--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: 배석진 <soukjin.bae@samsung.com>
+Date: Fri, 9 Nov 2018 16:53:06 -0800
+Subject: flow_dissector: do not dissect l4 ports for fragments
+
+From: 배석진 <soukjin.bae@samsung.com>
+
+[ Upstream commit 62230715fd2453b3ba948c9d83cfb3ada9169169 ]
+
+Only first fragment has the sport/dport information,
+not the following ones.
+
+If we want consistent hash for all fragments, we need to
+ignore ports even for first fragment.
+
+This bug is visible for IPv6 traffic, if incoming fragments
+do not have a flow label, since skb_get_hash() will give
+different results for first fragment and following ones.
+
+It is also visible if any routing rule wants dissection
+and sport or dport.
+
+See commit 5e5d6fed3741 ("ipv6: route: dissect flow
+in input path if fib rules need it") for details.
+
+[edumazet] rewrote the changelog completely.
+
+Fixes: 06635a35d13d ("flow_dissect: use programable dissector in skb_flow_dissect and friends")
+Signed-off-by: 배석진 <soukjin.bae@samsung.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/flow_dissector.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -838,8 +838,8 @@ ip_proto_again:
+ break;
+ }
+
+- if (dissector_uses_key(flow_dissector,
+- FLOW_DISSECTOR_KEY_PORTS)) {
++ if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS) &&
++ !(key_control->flags & FLOW_DIS_IS_FRAGMENT)) {
+ key_ports = skb_flow_dissector_target(flow_dissector,
+ FLOW_DISSECTOR_KEY_PORTS,
+ target_container);
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: "Michał Mirosław" <mirq-linux@rere.qmqm.pl>
+Date: Wed, 7 Nov 2018 17:50:52 +0100
+Subject: ibmvnic: fix accelerated VLAN handling
+
+From: "Michał Mirosław" <mirq-linux@rere.qmqm.pl>
+
+[ Upstream commit e84b47941e15e6666afb8ee8b21d1c3fc1a013af ]
+
+Don't request tag insertion when it isn't present in outgoing skb.
+
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1259,7 +1259,7 @@ static int ibmvnic_xmit(struct sk_buff *
+ tx_crq.v1.sge_len = cpu_to_be32(skb->len);
+ tx_crq.v1.ioba = cpu_to_be64(data_dma_addr);
+
+- if (adapter->vlan_header_insertion) {
++ if (adapter->vlan_header_insertion && skb_vlan_tag_present(skb)) {
+ tx_crq.v1.flags2 |= IBMVNIC_TX_VLAN_INSERT;
+ tx_crq.v1.vlan_id = cpu_to_be16(skb->vlan_tci);
+ }
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 8 Nov 2018 17:34:27 -0800
+Subject: inet: frags: better deal with smp races
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 0d5b9311baf27bb545f187f12ecfd558220c607d ]
+
+Multiple cpus might attempt to insert a new fragment in rhashtable,
+if for example RPS is buggy, as reported by 배석진 in
+https://patchwork.ozlabs.org/patch/994601/
+
+We use rhashtable_lookup_get_insert_key() instead of
+rhashtable_insert_fast() to let cpus losing the race
+free their own inet_frag_queue and use the one that
+was inserted by another cpu.
+
+Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: 배석진 <soukjin.bae@samsung.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/inet_fragment.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+--- a/net/ipv4/inet_fragment.c
++++ b/net/ipv4/inet_fragment.c
+@@ -180,21 +180,22 @@ static struct inet_frag_queue *inet_frag
+ }
+
+ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf,
+- void *arg)
++ void *arg,
++ struct inet_frag_queue **prev)
+ {
+ struct inet_frags *f = nf->f;
+ struct inet_frag_queue *q;
+- int err;
+
+ q = inet_frag_alloc(nf, f, arg);
+- if (!q)
++ if (!q) {
++ *prev = ERR_PTR(-ENOMEM);
+ return NULL;
+-
++ }
+ mod_timer(&q->timer, jiffies + nf->timeout);
+
+- err = rhashtable_insert_fast(&nf->rhashtable, &q->node,
+- f->rhash_params);
+- if (err < 0) {
++ *prev = rhashtable_lookup_get_insert_key(&nf->rhashtable, &q->key,
++ &q->node, f->rhash_params);
++ if (*prev) {
+ q->flags |= INET_FRAG_COMPLETE;
+ inet_frag_kill(q);
+ inet_frag_destroy(q);
+@@ -206,19 +207,20 @@ static struct inet_frag_queue *inet_frag
+ /* TODO : call from rcu_read_lock() and no longer use refcount_inc_not_zero() */
+ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key)
+ {
+- struct inet_frag_queue *fq;
++ struct inet_frag_queue *fq = NULL, *prev;
+
+ rcu_read_lock();
+
+- fq = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params);
+- if (fq) {
++ prev = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params);
++ if (!prev)
++ fq = inet_frag_create(nf, key, &prev);
++ if (prev && !IS_ERR(prev)) {
++ fq = prev;
+ if (!refcount_inc_not_zero(&fq->refcnt))
+ fq = NULL;
+- rcu_read_unlock();
+- return fq;
+ }
+ rcu_read_unlock();
+
+- return inet_frag_create(nf, key);
++ return fq;
+ }
+ EXPORT_SYMBOL(inet_frag_find);
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Sabrina Dubroca <sd@queasysnail.net>
+Date: Fri, 16 Nov 2018 16:58:19 +0100
+Subject: ip_tunnel: don't force DF when MTU is locked
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit 16f7eb2b77b55da816c4e207f3f9440a8cafc00a ]
+
+The various types of tunnels running over IPv4 can ask to set the DF
+bit to do PMTU discovery. However, PMTU discovery is subject to the
+threshold set by the net.ipv4.route.min_pmtu sysctl, and is also
+disabled on routes with "mtu lock". In those cases, we shouldn't set
+the DF bit.
