--- /dev/null
+From 37cf99e08c6fb4dcea0f9ad2b13b6daa8c76a711 Mon Sep 17 00:00:00 2001
+From: Konstantin Neumoin <kneumoin@virtuozzo.com>
+Date: Mon, 11 Jul 2016 15:28:59 +0300
+Subject: balloon: check the number of available pages in leak balloon
+
+From: Konstantin Neumoin <kneumoin@virtuozzo.com>
+
+commit 37cf99e08c6fb4dcea0f9ad2b13b6daa8c76a711 upstream.
+
+The balloon has a special mechanism that is subscribed to the oom
+notification which leads to deflation for a fixed number of pages.
+The number is always fixed even when the balloon is fully deflated.
+But leak_balloon did not expect that the pages to deflate will be more
+than taken, and raise a "BUG" in balloon_page_dequeue when page list
+will be empty.
+
+So, the simplest solution would be to check that the number of releases
+pages is less or equal to the number taken pages.
+
+Signed-off-by: Konstantin Neumoin <kneumoin@virtuozzo.com>
+Signed-off-by: Denis V. Lunev <den@openvz.org>
+CC: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/virtio/virtio_balloon.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -178,6 +178,8 @@ static void leak_balloon(struct virtio_b
+ num = min(num, ARRAY_SIZE(vb->pfns));
+
+ mutex_lock(&vb->balloon_lock);
++ /* We can't release more pages than taken */
++ num = min(num, (size_t)vb->num_pages);
+ for (vb->num_pfns = 0; vb->num_pfns < num;
+ vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE) {
+ page = balloon_page_dequeue(vb_dev_info);
--- /dev/null
+From b2e1c26f0b62531636509fbcb6dab65617ed8331 Mon Sep 17 00:00:00 2001
+From: Laura Abbott <labbott@redhat.com>
+Date: Fri, 8 Jul 2016 12:18:50 -0700
+Subject: ftrace/recordmcount: Work around for addition of metag magic but not relocations
+
+From: Laura Abbott <labbott@redhat.com>
+
+commit b2e1c26f0b62531636509fbcb6dab65617ed8331 upstream.
+
+glibc recently did a sync up (94e73c95d9b5 "elf.h: Sync with the gabi
+webpage") that added a #define for EM_METAG but did not add relocations
+
+This triggers build errors:
+
+scripts/recordmcount.c: In function 'do_file':
+scripts/recordmcount.c:466:28: error: 'R_METAG_ADDR32' undeclared (first use in this function)
+ case EM_METAG: reltype = R_METAG_ADDR32;
+ ^~~~~~~~~~~~~~
+scripts/recordmcount.c:466:28: note: each undeclared identifier is reported only once for each function it appears in
+scripts/recordmcount.c:468:20: error: 'R_METAG_NONE' undeclared (first use in this function)
+ rel_type_nop = R_METAG_NONE;
+ ^~~~~~~~~~~~
+
+Work around this change with some more #ifdefery for the relocations.
+
+Fedora Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1354034
+
+Link: http://lkml.kernel.org/r/1468005530-14757-1-git-send-email-labbott@redhat.com
+
+Cc: James Hogan <james.hogan@imgtec.com>
+Fixes: 00512bdd4573 ("metag: ftrace support")
+Reported-by: Ross Burton <ross.burton@intel.com>
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/recordmcount.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/scripts/recordmcount.c
++++ b/scripts/recordmcount.c
+@@ -33,10 +33,17 @@
+ #include <string.h>
+ #include <unistd.h>
+
++/*
++ * glibc synced up and added the metag number but didn't add the relocations.
++ * Work around this in a crude manner for now.
++ */
+ #ifndef EM_METAG
+-/* Remove this when these make it to the standard system elf.h. */
+ #define EM_METAG 174
++#endif
++#ifndef R_METAG_ADDR32
+ #define R_METAG_ADDR32 2
++#endif
++#ifndef R_METAG_NONE
+ #define R_METAG_NONE 3
+ #endif
+
--- /dev/null
+From 61c78eea9516a921799c17b4c20558e2aa780fd3 Mon Sep 17 00:00:00 2001
+From: Erez Shitrit <erezsh@mellanox.com>
+Date: Sat, 4 Jun 2016 15:15:19 +0300
+Subject: IB/IPoIB: Don't update neigh validity for unresolved entries
+
+From: Erez Shitrit <erezsh@mellanox.com>
+
+commit 61c78eea9516a921799c17b4c20558e2aa780fd3 upstream.
