From: Greg Kroah-Hartman Date: Thu, 15 Jun 2017 09:38:35 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v4.9.33~21 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c369ba3c9bed307b78d6ebcf1922cda3168054c2;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: arm-defconfigs-make-nf_ct_proto_sctp-and-nf_ct_proto_udplite-built-in.patch ipv6-addrconf-fix-generation-of-new-temporary-addresses.patch ipv6-fix-ipv6-packet-loss-in-scenarios-involving-roaming-snooping-switches.patch jump-label-pass-kbuild_cflags-when-checking-for-asm-goto-support.patch kasan-respect-proc-sys-kernel-traceoff_on_warning.patch kernel-ucount.c-mark-user_header-with-kmemleak_ignore.patch net-thunderx-fix-phy-autoneg-for-sgmii-qlm-mode.patch pm-runtime-avoid-false-positive-warnings-from-might_sleep_if.patch shmem-fix-sleeping-from-atomic-context.patch vfio-spapr_tce-set-window-when-adding-additional-groups-to-container.patch --- diff --git a/queue-4.9/arm-defconfigs-make-nf_ct_proto_sctp-and-nf_ct_proto_udplite-built-in.patch b/queue-4.9/arm-defconfigs-make-nf_ct_proto_sctp-and-nf_ct_proto_udplite-built-in.patch new file mode 100644 index 00000000000..cef6f5d703d --- /dev/null +++ b/queue-4.9/arm-defconfigs-make-nf_ct_proto_sctp-and-nf_ct_proto_udplite-built-in.patch @@ -0,0 +1,54 @@ +From foo@baz Thu Jun 15 11:38:13 CEST 2017 +From: Arnd Bergmann +Date: Tue, 23 May 2017 21:53:53 -0400 +Subject: ARM: defconfigs: make NF_CT_PROTO_SCTP and NF_CT_PROTO_UDPLITE built-in + +From: Arnd Bergmann + + +[ Upstream commit 5aff1d245e8cc1ab5c4517d916edaed9e3f7f973 ] + +The symbols can no longer be used as loadable modules, leading to a harmless Kconfig +warning: + +arch/arm/configs/imote2_defconfig:60:warning: symbol value 'm' invalid for NF_CT_PROTO_UDPLITE +arch/arm/configs/imote2_defconfig:59:warning: symbol value 'm' invalid for NF_CT_PROTO_SCTP +arch/arm/configs/ezx_defconfig:68:warning: symbol value 'm' invalid for NF_CT_PROTO_UDPLITE +arch/arm/configs/ezx_defconfig:67:warning: symbol value 'm' invalid for NF_CT_PROTO_SCTP + +Let's make them built-in. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/configs/ezx_defconfig | 4 ++-- + arch/arm/configs/imote2_defconfig | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/arm/configs/ezx_defconfig ++++ b/arch/arm/configs/ezx_defconfig +@@ -64,8 +64,8 @@ CONFIG_NETFILTER=y + CONFIG_NETFILTER_NETLINK_QUEUE=m + CONFIG_NF_CONNTRACK=m + CONFIG_NF_CONNTRACK_EVENTS=y +-CONFIG_NF_CT_PROTO_SCTP=m +-CONFIG_NF_CT_PROTO_UDPLITE=m ++CONFIG_NF_CT_PROTO_SCTP=y ++CONFIG_NF_CT_PROTO_UDPLITE=y + CONFIG_NF_CONNTRACK_AMANDA=m + CONFIG_NF_CONNTRACK_FTP=m + CONFIG_NF_CONNTRACK_H323=m +--- a/arch/arm/configs/imote2_defconfig ++++ b/arch/arm/configs/imote2_defconfig +@@ -56,8 +56,8 @@ CONFIG_NETFILTER=y + CONFIG_NETFILTER_NETLINK_QUEUE=m + CONFIG_NF_CONNTRACK=m + CONFIG_NF_CONNTRACK_EVENTS=y +-CONFIG_NF_CT_PROTO_SCTP=m +-CONFIG_NF_CT_PROTO_UDPLITE=m ++CONFIG_NF_CT_PROTO_SCTP=y ++CONFIG_NF_CT_PROTO_UDPLITE=y + CONFIG_NF_CONNTRACK_AMANDA=m + CONFIG_NF_CONNTRACK_FTP=m + CONFIG_NF_CONNTRACK_H323=m diff --git a/queue-4.9/ipv6-addrconf-fix-generation-of-new-temporary-addresses.patch b/queue-4.9/ipv6-addrconf-fix-generation-of-new-temporary-addresses.patch new file mode 100644 index 00000000000..bb7af418f38 --- /dev/null +++ b/queue-4.9/ipv6-addrconf-fix-generation-of-new-temporary-addresses.patch @@ -0,0 +1,50 @@ +From foo@baz Thu Jun 15 11:38:13 CEST 2017 +From: Marcus Huewe +Date: Tue, 23 May 2017 21:53:49 -0400 +Subject: ipv6: addrconf: fix generation of new temporary addresses + +From: Marcus Huewe + + +[ Upstream commit a11a7f71cac209c7c9cca66eb506e1ebb033a3b3 ] + +Under some circumstances it is possible that no new temporary addresses +will be generated. + +For instance, addrconf_prefix_rcv_add_addr() indirectly calls +ipv6_create_tempaddr(), which