From: Greg Kroah-Hartman Date: Tue, 2 Oct 2018 12:00:10 +0000 (-0700) Subject: 4.18-stable patches X-Git-Tag: v4.18.12~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1420368c00ec1fd3bc8d4f05e750b7563b05eb68;p=thirdparty%2Fkernel%2Fstable-queue.git 4.18-stable patches added patches: amdgpu-fix-multi-process-hang-issue.patch arm-arm64-smccc-1.1-handle-function-result-as-parameters.patch arm-arm64-smccc-1.1-make-return-values-unsigned-long.patch arm-dts-omap4-droid4-fix-emmc-errors-seen-on-some-devices.patch arm-dts-omap4-droid4-fix-vibrations-on-droid-4.patch arm-omap2-fix-module-address-for-modules-using-mpu_rt_idx.patch arm-omap2-fix-null-hwmod-for-ti-sysc-debug.patch arm64-kvm-tighten-guest-core-register-access-from-userspace.patch ata-ftide010-add-a-quirk-for-sq201.patch bpf-sockmap-fix-sock-hash-count-in-alloc_sock_hash_elem.patch bpf-sockmap-fix-sock_hash_alloc-and-reject-zero-sized-keys.patch bpf-sockmap-write_space-events-need-to-be-passed-to-tcp-handler.patch bus-ti-sysc-fix-module-register-ioremap-for-larger-offsets.patch bus-ti-sysc-fix-no_console_suspend-handling.patch clk-x86-set-default-parent-to-48mhz.patch crypto-cavium-nitrox-fix-for-command-corruption-in-queue-full-case-with-backlog-submissions.patch crypto-chtls-fix-null-dereference-chtls_free_uld.patch drm-amdgpu-enable-disable-gfx-pg-feature-in-rlc-safe-mode.patch drm-amdgpu-fix-preamble-handling.patch drm-amdgpu-fix-vm-clearing-for-the-root-pd.patch drm-amdgpu-need-to-set-moved-to-true-when-evict-bo.patch drm-amdgpu-update-power-state-at-the-end-of-smu-hw_init.patch e1000-check-on-netif_running-before-calling-e1000_up.patch e1000-ensure-to-free-old-tx-rx-rings-in-set_ringparam.patch hwmon-adt7475-make-adt7475_read_word-return-errors.patch hwmon-ina2xx-fix-sysfs-shunt-resistor-read-access.patch i2c-i801-allow-acpi-aml-access-i-o-ports-not-reserved-for-smbus.patch i40e-fix-condition-of-warn_once-for-stat-strings.patch i40e-fix-for-tx-timeouts-when-interface-is-brought-up-if-dcb-is-enabled.patch ice-clean-control-queues-only-when-they-are-initialized.patch ice-fix-a-few-null-pointer-dereference-issues.patch ice-fix-bugs-in-control-queue-processing.patch ice-fix-multiple-static-analyser-warnings.patch ice-fix-potential-return-of-uninitialized-value.patch ice-report-stats-for-allocated-queues-via-ethtool-stats.patch ice-set-vlan-flags-correctly.patch ice-use-order_base_2-to-calculate-higher-power-of-2.patch isofs-reject-hardware-sector-size-2048-bytes.patch ixgbe-fix-driver-behaviour-after-issuing-vflr.patch mmc-android-goldfish-fix-bad-logic-of-sg_copy_-from-to-_buffer-conversion.patch mmc-atmel-mci-fix-bad-logic-of-sg_copy_-from-to-_buffer-conversion.patch net-hns-fix-length-and-page_offset-overflow-when-config_arm64_64k_pages.patch net-hns-fix-skb-truesize-underestimation.patch net-hns3-fix-page_offset-overflow-when-config_arm64_64k_pages.patch net-ncsi-fixup-.dumpit-message-flags-and-id-check-in-netlink-handler.patch nvme-fcloop-fix-dropped-ls-s-to-removed-target-port.patch qed-avoid-sending-mailbox-commands-when-mfw-is-not-responsive.patch qed-prevent-a-possible-deadlock-during-driver-load-and-unload.patch qed-wait-for-mcp-halt-and-resume-commands-to-take-place.patch qed-wait-for-ready-indication-before-rereading-the-shmem.patch revert-arm-dts-imx7d-invert-legacy-pci-irq-mapping.patch tcp_bbr-add-bbr_check_probe_rtt_done-helper.patch tcp_bbr-in-restart-from-idle-see-if-we-should-exit-probe_rtt.patch thermal-of-thermal-disable-passive-polling-when-thermal-zone-is-disabled.patch tls-possible-hang-when-do_tcp_sendpages-hits-sndbuf-is-full-case.patch tools-bpftool-return-from-do_event_pipe-on-bad-arguments.patch x86-pti-fix-section-mismatch-warning-error.patch --- diff --git a/queue-4.18/amdgpu-fix-multi-process-hang-issue.patch b/queue-4.18/amdgpu-fix-multi-process-hang-issue.patch new file mode 100644 index 00000000000..5a42f76d80f --- /dev/null +++ b/queue-4.18/amdgpu-fix-multi-process-hang-issue.patch @@ -0,0 +1,53 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Emily Deng +Date: Wed, 22 Aug 2018 20:18:25 +0800 +Subject: amdgpu: fix multi-process hang issue + +From: Emily Deng + +[ Upstream commit 2f40c6eac74a2a60921cdec9e9a8a57e88e31434 ] + +SWDEV-146499: hang during multi vulkan process testing + +cause: +the second frame's PREAMBLE_IB have clear-state +and LOAD actions, those actions ruin the pipeline +that is still doing process in the previous frame's +work-load IB. + +fix: +need insert pipeline sync if have context switch for +SRIOV (because only SRIOV will report PREEMPTION flag +to UMD) + +Signed-off-by: Monk Liu +Signed-off-by: Emily Deng +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c +@@ -164,8 +164,10 @@ int amdgpu_ib_schedule(struct amdgpu_rin + return r; + } + ++ need_ctx_switch = ring->current_ctx != fence_ctx; + if (ring->funcs->emit_pipeline_sync && job && + ((tmp = amdgpu_sync_get_fence(&job->sched_sync, NULL)) || ++ (amdgpu_sriov_vf(adev) && need_ctx_switch) || + amdgpu_vm_need_pipeline_sync(ring, job))) { + need_pipe_sync = true; + dma_fence_put(tmp); +@@ -196,7 +198,6 @@ int amdgpu_ib_schedule(struct amdgpu_rin + } + + skip_preamble = ring->current_ctx == fence_ctx; +- need_ctx_switch = ring->current_ctx != fence_ctx; + if (job && ring->funcs->emit_cntxcntl) { + if (need_ctx_switch) + status |= AMDGPU_HAVE_CTX_SWITCH; diff --git a/queue-4.18/arm-arm64-smccc-1.1-handle-function-result-as-parameters.patch b/queue-4.18/arm-arm64-smccc-1.1-handle-function-result-as-parameters.patch new file mode 100644 index 00000000000..fb617c08c73 --- /dev/null +++ b/queue-4.18/arm-arm64-smccc-1.1-handle-function-result-as-parameters.patch @@ -0,0 +1,135 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Marc Zyngier +Date: Fri, 24 Aug 2018 15:08:30 +0100 +Subject: arm/arm64: smccc-1.1: Handle function result as parameters + +From: Marc Zyngier + +[ Upstream commit 755a8bf5579d22eb5636685c516d8dede799e27b ] + +If someone has the silly idea to write something along those lines: + + extern u64 foo(void); + + void bar(struct arm_smccc_res *res) + { + arm_smccc_1_1_smc(0xbad, foo(), res); + } + +they are in for a surprise, as this gets compiled as: + + 0000000000000588 : + 588: a9be7bfd stp x29, x30, [sp, #-32]! + 58c: 910003fd mov x29, sp + 590: f9000bf3 str x19, [sp, #16] + 594: aa0003f3 mov x19, x0 + 598: aa1e03e0 mov x0, x30 + 59c: 94000000 bl 0 <_mcount> + 5a0: 94000000 bl 0 + 5a4: aa0003e1 mov x1, x0 + 5a8: d4000003 smc #0x0 + 5ac: b4000073 cbz x19, 5b8 + 5b0: a9000660 stp x0, x1, [x19] + 5b4: a9010e62 stp x2, x3, [x19, #16] + 5b8: f9400bf3 ldr x19, [sp, #16] + 5bc: a8c27bfd ldp x29, x30, [sp], #32 + 5c0: d65f03c0 ret + 5c4: d503201f nop + +The call to foo "overwrites" the x0 register for the return value, +and we end up calling the wrong secure service. + +A solution is to evaluate all the parameters before assigning +anything to specific registers, leading to the expected result: + + 0000000000000588 : + 588: a9be7bfd stp x29, x30, [sp, #-32]! + 58c: 910003fd mov x29, sp + 590: f9000bf3 str x19, [sp, #16] + 594: aa0003f3 mov x19, x0 + 598: aa1e03e0 mov x0, x30 + 59c: 94000000 bl 0 <_mcount> + 5a0: 94000000 bl 0 + 5a4: aa0003e1 mov x1, x0 + 5a8: d28175a0 mov x0, #0xbad + 5ac: d4000003 smc #0x0 + 5b0: b4000073 cbz x19, 5bc + 5b4: a9000660 stp x0, x1, [x19] + 5b8: a9010e62 stp x2, x3, [x19, #16] + 5bc: f9400bf3 ldr x19, [sp, #16] + 5c0: a8c27bfd ldp x29, x30, [sp], #32 + 5c4: d65f03c0 ret + +Reported-by: Julien Grall +Signed-off-by: Marc Zyngier +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/arm-smccc.h | 30 ++++++++++++++++++++---------- + 1 file changed, 20 insertions(+), 10 deletions(-) + +--- a/include/linux/arm-smccc.h ++++ b/include/linux/arm-smccc.h +@@ -205,41 +205,51 @@ asmlinkage void __arm_smccc_hvc(unsigned + register unsigned long r3 asm("r3") + + #define __declare_arg_1(a0, a1, res) \ ++ typeof(a1) __a1 = a1; \ + struct arm_smccc_res *___res = res; \ + register unsigned long r0 asm("r0") = (u32)a0; \ +- register unsigned long r1 asm("r1") = a1; \ ++ register unsigned long r1 asm("r1") = __a1; \ + register unsigned long r2 asm("r2"); \ + register unsigned long r3 asm("r3") + + #define __declare_arg_2(a0, a1, a2, res) \ ++ typeof(a1) __a1 = a1; \ ++ typeof(a2) __a2 = a2; \ + struct arm_smccc_res *___res = res; \ + register unsigned long r0 asm("r0") = (u32)a0; \ +- register unsigned long r1 asm("r1") = a1; \ +- register unsigned long r2 asm("r2") = a2; \ ++ register unsigned long r1 asm("r1") = __a1; \ ++ register unsigned long r2 asm("r2") = __a2; \ + register unsigned long r3 asm("r3") + + #define __declare_arg_3(a0, a1, a2, a3, res) \ ++ typeof(a1) __a1 = a1; \ ++ typeof(a2) __a2 = a2; \ ++ typeof(a3) __a3 = a3; \ + struct arm_smccc_res *___res = res; \ + register unsigned long r0 asm("r0") = (u32)a0; \ +- register unsigned long r1 asm("r1") = a1; \ +- register unsigned long r2 asm("r2") = a2; \ +- register unsigned long r3 asm("r3") = a3 ++ register unsigned long r1 asm("r1") = __a1; \ ++ register unsigned long r2 asm("r2") = __a2; \ ++ register unsigned long r3 asm("r3") = __a3 + + #define __declare_arg_4(a0, a1, a2, a3, a4, res) \ ++ typeof(a4) __a4 = a4; \ + __declare_arg_3(a0, a1, a2, a3, res); \ +- register typeof(a4) r4 asm("r4") = a4 ++ register unsigned long r4 asm("r4") = __a4 + + #define __declare_arg_5(a0, a1, a2, a3, a4, a5, res) \ ++ typeof(a5) __a5 = a5; \ + __declare_arg_4(a0, a1, a2, a3, a4, res); \ +- register typeof(a5) r5 asm("r5") = a5 ++ register unsigned long r5 asm("r5") = __a5 + + #define __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res) \ ++ typeof(a6) __a6 = a6; \ + __declare_arg_5(a0, a1, a2, a3, a4, a5, res); \ +- register typeof(a6) r6 asm("r6") = a6 ++ register unsigned long r6 asm("r6") = __a6 + + #define __declare_arg_7(a0, a1, a2, a3, a4, a5, a6, a7, res) \ ++ typeof(a7) __a7 = a7; \ + __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res); \ +- register typeof(a7) r7 asm("r7") = a7 ++ register unsigned long r7 asm("r7") = __a7 + + #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) + #define __declare_args(count, ...) ___declare_args(count, __VA_ARGS__) diff --git a/queue-4.18/arm-arm64-smccc-1.1-make-return-values-unsigned-long.patch b/queue-4.18/arm-arm64-smccc-1.1-make-return-values-unsigned-long.patch new file mode 100644 index 00000000000..e2f4598d154 --- /dev/null +++ b/queue-4.18/arm-arm64-smccc-1.1-make-return-values-unsigned-long.patch @@ -0,0 +1,71 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Marc Zyngier +Date: Fri, 24 Aug 2018 15:08:29 +0100 +Subject: arm/arm64: smccc-1.1: Make return values unsigned long + +From: Marc Zyngier + +[ Upstream commit 1d8f574708a3fb6f18c85486d0c5217df893c0cf ] + +An unfortunate consequence of having a strong typing for the input +values to the SMC call is that it also affects the type of the +return values, limiting r0 to 32 bits and r{1,2,3} to whatever +was passed as an input. + +Let's turn everything into "unsigned long", which satisfies the +requirements of both architectures, and allows for the full +range of return values. + +Reported-by: Julien Grall +Signed-off-by: Marc Zyngier +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/arm-smccc.h | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/include/linux/arm-smccc.h ++++ b/include/linux/arm-smccc.h +@@ -199,31 +199,31 @@ asmlinkage void __arm_smccc_hvc(unsigned + + #define __declare_arg_0(a0, res) \ + struct arm_smccc_res *___res = res; \ +- register u32 r0 asm("r0") = a0; \ ++ register unsigned long r0 asm("r0") = (u32)a0; \ + register unsigned long r1 asm("r1"); \ + register unsigned long r2 asm("r2"); \ + register unsigned long r3 asm("r3") + + #define __declare_arg_1(a0, a1, res) \ + struct arm_smccc_res *___res = res; \ +- register u32 r0 asm("r0") = a0; \ +- register typeof(a1) r1 asm("r1") = a1; \ ++ register unsigned long r0 asm("r0") = (u32)a0; \ ++ register unsigned long r1 asm("r1") = a1; \ + register unsigned long r2 asm("r2"); \ + register unsigned long r3 asm("r3") + + #define __declare_arg_2(a0, a1, a2, res) \ + struct arm_smccc_res *___res = res; \ +- register u32 r0 asm("r0") = a0; \ +- register typeof(a1) r1 asm("r1") = a1; \ +- register typeof(a2) r2 asm("r2") = a2; \ ++ register unsigned long r0 asm("r0") = (u32)a0; \ ++ register unsigned long r1 asm("r1") = a1; \ ++ register unsigned long r2 asm("r2") = a2; \ + register unsigned long r3 asm("r3") + + #define __declare_arg_3(a0, a1, a2, a3, res) \ + struct arm_smccc_res *___res = res; \ +- register u32 r0 asm("r0") = a0; \ +- register typeof(a1) r1 asm("r1") = a1; \ +- register typeof(a2) r2 asm("r2") = a2; \ +- register typeof(a3) r3 asm("r3") = a3 ++ register unsigned long r0 asm("r0") = (u32)a0; \ ++ register unsigned long r1 asm("r1") = a1; \ ++ register unsigned long r2 asm("r2") = a2; \ ++ register unsigned long r3 asm("r3") = a3 + + #define __declare_arg_4(a0, a1, a2, a3, a4, res) \ + __declare_arg_3(a0, a1, a2, a3, res); \ diff --git a/queue-4.18/arm-dts-omap4-droid4-fix-emmc-errors-seen-on-some-devices.patch b/queue-4.18/arm-dts-omap4-droid4-fix-emmc-errors-seen-on-some-devices.patch new file mode 100644 index 00000000000..2eef4866f0e --- /dev/null +++ b/queue-4.18/arm-dts-omap4-droid4-fix-emmc-errors-seen-on-some-devices.patch @@ -0,0 +1,68 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Tony Lindgren +Date: Mon, 27 Aug 2018 19:18:21 -0700 +Subject: ARM: dts: omap4-droid4: Fix emmc errors seen on some devices + +From: Tony Lindgren + +[ Upstream commit 2d59bb602314a4b2593fde267734266b5e872dd0 ] + +Otherwise we can get the following errors occasionally on some devices: + +mmc1: tried to HW reset card, got error -110 +mmcblk1: error -110 requesting status +mmcblk1: recovery failed! +print_req_error: I/O error, dev mmcblk1, sector 14329 +... + +I have one device that hits this error almost on every boot, and another +one that hits it only rarely with the other ones I've used behave without +problems. I'm not sure if the issue is related to a particular eMMC card +model, but in case it is, both of the machines with issues have: + +# cat /sys/class/mmc_host/mmc1/mmc1:0001/manfid \ +/sys/class/mmc_host/mmc1/mmc1:0001/oemid \ +/sys/class/mmc_host/mmc1/mmc1:0001/name +0x000045 +0x0100 +SEM16G + +and the working ones have: + +0x000011 +0x0100 +016G92 + +Note that "ti,non-removable" is different as omap_hsmmc_reg_get() does not +call omap_hsmmc_disable_boot_regulators() if no_regulator_off_init is set. +And currently we set no_regulator_off_init only for "ti,non-removable" and +not for "non-removable". It seems that we should have "non-removable" with +some other mmc generic property behave in the same way instead of having to +use a non-generic property. But let's fix the issue first. + +Fixes: 7e2f8c0ae670 ("ARM: dts: Add minimal support for motorola droid 4 +xt894") +Cc: Marcel Partap +Cc: Merlijn Wajer +Cc: Michael Scott +Cc: NeKit +Cc: Pavel Machek +Cc: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/omap4-droid4-xt894.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts ++++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts +@@ -351,7 +351,7 @@ + &mmc2 { + vmmc-supply = <&vsdio>; + bus-width = <8>; +- non-removable; ++ ti,non-removable; + }; + + &mmc3 { diff --git a/queue-4.18/arm-dts-omap4-droid4-fix-vibrations-on-droid-4.patch b/queue-4.18/arm-dts-omap4-droid4-fix-vibrations-on-droid-4.patch new file mode 100644 index 00000000000..d342ff25f8a --- /dev/null +++ b/queue-4.18/arm-dts-omap4-droid4-fix-vibrations-on-droid-4.patch @@ -0,0 +1,56 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Pavel Machek +Date: Wed, 1 Aug 2018 22:28:21 +0200 +Subject: ARM: dts: omap4-droid4: fix vibrations on Droid 4 + +From: Pavel Machek + +[ Upstream commit f4efa74c09a7eddcc12cd13208f78743763f6e7a ] + +Vibration GPIOs don't have anything to do with wakeup. Move it to +normal section; this fixes vibrations on Droid 4. + +Fixes: a5effd968301 ("ARM: dts: omap4-droid4: Add vibrator") +Signed-off-by: Pavel Machek +Reviewed-by: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/omap4-droid4-xt894.dts | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts ++++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts +@@ -618,15 +618,6 @@ + OMAP4_IOPAD(0x10c, PIN_INPUT | MUX_MODE1) /* abe_mcbsp3_fsx */ + >; + }; +-}; +- +-&omap4_pmx_wkup { +- usb_gpio_mux_sel2: pinmux_usb_gpio_mux_sel2_pins { +- /* gpio_wk0 */ +- pinctrl-single,pins = < +- OMAP4_IOPAD(0x040, PIN_OUTPUT_PULLDOWN | MUX_MODE3) +- >; +- }; + + vibrator_direction_pin: pinmux_vibrator_direction_pin { + pinctrl-single,pins = < +@@ -640,6 +631,15 @@ + >; + }; + }; ++ ++&omap4_pmx_wkup { ++ usb_gpio_mux_sel2: pinmux_usb_gpio_mux_sel2_pins { ++ /* gpio_wk0 */ ++ pinctrl-single,pins = < ++ OMAP4_IOPAD(0x040, PIN_OUTPUT_PULLDOWN | MUX_MODE3) ++ >; ++ }; ++}; + + /* + * As uart1 is wired to mdm6600 with rts and cts, we can use the cts pin for diff --git a/queue-4.18/arm-omap2-fix-module-address-for-modules-using-mpu_rt_idx.patch b/queue-4.18/arm-omap2-fix-module-address-for-modules-using-mpu_rt_idx.patch new file mode 100644 index 00000000000..0d8e4f4a794 --- /dev/null +++ b/queue-4.18/arm-omap2-fix-module-address-for-modules-using-mpu_rt_idx.patch @@ -0,0 +1,83 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Tony Lindgren +Date: Wed, 8 Aug 2018 01:07:04 -0700 +Subject: ARM: OMAP2+: Fix module address for modules using mpu_rt_idx + +From: Tony Lindgren + +[ Upstream commit 1dbcb97c656eed1a244c960b8b3a469c3d20ce7b ] + +If we use device tree data for a module interconnect target we want +to map the control registers from the module start. Legacy hwmod platform +data however is using child IP offsets for cpsw module with mpu_rt_idx. + +In cases where we have the interconnect target module already using device +tree data with legacy hwmod platform data still around, the sysc register +area is not adjusted for mpu_rt_idx causing wrong registers being accessed. + +Let's fix the issue for mixed dts and platform data mode by ioremapping +the module registers using child IP offset if mpu_rt_idx is set. For +device tree only data there's no reason to use mpu_rt_idx. + +Fixes: 6c72b3550672 ("ARM: OMAP2+: Parse module IO range from dts for legacy +"ti,hwmods" support") +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-omap2/omap_hwmod.c | 37 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 37 insertions(+) + +--- a/arch/arm/mach-omap2/omap_hwmod.c ++++ b/arch/arm/mach-omap2/omap_hwmod.c +@@ -2161,6 +2161,37 @@ static int of_dev_hwmod_lookup(struct de + } + + /** ++ * omap_hwmod_fix_mpu_rt_idx - fix up mpu_rt_idx register offsets ++ * ++ * @oh: struct omap_hwmod * ++ * @np: struct device_node * ++ * ++ * Fix up module register offsets for modules with mpu_rt_idx. ++ * Only needed for cpsw with interconnect target module defined ++ * in device tree while still using legacy hwmod platform data ++ * for rev, sysc and syss registers. ++ * ++ * Can be removed when all cpsw hwmod platform data has been ++ * dropped. ++ */ ++static void omap_hwmod_fix_mpu_rt_idx(struct omap_hwmod *oh, ++ struct device_node *np, ++ struct resource *res) ++{ ++ struct device_node *child = NULL; ++ int error; ++ ++ child = of_get_next_child(np, child); ++ if (!child) ++ return; ++ ++ error = of_address_to_resource(child, oh->mpu_rt_idx, res); ++ if (error) ++ pr_err("%s: error mapping mpu_rt_idx: %i\n", ++ __func__, error); ++} ++ ++/** + * omap_hwmod_parse_module_range - map module IO range from device tree + * @oh: struct omap_hwmod * + * @np: struct device_node * +@@ -2222,6 +2253,12 @@ int omap_hwmod_parse_module_range(struct + pr_debug("omap_hwmod: %s %s at 0x%llx size 0x%llx\n", + oh ? oh->name : "", np->name, base, size); + ++ if (oh && oh->mpu_rt_idx) { ++ omap_hwmod_fix_mpu_rt_idx(oh, np, res); ++ ++ return 0; ++ } ++ + res->start = base; + res->end = base + size - 1; + res->flags = IORESOURCE_MEM; diff --git a/queue-4.18/arm-omap2-fix-null-hwmod-for-ti-sysc-debug.patch b/queue-4.18/arm-omap2-fix-null-hwmod-for-ti-sysc-debug.patch new file mode 100644 index 00000000000..415d3be4737 --- /dev/null +++ b/queue-4.18/arm-omap2-fix-null-hwmod-for-ti-sysc-debug.patch @@ -0,0 +1,32 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Tony Lindgren +Date: Wed, 8 Aug 2018 01:07:03 -0700 +Subject: ARM: OMAP2+: Fix null hwmod for ti-sysc debug + +From: Tony Lindgren + +[ Upstream commit 4769c003e0fcff0ee001a9102e2605bdaa5880f0 ] + +We may call omap_hwmod_parse_module_range() with no hwmod allocated yet +and may have debug enabled. Let's fix this by checking for hwmod before +trying to use it's name. + +Fixes: 6c72b3550672 ("ARM: OMAP2+: Parse module IO range from dts for legacy +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-omap2/omap_hwmod.