--- /dev/null
+From 037e119738120c1cdc460c6ae33871c3000531f3 Mon Sep 17 00:00:00 2001
+From: Conrad Kostecki <ck+linuxkernel@bl4ckb0x.de>
+Date: Tue, 26 Apr 2016 10:08:10 +0200
+Subject: ALSA: hda - Add dock support for ThinkPad X260
+
+From: Conrad Kostecki <ck+linuxkernel@bl4ckb0x.de>
+
+commit 037e119738120c1cdc460c6ae33871c3000531f3 upstream.
+
+Fixes audio output on a ThinkPad X260, when using Lenovo CES 2013
+docking station series (basic, pro, ultra).
+
+Signed-off-by: Conrad Kostecki <ck+linuxkernel@bl4ckb0x.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5584,6 +5584,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x5034, "Thinkpad T450", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK),
++ SND_PCI_QUIRK(0x17aa, 0x504a, "ThinkPad X260", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
+ SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
--- /dev/null
+From 9859a971ca228725425238756ee89c6133306ec8 Mon Sep 17 00:00:00 2001
+From: "Lu, Han" <han.lu@intel.com>
+Date: Wed, 20 Apr 2016 10:08:43 +0800
+Subject: ALSA: hda - add PCI ID for Intel Broxton-T
+
+From: Lu, Han <han.lu@intel.com>
+
+commit 9859a971ca228725425238756ee89c6133306ec8 upstream.
+
+Add HD Audio Device PCI ID for the Intel Broxton-T platform.
+It is an HDA Intel PCH controller.
+
+Signed-off-by: Lu, Han <han.lu@intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2207,6 +2207,9 @@ static const struct pci_device_id azx_id
+ /* Broxton-P(Apollolake) */
+ { PCI_DEVICE(0x8086, 0x5a98),
+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON },
++ /* Broxton-T */
++ { PCI_DEVICE(0x8086, 0x1a98),
++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON },
+ /* Haswell */
+ { PCI_DEVICE(0x8086, 0x0a0c),
+ .driver_data = AZX_DRIVER_HDMI | AZX_DCAPS_INTEL_HASWELL },
--- /dev/null
+From 50fd4987c4f3c3ebf0ce94d932732011bbdc7c71 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sun, 17 Apr 2016 09:39:41 +0200
+Subject: ALSA: hda - Don't trust the reported actual power state
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 50fd4987c4f3c3ebf0ce94d932732011bbdc7c71 upstream.
+
+We've got a regression report that the recording on Mac with a cirrus
+codec doesn't work any longer. This turned out to be the missing
+power up to D0 by power_save_node enablement.
+
+After analyzing the traces, we found out that the culprit is that the
+codec advertises the "actual" power state of a few nodes to be D0
+while the "target" power state is D3. This inconsistency is usually
+OK, as it implies the power transition. But in the case of cirrus
+codec, this seems to be stuck to D3 while it's not actually D0.
+
+This patch addresses the issue by checking the power state difference
+more strictly. It sends the power-state change verb unless both the
+target and the actual power states show the given value.
+
+We may introduce yet another flag indicating the possible broken
+hardware power state, but it's anyway safer to set the proper power
+state even in a transition (at least it's harmless as long as the
+target state is same). So this simpler change was applied now.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_generic.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -843,7 +843,7 @@ static hda_nid_t path_power_update(struc
+ bool allow_powerdown)
+ {
+ hda_nid_t nid, changed = 0;
+- int i, state;
++ int i, state, power;
+
+ for (i = 0; i < path->depth; i++) {
+ nid = path->path[i];
+@@ -855,7 +855,9 @@ static hda_nid_t path_power_update(struc
+ state = AC_PWRST_D0;
+ else
+ state = AC_PWRST_D3;
+- if (!snd_hda_check_power_state(codec, nid, state)) {
++ power = snd_hda_codec_read(codec, nid, 0,
++ AC_VERB_GET_POWER_STATE, 0);
++ if (power != (state | (state << 4))) {
+ snd_hda_codec_write(codec, nid, 0,
+ AC_VERB_SET_POWER_STATE, state);
+ changed = nid;
--- /dev/null
+From de3df8a986b635082a1d94bae2c361d043c57106 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 19 Apr 2016 22:07:50 +0200
+Subject: ALSA: hda - Keep powering up ADCs on Cirrus codecs
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit de3df8a986b635082a1d94bae2c361d043c57106 upstream.
+
+Although one weird behavior about the input path (inconsistent D0/D3
+switch) on Cirrus CS420x codecs was fixed in the previous commit,
+there is still an issue on some Mac machines: the capture stream
+stalls when switching the ADCs on the fly. More badly, this keeps
+stuck until the next reboot.
+
+The dynamic ADC switching is already a bit fragile and assuming
+optimistically that the chip accepts the frequent power changes. On
+Cirrus codecs, this doesn't seem applicable.