+
+This patch makes setting the DF bit conditional on the route's MTU
+locking state.
+
+This issue seems to be older than git history.
+
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ip_tunnel_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/ip_tunnel_core.c
++++ b/net/ipv4/ip_tunnel_core.c
+@@ -80,7 +80,7 @@ void iptunnel_xmit(struct sock *sk, stru
+
+ iph->version = 4;
+ iph->ihl = sizeof(struct iphdr) >> 2;
+- iph->frag_off = df;
++ iph->frag_off = ip_mtu_locked(&rt->dst) ? 0 : df;
+ iph->protocol = proto;
+ iph->tos = tos;
+ iph->daddr = dst;
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: David Ahern <dsahern@gmail.com>
+Date: Sun, 18 Nov 2018 10:45:30 -0800
+Subject: ipv6: Fix PMTU updates for UDP/raw sockets in presence of VRF
+
+From: David Ahern <dsahern@gmail.com>
+
+[ Upstream commit 7ddacfa564870cdd97275fd87decb6174abc6380 ]
+
+Preethi reported that PMTU discovery for UDP/raw applications is not
+working in the presence of VRF when the socket is not bound to a device.
+The problem is that ip6_sk_update_pmtu does not consider the L3 domain
+of the skb device if the socket is not bound. Update the function to
+set oif to the L3 master device if relevant.
+
+Fixes: ca254490c8df ("net: Add VRF support to IPv6 stack")
+Reported-by: Preethi Ramachandra <preethir@juniper.net>
+Signed-off-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/route.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1547,10 +1547,13 @@ EXPORT_SYMBOL_GPL(ip6_update_pmtu);
+
+ void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
+ {
++ int oif = sk->sk_bound_dev_if;
+ struct dst_entry *dst;
+
+- ip6_update_pmtu(skb, sock_net(sk), mtu,
+- sk->sk_bound_dev_if, sk->sk_mark, sk->sk_uid);
++ if (!oif && skb->dev)
++ oif = l3mdev_master_ifindex(skb->dev);
++
++ ip6_update_pmtu(skb, sock_net(sk), mtu, oif, sk->sk_mark, sk->sk_uid);
+
+ dst = __sk_dst_get(sk);
+ if (!dst || !dst->obsolete ||
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Shalom Toledo <shalomt@mellanox.com>
+Date: Fri, 2 Nov 2018 19:49:15 +0000
+Subject: mlxsw: spectrum: Fix IP2ME CPU policer configuration
+
+From: Shalom Toledo <shalomt@mellanox.com>
+
+[ Upstream commit 96801552f846460fe9ac10f1b189602992f004e1 ]
+
+The CPU policer used to police packets being trapped via a local route
+(IP2ME) was incorrectly configured to police based on bytes per second
+instead of packets per second.
+
+Change the policer to police based on packets per second and avoid
+packet loss under certain circumstances.
