From: Greg Kroah-Hartman Date: Wed, 6 May 2020 14:34:35 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.4.223~55 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=168de89d646da526a2cd799164cfdee4e0f4de6d;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: ath10k-free-cached-fw-bin-contents-when-get-board-id-fails.patch bonding-prevent-out-of-bound-accesses.patch btrfs-cleaner_kthread-doesn-t-need-explicit-freeze.patch c8sectpfe-rework-firmware-loading-mechanism.patch firmware-actually-return-null-on-failed-request_firmware_nowait.patch ib-mlx5-fix-fw-version-diaplay-in-sysfs.patch ib-mlx5-fix-rc-transport-send-queue-overhead-computation.patch irda-free-skb-on-irda_accept-error-path.patch mtd-nand-fix-onfi-parameter-page-layout.patch net-mlx5-add-timeout-handle-to-commands-with-callback.patch net-mlx5-avoid-calling-sleeping-function-by-the-health-poll-thread.patch net-mlx5-avoid-passing-dma-address-0-to-firmware.patch net-mlx5-fix-masking-of-reserved-bits-in-xrcd-number.patch net-mlx5-fix-pci-error-recovery-flow.patch net-mlx5-fix-potential-deadlock-in-command-mode-change.patch net-mlx5-fix-the-size-of-modify-qp-mailbox.patch net-mlx5-fix-wait_vital-for-vfs-and-remove-fixed-sleep.patch net-mlx5-make-command-timeout-way-shorter.patch net-mlx5-use-mlx5_buf_alloc_node-instead-of-mlx5_buf_alloc-in-mlx5_wq_ll_create.patch net-mlx5e-copy-all-l2-headers-into-inline-segment.patch net-mlx5e-fix-blue-flame-quota-logic.patch net-mlx5e-fix-mlx5e_100base_t-define.patch net_sched-keep-backlog-updated-with-qlen.patch phy-fix-device-reference-leaks.patch sch_drr-update-backlog-as-well.patch sch_hfsc-always-keep-backlog-updated.patch sch_prio-update-backlog-as-well.patch sch_qfq-keep-backlog-updated-with-qlen.patch sch_sfb-keep-backlog-updated-with-qlen.patch sch_tbf-update-backlog-as-well.patch --- diff --git a/queue-4.4/ath10k-free-cached-fw-bin-contents-when-get-board-id-fails.patch b/queue-4.4/ath10k-free-cached-fw-bin-contents-when-get-board-id-fails.patch new file mode 100644 index 00000000000..fd4399763eb --- /dev/null +++ b/queue-4.4/ath10k-free-cached-fw-bin-contents-when-get-board-id-fails.patch @@ -0,0 +1,33 @@ +From b9c191be3fbdd9d78be11160dd7a3ddb9fdc6d42 Mon Sep 17 00:00:00 2001 +From: Raja Mani +Date: Thu, 10 Mar 2016 10:25:07 +0530 +Subject: ath10k: free cached fw bin contents when get board id fails + +From: Raja Mani + +commit b9c191be3fbdd9d78be11160dd7a3ddb9fdc6d42 upstream. + +ath10k_core_probe_fw() simply returns error without freeing +cached firmware file content when get board id operation fails. +Free cached fw bin data in failure case to avoid memory leak. + +Fixes: db0984e51a18 ("ath10k: select board data based on BMI chip id and board id") +Signed-off-by: Raja Mani +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath10k/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -1805,7 +1805,7 @@ static int ath10k_core_probe_fw(struct a + if (ret && ret != -EOPNOTSUPP) { + ath10k_err(ar, "failed to get board id from otp for qca99x0: %d\n", + ret); +- return ret; ++ goto err_free_firmware_files; + } + + ret = ath10k_core_fetch_board_file(ar); diff --git a/queue-4.4/bonding-prevent-out-of-bound-accesses.patch b/queue-4.4/bonding-prevent-out-of-bound-accesses.patch new file mode 100644 index 00000000000..d3fe8402359 --- /dev/null +++ b/queue-4.4/bonding-prevent-out-of-bound-accesses.patch @@ -0,0 +1,115 @@ +From f87fda00b6ed232a817c655b8d179b48bde8fdbe Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 30 Jun 2016 16:13:41 +0200 +Subject: bonding: prevent out of bound accesses + +From: Eric Dumazet + +commit f87fda00b6ed232a817c655b8d179b48bde8fdbe upstream. + +ether_addr_equal_64bits() requires some care about its arguments, +namely that 8 bytes might be read, even if last 2 byte values are not +used. + +KASan detected a violation with null_mac_addr and lacpdu_mcast_addr +in bond_3ad.c + +Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c : +Although the 8-byte alignment was there, KASan would detect out +of bound accesses. + +Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare") +Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr") +Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB") +Signed-off-by: Eric Dumazet +Reported-by: Dmitry Vyukov +Acked-by: Dmitry Vyukov +Acked-by: Nikolay Aleksandrov +Acked-by: Ding Tianhong +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/bonding/bond_3ad.c | 11 +++++++---- + drivers/net/bonding/bond_alb.c | 7 ++----- + include/net/bonding.h | 7 ++++++- + 3 files changed, 15 insertions(+), 10 deletions(-) + +--- a/drivers/net/bonding/bond_3ad.c ++++ b/drivers/net/bonding/bond_3ad.c +@@ -100,11 +100,14 @@ enum ad_link_speed_type { + #define MAC_ADDRESS_EQUAL(A, B) \ + ether_addr_equal_64bits((const u8 *)A, (const u8 *)B) + +-static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } }; ++static const u8 null_mac_addr[ETH_ALEN + 2] __long_aligned = { ++ 0, 0, 0, 0, 0, 0 ++}; + static u16 ad_ticks_per_sec; + static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000; + +-static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR; ++static const u8 lacpdu_mcast_addr[ETH_ALEN + 2] __long_aligned = ++ MULTICAST_LACPDU_ADDR; + + /* ================= main 802.3ad protocol functions ================== */ + static int ad_lacpdu_send(struct port *port); +@@ -1701,7 +1704,7 @@ static void ad_clear_agg(struct aggregat + aggregator->is_individual = false; + aggregator->actor_admin_aggregator_key = 0; + aggregator->actor_oper_aggregator_key = 0; +- aggregator->partner_system = null_mac_addr; ++ eth_zero_addr(aggregator->partner_system.mac_addr_value); + aggregator->partner_system_priority = 0; + aggregator->partner_oper_aggregator_key = 0; + aggregator->receive_state = 0; +@@ -1723,7 +1726,7 @@ static void ad_initialize_agg(struct agg + if (aggregator) { + ad_clear_agg(aggregator); + +- aggregator->aggregator_mac_address = null_mac_addr; ++ eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value); + aggregator->aggregator_identifier = 0; + aggregator->slave = NULL; + } +--- a/drivers/net/bonding/bond_alb.c ++++ b/drivers/net/bonding/bond_alb.c +@@ -42,13 +42,10 @@ + + + +-#ifndef __long_aligned +-#define __long_aligned __attribute__((aligned((sizeof(long))))) +-#endif +-static const u8 mac_bcast[ETH_ALEN] __long_aligned = { ++static const u8 mac_bcast[ETH_ALEN + 2] __long_aligned = { + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff + }; +-static const u8 mac_v6_allmcast[ETH_ALEN] __long_aligned = { ++static const u8 mac_v6_allmcast[ETH_ALEN + 2] __long_aligned = { + 0x33, 0x33, 0x00, 0x00, 0x00, 0x01 + }; + static const int alb_delta_in_ticks = HZ / ALB_TIMER_TICKS_PER_SEC; +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -34,6 +34,9 @@ + + #define BOND_DEFAULT_MIIMON 100 + ++#ifndef __long_aligned ++#define __long_aligned __attribute__((aligned((sizeof(long))))) ++#endif + /* + * Less bad way to call ioctl from within the kernel; this needs to be + * done some other way to get the call out of interrupt context. +@@ -138,7 +141,9 @@ struct bond_params { + struct reciprocal_value reciprocal_packets_per_slave; + u16 ad_actor_sys_prio; + u16 ad_user_port_key; +- u8 ad_actor_system[ETH_ALEN]; ++ ++ /* 2 bytes of padding : see ether_addr_equal_64bits() */ ++ u8 ad_actor_system[ETH_ALEN + 2]; + }; + + struct bond_parm_tbl { diff --git a/queue-4.4/btrfs-cleaner_kthread-doesn-t-need-explicit-freeze.patch b/queue-4.4/btrfs-cleaner_kthread-doesn-t-need-explicit-freeze.patch new file mode 100644 index 00000000000..9b67e09bf61 --- /dev/null +++ b/queue-4.4/btrfs-cleaner_kthread-doesn-t-need-explicit-freeze.patch @@ -0,0 +1,40 @@ +From 838fe1887765f4cc679febea60d87d2a06bd300e Mon Sep 17 00:00:00 2001 +From: Jiri Kosina +Date: Tue, 15 Mar 2016 11:28:54 +0100 +Subject: btrfs: cleaner_kthread() doesn't need explicit freeze + +From: Jiri Kosina + +commit 838fe1887765f4cc679febea60d87d2a06bd300e upstream. + +cleaner_kthread() is not marked freezable, and therefore calling +try_to_freeze() in its context is a pointless no-op. + +In addition to that, as has been clearly demonstrated by 80ad623edd2d +("Revert "btrfs: clear PF_NOFREEZE in cleaner_kthread()"), it's perfectly +valid / legal for cleaner_kthread() to stay scheduled out in an arbitrary +place during suspend (in that particular example that was waiting for +reading of extent pages), so there is no need to leave any traces of +freezer in this kthread. + +Fixes: 80ad623edd2d ("Revert "btrfs: clear PF_NOFREEZE in cleaner_kthread()") +Fixes: 696249132158 ("btrfs: clear PF_NOFREEZE in cleaner_kthread()") +Signed-off-by: Jiri Kosina +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/disk-io.