+
+As a quick workaround, we pin down the ADCs to keep up in D0 when
+spec->dyn_adc_switch is set. In this way, the ADCs are kept up only
+for the system that were confirmed to be broken.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116171
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_cirrus.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -361,6 +361,7 @@ static int cs_parse_auto_config(struct h
+ {
+ struct cs_spec *spec = codec->spec;
+ int err;
++ int i;
+
+ err = snd_hda_parse_pin_defcfg(codec, &spec->gen.autocfg, NULL, 0);
+ if (err < 0)
+@@ -370,6 +371,19 @@ static int cs_parse_auto_config(struct h
+ if (err < 0)
+ return err;
+
++ /* keep the ADCs powered up when it's dynamically switchable */
++ if (spec->gen.dyn_adc_switch) {
++ unsigned int done = 0;
++ for (i = 0; i < spec->gen.input_mux.num_items; i++) {
++ int idx = spec->gen.dyn_adc_idx[i];
++ if (done & (1 << idx))
++ continue;
++ snd_hda_gen_fix_pin_power(codec,
++ spec->gen.adc_nids[idx]);
++ done |= 1 << idx;
++ }
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From afecb146d8d8a60a1dde9cdf570c278649617fde Mon Sep 17 00:00:00 2001
+From: Bastien Nocera <hadess@hadess.net>
+Date: Mon, 18 Apr 2016 11:10:42 +0200
+Subject: ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m
+
+From: Bastien Nocera <hadess@hadess.net>
+
+commit afecb146d8d8a60a1dde9cdf570c278649617fde upstream.
+
+The Optiplex 9020m with Haswell-DT processor needs a quirk for the
+headset jack at the front of the machine to be able to use microphones.
+
+A quirk for this model was originally added in 3127899, but c77900e
+removed it in favour of a more generic version.
+
+Unfortunately, pin configurations can changed based on firmware/BIOS
+versions, and the generic version doesn't have any effect on newer
+versions of the machine/firmware anymore.
+
+With help from David Henningsson <diwic@ubuntu.com>
+
+Signed-off-by: Bastien Nocera <hadess@hadess.net>
+Tested-by: Bastien Nocera <hadess@hadess.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5449,6 +5449,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0665, "Dell XPS 13", ALC288_FIXUP_DELL_XPS_13),
++ SND_PCI_QUIRK(0x1028, 0x0669, "Dell Optiplex 9020m", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x069a, "Dell Vostro 5480", ALC290_FIXUP_SUBWOOFER_HSJACK),
+ SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
--- /dev/null
+From 67f3754b51f22b18c4820fb84062f658c30e8644 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 21 Apr 2016 17:37:54 +0200
+Subject: ALSA: pcxhr: Fix missing mutex unlock
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 67f3754b51f22b18c4820fb84062f658c30e8644 upstream.
+
+The commit [9bef72bdb26e: ALSA: pcxhr: Use nonatomic PCM ops]
+converted to non-atomic PCM ops, but shamelessly with an unbalanced
+mutex locking, which leads to the hangup easily. Fix it.
+
+Fixes: 9bef72bdb26e ('ALSA: pcxhr: Use nonatomic PCM ops')
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116441
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/pcxhr/pcxhr_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/pcxhr/pcxhr_core.c
++++ b/sound/pci/pcxhr/pcxhr_core.c
+@@ -1341,5 +1341,6 @@ irqreturn_t pcxhr_threaded_irq(int irq,
+ }
+
+ pcxhr_msg_thread(mgr);
++ mutex_unlock(&mgr->lock);
+ return IRQ_HANDLED;
+ }
--- /dev/null
+From fba7cd681b6155e2d93e7862fcd6f970336b83c3 Mon Sep 17 00:00:00 2001
+From: Romain Perier <romain.perier@free-electrons.com>
+Date: Thu, 14 Apr 2016 15:36:03 +0200
+Subject: asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic()
+
+From: Romain Perier <romain.perier@free-electrons.com>
+
+commit fba7cd681b6155e2d93e7862fcd6f970336b83c3 upstream.
+
+The recent decoupling of pagefault disable and preempt disable added an
+explicit preempt_disable/enable() pair to the futex_atomic_cmpxchg_inatomic()
+implementation in asm-generic/futex.h. But it forgot to add preempt_enable()
+calls to the error handling code pathes, which results in a preemption count
+imbalance.
+
+This is observable on boot when the test for atomic_cmpxchg() is calling
+futex_atomic_cmpxchg_inatomic() on a NULL pointer.
+
+Add the missing preempt_enable() calls to the error handling code pathes.
+
+[ tglx: Massaged changelog ]
+
+Fixes: d9b9ff8c1889 ("sched/preempt, futex: Disable preemption in UP futex_atomic_cmpxchg_inatomic() explicitly")
+Signed-off-by: Romain Perier <romain.perier@free-electrons.com>
+Cc: linux-arch@vger.kernel.org
+Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/1460640963-690-1-git-send-email-romain.perier@free-electrons.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/asm-generic/futex.h | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/include/asm-generic/futex.h
++++ b/include/asm-generic/futex.h
+@@ -108,11 +108,15 @@ futex_atomic_cmpxchg_inatomic(u32 *uval,
+ u32 val;
+
+ preempt_disable();
+- if (unlikely(get_user(val, uaddr) != 0))
++ if (unlikely(get_user(val, uaddr) != 0)) {
++ preempt_enable();
+ return -EFAULT;
++ }
+
+- if (val == oldval && unlikely(put_user(newval, uaddr) != 0))
++ if (val == oldval && unlikely(put_user(newval, uaddr) != 0)) {
++ preempt_enable();
+ return -EFAULT;
++ }
+
+ *uval = val;
+ preempt_enable();
--- /dev/null
+From 1becf03545a0859ceaaf9e8c2d9861882a71cb01 Mon Sep 17 00:00:00 2001
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Date: Fri, 22 Apr 2016 19:53:59 -0700
+Subject: cpufreq: intel_pstate: Fix processing for turbo activation ratio
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+commit 1becf03545a0859ceaaf9e8c2d9861882a71cb01 upstream.
