]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.4-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Mar 2017 16:38:46 +0000 (17:38 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Mar 2017 16:38:46 +0000 (17:38 +0100)
added patches:
acpi-video-skip-evaluating-_dod-when-it-does-not-exist.patch
crypto-cryptd-assign-statesize-properly.patch
crypto-ghash-clmulni-fix-load-failure.patch
crypto-mcryptd-fix-load-failure.patch
cxlflash-increase-cmd_per_lun-for-better-throughput.patch
drivers-hv-avoid-vfree-on-crash.patch
drivers-hv-balloon-don-t-crash-when-memory-is-added-in-non-sorted-order.patch
drm-amdgpu-add-missing-irq.h-include.patch
give-up-on-gcc-ilog2-constant-optimizations.patch
hv_netvsc-use-skb_get_hash-instead-of-a-homegrown-implementation.patch
kernek-fork.c-allocate-idle-task-for-a-cpu-always-on-its-local-node.patch
kvm-ppc-book3s-pr-fix-illegal-opcode-emulation.patch
pinctrl-cherryview-do-not-mask-all-interrupts-in-probe.patch
s390-pci-fix-use-after-free-in-dma_init.patch
tpm_tis-use-devm_free_irq-not-free_irq.patch
xen-qspinlock-don-t-kick-cpu-if-irq-is-not-initialized.patch

17 files changed:
queue-4.4/acpi-video-skip-evaluating-_dod-when-it-does-not-exist.patch [new file with mode: 0644]
queue-4.4/crypto-cryptd-assign-statesize-properly.patch [new file with mode: 0644]
queue-4.4/crypto-ghash-clmulni-fix-load-failure.patch [new file with mode: 0644]
queue-4.4/crypto-mcryptd-fix-load-failure.patch [new file with mode: 0644]
queue-4.4/cxlflash-increase-cmd_per_lun-for-better-throughput.patch [new file with mode: 0644]
queue-4.4/drivers-hv-avoid-vfree-on-crash.patch [new file with mode: 0644]
queue-4.4/drivers-hv-balloon-don-t-crash-when-memory-is-added-in-non-sorted-order.patch [new file with mode: 0644]
queue-4.4/drm-amdgpu-add-missing-irq.h-include.patch [new file with mode: 0644]
queue-4.4/give-up-on-gcc-ilog2-constant-optimizations.patch [new file with mode: 0644]
queue-4.4/hv_netvsc-use-skb_get_hash-instead-of-a-homegrown-implementation.patch [new file with mode: 0644]
queue-4.4/kernek-fork.c-allocate-idle-task-for-a-cpu-always-on-its-local-node.patch [new file with mode: 0644]
queue-4.4/kvm-ppc-book3s-pr-fix-illegal-opcode-emulation.patch [new file with mode: 0644]
queue-4.4/pinctrl-cherryview-do-not-mask-all-interrupts-in-probe.patch [new file with mode: 0644]
queue-4.4/s390-pci-fix-use-after-free-in-dma_init.patch [new file with mode: 0644]
queue-4.4/series
queue-4.4/tpm_tis-use-devm_free_irq-not-free_irq.patch [new file with mode: 0644]
queue-4.4/xen-qspinlock-don-t-kick-cpu-if-irq-is-not-initialized.patch [new file with mode: 0644]

diff --git a/queue-4.4/acpi-video-skip-evaluating-_dod-when-it-does-not-exist.patch b/queue-4.4/acpi-video-skip-evaluating-_dod-when-it-does-not-exist.patch
new file mode 100644 (file)
index 0000000..340e54b
--- /dev/null
@@ -0,0 +1,34 @@
+From e34fbbac669de0b7fb7803929d0477f35f6e2833 Mon Sep 17 00:00:00 2001
+From: Alex Hung <alex.hung@canonical.com>
+Date: Fri, 27 May 2016 15:47:06 +0800
+Subject: ACPI / video: skip evaluating _DOD when it does not exist
+
+From: Alex Hung <alex.hung@canonical.com>
+
+commit e34fbbac669de0b7fb7803929d0477f35f6e2833 upstream.
+
+Some system supports hybrid graphics and its discrete VGA
+does not have any connectors and therefore has no _DOD method.
+
+Signed-off-by: Alex Hung <alex.hung@canonical.com>
+Reviewed-by: Aaron Lu <aaron.lu@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpi_video.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -1211,6 +1211,9 @@ static int acpi_video_device_enumerate(s
+       union acpi_object *dod = NULL;
+       union acpi_object *obj;
++      if (!video->cap._DOD)
++              return AE_NOT_EXIST;
++
+       status = acpi_evaluate_object(video->device->handle, "_DOD", NULL, &buffer);
+       if (!ACPI_SUCCESS(status)) {
+               ACPI_EXCEPTION((AE_INFO, status, "Evaluating _DOD"));
diff --git a/queue-4.4/crypto-cryptd-assign-statesize-properly.patch b/queue-4.4/crypto-cryptd-assign-statesize-properly.patch
new file mode 100644 (file)
index 0000000..98fcc48
--- /dev/null
@@ -0,0 +1,34 @@
+From 1a07834024dfca5c4bed5de8f8714306e0a11836 Mon Sep 17 00:00:00 2001
+From: "Wang, Rui Y" <rui.y.wang@intel.com>
+Date: Sun, 29 Nov 2015 22:45:34 +0800
+Subject: crypto: cryptd - Assign statesize properly
+
+From: Wang, Rui Y <rui.y.wang@intel.com>
+
+commit 1a07834024dfca5c4bed5de8f8714306e0a11836 upstream.
+
+cryptd_create_hash() fails by returning -EINVAL.  It is because after
+8996eafdc ("crypto: ahash - ensure statesize is non-zero") all ahash
+drivers must have a non-zero statesize.
+
+This patch fixes the problem by properly assigning the statesize.
