Make sure to drop any device reference taken by vio_find_node() when
adding and removing virtual I/O slots.

Fixes: 5eeb8c63 ("[PATCH] PCI Hotplug: rpaphp: Move VIO registration")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

Add comment clarifying that vio_find_node() takes a reference to the
embedded struct device which needs to be dropped after use.
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

Make sure to drop any reference taken by bus_find_device() when creating
devices during init and driver registration.

Fixes: 55347cc9 ("[POWERPC] ibmebus: Add device creation and bus probing based on of_device")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

Make sure to drop any reference taken by bus_find_device() in the sysfs
callbacks that are used to create and destroy devices based on
device-tree entries.

Fixes: 6bccf755 ("[POWERPC] ibmebus: dynamic addition/removal of adapters, some code cleanup")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

This condenses the opal node searching into a single function that finds
all compatible nodes, instead of just searching the ibm,opal children,
for ipmi, flash, and prd similar to how opal-i2c nodes are found.
Signed-off-by: Jack Miller <jack@codezen.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

Load monitored is no longer supported on POWER9 so let's remove the
code.

This reverts commit bd3ea317 ("powerpc: Load Monitor Register
Support").
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

Load monitored won't be supported in POWER9, so PPC_FEATURE2_ARCH_3_00
(in HWCAP2) will no longer imply Load monitor support.

These Load monitored tests are enabled by PPC_FEATURE2_ARCH_3_00 so
they are now bogus and need to be removed.

This reverts commit 16c19a2e ("selftests/powerpc: Load Monitor
Register Tests").
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

No one uses reiserfs much these days, or is likely to in future. So drop
it from pseries and powernv defconfigs to save time and space. It's
still enabled in ppc64_defconfig so we get some build coverage.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

We can use the front led of powerbooks/ibooks to visualize disk activity
without the deprecated IDE_GD_ATA.
Signed-off-by: Elimar Riesebieter <riesebie@lxtec.de>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

In ISA v2.05, the tlbiel instruction takes two arguments, RB and L:

tlbiel RB,L

+---------+---------+----+---------+---------+---------+----+
|    31   |    /    | L  |    /    |    RB   |   274   | /  |
| 31 - 26 | 25 - 22 | 21 | 20 - 16 | 15 - 11 |  10 - 1 | 0  |
+---------+---------+----+---------+---------+---------+----+

In ISA v2.06 tlbiel takes only one argument, RB:

tlbiel RB

+---------+---------+---------+---------+---------+----+
|    31   |    /    |    /    |    RB   |   274   | /  |
| 31 - 26 | 25 - 21 | 20 - 16 | 15 - 11 |  10 - 1 | 0  |
+---------+---------+---------+---------+---------+----+

And in ISA v3.00 tlbiel takes five arguments:

tlbiel RB,RS,RIC,PRS,R

+---------+---------+----+---------+----+----+---------+---------+----+
|    31   |    RS   | /  |   RIC   |PRS | R  |    RB   |   274   | /  |
| 31 - 26 | 25 - 21 | 20 | 19 - 18 | 17 | 16 | 15 - 11 |  10 - 1 | 0  |
+---------+---------+----+---------+----+----+---------+---------+----+

However the assembler also accepts "tlbiel RB", and generates
"tlbiel RB,r0,0,0,0".

As you can see above the L field from the v2.05 encoding overlaps with the
reserved field of the v2.06 encoding, and the low bit of the RS field of the
v3.00 encoding.

Currently in __tlbiel() we generate two tlbiel instructions manually using hex
constants. In the first case, for MMU_PAGE_4K, we generate "tlbiel RB,0", which
is safe in all cases, because the L bit is zero.

However in the default case we generate "tlbiel RB,1", therefore setting bit 21
to 1.

This is not an actual bug on v2.06 processors, because the CPU ignores the value
of the reserved field. However software is supposed to encode the reserved
fields as zero to enable forward compatibility.

On v3.00 processors setting bit 21 to 1 and no other bits of RS, means we are
using r1 for the value of RS.

Although it's not obvious, the code sets the IS field (bits 10-11) to 0 (by
omission), and L=1, in the va value, which is passed as RB. We also pass R=0 in
the instruction.