+
+When the config TDP level is not nominal (level = 0), the MSR values for
+reading level 1 and level 2 ratios contain power in low 14 bits and actual
+ratio bits are at bits [23:16]. The current processing for level 1 and
+level 2 is wrong as there is no shift done to get actual ratio.
+
+Fixes: 6a35fc2d6c22 (cpufreq: intel_pstate: get P1 from TAR when available)
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/intel_pstate.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -667,6 +667,11 @@ static int core_get_max_pstate(void)
+ if (err)
+ goto skip_tar;
+
++ /* For level 1 and 2, bits[23:16] contain the ratio */
++ if (tdp_ctrl)
++ tdp_ratio >>= 16;
++
++ tdp_ratio &= 0xff; /* ratios are only 8 bits long */
+ if (tdp_ratio - 1 == tar) {
+ max_pstate = tar;
+ pr_debug("max_pstate=TAC %x\n", max_pstate);
--- /dev/null
+From 9dbaab56ac09f07a73fe83bf69bec3e31060080a Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 14 Mar 2016 09:01:57 +0000
+Subject: drm/i915: Exit cherryview_irq_handler() after one pass
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 9dbaab56ac09f07a73fe83bf69bec3e31060080a upstream.
+
+This effectively reverts
+
+commit 8e5fd599eb219f1054e39b40d18b217af669eea9
+Author: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Date: Wed Apr 9 13:28:50 2014 +0300
+
+ drm/i915/chv: Make CHV irq handler loop until all interrupts are consumed
+
+as under continuous execlists load we can saturate the IRQ handler,
+destablising the tsc clock and triggering the NMI watchdog to declare a hung
+CPU.
+
+[ 552.756051] clocksource: timekeeping watchdog on CPU0: Marking clocksource 'tsc' as unstable because the skew is too large:
+[ 552.756080] clocksource: 'refined-jiffies' wd_now: 10003b480 wd_last: 10003b28c mask: ffffffff
+[ 552.756091] clocksource: 'tsc' cs_now: d55d31aa50 cs_last: d17446166c mask: ffffffffffffffff
+[ 552.756210] clocksource: Switched to clocksource refined-jiffies
+[ 575.217870] NMI watchdog: Watchdog detected hard LOCKUP on cpu 1
+[ 575.217893] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.5.0-rc7+ #18
+[ 575.217905] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0027.2015.0507.1758 05/07/2015
+[ 575.217915] 0000000000000000 ffff88027fd05bc0 ffffffff81288c6d 0000000000000000
+[ 575.217935] 0000000000000001 ffff88027fd05be0 ffffffff810e72d1 0000000000000000
+[ 575.217951] ffff88027fd05c80 ffff88027fd05c20 ffffffff81114b60 0000000181015f1e
+[ 575.217967] Call Trace:
+[ 575.217973] <NMI> [<ffffffff81288c6d>] dump_stack+0x4f/0x72
+[ 575.217994] [<ffffffff810e72d1>] watchdog_overflow_callback+0x151/0x160
+[ 575.218003] [<ffffffff81114b60>] __perf_event_overflow+0xa0/0x1e0
+[ 575.218016] [<ffffffff811154c4>] perf_event_overflow+0x14/0x20
+[ 575.218028] [<ffffffff8101d2ca>] intel_pmu_handle_irq+0x1da/0x460
+[ 575.218042] [<ffffffff814a8aae>] ? poll_idle+0x3e/0x70
+[ 575.218052] [<ffffffff814a8aae>] ? poll_idle+0x3e/0x70
+[ 575.218064] [<ffffffff81014ae8>] perf_event_nmi_handler+0x28/0x50
+[ 575.218075] [<ffffffff81007540>] nmi_handle+0x60/0x130
+[ 575.218086] [<ffffffff814a8aae>] ? poll_idle+0x3e/0x70
+[ 575.218096] [<ffffffff810079c0>] do_nmi+0x140/0x470
+[ 575.218108] [<ffffffff81559ec7>] end_repeat_nmi+0x1a/0x1e
+[ 575.218119] [<ffffffff814a8aae>] ? poll_idle+0x3e/0x70
+[ 575.218129] [<ffffffff814a8aae>] ? poll_idle+0x3e/0x70
+[ 575.218139] [<ffffffff814a8aae>] ? poll_idle+0x3e/0x70
+[ 575.218148] <<EOE>> [<ffffffff814a8353>] cpuidle_enter_state+0xf3/0x2f0
+[ 575.218164] [<ffffffff814a8587>] cpuidle_enter+0x17/0x20
+[ 575.218175] [<ffffffff810aaa3a>] call_cpuidle+0x2a/0x40
+[ 575.218185] [<ffffffff810aade3>] cpu_startup_entry+0x273/0x330
+[ 575.218196] [<ffffffff81033a1e>] start_secondary+0x10e/0x130
+
+However, not servicing all available IIR within the handler does hurt the
+throughput of pathological nop execbuf by about 20%, with a similar effect
+upon the dispatch latency of a series of execbuf.
