--- /dev/null
+From 037e119738120c1cdc460c6ae33871c3000531f3 Mon Sep 17 00:00:00 2001
+From: Conrad Kostecki <ck+linuxkernel@bl4ckb0x.de>
+Date: Tue, 26 Apr 2016 10:08:10 +0200
+Subject: ALSA: hda - Add dock support for ThinkPad X260
+
+From: Conrad Kostecki <ck+linuxkernel@bl4ckb0x.de>
+
+commit 037e119738120c1cdc460c6ae33871c3000531f3 upstream.
+
+Fixes audio output on a ThinkPad X260, when using Lenovo CES 2013
+docking station series (basic, pro, ultra).
+
+Signed-off-by: Conrad Kostecki <ck+linuxkernel@bl4ckb0x.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5584,6 +5584,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x5034, "Thinkpad T450", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK),
++ SND_PCI_QUIRK(0x17aa, 0x504a, "ThinkPad X260", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
+ SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
--- /dev/null
+From 9859a971ca228725425238756ee89c6133306ec8 Mon Sep 17 00:00:00 2001
+From: "Lu, Han" <han.lu@intel.com>
+Date: Wed, 20 Apr 2016 10:08:43 +0800
+Subject: ALSA: hda - add PCI ID for Intel Broxton-T
+
+From: Lu, Han <han.lu@intel.com>
+
+commit 9859a971ca228725425238756ee89c6133306ec8 upstream.
+
+Add HD Audio Device PCI ID for the Intel Broxton-T platform.
+It is an HDA Intel PCH controller.
+
+Signed-off-by: Lu, Han <han.lu@intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2232,6 +2232,9 @@ static const struct pci_device_id azx_id
+ /* Broxton-P(Apollolake) */
+ { PCI_DEVICE(0x8086, 0x5a98),
+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON },
++ /* Broxton-T */
++ { PCI_DEVICE(0x8086, 0x1a98),
++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON },
+ /* Haswell */
+ { PCI_DEVICE(0x8086, 0x0a0c),
+ .driver_data = AZX_DRIVER_HDMI | AZX_DCAPS_INTEL_HASWELL },
--- /dev/null
+From 50fd4987c4f3c3ebf0ce94d932732011bbdc7c71 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sun, 17 Apr 2016 09:39:41 +0200
+Subject: ALSA: hda - Don't trust the reported actual power state
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 50fd4987c4f3c3ebf0ce94d932732011bbdc7c71 upstream.
+
+We've got a regression report that the recording on Mac with a cirrus
+codec doesn't work any longer. This turned out to be the missing
+power up to D0 by power_save_node enablement.
+
+After analyzing the traces, we found out that the culprit is that the
+codec advertises the "actual" power state of a few nodes to be D0
+while the "target" power state is D3. This inconsistency is usually
+OK, as it implies the power transition. But in the case of cirrus
+codec, this seems to be stuck to D3 while it's not actually D0.
+
+This patch addresses the issue by checking the power state difference
+more strictly. It sends the power-state change verb unless both the
+target and the actual power states show the given value.
+
+We may introduce yet another flag indicating the possible broken
+hardware power state, but it's anyway safer to set the proper power
+state even in a transition (at least it's harmless as long as the
+target state is same). So this simpler change was applied now.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_generic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -826,7 +826,7 @@ static hda_nid_t path_power_update(struc
+ bool allow_powerdown)
+ {
+ hda_nid_t nid, changed = 0;
+- int i, state;
++ int i, state, power;
+
+ for (i = 0; i < path->depth; i++) {
+ nid = path->path[i];
+@@ -838,7 +838,9 @@ static hda_nid_t path_power_update(struc
+ state = AC_PWRST_D0;
+ else
+ state = AC_PWRST_D3;
+- if (!snd_hda_check_power_state(codec, nid, state)) {
++ power = snd_hda_codec_read(codec, nid, 0,
++ AC_VERB_GET_POWER_STATE, 0);
++ if (power != (state | (state << 4))) {
+ snd_hda_codec_write(codec, nid, 0,
+ AC_VERB_SET_POWER_STATE, state);
+ changed = nid;
--- /dev/null
+From de3df8a986b635082a1d94bae2c361d043c57106 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 19 Apr 2016 22:07:50 +0200
+Subject: ALSA: hda - Keep powering up ADCs on Cirrus codecs
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit de3df8a986b635082a1d94bae2c361d043c57106 upstream.
+
+Although one weird behavior about the input path (inconsistent D0/D3
+switch) on Cirrus CS420x codecs was fixed in the previous commit,
+there is still an issue on some Mac machines: the capture stream
+stalls when switching the ADCs on the fly. More badly, this keeps
+stuck until the next reboot.
+
+The dynamic ADC switching is already a bit fragile and assuming
+optimistically that the chip accepts the frequent power changes. On
+Cirrus codecs, this doesn't seem applicable.
+
+As a quick workaround, we pin down the ADCs to keep up in D0 when
+spec->dyn_adc_switch is set. In this way, the ADCs are kept up only
+for the system that were confirmed to be broken.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_cirrus.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -361,6 +361,7 @@ static int cs_parse_auto_config(struct h
+ {
+ struct cs_spec *spec = codec->spec;
+ int err;
++ int i;
+
+ err = snd_hda_parse_pin_defcfg(codec, &spec->gen.autocfg, NULL, 0);
+ if (err < 0)
+@@ -370,6 +371,19 @@ static int cs_parse_auto_config(struct h
+ if (err < 0)
+ return err;
+
++ /* keep the ADCs powered up when it's dynamically switchable */
++ if (spec->gen.dyn_adc_switch) {
++ unsigned int done = 0;
++ for (i = 0; i < spec->gen.input_mux.num_items; i++) {
++ int idx = spec->gen.dyn_adc_idx[i];
++ if (done & (1 << idx))
++ continue;
++ snd_hda_gen_fix_pin_power(codec,
++ spec->gen.adc_nids[idx]);
++ done |= 1 << idx;
++ }
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From afecb146d8d8a60a1dde9cdf570c278649617fde Mon Sep 17 00:00:00 2001
+From: Bastien Nocera <hadess@hadess.net>
+Date: Mon, 18 Apr 2016 11:10:42 +0200
+Subject: ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m
+
+From: Bastien Nocera <hadess@hadess.net>
+
+commit afecb146d8d8a60a1dde9cdf570c278649617fde upstream.
+
+The Optiplex 9020m with Haswell-DT processor needs a quirk for the
+headset jack at the front of the machine to be able to use microphones.
+
+A quirk for this model was originally added in 3127899, but c77900e
+removed it in favour of a more generic version.
+
+Unfortunately, pin configurations can changed based on firmware/BIOS
+versions, and the generic version doesn't have any effect on newer
+versions of the machine/firmware anymore.
+
+With help from David Henningsson <diwic@ubuntu.com>
+
+Signed-off-by: Bastien Nocera <hadess@hadess.net>
+Tested-by: Bastien Nocera <hadess@hadess.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5449,6 +5449,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0665, "Dell XPS 13", ALC288_FIXUP_DELL_XPS_13),
++ SND_PCI_QUIRK(0x1028, 0x0669, "Dell Optiplex 9020m", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x069a, "Dell Vostro 5480", ALC290_FIXUP_SUBWOOFER_HSJACK),
+ SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
--- /dev/null
+From bb03ed216370cb021f377f923471e56d1de3ff5d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 21 Apr 2016 16:39:17 +0200
+Subject: ALSA: hda - Update BCLK also at hotplug for i915 HSW/BDW
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit bb03ed216370cb021f377f923471e56d1de3ff5d upstream.