The combination of IS=0, L=1 and R=0 means the value of RS is not used, so even
on ISA v3.00 there is no actual bug.

We should still fix it, as setting a reserved bit on v2.06 is naughty, and we
are only avoiding a bug on v3.00 by accident rather than design. Use
ASM_FTR_IFSET() to generate the single argument form on ISA v2.06 and later, and
the two argument form on pre v2.06.

Although there may be very old toolchains which don't understand tlbiel, we have
other code in the tree which has been using tlbiel for over five years, and no
one has reported any build failures, so just let the assembler generate the
instructions.
Signed-off-by: Balbir Singh <bsingharora@gmail.com>
[mpe: Rewrite change log, use IFSET instead of IFCLR]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

When we're not compiling for a specific CPU, ie. none of the
CONFIG_POWERx_CPU options are set, and CONFIG_GENERIC_CPU *is* set, we
currently don't pass any -mcpu option to the compiler. This means the
compiler builds for a "generic" Power CPU.

But back in 2014 we dropped support for pre power4 CPUs in commit
468a3302 ("powerpc: Drop support for pre-POWER4 cpus").

Given that, there's no point in building the kernel to run on pre power4
cpus. So update the flags we pass to the compiler when
CONFIG_GENERIC_CPU is set, to specify -mcpu=power4.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

This adds a config option that can help exercise the case when
the kernel is not running at PAGE_OFFSET.
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Balbir Singh <bsingharora@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

An hcall was recently added that does exactly what we need during kexec
- it clears the entire MMU hash table, ignoring any VRMA mappings.

Try it and fall back to the old method if we get a failure.

On a POWER8 box with 5TB of memory, this reduces the time it takes to
kexec a new kernel from from 4 minutes to 1 minute.
Signed-off-by: Anton Blanchard <anton@samba.org>
Tested-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
[mpe: Split into separate functions and tweak function naming]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

That's unclear why lockdep shows the following warning but adding a
lockdep class to struct pmac_i2c_bus solves it

