Home Home > GIT Browse > SLE12-SP3-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-02-20 07:04:33 +0100
committerKernel Build Daemon <kbuild@suse.de>2019-02-20 07:04:33 +0100
commit7e31bdd77345b8eda56d5a7828744ec5d5014d7a (patch)
tree1e69e80992d7697cdf143adf69a6db8c18e624e7
parent0d93c1735fc4db4c1321b923e4704c13c9ee47e7 (diff)
parentc5f58b3c22d96c3faa3d14c18850d983a4df4e8d (diff)
Merge branch 'SLE12-SP3' into SLE12-SP3-AZURE
-rw-r--r--patches.drivers/RDMA-bnxt_re-Synchronize-destroy_qp-with-poll_cq.patch190
-rw-r--r--patches.drivers/bnxt_re-Fix-couple-of-memory-leaks-that-could-lead-t.patch44
-rw-r--r--patches.fixes/0001-mm-page_alloc-drop-should_suppress_show_mem.patch72
-rw-r--r--series.conf3
4 files changed, 309 insertions, 0 deletions
diff --git a/patches.drivers/RDMA-bnxt_re-Synchronize-destroy_qp-with-poll_cq.patch b/patches.drivers/RDMA-bnxt_re-Synchronize-destroy_qp-with-poll_cq.patch
new file mode 100644
index 0000000000..5e921636f4
--- /dev/null
+++ b/patches.drivers/RDMA-bnxt_re-Synchronize-destroy_qp-with-poll_cq.patch
@@ -0,0 +1,190 @@
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+Date: Thu, 15 Feb 2018 21:20:11 -0800
+Subject: RDMA/bnxt_re: Synchronize destroy_qp with poll_cq
+Patch-mainline: v4.16-rc3
+Git-commit: 3b921e3bc4c20af58a663ed238ad57e87493dde2
+References: bsc#1125446
+
+Avoid system crash when destroy_qp is invoked while
+the driver is processing the poll_cq. Synchronize these
+functions using the cq_lock.
+
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 39 +++++++++++++++++++++++++++++---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.h | 2 ++
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 21 +++++------------
+ drivers/infiniband/hw/bnxt_re/qplib_fp.h | 4 +++-
+ 4 files changed, 47 insertions(+), 19 deletions(-)
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -803,19 +803,50 @@ int bnxt_re_query_ah(struct ib_ah *ib_ah
+ return 0;
+ }
+
++static unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp)
++ __acquires(&qp->scq->cq_lock) __acquires(&qp->rcq->cq_lock)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&qp->scq->cq_lock, flags);
++ if (qp->rcq != qp->scq)
++ spin_lock(&qp->rcq->cq_lock);
++ else
++ __acquire(&qp->rcq->cq_lock);
++
++ return flags;
++}
++
++static void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp,
++ unsigned long flags)
++ __releases(&qp->scq->cq_lock) __releases(&qp->rcq->cq_lock)
++{
++ if (qp->rcq != qp->scq)
++ spin_unlock(&qp->rcq->cq_lock);
++ else
++ __release(&qp->rcq->cq_lock);
++ spin_unlock_irqrestore(&qp->scq->cq_lock, flags);
++}
++
+ /* Queue Pairs */
+ int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
+ {
+ struct bnxt_re_qp *qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp);
+ struct bnxt_re_dev *rdev = qp->rdev;
+ int rc;
++ unsigned int flags;
+
+- bnxt_qplib_del_flush_qp(&qp->qplib_qp);
+ rc = bnxt_qplib_destroy_qp(&rdev->qplib_res, &qp->qplib_qp);
+ if (rc) {
+ dev_err(rdev_to_dev(rdev), "Failed to destroy HW QP");
+ return rc;
+ }
++
++ flags = bnxt_re_lock_cqs(qp);
++ bnxt_qplib_clean_qp(&qp->qplib_qp);
++ bnxt_re_unlock_cqs(qp, flags);