+
+The recent bug report suggests that BCLK setup for i915 HSW/BDW needs
+to be updated at each HDMI hotplug, not only at initialization and
+resume. That is, we need to update HSW_EM4 and HSW_EM5 registers at
+ELD notification, too. Otherwise the HDMI audio may be out of sync
+and played in a wrong pitch.
+
+However, the HDA codec driver has no access to the controller
+registers, and currently the code managing these registers is in
+hda_intel.c, i.e. local to the controller driver. For allowing the
+explicit BCLK update from the codec driver, as in this patch, the
+former haswell_set_bclk() in hda_intel.c is moved to hdac_i915.c and
+exposed as snd_hdac_i915_set_bclk(). This is called from both the HDA
+controller driver and intel_pin_eld_notify() in HDMI codec driver.
+
+Along with this change, snd_hdac_get_display_clk() gets dropped as
+it's no longer used.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91410
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/sound/hda_i915.h | 5 +--
+ sound/hda/hdac_i915.c | 62 +++++++++++++++++++++++++++++++++++++--------
+ sound/pci/hda/hda_intel.c | 56 ++--------------------------------------
+ sound/pci/hda/patch_hdmi.c | 1
+ 4 files changed, 58 insertions(+), 66 deletions(-)
+
+--- a/include/sound/hda_i915.h
++++ b/include/sound/hda_i915.h
+@@ -9,7 +9,7 @@
+ #ifdef CONFIG_SND_HDA_I915
+ int snd_hdac_set_codec_wakeup(struct hdac_bus *bus, bool enable);
+ int snd_hdac_display_power(struct hdac_bus *bus, bool enable);
+-int snd_hdac_get_display_clk(struct hdac_bus *bus);
++void snd_hdac_i915_set_bclk(struct hdac_bus *bus);
+ int snd_hdac_sync_audio_rate(struct hdac_bus *bus, hda_nid_t nid, int rate);
+ int snd_hdac_acomp_get_eld(struct hdac_bus *bus, hda_nid_t nid,
+ bool *audio_enabled, char *buffer, int max_bytes);
+@@ -25,9 +25,8 @@ static inline int snd_hdac_display_power
+ {
+ return 0;
+ }
+-static inline int snd_hdac_get_display_clk(struct hdac_bus *bus)
++static inline void snd_hdac_i915_set_bclk(struct hdac_bus *bus)
+ {
+- return 0;
+ }
+ static inline int snd_hdac_sync_audio_rate(struct hdac_bus *bus, hda_nid_t nid,
+ int rate)
+--- a/sound/hda/hdac_i915.c
++++ b/sound/hda/hdac_i915.c
+@@ -20,6 +20,7 @@
+ #include <sound/core.h>
+ #include <sound/hdaudio.h>
+ #include <sound/hda_i915.h>
++#include <sound/hda_register.h>
+
+ static struct i915_audio_component *hdac_acomp;
+
+@@ -97,26 +98,65 @@ int snd_hdac_display_power(struct hdac_b
+ }
+ EXPORT_SYMBOL_GPL(snd_hdac_display_power);
+
++#define CONTROLLER_IN_GPU(pci) (((pci)->device == 0x0a0c) || \
++ ((pci)->device == 0x0c0c) || \
++ ((pci)->device == 0x0d0c) || \
++ ((pci)->device == 0x160c))
++
+ /**
+- * snd_hdac_get_display_clk - Get CDCLK in kHz
++ * snd_hdac_i915_set_bclk - Reprogram BCLK for HSW/BDW
+ * @bus: HDA core bus
+ *
+- * This function is supposed to be used only by a HD-audio controller
+- * driver that needs the interaction with i915 graphics.
++ * Intel HSW/BDW display HDA controller is in GPU. Both its power and link BCLK
++ * depends on GPU. Two Extended Mode registers EM4 (M value) and EM5 (N Value)
++ * are used to convert CDClk (Core Display Clock) to 24MHz BCLK:
++ * BCLK = CDCLK * M / N
++ * The values will be lost when the display power well is disabled and need to
++ * be restored to avoid abnormal playback speed.
+ *
+- * This function queries CDCLK value in kHz from the graphics driver and
+- * returns the value. A negative code is returned in error.
++ * Call this function at initializing and changing power well, as well as
++ * at ELD notifier for the hotplug.
+ */
+-int snd_hdac_get_display_clk(struct hdac_bus *bus)
++void snd_hdac_i915_set_bclk(struct hdac_bus *bus)
+ {
+ struct i915_audio_component *acomp = bus->audio_component;
++ struct pci_dev *pci = to_pci_dev(bus->dev);
++ int cdclk_freq;
++ unsigned int bclk_m, bclk_n;
++
++ if (!acomp || !acomp->ops || !acomp->ops->get_cdclk_freq)
++ return; /* only for i915 binding */
++ if (!CONTROLLER_IN_GPU(pci))
++ return; /* only HSW/BDW */
++
++ cdclk_freq = acomp->ops->get_cdclk_freq(acomp->dev);
++ switch (cdclk_freq) {
++ case 337500:
++ bclk_m = 16;
++ bclk_n = 225;
++ break;
++
++ case 450000:
++ default: /* default CDCLK 450MHz */
++ bclk_m = 4;
++ bclk_n = 75;
++ break;
++
++ case 540000:
++ bclk_m = 4;
++ bclk_n = 90;
++ break;
++
++ case 675000:
++ bclk_m = 8;
++ bclk_n = 225;
++ break;
++ }
+
+- if (!acomp || !acomp->ops)
+- return -ENODEV;
+-
+- return acomp->ops->get_cdclk_freq(acomp->dev);
++ snd_hdac_chip_writew(bus, HSW_EM4, bclk_m);
++ snd_hdac_chip_writew(bus, HSW_EM5, bclk_n);
+ }
+-EXPORT_SYMBOL_GPL(snd_hdac_get_display_clk);
++EXPORT_SYMBOL_GPL(snd_hdac_i915_set_bclk);
+
+ /* There is a fixed mapping between audio pin node and display port
+ * on current Intel platforms:
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -857,50 +857,6 @@ static int param_set_xint(const char *va
+ #define azx_del_card_list(chip) /* NOP */
+ #endif /* CONFIG_PM */
+
+-/* Intel HSW/BDW display HDA controller is in GPU. Both its power and link BCLK
+- * depends on GPU. Two Extended Mode registers EM4 (M value) and EM5 (N Value)
+- * are used to convert CDClk (Core Display Clock) to 24MHz BCLK:
+- * BCLK = CDCLK * M / N
+- * The values will be lost when the display power well is disabled and need to
+- * be restored to avoid abnormal playback speed.
