From: Sasha Levin Date: Sat, 23 Feb 2019 21:02:54 +0000 (-0500) Subject: patches for 4.19 X-Git-Tag: v4.9.161~40 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1275a8e3c5d0faaf13ec7d4b1f79902cc6bebb37;p=thirdparty%2Fkernel%2Fstable-queue.git patches for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/acpi-nfit-fix-race-accessing-memdev-in-nfit_get_smbi.patch b/queue-4.19/acpi-nfit-fix-race-accessing-memdev-in-nfit_get_smbi.patch new file mode 100644 index 00000000000..7437574464e --- /dev/null +++ b/queue-4.19/acpi-nfit-fix-race-accessing-memdev-in-nfit_get_smbi.patch @@ -0,0 +1,51 @@ +From 93f244bf886481ba21f2eb10e8408c68d784bd10 Mon Sep 17 00:00:00 2001 +From: Tony Luck +Date: Fri, 11 Jan 2019 14:46:37 -0800 +Subject: acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() + +[ Upstream commit 0919871ac37fdcf46c7657da0f1742efe096b399 ] + +Possible race accessing memdev structures after dropping the +mutex. Dan Williams says this could race against another thread +that is doing: + + # echo "ACPI0012:00" > /sys/bus/acpi/drivers/nfit/unbind + +Reported-by: Jane Chu +Fixes: 23222f8f8dce ("acpi, nfit: Add function to look up nvdimm...") +Signed-off-by: Tony Luck +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/acpi/nfit/core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index ea59c01ce8db0..f530d35412428 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -719,6 +719,7 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags) + struct acpi_nfit_memory_map *memdev; + struct acpi_nfit_desc *acpi_desc; + struct nfit_mem *nfit_mem; ++ u16 physical_id; + + mutex_lock(&acpi_desc_lock); + list_for_each_entry(acpi_desc, &acpi_descs, list) { +@@ -726,10 +727,11 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags) + list_for_each_entry(nfit_mem, &acpi_desc->dimms, list) { + memdev = __to_nfit_memdev(nfit_mem); + if (memdev->device_handle == device_handle) { ++ *flags = memdev->flags; ++ physical_id = memdev->physical_id; + mutex_unlock(&acpi_desc->init_mutex); + mutex_unlock(&acpi_desc_lock); +- *flags = memdev->flags; +- return memdev->physical_id; ++ return physical_id; + } + } + mutex_unlock(&acpi_desc->init_mutex); +-- +2.19.1 + diff --git a/queue-4.19/afs-don-t-set-vnode-cb_s_break-in-afs_validate.patch b/queue-4.19/afs-don-t-set-vnode-cb_s_break-in-afs_validate.patch new file mode 100644 index 00000000000..58e54ba1394 --- /dev/null +++ b/queue-4.19/afs-don-t-set-vnode-cb_s_break-in-afs_validate.patch @@ -0,0 +1,56 @@ +From 8bffc3f379ae0748d5b9301dc22ef7f70313dec7 Mon Sep 17 00:00:00 2001 +From: Marc Dionne +Date: Wed, 9 Jan 2019 17:23:54 +0000 +Subject: afs: Don't set vnode->cb_s_break in afs_validate() + +[ Upstream commit 4882a27cec24319d10f95e978ecc80050e3e3e15 ] + +A cb_interest record is not necessarily attached to the vnode on entry to +afs_validate(), which can cause an oops when we try to bring the vnode's +cb_s_break up to date in the default case (ie. no current callback promise +and the vnode has not been deleted). + +Fix this by simply removing the line, as vnode->cb_s_break will be set when +needed by afs_register_server_cb_interest() when we next get a callback +promise from RPC call. + +The oops looks something like: + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 + ... + RIP: 0010:afs_validate+0x66/0x250 [kafs] + ... + Call Trace: + afs_d_revalidate+0x8d/0x340 [kafs] + ? __d_lookup+0x61/0x150 + lookup_dcache+0x44/0x70 + ? lookup_dcache+0x44/0x70 + __lookup_hash+0x24/0xa0 + do_unlinkat+0x11d/0x2c0 + __x64_sys_unlink+0x23/0x30 + do_syscall_64+0x4d/0xf0 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: ae3b7361dc0e ("afs: Fix validation/callback interaction") +Signed-off-by: Marc Dionne +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + fs/afs/inode.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index 071075d775a95..26aa2d111a28f 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -411,7 +411,6 @@ int afs_validate(struct afs_vnode *vnode, struct key *key) + } else if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) { + valid = true; + } else { +- vnode->cb_s_break = vnode->cb_interest->server->cb_s_break; + vnode->cb_v_break = vnode->volume->cb_v_break; + valid = false; + } +-- +2.19.1 + diff --git a/queue-4.19/afs-fix-key-refcounting-in-file-locking-code.patch b/queue-4.19/afs-fix-key-refcounting-in-file-locking-code.patch new file mode 100644 index 00000000000..cdc5b3fe71f --- /dev/null +++ b/queue-4.19/afs-fix-key-refcounting-in-file-locking-code.patch @@ -0,0 +1,57 @@ +From a216a521a4fbaf05f8ceea73f059cf9b7bfc875b Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 9 Jan 2019 17:23:54 +0000 +Subject: afs: Fix key refcounting in file locking code + +[ Upstream commit 59d49076ae3e6912e6d7df2fd68e2337f3d02036 ] + +Fix the refcounting of the authentication keys in the file locking code. +The vnode->lock_key member points to a key on which it expects to be +holding a ref, but it isn't always given an extra ref, however. + +Fixes: 0fafdc9f888b ("afs: Fix file locking") +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + fs/afs/flock.c | 4 ++-- + fs/afs/inode.c | 2 ++ + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/afs/flock.c b/fs/afs/flock.c +index dc62d15a964b8..1bb300ef362b0 100644 +--- a/fs/afs/flock.c ++++ b/fs/afs/flock.c +@@ -208,7 +208,7 @@ void afs_lock_work(struct work_struct *work) + /* The new front of the queue now owns the state variables. */ + next = list_entry(vnode->pending_locks.next, + struct file_lock, fl_u.afs.link); +- vnode->lock_key = afs_file_key(next->fl_file); ++ vnode->lock_key = key_get(afs_file_key(next->fl_file)); + vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE; + vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB; + goto again; +@@ -413,7 +413,7 @@ static void afs_dequeue_lock(struct afs_vnode *vnode, struct file_lock *fl) + /* The new front of the queue now owns the state variables. */ + next = list_entry(vnode->pending_locks.next, + struct file_lock, fl_u.afs.link); +- vnode->lock_key = afs_file_key(next->fl_file); ++ vnode->lock_key = key_get(afs_file_key(next->fl_file)); + vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE; + vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB; + afs_lock_may_be_available(vnode); +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index 26aa2d111a28f..0726e40db0f8b 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -542,6 +542,8 @@ void afs_evict_inode(struct inode *inode) + #endif + + afs_put_permits(rcu_access_pointer(vnode->permit_cache)); ++ key_put(vnode->lock_key); ++ vnode->lock_key = NULL; + _leave(""); + } + +-- +2.19.1 + diff --git a/queue-4.19/always-clear-the-x2apic_enable-bit-for-pv-guest.patch b/queue-4.19/always-clear-the-x2apic_enable-bit-for-pv-guest.patch new file mode 100644 index 00000000000..bb38f4f638b --- /dev/null +++ b/queue-4.19/always-clear-the-x2apic_enable-bit-for-pv-guest.patch @@ -0,0 +1,39 @@ +From e6a55811aeebb4ad18f8414bf41d6aaf06e0d492 Mon Sep 17 00:00:00 2001 +From: Talons Lee +Date: Mon, 10 Dec 2018 18:03:00 +0800 +Subject: always clear the X2APIC_ENABLE bit for PV guest + +[ Upstream commit 5268c8f39e0efef81af2aaed160272d9eb507beb ] + +Commit e657fcc clears cpu capability bit instead of using fake cpuid +value, the EXTD should always be off for PV guest without depending +on cpuid value. So remove the cpuid check in xen_read_msr_safe() to +always clear the X2APIC_ENABLE bit. + +Signed-off-by: Talons Lee +Reviewed-by: Juergen Gross +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + arch/x86/xen/enlighten_pv.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c +index 52a7c3faee0cc..782f98b332f05 100644 +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -899,10 +899,7 @@ static u64 xen_read_msr_safe(unsigned int msr, int *err) + val = native_read_msr_safe(msr, err); + switch (msr) { + case MSR_IA32_APICBASE: +-#ifdef CONFIG_X86_X2APIC +- if (!(cpuid_ecx(1) & (1 << (X86_FEATURE_X2APIC & 31)))) +-#endif +- val &= ~X2APIC_ENABLE; ++ val &= ~X2APIC_ENABLE; + break; + } + return val; +-- +2.19.1 + diff --git a/queue-4.19/atm-he-fix-sign-extension-overflow-on-large-shift.patch b/queue-4.19/atm-he-fix-sign-extension-overflow-on-large-shift.patch new file mode 100644 index 00000000000..24607db5548 --- /dev/null +++ b/queue-4.19/atm-he-fix-sign-extension-overflow-on-large-shift.patch @@ -0,0 +1,38 @@ +From 5a49feb4e7ac54ad3a7bac942809d06d99ab3903 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Tue, 15 Jan 2019 18:03:38 +0000 +Subject: atm: he: fix sign-extension overflow on large shift + +[ Upstream commit cb12d72b27a6f41325ae23a11033cf5fedfa1b97 ] + +Shifting the 1 by exp by an int can lead to sign-extension overlow when +exp is 31 since 1 is an signed int and sign-extending this result to an +unsigned long long will set the upper 32 bits. Fix this by shifting an +unsigned long. + +Detected by cppcheck: +(warning) Shifting signed 32-bit value by 31 bits is undefined behaviour + +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/he.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/atm/he.c b/drivers/atm/he.c +index 29f102dcfec49..329ce9072ee9f 100644 +--- a/drivers/atm/he.c ++++ b/drivers/atm/he.c +@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev) + instead of '/ 512', use '>> 9' to prevent a call + to divdu3 on x86 platforms + */ +- rate_cps = (unsigned long long) (1 << exp) * (man + 512) >> 9; ++ rate_cps = (unsigned long long) (1UL << exp) * (man + 512) >> 9; + + if (rate_cps < 10) + rate_cps = 10; /* 2.2.1 minimum payload rate is 10 cps */ +-- +2.19.1 + diff --git a/queue-4.19/backlight-pwm_bl-fix-devicetree-parsing-with-auto-ge.patch b/queue-4.19/backlight-pwm_bl-fix-devicetree-parsing-with-auto-ge.patch new file mode 100644 index 00000000000..6838383d31f --- /dev/null +++ b/queue-4.19/backlight-pwm_bl-fix-devicetree-parsing-with-auto-ge.patch @@ -0,0 +1,69 @@ +From e89279979aedf444a2c2034075693b763630d645 Mon Sep 17 00:00:00 2001 +From: Heiko Stuebner +Date: Mon, 12 Nov 2018 10:02:57 +0100 +Subject: backlight: pwm_bl: Fix devicetree parsing with auto-generated + brightness tables + +[ Upstream commit 61170ee9386888f1e6f7e9cc58e8d9a8c2a3c1dd ] + +Commit 88ba95bedb79 ("backlight: pwm_bl: Compute brightness of LED linearly +to human eye") made the parse-dt function return early when using an auto- +generated brightness-table, but didn't take into account that some more +settings were handled below the brightness handling, like power-on-delays +and also setting the pdata enable-gpio to -EINVAL. + +This surfaces for example in the case of a backlight without any +enable-gpio which then tries to use gpio-0 in error. + +Fix this by simply moving the trailing settings above the brightness +handling. + +Fixes: 88ba95bedb79 ("backlight: pwm_bl: Compute brightness of LED linearly to human eye") +Signed-off-by: Heiko Stuebner +Acked-by: Daniel Thompson +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/pwm_bl.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c +index bdfcc0a71db14..6bde543452f25 100644 +--- a/drivers/video/backlight/pwm_bl.c ++++ b/drivers/video/backlight/pwm_bl.c +@@ -262,6 +262,16 @@ static int pwm_backlight_parse_dt(struct device *dev, + + memset(data, 0, sizeof(*data)); + ++ /* ++ * These values are optional and set as 0 by default, the out values ++ * are modified only if a valid u32 value can be decoded. ++ */ ++ of_property_read_u32(node, "post-pwm-on-delay-ms", ++ &data->post_pwm_on_delay); ++ of_property_read_u32(node, "pwm-off-delay-ms", &data->pwm_off_delay); ++ ++ data->enable_gpio = -EINVAL; ++ + /* + * Determine the number of brightness levels, if this property is not + * set a default table of brightness levels will be used. +@@ -374,15 +384,6 @@ static int pwm_backlight_parse_dt(struct device *dev, + data->max_brightness--; + } + +- /* +- * These values are optional and set as 0 by default, the out values +- * are modified only if a valid u32 value can be decoded. +- */ +- of_property_read_u32(node, "post-pwm-on-delay-ms", +- &data->post_pwm_on_delay); +- of_property_read_u32(node, "pwm-off-delay-ms", &data->pwm_off_delay); +- +- data->enable_gpio = -EINVAL; + return 0; + } + +-- +2.19.1 + diff --git a/queue-4.19/bpf-bpf_setsockopt-reset-sock-dst-on-so_mark-changes.patch b/queue-4.19/bpf-bpf_setsockopt-reset-sock-dst-on-so_mark-changes.patch new file mode 100644 index 00000000000..b37fbe96407 --- /dev/null +++ b/queue-4.19/bpf-bpf_setsockopt-reset-sock-dst-on-so_mark-changes.patch @@ -0,0 +1,44 @@ +From 0f1764e6318e4a25755a0d8c750ea6068f285de7 Mon Sep 17 00:00:00 2001 +From: Peter Oskolkov +Date: Wed, 16 Jan 2019 08:47:54 -0800 +Subject: bpf: bpf_setsockopt: reset sock dst on SO_MARK changes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit f4924f24da8c7ef64195096817f3cde324091d97 ] + +In sock_setsockopt() (net/core/sock.h), when SO_MARK option is used +to change sk_mark, sk_dst_reset(sk) is called. The same should be +done in bpf_setsockopt(). + +Fixes: 8c4b4c7e9ff0 ("bpf: Add setsockopt helper function to bpf") +Reported-by: Maciej Żenczykowski +Signed-off-by: Peter Oskolkov +Acked-by: Martin KaFai Lau +Reviewed-by: Maciej Żenczykowski +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 3400c7abda135..fb0080e84bd43 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -3930,7 +3930,10 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock, + sk->sk_rcvlowat = val ? : 1; + break; + case SO_MARK: +- sk->sk_mark = val; ++ if (sk->sk_mark != val) { ++ sk->sk_mark = val; ++ sk_dst_reset(sk); ++ } + break; + default: + ret = -EINVAL; +-- +2.19.1 + diff --git a/queue-4.19/bpf-correctly-set-initial-window-on-active-fast-open.patch b/queue-4.19/bpf-correctly-set-initial-window-on-active-fast-open.patch new file mode 100644 index 00000000000..c45d9fd335f --- /dev/null +++ b/queue-4.19/bpf-correctly-set-initial-window-on-active-fast-open.patch @@ -0,0 +1,39 @@ +From 8df4a9c1a6bcea88ccf67c28c1309bec1ce5eaa6 Mon Sep 17 00:00:00 2001 +From: Yuchung Cheng +Date: Tue, 8 Jan 2019 18:12:24 -0800 +Subject: bpf: correctly set initial window on active Fast Open sender + +[ Upstream commit 31aa6503a15ba00182ea6dbbf51afb63bf9e851d ] + +The existing BPF TCP initial congestion window (TCP_BPF_IW) does not +to work on (active) Fast Open sender. This is because it changes the +(initial) window only if data_segs_out is zero -- but data_segs_out +is also incremented on SYN-data. This patch fixes the issue by +proerly accounting for SYN-data additionally. + +Fixes: fc7478103c84 ("bpf: Adds support for setting initial cwnd") +Signed-off-by: Yuchung Cheng +Reviewed-by: Neal Cardwell +Acked-by: Lawrence Brakmo +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 8c2411fb25090..3400c7abda135 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -4001,7 +4001,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock, + /* Only some options are supported */ + switch (optname) { + case TCP_BPF_IW: +- if (val <= 0 || tp->data_segs_out > 0) ++ if (val <= 0 || tp->data_segs_out > tp->syn_data) + ret = -EINVAL; + else + tp->snd_cwnd = val; +-- +2.19.1 + diff --git a/queue-4.19/bpf-don-t-assume-build-id-length-is-always-20-bytes.patch b/queue-4.19/bpf-don-t-assume-build-id-length-is-always-20-bytes.patch new file mode 100644 index 00000000000..99ccbf620e6 --- /dev/null +++ b/queue-4.19/bpf-don-t-assume-build-id-length-is-always-20-bytes.patch @@ -0,0 +1,54 @@ +From 1a8669751d37804b60ac94eaf45f2a64e0259250 Mon Sep 17 00:00:00 2001 +From: Stanislav Fomichev +Date: Wed, 16 Jan 2019 14:03:15 -0800 +Subject: bpf: don't assume build-id length is always 20 bytes + +[ Upstream commit 0b698005a9d11c0e91141ec11a2c4918a129f703 ] + +Build-id length is not fixed to 20, it can be (`man ld` /--build-id): + * 128-bit (uuid) + * 160-bit (sha1) + * any length specified in ld --build-id=0xhexstring + +To fix the issue of missing BPF_STACK_BUILD_ID_VALID for shorter build-ids, +assume that build-id is somewhere in the range of 1 .. 20. +Set the remaining bytes to zero. + +v2: +* don't introduce new "len = min(BPF_BUILD_ID_SIZE, nhdr->n_descsz)", + we already know that nhdr->n_descsz <= BPF_BUILD_ID_SIZE if we enter + this 'if' condition + +Fixes: 615755a77b24 ("bpf: extend stackmap to save binary_build_id+offset instead of address") +Acked-by: Song Liu +Signed-off-by: Stanislav Fomichev +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + kernel/bpf/stackmap.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index e50ef5bca4213..98ad9dc3587aa 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -180,11 +180,14 @@ static inline int stack_map_parse_build_id(void *page_addr, + + if (nhdr->n_type == BPF_BUILD_ID && + nhdr->n_namesz == sizeof("GNU") && +- nhdr->n_descsz == BPF_BUILD_ID_SIZE) { ++ nhdr->n_descsz > 0 && ++ nhdr->n_descsz <= BPF_BUILD_ID_SIZE) { + memcpy(build_id, + note_start + note_offs + + ALIGN(sizeof("GNU"), 4) + sizeof(Elf32_Nhdr), +- BPF_BUILD_ID_SIZE); ++ nhdr->n_descsz); ++ memset(build_id + nhdr->n_descsz, 0, ++ BPF_BUILD_ID_SIZE - nhdr->n_descsz); + return 0; + } + new_offs = note_offs + sizeof(Elf32_Nhdr) + +-- +2.19.1 + diff --git a/queue-4.19/bpf-fix-1-rewrite-in-sys_sendmsg.patch b/queue-4.19/bpf-fix-1-rewrite-in-sys_sendmsg.patch new file mode 100644 index 00000000000..0a9c71111b5 --- /dev/null +++ b/queue-4.19/bpf-fix-1-rewrite-in-sys_sendmsg.patch @@ -0,0 +1,64 @@ +From 5751034dc1a557f6e10575b9ad4d291488c3ab71 Mon Sep 17 00:00:00 2001 +From: Andrey Ignatov +Date: Fri, 4 Jan 2019 01:07:07 -0800 +Subject: bpf: Fix [::] -> [::1] rewrite in sys_sendmsg + +[ Upstream commit e8e36984080b55ac5e57bdb09a5b570f2fc8e963 ] + +sys_sendmsg has supported unspecified destination IPv6 (wildcard) for +unconnected UDP sockets since 876c7f41. When [::] is passed by user as +destination, sys_sendmsg rewrites it with [::1] to be consistent with +BSD (see "BSD'ism" comment in the code). + +This didn't work when cgroup-bpf was enabled though since the rewrite +[::] -> [::1] happened before passing control to cgroup-bpf block where +fl6.daddr was updated with passed by user sockaddr_in6.sin6_addr (that +might or might not be changed by BPF program). That way if user passed +[::] as dst IPv6 it was first rewritten with [::1] by original code from +876c7f41, but then rewritten back with [::] by cgroup-bpf block. + +It happened even when BPF_CGROUP_UDP6_SENDMSG program was not present +(CONFIG_CGROUP_BPF=y was enough). + +The fix is to apply BSD'ism after cgroup-bpf block so that [::] is +replaced with [::1] no matter where it came from: passed by user to +sys_sendmsg or set by BPF_CGROUP_UDP6_SENDMSG program. + +Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") +Reported-by: Nitin Rawat +Signed-off-by: Andrey Ignatov +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/ipv6/udp.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 76ba2f34ef6b1..cab8b2b647f96 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1322,10 +1322,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + ipc6.opt = opt; + + fl6.flowi6_proto = sk->sk_protocol; +- if (!ipv6_addr_any(daddr)) +- fl6.daddr = *daddr; +- else +- fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */ ++ fl6.daddr = *daddr; + if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr)) + fl6.saddr = np->saddr; + fl6.fl6_sport = inet->inet_sport; +@@ -1353,6 +1350,9 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + } + } + ++ if (ipv6_addr_any(&fl6.daddr)) ++ fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */ ++ + final_p = fl6_update_dst(&fl6, opt, &final); + if (final_p) + connected = false; +-- +2.19.1 + diff --git a/queue-4.19/bpf-fix-panic-in-stack_map_get_build_id-on-i386-and-.patch b/queue-4.19/bpf-fix-panic-in-stack_map_get_build_id-on-i386-and-.patch new file mode 100644 index 00000000000..1ae910a0e01 --- /dev/null +++ b/queue-4.19/bpf-fix-panic-in-stack_map_get_build_id-on-i386-and-.patch @@ -0,0 +1,47 @@ +From ba1d248070c44619302d1c81351900ba73a66a2b Mon Sep 17 00:00:00 2001 +From: Song Liu +Date: Tue, 8 Jan 2019 14:20:44 -0800 +Subject: bpf: fix panic in stack_map_get_build_id() on i386 and arm32 + +[ Upstream commit beaf3d1901f4ea46fbd5c9d857227d99751de469 ] + +As Naresh reported, test_stacktrace_build_id() causes panic on i386 and +arm32 systems. This is caused by page_address() returns NULL in certain +cases. + +This patch fixes this error by using kmap_atomic/kunmap_atomic instead +of page_address. + +Fixes: 615755a77b24 (" bpf: extend stackmap to save binary_build_id+offset instead of address") +Reported-by: Naresh Kamboju +Signed-off-by: Song Liu +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + kernel/bpf/stackmap.