--- /dev/null
+From 6a8b0c6b18f62a277ffb2139d0c0253fe35d7feb Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyj.lk@gmail.com>
+Date: Wed, 10 Aug 2016 03:17:09 +0000
+Subject: dmaengine: at_xdmac: fix to pass correct device identity to free_irq()
+
+From: Wei Yongjun <weiyj.lk@gmail.com>
+
+commit 6a8b0c6b18f62a277ffb2139d0c0253fe35d7feb upstream.
+
+free_irq() expects the same device identity that was passed to
+corresponding request_irq(), otherwise the IRQ is not freed.
+
+Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")
+Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_xdmac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -2067,7 +2067,7 @@ err_dma_unregister:
+ err_clk_disable:
+ clk_disable_unprepare(atxdmac->clk);
+ err_free_irq:
+- free_irq(atxdmac->irq, atxdmac->dma.dev);
++ free_irq(atxdmac->irq, atxdmac);
+ return ret;
+ }
+
+@@ -2081,7 +2081,7 @@ static int at_xdmac_remove(struct platfo
+ dma_async_device_unregister(&atxdmac->dma);
+ clk_disable_unprepare(atxdmac->clk);
+
+- free_irq(atxdmac->irq, atxdmac->dma.dev);
++ free_irq(atxdmac->irq, atxdmac);
+
+ for (i = 0; i < atxdmac->dma.chancnt; i++) {
+ struct at_xdmac_chan *atchan = &atxdmac->chan[i];
--- /dev/null
+From 735f2770a770156100f534646158cb58cb8b2939 Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.com>
+Date: Thu, 1 Sep 2016 16:15:13 -0700
+Subject: kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd
+
+From: Michal Hocko <mhocko@suse.com>
+
+commit 735f2770a770156100f534646158cb58cb8b2939 upstream.
+
+Commit fec1d0115240 ("[PATCH] Disable CLONE_CHILD_CLEARTID for abnormal
+exit") has caused a subtle regression in nscd which uses
+CLONE_CHILD_CLEARTID to clear the nscd_certainly_running flag in the
+shared databases, so that the clients are notified when nscd is
+restarted. Now, when nscd uses a non-persistent database, clients that
+have it mapped keep thinking the database is being updated by nscd, when
+in fact nscd has created a new (anonymous) one (for non-persistent
+databases it uses an unlinked file as backend).
+
+The original proposal for the CLONE_CHILD_CLEARTID change claimed
+(https://lkml.org/lkml/2006/10/25/233):
+
+: The NPTL library uses the CLONE_CHILD_CLEARTID flag on clone() syscalls
+: on behalf of pthread_create() library calls. This feature is used to
+: request that the kernel clear the thread-id in user space (at an address
+: provided in the syscall) when the thread disassociates itself from the
+: address space, which is done in mm_release().
+:
+: Unfortunately, when a multi-threaded process incurs a core dump (such as
+: from a SIGSEGV), the core-dumping thread sends SIGKILL signals to all of
+: the other threads, which then proceed to clear their user-space tids
+: before synchronizing in exit_mm() with the start of core dumping. This
+: misrepresents the state of process's address space at the time of the
+: SIGSEGV and makes it more difficult for someone to debug NPTL and glibc
+: problems (misleading him/her to conclude that the threads had gone away
+: before the fault).
+:
+: The fix below is to simply avoid the CLONE_CHILD_CLEARTID action if a
+: core dump has been initiated.
+
+The resulting patch from Roland (https://lkml.org/lkml/2006/10/26/269)
+seems to have a larger scope than the original patch asked for. It
+seems that limitting the scope of the check to core dumping should work
+for SIGSEGV issue describe above.
+
+[Changelog partly based on Andreas' description]
+Fixes: fec1d0115240 ("[PATCH] Disable CLONE_CHILD_CLEARTID for abnormal exit")
+Link: http://lkml.kernel.org/r/1471968749-26173-1-git-send-email-mhocko@kernel.org
+Signed-off-by: Michal Hocko <mhocko@suse.com>
+Tested-by: William Preston <wpreston@suse.com>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Cc: Roland McGrath <roland@hack.frob.com>
+Cc: Andreas Schwab <schwab@suse.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/fork.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -938,14 +938,12 @@ void mm_release(struct task_struct *tsk,
+ deactivate_mm(tsk, mm);
+
+ /*
+- * If we're exiting normally, clear a user-space tid field if
+- * requested. We leave this alone when dying by signal, to leave
+- * the value intact in a core dump, and to save the unnecessary
+- * trouble, say, a killed vfork parent shouldn't touch this mm.
