]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/log
mirror_ubuntu-bionic-kernel.git
6 years agoUBUNTU: [Packaging] retpoline -- elide %rip relative indirections
Andy Whitcroft [Sun, 25 Mar 2018 10:05:54 +0000 (11:05 +0100)]
UBUNTU: [Packaging] retpoline -- elide %rip relative indirections

BugLink: http://bugs.launchpad.net/bugs/1758856
These are always safe because there is no way rip can be an unknown.

Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: [Packaging] retpoline -- widen indirect call/jmp detection
Andy Whitcroft [Fri, 23 Mar 2018 11:11:18 +0000 (11:11 +0000)]
UBUNTU: [Packaging] retpoline -- widen indirect call/jmp detection

BugLink: http://bugs.launchpad.net/bugs/1758856
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: [Packaging] retpoline-check -- only report additions
Andy Whitcroft [Tue, 20 Mar 2018 12:36:54 +0000 (12:36 +0000)]
UBUNTU: [Packaging] retpoline-check -- only report additions

BugLink: http://bugs.launchpad.net/bugs/1758856
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: [Packaging] retpoline -- add safe usage hint support
Andy Whitcroft [Thu, 8 Mar 2018 15:48:31 +0000 (15:48 +0000)]
UBUNTU: [Packaging] retpoline -- add safe usage hint support

BugLink: http://bugs.launchpad.net/bugs/1758856
Use the upstream retpoline safe hinting support to clear out known
safe retpoline sequences from those detected.  At the same time
switch to extracting the indirect sequences and associated hints
to .o generation time.  This allows it to be run on the cache hot
data and to be run in parallel on the builders.

Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)
Colin Ian King [Wed, 28 Mar 2018 10:19:25 +0000 (11:19 +0100)]
UBUNTU: SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)

BugLink: https://bugs.launchpad.net/bugs/1754584
Fix mmap'd libaio read on non-prefaulted page deadlock. This is a hot fix
from ZFS upstream that ensure pages do not deadlock and replaces the original
fix as it is a far better solution.

Performing a read with the target data in a mmap'd page that is map'd into
the same blocks that are being read causes a lock on the page and a further
lock on the same page when the page is being faulted in, causing deadlock.

This is an improved fix from the original fix which ensures the pages don't
deadlock and removes the original potentially racy pre-faulting fix

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoRevert "UBUNTU: SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)"
Colin Ian King [Wed, 28 Mar 2018 10:19:24 +0000 (11:19 +0100)]
Revert "UBUNTU: SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)"

BugLink: https://bugs.launchpad.net/bugs/1754584
Remove original hotfix to replace it with an improved fix

This reverts commit bc0adba16e0600a898435fa22c803f15e3caa866.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoKVM: PPC: Book3S HV: Fix duplication of host SLB entries
Paul Mackerras [Wed, 21 Mar 2018 22:48:54 +0000 (09:48 +1100)]
KVM: PPC: Book3S HV: Fix duplication of host SLB entries

BugLink: http://bugs.launchpad.net/bugs/1759045
Since commit 6964e6a4e489 ("KVM: PPC: Book3S HV: Do SLB load/unload
with guest LPCR value loaded", 2018-01-11), we have been seeing
occasional machine check interrupts on POWER8 systems when running
KVM guests, due to SLB multihit errors.

This turns out to be due to the guest exit code reloading the host
SLB entries from the SLB shadow buffer when the SLB was not previously
cleared in the guest entry path.  This can happen because the path
which skips from the guest entry code to the guest exit code without
entering the guest now does the skip before the SLB is cleared and
loaded with guest values, but the host values are loaded after the
point in the guest exit path that we skip to.

To fix this, we move the code that reloads the host SLB values up
so that it occurs just before the point in the guest exit code (the
label guest_bypass:) where we skip to from the guest entry path.

Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Fixes: 6964e6a4e489 ("KVM: PPC: Book3S HV: Do SLB load/unload with guest LPCR value loaded")
Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
(cherry picked from commit cda4a14733138b8f15b0b69d97ec198dc41eccae linux-next)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoKVM: PPC: Book3S HV: Fix trap number return from __kvmppc_vcore_entry
Paul Mackerras [Wed, 7 Mar 2018 11:17:20 +0000 (22:17 +1100)]
KVM: PPC: Book3S HV: Fix trap number return from __kvmppc_vcore_entry

BugLink: http://bugs.launchpad.net/bugs/1759045
This fixes a bug where the trap number that is returned by
__kvmppc_vcore_entry gets corrupted.  The effect of the corruption
is that IPIs get ignored on POWER9 systems when the IPI is sent via
a doorbell interrupt to a CPU which is executing in a KVM guest.
The effect of the IPI being ignored is often that another CPU locks
up inside smp_call_function_many() (and if that CPU is holding a
spinlock, other CPUs then lock up inside raw_spin_lock()).

The trap number is currently held in register r12 for most of the
assembly-language part of the guest exit path.  In that path, we
call kvmppc_subcore_exit_guest(), which is a C function, without
restoring r12 afterwards.  Depending on the kernel config and the
compiler, it may modify r12 or it may not, so some config/compiler
combinations see the bug and others don't.

To fix this, we arrange for the trap number to be stored on the
stack from the 'guest_bypass:' label until the end of the function,
then the trap number is loaded and returned in r12 as before.

Cc: stable@vger.kernel.org # v4.8+
Fixes: fd7bacbca47a ("KVM: PPC: Book3S HV: Fix TB corruption in guest exit path on HMI interrupt")
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
(cherry picked from commit a8b48a4dccea77e29462e59f1dbf0d5aa1ff167c)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoKVM: PPC: Book3S: Fix compile error that occurs with some gcc versions
Paul Mackerras [Tue, 13 Feb 2018 04:45:21 +0000 (15:45 +1100)]
KVM: PPC: Book3S: Fix compile error that occurs with some gcc versions

BugLink: http://bugs.launchpad.net/bugs/1759045
Some versions of gcc generate a warning that the variable "emulated"
may be used uninitialized in function kvmppc_handle_load128_by2x64().
It would be used uninitialized if kvmppc_handle_load128_by2x64 was
ever called with vcpu->arch.mmio_vmx_copy_nums == 0, but neither of
the callers ever do that, so there is no actual bug.  When gcc
generates a warning, it causes the build to fail because arch/powerpc
is compiled with -Werror.

This silences the warning by initializing "emulated" to EMULATE_DONE.

Fixes: 09f984961c13 ("KVM: PPC: Book3S: Add MMIO emulation for VMX instructions")
Reported-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
(cherry picked from commit 6df3877fc962c2bb3d0438633dfd24a185af6838)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoKVM: PPC: Book3S: Add MMIO emulation for VMX instructions
Jose Ricardo Ziviani [Sat, 3 Feb 2018 20:24:26 +0000 (18:24 -0200)]
KVM: PPC: Book3S: Add MMIO emulation for VMX instructions

BugLink: http://bugs.launchpad.net/bugs/1759045
This patch provides the MMIO load/store vector indexed
X-Form emulation.

Instructions implemented:
lvx: the quadword in storage addressed by the result of EA &
0xffff_ffff_ffff_fff0 is loaded into VRT.

stvx: the contents of VRS are stored into the quadword in storage
addressed by the result of EA & 0xffff_ffff_ffff_fff0.

Reported-by: Gopesh Kumar Chaudhary <gopchaud@in.ibm.com>
Reported-by: Balamuruhan S <bala24@linux.vnet.ibm.com>
Signed-off-by: Jose Ricardo Ziviani <joserz@linux.vnet.ibm.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
(cherry picked from commit 09f984961c137c4b252c368adab7e1c9f035fa59)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoKVM: PPC: Book3S HV: Make HPT resizing work on POWER9
David Gibson [Fri, 2 Feb 2018 03:29:08 +0000 (14:29 +1100)]
KVM: PPC: Book3S HV: Make HPT resizing work on POWER9

BugLink: http://bugs.launchpad.net/bugs/1759045
This adds code to enable the HPT resizing code to work on POWER9,
which uses a slightly modified HPT entry format compared to POWER8.
On POWER9, we convert HPTEs read from the HPT from the new format to
the old format so that the rest of the HPT resizing code can work as
before.  HPTEs written to the new HPT are converted to the new format
as the last step before writing them into the new HPT.

This takes out the checks added by commit bcd3bb63dbc8 ("KVM: PPC:
Book3S HV: Disable HPT resizing on POWER9 for now", 2017-02-18),
now that HPT resizing works on POWER9.

On POWER9, when we pivot to the new HPT, we now call
kvmppc_setup_partition_table() to update the partition table in order
to make the hardware use the new HPT.

[paulus@ozlabs.org - added kvmppc_setup_partition_table() call,
 wrote commit message.]

Tested-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
(cherry picked from commit 790a9df5fbef982f2a6992194fe497dd2b794a3d)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoKVM: PPC: Book3S HV: Fix handling of secondary HPTEG in HPT resizing code
Paul Mackerras [Wed, 7 Feb 2018 08:49:54 +0000 (19:49 +1100)]
KVM: PPC: Book3S HV: Fix handling of secondary HPTEG in HPT resizing code

BugLink: http://bugs.launchpad.net/bugs/1759045
This fixes the computation of the HPTE index to use when the HPT
resizing code encounters a bolted HPTE which is stored in its
secondary HPTE group.  The code inverts the HPTE group number, which
is correct, but doesn't then mask it with new_hash_mask.  As a result,
new_pteg will be effectively negative, resulting in new_hptep
pointing before the new HPT, which will corrupt memory.

In addition, this removes two BUG_ON statements.  The condition that
the BUG_ONs were testing -- that we have computed the hash value
incorrectly -- has never been observed in testing, and if it did
occur, would only affect the guest, not the host.  Given that
BUG_ON should only be used in conditions where the kernel (i.e.
the host kernel, in this case) can't possibly continue execution,
it is not appropriate here.

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
(cherry picked from commit 05f2bb0313a2855e491dadfc8319b7da261d7074)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoKVM: PPC: Book3S HV: Do SLB load/unload with guest LPCR value loaded
Paul Mackerras [Thu, 11 Jan 2018 03:51:02 +0000 (14:51 +1100)]
KVM: PPC: Book3S HV: Do SLB load/unload with guest LPCR value loaded

BugLink: http://bugs.launchpad.net/bugs/1759045
This moves the code that loads and unloads the guest SLB values so that
it is done while the guest LPCR value is loaded in the LPCR register.
The reason for doing this is that on POWER9, the behaviour of the
slbmte instruction depends on the LPCR[UPRT] bit.  If UPRT is 1, as
it is for a radix host (or guest), the SLB index is truncated to
2 bits.  This means that for a HPT guest on a radix host, the SLB
was not being loaded correctly, causing the guest to crash.

