--- /dev/null
+From foo@baz Thu Jun 15 11:38:13 CEST 2017
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 23 May 2017 21:53:53 -0400
+Subject: ARM: defconfigs: make NF_CT_PROTO_SCTP and NF_CT_PROTO_UDPLITE built-in
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit 5aff1d245e8cc1ab5c4517d916edaed9e3f7f973 ]
+
+The symbols can no longer be used as loadable modules, leading to a harmless Kconfig
+warning:
+
+arch/arm/configs/imote2_defconfig:60:warning: symbol value 'm' invalid for NF_CT_PROTO_UDPLITE
+arch/arm/configs/imote2_defconfig:59:warning: symbol value 'm' invalid for NF_CT_PROTO_SCTP
+arch/arm/configs/ezx_defconfig:68:warning: symbol value 'm' invalid for NF_CT_PROTO_UDPLITE
+arch/arm/configs/ezx_defconfig:67:warning: symbol value 'm' invalid for NF_CT_PROTO_SCTP
+
+Let's make them built-in.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/configs/ezx_defconfig | 4 ++--
+ arch/arm/configs/imote2_defconfig | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/configs/ezx_defconfig
++++ b/arch/arm/configs/ezx_defconfig
+@@ -64,8 +64,8 @@ CONFIG_NETFILTER=y
+ CONFIG_NETFILTER_NETLINK_QUEUE=m
+ CONFIG_NF_CONNTRACK=m
+ CONFIG_NF_CONNTRACK_EVENTS=y
+-CONFIG_NF_CT_PROTO_SCTP=m
+-CONFIG_NF_CT_PROTO_UDPLITE=m
++CONFIG_NF_CT_PROTO_SCTP=y
++CONFIG_NF_CT_PROTO_UDPLITE=y
+ CONFIG_NF_CONNTRACK_AMANDA=m
+ CONFIG_NF_CONNTRACK_FTP=m
+ CONFIG_NF_CONNTRACK_H323=m
+--- a/arch/arm/configs/imote2_defconfig
++++ b/arch/arm/configs/imote2_defconfig
+@@ -56,8 +56,8 @@ CONFIG_NETFILTER=y
+ CONFIG_NETFILTER_NETLINK_QUEUE=m
+ CONFIG_NF_CONNTRACK=m
+ CONFIG_NF_CONNTRACK_EVENTS=y
+-CONFIG_NF_CT_PROTO_SCTP=m
+-CONFIG_NF_CT_PROTO_UDPLITE=m
++CONFIG_NF_CT_PROTO_SCTP=y
++CONFIG_NF_CT_PROTO_UDPLITE=y
+ CONFIG_NF_CONNTRACK_AMANDA=m
+ CONFIG_NF_CONNTRACK_FTP=m
+ CONFIG_NF_CONNTRACK_H323=m
--- /dev/null
+From foo@baz Thu Jun 15 11:38:13 CEST 2017
+From: Marcus Huewe <suse-tux@gmx.de>
+Date: Tue, 23 May 2017 21:53:49 -0400
+Subject: ipv6: addrconf: fix generation of new temporary addresses
+
+From: Marcus Huewe <suse-tux@gmx.de>
+
+
+[ Upstream commit a11a7f71cac209c7c9cca66eb506e1ebb033a3b3 ]
+
+Under some circumstances it is possible that no new temporary addresses
+will be generated.
+
+For instance, addrconf_prefix_rcv_add_addr() indirectly calls
+ipv6_create_tempaddr(), which creates a tentative temporary address and
+starts dad. Next, addrconf_prefix_rcv_add_addr() indirectly calls
+addrconf_verify_rtnl(). Now, assume that the previously created temporary
+address has the least preferred lifetime among all existing addresses and
+is still tentative (that is, dad is still running). Hence, the next run of
+addrconf_verify_rtnl() is performed when the preferred lifetime of the
+temporary address ends. If dad succeeds before the next run, the temporary
+address becomes deprecated during the next run, but no new temporary
+address is generated.
+
+In order to fix this, schedule the next addrconf_verify_rtnl() run slightly
+before the temporary address becomes deprecated, if dad succeeded.
