--- /dev/null
+From e34fbbac669de0b7fb7803929d0477f35f6e2833 Mon Sep 17 00:00:00 2001
+From: Alex Hung <alex.hung@canonical.com>
+Date: Fri, 27 May 2016 15:47:06 +0800
+Subject: ACPI / video: skip evaluating _DOD when it does not exist
+
+From: Alex Hung <alex.hung@canonical.com>
+
+commit e34fbbac669de0b7fb7803929d0477f35f6e2833 upstream.
+
+Some system supports hybrid graphics and its discrete VGA
+does not have any connectors and therefore has no _DOD method.
+
+Signed-off-by: Alex Hung <alex.hung@canonical.com>
+Reviewed-by: Aaron Lu <aaron.lu@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpi_video.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -1211,6 +1211,9 @@ static int acpi_video_device_enumerate(s
+ union acpi_object *dod = NULL;
+ union acpi_object *obj;
+
++ if (!video->cap._DOD)
++ return AE_NOT_EXIST;
++
+ status = acpi_evaluate_object(video->device->handle, "_DOD", NULL, &buffer);
+ if (!ACPI_SUCCESS(status)) {
+ ACPI_EXCEPTION((AE_INFO, status, "Evaluating _DOD"));
--- /dev/null
+From 1a07834024dfca5c4bed5de8f8714306e0a11836 Mon Sep 17 00:00:00 2001
+From: "Wang, Rui Y" <rui.y.wang@intel.com>
+Date: Sun, 29 Nov 2015 22:45:34 +0800
+Subject: crypto: cryptd - Assign statesize properly
+
+From: Wang, Rui Y <rui.y.wang@intel.com>
+
+commit 1a07834024dfca5c4bed5de8f8714306e0a11836 upstream.
+
+cryptd_create_hash() fails by returning -EINVAL. It is because after
+8996eafdc ("crypto: ahash - ensure statesize is non-zero") all ahash
+drivers must have a non-zero statesize.
+
+This patch fixes the problem by properly assigning the statesize.
+
+Signed-off-by: Rui Wang <rui.y.wang@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/cryptd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/crypto/cryptd.c
++++ b/crypto/cryptd.c
+@@ -642,6 +642,7 @@ static int cryptd_create_hash(struct cry
+ inst->alg.halg.base.cra_flags = type;
+
+ inst->alg.halg.digestsize = salg->digestsize;
++ inst->alg.halg.statesize = salg->statesize;
+ inst->alg.halg.base.cra_ctxsize = sizeof(struct cryptd_hash_ctx);
+
+ inst->alg.halg.base.cra_init = cryptd_hash_init_tfm;
--- /dev/null
+From 3a020a723c65eb8ffa7c237faca26521a024e582 Mon Sep 17 00:00:00 2001
+From: "Wang, Rui Y" <rui.y.wang@intel.com>
+Date: Sun, 29 Nov 2015 22:45:33 +0800
+Subject: crypto: ghash-clmulni - Fix load failure
+
+From: Wang, Rui Y <rui.y.wang@intel.com>
+
+commit 3a020a723c65eb8ffa7c237faca26521a024e582 upstream.
+
+ghash_clmulni_intel fails to load on Linux 4.3+ with the following message:
+"modprobe: ERROR: could not insert 'ghash_clmulni_intel': Invalid argument"
+
+After 8996eafdc ("crypto: ahash - ensure statesize is non-zero") all ahash
+drivers are required to implement import()/export(), and must have a non-
+zero statesize.
+
+This patch has been tested with the algif_hash interface. The calculated
+digest values, after several rounds of import()s and export()s, match those
+calculated by tcrypt.
+
+Signed-off-by: Rui Wang <rui.y.wang@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ arch/x86/crypto/ghash-clmulni-intel_glue.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c
++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+@@ -219,6 +219,29 @@ static int ghash_async_final(struct ahas
+ }
+ }
+
++static int ghash_async_import(struct ahash_request *req, const void *in)
++{
++ struct ahash_request *cryptd_req = ahash_request_ctx(req);
++ struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
++ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
++
++ ghash_async_init(req);
++ memcpy(dctx, in, sizeof(*dctx));
++ return 0;
++
++}
++
++static int ghash_async_export(struct ahash_request *req, void *out)
++{
++ struct ahash_request *cryptd_req = ahash_request_ctx(req);
++ struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
++ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
++
++ memcpy(out, dctx, sizeof(*dctx));
++ return 0;
++
++}
++
+ static int ghash_async_digest(struct ahash_request *req)
+ {
+ struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+@@ -288,8 +311,11 @@ static struct ahash_alg ghash_async_alg
+ .final = ghash_async_final,
+ .setkey = ghash_async_setkey,
+ .digest = ghash_async_digest,
++ .export = ghash_async_export,
++ .import = ghash_async_import,
+ .halg = {
+ .digestsize = GHASH_DIGEST_SIZE,
++ .statesize = sizeof(struct ghash_desc_ctx),
+ .base = {
+ .cra_name = "ghash",
+ .cra_driver_name = "ghash-clmulni",
--- /dev/null
+From ddef482420b1ba8ec45e6123a7e8d3f67b21e5e3 Mon Sep 17 00:00:00 2001
+From: "Wang, Rui Y" <rui.y.wang@intel.com>
+Date: Wed, 27 Jan 2016 17:08:36 +0800
+Subject: crypto: mcryptd - Fix load failure
+
+From: Wang, Rui Y <rui.y.wang@intel.com>
+
+commit ddef482420b1ba8ec45e6123a7e8d3f67b21e5e3 upstream.
