--- /dev/null
+From fd48331f9b71d2add941adaee3619f5b8527182d Mon Sep 17 00:00:00 2001
+From: Maruthi Srinivas Bayyavarapu <Maruthi.Bayyavarapu@amd.com>
+Date: Wed, 3 Aug 2016 16:46:39 +0530
+Subject: ALSA: hda: add AMD Bonaire AZ PCI ID with proper driver caps
+
+From: Maruthi Srinivas Bayyavarapu <Maruthi.Bayyavarapu@amd.com>
+
+commit fd48331f9b71d2add941adaee3619f5b8527182d upstream.
+
+This commit fixes garbled audio on Bonaire HDMI
+
+Signed-off-by: Maruthi Bayyavarapu <maruthi.bayyavarapu@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2265,6 +2265,8 @@ static const struct pci_device_id azx_id
+ { PCI_DEVICE(0x1022, 0x780d),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
+ /* ATI HDMI */
++ { PCI_DEVICE(0x1002, 0x0002),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0x1308),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0x157a),
--- /dev/null
+From 59ec4b57bcaede46546d54d037a21004b9aa5cef Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Thu, 4 Aug 2016 15:28:04 +0800
+Subject: ALSA: hda - Fix headset mic detection problem for two dell machines
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 59ec4b57bcaede46546d54d037a21004b9aa5cef upstream.
+
+One of the machines has ALC255 on it, another one has ALC298 on it.
+
+On the machine with the codec ALC298, it also has the speaker volume
+problem, so we add the fixup chained to ALC298_FIXUP_SPK_VOLUME rather
+than adding a group of pin definition in the pin quirk table, since
+the speak volume problem does not happen on other machines yet.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5498,6 +5498,8 @@ static const struct hda_fixup alc269_fix
+ [ALC298_FIXUP_SPK_VOLUME] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc298_fixup_speaker_volume,
++ .chained = true,
++ .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+ },
+ };
+
+@@ -5821,6 +5823,10 @@ static const struct snd_hda_pin_quirk al
+ {0x1b, 0x01014020},
+ {0x21, 0x0221103f}),
+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ {0x14, 0x90170130},
++ {0x1b, 0x02011020},
++ {0x21, 0x0221103f}),
++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ {0x14, 0x90170150},
+ {0x1b, 0x02011020},
+ {0x21, 0x0221105f}),
--- /dev/null
+From 33baefe5e72f17a6df378e48196cd8cada11deec Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 3 Aug 2016 15:13:00 +0200
+Subject: ALSA: hda: Fix krealloc() with __GFP_ZERO usage
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 33baefe5e72f17a6df378e48196cd8cada11deec upstream.
+
+krealloc() doesn't work always properly with __GFP_ZERO flag as
+expected. For clearing the reallocated area, we need to clear
+explicitly instead.
+
+Reported-by: Joe Perches <joe@perches.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/hda/array.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/hda/array.c
++++ b/sound/hda/array.c
+@@ -21,13 +21,15 @@ void *snd_array_new(struct snd_array *ar
+ return NULL;
+ if (array->used >= array->alloced) {
+ int num = array->alloced + array->alloc_align;
++ int oldsize = array->alloced * array->elem_size;
+ int size = (num + 1) * array->elem_size;
+ void *nlist;
+ if (snd_BUG_ON(num >= 4096))
+ return NULL;
+- nlist = krealloc(array->list, size, GFP_KERNEL | __GFP_ZERO);
++ nlist = krealloc(array->list, size, GFP_KERNEL);
+ if (!nlist)
+ return NULL;
++ memset(nlist + oldsize, 0, size - oldsize);
+ array->list = nlist;
+ array->alloced = num;
+ }
--- /dev/null
+From dd9aa335c88003d131ac874e7f6809902de0b847 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 1 Aug 2016 10:20:32 +0800
+Subject: ALSA: hda/realtek - Can't adjust speaker's volume on a Dell AIO
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit dd9aa335c88003d131ac874e7f6809902de0b847 upstream.
+
+We have a Dell AIO on which we can't adjust its speaker's volume.
+The problem is it is connected to a Audio Output node without Amp-out
+capability. To fix it, we change it to be connnected to a node with
+Amp-out capability.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4674,6 +4674,22 @@ static void alc290_fixup_mono_speakers(s
+ }
+ }
+
++static void alc298_fixup_speaker_volume(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ /* The speaker is routed to the Node 0x06 by a mistake, as a result
++ we can't adjust the speaker's volume since this node does not has
++ Amp-out capability. we change the speaker's route to:
++ Node 0x02 (Audio Output) -> Node 0x0c (Audio Mixer) -> Node 0x17 (
++ Pin Complex), since Node 0x02 has Amp-out caps, we can adjust
++ speaker's volume now. */
++
++ hda_nid_t conn1[1] = { 0x0c };
++ snd_hda_override_conn_list(codec, 0x17, 1, conn1);
++ }
++}
++
+ /* Hook to update amp GPIO4 for automute */
+ static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
+ struct hda_jack_callback *jack)
+@@ -4823,6 +4839,7 @@ enum {
+ ALC280_FIXUP_HP_HEADSET_MIC,
+ ALC221_FIXUP_HP_FRONT_MIC,
+ ALC292_FIXUP_TPT460,
++ ALC298_FIXUP_SPK_VOLUME,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -5478,6 +5495,10 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE,
+ },
++ [ALC298_FIXUP_SPK_VOLUME] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc298_fixup_speaker_volume,
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -5524,6 +5545,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
++ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
--- /dev/null
+From 37cf99e08c6fb4dcea0f9ad2b13b6daa8c76a711 Mon Sep 17 00:00:00 2001
+From: Konstantin Neumoin <kneumoin@virtuozzo.com>
+Date: Mon, 11 Jul 2016 15:28:59 +0300
+Subject: balloon: check the number of available pages in leak balloon
+
+From: Konstantin Neumoin <kneumoin@virtuozzo.com>
+
+commit 37cf99e08c6fb4dcea0f9ad2b13b6daa8c76a711 upstream.
+
+The balloon has a special mechanism that is subscribed to the oom
+notification which leads to deflation for a fixed number of pages.
