--- /dev/null
+From cef75036c40408ba3bc308bcb00a3d440da713fc Mon Sep 17 00:00:00 2001
+From: Sinclair Yeh <syeh@vmware.com>
+Date: Wed, 1 Nov 2017 10:47:05 -0700
+Subject: drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue
+
+From: Sinclair Yeh <syeh@vmware.com>
+
+commit cef75036c40408ba3bc308bcb00a3d440da713fc upstream.
+
+This is an extension of Commit 7c20d213dd3c ("drm/vmwgfx: Work
+around mode set failure in 2D VMs")
+
+With Wayland desktop and atomic mode set, during the mode setting
+process there is a moment when two framebuffer sized surfaces
+are being pinned. This was not an issue with Xorg.
+
+Since this only happens during a mode change, there should be no
+performance impact by increasing allowable mem_size.
+
+Signed-off-by: Sinclair Yeh <syeh@vmware.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -722,7 +722,7 @@ static int vmw_driver_load(struct drm_de
+ * allocation taken by fbdev
+ */
+ if (!(dev_priv->capabilities & SVGA_CAP_3D))
+- mem_size *= 2;
++ mem_size *= 3;
+
+ dev_priv->max_mob_pages = mem_size * 1024 / PAGE_SIZE;
+ dev_priv->prim_bb_mem =
--- /dev/null
+From cdea6a30c2689cc33b34c6691b57cca277f0c5dc Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Tue, 7 Nov 2017 16:19:24 -0800
+Subject: Input: elan_i2c - add ELAN060C to the ACPI table
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit cdea6a30c2689cc33b34c6691b57cca277f0c5dc upstream.
+
+ELAN060C touchpad uses elan_i2c as its driver. It can be
+found on Lenovo ideapad 320-14AST.
+
+BugLink: https://bugs.launchpad.net/bugs/1727544
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/elan_i2c_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1253,6 +1253,7 @@ static const struct acpi_device_id elan_
+ { "ELAN0605", 0 },
+ { "ELAN0609", 0 },
+ { "ELAN060B", 0 },
++ { "ELAN060C", 0 },
+ { "ELAN0611", 0 },
+ { "ELAN1000", 0 },
+ { }
--- /dev/null
+From 38c53af853069adf87181684370d7b8866d6387b Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Wed, 8 Nov 2017 14:44:04 +1100
+Subject: KVM: PPC: Book3S HV: Fix exclusion between HPT resizing and other HPT updates
+
+From: Paul Mackerras <paulus@ozlabs.org>
+
+commit 38c53af853069adf87181684370d7b8866d6387b upstream.
+
+Commit 5e9859699aba ("KVM: PPC: Book3S HV: Outline of KVM-HV HPT resizing
+implementation", 2016-12-20) added code that tries to exclude any use
+or update of the hashed page table (HPT) while the HPT resizing code
+is iterating through all the entries in the HPT. It does this by
+taking the kvm->lock mutex, clearing the kvm->arch.hpte_setup_done
+flag and then sending an IPI to all CPUs in the host. The idea is
+that any VCPU task that tries to enter the guest will see that the
+hpte_setup_done flag is clear and therefore call kvmppc_hv_setup_htab_rma,
+which also takes the kvm->lock mutex and will therefore block until
+we release kvm->lock.
+
+However, any VCPU that is already in the guest, or is handling a
+hypervisor page fault or hypercall, can re-enter the guest without
+rechecking the hpte_setup_done flag. The IPI will cause a guest exit
+of any VCPUs that are currently in the guest, but does not prevent
+those VCPU tasks from immediately re-entering the guest.
