--- /dev/null
+From 6f36ff977bf6f939577cae064e346fbc6a1f0963 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Wed, 9 Jan 2019 00:34:37 +0100
+Subject: ACPI: EC: Look for ECDT EC after calling acpi_load_tables()
+
+[ Upstream commit b1c0330823fe842dbb34641f1410f0afa51c29d3 ]
+
+Some systems have had functional issues since commit 5a8361f7ecce
+(ACPICA: Integrate package handling with module-level code) that,
+among other things, changed the initial values of the
+acpi_gbl_group_module_level_code and acpi_gbl_parse_table_as_term_list
+global flags in ACPICA which implicitly caused acpi_ec_ecdt_probe() to
+be called before acpi_load_tables() on the vast majority of platforms.
+
+Namely, before commit 5a8361f7ecce, acpi_load_tables() was called from
+acpi_early_init() if acpi_gbl_parse_table_as_term_list was FALSE and
+acpi_gbl_group_module_level_code was TRUE, which almost always was
+the case as FALSE and TRUE were their initial values, respectively.
+The acpi_gbl_parse_table_as_term_list value would be changed to TRUE
+for a couple of platforms in acpi_quirks_dmi_table[], but it remained
+FALSE in the vast majority of cases.
+
+After commit 5a8361f7ecce, the initial values of the two flags have
+been reversed, so in effect acpi_load_tables() has not been called
+from acpi_early_init() any more. That, in turn, affects
+acpi_ec_ecdt_probe() which is invoked before acpi_load_tables() now
+and it is not possible to evaluate the _REG method for the EC address
+space handler installed by it. That effectively causes the EC address
+space to be inaccessible to AML on platforms with an ECDT matching the
+EC device definition in the DSDT and functional problems ensue in
+there.
+
+Because the default behavior before commit 5a8361f7ecce was to call
+acpi_ec_ecdt_probe() after acpi_load_tables(), it should be safe to
+do that again. Moreover, the EC address space handler installed by
+acpi_ec_ecdt_probe() is only needed for AML to be able to access the
+EC address space and the only AML that can run during acpi_load_tables()
+is module-level code which only is allowed to access address spaces
+with default handlers (memory, I/O and PCI config space).
+
+For this reason, move the acpi_ec_ecdt_probe() invocation back to
+acpi_bus_init(), from where it was taken away by commit d737f333b211
+(ACPI: probe ECDT before loading AML tables regardless of module-level
+code flag), and put it after the invocation of acpi_load_tables() to
+restore the original code ordering from before commit 5a8361f7ecce.
+
+Fixes: 5a8361f7ecce ("ACPICA: Integrate package handling with module-level code")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=199981
+Reported-by: step-ali <sunmooon15@gmail.com>
+Reported-by: Charles Stanhope <charles.stanhope@gmail.com>
+Tested-by: Charles Stanhope <charles.stanhope@gmail.com>
+Reported-by: Paulo Nascimento <paulo.ulusu@googlemail.com>
+Reported-by: David Purton <dcpurton@marshwiggle.net>
+Reported-by: Adam Harvey <adam@adamharvey.name>
+Reported-by: Zhang Rui <rui.zhang@intel.com>
+Tested-by: Zhang Rui <rui.zhang@intel.com>
+Tested-by: Jean-Marc Lenoir <archlinux@jihemel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/bus.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
+index bb3d96dea6dba..26d4164d394fb 100644
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -1054,18 +1054,6 @@ void __init acpi_early_init(void)
+ goto error0;
+ }
+
+- /*
+- * ACPI 2.0 requires the EC driver to be loaded and work before
+- * the EC device is found in the namespace (i.e. before
+- * acpi_load_tables() is called).
+- *
+- * This is accomplished by looking for the ECDT table, and getting
+- * the EC parameters out of that.
+- *
+- * Ignore the result. Not having an ECDT is not fatal.
+- */
+- status = acpi_ec_ecdt_probe();
+-
+ #ifdef CONFIG_X86
+ if (!acpi_ioapic) {
+ /* compatible (0) means level (3) */
+@@ -1142,6 +1130,18 @@ static int __init acpi_bus_init(void)
+ goto error1;
+ }
+
++ /*
++ * ACPI 2.0 requires the EC driver to be loaded and work before the EC
++ * device is found in the namespace.
++ *
++ * This is accomplished by looking for the ECDT table and getting the EC
++ * parameters out of that.
++ *
++ * Do that before calling acpi_initialize_objects() which may trigger EC
++ * address space accesses.
++ */
++ acpi_ec_ecdt_probe();
++
+ status = acpi_enable_subsystem(ACPI_NO_ACPI_ENABLE);
+ if (ACPI_FAILURE(status)) {
+ printk(KERN_ERR PREFIX
+--
+2.19.1
+
--- /dev/null
+From 9984965f68d47b8f36ba20d03b5cc95cd405d330 Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Fri, 11 Jan 2019 14:46:37 -0800
+Subject: acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id()
+
+[ Upstream commit 0919871ac37fdcf46c7657da0f1742efe096b399 ]
+
+Possible race accessing memdev structures after dropping the
+mutex. Dan Williams says this could race against another thread
+that is doing:
+
+ # echo "ACPI0012:00" > /sys/bus/acpi/drivers/nfit/unbind
+
+Reported-by: Jane Chu <jane.chu@oracle.com>
+Fixes: 23222f8f8dce ("acpi, nfit: Add function to look up nvdimm...")
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/nfit/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 8535e7999769b..2a2d7ec772526 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -724,6 +724,7 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags)
+ struct acpi_nfit_memory_map *memdev;
+ struct acpi_nfit_desc *acpi_desc;
+ struct nfit_mem *nfit_mem;
++ u16 physical_id;
+
+ mutex_lock(&acpi_desc_lock);
+ list_for_each_entry(acpi_desc, &acpi_descs, list) {
+@@ -731,10 +732,11 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags)
+ list_for_each_entry(nfit_mem, &acpi_desc->dimms, list) {
+ memdev = __to_nfit_memdev(nfit_mem);
+ if (memdev->device_handle == device_handle) {
++ *flags = memdev->flags;
++ physical_id = memdev->physical_id;
+ mutex_unlock(&acpi_desc->init_mutex);
+ mutex_unlock(&acpi_desc_lock);
+- *flags = memdev->flags;
+- return memdev->physical_id;
++ return physical_id;
+ }
+ }
+ mutex_unlock(&acpi_desc->init_mutex);
+--
+2.19.1
+
--- /dev/null
+From fdc4146683ed2e36edb23675cc706625a3bef857 Mon Sep 17 00:00:00 2001
+From: Marc Dionne <marc.dionne@auristor.com>
+Date: Wed, 9 Jan 2019 17:23:54 +0000
+Subject: afs: Don't set vnode->cb_s_break in afs_validate()
+
+[ Upstream commit 4882a27cec24319d10f95e978ecc80050e3e3e15 ]
+
+A cb_interest record is not necessarily attached to the vnode on entry to
+afs_validate(), which can cause an oops when we try to bring the vnode's
+cb_s_break up to date in the default case (ie. no current callback promise
+and the vnode has not been deleted).
+
+Fix this by simply removing the line, as vnode->cb_s_break will be set when
+needed by afs_register_server_cb_interest() when we next get a callback
+promise from RPC call.
+
+The oops looks something like:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
+ ...
+ RIP: 0010:afs_validate+0x66/0x250 [kafs]
+ ...
+ Call Trace:
+ afs_d_revalidate+0x8d/0x340 [kafs]
+ ? __d_lookup+0x61/0x150
+ lookup_dcache+0x44/0x70
+ ? lookup_dcache+0x44/0x70
+ __lookup_hash+0x24/0xa0
+ do_unlinkat+0x11d/0x2c0
+ __x64_sys_unlink+0x23/0x30
+ do_syscall_64+0x4d/0xf0
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: ae3b7361dc0e ("afs: Fix validation/callback interaction")
+Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/inode.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 6b17d36204142..211343831c304 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -414,7 +414,6 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
+ } else if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) {
+ valid = true;
+ } else {
+- vnode->cb_s_break = vnode->cb_interest->server->cb_s_break;
+ vnode->cb_v_break = vnode->volume->cb_v_break;
+ valid = false;
+ }
+--
+2.19.1
+
--- /dev/null
+From 8b676f51f6607dfb7504147645fc339abdbef3b8 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 9 Jan 2019 17:23:54 +0000
+Subject: afs: Fix key refcounting in file locking code
+
+[ Upstream commit 59d49076ae3e6912e6d7df2fd68e2337f3d02036 ]
+
+Fix the refcounting of the authentication keys in the file locking code.
+The vnode->lock_key member points to a key on which it expects to be
+holding a ref, but it isn't always given an extra ref, however.
+
+Fixes: 0fafdc9f888b ("afs: Fix file locking")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/flock.c | 4 ++--
+ fs/afs/inode.c | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/afs/flock.c b/fs/afs/flock.c
+index 0568fd9868210..e432bd27a2e7b 100644
+--- a/fs/afs/flock.c
++++ b/fs/afs/flock.c
+@@ -208,7 +208,7 @@ void afs_lock_work(struct work_struct *work)
+ /* The new front of the queue now owns the state variables. */
+ next = list_entry(vnode->pending_locks.next,
+ struct file_lock, fl_u.afs.link);
+- vnode->lock_key = afs_file_key(next->fl_file);
++ vnode->lock_key = key_get(afs_file_key(next->fl_file));
+ vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
+ vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
+ goto again;
+@@ -413,7 +413,7 @@ static void afs_dequeue_lock(struct afs_vnode *vnode, struct file_lock *fl)
+ /* The new front of the queue now owns the state variables. */
+ next = list_entry(vnode->pending_locks.next,
+ struct file_lock, fl_u.afs.link);
+- vnode->lock_key = afs_file_key(next->fl_file);
++ vnode->lock_key = key_get(afs_file_key(next->fl_file));
+ vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
+ vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
+ afs_lock_may_be_available(vnode);
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 211343831c304..1a4ce07fb406d 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -545,6 +545,8 @@ void afs_evict_inode(struct inode *inode)
+ #endif
+
+ afs_put_permits(rcu_access_pointer(vnode->permit_cache));
++ key_put(vnode->lock_key);
++ vnode->lock_key = NULL;
+ _leave("");
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 5bd05620a58cc375894da49230500c47b2def729 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 10 Jan 2019 15:40:50 +0000
+Subject: afs: Fix race in async call refcounting
+
+[ Upstream commit 34fa47612bfe5d7de7fcaf658a6952b6aeec3b13 ]
+
+There's a race between afs_make_call() and afs_wake_up_async_call() in the
+case that an error is returned from rxrpc_kernel_send_data() after it has
+queued the final packet.
+
+afs_make_call() will try and clean up the mess, but the call state may have
+been moved on thereby causing afs_process_async_call() to also try and to
+delete the call.
+
+Fix this by:
+
+ (1) Getting an extra ref for an asynchronous call for the call itself to
+ hold. This makes sure the call doesn't evaporate on us accidentally
+ and will allow the call to be retained by the caller in a future
+ patch. The ref is released on leaving afs_make_call() or
+ afs_wait_for_call_to_complete().
+
+ (2) In the event of an error from rxrpc_kernel_send_data():
+
+ (a) Don't set the call state to AFS_CALL_COMPLETE until *after* the
+ call has been aborted and ended. This prevents
+ afs_deliver_to_call() from doing anything with any notifications
+ it gets.
+
+ (b) Explicitly end the call immediately to prevent further callbacks.
+
+ (c) Cancel any queued async_work and wait for the work if it's
+ executing. This allows us to be sure the race won't recur when we
+ change the state. We put the work queue's ref on the call if we
+ managed to cancel it.
+
+ (d) Put the call's ref that we got in (1). This belongs to us as long
+ as the call is in state AFS_CALL_CL_REQUESTING.
+
+Fixes: 341f741f04be ("afs: Refcount the afs_call struct")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/rxrpc.c | 35 ++++++++++++++++++++++++++++++-----
+ include/trace/events/afs.h | 2 ++
+ 2 files changed, 32 insertions(+), 5 deletions(-)
+
+diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
+index 4830e0a6bf1d1..2c588f9bbbda2 100644
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -23,6 +23,7 @@ struct workqueue_struct *afs_async_calls;
+ static void afs_wake_up_call_waiter(struct sock *, struct rxrpc_call *, unsigned long);
+ static long afs_wait_for_call_to_complete(struct afs_call *, struct afs_addr_cursor *);
+ static void afs_wake_up_async_call(struct sock *, struct rxrpc_call *, unsigned long);
++static void afs_delete_async_call(struct work_struct *);
+ static void afs_process_async_call(struct work_struct *);
+ static void afs_rx_new_call(struct sock *, struct rxrpc_call *, unsigned long);
+ static void afs_rx_discard_new_call(struct rxrpc_call *, unsigned long);
+@@ -404,6 +405,12 @@ long afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call,
+ }
+ }
+
++ /* If the call is going to be asynchronous, we need an extra ref for
++ * the call to hold itself so the caller need not hang on to its ref.
++ */
++ if (call->async)
++ afs_get_call(call, afs_call_trace_get);
++
+ /* create a call */
+ rxcall = rxrpc_kernel_begin_call(call->net->socket, srx, call->key,
+ (unsigned long)call,
+@@ -444,15 +451,17 @@ long afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call,
+ goto error_do_abort;
+ }
+
+- /* at this point, an async call may no longer exist as it may have
+- * already completed */
+- if (call->async)
++ /* Note that at this point, we may have received the reply or an abort
++ * - and an asynchronous call may already have completed.
++ */
++ if (call->async) {
++ afs_put_call(call);
+ return -EINPROGRESS;
++ }
+
+ return afs_wait_for_call_to_complete(call, ac);
+
+ error_do_abort:
+- call->state = AFS_CALL_COMPLETE;
+ if (ret != -ECONNABORTED) {
+ rxrpc_kernel_abort_call(call->net->socket, rxcall,
+ RX_USER_ABORT, ret, "KSD");
+@@ -469,8 +478,24 @@ long afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call,
+ error_kill_call:
+ if (call->type->done)
+ call->type->done(call);
+- afs_put_call(call);
++
++ /* We need to dispose of the extra ref we grabbed for an async call.
++ * The call, however, might be queued on afs_async_calls and we need to
++ * make sure we don't get any more notifications that might requeue it.
++ */
++ if (call->rxcall) {
++ rxrpc_kernel_end_call(call->net->socket, call->rxcall);
++ call->rxcall = NULL;
++ }
++ if (call->async) {
++ if (cancel_work_sync(&call->async_work))
++ afs_put_call(call);
++ afs_put_call(call);
++ }
++
+ ac->error = ret;
++ call->state = AFS_CALL_COMPLETE;
++ afs_put_call(call);
+ _leave(" = %d", ret);
+ return ret;
+ }
+diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h
+index 33d291888ba9c..e3f005eae1f76 100644
+--- a/include/trace/events/afs.h
++++ b/include/trace/events/afs.h
+@@ -25,6 +25,7 @@
+ enum afs_call_trace {
+ afs_call_trace_alloc,
+ afs_call_trace_free,
++ afs_call_trace_get,
+ afs_call_trace_put,
+ afs_call_trace_wake,
+ afs_call_trace_work,
+@@ -159,6 +160,7 @@ enum afs_file_error {
+ #define afs_call_traces \
+ EM(afs_call_trace_alloc, "ALLOC") \
+ EM(afs_call_trace_free, "FREE ") \
++ EM(afs_call_trace_get, "GET ") \
+ EM(afs_call_trace_put, "PUT ") \
+ EM(afs_call_trace_wake, "WAKE ") \
+ E_(afs_call_trace_work, "WORK ")
+--
+2.19.1
+
--- /dev/null
+From 2806624d86a3256870158625d5298bd68599dae9 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 10 Jan 2019 15:14:29 +0000
+Subject: afs: Provide a function to get a ref on a call
+
+[ Upstream commit 7a75b0079a1d54e342c502c3c8107ba97e05d3d3 ]
+
+Provide a function to get a reference on an afs_call struct.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/rxrpc.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
+index a7b44863d502e..4830e0a6bf1d1 100644
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -203,20 +203,26 @@ void afs_put_call(struct afs_call *call)
+ }
+ }
+
++static struct afs_call *afs_get_call(struct afs_call *call,
++ enum afs_call_trace why)
++{
++ int u = atomic_inc_return(&call->usage);
++
++ trace_afs_call(call, why, u,
++ atomic_read(&call->net->nr_outstanding_calls),
++ __builtin_return_address(0));
++ return call;
++}
++
+ /*
+ * Queue the call for actual work.
+ */
+ static void afs_queue_call_work(struct afs_call *call)
+ {
+ if (call->type->work) {
+- int u = atomic_inc_return(&call->usage);
+-
+- trace_afs_call(call, afs_call_trace_work, u,
+- atomic_read(&call->net->nr_outstanding_calls),
+- __builtin_return_address(0));
+-
+ INIT_WORK(&call->work, call->type->work);
+
++ afs_get_call(call, afs_call_trace_work);
+ if (!queue_work(afs_wq, &call->work))
+ afs_put_call(call);
+ }
+--
+2.19.1
+
--- /dev/null
+From b21d4f17734285b8d059099e6d3c509e04942d0d Mon Sep 17 00:00:00 2001
+From: Marc Dionne <marc.dionne@auristor.com>
+Date: Wed, 9 Jan 2019 17:23:54 +0000
+Subject: afs: Set correct lock type for the yfs CreateFile
+
+[ Upstream commit 5edc22cc1d33d6a88d175d25adc38d2a5cee134d ]
+
+A lock type of 0 is "LockRead", which makes the fileserver record an
+unintentional read lock on the new file. This will cause problems
+later on if the file is the subject of locking operations.
+
+The correct default value should be -1 ("LockNone").
+
+Fix the operation marshalling code to set the value and provide an enum to
+symbolise the values whilst we're at it.
+
+Fixes: 30062bd13e36 ("afs: Implement YFS support in the fs client")
+Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/protocol_yfs.h | 11 +++++++++++
+ fs/afs/yfsclient.c | 2 +-
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/fs/afs/protocol_yfs.h b/fs/afs/protocol_yfs.h
+index 07bc10f076aac..d443e2bfa0946 100644
+--- a/fs/afs/protocol_yfs.h
++++ b/fs/afs/protocol_yfs.h
+@@ -161,3 +161,14 @@ struct yfs_xdr_YFSStoreVolumeStatus {
+ struct yfs_xdr_u64 max_quota;
+ struct yfs_xdr_u64 file_quota;
+ } __packed;
++
++enum yfs_lock_type {
++ yfs_LockNone = -1,
++ yfs_LockRead = 0,
++ yfs_LockWrite = 1,
++ yfs_LockExtend = 2,
++ yfs_LockRelease = 3,
++ yfs_LockMandatoryRead = 0x100,
++ yfs_LockMandatoryWrite = 0x101,
++ yfs_LockMandatoryExtend = 0x102,
++};
+diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c
+index 12658c1363ae4..5aa57929e8c23 100644
+--- a/fs/afs/yfsclient.c
++++ b/fs/afs/yfsclient.c
+@@ -803,7 +803,7 @@ int yfs_fs_create_file(struct afs_fs_cursor *fc,
+ bp = xdr_encode_YFSFid(bp, &vnode->fid);
+ bp = xdr_encode_string(bp, name, namesz);
+ bp = xdr_encode_YFSStoreStatus_mode(bp, mode);
+- bp = xdr_encode_u32(bp, 0); /* ViceLockType */
++ bp = xdr_encode_u32(bp, yfs_LockNone); /* ViceLockType */
+ yfs_check_req(call, bp);
+
+ afs_use_fs_server(call, fc->cbi);
+--
+2.19.1
+
--- /dev/null
+From 7524a9e41d39d989ca198415d0e089ead798667e Mon Sep 17 00:00:00 2001
+From: Talons Lee <xin.li@citrix.com>
+Date: Mon, 10 Dec 2018 18:03:00 +0800
+Subject: always clear the X2APIC_ENABLE bit for PV guest
+
+[ Upstream commit 5268c8f39e0efef81af2aaed160272d9eb507beb ]
+
+Commit e657fcc clears cpu capability bit instead of using fake cpuid
+value, the EXTD should always be off for PV guest without depending
+on cpuid value. So remove the cpuid check in xen_read_msr_safe() to
+always clear the X2APIC_ENABLE bit.
+
+Signed-off-by: Talons Lee <xin.li@citrix.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/enlighten_pv.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index 2f6787fc71066..c54a493e139a7 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -898,10 +898,7 @@ static u64 xen_read_msr_safe(unsigned int msr, int *err)
+ val = native_read_msr_safe(msr, err);
+ switch (msr) {
+ case MSR_IA32_APICBASE:
+-#ifdef CONFIG_X86_X2APIC
+- if (!(cpuid_ecx(1) & (1 << (X86_FEATURE_X2APIC & 31))))
+-#endif
+- val &= ~X2APIC_ENABLE;
++ val &= ~X2APIC_ENABLE;
+ break;
+ }
+ return val;
+--
+2.19.1
+
--- /dev/null
+From e1bd78151db5f67bf2295a36c8a8b8f7303fa074 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 15 Jan 2019 18:03:38 +0000
+Subject: atm: he: fix sign-extension overflow on large shift
+
+[ Upstream commit cb12d72b27a6f41325ae23a11033cf5fedfa1b97 ]
+
+Shifting the 1 by exp by an int can lead to sign-extension overlow when
+exp is 31 since 1 is an signed int and sign-extending this result to an
+unsigned long long will set the upper 32 bits. Fix this by shifting an
+unsigned long.
+
+Detected by cppcheck:
+(warning) Shifting signed 32-bit value by 31 bits is undefined behaviour
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/he.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/atm/he.c b/drivers/atm/he.c
+index 29f102dcfec49..329ce9072ee9f 100644
+--- a/drivers/atm/he.c
++++ b/drivers/atm/he.c
+@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev)
+ instead of '/ 512', use '>> 9' to prevent a call
+ to divdu3 on x86 platforms
+ */
+- rate_cps = (unsigned long long) (1 << exp) * (man + 512) >> 9;
++ rate_cps = (unsigned long long) (1UL << exp) * (man + 512) >> 9;
+
+ if (rate_cps < 10)
+ rate_cps = 10; /* 2.2.1 minimum payload rate is 10 cps */
+--
+2.19.1
+
--- /dev/null
+From eee258165fba193ef4c720b410d2efb1689f6f4d Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko.stuebner@bq.com>
+Date: Mon, 12 Nov 2018 10:02:57 +0100
+Subject: backlight: pwm_bl: Fix devicetree parsing with auto-generated
+ brightness tables
+
+[ Upstream commit 61170ee9386888f1e6f7e9cc58e8d9a8c2a3c1dd ]
+
+Commit 88ba95bedb79 ("backlight: pwm_bl: Compute brightness of LED linearly
+to human eye") made the parse-dt function return early when using an auto-
+generated brightness-table, but didn't take into account that some more
+settings were handled below the brightness handling, like power-on-delays
+and also setting the pdata enable-gpio to -EINVAL.
+
+This surfaces for example in the case of a backlight without any
+enable-gpio which then tries to use gpio-0 in error.
+
+Fix this by simply moving the trailing settings above the brightness
+handling.
+
+Fixes: 88ba95bedb79 ("backlight: pwm_bl: Compute brightness of LED linearly to human eye")
+Signed-off-by: Heiko Stuebner <heiko.stuebner@bq.com>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/pwm_bl.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
+index f9ef0673a083c..aded3213bfb51 100644
+--- a/drivers/video/backlight/pwm_bl.c
++++ b/drivers/video/backlight/pwm_bl.c
+@@ -268,6 +268,16 @@ static int pwm_backlight_parse_dt(struct device *dev,
+
+ memset(data, 0, sizeof(*data));
+
++ /*
++ * These values are optional and set as 0 by default, the out values
++ * are modified only if a valid u32 value can be decoded.
++ */
++ of_property_read_u32(node, "post-pwm-on-delay-ms",
++ &data->post_pwm_on_delay);
++ of_property_read_u32(node, "pwm-off-delay-ms", &data->pwm_off_delay);
++
++ data->enable_gpio = -EINVAL;
++
+ /*
+ * Determine the number of brightness levels, if this property is not
+ * set a default table of brightness levels will be used.
+@@ -380,15 +390,6 @@ static int pwm_backlight_parse_dt(struct device *dev,
+ data->max_brightness--;
+ }
+
+- /*
+- * These values are optional and set as 0 by default, the out values
+- * are modified only if a valid u32 value can be decoded.
+- */
+- of_property_read_u32(node, "post-pwm-on-delay-ms",
+- &data->post_pwm_on_delay);
+- of_property_read_u32(node, "pwm-off-delay-ms", &data->pwm_off_delay);
+-
+- data->enable_gpio = -EINVAL;
+ return 0;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 382b00b5c7f678eee66436136ee3ada86d2c59ae Mon Sep 17 00:00:00 2001
+From: Peter Oskolkov <posk@google.com>
+Date: Wed, 16 Jan 2019 08:47:54 -0800
+Subject: bpf: bpf_setsockopt: reset sock dst on SO_MARK changes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit f4924f24da8c7ef64195096817f3cde324091d97 ]
+
+In sock_setsockopt() (net/core/sock.h), when SO_MARK option is used
+to change sk_mark, sk_dst_reset(sk) is called. The same should be
+done in bpf_setsockopt().
+
+Fixes: 8c4b4c7e9ff0 ("bpf: Add setsockopt helper function to bpf")
+Reported-by: Maciej Żenczykowski <maze@google.com>
+Signed-off-by: Peter Oskolkov <posk@google.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Reviewed-by: Maciej Żenczykowski <maze@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index fa9452406f214..e176b335ddc09 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3948,7 +3948,10 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ sk->sk_rcvlowat = val ? : 1;
+ break;
+ case SO_MARK:
+- sk->sk_mark = val;
++ if (sk->sk_mark != val) {
++ sk->sk_mark = val;
++ sk_dst_reset(sk);
++ }
+ break;
+ default:
+ ret = -EINVAL;
+--
+2.19.1
+
--- /dev/null
+From 4778c2b1129d89351c9adc8dfe9457cde49bb464 Mon Sep 17 00:00:00 2001
+From: Yuchung Cheng <ycheng@google.com>
+Date: Tue, 8 Jan 2019 18:12:24 -0800
+Subject: bpf: correctly set initial window on active Fast Open sender
+
+[ Upstream commit 31aa6503a15ba00182ea6dbbf51afb63bf9e851d ]
+
+The existing BPF TCP initial congestion window (TCP_BPF_IW) does not
+to work on (active) Fast Open sender. This is because it changes the
+(initial) window only if data_segs_out is zero -- but data_segs_out
+is also incremented on SYN-data. This patch fixes the issue by
+proerly accounting for SYN-data additionally.
+
+Fixes: fc7478103c84 ("bpf: Adds support for setting initial cwnd")
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Lawrence Brakmo <brakmo@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index eb0007f30142b..fa9452406f214 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4019,7 +4019,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ /* Only some options are supported */
+ switch (optname) {
+ case TCP_BPF_IW:
+- if (val <= 0 || tp->data_segs_out > 0)
++ if (val <= 0 || tp->data_segs_out > tp->syn_data)
+ ret = -EINVAL;
+ else
+ tp->snd_cwnd = val;
+--
+2.19.1
+
--- /dev/null
+From 149f32bd36a0894c286e61383b4f23ede008b66a Mon Sep 17 00:00:00 2001
+From: Stanislav Fomichev <sdf@google.com>
+Date: Wed, 16 Jan 2019 14:03:15 -0800
+Subject: bpf: don't assume build-id length is always 20 bytes
+
+[ Upstream commit 0b698005a9d11c0e91141ec11a2c4918a129f703 ]
+
+Build-id length is not fixed to 20, it can be (`man ld` /--build-id):
+ * 128-bit (uuid)
+ * 160-bit (sha1)
+ * any length specified in ld --build-id=0xhexstring
+
+To fix the issue of missing BPF_STACK_BUILD_ID_VALID for shorter build-ids,
+assume that build-id is somewhere in the range of 1 .. 20.
+Set the remaining bytes to zero.
+
+v2:
+* don't introduce new "len = min(BPF_BUILD_ID_SIZE, nhdr->n_descsz)",
+ we already know that nhdr->n_descsz <= BPF_BUILD_ID_SIZE if we enter
+ this 'if' condition
+
+Fixes: 615755a77b24 ("bpf: extend stackmap to save binary_build_id+offset instead of address")
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/stackmap.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index d9e2483669d0b..f9df545e92f6e 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -180,11 +180,14 @@ static inline int stack_map_parse_build_id(void *page_addr,
+
+ if (nhdr->n_type == BPF_BUILD_ID &&
+ nhdr->n_namesz == sizeof("GNU") &&
+- nhdr->n_descsz == BPF_BUILD_ID_SIZE) {
++ nhdr->n_descsz > 0 &&
++ nhdr->n_descsz <= BPF_BUILD_ID_SIZE) {
+ memcpy(build_id,
+ note_start + note_offs +
+ ALIGN(sizeof("GNU"), 4) + sizeof(Elf32_Nhdr),
+- BPF_BUILD_ID_SIZE);
++ nhdr->n_descsz);
++ memset(build_id + nhdr->n_descsz, 0,
++ BPF_BUILD_ID_SIZE - nhdr->n_descsz);
+ return 0;
+ }
+ new_offs = note_offs + sizeof(Elf32_Nhdr) +
+--
+2.19.1
+
--- /dev/null
+From 372684cb4da76084fe7420dd5c49c807c5f3afb7 Mon Sep 17 00:00:00 2001
+From: Andrey Ignatov <rdna@fb.com>
+Date: Fri, 4 Jan 2019 01:07:07 -0800
+Subject: bpf: Fix [::] -> [::1] rewrite in sys_sendmsg
+
+[ Upstream commit e8e36984080b55ac5e57bdb09a5b570f2fc8e963 ]
+
+sys_sendmsg has supported unspecified destination IPv6 (wildcard) for
+unconnected UDP sockets since 876c7f41. When [::] is passed by user as
+destination, sys_sendmsg rewrites it with [::1] to be consistent with
+BSD (see "BSD'ism" comment in the code).
+
+This didn't work when cgroup-bpf was enabled though since the rewrite
+[::] -> [::1] happened before passing control to cgroup-bpf block where
+fl6.daddr was updated with passed by user sockaddr_in6.sin6_addr (that
+might or might not be changed by BPF program). That way if user passed
+[::] as dst IPv6 it was first rewritten with [::1] by original code from
+876c7f41, but then rewritten back with [::] by cgroup-bpf block.
+
+It happened even when BPF_CGROUP_UDP6_SENDMSG program was not present
+(CONFIG_CGROUP_BPF=y was enough).
+
+The fix is to apply BSD'ism after cgroup-bpf block so that [::] is
+replaced with [::1] no matter where it came from: passed by user to
+sys_sendmsg or set by BPF_CGROUP_UDP6_SENDMSG program.
+
+Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
+Reported-by: Nitin Rawat <nitin.rawat@intel.com>
+Signed-off-by: Andrey Ignatov <rdna@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/udp.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index d01ec252cb81d..848dd38a907a1 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1322,10 +1322,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ ipc6.opt = opt;
+
+ fl6.flowi6_proto = sk->sk_protocol;
+- if (!ipv6_addr_any(daddr))
+- fl6.daddr = *daddr;
+- else
+- fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
++ fl6.daddr = *daddr;
+ if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr))
+ fl6.saddr = np->saddr;
+ fl6.fl6_sport = inet->inet_sport;
+@@ -1353,6 +1350,9 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ }
+ }
+
++ if (ipv6_addr_any(&fl6.daddr))
++ fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
++
+ final_p = fl6_update_dst(&fl6, opt, &final);
+ if (final_p)
+ connected = false;
+--
+2.19.1
+
--- /dev/null
+From 7100ce1ea83e98fb2535e34a8877fd3182919aff Mon Sep 17 00:00:00 2001
+From: Song Liu <songliubraving@fb.com>
+Date: Tue, 8 Jan 2019 14:20:44 -0800
+Subject: bpf: fix panic in stack_map_get_build_id() on i386 and arm32
+
+[ Upstream commit beaf3d1901f4ea46fbd5c9d857227d99751de469 ]
+
+As Naresh reported, test_stacktrace_build_id() causes panic on i386 and
+arm32 systems. This is caused by page_address() returns NULL in certain
+cases.
+
+This patch fixes this error by using kmap_atomic/kunmap_atomic instead
+of page_address.
+
+Fixes: 615755a77b24 (" bpf: extend stackmap to save binary_build_id+offset instead of address")
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/stackmap.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index 90daf285de032..d9e2483669d0b 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -260,7 +260,7 @@ static int stack_map_get_build_id(struct vm_area_struct *vma,
+ return -EFAULT; /* page not mapped */
+
+ ret = -EINVAL;
+- page_addr = page_address(page);
++ page_addr = kmap_atomic(page);
+ ehdr = (Elf32_Ehdr *)page_addr;
+
+ /* compare magic x7f "ELF" */
+@@ -276,6 +276,7 @@ static int stack_map_get_build_id(struct vm_area_struct *vma,
+ else if (ehdr->e_ident[EI_CLASS] == ELFCLASS64)
+ ret = stack_map_get_build_id_64(page_addr, build_id);
+ out:
++ kunmap_atomic(page_addr);
+ put_page(page);
+ return ret;
+ }
+--
+2.19.1
+
--- /dev/null
+From 2a789ab62c37dedfeae179eb6eb085b1e811033a Mon Sep 17 00:00:00 2001
+From: Yuchung Cheng <ycheng@google.com>
+Date: Thu, 17 Jan 2019 08:51:01 -0800
+Subject: bpf: fix SO_MAX_PACING_RATE to support TCP internal pacing
+
+[ Upstream commit e224c390a6259c529f7b2a6bd215a087b3344f5c ]
+
+If sch_fq packet scheduler is not used, TCP can fallback to
+internal pacing, but this requires sk_pacing_status to
+be properly set.
+
+Fixes: 8c4b4c7e9ff0 ("bpf: Add setsockopt helper function to bpf")
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Lawrence Brakmo <brakmo@fb.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index e176b335ddc09..16350f8c8815a 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3935,6 +3935,10 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
+ break;
+ case SO_MAX_PACING_RATE: /* 32bit version */
++ if (val != ~0U)
++ cmpxchg(&sk->sk_pacing_status,
++ SK_PACING_NONE,
++ SK_PACING_NEEDED);
+ sk->sk_max_pacing_rate = (val == ~0U) ? ~0UL : val;
+ sk->sk_pacing_rate = min(sk->sk_pacing_rate,
+ sk->sk_max_pacing_rate);
+--
+2.19.1
+
--- /dev/null
+From 554268f8441317bf79f7ea9afbc970b45eb6afd6 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Thu, 17 Jan 2019 16:15:09 +0100
+Subject: bpf: pull in pkt_sched.h header for tooling to fix bpftool build
+
+[ Upstream commit ad6dd7a9c47ba587c0aba57f73737764cd31136f ]
+
+Dan reported that bpftool does not compile for him:
+
+ $ make tools/bpf
+ DESCEND bpf
+
+ Auto-detecting system features:
+ .. libbfd: [ on ]
+ .. disassembler-four-args: [ OFF ]
+
+ DESCEND bpftool
+
+ Auto-detecting system features:
+ .. libbfd: [ on ]
+ .. disassembler-four-args: [ OFF ]
+
+ CC /opt/linux.git/tools/bpf/bpftool/net.o
+ In file included from /opt/linux.git/tools/include/uapi/linux/pkt_cls.h:6:0,
+ from /opt/linux.git/tools/include/uapi/linux/tc_act/tc_bpf.h:14,
+ from net.c:13:
+ net.c: In function 'show_dev_tc_bpf':
+ net.c:164:21: error: 'TC_H_CLSACT' undeclared (first use in this function)
+ handle = TC_H_MAKE(TC_H_CLSACT, TC_H_MIN_INGRESS);
+ [...]
+
+Fix it by importing pkt_sched.h header copy into tooling
+infrastructure.
+
+Fixes: 49a249c38726 ("tools/bpftool: copy a few net uapi headers to tools directory")
+Fixes: f6f3bac08ff9 ("tools/bpf: bpftool: add net support")
+Reported-by: Dan Gilson <dan_gilson@yahoo.com>
+Reference: https://bugzilla.kernel.org/show_bug.cgi?id=202315
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/uapi/linux/pkt_sched.h | 1163 ++++++++++++++++++++++++++
+ 1 file changed, 1163 insertions(+)
+ create mode 100644 tools/include/uapi/linux/pkt_sched.h
+
+diff --git a/tools/include/uapi/linux/pkt_sched.h b/tools/include/uapi/linux/pkt_sched.h
+new file mode 100644
+index 0000000000000..0d18b1d1fbbc8
+--- /dev/null
++++ b/tools/include/uapi/linux/pkt_sched.h
+@@ -0,0 +1,1163 @@
++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++#ifndef __LINUX_PKT_SCHED_H
++#define __LINUX_PKT_SCHED_H
++
++#include <linux/types.h>
++
++/* Logical priority bands not depending on specific packet scheduler.
++ Every scheduler will map them to real traffic classes, if it has
++ no more precise mechanism to classify packets.
++
++ These numbers have no special meaning, though their coincidence
++ with obsolete IPv6 values is not occasional :-). New IPv6 drafts
++ preferred full anarchy inspired by diffserv group.
++
++ Note: TC_PRIO_BESTEFFORT does not mean that it is the most unhappy
++ class, actually, as rule it will be handled with more care than
++ filler or even bulk.
++ */
++
++#define TC_PRIO_BESTEFFORT 0
++#define TC_PRIO_FILLER 1
++#define TC_PRIO_BULK 2
++#define TC_PRIO_INTERACTIVE_BULK 4
++#define TC_PRIO_INTERACTIVE 6
++#define TC_PRIO_CONTROL 7
++
++#define TC_PRIO_MAX 15
++
++/* Generic queue statistics, available for all the elements.
++ Particular schedulers may have also their private records.
++ */
++
++struct tc_stats {
++ __u64 bytes; /* Number of enqueued bytes */
++ __u32 packets; /* Number of enqueued packets */
++ __u32 drops; /* Packets dropped because of lack of resources */
++ __u32 overlimits; /* Number of throttle events when this
++ * flow goes out of allocated bandwidth */
++ __u32 bps; /* Current flow byte rate */
++ __u32 pps; /* Current flow packet rate */
++ __u32 qlen;
++ __u32 backlog;
++};
++
++struct tc_estimator {
++ signed char interval;
++ unsigned char ewma_log;
++};
++
++/* "Handles"
++ ---------
++
++ All the traffic control objects have 32bit identifiers, or "handles".
