--- /dev/null
+From fd48331f9b71d2add941adaee3619f5b8527182d Mon Sep 17 00:00:00 2001
+From: Maruthi Srinivas Bayyavarapu <Maruthi.Bayyavarapu@amd.com>
+Date: Wed, 3 Aug 2016 16:46:39 +0530
+Subject: ALSA: hda: add AMD Bonaire AZ PCI ID with proper driver caps
+
+From: Maruthi Srinivas Bayyavarapu <Maruthi.Bayyavarapu@amd.com>
+
+commit fd48331f9b71d2add941adaee3619f5b8527182d upstream.
+
+This commit fixes garbled audio on Bonaire HDMI
+
+Signed-off-by: Maruthi Bayyavarapu <maruthi.bayyavarapu@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2288,6 +2288,8 @@ static const struct pci_device_id azx_id
+ { PCI_DEVICE(0x1022, 0x780d),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
+ /* ATI HDMI */
++ { PCI_DEVICE(0x1002, 0x0002),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0x1308),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0x157a),
--- /dev/null
+From 59ec4b57bcaede46546d54d037a21004b9aa5cef Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Thu, 4 Aug 2016 15:28:04 +0800
+Subject: ALSA: hda - Fix headset mic detection problem for two dell machines
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 59ec4b57bcaede46546d54d037a21004b9aa5cef upstream.
+
+One of the machines has ALC255 on it, another one has ALC298 on it.
+
+On the machine with the codec ALC298, it also has the speaker volume
+problem, so we add the fixup chained to ALC298_FIXUP_SPK_VOLUME rather
+than adding a group of pin definition in the pin quirk table, since
+the speak volume problem does not happen on other machines yet.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5498,6 +5498,8 @@ static const struct hda_fixup alc269_fix
+ [ALC298_FIXUP_SPK_VOLUME] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc298_fixup_speaker_volume,
++ .chained = true,
++ .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+ },
+ };
+
+@@ -5821,6 +5823,10 @@ static const struct snd_hda_pin_quirk al
+ {0x1b, 0x01014020},
+ {0x21, 0x0221103f}),
+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ {0x14, 0x90170130},
++ {0x1b, 0x02011020},
++ {0x21, 0x0221103f}),
++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ {0x14, 0x90170150},
+ {0x1b, 0x02011020},
+ {0x21, 0x0221105f}),
--- /dev/null
+From 33baefe5e72f17a6df378e48196cd8cada11deec Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 3 Aug 2016 15:13:00 +0200
+Subject: ALSA: hda: Fix krealloc() with __GFP_ZERO usage
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 33baefe5e72f17a6df378e48196cd8cada11deec upstream.
+
+krealloc() doesn't work always properly with __GFP_ZERO flag as
+expected. For clearing the reallocated area, we need to clear
+explicitly instead.
+
+Reported-by: Joe Perches <joe@perches.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/hda/array.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/hda/array.c
++++ b/sound/hda/array.c
+@@ -21,13 +21,15 @@ void *snd_array_new(struct snd_array *ar
+ return NULL;
+ if (array->used >= array->alloced) {
+ int num = array->alloced + array->alloc_align;
++ int oldsize = array->alloced * array->elem_size;
+ int size = (num + 1) * array->elem_size;
+ void *nlist;
+ if (snd_BUG_ON(num >= 4096))
+ return NULL;
+- nlist = krealloc(array->list, size, GFP_KERNEL | __GFP_ZERO);
++ nlist = krealloc(array->list, size, GFP_KERNEL);
+ if (!nlist)
+ return NULL;
++ memset(nlist + oldsize, 0, size - oldsize);
+ array->list = nlist;
+ array->alloced = num;
+ }
--- /dev/null
+From dd9aa335c88003d131ac874e7f6809902de0b847 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 1 Aug 2016 10:20:32 +0800
+Subject: ALSA: hda/realtek - Can't adjust speaker's volume on a Dell AIO
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit dd9aa335c88003d131ac874e7f6809902de0b847 upstream.
+
+We have a Dell AIO on which we can't adjust its speaker's volume.
+The problem is it is connected to a Audio Output node without Amp-out
+capability. To fix it, we change it to be connnected to a node with
+Amp-out capability.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4674,6 +4674,22 @@ static void alc290_fixup_mono_speakers(s
+ }
+ }
+
++static void alc298_fixup_speaker_volume(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ /* The speaker is routed to the Node 0x06 by a mistake, as a result
++ we can't adjust the speaker's volume since this node does not has
++ Amp-out capability. we change the speaker's route to:
++ Node 0x02 (Audio Output) -> Node 0x0c (Audio Mixer) -> Node 0x17 (
++ Pin Complex), since Node 0x02 has Amp-out caps, we can adjust
++ speaker's volume now. */
++
++ hda_nid_t conn1[1] = { 0x0c };
++ snd_hda_override_conn_list(codec, 0x17, 1, conn1);
++ }
++}
++
+ /* Hook to update amp GPIO4 for automute */
+ static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
+ struct hda_jack_callback *jack)
+@@ -4823,6 +4839,7 @@ enum {
+ ALC280_FIXUP_HP_HEADSET_MIC,
+ ALC221_FIXUP_HP_FRONT_MIC,
+ ALC292_FIXUP_TPT460,
++ ALC298_FIXUP_SPK_VOLUME,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -5478,6 +5495,10 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE,
+ },
++ [ALC298_FIXUP_SPK_VOLUME] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc298_fixup_speaker_volume,
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -5524,6 +5545,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
++ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
--- /dev/null
+From 37cf99e08c6fb4dcea0f9ad2b13b6daa8c76a711 Mon Sep 17 00:00:00 2001
+From: Konstantin Neumoin <kneumoin@virtuozzo.com>
+Date: Mon, 11 Jul 2016 15:28:59 +0300
+Subject: balloon: check the number of available pages in leak balloon
+
+From: Konstantin Neumoin <kneumoin@virtuozzo.com>
+
+commit 37cf99e08c6fb4dcea0f9ad2b13b6daa8c76a711 upstream.