+The number is always fixed even when the balloon is fully deflated.
+But leak_balloon did not expect that the pages to deflate will be more
+than taken, and raise a "BUG" in balloon_page_dequeue when page list
+will be empty.
+
+So, the simplest solution would be to check that the number of releases
+pages is less or equal to the number taken pages.
+
+Signed-off-by: Konstantin Neumoin <kneumoin@virtuozzo.com>
+Signed-off-by: Denis V. Lunev <den@openvz.org>
+CC: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/virtio/virtio_balloon.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -202,6 +202,8 @@ static unsigned leak_balloon(struct virt
+ num = min(num, ARRAY_SIZE(vb->pfns));
+
+ mutex_lock(&vb->balloon_lock);
++ /* We can't release more pages than taken */
++ num = min(num, (size_t)vb->num_pages);
+ for (vb->num_pfns = 0; vb->num_pfns < num;
+ vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE) {
+ page = balloon_page_dequeue(vb_dev_info);
--- /dev/null
+From 20bd723ec6a3261df5e02250cd3a1fbb09a343f2 Mon Sep 17 00:00:00 2001
+From: Paolo Valente <paolo.valente@linaro.org>
+Date: Wed, 27 Jul 2016 07:22:05 +0200
+Subject: block: add missing group association in bio-cloning functions
+
+From: Paolo Valente <paolo.valente@linaro.org>
+
+commit 20bd723ec6a3261df5e02250cd3a1fbb09a343f2 upstream.
+
+When a bio is cloned, the newly created bio must be associated with
+the same blkcg as the original bio (if BLK_CGROUP is enabled). If
+this operation is not performed, then the new bio is not associated
+with any group, and the group of the current task is returned when
+the group of the bio is requested.
+
+Depending on the cloning frequency, this may cause a large
+percentage of the bios belonging to a given group to be treated
+as if belonging to other groups (in most cases as if belonging to
+the root group). The expected group isolation may thereby be broken.
+
+This commit adds the missing association in bio-cloning functions.
+
+Fixes: da2f0f74cf7d ("Btrfs: add support for blkio controllers")
+
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Reviewed-by: Nikolay Borisov <kernel@kyup.com>
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/bio.c | 15 +++++++++++++++
+ fs/btrfs/extent_io.c | 6 ------
+ include/linux/bio.h | 3 +++
+ 3 files changed, 18 insertions(+), 6 deletions(-)
+
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -579,6 +579,8 @@ void __bio_clone_fast(struct bio *bio, s
+ bio->bi_rw = bio_src->bi_rw;
+ bio->bi_iter = bio_src->bi_iter;
+ bio->bi_io_vec = bio_src->bi_io_vec;
++
++ bio_clone_blkcg_association(bio, bio_src);
+ }
+ EXPORT_SYMBOL(__bio_clone_fast);
+
+@@ -684,6 +686,8 @@ integrity_clone:
+ }
+ }
+
++ bio_clone_blkcg_association(bio, bio_src);
++
+ return bio;
+ }
+ EXPORT_SYMBOL(bio_clone_bioset);
+@@ -2005,6 +2009,17 @@ void bio_disassociate_task(struct bio *b
+ }
+ }
+
++/**
++ * bio_clone_blkcg_association - clone blkcg association from src to dst bio
++ * @dst: destination bio
++ * @src: source bio
++ */
++void bio_clone_blkcg_association(struct bio *dst, struct bio *src)
++{
++ if (src->bi_css)
++ WARN_ON(bio_associate_blkcg(dst, src->bi_css));
++}
++
+ #endif /* CONFIG_BLK_CGROUP */
+
+ static void __init biovec_init_slabs(void)
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -2696,12 +2696,6 @@ struct bio *btrfs_bio_clone(struct bio *
+ btrfs_bio->csum = NULL;
+ btrfs_bio->csum_allocated = NULL;
+ btrfs_bio->end_io = NULL;
+-
+-#ifdef CONFIG_BLK_CGROUP
+- /* FIXME, put this into bio_clone_bioset */
+- if (bio->bi_css)
+- bio_associate_blkcg(new, bio->bi_css);
+-#endif
+ }
+ return new;
+ }
+--- a/include/linux/bio.h
++++ b/include/linux/bio.h
+@@ -527,11 +527,14 @@ extern unsigned int bvec_nr_vecs(unsigne
+ int bio_associate_blkcg(struct bio *bio, struct cgroup_subsys_state *blkcg_css);
+ int bio_associate_current(struct bio *bio);
+ void bio_disassociate_task(struct bio *bio);
++void bio_clone_blkcg_association(struct bio *dst, struct bio *src);
+ #else /* CONFIG_BLK_CGROUP */
+ static inline int bio_associate_blkcg(struct bio *bio,
+ struct cgroup_subsys_state *blkcg_css) { return 0; }
+ static inline int bio_associate_current(struct bio *bio) { return -ENOENT; }
+ static inline void bio_disassociate_task(struct bio *bio) { }
++static inline void bio_clone_blkcg_association(struct bio *dst,
++ struct bio *src) { }
+ #endif /* CONFIG_BLK_CGROUP */
+
+ #ifdef CONFIG_HIGHMEM
--- /dev/null
+From df08c32ce3be5be138c1dbfcba203314a3a7cd6f Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Sun, 31 Jul 2016 11:15:13 -0700
+Subject: block: fix bdi vs gendisk lifetime mismatch
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit df08c32ce3be5be138c1dbfcba203314a3a7cd6f upstream.
+
+The name for a bdi of a gendisk is derived from the gendisk's devt.
+However, since the gendisk is destroyed before the bdi it leaves a
+window where a new gendisk could dynamically reuse the same devt while a
+bdi with the same name is still live. Arrange for the bdi to hold a
+reference against its "owner" disk device while it is registered.
