--- /dev/null
+From df07101e1c4a29e820df02f9989a066988b160e6 Mon Sep 17 00:00:00 2001
+From: Sean Nyekjaer <sean.nyekjaer@prevas.dk>
+Date: Tue, 22 May 2018 19:45:09 +0200
+Subject: ARM: dts: imx6q: Use correct SDMA script for SPI5 core
+
+From: Sean Nyekjaer <sean.nyekjaer@prevas.dk>
+
+commit df07101e1c4a29e820df02f9989a066988b160e6 upstream.
+
+According to the reference manual the shp_2_mcu / mcu_2_shp
+scripts must be used for devices connected through the SPBA.
+
+This fixes an issue we saw with DMA transfers.
+Sometimes the SPI controller RX FIFO was not empty after a DMA
+transfer and the driver got stuck in the next PIO transfer when
+it read one word more than expected.
+
+commit dd4b487b32a35 ("ARM: dts: imx6: Use correct SDMA script
+for SPI cores") is fixing the same issue but only for SPI1 - 4.
+
+Fixes: 677940258dd8e ("ARM: dts: imx6q: enable dma for ecspi5")
+Signed-off-by: Sean Nyekjaer <sean.nyekjaer@prevas.dk>
+Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx6q.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx6q.dtsi
++++ b/arch/arm/boot/dts/imx6q.dtsi
+@@ -96,7 +96,7 @@
+ clocks = <&clks IMX6Q_CLK_ECSPI5>,
+ <&clks IMX6Q_CLK_ECSPI5>;
+ clock-names = "ipg", "per";
+- dmas = <&sdma 11 7 1>, <&sdma 12 7 2>;
++ dmas = <&sdma 11 8 1>, <&sdma 12 8 2>;
+ dma-names = "rx", "tx";
+ status = "disabled";
+ };
--- /dev/null
+From 1bc0299d976e000ececc6acd76e33b4582646cb7 Mon Sep 17 00:00:00 2001
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Thu, 31 May 2018 11:30:09 -0700
+Subject: IB/hfi1: Fix user context tail allocation for DMA_RTAIL
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+commit 1bc0299d976e000ececc6acd76e33b4582646cb7 upstream.
+
+The following code fails to allocate a buffer for the
+tail address that the hardware DMAs into when the user
+context DMA_RTAIL is set.
+
+if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL)) {
+ rcd->rcvhdrtail_kvaddr = dma_zalloc_coherent(
+ &dd->pcidev->dev, PAGE_SIZE, &dma_hdrqtail,
+ gfp_flags);
+ if (!rcd->rcvhdrtail_kvaddr)
+ goto bail_free;
+ rcd->rcvhdrqtailaddr_dma = dma_hdrqtail;
+}
+
+So the rcvhdrtail_kvaddr would then be NULL.
+
+The mmap logic fails to check for a NULL rcvhdrtail_kvaddr.
+
+The fix is to test for both user and kernel DMA_TAIL options
+during the allocation as well as testing for a NULL
+rcvhdrtail_kvaddr during the mmap processing.
+
+Additionally, all downstream testing of the capmask for DMA_RTAIL
+have been eliminated in favor of testing rcvhdrtail_kvaddr.
+
+Cc: <stable@vger.kernel.org> # 4.9.x
+Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/hfi1/chip.c | 8 ++++----
+ drivers/infiniband/hw/hfi1/file_ops.c | 2 +-
+ drivers/infiniband/hw/hfi1/init.c | 9 ++++-----
+ 3 files changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -6717,7 +6717,7 @@ static void rxe_kernel_unfreeze(struct h
+ for (i = 0; i < dd->n_krcv_queues; i++) {
+ rcvmask = HFI1_RCVCTRL_CTXT_ENB;
+ /* HFI1_RCVCTRL_TAILUPD_[ENB|DIS] needs to be set explicitly */
+- rcvmask |= HFI1_CAP_KGET_MASK(dd->rcd[i]->flags, DMA_RTAIL) ?
++ rcvmask |= dd->rcd[i]->rcvhdrtail_kvaddr ?