+
+mcryptd_create_hash() fails by returning -EINVAL, causing any
+driver using mcryptd to fail to load. It is because it needs
+to set its statesize properly.
+
+Signed-off-by: Rui Wang <rui.y.wang@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/mcryptd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/crypto/mcryptd.c
++++ b/crypto/mcryptd.c
+@@ -531,6 +531,7 @@ static int mcryptd_create_hash(struct cr
+ inst->alg.halg.base.cra_flags = type;
+
+ inst->alg.halg.digestsize = salg->digestsize;
++ inst->alg.halg.statesize = salg->statesize;
+ inst->alg.halg.base.cra_ctxsize = sizeof(struct mcryptd_hash_ctx);
+
+ inst->alg.halg.base.cra_init = mcryptd_hash_init_tfm;
--- /dev/null
+From 83430833b4d4a9c9b23964babbeb1f36450f8136 Mon Sep 17 00:00:00 2001
+From: "Manoj N. Kumar" <manoj@linux.vnet.ibm.com>
+Date: Fri, 4 Mar 2016 15:55:20 -0600
+Subject: cxlflash: Increase cmd_per_lun for better throughput
+
+From: Manoj N. Kumar <manoj@linux.vnet.ibm.com>
+
+commit 83430833b4d4a9c9b23964babbeb1f36450f8136 upstream.
+
+With the current value of cmd_per_lun at 16, the throughput
+over a single adapter is limited to around 150kIOPS.
+
+Increase the value of cmd_per_lun to 256 to improve
+throughput. With this change a single adapter is able to
+attain close to the maximum throughput (380kIOPS).
+Also change the number of RRQ entries that can be queued.
+
+Signed-off-by: Manoj N. Kumar <manoj@linux.vnet.ibm.com>
+Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
+Reviewed-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/cxlflash/common.h | 8 +++++---
+ drivers/scsi/cxlflash/main.c | 2 +-
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/cxlflash/common.h
++++ b/drivers/scsi/cxlflash/common.h
+@@ -34,7 +34,6 @@ extern const struct file_operations cxlf
+ sectors
+ */
+
+-#define NUM_RRQ_ENTRY 16 /* for master issued cmds */
+ #define MAX_RHT_PER_CONTEXT (PAGE_SIZE / sizeof(struct sisl_rht_entry))
+
+ /* AFU command retry limit */
+@@ -48,9 +47,12 @@ extern const struct file_operations cxlf
+ index derivation
+ */
+
+-#define CXLFLASH_MAX_CMDS 16
++#define CXLFLASH_MAX_CMDS 256
+ #define CXLFLASH_MAX_CMDS_PER_LUN CXLFLASH_MAX_CMDS
+
++/* RRQ for master issued cmds */
++#define NUM_RRQ_ENTRY CXLFLASH_MAX_CMDS
++
+
+ static inline void check_sizes(void)
+ {
+@@ -149,7 +151,7 @@ struct afu_cmd {
+ struct afu {
+ /* Stuff requiring alignment go first. */
+
+- u64 rrq_entry[NUM_RRQ_ENTRY]; /* 128B RRQ */
++ u64 rrq_entry[NUM_RRQ_ENTRY]; /* 2K RRQ */
+ /*
+ * Command & data for AFU commands.
+ */
+--- a/drivers/scsi/cxlflash/main.c
++++ b/drivers/scsi/cxlflash/main.c
+@@ -2305,7 +2305,7 @@ static struct scsi_host_template driver_
+ .eh_device_reset_handler = cxlflash_eh_device_reset_handler,
+ .eh_host_reset_handler = cxlflash_eh_host_reset_handler,
+ .change_queue_depth = cxlflash_change_queue_depth,
+- .cmd_per_lun = 16,
++ .cmd_per_lun = CXLFLASH_MAX_CMDS_PER_LUN,
+ .can_queue = CXLFLASH_MAX_CMDS,
+ .this_id = -1,
+ .sg_tablesize = SG_NONE, /* No scatter gather support */
--- /dev/null
+From a9f61ca793becabdefab03b77568d6c6f8c1bc79 Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Fri, 3 Jun 2016 17:09:22 -0700
+Subject: Drivers: hv: avoid vfree() on crash
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+commit a9f61ca793becabdefab03b77568d6c6f8c1bc79 upstream.
