From: Greg Kroah-Hartman Date: Thu, 18 Aug 2016 12:43:53 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v3.14.77~11 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6defbf8909772c47e2de4759715b7f2e702665f2;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: alsa-hda-add-amd-bonaire-az-pci-id-with-proper-driver-caps.patch alsa-hda-fix-headset-mic-detection-problem-for-two-dell-machines.patch alsa-hda-fix-krealloc-with-__gfp_zero-usage.patch alsa-hda-realtek-can-t-adjust-speaker-s-volume-on-a-dell-aio.patch balloon-check-the-number-of-available-pages-in-leak-balloon.patch block-add-missing-group-association-in-bio-cloning-functions.patch block-fix-bdi-vs-gendisk-lifetime-mismatch.patch ftrace-recordmcount-work-around-for-addition-of-metag-magic-but-not-relocations.patch ib-ipoib-don-t-update-neigh-validity-for-unresolved-entries.patch ib-iwpm-fix-a-potential-skb-leak.patch ib-mlx4-fix-error-flow-when-sending-mads-under-sriov.patch ib-mlx4-fix-memory-leak-if-qp-creation-failed.patch ib-mlx4-fix-the-sq-size-of-an-rc-qp.patch ib-mlx5-check-blueflame-hca-support.patch ib-mlx5-fix-entries-check-in-mlx5_ib_resize_cq.patch ib-mlx5-fix-entries-checks-in-mlx5_ib_create_cq.patch ib-mlx5-fix-modify_qp-command-input-structure.patch ib-mlx5-fix-post-send-fence-logic.patch ib-mlx5-fix-returned-values-of-query-qp.patch ib-mlx5-return-port_err-in-active-to-initializing-tranisition.patch ib-sa-use-correct-free-function.patch metag-fix-__cmpxchg_u32-asm-constraint-for-cmp.patch mm-hugetlb-avoid-soft-lockup-in-set_max_huge_pages.patch mtd-nand-fix-bug-writing-1-byte-less-than-page-size.patch --- diff --git a/queue-4.4/alsa-hda-add-amd-bonaire-az-pci-id-with-proper-driver-caps.patch b/queue-4.4/alsa-hda-add-amd-bonaire-az-pci-id-with-proper-driver-caps.patch new file mode 100644 index 00000000000..aef3c0ae68e --- /dev/null +++ b/queue-4.4/alsa-hda-add-amd-bonaire-az-pci-id-with-proper-driver-caps.patch @@ -0,0 +1,31 @@ +From fd48331f9b71d2add941adaee3619f5b8527182d Mon Sep 17 00:00:00 2001 +From: Maruthi Srinivas Bayyavarapu +Date: Wed, 3 Aug 2016 16:46:39 +0530 +Subject: ALSA: hda: add AMD Bonaire AZ PCI ID with proper driver caps + +From: Maruthi Srinivas Bayyavarapu + +commit fd48331f9b71d2add941adaee3619f5b8527182d upstream. + +This commit fixes garbled audio on Bonaire HDMI + +Signed-off-by: Maruthi Bayyavarapu +Reviewed-by: Alex Deucher +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2288,6 +2288,8 @@ static const struct pci_device_id azx_id + { PCI_DEVICE(0x1022, 0x780d), + .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, + /* ATI HDMI */ ++ { PCI_DEVICE(0x1002, 0x0002), ++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, + { PCI_DEVICE(0x1002, 0x1308), + .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, + { PCI_DEVICE(0x1002, 0x157a), diff --git a/queue-4.4/alsa-hda-fix-headset-mic-detection-problem-for-two-dell-machines.patch b/queue-4.4/alsa-hda-fix-headset-mic-detection-problem-for-two-dell-machines.patch new file mode 100644 index 00000000000..0608352c261 --- /dev/null +++ b/queue-4.4/alsa-hda-fix-headset-mic-detection-problem-for-two-dell-machines.patch @@ -0,0 +1,46 @@ +From 59ec4b57bcaede46546d54d037a21004b9aa5cef Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Thu, 4 Aug 2016 15:28:04 +0800 +Subject: ALSA: hda - Fix headset mic detection problem for two dell machines + +From: Hui Wang + +commit 59ec4b57bcaede46546d54d037a21004b9aa5cef upstream. + +One of the machines has ALC255 on it, another one has ALC298 on it. + +On the machine with the codec ALC298, it also has the speaker volume +problem, so we add the fixup chained to ALC298_FIXUP_SPK_VOLUME rather +than adding a group of pin definition in the pin quirk table, since +the speak volume problem does not happen on other machines yet. + +Signed-off-by: Hui Wang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5498,6 +5498,8 @@ static const struct hda_fixup alc269_fix + [ALC298_FIXUP_SPK_VOLUME] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc298_fixup_speaker_volume, ++ .chained = true, ++ .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, + }, + }; + +@@ -5821,6 +5823,10 @@ static const struct snd_hda_pin_quirk al + {0x1b, 0x01014020}, + {0x21, 0x0221103f}), + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x14, 0x90170130}, ++ {0x1b, 0x02011020}, ++ {0x21, 0x0221103f}), ++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x14, 0x90170150}, + {0x1b, 0x02011020}, + {0x21, 0x0221105f}), diff --git a/queue-4.4/alsa-hda-fix-krealloc-with-__gfp_zero-usage.patch b/queue-4.4/alsa-hda-fix-krealloc-with-__gfp_zero-usage.patch new file mode 100644 index 00000000000..dd1b80f83e2 --- /dev/null +++ b/queue-4.4/alsa-hda-fix-krealloc-with-__gfp_zero-usage.patch @@ -0,0 +1,40 @@ +From 33baefe5e72f17a6df378e48196cd8cada11deec Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 3 Aug 2016 15:13:00 +0200 +Subject: ALSA: hda: Fix krealloc() with __GFP_ZERO usage + +From: Takashi Iwai + +commit 33baefe5e72f17a6df378e48196cd8cada11deec upstream. + +krealloc() doesn't work always properly with __GFP_ZERO flag as +expected. For clearing the reallocated area, we need to clear +explicitly instead. + +Reported-by: Joe Perches +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/hda/array.