The SLB is now loaded much later in the guest entry path, after the
LPCR is loaded, which for a secondary thread is after it sees that
the primary thread has switched the MMU to the guest.  The loop that
waits for the primary thread has a branch out to the exit code that
is taken if it sees that other threads have commenced exiting the
guest.  Since we have now not loaded the SLB at this point, we make
this path branch to a new label 'guest_bypass' and we move the SLB
unload code to before this label.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
(cherry picked from commit 6964e6a4e4894c707e42d51d9d30683c57f43201)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: crypto: thunderx_zip: Fix fallout from CONFIG_VMAP_STACK
Jan Glauber [Tue, 27 Mar 2018 10:31:53 +0000 (12:31 +0200)]
UBUNTU: SAUCE: crypto: thunderx_zip: Fix fallout from CONFIG_VMAP_STACK

BugLink: http://bugs.launchpad.net/bugs/1755073
Enabling virtual mapped kernel stacks breaks the thunderx_zip
driver. On compression or decompression the executing CPU hangs
in an endless loop. The reason for this is the usage of __pa()
by the driver that does not work for an address that is
not part of the 1:1 mapping.

The zip driver allocates a result struct on the stack and needs
to tell the hardware the pysical address within this struct
that is used to signal the completion of the request.
With CONFIG_VMAP_STACK __pa() is no longer usable for a stack address.

As the hardware gets the wrong address it writes the result byte
to an arbitrary address. The zip driver then waits forever for the
completion byte to contain a non-zero value.

Allocating the result struct from 1:1 mapped memory resolves this
bug.

Note that there are more outstanding issues with the used completion
mechanism:
- volatile is used for a bitfield
- no barriers at all re used
- the completion loop should have a retry counter and not run forever
- polling for the result should use a delay
- interrupts for completion and error notification should be used

Signed-off-by: Jan Glauber <jglauber@cavium.com>
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoocxl: Add get_metadata IOCTL to share OCXL information to userspace
Alastair D'Silva [Thu, 22 Feb 2018 04:17:38 +0000 (15:17 +1100)]
ocxl: Add get_metadata IOCTL to share OCXL information to userspace

BugLink: http://bugs.launchpad.net/bugs/1755161
Some required information is not exposed to userspace currently (eg. the
PASID), pass this information back, along with other information which
is currently communicated via sysfs, which saves some parsing effort in
userspace.

Signed-off-by: Alastair D'Silva <alastair@d-silva.org>
Acked-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Acked-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
(cherry picked from commit 07c5ccd70ad702e561fcda8e4df494f098a42742)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoocxl: Fix potential bad errno on irq allocation
Frederic Barrat [Fri, 16 Feb 2018 13:01:18 +0000 (14:01 +0100)]
ocxl: Fix potential bad errno on irq allocation

BugLink: http://bugs.launchpad.net/bugs/1755161
Fix some issues found by a static checker:

When allocating an AFU interrupt, if the driver cannot copy the output
parameters to userland, the errno value was not set to EFAULT

Remove a (now) useless cast.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Acked-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
(cherry picked from commit 423688abd9ab654044bddd82eb5983189eb9630d)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoocxl: fix signed comparison with less than zero
Colin Ian King [Tue, 30 Jan 2018 15:11:44 +0000 (15:11 +0000)]
ocxl: fix signed comparison with less than zero

BugLink: http://bugs.launchpad.net/bugs/1755161
Currently the comparison of used < 0 is always false because
uses is a size_t. Fix this by making used a ssize_t type.

Detected by Coccinelle:
drivers/misc/ocxl/file.c:320:6-10: WARNING: Unsigned expression
compared with zero: used < 0

Fixes: 5ef3166e8a32 ("ocxl: Driver code for 'generic' opencapi devices")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Acked-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
(cherry picked from commit dedab7f0d3137441a97fe7cf9b9ca5dbd20ca9a5)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Enable OCXL operations
Uma Krishnan [Wed, 14 Feb 2018 00:16:13 +0000 (18:16 -0600)]
UBUNTU: SAUCE: cxlflash: Enable OCXL operations

BugLink: http://bugs.launchpad.net/bugs/1752672
This commit enables the OCXL operations for the OCXL devices.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support AFU reset
Uma Krishnan [Tue, 20 Feb 2018 21:24:37 +0000 (15:24 -0600)]
UBUNTU: SAUCE: cxlflash: Support AFU reset

BugLink: http://bugs.launchpad.net/bugs/1752672
The cxlflash core driver resets the AFU when the master contexts are
created in the initialization or recovery paths. Today, the OCXL
provider service to perform this operation is pending implementation.
To avoid a crash due to a missing fop, log an error once and return
success to continue with execution.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Register for translation errors
Uma Krishnan [Tue, 13 Feb 2018 23:25:18 +0000 (17:25 -0600)]
UBUNTU: SAUCE: cxlflash: Register for translation errors

BugLink: http://bugs.launchpad.net/bugs/1752672
While enabling a context on the link, a predefined callback can be
registered with the OCXL provider services to be notified on translation
errors. These errors can in turn be passed back to the user on a read
operation.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Introduce OCXL context state machine
Uma Krishnan [Tue, 13 Feb 2018 22:38:17 +0000 (16:38 -0600)]
UBUNTU: SAUCE: cxlflash: Introduce OCXL context state machine

BugLink: http://bugs.launchpad.net/bugs/1752672
In order to protect the OCXL hardware contexts from getting clobbered,
a simple state machine is added to indicate when a context is in open,
close or start state. The expected states are validated throughout the
code to prevent illegal operations on a context. A mutex is added to
protect writes to the context state field.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Update synchronous interrupt status bits
Uma Krishnan [Mon, 12 Feb 2018 18:10:18 +0000 (12:10 -0600)]
UBUNTU: SAUCE: cxlflash: Update synchronous interrupt status bits

BugLink: http://bugs.launchpad.net/bugs/1752672
The SISLite specification has been updated to define new synchronous
interrupt status bits. These bits are set by the AFU when a given PASID or
EA is bad and a synchronous interrupt is triggered.

The SISLite header file is updated to support these new bits. Note that
there are also some formatting updates to some of the existing bits to
allow all of the definitions to line up uniformly.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Setup LISNs for master contexts
Uma Krishnan [Wed, 14 Feb 2018 00:03:10 +0000 (18:03 -0600)]
UBUNTU: SAUCE: cxlflash: Setup LISNs for master contexts

BugLink: http://bugs.launchpad.net/bugs/1752672
Similar to user contexts, master contexts also require that the per-context
LISN registers be programmed for certain AFUs. The mapped trigger page is
obtained from underlying transport and registered with AFU for each master
context.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Setup LISNs for user contexts
Uma Krishnan [Fri, 2 Feb 2018 10:08:42 +0000 (04:08 -0600)]
UBUNTU: SAUCE: cxlflash: Setup LISNs for user contexts

BugLink: http://bugs.launchpad.net/bugs/1752672
The SISLite specification has been updated for OCXL to support
communicating data to generate AFU interrupts to the AFU. This includes
a new capability bit that is advertised for OCXL AFUs and new registers
to hold the object handle and translation PASID of each interrupt. For
Power, the object handle is the mapped trigger page. Note that because
these mappings are kernel only, the PASID of a kernel context must be
used to satisfy the translation.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Introduce object handle fop
Uma Krishnan [Fri, 2 Feb 2018 07:18:21 +0000 (01:18 -0600)]
UBUNTU: SAUCE: cxlflash: Introduce object handle fop

BugLink: http://bugs.launchpad.net/bugs/1752672
OCXL requires that AFUs use an opaque object handle to represent
an AFU interrupt. The specification does not provide a common means
to communicate the object handle to the AFU - each AFU must define
this within the AFU specification. To support this model, the object
handle must be passed back to the core driver as it manages the AFU
specification (SISLite) for cxlflash. Note that for Power systems,
the object handle is the effective address of the trigger page.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support file descriptor mapping
Uma Krishnan [Mon, 20 Nov 2017 21:43:14 +0000 (15:43 -0600)]
UBUNTU: SAUCE: cxlflash: Support file descriptor mapping

BugLink: http://bugs.launchpad.net/bugs/1752672
The cxlflash core fop API requires a way to invoke the fault and release
handlers of underlying transports using their native file-based APIs. This
provides the core with the ability to insert selectively itself into the
processing stream of these operations for cleanup. Implement these two
fops to map and release when requested.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support adapter context mmap and release
Uma Krishnan [Mon, 29 Jan 2018 19:24:04 +0000 (13:24 -0600)]
UBUNTU: SAUCE: cxlflash: Support adapter context mmap and release

BugLink: http://bugs.launchpad.net/bugs/1752672
The cxlflash userspace API requires that users be able to mmap and release
the adapter context. Support mapping by implementing the AFU mmap fop to
map the context MMIO space and install the corresponding page table entry
upon page fault. Similarly, implement the AFU release fop to terminate and
clean up the context when invoked.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support adapter context reading
Uma Krishnan [Tue, 23 Jan 2018 20:20:06 +0000 (14:20 -0600)]
UBUNTU: SAUCE: cxlflash: Support adapter context reading

BugLink: http://bugs.launchpad.net/bugs/1752672
The cxlflash userspace API requires that users be able to read the adapter
context for any pending events or interrupts from the AFU. Support reading
various events by implementing the AFU read fop to copy out event data.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support adapter context polling
Uma Krishnan [Tue, 23 Jan 2018 19:44:27 +0000 (13:44 -0600)]
UBUNTU: SAUCE: cxlflash: Support adapter context polling

BugLink: http://bugs.launchpad.net/bugs/1752672
The cxlflash userspace API requires that users be able to poll the adapter
context for any pending events or interrupts from the AFU. Support polling
on various events by implementing the AFU poll fop using a waitqueue.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support starting user contexts
Uma Krishnan [Thu, 18 Jan 2018 20:31:11 +0000 (14:31 -0600)]
UBUNTU: SAUCE: cxlflash: Support starting user contexts

BugLink: http://bugs.launchpad.net/bugs/1752672
User contexts request interrupts and are started using the "start work"
interface. Populate the start_work() fop to allocate and map interrupts
before starting the user context. As part of starting the context, update
the user process identification logic to properly derive the data required
by the SPA. Also, introduce a skeleton interrupt handler using a bitmap,
flag, and spinlock to track interrupts. This handler will be expanded in
future commits.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support AFU interrupt mapping and registration
Uma Krishnan [Wed, 20 Dec 2017 19:32:03 +0000 (13:32 -0600)]
UBUNTU: SAUCE: cxlflash: Support AFU interrupt mapping and registration

BugLink: http://bugs.launchpad.net/bugs/1752672
Add support to map and unmap the irq space and manage irq registrations
with the kernel for each allocated AFU interrupt. Also support mapping
the physical trigger page to obtain an effective address that will be
provided to the cxlflash core in a future commit.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support AFU interrupt management
Uma Krishnan [Wed, 20 Dec 2017 05:32:40 +0000 (23:32 -0600)]
UBUNTU: SAUCE: cxlflash: Support AFU interrupt management

BugLink: http://bugs.launchpad.net/bugs/1752672
Add support to allocate and free AFU interrupts using the OCXL provider
services. The trigger page returned upon successful allocation will be
mapped and exposed to the cxlflash core in a future commit.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support process element lifecycle
Uma Krishnan [Fri, 17 Nov 2017 22:03:24 +0000 (16:03 -0600)]
UBUNTU: SAUCE: cxlflash: Support process element lifecycle

BugLink: http://bugs.launchpad.net/bugs/1752672
As part of the context lifecycle, the associated process element within
the Shared Process Area (SPA) of the link must be updated. Each process
is defined by various parameters (pid, tid, PASID mm) that are stored in
the SPA upon starting a context and invalidated when a context is stopped.