creates a tentative temporary address and +starts dad. Next, addrconf_prefix_rcv_add_addr() indirectly calls +addrconf_verify_rtnl(). Now, assume that the previously created temporary +address has the least preferred lifetime among all existing addresses and +is still tentative (that is, dad is still running). Hence, the next run of +addrconf_verify_rtnl() is performed when the preferred lifetime of the +temporary address ends. If dad succeeds before the next run, the temporary +address becomes deprecated during the next run, but no new temporary +address is generated. + +In order to fix this, schedule the next addrconf_verify_rtnl() run slightly +before the temporary address becomes deprecated, if dad succeeded. + +Signed-off-by: Marcus Huewe +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/addrconf.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -4004,6 +4004,12 @@ static void addrconf_dad_completed(struc + + if (bump_id) + rt_genid_bump_ipv6(dev_net(dev)); ++ ++ /* Make sure that a new temporary address will be created ++ * before this temporary address becomes deprecated. ++ */ ++ if (ifp->flags & IFA_F_TEMPORARY) ++ addrconf_verify_rtnl(); + } + + static void addrconf_dad_run(struct inet6_dev *idev) diff --git a/queue-4.9/ipv6-fix-ipv6-packet-loss-in-scenarios-involving-roaming-snooping-switches.patch b/queue-4.9/ipv6-fix-ipv6-packet-loss-in-scenarios-involving-roaming-snooping-switches.patch new file mode 100644 index 00000000000..8f201a88951 --- /dev/null +++ b/queue-4.9/ipv6-fix-ipv6-packet-loss-in-scenarios-involving-roaming-snooping-switches.patch @@ -0,0 +1,55 @@ +From foo@baz Thu Jun 15 11:38:13 CEST 2017 +From: Linus Lüssing +Date: Tue, 23 May 2017 21:53:52 -0400 +Subject: ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping switches + +From: Linus Lüssing + + +[ Upstream commit a088d1d73a4bcfd7bc482f8d08375b9b665dc3e5 ] + +When for instance a mobile Linux device roams from one access point to +another with both APs sharing the same broadcast domain and a +multicast snooping switch in between: + +1) (c) <~~~> (AP1) <--[SSW]--> (AP2) + +2) (AP1) <--[SSW]--> (AP2) <~~~> (c) + +Then currently IPv6 multicast packets will get lost for (c) until an +MLD Querier sends its next query message. The packet loss occurs +because upon roaming the Linux host so far stayed silent regarding +MLD and the snooping switch will therefore be unaware of the +multicast topology change for a while. + +This patch fixes this by always resending MLD reports when an interface +change happens, for instance from NO-CARRIER to CARRIER state. + +Signed-off-by: Linus Lüssing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/addrconf.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -3387,9 +3387,15 @@ static int addrconf_notify(struct notifi + } + + if (idev) { +- if (idev->if_flags & IF_READY) +- /* device is already configured. */ ++ if (idev->if_flags & IF_READY) { ++ /* device is already configured - ++ * but resend MLD reports, we might ++ * have roamed and need to update ++ * multicast snooping switches ++ */ ++ ipv6_mc_up(idev); + break; ++ } + idev->if_flags |= IF_READY; + } + diff --git a/queue-4.9/jump-label-pass-kbuild_cflags-when-checking-for-asm-goto-support.patch b/queue-4.9/jump-label-pass-kbuild_cflags-when-checking-for-asm-goto-support.patch new file mode 100644 index 00000000000..7b99dd0bf2a --- /dev/null +++ b/queue-4.9/jump-label-pass-kbuild_cflags-when-checking-for-asm-goto-support.patch @@ -0,0 +1,40 @@ +From foo@baz Thu Jun 15 11:38:13 CEST 2017 +From: David Lin +Date: Tue, 23 May 2017 21:53:55 -0400 +Subject: jump label: pass kbuild_cflags when checking for asm goto support + +From: David Lin + + +[ Upstream commit 35f860f9ba6aac56cc38e8b18916d833a83f1157 ] + +Some versions of ARM GCC compiler such as Android toolchain