+
+When we crash from NMI context (e.g. after NMI injection from host when
+'sysctl -w kernel.unknown_nmi_panic=1' is set) we hit
+
+ kernel BUG at mm/vmalloc.c:1530!
+
+as vfree() is denied. While the issue could be solved with in_nmi() check
+instead I opted for skipping vfree on all sorts of crashes to reduce the
+amount of work which can cause consequent crashes. We don't really need to
+free anything on crash.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/hv.c | 8 +++++---
+ drivers/hv/hyperv_vmbus.h | 2 +-
+ drivers/hv/vmbus_drv.c | 8 ++++----
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/hv/hv.c
++++ b/drivers/hv/hv.c
+@@ -274,7 +274,7 @@ cleanup:
+ *
+ * This routine is called normally during driver unloading or exiting.
+ */
+-void hv_cleanup(void)
++void hv_cleanup(bool crash)
+ {
+ union hv_x64_msr_hypercall_contents hypercall_msr;
+
+@@ -284,7 +284,8 @@ void hv_cleanup(void)
+ if (hv_context.hypercall_page) {
+ hypercall_msr.as_uint64 = 0;
+ wrmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
+- vfree(hv_context.hypercall_page);
++ if (!crash)
++ vfree(hv_context.hypercall_page);
+ hv_context.hypercall_page = NULL;
+ }
+
+@@ -304,7 +305,8 @@ void hv_cleanup(void)
+
+ hypercall_msr.as_uint64 = 0;
+ wrmsrl(HV_X64_MSR_REFERENCE_TSC, hypercall_msr.as_uint64);
+- vfree(hv_context.tsc_page);
++ if (!crash)
++ vfree(hv_context.tsc_page);
+ hv_context.tsc_page = NULL;
+ }
+ #endif
+--- a/drivers/hv/hyperv_vmbus.h
++++ b/drivers/hv/hyperv_vmbus.h
+@@ -581,7 +581,7 @@ struct hv_ring_buffer_debug_info {
+
+ extern int hv_init(void);
+
+-extern void hv_cleanup(void);
++extern void hv_cleanup(bool crash);
+
+ extern int hv_post_message(union hv_connection_id connection_id,
+ enum hv_message_type message_type,
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -889,7 +889,7 @@ err_alloc:
+ bus_unregister(&hv_bus);
+
+ err_cleanup:
+- hv_cleanup();
++ hv_cleanup(false);
+
+ return ret;
+ }
+@@ -1254,7 +1254,7 @@ static void hv_kexec_handler(void)
+ vmbus_initiate_unload();
+ for_each_online_cpu(cpu)
+ smp_call_function_single(cpu, hv_synic_cleanup, NULL, 1);
+- hv_cleanup();
++ hv_cleanup(false);
+ };
+
+ static void hv_crash_handler(struct pt_regs *regs)
+@@ -1266,7 +1266,7 @@ static void hv_crash_handler(struct pt_r
+ * for kdump.
+ */
+ hv_synic_cleanup(NULL);
+- hv_cleanup();
++ hv_cleanup(true);
+ };
+
+ static int __init hv_acpi_init(void)
+@@ -1330,7 +1330,7 @@ static void __exit vmbus_exit(void)
+ &hyperv_panic_block);
+ }
+ bus_unregister(&hv_bus);
+- hv_cleanup();
++ hv_cleanup(false);
+ for_each_online_cpu(cpu) {
+ tasklet_kill(hv_context.event_dpc[cpu]);
+ smp_call_function_single(cpu, hv_synic_cleanup, NULL, 1);
--- /dev/null
+From 77c0c9735bc0ba5898e637a3a20d6bcb50e3f67d Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Sat, 30 Apr 2016 19:21:35 -0700
+Subject: Drivers: hv: balloon: don't crash when memory is added in non-sorted order
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+commit 77c0c9735bc0ba5898e637a3a20d6bcb50e3f67d upstream.
+
+When we iterate through all HA regions in handle_pg_range() we have an
+assumption that all these regions are sorted in the list and the
+'start_pfn >= has->end_pfn' check is enough to find the proper region.
+Unfortunately it's not the case with WS2016 where host can hot-add regions
+in a different order. We end up modifying the wrong HA region and crashing
+later on pages online. Modify the check to make sure we found the region
+we were searching for while iterating. Fix the same check in pfn_covered()
+as well.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/hv_balloon.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hv/hv_balloon.c
++++ b/drivers/hv/hv_balloon.c
+@@ -714,7 +714,7 @@ static bool pfn_covered(unsigned long st
+ * If the pfn range we are dealing with is not in the current
+ * "hot add block", move on.
+ */
+- if ((start_pfn >= has->end_pfn))
++ if (start_pfn < has->start_pfn || start_pfn >= has->end_pfn)
+ continue;
+ /*
+ * If the current hot add-request extends beyond
+@@ -768,7 +768,7 @@ static unsigned long handle_pg_range(uns
+ * If the pfn range we are dealing with is not in the current
+ * "hot add block", move on.