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index 8061a439ef18c..e50ef5bca4213 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -260,7 +260,7 @@ static int stack_map_get_build_id(struct vm_area_struct *vma, + return -EFAULT; /* page not mapped */ + + ret = -EINVAL; +- page_addr = page_address(page); ++ page_addr = kmap_atomic(page); + ehdr = (Elf32_Ehdr *)page_addr; + + /* compare magic x7f "ELF" */ +@@ -276,6 +276,7 @@ static int stack_map_get_build_id(struct vm_area_struct *vma, + else if (ehdr->e_ident[EI_CLASS] == ELFCLASS64) + ret = stack_map_get_build_id_64(page_addr, build_id); + out: ++ kunmap_atomic(page_addr); + put_page(page); + return ret; + } +-- +2.19.1 + diff --git a/queue-4.19/bpf-zero-out-build_id-for-bpf_stack_build_id_ip.patch b/queue-4.19/bpf-zero-out-build_id-for-bpf_stack_build_id_ip.patch new file mode 100644 index 00000000000..063c7a7185c --- /dev/null +++ b/queue-4.19/bpf-zero-out-build_id-for-bpf_stack_build_id_ip.patch @@ -0,0 +1,44 @@ +From db8362d9769b99502f8087f88dcef13cee35889e Mon Sep 17 00:00:00 2001 +From: Stanislav Fomichev +Date: Wed, 16 Jan 2019 14:03:16 -0800 +Subject: bpf: zero out build_id for BPF_STACK_BUILD_ID_IP + +[ Upstream commit 4af396ae4836c4ecab61e975b8e61270c551894d ] + +When returning BPF_STACK_BUILD_ID_IP from stack_map_get_build_id_offset, +make sure that build_id field is empty. Since we are using percpu +free list, there is a possibility that we might reuse some previous +bpf_stack_build_id with non-zero build_id. + +Fixes: 615755a77b24 ("bpf: extend stackmap to save binary_build_id+offset instead of address") +Acked-by: Song Liu +Signed-off-by: Stanislav Fomichev +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + kernel/bpf/stackmap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index 98ad9dc3587aa..6a32933cae4ff 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -314,6 +314,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, + for (i = 0; i < trace_nr; i++) { + id_offs[i].status = BPF_STACK_BUILD_ID_IP; + id_offs[i].ip = ips[i]; ++ memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE); + } + return; + } +@@ -324,6 +325,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs, + /* per entry fall back to ips */ + id_offs[i].status = BPF_STACK_BUILD_ID_IP; + id_offs[i].ip = ips[i]; ++ memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE); + continue; + } + id_offs[i].offset = (vma->vm_pgoff << PAGE_SHIFT) + ips[i] +-- +2.19.1 + diff --git a/queue-4.19/dpaa_eth-netif_f_lltx-requires-to-do-our-own-update-.patch b/queue-4.19/dpaa_eth-netif_f_lltx-requires-to-do-our-own-update-.patch new file mode 100644 index 00000000000..f219a2261f4 --- /dev/null +++ b/queue-4.19/dpaa_eth-netif_f_lltx-requires-to-do-our-own-update-.patch @@ -0,0 +1,44 @@ +From c69eb8583025f95a8ea24c69bcf3dd2cf82f2e62 Mon Sep 17 00:00:00 2001 +From: Madalin Bucur +Date: Thu, 17 Jan 2019 11:42:27 +0200 +Subject: dpaa_eth: NETIF_F_LLTX requires to do our own update of trans_start + +[ Upstream commit c6ddfb9a963f0cac0f7365acfc87f3f3b33a3b69 ] + +As txq_trans_update() only updates trans_start when the lock is held, +trans_start does not get updated if NETIF_F_LLTX is declared. + +Signed-off-by: Madalin Bucur +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index 65a22cd9aef26..029730bbe7db1 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -2052,6 +2052,7 @@ static int dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) + bool nonlinear = skb_is_nonlinear(skb); + struct rtnl_link_stats64 *percpu_stats; + struct dpaa_percpu_priv *percpu_priv; ++ struct netdev_queue *txq; + struct dpaa_priv *priv; + struct qm_fd fd; + int offset = 0; +@@ -2101,6 +2102,11 @@ static int dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) + if (unlikely(err < 0)) + goto skb_to_fd_failed; + ++ txq = netdev_get_tx_queue(net_dev, queue_mapping); ++ ++ /* LLTX requires to do our own update of trans_start */ ++ txq->trans_start = jiffies; ++ + if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) { + fd.cmd |= cpu_to_be32(FM_FD_CMD_UPD); + skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; +-- +2.19.1 + diff --git a/queue-4.19/drm-amd-display-fix-pme-notification-not-working-in-.patch b/queue-4.19/drm-amd-display-fix-pme-notification-not-working-in-.patch new file mode 100644 index 00000000000..87570428a4b --- /dev/null +++ b/queue-4.19/drm-amd-display-fix-pme-notification-not-working-in-.patch @@ -0,0 +1,54 @@ +From eac4c053d6dc01c1837368d366fd3dadea18f422 Mon Sep 17 00:00:00 2001 +From: Charlene Liu +Date: Wed, 12 Dec 2018 18:09:16 -0500 +Subject: drm/amd/display: fix PME notification not working in RV desktop + +[ Upstream commit 20300db4aec5ba5edf6f0ad6f7111a51fbea7e10 ] + +[Why] +PPLIB not receive the PME when unplug. + +Signed-off-by: Charlene Liu +Reviewed-by: Chris Park +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +index 580e7e82034fa..53ccacf99eca4 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +@@ -1000,7 +1000,7 @@ void dce110_enable_audio_stream(struct pipe_ctx *pipe_ctx) + + pipe_ctx->stream_res.audio->funcs->az_enable(pipe_ctx->stream_res.audio); + +- if (num_audio == 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL) ++ if (num_audio >= 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL) + /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/ + pp_smu->set_pme_wa_enable(&pp_smu->pp_smu); + /* un-mute audio */ +@@ -1017,6 +1017,8 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option) + pipe_ctx->stream_res.stream_enc->funcs->audio_mute_control( + pipe_ctx->stream_res.stream_enc, true); + if (pipe_ctx->stream_res.audio) { ++ struct pp_smu_funcs_rv *pp_smu = dc->res_pool->pp_smu; ++ + if (option != KEEP_ACQUIRED_RESOURCE || + !dc->debug.az_endpoint_mute_only) { + /*only disalbe az_endpoint if power down or free*/ +@@ -1036,6 +1038,9 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option) + update_audio_usage(&dc->current_state->res_ctx, dc->res_pool, pipe_ctx->stream_res.audio, false); + pipe_ctx->stream_res.audio = NULL; + } ++ if (pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL) ++ /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/ ++ pp_smu->set_pme_wa_enable(&pp_smu->pp_smu); + + /* TODO: notify audio driver for if audio modes list changed + * add audio mode list change flag */ +-- +2.19.1 + diff --git a/queue-4.19/drm-amdkfd-don-t-assign-dgpus-to-apu-topology-device.patch b/queue-4.19/drm-amdkfd-don-t-assign-dgpus-to-apu-topology-device.patch new file mode 100644 index 00000000000..b7a7e1716f6 --- /dev/null +++ b/queue-4.19/drm-amdkfd-don-t-assign-dgpus-to-apu-topology-device.patch @@ -0,0 +1,58 @@ +From 7d0c6a2f552796a1f03c24c79e7759afd65c15a4 Mon Sep 17 00:00:00 2001 +From: Felix Kuehling +Date: Wed, 2 Jan 2019 17:47:39 -0500 +Subject: drm/amdkfd: Don't assign dGPUs to APU topology devices + +[ Upstream commit bbdf514fe5648566b0754476cbcb92ac3422dde2 ] + +dGPUs need their own topology devices. Don't assign them to APU topology +devices with CPU cores. + +Bug: https://github.com/RadeonOpenCompute/ROCK-Kernel-Driver/issues/66 +Signed-off-by: Felix Kuehling +Tested-by: Elias Konstantinidis +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +index 80f5db4ef75fd..0805c423a5ce0 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +@@ -1072,8 +1072,6 @@ static uint32_t kfd_generate_gpu_id(struct kfd_dev *gpu) + * the GPU device is not already present in the topology device + * list then return NULL. This means a new topology device has to + * be created for this GPU. +- * TODO: Rather than assiging @gpu to first topology device withtout +- * gpu attached, it will better to have more stringent check. + */ + static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu) + { +@@ -1081,12 +1079,20 @@ static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu) + struct kfd_topology_device *out_dev = NULL; + + down_write(&topology_lock); +- list_for_each_entry(dev, &topology_device_list, list) ++ list_for_each_entry(dev, &topology_device_list, list) { ++ /* Discrete GPUs need their own topology device list ++ * entries. Don't assign them to CPU/APU nodes. ++ */ ++ if (!gpu->device_info->needs_iommu_device && ++ dev->node_props.cpu_cores_count) ++ continue; ++ + if (!dev->gpu && (dev->node_props.simd_count > 0)) { + dev->gpu = gpu; + out_dev = dev; + break; + } ++ } + up_write(&topology_lock); + return out_dev; + } +-- +2.19.1 + diff --git a/queue-4.19/drm-meson-add-missing-of_node_put.patch b/queue-4.19/drm-meson-add-missing-of_node_put.patch new file mode 100644 index 00000000000..8645c61d9b3 --- /dev/null +++ b/queue-4.19/drm-meson-add-missing-of_node_put.patch @@ -0,0 +1,76 @@ +From 6666ae93a8872a4772ba168db0a1dd94b7a4ce03 Mon Sep 17 00:00:00 2001 +From: Julia Lawall +Date: Sun, 13 Jan 2019 10:44:51 +0100 +Subject: drm/meson: add missing of_node_put + +[ Upstream commit f672b93e4a0a4947d2e1103ed8780e01e13eadb6 ] + +Add an of_node_put when the result of of_graph_get_remote_port_parent is +not available. + +An of_node_put is also needed when meson_probe_remote completes. This was +present at the recursive call, but not in the call from meson_drv_probe. + +The semantic match that finds this problem is as follows +(http://coccinelle.lip6.fr): + +// +@r exists@ +local idexpression e; +expression x; +@@ +e = of_graph_get_remote_port_parent(...); +... when != x = e + when != true e == NULL + when != of_node_put(e) + when != of_fwnode_handle(e) +( +return e; +| +*return ...; +) +// + +Signed-off-by: Julia Lawall +Acked-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/1547372691-28324-4-git-send-email-Julia.Lawall@lip6.fr +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_drv.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index bf5f294f172fa..611ac340fb289 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -368,8 +368,10 @@ static int meson_probe_remote(struct platform_device *pdev, + remote_node = of_graph_get_remote_port_parent(ep); + if (!remote_node || + remote_node == parent || /* Ignore parent endpoint */ +- !of_device_is_available(remote_node)) ++ !of_device_is_available(remote_node)) { ++ of_node_put(remote_node); + continue; ++ } + + count += meson_probe_remote(pdev, match, remote, remote_node); + +@@ -388,10 +390,13 @@ static int meson_drv_probe(struct platform_device *pdev) + + for_each_endpoint_of_node(np, ep) { + remote = of_graph_get_remote_port_parent(ep); +- if (!remote || !of_device_is_available(remote)) ++ if (!remote || !of_device_is_available(remote)) { ++ of_node_put(remote); + continue; ++ } + + count += meson_probe_remote(pdev, &match, np, remote); ++ of_node_put(remote); + } + + if (count && !match) +-- +2.19.1 + diff --git a/queue-4.19/drm-sun4i-backend-add-missing-of_node_puts.patch b/queue-4.19/drm-sun4i-backend-add-missing-of_node_puts.patch new file mode 100644 index 00000000000..17daf8804c2 --- /dev/null +++ b/queue-4.19/drm-sun4i-backend-add-missing-of_node_puts.patch @@ -0,0 +1,72 @@ +From d3a0a9408a2c25986f04a5a967b5f4f1c272d662 Mon Sep 17 00:00:00 2001 +From: Julia Lawall +Date: Sun, 13 Jan 2019 09:47:44 +0100 +Subject: drm/sun4i: backend: add missing of_node_puts + +[ Upstream commit 4bb0e6d7258213d4893c2c876712fbba40e712fe ] + +The device node iterators perform an of_node_get on each +iteration, so a jump out of the loop requires an of_node_put. + +Remote and port also have augmented reference counts, so drop them +on each iteration and at the end of the function, respectively. +Remote is only used for the address it contains, not for the +contents of that address, so the reference count can be dropped +immediately. + +The semantic patch that fixes the first part of this problem is +as follows (http://coccinelle.lip6.fr): + +// +@@ +expression root,e; +local idexpression child; +iterator name for_each_child_of_node; +@@ + + for_each_available_child_of_node(root, child) { + ... when != of_node_put(child) + when != e = child ++ of_node_put(child); +? break; + ... +} +... when != child +// + +Signed-off-by: Julia Lawall +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/1547369264-24831-5-git-send-email-Julia.Lawall@lip6.fr +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun4i_backend.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c +index d7950b52a1fd9..e30b1f5b9d91a 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_backend.c ++++ b/drivers/gpu/drm/sun4i/sun4i_backend.c +@@ -717,17 +717,18 @@ static struct sun4i_frontend *sun4i_backend_find_frontend(struct sun4i_drv *drv, + remote = of_graph_get_remote_port_parent(ep); + if (!remote) + continue; ++ of_node_put(remote); + + /* does this node match any registered engines? */ + list_for_each_entry(frontend, &drv->frontend_list, list) { + if (remote == frontend->node) { +- of_node_put(remote); + of_node_put(port); ++ of_node_put(ep); + return frontend; + } + } + } +- ++ of_node_put(port); + return ERR_PTR(-EINVAL); + } + +-- +2.19.1 + diff --git a/queue-4.19/hwmon-tmp421-correct-the-misspelling-of-the-tmp442-c.patch b/queue-4.19/hwmon-tmp421-correct-the-misspelling-of-the-tmp442-c.patch new file mode 100644 index 00000000000..49164da08f9 --- /dev/null +++ b/queue-4.19/hwmon-tmp421-correct-the-misspelling-of-the-tmp442-c.patch @@ -0,0 +1,35 @@ +From d2a7ef07c82e273bc7b2765de9f80e308b8c643b Mon Sep 17 00:00:00 2001 +From: Cheng-Min Ao +Date: Mon, 7 Jan 2019 14:29:32 +0800 +Subject: hwmon: (tmp421) Correct the misspelling of the tmp442 compatible + attribute in OF device ID table + +[ Upstream commit f422449b58548a41e98fc97b259a283718e527db ] + +Correct a typo in OF device ID table +The last one should be 'ti,tmp442' + +Signed-off-by: Cheng-Min Ao +Signed-off-by: Yu-Hsiang Chen +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/tmp421.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c +index e36399213324d..ceb3db6f3fdda 100644 +--- a/drivers/hwmon/tmp421.c ++++ b/drivers/hwmon/tmp421.c +@@ -88,7 +88,7 @@ static const struct of_device_id tmp421_of_match[] = { + .data = (void *)2 + }, + { +- .compatible = "ti,tmp422", ++ .compatible = "ti,tmp442", + .data = (void *)3 + }, + { }, +-- +2.19.1 + diff --git a/queue-4.19/include-linux-compiler-.h-fix-optimizer_hide_var.patch b/queue-4.19/include-linux-compiler-.h-fix-optimizer_hide_var.patch new file mode 100644 index 00000000000..c38383b8922 --- /dev/null +++ b/queue-4.19/include-linux-compiler-.h-fix-optimizer_hide_var.patch @@ -0,0 +1,101 @@ +From f1deb5e13c592ca6e0239b051820f7781691bfbb Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" +Date: Wed, 2 Jan 2019 15:57:49 -0500 +Subject: include/linux/compiler*.h: fix OPTIMIZER_HIDE_VAR + +[ Upstream commit 3e2ffd655cc6a694608d997738989ff5572a8266 ] + +Since commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h +mutually exclusive") clang no longer reuses the OPTIMIZER_HIDE_VAR macro +from compiler-gcc - instead it gets the version in +include/linux/compiler.h. Unfortunately that version doesn't actually +prevent compiler from optimizing out the variable. + +Fix up by moving the macro out from compiler-gcc.h to compiler.h. +Compilers without incline asm support will keep working +since it's protected by an ifdef. + +Also fix up comments to match reality since we are no longer overriding +any macros. + +Build-tested with gcc and clang. + +Fixes: 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive") +Cc: Eli Friedman +Cc: Joe Perches +Cc: Linus Torvalds +Reviewed-by: Nick Desaulniers +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Miguel Ojeda +Signed-off-by: Sasha Levin +--- + include/linux/compiler-clang.h | 5 ++--- + include/linux/compiler-gcc.h | 4 ---- + include/linux/compiler-intel.h | 4 +--- + include/linux/compiler.h | 4 +++- + 4 files changed, 6 insertions(+), 11 deletions(-) + +diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h +index b1ce500fe8b3d..d756f2318efe0 100644 +--- a/include/linux/compiler-clang.h ++++ b/include/linux/compiler-clang.h +@@ -3,9 +3,8 @@ + #error "Please don't include directly, include instead." + #endif + +-/* Some compiler specific definitions are overwritten here +- * for Clang compiler +- */ ++/* Compiler specific definitions for Clang compiler */ ++ + #define uninitialized_var(x) x = *(&(x)) + + /* same as gcc, this was present in clang-2.6 so we can assume it works +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index 0242f6eec4eaf..a8ff0ca0c3213 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -58,10 +58,6 @@ + (typeof(ptr)) (__ptr + (off)); \ + }) + +-/* Make the optimizer believe the variable can be manipulated arbitrarily. */ +-#define OPTIMIZER_HIDE_VAR(var) \ +- __asm__ ("" : "=r" (var) : "0" (var)) +- + /* + * A trick to suppress uninitialized variable warning without generating any + * code +diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h +index 4c7f9befa9f6c..f1fc60f103176 100644 +--- a/include/linux/compiler-intel.h ++++ b/include/linux/compiler-intel.h +@@ -5,9 +5,7 @@ + + #ifdef __ECC + +-/* Some compiler specific definitions are overwritten here +- * for Intel ECC compiler +- */ ++/* Compiler specific definitions for Intel ECC compiler */ + + #include + +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index 681d866efb1eb..269d376f5a119 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -158,7 +158,9 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val, + #endif + + #ifndef OPTIMIZER_HIDE_VAR +-#define OPTIMIZER_HIDE_VAR(var) barrier() ++/* Make the optimizer believe the variable can be manipulated arbitrarily. */ ++#define OPTIMIZER_HIDE_VAR(var) \ ++ __asm__ ("" : "=r" (var) : "0" (var)) + #endif + + /* Not-quite-unique ID. */ +-- +2.19.1 + diff --git a/queue-4.19/isdn-avm-fix-string-plus-integer-warning-from-clang.patch b/queue-4.19/isdn-avm-fix-string-plus-integer-warning-from-clang.patch new file mode 100644 index 00000000000..6414c098250 --- /dev/null +++ b/queue-4.19/isdn-avm-fix-string-plus-integer-warning-from-clang.patch @@ -0,0 +1,48 @@ +From e960b78c80da4b62e60c38b37c37c97b2971a22b Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Wed, 9 Jan 2019 22:41:08 -0700 +Subject: isdn: avm: Fix string plus integer warning from Clang + +[ Upstream commit 7afa81c55fca0cad589722cb4bce698b4803b0e1 ] + +A recent commit in Clang expanded the -Wstring-plus-int warning, showing +some odd behavior in this file. + +drivers/isdn/hardware/avm/b1.c:426:30: warning: adding 'int' to a string does not append to the string [-Wstring-plus-int] + cinfo->version[j] = "\0\0" + 1; + ~~~~~~~^~~ +drivers/isdn/hardware/avm/b1.c:426:30: note: use array indexing to silence this warning + cinfo->version[j] = "\0\0" + 1; + ^ + & [ ] +1 warning generated. + +This is equivalent to just "\0". Nick pointed out that it is smarter to +use "" instead of "\0" because "" is used elsewhere in the kernel and +can be deduplicated at the linking stage. + +Link: https://github.com/ClangBuiltLinux/linux/issues/309 +Suggested-by: Nick Desaulniers +Signed-off-by: Nathan Chancellor +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/avm/b1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c +index 4ac378e489023..40ca1e8fa09fc 100644 +--- a/drivers/isdn/hardware/avm/b1.c ++++ b/drivers/isdn/hardware/avm/b1.c +@@ -423,7 +423,7 @@ void b1_parse_version(avmctrl_info *cinfo) + int i, j; + + for (j = 0; j < AVM_MAXVERSION; j++) +- cinfo->version[j] = "\0\0" + 1; ++ cinfo->version[j] = ""; + for (i = 0, j = 0; + j < AVM_MAXVERSION && i < cinfo->versionlen; + j++, i += cinfo->versionbuf[i] + 1) +-- +2.19.1 + diff --git a/queue-4.19/isdn-i4l-isdn_tty-fix-some-concurrency-double-free-b.patch b/queue-4.19/isdn-i4l-isdn_tty-fix-some-concurrency-double-free-b.patch new file mode 100644 index 00000000000..2bb6c42a512 --- /dev/null +++ b/queue-4.19/isdn-i4l-isdn_tty-fix-some-concurrency-double-free-b.patch @@ -0,0 +1,67 @@ +From 1c455ba5c118f788774c724e6dc6c599709e364d Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Tue, 8 Jan 2019 21:04:48 +0800 +Subject: isdn: i4l: isdn_tty: Fix some concurrency double-free bugs + +[ Upstream commit 2ff33d6637393fe9348357285931811b76e1402f ] + +The functions isdn_tty_tiocmset() and isdn_tty_set_termios() may be +concurrently executed. + +isdn_tty_tiocmset + isdn_tty_modem_hup + line 719: kfree(info->dtmf_state); + line 721: kfree(info->silence_state); + line 723: kfree(info->adpcms); + line 725: kfree(info->adpcmr); + +isdn_tty_set_termios + isdn_tty_modem_hup + line 719: kfree(info->dtmf_state); + line 721: kfree(info->silence_state); + line 723: kfree(info->adpcms); + line 725: kfree(info->adpcmr); + +Thus, some concurrency double-free bugs may occur. + +These possible bugs are found by a static tool written by myself and +my manual code review. + +To fix these possible bugs, the mutex lock "modem_info_mutex" used in +isdn_tty_tiocmset() is added in isdn_tty_set_termios(). + +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/i4l/isdn_tty.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c +index b730037a0e2d3..9cff667b2d245 100644 +--- a/drivers/isdn/i4l/isdn_tty.c ++++ b/drivers/isdn/i4l/isdn_tty.c +@@ -1456,15 +1456,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios) + { + modem_info *info = (modem_info *) tty->driver_data; + ++ mutex_lock(&modem_info_mutex); + if (!old_termios) + isdn_tty_change_speed(info); + else { + if (tty->termios.c_cflag == old_termios->c_cflag && + tty->termios.c_ispeed == old_termios->c_ispeed && +- tty->termios.c_ospeed == old_termios->c_ospeed) ++ tty->termios.c_ospeed == old_termios->c_ospeed) { ++ mutex_unlock(&modem_info_mutex); + return; ++ } + isdn_tty_change_speed(info); + } ++ mutex_unlock(&modem_info_mutex); + } + + /* +-- +2.19.1 + diff --git a/queue-4.19/leds-lp5523-fix-a-missing-check-of-return-value-of-l.patch b/queue-4.19/leds-lp5523-fix-a-missing-check-of-return-value-of-l.patch new file mode 100644 index 00000000000..e6b8df6480e --- /dev/null +++ b/queue-4.19/leds-lp5523-fix-a-missing-check-of-return-value-of-l.patch @@ -0,0 +1,38 @@ +From 18a629e072d9094e3282028d6672346ca61a5231 Mon Sep 17 00:00:00 2001 +From: Kangjie Lu +Date: Tue, 25 Dec 2018 22:18:23 -0600 +Subject: leds: lp5523: fix a missing check of return value of lp55xx_read + +[ Upstream commit 248b57015f35c94d4eae2fdd8c6febf5cd703900 ] + +When lp55xx_read() fails, "status" is an uninitialized variable and thus +may contain random value; using it leads to undefined behaviors. + +The fix inserts a check for the return value of lp55xx_read: if it +fails, returns with its error code. + +Signed-off-by: Kangjie Lu +Signed-off-by: Jacek Anaszewski +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-lp5523.