+
+v2: use do {} while(0) for a smaller patch, and easier to revert again
+
+I have reasonable confidence that we do not miss GT interrupts (as
+execlists provides a stress case with a failure mechanism easily
+detected by igt), however I have less confidence about all the other
+sources of interrupts and worry that may lose a display hotplug
+interrupt, for example.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93467
+Testcase: igt/gem_exec_nop/basic # requires NMI watchdog
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Antti Koskipää <antti.koskipaa@linux.intel.com>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1457946117-6714-1-git-send-email-chris@chris-wilson.co.uk
+(cherry picked from commit 579de73b048a0a4c66c25a033ac76a2836e0cf73)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_irq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -1788,7 +1788,7 @@ static irqreturn_t cherryview_irq_handle
+ if (!intel_irqs_enabled(dev_priv))
+ return IRQ_NONE;
+
+- for (;;) {
++ do {
+ master_ctl = I915_READ(GEN8_MASTER_IRQ) & ~GEN8_MASTER_IRQ_CONTROL;
+ iir = I915_READ(VLV_IIR);
+
+@@ -1816,7 +1816,7 @@ static irqreturn_t cherryview_irq_handle
+
+ I915_WRITE(GEN8_MASTER_IRQ, DE_MASTER_IRQ_CONTROL);
+ POSTING_READ(GEN8_MASTER_IRQ);
+- }
++ } while (0);
+
+ return ret;
+ }
--- /dev/null
+From 9e60290dbafdf577766e5fc5f2fdb3be450cf9a6 Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Wed, 16 Mar 2016 15:18:04 -0400
+Subject: drm/i915: Fix race condition in intel_dp_destroy_mst_connector()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lyude <cpaul@redhat.com>
+
+commit 9e60290dbafdf577766e5fc5f2fdb3be450cf9a6 upstream.
+
+After unplugging a DP MST display from the system, we have to go through
+and destroy all of the DRM connectors associated with it since none of
+them are valid anymore. Unfortunately, intel_dp_destroy_mst_connector()
+doesn't do a good enough job of ensuring that throughout the destruction
+process that no modesettings can be done with the connectors. As it is
+right now, intel_dp_destroy_mst_connector() works like this:
+
+* Take all modeset locks
+* Clear the configuration of the crtc on the connector, if there is one
+* Drop all modeset locks, this is required because of circular
+ dependency issues that arise with trying to remove the connector from
+ sysfs with modeset locks held
+* Unregister the connector
+* Take all modeset locks, again
+* Do the rest of the required cleaning for destroying the connector
+* Finally drop all modeset locks for good
+
+This only works sometimes. During the destruction process, it's very
+possible that a userspace application will attempt to do a modesetting
+using the connector. When we drop the modeset locks, an ioctl handler
+such as drm_mode_setcrtc has the oppurtunity to take all of the modeset
+locks from us. When this happens, one thing leads to another and
+eventually we end up committing a mode with the non-existent connector:
+
+ [drm:intel_dp_link_training_clock_recovery [i915]] *ERROR* failed to enable link training
+ [drm:intel_dp_aux_ch] dp_aux_ch timeout status 0x7cf0001f
+ [drm:intel_dp_start_link_train [i915]] *ERROR* failed to start channel equalization
+ [drm:intel_dp_aux_ch] dp_aux_ch timeout status 0x7cf0001f
+ [drm:intel_mst_pre_enable_dp [i915]] *ERROR* failed to allocate vcpi
+
+And in some cases, such as with the T460s using an MST dock, this
+results in breaking modesetting and/or panicking the system.
+
+To work around this, we now unregister the connector at the very
+beginning of intel_dp_destroy_mst_connector(), grab all the modesetting
+locks, and then hold them until we finish the rest of the function.
+
+Signed-off-by: Lyude <cpaul@redhat.com>
+Signed-off-by: Rob Clark <rclark@redhat.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1458155884-13877-1-git-send-email-cpaul@redhat.com
+(cherry picked from commit 1f7717552ef1306be3b7ed28c66c6eff550e3a23)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_dp_mst.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -477,6 +477,8 @@ static void intel_dp_destroy_mst_connect
+ struct intel_connector *intel_connector = to_intel_connector(connector);
+ struct drm_device *dev = connector->dev;
+
++ intel_connector->unregister(intel_connector);
++
+ /* need to nuke the connector */
+ drm_modeset_lock_all(dev);
+ if (connector->state->crtc) {
+@@ -490,11 +492,7 @@ static void intel_dp_destroy_mst_connect
+
+ WARN(ret, "Disabling mst crtc failed with %i\n", ret);
+ }
+- drm_modeset_unlock_all(dev);
+
+- intel_connector->unregister(intel_connector);
+-
+- drm_modeset_lock_all(dev);
+ intel_connector_remove_from_fbdev(intel_connector);
+ drm_connector_cleanup(connector);
+ drm_modeset_unlock_all(dev);
--- /dev/null
+From 78a121d82da8aff3aca2a6a1c40f5061081760f0 Mon Sep 17 00:00:00 2001
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+Date: Sun, 6 Mar 2016 16:06:06 -0500
+Subject: drm/nouveau/core: use vzalloc for allocating ramht
+
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+
+commit 78a121d82da8aff3aca2a6a1c40f5061081760f0 upstream.