+ */
+- if ((start_pfn >= has->end_pfn))
++ if (start_pfn < has->start_pfn || start_pfn >= has->end_pfn)
+ continue;
+
+ old_covered_state = has->covered_end_pfn;
--- /dev/null
+From e9c5e7402dad6f4f04c2430db6f283512bcd4392 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Thu, 14 Jan 2016 08:07:55 +1000
+Subject: drm/amdgpu: add missing irq.h include
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit e9c5e7402dad6f4f04c2430db6f283512bcd4392 upstream.
+
+this fixes the build on arm.
+
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
+@@ -25,6 +25,7 @@
+ * Alex Deucher
+ * Jerome Glisse
+ */
++#include <linux/irq.h>
+ #include <drm/drmP.h>
+ #include <drm/drm_crtc_helper.h>
+ #include <drm/amdgpu_drm.h>
--- /dev/null
+From 474c90156c8dcc2fa815e6716cc9394d7930cb9c Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 2 Mar 2017 12:17:22 -0800
+Subject: give up on gcc ilog2() constant optimizations
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 474c90156c8dcc2fa815e6716cc9394d7930cb9c upstream.
+
+gcc-7 has an "optimization" pass that completely screws up, and
+generates the code expansion for the (impossible) case of calling
+ilog2() with a zero constant, even when the code gcc compiles does not
+actually have a zero constant.
+
+And we try to generate a compile-time error for anybody doing ilog2() on
+a constant where that doesn't make sense (be it zero or negative). So
+now gcc7 will fail the build due to our sanity checking, because it
+created that constant-zero case that didn't actually exist in the source
+code.
+
+There's a whole long discussion on the kernel mailing about how to work
+around this gcc bug. The gcc people themselevs have discussed their
+"feature" in
+
+ https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72785
+
+but it's all water under the bridge, because while it looked at one
+point like it would be solved by the time gcc7 was released, that was
+not to be.
+
+So now we have to deal with this compiler braindamage.
+
+And the only simple approach seems to be to just delete the code that
+tries to warn about bad uses of ilog2().
+
+So now "ilog2()" will just return 0 not just for the value 1, but for
+any non-positive value too.
+
+It's not like I can recall anybody having ever actually tried to use
+this function on any invalid value, but maybe the sanity check just
+meant that such code never made it out in public.
+
+Reported-by: Laura Abbott <labbott@redhat.com>
+Cc: John Stultz <john.stultz@linaro.org>,
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/log2.h | 13 ++-----------
+ tools/include/linux/log2.h | 13 ++-----------
+ 2 files changed, 4 insertions(+), 22 deletions(-)
+
+--- a/include/linux/log2.h
++++ b/include/linux/log2.h
+@@ -16,12 +16,6 @@
+ #include <linux/bitops.h>
+
+ /*
+- * deal with unrepresentable constant logarithms
+- */
+-extern __attribute__((const, noreturn))
+-int ____ilog2_NaN(void);
+-
+-/*
+ * non-constant log of base 2 calculators
+ * - the arch may override these in asm/bitops.h if they can be implemented
+ * more efficiently than using fls() and fls64()
+@@ -85,7 +79,7 @@ unsigned long __rounddown_pow_of_two(uns
+ #define ilog2(n) \
+ ( \
+ __builtin_constant_p(n) ? ( \
+- (n) < 1 ? ____ilog2_NaN() : \
++ (n) < 2 ? 0 : \
+ (n) & (1ULL << 63) ? 63 : \
+ (n) & (1ULL << 62) ? 62 : \
+ (n) & (1ULL << 61) ? 61 : \
+@@ -148,10 +142,7 @@ unsigned long __rounddown_pow_of_two(uns
+ (n) & (1ULL << 4) ? 4 : \
+ (n) & (1ULL << 3) ? 3 : \
+ (n) & (1ULL << 2) ? 2 : \
+- (n) & (1ULL << 1) ? 1 : \
+- (n) & (1ULL << 0) ? 0 : \
+- ____ilog2_NaN() \
+- ) : \
++ 1 ) : \
+ (sizeof(n) <= 4) ? \
+ __ilog2_u32(n) : \
+ __ilog2_u64(n) \
+--- a/tools/include/linux/log2.h
++++ b/tools/include/linux/log2.h
+@@ -13,12 +13,6 @@
+ #define _TOOLS_LINUX_LOG2_H
+
+ /*
+- * deal with unrepresentable constant logarithms
+- */
+-extern __attribute__((const, noreturn))
+-int ____ilog2_NaN(void);
+-
+-/*
+ * non-constant log of base 2 calculators
+ * - the arch may override these in asm/bitops.h if they can be implemented
+ * more efficiently than using fls() and fls64()
+@@ -78,7 +72,7 @@ unsigned long __rounddown_pow_of_two(uns
+ #define ilog2(n) \
+ ( \
+ __builtin_constant_p(n) ? ( \
+- (n) < 1 ? ____ilog2_NaN() : \
++ (n) < 2 ? 0 : \
+ (n) & (1ULL << 63) ? 63 : \
+ (n) & (1ULL << 62) ? 62 : \
+ (n) & (1ULL << 61) ? 61 : \
+@@ -141,10 +135,7 @@ unsigned long __rounddown_pow_of_two(uns
+ (n) & (1ULL << 4) ? 4 : \
+ (n) & (1ULL << 3) ? 3 : \
+ (n) & (1ULL << 2) ? 2 : \
+- (n) & (1ULL << 1) ? 1 : \
+- (n) & (1ULL << 0) ? 0 : \
+- ____ilog2_NaN() \
+- ) : \
++ 1 ) : \
+ (sizeof(n) <= 4) ? \
+ __ilog2_u32(n) : \
+ __ilog2_u64(n) \
--- /dev/null
+From 757647e10e55c01fb7a9c4356529442e316a7c72 Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Mon, 25 Jan 2016 16:00:41 +0100
+Subject: hv_netvsc: use skb_get_hash() instead of a homegrown implementation
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+commit 757647e10e55c01fb7a9c4356529442e316a7c72 upstream.