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c +index a2e74feee2b2f..fd64df5a57a5e 100644 +--- a/drivers/leds/leds-lp5523.c ++++ b/drivers/leds/leds-lp5523.c +@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip) + + /* Let the programs run for couple of ms and check the engine status */ + usleep_range(3000, 6000); +- lp55xx_read(chip, LP5523_REG_STATUS, &status); ++ ret = lp55xx_read(chip, LP5523_REG_STATUS, &status); ++ if (ret) ++ return ret; + status &= LP5523_ENG_STATUS_MASK; + + if (status != LP5523_ENG_STATUS_MASK) { +-- +2.19.1 + diff --git a/queue-4.19/mfd-ab8500-core-return-zero-in-get_register_interrup.patch b/queue-4.19/mfd-ab8500-core-return-zero-in-get_register_interrup.patch new file mode 100644 index 00000000000..e07e69e74f6 --- /dev/null +++ b/queue-4.19/mfd-ab8500-core-return-zero-in-get_register_interrup.patch @@ -0,0 +1,40 @@ +From 10410dd82c31d89e002adada2dcb0dc822f3a800 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 25 Oct 2018 15:43:44 +0300 +Subject: mfd: ab8500-core: Return zero in get_register_interruptible() + +[ Upstream commit 10628e3ecf544fa2e4e24f8e112d95c37884dc98 ] + +This function is supposed to return zero on success or negative error +codes on error. Unfortunately, there is a bug so it sometimes returns +non-zero, positive numbers on success. + +I noticed this bug during review and I can't test it. It does appear +that the return is sometimes propogated back to _regmap_read() where all +non-zero returns are treated as failure so this may affect run time. + +Fixes: 47c1697508f2 ("mfd: Align ab8500 with the abx500 interface") +Signed-off-by: Dan Carpenter +Reviewed-by: Linus Walleij +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/ab8500-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c +index 30d09d1771717..11ab17f64c649 100644 +--- a/drivers/mfd/ab8500-core.c ++++ b/drivers/mfd/ab8500-core.c +@@ -261,7 +261,7 @@ static int get_register_interruptible(struct ab8500 *ab8500, u8 bank, + mutex_unlock(&ab8500->lock); + dev_vdbg(ab8500->dev, "rd: addr %#x => data %#x\n", addr, ret); + +- return ret; ++ return (ret < 0) ? ret : 0; + } + + static int ab8500_get_register(struct device *dev, u8 bank, +-- +2.19.1 + diff --git a/queue-4.19/mfd-axp20x-add-ac-power-supply-cell-for-axp813.patch b/queue-4.19/mfd-axp20x-add-ac-power-supply-cell-for-axp813.patch new file mode 100644 index 00000000000..1f1fc7488c8 --- /dev/null +++ b/queue-4.19/mfd-axp20x-add-ac-power-supply-cell-for-axp813.patch @@ -0,0 +1,38 @@ +From 78f6b287c0892d2eb46d78547d2685f7d066df34 Mon Sep 17 00:00:00 2001 +From: Oskari Lemmela +Date: Tue, 20 Nov 2018 19:52:10 +0200 +Subject: mfd: axp20x: Add AC power supply cell for AXP813 + +[ Upstream commit 4a19f9a65375ca9781b3ca9e810ece92edfc3e78 ] + +As axp20x-ac-power-supply now supports AXP813, add a cell for it. + +Signed-off-by: Oskari Lemmela +Reviewed-by: Quentin Schulz +Reviewed-by: Chen-Yu Tsai +Tested-by: Vasily Khoruzhick +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/axp20x.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c +index 0be511dd93d01..dfc3cff1d08b4 100644 +--- a/drivers/mfd/axp20x.c ++++ b/drivers/mfd/axp20x.c +@@ -778,6 +778,11 @@ static const struct mfd_cell axp813_cells[] = { + }, { + .name = "axp20x-battery-power-supply", + .of_compatible = "x-powers,axp813-battery-power-supply", ++ }, { ++ .name = "axp20x-ac-power-supply", ++ .of_compatible = "x-powers,axp813-ac-power-supply", ++ .num_resources = ARRAY_SIZE(axp20x_ac_power_supply_resources), ++ .resources = axp20x_ac_power_supply_resources, + }, + }; + +-- +2.19.1 + diff --git a/queue-4.19/mfd-axp20x-add-supported-cells-for-axp803.patch b/queue-4.19/mfd-axp20x-add-supported-cells-for-axp803.patch new file mode 100644 index 00000000000..b483df65ea6 --- /dev/null +++ b/queue-4.19/mfd-axp20x-add-supported-cells-for-axp803.patch @@ -0,0 +1,48 @@ +From 36c655f0c5b334a6a1d97c06e2628e103320d517 Mon Sep 17 00:00:00 2001 +From: Oskari Lemmela +Date: Sat, 8 Dec 2018 19:58:47 +0200 +Subject: mfd: axp20x: Add supported cells for AXP803 + +[ Upstream commit ea90e7b47f0a8bd2fe14e9a88f523de7c67db90a ] + +Parts of the AXP803 are compatible with their counterparts on the AXP813. +These include the GPIO, ADC, AC and battery power supplies. + +Signed-off-by: Oskari Lemmela +Reviewed-by: Chen-Yu Tsai +Tested-by: Vasily Khoruzhick +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/axp20x.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c +index 8037b4e01ed67..f8e0fa97bb31e 100644 +--- a/drivers/mfd/axp20x.c ++++ b/drivers/mfd/axp20x.c +@@ -726,6 +726,20 @@ static const struct mfd_cell axp803_cells[] = { + .name = "axp221-pek", + .num_resources = ARRAY_SIZE(axp803_pek_resources), + .resources = axp803_pek_resources, ++ }, { ++ .name = "axp20x-gpio", ++ .of_compatible = "x-powers,axp813-gpio", ++ }, { ++ .name = "axp813-adc", ++ .of_compatible = "x-powers,axp813-adc", ++ }, { ++ .name = "axp20x-battery-power-supply", ++ .of_compatible = "x-powers,axp813-battery-power-supply", ++ }, { ++ .name = "axp20x-ac-power-supply", ++ .of_compatible = "x-powers,axp813-ac-power-supply", ++ .num_resources = ARRAY_SIZE(axp20x_ac_power_supply_resources), ++ .resources = axp20x_ac_power_supply_resources, + }, + { .name = "axp20x-regulator" }, + }; +-- +2.19.1 + diff --git a/queue-4.19/mfd-axp20x-re-align-mfd-cell-entries.patch b/queue-4.19/mfd-axp20x-re-align-mfd-cell-entries.patch new file mode 100644 index 00000000000..5a2cbcb76a8 --- /dev/null +++ b/queue-4.19/mfd-axp20x-re-align-mfd-cell-entries.patch @@ -0,0 +1,197 @@ +From 3c9832d51408631bb6e1d2e7766786d3007e3d4a Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Sat, 8 Dec 2018 19:58:46 +0200 +Subject: mfd: axp20x: Re-align MFD cell entries + +[ Upstream commit 753a8d083e085c6f552c7982749de4cc7c40e2ac ] + +In the axp20x driver, the various mfd_cell lists had varying amounts +of indentation, sometimes even within the same list. For the axp288, +there's no alignment at all. + +Re-align the right hand side of the assignments with the least amount +of tabs possible. Also collapse the closing bracket and the opening +bracket of the next entry onto the same line for the axp288, to be +consistent with all the other mfd_cell lists. + +This patch is whitespace change only. No functionality is modified. + +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Oskari Lemmela +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/axp20x.c | 107 +++++++++++++++++++++---------------------- + 1 file changed, 51 insertions(+), 56 deletions(-) + +diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c +index dfc3cff1d08b4..8037b4e01ed67 100644 +--- a/drivers/mfd/axp20x.c ++++ b/drivers/mfd/axp20x.c +@@ -640,9 +640,9 @@ static const struct mfd_cell axp221_cells[] = { + + static const struct mfd_cell axp223_cells[] = { + { +- .name = "axp221-pek", +- .num_resources = ARRAY_SIZE(axp22x_pek_resources), +- .resources = axp22x_pek_resources, ++ .name = "axp221-pek", ++ .num_resources = ARRAY_SIZE(axp22x_pek_resources), ++ .resources = axp22x_pek_resources, + }, { + .name = "axp22x-adc", + .of_compatible = "x-powers,axp221-adc", +@@ -650,7 +650,7 @@ static const struct mfd_cell axp223_cells[] = { + .name = "axp20x-battery-power-supply", + .of_compatible = "x-powers,axp221-battery-power-supply", + }, { +- .name = "axp20x-regulator", ++ .name = "axp20x-regulator", + }, { + .name = "axp20x-ac-power-supply", + .of_compatible = "x-powers,axp221-ac-power-supply", +@@ -666,9 +666,9 @@ static const struct mfd_cell axp223_cells[] = { + + static const struct mfd_cell axp152_cells[] = { + { +- .name = "axp20x-pek", +- .num_resources = ARRAY_SIZE(axp152_pek_resources), +- .resources = axp152_pek_resources, ++ .name = "axp20x-pek", ++ .num_resources = ARRAY_SIZE(axp152_pek_resources), ++ .resources = axp152_pek_resources, + }, + }; + +@@ -697,84 +697,79 @@ static const struct resource axp288_charger_resources[] = { + + static const struct mfd_cell axp288_cells[] = { + { +- .name = "axp288_adc", +- .num_resources = ARRAY_SIZE(axp288_adc_resources), +- .resources = axp288_adc_resources, +- }, +- { +- .name = "axp288_extcon", +- .num_resources = ARRAY_SIZE(axp288_extcon_resources), +- .resources = axp288_extcon_resources, +- }, +- { +- .name = "axp288_charger", +- .num_resources = ARRAY_SIZE(axp288_charger_resources), +- .resources = axp288_charger_resources, +- }, +- { +- .name = "axp288_fuel_gauge", +- .num_resources = ARRAY_SIZE(axp288_fuel_gauge_resources), +- .resources = axp288_fuel_gauge_resources, +- }, +- { +- .name = "axp221-pek", +- .num_resources = ARRAY_SIZE(axp288_power_button_resources), +- .resources = axp288_power_button_resources, +- }, +- { +- .name = "axp288_pmic_acpi", ++ .name = "axp288_adc", ++ .num_resources = ARRAY_SIZE(axp288_adc_resources), ++ .resources = axp288_adc_resources, ++ }, { ++ .name = "axp288_extcon", ++ .num_resources = ARRAY_SIZE(axp288_extcon_resources), ++ .resources = axp288_extcon_resources, ++ }, { ++ .name = "axp288_charger", ++ .num_resources = ARRAY_SIZE(axp288_charger_resources), ++ .resources = axp288_charger_resources, ++ }, { ++ .name = "axp288_fuel_gauge", ++ .num_resources = ARRAY_SIZE(axp288_fuel_gauge_resources), ++ .resources = axp288_fuel_gauge_resources, ++ }, { ++ .name = "axp221-pek", ++ .num_resources = ARRAY_SIZE(axp288_power_button_resources), ++ .resources = axp288_power_button_resources, ++ }, { ++ .name = "axp288_pmic_acpi", + }, + }; + + static const struct mfd_cell axp803_cells[] = { + { +- .name = "axp221-pek", +- .num_resources = ARRAY_SIZE(axp803_pek_resources), +- .resources = axp803_pek_resources, ++ .name = "axp221-pek", ++ .num_resources = ARRAY_SIZE(axp803_pek_resources), ++ .resources = axp803_pek_resources, + }, +- { .name = "axp20x-regulator" }, ++ { .name = "axp20x-regulator" }, + }; + + static const struct mfd_cell axp806_self_working_cells[] = { + { +- .name = "axp221-pek", +- .num_resources = ARRAY_SIZE(axp806_pek_resources), +- .resources = axp806_pek_resources, ++ .name = "axp221-pek", ++ .num_resources = ARRAY_SIZE(axp806_pek_resources), ++ .resources = axp806_pek_resources, + }, +- { .name = "axp20x-regulator" }, ++ { .name = "axp20x-regulator" }, + }; + + static const struct mfd_cell axp806_cells[] = { + { +- .id = 2, +- .name = "axp20x-regulator", ++ .id = 2, ++ .name = "axp20x-regulator", + }, + }; + + static const struct mfd_cell axp809_cells[] = { + { +- .name = "axp221-pek", +- .num_resources = ARRAY_SIZE(axp809_pek_resources), +- .resources = axp809_pek_resources, ++ .name = "axp221-pek", ++ .num_resources = ARRAY_SIZE(axp809_pek_resources), ++ .resources = axp809_pek_resources, + }, { +- .id = 1, +- .name = "axp20x-regulator", ++ .id = 1, ++ .name = "axp20x-regulator", + }, + }; + + static const struct mfd_cell axp813_cells[] = { + { +- .name = "axp221-pek", +- .num_resources = ARRAY_SIZE(axp803_pek_resources), +- .resources = axp803_pek_resources, ++ .name = "axp221-pek", ++ .num_resources = ARRAY_SIZE(axp803_pek_resources), ++ .resources = axp803_pek_resources, + }, { +- .name = "axp20x-regulator", ++ .name = "axp20x-regulator", + }, { +- .name = "axp20x-gpio", +- .of_compatible = "x-powers,axp813-gpio", ++ .name = "axp20x-gpio", ++ .of_compatible = "x-powers,axp813-gpio", + }, { +- .name = "axp813-adc", +- .of_compatible = "x-powers,axp813-adc", ++ .name = "axp813-adc", ++ .of_compatible = "x-powers,axp813-adc", + }, { + .name = "axp20x-battery-power-supply", + .of_compatible = "x-powers,axp813-battery-power-supply", +-- +2.19.1 + diff --git a/queue-4.19/mfd-bd9571mwv-add-volatile-register-to-make-dvfs-wor.patch b/queue-4.19/mfd-bd9571mwv-add-volatile-register-to-make-dvfs-wor.patch new file mode 100644 index 00000000000..edf4cdd85e6 --- /dev/null +++ b/queue-4.19/mfd-bd9571mwv-add-volatile-register-to-make-dvfs-wor.patch @@ -0,0 +1,37 @@ +From 9e64e44d9d8388a3dd344b3f9ba404426fa139fb Mon Sep 17 00:00:00 2001 +From: Dien Pham +Date: Wed, 3 Oct 2018 15:58:41 +0200 +Subject: mfd: bd9571mwv: Add volatile register to make DVFS work + +[ Upstream commit b0aff01e7aa6ad2d6998ef1323843212d1db8b04 ] + +Because BD9571MWV_DVFS_MONIVDAC is not defined in the volatile table, +the physical register value is not updated by regmap and DVFS doesn't +work as expected. Fix it! + +Fixes: d3ea21272094 ("mfd: Add ROHM BD9571MWV-M MFD PMIC driver") +Signed-off-by: Dien Pham +[wsa: rebase, add 'Fixes', reword commit message] +Signed-off-by: Wolfram Sang +Reviewed-by: Marek Vasut +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/bd9571mwv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mfd/bd9571mwv.c b/drivers/mfd/bd9571mwv.c +index 503979c81dae1..fab3cdc27ed64 100644 +--- a/drivers/mfd/bd9571mwv.c ++++ b/drivers/mfd/bd9571mwv.c +@@ -59,6 +59,7 @@ static const struct regmap_access_table bd9571mwv_writable_table = { + }; + + static const struct regmap_range bd9571mwv_volatile_yes_ranges[] = { ++ regmap_reg_range(BD9571MWV_DVFS_MONIVDAC, BD9571MWV_DVFS_MONIVDAC), + regmap_reg_range(BD9571MWV_GPIO_IN, BD9571MWV_GPIO_IN), + regmap_reg_range(BD9571MWV_GPIO_INT, BD9571MWV_GPIO_INT), + regmap_reg_range(BD9571MWV_INT_INTREQ, BD9571MWV_INT_INTREQ), +-- +2.19.1 + diff --git a/queue-4.19/mfd-cros_ec_dev-add-missing-mfd_remove_devices-call-.patch b/queue-4.19/mfd-cros_ec_dev-add-missing-mfd_remove_devices-call-.patch new file mode 100644 index 00000000000..512da85786f --- /dev/null +++ b/queue-4.19/mfd-cros_ec_dev-add-missing-mfd_remove_devices-call-.patch @@ -0,0 +1,34 @@ +From ff5a6c0eb7d28f61a95c4fcbc3785cb6f7902dec Mon Sep 17 00:00:00 2001 +From: Enric Balletbo i Serra +Date: Mon, 10 Dec 2018 19:00:02 +0100 +Subject: mfd: cros_ec_dev: Add missing mfd_remove_devices() call in remove + +[ Upstream commit 18e294ddafaeb80a1e2e10c9bd750a6cb8388d5b ] + +The driver adds different MFD child devices via mfd_add_devices() and +hence it is required to call mfd_remove_devices() to remove MFD child +devices. + +Fixes: 5e0115581bbc ("cros_ec: Move cros_ec_dev module to drivers/mfd") +Signed-off-by: Enric Balletbo i Serra +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/cros_ec_dev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mfd/cros_ec_dev.c b/drivers/mfd/cros_ec_dev.c +index 6b22d54a540d1..bccde3eac92ca 100644 +--- a/drivers/mfd/cros_ec_dev.c ++++ b/drivers/mfd/cros_ec_dev.c +@@ -499,6 +499,7 @@ static int ec_device_remove(struct platform_device *pdev) + + cros_ec_debugfs_remove(ec); + ++ mfd_remove_devices(ec->dev); + cdev_del(&ec->cdev); + device_unregister(&ec->class_dev); + return 0; +-- +2.19.1 + diff --git a/queue-4.19/mfd-db8500-prcmu-fix-some-section-annotations.patch b/queue-4.19/mfd-db8500-prcmu-fix-some-section-annotations.patch new file mode 100644 index 00000000000..711b26f28ed --- /dev/null +++ b/queue-4.19/mfd-db8500-prcmu-fix-some-section-annotations.patch @@ -0,0 +1,61 @@ +From 45e74cdae435cf79700e3d6ae423fce7c62ead67 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Wed, 17 Oct 2018 17:56:28 -0700 +Subject: mfd: db8500-prcmu: Fix some section annotations + +[ Upstream commit a3888f62fe66429fad3be7f2ba962e1e08c26fd6 ] + +When building the kernel with Clang, the following section mismatch +warnings appear: + +WARNING: vmlinux.o(.text+0x7239cc): Section mismatch in reference from +the function db8500_prcmu_probe() to the function +.init.text:init_prcm_registers() +The function db8500_prcmu_probe() references +the function __init init_prcm_registers(). +This is often because db8500_prcmu_probe lacks a __init +annotation or the annotation of init_prcm_registers is wrong. + +WARNING: vmlinux.o(.text+0x723e28): Section mismatch in reference from +the function db8500_prcmu_probe() to the function +.init.text:fw_project_name() +The function db8500_prcmu_probe() references +the function __init fw_project_name(). +This is often because db8500_prcmu_probe lacks a __init +annotation or the annotation of fw_project_name is wrong. + +db8500_prcmu_probe should not be marked as __init so remove the __init +annotation from fw_project_name and init_prcm_registers. + +Signed-off-by: Nathan Chancellor +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/db8500-prcmu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c +index 5970b8def5487..aec20e1c7d3d5 100644 +--- a/drivers/mfd/db8500-prcmu.c ++++ b/drivers/mfd/db8500-prcmu.c +@@ -2584,7 +2584,7 @@ static struct irq_chip prcmu_irq_chip = { + .irq_unmask = prcmu_irq_unmask, + }; + +-static __init char *fw_project_name(u32 project) ++static char *fw_project_name(u32 project) + { + switch (project) { + case PRCMU_FW_PROJECT_U8500: +@@ -2732,7 +2732,7 @@ void __init db8500_prcmu_early_init(u32 phy_base, u32 size) + INIT_WORK(&mb0_transfer.mask_work, prcmu_mask_work); + } + +-static void __init init_prcm_registers(void) ++static void init_prcm_registers(void) + { + u32 val; + +-- +2.19.1 + diff --git a/queue-4.19/mfd-mc13xxx-fix-a-missing-check-of-a-register-read-f.patch b/queue-4.19/mfd-mc13xxx-fix-a-missing-check-of-a-register-read-f.patch new file mode 100644 index 00000000000..fc727826bc0 --- /dev/null +++ b/queue-4.19/mfd-mc13xxx-fix-a-missing-check-of-a-register-read-f.patch @@ -0,0 +1,38 @@ +From 4bafbaf1a89782bab39fad5b8c0fe6bd775d2a39 Mon Sep 17 00:00:00 2001 +From: Kangjie Lu +Date: Thu, 20 Dec 2018 15:12:11 -0600 +Subject: mfd: mc13xxx: Fix a missing check of a register-read failure + +[ Upstream commit 9e28989d41c0eab57ec0bb156617a8757406ff8a ] + +When mc13xxx_reg_read() fails, "old_adc0" is uninitialized and will +contain random value. Further execution uses "old_adc0" even when +mc13xxx_reg_read() fails. +The fix checks the return value of mc13xxx_reg_read(), and exits +the execution when it fails. + +Signed-off-by: Kangjie Lu +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/mc13xxx-core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c +index c63e331738c17..234febfe6398b 100644 +--- a/drivers/mfd/mc13xxx-core.c ++++ b/drivers/mfd/mc13xxx-core.c +@@ -274,7 +274,9 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode, + + mc13xxx->adcflags |= MC13XXX_ADC_WORKING; + +- mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0); ++ ret = mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0); ++ if (ret) ++ goto out; + + adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2; + adc1 = MC13XXX_ADC1_ADEN | MC13XXX_ADC1_ADTRIGIGN | MC13XXX_ADC1_ASC; +-- +2.19.1 + diff --git a/queue-4.19/mfd-mt6397-do-not-call-irq_domain_remove-if-pmic-uns.patch b/queue-4.19/mfd-mt6397-do-not-call-irq_domain_remove-if-pmic-uns.patch new file mode 100644 index 00000000000..315c13facbf --- /dev/null +++ b/queue-4.19/mfd-mt6397-do-not-call-irq_domain_remove-if-pmic-uns.patch @@ -0,0 +1,37 @@ +From 5ce98b90a5748a16e457976a4270fbde86051c6b Mon Sep 17 00:00:00 2001 +From: Nicolas Boichat +Date: Mon, 22 Oct 2018 10:55:06 +0800 +Subject: mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported + +[ Upstream commit a177276aa098aa47a100d51a13eaaef029604b6d ] + +If the PMIC ID is unknown, the current code would call +irq_domain_remove and panic, as pmic->irq_domain is only +initialized by mt6397_irq_init. + +Return immediately with an error, if the chip ID is unsupported. + +Signed-off-by: Nicolas Boichat +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/mt6397-core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/mfd/mt6397-core.c b/drivers/mfd/mt6397-core.c +index 77b64bd64df36..ab24e176ef448 100644 +--- a/drivers/mfd/mt6397-core.c ++++ b/drivers/mfd/mt6397-core.c +@@ -329,8 +329,7 @@ static int mt6397_probe(struct platform_device *pdev) + + default: + dev_err(&pdev->dev, "unsupported chip: %d\n", id); +- ret = -ENODEV; +- break; ++ return -ENODEV; + } + + if (ret) { +-- +2.19.1 + diff --git a/queue-4.19/mfd-qcom_rpm-write-fw_version-to-ctrl_reg.patch b/queue-4.19/mfd-qcom_rpm-write-fw_version-to-ctrl_reg.patch new file mode 100644 index 00000000000..b974bae0830 --- /dev/null +++ b/queue-4.19/mfd-qcom_rpm-write-fw_version-to-ctrl_reg.patch @@ -0,0 +1,37 @@ +From eb2c764feafd017a1395cabdfdce835c0f5f2d35 Mon Sep 17 00:00:00 2001 +From: Jonathan Marek +Date: Mon, 19 Nov 2018 14:53:17 -0500 +Subject: mfd: qcom_rpm: write fw_version to CTRL_REG + +[ Upstream commit 504e4175829c44328773b96ad9c538e4783a8d22 ] + +This is required as part of the initialization sequence on certain SoCs. + +If these registers are not initialized, the hardware can be unresponsive. +This fixes the driver on apq8060 (HP TouchPad device). + +Signed-off-by: Jonathan Marek +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/qcom_rpm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c +index 52fafea06067e..8d420c37b2a61 100644 +--- a/drivers/mfd/qcom_rpm.c ++++ b/drivers/mfd/qcom_rpm.c +@@ -638,6 +638,10 @@ static int qcom_rpm_probe(struct platform_device *pdev) + return -EFAULT; + } + ++ writel(fw_version[0], RPM_CTRL_REG(rpm, 0)); ++ writel(fw_version[1], RPM_CTRL_REG(rpm, 1)); ++ writel(fw_version[2], RPM_CTRL_REG(rpm, 2)); ++ + dev_info(&pdev->dev, "RPM firmware %u.%u.