+
+The result is that after resize_hpt_rehash_hpte() has made a HPTE
+absent, a hypervisor page fault can occur and make that HPTE present
+again. This includes updating the rmap array for the guest real page,
+meaning that we now have a pointer in the rmap array which connects
+with pointers in the old rev array but not the new rev array. In
+fact, if the HPT is being reduced in size, the pointer in the rmap
+array could point outside the bounds of the new rev array. If that
+happens, we can get a host crash later on such as this one:
+
+[91652.628516] Unable to handle kernel paging request for data at address 0xd0000000157fb10c
+[91652.628668] Faulting instruction address: 0xc0000000000e2640
+[91652.628736] Oops: Kernel access of bad area, sig: 11 [#1]
+[91652.628789] LE SMP NR_CPUS=1024 NUMA PowerNV
+[91652.628847] Modules linked in: binfmt_misc vhost_net vhost tap xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_mangle ip6table_security ip6table_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack libcrc32c iptable_mangle iptable_security iptable_raw ebtable_filter ebtables ip6table_filter ip6_tables ses enclosure scsi_transport_sas i2c_opal ipmi_powernv ipmi_devintf i2c_core ipmi_msghandler powernv_op_panel nfsd auth_rpcgss oid_registry nfs_acl lockd grace sunrpc kvm_hv kvm_pr kvm scsi_dh_alua dm_service_time dm_multipath tg3 ptp pps_core [last unloaded: stap_552b612747aec2da355051e464fa72a1_14259]
+[91652.629566] CPU: 136 PID: 41315 Comm: CPU 21/KVM Tainted: G O 4.14.0-1.rc4.dev.gitb27fc5c.el7.centos.ppc64le #1
+[91652.629684] task: c0000007a419e400 task.stack: c0000000028d8000
+[91652.629750] NIP: c0000000000e2640 LR: d00000000c36e498 CTR: c0000000000e25f0
+[91652.629829] REGS: c0000000028db5d0 TRAP: 0300 Tainted: G O (4.14.0-1.rc4.dev.gitb27fc5c.el7.centos.ppc64le)
+[91652.629932] MSR: 900000010280b033 <SF,HV,VEC,VSX,EE,FP,ME,IR,DR,RI,LE,TM[E]> CR: 44022422 XER: 00000000
+[91652.630034] CFAR: d00000000c373f84 DAR: d0000000157fb10c DSISR: 40000000 SOFTE: 1
+[91652.630034] GPR00: d00000000c36e498 c0000000028db850 c000000001403900 c0000007b7960000
+[91652.630034] GPR04: d0000000117fb100 d000000007ab00d8 000000000033bb10 0000000000000000
+[91652.630034] GPR08: fffffffffffffe7f 801001810073bb10 d00000000e440000 d00000000c373f70
+[91652.630034] GPR12: c0000000000e25f0 c00000000fdb9400 f000000003b24680 0000000000000000
+[91652.630034] GPR16: 00000000000004fb 00007ff7081a0000 00000000000ec91a 000000000033bb10
+[91652.630034] GPR20: 0000000000010000 00000000001b1190 0000000000000001 0000000000010000
+[91652.630034] GPR24: c0000007b7ab8038 d0000000117fb100 0000000ec91a1190 c000001e6a000000
+[91652.630034] GPR28: 00000000033bb100 000000000073bb10 c0000007b7960000 d0000000157fb100
+[91652.630735] NIP [c0000000000e2640] kvmppc_add_revmap_chain+0x50/0x120
+[91652.630806] LR [d00000000c36e498] kvmppc_book3s_hv_page_fault+0xbb8/0xc40 [kvm_hv]
+[91652.630884] Call Trace:
+[91652.630913] [c0000000028db850] [c0000000028db8b0] 0xc0000000028db8b0 (unreliable)
+[91652.630996] [c0000000028db8b0] [d00000000c36e498] kvmppc_book3s_hv_page_fault+0xbb8/0xc40 [kvm_hv]
+[91652.631091] [c0000000028db9e0] [d00000000c36a078] kvmppc_vcpu_run_hv+0xdf8/0x1300 [kvm_hv]
+[91652.631179] [c0000000028dbb30] [d00000000c2248c4] kvmppc_vcpu_run+0x34/0x50 [kvm]
+[91652.631266] [c0000000028dbb50] [d00000000c220d54] kvm_arch_vcpu_ioctl_run+0x114/0x2a0 [kvm]
+[91652.631351] [c0000000028dbbd0] [d00000000c2139d8] kvm_vcpu_ioctl+0x598/0x7a0 [kvm]
+[91652.631433] [c0000000028dbd40] [c0000000003832e0] do_vfs_ioctl+0xd0/0x8c0
+[91652.631501] [c0000000028dbde0] [c000000000383ba4] SyS_ioctl+0xd4/0x130
+[91652.631569] [c0000000028dbe30] [c00000000000b8e0] system_call+0x58/0x6c
+[91652.631635] Instruction dump:
+[91652.631676] fba1ffe8 fbc1fff0 fbe1fff8 f8010010 f821ffa1 2fa70000 793d0020 e9432110
+[91652.631814] 7bbf26e4 7c7e1b78 7feafa14 409e0094 <807f000c> 786326e4 7c6a1a14 93a40008
+[91652.631959] ---[ end trace ac85ba6db72e5b2e ]---
+
+To fix this, we tighten up the way that the hpte_setup_done flag is
+checked to ensure that it does provide the guarantee that the resizing
+code needs. In kvmppc_run_core(), we check the hpte_setup_done flag
+after disabling interrupts and refuse to enter the guest if it is
+clear (for a HPT guest). The code that checks hpte_setup_done and
+calls kvmppc_hv_setup_htab_rma() is moved from kvmppc_vcpu_run_hv()
+to a point inside the main loop in kvmppc_run_vcpu(), ensuring that
+we don't just spin endlessly calling kvmppc_run_core() while
+hpte_setup_done is clear, but instead have a chance to block on the
+kvm->lock mutex.