+
+Recent changes to 'struct flow_keys' (e.g commit d34af823ff40 ("net: Add
+VLAN ID to flow_keys")) introduced a performance regression in netvsc
+driver. Is problem is, however, not the above mentioned commit but the
+fact that netvsc_set_hash() function did some assumptions on the struct
+flow_keys data layout and this is wrong.
+
+Get rid of netvsc_set_hash() by switching to skb_get_hash(). This change
+will also imply switching to Jenkins hash from the currently used Toeplitz
+but it seems there is no good excuse for Toeplitz to stay.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/hyperv/netvsc_drv.c | 67 +---------------------------------------
+ 1 file changed, 3 insertions(+), 64 deletions(-)
+
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -197,65 +197,6 @@ static void *init_ppi_data(struct rndis_
+ return ppi;
+ }
+
+-union sub_key {
+- u64 k;
+- struct {
+- u8 pad[3];
+- u8 kb;
+- u32 ka;
+- };
+-};
+-
+-/* Toeplitz hash function
+- * data: network byte order
+- * return: host byte order
+- */
+-static u32 comp_hash(u8 *key, int klen, void *data, int dlen)
+-{
+- union sub_key subk;
+- int k_next = 4;
+- u8 dt;
+- int i, j;
+- u32 ret = 0;
+-
+- subk.k = 0;
+- subk.ka = ntohl(*(u32 *)key);
+-
+- for (i = 0; i < dlen; i++) {
+- subk.kb = key[k_next];
+- k_next = (k_next + 1) % klen;
+- dt = ((u8 *)data)[i];
+- for (j = 0; j < 8; j++) {
+- if (dt & 0x80)
+- ret ^= subk.ka;
+- dt <<= 1;
+- subk.k <<= 1;
+- }
+- }
+-
+- return ret;
+-}
+-
+-static bool netvsc_set_hash(u32 *hash, struct sk_buff *skb)
+-{
+- struct flow_keys flow;
+- int data_len;
+-
+- if (!skb_flow_dissect_flow_keys(skb, &flow, 0) ||
+- !(flow.basic.n_proto == htons(ETH_P_IP) ||
+- flow.basic.n_proto == htons(ETH_P_IPV6)))
+- return false;
+-
+- if (flow.basic.ip_proto == IPPROTO_TCP)
+- data_len = 12;
+- else
+- data_len = 8;
+-
+- *hash = comp_hash(netvsc_hash_key, HASH_KEYLEN, &flow, data_len);
+-
+- return true;
+-}
+-
+ static u16 netvsc_select_queue(struct net_device *ndev, struct sk_buff *skb,
+ void *accel_priv, select_queue_fallback_t fallback)
+ {
+@@ -268,11 +209,9 @@ static u16 netvsc_select_queue(struct ne
+ if (nvsc_dev == NULL || ndev->real_num_tx_queues <= 1)
+ return 0;
+
+- if (netvsc_set_hash(&hash, skb)) {
+- q_idx = nvsc_dev->send_table[hash % VRSS_SEND_TAB_SIZE] %
+- ndev->real_num_tx_queues;
+- skb_set_hash(skb, hash, PKT_HASH_TYPE_L3);
+- }
++ hash = skb_get_hash(skb);
++ q_idx = nvsc_dev->send_table[hash % VRSS_SEND_TAB_SIZE] %
++ ndev->real_num_tx_queues;
+
+ return q_idx;
+ }
--- /dev/null
+From 725fc629ff2545b061407305ae51016c9f928fce Mon Sep 17 00:00:00 2001
+From: Andi Kleen <ak@linux.intel.com>
+Date: Mon, 23 May 2016 16:24:05 -0700
+Subject: kernek/fork.c: allocate idle task for a CPU always on its local node
+
+From: Andi Kleen <ak@linux.intel.com>
+
+commit 725fc629ff2545b061407305ae51016c9f928fce upstream.