%u\n", fw_version[0], + fw_version[1], + fw_version[2]); +-- +2.19.1 + diff --git a/queue-4.19/mfd-ti_am335x_tscadc-use-platform_devid_auto-while-r.patch b/queue-4.19/mfd-ti_am335x_tscadc-use-platform_devid_auto-while-r.patch new file mode 100644 index 00000000000..75046f66aeb --- /dev/null +++ b/queue-4.19/mfd-ti_am335x_tscadc-use-platform_devid_auto-while-r.patch @@ -0,0 +1,38 @@ +From 217238efc10a451970d633b120c15b95f36435e8 Mon Sep 17 00:00:00 2001 +From: Vignesh R +Date: Mon, 3 Dec 2018 13:31:17 +0530 +Subject: mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd + cells + +[ Upstream commit b40ee006fe6a8a25093434e5d394128c356a48f3 ] + +Use PLATFORM_DEVID_AUTO to number mfd cells while registering, so that +different instances are uniquely identified. This is required in order +to support registering of multiple instances of same ti_am335x_tscadc IP. + +Signed-off-by: Vignesh R +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/ti_am335x_tscadc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c +index 7a30546880a42..fe8d335a4d74d 100644 +--- a/drivers/mfd/ti_am335x_tscadc.c ++++ b/drivers/mfd/ti_am335x_tscadc.c +@@ -264,8 +264,9 @@ static int ti_tscadc_probe(struct platform_device *pdev) + cell->pdata_size = sizeof(tscadc); + } + +- err = mfd_add_devices(&pdev->dev, pdev->id, tscadc->cells, +- tscadc->used_cells, NULL, 0, NULL); ++ err = mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO, ++ tscadc->cells, tscadc->used_cells, NULL, ++ 0, NULL); + if (err < 0) + goto err_disable_clk; + +-- +2.19.1 + diff --git a/queue-4.19/mfd-tps65218-use-devm_regmap_add_irq_chip-and-clean-.patch b/queue-4.19/mfd-tps65218-use-devm_regmap_add_irq_chip-and-clean-.patch new file mode 100644 index 00000000000..08e7f55d1c7 --- /dev/null +++ b/queue-4.19/mfd-tps65218-use-devm_regmap_add_irq_chip-and-clean-.patch @@ -0,0 +1,75 @@ +From a412eb518363bfa746be8eb5bbddec904809607b Mon Sep 17 00:00:00 2001 +From: Keerthy +Date: Sun, 9 Dec 2018 19:29:31 +0530 +Subject: mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path + in probe() + +[ Upstream commit 75d4c5e03c2ae9902ab521024b10291f6fc9515b ] + +Use devm_regmap_add_irq_chip and clean up error path in probe +and also the remove function. + +Reported-by: Christian Hohnstaedt +Signed-off-by: Keerthy +Reviewed-by: Sebastian Reichel +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/tps65218.c | 24 +++--------------------- + 1 file changed, 3 insertions(+), 21 deletions(-) + +diff --git a/drivers/mfd/tps65218.c b/drivers/mfd/tps65218.c +index 910f569ff77c1..8bcdecf494d05 100644 +--- a/drivers/mfd/tps65218.c ++++ b/drivers/mfd/tps65218.c +@@ -235,9 +235,9 @@ static int tps65218_probe(struct i2c_client *client, + + mutex_init(&tps->tps_lock); + +- ret = regmap_add_irq_chip(tps->regmap, tps->irq, +- IRQF_ONESHOT, 0, &tps65218_irq_chip, +- &tps->irq_data); ++ ret = devm_regmap_add_irq_chip(&client->dev, tps->regmap, tps->irq, ++ IRQF_ONESHOT, 0, &tps65218_irq_chip, ++ &tps->irq_data); + if (ret < 0) + return ret; + +@@ -253,26 +253,9 @@ static int tps65218_probe(struct i2c_client *client, + ARRAY_SIZE(tps65218_cells), NULL, 0, + regmap_irq_get_domain(tps->irq_data)); + +- if (ret < 0) +- goto err_irq; +- +- return 0; +- +-err_irq: +- regmap_del_irq_chip(tps->irq, tps->irq_data); +- + return ret; + } + +-static int tps65218_remove(struct i2c_client *client) +-{ +- struct tps65218 *tps = i2c_get_clientdata(client); +- +- regmap_del_irq_chip(tps->irq, tps->irq_data); +- +- return 0; +-} +- + static const struct i2c_device_id tps65218_id_table[] = { + { "tps65218", TPS65218 }, + { }, +@@ -285,7 +268,6 @@ static struct i2c_driver tps65218_driver = { + .of_match_table = of_tps65218_match_table, + }, + .probe = tps65218_probe, +- .remove = tps65218_remove, + .id_table = tps65218_id_table, + }; + +-- +2.19.1 + diff --git a/queue-4.19/mfd-twl-core-fix-section-annotations-on-un-protect_p.patch b/queue-4.19/mfd-twl-core-fix-section-annotations-on-un-protect_p.patch new file mode 100644 index 00000000000..463a517dd6a --- /dev/null +++ b/queue-4.19/mfd-twl-core-fix-section-annotations-on-un-protect_p.patch @@ -0,0 +1,53 @@ +From 662720a04ef173b691e029556ca7005986e4a232 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Wed, 17 Oct 2018 10:13:23 -0700 +Subject: mfd: twl-core: Fix section annotations on {,un}protect_pm_master + +[ Upstream commit 8838555089f0345b87f4277fe5a8dd647dc65589 ] + +When building the kernel with Clang, the following section mismatch +warning appears: + +WARNING: vmlinux.o(.text+0x3d84a3b): Section mismatch in reference from +the function twl_probe() to the function +.init.text:unprotect_pm_master() +The function twl_probe() references +the function __init unprotect_pm_master(). +This is often because twl_probe lacks a __init +annotation or the annotation of unprotect_pm_master is wrong. + +Remove the __init annotation on the *protect_pm_master functions so +there is no more mismatch. + +Signed-off-by: Nathan Chancellor +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/twl-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c +index 4be3d239da9ec..299016bc46d90 100644 +--- a/drivers/mfd/twl-core.c ++++ b/drivers/mfd/twl-core.c +@@ -979,7 +979,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned irq_base, + * letting it generate the right frequencies for USB, MADC, and + * other purposes. + */ +-static inline int __init protect_pm_master(void) ++static inline int protect_pm_master(void) + { + int e = 0; + +@@ -988,7 +988,7 @@ static inline int __init protect_pm_master(void) + return e; + } + +-static inline int __init unprotect_pm_master(void) ++static inline int unprotect_pm_master(void) + { + int e = 0; + +-- +2.19.1 + diff --git a/queue-4.19/mfd-wm5110-add-missing-asrc-rate-register.patch b/queue-4.19/mfd-wm5110-add-missing-asrc-rate-register.patch new file mode 100644 index 00000000000..20461b18cbf --- /dev/null +++ b/queue-4.19/mfd-wm5110-add-missing-asrc-rate-register.patch @@ -0,0 +1,37 @@ +From 65aa8bdf4abdce0d03cfb265a36c852ae50316ae Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Wed, 28 Nov 2018 10:04:22 +0000 +Subject: mfd: wm5110: Add missing ASRC rate register + +[ Upstream commit 04c801c18ded421845324255e660147a6f58dcd6 ] + +Signed-off-by: Charles Keepax +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/wm5110-tables.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c +index 1ee68bd440fbc..16c6e2accfaa5 100644 +--- a/drivers/mfd/wm5110-tables.c ++++ b/drivers/mfd/wm5110-tables.c +@@ -1618,6 +1618,7 @@ static const struct reg_default wm5110_reg_default[] = { + { 0x00000ECD, 0x0000 }, /* R3789 - HPLPF4_2 */ + { 0x00000EE0, 0x0000 }, /* R3808 - ASRC_ENABLE */ + { 0x00000EE2, 0x0000 }, /* R3810 - ASRC_RATE1 */ ++ { 0x00000EE3, 0x4000 }, /* R3811 - ASRC_RATE2 */ + { 0x00000EF0, 0x0000 }, /* R3824 - ISRC 1 CTRL 1 */ + { 0x00000EF1, 0x0000 }, /* R3825 - ISRC 1 CTRL 2 */ + { 0x00000EF2, 0x0000 }, /* R3826 - ISRC 1 CTRL 3 */ +@@ -2869,6 +2870,7 @@ static bool wm5110_readable_register(struct device *dev, unsigned int reg) + case ARIZONA_ASRC_ENABLE: + case ARIZONA_ASRC_STATUS: + case ARIZONA_ASRC_RATE1: ++ case ARIZONA_ASRC_RATE2: + case ARIZONA_ISRC_1_CTRL_1: + case ARIZONA_ISRC_1_CTRL_2: + case ARIZONA_ISRC_1_CTRL_3: +-- +2.19.1 + diff --git a/queue-4.19/mips-ath79-enable-of-serial-ports-in-the-default-con.patch b/queue-4.19/mips-ath79-enable-of-serial-ports-in-the-default-con.patch new file mode 100644 index 00000000000..92c074af397 --- /dev/null +++ b/queue-4.19/mips-ath79-enable-of-serial-ports-in-the-default-con.patch @@ -0,0 +1,37 @@ +From 2c9360871b9ba46b2a10ddcffeb8ffa95334376a Mon Sep 17 00:00:00 2001 +From: Alban Bedel +Date: Mon, 7 Jan 2019 20:45:15 +0100 +Subject: MIPS: ath79: Enable OF serial ports in the default config + +[ Upstream commit 565dc8a4f55e491935bfb04866068d21784ea9a4 ] + +CONFIG_SERIAL_OF_PLATFORM is needed to get a working console on the OF +boards, enable it in the default config to get a working setup out of +the box. + +Signed-off-by: Alban Bedel +Signed-off-by: Paul Burton +Cc: linux-mips@vger.kernel.org +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/configs/ath79_defconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/configs/ath79_defconfig b/arch/mips/configs/ath79_defconfig +index 951c4231bdb85..4c47b3fd958b6 100644 +--- a/arch/mips/configs/ath79_defconfig ++++ b/arch/mips/configs/ath79_defconfig +@@ -71,6 +71,7 @@ CONFIG_SERIAL_8250_CONSOLE=y + # CONFIG_SERIAL_8250_PCI is not set + CONFIG_SERIAL_8250_NR_UARTS=1 + CONFIG_SERIAL_8250_RUNTIME_UARTS=1 ++CONFIG_SERIAL_OF_PLATFORM=y + CONFIG_SERIAL_AR933X=y + CONFIG_SERIAL_AR933X_CONSOLE=y + # CONFIG_HW_RANDOM is not set +-- +2.19.1 + diff --git a/queue-4.19/mips-jazz-fix-64bit-build.patch b/queue-4.19/mips-jazz-fix-64bit-build.patch new file mode 100644 index 00000000000..655061145df --- /dev/null +++ b/queue-4.19/mips-jazz-fix-64bit-build.patch @@ -0,0 +1,75 @@ +From e488a674d9dcbdd8616f3a26838f0a27688c87e6 Mon Sep 17 00:00:00 2001 +From: Thomas Bogendoerfer +Date: Wed, 9 Jan 2019 18:12:16 +0100 +Subject: MIPS: jazz: fix 64bit build + +[ Upstream commit 41af167fbc0032f9d7562854f58114eaa9270336 ] + +64bit JAZZ builds failed with + + linux-next/arch/mips/jazz/jazzdma.c: In function `vdma_init`: + /linux-next/arch/mips/jazz/jazzdma.c:77:30: error: implicit declaration + of function `KSEG1ADDR`; did you mean `CKSEG1ADDR`? + [-Werror=implicit-function-declaration] + pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl); + ^~~~~~~~~ + CKSEG1ADDR + /linux-next/arch/mips/jazz/jazzdma.c:77:10: error: cast to pointer from + integer of different size [-Werror=int-to-pointer-cast] + pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl); + ^ + In file included from /linux-next/arch/mips/include/asm/barrier.h:11:0, + from /linux-next/include/linux/compiler.h:248, + from /linux-next/include/linux/kernel.h:10, + from /linux-next/arch/mips/jazz/jazzdma.c:11: + /linux-next/arch/mips/include/asm/addrspace.h:41:29: error: cast from + pointer to integer of different size [-Werror=pointer-to-int-cast] + #define _ACAST32_ (_ATYPE_)(_ATYPE32_) /* widen if necessary */ + ^ + /linux-next/arch/mips/include/asm/addrspace.h:53:25: note: in + expansion of macro `_ACAST32_` + #define CPHYSADDR(a) ((_ACAST32_(a)) & 0x1fffffff) + ^~~~~~~~~ + /linux-next/arch/mips/jazz/jazzdma.c:84:44: note: in expansion of + macro `CPHYSADDR` + r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl)); + +Using correct casts and CKSEG1ADDR when dealing with the pgtbl setup +fixes this. + +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/jazz/jazzdma.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c +index d31bc2f012088..fb2b6d0b77c36 100644 +--- a/arch/mips/jazz/jazzdma.c ++++ b/arch/mips/jazz/jazzdma.c +@@ -74,14 +74,15 @@ static int __init vdma_init(void) + get_order(VDMA_PGTBL_SIZE)); + BUG_ON(!pgtbl); + dma_cache_wback_inv((unsigned long)pgtbl, VDMA_PGTBL_SIZE); +- pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl); ++ pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR((unsigned long)pgtbl); + + /* + * Clear the R4030 translation table + */ + vdma_pgtbl_init(); + +- r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl)); ++ r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, ++ CPHYSADDR((unsigned long)pgtbl)); + r4030_write_reg32(JAZZ_R4030_TRSTBL_LIM, VDMA_PGTBL_SIZE); + r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0); + +-- +2.19.1 + diff --git a/queue-4.19/mlxsw-pci-return-error-on-pci-reset-timeout.patch b/queue-4.19/mlxsw-pci-return-error-on-pci-reset-timeout.patch new file mode 100644 index 00000000000..95fb8e43118 --- /dev/null +++ b/queue-4.19/mlxsw-pci-return-error-on-pci-reset-timeout.patch @@ -0,0 +1,40 @@ +From c4dd758aeb23871b27eaabb773dc4e3c0e71a6a9 Mon Sep 17 00:00:00 2001 +From: Nir Dotan +Date: Fri, 18 Jan 2019 15:57:57 +0000 +Subject: mlxsw: pci: Return error on PCI reset timeout + +[ Upstream commit 67c14cc9b35055264fc0efed00159a7de1819f1b ] + +Return an appropriate error in the case when the driver timeouts on waiting +for firmware to go out of PCI reset. + +Fixes: 233fa44bd67a ("mlxsw: pci: Implement reset done check") +Signed-off-by: Nir Dotan +Acked-by: Jiri Pirko +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c +index c7901a3f2a794..a903e97793f9a 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c +@@ -1367,10 +1367,10 @@ static int mlxsw_pci_sw_reset(struct mlxsw_pci *mlxsw_pci, + u32 val = mlxsw_pci_read32(mlxsw_pci, FW_READY); + + if ((val & MLXSW_PCI_FW_READY_MASK) == MLXSW_PCI_FW_READY_MAGIC) +- break; ++ return 0; + cond_resched(); + } while (time_before(jiffies, end)); +- return 0; ++ return -EBUSY; + } + + static int mlxsw_pci_alloc_irq_vectors(struct mlxsw_pci *mlxsw_pci) +-- +2.19.1 + diff --git a/queue-4.19/mlxsw-spectrum_acl-add-cleanup-after-c-tcam-update-e.patch b/queue-4.19/mlxsw-spectrum_acl-add-cleanup-after-c-tcam-update-e.patch new file mode 100644 index 00000000000..420ca8bbb3b --- /dev/null +++ b/queue-4.19/mlxsw-spectrum_acl-add-cleanup-after-c-tcam-update-e.patch @@ -0,0 +1,47 @@ +From c823c4dfb49658af2822509b657020e1a56fe25c Mon Sep 17 00:00:00 2001 +From: Nir Dotan +Date: Tue, 8 Jan 2019 16:48:03 +0000 +Subject: mlxsw: spectrum_acl: Add cleanup after C-TCAM update error condition + +[ Upstream commit ff0db43cd6c530ff944773ccf48ece55d32d0c22 ] + +When writing to C-TCAM, mlxsw driver uses cregion->ops->entry_insert(). +In case of C-TCAM HW insertion error, the opposite action should take +place. +Add error handling case in which the C-TCAM region entry is removed, by +calling cregion->ops->entry_remove(). + +Fixes: a0a777b9409f ("mlxsw: spectrum_acl: Start using A-TCAM") +Signed-off-by: Nir Dotan +Reviewed-by: Jiri Pirko +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c +index e3c6fe8b1d406..1dcf152b28138 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c +@@ -75,7 +75,15 @@ mlxsw_sp_acl_ctcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp, + act_set = mlxsw_afa_block_first_set(rulei->act_block); + mlxsw_reg_ptce2_flex_action_set_memcpy_to(ptce2_pl, act_set); + +- return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ptce2), ptce2_pl); ++ err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ptce2), ptce2_pl); ++ if (err) ++ goto err_ptce2_write; ++ ++ return 0; ++ ++err_ptce2_write: ++ cregion->ops->entry_remove(cregion, centry); ++ return err; + } + + static void +-- +2.19.1 + diff --git a/queue-4.19/mlxsw-spectrum_switchdev-do-not-treat-static-fdb-ent.patch b/queue-4.19/mlxsw-spectrum_switchdev-do-not-treat-static-fdb-ent.patch new file mode 100644 index 00000000000..767e699779c --- /dev/null +++ b/queue-4.19/mlxsw-spectrum_switchdev-do-not-treat-static-fdb-ent.patch @@ -0,0 +1,81 @@ +From ce0602891f1578fa50ed2f77544d601779d26a9d Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Fri, 18 Jan 2019 15:58:01 +0000 +Subject: mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky + +[ Upstream commit 64254a2054611205798e6bde634639bc704573ac ] + +The driver currently treats static FDB entries as both static and +sticky. This is incorrect and prevents such entries from being roamed to +a different port via learning. + +Fix this by configuring static entries with ageing disabled and roaming +enabled. + +In net-next we can add proper support for the newly introduced 'sticky' +flag. + +Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC") +Signed-off-by: Ido Schimmel +Reported-by: Alexander Petrovskiy +Reviewed-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +index cdec48bcc6ad5..af673abdb4823 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -1209,7 +1209,7 @@ mlxsw_sp_bridge_port_fdb_flush(struct mlxsw_sp *mlxsw_sp, + static enum mlxsw_reg_sfd_rec_policy mlxsw_sp_sfd_rec_policy(bool dynamic) + { + return dynamic ? MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_INGRESS : +- MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY; ++ MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_MLAG; + } + + static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding) +@@ -1221,7 +1221,7 @@ static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding) + static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port, + const char *mac, u16 fid, bool adding, + enum mlxsw_reg_sfd_rec_action action, +- bool dynamic) ++ enum mlxsw_reg_sfd_rec_policy policy) + { + char *sfd_pl; + u8 num_rec; +@@ -1232,8 +1232,7 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port, + return -ENOMEM; + + mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0); +- mlxsw_reg_sfd_uc_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic), +- mac, fid, action, local_port); ++ mlxsw_reg_sfd_uc_pack(sfd_pl, 0, policy, mac, fid, action, local_port); + num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl); + err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl); + if (err) +@@ -1252,7 +1251,8 @@ static int mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port, + bool dynamic) + { + return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, local_port, mac, fid, adding, +- MLXSW_REG_SFD_REC_ACTION_NOP, dynamic); ++ MLXSW_REG_SFD_REC_ACTION_NOP, ++ mlxsw_sp_sfd_rec_policy(dynamic)); + } + + int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid, +@@ -1260,7 +1260,7 @@ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid, + { + return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, 0, mac, fid, adding, + MLXSW_REG_SFD_REC_ACTION_FORWARD_IP_ROUTER, +- false); ++ MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY); + } + + static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id, +-- +2.19.1 + diff --git a/queue-4.19/net-bridge-mark-fdb-entries-that-were-added-by-user-.patch b/queue-4.19/net-bridge-mark-fdb-entries-that-were-added-by-user-.patch new file mode 100644 index 00000000000..0554ff426e0 --- /dev/null +++ b/queue-4.19/net-bridge-mark-fdb-entries-that-were-added-by-user-.patch @@ -0,0 +1,58 @@ +From cfa52f8771e2d873ea9ab12674e6267e0440d376 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Fri, 18 Jan 2019 15:58:00 +0000 +Subject: net: bridge: Mark FDB entries that were added by user as such + +[ Upstream commit 710ae72877378e7cde611efd30fe90502a6e5b30 ] + +Externally learned entries can be added by a user or by a switch driver +that is notifying the bridge driver about entries that were learned in +hardware. + +In the first case, the entries are not marked with the 'added_by_user' +flag, which causes switch drivers to ignore them and not offload them. + +The 'added_by_user' flag can be set on externally learned FDB entries +based on the 'swdev_notify' parameter in br_fdb_external_learn_add(), +which effectively means if the created / updated FDB entry was added by +a user or not. + +Fixes: 816a3bed9549 ("switchdev: Add fdb.added_by_user to switchdev notifications") +Signed-off-by: Ido Schimmel +Reported-by: Alexander Petrovskiy +Reviewed-by: Petr Machata +Cc: Roopa Prabhu +Cc: Nikolay Aleksandrov +Cc: bridge@lists.linux-foundation.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_fdb.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c +index 502f663495308..4d4b9b5ea1c17 100644 +--- a/net/bridge/br_fdb.c ++++ b/net/bridge/br_fdb.c +@@ -1088,6 +1088,8 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p, + err = -ENOMEM; + goto err_unlock; + } ++ if (swdev_notify) ++ fdb->added_by_user = 1; + fdb->added_by_external_learn = 1; + fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify); + } else { +@@ -1107,6 +1109,9 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p, + modified = true; + } + ++ if (swdev_notify) ++ fdb->added_by_user = 1; ++ + if (modified) + fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify); + } +-- +2.19.1 + diff --git a/queue-4.19/net-hns-fix-use-after-free-identified-by-slub-debug.patch b/queue-4.19/net-hns-fix-use-after-free-identified-by-slub-debug.patch new file mode 100644 index 00000000000..b56889e71b6 --- /dev/null +++ b/queue-4.19/net-hns-fix-use-after-free-identified-by-slub-debug.patch @@ -0,0 +1,93 @@ +From 5441ea9b0f38993c85dfeea48b08efbd5960d519 Mon Sep 17 00:00:00 2001 +From: Yonglong Liu +Date: Fri, 4 Jan 2019 20:18:11 +0800 +Subject: net: hns: Fix use after free identified by SLUB debug + +[ Upstream commit bb989501abcafa0de5f18b0ec0ec459b5b817908 ] + +When enable SLUB debug, than remove hns_enet_drv module, SLUB debug will +identify a use after free bug: + +[134.189505] Unable to handle kernel paging request at virtual address + 006b6b6b6b6b6b6b +[134.197553] Mem abort info: +[134.200381] ESR = 0x96000004 +[134.203487] Exception class = DABT (current EL), IL = 32 bits +[134.209497] SET = 0, FnV = 0 +[134.212596] EA = 0, S1PTW = 0 +[134.215777] Data abort info: +[134.218701] ISV = 0, ISS = 0x00000004 +[134.222596] CM = 0, WnR = 0 +[134.225606] [006b6b6b6b6b6b6b] address between user and kernel address ranges +[134.232851] Internal error: Oops: 96000004 [#1] SMP +[134.237798] CPU: 21 PID: 27834 Comm: rmmod Kdump: loaded Tainted: G + OE 4.19.5-1.2.34.aarch64 #1 +[134.247856] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.58 10/24/2018 +[134.255181] pstate: 20000005 (nzCv daif -PAN -UAO) +[134.260044] pc : hns_ae_put_handle+0x38/0x60 +[134.264372] lr : hns_ae_put_handle+0x24/0x60 +[134.268700] sp : ffff00001be93c50 +[134.272054] x29: ffff00001be93c50 x28: ffff802faaec8040 +[134.277442] x27: 0000000000000000 x26: 0000000000000000 +[134.282830] x25: 0000000056000000 x24: 0000000000000015 +[134.288284] x23: ffff0000096fe098 x22: ffff000001050070 +[134.293671] x21: ffff801fb3c044a0 x20: ffff80afb75ec098 +[134.303287] x19: ffff80afb75ec098 x18: 0000000000000000 +[134.312945] x17: 0000000000000000 x16: 0000000000000000 +[134.322517] x15: 0000000000000002 x14: 0000000000000000 +[134.332030] x13: dead000000000100 x12: ffff7e02bea3c988 +[134.341487] x11: ffff80affbee9e68 x10: 0000000000000000 +[134.351033] x9 : 6fffff8000008101 x8 : 0000000000000000 +[134.360569] x7 : dead000000000100 x6 : ffff000009579748 +[134.370059] x5 : 0000000000210d00 x4 : 0000000000000000 +[134.379550] x3 : 0000000000000001 x2 : 0000000000000000 +[134.388813] x1 : 6b6b6b6b6b6b6b6b x0 : 0000000000000000 +[134.397993] Process rmmod (pid: 27834, stack limit = 0x00000000d474b7fd) +[134.408498] Call trace: +[134.414611] hns_ae_put_handle+0x38/0x60 +[134.422208] hnae_put_handle+0xd4/0x108 +[134.429563] hns_nic_dev_remove+0x60/0xc0 [hns_enet_drv] +[134.438342] platform_drv_remove+0x2c/0x70 +[134.445958] device_release_driver_internal+0x174/0x208 +[134.454810] driver_detach+0x70/0xd8 +[134.461913] bus_remove_driver+0x64/0xe8 +[134.469396] driver_unregister+0x34/0x60 +[134.476822] platform_driver_unregister+0x20/0x30 +[134.485130] hns_nic_dev_driver_exit+0x14/0x6e4 [hns_enet_drv] +[134.494634] __arm64_sys_delete_module+0x238/0x290 + +struct hnae_handle is a member of struct hnae_vf_cb, so when vf_cb is +freed, than use hnae_handle will cause use after free panic. + +This patch frees vf_cb after hnae_handle used. + +Signed-off-by: Yonglong Liu +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c +index ad1779fc410e6..a78bfafd212c8 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c +@@ -147,12 +147,10 @@ static void hns_ae_put_handle(struct hnae_handle *handle) + struct hnae_vf_cb *vf_cb = hns_ae_get_vf_cb(handle); + int i; + +- vf_cb->mac_cb = NULL; +- +- kfree(vf_cb); +- + for (i = 0; i < handle->q_num; i++) + hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0; ++ ++ kfree(vf_cb); + } + + static int hns_ae_wait_flow_down(struct hnae_handle *handle) +-- +2.19.1 + diff --git a/queue-4.19/net-mlx4-get-rid-of-page-operation-after-dma_alloc_c.patch b/queue-4.19/net-mlx4-get-rid-of-page-operation-after-dma_alloc_c.patch new file mode 100644 index 00000000000..8155891b8dd --- /dev/null +++ b/queue-4.19/net-mlx4-get-rid-of-page-operation-after-dma_alloc_c.patch @@ -0,0 +1,273 @@ +From bcafeccdea8ae6a80c9e8754cedb287b47bad74e Mon Sep 17 00:00:00 2001 +From: Stephen Warren +Date: Thu, 3 Jan 2019 10:23:23 -0700 +Subject: net/mlx4: Get rid of page operation after dma_alloc_coherent + +[ Upstream commit f65e192af35058e5c82da9e90871b472d24912bc ] + +This patch solves a crash at the time of mlx4 driver unload or system +shutdown. The crash occurs because dma_alloc_coherent() returns one +value in mlx4_alloc_icm_coherent(), but a different value is passed to +dma_free_coherent() in mlx4_free_icm_coherent(). In turn this is because +when allocated, that pointer is passed to sg_set_buf() to record it, +then when freed it is re-calculated by calling +lowmem_page_address(sg_page()) which returns a different value. Solve +this by recording the value that dma_alloc_coherent() returns, and +passing this to dma_free_coherent(). + +This patch is roughly equivalent to commit 