[   20.507795] ======================================================
[   20.507796] [ INFO: possible circular locking dependency detected ]
[   20.507800] 4.8.0-rc7-00037-gd2ffb010 #21 Not tainted
[   20.507801] -------------------------------------------------------
[   20.507803] swapper/0/1 is trying to acquire lock:
[   20.507818]  (&bus->mutex){+.+.+.}, at: [<c000000000052830>] .pmac_i2c_open+0x30/0x100
[   20.507819]
[   20.507819] but task is already holding lock:
[   20.507829]  (&policy->rwsem){+.+.+.}, at: [<c00000000068adcc>] .cpufreq_online+0x1ac/0x9d0
[   20.507830]
[   20.507830] which lock already depends on the new lock.
[   20.507830]
[   20.507832]
[   20.507832] the existing dependency chain (in reverse order) is:
[   20.507837]
[   20.507837] -> #4 (&policy->rwsem){+.+.+.}:
[   20.507844]        [<c00000000082385c>] .down_write+0x6c/0x110
[   20.507849]        [<c00000000068adcc>] .cpufreq_online+0x1ac/0x9d0
[   20.507855]        [<c0000000004d76d8>] .subsys_interface_register+0xb8/0x110
[   20.507860]        [<c000000000689bb0>] .cpufreq_register_driver+0x1d0/0x250
[   20.507866]        [<c000000000b4f8f4>] .g5_cpufreq_init+0x9cc/0xa28
[   20.507872]        [<c00000000000a98c>] .do_one_initcall+0x5c/0x1d0
[   20.507878]        [<c000000000b0f86c>] .kernel_init_freeable+0x1ac/0x28c
[   20.507883]        [<c00000000000b3bc>] .kernel_init+0x1c/0x140
[   20.507887]        [<c0000000000098f4>] .ret_from_kernel_thread+0x58/0x64
[   20.507894]
[   20.507894] -> #3 (subsys mutex#2){+.+.+.}:
[   20.507899]        [<c000000000820448>] .mutex_lock_nested+0xa8/0x590
[   20.507903]        [<c0000000004d7f24>] .bus_probe_device+0x44/0xe0
[   20.507907]        [<c0000000004d5208>] .device_add+0x508/0x730
[   20.507911]        [<c0000000004dd528>] .register_cpu+0x118/0x190
[   20.507916]        [<c000000000b14450>] .topology_init+0x148/0x248
[   20.507921]        [<c00000000000a98c>] .do_one_initcall+0x5c/0x1d0
[   20.507925]        [<c000000000b0f86c>] .kernel_init_freeable+0x1ac/0x28c
[   20.507929]        [<c00000000000b3bc>] .kernel_init+0x1c/0x140
[   20.507934]        [<c0000000000098f4>] .ret_from_kernel_thread+0x58/0x64
[   20.507939]
[   20.507939] -> #2 (cpu_add_remove_lock){+.+.+.}:
[   20.507944]        [<c000000000820448>] .mutex_lock_nested+0xa8/0x590
[   20.507950]        [<c000000000087a9c>] .register_cpu_notifier+0x2c/0x70
[   20.507955]        [<c000000000b267e0>] .spawn_ksoftirqd+0x18/0x4c
[   20.507959]        [<c00000000000a98c>] .do_one_initcall+0x5c/0x1d0
[   20.507964]        [<c000000000b0f770>] .kernel_init_freeable+0xb0/0x28c
[   20.507968]        [<c00000000000b3bc>] .kernel_init+0x1c/0x140
[   20.507972]        [<c0000000000098f4>] .ret_from_kernel_thread+0x58/0x64
[   20.507978]
[   20.507978] -> #1 (&host->mutex){+.+.+.}:
[   20.507982]        [<c000000000820448>] .mutex_lock_nested+0xa8/0x590
[   20.507987]        [<c0000000000527e8>] .kw_i2c_open+0x18/0x30
[   20.507991]        [<c000000000052894>] .pmac_i2c_open+0x94/0x100
[   20.507995]        [<c000000000b220a0>] .smp_core99_probe+0x260/0x410
[   20.507999]        [<c000000000b185bc>] .smp_prepare_cpus+0x280/0x2ac
[   20.508003]        [<c000000000b0f748>] .kernel_init_freeable+0x88/0x28c
[   20.508008]        [<c00000000000b3bc>] .kernel_init+0x1c/0x140
[   20.508012]        [<c0000000000098f4>] .ret_from_kernel_thread+0x58/0x64
[   20.508018]
[   20.508018] -> #0 (&bus->mutex){+.+.+.}:
[   20.508023]        [<c0000000000ed5b4>] .lock_acquire+0x84/0x100
[   20.508027]        [<c000000000820448>] .mutex_lock_nested+0xa8/0x590
[   20.508032]        [<c000000000052830>] .pmac_i2c_open+0x30/0x100
[   20.508037]        [<c000000000052e14>] .pmac_i2c_do_begin+0x34/0x120
[   20.508040]        [<c000000000056bc0>] .pmf_call_one+0x50/0xd0
[   20.508045]        [<c00000000068ff1c>] .g5_pfunc_switch_volt+0x2c/0xc0
[   20.508050]        [<c00000000068fecc>] .g5_pfunc_switch_freq+0x1cc/0x1f0
[   20.508054]        [<c00000000068fc2c>] .g5_cpufreq_target+0x2c/0x40
[   20.508058]        [<c0000000006873ec>] .__cpufreq_driver_target+0x23c/0x840
[   20.508062]        [<c00000000068c798>] .cpufreq_gov_performance_limits+0x18/0x30