+
+Signed-off-by: Marcus Huewe <suse-tux@gmx.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/addrconf.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -4004,6 +4004,12 @@ static void addrconf_dad_completed(struc
+
+ if (bump_id)
+ rt_genid_bump_ipv6(dev_net(dev));
++
++ /* Make sure that a new temporary address will be created
++ * before this temporary address becomes deprecated.
++ */
++ if (ifp->flags & IFA_F_TEMPORARY)
++ addrconf_verify_rtnl();
+ }
+
+ static void addrconf_dad_run(struct inet6_dev *idev)
--- /dev/null
+From foo@baz Thu Jun 15 11:38:13 CEST 2017
+From: Linus Lüssing <linus.luessing@c0d3.blue>
+Date: Tue, 23 May 2017 21:53:52 -0400
+Subject: ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping switches
+
+From: Linus Lüssing <linus.luessing@c0d3.blue>
+
+
+[ Upstream commit a088d1d73a4bcfd7bc482f8d08375b9b665dc3e5 ]
+
+When for instance a mobile Linux device roams from one access point to
+another with both APs sharing the same broadcast domain and a
+multicast snooping switch in between:
+
+1) (c) <~~~> (AP1) <--[SSW]--> (AP2)
+
+2) (AP1) <--[SSW]--> (AP2) <~~~> (c)
+
+Then currently IPv6 multicast packets will get lost for (c) until an
+MLD Querier sends its next query message. The packet loss occurs
+because upon roaming the Linux host so far stayed silent regarding
+MLD and the snooping switch will therefore be unaware of the
+multicast topology change for a while.
+
+This patch fixes this by always resending MLD reports when an interface
+change happens, for instance from NO-CARRIER to CARRIER state.
+
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/addrconf.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -3387,9 +3387,15 @@ static int addrconf_notify(struct notifi
+ }
+
+ if (idev) {
+- if (idev->if_flags & IF_READY)
+- /* device is already configured. */
++ if (idev->if_flags & IF_READY) {
++ /* device is already configured -
++ * but resend MLD reports, we might
++ * have roamed and need to update
++ * multicast snooping switches
++ */
++ ipv6_mc_up(idev);
+ break;
++ }
+ idev->if_flags |= IF_READY;
+ }
+
--- /dev/null
+From foo@baz Thu Jun 15 11:38:13 CEST 2017
+From: David Lin <dtwlin@google.com>
+Date: Tue, 23 May 2017 21:53:55 -0400
+Subject: jump label: pass kbuild_cflags when checking for asm goto support
+
+From: David Lin <dtwlin@google.com>
+
+
+[ Upstream commit 35f860f9ba6aac56cc38e8b18916d833a83f1157 ]
+
+Some versions of ARM GCC compiler such as Android toolchain throws in a
+'-fpic' flag by default. This causes the gcc-goto check script to fail
+although some config would have '-fno-pic' flag in the KBUILD_CFLAGS.
+
+This patch passes the KBUILD_CFLAGS to the check script so that the
+script does not rely on the default config from different compilers.
+
+Link: http://lkml.kernel.org/r/20170120234329.78868-1-dtwlin@google.com
+Signed-off-by: David Lin <dtwlin@google.com>
+Acked-by: Steven Rostedt <rostedt@goodmis.org>
+Cc: Michal Marek <mmarek@suse.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -797,7 +797,7 @@ KBUILD_CFLAGS += $(call cc-option,-Wer
+ KBUILD_ARFLAGS := $(call ar-option,D)
+
+ # check for 'asm goto'
+-ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC)), y)
++ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y)
+ KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO
+ KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO
+ endif
--- /dev/null
+From foo@baz Thu Jun 15 11:38:13 CEST 2017
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Tue, 23 May 2017 21:53:57 -0400
+Subject: kasan: respect /proc/sys/kernel/traceoff_on_warning
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+
+[ Upstream commit 4f40c6e5627ea73b4e7c615c59631f38cc880885 ]
+
+After much waiting I finally reproduced a KASAN issue, only to find my
+trace-buffer empty of useful information because it got spooled out :/
+
+Make kasan_report honour the /proc/sys/kernel/traceoff_on_warning
+interface.