+- * Userland only wants this done for a sys_exit.
++ * Signal userspace if we're not exiting with a core dump
++ * because we want to leave the value intact for debugging
++ * purposes.
+ */
+ if (tsk->clear_child_tid) {
+- if (!(tsk->flags & PF_SIGNALED) &&
++ if (!(tsk->signal->flags & SIGNAL_GROUP_COREDUMP) &&
+ atomic_read(&mm->mm_users) > 1) {
+ /*
+ * We don't check the error code - if userspace has
--- /dev/null
+From dccbfcf52cebb8963246eba5b177b77f26b34da0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= <rkrcmar@redhat.com>
+Date: Mon, 8 Aug 2016 20:16:23 +0200
+Subject: KVM: nVMX: postpone VMCS changes on MSR_IA32_APICBASE write
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Radim Krčmář <rkrcmar@redhat.com>
+
+commit dccbfcf52cebb8963246eba5b177b77f26b34da0 upstream.
+
+If vmcs12 does not intercept APIC_BASE writes, then KVM will handle the
+write with vmcs02 as the current VMCS.
+This will incorrectly apply modifications intended for vmcs01 to vmcs02
+and L2 can use it to gain access to L0's x2APIC registers by disabling
+virtualized x2APIC while using msr bitmap that assumes enabled.
+
+Postpone execution of vmx_set_virtual_x2apic_mode until vmcs01 is the
+current VMCS. An alternative solution would temporarily make vmcs01 the
+current VMCS, but it requires more care.
+
+Fixes: 8d14695f9542 ("x86, apicv: add virtual x2apic support")
+Reported-by: Jim Mattson <jmattson@google.com>
+Reviewed-by: Wanpeng Li <wanpeng.li@hotmail.com>
+Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/vmx.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -409,6 +409,7 @@ struct nested_vmx {
+ struct list_head vmcs02_pool;
+ int vmcs02_num;
+ u64 vmcs01_tsc_offset;
++ bool change_vmcs01_virtual_x2apic_mode;
+ /* L2 must run next, and mustn't decide to exit to L1. */
+ bool nested_run_pending;
+ /*
+@@ -8284,6 +8285,12 @@ static void vmx_set_virtual_x2apic_mode(
+ {
+ u32 sec_exec_control;
+
++ /* Postpone execution until vmcs01 is the current VMCS. */
++ if (is_guest_mode(vcpu)) {
++ to_vmx(vcpu)->nested.change_vmcs01_virtual_x2apic_mode = true;
++ return;
++ }
++
+ /*
+ * There is not point to enable virtualize x2apic without enable
+ * apicv
+@@ -10601,6 +10608,12 @@ static void nested_vmx_vmexit(struct kvm
+ /* Update TSC_OFFSET if TSC was changed while L2 ran */
+ vmcs_write64(TSC_OFFSET, vmx->nested.vmcs01_tsc_offset);
+
++ if (vmx->nested.change_vmcs01_virtual_x2apic_mode) {
++ vmx->nested.change_vmcs01_virtual_x2apic_mode = false;
++ vmx_set_virtual_x2apic_mode(vcpu,
++ vcpu->arch.apic_base & X2APIC_ENABLE);
++ }
++
+ /* This is needed for same reason as it was needed in prepare_vmcs02 */
+ vmx->host_rsp = 0;
+
--- /dev/null
+From e6173ba42bbdba05fd4f3021c0beda0506271507 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Thu, 1 Sep 2016 16:14:53 -0700
+Subject: lib/test_hash.c: fix warning in preprocessor symbol evaluation
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+commit e6173ba42bbdba05fd4f3021c0beda0506271507 upstream.