+
+ipoib_neigh_get unconditionally updates the "alive" variable member on
+any packet send. This prevents the neighbor garbage collection from
+cleaning out a dead neighbor entry if we are still queueing packets
+for it. If the queue for this neighbor is full, then don't update the
+alive timestamp. That way the neighbor can time out even if packets
+are still being queued as long as none of them are being sent.
+
+Fixes: b63b70d87741 ("IPoIB: Use a private hash table for path lookup in xmit path")
+Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -884,7 +884,9 @@ struct ipoib_neigh *ipoib_neigh_get(stru
+ neigh = NULL;
+ goto out_unlock;
+ }
+- neigh->alive = jiffies;
++
++ if (likely(skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE))
++ neigh->alive = jiffies;
+ goto out_unlock;
+ }
+ }
--- /dev/null
+From f2940e2c76bb554a7fbdd28ca5b90904117a9e96 Mon Sep 17 00:00:00 2001
+From: Yishai Hadas <yishaih@mellanox.com>
+Date: Wed, 22 Jun 2016 17:27:28 +0300
+Subject: IB/mlx4: Fix the SQ size of an RC QP
+
+From: Yishai Hadas <yishaih@mellanox.com>
+
+commit f2940e2c76bb554a7fbdd28ca5b90904117a9e96 upstream.
+
+When calculating the required size of an RC QP send queue, leave
+enough space for masked atomic operations, which require more space than
+"regular" atomic operation.
+
+Fixes: 6fa8f719844b ("IB/mlx4: Add support for masked atomic operations")
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Reviewed-by: Jack Morgenstein <jackm@mellanox.co.il>
+Reviewed-by: Eran Ben Elisha <eranbe@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx4/qp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -361,7 +361,7 @@ static int send_wqe_overhead(enum mlx4_i
+ sizeof (struct mlx4_wqe_raddr_seg);
+ case MLX4_IB_QPT_RC:
+ return sizeof (struct mlx4_wqe_ctrl_seg) +
+- sizeof (struct mlx4_wqe_atomic_seg) +
++ sizeof (struct mlx4_wqe_masked_atomic_seg) +
+ sizeof (struct mlx4_wqe_raddr_seg);
+ case MLX4_IB_QPT_SMI:
+ case MLX4_IB_QPT_GSI:
--- /dev/null
+From 9ea578528656e191c1097798a771ff08bab6f323 Mon Sep 17 00:00:00 2001
+From: Noa Osherovich <noaos@mellanox.com>
+Date: Sat, 4 Jun 2016 15:15:34 +0300
+Subject: IB/mlx5: Fix entries checks in mlx5_ib_create_cq
+
+From: Noa Osherovich <noaos@mellanox.com>
+
+commit 9ea578528656e191c1097798a771ff08bab6f323 upstream.
+
+Number of entries shouldn't be greater than the device's max
+capability. This should be checked before rounding the entries number
+to power of two.
+
+Fixes: 51ee86a4af639 ('IB/mlx5: Fix check of number of entries...')
+Signed-off-by: Majd Dibbiny <majd@mellanox.com>
+Signed-off-by: Noa Osherovich <noaos@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/cq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx5/cq.c
++++ b/drivers/infiniband/hw/mlx5/cq.c
+@@ -686,7 +686,8 @@ struct ib_cq *mlx5_ib_create_cq(struct i
+ int eqn;
+ int err;
+
+- if (entries < 0)
++ if (entries < 0 ||
++ (entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz))))
+ return ERR_PTR(-EINVAL);
+
+ entries = roundup_pow_of_two(entries + 1);
--- /dev/null
+From e3353c268b06236d6c40fa1714c114f21f44451c Mon Sep 17 00:00:00 2001
+From: Artemy Kovalyov <artemyko@mellanox.com>
+Date: Fri, 17 Jun 2016 15:33:31 +0300
+Subject: IB/mlx5: Fix MODIFY_QP command input structure
+
+From: Artemy Kovalyov <artemyko@mellanox.com>
+
+commit e3353c268b06236d6c40fa1714c114f21f44451c upstream.