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-omap2/omap_hwmod.c ++++ b/arch/arm/mach-omap2/omap_hwmod.c +@@ -2220,7 +2220,7 @@ int omap_hwmod_parse_module_range(struct + size = be32_to_cpup(ranges); + + pr_debug("omap_hwmod: %s %s at 0x%llx size 0x%llx\n", +- oh->name, np->name, base, size); ++ oh ? oh->name : "", np->name, base, size); + + res->start = base; + res->end = base + size - 1; diff --git a/queue-4.18/arm64-kvm-tighten-guest-core-register-access-from-userspace.patch b/queue-4.18/arm64-kvm-tighten-guest-core-register-access-from-userspace.patch new file mode 100644 index 00000000000..1b05f980dda --- /dev/null +++ b/queue-4.18/arm64-kvm-tighten-guest-core-register-access-from-userspace.patch @@ -0,0 +1,99 @@ +From d26c25a9d19b5976b319af528886f89cf455692d Mon Sep 17 00:00:00 2001 +From: Dave Martin +Date: Thu, 27 Sep 2018 16:53:21 +0100 +Subject: arm64: KVM: Tighten guest core register access from userspace + +From: Dave Martin + +commit d26c25a9d19b5976b319af528886f89cf455692d upstream. + +We currently allow userspace to access the core register file +in about any possible way, including straddling multiple +registers and doing unaligned accesses. + +This is not the expected use of the ABI, and nobody is actually +using it that way. Let's tighten it by explicitly checking +the size and alignment for each field of the register file. + +Cc: +Fixes: 2f4a07c5f9fe ("arm64: KVM: guest one-reg interface") +Reviewed-by: Christoffer Dall +Reviewed-by: Mark Rutland +Signed-off-by: Dave Martin +[maz: rewrote Dave's initial patch to be more easily backported] +Signed-off-by: Marc Zyngier +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kvm/guest.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 45 insertions(+) + +--- a/arch/arm64/kvm/guest.c ++++ b/arch/arm64/kvm/guest.c +@@ -57,6 +57,45 @@ static u64 core_reg_offset_from_id(u64 i + return id & ~(KVM_REG_ARCH_MASK | KVM_REG_SIZE_MASK | KVM_REG_ARM_CORE); + } + ++static int validate_core_offset(const struct kvm_one_reg *reg) ++{ ++ u64 off = core_reg_offset_from_id(reg->id); ++ int size; ++ ++ switch (off) { ++ case KVM_REG_ARM_CORE_REG(regs.regs[0]) ... ++ KVM_REG_ARM_CORE_REG(regs.regs[30]): ++ case KVM_REG_ARM_CORE_REG(regs.sp): ++ case KVM_REG_ARM_CORE_REG(regs.pc): ++ case KVM_REG_ARM_CORE_REG(regs.pstate): ++ case KVM_REG_ARM_CORE_REG(sp_el1): ++ case KVM_REG_ARM_CORE_REG(elr_el1): ++ case KVM_REG_ARM_CORE_REG(spsr[0]) ... ++ KVM_REG_ARM_CORE_REG(spsr[KVM_NR_SPSR - 1]): ++ size = sizeof(__u64); ++ break; ++ ++ case KVM_REG_ARM_CORE_REG(fp_regs.vregs[0]) ... ++ KVM_REG_ARM_CORE_REG(fp_regs.vregs[31]): ++ size = sizeof(__uint128_t); ++ break; ++ ++ case KVM_REG_ARM_CORE_REG(fp_regs.fpsr): ++ case KVM_REG_ARM_CORE_REG(fp_regs.fpcr): ++ size = sizeof(__u32); ++ break; ++ ++ default: ++ return -EINVAL; ++ } ++ ++ if (KVM_REG_SIZE(reg->id) == size && ++ IS_ALIGNED(off, size / sizeof(__u32))) ++ return 0; ++ ++ return -EINVAL; ++} ++ + static int get_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + { + /* +@@ -76,6 +115,9 @@ static int get_core_reg(struct kvm_vcpu + (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs) + return -ENOENT; + ++ if (validate_core_offset(reg)) ++ return -EINVAL; ++ + if (copy_to_user(uaddr, ((u32 *)regs) + off, KVM_REG_SIZE(reg->id))) + return -EFAULT; + +@@ -98,6 +140,9 @@ static int set_core_reg(struct kvm_vcpu + (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs) + return -ENOENT; + ++ if (validate_core_offset(reg)) ++ return -EINVAL; ++ + if (KVM_REG_SIZE(reg->id) > sizeof(tmp)) + return -EINVAL; + diff --git a/queue-4.18/ata-ftide010-add-a-quirk-for-sq201.patch b/queue-4.18/ata-ftide010-add-a-quirk-for-sq201.patch new file mode 100644 index 00000000000..4c0d49ed71b --- /dev/null +++ b/queue-4.18/ata-ftide010-add-a-quirk-for-sq201.patch @@ -0,0 +1,97 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Linus Walleij +Date: Sun, 15 Jul 2018 22:09:29 +0200 +Subject: ata: ftide010: Add a quirk for SQ201 + +From: Linus Walleij + +[ Upstream commit 46cb52ad414ac829680d0bb8cc7090ac2b577ca7 ] + +The DMA is broken on this specific device for some unknown +reason (probably badly designed or plain broken interface +electronics) and will only work with PIO. Other users of +the same hardware does not have this problem. + +Add a specific quirk so that this Gemini device gets +DMA turned off. Also fix up some code around passing the +port information around in probe while we're at it. + +Signed-off-by: Linus Walleij +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/pata_ftide010.c | 27 +++++++++++++++++---------- + 1 file changed, 17 insertions(+), 10 deletions(-) + +--- a/drivers/ata/pata_ftide010.c ++++ b/drivers/ata/pata_ftide010.c +@@ -256,14 +256,12 @@ static struct ata_port_operations pata_f + .qc_issue = ftide010_qc_issue, + }; + +-static struct ata_port_info ftide010_port_info[] = { +- { +- .flags = ATA_FLAG_SLAVE_POSS, +- .mwdma_mask = ATA_MWDMA2, +- .udma_mask = ATA_UDMA6, +- .pio_mask = ATA_PIO4, +- .port_ops = &pata_ftide010_port_ops, +- }, ++static struct ata_port_info ftide010_port_info = { ++ .flags = ATA_FLAG_SLAVE_POSS, ++ .mwdma_mask = ATA_MWDMA2, ++ .udma_mask = ATA_UDMA6, ++ .pio_mask = ATA_PIO4, ++ .port_ops = &pata_ftide010_port_ops, + }; + + #if IS_ENABLED(CONFIG_SATA_GEMINI) +@@ -349,6 +347,7 @@ static int pata_ftide010_gemini_cable_de + } + + static int pata_ftide010_gemini_init(struct ftide010 *ftide, ++ struct ata_port_info *pi, + bool is_ata1) + { + struct device *dev = ftide->dev; +@@ -373,7 +372,13 @@ static int pata_ftide010_gemini_init(str + + /* Flag port as SATA-capable */ + if (gemini_sata_bridge_enabled(sg, is_ata1)) +- ftide010_port_info[0].flags |= ATA_FLAG_SATA; ++ pi->flags |= ATA_FLAG_SATA; ++ ++ /* This device has broken DMA, only PIO works */ ++ if (of_machine_is_compatible("itian,sq201")) { ++ pi->mwdma_mask = 0; ++ pi->udma_mask = 0; ++ } + + /* + * We assume that a simple 40-wire cable is used in the PATA mode. +@@ -435,6 +440,7 @@ static int pata_ftide010_gemini_init(str + } + #else + static int pata_ftide010_gemini_init(struct ftide010 *ftide, ++ struct ata_port_info *pi, + bool is_ata1) + { + return -ENOTSUPP; +@@ -446,7 +452,7 @@ static int pata_ftide010_probe(struct pl + { + struct device *dev = &pdev->dev; + struct device_node *np = dev->of_node; +- const struct ata_port_info pi = ftide010_port_info[0]; ++ struct ata_port_info pi = ftide010_port_info; + const struct ata_port_info *ppi[] = { &pi, NULL }; + struct ftide010 *ftide; + struct resource *res; +@@ -490,6 +496,7 @@ static int pata_ftide010_probe(struct pl + * are ATA0. This will also set up the cable types. + */ + ret = pata_ftide010_gemini_init(ftide, ++ &pi, + (res->start == 0x63400000)); + if (ret) + goto err_dis_clk; diff --git a/queue-4.18/bpf-sockmap-fix-sock-hash-count-in-alloc_sock_hash_elem.patch b/queue-4.18/bpf-sockmap-fix-sock-hash-count-in-alloc_sock_hash_elem.patch new file mode 100644 index 00000000000..fdf3e39a637 --- /dev/null +++ b/queue-4.18/bpf-sockmap-fix-sock-hash-count-in-alloc_sock_hash_elem.patch @@ -0,0 +1,37 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Daniel Borkmann +Date: Wed, 22 Aug 2018 18:09:17 +0200 +Subject: bpf, sockmap: fix sock hash count in alloc_sock_hash_elem + +From: Daniel Borkmann + +[ Upstream commit eb29429d81e31b191f3b2bd19cf820279cec6463 ] + +When we try to allocate a new sock hash entry and the allocation +fails, then sock hash map fails to reduce the map element counter, +meaning we keep accounting this element although it was never used. +Fix it by dropping the element counter on error. + +Fixes: 81110384441a ("bpf: sockmap, add hash map support") +Signed-off-by: Daniel Borkmann +Acked-by: John Fastabend +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/sockmap.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/bpf/sockmap.c ++++ b/kernel/bpf/sockmap.c +@@ -2272,8 +2272,10 @@ static struct htab_elem *alloc_sock_hash + } + l_new = kmalloc_node(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN, + htab->map.numa_node); +- if (!l_new) ++ if (!l_new) { ++ atomic_dec(&htab->count); + return ERR_PTR(-ENOMEM); ++ } + + memcpy(l_new->key, key, key_size); + l_new->sk = sk; diff --git a/queue-4.18/bpf-sockmap-fix-sock_hash_alloc-and-reject-zero-sized-keys.patch b/queue-4.18/bpf-sockmap-fix-sock_hash_alloc-and-reject-zero-sized-keys.patch new file mode 100644 index 00000000000..dff7f0ee682 --- /dev/null +++ b/queue-4.18/bpf-sockmap-fix-sock_hash_alloc-and-reject-zero-sized-keys.patch @@ -0,0 +1,38 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Daniel Borkmann +Date: Tue, 21 Aug 2018 15:55:00 +0200 +Subject: bpf, sockmap: fix sock_hash_alloc and reject zero-sized keys + +From: Daniel Borkmann + +[ Upstream commit b845c898b2f1ea458d5453f0fa1da6e2dfce3bb4 ] + +Currently, it is possible to create a sock hash map with key size +of 0 and have the kernel return a fd back to user space. This is +invalid for hash maps (and kernel also hasn't been tested for zero +key size support in general at this point). Thus, reject such +configuration. + +Fixes: 81110384441a ("bpf: sockmap, add hash map support") +Signed-off-by: Daniel Borkmann +Acked-by: John Fastabend +Acked-by: Song Liu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/sockmap.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/bpf/sockmap.c ++++ b/kernel/bpf/sockmap.c +@@ -2143,7 +2143,9 @@ static struct bpf_map *sock_hash_alloc(u + return ERR_PTR(-EPERM); + + /* check sanity of attributes */ +- if (attr->max_entries == 0 || attr->value_size != 4 || ++ if (attr->max_entries == 0 || ++ attr->key_size == 0 || ++ attr->value_size != 4 || + attr->map_flags & ~SOCK_CREATE_FLAG_MASK) + return ERR_PTR(-EINVAL); + diff --git a/queue-4.18/bpf-sockmap-write_space-events-need-to-be-passed-to-tcp-handler.patch b/queue-4.18/bpf-sockmap-write_space-events-need-to-be-passed-to-tcp-handler.patch new file mode 100644 index 00000000000..cb70e1559bb --- /dev/null +++ b/queue-4.18/bpf-sockmap-write_space-events-need-to-be-passed-to-tcp-handler.patch @@ -0,0 +1,51 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: John Fastabend +Date: Wed, 22 Aug 2018 08:37:37 -0700 +Subject: bpf: sockmap: write_space events need to be passed to TCP handler + +From: John Fastabend + +[ Upstream commit 9b2e0388bec8ec5427403e23faff3b58dd1c3200 ] + +When sockmap code is using the stream parser it also handles the write +space events in order to handle the case where (a) verdict redirects +skb to another socket and (b) the sockmap then sends the skb but due +to memory constraints (or other EAGAIN errors) needs to do a retry. + +But the initial code missed a third case where the +skb_send_sock_locked() triggers an sk_wait_event(). A typically case +would be when sndbuf size is exceeded. If this happens because we +do not pass the write_space event to the lower layers we never wake +up the event and it will wait for sndtimeo. Which as noted in ktls +fix may be rather large and look like a hang to the user. + +To reproduce the best test is to reduce the sndbuf size and send +1B data chunks to stress the memory handling. To fix this pass the +event from the upper layer to the lower layer. + +Signed-off-by: John Fastabend +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/sockmap.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/kernel/bpf/sockmap.c ++++ b/kernel/bpf/sockmap.c +@@ -1430,12 +1430,15 @@ out: + static void smap_write_space(struct sock *sk) + { + struct smap_psock *psock; ++ void (*write_space)(struct sock *sk); + + rcu_read_lock(); + psock = smap_psock_sk(sk); + if (likely(psock && test_bit(SMAP_TX_RUNNING, &psock->state))) + schedule_work(&psock->tx_work); ++ write_space = psock->save_write_space; + rcu_read_unlock(); ++ write_space(sk); + } + + static void smap_stop_sock(struct smap_psock *psock, struct sock *sk) diff --git a/queue-4.18/bus-ti-sysc-fix-module-register-ioremap-for-larger-offsets.patch b/queue-4.18/bus-ti-sysc-fix-module-register-ioremap-for-larger-offsets.patch new file mode 100644 index 00000000000..5751e863803 --- /dev/null +++ b/queue-4.18/bus-ti-sysc-fix-module-register-ioremap-for-larger-offsets.patch @@ -0,0 +1,76 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Tony Lindgren +Date: Wed, 8 Aug 2018 01:07:05 -0700 +Subject: bus: ti-sysc: Fix module register ioremap for larger offsets + +From: Tony Lindgren + +[ Upstream commit 0ef8e3bb974af56346b34393e643d491d9141c66 ] + +We can have the interconnect target module control registers pretty +much anywhere within the module range. The current code attempts an +incomplete optimization of the ioremap size but does it wrong and +it only works for registers at the beginning of the module. + +Let's just use the largest control register to calculate the ioremap +size. The ioremapped range is for most part cached anyways so there +is no need for size optimization. Let's also update the comments +accordingly. + +Fixes: 0eecc636e5a2 ("bus: ti-sysc: Add minimal TI sysc interconnect +target driver") +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/ti-sysc.c | 29 +++++++++++++---------------- + 1 file changed, 13 insertions(+), 16 deletions(-) + +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -490,32 +490,29 @@ static int sysc_check_registers(struct s + + /** + * syc_ioremap - ioremap register space for the interconnect target module +- * @ddata: deviec driver data ++ * @ddata: device driver data + * + * Note that the interconnect target module registers can be anywhere +- * within the first child device address space. For example, SGX has +- * them at offset 0x1fc00 in the 32MB module address space. We just +- * what we need around the interconnect target module registers. ++ * within the interconnect target module range. For example, SGX has ++ * them at offset 0x1fc00 in the 32MB module address space. And cpsw ++ * has them at offset 0x1200 in the CPSW_WR child. Usually the ++ * the interconnect target module registers are at the beginning of ++ * the module range though. + */ + static int sysc_ioremap(struct sysc *ddata) + { +- u32 size = 0; ++ int size; + +- if (ddata->offsets[SYSC_SYSSTATUS] >= 0) +- size = ddata->offsets[SYSC_SYSSTATUS]; +- else if (ddata->offsets[SYSC_SYSCONFIG] >= 0) +- size = ddata->offsets[SYSC_SYSCONFIG]; +- else if (ddata->offsets[SYSC_REVISION] >= 0) +- size = ddata->offsets[SYSC_REVISION]; +- else +- return -EINVAL; ++ size = max3(ddata->offsets[SYSC_REVISION], ++ ddata->offsets[SYSC_SYSCONFIG], ++ ddata->offsets[SYSC_SYSSTATUS]); + +- size &= 0xfff00; +- size += SZ_256; ++ if (size < 0 || (size + sizeof(u32)) > ddata->module_size) ++ return -EINVAL; + + ddata->module_va = devm_ioremap(ddata->dev, + ddata->module_pa, +- size); ++ size + sizeof(u32)); + if (!ddata->module_va) + return -EIO; + diff --git a/queue-4.18/bus-ti-sysc-fix-no_console_suspend-handling.patch b/queue-4.18/bus-ti-sysc-fix-no_console_suspend-handling.patch new file mode 100644 index 00000000000..f0d82159e4a --- /dev/null +++ b/queue-4.18/bus-ti-sysc-fix-no_console_suspend-handling.patch @@ -0,0 +1,37 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Tony Lindgren +Date: Wed, 8 Aug 2018 01:07:06 -0700 +Subject: bus: ti-sysc: Fix no_console_suspend handling + +From: Tony Lindgren + +[ Upstream commit 4f3530f4a41d49c41015020cd9a5ed5c95b5d2db ] + +If no_console_suspend is set, we should keep console enabled during suspend. +Lets fix this by only producing a warning if we can't idle hardware during +suspend. + +Fixes: ef55f8215a78 ("bus: ti-sysc: Improve suspend and resume handling") +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/ti-sysc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1175,10 +1175,10 @@ static int sysc_child_suspend_noirq(stru + if (!pm_runtime_status_suspended(dev)) { + error = pm_generic_runtime_suspend(dev); + if (error) { +- dev_err(dev, "%s error at %i: %i\n", +- __func__, __LINE__, error); ++ dev_warn(dev, "%s busy at %i: %i\n", ++ __func__, __LINE__, error); + +- return error; ++ return 0; + } + + error = sysc_runtime_suspend(ddata->dev); diff --git a/queue-4.18/clk-x86-set-default-parent-to-48mhz.patch b/queue-4.18/clk-x86-set-default-parent-to-48mhz.patch new file mode 100644 index 00000000000..e816f66e1ce --- /dev/null +++ b/queue-4.18/clk-x86-set-default-parent-to-48mhz.patch @@ -0,0 +1,36 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Akshu Agrawal +Date: Tue, 21 Aug 2018 12:21:57 +0530 +Subject: clk: x86: Set default parent to 48Mhz + +From: Akshu Agrawal + +[ Upstream commit bded6c03e398dc6e862dc8301fb9a60175740653 ] + +System clk provided in ST soc can be set to: +48Mhz, non-spread +25Mhz, spread +To get accurate rate, we need it to set it at non-spread +option which is 48Mhz. + +Signed-off-by: Akshu Agrawal +Reviewed-by: Daniel Kurtz +Fixes: 421bf6a1f061 ("clk: x86: Add ST oscout platform clock") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/x86/clk-st.