+
+Signed-off-by: Rui Wang <rui.y.wang@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/cryptd.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/crypto/cryptd.c
++++ b/crypto/cryptd.c
+@@ -642,6 +642,7 @@ static int cryptd_create_hash(struct cry
+       inst->alg.halg.base.cra_flags = type;
+       inst->alg.halg.digestsize = salg->digestsize;
++      inst->alg.halg.statesize = salg->statesize;
+       inst->alg.halg.base.cra_ctxsize = sizeof(struct cryptd_hash_ctx);
+       inst->alg.halg.base.cra_init = cryptd_hash_init_tfm;
diff --git a/queue-4.4/crypto-ghash-clmulni-fix-load-failure.patch b/queue-4.4/crypto-ghash-clmulni-fix-load-failure.patch
new file mode 100644 (file)
index 0000000..9c14495
--- /dev/null
@@ -0,0 +1,74 @@
+From 3a020a723c65eb8ffa7c237faca26521a024e582 Mon Sep 17 00:00:00 2001
+From: "Wang, Rui Y" <rui.y.wang@intel.com>
+Date: Sun, 29 Nov 2015 22:45:33 +0800
+Subject: crypto: ghash-clmulni - Fix load failure
+
+From: Wang, Rui Y <rui.y.wang@intel.com>
+
+commit 3a020a723c65eb8ffa7c237faca26521a024e582 upstream.
+
+ghash_clmulni_intel fails to load on Linux 4.3+ with the following message:
+"modprobe: ERROR: could not insert 'ghash_clmulni_intel': Invalid argument"
+
+After 8996eafdc ("crypto: ahash - ensure statesize is non-zero") all ahash
+drivers are required to implement import()/export(), and must have a non-
+zero statesize.
+
+This patch has been tested with the algif_hash interface. The calculated
+digest values, after several rounds of import()s and export()s, match those
+calculated by tcrypt.
+
+Signed-off-by: Rui Wang <rui.y.wang@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ arch/x86/crypto/ghash-clmulni-intel_glue.c |   26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c
++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+@@ -219,6 +219,29 @@ static int ghash_async_final(struct ahas
+       }
+ }
++static int ghash_async_import(struct ahash_request *req, const void *in)
++{
++      struct ahash_request *cryptd_req = ahash_request_ctx(req);
++      struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
++      struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
++
++      ghash_async_init(req);
++      memcpy(dctx, in, sizeof(*dctx));
++      return 0;
++
++}
++
++static int ghash_async_export(struct ahash_request *req, void *out)
++{
++      struct ahash_request *cryptd_req = ahash_request_ctx(req);
++      struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
++      struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
++
++      memcpy(out, dctx, sizeof(*dctx));
++      return 0;
++
++}
++
+ static int ghash_async_digest(struct ahash_request *req)
+ {
+       struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+@@ -288,8 +311,11 @@ static struct ahash_alg ghash_async_alg
+       .final          = ghash_async_final,
+       .setkey         = ghash_async_setkey,
+       .digest         = ghash_async_digest,
++      .export         = ghash_async_export,
++      .import         = ghash_async_import,
+       .halg = {
+               .digestsize     = GHASH_DIGEST_SIZE,
++              .statesize = sizeof(struct ghash_desc_ctx),
+               .base = {
+                       .cra_name               = "ghash",
+                       .cra_driver_name        = "ghash-clmulni",
diff --git a/queue-4.4/crypto-mcryptd-fix-load-failure.patch b/queue-4.4/crypto-mcryptd-fix-load-failure.patch
new file mode 100644 (file)
index 0000000..4273b5c
--- /dev/null
@@ -0,0 +1,32 @@
+From ddef482420b1ba8ec45e6123a7e8d3f67b21e5e3 Mon Sep 17 00:00:00 2001
+From: "Wang, Rui Y" <rui.y.wang@intel.com>
+Date: Wed, 27 Jan 2016 17:08:36 +0800
+Subject: crypto: mcryptd - Fix load failure
+
+From: Wang, Rui Y <rui.y.wang@intel.com>
+
+commit ddef482420b1ba8ec45e6123a7e8d3f67b21e5e3 upstream.
+
+mcryptd_create_hash() fails by returning -EINVAL, causing any
+driver using mcryptd to fail to load. It is because it needs
+to set its statesize properly.
+
+Signed-off-by: Rui Wang <rui.y.wang@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/mcryptd.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/crypto/mcryptd.c
++++ b/crypto/mcryptd.c
+@@ -531,6 +531,7 @@ static int mcryptd_create_hash(struct cr
+       inst->alg.halg.base.cra_flags = type;
+       inst->alg.halg.digestsize = salg->digestsize;
++      inst->alg.halg.statesize = salg->statesize;
+       inst->alg.halg.base.cra_ctxsize = sizeof(struct mcryptd_hash_ctx);
+       inst->alg.halg.base.cra_init = mcryptd_hash_init_tfm;
diff --git a/queue-4.4/cxlflash-increase-cmd_per_lun-for-better-throughput.patch b/queue-4.4/cxlflash-increase-cmd_per_lun-for-better-throughput.patch
new file mode 100644 (file)
index 0000000..7bb183d
--- /dev/null
@@ -0,0 +1,73 @@
+From 83430833b4d4a9c9b23964babbeb1f36450f8136 Mon Sep 17 00:00:00 2001
+From: "Manoj N. Kumar" <manoj@linux.vnet.ibm.com>
+Date: Fri, 4 Mar 2016 15:55:20 -0600
+Subject: cxlflash: Increase cmd_per_lun for better throughput
+
+From: Manoj N. Kumar <manoj@linux.vnet.ibm.com>
+
+commit 83430833b4d4a9c9b23964babbeb1f36450f8136 upstream.
+
+With the current value of cmd_per_lun at 16, the throughput
+over a single adapter is limited to around 150kIOPS.
+
+Increase the value of cmd_per_lun to 256 to improve
+throughput. With this change a single adapter is able to
+attain close to the maximum throughput (380kIOPS).
+Also change the number of RRQ entries that can be queued.