+
+Make MODIFY_QP command input structure compliant to specification
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
+Signed-off-by: Artemy Kovalyov <artemyko@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/mlx5/qp.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/mlx5/qp.h
++++ b/include/linux/mlx5/qp.h
+@@ -378,9 +378,9 @@ struct mlx5_destroy_qp_mbox_out {
+ struct mlx5_modify_qp_mbox_in {
+ struct mlx5_inbox_hdr hdr;
+ __be32 qpn;
+- u8 rsvd1[4];
+- __be32 optparam;
+ u8 rsvd0[4];
++ __be32 optparam;
++ u8 rsvd1[4];
+ struct mlx5_qp_context ctx;
+ };
+
--- /dev/null
+From c9b254955b9f8814966f5dabd34c39d0e0a2b437 Mon Sep 17 00:00:00 2001
+From: Eli Cohen <eli@mellanox.com>
+Date: Wed, 22 Jun 2016 17:27:26 +0300
+Subject: IB/mlx5: Fix post send fence logic
+
+From: Eli Cohen <eli@mellanox.com>
+
+commit c9b254955b9f8814966f5dabd34c39d0e0a2b437 upstream.
+
+If the caller specified IB_SEND_FENCE in the send flags of the work
+request and no previous work request stated that the successive one
+should be fenced, the work request would be executed without a fence.
+This could result in RDMA read or atomic operations failure due to a MR
+being invalidated. Fix this by adding the mlx5 enumeration for fencing
+RDMA/atomic operations and fix the logic to apply this.
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
+Signed-off-by: Eli Cohen <eli@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/qp.c | 7 ++++---
+ include/linux/mlx5/qp.h | 1 +
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -2037,10 +2037,11 @@ static u8 get_fence(u8 fence, struct ib_
+ return MLX5_FENCE_MODE_SMALL_AND_FENCE;
+ else
+ return fence;
+-
+- } else {
+- return 0;
++ } else if (unlikely(wr->send_flags & IB_SEND_FENCE)) {
++ return MLX5_FENCE_MODE_FENCE;
+ }
++
++ return 0;
+ }
+
+ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
+--- a/include/linux/mlx5/qp.h
++++ b/include/linux/mlx5/qp.h
+@@ -137,6 +137,7 @@ enum {
+ enum {
+ MLX5_FENCE_MODE_NONE = 0 << 5,
+ MLX5_FENCE_MODE_INITIATOR_SMALL = 1 << 5,
++ MLX5_FENCE_MODE_FENCE = 2 << 5,
+ MLX5_FENCE_MODE_STRONG_ORDERING = 3 << 5,
+ MLX5_FENCE_MODE_SMALL_AND_FENCE = 4 << 5,
+ };
--- /dev/null
+From 0540d8148d419bf769e5aa99c77027febd8922f0 Mon Sep 17 00:00:00 2001
+From: Noa Osherovich <noaos@mellanox.com>
+Date: Sat, 4 Jun 2016 15:15:32 +0300
+Subject: IB/mlx5: Fix returned values of query QP
+
+From: Noa Osherovich <noaos@mellanox.com>
+
+commit 0540d8148d419bf769e5aa99c77027febd8922f0 upstream.
+
+Some variables were not initialized properly: max_recv_wr,
+max_recv_sge, max_send_wr, qp_context and max_inline_data.
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB...')