throws in a +'-fpic' flag by default. This causes the gcc-goto check script to fail +although some config would have '-fno-pic' flag in the KBUILD_CFLAGS. + +This patch passes the KBUILD_CFLAGS to the check script so that the +script does not rely on the default config from different compilers. + +Link: http://lkml.kernel.org/r/20170120234329.78868-1-dtwlin@google.com +Signed-off-by: David Lin +Acked-by: Steven Rostedt +Cc: Michal Marek +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Makefile ++++ b/Makefile +@@ -797,7 +797,7 @@ KBUILD_CFLAGS += $(call cc-option,-Wer + KBUILD_ARFLAGS := $(call ar-option,D) + + # check for 'asm goto' +-ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC)), y) ++ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y) + KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO + KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO + endif diff --git a/queue-4.9/kasan-respect-proc-sys-kernel-traceoff_on_warning.patch b/queue-4.9/kasan-respect-proc-sys-kernel-traceoff_on_warning.patch new file mode 100644 index 00000000000..2350de128c5 --- /dev/null +++ b/queue-4.9/kasan-respect-proc-sys-kernel-traceoff_on_warning.patch @@ -0,0 +1,49 @@ +From foo@baz Thu Jun 15 11:38:13 CEST 2017 +From: Peter Zijlstra +Date: Tue, 23 May 2017 21:53:57 -0400 +Subject: kasan: respect /proc/sys/kernel/traceoff_on_warning + +From: Peter Zijlstra + + +[ Upstream commit 4f40c6e5627ea73b4e7c615c59631f38cc880885 ] + +After much waiting I finally reproduced a KASAN issue, only to find my +trace-buffer empty of useful information because it got spooled out :/ + +Make kasan_report honour the /proc/sys/kernel/traceoff_on_warning +interface. + +Link: http://lkml.kernel.org/r/20170125164106.3514-1-aryabinin@virtuozzo.com +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Andrey Ryabinin +Acked-by: Alexander Potapenko +Cc: Dmitry Vyukov +Cc: Steven Rostedt +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + mm/kasan/report.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/mm/kasan/report.c ++++ b/mm/kasan/report.c +@@ -13,6 +13,7 @@ + * + */ + ++#include + #include + #include + #include +@@ -298,6 +299,8 @@ void kasan_report(unsigned long addr, si + if (likely(!kasan_report_enabled())) + return; + ++ disable_trace_on_warning(); ++ + info.access_addr = (void *)addr; + info.access_size = size; + info.is_write = is_write; diff --git a/queue-4.9/kernel-ucount.c-mark-user_header-with-kmemleak_ignore.patch b/queue-4.9/kernel-ucount.c-mark-user_header-with-kmemleak_ignore.patch new file mode 100644 index 00000000000..17ba2c4b5ea --- /dev/null +++ b/queue-4.9/kernel-ucount.c-mark-user_header-with-kmemleak_ignore.patch @@ -0,0 +1,64 @@ +From foo@baz Thu Jun 15 11:38:13 CEST 2017 +From: "Luis R. Rodriguez" +Date: Tue, 23 May 2017 21:53:47 -0400 +Subject: kernel/ucount.c: mark user_header with kmemleak_ignore() + +From: "Luis R. Rodriguez" + + +[ Upstream commit ed5bd7dc88edf4a4a9c67130742b1b59aa017a5f ] + +The user_header gets caught by kmemleak with the following splat as +missing a free: + + unreferenced object 0xffff99667a733d80 (size 96): + comm "swapper/0", pid 1, jiffies 4294892317 (age 62191.468s) + hex dump (first 32 bytes): + a0 b6 92 b4 ff ff ff ff 00 00 00 00 01 00 00 00 ................ + 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + kmemleak_alloc+0x4a/0xa0 + __kmalloc+0x144/0x260 + __register_sysctl_table+0x54/0x5e0 + register_sysctl+0x1b/0x20 + user_namespace_sysctl_init+0x17/0x34 + do_one_initcall+0x52/0x1a0 + kernel_init_freeable+0x173/0x200 + kernel_init+0xe/0x100 + ret_from_fork+0x2c/0x40 + +The BUG_ON()s are intended to crash so no need to clean up after +ourselves on error there. This is also a kernel/ subsys_init() we don't +need a respective exit call here as this is never modular, so just white +list it. + +Link: http://lkml.kernel.org/r/20170203211404.31458-1-mcgrof@kernel.org +Signed-off-by: Luis R. Rodriguez +Cc: Eric W. Biederman +Cc: Kees Cook +Cc: Nikolay Borisov +Cc: Serge Hallyn +Cc: Jan Kara +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/ucount.