+
+Link: http://lkml.kernel.org/r/20170125164106.3514-1-aryabinin@virtuozzo.com
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Acked-by: Alexander Potapenko <glider@google.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/kasan/report.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/mm/kasan/report.c
++++ b/mm/kasan/report.c
+@@ -13,6 +13,7 @@
+ *
+ */
+
++#include <linux/ftrace.h>
+ #include <linux/kernel.h>
+ #include <linux/mm.h>
+ #include <linux/printk.h>
+@@ -298,6 +299,8 @@ void kasan_report(unsigned long addr, si
+ if (likely(!kasan_report_enabled()))
+ return;
+
++ disable_trace_on_warning();
++
+ info.access_addr = (void *)addr;
+ info.access_size = size;
+ info.is_write = is_write;
--- /dev/null
+From foo@baz Thu Jun 15 11:38:13 CEST 2017
+From: "Luis R. Rodriguez" <mcgrof@kernel.org>
+Date: Tue, 23 May 2017 21:53:47 -0400
+Subject: kernel/ucount.c: mark user_header with kmemleak_ignore()
+
+From: "Luis R. Rodriguez" <mcgrof@kernel.org>
+
+
+[ Upstream commit ed5bd7dc88edf4a4a9c67130742b1b59aa017a5f ]
+
+The user_header gets caught by kmemleak with the following splat as
+missing a free:
+
+ unreferenced object 0xffff99667a733d80 (size 96):
+ comm "swapper/0", pid 1, jiffies 4294892317 (age 62191.468s)
+ hex dump (first 32 bytes):
+ a0 b6 92 b4 ff ff ff ff 00 00 00 00 01 00 00 00 ................
+ 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ kmemleak_alloc+0x4a/0xa0
+ __kmalloc+0x144/0x260
+ __register_sysctl_table+0x54/0x5e0
+ register_sysctl+0x1b/0x20
+ user_namespace_sysctl_init+0x17/0x34
+ do_one_initcall+0x52/0x1a0
+ kernel_init_freeable+0x173/0x200
+ kernel_init+0xe/0x100
+ ret_from_fork+0x2c/0x40
+
+The BUG_ON()s are intended to crash so no need to clean up after
+ourselves on error there. This is also a kernel/ subsys_init() we don't
+need a respective exit call here as this is never modular, so just white
+list it.
+
+Link: http://lkml.kernel.org/r/20170203211404.31458-1-mcgrof@kernel.org
+Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org>
+Cc: Eric W. Biederman <ebiederm@xmission.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Nikolay Borisov <n.borisov.lkml@gmail.com>
+Cc: Serge Hallyn <serge@hallyn.com>
+Cc: Jan Kara <jack@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/ucount.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/kernel/ucount.c
++++ b/kernel/ucount.c
+@@ -231,11 +231,10 @@ static __init int user_namespace_sysctl_
+ * properly.
+ */
+ user_header = register_sysctl("user", empty);
++ kmemleak_ignore(user_header);
+ BUG_ON(!user_header);
+ BUG_ON(!setup_userns_sysctls(&init_user_ns));
+ #endif
+ return 0;
+ }
+ subsys_initcall(user_namespace_sysctl_init);
+-
+-
--- /dev/null
+From foo@baz Thu Jun 15 11:38:13 CEST 2017
+From: Thanneeru Srinivasulu <tsrinivasulu@cavium.com>
+Date: Tue, 23 May 2017 21:53:48 -0400
+Subject: net: thunderx: Fix PHY autoneg for SGMII QLM mode
+
+From: Thanneeru Srinivasulu <tsrinivasulu@cavium.com>
+
+
+[ Upstream commit 075ad765ef7541b2860de8408c165a92b78aefa3 ]
+
+This patch fixes the case where there is no phydev attached
+to a LMAC in DT due to non-existance of a PHY driver or due
+to usage of non-stanadard PHY which doesn't support autoneg.
+Changes dependeds on firmware to send correct info w.r.t
+PHY and autoneg capability.
+
+This patch also covers a case where a 10G/40G interface is used
+as a 1G with convertors with Cortina PHY in between.