+
+Signed-off-by: Manoj N. Kumar <manoj@linux.vnet.ibm.com>
+Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
+Reviewed-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/cxlflash/common.h |    8 +++++---
+ drivers/scsi/cxlflash/main.c   |    2 +-
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/cxlflash/common.h
++++ b/drivers/scsi/cxlflash/common.h
+@@ -34,7 +34,6 @@ extern const struct file_operations cxlf
+                                                                  sectors
+                                                               */
+-#define NUM_RRQ_ENTRY    16     /* for master issued cmds */
+ #define MAX_RHT_PER_CONTEXT (PAGE_SIZE / sizeof(struct sisl_rht_entry))
+ /* AFU command retry limit */
+@@ -48,9 +47,12 @@ extern const struct file_operations cxlf
+                                                          index derivation
+                                                        */
+-#define CXLFLASH_MAX_CMDS               16
++#define CXLFLASH_MAX_CMDS               256
+ #define CXLFLASH_MAX_CMDS_PER_LUN       CXLFLASH_MAX_CMDS
++/* RRQ for master issued cmds */
++#define NUM_RRQ_ENTRY                   CXLFLASH_MAX_CMDS
++
+ static inline void check_sizes(void)
+ {
+@@ -149,7 +151,7 @@ struct afu_cmd {
+ struct afu {
+       /* Stuff requiring alignment go first. */
+-      u64 rrq_entry[NUM_RRQ_ENTRY];   /* 128B RRQ */
++      u64 rrq_entry[NUM_RRQ_ENTRY];   /* 2K RRQ */
+       /*
+        * Command & data for AFU commands.
+        */
+--- a/drivers/scsi/cxlflash/main.c
++++ b/drivers/scsi/cxlflash/main.c
+@@ -2305,7 +2305,7 @@ static struct scsi_host_template driver_
+       .eh_device_reset_handler = cxlflash_eh_device_reset_handler,
+       .eh_host_reset_handler = cxlflash_eh_host_reset_handler,
+       .change_queue_depth = cxlflash_change_queue_depth,
+-      .cmd_per_lun = 16,
++      .cmd_per_lun = CXLFLASH_MAX_CMDS_PER_LUN,
+       .can_queue = CXLFLASH_MAX_CMDS,
+       .this_id = -1,
+       .sg_tablesize = SG_NONE,        /* No scatter gather support */
diff --git a/queue-4.4/drivers-hv-avoid-vfree-on-crash.patch b/queue-4.4/drivers-hv-avoid-vfree-on-crash.patch
new file mode 100644 (file)
index 0000000..a109e83
--- /dev/null
@@ -0,0 +1,110 @@
+From a9f61ca793becabdefab03b77568d6c6f8c1bc79 Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Fri, 3 Jun 2016 17:09:22 -0700
+Subject: Drivers: hv: avoid vfree() on crash
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+commit a9f61ca793becabdefab03b77568d6c6f8c1bc79 upstream.
+
+When we crash from NMI context (e.g. after NMI injection from host when
+'sysctl -w kernel.unknown_nmi_panic=1' is set) we hit
+
+    kernel BUG at mm/vmalloc.c:1530!
+
+as vfree() is denied. While the issue could be solved with in_nmi() check
+instead I opted for skipping vfree on all sorts of crashes to reduce the
+amount of work which can cause consequent crashes. We don't really need to
+free anything on crash.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/hv.c           |    8 +++++---
+ drivers/hv/hyperv_vmbus.h |    2 +-
+ drivers/hv/vmbus_drv.c    |    8 ++++----
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/hv/hv.c
++++ b/drivers/hv/hv.c
+@@ -274,7 +274,7 @@ cleanup:
+  *
+  * This routine is called normally during driver unloading or exiting.
+  */
+-void hv_cleanup(void)
++void hv_cleanup(bool crash)
+ {
+       union hv_x64_msr_hypercall_contents hypercall_msr;
+@@ -284,7 +284,8 @@ void hv_cleanup(void)
+       if (hv_context.hypercall_page) {
+               hypercall_msr.as_uint64 = 0;
+               wrmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
+-              vfree(hv_context.hypercall_page);
++              if (!crash)
++                      vfree(hv_context.hypercall_page);
+               hv_context.hypercall_page = NULL;
+       }
+@@ -304,7 +305,8 @@ void hv_cleanup(void)
+               hypercall_msr.as_uint64 = 0;
+               wrmsrl(HV_X64_MSR_REFERENCE_TSC, hypercall_msr.as_uint64);
+-              vfree(hv_context.tsc_page);
++              if (!crash)
++                      vfree(hv_context.tsc_page);
+               hv_context.tsc_page = NULL;
+       }
+ #endif
+--- a/drivers/hv/hyperv_vmbus.h
++++ b/drivers/hv/hyperv_vmbus.h
+@@ -581,7 +581,7 @@ struct hv_ring_buffer_debug_info {
+ extern int hv_init(void);
+-extern void hv_cleanup(void);
++extern void hv_cleanup(bool crash);
+ extern int hv_post_message(union hv_connection_id connection_id,
+                        enum hv_message_type message_type,
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -889,7 +889,7 @@ err_alloc:
+       bus_unregister(&hv_bus);
+ err_cleanup:
+-      hv_cleanup();
++      hv_cleanup(false);
+       return ret;
+ }
+@@ -1254,7 +1254,7 @@ static void hv_kexec_handler(void)
+       vmbus_initiate_unload();
+       for_each_online_cpu(cpu)
+               smp_call_function_single(cpu, hv_synic_cleanup, NULL, 1);
+-      hv_cleanup();
++      hv_cleanup(false);
+ };
+ static void hv_crash_handler(struct pt_regs *regs)
+@@ -1266,7 +1266,7 @@ static void hv_crash_handler(struct pt_r
+        * for kdump.
