From: Greg Kroah-Hartman Date: Thu, 5 Jul 2018 18:23:09 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v4.14.54~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=16da1e5c642e8dce05af3f2ec89bbaff25c61660;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: arm-dts-imx6q-use-correct-sdma-script-for-spi5-core.patch ib-hfi1-fix-user-context-tail-allocation-for-dma_rtail.patch net-phy-micrel-fix-crash-when-statistic-requested-for-ksz9031-phy.patch x86-cpu-re-apply-forced-caps-every-time-cpu-caps-are-re-read.patch x86-xen-add-call-of-speculative_store_bypass_ht_init-to-pv-paths.patch --- diff --git a/queue-4.9/arm-dts-imx6q-use-correct-sdma-script-for-spi5-core.patch b/queue-4.9/arm-dts-imx6q-use-correct-sdma-script-for-spi5-core.patch new file mode 100644 index 00000000000..951096f511d --- /dev/null +++ b/queue-4.9/arm-dts-imx6q-use-correct-sdma-script-for-spi5-core.patch @@ -0,0 +1,41 @@ +From df07101e1c4a29e820df02f9989a066988b160e6 Mon Sep 17 00:00:00 2001 +From: Sean Nyekjaer +Date: Tue, 22 May 2018 19:45:09 +0200 +Subject: ARM: dts: imx6q: Use correct SDMA script for SPI5 core + +From: Sean Nyekjaer + +commit df07101e1c4a29e820df02f9989a066988b160e6 upstream. + +According to the reference manual the shp_2_mcu / mcu_2_shp +scripts must be used for devices connected through the SPBA. + +This fixes an issue we saw with DMA transfers. +Sometimes the SPI controller RX FIFO was not empty after a DMA +transfer and the driver got stuck in the next PIO transfer when +it read one word more than expected. + +commit dd4b487b32a35 ("ARM: dts: imx6: Use correct SDMA script +for SPI cores") is fixing the same issue but only for SPI1 - 4. + +Fixes: 677940258dd8e ("ARM: dts: imx6q: enable dma for ecspi5") +Signed-off-by: Sean Nyekjaer +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/imx6q.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/imx6q.dtsi ++++ b/arch/arm/boot/dts/imx6q.dtsi +@@ -96,7 +96,7 @@ + clocks = <&clks IMX6Q_CLK_ECSPI5>, + <&clks IMX6Q_CLK_ECSPI5>; + clock-names = "ipg", "per"; +- dmas = <&sdma 11 7 1>, <&sdma 12 7 2>; ++ dmas = <&sdma 11 8 1>, <&sdma 12 8 2>; + dma-names = "rx", "tx"; + status = "disabled"; + }; diff --git a/queue-4.9/ib-hfi1-fix-user-context-tail-allocation-for-dma_rtail.patch b/queue-4.9/ib-hfi1-fix-user-context-tail-allocation-for-dma_rtail.patch new file mode 100644 index 00000000000..24ddf02645a --- /dev/null +++ b/queue-4.9/ib-hfi1-fix-user-context-tail-allocation-for-dma_rtail.patch @@ -0,0 +1,123 @@ +From 1bc0299d976e000ececc6acd76e33b4582646cb7 Mon Sep 17 00:00:00 2001 +From: Mike Marciniszyn +Date: Thu, 31 May 2018 11:30:09 -0700 +Subject: IB/hfi1: Fix user context tail allocation for DMA_RTAIL + +From: Mike Marciniszyn + +commit 1bc0299d976e000ececc6acd76e33b4582646cb7 upstream. + +The following code fails to allocate a buffer for the +tail address that the hardware DMAs into when the user +context DMA_RTAIL is set. + +if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL)) { + rcd->rcvhdrtail_kvaddr = dma_zalloc_coherent( + &dd->pcidev->dev, PAGE_SIZE, &dma_hdrqtail, + gfp_flags); + if (!rcd->rcvhdrtail_kvaddr) + goto bail_free; + rcd->rcvhdrqtailaddr_dma = dma_hdrqtail; +} + +So