Use the OCXL provider services to configure the SPA with the appropriate
data that is unique to the process when starting a context. Initially only
kernel contexts are supported and therefore these process values are not
applicable. Note that the OCXL service used has an optional callback for
translation fault error notification. While not used here, it will be
expanded in a future commit.

Also add a service to stop a context by terminating the corresponding
PASID and remove the process element from the SPA.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Setup OCXL transaction layer
Uma Krishnan [Thu, 16 Nov 2017 21:18:17 +0000 (15:18 -0600)]
UBUNTU: SAUCE: cxlflash: Setup OCXL transaction layer

BugLink: http://bugs.launchpad.net/bugs/1752672
The first function of the link needs to configure the transaction layer
between the host and device. This is accomplished by a call to the OCXL
provider services.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Setup function OCXL link
Uma Krishnan [Thu, 16 Nov 2017 21:13:24 +0000 (15:13 -0600)]
UBUNTU: SAUCE: cxlflash: Setup function OCXL link

BugLink: http://bugs.launchpad.net/bugs/1752672
After reading and modifying the function configuration, setup the OCXL
link using the OCXL provider services. The link is released when the
adapter is unconfigured.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support reading adapter VPD data
Uma Krishnan [Tue, 14 Nov 2017 19:45:00 +0000 (13:45 -0600)]
UBUNTU: SAUCE: cxlflash: Support reading adapter VPD data

BugLink: http://bugs.launchpad.net/bugs/1752672
Use the PCI VPD services to support reading the VPD data of the
underlying adapter.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support AFU state toggling
Uma Krishnan [Tue, 14 Nov 2017 19:13:06 +0000 (13:13 -0600)]
UBUNTU: SAUCE: cxlflash: Support AFU state toggling

BugLink: http://bugs.launchpad.net/bugs/1752672
The AFU should be enabled following a successful configuration and
disabled near the end of the cleanup path.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support process specific mappings
Uma Krishnan [Mon, 13 Nov 2017 22:20:53 +0000 (16:20 -0600)]
UBUNTU: SAUCE: cxlflash: Support process specific mappings

BugLink: http://bugs.launchpad.net/bugs/1752672
Once the context is started, the assigned MMIO space can be mapped
and unmapped. Provide means to map and unmap the context MMIO space.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support starting an adapter context
Uma Krishnan [Mon, 13 Nov 2017 21:59:43 +0000 (15:59 -0600)]
UBUNTU: SAUCE: cxlflash: Support starting an adapter context

BugLink: http://bugs.launchpad.net/bugs/1752672
Once the adapter context is created, it needs to be started by assigning
the MMIO space for the context and by enabling the process element in the
link. This commit adds the skeleton for starting the context and assigns
the context specific MMIO space. Master contexts have access to the global
MMIO space while the rest have access to the context specific space.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: MMIO map the AFU
Uma Krishnan [Tue, 31 Oct 2017 19:30:35 +0000 (14:30 -0500)]
UBUNTU: SAUCE: cxlflash: MMIO map the AFU

BugLink: http://bugs.launchpad.net/bugs/1752672
When the AFU is configured, the global and per process MMIO regions
are presented by the configuration space. Save these regions and
map the global MMIO region that is used to access all of the control
and provisioning data in the AFU.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support image reload policy modification
Uma Krishnan [Tue, 24 Oct 2017 19:32:41 +0000 (14:32 -0500)]
UBUNTU: SAUCE: cxlflash: Support image reload policy modification

BugLink: http://bugs.launchpad.net/bugs/1752672
On a PERST, the AFU image can be reloaded or left intact. Provide means to
set this image reload policy.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support adapter context discovery
Uma Krishnan [Mon, 30 Oct 2017 20:45:55 +0000 (15:45 -0500)]
UBUNTU: SAUCE: cxlflash: Support adapter context discovery

BugLink: http://bugs.launchpad.net/bugs/1752672
Provide means to obtain the process element of an adapter context as well
as locate an adapter context by file.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Support adapter file descriptors for OCXL
Uma Krishnan [Mon, 30 Oct 2017 18:37:38 +0000 (13:37 -0500)]
UBUNTU: SAUCE: cxlflash: Support adapter file descriptors for OCXL

BugLink: http://bugs.launchpad.net/bugs/1752672
Allocate a file descriptor for an adapter context when requested. In order
to allocate inodes for the file descriptors, a pseudo filesystem is created
and used.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Use IDR to manage adapter contexts
Uma Krishnan [Thu, 26 Oct 2017 19:35:21 +0000 (14:35 -0500)]
UBUNTU: SAUCE: cxlflash: Use IDR to manage adapter contexts

BugLink: http://bugs.launchpad.net/bugs/1752672
A range of PASIDs are used as identifiers for the adapter contexts. These
contexts may be destroyed and created randomly. Use an IDR to keep track
of contexts that are in use and assign a unique identifier to new ones.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Adapter context support for OCXL
Uma Krishnan [Thu, 26 Oct 2017 17:41:19 +0000 (12:41 -0500)]
UBUNTU: SAUCE: cxlflash: Adapter context support for OCXL

BugLink: http://bugs.launchpad.net/bugs/1752672
Add support to create and release the adapter contexts for OCXL and
provide means to specify certain contexts as a master.

The existing cxlflash core has a design requirement that each host will
have a single host context available by default. To satisfy this
requirement, one host adapter context is created when the hardware AFU is
initialized. This is returned by the get_context() fop.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Setup AFU PASID
Uma Krishnan [Tue, 7 Nov 2017 20:04:36 +0000 (14:04 -0600)]
UBUNTU: SAUCE: cxlflash: Setup AFU PASID

BugLink: http://bugs.launchpad.net/bugs/1752672
Per the OCXL specification, the maximum PASID supported by the AFU is
indicated by a field within the configuration space. Similar to acTags,
implementations can choose to use any sub-range of PASID within their
assigned range. For cxlflash, the entire range is used.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Setup AFU acTag range
Uma Krishnan [Tue, 7 Nov 2017 19:40:55 +0000 (13:40 -0600)]
UBUNTU: SAUCE: cxlflash: Setup AFU acTag range

BugLink: http://bugs.launchpad.net/bugs/1752672
The OCXL specification supports distributing acTags amongst different
AFUs and functions on the link. As cxlflash devices are expected to only
support a single AFU and function, the entire range that was assigned to
the function is also assigned to the AFU.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Read host AFU configuration
Uma Krishnan [Tue, 7 Nov 2017 18:01:19 +0000 (12:01 -0600)]
UBUNTU: SAUCE: cxlflash: Read host AFU configuration

BugLink: http://bugs.launchpad.net/bugs/1752672
The host AFU configuration is read on the initialization path to identify
the features and configuration of the AFU. This data is cached for use in
later configuration steps.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Setup function acTag range
Uma Krishnan [Tue, 7 Nov 2017 17:05:40 +0000 (11:05 -0600)]
UBUNTU: SAUCE: cxlflash: Setup function acTag range

BugLink: http://bugs.launchpad.net/bugs/1752672
The OCXL specification supports distributing acTags amongst different
AFUs and functions on the link. The platform-specific acTag range for the
link is obtained using the OCXL provider services and then assigned to the
host function based on implementation. For cxlflash devices only a single
function per host is expected and thus the entire range is assigned.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Read host function configuration
Uma Krishnan [Tue, 31 Oct 2017 19:12:43 +0000 (14:12 -0500)]
UBUNTU: SAUCE: cxlflash: Read host function configuration

BugLink: http://bugs.launchpad.net/bugs/1752672
Per the OCXL specification, the underlying host can have multiple AFUs
per function with each function supporting its own configuration. The host
function configuration is read on the initialization path to evaluate the
number of functions present and identify the features and configuration of
the functions present. This data is cached for use in later configuration
steps. Note that for the OCXL hardware supported by the cxlflash driver,
only one AFU per function is expected.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Hardware AFU for OCXL
Uma Krishnan [Tue, 24 Oct 2017 19:04:29 +0000 (14:04 -0500)]
UBUNTU: SAUCE: cxlflash: Hardware AFU for OCXL

BugLink: http://bugs.launchpad.net/bugs/1752672
When an adapter is initialized, transport specific configuration and MMIO
mapping details need to be saved. For CXL, this data is managed by the
underlying kernel module. To maintain a separation between the cxlflash
core and underlying transports, introduce a new structure to store data
specific to the OCXL AFU.

Initially only the pointers to underlying PCI and generic devices are
added to this new structure - it will be expanded further in future
commits. Services to create and destroy this hardware AFU are added and
integrated in the probe and exit paths of the driver.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Introduce OCXL backend
Uma Krishnan [Tue, 17 Oct 2017 20:11:03 +0000 (15:11 -0500)]
UBUNTU: SAUCE: cxlflash: Introduce OCXL backend

BugLink: http://bugs.launchpad.net/bugs/1752672
Add initial infrastructure to support a new cxlflash transport, OCXL.

Claim a dependency on OCXL and add a new file, ocxl_hw.c, which will host
the backend routines that are specific to OCXL.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Add argument identifier names
Uma Krishnan [Mon, 12 Feb 2018 21:56:37 +0000 (15:56 -0600)]
UBUNTU: SAUCE: cxlflash: Add argument identifier names

BugLink: http://bugs.launchpad.net/bugs/1752672
Checkpatch throws a warning when the argument identifier names are not
included in the function definitions.

To avoid these warnings, argument identifiers are added in the existing
function definitions.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Avoid clobbering context control register value
Matthew R. Ochs [Mon, 12 Feb 2018 06:25:09 +0000 (00:25 -0600)]
UBUNTU: SAUCE: cxlflash: Avoid clobbering context control register value

BugLink: http://bugs.launchpad.net/bugs/1752672
The SISLite specification originally defined the context control
register with a single field of bits to represent the LISN and
also stipulated that the register reset value be 0. The cxlflash
driver took advantage of this when programming the LISN for the
master contexts via an unconditional write - no other bits were
preserved.