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/kernel/ucount.c ++++ b/kernel/ucount.c +@@ -231,11 +231,10 @@ static __init int user_namespace_sysctl_ + * properly. + */ + user_header = register_sysctl("user", empty); ++ kmemleak_ignore(user_header); + BUG_ON(!user_header); + BUG_ON(!setup_userns_sysctls(&init_user_ns)); + #endif + return 0; + } + subsys_initcall(user_namespace_sysctl_init); +- +- diff --git a/queue-4.9/net-thunderx-fix-phy-autoneg-for-sgmii-qlm-mode.patch b/queue-4.9/net-thunderx-fix-phy-autoneg-for-sgmii-qlm-mode.patch new file mode 100644 index 00000000000..d367a4da0dd --- /dev/null +++ b/queue-4.9/net-thunderx-fix-phy-autoneg-for-sgmii-qlm-mode.patch @@ -0,0 +1,207 @@ +From foo@baz Thu Jun 15 11:38:13 CEST 2017 +From: Thanneeru Srinivasulu +Date: Tue, 23 May 2017 21:53:48 -0400 +Subject: net: thunderx: Fix PHY autoneg for SGMII QLM mode + +From: Thanneeru Srinivasulu + + +[ Upstream commit 075ad765ef7541b2860de8408c165a92b78aefa3 ] + +This patch fixes the case where there is no phydev attached +to a LMAC in DT due to non-existance of a PHY driver or due +to usage of non-stanadard PHY which doesn't support autoneg. +Changes dependeds on firmware to send correct info w.r.t +PHY and autoneg capability. + +This patch also covers a case where a 10G/40G interface is used +as a 1G with convertors with Cortina PHY in between. + +Signed-off-by: Thanneeru Srinivasulu +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 108 +++++++++++++++++++--- + drivers/net/ethernet/cavium/thunder/thunder_bgx.h | 5 + + 2 files changed, 101 insertions(+), 12 deletions(-) + +--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c ++++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c +@@ -31,6 +31,7 @@ struct lmac { + u8 lmac_type; + u8 lane_to_sds; + bool use_training; ++ bool autoneg; + bool link_up; + int lmacid; /* ID within BGX */ + int lmacid_bd; /* ID on board */ +@@ -418,7 +419,17 @@ static int bgx_lmac_sgmii_init(struct bg + /* power down, reset autoneg, autoneg enable */ + cfg = bgx_reg_read(bgx, lmacid, BGX_GMP_PCS_MRX_CTL); + cfg &= ~PCS_MRX_CTL_PWR_DN; +- cfg |= (PCS_MRX_CTL_RST_AN | PCS_MRX_CTL_AN_EN); ++ cfg |= PCS_MRX_CTL_RST_AN; ++ if (lmac->phydev) { ++ cfg |= PCS_MRX_CTL_AN_EN; ++ } else { ++ /* In scenarios where PHY driver is not present or it's a ++ * non-standard PHY, FW sets AN_EN to inform Linux driver ++ * to do auto-neg and link polling or not. ++ */ ++ if (cfg & PCS_MRX_CTL_AN_EN) ++ lmac->autoneg = true; ++ } + bgx_reg_write(bgx, lmacid, BGX_GMP_PCS_MRX_CTL, cfg); + + if (lmac->lmac_type == BGX_MODE_QSGMII) { +@@ -429,7 +440,7 @@ static int bgx_lmac_sgmii_init(struct bg + return 0; + } + +- if (lmac->lmac_type == BGX_MODE_SGMII) { ++ if ((lmac->lmac_type == BGX_MODE_SGMII) && lmac->phydev) { + if (bgx_poll_reg(bgx, lmacid, BGX_GMP_PCS_MRX_STATUS, + PCS_MRX_STATUS_AN_CPT, false)) { + dev_err(&bgx->pdev->dev, "BGX AN_CPT not completed\n"); +@@ -623,12 +634,71 @@ static int bgx_xaui_check_link(struct lm + return -1; + } + ++static void bgx_poll_for_sgmii_link(struct lmac *lmac) ++{ ++ u64 pcs_link, an_result; ++ u8 speed; ++ ++ pcs_link = bgx_reg_read(lmac->bgx, lmac->lmacid, ++ BGX_GMP_PCS_MRX_STATUS); ++ ++ /*Link state bit is sticky, read it again*/ ++ if (!