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/hda/array.c ++++ b/sound/hda/array.c +@@ -21,13 +21,15 @@ void *snd_array_new(struct snd_array *ar + return NULL; + if (array->used >= array->alloced) { + int num = array->alloced + array->alloc_align; ++ int oldsize = array->alloced * array->elem_size; + int size = (num + 1) * array->elem_size; + void *nlist; + if (snd_BUG_ON(num >= 4096)) + return NULL; +- nlist = krealloc(array->list, size, GFP_KERNEL | __GFP_ZERO); ++ nlist = krealloc(array->list, size, GFP_KERNEL); + if (!nlist) + return NULL; ++ memset(nlist + oldsize, 0, size - oldsize); + array->list = nlist; + array->alloced = num; + } diff --git a/queue-4.4/alsa-hda-realtek-can-t-adjust-speaker-s-volume-on-a-dell-aio.patch b/queue-4.4/alsa-hda-realtek-can-t-adjust-speaker-s-volume-on-a-dell-aio.patch new file mode 100644 index 00000000000..fa468ec9f48 --- /dev/null +++ b/queue-4.4/alsa-hda-realtek-can-t-adjust-speaker-s-volume-on-a-dell-aio.patch @@ -0,0 +1,74 @@ +From dd9aa335c88003d131ac874e7f6809902de0b847 Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Mon, 1 Aug 2016 10:20:32 +0800 +Subject: ALSA: hda/realtek - Can't adjust speaker's volume on a Dell AIO + +From: Hui Wang + +commit dd9aa335c88003d131ac874e7f6809902de0b847 upstream. + +We have a Dell AIO on which we can't adjust its speaker's volume. +The problem is it is connected to a Audio Output node without Amp-out +capability. To fix it, we change it to be connnected to a node with +Amp-out capability. + +Signed-off-by: Hui Wang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4674,6 +4674,22 @@ static void alc290_fixup_mono_speakers(s + } + } + ++static void alc298_fixup_speaker_volume(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ /* The speaker is routed to the Node 0x06 by a mistake, as a result ++ we can't adjust the speaker's volume since this node does not has ++ Amp-out capability. we change the speaker's route to: ++ Node 0x02 (Audio Output) -> Node 0x0c (Audio Mixer) -> Node 0x17 ( ++ Pin Complex), since Node 0x02 has Amp-out caps, we can adjust ++ speaker's volume now. */ ++ ++ hda_nid_t conn1[1] = { 0x0c }; ++ snd_hda_override_conn_list(codec, 0x17, 1, conn1); ++ } ++} ++ + /* Hook to update amp GPIO4 for automute */ + static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec, + struct hda_jack_callback *jack) +@@ -4823,6 +4839,7 @@ enum { + ALC280_FIXUP_HP_HEADSET_MIC, + ALC221_FIXUP_HP_FRONT_MIC, + ALC292_FIXUP_TPT460, ++ ALC298_FIXUP_SPK_VOLUME, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -5478,6 +5495,10 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE, + }, ++ [ALC298_FIXUP_SPK_VOLUME] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc298_fixup_speaker_volume, ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -5524,6 +5545,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), + SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), ++ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), diff --git a/queue-4.4/balloon-check-the-number-of-available-pages-in-leak-balloon.patch b/queue-4.4/balloon-check-the-number-of-available-pages-in-leak-balloon.patch new file mode 100644 index 00000000000..4167aa32dbe --- /dev/null +++ b/queue-4.4/balloon-check-the-number-of-available-pages-in-leak-balloon.patch @@ -0,0 +1,40 @@ +From 37cf99e08c6fb4dcea0f9ad2b13b6daa8c76a711 Mon Sep 17 00:00:00 2001 +From: Konstantin Neumoin +Date: Mon, 11 Jul 2016 15:28:59 +0300 +Subject: balloon: check the number of available pages in leak balloon + +From: Konstantin Neumoin + +commit 37cf99e08c6fb4dcea0f9ad2b13b6daa8c76a711 upstream. + +The balloon has a special mechanism that is subscribed to the oom +notification which leads to deflation for a fixed number of pages. +The number is always fixed even when the balloon is fully deflated. +But leak_balloon did not expect that the pages to deflate will be more +than taken, and raise a "BUG" in balloon_page_dequeue when page list +will be empty. + +So, the simplest solution would be to check that the number of releases +pages is less or equal to the number taken pages. + +Signed-off-by: Konstantin Neumoin +Signed-off-by: Denis V. Lunev +CC: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/virtio/virtio_balloon.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/virtio/virtio_balloon.c ++++ b/drivers/virtio/virtio_balloon.c +@@ -196,6 +196,8 @@ static unsigned leak_balloon(struct virt + num = min(num, ARRAY_SIZE(vb->pfns)); + + mutex_lock(&vb->balloon_lock); ++ /* We can't release more pages than taken */ ++ num = min(num, (size_t)vb->num_pages); + for (vb->num_pfns = 0; vb->num_pfns < num; + vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE) { + page = balloon_page_dequeue(vb_dev_info); diff --git a/queue-4.4/block-add-missing-group-association-in-bio-cloning-functions.patch b/queue-4.4/block-add-missing-group-association-in-bio-cloning-functions.patch new file mode 100644 index 00000000000..9d951e11f6b --- /dev/null +++ b/queue-4.4/block-add-missing-group-association-in-bio-cloning-functions.patch @@ -0,0 +1,107 @@ +From 20bd723ec6a3261df5e02250cd3a1fbb09a343f2 Mon Sep 17 00:00:00 2001 +From: Paolo Valente +Date: Wed, 27 Jul 2016 07:22:05 +0200 +Subject: block: add missing group association in bio-cloning functions + +From: Paolo Valente + +commit 20bd723ec6a3261df5e02250cd3a1fbb09a343f2 upstream. + +When a bio is cloned, the newly created bio must be associated with +the same blkcg as the original bio (if BLK_CGROUP is enabled). If +this operation is not performed, then the new bio is not associated +with any group, and the group of the current task is returned when +the group of the bio is requested. + +Depending on the cloning frequency, this may cause a large +percentage of the bios belonging to a given group to be treated +as if belonging to other groups (in most cases as if belonging to +the root group). The expected group isolation may thereby be broken. + +This commit adds the missing association in bio-cloning functions. + +Fixes: da2f0f74cf7d ("Btrfs: add support for blkio controllers") + +Signed-off-by: Paolo Valente +Reviewed-by: Nikolay Borisov +Reviewed-by: Jeff Moyer +Acked-by: Tejun Heo +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/bio.c | 15 +++++++++++++++ + fs/btrfs/extent_io.c | 6 ------ + include/linux/bio.h | 3 +++ + 3 files changed, 18 insertions(+), 6 deletions(-) + +--- a/block/bio.c ++++ b/block/bio.c +@@ -584,6 +584,8 @@ void __bio_clone_fast(struct bio *bio, s + bio->bi_rw = bio_src->bi_rw; + bio->bi_iter = bio_src->bi_iter; + bio->bi_io_vec = bio_src->bi_io_vec; ++ ++ bio_clone_blkcg_association(bio, bio_src); + } + EXPORT_SYMBOL(__bio_clone_fast); + +@@ -689,6 +691,8 @@ integrity_clone: + } + } + ++ bio_clone_blkcg_association(bio, bio_src); ++ + return bio; + } + EXPORT_SYMBOL(bio_clone_bioset); +@@ -2014,6 +2018,17 @@ void bio_disassociate_task(struct bio *b + } + } + ++/** ++ * bio_clone_blkcg_association - clone blkcg association from src to dst bio ++ * @dst: destination bio ++ * @src: source bio ++ */ ++void bio_clone_blkcg_association(struct bio *dst, struct bio *src) ++{ ++ if (src->bi_css) ++ WARN_ON(bio_associate_blkcg(dst, src->bi_css)); ++} ++ + #endif /* CONFIG_BLK_CGROUP */ + + static void __init biovec_init_slabs(void) +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -2786,12 +2786,6 @@ struct bio *btrfs_bio_clone(struct bio * + btrfs_bio->csum = NULL; + btrfs_bio->csum_allocated = NULL; + btrfs_bio->end_io = NULL; +- +-#ifdef CONFIG_BLK_CGROUP +- /* FIXME, put this into bio_clone_bioset */ +- if (bio->bi_css) +- bio_associate_blkcg(new, bio->bi_css); +-#endif + } + return new; + } +--- a/include/linux/bio.h ++++ b/include/linux/bio.h +@@ -527,11 +527,14 @@ extern unsigned int bvec_nr_vecs(unsigne + int bio_associate_blkcg(struct bio *bio, struct cgroup_subsys_state *blkcg_css); + int bio_associate_current(struct bio *bio); + void bio_disassociate_task(struct bio *bio); ++void bio_clone_blkcg_association(struct bio *dst, struct bio *src); + #else /* CONFIG_BLK_CGROUP */ + static inline int bio_associate_blkcg(struct bio *bio, + struct cgroup_subsys_state *blkcg_css) { return 0; } + static inline int bio_associate_current(struct bio *bio) { return -ENOENT; } + static inline void bio_disassociate_task(struct bio *bio) { } ++static inline void bio_clone_blkcg_association(struct bio *dst, ++ struct bio *src) { } + #endif /* CONFIG_BLK_CGROUP */ + + #ifdef CONFIG_HIGHMEM diff --git a/queue-4.4/block-fix-bdi-vs-gendisk-lifetime-mismatch.patch b/queue-4.4/block-fix-bdi-vs-gendisk-lifetime-mismatch.patch new file mode 100644 index 00000000000..d9acc0e86c2 --- /dev/null +++ b/queue-4.4/block-fix-bdi-vs-gendisk-lifetime-mismatch.patch @@ -0,0 +1,122 @@ +From df08c32ce3be5be138c1dbfcba203314a3a7cd6f Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Sun, 31 Jul 2016 11:15:13 -0700 +Subject: block: fix bdi vs gendisk lifetime mismatch + +From: Dan Williams + +commit df08c32ce3be5be138c1dbfcba203314a3a7cd6f upstream. + +The name for a bdi of a gendisk is derived from the gendisk's devt. +However, since the gendisk is destroyed before the bdi it leaves a +window where a new gendisk could dynamically reuse the same devt while a +bdi with the same name is still live. Arrange for the bdi to hold a +reference against its "owner" disk device while it is registered. +Otherwise we can hit sysfs duplicate name collisions like the following: + + WARNING: CPU: 10 PID: 2078 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x64/0x80 + sysfs: cannot create duplicate filename '/devices/virtual/bdi/259:1' + + Hardware name: HP ProLiant DL580 Gen8, BIOS P79 05/06/2015 + 0000000000000286 0000000002c04ad5 ffff88006f24f970 ffffffff8134caec + ffff88006f24f9c0 0000000000000000 ffff88006f24f9b0 ffffffff8108c351 + 0000001f0000000c ffff88105d236000 ffff88105d1031e0 ffff8800357427f8 + Call Trace: + [] dump_stack+0x63/0x87 + [] __warn+0xd1/0xf0 + [] warn_slowpath_fmt+0x5f/0x80 + [] sysfs_warn_dup+0x64/0x80 + [] sysfs_create_dir_ns+0x7e/0x90 + [] kobject_add_internal+0xaa/0x320 + [] ? vsnprintf+0x34e/0x4d0 + [] kobject_add+0x75/0xd0 + [] ? mutex_lock+0x12/0x2f + [] device_add+0x125/0x610 + [] device_create_groups_vargs+0xd8/0x100 + [] device_create_vargs+0x1c/0x20 + [] bdi_register+0x8c/0x180 + [] bdi_register_dev+0x27/0x30 + [] add_disk+0x175/0x4a0 + +Reported-by: Yi Zhang +Tested-by: Yi Zhang +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +Fixed up missing 0 return in bdi_register_owner(). + +Signed-off-by: Jens Axboe + +--- + block/genhd.c | 2 +- + include/linux/backing-dev-defs.h | 1 + + include/linux/backing-dev.h | 1 + + mm/backing-dev.c | 19 +++++++++++++++++++ + 4 files changed, 22 insertions(+), 1 deletion(-) + +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -612,7 +612,7 @@ void add_disk(struct gendisk *disk) + + /* Register BDI before referencing it from bdev */ + bdi = &disk->queue->backing_dev_info; +- bdi_register_dev(bdi, disk_devt(disk)); ++ bdi_register_owner(bdi, disk_to_dev(disk)); + + blk_register_region(disk_devt(disk), disk->minors, NULL, + exact_match, exact_lock, disk); +--- a/include/linux/backing-dev-defs.h ++++ b/include/linux/backing-dev-defs.h +@@ -163,6 +163,7 @@ struct backing_dev_info { + wait_queue_head_t wb_waitq; + + struct device *dev; ++ struct device *owner; + + struct timer_list laptop_mode_wb_timer; + +--- a/include/linux/backing-dev.h ++++ b/include/linux/backing-dev.h +@@ -24,6 +24,7 @@ __printf(3, 4) + int bdi_register(struct backing_dev_info *bdi, struct device *parent, + const char *fmt, ...); + int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev); ++int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner); + void bdi_unregister(struct backing_dev_info *bdi); + + int __must_check bdi_setup_and_register(struct backing_dev_info *, char *); +--- a/mm/backing-dev.c ++++ b/mm/backing-dev.c +@@ -825,6 +825,20 @@ int bdi_register_dev(struct backing_dev_ + } + EXPORT_SYMBOL(bdi_register_dev); + ++int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner) ++{ ++ int rc; ++ ++ rc = bdi_register(bdi, NULL, "%u:%u", MAJOR(owner->devt), ++ MINOR(owner->devt)); ++ if (rc) ++ return rc; ++ bdi->owner = owner; ++ get_device(owner); ++ return 0; ++} ++EXPORT_SYMBOL(bdi_register_owner); ++ + /* + * Remove bdi from bdi_list, and ensure that it is no longer visible + */ +@@ -849,6 +863,11 @@ void bdi_unregister(struct backing_dev_i + device_unregister(bdi->dev); + bdi->dev = NULL; + } ++ ++ if (bdi->owner) { ++ put_device(bdi->owner); ++ bdi->owner = NULL; ++ } + } + + void bdi_exit(struct backing_dev_info *bdi) diff --git