+
+The balloon has a special mechanism that is subscribed to the oom
+notification which leads to deflation for a fixed number of pages.
+The number is always fixed even when the balloon is fully deflated.
+But leak_balloon did not expect that the pages to deflate will be more
+than taken, and raise a "BUG" in balloon_page_dequeue when page list
+will be empty.
+
+So, the simplest solution would be to check that the number of releases
+pages is less or equal to the number taken pages.
+
+Signed-off-by: Konstantin Neumoin <kneumoin@virtuozzo.com>
+Signed-off-by: Denis V. Lunev <den@openvz.org>
+CC: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/virtio/virtio_balloon.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -196,6 +196,8 @@ static unsigned leak_balloon(struct virt
+ num = min(num, ARRAY_SIZE(vb->pfns));
+
+ mutex_lock(&vb->balloon_lock);
++ /* We can't release more pages than taken */
++ num = min(num, (size_t)vb->num_pages);
+ for (vb->num_pfns = 0; vb->num_pfns < num;
+ vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE) {
+ page = balloon_page_dequeue(vb_dev_info);
--- /dev/null
+From 20bd723ec6a3261df5e02250cd3a1fbb09a343f2 Mon Sep 17 00:00:00 2001
+From: Paolo Valente <paolo.valente@linaro.org>
+Date: Wed, 27 Jul 2016 07:22:05 +0200
+Subject: block: add missing group association in bio-cloning functions
+
+From: Paolo Valente <paolo.valente@linaro.org>
+
+commit 20bd723ec6a3261df5e02250cd3a1fbb09a343f2 upstream.
+
+When a bio is cloned, the newly created bio must be associated with
+the same blkcg as the original bio (if BLK_CGROUP is enabled). If
+this operation is not performed, then the new bio is not associated
+with any group, and the group of the current task is returned when
+the group of the bio is requested.
+
+Depending on the cloning frequency, this may cause a large
+percentage of the bios belonging to a given group to be treated
+as if belonging to other groups (in most cases as if belonging to
+the root group). The expected group isolation may thereby be broken.
+
+This commit adds the missing association in bio-cloning functions.
+
+Fixes: da2f0f74cf7d ("Btrfs: add support for blkio controllers")
+
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Reviewed-by: Nikolay Borisov <kernel@kyup.com>
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/bio.c | 15 +++++++++++++++
+ fs/btrfs/extent_io.c | 6 ------
+ include/linux/bio.h | 3 +++
+ 3 files changed, 18 insertions(+), 6 deletions(-)
+
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -584,6 +584,8 @@ void __bio_clone_fast(struct bio *bio, s
+ bio->bi_rw = bio_src->bi_rw;
+ bio->bi_iter = bio_src->bi_iter;
+ bio->bi_io_vec = bio_src->bi_io_vec;
++
++ bio_clone_blkcg_association(bio, bio_src);
+ }
+ EXPORT_SYMBOL(__bio_clone_fast);
+
+@@ -689,6 +691,8 @@ integrity_clone:
+ }
+ }
+
++ bio_clone_blkcg_association(bio, bio_src);
++
+ return bio;
+ }
+ EXPORT_SYMBOL(bio_clone_bioset);
+@@ -2014,6 +2018,17 @@ void bio_disassociate_task(struct bio *b
+ }
+ }
+
++/**
++ * bio_clone_blkcg_association - clone blkcg association from src to dst bio
++ * @dst: destination bio
++ * @src: source bio
++ */
++void bio_clone_blkcg_association(struct bio *dst, struct bio *src)
++{
++ if (src->bi_css)
++ WARN_ON(bio_associate_blkcg(dst, src->bi_css));
++}
++
+ #endif /* CONFIG_BLK_CGROUP */
+
+ static void __init biovec_init_slabs(void)
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -2786,12 +2786,6 @@ struct bio *btrfs_bio_clone(struct bio *
+ btrfs_bio->csum = NULL;
+ btrfs_bio->csum_allocated = NULL;
+ btrfs_bio->end_io = NULL;
+-
+-#ifdef CONFIG_BLK_CGROUP
+- /* FIXME, put this into bio_clone_bioset */
+- if (bio->bi_css)
+- bio_associate_blkcg(new, bio->bi_css);
+-#endif
+ }
+ return new;
+ }
+--- a/include/linux/bio.h
++++ b/include/linux/bio.h
+@@ -527,11 +527,14 @@ extern unsigned int bvec_nr_vecs(unsigne
+ int bio_associate_blkcg(struct bio *bio, struct cgroup_subsys_state *blkcg_css);
+ int bio_associate_current(struct bio *bio);
+ void bio_disassociate_task(struct bio *bio);
++void bio_clone_blkcg_association(struct bio *dst, struct bio *src);
+ #else /* CONFIG_BLK_CGROUP */
+ static inline int bio_associate_blkcg(struct bio *bio,
+ struct cgroup_subsys_state *blkcg_css) { return 0; }
+ static inline int bio_associate_current(struct bio *bio) { return -ENOENT; }
+ static inline void bio_disassociate_task(struct bio *bio) { }
++static inline void bio_clone_blkcg_association(struct bio *dst,
++ struct bio *src) { }
+ #endif /* CONFIG_BLK_CGROUP */
+
+ #ifdef CONFIG_HIGHMEM
--- /dev/null
+From df08c32ce3be5be138c1dbfcba203314a3a7cd6f Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Sun, 31 Jul 2016 11:15:13 -0700
+Subject: block: fix bdi vs gendisk lifetime mismatch
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit df08c32ce3be5be138c1dbfcba203314a3a7cd6f upstream.
+
+The name for a bdi of a gendisk is derived from the gendisk's devt.
+However, since the gendisk is destroyed before the bdi it leaves a
+window where a new gendisk could dynamically reuse the same devt while a
+bdi with the same name is still live. Arrange for the bdi to hold a
+reference against its "owner" disk device while it is registered.