+- */
+-static void haswell_set_bclk(struct hda_intel *hda)
+-{
+- struct azx *chip = &hda->chip;
+- int cdclk_freq;
+- unsigned int bclk_m, bclk_n;
+-
+- if (!hda->need_i915_power)
+- return;
+-
+- cdclk_freq = snd_hdac_get_display_clk(azx_bus(chip));
+- switch (cdclk_freq) {
+- case 337500:
+- bclk_m = 16;
+- bclk_n = 225;
+- break;
+-
+- case 450000:
+- default: /* default CDCLK 450MHz */
+- bclk_m = 4;
+- bclk_n = 75;
+- break;
+-
+- case 540000:
+- bclk_m = 4;
+- bclk_n = 90;
+- break;
+-
+- case 675000:
+- bclk_m = 8;
+- bclk_n = 225;
+- break;
+- }
+-
+- azx_writew(chip, HSW_EM4, bclk_m);
+- azx_writew(chip, HSW_EM5, bclk_n);
+-}
+-
+ #if defined(CONFIG_PM_SLEEP) || defined(SUPPORT_VGA_SWITCHEROO)
+ /*
+ * power management
+@@ -958,7 +914,7 @@ static int azx_resume(struct device *dev
+ if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL
+ && hda->need_i915_power) {
+ snd_hdac_display_power(azx_bus(chip), true);
+- haswell_set_bclk(hda);
++ snd_hdac_i915_set_bclk(azx_bus(chip));
+ }
+ if (chip->msi)
+ if (pci_enable_msi(pci) < 0)
+@@ -1058,7 +1014,7 @@ static int azx_runtime_resume(struct dev
+ bus = azx_bus(chip);
+ if (hda->need_i915_power) {
+ snd_hdac_display_power(bus, true);
+- haswell_set_bclk(hda);
++ snd_hdac_i915_set_bclk(bus);
+ } else {
+ /* toggle codec wakeup bit for STATESTS read */
+ snd_hdac_set_codec_wakeup(bus, true);
+@@ -1796,12 +1752,8 @@ static int azx_first_init(struct azx *ch
+ /* initialize chip */
+ azx_init_pci(chip);
+
+- if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
+- struct hda_intel *hda;
+-
+- hda = container_of(chip, struct hda_intel, chip);
+- haswell_set_bclk(hda);
+- }
++ if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
++ snd_hdac_i915_set_bclk(bus);
+
+ hda_intel_init_chip(chip, (probe_only[dev] & 2) == 0);
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2452,6 +2452,7 @@ static void intel_pin_eld_notify(void *a
+ if (atomic_read(&(codec)->core.in_pm))
+ return;
+
++ snd_hdac_i915_set_bclk(&codec->bus->core);
+ check_presence_and_report(codec, pin_nid);
+ }
+
--- /dev/null
+From 67f3754b51f22b18c4820fb84062f658c30e8644 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 21 Apr 2016 17:37:54 +0200
+Subject: ALSA: pcxhr: Fix missing mutex unlock
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 67f3754b51f22b18c4820fb84062f658c30e8644 upstream.
+
+The commit [9bef72bdb26e: ALSA: pcxhr: Use nonatomic PCM ops]
+converted to non-atomic PCM ops, but shamelessly with an unbalanced
+mutex locking, which leads to the hangup easily. Fix it.
+
+Fixes: 9bef72bdb26e ('ALSA: pcxhr: Use nonatomic PCM ops')
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116441
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/pcxhr/pcxhr_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/pcxhr/pcxhr_core.c
++++ b/sound/pci/pcxhr/pcxhr_core.c
+@@ -1341,5 +1341,6 @@ irqreturn_t pcxhr_threaded_irq(int irq,
+ }
+
+ pcxhr_msg_thread(mgr);
++ mutex_unlock(&mgr->lock);
+ return IRQ_HANDLED;
+ }
--- /dev/null
+From fba7cd681b6155e2d93e7862fcd6f970336b83c3 Mon Sep 17 00:00:00 2001
+From: Romain Perier <romain.perier@free-electrons.com>
+Date: Thu, 14 Apr 2016 15:36:03 +0200
+Subject: asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic()
+
+From: Romain Perier <romain.perier@free-electrons.com>
+
+commit fba7cd681b6155e2d93e7862fcd6f970336b83c3 upstream.
+
+The recent decoupling of pagefault disable and preempt disable added an
+explicit preempt_disable/enable() pair to the futex_atomic_cmpxchg_inatomic()
+implementation in asm-generic/futex.h. But it forgot to add preempt_enable()
+calls to the error handling code pathes, which results in a preemption count
+imbalance.
+
+This is observable on boot when the test for atomic_cmpxchg() is calling
+futex_atomic_cmpxchg_inatomic() on a NULL pointer.
+
+Add the missing preempt_enable() calls to the error handling code pathes.
+
+[ tglx: Massaged changelog ]
+
+Fixes: d9b9ff8c1889 ("sched/preempt, futex: Disable preemption in UP futex_atomic_cmpxchg_inatomic() explicitly")
+Signed-off-by: Romain Perier <romain.perier@free-electrons.com>
+Cc: linux-arch@vger.kernel.org
+Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/1460640963-690-1-git-send-email-romain.perier@free-electrons.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/asm-generic/futex.h | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/include/asm-generic/futex.h
++++ b/include/asm-generic/futex.h
+@@ -108,11 +108,15 @@ futex_atomic_cmpxchg_inatomic(u32 *uval,
+ u32 val;
+
+ preempt_disable();
+- if (unlikely(get_user(val, uaddr) != 0))
++ if (unlikely(get_user(val, uaddr) != 0)) {
++ preempt_enable();
+ return -EFAULT;
++ }
+
+- if (val == oldval && unlikely(put_user(newval, uaddr) != 0))
++ if (val == oldval && unlikely(put_user(newval, uaddr) != 0)) {
++ preempt_enable();
+ return -EFAULT;
++ }
+
+ *uval = val;
+ preempt_enable();
--- /dev/null
+From 1becf03545a0859ceaaf9e8c2d9861882a71cb01 Mon Sep 17 00:00:00 2001
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Date: Fri, 22 Apr 2016 19:53:59 -0700
+Subject: cpufreq: intel_pstate: Fix processing for turbo activation ratio
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+commit 1becf03545a0859ceaaf9e8c2d9861882a71cb01 upstream.
+
+When the config TDP level is not nominal (level = 0), the MSR values for
+reading level 1 and level 2 ratios contain power in low 14 bits and actual
+ratio bits are at bits [23:16]. The current processing for level 1 and
+level 2 is wrong as there is no shift done to get actual ratio.
+
+Fixes: 6a35fc2d6c22 (cpufreq: intel_pstate: get P1 from TAR when available)
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/intel_pstate.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -673,6 +673,11 @@ static int core_get_max_pstate(void)
+ if (err)
+ goto skip_tar;
+
++ /* For level 1 and 2, bits[23:16] contain the ratio */
++ if (tdp_ctrl)
++ tdp_ratio >>= 16;
++
++ tdp_ratio &= 0xff; /* ratios are only 8 bits long */
+ if (tdp_ratio - 1 == tar) {
+ max_pstate = tar;
+ pr_debug("max_pstate=TAC %x\n", max_pstate);
--- /dev/null
+From 9dbaab56ac09f07a73fe83bf69bec3e31060080a Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 14 Mar 2016 09:01:57 +0000
+Subject: drm/i915: Exit cherryview_irq_handler() after one pass
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 9dbaab56ac09f07a73fe83bf69bec3e31060080a upstream.
+
+This effectively reverts
+
+commit 8e5fd599eb219f1054e39b40d18b217af669eea9
+Author: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Date: Wed Apr 9 13:28:50 2014 +0300
+
+ drm/i915/chv: Make CHV irq handler loop until all interrupts are consumed
+
+as under continuous execlists load we can saturate the IRQ handler,
+destablising the tsc clock and triggering the NMI watchdog to declare a hung
+CPU.