+        */
+       hv_synic_cleanup(NULL);
+-      hv_cleanup();
++      hv_cleanup(true);
+ };
+ static int __init hv_acpi_init(void)
+@@ -1330,7 +1330,7 @@ static void __exit vmbus_exit(void)
+                                                &hyperv_panic_block);
+       }
+       bus_unregister(&hv_bus);
+-      hv_cleanup();
++      hv_cleanup(false);
+       for_each_online_cpu(cpu) {
+               tasklet_kill(hv_context.event_dpc[cpu]);
+               smp_call_function_single(cpu, hv_synic_cleanup, NULL, 1);
diff --git a/queue-4.4/drivers-hv-balloon-don-t-crash-when-memory-is-added-in-non-sorted-order.patch b/queue-4.4/drivers-hv-balloon-don-t-crash-when-memory-is-added-in-non-sorted-order.patch
new file mode 100644 (file)
index 0000000..b45f52d
--- /dev/null
@@ -0,0 +1,47 @@
+From 77c0c9735bc0ba5898e637a3a20d6bcb50e3f67d Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Sat, 30 Apr 2016 19:21:35 -0700
+Subject: Drivers: hv: balloon: don't crash when memory is added in non-sorted order
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+commit 77c0c9735bc0ba5898e637a3a20d6bcb50e3f67d upstream.
+
+When we iterate through all HA regions in handle_pg_range() we have an
+assumption that all these regions are sorted in the list and the
+'start_pfn >= has->end_pfn' check is enough to find the proper region.
+Unfortunately it's not the case with WS2016 where host can hot-add regions
+in a different order. We end up modifying the wrong HA region and crashing
+later on pages online. Modify the check to make sure we found the region
+we were searching for while iterating. Fix the same check in pfn_covered()
+as well.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/hv_balloon.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hv/hv_balloon.c
++++ b/drivers/hv/hv_balloon.c
+@@ -714,7 +714,7 @@ static bool pfn_covered(unsigned long st
+                * If the pfn range we are dealing with is not in the current
+                * "hot add block", move on.
+                */
+-              if ((start_pfn >= has->end_pfn))
++              if (start_pfn < has->start_pfn || start_pfn >= has->end_pfn)
+                       continue;
+               /*
+                * If the current hot add-request extends beyond
+@@ -768,7 +768,7 @@ static unsigned long handle_pg_range(uns
+                * If the pfn range we are dealing with is not in the current
+                * "hot add block", move on.
+                */
+-              if ((start_pfn >= has->end_pfn))
++              if (start_pfn < has->start_pfn || start_pfn >= has->end_pfn)
+                       continue;
+               old_covered_state = has->covered_end_pfn;
diff --git a/queue-4.4/drm-amdgpu-add-missing-irq.h-include.patch b/queue-4.4/drm-amdgpu-add-missing-irq.h-include.patch
new file mode 100644 (file)
index 0000000..600deb4
--- /dev/null
@@ -0,0 +1,29 @@
+From e9c5e7402dad6f4f04c2430db6f283512bcd4392 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Thu, 14 Jan 2016 08:07:55 +1000
+Subject: drm/amdgpu: add missing irq.h include
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit e9c5e7402dad6f4f04c2430db6f283512bcd4392 upstream.
+
+this fixes the build on arm.
+
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
+@@ -25,6 +25,7 @@
+  *          Alex Deucher
+  *          Jerome Glisse
+  */
++#include <linux/irq.h>
+ #include <drm/drmP.h>
+ #include <drm/drm_crtc_helper.h>
+ #include <drm/amdgpu_drm.h>
diff --git a/queue-4.4/give-up-on-gcc-ilog2-constant-optimizations.patch b/queue-4.4/give-up-on-gcc-ilog2-constant-optimizations.patch
new file mode 100644 (file)
index 0000000..3e43a43
--- /dev/null
@@ -0,0 +1,127 @@
+From 474c90156c8dcc2fa815e6716cc9394d7930cb9c Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 2 Mar 2017 12:17:22 -0800
+Subject: give up on gcc ilog2() constant optimizations
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 474c90156c8dcc2fa815e6716cc9394d7930cb9c upstream.
+
+gcc-7 has an "optimization" pass that completely screws up, and
+generates the code expansion for the (impossible) case of calling
+ilog2() with a zero constant, even when the code gcc compiles does not
+actually have a zero constant.
+
+And we try to generate a compile-time error for anybody doing ilog2() on
+a constant where that doesn't make sense (be it zero or negative).  So
+now gcc7 will fail the build due to our sanity checking, because it
+created that constant-zero case that didn't actually exist in the source
+code.
+
+There's a whole long discussion on the kernel mailing about how to work
+around this gcc bug.  The gcc people themselevs have discussed their
+"feature" in
+
+   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72785
+
+but it's all water under the bridge, because while it looked at one
+point like it would be solved by the time gcc7 was released, that was
+not to be.
+
+So now we have to deal with this compiler braindamage.
+
+And the only simple approach seems to be to just delete the code that
+tries to warn about bad uses of ilog2().
+
+So now "ilog2()" will just return 0 not just for the value 1, but for
+any non-positive value too.
+
+It's not like I can recall anybody having ever actually tried to use
+this function on any invalid value, but maybe the sanity check just
+meant that such code never made it out in public.