+Otherwise we can hit sysfs duplicate name collisions like the following:
+
+ WARNING: CPU: 10 PID: 2078 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x64/0x80
+ sysfs: cannot create duplicate filename '/devices/virtual/bdi/259:1'
+
+ Hardware name: HP ProLiant DL580 Gen8, BIOS P79 05/06/2015
+ 0000000000000286 0000000002c04ad5 ffff88006f24f970 ffffffff8134caec
+ ffff88006f24f9c0 0000000000000000 ffff88006f24f9b0 ffffffff8108c351
+ 0000001f0000000c ffff88105d236000 ffff88105d1031e0 ffff8800357427f8
+ Call Trace:
+ [<ffffffff8134caec>] dump_stack+0x63/0x87
+ [<ffffffff8108c351>] __warn+0xd1/0xf0
+ [<ffffffff8108c3cf>] warn_slowpath_fmt+0x5f/0x80
+ [<ffffffff812a0d34>] sysfs_warn_dup+0x64/0x80
+ [<ffffffff812a0e1e>] sysfs_create_dir_ns+0x7e/0x90
+ [<ffffffff8134faaa>] kobject_add_internal+0xaa/0x320
+ [<ffffffff81358d4e>] ? vsnprintf+0x34e/0x4d0
+ [<ffffffff8134ff55>] kobject_add+0x75/0xd0
+ [<ffffffff816e66b2>] ? mutex_lock+0x12/0x2f
+ [<ffffffff8148b0a5>] device_add+0x125/0x610
+ [<ffffffff8148b788>] device_create_groups_vargs+0xd8/0x100
+ [<ffffffff8148b7cc>] device_create_vargs+0x1c/0x20
+ [<ffffffff811b775c>] bdi_register+0x8c/0x180
+ [<ffffffff811b7877>] bdi_register_dev+0x27/0x30
+ [<ffffffff813317f5>] add_disk+0x175/0x4a0
+
+Reported-by: Yi Zhang <yizhan@redhat.com>
+Tested-by: Yi Zhang <yizhan@redhat.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+Fixed up missing 0 return in bdi_register_owner().
+
+Signed-off-by: Jens Axboe <axboe@fb.com>
+
+---
+ block/genhd.c | 2 +-
+ include/linux/backing-dev-defs.h | 1 +
+ include/linux/backing-dev.h | 1 +
+ mm/backing-dev.c | 19 +++++++++++++++++++
+ 4 files changed, 22 insertions(+), 1 deletion(-)
+
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -612,7 +612,7 @@ void add_disk(struct gendisk *disk)
+
+ /* Register BDI before referencing it from bdev */
+ bdi = &disk->queue->backing_dev_info;
+- bdi_register_dev(bdi, disk_devt(disk));
++ bdi_register_owner(bdi, disk_to_dev(disk));
+
+ blk_register_region(disk_devt(disk), disk->minors, NULL,
+ exact_match, exact_lock, disk);
+--- a/include/linux/backing-dev-defs.h
++++ b/include/linux/backing-dev-defs.h
+@@ -163,6 +163,7 @@ struct backing_dev_info {
+ wait_queue_head_t wb_waitq;
+
+ struct device *dev;
++ struct device *owner;
+
+ struct timer_list laptop_mode_wb_timer;
+
+--- a/include/linux/backing-dev.h
++++ b/include/linux/backing-dev.h
+@@ -24,6 +24,7 @@ __printf(3, 4)
+ int bdi_register(struct backing_dev_info *bdi, struct device *parent,
+ const char *fmt, ...);
+ int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev);
++int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner);
+ void bdi_unregister(struct backing_dev_info *bdi);
+
+ int __must_check bdi_setup_and_register(struct backing_dev_info *, char *);
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -825,6 +825,20 @@ int bdi_register_dev(struct backing_dev_
+ }
+ EXPORT_SYMBOL(bdi_register_dev);
+
++int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner)
++{
++ int rc;
++
++ rc = bdi_register(bdi, NULL, "%u:%u", MAJOR(owner->devt),
++ MINOR(owner->devt));
++ if (rc)
++ return rc;
++ bdi->owner = owner;
++ get_device(owner);
++ return 0;
++}
++EXPORT_SYMBOL(bdi_register_owner);
++
+ /*
+ * Remove bdi from bdi_list, and ensure that it is no longer visible
+ */
+@@ -849,6 +863,11 @@ void bdi_unregister(struct backing_dev_i
+ device_unregister(bdi->dev);
+ bdi->dev = NULL;
+ }
++
++ if (bdi->owner) {
++ put_device(bdi->owner);
++ bdi->owner = NULL;
++ }
+ }
+
+ void bdi_exit(struct backing_dev_info *bdi)
--- /dev/null
+From b2e1c26f0b62531636509fbcb6dab65617ed8331 Mon Sep 17 00:00:00 2001
+From: Laura Abbott <labbott@redhat.com>
+Date: Fri, 8 Jul 2016 12:18:50 -0700
+Subject: ftrace/recordmcount: Work around for addition of metag magic but not relocations
+
+From: Laura Abbott <labbott@redhat.com>
+
+commit b2e1c26f0b62531636509fbcb6dab65617ed8331 upstream.
+
+glibc recently did a sync up (94e73c95d9b5 "elf.h: Sync with the gabi
+webpage") that added a #define for EM_METAG but did not add relocations
+
+This triggers build errors:
+
+scripts/recordmcount.c: In function 'do_file':
+scripts/recordmcount.c:466:28: error: 'R_METAG_ADDR32' undeclared (first use in this function)
+ case EM_METAG: reltype = R_METAG_ADDR32;
+ ^~~~~~~~~~~~~~
+scripts/recordmcount.c:466:28: note: each undeclared identifier is reported only once for each function it appears in
+scripts/recordmcount.c:468:20: error: 'R_METAG_NONE' undeclared (first use in this function)
+ rel_type_nop = R_METAG_NONE;
+ ^~~~~~~~~~~~
+
+Work around this change with some more #ifdefery for the relocations.