+
+Some versions of gcc don't like tests for the value of an undefined
+preprocessor symbol, even in the #else branch of an #ifndef:
+
+ lib/test_hash.c:224:7: warning: "HAVE_ARCH__HASH_32" is not defined [-Wundef]
+ #elif HAVE_ARCH__HASH_32 != 1
+ ^
+ lib/test_hash.c:229:7: warning: "HAVE_ARCH_HASH_32" is not defined [-Wundef]
+ #elif HAVE_ARCH_HASH_32 != 1
+ ^
+ lib/test_hash.c:234:7: warning: "HAVE_ARCH_HASH_64" is not defined [-Wundef]
+ #elif HAVE_ARCH_HASH_64 != 1
+ ^
+
+Seen with gcc 4.9, not seen with 4.1.2.
+
+Change the logic to only check the value inside an #ifdef to fix this.
+
+Fixes: 468a9428521e7d00 ("<linux/hash.h>: Add support for architecture-specific functions")
+Link: http://lkml.kernel.org/r/20160829214952.1334674-4-arnd@arndb.de
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: George Spelvin <linux@sciencehorizons.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/test_hash.c | 24 +++++++++++++++---------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+--- a/lib/test_hash.c
++++ b/lib/test_hash.c
+@@ -219,21 +219,27 @@ test_hash_init(void)
+ }
+
+ /* Issue notices about skipped tests. */
+-#ifndef HAVE_ARCH__HASH_32
+- pr_info("__hash_32() has no arch implementation to test.");
+-#elif HAVE_ARCH__HASH_32 != 1
++#ifdef HAVE_ARCH__HASH_32
++#if HAVE_ARCH__HASH_32 != 1
+ pr_info("__hash_32() is arch-specific; not compared to generic.");
+ #endif
+-#ifndef HAVE_ARCH_HASH_32
+- pr_info("hash_32() has no arch implementation to test.");
+-#elif HAVE_ARCH_HASH_32 != 1
++#else
++ pr_info("__hash_32() has no arch implementation to test.");
++#endif
++#ifdef HAVE_ARCH_HASH_32
++#if HAVE_ARCH_HASH_32 != 1
+ pr_info("hash_32() is arch-specific; not compared to generic.");
+ #endif
+-#ifndef HAVE_ARCH_HASH_64
+- pr_info("hash_64() has no arch implementation to test.");
+-#elif HAVE_ARCH_HASH_64 != 1
++#else
++ pr_info("hash_32() has no arch implementation to test.");
++#endif
++#ifdef HAVE_ARCH_HASH_64
++#if HAVE_ARCH_HASH_64 != 1
+ pr_info("hash_64() is arch-specific; not compared to generic.");
+ #endif
++#else
++ pr_info("hash_64() has no arch implementation to test.");
++#endif
+
+ pr_notice("%u tests passed.", tests);
+
--- /dev/null
+From 1c8d477a77e2d1d3504419e7f2e02e6422becf9a Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Sun, 14 Aug 2016 12:47:49 -0400
+Subject: pNFS/flexfiles: Fix layoutstat periodic reporting
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit 1c8d477a77e2d1d3504419e7f2e02e6422becf9a upstream.
+
+Putting the periodicity timer in the mirror instances is causing
+non-scalable reporting behaviour and missed reporting intervals.