[   20.508067]        [<c00000000068915c>] .cpufreq_start_governor+0xac/0x100
[   20.508071]        [<c00000000068a788>] .cpufreq_set_policy+0x208/0x260
[   20.508076]        [<c00000000068abdc>] .cpufreq_init_policy+0x6c/0xb0
[   20.508081]        [<c00000000068ae70>] .cpufreq_online+0x250/0x9d0
[   20.508085]        [<c0000000004d76d8>] .subsys_interface_register+0xb8/0x110
[   20.508090]        [<c000000000689bb0>] .cpufreq_register_driver+0x1d0/0x250
[   20.508094]        [<c000000000b4f8f4>] .g5_cpufreq_init+0x9cc/0xa28
[   20.508099]        [<c00000000000a98c>] .do_one_initcall+0x5c/0x1d0
[   20.508103]        [<c000000000b0f86c>] .kernel_init_freeable+0x1ac/0x28c
[   20.508107]        [<c00000000000b3bc>] .kernel_init+0x1c/0x140
[   20.508112]        [<c0000000000098f4>] .ret_from_kernel_thread+0x58/0x64
[   20.508113]
[   20.508113] other info that might help us debug this:
[   20.508113]
[   20.508121] Chain exists of:
[   20.508121]   &bus->mutex --> subsys mutex#2 --> &policy->rwsem
[   20.508121]
[   20.508123]  Possible unsafe locking scenario:
[   20.508123]
[   20.508124]        CPU0                    CPU1
[   20.508125]        ----                    ----
[   20.508128]   lock(&policy->rwsem);
[   20.508132]                                lock(subsys mutex#2);
[   20.508135]                                lock(&policy->rwsem);
[   20.508138]   lock(&bus->mutex);
[   20.508139]
[   20.508139]  *** DEADLOCK ***
[   20.508139]
[   20.508141] 3 locks held by swapper/0/1:
[   20.508150]  #0:  (cpu_hotplug.lock){++++++}, at: [<c000000000087838>] .get_online_cpus+0x48/0xc0
[   20.508159]  #1:  (subsys mutex#2){+.+.+.}, at: [<c0000000004d7670>] .subsys_interface_register+0x50/0x110
[   20.508168]  #2:  (&policy->rwsem){+.+.+.}, at: [<c00000000068adcc>] .cpufreq_online+0x1ac/0x9d0
[   20.508169]
[   20.508169] stack backtrace:
[   20.508173] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.8.0-rc7-00037-gd2ffb010 #21
[   20.508175] Call Trace:
[   20.508180] [c0000000790c2b90] [c00000000082cc70] .dump_stack+0xe0/0x14c (unreliable)
[   20.508184] [c0000000790c2c20] [c000000000828c88] .print_circular_bug+0x350/0x388
[   20.508188] [c0000000790c2cd0] [c0000000000ecb0c] .__lock_acquire+0x196c/0x1d30
[   20.508192] [c0000000790c2e50] [c0000000000ed5b4] .lock_acquire+0x84/0x100
[   20.508196] [c0000000790c2f20] [c000000000820448] .mutex_lock_nested+0xa8/0x590
[   20.508201] [c0000000790c3030] [c000000000052830] .pmac_i2c_open+0x30/0x100
[   20.508206] [c0000000790c30c0] [c000000000052e14] .pmac_i2c_do_begin+0x34/0x120
[   20.508209] [c0000000790c3150] [c000000000056bc0] .pmf_call_one+0x50/0xd0
[   20.508213] [c0000000790c31e0] [c00000000068ff1c] .g5_pfunc_switch_volt+0x2c/0xc0
[   20.508217] [c0000000790c3250] [c00000000068fecc] .g5_pfunc_switch_freq+0x1cc/0x1f0
[   20.508221] [c0000000790c3320] [c00000000068fc2c] .g5_cpufreq_target+0x2c/0x40
[   20.508226] [c0000000790c3390] [c0000000006873ec] .__cpufreq_driver_target+0x23c/0x840
[   20.508230] [c0000000790c3440] [c00000000068c798] .cpufreq_gov_performance_limits+0x18/0x30
[   20.508235] [c0000000790c34b0] [c00000000068915c] .cpufreq_start_governor+0xac/0x100
[   20.508239] [c0000000790c3530] [c00000000068a788] .cpufreq_set_policy+0x208/0x260
[   20.508244] [c0000000790c35d0] [c00000000068abdc] .cpufreq_init_policy+0x6c/0xb0
[   20.508249] [c0000000790c3940] [c00000000068ae70] .cpufreq_online+0x250/0x9d0
[   20.508253] [c0000000790c3a30] [c0000000004d76d8] .subsys_interface_register+0xb8/0x110
[   20.508258] [c0000000790c3ad0] [c000000000689bb0] .cpufreq_register_driver+0x1d0/0x250
[   20.508262] [c0000000790c3b60] [c000000000b4f8f4] .g5_cpufreq_init+0x9cc/0xa28
[   20.508267] [c0000000790c3c20] [c00000000000a98c] .do_one_initcall+0x5c/0x1d0
[   20.508271] [c0000000790c3d00] [c000000000b0f86c] .kernel_init_freeable+0x1ac/0x28c
[   20.508276] [c0000000790c3db0] [c00000000000b3bc] .kernel_init+0x1c/0x140
[   20.508280] [c0000000790c3e30] [c0000000000098f4] .ret_from_kernel_thread+0x58/0x64
Signed-off-by: Denis Kirjanov <kda@linux-powerpc.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