the rcvhdrtail_kvaddr would then be NULL. + +The mmap logic fails to check for a NULL rcvhdrtail_kvaddr. + +The fix is to test for both user and kernel DMA_TAIL options +during the allocation as well as testing for a NULL +rcvhdrtail_kvaddr during the mmap processing. + +Additionally, all downstream testing of the capmask for DMA_RTAIL +have been eliminated in favor of testing rcvhdrtail_kvaddr. + +Cc: # 4.9.x +Reviewed-by: Michael J. Ruhl +Signed-off-by: Mike Marciniszyn +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hfi1/chip.c | 8 ++++---- + drivers/infiniband/hw/hfi1/file_ops.c | 2 +- + drivers/infiniband/hw/hfi1/init.c | 9 ++++----- + 3 files changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/infiniband/hw/hfi1/chip.c ++++ b/drivers/infiniband/hw/hfi1/chip.c +@@ -6717,7 +6717,7 @@ static void rxe_kernel_unfreeze(struct h + for (i = 0; i < dd->n_krcv_queues; i++) { + rcvmask = HFI1_RCVCTRL_CTXT_ENB; + /* HFI1_RCVCTRL_TAILUPD_[ENB|DIS] needs to be set explicitly */ +- rcvmask |= HFI1_CAP_KGET_MASK(dd->rcd[i]->flags, DMA_RTAIL) ? ++ rcvmask |= dd->rcd[i]->rcvhdrtail_kvaddr ? + HFI1_RCVCTRL_TAILUPD_ENB : HFI1_RCVCTRL_TAILUPD_DIS; + hfi1_rcvctrl(dd, rcvmask, i); + } +@@ -8211,7 +8211,7 @@ static inline int check_packet_present(s + u32 tail; + int present; + +- if (!HFI1_CAP_IS_KSET(DMA_RTAIL)) ++ if (!rcd->rcvhdrtail_kvaddr) + present = (rcd->seq_cnt == + rhf_rcv_seq(rhf_to_cpu(get_rhf_addr(rcd)))); + else /* is RDMA rtail */ +@@ -11550,7 +11550,7 @@ void hfi1_rcvctrl(struct hfi1_devdata *d + /* reset the tail and hdr addresses, and sequence count */ + write_kctxt_csr(dd, ctxt, RCV_HDR_ADDR, + rcd->rcvhdrq_dma); +- if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL)) ++ if (rcd->rcvhdrtail_kvaddr) + write_kctxt_csr(dd, ctxt, RCV_HDR_TAIL_ADDR, + rcd->rcvhdrqtailaddr_dma); + rcd->seq_cnt = 1; +@@ -11630,7 +11630,7 @@ void hfi1_rcvctrl(struct hfi1_devdata *d + rcvctrl |= RCV_CTXT_CTRL_INTR_AVAIL_SMASK; + if (op & HFI1_RCVCTRL_INTRAVAIL_DIS) + rcvctrl &= ~RCV_CTXT_CTRL_INTR_AVAIL_SMASK; +- if (op & HFI1_RCVCTRL_TAILUPD_ENB && rcd->rcvhdrqtailaddr_dma) ++ if ((op & HFI1_RCVCTRL_TAILUPD_ENB) && rcd->rcvhdrtail_kvaddr) + rcvctrl |= RCV_CTXT_CTRL_TAIL_UPD_SMASK; + if (op & HFI1_RCVCTRL_TAILUPD_DIS) { + /* See comment on RcvCtxtCtrl.TailUpd above */ +--- a/drivers/infiniband/hw/hfi1/file_ops.c ++++ b/drivers/infiniband/hw/hfi1/file_ops.c +@@ -609,7 +609,7 @@ static int hfi1_file_mmap(struct file *f + ret = -EINVAL; + goto done; + } +- if (flags & VM_WRITE) { ++ if ((flags & VM_WRITE) || !uctxt->rcvhdrtail_kvaddr) { + ret = -EPERM; + goto done; + } +--- a/drivers/infiniband/hw/hfi1/init.c ++++ b/drivers/infiniband/hw/hfi1/init.c +@@ -1618,7 +1618,6 @@ int hfi1_create_rcvhdrq(struct hfi1_devd + u64 reg; + + if (!rcd->rcvhdrq) { +- dma_addr_t dma_hdrqtail; + gfp_t gfp_flags; + + /* +@@ -1641,13 +1640,13 @@ int hfi1_create_rcvhdrq(struct hfi1_devd + goto bail; + } + +- if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL)) { ++ if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL) || ++ HFI1_CAP_UGET_MASK(rcd->flags, DMA_RTAIL)) { + rcd->rcvhdrtail_kvaddr = dma_zalloc_coherent( +- &dd->pcidev->dev, PAGE_SIZE, &dma_hdrqtail, +- gfp_flags); ++ &dd->pcidev->dev, PAGE_SIZE, ++ &rcd->rcvhdrqtailaddr_dma, gfp_flags); + if (!rcd->rcvhdrtail_kvaddr) + goto bail_free; +- rcd->rcvhdrqtailaddr_dma = dma_hdrqtail; + } + + rcd->rcvhdrq_size = amt; diff --git a/queue-4.9/net-phy-micrel-fix-crash-when-statistic-requested-for-ksz9031-phy.patch b/queue-4.9/net-phy-micrel-fix-crash-when-statistic-requested-for-ksz9031-phy.patch new file mode 100644 index 00000000000..b98b44dbfa7 --- /dev/null +++ b/queue-4.9/net-phy-micrel-fix-crash-when-statistic-requested-for-ksz9031-phy.patch @@ -0,0 +1,116 @@ +From bfe72442578bb112626e476ffe1f276504d85b95 Mon Sep 17 00:00:00 2001 +From: Grygorii Strashko +Date: Thu, 13 Apr 2017 14:11:27 -0500 +Subject: net: phy: micrel: fix crash when statistic requested for KSZ9031 phy + +From: Grygorii Strashko + +commit bfe72442578bb112626e476ffe1f276504d85b95 upstream. + +Now the command: + ethtool --phy-statistics eth0 +will cause system crash with meassage "Unable to handle kernel NULL pointer +dereference at virtual address 00000010" from: + + (kszphy_get_stats) from [] (ethtool_get_phy_stats+0xd8/0x210) + (ethtool_get_phy_stats) from [] (dev_ethtool+0x5b8/0x228c) + (dev_ethtool) from [] (dev_ioctl+0x3fc/0x964) + (dev_ioctl) from [] (sock_ioctl+0x170/0x2c0) + (sock_ioctl) from [] (do_vfs_ioctl+0xa8/0x95c) + (do_vfs_ioctl) from [] (SyS_ioctl+0x3c/0x64) + (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x44) + +The reason: phy_driver structure for KSZ9031 phy has no .probe() callback +defined. As result, struct phy_device *phydev->priv pointer will not be +initializes (null). +This issue will affect also following phys: + KSZ8795, KSZ886X, KSZ8873MLL, KSZ9031, KSZ9021, KSZ8061, KS8737 + +Fix it by: +- adding .probe() = kszphy_probe() callback to KSZ9031, KSZ9021 +phys. The kszphy_probe() can be re-used as it doesn't do any phy specific +settings. +- removing statistic callbacks from other phys (KSZ8795, KSZ886X, +KSZ8873MLL, KSZ8061, KS8737) as they doesn't have corresponding +statistic counters. + +Fixes: 2b2427d06426 ("phy: micrel: Add ethtool statistics counters") +Signed-off-by: Grygorii Strashko +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Cc: Dan Rue +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/phy/micrel.c | 17 ++--------------- + 1 file changed, 2 insertions(+), 15 deletions(-) + +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -801,9 +801,6 @@ static struct phy_driver ksphy_driver[] + .read_status = genphy_read_status, + .ack_interrupt = kszphy_ack_interrupt, + .config_intr = kszphy_config_intr, +- .get_sset_count = kszphy_get_sset_count, +- .get_strings = kszphy_get_strings, +- .get_stats = kszphy_get_stats, + .suspend = genphy_suspend, + .resume = genphy_resume, + }, { +@@ -948,9 +945,6 @@ static struct phy_driver ksphy_driver[] + .read_status = genphy_read_status, + .ack_interrupt = kszphy_ack_interrupt, + .config_intr = kszphy_config_intr, +- .get_sset_count = kszphy_get_sset_count, +- .get_strings = kszphy_get_strings, +- .get_stats = kszphy_get_stats, + .suspend = genphy_suspend, + .resume = genphy_resume, + }, { +@@ -960,6 +954,7 @@ static struct phy_driver ksphy_driver[] + .features = (PHY_GBIT_FEATURES | SUPPORTED_Pause), + .flags = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT, + .driver_data = &ksz9021_type, ++ .probe = kszphy_probe, + .config_init = ksz9021_config_init, + .config_aneg = genphy_config_aneg, + .read_status = genphy_read_status, +@@ -979,6 +974,7 @@ static struct phy_driver ksphy_driver[] + .features = (PHY_GBIT_FEATURES | SUPPORTED_Pause), + .flags = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT, + .driver_data = &ksz9021_type, ++ .probe = kszphy_probe, + .config_init = ksz9031_config_init, + .config_aneg = genphy_config_aneg, + .read_status = ksz9031_read_status, +@@ -998,9 +994,6 @@ static struct phy_driver ksphy_driver[] + .config_init = kszphy_config_init, + .config_aneg = ksz8873mll_config_aneg, + .read_status = ksz8873mll_read_status, +- .get_sset_count = kszphy_get_sset_count, +- .get_strings = kszphy_get_strings, +- .get_stats = kszphy_get_stats, + .suspend = genphy_suspend, + .resume = genphy_resume, + }, { +@@ -1012,9 +1005,6 @@ static struct phy_driver ksphy_driver[] + .config_init = kszphy_config_init, + .config_aneg = genphy_config_aneg, + .read_status = genphy_read_status, +- .get_sset_count = kszphy_get_sset_count, +- .get_strings = kszphy_get_strings, +- .get_stats = kszphy_get_stats, + .suspend = genphy_suspend, + .resume = genphy_resume, + }, { +@@ -1026,9 +1016,6 @@ static struct phy_driver ksphy_driver[] + .config_init = kszphy_config_init, + .config_aneg = ksz8873mll_config_aneg, + .read_status = ksz8873mll_read_status, +- .get_sset_count = kszphy_get_sset_count, +- .get_strings = kszphy_get_strings, +- .get_stats = kszphy_get_stats, + .suspend = genphy_suspend, + .resume = genphy_resume, + } }; diff --git a/queue-4.9/series b/queue-4.9/series index 878529bbc8d..6d2d012c824 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -11,3 +11,8 @@ ipv4-fix-error-return-value-in-fib_convert_metrics.patch kprobes-x86-do-not-modify-singlestep-buffer-while-resuming.patch netfilter-nf_tables-use-warn_on_once-instead-of-bug_on-in-nft_do_chain.patch revert-sit-reload-iphdr-in-ipip6_rcv.patch +net-phy-micrel-fix-crash-when-statistic-requested-for-ksz9031-phy.patch +arm-dts-imx6q-use-correct-sdma-script-for-spi5-core.patch +ib-hfi1-fix-user-context-tail-allocation-for-dma_rtail.patch +x86-xen-add-call-of-speculative_store_bypass_ht_init-to-pv-paths.patch +x86-cpu-re-apply-forced-caps-every-time-cpu-caps-are-re-read.patch diff --git a/queue-4.9/x86-cpu-re-apply-forced-caps-every-time-cpu-caps-are-re-read.patch b/queue-4.9/x86-cpu-re-apply-forced-caps-every-time-cpu-caps-are-re-read.patch new file mode 100644 index 00000000000..895170d93f4 --- /dev/null +++ b/queue-4.9/x86-cpu-re-apply-forced-caps-every-time-cpu-caps-are-re-read.patch @@ -0,0 +1,58 @@ +From 60d3450167433f2d099ce2869dc52dd9e7dc9b29 Mon Sep 17 00:00:00 2001 +From: Andy Lutomirski +Date: Wed, 18 Jan 2017 11:15:39 -0800 +Subject: x86/cpu: Re-apply forced caps every time CPU caps are re-read + +From: Andy Lutomirski + +commit 60d3450167433f2d099ce2869dc52dd9e7dc9b29 upstream. + +Calling get_cpu_cap() will reset a bunch of CPU features. This will +cause the system to lose track of force-set and