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/x86/clk-st.c ++++ b/drivers/clk/x86/clk-st.c +@@ -46,7 +46,7 @@ static int st_clk_probe(struct platform_ + clk_oscout1_parents, ARRAY_SIZE(clk_oscout1_parents), + 0, st_data->base + CLKDRVSTR2, OSCOUT1CLK25MHZ, 3, 0, NULL); + +- clk_set_parent(hws[ST_CLK_MUX]->clk, hws[ST_CLK_25M]->clk); ++ clk_set_parent(hws[ST_CLK_MUX]->clk, hws[ST_CLK_48M]->clk); + + hws[ST_CLK_GATE] = clk_hw_register_gate(NULL, "oscout1", "oscout1_mux", + 0, st_data->base + MISCCLKCNTL1, OSCCLKENB, diff --git a/queue-4.18/crypto-cavium-nitrox-fix-for-command-corruption-in-queue-full-case-with-backlog-submissions.patch b/queue-4.18/crypto-cavium-nitrox-fix-for-command-corruption-in-queue-full-case-with-backlog-submissions.patch new file mode 100644 index 00000000000..d56b75f042d --- /dev/null +++ b/queue-4.18/crypto-cavium-nitrox-fix-for-command-corruption-in-queue-full-case-with-backlog-submissions.patch @@ -0,0 +1,182 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Srikanth Jampala +Date: Wed, 22 Aug 2018 12:40:52 +0530 +Subject: crypto: cavium/nitrox - fix for command corruption in queue full case with backlog submissions. + +From: Srikanth Jampala + +[ Upstream commit 3d7c82060d1fe65bde4023aac41a0b1bd7718e07 ] + +Earlier used to post the current command without checking queue full + after backlog submissions. So, post the current command only after + confirming the space in queue after backlog submissions. + + Maintain host write index instead of reading device registers + to get the next free slot to post the command. + + Return -ENOSPC in queue full case. + +Signed-off-by: Srikanth Jampala +Reviewed-by: Gadam Sreerama +Tested-by: Jha, Chandan +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/cavium/nitrox/nitrox_dev.h | 3 - + drivers/crypto/cavium/nitrox/nitrox_lib.c | 1 + drivers/crypto/cavium/nitrox/nitrox_reqmgr.c | 57 +++++++++++++++------------ + 3 files changed, 35 insertions(+), 26 deletions(-) + +--- a/drivers/crypto/cavium/nitrox/nitrox_dev.h ++++ b/drivers/crypto/cavium/nitrox/nitrox_dev.h +@@ -35,6 +35,7 @@ struct nitrox_cmdq { + /* requests in backlog queues */ + atomic_t backlog_count; + ++ int write_idx; + /* command size 32B/64B */ + u8 instr_size; + u8 qno; +@@ -87,7 +88,7 @@ struct nitrox_bh { + struct bh_data *slc; + }; + +-/* NITROX-5 driver state */ ++/* NITROX-V driver state */ + #define NITROX_UCODE_LOADED 0 + #define NITROX_READY 1 + +--- a/drivers/crypto/cavium/nitrox/nitrox_lib.c ++++ b/drivers/crypto/cavium/nitrox/nitrox_lib.c +@@ -36,6 +36,7 @@ static int cmdq_common_init(struct nitro + cmdq->head = PTR_ALIGN(cmdq->head_unaligned, PKT_IN_ALIGN); + cmdq->dma = PTR_ALIGN(cmdq->dma_unaligned, PKT_IN_ALIGN); + cmdq->qsize = (qsize + PKT_IN_ALIGN); ++ cmdq->write_idx = 0; + + spin_lock_init(&cmdq->response_lock); + spin_lock_init(&cmdq->cmdq_lock); +--- a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c ++++ b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c +@@ -42,6 +42,16 @@ + * Invalid flag options in AES-CCM IV. + */ + ++static inline int incr_index(int index, int count, int max) ++{ ++ if ((index + count) >= max) ++ index = index + count - max; ++ else ++ index += count; ++ ++ return index; ++} ++ + /** + * dma_free_sglist - unmap and free the sg lists. + * @ndev: N5 device +@@ -426,30 +436,29 @@ static void post_se_instr(struct nitrox_ + struct nitrox_cmdq *cmdq) + { + struct nitrox_device *ndev = sr->ndev; +- union nps_pkt_in_instr_baoff_dbell pkt_in_baoff_dbell; +- u64 offset; ++ int idx; + u8 *ent; + + spin_lock_bh(&cmdq->cmdq_lock); + +- /* get the next write offset */ +- offset = NPS_PKT_IN_INSTR_BAOFF_DBELLX(cmdq->qno); +- pkt_in_baoff_dbell.value = nitrox_read_csr(ndev, offset); ++ idx = cmdq->write_idx; + /* copy the instruction */ +- ent = cmdq->head + pkt_in_baoff_dbell.s.aoff; ++ ent = cmdq->head + (idx * cmdq->instr_size); + memcpy(ent, &sr->instr, cmdq->instr_size); +- /* flush the command queue updates */ +- dma_wmb(); + +- sr->tstamp = jiffies; + atomic_set(&sr->status, REQ_POSTED); + response_list_add(sr, cmdq); ++ sr->tstamp = jiffies; ++ /* flush the command queue updates */ ++ dma_wmb(); + + /* Ring doorbell with count 1 */ + writeq(1, cmdq->dbell_csr_addr); + /* orders the doorbell rings */ + mmiowb(); + ++ cmdq->write_idx = incr_index(idx, 1, ndev->qlen); ++ + spin_unlock_bh(&cmdq->cmdq_lock); + } + +@@ -459,6 +468,9 @@ static int post_backlog_cmds(struct nitr + struct nitrox_softreq *sr, *tmp; + int ret = 0; + ++ if (!atomic_read(&cmdq->backlog_count)) ++ return 0; ++ + spin_lock_bh(&cmdq->backlog_lock); + + list_for_each_entry_safe(sr, tmp, &cmdq->backlog_head, backlog) { +@@ -466,7 +478,7 @@ static int post_backlog_cmds(struct nitr + + /* submit until space available */ + if (unlikely(cmdq_full(cmdq, ndev->qlen))) { +- ret = -EBUSY; ++ ret = -ENOSPC; + break; + } + /* delete from backlog list */ +@@ -491,23 +503,20 @@ static int nitrox_enqueue_request(struct + { + struct nitrox_cmdq *cmdq = sr->cmdq; + struct nitrox_device *ndev = sr->ndev; +- int ret = -EBUSY; ++ ++ /* try to post backlog requests */ ++ post_backlog_cmds(cmdq); + + if (unlikely(cmdq_full(cmdq, ndev->qlen))) { + if (!(sr->flags & CRYPTO_TFM_REQ_MAY_BACKLOG)) +- return -EAGAIN; +- ++ return -ENOSPC; ++ /* add to backlog list */ + backlog_list_add(sr, cmdq); +- } else { +- ret = post_backlog_cmds(cmdq); +- if (ret) { +- backlog_list_add(sr, cmdq); +- return ret; +- } +- post_se_instr(sr, cmdq); +- ret = -EINPROGRESS; ++ return -EBUSY; + } +- return ret; ++ post_se_instr(sr, cmdq); ++ ++ return -EINPROGRESS; + } + + /** +@@ -624,11 +633,9 @@ int nitrox_process_se_request(struct nit + */ + sr->instr.fdata[0] = *((u64 *)&req->gph); + sr->instr.fdata[1] = 0; +- /* flush the soft_req changes before posting the cmd */ +- wmb(); + + ret = nitrox_enqueue_request(sr); +- if (ret == -EAGAIN) ++ if (ret == -ENOSPC) + goto send_fail; + + return ret; diff --git a/queue-4.18/crypto-chtls-fix-null-dereference-chtls_free_uld.patch b/queue-4.18/crypto-chtls-fix-null-dereference-chtls_free_uld.patch new file mode 100644 index 00000000000..240ed9eb052 --- /dev/null +++ b/queue-4.18/crypto-chtls-fix-null-dereference-chtls_free_uld.patch @@ -0,0 +1,66 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Ganesh Goudar +Date: Fri, 10 Aug 2018 18:27:41 +0530 +Subject: crypto: chtls - fix null dereference chtls_free_uld() + +From: Ganesh Goudar + +[ Upstream commit 65b2c12dcdb883fc015c0ec65d6c2f857e0456ac ] + +call chtls_free_uld() only for the initialized cdev, +this fixes NULL dereference in chtls_free_uld() + +Signed-off-by: Ganesh Goudar +Signed-off-by: Atul Gupta +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/chelsio/chtls/chtls.h | 5 +++++ + drivers/crypto/chelsio/chtls/chtls_main.c | 7 +++++-- + 2 files changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/chelsio/chtls/chtls.h ++++ b/drivers/crypto/chelsio/chtls/chtls.h +@@ -96,6 +96,10 @@ enum csk_flags { + CSK_CONN_INLINE, /* Connection on HW */ + }; + ++enum chtls_cdev_state { ++ CHTLS_CDEV_STATE_UP = 1 ++}; ++ + struct listen_ctx { + struct sock *lsk; + struct chtls_dev *cdev; +@@ -146,6 +150,7 @@ struct chtls_dev { + unsigned int send_page_order; + int max_host_sndbuf; + struct key_map kmap; ++ unsigned int cdev_state; + }; + + struct chtls_hws { +--- a/drivers/crypto/chelsio/chtls/chtls_main.c ++++ b/drivers/crypto/chelsio/chtls/chtls_main.c +@@ -160,6 +160,7 @@ static void chtls_register_dev(struct ch + tlsdev->hash = chtls_create_hash; + tlsdev->unhash = chtls_destroy_hash; + tls_register_device(&cdev->tlsdev); ++ cdev->cdev_state = CHTLS_CDEV_STATE_UP; + } + + static void chtls_unregister_dev(struct chtls_dev *cdev) +@@ -281,8 +282,10 @@ static void chtls_free_all_uld(void) + struct chtls_dev *cdev, *tmp; + + mutex_lock(&cdev_mutex); +- list_for_each_entry_safe(cdev, tmp, &cdev_list, list) +- chtls_free_uld(cdev); ++ list_for_each_entry_safe(cdev, tmp, &cdev_list, list) { ++ if (cdev->cdev_state == CHTLS_CDEV_STATE_UP) ++ chtls_free_uld(cdev); ++ } + mutex_unlock(&cdev_mutex); + } + diff --git a/queue-4.18/drm-amdgpu-enable-disable-gfx-pg-feature-in-rlc-safe-mode.patch b/queue-4.18/drm-amdgpu-enable-disable-gfx-pg-feature-in-rlc-safe-mode.patch new file mode 100644 index 00000000000..4e7373e4b71 --- /dev/null +++ b/queue-4.18/drm-amdgpu-enable-disable-gfx-pg-feature-in-rlc-safe-mode.patch @@ -0,0 +1,49 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Rex Zhu +Date: Fri, 24 Aug 2018 17:26:23 +0800 +Subject: drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode + +From: Rex Zhu + +[ Upstream commit 8ef23364b654d44244400d79988e677e504b21ba ] + +This is required by gfx hw and can fix the rlc hang when +do s3 stree test on Cz/St. + +Reviewed-by: Alex Deucher +Signed-off-by: Hang Zhou +Signed-off-by: Rex Zhu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -5614,6 +5614,11 @@ static int gfx_v8_0_set_powergating_stat + if (amdgpu_sriov_vf(adev)) + return 0; + ++ if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG | ++ AMD_PG_SUPPORT_RLC_SMU_HS | ++ AMD_PG_SUPPORT_CP | ++ AMD_PG_SUPPORT_GFX_DMG)) ++ adev->gfx.rlc.funcs->enter_safe_mode(adev); + switch (adev->asic_type) { + case CHIP_CARRIZO: + case CHIP_STONEY: +@@ -5663,7 +5668,11 @@ static int gfx_v8_0_set_powergating_stat + default: + break; + } +- ++ if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG | ++ AMD_PG_SUPPORT_RLC_SMU_HS | ++ AMD_PG_SUPPORT_CP | ++ AMD_PG_SUPPORT_GFX_DMG)) ++ adev->gfx.rlc.funcs->exit_safe_mode(adev); + return 0; + } + diff --git a/queue-4.18/drm-amdgpu-fix-preamble-handling.patch b/queue-4.18/drm-amdgpu-fix-preamble-handling.patch new file mode 100644 index 00000000000..3bbfdb54bf4 --- /dev/null +++ b/queue-4.18/drm-amdgpu-fix-preamble-handling.patch @@ -0,0 +1,52 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: "Christian König" +Date: Tue, 21 Aug 2018 15:09:39 +0200 +Subject: drm/amdgpu: fix preamble handling + +From: "Christian König" + +[ Upstream commit d98ff24e8e9be3329eea7c84d5e244d0c1cd0ab3 ] + +At this point the command submission can still be interrupted. + +Signed-off-by: Christian König +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -975,13 +975,9 @@ static int amdgpu_cs_ib_fill(struct amdg + if (r) + return r; + +- if (chunk_ib->flags & AMDGPU_IB_FLAG_PREAMBLE) { +- parser->job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT; +- if (!parser->ctx->preamble_presented) { +- parser->job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT_FIRST; +- parser->ctx->preamble_presented = true; +- } +- } ++ if (chunk_ib->flags & AMDGPU_IB_FLAG_PREAMBLE) ++ parser->job->preamble_status |= ++ AMDGPU_PREAMBLE_IB_PRESENT; + + if (parser->job->ring && parser->job->ring != ring) + return -EINVAL; +@@ -1206,6 +1202,12 @@ static int amdgpu_cs_submit(struct amdgp + + amdgpu_cs_post_dependencies(p); + ++ if ((job->preamble_status & AMDGPU_PREAMBLE_IB_PRESENT) && ++ !p->ctx->preamble_presented) { ++ job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT_FIRST; ++ p->ctx->preamble_presented = true; ++ } ++ + cs->out.handle = seq; + job->uf_sequence = seq; + diff --git a/queue-4.18/drm-amdgpu-fix-vm-clearing-for-the-root-pd.patch b/queue-4.18/drm-amdgpu-fix-vm-clearing-for-the-root-pd.patch new file mode 100644 index 00000000000..01cd33da61a --- /dev/null +++ b/queue-4.18/drm-amdgpu-fix-vm-clearing-for-the-root-pd.patch @@ -0,0 +1,40 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: "Christian König" +Date: Thu, 16 Aug 2018 12:01:03 +0200 +Subject: drm/amdgpu: fix VM clearing for the root PD + +From: "Christian König" + +[ Upstream commit 8604ffcbf04f8f4f3f55a9e46e5ff948b2ed4290 ] + +We need to figure out the address after validating the BO, not before. + +Signed-off-by: Christian König +Reviewed-by: Felix Kuehling +Reviewed-by: Junwei Zhang +Reviewed-by: Huang Rui +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -303,7 +303,6 @@ static int amdgpu_vm_clear_bo(struct amd + uint64_t addr; + int r; + +- addr = amdgpu_bo_gpu_offset(bo); + entries = amdgpu_bo_size(bo) / 8; + + if (pte_support_ats) { +@@ -335,6 +334,7 @@ static int amdgpu_vm_clear_bo(struct amd + if (r) + goto error; + ++ addr = amdgpu_bo_gpu_offset(bo); + if (ats_entries) { + uint64_t ats_value; + diff --git a/queue-4.18/drm-amdgpu-need-to-set-moved-to-true-when-evict-bo.patch b/queue-4.18/drm-amdgpu-need-to-set-moved-to-true-when-evict-bo.patch new file mode 100644 index 00000000000..5024c656289 --- /dev/null +++ b/queue-4.18/drm-amdgpu-need-to-set-moved-to-true-when-evict-bo.patch @@ -0,0 +1,43 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Emily Deng +Date: Tue, 28 Aug 2018 20:52:40 +0800 +Subject: drm/amdgpu: Need to set moved to true when evict bo + +From: Emily Deng + +[ Upstream commit 6ddd9769db4fc11a98bd7e58be1764e47fdb8384 ] + +Fix the VMC page fault when the running sequence is as below: +1.amdgpu_gem_create_ioctl +2.ttm_bo_swapout->amdgpu_vm_bo_invalidate, as not called +amdgpu_vm_bo_base_init, so won't called +list_add_tail(&base->bo_list, &bo->va). Even the bo was evicted, +it won't set the bo_base->moved. +3.drm_gem_open_ioctl->amdgpu_vm_bo_base_init, here only called +list_move_tail(&base->vm_status, &vm->evicted), but not set the +bo_base->moved. +4.amdgpu_vm_bo_map->amdgpu_vm_bo_insert_map, as the bo_base->moved is +not set true, the function amdgpu_vm_bo_insert_map will call +list_move(&bo_va->base.vm_status, &vm->moved) +5.amdgpu_cs_ioctl won't validate the swapout bo, as it is only in the +moved list, not in the evict list. So VMC page fault occurs. + +Signed-off-by: Emily Deng +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -123,6 +123,7 @@ static void amdgpu_vm_bo_base_init(struc + * is validated on next vm use to avoid fault. + * */ + list_move_tail(&base->vm_status, &vm->evicted); ++ base->moved = true; + } + + /** diff --git a/queue-4.18/drm-amdgpu-update-power-state-at-the-end-of-smu-hw_init.patch b/queue-4.18/drm-amdgpu-update-power-state-at-the-end-of-smu-hw_init.patch new file mode 100644 index 00000000000..600124ce6e8 --- /dev/null +++ b/queue-4.18/drm-amdgpu-update-power-state-at-the-end-of-smu-hw_init.patch @@ -0,0 +1,67 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Rex Zhu +Date: Fri, 24 Aug 2018 16:17:54 +0800 +Subject: drm/amdgpu: Update power state at the end of smu hw_init. + +From: Rex Zhu + +[ Upstream commit 2ab4d0e74256fc49b7b270f63c1d1e47c2455abc ] + +For SI/Kv, the power state is managed by function +amdgpu_pm_compute_clocks. + +when dpm enabled, we should call amdgpu_pm_compute_clocks +to update current power state instand of set boot state. + +this change can fix the oops when kfd driver was enabled on Kv. + +Reviewed-by: Alex Deucher +Tested-by: Michel Dänzer +Signed-off-by: Rex Zhu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/kv_dpm.c | 4 +--- + drivers/gpu/drm/amd/amdgpu/si_dpm.c | 3 +-- + 2 files changed, 2 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c +@@ -1354,8 +1354,6 @@ static int kv_dpm_enable(struct amdgpu_d + return ret; + } + +- kv_update_current_ps(adev, adev->pm.dpm.boot_ps); +- + if (adev->irq.installed && + amdgpu_is_internal_thermal_sensor(adev->pm.int_thermal_type)) { + ret = kv_set_thermal_temperature_range(adev, KV_TEMP_RANGE_MIN, KV_TEMP_RANGE_MAX); +@@ -3061,7 +3059,7 @@ static int kv_dpm_hw_init(void *handle) + else + adev->pm.dpm_enabled = true; + mutex_unlock(&adev->pm.mutex); +- ++ amdgpu_pm_compute_clocks(adev); + return ret; + } + +--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c +@@ -6887,7 +6887,6 @@ static int si_dpm_enable(struct amdgpu_d + + si_enable_auto_throttle_source(adev, AMDGPU_DPM_AUTO_THROTTLE_SRC_THERMAL, true); + si_thermal_start_thermal_controller(adev); +- ni_update_current_ps(adev, boot_ps); + + return 0; + } +@@ -7764,7 +7763,7 @@ static int si_dpm_hw_init(void *handle) + else + adev->pm.dpm_enabled = true; + mutex_unlock(&adev->pm.mutex); +- ++ amdgpu_pm_compute_clocks(adev); + return ret; + } + diff --git a/queue-4.18/e1000-check-on-netif_running-before-calling-e1000_up.patch b/queue-4.18/e1000-check-on-netif_running-before-calling-e1000_up.patch new file mode 100644 index 00000000000..feee692b5c2 --- /dev/null +++ b/queue-4.18/e1000-check-on-netif_running-before-calling-e1000_up.patch @@ -0,0 +1,42 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Bo Chen +Date: Mon, 23 Jul 2018 09:01:29 -0700 +Subject: e1000: check on netif_running() before calling e1000_up() + +From: Bo Chen + +[ Upstream commit cf1acec008f8d7761aa3fd7c4bca7e17b2d2512d ] + +When the device is not up, the call to 'e1000_up()' from the error handling path +of 'e1000_set_ringparam()' causes a kernel oops with a null-pointer +dereference. The null-pointer dereference is triggered in function +'e1000_alloc_rx_buffers()' at line 'buffer_info = &rx_ring->buffer_info[i]'. + +This bug was reported by COD, a tool for testing kernel module binaries I am +building. This bug was also detected by KFI from Dr. Kai Cong. + +This patch fixes the bug by checking on 'netif_running()' before calling +'e1000_up()' in 'e1000_set_ringparam()'. + +Signed-off-by: Bo Chen +Acked-by: Alexander Duyck +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c +@@ -644,7 +644,8 @@ err_setup_rx: + err_alloc_rx: + kfree(txdr); + err_alloc_tx: +- e1000_up(adapter); ++ if (netif_running(adapter->netdev)) ++ e1000_up(adapter); + err_setup: + clear_bit(__E1000_RESETTING, &adapter->flags); + return err; diff --git a/queue-4.18/e1000-ensure-to-free-old-tx-rx-rings-in-set_ringparam.patch b/queue-4.18/e1000-ensure-to-free-old-tx-rx-rings-in-set_ringparam.patch new file mode 100644 index 00000000000..f79d4e8e1c2 --- /dev/null +++ b/queue-4.18/e1000-ensure-to-free-old-tx-rx-rings-in-set_ringparam.patch @@ -0,0 +1,46 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Bo Chen +Date: Mon, 23 Jul 2018 09:01:30 -0700 +Subject: e1000: ensure to free old tx/rx rings in set_ringparam() + +From: Bo Chen + +[ Upstream commit ee400a3f1bfe7004a3e14b81c38ccc5583c26295 ] + +In 'e1000_set_ringparam()', the tx_ring and rx_ring are updated with new value +and the old tx/rx rings are freed only when the device is up. There are resource +leaks on old tx/rx rings when the device is not up. This bug is reported by COD, +a tool for testing kernel module binaries I am building. + +This patch fixes the bug by always calling 'kfree()' on old tx/rx rings in +'e1000_set_ringparam()'. + +Signed-off-by: Bo Chen +Reviewed-by: Alexander Duyck +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c +@@ -624,14 +624,14 @@ static int e1000_set_ringparam(struct ne + adapter->tx_ring = tx_old; + e1000_free_all_rx_resources(adapter); + e1000_free_all_tx_resources(adapter); +- kfree(tx_old); +- kfree(rx_old); + adapter->rx_ring = rxdr; + adapter->tx_ring = txdr; + err = e1000_up(adapter); + if (err) + goto err_setup; + } ++ kfree(tx_old); ++ kfree(rx_old); + + clear_bit(__E1000_RESETTING, &adapter->flags); + return 0; diff --git a/queue-4.18/hwmon-adt7475-make-adt7475_read_word-return-errors.patch b/queue-4.18/hwmon-adt7475-make-adt7475_read_word-return-errors.patch new file mode 100644 index 00000000000..ab844025d6a --- /dev/null +++ b/queue-4.18/hwmon-adt7475-make-adt7475_read_word-return-errors.patch @@ -0,0 +1,47 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Dan Carpenter +Date: Tue, 14 Aug 2018 13:07:47 +0300 +Subject: hwmon: (adt7475) Make adt7475_read_word() return errors + +From: Dan Carpenter + +[ Upstream commit f196dec6d50abb2e65fb54a0621b2f1b4d922995 ] + +The adt7475_read_word() function was meant to return negative error +codes on failure. + +Signed-off-by: Dan Carpenter +Reviewed-by: Tokunori Ikegami +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/adt7475.