++ bnxt_qplib_free_qp_res(&rdev->qplib_res, &qp->qplib_qp);
++
+ if (ib_qp->qp_type == IB_QPT_GSI && rdev->qp1_sqp) {
+ rc = bnxt_qplib_destroy_ah(&rdev->qplib_res,
+ &rdev->sqp_ah->qplib_ah);
+@@ -825,7 +856,7 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_
+ return rc;
+ }
+
+- bnxt_qplib_del_flush_qp(&qp->qplib_qp);
++ bnxt_qplib_clean_qp(&qp->qplib_qp);
+ rc = bnxt_qplib_destroy_qp(&rdev->qplib_res,
+ &rdev->qp1_sqp->qplib_qp);
+ if (rc) {
+@@ -1085,6 +1116,7 @@ struct ib_qp *bnxt_re_create_qp(struct i
+ goto fail;
+ }
+ qp->qplib_qp.scq = &cq->qplib_cq;
++ qp->scq = cq;
+ }
+
+ if (qp_init_attr->recv_cq) {
+@@ -1096,6 +1128,7 @@ struct ib_qp *bnxt_re_create_qp(struct i
+ goto fail;
+ }
+ qp->qplib_qp.rcq = &cq->qplib_cq;
++ qp->rcq = cq;
+ }
+
+ if (qp_init_attr->srq) {
+@@ -1385,7 +1418,7 @@ int bnxt_re_modify_qp(struct ib_qp *ib_q
+ dev_dbg(rdev_to_dev(rdev),
+ "Move QP = %p out of flush list\n",
+ qp);
+- bnxt_qplib_del_flush_qp(&qp->qplib_qp);
++ bnxt_qplib_clean_qp(&qp->qplib_qp);
+ }
+ }
+ if (qp_attr_mask & IB_QP_EN_SQD_ASYNC_NOTIFY) {
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
+@@ -80,6 +80,8 @@ struct bnxt_re_qp {
+ /* QP1 */
+ u32 send_psn;
+ struct ib_ud_header qp1_hdr;
++ struct bnxt_re_cq *scq;
++ struct bnxt_re_cq *rcq;
+ };
+
+ struct bnxt_re_cq {
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -115,7 +115,7 @@ void bnxt_qplib_add_flush_qp(struct bnxt
+ }
+ }
+
+-void bnxt_qplib_del_flush_qp(struct bnxt_qplib_qp *qp)
++void bnxt_qplib_clean_qp(struct bnxt_qplib_qp *qp)
+ {
+ struct bnxt_qplib_cq *scq, *rcq;
+ unsigned long flags;
+@@ -1096,7 +1096,6 @@ int bnxt_qplib_destroy_qp(struct bnxt_qp
+ struct bnxt_qplib_rcfw *rcfw = res->rcfw;
+ struct cmdq_destroy_qp req;
+ struct creq_destroy_qp_resp resp;
+- unsigned long flags;
+ u16 cmd_flags = 0;
+ int rc;
+
+@@ -1114,18 +1113,13 @@ int bnxt_qplib_destroy_qp(struct bnxt_qp
+ return rc;
+ }
+
+- /* Must walk the associated CQs to nullified the QP ptr */
+- spin_lock_irqsave(&qp->scq->hwq.lock, flags);
++ return 0;
++}
+
+- __clean_cq(qp->scq, (u64)(unsigned long)qp);
+
+- if (qp->rcq && qp->rcq != qp->scq) {
+- spin_lock(&qp->rcq->hwq.lock);
+- __clean_cq(qp->rcq, (u64)(unsigned long)qp);
+- spin_unlock(&qp->rcq->hwq.lock);
+- }
+-
+- spin_unlock_irqrestore(&qp->scq->hwq.lock, flags);
++void bnxt_qplib_free_qp_res(struct bnxt_qplib_res *res,
++ struct bnxt_qplib_qp *qp)
++{
+
+ bnxt_qplib_free_qp_hdr_buf(res, qp);
+ bnxt_qplib_free_hwq(res->pdev, &qp->sq.hwq);
+@@ -1139,7 +1133,6 @@ int bnxt_qplib_destroy_qp(struct bnxt_qp
+ if (qp->orrq.max_elements)
+ bnxt_qplib_free_hwq(res->pdev, &qp->orrq);
+
+- return 0;
+ }
+
+ void *bnxt_qplib_get_qp1_sq_buf(struct bnxt_qplib_qp *qp,
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+@@ -449,6 +449,9 @@ int bnxt_qplib_create_qp(struct bnxt_qpl
+ int bnxt_qplib_modify_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp);
+ int bnxt_qplib_query_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp);
+ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp);
++void bnxt_qplib_clean_qp(struct bnxt_qplib_qp *qp);