force-cleared +features in the words that are reset until the end of CPU +initialization. This can cause X86_FEATURE_FPU, for example, to +change back and forth during boot and potentially confuse CPU setup. + +To minimize the chance of confusion, re-apply forced caps every time +get_cpu_cap() is called. + +Signed-off-by: Andy Lutomirski +Reviewed-by: Borislav Petkov +Cc: Borislav Petkov +Cc: Brian Gerst +Cc: Dave Hansen +Cc: Fenghua Yu +Cc: H. Peter Anvin +Cc: Linus Torvalds +Cc: Matthew Whitehead +Cc: Oleg Nesterov +Cc: One Thousand Gnomes +Cc: Peter Zijlstra +Cc: Rik van Riel +Cc: Thomas Gleixner +Cc: Yu-cheng Yu +Link: http://lkml.kernel.org/r/c817eb373d2c67c2c81413a70fc9b845fa34a37e.1484705016.git.luto@kernel.org +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + + +--- + arch/x86/kernel/cpu/common.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -848,6 +848,13 @@ void get_cpu_cap(struct cpuinfo_x86 *c) + + init_scattered_cpuid_features(c); + init_speculation_control(c); ++ ++ /* ++ * Clear/Set all flags overridden by options, after probe. ++ * This needs to happen each time we re-probe, which may happen ++ * several times during CPU initialization. ++ */ ++ apply_forced_caps(c); + } + + static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c) diff --git a/queue-4.9/x86-xen-add-call-of-speculative_store_bypass_ht_init-to-pv-paths.patch b/queue-4.9/x86-xen-add-call-of-speculative_store_bypass_ht_init-to-pv-paths.patch new file mode 100644 index 00000000000..407d54efc9d --- /dev/null +++ b/queue-4.9/x86-xen-add-call-of-speculative_store_bypass_ht_init-to-pv-paths.patch @@ -0,0 +1,64 @@ +From 74899d92e66663dc7671a8017b3146dcd4735f3b Mon Sep 17 00:00:00 2001 +From: Juergen Gross +Date: Thu, 21 Jun 2018 10:43:31 +0200 +Subject: x86/xen: Add call of speculative_store_bypass_ht_init() to PV paths + +From: Juergen Gross + +commit 74899d92e66663dc7671a8017b3146dcd4735f3b upstream. + +Commit: + + 1f50ddb4f418 ("x86/speculation: Handle HT correctly on AMD") + +... added speculative_store_bypass_ht_init() to the per-CPU initialization sequence. + +speculative_store_bypass_ht_init() needs to be called on each CPU for +PV guests, too. + +Reported-by: Brian Woods +Tested-by: Brian Woods +Signed-off-by: Juergen Gross +Cc: +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: boris.ostrovsky@oracle.com +Cc: xen-devel@lists.xenproject.org +Fixes: 1f50ddb4f4189243c05926b842dc1a0332195f31 ("x86/speculation: Handle HT correctly on AMD") +Link: https://lore.kernel.org/lkml/20180621084331.21228-1-jgross@suse.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/smp.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/x86/xen/smp.c ++++ b/arch/x86/xen/smp.c +@@ -28,6 +28,7 @@ + #include + #include + ++#include + #include + #include + +@@ -87,6 +88,8 @@ static void cpu_bringup(void) + cpu_data(cpu).x86_max_cores = 1; + set_cpu_sibling_map(cpu); + ++ speculative_store_bypass_ht_init(); ++ + xen_setup_cpu_clockevents(); + + notify_cpu_starting(cpu); +@@ -375,6 +378,8 @@ static void __init xen_smp_prepare_cpus( + } + set_cpu_sibling_map(0); + ++ speculative_store_bypass_ht_init(); ++ + xen_pmu_init(0); + + if (xen_smp_intr_init(0))