+
+[ 552.756051] clocksource: timekeeping watchdog on CPU0: Marking clocksource 'tsc' as unstable because the skew is too large:
+[ 552.756080] clocksource: 'refined-jiffies' wd_now: 10003b480 wd_last: 10003b28c mask: ffffffff
+[ 552.756091] clocksource: 'tsc' cs_now: d55d31aa50 cs_last: d17446166c mask: ffffffffffffffff
+[ 552.756210] clocksource: Switched to clocksource refined-jiffies
+[ 575.217870] NMI watchdog: Watchdog detected hard LOCKUP on cpu 1
+[ 575.217893] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.5.0-rc7+ #18
+[ 575.217905] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0027.2015.0507.1758 05/07/2015
+[ 575.217915] 0000000000000000 ffff88027fd05bc0 ffffffff81288c6d 0000000000000000
+[ 575.217935] 0000000000000001 ffff88027fd05be0 ffffffff810e72d1 0000000000000000
+[ 575.217951] ffff88027fd05c80 ffff88027fd05c20 ffffffff81114b60 0000000181015f1e
+[ 575.217967] Call Trace:
+[ 575.217973] <NMI> [<ffffffff81288c6d>] dump_stack+0x4f/0x72
+[ 575.217994] [<ffffffff810e72d1>] watchdog_overflow_callback+0x151/0x160
+[ 575.218003] [<ffffffff81114b60>] __perf_event_overflow+0xa0/0x1e0
+[ 575.218016] [<ffffffff811154c4>] perf_event_overflow+0x14/0x20
+[ 575.218028] [<ffffffff8101d2ca>] intel_pmu_handle_irq+0x1da/0x460
+[ 575.218042] [<ffffffff814a8aae>] ? poll_idle+0x3e/0x70
+[ 575.218052] [<ffffffff814a8aae>] ? poll_idle+0x3e/0x70
+[ 575.218064] [<ffffffff81014ae8>] perf_event_nmi_handler+0x28/0x50
+[ 575.218075] [<ffffffff81007540>] nmi_handle+0x60/0x130
+[ 575.218086] [<ffffffff814a8aae>] ? poll_idle+0x3e/0x70
+[ 575.218096] [<ffffffff810079c0>] do_nmi+0x140/0x470
+[ 575.218108] [<ffffffff81559ec7>] end_repeat_nmi+0x1a/0x1e
+[ 575.218119] [<ffffffff814a8aae>] ? poll_idle+0x3e/0x70
+[ 575.218129] [<ffffffff814a8aae>] ? poll_idle+0x3e/0x70
+[ 575.218139] [<ffffffff814a8aae>] ? poll_idle+0x3e/0x70
+[ 575.218148] <<EOE>> [<ffffffff814a8353>] cpuidle_enter_state+0xf3/0x2f0
+[ 575.218164] [<ffffffff814a8587>] cpuidle_enter+0x17/0x20
+[ 575.218175] [<ffffffff810aaa3a>] call_cpuidle+0x2a/0x40
+[ 575.218185] [<ffffffff810aade3>] cpu_startup_entry+0x273/0x330
+[ 575.218196] [<ffffffff81033a1e>] start_secondary+0x10e/0x130
+
+However, not servicing all available IIR within the handler does hurt the
+throughput of pathological nop execbuf by about 20%, with a similar effect
+upon the dispatch latency of a series of execbuf.
+
+v2: use do {} while(0) for a smaller patch, and easier to revert again
+
+I have reasonable confidence that we do not miss GT interrupts (as
+execlists provides a stress case with a failure mechanism easily
+detected by igt), however I have less confidence about all the other
+sources of interrupts and worry that may lose a display hotplug
+interrupt, for example.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93467
+Testcase: igt/gem_exec_nop/basic # requires NMI watchdog
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Antti Koskipää <antti.koskipaa@linux.intel.com>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1457946117-6714-1-git-send-email-chris@chris-wilson.co.uk
+(cherry picked from commit 579de73b048a0a4c66c25a033ac76a2836e0cf73)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_irq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -1823,7 +1823,7 @@ static irqreturn_t cherryview_irq_handle
+ /* IRQs are synced during runtime_suspend, we don't require a wakeref */
+ disable_rpm_wakeref_asserts(dev_priv);
+
+- for (;;) {
++ do {
+ master_ctl = I915_READ(GEN8_MASTER_IRQ) & ~GEN8_MASTER_IRQ_CONTROL;
+ iir = I915_READ(VLV_IIR);
+
+@@ -1851,7 +1851,7 @@ static irqreturn_t cherryview_irq_handle
+
+ I915_WRITE(GEN8_MASTER_IRQ, DE_MASTER_IRQ_CONTROL);
+ POSTING_READ(GEN8_MASTER_IRQ);
+- }
++ } while (0);
+
+ enable_rpm_wakeref_asserts(dev_priv);
+
--- /dev/null
+From 9e60290dbafdf577766e5fc5f2fdb3be450cf9a6 Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Wed, 16 Mar 2016 15:18:04 -0400
+Subject: drm/i915: Fix race condition in intel_dp_destroy_mst_connector()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lyude <cpaul@redhat.com>
+
+commit 9e60290dbafdf577766e5fc5f2fdb3be450cf9a6 upstream.
+
+After unplugging a DP MST display from the system, we have to go through
+and destroy all of the DRM connectors associated with it since none of
+them are valid anymore. Unfortunately, intel_dp_destroy_mst_connector()
+doesn't do a good enough job of ensuring that throughout the destruction
+process that no modesettings can be done with the connectors. As it is
+right now, intel_dp_destroy_mst_connector() works like this:
+
+* Take all modeset locks
+* Clear the configuration of the crtc on the connector, if there is one
+* Drop all modeset locks, this is required because of circular
+ dependency issues that arise with trying to remove the connector from
+ sysfs with modeset locks held
+* Unregister the connector
+* Take all modeset locks, again
+* Do the rest of the required cleaning for destroying the connector
+* Finally drop all modeset locks for good
+
+This only works sometimes. During the destruction process, it's very
+possible that a userspace application will attempt to do a modesetting
+using the connector. When we drop the modeset locks, an ioctl handler
+such as drm_mode_setcrtc has the oppurtunity to take all of the modeset
+locks from us. When this happens, one thing leads to another and
+eventually we end up committing a mode with the non-existent connector:
+
+ [drm:intel_dp_link_training_clock_recovery [i915]] *ERROR* failed to enable link training
+ [drm:intel_dp_aux_ch] dp_aux_ch timeout status 0x7cf0001f
+ [drm:intel_dp_start_link_train [i915]] *ERROR* failed to start channel equalization
+ [drm:intel_dp_aux_ch] dp_aux_ch timeout status 0x7cf0001f
+ [drm:intel_mst_pre_enable_dp [i915]] *ERROR* failed to allocate vcpi
+
+And in some cases, such as with the T460s using an MST dock, this
+results in breaking modesetting and/or panicking the system.
+
+To work around this, we now unregister the connector at the very
+beginning of intel_dp_destroy_mst_connector(), grab all the modesetting
+locks, and then hold them until we finish the rest of the function.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+Signed-off-by: Rob Clark <rclark@redhat.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1458155884-13877-1-git-send-email-cpaul@redhat.com
+(cherry picked from commit 1f7717552ef1306be3b7ed28c66c6eff550e3a23)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_dp_mst.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -499,6 +499,8 @@ static void intel_dp_destroy_mst_connect
+ struct intel_connector *intel_connector = to_intel_connector(connector);
+ struct drm_device *dev = connector->dev;
+
++ intel_connector->unregister(intel_connector);
++
+ /* need to nuke the connector */
+ drm_modeset_lock_all(dev);
+ if (connector->state->crtc) {
+@@ -512,11 +514,7 @@ static void intel_dp_destroy_mst_connect
+
+ WARN(ret, "Disabling mst crtc failed with %i\n", ret);
+ }
+- drm_modeset_unlock_all(dev);
+
+- intel_connector->unregister(intel_connector);
+-
+- drm_modeset_lock_all(dev);
+ intel_connector_remove_from_fbdev(intel_connector);
+ drm_connector_cleanup(connector);
+ drm_modeset_unlock_all(dev);
--- /dev/null
+From 78a121d82da8aff3aca2a6a1c40f5061081760f0 Mon Sep 17 00:00:00 2001
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+Date: Sun, 6 Mar 2016 16:06:06 -0500
+Subject: drm/nouveau/core: use vzalloc for allocating ramht
+
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+
+commit 78a121d82da8aff3aca2a6a1c40f5061081760f0 upstream.