+
+Finally we also check hpte_setup_done inside the region in
+kvmppc_book3s_hv_page_fault() where the HPTE is locked and we are about
+to update the HPTE, and bail out if it is clear. If another CPU is
+inside kvm_vm_ioctl_resize_hpt_commit) and has cleared hpte_setup_done,
+then we know that either we are looking at a HPTE
+that resize_hpt_rehash_hpte() has not yet processed, which is OK,
+or else we will see hpte_setup_done clear and refuse to update it,
+because of the full barrier formed by the unlock of the HPTE in
+resize_hpt_rehash_hpte() combined with the locking of the HPTE
+in kvmppc_book3s_hv_page_fault().
+
+Fixes: 5e9859699aba ("KVM: PPC: Book3S HV: Outline of KVM-HV HPT resizing implementation")
+Reported-by: Satheesh Rajendran <satheera@in.ibm.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kvm/book3s_64_mmu_hv.c | 10 ++++++++++
+ arch/powerpc/kvm/book3s_hv.c | 29 +++++++++++++++++++----------
+ 2 files changed, 29 insertions(+), 10 deletions(-)
+
+--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
++++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
+@@ -645,6 +645,16 @@ int kvmppc_book3s_hv_page_fault(struct k
+ hnow_v = hpte_new_to_old_v(hnow_v, hnow_r);
+ hnow_r = hpte_new_to_old_r(hnow_r);
+ }
++
++ /*
++ * If the HPT is being resized, don't update the HPTE,
++ * instead let the guest retry after the resize operation is complete.
++ * The synchronization for hpte_setup_done test vs. set is provided
++ * by the HPTE lock.
++ */
++ if (!kvm->arch.hpte_setup_done)
++ goto out_unlock;
++
+ if ((hnow_v & ~HPTE_V_HVLOCK) != hpte[0] || hnow_r != hpte[1] ||
+ rev->guest_rpte != hpte[2])
+ /* HPTE has been changed under us; let the guest retry */
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -2688,11 +2688,14 @@ static noinline void kvmppc_run_core(str
+ * Hard-disable interrupts, and check resched flag and signals.
+ * If we need to reschedule or deliver a signal, clean up
+ * and return without going into the guest(s).
++ * If the hpte_setup_done flag has been cleared, don't go into the
++ * guest because that means a HPT resize operation is in progress.
+ */
+ local_irq_disable();
+ hard_irq_disable();
+ if (lazy_irq_pending() || need_resched() ||
+- recheck_signals(&core_info)) {
++ recheck_signals(&core_info) ||
++ (!kvm_is_radix(vc->kvm) && !vc->kvm->arch.hpte_setup_done)) {
+ local_irq_enable();
+ vc->vcore_state = VCORE_INACTIVE;
+ /* Unlock all except the primary vcore */
+@@ -3061,7 +3064,7 @@ out:
+
+ static int kvmppc_run_vcpu(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
+ {
+- int n_ceded, i;
++ int n_ceded, i, r;
+ struct kvmppc_vcore *vc;
+ struct kvm_vcpu *v;
+
+@@ -3115,6 +3118,20 @@ static int kvmppc_run_vcpu(struct kvm_ru
+
+ while (vcpu->arch.state == KVMPPC_VCPU_RUNNABLE &&
+ !signal_pending(current)) {
++ /* See if the HPT and VRMA are ready to go */
++ if (!kvm_is_radix(vcpu->kvm) &&
++ !vcpu->kvm->arch.hpte_setup_done) {
++ spin_unlock(&vc->lock);
++ r = kvmppc_hv_setup_htab_rma(vcpu);
++ spin_lock(&vc->lock);
++ if (r) {
++ kvm_run->exit_reason = KVM_EXIT_FAIL_ENTRY;