+
+Fedora Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1354034
+
+Link: http://lkml.kernel.org/r/1468005530-14757-1-git-send-email-labbott@redhat.com
+
+Cc: James Hogan <james.hogan@imgtec.com>
+Fixes: 00512bdd4573 ("metag: ftrace support")
+Reported-by: Ross Burton <ross.burton@intel.com>
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/recordmcount.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/scripts/recordmcount.c
++++ b/scripts/recordmcount.c
+@@ -33,10 +33,17 @@
+ #include <string.h>
+ #include <unistd.h>
+
++/*
++ * glibc synced up and added the metag number but didn't add the relocations.
++ * Work around this in a crude manner for now.
++ */
+ #ifndef EM_METAG
+-/* Remove this when these make it to the standard system elf.h. */
+ #define EM_METAG 174
++#endif
++#ifndef R_METAG_ADDR32
+ #define R_METAG_ADDR32 2
++#endif
++#ifndef R_METAG_NONE
+ #define R_METAG_NONE 3
+ #endif
+
--- /dev/null
+From 61c78eea9516a921799c17b4c20558e2aa780fd3 Mon Sep 17 00:00:00 2001
+From: Erez Shitrit <erezsh@mellanox.com>
+Date: Sat, 4 Jun 2016 15:15:19 +0300
+Subject: IB/IPoIB: Don't update neigh validity for unresolved entries
+
+From: Erez Shitrit <erezsh@mellanox.com>
+
+commit 61c78eea9516a921799c17b4c20558e2aa780fd3 upstream.
+
+ipoib_neigh_get unconditionally updates the "alive" variable member on
+any packet send. This prevents the neighbor garbage collection from
+cleaning out a dead neighbor entry if we are still queueing packets
+for it. If the queue for this neighbor is full, then don't update the
+alive timestamp. That way the neighbor can time out even if packets
+are still being queued as long as none of them are being sent.
+
+Fixes: b63b70d87741 ("IPoIB: Use a private hash table for path lookup in xmit path")
+Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1131,7 +1131,9 @@ struct ipoib_neigh *ipoib_neigh_get(stru
+ neigh = NULL;
+ goto out_unlock;
+ }
+- neigh->alive = jiffies;
++
++ if (likely(skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE))
++ neigh->alive = jiffies;
+ goto out_unlock;
+ }
+ }
--- /dev/null
+From 5ed935e861a4cbf2158ad3386d6d26edd60d2658 Mon Sep 17 00:00:00 2001
+From: Mark Bloch <markb@mellanox.com>
+Date: Fri, 6 May 2016 22:45:24 +0300
+Subject: IB/IWPM: Fix a potential skb leak
+
+From: Mark Bloch <markb@mellanox.com>
+
+commit 5ed935e861a4cbf2158ad3386d6d26edd60d2658 upstream.
+
+In case ibnl_put_msg fails in send_nlmsg_done,
+the function returns with -ENOMEM without freeing.
+
+This patch fixes this behavior.
+
+Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service")
+Signed-off-by: Mark Bloch <markb@mellanox.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Reviewed-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/iwpm_util.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/infiniband/core/iwpm_util.c
++++ b/drivers/infiniband/core/iwpm_util.c
+@@ -634,6 +634,7 @@ static int send_nlmsg_done(struct sk_buf
+ if (!(ibnl_put_msg(skb, &nlh, 0, 0, nl_client,
+ RDMA_NL_IWPM_MAPINFO, NLM_F_MULTI))) {
+ pr_warn("%s Unable to put NLMSG_DONE\n", __func__);
++ dev_kfree_skb(skb);
+ return -ENOMEM;
+ }
+ nlh->nlmsg_type = NLMSG_DONE;
--- /dev/null
+From a6100603a4a87fc436199362bdb81cb849faaf6e Mon Sep 17 00:00:00 2001
+From: Yishai Hadas <yishaih@mellanox.com>
+Date: Wed, 22 Jun 2016 17:27:29 +0300
+Subject: IB/mlx4: Fix error flow when sending mads under SRIOV
+
+From: Yishai Hadas <yishaih@mellanox.com>
+
+commit a6100603a4a87fc436199362bdb81cb849faaf6e upstream.
+
+Fix mad send error flow to prevent double freeing address handles,
+and leaking tx_ring entries when SRIOV is active.
+
+If ib_mad_post_send fails, the address handle pointer in the tx_ring entry
+must be set to NULL (or there will be a double-free) and tx_tail must be
+incremented (or there will be a leak of tx_ring entries).
+The tx_ring is handled the same way in the send-completion handler.
+
+Fixes: 37bfc7c1e83f ("IB/mlx4: SR-IOV multiplex and demultiplex MADs")
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Reviewed-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx4/mad.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx4/mad.c
++++ b/drivers/infiniband/hw/mlx4/mad.c
+@@ -526,7 +526,7 @@ int mlx4_ib_send_to_slave(struct mlx4_ib
+ tun_tx_ix = (++tun_qp->tx_ix_head) & (MLX4_NUM_TUNNEL_BUFS - 1);
+ spin_unlock(&tun_qp->tx_lock);
+ if (ret)
+- goto out;
++ goto end;
+
+ tun_mad = (struct mlx4_rcv_tunnel_mad *) (tun_qp->tx_ring[tun_tx_ix].buf.addr);
+ if (tun_qp->tx_ring[tun_tx_ix].ah)
+@@ -595,9 +595,15 @@ int mlx4_ib_send_to_slave(struct mlx4_ib
+ wr.wr.send_flags = IB_SEND_SIGNALED;
+
+ ret = ib_post_send(src_qp, &wr.wr, &bad_wr);
+-out:
+- if (ret)
+- ib_destroy_ah(ah);
++ if (!ret)
++ return 0;
++ out:
++ spin_lock(&tun_qp->tx_lock);
++ tun_qp->tx_ix_tail++;
++ spin_unlock(&tun_qp->tx_lock);
++ tun_qp->tx_ring[tun_tx_ix].ah = NULL;
++end:
++ ib_destroy_ah(ah);
+ return ret;
+ }
+
+@@ -1278,9 +1284,15 @@ int mlx4_ib_send_to_wire(struct mlx4_ib_
+
+
+ ret = ib_post_send(send_qp, &wr.wr, &bad_wr);
++ if (!ret)
++ return 0;
++
++ spin_lock(&sqp->tx_lock);
++ sqp->tx_ix_tail++;
++ spin_unlock(&sqp->tx_lock);
++ sqp->tx_ring[wire_tx_ix].ah = NULL;
+ out:
+- if (ret)
+- ib_destroy_ah(ah);
++ ib_destroy_ah(ah);
+ return ret;
+ }
+
--- /dev/null
+From 5b420d9cf7382c6e1512e96e02d18842d272049c Mon Sep 17 00:00:00 2001
+From: Dotan Barak <dotanb@dev.mellanox.co.il>
+Date: Wed, 22 Jun 2016 17:27:31 +0300
+Subject: IB/mlx4: Fix memory leak if QP creation failed
+
+From: Dotan Barak <dotanb@dev.mellanox.co.il>
+
+commit 5b420d9cf7382c6e1512e96e02d18842d272049c upstream.