+ HFI1_RCVCTRL_TAILUPD_ENB : HFI1_RCVCTRL_TAILUPD_DIS;
+ hfi1_rcvctrl(dd, rcvmask, i);
+ }
+@@ -8211,7 +8211,7 @@ static inline int check_packet_present(s
+ u32 tail;
+ int present;
+
+- if (!HFI1_CAP_IS_KSET(DMA_RTAIL))
++ if (!rcd->rcvhdrtail_kvaddr)
+ present = (rcd->seq_cnt ==
+ rhf_rcv_seq(rhf_to_cpu(get_rhf_addr(rcd))));
+ else /* is RDMA rtail */
+@@ -11550,7 +11550,7 @@ void hfi1_rcvctrl(struct hfi1_devdata *d
+ /* reset the tail and hdr addresses, and sequence count */
+ write_kctxt_csr(dd, ctxt, RCV_HDR_ADDR,
+ rcd->rcvhdrq_dma);
+- if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL))
++ if (rcd->rcvhdrtail_kvaddr)
+ write_kctxt_csr(dd, ctxt, RCV_HDR_TAIL_ADDR,
+ rcd->rcvhdrqtailaddr_dma);
+ rcd->seq_cnt = 1;
+@@ -11630,7 +11630,7 @@ void hfi1_rcvctrl(struct hfi1_devdata *d
+ rcvctrl |= RCV_CTXT_CTRL_INTR_AVAIL_SMASK;
+ if (op & HFI1_RCVCTRL_INTRAVAIL_DIS)
+ rcvctrl &= ~RCV_CTXT_CTRL_INTR_AVAIL_SMASK;
+- if (op & HFI1_RCVCTRL_TAILUPD_ENB && rcd->rcvhdrqtailaddr_dma)
++ if ((op & HFI1_RCVCTRL_TAILUPD_ENB) && rcd->rcvhdrtail_kvaddr)
+ rcvctrl |= RCV_CTXT_CTRL_TAIL_UPD_SMASK;
+ if (op & HFI1_RCVCTRL_TAILUPD_DIS) {
+ /* See comment on RcvCtxtCtrl.TailUpd above */
+--- a/drivers/infiniband/hw/hfi1/file_ops.c
++++ b/drivers/infiniband/hw/hfi1/file_ops.c
+@@ -609,7 +609,7 @@ static int hfi1_file_mmap(struct file *f
+ ret = -EINVAL;
+ goto done;
+ }
+- if (flags & VM_WRITE) {
++ if ((flags & VM_WRITE) || !uctxt->rcvhdrtail_kvaddr) {
+ ret = -EPERM;
+ goto done;
+ }
+--- a/drivers/infiniband/hw/hfi1/init.c
++++ b/drivers/infiniband/hw/hfi1/init.c
+@@ -1618,7 +1618,6 @@ int hfi1_create_rcvhdrq(struct hfi1_devd
+ u64 reg;
+
+ if (!rcd->rcvhdrq) {
+- dma_addr_t dma_hdrqtail;
+ gfp_t gfp_flags;
+
+ /*
+@@ -1641,13 +1640,13 @@ int hfi1_create_rcvhdrq(struct hfi1_devd
+ goto bail;
+ }
+
+- if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL)) {
++ if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL) ||
++ HFI1_CAP_UGET_MASK(rcd->flags, DMA_RTAIL)) {
+ rcd->rcvhdrtail_kvaddr = dma_zalloc_coherent(
+- &dd->pcidev->dev, PAGE_SIZE, &dma_hdrqtail,
+- gfp_flags);
++ &dd->pcidev->dev, PAGE_SIZE,
++ &rcd->rcvhdrqtailaddr_dma, gfp_flags);
+ if (!rcd->rcvhdrtail_kvaddr)
+ goto bail_free;
+- rcd->rcvhdrqtailaddr_dma = dma_hdrqtail;
+ }
+
+ rcd->rcvhdrq_size = amt;
--- /dev/null
+From bfe72442578bb112626e476ffe1f276504d85b95 Mon Sep 17 00:00:00 2001
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Thu, 13 Apr 2017 14:11:27 -0500
+Subject: net: phy: micrel: fix crash when statistic requested for KSZ9031 phy
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+commit bfe72442578bb112626e476ffe1f276504d85b95 upstream.
+
+Now the command:
+ ethtool --phy-statistics eth0
+will cause system crash with meassage "Unable to handle kernel NULL pointer
+dereference at virtual address 00000010" from:
+
+ (kszphy_get_stats) from [<c069f1d8>] (ethtool_get_phy_stats+0xd8/0x210)
+ (ethtool_get_phy_stats) from [<c06a0738>] (dev_ethtool+0x5b8/0x228c)
+ (dev_ethtool) from [<c06b5484>] (dev_ioctl+0x3fc/0x964)
+ (dev_ioctl) from [<c0679f7c>] (sock_ioctl+0x170/0x2c0)
+ (sock_ioctl) from [<c02419d4>] (do_vfs_ioctl+0xa8/0x95c)
+ (do_vfs_ioctl) from [<c02422c4>] (SyS_ioctl+0x3c/0x64)
+ (SyS_ioctl) from [<c0107d60>] (ret_fast_syscall+0x0/0x44)
+
+The reason: phy_driver structure for KSZ9031 phy has no .probe() callback
+defined. As result, struct phy_device *phydev->priv pointer will not be
+initializes (null).