+
+Reported-by: Laura Abbott <labbott@redhat.com>
+Cc: John Stultz <john.stultz@linaro.org>,
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/log2.h       |   13 ++-----------
+ tools/include/linux/log2.h |   13 ++-----------
+ 2 files changed, 4 insertions(+), 22 deletions(-)
+
+--- a/include/linux/log2.h
++++ b/include/linux/log2.h
+@@ -16,12 +16,6 @@
+ #include <linux/bitops.h>
+ /*
+- * deal with unrepresentable constant logarithms
+- */
+-extern __attribute__((const, noreturn))
+-int ____ilog2_NaN(void);
+-
+-/*
+  * non-constant log of base 2 calculators
+  * - the arch may override these in asm/bitops.h if they can be implemented
+  *   more efficiently than using fls() and fls64()
+@@ -85,7 +79,7 @@ unsigned long __rounddown_pow_of_two(uns
+ #define ilog2(n)                              \
+ (                                             \
+       __builtin_constant_p(n) ? (             \
+-              (n) < 1 ? ____ilog2_NaN() :     \
++              (n) < 2 ? 0 :                   \
+               (n) & (1ULL << 63) ? 63 :       \
+               (n) & (1ULL << 62) ? 62 :       \
+               (n) & (1ULL << 61) ? 61 :       \
+@@ -148,10 +142,7 @@ unsigned long __rounddown_pow_of_two(uns
+               (n) & (1ULL <<  4) ?  4 :       \
+               (n) & (1ULL <<  3) ?  3 :       \
+               (n) & (1ULL <<  2) ?  2 :       \
+-              (n) & (1ULL <<  1) ?  1 :       \
+-              (n) & (1ULL <<  0) ?  0 :       \
+-              ____ilog2_NaN()                 \
+-                                 ) :          \
++              1 ) :                           \
+       (sizeof(n) <= 4) ?                      \
+       __ilog2_u32(n) :                        \
+       __ilog2_u64(n)                          \
+--- a/tools/include/linux/log2.h
++++ b/tools/include/linux/log2.h
+@@ -13,12 +13,6 @@
+ #define _TOOLS_LINUX_LOG2_H
+ /*
+- * deal with unrepresentable constant logarithms
+- */
+-extern __attribute__((const, noreturn))
+-int ____ilog2_NaN(void);
+-
+-/*
+  * non-constant log of base 2 calculators
+  * - the arch may override these in asm/bitops.h if they can be implemented
+  *   more efficiently than using fls() and fls64()
+@@ -78,7 +72,7 @@ unsigned long __rounddown_pow_of_two(uns
+ #define ilog2(n)                              \
+ (                                             \
+       __builtin_constant_p(n) ? (             \
+-              (n) < 1 ? ____ilog2_NaN() :     \
++              (n) < 2 ? 0 :                   \
+               (n) & (1ULL << 63) ? 63 :       \
+               (n) & (1ULL << 62) ? 62 :       \
+               (n) & (1ULL << 61) ? 61 :       \
+@@ -141,10 +135,7 @@ unsigned long __rounddown_pow_of_two(uns
+               (n) & (1ULL <<  4) ?  4 :       \
+               (n) & (1ULL <<  3) ?  3 :       \
+               (n) & (1ULL <<  2) ?  2 :       \
+-              (n) & (1ULL <<  1) ?  1 :       \
+-              (n) & (1ULL <<  0) ?  0 :       \
+-              ____ilog2_NaN()                 \
+-                                 ) :          \
++              1 ) :                           \
+       (sizeof(n) <= 4) ?                      \
+       __ilog2_u32(n) :                        \
+       __ilog2_u64(n)                          \
diff --git a/queue-4.4/hv_netvsc-use-skb_get_hash-instead-of-a-homegrown-implementation.patch b/queue-4.4/hv_netvsc-use-skb_get_hash-instead-of-a-homegrown-implementation.patch
new file mode 100644 (file)
index 0000000..c67190f
--- /dev/null
@@ -0,0 +1,112 @@
+From 757647e10e55c01fb7a9c4356529442e316a7c72 Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Mon, 25 Jan 2016 16:00:41 +0100
+Subject: hv_netvsc: use skb_get_hash() instead of a homegrown implementation
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+commit 757647e10e55c01fb7a9c4356529442e316a7c72 upstream.
+
+Recent changes to 'struct flow_keys' (e.g commit d34af823ff40 ("net: Add
+VLAN ID to flow_keys")) introduced a performance regression in netvsc
+driver. Is problem is, however, not the above mentioned commit but the
+fact that netvsc_set_hash() function did some assumptions on the struct
+flow_keys data layout and this is wrong.
+
+Get rid of netvsc_set_hash() by switching to skb_get_hash(). This change
+will also imply switching to Jenkins hash from the currently used Toeplitz
+but it seems there is no good excuse for Toeplitz to stay.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/hyperv/netvsc_drv.c |   67 +---------------------------------------
+ 1 file changed, 3 insertions(+), 64 deletions(-)
+
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -197,65 +197,6 @@ static void *init_ppi_data(struct rndis_
+       return ppi;
+ }
+-union sub_key {
+-      u64 k;
+-      struct {
+-              u8 pad[3];
+-              u8 kb;
+-              u32 ka;
+-      };
+-};
+-
+-/* Toeplitz hash function
+- * data: network byte order
+- * return: host byte order
+- */
+-static u32 comp_hash(u8 *key, int klen, void *data, int dlen)
+-{
+-      union sub_key subk;
+-      int k_next = 4;
+-      u8 dt;
+-      int i, j;
+-      u32 ret = 0;
+-
+-      subk.k = 0;
+-      subk.ka = ntohl(*(u32 *)key);
+-
+-      for (i = 0; i < dlen; i++) {
+-              subk.kb = key[k_next];
+-              k_next = (k_next + 1) % klen;
+-              dt = ((u8 *)data)[i];
+-              for (j = 0; j < 8; j++) {
+-                      if (dt & 0x80)
+-                              ret ^= subk.ka;
+-                      dt <<= 1;
+-                      subk.k <<= 1;
+-              }
+-      }
+-
+-      return ret;
+-}
+-
+-static bool netvsc_set_hash(u32 *hash, struct sk_buff *skb)
+-{
+-      struct flow_keys flow;
+-      int data_len;
+-
+-      if (!skb_flow_dissect_flow_keys(skb, &flow, 0) ||
+-          !(flow.basic.n_proto == htons(ETH_P_IP) ||
+-            flow.basic.n_proto == htons(ETH_P_IPV6)))
+-              return false;
+-
+-      if (flow.basic.ip_proto == IPPROTO_TCP)
+-              data_len = 12;
+-      else
+-              data_len = 8;
+-
+-      *hash = comp_hash(netvsc_hash_key, HASH_KEYLEN, &flow, data_len);
+-
+-      return true;
+-}
+-
+ static u16 netvsc_select_queue(struct net_device *ndev, struct sk_buff *skb,
+                       void *accel_priv, select_queue_fallback_t fallback)
+ {
+@@ -268,11 +209,9 @@ static u16 netvsc_select_queue(struct ne
+       if (nvsc_dev == NULL || ndev->real_num_tx_queues <= 1)
+               return 0;
+-      if (netvsc_set_hash(&hash, skb)) {
+-              q_idx = nvsc_dev->send_table[hash % VRSS_SEND_TAB_SIZE] %
+-                      ndev->real_num_tx_queues;
+-              skb_set_hash(skb, hash, PKT_HASH_TYPE_L3);
+-      }
++      hash = skb_get_hash(skb);
++      q_idx = nvsc_dev->send_table[hash % VRSS_SEND_TAB_SIZE] %
++              ndev->real_num_tx_queues;
+       return q_idx;
+ }
diff --git a/queue-4.4/kernek-fork.c-allocate-idle-task-for-a-cpu-always-on-its-local-node.patch b/queue-4.4/kernek-fork.c-allocate-idle-task-for-a-cpu-always-on-its-local-node.patch
new file mode 100644 (file)
index 0000000..ad0b171
--- /dev/null
@@ -0,0 +1,92 @@
+From 725fc629ff2545b061407305ae51016c9f928fce Mon Sep 17 00:00:00 2001
+From: Andi Kleen <ak@linux.intel.com>
+Date: Mon, 23 May 2016 16:24:05 -0700
+Subject: kernek/fork.c: allocate idle task for a CPU always on its local node
+
+From: Andi Kleen <ak@linux.intel.com>
+
+commit 725fc629ff2545b061407305ae51016c9f928fce upstream.