+
+Linux preallocates the task structs of the idle tasks for all possible
+CPUs. This currently means they all end up on node 0. This also
+implies that the cache line of MWAIT, which is around the flags field in
+the task struct, are all located in node 0.
+
+We see a noticeable performance improvement on Knights Landing CPUs when
+the cache lines used for MWAIT are located in the local nodes of the
+CPUs using them. I would expect this to give a (likely slight)
+improvement on other systems too.
+
+The patch implements placing the idle task in the node of its CPUs, by
+passing the right target node to copy_process()
+
+[akpm@linux-foundation.org: use NUMA_NO_NODE, not a bare -1]
+Link: http://lkml.kernel.org/r/1463492694-15833-1-git-send-email-andi@firstfloor.org
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/fork.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -331,13 +331,14 @@ void set_task_stack_end_magic(struct tas
+ *stackend = STACK_END_MAGIC; /* for overflow detection */
+ }
+
+-static struct task_struct *dup_task_struct(struct task_struct *orig)
++static struct task_struct *dup_task_struct(struct task_struct *orig, int node)
+ {
+ struct task_struct *tsk;
+ struct thread_info *ti;
+- int node = tsk_fork_get_node(orig);
+ int err;
+
++ if (node == NUMA_NO_NODE)
++ node = tsk_fork_get_node(orig);
+ tsk = alloc_task_struct_node(node);
+ if (!tsk)
+ return NULL;
+@@ -1270,7 +1271,8 @@ static struct task_struct *copy_process(
+ int __user *child_tidptr,
+ struct pid *pid,
+ int trace,
+- unsigned long tls)
++ unsigned long tls,
++ int node)
+ {
+ int retval;
+ struct task_struct *p;
+@@ -1323,7 +1325,7 @@ static struct task_struct *copy_process(
+ goto fork_out;
+
+ retval = -ENOMEM;
+- p = dup_task_struct(current);
++ p = dup_task_struct(current, node);
+ if (!p)
+ goto fork_out;
+
+@@ -1699,7 +1701,8 @@ static inline void init_idle_pids(struct
+ struct task_struct *fork_idle(int cpu)
+ {
+ struct task_struct *task;
+- task = copy_process(CLONE_VM, 0, 0, NULL, &init_struct_pid, 0, 0);
++ task = copy_process(CLONE_VM, 0, 0, NULL, &init_struct_pid, 0, 0,
++ cpu_to_node(cpu));
+ if (!IS_ERR(task)) {
+ init_idle_pids(task->pids);
+ init_idle(task, cpu);
+@@ -1744,7 +1747,7 @@ long _do_fork(unsigned long clone_flags,
+ }
+
+ p = copy_process(clone_flags, stack_start, stack_size,
+- child_tidptr, NULL, trace, tls);
++ child_tidptr, NULL, trace, tls, NUMA_NO_NODE);
+ /*
+ * Do this prior waking up the new thread - the thread pointer
+ * might get invalid after that point, if the thread exits quickly.
--- /dev/null
+From 708e75a3ee750dce1072134e630d66c4e6eaf63c Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Wed, 18 May 2016 21:01:20 +0200
+Subject: KVM: PPC: Book3S PR: Fix illegal opcode emulation
+
+From: Thomas Huth <thuth@redhat.com>
+
+commit 708e75a3ee750dce1072134e630d66c4e6eaf63c upstream.
+
+If kvmppc_handle_exit_pr() calls kvmppc_emulate_instruction() to emulate
+one instruction (in the BOOK3S_INTERRUPT_H_EMUL_ASSIST case), it calls
+kvmppc_core_queue_program() afterwards if kvmppc_emulate_instruction()
+returned EMULATE_FAIL, so the guest gets an program interrupt for the
+illegal opcode.
+However, the kvmppc_emulate_instruction() also tried to inject a
+program exception for this already, so the program interrupt gets
+injected twice and the return address in srr0 gets destroyed.
+All other callers of kvmppc_emulate_instruction() are also injecting
+a program interrupt, and since the callers have the right knowledge
+about the srr1 flags that should be used, it is the function
+kvmppc_emulate_instruction() that should _not_ inject program
+interrupts, so remove the kvmppc_core_queue_program() here.
+
+This fixes the issue discovered by Laurent Vivier with kvm-unit-tests
+where the logs are filled with these messages when the test tries
+to execute an illegal instruction:
+
+ Couldn't emulate instruction 0x00000000 (op 0 xop 0)
+ kvmppc_handle_exit_pr: emulation at 700 failed (00000000)
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Alexander Graf <agraf@suse.de>
+Tested-by: Laurent Vivier <lvivier@redhat.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kvm/emulate.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/powerpc/kvm/emulate.c
++++ b/arch/powerpc/kvm/emulate.c
+@@ -302,7 +302,6 @@ int kvmppc_emulate_instruction(struct kv
+ advance = 0;
+ printk(KERN_ERR "Couldn't emulate instruction 0x%08x "
+ "(op %d xop %d)\n", inst, get_op(inst), get_xop(inst));
+- kvmppc_core_queue_program(vcpu, 0);
+ }
+ }
+
--- /dev/null
+From bcb48cca23ec9852739e4a464307fa29515bbe48 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Mon, 22 Aug 2016 14:42:52 +0300
+Subject: pinctrl: cherryview: Do not mask all interrupts in probe
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit bcb48cca23ec9852739e4a464307fa29515bbe48 upstream.