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1750,7 +1750,7 @@ static int cleaner_kthread(void *arg) + */ + btrfs_delete_unused_bgs(root->fs_info); + sleep: +- if (!try_to_freeze() && !again) { ++ if (!again) { + set_current_state(TASK_INTERRUPTIBLE); + if (!kthread_should_stop()) + schedule(); diff --git a/queue-4.4/c8sectpfe-rework-firmware-loading-mechanism.patch b/queue-4.4/c8sectpfe-rework-firmware-loading-mechanism.patch new file mode 100644 index 00000000000..50111cbc517 --- /dev/null +++ b/queue-4.4/c8sectpfe-rework-firmware-loading-mechanism.patch @@ -0,0 +1,174 @@ +From c23ac90f78aa9190643c82c1975a0cfe480d7c60 Mon Sep 17 00:00:00 2001 +From: Peter Griffin +Date: Thu, 24 Mar 2016 08:23:52 -0300 +Subject: [media] c8sectpfe: Rework firmware loading mechanism + +From: Peter Griffin + +commit c23ac90f78aa9190643c82c1975a0cfe480d7c60 upstream. + +c8sectpfe driver relied on CONFIG_FW_LOADER_USER_HELPER_FALLBACK option +for loading its xp70 firmware. A previous commit removed this Kconfig +option, as it is apparently harmful, but did not update the driver +code which relied on it. + +This patch reworks the firmware loading into the start_feed callback. +At this point we can be sure the rootfs is present, thereby removing +the depedency on CONFIG_FW_LOADER_USER_HELPER_FALLBACK. + +Fixes: 79f5b6ae960d ('[media] c8sectpfe: Remove select on CONFIG_FW_LOADER_USER_HELPER_FALLBACK') + +Signed-off-by: Peter Griffin +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 65 ++++++------------ + 1 file changed, 22 insertions(+), 43 deletions(-) + +--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c ++++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +@@ -49,7 +49,7 @@ MODULE_FIRMWARE(FIRMWARE_MEMDMA); + #define PID_TABLE_SIZE 1024 + #define POLL_MSECS 50 + +-static int load_c8sectpfe_fw_step1(struct c8sectpfei *fei); ++static int load_c8sectpfe_fw(struct c8sectpfei *fei); + + #define TS_PKT_SIZE 188 + #define HEADER_SIZE (4) +@@ -143,6 +143,7 @@ static int c8sectpfe_start_feed(struct d + struct channel_info *channel; + u32 tmp; + unsigned long *bitmap; ++ int ret; + + switch (dvbdmxfeed->type) { + case DMX_TYPE_TS: +@@ -171,8 +172,9 @@ static int c8sectpfe_start_feed(struct d + } + + if (!atomic_read(&fei->fw_loaded)) { +- dev_err(fei->dev, "%s: c8sectpfe fw not loaded\n", __func__); +- return -EINVAL; ++ ret = load_c8sectpfe_fw(fei); ++ if (ret) ++ return ret; + } + + mutex_lock(&fei->lock); +@@ -267,8 +269,9 @@ static int c8sectpfe_stop_feed(struct dv + unsigned long *bitmap; + + if (!atomic_read(&fei->fw_loaded)) { +- dev_err(fei->dev, "%s: c8sectpfe fw not loaded\n", __func__); +- return -EINVAL; ++ ret = load_c8sectpfe_fw(fei); ++ if (ret) ++ return ret; + } + + mutex_lock(&fei->lock); +@@ -882,13 +885,6 @@ static int c8sectpfe_probe(struct platfo + goto err_clk_disable; + } + +- /* ensure all other init has been done before requesting firmware */ +- ret = load_c8sectpfe_fw_step1(fei); +- if (ret) { +- dev_err(dev, "Couldn't load slim core firmware\n"); +- goto err_clk_disable; +- } +- + c8sectpfe_debugfs_init(fei); + + return 0; +@@ -1093,15 +1089,14 @@ static void load_dmem_segment(struct c8s + phdr->p_memsz - phdr->p_filesz); + } + +-static int load_slim_core_fw(const struct firmware *fw, void *context) ++static int load_slim_core_fw(const struct firmware *fw, struct c8sectpfei *fei) + { +- struct c8sectpfei *fei = context; + Elf32_Ehdr *ehdr; + Elf32_Phdr *phdr; + u8 __iomem *dst; + int err = 0, i; + +- if (!fw || !context) ++ if (!fw || !fei) + return -EINVAL; + + ehdr = (Elf32_Ehdr *)fw->data; +@@ -1153,29 +1148,35 @@ static int load_slim_core_fw(const struc + return err; + } + +-static void load_c8sectpfe_fw_cb(const struct firmware *fw, void *context) ++static int load_c8sectpfe_fw(struct c8sectpfei *fei) + { +- struct c8sectpfei *fei = context; ++ const struct firmware *fw; + int err; + ++ dev_info(fei->dev, "Loading firmware: %s\n", FIRMWARE_MEMDMA); ++ ++ err = request_firmware(&fw, FIRMWARE_MEMDMA, fei->dev); ++ if (err) ++ return err; ++ + err = c8sectpfe_elf_sanity_check(fei, fw); + if (err) { + dev_err(fei->dev, "c8sectpfe_elf_sanity_check failed err=(%d)\n" + , err); +- goto err; ++ return err; + } + +- err = load_slim_core_fw(fw, context); ++ err = load_slim_core_fw(fw, fei); + if (err) { + dev_err(fei->dev, "load_slim_core_fw failed err=(%d)\n", err); +- goto err; ++ return err; + } + + /* now the firmware is loaded configure the input blocks */ + err = configure_channels(fei); + if (err) { + dev_err(fei->dev, "configure_channels failed err=(%d)\n", err); +- goto err; ++ return err; + } + + /* +@@ -1188,28 +1189,6 @@ static void load_c8sectpfe_fw_cb(const s + writel(0x1, fei->io + DMA_CPU_RUN); + + atomic_set(&fei->fw_loaded, 1); +-err: +- complete_all(&fei->fw_ack); +-} +- +-static int load_c8sectpfe_fw_step1(struct c8sectpfei *fei) +-{ +- int err; +- +- dev_info(fei->dev, "Loading firmware: %s\n", FIRMWARE_MEMDMA); +- +- init_completion(&fei->fw_ack); +- atomic_set(&fei->fw_loaded, 0); +- +- err = request_firmware_nowait(THIS_MODULE, FW_ACTION_HOTPLUG, +- FIRMWARE_MEMDMA, fei->dev, GFP_KERNEL, fei, +- load_c8sectpfe_fw_cb); +- +- if (err) { +- dev_err(fei->dev, "request_firmware_nowait err: %d.\n", err); +- complete_all(&fei->fw_ack); +- return err; +- } + + return 0; + } diff --git a/queue-4.4/firmware-actually-return-null-on-failed-request_firmware_nowait.patch b/queue-4.4/firmware-actually-return-null-on-failed-request_firmware_nowait.patch new file mode 100644 index 00000000000..f100441dc82 --- /dev/null +++ b/queue-4.4/firmware-actually-return-null-on-failed-request_firmware_nowait.patch @@ -0,0 +1,110 @@ +From 715780ae4bb76d6fd2f20eb78e2a9ba9769a6cdc Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Wed, 9 Dec 2015 14:50:28 -0800 +Subject: firmware: actually return NULL on failed request_firmware_nowait() + +From: Brian Norris + +commit 715780ae4bb76d6fd2f20eb78e2a9ba9769a6cdc upstream. + +The kerneldoc for request_firmware_nowait() says that it may call the +provided cont() callback with @fw == NULL, if the firmware request +fails. However, this is not the case when called with an empty string +(""). This case is short-circuited by the 'name[0] == '\0'' check +introduced in commit 471b095dfe0d ("firmware_class: make sure fw requests +contain a name"), so _request_firmware() never gets to set the fw to +NULL. + +Noticed while using the new 'trigger_async_request' testing hook: + + # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request + [10553.726178] test_firmware: loading '' + [10553.729859] test_firmware: loaded: 995209091 + # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request + [10733.676184] test_firmware: loading '' + [10733.679855] Unable to handle kernel NULL pointer dereference at virtual address 00000004 + [10733.687951] pgd = ec188000 + [10733.690655] [00000004] *pgd=00000000 + [10733.694240] Internal error: Oops: 5 [#1] SMP ARM + [10733.698847] Modules linked in: btmrvl_sdio btmrvl bluetooth sbs_battery nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables asix usbnet mwifiex_sdio mwifiex cfg80211 jitterentropy_rng drbg joydev snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device ppp_async ppp_generic slhc tun + [10733.725670] CPU: 0 PID: 6600 Comm: bash Not tainted 4.4.0-rc4-00351-g63d0877 #178 + [10733.733137] Hardware name: Rockchip (Device Tree) + [10733.737831] task: ed24f6c0 ti: ee322000 task.ti: ee322000 + [10733.743222] PC is at do_raw_spin_lock+0x18/0x1a0 + [10733.747831] LR is at _raw_spin_lock+0x18/0x1c + [10733.752180] pc : [] lr : [] psr: a00d0013 + [10733.752180] sp : ee323df8 ip : ee323e20 fp : ee323e1c + [10733.763634] r10: 00000051 r9 : b6f18000 r8 : ee323f80 + [10733.768847] r7 : c089cebc r6 : 00000001 r5 : 00000000 r4 : ec0e6000 + [10733.775360] r3 : dead4ead r2 : c06bd140 r1 : eef913b4 r0 : 00000000 + [10733.781874] Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none + [10733.788995] Control: 10c5387d Table: 2c18806a DAC: 00000051 + [10733.794728] Process bash (pid: 6600, stack limit = 0xee322218) + [10733.800549] Stack: (0xee323df8 to 0xee324000) + [10733.804896] 3de0: ec0e6000 00000000 + [10733.813059] 3e00: 00000001 c089cebc ee323f80 b6f18000 ee323e2c ee323e20 c054c204 c0065394 + [10733.821221] 3e20: ee323e44 ee323e30 c02fec60 c054c1f8 ec0e7ec0 ec3fcfc0 ee323e5c ee323e48 + [10733.829384] 3e40: c02fed08 c02fec48 c07dbf74 eeb05a00 ee323e8c ee323e60 c0253828 c02fecac + [10733.837547] 3e60: 00000001 c0116950 ee323eac ee323e78 00000001 ec3fce00 ed2d9700 ed2d970c + [10733.845710] 3e80: ee323e9c ee323e90 c02e873c c02537d4 ee323eac ee323ea0 c017bd40 c02e8720 + [10733.853873] 3ea0: ee323ee4 ee323eb0 c017b250 c017bd00 00000000 00000000 f3e47a54 ec128b00 + [10733.862035] 3ec0: c017b10c ee323f80 00000001 c000f504 ee322000 00000000 ee323f4c ee323ee8 + [10733.870197] 3ee0: c011b71c c017b118 ee323fb0 c011bc90 becfa8d9 00000001 ec128b00 00000001 + [10733.878359] 3f00: b6f18000 ee323f80 ee323f4c ee323f18 c011bc90 c0063950 ee323f3c ee323f28 + [10733.886522] 3f20: c0063950 c0549138 00000001 ec128b00 00000001 ec128b00 b6f18000 ee323f80 + [10733.894684] 3f40: ee323f7c ee323f50 c011bed8 c011b6ec c0135fb8 c0135f24 ec128b00 ec128b00 + [10733.902847] 3f60: 00000001 b6f18000 c000f504 ee322000 ee323fa4 ee323f80 c011c664 c011be24 + [10733.911009] 3f80: 00000000 00000000 00000001 b6f18000 b6e79be0 00000004 00000000 ee323fa8 + [10733.919172] 3fa0: c000f340 c011c618 00000001 b6f18000 00000001 b6f18000 00000001 00000000 + [10733.927334] 3fc0: 00000001 b6f18000 b6e79be0 00000004 00000001 00000001 8068a3f1 b6e79c84 + [10733.935496] 3fe0: 00000000 becfa7dc b6de194d b6e20246 400d0030 00000001 7a4536e8 49bda390 + [10733.943664] [] (do_raw_spin_lock) from [] (_raw_spin_lock+0x18/0x1c) + [10733.951743] [] (_raw_spin_lock) from [] (fw_free_buf+0x24/0x64) + [10733.959388] [] (fw_free_buf) from [] (release_firmware+0x68/0x74) + [10733.967207] [] (release_firmware) from [] (trigger_async_request_store+0x60/0x124) + [10733.976501] [] (trigger_async_request_store) from [] (dev_attr_store+0x28/0x34) + [10733.985533] [] (dev_attr_store) from [] (sysfs_kf_write+0x4c/0x58) + [10733.993437] [] (sysfs_kf_write) from [] (kernfs_fop_write+0x144/0x1a8) + [10734.001689] [] (kernfs_fop_write) from [] (__vfs_write+0x3c/0xe4) + +After this patch: + + # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request + [ 32.126322] test_firmware: loading '' + [ 32.129995] test_firmware: failed to async load firmware + -bash: printf: write error: No such device + +Fixes: 471b095dfe0d ("firmware_class: make sure fw requests contain a name") +Signed-off-by: Brian Norris +Acked-by: Ming Lei +Acked-by: Kees Cook +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/firmware_class.