This halves the exception table size on 64-bit builds, and it allows
build-time sorting of exception tables to work on relocated kernels.
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
[mpe: Minor asm fixups and bits to keep the selftests working]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

This macro is taken from s390, and allows more flexibility in
changing exception table format.

mpe: Put it in ppc_asm.h and only define one version using
stringinfy_in_c(). Add some empty definitions and headers to keep the
selftests happy.
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

If the result returned by load_unaligned_zeropad() doesn't match what we
expect we should fail the test!
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

If the load unaligned zeropad test takes a SEGV which can't be handled,
we increment segv_error, print the offending NIP and then return without
taking any further action. In almost all cases this means we'll just
take the SEGV again, and loop eternally spamming the console.

Instead just abort(), it's a fatal error in the test. The test harness
will notice that the child died and print a nice message for us.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

We haven't seen these before, but the soon to be merged relative
exception tables support causes them to be generated.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

There's no reason to #error if we include ppc_asm.h in asm files, the
ifdef already prevents any problems.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

Exception handlers are aligned to 128 bytes (L1 cache) on 64s, which is
overkill. It can reduce the icache footprint of any individual exception
path. However taken as a whole, the expansion in icache footprint seems
likely to be counter-productive and cause more total misses.

Create IFETCH_ALIGN_SHIFT/BYTES, which should give optimal ifetch
alignment with much more reasonable alignment. This saves 1792 bytes
from head_64.o text with an allmodconfig build.

Other subarchitectures should define appropriate IFETCH_ALIGN_SHIFT
values if this becomes more widely used.
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

There are three #ifdef CONFIG_PPC_BOOK3E sections in nohash/64/pgtable.h.
And there should be no configurations possible which use nohash/64/pgtable.h
but don't also enable CONFIG_PPC_BOOK3E.
Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Rui Teng <rui.teng@linux.vnet.ibm.com>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

Pull in a version of Anton's null_syscall benchmark:
  http://ozlabs.org/~anton/junkcode/null_syscall.cSuggested-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Anton Blanchard <anton@au.ibm.com>
Signed-off-by: Rui Teng <rui.teng@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

Pull KVM fixes from Paolo Bonzini:
 "ARM fixes.  There are a couple pending x86 patches but they'll have to
  wait for next week"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: arm/arm64: vgic: Kick VCPUs when queueing already pending IRQs
  KVM: arm/arm64: vgic: Prevent access to invalid SPIs
  arm/arm64: KVM: Perform local TLB invalidation when multiplexing vcpus on a single CPU

Merge media fixes from Mauro Carvalho Chehab:
 "This contains two patches fixing problems with my patch series meant
  to make USB drivers to work again after the DMA on stack changes.

  The last patch on this series is actually not related to DMA on stack.
  It solves a longstanding bug affecting module unload, causing
  module_put() to be called twice. It was reported by the user who
  reported and tested the issues with the gp8psk driver with the DMA
  fixup patches. As we're late at -rc cycle, maybe you prefer to not
  apply it right now. If this is the case, I'll add to the pile of
  patches for 4.10.

  Exceptionally this time, I'm sending the patches via e-mail, because
  I'm on another trip, and won't be able to use the usual procedure
  until Monday. Also, it is only three patches, and you followed already
  the discussions about the first one"

* emailed patches from Mauro Carvalho Chehab <mchehab@osg.samsung.com>:
  gp8psk: Fix DVB frontend attach
  gp8psk: fix gp8psk_usb_in_op() logic
  dvb-usb: move data_mutex to struct dvb_usb_device

Pull char/misc fixes from Greg KH:
 "Here are three small driver fixes for some reported issues for
  4.9-rc5.