+
+Fixes: 9148e7cf73ce ("mlxsw: spectrum: Add policers for trap groups")
+Signed-off-by: Shalom Toledo <shalomt@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -3471,7 +3471,6 @@ static int mlxsw_sp_cpu_policers_set(str
+ burst_size = 7;
+ break;
+ case MLXSW_REG_HTGT_TRAP_GROUP_SP_IP2ME:
+- is_bytes = true;
+ rate = 4 * 1024;
+ burst_size = 4;
+ break;
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Tristram Ha <Tristram.Ha@microchip.com>
+Date: Fri, 2 Nov 2018 19:23:41 -0700
+Subject: net: dsa: microchip: initialize mutex before use
+
+From: Tristram Ha <Tristram.Ha@microchip.com>
+
+[ Upstream commit 284fb78ed7572117846f8e1d1d8e3dbfd16880c2 ]
+
+Initialize mutex before use. Avoid kernel complaint when
+CONFIG_DEBUG_LOCK_ALLOC is enabled.
+
+Fixes: b987e98e50ab90e5 ("dsa: add DSA switch driver for Microchip KSZ9477")
+Signed-off-by: Tristram Ha <Tristram.Ha@microchip.com>
+Reviewed-by: Pavel Machek <pavel@ucw.cz>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/microchip/ksz_common.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/dsa/microchip/ksz_common.c
++++ b/drivers/net/dsa/microchip/ksz_common.c
+@@ -1104,11 +1104,6 @@ static int ksz_switch_init(struct ksz_de
+ {
+ int i;
+
+- mutex_init(&dev->reg_mutex);
+- mutex_init(&dev->stats_mutex);
+- mutex_init(&dev->alu_mutex);
+- mutex_init(&dev->vlan_mutex);
+-
+ dev->ds->ops = &ksz_switch_ops;
+
+ for (i = 0; i < ARRAY_SIZE(ksz_switch_chips); i++) {
+@@ -1193,6 +1188,11 @@ int ksz_switch_register(struct ksz_devic
+ if (dev->pdata)
+ dev->chip_id = dev->pdata->chip_id;
+
++ mutex_init(&dev->reg_mutex);
++ mutex_init(&dev->stats_mutex);
++ mutex_init(&dev->alu_mutex);
++ mutex_init(&dev->vlan_mutex);
++
+ if (ksz_switch_detect(dev))
+ return -EINVAL;
+
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Eric Dumazet <edumazet@google.com>
+Date: Sat, 17 Nov 2018 21:57:02 -0800
+Subject: net-gro: reset skb->pkt_type in napi_reuse_skb()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 33d9a2c72f086cbf1087b2fd2d1a15aa9df14a7f ]
+
+eth_type_trans() assumes initial value for skb->pkt_type
+is PACKET_HOST.
+
+This is indeed the value right after a fresh skb allocation.
+
+However, it is possible that GRO merged a packet with a different
+value (like PACKET_OTHERHOST in case macvlan is used), so
+we need to make sure napi->skb will have pkt_type set back to
+PACKET_HOST.
+
+Otherwise, valid packets might be dropped by the stack because
+their pkt_type is not PACKET_HOST.
+
+napi_reuse_skb() was added in commit 96e93eab2033 ("gro: Add
+internal interfaces for VLAN"), but this bug always has
+been there.
+
+Fixes: 96e93eab2033 ("gro: Add internal interfaces for VLAN")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/dev.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4993,6 +4993,10 @@ static void napi_reuse_skb(struct napi_s
+ skb->vlan_tci = 0;
+ skb->dev = napi->dev;
+ skb->skb_iif = 0;
++
++ /* eth_type_trans() assumes pkt_type is PACKET_HOST */
++ skb->pkt_type = PACKET_HOST;
++
+ skb->encapsulation = 0;
+ skb_shinfo(skb)->gso_type = 0;
+ skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Martin Schiller <ms@dev.tdt.de>
+Date: Fri, 16 Nov 2018 08:38:36 +0100
+Subject: net: phy: mdio-gpio: Fix working over slow can_sleep GPIOs
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit df5a8ec64eed7fe45b556cfff503acd6429ab817 ]
+
+Up until commit 7e5fbd1e0700 ("net: mdio-gpio: Convert to use gpiod
+functions where possible"), the _cansleep variants of the gpio_ API was
+used. After that commit and the change to gpiod_ API, the _cansleep()
+was dropped. This then results in WARN_ON() when used with GPIO
+devices which do sleep. Add back the _cansleep() to avoid this.
+
+Fixes: 7e5fbd1e0700 ("net: mdio-gpio: Convert to use gpiod functions where possible")
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/mdio-gpio.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/phy/mdio-gpio.c
++++ b/drivers/net/phy/mdio-gpio.c
+@@ -79,7 +79,7 @@ static void mdio_dir(struct mdiobb_ctrl
+ * assume the pin serves as pull-up. If direction is
+ * output, the default value is high.