++void bnxt_qplib_free_qp_res(struct bnxt_qplib_res *res,
++ struct bnxt_qplib_qp *qp);
+ void *bnxt_qplib_get_qp1_sq_buf(struct bnxt_qplib_qp *qp,
+ struct bnxt_qplib_sge *sge);
+ void *bnxt_qplib_get_qp1_rq_buf(struct bnxt_qplib_qp *qp,
+@@ -470,7 +473,6 @@ void bnxt_qplib_req_notify_cq(struct bnx
+ void bnxt_qplib_free_nq(struct bnxt_qplib_nq *nq);
+ int bnxt_qplib_alloc_nq(struct pci_dev *pdev, struct bnxt_qplib_nq *nq);
+ void bnxt_qplib_add_flush_qp(struct bnxt_qplib_qp *qp);
+-void bnxt_qplib_del_flush_qp(struct bnxt_qplib_qp *qp);
+ int bnxt_qplib_process_flush_list(struct bnxt_qplib_cq *cq,
+ struct bnxt_qplib_cqe *cqe,
+ int num_cqes);
diff --git a/patches.drivers/bnxt_re-Fix-couple-of-memory-leaks-that-could-lead-t.patch b/patches.drivers/bnxt_re-Fix-couple-of-memory-leaks-that-could-lead-t.patch
new file mode 100644
index 0000000000..c247b20a9c
--- /dev/null
+++ b/patches.drivers/bnxt_re-Fix-couple-of-memory-leaks-that-could-lead-t.patch
@@ -0,0 +1,44 @@
+From: Somnath Kotur <somnath.kotur@broadcom.com>
+Date: Wed, 5 Sep 2018 13:20:34 +0530
+Subject: bnxt_re: Fix couple of memory leaks that could lead to IOMMU call
+ traces
+Patch-mainline: v4.19-rc4
+Git-commit: f40f299bbe806a2e2c8b0d7cdda822fa3bdd171b
+References: bsc#1020413, FATE#321905
+
+1. DMA-able memory allocated for Shadow QP was not being freed.
+2. bnxt_qplib_alloc_qp_hdr_buf() had a bug wherein the SQ pointer was
+ erroneously pointing to the RQ. But since the corresponding
+ free_qp_hdr_buf() was correct, memory being free was less than what was
+ allocated.
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Signed-off-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 ++
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -864,6 +864,8 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_
+ "Failed to destroy Shadow QP");
+ return rc;
+ }
++ bnxt_qplib_free_qp_res(&rdev->qplib_res,
++ &rdev->qp1_sqp->qplib_qp);
+ mutex_lock(&rdev->qp_lock);
+ list_del(&rdev->qp1_sqp->list);
+ atomic_dec(&rdev->qp_count);
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -186,7 +186,7 @@ static int bnxt_qplib_alloc_qp_hdr_buf(s
+ struct bnxt_qplib_qp *qp)
+ {
+ struct bnxt_qplib_q *rq = &qp->rq;
+- struct bnxt_qplib_q *sq = &qp->rq;
++ struct bnxt_qplib_q *sq = &qp->sq;
+ int rc = 0;
+
+ if (qp->sq_hdr_buf_size && sq->hwq.max_elements) {
diff --git a/patches.fixes/0001-mm-page_alloc-drop-should_suppress_show_mem.patch b/patches.fixes/0001-mm-page_alloc-drop-should_suppress_show_mem.patch
new file mode 100644
index 0000000000..024dfe2efb
--- /dev/null
+++ b/patches.fixes/0001-mm-page_alloc-drop-should_suppress_show_mem.patch
@@ -0,0 +1,72 @@
+From 2c029a1ea3aac296cd5b47584a579defcc4b4aa0 Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.com>
+Date: Fri, 26 Oct 2018 15:06:49 -0700
+Subject: [PATCH] mm, page_alloc: drop should_suppress_show_mem
+Git-commit: 2c029a1ea3aac296cd5b47584a579defcc4b4aa0
+Patch-mainline: v4.20-rc1
+References: bnc#1125892, bnc#1106061
+
+should_suppress_show_mem() was introduced to reduce the overhead of
+show_mem on large NUMA systems. Things have changed since then though.