+This issue will affect also following phys:
+ KSZ8795, KSZ886X, KSZ8873MLL, KSZ9031, KSZ9021, KSZ8061, KS8737
+
+Fix it by:
+- adding .probe() = kszphy_probe() callback to KSZ9031, KSZ9021
+phys. The kszphy_probe() can be re-used as it doesn't do any phy specific
+settings.
+- removing statistic callbacks from other phys (KSZ8795, KSZ886X,
+KSZ8873MLL, KSZ8061, KS8737) as they doesn't have corresponding
+statistic counters.
+
+Fixes: 2b2427d06426 ("phy: micrel: Add ethtool statistics counters")
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Dan Rue <dan.rue@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/phy/micrel.c | 17 ++---------------
+ 1 file changed, 2 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -801,9 +801,6 @@ static struct phy_driver ksphy_driver[]
+ .read_status = genphy_read_status,
+ .ack_interrupt = kszphy_ack_interrupt,
+ .config_intr = kszphy_config_intr,
+- .get_sset_count = kszphy_get_sset_count,
+- .get_strings = kszphy_get_strings,
+- .get_stats = kszphy_get_stats,
+ .suspend = genphy_suspend,
+ .resume = genphy_resume,
+ }, {
+@@ -948,9 +945,6 @@ static struct phy_driver ksphy_driver[]
+ .read_status = genphy_read_status,
+ .ack_interrupt = kszphy_ack_interrupt,
+ .config_intr = kszphy_config_intr,
+- .get_sset_count = kszphy_get_sset_count,
+- .get_strings = kszphy_get_strings,
+- .get_stats = kszphy_get_stats,
+ .suspend = genphy_suspend,
+ .resume = genphy_resume,
+ }, {
+@@ -960,6 +954,7 @@ static struct phy_driver ksphy_driver[]
+ .features = (PHY_GBIT_FEATURES | SUPPORTED_Pause),
+ .flags = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
+ .driver_data = &ksz9021_type,
++ .probe = kszphy_probe,
+ .config_init = ksz9021_config_init,
+ .config_aneg = genphy_config_aneg,
+ .read_status = genphy_read_status,
+@@ -979,6 +974,7 @@ static struct phy_driver ksphy_driver[]
+ .features = (PHY_GBIT_FEATURES | SUPPORTED_Pause),
+ .flags = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
+ .driver_data = &ksz9021_type,
++ .probe = kszphy_probe,
+ .config_init = ksz9031_config_init,
+ .config_aneg = genphy_config_aneg,
+ .read_status = ksz9031_read_status,
+@@ -998,9 +994,6 @@ static struct phy_driver ksphy_driver[]
+ .config_init = kszphy_config_init,
+ .config_aneg = ksz8873mll_config_aneg,
+ .read_status = ksz8873mll_read_status,
+- .get_sset_count = kszphy_get_sset_count,
+- .get_strings = kszphy_get_strings,
+- .get_stats = kszphy_get_stats,
+ .suspend = genphy_suspend,
+ .resume = genphy_resume,
+ }, {
+@@ -1012,9 +1005,6 @@ static struct phy_driver ksphy_driver[]
+ .config_init = kszphy_config_init,
+ .config_aneg = genphy_config_aneg,
+ .read_status = genphy_read_status,
+- .get_sset_count = kszphy_get_sset_count,
+- .get_strings = kszphy_get_strings,
+- .get_stats = kszphy_get_stats,
+ .suspend = genphy_suspend,
+ .resume = genphy_resume,
+ }, {
+@@ -1026,9 +1016,6 @@ static struct phy_driver ksphy_driver[]
+ .config_init = kszphy_config_init,
+ .config_aneg = ksz8873mll_config_aneg,
+ .read_status = ksz8873mll_read_status,
+- .get_sset_count = kszphy_get_sset_count,
+- .get_strings = kszphy_get_strings,
+- .get_stats = kszphy_get_stats,
+ .suspend = genphy_suspend,
+ .resume = genphy_resume,
+ } };
kprobes-x86-do-not-modify-singlestep-buffer-while-resuming.patch
netfilter-nf_tables-use-warn_on_once-instead-of-bug_on-in-nft_do_chain.patch
revert-sit-reload-iphdr-in-ipip6_rcv.patch
+net-phy-micrel-fix-crash-when-statistic-requested-for-ksz9031-phy.patch
+arm-dts-imx6q-use-correct-sdma-script-for-spi5-core.patch
+ib-hfi1-fix-user-context-tail-allocation-for-dma_rtail.patch
+x86-xen-add-call-of-speculative_store_bypass_ht_init-to-pv-paths.patch
+x86-cpu-re-apply-forced-caps-every-time-cpu-caps-are-re-read.patch
--- /dev/null
+From 60d3450167433f2d099ce2869dc52dd9e7dc9b29 Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@kernel.org>
+Date: Wed, 18 Jan 2017 11:15:39 -0800
+Subject: x86/cpu: Re-apply forced caps every time CPU caps are re-read
+
+From: Andy Lutomirski <luto@kernel.org>
+
+commit 60d3450167433f2d099ce2869dc52dd9e7dc9b29 upstream.