+
+Signed-off-by: Thanneeru Srinivasulu <tsrinivasulu@cavium.com>
+Signed-off-by: Sunil Goutham <sgoutham@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 108 +++++++++++++++++++---
+ drivers/net/ethernet/cavium/thunder/thunder_bgx.h | 5 +
+ 2 files changed, 101 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
++++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+@@ -31,6 +31,7 @@ struct lmac {
+ u8 lmac_type;
+ u8 lane_to_sds;
+ bool use_training;
++ bool autoneg;
+ bool link_up;
+ int lmacid; /* ID within BGX */
+ int lmacid_bd; /* ID on board */
+@@ -418,7 +419,17 @@ static int bgx_lmac_sgmii_init(struct bg
+ /* power down, reset autoneg, autoneg enable */
+ cfg = bgx_reg_read(bgx, lmacid, BGX_GMP_PCS_MRX_CTL);
+ cfg &= ~PCS_MRX_CTL_PWR_DN;
+- cfg |= (PCS_MRX_CTL_RST_AN | PCS_MRX_CTL_AN_EN);
++ cfg |= PCS_MRX_CTL_RST_AN;
++ if (lmac->phydev) {
++ cfg |= PCS_MRX_CTL_AN_EN;
++ } else {
++ /* In scenarios where PHY driver is not present or it's a
++ * non-standard PHY, FW sets AN_EN to inform Linux driver
++ * to do auto-neg and link polling or not.
++ */
++ if (cfg & PCS_MRX_CTL_AN_EN)
++ lmac->autoneg = true;
++ }
+ bgx_reg_write(bgx, lmacid, BGX_GMP_PCS_MRX_CTL, cfg);
+
+ if (lmac->lmac_type == BGX_MODE_QSGMII) {
+@@ -429,7 +440,7 @@ static int bgx_lmac_sgmii_init(struct bg
+ return 0;
+ }
+
+- if (lmac->lmac_type == BGX_MODE_SGMII) {
++ if ((lmac->lmac_type == BGX_MODE_SGMII) && lmac->phydev) {
+ if (bgx_poll_reg(bgx, lmacid, BGX_GMP_PCS_MRX_STATUS,
+ PCS_MRX_STATUS_AN_CPT, false)) {
+ dev_err(&bgx->pdev->dev, "BGX AN_CPT not completed\n");
+@@ -623,12 +634,71 @@ static int bgx_xaui_check_link(struct lm
+ return -1;
+ }
+
++static void bgx_poll_for_sgmii_link(struct lmac *lmac)
++{
++ u64 pcs_link, an_result;
++ u8 speed;
++
++ pcs_link = bgx_reg_read(lmac->bgx, lmac->lmacid,
++ BGX_GMP_PCS_MRX_STATUS);
++
++ /*Link state bit is sticky, read it again*/
++ if (!(pcs_link & PCS_MRX_STATUS_LINK))
++ pcs_link = bgx_reg_read(lmac->bgx, lmac->lmacid,
++ BGX_GMP_PCS_MRX_STATUS);
++
++ if (bgx_poll_reg(lmac->bgx, lmac->lmacid, BGX_GMP_PCS_MRX_STATUS,
++ PCS_MRX_STATUS_AN_CPT, false)) {
++ lmac->link_up = false;
++ lmac->last_speed = SPEED_UNKNOWN;
++ lmac->last_duplex = DUPLEX_UNKNOWN;
++ goto next_poll;
++ }
++
++ lmac->link_up = ((pcs_link & PCS_MRX_STATUS_LINK) != 0) ? true : false;
++ an_result = bgx_reg_read(lmac->bgx, lmac->lmacid,
++ BGX_GMP_PCS_ANX_AN_RESULTS);
++
++ speed = (an_result >> 3) & 0x3;
++ lmac->last_duplex = (an_result >> 1) & 0x1;
++ switch (speed) {
++ case 0:
++ lmac->last_speed = 10;
++ break;
++ case 1:
++ lmac->last_speed = 100;
++ break;
++ case 2:
++ lmac->last_speed = 1000;
++ break;
++ default:
++ lmac->link_up = false;
++ lmac->last_speed = SPEED_UNKNOWN;
++ lmac->last_duplex = DUPLEX_UNKNOWN;
++ break;
++ }
++
++next_poll:
++
++ if (lmac->last_link != lmac->link_up) {
++ if (lmac->link_up)
++ bgx_sgmii_change_link_state(lmac);
++ lmac->last_link = lmac->link_up;
++ }
++
++ queue_delayed_work(lmac->check_link, &lmac->dwork, HZ * 3);
++}
++
+ static void bgx_poll_for_link(struct work_struct *work)