a/queue-4.4/ftrace-recordmcount-work-around-for-addition-of-metag-magic-but-not-relocations.patch b/queue-4.4/ftrace-recordmcount-work-around-for-addition-of-metag-magic-but-not-relocations.patch new file mode 100644 index 00000000000..a4f9d9e7ba3 --- /dev/null +++ b/queue-4.4/ftrace-recordmcount-work-around-for-addition-of-metag-magic-but-not-relocations.patch @@ -0,0 +1,61 @@ +From b2e1c26f0b62531636509fbcb6dab65617ed8331 Mon Sep 17 00:00:00 2001 +From: Laura Abbott +Date: Fri, 8 Jul 2016 12:18:50 -0700 +Subject: ftrace/recordmcount: Work around for addition of metag magic but not relocations + +From: Laura Abbott + +commit b2e1c26f0b62531636509fbcb6dab65617ed8331 upstream. + +glibc recently did a sync up (94e73c95d9b5 "elf.h: Sync with the gabi +webpage") that added a #define for EM_METAG but did not add relocations + +This triggers build errors: + +scripts/recordmcount.c: In function 'do_file': +scripts/recordmcount.c:466:28: error: 'R_METAG_ADDR32' undeclared (first use in this function) + case EM_METAG: reltype = R_METAG_ADDR32; + ^~~~~~~~~~~~~~ +scripts/recordmcount.c:466:28: note: each undeclared identifier is reported only once for each function it appears in +scripts/recordmcount.c:468:20: error: 'R_METAG_NONE' undeclared (first use in this function) + rel_type_nop = R_METAG_NONE; + ^~~~~~~~~~~~ + +Work around this change with some more #ifdefery for the relocations. + +Fedora Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1354034 + +Link: http://lkml.kernel.org/r/1468005530-14757-1-git-send-email-labbott@redhat.com + +Cc: James Hogan +Fixes: 00512bdd4573 ("metag: ftrace support") +Reported-by: Ross Burton +Signed-off-by: Laura Abbott +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/recordmcount.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/scripts/recordmcount.c ++++ b/scripts/recordmcount.c +@@ -33,10 +33,17 @@ + #include + #include + ++/* ++ * glibc synced up and added the metag number but didn't add the relocations. ++ * Work around this in a crude manner for now. ++ */ + #ifndef EM_METAG +-/* Remove this when these make it to the standard system elf.h. */ + #define EM_METAG 174 ++#endif ++#ifndef R_METAG_ADDR32 + #define R_METAG_ADDR32 2 ++#endif ++#ifndef R_METAG_NONE + #define R_METAG_NONE 3 + #endif + diff --git a/queue-4.4/ib-ipoib-don-t-update-neigh-validity-for-unresolved-entries.patch b/queue-4.4/ib-ipoib-don-t-update-neigh-validity-for-unresolved-entries.patch new file mode 100644 index 00000000000..eefed78fa8f --- /dev/null +++ b/queue-4.4/ib-ipoib-don-t-update-neigh-validity-for-unresolved-entries.patch @@ -0,0 +1,39 @@ +From 61c78eea9516a921799c17b4c20558e2aa780fd3 Mon Sep 17 00:00:00 2001 +From: Erez Shitrit +Date: Sat, 4 Jun 2016 15:15:19 +0300 +Subject: IB/IPoIB: Don't update neigh validity for unresolved entries + +From: Erez Shitrit + +commit 61c78eea9516a921799c17b4c20558e2aa780fd3 upstream. + +ipoib_neigh_get unconditionally updates the "alive" variable member on +any packet send. This prevents the neighbor garbage collection from +cleaning out a dead neighbor entry if we are still queueing packets +for it. If the queue for this neighbor is full, then don't update the +alive timestamp. That way the neighbor can time out even if packets +are still being queued as long as none of them are being sent. + +Fixes: b63b70d87741 ("IPoIB: Use a private hash table for path lookup in xmit path") +Signed-off-by: Erez Shitrit +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -1131,7 +1131,9 @@ struct ipoib_neigh *ipoib_neigh_get(stru + neigh = NULL; + goto out_unlock; + } +- neigh->alive = jiffies; ++ ++ if (likely(skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE)) ++ neigh->alive = jiffies; + goto out_unlock; + } + } diff --git a/queue-4.4/ib-iwpm-fix-a-potential-skb-leak.patch b/queue-4.4/ib-iwpm-fix-a-potential-skb-leak.patch new file mode 100644 index 00000000000..4f8baa31b4e --- /dev/null +++ b/queue-4.4/ib-iwpm-fix-a-potential-skb-leak.patch @@ -0,0 +1,36 @@ +From 5ed935e861a4cbf2158ad3386d6d26edd60d2658 Mon Sep 17 00:00:00 2001 +From: Mark Bloch +Date: Fri, 6 May 2016 22:45:24 +0300 +Subject: IB/IWPM: Fix a potential skb leak + +From: Mark Bloch + +commit 5ed935e861a4cbf2158ad3386d6d26edd60d2658 upstream. + +In case ibnl_put_msg fails in send_nlmsg_done, +the function returns with -ENOMEM without freeing. + +This patch fixes this behavior. + +Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service") +Signed-off-by: Mark Bloch +Reviewed-by: Leon Romanovsky +Signed-off-by: Leon Romanovsky +Reviewed-by: Steve Wise +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/iwpm_util.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/core/iwpm_util.c ++++ b/drivers/infiniband/core/iwpm_util.c +@@ -634,6 +634,7 @@ static int send_nlmsg_done(struct sk_buf + if (!(ibnl_put_msg(skb, &nlh, 0, 0, nl_client, + RDMA_NL_IWPM_MAPINFO, NLM_F_MULTI))) { + pr_warn("%s Unable to put NLMSG_DONE\n", __func__); ++ dev_kfree_skb(skb); + return -ENOMEM; + } + nlh->nlmsg_type = NLMSG_DONE; diff --git a/queue-4.4/ib-mlx4-fix-error-flow-when-sending-mads-under-sriov.patch b/queue-4.4/ib-mlx4-fix-error-flow-when-sending-mads-under-sriov.patch new file mode 100644 index 00000000000..ca3bfecbc04 --- /dev/null +++ b/queue-4.4/ib-mlx4-fix-error-flow-when-sending-mads-under-sriov.patch @@ -0,0 +1,76 @@ +From a6100603a4a87fc436199362bdb81cb849faaf6e Mon Sep 17 00:00:00 2001 +From: Yishai Hadas +Date: Wed, 22 Jun 2016 17:27:29 +0300 +Subject: IB/mlx4: Fix error flow when sending mads under SRIOV + +From: Yishai Hadas + +commit a6100603a4a87fc436199362bdb81cb849faaf6e upstream. + +Fix mad send error flow to prevent double freeing address handles, +and leaking tx_ring entries when SRIOV is active. + +If ib_mad_post_send fails, the address handle pointer in the tx_ring entry +must be set to NULL (or there will be a double-free) and tx_tail must be +incremented (or there will be a leak of tx_ring entries). +The tx_ring is handled the same way in the send-completion handler. + +Fixes: 37bfc7c1e83f ("IB/mlx4: SR-IOV multiplex and demultiplex MADs") +Signed-off-by: Yishai Hadas +Reviewed-by: Jack Morgenstein +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx4/mad.