+When you recall layouts and/or implement client side mirroring, it
+leads to consecutive reports with only a few ms between RPC calls.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Fixes: d0379a5d066a9 ("pNFS/flexfiles: Support server-supplied...")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/flexfilelayout/flexfilelayout.c | 8 ++++----
+ fs/nfs/flexfilelayout/flexfilelayout.h | 2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -37,6 +37,7 @@ ff_layout_alloc_layout_hdr(struct inode
+ if (ffl) {
+ INIT_LIST_HEAD(&ffl->error_list);
+ INIT_LIST_HEAD(&ffl->mirrors);
++ ffl->last_report_time = ktime_get();
+ return &ffl->generic_hdr;
+ } else
+ return NULL;
+@@ -640,19 +641,18 @@ nfs4_ff_layoutstat_start_io(struct nfs4_
+ {
+ static const ktime_t notime = {0};
+ s64 report_interval = FF_LAYOUTSTATS_REPORT_INTERVAL;
++ struct nfs4_flexfile_layout *ffl = FF_LAYOUT_FROM_HDR(mirror->layout);
+
+ nfs4_ff_start_busy_timer(&layoutstat->busy_timer, now);
+ if (ktime_equal(mirror->start_time, notime))
+ mirror->start_time = now;
+- if (ktime_equal(mirror->last_report_time, notime))
+- mirror->last_report_time = now;
+ if (mirror->report_interval != 0)
+ report_interval = (s64)mirror->report_interval * 1000LL;
+ else if (layoutstats_timer != 0)
+ report_interval = (s64)layoutstats_timer * 1000LL;
+- if (ktime_to_ms(ktime_sub(now, mirror->last_report_time)) >=
++ if (ktime_to_ms(ktime_sub(now, ffl->last_report_time)) >=
+ report_interval) {
+- mirror->last_report_time = now;
++ ffl->last_report_time = now;
+ return true;
+ }
+
+--- a/fs/nfs/flexfilelayout/flexfilelayout.h
++++ b/fs/nfs/flexfilelayout/flexfilelayout.h
+@@ -84,7 +84,6 @@ struct nfs4_ff_layout_mirror {
+ struct nfs4_ff_layoutstat read_stat;
+ struct nfs4_ff_layoutstat write_stat;
+ ktime_t start_time;
+- ktime_t last_report_time;
+ u32 report_interval;
+ };
+
+@@ -101,6 +100,7 @@ struct nfs4_flexfile_layout {
+ struct pnfs_ds_commit_info commit_info;
+ struct list_head mirrors;
+ struct list_head error_list; /* nfs4_ff_layout_ds_err */
++ ktime_t last_report_time; /* Layoutstat report times */
+ };
+
+ static inline struct nfs4_flexfile_layout *
sysctl-handle-error-writing-uint_max-to-u32-fields.patch
asoc-omap-mcpdm-fix-irq-resource-handling.patch
ib-core-fix-possible-memory-leak-in-cma_resolve_iboe_route.patch
+kernel-fork-fix-clone_child_cleartid-regression-in-nscd.patch
+sunrpc-silence-warn_on-when-nfsv4.1-over-rdma-is-in-use.patch
+pnfs-flexfiles-fix-layoutstat-periodic-reporting.patch
+lib-test_hash.c-fix-warning-in-preprocessor-symbol-evaluation.patch
+dmaengine-at_xdmac-fix-to-pass-correct-device-identity-to-free_irq.patch
+kvm-nvmx-postpone-vmcs-changes-on-msr_ia32_apicbase-write.patch
--- /dev/null
+From 16590a228109e2f318d2cc6466221134cfab723a Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Mon, 22 Aug 2016 14:57:42 -0400
+Subject: SUNRPC: Silence WARN_ON when NFSv4.1 over RDMA is in use
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 16590a228109e2f318d2cc6466221134cfab723a upstream.
+
+Using NFSv4.1 on RDMA should be safe, so broaden the new checks in
+rpc_create().
+
+WARN_ON_ONCE is used, matching most other WARN call sites in clnt.c.
+
+Fixes: 39a9beab5acb ("rpc: share one xps between all backchannels")
+Fixes: d50039ea5ee6 ("nfsd4/rpc: move backchannel create logic...")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Reviewed-by: J. Bruce Fields <bfields@fieldses.org>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/clnt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -453,7 +453,7 @@ static struct rpc_clnt *rpc_create_xprt(
+ struct rpc_xprt_switch *xps;
+
+ if (args->bc_xprt && args->bc_xprt->xpt_bc_xps) {
+- WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
++ WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
+ xps = args->bc_xprt->xpt_bc_xps;
+ xprt_switch_get(xps);
+ } else {
+@@ -520,7 +520,7 @@ struct rpc_clnt *rpc_create(struct rpc_c
+ char servername[48];
+
+ if (args->bc_xprt) {
+- WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
++ WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
+ xprt = args->bc_xprt->xpt_bc_xprt;
+ if (xprt) {
+ xprt_get(xprt);