++
++ They can be considered as opaque numbers from user API viewpoint,
++ but actually they always consist of two fields: major and
++ minor numbers, which are interpreted by kernel specially,
++ that may be used by applications, though not recommended.
++
++ F.e. qdisc handles always have minor number equal to zero,
++ classes (or flows) have major equal to parent qdisc major, and
++ minor uniquely identifying class inside qdisc.
++
++ Macros to manipulate handles:
++ */
++
++#define TC_H_MAJ_MASK (0xFFFF0000U)
++#define TC_H_MIN_MASK (0x0000FFFFU)
++#define TC_H_MAJ(h) ((h)&TC_H_MAJ_MASK)
++#define TC_H_MIN(h) ((h)&TC_H_MIN_MASK)
++#define TC_H_MAKE(maj,min) (((maj)&TC_H_MAJ_MASK)|((min)&TC_H_MIN_MASK))
++
++#define TC_H_UNSPEC (0U)
++#define TC_H_ROOT (0xFFFFFFFFU)
++#define TC_H_INGRESS (0xFFFFFFF1U)
++#define TC_H_CLSACT TC_H_INGRESS
++
++#define TC_H_MIN_PRIORITY 0xFFE0U
++#define TC_H_MIN_INGRESS 0xFFF2U
++#define TC_H_MIN_EGRESS 0xFFF3U
++
++/* Need to corrospond to iproute2 tc/tc_core.h "enum link_layer" */
++enum tc_link_layer {
++ TC_LINKLAYER_UNAWARE, /* Indicate unaware old iproute2 util */
++ TC_LINKLAYER_ETHERNET,
++ TC_LINKLAYER_ATM,
++};
++#define TC_LINKLAYER_MASK 0x0F /* limit use to lower 4 bits */
++
++struct tc_ratespec {
++ unsigned char cell_log;
++ __u8 linklayer; /* lower 4 bits */
++ unsigned short overhead;
++ short cell_align;
++ unsigned short mpu;
++ __u32 rate;
++};
++
++#define TC_RTAB_SIZE 1024
++
++struct tc_sizespec {
++ unsigned char cell_log;
++ unsigned char size_log;
++ short cell_align;
++ int overhead;
++ unsigned int linklayer;
++ unsigned int mpu;
++ unsigned int mtu;
++ unsigned int tsize;
++};
++
++enum {
++ TCA_STAB_UNSPEC,
++ TCA_STAB_BASE,
++ TCA_STAB_DATA,
++ __TCA_STAB_MAX
++};
++
++#define TCA_STAB_MAX (__TCA_STAB_MAX - 1)
++
++/* FIFO section */
++
++struct tc_fifo_qopt {
++ __u32 limit; /* Queue length: bytes for bfifo, packets for pfifo */
++};
++
++/* SKBPRIO section */
++
++/*
++ * Priorities go from zero to (SKBPRIO_MAX_PRIORITY - 1).
++ * SKBPRIO_MAX_PRIORITY should be at least 64 in order for skbprio to be able
++ * to map one to one the DS field of IPV4 and IPV6 headers.
++ * Memory allocation grows linearly with SKBPRIO_MAX_PRIORITY.
++ */
++
++#define SKBPRIO_MAX_PRIORITY 64
++
++struct tc_skbprio_qopt {
++ __u32 limit; /* Queue length in packets. */
++};
++
++/* PRIO section */
++
++#define TCQ_PRIO_BANDS 16
++#define TCQ_MIN_PRIO_BANDS 2
++
++struct tc_prio_qopt {
++ int bands; /* Number of bands */
++ __u8 priomap[TC_PRIO_MAX+1]; /* Map: logical priority -> PRIO band */
++};
++
++/* MULTIQ section */
++
++struct tc_multiq_qopt {
++ __u16 bands; /* Number of bands */
++ __u16 max_bands; /* Maximum number of queues */
++};
++
++/* PLUG section */
++
++#define TCQ_PLUG_BUFFER 0
++#define TCQ_PLUG_RELEASE_ONE 1
++#define TCQ_PLUG_RELEASE_INDEFINITE 2
++#define TCQ_PLUG_LIMIT 3
++
++struct tc_plug_qopt {
++ /* TCQ_PLUG_BUFFER: Inset a plug into the queue and
++ * buffer any incoming packets
++ * TCQ_PLUG_RELEASE_ONE: Dequeue packets from queue head
++ * to beginning of the next plug.
++ * TCQ_PLUG_RELEASE_INDEFINITE: Dequeue all packets from queue.
++ * Stop buffering packets until the next TCQ_PLUG_BUFFER
++ * command is received (just act as a pass-thru queue).
++ * TCQ_PLUG_LIMIT: Increase/decrease queue size
++ */
++ int action;
++ __u32 limit;
++};
++
++/* TBF section */
++
++struct tc_tbf_qopt {
++ struct tc_ratespec rate;
++ struct tc_ratespec peakrate;
++ __u32 limit;
++ __u32 buffer;
++ __u32 mtu;
++};
++
++enum {
++ TCA_TBF_UNSPEC,
++ TCA_TBF_PARMS,
++ TCA_TBF_RTAB,
++ TCA_TBF_PTAB,
++ TCA_TBF_RATE64,
++ TCA_TBF_PRATE64,
++ TCA_TBF_BURST,
++ TCA_TBF_PBURST,
++ TCA_TBF_PAD,
++ __TCA_TBF_MAX,
++};
++
++#define TCA_TBF_MAX (__TCA_TBF_MAX - 1)
++
++
++/* TEQL section */
++
++/* TEQL does not require any parameters */
++
++/* SFQ section */
++
++struct tc_sfq_qopt {
++ unsigned quantum; /* Bytes per round allocated to flow */
++ int perturb_period; /* Period of hash perturbation */
++ __u32 limit; /* Maximal packets in queue */
++ unsigned divisor; /* Hash divisor */
++ unsigned flows; /* Maximal number of flows */
++};
++
++struct tc_sfqred_stats {
++ __u32 prob_drop; /* Early drops, below max threshold */
++ __u32 forced_drop; /* Early drops, after max threshold */
++ __u32 prob_mark; /* Marked packets, below max threshold */
++ __u32 forced_mark; /* Marked packets, after max threshold */
++ __u32 prob_mark_head; /* Marked packets, below max threshold */
++ __u32 forced_mark_head;/* Marked packets, after max threshold */
++};
++
++struct tc_sfq_qopt_v1 {
++ struct tc_sfq_qopt v0;
++ unsigned int depth; /* max number of packets per flow */
++ unsigned int headdrop;
++/* SFQRED parameters */
++ __u32 limit; /* HARD maximal flow queue length (bytes) */
++ __u32 qth_min; /* Min average length threshold (bytes) */
++ __u32 qth_max; /* Max average length threshold (bytes) */
++ unsigned char Wlog; /* log(W) */
++ unsigned char Plog; /* log(P_max/(qth_max-qth_min)) */
++ unsigned char Scell_log; /* cell size for idle damping */
++ unsigned char flags;
++ __u32 max_P; /* probability, high resolution */
++/* SFQRED stats */
++ struct tc_sfqred_stats stats;
++};
++
++
++struct tc_sfq_xstats {
++ __s32 allot;
++};
++
++/* RED section */
++
++enum {
++ TCA_RED_UNSPEC,
++ TCA_RED_PARMS,
++ TCA_RED_STAB,
++ TCA_RED_MAX_P,
++ __TCA_RED_MAX,
++};
++
++#define TCA_RED_MAX (__TCA_RED_MAX - 1)
++
++struct tc_red_qopt {
++ __u32 limit; /* HARD maximal queue length (bytes) */
++ __u32 qth_min; /* Min average length threshold (bytes) */
++ __u32 qth_max; /* Max average length threshold (bytes) */
++ unsigned char Wlog; /* log(W) */
++ unsigned char Plog; /* log(P_max/(qth_max-qth_min)) */
++ unsigned char Scell_log; /* cell size for idle damping */
++ unsigned char flags;
++#define TC_RED_ECN 1
++#define TC_RED_HARDDROP 2
++#define TC_RED_ADAPTATIVE 4
++};
++
++struct tc_red_xstats {
++ __u32 early; /* Early drops */
++ __u32 pdrop; /* Drops due to queue limits */
++ __u32 other; /* Drops due to drop() calls */
++ __u32 marked; /* Marked packets */
++};
++
++/* GRED section */
++
++#define MAX_DPs 16
++
++enum {
++ TCA_GRED_UNSPEC,
++ TCA_GRED_PARMS,
++ TCA_GRED_STAB,
++ TCA_GRED_DPS,
++ TCA_GRED_MAX_P,
++ TCA_GRED_LIMIT,
++ TCA_GRED_VQ_LIST, /* nested TCA_GRED_VQ_ENTRY */
++ __TCA_GRED_MAX,
++};
++
++#define TCA_GRED_MAX (__TCA_GRED_MAX - 1)
++
++enum {
++ TCA_GRED_VQ_ENTRY_UNSPEC,
++ TCA_GRED_VQ_ENTRY, /* nested TCA_GRED_VQ_* */
++ __TCA_GRED_VQ_ENTRY_MAX,
++};
++#define TCA_GRED_VQ_ENTRY_MAX (__TCA_GRED_VQ_ENTRY_MAX - 1)
++
++enum {
++ TCA_GRED_VQ_UNSPEC,
++ TCA_GRED_VQ_PAD,
++ TCA_GRED_VQ_DP, /* u32 */
++ TCA_GRED_VQ_STAT_BYTES, /* u64 */
++ TCA_GRED_VQ_STAT_PACKETS, /* u32 */
++ TCA_GRED_VQ_STAT_BACKLOG, /* u32 */
++ TCA_GRED_VQ_STAT_PROB_DROP, /* u32 */
++ TCA_GRED_VQ_STAT_PROB_MARK, /* u32 */
++ TCA_GRED_VQ_STAT_FORCED_DROP, /* u32 */
++ TCA_GRED_VQ_STAT_FORCED_MARK, /* u32 */
++ TCA_GRED_VQ_STAT_PDROP, /* u32 */
++ TCA_GRED_VQ_STAT_OTHER, /* u32 */
++ TCA_GRED_VQ_FLAGS, /* u32 */
++ __TCA_GRED_VQ_MAX
++};
++
++#define TCA_GRED_VQ_MAX (__TCA_GRED_VQ_MAX - 1)
++
++struct tc_gred_qopt {
++ __u32 limit; /* HARD maximal queue length (bytes) */
++ __u32 qth_min; /* Min average length threshold (bytes) */
++ __u32 qth_max; /* Max average length threshold (bytes) */
++ __u32 DP; /* up to 2^32 DPs */
++ __u32 backlog;
++ __u32 qave;
++ __u32 forced;
++ __u32 early;
++ __u32 other;
++ __u32 pdrop;
++ __u8 Wlog; /* log(W) */
++ __u8 Plog; /* log(P_max/(qth_max-qth_min)) */
++ __u8 Scell_log; /* cell size for idle damping */
++ __u8 prio; /* prio of this VQ */
++ __u32 packets;
++ __u32 bytesin;
++};
++
++/* gred setup */
++struct tc_gred_sopt {
++ __u32 DPs;
++ __u32 def_DP;
++ __u8 grio;
++ __u8 flags;
++ __u16 pad1;
++};
++
++/* CHOKe section */
++
++enum {
++ TCA_CHOKE_UNSPEC,
++ TCA_CHOKE_PARMS,
++ TCA_CHOKE_STAB,
++ TCA_CHOKE_MAX_P,
++ __TCA_CHOKE_MAX,
++};
++
++#define TCA_CHOKE_MAX (__TCA_CHOKE_MAX - 1)
++
++struct tc_choke_qopt {
++ __u32 limit; /* Hard queue length (packets) */
++ __u32 qth_min; /* Min average threshold (packets) */
++ __u32 qth_max; /* Max average threshold (packets) */
++ unsigned char Wlog; /* log(W) */
++ unsigned char Plog; /* log(P_max/(qth_max-qth_min)) */
++ unsigned char Scell_log; /* cell size for idle damping */
++ unsigned char flags; /* see RED flags */
++};
++
++struct tc_choke_xstats {
++ __u32 early; /* Early drops */
++ __u32 pdrop; /* Drops due to queue limits */
++ __u32 other; /* Drops due to drop() calls */
++ __u32 marked; /* Marked packets */
++ __u32 matched; /* Drops due to flow match */
++};
++
++/* HTB section */
++#define TC_HTB_NUMPRIO 8
++#define TC_HTB_MAXDEPTH 8
++#define TC_HTB_PROTOVER 3 /* the same as HTB and TC's major */
++
++struct tc_htb_opt {
++ struct tc_ratespec rate;
++ struct tc_ratespec ceil;
++ __u32 buffer;
++ __u32 cbuffer;
++ __u32 quantum;
++ __u32 level; /* out only */
++ __u32 prio;
++};
++struct tc_htb_glob {
++ __u32 version; /* to match HTB/TC */
++ __u32 rate2quantum; /* bps->quantum divisor */
++ __u32 defcls; /* default class number */
++ __u32 debug; /* debug flags */
++
++ /* stats */
++ __u32 direct_pkts; /* count of non shaped packets */
++};
++enum {
++ TCA_HTB_UNSPEC,
++ TCA_HTB_PARMS,
++ TCA_HTB_INIT,
++ TCA_HTB_CTAB,
++ TCA_HTB_RTAB,
++ TCA_HTB_DIRECT_QLEN,
++ TCA_HTB_RATE64,
++ TCA_HTB_CEIL64,
++ TCA_HTB_PAD,
++ __TCA_HTB_MAX,
++};
++
++#define TCA_HTB_MAX (__TCA_HTB_MAX - 1)
++
++struct tc_htb_xstats {
++ __u32 lends;
++ __u32 borrows;
++ __u32 giants; /* unused since 'Make HTB scheduler work with TSO.' */
++ __s32 tokens;
++ __s32 ctokens;
++};
++
++/* HFSC section */
++
++struct tc_hfsc_qopt {
++ __u16 defcls; /* default class */
++};
++
++struct tc_service_curve {
++ __u32 m1; /* slope of the first segment in bps */
++ __u32 d; /* x-projection of the first segment in us */
++ __u32 m2; /* slope of the second segment in bps */
++};
++
++struct tc_hfsc_stats {
++ __u64 work; /* total work done */
++ __u64 rtwork; /* work done by real-time criteria */
++ __u32 period; /* current period */
++ __u32 level; /* class level in hierarchy */
++};
++
++enum {
++ TCA_HFSC_UNSPEC,
++ TCA_HFSC_RSC,
++ TCA_HFSC_FSC,
++ TCA_HFSC_USC,
++ __TCA_HFSC_MAX,
++};
++
++#define TCA_HFSC_MAX (__TCA_HFSC_MAX - 1)
++
++
++/* CBQ section */
++
++#define TC_CBQ_MAXPRIO 8
++#define TC_CBQ_MAXLEVEL 8
++#define TC_CBQ_DEF_EWMA 5
++
++struct tc_cbq_lssopt {
++ unsigned char change;
++ unsigned char flags;
++#define TCF_CBQ_LSS_BOUNDED 1
++#define TCF_CBQ_LSS_ISOLATED 2
++ unsigned char ewma_log;
++ unsigned char level;
++#define TCF_CBQ_LSS_FLAGS 1
++#define TCF_CBQ_LSS_EWMA 2
++#define TCF_CBQ_LSS_MAXIDLE 4
++#define TCF_CBQ_LSS_MINIDLE 8
++#define TCF_CBQ_LSS_OFFTIME 0x10
++#define TCF_CBQ_LSS_AVPKT 0x20
++ __u32 maxidle;
++ __u32 minidle;
++ __u32 offtime;
++ __u32 avpkt;
++};
++
++struct tc_cbq_wrropt {
++ unsigned char flags;
++ unsigned char priority;
++ unsigned char cpriority;
++ unsigned char __reserved;
++ __u32 allot;
++ __u32 weight;
++};
++
++struct tc_cbq_ovl {
++ unsigned char strategy;
++#define TC_CBQ_OVL_CLASSIC 0
++#define TC_CBQ_OVL_DELAY 1
++#define TC_CBQ_OVL_LOWPRIO 2
++#define TC_CBQ_OVL_DROP 3
++#define TC_CBQ_OVL_RCLASSIC 4
++ unsigned char priority2;
++ __u16 pad;
++ __u32 penalty;
++};
++
++struct tc_cbq_police {
++ unsigned char police;
++ unsigned char __res1;
++ unsigned short __res2;
++};
++
++struct tc_cbq_fopt {
++ __u32 split;
++ __u32 defmap;
++ __u32 defchange;
++};
++
++struct tc_cbq_xstats {
++ __u32 borrows;
++ __u32 overactions;
++ __s32 avgidle;
++ __s32 undertime;
++};
++
++enum {
++ TCA_CBQ_UNSPEC,
++ TCA_CBQ_LSSOPT,
++ TCA_CBQ_WRROPT,
++ TCA_CBQ_FOPT,
++ TCA_CBQ_OVL_STRATEGY,
++ TCA_CBQ_RATE,
++ TCA_CBQ_RTAB,
++ TCA_CBQ_POLICE,
++ __TCA_CBQ_MAX,
++};
++
++#define TCA_CBQ_MAX (__TCA_CBQ_MAX - 1)
++
++/* dsmark section */
++
++enum {
++ TCA_DSMARK_UNSPEC,
++ TCA_DSMARK_INDICES,
++ TCA_DSMARK_DEFAULT_INDEX,
++ TCA_DSMARK_SET_TC_INDEX,
++ TCA_DSMARK_MASK,
++ TCA_DSMARK_VALUE,
++ __TCA_DSMARK_MAX,
++};
++
++#define TCA_DSMARK_MAX (__TCA_DSMARK_MAX - 1)
++
++/* ATM section */
++
++enum {
++ TCA_ATM_UNSPEC,
++ TCA_ATM_FD, /* file/socket descriptor */
++ TCA_ATM_PTR, /* pointer to descriptor - later */
++ TCA_ATM_HDR, /* LL header */
++ TCA_ATM_EXCESS, /* excess traffic class (0 for CLP) */
++ TCA_ATM_ADDR, /* PVC address (for output only) */
++ TCA_ATM_STATE, /* VC state (ATM_VS_*; for output only) */
++ __TCA_ATM_MAX,
++};
++
++#define TCA_ATM_MAX (__TCA_ATM_MAX - 1)
++
++/* Network emulator */
++
++enum {
++ TCA_NETEM_UNSPEC,
++ TCA_NETEM_CORR,
++ TCA_NETEM_DELAY_DIST,
++ TCA_NETEM_REORDER,
++ TCA_NETEM_CORRUPT,
++ TCA_NETEM_LOSS,
++ TCA_NETEM_RATE,
++ TCA_NETEM_ECN,
++ TCA_NETEM_RATE64,
++ TCA_NETEM_PAD,
++ TCA_NETEM_LATENCY64,
++ TCA_NETEM_JITTER64,
++ TCA_NETEM_SLOT,
++ TCA_NETEM_SLOT_DIST,
++ __TCA_NETEM_MAX,
++};
++
++#define TCA_NETEM_MAX (__TCA_NETEM_MAX - 1)
++
++struct tc_netem_qopt {
++ __u32 latency; /* added delay (us) */
++ __u32 limit; /* fifo limit (packets) */
++ __u32 loss; /* random packet loss (0=none ~0=100%) */
++ __u32 gap; /* re-ordering gap (0 for none) */
++ __u32 duplicate; /* random packet dup (0=none ~0=100%) */
++ __u32 jitter; /* random jitter in latency (us) */
++};
++
++struct tc_netem_corr {
++ __u32 delay_corr; /* delay correlation */
++ __u32 loss_corr; /* packet loss correlation */
++ __u32 dup_corr; /* duplicate correlation */
++};
++
++struct tc_netem_reorder {
++ __u32 probability;
++ __u32 correlation;
++};
++
++struct tc_netem_corrupt {
++ __u32 probability;
++ __u32 correlation;
++};
++
++struct tc_netem_rate {
++ __u32 rate; /* byte/s */
++ __s32 packet_overhead;
++ __u32 cell_size;
++ __s32 cell_overhead;
++};
++
++struct tc_netem_slot {
++ __s64 min_delay; /* nsec */
++ __s64 max_delay;
++ __s32 max_packets;
++ __s32 max_bytes;
++ __s64 dist_delay; /* nsec */
++ __s64 dist_jitter; /* nsec */
++};
++
++enum {
++ NETEM_LOSS_UNSPEC,
++ NETEM_LOSS_GI, /* General Intuitive - 4 state model */
++ NETEM_LOSS_GE, /* Gilbert Elliot models */
++ __NETEM_LOSS_MAX
++};
++#define NETEM_LOSS_MAX (__NETEM_LOSS_MAX - 1)
++
++/* State transition probabilities for 4 state model */
++struct tc_netem_gimodel {
++ __u32 p13;
++ __u32 p31;
++ __u32 p32;
++ __u32 p14;
++ __u32 p23;
++};
++
++/* Gilbert-Elliot models */
++struct tc_netem_gemodel {
++ __u32 p;
++ __u32 r;
++ __u32 h;
++ __u32 k1;
++};
++
++#define NETEM_DIST_SCALE 8192
++#define NETEM_DIST_MAX 16384
++
++/* DRR */
++
++enum {
++ TCA_DRR_UNSPEC,
++ TCA_DRR_QUANTUM,
++ __TCA_DRR_MAX
++};
++
++#define TCA_DRR_MAX (__TCA_DRR_MAX - 1)
++
++struct tc_drr_stats {
++ __u32 deficit;
++};
++
++/* MQPRIO */
++#define TC_QOPT_BITMASK 15
++#define TC_QOPT_MAX_QUEUE 16
++
++enum {
++ TC_MQPRIO_HW_OFFLOAD_NONE, /* no offload requested */
++ TC_MQPRIO_HW_OFFLOAD_TCS, /* offload TCs, no queue counts */
++ __TC_MQPRIO_HW_OFFLOAD_MAX
++};
++
++#define TC_MQPRIO_HW_OFFLOAD_MAX (__TC_MQPRIO_HW_OFFLOAD_MAX - 1)
++
++enum {
++ TC_MQPRIO_MODE_DCB,
++ TC_MQPRIO_MODE_CHANNEL,
++ __TC_MQPRIO_MODE_MAX
++};
++
++#define __TC_MQPRIO_MODE_MAX (__TC_MQPRIO_MODE_MAX - 1)
++
++enum {
++ TC_MQPRIO_SHAPER_DCB,
++ TC_MQPRIO_SHAPER_BW_RATE, /* Add new shapers below */
++ __TC_MQPRIO_SHAPER_MAX
++};
++
++#define __TC_MQPRIO_SHAPER_MAX (__TC_MQPRIO_SHAPER_MAX - 1)
++
++struct tc_mqprio_qopt {
++ __u8 num_tc;
++ __u8 prio_tc_map[TC_QOPT_BITMASK + 1];
++ __u8 hw;
++ __u16 count[TC_QOPT_MAX_QUEUE];
++ __u16 offset[TC_QOPT_MAX_QUEUE];
++};
++
++#define TC_MQPRIO_F_MODE 0x1
++#define TC_MQPRIO_F_SHAPER 0x2
++#define TC_MQPRIO_F_MIN_RATE 0x4
++#define TC_MQPRIO_F_MAX_RATE 0x8
++
++enum {
++ TCA_MQPRIO_UNSPEC,
++ TCA_MQPRIO_MODE,
++ TCA_MQPRIO_SHAPER,
++ TCA_MQPRIO_MIN_RATE64,
++ TCA_MQPRIO_MAX_RATE64,
++ __TCA_MQPRIO_MAX,
++};
++
++#define TCA_MQPRIO_MAX (__TCA_MQPRIO_MAX - 1)
++
++/* SFB */
++
++enum {
++ TCA_SFB_UNSPEC,
++ TCA_SFB_PARMS,
++ __TCA_SFB_MAX,
++};
++
++#define TCA_SFB_MAX (__TCA_SFB_MAX - 1)
++
++/*
++ * Note: increment, decrement are Q0.16 fixed-point values.
++ */
++struct tc_sfb_qopt {
++ __u32 rehash_interval; /* delay between hash move, in ms */
++ __u32 warmup_time; /* double buffering warmup time in ms (warmup_time < rehash_interval) */
++ __u32 max; /* max len of qlen_min */
++ __u32 bin_size; /* maximum queue length per bin */
++ __u32 increment; /* probability increment, (d1 in Blue) */
++ __u32 decrement; /* probability decrement, (d2 in Blue) */
++ __u32 limit; /* max SFB queue length */
++ __u32 penalty_rate; /* inelastic flows are rate limited to 'rate' pps */
++ __u32 penalty_burst;
++};
++
++struct tc_sfb_xstats {
++ __u32 earlydrop;
++ __u32 penaltydrop;
++ __u32 bucketdrop;
++ __u32 queuedrop;
++ __u32 childdrop; /* drops in child qdisc */
++ __u32 marked;
++ __u32 maxqlen;
++ __u32 maxprob;
++ __u32 avgprob;
++};
++
++#define SFB_MAX_PROB 0xFFFF
++
++/* QFQ */
++enum {
++ TCA_QFQ_UNSPEC,
++ TCA_QFQ_WEIGHT,
++ TCA_QFQ_LMAX,
++ __TCA_QFQ_MAX
++};
++
++#define TCA_QFQ_MAX (__TCA_QFQ_MAX - 1)
++
++struct tc_qfq_stats {
++ __u32 weight;
++ __u32 lmax;
++};
++
++/* CODEL */
++
++enum {
++ TCA_CODEL_UNSPEC,
++ TCA_CODEL_TARGET,
++ TCA_CODEL_LIMIT,
++ TCA_CODEL_INTERVAL,
++ TCA_CODEL_ECN,
++ TCA_CODEL_CE_THRESHOLD,
++ __TCA_CODEL_MAX
++};
++
++#define TCA_CODEL_MAX (__TCA_CODEL_MAX - 1)
++
++struct tc_codel_xstats {
++ __u32 maxpacket; /* largest packet we've seen so far */
++ __u32 count; /* how many drops we've done since the last time we
++ * entered dropping state
++ */
++ __u32 lastcount; /* count at entry to dropping state */
++ __u32 ldelay; /* in-queue delay seen by most recently dequeued packet */
++ __s32 drop_next; /* time to drop next packet */
++ __u32 drop_overlimit; /* number of time max qdisc packet limit was hit */
++ __u32 ecn_mark; /* number of packets we ECN marked instead of dropped */
++ __u32 dropping; /* are we in dropping state ? */
++ __u32 ce_mark; /* number of CE marked packets because of ce_threshold */
++};
++
++/* FQ_CODEL */
++
++enum {
++ TCA_FQ_CODEL_UNSPEC,
++ TCA_FQ_CODEL_TARGET,
++ TCA_FQ_CODEL_LIMIT,
++ TCA_FQ_CODEL_INTERVAL,
++ TCA_FQ_CODEL_ECN,
++ TCA_FQ_CODEL_FLOWS,
++ TCA_FQ_CODEL_QUANTUM,
++ TCA_FQ_CODEL_CE_THRESHOLD,
++ TCA_FQ_CODEL_DROP_BATCH_SIZE,
++ TCA_FQ_CODEL_MEMORY_LIMIT,
++ __TCA_FQ_CODEL_MAX
++};
++
++#define TCA_FQ_CODEL_MAX (__TCA_FQ_CODEL_MAX - 1)
++
++enum {
++ TCA_FQ_CODEL_XSTATS_QDISC,
++ TCA_FQ_CODEL_XSTATS_CLASS,
++};
++
++struct tc_fq_codel_qd_stats {
++ __u32 maxpacket; /* largest packet we've seen so far */
++ __u32 drop_overlimit; /* number of time max qdisc
++ * packet limit was hit
++ */
++ __u32 ecn_mark; /* number of packets we ECN marked
++ * instead of being dropped
++ */
++ __u32 new_flow_count; /* number of time packets
++ * created a 'new flow'
++ */
++ __u32 new_flows_len; /* count of flows in new list */
++ __u32 old_flows_len; /* count of flows in old list */
++ __u32 ce_mark; /* packets above ce_threshold */
++ __u32 memory_usage; /* in bytes */
++ __u32 drop_overmemory;
++};
++
++struct tc_fq_codel_cl_stats {
++ __s32 deficit;
++ __u32 ldelay; /* in-queue delay seen by most recently
++ * dequeued packet
++ */
++ __u32 count;
++ __u32 lastcount;
++ __u32 dropping;
++ __s32 drop_next;
++};
++
++struct tc_fq_codel_xstats {
++ __u32 type;
++ union {
++ struct tc_fq_codel_qd_stats qdisc_stats;
++ struct tc_fq_codel_cl_stats class_stats;
++ };
++};
++
++/* FQ */
++
++enum {
++ TCA_FQ_UNSPEC,
++
++ TCA_FQ_PLIMIT, /* limit of total number of packets in queue */
++
++ TCA_FQ_FLOW_PLIMIT, /* limit of packets per flow */
++
++ TCA_FQ_QUANTUM, /* RR quantum */
++
++ TCA_FQ_INITIAL_QUANTUM, /* RR quantum for new flow */
++
++ TCA_FQ_RATE_ENABLE, /* enable/disable rate limiting */
++
++ TCA_FQ_FLOW_DEFAULT_RATE,/* obsolete, do not use */
++
++ TCA_FQ_FLOW_MAX_RATE, /* per flow max rate */
++
++ TCA_FQ_BUCKETS_LOG, /* log2(number of buckets) */
++
++ TCA_FQ_FLOW_REFILL_DELAY, /* flow credit refill delay in usec */
++
++ TCA_FQ_ORPHAN_MASK, /* mask applied to orphaned skb hashes */
++
++ TCA_FQ_LOW_RATE_THRESHOLD, /* per packet delay under this rate */
++
++ TCA_FQ_CE_THRESHOLD, /* DCTCP-like CE-marking threshold */
++
++ __TCA_FQ_MAX
++};
++
++#define TCA_FQ_MAX (__TCA_FQ_MAX - 1)
++
++struct tc_fq_qd_stats {
++ __u64 gc_flows;
++ __u64 highprio_packets;
++ __u64 tcp_retrans;
++ __u64 throttled;
++ __u64 flows_plimit;
++ __u64 pkts_too_long;
++ __u64 allocation_errors;
++ __s64 time_next_delayed_flow;
++ __u32 flows;
++ __u32 inactive_flows;
++ __u32 throttled_flows;
++ __u32 unthrottle_latency_ns;
++ __u64 ce_mark; /* packets above ce_threshold */
++};
++
++/* Heavy-Hitter Filter */
++
++enum {
++ TCA_HHF_UNSPEC,
++ TCA_HHF_BACKLOG_LIMIT,
++ TCA_HHF_QUANTUM,
++ TCA_HHF_HH_FLOWS_LIMIT,
++ TCA_HHF_RESET_TIMEOUT,
++ TCA_HHF_ADMIT_BYTES,
++ TCA_HHF_EVICT_TIMEOUT,
++ TCA_HHF_NON_HH_WEIGHT,
++ __TCA_HHF_MAX
++};
++
++#define TCA_HHF_MAX (__TCA_HHF_MAX - 1)
++
++struct tc_hhf_xstats {
++ __u32 drop_overlimit; /* number of times max qdisc packet limit
++ * was hit
++ */
++ __u32 hh_overlimit; /* number of times max heavy-hitters was hit */
++ __u32 hh_tot_count; /* number of captured heavy-hitters so far */
++ __u32 hh_cur_count; /* number of current heavy-hitters */
++};
++
++/* PIE */
++enum {
++ TCA_PIE_UNSPEC,
++ TCA_PIE_TARGET,
++ TCA_PIE_LIMIT,
++ TCA_PIE_TUPDATE,
++ TCA_PIE_ALPHA,
++ TCA_PIE_BETA,
++ TCA_PIE_ECN,
++ TCA_PIE_BYTEMODE,
++ __TCA_PIE_MAX
++};
++#define TCA_PIE_MAX (__TCA_PIE_MAX - 1)
++
++struct tc_pie_xstats {
++ __u32 prob; /* current probability */
++ __u32 delay; /* current delay in ms */
++ __u32 avg_dq_rate; /* current average dq_rate in bits/pie_time */
++ __u32 packets_in; /* total number of packets enqueued */
++ __u32 dropped; /* packets dropped due to pie_action */
++ __u32 overlimit; /* dropped due to lack of space in queue */
++ __u32 maxq; /* maximum queue size */
++ __u32 ecn_mark; /* packets marked with ecn*/
++};
++
++/* CBS */
++struct tc_cbs_qopt {
++ __u8 offload;
++ __u8 _pad[3];
++ __s32 hicredit;
++ __s32 locredit;
++ __s32 idleslope;
++ __s32 sendslope;
++};
++
++enum {
++ TCA_CBS_UNSPEC,
++ TCA_CBS_PARMS,
++ __TCA_CBS_MAX,
++};
++
++#define TCA_CBS_MAX (__TCA_CBS_MAX - 1)
++
++
++/* ETF */
++struct tc_etf_qopt {
++ __s32 delta;
++ __s32 clockid;
++ __u32 flags;
++#define TC_ETF_DEADLINE_MODE_ON BIT(0)
++#define TC_ETF_OFFLOAD_ON BIT(1)
++};
++
++enum {
++ TCA_ETF_UNSPEC,
++ TCA_ETF_PARMS,
++ __TCA_ETF_MAX,
++};
++
++#define TCA_ETF_MAX (__TCA_ETF_MAX - 1)
++
++
++/* CAKE */
++enum {
++ TCA_CAKE_UNSPEC,
++ TCA_CAKE_PAD,
++ TCA_CAKE_BASE_RATE64,
++ TCA_CAKE_DIFFSERV_MODE,
++ TCA_CAKE_ATM,
++ TCA_CAKE_FLOW_MODE,
++ TCA_CAKE_OVERHEAD,
++ TCA_CAKE_RTT,
++ TCA_CAKE_TARGET,
++ TCA_CAKE_AUTORATE,
++ TCA_CAKE_MEMORY,
++ TCA_CAKE_NAT,
++ TCA_CAKE_RAW,
++ TCA_CAKE_WASH,
++ TCA_CAKE_MPU,
++ TCA_CAKE_INGRESS,
++ TCA_CAKE_ACK_FILTER,
++ TCA_CAKE_SPLIT_GSO,
++ __TCA_CAKE_MAX
++};
++#define TCA_CAKE_MAX (__TCA_CAKE_MAX - 1)
++
++enum {
++ __TCA_CAKE_STATS_INVALID,
++ TCA_CAKE_STATS_PAD,
++ TCA_CAKE_STATS_CAPACITY_ESTIMATE64,
++ TCA_CAKE_STATS_MEMORY_LIMIT,
++ TCA_CAKE_STATS_MEMORY_USED,
++ TCA_CAKE_STATS_AVG_NETOFF,
++ TCA_CAKE_STATS_MIN_NETLEN,
++ TCA_CAKE_STATS_MAX_NETLEN,
++ TCA_CAKE_STATS_MIN_ADJLEN,
++ TCA_CAKE_STATS_MAX_ADJLEN,
++ TCA_CAKE_STATS_TIN_STATS,
++ TCA_CAKE_STATS_DEFICIT,
++ TCA_CAKE_STATS_COBALT_COUNT,
++ TCA_CAKE_STATS_DROPPING,
++ TCA_CAKE_STATS_DROP_NEXT_US,
++ TCA_CAKE_STATS_P_DROP,
++ TCA_CAKE_STATS_BLUE_TIMER_US,
++ __TCA_CAKE_STATS_MAX
++};
++#define TCA_CAKE_STATS_MAX (__TCA_CAKE_STATS_MAX - 1)
++
++enum {
++ __TCA_CAKE_TIN_STATS_INVALID,
++ TCA_CAKE_TIN_STATS_PAD,
++ TCA_CAKE_TIN_STATS_SENT_PACKETS,
++ TCA_CAKE_TIN_STATS_SENT_BYTES64,
++ TCA_CAKE_TIN_STATS_DROPPED_PACKETS,
++ TCA_CAKE_TIN_STATS_DROPPED_BYTES64,
++ TCA_CAKE_TIN_STATS_ACKS_DROPPED_PACKETS,
++ TCA_CAKE_TIN_STATS_ACKS_DROPPED_BYTES64,
++ TCA_CAKE_TIN_STATS_ECN_MARKED_PACKETS,
++ TCA_CAKE_TIN_STATS_ECN_MARKED_BYTES64,
++ TCA_CAKE_TIN_STATS_BACKLOG_PACKETS,
++ TCA_CAKE_TIN_STATS_BACKLOG_BYTES,
++ TCA_CAKE_TIN_STATS_THRESHOLD_RATE64,
++ TCA_CAKE_TIN_STATS_TARGET_US,
++ TCA_CAKE_TIN_STATS_INTERVAL_US,
++ TCA_CAKE_TIN_STATS_WAY_INDIRECT_HITS,
++ TCA_CAKE_TIN_STATS_WAY_MISSES,
++ TCA_CAKE_TIN_STATS_WAY_COLLISIONS,
++ TCA_CAKE_TIN_STATS_PEAK_DELAY_US,
++ TCA_CAKE_TIN_STATS_AVG_DELAY_US,
++ TCA_CAKE_TIN_STATS_BASE_DELAY_US,
++ TCA_CAKE_TIN_STATS_SPARSE_FLOWS,
++ TCA_CAKE_TIN_STATS_BULK_FLOWS,
++ TCA_CAKE_TIN_STATS_UNRESPONSIVE_FLOWS,
++ TCA_CAKE_TIN_STATS_MAX_SKBLEN,
++ TCA_CAKE_TIN_STATS_FLOW_QUANTUM,
++ __TCA_CAKE_TIN_STATS_MAX
++};
++#define TCA_CAKE_TIN_STATS_MAX (__TCA_CAKE_TIN_STATS_MAX - 1)
++#define TC_CAKE_MAX_TINS (8)
++
++enum {
++ CAKE_FLOW_NONE = 0,
++ CAKE_FLOW_SRC_IP,
++ CAKE_FLOW_DST_IP,
++ CAKE_FLOW_HOSTS, /* = CAKE_FLOW_SRC_IP | CAKE_FLOW_DST_IP */
++ CAKE_FLOW_FLOWS,
++ CAKE_FLOW_DUAL_SRC, /* = CAKE_FLOW_SRC_IP | CAKE_FLOW_FLOWS */
++ CAKE_FLOW_DUAL_DST, /* = CAKE_FLOW_DST_IP | CAKE_FLOW_FLOWS */
++ CAKE_FLOW_TRIPLE, /* = CAKE_FLOW_HOSTS | CAKE_FLOW_FLOWS */
++ CAKE_FLOW_MAX,
++};
++
++enum {
++ CAKE_DIFFSERV_DIFFSERV3 = 0,
++ CAKE_DIFFSERV_DIFFSERV4,
++ CAKE_DIFFSERV_DIFFSERV8,
++ CAKE_DIFFSERV_BESTEFFORT,
++ CAKE_DIFFSERV_PRECEDENCE,
++ CAKE_DIFFSERV_MAX
++};
++
++enum {
++ CAKE_ACK_NONE = 0,
++ CAKE_ACK_FILTER,
++ CAKE_ACK_AGGRESSIVE,
++ CAKE_ACK_MAX
++};
++
++enum {
++ CAKE_ATM_NONE = 0,
++ CAKE_ATM_ATM,
++ CAKE_ATM_PTM,
++ CAKE_ATM_MAX
++};
++
++
++/* TAPRIO */
++enum {
++ TC_TAPRIO_CMD_SET_GATES = 0x00,
++ TC_TAPRIO_CMD_SET_AND_HOLD = 0x01,
++ TC_TAPRIO_CMD_SET_AND_RELEASE = 0x02,
++};
++
++enum {
++ TCA_TAPRIO_SCHED_ENTRY_UNSPEC,
++ TCA_TAPRIO_SCHED_ENTRY_INDEX, /* u32 */
++ TCA_TAPRIO_SCHED_ENTRY_CMD, /* u8 */
++ TCA_TAPRIO_SCHED_ENTRY_GATE_MASK, /* u32 */
++ TCA_TAPRIO_SCHED_ENTRY_INTERVAL, /* u32 */
++ __TCA_TAPRIO_SCHED_ENTRY_MAX,
++};
++#define TCA_TAPRIO_SCHED_ENTRY_MAX (__TCA_TAPRIO_SCHED_ENTRY_MAX - 1)
++
++/* The format for schedule entry list is:
++ * [TCA_TAPRIO_SCHED_ENTRY_LIST]
++ * [TCA_TAPRIO_SCHED_ENTRY]
++ * [TCA_TAPRIO_SCHED_ENTRY_CMD]
++ * [TCA_TAPRIO_SCHED_ENTRY_GATES]
++ * [TCA_TAPRIO_SCHED_ENTRY_INTERVAL]
++ */
++enum {
++ TCA_TAPRIO_SCHED_UNSPEC,
++ TCA_TAPRIO_SCHED_ENTRY,
++ __TCA_TAPRIO_SCHED_MAX,
++};
++
++#define TCA_TAPRIO_SCHED_MAX (__TCA_TAPRIO_SCHED_MAX - 1)
++
++enum {
++ TCA_TAPRIO_ATTR_UNSPEC,
++ TCA_TAPRIO_ATTR_PRIOMAP, /* struct tc_mqprio_qopt */
++ TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST, /* nested of entry */
++ TCA_TAPRIO_ATTR_SCHED_BASE_TIME, /* s64 */
++ TCA_TAPRIO_ATTR_SCHED_SINGLE_ENTRY, /* single entry */
++ TCA_TAPRIO_ATTR_SCHED_CLOCKID, /* s32 */
++ TCA_TAPRIO_PAD,
++ __TCA_TAPRIO_ATTR_MAX,
++};
++
++#define TCA_TAPRIO_ATTR_MAX (__TCA_TAPRIO_ATTR_MAX - 1)
++
++#endif
+--
+2.19.1
+
--- /dev/null
+From dba45618978270432937678dd3e2792113b37364 Mon Sep 17 00:00:00 2001
+From: Stanislav Fomichev <sdf@google.com>
+Date: Wed, 16 Jan 2019 14:03:16 -0800
+Subject: bpf: zero out build_id for BPF_STACK_BUILD_ID_IP
+
+[ Upstream commit 4af396ae4836c4ecab61e975b8e61270c551894d ]
+
+When returning BPF_STACK_BUILD_ID_IP from stack_map_get_build_id_offset,
+make sure that build_id field is empty. Since we are using percpu
+free list, there is a possibility that we might reuse some previous
+bpf_stack_build_id with non-zero build_id.