378efe798ecf ("RDMA/hns: Get +rid of page operation after dma_alloc_coherent"). + +Based-on-code-from: Christoph Hellwig +Signed-off-by: Stephen Warren +Reviewed-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/icm.c | 92 ++++++++++++++---------- + drivers/net/ethernet/mellanox/mlx4/icm.h | 22 +++++- + 2 files changed, 75 insertions(+), 39 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c +index 7262c6310650e..288fca826a55c 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/icm.c ++++ b/drivers/net/ethernet/mellanox/mlx4/icm.c +@@ -57,12 +57,12 @@ static void mlx4_free_icm_pages(struct mlx4_dev *dev, struct mlx4_icm_chunk *chu + int i; + + if (chunk->nsg > 0) +- pci_unmap_sg(dev->persist->pdev, chunk->mem, chunk->npages, ++ pci_unmap_sg(dev->persist->pdev, chunk->sg, chunk->npages, + PCI_DMA_BIDIRECTIONAL); + + for (i = 0; i < chunk->npages; ++i) +- __free_pages(sg_page(&chunk->mem[i]), +- get_order(chunk->mem[i].length)); ++ __free_pages(sg_page(&chunk->sg[i]), ++ get_order(chunk->sg[i].length)); + } + + static void mlx4_free_icm_coherent(struct mlx4_dev *dev, struct mlx4_icm_chunk *chunk) +@@ -71,9 +71,9 @@ static void mlx4_free_icm_coherent(struct mlx4_dev *dev, struct mlx4_icm_chunk * + + for (i = 0; i < chunk->npages; ++i) + dma_free_coherent(&dev->persist->pdev->dev, +- chunk->mem[i].length, +- lowmem_page_address(sg_page(&chunk->mem[i])), +- sg_dma_address(&chunk->mem[i])); ++ chunk->buf[i].size, ++ chunk->buf[i].addr, ++ chunk->buf[i].dma_addr); + } + + void mlx4_free_icm(struct mlx4_dev *dev, struct mlx4_icm *icm, int coherent) +@@ -111,22 +111,21 @@ static int mlx4_alloc_icm_pages(struct scatterlist *mem, int order, + return 0; + } + +-static int mlx4_alloc_icm_coherent(struct device *dev, struct scatterlist *mem, +- int order, gfp_t gfp_mask) ++static int mlx4_alloc_icm_coherent(struct device *dev, struct mlx4_icm_buf *buf, ++ int order, gfp_t gfp_mask) + { +- void *buf = dma_alloc_coherent(dev, PAGE_SIZE << order, +- &sg_dma_address(mem), gfp_mask); +- if (!buf) ++ buf->addr = dma_alloc_coherent(dev, PAGE_SIZE << order, ++ &buf->dma_addr, gfp_mask); ++ if (!buf->addr) + return -ENOMEM; + +- if (offset_in_page(buf)) { +- dma_free_coherent(dev, PAGE_SIZE << order, +- buf, sg_dma_address(mem)); ++ if (offset_in_page(buf->addr)) { ++ dma_free_coherent(dev, PAGE_SIZE << order, buf->addr, ++ buf->dma_addr); + return -ENOMEM; + } + +- sg_set_buf(mem, buf, PAGE_SIZE << order); +- sg_dma_len(mem) = PAGE_SIZE << order; ++ buf->size = PAGE_SIZE << order; + return 0; + } + +@@ -159,21 +158,21 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages, + + while (npages > 0) { + if (!chunk) { +- chunk = kmalloc_node(sizeof(*chunk), ++ chunk = kzalloc_node(sizeof(*chunk), + gfp_mask & ~(__GFP_HIGHMEM | + __GFP_NOWARN), + dev->numa_node); + if (!chunk) { +- chunk = kmalloc(sizeof(*chunk), ++ chunk = kzalloc(sizeof(*chunk), + gfp_mask & ~(__GFP_HIGHMEM | + __GFP_NOWARN)); + if (!chunk) + goto fail; + } ++ chunk->coherent = coherent; + +- sg_init_table(chunk->mem, MLX4_ICM_CHUNK_LEN); +- chunk->npages = 0; +- chunk->nsg = 0; ++ if (!coherent) ++ sg_init_table(chunk->sg, MLX4_ICM_CHUNK_LEN); + list_add_tail(&chunk->list, &icm->chunk_list); + } + +@@ -186,10 +185,10 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages, + + if (coherent) + ret = mlx4_alloc_icm_coherent(&dev->persist->pdev->dev, +- &chunk->mem[chunk->npages], +- cur_order, mask); ++ &chunk->buf[chunk->npages], ++ cur_order, mask); + else +- ret = mlx4_alloc_icm_pages(&chunk->mem[chunk->npages], ++ ret = mlx4_alloc_icm_pages(&chunk->sg[chunk->npages], + cur_order, mask, + dev->numa_node); + +@@ -205,7 +204,7 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages, + if (coherent) + ++chunk->nsg; + else if (chunk->npages == MLX4_ICM_CHUNK_LEN) { +- chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->mem, ++ chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->sg, + chunk->npages, + PCI_DMA_BIDIRECTIONAL); + +@@ -220,7 +219,7 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages, + } + + if (!coherent && chunk) { +- chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->mem, ++ chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->sg, + chunk->npages, + PCI_DMA_BIDIRECTIONAL); + +@@ -320,7 +319,7 @@ void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj, + u64 idx; + struct mlx4_icm_chunk *chunk; + struct mlx4_icm *icm; +- struct page *page = NULL; ++ void *addr = NULL; + + if (!table->lowmem) + return NULL; +@@ -336,28 +335,49 @@ void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj, + + list_for_each_entry(chunk, &icm->chunk_list, list) { + for (i = 0; i < chunk->npages; ++i) { ++ dma_addr_t dma_addr; ++ size_t len; ++ ++ if (table->coherent) { ++ len = chunk->buf[i].size; ++ dma_addr = chunk->buf[i].dma_addr; ++ addr = chunk->buf[i].addr; ++ } else { ++ struct page *page; ++ ++ len = sg_dma_len(&chunk->sg[i]); ++ dma_addr = sg_dma_address(&chunk->sg[i]); ++ ++ /* XXX: we should never do this for highmem ++ * allocation. This function either needs ++ * to be split, or the kernel virtual address ++ * return needs to be made optional. ++ */ ++ page = sg_page(&chunk->sg[i]); ++ addr = lowmem_page_address(page); ++ } ++ + if (dma_handle && dma_offset >= 0) { +- if (sg_dma_len(&chunk->mem[i]) > dma_offset) +- *dma_handle = sg_dma_address(&chunk->mem[i]) + +- dma_offset; +- dma_offset -= sg_dma_len(&chunk->mem[i]); ++ if (len > dma_offset) ++ *dma_handle = dma_addr + dma_offset; ++ dma_offset -= len; + } ++ + /* + * DMA mapping can merge pages but not split them, + * so if we found the page, dma_handle has already + * been assigned to. + */ +- if (chunk->mem[i].length > offset) { +- page = sg_page(&chunk->mem[i]); ++ if (len > offset) + goto out; +- } +- offset -= chunk->mem[i].length; ++ offset -= len; + } + } + ++ addr = NULL; + out: + mutex_unlock(&table->mutex); +- return page ? lowmem_page_address(page) + offset : NULL; ++ return addr ? addr + offset : NULL; + } + + int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table, +diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.h b/drivers/net/ethernet/mellanox/mlx4/icm.h +index c9169a490557c..d199874b1c074 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/icm.h ++++ b/drivers/net/ethernet/mellanox/mlx4/icm.h +@@ -47,11 +47,21 @@ enum { + MLX4_ICM_PAGE_SIZE = 1 << MLX4_ICM_PAGE_SHIFT, + }; + ++struct mlx4_icm_buf { ++ void *addr; ++ size_t size; ++ dma_addr_t dma_addr; ++}; ++ + struct mlx4_icm_chunk { + struct list_head list; + int npages; + int nsg; +- struct scatterlist mem[MLX4_ICM_CHUNK_LEN]; ++ bool coherent; ++ union { ++ struct scatterlist sg[MLX4_ICM_CHUNK_LEN]; ++ struct mlx4_icm_buf buf[MLX4_ICM_CHUNK_LEN]; ++ }; + }; + + struct mlx4_icm { +@@ -114,12 +124,18 @@ static inline void mlx4_icm_next(struct mlx4_icm_iter *iter) + + static inline dma_addr_t mlx4_icm_addr(struct mlx4_icm_iter *iter) + { +- return sg_dma_address(&iter->chunk->mem[iter->page_idx]); ++ if (iter->chunk->coherent) ++ return iter->chunk->buf[iter->page_idx].dma_addr; ++ else ++ return sg_dma_address(&iter->chunk->sg[iter->page_idx]); + } + + static inline unsigned long mlx4_icm_size(struct mlx4_icm_iter *iter) + { +- return sg_dma_len(&iter->chunk->mem[iter->page_idx]); ++ if (iter->chunk->coherent) ++ return iter->chunk->buf[iter->page_idx].size; ++ else ++ return sg_dma_len(&iter->chunk->sg[iter->page_idx]); + } + + int mlx4_MAP_ICM_AUX(struct mlx4_dev *dev, struct mlx4_icm *icm); +-- +2.19.1 + diff --git a/queue-4.19/net-mlx5e-fix-wrong-zero-tx-drop-counter-indication-.patch b/queue-4.19/net-mlx5e-fix-wrong-zero-tx-drop-counter-indication-.patch new file mode 100644 index 00000000000..b77c9b756c6 --- /dev/null +++ b/queue-4.19/net-mlx5e-fix-wrong-zero-tx-drop-counter-indication-.patch @@ -0,0 +1,33 @@ +From 3d045ca9fe7d8653aae2364827a4bb5894c717d2 Mon Sep 17 00:00:00 2001 +From: Tariq Toukan +Date: Thu, 8 Nov 2018 12:06:53 +0200 +Subject: net/mlx5e: Fix wrong (zero) TX drop counter indication for + representor + +[ Upstream commit 7fdc1adc52d3975740547a78c2df329bb207f15d ] + +For representors, the TX dropped counter is not folded from the +per-ring counters. Fix it. + +Signed-off-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index c9cc9747d21d1..701624a63d2f4 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -144,6 +144,7 @@ static void mlx5e_rep_update_sw_counters(struct mlx5e_priv *priv) + + s->tx_packets += sq_stats->packets; + s->tx_bytes += sq_stats->bytes; ++ s->tx_queue_dropped += sq_stats->dropped; + } + } + } +-- +2.19.1 + diff --git a/queue-4.19/net-stmmac-check-if-cbs-is-supported-before-configur.patch b/queue-4.19/net-stmmac-check-if-cbs-is-supported-before-configur.patch new file mode 100644 index 00000000000..7bf0e87b2de --- /dev/null +++ b/queue-4.19/net-stmmac-check-if-cbs-is-supported-before-configur.patch @@ -0,0 +1,36 @@ +From 8d0349603374782237f07b924e0a871393579e83 Mon Sep 17 00:00:00 2001 +From: Jose Abreu +Date: Wed, 9 Jan 2019 10:05:58 +0100 +Subject: net: stmmac: Check if CBS is supported before configuring + +[ Upstream commit 0650d4017f4d2eee67230a02285a7ae5204240c2 ] + +Check if CBS is currently supported before trying to configure it in HW. + +Cc: Joao Pinto +Cc: David S. Miller +Cc: Giuseppe Cavallaro +Cc: Alexandre Torgue +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +index 531294f4978bc..58ea18af9813a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +@@ -301,6 +301,8 @@ static int tc_setup_cbs(struct stmmac_priv *priv, + /* Queue 0 is not AVB capable */ + if (queue <= 0 || queue >= tx_queues_count) + return -EINVAL; ++ if (!priv->dma_cap.av) ++ return -EOPNOTSUPP; + if (priv->speed != SPEED_100 && priv->speed != SPEED_1000) + return -EOPNOTSUPP; + +-- +2.19.1 + diff --git a/queue-4.19/net-stmmac-dwxgmac2-only-clear-interrupts-that-are-a.patch b/queue-4.19/net-stmmac-dwxgmac2-only-clear-interrupts-that-are-a.patch new file mode 100644 index 00000000000..434c355ab2a --- /dev/null +++ b/queue-4.19/net-stmmac-dwxgmac2-only-clear-interrupts-that-are-a.patch @@ -0,0 +1,56 @@ +From 5c109d50b9714a357ff18fbac266c41b1acae249 Mon Sep 17 00:00:00 2001 +From: Jose Abreu +Date: Wed, 9 Jan 2019 10:05:57 +0100 +Subject: net: stmmac: dwxgmac2: Only clear interrupts that are active + +[ Upstream commit fcc509eb10ff4794641e6ad3082118287a750d0a ] + +In DMA interrupt handler we were clearing all interrupts status, even +the ones that were not active. Fix this and only clear the active +interrupts. + +Cc: Joao Pinto +Cc: David S. Miller +Cc: Giuseppe Cavallaro +Cc: Alexandre Torgue +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +index 20909036e0028..1c39305274440 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +@@ -260,6 +260,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr, + struct stmmac_extra_stats *x, u32 chan) + { + u32 intr_status = readl(ioaddr + XGMAC_DMA_CH_STATUS(chan)); ++ u32 intr_en = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan)); + int ret = 0; + + /* ABNORMAL interrupts */ +@@ -279,8 +280,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr, + x->normal_irq_n++; + + if (likely(intr_status & XGMAC_RI)) { +- u32 value = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan)); +- if (likely(value & XGMAC_RIE)) { ++ if (likely(intr_en & XGMAC_RIE)) { + x->rx_normal_irq_n++; + ret |= handle_rx; + } +@@ -292,7 +292,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr, + } + + /* Clear interrupts */ +- writel(~0x0, ioaddr + XGMAC_DMA_CH_STATUS(chan)); ++ writel(intr_en & intr_status, ioaddr + XGMAC_DMA_CH_STATUS(chan)); + + return ret; + } +-- +2.19.1 + diff --git a/queue-4.19/net-stmmac-fix-pci-module-removal-leak.patch b/queue-4.19/net-stmmac-fix-pci-module-removal-leak.patch new file mode 100644 index 00000000000..59fbe96348e --- /dev/null +++ b/queue-4.19/net-stmmac-fix-pci-module-removal-leak.patch @@ -0,0 +1,54 @@ +From 0905b6c70d9d03d54eb451305963334fc490b45f Mon Sep 17 00:00:00 2001 +From: Jose Abreu +Date: Wed, 9 Jan 2019 10:05:56 +0100 +Subject: net: stmmac: Fix PCI module removal leak + +[ Upstream commit 6dea7e1881fd86b80da64e476ac398008daed857 ] + +Since commit b7d0f08e9129, the enable / disable of PCI device is not +managed which will result in IO regions not being automatically unmapped. +As regions continue mapped it is currently not possible to remove and +then probe again the PCI module of stmmac. + +Fix this by manually unmapping regions on remove callback. + +Changes from v1: +- Fix build error + +Cc: Joao Pinto +Cc: David S. Miller +Cc: Giuseppe Cavallaro +Cc: Alexandre Torgue +Fixes: b7d0f08e9129 ("net: stmmac: Fix WoL for PCI-based setups") +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +index c54a50dbd5ac2..d819e8eaba122 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +@@ -299,7 +299,17 @@ static int stmmac_pci_probe(struct pci_dev *pdev, + */ + static void stmmac_pci_remove(struct pci_dev *pdev) + { ++ int i; ++ + stmmac_dvr_remove(&pdev->dev); ++ ++ for (i = 0; i <= PCI_STD_RESOURCE_END; i++) { ++ if (pci_resource_len(pdev, i) == 0) ++ continue; ++ pcim_iounmap_regions(pdev, BIT(i)); ++ break; ++ } ++ + pci_disable_device(pdev); + } + +-- +2.19.1 + diff --git a/queue-4.19/net-stmmac-fix-the-logic-of-checking-if-rx-watchdog-.patch b/queue-4.19/net-stmmac-fix-the-logic-of-checking-if-rx-watchdog-.patch new file mode 100644 index 00000000000..e4b407f5d46 --- /dev/null +++ b/queue-4.19/net-stmmac-fix-the-logic-of-checking-if-rx-watchdog-.patch @@ -0,0 +1,69 @@ +From a2178def0bcb883497a505b853ff632e9782f2e0 Mon Sep 17 00:00:00 2001 +From: Jose Abreu +Date: Wed, 9 Jan 2019 10:05:59 +0100 +Subject: net: stmmac: Fix the logic of checking if RX Watchdog must be enabled + +[ Upstream commit 3b5094665e273c4a2a99f7f5f16977c0f1e19095 ] + +RX Watchdog can be disabled by platform definitions but currently we are +initializing the descriptors before checking if Watchdog must be +disabled or not. + +Fix this by checking earlier if user wants Watchdog disabled or not. + +Cc: Joao Pinto +Cc: David S. Miller +Cc: Giuseppe Cavallaro +Cc: Alexandre Torgue +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 24 +++++++++---------- + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 2103b865726ac..24ae244c2ee33 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -4191,6 +4191,18 @@ static int stmmac_hw_init(struct stmmac_priv *priv) + return ret; + } + ++ /* Rx Watchdog is available in the COREs newer than the 3.40. ++ * In some case, for example on bugged HW this feature ++ * has to be disable and this can be done by passing the ++ * riwt_off field from the platform. ++ */ ++ if (((priv->synopsys_id >= DWMAC_CORE_3_50) || ++ (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) { ++ priv->use_riwt = 1; ++ dev_info(priv->device, ++ "Enable RX Mitigation via HW Watchdog Timer\n"); ++ } ++ + return 0; + } + +@@ -4323,18 +4335,6 @@ int stmmac_dvr_probe(struct device *device, + if (flow_ctrl) + priv->flow_ctrl = FLOW_AUTO; /* RX/TX pause on */ + +- /* Rx Watchdog is available in the COREs newer than the 3.40. +- * In some case, for example on bugged HW this feature +- * has to be disable and this can be done by passing the +- * riwt_off field from the platform. +- */ +- if (((priv->synopsys_id >= DWMAC_CORE_3_50) || +- (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) { +- priv->use_riwt = 1; +- dev_info(priv->device, +- "Enable RX Mitigation via HW Watchdog Timer\n"); +- } +- + /* Setup channels NAPI */ + maxq = max(priv->plat->rx_queues_to_use, priv->plat->tx_queues_to_use); + +-- +2.19.1 + diff --git a/queue-4.19/net-stmmac-prevent-rx-starvation-in-stmmac_napi_poll.patch b/queue-4.19/net-stmmac-prevent-rx-starvation-in-stmmac_napi_poll.patch new file mode 100644 index 00000000000..59e8dea1368 --- /dev/null +++ b/queue-4.19/net-stmmac-prevent-rx-starvation-in-stmmac_napi_poll.patch @@ -0,0 +1,78 @@ +From 3cef9a1d02bf84b86a6edf42e26adfaad3a600da Mon Sep 17 00:00:00 2001 +From: Jose Abreu +Date: Wed, 9 Jan 2019 10:06:00 +0100 +Subject: net: stmmac: Prevent RX starvation in stmmac_napi_poll() + +[ Upstream commit fa0be0a43f101888ac677dba31b590963eafeaa1 ] + +Currently, TX is given a budget which is consumed by stmmac_tx_clean() +and stmmac_rx() is given the remaining non-consumed budget. + +This is wrong and in case we are sending a large number of packets this +can starve RX because remaining budget will be low. + +Let's give always the same budget for RX and TX clean. + +While at it, check if we missed any interrupts while we were in NAPI +callback by looking at DMA interrupt status. + +Cc: Joao Pinto +Cc: David S. Miller +Cc: Giuseppe Cavallaro +Cc: Alexandre Torgue +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 27 ++++++++++--------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 24ae244c2ee33..123b74e25ed81 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -3522,27 +3522,28 @@ static int stmmac_napi_poll(struct napi_struct *napi, int budget) + struct stmmac_channel *ch = + container_of(napi, struct stmmac_channel, napi); + struct stmmac_priv *priv = ch->priv_data; +- int work_done = 0, work_rem = budget; ++ int work_done, rx_done = 0, tx_done = 0; + u32 chan = ch->index; + + priv->xstats.napi_poll++; + +- if (ch->has_tx) { +- int done = stmmac_tx_clean(priv, work_rem, chan); ++ if (ch->has_tx) ++ tx_done = stmmac_tx_clean(priv, budget, chan); ++ if (ch->has_rx) ++ rx_done = stmmac_rx(priv, budget, chan); + +- work_done += done; +- work_rem -= done; +- } +- +- if (ch->has_rx) { +- int done = stmmac_rx(priv, work_rem, chan); ++ work_done = max(rx_done, tx_done); ++ work_done = min(work_done, budget); + +- work_done += done; +- work_rem -= done; +- } ++ if (work_done < budget && napi_complete_done(napi, work_done)) { ++ int stat; + +- if (work_done < budget && napi_complete_done(napi, work_done)) + stmmac_enable_dma_irq(priv, priv->ioaddr, chan); ++ stat = stmmac_dma_interrupt_status(priv, priv->ioaddr, ++ &priv->xstats, chan); ++ if (stat && napi_reschedule(napi)) ++ stmmac_disable_dma_irq(priv, priv->ioaddr, chan); ++ } + + return work_done; + } +-- +2.19.1 + diff --git a/queue-4.19/netfilter-nf_tables-fix-leaking-object-reference-cou.patch b/queue-4.19/netfilter-nf_tables-fix-leaking-object-reference-cou.patch new file mode 100644 index 00000000000..22d96ebdf9e --- /dev/null +++ b/queue-4.19/netfilter-nf_tables-fix-leaking-object-reference-cou.patch @@ -0,0 +1,56 @@ +From 9deb3ca915755afb97b3348e308f2d84d080b783 Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Fri, 4 Jan 2019 17:56:16 +0900 +Subject: netfilter: nf_tables: fix leaking object reference count + +[ Upstream commit b91d9036883793122cf6575ca4dfbfbdd201a83d ] + +There is no code that decreases the reference count of stateful objects +in error path of the nft_add_set_elem(). this causes a leak of reference +count of stateful objects. + +Test commands: + $nft add table ip filter + $nft add counter ip filter c1 + $nft add map ip filter m1 { type ipv4_addr : counter \;} + $nft add element ip filter m1 { 1 : c1 } + $nft add element ip filter m1 { 1 : c1 } + $nft delete element ip filter m1 { 1 } + $nft delete counter ip filter c1 + +Result: + Error: Could not process rule: Device or resource busy + delete counter ip filter c1 + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +At the second 'nft add element ip filter m1 { 1 : c1 }', the reference +count of the 'c1' is increased then it tries to insert into the 'm1'. but +the 'm1' already has same element so it returns -EEXIST. +But it doesn't decrease the reference count of the 'c1' in the error path. +Due to a leak of the reference count of the 'c1', the 'c1' can't be +removed by 'nft delete counter ip filter c1'. + +Fixes: 8aeff920dcc9 ("netfilter: nf_tables: add stateful object reference to set elements") +Signed-off-by: Taehee Yoo +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index ed9af46720e14..38654730230b2 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4439,6 +4439,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + err5: + kfree(trans); + err4: ++ if (obj) ++ obj->use--; + kfree(elem.priv); + err3: + if (nla[NFTA_SET_ELEM_DATA] != NULL) +-- +2.19.1 + diff --git a/queue-4.19/netfilter-nft_flow_offload-fix-checking-method-of-co.patch b/queue-4.19/netfilter-nft_flow_offload-fix-checking-method-of-co.patch new file mode 100644 index 00000000000..996245a11e5 --- /dev/null +++ b/queue-4.19/netfilter-nft_flow_offload-fix-checking-method-of-co.patch @@ -0,0 +1,61 @@ +From a1d7ac3c3003e4eae90c9a4113623b5bf00ca7db Mon Sep 17 00:00:00 2001 +From: Henry Yen +Date: Mon, 14 Jan 2019 17:59:43 +0800 +Subject: netfilter: nft_flow_offload: fix checking method of conntrack helper + +[ Upstream commit 2314e879747e82896f51cce4488f6a00f3e1af7b ] + +This patch uses nfct_help() to detect whether an established connection +needs conntrack helper instead of using test_bit(IPS_HELPER_BIT, +&ct->status). + +The reason is that IPS_HELPER_BIT is only set when using explicit CT +target. + +However, in the case that a device enables conntrack helper via command +"echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper", the status of +IPS_HELPER_BIT will not present any change, and consequently it loses +the checking ability in the context. + +Signed-off-by: Henry Yen +Reviewed-by: Ryder Lee +Tested-by: John Crispin +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_flow_offload.