  One for the hyper-v subsystem, fixing up a naming issue that showed up
  in 4.9-rc1, one mei driver fix, and one fix for parallel ports,
  resolving a reported regression.

  All have been in linux-next with no reported issues"

* tag 'char-misc-4.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  ppdev: fix double-free of pp->pdev->name
  vmbus: make sysfs names consistent with PCI
  mei: bus: fix received data size check in NFC fixup

Pull driver core fixes from Greg KH:
 "Here are two driver core fixes for 4.9-rc5.

  The first resolves an issue with some drivers not liking to be unbound
  and bound again (if CONFIG_DEBUG_TEST_DRIVER_REMOVE is enabled), which
  solves some reported problems with graphics and storage drivers. The
  other resolves a smatch error with the 4.9-rc1 driver core changes
  around this feature.

  Both have been in linux-next with no reported issues"

* tag 'driver-core-4.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  driver core: fix smatch warning on dev->bus check
  driver core: skip removal test for non-removable drivers

Pull staging/IIO fixes from Grek KH:
 "Here are a few small staging and iio driver fixes for reported issues.

  The last one was cherry-picked from my -next branch to resolve a build
  warning that Arnd fixed, in his quest to be able to turn
  -Wmaybe-uninitialized back on again. That patch, and all of the
  others, have been in linux-next for a while with no reported issues"

* tag 'staging-4.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  iio: maxim_thermocouple: detect invalid storage size in read()
  staging: nvec: remove managed resource from PS2 driver
  Revert "staging: nvec: ps2: change serio type to passthrough"
  drivers: staging: nvec: remove bogus reset command for PS/2 interface
  staging: greybus: arche-platform: fix device reference leak
  staging: comedi: ni_tio: fix buggy ni_tio_clock_period_ps() return value
  staging: sm750fb: Fix bugs introduced by early commits
  iio: hid-sensors: Increase the precision of scale to fix wrong reading interpretation.
  iio: orientation: hid-sensor-rotation: Add PM function (fix non working driver)
  iio: st_sensors: fix scale configuration for h3lis331dl
  staging: iio: ad5933: avoid uninitialized variable in error case

Pull USB / PHY fixes from Greg KH:
 "Here are a number of small USB and PHY driver fixes for 4.9-rc5

  Nothing major, just small fixes for reported issues, all of these have
  been in linux-next for a while with no reported issues"

* tag 'usb-4.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: cdc-acm: fix TIOCMIWAIT
  cdc-acm: fix uninitialized variable
  drivers/usb: Skip auto handoff for TI and RENESAS usb controllers
  usb: musb: remove duplicated actions
  usb: musb: da8xx: Don't print phy error on -EPROBE_DEFER
  phy: sun4i: check PMU presence when poking unknown bit of pmu
  phy-rockchip-pcie: remove deassert of phy_rst from exit callback
  phy: da8xx-usb: rename the ohci device to ohci-da8xx
  phy: Add reset callback for not generic phy
  uwb: fix device reference leaks
  usb: gadget: u_ether: remove interrupt throttling
  usb: dwc3: st: add missing <linux/pinctrl/consumer.h> include
  usb: dwc3: Fix error handling for core init

Pull more block fixes from Jens Axboe:
 "Since I mistakenly left out the lightnvm regression fix yesterday and
  the aoeblk seems adequately tested at this point, might as well send
  out another pull to make -rc5"

* 'for-linus' of git://git.kernel.dk/linux-block:
  aoe: fix crash in page count manipulation
  lightnvm: invalid offset calculation for lba_shift

Pull SCSI fixes from James Bottomley:
 "The megaraid_sas patch in here fixes a major regression in the last
  fix set that made all megaraid_sas cards unusable. It turns out no-one
  had actually tested such an "obvious" fix, sigh. The fix for the fix
  has been tested ...

  The next most serious is the vmw_pvscsi abort problem which basically
  means that aborts don't work on the vmware paravirt devices and error
  handling always escalates to reset.