+
+Fixes: 615755a77b24 ("bpf: extend stackmap to save binary_build_id+offset instead of address")
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/stackmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index f9df545e92f6e..d43b145358275 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -314,6 +314,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
+ for (i = 0; i < trace_nr; i++) {
+ id_offs[i].status = BPF_STACK_BUILD_ID_IP;
+ id_offs[i].ip = ips[i];
++ memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE);
+ }
+ return;
+ }
+@@ -324,6 +325,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
+ /* per entry fall back to ips */
+ id_offs[i].status = BPF_STACK_BUILD_ID_IP;
+ id_offs[i].ip = ips[i];
++ memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE);
+ continue;
+ }
+ id_offs[i].offset = (vma->vm_pgoff << PAGE_SHIFT) + ips[i]
+--
+2.19.1
+
--- /dev/null
+From 25f3e74aac419b01f7c794db6e888e0983498b87 Mon Sep 17 00:00:00 2001
+From: Madalin Bucur <madalin.bucur@nxp.com>
+Date: Thu, 17 Jan 2019 11:42:27 +0200
+Subject: dpaa_eth: NETIF_F_LLTX requires to do our own update of trans_start
+
+[ Upstream commit c6ddfb9a963f0cac0f7365acfc87f3f3b33a3b69 ]
+
+As txq_trans_update() only updates trans_start when the lock is held,
+trans_start does not get updated if NETIF_F_LLTX is declared.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index 6e0f47f2c8a37..3e53be0fcd7ec 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2051,6 +2051,7 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ bool nonlinear = skb_is_nonlinear(skb);
+ struct rtnl_link_stats64 *percpu_stats;
+ struct dpaa_percpu_priv *percpu_priv;
++ struct netdev_queue *txq;
+ struct dpaa_priv *priv;
+ struct qm_fd fd;
+ int offset = 0;
+@@ -2100,6 +2101,11 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ if (unlikely(err < 0))
+ goto skb_to_fd_failed;
+
++ txq = netdev_get_tx_queue(net_dev, queue_mapping);
++
++ /* LLTX requires to do our own update of trans_start */
++ txq->trans_start = jiffies;
++
+ if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
+ fd.cmd |= cpu_to_be32(FM_FD_CMD_UPD);
+ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+--
+2.19.1
+
--- /dev/null
+From 25e0e47c87e14fea0d6e102ccd22c53f9a321056 Mon Sep 17 00:00:00 2001
+From: Charlene Liu <charlene.liu@amd.com>
+Date: Wed, 12 Dec 2018 18:09:16 -0500
+Subject: drm/amd/display: fix PME notification not working in RV desktop
+
+[ Upstream commit 20300db4aec5ba5edf6f0ad6f7111a51fbea7e10 ]
+
+[Why]
+PPLIB not receive the PME when unplug.
+
+Signed-off-by: Charlene Liu <charlene.liu@amd.com>
+Reviewed-by: Chris Park <Chris.Park@amd.com>
+Acked-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+index 4443a916a0fb6..e84275f15e7ad 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -1000,7 +1000,7 @@ void dce110_enable_audio_stream(struct pipe_ctx *pipe_ctx)
+
+ pipe_ctx->stream_res.audio->funcs->az_enable(pipe_ctx->stream_res.audio);
+
+- if (num_audio == 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
++ if (num_audio >= 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
+ /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/
+ pp_smu->set_pme_wa_enable(&pp_smu->pp_smu);
+ /* un-mute audio */
+@@ -1017,6 +1017,8 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option)
+ pipe_ctx->stream_res.stream_enc->funcs->audio_mute_control(
+ pipe_ctx->stream_res.stream_enc, true);
+ if (pipe_ctx->stream_res.audio) {
++ struct pp_smu_funcs_rv *pp_smu = dc->res_pool->pp_smu;
++
+ if (option != KEEP_ACQUIRED_RESOURCE ||
+ !dc->debug.az_endpoint_mute_only) {
+ /*only disalbe az_endpoint if power down or free*/
+@@ -1036,6 +1038,9 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option)
+ update_audio_usage(&dc->current_state->res_ctx, dc->res_pool, pipe_ctx->stream_res.audio, false);
+ pipe_ctx->stream_res.audio = NULL;
+ }
++ if (pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
++ /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/
++ pp_smu->set_pme_wa_enable(&pp_smu->pp_smu);
+
+ /* TODO: notify audio driver for if audio modes list changed
+ * add audio mode list change flag */
+--
+2.19.1
+
--- /dev/null
+From 04fa8d63ecc4981f99e18dffd12cc61468751e3b Mon Sep 17 00:00:00 2001
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+Date: Wed, 2 Jan 2019 17:47:39 -0500
+Subject: drm/amdkfd: Don't assign dGPUs to APU topology devices
+
+[ Upstream commit bbdf514fe5648566b0754476cbcb92ac3422dde2 ]
+
+dGPUs need their own topology devices. Don't assign them to APU topology
+devices with CPU cores.
+
+Bug: https://github.com/RadeonOpenCompute/ROCK-Kernel-Driver/issues/66
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Tested-by: Elias Konstantinidis <ekondis@gmail.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+index e3843c5929edf..fffece5e42c56 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -1074,8 +1074,6 @@ static uint32_t kfd_generate_gpu_id(struct kfd_dev *gpu)
+ * the GPU device is not already present in the topology device
+ * list then return NULL. This means a new topology device has to
+ * be created for this GPU.
+- * TODO: Rather than assiging @gpu to first topology device withtout
+- * gpu attached, it will better to have more stringent check.
+ */
+ static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu)
+ {
+@@ -1083,12 +1081,20 @@ static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu)
+ struct kfd_topology_device *out_dev = NULL;
+
+ down_write(&topology_lock);
+- list_for_each_entry(dev, &topology_device_list, list)
++ list_for_each_entry(dev, &topology_device_list, list) {
++ /* Discrete GPUs need their own topology device list
++ * entries. Don't assign them to CPU/APU nodes.
++ */
++ if (!gpu->device_info->needs_iommu_device &&
++ dev->node_props.cpu_cores_count)
++ continue;
++
+ if (!dev->gpu && (dev->node_props.simd_count > 0)) {
+ dev->gpu = gpu;
+ out_dev = dev;
+ break;
+ }
++ }
+ up_write(&topology_lock);
+ return out_dev;
+ }
+--
+2.19.1
+
--- /dev/null
+From b6f4453b1ca56828e88983e3ef124d79305fb1fd Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Sun, 13 Jan 2019 10:44:51 +0100
+Subject: drm/meson: add missing of_node_put
+
+[ Upstream commit f672b93e4a0a4947d2e1103ed8780e01e13eadb6 ]
+
+Add an of_node_put when the result of of_graph_get_remote_port_parent is
+not available.
+
+An of_node_put is also needed when meson_probe_remote completes. This was
+present at the recursive call, but not in the call from meson_drv_probe.
+
+The semantic match that finds this problem is as follows
+(http://coccinelle.lip6.fr):
+
+// <smpl>
+@r exists@
+local idexpression e;
+expression x;
+@@
+e = of_graph_get_remote_port_parent(...);
+... when != x = e
+ when != true e == NULL
+ when != of_node_put(e)
+ when != of_fwnode_handle(e)
+(
+return e;
+|
+*return ...;
+)
+// </smpl>
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1547372691-28324-4-git-send-email-Julia.Lawall@lip6.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_drv.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index bf5f294f172fa..611ac340fb289 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -368,8 +368,10 @@ static int meson_probe_remote(struct platform_device *pdev,
+ remote_node = of_graph_get_remote_port_parent(ep);
+ if (!remote_node ||
+ remote_node == parent || /* Ignore parent endpoint */
+- !of_device_is_available(remote_node))
++ !of_device_is_available(remote_node)) {
++ of_node_put(remote_node);
+ continue;
++ }
+
+ count += meson_probe_remote(pdev, match, remote, remote_node);
+
+@@ -388,10 +390,13 @@ static int meson_drv_probe(struct platform_device *pdev)
+
+ for_each_endpoint_of_node(np, ep) {
+ remote = of_graph_get_remote_port_parent(ep);
+- if (!remote || !of_device_is_available(remote))
++ if (!remote || !of_device_is_available(remote)) {
++ of_node_put(remote);
+ continue;
++ }
+
+ count += meson_probe_remote(pdev, &match, np, remote);
++ of_node_put(remote);
+ }
+
+ if (count && !match)
+--
+2.19.1
+
--- /dev/null
+From 7acf3e23c5bbed8a5d0f008aa349f03baf15908b Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Sun, 13 Jan 2019 09:47:44 +0100
+Subject: drm/sun4i: backend: add missing of_node_puts
+
+[ Upstream commit 4bb0e6d7258213d4893c2c876712fbba40e712fe ]
+
+The device node iterators perform an of_node_get on each
+iteration, so a jump out of the loop requires an of_node_put.
+
+Remote and port also have augmented reference counts, so drop them
+on each iteration and at the end of the function, respectively.
+Remote is only used for the address it contains, not for the
+contents of that address, so the reference count can be dropped
+immediately.
+
+The semantic patch that fixes the first part of this problem is
+as follows (http://coccinelle.lip6.fr):
+
+// <smpl>
+@@
+expression root,e;
+local idexpression child;
+iterator name for_each_child_of_node;
+@@
+
+ for_each_available_child_of_node(root, child) {
+ ... when != of_node_put(child)
+ when != e = child
++ of_node_put(child);
+? break;
+ ...
+}
+... when != child
+// </smpl>
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1547369264-24831-5-git-send-email-Julia.Lawall@lip6.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_backend.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
+index bf49c55b0f2c7..9f27d5464804b 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
++++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
+@@ -704,17 +704,18 @@ static struct sun4i_frontend *sun4i_backend_find_frontend(struct sun4i_drv *drv,
+ remote = of_graph_get_remote_port_parent(ep);
+ if (!remote)
+ continue;
++ of_node_put(remote);
+
+ /* does this node match any registered engines? */
+ list_for_each_entry(frontend, &drv->frontend_list, list) {
+ if (remote == frontend->node) {
+- of_node_put(remote);
+ of_node_put(port);
++ of_node_put(ep);
+ return frontend;
+ }
+ }
+ }
+-
++ of_node_put(port);
+ return ERR_PTR(-EINVAL);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From bfa60e60bb46d7afcd620b085cf3363386455f70 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Wed, 26 Dec 2018 13:56:15 -0800
+Subject: hwmon: (nct6775) Enable IO mapping for NCT6797D and NCT6798D
+
+[ Upstream commit 9de15c95a63f527c8f7a968cd95e6ec71fc6891d ]
+
+Similar to other recent chips from Nuvoton, IO mapping may be disabled
+by default. Enable it when instantiating the driver and after resume.
+
+Fixes: 0599682b826f ("hwmon: (nct6775) Add support for NCT6798D")
+Fixes: e41da286a2fd ("hwmon: (nct6775) Add support for NCT6797D")
+Reported-by: Michael Cook <mcook@mackal.net>
+Cc: Michael Cook <mcook@mackal.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct6775.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
+index 8f91e366866f3..4adec4ab7d066 100644
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -4508,7 +4508,8 @@ static int __maybe_unused nct6775_resume(struct device *dev)
+
+ if (data->kind == nct6791 || data->kind == nct6792 ||
+ data->kind == nct6793 || data->kind == nct6795 ||
+- data->kind == nct6796)
++ data->kind == nct6796 || data->kind == nct6797 ||
++ data->kind == nct6798)
+ nct6791_enable_io_mapping(sioreg);
+
+ superio_exit(sioreg);
+@@ -4644,7 +4645,8 @@ static int __init nct6775_find(int sioaddr, struct nct6775_sio_data *sio_data)
+
+ if (sio_data->kind == nct6791 || sio_data->kind == nct6792 ||
+ sio_data->kind == nct6793 || sio_data->kind == nct6795 ||
+- sio_data->kind == nct6796)
++ sio_data->kind == nct6796 || sio_data->kind == nct6797 ||
++ sio_data->kind == nct6798)
+ nct6791_enable_io_mapping(sioaddr);
+
+ superio_exit(sioaddr);
+--
+2.19.1
+
--- /dev/null
+From 1d5eb67b67181df41a49614a435f88c8929f0533 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Wed, 26 Dec 2018 07:34:31 -0800
+Subject: hwmon: (nct6775) Fix chip ID for NCT6798D
+
+[ Upstream commit 264142bc70ec039e26d8f3b46a717e8037f59ca0 ]
+
+The chip ID is 0xd42[8-f], not 0xd45[8-f].
+
+Fixes: 0599682b826f ("hwmon: (nct6775) Add support for NCT6798D")
+Reported-by: Michael Cook <mcook@mackal.net>
+Cc: Michael Cook <mcook@mackal.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct6775.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
+index c3040079b1cb6..8f91e366866f3 100644
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -44,8 +44,8 @@
+ * nct6796d 14 7 7 2+6 0xd420 0xc1 0x5ca3
+ * nct6797d 14 7 7 2+6 0xd450 0xc1 0x5ca3
+ * (0xd451)
+- * nct6798d 14 7 7 2+6 0xd458 0xc1 0x5ca3
+- * (0xd459)
++ * nct6798d 14 7 7 2+6 0xd428 0xc1 0x5ca3
++ * (0xd429)
+ *
+ * #temp lists the number of monitored temperature sources (first value) plus
+ * the number of directly connectable temperature sensors (second value).
+@@ -138,7 +138,7 @@ MODULE_PARM_DESC(fan_debounce, "Enable debouncing for fan RPM signal");
+ #define SIO_NCT6795_ID 0xd350
+ #define SIO_NCT6796_ID 0xd420
+ #define SIO_NCT6797_ID 0xd450
+-#define SIO_NCT6798_ID 0xd458
++#define SIO_NCT6798_ID 0xd428
+ #define SIO_ID_MASK 0xFFF8
+
+ enum pwm_enable { off, manual, thermal_cruise, speed_cruise, sf3, sf4 };
+--
+2.19.1
+
--- /dev/null
+From e4485abc71272d9078af9ab330f20bf1a19349a5 Mon Sep 17 00:00:00 2001
+From: Cheng-Min Ao <tony_ao@wiwynn.com>
+Date: Mon, 7 Jan 2019 14:29:32 +0800
+Subject: hwmon: (tmp421) Correct the misspelling of the tmp442 compatible
+ attribute in OF device ID table
+
+[ Upstream commit f422449b58548a41e98fc97b259a283718e527db ]
+
+Correct a typo in OF device ID table
+The last one should be 'ti,tmp442'
+
+Signed-off-by: Cheng-Min Ao <tony_ao@wiwynn.com>
+Signed-off-by: Yu-Hsiang Chen <matt_chen@wiwynn.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/tmp421.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c
+index 8844c9565d2a4..7053be59ad2e4 100644
+--- a/drivers/hwmon/tmp421.c
++++ b/drivers/hwmon/tmp421.c
+@@ -88,7 +88,7 @@ static const struct of_device_id tmp421_of_match[] = {
+ .data = (void *)2
+ },
+ {
+- .compatible = "ti,tmp422",
++ .compatible = "ti,tmp442",
+ .data = (void *)3
+ },
+ { },
+--
+2.19.1
+
--- /dev/null
+From 718f9176db2b191be3789023fc0514df52272173 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Wed, 2 Jan 2019 15:57:49 -0500
+Subject: include/linux/compiler*.h: fix OPTIMIZER_HIDE_VAR
+
+[ Upstream commit 3e2ffd655cc6a694608d997738989ff5572a8266 ]
+
+Since commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h
+mutually exclusive") clang no longer reuses the OPTIMIZER_HIDE_VAR macro
+from compiler-gcc - instead it gets the version in
+include/linux/compiler.h. Unfortunately that version doesn't actually
+prevent compiler from optimizing out the variable.
+
+Fix up by moving the macro out from compiler-gcc.h to compiler.h.
+Compilers without incline asm support will keep working
+since it's protected by an ifdef.
+
+Also fix up comments to match reality since we are no longer overriding
+any macros.
+
+Build-tested with gcc and clang.
+
+Fixes: 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive")
+Cc: Eli Friedman <efriedma@codeaurora.org>
+Cc: Joe Perches <joe@perches.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/compiler-clang.h | 5 ++---
+ include/linux/compiler-gcc.h | 4 ----
+ include/linux/compiler-intel.h | 4 +---
+ include/linux/compiler.h | 4 +++-
+ 4 files changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
+index 3e7dafb3ea809..7ddaeb5182e33 100644
+--- a/include/linux/compiler-clang.h
++++ b/include/linux/compiler-clang.h
+@@ -3,9 +3,8 @@
+ #error "Please don't include <linux/compiler-clang.h> directly, include <linux/compiler.h> instead."
+ #endif
+
+-/* Some compiler specific definitions are overwritten here
+- * for Clang compiler
+- */
++/* Compiler specific definitions for Clang compiler */
++
+ #define uninitialized_var(x) x = *(&(x))
+
+ /* same as gcc, this was present in clang-2.6 so we can assume it works
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index 977ddf2774f97..c61c4bb2bd15f 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -58,10 +58,6 @@
+ (typeof(ptr)) (__ptr + (off)); \
+ })
+
+-/* Make the optimizer believe the variable can be manipulated arbitrarily. */
+-#define OPTIMIZER_HIDE_VAR(var) \
+- __asm__ ("" : "=r" (var) : "0" (var))
+-
+ /*
+ * A trick to suppress uninitialized variable warning without generating any
+ * code
+diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h
+index 517bd14e12224..b17f3cd18334d 100644
+--- a/include/linux/compiler-intel.h
++++ b/include/linux/compiler-intel.h
+@@ -5,9 +5,7 @@
+
+ #ifdef __ECC
+
+-/* Some compiler specific definitions are overwritten here
+- * for Intel ECC compiler
+- */
++/* Compiler specific definitions for Intel ECC compiler */
+
+ #include <asm/intrinsics.h>
+
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index fc5004a4b07d7..445348facea97 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -161,7 +161,9 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+ #endif
+
+ #ifndef OPTIMIZER_HIDE_VAR
+-#define OPTIMIZER_HIDE_VAR(var) barrier()
++/* Make the optimizer believe the variable can be manipulated arbitrarily. */
++#define OPTIMIZER_HIDE_VAR(var) \
++ __asm__ ("" : "=r" (var) : "0" (var))
+ #endif
+
+ /* Not-quite-unique ID. */
+--
+2.19.1
+
--- /dev/null
+From fbaac8f4647090488c65f5104f0f02f7da5ed6f2 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Wed, 9 Jan 2019 22:41:08 -0700
+Subject: isdn: avm: Fix string plus integer warning from Clang
+
+[ Upstream commit 7afa81c55fca0cad589722cb4bce698b4803b0e1 ]
+
+A recent commit in Clang expanded the -Wstring-plus-int warning, showing
+some odd behavior in this file.
+
+drivers/isdn/hardware/avm/b1.c:426:30: warning: adding 'int' to a string does not append to the string [-Wstring-plus-int]
+ cinfo->version[j] = "\0\0" + 1;
+ ~~~~~~~^~~
+drivers/isdn/hardware/avm/b1.c:426:30: note: use array indexing to silence this warning
+ cinfo->version[j] = "\0\0" + 1;
+ ^
+ & [ ]
+1 warning generated.
+
+This is equivalent to just "\0". Nick pointed out that it is smarter to
+use "" instead of "\0" because "" is used elsewhere in the kernel and
+can be deduplicated at the linking stage.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/309
+Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/hardware/avm/b1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
+index 4ac378e489023..40ca1e8fa09fc 100644
+--- a/drivers/isdn/hardware/avm/b1.c
++++ b/drivers/isdn/hardware/avm/b1.c
+@@ -423,7 +423,7 @@ void b1_parse_version(avmctrl_info *cinfo)
+ int i, j;
+
+ for (j = 0; j < AVM_MAXVERSION; j++)
+- cinfo->version[j] = "\0\0" + 1;
++ cinfo->version[j] = "";
+ for (i = 0, j = 0;
+ j < AVM_MAXVERSION && i < cinfo->versionlen;
+ j++, i += cinfo->versionbuf[i] + 1)
+--
+2.19.1
+
--- /dev/null
+From bd0e93768d90e43ab24a41c49114d0401a3d638b Mon Sep 17 00:00:00 2001
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Tue, 8 Jan 2019 21:04:48 +0800
+Subject: isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
+
+[ Upstream commit 2ff33d6637393fe9348357285931811b76e1402f ]
+
+The functions isdn_tty_tiocmset() and isdn_tty_set_termios() may be
+concurrently executed.
+
+isdn_tty_tiocmset
+ isdn_tty_modem_hup
+ line 719: kfree(info->dtmf_state);
+ line 721: kfree(info->silence_state);
+ line 723: kfree(info->adpcms);
+ line 725: kfree(info->adpcmr);
+
+isdn_tty_set_termios
+ isdn_tty_modem_hup
+ line 719: kfree(info->dtmf_state);
+ line 721: kfree(info->silence_state);
+ line 723: kfree(info->adpcms);
+ line 725: kfree(info->adpcmr);
+
+Thus, some concurrency double-free bugs may occur.
+
+These possible bugs are found by a static tool written by myself and
+my manual code review.
+
+To fix these possible bugs, the mutex lock "modem_info_mutex" used in
+isdn_tty_tiocmset() is added in isdn_tty_set_termios().
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/i4l/isdn_tty.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
+index 1b2239c1d5694..dc1cded716c1a 100644
+--- a/drivers/isdn/i4l/isdn_tty.c
++++ b/drivers/isdn/i4l/isdn_tty.c
+@@ -1437,15 +1437,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
+ {
+ modem_info *info = (modem_info *) tty->driver_data;
+
++ mutex_lock(&modem_info_mutex);
+ if (!old_termios)
+ isdn_tty_change_speed(info);
+ else {
+ if (tty->termios.c_cflag == old_termios->c_cflag &&
+ tty->termios.c_ispeed == old_termios->c_ispeed &&
+- tty->termios.c_ospeed == old_termios->c_ospeed)
++ tty->termios.c_ospeed == old_termios->c_ospeed) {
++ mutex_unlock(&modem_info_mutex);
+ return;
++ }
+ isdn_tty_change_speed(info);
+ }
++ mutex_unlock(&modem_info_mutex);
+ }
+
+ /*
+--
+2.19.1
+
--- /dev/null
+From fe90c800c2ed0cbd9209e8c79809e09e9dd9c423 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Tue, 25 Dec 2018 22:18:23 -0600
+Subject: leds: lp5523: fix a missing check of return value of lp55xx_read
+
+[ Upstream commit 248b57015f35c94d4eae2fdd8c6febf5cd703900 ]
+
+When lp55xx_read() fails, "status" is an uninitialized variable and thus
+may contain random value; using it leads to undefined behaviors.
+
+The fix inserts a check for the return value of lp55xx_read: if it
+fails, returns with its error code.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-lp5523.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
+index a2e74feee2b2f..fd64df5a57a5e 100644
+--- a/drivers/leds/leds-lp5523.c
++++ b/drivers/leds/leds-lp5523.c
+@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)
+
+ /* Let the programs run for couple of ms and check the engine status */
+ usleep_range(3000, 6000);
+- lp55xx_read(chip, LP5523_REG_STATUS, &status);
++ ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
++ if (ret)
++ return ret;
+ status &= LP5523_ENG_STATUS_MASK;
+
+ if (status != LP5523_ENG_STATUS_MASK) {
+--
+2.19.1
+
--- /dev/null
+From ff0f9a2e8861de94a2c7bd41a80f5b047f0c088e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 25 Oct 2018 15:43:44 +0300
+Subject: mfd: ab8500-core: Return zero in get_register_interruptible()
+
+[ Upstream commit 10628e3ecf544fa2e4e24f8e112d95c37884dc98 ]
+
+This function is supposed to return zero on success or negative error
+codes on error. Unfortunately, there is a bug so it sometimes returns
+non-zero, positive numbers on success.
+
+I noticed this bug during review and I can't test it. It does appear
+that the return is sometimes propogated back to _regmap_read() where all
+non-zero returns are treated as failure so this may affect run time.
+
+Fixes: 47c1697508f2 ("mfd: Align ab8500 with the abx500 interface")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/ab8500-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
+index 30d09d1771717..11ab17f64c649 100644
+--- a/drivers/mfd/ab8500-core.c
++++ b/drivers/mfd/ab8500-core.c
+@@ -261,7 +261,7 @@ static int get_register_interruptible(struct ab8500 *ab8500, u8 bank,
+ mutex_unlock(&ab8500->lock);
+ dev_vdbg(ab8500->dev, "rd: addr %#x => data %#x\n", addr, ret);
+
+- return ret;
++ return (ret < 0) ? ret : 0;
+ }
+
+ static int ab8500_get_register(struct device *dev, u8 bank,
+--
+2.19.1
+
--- /dev/null
+From 7b0ac5968b4f785f44557fbba6dadca4a1311696 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <jdelvare@suse.de>
+Date: Mon, 12 Nov 2018 10:49:42 +0100
+Subject: mfd: at91-usart: Add platform dependency
+
+[ Upstream commit 628f3dfe4c7b35bbe63ec194ca6da857b00b0083 ]
+
+It doesn't make sense to present option MFD_AT91_USART by default if
+not building an AT91 kernel, as the drivers which depend on it are
+not available.
+
+Fixes: 7d3aa342cef7 ("mfd: at91-usart: Add MFD driver for USART")
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
+index 8c5dfdce4326c..f461460a2aeb9 100644
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -102,6 +102,7 @@ config MFD_AAT2870_CORE
+ config MFD_AT91_USART
+ tristate "AT91 USART Driver"
+ select MFD_CORE
++ depends on ARCH_AT91 || COMPILE_TEST
+ help
+ Select this to get support for AT91 USART IP. This is a wrapper
+ over at91-usart-serial driver and usart-spi-driver. Only one function
+--
+2.19.1
+
--- /dev/null
+From b3a19201ea14b7379b247bf92b8b8c2b06aa2c20 Mon Sep 17 00:00:00 2001
+From: Oskari Lemmela <oskari@lemmela.net>
+Date: Tue, 20 Nov 2018 19:52:10 +0200
+Subject: mfd: axp20x: Add AC power supply cell for AXP813
+
+[ Upstream commit 4a19f9a65375ca9781b3ca9e810ece92edfc3e78 ]
+
+As axp20x-ac-power-supply now supports AXP813, add a cell for it.
+
+Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
+Reviewed-by: Quentin Schulz <quentin.schulz@bootlin.com>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Tested-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/axp20x.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
+index 0be511dd93d01..dfc3cff1d08b4 100644
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -778,6 +778,11 @@ static const struct mfd_cell axp813_cells[] = {
+ }, {
+ .name = "axp20x-battery-power-supply",
+ .of_compatible = "x-powers,axp813-battery-power-supply",
++ }, {
++ .name = "axp20x-ac-power-supply",
++ .of_compatible = "x-powers,axp813-ac-power-supply",
++ .num_resources = ARRAY_SIZE(axp20x_ac_power_supply_resources),
++ .resources = axp20x_ac_power_supply_resources,
+ },
+ };
+
+--
+2.19.1
+
--- /dev/null
+From 83b567e3b9a371ba32e0577e19cbd18ffb09e4a1 Mon Sep 17 00:00:00 2001
+From: Oskari Lemmela <oskari@lemmela.net>
+Date: Sat, 8 Dec 2018 19:58:47 +0200
+Subject: mfd: axp20x: Add supported cells for AXP803
+
+[ Upstream commit ea90e7b47f0a8bd2fe14e9a88f523de7c67db90a ]
+
+Parts of the AXP803 are compatible with their counterparts on the AXP813.
+These include the GPIO, ADC, AC and battery power supplies.
+
+Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Tested-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/axp20x.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
+index 8037b4e01ed67..f8e0fa97bb31e 100644
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -726,6 +726,20 @@ static const struct mfd_cell axp803_cells[] = {
+ .name = "axp221-pek",
+ .num_resources = ARRAY_SIZE(axp803_pek_resources),
+ .resources = axp803_pek_resources,
++ }, {
++ .name = "axp20x-gpio",
++ .of_compatible = "x-powers,axp813-gpio",
++ }, {
++ .name = "axp813-adc",
++ .of_compatible = "x-powers,axp813-adc",
++ }, {
++ .name = "axp20x-battery-power-supply",
++ .of_compatible = "x-powers,axp813-battery-power-supply",
++ }, {
++ .name = "axp20x-ac-power-supply",
++ .of_compatible = "x-powers,axp813-ac-power-supply",
++ .num_resources = ARRAY_SIZE(axp20x_ac_power_supply_resources),
++ .resources = axp20x_ac_power_supply_resources,
+ },
+ { .name = "axp20x-regulator" },
+ };
+--
+2.19.1
+
--- /dev/null
+From 14cb5084d287fc49c0c732986880ab72e57c105d Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Sat, 8 Dec 2018 19:58:46 +0200
+Subject: mfd: axp20x: Re-align MFD cell entries
+
+[ Upstream commit 753a8d083e085c6f552c7982749de4cc7c40e2ac ]
+
+In the axp20x driver, the various mfd_cell lists had varying amounts
+of indentation, sometimes even within the same list. For the axp288,
+there's no alignment at all.
+
+Re-align the right hand side of the assignments with the least amount
+of tabs possible. Also collapse the closing bracket and the opening
+bracket of the next entry onto the same line for the axp288, to be
+consistent with all the other mfd_cell lists.
+
+This patch is whitespace change only. No functionality is modified.
+
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/axp20x.c | 107 +++++++++++++++++++++----------------------
+ 1 file changed, 51 insertions(+), 56 deletions(-)
+
+diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
+index dfc3cff1d08b4..8037b4e01ed67 100644
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -640,9 +640,9 @@ static const struct mfd_cell axp221_cells[] = {
+
+ static const struct mfd_cell axp223_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp22x_pek_resources),
+- .resources = axp22x_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp22x_pek_resources),
++ .resources = axp22x_pek_resources,
+ }, {
+ .name = "axp22x-adc",
+ .of_compatible = "x-powers,axp221-adc",
+@@ -650,7 +650,7 @@ static const struct mfd_cell axp223_cells[] = {
+ .name = "axp20x-battery-power-supply",
+ .of_compatible = "x-powers,axp221-battery-power-supply",
+ }, {
+- .name = "axp20x-regulator",
++ .name = "axp20x-regulator",
+ }, {
+ .name = "axp20x-ac-power-supply",
+ .of_compatible = "x-powers,axp221-ac-power-supply",
+@@ -666,9 +666,9 @@ static const struct mfd_cell axp223_cells[] = {
+
+ static const struct mfd_cell axp152_cells[] = {
+ {
+- .name = "axp20x-pek",
+- .num_resources = ARRAY_SIZE(axp152_pek_resources),
+- .resources = axp152_pek_resources,
++ .name = "axp20x-pek",
++ .num_resources = ARRAY_SIZE(axp152_pek_resources),
++ .resources = axp152_pek_resources,
+ },
+ };
+
+@@ -697,84 +697,79 @@ static const struct resource axp288_charger_resources[] = {
+
+ static const struct mfd_cell axp288_cells[] = {
+ {
+- .name = "axp288_adc",
+- .num_resources = ARRAY_SIZE(axp288_adc_resources),
+- .resources = axp288_adc_resources,
+- },
+- {
+- .name = "axp288_extcon",
+- .num_resources = ARRAY_SIZE(axp288_extcon_resources),
+- .resources = axp288_extcon_resources,
+- },
+- {
+- .name = "axp288_charger",
+- .num_resources = ARRAY_SIZE(axp288_charger_resources),
+- .resources = axp288_charger_resources,
+- },
+- {
+- .name = "axp288_fuel_gauge",
+- .num_resources = ARRAY_SIZE(axp288_fuel_gauge_resources),
+- .resources = axp288_fuel_gauge_resources,
+- },
+- {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp288_power_button_resources),
+- .resources = axp288_power_button_resources,
+- },
+- {
+- .name = "axp288_pmic_acpi",
++ .name = "axp288_adc",
++ .num_resources = ARRAY_SIZE(axp288_adc_resources),
++ .resources = axp288_adc_resources,
++ }, {
++ .name = "axp288_extcon",
++ .num_resources = ARRAY_SIZE(axp288_extcon_resources),
++ .resources = axp288_extcon_resources,
++ }, {
++ .name = "axp288_charger",
++ .num_resources = ARRAY_SIZE(axp288_charger_resources),
++ .resources = axp288_charger_resources,
++ }, {
++ .name = "axp288_fuel_gauge",
++ .num_resources = ARRAY_SIZE(axp288_fuel_gauge_resources),
++ .resources = axp288_fuel_gauge_resources,
++ }, {
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp288_power_button_resources),
++ .resources = axp288_power_button_resources,
++ }, {
++ .name = "axp288_pmic_acpi",
+ },
+ };
+
+ static const struct mfd_cell axp803_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp803_pek_resources),
+- .resources = axp803_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp803_pek_resources),
++ .resources = axp803_pek_resources,
+ },
+- { .name = "axp20x-regulator" },
++ { .name = "axp20x-regulator" },
+ };
+
+ static const struct mfd_cell axp806_self_working_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp806_pek_resources),
+- .resources = axp806_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp806_pek_resources),
++ .resources = axp806_pek_resources,
+ },
+- { .name = "axp20x-regulator" },
++ { .name = "axp20x-regulator" },
+ };
+
+ static const struct mfd_cell axp806_cells[] = {
+ {
+- .id = 2,
+- .name = "axp20x-regulator",
++ .id = 2,
++ .name = "axp20x-regulator",
+ },
+ };
+
+ static const struct mfd_cell axp809_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp809_pek_resources),
+- .resources = axp809_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp809_pek_resources),
++ .resources = axp809_pek_resources,
+ }, {
+- .id = 1,
+- .name = "axp20x-regulator",
++ .id = 1,
++ .name = "axp20x-regulator",
+ },
+ };
+
+ static const struct mfd_cell axp813_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp803_pek_resources),
+- .resources = axp803_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp803_pek_resources),
++ .resources = axp803_pek_resources,
+ }, {
+- .name = "axp20x-regulator",
++ .name = "axp20x-regulator",
+ }, {
+- .name = "axp20x-gpio",
+- .of_compatible = "x-powers,axp813-gpio",
++ .name = "axp20x-gpio",
++ .of_compatible = "x-powers,axp813-gpio",
+ }, {
+- .name = "axp813-adc",
+- .of_compatible = "x-powers,axp813-adc",
++ .name = "axp813-adc",
++ .of_compatible = "x-powers,axp813-adc",
+ }, {
+ .name = "axp20x-battery-power-supply",
+ .of_compatible = "x-powers,axp813-battery-power-supply",
+--
+2.19.1
+
--- /dev/null
+From 240bbff06ee0e1db8f252d7f2c3eee2bd1d5c38c Mon Sep 17 00:00:00 2001
+From: Dien Pham <dien.pham.ry@renesas.com>
+Date: Wed, 3 Oct 2018 15:58:41 +0200
+Subject: mfd: bd9571mwv: Add volatile register to make DVFS work
+
+[ Upstream commit b0aff01e7aa6ad2d6998ef1323843212d1db8b04 ]
+
+Because BD9571MWV_DVFS_MONIVDAC is not defined in the volatile table,
+the physical register value is not updated by regmap and DVFS doesn't
+work as expected. Fix it!