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/hwmon/adt7475.c ++++ b/drivers/hwmon/adt7475.c +@@ -303,14 +303,18 @@ static inline u16 volt2reg(int channel, + return clamp_val(reg, 0, 1023) & (0xff << 2); + } + +-static u16 adt7475_read_word(struct i2c_client *client, int reg) ++static int adt7475_read_word(struct i2c_client *client, int reg) + { +- u16 val; ++ int val1, val2; + +- val = i2c_smbus_read_byte_data(client, reg); +- val |= (i2c_smbus_read_byte_data(client, reg + 1) << 8); ++ val1 = i2c_smbus_read_byte_data(client, reg); ++ if (val1 < 0) ++ return val1; ++ val2 = i2c_smbus_read_byte_data(client, reg + 1); ++ if (val2 < 0) ++ return val2; + +- return val; ++ return val1 | (val2 << 8); + } + + static void adt7475_write_word(struct i2c_client *client, int reg, u16 val) diff --git a/queue-4.18/hwmon-ina2xx-fix-sysfs-shunt-resistor-read-access.patch b/queue-4.18/hwmon-ina2xx-fix-sysfs-shunt-resistor-read-access.patch new file mode 100644 index 00000000000..e7d5f734713 --- /dev/null +++ b/queue-4.18/hwmon-ina2xx-fix-sysfs-shunt-resistor-read-access.patch @@ -0,0 +1,82 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Lothar Felten +Date: Tue, 14 Aug 2018 09:09:37 +0200 +Subject: hwmon: (ina2xx) fix sysfs shunt resistor read access + +From: Lothar Felten + +[ Upstream commit 3ad867001c91657c46dcf6656d52eb6080286fd5 ] + +fix the sysfs shunt resistor read access: return the shunt resistor +value, not the calibration register contents. + +update email address + +Signed-off-by: Lothar Felten +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/hwmon/ina2xx | 2 +- + drivers/hwmon/ina2xx.c | 13 +++++++++++-- + include/linux/platform_data/ina2xx.h | 2 +- + 3 files changed, 13 insertions(+), 4 deletions(-) + +--- a/Documentation/hwmon/ina2xx ++++ b/Documentation/hwmon/ina2xx +@@ -32,7 +32,7 @@ Supported chips: + Datasheet: Publicly available at the Texas Instruments website + http://www.ti.com/ + +-Author: Lothar Felten ++Author: Lothar Felten + + Description + ----------- +--- a/drivers/hwmon/ina2xx.c ++++ b/drivers/hwmon/ina2xx.c +@@ -17,7 +17,7 @@ + * Bi-directional Current/Power Monitor with I2C Interface + * Datasheet: http://www.ti.com/product/ina230 + * +- * Copyright (C) 2012 Lothar Felten ++ * Copyright (C) 2012 Lothar Felten + * Thanks to Jan Volkering + * + * This program is free software; you can redistribute it and/or modify +@@ -329,6 +329,15 @@ static int ina2xx_set_shunt(struct ina2x + return 0; + } + ++static ssize_t ina2xx_show_shunt(struct device *dev, ++ struct device_attribute *da, ++ char *buf) ++{ ++ struct ina2xx_data *data = dev_get_drvdata(dev); ++ ++ return snprintf(buf, PAGE_SIZE, "%li\n", data->rshunt); ++} ++ + static ssize_t ina2xx_store_shunt(struct device *dev, + struct device_attribute *da, + const char *buf, size_t count) +@@ -403,7 +412,7 @@ static SENSOR_DEVICE_ATTR(power1_input, + + /* shunt resistance */ + static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR, +- ina2xx_show_value, ina2xx_store_shunt, ++ ina2xx_show_shunt, ina2xx_store_shunt, + INA2XX_CALIBRATION); + + /* update interval (ina226 only) */ +--- a/include/linux/platform_data/ina2xx.h ++++ b/include/linux/platform_data/ina2xx.h +@@ -1,7 +1,7 @@ + /* + * Driver for Texas Instruments INA219, INA226 power monitor chips + * +- * Copyright (C) 2012 Lothar Felten ++ * Copyright (C) 2012 Lothar Felten + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as diff --git a/queue-4.18/i2c-i801-allow-acpi-aml-access-i-o-ports-not-reserved-for-smbus.patch b/queue-4.18/i2c-i801-allow-acpi-aml-access-i-o-ports-not-reserved-for-smbus.patch new file mode 100644 index 00000000000..0051ba2b285 --- /dev/null +++ b/queue-4.18/i2c-i801-allow-acpi-aml-access-i-o-ports-not-reserved-for-smbus.patch @@ -0,0 +1,94 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Mika Westerberg +Date: Thu, 30 Aug 2018 11:50:13 +0300 +Subject: i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus + +From: Mika Westerberg + +[ Upstream commit 7fd6d98b89f382d414e1db528e29a67bbd749457 ] + +Commit 7ae81952cda ("i2c: i801: Allow ACPI SystemIO OpRegion to conflict +with PCI BAR") made it possible for AML code to access SMBus I/O ports +by installing custom SystemIO OpRegion handler and blocking i80i driver +access upon first AML read/write to this OpRegion. + +However, while ThinkPad T560 does have SystemIO OpRegion declared under +the SMBus device, it does not access any of the SMBus registers: + + Device (SMBU) + { + ... + + OperationRegion (SMBP, PCI_Config, 0x50, 0x04) + Field (SMBP, DWordAcc, NoLock, Preserve) + { + , 5, + TCOB, 11, + Offset (0x04) + } + + Name (TCBV, 0x00) + Method (TCBS, 0, NotSerialized) + { + If ((TCBV == 0x00)) + { + TCBV = (\_SB.PCI0.SMBU.TCOB << 0x05) + } + + Return (TCBV) /* \_SB_.PCI0.SMBU.TCBV */ + } + + OperationRegion (TCBA, SystemIO, TCBS (), 0x10) + Field (TCBA, ByteAcc, NoLock, Preserve) + { + Offset (0x04), + , 9, + CPSC, 1 + } + } + +Problem with the current approach is that it blocks all I/O port access +and because this system has touchpad connected to the SMBus controller +after first AML access (happens during suspend/resume cycle) the +touchpad fails to work anymore. + +Fix this so that we allow ACPI AML I/O port access if it does not touch +the region reserved for the SMBus. + +Fixes: 7ae81952cda ("i2c: i801: Allow ACPI SystemIO OpRegion to conflict with PCI BAR") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=200737 +Reported-by: Yussuf Khalil +Signed-off-by: Mika Westerberg +Reviewed-by: Jean Delvare +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-i801.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -1417,6 +1417,13 @@ static void i801_add_tco(struct i801_pri + } + + #ifdef CONFIG_ACPI ++static bool i801_acpi_is_smbus_ioport(const struct i801_priv *priv, ++ acpi_physical_address address) ++{ ++ return address >= priv->smba && ++ address <= pci_resource_end(priv->pci_dev, SMBBAR); ++} ++ + static acpi_status + i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits, + u64 *value, void *handler_context, void *region_context) +@@ -1432,7 +1439,7 @@ i801_acpi_io_handler(u32 function, acpi_ + */ + mutex_lock(&priv->acpi_lock); + +- if (!priv->acpi_reserved) { ++ if (!priv->acpi_reserved && i801_acpi_is_smbus_ioport(priv, address)) { + priv->acpi_reserved = true; + + dev_warn(&pdev->dev, "BIOS is accessing SMBus registers\n"); diff --git a/queue-4.18/i40e-fix-condition-of-warn_once-for-stat-strings.patch b/queue-4.18/i40e-fix-condition-of-warn_once-for-stat-strings.patch new file mode 100644 index 00000000000..18a358b4d12 --- /dev/null +++ b/queue-4.18/i40e-fix-condition-of-warn_once-for-stat-strings.patch @@ -0,0 +1,39 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Jacob Keller +Date: Mon, 20 Aug 2018 08:12:27 -0700 +Subject: i40e: fix condition of WARN_ONCE for stat strings + +From: Jacob Keller + +[ Upstream commit 07f3701387dcab3a4fb0166098fb2754a1b927e1 ] + +Commit 9b10df596bd4 ("i40e: use WARN_ONCE to replace the commented +BUG_ON size check") introduced a warning check to make sure +that the size of the stat strings was always the expected value. This +code accidentally inverted the check of the data pointer. Fix this so +that we accurately count the size of the stats we copied in. + +This fixes an erroneous WARN kernel splat that occurs when requesting +ethtool statistics. + +Signed-off-by: Jacob Keller +Tested-by: Andrew Bowers +Tested-by: Mauro S M Rodrigues +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -1903,7 +1903,7 @@ static void i40e_get_stat_strings(struct + data += ETH_GSTRING_LEN; + } + +- WARN_ONCE(p - data != i40e_get_stats_count(netdev) * ETH_GSTRING_LEN, ++ WARN_ONCE(data - p != i40e_get_stats_count(netdev) * ETH_GSTRING_LEN, + "stat strings count mismatch!"); + } + diff --git a/queue-4.18/i40e-fix-for-tx-timeouts-when-interface-is-brought-up-if-dcb-is-enabled.patch b/queue-4.18/i40e-fix-for-tx-timeouts-when-interface-is-brought-up-if-dcb-is-enabled.patch new file mode 100644 index 00000000000..9b0ce93b23a --- /dev/null +++ b/queue-4.18/i40e-fix-for-tx-timeouts-when-interface-is-brought-up-if-dcb-is-enabled.patch @@ -0,0 +1,66 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Martyna Szapar +Date: Tue, 7 Aug 2018 17:11:23 -0700 +Subject: i40e: Fix for Tx timeouts when interface is brought up if DCB is enabled + +From: Martyna Szapar + +[ Upstream commit fa38e30ac73fbb01d7e5d0fd1b12d412fa3ac3ee ] + +If interface is connected to switch port configured for DCB there are +TX timeouts when bringing up interface. Problem started appearing after +adding in i40e driver code mqprio hardware offload mode. In function +i40e_vsi_configure_bw_alloc was added resetting BW rate which should +be executing when mqprio qdisc is removed but was also when there was +no mqprio qdisc added and DCB was enabled. In this patch was added +additional check for DCB flag so now when DCB is enabled the correct +DCB configs from before mqprio patch are restored. + +Signed-off-by: Martyna Szapar +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -5121,15 +5121,17 @@ static int i40e_vsi_configure_bw_alloc(s + u8 *bw_share) + { + struct i40e_aqc_configure_vsi_tc_bw_data bw_data; ++ struct i40e_pf *pf = vsi->back; + i40e_status ret; + int i; + +- if (vsi->back->flags & I40E_FLAG_TC_MQPRIO) ++ /* There is no need to reset BW when mqprio mode is on. */ ++ if (pf->flags & I40E_FLAG_TC_MQPRIO) + return 0; +- if (!vsi->mqprio_qopt.qopt.hw) { ++ if (!vsi->mqprio_qopt.qopt.hw && !(pf->flags & I40E_FLAG_DCB_ENABLED)) { + ret = i40e_set_bw_limit(vsi, vsi->seid, 0); + if (ret) +- dev_info(&vsi->back->pdev->dev, ++ dev_info(&pf->pdev->dev, + "Failed to reset tx rate for vsi->seid %u\n", + vsi->seid); + return ret; +@@ -5138,12 +5140,11 @@ static int i40e_vsi_configure_bw_alloc(s + for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) + bw_data.tc_bw_credits[i] = bw_share[i]; + +- ret = i40e_aq_config_vsi_tc_bw(&vsi->back->hw, vsi->seid, &bw_data, +- NULL); ++ ret = i40e_aq_config_vsi_tc_bw(&pf->hw, vsi->seid, &bw_data, NULL); + if (ret) { +- dev_info(&vsi->back->pdev->dev, ++ dev_info(&pf->pdev->dev, + "AQ command Config VSI BW allocation per TC failed = %d\n", +- vsi->back->hw.aq.asq_last_status); ++ pf->hw.aq.asq_last_status); + return -EINVAL; + } + diff --git a/queue-4.18/ice-clean-control-queues-only-when-they-are-initialized.patch b/queue-4.18/ice-clean-control-queues-only-when-they-are-initialized.patch new file mode 100644 index 00000000000..b6d7ceeb34c --- /dev/null +++ b/queue-4.18/ice-clean-control-queues-only-when-they-are-initialized.patch @@ -0,0 +1,65 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Preethi Banala +Date: Thu, 9 Aug 2018 06:28:55 -0700 +Subject: ice: Clean control queues only when they are initialized + +From: Preethi Banala + +[ Upstream commit b29bc220e2c7bd494a4605defcd93b18d5a8cf86 ] + +Clean control queues only when they are initialized. One of the ways to +validate if the basic initialization is done is by checking value of +cq->sq.head and cq->rq.head variables that specify the register address. +This patch adds a check to avoid NULL pointer dereference crash when tried +to shutdown uninitialized control queue. + +Signed-off-by: Preethi Banala +Signed-off-by: Anirudh Venkataramanan +Tested-by: Tony Brelinski +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_controlq.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_controlq.c ++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c +@@ -597,10 +597,14 @@ static enum ice_status ice_init_check_ad + return 0; + + init_ctrlq_free_rq: +- ice_shutdown_rq(hw, cq); +- ice_shutdown_sq(hw, cq); +- mutex_destroy(&cq->sq_lock); +- mutex_destroy(&cq->rq_lock); ++ if (cq->rq.head) { ++ ice_shutdown_rq(hw, cq); ++ mutex_destroy(&cq->rq_lock); ++ } ++ if (cq->sq.head) { ++ ice_shutdown_sq(hw, cq); ++ mutex_destroy(&cq->sq_lock); ++ } + return status; + } + +@@ -706,10 +710,14 @@ static void ice_shutdown_ctrlq(struct ic + return; + } + +- ice_shutdown_sq(hw, cq); +- ice_shutdown_rq(hw, cq); +- mutex_destroy(&cq->sq_lock); +- mutex_destroy(&cq->rq_lock); ++ if (cq->sq.head) { ++ ice_shutdown_sq(hw, cq); ++ mutex_destroy(&cq->sq_lock); ++ } ++ if (cq->rq.head) { ++ ice_shutdown_rq(hw, cq); ++ mutex_destroy(&cq->rq_lock); ++ } + } + + /** diff --git a/queue-4.18/ice-fix-a-few-null-pointer-dereference-issues.patch b/queue-4.18/ice-fix-a-few-null-pointer-dereference-issues.patch new file mode 100644 index 00000000000..0d5560d2c62 --- /dev/null +++ b/queue-4.18/ice-fix-a-few-null-pointer-dereference-issues.patch @@ -0,0 +1,71 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Anirudh Venkataramanan +Date: Thu, 9 Aug 2018 06:29:00 -0700 +Subject: ice: Fix a few null pointer dereference issues + +From: Anirudh Venkataramanan + +[ Upstream commit c7f2c42b80ed6009f44e355aefc1e40db9485a9d ] + +1) When ice_ena_msix_range() fails to reserve vectors, a devm_kfree() + warning was seen in the error flow path. So check pf->irq_tracker + before use in ice_clear_interrupt_scheme(). + +2) In ice_vsi_cfg(), check vsi->netdev before use. + +3) In ice_get_link_status, check link_up before use. + +Signed-off-by: Anirudh Venkataramanan +Tested-by: Tony Brelinski +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_common.c | 2 +- + drivers/net/ethernet/intel/ice/ice_main.c | 17 ++++++++++------- + 2 files changed, 11 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_common.c ++++ b/drivers/net/ethernet/intel/ice/ice_common.c +@@ -1483,7 +1483,7 @@ enum ice_status ice_get_link_status(stru + struct ice_phy_info *phy_info; + enum ice_status status = 0; + +- if (!pi) ++ if (!pi || !link_up) + return ICE_ERR_PARAM; + + phy_info = &pi->phy; +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -3260,8 +3260,10 @@ static void ice_clear_interrupt_scheme(s + if (test_bit(ICE_FLAG_MSIX_ENA, pf->flags)) + ice_dis_msix(pf); + +- devm_kfree(&pf->pdev->dev, pf->irq_tracker); +- pf->irq_tracker = NULL; ++ if (pf->irq_tracker) { ++ devm_kfree(&pf->pdev->dev, pf->irq_tracker); ++ pf->irq_tracker = NULL; ++ } + } + + /** +@@ -4115,11 +4117,12 @@ static int ice_vsi_cfg(struct ice_vsi *v + { + int err; + +- ice_set_rx_mode(vsi->netdev); +- +- err = ice_restore_vlan(vsi); +- if (err) +- return err; ++ if (vsi->netdev) { ++ ice_set_rx_mode(vsi->netdev); ++ err = ice_restore_vlan(vsi); ++ if (err) ++ return err; ++ } + + err = ice_vsi_cfg_txqs(vsi); + if (!err) diff --git a/queue-4.18/ice-fix-bugs-in-control-queue-processing.patch b/queue-4.18/ice-fix-bugs-in-control-queue-processing.patch new file mode 100644 index 00000000000..24ced6450b5 --- /dev/null +++ b/queue-4.18/ice-fix-bugs-in-control-queue-processing.patch @@ -0,0 +1,97 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Anirudh Venkataramanan +Date: Thu, 9 Aug 2018 06:28:56 -0700 +Subject: ice: Fix bugs in control queue processing + +From: Anirudh Venkataramanan + +[ Upstream commit 3d6b640efcc1b07709b42dd2e9609401c6f88633 ] + +This patch is a consolidation of multiple bug fixes for control queue +processing. + +1) In ice_clean_adminq_subtask() remove unnecessary reads/writes to + registers. The bits PFINT_FW_CTL, PFINT_MBX_CTL and PFINT_SB_CTL + are not set when an interrupt arrives, which means that clearing them + again can be omitted. + +2) Get an accurate value in "pending" by re-reading the control queue + head register from the hardware. + +3) Fix a corner case involving lost control queue messages by checking + for new control messages (using ice_ctrlq_pending) before exiting the + cleanup routine. + +Signed-off-by: Anirudh Venkataramanan +Tested-by: Tony Brelinski +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_controlq.c | 5 ++++- + drivers/net/ethernet/intel/ice/ice_main.c | 26 ++++++++++++++++++++++---- + 2 files changed, 26 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_controlq.c ++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c +@@ -1065,8 +1065,11 @@ ice_clean_rq_elem(struct ice_hw *hw, str + + clean_rq_elem_out: + /* Set pending if needed, unlock and return */ +- if (pending) ++ if (pending) { ++ /* re-read HW head to calculate actual pending messages */ ++ ntu = (u16)(rd32(hw, cq->rq.head) & cq->rq.head_mask); + *pending = (u16)((ntc > ntu ? cq->rq.count : 0) + (ntu - ntc)); ++ } + clean_rq_elem_err: + mutex_unlock(&cq->rq_lock); + +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -917,13 +917,27 @@ static int __ice_clean_ctrlq(struct ice_ + } + + /** ++ * ice_ctrlq_pending - check if there is a difference between ntc and ntu ++ * @hw: pointer to hardware info ++ * @cq: control queue information ++ * ++ * returns true if there are pending messages in a queue, false if there aren't ++ */ ++static bool ice_ctrlq_pending(struct ice_hw *hw, struct ice_ctl_q_info *cq) ++{ ++ u16 ntu; ++ ++ ntu = (u16)(rd32(hw, cq->rq.head) & cq->rq.head_mask); ++ return cq->rq.next_to_clean != ntu; ++} ++ ++/** + * ice_clean_adminq_subtask - clean the AdminQ rings + * @pf: board private structure + */ + static void ice_clean_adminq_subtask(struct ice_pf *pf) + { + struct ice_hw *hw = &pf->hw; +- u32 val; + + if (!test_bit(__ICE_ADMINQ_EVENT_PENDING, pf->state)) + return; +@@ -933,9 +947,13 @@ static void ice_clean_adminq_subtask(str + + clear_bit(__ICE_ADMINQ_EVENT_PENDING, pf->state); + +- /* re-enable Admin queue interrupt causes */ +- val = rd32(hw, PFINT_FW_CTL); +- wr32(hw, PFINT_FW_CTL, (val | PFINT_FW_CTL_CAUSE_ENA_M)); ++ /* There might be a situation where new messages arrive to a control ++ * queue between processing the last message and clearing the ++ * EVENT_PENDING bit. So before exiting, check queue head again (using ++ * ice_ctrlq_pending) and process new messages if any. ++ */ ++ if (ice_ctrlq_pending(hw, &hw->adminq)) ++ __ice_clean_ctrlq(pf, ICE_CTL_Q_ADMIN); + + ice_flush(hw); + } diff --git a/queue-4.18/ice-fix-multiple-static-analyser-warnings.patch b/queue-4.18/ice-fix-multiple-static-analyser-warnings.patch new file mode 100644 index 00000000000..06923d1fe53 --- /dev/null +++ b/queue-4.18/ice-fix-multiple-static-analyser-warnings.patch @@ -0,0 +1,146 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Anirudh Venkataramanan +Date: Thu, 9 Aug 2018 06:28:51 -0700 +Subject: ice: Fix multiple static analyser warnings + +From: Anirudh Venkataramanan + +[ Upstream commit 4381147df9098706caa5cf9fda37e53b2fe4871f ] + +This patch fixes the following smatch errors: + +1) Fix "odd binop '0x0 & 0xc'" when performing the bitwise-and with a + constant value of zero (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128_FLAG). + Remove a similar bitwise-and with 0 in ice_add_marker_act() and use the + right mask ICE_LG_ACT_GENERIC_OFFSET_M in the expression. + +2) Fix a similar issue "odd binop '0x0 & 0x1800' in ice_req_irq_msix_misc. + +3) Fix "odd binop '0x380000 & 0x7fff8'" in ice_add_marker_act(). Also, use + a new define ICE_LG_ACT_GENERIC_OFF_RX_DESC_PROF_IDX instead of magic + number '7'. + +4) Fix warn: odd binop '0x0 & 0x18' in ice_set_dflt_vsi_ctx() by removing + unnecessary logic to explicitly unset bits 3 and 4 in port_vlan_bits. + These bits are unset already by the memset on ctxt->info. + +Reported-by: Dan Carpenter +Signed-off-by: Anirudh Venkataramanan +Tested-by: Tony Brelinski +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 1 + drivers/net/ethernet/intel/ice/ice_common.c | 25 +++++++++++++----------- + drivers/net/ethernet/intel/ice/ice_main.c | 19 +++++++----------- + drivers/net/ethernet/intel/ice/ice_switch.c | 4 +-- + 4 files changed, 25 insertions(+), 24 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h ++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +@@ -594,6 +594,7 @@ struct ice_sw_rule_lg_act { + #define ICE_LG_ACT_GENERIC_OFFSET_M (0x7 << ICE_LG_ACT_GENERIC_OFFSET_S) + #define ICE_LG_ACT_GENERIC_PRIORITY_S 22 + #define ICE_LG_ACT_GENERIC_PRIORITY_M (0x7 << ICE_LG_ACT_GENERIC_PRIORITY_S) ++#define ICE_LG_ACT_GENERIC_OFF_RX_DESC_PROF_IDX 7 + + /* Action = 7 - Set Stat count */ + #define ICE_LG_ACT_STAT_COUNT 0x7 +--- a/drivers/net/ethernet/intel/ice/ice_common.c ++++ b/drivers/net/ethernet/intel/ice/ice_common.c +@@ -1619,20 +1619,23 @@ __ice_aq_get_set_rss_lut(struct ice_hw * + } + + /* LUT size is only valid for Global and PF table types */ +- if (lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128) { +- flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128_FLAG << +- ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) & +- ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M; +- } else if (lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512) { ++ switch (lut_size) { ++ case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128: ++ break; ++ case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512: + flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512_FLAG << + ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) & + ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M; +- } else if ((lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K) && +- (lut_type == ICE_AQC_GSET_RSS_LUT_TABLE_TYPE_PF)) { +- flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K_FLAG << +- ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) & +- ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M; +- } else { ++ break; ++ case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K: ++ if (lut_type == ICE_AQC_GSET_RSS_LUT_TABLE_TYPE_PF) { ++ flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K_FLAG << ++ ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) & ++ ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M; ++ break; ++ } ++ /* fall-through */ ++ default: + status = ICE_ERR_PARAM; + goto ice_aq_get_set_rss_lut_exit; + } +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -1352,14 +1352,13 @@ static void ice_set_dflt_vsi_ctx(struct + ctxt->info.sw_flags = ICE_AQ_VSI_SW_FLAG_SRC_PRUNE; + /* Traffic from VSI can be sent to LAN */ + ctxt->info.sw_flags2 = ICE_AQ_VSI_SW_FLAG_LAN_ENA; +- /* Allow all packets untagged/tagged */ ++ /* By default bits 3 and 4 in port_vlan_flags are 0's which results in ++ * legacy behavior (show VLAN, DEI, and UP) in descriptor. Also, allow ++ * all packets untagged/tagged. ++ */ + ctxt->info.port_vlan_flags = ((ICE_AQ_VSI_PVLAN_MODE_ALL & + ICE_AQ_VSI_PVLAN_MODE_M) >> + ICE_AQ_VSI_PVLAN_MODE_S); +- /* Show VLAN/UP from packets in Rx descriptors */ +- ctxt->info.port_vlan_flags |= ((ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH & +- ICE_AQ_VSI_PVLAN_EMOD_M) >> +- ICE_AQ_VSI_PVLAN_EMOD_S); + /* Have 1:1 UP mapping for both ingress/egress tables */ + table |= ICE_UP_TABLE_TRANSLATE(0, 0); + table |= ICE_UP_TABLE_TRANSLATE(1, 1); +@@ -2058,15 +2057,13 @@ static int ice_req_irq_msix_misc(struct + skip_req_irq: + ice_ena_misc_vector(pf); + +- val = (pf->oicr_idx & PFINT_OICR_CTL_MSIX_INDX_M) | +- (ICE_RX_ITR & PFINT_OICR_CTL_ITR_INDX_M) | +- PFINT_OICR_CTL_CAUSE_ENA_M; ++ val = ((pf->oicr_idx & PFINT_OICR_CTL_MSIX_INDX_M) | ++ PFINT_OICR_CTL_CAUSE_ENA_M); + wr32(hw, PFINT_OICR_CTL, val); + + /* This enables Admin queue Interrupt causes */ +- val = (pf->oicr_idx & PFINT_FW_CTL_MSIX_INDX_M) | +- (ICE_RX_ITR & PFINT_FW_CTL_ITR_INDX_M) | +- PFINT_FW_CTL_CAUSE_ENA_M; ++ val = ((pf->oicr_idx & PFINT_FW_CTL_MSIX_INDX_M) | ++ PFINT_FW_CTL_CAUSE_ENA_M); + wr32(hw, PFINT_FW_CTL, val); + + itr_gran = hw->itr_gran_200; +--- a/drivers/net/ethernet/intel/ice/ice_switch.c ++++ b/drivers/net/ethernet/intel/ice/ice_switch.c +@@ -645,14 +645,14 @@ ice_add_marker_act(struct ice_hw *hw, st + act |= (1 << ICE_LG_ACT_GENERIC_VALUE_S) & ICE_LG_ACT_GENERIC_VALUE_M; + lg_act->pdata.lg_act.act[1] = cpu_to_le32(act); + +- act = (7 << ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_VALUE_M; ++ act = (ICE_LG_ACT_GENERIC_OFF_RX_DESC_PROF_IDX << ++ ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_OFFSET_M; + + /* Third action Marker value */ + act |= ICE_LG_ACT_GENERIC; + act |= (sw_marker << ICE_LG_ACT_GENERIC_VALUE_S) & + ICE_LG_ACT_GENERIC_VALUE_M; + +- act |= (0 << ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_VALUE_M; + lg_act->pdata.lg_act.act[2] = cpu_to_le32(act); + + /* call the fill switch rule to fill the lookup tx rx structure */ diff --git a/queue-4.18/ice-fix-potential-return-of-uninitialized-value.patch b/queue-4.18/ice-fix-potential-return-of-uninitialized-value.patch new file mode 100644 index 00000000000..3e44c96cab8 --- /dev/null +++ b/queue-4.18/ice-fix-potential-return-of-uninitialized-value.patch @@ -0,0 +1,42 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Jesse Brandeburg +Date: Thu, 9 Aug 2018 06:29:01 -0700 +Subject: ice: Fix potential return of uninitialized value + +From: Jesse Brandeburg + +[ Upstream commit dab0588fb616c1774bbf108eab1749dda4ac6942 ] + +In ice_vsi_setup_[tx|rx]_rings, err is uninitialized which can result in +a garbage value return to the caller. Fix that. + +Signed-off-by: Jesse Brandeburg +Signed-off-by: Anirudh Venkataramanan +Tested-by: Tony Brelinski +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -4888,7 +4888,7 @@ int ice_down(struct ice_vsi *vsi) + */ + static int ice_vsi_setup_tx_rings(struct ice_vsi *vsi) + { +- int i, err; ++ int i, err = 0; + + if (!vsi->num_txq) { + dev_err(&vsi->back->pdev->dev, "VSI %d has 0 Tx queues\n", +@@ -4913,7 +4913,7 @@ static int ice_vsi_setup_tx_rings(struct + */ + static int ice_vsi_setup_rx_rings(struct ice_vsi *vsi) + { +- int i, err; ++ int i, err = 0; + + if (!vsi->num_rxq) { + dev_err(&vsi->back->pdev->dev, "VSI %d has 0 Rx queues\n", diff --git a/queue-4.18/ice-report-stats-for-allocated-queues-via-ethtool-stats.patch b/queue-4.18/ice-report-stats-for-allocated-queues-via-ethtool-stats.patch new file mode 100644 index 00000000000..f56b92a96a2 --- /dev/null +++ b/queue-4.18/ice-report-stats-for-allocated-queues-via-ethtool-stats.patch @@ -0,0 +1,192 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Jacob Keller +Date: Thu, 9 Aug 2018 06:28:54 -0700 +Subject: ice: Report stats for allocated queues via ethtool stats + +From: Jacob Keller + +[ Upstream commit f8ba7db850350319348b6d3c276f8ba19bc098ef ] + +It is not safe to have the string table for statistics change order or +size over the lifetime of a given netdevice. This is because of the +nature of the 3-step process for obtaining stats. First, user space +performs a request for the size of the strings table. Second it performs +a separate request for the strings themselves, after allocating space +for the table. Third, it requests the stats themselves, also allocating +space for the table. + +If the size decreased, there is potential to see garbage data or stats +values. In the worst case, we could potentially see stats values become +mis-aligned with their strings, so that it looks like a statistic is +being reported differently than it actually is. + +Even worse, if the size increased, there is potential that the strings +table or stats table was not allocated large enough and the stats code +could access and write to memory it should not, potentially resulting in +undefined behavior and system crashes. + +It isn't even safe if the size always changes under the RTNL lock. This +is because the calls take place over multiple user space commands, so it +is not possible to hold the RTNL lock for the entire duration of +obtaining strings and stats. Further, not all consumers of the ethtool +API are the user space ethtool program, and it is possible that one +assumes the strings will not change (valid under the current contract), +and thus only requests the stats values when requesting stats in a loop. + +Finally, it's not possible in the general case to detect when the size +changes, because it is quite possible that one value which could impact +the stat size increased, while another decreased. This would result in +the same total number of stats, but reordering them so that stats no +longer line up with the strings they belong to. Since only size changes +aren't enough, we would need some sort of hash or token to determine +when the strings no longer match. This would require extending the +ethtool stats commands, but there is no more space in the relevant +structures. + +The real solution to resolve this would be to add a completely new API +for stats, probably over netlink. + +In the ice driver, the only thing impacting the stats that is not +constant is the number of queues. Instead of reporting stats for each +used queue, report stats for each allocated queue. We do not change the +number of queues allocated for a given netdevice, as we pass this into +the alloc_etherdev_mq() function to set the num_tx_queues and +num_rx_queues. + +This resolves the potential bugs at the slight cost of displaying many +queue statistics which will not be activated. + +Signed-off-by: Jacob Keller +Signed-off-by: Anirudh Venkataramanan +Tested-by: Tony Brelinski +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice.h | 7 +++ + drivers/net/ethernet/intel/ice/ice_ethtool.c | 52 ++++++++++++++++++++------- + 2 files changed, 46 insertions(+), 13 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice.h ++++ b/drivers/net/ethernet/intel/ice/ice.h +@@ -89,6 +89,13 @@ extern const char ice_drv_ver[]; + #define ice_for_each_rxq(vsi, i) \ + for ((i) = 0; (i) < (vsi)->num_rxq; (i)++) + ++/* Macros for each allocated tx/rx ring whether used or not in a VSI */ ++#define ice_for_each_alloc_txq(vsi, i) \ ++ for ((i) = 0; (i) < (vsi)->alloc_txq; (i)++) ++ ++#define ice_for_each_alloc_rxq(vsi, i) \ ++ for ((i) = 0; (i) < (vsi)->alloc_rxq; (i)++) ++ + struct ice_tc_info { + u16 qoffset; + u16 qcount; +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -26,7 +26,7 @@ static int ice_q_stats_len(struct net_de + { + struct ice_netdev_priv *np = netdev_priv(netdev); + +- return ((np->vsi->num_txq + np->vsi->num_rxq) * ++ return ((np->vsi->alloc_txq + np->vsi->alloc_rxq) * + (sizeof(struct ice_q_stats) / sizeof(u64))); + } + +@@ -218,7 +218,7 @@ static void ice_get_strings(struct net_d + p += ETH_GSTRING_LEN; + } + +- ice_for_each_txq(vsi, i) { ++ ice_for_each_alloc_txq(vsi, i) { + snprintf(p, ETH_GSTRING_LEN, + "tx-queue-%u.tx_packets", i); + p += ETH_GSTRING_LEN; +@@ -226,7 +226,7 @@ static void ice_get_strings(struct net_d + p += ETH_GSTRING_LEN; + } + +- ice_for_each_rxq(vsi, i) { ++ ice_for_each_alloc_rxq(vsi, i) { + snprintf(p, ETH_GSTRING_LEN, + "rx-queue-%u.rx_packets", i); + p += ETH_GSTRING_LEN; +@@ -253,6 +253,24 @@ static int ice_get_sset_count(struct net + { + switch (sset) { + case ETH_SS_STATS: ++ /* The number (and order) of strings reported *must* remain ++ * constant for a given netdevice. This function must not ++ * report a different number based on run time parameters ++ * (such as the number of queues in use, or the setting of ++ * a private ethtool flag). This is due to the nature of the ++ * ethtool stats API. ++ * ++ * User space programs such as ethtool must make 3 separate ++ * ioctl requests, one for size, one for the strings, and ++ * finally one for the stats. Since these cross into ++ * user space, changes to the number or size could result in ++ * undefined memory access or incorrect string<->value ++ * correlations for statistics. ++ * ++ * Even if it appears to be safe, changes to the size or ++ * order of strings will suffer from race conditions and are ++ * not safe. ++ */ + return ICE_ALL_STATS_LEN(netdev); + default: + return -EOPNOTSUPP; +@@ -280,18 +298,26 @@ ice_get_ethtool_stats(struct net_device + /* populate per queue stats */ + rcu_read_lock(); + +- ice_for_each_txq(vsi, j) { ++ ice_for_each_alloc_txq(vsi, j) { + ring = READ_ONCE(vsi->tx_rings[j]); +- if (!ring) +- continue; +- data[i++] = ring->stats.pkts; +- data[i++] = ring->stats.bytes; ++ if (ring) { ++ data[i++] = ring->stats.pkts; ++ data[i++] = ring->stats.bytes; ++ } else { ++ data[i++] = 0; ++ data[i++] = 0; ++ } + } + +- ice_for_each_rxq(vsi, j) { ++ ice_for_each_alloc_rxq(vsi, j) { + ring = READ_ONCE(vsi->rx_rings[j]); +- data[i++] = ring->stats.pkts; +- data[i++] = ring->stats.bytes; ++ if (ring) { ++ data[i++] = ring->stats.pkts; ++ data[i++] = ring->stats.bytes; ++ } else { ++ data[i++] = 0; ++ data[i++] = 0; ++ } + } + + rcu_read_unlock(); +@@ -519,7 +545,7 @@ ice_set_ringparam(struct net_device *net + goto done; + } + +- for (i = 0; i < vsi->num_txq; i++) { ++ for (i = 0; i < vsi->alloc_txq; i++) { + /* clone ring and setup updated count */ + tx_rings[i] = *vsi->tx_rings[i]; + tx_rings[i].count = new_tx_cnt; +@@ -551,7 +577,7 @@ process_rx: + goto done; + } + +- for (i = 0; i < vsi->num_rxq; i++) { ++ for (i = 0; i < vsi->alloc_rxq; i++) { + /* clone ring and setup updated count */ + rx_rings[i] = *vsi->rx_rings[i]; + rx_rings[i].count = new_rx_cnt; diff --git a/queue-4.18/ice-set-vlan-flags-correctly.patch b/queue-4.18/ice-set-vlan-flags-correctly.patch new file mode 100644 index 00000000000..d55dc574b42 --- /dev/null +++ b/queue-4.18/ice-set-vlan-flags-correctly.patch @@ -0,0 +1,139 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Brett Creeley +Date: Thu, 9 Aug 2018 06:28:58 -0700 +Subject: ice: Set VLAN flags correctly + +From: Brett Creeley + +[ Upstream commit 5d8778d803e21f235e9bc727b5bd619f02abb88b ] + +In the struct ice_aqc_vsi_props the field port_vlan_flags is an +overloaded term because it is used for both port VLANs (PVLANs) and +regular VLANs. This is an issue and is very confusing especially when +dealing with VFs because normal VLANs and port VLANs are not the same. +To fix this the field was renamed to vlan_flags and all of the #define's +labeled *_PVLAN_* were renamed to *_VLAN_* if they are not specific to +port VLANs. + +Also in ice_vsi_manage_vlan_stripping, set the ICE_AQ_VSI_VLAN_MODE_ALL +bit to allow the driver to add a VLAN tag to all packets it sends. + +Signed-off-by: Brett Creeley +Signed-off-by: Anirudh Venkataramanan +Tested-by: Tony Brelinski +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 24 +++++++++--------- + drivers/net/ethernet/intel/ice/ice_main.c | 31 +++++++++++++----------- + 2 files changed, 30 insertions(+), 25 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h ++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +@@ -329,19 +329,19 @@ struct ice_aqc_vsi_props { + /* VLAN section */ + __le16 pvid; /* VLANS include priority bits */ + u8 pvlan_reserved[2]; +- u8 port_vlan_flags; +-#define ICE_AQ_VSI_PVLAN_MODE_S 0 +-#define ICE_AQ_VSI_PVLAN_MODE_M (0x3 << ICE_AQ_VSI_PVLAN_MODE_S) +-#define ICE_AQ_VSI_PVLAN_MODE_UNTAGGED 0x1 +-#define ICE_AQ_VSI_PVLAN_MODE_TAGGED 0x2 +-#define ICE_AQ_VSI_PVLAN_MODE_ALL 0x3 ++ u8 vlan_flags; ++#define ICE_AQ_VSI_VLAN_MODE_S 0 ++#define ICE_AQ_VSI_VLAN_MODE_M (0x3 << ICE_AQ_VSI_VLAN_MODE_S) ++#define ICE_AQ_VSI_VLAN_MODE_UNTAGGED 0x1 ++#define ICE_AQ_VSI_VLAN_MODE_TAGGED 0x2 ++#define ICE_AQ_VSI_VLAN_MODE_ALL 0x3 + #define ICE_AQ_VSI_PVLAN_INSERT_PVID BIT(2) +-#define ICE_AQ_VSI_PVLAN_EMOD_S 3 +-#define ICE_AQ_VSI_PVLAN_EMOD_M (0x3 << ICE_AQ_VSI_PVLAN_EMOD_S) +-#define ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH (0x0 << ICE_AQ_VSI_PVLAN_EMOD_S) +-#define ICE_AQ_VSI_PVLAN_EMOD_STR_UP (0x1 << ICE_AQ_VSI_PVLAN_EMOD_S) +-#define ICE_AQ_VSI_PVLAN_EMOD_STR (0x2 << ICE_AQ_VSI_PVLAN_EMOD_S) +-#define ICE_AQ_VSI_PVLAN_EMOD_NOTHING (0x3 << ICE_AQ_VSI_PVLAN_EMOD_S) ++#define ICE_AQ_VSI_VLAN_EMOD_S 3 ++#define ICE_AQ_VSI_VLAN_EMOD_M (0x3 << ICE_AQ_VSI_VLAN_EMOD_S) ++#define ICE_AQ_VSI_VLAN_EMOD_STR_BOTH (0x0 << ICE_AQ_VSI_VLAN_EMOD_S) ++#define ICE_AQ_VSI_VLAN_EMOD_STR_UP (0x1 << ICE_AQ_VSI_VLAN_EMOD_S) ++#define ICE_AQ_VSI_VLAN_EMOD_STR (0x2 << ICE_AQ_VSI_VLAN_EMOD_S) ++#define ICE_AQ_VSI_VLAN_EMOD_NOTHING (0x3 << ICE_AQ_VSI_VLAN_EMOD_S) + u8 pvlan_reserved2[3]; + /* ingress egress up sections */ + __le32 ingress_table; /* bitmap, 3 bits per up */ +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -1367,13 +1367,15 @@ static void ice_set_dflt_vsi_ctx(struct + ctxt->info.sw_flags = ICE_AQ_VSI_SW_FLAG_SRC_PRUNE; + /* Traffic from VSI can be sent to LAN */ + ctxt->info.sw_flags2 = ICE_AQ_VSI_SW_FLAG_LAN_ENA; +- /* By default bits 3 and 4 in port_vlan_flags are 0's which results in +- * legacy behavior (show VLAN, DEI, and UP) in descriptor. Also, allow +- * all packets untagged/tagged. ++ ++ /* By default bits 3 and 4 in vlan_flags are 0's which results in legacy ++ * behavior (show VLAN, DEI, and UP) in descriptor. Also, allow all ++ * packets untagged/tagged. + */ +- ctxt->info.port_vlan_flags = ((ICE_AQ_VSI_PVLAN_MODE_ALL & +- ICE_AQ_VSI_PVLAN_MODE_M) >> +- ICE_AQ_VSI_PVLAN_MODE_S); ++ ctxt->info.vlan_flags = ((ICE_AQ_VSI_VLAN_MODE_ALL & ++ ICE_AQ_VSI_VLAN_MODE_M) >> ++ ICE_AQ_VSI_VLAN_MODE_S); ++ + /* Have 1:1 UP mapping for both ingress/egress tables */ + table |= ICE_UP_TABLE_TRANSLATE(0, 0); + table |= ICE_UP_TABLE_TRANSLATE(1, 1); +@@ -3732,10 +3734,10 @@ static int ice_vsi_manage_vlan_insertion + enum ice_status status; + + /* Here we are configuring the VSI to let the driver add VLAN tags by +- * setting port_vlan_flags to ICE_AQ_VSI_PVLAN_MODE_ALL. The actual VLAN +- * tag insertion happens in the Tx hot path, in ice_tx_map. ++ * setting vlan_flags to ICE_AQ_VSI_VLAN_MODE_ALL. The actual VLAN tag ++ * insertion happens in the Tx hot path, in ice_tx_map. + */ +- ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_MODE_ALL; ++ ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_MODE_ALL; + + ctxt.info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_VLAN_VALID); + ctxt.vsi_num = vsi->vsi_num; +@@ -3747,7 +3749,7 @@ static int ice_vsi_manage_vlan_insertion + return -EIO; + } + +- vsi->info.port_vlan_flags = ctxt.info.port_vlan_flags; ++ vsi->info.vlan_flags = ctxt.info.vlan_flags; + return 0; + } + +@@ -3769,12 +3771,15 @@ static int ice_vsi_manage_vlan_stripping + */ + if (ena) { + /* Strip VLAN tag from Rx packet and put it in the desc */ +- ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH; ++ ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_EMOD_STR_BOTH; + } else { + /* Disable stripping. Leave tag in packet */ +- ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_EMOD_NOTHING; ++ ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_EMOD_NOTHING; + } + ++ /* Allow all packets untagged/tagged */ ++ ctxt.info.vlan_flags |= ICE_AQ_VSI_VLAN_MODE_ALL; ++ + ctxt.info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_VLAN_VALID); + ctxt.vsi_num = vsi->vsi_num; + +@@ -3785,7 +3790,7 @@ static int ice_vsi_manage_vlan_stripping + return -EIO; + } + +- vsi->info.port_vlan_flags = ctxt.info.port_vlan_flags; ++ vsi->info.vlan_flags = ctxt.info.vlan_flags; + return 0; + } + diff --git a/queue-4.18/ice-use-order_base_2-to-calculate-higher-power-of-2.patch b/queue-4.18/ice-use-order_base_2-to-calculate-higher-power-of-2.patch new file mode 100644 index 00000000000..7f650c6bd79 --- /dev/null +++ b/queue-4.18/ice-use-order_base_2-to-calculate-higher-power-of-2.patch @@ -0,0 +1,55 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Jacob Keller +Date: Thu, 9 Aug 2018 06:28:57 -0700 +Subject: ice: Use order_base_2 to calculate higher power of 2 + +From: Jacob Keller + +[ Upstream commit 1eb43fc754485d772b1165118a8fb80c385f0492 ] + +Currently, we use a combination of ilog2 and is_power_of_2() to +calculate the next power of 2 for the qcount. This appears to be causing +a warning on some combinations of GCC and the Linux kernel: + +MODPOST 1 modules +WARNING: "____ilog2_NaN" [ice.ko] undefined! + +This appears to because because GCC realizes that qcount could be zero +in some circumstances and thus attempts to link against the +intentionally undefined ___ilog2_NaN function. + +The order_base_2 function is intentionally defined to return 0 when +passed 0 as an argument, and thus will be safe to use here. + +This not only fixes the warning but makes the resulting code slightly +cleaner, and is really what we should have used originally. + +Also update the comment to make it more clear that we are rounding up, +not just incrementing the ilog2 of qcount unconditionally. + +Signed-off-by: Jacob Keller +Signed-off-by: Anirudh Venkataramanan +Tested-by: Tony Brelinski +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_main.