+ */
+- gpiod_set_value(bitbang->mdo, 1);
++ gpiod_set_value_cansleep(bitbang->mdo, 1);
+ return;
+ }
+
+@@ -94,7 +94,7 @@ static int mdio_get(struct mdiobb_ctrl *
+ struct mdio_gpio_info *bitbang =
+ container_of(ctrl, struct mdio_gpio_info, ctrl);
+
+- return gpiod_get_value(bitbang->mdio);
++ return gpiod_get_value_cansleep(bitbang->mdio);
+ }
+
+ static void mdio_set(struct mdiobb_ctrl *ctrl, int what)
+@@ -103,9 +103,9 @@ static void mdio_set(struct mdiobb_ctrl
+ container_of(ctrl, struct mdio_gpio_info, ctrl);
+
+ if (bitbang->mdo)
+- gpiod_set_value(bitbang->mdo, what);
++ gpiod_set_value_cansleep(bitbang->mdo, what);
+ else
+- gpiod_set_value(bitbang->mdio, what);
++ gpiod_set_value_cansleep(bitbang->mdio, what);
+ }
+
+ static void mdc_set(struct mdiobb_ctrl *ctrl, int what)
+@@ -113,7 +113,7 @@ static void mdc_set(struct mdiobb_ctrl *
+ struct mdio_gpio_info *bitbang =
+ container_of(ctrl, struct mdio_gpio_info, ctrl);
+
+- gpiod_set_value(bitbang->mdc, what);
++ gpiod_set_value_cansleep(bitbang->mdc, what);
+ }
+
+ static const struct mdiobb_ops mdio_gpio_ops = {
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
+Date: Fri, 9 Nov 2018 18:56:27 -0700
+Subject: net: qualcomm: rmnet: Fix incorrect assignment of real_dev
+
+From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
+
+[ Upstream commit d02854dc1999ed3e7fd79ec700c64ac23ac0c458 ]
+
+A null dereference was observed when a sysctl was being set
+from userspace and rmnet was stuck trying to complete some actions
+in the NETDEV_REGISTER callback. This is because the real_dev is set
+only after the device registration handler completes.
+
+sysctl call stack -
+
+<6> Unable to handle kernel NULL pointer dereference at
+ virtual address 00000108
+<2> pc : rmnet_vnd_get_iflink+0x1c/0x28
+<2> lr : dev_get_iflink+0x2c/0x40
+<2> rmnet_vnd_get_iflink+0x1c/0x28
+<2> inet6_fill_ifinfo+0x15c/0x234
+<2> inet6_ifinfo_notify+0x68/0xd4
+<2> ndisc_ifinfo_sysctl_change+0x1b8/0x234
+<2> proc_sys_call_handler+0xac/0x100
+<2> proc_sys_write+0x3c/0x4c
+<2> __vfs_write+0x54/0x14c
+<2> vfs_write+0xcc/0x188
+<2> SyS_write+0x60/0xc0
+<2> el0_svc_naked+0x34/0x38
+
+device register call stack -
+
+<2> notifier_call_chain+0x84/0xbc
+<2> raw_notifier_call_chain+0x38/0x48
+<2> call_netdevice_notifiers_info+0x40/0x70
+<2> call_netdevice_notifiers+0x38/0x60
+<2> register_netdevice+0x29c/0x3d8
+<2> rmnet_vnd_newlink+0x68/0xe8
+<2> rmnet_newlink+0xa0/0x160
+<2> rtnl_newlink+0x57c/0x6c8
+<2> rtnetlink_rcv_msg+0x1dc/0x328
+<2> netlink_rcv_skb+0xac/0x118
+<2> rtnetlink_rcv+0x24/0x30
+<2> netlink_unicast+0x158/0x1f0
+<2> netlink_sendmsg+0x32c/0x338
+<2> sock_sendmsg+0x44/0x60
+<2> SyS_sendto+0x150/0x1ac
+<2> el0_svc_naked+0x34/0x38
+
+Fixes: b752eff5be24 ("net: qualcomm: rmnet: Implement ndo_get_iflink")
+Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
+Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+@@ -102,12 +102,14 @@ int rmnet_vnd_newlink(u8 id, struct net_
+ struct rmnet_port *port,
+ struct net_device *real_dev)
+ {
+- struct rmnet_priv *priv;
++ struct rmnet_priv *priv = netdev_priv(rmnet_dev);
+ int rc;
+
+ if (port->rmnet_devices[id])
+ return -EINVAL;
+
++ priv->real_dev = real_dev;
++
+ rc = register_netdevice(rmnet_dev);
+ if (!rc) {
+ port->rmnet_devices[id] = rmnet_dev;
+@@ -115,9 +117,7 @@ int rmnet_vnd_newlink(u8 id, struct net_
+
+ rmnet_dev->rtnl_link_ops = &rmnet_link_ops;
+
+- priv = netdev_priv(rmnet_dev);
+ priv->mux_id = id;
+- priv->real_dev = real_dev;
+
+ netdev_dbg(rmnet_dev, "rmnet dev created\n");
+ }
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Thu, 8 Nov 2018 20:38:26 +0100
+Subject: net: smsc95xx: Fix MTU range
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 85b18b0237ce9986a81a1b9534b5e2ee116f5504 ]
+
+The commit f77f0aee4da4 ("net: use core MTU range checking in USB NIC
+drivers") introduce a common MTU handling for usbnet. But it's missing
+the necessary changes for smsc95xx. So set the MTU range accordingly.