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/base/firmware_class.c ++++ b/drivers/base/firmware_class.c +@@ -1119,15 +1119,17 @@ static int + _request_firmware(const struct firmware **firmware_p, const char *name, + struct device *device, unsigned int opt_flags) + { +- struct firmware *fw; ++ struct firmware *fw = NULL; + long timeout; + int ret; + + if (!firmware_p) + return -EINVAL; + +- if (!name || name[0] == '\0') +- return -EINVAL; ++ if (!name || name[0] == '\0') { ++ ret = -EINVAL; ++ goto out; ++ } + + ret = _request_firmware_prepare(&fw, name, device); + if (ret <= 0) /* error or already assigned */ diff --git a/queue-4.4/ib-mlx5-fix-fw-version-diaplay-in-sysfs.patch b/queue-4.4/ib-mlx5-fix-fw-version-diaplay-in-sysfs.patch new file mode 100644 index 00000000000..c280bd44f61 --- /dev/null +++ b/queue-4.4/ib-mlx5-fix-fw-version-diaplay-in-sysfs.patch @@ -0,0 +1,33 @@ +From c0fcebf55289c48148992eee002a7caf853a5358 Mon Sep 17 00:00:00 2001 +From: Eran Ben Elisha +Date: Sat, 4 Jun 2016 15:15:30 +0300 +Subject: IB/mlx5: Fix FW version diaplay in sysfs + +From: Eran Ben Elisha + +commit c0fcebf55289c48148992eee002a7caf853a5358 upstream. + +Add a 4-digit padding to show FW version in proper format. + +Fixes: 9603b61de1eee ('mlx5: Move pci device handling from...') +Signed-off-by: Eran Ben Elisha +Signed-off-by: Noa Osherovich +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -905,7 +905,7 @@ static ssize_t show_fw_ver(struct device + { + struct mlx5_ib_dev *dev = + container_of(device, struct mlx5_ib_dev, ib_dev.dev); +- return sprintf(buf, "%d.%d.%d\n", fw_rev_maj(dev->mdev), ++ return sprintf(buf, "%d.%d.%04d\n", fw_rev_maj(dev->mdev), + fw_rev_min(dev->mdev), fw_rev_sub(dev->mdev)); + } + diff --git a/queue-4.4/ib-mlx5-fix-rc-transport-send-queue-overhead-computation.patch b/queue-4.4/ib-mlx5-fix-rc-transport-send-queue-overhead-computation.patch new file mode 100644 index 00000000000..5d876923885 --- /dev/null +++ b/queue-4.4/ib-mlx5-fix-rc-transport-send-queue-overhead-computation.patch @@ -0,0 +1,59 @@ +From 75c1657e1d50730dc0130a67977f7831a4e241f4 Mon Sep 17 00:00:00 2001 +From: Leon Romanovsky +Date: Thu, 11 Feb 2016 21:09:57 +0200 +Subject: IB/mlx5: Fix RC transport send queue overhead computation + +From: Leon Romanovsky + +commit 75c1657e1d50730dc0130a67977f7831a4e241f4 upstream. + +Fix the RC QPs send queue overhead computation to take into account +two additional segments in the WQE which are needed for registration +operations. + +The ATOMIC and UMR segments can't coexist together, so chose maximum out +of them. + +The commit 9e65dc371b5c ("IB/mlx5: Fix RC transport send queue overhead +computation") was intended to update RC transport as commit messages +states, but added the code to UC transport. + +Fixes: 9e65dc371b5c ("IB/mlx5: Fix RC transport send queue overhead computation") +Signed-off-by: Kamal Heib +Signed-off-by: Leon Romanovsky +Reviewed-by: Sagi Grimberg +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/qp.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -271,8 +271,10 @@ static int sq_overhead(enum ib_qp_type q + /* fall through */ + case IB_QPT_RC: + size += sizeof(struct mlx5_wqe_ctrl_seg) + +- sizeof(struct mlx5_wqe_atomic_seg) + +- sizeof(struct mlx5_wqe_raddr_seg); ++ max(sizeof(struct mlx5_wqe_atomic_seg) + ++ sizeof(struct mlx5_wqe_raddr_seg), ++ sizeof(struct mlx5_wqe_umr_ctrl_seg) + ++ sizeof(struct mlx5_mkey_seg)); + break; + + case IB_QPT_XRC_TGT: +@@ -280,9 +282,9 @@ static int sq_overhead(enum ib_qp_type q + + case IB_QPT_UC: + size += sizeof(struct mlx5_wqe_ctrl_seg) + +- sizeof(struct mlx5_wqe_raddr_seg) + +- sizeof(struct mlx5_wqe_umr_ctrl_seg) + +- sizeof(struct mlx5_mkey_seg); ++ max(sizeof(struct mlx5_wqe_raddr_seg), ++ sizeof(struct mlx5_wqe_umr_ctrl_seg) + ++ sizeof(struct mlx5_mkey_seg)); + break; + + case IB_QPT_UD: diff --git a/queue-4.4/irda-free-skb-on-irda_accept-error-path.patch b/queue-4.4/irda-free-skb-on-irda_accept-error-path.patch new file mode 100644 index 00000000000..3a5fa1916b8 --- /dev/null +++ b/queue-4.4/irda-free-skb-on-irda_accept-error-path.patch @@ -0,0 +1,56 @@ +From 8ab86c00e349cef9fb14719093a7f198bcc72629 Mon Sep 17 00:00:00 2001 +From: "phil.turnbull@oracle.com" +Date: Thu, 15 Sep 2016 12:41:44 -0400 +Subject: irda: Free skb on irda_accept error path. + +From: phil.turnbull@oracle.com + +commit 8ab86c00e349cef9fb14719093a7f198bcc72629 upstream. + +skb is not freed if newsk is NULL. Rework the error path so free_skb is +unconditionally called on function exit. + +Fixes: c3ea9fa27413 ("[IrDA] af_irda: IRDA_ASSERT cleanups") +Signed-off-by: Phil Turnbull +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/irda/af_irda.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/net/irda/af_irda.c ++++ b/net/irda/af_irda.c +@@ -839,7 +839,7 @@ static int irda_accept(struct socket *so + struct sock *sk = sock->sk; + struct irda_sock *new, *self = irda_sk(sk); + struct sock *newsk; +- struct sk_buff *skb; ++ struct sk_buff *skb = NULL; + int err; + + err = irda_create(sock_net(sk), newsock, sk->sk_protocol, 0); +@@ -907,7 +907,6 @@ static int irda_accept(struct socket *so + err = -EPERM; /* value does not seem to make sense. -arnd */ + if (!new->tsap) { + pr_debug("%s(), dup failed!\n", __func__); +- kfree_skb(skb); + goto out; + } + +@@ -926,7 +925,6 @@ static int irda_accept(struct socket *so + /* Clean up the original one to keep it in listen state */ + irttp_listen(self->tsap); + +- kfree_skb(skb); + sk->sk_ack_backlog--; + + newsock->state = SS_CONNECTED; +@@ -934,6 +932,7 @@ static int irda_accept(struct socket *so + irda_connect_response(new); + err = 0; + out: ++ kfree_skb(skb); + release_sock(sk); + return err; + } diff --git a/queue-4.4/mtd-nand-fix-onfi-parameter-page-layout.patch b/queue-4.4/mtd-nand-fix-onfi-parameter-page-layout.patch new file mode 100644 index 00000000000..c567510cf24 --- /dev/null +++ b/queue-4.4/mtd-nand-fix-onfi-parameter-page-layout.patch @@ -0,0 +1,41 @@ +From de64aa9ec129ba627634088f662a4d09e356ddb6 Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Mon, 23 Nov 2015 11:23:07 +0100 +Subject: mtd: nand: fix ONFI parameter page layout + +From: Boris Brezillon + +commit de64aa9ec129ba627634088f662a4d09e356ddb6 upstream. + +src_ssync_features field is only 1 byte large, and the 4th reserved area +is actually 8 bytes large. + +Fixes: d1e1f4e42b5 ("mtd: nand: add support for reading ONFI parameters from NAND device") +Signed-off-by: Boris Brezillon +Signed-off-by: Brian Norris +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/mtd/nand.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/mtd/nand.h ++++ b/include/linux/mtd/nand.h +@@ -276,7 +276,7 @@ struct nand_onfi_params { + __le16 t_r; + __le16 t_ccs; + __le16 src_sync_timing_mode; +- __le16 src_ssync_features; ++ u8 src_ssync_features; + __le16 clk_pin_capacitance_typ; + __le16 io_pin_capacitance_typ; + __le16 input_pin_capacitance_typ; +@@ -284,7 +284,7 @@ struct nand_onfi_params { + u8 driver_strength_support; + __le16 t_int_r; + __le16 t_ald; +- u8 reserved4[7]; ++ u8 reserved4[8]; + + /* vendor */ + __le16 vendor_revision; diff --git a/queue-4.4/net-mlx5-add-timeout-handle-to-commands-with-callback.patch b/queue-4.4/net-mlx5-add-timeout-handle-to-commands-with-callback.patch new file mode 100644 index 00000000000..39f8984e66b --- /dev/null +++ b/queue-4.4/net-mlx5-add-timeout-handle-to-commands-with-callback.patch @@ -0,0 +1,118 @@ +From 65ee67084589c1783a74b4a4a5db38d7264ec8b5 Mon Sep 17 00:00:00 2001 +From: Mohamad Haj Yahia +Date: Thu, 30 Jun 2016 17:34:43 +0300 +Subject: net/mlx5: Add timeout handle to commands with callback + +From: Mohamad Haj Yahia + +commit 65ee67084589c1783a74b4a4a5db38d7264ec8b5 upstream. + +The current implementation does not handle timeout in case of command +with callback request, and this can lead to deadlock if the command +doesn't get fw response. +Add delayed callback timeout work before posting the command to fw. +In case of real fw command completion we will cancel the delayed work. +In case of fw command