+Otherwise we can hit sysfs duplicate name collisions like the following:
+
+ WARNING: CPU: 10 PID: 2078 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x64/0x80
+ sysfs: cannot create duplicate filename '/devices/virtual/bdi/259:1'
+
+ Hardware name: HP ProLiant DL580 Gen8, BIOS P79 05/06/2015
+ 0000000000000286 0000000002c04ad5 ffff88006f24f970 ffffffff8134caec
+ ffff88006f24f9c0 0000000000000000 ffff88006f24f9b0 ffffffff8108c351
+ 0000001f0000000c ffff88105d236000 ffff88105d1031e0 ffff8800357427f8
+ Call Trace:
+ [<ffffffff8134caec>] dump_stack+0x63/0x87
+ [<ffffffff8108c351>] __warn+0xd1/0xf0
+ [<ffffffff8108c3cf>] warn_slowpath_fmt+0x5f/0x80
+ [<ffffffff812a0d34>] sysfs_warn_dup+0x64/0x80
+ [<ffffffff812a0e1e>] sysfs_create_dir_ns+0x7e/0x90
+ [<ffffffff8134faaa>] kobject_add_internal+0xaa/0x320
+ [<ffffffff81358d4e>] ? vsnprintf+0x34e/0x4d0
+ [<ffffffff8134ff55>] kobject_add+0x75/0xd0
+ [<ffffffff816e66b2>] ? mutex_lock+0x12/0x2f
+ [<ffffffff8148b0a5>] device_add+0x125/0x610
+ [<ffffffff8148b788>] device_create_groups_vargs+0xd8/0x100
+ [<ffffffff8148b7cc>] device_create_vargs+0x1c/0x20
+ [<ffffffff811b775c>] bdi_register+0x8c/0x180
+ [<ffffffff811b7877>] bdi_register_dev+0x27/0x30
+ [<ffffffff813317f5>] add_disk+0x175/0x4a0
+
+Reported-by: Yi Zhang <yizhan@redhat.com>
+Tested-by: Yi Zhang <yizhan@redhat.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+Fixed up missing 0 return in bdi_register_owner().
+
+Signed-off-by: Jens Axboe <axboe@fb.com>
+
+---
+ block/genhd.c | 2 +-
+ include/linux/backing-dev-defs.h | 1 +
+ include/linux/backing-dev.h | 1 +
+ mm/backing-dev.c | 19 +++++++++++++++++++
+ 4 files changed, 22 insertions(+), 1 deletion(-)
+
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -613,7 +613,7 @@ void add_disk(struct gendisk *disk)
+
+ /* Register BDI before referencing it from bdev */
+ bdi = &disk->queue->backing_dev_info;
+- bdi_register_dev(bdi, disk_devt(disk));
++ bdi_register_owner(bdi, disk_to_dev(disk));
+
+ blk_register_region(disk_devt(disk), disk->minors, NULL,
+ exact_match, exact_lock, disk);
+--- a/include/linux/backing-dev-defs.h
++++ b/include/linux/backing-dev-defs.h
+@@ -163,6 +163,7 @@ struct backing_dev_info {
+ wait_queue_head_t wb_waitq;
+
+ struct device *dev;
++ struct device *owner;
+
+ struct timer_list laptop_mode_wb_timer;
+
+--- a/include/linux/backing-dev.h
++++ b/include/linux/backing-dev.h
+@@ -24,6 +24,7 @@ __printf(3, 4)
+ int bdi_register(struct backing_dev_info *bdi, struct device *parent,
+ const char *fmt, ...);
+ int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev);
++int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner);
+ void bdi_unregister(struct backing_dev_info *bdi);
+
+ int __must_check bdi_setup_and_register(struct backing_dev_info *, char *);
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -825,6 +825,20 @@ int bdi_register_dev(struct backing_dev_
+ }
+ EXPORT_SYMBOL(bdi_register_dev);
+
++int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner)
++{
++ int rc;
++
++ rc = bdi_register(bdi, NULL, "%u:%u", MAJOR(owner->devt),
++ MINOR(owner->devt));
++ if (rc)
++ return rc;
++ bdi->owner = owner;
++ get_device(owner);
++ return 0;
++}
++EXPORT_SYMBOL(bdi_register_owner);
++
+ /*
+ * Remove bdi from bdi_list, and ensure that it is no longer visible
+ */
+@@ -849,6 +863,11 @@ void bdi_unregister(struct backing_dev_i
+ device_unregister(bdi->dev);
+ bdi->dev = NULL;
+ }
++
++ if (bdi->owner) {
++ put_device(bdi->owner);
++ bdi->owner = NULL;
++ }
+ }
+
+ void bdi_exit(struct backing_dev_info *bdi)
--- /dev/null
+From ff06db1efb2ad6db06eb5b99b88a0c15a9cc9b0e Mon Sep 17 00:00:00 2001
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Thu, 16 Jun 2016 09:53:58 +0200
+Subject: floppy: fix open(O_ACCMODE) for ioctl-only open
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+commit ff06db1efb2ad6db06eb5b99b88a0c15a9cc9b0e upstream.
+
+Commit 09954bad4 ("floppy: refactor open() flags handling"), as a
+side-effect, causes open(/dev/fdX, O_ACCMODE) to fail. It turns out that
+this is being used setfdprm userspace for ioctl-only open().
+
+Reintroduce back the original behavior wrt !(FMODE_READ|FMODE_WRITE)
+modes, while still keeping the original O_NDELAY bug fixed.
+
+Reported-by: Wim Osterholt <wim@djo.tudelft.nl>
+Tested-by: Wim Osterholt <wim@djo.tudelft.nl>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/floppy.c | 21 +++++++++------------
+ 1 file changed, 9 insertions(+), 12 deletions(-)
+
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -3663,11 +3663,6 @@ static int floppy_open(struct block_devi
+
+ opened_bdev[drive] = bdev;
+
+- if (!(mode & (FMODE_READ|FMODE_WRITE))) {
+- res = -EINVAL;
+- goto out;
+- }
+-
+ res = -ENXIO;
+
+ if (!floppy_track_buffer) {
+@@ -3711,13 +3706,15 @@ static int floppy_open(struct block_devi
+ if (UFDCS->rawcmd == 1)
+ UFDCS->rawcmd = 2;
+
+- UDRS->last_checked = 0;
+- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
+- check_disk_change(bdev);
+- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
+- goto out;
+- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
+- goto out;
++ if (mode & (FMODE_READ|FMODE_WRITE)) {
++ UDRS->last_checked = 0;
++ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
++ check_disk_change(bdev);
++ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
++ goto out;
++ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
++ goto out;
++ }
+
+ res = -EROFS;
+
--- /dev/null
+From b2e1c26f0b62531636509fbcb6dab65617ed8331 Mon Sep 17 00:00:00 2001
+From: Laura Abbott <labbott@redhat.com>
+Date: Fri, 8 Jul 2016 12:18:50 -0700
+Subject: ftrace/recordmcount: Work around for addition of metag magic but not relocations
+
+From: Laura Abbott <labbott@redhat.com>
+
+commit b2e1c26f0b62531636509fbcb6dab65617ed8331 upstream.