+
+Most calls to nvkm_ramht_new use 0x8000 as the size. This results in a
+fairly sizeable chunk of memory to be allocated, which may not be
+available with kzalloc. Since this is done fairly rarely (once per
+channel), use vzalloc instead.
+
+Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Cc: Sven Joachim <svenjoac@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nvkm/core/ramht.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nvkm/core/ramht.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/ramht.c
+@@ -131,7 +131,7 @@ nvkm_ramht_del(struct nvkm_ramht **pramh
+ struct nvkm_ramht *ramht = *pramht;
+ if (ramht) {
+ nvkm_gpuobj_del(&ramht->gpuobj);
+- kfree(*pramht);
++ vfree(*pramht);
+ *pramht = NULL;
+ }
+ }
+@@ -143,8 +143,8 @@ nvkm_ramht_new(struct nvkm_device *devic
+ struct nvkm_ramht *ramht;
+ int ret, i;
+
+- if (!(ramht = *pramht = kzalloc(sizeof(*ramht) + (size >> 3) *
+- sizeof(*ramht->data), GFP_KERNEL)))
++ if (!(ramht = *pramht = vzalloc(sizeof(*ramht) +
++ (size >> 3) * sizeof(*ramht->data))))
+ return -ENOMEM;
+
+ ramht->device = device;
--- /dev/null
+From d59a1f71ff1aeda4b4630df92d3ad4e3b1dfc885 Mon Sep 17 00:00:00 2001
+From: John Keeping <john@metanate.com>
+Date: Wed, 18 Nov 2015 11:17:25 +0000
+Subject: drm/qxl: fix cursor position with non-zero hotspot
+
+From: John Keeping <john@metanate.com>
+
+commit d59a1f71ff1aeda4b4630df92d3ad4e3b1dfc885 upstream.
+
+The SPICE protocol considers the position of a cursor to be the location
+of its active pixel on the display, so the cursor is drawn with its
+top-left corner at "(x - hot_spot_x, y - hot_spot_y)" but the DRM cursor
+position gives the location where the top-left corner should be drawn,
+with the hotspot being a hint for drivers that need it.
+
+This fixes the location of the window resize cursors when using Fluxbox
+with the QXL DRM driver and both the QXL and modesetting X drivers.
+
+Signed-off-by: John Keeping <john@metanate.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1447845445-2116-1-git-send-email-john@metanate.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/qxl/qxl_display.c | 13 +++++++++----
+ drivers/gpu/drm/qxl/qxl_drv.h | 2 ++
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/qxl/qxl_display.c
++++ b/drivers/gpu/drm/qxl/qxl_display.c
+@@ -375,10 +375,15 @@ static int qxl_crtc_cursor_set2(struct d
+
+ qxl_bo_kunmap(user_bo);
+
++ qcrtc->cur_x += qcrtc->hot_spot_x - hot_x;
++ qcrtc->cur_y += qcrtc->hot_spot_y - hot_y;
++ qcrtc->hot_spot_x = hot_x;
++ qcrtc->hot_spot_y = hot_y;
++
+ cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release);
+ cmd->type = QXL_CURSOR_SET;
+- cmd->u.set.position.x = qcrtc->cur_x;
+- cmd->u.set.position.y = qcrtc->cur_y;
++ cmd->u.set.position.x = qcrtc->cur_x + qcrtc->hot_spot_x;
++ cmd->u.set.position.y = qcrtc->cur_y + qcrtc->hot_spot_y;
+
+ cmd->u.set.shape = qxl_bo_physical_address(qdev, cursor_bo, 0);
+
+@@ -441,8 +446,8 @@ static int qxl_crtc_cursor_move(struct d
+
+ cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release);
+ cmd->type = QXL_CURSOR_MOVE;
+- cmd->u.position.x = qcrtc->cur_x;
+- cmd->u.position.y = qcrtc->cur_y;
++ cmd->u.position.x = qcrtc->cur_x + qcrtc->hot_spot_x;
++ cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y;
+ qxl_release_unmap(qdev, release, &cmd->release_info);
+
+ qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
+--- a/drivers/gpu/drm/qxl/qxl_drv.h
++++ b/drivers/gpu/drm/qxl/qxl_drv.h
+@@ -135,6 +135,8 @@ struct qxl_crtc {
+ int index;
+ int cur_x;
+ int cur_y;
++ int hot_spot_x;
++ int hot_spot_y;
+ };
+
+ struct qxl_output {
--- /dev/null
+From fe1bce9e2107ba3a8faffe572483b6974201a0e6 Mon Sep 17 00:00:00 2001
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Wed, 20 Apr 2016 20:09:24 -0700
+Subject: futex: Acknowledge a new waiter in counter before plist
+
+From: Davidlohr Bueso <dave@stgolabs.net>
+
+commit fe1bce9e2107ba3a8faffe572483b6974201a0e6 upstream.
+
+Otherwise an incoming waker on the dest hash bucket can miss
+the waiter adding itself to the plist during the lockless
+check optimization (small window but still the correct way
+of doing this); similarly to the decrement counterpart.
+
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: bigeasy@linutronix.de
+Cc: dvhart@infradead.org
+Link: http://lkml.kernel.org/r/1461208164-29150-1-git-send-email-dave@stgolabs.net
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/futex.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1452,8 +1452,8 @@ void requeue_futex(struct futex_q *q, st
+ if (likely(&hb1->chain != &hb2->chain)) {
+ plist_del(&q->list, &hb1->chain);
+ hb_waiters_dec(hb1);
+- plist_add(&q->list, &hb2->chain);
+ hb_waiters_inc(hb2);
++ plist_add(&q->list, &hb2->chain);
+ q->lock_ptr = &hb2->lock;
+ }
+ get_futex_key_refs(key2);
--- /dev/null
+From 89e9e66ba1b3bde9d8ea90566c2aee20697ad681 Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Fri, 15 Apr 2016 14:35:39 +0200
+Subject: futex: Handle unlock_pi race gracefully
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+commit 89e9e66ba1b3bde9d8ea90566c2aee20697ad681 upstream.
+
+If userspace calls UNLOCK_PI unconditionally without trying the TID -> 0
+transition in user space first then the user space value might not have the
+waiters bit set. This opens the following race:
+
+CPU0 CPU1
+uval = get_user(futex)
+ lock(hb)
+lock(hb)
+ futex |= FUTEX_WAITERS
+ ....
+ unlock(hb)
+
+cmpxchg(futex, uval, newval)
+
+So the cmpxchg fails and returns -EINVAL to user space, which is wrong because
+the futex value is valid.
+
+To handle this (yes, yet another) corner case gracefully, check for a flag
+change and retry.