+ {
+ struct lmac *lmac;
+ u64 spu_link, smu_link;
+
+ lmac = container_of(work, struct lmac, dwork.work);
++ if (lmac->is_sgmii) {
++ bgx_poll_for_sgmii_link(lmac);
++ return;
++ }
+
+ /* Receive link is latching low. Force it high and verify it */
+ bgx_reg_modify(lmac->bgx, lmac->lmacid,
+@@ -720,9 +790,21 @@ static int bgx_lmac_enable(struct bgx *b
+ (lmac->lmac_type != BGX_MODE_XLAUI) &&
+ (lmac->lmac_type != BGX_MODE_40G_KR) &&
+ (lmac->lmac_type != BGX_MODE_10G_KR)) {
+- if (!lmac->phydev)
+- return -ENODEV;
+-
++ if (!lmac->phydev) {
++ if (lmac->autoneg) {
++ bgx_reg_write(bgx, lmacid,
++ BGX_GMP_PCS_LINKX_TIMER,
++ PCS_LINKX_TIMER_COUNT);
++ goto poll;
++ } else {
++ /* Default to below link speed and duplex */
++ lmac->link_up = true;
++ lmac->last_speed = 1000;
++ lmac->last_duplex = 1;
++ bgx_sgmii_change_link_state(lmac);
++ return 0;
++ }
++ }
+ lmac->phydev->dev_flags = 0;
+
+ if (phy_connect_direct(&lmac->netdev, lmac->phydev,
+@@ -731,15 +813,17 @@ static int bgx_lmac_enable(struct bgx *b
+ return -ENODEV;
+
+ phy_start_aneg(lmac->phydev);
+- } else {
+- lmac->check_link = alloc_workqueue("check_link", WQ_UNBOUND |
+- WQ_MEM_RECLAIM, 1);
+- if (!lmac->check_link)
+- return -ENOMEM;
+- INIT_DELAYED_WORK(&lmac->dwork, bgx_poll_for_link);
+- queue_delayed_work(lmac->check_link, &lmac->dwork, 0);
++ return 0;
+ }
+
++poll:
++ lmac->check_link = alloc_workqueue("check_link", WQ_UNBOUND |
++ WQ_MEM_RECLAIM, 1);
++ if (!lmac->check_link)
++ return -ENOMEM;
++ INIT_DELAYED_WORK(&lmac->dwork, bgx_poll_for_link);
++ queue_delayed_work(lmac->check_link, &lmac->dwork, 0);
++
+ return 0;
+ }
+
+--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
++++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
+@@ -144,10 +144,15 @@
+ #define PCS_MRX_CTL_LOOPBACK1 BIT_ULL(14)
+ #define PCS_MRX_CTL_RESET BIT_ULL(15)
+ #define BGX_GMP_PCS_MRX_STATUS 0x30008
++#define PCS_MRX_STATUS_LINK BIT_ULL(2)
+ #define PCS_MRX_STATUS_AN_CPT BIT_ULL(5)
++#define BGX_GMP_PCS_ANX_ADV 0x30010
+ #define BGX_GMP_PCS_ANX_AN_RESULTS 0x30020
++#define BGX_GMP_PCS_LINKX_TIMER 0x30040
++#define PCS_LINKX_TIMER_COUNT 0x1E84
+ #define BGX_GMP_PCS_SGM_AN_ADV 0x30068
+ #define BGX_GMP_PCS_MISCX_CTL 0x30078
++#define PCS_MISC_CTL_MODE BIT_ULL(8)
+ #define PCS_MISC_CTL_DISP_EN BIT_ULL(13)
+ #define PCS_MISC_CTL_GMX_ENO BIT_ULL(11)
+ #define PCS_MISC_CTL_SAMP_PT_MASK 0x7Full
--- /dev/null
+From foo@baz Thu Jun 15 11:38:13 CEST 2017
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 23 May 2017 21:53:54 -0400
+Subject: PM / runtime: Avoid false-positive warnings from might_sleep_if()
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+
+[ Upstream commit a9306a63631493afc75893a4ac405d4e1cbae6aa ]
+
+The might_sleep_if() assertions in __pm_runtime_idle(),
+__pm_runtime_suspend() and __pm_runtime_resume() may generate
+false-positive warnings in some situations. For example, that
+happens if a nested pm_runtime_get_sync()/pm_runtime_put() pair
+is executed with disabled interrupts within an outer
+pm_runtime_get_sync()/pm_runtime_put() section for the same device.