timeout the callback timeout handler will be +called and it will simulate fw completion with timeout error. + +Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters') +Signed-off-by: Mohamad Haj Yahia +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 38 +++++++++++++++++++++----- + include/linux/mlx5/driver.h | 1 + 2 files changed, 32 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -634,11 +634,36 @@ static void free_msg(struct mlx5_core_de + static void mlx5_free_cmd_msg(struct mlx5_core_dev *dev, + struct mlx5_cmd_msg *msg); + ++static u16 msg_to_opcode(struct mlx5_cmd_msg *in) ++{ ++ struct mlx5_inbox_hdr *hdr = (struct mlx5_inbox_hdr *)(in->first.data); ++ ++ return be16_to_cpu(hdr->opcode); ++} ++ ++static void cb_timeout_handler(struct work_struct *work) ++{ ++ struct delayed_work *dwork = container_of(work, struct delayed_work, ++ work); ++ struct mlx5_cmd_work_ent *ent = container_of(dwork, ++ struct mlx5_cmd_work_ent, ++ cb_timeout_work); ++ struct mlx5_core_dev *dev = container_of(ent->cmd, struct mlx5_core_dev, ++ cmd); ++ ++ ent->ret = -ETIMEDOUT; ++ mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n", ++ mlx5_command_str(msg_to_opcode(ent->in)), ++ msg_to_opcode(ent->in)); ++ mlx5_cmd_comp_handler(dev, 1UL << ent->idx); ++} ++ + static void cmd_work_handler(struct work_struct *work) + { + struct mlx5_cmd_work_ent *ent = container_of(work, struct mlx5_cmd_work_ent, work); + struct mlx5_cmd *cmd = ent->cmd; + struct mlx5_core_dev *dev = container_of(cmd, struct mlx5_core_dev, cmd); ++ unsigned long cb_timeout = msecs_to_jiffies(MLX5_CMD_TIMEOUT_MSEC); + struct mlx5_cmd_layout *lay; + struct semaphore *sem; + unsigned long flags; +@@ -691,6 +716,9 @@ static void cmd_work_handler(struct work + ent->ts1 = ktime_get_ns(); + cmd_mode = cmd->mode; + ++ if (ent->callback) ++ schedule_delayed_work(&ent->cb_timeout_work, cb_timeout); ++ + /* ring doorbell after the descriptor is valid */ + mlx5_core_dbg(dev, "writing 0x%x to command doorbell\n", 1 << ent->idx); + wmb(); +@@ -735,13 +763,6 @@ static const char *deliv_status_to_str(u + } + } + +-static u16 msg_to_opcode(struct mlx5_cmd_msg *in) +-{ +- struct mlx5_inbox_hdr *hdr = (struct mlx5_inbox_hdr *)(in->first.data); +- +- return be16_to_cpu(hdr->opcode); +-} +- + static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent) + { + unsigned long timeout = msecs_to_jiffies(MLX5_CMD_TIMEOUT_MSEC); +@@ -808,6 +829,7 @@ static int mlx5_cmd_invoke(struct mlx5_c + if (!callback) + init_completion(&ent->done); + ++ INIT_DELAYED_WORK(&ent->cb_timeout_work, cb_timeout_handler); + INIT_WORK(&ent->work, cmd_work_handler); + if (page_queue) { + cmd_work_handler(&ent->work); +@@ -1287,6 +1309,8 @@ void mlx5_cmd_comp_handler(struct mlx5_c + struct semaphore *sem; + + ent = cmd->ent_arr[i]; ++ if (ent->callback) ++ cancel_delayed_work(&ent->cb_timeout_work); + if (ent->page_queue) + sem = &cmd->pages_sem; + else +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -566,6 +566,7 @@ struct mlx5_cmd_work_ent { + void *uout; + int uout_size; + mlx5_cmd_cbk_t callback; ++ struct delayed_work cb_timeout_work; + void *context; + int idx; + struct completion done; diff --git a/queue-4.4/net-mlx5-avoid-calling-sleeping-function-by-the-health-poll-thread.patch b/queue-4.4/net-mlx5-avoid-calling-sleeping-function-by-the-health-poll-thread.patch new file mode 100644 index 00000000000..83d9071cad3 --- /dev/null +++ b/queue-4.4/net-mlx5-avoid-calling-sleeping-function-by-the-health-poll-thread.patch @@ -0,0 +1,64 @@ +From c1d4d2e92ad670168a17a57dfa182a5a5baa72d4 Mon Sep 17 00:00:00 2001 +From: Mohamad Haj Yahia +Date: Thu, 30 Jun 2016 17:34:39 +0300 +Subject: net/mlx5: Avoid calling sleeping function by the health poll thread + +From: Mohamad Haj Yahia + +commit c1d4d2e92ad670168a17a57dfa182a5a5baa72d4 upstream. + +In internal error state the health poll thread will eventually call +synchronize_irq() (to safely trigger command completions) which might +sleep, so we are calling sleeping function from atomic context which is +invalid. +Here we move trigger_cmd_completions(dev) to enter error state which is +the earliest stage in error state handling. +This way we won't need to wait for next health poll to trigger command +completions and will solve the scheduling while atomic issue. +mlx5_enter_error_state can be called from two contexts, protect it with +dev->intf_state_lock + +Fixes: 89d44f0a6c73 ('net/mlx5_core: Add pci error handlers to mlx5_core driver') +Signed-off-by: Mohamad Haj Yahia +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlx5/core/health.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c +@@ -108,15 +108,21 @@ static int in_fatal(struct mlx5_core_dev + + void mlx5_enter_error_state(struct mlx5_core_dev *dev) + { ++ mutex_lock(&dev->intf_state_mutex); + if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) +- return; ++ goto unlock; + + mlx5_core_err(dev, "start\n"); +- if (pci_channel_offline(dev->pdev) || in_fatal(dev)) ++ if (pci_channel_offline(dev->pdev) || in_fatal(dev)) { + dev->state = MLX5_DEVICE_STATE_INTERNAL_ERROR; ++ trigger_cmd_completions(dev); ++ } + + mlx5_core_event(dev, MLX5_DEV_EVENT_SYS_ERROR, 0); + mlx5_core_err(dev, "end\n"); ++ ++unlock: ++ mutex_unlock(&dev->intf_state_mutex); + } + + static void mlx5_handle_bad_state(struct mlx5_core_dev *dev) +@@ -245,7 +251,6 @@ static void poll_health(unsigned long da + u32 count; + + if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) { +- trigger_cmd_completions(dev); + mod_timer(&health->timer, get_next_poll_jiffies()); + return; + } diff --git a/queue-4.4/net-mlx5-avoid-passing-dma-address-0-to-firmware.patch b/queue-4.4/net-mlx5-avoid-passing-dma-address-0-to-firmware.patch new file mode 100644 index 00000000000..8e8c649b44c --- /dev/null +++ b/queue-4.4/net-mlx5-avoid-passing-dma-address-0-to-firmware.patch @@ -0,0 +1,81 @@ +From 6b276190c50a12511d889d9079ffb901ff94a822 Mon Sep 17 00:00:00 2001 +From: Noa Osherovich +Date: Tue, 25 Oct 2016 18:36:35 +0300 +Subject: net/mlx5: Avoid passing dma address 0 to firmware + +From: Noa Osherovich + +commit 6b276190c50a12511d889d9079ffb901ff94a822 upstream. + +Currently the firmware can't work with a page with dma address 0. +Passing such an address to the firmware will cause the give_pages +command to fail. + +To avoid this, in case we get a 0 dma address of a page from the +dma engine, we avoid passing it to FW by remapping to get an address +other than 0. + +Fixes: bf0bf77f6519 ('mlx5: Support communicating arbitrary host...') +Signed-off-by: Noa Osherovich +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 26 +++++++++++++------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +@@ -243,6 +243,7 @@ static void free_4k(struct mlx5_core_dev + static int alloc_system_page(struct mlx5_core_dev *dev, u16 func_id) + { + struct page *page; ++ u64 zero_addr = 1; + u64 addr; + int err; + int nid = dev_to_node(&dev->pdev->dev); +@@ -252,26 +253,35 @@ static int alloc_system_page(struct mlx5 + mlx5_core_warn(dev, "failed to allocate page\n"); + return -ENOMEM; + } ++map: + addr = dma_map_page(&dev->pdev->dev, page, 0, + PAGE_SIZE, DMA_BIDIRECTIONAL); + if (dma_mapping_error(&dev->pdev->dev, addr)) { + mlx5_core_warn(dev, "failed dma mapping page\n"); + err = -ENOMEM; +- goto out_alloc; ++ goto err_mapping; + } ++ ++ /* Firmware doesn't support page with physical address 0 */ ++ if (addr == 0) { ++ zero_addr = addr; ++ goto map; ++ } ++ + err = insert_page(dev, addr, page, func_id); + if (err) { + mlx5_core_err(dev, "failed to track allocated page\n"); +- goto out_mapping; ++ dma_unmap_page(&dev->pdev->dev, addr, PAGE_SIZE, ++ DMA_BIDIRECTIONAL); + } + +- return 0; +- +-out_mapping: +- dma_unmap_page(&dev->pdev->dev, addr, PAGE_SIZE, DMA_BIDIRECTIONAL); ++err_mapping: ++ if (err) ++ __free_page(page); + +-out_alloc: +- __free_page(page); ++ if (zero_addr == 0) ++ dma_unmap_page(&dev->pdev->dev, zero_addr, PAGE_SIZE, ++ DMA_BIDIRECTIONAL); + + return err; + } diff --git a/queue-4.4/net-mlx5-fix-masking-of-reserved-bits-in-xrcd-number.patch b/queue-4.4/net-mlx5-fix-masking-of-reserved-bits-in-xrcd-number.patch new file mode 100644 index 00000000000..838c020d1f7 --- /dev/null +++ b/queue-4.4/net-mlx5-fix-masking-of-reserved-bits-in-xrcd-number.patch @@ -0,0 +1,33 @@ +From 9cd3411c42c5d5ba55d6e745edfe7df53c1ffa41 Mon Sep 17 00:00:00 2001 +From: Majd Dibbiny +Date: Fri, 10 Jun 2016 00:07:29 +0300 +Subject: net/mlx5: Fix masking of reserved bits in XRCD number + +From: Majd Dibbiny + +commit 9cd3411c42c5d5ba55d6e745edfe7df53c1ffa41 upstream. + +Mask the reserved bits when reading the number of newly +created XRCD. + +Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters') +Signed-off-by: Majd Dibbiny +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlx5/core/qp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c +@@ -393,7 +393,7 @@ int mlx5_core_xrcd_alloc(struct mlx5_cor + if (out.hdr.status) + err = mlx5_cmd_status_to_err(&out.hdr); + else +- *xrcdn = be32_to_cpu(out.xrcdn); ++ *xrcdn = be32_to_cpu(out.xrcdn) & 0xffffff; + + return err; + } diff --git a/queue-4.4/net-mlx5-fix-pci-error-recovery-flow.patch