+
+[ tglx: Massaged changelog and slightly reworked implementation ]
+
+Fixes: ccf9e6a80d9e ("futex: Make unlock_pi more robust")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Darren Hart <dvhart@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/1460723739-5195-1-git-send-email-bigeasy@linutronix.de
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/futex.c | 25 ++++++++++++++++++++++---
+ 1 file changed, 22 insertions(+), 3 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1212,10 +1212,20 @@ static int wake_futex_pi(u32 __user *uad
+ if (unlikely(should_fail_futex(true)))
+ ret = -EFAULT;
+
+- if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
++ if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) {
+ ret = -EFAULT;
+- else if (curval != uval)
+- ret = -EINVAL;
++ } else if (curval != uval) {
++ /*
++ * If a unconditional UNLOCK_PI operation (user space did not
++ * try the TID->0 transition) raced with a waiter setting the
++ * FUTEX_WAITERS flag between get_user() and locking the hash
++ * bucket lock, retry the operation.
++ */
++ if ((FUTEX_TID_MASK & curval) == uval)
++ ret = -EAGAIN;
++ else
++ ret = -EINVAL;
++ }
+ if (ret) {
+ raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
+ return ret;
+@@ -2536,6 +2546,15 @@ retry:
+ if (ret == -EFAULT)
+ goto pi_faulted;
+ /*
++ * A unconditional UNLOCK_PI op raced against a waiter
++ * setting the FUTEX_WAITERS bit. Try again.
++ */
++ if (ret == -EAGAIN) {
++ spin_unlock(&hb->lock);
++ put_futex_key(&key);
++ goto retry;
++ }
++ /*
+ * wake_futex_pi has detected invalid state. Tell user
+ * space.
+ */
--- /dev/null
+From e9bef455af8eb0e837e179aab8988ae2649fd8d3 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 25 Apr 2016 13:12:18 -0400
+Subject: Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control"
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e9bef455af8eb0e837e179aab8988ae2649fd8d3 upstream.
+
+This reverts commit bedf2a65c1aa8fb29ba8527fd00c0f68ec1f55f1.
+
+See the radeon revert for an extended description.
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 8 ++++----
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +-------
+ 2 files changed, 5 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+@@ -63,10 +63,6 @@ bool amdgpu_has_atpx(void) {
+ return amdgpu_atpx_priv.atpx_detected;
+ }
+
+-bool amdgpu_has_atpx_dgpu_power_cntl(void) {
+- return amdgpu_atpx_priv.atpx.functions.power_cntl;
+-}
+-
+ /**
+ * amdgpu_atpx_call - call an ATPX method
+ *
+@@ -146,6 +142,10 @@ static void amdgpu_atpx_parse_functions(
+ */
+ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx)
+ {
++ /* make sure required functions are enabled */
++ /* dGPU power control is required */
++ atpx->functions.power_cntl = true;
++
+ if (atpx->functions.px_params) {
+ union acpi_object *info;
+ struct atpx_px_params output;
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -62,12 +62,6 @@ static const char *amdgpu_asic_name[] =
+ "LAST",
+ };
+
+-#if defined(CONFIG_VGA_SWITCHEROO)
+-bool amdgpu_has_atpx_dgpu_power_cntl(void);
+-#else
+-static inline bool amdgpu_has_atpx_dgpu_power_cntl(void) { return false; }
+-#endif
+-
+ bool amdgpu_device_is_px(struct drm_device *dev)
+ {
+ struct amdgpu_device *adev = dev->dev_private;
+@@ -1517,7 +1511,7 @@ int amdgpu_device_init(struct amdgpu_dev
+
+ if (amdgpu_runtime_pm == 1)
+ runtime = true;
+- if (amdgpu_device_is_px(ddev) && amdgpu_has_atpx_dgpu_power_cntl())
++ if (amdgpu_device_is_px(ddev))
+ runtime = true;
+ vga_switcheroo_register_client(adev->pdev, &amdgpu_switcheroo_ops, runtime);
+ if (runtime)
--- /dev/null
+From bfaddd9fc8ac048b99475f000dbef6f08297417f Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 18 Apr 2016 11:19:19 -0400
+Subject: Revert "drm/radeon: disable runtime pm on PX laptops without dGPU power control"
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit bfaddd9fc8ac048b99475f000dbef6f08297417f upstream.
+
+This reverts commit e64c952efb8e0c15ae82cec8e455ab4910690ef1.
+
+ATPX is the ACPI method for controlling AMD PowerXpress laptops.
+There are flags to indicate which methods are supported. If
+the dGPU power down flag is not supported, the driver needs to
+implement the dGPU power down manually. We had previously
+always forced the driver to assume the ATPX dGPU power down
+was present, but this causes problems on boards where it is
+not, leading to GPU hangs when attempting to power down the
+dGPU. Manual dGPU power down is not currently supported in
+the Linux driver. Some laptops indicate that the ATPX
+dGPU power down method is not present, but it actually
+apparently is. I'm not sure if this is a bios bug and it should
+be set or if there is a reason it was unset and the method should
+not be used. This is not an issue on other OSes since both the
+ATPX and the manual driver power down methods are supported.
+
+This is apparently fairly widespread, so just revert for now.
+
+bugs:
+https://bugzilla.kernel.org/show_bug.cgi?id=115321
+https://bugzilla.kernel.org/show_bug.cgi?id=116581
+https://bugzilla.kernel.org/show_bug.cgi?id=116251
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_atpx_handler.c | 8 ++++----
+ drivers/gpu/drm/radeon/radeon_device.c | 8 +-------
+ 2 files changed, 5 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+@@ -62,10 +62,6 @@ bool radeon_has_atpx(void) {
+ return radeon_atpx_priv.atpx_detected;
+ }
+
+-bool radeon_has_atpx_dgpu_power_cntl(void) {
+- return radeon_atpx_priv.atpx.functions.power_cntl;
+-}
+-
+ /**
+ * radeon_atpx_call - call an ATPX method
+ *
+@@ -145,6 +141,10 @@ static void radeon_atpx_parse_functions(
+ */
+ static int radeon_atpx_validate(struct radeon_atpx *atpx)
+ {
++ /* make sure required functions are enabled */
++ /* dGPU power control is required */
++ atpx->functions.power_cntl = true;
++
+ if (atpx->functions.px_params) {
+ union acpi_object *info;
+ struct atpx_px_params output;
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -103,12 +103,6 @@ static const char radeon_family_name[][1
+ "LAST",
+ };
+
+-#if defined(CONFIG_VGA_SWITCHEROO)
+-bool radeon_has_atpx_dgpu_power_cntl(void);
+-#else
+-static inline bool radeon_has_atpx_dgpu_power_cntl(void) { return false; }
+-#endif
+-
+ #define RADEON_PX_QUIRK_DISABLE_PX (1 << 0)
+ #define RADEON_PX_QUIRK_LONG_WAKEUP (1 << 1)
+
+@@ -1439,7 +1433,7 @@ int radeon_device_init(struct radeon_dev
+ * ignore it */
+ vga_client_register(rdev->pdev, rdev, NULL, radeon_vga_set_decode);
+
+- if ((rdev->flags & RADEON_IS_PX) && radeon_has_atpx_dgpu_power_cntl())
++ if (rdev->flags & RADEON_IS_PX)
+ runtime = true;
+ vga_switcheroo_register_client(rdev->pdev, &radeon_switcheroo_ops, runtime);
+ if (runtime)
--- /dev/null
+From b2d7a9cd3ff8ec561348267c2ef7d47b2b91e801 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Mon, 28 Mar 2016 18:45:36 -0300
+Subject: Revert "PCI: imx6: Add support for active-low reset GPIO"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+commit b2d7a9cd3ff8ec561348267c2ef7d47b2b91e801 upstream.
+
+Commit 5c5fb40de8f1 ("PCI: imx6: Add support for active-low reset GPIO")
+cause regressions on some boards like MX6 Gateworks Ventana, for example.