+
+Calling get_cpu_cap() will reset a bunch of CPU features. This will
+cause the system to lose track of force-set and force-cleared
+features in the words that are reset until the end of CPU
+initialization. This can cause X86_FEATURE_FPU, for example, to
+change back and forth during boot and potentially confuse CPU setup.
+
+To minimize the chance of confusion, re-apply forced caps every time
+get_cpu_cap() is called.
+
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Fenghua Yu <fenghua.yu@intel.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthew Whitehead <tedheadster@gmail.com>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yu-cheng Yu <yu-cheng.yu@intel.com>
+Link: http://lkml.kernel.org/r/c817eb373d2c67c2c81413a70fc9b845fa34a37e.1484705016.git.luto@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ arch/x86/kernel/cpu/common.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -848,6 +848,13 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
+
+ init_scattered_cpuid_features(c);
+ init_speculation_control(c);
++
++ /*
++ * Clear/Set all flags overridden by options, after probe.
++ * This needs to happen each time we re-probe, which may happen
++ * several times during CPU initialization.
++ */
++ apply_forced_caps(c);
+ }
+
+ static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c)
--- /dev/null
+From 74899d92e66663dc7671a8017b3146dcd4735f3b Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Thu, 21 Jun 2018 10:43:31 +0200
+Subject: x86/xen: Add call of speculative_store_bypass_ht_init() to PV paths
+
+From: Juergen Gross <jgross@suse.com>
+
+commit 74899d92e66663dc7671a8017b3146dcd4735f3b upstream.
+
+Commit:
+
+ 1f50ddb4f418 ("x86/speculation: Handle HT correctly on AMD")
+
+... added speculative_store_bypass_ht_init() to the per-CPU initialization sequence.
+
+speculative_store_bypass_ht_init() needs to be called on each CPU for
+PV guests, too.
+
+Reported-by: Brian Woods <brian.woods@amd.com>
+Tested-by: Brian Woods <brian.woods@amd.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Cc: <stable@vger.kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: boris.ostrovsky@oracle.com
+Cc: xen-devel@lists.xenproject.org
+Fixes: 1f50ddb4f4189243c05926b842dc1a0332195f31 ("x86/speculation: Handle HT correctly on AMD")
+Link: https://lore.kernel.org/lkml/20180621084331.21228-1-jgross@suse.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/xen/smp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/x86/xen/smp.c
++++ b/arch/x86/xen/smp.c
+@@ -28,6 +28,7 @@
+ #include <xen/interface/vcpu.h>
+ #include <xen/interface/xenpmu.h>
+
++#include <asm/spec-ctrl.h>
+ #include <asm/xen/interface.h>
+ #include <asm/xen/hypercall.h>
+
+@@ -87,6 +88,8 @@ static void cpu_bringup(void)
+ cpu_data(cpu).x86_max_cores = 1;
+ set_cpu_sibling_map(cpu);
+
++ speculative_store_bypass_ht_init();
++
+ xen_setup_cpu_clockevents();
+
+ notify_cpu_starting(cpu);
+@@ -375,6 +378,8 @@ static void __init xen_smp_prepare_cpus(
+ }
+ set_cpu_sibling_map(0);
+
++ speculative_store_bypass_ht_init();
++
+ xen_pmu_init(0);
+
+ if (xen_smp_intr_init(0))
projects / thirdparty / kernel / stable-queue.git / commitdiff