+[Generally, pm_runtime_get_sync() may sleep, so it should not be
+called with disabled interrupts, but in this particular case the
+previous pm_runtime_get_sync() guarantees that the device will not
+be suspended, so the inner pm_runtime_get_sync() will return
+immediately after incrementing the device's usage counter.]
+
+That started to happen in the i915 driver in 4.10-rc, leading to
+the following splat:
+
+ BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1032
+ in_atomic(): 1, irqs_disabled(): 0, pid: 1500, name: Xorg
+ 1 lock held by Xorg/1500:
+ #0: (&dev->struct_mutex){+.+.+.}, at:
+ [<ffffffffa0680c13>] i915_mutex_lock_interruptible+0x43/0x140 [i915]
+ CPU: 0 PID: 1500 Comm: Xorg Not tainted
+ Call Trace:
+ dump_stack+0x85/0xc2
+ ___might_sleep+0x196/0x260
+ __might_sleep+0x53/0xb0
+ __pm_runtime_resume+0x7a/0x90
+ intel_runtime_pm_get+0x25/0x90 [i915]
+ aliasing_gtt_bind_vma+0xaa/0xf0 [i915]
+ i915_vma_bind+0xaf/0x1e0 [i915]
+ i915_gem_execbuffer_relocate_entry+0x513/0x6f0 [i915]
+ i915_gem_execbuffer_relocate_vma.isra.34+0x188/0x250 [i915]
+ ? trace_hardirqs_on+0xd/0x10
+ ? i915_gem_execbuffer_reserve_vma.isra.31+0x152/0x1f0 [i915]
+ ? i915_gem_execbuffer_reserve.isra.32+0x372/0x3a0 [i915]
+ i915_gem_do_execbuffer.isra.38+0xa70/0x1a40 [i915]
+ ? __might_fault+0x4e/0xb0
+ i915_gem_execbuffer2+0xc5/0x260 [i915]
+ ? __might_fault+0x4e/0xb0
+ drm_ioctl+0x206/0x450 [drm]
+ ? i915_gem_execbuffer+0x340/0x340 [i915]
+ ? __fget+0x5/0x200
+ do_vfs_ioctl+0x91/0x6f0
+ ? __fget+0x111/0x200
+ ? __fget+0x5/0x200
+ SyS_ioctl+0x79/0x90
+ entry_SYSCALL_64_fastpath+0x23/0xc6
+
+even though the code triggering it is correct.
+
+Unfortunately, the might_sleep_if() assertions in question are
+too coarse-grained to cover such cases correctly, so make them
+a bit less sensitive in order to avoid the false-positives.
+
+Reported-and-tested-by: Sedat Dilek <sedat.dilek@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/power/runtime.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -889,13 +889,13 @@ int __pm_runtime_idle(struct device *dev
+ unsigned long flags;
+ int retval;
+
+- might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
+-
+ if (rpmflags & RPM_GET_PUT) {
+ if (!atomic_dec_and_test(&dev->power.usage_count))
+ return 0;
+ }
+
++ might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
++
+ spin_lock_irqsave(&dev->power.lock, flags);
+ retval = rpm_idle(dev, rpmflags);
+ spin_unlock_irqrestore(&dev->power.lock, flags);
+@@ -921,13 +921,13 @@ int __pm_runtime_suspend(struct device *
+ unsigned long flags;
+ int retval;
+
+- might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
+-
+ if (rpmflags & RPM_GET_PUT) {
+ if (!atomic_dec_and_test(&dev->power.usage_count))
+ return 0;
+ }
+
++ might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
++
+ spin_lock_irqsave(&dev->power.lock, flags);
+ retval = rpm_suspend(dev, rpmflags);
+ spin_unlock_irqrestore(&dev->power.lock, flags);
+@@ -952,7 +952,8 @@ int __pm_runtime_resume(struct device *d
+ unsigned long flags;
+ int retval;
+
+- might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
++ might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe &&
++ dev->power.runtime_status != RPM_ACTIVE);
+
+ if (rpmflags & RPM_GET_PUT)
+ atomic_inc(&dev->power.usage_count);
i2c-piix4-request-the-smbus-semaphore-inside-the-mutex.patch
i2c-piix4-fix-request_region-size.patch
powerpc-powernv-properly-set-host-ipi-on-ipis.patch