When unmap support was added, SISLite was updated to define bit
0 of the context control register as a way for the AFU to notify
the context owner that unmap operations were supported. Thus the
assumptions under which the register is setup changed and the
existing unconditional write is clobbering the unmap state for
master contexts. This is presently not an issue due to the order
in which the context control register is programmed in relation to
the unmap bit being queried but should be addressed to avoid a
future regression in the event this code is moved elsewhere.

To remedy this issue, preserve the bits when programming the LISN
field in the context control register. Since the LISN will now be
programmed using a read value, assert that the initial state of the
LISN field is as described in SISLite (0).

Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoUBUNTU: SAUCE: cxlflash: Preserve number of interrupts for master contexts
Uma Krishnan [Tue, 20 Feb 2018 01:27:04 +0000 (19:27 -0600)]
UBUNTU: SAUCE: cxlflash: Preserve number of interrupts for master contexts

BugLink: http://bugs.launchpad.net/bugs/1752672
The number of interrupts requested for user contexts are stored in the
context specific structures and utilized to manage the interrupts. For the
master contexts, this number is only used once and therefore not saved.

To prepare for future commits where the number of interrupts will be
required in more than one place, preserve the value in the master context
structure.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoscsi: cxlflash: Staging to support future accelerators
Matthew R. Ochs [Wed, 3 Jan 2018 22:55:26 +0000 (16:55 -0600)]
scsi: cxlflash: Staging to support future accelerators

BugLink: http://bugs.launchpad.net/bugs/1752672
As staging to support future accelerator transports, add a shim layer
such that the underlying services the cxlflash driver requires can be
conditional upon the accelerator infrastructure.

Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 25b8e08e83b5bc58967aae566730548f407c0439)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoscsi: cxlflash: Adapter context init can return error
Uma Krishnan [Wed, 3 Jan 2018 22:55:04 +0000 (16:55 -0600)]
scsi: cxlflash: Adapter context init can return error

BugLink: http://bugs.launchpad.net/bugs/1752672
Adapter context creation can return either NULL or an error pointer.
Updating the check condition to reflect this.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 0df69c6024cd089144d3b38f12352899dd4e40b1)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoscsi: cxlflash: Remove embedded CXL work structures
Matthew R. Ochs [Wed, 3 Jan 2018 22:54:50 +0000 (16:54 -0600)]
scsi: cxlflash: Remove embedded CXL work structures

BugLink: http://bugs.launchpad.net/bugs/1752672
The CXL-specific work structure used to request the number of interrupts
currently resides as a nested member of both the context information and
hardware queue structures. It is used to cache values (specifically the
number of interrupts) required by the CXL layer when starting a context.

To facilitate staging that will ultimately allow the cxlflash core to
become agnostic of the underlying accelerator transport, remove these
embedded work structures.

Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 8762353106c4376deabd76473e1bd7ba36dd529c)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoscsi: cxlflash: Explicitly cache number of interrupts per context
Matthew R. Ochs [Wed, 3 Jan 2018 22:54:37 +0000 (16:54 -0600)]
scsi: cxlflash: Explicitly cache number of interrupts per context

BugLink: http://bugs.launchpad.net/bugs/1752672
The number of interrupts a user requests during a context attach is
presently stored within the CXL work ioctl structure that is nested
alongside the per context metadata. Keeping this data in a structure
that is tied to a particular hardware implementation (CXL) will only
complicate matters when supporting newer accelerator transports.

Instead of relying upon the number of interrupts being cached within
a CXL-specific structure, explicitly cache the value within the context
information structure.

Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit af2047ec00bfd61b46b653e856dcf1e0bc567619)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoscsi: cxlflash: Update cxl-specific arguments to generic cookie
Uma Krishnan [Wed, 3 Jan 2018 22:54:25 +0000 (16:54 -0600)]
scsi: cxlflash: Update cxl-specific arguments to generic cookie

BugLink: http://bugs.launchpad.net/bugs/1752672
Convert cxl-specific pointers to generic cookies to facilitate future
enhancements.

Signed-off-by: Uma Krishnan <ukrishn@linux.vnet.ibm.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit b070545db112e4c815fbfce25449495eff20c170)
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
6 years agoplatform/x86: intel_pmc_core: Special case for Coffeelake
Rajneesh Bhardwaj [Fri, 2 Feb 2018 13:43:37 +0000 (19:13 +0530)]
platform/x86: intel_pmc_core: Special case for Coffeelake

BugLink: http://bugs.launchpad.net/bugs/1730770
Intel CoffeeLake SoC uses CPU ID of KabyLake but has Cannonlake PCH, so in
this case PMC register details from Cannonlake PCH must be used.

In order to identify whether the given platform is Coffeelake, scan for the
Sunrisepoint PMC PCI Id.

 KBL CPUID SPT PCIID
------------------------------------
KBL | Y | Y   |
------------------------------------
CFL | Y | N   |
------------------------------------

Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
(cherry picked from commit 661405bd817b209ac9bd4812c63d90873a7f2993)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoplatform/x86: intel_pmc_core: Add CannonLake PCH support
Rajneesh Bhardwaj [Fri, 2 Feb 2018 13:43:36 +0000 (19:13 +0530)]
platform/x86: intel_pmc_core: Add CannonLake PCH support

BugLink: http://bugs.launchpad.net/bugs/1730770
This adds support for Cannonlake PCH which is used by Cannonlake and
Coffeelake SoCs.

Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
(cherry picked from commit 291101f6a73566f5d1ab597784288c5bc85906fd)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agox86/cpu: Add Cannonlake to Intel family
Rajneesh Bhardwaj [Fri, 2 Feb 2018 13:43:35 +0000 (19:13 +0530)]
x86/cpu: Add Cannonlake to Intel family

BugLink: http://bugs.launchpad.net/bugs/1730770
Add CPUID of Cannonlake (CNL) processors to Intel family list.

Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: x86@kernel.org
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Suggested-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
(cherry picked from commit 850eb9fba3711e98bafebde26675d9c082c0ff48)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoplatform/x86: intel_pmc_core: Read base address from LPIT
Srinivas Pandruvada [Fri, 2 Feb 2018 13:43:34 +0000 (19:13 +0530)]
platform/x86: intel_pmc_core: Read base address from LPIT

BugLink: http://bugs.launchpad.net/bugs/1730770
Read SLP_S0 address from ACPI LPIT table when present and use PMC
specific SLP_S0 offset to get the base address of PMC MMIO.

Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
(cherry picked from commit 745698c37c08f48fb5ad3c0cb7ee955bd5701d4a)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoACPI / LPIT: Export lpit_read_residency_count_address()
Srinivas Pandruvada [Fri, 2 Feb 2018 13:43:33 +0000 (19:13 +0530)]
ACPI / LPIT: Export lpit_read_residency_count_address()

BugLink: http://bugs.launchpad.net/bugs/1730770
Export lpit_read_residency_count_address(), so that it can be used from
drivers built as module. With the recent changes, the builtin_pci
functionality of the intel_pmc_core driver is removed and now it can be
built as a module to read this exported interface to calculate the PMC base
address.

Cc: Rafael J. Wysocki <rjw@rjwysocki.net>
Cc: Len Brown <lenb@kernel.org>
Cc: linux-acpi@vger.kernel.org
Acked-by: Rafael J. Wysocki <rafael@kernel.org>
Tested-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
(cherry picked from commit 9383bbadfe29fe8319e2245b75a508db9abd7b87)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoplatform/x86: intel_pmc_core: Remove unused header file
Rajneesh Bhardwaj [Wed, 31 Jan 2018 06:20:22 +0000 (11:50 +0530)]
platform/x86: intel_pmc_core: Remove unused header file

BugLink: http://bugs.launchpad.net/bugs/1730770
Recently sent patch 'platform/x86: intel_pmc_core: Remove unused EXPORTED
API' missed to remove the header file 'arch/x86/include/asm/pmc_core.h'
which was solely used to declare the EXPORTED API
'intel_pmc_slp_s0_counter_read'. This patch provides the errata fix for the
same.

Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
(cherry picked from commit 941691ef2197944a202d7870dcd7da3fb0391c65)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoplatform/x86: intel_pmc_core: Convert to ICPU macro
Rajneesh Bhardwaj [Fri, 19 Jan 2018 08:58:24 +0000 (14:28 +0530)]
platform/x86: intel_pmc_core: Convert to ICPU macro

BugLink: http://bugs.launchpad.net/bugs/1730770
Use ICPU macro to refactor code related to x86_cpu_id for better
readability.

Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
(cherry picked from commit 00f8b2fce4da2296bafc1de6a46510a13ef60938)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoplatform/x86: intel_pmc_core: Substitute PCI with CPUID enumeration
Srinivas Pandruvada [Fri, 19 Jan 2018 08:58:21 +0000 (14:28 +0530)]
platform/x86: intel_pmc_core: Substitute PCI with CPUID enumeration

BugLink: http://bugs.launchpad.net/bugs/1730770
The Only use of PCI device enumeration here is to get the PMC base address
which is a fixed value i.e. 0xFE000000. On some platforms this can be read
through a non standard PCI BAR. But after Kabylake, PMC is not exposed as a
PCI device anymore. There are other non standard methods like ACPI LPIT
which can also be used for obtaining this value.

For simplicity, this value can be hardcoded as it won't change.

Since we don't have a PMC PCI device on any platform after Kabylake, this
creates a foundation for future SoC support.

Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
(cherry picked from commit 21ae43570940f8393a80369f62a3880bd64daad8)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoplatform/x86: intel_pmc_core: Refactor debugfs entries
Rajneesh Bhardwaj [Fri, 19 Jan 2018 08:58:20 +0000 (14:28 +0530)]
platform/x86: intel_pmc_core: Refactor debugfs entries

BugLink: http://bugs.launchpad.net/bugs/1730770
When on a platform if we can't show MPHY and PLL status, don't even bother
to create a debugfs entry as it will fail anyway. In fact unless OEM builds
a special BIOS for test, it will fail on every production system.

This will help to add future platform support where we can't support these
entries.

Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
(cherry picked from commit 750e0f570b7145870d40f07337f3356c18e0abd4)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoplatform/x86: intel_pmc_core: Fix file permission warnings
Rajneesh Bhardwaj [Thu, 11 Jan 2018 11:10:35 +0000 (16:40 +0530)]
platform/x86: intel_pmc_core: Fix file permission warnings

BugLink: http://bugs.launchpad.net/bugs/1730770
Symbolic permissions 'S_IRUGO' are not preferred. This patch changes the
debugfs files to use octal permissions '0644' or '0444' as needed by the
attribute.

Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
(cherry picked from commit 1f644da7e920cb83403818efa88ebfb6d1528264)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoplatform/x86: intel_pmc_core: Change driver to a module
Srinivas Pandruvada [Thu, 11 Jan 2018 11:10:34 +0000 (16:40 +0530)]
platform/x86: intel_pmc_core: Change driver to a module

BugLink: http://bugs.launchpad.net/bugs/1730770
Allow the driver to be a module since builtin_pci_driver funtionality is no
longer needed.

Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
(cherry picked from commit 2854a0aa822c11ea8538ebfe94a62e20ab570e2b)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoplatform/x86: intel_pmc_core: Remove unused EXPORTED API
Rajneesh Bhardwaj [Thu, 11 Jan 2018 11:10:31 +0000 (16:40 +0530)]
platform/x86: intel_pmc_core: Remove unused EXPORTED API

BugLink: http://bugs.launchpad.net/bugs/1730770
Though ChromeOs uses the exported API as part of their S0ix failsafe
mechanism, there is no active consumer of this API in upstream kernel.

We can revisit this when ChromeOs kernel team is able to get their S0ix
failsafe framework in mainline.

Cc: Derek Basehore <dbasehore@chromium.org>
Cc: Rajat Jain <rajatja@google.com>
Link: https://patchwork.kernel.org/patch/9831229/
Suggested-by: Andriy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
(cherry picked from commit 12d614a0dcaee9668c641fcaa9f524da861a765e)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoKVM: PPC: Book3S HV: Fix guest time accounting with VIRT_CPU_ACCOUNTING_GEN
Laurent Vivier [Fri, 23 Mar 2018 20:03:03 +0000 (16:03 -0400)]
KVM: PPC: Book3S HV: Fix guest time accounting with VIRT_CPU_ACCOUNTING_GEN

BugLink: http://bugs.launchpad.net/bugs/1755979
Since commit 8b24e69fc47e ("KVM: PPC: Book3S HV: Close race with testing
for signals on guest entry"), if CONFIG_VIRT_CPU_ACCOUNTING_GEN is set, the
guest time is not accounted to guest time and user time, but instead to
system time.

This is because guest_enter()/guest_exit() are called while interrupts
are disabled and the tick counter cannot be updated between them.

To fix that, move guest_exit() after local_irq_enable(), and as
guest_enter() is called with IRQ disabled, call guest_enter_irqoff()
instead.

Fixes: 8b24e69fc47e ("KVM: PPC: Book3S HV: Close race with testing for signals on guest entry")
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
(cherry picked from commit 61bd0f66ff92d5ce765ff9850fd3cbfec773c560)
Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoUBUNTU: SAUCE: drm/i915: make previous commit affects Wyse 3040 only
Wen-chien Jesse Sung [Fri, 23 Mar 2018 16:54:28 +0000 (00:54 +0800)]
UBUNTU: SAUCE: drm/i915: make previous commit affects Wyse 3040 only

BugLink: https://launchpad.net/bugs/1736393
Signed-off-by: Wen-chien Jesse Sung <jesse.sung@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoUBUNTU: SAUCE: drm/i915:Don't set chip specific data
Raymond Liu [Fri, 23 Mar 2018 16:54:27 +0000 (00:54 +0800)]
UBUNTU: SAUCE: drm/i915:Don't set chip specific data

BugLink: https://launchpad.net/bugs/1736393
This chip data is unused and cause panic after
the cycle of cpu offline/online

Signed-off-by: Raymond Liu <raymondx.liu@intel.com>
Signed-off-by: Wen-chien Jesse Sung <jesse.sung@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoHID: intel-ish-hid: Enable Cannon Lake and Coffee Lake laptop/desktop
Srinivas Pandruvada [Fri, 23 Mar 2018 16:34:47 +0000 (09:34 -0700)]
HID: intel-ish-hid: Enable Cannon Lake and Coffee Lake laptop/desktop

BugLink: https://bugs.launchpad.net/bugs/1739522
Added PCI ID for Cannon Lake and Coffee Lake laptop/desktop skews.

Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
(cherry picked from commit 7103f6b23392c0a57ceba7915f72fa7bf11d2a90)
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Acked-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoath9k: add a quirk to set use_msi automatically
AceLan Kao [Wed, 21 Mar 2018 01:55:19 +0000 (09:55 +0800)]
ath9k: add a quirk to set use_msi automatically

BugLink: https://bugs.launchpad.net/bugs/1727228
Some platform(BIOS) blocks legacy interrupts (INTx), and only allows MSI
for WLAN device. So adding a quirk to list those machines and set
use_msi automatically.
Adding the following platforms to the quirk.
   Dell Inspiron 24-3460
   Dell Inspiron 3472
   Dell Inspiron 14-3473
   Dell Vostro 3262
   Dell Vostro 15-3572

Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
(cherry picked from commit 3153b68e4d1a0b6c9d75cf4fe419229890ee15d5)
Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoath9k: add MSI support
Russell Hu [Wed, 21 Mar 2018 01:55:18 +0000 (09:55 +0800)]
ath9k: add MSI support

BugLink: https://bugs.launchpad.net/bugs/1727228
On new Intel platforms like ApolloLake, legacy interrupt mechanism
(INTx) is not supported, so WLAN modules are not working because
interrupts are missing, therefore this patch is to add MSI support to
ath9k.  With module paremeter "use_msi=1", ath9k driver would try to
use MSI instead of INTx.

Signed-off-by: Russell Hu <rhu@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
(cherry picked from commit 7368160f0ab0b1c2c9d95fc52dca1e7ec62201a4)
Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoiperf vendor events: Use more flexible pattern matching for CPU identification for...
William Cohen [Thu, 15 Mar 2018 13:57:27 +0000 (10:57 -0300)]
iperf vendor events: Use more flexible pattern matching for CPU identification for mapfile.csv

BugLink: https://bugs.launchpad.net/bugs/1755470
The powerpc cpuid information includes chip revision information.
Changes between chip revisions are usually minor bug fixes and usually
do not affect the operation of the performance monitoring hardware.

The original mapfile.csv matching requires enumerating every possible
cpuid string.  When a new minor chip revision is produced a new entry
has to be added to the mapfile.csv and the code recompiled to allow perf
to have the implementation specific perf events for this new minor
revision.  For users of various distibutions of Linux having to wait for
a new release of the kernel's perf tool to be built with these trivial
patches is inconvenient.

Using regular expressions rather than exactly string matching of the
entire cpuid string allows developers to write mapfile.csv files that do
not require patches and recompiles for each of these minor version
changes.  If special cases need to be made for some particular versions,
they can be placed earlier in the mapfile.csv file before the more
general matches.

Signed-off-by: William Cohen <wcohen@redhat.com>
Tested-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Michael Petlan <mpetlan@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Shriya <shriyak@linux.vnet.ibm.com>
Link: http://lkml.kernel.org/r/20171204145728.16792-1-wcohen@redhat.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
(cherry-picked from fbc2844e84038ce3687d203ac80b66194e9f21e6)
Signed-off-by: Gustavo Walbon <gwalbon@linux.vnet.ibm.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoUBUNTU: SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)
Colin Ian King [Mon, 26 Mar 2018 11:11:18 +0000 (12:11 +0100)]
UBUNTU: SAUCE: Fix non-prefaulted page deadlock (LP: #1754584)

BugLink: https://bugs.launchpad.net/bugs/1754584
Fix mmap'd libaio read on non-prefaulted page deadlock. This is a hot fix
from ZFS upstream that ensure pages are pre-faulted in to avoid deadlock.
Performing a read with the target data in a mmap'd page that is map'd into
the same blocks that are being read causes a lock on the page and a further
lock on the same page when the page is being faulted in, causing deadlock.
The current workaround is to prefault the page(s) before the pages are
read.

This is no current upstream commit ID for this fix, as it landed late on
Friday and it's not commited to upstream ZFS. The fix has passed our ZFS
regression tests and fixes the issue, so I'd like to get this included
into Bionic sooner than later.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoUBUNTU: SAUCE: Fix ioctl loop-spin in zed (LP: #1751796)
Colin Ian King [Mon, 26 Mar 2018 10:58:14 +0000 (11:58 +0100)]
UBUNTU: SAUCE: Fix ioctl loop-spin in zed (LP: #1751796)

BugLink: https://bugs.launchpad.net/bugs/1751796
Add ZFS 0.6.x kernel ioctl binary compat shim, detect ZFS kernel driver
version and copy zfs ioctl command to the newer ZFS 0.7.0 ioctl command layout.
This allows zed to be upgraded from a pre-0.7.0 ZFS to 0.7.0 without causing
ioctl breakage.

This patch sync's the kernel drivers to the module fixes in userspace, introduced
in version zfsutils-linux 0.7.5-1ubuntu8.  No functional change in the kernel drivers;
this just adds compat structures to allow userspace to copy ioctl data appropriately
in the userspace tools.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoLinux 4.15.13
Greg Kroah-Hartman [Sat, 24 Mar 2018 10:02:53 +0000 (11:02 +0100)]
Linux 4.15.13

BugLink: http://bugs.launchpad.net/bugs/1758886
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoRDMA/ucma: Don't allow join attempts for unsupported AF family
Leon Romanovsky [Tue, 13 Mar 2018 16:37:27 +0000 (18:37 +0200)]
RDMA/ucma: Don't allow join attempts for unsupported AF family

BugLink: http://bugs.launchpad.net/bugs/1758886
commit 0c81ffc60d5280991773d17e84bda605387148b1 upstream.

Users can provide garbage while calling to ucma_join_ip_multicast(),
it will indirectly cause to rdma_addr_size() return 0, making the
call to ucma_process_join(), which had the right checks, but it is
better to check the input as early as possible.

The following crash from syzkaller revealed it.

kernel BUG at lib/string.c:1052!
invalid opcode: 0000 [#1] SMP KASAN Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 4113 Comm: syz-executor0 Not tainted 4.16.0-rc5+ #261
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:fortify_panic+0x13/0x20 lib/string.c:1051
RSP: 0018:ffff8801ca81f8f0 EFLAGS: 00010286
RAX: 0000000000000022 RBX: 1ffff10039503f23 RCX: 0000000000000000
RDX: 0000000000000022 RSI: 1ffff10039503ed3 RDI: ffffed0039503f12
RBP: ffff8801ca81f8f0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000006 R11: 0000000000000000 R12: ffff8801ca81f998
R13: ffff8801ca81f938 R14: ffff8801ca81fa58 R15: 000000000000fa00
FS:  0000000000000000(0000) GS:ffff8801db200000(0063) knlGS:000000000a12a900
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000008138024 CR3: 00000001cbb58004 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 memcpy include/linux/string.h:344 [inline]
 ucma_join_ip_multicast+0x36b/0x3b0 drivers/infiniband/core/ucma.c:1421
 ucma_write+0x2d6/0x3d0 drivers/infiniband/core/ucma.c:1633
 __vfs_write+0xef/0x970 fs/read_write.c:480
 vfs_write+0x189/0x510 fs/read_write.c:544
 SYSC_write fs/read_write.c:589 [inline]
 SyS_write+0xef/0x220 fs/read_write.c:581
 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 do_fast_syscall_32+0x3ec/0xf9f arch/x86/entry/common.c:392
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f9ec99
RSP: 002b:00000000ff8172cc EFLAGS: 00000282 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000100
RDX: 0000000000000063 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Code: 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b 48 89 df e8 42 2c e3 fb eb de
55 48 89 fe 48 c7 c7 80 75 98 86 48 89 e5 e8 85 95 94 fb <0f> 0b 90 90 90 90
90 90 90 90 90 90 90 55 48 89 e5 41 57 41 56
RIP: fortify_panic+0x13/0x20 lib/string.c:1051 RSP: ffff8801ca81f8f0

Fixes: 5bc2b7b397b0 ("RDMA/ucma: Allow user space to specify AF_IB when joining multicast")
Reported-by: <syzbot+2287ac532caa81900a4e@syzkaller.appspotmail.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoRDMA/ucma: Fix access to non-initialized CM_ID object
Leon Romanovsky [Tue, 13 Mar 2018 09:43:23 +0000 (11:43 +0200)]
RDMA/ucma: Fix access to non-initialized CM_ID object

BugLink: http://bugs.launchpad.net/bugs/1758886
commit 7688f2c3bbf55e52388e37ac5d63ca471a7712e1 upstream.