+
+The Cherryview GPIO controller has 8 or 16 wires connected to the I/O-APIC
+which can be used directly by the platform/BIOS or drivers. One such wire
+is used as SCI (System Control Interrupt) which ACPI depends on to be able
+to trigger GPEs (General Purpose Events).
+
+The pinctrl driver itself uses another IRQ resource which is wire OR of all
+the 8 (or 16) wires and follows what BIOS has programmed to the IntSel
+register of each pin.
+
+Currently the driver masks all interrupts at probe time and this prevents
+these direct interrupts from working as expected. The reason for this is
+that some early stage prototypes had some pins misconfigured causing lots
+of spurious interrupts.
+
+We fix this by leaving the interrupt mask untouched. This allows SCI and
+other direct interrupts work properly. What comes to the possible spurious
+interrupts we switch the default handler to be handle_bad_irq() instead of
+handle_simple_irq() (which was not correct anyway).
+
+Reported-by: Yu C Chen <yu.c.chen@intel.com>
+Reported-by: Anisse Astier <anisse@astier.eu>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/intel/pinctrl-cherryview.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -1466,12 +1466,11 @@ static int chv_gpio_probe(struct chv_pin
+ offset += range->npins;
+ }
+
+- /* Mask and clear all interrupts */
+- chv_writel(0, pctrl->regs + CHV_INTMASK);
++ /* Clear all interrupts */
+ chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
+
+ ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
+- handle_simple_irq, IRQ_TYPE_NONE);
++ handle_bad_irq, IRQ_TYPE_NONE);
+ if (ret) {
+ dev_err(pctrl->dev, "failed to add IRQ chip\n");
+ goto fail;
--- /dev/null
+From dba599091c191d209b1499511a524ad9657c0e5a Mon Sep 17 00:00:00 2001
+From: Sebastian Ott <sebott@linux.vnet.ibm.com>
+Date: Fri, 15 Apr 2016 09:41:35 +0200
+Subject: s390/pci: fix use after free in dma_init
+
+From: Sebastian Ott <sebott@linux.vnet.ibm.com>
+
+commit dba599091c191d209b1499511a524ad9657c0e5a upstream.
+
+After a failure during registration of the dma_table (because of the
+function being in error state) we free its memory but don't reset the
+associated pointer to zero.
+
+When we then receive a notification from firmware (about the function
+being in error state) we'll try to walk and free the dma_table again.
+
+Fix this by resetting the dma_table pointer. In addition to that make
+sure that we free the iommu_bitmap when appropriate.
+
+Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
+Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/pci/pci_dma.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/arch/s390/pci/pci_dma.c
++++ b/arch/s390/pci/pci_dma.c
+@@ -455,7 +455,7 @@ int zpci_dma_init_device(struct zpci_dev
+ zdev->dma_table = dma_alloc_cpu_table();
+ if (!zdev->dma_table) {
+ rc = -ENOMEM;
+- goto out_clean;
++ goto out;
+ }
+
+ /*
+@@ -475,18 +475,22 @@ int zpci_dma_init_device(struct zpci_dev
+ zdev->iommu_bitmap = vzalloc(zdev->iommu_pages / 8);
+ if (!zdev->iommu_bitmap) {
+ rc = -ENOMEM;
+- goto out_reg;
++ goto free_dma_table;
+ }
+
+ rc = zpci_register_ioat(zdev, 0, zdev->start_dma, zdev->end_dma,
+ (u64) zdev->dma_table);
+ if (rc)
+- goto out_reg;
+- return 0;
++ goto free_bitmap;
+
+-out_reg:
++ return 0;
++free_bitmap:
++ vfree(zdev->iommu_bitmap);
++ zdev->iommu_bitmap = NULL;
++free_dma_table:
+ dma_free_cpu_table(zdev->dma_table);
+-out_clean:
++ zdev->dma_table = NULL;
++out:
+ return rc;
+ }
+
usb-core-hub-hub_port_init-lock-controller-instead-of-bus.patch
usb-don-t-free-bandwidth_mutex-too-early.patch
+crypto-ghash-clmulni-fix-load-failure.patch
+crypto-cryptd-assign-statesize-properly.patch
+crypto-mcryptd-fix-load-failure.patch
+cxlflash-increase-cmd_per_lun-for-better-throughput.patch
+acpi-video-skip-evaluating-_dod-when-it-does-not-exist.patch
+pinctrl-cherryview-do-not-mask-all-interrupts-in-probe.patch
+drivers-hv-balloon-don-t-crash-when-memory-is-added-in-non-sorted-order.patch
+drivers-hv-avoid-vfree-on-crash.patch
+xen-qspinlock-don-t-kick-cpu-if-irq-is-not-initialized.patch
+kvm-ppc-book3s-pr-fix-illegal-opcode-emulation.patch
+s390-pci-fix-use-after-free-in-dma_init.patch
+drm-amdgpu-add-missing-irq.h-include.patch
+tpm_tis-use-devm_free_irq-not-free_irq.patch
+hv_netvsc-use-skb_get_hash-instead-of-a-homegrown-implementation.patch
+kernek-fork.c-allocate-idle-task-for-a-cpu-always-on-its-local-node.patch
+give-up-on-gcc-ilog2-constant-optimizations.patch
--- /dev/null
+From 727f28b8ca24a581c7bd868326b8cea1058c720a Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Date: Wed, 25 Nov 2015 14:05:30 -0700
+Subject: tpm_tis: Use devm_free_irq not free_irq
+
+From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+
+commit 727f28b8ca24a581c7bd868326b8cea1058c720a upstream.