+
+When RC, UC, or RAW QPs are created, a qp object is allocated (kzalloc).
+If at a later point (in procedure create_qp_common) the qp creation fails,
+this qp object must be freed.
+
+Fixes: 1ffeb2eb8be99 ("IB/mlx4: SR-IOV IB context objects and proxy/tunnel SQP support")
+Signed-off-by: Dotan Barak <dotanb@dev.mellanox.co.il>
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx4/qp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -1162,8 +1162,10 @@ struct ib_qp *mlx4_ib_create_qp(struct i
+ {
+ err = create_qp_common(to_mdev(pd->device), pd, init_attr,
+ udata, 0, &qp, gfp);
+- if (err)
++ if (err) {
++ kfree(qp);
+ return ERR_PTR(err);
++ }
+
+ qp->ibqp.qp_num = qp->mqp.qpn;
+ qp->xrcdn = xrcdn;
--- /dev/null
+From f2940e2c76bb554a7fbdd28ca5b90904117a9e96 Mon Sep 17 00:00:00 2001
+From: Yishai Hadas <yishaih@mellanox.com>
+Date: Wed, 22 Jun 2016 17:27:28 +0300
+Subject: IB/mlx4: Fix the SQ size of an RC QP
+
+From: Yishai Hadas <yishaih@mellanox.com>
+
+commit f2940e2c76bb554a7fbdd28ca5b90904117a9e96 upstream.
+
+When calculating the required size of an RC QP send queue, leave
+enough space for masked atomic operations, which require more space than
+"regular" atomic operation.
+
+Fixes: 6fa8f719844b ("IB/mlx4: Add support for masked atomic operations")
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Reviewed-by: Jack Morgenstein <jackm@mellanox.co.il>
+Reviewed-by: Eran Ben Elisha <eranbe@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx4/qp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -357,7 +357,7 @@ static int send_wqe_overhead(enum mlx4_i
+ sizeof (struct mlx4_wqe_raddr_seg);
+ case MLX4_IB_QPT_RC:
+ return sizeof (struct mlx4_wqe_ctrl_seg) +
+- sizeof (struct mlx4_wqe_atomic_seg) +
++ sizeof (struct mlx4_wqe_masked_atomic_seg) +
+ sizeof (struct mlx4_wqe_raddr_seg);
+ case MLX4_IB_QPT_SMI:
+ case MLX4_IB_QPT_GSI:
--- /dev/null
+From 2cc6ad5f2130733e561f97dba7a2052f8ea024aa Mon Sep 17 00:00:00 2001
+From: Noa Osherovich <noaos@mellanox.com>
+Date: Sat, 4 Jun 2016 15:15:33 +0300
+Subject: IB/mlx5: Check BlueFlame HCA support
+
+From: Noa Osherovich <noaos@mellanox.com>
+
+commit 2cc6ad5f2130733e561f97dba7a2052f8ea024aa upstream.
+
+BlueFlame support is reported only for PFs when the HCA capability is
+on.
+
+Fixes: 938fe83c8dcbb ('net/mlx5_core: New device capabilities...')
+Signed-off-by: Majd Dibbiny <majd@mellanox.com>
+Signed-off-by: Noa Osherovich <noaos@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -626,7 +626,8 @@ static struct ib_ucontext *mlx5_ib_alloc
+ num_uars = req.total_num_uuars / MLX5_NON_FP_BF_REGS_PER_PAGE;
+ gross_uuars = num_uars * MLX5_BF_REGS_PER_PAGE;
+ resp.qp_tab_size = 1 << MLX5_CAP_GEN(dev->mdev, log_max_qp);
+- resp.bf_reg_size = 1 << MLX5_CAP_GEN(dev->mdev, log_bf_reg_size);
++ if (mlx5_core_is_pf(dev->mdev) && MLX5_CAP_GEN(dev->mdev, bf))
++ resp.bf_reg_size = 1 << MLX5_CAP_GEN(dev->mdev, log_bf_reg_size);
+ resp.cache_line_size = L1_CACHE_BYTES;
+ resp.max_sq_desc_sz = MLX5_CAP_GEN(dev->mdev, max_wqe_sz_sq);
+ resp.max_rq_desc_sz = MLX5_CAP_GEN(dev->mdev, max_wqe_sz_rq);
--- /dev/null
+From 3c4c37746c919c983e439ac6a7328cd2d48c10ed Mon Sep 17 00:00:00 2001
+From: Noa Osherovich <noaos@mellanox.com>
+Date: Sat, 4 Jun 2016 15:15:35 +0300
+Subject: IB/mlx5: Fix entries check in mlx5_ib_resize_cq
+
+From: Noa Osherovich <noaos@mellanox.com>
+
+commit 3c4c37746c919c983e439ac6a7328cd2d48c10ed upstream.
+
+Verify that number of entries is less than device capability.
+Add an appropriate warning message for error flow.