+
+glibc recently did a sync up (94e73c95d9b5 "elf.h: Sync with the gabi
+webpage") that added a #define for EM_METAG but did not add relocations
+
+This triggers build errors:
+
+scripts/recordmcount.c: In function 'do_file':
+scripts/recordmcount.c:466:28: error: 'R_METAG_ADDR32' undeclared (first use in this function)
+ case EM_METAG: reltype = R_METAG_ADDR32;
+ ^~~~~~~~~~~~~~
+scripts/recordmcount.c:466:28: note: each undeclared identifier is reported only once for each function it appears in
+scripts/recordmcount.c:468:20: error: 'R_METAG_NONE' undeclared (first use in this function)
+ rel_type_nop = R_METAG_NONE;
+ ^~~~~~~~~~~~
+
+Work around this change with some more #ifdefery for the relocations.
+
+Fedora Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1354034
+
+Link: http://lkml.kernel.org/r/1468005530-14757-1-git-send-email-labbott@redhat.com
+
+Cc: James Hogan <james.hogan@imgtec.com>
+Fixes: 00512bdd4573 ("metag: ftrace support")
+Reported-by: Ross Burton <ross.burton@intel.com>
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/recordmcount.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/scripts/recordmcount.c
++++ b/scripts/recordmcount.c
+@@ -33,10 +33,17 @@
+ #include <string.h>
+ #include <unistd.h>
+
++/*
++ * glibc synced up and added the metag number but didn't add the relocations.
++ * Work around this in a crude manner for now.
++ */
+ #ifndef EM_METAG
+-/* Remove this when these make it to the standard system elf.h. */
+ #define EM_METAG 174
++#endif
++#ifndef R_METAG_ADDR32
+ #define R_METAG_ADDR32 2
++#endif
++#ifndef R_METAG_NONE
+ #define R_METAG_NONE 3
+ #endif
+
--- /dev/null
+From eaa74ec7329a48a4b724d8de440b3a2cbaabf7c8 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Thu, 21 Jul 2016 13:03:09 -0700
+Subject: IB/core: Make rdma_rw_ctx_init() initialize all used fields
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit eaa74ec7329a48a4b724d8de440b3a2cbaabf7c8 upstream.
+
+Some but not all callers of rdma_rw_ctx_init() zero-initialize
+struct rdma_rw_ctx. Hence make rdma_rw_ctx_init() initialize all
+work request fields that will be read by ib_post_send().
+
+Fixes: a060b5629ab0 ("IB/core: generic RDMA READ/WRITE API")
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Tested-by: Steve Wise <swise@opengridcomputing.com>
+Tested-by: Laurence Oberman <loberman@redhat.com>
+Cc: Parav Pandit <pandit.parav@gmail.com>
+Cc: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/rw.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/infiniband/core/rw.c
++++ b/drivers/infiniband/core/rw.c
+@@ -71,6 +71,7 @@ static inline u32 rdma_rw_fr_page_list_l
+ return min_t(u32, dev->attrs.max_fast_reg_page_list_len, 256);
+ }
+
++/* Caller must have zero-initialized *reg. */
+ static int rdma_rw_init_one_mr(struct ib_qp *qp, u8 port_num,
+ struct rdma_rw_reg_ctx *reg, struct scatterlist *sg,
+ u32 sg_cnt, u32 offset)
+@@ -114,6 +115,7 @@ static int rdma_rw_init_mr_wrs(struct rd
+ u8 port_num, struct scatterlist *sg, u32 sg_cnt, u32 offset,
+ u64 remote_addr, u32 rkey, enum dma_data_direction dir)
+ {
++ struct rdma_rw_reg_ctx *prev = NULL;
+ u32 pages_per_mr = rdma_rw_fr_page_list_len(qp->pd->device);
+ int i, j, ret = 0, count = 0;
+
+@@ -125,7 +127,6 @@ static int rdma_rw_init_mr_wrs(struct rd
+ }
+
+ for (i = 0; i < ctx->nr_ops; i++) {
+- struct rdma_rw_reg_ctx *prev = i ? &ctx->reg[i - 1] : NULL;
+ struct rdma_rw_reg_ctx *reg = &ctx->reg[i];
+ u32 nents = min(sg_cnt, pages_per_mr);
+
+@@ -162,9 +163,13 @@ static int rdma_rw_init_mr_wrs(struct rd
+ sg_cnt -= nents;
+ for (j = 0; j < nents; j++)
+ sg = sg_next(sg);
++ prev = reg;
+ offset = 0;
+ }
+
++ if (prev)
++ prev->wr.wr.next = NULL;
++
+ ctx->type = RDMA_RW_MR;
+ return count;
+
+@@ -205,11 +210,10 @@ static int rdma_rw_init_map_wrs(struct r
+ rdma_wr->wr.opcode = IB_WR_RDMA_READ;
+ rdma_wr->remote_addr = remote_addr + total_len;
+ rdma_wr->rkey = rkey;
++ rdma_wr->wr.num_sge = nr_sge;
+ rdma_wr->wr.sg_list = sge;
+
+ for (j = 0; j < nr_sge; j++, sg = sg_next(sg)) {
+- rdma_wr->wr.num_sge++;
+-
+ sge->addr = ib_sg_dma_address(dev, sg) + offset;
+ sge->length = ib_sg_dma_len(dev, sg) - offset;
+ sge->lkey = qp->pd->local_dma_lkey;
+@@ -220,8 +224,8 @@ static int rdma_rw_init_map_wrs(struct r
+ offset = 0;
+ }
+
+- if (i + 1 < ctx->nr_ops)
+- rdma_wr->wr.next = &ctx->map.wrs[i + 1].wr;
++ rdma_wr->wr.next = i + 1 < ctx->nr_ops ?