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +--- a/drivers/infiniband/hw/mlx4/mad.c ++++ b/drivers/infiniband/hw/mlx4/mad.c +@@ -526,7 +526,7 @@ int mlx4_ib_send_to_slave(struct mlx4_ib + tun_tx_ix = (++tun_qp->tx_ix_head) & (MLX4_NUM_TUNNEL_BUFS - 1); + spin_unlock(&tun_qp->tx_lock); + if (ret) +- goto out; ++ goto end; + + tun_mad = (struct mlx4_rcv_tunnel_mad *) (tun_qp->tx_ring[tun_tx_ix].buf.addr); + if (tun_qp->tx_ring[tun_tx_ix].ah) +@@ -595,9 +595,15 @@ int mlx4_ib_send_to_slave(struct mlx4_ib + wr.wr.send_flags = IB_SEND_SIGNALED; + + ret = ib_post_send(src_qp, &wr.wr, &bad_wr); +-out: +- if (ret) +- ib_destroy_ah(ah); ++ if (!ret) ++ return 0; ++ out: ++ spin_lock(&tun_qp->tx_lock); ++ tun_qp->tx_ix_tail++; ++ spin_unlock(&tun_qp->tx_lock); ++ tun_qp->tx_ring[tun_tx_ix].ah = NULL; ++end: ++ ib_destroy_ah(ah); + return ret; + } + +@@ -1278,9 +1284,15 @@ int mlx4_ib_send_to_wire(struct mlx4_ib_ + + + ret = ib_post_send(send_qp, &wr.wr, &bad_wr); ++ if (!ret) ++ return 0; ++ ++ spin_lock(&sqp->tx_lock); ++ sqp->tx_ix_tail++; ++ spin_unlock(&sqp->tx_lock); ++ sqp->tx_ring[wire_tx_ix].ah = NULL; + out: +- if (ret) +- ib_destroy_ah(ah); ++ ib_destroy_ah(ah); + return ret; + } + diff --git a/queue-4.4/ib-mlx4-fix-memory-leak-if-qp-creation-failed.patch b/queue-4.4/ib-mlx4-fix-memory-leak-if-qp-creation-failed.patch new file mode 100644 index 00000000000..6152bcb17a9 --- /dev/null +++ b/queue-4.4/ib-mlx4-fix-memory-leak-if-qp-creation-failed.patch @@ -0,0 +1,38 @@ +From 5b420d9cf7382c6e1512e96e02d18842d272049c Mon Sep 17 00:00:00 2001 +From: Dotan Barak +Date: Wed, 22 Jun 2016 17:27:31 +0300 +Subject: IB/mlx4: Fix memory leak if QP creation failed + +From: Dotan Barak + +commit 5b420d9cf7382c6e1512e96e02d18842d272049c upstream. + +When RC, UC, or RAW QPs are created, a qp object is allocated (kzalloc). +If at a later point (in procedure create_qp_common) the qp creation fails, +this qp object must be freed. + +Fixes: 1ffeb2eb8be99 ("IB/mlx4: SR-IOV IB context objects and proxy/tunnel SQP support") +Signed-off-by: Dotan Barak +Signed-off-by: Jack Morgenstein +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx4/qp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -1162,8 +1162,10 @@ struct ib_qp *mlx4_ib_create_qp(struct i + { + err = create_qp_common(to_mdev(pd->device), pd, init_attr, + udata, 0, &qp, gfp); +- if (err) ++ if (err) { ++ kfree(qp); + return ERR_PTR(err); ++ } + + qp->ibqp.qp_num = qp->mqp.qpn; + qp->xrcdn = xrcdn; diff --git a/queue-4.4/ib-mlx4-fix-the-sq-size-of-an-rc-qp.patch b/queue-4.4/ib-mlx4-fix-the-sq-size-of-an-rc-qp.patch new file mode 100644 index 00000000000..8c4c2f4620f --- /dev/null +++ b/queue-4.4/ib-mlx4-fix-the-sq-size-of-an-rc-qp.patch @@ -0,0 +1,36 @@ +From f2940e2c76bb554a7fbdd28ca5b90904117a9e96 Mon Sep 17 00:00:00 2001 +From: Yishai Hadas +Date: Wed, 22 Jun 2016 17:27:28 +0300 +Subject: IB/mlx4: Fix the SQ size of an RC QP + +From: Yishai Hadas + +commit f2940e2c76bb554a7fbdd28ca5b90904117a9e96 upstream. + +When calculating the required size of an RC QP send queue, leave +enough space for masked atomic operations, which require more space than +"regular" atomic operation. + +Fixes: 6fa8f719844b ("IB/mlx4: Add support for masked atomic operations") +Signed-off-by: Yishai Hadas +Reviewed-by: Jack Morgenstein +Reviewed-by: Eran Ben Elisha +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx4/qp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -357,7 +357,7 @@ static int send_wqe_overhead(enum mlx4_i + sizeof (struct mlx4_wqe_raddr_seg); + case MLX4_IB_QPT_RC: + return sizeof (struct mlx4_wqe_ctrl_seg) + +- sizeof (struct mlx4_wqe_atomic_seg) + ++ sizeof (struct mlx4_wqe_masked_atomic_seg) + + sizeof (struct mlx4_wqe_raddr_seg); + case MLX4_IB_QPT_SMI: + case MLX4_IB_QPT_GSI: diff --git a/queue-4.4/ib-mlx5-check-blueflame-hca-support.patch b/queue-4.4/ib-mlx5-check-blueflame-hca-support.patch new file mode 100644 index 00000000000..3d930b46040 --- /dev/null +++ b/queue-4.4/ib-mlx5-check-blueflame-hca-support.patch @@ -0,0 +1,36 @@ +From 2cc6ad5f2130733e561f97dba7a2052f8ea024aa Mon Sep 17 00:00:00 2001 +From: Noa Osherovich +Date: Sat, 4 Jun 2016 15:15:33 +0300 +Subject: IB/mlx5: Check BlueFlame HCA support + +From: Noa Osherovich + +commit 2cc6ad5f2130733e561f97dba7a2052f8ea024aa upstream. + +BlueFlame support is reported only for PFs when the HCA capability is +on. + +Fixes: 938fe83c8dcbb ('net/mlx5_core: New device capabilities...') +Signed-off-by: Majd Dibbiny +Signed-off-by: Noa Osherovich +Signed-off-by: Leon Romanovsky +Reviewed-by: Sagi Grimberg +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -626,7 +626,8 @@ static struct ib_ucontext *mlx5_ib_alloc + num_uars = req.total_num_uuars / MLX5_NON_FP_BF_REGS_PER_PAGE; + gross_uuars = num_uars * MLX5_BF_REGS_PER_PAGE; + resp.qp_tab_size = 1 << MLX5_CAP_GEN(dev->mdev, log_max_qp); +- resp.bf_reg_size = 1 << MLX5_CAP_GEN(dev->mdev, log_bf_reg_size); ++ if (mlx5_core_is_pf(dev->mdev) && MLX5_CAP_GEN(dev->mdev, bf)) ++ resp.bf_reg_size = 1 << MLX5_CAP_GEN(dev->mdev, log_bf_reg_size); + resp.cache_line_size = L1_CACHE_BYTES; + resp.max_sq_desc_sz = MLX5_CAP_GEN(dev->mdev, max_wqe_sz_sq); + resp.max_rq_desc_sz = MLX5_CAP_GEN(dev->mdev, max_wqe_sz_rq); diff --git a/queue-4.4/ib-mlx5-fix-entries-check-in-mlx5_ib_resize_cq.patch b/queue-4.4/ib-mlx5-fix-entries-check-in-mlx5_ib_resize_cq.patch new file mode 100644 index 00000000000..f5d80132187 --- /dev/null +++ b/queue-4.4/ib-mlx5-fix-entries-check-in-mlx5_ib_resize_cq.patch @@ -0,0 +1,44 @@ +From 3c4c37746c919c983e439ac6a7328cd2d48c10ed Mon Sep 17 00:00:00 2001 +From: Noa Osherovich +Date: Sat, 4 Jun 2016 15:15:35 +0300 +Subject: IB/mlx5: Fix entries check in mlx5_ib_resize_cq + +From: Noa Osherovich + +commit 3c4c37746c919c983e439ac6a7328cd2d48c10ed upstream. + +Verify that number of entries is less than device capability. +Add an appropriate warning message for error flow. + +Fixes: bde51583f49b ('IB/mlx5: Add support for resize CQ') +Signed-off-by: Majd Dibbiny +Signed-off-by: Noa Osherovich +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/cq.