+
+Linux preallocates the task structs of the idle tasks for all possible
+CPUs.  This currently means they all end up on node 0.  This also
+implies that the cache line of MWAIT, which is around the flags field in
+the task struct, are all located in node 0.
+
+We see a noticeable performance improvement on Knights Landing CPUs when
+the cache lines used for MWAIT are located in the local nodes of the
+CPUs using them.  I would expect this to give a (likely slight)
+improvement on other systems too.
+
+The patch implements placing the idle task in the node of its CPUs, by
+passing the right target node to copy_process()
+
+[akpm@linux-foundation.org: use NUMA_NO_NODE, not a bare -1]
+Link: http://lkml.kernel.org/r/1463492694-15833-1-git-send-email-andi@firstfloor.org
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/fork.c |   15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -331,13 +331,14 @@ void set_task_stack_end_magic(struct tas
+       *stackend = STACK_END_MAGIC;    /* for overflow detection */
+ }
+-static struct task_struct *dup_task_struct(struct task_struct *orig)
++static struct task_struct *dup_task_struct(struct task_struct *orig, int node)
+ {
+       struct task_struct *tsk;
+       struct thread_info *ti;
+-      int node = tsk_fork_get_node(orig);
+       int err;
++      if (node == NUMA_NO_NODE)
++              node = tsk_fork_get_node(orig);
+       tsk = alloc_task_struct_node(node);
+       if (!tsk)
+               return NULL;
+@@ -1270,7 +1271,8 @@ static struct task_struct *copy_process(
+                                       int __user *child_tidptr,
+                                       struct pid *pid,
+                                       int trace,
+-                                      unsigned long tls)
++                                      unsigned long tls,
++                                      int node)
+ {
+       int retval;
+       struct task_struct *p;
+@@ -1323,7 +1325,7 @@ static struct task_struct *copy_process(
+               goto fork_out;
+       retval = -ENOMEM;
+-      p = dup_task_struct(current);
++      p = dup_task_struct(current, node);
+       if (!p)
+               goto fork_out;
+@@ -1699,7 +1701,8 @@ static inline void init_idle_pids(struct
+ struct task_struct *fork_idle(int cpu)
+ {
+       struct task_struct *task;
+-      task = copy_process(CLONE_VM, 0, 0, NULL, &init_struct_pid, 0, 0);
++      task = copy_process(CLONE_VM, 0, 0, NULL, &init_struct_pid, 0, 0,
++                          cpu_to_node(cpu));
+       if (!IS_ERR(task)) {
+               init_idle_pids(task->pids);
+               init_idle(task, cpu);
+@@ -1744,7 +1747,7 @@ long _do_fork(unsigned long clone_flags,
+       }
+       p = copy_process(clone_flags, stack_start, stack_size,
+-                       child_tidptr, NULL, trace, tls);
++                       child_tidptr, NULL, trace, tls, NUMA_NO_NODE);
+       /*
+        * Do this prior waking up the new thread - the thread pointer
+        * might get invalid after that point, if the thread exits quickly.
diff --git a/queue-4.4/kvm-ppc-book3s-pr-fix-illegal-opcode-emulation.patch b/queue-4.4/kvm-ppc-book3s-pr-fix-illegal-opcode-emulation.patch
new file mode 100644 (file)
index 0000000..05a7390
--- /dev/null
@@ -0,0 +1,51 @@
+From 708e75a3ee750dce1072134e630d66c4e6eaf63c Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Wed, 18 May 2016 21:01:20 +0200
+Subject: KVM: PPC: Book3S PR: Fix illegal opcode emulation
+
+From: Thomas Huth <thuth@redhat.com>
+
+commit 708e75a3ee750dce1072134e630d66c4e6eaf63c upstream.
+
+If kvmppc_handle_exit_pr() calls kvmppc_emulate_instruction() to emulate
+one instruction (in the BOOK3S_INTERRUPT_H_EMUL_ASSIST case), it calls
+kvmppc_core_queue_program() afterwards if kvmppc_emulate_instruction()
+returned EMULATE_FAIL, so the guest gets an program interrupt for the
+illegal opcode.
+However, the kvmppc_emulate_instruction() also tried to inject a
+program exception for this already, so the program interrupt gets
+injected twice and the return address in srr0 gets destroyed.
+All other callers of kvmppc_emulate_instruction() are also injecting
+a program interrupt, and since the callers have the right knowledge
+about the srr1 flags that should be used, it is the function
+kvmppc_emulate_instruction() that should _not_ inject program
+interrupts, so remove the kvmppc_core_queue_program() here.