+kernel-ucount.c-mark-user_header-with-kmemleak_ignore.patch
+net-thunderx-fix-phy-autoneg-for-sgmii-qlm-mode.patch
+ipv6-addrconf-fix-generation-of-new-temporary-addresses.patch
+vfio-spapr_tce-set-window-when-adding-additional-groups-to-container.patch
+ipv6-fix-ipv6-packet-loss-in-scenarios-involving-roaming-snooping-switches.patch
+arm-defconfigs-make-nf_ct_proto_sctp-and-nf_ct_proto_udplite-built-in.patch
+pm-runtime-avoid-false-positive-warnings-from-might_sleep_if.patch
+jump-label-pass-kbuild_cflags-when-checking-for-asm-goto-support.patch
+shmem-fix-sleeping-from-atomic-context.patch
+kasan-respect-proc-sys-kernel-traceoff_on_warning.patch
--- /dev/null
+From foo@baz Thu Jun 15 11:38:13 CEST 2017
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Tue, 23 May 2017 21:53:56 -0400
+Subject: shmem: fix sleeping from atomic context
+
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+
+
+[ Upstream commit 253fd0f02040a19c6fe80e4171659fa3482a422d ]
+
+Syzkaller fuzzer managed to trigger this:
+
+ BUG: sleeping function called from invalid context at mm/shmem.c:852
+ in_atomic(): 1, irqs_disabled(): 0, pid: 529, name: khugepaged
+ 3 locks held by khugepaged/529:
+ #0: (shrinker_rwsem){++++..}, at: [<ffffffff818d7ef1>] shrink_slab.part.59+0x121/0xd30 mm/vmscan.c:451
+ #1: (&type->s_umount_key#29){++++..}, at: [<ffffffff81a63630>] trylock_super+0x20/0x100 fs/super.c:392
+ #2: (&(&sbinfo->shrinklist_lock)->rlock){+.+.-.}, at: [<ffffffff818fd83e>] spin_lock include/linux/spinlock.h:302 [inline]
+ #2: (&(&sbinfo->shrinklist_lock)->rlock){+.+.-.}, at: [<ffffffff818fd83e>] shmem_unused_huge_shrink+0x28e/0x1490 mm/shmem.c:427
+ CPU: 2 PID: 529 Comm: khugepaged Not tainted 4.10.0-rc5+ #201
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
+ Call Trace:
+ shmem_undo_range+0xb20/0x2710 mm/shmem.c:852
+ shmem_truncate_range+0x27/0xa0 mm/shmem.c:939
+ shmem_evict_inode+0x35f/0xca0 mm/shmem.c:1030
+ evict+0x46e/0x980 fs/inode.c:553
+ iput_final fs/inode.c:1515 [inline]
+ iput+0x589/0xb20 fs/inode.c:1542
+ shmem_unused_huge_shrink+0xbad/0x1490 mm/shmem.c:446
+ shmem_unused_huge_scan+0x10c/0x170 mm/shmem.c:512
+ super_cache_scan+0x376/0x450 fs/super.c:106
+ do_shrink_slab mm/vmscan.c:378 [inline]
+ shrink_slab.part.59+0x543/0xd30 mm/vmscan.c:481
+ shrink_slab mm/vmscan.c:2592 [inline]
+ shrink_node+0x2c7/0x870 mm/vmscan.c:2592
+ shrink_zones mm/vmscan.c:2734 [inline]
+ do_try_to_free_pages+0x369/0xc80 mm/vmscan.c:2776
+ try_to_free_pages+0x3c6/0x900 mm/vmscan.c:2982
+ __perform_reclaim mm/page_alloc.c:3301 [inline]
+ __alloc_pages_direct_reclaim mm/page_alloc.c:3322 [inline]
+ __alloc_pages_slowpath+0xa24/0x1c30 mm/page_alloc.c:3683
+ __alloc_pages_nodemask+0x544/0xae0 mm/page_alloc.c:3848
+ __alloc_pages include/linux/gfp.h:426 [inline]
+ __alloc_pages_node include/linux/gfp.h:439 [inline]
+ khugepaged_alloc_page+0xc2/0x1b0 mm/khugepaged.c:750
+ collapse_huge_page+0x182/0x1fe0 mm/khugepaged.c:955
+ khugepaged_scan_pmd+0xfdf/0x12a0 mm/khugepaged.c:1208
+ khugepaged_scan_mm_slot mm/khugepaged.c:1727 [inline]
+ khugepaged_do_scan mm/khugepaged.c:1808 [inline]
+ khugepaged+0xe9b/0x1590 mm/khugepaged.c:1853
+ kthread+0x326/0x3f0 kernel/kthread.c:227
+ ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430
+
+The iput() from atomic context was a bad idea: if after igrab() somebody
+else calls iput() and we left with the last inode reference, our iput()
+would lead to inode eviction and therefore sleeping.