b/queue-4.4/net-mlx5-fix-pci-error-recovery-flow.patch new file mode 100644 index 00000000000..e8f2be00899 --- /dev/null +++ b/queue-4.4/net-mlx5-fix-pci-error-recovery-flow.patch @@ -0,0 +1,117 @@ +From 1061c90f524963a0a90e7d2f9a6bfa666458af51 Mon Sep 17 00:00:00 2001 +From: Mohamad Haj Yahia +Date: Thu, 18 Aug 2016 21:09:04 +0300 +Subject: net/mlx5: Fix pci error recovery flow + +From: Mohamad Haj Yahia + +commit 1061c90f524963a0a90e7d2f9a6bfa666458af51 upstream. + +When PCI error is detected we should save the state of the pci prior to +disabling it. + +Also when receiving pci slot reset call we need to verify that the +device is responsive. + +Fixes: 89d44f0a6c73 ('net/mlx5_core: Add pci error handlers to mlx5_core +driver') +Signed-off-by: Mohamad Haj Yahia +Signed-off-by: Greg Kroah-Hartman + +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller + +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 59 ++++++++++++------------- + 1 file changed, 29 insertions(+), 30 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1276,36 +1276,12 @@ static pci_ers_result_t mlx5_pci_err_det + dev_info(&pdev->dev, "%s was called\n", __func__); + mlx5_enter_error_state(dev); + mlx5_unload_one(dev, priv); ++ pci_save_state(pdev); + mlx5_pci_disable_device(dev); + return state == pci_channel_io_perm_failure ? + PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_NEED_RESET; + } + +-static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev) +-{ +- struct mlx5_core_dev *dev = pci_get_drvdata(pdev); +- int err = 0; +- +- dev_info(&pdev->dev, "%s was called\n", __func__); +- +- err = mlx5_pci_enable_device(dev); +- if (err) { +- dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n" +- , __func__, err); +- return PCI_ERS_RESULT_DISCONNECT; +- } +- pci_set_master(pdev); +- pci_set_power_state(pdev, PCI_D0); +- pci_restore_state(pdev); +- +- return err ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED; +-} +- +-void mlx5_disable_device(struct mlx5_core_dev *dev) +-{ +- mlx5_pci_err_detected(dev->pdev, 0); +-} +- + /* wait for the device to show vital signs by waiting + * for the health counter to start counting. + */ +@@ -1333,21 +1309,44 @@ static int wait_vital(struct pci_dev *pd + return -ETIMEDOUT; + } + +-static void mlx5_pci_resume(struct pci_dev *pdev) ++static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev) + { + struct mlx5_core_dev *dev = pci_get_drvdata(pdev); +- struct mlx5_priv *priv = &dev->priv; + int err; + + dev_info(&pdev->dev, "%s was called\n", __func__); + +- pci_save_state(pdev); +- err = wait_vital(pdev); ++ err = mlx5_pci_enable_device(dev); + if (err) { ++ dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n" ++ , __func__, err); ++ return PCI_ERS_RESULT_DISCONNECT; ++ } ++ ++ pci_set_master(pdev); ++ pci_restore_state(pdev); ++ ++ if (wait_vital(pdev)) { + dev_err(&pdev->dev, "%s: wait_vital timed out\n", __func__); +- return; ++ return PCI_ERS_RESULT_DISCONNECT; + } + ++ return PCI_ERS_RESULT_RECOVERED; ++} ++ ++void mlx5_disable_device(struct mlx5_core_dev *dev) ++{ ++ mlx5_pci_err_detected(dev->pdev, 0); ++} ++ ++static void mlx5_pci_resume(struct pci_dev *pdev) ++{ ++ struct mlx5_core_dev *dev = pci_get_drvdata(pdev); ++ struct mlx5_priv *priv = &dev->priv; ++ int err; ++ ++ dev_info(&pdev->dev, "%s was called\n", __func__); ++ + err = mlx5_load_one(dev, priv); + if (err) + dev_err(&pdev->dev, "%s: mlx5_load_one failed with error code: %d\n" diff --git a/queue-4.4/net-mlx5-fix-potential-deadlock-in-command-mode-change.patch b/queue-4.4/net-mlx5-fix-potential-deadlock-in-command-mode-change.patch new file mode 100644 index 00000000000..8ccfa4e4db5 --- /dev/null +++ b/queue-4.4/net-mlx5-fix-potential-deadlock-in-command-mode-change.patch @@ -0,0 +1,144 @@ +From 9cba4ebcf374c3772f6eb61f2d065294b2451b49 Mon Sep 17 00:00:00 2001 +From: Mohamad Haj Yahia +Date: Thu, 30 Jun 2016 17:34:42 +0300 +Subject: net/mlx5: Fix potential deadlock in command mode change + +From: Mohamad Haj Yahia + +commit 9cba4ebcf374c3772f6eb61f2d065294b2451b49 upstream. + +Call command completion handler in case of timeout when working in +interrupts mode. +Avoid flushing the commands workqueue after acquiring the semaphores to +prevent a potential deadlock. + +Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters') +Signed-off-by: Mohamad Haj Yahia +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 79 ++++++++++---------------- + 1 file changed, 33 insertions(+), 46 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -750,13 +750,13 @@ static int wait_func(struct mlx5_core_de + + if (cmd->mode == CMD_MODE_POLLING) { + wait_for_completion(&ent->done); +- err = ent->ret; +- } else { +- if (!wait_for_completion_timeout(&ent->done, timeout)) +- err = -ETIMEDOUT; +- else +- err = 0; ++ } else if (!wait_for_completion_timeout(&ent->done, timeout)) { ++ ent->ret = -ETIMEDOUT; ++ mlx5_cmd_comp_handler(dev, 1UL << ent->idx); + } ++ ++ err = ent->ret; ++ + if (err == -ETIMEDOUT) { + mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n", + mlx5_command_str(msg_to_opcode(ent->in)), +@@ -817,28 +817,26 @@ static int mlx5_cmd_invoke(struct mlx5_c + goto out_free; + } + +- if (!callback) { +- err = wait_func(dev, ent); +- if (err == -ETIMEDOUT) +- goto out; +- +- ds = ent->ts2 - ent->ts1; +- op = be16_to_cpu(((struct mlx5_inbox_hdr *)in->first.data)->opcode); +- if (op < ARRAY_SIZE(cmd->stats)) { +- stats = &cmd->stats[op]; +- spin_lock_irq(&stats->lock); +- stats->sum += ds; +- ++stats->n; +- spin_unlock_irq(&stats->lock); +- } +- mlx5_core_dbg_mask(dev, 1 << MLX5_CMD_TIME, +- "fw exec time for %s is %lld nsec\n", +- mlx5_command_str(op), ds); +- *status = ent->status; +- free_cmd(ent); +- } ++ if (callback) ++ goto out; + +- return err; ++ err = wait_func(dev, ent); ++ if (err == -ETIMEDOUT) ++ goto out_free; ++ ++ ds = ent->ts2 - ent->ts1; ++ op = be16_to_cpu(((struct mlx5_inbox_hdr *)in->first.data)->opcode); ++ if (op < ARRAY_SIZE(cmd->stats)) { ++ stats = &cmd->stats[op]; ++ spin_lock_irq(&stats->lock); ++ stats->sum += ds; ++ ++stats->n; ++ spin_unlock_irq(&stats->lock); ++ } ++ mlx5_core_dbg_mask(dev, 1 << MLX5_CMD_TIME, ++ "fw exec time for %s is %lld nsec\n", ++ mlx5_command_str(op), ds); ++ *status = ent->status; + + out_free: + free_cmd(ent); +@@ -1230,41 +1228,30 @@ err_dbg: + return err; + } + +-void mlx5_cmd_use_events(struct mlx5_core_dev *dev) ++static void mlx5_cmd_change_mod(struct mlx5_core_dev *dev, int mode) + { + struct mlx5_cmd *cmd = &dev->cmd; + int i; + + for (i = 0; i < cmd->max_reg_cmds; i++) + down(&cmd->sem); +- + down(&cmd->pages_sem); + +- flush_workqueue(cmd->wq); +- +- cmd->mode = CMD_MODE_EVENTS; ++ cmd->mode = mode; + + up(&cmd->pages_sem); + for (i = 0; i < cmd->max_reg_cmds; i++) + up(&cmd->sem); + } + +-void mlx5_cmd_use_polling(struct mlx5_core_dev *dev) ++void mlx5_cmd_use_events(struct mlx5_core_dev *dev) + { +- struct mlx5_cmd *cmd = &dev->cmd; +- int i; +- +- for (i = 0; i < cmd->max_reg_cmds; i++) +- down(&cmd->sem); +- +- down(&cmd->pages_sem); +- +- flush_workqueue(cmd->wq); +- cmd->mode = CMD_MODE_POLLING; ++ mlx5_cmd_change_mod(dev, CMD_MODE_EVENTS); ++} + +- up(&cmd->pages_sem); +- for (i = 0; i < cmd->max_reg_cmds; i++) +- up(&cmd->sem); ++void mlx5_cmd_use_polling(struct mlx5_core_dev *dev) ++{ ++ mlx5_cmd_change_mod(dev, CMD_MODE_POLLING); + } + + static void free_msg(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *msg) diff --git a/queue-4.4/net-mlx5-fix-the-size-of-modify-qp-mailbox.patch b/queue-4.4/net-mlx5-fix-the-size-of-modify-qp-mailbox.patch new file mode 100644 index 00000000000..64d5cc7041c --- /dev/null +++ b/queue-4.4/net-mlx5-fix-the-size-of-modify-qp-mailbox.patch @@ -0,0 +1,32 @@ +From 418f8399a8bedf376ec13eb01088f04a76ebdd6f Mon Sep 17 00:00:00 2001 +From: Majd Dibbiny +Date: Fri, 10 Jun 2016 00:07:28 +0300 +Subject: net/mlx5: Fix the size of modify QP mailbox + +From: Majd Dibbiny + +commit 418f8399a8bedf376ec13eb01088f04a76ebdd6f upstream. + +Add 16 reserved bytes at the end of mlx5_modify_qp_mbox_in to +match the hardware spec definition. + +Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters') +Signed-off-by: Majd Dibbiny +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/mlx5/qp.