+
+This patch has been tested on a Raspberry Pi 3.
+
+Fixes: f77f0aee4da4 ("net: use core MTU range checking in USB NIC drivers")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/smsc95xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -1321,6 +1321,8 @@ static int smsc95xx_bind(struct usbnet *
+ dev->net->ethtool_ops = &smsc95xx_ethtool_ops;
+ dev->net->flags |= IFF_MULTICAST;
+ dev->net->hard_header_len += SMSC95XX_TX_OVERHEAD_CSUM;
++ dev->net->min_mtu = ETH_MIN_MTU;
++ dev->net->max_mtu = ETH_DATA_LEN;
+ dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+
+ pdata->dev = dev;
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 1 Nov 2018 15:55:38 -0700
+Subject: net: systemport: Protect stop from timeout
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 7cb6a2a2c72c1ed8f42fb01f1a661281b568dead ]
+
+A timing hazard exists when the network interface is stopped that
+allows a watchdog timeout to be processed by a separate core in
+parallel. This creates the potential for the timeout handler to
+wake the queues while the driver is shutting down, or access
+registers after their clocks have been removed.
+
+The more common case is that the watchdog timeout will produce a
+warning message which doesn't lead to a crash. The chances of this
+are greatly increased by the fact that bcm_sysport_netif_stop stops
+the transmit queues which can easily precipitate a watchdog time-
+out because of stale trans_start data in the queues.
+
+This commit corrects the behavior by ensuring that the watchdog
+timeout is disabled before enterring bcm_sysport_netif_stop. There
+are currently only two users of the bcm_sysport_netif_stop function:
+close and suspend.
+
+The close case already handles the issue by exiting the RUNNING
+state before invoking the driver close service.
+
+The suspend case now performs the netif_device_detach to exit the
+PRESENT state before the call to bcm_sysport_netif_stop rather than
+after it.
+
+These behaviors prevent any future scheduling of the driver timeout
+service during the window. The netif_tx_stop_all_queues function
+in bcm_sysport_netif_stop is replaced with netif_tx_disable to ensure
+synchronization with any transmit or timeout threads that may
+already be executing on other cores.
+
+For symmetry, the netif_device_attach call upon resume is moved to
+after the call to bcm_sysport_netif_start. Since it wakes the transmit
+queues it is not necessary to invoke netif_tx_start_all_queues from
+bcm_sysport_netif_start so it is moved into the driver open service.
+
+Fixes: 40755a0fce17 ("net: systemport: add suspend and resume support")
+Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -1774,9 +1774,6 @@ static void bcm_sysport_netif_start(stru
+ intrl2_1_mask_clear(priv, 0xffffffff);
+ else
+ intrl2_0_mask_clear(priv, INTRL2_0_TDMA_MBDONE_MASK);
+-
+- /* Last call before we start the real business */
+- netif_tx_start_all_queues(dev);
+ }
+
+ static void rbuf_init(struct bcm_sysport_priv *priv)
+@@ -1922,6 +1919,8 @@ static int bcm_sysport_open(struct net_d
+
+ bcm_sysport_netif_start(dev);
+
++ netif_tx_start_all_queues(dev);
++
+ return 0;
+
+ out_clear_rx_int:
+@@ -1945,7 +1944,7 @@ static void bcm_sysport_netif_stop(struc
+ struct bcm_sysport_priv *priv = netdev_priv(dev);
+
+ /* stop all software from updating hardware */
+- netif_tx_stop_all_queues(dev);
++ netif_tx_disable(dev);
+ napi_disable(&priv->napi);
+ phy_stop(dev->phydev);
+
+@@ -2267,12 +2266,12 @@ static int bcm_sysport_suspend(struct de
+ if (!netif_running(dev))
+ return 0;
+
++ netif_device_detach(dev);
++
+ bcm_sysport_netif_stop(dev);
+
+ phy_suspend(dev->phydev);
+
+- netif_device_detach(dev);
+-
+ /* Disable UniMAC RX */
+ umac_enable_set(priv, CMD_RX_EN, 0);
+
+@@ -2356,8 +2355,6 @@ static int bcm_sysport_resume(struct dev
+ goto out_free_rx_ring;
+ }
+
+- netif_device_attach(dev);
+-
+ /* RX pipe enable */
+ topctrl_writel(priv, 0, RX_FLUSH_CNTL);
+
+@@ -2402,6 +2399,8 @@ static int bcm_sysport_resume(struct dev
+
+ bcm_sysport_netif_start(dev);
+
++ netif_device_attach(dev);
++
+ return 0;
+
+ out_free_rx_ring:
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Xin Long <lucien.xin@gmail.com>
+Date: Sat, 3 Nov 2018 13:59:45 +0800
+Subject: sctp: fix strchange_flags name for Stream Change Event
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit fd82d61ba142f0b83463e47064bf5460aac57b6e ]
+
+As defined in rfc6525#section-6.1.3, SCTP_STREAM_CHANGE_DENIED
+and SCTP_STREAM_CHANGE_FAILED should be used instead of
+SCTP_ASSOC_CHANGE_DENIED and SCTP_ASSOC_CHANGE_FAILED.