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/mlx5/cq.c ++++ b/drivers/infiniband/hw/mlx5/cq.c +@@ -1095,11 +1095,16 @@ int mlx5_ib_resize_cq(struct ib_cq *ibcq + return -ENOSYS; + } + +- if (entries < 1) ++ if (entries < 1 || ++ entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz))) { ++ mlx5_ib_warn(dev, "wrong entries number %d, max %d\n", ++ entries, ++ 1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz)); + return -EINVAL; ++ } + + entries = roundup_pow_of_two(entries + 1); +- if (entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz)) + 1) ++ if (entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz)) + 1) + return -EINVAL; + + if (entries == ibcq->cqe + 1) diff --git a/queue-4.4/ib-mlx5-fix-entries-checks-in-mlx5_ib_create_cq.patch b/queue-4.4/ib-mlx5-fix-entries-checks-in-mlx5_ib_create_cq.patch new file mode 100644 index 00000000000..5d990cd4e77 --- /dev/null +++ b/queue-4.4/ib-mlx5-fix-entries-checks-in-mlx5_ib_create_cq.patch @@ -0,0 +1,37 @@ +From 9ea578528656e191c1097798a771ff08bab6f323 Mon Sep 17 00:00:00 2001 +From: Noa Osherovich +Date: Sat, 4 Jun 2016 15:15:34 +0300 +Subject: IB/mlx5: Fix entries checks in mlx5_ib_create_cq + +From: Noa Osherovich + +commit 9ea578528656e191c1097798a771ff08bab6f323 upstream. + +Number of entries shouldn't be greater than the device's max +capability. This should be checked before rounding the entries number +to power of two. + +Fixes: 51ee86a4af639 ('IB/mlx5: Fix check of number of entries...') +Signed-off-by: Majd Dibbiny +Signed-off-by: Noa Osherovich +Signed-off-by: Leon Romanovsky +Reviewed-by: Sagi Grimberg +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/cq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx5/cq.c ++++ b/drivers/infiniband/hw/mlx5/cq.c +@@ -763,7 +763,8 @@ struct ib_cq *mlx5_ib_create_cq(struct i + if (attr->flags) + return ERR_PTR(-EINVAL); + +- if (entries < 0) ++ if (entries < 0 || ++ (entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz)))) + return ERR_PTR(-EINVAL); + + entries = roundup_pow_of_two(entries + 1); diff --git a/queue-4.4/ib-mlx5-fix-modify_qp-command-input-structure.patch b/queue-4.4/ib-mlx5-fix-modify_qp-command-input-structure.patch new file mode 100644 index 00000000000..71c74c150ee --- /dev/null +++ b/queue-4.4/ib-mlx5-fix-modify_qp-command-input-structure.patch @@ -0,0 +1,35 @@ +From e3353c268b06236d6c40fa1714c114f21f44451c Mon Sep 17 00:00:00 2001 +From: Artemy Kovalyov +Date: Fri, 17 Jun 2016 15:33:31 +0300 +Subject: IB/mlx5: Fix MODIFY_QP command input structure + +From: Artemy Kovalyov + +commit e3353c268b06236d6c40fa1714c114f21f44451c upstream. + +Make MODIFY_QP command input structure compliant to specification + +Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters') +Signed-off-by: Artemy Kovalyov +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/mlx5/qp.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/mlx5/qp.h ++++ b/include/linux/mlx5/qp.h +@@ -534,9 +534,9 @@ struct mlx5_destroy_qp_mbox_out { + struct mlx5_modify_qp_mbox_in { + struct mlx5_inbox_hdr hdr; + __be32 qpn; +- u8 rsvd1[4]; +- __be32 optparam; + u8 rsvd0[4]; ++ __be32 optparam; ++ u8 rsvd1[4]; + struct mlx5_qp_context ctx; + }; + diff --git a/queue-4.4/ib-mlx5-fix-post-send-fence-logic.patch b/queue-4.4/ib-mlx5-fix-post-send-fence-logic.patch new file mode 100644 index 00000000000..f2b061cdb2f --- /dev/null +++ b/queue-4.4/ib-mlx5-fix-post-send-fence-logic.patch @@ -0,0 +1,54 @@ +From c9b254955b9f8814966f5dabd34c39d0e0a2b437 Mon Sep 17 00:00:00 2001 +From: Eli Cohen +Date: Wed, 22 Jun 2016 17:27:26 +0300 +Subject: IB/mlx5: Fix post send fence logic + +From: Eli Cohen + +commit c9b254955b9f8814966f5dabd34c39d0e0a2b437 upstream. + +If the caller specified IB_SEND_FENCE in the send flags of the work +request and no previous work request stated that the successive one +should be fenced, the work request would be executed without a fence. +This could result in RDMA read or atomic operations failure due to a MR +being invalidated. Fix this by adding the mlx5 enumeration for fencing +RDMA/atomic operations and fix the logic to apply this. + +Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters') +Signed-off-by: Eli Cohen +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/qp.c | 7 ++++--- + include/linux/mlx5/qp.h | 1 + + 2 files changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -2527,10 +2527,11 @@ static u8 get_fence(u8 fence, struct ib_ + return MLX5_FENCE_MODE_SMALL_AND_FENCE; + else + return fence; +- +- } else { +- return 0; ++ } else if (unlikely(wr->send_flags & IB_SEND_FENCE)) { ++ return MLX5_FENCE_MODE_FENCE; + } ++ ++ return 0; + } + + static int begin_wqe(struct mlx5_ib_qp *qp, void **seg, +--- a/include/linux/mlx5/qp.h ++++ b/include/linux/mlx5/qp.h +@@ -160,6 +160,7 @@ enum { + enum { + MLX5_FENCE_MODE_NONE = 0 << 5, + MLX5_FENCE_MODE_INITIATOR_SMALL = 1 << 5, ++ MLX5_FENCE_MODE_FENCE = 2 << 5, + MLX5_FENCE_MODE_STRONG_ORDERING = 3 << 5, + MLX5_FENCE_MODE_SMALL_AND_FENCE = 4 << 5, + }; diff --git a/queue-4.4/ib-mlx5-fix-returned-values-of-query-qp.patch b/queue-4.4/ib-mlx5-fix-returned-values-of-query-qp.patch new file mode 100644 index 00000000000..730c4ea7a4d --- /dev/null +++ b/queue-4.4/ib-mlx5-fix-returned-values-of-query-qp.patch @@ -0,0 +1,59 @@ +From 0540d8148d419bf769e5aa99c77027febd8922f0 Mon Sep 17 00:00:00 2001 +From: Noa Osherovich +Date: Sat, 4 Jun 2016 15:15:32 +0300 +Subject: IB/mlx5: Fix returned values of query QP + +From: Noa Osherovich + +commit 0540d8148d419bf769e5aa99c77027febd8922f0 upstream. + +Some variables were not initialized properly: max_recv_wr, +max_recv_sge, max_send_wr, qp_context and max_inline_data. + +Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB...') +Signed-off-by: Noa Osherovich +Signed-off-by: Leon Romanovsky +Reviewed-by: Sagi Grimberg +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/qp.