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/linux/mlx5/qp.h ++++ b/include/linux/mlx5/qp.h +@@ -539,6 +539,7 @@ struct mlx5_modify_qp_mbox_in { + __be32 optparam; + u8 rsvd1[4]; + struct mlx5_qp_context ctx; ++ u8 rsvd2[16]; + }; + + struct mlx5_modify_qp_mbox_out { diff --git a/queue-4.4/net-mlx5-fix-wait_vital-for-vfs-and-remove-fixed-sleep.patch b/queue-4.4/net-mlx5-fix-wait_vital-for-vfs-and-remove-fixed-sleep.patch new file mode 100644 index 00000000000..0f8f8c536d2 --- /dev/null +++ b/queue-4.4/net-mlx5-fix-wait_vital-for-vfs-and-remove-fixed-sleep.patch @@ -0,0 +1,99 @@ +From d57847dc4177c6fd8d950cb533f5edf0eab45b11 Mon Sep 17 00:00:00 2001 +From: Daniel Jurgens +Date: Thu, 30 Jun 2016 17:34:41 +0300 +Subject: net/mlx5: Fix wait_vital for VFs and remove fixed sleep + +From: Daniel Jurgens + +commit d57847dc4177c6fd8d950cb533f5edf0eab45b11 upstream. + +The device ID for VFs is in a different location than PFs. This results +in the poll always timing out for VFs. There's no good way to read the +VF device ID without using the PF's configuration space. Switch to waiting +for the health poll to start incrementing. Also remove the 1s sleep +at the beginning. + +fixes: 89d44f0a6c73 ('net/mlx5_core: Add pci error handlers to mlx5_core +driver') +Signed-off-by: Daniel Jurgens +Signed-off-by: Greg Kroah-Hartman + +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller + +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 41 +++++++++---------------- + 1 file changed, 15 insertions(+), 26 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1306,46 +1306,31 @@ void mlx5_disable_device(struct mlx5_cor + mlx5_pci_err_detected(dev->pdev, 0); + } + +-/* wait for the device to show vital signs. For now we check +- * that we can read the device ID and that the health buffer +- * shows a non zero value which is different than 0xffffffff ++/* wait for the device to show vital signs by waiting ++ * for the health counter to start counting. + */ +-static void wait_vital(struct pci_dev *pdev) ++static int wait_vital(struct pci_dev *pdev) + { + struct mlx5_core_dev *dev = pci_get_drvdata(pdev); + struct mlx5_core_health *health = &dev->priv.health; + const int niter = 100; ++ u32 last_count = 0; + u32 count; +- u16 did; + int i; + +- /* Wait for firmware to be ready after reset */ +- msleep(1000); +- for (i = 0; i < niter; i++) { +- if (pci_read_config_word(pdev, 2, &did)) { +- dev_warn(&pdev->dev, "failed reading config word\n"); +- break; +- } +- if (did == pdev->device) { +- dev_info(&pdev->dev, "device ID correctly read after %d iterations\n", i); +- break; +- } +- msleep(50); +- } +- if (i == niter) +- dev_warn(&pdev->dev, "%s-%d: could not read device ID\n", __func__, __LINE__); +- + for (i = 0; i < niter; i++) { + count = ioread32be(health->health_counter); + if (count && count != 0xffffffff) { +- dev_info(&pdev->dev, "Counter value 0x%x after %d iterations\n", count, i); +- break; ++ if (last_count && last_count != count) { ++ dev_info(&pdev->dev, "Counter value 0x%x after %d iterations\n", count, i); ++ return 0; ++ } ++ last_count = count; + } + msleep(50); + } + +- if (i == niter) +- dev_warn(&pdev->dev, "%s-%d: could not read device ID\n", __func__, __LINE__); ++ return -ETIMEDOUT; + } + + static void mlx5_pci_resume(struct pci_dev *pdev) +@@ -1357,7 +1342,11 @@ static void mlx5_pci_resume(struct pci_d + dev_info(&pdev->dev, "%s was called\n", __func__); + + pci_save_state(pdev); +- wait_vital(pdev); ++ err = wait_vital(pdev); ++ if (err) { ++ dev_err(&pdev->dev, "%s: wait_vital timed out\n", __func__); ++ return; ++ } + + err = mlx5_load_one(dev, priv); + if (err) diff --git a/queue-4.4/net-mlx5-make-command-timeout-way-shorter.patch b/queue-4.4/net-mlx5-make-command-timeout-way-shorter.patch new file mode 100644 index 00000000000..f682d0b8c3a --- /dev/null +++ b/queue-4.4/net-mlx5-make-command-timeout-way-shorter.patch @@ -0,0 +1,35 @@ +From 6b6c07bdcdc97ccac2596063bfc32a5faddfe884 Mon Sep 17 00:00:00 2001 +From: Or Gerlitz +Date: Wed, 2 Mar 2016 00:13:39 +0200 +Subject: net/mlx5: Make command timeout way shorter + +From: Or Gerlitz + +commit 6b6c07bdcdc97ccac2596063bfc32a5faddfe884 upstream. + +The command timeout is terribly long, whole two hours. Make it 60s so if +things do go wrong, the user gets feedback in relatively short time, so +they can take corrective actions and/or investigate using tools and such. + +Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters') +Signed-off-by: Or Gerlitz +Signed-off-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/mlx5/driver.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -54,7 +54,7 @@ enum { + /* one minute for the sake of bringup. Generally, commands must always + * complete and we may need to increase this timeout value + */ +- MLX5_CMD_TIMEOUT_MSEC = 7200 * 1000, ++ MLX5_CMD_TIMEOUT_MSEC = 60 * 1000, + MLX5_CMD_WQ_MAX_NAME = 32, + }; + diff --git a/queue-4.4/net-mlx5-use-mlx5_buf_alloc_node-instead-of-mlx5_buf_alloc-in-mlx5_wq_ll_create.patch b/queue-4.4/net-mlx5-use-mlx5_buf_alloc_node-instead-of-mlx5_buf_alloc-in-mlx5_wq_ll_create.patch new file mode 100644 index 00000000000..134ddd70920 --- /dev/null +++ b/queue-4.4/net-mlx5-use-mlx5_buf_alloc_node-instead-of-mlx5_buf_alloc-in-mlx5_wq_ll_create.patch @@ -0,0 +1,81 @@ +From f299a02d5f13c4deb52c1a7ddf2b42630fe6294a Mon Sep 17 00:00:00 2001 +From: Wang Sheng-Hui +Date: Fri, 24 Jun 2016 08:52:11 +0800 +Subject: net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create + +From: Wang Sheng-Hui + +commit f299a02d5f13c4deb52c1a7ddf2b42630fe6294a upstream. + +Commit 311c7c71c9bb ("net/mlx5e: Allocate DMA coherent memory on +reader NUMA node") introduced mlx5_*_alloc_node() but missed changing +some calling and warn messages. This patch introduces 2 changes: + * Use mlx5_buf_alloc_node() instead of mlx5_buf_alloc() in + mlx5_wq_ll_create() + * Update the failure warn messages with _node postfix for + mlx5_*_alloc function names + +Fixes: 311c7c71c9bb ("net/mlx5e: Allocate DMA coherent memory on reader NUMA node") +Signed-off-by: Wang Sheng-Hui +Acked-By: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlx5/core/wq.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c +@@ -75,14 +75,14 @@ int mlx5_wq_cyc_create(struct mlx5_core_ + + err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node); + if (err) { +- mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err); ++ mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err); + return err; + } + + err = mlx5_buf_alloc_node(mdev, mlx5_wq_cyc_get_byte_size(wq), + &wq_ctrl->buf, param->buf_numa_node); + if (err) { +- mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err); ++ mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err); + goto err_db_free; + } + +@@ -111,14 +111,14 @@ int mlx5_cqwq_create(struct mlx5_core_de + + err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node); + if (err) { +- mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err); ++ mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err); + return err; + } + + err = mlx5_buf_alloc_node(mdev, mlx5_cqwq_get_byte_size(wq), + &wq_ctrl->buf, param->buf_numa_node); + if (err) { +- mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err); ++ mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err); + goto err_db_free; + } + +@@ -148,13 +148,14 @@ int mlx5_wq_ll_create(struct mlx5_core_d + + err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node); + if (err) { +- mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err); ++ mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err); + return err; + } + +- err = mlx5_buf_alloc(mdev, mlx5_wq_ll_get_byte_size(wq), &wq_ctrl->buf); ++ err = mlx5_buf_alloc_node(mdev, mlx5_wq_ll_get_byte_size(wq), ++ &wq_ctrl->buf, param->buf_numa_node); + if (err) { +- mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err); ++ mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err); + goto err_db_free; + } + diff --git a/queue-4.4/net-mlx5e-copy-all-l2-headers-into-inline-segment.patch b/queue-4.4/net-mlx5e-copy-all-l2-headers-into-inline-segment.patch new file mode 100644 index 00000000000..b791260d932 --- /dev/null +++ b/queue-4.4/net-mlx5e-copy-all-l2-headers-into-inline-segment.patch @@ -0,0 +1,44 @@ +From e3a19b53cbb0e6738b7a547f262179065b72e3fa Mon Sep 17 00:00:00 2001 +From: Matthew Finlay +Date: Thu, 30 Jun 2016 17:34:47 +0300 +Subject: net/mlx5e: Copy all L2 headers into inline segment + +From: Matthew Finlay + +commit e3a19b53cbb0e6738b7a547f262179065b72e3fa upstream. + +ConnectX4-Lx uses an inline wqe mode that currently defaults to +requiring the entire L2 header be included in the wqe. +This patch fixes mlx5e_get_inline_hdr_size() to account for +all L2 headers (VLAN, QinQ, etc) using skb_network_offset(skb). + +Fixes: e586b3b0baee ("net/mlx5: Ethernet Datapath files") +Signed-off-by: Matthew Finlay +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +@@ -124,7 +124,7 @@ static inline u16 mlx5e_get_inline_hdr_s + * headers and occur before the data gather. + * Therefore these headers must be copied into the WQE + */ +-#define MLX5E_MIN_INLINE ETH_HLEN ++#define MLX5E_MIN_INLINE (ETH_HLEN + VLAN_HLEN) + + if (bf) { + u16 ihs = skb_headlen(skb); +@@ -136,7 +136,7 @@ static inline u16 mlx5e_get_inline_hdr_s + return skb_headlen(skb); + } + +- return MLX5E_MIN_INLINE; ++ return max(skb_network_offset(skb), MLX5E_MIN_INLINE); + } + + static inline void mlx5e_insert_vlan(void *start, struct sk_buff *skb, u16 ihs) diff --git a/queue-4.4/net-mlx5e-fix-blue-flame-quota-logic.patch b/queue-4.4/net-mlx5e-fix-blue-flame-quota-logic.patch new file mode 100644 index 00000000000..6780b388385 --- /dev/null +++ b/queue-4.4/net-mlx5e-fix-blue-flame-quota-logic.patch @@ -0,0 +1,45 @@ +From 0ca00fc1f808602137dc6d51f17747b3bb0fc34d Mon Sep 17 00:00:00 2001 +From: Eli Cohen +Date: Fri, 10 Jun 2016 00:07:40 +0300 +Subject: net/mlx5e: Fix blue flame quota logic + +From: Eli Cohen + +commit 0ca00fc1f808602137dc6d51f17747b3bb0fc34d upstream. + +Blue flame is a latency enhancement feature