The attempt to join multicast group without ensuring that CMA device
exists will lead to the following crash reported by syzkaller.

[   64.076794] BUG: KASAN: null-ptr-deref in rdma_join_multicast+0x26e/0x12c0
[   64.076797] Read of size 8 at addr 00000000000000b0 by task join/691
[   64.076797]
[   64.076800] CPU: 1 PID: 691 Comm: join Not tainted 4.16.0-rc1-00219-gb97853b65b93 #23
[   64.076802] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-proj4
[   64.076803] Call Trace:
[   64.076809]  dump_stack+0x5c/0x77
[   64.076817]  kasan_report+0x163/0x380
[   64.085859]  ? rdma_join_multicast+0x26e/0x12c0
[   64.086634]  rdma_join_multicast+0x26e/0x12c0
[   64.087370]  ? rdma_disconnect+0xf0/0xf0
[   64.088579]  ? __radix_tree_replace+0xc3/0x110
[   64.089132]  ? node_tag_clear+0x81/0xb0
[   64.089606]  ? idr_alloc_u32+0x12e/0x1a0
[   64.090517]  ? __fprop_inc_percpu_max+0x150/0x150
[   64.091768]  ? tracing_record_taskinfo+0x10/0xc0
[   64.092340]  ? idr_alloc+0x76/0xc0
[   64.092951]  ? idr_alloc_u32+0x1a0/0x1a0
[   64.093632]  ? ucma_process_join+0x23d/0x460
[   64.094510]  ucma_process_join+0x23d/0x460
[   64.095199]  ? ucma_migrate_id+0x440/0x440
[   64.095696]  ? futex_wake+0x10b/0x2a0
[   64.096159]  ucma_join_multicast+0x88/0xe0
[   64.096660]  ? ucma_process_join+0x460/0x460
[   64.097540]  ? _copy_from_user+0x5e/0x90
[   64.098017]  ucma_write+0x174/0x1f0
[   64.098640]  ? ucma_resolve_route+0xf0/0xf0
[   64.099343]  ? rb_erase_cached+0x6c7/0x7f0
[   64.099839]  __vfs_write+0xc4/0x350
[   64.100622]  ? perf_syscall_enter+0xe4/0x5f0
[   64.101335]  ? kernel_read+0xa0/0xa0
[   64.103525]  ? perf_sched_cb_inc+0xc0/0xc0
[   64.105510]  ? syscall_exit_register+0x2a0/0x2a0
[   64.107359]  ? __switch_to+0x351/0x640
[   64.109285]  ? fsnotify+0x899/0x8f0
[   64.111610]  ? fsnotify_unmount_inodes+0x170/0x170
[   64.113876]  ? __fsnotify_update_child_dentry_flags+0x30/0x30
[   64.115813]  ? ring_buffer_record_is_on+0xd/0x20
[   64.117824]  ? __fget+0xa8/0xf0
[   64.119869]  vfs_write+0xf7/0x280
[   64.122001]  SyS_write+0xa1/0x120
[   64.124213]  ? SyS_read+0x120/0x120
[   64.126644]  ? SyS_read+0x120/0x120
[   64.128563]  do_syscall_64+0xeb/0x250
[   64.130732]  entry_SYSCALL_64_after_hwframe+0x21/0x86
[   64.132984] RIP: 0033:0x7f5c994ade99
[   64.135699] RSP: 002b:00007f5c99b97d98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   64.138740] RAX: ffffffffffffffda RBX: 00000000200001e4 RCX: 00007f5c994ade99
[   64.141056] RDX: 00000000000000a0 RSI: 00000000200001c0 RDI: 0000000000000015
[   64.143536] RBP: 00007f5c99b97ec0 R08: 0000000000000000 R09: 0000000000000000
[   64.146017] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5c99b97fc0
[   64.148608] R13: 0000000000000000 R14: 00007fff660e1c40 R15: 00007f5c99b989c0
[   64.151060]
[   64.153703] Disabling lock debugging due to kernel taint
[   64.156032] BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
[   64.159066] IP: rdma_join_multicast+0x26e/0x12c0
[   64.161451] PGD 80000001d0298067 P4D 80000001d0298067 PUD 1dea39067 PMD 0
[   64.164442] Oops: 0000 [#1] SMP KASAN PTI
[   64.166817] CPU: 1 PID: 691 Comm: join Tainted: G    B 4.16.0-rc1-00219-gb97853b65b93 #23
[   64.170004] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-proj4
[   64.174985] RIP: 0010:rdma_join_multicast+0x26e/0x12c0
[   64.177246] RSP: 0018:ffff8801c8207860 EFLAGS: 00010282
[   64.179901] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff94789522
[   64.183344] RDX: 1ffffffff2d50fa5 RSI: 0000000000000297 RDI: 0000000000000297
[   64.186237] RBP: ffff8801c8207a50 R08: 0000000000000000 R09: ffffed0039040ea7
[   64.189328] R10: 0000000000000001 R11: ffffed0039040ea6 R12: 0000000000000000
[   64.192634] R13: 0000000000000000 R14: ffff8801e2022800 R15: ffff8801d4ac2400
[   64.196105] FS:  00007f5c99b98700(0000) GS:ffff8801e5d00000(0000) knlGS:0000000000000000
[   64.199211] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   64.202046] CR2: 00000000000000b0 CR3: 00000001d1c48004 CR4: 00000000003606a0
[   64.205032] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   64.208221] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   64.211554] Call Trace:
[   64.213464]  ? rdma_disconnect+0xf0/0xf0
[   64.216124]  ? __radix_tree_replace+0xc3/0x110
[   64.219337]  ? node_tag_clear+0x81/0xb0
[   64.222140]  ? idr_alloc_u32+0x12e/0x1a0
[   64.224422]  ? __fprop_inc_percpu_max+0x150/0x150
[   64.226588]  ? tracing_record_taskinfo+0x10/0xc0
[   64.229763]  ? idr_alloc+0x76/0xc0
[   64.232186]  ? idr_alloc_u32+0x1a0/0x1a0
[   64.234505]  ? ucma_process_join+0x23d/0x460
[   64.237024]  ucma_process_join+0x23d/0x460
[   64.240076]  ? ucma_migrate_id+0x440/0x440
[   64.243284]  ? futex_wake+0x10b/0x2a0
[   64.245302]  ucma_join_multicast+0x88/0xe0
[   64.247783]  ? ucma_process_join+0x460/0x460
[   64.250841]  ? _copy_from_user+0x5e/0x90
[   64.253878]  ucma_write+0x174/0x1f0
[   64.257008]  ? ucma_resolve_route+0xf0/0xf0
[   64.259877]  ? rb_erase_cached+0x6c7/0x7f0
[   64.262746]  __vfs_write+0xc4/0x350
[   64.265537]  ? perf_syscall_enter+0xe4/0x5f0
[   64.267792]  ? kernel_read+0xa0/0xa0
[   64.270358]  ? perf_sched_cb_inc+0xc0/0xc0
[   64.272575]  ? syscall_exit_register+0x2a0/0x2a0
[   64.275367]  ? __switch_to+0x351/0x640
[   64.277700]  ? fsnotify+0x899/0x8f0
[   64.280530]  ? fsnotify_unmount_inodes+0x170/0x170
[   64.283156]  ? __fsnotify_update_child_dentry_flags+0x30/0x30
[   64.286182]  ? ring_buffer_record_is_on+0xd/0x20
[   64.288749]  ? __fget+0xa8/0xf0
[   64.291136]  vfs_write+0xf7/0x280
[   64.292972]  SyS_write+0xa1/0x120
[   64.294965]  ? SyS_read+0x120/0x120
[   64.297474]  ? SyS_read+0x120/0x120
[   64.299751]  do_syscall_64+0xeb/0x250
[   64.301826]  entry_SYSCALL_64_after_hwframe+0x21/0x86
[   64.304352] RIP: 0033:0x7f5c994ade99
[   64.306711] RSP: 002b:00007f5c99b97d98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   64.309577] RAX: ffffffffffffffda RBX: 00000000200001e4 RCX: 00007f5c994ade99
[   64.312334] RDX: 00000000000000a0 RSI: 00000000200001c0 RDI: 0000000000000015
[   64.315783] RBP: 00007f5c99b97ec0 R08: 0000000000000000 R09: 0000000000000000
[   64.318365] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5c99b97fc0
[   64.320980] R13: 0000000000000000 R14: 00007fff660e1c40 R15: 00007f5c99b989c0
[   64.323515] Code: e8 e8 79 08 ff 4c 89 ff 45 0f b6 a7 b8 01 00 00 e8 68 7c 08 ff 49 8b 1f 4d 89 e5 49 c1 e4 04 48 8
[   64.330753] RIP: rdma_join_multicast+0x26e/0x12c0 RSP: ffff8801c8207860
[   64.332979] CR2: 00000000000000b0
[   64.335550] ---[ end trace 0c00c17a408849c1 ]---

Reported-by: <syzbot+e6aba77967bd72cbc9d6@syzkaller.appspotmail.com>
Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoclk: migrate the count of orphaned clocks at init
Jerome Brunet [Wed, 14 Feb 2018 13:43:36 +0000 (14:43 +0100)]
clk: migrate the count of orphaned clocks at init

BugLink: http://bugs.launchpad.net/bugs/1758886
commit 99652a469df19086d594e8e89757d4081a812789 upstream.

The orphan clocks reparents should migrate any existing count from the
orphan clock to its new acestor clocks, otherwise we may have
inconsistent counts in the tree and end-up with gated critical clocks

Assuming we have two clocks, A and B.
* Clock A has CLK_IS_CRITICAL flag set.
* Clock B is an ancestor of A which can gate. Clock B gate is left
  enabled by the bootloader.

Step 1: Clock A is registered. Since it is a critical clock, it is
enabled. The clock being still an orphan, no parent are enabled.