+Signed-off-by: Noa Osherovich <noaos@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/qp.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -169,6 +169,8 @@ static int set_rq_size(struct mlx5_ib_de
+ qp->rq.max_gs = 0;
+ qp->rq.wqe_cnt = 0;
+ qp->rq.wqe_shift = 0;
++ cap->max_recv_wr = 0;
++ cap->max_recv_sge = 0;
+ } else {
+ if (ucmd) {
+ qp->rq.wqe_cnt = ucmd->rq_wqe_count;
+@@ -2503,17 +2505,19 @@ int mlx5_ib_query_qp(struct ib_qp *ibqp,
+ qp_attr->cap.max_recv_sge = qp->rq.max_gs;
+
+ if (!ibqp->uobject) {
+- qp_attr->cap.max_send_wr = qp->sq.wqe_cnt;
++ qp_attr->cap.max_send_wr = qp->sq.max_post;
+ qp_attr->cap.max_send_sge = qp->sq.max_gs;
++ qp_init_attr->qp_context = ibqp->qp_context;
+ } else {
+ qp_attr->cap.max_send_wr = 0;
+ qp_attr->cap.max_send_sge = 0;
+ }
+
+- /* We don't support inline sends for kernel QPs (yet), and we
+- * don't know what userspace's value should be.
+- */
+- qp_attr->cap.max_inline_data = 0;
++ qp_init_attr->qp_type = ibqp->qp_type;
++ qp_init_attr->recv_cq = ibqp->recv_cq;
++ qp_init_attr->send_cq = ibqp->send_cq;
++ qp_init_attr->srq = ibqp->srq;
++ qp_attr->cap.max_inline_data = qp->max_inline_data;
+
+ qp_init_attr->cap = qp_attr->cap;
+
--- /dev/null
+From 6154c187b97ee7513046bb4eb317a89f738f13ef Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Thu, 4 Aug 2016 17:36:08 +0100
+Subject: metag: Fix __cmpxchg_u32 asm constraint for CMP
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 6154c187b97ee7513046bb4eb317a89f738f13ef upstream.
+
+The LNKGET based atomic sequence in __cmpxchg_u32 has slightly incorrect
+constraints for the return value which under certain circumstances can
+allow an address unit register to be used as the first operand of a CMP
+instruction. This isn't a valid instruction however as the encodings
+only allow a data unit to be specified. This would result in an
+assembler error like the following:
+
+ Error: failed to assemble instruction: "CMP A0.2,D0Ar6"
+
+Fix by changing the constraint from "=&da" (assigned, early clobbered,
+data or address unit register) to "=&d" (data unit register only).
+
+The constraint for the second operand, "bd" (an op2 register where op1
+is a data unit register and the instruction supports O2R) is already
+correct assuming the first operand is a data unit register.
+
+Other cases of CMP in inline asm have had their constraints checked, and
+appear to all be fine.
+
+Fixes: 6006c0d8ce94 ("metag: Atomics, locks and bitops")
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: linux-metag@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/metag/include/asm/cmpxchg_lnkget.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/metag/include/asm/cmpxchg_lnkget.h
++++ b/arch/metag/include/asm/cmpxchg_lnkget.h
+@@ -73,7 +73,7 @@ static inline unsigned long __cmpxchg_u3
+ " DCACHE [%2], %0\n"
+ #endif
+ "2:\n"
+- : "=&d" (temp), "=&da" (retval)
++ : "=&d" (temp), "=&d" (retval)
+ : "da" (m), "bd" (old), "da" (new)
+ : "cc"
+ );
drm-radeon-fix-firmware-info-version-checks.patch
drm-radeon-support-backlight-control-for-uniphy3.patch
drm-i915-dp-revert-drm-i915-dp-fall-back-to-18-bpp-when-sink-capability-is-unknown.patch
+balloon-check-the-number-of-available-pages-in-leak-balloon.patch
+ftrace-recordmcount-work-around-for-addition-of-metag-magic-but-not-relocations.patch
+metag-fix-__cmpxchg_u32-asm-constraint-for-cmp.patch
+ib-mlx5-fix-modify_qp-command-input-structure.patch
+ib-mlx5-fix-entries-checks-in-mlx5_ib_create_cq.patch
+ib-mlx5-fix-returned-values-of-query-qp.patch
+ib-mlx5-fix-post-send-fence-logic.patch
+ib-ipoib-don-t-update-neigh-validity-for-unresolved-entries.patch
+ib-mlx4-fix-the-sq-size-of-an-rc-qp.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