++ &ctx->map.wrs[i + 1].wr : NULL;
+ }
+
+ ctx->type = RDMA_RW_MULTI_WR;
--- /dev/null
+From 632bc3f65081dd1e2e5394a9161580a0f78e8839 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Thu, 21 Jul 2016 13:03:30 -0700
+Subject: IB/core, RDMA RW API: Do not exceed QP SGE send limit
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit 632bc3f65081dd1e2e5394a9161580a0f78e8839 upstream.
+
+Compute the SGE limit for RDMA READ and WRITE requests in
+ib_create_qp(). Use that limit in the RDMA RW API implementation.
+
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Sagi Grimberg <sagi@grimberg.me>
+Cc: Steve Wise <swise@opengridcomputing.com>
+Cc: Parav Pandit <pandit.parav@gmail.com>
+Cc: Nicholas Bellinger <nab@linux-iscsi.org>
+Cc: Laurence Oberman <loberman@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/rw.c | 10 ++--------
+ drivers/infiniband/core/verbs.c | 9 +++++++++
+ include/rdma/ib_verbs.h | 6 ++++++
+ 3 files changed, 17 insertions(+), 8 deletions(-)
+
+--- a/drivers/infiniband/core/rw.c
++++ b/drivers/infiniband/core/rw.c
+@@ -58,13 +58,6 @@ static inline bool rdma_rw_io_needs_mr(s
+ return false;
+ }
+
+-static inline u32 rdma_rw_max_sge(struct ib_device *dev,
+- enum dma_data_direction dir)
+-{
+- return dir == DMA_TO_DEVICE ?
+- dev->attrs.max_sge : dev->attrs.max_sge_rd;
+-}
+-
+ static inline u32 rdma_rw_fr_page_list_len(struct ib_device *dev)
+ {
+ /* arbitrary limit to avoid allocating gigantic resources */
+@@ -186,7 +179,8 @@ static int rdma_rw_init_map_wrs(struct r
+ u64 remote_addr, u32 rkey, enum dma_data_direction dir)
+ {
+ struct ib_device *dev = qp->pd->device;
+- u32 max_sge = rdma_rw_max_sge(dev, dir);
++ u32 max_sge = dir == DMA_TO_DEVICE ? qp->max_write_sge :
++ qp->max_read_sge;
+ struct ib_sge *sge;
+ u32 total_len = 0, i, j;
+
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -814,6 +814,15 @@ struct ib_qp *ib_create_qp(struct ib_pd
+ }
+ }
+
++ /*
++ * Note: all hw drivers guarantee that max_send_sge is lower than
++ * the device RDMA WRITE SGE limit but not all hw drivers ensure that
++ * max_send_sge <= max_sge_rd.
++ */
++ qp->max_write_sge = qp_init_attr->cap.max_send_sge;
++ qp->max_read_sge = min_t(u32, qp_init_attr->cap.max_send_sge,
++ device->attrs.max_sge_rd);
++
+ return qp;
+ }
+ EXPORT_SYMBOL(ib_create_qp);
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -1428,6 +1428,10 @@ struct ib_srq {
+ } ext;
+ };
+
++/*
++ * @max_write_sge: Maximum SGE elements per RDMA WRITE request.
++ * @max_read_sge: Maximum SGE elements per RDMA READ request.
++ */
+ struct ib_qp {
+ struct ib_device *device;
+ struct ib_pd *pd;
+@@ -1449,6 +1453,8 @@ struct ib_qp {
+ void (*event_handler)(struct ib_event *, void *);
+ void *qp_context;
+ u32 qp_num;
++ u32 max_write_sge;
++ u32 max_read_sge;
+ enum ib_qp_type qp_type;
+ };
+
--- /dev/null
+From b0ffeb537f3a726931d962ab6d03e34a2f070ea4 Mon Sep 17 00:00:00 2001
+From: Slava Shwartsman <slavash@mellanox.com>
+Date: Sun, 3 Jul 2016 15:28:19 +0300
+Subject: IB/mlx5: Fix iteration overrun in GSI qps
+
+From: Slava Shwartsman <slavash@mellanox.com>
+
+commit b0ffeb537f3a726931d962ab6d03e34a2f070ea4 upstream.
+
+Number of outstanding_pi may overflow and as a result may indicate that
+there are no elements in the queue. The effect of doing this is that the
+MAD layer will get stuck waiting for completions. The MAD layer will
+think that the QP is full - because it didn't receive these completions.
+
+This fix changes it so the outstanding_pi number is increased
+with 32-bit wraparound and is not limited to max_send_wr so
+that the difference between outstanding_pi and outstanding_ci will
+really indicate the number of outstanding completions.
+
+Fixes: ea6dc2036224 ('IB/mlx5: Reorder GSI completions')
+Signed-off-by: Slava Shwartsman <slavash@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Reviewed-by: Haggai Eran <haggaie@mellanox.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/gsi.c | 19 ++++++-------------
+ 1 file changed, 6 insertions(+), 13 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/gsi.c
++++ b/drivers/infiniband/hw/mlx5/gsi.c
+@@ -69,15 +69,6 @@ static bool mlx5_ib_deth_sqpn_cap(struct
+ return MLX5_CAP_GEN(dev->mdev, set_deth_sqpn);
+ }
+
+-static u32 next_outstanding(struct mlx5_ib_gsi_qp *gsi, u32 index)
+-{
+- return ++index % gsi->cap.max_send_wr;
+-}
+-
+-#define for_each_outstanding_wr(gsi, index) \
+- for (index = gsi->outstanding_ci; index != gsi->outstanding_pi; \
+- index = next_outstanding(gsi, index))
+-
+ /* Call with gsi->lock locked */
+ static void generate_completions(struct mlx5_ib_gsi_qp *gsi)
+ {
+@@ -85,8 +76,9 @@ static void generate_completions(struct
+ struct mlx5_ib_gsi_wr *wr;
+ u32 index;
+
+- for_each_outstanding_wr(gsi, index) {
+- wr = &gsi->outstanding_wrs[index];
++ for (index = gsi->outstanding_ci; index != gsi->outstanding_pi;
++ index++) {
++ wr = &gsi->outstanding_wrs[index % gsi->cap.max_send_wr];
+
+ if (!wr->completed)
+ break;
+@@ -430,8 +422,9 @@ static int mlx5_ib_add_outstanding_wr(st
+ return -ENOMEM;
+ }
+
+- gsi_wr = &gsi->outstanding_wrs[gsi->outstanding_pi];
+- gsi->outstanding_pi = next_outstanding(gsi, gsi->outstanding_pi);
++ gsi_wr = &gsi->outstanding_wrs[gsi->outstanding_pi %
++ gsi->cap.max_send_wr];
++ gsi->outstanding_pi++;
+
+ if (!wc) {
+ memset(&gsi_wr->wc, 0, sizeof(gsi_wr->wc));
--- /dev/null
+From e3353c268b06236d6c40fa1714c114f21f44451c Mon Sep 17 00:00:00 2001
+From: Artemy Kovalyov <artemyko@mellanox.com>
+Date: Fri, 17 Jun 2016 15:33:31 +0300
+Subject: IB/mlx5: Fix MODIFY_QP command input structure
+
+From: Artemy Kovalyov <artemyko@mellanox.com>
+
+commit e3353c268b06236d6c40fa1714c114f21f44451c upstream.