+
+The interrupt is always allocated with devm_request_irq so it
+must always be freed with devm_free_irq.
+
+Fixes: 448e9c55c12d ("tpm_tis: verify interrupt during init")
+Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Acked-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Tested-by: Martin Wilck <Martin.Wilck@ts.fujitsu.com>
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Acked-by: Peter Huewe <peterhuewe@gmx.de>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/tpm/tpm_tis.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -401,7 +401,7 @@ static void disable_interrupts(struct tp
+ iowrite32(intmask,
+ chip->vendor.iobase +
+ TPM_INT_ENABLE(chip->vendor.locality));
+- free_irq(chip->vendor.irq, chip);
++ devm_free_irq(chip->pdev, chip->vendor.irq, chip);
+ chip->vendor.irq = 0;
+ }
+
--- /dev/null
+From 707e59ba494372a90d245f18b0c78982caa88e48 Mon Sep 17 00:00:00 2001
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Fri, 22 Apr 2016 13:05:31 +0100
+Subject: xen/qspinlock: Don't kick CPU if IRQ is not initialized
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+commit 707e59ba494372a90d245f18b0c78982caa88e48 upstream.
+
+The following commit:
+
+ 1fb3a8b2cfb2 ("xen/spinlock: Fix locking path engaging too soon under PVHVM.")
+
+... moved the initalization of the kicker interrupt until after
+native_cpu_up() is called.
+
+However, when using qspinlocks, a CPU may try to kick another CPU that is
+spinning (because it has not yet initialized its kicker interrupt), resulting
+in the following crash during boot:
+
+ kernel BUG at /build/linux-Ay7j_C/linux-4.4.0/drivers/xen/events/events_base.c:1210!
+ invalid opcode: 0000 [#1] SMP
+ ...
+ RIP: 0010:[<ffffffff814c97c9>] [<ffffffff814c97c9>] xen_send_IPI_one+0x59/0x60
+ ...
+ Call Trace:
+ [<ffffffff8102be9e>] xen_qlock_kick+0xe/0x10
+ [<ffffffff810cabc2>] __pv_queued_spin_unlock+0xb2/0xf0
+ [<ffffffff810ca6d1>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
+ [<ffffffff81052936>] ? check_tsc_warp+0x76/0x150
+ [<ffffffff81052aa6>] check_tsc_sync_source+0x96/0x160
+ [<ffffffff81051e28>] native_cpu_up+0x3d8/0x9f0
+ [<ffffffff8102b315>] xen_hvm_cpu_up+0x35/0x80
+ [<ffffffff8108198c>] _cpu_up+0x13c/0x180
+ [<ffffffff81081a4a>] cpu_up+0x7a/0xa0
+ [<ffffffff81f80dfc>] smp_init+0x7f/0x81
+ [<ffffffff81f5a121>] kernel_init_freeable+0xef/0x212
+ [<ffffffff81817f30>] ? rest_init+0x80/0x80
+ [<ffffffff81817f3e>] kernel_init+0xe/0xe0
+ [<ffffffff8182488f>] ret_from_fork+0x3f/0x70
+ [<ffffffff81817f30>] ? rest_init+0x80/0x80
+
+To fix this, only send the kick if the target CPU's interrupt has been
+initialized. This check isn't racy, because the target is waiting for
+the spinlock, so it won't have initialized the interrupt in the
+meantime.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: David Vrabel <david.vrabel@citrix.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-kernel@vger.kernel.org
+Cc: xen-devel@lists.xenproject.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/xen/spinlock.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -27,6 +27,12 @@ static bool xen_pvspin = true;
+
+ static void xen_qlock_kick(int cpu)
+ {
++ int irq = per_cpu(lock_kicker_irq, cpu);
++
++ /* Don't kick if the target's kicker interrupt is not initialized. */
++ if (irq == -1)
++ return;
++
+ xen_send_IPI_one(cpu, XEN_SPIN_UNLOCK_VECTOR);
+ }
+