+
+Most calls to nvkm_ramht_new use 0x8000 as the size. This results in a
+fairly sizeable chunk of memory to be allocated, which may not be
+available with kzalloc. Since this is done fairly rarely (once per
+channel), use vzalloc instead.
+
+Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Cc: Sven Joachim <svenjoac@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nvkm/core/ramht.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nvkm/core/ramht.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/ramht.c
+@@ -131,7 +131,7 @@ nvkm_ramht_del(struct nvkm_ramht **pramh
+ struct nvkm_ramht *ramht = *pramht;
+ if (ramht) {
+ nvkm_gpuobj_del(&ramht->gpuobj);
+- kfree(*pramht);
++ vfree(*pramht);
+ *pramht = NULL;
+ }
+ }
+@@ -143,8 +143,8 @@ nvkm_ramht_new(struct nvkm_device *devic
+ struct nvkm_ramht *ramht;
+ int ret, i;
+
+- if (!(ramht = *pramht = kzalloc(sizeof(*ramht) + (size >> 3) *
+- sizeof(*ramht->data), GFP_KERNEL)))
++ if (!(ramht = *pramht = vzalloc(sizeof(*ramht) +
++ (size >> 3) * sizeof(*ramht->data))))
+ return -ENOMEM;
+
+ ramht->device = device;
--- /dev/null
+From d59a1f71ff1aeda4b4630df92d3ad4e3b1dfc885 Mon Sep 17 00:00:00 2001
+From: John Keeping <john@metanate.com>
+Date: Wed, 18 Nov 2015 11:17:25 +0000
+Subject: drm/qxl: fix cursor position with non-zero hotspot
+
+From: John Keeping <john@metanate.com>
+
+commit d59a1f71ff1aeda4b4630df92d3ad4e3b1dfc885 upstream.
+
+The SPICE protocol considers the position of a cursor to be the location
+of its active pixel on the display, so the cursor is drawn with its
+top-left corner at "(x - hot_spot_x, y - hot_spot_y)" but the DRM cursor
+position gives the location where the top-left corner should be drawn,
+with the hotspot being a hint for drivers that need it.
+
+This fixes the location of the window resize cursors when using Fluxbox
+with the QXL DRM driver and both the QXL and modesetting X drivers.
+
+Signed-off-by: John Keeping <john@metanate.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1447845445-2116-1-git-send-email-john@metanate.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/qxl/qxl_display.c | 13 +++++++++----
+ drivers/gpu/drm/qxl/qxl_drv.h | 2 ++
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/qxl/qxl_display.c
++++ b/drivers/gpu/drm/qxl/qxl_display.c
+@@ -375,10 +375,15 @@ static int qxl_crtc_cursor_set2(struct d
+
+ qxl_bo_kunmap(user_bo);
+
++ qcrtc->cur_x += qcrtc->hot_spot_x - hot_x;
++ qcrtc->cur_y += qcrtc->hot_spot_y - hot_y;
++ qcrtc->hot_spot_x = hot_x;
++ qcrtc->hot_spot_y = hot_y;
++
+ cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release);
+ cmd->type = QXL_CURSOR_SET;
+- cmd->u.set.position.x = qcrtc->cur_x;
+- cmd->u.set.position.y = qcrtc->cur_y;
++ cmd->u.set.position.x = qcrtc->cur_x + qcrtc->hot_spot_x;
++ cmd->u.set.position.y = qcrtc->cur_y + qcrtc->hot_spot_y;
+
+ cmd->u.set.shape = qxl_bo_physical_address(qdev, cursor_bo, 0);
+
+@@ -441,8 +446,8 @@ static int qxl_crtc_cursor_move(struct d
+
+ cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release);
+ cmd->type = QXL_CURSOR_MOVE;
+- cmd->u.position.x = qcrtc->cur_x;
+- cmd->u.position.y = qcrtc->cur_y;
++ cmd->u.position.x = qcrtc->cur_x + qcrtc->hot_spot_x;
++ cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y;
+ qxl_release_unmap(qdev, release, &cmd->release_info);
+
+ qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
+--- a/drivers/gpu/drm/qxl/qxl_drv.h
++++ b/drivers/gpu/drm/qxl/qxl_drv.h
+@@ -135,6 +135,8 @@ struct qxl_crtc {
+ int index;
+ int cur_x;
+ int cur_y;
++ int hot_spot_x;
++ int hot_spot_y;
+ };
+
+ struct qxl_output {
--- /dev/null
+From fe1bce9e2107ba3a8faffe572483b6974201a0e6 Mon Sep 17 00:00:00 2001
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Wed, 20 Apr 2016 20:09:24 -0700
+Subject: futex: Acknowledge a new waiter in counter before plist
+
+From: Davidlohr Bueso <dave@stgolabs.net>
+
+commit fe1bce9e2107ba3a8faffe572483b6974201a0e6 upstream.
+
+Otherwise an incoming waker on the dest hash bucket can miss
+the waiter adding itself to the plist during the lockless
+check optimization (small window but still the correct way
+of doing this); similarly to the decrement counterpart.