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -226,6 +226,8 @@ static int set_rq_size(struct mlx5_ib_de + qp->rq.max_gs = 0; + qp->rq.wqe_cnt = 0; + qp->rq.wqe_shift = 0; ++ cap->max_recv_wr = 0; ++ cap->max_recv_sge = 0; + } else { + if (ucmd) { + qp->rq.wqe_cnt = ucmd->rq_wqe_count; +@@ -3092,17 +3094,19 @@ int mlx5_ib_query_qp(struct ib_qp *ibqp, + qp_attr->cap.max_recv_sge = qp->rq.max_gs; + + if (!ibqp->uobject) { +- qp_attr->cap.max_send_wr = qp->sq.wqe_cnt; ++ qp_attr->cap.max_send_wr = qp->sq.max_post; + qp_attr->cap.max_send_sge = qp->sq.max_gs; ++ qp_init_attr->qp_context = ibqp->qp_context; + } else { + qp_attr->cap.max_send_wr = 0; + qp_attr->cap.max_send_sge = 0; + } + +- /* We don't support inline sends for kernel QPs (yet), and we +- * don't know what userspace's value should be. +- */ +- qp_attr->cap.max_inline_data = 0; ++ qp_init_attr->qp_type = ibqp->qp_type; ++ qp_init_attr->recv_cq = ibqp->recv_cq; ++ qp_init_attr->send_cq = ibqp->send_cq; ++ qp_init_attr->srq = ibqp->srq; ++ qp_attr->cap.max_inline_data = qp->max_inline_data; + + qp_init_attr->cap = qp_attr->cap; + diff --git a/queue-4.4/ib-mlx5-return-port_err-in-active-to-initializing-tranisition.patch b/queue-4.4/ib-mlx5-return-port_err-in-active-to-initializing-tranisition.patch new file mode 100644 index 00000000000..e29aa17964d --- /dev/null +++ b/queue-4.4/ib-mlx5-return-port_err-in-active-to-initializing-tranisition.patch @@ -0,0 +1,46 @@ +From 2788cf3bd90af3791c3195c52391bcf34fa67b40 Mon Sep 17 00:00:00 2001 +From: Noa Osherovich +Date: Sat, 4 Jun 2016 15:15:29 +0300 +Subject: IB/mlx5: Return PORT_ERR in Active to Initializing tranisition + +From: Noa Osherovich + +commit 2788cf3bd90af3791c3195c52391bcf34fa67b40 upstream. + +FW port-change events are fired on Active <-> non Active port state +transitions only. +When the port state changes from Active to Initializing (Active -> +Down -> Initializing), a single event is fired. +The HCA transitions from Down to Initializing unless prevented from +doing so, hence the driver should also propagate events when the port +state is Initializing to consumers so they'll be aware that the port +is no longer Active and act accordingly. + +Fixes: e126ba97dba9e ('mlx5: Add driver for Mellanox Connect-IB...') +Signed-off-by: Noa Osherovich +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/main.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -962,14 +962,11 @@ static void mlx5_ib_event(struct mlx5_co + break; + + case MLX5_DEV_EVENT_PORT_DOWN: ++ case MLX5_DEV_EVENT_PORT_INITIALIZED: + ibev.event = IB_EVENT_PORT_ERR; + port = (u8)param; + break; + +- case MLX5_DEV_EVENT_PORT_INITIALIZED: +- /* not used by ULPs */ +- return; +- + case MLX5_DEV_EVENT_LID_CHANGE: + ibev.event = IB_EVENT_LID_CHANGE; + port = (u8)param; diff --git a/queue-4.4/ib-sa-use-correct-free-function.patch b/queue-4.4/ib-sa-use-correct-free-function.patch new file mode 100644 index 00000000000..5927db2e5d3 --- /dev/null +++ b/queue-4.4/ib-sa-use-correct-free-function.patch @@ -0,0 +1,35 @@ +From 0f377d86252d11bfea941852785e3094b93601a7 Mon Sep 17 00:00:00 2001 +From: Mark Bloch +Date: Fri, 6 May 2016 22:45:27 +0300 +Subject: IB/SA: Use correct free function + +From: Mark Bloch + +commit 0f377d86252d11bfea941852785e3094b93601a7 upstream. + +Fixes a direct call to kfree_skb when nlmsg_free should be used. + +Fixes: 2ca546b92a02 ('IB/sa: Route SA pathrecord query through netlink') +Signed-off-by: Mark Bloch +Reviewed-by: Leon Romanovsky +Signed-off-by: Leon Romanovsky +Reviewed-by: Ira Weiny +Reviewed-by: Steve Wise +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/sa_query.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/core/sa_query.c ++++ b/drivers/infiniband/core/sa_query.c +@@ -534,7 +534,7 @@ static int ib_nl_send_msg(struct ib_sa_q + data = ibnl_put_msg(skb, &nlh, query->seq, 0, RDMA_NL_LS, + RDMA_NL_LS_OP_RESOLVE, NLM_F_REQUEST); + if (!data) { +- kfree_skb(skb); ++ nlmsg_free(skb); + return -EMSGSIZE; + } + diff --git a/queue-4.4/metag-fix-__cmpxchg_u32-asm-constraint-for-cmp.patch b/queue-4.4/metag-fix-__cmpxchg_u32-asm-constraint-for-cmp.patch new file mode 100644 index 00000000000..c470ecfa5df --- /dev/null +++ b/queue-4.4/metag-fix-__cmpxchg_u32-asm-constraint-for-cmp.patch @@ -0,0 +1,48 @@ +From 6154c187b97ee7513046bb4eb317a89f738f13ef Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Thu, 4 Aug 2016 17:36:08 +0100 +Subject: metag: Fix __cmpxchg_u32 asm constraint for CMP + +From: James Hogan + +commit 6154c187b97ee7513046bb4eb317a89f738f13ef upstream. + +The LNKGET based atomic sequence in __cmpxchg_u32 has slightly incorrect +constraints for the return value which under certain circumstances can +allow an address unit register to be used as the first operand of a CMP +instruction. This isn't a valid instruction however as the encodings +only allow a data unit to be specified. This would result in an +assembler error like the following: + + Error: failed to assemble instruction: "CMP A0.2,D0Ar6" + +Fix by changing the constraint from "=&da" (assigned, early clobbered, +data or address unit register) to "=&d" (data unit register only). + +The constraint for the second operand, "bd" (an op2 register where op1 +is a data unit register and the instruction supports O2R) is already +correct assuming the first operand is a data unit register. + +Other cases of CMP in inline asm have had their constraints checked, and +appear to all be fine. + +Fixes: 6006c0d8ce94 ("metag: Atomics, locks and bitops") +Signed-off-by: James Hogan +Cc: linux-metag@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/metag/include/asm/cmpxchg_lnkget.