Step 2: Clock B is registered and reparented to clock A (potentially
through several other clocks). We are now in situation where the enable
count of clock A is 1 while the enable count of its ancestors is 0, which
is not good.

Step 3: in lateinit, clk_disable_unused() is called, the enable_count of
clock B being 0, clock B is gated and and critical clock A actually gets
disabled.

This situation was found while adding fdiv_clk gates to the meson8b
platform.  These clocks parent clk81 critical clock, which is the mother
of all peripheral clocks in this system. Because of the issue described
here, the system is crashing when clk_disable_unused() is called.

The situation is solved by reverting
commit f8f8f1d04494 ("clk: Don't touch hardware when reparenting during registration").
To avoid breaking again the situation described in this commit
description, enabling critical clock should be done before walking the
orphan list. This way, a parent critical clock may not be accidentally
disabled due to the CLK_OPS_PARENT_ENABLE mechanism.

Fixes: f8f8f1d04494 ("clk: Don't touch hardware when reparenting during registration")
Cc: Stephen Boyd <sboyd@codeaurora.org>
Cc: Shawn Guo <shawnguo@kernel.org>
Cc: Dong Aisheng <aisheng.dong@nxp.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Michael Turquette <mturquette@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoRDMA/core: Do not use invalid destination in determining port reuse
Tatyana Nikolova [Mon, 12 Mar 2018 22:14:02 +0000 (17:14 -0500)]
RDMA/core: Do not use invalid destination in determining port reuse

BugLink: http://bugs.launchpad.net/bugs/1758886
commit 9dea9a2ff61c5efb4d4937ae23b14babd25a5547 upstream.

cma_port_is_unique() allows local port reuse if the quad (source
address and port, destination address and port) for this connection
is unique. However, if the destination info is zero or unspecified, it
can't make a correct decision but still allows port reuse. For example,
sometimes rdma_bind_addr() is called with unspecified destination and
reusing the port can lead to creating a connection with a duplicate quad,
after the destination is resolved. The issue manifests when MPI scale-up
tests hang after the duplicate quad is used.

Set the destination address family and add checks for zero destination
address and port to prevent source port reuse based on invalid destination.

Fixes: 19b752a19dce ("IB/cma: Allow port reuse for rdma_id")
Reviewed-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoserial: 8250_pci: Don't fail on multiport card class
Andy Shevchenko [Fri, 2 Feb 2018 18:39:13 +0000 (20:39 +0200)]
serial: 8250_pci: Don't fail on multiport card class

BugLink: http://bugs.launchpad.net/bugs/1758886
commit e7f3e99cb1a667d04d60d02957fbed58b50d4e5a upstream.

Do not fail on multiport cards in serial_pci_is_class_communication().

It restores behaviour for SUNIX multiport cards, that enumerated by
class and have a custom board data.

Moreover it allows users to reenumerate port-by-port from user space.

Fixes: 7d8905d06405 ("serial: 8250_pci: Enable device after we check black list")
Reported-by: Nikola Ciprich <nikola.ciprich@linuxbox.cz>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Tested-by: Nikola Ciprich <nikola.ciprich@linuxbox.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoRDMA/vmw_pvrdma: Fix usage of user response structures in ABI file
Adit Ranadive [Thu, 15 Feb 2018 20:36:46 +0000 (12:36 -0800)]
RDMA/vmw_pvrdma: Fix usage of user response structures in ABI file

BugLink: http://bugs.launchpad.net/bugs/1758886
commit 1f5a6c47aabc4606f91ad2e6ef71a1ff1924101c upstream.

This ensures that we return the right structures back to userspace.
Otherwise, it looks like the reserved fields in the response structures
in userspace might have uninitialized data in them.

Fixes: 8b10ba783c9d ("RDMA/vmw_pvrdma: Add shared receive queue support")
Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
Suggested-by: Jason Gunthorpe <jgg@mellanox.com>
Reviewed-by: Bryan Tan <bryantan@vmware.com>
Reviewed-by: Aditya Sarwade <asarwade@vmware.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: Adit Ranadive <aditr@vmware.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoIB/mlx5: Fix out-of-bounds read in create_raw_packet_qp_rq
Boris Pismenny [Thu, 8 Mar 2018 13:51:40 +0000 (15:51 +0200)]
IB/mlx5: Fix out-of-bounds read in create_raw_packet_qp_rq

BugLink: http://bugs.launchpad.net/bugs/1758886
commit 2c292dbb398ee46fc1343daf6c3cf9715a75688e upstream.

Add a check for the length of the qpin structure to prevent out-of-bounds reads

BUG: KASAN: slab-out-of-bounds in create_raw_packet_qp+0x114c/0x15e2
Read of size 8192 at addr ffff880066b99290 by task syz-executor3/549

CPU: 3 PID: 549 Comm: syz-executor3 Not tainted 4.15.0-rc2+ #27 Hardware
name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
Call Trace:
 dump_stack+0x8d/0xd4
 print_address_description+0x73/0x290
 kasan_report+0x25c/0x370
 ? create_raw_packet_qp+0x114c/0x15e2
 memcpy+0x1f/0x50
 create_raw_packet_qp+0x114c/0x15e2
 ? create_raw_packet_qp_tis.isra.28+0x13d/0x13d
 ? lock_acquire+0x370/0x370
 create_qp_common+0x2245/0x3b50
 ? destroy_qp_user.isra.47+0x100/0x100
 ? kasan_kmalloc+0x13d/0x170
 ? sched_clock_cpu+0x18/0x180
 ? fs_reclaim_acquire.part.15+0x5/0x30
 ? __lock_acquire+0xa11/0x1da0
 ? sched_clock_cpu+0x18/0x180
 ? kmem_cache_alloc_trace+0x17e/0x310
 ? mlx5_ib_create_qp+0x30e/0x17b0
 mlx5_ib_create_qp+0x33d/0x17b0
 ? sched_clock_cpu+0x18/0x180
 ? create_qp_common+0x3b50/0x3b50
 ? lock_acquire+0x370/0x370
 ? __radix_tree_lookup+0x180/0x220
 ? uverbs_try_lock_object+0x68/0xc0
 ? rdma_lookup_get_uobject+0x114/0x240
 create_qp.isra.5+0xce4/0x1e20
 ? ib_uverbs_ex_create_cq_cb+0xa0/0xa0
 ? copy_ah_attr_from_uverbs.isra.2+0xa00/0xa00
 ? ib_uverbs_cq_event_handler+0x160/0x160
 ? __might_fault+0x17c/0x1c0
 ib_uverbs_create_qp+0x21b/0x2a0
 ? ib_uverbs_destroy_cq+0x2e0/0x2e0
 ib_uverbs_write+0x55a/0xad0
 ? ib_uverbs_destroy_cq+0x2e0/0x2e0
 ? ib_uverbs_destroy_cq+0x2e0/0x2e0
 ? ib_uverbs_open+0x760/0x760
 ? futex_wake+0x147/0x410
 ? check_prev_add+0x1680/0x1680
 ? do_futex+0x3d3/0xa60
 ? sched_clock_cpu+0x18/0x180
 __vfs_write+0xf7/0x5c0
 ? ib_uverbs_open+0x760/0x760
 ? kernel_read+0x110/0x110
 ? lock_acquire+0x370/0x370
 ? __fget+0x264/0x3b0
 vfs_write+0x18a/0x460
 SyS_write+0xc7/0x1a0
 ? SyS_read+0x1a0/0x1a0
 ? trace_hardirqs_on_thunk+0x1a/0x1c
 entry_SYSCALL_64_fastpath+0x18/0x85
RIP: 0033:0x4477b9
RSP: 002b:00007f1822cadc18 EFLAGS: 00000292 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000004477b9
RDX: 0000000000000070 RSI: 000000002000a000 RDI: 0000000000000005
RBP: 0000000000708000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 00000000ffffffff
R13: 0000000000005d70 R14: 00000000006e6e30 R15: 0000000020010ff0

Allocated by task 549:
 __kmalloc+0x15e/0x340
 kvmalloc_node+0xa1/0xd0
 create_user_qp.isra.46+0xd42/0x1610
 create_qp_common+0x2e63/0x3b50
 mlx5_ib_create_qp+0x33d/0x17b0
 create_qp.isra.5+0xce4/0x1e20
 ib_uverbs_create_qp+0x21b/0x2a0
 ib_uverbs_write+0x55a/0xad0
 __vfs_write+0xf7/0x5c0
 vfs_write+0x18a/0x460
 SyS_write+0xc7/0x1a0
 entry_SYSCALL_64_fastpath+0x18/0x85

Freed by task 368:
 kfree+0xeb/0x2f0
 kernfs_fop_release+0x140/0x180
 __fput+0x266/0x700
 task_work_run+0x104/0x180
 exit_to_usermode_loop+0xf7/0x110
 syscall_return_slowpath+0x298/0x370
 entry_SYSCALL_64_fastpath+0x83/0x85

The buggy address belongs to the object at ffff880066b99180  which
belongs to the cache kmalloc-512 of size 512 The buggy address is
located 272 bytes inside of  512-byte region [ffff880066b99180,
ffff880066b99380) The buggy address belongs to the page:
page:000000006040eedd count:1 mapcount:0 mapping:          (null)
index:0x0 compound_mapcount: 0
flags: 0x4000000000008100(slab|head)
raw: 4000000000008100 0000000000000000 0000000000000000 0000000180190019
raw: ffffea00019a7500 0000000b0000000b ffff88006c403080 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff880066b99180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff880066b99200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff880066b99280: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                         ^
 ffff880066b99300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff880066b99380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

Cc: syzkaller <syzkaller@googlegroups.com>
Fixes: 0fb2ed66a14c ("IB/mlx5: Add create and destroy functionality for Raw Packet QP")
Signed-off-by: Boris Pismenny <borisp@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoIB/mlx5: Fix integer overflows in mlx5_ib_create_srq
Boris Pismenny [Thu, 8 Mar 2018 13:51:41 +0000 (15:51 +0200)]
IB/mlx5: Fix integer overflows in mlx5_ib_create_srq

BugLink: http://bugs.launchpad.net/bugs/1758886
commit c2b37f76485f073f020e60b5954b6dc4e55f693c upstream.

This patch validates user provided input to prevent integer overflow due
to integer manipulation in the mlx5_ib_create_srq function.

Cc: syzkaller <syzkaller@googlegroups.com>
Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: Boris Pismenny <borisp@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agodmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63
Vignesh R [Tue, 19 Dec 2017 10:51:16 +0000 (12:51 +0200)]
dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63

BugLink: http://bugs.launchpad.net/bugs/1758886
[ Upstream commit d087f15786021a9605b20f4c678312510be4cac1 ]

Register layout of a typical TPCC_EVT_MUX_M_N register is such that the
lowest numbered event is at the lowest byte address and highest numbered
event at highest byte address. But TPCC_EVT_MUX_60_63 register layout is
different,  in that the lowest numbered event is at the highest address
and highest numbered event is at the lowest address. Therefore, modify
ti_am335x_xbar_write() to handle TPCC_EVT_MUX_60_63 register
accordingly.