+
+This patch should fix the situation.
+
+Link: http://lkml.kernel.org/r/20170131093141.GA15899@node.shutemov.name
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/shmem.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -412,6 +412,7 @@ static unsigned long shmem_unused_huge_s
+ struct shrink_control *sc, unsigned long nr_to_split)
+ {
+ LIST_HEAD(list), *pos, *next;
++ LIST_HEAD(to_remove);
+ struct inode *inode;
+ struct shmem_inode_info *info;
+ struct page *page;
+@@ -438,9 +439,8 @@ static unsigned long shmem_unused_huge_s
+ /* Check if there's anything to gain */
+ if (round_up(inode->i_size, PAGE_SIZE) ==
+ round_up(inode->i_size, HPAGE_PMD_SIZE)) {
+- list_del_init(&info->shrinklist);
++ list_move(&info->shrinklist, &to_remove);
+ removed++;
+- iput(inode);
+ goto next;
+ }
+
+@@ -451,6 +451,13 @@ next:
+ }
+ spin_unlock(&sbinfo->shrinklist_lock);
+
++ list_for_each_safe(pos, next, &to_remove) {
++ info = list_entry(pos, struct shmem_inode_info, shrinklist);
++ inode = &info->vfs_inode;
++ list_del_init(&info->shrinklist);
++ iput(inode);
++ }
++
+ list_for_each_safe(pos, next, &list) {
+ int ret;
+
--- /dev/null
+From foo@baz Thu Jun 15 11:38:13 CEST 2017
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+Date: Tue, 23 May 2017 21:53:51 -0400
+Subject: vfio/spapr_tce: Set window when adding additional groups to container
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+
+[ Upstream commit 930a42ded3fede7ca3acafc9153f4f2d0f56a92c ]
+
+If a container already has a group attached, attaching a new group
+should just program already created IOMMU tables to the hardware via
+the iommu_table_group_ops::set_window() callback.
+
+However commit 6f01cc692a16 ("vfio/spapr: Add a helper to create
+default DMA window") did not just simplify the code but also removed
+the set_window() calls in the case of attaching groups to a container
+which already has tables so it broke VFIO PCI hotplug.
+
+This reverts set_window() bits in tce_iommu_take_ownership_ddw().
+
+Fixes: 6f01cc692a16 ("vfio/spapr: Add a helper to create default DMA window")
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vfio/vfio_iommu_spapr_tce.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/drivers/vfio/vfio_iommu_spapr_tce.c
++++ b/drivers/vfio/vfio_iommu_spapr_tce.c
+@@ -1246,6 +1246,8 @@ static void tce_iommu_release_ownership_
+ static long tce_iommu_take_ownership_ddw(struct tce_container *container,
+ struct iommu_table_group *table_group)
+ {
++ long i, ret = 0;
++
+ if (!table_group->ops->create_table || !table_group->ops->set_window ||
+ !table_group->ops->release_ownership) {
+ WARN_ON_ONCE(1);
+@@ -1254,7 +1256,27 @@ static long tce_iommu_take_ownership_ddw
+
+ table_group->ops->take_ownership(table_group);
+
++ /* Set all windows to the new group */
++ for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i) {
++ struct iommu_table *tbl = container->tables[i];
++
++ if (!tbl)
++ continue;
++
++ ret = table_group->ops->set_window(table_group, i, tbl);
++ if (ret)
++ goto release_exit;
++ }
++
+ return 0;
++
++release_exit:
++ for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i)
++ table_group->ops->unset_window(table_group, i);
++
++ table_group->ops->release_ownership(table_group);
++
++ return ret;
+ }
+
+ static int tce_iommu_attach_group(void *iommu_data,
projects / thirdparty / kernel / stable-queue.git / commitdiff