that allows the driver to +write the packet data directly to the NIC's registers thus making the +read of the packet data from host memory redundant. + +We maintain a quota for the blue flame which is reloaded whenever we +identify that the hardware is processing send requests and processes +them fast enough so by the time we post the next send request it was +able to process all the pending ones. This indicates that the hardware +is capable of processing more blue flame requests efficiently. The blue +flame quota is decremented whenever we send using blue flame. + +The current code erroneously clears the budget if we did not use blue +flame for the current post send operation and we fix it here. + +Fixes: 88a85f99e51f ('net/mlx5e: TX latency optimization to save DMA reads') +Signed-off-by: Eli Cohen +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +@@ -290,7 +290,8 @@ static netdev_tx_t mlx5e_sq_xmit(struct + while ((sq->pc & wq->sz_m1) > sq->edge) + mlx5e_send_nop(sq, false); + +- sq->bf_budget = bf ? sq->bf_budget - 1 : 0; ++ if (bf) ++ sq->bf_budget--; + + sq->stats.packets++; + return NETDEV_TX_OK; diff --git a/queue-4.4/net-mlx5e-fix-mlx5e_100base_t-define.patch b/queue-4.4/net-mlx5e-fix-mlx5e_100base_t-define.patch new file mode 100644 index 00000000000..3a600e2694d --- /dev/null +++ b/queue-4.4/net-mlx5e-fix-mlx5e_100base_t-define.patch @@ -0,0 +1,52 @@ +From 6e4c21894673baabdbef03c3ac2458a28246128b Mon Sep 17 00:00:00 2001 +From: Rana Shahout +Date: Fri, 22 Apr 2016 00:33:01 +0300 +Subject: net/mlx5e: Fix MLX5E_100BASE_T define + +From: Rana Shahout + +commit 6e4c21894673baabdbef03c3ac2458a28246128b upstream. + +Bit 25 of eth_proto_capability in PTYS register is +1000Base-TT and not 100Base-T. + +Fixes: f62b8bb8f2d3 ('net/mlx5: Extend mlx5_core to +support ConnectX-4 Ethernet functionality') +Signed-off-by: Rana Shahout +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- + drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 8 ++++---- + 2 files changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -543,7 +543,7 @@ enum mlx5e_link_mode { + MLX5E_100GBASE_KR4 = 22, + MLX5E_100GBASE_LR4 = 23, + MLX5E_100BASE_TX = 24, +- MLX5E_100BASE_T = 25, ++ MLX5E_1000BASE_T = 25, + MLX5E_10GBASE_T = 26, + MLX5E_25GBASE_CR = 27, + MLX5E_25GBASE_KR = 28, +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -138,10 +138,10 @@ static const struct { + [MLX5E_100BASE_TX] = { + .speed = 100, + }, +- [MLX5E_100BASE_T] = { +- .supported = SUPPORTED_100baseT_Full, +- .advertised = ADVERTISED_100baseT_Full, +- .speed = 100, ++ [MLX5E_1000BASE_T] = { ++ .supported = SUPPORTED_1000baseT_Full, ++ .advertised = ADVERTISED_1000baseT_Full, ++ .speed = 1000, + }, + [MLX5E_10GBASE_T] = { + .supported = SUPPORTED_10000baseT_Full, diff --git a/queue-4.4/net_sched-keep-backlog-updated-with-qlen.patch b/queue-4.4/net_sched-keep-backlog-updated-with-qlen.patch new file mode 100644 index 00000000000..b2513b8ed40 --- /dev/null +++ b/queue-4.4/net_sched-keep-backlog-updated-with-qlen.patch @@ -0,0 +1,67 @@ +From a27758ffaf96f89002129eedb2cc172d254099f8 Mon Sep 17 00:00:00 2001 +From: WANG Cong +Date: Fri, 3 Jun 2016 15:05:57 -0700 +Subject: net_sched: keep backlog updated with qlen + +From: WANG Cong + +commit a27758ffaf96f89002129eedb2cc172d254099f8 upstream. + +For gso_skb we only update qlen, backlog should be updated too. + +Note, it is correct to just update these stats at one layer, +because the gso_skb is cached there. + +Reported-by: Stas Nichiporovich +Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too") +Cc: Jamal Hadi Salim +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/sch_generic.h | 5 ++++- + net/sched/sch_generic.c | 2 ++ + 2 files changed, 6 insertions(+), 1 deletion(-) + +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -674,9 +674,11 @@ static inline struct sk_buff *qdisc_peek + /* we can reuse ->gso_skb because peek isn't called for root qdiscs */ + if (!sch->gso_skb) { + sch->gso_skb = sch->dequeue(sch); +- if (sch->gso_skb) ++ if (sch->gso_skb) { + /* it's still part of the queue */ ++ qdisc_qstats_backlog_inc(sch, sch->gso_skb); + sch->q.qlen++; ++ } + } + + return sch->gso_skb; +@@ -689,6 +691,7 @@ static inline struct sk_buff *qdisc_dequ + + if (skb) { + sch->gso_skb = NULL; ++ qdisc_qstats_backlog_dec(sch, skb); + sch->q.qlen--; + } else { + skb = sch->dequeue(sch); +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -49,6 +49,7 @@ static inline int dev_requeue_skb(struct + { + q->gso_skb = skb; + q->qstats.requeues++; ++ qdisc_qstats_backlog_inc(q, skb); + q->q.qlen++; /* it's still part of the queue */ + __netif_schedule(q); + +@@ -92,6 +93,7 @@ static struct sk_buff *dequeue_skb(struc + txq = skb_get_tx_queue(txq->dev, skb); + if (!netif_xmit_frozen_or_stopped(txq)) { + q->gso_skb = NULL; ++ qdisc_qstats_backlog_dec(q, skb); + q->q.qlen--; + } else + skb = NULL; diff --git a/queue-4.4/phy-fix-device-reference-leaks.patch b/queue-4.4/phy-fix-device-reference-leaks.patch new file mode 100644 index 00000000000..ab3845e7eb2 --- /dev/null +++ b/queue-4.4/phy-fix-device-reference-leaks.patch @@ -0,0 +1,43 @@ +From 17ae1c650c1ecf8dc8e16d54b0f68a345965f43f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 3 Nov 2016 18:40:19 +0100 +Subject: phy: fix device reference leaks + +From: Johan Hovold + +commit 17ae1c650c1ecf8dc8e16d54b0f68a345965f43f upstream. + +Make sure to drop the reference taken by bus_find_device_by_name() +before returning from phy_connect() and phy_attach(). + +Note that both function still take a reference to the phy device +through phy_attach_direct(). + +Fixes: e13934563db0 ("[PATCH] PHY Layer fixup") +Cc: Florian Fainelli +Signed-off-by: Johan Hovold +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/phy/phy_device.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -522,6 +522,7 @@ struct phy_device *phy_connect(struct ne + phydev = to_phy_device(d); + + rc = phy_connect_direct(dev, phydev, handler, interface); ++ put_device(d); + if (rc) + return ERR_PTR(rc); + +@@ -721,6 +722,7 @@ struct phy_device *phy_attach(struct net + phydev = to_phy_device(d); + + rc = phy_attach_direct(dev, phydev, phydev->dev_flags, interface); ++ put_device(d); + if (rc) + return ERR_PTR(rc); + diff --git a/queue-4.4/sch_drr-update-backlog-as-well.patch b/queue-4.4/sch_drr-update-backlog-as-well.patch new file mode 100644 index 00000000000..65e186d7eb3 --- /dev/null +++ b/queue-4.4/sch_drr-update-backlog-as-well.patch @@ -0,0 +1,53 @@ +From 6a73b571b63075ef408c83f07c2565b5652f93cc Mon Sep 17 00:00:00 2001 +From: WANG Cong +Date: Wed, 1 Jun 2016 16:15:17 -0700 +Subject: sch_drr: update backlog as well + +From: WANG Cong + +commit 6a73b571b63075ef408c83f07c2565b5652f93cc upstream. + +Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too") +Cc: Jamal Hadi Salim +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/sch_drr.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/sched/sch_drr.c ++++ b/net/sched/sch_drr.c +@@ -375,6 +375,7 @@ static int drr_enqueue(struct sk_buff *s + cl->deficit = cl->quantum; + } + ++ qdisc_qstats_backlog_inc(sch, skb); + sch->q.qlen++; + return err; + } +@@ -405,6 +406,7 @@ static struct sk_buff *drr_dequeue(struc + + bstats_update(&cl->bstats, skb); + qdisc_bstats_update(sch, skb); ++ qdisc_qstats_backlog_dec(sch, skb); + sch->q.qlen--; + return skb; + } +@@ -426,6 +428,7 @@ static unsigned int drr_drop(struct Qdis + if (cl->qdisc->ops->drop) { + len = cl->qdisc->ops->drop(cl->qdisc); + if (len > 0) { ++ sch->qstats.backlog -= len; + sch->q.qlen--; + if (cl->qdisc->q.qlen == 0) + list_del(&cl->alist); +@@ -461,6 +464,7 @@ static void drr_reset_qdisc(struct Qdisc + qdisc_reset(cl->qdisc); + } + } ++ sch->qstats.backlog = 0; + sch->q.qlen = 0; + } + diff --git a/queue-4.4/sch_hfsc-always-keep-backlog-updated.patch b/queue-4.4/sch_hfsc-always-keep-backlog-updated.patch new file mode 100644 index 00000000000..3759869fd2d --- /dev/null +++ b/queue-4.4/sch_hfsc-always-keep-backlog-updated.patch @@ -0,0 +1,74 @@ +From 357cc9b4a8a7a0cd0e662537b76e6fa4670b6798 Mon Sep 17 00:00:00 2001 +From: WANG Cong +Date: Wed, 1 Jun 2016 16:15:15 -0700 +Subject: sch_hfsc: always keep backlog updated + +From: WANG Cong + +commit 357cc9b4a8a7a0cd0e662537b76e6fa4670b6798 upstream. + +hfsc updates backlog lazily, that is only when we +dump the stats. This is problematic after we begin to +update backlog in qdisc_tree_reduce_backlog(). + +Reported-by: Stas Nichiporovich +Tested-by: Stas Nichiporovich +Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too") +Cc: Jamal Hadi Salim +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/sch_hfsc.