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index 4d7cf943fff2c..436cc14cfc59b 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + + struct nft_flow_offload { + struct nft_flowtable *flowtable; +@@ -66,6 +67,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + { + struct nft_flow_offload *priv = nft_expr_priv(expr); + struct nf_flowtable *flowtable = &priv->flowtable->data; ++ const struct nf_conn_help *help; + enum ip_conntrack_info ctinfo; + struct nf_flow_route route; + struct flow_offload *flow; +@@ -88,7 +90,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, + goto out; + } + +- if (test_bit(IPS_HELPER_BIT, &ct->status)) ++ help = nfct_help(ct); ++ if (help) + goto out; + + if (ctinfo == IP_CT_NEW || +-- +2.19.1 + diff --git a/queue-4.19/netfilter-nft_flow_offload-fix-interaction-with-vrf-.patch b/queue-4.19/netfilter-nft_flow_offload-fix-interaction-with-vrf-.patch new file mode 100644 index 00000000000..8c3c36e383f --- /dev/null +++ b/queue-4.19/netfilter-nft_flow_offload-fix-interaction-with-vrf-.patch @@ -0,0 +1,102 @@ +From 04cb8830b33ac4d6157abb8d645411fa266de25f Mon Sep 17 00:00:00 2001 +From: wenxu +Date: Thu, 10 Jan 2019 14:51:35 +0800 +Subject: netfilter: nft_flow_offload: fix interaction with vrf slave device + +[ Upstream commit 10f4e765879e514e1ce7f52ed26603047af196e2 ] + +In the forward chain, the iif is changed from slave device to master vrf +device. Thus, flow offload does not find a match on the lower slave +device. + +This patch uses the cached route, ie. dst->dev, to update the iif and +oif fields in the flow entry. + +After this patch, the following example works fine: + + # ip addr add dev eth0 1.1.1.1/24 + # ip addr add dev eth1 10.0.0.1/24 + # ip link add user1 type vrf table 1 + # ip l set user1 up + # ip l set dev eth0 master user1 + # ip l set dev eth1 master user1 + + # nft add table firewall + # nft add flowtable f fb1 { hook ingress priority 0 \; devices = { eth0, eth1 } \; } + # nft add chain f ftb-all {type filter hook forward priority 0 \; policy accept \; } + # nft add rule f ftb-all ct zone 1 ip protocol tcp flow offload @fb1 + # nft add rule f ftb-all ct zone 1 ip protocol udp flow offload @fb1 + +Signed-off-by: wenxu +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_flow_table.h | 1 - + net/netfilter/nf_flow_table_core.c | 5 +++-- + net/netfilter/nft_flow_offload.c | 4 ++-- + 3 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h +index 0e355f4a3d763..0a3de10c6dece 100644 +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -84,7 +84,6 @@ struct flow_offload { + struct nf_flow_route { + struct { + struct dst_entry *dst; +- int ifindex; + } tuple[FLOW_OFFLOAD_DIR_MAX]; + }; + +diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c +index d8125616edc79..e1537ace2b90c 100644 +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -28,6 +28,7 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct, + { + struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple; + struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple; ++ struct dst_entry *other_dst = route->tuple[!dir].dst; + struct dst_entry *dst = route->tuple[dir].dst; + + ft->dir = dir; +@@ -50,8 +51,8 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct, + ft->src_port = ctt->src.u.tcp.port; + ft->dst_port = ctt->dst.u.tcp.port; + +- ft->iifidx = route->tuple[dir].ifindex; +- ft->oifidx = route->tuple[!dir].ifindex; ++ ft->iifidx = other_dst->dev->ifindex; ++ ft->oifidx = dst->dev->ifindex; + ft->dst_cache = dst; + } + +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index e0c04851a3493..4d7cf943fff2c 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -30,9 +30,11 @@ static int nft_flow_route(const struct nft_pktinfo *pkt, + switch (nft_pf(pkt)) { + case NFPROTO_IPV4: + fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip; ++ fl.u.ip4.flowi4_oif = nft_in(pkt)->ifindex; + break; + case NFPROTO_IPV6: + fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6; ++ fl.u.ip6.flowi6_oif = nft_in(pkt)->ifindex; + break; + } + +@@ -41,9 +43,7 @@ static int nft_flow_route(const struct nft_pktinfo *pkt, + return -ENOENT; + + route->tuple[dir].dst = this_dst; +- route->tuple[dir].ifindex = nft_in(pkt)->ifindex; + route->tuple[!dir].dst = other_dst; +- route->tuple[!dir].ifindex = nft_out(pkt)->ifindex; + + return 0; + } +-- +2.19.1 + diff --git a/queue-4.19/netfilter-nft_flow_offload-fix-reverse-route-lookup.patch b/queue-4.19/netfilter-nft_flow_offload-fix-reverse-route-lookup.patch new file mode 100644 index 00000000000..81085f13e37 --- /dev/null +++ b/queue-4.19/netfilter-nft_flow_offload-fix-reverse-route-lookup.patch @@ -0,0 +1,50 @@ +From fb5ac0d850a34ff3da110f008984f7a2b3ee195a Mon Sep 17 00:00:00 2001 +From: wenxu +Date: Wed, 9 Jan 2019 10:40:11 +0800 +Subject: netfilter: nft_flow_offload: Fix reverse route lookup + +[ Upstream commit a799aea0988ea0d1b1f263e996fdad2f6133c680 ] + +Using the following example: + + client 1.1.1.7 ---> 2.2.2.7 which dnat to 10.0.0.7 server + +The first reply packet (ie. syn+ack) uses an incorrect destination +address for the reverse route lookup since it uses: + + daddr = ct->tuplehash[!dir].tuple.dst.u3.ip; + +which is 2.2.2.7 in the scenario that is described above, while this +should be: + + daddr = ct->tuplehash[dir].tuple.src.u3.ip; + +that is 10.0.0.7. + +Signed-off-by: wenxu +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_flow_offload.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c +index 5fd4c57c79cc9..e0c04851a3493 100644 +--- a/net/netfilter/nft_flow_offload.c ++++ b/net/netfilter/nft_flow_offload.c +@@ -29,10 +29,10 @@ static int nft_flow_route(const struct nft_pktinfo *pkt, + memset(&fl, 0, sizeof(fl)); + switch (nft_pf(pkt)) { + case NFPROTO_IPV4: +- fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip; ++ fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip; + break; + case NFPROTO_IPV6: +- fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6; ++ fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6; + break; + } + +-- +2.19.1 + diff --git a/queue-4.19/powerpc-8xx-fix-setting-of-pagetable-for-abatron-bdi.patch b/queue-4.19/powerpc-8xx-fix-setting-of-pagetable-for-abatron-bdi.patch new file mode 100644 index 00000000000..80e6576cfa2 --- /dev/null +++ b/queue-4.19/powerpc-8xx-fix-setting-of-pagetable-for-abatron-bdi.patch @@ -0,0 +1,42 @@ +From 80db45ef0b512107e0cfdd9e3d43ac65d07424f4 Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Wed, 9 Jan 2019 20:30:07 +0000 +Subject: powerpc/8xx: fix setting of pagetable for Abatron BDI debug tool. + +[ Upstream commit fb0bdec51a4901b7dd088de0a1e365e1b9f5cd21 ] + +Commit 8c8c10b90d88 ("powerpc/8xx: fix handling of early NULL pointer +dereference") moved the loading of r6 earlier in the code. As some +functions are called inbetween, r6 needs to be loaded again with the +address of swapper_pg_dir in order to set PTE pointers for +the Abatron BDI. + +Fixes: 8c8c10b90d88 ("powerpc/8xx: fix handling of early NULL pointer dereference") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/head_8xx.S | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S +index 81d4574d1f377..9fd2ff28b8ff2 100644 +--- a/arch/powerpc/kernel/head_8xx.S ++++ b/arch/powerpc/kernel/head_8xx.S +@@ -919,11 +919,12 @@ start_here: + + /* set up the PTE pointers for the Abatron bdiGDB. + */ +- tovirt(r6,r6) + lis r5, abatron_pteptrs@h + ori r5, r5, abatron_pteptrs@l + stw r5, 0xf0(0) /* Must match your Abatron config file */ + tophys(r5,r5) ++ lis r6, swapper_pg_dir@h ++ ori r6, r6, swapper_pg_dir@l + stw r6, 0(r5) + + /* Now turn on the MMU for real! */ +-- +2.19.1 + diff --git a/queue-4.19/pvcalls-back-set-enotconn-in-pvcalls_conn_back_read.patch b/queue-4.19/pvcalls-back-set-enotconn-in-pvcalls_conn_back_read.patch new file mode 100644 index 00000000000..1774939b56f --- /dev/null +++ b/queue-4.19/pvcalls-back-set-enotconn-in-pvcalls_conn_back_read.patch @@ -0,0 +1,52 @@ +From 943636be302f882fc6f1c15068bfb8c6fd740899 Mon Sep 17 00:00:00 2001 +From: Stefano Stabellini +Date: Fri, 21 Dec 2018 15:06:33 -0800 +Subject: pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read + +[ Upstream commit e6587cdbd732eacb4c7ce592ed46f7bbcefb655f ] + +When a connection is closing we receive on pvcalls_sk_state_change +notification. Instead of setting the connection as closed immediately +(-ENOTCONN), let's read one more time from it: pvcalls_conn_back_read +will set the connection as closed when necessary. + +That way, we avoid races between pvcalls_sk_state_change and +pvcalls_back_ioworker. + +Signed-off-by: Stefano Stabellini +Reviewed-by: Boris Ostrovsky +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + drivers/xen/pvcalls-back.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c +index b1092fbefa630..e8b3ff8e7868b 100644 +--- a/drivers/xen/pvcalls-back.c ++++ b/drivers/xen/pvcalls-back.c +@@ -160,9 +160,10 @@ static void pvcalls_conn_back_read(void *opaque) + + /* write the data, then modify the indexes */ + virt_wmb(); +- if (ret < 0) ++ if (ret < 0) { ++ atomic_set(&map->read, 0); + intf->in_error = ret; +- else ++ } else + intf->in_prod = prod + ret; + /* update the indexes, then notify the other end */ + virt_wmb(); +@@ -288,7 +289,7 @@ static void pvcalls_sk_state_change(struct sock *sock) + return; + + intf = map->ring; +- intf->in_error = -ENOTCONN; ++ atomic_inc(&map->read); + notify_remote_via_irq(map->irq); + } + +-- +2.19.1 + diff --git a/queue-4.19/pvcalls-front-avoid-get_free_pages-gfp_kernel-under-.patch b/queue-4.19/pvcalls-front-avoid-get_free_pages-gfp_kernel-under-.patch new file mode 100644 index 00000000000..421c64f7a85 --- /dev/null +++ b/queue-4.19/pvcalls-front-avoid-get_free_pages-gfp_kernel-under-.patch @@ -0,0 +1,206 @@ +From 067166af2f8674507f271a419543cc51b5e43dd8 Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Wed, 5 Dec 2018 10:35:50 +0800 +Subject: pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock + +[ Upstream commit 9f51c05dc41a6d69423e3d03d18eb7ab22f9ec19 ] + +The problem is that we call this with a spin lock held. +The call tree is: +pvcalls_front_accept() holds bedata->socket_lock. + -> create_active() + -> __get_free_pages() uses GFP_KERNEL + +The create_active() function is only called from pvcalls_front_accept() +with a spin_lock held, The allocation is not allowed to sleep and +GFP_KERNEL is not sufficient. + +This issue was detected by using the Coccinelle software. + +v2: Add a function doing the allocations which is called + outside the lock and passing the allocated data to + create_active(). + +v3: Use the matching deallocators i.e., free_page() + and free_pages(), respectively. + +v4: It would be better to pre-populate map (struct sock_mapping), + rather than introducing one more new struct. + +v5: Since allocating the data outside of this call it should also + be freed outside, when create_active() fails. + Move kzalloc(sizeof(*map2), GFP_ATOMIC) outside spinlock and + use GFP_KERNEL instead. + +v6: Drop the superfluous calls. + +Suggested-by: Juergen Gross +Suggested-by: Boris Ostrovsky +Suggested-by: Stefano Stabellini +Signed-off-by: Wen Yang +Acked-by: Stefano Stabellini +CC: Julia Lawall +CC: Boris Ostrovsky +CC: Juergen Gross +CC: Stefano Stabellini +CC: xen-devel@lists.xenproject.org +CC: linux-kernel@vger.kernel.org +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + drivers/xen/pvcalls-front.c | 81 +++++++++++++++++++++++++++---------- + 1 file changed, 59 insertions(+), 22 deletions(-) + +diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c +index 01588582ae663..6357160d466ab 100644 +--- a/drivers/xen/pvcalls-front.c ++++ b/drivers/xen/pvcalls-front.c +@@ -341,6 +341,39 @@ int pvcalls_front_socket(struct socket *sock) + return ret; + } + ++static void free_active_ring(struct sock_mapping *map) ++{ ++ free_pages((unsigned long)map->active.data.in, ++ map->active.ring->ring_order); ++ free_page((unsigned long)map->active.ring); ++} ++ ++static int alloc_active_ring(struct sock_mapping *map) ++{ ++ void *bytes; ++ ++ map->active.ring = (struct pvcalls_data_intf *) ++ get_zeroed_page(GFP_KERNEL); ++ if (!map->active.ring) ++ goto out; ++ ++ map->active.ring->ring_order = PVCALLS_RING_ORDER; ++ bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, ++ PVCALLS_RING_ORDER); ++ if (!bytes) ++ goto out; ++ ++ map->active.data.in = bytes; ++ map->active.data.out = bytes + ++ XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER); ++ ++ return 0; ++ ++out: ++ free_active_ring(map); ++ return -ENOMEM; ++} ++ + static int create_active(struct sock_mapping *map, int *evtchn) + { + void *bytes; +@@ -349,15 +382,7 @@ static int create_active(struct sock_mapping *map, int *evtchn) + *evtchn = -1; + init_waitqueue_head(&map->active.inflight_conn_req); + +- map->active.ring = (struct pvcalls_data_intf *) +- __get_free_page(GFP_KERNEL | __GFP_ZERO); +- if (map->active.ring == NULL) +- goto out_error; +- map->active.ring->ring_order = PVCALLS_RING_ORDER; +- bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, +- PVCALLS_RING_ORDER); +- if (bytes == NULL) +- goto out_error; ++ bytes = map->active.data.in; + for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++) + map->active.ring->ref[i] = gnttab_grant_foreign_access( + pvcalls_front_dev->otherend_id, +@@ -367,10 +392,6 @@ static int create_active(struct sock_mapping *map, int *evtchn) + pvcalls_front_dev->otherend_id, + pfn_to_gfn(virt_to_pfn((void *)map->active.ring)), 0); + +- map->active.data.in = bytes; +- map->active.data.out = bytes + +- XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER); +- + ret = xenbus_alloc_evtchn(pvcalls_front_dev, evtchn); + if (ret) + goto out_error; +@@ -391,8 +412,6 @@ static int create_active(struct sock_mapping *map, int *evtchn) + out_error: + if (*evtchn >= 0) + xenbus_free_evtchn(pvcalls_front_dev, *evtchn); +- free_pages((unsigned long)map->active.data.in, PVCALLS_RING_ORDER); +- free_page((unsigned long)map->active.ring); + return ret; + } + +@@ -412,17 +431,24 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr, + return PTR_ERR(map); + + bedata = dev_get_drvdata(&pvcalls_front_dev->dev); ++ ret = alloc_active_ring(map); ++ if (ret < 0) { ++ pvcalls_exit_sock(sock); ++ return ret; ++ } + + spin_lock(&bedata->socket_lock); + ret = get_request(bedata, &req_id); + if (ret < 0) { + spin_unlock(&bedata->socket_lock); ++ free_active_ring(map); + pvcalls_exit_sock(sock); + return ret; + } + ret = create_active(map, &evtchn); + if (ret < 0) { + spin_unlock(&bedata->socket_lock); ++ free_active_ring(map); + pvcalls_exit_sock(sock); + return ret; + } +@@ -784,25 +810,36 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags) + } + } + +- spin_lock(&bedata->socket_lock); +- ret = get_request(bedata, &req_id); +- if (ret < 0) { ++ map2 = kzalloc(sizeof(*map2), GFP_KERNEL); ++ if (map2 == NULL) { + clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, + (void *)&map->passive.flags); +- spin_unlock(&bedata->socket_lock); ++ pvcalls_exit_sock(sock); ++ return -ENOMEM; ++ } ++ ret = alloc_active_ring(map2); ++ if (ret < 0) { ++ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, ++ (void *)&map->passive.flags); ++ kfree(map2); + pvcalls_exit_sock(sock); + return ret; + } +- map2 = kzalloc(sizeof(*map2), GFP_ATOMIC); +- if (map2 == NULL) { ++ spin_lock(&bedata->socket_lock); ++ ret = get_request(bedata, &req_id); ++ if (ret < 0) { + clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, + (void *)&map->passive.flags); + spin_unlock(&bedata->socket_lock); ++ free_active_ring(map2); ++ kfree(map2); + pvcalls_exit_sock(sock); +- return -ENOMEM; ++ return ret; + } ++ + ret = create_active(map2, &evtchn); + if (ret < 0) { ++ free_active_ring(map2); + kfree(map2); + clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, + (void *)&map->passive.flags); +-- +2.19.1 + diff --git a/queue-4.19/pvcalls-front-don-t-try-to-free-unallocated-rings.patch b/queue-4.19/pvcalls-front-don-t-try-to-free-unallocated-rings.patch new file mode 100644 index 00000000000..2867debf500 --- /dev/null +++ b/queue-4.19/pvcalls-front-don-t-try-to-free-unallocated-rings.patch @@ -0,0 +1,36 @@ +From a976aa05b9a9a7c661bb9eade30c579173d6689c Mon Sep 17 00:00:00 2001 +From: Stefano Stabellini +Date: Fri, 21 Dec 2018 15:06:30 -0800 +Subject: pvcalls-front: don't try to free unallocated rings + +[ Upstream commit 96283f9a084e23d7cda2d3c5d1ffa6df6cf1ecec ] + +inflight_req_id is 0 when initialized. If inflight_req_id is 0, there is +no accept_map to free. Fix the check in pvcalls_front_release. + +Signed-off-by: Stefano Stabellini +Reviewed-by: Boris Ostrovsky +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + drivers/xen/pvcalls-front.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c +index e5d95aab2cb80..4f3d664b3f39e 100644 +--- a/drivers/xen/pvcalls-front.c ++++ b/drivers/xen/pvcalls-front.c +@@ -1030,8 +1030,8 @@ int pvcalls_front_release(struct socket *sock) + spin_lock(&bedata->socket_lock); + list_del(&map->list); + spin_unlock(&bedata->socket_lock); +- if (READ_ONCE(map->passive.inflight_req_id) != +- PVCALLS_INVALID_ID) { ++ if (READ_ONCE(map->passive.inflight_req_id) != PVCALLS_INVALID_ID && ++ READ_ONCE(map->passive.inflight_req_id) != 0) { + pvcalls_front_free_map(bedata, + map->passive.accept_map); + } +-- +2.19.1 + diff --git a/queue-4.19/pvcalls-front-fix-potential-null-dereference.patch b/queue-4.19/pvcalls-front-fix-potential-null-dereference.patch new file mode 100644 index 00000000000..bf14f03db94 --- /dev/null +++ b/queue-4.19/pvcalls-front-fix-potential-null-dereference.patch @@ -0,0 +1,77 @@ +From a81a10e6cab4cd726910827150e94acbc8ab5a06 Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Tue, 15 Jan 2019 10:31:27 +0800 +Subject: pvcalls-front: fix potential null dereference + +[ Upstream commit b4711098066f1cf808d4dc11a1a842860a3292fe ] + + static checker warning: + drivers/xen/pvcalls-front.c:373 alloc_active_ring() + error: we previously assumed 'map->active.ring' could be null + (see line 357) + +drivers/xen/pvcalls-front.c + 351 static int alloc_active_ring(struct sock_mapping *map) + 352 { + 353 void *bytes; + 354 + 355 map->active.ring = (struct pvcalls_data_intf *) + 356 get_zeroed_page(GFP_KERNEL); + 357 if (!map->active.ring) + ^^^^^^^^^^^^^^^^^ +Check + + 358 goto out; + 359 + 360 map->active.ring->ring_order = PVCALLS_RING_ORDER; + 361 bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, + 362 PVCALLS_RING_ORDER); + 363 if (!bytes) + 364 goto out; + 365 + 366 map->active.data.in = bytes; + 367 map->active.data.out = bytes + + 368 XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER); + 369 + 370 return 0; + 371 + 372 out: +--> 373 free_active_ring(map); + ^^^ +Add null check on map->active.ring before dereferencing it to avoid +any NULL pointer dereferences. + +Fixes: 9f51c05dc41a ("pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock") +Reported-by: Dan Carpenter +Suggested-by: Boris Ostrovsky +Signed-off-by: Wen Yang +Reviewed-by: Boris Ostrovsky +CC: Boris Ostrovsky +CC: Juergen Gross +CC: Stefano Stabellini +CC: Dan Carpenter +CC: xen-devel@lists.xenproject.org +CC: linux-kernel@vger.kernel.org +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + drivers/xen/pvcalls-front.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c +index 6357160d466ab..91da7e44d5d4f 100644 +--- a/drivers/xen/pvcalls-front.c ++++ b/drivers/xen/pvcalls-front.c +@@ -343,6 +343,9 @@ int pvcalls_front_socket(struct socket *sock) + + static void free_active_ring(struct sock_mapping *map) + { ++ if (!map->active.ring) ++ return; ++ + free_pages((unsigned long)map->active.data.in, + map->active.ring->ring_order); + free_page((unsigned long)map->active.ring); +-- +2.19.1 + diff --git a/queue-4.19/pvcalls-front-properly-allocate-sk.patch b/queue-4.19/pvcalls-front-properly-allocate-sk.patch new file mode 100644 index 00000000000..52302597b73 --- /dev/null +++ b/queue-4.19/pvcalls-front-properly-allocate-sk.patch @@ -0,0 +1,48 @@ +From bb1e1e70c2e720dbb6a67f9247fc1d03cbe39101 Mon Sep 17 00:00:00 2001 +From: Stefano Stabellini +Date: Fri, 21 Dec 2018 15:06:31 -0800 +Subject: pvcalls-front: properly allocate sk + +[ Upstream commit beee1fbe8f7d57d6ebaa5188f9f4db89c2077196 ] + +Don't use kzalloc: it ends up leaving sk->sk_prot not properly +initialized. Use sk_alloc instead and define our own trivial struct +proto. + +Signed-off-by: Stefano Stabellini +Reviewed-by: Boris Ostrovsky +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + drivers/xen/pvcalls-front.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c +index 4f3d664b3f39e..01588582ae663 100644 +--- a/drivers/xen/pvcalls-front.c ++++ b/drivers/xen/pvcalls-front.c +@@ -31,6 +31,12 @@ + #define PVCALLS_NR_RSP_PER_RING __CONST_RING_SIZE(xen_pvcalls, XEN_PAGE_SIZE) + #define PVCALLS_FRONT_MAX_SPIN 5000 + ++static struct proto pvcalls_proto = { ++ .name = "PVCalls", ++ .owner = THIS_MODULE, ++ .obj_size = sizeof(struct sock), ++}; ++ + struct pvcalls_bedata { + struct xen_pvcalls_front_ring ring; + grant_ref_t ref; +@@ -837,7 +843,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags) + + received: + map2->sock = newsock; +- newsock->sk = kzalloc(sizeof(*newsock->sk), GFP_KERNEL); ++ newsock->sk = sk_alloc(sock_net(sock->sk), PF_INET, GFP_KERNEL, &pvcalls_proto, false); + if (!newsock->sk) { + bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID; + map->passive.inflight_req_id = PVCALLS_INVALID_ID; +-- +2.19.1 + diff --git a/queue-4.19/pvcalls-front-read-all-data-before-closing-the-conne.patch b/queue-4.19/pvcalls-front-read-all-data-before-closing-the-conne.patch new file mode 100644 index 00000000000..eb8ed63fb3a --- /dev/null +++ b/queue-4.19/pvcalls-front-read-all-data-before-closing-the-conne.patch @@ -0,0 +1,43 @@ +From 2ba2ec520f2f0b775a8bcdbaa05e1ac820ea53da Mon Sep 17 00:00:00 2001 +From: Stefano Stabellini +Date: Fri, 21 Dec 2018 15:06:29 -0800 +Subject: pvcalls-front: read all data before closing the connection + +[ Upstream commit b79470b64fa9266948d1ce8d825ced94c4f63293 ] + +When a connection is closing in_error is set to ENOTCONN. There could +still be outstanding data on the ring left by the backend. Before +closing the connection on the frontend side, drain the ring. + +Signed-off-by: Stefano Stabellini +Reviewed-by: Boris Ostrovsky +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + drivers/xen/pvcalls-front.