(pcs_link & PCS_MRX_STATUS_LINK)) ++ pcs_link = bgx_reg_read(lmac->bgx, lmac->lmacid, ++ BGX_GMP_PCS_MRX_STATUS); ++ ++ if (bgx_poll_reg(lmac->bgx, lmac->lmacid, BGX_GMP_PCS_MRX_STATUS, ++ PCS_MRX_STATUS_AN_CPT, false)) { ++ lmac->link_up = false; ++ lmac->last_speed = SPEED_UNKNOWN; ++ lmac->last_duplex = DUPLEX_UNKNOWN; ++ goto next_poll; ++ } ++ ++ lmac->link_up = ((pcs_link & PCS_MRX_STATUS_LINK) != 0) ? true : false; ++ an_result = bgx_reg_read(lmac->bgx, lmac->lmacid, ++ BGX_GMP_PCS_ANX_AN_RESULTS); ++ ++ speed = (an_result >> 3) & 0x3; ++ lmac->last_duplex = (an_result >> 1) & 0x1; ++ switch (speed) { ++ case 0: ++ lmac->last_speed = 10; ++ break; ++ case 1: ++ lmac->last_speed = 100; ++ break; ++ case 2: ++ lmac->last_speed = 1000; ++ break; ++ default: ++ lmac->link_up = false; ++ lmac->last_speed = SPEED_UNKNOWN; ++ lmac->last_duplex = DUPLEX_UNKNOWN; ++ break; ++ } ++ ++next_poll: ++ ++ if (lmac->last_link != lmac->link_up) { ++ if (lmac->link_up) ++ bgx_sgmii_change_link_state(lmac); ++ lmac->last_link = lmac->link_up; ++ } ++ ++ queue_delayed_work(lmac->check_link, &lmac->dwork, HZ * 3); ++} ++ + static void bgx_poll_for_link(struct work_struct *work) + { + struct lmac *lmac; + u64 spu_link, smu_link; + + lmac = container_of(work, struct lmac, dwork.work); ++ if (lmac->is_sgmii) { ++ bgx_poll_for_sgmii_link(lmac); ++ return; ++ } + + /* Receive link is latching low. Force it high and verify it */ + bgx_reg_modify(lmac->bgx, lmac->lmacid, +@@ -720,9 +790,21 @@ static int bgx_lmac_enable(struct bgx *b + (lmac->lmac_type != BGX_MODE_XLAUI) && + (lmac->lmac_type != BGX_MODE_40G_KR) && + (lmac->lmac_type != BGX_MODE_10G_KR)) { +- if (!lmac->phydev) +- return -ENODEV; +- ++ if (!lmac->phydev) { ++ if (lmac->autoneg) { ++ bgx_reg_write(bgx, lmacid, ++ BGX_GMP_PCS_LINKX_TIMER, ++ PCS_LINKX_TIMER_COUNT); ++ goto poll; ++ } else { ++ /* Default to below link speed and duplex */ ++ lmac->link_up = true; ++ lmac->last_speed = 1000; ++ lmac->last_duplex = 1; ++ bgx_sgmii_change_link_state(lmac); ++ return 0; ++ } ++ } + lmac->phydev->dev_flags = 0; + + if (phy_connect_direct(&lmac->netdev, lmac->phydev, +@@ -731,15 +813,17 @@ static int bgx_lmac_enable(struct bgx *b + return -ENODEV; + + phy_start_aneg(lmac->phydev); +- } else { +- lmac->check_link = alloc_workqueue("check_link", WQ_UNBOUND | +- WQ_MEM_RECLAIM, 1); +- if (!lmac->check_link) +- return -ENOMEM; +- INIT_DELAYED_WORK(&lmac->dwork, bgx_poll_for_link); +- queue_delayed_work(lmac->check_link, &lmac->dwork, 0); ++ return 0; + } + ++poll: ++ lmac->check_link = alloc_workqueue("check_link", WQ_UNBOUND | ++ WQ_MEM_RECLAIM, 1); ++ if (!lmac->check_link) ++ return -ENOMEM; ++ INIT_DELAYED_WORK(&lmac->dwork, bgx_poll_for_link); ++ queue_delayed_work(lmac->check_link, &lmac->dwork, 0); ++ + return 0; + } + +--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h ++++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h +@@ -144,10 +144,15 @@ + #define PCS_MRX_CTL_LOOPBACK1 BIT_ULL(14) + #define PCS_MRX_CTL_RESET BIT_ULL(15) + #define BGX_GMP_PCS_MRX_STATUS 0x30008 ++#define PCS_MRX_STATUS_LINK BIT_ULL(2) + #define PCS_MRX_STATUS_AN_CPT BIT_ULL(5) ++#define BGX_GMP_PCS_ANX_ADV 0x30010 + #define BGX_GMP_PCS_ANX_AN_RESULTS 0x30020 ++#define BGX_GMP_PCS_LINKX_TIMER 0x30040 ++#define PCS_LINKX_TIMER_COUNT 0x1E84 + #define BGX_GMP_PCS_SGM_AN_ADV 0x30068 + #define BGX_GMP_PCS_MISCX_CTL 0x30078 ++#define PCS_MISC_CTL_MODE BIT_ULL(8) + #define PCS_MISC_CTL_DISP_EN BIT_ULL(13) + #define PCS_MISC_CTL_GMX_ENO BIT_ULL(11) + #define PCS_MISC_CTL_SAMP_PT_MASK 0x7Full diff --git a/queue-4.9/pm-runtime-avoid-false-positive-warnings-from-might_sleep_if.patch b/queue-4.9/pm-runtime-avoid-false-positive-warnings-from-might_sleep_if.patch new file mode 100644 index 00000000000..fa228065858 --- /dev/null +++ b/queue-4.9/pm-runtime-avoid-false-positive-warnings-from-might_sleep_if.patch @@ -0,0 +1,115 @@ +From foo@baz Thu Jun 15 11:38:13 CEST 2017 +From: "Rafael J. Wysocki" +Date: Tue, 23 May 2017 21:53:54 -0400 +Subject: PM / runtime: Avoid false-positive warnings from might_sleep_if() + +From: "Rafael J. Wysocki" + + +[ Upstream commit a9306a63631493afc75893a4ac405d4e1cbae6aa ] + +The might_sleep_if() assertions in __pm_runtime_idle(), +__pm_runtime_suspend() and __pm_runtime_resume() may generate +false-positive warnings in some situations. For example, that +happens if a nested pm_runtime_get_sync()/pm_runtime_put() pair +is executed with disabled interrupts within an outer +pm_runtime_get_sync()/pm_runtime_put() section for the same device. +[Generally, pm_runtime_get_sync() may sleep, so it should not be +called with disabled interrupts, but in this particular case the +previous pm_runtime_get_sync() guarantees that the device will not +be suspended, so the inner pm_runtime_get_sync() will return +immediately after incrementing the device's usage counter.] + +That started to happen in the i915 driver in 4.10-rc, leading to +the following splat: + + BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1032 + in_atomic(): 1, irqs_disabled(): 0, pid: 1500, name: Xorg + 1 lock held by Xorg/1500: + #0: (&dev->struct_mutex){+.+.+.}, at: + [] i915_mutex_lock_interruptible+0x43/0x140 [i915] + CPU: 0 PID: 1500 Comm: Xorg Not tainted + Call Trace: + dump_stack+0x85/0xc2 + ___might_sleep+0x196/0x260 + __might_sleep+0x53/0xb0 + __pm_runtime_resume+0x7a/0x90 + intel_runtime_pm_get+0x25/0x90 [i915] + aliasing_gtt_bind_vma+0xaa/0xf0 [i915] + i915_vma_bind+0xaf/0x1e0 [i915] + i915_gem_execbuffer_relocate_entry+0x513/0x6f0 [i915] + i915_gem_execbuffer_relocate_vma.isra.34+0x188/0x250 [i915] + ? trace_hardirqs_on+0xd/0x10 + ? i915_gem_execbuffer_reserve_vma.isra.31+0x152/0x1f0 [i915] + ? i915_gem_execbuffer_reserve.isra.32+0x372/0x3a0 [i915] + i915_gem_do_execbuffer.isra.38+0xa70/0x1a40 [i915] + ? __might_fault+0x4e/0xb0 + i915_gem_execbuffer2+0xc5/0x260 [i915] + ? __might_fault+0x4e/0xb0 + drm_ioctl+0x206/0x450 [drm] + ? i915_gem_execbuffer+0x340/0x340 [i915] + ? __fget+0x5/0x200 + do_vfs_ioctl+0x91/0x6f0 + ? __fget+0x111/0x200 + ? __fget+0x5/0x200 + SyS_ioctl+0x79/0x90 + entry_SYSCALL_64_fastpath+0x23/0xc6 + +even though the code triggering it is correct. + +Unfortunately, the might_sleep_if() assertions in question are +too coarse-grained to cover such cases correctly, so make them +a bit less sensitive in order to avoid the false-positives. + +Reported-and-tested-by: Sedat Dilek +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/power/runtime.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -889,13 +889,13 @@ int __pm_runtime_idle(struct device *dev + unsigned long flags; + int retval; + +- might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); +- + if (rpmflags & RPM_GET_PUT) { + if (!atomic_dec_and_test(&dev->power.usage_count)) + return 0; + } + ++ might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); ++ + spin_lock_irqsave(&dev->power.lock, flags); + retval = rpm_idle(dev, rpmflags); + spin_unlock_irqrestore(&dev->power.lock, flags); +@@ -921,13 +921,13 @@ int __pm_runtime_suspend(struct device * + unsigned long flags; + int retval; + +- might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); +- + if (rpmflags & RPM_GET_PUT) { + if (!atomic_dec_and_test(&dev->power.usage_count)) + return 0; + } + ++ might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); ++ + spin_lock_irqsave(&dev->power.lock, flags); + retval = rpm_suspend(dev, rpmflags); + spin_unlock_irqrestore(&dev->power.lock, flags); +@@ -952,7 +952,8 @@ int __pm_runtime_resume(struct device *d + unsigned long flags; + int retval; + +- might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); ++ might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe && ++ dev->power.runtime_status != RPM_ACTIVE); + + if (rpmflags & RPM_GET_PUT) + atomic_inc(&dev->power.usage_count); diff --git a/queue-4.9/series b/queue-4.9/series index 9bb53491555..d15be1766a5 