+
+Fixes: d3ea21272094 ("mfd: Add ROHM BD9571MWV-M MFD PMIC driver")
+Signed-off-by: Dien Pham <dien.pham.ry@renesas.com>
+[wsa: rebase, add 'Fixes', reword commit message]
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Marek Vasut <marek.vasut@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/bd9571mwv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/bd9571mwv.c b/drivers/mfd/bd9571mwv.c
+index 503979c81dae1..fab3cdc27ed64 100644
+--- a/drivers/mfd/bd9571mwv.c
++++ b/drivers/mfd/bd9571mwv.c
+@@ -59,6 +59,7 @@ static const struct regmap_access_table bd9571mwv_writable_table = {
+ };
+
+ static const struct regmap_range bd9571mwv_volatile_yes_ranges[] = {
++ regmap_reg_range(BD9571MWV_DVFS_MONIVDAC, BD9571MWV_DVFS_MONIVDAC),
+ regmap_reg_range(BD9571MWV_GPIO_IN, BD9571MWV_GPIO_IN),
+ regmap_reg_range(BD9571MWV_GPIO_INT, BD9571MWV_GPIO_INT),
+ regmap_reg_range(BD9571MWV_INT_INTREQ, BD9571MWV_INT_INTREQ),
+--
+2.19.1
+
--- /dev/null
+From 667c77138582ae6d7b1e37c2910e49ca054edc17 Mon Sep 17 00:00:00 2001
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Date: Mon, 10 Dec 2018 19:00:02 +0100
+Subject: mfd: cros_ec_dev: Add missing mfd_remove_devices() call in remove
+
+[ Upstream commit 18e294ddafaeb80a1e2e10c9bd750a6cb8388d5b ]
+
+The driver adds different MFD child devices via mfd_add_devices() and
+hence it is required to call mfd_remove_devices() to remove MFD child
+devices.
+
+Fixes: 5e0115581bbc ("cros_ec: Move cros_ec_dev module to drivers/mfd")
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/cros_ec_dev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/cros_ec_dev.c b/drivers/mfd/cros_ec_dev.c
+index b99a194ce5a4a..2d0fee488c5aa 100644
+--- a/drivers/mfd/cros_ec_dev.c
++++ b/drivers/mfd/cros_ec_dev.c
+@@ -499,6 +499,7 @@ static int ec_device_remove(struct platform_device *pdev)
+
+ cros_ec_debugfs_remove(ec);
+
++ mfd_remove_devices(ec->dev);
+ cdev_del(&ec->cdev);
+ device_unregister(&ec->class_dev);
+ return 0;
+--
+2.19.1
+
--- /dev/null
+From f2c3d5230e2e2ed2c424f5fa1c992df82a17935d Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Wed, 17 Oct 2018 17:56:28 -0700
+Subject: mfd: db8500-prcmu: Fix some section annotations
+
+[ Upstream commit a3888f62fe66429fad3be7f2ba962e1e08c26fd6 ]
+
+When building the kernel with Clang, the following section mismatch
+warnings appear:
+
+WARNING: vmlinux.o(.text+0x7239cc): Section mismatch in reference from
+the function db8500_prcmu_probe() to the function
+.init.text:init_prcm_registers()
+The function db8500_prcmu_probe() references
+the function __init init_prcm_registers().
+This is often because db8500_prcmu_probe lacks a __init
+annotation or the annotation of init_prcm_registers is wrong.
+
+WARNING: vmlinux.o(.text+0x723e28): Section mismatch in reference from
+the function db8500_prcmu_probe() to the function
+.init.text:fw_project_name()
+The function db8500_prcmu_probe() references
+the function __init fw_project_name().
+This is often because db8500_prcmu_probe lacks a __init
+annotation or the annotation of fw_project_name is wrong.
+
+db8500_prcmu_probe should not be marked as __init so remove the __init
+annotation from fw_project_name and init_prcm_registers.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/db8500-prcmu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
+index 5970b8def5487..aec20e1c7d3d5 100644
+--- a/drivers/mfd/db8500-prcmu.c
++++ b/drivers/mfd/db8500-prcmu.c
+@@ -2584,7 +2584,7 @@ static struct irq_chip prcmu_irq_chip = {
+ .irq_unmask = prcmu_irq_unmask,
+ };
+
+-static __init char *fw_project_name(u32 project)
++static char *fw_project_name(u32 project)
+ {
+ switch (project) {
+ case PRCMU_FW_PROJECT_U8500:
+@@ -2732,7 +2732,7 @@ void __init db8500_prcmu_early_init(u32 phy_base, u32 size)
+ INIT_WORK(&mb0_transfer.mask_work, prcmu_mask_work);
+ }
+
+-static void __init init_prcm_registers(void)
++static void init_prcm_registers(void)
+ {
+ u32 val;
+
+--
+2.19.1
+
--- /dev/null
+From 358b0c6002e80eeaaf9aa1a24202156b5d44ad0c Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Thu, 20 Dec 2018 15:12:11 -0600
+Subject: mfd: mc13xxx: Fix a missing check of a register-read failure
+
+[ Upstream commit 9e28989d41c0eab57ec0bb156617a8757406ff8a ]
+
+When mc13xxx_reg_read() fails, "old_adc0" is uninitialized and will
+contain random value. Further execution uses "old_adc0" even when
+mc13xxx_reg_read() fails.
+The fix checks the return value of mc13xxx_reg_read(), and exits
+the execution when it fails.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mc13xxx-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
+index f475e848252fa..d0bf50e3568d7 100644
+--- a/drivers/mfd/mc13xxx-core.c
++++ b/drivers/mfd/mc13xxx-core.c
+@@ -274,7 +274,9 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode,
+
+ mc13xxx->adcflags |= MC13XXX_ADC_WORKING;
+
+- mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
++ ret = mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
++ if (ret)
++ goto out;
+
+ adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2 |
+ MC13XXX_ADC0_CHRGRAWDIV;
+--
+2.19.1
+
--- /dev/null
+From 7727e12711991d589174a139004a6c7815650e37 Mon Sep 17 00:00:00 2001
+From: Nicolas Boichat <drinkcat@chromium.org>
+Date: Mon, 22 Oct 2018 10:55:06 +0800
+Subject: mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported
+
+[ Upstream commit a177276aa098aa47a100d51a13eaaef029604b6d ]
+
+If the PMIC ID is unknown, the current code would call
+irq_domain_remove and panic, as pmic->irq_domain is only
+initialized by mt6397_irq_init.
+
+Return immediately with an error, if the chip ID is unsupported.
+
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mt6397-core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/mt6397-core.c b/drivers/mfd/mt6397-core.c
+index 77b64bd64df36..ab24e176ef448 100644
+--- a/drivers/mfd/mt6397-core.c
++++ b/drivers/mfd/mt6397-core.c
+@@ -329,8 +329,7 @@ static int mt6397_probe(struct platform_device *pdev)
+
+ default:
+ dev_err(&pdev->dev, "unsupported chip: %d\n", id);
+- ret = -ENODEV;
+- break;
++ return -ENODEV;
+ }
+
+ if (ret) {
+--
+2.19.1
+
--- /dev/null
+From 44b538c437f0657ef73ecf7018d2e786135d7d45 Mon Sep 17 00:00:00 2001
+From: Jonathan Marek <jonathan@marek.ca>
+Date: Mon, 19 Nov 2018 14:53:17 -0500
+Subject: mfd: qcom_rpm: write fw_version to CTRL_REG
+
+[ Upstream commit 504e4175829c44328773b96ad9c538e4783a8d22 ]
+
+This is required as part of the initialization sequence on certain SoCs.
+
+If these registers are not initialized, the hardware can be unresponsive.
+This fixes the driver on apq8060 (HP TouchPad device).
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/qcom_rpm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c
+index 52fafea06067e..8d420c37b2a61 100644
+--- a/drivers/mfd/qcom_rpm.c
++++ b/drivers/mfd/qcom_rpm.c
+@@ -638,6 +638,10 @@ static int qcom_rpm_probe(struct platform_device *pdev)
+ return -EFAULT;
+ }
+
++ writel(fw_version[0], RPM_CTRL_REG(rpm, 0));
++ writel(fw_version[1], RPM_CTRL_REG(rpm, 1));
++ writel(fw_version[2], RPM_CTRL_REG(rpm, 2));
++
+ dev_info(&pdev->dev, "RPM firmware %u.%u.%u\n", fw_version[0],
+ fw_version[1],
+ fw_version[2]);
+--
+2.19.1
+
--- /dev/null
+From a643756aabf55da7b1277423ac095630eb444241 Mon Sep 17 00:00:00 2001
+From: Vignesh R <vigneshr@ti.com>
+Date: Mon, 3 Dec 2018 13:31:17 +0530
+Subject: mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd
+ cells
+
+[ Upstream commit b40ee006fe6a8a25093434e5d394128c356a48f3 ]
+
+Use PLATFORM_DEVID_AUTO to number mfd cells while registering, so that
+different instances are uniquely identified. This is required in order
+to support registering of multiple instances of same ti_am335x_tscadc IP.
+
+Signed-off-by: Vignesh R <vigneshr@ti.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/ti_am335x_tscadc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c
+index c2d47d78705b8..fd111296b9592 100644
+--- a/drivers/mfd/ti_am335x_tscadc.c
++++ b/drivers/mfd/ti_am335x_tscadc.c
+@@ -264,8 +264,9 @@ static int ti_tscadc_probe(struct platform_device *pdev)
+ cell->pdata_size = sizeof(tscadc);
+ }
+
+- err = mfd_add_devices(&pdev->dev, pdev->id, tscadc->cells,
+- tscadc->used_cells, NULL, 0, NULL);
++ err = mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO,
++ tscadc->cells, tscadc->used_cells, NULL,
++ 0, NULL);
+ if (err < 0)
+ goto err_disable_clk;
+
+--
+2.19.1
+
--- /dev/null
+From 6a5f9503203b615ef67902a0a28b13f92d61521c Mon Sep 17 00:00:00 2001
+From: Keerthy <j-keerthy@ti.com>
+Date: Sun, 9 Dec 2018 19:29:31 +0530
+Subject: mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path
+ in probe()
+
+[ Upstream commit 75d4c5e03c2ae9902ab521024b10291f6fc9515b ]
+
+Use devm_regmap_add_irq_chip and clean up error path in probe
+and also the remove function.
+
+Reported-by: Christian Hohnstaedt <Christian.Hohnstaedt@wago.com>
+Signed-off-by: Keerthy <j-keerthy@ti.com>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tps65218.c | 24 +++---------------------
+ 1 file changed, 3 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/mfd/tps65218.c b/drivers/mfd/tps65218.c
+index 910f569ff77c1..8bcdecf494d05 100644
+--- a/drivers/mfd/tps65218.c
++++ b/drivers/mfd/tps65218.c
+@@ -235,9 +235,9 @@ static int tps65218_probe(struct i2c_client *client,
+
+ mutex_init(&tps->tps_lock);
+
+- ret = regmap_add_irq_chip(tps->regmap, tps->irq,
+- IRQF_ONESHOT, 0, &tps65218_irq_chip,
+- &tps->irq_data);
++ ret = devm_regmap_add_irq_chip(&client->dev, tps->regmap, tps->irq,
++ IRQF_ONESHOT, 0, &tps65218_irq_chip,
++ &tps->irq_data);
+ if (ret < 0)
+ return ret;
+
+@@ -253,26 +253,9 @@ static int tps65218_probe(struct i2c_client *client,
+ ARRAY_SIZE(tps65218_cells), NULL, 0,
+ regmap_irq_get_domain(tps->irq_data));
+
+- if (ret < 0)
+- goto err_irq;
+-
+- return 0;
+-
+-err_irq:
+- regmap_del_irq_chip(tps->irq, tps->irq_data);
+-
+ return ret;
+ }
+
+-static int tps65218_remove(struct i2c_client *client)
+-{
+- struct tps65218 *tps = i2c_get_clientdata(client);
+-
+- regmap_del_irq_chip(tps->irq, tps->irq_data);
+-
+- return 0;
+-}
+-
+ static const struct i2c_device_id tps65218_id_table[] = {
+ { "tps65218", TPS65218 },
+ { },
+@@ -285,7 +268,6 @@ static struct i2c_driver tps65218_driver = {
+ .of_match_table = of_tps65218_match_table,
+ },
+ .probe = tps65218_probe,
+- .remove = tps65218_remove,
+ .id_table = tps65218_id_table,
+ };
+
+--
+2.19.1
+
--- /dev/null
+From 7355dbd73af71abaa4f78e41dce9654a2dca4fc1 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Wed, 17 Oct 2018 10:13:23 -0700
+Subject: mfd: twl-core: Fix section annotations on {,un}protect_pm_master
+
+[ Upstream commit 8838555089f0345b87f4277fe5a8dd647dc65589 ]
+
+When building the kernel with Clang, the following section mismatch
+warning appears:
+
+WARNING: vmlinux.o(.text+0x3d84a3b): Section mismatch in reference from
+the function twl_probe() to the function
+.init.text:unprotect_pm_master()
+The function twl_probe() references
+the function __init unprotect_pm_master().
+This is often because twl_probe lacks a __init
+annotation or the annotation of unprotect_pm_master is wrong.
+
+Remove the __init annotation on the *protect_pm_master functions so
+there is no more mismatch.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/twl-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
+index 4be3d239da9ec..299016bc46d90 100644
+--- a/drivers/mfd/twl-core.c
++++ b/drivers/mfd/twl-core.c
+@@ -979,7 +979,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned irq_base,
+ * letting it generate the right frequencies for USB, MADC, and
+ * other purposes.
+ */
+-static inline int __init protect_pm_master(void)
++static inline int protect_pm_master(void)
+ {
+ int e = 0;
+
+@@ -988,7 +988,7 @@ static inline int __init protect_pm_master(void)
+ return e;
+ }
+
+-static inline int __init unprotect_pm_master(void)
++static inline int unprotect_pm_master(void)
+ {
+ int e = 0;
+
+--
+2.19.1
+
--- /dev/null
+From 9e98a243f2da597974b6d9ec2f8f275753d3a138 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Wed, 28 Nov 2018 10:04:22 +0000
+Subject: mfd: wm5110: Add missing ASRC rate register
+
+[ Upstream commit 04c801c18ded421845324255e660147a6f58dcd6 ]
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/wm5110-tables.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c
+index 1ee68bd440fbc..16c6e2accfaa5 100644
+--- a/drivers/mfd/wm5110-tables.c
++++ b/drivers/mfd/wm5110-tables.c
+@@ -1618,6 +1618,7 @@ static const struct reg_default wm5110_reg_default[] = {
+ { 0x00000ECD, 0x0000 }, /* R3789 - HPLPF4_2 */
+ { 0x00000EE0, 0x0000 }, /* R3808 - ASRC_ENABLE */
+ { 0x00000EE2, 0x0000 }, /* R3810 - ASRC_RATE1 */
++ { 0x00000EE3, 0x4000 }, /* R3811 - ASRC_RATE2 */
+ { 0x00000EF0, 0x0000 }, /* R3824 - ISRC 1 CTRL 1 */
+ { 0x00000EF1, 0x0000 }, /* R3825 - ISRC 1 CTRL 2 */
+ { 0x00000EF2, 0x0000 }, /* R3826 - ISRC 1 CTRL 3 */
+@@ -2869,6 +2870,7 @@ static bool wm5110_readable_register(struct device *dev, unsigned int reg)
+ case ARIZONA_ASRC_ENABLE:
+ case ARIZONA_ASRC_STATUS:
+ case ARIZONA_ASRC_RATE1:
++ case ARIZONA_ASRC_RATE2:
+ case ARIZONA_ISRC_1_CTRL_1:
+ case ARIZONA_ISRC_1_CTRL_2:
+ case ARIZONA_ISRC_1_CTRL_3:
+--
+2.19.1
+
--- /dev/null
+From 949edf38e239adc5143d1143b03b0cad30332fd9 Mon Sep 17 00:00:00 2001
+From: Alban Bedel <albeu@free.fr>
+Date: Mon, 7 Jan 2019 20:45:15 +0100
+Subject: MIPS: ath79: Enable OF serial ports in the default config
+
+[ Upstream commit 565dc8a4f55e491935bfb04866068d21784ea9a4 ]
+
+CONFIG_SERIAL_OF_PLATFORM is needed to get a working console on the OF
+boards, enable it in the default config to get a working setup out of
+the box.
+
+Signed-off-by: Alban Bedel <albeu@free.fr>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: linux-mips@vger.kernel.org
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/configs/ath79_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/configs/ath79_defconfig b/arch/mips/configs/ath79_defconfig
+index 951c4231bdb85..4c47b3fd958b6 100644
+--- a/arch/mips/configs/ath79_defconfig
++++ b/arch/mips/configs/ath79_defconfig
+@@ -71,6 +71,7 @@ CONFIG_SERIAL_8250_CONSOLE=y
+ # CONFIG_SERIAL_8250_PCI is not set
+ CONFIG_SERIAL_8250_NR_UARTS=1
+ CONFIG_SERIAL_8250_RUNTIME_UARTS=1
++CONFIG_SERIAL_OF_PLATFORM=y
+ CONFIG_SERIAL_AR933X=y
+ CONFIG_SERIAL_AR933X_CONSOLE=y
+ # CONFIG_HW_RANDOM is not set
+--
+2.19.1
+
--- /dev/null
+From 6506327200f3c3d4b213005506d167a8da695831 Mon Sep 17 00:00:00 2001
+From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Date: Wed, 9 Jan 2019 18:12:16 +0100
+Subject: MIPS: jazz: fix 64bit build
+
+[ Upstream commit 41af167fbc0032f9d7562854f58114eaa9270336 ]
+
+64bit JAZZ builds failed with
+
+ linux-next/arch/mips/jazz/jazzdma.c: In function `vdma_init`:
+ /linux-next/arch/mips/jazz/jazzdma.c:77:30: error: implicit declaration
+ of function `KSEG1ADDR`; did you mean `CKSEG1ADDR`?
+ [-Werror=implicit-function-declaration]
+ pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
+ ^~~~~~~~~
+ CKSEG1ADDR
+ /linux-next/arch/mips/jazz/jazzdma.c:77:10: error: cast to pointer from
+ integer of different size [-Werror=int-to-pointer-cast]
+ pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
+ ^
+ In file included from /linux-next/arch/mips/include/asm/barrier.h:11:0,
+ from /linux-next/include/linux/compiler.h:248,
+ from /linux-next/include/linux/kernel.h:10,
+ from /linux-next/arch/mips/jazz/jazzdma.c:11:
+ /linux-next/arch/mips/include/asm/addrspace.h:41:29: error: cast from
+ pointer to integer of different size [-Werror=pointer-to-int-cast]
+ #define _ACAST32_ (_ATYPE_)(_ATYPE32_) /* widen if necessary */
+ ^
+ /linux-next/arch/mips/include/asm/addrspace.h:53:25: note: in
+ expansion of macro `_ACAST32_`
+ #define CPHYSADDR(a) ((_ACAST32_(a)) & 0x1fffffff)
+ ^~~~~~~~~
+ /linux-next/arch/mips/jazz/jazzdma.c:84:44: note: in expansion of
+ macro `CPHYSADDR`
+ r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));
+
+Using correct casts and CKSEG1ADDR when dealing with the pgtbl setup
+fixes this.
+
+Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/jazz/jazzdma.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c
+index 4c41ed0a637e5..415a08376c362 100644
+--- a/arch/mips/jazz/jazzdma.c
++++ b/arch/mips/jazz/jazzdma.c
+@@ -74,14 +74,15 @@ static int __init vdma_init(void)
+ get_order(VDMA_PGTBL_SIZE));
+ BUG_ON(!pgtbl);
+ dma_cache_wback_inv((unsigned long)pgtbl, VDMA_PGTBL_SIZE);
+- pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
++ pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR((unsigned long)pgtbl);
+
+ /*
+ * Clear the R4030 translation table
+ */
+ vdma_pgtbl_init();
+
+- r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));
++ r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE,
++ CPHYSADDR((unsigned long)pgtbl));
+ r4030_write_reg32(JAZZ_R4030_TRSTBL_LIM, VDMA_PGTBL_SIZE);
+ r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0);
+
+--
+2.19.1
+
--- /dev/null
+From f1d3a11a1e9bd0f2725244ec3e8722cb38029fdf Mon Sep 17 00:00:00 2001
+From: Nir Dotan <nird@mellanox.com>
+Date: Fri, 18 Jan 2019 15:57:57 +0000
+Subject: mlxsw: pci: Return error on PCI reset timeout
+
+[ Upstream commit 67c14cc9b35055264fc0efed00159a7de1819f1b ]
+
+Return an appropriate error in the case when the driver timeouts on waiting
+for firmware to go out of PCI reset.
+
+Fixes: 233fa44bd67a ("mlxsw: pci: Implement reset done check")
+Signed-off-by: Nir Dotan <nird@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
+index c7901a3f2a794..a903e97793f9a 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
+@@ -1367,10 +1367,10 @@ static int mlxsw_pci_sw_reset(struct mlxsw_pci *mlxsw_pci,
+ u32 val = mlxsw_pci_read32(mlxsw_pci, FW_READY);
+
+ if ((val & MLXSW_PCI_FW_READY_MASK) == MLXSW_PCI_FW_READY_MAGIC)
+- break;
++ return 0;
+ cond_resched();
+ } while (time_before(jiffies, end));
+- return 0;
++ return -EBUSY;
+ }
+
+ static int mlxsw_pci_alloc_irq_vectors(struct mlxsw_pci *mlxsw_pci)
+--
+2.19.1
+
--- /dev/null
+From ee4e79292ff28b702d3923d439792caaf23eb1c4 Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Tue, 8 Jan 2019 16:48:06 +0000
+Subject: mlxsw: spectrum: Add VXLAN dependency for spectrum
+
+[ Upstream commit 143a8e038ac599ca73c6354c8af6a8fdeee9fa7d ]
+
+When VXLAN is a loadable module, MLXSW_SPECTRUM must not be built-in:
+
+drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c:2547: undefined
+reference to `vxlan_fdb_find_uc'
+
+Add Kconfig dependency to enforce usable configurations.
+
+Fixes: 1231e04f5bba ("mlxsw: spectrum_switchdev: Add support for VxLAN encapsulation")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reported-by: kbuild test robot <lkp@intel.com>
+Reviewed-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/Kconfig b/drivers/net/ethernet/mellanox/mlxsw/Kconfig
+index 8a291eb36c64c..7338c9bac4e6a 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/Kconfig
++++ b/drivers/net/ethernet/mellanox/mlxsw/Kconfig
+@@ -78,6 +78,7 @@ config MLXSW_SPECTRUM
+ depends on IPV6 || IPV6=n
+ depends on NET_IPGRE || NET_IPGRE=n
+ depends on IPV6_GRE || IPV6_GRE=n
++ depends on VXLAN || VXLAN=n
+ select GENERIC_ALLOCATOR
+ select PARMAN
+ select MLXFW
+--
+2.19.1
+
--- /dev/null
+From dab08affb9d11f4ff8df0a6c4b1cea1bf54a48a7 Mon Sep 17 00:00:00 2001
+From: Nir Dotan <nird@mellanox.com>
+Date: Tue, 8 Jan 2019 16:48:03 +0000
+Subject: mlxsw: spectrum_acl: Add cleanup after C-TCAM update error condition
+
+[ Upstream commit ff0db43cd6c530ff944773ccf48ece55d32d0c22 ]
+
+When writing to C-TCAM, mlxsw driver uses cregion->ops->entry_insert().
+In case of C-TCAM HW insertion error, the opposite action should take
+place.
+Add error handling case in which the C-TCAM region entry is removed, by
+calling cregion->ops->entry_remove().
+
+Fixes: a0a777b9409f ("mlxsw: spectrum_acl: Start using A-TCAM")
+Signed-off-by: Nir Dotan <nird@mellanox.com>
+Reviewed-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c
+index e3c6fe8b1d406..1dcf152b28138 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c
+@@ -75,7 +75,15 @@ mlxsw_sp_acl_ctcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp,
+ act_set = mlxsw_afa_block_first_set(rulei->act_block);
+ mlxsw_reg_ptce2_flex_action_set_memcpy_to(ptce2_pl, act_set);
+
+- return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ptce2), ptce2_pl);
++ err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ptce2), ptce2_pl);
++ if (err)
++ goto err_ptce2_write;
++
++ return 0;
++
++err_ptce2_write:
++ cregion->ops->entry_remove(cregion, centry);
++ return err;
+ }
+
+ static void
+--
+2.19.1
+
--- /dev/null
+From ea4fb13c302bdd8fe236c9d8b9e933184650f20e Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Fri, 18 Jan 2019 15:58:01 +0000
+Subject: mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky
+
+[ Upstream commit 64254a2054611205798e6bde634639bc704573ac ]
+
+The driver currently treats static FDB entries as both static and
+sticky. This is incorrect and prevents such entries from being roamed to
+a different port via learning.
+
+Fix this by configuring static entries with ageing disabled and roaming
+enabled.
+
+In net-next we can add proper support for the newly introduced 'sticky'
+flag.
+
+Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reported-by: Alexander Petrovskiy <alexpe@mellanox.com>
+Reviewed-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index c514af438fc28..b606db9833e9e 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -1219,7 +1219,7 @@ mlxsw_sp_bridge_port_fdb_flush(struct mlxsw_sp *mlxsw_sp,
+ static enum mlxsw_reg_sfd_rec_policy mlxsw_sp_sfd_rec_policy(bool dynamic)
+ {
+ return dynamic ? MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_INGRESS :
+- MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY;
++ MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_MLAG;
+ }
+
+ static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding)
+@@ -1276,7 +1276,7 @@ static int mlxsw_sp_port_fdb_tunnel_uc_op(struct mlxsw_sp *mlxsw_sp,
+ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ const char *mac, u16 fid, bool adding,
+ enum mlxsw_reg_sfd_rec_action action,
+- bool dynamic)
++ enum mlxsw_reg_sfd_rec_policy policy)
+ {
+ char *sfd_pl;
+ u8 num_rec;
+@@ -1287,8 +1287,7 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ return -ENOMEM;
+
+ mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0);
+- mlxsw_reg_sfd_uc_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic),
+- mac, fid, action, local_port);
++ mlxsw_reg_sfd_uc_pack(sfd_pl, 0, policy, mac, fid, action, local_port);
+ num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl);
+ err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl);
+ if (err)
+@@ -1307,7 +1306,8 @@ static int mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ bool dynamic)
+ {
+ return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, local_port, mac, fid, adding,
+- MLXSW_REG_SFD_REC_ACTION_NOP, dynamic);
++ MLXSW_REG_SFD_REC_ACTION_NOP,
++ mlxsw_sp_sfd_rec_policy(dynamic));
+ }
+
+ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
+@@ -1315,7 +1315,7 @@ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
+ {
+ return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, 0, mac, fid, adding,
+ MLXSW_REG_SFD_REC_ACTION_FORWARD_IP_ROUTER,
+- false);
++ MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY);
+ }
+
+ static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id,
+--
+2.19.1
+
--- /dev/null
+From 543ae7e7b12348797a98f38f3b085f8ffee0d612 Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Fri, 18 Jan 2019 15:58:00 +0000
+Subject: net: bridge: Mark FDB entries that were added by user as such
+
+[ Upstream commit 710ae72877378e7cde611efd30fe90502a6e5b30 ]
+
+Externally learned entries can be added by a user or by a switch driver
+that is notifying the bridge driver about entries that were learned in
+hardware.
+
+In the first case, the entries are not marked with the 'added_by_user'
+flag, which causes switch drivers to ignore them and not offload them.
+
+The 'added_by_user' flag can be set on externally learned FDB entries
+based on the 'swdev_notify' parameter in br_fdb_external_learn_add(),
+which effectively means if the created / updated FDB entry was added by
+a user or not.
+
+Fixes: 816a3bed9549 ("switchdev: Add fdb.added_by_user to switchdev notifications")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reported-by: Alexander Petrovskiy <alexpe@mellanox.com>
+Reviewed-by: Petr Machata <petrm@mellanox.com>
+Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
+Cc: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+Cc: bridge@lists.linux-foundation.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_fdb.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
+index e56ba3912a905..8b8abf88befbd 100644
+--- a/net/bridge/br_fdb.c
++++ b/net/bridge/br_fdb.c
+@@ -1102,6 +1102,8 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
+ err = -ENOMEM;
+ goto err_unlock;
+ }
++ if (swdev_notify)
++ fdb->added_by_user = 1;
+ fdb->added_by_external_learn = 1;
+ fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify);
+ } else {
+@@ -1121,6 +1123,9 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
+ modified = true;
+ }
+
++ if (swdev_notify)
++ fdb->added_by_user = 1;
++
+ if (modified)
+ fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify);
+ }
+--
+2.19.1
+
--- /dev/null
+From 7e66de7f73db7776880ae0ee8a13fa271a53e018 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Fri, 4 Jan 2019 20:18:11 +0800
+Subject: net: hns: Fix use after free identified by SLUB debug
+
+[ Upstream commit bb989501abcafa0de5f18b0ec0ec459b5b817908 ]
+
+When enable SLUB debug, than remove hns_enet_drv module, SLUB debug will
+identify a use after free bug:
+
+[134.189505] Unable to handle kernel paging request at virtual address
+ 006b6b6b6b6b6b6b
+[134.197553] Mem abort info:
+[134.200381] ESR = 0x96000004
+[134.203487] Exception class = DABT (current EL), IL = 32 bits
+[134.209497] SET = 0, FnV = 0
+[134.212596] EA = 0, S1PTW = 0
+[134.215777] Data abort info:
+[134.218701] ISV = 0, ISS = 0x00000004
+[134.222596] CM = 0, WnR = 0
+[134.225606] [006b6b6b6b6b6b6b] address between user and kernel address ranges
+[134.232851] Internal error: Oops: 96000004 [#1] SMP
+[134.237798] CPU: 21 PID: 27834 Comm: rmmod Kdump: loaded Tainted: G
+ OE 4.19.5-1.2.34.aarch64 #1
+[134.247856] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.58 10/24/2018
+[134.255181] pstate: 20000005 (nzCv daif -PAN -UAO)
+[134.260044] pc : hns_ae_put_handle+0x38/0x60
+[134.264372] lr : hns_ae_put_handle+0x24/0x60
+[134.268700] sp : ffff00001be93c50
+[134.272054] x29: ffff00001be93c50 x28: ffff802faaec8040
+[134.277442] x27: 0000000000000000 x26: 0000000000000000
+[134.282830] x25: 0000000056000000 x24: 0000000000000015
+[134.288284] x23: ffff0000096fe098 x22: ffff000001050070
+[134.293671] x21: ffff801fb3c044a0 x20: ffff80afb75ec098
+[134.303287] x19: ffff80afb75ec098 x18: 0000000000000000
+[134.312945] x17: 0000000000000000 x16: 0000000000000000
+[134.322517] x15: 0000000000000002 x14: 0000000000000000
+[134.332030] x13: dead000000000100 x12: ffff7e02bea3c988
+[134.341487] x11: ffff80affbee9e68 x10: 0000000000000000
+[134.351033] x9 : 6fffff8000008101 x8 : 0000000000000000
+[134.360569] x7 : dead000000000100 x6 : ffff000009579748
+[134.370059] x5 : 0000000000210d00 x4 : 0000000000000000
+[134.379550] x3 : 0000000000000001 x2 : 0000000000000000
+[134.388813] x1 : 6b6b6b6b6b6b6b6b x0 : 0000000000000000
+[134.397993] Process rmmod (pid: 27834, stack limit = 0x00000000d474b7fd)
+[134.408498] Call trace:
+[134.414611] hns_ae_put_handle+0x38/0x60
+[134.422208] hnae_put_handle+0xd4/0x108
+[134.429563] hns_nic_dev_remove+0x60/0xc0 [hns_enet_drv]
+[134.438342] platform_drv_remove+0x2c/0x70
+[134.445958] device_release_driver_internal+0x174/0x208
+[134.454810] driver_detach+0x70/0xd8
+[134.461913] bus_remove_driver+0x64/0xe8
+[134.469396] driver_unregister+0x34/0x60
+[134.476822] platform_driver_unregister+0x20/0x30
+[134.485130] hns_nic_dev_driver_exit+0x14/0x6e4 [hns_enet_drv]
+[134.494634] __arm64_sys_delete_module+0x238/0x290
+
+struct hnae_handle is a member of struct hnae_vf_cb, so when vf_cb is
+freed, than use hnae_handle will cause use after free panic.
+
+This patch frees vf_cb after hnae_handle used.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+index ad1779fc410e6..a78bfafd212c8 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+@@ -147,12 +147,10 @@ static void hns_ae_put_handle(struct hnae_handle *handle)
+ struct hnae_vf_cb *vf_cb = hns_ae_get_vf_cb(handle);
+ int i;
+
+- vf_cb->mac_cb = NULL;
+-
+- kfree(vf_cb);
+-
+ for (i = 0; i < handle->q_num; i++)
+ hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0;
++
++ kfree(vf_cb);
+ }
+
+ static int hns_ae_wait_flow_down(struct hnae_handle *handle)
+--
+2.19.1
+
--- /dev/null
+From 1f59f2131a354546d91fe3a16aba1d3e9512e792 Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Thu, 3 Jan 2019 10:23:23 -0700
+Subject: net/mlx4: Get rid of page operation after dma_alloc_coherent
+
+[ Upstream commit f65e192af35058e5c82da9e90871b472d24912bc ]
+
+This patch solves a crash at the time of mlx4 driver unload or system
+shutdown. The crash occurs because dma_alloc_coherent() returns one
+value in mlx4_alloc_icm_coherent(), but a different value is passed to
+dma_free_coherent() in mlx4_free_icm_coherent(). In turn this is because
+when allocated, that pointer is passed to sg_set_buf() to record it,
+then when freed it is re-calculated by calling
+lowmem_page_address(sg_page()) which returns a different value. Solve
+this by recording the value that dma_alloc_coherent() returns, and
+passing this to dma_free_coherent().
+
+This patch is roughly equivalent to commit 378efe798ecf ("RDMA/hns: Get
+rid of page operation after dma_alloc_coherent").
+
+Based-on-code-from: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/icm.c | 92 ++++++++++++++----------
+ drivers/net/ethernet/mellanox/mlx4/icm.h | 22 +++++-
+ 2 files changed, 75 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
+index 4b4351141b94c..76b84d08a058b 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
++++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
+@@ -57,12 +57,12 @@ static void mlx4_free_icm_pages(struct mlx4_dev *dev, struct mlx4_icm_chunk *chu
+ int i;
+
+ if (chunk->nsg > 0)
+- pci_unmap_sg(dev->persist->pdev, chunk->mem, chunk->npages,
++ pci_unmap_sg(dev->persist->pdev, chunk->sg, chunk->npages,
+ PCI_DMA_BIDIRECTIONAL);
+
+ for (i = 0; i < chunk->npages; ++i)
+- __free_pages(sg_page(&chunk->mem[i]),
+- get_order(chunk->mem[i].length));
++ __free_pages(sg_page(&chunk->sg[i]),
++ get_order(chunk->sg[i].length));
+ }
+
+ static void mlx4_free_icm_coherent(struct mlx4_dev *dev, struct mlx4_icm_chunk *chunk)
+@@ -71,9 +71,9 @@ static void mlx4_free_icm_coherent(struct mlx4_dev *dev, struct mlx4_icm_chunk *
+
+ for (i = 0; i < chunk->npages; ++i)
+ dma_free_coherent(&dev->persist->pdev->dev,
+- chunk->mem[i].length,
+- lowmem_page_address(sg_page(&chunk->mem[i])),
+- sg_dma_address(&chunk->mem[i]));
++ chunk->buf[i].size,
++ chunk->buf[i].addr,
++ chunk->buf[i].dma_addr);
+ }
+
+ void mlx4_free_icm(struct mlx4_dev *dev, struct mlx4_icm *icm, int coherent)
+@@ -111,22 +111,21 @@ static int mlx4_alloc_icm_pages(struct scatterlist *mem, int order,
+ return 0;
+ }
+
+-static int mlx4_alloc_icm_coherent(struct device *dev, struct scatterlist *mem,
+- int order, gfp_t gfp_mask)
++static int mlx4_alloc_icm_coherent(struct device *dev, struct mlx4_icm_buf *buf,
++ int order, gfp_t gfp_mask)
+ {
+- void *buf = dma_alloc_coherent(dev, PAGE_SIZE << order,
+- &sg_dma_address(mem), gfp_mask);
+- if (!buf)
++ buf->addr = dma_alloc_coherent(dev, PAGE_SIZE << order,
++ &buf->dma_addr, gfp_mask);
++ if (!buf->addr)
+ return -ENOMEM;
+
+- if (offset_in_page(buf)) {
+- dma_free_coherent(dev, PAGE_SIZE << order,
+- buf, sg_dma_address(mem));
++ if (offset_in_page(buf->addr)) {
++ dma_free_coherent(dev, PAGE_SIZE << order, buf->addr,
++ buf->dma_addr);
+ return -ENOMEM;
+ }
+
+- sg_set_buf(mem, buf, PAGE_SIZE << order);
+- sg_dma_len(mem) = PAGE_SIZE << order;
++ buf->size = PAGE_SIZE << order;
+ return 0;
+ }
+
+@@ -159,21 +158,21 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
+
+ while (npages > 0) {
+ if (!chunk) {
+- chunk = kmalloc_node(sizeof(*chunk),
++ chunk = kzalloc_node(sizeof(*chunk),
+ gfp_mask & ~(__GFP_HIGHMEM |
+ __GFP_NOWARN),
+ dev->numa_node);
+ if (!chunk) {
+- chunk = kmalloc(sizeof(*chunk),
++ chunk = kzalloc(sizeof(*chunk),
+ gfp_mask & ~(__GFP_HIGHMEM |
+ __GFP_NOWARN));
+ if (!chunk)
+ goto fail;
+ }
++ chunk->coherent = coherent;
+
+- sg_init_table(chunk->mem, MLX4_ICM_CHUNK_LEN);
+- chunk->npages = 0;
+- chunk->nsg = 0;
++ if (!coherent)
++ sg_init_table(chunk->sg, MLX4_ICM_CHUNK_LEN);
+ list_add_tail(&chunk->list, &icm->chunk_list);
+ }
+
+@@ -186,10 +185,10 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
+
+ if (coherent)
+ ret = mlx4_alloc_icm_coherent(&dev->persist->pdev->dev,
+- &chunk->mem[chunk->npages],
+- cur_order, mask);
++ &chunk->buf[chunk->npages],
++ cur_order, mask);
+ else
+- ret = mlx4_alloc_icm_pages(&chunk->mem[chunk->npages],
++ ret = mlx4_alloc_icm_pages(&chunk->sg[chunk->npages],
+ cur_order, mask,
+ dev->numa_node);
+
+@@ -205,7 +204,7 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
+ if (coherent)
+ ++chunk->nsg;
+ else if (chunk->npages == MLX4_ICM_CHUNK_LEN) {
+- chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->mem,
++ chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->sg,
+ chunk->npages,
+ PCI_DMA_BIDIRECTIONAL);
+
+@@ -220,7 +219,7 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
+ }
+
+ if (!coherent && chunk) {
+- chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->mem,
++ chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->sg,
+ chunk->npages,
+ PCI_DMA_BIDIRECTIONAL);
+
+@@ -320,7 +319,7 @@ void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj,
+ u64 idx;
+ struct mlx4_icm_chunk *chunk;
+ struct mlx4_icm *icm;
+- struct page *page = NULL;
++ void *addr = NULL;
+
+ if (!table->lowmem)
+ return NULL;
+@@ -336,28 +335,49 @@ void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj,
+
+ list_for_each_entry(chunk, &icm->chunk_list, list) {
+ for (i = 0; i < chunk->npages; ++i) {
++ dma_addr_t dma_addr;
++ size_t len;
++
++ if (table->coherent) {
++ len = chunk->buf[i].size;
++ dma_addr = chunk->buf[i].dma_addr;
++ addr = chunk->buf[i].addr;
++ } else {
++ struct page *page;
++
++ len = sg_dma_len(&chunk->sg[i]);
++ dma_addr = sg_dma_address(&chunk->sg[i]);
++
++ /* XXX: we should never do this for highmem
++ * allocation. This function either needs
++ * to be split, or the kernel virtual address
++ * return needs to be made optional.