+
+This fixes the issue discovered by Laurent Vivier with kvm-unit-tests
+where the logs are filled with these messages when the test tries
+to execute an illegal instruction:
+
+     Couldn't emulate instruction 0x00000000 (op 0 xop 0)
+     kvmppc_handle_exit_pr: emulation at 700 failed (00000000)
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Alexander Graf <agraf@suse.de>
+Tested-by: Laurent Vivier <lvivier@redhat.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kvm/emulate.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/powerpc/kvm/emulate.c
++++ b/arch/powerpc/kvm/emulate.c
+@@ -302,7 +302,6 @@ int kvmppc_emulate_instruction(struct kv
+                       advance = 0;
+                       printk(KERN_ERR "Couldn't emulate instruction 0x%08x "
+                              "(op %d xop %d)\n", inst, get_op(inst), get_xop(inst));
+-                      kvmppc_core_queue_program(vcpu, 0);
+               }
+       }
diff --git a/queue-4.4/pinctrl-cherryview-do-not-mask-all-interrupts-in-probe.patch b/queue-4.4/pinctrl-cherryview-do-not-mask-all-interrupts-in-probe.patch
new file mode 100644 (file)
index 0000000..86d8609
--- /dev/null
@@ -0,0 +1,56 @@
+From bcb48cca23ec9852739e4a464307fa29515bbe48 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Mon, 22 Aug 2016 14:42:52 +0300
+Subject: pinctrl: cherryview: Do not mask all interrupts in probe
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit bcb48cca23ec9852739e4a464307fa29515bbe48 upstream.
+
+The Cherryview GPIO controller has 8 or 16 wires connected to the I/O-APIC
+which can be used directly by the platform/BIOS or drivers. One such wire
+is used as SCI (System Control Interrupt) which ACPI depends on to be able
+to trigger GPEs (General Purpose Events).
+
+The pinctrl driver itself uses another IRQ resource which is wire OR of all
+the 8 (or 16) wires and follows what BIOS has programmed to the IntSel
+register of each pin.
+
+Currently the driver masks all interrupts at probe time and this prevents
+these direct interrupts from working as expected. The reason for this is
+that some early stage prototypes had some pins misconfigured causing lots
+of spurious interrupts.
+
+We fix this by leaving the interrupt mask untouched. This allows SCI and
+other direct interrupts work properly. What comes to the possible spurious
+interrupts we switch the default handler to be handle_bad_irq() instead of
+handle_simple_irq() (which was not correct anyway).
+
+Reported-by: Yu C Chen <yu.c.chen@intel.com>
+Reported-by: Anisse Astier <anisse@astier.eu>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/intel/pinctrl-cherryview.c |    5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -1466,12 +1466,11 @@ static int chv_gpio_probe(struct chv_pin
+               offset += range->npins;
+       }
+-      /* Mask and clear all interrupts */
+-      chv_writel(0, pctrl->regs + CHV_INTMASK);
++      /* Clear all interrupts */
+       chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
+       ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
+-                                 handle_simple_irq, IRQ_TYPE_NONE);
++                                 handle_bad_irq, IRQ_TYPE_NONE);
+       if (ret) {
+               dev_err(pctrl->dev, "failed to add IRQ chip\n");
+               goto fail;
diff --git a/queue-4.4/s390-pci-fix-use-after-free-in-dma_init.patch b/queue-4.4/s390-pci-fix-use-after-free-in-dma_init.patch
new file mode 100644 (file)
index 0000000..07ee4b1
--- /dev/null
@@ -0,0 +1,68 @@
+From dba599091c191d209b1499511a524ad9657c0e5a Mon Sep 17 00:00:00 2001
+From: Sebastian Ott <sebott@linux.vnet.ibm.com>
+Date: Fri, 15 Apr 2016 09:41:35 +0200
+Subject: s390/pci: fix use after free in dma_init
+
+From: Sebastian Ott <sebott@linux.vnet.ibm.com>
+
+commit dba599091c191d209b1499511a524ad9657c0e5a upstream.
+
+After a failure during registration of the dma_table (because of the
+function being in error state) we free its memory but don't reset the
+associated pointer to zero.
+
+When we then receive a notification from firmware (about the function
+being in error state) we'll try to walk and free the dma_table again.
+
+Fix this by resetting the dma_table pointer. In addition to that make
+sure that we free the iommu_bitmap when appropriate.