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -1313,11 +1313,8 @@ static void ice_vsi_setup_q_map(struct i + qcount = numq_tc; + } + +- /* find higher power-of-2 of qcount */ +- pow = ilog2(qcount); +- +- if (!is_power_of_2(qcount)) +- pow++; ++ /* find the (rounded up) power-of-2 of qcount */ ++ pow = order_base_2(qcount); + + for (i = 0; i < ICE_MAX_TRAFFIC_CLASS; i++) { + if (!(vsi->tc_cfg.ena_tc & BIT(i))) { diff --git a/queue-4.18/isofs-reject-hardware-sector-size-2048-bytes.patch b/queue-4.18/isofs-reject-hardware-sector-size-2048-bytes.patch new file mode 100644 index 00000000000..1658840f778 --- /dev/null +++ b/queue-4.18/isofs-reject-hardware-sector-size-2048-bytes.patch @@ -0,0 +1,59 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Eric Sandeen +Date: Thu, 16 Aug 2018 21:44:02 -0500 +Subject: isofs: reject hardware sector size > 2048 bytes + +From: Eric Sandeen + +[ Upstream commit 09a4e0be5826aa66c4ce9954841f110ffe63ef4f ] + +The largest block size supported by isofs is ISOFS_BLOCK_SIZE (2048), but +isofs_fill_super calls sb_min_blocksize and sets the blocksize to the +device's logical block size if it's larger than what we ended up with after +option parsing. + +If for some reason we try to mount a hard 4k device as an isofs filesystem, +we'll set opt.blocksize to 4096, and when we try to read the superblock +we found via: + + block = iso_blknum << (ISOFS_BLOCK_BITS - s->s_blocksize_bits) + +with s_blocksize_bits greater than ISOFS_BLOCK_BITS, we'll have a negative +shift and the bread will fail somewhat cryptically: + + isofs_fill_super: bread failed, dev=sda, iso_blknum=17, block=-2147483648 + +It seems best to just catch and clearly reject mounts of such a device. + +Reported-by: Bryan Gurney +Signed-off-by: Eric Sandeen +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/isofs/inode.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/isofs/inode.c ++++ b/fs/isofs/inode.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + #include "isofs.h" + #include "zisofs.h" +@@ -653,6 +654,12 @@ static int isofs_fill_super(struct super + /* + * What if bugger tells us to go beyond page size? + */ ++ if (bdev_logical_block_size(s->s_bdev) > 2048) { ++ printk(KERN_WARNING ++ "ISOFS: unsupported/invalid hardware sector size %d\n", ++ bdev_logical_block_size(s->s_bdev)); ++ goto out_freesbi; ++ } + opt.blocksize = sb_min_blocksize(s, opt.blocksize); + + sbi->s_high_sierra = 0; /* default is iso9660 */ diff --git a/queue-4.18/ixgbe-fix-driver-behaviour-after-issuing-vflr.patch b/queue-4.18/ixgbe-fix-driver-behaviour-after-issuing-vflr.patch new file mode 100644 index 00000000000..f1b2eeec97d --- /dev/null +++ b/queue-4.18/ixgbe-fix-driver-behaviour-after-issuing-vflr.patch @@ -0,0 +1,77 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Sebastian Basierski +Date: Tue, 31 Jul 2018 18:16:00 +0200 +Subject: ixgbe: fix driver behaviour after issuing VFLR + +From: Sebastian Basierski + +[ Upstream commit 939b701ad63314f5aa90dcd3d866f73954945209 ] + +Since VFLR doesn't clear VFMBMEM (VF Mailbox Memory) +and is not re-enabling queues correctly we should fix +this behavior. + +Signed-off-by: Sebastian Basierski +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 26 +++++++++++++++++++++++++ + drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 1 + 2 files changed, 27 insertions(+) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +@@ -688,8 +688,13 @@ static int ixgbe_set_vf_macvlan(struct i + static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf) + { + struct ixgbe_hw *hw = &adapter->hw; ++ struct ixgbe_ring_feature *vmdq = &adapter->ring_feature[RING_F_VMDQ]; + struct vf_data_storage *vfinfo = &adapter->vfinfo[vf]; ++ u32 q_per_pool = __ALIGN_MASK(1, ~vmdq->mask); + u8 num_tcs = adapter->hw_tcs; ++ u32 reg_val; ++ u32 queue; ++ u32 word; + + /* remove VLAN filters beloning to this VF */ + ixgbe_clear_vf_vlans(adapter, vf); +@@ -726,6 +731,27 @@ static inline void ixgbe_vf_reset_event( + + /* reset VF api back to unknown */ + adapter->vfinfo[vf].vf_api = ixgbe_mbox_api_10; ++ ++ /* Restart each queue for given VF */ ++ for (queue = 0; queue < q_per_pool; queue++) { ++ unsigned int reg_idx = (vf * q_per_pool) + queue; ++ ++ reg_val = IXGBE_READ_REG(hw, IXGBE_PVFTXDCTL(reg_idx)); ++ ++ /* Re-enabling only configured queues */ ++ if (reg_val) { ++ reg_val |= IXGBE_TXDCTL_ENABLE; ++ IXGBE_WRITE_REG(hw, IXGBE_PVFTXDCTL(reg_idx), reg_val); ++ reg_val &= ~IXGBE_TXDCTL_ENABLE; ++ IXGBE_WRITE_REG(hw, IXGBE_PVFTXDCTL(reg_idx), reg_val); ++ } ++ } ++ ++ /* Clear VF's mailbox memory */ ++ for (word = 0; word < IXGBE_VFMAILBOX_SIZE; word++) ++ IXGBE_WRITE_REG_ARRAY(hw, IXGBE_PFMBMEM(vf), word, 0); ++ ++ IXGBE_WRITE_FLUSH(hw); + } + + static int ixgbe_set_vf_mac(struct ixgbe_adapter *adapter, +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h +@@ -2518,6 +2518,7 @@ enum { + /* Translated register #defines */ + #define IXGBE_PVFTDH(P) (0x06010 + (0x40 * (P))) + #define IXGBE_PVFTDT(P) (0x06018 + (0x40 * (P))) ++#define IXGBE_PVFTXDCTL(P) (0x06028 + (0x40 * (P))) + #define IXGBE_PVFTDWBAL(P) (0x06038 + (0x40 * (P))) + #define IXGBE_PVFTDWBAH(P) (0x0603C + (0x40 * (P))) + diff --git a/queue-4.18/mmc-android-goldfish-fix-bad-logic-of-sg_copy_-from-to-_buffer-conversion.patch b/queue-4.18/mmc-android-goldfish-fix-bad-logic-of-sg_copy_-from-to-_buffer-conversion.patch new file mode 100644 index 00000000000..34e083fbd13 --- /dev/null +++ b/queue-4.18/mmc-android-goldfish-fix-bad-logic-of-sg_copy_-from-to-_buffer-conversion.patch @@ -0,0 +1,45 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Ludovic Desroches +Date: Mon, 20 Aug 2018 10:54:45 +0200 +Subject: mmc: android-goldfish: fix bad logic of sg_copy_{from,to}_buffer conversion + +From: Ludovic Desroches + +[ Upstream commit 17e96d8516e31c3cb52cb8e2ee79d1d2e6948c11 ] + +The conversion to sg_copy_{from,to}_buffer has been done in the wrong +way. sg_copy_to_buffer is a copy from an SG list to a linear buffer so +it can't replace memcpy(dest, host->virt_base, data->sg->length) where +dest is the virtual address of the SG. Same for sg_copy_from_buffer +but in the opposite way. + +Signed-off-by: Ludovic Desroches +Suggested-by: Douglas Gilbert +Fixes: 53d7e098ba08 ("mmc: android-goldfish: use sg_copy_{from,to}_buffer") +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/android-goldfish.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/android-goldfish.c ++++ b/drivers/mmc/host/android-goldfish.c +@@ -217,7 +217,7 @@ static void goldfish_mmc_xfer_done(struc + * We don't really have DMA, so we need + * to copy from our platform driver buffer + */ +- sg_copy_to_buffer(data->sg, 1, host->virt_base, ++ sg_copy_from_buffer(data->sg, 1, host->virt_base, + data->sg->length); + } + host->data->bytes_xfered += data->sg->length; +@@ -393,7 +393,7 @@ static void goldfish_mmc_prepare_data(st + * We don't really have DMA, so we need to copy to our + * platform driver buffer + */ +- sg_copy_from_buffer(data->sg, 1, host->virt_base, ++ sg_copy_to_buffer(data->sg, 1, host->virt_base, + data->sg->length); + } + } diff --git a/queue-4.18/mmc-atmel-mci-fix-bad-logic-of-sg_copy_-from-to-_buffer-conversion.patch b/queue-4.18/mmc-atmel-mci-fix-bad-logic-of-sg_copy_-from-to-_buffer-conversion.patch new file mode 100644 index 00000000000..be6e173b15c --- /dev/null +++ b/queue-4.18/mmc-atmel-mci-fix-bad-logic-of-sg_copy_-from-to-_buffer-conversion.patch @@ -0,0 +1,81 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Ludovic Desroches +Date: Mon, 20 Aug 2018 10:54:44 +0200 +Subject: mmc: atmel-mci: fix bad logic of sg_copy_{from,to}_buffer conversion + +From: Ludovic Desroches + +[ Upstream commit 19f5e9e015675fcdbf2c20e804b2e84e80201454 ] + +The conversion to sg_copy_{from,to}_buffer has been done in the wrong +way. sg_copy_to_buffer is a copy from an SG list to a linear buffer so +it can't replace memcpy(buf + offset, &value, remaining) where buf is +the virtual address of the SG. Same for sg_copy_to_buffer but in the +opposite way. + +Signed-off-by: Ludovic Desroches +Suggested-by: Douglas Gilbert +Fixes: 5b4277814e3f ("mmc: atmel-mci: use sg_copy_{from,to}_buffer") +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/atmel-mci.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -1976,7 +1976,7 @@ static void atmci_read_data_pio(struct a + do { + value = atmci_readl(host, ATMCI_RDR); + if (likely(offset + 4 <= sg->length)) { +- sg_pcopy_to_buffer(sg, 1, &value, sizeof(u32), offset); ++ sg_pcopy_from_buffer(sg, 1, &value, sizeof(u32), offset); + + offset += 4; + nbytes += 4; +@@ -1993,7 +1993,7 @@ static void atmci_read_data_pio(struct a + } else { + unsigned int remaining = sg->length - offset; + +- sg_pcopy_to_buffer(sg, 1, &value, remaining, offset); ++ sg_pcopy_from_buffer(sg, 1, &value, remaining, offset); + nbytes += remaining; + + flush_dcache_page(sg_page(sg)); +@@ -2003,7 +2003,7 @@ static void atmci_read_data_pio(struct a + goto done; + + offset = 4 - remaining; +- sg_pcopy_to_buffer(sg, 1, (u8 *)&value + remaining, ++ sg_pcopy_from_buffer(sg, 1, (u8 *)&value + remaining, + offset, 0); + nbytes += offset; + } +@@ -2042,7 +2042,7 @@ static void atmci_write_data_pio(struct + + do { + if (likely(offset + 4 <= sg->length)) { +- sg_pcopy_from_buffer(sg, 1, &value, sizeof(u32), offset); ++ sg_pcopy_to_buffer(sg, 1, &value, sizeof(u32), offset); + atmci_writel(host, ATMCI_TDR, value); + + offset += 4; +@@ -2059,7 +2059,7 @@ static void atmci_write_data_pio(struct + unsigned int remaining = sg->length - offset; + + value = 0; +- sg_pcopy_from_buffer(sg, 1, &value, remaining, offset); ++ sg_pcopy_to_buffer(sg, 1, &value, remaining, offset); + nbytes += remaining; + + host->sg = sg = sg_next(sg); +@@ -2070,7 +2070,7 @@ static void atmci_write_data_pio(struct + } + + offset = 4 - remaining; +- sg_pcopy_from_buffer(sg, 1, (u8 *)&value + remaining, ++ sg_pcopy_to_buffer(sg, 1, (u8 *)&value + remaining, + offset, 0); + atmci_writel(host, ATMCI_TDR, value); + nbytes += offset; diff --git a/queue-4.18/net-hns-fix-length-and-page_offset-overflow-when-config_arm64_64k_pages.patch b/queue-4.18/net-hns-fix-length-and-page_offset-overflow-when-config_arm64_64k_pages.patch new file mode 100644 index 00000000000..e905934a2fd --- /dev/null +++ b/queue-4.18/net-hns-fix-length-and-page_offset-overflow-when-config_arm64_64k_pages.patch @@ -0,0 +1,39 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Huazhong Tan +Date: Thu, 23 Aug 2018 11:10:10 +0800 +Subject: net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES + +From: Huazhong Tan + +[ Upstream commit 3ed614dce3ca9912d22be215ff0f11104b69fe62 ] + +When enable the config item "CONFIG_ARM64_64K_PAGES", the size of PAGE_SIZE +is 65536(64K). But the type of length and page_offset are u16, they will +overflow. So change them to u32. + +Fixes: 6fe6611ff275 ("net: add Hisilicon Network Subsystem hnae framework support") +Signed-off-by: Huazhong Tan +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns/hnae.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns/hnae.h ++++ b/drivers/net/ethernet/hisilicon/hns/hnae.h +@@ -220,10 +220,10 @@ struct hnae_desc_cb { + + /* priv data for the desc, e.g. skb when use with ip stack*/ + void *priv; +- u16 page_offset; +- u16 reuse_flag; ++ u32 page_offset; ++ u32 length; /* length of the buffer */ + +- u16 length; /* length of the buffer */ ++ u16 reuse_flag; + + /* desc type, used by the ring user to mark the type of the priv data */ + u16 type; diff --git a/queue-4.18/net-hns-fix-skb-truesize-underestimation.patch b/queue-4.18/net-hns-fix-skb-truesize-underestimation.patch new file mode 100644 index 00000000000..403d491b1cf --- /dev/null +++ b/queue-4.18/net-hns-fix-skb-truesize-underestimation.patch @@ -0,0 +1,39 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Huazhong Tan +Date: Thu, 23 Aug 2018 11:10:12 +0800 +Subject: net: hns: fix skb->truesize underestimation + +From: Huazhong Tan + +[ Upstream commit b1ccd4c0ab6ef499f47dd84ed4920502a7147bba ] + +skb->truesize is not meant to be tracking amount of used bytes in a skb, +but amount of reserved/consumed bytes in memory. + +For instance, if we use a single byte in last page fragment, we have to +account the full size of the fragment. + +So skb_add_rx_frag needs to calculate the length of the entire buffer into +turesize. + +Fixes: 9cbe9fd5214e ("net: hns: optimize XGE capability by reducing cpu usage") +Signed-off-by: Huazhong tan +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns/hns_enet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +@@ -530,7 +530,7 @@ static void hns_nic_reuse_page(struct sk + } + + skb_add_rx_frag(skb, i, desc_cb->priv, desc_cb->page_offset + pull_len, +- size - pull_len, truesize - pull_len); ++ size - pull_len, truesize); + + /* avoid re-using remote pages,flag default unreuse */ + if (unlikely(page_to_nid(desc_cb->priv) != numa_node_id())) diff --git a/queue-4.18/net-hns3-fix-page_offset-overflow-when-config_arm64_64k_pages.patch b/queue-4.18/net-hns3-fix-page_offset-overflow-when-config_arm64_64k_pages.patch new file mode 100644 index 00000000000..3c88c5a5dfc --- /dev/null +++ b/queue-4.18/net-hns3-fix-page_offset-overflow-when-config_arm64_64k_pages.patch @@ -0,0 +1,40 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Huazhong Tan +Date: Thu, 23 Aug 2018 11:37:15 +0800 +Subject: net: hns3: fix page_offset overflow when CONFIG_ARM64_64K_PAGES + +From: Huazhong Tan + +[ Upstream commit 27a5959308559fa6afcaa4e6cd81d25bcb2dda7c ] + +When enable the config item "CONFIG_ARM64_64K_PAGES", the size of +PAGE_SIZE is 65536(64K). But the type of page_offset is u16, it will +overflow. So change it to u32, when "CONFIG_ARM64_64K_PAGES" enabled. + +Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") +Signed-off-by: Huazhong Tan +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +@@ -290,11 +290,11 @@ struct hns3_desc_cb { + + /* priv data for the desc, e.g. skb when use with ip stack*/ + void *priv; +- u16 page_offset; +- u16 reuse_flag; +- ++ u32 page_offset; + u32 length; /* length of the buffer */ + ++ u16 reuse_flag; ++ + /* desc type, used by the ring user to mark the type of the priv data */ + u16 type; + }; diff --git a/queue-4.18/net-ncsi-fixup-.dumpit-message-flags-and-id-check-in-netlink-handler.patch b/queue-4.18/net-ncsi-fixup-.dumpit-message-flags-and-id-check-in-netlink-handler.patch new file mode 100644 index 00000000000..cb65081f132 --- /dev/null +++ b/queue-4.18/net-ncsi-fixup-.dumpit-message-flags-and-id-check-in-netlink-handler.patch @@ -0,0 +1,42 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Samuel Mendoza-Jonas +Date: Wed, 22 Aug 2018 14:57:44 +1000 +Subject: net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler + +From: Samuel Mendoza-Jonas + +[ Upstream commit 3d0371b313b84ba7c16ebf2526a7a34f1c57b19e ] + +The ncsi_pkg_info_all_nl() .dumpit handler is missing the NLM_F_MULTI +flag, causing additional package information after the first to be lost. +Also fixup a sanity check in ncsi_write_package_info() to reject out of +range package IDs. + +Signed-off-by: Samuel Mendoza-Jonas +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ncsi/ncsi-netlink.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ncsi/ncsi-netlink.c ++++ b/net/ncsi/ncsi-netlink.c +@@ -100,7 +100,7 @@ static int ncsi_write_package_info(struc + bool found; + int rc; + +- if (id > ndp->package_num) { ++ if (id > ndp->package_num - 1) { + netdev_info(ndp->ndev.dev, "NCSI: No package with id %u\n", id); + return -ENODEV; + } +@@ -240,7 +240,7 @@ static int ncsi_pkg_info_all_nl(struct s + return 0; /* done */ + + hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, +- &ncsi_genl_family, 0, NCSI_CMD_PKG_INFO); ++ &ncsi_genl_family, NLM_F_MULTI, NCSI_CMD_PKG_INFO); + if (!hdr) { + rc = -EMSGSIZE; + goto err; diff --git a/queue-4.18/nvme-fcloop-fix-dropped-ls-s-to-removed-target-port.patch b/queue-4.18/nvme-fcloop-fix-dropped-ls-s-to-removed-target-port.patch new file mode 100644 index 00000000000..ee9b3656570 --- /dev/null +++ b/queue-4.18/nvme-fcloop-fix-dropped-ls-s-to-removed-target-port.patch @@ -0,0 +1,47 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: James Smart +Date: Thu, 9 Aug 2018 16:00:14 -0700 +Subject: nvme-fcloop: Fix dropped LS's to removed target port + +From: James Smart + +[ Upstream commit afd299ca996929f4f98ac20da0044c0cdc124879 ] + +When a targetport is removed from the config, fcloop will avoid calling +the LS done() routine thinking the targetport is gone. This leaves the +initiator reset/reconnect hanging as it waits for a status on the +Create_Association LS for the reconnect. + +Change the filter in the LS callback path. If tport null (set when +failed validation before "sending to remote port"), be sure to call +done. This was the main bug. But, continue the logic that only calls +done if tport was set but there is no remoteport (e.g. case where +remoteport has been removed, thus host doesn't expect a completion). + +Signed-off-by: James Smart +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/target/fcloop.