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +--- a/net/sched/sch_hfsc.c ++++ b/net/sched/sch_hfsc.c +@@ -1529,6 +1529,7 @@ hfsc_reset_qdisc(struct Qdisc *sch) + q->eligible = RB_ROOT; + INIT_LIST_HEAD(&q->droplist); + qdisc_watchdog_cancel(&q->watchdog); ++ sch->qstats.backlog = 0; + sch->q.qlen = 0; + } + +@@ -1559,14 +1560,6 @@ hfsc_dump_qdisc(struct Qdisc *sch, struc + struct hfsc_sched *q = qdisc_priv(sch); + unsigned char *b = skb_tail_pointer(skb); + struct tc_hfsc_qopt qopt; +- struct hfsc_class *cl; +- unsigned int i; +- +- sch->qstats.backlog = 0; +- for (i = 0; i < q->clhash.hashsize; i++) { +- hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode) +- sch->qstats.backlog += cl->qdisc->qstats.backlog; +- } + + qopt.defcls = q->defcls; + if (nla_put(skb, TCA_OPTIONS, sizeof(qopt), &qopt)) +@@ -1604,6 +1597,7 @@ hfsc_enqueue(struct sk_buff *skb, struct + if (cl->qdisc->q.qlen == 1) + set_active(cl, qdisc_pkt_len(skb)); + ++ qdisc_qstats_backlog_inc(sch, skb); + sch->q.qlen++; + + return NET_XMIT_SUCCESS; +@@ -1672,6 +1666,7 @@ hfsc_dequeue(struct Qdisc *sch) + + qdisc_unthrottled(sch); + qdisc_bstats_update(sch, skb); ++ qdisc_qstats_backlog_dec(sch, skb); + sch->q.qlen--; + + return skb; +@@ -1695,6 +1690,7 @@ hfsc_drop(struct Qdisc *sch) + } + cl->qstats.drops++; + qdisc_qstats_drop(sch); ++ sch->qstats.backlog -= len; + sch->q.qlen--; + return len; + } diff --git a/queue-4.4/sch_prio-update-backlog-as-well.patch b/queue-4.4/sch_prio-update-backlog-as-well.patch new file mode 100644 index 00000000000..82859ee789c --- /dev/null +++ b/queue-4.4/sch_prio-update-backlog-as-well.patch @@ -0,0 +1,59 @@ +From 6529d75ad9228f4d8a8f6c5c5244ceb945ac9bc2 Mon Sep 17 00:00:00 2001 +From: WANG Cong +Date: Wed, 1 Jun 2016 16:15:16 -0700 +Subject: sch_prio: update backlog as well + +From: WANG Cong + +commit 6529d75ad9228f4d8a8f6c5c5244ceb945ac9bc2 upstream. + +We need to update backlog too when we update qlen. + +Joint work with Stas. + +Reported-by: Stas Nichiporovich +Tested-by: Stas Nichiporovich +Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too") +Cc: Jamal Hadi Salim +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/sch_prio.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/sched/sch_prio.c ++++ b/net/sched/sch_prio.c +@@ -85,6 +85,7 @@ prio_enqueue(struct sk_buff *skb, struct + + ret = qdisc_enqueue(skb, qdisc); + if (ret == NET_XMIT_SUCCESS) { ++ qdisc_qstats_backlog_inc(sch, skb); + sch->q.qlen++; + return NET_XMIT_SUCCESS; + } +@@ -117,6 +118,7 @@ static struct sk_buff *prio_dequeue(stru + struct sk_buff *skb = qdisc_dequeue_peeked(qdisc); + if (skb) { + qdisc_bstats_update(sch, skb); ++ qdisc_qstats_backlog_dec(sch, skb); + sch->q.qlen--; + return skb; + } +@@ -135,6 +137,7 @@ static unsigned int prio_drop(struct Qdi + for (prio = q->bands-1; prio >= 0; prio--) { + qdisc = q->queues[prio]; + if (qdisc->ops->drop && (len = qdisc->ops->drop(qdisc)) != 0) { ++ sch->qstats.backlog -= len; + sch->q.qlen--; + return len; + } +@@ -151,6 +154,7 @@ prio_reset(struct Qdisc *sch) + + for (prio = 0; prio < q->bands; prio++) + qdisc_reset(q->queues[prio]); ++ sch->qstats.backlog = 0; + sch->q.qlen = 0; + } + diff --git a/queue-4.4/sch_qfq-keep-backlog-updated-with-qlen.patch b/queue-4.4/sch_qfq-keep-backlog-updated-with-qlen.patch new file mode 100644 index 00000000000..29249b71427 --- /dev/null +++ b/queue-4.4/sch_qfq-keep-backlog-updated-with-qlen.patch @@ -0,0 +1,47 @@ +From 2ed5c3f09627f72a2e0e407a86b2ac05494190f9 Mon Sep 17 00:00:00 2001 +From: WANG Cong +Date: Sun, 18 Sep 2016 16:22:47 -0700 +Subject: sch_qfq: keep backlog updated with qlen + +From: WANG Cong + +commit 2ed5c3f09627f72a2e0e407a86b2ac05494190f9 upstream. + +Reported-by: Stas Nichiporovich +Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too") +Cc: Jamal Hadi Salim +Signed-off-by: Cong Wang +Acked-by: Jamal Hadi Salim +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/sch_qfq.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/sched/sch_qfq.c ++++ b/net/sched/sch_qfq.c +@@ -1150,6 +1150,7 @@ static struct sk_buff *qfq_dequeue(struc + if (!skb) + return NULL; + ++ qdisc_qstats_backlog_dec(sch, skb); + sch->q.qlen--; + qdisc_bstats_update(sch, skb); + +@@ -1250,6 +1251,7 @@ static int qfq_enqueue(struct sk_buff *s + } + + bstats_update(&cl->bstats, skb); ++ qdisc_qstats_backlog_inc(sch, skb); + ++sch->q.qlen; + + agg = cl->agg; +@@ -1516,6 +1518,7 @@ static void qfq_reset_qdisc(struct Qdisc + qdisc_reset(cl->qdisc); + } + } ++ sch->qstats.backlog = 0; + sch->q.qlen = 0; + } + diff --git a/queue-4.4/sch_sfb-keep-backlog-updated-with-qlen.patch b/queue-4.4/sch_sfb-keep-backlog-updated-with-qlen.patch new file mode 100644 index 00000000000..c6b41339fde --- /dev/null +++ b/queue-4.4/sch_sfb-keep-backlog-updated-with-qlen.patch @@ -0,0 +1,46 @@ +From 3d4357fba82b3cf19ebf0a04d1c9cb086af15d02 Mon Sep 17 00:00:00 2001 +From: WANG Cong +Date: Sun, 18 Sep 2016 16:22:48 -0700 +Subject: sch_sfb: keep backlog updated with qlen + +From: WANG Cong + +commit 3d4357fba82b3cf19ebf0a04d1c9cb086af15d02 upstream. + +Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too") +Cc: Jamal Hadi Salim +Signed-off-by: Cong Wang +Acked-by: Jamal Hadi Salim +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/sch_sfb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/sched/sch_sfb.c ++++ b/net/sched/sch_sfb.c +@@ -400,6 +400,7 @@ static int sfb_enqueue(struct sk_buff *s + enqueue: + ret = qdisc_enqueue(skb, child); + if (likely(ret == NET_XMIT_SUCCESS)) { ++ qdisc_qstats_backlog_inc(sch, skb); + sch->q.qlen++; + increment_qlen(skb, q); + } else if (net_xmit_drop_count(ret)) { +@@ -428,6 +429,7 @@ static struct sk_buff *sfb_dequeue(struc + + if (skb) { + qdisc_bstats_update(sch, skb); ++ qdisc_qstats_backlog_dec(sch, skb); + sch->q.qlen--; + decrement_qlen(skb, q); + } +@@ -450,6 +452,7 @@ static void sfb_reset(struct Qdisc *sch) + struct sfb_sched_data *q = qdisc_priv(sch); + + qdisc_reset(q->qdisc); ++ sch->qstats.backlog = 0; + sch->q.qlen = 0; + q->slot = 0; + q->double_buffering = false; diff --git a/queue-4.4/sch_tbf-update-backlog-as-well.patch b/queue-4.4/sch_tbf-update-backlog-as-well.patch new file mode 100644 index 00000000000..e59380bd8c5 --- /dev/null +++ b/queue-4.4/sch_tbf-update-backlog-as-well.patch @@ -0,0 +1,53 @@ +From 8d5958f424b62060a8696b12c17dad198d5d386f Mon Sep 17 00:00:00 2001 +From: WANG Cong +Date: Wed, 1 Jun 2016 16:15:19 -0700 +Subject: sch_tbf: update backlog as well + +From: WANG Cong + +commit 8d5958f424b62060a8696b12c17dad198d5d386f upstream. + +Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too") +Cc: Jamal Hadi Salim +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/sch_tbf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/sched/sch_tbf.c ++++ b/net/sched/sch_tbf.c +@@ -197,6 +197,7 @@ static int tbf_enqueue(struct sk_buff *s + return ret; + } + ++ qdisc_qstats_backlog_inc(sch, skb); + sch->q.qlen++; + return NET_XMIT_SUCCESS; + } +@@ -207,6 +208,7 @@ static unsigned int tbf_drop(struct Qdis + unsigned int len = 0; + + if (q->qdisc->ops->drop && (len = q->qdisc->ops->drop(q->qdisc)) != 0) { ++ sch->qstats.backlog -= len; + sch->q.qlen--; + qdisc_qstats_drop(sch); + } +@@ -253,6 +255,7 @@ static struct sk_buff *tbf_dequeue(struc + q->t_c = now; + q->tokens = toks; + q->ptokens = ptoks; ++ qdisc_qstats_backlog_dec(sch, skb); + sch->q.qlen--; + qdisc_unthrottled(sch); + qdisc_bstats_update(sch, skb); +@@ -284,6 +287,7 @@ static void tbf_reset(struct Qdisc *sch) + struct tbf_sched_data *q = qdisc_priv(sch); + + qdisc_reset(q->qdisc); ++ sch->qstats.backlog = 0; + sch->q.qlen = 0; + q->t_c = ktime_get_ns(); + q->tokens = q->buffer; diff --git a/queue-4.4/series b/queue-4.4/series index 60f9e167055..ad33d563c7d 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -67,3 +67,33 @@ ib-mlx4-initialize-hop_limit-when-creating-address-handle.patch ovs-gre-geneve-fix-error-path-when-creating-an-iface.patch gre-disable-segmentation-offloads-w-csum-and-we-are-encapsulated-via-fou.patch powerpc-pci-of-parse-unassigned-resources.patch +firmware-actually-return-null-on-failed-request_firmware_nowait.patch +c8sectpfe-rework-firmware-loading-mechanism.patch +net-mlx5-avoid-passing-dma-address-0-to-firmware.patch +ib-mlx5-fix-rc-transport-send-queue-overhead-computation.patch +net-mlx5-make-command-timeout-way-shorter.patch +ib-mlx5-fix-fw-version-diaplay-in-sysfs.patch +net-mlx5e-fix-mlx5e_100base_t-define.patch +net-mlx5-fix-the-size-of-modify-qp-mailbox.patch +net-mlx5-fix-masking-of-reserved-bits-in-xrcd-number.patch +net-mlx5e-fix-blue-flame-quota-logic.patch +net-mlx5-use-mlx5_buf_alloc_node-instead-of-mlx5_buf_alloc-in-mlx5_wq_ll_create.patch +net-mlx5-avoid-calling-sleeping-function-by-the-health-poll-thread.patch +net-mlx5-fix-wait_vital-for-vfs-and-remove-fixed-sleep.patch +net-mlx5-fix-potential-deadlock-in-command-mode-change.patch +net-mlx5-add-timeout-handle-to-commands-with-callback.patch +net-mlx5-fix-pci-error-recovery-flow.patch +net-mlx5e-copy-all-l2-headers-into-inline-segment.patch +net_sched-keep-backlog-updated-with-qlen.patch +sch_drr-update-backlog-as-well.patch +sch_hfsc-always-keep-backlog-updated.patch +sch_prio-update-backlog-as-well.patch +sch_qfq-keep-backlog-updated-with-qlen.patch +sch_sfb-keep-backlog-updated-with-qlen.patch +sch_tbf-update-backlog-as-well.patch +btrfs-cleaner_kthread-doesn-t-need-explicit-freeze.patch +irda-free-skb-on-irda_accept-error-path.patch +phy-fix-device-reference-leaks.patch +bonding-prevent-out-of-bound-accesses.patch +mtd-nand-fix-onfi-parameter-page-layout.patch +ath10k-free-cached-fw-bin-contents-when-get-board-id-fails.patch