+
+Make MODIFY_QP command input structure compliant to specification
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
+Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/mlx5/qp.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/mlx5/qp.h
++++ b/include/linux/mlx5/qp.h
+@@ -556,9 +556,9 @@ struct mlx5_destroy_qp_mbox_out {
+ struct mlx5_modify_qp_mbox_in {
+ struct mlx5_inbox_hdr hdr;
+ __be32 qpn;
+- u8 rsvd1[4];
+- __be32 optparam;
+ u8 rsvd0[4];
++ __be32 optparam;
++ u8 rsvd1[4];
+ struct mlx5_qp_context ctx;
+ u8 rsvd2[16];
+ };
--- /dev/null
+From a6580f4310ded039fc9f682cbf027fbba217652b Mon Sep 17 00:00:00 2001
+From: Jianxin Xiong <jianxin.xiong@intel.com>
+Date: Mon, 25 Jul 2016 13:39:08 -0700
+Subject: IB/rdmavt: Add missing spin_lock_init call for rdi->n_cqs_lock
+
+From: Jianxin Xiong <jianxin.xiong@intel.com>
+
+commit a6580f4310ded039fc9f682cbf027fbba217652b upstream.
+
+This fixes the following warning with PROV_LOCKING enabled kernel:
+
+INFO: trying to register non-static key.
+the code is fine but needs lockdep annotation.
+turning off the locking correctness validator.
+CPU: 15 PID: 12286 Comm: modprobe Not tainted 4.7.0-rc5.prove_rcu+ #1
+Hardware name: Intel Corporation S2600WT2R/S2600WT2R,
+......
+Call Trace:
+[<ffffffff8139ec0d>] dump_stack+0x85/0xc8
+[<ffffffff810eb765>] register_lock_class+0x415/0x4b0
+[<ffffffff810ede1c>] ? __lock_acquire+0x40c/0x1960
+[<ffffffff810edaa9>] __lock_acquire+0x99/0x1960
+[<ffffffff8120ab62>] ? find_vmap_area+0x42/0x60
+[<ffffffff8120ab39>] ? find_vmap_area+0x19/0x60
+[<ffffffff810ef9d3>] lock_acquire+0xd3/0x200
+[<ffffffffa049d598>] ? rvt_create_cq+0xc8/0x250 [rdmavt]
+[<ffffffff81763391>] _raw_spin_lock+0x31/0x40
+[<ffffffffa049d598>] ? rvt_create_cq+0xc8/0x250 [rdmavt]
+[<ffffffffa049d598>] rvt_create_cq+0xc8/0x250 [rdmavt]
+[<ffffffff810ead46>] ? static_obj+0x36/0x50
+[<ffffffffa0469e39>] ib_alloc_cq+0x49/0x180 [ib_core]
+[<ffffffffa047bed4>] ib_mad_init_device+0x204/0x6d0 [ib_core]
+[<ffffffff810e968f>] ? up_write+0x1f/0x40
+[<ffffffffa046e2c0>] ib_register_device+0x3d0/0x510 [ib_core]
+[<ffffffffa0752410>] ? read_cc_setting_bin+0x200/0x200 [hfi1]
+[<ffffffff810ead46>] ? static_obj+0x36/0x50
+[<ffffffff810eb888>] ? lockdep_init_map+0x88/0x200
+[<ffffffffa049cbff>] rvt_register_device+0x17f/0x320 [rdmavt]
+[<ffffffffa0766caa>] hfi1_register_ib_device+0x6ca/0x7c0 [hfi1]
+[<ffffffffa0733de4>] init_one+0x2b4/0x430 [hfi1]
+[<ffffffff813e40a5>] local_pci_probe+0x45/0xa0
+[<ffffffff813e5110>] ? pci_match_device+0xe0/0x110
+[<ffffffff813e550c>] pci_device_probe+0xfc/0x140
+[<ffffffff814daee9>] driver_probe_device+0x239/0x460
+[<ffffffff814db1dd>] __driver_attach+0xcd/0xf0
+[<ffffffff814db110>] ? driver_probe_device+0x460/0x460
+[<ffffffff814d89b3>] bus_for_each_dev+0x73/0xc0
+[<ffffffff814da74e>] driver_attach+0x1e/0x20
+[<ffffffff814da1b3>] bus_add_driver+0x1d3/0x290
+[<ffffffffa04cc114>] ? dev_init+0x114/0x114 [hfi1]
+[<ffffffff814dbf60>] driver_register+0x60/0xe0
+[<ffffffffa04cc114>] ? dev_init+0x114/0x114 [hfi1]
+[<ffffffff813e39d0>] __pci_register_driver+0x60/0x70
+[<ffffffffa04cc2aa>] hfi1_mod_init+0x196/0x1fe [hfi1]
+[<ffffffff81002190>] do_one_initcall+0x50/0x190
+[<ffffffff8110be72>] ? rcu_read_lock_sched_held+0x62/0x70
+[<ffffffff8122d4aa>] ? kmem_cache_alloc_trace+0x23a/0x2a0
+[<ffffffff811c1881>] ? do_init_module+0x27/0x1dc
+[<ffffffff811c18ba>] do_init_module+0x60/0x1dc
+[<ffffffff811360cc>] load_module+0x132c/0x1ac0
+[<ffffffff81132c40>] ? __symbol_put+0x60/0x60
+[<ffffffff8133e50d>] ? ima_post_read_file+0x3d/0x80
+
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Jianxin Xiong <jianxin.xiong@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/sw/rdmavt/cq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/infiniband/sw/rdmavt/cq.c
++++ b/drivers/infiniband/sw/rdmavt/cq.c
+@@ -510,6 +510,7 @@ int rvt_driver_cq_init(struct rvt_dev_in
+
+ if (rdi->worker)
+ return 0;
++ spin_lock_init(&rdi->n_cqs_lock);
+ rdi->worker = kzalloc(sizeof(*rdi->worker), GFP_KERNEL);
+ if (!rdi->worker)
+ return -ENOMEM;
--- /dev/null
+From 378fc3201eae07ab0fa7fb4133da141c3072f995 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Tue, 19 Jul 2016 10:03:17 -0700
+Subject: IB/rdmavt: Disable by default
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit 378fc3201eae07ab0fa7fb4133da141c3072f995 upstream.