+
+Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
+Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/pci/pci_dma.c |   16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/arch/s390/pci/pci_dma.c
++++ b/arch/s390/pci/pci_dma.c
+@@ -455,7 +455,7 @@ int zpci_dma_init_device(struct zpci_dev
+       zdev->dma_table = dma_alloc_cpu_table();
+       if (!zdev->dma_table) {
+               rc = -ENOMEM;
+-              goto out_clean;
++              goto out;
+       }
+       /*
+@@ -475,18 +475,22 @@ int zpci_dma_init_device(struct zpci_dev
+       zdev->iommu_bitmap = vzalloc(zdev->iommu_pages / 8);
+       if (!zdev->iommu_bitmap) {
+               rc = -ENOMEM;
+-              goto out_reg;
++              goto free_dma_table;
+       }
+       rc = zpci_register_ioat(zdev, 0, zdev->start_dma, zdev->end_dma,
+                               (u64) zdev->dma_table);
+       if (rc)
+-              goto out_reg;
+-      return 0;
++              goto free_bitmap;
+-out_reg:
++      return 0;
++free_bitmap:
++      vfree(zdev->iommu_bitmap);
++      zdev->iommu_bitmap = NULL;
++free_dma_table:
+       dma_free_cpu_table(zdev->dma_table);
+-out_clean:
++      zdev->dma_table = NULL;
++out:
+       return rc;
+ }
index ff59d1b84c7063307c41dc52824cf0ffd95bec6a..2ebd9d49a66d4334dbbe969abc545bbd94bf9249 100644 (file)
@@ -1,2 +1,18 @@
 usb-core-hub-hub_port_init-lock-controller-instead-of-bus.patch
 usb-don-t-free-bandwidth_mutex-too-early.patch
+crypto-ghash-clmulni-fix-load-failure.patch
+crypto-cryptd-assign-statesize-properly.patch
+crypto-mcryptd-fix-load-failure.patch
+cxlflash-increase-cmd_per_lun-for-better-throughput.patch
+acpi-video-skip-evaluating-_dod-when-it-does-not-exist.patch
+pinctrl-cherryview-do-not-mask-all-interrupts-in-probe.patch
+drivers-hv-balloon-don-t-crash-when-memory-is-added-in-non-sorted-order.patch
+drivers-hv-avoid-vfree-on-crash.patch
+xen-qspinlock-don-t-kick-cpu-if-irq-is-not-initialized.patch
+kvm-ppc-book3s-pr-fix-illegal-opcode-emulation.patch
+s390-pci-fix-use-after-free-in-dma_init.patch
+drm-amdgpu-add-missing-irq.h-include.patch
+tpm_tis-use-devm_free_irq-not-free_irq.patch
+hv_netvsc-use-skb_get_hash-instead-of-a-homegrown-implementation.patch
+kernek-fork.c-allocate-idle-task-for-a-cpu-always-on-its-local-node.patch
+give-up-on-gcc-ilog2-constant-optimizations.patch
diff --git a/queue-4.4/tpm_tis-use-devm_free_irq-not-free_irq.patch b/queue-4.4/tpm_tis-use-devm_free_irq-not-free_irq.patch
new file mode 100644 (file)
index 0000000..14d8d3a
--- /dev/null
@@ -0,0 +1,37 @@
+From 727f28b8ca24a581c7bd868326b8cea1058c720a Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Date: Wed, 25 Nov 2015 14:05:30 -0700
+Subject: tpm_tis: Use devm_free_irq not free_irq
+
+From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+
+commit 727f28b8ca24a581c7bd868326b8cea1058c720a upstream.
+
+The interrupt is always allocated with devm_request_irq so it
+must always be freed with devm_free_irq.
+
+Fixes: 448e9c55c12d ("tpm_tis: verify interrupt during init")
+Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Acked-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Tested-by: Martin Wilck <Martin.Wilck@ts.fujitsu.com>
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Acked-by: Peter Huewe <peterhuewe@gmx.de>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/tpm/tpm_tis.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -401,7 +401,7 @@ static void disable_interrupts(struct tp
+       iowrite32(intmask,
+                 chip->vendor.iobase +
+                 TPM_INT_ENABLE(chip->vendor.locality));
+-      free_irq(chip->vendor.irq, chip);
++      devm_free_irq(chip->pdev, chip->vendor.irq, chip);
+       chip->vendor.irq = 0;
+ }
diff --git a/queue-4.4/xen-qspinlock-don-t-kick-cpu-if-irq-is-not-initialized.patch b/queue-4.4/xen-qspinlock-don-t-kick-cpu-if-irq-is-not-initialized.patch
new file mode 100644 (file)
index 0000000..1cb9aad
--- /dev/null
@@ -0,0 +1,80 @@
+From 707e59ba494372a90d245f18b0c78982caa88e48 Mon Sep 17 00:00:00 2001
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Fri, 22 Apr 2016 13:05:31 +0100
+Subject: xen/qspinlock: Don't kick CPU if IRQ is not initialized
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+commit 707e59ba494372a90d245f18b0c78982caa88e48 upstream.
+
+The following commit:
+
+  1fb3a8b2cfb2 ("xen/spinlock: Fix locking path engaging too soon under PVHVM.")
+
+... moved the initalization of the kicker interrupt until after
+native_cpu_up() is called.
+
+However, when using qspinlocks, a CPU may try to kick another CPU that is
+spinning (because it has not yet initialized its kicker interrupt), resulting
+in the following crash during boot:
+
+  kernel BUG at /build/linux-Ay7j_C/linux-4.4.0/drivers/xen/events/events_base.c:1210!
+  invalid opcode: 0000 [#1] SMP
+  ...
+  RIP: 0010:[<ffffffff814c97c9>]  [<ffffffff814c97c9>] xen_send_IPI_one+0x59/0x60
+  ...
+  Call Trace:
+   [<ffffffff8102be9e>] xen_qlock_kick+0xe/0x10
+   [<ffffffff810cabc2>] __pv_queued_spin_unlock+0xb2/0xf0
+   [<ffffffff810ca6d1>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
+   [<ffffffff81052936>] ? check_tsc_warp+0x76/0x150
+   [<ffffffff81052aa6>] check_tsc_sync_source+0x96/0x160
+   [<ffffffff81051e28>] native_cpu_up+0x3d8/0x9f0
+   [<ffffffff8102b315>] xen_hvm_cpu_up+0x35/0x80
+   [<ffffffff8108198c>] _cpu_up+0x13c/0x180
+   [<ffffffff81081a4a>] cpu_up+0x7a/0xa0
+   [<ffffffff81f80dfc>] smp_init+0x7f/0x81
+   [<ffffffff81f5a121>] kernel_init_freeable+0xef/0x212
+   [<ffffffff81817f30>] ? rest_init+0x80/0x80
+   [<ffffffff81817f3e>] kernel_init+0xe/0xe0
+   [<ffffffff8182488f>] ret_from_fork+0x3f/0x70
+   [<ffffffff81817f30>] ? rest_init+0x80/0x80
+
+To fix this, only send the kick if the target CPU's interrupt has been
+initialized. This check isn't racy, because the target is waiting for
+the spinlock, so it won't have initialized the interrupt in the
+meantime.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: David Vrabel <david.vrabel@citrix.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-kernel@vger.kernel.org
+Cc: xen-devel@lists.xenproject.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/xen/spinlock.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -27,6 +27,12 @@ static bool xen_pvspin = true;
+ static void xen_qlock_kick(int cpu)
+ {
++      int irq = per_cpu(lock_kicker_irq, cpu);
++
++      /* Don't kick if the target's kicker interrupt is not initialized. */
++      if (irq == -1)
++              return;
++
+       xen_send_IPI_one(cpu, XEN_SPIN_UNLOCK_VECTOR);
+ }