++ */
++ page = sg_page(&chunk->sg[i]);
++ addr = lowmem_page_address(page);
++ }
++
+ if (dma_handle && dma_offset >= 0) {
+- if (sg_dma_len(&chunk->mem[i]) > dma_offset)
+- *dma_handle = sg_dma_address(&chunk->mem[i]) +
+- dma_offset;
+- dma_offset -= sg_dma_len(&chunk->mem[i]);
++ if (len > dma_offset)
++ *dma_handle = dma_addr + dma_offset;
++ dma_offset -= len;
+ }
++
+ /*
+ * DMA mapping can merge pages but not split them,
+ * so if we found the page, dma_handle has already
+ * been assigned to.
+ */
+- if (chunk->mem[i].length > offset) {
+- page = sg_page(&chunk->mem[i]);
++ if (len > offset)
+ goto out;
+- }
+- offset -= chunk->mem[i].length;
++ offset -= len;
+ }
+ }
+
++ addr = NULL;
+ out:
+ mutex_unlock(&table->mutex);
+- return page ? lowmem_page_address(page) + offset : NULL;
++ return addr ? addr + offset : NULL;
+ }
+
+ int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
+diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.h b/drivers/net/ethernet/mellanox/mlx4/icm.h
+index c9169a490557c..d199874b1c074 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/icm.h
++++ b/drivers/net/ethernet/mellanox/mlx4/icm.h
+@@ -47,11 +47,21 @@ enum {
+ MLX4_ICM_PAGE_SIZE = 1 << MLX4_ICM_PAGE_SHIFT,
+ };
+
++struct mlx4_icm_buf {
++ void *addr;
++ size_t size;
++ dma_addr_t dma_addr;
++};
++
+ struct mlx4_icm_chunk {
+ struct list_head list;
+ int npages;
+ int nsg;
+- struct scatterlist mem[MLX4_ICM_CHUNK_LEN];
++ bool coherent;
++ union {
++ struct scatterlist sg[MLX4_ICM_CHUNK_LEN];
++ struct mlx4_icm_buf buf[MLX4_ICM_CHUNK_LEN];
++ };
+ };
+
+ struct mlx4_icm {
+@@ -114,12 +124,18 @@ static inline void mlx4_icm_next(struct mlx4_icm_iter *iter)
+
+ static inline dma_addr_t mlx4_icm_addr(struct mlx4_icm_iter *iter)
+ {
+- return sg_dma_address(&iter->chunk->mem[iter->page_idx]);
++ if (iter->chunk->coherent)
++ return iter->chunk->buf[iter->page_idx].dma_addr;
++ else
++ return sg_dma_address(&iter->chunk->sg[iter->page_idx]);
+ }
+
+ static inline unsigned long mlx4_icm_size(struct mlx4_icm_iter *iter)
+ {
+- return sg_dma_len(&iter->chunk->mem[iter->page_idx]);
++ if (iter->chunk->coherent)
++ return iter->chunk->buf[iter->page_idx].size;
++ else
++ return sg_dma_len(&iter->chunk->sg[iter->page_idx]);
+ }
+
+ int mlx4_MAP_ICM_AUX(struct mlx4_dev *dev, struct mlx4_icm *icm);
+--
+2.19.1
+
--- /dev/null
+From ddab37e242c9ffd673728572a8453eec898d7f8e Mon Sep 17 00:00:00 2001
+From: Tariq Toukan <tariqt@mellanox.com>
+Date: Thu, 8 Nov 2018 12:06:53 +0200
+Subject: net/mlx5e: Fix wrong (zero) TX drop counter indication for
+ representor
+
+[ Upstream commit 7fdc1adc52d3975740547a78c2df329bb207f15d ]
+
+For representors, the TX dropped counter is not folded from the
+per-ring counters. Fix it.
+
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+index 820fe85100b08..4dccc84fdcf2c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+@@ -143,6 +143,7 @@ static void mlx5e_rep_update_sw_counters(struct mlx5e_priv *priv)
+
+ s->tx_packets += sq_stats->packets;
+ s->tx_bytes += sq_stats->bytes;
++ s->tx_queue_dropped += sq_stats->dropped;
+ }
+ }
+ }
+--
+2.19.1
+
--- /dev/null
+From a16599b5dcb875b7be03fd754ee096e784acc711 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 10 Jan 2019 20:22:26 +0100
+Subject: net: phy: micrel: set soft_reset callback to genphy_soft_reset for
+ KSZ9031
+
+[ Upstream commit 1d16073a326891c2a964e4cb95bc18fbcafb5f74 ]
+
+So far genphy_soft_reset was used automatically if the PHY driver
+didn't implement the soft_reset callback. This changed with the
+mentioned commit and broke KSZ9031. To fix this configure the
+KSZ9031 PHY driver to use genphy_soft_reset.
+
+Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset")
+Reported-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Tested-by: Tony Lindgren <tony@atomide.com>
+Tested-by: Sekhar Nori <nsekhar@ti.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/micrel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index 51611c7a23d1c..22dfbd4c6aaf4 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -1076,6 +1076,7 @@ static struct phy_driver ksphy_driver[] = {
+ .driver_data = &ksz9021_type,
+ .probe = kszphy_probe,
+ .config_init = ksz9031_config_init,
++ .soft_reset = genphy_soft_reset,
+ .read_status = ksz9031_read_status,
+ .ack_interrupt = kszphy_ack_interrupt,
+ .config_intr = kszphy_config_intr,
+--
+2.19.1
+
--- /dev/null
+From f36beaf043f29e1c5397f4b4879b0867ac7d412d Mon Sep 17 00:00:00 2001
+From: Jose Abreu <jose.abreu@synopsys.com>
+Date: Wed, 9 Jan 2019 10:05:58 +0100
+Subject: net: stmmac: Check if CBS is supported before configuring
+
+[ Upstream commit 0650d4017f4d2eee67230a02285a7ae5204240c2 ]
+
+Check if CBS is currently supported before trying to configure it in HW.
+
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+index 531294f4978bc..58ea18af9813a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -301,6 +301,8 @@ static int tc_setup_cbs(struct stmmac_priv *priv,
+ /* Queue 0 is not AVB capable */
+ if (queue <= 0 || queue >= tx_queues_count)
+ return -EINVAL;
++ if (!priv->dma_cap.av)
++ return -EOPNOTSUPP;
+ if (priv->speed != SPEED_100 && priv->speed != SPEED_1000)
+ return -EOPNOTSUPP;
+
+--
+2.19.1
+
--- /dev/null
+From 0b78d2feb32dcc8edf452cc171df6ebe1f42408a Mon Sep 17 00:00:00 2001
+From: Jose Abreu <jose.abreu@synopsys.com>
+Date: Wed, 9 Jan 2019 10:05:57 +0100
+Subject: net: stmmac: dwxgmac2: Only clear interrupts that are active
+
+[ Upstream commit fcc509eb10ff4794641e6ad3082118287a750d0a ]
+
+In DMA interrupt handler we were clearing all interrupts status, even
+the ones that were not active. Fix this and only clear the active
+interrupts.
+
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+index 6c5092e7771cd..c5e25580a43fa 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+@@ -263,6 +263,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr,
+ struct stmmac_extra_stats *x, u32 chan)
+ {
+ u32 intr_status = readl(ioaddr + XGMAC_DMA_CH_STATUS(chan));
++ u32 intr_en = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+ int ret = 0;
+
+ /* ABNORMAL interrupts */
+@@ -282,8 +283,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr,
+ x->normal_irq_n++;
+
+ if (likely(intr_status & XGMAC_RI)) {
+- u32 value = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+- if (likely(value & XGMAC_RIE)) {
++ if (likely(intr_en & XGMAC_RIE)) {
+ x->rx_normal_irq_n++;
+ ret |= handle_rx;
+ }
+@@ -295,7 +295,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr,
+ }
+
+ /* Clear interrupts */
+- writel(~0x0, ioaddr + XGMAC_DMA_CH_STATUS(chan));
++ writel(intr_en & intr_status, ioaddr + XGMAC_DMA_CH_STATUS(chan));
+
+ return ret;
+ }
+--
+2.19.1
+
--- /dev/null
+From eb22dcdfc7b7f3f0daa283922456021fc51db4b2 Mon Sep 17 00:00:00 2001
+From: Jose Abreu <jose.abreu@synopsys.com>
+Date: Wed, 9 Jan 2019 10:05:56 +0100
+Subject: net: stmmac: Fix PCI module removal leak
+
+[ Upstream commit 6dea7e1881fd86b80da64e476ac398008daed857 ]
+
+Since commit b7d0f08e9129, the enable / disable of PCI device is not
+managed which will result in IO regions not being automatically unmapped.
+As regions continue mapped it is currently not possible to remove and
+then probe again the PCI module of stmmac.
+
+Fix this by manually unmapping regions on remove callback.
+
+Changes from v1:
+- Fix build error
+
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Fixes: b7d0f08e9129 ("net: stmmac: Fix WoL for PCI-based setups")
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+index c54a50dbd5ac2..d819e8eaba122 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+@@ -299,7 +299,17 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
+ */
+ static void stmmac_pci_remove(struct pci_dev *pdev)
+ {
++ int i;
++
+ stmmac_dvr_remove(&pdev->dev);
++
++ for (i = 0; i <= PCI_STD_RESOURCE_END; i++) {
++ if (pci_resource_len(pdev, i) == 0)
++ continue;
++ pcim_iounmap_regions(pdev, BIT(i));
++ break;
++ }
++
+ pci_disable_device(pdev);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 666a07dc0f558a21e18e4304986c1db729765b11 Mon Sep 17 00:00:00 2001
+From: Jose Abreu <jose.abreu@synopsys.com>
+Date: Wed, 9 Jan 2019 10:05:59 +0100
+Subject: net: stmmac: Fix the logic of checking if RX Watchdog must be enabled
+
+[ Upstream commit 3b5094665e273c4a2a99f7f5f16977c0f1e19095 ]
+
+RX Watchdog can be disabled by platform definitions but currently we are
+initializing the descriptors before checking if Watchdog must be
+disabled or not.
+
+Fix this by checking earlier if user wants Watchdog disabled or not.
+
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 24 +++++++++----------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index c4a35e932f052..fe9240e15aeac 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -4194,6 +4194,18 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
+ return ret;
+ }
+
++ /* Rx Watchdog is available in the COREs newer than the 3.40.
++ * In some case, for example on bugged HW this feature
++ * has to be disable and this can be done by passing the
++ * riwt_off field from the platform.
++ */
++ if (((priv->synopsys_id >= DWMAC_CORE_3_50) ||
++ (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) {
++ priv->use_riwt = 1;
++ dev_info(priv->device,
++ "Enable RX Mitigation via HW Watchdog Timer\n");
++ }
++
+ return 0;
+ }
+
+@@ -4326,18 +4338,6 @@ int stmmac_dvr_probe(struct device *device,
+ if (flow_ctrl)
+ priv->flow_ctrl = FLOW_AUTO; /* RX/TX pause on */
+
+- /* Rx Watchdog is available in the COREs newer than the 3.40.
+- * In some case, for example on bugged HW this feature
+- * has to be disable and this can be done by passing the
+- * riwt_off field from the platform.
+- */
+- if (((priv->synopsys_id >= DWMAC_CORE_3_50) ||
+- (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) {
+- priv->use_riwt = 1;
+- dev_info(priv->device,
+- "Enable RX Mitigation via HW Watchdog Timer\n");
+- }
+-
+ /* Setup channels NAPI */
+ maxq = max(priv->plat->rx_queues_to_use, priv->plat->tx_queues_to_use);
+
+--
+2.19.1
+
--- /dev/null
+From 0d2d07aec337018d4efb6b1f0091fffbf8e97be3 Mon Sep 17 00:00:00 2001
+From: Jose Abreu <jose.abreu@synopsys.com>
+Date: Wed, 9 Jan 2019 10:06:00 +0100
+Subject: net: stmmac: Prevent RX starvation in stmmac_napi_poll()
+
+[ Upstream commit fa0be0a43f101888ac677dba31b590963eafeaa1 ]
+
+Currently, TX is given a budget which is consumed by stmmac_tx_clean()
+and stmmac_rx() is given the remaining non-consumed budget.
+
+This is wrong and in case we are sending a large number of packets this
+can starve RX because remaining budget will be low.
+
+Let's give always the same budget for RX and TX clean.
+
+While at it, check if we missed any interrupts while we were in NAPI
+callback by looking at DMA interrupt status.
+
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 27 ++++++++++---------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index fe9240e15aeac..5d83d6a7694b0 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3525,27 +3525,28 @@ static int stmmac_napi_poll(struct napi_struct *napi, int budget)
+ struct stmmac_channel *ch =
+ container_of(napi, struct stmmac_channel, napi);
+ struct stmmac_priv *priv = ch->priv_data;
+- int work_done = 0, work_rem = budget;
++ int work_done, rx_done = 0, tx_done = 0;
+ u32 chan = ch->index;
+
+ priv->xstats.napi_poll++;
+
+- if (ch->has_tx) {
+- int done = stmmac_tx_clean(priv, work_rem, chan);
++ if (ch->has_tx)
++ tx_done = stmmac_tx_clean(priv, budget, chan);
++ if (ch->has_rx)
++ rx_done = stmmac_rx(priv, budget, chan);
+
+- work_done += done;
+- work_rem -= done;
+- }
+-
+- if (ch->has_rx) {
+- int done = stmmac_rx(priv, work_rem, chan);
++ work_done = max(rx_done, tx_done);
++ work_done = min(work_done, budget);
+
+- work_done += done;
+- work_rem -= done;
+- }
++ if (work_done < budget && napi_complete_done(napi, work_done)) {
++ int stat;
+
+- if (work_done < budget && napi_complete_done(napi, work_done))
+ stmmac_enable_dma_irq(priv, priv->ioaddr, chan);
++ stat = stmmac_dma_interrupt_status(priv, priv->ioaddr,
++ &priv->xstats, chan);
++ if (stat && napi_reschedule(napi))
++ stmmac_disable_dma_irq(priv, priv->ioaddr, chan);
++ }
+
+ return work_done;
+ }
+--
+2.19.1
+
--- /dev/null
+From aa22dc1cc5ec53fe8f0fbab9f30335b1d700bb75 Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Fri, 4 Jan 2019 17:56:16 +0900
+Subject: netfilter: nf_tables: fix leaking object reference count
+
+[ Upstream commit b91d9036883793122cf6575ca4dfbfbdd201a83d ]
+
+There is no code that decreases the reference count of stateful objects
+in error path of the nft_add_set_elem(). this causes a leak of reference
+count of stateful objects.
+
+Test commands:
+ $nft add table ip filter
+ $nft add counter ip filter c1
+ $nft add map ip filter m1 { type ipv4_addr : counter \;}
+ $nft add element ip filter m1 { 1 : c1 }
+ $nft add element ip filter m1 { 1 : c1 }
+ $nft delete element ip filter m1 { 1 }
+ $nft delete counter ip filter c1
+
+Result:
+ Error: Could not process rule: Device or resource busy
+ delete counter ip filter c1
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+At the second 'nft add element ip filter m1 { 1 : c1 }', the reference
+count of the 'c1' is increased then it tries to insert into the 'm1'. but
+the 'm1' already has same element so it returns -EEXIST.
+But it doesn't decrease the reference count of the 'c1' in the error path.
+Due to a leak of the reference count of the 'c1', the 'c1' can't be
+removed by 'nft delete counter ip filter c1'.
+
+Fixes: 8aeff920dcc9 ("netfilter: nf_tables: add stateful object reference to set elements")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 6e548d7c9f67b..aba6ec4a14cec 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4474,6 +4474,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ err5:
+ kfree(trans);
+ err4:
++ if (obj)
++ obj->use--;
+ kfree(elem.priv);
+ err3:
+ if (nla[NFTA_SET_ELEM_DATA] != NULL)
+--
+2.19.1
+
--- /dev/null
+From a1976baa3483db5ba76b0680813eeab8484d1eb0 Mon Sep 17 00:00:00 2001
+From: Henry Yen <henry.yen@mediatek.com>
+Date: Mon, 14 Jan 2019 17:59:43 +0800
+Subject: netfilter: nft_flow_offload: fix checking method of conntrack helper
+
+[ Upstream commit 2314e879747e82896f51cce4488f6a00f3e1af7b ]
+
+This patch uses nfct_help() to detect whether an established connection
+needs conntrack helper instead of using test_bit(IPS_HELPER_BIT,
+&ct->status).
+
+The reason is that IPS_HELPER_BIT is only set when using explicit CT
+target.
+
+However, in the case that a device enables conntrack helper via command
+"echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper", the status of
+IPS_HELPER_BIT will not present any change, and consequently it loses
+the checking ability in the context.
+
+Signed-off-by: Henry Yen <henry.yen@mediatek.com>
+Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
+Tested-by: John Crispin <john@phrozen.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_flow_offload.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 188c6bbf4e165..6e6b9adf7d387 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -12,6 +12,7 @@
+ #include <net/netfilter/nf_conntrack_core.h>
+ #include <linux/netfilter/nf_conntrack_common.h>
+ #include <net/netfilter/nf_flow_table.h>
++#include <net/netfilter/nf_conntrack_helper.h>
+
+ struct nft_flow_offload {
+ struct nft_flowtable *flowtable;
+@@ -66,6 +67,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ {
+ struct nft_flow_offload *priv = nft_expr_priv(expr);
+ struct nf_flowtable *flowtable = &priv->flowtable->data;
++ const struct nf_conn_help *help;
+ enum ip_conntrack_info ctinfo;
+ struct nf_flow_route route;
+ struct flow_offload *flow;
+@@ -88,7 +90,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ goto out;
+ }
+
+- if (test_bit(IPS_HELPER_BIT, &ct->status))
++ help = nfct_help(ct);
++ if (help)
+ goto out;
+
+ if (ctinfo == IP_CT_NEW ||
+--
+2.19.1
+
--- /dev/null
+From 48fa6b1b948a2bbb25ad47f6e66237df4f5bdfe5 Mon Sep 17 00:00:00 2001
+From: wenxu <wenxu@ucloud.cn>
+Date: Thu, 10 Jan 2019 14:51:35 +0800
+Subject: netfilter: nft_flow_offload: fix interaction with vrf slave device
+
+[ Upstream commit 10f4e765879e514e1ce7f52ed26603047af196e2 ]
+
+In the forward chain, the iif is changed from slave device to master vrf
+device. Thus, flow offload does not find a match on the lower slave
+device.
+
+This patch uses the cached route, ie. dst->dev, to update the iif and
+oif fields in the flow entry.
+
+After this patch, the following example works fine:
+
+ # ip addr add dev eth0 1.1.1.1/24
+ # ip addr add dev eth1 10.0.0.1/24
+ # ip link add user1 type vrf table 1
+ # ip l set user1 up
+ # ip l set dev eth0 master user1
+ # ip l set dev eth1 master user1
+
+ # nft add table firewall
+ # nft add flowtable f fb1 { hook ingress priority 0 \; devices = { eth0, eth1 } \; }
+ # nft add chain f ftb-all {type filter hook forward priority 0 \; policy accept \; }
+ # nft add rule f ftb-all ct zone 1 ip protocol tcp flow offload @fb1
+ # nft add rule f ftb-all ct zone 1 ip protocol udp flow offload @fb1
+
+Signed-off-by: wenxu <wenxu@ucloud.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_flow_table.h | 1 -
+ net/netfilter/nf_flow_table_core.c | 5 +++--
+ net/netfilter/nft_flow_offload.c | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
+index 77e2761d4f2f9..ff4eb9869e5ba 100644
+--- a/include/net/netfilter/nf_flow_table.h
++++ b/include/net/netfilter/nf_flow_table.h
+@@ -84,7 +84,6 @@ struct flow_offload {
+ struct nf_flow_route {
+ struct {
+ struct dst_entry *dst;
+- int ifindex;
+ } tuple[FLOW_OFFLOAD_DIR_MAX];
+ };
+
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index b7a4816add765..cc91b4d6aa22f 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -28,6 +28,7 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
+ {
+ struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple;
+ struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple;
++ struct dst_entry *other_dst = route->tuple[!dir].dst;
+ struct dst_entry *dst = route->tuple[dir].dst;
+
+ ft->dir = dir;
+@@ -50,8 +51,8 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
+ ft->src_port = ctt->src.u.tcp.port;
+ ft->dst_port = ctt->dst.u.tcp.port;
+
+- ft->iifidx = route->tuple[dir].ifindex;
+- ft->oifidx = route->tuple[!dir].ifindex;
++ ft->iifidx = other_dst->dev->ifindex;
++ ft->oifidx = dst->dev->ifindex;
+ ft->dst_cache = dst;
+ }
+
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index ccdb8f5ababbe..188c6bbf4e165 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -30,9 +30,11 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
+ switch (nft_pf(pkt)) {
+ case NFPROTO_IPV4:
+ fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip;
++ fl.u.ip4.flowi4_oif = nft_in(pkt)->ifindex;
+ break;
+ case NFPROTO_IPV6:
+ fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6;
++ fl.u.ip6.flowi6_oif = nft_in(pkt)->ifindex;
+ break;
+ }
+
+@@ -41,9 +43,7 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
+ return -ENOENT;
+
+ route->tuple[dir].dst = this_dst;
+- route->tuple[dir].ifindex = nft_in(pkt)->ifindex;
+ route->tuple[!dir].dst = other_dst;
+- route->tuple[!dir].ifindex = nft_out(pkt)->ifindex;
+
+ return 0;
+ }
+--
+2.19.1
+
--- /dev/null
+From 15997a96cd8755f68009109af7e8fdb569f0cda9 Mon Sep 17 00:00:00 2001
+From: wenxu <wenxu@ucloud.cn>
+Date: Wed, 9 Jan 2019 10:40:11 +0800
+Subject: netfilter: nft_flow_offload: Fix reverse route lookup
+
+[ Upstream commit a799aea0988ea0d1b1f263e996fdad2f6133c680 ]
+
+Using the following example:
+
+ client 1.1.1.7 ---> 2.2.2.7 which dnat to 10.0.0.7 server
+
+The first reply packet (ie. syn+ack) uses an incorrect destination
+address for the reverse route lookup since it uses:
+
+ daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
+
+which is 2.2.2.7 in the scenario that is described above, while this
+should be:
+
+ daddr = ct->tuplehash[dir].tuple.src.u3.ip;
+
+that is 10.0.0.7.
+
+Signed-off-by: wenxu <wenxu@ucloud.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_flow_offload.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 974525eb92df7..ccdb8f5ababbe 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -29,10 +29,10 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
+ memset(&fl, 0, sizeof(fl));
+ switch (nft_pf(pkt)) {
+ case NFPROTO_IPV4:
+- fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
++ fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip;
+ break;
+ case NFPROTO_IPV6:
+- fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6;
++ fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6;
+ break;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 0951a9d5f002becb9bb77200a09ef537aefda011 Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Wed, 9 Jan 2019 20:30:07 +0000
+Subject: powerpc/8xx: fix setting of pagetable for Abatron BDI debug tool.
+
+[ Upstream commit fb0bdec51a4901b7dd088de0a1e365e1b9f5cd21 ]
+
+Commit 8c8c10b90d88 ("powerpc/8xx: fix handling of early NULL pointer
+dereference") moved the loading of r6 earlier in the code. As some
+functions are called inbetween, r6 needs to be loaded again with the
+address of swapper_pg_dir in order to set PTE pointers for
+the Abatron BDI.
+
+Fixes: 8c8c10b90d88 ("powerpc/8xx: fix handling of early NULL pointer dereference")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_8xx.S | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index 3b67b9533c82f..438512759e827 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -927,11 +927,12 @@ start_here:
+
+ /* set up the PTE pointers for the Abatron bdiGDB.
+ */
+- tovirt(r6,r6)
+ lis r5, abatron_pteptrs@h
+ ori r5, r5, abatron_pteptrs@l
+ stw r5, 0xf0(0) /* Must match your Abatron config file */
+ tophys(r5,r5)
++ lis r6, swapper_pg_dir@h
++ ori r6, r6, swapper_pg_dir@l
+ stw r6, 0(r5)
+
+ /* Now turn on the MMU for real! */
+--
+2.19.1
+
--- /dev/null
+From fb6f98e21107987caf061113a556e386b8e04328 Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <sstabellini@kernel.org>
+Date: Fri, 21 Dec 2018 15:06:33 -0800
+Subject: pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read
+
+[ Upstream commit e6587cdbd732eacb4c7ce592ed46f7bbcefb655f ]
+
+When a connection is closing we receive on pvcalls_sk_state_change
+notification. Instead of setting the connection as closed immediately
+(-ENOTCONN), let's read one more time from it: pvcalls_conn_back_read
+will set the connection as closed when necessary.
+
+That way, we avoid races between pvcalls_sk_state_change and
+pvcalls_back_ioworker.
+
+Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-back.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index 2e5d845b50914..71b628774c6fb 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -160,9 +160,10 @@ static void pvcalls_conn_back_read(void *opaque)
+
+ /* write the data, then modify the indexes */
+ virt_wmb();
+- if (ret < 0)
++ if (ret < 0) {
++ atomic_set(&map->read, 0);
+ intf->in_error = ret;
+- else
++ } else
+ intf->in_prod = prod + ret;
+ /* update the indexes, then notify the other end */
+ virt_wmb();
+@@ -288,7 +289,7 @@ static void pvcalls_sk_state_change(struct sock *sock)
+ return;
+
+ intf = map->ring;
+- intf->in_error = -ENOTCONN;
++ atomic_inc(&map->read);
+ notify_remote_via_irq(map->irq);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 48d0c7384cc48bcd72559a278cf77f2a1428a335 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Wed, 5 Dec 2018 10:35:50 +0800
+Subject: pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock
+
+[ Upstream commit 9f51c05dc41a6d69423e3d03d18eb7ab22f9ec19 ]
+
+The problem is that we call this with a spin lock held.
+The call tree is:
+pvcalls_front_accept() holds bedata->socket_lock.
+ -> create_active()
+ -> __get_free_pages() uses GFP_KERNEL
+
+The create_active() function is only called from pvcalls_front_accept()
+with a spin_lock held, The allocation is not allowed to sleep and
+GFP_KERNEL is not sufficient.
+
+This issue was detected by using the Coccinelle software.
+
+v2: Add a function doing the allocations which is called
+ outside the lock and passing the allocated data to
+ create_active().
+
+v3: Use the matching deallocators i.e., free_page()
+ and free_pages(), respectively.
+
+v4: It would be better to pre-populate map (struct sock_mapping),
+ rather than introducing one more new struct.
+
+v5: Since allocating the data outside of this call it should also
+ be freed outside, when create_active() fails.
+ Move kzalloc(sizeof(*map2), GFP_ATOMIC) outside spinlock and
+ use GFP_KERNEL instead.
+
+v6: Drop the superfluous calls.
+
+Suggested-by: Juergen Gross <jgross@suse.com>
+Suggested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Suggested-by: Stefano Stabellini <sstabellini@kernel.org>
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Acked-by: Stefano Stabellini <sstabellini@kernel.org>
+CC: Julia Lawall <julia.lawall@lip6.fr>
+CC: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+CC: Juergen Gross <jgross@suse.com>
+CC: Stefano Stabellini <sstabellini@kernel.org>
+CC: xen-devel@lists.xenproject.org
+CC: linux-kernel@vger.kernel.org
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-front.c | 81 +++++++++++++++++++++++++++----------
+ 1 file changed, 59 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index 01588582ae663..6357160d466ab 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -341,6 +341,39 @@ int pvcalls_front_socket(struct socket *sock)
+ return ret;
+ }
+
++static void free_active_ring(struct sock_mapping *map)
++{
++ free_pages((unsigned long)map->active.data.in,
++ map->active.ring->ring_order);
++ free_page((unsigned long)map->active.ring);
++}
++
++static int alloc_active_ring(struct sock_mapping *map)
++{
++ void *bytes;
++
++ map->active.ring = (struct pvcalls_data_intf *)
++ get_zeroed_page(GFP_KERNEL);
++ if (!map->active.ring)
++ goto out;
++
++ map->active.ring->ring_order = PVCALLS_RING_ORDER;
++ bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
++ PVCALLS_RING_ORDER);
++ if (!bytes)
++ goto out;
++
++ map->active.data.in = bytes;
++ map->active.data.out = bytes +
++ XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
++
++ return 0;
++
++out:
++ free_active_ring(map);
++ return -ENOMEM;
++}
++
+ static int create_active(struct sock_mapping *map, int *evtchn)
+ {
+ void *bytes;
+@@ -349,15 +382,7 @@ static int create_active(struct sock_mapping *map, int *evtchn)
+ *evtchn = -1;
+ init_waitqueue_head(&map->active.inflight_conn_req);
+
+- map->active.ring = (struct pvcalls_data_intf *)
+- __get_free_page(GFP_KERNEL | __GFP_ZERO);
+- if (map->active.ring == NULL)
+- goto out_error;
+- map->active.ring->ring_order = PVCALLS_RING_ORDER;
+- bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+- PVCALLS_RING_ORDER);
+- if (bytes == NULL)
+- goto out_error;
++ bytes = map->active.data.in;
+ for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++)
+ map->active.ring->ref[i] = gnttab_grant_foreign_access(
+ pvcalls_front_dev->otherend_id,
+@@ -367,10 +392,6 @@ static int create_active(struct sock_mapping *map, int *evtchn)
+ pvcalls_front_dev->otherend_id,
+ pfn_to_gfn(virt_to_pfn((void *)map->active.ring)), 0);
+
+- map->active.data.in = bytes;
+- map->active.data.out = bytes +
+- XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
+-
+ ret = xenbus_alloc_evtchn(pvcalls_front_dev, evtchn);
+ if (ret)
+ goto out_error;
+@@ -391,8 +412,6 @@ static int create_active(struct sock_mapping *map, int *evtchn)
+ out_error:
+ if (*evtchn >= 0)
+ xenbus_free_evtchn(pvcalls_front_dev, *evtchn);
+- free_pages((unsigned long)map->active.data.in, PVCALLS_RING_ORDER);
+- free_page((unsigned long)map->active.ring);
+ return ret;
+ }
+
+@@ -412,17 +431,24 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
+ return PTR_ERR(map);
+
+ bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
++ ret = alloc_active_ring(map);
++ if (ret < 0) {
++ pvcalls_exit_sock(sock);
++ return ret;
++ }
+
+ spin_lock(&bedata->socket_lock);
+ ret = get_request(bedata, &req_id);
+ if (ret < 0) {
+ spin_unlock(&bedata->socket_lock);
++ free_active_ring(map);
+ pvcalls_exit_sock(sock);
+ return ret;
+ }
+ ret = create_active(map, &evtchn);
+ if (ret < 0) {
+ spin_unlock(&bedata->socket_lock);
++ free_active_ring(map);
+ pvcalls_exit_sock(sock);
+ return ret;
+ }
+@@ -784,25 +810,36 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
+ }
+ }
+
+- spin_lock(&bedata->socket_lock);
+- ret = get_request(bedata, &req_id);
+- if (ret < 0) {
++ map2 = kzalloc(sizeof(*map2), GFP_KERNEL);
++ if (map2 == NULL) {
+ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
+ (void *)&map->passive.flags);
+- spin_unlock(&bedata->socket_lock);
++ pvcalls_exit_sock(sock);
++ return -ENOMEM;
++ }
++ ret = alloc_active_ring(map2);
++ if (ret < 0) {
++ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
++ (void *)&map->passive.flags);
++ kfree(map2);
+ pvcalls_exit_sock(sock);
+ return ret;
+ }
+- map2 = kzalloc(sizeof(*map2), GFP_ATOMIC);
+- if (map2 == NULL) {
++ spin_lock(&bedata->socket_lock);
++ ret = get_request(bedata, &req_id);
++ if (ret < 0) {
+ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
+ (void *)&map->passive.flags);
+ spin_unlock(&bedata->socket_lock);
++ free_active_ring(map2);
++ kfree(map2);
+ pvcalls_exit_sock(sock);
+- return -ENOMEM;
++ return ret;
+ }
++
+ ret = create_active(map2, &evtchn);
+ if (ret < 0) {
++ free_active_ring(map2);
+ kfree(map2);
+ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
+ (void *)&map->passive.flags);
+--
+2.19.1
+
--- /dev/null
+From ed77313171a96687e8153933f64d4d3f22b344f8 Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <sstabellini@kernel.org>
+Date: Fri, 21 Dec 2018 15:06:30 -0800
+Subject: pvcalls-front: don't try to free unallocated rings
+
+[ Upstream commit 96283f9a084e23d7cda2d3c5d1ffa6df6cf1ecec ]
+
+inflight_req_id is 0 when initialized. If inflight_req_id is 0, there is
+no accept_map to free. Fix the check in pvcalls_front_release.
+
+Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-front.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index e5d95aab2cb80..4f3d664b3f39e 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -1030,8 +1030,8 @@ int pvcalls_front_release(struct socket *sock)
+ spin_lock(&bedata->socket_lock);
+ list_del(&map->list);
+ spin_unlock(&bedata->socket_lock);
+- if (READ_ONCE(map->passive.inflight_req_id) !=
+- PVCALLS_INVALID_ID) {
++ if (READ_ONCE(map->passive.inflight_req_id) != PVCALLS_INVALID_ID &&
++ READ_ONCE(map->passive.inflight_req_id) != 0) {
+ pvcalls_front_free_map(bedata,
+ map->passive.accept_map);
+ }
+--
+2.19.1
+
--- /dev/null
+From b8bcd7c588e196687cef324c09caf6f6fb428b4a Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Tue, 15 Jan 2019 10:31:27 +0800
+Subject: pvcalls-front: fix potential null dereference
+
+[ Upstream commit b4711098066f1cf808d4dc11a1a842860a3292fe ]
+
+ static checker warning:
+ drivers/xen/pvcalls-front.c:373 alloc_active_ring()
+ error: we previously assumed 'map->active.ring' could be null
+ (see line 357)
+
+drivers/xen/pvcalls-front.c
+ 351 static int alloc_active_ring(struct sock_mapping *map)
+ 352 {
+ 353 void *bytes;
+ 354
+ 355 map->active.ring = (struct pvcalls_data_intf *)
+ 356 get_zeroed_page(GFP_KERNEL);
+ 357 if (!map->active.ring)
+ ^^^^^^^^^^^^^^^^^
+Check
+
+ 358 goto out;
+ 359
+ 360 map->active.ring->ring_order = PVCALLS_RING_ORDER;
+ 361 bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+ 362 PVCALLS_RING_ORDER);
+ 363 if (!bytes)
+ 364 goto out;
+ 365
+ 366 map->active.data.in = bytes;
+ 367 map->active.data.out = bytes +
+ 368 XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
+ 369
+ 370 return 0;
+ 371
+ 372 out:
+--> 373 free_active_ring(map);
+ ^^^
+Add null check on map->active.ring before dereferencing it to avoid
+any NULL pointer dereferences.
+
+Fixes: 9f51c05dc41a ("pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Suggested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+CC: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+CC: Juergen Gross <jgross@suse.com>
+CC: Stefano Stabellini <sstabellini@kernel.org>
+CC: Dan Carpenter <dan.carpenter@oracle.com>
+CC: xen-devel@lists.xenproject.org
+CC: linux-kernel@vger.kernel.org
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-front.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index 6357160d466ab..91da7e44d5d4f 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -343,6 +343,9 @@ int pvcalls_front_socket(struct socket *sock)
+
+ static void free_active_ring(struct sock_mapping *map)
+ {
++ if (!map->active.ring)
++ return;
++
+ free_pages((unsigned long)map->active.data.in,
+ map->active.ring->ring_order);
+ free_page((unsigned long)map->active.ring);
+--
+2.19.1
+
--- /dev/null
+From 6102b6bef100c6967ed3605a5d6ac7f00b87478d Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <sstabellini@kernel.org>
+Date: Fri, 21 Dec 2018 15:06:31 -0800
+Subject: pvcalls-front: properly allocate sk
+
+[ Upstream commit beee1fbe8f7d57d6ebaa5188f9f4db89c2077196 ]
+
+Don't use kzalloc: it ends up leaving sk->sk_prot not properly
+initialized. Use sk_alloc instead and define our own trivial struct
+proto.