+
+To keep the compatibility, fix it by adding two macros.
+
+Fixes: b444153fb5a6 ("sctp: add support for generating add stream change event notification")
+Reported-by: Jianwen Ji <jiji@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/uapi/linux/sctp.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/uapi/linux/sctp.h
++++ b/include/uapi/linux/sctp.h
+@@ -519,6 +519,8 @@ struct sctp_assoc_reset_event {
+
+ #define SCTP_ASSOC_CHANGE_DENIED 0x0004
+ #define SCTP_ASSOC_CHANGE_FAILED 0x0008
++#define SCTP_STREAM_CHANGE_DENIED SCTP_ASSOC_CHANGE_DENIED
++#define SCTP_STREAM_CHANGE_FAILED SCTP_ASSOC_CHANGE_FAILED
+ struct sctp_stream_change_event {
+ __u16 strchange_type;
+ __u16 strchange_flags;
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Xin Long <lucien.xin@gmail.com>
+Date: Sun, 18 Nov 2018 15:21:53 +0800
+Subject: sctp: not allow to set asoc prsctp_enable by sockopt
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit cc3ccf26f0649089b3a34a2781977755ea36e72c ]
+
+As rfc7496#section4.5 says about SCTP_PR_SUPPORTED:
+
+ This socket option allows the enabling or disabling of the
+ negotiation of PR-SCTP support for future associations. For existing
+ associations, it allows one to query whether or not PR-SCTP support
+ was negotiated on a particular association.
+
+It means only sctp sock's prsctp_enable can be set.
+
+Note that for the limitation of SCTP_{CURRENT|ALL}_ASSOC, we will
+add it when introducing SCTP_{FUTURE|CURRENT|ALL}_ASSOC for linux
+sctp in another patchset.
+
+v1->v2:
+ - drop the params.assoc_id check as Neil suggested.
+
+Fixes: 28aa4c26fce2 ("sctp: add SCTP_PR_SUPPORTED on sctp sockopt")
+Reported-by: Ying Xu <yinxu@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/socket.c | 26 +++++---------------------
+ 1 file changed, 5 insertions(+), 21 deletions(-)
+
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -3750,32 +3750,16 @@ static int sctp_setsockopt_pr_supported(
+ unsigned int optlen)
+ {
+ struct sctp_assoc_value params;
+- struct sctp_association *asoc;
+- int retval = -EINVAL;
+
+ if (optlen != sizeof(params))
+- goto out;
++ return -EINVAL;
+
+- if (copy_from_user(¶ms, optval, optlen)) {
+- retval = -EFAULT;
+- goto out;
+- }
++ if (copy_from_user(¶ms, optval, optlen))
++ return -EFAULT;
+
+- asoc = sctp_id2assoc(sk, params.assoc_id);
+- if (asoc) {
+- asoc->prsctp_enable = !!params.assoc_value;
+- } else if (!params.assoc_id) {
+- struct sctp_sock *sp = sctp_sk(sk);
++ sctp_sk(sk)->ep->prsctp_enable = !!params.assoc_value;
+
+- sp->ep->prsctp_enable = !!params.assoc_value;
+- } else {
+- goto out;
+- }
+-
+- retval = 0;
+-
+-out:
+- return retval;
++ return 0;
+ }
+
+ static int sctp_setsockopt_default_prinfo(struct sock *sk,
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Xin Long <lucien.xin@gmail.com>
+Date: Sun, 18 Nov 2018 21:59:49 +0800
+Subject: sctp: not increase stream's incnt before sending addstrm_in request
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit e1e46479847e66f78f79d8c24d5169a5954b3fc2 ]
+
+Different from processing the addstrm_out request, The receiver handles
+an addstrm_in request by sending back an addstrm_out request to the
+sender who will increase its stream's in and incnt later.