+
+There is a strict policy in the Linux kernel that new drivers must be
+disabled by default. Hence leave out the "default m" line from Kconfig.
+
+Fixes: 0194621b2253 ("IB/rdmavt: Create module framework and handle driver registration")
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Cc: Jubin John <jubin.john@intel.com>
+Cc: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Cc: Ira Weiny <ira.weiny@intel.com>
+Cc: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/sw/rdmavt/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/infiniband/sw/rdmavt/Kconfig
++++ b/drivers/infiniband/sw/rdmavt/Kconfig
+@@ -1,6 +1,5 @@
+ config INFINIBAND_RDMAVT
+ tristate "RDMA verbs transport library"
+ depends on 64BIT
+- default m
+ ---help---
+ This is a common software verbs provider for RDMA networks.
--- /dev/null
+From 30c6d8773de06878f920666d8c945f81cb2081b3 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Thu, 21 Jul 2016 13:03:47 -0700
+Subject: IB/srpt: Limit the number of SG elements per work request
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit 30c6d8773de06878f920666d8c945f81cb2081b3 upstream.
+
+Limit the number of SG elements per work request to what the HCA
+and the queue pair support.
+
+Fixes: 34693573fde0 ("IB/srpt: Reduce QP buffer size")
+Reported-by: Parav Pandit <pandit.parav@gmail.com>
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Sagi Grimberg <sagi@grimberg.me>
+Cc: Steve Wise <swise@opengridcomputing.com>
+Cc: Parav Pandit <pandit.parav@gmail.com>
+Cc: Nicholas Bellinger <nab@linux-iscsi.org>
+Cc: Laurence Oberman <loberman@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 3 ++-
+ drivers/infiniband/ulp/srpt/ib_srpt.h | 6 +++++-
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -1601,6 +1601,7 @@ static int srpt_create_ch_ib(struct srpt
+ struct ib_qp_init_attr *qp_init;
+ struct srpt_port *sport = ch->sport;
+ struct srpt_device *sdev = sport->sdev;
++ const struct ib_device_attr *attrs = &sdev->device->attrs;
+ u32 srp_sq_size = sport->port_attrib.srp_sq_size;
+ int ret;
+
+@@ -1638,7 +1639,7 @@ retry:
+ */
+ qp_init->cap.max_send_wr = srp_sq_size / 2;
+ qp_init->cap.max_rdma_ctxs = srp_sq_size / 2;
+- qp_init->cap.max_send_sge = SRPT_DEF_SG_PER_WQE;
++ qp_init->cap.max_send_sge = min(attrs->max_sge, SRPT_MAX_SG_PER_WQE);
+ qp_init->port_num = ch->sport->port;
+
+ ch->qp = ib_create_qp(sdev->pd, qp_init);
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.h
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.h
+@@ -106,7 +106,11 @@ enum {
+ SRP_LOGIN_RSP_MULTICHAN_MAINTAINED = 0x2,
+
+ SRPT_DEF_SG_TABLESIZE = 128,
+- SRPT_DEF_SG_PER_WQE = 16,
++ /*
++ * An experimentally determined value that avoids that QP creation
++ * fails due to "swiotlb buffer is full" on systems using the swiotlb.
++ */
++ SRPT_MAX_SG_PER_WQE = 16,
+
+ MIN_SRPT_SQ_SIZE = 16,
+ DEF_SRPT_SQ_SIZE = 4096,
--- /dev/null
+From 6154c187b97ee7513046bb4eb317a89f738f13ef Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Thu, 4 Aug 2016 17:36:08 +0100
+Subject: metag: Fix __cmpxchg_u32 asm constraint for CMP
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 6154c187b97ee7513046bb4eb317a89f738f13ef upstream.
+
+The LNKGET based atomic sequence in __cmpxchg_u32 has slightly incorrect
+constraints for the return value which under certain circumstances can
+allow an address unit register to be used as the first operand of a CMP
+instruction. This isn't a valid instruction however as the encodings
+only allow a data unit to be specified. This would result in an
+assembler error like the following:
+
+ Error: failed to assemble instruction: "CMP A0.2,D0Ar6"
+
+Fix by changing the constraint from "=&da" (assigned, early clobbered,
+data or address unit register) to "=&d" (data unit register only).
+
+The constraint for the second operand, "bd" (an op2 register where op1
+is a data unit register and the instruction supports O2R) is already
+correct assuming the first operand is a data unit register.
+
+Other cases of CMP in inline asm have had their constraints checked, and
+appear to all be fine.