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -21,3 +21,13 @@ sierra_net-add-support-for-ipv6-and-dual-stack-link-sense-indications.patch i2c-piix4-request-the-smbus-semaphore-inside-the-mutex.patch i2c-piix4-fix-request_region-size.patch powerpc-powernv-properly-set-host-ipi-on-ipis.patch +kernel-ucount.c-mark-user_header-with-kmemleak_ignore.patch +net-thunderx-fix-phy-autoneg-for-sgmii-qlm-mode.patch +ipv6-addrconf-fix-generation-of-new-temporary-addresses.patch +vfio-spapr_tce-set-window-when-adding-additional-groups-to-container.patch +ipv6-fix-ipv6-packet-loss-in-scenarios-involving-roaming-snooping-switches.patch +arm-defconfigs-make-nf_ct_proto_sctp-and-nf_ct_proto_udplite-built-in.patch +pm-runtime-avoid-false-positive-warnings-from-might_sleep_if.patch +jump-label-pass-kbuild_cflags-when-checking-for-asm-goto-support.patch +shmem-fix-sleeping-from-atomic-context.patch +kasan-respect-proc-sys-kernel-traceoff_on_warning.patch diff --git a/queue-4.9/shmem-fix-sleeping-from-atomic-context.patch b/queue-4.9/shmem-fix-sleeping-from-atomic-context.patch new file mode 100644 index 00000000000..b2e95d4f49e --- /dev/null +++ b/queue-4.9/shmem-fix-sleeping-from-atomic-context.patch @@ -0,0 +1,105 @@ +From foo@baz Thu Jun 15 11:38:13 CEST 2017 +From: "Kirill A. Shutemov" +Date: Tue, 23 May 2017 21:53:56 -0400 +Subject: shmem: fix sleeping from atomic context + +From: "Kirill A. Shutemov" + + +[ Upstream commit 253fd0f02040a19c6fe80e4171659fa3482a422d ] + +Syzkaller fuzzer managed to trigger this: + + BUG: sleeping function called from invalid context at mm/shmem.c:852 + in_atomic(): 1, irqs_disabled(): 0, pid: 529, name: khugepaged + 3 locks held by khugepaged/529: + #0: (shrinker_rwsem){++++..}, at: [] shrink_slab.part.59+0x121/0xd30 mm/vmscan.c:451 + #1: (&type->s_umount_key#29){++++..}, at: [] trylock_super+0x20/0x100 fs/super.c:392 + #2: (&(&sbinfo->shrinklist_lock)->rlock){+.+.-.}, at: [] spin_lock include/linux/spinlock.h:302 [inline] + #2: (&(&sbinfo->shrinklist_lock)->rlock){+.+.-.}, at: [] shmem_unused_huge_shrink+0x28e/0x1490 mm/shmem.c:427 + CPU: 2 PID: 529 Comm: khugepaged Not tainted 4.10.0-rc5+ #201 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 + Call Trace: + shmem_undo_range+0xb20/0x2710 mm/shmem.c:852 + shmem_truncate_range+0x27/0xa0 mm/shmem.c:939 + shmem_evict_inode+0x35f/0xca0 mm/shmem.c:1030 + evict+0x46e/0x980 fs/inode.c:553 + iput_final fs/inode.c:1515 [inline] + iput+0x589/0xb20 fs/inode.c:1542 + shmem_unused_huge_shrink+0xbad/0x1490 mm/shmem.c:446 + shmem_unused_huge_scan+0x10c/0x170 mm/shmem.c:512 + super_cache_scan+0x376/0x450 fs/super.c:106 + do_shrink_slab mm/vmscan.c:378 [inline] + shrink_slab.part.59+0x543/0xd30 mm/vmscan.c:481 + shrink_slab mm/vmscan.c:2592 [inline] + shrink_node+0x2c7/0x870 mm/vmscan.c:2592 + shrink_zones mm/vmscan.c:2734 [inline] + do_try_to_free_pages+0x369/0xc80 mm/vmscan.c:2776 + try_to_free_pages+0x3c6/0x900 mm/vmscan.c:2982 + __perform_reclaim mm/page_alloc.c:3301 [inline] + __alloc_pages_direct_reclaim mm/page_alloc.c:3322 [inline] + __alloc_pages_slowpath+0xa24/0x1c30 mm/page_alloc.c:3683 + __alloc_pages_nodemask+0x544/0xae0 mm/page_alloc.c:3848 + __alloc_pages include/linux/gfp.h:426 [inline] + __alloc_pages_node include/linux/gfp.h:439 [inline] + khugepaged_alloc_page+0xc2/0x1b0 mm/khugepaged.c:750 + collapse_huge_page+0x182/0x1fe0 mm/khugepaged.c:955 + khugepaged_scan_pmd+0xfdf/0x12a0 mm/khugepaged.c:1208 + khugepaged_scan_mm_slot mm/khugepaged.c:1727 [inline] + khugepaged_do_scan mm/khugepaged.c:1808 [inline] + khugepaged+0xe9b/0x1590 mm/khugepaged.c:1853 + kthread+0x326/0x3f0 kernel/kthread.c:227 + ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430 + +The iput() from atomic context was a bad idea: if after igrab() somebody +else calls iput() and we left with the last inode reference, our iput() +would lead to inode eviction and therefore sleeping. + +This patch should fix the situation. + +Link: http://lkml.kernel.org/r/20170131093141.GA15899@node.shutemov.name +Signed-off-by: Kirill A. Shutemov +Reported-by: Dmitry Vyukov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + mm/shmem.