+
+Fixes: bde51583f49b ('IB/mlx5: Add support for resize CQ')
+Signed-off-by: Majd Dibbiny <majd@mellanox.com>
+Signed-off-by: Noa Osherovich <noaos@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/cq.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/cq.c
++++ b/drivers/infiniband/hw/mlx5/cq.c
+@@ -1095,11 +1095,16 @@ int mlx5_ib_resize_cq(struct ib_cq *ibcq
+ return -ENOSYS;
+ }
+
+- if (entries < 1)
++ if (entries < 1 ||
++ entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz))) {
++ mlx5_ib_warn(dev, "wrong entries number %d, max %d\n",
++ entries,
++ 1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz));
+ return -EINVAL;
++ }
+
+ entries = roundup_pow_of_two(entries + 1);
+- if (entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz)) + 1)
++ if (entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz)) + 1)
+ return -EINVAL;
+
+ if (entries == ibcq->cqe + 1)
--- /dev/null
+From 9ea578528656e191c1097798a771ff08bab6f323 Mon Sep 17 00:00:00 2001
+From: Noa Osherovich <noaos@mellanox.com>
+Date: Sat, 4 Jun 2016 15:15:34 +0300
+Subject: IB/mlx5: Fix entries checks in mlx5_ib_create_cq
+
+From: Noa Osherovich <noaos@mellanox.com>
+
+commit 9ea578528656e191c1097798a771ff08bab6f323 upstream.
+
+Number of entries shouldn't be greater than the device's max
+capability. This should be checked before rounding the entries number
+to power of two.
+
+Fixes: 51ee86a4af639 ('IB/mlx5: Fix check of number of entries...')
+Signed-off-by: Majd Dibbiny <majd@mellanox.com>
+Signed-off-by: Noa Osherovich <noaos@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/cq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx5/cq.c
++++ b/drivers/infiniband/hw/mlx5/cq.c
+@@ -763,7 +763,8 @@ struct ib_cq *mlx5_ib_create_cq(struct i
+ if (attr->flags)
+ return ERR_PTR(-EINVAL);
+
+- if (entries < 0)
++ if (entries < 0 ||
++ (entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz))))
+ return ERR_PTR(-EINVAL);
+
+ entries = roundup_pow_of_two(entries + 1);
--- /dev/null
+From e3353c268b06236d6c40fa1714c114f21f44451c Mon Sep 17 00:00:00 2001
+From: Artemy Kovalyov <artemyko@mellanox.com>
+Date: Fri, 17 Jun 2016 15:33:31 +0300
+Subject: IB/mlx5: Fix MODIFY_QP command input structure
+
+From: Artemy Kovalyov <artemyko@mellanox.com>
+
+commit e3353c268b06236d6c40fa1714c114f21f44451c upstream.
+
+Make MODIFY_QP command input structure compliant to specification
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
+Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/mlx5/qp.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/mlx5/qp.h
++++ b/include/linux/mlx5/qp.h
+@@ -534,9 +534,9 @@ struct mlx5_destroy_qp_mbox_out {
+ struct mlx5_modify_qp_mbox_in {
+ struct mlx5_inbox_hdr hdr;
+ __be32 qpn;
+- u8 rsvd1[4];
+- __be32 optparam;
+ u8 rsvd0[4];
++ __be32 optparam;
++ u8 rsvd1[4];
+ struct mlx5_qp_context ctx;
+ };
+
--- /dev/null
+From c9b254955b9f8814966f5dabd34c39d0e0a2b437 Mon Sep 17 00:00:00 2001
+From: Eli Cohen <eli@mellanox.com>
+Date: Wed, 22 Jun 2016 17:27:26 +0300
+Subject: IB/mlx5: Fix post send fence logic
+
+From: Eli Cohen <eli@mellanox.com>
+
+commit c9b254955b9f8814966f5dabd34c39d0e0a2b437 upstream.
+
+If the caller specified IB_SEND_FENCE in the send flags of the work
+request and no previous work request stated that the successive one
+should be fenced, the work request would be executed without a fence.
+This could result in RDMA read or atomic operations failure due to a MR
+being invalidated. Fix this by adding the mlx5 enumeration for fencing
+RDMA/atomic operations and fix the logic to apply this.
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
+Signed-off-by: Eli Cohen <eli@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/qp.c | 7 ++++---
+ include/linux/mlx5/qp.h | 1 +
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -2527,10 +2527,11 @@ static u8 get_fence(u8 fence, struct ib_
+ return MLX5_FENCE_MODE_SMALL_AND_FENCE;
+ else
+ return fence;
+-
+- } else {
+- return 0;
++ } else if (unlikely(wr->send_flags & IB_SEND_FENCE)) {
++ return MLX5_FENCE_MODE_FENCE;
+ }
++
++ return 0;
+ }
+
+ static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
+--- a/include/linux/mlx5/qp.h
++++ b/include/linux/mlx5/qp.h
+@@ -160,6 +160,7 @@ enum {
+ enum {
+ MLX5_FENCE_MODE_NONE = 0 << 5,
+ MLX5_FENCE_MODE_INITIATOR_SMALL = 1 << 5,
++ MLX5_FENCE_MODE_FENCE = 2 << 5,
+ MLX5_FENCE_MODE_STRONG_ORDERING = 3 << 5,
+ MLX5_FENCE_MODE_SMALL_AND_FENCE = 4 << 5,
+ };
--- /dev/null
+From 0540d8148d419bf769e5aa99c77027febd8922f0 Mon Sep 17 00:00:00 2001
+From: Noa Osherovich <noaos@mellanox.com>
+Date: Sat, 4 Jun 2016 15:15:32 +0300
+Subject: IB/mlx5: Fix returned values of query QP
+
+From: Noa Osherovich <noaos@mellanox.com>
+
+commit 0540d8148d419bf769e5aa99c77027febd8922f0 upstream.
+
+Some variables were not initialized properly: max_recv_wr,
+max_recv_sge, max_send_wr, qp_context and max_inline_data.
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB...')