+
+Fixes: 6006c0d8ce94 ("metag: Atomics, locks and bitops")
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: linux-metag@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/metag/include/asm/cmpxchg_lnkget.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/metag/include/asm/cmpxchg_lnkget.h
++++ b/arch/metag/include/asm/cmpxchg_lnkget.h
+@@ -73,7 +73,7 @@ static inline unsigned long __cmpxchg_u3
+ " DCACHE [%2], %0\n"
+ #endif
+ "2:\n"
+- : "=&d" (temp), "=&da" (retval)
++ : "=&d" (temp), "=&d" (retval)
+ : "da" (m), "bd" (old), "da" (new)
+ : "cc"
+ );
--- /dev/null
+From 649920c6ab93429b94bc7c1aa7c0e8395351be32 Mon Sep 17 00:00:00 2001
+From: Jia He <hejianet@gmail.com>
+Date: Tue, 2 Aug 2016 14:02:31 -0700
+Subject: mm/hugetlb: avoid soft lockup in set_max_huge_pages()
+
+From: Jia He <hejianet@gmail.com>
+
+commit 649920c6ab93429b94bc7c1aa7c0e8395351be32 upstream.
+
+In powerpc servers with large memory(32TB), we watched several soft
+lockups for hugepage under stress tests.
+
+The call traces are as follows:
+1.
+get_page_from_freelist+0x2d8/0xd50
+__alloc_pages_nodemask+0x180/0xc20
+alloc_fresh_huge_page+0xb0/0x190
+set_max_huge_pages+0x164/0x3b0
+
+2.
+prep_new_huge_page+0x5c/0x100
+alloc_fresh_huge_page+0xc8/0x190
+set_max_huge_pages+0x164/0x3b0
+
+This patch fixes such soft lockups. It is safe to call cond_resched()
+there because it is out of spin_lock/unlock section.
+
+Link: http://lkml.kernel.org/r/1469674442-14848-1-git-send-email-hejianet@gmail.com
+Signed-off-by: Jia He <hejianet@gmail.com>
+Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/hugetlb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2214,6 +2214,10 @@ static unsigned long set_max_huge_pages(
+ * and reducing the surplus.
+ */
+ spin_unlock(&hugetlb_lock);
++
++ /* yield cpu to avoid soft lockup */
++ cond_resched();
++
+ if (hstate_is_gigantic(h))
+ ret = alloc_fresh_gigantic_page(h, nodes_allowed);
+ else
--- /dev/null
+From 144f4c98399e2c0ca60eb414c15a2c68125c18b8 Mon Sep 17 00:00:00 2001
+From: Hector Palacios <hector.palacios@digi.com>
+Date: Mon, 18 Jul 2016 10:39:18 +0200
+Subject: mtd: nand: fix bug writing 1 byte less than page size
+
+From: Hector Palacios <hector.palacios@digi.com>
+
+commit 144f4c98399e2c0ca60eb414c15a2c68125c18b8 upstream.
+
+nand_do_write_ops() determines if it is writing a partial page with the
+formula:
+ part_pagewr = (column || writelen < (mtd->writesize - 1))
+
+When 'writelen' is exactly 1 byte less than the NAND page size the formula
+equates to zero, so the code doesn't process it as a partial write,
+although it should.
+As a consequence the function remains in the while(1) loop with 'writelen'
+becoming 0xffffffff and iterating endlessly.
+
+The bug may not be easy to reproduce in Linux since user space tools
+usually force the padding or round-up the write size to a page-size
+multiple.
+This was discovered in U-Boot where the issue can be reproduced by
+writing any size that is 1 byte less than a page-size multiple.
+For example, on a NAND with 2K page (0x800):
+ => nand erase.part <partition>
+ => nand write $loadaddr <partition> 7ff
+
+[Editor's note: the bug was added in commit 29072b96078f, but moved
+around in commit 66507c7bc8895 ("mtd: nand: Add support to use nand_base
+poi databuf as bounce buffer")]
+
+Fixes: 29072b96078f ("[MTD] NAND: add subpage write support")
+Signed-off-by: Hector Palacios <hector.palacios@digi.com>
+Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/nand_base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -2610,7 +2610,7 @@ static int nand_do_write_ops(struct mtd_
+ int cached = writelen > bytes && page != blockmask;
+ uint8_t *wbuf = buf;
+ int use_bufpoi;
+- int part_pagewr = (column || writelen < (mtd->writesize - 1));
++ int part_pagewr = (column || writelen < mtd->writesize);
+
+ if (part_pagewr)
+ use_bufpoi = 1;
drm-edid-add-6-bpc-quirk-for-display-aeo-model-0.patch
drm-i915-never-fully-mask-the-the-ei-up-rps-interrupt-on-snb-ivb.patch
drm-i915-dp-revert-drm-i915-dp-fall-back-to-18-bpp-when-sink-capability-is-unknown.patch
+balloon-check-the-number-of-available-pages-in-leak-balloon.patch
+ftrace-recordmcount-work-around-for-addition-of-metag-magic-but-not-relocations.patch
+metag-fix-__cmpxchg_u32-asm-constraint-for-cmp.patch
+block-add-missing-group-association-in-bio-cloning-functions.patch
+block-fix-bdi-vs-gendisk-lifetime-mismatch.patch
+floppy-fix-open-o_accmode-for-ioctl-only-open.patch
+mtd-nand-fix-bug-writing-1-byte-less-than-page-size.patch
+mm-hugetlb-avoid-soft-lockup-in-set_max_huge_pages.patch
+alsa-hda-fix-krealloc-with-__gfp_zero-usage.patch
+alsa-hda-realtek-can-t-adjust-speaker-s-volume-on-a-dell-aio.patch
+alsa-hda-add-amd-bonaire-az-pci-id-with-proper-driver-caps.patch
+alsa-hda-fix-headset-mic-detection-problem-for-two-dell-machines.patch
+ib-mlx5-fix-iteration-overrun-in-gsi-qps.patch
+ib-mlx5-fix-modify_qp-command-input-structure.patch
+ib-rdmavt-disable-by-default.patch
+ib-rdmavt-add-missing-spin_lock_init-call-for-rdi-n_cqs_lock.patch
+ib-srpt-limit-the-number-of-sg-elements-per-work-request.patch
+ib-core-make-rdma_rw_ctx_init-initialize-all-used-fields.patch
+ib-core-rdma-rw-api-do-not-exceed-qp-sge-send-limit.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