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -412,6 +412,7 @@ static unsigned long shmem_unused_huge_s + struct shrink_control *sc, unsigned long nr_to_split) + { + LIST_HEAD(list), *pos, *next; ++ LIST_HEAD(to_remove); + struct inode *inode; + struct shmem_inode_info *info; + struct page *page; +@@ -438,9 +439,8 @@ static unsigned long shmem_unused_huge_s + /* Check if there's anything to gain */ + if (round_up(inode->i_size, PAGE_SIZE) == + round_up(inode->i_size, HPAGE_PMD_SIZE)) { +- list_del_init(&info->shrinklist); ++ list_move(&info->shrinklist, &to_remove); + removed++; +- iput(inode); + goto next; + } + +@@ -451,6 +451,13 @@ next: + } + spin_unlock(&sbinfo->shrinklist_lock); + ++ list_for_each_safe(pos, next, &to_remove) { ++ info = list_entry(pos, struct shmem_inode_info, shrinklist); ++ inode = &info->vfs_inode; ++ list_del_init(&info->shrinklist); ++ iput(inode); ++ } ++ + list_for_each_safe(pos, next, &list) { + int ret; + diff --git a/queue-4.9/vfio-spapr_tce-set-window-when-adding-additional-groups-to-container.patch b/queue-4.9/vfio-spapr_tce-set-window-when-adding-additional-groups-to-container.patch new file mode 100644 index 00000000000..ef564fa8ed9 --- /dev/null +++ b/queue-4.9/vfio-spapr_tce-set-window-when-adding-additional-groups-to-container.patch @@ -0,0 +1,70 @@ +From foo@baz Thu Jun 15 11:38:13 CEST 2017 +From: Alexey Kardashevskiy +Date: Tue, 23 May 2017 21:53:51 -0400 +Subject: vfio/spapr_tce: Set window when adding additional groups to container + +From: Alexey Kardashevskiy + + +[ Upstream commit 930a42ded3fede7ca3acafc9153f4f2d0f56a92c ] + +If a container already has a group attached, attaching a new group +should just program already created IOMMU tables to the hardware via +the iommu_table_group_ops::set_window() callback. + +However commit 6f01cc692a16 ("vfio/spapr: Add a helper to create +default DMA window") did not just simplify the code but also removed +the set_window() calls in the case of attaching groups to a container +which already has tables so it broke VFIO PCI hotplug. + +This reverts set_window() bits in tce_iommu_take_ownership_ddw(). + +Fixes: 6f01cc692a16 ("vfio/spapr: Add a helper to create default DMA window") +Signed-off-by: Alexey Kardashevskiy +Reviewed-by: David Gibson +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vfio/vfio_iommu_spapr_tce.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/drivers/vfio/vfio_iommu_spapr_tce.c ++++ b/drivers/vfio/vfio_iommu_spapr_tce.c +@@ -1246,6 +1246,8 @@ static void tce_iommu_release_ownership_ + static long tce_iommu_take_ownership_ddw(struct tce_container *container, + struct iommu_table_group *table_group) + { ++ long i, ret = 0; ++ + if (!table_group->ops->create_table || !table_group->ops->set_window || + !table_group->ops->release_ownership) { + WARN_ON_ONCE(1); +@@ -1254,7 +1256,27 @@ static long tce_iommu_take_ownership_ddw + + table_group->ops->take_ownership(table_group); + ++ /* Set all windows to the new group */ ++ for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i) { ++ struct iommu_table *tbl = container->tables[i]; ++ ++ if (!tbl) ++ continue; ++ ++ ret = table_group->ops->set_window(table_group, i, tbl); ++ if (ret) ++ goto release_exit; ++ } ++ + return 0; ++ ++release_exit: ++ for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i) ++ table_group->ops->unset_window(table_group, i); ++ ++ table_group->ops->release_ownership(table_group); ++ ++ return ret; + } + + static int tce_iommu_attach_group(void *iommu_data,