+
+Now stream->incnt has been increased since it sent out the addstrm_in
+request in sctp_send_add_streams(), with the wrong stream->incnt will
+even cause crash when copying stream info from the old stream's in to
+the new one's in sctp_process_strreset_addstrm_out().
+
+This patch is to fix it by simply removing the stream->incnt change
+from sctp_send_add_streams().
+
+Fixes: 242bd2d519d7 ("sctp: implement sender-side procedures for Add Incoming/Outgoing Streams Request Parameter")
+Reported-by: Jianwen Ji <jiji@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/stream.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/sctp/stream.c
++++ b/net/sctp/stream.c
+@@ -310,7 +310,6 @@ int sctp_send_add_streams(struct sctp_as
+ goto out;
+ }
+
+- stream->incnt = incnt;
+ stream->outcnt = outcnt;
+
+ asoc->strreset_outstanding = !!out + !!in;
--- /dev/null
+flow_dissector-do-not-dissect-l4-ports-for-fragments.patch
+ibmvnic-fix-accelerated-vlan-handling.patch
+ip_tunnel-don-t-force-df-when-mtu-is-locked.patch
+ipv6-fix-pmtu-updates-for-udp-raw-sockets-in-presence-of-vrf.patch
+net-gro-reset-skb-pkt_type-in-napi_reuse_skb.patch
+sctp-not-allow-to-set-asoc-prsctp_enable-by-sockopt.patch
+tg3-add-phy-reset-for-5717-5719-5720-in-change-ring-and-flow-control-paths.patch
+tuntap-fix-multiqueue-rx.patch
+net-systemport-protect-stop-from-timeout.patch
+net-qualcomm-rmnet-fix-incorrect-assignment-of-real_dev.patch
+net-dsa-microchip-initialize-mutex-before-use.patch
+sctp-fix-strchange_flags-name-for-stream-change-event.patch
+net-phy-mdio-gpio-fix-working-over-slow-can_sleep-gpios.patch
+sctp-not-increase-stream-s-incnt-before-sending-addstrm_in-request.patch
+mlxsw-spectrum-fix-ip2me-cpu-policer-configuration.patch
+net-smsc95xx-fix-mtu-range.patch
+usbnet-smsc95xx-disable-carrier-check-while-suspending.patch
+inet-frags-better-deal-with-smp-races.patch
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Siva Reddy Kallam <siva.kallam@broadcom.com>
+Date: Tue, 20 Nov 2018 10:04:04 +0530
+Subject: tg3: Add PHY reset for 5717/5719/5720 in change ring and flow control paths
+
+From: Siva Reddy Kallam <siva.kallam@broadcom.com>
+
+[ Upstream commit 59663e42199c93d1d7314d1446f6782fc4b1eb81 ]
+
+This patch has the fix to avoid PHY lockup with 5717/5719/5720 in change
+ring and flow control paths. This patch solves the RX hang while doing
+continuous ring or flow control parameters with heavy traffic from peer.