++ kvm_run->fail_entry.hardware_entry_failure_reason = 0;
++ vcpu->arch.ret = r;
++ break;
++ }
++ }
++
+ if (vc->vcore_state == VCORE_PREEMPT && vc->runner == NULL)
+ kvmppc_vcore_end_preempt(vc);
+
+@@ -3232,13 +3249,6 @@ static int kvmppc_vcpu_run_hv(struct kvm
+ /* Order vcpus_running vs. hpte_setup_done, see kvmppc_alloc_reset_hpt */
+ smp_mb();
+
+- /* On the first time here, set up HTAB and VRMA */
+- if (!kvm_is_radix(vcpu->kvm) && !vcpu->kvm->arch.hpte_setup_done) {
+- r = kvmppc_hv_setup_htab_rma(vcpu);
+- if (r)
+- goto out;
+- }
+-
+ flush_all_to_thread(current);
+
+ /* Save userspace EBB and other register values */
+@@ -3286,7 +3296,6 @@ static int kvmppc_vcpu_run_hv(struct kvm
+ }
+ mtspr(SPRN_VRSAVE, user_vrsave);
+
+- out:
+ vcpu->arch.state = KVMPPC_VCPU_NOTREADY;
+ atomic_dec(&vcpu->kvm->arch.vcpus_running);
+ return r;
--- /dev/null
+From e6b03ab63b4d270e0249f96536fde632409dc1dc Mon Sep 17 00:00:00 2001
+From: Jonas Gorski <jonas.gorski@gmail.com>
+Date: Sun, 29 Oct 2017 16:27:19 +0100
+Subject: MIPS: AR7: Defer registration of GPIO
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+commit e6b03ab63b4d270e0249f96536fde632409dc1dc upstream.
+
+When called from prom init code, ar7_gpio_init() will fail as it will
+call gpiochip_add() which relies on a working kmalloc() to alloc
+the gpio_desc array and kmalloc is not useable yet at prom init time.
+
+Move ar7_gpio_init() to ar7_register_devices() (a device_initcall)
+where kmalloc works.
+
+Fixes: 14e85c0e69d5 ("gpio: remove gpio_descs global array")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Yoshihiro YUNOMAE <yoshihiro.yunomae.ez@hitachi.com>
+Cc: Nicolas Schichan <nschichan@freebox.fr>
+Cc: linux-mips@linux-mips.org
+Cc: linux-serial@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/17542/
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/ar7/platform.c | 4 ++++
+ arch/mips/ar7/prom.c | 2 --
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/ar7/platform.c
++++ b/arch/mips/ar7/platform.c
+@@ -653,6 +653,10 @@ static int __init ar7_register_devices(v
+ u32 val;
+ int res;
+
++ res = ar7_gpio_init();
++ if (res)
++ pr_warn("unable to register gpios: %d\n", res);
++
+ res = ar7_register_uarts();
+ if (res)
+ pr_err("unable to setup uart(s): %d\n", res);
+--- a/arch/mips/ar7/prom.c
++++ b/arch/mips/ar7/prom.c
+@@ -246,8 +246,6 @@ void __init prom_init(void)
+ ar7_init_cmdline(fw_arg0, (char **)fw_arg1);
+ ar7_init_env((struct env_var *)fw_arg2);
+ console_config();
+-
+- ar7_gpio_init();
+ }
+
+ #define PORT(offset) (KSEG1ADDR(AR7_REGS_UART0 + (offset * 4)))
--- /dev/null
+From b084116f8587b222a2c5ef6dcd846f40f24b9420 Mon Sep 17 00:00:00 2001
+From: Oswald Buddenhagen <oswald.buddenhagen@gmx.de>
+Date: Sun, 29 Oct 2017 16:27:20 +0100
+Subject: MIPS: AR7: Ensure that serial ports are properly set up
+
+From: Oswald Buddenhagen <oswald.buddenhagen@gmx.de>
+
+commit b084116f8587b222a2c5ef6dcd846f40f24b9420 upstream.
+
+Without UPF_FIXED_TYPE, the data from the PORT_AR7 uart_config entry is
+never copied, resulting in a dead port.