Signed-off-by: Vignesh R <vigneshr@ti.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agohwrng: core - Clean up RNG list when last hwrng is unregistered
Gary R Hook [Fri, 15 Dec 2017 19:55:59 +0000 (13:55 -0600)]
hwrng: core - Clean up RNG list when last hwrng is unregistered

BugLink: http://bugs.launchpad.net/bugs/1758886
[ Upstream commit 0e4b52942b1c76f89e0dcb829f72e123d0678f54 ]

Commit 142a27f0a731 added support for a "best" RNG, and in doing so
introduced a hang from rmmod/modprobe -r when the last RNG on the list
was unloaded.

When the hwrng list is depleted, return the global variables to their
original state and decrement all references to the object.

Fixes: 142a27f0a731 ("hwrng: core - Reset user selected rng by writing "" to rng_current")
Signed-off-by: Gary R Hook <gary.hook@amd.com>
Reviewed-by: PrasannaKumar Muralidharan <prasannatsmkumar@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agocrypto: artpec6 - set correct iv size for gcm(aes)
Lars Persson [Tue, 12 Dec 2017 11:40:22 +0000 (12:40 +0100)]
crypto: artpec6 - set correct iv size for gcm(aes)

BugLink: http://bugs.launchpad.net/bugs/1758886
[ Upstream commit 6d6e71feb183aa588c849e20e7baa47cb162928a ]

The IV size should not include the 32 bit counter. Because we had the
IV size set as 16 the transform only worked when the IV input was zero
padded.

Fixes: a21eb94fc4d3 ("crypto: axis - add ARTPEC-6/7 crypto accelerator driver")
Signed-off-by: Lars Persson <larper@axis.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoclk: si5351: Rename internal plls to avoid name collisions
Sergej Sawazki [Tue, 25 Jul 2017 21:21:02 +0000 (23:21 +0200)]
clk: si5351: Rename internal plls to avoid name collisions

BugLink: http://bugs.launchpad.net/bugs/1758886
[ Upstream commit cdba9a4fb0b53703959ac861e415816cb61aded4 ]

This drivers probe fails due to a clock name collision if a clock named
'plla' or 'pllb' is already registered when registering this drivers
internal plls.

Fix it by renaming internal plls to avoid name collisions.

Cc: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
Cc: Rabeeh Khoury <rabeeh@solid-run.com>
Signed-off-by: Sergej Sawazki <sergej@taudac.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoclk: axi-clkgen: Correctly handle nocount bit in recalc_rate()
Lars-Peter Clausen [Tue, 5 Sep 2017 09:32:40 +0000 (11:32 +0200)]
clk: axi-clkgen: Correctly handle nocount bit in recalc_rate()

BugLink: http://bugs.launchpad.net/bugs/1758886
[ Upstream commit 063578dc5f407f67d149133818efabe457daafda ]

If the nocount bit is set the divider is bypassed and the settings for the
divider count should be ignored and a divider value of 1 should be assumed.
Handle this correctly in the driver recalc_rate() callback.

While the driver sets up the part so that the read back dividers values
yield the correct result the power-on reset settings of the part might not
reflect this and hence calling e.g. clk_get_rate() without prior calls to
clk_set_rate() will yield the wrong result.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoclk: Don't touch hardware when reparenting during registration
Stephen Boyd [Thu, 2 Nov 2017 07:36:09 +0000 (00:36 -0700)]
clk: Don't touch hardware when reparenting during registration

BugLink: http://bugs.launchpad.net/bugs/1758886
[ Upstream commit f8f8f1d04494d3a6546bee3f0618c4dba31d7b72 ]

The orphan clocks reparent operation shouldn't touch the hardware
if clocks are enabled, otherwise it may get a chance to disable a
newly registered critical clock which triggers the warning below.

Assuming we have two clocks: A and B, B is the parent of A.
Clock A has flag: CLK_OPS_PARENT_ENABLE
Clock B has flag: CLK_IS_CRITICAL

Step 1:
Clock A is registered, then it becomes orphan.

Step 2:
Clock B is registered. Before clock B reach the critical clock enable
operation, orphan A will find the newly registered parent B and do
reparent operation, then parent B will be finally disabled in
__clk_set_parent_after() due to CLK_OPS_PARENT_ENABLE flag as there's
still no users of B which will then trigger the following warning.

WARNING: CPU: 0 PID: 0 at drivers/clk/clk.c:597 clk_core_disable+0xb4/0xe0
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.11.0-rc1-00056-gdff1f66-dirty #1373
Hardware name: Generic DT based system
Backtrace:
[<c010c4bc>] (dump_backtrace) from [<c010c764>] (show_stack+0x18/0x1c)
 r6:600000d3 r5:00000000 r4:c0e26358 r3:00000000
[<c010c74c>] (show_stack) from [<c040599c>] (dump_stack+0xb4/0xe8)
[<c04058e8>] (dump_stack) from [<c0125c94>] (__warn+0xd8/0x104)
 r10:c0c21cd0 r9:c048aa78 r8:00000255 r7:00000009 r6:c0c1cd90 r5:00000000
 r4:00000000 r3:c0e01d34
[<c0125bbc>] (__warn) from [<c0125d74>] (warn_slowpath_null+0x28/0x30)
 r9:00000000 r8:ef00bf80 r7:c165ac4c r6:ef00bf80 r5:ef00bf80 r4:ef00bf80
[<c0125d4c>] (warn_slowpath_null) from [<c048aa78>] (clk_core_disable+0xb4/0xe0)
[<c048a9c4>] (clk_core_disable) from [<c048be88>] (clk_core_disable_lock+0x20/0x2c)
 r4:000000d3 r3:c0e0af00
[<c048be68>] (clk_core_disable_lock) from [<c048c224>] (clk_core_disable_unprepare+0x14/0x28)
 r5:00000000 r4:ef00bf80
[<c048c210>] (clk_core_disable_unprepare) from [<c048c270>] (__clk_set_parent_after+0x38/0x54)
 r4:ef00bd80 r3:000010a0
[<c048c238>] (__clk_set_parent_after) from [<c048daa8>] (clk_register+0x4d0/0x648)
 r6:ef00d500 r5:ef00bf80 r4:ef00bd80 r3:ef00bfd4
[<c048d5d8>] (clk_register) from [<c048dc30>] (clk_hw_register+0x10/0x1c)
 r9:00000000 r8:00000003 r7:00000000 r6:00000824 r5:00000001 r4:ef00d500
[<c048dc20>] (clk_hw_register) from [<c048e698>] (_register_divider+0xcc/0x120)
[<c048e5cc>] (_register_divider) from [<c048e730>] (clk_register_divider+0x44/0x54)
 r10:00000004 r9:00000003 r8:00000001 r7:00000000 r6:00000003 r5:00000001
 r4:f0810030
[<c048e6ec>] (clk_register_divider) from [<c0d3ff58>] (imx7ulp_clocks_init+0x558/0xe98)
 r7:c0e296f8 r6:c165c808 r5:00000000 r4:c165c808
[<c0d3fa00>] (imx7ulp_clocks_init) from [<c0d24db0>] (of_clk_init+0x118/0x1e0)
 r10:00000001 r9:c0e01f68 r8:00000000 r7:c0e01f60 r6:ef7f8974 r5:ef0035c0
 r4:00000006
[<c0d24c98>] (of_clk_init) from [<c0d04a50>] (time_init+0x2c/0x38)
 r10:efffed40 r9:c0d61a48 r8:c0e78000 r7:c0e07900 r6:ffffffff r5:c0e78000
 r4:00000000
[<c0d04a24>] (time_init) from [<c0d00b8c>] (start_kernel+0x218/0x394)
[<c0d00974>] (start_kernel) from [<6000807c>] (0x6000807c)
 r10:00000000 r9:410fc075 r8:6000406a r7:c0e0c930 r6:c0d61a44 r5:c0e07918
 r4:c0e78294

We know that the clk isn't enabled with any sort of prepare_count
here so we don't need to enable anything to prevent a race. And
we're holding the prepare mutex so set_rate/set_parent can't race
here either. Based on an earlier patch by Dong Aisheng.

Fixes: fc8726a2c021 ("clk: core: support clocks which requires parents enable (part 2)")
Cc: Michael Turquette <mturquette@baylibre.com>
Cc: Shawn Guo <shawnguo@kernel.org>
Reported-by: Dong Aisheng <aisheng.dong@nxp.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoclk: at91: pmc: Wait for clocks when resuming
Romain Izard [Mon, 11 Dec 2017 16:55:33 +0000 (17:55 +0100)]
clk: at91: pmc: Wait for clocks when resuming

BugLink: http://bugs.launchpad.net/bugs/1758886
[ Upstream commit 960e1c4d93be86d3b118fe22d4edc69e401b28b5 ]

Wait for the syncronization of all clocks when resuming, not only the
UPLL clock. Do not use regmap_read_poll_timeout, as it will call BUG()
when interrupts are masked, which is the case in here.

Signed-off-by: Romain Izard <romain.izard.pro@gmail.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agonfsd4: permit layoutget of executable-only files
Benjamin Coddington [Tue, 19 Dec 2017 14:35:25 +0000 (09:35 -0500)]
nfsd4: permit layoutget of executable-only files

BugLink: http://bugs.launchpad.net/bugs/1758886
[ Upstream commit 66282ec1cf004c09083c29cb5e49019037937bbd ]

Clients must be able to read a file in order to execute it, and for pNFS
that means the client needs to be able to perform a LAYOUTGET on the file.

This behavior for executable-only files was added for OPEN in commit
a043226bc140 "nfsd4: permit read opens of executable-only files".

This fixes up xfstests generic/126 on block/scsi layouts.

Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoARM: dts: aspeed-evb: Add unit name to memory node
Joel Stanley [Mon, 18 Dec 2017 12:57:03 +0000 (23:27 +1030)]
ARM: dts: aspeed-evb: Add unit name to memory node

BugLink: http://bugs.launchpad.net/bugs/1758886
[ Upstream commit e40ed274489a5f516da120186578eb379b452ac6 ]

Fixes a warning when building with W=1.

All of the ASPEED device trees build without warnings now.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
6 years agoRDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS
Anton Vasilyev [Tue, 8 Aug 2017 15:56:37 +0000 (18:56 +0300)]
RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS

BugLink: http://bugs.launchpad.net/bugs/1758886
[ Upstream commit 744820869166c8c78be891240cf5f66e8a333694 ]

Debugfs file reset_stats is created with S_IRUSR permissions,
but ocrdma_dbgfs_ops_read() doesn't support OCRDMA_RESET_STATS,
whereas ocrdma_dbgfs_ops_write() supports only OCRDMA_RESET_STATS.

The patch fixes misstype with permissions.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>