+Namely c78e93630d15 ("mm: do not walk all of system memory during
+show_mem") has reduced the overhead considerably.
+
+Moreover warn_alloc_show_mem clears SHOW_MEM_FILTER_NODES when called from
+the IRQ context already so we are not printing per node stats.
+
+Remove should_suppress_show_mem because we are losing potentially
+interesting information about allocation failures. We have seen a bug
+report where system gets unresponsive under memory pressure and there is
+only
+
+Kernel: [2032243.696888] qlge 0000:8b:00.1 ql1: Could not get a page chunk, i=8, clean_idx =200 .
+Kernel: [2032243.710725] swapper/7: page allocation failure: order:1, mode:0x1084120(GFP_ATOMIC|__GFP_COLD|__GFP_COMP)
+
+without an additional information for debugging. It would be great to see
+the state of the page allocator at the moment.
+
+Link: http://lkml.kernel.org/r/20180907114334.7088-1-mhocko@kernel.org
+Signed-off-by: Michal Hocko <mhocko@suse.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+
+---
+ mm/page_alloc.c | 17 +----------------
+ 1 file changed, 1 insertion(+), 16 deletions(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -3028,20 +3028,6 @@ reset_fair:
+ return NULL;
+ }
+
+-/*
+- * Large machines with many possible nodes should not always dump per-node
+- * meminfo in irq context.
+- */
+-static inline bool should_suppress_show_mem(void)
+-{
+- bool ret = false;
+-
+-#if NODES_SHIFT > 8
+- ret = in_interrupt();
+-#endif
+- return ret;
+-}
+-
+ static DEFINE_RATELIMIT_STATE(nopage_rs,
+ DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
+@@ -3083,8 +3069,7 @@ void warn_alloc_failed(gfp_t gfp_mask, u
+ pr_warn("%s: page allocation failure: order:%u, mode:%#x(%pGg)\n",
+ current->comm, order, gfp_mask, &gfp_mask);
+ dump_stack();
+- if (!should_suppress_show_mem())
+- show_mem(filter);
++ show_mem(filter);
+ }
+
+ static inline struct page *
diff --git a/series.conf b/series.conf
index 600383a1d6..03516b2950 100644
--- a/series.conf
+++ b/series.conf
@@ -23293,6 +23293,7 @@
patches.drivers/ibmvnic-Clean-RX-pool-buffers-during-device-close.patch
patches.drivers/PCI-cxgb4-Extend-T3-PCI-quirk-to-T4-devices.patch
patches.drivers/RDMA-uverbs-Protect-from-command-mask-overflow.patch
+ patches.drivers/RDMA-bnxt_re-Synchronize-destroy_qp-with-poll_cq.patch
patches.drivers/scsi-mpt3sas-fix-an-out-of-bound-write
patches.drivers/scsi-qla2xxx-Fix-a-locking-imbalance-in-qlt_24xx_han.patch
patches.drivers/scsi-qla2xxx-Fix-double-free-bug-after-firmware-time.patch
@@ -24208,6 +24209,7 @@
patches.fixes/cifs-connect-to-servername-instead-of-IP-for-IPC-share.patch
patches.fixes/ceph-avoid-a-use-after-free-in-ceph_destroy_options.patch
patches.arch/0006-kvm-x86-do-not-re-try-execute-after-failed-emulation-in-l2
+ patches.drivers/bnxt_re-Fix-couple-of-memory-leaks-that-could-lead-t.patch
patches.arch/s390-sles12sp3-22-01-01-net-af_iucv-drop-inbound-packets-with-invalid-flags.patch
patches.arch/s390-sles12sp3-22-01-02-net-af_iucv-fix-skb-handling-on-HiperTransport-xmit-.patch
patches.drivers/net-ena-fix-surprise-unplug-NULL-dereference-kernel-.patch
@@ -24339,6 +24341,7 @@
patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch
patches.arch/powerpc-traps-restore-recoverability-of-machine_chec.patch
patches.fixes/0001-mm-don-t-miss-the-last-page-because-of-round-off-err.patch
+ patches.fixes/0001-mm-page_alloc-drop-should_suppress_show_mem.patch
patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch
patches.fixes/0001-drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
patches.fixes/0001-drm-hisilicon-hibmc-Do-not-carry-error-code-in-HiBMC.patch