+
+The reason for the breakage is that this commit sets the GPIO polarity in
+the wrong logic level.
+
+Also, the commit log is wrong because active-low reset GPIO is what the
+driver used to support since the beginning.
+
+So keep the old behavior that ignores the GPIO polarity specified in the
+device tree and treat the PCI reset GPIO as active-low.
+
+Reported-by: Krzysztof Hałasa <khalasa@piap.pl>
+Tested-by: Tim Harvey <tharvey@gateworks.com> # Gateworks Ventana
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Tim Harvey <tharvey@gateworks.com>
+Acked-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pci-imx6.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+--- a/drivers/pci/host/pci-imx6.c
++++ b/drivers/pci/host/pci-imx6.c
+@@ -32,7 +32,7 @@
+ #define to_imx6_pcie(x) container_of(x, struct imx6_pcie, pp)
+
+ struct imx6_pcie {
+- struct gpio_desc *reset_gpio;
++ int reset_gpio;
+ struct clk *pcie_bus;
+ struct clk *pcie_phy;
+ struct clk *pcie;
+@@ -287,10 +287,10 @@ static int imx6_pcie_deassert_core_reset
+ usleep_range(200, 500);
+
+ /* Some boards don't have PCIe reset GPIO. */
+- if (imx6_pcie->reset_gpio) {
+- gpiod_set_value_cansleep(imx6_pcie->reset_gpio, 0);
++ if (gpio_is_valid(imx6_pcie->reset_gpio)) {
++ gpio_set_value_cansleep(imx6_pcie->reset_gpio, 0);
+ msleep(100);
+- gpiod_set_value_cansleep(imx6_pcie->reset_gpio, 1);
++ gpio_set_value_cansleep(imx6_pcie->reset_gpio, 1);
+ }
+ return 0;
+
+@@ -561,6 +561,7 @@ static int __init imx6_pcie_probe(struct
+ {
+ struct imx6_pcie *imx6_pcie;
+ struct pcie_port *pp;
++ struct device_node *np = pdev->dev.of_node;
+ struct resource *dbi_base;
+ int ret;
+
+@@ -581,8 +582,15 @@ static int __init imx6_pcie_probe(struct
+ return PTR_ERR(pp->dbi_base);
+
+ /* Fetch GPIOs */
+- imx6_pcie->reset_gpio = devm_gpiod_get_optional(&pdev->dev, "reset",
+- GPIOD_OUT_LOW);
++ imx6_pcie->reset_gpio = of_get_named_gpio(np, "reset-gpio", 0);
++ if (gpio_is_valid(imx6_pcie->reset_gpio)) {
++ ret = devm_gpio_request_one(&pdev->dev, imx6_pcie->reset_gpio,
++ GPIOF_OUT_INIT_LOW, "PCIe reset");
++ if (ret) {
++ dev_err(&pdev->dev, "unable to get reset gpio\n");
++ return ret;
++ }
++ }
+
+ /* Fetch clocks */
+ imx6_pcie->pcie_phy = devm_clk_get(&pdev->dev, "pcie_phy");
dmaengine-pxa_dma-fix-the-maximum-requestor-line.patch
mtd-nand-pxa3xx_nand-fix-dmaengine-initialization.patch
sched-cgroup-fix-cleanup-cgroup-teardown-init.patch
+x86-mm-xen-suppress-hugetlbfs-in-pv-guests.patch
+x86-edac-sb_edac.c-repair-damage-introduced-when-fixing-channel-address.patch
+x86-edac-sb_edac.c-take-account-of-channel-hashing-when-needed.patch
+alsa-hda-don-t-trust-the-reported-actual-power-state.patch
+alsa-hda-realtek-add-alc3234-headset-mode-for-optiplex-9020m.patch
+alsa-hda-keep-powering-up-adcs-on-cirrus-codecs.patch
+alsa-hda-add-pci-id-for-intel-broxton-t.patch
+alsa-pcxhr-fix-missing-mutex-unlock.patch
+alsa-hda-add-dock-support-for-thinkpad-x260.patch
+alsa-hda-update-bclk-also-at-hotplug-for-i915-hsw-bdw.patch
+asm-generic-futex-re-enable-preemption-in-futex_atomic_cmpxchg_inatomic.patch
+futex-handle-unlock_pi-race-gracefully.patch
+futex-acknowledge-a-new-waiter-in-counter-before-plist.patch
+drm-nouveau-core-use-vzalloc-for-allocating-ramht.patch
+drm-qxl-fix-cursor-position-with-non-zero-hotspot.patch
+drm-i915-exit-cherryview_irq_handler-after-one-pass.patch
+drm-i915-fix-race-condition-in-intel_dp_destroy_mst_connector.patch
+revert-drm-radeon-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch
+revert-pci-imx6-add-support-for-active-low-reset-gpio.patch
+usbvision-revert-commit-588afcc1.patch
+revert-drm-amdgpu-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch
+cpufreq-intel_pstate-fix-processing-for-turbo-activation-ratio.patch
--- /dev/null
+From d5468d7afaa9c9e961e150f0455a14a9f4872a98 Mon Sep 17 00:00:00 2001
+From: Vladis Dronov <vdronov@redhat.com>
+Date: Sun, 31 Jan 2016 14:14:52 -0200
+Subject: [media] usbvision: revert commit 588afcc1
+
+From: Vladis Dronov <vdronov@redhat.com>
+
+commit d5468d7afaa9c9e961e150f0455a14a9f4872a98 upstream.
+
+Commit 588afcc1c0e4 ("[media] usbvision fix overflow of interfaces
+array")' should be reverted, because:
+
+* "!dev->actconfig->interface[ifnum]" won't catch a case where the value
+is not NULL but some garbage. This way the system may crash later with
+GPF.
+
+* "(ifnum >= USB_MAXINTERFACES)" does not cover all the error
+conditions. "ifnum" should be compared to "dev->actconfig->
+desc.bNumInterfaces", i.e. compared to the number of "struct
+usb_interface" kzalloc()-ed, not to USB_MAXINTERFACES.
+
+* There is a "struct usb_device" leak in this error path, as there is
+usb_get_dev(), but no usb_put_dev() on this path.
+
+* There is a bug of the same type several lines below with number of
+endpoints. The code is accessing hard-coded second endpoint
+("interface->endpoint[1].desc") which may not exist. It would be great
+to handle this in the same patch too.
+
+* All the concerns above are resolved by already-accepted commit fa52bd50
+("[media] usbvision: fix crash on detecting device with invalid
+configuration")
+
+* Mailing list message:
+http://www.spinics.net/lists/linux-media/msg94832.html
+
+Signed-off-by: Vladis Dronov <vdronov@redhat.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/usbvision/usbvision-video.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/drivers/media/usb/usbvision/usbvision-video.c
++++ b/drivers/media/usb/usbvision/usbvision-video.c
+@@ -1461,13 +1461,6 @@ static int usbvision_probe(struct usb_in
+ printk(KERN_INFO "%s: %s found\n", __func__,
+ usbvision_device_data[model].model_string);
+
+- /*
+- * this is a security check.
+- * an exploit using an incorrect bInterfaceNumber is known
+- */
+- if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum])
+- return -ENODEV;
+-
+ if (usbvision_device_data[model].interface >= 0)
+ interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
+ else if (ifnum < dev->actconfig->desc.bNumInterfaces)
--- /dev/null
+From ff15e95c82768d589957dbb17d7eb7dba7904659 Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Thu, 14 Apr 2016 10:21:52 -0700
+Subject: x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit ff15e95c82768d589957dbb17d7eb7dba7904659 upstream.