+
+Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
+Acked-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -12395,6 +12395,7 @@ static int tg3_set_ringparam(struct net_
+ {
+ struct tg3 *tp = netdev_priv(dev);
+ int i, irq_sync = 0, err = 0;
++ bool reset_phy = false;
+
+ if ((ering->rx_pending > tp->rx_std_ring_mask) ||
+ (ering->rx_jumbo_pending > tp->rx_jmb_ring_mask) ||
+@@ -12426,7 +12427,13 @@ static int tg3_set_ringparam(struct net_
+
+ if (netif_running(dev)) {
+ tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+- err = tg3_restart_hw(tp, false);
++ /* Reset PHY to avoid PHY lock up */
++ if (tg3_asic_rev(tp) == ASIC_REV_5717 ||
++ tg3_asic_rev(tp) == ASIC_REV_5719 ||
++ tg3_asic_rev(tp) == ASIC_REV_5720)
++ reset_phy = true;
++
++ err = tg3_restart_hw(tp, reset_phy);
+ if (!err)
+ tg3_netif_start(tp);
+ }
+@@ -12460,6 +12467,7 @@ static int tg3_set_pauseparam(struct net
+ {
+ struct tg3 *tp = netdev_priv(dev);
+ int err = 0;
++ bool reset_phy = false;
+
+ if (tp->link_config.autoneg == AUTONEG_ENABLE)
+ tg3_warn_mgmt_link_flap(tp);
+@@ -12550,7 +12558,13 @@ static int tg3_set_pauseparam(struct net
+
+ if (netif_running(dev)) {
+ tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+- err = tg3_restart_hw(tp, false);
++ /* Reset PHY to avoid PHY lock up */
++ if (tg3_asic_rev(tp) == ASIC_REV_5717 ||
++ tg3_asic_rev(tp) == ASIC_REV_5719 ||
++ tg3_asic_rev(tp) == ASIC_REV_5720)
++ reset_phy = true;
++
++ err = tg3_restart_hw(tp, reset_phy);
+ if (!err)
+ tg3_netif_start(tp);
+ }
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Matthew Cover <werekraken@gmail.com>
+Date: Sun, 18 Nov 2018 00:46:00 -0700
+Subject: tuntap: fix multiqueue rx
+
+From: Matthew Cover <werekraken@gmail.com>
+
+[ Upstream commit 8ebebcba559a1bfbaec7bbda64feb9870b9c58da ]
+
+When writing packets to a descriptor associated with a combined queue, the
+packets should end up on that queue.
+
+Before this change all packets written to any descriptor associated with a
+tap interface end up on rx-0, even when the descriptor is associated with a
+different queue.
+
+The rx traffic can be generated by either of the following.
+ 1. a simple tap program which spins up multiple queues and writes packets
+ to each of the file descriptors
+ 2. tx from a qemu vm with a tap multiqueue netdev
+
+The queue for rx traffic can be observed by either of the following (done
+on the hypervisor in the qemu case).
+ 1. a simple netmap program which opens and reads from per-queue
+ descriptors
+ 2. configuring RPS and doing per-cpu captures with rxtxcpu
+
+Alternatively, if you printk() the return value of skb_get_rx_queue() just
+before each instance of netif_receive_skb() in tun.c, you will get 65535
+for every skb.
+
+Calling skb_record_rx_queue() to set the rx queue to the queue_index fixes
+the association between descriptor and rx queue.
+
+Signed-off-by: Matthew Cover <matthew.cover@stackpath.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/tun.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1214,6 +1214,7 @@ static void tun_rx_batched(struct tun_st
+
+ if (!rx_batched || (!more && skb_queue_empty(queue))) {
+ local_bh_disable();
++ skb_record_rx_queue(skb, tfile->queue_index);
+ netif_receive_skb(skb);
+ local_bh_enable();
+ return;
+@@ -1233,8 +1234,11 @@ static void tun_rx_batched(struct tun_st
+ struct sk_buff *nskb;
+
+ local_bh_disable();
+- while ((nskb = __skb_dequeue(&process_queue)))
++ while ((nskb = __skb_dequeue(&process_queue))) {
++ skb_record_rx_queue(nskb, tfile->queue_index);
+ netif_receive_skb(nskb);
++ }
++ skb_record_rx_queue(skb, tfile->queue_index);
+ netif_receive_skb(skb);
+ local_bh_enable();
+ }
--- /dev/null
+From foo@baz Wed Nov 21 12:20:20 CET 2018
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+Date: Wed, 31 Oct 2018 22:52:19 +0100
+Subject: usbnet: smsc95xx: disable carrier check while suspending
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit 7b900ead6cc66b2ee873cb042dfba169aa68b56c ]
+
+We need to make sure, that the carrier check polling is disabled
+while suspending. Otherwise we can end up with usbnet_read_cmd()
+being issued when only usbnet_read_cmd_nopm() is allowed. If this
+happens, read operations lock up.
+
+Fixes: d69d169493 ("usbnet: smsc95xx: fix link detection for disabled autonegotiation")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Reviewed-by: Raghuram Chary J <RaghuramChary.Jallipalli@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/smsc95xx.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -1600,6 +1600,8 @@ static int smsc95xx_suspend(struct usb_i
+ return ret;
+ }
+
++ cancel_delayed_work_sync(&pdata->carrier_check);
++
+ if (pdata->suspend_flags) {
+ netdev_warn(dev->net, "error during last resume\n");
+ pdata->suspend_flags = 0;
+@@ -1842,6 +1844,11 @@ done:
+ */
+ if (ret && PMSG_IS_AUTO(message))
+ usbnet_resume(intf);
++
++ if (ret)
++ schedule_delayed_work(&pdata->carrier_check,
++ CARRIER_CHECK_DELAY);
++
+ return ret;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