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -311,7 +311,7 @@ fcloop_tgt_lsrqst_done_work(struct work_ + struct fcloop_tport *tport = tls_req->tport; + struct nvmefc_ls_req *lsreq = tls_req->lsreq; + +- if (tport->remoteport) ++ if (!tport || tport->remoteport) + lsreq->done(lsreq, tls_req->status); + } + +@@ -329,6 +329,7 @@ fcloop_ls_req(struct nvme_fc_local_port + + if (!rport->targetport) { + tls_req->status = -ECONNREFUSED; ++ tls_req->tport = NULL; + schedule_work(&tls_req->work); + return ret; + } diff --git a/queue-4.18/qed-avoid-sending-mailbox-commands-when-mfw-is-not-responsive.patch b/queue-4.18/qed-avoid-sending-mailbox-commands-when-mfw-is-not-responsive.patch new file mode 100644 index 00000000000..d68873f8c4e --- /dev/null +++ b/queue-4.18/qed-avoid-sending-mailbox-commands-when-mfw-is-not-responsive.patch @@ -0,0 +1,178 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Tomer Tayar +Date: Mon, 20 Aug 2018 00:01:45 +0300 +Subject: qed: Avoid sending mailbox commands when MFW is not responsive + +From: Tomer Tayar + +[ Upstream commit b310974e041913231b6e3d5d475d4df55c312301 ] + +Keep sending mailbox commands to the MFW when it is not responsive ends up +with a redundant amount of timeout expiries. +This patch prints the MCP status on the first command which is not +responded, and blocks the following commands. +Since the (un)load request commands might be not responded due to other +PFs, the patch also adds the option to skip the blocking upon a failure. + +Signed-off-by: Tomer Tayar +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_mcp.c | 52 ++++++++++++++++++++++++- + drivers/net/ethernet/qlogic/qed/qed_mcp.h | 6 ++ + drivers/net/ethernet/qlogic/qed/qed_reg_addr.h | 1 + 3 files changed, 56 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +@@ -320,6 +320,12 @@ int qed_mcp_reset(struct qed_hwfn *p_hwf + u32 org_mcp_reset_seq, seq, delay = QED_MCP_RESP_ITER_US, cnt = 0; + int rc = 0; + ++ if (p_hwfn->mcp_info->b_block_cmd) { ++ DP_NOTICE(p_hwfn, ++ "The MFW is not responsive. Avoid sending MCP_RESET mailbox command.\n"); ++ return -EBUSY; ++ } ++ + /* Ensure that only a single thread is accessing the mailbox */ + spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + +@@ -445,6 +451,33 @@ static void __qed_mcp_cmd_and_union(stru + (p_mb_params->cmd | seq_num), p_mb_params->param); + } + ++static void qed_mcp_cmd_set_blocking(struct qed_hwfn *p_hwfn, bool block_cmd) ++{ ++ p_hwfn->mcp_info->b_block_cmd = block_cmd; ++ ++ DP_INFO(p_hwfn, "%s sending of mailbox commands to the MFW\n", ++ block_cmd ? "Block" : "Unblock"); ++} ++ ++static void qed_mcp_print_cpu_info(struct qed_hwfn *p_hwfn, ++ struct qed_ptt *p_ptt) ++{ ++ u32 cpu_mode, cpu_state, cpu_pc_0, cpu_pc_1, cpu_pc_2; ++ u32 delay = QED_MCP_RESP_ITER_US; ++ ++ cpu_mode = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE); ++ cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE); ++ cpu_pc_0 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER); ++ udelay(delay); ++ cpu_pc_1 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER); ++ udelay(delay); ++ cpu_pc_2 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER); ++ ++ DP_NOTICE(p_hwfn, ++ "MCP CPU info: mode 0x%08x, state 0x%08x, pc {0x%08x, 0x%08x, 0x%08x}\n", ++ cpu_mode, cpu_state, cpu_pc_0, cpu_pc_1, cpu_pc_2); ++} ++ + static int + _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + struct qed_ptt *p_ptt, +@@ -531,11 +564,15 @@ _qed_mcp_cmd_and_union(struct qed_hwfn * + DP_NOTICE(p_hwfn, + "The MFW failed to respond to command 0x%08x [param 0x%08x].\n", + p_mb_params->cmd, p_mb_params->param); ++ qed_mcp_print_cpu_info(p_hwfn, p_ptt); + + spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem); + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + ++ if (!QED_MB_FLAGS_IS_SET(p_mb_params, AVOID_BLOCK)) ++ qed_mcp_cmd_set_blocking(p_hwfn, true); ++ + return -EAGAIN; + } + +@@ -573,6 +610,13 @@ static int qed_mcp_cmd_and_union(struct + return -EBUSY; + } + ++ if (p_hwfn->mcp_info->b_block_cmd) { ++ DP_NOTICE(p_hwfn, ++ "The MFW is not responsive. Avoid sending mailbox command 0x%08x [param 0x%08x].\n", ++ p_mb_params->cmd, p_mb_params->param); ++ return -EBUSY; ++ } ++ + if (p_mb_params->data_src_size > union_data_size || + p_mb_params->data_dst_size > union_data_size) { + DP_ERR(p_hwfn, +@@ -805,7 +849,7 @@ __qed_mcp_load_req(struct qed_hwfn *p_hw + mb_params.data_src_size = sizeof(load_req); + mb_params.p_data_dst = &load_rsp; + mb_params.data_dst_size = sizeof(load_rsp); +- mb_params.flags = QED_MB_FLAG_CAN_SLEEP; ++ mb_params.flags = QED_MB_FLAG_CAN_SLEEP | QED_MB_FLAG_AVOID_BLOCK; + + DP_VERBOSE(p_hwfn, QED_MSG_SP, + "Load Request: param 0x%08x [init_hw %d, drv_type %d, hsi_ver %d, pda 0x%04x]\n", +@@ -1049,7 +1093,7 @@ int qed_mcp_unload_req(struct qed_hwfn * + memset(&mb_params, 0, sizeof(mb_params)); + mb_params.cmd = DRV_MSG_CODE_UNLOAD_REQ; + mb_params.param = wol_param; +- mb_params.flags = QED_MB_FLAG_CAN_SLEEP; ++ mb_params.flags = QED_MB_FLAG_CAN_SLEEP | QED_MB_FLAG_AVOID_BLOCK; + + return qed_mcp_cmd_and_union(p_hwfn, p_ptt, &mb_params); + } +@@ -2156,6 +2200,8 @@ int qed_mcp_halt(struct qed_hwfn *p_hwfn + return -EBUSY; + } + ++ qed_mcp_cmd_set_blocking(p_hwfn, true); ++ + return 0; + } + +@@ -2180,6 +2226,8 @@ int qed_mcp_resume(struct qed_hwfn *p_hw + return -EBUSY; + } + ++ qed_mcp_cmd_set_blocking(p_hwfn, false); ++ + return 0; + } + +--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.h +@@ -635,11 +635,14 @@ struct qed_mcp_info { + */ + spinlock_t cmd_lock; + ++ /* Flag to indicate whether sending a MFW mailbox command is blocked */ ++ bool b_block_cmd; ++ + /* Spinlock used for syncing SW link-changes and link-changes + * originating from attention context. + */ + spinlock_t link_lock; +- bool block_mb_sending; ++ + u32 public_base; + u32 drv_mb_addr; + u32 mfw_mb_addr; +@@ -670,6 +673,7 @@ struct qed_mcp_mb_params { + u32 mcp_param; + u32 flags; + #define QED_MB_FLAG_CAN_SLEEP (0x1 << 0) ++#define QED_MB_FLAG_AVOID_BLOCK (0x1 << 1) + #define QED_MB_FLAGS_IS_SET(params, flag) \ + ({ typeof(params) __params = (params); \ + (__params && (__params->flags & QED_MB_FLAG_ ## flag)); }) +--- a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h +@@ -565,6 +565,7 @@ + #define MCP_REG_CPU_STATE_SOFT_HALTED (0x1UL << 10) + #define MCP_REG_CPU_EVENT_MASK \ + 0xe05008UL ++#define MCP_REG_CPU_PROGRAM_COUNTER 0xe0501cUL + #define PGLUE_B_REG_PF_BAR0_SIZE \ + 0x2aae60UL + #define PGLUE_B_REG_PF_BAR1_SIZE \ diff --git a/queue-4.18/qed-prevent-a-possible-deadlock-during-driver-load-and-unload.patch b/queue-4.18/qed-prevent-a-possible-deadlock-during-driver-load-and-unload.patch new file mode 100644 index 00000000000..dcf3d8ed91a --- /dev/null +++ b/queue-4.18/qed-prevent-a-possible-deadlock-during-driver-load-and-unload.patch @@ -0,0 +1,182 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Tomer Tayar +Date: Mon, 20 Aug 2018 00:01:44 +0300 +Subject: qed: Prevent a possible deadlock during driver load and unload + +From: Tomer Tayar + +[ Upstream commit eaa50fc59e5841910987e90b0438b2643041f508 ] + +The MFW manages an internal lock to prevent concurrent hardware +(de)initialization of different PFs. +This, together with the busy-waiting for the MFW's responses for commands, +might lead to a deadlock during concurrent load or unload of PFs. +This patch adds the option to sleep within the busy-waiting, and uses it +for the (un)load requests (which are not sent from an interrupt context) to +prevent the possible deadlock. + +Signed-off-by: Tomer Tayar +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_mcp.c | 43 +++++++++++++++++++++--------- + drivers/net/ethernet/qlogic/qed/qed_mcp.h | 21 +++++++++----- + 2 files changed, 44 insertions(+), 20 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +@@ -48,7 +48,7 @@ + #include "qed_reg_addr.h" + #include "qed_sriov.h" + +-#define CHIP_MCP_RESP_ITER_US 10 ++#define QED_MCP_RESP_ITER_US 10 + + #define QED_DRV_MB_MAX_RETRIES (500 * 1000) /* Account for 5 sec */ + #define QED_MCP_RESET_RETRIES (50 * 1000) /* Account for 500 msec */ +@@ -317,7 +317,7 @@ static void qed_mcp_reread_offsets(struc + + int qed_mcp_reset(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) + { +- u32 org_mcp_reset_seq, seq, delay = CHIP_MCP_RESP_ITER_US, cnt = 0; ++ u32 org_mcp_reset_seq, seq, delay = QED_MCP_RESP_ITER_US, cnt = 0; + int rc = 0; + + /* Ensure that only a single thread is accessing the mailbox */ +@@ -449,10 +449,10 @@ static int + _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + struct qed_ptt *p_ptt, + struct qed_mcp_mb_params *p_mb_params, +- u32 max_retries, u32 delay) ++ u32 max_retries, u32 usecs) + { ++ u32 cnt = 0, msecs = DIV_ROUND_UP(usecs, 1000); + struct qed_mcp_cmd_elem *p_cmd_elem; +- u32 cnt = 0; + u16 seq_num; + int rc = 0; + +@@ -475,7 +475,11 @@ _qed_mcp_cmd_and_union(struct qed_hwfn * + goto err; + + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); +- udelay(delay); ++ ++ if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP)) ++ msleep(msecs); ++ else ++ udelay(usecs); + } while (++cnt < max_retries); + + if (cnt >= max_retries) { +@@ -504,7 +508,11 @@ _qed_mcp_cmd_and_union(struct qed_hwfn * + * The spinlock stays locked until the list element is removed. + */ + +- udelay(delay); ++ if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP)) ++ msleep(msecs); ++ else ++ udelay(usecs); ++ + spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + + if (p_cmd_elem->b_is_completed) +@@ -539,7 +547,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn * + "MFW mailbox: response 0x%08x param 0x%08x [after %d.%03d ms]\n", + p_mb_params->mcp_resp, + p_mb_params->mcp_param, +- (cnt * delay) / 1000, (cnt * delay) % 1000); ++ (cnt * usecs) / 1000, (cnt * usecs) % 1000); + + /* Clear the sequence number from the MFW response */ + p_mb_params->mcp_resp &= FW_MSG_CODE_MASK; +@@ -557,7 +565,7 @@ static int qed_mcp_cmd_and_union(struct + { + size_t union_data_size = sizeof(union drv_union_data); + u32 max_retries = QED_DRV_MB_MAX_RETRIES; +- u32 delay = CHIP_MCP_RESP_ITER_US; ++ u32 usecs = QED_MCP_RESP_ITER_US; + + /* MCP not initialized */ + if (!qed_mcp_is_init(p_hwfn)) { +@@ -574,8 +582,13 @@ static int qed_mcp_cmd_and_union(struct + return -EINVAL; + } + ++ if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP)) { ++ max_retries = DIV_ROUND_UP(max_retries, 1000); ++ usecs *= 1000; ++ } ++ + return _qed_mcp_cmd_and_union(p_hwfn, p_ptt, p_mb_params, max_retries, +- delay); ++ usecs); + } + + int qed_mcp_cmd(struct qed_hwfn *p_hwfn, +@@ -792,6 +805,7 @@ __qed_mcp_load_req(struct qed_hwfn *p_hw + mb_params.data_src_size = sizeof(load_req); + mb_params.p_data_dst = &load_rsp; + mb_params.data_dst_size = sizeof(load_rsp); ++ mb_params.flags = QED_MB_FLAG_CAN_SLEEP; + + DP_VERBOSE(p_hwfn, QED_MSG_SP, + "Load Request: param 0x%08x [init_hw %d, drv_type %d, hsi_ver %d, pda 0x%04x]\n", +@@ -1013,7 +1027,8 @@ int qed_mcp_load_req(struct qed_hwfn *p_ + + int qed_mcp_unload_req(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) + { +- u32 wol_param, mcp_resp, mcp_param; ++ struct qed_mcp_mb_params mb_params; ++ u32 wol_param; + + switch (p_hwfn->cdev->wol_config) { + case QED_OV_WOL_DISABLED: +@@ -1031,8 +1046,12 @@ int qed_mcp_unload_req(struct qed_hwfn * + wol_param = DRV_MB_PARAM_UNLOAD_WOL_MCP; + } + +- return qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_UNLOAD_REQ, wol_param, +- &mcp_resp, &mcp_param); ++ memset(&mb_params, 0, sizeof(mb_params)); ++ mb_params.cmd = DRV_MSG_CODE_UNLOAD_REQ; ++ mb_params.param = wol_param; ++ mb_params.flags = QED_MB_FLAG_CAN_SLEEP; ++ ++ return qed_mcp_cmd_and_union(p_hwfn, p_ptt, &mb_params); + } + + int qed_mcp_unload_done(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) +--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.h +@@ -660,14 +660,19 @@ struct qed_mcp_info { + }; + + struct qed_mcp_mb_params { +- u32 cmd; +- u32 param; +- void *p_data_src; +- u8 data_src_size; +- void *p_data_dst; +- u8 data_dst_size; +- u32 mcp_resp; +- u32 mcp_param; ++ u32 cmd; ++ u32 param; ++ void *p_data_src; ++ void *p_data_dst; ++ u8 data_src_size; ++ u8 data_dst_size; ++ u32 mcp_resp; ++ u32 mcp_param; ++ u32 flags; ++#define QED_MB_FLAG_CAN_SLEEP (0x1 << 0) ++#define QED_MB_FLAGS_IS_SET(params, flag) \ ++ ({ typeof(params) __params = (params); \ ++ (__params && (__params->flags & QED_MB_FLAG_ ## flag)); }) + }; + + struct qed_drv_tlv_hdr { diff --git a/queue-4.18/qed-wait-for-mcp-halt-and-resume-commands-to-take-place.patch b/queue-4.18/qed-wait-for-mcp-halt-and-resume-commands-to-take-place.patch new file mode 100644 index 00000000000..0ba23dcfc40 --- /dev/null +++ b/queue-4.18/qed-wait-for-mcp-halt-and-resume-commands-to-take-place.patch @@ -0,0 +1,107 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Tomer Tayar +Date: Mon, 20 Aug 2018 00:01:43 +0300 +Subject: qed: Wait for MCP halt and resume commands to take place + +From: Tomer Tayar + +[ Upstream commit 76271809f49056f079e202bf6513d17b0d6dd34d ] + +Successive iterations of halting and resuming the management chip (MCP) +might fail, since currently the driver doesn't wait for these operations to +actually take place. +This patch prevents the driver from moving forward before the operations +are reflected in the state register. + +Signed-off-by: Tomer Tayar +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_mcp.c | 46 ++++++++++++++++++++----- + drivers/net/ethernet/qlogic/qed/qed_reg_addr.h | 1 + 2 files changed, 39 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +@@ -2107,31 +2107,61 @@ qed_mcp_send_drv_version(struct qed_hwfn + return rc; + } + ++/* A maximal 100 msec waiting time for the MCP to halt */ ++#define QED_MCP_HALT_SLEEP_MS 10 ++#define QED_MCP_HALT_MAX_RETRIES 10 ++ + int qed_mcp_halt(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) + { +- u32 resp = 0, param = 0; ++ u32 resp = 0, param = 0, cpu_state, cnt = 0; + int rc; + + rc = qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_MCP_HALT, 0, &resp, + ¶m); +- if (rc) ++ if (rc) { + DP_ERR(p_hwfn, "MCP response failure, aborting\n"); ++ return rc; ++ } + +- return rc; ++ do { ++ msleep(QED_MCP_HALT_SLEEP_MS); ++ cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE); ++ if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED) ++ break; ++ } while (++cnt < QED_MCP_HALT_MAX_RETRIES); ++ ++ if (cnt == QED_MCP_HALT_MAX_RETRIES) { ++ DP_NOTICE(p_hwfn, ++ "Failed to halt the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n", ++ qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE), cpu_state); ++ return -EBUSY; ++ } ++ ++ return 0; + } + ++#define QED_MCP_RESUME_SLEEP_MS 10 ++ + int qed_mcp_resume(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) + { +- u32 value, cpu_mode; ++ u32 cpu_mode, cpu_state; + + qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_STATE, 0xffffffff); + +- value = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE); +- value &= ~MCP_REG_CPU_MODE_SOFT_HALT; +- qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, value); + cpu_mode = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE); ++ cpu_mode &= ~MCP_REG_CPU_MODE_SOFT_HALT; ++ qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, cpu_mode); ++ msleep(QED_MCP_RESUME_SLEEP_MS); ++ cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE); ++ ++ if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED) { ++ DP_NOTICE(p_hwfn, ++ "Failed to resume the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n", ++ cpu_mode, cpu_state); ++ return -EBUSY; ++ } + +- return (cpu_mode & MCP_REG_CPU_MODE_SOFT_HALT) ? -EAGAIN : 0; ++ return 0; + } + + int qed_mcp_ov_update_current_config(struct qed_hwfn *p_hwfn, +--- a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h +@@ -562,6 +562,7 @@ + 0 + #define MCP_REG_CPU_STATE \ + 0xe05004UL ++#define MCP_REG_CPU_STATE_SOFT_HALTED (0x1UL << 10) + #define MCP_REG_CPU_EVENT_MASK \ + 0xe05008UL + #define PGLUE_B_REG_PF_BAR0_SIZE \ diff --git a/queue-4.18/qed-wait-for-ready-indication-before-rereading-the-shmem.patch b/queue-4.18/qed-wait-for-ready-indication-before-rereading-the-shmem.patch new file mode 100644 index 00000000000..7a286c8b6fd --- /dev/null +++ b/queue-4.18/qed-wait-for-ready-indication-before-rereading-the-shmem.patch @@ -0,0 +1,99 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Tomer Tayar +Date: Mon, 20 Aug 2018 00:01:42 +0300 +Subject: qed: Wait for ready indication before rereading the shmem + +From: Tomer Tayar + +[ Upstream commit f00d25f3154b676fcea4502a25b94bd7f142ca74 ] + +The MFW might be reset and re-update its shared memory. +Upon the detection of such a reset the driver rereads this memory, but it +has to wait till the data is valid. +This patch adds the missing wait for a data ready indication. + +Signed-off-by: Tomer Tayar +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_mcp.c | 50 ++++++++++++++++++++++++------ + 1 file changed, 41 insertions(+), 9 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +@@ -183,18 +183,57 @@ int qed_mcp_free(struct qed_hwfn *p_hwfn + return 0; + } + ++/* Maximum of 1 sec to wait for the SHMEM ready indication */ ++#define QED_MCP_SHMEM_RDY_MAX_RETRIES 20 ++#define QED_MCP_SHMEM_RDY_ITER_MS 50 ++ + static int qed_load_mcp_offsets(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) + { + struct qed_mcp_info *p_info = p_hwfn->mcp_info; ++ u8 cnt = QED_MCP_SHMEM_RDY_MAX_RETRIES; ++ u8 msec = QED_MCP_SHMEM_RDY_ITER_MS; + u32 drv_mb_offsize, mfw_mb_offsize; + u32 mcp_pf_id = MCP_PF_ID(p_hwfn); + + p_info->public_base = qed_rd(p_hwfn, p_ptt, MISC_REG_SHARED_MEM_ADDR); +- if (!p_info->public_base) +- return 0; ++ if (!p_info->public_base) { ++ DP_NOTICE(p_hwfn, ++ "The address of the MCP scratch-pad is not configured\n"); ++ return -EINVAL; ++ } + + p_info->public_base |= GRCBASE_MCP; + ++ /* Get the MFW MB address and number of supported messages */ ++ mfw_mb_offsize = qed_rd(p_hwfn, p_ptt, ++ SECTION_OFFSIZE_ADDR(p_info->public_base, ++ PUBLIC_MFW_MB)); ++ p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id); ++ p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt, ++ p_info->mfw_mb_addr + ++ offsetof(struct public_mfw_mb, ++ sup_msgs)); ++ ++ /* The driver can notify that there was an MCP reset, and might read the ++ * SHMEM values before the MFW has completed initializing them. ++ * To avoid this, the "sup_msgs" field in the MFW mailbox is used as a ++ * data ready indication. ++ */ ++ while (!p_info->mfw_mb_length && --cnt) { ++ msleep(msec); ++ p_info->mfw_mb_length = ++ (u16)qed_rd(p_hwfn, p_ptt, ++ p_info->mfw_mb_addr + ++ offsetof(struct public_mfw_mb, sup_msgs)); ++ } ++ ++ if (!cnt) { ++ DP_NOTICE(p_hwfn, ++ "Failed to get the SHMEM ready notification after %d msec\n", ++ QED_MCP_SHMEM_RDY_MAX_RETRIES * msec); ++ return -EBUSY; ++ } ++ + /* Calculate the driver and MFW mailbox address */ + drv_mb_offsize = qed_rd(p_hwfn, p_ptt, + SECTION_OFFSIZE_ADDR(p_info->public_base, +@@ -204,13 +243,6 @@ static int qed_load_mcp_offsets(struct q + "drv_mb_offsiz = 0x%x, drv_mb_addr = 0x%x mcp_pf_id = 0x%x\n", + drv_mb_offsize, p_info->drv_mb_addr, mcp_pf_id); + +- /* Set the MFW MB address */ +- mfw_mb_offsize = qed_rd(p_hwfn, p_ptt, +- SECTION_OFFSIZE_ADDR(p_info->public_base, +- PUBLIC_MFW_MB)); +- p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id); +- p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt, p_info->mfw_mb_addr); +- + /* Get the current driver mailbox sequence before sending + * the first command + */ diff --git a/queue-4.18/revert-arm-dts-imx7d-invert-legacy-pci-irq-mapping.patch b/queue-4.18/revert-arm-dts-imx7d-invert-legacy-pci-irq-mapping.patch new file mode 100644 index 00000000000..def3a984f83 --- /dev/null +++ b/queue-4.18/revert-arm-dts-imx7d-invert-legacy-pci-irq-mapping.patch @@ -0,0 +1,47 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Leonard Crestez +Date: Tue, 24 Jul 2018 19:14:19 +0300 +Subject: Revert "ARM: dts: imx7d: Invert legacy PCI irq mapping" + +From: Leonard Crestez + +[ Upstream commit 538d6e9d597584e80514698e24321645debde78f ] + +This reverts commit 1c86c9dd82f859b474474a7fee0d5195da2c9c1d. + +That commit followed the reference manual but unfortunately the imx7d +manual is incorrect. + +Tested with ath9k pcie card and confirmed internally. + +Signed-off-by: Leonard Crestez +Acked-by: Lucas Stach +Fixes: 1c86c9dd82f8 ("ARM: dts: imx7d: Invert legacy PCI irq mapping") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/imx7d.dtsi | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/arch/arm/boot/dts/imx7d.dtsi ++++ b/arch/arm/boot/dts/imx7d.dtsi +@@ -125,10 +125,14 @@ + interrupt-names = "msi"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0x7>; +- interrupt-map = <0 0 0 1 &intc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>, +- <0 0 0 2 &intc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>, +- <0 0 0 3 &intc GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>, +- <0 0 0 4 &intc GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>; ++ /* ++ * Reference manual lists pci irqs incorrectly ++ * Real hardware ordering is same as imx6: D+MSI, C, B, A ++ */ ++ interrupt-map = <0 0 0 1 &intc GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>, ++ <0 0 0 2 &intc GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>, ++ <0 0 0 3 &intc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>, ++ <0 0 0 4 &intc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clks IMX7D_PCIE_CTRL_ROOT_CLK>, + <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>, + <&clks IMX7D_PCIE_PHY_ROOT_CLK>; diff --git a/queue-4.18/series b/queue-4.18/series index e08792f4d26..5affb43d349 100644 --- a/queue-4.18/series +++ b/queue-4.18/series @@ -165,3 +165,60 @@ ib-hfi1-fix-context-recovery-when-pbc-has-an-unsupportedvl.patch ib-hfi1-fix-destroy_qp-hang-after-a-link-down.patch acpi-hotplug-pci-don-t-scan-for-non-hotplug-bridges-if-slot-is-not-bridge.patch rdma-uverbs-atomically-flush-and-mark-closed-the-comp-event-queue.patch +arm64-kvm-tighten-guest-core-register-access-from-userspace.patch +arm-omap2-fix-null-hwmod-for-ti-sysc-debug.patch +arm-omap2-fix-module-address-for-modules-using-mpu_rt_idx.patch +bus-ti-sysc-fix-module-register-ioremap-for-larger-offsets.patch +qed-wait-for-ready-indication-before-rereading-the-shmem.patch +qed-wait-for-mcp-halt-and-resume-commands-to-take-place.patch +qed-prevent-a-possible-deadlock-during-driver-load-and-unload.patch +qed-avoid-sending-mailbox-commands-when-mfw-is-not-responsive.patch +thermal-of-thermal-disable-passive-polling-when-thermal-zone-is-disabled.patch +isofs-reject-hardware-sector-size-2048-bytes.patch +mmc-atmel-mci-fix-bad-logic-of-sg_copy_-from-to-_buffer-conversion.patch +mmc-android-goldfish-fix-bad-logic-of-sg_copy_-from-to-_buffer-conversion.patch +bus-ti-sysc-fix-no_console_suspend-handling.patch +arm-dts-omap4-droid4-fix-vibrations-on-droid-4.patch +bpf-sockmap-fix-sock_hash_alloc-and-reject-zero-sized-keys.patch +bpf-sockmap-fix-sock-hash-count-in-alloc_sock_hash_elem.patch +tls-possible-hang-when-do_tcp_sendpages-hits-sndbuf-is-full-case.patch +bpf-sockmap-write_space-events-need-to-be-passed-to-tcp-handler.patch +drm-amdgpu-fix-vm-clearing-for-the-root-pd.patch +drm-amdgpu-fix-preamble-handling.patch +amdgpu-fix-multi-process-hang-issue.patch +net-ncsi-fixup-.dumpit-message-flags-and-id-check-in-netlink-handler.patch +tcp_bbr-add-bbr_check_probe_rtt_done-helper.patch +tcp_bbr-in-restart-from-idle-see-if-we-should-exit-probe_rtt.patch +net-hns-fix-length-and-page_offset-overflow-when-config_arm64_64k_pages.patch +net-hns-fix-skb-truesize-underestimation.patch +net-hns3-fix-page_offset-overflow-when-config_arm64_64k_pages.patch +ice-fix-multiple-static-analyser-warnings.patch +ice-report-stats-for-allocated-queues-via-ethtool-stats.patch +ice-clean-control-queues-only-when-they-are-initialized.patch +ice-fix-bugs-in-control-queue-processing.patch +ice-use-order_base_2-to-calculate-higher-power-of-2.patch +ice-set-vlan-flags-correctly.patch +tools-bpftool-return-from-do_event_pipe-on-bad-arguments.patch +ice-fix-a-few-null-pointer-dereference-issues.patch +ice-fix-potential-return-of-uninitialized-value.patch +e1000-check-on-netif_running-before-calling-e1000_up.patch +e1000-ensure-to-free-old-tx-rx-rings-in-set_ringparam.patch +ixgbe-fix-driver-behaviour-after-issuing-vflr.patch +i40e-fix-for-tx-timeouts-when-interface-is-brought-up-if-dcb-is-enabled.patch +i40e-fix-condition-of-warn_once-for-stat-strings.patch +crypto-chtls-fix-null-dereference-chtls_free_uld.patch +crypto-cavium-nitrox-fix-for-command-corruption-in-queue-full-case-with-backlog-submissions.patch +hwmon-ina2xx-fix-sysfs-shunt-resistor-read-access.patch +hwmon-adt7475-make-adt7475_read_word-return-errors.patch +revert-arm-dts-imx7d-invert-legacy-pci-irq-mapping.patch +drm-amdgpu-enable-disable-gfx-pg-feature-in-rlc-safe-mode.patch +drm-amdgpu-update-power-state-at-the-end-of-smu-hw_init.patch +ata-ftide010-add-a-quirk-for-sq201.patch +nvme-fcloop-fix-dropped-ls-s-to-removed-target-port.patch +arm-dts-omap4-droid4-fix-emmc-errors-seen-on-some-devices.patch +drm-amdgpu-need-to-set-moved-to-true-when-evict-bo.patch +arm-arm64-smccc-1.1-make-return-values-unsigned-long.patch +arm-arm64-smccc-1.1-handle-function-result-as-parameters.patch +i2c-i801-allow-acpi-aml-access-i-o-ports-not-reserved-for-smbus.patch +clk-x86-set-default-parent-to-48mhz.patch +x86-pti-fix-section-mismatch-warning-error.patch diff --git a/queue-4.18/tcp_bbr-add-bbr_check_probe_rtt_done-helper.patch b/queue-4.18/tcp_bbr-add-bbr_check_probe_rtt_done-helper.patch new file mode 100644 index 00000000000..114b98ffef1 --- /dev/null +++ b/queue-4.18/tcp_bbr-add-bbr_check_probe_rtt_done-helper.patch @@ -0,0 +1,103 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Kevin Yang +Date: Wed, 22 Aug 2018 17:43:14 -0400 +Subject: tcp_bbr: add bbr_check_probe_rtt_done() helper + +From: Kevin Yang + +[ Upstream commit fb99886224294b2291d267da41395022fa4200e2 ] + +This patch add a helper function bbr_check_probe_rtt_done() to + 1. check the condition to see if bbr should exit probe_rtt mode; + 2. process the logic of exiting probe_rtt mode. + +Fixes: 0f8782ea1497 ("tcp_bbr: add BBR congestion control") +Signed-off-by: Kevin Yang +Signed-off-by: Neal Cardwell +Signed-off-by: Yuchung Cheng +Reviewed-by: Soheil Hassas Yeganeh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_bbr.c | 34 ++++++++++++++++++---------------- + 1 file changed, 18 insertions(+), 16 deletions(-) + +--- a/net/ipv4/tcp_bbr.c ++++ b/net/ipv4/tcp_bbr.c +@@ -95,11 +95,10 @@ struct bbr { + u32 mode:3, /* current bbr_mode in state machine */ + prev_ca_state:3, /* CA state on previous ACK */ + packet_conservation:1, /* use packet conservation? */ +- restore_cwnd:1, /* decided to revert cwnd to old value */ + round_start:1, /* start of packet-timed tx->ack round? */ + idle_restart:1, /* restarting after idle? */ + probe_rtt_round_done:1, /* a BBR_PROBE_RTT round at 4 pkts? */ +- unused:12, ++ unused:13, + lt_is_sampling:1, /* taking long-term ("LT") samples now? */ + lt_rtt_cnt:7, /* round trips in long-term interval */ + lt_use_bw:1; /* use lt_bw as our bw estimate? */ +@@ -392,17 +391,11 @@ static bool bbr_set_cwnd_to_recover_or_r + cwnd = tcp_packets_in_flight(tp) + acked; + } else if (prev_state >= TCP_CA_Recovery && state < TCP_CA_Recovery) { + /* Exiting loss recovery; restore cwnd saved before recovery. */ +- bbr->restore_cwnd = 1; ++ cwnd = max(cwnd, bbr->prior_cwnd); + bbr->packet_conservation = 0; + } + bbr->prev_ca_state = state; + +- if (bbr->restore_cwnd) { +- /* Restore cwnd after exiting loss recovery or PROBE_RTT. */ +- cwnd = max(cwnd, bbr->prior_cwnd); +- bbr->restore_cwnd = 0; +- } +- + if (bbr->packet_conservation) { + *new_cwnd = max(cwnd, tcp_packets_in_flight(tp) + acked); + return true; /* yes, using packet conservation */ +@@ -744,6 +737,20 @@ static void bbr_check_drain(struct sock + bbr_reset_probe_bw_mode(sk); /* we estimate queue is drained */ + } + ++static void bbr_check_probe_rtt_done(struct sock *sk) ++{ ++ struct tcp_sock *tp = tcp_sk(sk); ++ struct bbr *bbr = inet_csk_ca(sk); ++ ++ if (!(bbr->probe_rtt_done_stamp && ++ after(tcp_jiffies32, bbr->probe_rtt_done_stamp))) ++ return; ++ ++ bbr->min_rtt_stamp = tcp_jiffies32; /* wait a while until PROBE_RTT */ ++ tp->snd_cwnd = max(tp->snd_cwnd, bbr->prior_cwnd); ++ bbr_reset_mode(sk); ++} ++ + /* The goal of PROBE_RTT mode is to have BBR flows cooperatively and + * periodically drain the bottleneck queue, to converge to measure the true + * min_rtt (unloaded propagation delay). This allows the flows to keep queues +@@ -802,12 +809,8 @@ static void bbr_update_min_rtt(struct so + } else if (bbr->probe_rtt_done_stamp) { + if (bbr->round_start) + bbr->probe_rtt_round_done = 1; +- if (bbr->probe_rtt_round_done && +- after(tcp_jiffies32, bbr->probe_rtt_done_stamp)) { +- bbr->min_rtt_stamp = tcp_jiffies32; +- bbr->restore_cwnd = 1; /* snap to prior_cwnd */ +- bbr_reset_mode(sk); +- } ++ if (bbr->probe_rtt_round_done) ++ bbr_check_probe_rtt_done(sk); + } + } + /* Restart after idle ends only once we process a new S/ACK for data */ +@@ -858,7 +861,6 @@ static void bbr_init(struct sock *sk) + bbr->has_seen_rtt = 0; + bbr_init_pacing_rate_from_rtt(sk); + +- bbr->restore_cwnd = 0; + bbr->round_start = 0; + bbr->idle_restart = 0; + bbr->full_bw_reached = 0; diff --git a/queue-4.18/tcp_bbr-in-restart-from-idle-see-if-we-should-exit-probe_rtt.patch b/queue-4.18/tcp_bbr-in-restart-from-idle-see-if-we-should-exit-probe_rtt.patch new file mode 100644 index 00000000000..eac4d379410 --- /dev/null +++ b/queue-4.18/tcp_bbr-in-restart-from-idle-see-if-we-should-exit-probe_rtt.patch @@ -0,0 +1,47 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Kevin Yang +Date: Wed, 22 Aug 2018 17:43:15 -0400 +Subject: tcp_bbr: in restart from idle, see if we should exit PROBE_RTT + +From: Kevin Yang + +[ Upstream commit 5490b32dce6932ea7ee8e3b2f76db2957c92af6e ] + +This patch fix the case where BBR does not exit PROBE_RTT mode when +it restarts from idle. When BBR restarts from idle and if BBR is in +PROBE_RTT mode, BBR should check if it's time to exit PROBE_RTT. If +yes, then BBR should exit PROBE_RTT mode and restore the cwnd to its +full value. + +Fixes: 0f8782ea1497 ("tcp_bbr: add BBR congestion control") +Signed-off-by: Kevin Yang +Signed-off-by: Neal Cardwell +Reviewed-by: Yuchung Cheng +Reviewed-by: Soheil Hassas Yeganeh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_bbr.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/ipv4/tcp_bbr.c ++++ b/net/ipv4/tcp_bbr.c +@@ -174,6 +174,8 @@ static const u32 bbr_lt_bw_diff = 4000 / + /* If we estimate we're policed, use lt_bw for this many round trips: */ + static const u32 bbr_lt_bw_max_rtts = 48; + ++static void bbr_check_probe_rtt_done(struct sock *sk); ++ + /* Do we estimate that STARTUP filled the pipe? */ + static bool bbr_full_bw_reached(const struct sock *sk) + { +@@ -304,6 +306,8 @@ static void bbr_cwnd_event(struct sock * + */ + if (bbr->mode == BBR_PROBE_BW) + bbr_set_pacing_rate(sk, bbr_bw(sk), BBR_UNIT); ++ else if (bbr->mode == BBR_PROBE_RTT) ++ bbr_check_probe_rtt_done(sk); + } + } + diff --git a/queue-4.18/thermal-of-thermal-disable-passive-polling-when-thermal-zone-is-disabled.patch b/queue-4.18/thermal-of-thermal-disable-passive-polling-when-thermal-zone-is-disabled.patch new file mode 100644 index 00000000000..d2de09f9655 --- /dev/null +++ b/queue-4.18/thermal-of-thermal-disable-passive-polling-when-thermal-zone-is-disabled.patch @@ -0,0 +1,43 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Anson Huang +Date: Tue, 31 Jul 2018 00:56:49 +0800 +Subject: thermal: of-thermal: disable passive polling when thermal zone is disabled + +From: Anson Huang + +[ Upstream commit 152395fd03d4ce1e535a75cdbf58105e50587611 ] + +When thermal zone is in passive mode, disabling its mode from +sysfs is NOT taking effect at all, it is still polling the +temperature of the disabled thermal zone and handling all thermal +trips, it makes user confused. The disabling operation should +disable the thermal zone behavior completely, for both active and +passive mode, this patch clears the passive_delay when thermal +zone is disabled and restores it when it is enabled. + +Signed-off-by: Anson Huang +Signed-off-by: Eduardo Valentin +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/of-thermal.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/thermal/of-thermal.c ++++ b/drivers/thermal/of-thermal.c +@@ -260,10 +260,13 @@ static int of_thermal_set_mode(struct th + + mutex_lock(&tz->lock); + +- if (mode == THERMAL_DEVICE_ENABLED) ++ if (mode == THERMAL_DEVICE_ENABLED) { + tz->polling_delay = data->polling_delay; +- else ++ tz->passive_delay = data->passive_delay; ++ } else { + tz->polling_delay = 0; ++ tz->passive_delay = 0; ++ } + + mutex_unlock(&tz->lock); + diff --git a/queue-4.18/tls-possible-hang-when-do_tcp_sendpages-hits-sndbuf-is-full-case.patch b/queue-4.18/tls-possible-hang-when-do_tcp_sendpages-hits-sndbuf-is-full-case.patch new file mode 100644 index 00000000000..ea6179d7b83 --- /dev/null +++ b/queue-4.18/tls-possible-hang-when-do_tcp_sendpages-hits-sndbuf-is-full-case.patch @@ -0,0 +1,60 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: John Fastabend +Date: Wed, 22 Aug 2018 08:37:32 -0700 +Subject: tls: possible hang when do_tcp_sendpages hits sndbuf is full case + +From: John Fastabend + +[ Upstream commit 67db7cd249e71f64346f481b629724376d063e08 ] + +Currently, the lower protocols sk_write_space handler is not called if +TLS is sending a scatterlist via tls_push_sg. However, normally +tls_push_sg calls do_tcp_sendpage, which may be under memory pressure, +that in turn may trigger a wait via sk_wait_event. Typically, this +happens when the in-flight bytes exceed the sdnbuf size. In the normal +case when enough ACKs are received sk_write_space() will be called and +the sk_wait_event will be woken up allowing it to send more data +and/or return to the user. + +But, in the TLS case because the sk_write_space() handler does not +wake up the events the above send will wait until the sndtimeo is +exceeded. By default this is MAX_SCHEDULE_TIMEOUT so it look like a +hang to the user (especially this impatient user). To fix this pass +the sk_write_space event to the lower layers sk_write_space event +which in the TCP case will wake any pending events. + +I observed the above while integrating sockmap and ktls. It +initially appeared as test_sockmap (modified to use ktls) occasionally +hanging. To reliably reproduce this reduce the sndbuf size and stress +the tls layer by sending many 1B sends. This results in every byte +needing a header and each byte individually being sent to the crypto +layer. + +Signed-off-by: John Fastabend +Acked-by: Dave Watson +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/tls/tls_main.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -222,9 +222,14 @@ static void tls_write_space(struct sock + { + struct tls_context *ctx = tls_get_ctx(sk); + +- /* We are already sending pages, ignore notification */ +- if (ctx->in_tcp_sendpages) ++ /* If in_tcp_sendpages call lower protocol write space handler ++ * to ensure we wake up any waiting operations there. For example ++ * if do_tcp_sendpages where to call sk_wait_event. ++ */ ++ if (ctx->in_tcp_sendpages) { ++ ctx->sk_write_space(sk); + return; ++ } + + if (!sk->sk_write_pending && tls_is_pending_closed_record(ctx)) { + gfp_t sk_allocation = sk->sk_allocation; diff --git a/queue-4.18/tools-bpftool-return-from-do_event_pipe-on-bad-arguments.patch b/queue-4.18/tools-bpftool-return-from-do_event_pipe-on-bad-arguments.patch new file mode 100644 index 00000000000..a39d9be6a2c --- /dev/null +++ b/queue-4.18/tools-bpftool-return-from-do_event_pipe-on-bad-arguments.patch @@ -0,0 +1,46 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Quentin Monnet +Date: Thu, 23 Aug 2018 17:46:25 +0100 +Subject: tools: bpftool: return from do_event_pipe() on bad arguments + +From: Quentin Monnet + +[ Upstream commit 785e76d7a2051a9e28b9134d5388a45b16f5eb72 ] + +When command line parsing fails in the while loop in do_event_pipe() +because the number of arguments is incorrect or because the keyword is +unknown, an error message is displayed, but bpftool remains stuck in +the loop. Make sure we exit the loop upon failure. + +Fixes: f412eed9dfde ("tools: bpftool: add simple perf event output reader") +Signed-off-by: Quentin Monnet +Reviewed-by: Jakub Kicinski +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/bpf/bpftool/map_perf_ring.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/tools/bpf/bpftool/map_perf_ring.c ++++ b/tools/bpf/bpftool/map_perf_ring.c +@@ -194,8 +194,10 @@ int do_event_pipe(int argc, char **argv) + } + + while (argc) { +- if (argc < 2) ++ if (argc < 2) { + BAD_ARG(); ++ goto err_close_map; ++ } + + if (is_prefix(*argv, "cpu")) { + char *endptr; +@@ -221,6 +223,7 @@ int do_event_pipe(int argc, char **argv) + NEXT_ARG(); + } else { + BAD_ARG(); ++ goto err_close_map; + } + + do_all = false; diff --git a/queue-4.18/x86-pti-fix-section-mismatch-warning-error.patch b/queue-4.18/x86-pti-fix-section-mismatch-warning-error.patch new file mode 100644 index 00000000000..6e8a081b2d7 --- /dev/null +++ b/queue-4.18/x86-pti-fix-section-mismatch-warning-error.patch @@ -0,0 +1,41 @@ +From foo@baz Tue Oct 2 04:59:29 PDT 2018 +From: Randy Dunlap +Date: Sat, 1 Sep 2018 21:01:28 -0700 +Subject: x86/pti: Fix section mismatch warning/error + +From: Randy Dunlap + +[ Upstream commit ff924c5a1ec7548825cc2d07980b03be4224ffac ] + +Fix the section mismatch warning in arch/x86/mm/pti.c: + +WARNING: vmlinux.o(.text+0x6972a): Section mismatch in reference from the function pti_clone_pgtable() to the function .init.text:pti_user_pagetable_walk_pte() +The function pti_clone_pgtable() references +the function __init pti_user_pagetable_walk_pte(). +This is often because pti_clone_pgtable lacks a __init +annotation or the annotation of pti_user_pagetable_walk_pte is wrong. +FATAL: modpost: Section mismatches detected. + +Fixes: 85900ea51577 ("x86/pti: Map the vsyscall page if needed") +Reported-by: kbuild test robot +Signed-off-by: Randy Dunlap +Signed-off-by: Thomas Gleixner +Cc: Andy Lutomirski +Link: https://lkml.kernel.org/r/43a6d6a3-d69d-5eda-da09-0b1c88215a2a@infradead.org +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/mm/pti.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/mm/pti.c ++++ b/arch/x86/mm/pti.c +@@ -239,7 +239,7 @@ static pmd_t *pti_user_pagetable_walk_pm + * + * Returns a pointer to a PTE on success, or NULL on failure. + */ +-static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address) ++static pte_t *pti_user_pagetable_walk_pte(unsigned long address) + { + gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO); + pmd_t *pmd;