+
+Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-front.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index 4f3d664b3f39e..01588582ae663 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -31,6 +31,12 @@
+ #define PVCALLS_NR_RSP_PER_RING __CONST_RING_SIZE(xen_pvcalls, XEN_PAGE_SIZE)
+ #define PVCALLS_FRONT_MAX_SPIN 5000
+
++static struct proto pvcalls_proto = {
++ .name = "PVCalls",
++ .owner = THIS_MODULE,
++ .obj_size = sizeof(struct sock),
++};
++
+ struct pvcalls_bedata {
+ struct xen_pvcalls_front_ring ring;
+ grant_ref_t ref;
+@@ -837,7 +843,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
+
+ received:
+ map2->sock = newsock;
+- newsock->sk = kzalloc(sizeof(*newsock->sk), GFP_KERNEL);
++ newsock->sk = sk_alloc(sock_net(sock->sk), PF_INET, GFP_KERNEL, &pvcalls_proto, false);
+ if (!newsock->sk) {
+ bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
+ map->passive.inflight_req_id = PVCALLS_INVALID_ID;
+--
+2.19.1
+
--- /dev/null
+From b74895ca8d6ecd29dfa346e5b33b8d9ca811d970 Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <sstabellini@kernel.org>
+Date: Fri, 21 Dec 2018 15:06:29 -0800
+Subject: pvcalls-front: read all data before closing the connection
+
+[ Upstream commit b79470b64fa9266948d1ce8d825ced94c4f63293 ]
+
+When a connection is closing in_error is set to ENOTCONN. There could
+still be outstanding data on the ring left by the backend. Before
+closing the connection on the frontend side, drain the ring.
+
+Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-front.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index 77224d8f3e6fe..e5d95aab2cb80 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -560,15 +560,13 @@ static int __read_ring(struct pvcalls_data_intf *intf,
+ error = intf->in_error;
+ /* get pointers before reading from the ring */
+ virt_rmb();
+- if (error < 0)
+- return error;
+
+ size = pvcalls_queued(prod, cons, array_size);
+ masked_prod = pvcalls_mask(prod, array_size);
+ masked_cons = pvcalls_mask(cons, array_size);
+
+ if (size == 0)
+- return 0;
++ return error ?: size;
+
+ if (len > size)
+ len = size;
+--
+2.19.1
+
--- /dev/null
+From 1dfa314c21919afa833eac62e7f96b4cfe1ddd01 Mon Sep 17 00:00:00 2001
+From: Denis Bolotin <dbolotin@marvell.com>
+Date: Thu, 3 Jan 2019 12:02:39 +0200
+Subject: qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page
+ count
+
+[ Upstream commit 2d533a9287f2011632977e87ce2783f4c689c984 ]
+
+In PBL chains with non power of 2 page count, the producer is not at the
+beginning of the chain when index is 0 after a wrap. Therefore, after the
+producer index wrap around, page index should be calculated more carefully.
+
+Signed-off-by: Denis Bolotin <dbolotin@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/qed/qed_chain.h | 31 +++++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h
+index 59ddf9af909e4..2dd0a9ed5b361 100644
+--- a/include/linux/qed/qed_chain.h
++++ b/include/linux/qed/qed_chain.h
+@@ -663,6 +663,37 @@ static inline void *qed_chain_get_last_elem(struct qed_chain *p_chain)
+ static inline void qed_chain_set_prod(struct qed_chain *p_chain,
+ u32 prod_idx, void *p_prod_elem)
+ {
++ if (p_chain->mode == QED_CHAIN_MODE_PBL) {
++ u32 cur_prod, page_mask, page_cnt, page_diff;
++
++ cur_prod = is_chain_u16(p_chain) ? p_chain->u.chain16.prod_idx :
++ p_chain->u.chain32.prod_idx;
++
++ /* Assume that number of elements in a page is power of 2 */
++ page_mask = ~p_chain->elem_per_page_mask;
++
++ /* Use "cur_prod - 1" and "prod_idx - 1" since producer index
++ * reaches the first element of next page before the page index
++ * is incremented. See qed_chain_produce().
++ * Index wrap around is not a problem because the difference
++ * between current and given producer indices is always
++ * positive and lower than the chain's capacity.
++ */
++ page_diff = (((cur_prod - 1) & page_mask) -
++ ((prod_idx - 1) & page_mask)) /
++ p_chain->elem_per_page;
++
++ page_cnt = qed_chain_get_page_cnt(p_chain);
++ if (is_chain_u16(p_chain))
++ p_chain->pbl.c.u16.prod_page_idx =
++ (p_chain->pbl.c.u16.prod_page_idx -
++ page_diff + page_cnt) % page_cnt;
++ else
++ p_chain->pbl.c.u32.prod_page_idx =
++ (p_chain->pbl.c.u32.prod_page_idx -
++ page_diff + page_cnt) % page_cnt;
++ }
++
+ if (is_chain_u16(p_chain))
+ p_chain->u.chain16.prod_idx = (u16) prod_idx;
+ else
+--
+2.19.1
+
--- /dev/null
+From 44376fea49708618160c71ed305f6eff7863b80a Mon Sep 17 00:00:00 2001
+From: Denis Bolotin <dbolotin@marvell.com>
+Date: Thu, 3 Jan 2019 12:02:40 +0200
+Subject: qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory
+ barrier
+
+[ Upstream commit 46721c3d9e273aea880e9ff835b0e1271e1cd2fb ]
+
+Make sure chain element is updated before ringing the doorbell.
+
+Signed-off-by: Denis Bolotin <dbolotin@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_ll2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+index c6f4bab67a5fc..9e728ec82c218 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -1603,6 +1603,10 @@ static void qed_ll2_post_rx_buffer_notify_fw(struct qed_hwfn *p_hwfn,
+ cq_prod = qed_chain_get_prod_idx(&p_rx->rcq_chain);
+ rx_prod.bd_prod = cpu_to_le16(bd_prod);
+ rx_prod.cqe_prod = cpu_to_le16(cq_prod);
++
++ /* Make sure chain element is updated before ringing the doorbell */
++ dma_wmb();
++
+ DIRECT_REG_WR(p_rx->set_prod_addr, *((u32 *)&rx_prod));
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 1be81231a0f039f7120b09e2f7061c34abbd1d79 Mon Sep 17 00:00:00 2001
+From: Leon Romanovsky <leonro@mellanox.com>
+Date: Thu, 10 Jan 2019 08:15:45 +0200
+Subject: RDMA/mthca: Clear QP objects during their allocation
+
+[ Upstream commit 9d9f59b4204bc41896c866b3e5856e5b416aa199 ]
+
+As part of audit process to update drivers to use rdma_restrack_add()
+ensure that QP objects is cleared before access. Such change fixes the
+crash observed with uninitialized non zero sgid attr accessed by
+ib_destroy_qp().
+
+CPU: 3 PID: 74 Comm: kworker/u16:1 Not tainted 4.19.10-300.fc29.x86_64
+Workqueue: ipoib_wq ipoib_cm_tx_reap [ib_ipoib]
+RIP: 0010:rdma_put_gid_attr+0x9/0x30 [ib_core]
+RSP: 0018:ffffb7ad819dbde8 EFLAGS: 00010202
+RAX: 0000000000000000 RBX: ffff8d1bdf5a2e00 RCX: 0000000000002699
+RDX: 206c656e72656af8 RSI: ffff8d1bf7ae6160 RDI: 206c656e72656b20
+RBP: 0000000000000000 R08: 0000000000026160 R09: ffffffffc06b45bf
+R10: ffffe849887da000 R11: 0000000000000002 R12: ffff8d1be30cb400
+R13: ffff8d1bdf681800 R14: ffff8d1be2272400 R15: ffff8d1be30ca000
+FS: 0000000000000000(0000) GS:ffff8d1bf7ac0000(0000)
+knlGS:0000000000000000
+Trace:
+ ib_destroy_qp+0xc9/0x240 [ib_core]
+ ipoib_cm_tx_reap+0x1f9/0x4e0 [ib_ipoib]
+ process_one_work+0x1a1/0x3a0
+ worker_thread+0x30/0x380
+ ? pwq_unbound_release_workfn+0xd0/0xd0
+ kthread+0x112/0x130
+ ? kthread_create_worker_on_cpu+0x70/0x70
+ ret_from_fork+0x22/0x40
+
+Reported-by: Alexander Murashkin <AlexanderMurashkin@msn.com>
+Tested-by: Alexander Murashkin <AlexanderMurashkin@msn.com>
+Fixes: 1a1f460ff151 ("RDMA: Hold the sgid_attr inside the struct ib_ah/qp")
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mthca/mthca_provider.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
+index 691c6f0489386..2428c7d89c6be 100644
+--- a/drivers/infiniband/hw/mthca/mthca_provider.c
++++ b/drivers/infiniband/hw/mthca/mthca_provider.c
+@@ -533,7 +533,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
+ {
+ struct mthca_ucontext *context;
+
+- qp = kmalloc(sizeof *qp, GFP_KERNEL);
++ qp = kzalloc(sizeof(*qp), GFP_KERNEL);
+ if (!qp)
+ return ERR_PTR(-ENOMEM);
+
+@@ -599,7 +599,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
+ if (pd->uobject)
+ return ERR_PTR(-EINVAL);
+
+- qp = kmalloc(sizeof (struct mthca_sqp), GFP_KERNEL);
++ qp = kzalloc(sizeof(struct mthca_sqp), GFP_KERNEL);
+ if (!qp)
+ return ERR_PTR(-ENOMEM);
+
+--
+2.19.1
+
--- /dev/null
+From 8f25a97740644dc4180229480b5c62775ae6b65f Mon Sep 17 00:00:00 2001
+From: Yonghong Song <yhs@fb.com>
+Date: Sat, 12 Jan 2019 15:04:30 -0800
+Subject: samples/bpf: workaround clang asm goto compilation errors
+
+[ Upstream commit 6bf3bbe1f4d4cf405e3c2bf07bbdff56d3223ec8 ]
+
+x86 compilation has required asm goto support since 4.17.
+Since clang does not support asm goto, at 4.17,
+Commit b1ae32dbab50 ("x86/cpufeature: Guard asm_volatile_goto usage
+for BPF compilation") worked around the issue by permitting an
+alternative implementation without asm goto for clang.
+
+At 5.0, more asm goto usages appeared.
+ [yhs@148 x86]$ egrep -r asm_volatile_goto
+ include/asm/cpufeature.h: asm_volatile_goto("1: jmp 6f\n"
+ include/asm/jump_label.h: asm_volatile_goto("1:"
+ include/asm/jump_label.h: asm_volatile_goto("1:"
+ include/asm/rmwcc.h: asm_volatile_goto (fullop "; j" #cc " %l[cc_label]" \
+ include/asm/uaccess.h: asm_volatile_goto("\n" \
+ include/asm/uaccess.h: asm_volatile_goto("\n" \
+ [yhs@148 x86]$
+
+Compiling samples/bpf directories, most bpf programs failed
+compilation with error messages like:
+ In file included from /home/yhs/work/bpf-next/samples/bpf/xdp_sample_pkts_kern.c:2:
+ In file included from /home/yhs/work/bpf-next/include/linux/ptrace.h:6:
+ In file included from /home/yhs/work/bpf-next/include/linux/sched.h:15:
+ In file included from /home/yhs/work/bpf-next/include/linux/sem.h:5:
+ In file included from /home/yhs/work/bpf-next/include/uapi/linux/sem.h:5:
+ In file included from /home/yhs/work/bpf-next/include/linux/ipc.h:9:
+ In file included from /home/yhs/work/bpf-next/include/linux/refcount.h:72:
+ /home/yhs/work/bpf-next/arch/x86/include/asm/refcount.h:70:9: error: 'asm goto' constructs are not supported yet
+ return GEN_BINARY_SUFFIXED_RMWcc(LOCK_PREFIX "subl",
+ ^
+ /home/yhs/work/bpf-next/arch/x86/include/asm/rmwcc.h:67:2: note: expanded from macro 'GEN_BINARY_SUFFIXED_RMWcc'
+ __GEN_RMWcc(op " %[val], %[var]\n\t" suffix, var, cc, \
+ ^
+ /home/yhs/work/bpf-next/arch/x86/include/asm/rmwcc.h:21:2: note: expanded from macro '__GEN_RMWcc'
+ asm_volatile_goto (fullop "; j" #cc " %l[cc_label]" \
+ ^
+ /home/yhs/work/bpf-next/include/linux/compiler_types.h:188:37: note: expanded from macro 'asm_volatile_goto'
+ #define asm_volatile_goto(x...) asm goto(x)
+
+Most implementation does not even provide an alternative
+implementation. And it is also not practical to make changes
+for each call site.
+
+This patch workarounded the asm goto issue by redefining the macro like below:
+ #define asm_volatile_goto(x...) asm volatile("invalid use of asm_volatile_goto")
+
+If asm_volatile_goto is not used by bpf programs, which is typically the case, nothing bad
+will happen. If asm_volatile_goto is used by bpf programs, which is incorrect, the compiler
+will issue an error since "invalid use of asm_volatile_goto" is not valid assembly codes.
+
+With this patch, all bpf programs under samples/bpf can pass compilation.
+
+Note that bpf programs under tools/testing/selftests/bpf/ compiled fine as
+they do not access kernel internal headers.
+
+Fixes: e769742d3584 ("Revert "x86/jump-labels: Macrofy inline assembly code to work around GCC inlining bugs"")
+Fixes: 18fe58229d80 ("x86, asm: change the GEN_*_RMWcc() macros to not quote the condition")
+Acked-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/Makefile | 1 +
+ samples/bpf/asm_goto_workaround.h | 16 ++++++++++++++++
+ 2 files changed, 17 insertions(+)
+ create mode 100644 samples/bpf/asm_goto_workaround.h
+
+diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
+index be0a961450bc2..f5ce993c78e42 100644
+--- a/samples/bpf/Makefile
++++ b/samples/bpf/Makefile
+@@ -273,6 +273,7 @@ $(obj)/%.o: $(src)/%.c
+ -Wno-gnu-variable-sized-type-not-at-end \
+ -Wno-address-of-packed-member -Wno-tautological-compare \
+ -Wno-unknown-warning-option $(CLANG_ARCH_ARGS) \
++ -I$(srctree)/samples/bpf/ -include asm_goto_workaround.h \
+ -O2 -emit-llvm -c $< -o -| $(LLC) -march=bpf $(LLC_FLAGS) -filetype=obj -o $@
+ ifeq ($(DWARF2BTF),y)
+ $(BTF_PAHOLE) -J $@
+diff --git a/samples/bpf/asm_goto_workaround.h b/samples/bpf/asm_goto_workaround.h
+new file mode 100644
+index 0000000000000..5cd7c1d1a5d56
+--- /dev/null
++++ b/samples/bpf/asm_goto_workaround.h
+@@ -0,0 +1,16 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright (c) 2019 Facebook */
++#ifndef __ASM_GOTO_WORKAROUND_H
++#define __ASM_GOTO_WORKAROUND_H
++
++/* this will bring in asm_volatile_goto macro definition
++ * if enabled by compiler and config options.
++ */
++#include <linux/types.h>
++
++#ifdef asm_volatile_goto
++#undef asm_volatile_goto
++#define asm_volatile_goto(x...) asm volatile("invalid use of asm_volatile_goto")
++#endif
++
++#endif
+--
+2.19.1
+
--- /dev/null
+From 4e971cc39f79846f902228beebb9637f430db70d Mon Sep 17 00:00:00 2001
+From: Varun Prakash <varun@chelsio.com>
+Date: Thu, 10 Jan 2019 23:29:28 +0530
+Subject: scsi: cxgb4i: add wait_for_completion()
+
+[ Upstream commit 9e8f1c79831424d30c0e3df068be7f4a244157c9 ]
+
+In case of ->set_param() and ->bind_conn() cxgb4i driver does not wait for
+cmd completion, this can create race conditions, to avoid this add
+wait_for_completion().
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 9 ++++-----
+ drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 28 ++++++++++++++++++++--------
+ drivers/scsi/cxgbi/libcxgbi.c | 7 ++++---
+ drivers/scsi/cxgbi/libcxgbi.h | 5 +++--
+ 4 files changed, 31 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+index bf07735275a49..0fc382cb977bf 100644
+--- a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
++++ b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+@@ -1144,7 +1144,7 @@ static void ddp_clear_map(struct cxgbi_device *cdev, struct cxgbi_ppm *ppm,
+ }
+
+ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
+- unsigned int tid, int pg_idx, bool reply)
++ unsigned int tid, int pg_idx)
+ {
+ struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0,
+ GFP_KERNEL);
+@@ -1160,7 +1160,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
+ req = (struct cpl_set_tcb_field *)skb->head;
+ req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+ OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
+- req->reply = V_NO_REPLY(reply ? 0 : 1);
++ req->reply = V_NO_REPLY(1);
+ req->cpu_idx = 0;
+ req->word = htons(31);
+ req->mask = cpu_to_be64(0xF0000000);
+@@ -1177,11 +1177,10 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
+ * @tid: connection id
+ * @hcrc: header digest enabled
+ * @dcrc: data digest enabled
+- * @reply: request reply from h/w
+ * set up the iscsi digest settings for a connection identified by tid
+ */
+ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+- int hcrc, int dcrc, int reply)
++ int hcrc, int dcrc)
+ {
+ struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0,
+ GFP_KERNEL);
+@@ -1197,7 +1196,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+ req = (struct cpl_set_tcb_field *)skb->head;
+ req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+ OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
+- req->reply = V_NO_REPLY(reply ? 0 : 1);
++ req->reply = V_NO_REPLY(1);
+ req->cpu_idx = 0;
+ req->word = htons(31);
+ req->mask = cpu_to_be64(0x0F000000);
+diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+index 064ef57351828..bd6cc014cab04 100644
+--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
++++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+@@ -1548,16 +1548,22 @@ static void do_set_tcb_rpl(struct cxgbi_device *cdev, struct sk_buff *skb)
+ struct cxgbi_sock *csk;
+
+ csk = lookup_tid(t, tid);
+- if (!csk)
++ if (!csk) {
+ pr_err("can't find conn. for tid %u.\n", tid);
++ return;
++ }
+
+ log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
+ "csk 0x%p,%u,%lx,%u, status 0x%x.\n",
+ csk, csk->state, csk->flags, csk->tid, rpl->status);
+
+- if (rpl->status != CPL_ERR_NONE)
++ if (rpl->status != CPL_ERR_NONE) {
+ pr_err("csk 0x%p,%u, SET_TCB_RPL status %u.\n",
+ csk, tid, rpl->status);
++ csk->err = -EINVAL;
++ }
++
++ complete(&csk->cmpl);
+
+ __kfree_skb(skb);
+ }
+@@ -1984,7 +1990,7 @@ static int ddp_set_map(struct cxgbi_ppm *ppm, struct cxgbi_sock *csk,
+ }
+
+ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
+- int pg_idx, bool reply)
++ int pg_idx)
+ {
+ struct sk_buff *skb;
+ struct cpl_set_tcb_field *req;
+@@ -2000,7 +2006,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
+ req = (struct cpl_set_tcb_field *)skb->head;
+ INIT_TP_WR(req, csk->tid);
+ OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, csk->tid));
+- req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid));
++ req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid));
+ req->word_cookie = htons(0);
+ req->mask = cpu_to_be64(0x3 << 8);
+ req->val = cpu_to_be64(pg_idx << 8);
+@@ -2009,12 +2015,15 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
+ log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
+ "csk 0x%p, tid 0x%x, pg_idx %u.\n", csk, csk->tid, pg_idx);
+
++ reinit_completion(&csk->cmpl);
+ cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb);
+- return 0;
++ wait_for_completion(&csk->cmpl);
++
++ return csk->err;
+ }
+
+ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+- int hcrc, int dcrc, int reply)
++ int hcrc, int dcrc)
+ {
+ struct sk_buff *skb;
+ struct cpl_set_tcb_field *req;
+@@ -2032,7 +2041,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+ req = (struct cpl_set_tcb_field *)skb->head;
+ INIT_TP_WR(req, tid);
+ OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
+- req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid));
++ req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid));
+ req->word_cookie = htons(0);
+ req->mask = cpu_to_be64(0x3 << 4);
+ req->val = cpu_to_be64(((hcrc ? ULP_CRC_HEADER : 0) |
+@@ -2042,8 +2051,11 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+ log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
+ "csk 0x%p, tid 0x%x, crc %d,%d.\n", csk, csk->tid, hcrc, dcrc);
+
++ reinit_completion(&csk->cmpl);
+ cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb);
+- return 0;
++ wait_for_completion(&csk->cmpl);
++
++ return csk->err;
+ }
+
+ static struct cxgbi_ppm *cdev2ppm(struct cxgbi_device *cdev)
+diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
+index 75f876409fb9d..245742557c036 100644
+--- a/drivers/scsi/cxgbi/libcxgbi.c
++++ b/drivers/scsi/cxgbi/libcxgbi.c
+@@ -573,6 +573,7 @@ static struct cxgbi_sock *cxgbi_sock_create(struct cxgbi_device *cdev)
+ skb_queue_head_init(&csk->receive_queue);
+ skb_queue_head_init(&csk->write_queue);
+ timer_setup(&csk->retry_timer, NULL, 0);
++ init_completion(&csk->cmpl);
+ rwlock_init(&csk->callback_lock);
+ csk->cdev = cdev;
+ csk->flags = 0;
+@@ -2251,14 +2252,14 @@ int cxgbi_set_conn_param(struct iscsi_cls_conn *cls_conn,
+ if (!err && conn->hdrdgst_en)
+ err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid,
+ conn->hdrdgst_en,
+- conn->datadgst_en, 0);
++ conn->datadgst_en);
+ break;
+ case ISCSI_PARAM_DATADGST_EN:
+ err = iscsi_set_param(cls_conn, param, buf, buflen);
+ if (!err && conn->datadgst_en)
+ err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid,
+ conn->hdrdgst_en,
+- conn->datadgst_en, 0);
++ conn->datadgst_en);
+ break;
+ case ISCSI_PARAM_MAX_R2T:
+ return iscsi_tcp_set_max_r2t(conn, buf);
+@@ -2384,7 +2385,7 @@ int cxgbi_bind_conn(struct iscsi_cls_session *cls_session,
+
+ ppm = csk->cdev->cdev2ppm(csk->cdev);
+ err = csk->cdev->csk_ddp_setup_pgidx(csk, csk->tid,
+- ppm->tformat.pgsz_idx_dflt, 0);
++ ppm->tformat.pgsz_idx_dflt);
+ if (err < 0)
+ return err;
+
+diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h
+index 5d5d8b50d8426..1917ff57651d7 100644
+--- a/drivers/scsi/cxgbi/libcxgbi.h
++++ b/drivers/scsi/cxgbi/libcxgbi.h
+@@ -149,6 +149,7 @@ struct cxgbi_sock {
+ struct sk_buff_head receive_queue;
+ struct sk_buff_head write_queue;
+ struct timer_list retry_timer;
++ struct completion cmpl;
+ int err;
+ rwlock_t callback_lock;
+ void *user_data;
+@@ -490,9 +491,9 @@ struct cxgbi_device {
+ struct cxgbi_ppm *,
+ struct cxgbi_task_tag_info *);
+ int (*csk_ddp_setup_digest)(struct cxgbi_sock *,
+- unsigned int, int, int, int);
++ unsigned int, int, int);
+ int (*csk_ddp_setup_pgidx)(struct cxgbi_sock *,
+- unsigned int, int, bool);
++ unsigned int, int);
+
+ void (*csk_release_offload_resources)(struct cxgbi_sock *);
+ int (*csk_rx_pdu_ready)(struct cxgbi_sock *, struct sk_buff *);
+--
+2.19.1
+
--- /dev/null
+From ca94bf98da48125a7cee1c133c12cce1e708f77c Mon Sep 17 00:00:00 2001
+From: Logan Gunthorpe <logang@deltatee.com>
+Date: Tue, 8 Jan 2019 13:50:43 -0700
+Subject: scsi: isci: initialize shost fully before calling scsi_add_host()
+
+[ Upstream commit cc29a1b0a3f2597ce887d339222fa85b9307706d ]
+
+scsi_mq_setup_tags(), which is called by scsi_add_host(), calculates the
+command size to allocate based on the prot_capabilities. In the isci
+driver, scsi_host_set_prot() is called after scsi_add_host() so the command
+size gets calculated to be smaller than it needs to be. Eventually,
+scsi_mq_init_request() locates the 'prot_sdb' after the command assuming it
+was sized correctly and a buffer overrun may occur.
+
+However, seeing blk_mq_alloc_rqs() rounds up to the nearest cache line
+size, the mistake can go unnoticed.
+
+The bug was noticed after the struct request size was reduced by commit
+9d037ad707ed ("block: remove req->timeout_list")
+
+Which likely reduced the allocated space for the request by an entire cache
+line, enough that the overflow could be hit and it caused a panic, on boot,
+at:
+
+ RIP: 0010:t10_pi_complete+0x77/0x1c0
+ Call Trace:
+ <IRQ>
+ sd_done+0xf5/0x340
+ scsi_finish_command+0xc3/0x120
+ blk_done_softirq+0x83/0xb0
+ __do_softirq+0xa1/0x2e6
+ irq_exit+0xbc/0xd0
+ call_function_single_interrupt+0xf/0x20
+ </IRQ>
+
+sd_done() would call scsi_prot_sg_count() which reads the number of
+entities in 'prot_sdb', but seeing 'prot_sdb' is located after the end of
+the allocated space it reads a garbage number and erroneously calls
+t10_pi_complete().
+
+To prevent this, the calls to scsi_host_set_prot() are moved into
+isci_host_alloc() before the call to scsi_add_host(). Out of caution, also
+move the similar call to scsi_host_set_guard().
+
+Fixes: 3d2d75254915 ("[SCSI] isci: T10 DIF support")
+Link: http://lkml.kernel.org/r/da851333-eadd-163a-8c78-e1f4ec5ec857@deltatee.com
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+Cc: Intel SCU Linux support <intel-linux-scu@intel.com>
+Cc: Artur Paszkiewicz <artur.paszkiewicz@intel.com>
+Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Jeff Moyer <jmoyer@redhat.com>
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+Reviewed-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/isci/init.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
+index 08c7b1e25fe48..dde84f7443136 100644
+--- a/drivers/scsi/isci/init.c
++++ b/drivers/scsi/isci/init.c
+@@ -588,6 +588,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id)
+ shost->max_lun = ~0;
+ shost->max_cmd_len = MAX_COMMAND_SIZE;
+
++ /* turn on DIF support */
++ scsi_host_set_prot(shost,
++ SHOST_DIF_TYPE1_PROTECTION |
++ SHOST_DIF_TYPE2_PROTECTION |
++ SHOST_DIF_TYPE3_PROTECTION);
++ scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC);
++
+ err = scsi_add_host(shost, &pdev->dev);
+ if (err)
+ goto err_shost;
+@@ -675,13 +682,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ goto err_host_alloc;
+ }
+ pci_info->hosts[i] = h;
+-
+- /* turn on DIF support */
+- scsi_host_set_prot(to_shost(h),
+- SHOST_DIF_TYPE1_PROTECTION |
+- SHOST_DIF_TYPE2_PROTECTION |
+- SHOST_DIF_TYPE3_PROTECTION);
+- scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC);
+ }
+
+ err = isci_setup_interrupts(pdev);
+--
+2.19.1
+
--- /dev/null
+From f633f032a05c49717d6ca720a3b456d4ef335818 Mon Sep 17 00:00:00 2001
+From: Manish Rangankar <mrangankar@marvell.com>
+Date: Wed, 9 Jan 2019 01:39:07 -0800
+Subject: scsi: qedi: Add ep_state for login completion on un-reachable targets
+
+[ Upstream commit 34a2ce887668db9dda4b56e6f155c49ac13f3e54 ]
+
+When the driver finds invalid destination MAC for the first un-reachable
+target, and before completes the PATH_REQ operation, set new ep_state to
+OFFLDCONN_NONE so that as part of driver ep_poll mechanism, the upper
+open-iscsi layer is notified to complete the login process on the first
+un-reachable target and thus proceed login to other reachable targets.
+
+Signed-off-by: Manish Rangankar <mrangankar@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedi/qedi_iscsi.c | 3 +++
+ drivers/scsi/qedi/qedi_iscsi.h | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
+index 2f0a4f2c5ff80..d4821b9dea45d 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.c
++++ b/drivers/scsi/qedi/qedi_iscsi.c
+@@ -954,6 +954,7 @@ static int qedi_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
+
+ qedi_ep = ep->dd_data;
+ if (qedi_ep->state == EP_STATE_IDLE ||
++ qedi_ep->state == EP_STATE_OFLDCONN_NONE ||
+ qedi_ep->state == EP_STATE_OFLDCONN_FAILED)
+ return -1;
+
+@@ -1036,6 +1037,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
+
+ switch (qedi_ep->state) {
+ case EP_STATE_OFLDCONN_START:
++ case EP_STATE_OFLDCONN_NONE:
+ goto ep_release_conn;
+ case EP_STATE_OFLDCONN_FAILED:
+ break;
+@@ -1226,6 +1228,7 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data)
+
+ if (!is_valid_ether_addr(&path_data->mac_addr[0])) {
+ QEDI_NOTICE(&qedi->dbg_ctx, "dst mac NOT VALID\n");
++ qedi_ep->state = EP_STATE_OFLDCONN_NONE;
+ ret = -EIO;
+ goto set_path_exit;
+ }
+diff --git a/drivers/scsi/qedi/qedi_iscsi.h b/drivers/scsi/qedi/qedi_iscsi.h
+index 11260776212fa..892d70d545537 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.h
++++ b/drivers/scsi/qedi/qedi_iscsi.h
+@@ -59,6 +59,7 @@ enum {
+ EP_STATE_OFLDCONN_FAILED = 0x2000,
+ EP_STATE_CONNECT_FAILED = 0x4000,
+ EP_STATE_DISCONN_TIMEDOUT = 0x8000,
++ EP_STATE_OFLDCONN_NONE = 0x10000,
+ };
+
+ struct qedi_conn;
+--
+2.19.1
+
--- /dev/null
+From 12afdca6625ecf3c7a3346e35f9d46c50a4673e3 Mon Sep 17 00:00:00 2001
+From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Date: Wed, 9 Jan 2019 15:09:02 +0100
+Subject: scsi: qla1280: set 64bit coherent mask
+
+[ Upstream commit 4a01ab60f55041b1ccc760e43258a5b3aeeca1bc ]
+
+After Commit 54aed4dd3526 ("MIPS: IP27: use dma_direct_ops") qla1280 driver
+failed on SGI IP27 machines with
+
+qla1280: QLA1040 found on PCI bus 0, dev 0
+qla1280 0000:00:00.0: enabling device (0006 -> 0007)
+qla1280: Failed to get request memory
+qla1280: probe of 0000:00:00.0 failed with error -12
+
+Reason is that SGI IP27 always generates 64bit DMA addresses and has no
+fallback mode for 32bit DMA addresses implemented. QLA1280 supports 64bit
+addressing for all DMA accesses so setting coherent mask to 64bit fixes the
+issue.
+
+Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla1280.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c
+index 15a50cc7e4b36..c8589926014d4 100644
+--- a/drivers/scsi/qla1280.c
++++ b/drivers/scsi/qla1280.c
+@@ -4259,7 +4259,7 @@ qla1280_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ ha->devnum = devnum; /* specifies microcode load address */
+
+ #ifdef QLA_64BIT_PTR
+- if (dma_set_mask(&ha->pdev->dev, DMA_BIT_MASK(64))) {
++ if (dma_set_mask_and_coherent(&ha->pdev->dev, DMA_BIT_MASK(64))) {
+ if (dma_set_mask(&ha->pdev->dev, DMA_BIT_MASK(32))) {
+ printk(KERN_WARNING "scsi(%li): Unable to set a "
+ "suitable DMA mask - aborting\n", ha->host_no);
+--
+2.19.1
+
--- /dev/null
+From 46a425d7c359622a0d4bd467d314b309510fe9d9 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 20 Dec 2018 11:16:07 +0800
+Subject: scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
+
+[ Upstream commit 72b4a0465f995175a2e22cf4a636bf781f1f28a7 ]
+
+The return code should be check while qla4xxx_copy_from_fwddb_param fails.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Manish Rangankar <mrangankar@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla4xxx/ql4_os.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index 051164f755a4c..a13396c56a6a1 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -7237,6 +7237,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha,
+
+ rc = qla4xxx_copy_from_fwddb_param(fnode_sess, fnode_conn,
+ fw_ddb_entry);
++ if (rc)
++ goto free_sess;
+
+ ql4_printk(KERN_INFO, ha, "%s: sysfs entry %s created\n",
+ __func__, fnode_sess->dev.kobj.name);
+--
+2.19.1
+
--- /dev/null
+From 3a457460dc357a0ada025d932649bc831f42f35f Mon Sep 17 00:00:00 2001
+From: Xiubo Li <xiubli@redhat.com>
+Date: Fri, 23 Nov 2018 09:15:30 +0800
+Subject: scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes
+
+[ Upstream commit a94a2572b97744d3a35a1996df0e5cf6b2461a4a ]
+
+Currently there is one cmd timeout timer and one qfull timer for each udev,
+and whenever any new command is coming in we will update the cmd timer or
+qfull timer. For some corner cases the timers are always working only for
+the ringbuffer's and full queue's newest cmd. That's to say the timer won't
+be fired even if one cmd has been stuck for a very long time and the
+deadline is reached.
+
+This fix will keep the cmd/qfull timers to be pended for the oldest cmd in
+ringbuffer and full queue, and will update them with the next cmd's
+deadline only when the old cmd's deadline is reached or removed from the
+ringbuffer and full queue.
+
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Acked-by: Mike Christie <mchristi@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_user.c | 88 +++++++++++++++++++++----------
+ 1 file changed, 61 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 9cd404acdb82b..ac7620120491b 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -148,7 +148,7 @@ struct tcmu_dev {
+ size_t ring_size;
+
+ struct mutex cmdr_lock;
+- struct list_head cmdr_queue;
++ struct list_head qfull_queue;
+
+ uint32_t dbi_max;
+ uint32_t dbi_thresh;
+@@ -159,6 +159,7 @@ struct tcmu_dev {
+
+ struct timer_list cmd_timer;
+ unsigned int cmd_time_out;
++ struct list_head inflight_queue;
+
+ struct timer_list qfull_timer;
+ int qfull_time_out;
+@@ -179,7 +180,7 @@ struct tcmu_dev {
+ struct tcmu_cmd {
+ struct se_cmd *se_cmd;
+ struct tcmu_dev *tcmu_dev;
+- struct list_head cmdr_queue_entry;
++ struct list_head queue_entry;
+
+ uint16_t cmd_id;
+
+@@ -192,6 +193,7 @@ struct tcmu_cmd {
+ unsigned long deadline;
+
+ #define TCMU_CMD_BIT_EXPIRED 0
++#define TCMU_CMD_BIT_INFLIGHT 1
+ unsigned long flags;
+ };
+ /*
+@@ -586,7 +588,7 @@ static struct tcmu_cmd *tcmu_alloc_cmd(struct se_cmd *se_cmd)
+ if (!tcmu_cmd)
+ return NULL;
+
+- INIT_LIST_HEAD(&tcmu_cmd->cmdr_queue_entry);
++ INIT_LIST_HEAD(&tcmu_cmd->queue_entry);
+ tcmu_cmd->se_cmd = se_cmd;
+ tcmu_cmd->tcmu_dev = udev;
+
+@@ -915,11 +917,13 @@ static int tcmu_setup_cmd_timer(struct tcmu_cmd *tcmu_cmd, unsigned int tmo,
+ return 0;
+
+ tcmu_cmd->deadline = round_jiffies_up(jiffies + msecs_to_jiffies(tmo));
+- mod_timer(timer, tcmu_cmd->deadline);
++ if (!timer_pending(timer))
++ mod_timer(timer, tcmu_cmd->deadline);
++
+ return 0;
+ }
+
+-static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd)
++static int add_to_qfull_queue(struct tcmu_cmd *tcmu_cmd)
+ {
+ struct tcmu_dev *udev = tcmu_cmd->tcmu_dev;
+ unsigned int tmo;
+@@ -942,7 +946,7 @@ static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd)
+ if (ret)
+ return ret;
+
+- list_add_tail(&tcmu_cmd->cmdr_queue_entry, &udev->cmdr_queue);
++ list_add_tail(&tcmu_cmd->queue_entry, &udev->qfull_queue);
+ pr_debug("adding cmd %u on dev %s to ring space wait queue\n",
+ tcmu_cmd->cmd_id, udev->name);
+ return 0;
+@@ -999,7 +1003,7 @@ static sense_reason_t queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, int *scsi_err)
+ base_command_size = tcmu_cmd_get_base_cmd_size(tcmu_cmd->dbi_cnt);
+ command_size = tcmu_cmd_get_cmd_size(tcmu_cmd, base_command_size);
+
+- if (!list_empty(&udev->cmdr_queue))
++ if (!list_empty(&udev->qfull_queue))
+ goto queue;
+
+ mb = udev->mb_addr;
+@@ -1096,13 +1100,16 @@ static sense_reason_t queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, int *scsi_err)
+ UPDATE_HEAD(mb->cmd_head, command_size, udev->cmdr_size);
+ tcmu_flush_dcache_range(mb, sizeof(*mb));
+
++ list_add_tail(&tcmu_cmd->queue_entry, &udev->inflight_queue);
++ set_bit(TCMU_CMD_BIT_INFLIGHT, &tcmu_cmd->flags);
++
+ /* TODO: only if FLUSH and FUA? */
+ uio_event_notify(&udev->uio_info);
+
+ return 0;
+
+ queue:
+- if (add_to_cmdr_queue(tcmu_cmd)) {
++ if (add_to_qfull_queue(tcmu_cmd)) {
+ *scsi_err = TCM_OUT_OF_RESOURCES;
+ return -1;
+ }
+@@ -1145,6 +1152,8 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
+ if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
+ goto out;
+
++ list_del_init(&cmd->queue_entry);
++
+ tcmu_cmd_reset_dbi_cur(cmd);
+
+ if (entry->hdr.uflags & TCMU_UFLAG_UNKNOWN_OP) {
+@@ -1194,9 +1203,29 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
+ tcmu_free_cmd(cmd);
+ }
+
++static void tcmu_set_next_deadline(struct list_head *queue,
++ struct timer_list *timer)
++{
++ struct tcmu_cmd *tcmu_cmd, *tmp_cmd;
++ unsigned long deadline = 0;
++
++ list_for_each_entry_safe(tcmu_cmd, tmp_cmd, queue, queue_entry) {
++ if (!time_after(jiffies, tcmu_cmd->deadline)) {
++ deadline = tcmu_cmd->deadline;
++ break;
++ }
++ }
++
++ if (deadline)
++ mod_timer(timer, deadline);
++ else
++ del_timer(timer);
++}
++
+ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ {
+ struct tcmu_mailbox *mb;
++ struct tcmu_cmd *cmd;
+ int handled = 0;
+
+ if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags)) {
+@@ -1210,7 +1239,6 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ while (udev->cmdr_last_cleaned != READ_ONCE(mb->cmd_tail)) {
+
+ struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned;
+- struct tcmu_cmd *cmd;
+
+ tcmu_flush_dcache_range(entry, sizeof(*entry));
+
+@@ -1243,7 +1271,7 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ /* no more pending commands */
+ del_timer(&udev->cmd_timer);
+
+- if (list_empty(&udev->cmdr_queue)) {
++ if (list_empty(&udev->qfull_queue)) {
+ /*
+ * no more pending or waiting commands so try to
+ * reclaim blocks if needed.