+
+Fixes: 154615d55459 ("MIPS: AR7: Use correct UART port type")
+Signed-off-by: Oswald Buddenhagen <oswald.buddenhagen@gmx.de>
+[jonas.gorski: add Fixes tag]
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Yoshihiro YUNOMAE <yoshihiro.yunomae.ez@hitachi.com>
+Cc: Nicolas Schichan <nschichan@freebox.fr>
+Cc: Oswald Buddenhagen <oswald.buddenhagen@gmx.de>
+Cc: linux-mips@linux-mips.org
+Cc: linux-serial@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/17543/
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/ar7/platform.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/mips/ar7/platform.c
++++ b/arch/mips/ar7/platform.c
+@@ -575,6 +575,7 @@ static int __init ar7_register_uarts(voi
+ uart_port.type = PORT_AR7;
+ uart_port.uartclk = clk_get_rate(bus_clk) / 2;
+ uart_port.iotype = UPIO_MEM32;
++ uart_port.flags = UPF_FIXED_TYPE;
+ uart_port.regshift = 2;
+
+ uart_port.line = 0;
--- /dev/null
+From ea4b3afe1eac8f88bb453798a084fba47a1f155a Mon Sep 17 00:00:00 2001
+From: Jaedon Shin <jaedon.shin@gmail.com>
+Date: Fri, 16 Jun 2017 20:03:01 +0900
+Subject: MIPS: BMIPS: Fix missing cbr address
+
+From: Jaedon Shin <jaedon.shin@gmail.com>
+
+commit ea4b3afe1eac8f88bb453798a084fba47a1f155a upstream.
+
+Fix NULL pointer access in BMIPS3300 RAC flush.
+
+Fixes: 738a3f79027b ("MIPS: BMIPS: Add early CPU initialization code")
+Signed-off-by: Jaedon Shin <jaedon.shin@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Kevin Cernekee <cernekee@gmail.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/16423/
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/smp-bmips.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/kernel/smp-bmips.c
++++ b/arch/mips/kernel/smp-bmips.c
+@@ -589,11 +589,11 @@ void __init bmips_cpu_setup(void)
+
+ /* Flush and enable RAC */
+ cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
+- __raw_writel(cfg | 0x100, BMIPS_RAC_CONFIG);
++ __raw_writel(cfg | 0x100, cbr + BMIPS_RAC_CONFIG);
+ __raw_readl(cbr + BMIPS_RAC_CONFIG);
+
+ cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
+- __raw_writel(cfg | 0xf, BMIPS_RAC_CONFIG);
++ __raw_writel(cfg | 0xf, cbr + BMIPS_RAC_CONFIG);
+ __raw_readl(cbr + BMIPS_RAC_CONFIG);
+
+ cfg = __raw_readl(cbr + BMIPS_RAC_ADDRESS_RANGE);
--- /dev/null
+From 1e37f2f84680fa7f8394fd444b6928e334495ccc Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Mon, 6 Nov 2017 11:33:36 +0100
+Subject: rbd: use GFP_NOIO for parent stat and data requests
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+commit 1e37f2f84680fa7f8394fd444b6928e334495ccc upstream.
+
+rbd_img_obj_exists_submit() and rbd_img_obj_parent_read_full() are on
+the writeback path for cloned images -- we attempt a stat on the parent
+object to see if it exists and potentially read it in to call copyup.
+GFP_NOIO should be used instead of GFP_KERNEL here.
+
+Link: http://tracker.ceph.com/issues/22014
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Reviewed-by: David Disseldorp <ddiss@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/rbd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -2692,7 +2692,7 @@ static int rbd_img_obj_parent_read_full(
+ * from the parent.
+ */
+ page_count = (u32)calc_pages_for(0, length);
+- pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
++ pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
+ if (IS_ERR(pages)) {
+ result = PTR_ERR(pages);
+ pages = NULL;
+@@ -2827,7 +2827,7 @@ static int rbd_img_obj_exists_submit(str
+ */
+ size = sizeof (__le64) + sizeof (__le32) + sizeof (__le32);
+ page_count = (u32)calc_pages_for(0, size);
+- pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
++ pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
+ if (IS_ERR(pages)) {
+ ret = PTR_ERR(pages);
+ goto fail_stat_request;
--- /dev/null
+From ea0ee33988778fb73e4f45e7c73fb735787e2f32 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Fri, 10 Nov 2017 11:19:11 -0800
+Subject: Revert "x86: CPU: Fix up "cpu MHz" in /proc/cpuinfo"
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit ea0ee33988778fb73e4f45e7c73fb735787e2f32 upstream.
+
+This reverts commit 941f5f0f6ef5338814145cf2b813cf1f98873e2f.