+
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: bigeasy@linutronix.de
+Cc: dvhart@infradead.org
+Link: http://lkml.kernel.org/r/1461208164-29150-1-git-send-email-dave@stgolabs.net
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/futex.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1484,8 +1484,8 @@ void requeue_futex(struct futex_q *q, st
+ if (likely(&hb1->chain != &hb2->chain)) {
+ plist_del(&q->list, &hb1->chain);
+ hb_waiters_dec(hb1);
+- plist_add(&q->list, &hb2->chain);
+ hb_waiters_inc(hb2);
++ plist_add(&q->list, &hb2->chain);
+ q->lock_ptr = &hb2->lock;
+ }
+ get_futex_key_refs(key2);
--- /dev/null
+From 89e9e66ba1b3bde9d8ea90566c2aee20697ad681 Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Fri, 15 Apr 2016 14:35:39 +0200
+Subject: futex: Handle unlock_pi race gracefully
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+commit 89e9e66ba1b3bde9d8ea90566c2aee20697ad681 upstream.
+
+If userspace calls UNLOCK_PI unconditionally without trying the TID -> 0
+transition in user space first then the user space value might not have the
+waiters bit set. This opens the following race:
+
+CPU0 CPU1
+uval = get_user(futex)
+ lock(hb)
+lock(hb)
+ futex |= FUTEX_WAITERS
+ ....
+ unlock(hb)
+
+cmpxchg(futex, uval, newval)
+
+So the cmpxchg fails and returns -EINVAL to user space, which is wrong because
+the futex value is valid.
+
+To handle this (yes, yet another) corner case gracefully, check for a flag
+change and retry.
+
+[ tglx: Massaged changelog and slightly reworked implementation ]
+
+Fixes: ccf9e6a80d9e ("futex: Make unlock_pi more robust")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Darren Hart <dvhart@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/1460723739-5195-1-git-send-email-bigeasy@linutronix.de
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/futex.c | 25 ++++++++++++++++++++++---
+ 1 file changed, 22 insertions(+), 3 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1244,10 +1244,20 @@ static int wake_futex_pi(u32 __user *uad
+ if (unlikely(should_fail_futex(true)))
+ ret = -EFAULT;
+
+- if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
++ if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) {
+ ret = -EFAULT;
+- else if (curval != uval)
+- ret = -EINVAL;
++ } else if (curval != uval) {
++ /*
++ * If a unconditional UNLOCK_PI operation (user space did not
++ * try the TID->0 transition) raced with a waiter setting the
++ * FUTEX_WAITERS flag between get_user() and locking the hash
++ * bucket lock, retry the operation.
++ */
++ if ((FUTEX_TID_MASK & curval) == uval)
++ ret = -EAGAIN;
++ else
++ ret = -EINVAL;
++ }
+ if (ret) {
+ raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
+ return ret;
+@@ -2538,6 +2548,15 @@ retry:
+ if (ret == -EFAULT)
+ goto pi_faulted;
+ /*
++ * A unconditional UNLOCK_PI op raced against a waiter
++ * setting the FUTEX_WAITERS bit. Try again.
++ */
++ if (ret == -EAGAIN) {
++ spin_unlock(&hb->lock);
++ put_futex_key(&key);
++ goto retry;
++ }
++ /*
+ * wake_futex_pi has detected invalid state. Tell user
+ * space.
+ */
--- /dev/null
+From e9bef455af8eb0e837e179aab8988ae2649fd8d3 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 25 Apr 2016 13:12:18 -0400
+Subject: Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control"
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e9bef455af8eb0e837e179aab8988ae2649fd8d3 upstream.
+
+This reverts commit bedf2a65c1aa8fb29ba8527fd00c0f68ec1f55f1.
+
+See the radeon revert for an extended description.
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 8 ++++----
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +-------
+ 2 files changed, 5 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+@@ -63,10 +63,6 @@ bool amdgpu_has_atpx(void) {
+ return amdgpu_atpx_priv.atpx_detected;
+ }
+
+-bool amdgpu_has_atpx_dgpu_power_cntl(void) {
+- return amdgpu_atpx_priv.atpx.functions.power_cntl;
+-}
+-
+ /**
+ * amdgpu_atpx_call - call an ATPX method
+ *
+@@ -146,6 +142,10 @@ static void amdgpu_atpx_parse_functions(
+ */
+ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx)
+ {
++ /* make sure required functions are enabled */
++ /* dGPU power control is required */
++ atpx->functions.power_cntl = true;
++
+ if (atpx->functions.px_params) {
+ union acpi_object *info;
+ struct atpx_px_params output;
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -61,12 +61,6 @@ static const char *amdgpu_asic_name[] =
+ "LAST",
+ };
+
+-#if defined(CONFIG_VGA_SWITCHEROO)
+-bool amdgpu_has_atpx_dgpu_power_cntl(void);
+-#else
+-static inline bool amdgpu_has_atpx_dgpu_power_cntl(void) { return false; }
+-#endif
+-
+ bool amdgpu_device_is_px(struct drm_device *dev)
+ {
+ struct amdgpu_device *adev = dev->dev_private;
+@@ -1475,7 +1469,7 @@ int amdgpu_device_init(struct amdgpu_dev
+
+ if (amdgpu_runtime_pm == 1)
+ runtime = true;
+- if (amdgpu_device_is_px(ddev) && amdgpu_has_atpx_dgpu_power_cntl())
++ if (amdgpu_device_is_px(ddev))
+ runtime = true;
+ vga_switcheroo_register_client(adev->pdev, &amdgpu_switcheroo_ops, runtime);
+ if (runtime)
--- /dev/null
+From bfaddd9fc8ac048b99475f000dbef6f08297417f Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 18 Apr 2016 11:19:19 -0400
+Subject: Revert "drm/radeon: disable runtime pm on PX laptops without dGPU power control"
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit bfaddd9fc8ac048b99475f000dbef6f08297417f upstream.