+@@ -1252,6 +1280,8 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ tcmu_global_max_blocks)
+ schedule_delayed_work(&tcmu_unmap_work, 0);
+ }
++ } else if (udev->cmd_time_out) {
++ tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer);
+ }
+
+ return handled;
+@@ -1271,7 +1301,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
+ if (!time_after(jiffies, cmd->deadline))
+ return 0;
+
+- is_running = list_empty(&cmd->cmdr_queue_entry);
++ is_running = test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags);
+ se_cmd = cmd->se_cmd;
+
+ if (is_running) {
+@@ -1288,12 +1318,11 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
+ */
+ scsi_status = SAM_STAT_CHECK_CONDITION;
+ } else {
+- list_del_init(&cmd->cmdr_queue_entry);
+-
+ idr_remove(&udev->commands, id);
+ tcmu_free_cmd(cmd);
+ scsi_status = SAM_STAT_TASK_SET_FULL;
+ }
++ list_del_init(&cmd->queue_entry);
+
+ pr_debug("Timing out cmd %u on dev %s that is %s.\n",
+ id, udev->name, is_running ? "inflight" : "queued");
+@@ -1372,7 +1401,8 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
+
+ INIT_LIST_HEAD(&udev->node);
+ INIT_LIST_HEAD(&udev->timedout_entry);
+- INIT_LIST_HEAD(&udev->cmdr_queue);
++ INIT_LIST_HEAD(&udev->qfull_queue);
++ INIT_LIST_HEAD(&udev->inflight_queue);
+ idr_init(&udev->commands);
+
+ timer_setup(&udev->qfull_timer, tcmu_qfull_timedout, 0);
+@@ -1383,7 +1413,7 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
+ return &udev->se_dev;
+ }
+
+-static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
++static bool run_qfull_queue(struct tcmu_dev *udev, bool fail)
+ {
+ struct tcmu_cmd *tcmu_cmd, *tmp_cmd;
+ LIST_HEAD(cmds);
+@@ -1391,15 +1421,15 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
+ sense_reason_t scsi_ret;
+ int ret;
+
+- if (list_empty(&udev->cmdr_queue))
++ if (list_empty(&udev->qfull_queue))
+ return true;
+
+ pr_debug("running %s's cmdr queue forcefail %d\n", udev->name, fail);
+
+- list_splice_init(&udev->cmdr_queue, &cmds);
++ list_splice_init(&udev->qfull_queue, &cmds);
+
+- list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, cmdr_queue_entry) {
+- list_del_init(&tcmu_cmd->cmdr_queue_entry);
++ list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, queue_entry) {
++ list_del_init(&tcmu_cmd->queue_entry);
+
+ pr_debug("removing cmd %u on dev %s from queue\n",
+ tcmu_cmd->cmd_id, udev->name);
+@@ -1437,14 +1467,13 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
+ * cmd was requeued, so just put all cmds back in
+ * the queue
+ */
+- list_splice_tail(&cmds, &udev->cmdr_queue);
++ list_splice_tail(&cmds, &udev->qfull_queue);
+ drained = false;
+- goto done;
++ break;
+ }
+ }
+- if (list_empty(&udev->cmdr_queue))
+- del_timer(&udev->qfull_timer);
+-done:
++
++ tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer);
+ return drained;
+ }
+
+@@ -1454,7 +1483,7 @@ static int tcmu_irqcontrol(struct uio_info *info, s32 irq_on)
+
+ mutex_lock(&udev->cmdr_lock);
+ tcmu_handle_completions(udev);
+- run_cmdr_queue(udev, false);
++ run_qfull_queue(udev, false);
+ mutex_unlock(&udev->cmdr_lock);
+
+ return 0;
+@@ -1982,7 +2011,7 @@ static void tcmu_block_dev(struct tcmu_dev *udev)
+ /* complete IO that has executed successfully */
+ tcmu_handle_completions(udev);
+ /* fail IO waiting to be queued */
+- run_cmdr_queue(udev, true);
++ run_qfull_queue(udev, true);
+
+ unlock:
+ mutex_unlock(&udev->cmdr_lock);
+@@ -1997,7 +2026,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
+ mutex_lock(&udev->cmdr_lock);
+
+ idr_for_each_entry(&udev->commands, cmd, i) {
+- if (!list_empty(&cmd->cmdr_queue_entry))
++ if (!test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags))
+ continue;
+
+ pr_debug("removing cmd %u on dev %s from ring (is expired %d)\n",
+@@ -2006,6 +2035,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
+
+ idr_remove(&udev->commands, i);
+ if (!test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
++ list_del_init(&cmd->queue_entry);
+ if (err_level == 1) {
+ /*
+ * Userspace was not able to start the
+@@ -2666,6 +2696,10 @@ static void check_timedout_devices(void)
+
+ mutex_lock(&udev->cmdr_lock);
+ idr_for_each(&udev->commands, tcmu_check_expired_cmd, NULL);
++
++ tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer);
++ tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer);
++
+ mutex_unlock(&udev->cmdr_lock);
+
+ spin_lock_bh(&timed_out_udevs_lock);
+--
+2.19.1
+
--- /dev/null
+From 6b6617c782e98c35c8c0215c4c97f4df96615154 Mon Sep 17 00:00:00 2001
+From: Avri Altman <avri.altman@wdc.com>
+Date: Thu, 10 Jan 2019 13:31:26 +0200
+Subject: scsi: ufs: Fix geometry descriptor size
+
+[ Upstream commit 9be9db9f78f52ef03ee90063730cb9d730e7032b ]
+
+Albeit we no longer rely on those hard-coded descriptor sizes, we still use
+them as our defaults, so better get it right. While adding its sysfs
+entries, we forgot to update the geometry descriptor size. It is 0x48
+according to UFS2.1, and wasn't changed in UFS3.0.
+
+[mkp: typo]
+
+Fixes: c720c091222e (scsi: ufs: sysfs: geometry descriptor)
+Signed-off-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h
+index 58087d3916d05..5417ce09b1054 100644
+--- a/drivers/scsi/ufs/ufs.h
++++ b/drivers/scsi/ufs/ufs.h
+@@ -195,7 +195,7 @@ enum ufs_desc_def_size {
+ QUERY_DESC_CONFIGURATION_DEF_SIZE = 0x90,
+ QUERY_DESC_UNIT_DEF_SIZE = 0x23,
+ QUERY_DESC_INTERCONNECT_DEF_SIZE = 0x06,
+- QUERY_DESC_GEOMETRY_DEF_SIZE = 0x44,
++ QUERY_DESC_GEOMETRY_DEF_SIZE = 0x48,
+ QUERY_DESC_POWER_DEF_SIZE = 0x62,
+ QUERY_DESC_HEALTH_DEF_SIZE = 0x25,
+ };
+--
+2.19.1
+
--- /dev/null
+From 1605edf2fc8f905ccd60a5c7ae652f695ebd9444 Mon Sep 17 00:00:00 2001
+From: Stanley Chu <stanley.chu@mediatek.com>
+Date: Mon, 7 Jan 2019 22:19:34 +0800
+Subject: scsi: ufs: Fix system suspend status
+
+[ Upstream commit ce9e7bce43526626f7cffe2e657953997870197e ]
+
+hba->is_sys_suspended is set after successful system suspend but
+not clear after successful system resume.
+
+According to current behavior, hba->is_sys_suspended will not be set if
+host is runtime-suspended but not system-suspended. Thus we shall aligh the
+same policy: clear this flag even if host remains runtime-suspended after
+ufshcd_system_resume is successfully returned.
+
+Simply fix this flag to correct host status logs.
+
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 1cb35ab8a4ec2..2772ff4357fc4 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -7924,6 +7924,8 @@ int ufshcd_system_resume(struct ufs_hba *hba)
+ trace_ufshcd_system_resume(dev_name(hba->dev), ret,
+ ktime_to_us(ktime_sub(ktime_get(), start)),
+ hba->curr_dev_pwr_mode, hba->uic_link_state);
++ if (!ret)
++ hba->is_sys_suspended = false;
+ return ret;
+ }
+ EXPORT_SYMBOL(ufshcd_system_resume);
+--
+2.19.1
+
--- /dev/null
+From 02fd7848b61c0015fc17197fdee8439ec8e4d9d5 Mon Sep 17 00:00:00 2001
+From: Anders Roxell <anders.roxell@linaro.org>
+Date: Tue, 8 Jan 2019 10:23:03 +0100
+Subject: selftests: bpf: install files tcp_(server|client)*.py
+
+[ Upstream commit f98937c6bb73ae11717a15aec85c187d33ca5d34 ]
+
+When test_tcpbpf_user runs it complains that it can't find files
+tcp_server.py and tcp_client.py.
+
+Rework so that tcp_server.py and tcp_client.py gets installed, added them
+to the variable TEST_PROGS_EXTENDED.
+
+Fixes: d6d4f60c3a09 ("bpf: add selftest for tcpbpf")
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/Makefile | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
+index ecd79b7fb1073..74ece4f9fccee 100644
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -53,7 +53,9 @@ TEST_PROGS := test_kmod.sh \
+ test_flow_dissector.sh \
+ test_xdp_vlan.sh
+
+-TEST_PROGS_EXTENDED := with_addr.sh
++TEST_PROGS_EXTENDED := with_addr.sh \
++ tcp_client.py \
++ tcp_server.py
+
+ # Compile but not part of 'make run_tests'
+ TEST_GEN_PROGS_EXTENDED = test_libbpf_open test_sock_addr test_skb_cgroup_id_user \
+--
+2.19.1
+
--- /dev/null
+From fe74c05b3b56e8fdfe27a9a1a3072f7ce8306659 Mon Sep 17 00:00:00 2001
+From: Stanislav Fomichev <sdf@google.com>
+Date: Mon, 14 Jan 2019 09:41:41 -0800
+Subject: selftests/bpf: install with_tunnels.sh for test_flow_dissector.sh
+
+[ Upstream commit 1be72f29bfb98be27a95309f18b4ab5249967b59 ]
+
+test_flow_dissector.sh depends on both with_addr.sh and with_tunnels.sh
+However, we install only with_addr.sh.
+
+Add with_tunnels.sh to TEST_PROGS_EXTENDED to make sure it gets
+installed as well.
+
+Tested with: make TARGETS=bpf install INSTALL_PATH=$PWD/x
+
+Fixes: ef4ab8447aa26 ("selftests: bpf: install script with_addr.sh")
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
+index 74ece4f9fccee..d5e992f7c7dd5 100644
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -54,6 +54,7 @@ TEST_PROGS := test_kmod.sh \
+ test_xdp_vlan.sh
+
+ TEST_PROGS_EXTENDED := with_addr.sh \
++ with_tunnels.sh \
+ tcp_client.py \
+ tcp_server.py
+
+--
+2.19.1
+
--- /dev/null
+From e1e8356ac682b5aa2d1e58d8b2e814461db26c87 Mon Sep 17 00:00:00 2001
+From: Stanislav Fomichev <sdf@google.com>
+Date: Wed, 16 Jan 2019 14:03:17 -0800
+Subject: selftests/bpf: retry tests that expect build-id
+
+[ Upstream commit f67ad87ab3120e82845521b18a2b99273a340308 ]
+
+While running test_progs in a loop I found out that I'm sometimes hitting
+"Didn't find expected build ID from the map" error.
+
+Looking at stack_map_get_build_id_offset() it seems that it is racy (by
+design) and can sometimes return BPF_STACK_BUILD_ID_IP (i.e. can't trylock
+current->mm->mmap_sem).
+
+Let's retry this test a single time.
+
+Fixes: 13790d1cc72c ("bpf: add selftest for stackmap with build_id in NMI context")
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 30 ++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index 6ac7232b0fdeb..3ec4ce156074c 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -1136,7 +1136,9 @@ static void test_stacktrace_build_id(void)
+ int i, j;
+ struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH];
+ int build_id_matches = 0;
++ int retry = 1;
+
++retry:
+ err = bpf_prog_load(file, BPF_PROG_TYPE_TRACEPOINT, &obj, &prog_fd);
+ if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno))
+ goto out;
+@@ -1249,6 +1251,19 @@ static void test_stacktrace_build_id(void)
+ previous_key = key;
+ } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
+
++ /* stack_map_get_build_id_offset() is racy and sometimes can return
++ * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID;
++ * try it one more time.
++ */
++ if (build_id_matches < 1 && retry--) {
++ ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
++ close(pmu_fd);
++ bpf_object__close(obj);
++ printf("%s:WARN:Didn't find expected build ID from the map, retrying\n",
++ __func__);
++ goto retry;
++ }
++
+ if (CHECK(build_id_matches < 1, "build id match",
+ "Didn't find expected build ID from the map\n"))
+ goto disable_pmu;
+@@ -1289,7 +1304,9 @@ static void test_stacktrace_build_id_nmi(void)
+ int i, j;
+ struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH];
+ int build_id_matches = 0;
++ int retry = 1;
+
++retry:
+ err = bpf_prog_load(file, BPF_PROG_TYPE_PERF_EVENT, &obj, &prog_fd);
+ if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno))
+ return;
+@@ -1384,6 +1401,19 @@ static void test_stacktrace_build_id_nmi(void)
+ previous_key = key;
+ } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
+
++ /* stack_map_get_build_id_offset() is racy and sometimes can return
++ * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID;
++ * try it one more time.
++ */
++ if (build_id_matches < 1 && retry--) {
++ ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
++ close(pmu_fd);
++ bpf_object__close(obj);
++ printf("%s:WARN:Didn't find expected build ID from the map, retrying\n",
++ __func__);
++ goto retry;
++ }
++
+ if (CHECK(build_id_matches < 1, "build id match",
+ "Didn't find expected build ID from the map\n"))
+ goto disable_pmu;
+--
+2.19.1
+
--- /dev/null
+From 874a37a958a6c0a755c8d4e61a65cf53617d056d Mon Sep 17 00:00:00 2001
+From: Andrey Ignatov <rdna@fb.com>
+Date: Fri, 4 Jan 2019 01:07:08 -0800
+Subject: selftests/bpf: Test [::] -> [::1] rewrite in sys_sendmsg in
+ test_sock_addr
+
+[ Upstream commit 976b4f3a4646fbf0d189caca25f91f82e4be4b5a ]
+
+Test that sys_sendmsg BPF hook doesn't break sys_sendmsg behaviour to
+rewrite destination IPv6 = [::] with [::1] (BSD'ism).
+
+Two test cases are added:
+
+1) User passes dst IPv6 = [::] and BPF_CGROUP_UDP6_SENDMSG program
+ doesn't touch it.
+
+2) User passes dst IPv6 != [::], but BPF_CGROUP_UDP6_SENDMSG program
+ rewrites it with [::].
+
+In both cases [::1] is used by sys_sendmsg code eventually and datagram
+is sent successfully for unconnected UDP socket.
+
+Example of relevant output:
+ Test case: sendmsg6: set dst IP = [::] (BSD'ism) .. [PASS]
+ Test case: sendmsg6: preserve dst IP = [::] (BSD'ism) .. [PASS]
+
+Signed-off-by: Andrey Ignatov <rdna@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_sock_addr.c | 53 ++++++++++++++++++--
+ 1 file changed, 50 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c
+index aeeb76a54d633..e38f1cb7089d3 100644
+--- a/tools/testing/selftests/bpf/test_sock_addr.c
++++ b/tools/testing/selftests/bpf/test_sock_addr.c
+@@ -44,6 +44,7 @@
+ #define SERV6_V4MAPPED_IP "::ffff:192.168.0.4"
+ #define SRC6_IP "::1"
+ #define SRC6_REWRITE_IP "::6"
++#define WILDCARD6_IP "::"
+ #define SERV6_PORT 6060
+ #define SERV6_REWRITE_PORT 6666
+
+@@ -85,12 +86,14 @@ static int bind4_prog_load(const struct sock_addr_test *test);
+ static int bind6_prog_load(const struct sock_addr_test *test);
+ static int connect4_prog_load(const struct sock_addr_test *test);
+ static int connect6_prog_load(const struct sock_addr_test *test);
++static int sendmsg_allow_prog_load(const struct sock_addr_test *test);
+ static int sendmsg_deny_prog_load(const struct sock_addr_test *test);
+ static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test);
+ static int sendmsg4_rw_c_prog_load(const struct sock_addr_test *test);
+ static int sendmsg6_rw_asm_prog_load(const struct sock_addr_test *test);
+ static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test);
+ static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test);
++static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test);
+
+ static struct sock_addr_test tests[] = {
+ /* bind */
+@@ -462,6 +465,34 @@ static struct sock_addr_test tests[] = {
+ SRC6_REWRITE_IP,
+ SYSCALL_ENOTSUPP,
+ },
++ {
++ "sendmsg6: set dst IP = [::] (BSD'ism)",
++ sendmsg6_rw_wildcard_prog_load,
++ BPF_CGROUP_UDP6_SENDMSG,
++ BPF_CGROUP_UDP6_SENDMSG,
++ AF_INET6,
++ SOCK_DGRAM,
++ SERV6_IP,
++ SERV6_PORT,
++ SERV6_REWRITE_IP,
++ SERV6_REWRITE_PORT,
++ SRC6_REWRITE_IP,
++ SUCCESS,
++ },
++ {
++ "sendmsg6: preserve dst IP = [::] (BSD'ism)",
++ sendmsg_allow_prog_load,
++ BPF_CGROUP_UDP6_SENDMSG,
++ BPF_CGROUP_UDP6_SENDMSG,
++ AF_INET6,
++ SOCK_DGRAM,
++ WILDCARD6_IP,
++ SERV6_PORT,
++ SERV6_REWRITE_IP,
++ SERV6_PORT,
++ SRC6_IP,
++ SUCCESS,
++ },
+ {
+ "sendmsg6: deny call",
+ sendmsg_deny_prog_load,
+@@ -714,16 +745,27 @@ static int connect6_prog_load(const struct sock_addr_test *test)
+ return load_path(test, CONNECT6_PROG_PATH);
+ }
+
+-static int sendmsg_deny_prog_load(const struct sock_addr_test *test)
++static int sendmsg_ret_only_prog_load(const struct sock_addr_test *test,
++ int32_t rc)
+ {
+ struct bpf_insn insns[] = {
+- /* return 0 */
+- BPF_MOV64_IMM(BPF_REG_0, 0),
++ /* return rc */
++ BPF_MOV64_IMM(BPF_REG_0, rc),
+ BPF_EXIT_INSN(),
+ };
+ return load_insns(test, insns, sizeof(insns) / sizeof(struct bpf_insn));
+ }
+
++static int sendmsg_allow_prog_load(const struct sock_addr_test *test)
++{
++ return sendmsg_ret_only_prog_load(test, /*rc*/ 1);
++}
++
++static int sendmsg_deny_prog_load(const struct sock_addr_test *test)
++{
++ return sendmsg_ret_only_prog_load(test, /*rc*/ 0);
++}
++
+ static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test)
+ {
+ struct sockaddr_in dst4_rw_addr;
+@@ -844,6 +886,11 @@ static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test)
+ return sendmsg6_rw_dst_asm_prog_load(test, SERV6_V4MAPPED_IP);
+ }
+
++static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test)
++{
++ return sendmsg6_rw_dst_asm_prog_load(test, WILDCARD6_IP);
++}
++
+ static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test)
+ {
+ return load_path(test, SENDMSG6_PROG_PATH);
+--
+2.19.1
+
--- /dev/null
+From c9b4faafd11d86637dd5d38edca44bd3dd80dd83 Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Fri, 18 Jan 2019 15:58:03 +0000
+Subject: selftests: forwarding: Add a test case for externally learned FDB
+ entries
+
+[ Upstream commit 479a2b761d61c04e2ae97325aa391a8a8c99c23e ]
+
+Test that externally learned FDB entries can roam, but not age out.
+
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reviewed-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/forwarding/bridge_vlan_aware.sh | 34 ++++++++++++++++++-
+ 1 file changed, 33 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
+index 04c6431b2bd8c..b90dff8d3a94b 100755
+--- a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
++++ b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
+@@ -1,7 +1,7 @@
+ #!/bin/bash
+ # SPDX-License-Identifier: GPL-2.0
+
+-ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding vlan_deletion"
++ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding vlan_deletion extern_learn"
+ NUM_NETIFS=4
+ CHECK_TC="yes"
+ source lib.sh
+@@ -109,6 +109,38 @@ vlan_deletion()
+ ping_ipv6
+ }
+
++extern_learn()
++{
++ local mac=de:ad:be:ef:13:37
++ local ageing_time
++
++ # Test that externally learned FDB entries can roam, but not age out
++ RET=0
++
++ bridge fdb add de:ad:be:ef:13:37 dev $swp1 master extern_learn vlan 1
++
++ bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37
++ check_err $? "Did not find FDB entry when should"
++
++ # Wait for 10 seconds after the ageing time to make sure the FDB entry
++ # was not aged out
++ ageing_time=$(bridge_ageing_time_get br0)
++ sleep $((ageing_time + 10))
++
++ bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37
++ check_err $? "FDB entry was aged out when should not"
++
++ $MZ $h2 -c 1 -p 64 -a $mac -t ip -q
++
++ bridge fdb show brport $swp2 | grep -q de:ad:be:ef:13:37
++ check_err $? "FDB entry did not roam when should"
++
++ log_test "Externally learned FDB entry - ageing & roaming"
++
++ bridge fdb del de:ad:be:ef:13:37 dev $swp2 master vlan 1 &> /dev/null
++ bridge fdb del de:ad:be:ef:13:37 dev $swp1 master vlan 1 &> /dev/null
++}
++
+ trap cleanup EXIT
+
+ setup_prepare
+--
+2.19.1
+
--- /dev/null
+From a46fcb59f0ab14103957492e93e6ace381b40f64 Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Tue, 8 Jan 2019 16:48:14 +0000
+Subject: selftests: forwarding: Add a test for VLAN deletion
+
+[ Upstream commit 4fabf3bf93a194c7fa5288da3e0af37e4b943cf3 ]
+
+Add a VLAN on a bridge port, delete it and make sure the PVID VLAN is
+not affected.
+
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/net/forwarding/bridge_vlan_aware.sh | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
+index d8313d0438b74..04c6431b2bd8c 100755
+--- a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
++++ b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
+@@ -1,7 +1,7 @@
+ #!/bin/bash
+ # SPDX-License-Identifier: GPL-2.0
+
+-ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding"
++ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding vlan_deletion"
+ NUM_NETIFS=4
+ CHECK_TC="yes"
+ source lib.sh
+@@ -96,6 +96,19 @@ flooding()
+ flood_test $swp2 $h1 $h2
+ }
+
++vlan_deletion()
++{
++ # Test that the deletion of a VLAN on a bridge port does not affect
++ # the PVID VLAN
++ log_info "Add and delete a VLAN on bridge port $swp1"
++
++ bridge vlan add vid 10 dev $swp1
++ bridge vlan del vid 10 dev $swp1
++
++ ping_ipv4
++ ping_ipv6
++}
++
+ trap cleanup EXIT
+
+ setup_prepare
+--
+2.19.1
+
--- /dev/null
+From 100285f4bb198ae1043a948323bec6e8f41bbc98 Mon Sep 17 00:00:00 2001
+From: Peter Oskolkov <posk@google.com>
+Date: Fri, 4 Jan 2019 09:43:08 -0800
+Subject: selftests: net: fix/improve ip_defrag selftest
+
+[ Upstream commit 3271a4821882a64214acc1bd7b173900ec70c9bf ]
+
+Commit ade446403bfb ("net: ipv4: do not handle duplicate fragments as
+overlapping") changed IPv4 defragmentation so that duplicate fragments,
+as well as _some_ fragments completely covered by previously delivered
+fragments, do not lead to the whole frag queue being discarded. This
+makes the existing ip_defrag selftest flaky.
+
+This patch
+* makes sure that negative IPv4 defrag tests generate truly overlapping
+ fragments that trigger defrag queue drops;
+* tests that duplicate IPv4 fragments do not trigger defrag queue drops;
+* makes a couple of minor tweaks to the test aimed at increasing its code
+ coverage and reduce flakiness.
+
+Signed-off-by: Peter Oskolkov <posk@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/ip_defrag.c | 96 +++++++++++++++++++++---
+ tools/testing/selftests/net/ip_defrag.sh | 9 ++-
+ 2 files changed, 95 insertions(+), 10 deletions(-)
+
+diff --git a/tools/testing/selftests/net/ip_defrag.c b/tools/testing/selftests/net/ip_defrag.c
+index 61ae2782388e9..5d56cc0838f62 100644
+--- a/tools/testing/selftests/net/ip_defrag.c
++++ b/tools/testing/selftests/net/ip_defrag.c
+@@ -203,6 +203,7 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
+ {
+ struct ip *iphdr = (struct ip *)ip_frame;
+ struct ip6_hdr *ip6hdr = (struct ip6_hdr *)ip_frame;
++ const bool ipv4 = !ipv6;
+ int res;
+ int offset;
+ int frag_len;
+@@ -239,19 +240,53 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
+ iphdr->ip_sum = 0;
+ }
+
++ /* Occasionally test in-order fragments. */
++ if (!cfg_overlap && (rand() % 100 < 15)) {
++ offset = 0;
++ while (offset < (UDP_HLEN + payload_len)) {
++ send_fragment(fd_raw, addr, alen, offset, ipv6);
++ offset += max_frag_len;
++ }
++ return;
++ }
++
++ /* Occasionally test IPv4 "runs" (see net/ipv4/ip_fragment.c) */
++ if (ipv4 && !cfg_overlap && (rand() % 100 < 20) &&
++ (payload_len > 9 * max_frag_len)) {
++ offset = 6 * max_frag_len;
++ while (offset < (UDP_HLEN + payload_len)) {
++ send_fragment(fd_raw, addr, alen, offset, ipv6);
++ offset += max_frag_len;
++ }
++ offset = 3 * max_frag_len;
++ while (offset < 6 * max_frag_len) {
++ send_fragment(fd_raw, addr, alen, offset, ipv6);
++ offset += max_frag_len;
++ }
++ offset = 0;
++ while (offset < 3 * max_frag_len) {
++ send_fragment(fd_raw, addr, alen, offset, ipv6);
++ offset += max_frag_len;
++ }
++ return;
++ }
++
+ /* Odd fragments. */
+ offset = max_frag_len;
+ while (offset < (UDP_HLEN + payload_len)) {
+ send_fragment(fd_raw, addr, alen, offset, ipv6);
++ /* IPv4 ignores duplicates, so randomly send a duplicate. */
++ if (ipv4 && (1 == rand() % 100))
++ send_fragment(fd_raw, addr, alen, offset, ipv6);
+ offset += 2 * max_frag_len;
+ }
+
+ if (cfg_overlap) {
+ /* Send an extra random fragment. */
+- offset = rand() % (UDP_HLEN + payload_len - 1);
+- /* sendto() returns EINVAL if offset + frag_len is too small. */
+ if (ipv6) {
+ struct ip6_frag *fraghdr = (struct ip6_frag *)(ip_frame + IP6_HLEN);
++ /* sendto() returns EINVAL if offset + frag_len is too small. */
++ offset = rand() % (UDP_HLEN + payload_len - 1);
+ frag_len = max_frag_len + rand() % 256;
+ /* In IPv6 if !!(frag_len % 8), the fragment is dropped. */
+ frag_len &= ~0x7;
+@@ -259,13 +294,29 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
+ ip6hdr->ip6_plen = htons(frag_len);
+ frag_len += IP6_HLEN;
+ } else {
+- frag_len = IP4_HLEN + UDP_HLEN + rand() % 256;
++ /* In IPv4, duplicates and some fragments completely inside
++ * previously sent fragments are dropped/ignored. So
++ * random offset and frag_len can result in a dropped
++ * fragment instead of a dropped queue/packet. So we
++ * hard-code offset and frag_len.
++ *
++ * See ade446403bfb ("net: ipv4: do not handle duplicate
++ * fragments as overlapping").
++ */
++ if (max_frag_len * 4 < payload_len || max_frag_len < 16) {
++ /* not enough payload to play with random offset and frag_len. */
++ offset = 8;
++ frag_len = IP4_HLEN + UDP_HLEN + max_frag_len;
++ } else {
++ offset = rand() % (payload_len / 2);
++ frag_len = 2 * max_frag_len + 1 + rand() % 256;
++ }
+ iphdr->ip_off = htons(offset / 8 | IP4_MF);
+ iphdr->ip_len = htons(frag_len);
+ }
+ res = sendto(fd_raw, ip_frame, frag_len, 0, addr, alen);
+ if (res < 0)
+- error(1, errno, "sendto overlap");
++ error(1, errno, "sendto overlap: %d", frag_len);
+ if (res != frag_len)
+ error(1, 0, "sendto overlap: %d vs %d", (int)res, frag_len);
+ frag_counter++;
+@@ -275,6 +326,9 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
+ offset = 0;
+ while (offset < (UDP_HLEN + payload_len)) {
+ send_fragment(fd_raw, addr, alen, offset, ipv6);
++ /* IPv4 ignores duplicates, so randomly send a duplicate. */
++ if (ipv4 && (1 == rand() % 100))
++ send_fragment(fd_raw, addr, alen, offset, ipv6);
+ offset += 2 * max_frag_len;
+ }
+ }
+@@ -282,7 +336,11 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
+ static void run_test(struct sockaddr *addr, socklen_t alen, bool ipv6)
+ {
+ int fd_tx_raw, fd_rx_udp;
+- struct timeval tv = { .tv_sec = 0, .tv_usec = 10 * 1000 };
++ /* Frag queue timeout is set to one second in the calling script;
++ * socket timeout should be just a bit longer to avoid tests interfering
++ * with each other.
++ */
++ struct timeval tv = { .tv_sec = 1, .tv_usec = 10 };
+ int idx;
+ int min_frag_len = ipv6 ? 1280 : 8;
+
+@@ -308,12 +366,32 @@ static void run_test(struct sockaddr *addr, socklen_t alen, bool ipv6)
+ payload_len += (rand() % 4096)) {
+ if (cfg_verbose)
+ printf("payload_len: %d\n", payload_len);
+- max_frag_len = min_frag_len;
+- do {
++
++ if (cfg_overlap) {
++ /* With overlaps, one send/receive pair below takes
++ * at least one second (== timeout) to run, so there
++ * is not enough test time to run a nested loop:
++ * the full overlap test takes 20-30 seconds.
++ */
++ max_frag_len = min_frag_len +
++ rand() % (1500 - FRAG_HLEN - min_frag_len);
+ send_udp_frags(fd_tx_raw, addr, alen, ipv6);
+ recv_validate_udp(fd_rx_udp);
+- max_frag_len += 8 * (rand() % 8);
+- } while (max_frag_len < (1500 - FRAG_HLEN) && max_frag_len <= payload_len);
++ } else {
++ /* Without overlaps, each packet reassembly (== one
++ * send/receive pair below) takes very little time to
++ * run, so we can easily afford more thourough testing
++ * with a nested loop: the full non-overlap test takes
++ * less than one second).
++ */
++ max_frag_len = min_frag_len;
++ do {
++ send_udp_frags(fd_tx_raw, addr, alen, ipv6);
++ recv_validate_udp(fd_rx_udp);
++ max_frag_len += 8 * (rand() % 8);
++ } while (max_frag_len < (1500 - FRAG_HLEN) &&
++ max_frag_len <= payload_len);
++ }
+ }
+
+ /* Cleanup. */
+diff --git a/tools/testing/selftests/net/ip_defrag.sh b/tools/testing/selftests/net/ip_defrag.sh
+index f346727960449..7dd79a9efb177 100755
+--- a/tools/testing/selftests/net/ip_defrag.sh
++++ b/tools/testing/selftests/net/ip_defrag.sh
+@@ -11,10 +11,17 @@ readonly NETNS="ns-$(mktemp -u XXXXXX)"
+ setup() {
+ ip netns add "${NETNS}"
+ ip -netns "${NETNS}" link set lo up
++
+ ip netns exec "${NETNS}" sysctl -w net.ipv4.ipfrag_high_thresh=9000000 >/dev/null 2>&1
+ ip netns exec "${NETNS}" sysctl -w net.ipv4.ipfrag_low_thresh=7000000 >/dev/null 2>&1
++ ip netns exec "${NETNS}" sysctl -w net.ipv4.ipfrag_time=1 >/dev/null 2>&1
++
+ ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_high_thresh=9000000 >/dev/null 2>&1
+ ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_low_thresh=7000000 >/dev/null 2>&1
++ ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_time=1 >/dev/null 2>&1
++
++ # DST cache can get full with a lot of frags, with GC not keeping up with the test.
++ ip netns exec "${NETNS}" sysctl -w net.ipv6.route.max_size=65536 >/dev/null 2>&1
+ }
+
+ cleanup() {
+@@ -27,7 +34,6 @@ setup
+ echo "ipv4 defrag"
+ ip netns exec "${NETNS}" ./ip_defrag -4
+
+-
+ echo "ipv4 defrag with overlaps"
+ ip netns exec "${NETNS}" ./ip_defrag -4o
+
+@@ -37,3 +43,4 @@ ip netns exec "${NETNS}" ./ip_defrag -6
+ echo "ipv6 defrag with overlaps"
+ ip netns exec "${NETNS}" ./ip_defrag -6o
+
++echo "all tests done"
+--
+2.19.1
+
--- /dev/null
+From 210947b87b248cacf372e6571a065e241c2ad1a7 Mon Sep 17 00:00:00 2001
+From: Davide Caratti <dcaratti@redhat.com>
+Date: Fri, 11 Jan 2019 11:49:58 +0100
+Subject: selftests: tc-testing: drop test on missing tunnel key id
+
+[ Upstream commit e413615502a3324daba038f529932ba9a5248af0 ]
+
+After merge of commit 80ef0f22ceda ("net/sched: act_tunnel_key: Allow
+key-less tunnels"), act_tunnel_key does not reject anymore requests to
+install 'set' rules where the key id is missing. Therefore, drop the
+following TDC testcase:
+
+ ba4e - Add tunnel_key set action with missing mandatory id parameter
+
+because it's going to become a systematic fail as soon as userspace
+iproute2 will start supporting key-less tunnels.
+
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../tc-tests/actions/tunnel_key.json | 29 -------------------
+ 1 file changed, 29 deletions(-)
+
+diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
+index 10b2d894e4362..af5e99d272296 100644
+--- a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
+@@ -81,35 +81,6 @@
+ ]
+ ]
+ },
+- {
+- "id": "ba4e",
+- "name": "Add tunnel_key set action with missing mandatory id parameter",
+- "category": [
+- "actions",
+- "tunnel_key"
+- ],
+- "setup": [
+- [
+- "$TC actions flush action tunnel_key",
+- 0,
+- 1,
+- 255
+- ]
+- ],
+- "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 20.20.20.2",
+- "expExitCode": "255",
+- "verifyCmd": "$TC actions list action tunnel_key",
+- "matchPattern": "action order [0-9]+: tunnel_key set.*src_ip 10.10.10.1.*dst_ip 20.20.20.2",
+- "matchCount": "0",
+- "teardown": [
+- [
+- "$TC actions flush action tunnel_key",
+- 0,
+- 1,
+- 255
+- ]
+- ]
+- },
+ {
+ "id": "a5e0",
+ "name": "Add tunnel_key set action with invalid src_ip parameter",
+--
+2.19.1
+
--- /dev/null
+From c51aaa2113af2d3c5df761d6dc9db53f434698b3 Mon Sep 17 00:00:00 2001
+From: Davide Caratti <dcaratti@redhat.com>
+Date: Mon, 14 Jan 2019 18:16:44 +0100
+Subject: selftests: tc-testing: fix parsing of ife type
+
+[ Upstream commit 91fa038d9446b5bf5ea80822790af7dd9bcbb5a2 ]
+
+In iproute2 commit 90c5c969f0b9 ("fix print_0xhex on 32 bit"), the format
+specifier for the ife type changed from 0x%X to %#llX, causing systematic
+failures in the following TDC test cases:
+
+ 7682 - Create valid ife encode action with mark and pass control
+ ef47 - Create valid ife encode action with mark and pipe control
+ df43 - Create valid ife encode action with mark and continue control
+ e4cf - Create valid ife encode action with mark and drop control
+ ccba - Create valid ife encode action with mark and reclassify control
+ a1cf - Create valid ife encode action with mark and jump control
+ cb3d - Create valid ife encode action with mark value at 32-bit maximum
+ 95ed - Create valid ife encode action with prio and pass control
+ aa17 - Create valid ife encode action with prio and pipe control
+ 74c7 - Create valid ife encode action with prio and continue control
+ 7a97 - Create valid ife encode action with prio and drop control
+ f66b - Create valid ife encode action with prio and reclassify control
+ 3056 - Create valid ife encode action with prio and jump control
+ 7dd3 - Create valid ife encode action with prio value at 32-bit maximum
+ 05bb - Create valid ife encode action with tcindex and pass control
+ ce65 - Create valid ife encode action with tcindex and pipe control
+ 09cd - Create valid ife encode action with tcindex and continue control
+ 8eb5 - Create valid ife encode action with tcindex and continue control
+ 451a - Create valid ife encode action with tcindex and drop control
+ d76c - Create valid ife encode action with tcindex and reclassify control
+ e731 - Create valid ife encode action with tcindex and jump control
+ b7b8 - Create valid ife encode action with tcindex value at 16-bit maximum
+ 2a9c - Create valid ife encode action with mac src parameter
+ cf5c - Create valid ife encode action with mac dst parameter
+ 2353 - Create valid ife encode action with mac src and mac dst parameters
+ 552c - Create valid ife encode action with mark and type parameters
+ 0421 - Create valid ife encode action with prio and type parameters
+ 4017 - Create valid ife encode action with tcindex and type parameters
+ fac3 - Create valid ife encode action with index at 32-bit maximnum
+ 7c25 - Create valid ife decode action with pass control
+ dccb - Create valid ife decode action with pipe control
+ 7bb9 - Create valid ife decode action with continue control
+ d9ad - Create valid ife decode action with drop control
+ 219f - Create valid ife decode action with reclassify control
+ 8f44 - Create valid ife decode action with jump control
+ b330 - Create ife encode action with cookie
+
+Change 'matchPattern' values, allowing '0' and '0x0' if ife type is equal
+to 0, and accepting both '0x' and '0X' otherwise, to let these tests pass
+both with old and new tc binaries.