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c +index 77224d8f3e6fe..e5d95aab2cb80 100644 +--- a/drivers/xen/pvcalls-front.c ++++ b/drivers/xen/pvcalls-front.c +@@ -560,15 +560,13 @@ static int __read_ring(struct pvcalls_data_intf *intf, + error = intf->in_error; + /* get pointers before reading from the ring */ + virt_rmb(); +- if (error < 0) +- return error; + + size = pvcalls_queued(prod, cons, array_size); + masked_prod = pvcalls_mask(prod, array_size); + masked_cons = pvcalls_mask(cons, array_size); + + if (size == 0) +- return 0; ++ return error ?: size; + + if (len > size) + len = size; +-- +2.19.1 + diff --git a/queue-4.19/qed-fix-qed_chain_set_prod-for-pbl-chains-with-non-p.patch b/queue-4.19/qed-fix-qed_chain_set_prod-for-pbl-chains-with-non-p.patch new file mode 100644 index 00000000000..02f36710bf6 --- /dev/null +++ b/queue-4.19/qed-fix-qed_chain_set_prod-for-pbl-chains-with-non-p.patch @@ -0,0 +1,65 @@ +From 4f3274a4081139c2de7eb48b283d4dd4a1276c95 Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Thu, 3 Jan 2019 12:02:39 +0200 +Subject: qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page + count + +[ Upstream commit 2d533a9287f2011632977e87ce2783f4c689c984 ] + +In PBL chains with non power of 2 page count, the producer is not at the +beginning of the chain when index is 0 after a wrap. Therefore, after the +producer index wrap around, page index should be calculated more carefully. + +Signed-off-by: Denis Bolotin +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/qed/qed_chain.h | 31 +++++++++++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h +index 59ddf9af909e4..2dd0a9ed5b361 100644 +--- a/include/linux/qed/qed_chain.h ++++ b/include/linux/qed/qed_chain.h +@@ -663,6 +663,37 @@ static inline void *qed_chain_get_last_elem(struct qed_chain *p_chain) + static inline void qed_chain_set_prod(struct qed_chain *p_chain, + u32 prod_idx, void *p_prod_elem) + { ++ if (p_chain->mode == QED_CHAIN_MODE_PBL) { ++ u32 cur_prod, page_mask, page_cnt, page_diff; ++ ++ cur_prod = is_chain_u16(p_chain) ? p_chain->u.chain16.prod_idx : ++ p_chain->u.chain32.prod_idx; ++ ++ /* Assume that number of elements in a page is power of 2 */ ++ page_mask = ~p_chain->elem_per_page_mask; ++ ++ /* Use "cur_prod - 1" and "prod_idx - 1" since producer index ++ * reaches the first element of next page before the page index ++ * is incremented. See qed_chain_produce(). ++ * Index wrap around is not a problem because the difference ++ * between current and given producer indices is always ++ * positive and lower than the chain's capacity. ++ */ ++ page_diff = (((cur_prod - 1) & page_mask) - ++ ((prod_idx - 1) & page_mask)) / ++ p_chain->elem_per_page; ++ ++ page_cnt = qed_chain_get_page_cnt(p_chain); ++ if (is_chain_u16(p_chain)) ++ p_chain->pbl.c.u16.prod_page_idx = ++ (p_chain->pbl.c.u16.prod_page_idx - ++ page_diff + page_cnt) % page_cnt; ++ else ++ p_chain->pbl.c.u32.prod_page_idx = ++ (p_chain->pbl.c.u32.prod_page_idx - ++ page_diff + page_cnt) % page_cnt; ++ } ++ + if (is_chain_u16(p_chain)) + p_chain->u.chain16.prod_idx = (u16) prod_idx; + else +-- +2.19.1 + diff --git a/queue-4.19/qed-fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch b/queue-4.19/qed-fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch new file mode 100644 index 00000000000..d484d57dc51 --- /dev/null +++ b/queue-4.19/qed-fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch @@ -0,0 +1,36 @@ +From 440d1358dae79bf9a49fd92136cca2fb50a0daec Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Thu, 3 Jan 2019 12:02:40 +0200 +Subject: qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory + barrier + +[ Upstream commit 46721c3d9e273aea880e9ff835b0e1271e1cd2fb ] + +Make sure chain element is updated before ringing the doorbell. + +Signed-off-by: Denis Bolotin +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_ll2.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c +index 2fa1c050a14b4..92cd8abeb41d7 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c +@@ -1592,6 +1592,10 @@ static void qed_ll2_post_rx_buffer_notify_fw(struct qed_hwfn *p_hwfn, + cq_prod = qed_chain_get_prod_idx(&p_rx->rcq_chain); + rx_prod.bd_prod = cpu_to_le16(bd_prod); + rx_prod.cqe_prod = cpu_to_le16(cq_prod); ++ ++ /* Make sure chain element is updated before ringing the doorbell */ ++ dma_wmb(); ++ + DIRECT_REG_WR(p_rx->set_prod_addr, *((u32 *)&rx_prod)); + } + +-- +2.19.1 + diff --git a/queue-4.19/rdma-mthca-clear-qp-objects-during-their-allocation.patch b/queue-4.19/rdma-mthca-clear-qp-objects-during-their-allocation.patch new file mode 100644 index 00000000000..280f21ff73a --- /dev/null +++ b/queue-4.19/rdma-mthca-clear-qp-objects-during-their-allocation.patch @@ -0,0 +1,69 @@ +From 45d09ff9389ab8248681b23df03772839a81fd5a Mon Sep 17 00:00:00 2001 +From: Leon Romanovsky +Date: Thu, 10 Jan 2019 08:15:45 +0200 +Subject: RDMA/mthca: Clear QP objects during their allocation + +[ Upstream commit 9d9f59b4204bc41896c866b3e5856e5b416aa199 ] + +As part of audit process to update drivers to use rdma_restrack_add() +ensure that QP objects is cleared before access. Such change fixes the +crash observed with uninitialized non zero sgid attr accessed by +ib_destroy_qp(). + +CPU: 3 PID: 74 Comm: kworker/u16:1 Not tainted 4.19.10-300.fc29.x86_64 +Workqueue: ipoib_wq ipoib_cm_tx_reap [ib_ipoib] +RIP: 0010:rdma_put_gid_attr+0x9/0x30 [ib_core] +RSP: 0018:ffffb7ad819dbde8 EFLAGS: 00010202 +RAX: 0000000000000000 RBX: ffff8d1bdf5a2e00 RCX: 0000000000002699 +RDX: 206c656e72656af8 RSI: ffff8d1bf7ae6160 RDI: 206c656e72656b20 +RBP: 0000000000000000 R08: 0000000000026160 R09: ffffffffc06b45bf +R10: ffffe849887da000 R11: 0000000000000002 R12: ffff8d1be30cb400 +R13: ffff8d1bdf681800 R14: ffff8d1be2272400 R15: ffff8d1be30ca000 +FS: 0000000000000000(0000) GS:ffff8d1bf7ac0000(0000) +knlGS:0000000000000000 +Trace: + ib_destroy_qp+0xc9/0x240 [ib_core] + ipoib_cm_tx_reap+0x1f9/0x4e0 [ib_ipoib] + process_one_work+0x1a1/0x3a0 + worker_thread+0x30/0x380 + ? pwq_unbound_release_workfn+0xd0/0xd0 + kthread+0x112/0x130 + ? kthread_create_worker_on_cpu+0x70/0x70 + ret_from_fork+0x22/0x40 + +Reported-by: Alexander Murashkin +Tested-by: Alexander Murashkin +Fixes: 1a1f460ff151 ("RDMA: Hold the sgid_attr inside the struct ib_ah/qp") +Signed-off-by: Parav Pandit +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mthca/mthca_provider.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c +index 0d3473b4596e1..21f4239022c7a 100644 +--- a/drivers/infiniband/hw/mthca/mthca_provider.c ++++ b/drivers/infiniband/hw/mthca/mthca_provider.c +@@ -533,7 +533,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd, + { + struct mthca_ucontext *context; + +- qp = kmalloc(sizeof *qp, GFP_KERNEL); ++ qp = kzalloc(sizeof(*qp), GFP_KERNEL); + if (!qp) + return ERR_PTR(-ENOMEM); + +@@ -599,7 +599,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd, + if (pd->uobject) + return ERR_PTR(-EINVAL); + +- qp = kmalloc(sizeof (struct mthca_sqp), GFP_KERNEL); ++ qp = kzalloc(sizeof(struct mthca_sqp), GFP_KERNEL); + if (!qp) + return ERR_PTR(-ENOMEM); + +-- +2.19.1 + diff --git a/queue-4.19/scsi-cxgb4i-add-wait_for_completion.patch b/queue-4.19/scsi-cxgb4i-add-wait_for_completion.patch new file mode 100644 index 00000000000..20e76c2adfa --- /dev/null +++ b/queue-4.19/scsi-cxgb4i-add-wait_for_completion.patch @@ -0,0 +1,217 @@ +From a98f59e2648587cbdcade965894291ae8dc972a7 Mon Sep 17 00:00:00 2001 +From: Varun Prakash +Date: Thu, 10 Jan 2019 23:29:28 +0530 +Subject: scsi: cxgb4i: add wait_for_completion() + +[ Upstream commit 9e8f1c79831424d30c0e3df068be7f4a244157c9 ] + +In case of ->set_param() and ->bind_conn() cxgb4i driver does not wait for +cmd completion, this can create race conditions, to avoid this add +wait_for_completion(). + +Signed-off-by: Varun Prakash +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 9 ++++----- + drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 28 ++++++++++++++++++++-------- + drivers/scsi/cxgbi/libcxgbi.c | 7 ++++--- + drivers/scsi/cxgbi/libcxgbi.h | 5 +++-- + 4 files changed, 31 insertions(+), 18 deletions(-) + +diff --git a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c +index bf07735275a49..0fc382cb977bf 100644 +--- a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c ++++ b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c +@@ -1144,7 +1144,7 @@ static void ddp_clear_map(struct cxgbi_device *cdev, struct cxgbi_ppm *ppm, + } + + static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, +- unsigned int tid, int pg_idx, bool reply) ++ unsigned int tid, int pg_idx) + { + struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0, + GFP_KERNEL); +@@ -1160,7 +1160,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, + req = (struct cpl_set_tcb_field *)skb->head; + req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD)); + OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid)); +- req->reply = V_NO_REPLY(reply ? 0 : 1); ++ req->reply = V_NO_REPLY(1); + req->cpu_idx = 0; + req->word = htons(31); + req->mask = cpu_to_be64(0xF0000000); +@@ -1177,11 +1177,10 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, + * @tid: connection id + * @hcrc: header digest enabled + * @dcrc: data digest enabled +- * @reply: request reply from h/w + * set up the iscsi digest settings for a connection identified by tid + */ + static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid, +- int hcrc, int dcrc, int reply) ++ int hcrc, int dcrc) + { + struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0, + GFP_KERNEL); +@@ -1197,7 +1196,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid, + req = (struct cpl_set_tcb_field *)skb->head; + req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD)); + OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid)); +- req->reply = V_NO_REPLY(reply ? 0 : 1); ++ req->reply = V_NO_REPLY(1); + req->cpu_idx = 0; + req->word = htons(31); + req->mask = cpu_to_be64(0x0F000000); +diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c +index 211da1d5a8699..689d6c813a50d 100644 +--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c ++++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c +@@ -1517,16 +1517,22 @@ static void do_set_tcb_rpl(struct cxgbi_device *cdev, struct sk_buff *skb) + struct cxgbi_sock *csk; + + csk = lookup_tid(t, tid); +- if (!csk) ++ if (!csk) { + pr_err("can't find conn. for tid %u.\n", tid); ++ return; ++ } + + log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK, + "csk 0x%p,%u,%lx,%u, status 0x%x.\n", + csk, csk->state, csk->flags, csk->tid, rpl->status); + +- if (rpl->status != CPL_ERR_NONE) ++ if (rpl->status != CPL_ERR_NONE) { + pr_err("csk 0x%p,%u, SET_TCB_RPL status %u.\n", + csk, tid, rpl->status); ++ csk->err = -EINVAL; ++ } ++ ++ complete(&csk->cmpl); + + __kfree_skb(skb); + } +@@ -1903,7 +1909,7 @@ static int ddp_set_map(struct cxgbi_ppm *ppm, struct cxgbi_sock *csk, + } + + static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid, +- int pg_idx, bool reply) ++ int pg_idx) + { + struct sk_buff *skb; + struct cpl_set_tcb_field *req; +@@ -1919,7 +1925,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid, + req = (struct cpl_set_tcb_field *)skb->head; + INIT_TP_WR(req, csk->tid); + OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, csk->tid)); +- req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid)); ++ req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid)); + req->word_cookie = htons(0); + req->mask = cpu_to_be64(0x3 << 8); + req->val = cpu_to_be64(pg_idx << 8); +@@ -1928,12 +1934,15 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid, + log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK, + "csk 0x%p, tid 0x%x, pg_idx %u.\n", csk, csk->tid, pg_idx); + ++ reinit_completion(&csk->cmpl); + cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb); +- return 0; ++ wait_for_completion(&csk->cmpl); ++ ++ return csk->err; + } + + static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid, +- int hcrc, int dcrc, int reply) ++ int hcrc, int dcrc) + { + struct sk_buff *skb; + struct cpl_set_tcb_field *req; +@@ -1951,7 +1960,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid, + req = (struct cpl_set_tcb_field *)skb->head; + INIT_TP_WR(req, tid); + OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid)); +- req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid)); ++ req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid)); + req->word_cookie = htons(0); + req->mask = cpu_to_be64(0x3 << 4); + req->val = cpu_to_be64(((hcrc ? ULP_CRC_HEADER : 0) | +@@ -1961,8 +1970,11 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid, + log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK, + "csk 0x%p, tid 0x%x, crc %d,%d.\n", csk, csk->tid, hcrc, dcrc); + ++ reinit_completion(&csk->cmpl); + cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb); +- return 0; ++ wait_for_completion(&csk->cmpl); ++ ++ return csk->err; + } + + static struct cxgbi_ppm *cdev2ppm(struct cxgbi_device *cdev) +diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c +index 3f3af5e74a07d..f2c561ca731a3 100644 +--- a/drivers/scsi/cxgbi/libcxgbi.c ++++ b/drivers/scsi/cxgbi/libcxgbi.c +@@ -573,6 +573,7 @@ static struct cxgbi_sock *cxgbi_sock_create(struct cxgbi_device *cdev) + skb_queue_head_init(&csk->receive_queue); + skb_queue_head_init(&csk->write_queue); + timer_setup(&csk->retry_timer, NULL, 0); ++ init_completion(&csk->cmpl); + rwlock_init(&csk->callback_lock); + csk->cdev = cdev; + csk->flags = 0; +@@ -2252,14 +2253,14 @@ int cxgbi_set_conn_param(struct iscsi_cls_conn *cls_conn, + if (!err && conn->hdrdgst_en) + err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid, + conn->hdrdgst_en, +- conn->datadgst_en, 0); ++ conn->datadgst_en); + break; + case ISCSI_PARAM_DATADGST_EN: + err = iscsi_set_param(cls_conn, param, buf, buflen); + if (!err && conn->datadgst_en) + err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid, + conn->hdrdgst_en, +- conn->datadgst_en, 0); ++ conn->datadgst_en); + break; + case ISCSI_PARAM_MAX_R2T: + return iscsi_tcp_set_max_r2t(conn, buf); +@@ -2385,7 +2386,7 @@ int cxgbi_bind_conn(struct iscsi_cls_session *cls_session, + + ppm = csk->cdev->cdev2ppm(csk->cdev); + err = csk->cdev->csk_ddp_setup_pgidx(csk, csk->tid, +- ppm->tformat.pgsz_idx_dflt, 0); ++ ppm->tformat.pgsz_idx_dflt); + if (err < 0) + return err; + +diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h +index dcb190e753434..3bf7414a75e5e 100644 +--- a/drivers/scsi/cxgbi/libcxgbi.h ++++ b/drivers/scsi/cxgbi/libcxgbi.h +@@ -146,6 +146,7 @@ struct cxgbi_sock { + struct sk_buff_head receive_queue; + struct sk_buff_head write_queue; + struct timer_list retry_timer; ++ struct completion cmpl; + int err; + rwlock_t callback_lock; + void *user_data; +@@ -487,9 +488,9 @@ struct cxgbi_device { + struct cxgbi_ppm *, + struct cxgbi_task_tag_info *); + int (*csk_ddp_setup_digest)(struct cxgbi_sock *, +- unsigned int, int, int, int); ++ unsigned int, int, int); + int (*csk_ddp_setup_pgidx)(struct cxgbi_sock *, +- unsigned int, int, bool); ++ unsigned int, int); + + void (*csk_release_offload_resources)(struct cxgbi_sock *); + int (*csk_rx_pdu_ready)(struct cxgbi_sock *, struct sk_buff *); +-- +2.19.1 + diff --git a/queue-4.19/scsi-isci-initialize-shost-fully-before-calling-scsi.patch b/queue-4.19/scsi-isci-initialize-shost-fully-before-calling-scsi.patch new file mode 100644 index 00000000000..22b2bbf62d7 --- /dev/null +++ b/queue-4.19/scsi-isci-initialize-shost-fully-before-calling-scsi.patch @@ -0,0 +1,97 @@ +From 582d4b055849bc44431e71cafb97586e7d6467ee Mon Sep 17 00:00:00 2001 +From: Logan Gunthorpe +Date: Tue, 8 Jan 2019 13:50:43 -0700 +Subject: scsi: isci: initialize shost fully before calling scsi_add_host() + +[ Upstream commit cc29a1b0a3f2597ce887d339222fa85b9307706d ] + +scsi_mq_setup_tags(), which is called by scsi_add_host(), calculates the +command size to allocate based on the prot_capabilities. In the isci +driver, scsi_host_set_prot() is called after scsi_add_host() so the command +size gets calculated to be smaller than it needs to be. Eventually, +scsi_mq_init_request() locates the 'prot_sdb' after the command assuming it +was sized correctly and a buffer overrun may occur. + +However, seeing blk_mq_alloc_rqs() rounds up to the nearest cache line +size, the mistake can go unnoticed. + +The bug was noticed after the struct request size was reduced by commit +9d037ad707ed ("block: remove req->timeout_list") + +Which likely reduced the allocated space for the request by an entire cache +line, enough that the overflow could be hit and it caused a panic, on boot, +at: + + RIP: 0010:t10_pi_complete+0x77/0x1c0 + Call Trace: + + sd_done+0xf5/0x340 + scsi_finish_command+0xc3/0x120 + blk_done_softirq+0x83/0xb0 + __do_softirq+0xa1/0x2e6 + irq_exit+0xbc/0xd0 + call_function_single_interrupt+0xf/0x20 + + +sd_done() would call scsi_prot_sg_count() which reads the number of +entities in 'prot_sdb', but seeing 'prot_sdb' is located after the end of +the allocated space it reads a garbage number and erroneously calls +t10_pi_complete(). + +To prevent this, the calls to scsi_host_set_prot() are moved into +isci_host_alloc() before the call to scsi_add_host(). Out of caution, also +move the similar call to scsi_host_set_guard(). + +Fixes: 3d2d75254915 ("[SCSI] isci: T10 DIF support") +Link: http://lkml.kernel.org/r/da851333-eadd-163a-8c78-e1f4ec5ec857@deltatee.com +Signed-off-by: Logan Gunthorpe +Cc: Intel SCU Linux support +Cc: Artur Paszkiewicz +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: Christoph Hellwig +Cc: Jens Axboe +Cc: Jeff Moyer +Reviewed-by: Jeff Moyer +Reviewed-by: Jens Axboe +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/isci/init.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c +index 08c7b1e25fe48..dde84f7443136 100644 +--- a/drivers/scsi/isci/init.c ++++ b/drivers/scsi/isci/init.c +@@ -588,6 +588,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id) + shost->max_lun = ~0; + shost->max_cmd_len = MAX_COMMAND_SIZE; + ++ /* turn on DIF support */ ++ scsi_host_set_prot(shost, ++ SHOST_DIF_TYPE1_PROTECTION | ++ SHOST_DIF_TYPE2_PROTECTION | ++ SHOST_DIF_TYPE3_PROTECTION); ++ scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC); ++ + err = scsi_add_host(shost, &pdev->dev); + if (err) + goto err_shost; +@@ -675,13 +682,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + goto err_host_alloc; + } + pci_info->hosts[i] = h; +- +- /* turn on DIF support */ +- scsi_host_set_prot(to_shost(h), +- SHOST_DIF_TYPE1_PROTECTION | +- SHOST_DIF_TYPE2_PROTECTION | +- SHOST_DIF_TYPE3_PROTECTION); +- scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC); + } + + err = isci_setup_interrupts(pdev); +-- +2.19.1 + diff --git a/queue-4.19/scsi-qedi-add-ep_state-for-login-completion-on-un-re.patch b/queue-4.19/scsi-qedi-add-ep_state-for-login-completion-on-un-re.patch new file mode 100644 index 00000000000..f61985980fc --- /dev/null +++ b/queue-4.19/scsi-qedi-add-ep_state-for-login-completion-on-un-re.patch @@ -0,0 +1,64 @@ +From 876fb45fb94d89d3e55c73fa4ee5122f169f268a Mon Sep 17 00:00:00 2001 +From: Manish Rangankar +Date: Wed, 9 Jan 2019 01:39:07 -0800 +Subject: scsi: qedi: Add ep_state for login completion on un-reachable targets + +[ Upstream commit 34a2ce887668db9dda4b56e6f155c49ac13f3e54 ] + +When the driver finds invalid destination MAC for the first un-reachable +target, and before completes the PATH_REQ operation, set new ep_state to +OFFLDCONN_NONE so that as part of driver ep_poll mechanism, the upper +open-iscsi layer is notified to complete the login process on the first +un-reachable target and thus proceed login to other reachable targets. + +Signed-off-by: Manish Rangankar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_iscsi.c | 3 +++ + drivers/scsi/qedi/qedi_iscsi.h | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c +index 2f0a4f2c5ff80..d4821b9dea45d 100644 +--- a/drivers/scsi/qedi/qedi_iscsi.c ++++ b/drivers/scsi/qedi/qedi_iscsi.c +@@ -954,6 +954,7 @@ static int qedi_ep_poll(struct iscsi_endpoint *ep, int timeout_ms) + + qedi_ep = ep->dd_data; + if (qedi_ep->state == EP_STATE_IDLE || ++ qedi_ep->state == EP_STATE_OFLDCONN_NONE || + qedi_ep->state == EP_STATE_OFLDCONN_FAILED) + return -1; + +@@ -1036,6 +1037,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep) + + switch (qedi_ep->state) { + case EP_STATE_OFLDCONN_START: ++ case EP_STATE_OFLDCONN_NONE: + goto ep_release_conn; + case EP_STATE_OFLDCONN_FAILED: + break; +@@ -1226,6 +1228,7 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data) + + if (!is_valid_ether_addr(&path_data->mac_addr[0])) { + QEDI_NOTICE(&qedi->dbg_ctx, "dst mac NOT VALID\n"); ++ qedi_ep->state = EP_STATE_OFLDCONN_NONE; + ret = -EIO; + goto set_path_exit; + } +diff --git a/drivers/scsi/qedi/qedi_iscsi.h b/drivers/scsi/qedi/qedi_iscsi.h +index 11260776212fa..892d70d545537 100644 +--- a/drivers/scsi/qedi/qedi_iscsi.h ++++ b/drivers/scsi/qedi/qedi_iscsi.h +@@ -59,6 +59,7 @@ enum { + EP_STATE_OFLDCONN_FAILED = 0x2000, + EP_STATE_CONNECT_FAILED = 0x4000, + EP_STATE_DISCONN_TIMEDOUT = 0x8000, ++ EP_STATE_OFLDCONN_NONE = 0x10000, + }; + + struct qedi_conn; +-- +2.19.1 + diff --git a/queue-4.19/scsi-qla4xxx-check-return-code-of-qla4xxx_copy_from_.patch b/queue-4.19/scsi-qla4xxx-check-return-code-of-qla4xxx_copy_from_.patch new file mode 100644 index 00000000000..ecaa05d68da --- /dev/null +++ b/queue-4.19/scsi-qla4xxx-check-return-code-of-qla4xxx_copy_from_.patch @@ -0,0 +1,33 @@ +From 694478e775b6860a3a1f490f9cc64ad4bb5ab449 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Thu, 20 Dec 2018 11:16:07 +0800 +Subject: scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param + +[ Upstream commit 72b4a0465f995175a2e22cf4a636bf781f1f28a7 ] + +The return code should be check while qla4xxx_copy_from_fwddb_param fails. + +Signed-off-by: YueHaibing +Acked-by: Manish Rangankar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla4xxx/ql4_os.