+
+In commit:
+
+ eb1af3b71f9d ("Fix computation of channel address")
+
+I switched the "sck_way" variable from holding the log2 value read
+from the h/w to instead be the actual number. Unfortunately it
+is needed in log2 form when used to shift the address.
+
+Tested-by: Patrick Geary <patrickg@supermicro.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Acked-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Cc: Aristeu Rozanski <arozansk@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-edac@vger.kernel.org
+Fixes: eb1af3b71f9d ("Fix computation of channel address")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/edac/sb_edac.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -2118,7 +2118,7 @@ static int get_memory_error_data(struct
+ }
+
+ ch_way = TAD_CH(reg) + 1;
+- sck_way = 1 << TAD_SOCK(reg);
++ sck_way = TAD_SOCK(reg);
+
+ if (ch_way == 3)
+ idx = addr >> 6;
+@@ -2157,7 +2157,7 @@ static int get_memory_error_data(struct
+ switch(ch_way) {
+ case 2:
+ case 4:
+- sck_xch = 1 << sck_way * (ch_way >> 1);
++ sck_xch = (1 << sck_way) * (ch_way >> 1);
+ break;
+ default:
+ sprintf(msg, "Invalid mirror set. Can't decode addr");
+@@ -2193,7 +2193,7 @@ static int get_memory_error_data(struct
+
+ ch_addr = addr - offset;
+ ch_addr >>= (6 + shiftup);
+- ch_addr /= ch_way * sck_way;
++ ch_addr /= sck_xch;
+ ch_addr <<= (6 + shiftup);
+ ch_addr |= addr & ((1 << (6 + shiftup)) - 1);
+
--- /dev/null
+From ea5dfb5fae81939f777ca569d8cfb599252da2e8 Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Thu, 14 Apr 2016 10:22:02 -0700
+Subject: x86 EDAC, sb_edac.c: Take account of channel hashing when needed
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit ea5dfb5fae81939f777ca569d8cfb599252da2e8 upstream.
+
+Haswell and Broadwell can be configured to hash the channel
+interleave function using bits [27:12] of the physical address.
+
+On those processor models we must check to see if hashing is
+enabled (bit21 of the HASWELL_HASYSDEFEATURE2 register) and
+act accordingly.
+
+Based on a patch by patrickg <patrickg@supermicro.com>
+
+Tested-by: Patrick Geary <patrickg@supermicro.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Acked-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Cc: Aristeu Rozanski <arozansk@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-edac@vger.kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/edac/sb_edac.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -362,6 +362,7 @@ struct sbridge_pvt {
+
+ /* Memory type detection */
+ bool is_mirrored, is_lockstep, is_close_pg;
++ bool is_chan_hash;
+
+ /* Fifo double buffers */
+ struct mce mce_entry[MCE_LOG_LEN];
+@@ -1060,6 +1061,20 @@ static inline u8 sad_pkg_ha(u8 pkg)
+ return (pkg >> 2) & 0x1;
+ }
+
++static int haswell_chan_hash(int idx, u64 addr)
++{
++ int i;
++
++ /*
++ * XOR even bits from 12:26 to bit0 of idx,
++ * odd bits from 13:27 to bit1
++ */
++ for (i = 12; i < 28; i += 2)
++ idx ^= (addr >> i) & 3;
++
++ return idx;
++}
++
+ /****************************************************************************
+ Memory check routines
+ ****************************************************************************/
+@@ -1616,6 +1631,10 @@ static int get_dimm_config(struct mem_ct
+ KNL_MAX_CHANNELS : NUM_CHANNELS;
+ u64 knl_mc_sizes[KNL_MAX_CHANNELS];
+
++ if (pvt->info.type == HASWELL || pvt->info.type == BROADWELL) {
++ pci_read_config_dword(pvt->pci_ha0, HASWELL_HASYSDEFEATURE2, ®);
++ pvt->is_chan_hash = GET_BITFIELD(reg, 21, 21);
++ }
+ if (pvt->info.type == HASWELL || pvt->info.type == BROADWELL ||
+ pvt->info.type == KNIGHTS_LANDING)
+ pci_read_config_dword(pvt->pci_sad1, SAD_TARGET, ®);
+@@ -2122,8 +2141,11 @@ static int get_memory_error_data(struct
+
+ if (ch_way == 3)
+ idx = addr >> 6;
+- else
++ else {
+ idx = (addr >> (6 + sck_way + shiftup)) & 0x3;
++ if (pvt->is_chan_hash)
++ idx = haswell_chan_hash(idx, addr);
++ }
+ idx = idx % ch_way;
+
+ /*
--- /dev/null
+From 103f6112f253017d7062cd74d17f4a514ed4485c Mon Sep 17 00:00:00 2001
+From: Jan Beulich <JBeulich@suse.com>
+Date: Thu, 21 Apr 2016 00:27:04 -0600
+Subject: x86/mm/xen: Suppress hugetlbfs in PV guests
+
+From: Jan Beulich <JBeulich@suse.com>
+
+commit 103f6112f253017d7062cd74d17f4a514ed4485c upstream.
+
+Huge pages are not normally available to PV guests. Not suppressing
+hugetlbfs use results in an endless loop of page faults when user mode
+code tries to access a hugetlbfs mapped area (since the hypervisor
+denies such PTEs to be created, but error indications can't be
+propagated out of xen_set_pte_at(), just like for various of its
+siblings), and - once killed in an oops like this:
+
+ kernel BUG at .../fs/hugetlbfs/inode.c:428!
+ invalid opcode: 0000 [#1] SMP
+ ...
+ RIP: e030:[<ffffffff811c333b>] [<ffffffff811c333b>] remove_inode_hugepages+0x25b/0x320
+ ...
+ Call Trace:
+ [<ffffffff811c3415>] hugetlbfs_evict_inode+0x15/0x40
+ [<ffffffff81167b3d>] evict+0xbd/0x1b0
+ [<ffffffff8116514a>] __dentry_kill+0x19a/0x1f0
+ [<ffffffff81165b0e>] dput+0x1fe/0x220
+ [<ffffffff81150535>] __fput+0x155/0x200
+ [<ffffffff81079fc0>] task_work_run+0x60/0xa0
+ [<ffffffff81063510>] do_exit+0x160/0x400
+ [<ffffffff810637eb>] do_group_exit+0x3b/0xa0
+ [<ffffffff8106e8bd>] get_signal+0x1ed/0x470
+ [<ffffffff8100f854>] do_signal+0x14/0x110
+ [<ffffffff810030e9>] prepare_exit_to_usermode+0xe9/0xf0
+ [<ffffffff814178a5>] retint_user+0x8/0x13
+
+This is CVE-2016-3961 / XSA-174.
+
+Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: David Vrabel <david.vrabel@citrix.com>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Juergen Gross <JGross@suse.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Luis R. Rodriguez <mcgrof@suse.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Toshi Kani <toshi.kani@hp.com>
+Cc: xen-devel <xen-devel@lists.xenproject.org>
+Link: http://lkml.kernel.org/r/57188ED802000078000E431C@prv-mh.provo.novell.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/hugetlb.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/include/asm/hugetlb.h
++++ b/arch/x86/include/asm/hugetlb.h
+@@ -4,6 +4,7 @@
+ #include <asm/page.h>
+ #include <asm-generic/hugetlb.h>
+
++#define hugepages_supported() cpu_has_pse
+
+ static inline int is_hugepage_only_range(struct mm_struct *mm,
+ unsigned long addr,
projects / thirdparty / kernel / stable-queue.git / commitdiff