+Signed-off-by: Noa Osherovich <noaos@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/qp.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -226,6 +226,8 @@ static int set_rq_size(struct mlx5_ib_de
+ qp->rq.max_gs = 0;
+ qp->rq.wqe_cnt = 0;
+ qp->rq.wqe_shift = 0;
++ cap->max_recv_wr = 0;
++ cap->max_recv_sge = 0;
+ } else {
+ if (ucmd) {
+ qp->rq.wqe_cnt = ucmd->rq_wqe_count;
+@@ -3092,17 +3094,19 @@ int mlx5_ib_query_qp(struct ib_qp *ibqp,
+ qp_attr->cap.max_recv_sge = qp->rq.max_gs;
+
+ if (!ibqp->uobject) {
+- qp_attr->cap.max_send_wr = qp->sq.wqe_cnt;
++ qp_attr->cap.max_send_wr = qp->sq.max_post;
+ qp_attr->cap.max_send_sge = qp->sq.max_gs;
++ qp_init_attr->qp_context = ibqp->qp_context;
+ } else {
+ qp_attr->cap.max_send_wr = 0;
+ qp_attr->cap.max_send_sge = 0;
+ }
+
+- /* We don't support inline sends for kernel QPs (yet), and we
+- * don't know what userspace's value should be.
+- */
+- qp_attr->cap.max_inline_data = 0;
++ qp_init_attr->qp_type = ibqp->qp_type;
++ qp_init_attr->recv_cq = ibqp->recv_cq;
++ qp_init_attr->send_cq = ibqp->send_cq;
++ qp_init_attr->srq = ibqp->srq;
++ qp_attr->cap.max_inline_data = qp->max_inline_data;
+
+ qp_init_attr->cap = qp_attr->cap;
+
--- /dev/null
+From 2788cf3bd90af3791c3195c52391bcf34fa67b40 Mon Sep 17 00:00:00 2001
+From: Noa Osherovich <noaos@mellanox.com>
+Date: Sat, 4 Jun 2016 15:15:29 +0300
+Subject: IB/mlx5: Return PORT_ERR in Active to Initializing tranisition
+
+From: Noa Osherovich <noaos@mellanox.com>
+
+commit 2788cf3bd90af3791c3195c52391bcf34fa67b40 upstream.
+
+FW port-change events are fired on Active <-> non Active port state
+transitions only.
+When the port state changes from Active to Initializing (Active ->
+Down -> Initializing), a single event is fired.
+The HCA transitions from Down to Initializing unless prevented from
+doing so, hence the driver should also propagate events when the port
+state is Initializing to consumers so they'll be aware that the port
+is no longer Active and act accordingly.
+
+Fixes: e126ba97dba9e ('mlx5: Add driver for Mellanox Connect-IB...')
+Signed-off-by: Noa Osherovich <noaos@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/main.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -962,14 +962,11 @@ static void mlx5_ib_event(struct mlx5_co
+ break;
+
+ case MLX5_DEV_EVENT_PORT_DOWN:
++ case MLX5_DEV_EVENT_PORT_INITIALIZED:
+ ibev.event = IB_EVENT_PORT_ERR;
+ port = (u8)param;
+ break;
+
+- case MLX5_DEV_EVENT_PORT_INITIALIZED:
+- /* not used by ULPs */
+- return;
+-
+ case MLX5_DEV_EVENT_LID_CHANGE:
+ ibev.event = IB_EVENT_LID_CHANGE;
+ port = (u8)param;
--- /dev/null
+From 0f377d86252d11bfea941852785e3094b93601a7 Mon Sep 17 00:00:00 2001
+From: Mark Bloch <markb@mellanox.com>
+Date: Fri, 6 May 2016 22:45:27 +0300
+Subject: IB/SA: Use correct free function
+
+From: Mark Bloch <markb@mellanox.com>
+
+commit 0f377d86252d11bfea941852785e3094b93601a7 upstream.
+
+Fixes a direct call to kfree_skb when nlmsg_free should be used.
+
+Fixes: 2ca546b92a02 ('IB/sa: Route SA pathrecord query through netlink')
+Signed-off-by: Mark Bloch <markb@mellanox.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Reviewed-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/sa_query.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/sa_query.c
++++ b/drivers/infiniband/core/sa_query.c
+@@ -534,7 +534,7 @@ static int ib_nl_send_msg(struct ib_sa_q
+ data = ibnl_put_msg(skb, &nlh, query->seq, 0, RDMA_NL_LS,
+ RDMA_NL_LS_OP_RESOLVE, NLM_F_REQUEST);
+ if (!data) {
+- kfree_skb(skb);
++ nlmsg_free(skb);
+ return -EMSGSIZE;
+ }
+
--- /dev/null
+From 6154c187b97ee7513046bb4eb317a89f738f13ef Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Thu, 4 Aug 2016 17:36:08 +0100
+Subject: metag: Fix __cmpxchg_u32 asm constraint for CMP
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 6154c187b97ee7513046bb4eb317a89f738f13ef upstream.
+
+The LNKGET based atomic sequence in __cmpxchg_u32 has slightly incorrect
+constraints for the return value which under certain circumstances can
+allow an address unit register to be used as the first operand of a CMP
+instruction. This isn't a valid instruction however as the encodings
+only allow a data unit to be specified. This would result in an
+assembler error like the following:
+
+ Error: failed to assemble instruction: "CMP A0.2,D0Ar6"
+
+Fix by changing the constraint from "=&da" (assigned, early clobbered,
+data or address unit register) to "=&d" (data unit register only).
+
+The constraint for the second operand, "bd" (an op2 register where op1
+is a data unit register and the instruction supports O2R) is already
+correct assuming the first operand is a data unit register.
+
+Other cases of CMP in inline asm have had their constraints checked, and
+appear to all be fine.
+
+Fixes: 6006c0d8ce94 ("metag: Atomics, locks and bitops")
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: linux-metag@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/metag/include/asm/cmpxchg_lnkget.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/metag/include/asm/cmpxchg_lnkget.h
++++ b/arch/metag/include/asm/cmpxchg_lnkget.h
+@@ -73,7 +73,7 @@ static inline unsigned long __cmpxchg_u3
+ " DCACHE [%2], %0\n"
+ #endif
+ "2:\n"
+- : "=&d" (temp), "=&da" (retval)
++ : "=&d" (temp), "=&d" (retval)
+ : "da" (m), "bd" (old), "da" (new)
+ : "cc"
+ );
--- /dev/null
+From 649920c6ab93429b94bc7c1aa7c0e8395351be32 Mon Sep 17 00:00:00 2001
+From: Jia He <hejianet@gmail.com>
+Date: Tue, 2 Aug 2016 14:02:31 -0700
+Subject: mm/hugetlb: avoid soft lockup in set_max_huge_pages()
+
+From: Jia He <hejianet@gmail.com>
+
+commit 649920c6ab93429b94bc7c1aa7c0e8395351be32 upstream.