+
+This reverts commit e64c952efb8e0c15ae82cec8e455ab4910690ef1.
+
+ATPX is the ACPI method for controlling AMD PowerXpress laptops.
+There are flags to indicate which methods are supported. If
+the dGPU power down flag is not supported, the driver needs to
+implement the dGPU power down manually. We had previously
+always forced the driver to assume the ATPX dGPU power down
+was present, but this causes problems on boards where it is
+not, leading to GPU hangs when attempting to power down the
+dGPU. Manual dGPU power down is not currently supported in
+the Linux driver. Some laptops indicate that the ATPX
+dGPU power down method is not present, but it actually
+apparently is. I'm not sure if this is a bios bug and it should
+be set or if there is a reason it was unset and the method should
+not be used. This is not an issue on other OSes since both the
+ATPX and the manual driver power down methods are supported.
+
+This is apparently fairly widespread, so just revert for now.
+
+bugs:
+https://bugzilla.kernel.org/show_bug.cgi?id=115321
+https://bugzilla.kernel.org/show_bug.cgi?id=116581
+https://bugzilla.kernel.org/show_bug.cgi?id=116251
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_atpx_handler.c | 8 ++++----
+ drivers/gpu/drm/radeon/radeon_device.c | 8 +-------
+ 2 files changed, 5 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+@@ -62,10 +62,6 @@ bool radeon_has_atpx(void) {
+ return radeon_atpx_priv.atpx_detected;
+ }
+
+-bool radeon_has_atpx_dgpu_power_cntl(void) {
+- return radeon_atpx_priv.atpx.functions.power_cntl;
+-}
+-
+ /**
+ * radeon_atpx_call - call an ATPX method
+ *
+@@ -145,6 +141,10 @@ static void radeon_atpx_parse_functions(
+ */
+ static int radeon_atpx_validate(struct radeon_atpx *atpx)
+ {
++ /* make sure required functions are enabled */
++ /* dGPU power control is required */
++ atpx->functions.power_cntl = true;
++
+ if (atpx->functions.px_params) {
+ union acpi_object *info;
+ struct atpx_px_params output;
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -103,12 +103,6 @@ static const char radeon_family_name[][1
+ "LAST",
+ };
+
+-#if defined(CONFIG_VGA_SWITCHEROO)
+-bool radeon_has_atpx_dgpu_power_cntl(void);
+-#else
+-static inline bool radeon_has_atpx_dgpu_power_cntl(void) { return false; }
+-#endif
+-
+ #define RADEON_PX_QUIRK_DISABLE_PX (1 << 0)
+ #define RADEON_PX_QUIRK_LONG_WAKEUP (1 << 1)
+
+@@ -1439,7 +1433,7 @@ int radeon_device_init(struct radeon_dev
+ * ignore it */
+ vga_client_register(rdev->pdev, rdev, NULL, radeon_vga_set_decode);
+
+- if ((rdev->flags & RADEON_IS_PX) && radeon_has_atpx_dgpu_power_cntl())
++ if (rdev->flags & RADEON_IS_PX)
+ runtime = true;
+ vga_switcheroo_register_client(rdev->pdev, &radeon_switcheroo_ops, runtime);
+ if (runtime)
sched-cgroup-fix-cleanup-cgroup-teardown-init.patch
arm64-honour-pte_write-in-set_pte_at-for-kernel-mappings.patch
arm64-update-pte_rdonly-in-set_pte_at-for-prot_none-permission.patch
+x86-mm-xen-suppress-hugetlbfs-in-pv-guests.patch
+x86-edac-sb_edac.c-repair-damage-introduced-when-fixing-channel-address.patch
+alsa-hda-don-t-trust-the-reported-actual-power-state.patch
+alsa-hda-realtek-add-alc3234-headset-mode-for-optiplex-9020m.patch
+alsa-hda-keep-powering-up-adcs-on-cirrus-codecs.patch
+alsa-hda-add-pci-id-for-intel-broxton-t.patch
+alsa-pcxhr-fix-missing-mutex-unlock.patch
+alsa-hda-add-dock-support-for-thinkpad-x260.patch
+asm-generic-futex-re-enable-preemption-in-futex_atomic_cmpxchg_inatomic.patch
+futex-handle-unlock_pi-race-gracefully.patch
+futex-acknowledge-a-new-waiter-in-counter-before-plist.patch
+drm-nouveau-core-use-vzalloc-for-allocating-ramht.patch
+drm-qxl-fix-cursor-position-with-non-zero-hotspot.patch
+drm-i915-exit-cherryview_irq_handler-after-one-pass.patch
+drm-i915-fix-race-condition-in-intel_dp_destroy_mst_connector.patch
+revert-drm-radeon-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch
+revert-drm-amdgpu-disable-runtime-pm-on-px-laptops-without-dgpu-power-control.patch
+cpufreq-intel_pstate-fix-processing-for-turbo-activation-ratio.patch
--- /dev/null
+From ff15e95c82768d589957dbb17d7eb7dba7904659 Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Thu, 14 Apr 2016 10:21:52 -0700
+Subject: x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit ff15e95c82768d589957dbb17d7eb7dba7904659 upstream.