+
+Sadly, it turns out that we really can't just do the cross-CPU IPI to
+all CPU's to get their proper frequencies, because it's much too
+expensive on systems with lots of cores.
+
+So we'll have to revert this for now, and revisit it using a smarter
+model (probably doing one system-wide IPI at open time, and doing all
+the frequency calculations in parallel).
+
+Reported-by: WANG Chao <chao.wang@ucloud.cn>
+Reported-by: Ingo Molnar <mingo@kernel.org>
+Cc: Rafael J Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/Makefile | 2 +-
+ arch/x86/kernel/cpu/aperfmperf.c | 11 ++++-------
+ arch/x86/kernel/cpu/proc.c | 4 +---
+ 3 files changed, 6 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/kernel/cpu/Makefile
++++ b/arch/x86/kernel/cpu/Makefile
+@@ -21,7 +21,7 @@ obj-y += common.o
+ obj-y += rdrand.o
+ obj-y += match.o
+ obj-y += bugs.o
+-obj-y += aperfmperf.o
++obj-$(CONFIG_CPU_FREQ) += aperfmperf.o
+
+ obj-$(CONFIG_PROC_FS) += proc.o
+ obj-$(CONFIG_X86_FEATURE_NAMES) += capflags.o powerflags.o
+--- a/arch/x86/kernel/cpu/aperfmperf.c
++++ b/arch/x86/kernel/cpu/aperfmperf.c
+@@ -42,6 +42,10 @@ static void aperfmperf_snapshot_khz(void
+ s64 time_delta = ktime_ms_delta(now, s->time);
+ unsigned long flags;
+
++ /* Don't bother re-computing within the cache threshold time. */
++ if (time_delta < APERFMPERF_CACHE_THRESHOLD_MS)
++ return;
++
+ local_irq_save(flags);
+ rdmsrl(MSR_IA32_APERF, aperf);
+ rdmsrl(MSR_IA32_MPERF, mperf);
+@@ -70,7 +74,6 @@ static void aperfmperf_snapshot_khz(void
+
+ unsigned int arch_freq_get_on_cpu(int cpu)
+ {
+- s64 time_delta;
+ unsigned int khz;
+
+ if (!cpu_khz)
+@@ -79,12 +82,6 @@ unsigned int arch_freq_get_on_cpu(int cp
+ if (!static_cpu_has(X86_FEATURE_APERFMPERF))
+ return 0;
+
+- /* Don't bother re-computing within the cache threshold time. */
+- time_delta = ktime_ms_delta(ktime_get(), per_cpu(samples.time, cpu));
+- khz = per_cpu(samples.khz, cpu);
+- if (khz && time_delta < APERFMPERF_CACHE_THRESHOLD_MS)
+- return khz;
+-
+ smp_call_function_single(cpu, aperfmperf_snapshot_khz, NULL, 1);
+ khz = per_cpu(samples.khz, cpu);
+ if (khz)
+--- a/arch/x86/kernel/cpu/proc.c
++++ b/arch/x86/kernel/cpu/proc.c
+@@ -77,11 +77,9 @@ static int show_cpuinfo(struct seq_file
+ seq_printf(m, "microcode\t: 0x%x\n", c->microcode);
+
+ if (cpu_has(c, X86_FEATURE_TSC)) {
+- unsigned int freq = arch_freq_get_on_cpu(cpu);
++ unsigned int freq = cpufreq_quick_get(cpu);
+
+ if (!freq)
+- freq = cpufreq_quick_get(cpu);
+- if (!freq)
+ freq = cpu_khz;
+ seq_printf(m, "cpu MHz\t\t: %u.%03u\n",
+ freq / 1000, (freq % 1000));
alsa-seq-fix-oss-sysex-delivery-in-oss-emulation.patch
alsa-seq-avoid-invalid-lockdep-class-warning.patch
mips-fix-cm-region-target-definitions.patch
+mips-bmips-fix-missing-cbr-address.patch
+mips-ar7-defer-registration-of-gpio.patch
+mips-ar7-ensure-that-serial-ports-are-properly-set-up.patch
+kvm-ppc-book3s-hv-fix-exclusion-between-hpt-resizing-and-other-hpt-updates.patch
+input-elan_i2c-add-elan060c-to-the-acpi-table.patch
+rbd-use-gfp_noio-for-parent-stat-and-data-requests.patch
+drm-vmwgfx-fix-ubuntu-17.10-wayland-black-screen-issue.patch
+revert-x86-cpu-fix-up-cpu-mhz-in-proc-cpuinfo.patch