+
+In powerpc servers with large memory(32TB), we watched several soft
+lockups for hugepage under stress tests.
+
+The call traces are as follows:
+1.
+get_page_from_freelist+0x2d8/0xd50
+__alloc_pages_nodemask+0x180/0xc20
+alloc_fresh_huge_page+0xb0/0x190
+set_max_huge_pages+0x164/0x3b0
+
+2.
+prep_new_huge_page+0x5c/0x100
+alloc_fresh_huge_page+0xc8/0x190
+set_max_huge_pages+0x164/0x3b0
+
+This patch fixes such soft lockups. It is safe to call cond_resched()
+there because it is out of spin_lock/unlock section.
+
+Link: http://lkml.kernel.org/r/1469674442-14848-1-git-send-email-hejianet@gmail.com
+Signed-off-by: Jia He <hejianet@gmail.com>
+Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/hugetlb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2170,6 +2170,10 @@ static unsigned long set_max_huge_pages(
+ * and reducing the surplus.
+ */
+ spin_unlock(&hugetlb_lock);
++
++ /* yield cpu to avoid soft lockup */
++ cond_resched();
++
+ if (hstate_is_gigantic(h))
+ ret = alloc_fresh_gigantic_page(h, nodes_allowed);
+ else
--- /dev/null
+From 144f4c98399e2c0ca60eb414c15a2c68125c18b8 Mon Sep 17 00:00:00 2001
+From: Hector Palacios <hector.palacios@digi.com>
+Date: Mon, 18 Jul 2016 10:39:18 +0200
+Subject: mtd: nand: fix bug writing 1 byte less than page size
+
+From: Hector Palacios <hector.palacios@digi.com>
+
+commit 144f4c98399e2c0ca60eb414c15a2c68125c18b8 upstream.
+
+nand_do_write_ops() determines if it is writing a partial page with the
+formula:
+ part_pagewr = (column || writelen < (mtd->writesize - 1))
+
+When 'writelen' is exactly 1 byte less than the NAND page size the formula
+equates to zero, so the code doesn't process it as a partial write,
+although it should.
+As a consequence the function remains in the while(1) loop with 'writelen'
+becoming 0xffffffff and iterating endlessly.
+
+The bug may not be easy to reproduce in Linux since user space tools
+usually force the padding or round-up the write size to a page-size
+multiple.
+This was discovered in U-Boot where the issue can be reproduced by
+writing any size that is 1 byte less than a page-size multiple.
+For example, on a NAND with 2K page (0x800):
+ => nand erase.part <partition>
+ => nand write $loadaddr <partition> 7ff
+
+[Editor's note: the bug was added in commit 29072b96078f, but moved
+around in commit 66507c7bc8895 ("mtd: nand: Add support to use nand_base
+poi databuf as bounce buffer")]
+
+Fixes: 29072b96078f ("[MTD] NAND: add subpage write support")
+Signed-off-by: Hector Palacios <hector.palacios@digi.com>
+Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/nand_base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -2586,7 +2586,7 @@ static int nand_do_write_ops(struct mtd_
+ int cached = writelen > bytes && page != blockmask;
+ uint8_t *wbuf = buf;
+ int use_bufpoi;
+- int part_pagewr = (column || writelen < (mtd->writesize - 1));
++ int part_pagewr = (column || writelen < mtd->writesize);
+
+ if (part_pagewr)
+ use_bufpoi = 1;
drm-edid-add-6-bpc-quirk-for-display-aeo-model-0.patch
drm-i915-never-fully-mask-the-the-ei-up-rps-interrupt-on-snb-ivb.patch
drm-i915-dp-revert-drm-i915-dp-fall-back-to-18-bpp-when-sink-capability-is-unknown.patch
+balloon-check-the-number-of-available-pages-in-leak-balloon.patch
+ftrace-recordmcount-work-around-for-addition-of-metag-magic-but-not-relocations.patch
+metag-fix-__cmpxchg_u32-asm-constraint-for-cmp.patch
+block-add-missing-group-association-in-bio-cloning-functions.patch
+block-fix-bdi-vs-gendisk-lifetime-mismatch.patch
+mtd-nand-fix-bug-writing-1-byte-less-than-page-size.patch
+mm-hugetlb-avoid-soft-lockup-in-set_max_huge_pages.patch
+alsa-hda-fix-krealloc-with-__gfp_zero-usage.patch
+alsa-hda-realtek-can-t-adjust-speaker-s-volume-on-a-dell-aio.patch
+alsa-hda-add-amd-bonaire-az-pci-id-with-proper-driver-caps.patch
+alsa-hda-fix-headset-mic-detection-problem-for-two-dell-machines.patch
+ib-mlx5-fix-modify_qp-command-input-structure.patch
+ib-mlx5-fix-entries-checks-in-mlx5_ib_create_cq.patch
+ib-mlx5-fix-returned-values-of-query-qp.patch
+ib-mlx5-fix-entries-check-in-mlx5_ib_resize_cq.patch
+ib-mlx5-fix-post-send-fence-logic.patch
+ib-mlx5-return-port_err-in-active-to-initializing-tranisition.patch
+ib-mlx5-check-blueflame-hca-support.patch
+ib-sa-use-correct-free-function.patch
+ib-ipoib-don-t-update-neigh-validity-for-unresolved-entries.patch
+ib-iwpm-fix-a-potential-skb-leak.patch
+ib-mlx4-fix-the-sq-size-of-an-rc-qp.patch
+ib-mlx4-fix-error-flow-when-sending-mads-under-sriov.patch
+ib-mlx4-fix-memory-leak-if-qp-creation-failed.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