+
+In commit:
+
+ eb1af3b71f9d ("Fix computation of channel address")
+
+I switched the "sck_way" variable from holding the log2 value read
+from the h/w to instead be the actual number. Unfortunately it
+is needed in log2 form when used to shift the address.
+
+Tested-by: Patrick Geary <patrickg@supermicro.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Acked-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Cc: Aristeu Rozanski <arozansk@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-edac@vger.kernel.org
+Fixes: eb1af3b71f9d ("Fix computation of channel address")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/edac/sb_edac.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -1396,7 +1396,7 @@ static int get_memory_error_data(struct
+ }
+
+ ch_way = TAD_CH(reg) + 1;
+- sck_way = 1 << TAD_SOCK(reg);
++ sck_way = TAD_SOCK(reg);
+
+ if (ch_way == 3)
+ idx = addr >> 6;
+@@ -1435,7 +1435,7 @@ static int get_memory_error_data(struct
+ switch(ch_way) {
+ case 2:
+ case 4:
+- sck_xch = 1 << sck_way * (ch_way >> 1);
++ sck_xch = (1 << sck_way) * (ch_way >> 1);
+ break;
+ default:
+ sprintf(msg, "Invalid mirror set. Can't decode addr");
+@@ -1471,7 +1471,7 @@ static int get_memory_error_data(struct
+
+ ch_addr = addr - offset;
+ ch_addr >>= (6 + shiftup);
+- ch_addr /= ch_way * sck_way;
++ ch_addr /= sck_xch;
+ ch_addr <<= (6 + shiftup);
+ ch_addr |= addr & ((1 << (6 + shiftup)) - 1);
+
--- /dev/null
+From 103f6112f253017d7062cd74d17f4a514ed4485c Mon Sep 17 00:00:00 2001
+From: Jan Beulich <JBeulich@suse.com>
+Date: Thu, 21 Apr 2016 00:27:04 -0600
+Subject: x86/mm/xen: Suppress hugetlbfs in PV guests
+
+From: Jan Beulich <JBeulich@suse.com>
+
+commit 103f6112f253017d7062cd74d17f4a514ed4485c upstream.
+
+Huge pages are not normally available to PV guests. Not suppressing
+hugetlbfs use results in an endless loop of page faults when user mode
+code tries to access a hugetlbfs mapped area (since the hypervisor
+denies such PTEs to be created, but error indications can't be
+propagated out of xen_set_pte_at(), just like for various of its
+siblings), and - once killed in an oops like this:
+
+ kernel BUG at .../fs/hugetlbfs/inode.c:428!
+ invalid opcode: 0000 [#1] SMP
+ ...
+ RIP: e030:[<ffffffff811c333b>] [<ffffffff811c333b>] remove_inode_hugepages+0x25b/0x320
+ ...
+ Call Trace:
+ [<ffffffff811c3415>] hugetlbfs_evict_inode+0x15/0x40
+ [<ffffffff81167b3d>] evict+0xbd/0x1b0
+ [<ffffffff8116514a>] __dentry_kill+0x19a/0x1f0
+ [<ffffffff81165b0e>] dput+0x1fe/0x220
+ [<ffffffff81150535>] __fput+0x155/0x200
+ [<ffffffff81079fc0>] task_work_run+0x60/0xa0
+ [<ffffffff81063510>] do_exit+0x160/0x400
+ [<ffffffff810637eb>] do_group_exit+0x3b/0xa0
+ [<ffffffff8106e8bd>] get_signal+0x1ed/0x470
+ [<ffffffff8100f854>] do_signal+0x14/0x110
+ [<ffffffff810030e9>] prepare_exit_to_usermode+0xe9/0xf0
+ [<ffffffff814178a5>] retint_user+0x8/0x13
+
+This is CVE-2016-3961 / XSA-174.
+
+Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: David Vrabel <david.vrabel@citrix.com>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Juergen Gross <JGross@suse.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Luis R. Rodriguez <mcgrof@suse.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Toshi Kani <toshi.kani@hp.com>
+Cc: xen-devel <xen-devel@lists.xenproject.org>
+Link: http://lkml.kernel.org/r/57188ED802000078000E431C@prv-mh.provo.novell.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/hugetlb.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/include/asm/hugetlb.h
++++ b/arch/x86/include/asm/hugetlb.h
+@@ -4,6 +4,7 @@
+ #include <asm/page.h>
+ #include <asm-generic/hugetlb.h>
+
++#define hugepages_supported() cpu_has_pse
+
+ static inline int is_hugepage_only_range(struct mm_struct *mm,
+ unsigned long addr,
projects / thirdparty / kernel / stable-queue.git / commitdiff