  The rest are an assortment of missed reference counting in certain
  paths and corner case bugs that show up on some architectures"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: megaraid_sas: fix macro MEGASAS_IS_LOGICAL to avoid regression
  scsi: qla2xxx: fix invalid DMA access after command aborts in PCI device remove
  scsi: qla2xxx: do not queue commands when unloading
  scsi: libcxgbi: fix incorrect DDP resource cleanup
  scsi: qla2xxx: Fix scsi scan hang triggered if adapter fails during init
  scsi: scsi_dh_alua: Fix a reference counting bug
  scsi: vmw_pvscsi: return SUCCESS for successful command aborts
  scsi: mpt3sas: Fix for block device of raid exists even after deleting raid disk
  scsi: scsi_dh_alua: fix missing kref_put() in alua_rtpg_work()

Pull clk fixes from Stephen Boyd:
 "The typical collection of minor bug fixes in clk drivers. We don't
  have anything in the core framework here, just driver fixes.

  There's a boot fix for Samsung devices and a safety measure for qoriq
  to prevent CPUs from running too fast. There's also a fix for i.MX6Q
  to properly handle audio clock rates. We also have some "that's
  obviously wrong" fixes like bad NULL pointer checks in the MPP driver
  and a poor usage of __pa in the xgene clk driver that are fixed here"

* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
  clk: mmp: pxa910: fix return value check in pxa910_clk_init()
  clk: mmp: pxa168: fix return value check in pxa168_clk_init()
  clk: mmp: mmp2: fix return value check in mmp2_clk_init()
  clk: qoriq: Don't allow CPU clocks higher than starting value
  clk: imx: fix integer overflow in AV PLL round rate
  clk: xgene: Don't call __pa on ioremaped address
  clk/samsung: Use CLK_OF_DECLARE_DRIVER initialization method for CLKOUT
  clk: rockchip: don't return NULL when failing to register ddrclk branch

The DVB binding schema at the DVB core assumes that the frontend is a
separate driver.  Faling to do that causes OOPS when the module is
removed, as it tries to do a symbol_put_addr on an internal symbol,
causing craches like:

    WARNING: CPU: 1 PID: 28102 at kernel/module.c:1108 module_put+0x57/0x70
    Modules linked in: dvb_usb_gp8psk(-) dvb_usb dvb_core nvidia_drm(PO) nvidia_modeset(PO) snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd soundcore nvidia(PO) [last unloaded: rc_core]
    CPU: 1 PID: 28102 Comm: rmmod Tainted: P        WC O 4.8.4-build.1 #1
    Hardware name: MSI MS-7309/MS-7309, BIOS V1.12 02/23/2009
    Call Trace:
       dump_stack+0x44/0x64
       __warn+0xfa/0x120
       module_put+0x57/0x70
       module_put+0x57/0x70
       warn_slowpath_null+0x23/0x30
       module_put+0x57/0x70
       gp8psk_fe_set_frontend+0x460/0x460 [dvb_usb_gp8psk]
       symbol_put_addr+0x27/0x50
       dvb_usb_adapter_frontend_exit+0x3a/0x70 [dvb_usb]

From Derek's tests:
    "Attach bug is fixed, tuning works, module unloads without
     crashing. Everything seems ok!"
Reported-by: Derek <user.vdr@gmail.com>
Tested-by: Derek <user.vdr@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Commit bc29131ecb10 ("[media] gp8psk: don't do DMA on stack") fixed the
usage of DMA on stack, but the memcpy was wrong for gp8psk_usb_in_op().
Fix it.

From Derek's email:
    "Fix confirmed using 2 different Skywalker models with
     HD mpeg4, SD mpeg2."
Suggested-by: Johannes Stezenbach <js@linuxtv.org>
Fixes: bc29131ecb10 ("[media] gp8psk: don't do DMA on stack")
Tested-by: Derek <user.vdr@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The data_mutex is initialized too late, as it is needed for
each device driver's power control, causing an OOPS:

    dvb-usb: found a 'TerraTec/qanu USB2.0 Highspeed DVB-T Receiver' in warm state.
    BUG: unable to handle kernel NULL pointer dereference at           (null)
    IP: [<ffffffff846617af>] __mutex_lock_slowpath+0x6f/0x100 PGD 0
    Oops: 0002 [#1] SMP
    Modules linked in: dvb_usb_cinergyT2(+) dvb_usb
    CPU: 0 PID: 2029 Comm: modprobe Not tainted 4.9.0-rc4-dvbmod #24
    Hardware name: FUJITSU LIFEBOOK A544/FJNBB35 , BIOS Version 1.17 05/09/2014
    task: ffff88020e943840 task.stack: ffff8801f36ec000
    RIP: 0010:[<ffffffff846617af>]  [<ffffffff846617af>] __mutex_lock_slowpath+0x6f/0x100
    RSP: 0018:ffff8801f36efb10  EFLAGS: 00010282
    RAX: 0000000000000000 RBX: ffff88021509bdc8 RCX: 00000000c0000100
    RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff88021509bdcc
    RBP: ffff8801f36efb58 R08: ffff88021f216320 R09: 0000000000100000
    R10: ffff88021f216320 R11: 00000023fee6c5a1 R12: ffff88020e943840
    R13: ffff88021509bdcc R14: 00000000ffffffff R15: ffff88021509bdd0
    FS:  00007f21adb86740(0000) GS:ffff88021f200000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000000 CR3: 0000000215bce000 CR4: 00000000001406f0
    Call Trace:
       mutex_lock+0x16/0x25
       cinergyt2_power_ctrl+0x1f/0x60 [dvb_usb_cinergyT2]
       dvb_usb_device_init+0x21e/0x5d0 [dvb_usb]
       cinergyt2_usb_probe+0x21/0x50 [dvb_usb_cinergyT2]
       usb_probe_interface+0xf3/0x2a0
       driver_probe_device+0x208/0x2b0
       __driver_attach+0x87/0x90
       driver_probe_device+0x2b0/0x2b0
       bus_for_each_dev+0x52/0x80
       bus_add_driver+0x1a3/0x220
       driver_register+0x56/0xd0
       usb_register_driver+0x77/0x130
       do_one_initcall+0x46/0x180
       free_vmap_area_noflush+0x38/0x70
       kmem_cache_alloc+0x84/0xc0
       do_init_module+0x50/0x1be
       load_module+0x1d8b/0x2100
       find_symbol_in_section+0xa0/0xa0
       SyS_finit_module+0x89/0x90
       entry_SYSCALL_64_fastpath+0x13/0x94
    Code: e8 a7 1d 00 00 8b 03 83 f8 01 0f 84 97 00 00 00 48 8b 43 10 4c 8d 7b 08 48 89 63 10 4c 89 3c 24 41 be ff ff ff ff 48 89 44 24 08 <48> 89 20 4c 89 64 24 10 eb 1a 49 c7 44 24 08 02 00 00 00 c6 43 RIP  [<ffffffff846617af>] __mutex_lock_slowpath+0x6f/0x100 RSP <ffff8801f36efb10>
    CR2: 0000000000000000

So, move it to the struct dvb_usb_device and initialize it
before calling the driver's callbacks.
Reported-by: Jörg Otte <jrg.otte@gmail.com>
Tested-by: Jörg Otte <jrg.otte@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

As found by gcc -Wmaybe-uninitialized, having a storage_bytes value other
than 2 or 4 will result in undefined behavior:

drivers/iio/temperature/maxim_thermocouple.c: In function 'maxim_thermocouple_read':
drivers/iio/temperature/maxim_thermocouple.c:141:5: error: 'ret' may be used uninitialized in this function [-Werror=maybe-uninitialized]

This probably cannot happen, but returning -EINVAL here is appropriate
and makes gcc happy and the code more robust.

Fixes: 231147ee ("iio: maxim_thermocouple: Align 16 bit big endian value of raw reads")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
(cherry picked from commit 32cb7d27)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

aoeblk contains some mysterious code, that wants to elevate the bio
vec page counts while it's under IO. That is not needed, it's
fragile, and it's causing kernel oopses for some.
Reported-by: Tested-by: Don Koch <kochd@us.ibm.com>
Tested-by: Tested-by: Don Koch <kochd@us.ibm.com>
Signed-off-by: Jens Axboe <axboe@fb.com>