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/metag/include/asm/cmpxchg_lnkget.h ++++ b/arch/metag/include/asm/cmpxchg_lnkget.h +@@ -73,7 +73,7 @@ static inline unsigned long __cmpxchg_u3 + " DCACHE [%2], %0\n" + #endif + "2:\n" +- : "=&d" (temp), "=&da" (retval) ++ : "=&d" (temp), "=&d" (retval) + : "da" (m), "bd" (old), "da" (new) + : "cc" + ); diff --git a/queue-4.4/mm-hugetlb-avoid-soft-lockup-in-set_max_huge_pages.patch b/queue-4.4/mm-hugetlb-avoid-soft-lockup-in-set_max_huge_pages.patch new file mode 100644 index 00000000000..637db637ef1 --- /dev/null +++ b/queue-4.4/mm-hugetlb-avoid-soft-lockup-in-set_max_huge_pages.patch @@ -0,0 +1,56 @@ +From 649920c6ab93429b94bc7c1aa7c0e8395351be32 Mon Sep 17 00:00:00 2001 +From: Jia He +Date: Tue, 2 Aug 2016 14:02:31 -0700 +Subject: mm/hugetlb: avoid soft lockup in set_max_huge_pages() + +From: Jia He + +commit 649920c6ab93429b94bc7c1aa7c0e8395351be32 upstream. + +In powerpc servers with large memory(32TB), we watched several soft +lockups for hugepage under stress tests. + +The call traces are as follows: +1. +get_page_from_freelist+0x2d8/0xd50 +__alloc_pages_nodemask+0x180/0xc20 +alloc_fresh_huge_page+0xb0/0x190 +set_max_huge_pages+0x164/0x3b0 + +2. +prep_new_huge_page+0x5c/0x100 +alloc_fresh_huge_page+0xc8/0x190 +set_max_huge_pages+0x164/0x3b0 + +This patch fixes such soft lockups. It is safe to call cond_resched() +there because it is out of spin_lock/unlock section. + +Link: http://lkml.kernel.org/r/1469674442-14848-1-git-send-email-hejianet@gmail.com +Signed-off-by: Jia He +Reviewed-by: Naoya Horiguchi +Acked-by: Michal Hocko +Acked-by: Dave Hansen +Cc: Mike Kravetz +Cc: "Kirill A. Shutemov" +Cc: Paul Gortmaker +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2170,6 +2170,10 @@ static unsigned long set_max_huge_pages( + * and reducing the surplus. + */ + spin_unlock(&hugetlb_lock); ++ ++ /* yield cpu to avoid soft lockup */ ++ cond_resched(); ++ + if (hstate_is_gigantic(h)) + ret = alloc_fresh_gigantic_page(h, nodes_allowed); + else diff --git a/queue-4.4/mtd-nand-fix-bug-writing-1-byte-less-than-page-size.patch b/queue-4.4/mtd-nand-fix-bug-writing-1-byte-less-than-page-size.patch new file mode 100644 index 00000000000..00d7ccb36d4 --- /dev/null +++ b/queue-4.4/mtd-nand-fix-bug-writing-1-byte-less-than-page-size.patch @@ -0,0 +1,53 @@ +From 144f4c98399e2c0ca60eb414c15a2c68125c18b8 Mon Sep 17 00:00:00 2001 +From: Hector Palacios +Date: Mon, 18 Jul 2016 10:39:18 +0200 +Subject: mtd: nand: fix bug writing 1 byte less than page size + +From: Hector Palacios + +commit 144f4c98399e2c0ca60eb414c15a2c68125c18b8 upstream. + +nand_do_write_ops() determines if it is writing a partial page with the +formula: + part_pagewr = (column || writelen < (mtd->writesize - 1)) + +When 'writelen' is exactly 1 byte less than the NAND page size the formula +equates to zero, so the code doesn't process it as a partial write, +although it should. +As a consequence the function remains in the while(1) loop with 'writelen' +becoming 0xffffffff and iterating endlessly. + +The bug may not be easy to reproduce in Linux since user space tools +usually force the padding or round-up the write size to a page-size +multiple. +This was discovered in U-Boot where the issue can be reproduced by +writing any size that is 1 byte less than a page-size multiple. +For example, on a NAND with 2K page (0x800): + => nand erase.part + => nand write $loadaddr 7ff + +[Editor's note: the bug was added in commit 29072b96078f, but moved +around in commit 66507c7bc8895 ("mtd: nand: Add support to use nand_base +poi databuf as bounce buffer")] + +Fixes: 29072b96078f ("[MTD] NAND: add subpage write support") +Signed-off-by: Hector Palacios +Acked-by: Boris Brezillon +Signed-off-by: Brian Norris +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/nand_base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -2586,7 +2586,7 @@ static int nand_do_write_ops(struct mtd_ + int cached = writelen > bytes && page != blockmask; + uint8_t *wbuf = buf; + int use_bufpoi; +- int part_pagewr = (column || writelen < (mtd->writesize - 1)); ++ int part_pagewr = (column || writelen < mtd->writesize); + + if (part_pagewr) + use_bufpoi = 1; diff --git a/queue-4.4/series b/queue-4.4/series index a2cb4dfc372..89aa77d0b70 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -89,3 +89,27 @@ drm-restore-double-clflush-on-the-last-partial-cacheline.patch drm-edid-add-6-bpc-quirk-for-display-aeo-model-0.patch drm-i915-never-fully-mask-the-the-ei-up-rps-interrupt-on-snb-ivb.patch drm-i915-dp-revert-drm-i915-dp-fall-back-to-18-bpp-when-sink-capability-is-unknown.patch +balloon-check-the-number-of-available-pages-in-leak-balloon.patch +ftrace-recordmcount-work-around-for-addition-of-metag-magic-but-not-relocations.patch +metag-fix-__cmpxchg_u32-asm-constraint-for-cmp.patch +block-add-missing-group-association-in-bio-cloning-functions.patch +block-fix-bdi-vs-gendisk-lifetime-mismatch.patch +mtd-nand-fix-bug-writing-1-byte-less-than-page-size.patch +mm-hugetlb-avoid-soft-lockup-in-set_max_huge_pages.patch +alsa-hda-fix-krealloc-with-__gfp_zero-usage.patch +alsa-hda-realtek-can-t-adjust-speaker-s-volume-on-a-dell-aio.patch +alsa-hda-add-amd-bonaire-az-pci-id-with-proper-driver-caps.patch +alsa-hda-fix-headset-mic-detection-problem-for-two-dell-machines.patch +ib-mlx5-fix-modify_qp-command-input-structure.patch +ib-mlx5-fix-entries-checks-in-mlx5_ib_create_cq.patch +ib-mlx5-fix-returned-values-of-query-qp.patch +ib-mlx5-fix-entries-check-in-mlx5_ib_resize_cq.patch +ib-mlx5-fix-post-send-fence-logic.patch +ib-mlx5-return-port_err-in-active-to-initializing-tranisition.patch +ib-mlx5-check-blueflame-hca-support.patch +ib-sa-use-correct-free-function.patch +ib-ipoib-don-t-update-neigh-validity-for-unresolved-entries.patch +ib-iwpm-fix-a-potential-skb-leak.patch +ib-mlx4-fix-the-sq-size-of-an-rc-qp.patch +ib-mlx4-fix-error-flow-when-sending-mads-under-sriov.patch +ib-mlx4-fix-memory-leak-if-qp-creation-failed.patch