+While at it, fix a small typo in test case fac3 ('maximnum'->'maximum').
+
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Acked-by: Stephen Hemminger <stephen@networkplumber.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../tc-testing/tc-tests/actions/ife.json | 88 +++++++++----------
+ 1 file changed, 44 insertions(+), 44 deletions(-)
+
+diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
+index 637ea0219617f..0da3545cabdb6 100644
+--- a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
+@@ -17,7 +17,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -41,7 +41,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 10 pipe index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -65,7 +65,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark continue index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*allow mark.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*allow mark.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -89,7 +89,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 789 drop index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*use mark 789.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*use mark 789.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -113,7 +113,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 656768 reclassify index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 656768.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 656768.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -137,7 +137,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 65 jump 1 index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0xED3E.*use mark 65.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0[xX]ED3E.*use mark 65.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -161,7 +161,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295 reclassify index 90",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 90",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 4294967295.*index 90",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 4294967295.*index 90",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -185,7 +185,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295999 pipe index 90",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 90",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark 4294967295999.*index 90",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark 4294967295999.*index 90",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -207,7 +207,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow prio pass index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow prio.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow prio.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -231,7 +231,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 7 pipe index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 7.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 7.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -255,7 +255,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 3 continue index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use prio 3.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use prio 3.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -279,7 +279,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow prio drop index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow prio.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow prio.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -303,7 +303,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 998877 reclassify index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 998877.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 998877.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -327,7 +327,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 998877 jump 10 index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0xED3E.*use prio 998877.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0[xX]ED3E.*use prio 998877.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -351,7 +351,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 4294967295 reclassify index 99",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 99",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 4294967295.*index 99",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 4294967295.*index 99",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -375,7 +375,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 4294967298 pipe index 99",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 99",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 4294967298.*index 99",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 4294967298.*index 99",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -397,7 +397,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex pass index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -421,7 +421,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 111 pipe index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 111.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 111.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -445,7 +445,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -469,7 +469,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -493,7 +493,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex drop index 77",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 77",
+- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow tcindex.*index 77",
++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow tcindex.*index 77",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -517,7 +517,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex reclassify index 77",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 77",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*allow tcindex.*index 77",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*allow tcindex.*index 77",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -541,7 +541,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex jump 999 index 77",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 77",
+- "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0xED3E.*allow tcindex.*index 77",
++ "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0[xX]ED3E.*allow tcindex.*index 77",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -565,7 +565,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 65535 pass index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*use tcindex 65535.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*use tcindex 65535.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -589,7 +589,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 65539 pipe index 1",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 65539.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 65539.*index 1",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -611,7 +611,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark src 00:11:22:33:44:55 pipe index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow mark src 00:11:22:33:44:55.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow mark src 00:11:22:33:44:55.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -635,7 +635,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 9876 dst 00:11:22:33:44:55 reclassify index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -659,7 +659,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex src 00:aa:bb:cc:dd:ee dst 00:11:22:33:44:55 pass index 11",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 11",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -683,7 +683,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 7 type 0xfefe pass index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xFEFE.*use mark 7.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]FEFE.*use mark 7.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -707,7 +707,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 444 type 0xabba pipe index 21",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 21",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xABBA.*use prio 444.*index 21",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ABBA.*use prio 444.*index 21",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -731,7 +731,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 5000 type 0xabcd reclassify index 21",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 21",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xABCD.*use tcindex 5000.*index 21",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ABCD.*use tcindex 5000.*index 21",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -739,7 +739,7 @@
+ },
+ {
+ "id": "fac3",
+- "name": "Create valid ife encode action with index at 32-bit maximnum",
++ "name": "Create valid ife encode action with index at 32-bit maximum",
+ "category": [
+ "actions",
+ "ife"
+@@ -755,7 +755,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 4294967295",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -779,7 +779,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode pass index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action pass.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action pass.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -803,7 +803,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode pipe index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -827,7 +827,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode continue index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action continue.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action continue.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -851,7 +851,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode drop index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action drop.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action drop.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -875,7 +875,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode reclassify index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -899,7 +899,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode jump 10 index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -923,7 +923,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295999",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 4294967295999",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295999",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295999",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -945,7 +945,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark kuka index 4",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 4",
+- "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0xED3E.*allow mark.*index 4",
++ "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0[xX]ED3E.*allow mark.*index 4",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -967,7 +967,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow prio pipe index 4 cookie aabbccddeeff112233445566778800a1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 4",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -991,7 +991,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow foo pipe index 4",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 4",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow foo.*index 4",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow foo.*index 4",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -1013,7 +1013,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow prio type 70000 pipe index 4",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 4",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0x11170.*allow prio.*index 4",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]11170.*allow prio.*index 4",
+ "matchCount": "0",
+ "teardown": []
+ },
+--
+2.19.1
+
--- /dev/null
+From d18de5574235ae33f7e0180daf0d565230dd825d Mon Sep 17 00:00:00 2001
+From: Davide Caratti <dcaratti@redhat.com>
+Date: Fri, 11 Jan 2019 15:08:23 +0100
+Subject: selftests: tc-testing: fix tunnel_key failure if dst_port is
+ unspecified
+
+[ Upstream commit 5216bd77798e2ed773ecd45f3f368dcaec63e5dd ]
+
+After commit 1c25324caf82 ("net/sched: act_tunnel_key: Don't dump dst port
+if it wasn't set"), act_tunnel_key doesn't dump anymore the destination
+port, unless it was explicitly configured. This caused systematic failures
+in the following TDC test case:
+
+ 7a88 - Add tunnel_key action with cookie parameter
+
+Avoid matching zero values of TCA_TUNNEL_KEY_ENC_DST_PORT to let the test
+pass again.
+
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/tc-testing/tc-tests/actions/tunnel_key.json | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
+index af5e99d272296..e7e15a7336b6d 100644
+--- a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
+@@ -605,7 +605,7 @@
+ "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 10.10.10.2 id 7 index 4 cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action tunnel_key index 4",
+- "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*dst_port 0.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
++ "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action tunnel_key"
+--
+2.19.1
+
alsa-hda-realtek-headset-microphone-and-internal-speaker-support-for-system76-oryp5.patch
alsa-hda-realtek-disable-pc-beep-in-passthrough-on-alc285.patch
keys-allow-reaching-the-keys-quotas-exactly.patch
+backlight-pwm_bl-fix-devicetree-parsing-with-auto-ge.patch
+mfd-ti_am335x_tscadc-use-platform_devid_auto-while-r.patch
+pvcalls-front-read-all-data-before-closing-the-conne.patch
+pvcalls-front-don-t-try-to-free-unallocated-rings.patch
+pvcalls-front-properly-allocate-sk.patch
+pvcalls-back-set-enotconn-in-pvcalls_conn_back_read.patch
+mfd-twl-core-fix-section-annotations-on-un-protect_p.patch
+mfd-db8500-prcmu-fix-some-section-annotations.patch
+mfd-mt6397-do-not-call-irq_domain_remove-if-pmic-uns.patch
+mfd-ab8500-core-return-zero-in-get_register_interrup.patch
+mfd-bd9571mwv-add-volatile-register-to-make-dvfs-wor.patch
+mfd-at91-usart-add-platform-dependency.patch
+mfd-qcom_rpm-write-fw_version-to-ctrl_reg.patch
+mfd-wm5110-add-missing-asrc-rate-register.patch
+mfd-axp20x-add-ac-power-supply-cell-for-axp813.patch
+mfd-axp20x-re-align-mfd-cell-entries.patch
+mfd-axp20x-add-supported-cells-for-axp803.patch
+mfd-cros_ec_dev-add-missing-mfd_remove_devices-call-.patch
+mfd-tps65218-use-devm_regmap_add_irq_chip-and-clean-.patch
+mfd-mc13xxx-fix-a-missing-check-of-a-register-read-f.patch
+xen-pvcalls-remove-set-but-not-used-variable-intf.patch
+soc-fsl-qe-fix-err-handling-of-ucc_of_parse_tdm.patch
+qed-fix-qed_chain_set_prod-for-pbl-chains-with-non-p.patch
+qed-fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch
+net-hns-fix-use-after-free-identified-by-slub-debug.patch
+selftests-net-fix-improve-ip_defrag-selftest.patch
+bpf-fix-1-rewrite-in-sys_sendmsg.patch
+selftests-bpf-test-1-rewrite-in-sys_sendmsg-in-test_.patch
+hwmon-nct6775-fix-chip-id-for-nct6798d.patch
+hwmon-nct6775-enable-io-mapping-for-nct6797d-and-nct.patch
+watchdog-mt7621_wdt-rt2880_wdt-fix-compilation-probl.patch
+net-mlx4-get-rid-of-page-operation-after-dma_alloc_c.patch
+mips-ath79-enable-of-serial-ports-in-the-default-con.patch
+xprtrdma-double-free-in-rpcrdma_sendctxs_create.patch
+mlxsw-spectrum_acl-add-cleanup-after-c-tcam-update-e.patch
+mlxsw-spectrum-add-vxlan-dependency-for-spectrum.patch
+selftests-forwarding-add-a-test-for-vlan-deletion.patch
+netfilter-nf_tables-fix-leaking-object-reference-cou.patch
+scsi-qla4xxx-check-return-code-of-qla4xxx_copy_from_.patch
+scsi-isci-initialize-shost-fully-before-calling-scsi.patch
+include-linux-compiler-.h-fix-optimizer_hide_var.patch
+mips-jazz-fix-64bit-build.patch
+netfilter-nft_flow_offload-fix-reverse-route-lookup.patch
+bpf-correctly-set-initial-window-on-active-fast-open.patch
+pvcalls-front-avoid-get_free_pages-gfp_kernel-under-.patch
+selftests-bpf-install-files-tcp_-server-client-.py.patch
+bpf-fix-panic-in-stack_map_get_build_id-on-i386-and-.patch
+afs-set-correct-lock-type-for-the-yfs-createfile.patch
+netfilter-nft_flow_offload-fix-interaction-with-vrf-.patch
+rdma-mthca-clear-qp-objects-during-their-allocation.patch
+powerpc-8xx-fix-setting-of-pagetable-for-abatron-bdi.patch
+acpi-nfit-fix-race-accessing-memdev-in-nfit_get_smbi.patch
+net-stmmac-fix-pci-module-removal-leak.patch
+net-stmmac-dwxgmac2-only-clear-interrupts-that-are-a.patch
+net-stmmac-check-if-cbs-is-supported-before-configur.patch
+net-stmmac-fix-the-logic-of-checking-if-rx-watchdog-.patch
+net-stmmac-prevent-rx-starvation-in-stmmac_napi_poll.patch
+isdn-i4l-isdn_tty-fix-some-concurrency-double-free-b.patch
+scsi-tcmu-avoid-cmd-qfull-timers-updated-whenever-a-.patch
+scsi-ufs-fix-system-suspend-status.patch
+scsi-qedi-add-ep_state-for-login-completion-on-un-re.patch
+scsi-ufs-fix-geometry-descriptor-size.patch
+scsi-qla1280-set-64bit-coherent-mask.patch
+scsi-cxgb4i-add-wait_for_completion.patch
+netfilter-nft_flow_offload-fix-checking-method-of-co.patch
+always-clear-the-x2apic_enable-bit-for-pv-guest.patch
+drm-meson-add-missing-of_node_put.patch
+drm-amdkfd-don-t-assign-dgpus-to-apu-topology-device.patch
+drm-amd-display-fix-pme-notification-not-working-in-.patch
+vhost-return-einval-if-iovecs-size-does-not-match-th.patch
+vhost-scsi-use-copy_to_iter-to-send-control-queue-re.patch
+xsk-check-if-a-queue-exists-during-umem-setup.patch
+selftests-bpf-install-with_tunnels.sh-for-test_flow_.patch
+samples-bpf-workaround-clang-asm-goto-compilation-er.patch
+sunrpc-ensure-rq_bytes_sent-is-reset-before-request-.patch
+sunrpc-ensure-we-respect-the-rpcsec_gss-sequence-num.patch
+drm-sun4i-backend-add-missing-of_node_puts.patch
+pvcalls-front-fix-potential-null-dereference.patch
+acpi-ec-look-for-ecdt-ec-after-calling-acpi_load_tab.patch
+net-phy-micrel-set-soft_reset-callback-to-genphy_sof.patch
+selftests-tc-testing-drop-test-on-missing-tunnel-key.patch
+selftests-tc-testing-fix-tunnel_key-failure-if-dst_p.patch
+selftests-tc-testing-fix-parsing-of-ife-type.patch
+afs-don-t-set-vnode-cb_s_break-in-afs_validate.patch
+afs-fix-key-refcounting-in-file-locking-code.patch
+afs-provide-a-function-to-get-a-ref-on-a-call.patch
+afs-fix-race-in-async-call-refcounting.patch
+bpf-don-t-assume-build-id-length-is-always-20-bytes.patch
+bpf-zero-out-build_id-for-bpf_stack_build_id_ip.patch
+selftests-bpf-retry-tests-that-expect-build-id.patch
+atm-he-fix-sign-extension-overflow-on-large-shift.patch
+hwmon-tmp421-correct-the-misspelling-of-the-tmp442-c.patch
+leds-lp5523-fix-a-missing-check-of-return-value-of-l.patch
+bpf-bpf_setsockopt-reset-sock-dst-on-so_mark-changes.patch
+bpf-fix-so_max_pacing_rate-to-support-tcp-internal-p.patch
+dpaa_eth-netif_f_lltx-requires-to-do-our-own-update-.patch
+mlxsw-pci-return-error-on-pci-reset-timeout.patch
+net-bridge-mark-fdb-entries-that-were-added-by-user-.patch
+mlxsw-spectrum_switchdev-do-not-treat-static-fdb-ent.patch
+selftests-forwarding-add-a-test-case-for-externally-.patch
+bpf-pull-in-pkt_sched.h-header-for-tooling-to-fix-bp.patch
+net-mlx5e-fix-wrong-zero-tx-drop-counter-indication-.patch
+isdn-avm-fix-string-plus-integer-warning-from-clang.patch
--- /dev/null
+From 9cb1517b6cbe55c58a5d8374159a1f776eeedf5d Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Thu, 3 Jan 2019 01:09:53 +0800
+Subject: soc/fsl/qe: fix err handling of ucc_of_parse_tdm
+
+[ Upstream commit 8d68100ab4ad92560a16a68b72e068613ac4d573 ]
+
+Currently there are some issues with the ucc_of_parse_tdm function:
+1, a possible null pointer dereference in ucc_of_parse_tdm,
+detected by the semantic patch deref_null.cocci,
+with the following warning:
+drivers/soc/fsl/qe/qe_tdm.c:177:21-24: ERROR: pdev is NULL but dereferenced.
+2, dev gets modified, so in any case that devm_iounmap() will fail
+even when the new pdev is valid, because the iomap was done with a
+ different pdev.
+3, there is no driver bind with the "fsl,t1040-qe-si" or
+"fsl,t1040-qe-siram" device. So allocating resources using devm_*()
+with these devices won't provide a cleanup path for these resources
+when the caller fails.
+
+This patch fixes them.
+
+Suggested-by: Li Yang <leoyang.li@nxp.com>
+Suggested-by: Christophe LEROY <christophe.leroy@c-s.fr>
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Reviewed-by: Peng Hao <peng.hao2@zte.com.cn>
+CC: Julia Lawall <julia.lawall@lip6.fr>
+CC: Zhao Qiang <qiang.zhao@nxp.com>
+CC: David S. Miller <davem@davemloft.net>
+CC: netdev@vger.kernel.org
+CC: linuxppc-dev@lists.ozlabs.org
+CC: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/fsl_ucc_hdlc.c | 62 +++++++++++++++++++++++++++++++++-
+ drivers/soc/fsl/qe/qe_tdm.c | 55 ------------------------------
+ 2 files changed, 61 insertions(+), 56 deletions(-)
+
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index 4d6409605207c..af13d8cf94ad4 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -1049,6 +1049,54 @@ static const struct net_device_ops uhdlc_ops = {
+ .ndo_tx_timeout = uhdlc_tx_timeout,
+ };
+
++static int hdlc_map_iomem(char *name, int init_flag, void __iomem **ptr)
++{
++ struct device_node *np;
++ struct platform_device *pdev;
++ struct resource *res;
++ static int siram_init_flag;
++ int ret = 0;
++
++ np = of_find_compatible_node(NULL, NULL, name);
++ if (!np)
++ return -EINVAL;
++
++ pdev = of_find_device_by_node(np);
++ if (!pdev) {
++ pr_err("%pOFn: failed to lookup pdev\n", np);
++ of_node_put(np);
++ return -EINVAL;
++ }
++
++ of_node_put(np);
++ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!res) {
++ ret = -EINVAL;
++ goto error_put_device;
++ }
++ *ptr = ioremap(res->start, resource_size(res));
++ if (!*ptr) {
++ ret = -ENOMEM;
++ goto error_put_device;
++ }
++
++ /* We've remapped the addresses, and we don't need the device any
++ * more, so we should release it.
++ */
++ put_device(&pdev->dev);
++
++ if (init_flag && siram_init_flag == 0) {
++ memset_io(*ptr, 0, resource_size(res));
++ siram_init_flag = 1;
++ }
++ return 0;
++
++error_put_device:
++ put_device(&pdev->dev);
++
++ return ret;
++}
++
+ static int ucc_hdlc_probe(struct platform_device *pdev)
+ {
+ struct device_node *np = pdev->dev.of_node;
+@@ -1143,6 +1191,15 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
+ ret = ucc_of_parse_tdm(np, utdm, ut_info);
+ if (ret)
+ goto free_utdm;
++
++ ret = hdlc_map_iomem("fsl,t1040-qe-si", 0,
++ (void __iomem **)&utdm->si_regs);
++ if (ret)
++ goto free_utdm;
++ ret = hdlc_map_iomem("fsl,t1040-qe-siram", 1,
++ (void __iomem **)&utdm->siram);
++ if (ret)
++ goto unmap_si_regs;
+ }
+
+ if (of_property_read_u16(np, "fsl,hmask", &uhdlc_priv->hmask))
+@@ -1151,7 +1208,7 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
+ ret = uhdlc_init(uhdlc_priv);
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to init uhdlc\n");
+- goto free_utdm;
++ goto undo_uhdlc_init;
+ }
+
+ dev = alloc_hdlcdev(uhdlc_priv);
+@@ -1181,6 +1238,9 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
+ free_dev:
+ free_netdev(dev);
+ undo_uhdlc_init:
++ iounmap(utdm->siram);
++unmap_si_regs:
++ iounmap(utdm->si_regs);
+ free_utdm:
+ if (uhdlc_priv->tsa)
+ kfree(utdm);
+diff --git a/drivers/soc/fsl/qe/qe_tdm.c b/drivers/soc/fsl/qe/qe_tdm.c
+index f78c34647ca2d..76480df195a87 100644
+--- a/drivers/soc/fsl/qe/qe_tdm.c
++++ b/drivers/soc/fsl/qe/qe_tdm.c
+@@ -44,10 +44,6 @@ int ucc_of_parse_tdm(struct device_node *np, struct ucc_tdm *utdm,
+ const char *sprop;
+ int ret = 0;
+ u32 val;
+- struct resource *res;
+- struct device_node *np2;
+- static int siram_init_flag;
+- struct platform_device *pdev;
+
+ sprop = of_get_property(np, "fsl,rx-sync-clock", NULL);
+ if (sprop) {
+@@ -124,57 +120,6 @@ int ucc_of_parse_tdm(struct device_node *np, struct ucc_tdm *utdm,
+ utdm->siram_entry_id = val;
+
+ set_si_param(utdm, ut_info);
+-
+- np2 = of_find_compatible_node(NULL, NULL, "fsl,t1040-qe-si");
+- if (!np2)
+- return -EINVAL;
+-
+- pdev = of_find_device_by_node(np2);
+- if (!pdev) {
+- pr_err("%pOFn: failed to lookup pdev\n", np2);
+- of_node_put(np2);
+- return -EINVAL;
+- }
+-
+- of_node_put(np2);
+- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- utdm->si_regs = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(utdm->si_regs)) {
+- ret = PTR_ERR(utdm->si_regs);
+- goto err_miss_siram_property;
+- }
+-
+- np2 = of_find_compatible_node(NULL, NULL, "fsl,t1040-qe-siram");
+- if (!np2) {
+- ret = -EINVAL;
+- goto err_miss_siram_property;
+- }
+-
+- pdev = of_find_device_by_node(np2);
+- if (!pdev) {
+- ret = -EINVAL;
+- pr_err("%pOFn: failed to lookup pdev\n", np2);
+- of_node_put(np2);
+- goto err_miss_siram_property;
+- }
+-
+- of_node_put(np2);
+- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- utdm->siram = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(utdm->siram)) {
+- ret = PTR_ERR(utdm->siram);
+- goto err_miss_siram_property;
+- }
+-
+- if (siram_init_flag == 0) {
+- memset_io(utdm->siram, 0, resource_size(res));
+- siram_init_flag = 1;
+- }
+-
+- return ret;
+-
+-err_miss_siram_property:
+- devm_iounmap(&pdev->dev, utdm->si_regs);
+ return ret;
+ }
+ EXPORT_SYMBOL(ucc_of_parse_tdm);
+--
+2.19.1
+
--- /dev/null
+From 93e32d00ebc1d7d25433017e4b45a4013f2c681b Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trondmy@gmail.com>
+Date: Wed, 2 Jan 2019 17:53:10 -0500
+Subject: SUNRPC: Ensure rq_bytes_sent is reset before request transmission
+
+[ Upstream commit e66721f0436396f779291a29616858b76bfd9415 ]
+
+When we resend a request, ensure that the 'rq_bytes_sent' is reset
+to zero.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/clnt.c | 1 -
+ net/sunrpc/xprt.c | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 24cbddc44c884..2189fbc4c5704 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1738,7 +1738,6 @@ rpc_xdr_encode(struct rpc_task *task)
+ xdr_buf_init(&req->rq_rcv_buf,
+ req->rq_rbuffer,
+ req->rq_rcvsize);
+- req->rq_bytes_sent = 0;
+
+ p = rpc_encode_header(task);
+ if (p == NULL) {
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index 943f08be7c387..f1ec2110efebe 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -1151,6 +1151,7 @@ xprt_request_enqueue_transmit(struct rpc_task *task)
+ struct rpc_xprt *xprt = req->rq_xprt;
+
+ if (xprt_request_need_enqueue_transmit(task, req)) {
++ req->rq_bytes_sent = 0;
+ spin_lock(&xprt->queue_lock);
+ /*
+ * Requests that carry congestion control credits are added
+--
+2.19.1
+
--- /dev/null
+From f159fbe8525642a3cf4bbed106892caa3698d5f3 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trondmy@gmail.com>
+Date: Wed, 2 Jan 2019 17:53:13 -0500
+Subject: SUNRPC: Ensure we respect the RPCSEC_GSS sequence number limit
+
+[ Upstream commit 97b78ae96ba76f4ca2d8f5afee6a2e567ccb8f45 ]
+
+According to RFC2203, the RPCSEC_GSS sequence numbers are bounded to
+an upper limit of MAXSEQ = 0x80000000. Ensure that we handle that
+correctly.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/auth_gss/auth_gss.c | 12 +++++++++---
+ net/sunrpc/clnt.c | 19 ++++++++++++-------
+ 2 files changed, 21 insertions(+), 10 deletions(-)
+
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index ba765473d1f06..efeee5586b2ac 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -1563,8 +1563,10 @@ gss_marshal(struct rpc_task *task, __be32 *p)
+ cred_len = p++;
+
+ spin_lock(&ctx->gc_seq_lock);
+- req->rq_seqno = ctx->gc_seq++;
++ req->rq_seqno = (ctx->gc_seq < MAXSEQ) ? ctx->gc_seq++ : MAXSEQ;
+ spin_unlock(&ctx->gc_seq_lock);
++ if (req->rq_seqno == MAXSEQ)
++ goto out_expired;
+
+ *p++ = htonl((u32) RPC_GSS_VERSION);
+ *p++ = htonl((u32) ctx->gc_proc);
+@@ -1586,14 +1588,18 @@ gss_marshal(struct rpc_task *task, __be32 *p)
+ mic.data = (u8 *)(p + 1);
+ maj_stat = gss_get_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
+ if (maj_stat == GSS_S_CONTEXT_EXPIRED) {
+- clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
++ goto out_expired;
+ } else if (maj_stat != 0) {
+- printk("gss_marshal: gss_get_mic FAILED (%d)\n", maj_stat);
++ pr_warn("gss_marshal: gss_get_mic FAILED (%d)\n", maj_stat);
++ task->tk_status = -EIO;
+ goto out_put_ctx;
+ }
+ p = xdr_encode_opaque(p, NULL, mic.len);
+ gss_put_ctx(ctx);
+ return p;
++out_expired:
++ clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
++ task->tk_status = -EKEYEXPIRED;
+ out_put_ctx:
+ gss_put_ctx(ctx);
+ return NULL;
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 2189fbc4c5704..1ee04e0ec4bca 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1740,11 +1740,8 @@ rpc_xdr_encode(struct rpc_task *task)
+ req->rq_rcvsize);
+
+ p = rpc_encode_header(task);
+- if (p == NULL) {
+- printk(KERN_INFO "RPC: couldn't encode RPC header, exit EIO\n");
+- rpc_exit(task, -EIO);
++ if (p == NULL)
+ return;
+- }
+
+ encode = task->tk_msg.rpc_proc->p_encode;
+ if (encode == NULL)
+@@ -1769,10 +1766,17 @@ call_encode(struct rpc_task *task)
+ /* Did the encode result in an error condition? */
+ if (task->tk_status != 0) {
+ /* Was the error nonfatal? */
+- if (task->tk_status == -EAGAIN || task->tk_status == -ENOMEM)
++ switch (task->tk_status) {
++ case -EAGAIN:
++ case -ENOMEM:
+ rpc_delay(task, HZ >> 4);
+- else
++ break;
++ case -EKEYEXPIRED:
++ task->tk_action = call_refresh;
++ break;
++ default:
+ rpc_exit(task, task->tk_status);
++ }
+ return;
+ }
+
+@@ -2334,7 +2338,8 @@ rpc_encode_header(struct rpc_task *task)
+ *p++ = htonl(clnt->cl_vers); /* program version */
+ *p++ = htonl(task->tk_msg.rpc_proc->p_proc); /* procedure */
+ p = rpcauth_marshcred(task, p);
+- req->rq_slen = xdr_adjust_iovec(&req->rq_svec[0], p);
++ if (p)
++ req->rq_slen = xdr_adjust_iovec(&req->rq_svec[0], p);
+ return p;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 33f04969acc89b7d8cb71a3cc794a0c0e8c8f04d Mon Sep 17 00:00:00 2001
+From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
+Date: Thu, 13 Dec 2018 17:53:50 +0300
+Subject: vhost: return EINVAL if iovecs size does not match the message size
+
+[ Upstream commit 74ad7419489ddade8044e3c9ab064ad656520306 ]
+
+We've failed to copy and process vhost_iotlb_msg so let userspace at
+least know about it. For instance before these patch the code below runs
+without any error:
+
+int main()
+{
+ struct vhost_msg msg;
+ struct iovec iov;
+ int fd;
+
+ fd = open("/dev/vhost-net", O_RDWR);
+ if (fd == -1) {
+ perror("open");
+ return 1;
+ }
+
+ iov.iov_base = &msg;
+ iov.iov_len = sizeof(msg)-4;
+
+ if (writev(fd, &iov,1) == -1) {
+ perror("writev");
+ return 1;
+ }
+
+ return 0;
+}
+
+Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vhost.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 5eaeca805c95c..b214a72d5caad 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -1035,8 +1035,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
+ int type, ret;
+
+ ret = copy_from_iter(&type, sizeof(type), from);
+- if (ret != sizeof(type))
++ if (ret != sizeof(type)) {
++ ret = -EINVAL;
+ goto done;
++ }
+
+ switch (type) {
+ case VHOST_IOTLB_MSG:
+@@ -1055,8 +1057,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
+
+ iov_iter_advance(from, offset);
+ ret = copy_from_iter(&msg, sizeof(msg), from);
+- if (ret != sizeof(msg))
++ if (ret != sizeof(msg)) {
++ ret = -EINVAL;
+ goto done;
++ }
+ if (vhost_process_iotlb_msg(dev, &msg)) {
+ ret = -EFAULT;
+ goto done;
+--
+2.19.1
+
--- /dev/null
+From 1bade9132e49bf778cc567c9196e92a1ef8e0bbc Mon Sep 17 00:00:00 2001
+From: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
+Date: Mon, 3 Dec 2018 16:48:23 -0800
+Subject: vhost/scsi: Use copy_to_iter() to send control queue response
+
+[ Upstream commit 8e5dadfe76cf2862ebf3e4f22adef29982df7766 ]
+
+Uses copy_to_iter() instead of __copy_to_user() in order to ensure we
+support arbitrary layouts and an input buffer split across iov entries.
+
+Fixes: 0d02dbd68c47b ("vhost/scsi: Respond to control queue operations")
+Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/scsi.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index 73a4adeab096b..11bd8b6422ebf 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -1132,16 +1132,18 @@ vhost_scsi_send_tmf_reject(struct vhost_scsi *vs,
+ struct vhost_virtqueue *vq,
+ struct vhost_scsi_ctx *vc)
+ {
+- struct virtio_scsi_ctrl_tmf_resp __user *resp;
+ struct virtio_scsi_ctrl_tmf_resp rsp;
++ struct iov_iter iov_iter;
+ int ret;
+
+ pr_debug("%s\n", __func__);
+ memset(&rsp, 0, sizeof(rsp));
+ rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
+- resp = vq->iov[vc->out].iov_base;
+- ret = __copy_to_user(resp, &rsp, sizeof(rsp));
+- if (!ret)
++
++ iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp));
++
++ ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);
++ if (likely(ret == sizeof(rsp)))
+ vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
+ else
+ pr_err("Faulted on virtio_scsi_ctrl_tmf_resp\n");
+@@ -1152,16 +1154,18 @@ vhost_scsi_send_an_resp(struct vhost_scsi *vs,
+ struct vhost_virtqueue *vq,
+ struct vhost_scsi_ctx *vc)
+ {
+- struct virtio_scsi_ctrl_an_resp __user *resp;
+ struct virtio_scsi_ctrl_an_resp rsp;
++ struct iov_iter iov_iter;
+ int ret;
+
+ pr_debug("%s\n", __func__);
+ memset(&rsp, 0, sizeof(rsp)); /* event_actual = 0 */
+ rsp.response = VIRTIO_SCSI_S_OK;
+- resp = vq->iov[vc->out].iov_base;
+- ret = __copy_to_user(resp, &rsp, sizeof(rsp));
+- if (!ret)
++
++ iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp));
++
++ ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);
++ if (likely(ret == sizeof(rsp)))
+ vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
+ else
+ pr_err("Faulted on virtio_scsi_ctrl_an_resp\n");
+--
+2.19.1
+
--- /dev/null
+From 4f60d003f5e56a9594346532bb03f3eefe317ef0 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neil@brown.name>
+Date: Sun, 30 Dec 2018 14:21:52 +1100
+Subject: watchdog: mt7621_wdt/rt2880_wdt: Fix compilation problem
+
+[ Upstream commit 3aa8b8bbc142eeaac89891de584535ceb7fce405 ]
+
+These files need
+ #include <linux/mod_devicetable.h>
+to compile correctly.
+
+Fixes: ac3167257b9f ("headers: separate linux/mod_devicetable.h from linux/platform_device.h")
+Signed-off-by: NeilBrown <neil@brown.name>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/mt7621_wdt.c | 1 +
+ drivers/watchdog/rt2880_wdt.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/watchdog/mt7621_wdt.c b/drivers/watchdog/mt7621_wdt.c
+index 5c4a764717c4d..81208cd3f4ecb 100644
+--- a/drivers/watchdog/mt7621_wdt.c
++++ b/drivers/watchdog/mt7621_wdt.c
+@@ -17,6 +17,7 @@
+ #include <linux/watchdog.h>
+ #include <linux/moduleparam.h>
+ #include <linux/platform_device.h>
++#include <linux/mod_devicetable.h>
+
+ #include <asm/mach-ralink/ralink_regs.h>
+
+diff --git a/drivers/watchdog/rt2880_wdt.c b/drivers/watchdog/rt2880_wdt.c
+index 98967f0a7d10e..db7c57d82cfdc 100644
+--- a/drivers/watchdog/rt2880_wdt.c
++++ b/drivers/watchdog/rt2880_wdt.c
+@@ -18,6 +18,7 @@
+ #include <linux/watchdog.h>
+ #include <linux/moduleparam.h>
+ #include <linux/platform_device.h>
++#include <linux/mod_devicetable.h>
+
+ #include <asm/mach-ralink/ralink_regs.h>
+
+--
+2.19.1
+
--- /dev/null
+From 8a7ed3df7b16c875cced652dc9955c0cd8fa7e64 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 4 Jan 2019 06:03:40 +0000
+Subject: xen/pvcalls: remove set but not used variable 'intf'
+
+[ Upstream commit 1f8ce09b36c41a026a37a24b20efa32000892a64 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/xen/pvcalls-back.c: In function 'pvcalls_sk_state_change':
+drivers/xen/pvcalls-back.c:286:28: warning:
+ variable 'intf' set but not used [-Wunused-but-set-variable]
+
+It not used since e6587cdbd732 ("pvcalls-back: set -ENOTCONN in
+pvcalls_conn_back_read")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-back.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index 71b628774c6fb..7aa64d1b119c2 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -283,12 +283,10 @@ static int pvcalls_back_socket(struct xenbus_device *dev,
+ static void pvcalls_sk_state_change(struct sock *sock)
+ {
+ struct sock_mapping *map = sock->sk_user_data;
+- struct pvcalls_data_intf *intf;
+
+ if (map == NULL)
+ return;
+
+- intf = map->ring;
+ atomic_inc(&map->read);
+ notify_remote_via_irq(map->irq);
+ }
+--
+2.19.1
+
--- /dev/null
+From 66cbabf1982ef00fd3a488082c50122b739c07cd Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 5 Jan 2019 16:06:48 +0300
+Subject: xprtrdma: Double free in rpcrdma_sendctxs_create()
+
+[ Upstream commit 6e17f58c486d9554341f70aa5b63b8fbed07b3fa ]
+
+The clean up is handled by the caller, rpcrdma_buffer_create(), so this
+call to rpcrdma_sendctxs_destroy() leads to a double free.
+
+Fixes: ae72950abf99 ("xprtrdma: Add data structure to manage RDMA Send arguments")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtrdma/verbs.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 919fddec01973..dffedf1df02ce 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -912,17 +912,13 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt)
+ for (i = 0; i <= buf->rb_sc_last; i++) {
+ sc = rpcrdma_sendctx_create(&r_xprt->rx_ia);
+ if (!sc)
+- goto out_destroy;
++ return -ENOMEM;
+
+ sc->sc_xprt = r_xprt;
+ buf->rb_sc_ctxs[i] = sc;
+ }
+
+ return 0;
+-
+-out_destroy:
+- rpcrdma_sendctxs_destroy(buf);
+- return -ENOMEM;
+ }
+
+ /* The sendctx queue is not guaranteed to have a size that is a
+--
+2.19.1
+
--- /dev/null
+From aaa712e4340d0948437366ace56b851b2a2447c3 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kazimierczak <krzysztof.kazimierczak@intel.com>
+Date: Thu, 10 Jan 2019 20:29:02 +0100
+Subject: xsk: Check if a queue exists during umem setup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit cc5b5d3565048ae57d14e5674a5fb085b2ab0193 ]
+
+In the xdp_umem_assign_dev() path, the xsk code does not
+check if a queue for which umem is to be created exists.
+It leads to a situation where umem is not assigned to any
+Tx/Rx queue of a netdevice, without notifying the stack
+about an error. This affects both XDP_SKB and XDP_DRV
+modes - in case of XDP_DRV_ZC, queue index is checked by
+the driver.
+
+This patch fixes xsk code, so that in both XDP_SKB and
+XDP_DRV mode of AF_XDP, an error is returned when requested
+queue index exceedes an existing maximum.
+
+Fixes: c9b47cc1fabca ("xsk: fix bug when trying to use both copy and zero-copy on one queue id")
+Reported-by: Jakub Spizewski <jakub.spizewski@intel.com>
+Signed-off-by: Krzysztof Kazimierczak <krzysztof.kazimierczak@intel.com>
+Acked-by: Björn Töpel <bjorn.topel@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xdp/xdp_umem.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
+index a264cf2accd0f..d4de871e7d4d7 100644
+--- a/net/xdp/xdp_umem.c
++++ b/net/xdp/xdp_umem.c
+@@ -41,13 +41,20 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
+ * not know if the device has more tx queues than rx, or the opposite.
+ * This might also change during run time.
+ */
+-static void xdp_reg_umem_at_qid(struct net_device *dev, struct xdp_umem *umem,
+- u16 queue_id)
++static int xdp_reg_umem_at_qid(struct net_device *dev, struct xdp_umem *umem,
++ u16 queue_id)
+ {
++ if (queue_id >= max_t(unsigned int,
++ dev->real_num_rx_queues,
++ dev->real_num_tx_queues))
++ return -EINVAL;
++
+ if (queue_id < dev->real_num_rx_queues)
+ dev->_rx[queue_id].umem = umem;
+ if (queue_id < dev->real_num_tx_queues)
+ dev->_tx[queue_id].umem = umem;
++
++ return 0;
+ }
+
+ struct xdp_umem *xdp_get_umem_from_qid(struct net_device *dev,
+@@ -88,7 +95,10 @@ int xdp_umem_assign_dev(struct xdp_umem *umem, struct net_device *dev,
+ goto out_rtnl_unlock;
+ }
+
+- xdp_reg_umem_at_qid(dev, umem, queue_id);
++ err = xdp_reg_umem_at_qid(dev, umem, queue_id);
++ if (err)
++ goto out_rtnl_unlock;
++
+ umem->dev = dev;
+ umem->queue_id = queue_id;
+ if (force_copy)
+--
+2.19.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