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index 0e13349dce570..575445c761b48 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -7237,6 +7237,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha, + + rc = qla4xxx_copy_from_fwddb_param(fnode_sess, fnode_conn, + fw_ddb_entry); ++ if (rc) ++ goto free_sess; + + ql4_printk(KERN_INFO, ha, "%s: sysfs entry %s created\n", + __func__, fnode_sess->dev.kobj.name); +-- +2.19.1 + diff --git a/queue-4.19/scsi-tcmu-avoid-cmd-qfull-timers-updated-whenever-a-.patch b/queue-4.19/scsi-tcmu-avoid-cmd-qfull-timers-updated-whenever-a-.patch new file mode 100644 index 00000000000..dc79971693c --- /dev/null +++ b/queue-4.19/scsi-tcmu-avoid-cmd-qfull-timers-updated-whenever-a-.patch @@ -0,0 +1,321 @@ +From e3f455665f868bf30b7dc823bd0a4983fd9334b4 Mon Sep 17 00:00:00 2001 +From: Xiubo Li +Date: Fri, 23 Nov 2018 09:15:30 +0800 +Subject: scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes + +[ Upstream commit a94a2572b97744d3a35a1996df0e5cf6b2461a4a ] + +Currently there is one cmd timeout timer and one qfull timer for each udev, +and whenever any new command is coming in we will update the cmd timer or +qfull timer. For some corner cases the timers are always working only for +the ringbuffer's and full queue's newest cmd. That's to say the timer won't +be fired even if one cmd has been stuck for a very long time and the +deadline is reached. + +This fix will keep the cmd/qfull timers to be pended for the oldest cmd in +ringbuffer and full queue, and will update them with the next cmd's +deadline only when the old cmd's deadline is reached or removed from the +ringbuffer and full queue. + +Signed-off-by: Xiubo Li +Acked-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_user.c | 88 +++++++++++++++++++++---------- + 1 file changed, 61 insertions(+), 27 deletions(-) + +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index 9cd404acdb82b..ac7620120491b 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -148,7 +148,7 @@ struct tcmu_dev { + size_t ring_size; + + struct mutex cmdr_lock; +- struct list_head cmdr_queue; ++ struct list_head qfull_queue; + + uint32_t dbi_max; + uint32_t dbi_thresh; +@@ -159,6 +159,7 @@ struct tcmu_dev { + + struct timer_list cmd_timer; + unsigned int cmd_time_out; ++ struct list_head inflight_queue; + + struct timer_list qfull_timer; + int qfull_time_out; +@@ -179,7 +180,7 @@ struct tcmu_dev { + struct tcmu_cmd { + struct se_cmd *se_cmd; + struct tcmu_dev *tcmu_dev; +- struct list_head cmdr_queue_entry; ++ struct list_head queue_entry; + + uint16_t cmd_id; + +@@ -192,6 +193,7 @@ struct tcmu_cmd { + unsigned long deadline; + + #define TCMU_CMD_BIT_EXPIRED 0 ++#define TCMU_CMD_BIT_INFLIGHT 1 + unsigned long flags; + }; + /* +@@ -586,7 +588,7 @@ static struct tcmu_cmd *tcmu_alloc_cmd(struct se_cmd *se_cmd) + if (!tcmu_cmd) + return NULL; + +- INIT_LIST_HEAD(&tcmu_cmd->cmdr_queue_entry); ++ INIT_LIST_HEAD(&tcmu_cmd->queue_entry); + tcmu_cmd->se_cmd = se_cmd; + tcmu_cmd->tcmu_dev = udev; + +@@ -915,11 +917,13 @@ static int tcmu_setup_cmd_timer(struct tcmu_cmd *tcmu_cmd, unsigned int tmo, + return 0; + + tcmu_cmd->deadline = round_jiffies_up(jiffies + msecs_to_jiffies(tmo)); +- mod_timer(timer, tcmu_cmd->deadline); ++ if (!timer_pending(timer)) ++ mod_timer(timer, tcmu_cmd->deadline); ++ + return 0; + } + +-static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd) ++static int add_to_qfull_queue(struct tcmu_cmd *tcmu_cmd) + { + struct tcmu_dev *udev = tcmu_cmd->tcmu_dev; + unsigned int tmo; +@@ -942,7 +946,7 @@ static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd) + if (ret) + return ret; + +- list_add_tail(&tcmu_cmd->cmdr_queue_entry, &udev->cmdr_queue); ++ list_add_tail(&tcmu_cmd->queue_entry, &udev->qfull_queue); + pr_debug("adding cmd %u on dev %s to ring space wait queue\n", + tcmu_cmd->cmd_id, udev->name); + return 0; +@@ -999,7 +1003,7 @@ static sense_reason_t queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, int *scsi_err) + base_command_size = tcmu_cmd_get_base_cmd_size(tcmu_cmd->dbi_cnt); + command_size = tcmu_cmd_get_cmd_size(tcmu_cmd, base_command_size); + +- if (!list_empty(&udev->cmdr_queue)) ++ if (!list_empty(&udev->qfull_queue)) + goto queue; + + mb = udev->mb_addr; +@@ -1096,13 +1100,16 @@ static sense_reason_t queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, int *scsi_err) + UPDATE_HEAD(mb->cmd_head, command_size, udev->cmdr_size); + tcmu_flush_dcache_range(mb, sizeof(*mb)); + ++ list_add_tail(&tcmu_cmd->queue_entry, &udev->inflight_queue); ++ set_bit(TCMU_CMD_BIT_INFLIGHT, &tcmu_cmd->flags); ++ + /* TODO: only if FLUSH and FUA? */ + uio_event_notify(&udev->uio_info); + + return 0; + + queue: +- if (add_to_cmdr_queue(tcmu_cmd)) { ++ if (add_to_qfull_queue(tcmu_cmd)) { + *scsi_err = TCM_OUT_OF_RESOURCES; + return -1; + } +@@ -1145,6 +1152,8 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry * + if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) + goto out; + ++ list_del_init(&cmd->queue_entry); ++ + tcmu_cmd_reset_dbi_cur(cmd); + + if (entry->hdr.uflags & TCMU_UFLAG_UNKNOWN_OP) { +@@ -1194,9 +1203,29 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry * + tcmu_free_cmd(cmd); + } + ++static void tcmu_set_next_deadline(struct list_head *queue, ++ struct timer_list *timer) ++{ ++ struct tcmu_cmd *tcmu_cmd, *tmp_cmd; ++ unsigned long deadline = 0; ++ ++ list_for_each_entry_safe(tcmu_cmd, tmp_cmd, queue, queue_entry) { ++ if (!time_after(jiffies, tcmu_cmd->deadline)) { ++ deadline = tcmu_cmd->deadline; ++ break; ++ } ++ } ++ ++ if (deadline) ++ mod_timer(timer, deadline); ++ else ++ del_timer(timer); ++} ++ + static unsigned int tcmu_handle_completions(struct tcmu_dev *udev) + { + struct tcmu_mailbox *mb; ++ struct tcmu_cmd *cmd; + int handled = 0; + + if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags)) { +@@ -1210,7 +1239,6 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev) + while (udev->cmdr_last_cleaned != READ_ONCE(mb->cmd_tail)) { + + struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned; +- struct tcmu_cmd *cmd; + + tcmu_flush_dcache_range(entry, sizeof(*entry)); + +@@ -1243,7 +1271,7 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev) + /* no more pending commands */ + del_timer(&udev->cmd_timer); + +- if (list_empty(&udev->cmdr_queue)) { ++ if (list_empty(&udev->qfull_queue)) { + /* + * no more pending or waiting commands so try to + * reclaim blocks if needed. +@@ -1252,6 +1280,8 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev) + tcmu_global_max_blocks) + schedule_delayed_work(&tcmu_unmap_work, 0); + } ++ } else if (udev->cmd_time_out) { ++ tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer); + } + + return handled; +@@ -1271,7 +1301,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data) + if (!time_after(jiffies, cmd->deadline)) + return 0; + +- is_running = list_empty(&cmd->cmdr_queue_entry); ++ is_running = test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags); + se_cmd = cmd->se_cmd; + + if (is_running) { +@@ -1288,12 +1318,11 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data) + */ + scsi_status = SAM_STAT_CHECK_CONDITION; + } else { +- list_del_init(&cmd->cmdr_queue_entry); +- + idr_remove(&udev->commands, id); + tcmu_free_cmd(cmd); + scsi_status = SAM_STAT_TASK_SET_FULL; + } ++ list_del_init(&cmd->queue_entry); + + pr_debug("Timing out cmd %u on dev %s that is %s.\n", + id, udev->name, is_running ? "inflight" : "queued"); +@@ -1372,7 +1401,8 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name) + + INIT_LIST_HEAD(&udev->node); + INIT_LIST_HEAD(&udev->timedout_entry); +- INIT_LIST_HEAD(&udev->cmdr_queue); ++ INIT_LIST_HEAD(&udev->qfull_queue); ++ INIT_LIST_HEAD(&udev->inflight_queue); + idr_init(&udev->commands); + + timer_setup(&udev->qfull_timer, tcmu_qfull_timedout, 0); +@@ -1383,7 +1413,7 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name) + return &udev->se_dev; + } + +-static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail) ++static bool run_qfull_queue(struct tcmu_dev *udev, bool fail) + { + struct tcmu_cmd *tcmu_cmd, *tmp_cmd; + LIST_HEAD(cmds); +@@ -1391,15 +1421,15 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail) + sense_reason_t scsi_ret; + int ret; + +- if (list_empty(&udev->cmdr_queue)) ++ if (list_empty(&udev->qfull_queue)) + return true; + + pr_debug("running %s's cmdr queue forcefail %d\n", udev->name, fail); + +- list_splice_init(&udev->cmdr_queue, &cmds); ++ list_splice_init(&udev->qfull_queue, &cmds); + +- list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, cmdr_queue_entry) { +- list_del_init(&tcmu_cmd->cmdr_queue_entry); ++ list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, queue_entry) { ++ list_del_init(&tcmu_cmd->queue_entry); + + pr_debug("removing cmd %u on dev %s from queue\n", + tcmu_cmd->cmd_id, udev->name); +@@ -1437,14 +1467,13 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail) + * cmd was requeued, so just put all cmds back in + * the queue + */ +- list_splice_tail(&cmds, &udev->cmdr_queue); ++ list_splice_tail(&cmds, &udev->qfull_queue); + drained = false; +- goto done; ++ break; + } + } +- if (list_empty(&udev->cmdr_queue)) +- del_timer(&udev->qfull_timer); +-done: ++ ++ tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer); + return drained; + } + +@@ -1454,7 +1483,7 @@ static int tcmu_irqcontrol(struct uio_info *info, s32 irq_on) + + mutex_lock(&udev->cmdr_lock); + tcmu_handle_completions(udev); +- run_cmdr_queue(udev, false); ++ run_qfull_queue(udev, false); + mutex_unlock(&udev->cmdr_lock); + + return 0; +@@ -1982,7 +2011,7 @@ static void tcmu_block_dev(struct tcmu_dev *udev) + /* complete IO that has executed successfully */ + tcmu_handle_completions(udev); + /* fail IO waiting to be queued */ +- run_cmdr_queue(udev, true); ++ run_qfull_queue(udev, true); + + unlock: + mutex_unlock(&udev->cmdr_lock); +@@ -1997,7 +2026,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level) + mutex_lock(&udev->cmdr_lock); + + idr_for_each_entry(&udev->commands, cmd, i) { +- if (!list_empty(&cmd->cmdr_queue_entry)) ++ if (!test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags)) + continue; + + pr_debug("removing cmd %u on dev %s from ring (is expired %d)\n", +@@ -2006,6 +2035,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level) + + idr_remove(&udev->commands, i); + if (!test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) { ++ list_del_init(&cmd->queue_entry); + if (err_level == 1) { + /* + * Userspace was not able to start the +@@ -2666,6 +2696,10 @@ static void check_timedout_devices(void) + + mutex_lock(&udev->cmdr_lock); + idr_for_each(&udev->commands, tcmu_check_expired_cmd, NULL); ++ ++ tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer); ++ tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer); ++ + mutex_unlock(&udev->cmdr_lock); + + spin_lock_bh(&timed_out_udevs_lock); +-- +2.19.1 + diff --git a/queue-4.19/scsi-ufs-fix-geometry-descriptor-size.patch b/queue-4.19/scsi-ufs-fix-geometry-descriptor-size.patch new file mode 100644 index 00000000000..9a60b1a5030 --- /dev/null +++ b/queue-4.19/scsi-ufs-fix-geometry-descriptor-size.patch @@ -0,0 +1,38 @@ +From 4805af988458ac0a151c6375086ed5794b479a56 Mon Sep 17 00:00:00 2001 +From: Avri Altman +Date: Thu, 10 Jan 2019 13:31:26 +0200 +Subject: scsi: ufs: Fix geometry descriptor size + +[ Upstream commit 9be9db9f78f52ef03ee90063730cb9d730e7032b ] + +Albeit we no longer rely on those hard-coded descriptor sizes, we still use +them as our defaults, so better get it right. While adding its sysfs +entries, we forgot to update the geometry descriptor size. It is 0x48 +according to UFS2.1, and wasn't changed in UFS3.0. + +[mkp: typo] + +Fixes: c720c091222e (scsi: ufs: sysfs: geometry descriptor) +Signed-off-by: Avri Altman +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h +index 14e5bf7af0bb1..c3bcaaec0fc5c 100644 +--- a/drivers/scsi/ufs/ufs.h ++++ b/drivers/scsi/ufs/ufs.h +@@ -195,7 +195,7 @@ enum ufs_desc_def_size { + QUERY_DESC_CONFIGURATION_DEF_SIZE = 0x90, + QUERY_DESC_UNIT_DEF_SIZE = 0x23, + QUERY_DESC_INTERCONNECT_DEF_SIZE = 0x06, +- QUERY_DESC_GEOMETRY_DEF_SIZE = 0x44, ++ QUERY_DESC_GEOMETRY_DEF_SIZE = 0x48, + QUERY_DESC_POWER_DEF_SIZE = 0x62, + QUERY_DESC_HEALTH_DEF_SIZE = 0x25, + }; +-- +2.19.1 + diff --git a/queue-4.19/scsi-ufs-fix-system-suspend-status.patch b/queue-4.19/scsi-ufs-fix-system-suspend-status.patch new file mode 100644 index 00000000000..c6103ee25f1 --- /dev/null +++ b/queue-4.19/scsi-ufs-fix-system-suspend-status.patch @@ -0,0 +1,41 @@ +From 18dc5238f319825a31a266fabdb04dd7b5d1e3fe Mon Sep 17 00:00:00 2001 +From: Stanley Chu +Date: Mon, 7 Jan 2019 22:19:34 +0800 +Subject: scsi: ufs: Fix system suspend status + +[ Upstream commit ce9e7bce43526626f7cffe2e657953997870197e ] + +hba->is_sys_suspended is set after successful system suspend but +not clear after successful system resume. + +According to current behavior, hba->is_sys_suspended will not be set if +host is runtime-suspended but not system-suspended. Thus we shall aligh the +same policy: clear this flag even if host remains runtime-suspended after +ufshcd_system_resume is successfully returned. + +Simply fix this flag to correct host status logs. + +Signed-off-by: Stanley Chu +Reviewed-by: Avri Altman +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 12ddb5928a738..6e80dfe4fa979 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -7768,6 +7768,8 @@ int ufshcd_system_resume(struct ufs_hba *hba) + trace_ufshcd_system_resume(dev_name(hba->dev), ret, + ktime_to_us(ktime_sub(ktime_get(), start)), + hba->curr_dev_pwr_mode, hba->uic_link_state); ++ if (!ret) ++ hba->is_sys_suspended = false; + return ret; + } + EXPORT_SYMBOL(ufshcd_system_resume); +-- +2.19.1 + diff --git a/queue-4.19/selftests-bpf-retry-tests-that-expect-build-id.patch b/queue-4.19/selftests-bpf-retry-tests-that-expect-build-id.patch new file mode 100644 index 00000000000..2642a44fd6f --- /dev/null +++ b/queue-4.19/selftests-bpf-retry-tests-that-expect-build-id.patch @@ -0,0 +1,92 @@ +From d3b2ed293a5d5cd9f34ddae5396f735636f5ac49 Mon Sep 17 00:00:00 2001 +From: Stanislav Fomichev +Date: Wed, 16 Jan 2019 14:03:17 -0800 +Subject: selftests/bpf: retry tests that expect build-id + +[ Upstream commit f67ad87ab3120e82845521b18a2b99273a340308 ] + +While running test_progs in a loop I found out that I'm sometimes hitting +"Didn't find expected build ID from the map" error. + +Looking at stack_map_get_build_id_offset() it seems that it is racy (by +design) and can sometimes return BPF_STACK_BUILD_ID_IP (i.e. can't trylock +current->mm->mmap_sem). + +Let's retry this test a single time. + +Fixes: 13790d1cc72c ("bpf: add selftest for stackmap with build_id in NMI context") +Acked-by: Song Liu +Signed-off-by: Stanislav Fomichev +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_progs.c | 30 ++++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c +index d029cad08cbd8..89f8b0dae7ef0 100644 +--- a/tools/testing/selftests/bpf/test_progs.c ++++ b/tools/testing/selftests/bpf/test_progs.c +@@ -1136,7 +1136,9 @@ static void test_stacktrace_build_id(void) + int i, j; + struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH]; + int build_id_matches = 0; ++ int retry = 1; + ++retry: + err = bpf_prog_load(file, BPF_PROG_TYPE_TRACEPOINT, &obj, &prog_fd); + if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno)) + goto out; +@@ -1249,6 +1251,19 @@ static void test_stacktrace_build_id(void) + previous_key = key; + } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0); + ++ /* stack_map_get_build_id_offset() is racy and sometimes can return ++ * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID; ++ * try it one more time. ++ */ ++ if (build_id_matches < 1 && retry--) { ++ ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE); ++ close(pmu_fd); ++ bpf_object__close(obj); ++ printf("%s:WARN:Didn't find expected build ID from the map, retrying\n", ++ __func__); ++ goto retry; ++ } ++ + if (CHECK(build_id_matches < 1, "build id match", + "Didn't find expected build ID from the map\n")) + goto disable_pmu; +@@ -1289,7 +1304,9 @@ static void test_stacktrace_build_id_nmi(void) + int i, j; + struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH]; + int build_id_matches = 0; ++ int retry = 1; + ++retry: + err = bpf_prog_load(file, BPF_PROG_TYPE_PERF_EVENT, &obj, &prog_fd); + if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno)) + return; +@@ -1384,6 +1401,19 @@ static void test_stacktrace_build_id_nmi(void) + previous_key = key; + } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0); + ++ /* stack_map_get_build_id_offset() is racy and sometimes can return ++ * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID; ++ * try it one more time. ++ */ ++ if (build_id_matches < 1 && retry--) { ++ ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE); ++ close(pmu_fd); ++ bpf_object__close(obj); ++ printf("%s:WARN:Didn't find expected build ID from the map, retrying\n", ++ __func__); ++ goto retry; ++ } ++ + if (CHECK(build_id_matches < 1, "build id match", + "Didn't find expected build ID from the map\n")) + goto disable_pmu; +-- +2.19.1 + diff --git a/queue-4.19/selftests-bpf-test-1-rewrite-in-sys_sendmsg-in-test_.patch b/queue-4.19/selftests-bpf-test-1-rewrite-in-sys_sendmsg-in-test_.patch new file mode 100644 index 00000000000..08cb5575ecb --- /dev/null +++ b/queue-4.19/selftests-bpf-test-1-rewrite-in-sys_sendmsg-in-test_.patch @@ -0,0 +1,141 @@ +From 08feabe7f2e031eee5a1f08d89478588978602b4 Mon Sep 17 00:00:00 2001 +From: Andrey Ignatov +Date: Fri, 4 Jan 2019 01:07:08 -0800 +Subject: selftests/bpf: Test [::] -> [::1] rewrite in sys_sendmsg in + test_sock_addr + +[ Upstream commit 976b4f3a4646fbf0d189caca25f91f82e4be4b5a ] + +Test that sys_sendmsg BPF hook doesn't break sys_sendmsg behaviour to +rewrite destination IPv6 = [::] with [::1] (BSD'ism). + +Two test cases are added: + +1) User passes dst IPv6 = [::] and BPF_CGROUP_UDP6_SENDMSG program + doesn't touch it. + +2) User passes dst IPv6 != [::], but BPF_CGROUP_UDP6_SENDMSG program + rewrites it with [::]. + +In both cases [::1] is used by sys_sendmsg code eventually and datagram +is sent successfully for unconnected UDP socket. + +Example of relevant output: + Test case: sendmsg6: set dst IP = [::] (BSD'ism) .. [PASS] + Test case: sendmsg6: preserve dst IP = [::] (BSD'ism) .. [PASS] + +Signed-off-by: Andrey Ignatov +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_sock_addr.c | 53 ++++++++++++++++++-- + 1 file changed, 50 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c +index aeeb76a54d633..e38f1cb7089d3 100644 +--- a/tools/testing/selftests/bpf/test_sock_addr.c ++++ b/tools/testing/selftests/bpf/test_sock_addr.c +@@ -44,6 +44,7 @@ + #define SERV6_V4MAPPED_IP "::ffff:192.168.0.4" + #define SRC6_IP "::1" + #define SRC6_REWRITE_IP "::6" ++#define WILDCARD6_IP "::" + #define SERV6_PORT 6060 + #define SERV6_REWRITE_PORT 6666 + +@@ -85,12 +86,14 @@ static int bind4_prog_load(const struct sock_addr_test *test); + static int bind6_prog_load(const struct sock_addr_test *test); + static int connect4_prog_load(const struct sock_addr_test *test); + static int connect6_prog_load(const struct sock_addr_test *test); ++static int sendmsg_allow_prog_load(const struct sock_addr_test *test); + static int sendmsg_deny_prog_load(const struct sock_addr_test *test); + static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test); + static int sendmsg4_rw_c_prog_load(const struct sock_addr_test *test); + static int sendmsg6_rw_asm_prog_load(const struct sock_addr_test *test); + static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test); + static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test); ++static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test); + + static struct sock_addr_test tests[] = { + /* bind */ +@@ -462,6 +465,34 @@ static struct sock_addr_test tests[] = { + SRC6_REWRITE_IP, + SYSCALL_ENOTSUPP, + }, ++ { ++ "sendmsg6: set dst IP = [::] (BSD'ism)", ++ sendmsg6_rw_wildcard_prog_load, ++ BPF_CGROUP_UDP6_SENDMSG, ++ BPF_CGROUP_UDP6_SENDMSG, ++ AF_INET6, ++ SOCK_DGRAM, ++ SERV6_IP, ++ SERV6_PORT, ++ SERV6_REWRITE_IP, ++ SERV6_REWRITE_PORT, ++ SRC6_REWRITE_IP, ++ SUCCESS, ++ }, ++ { ++ "sendmsg6: preserve dst IP = [::] (BSD'ism)", ++ sendmsg_allow_prog_load, ++ BPF_CGROUP_UDP6_SENDMSG, ++ BPF_CGROUP_UDP6_SENDMSG, ++ AF_INET6, ++ SOCK_DGRAM, ++ WILDCARD6_IP, ++ SERV6_PORT, ++ SERV6_REWRITE_IP, ++ SERV6_PORT, ++ SRC6_IP, ++ SUCCESS, ++ }, + { + "sendmsg6: deny call", + sendmsg_deny_prog_load, +@@ -714,16 +745,27 @@ static int connect6_prog_load(const struct sock_addr_test *test) + return load_path(test, CONNECT6_PROG_PATH); + } + +-static int sendmsg_deny_prog_load(const struct sock_addr_test *test) ++static int sendmsg_ret_only_prog_load(const struct sock_addr_test *test, ++ int32_t rc) + { + struct bpf_insn insns[] = { +- /* return 0 */ +- BPF_MOV64_IMM(BPF_REG_0, 0), ++ /* return rc */ ++ BPF_MOV64_IMM(BPF_REG_0, rc), + BPF_EXIT_INSN(), + }; + return load_insns(test, insns, sizeof(insns) / sizeof(struct bpf_insn)); + } + ++static int sendmsg_allow_prog_load(const struct sock_addr_test *test) ++{ ++ return sendmsg_ret_only_prog_load(test, /*rc*/ 1); ++} ++ ++static int sendmsg_deny_prog_load(const struct sock_addr_test *test) ++{ ++ return sendmsg_ret_only_prog_load(test, /*rc*/ 0); ++} ++ + static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test) + { + struct sockaddr_in dst4_rw_addr; +@@ -844,6 +886,11 @@ static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test) + return sendmsg6_rw_dst_asm_prog_load(test, SERV6_V4MAPPED_IP); + } + ++static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test) ++{ ++ return sendmsg6_rw_dst_asm_prog_load(test, WILDCARD6_IP); ++} ++ + static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test) + { + return load_path(test, SENDMSG6_PROG_PATH); +-- +2.19.1 + diff --git a/queue-4.19/selftests-forwarding-add-a-test-case-for-externally-.patch b/queue-4.19/selftests-forwarding-add-a-test-case-for-externally-.patch new file mode 100644 index 00000000000..d6a20aa4043 --- /dev/null +++ b/queue-4.19/selftests-forwarding-add-a-test-case-for-externally-.patch @@ -0,0 +1,73 @@ +From 66372cc576724dc012a74a534d23e8b0c5aed277 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Fri, 18 Jan 2019 15:58:03 +0000 +Subject: selftests: forwarding: Add a test case for externally learned FDB + entries + +[ Upstream commit 479a2b761d61c04e2ae97325aa391a8a8c99c23e ] + +Test that externally learned FDB entries can roam, but not age out. + +Signed-off-by: Ido Schimmel +Reviewed-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/forwarding/bridge_vlan_aware.sh | 34 ++++++++++++++++++- + 1 file changed, 33 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh +index 04c6431b2bd8c..b90dff8d3a94b 100755 +--- a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh ++++ b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh +@@ -1,7 +1,7 @@ + #!/bin/bash + # SPDX-License-Identifier: GPL-2.0 + +-ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding vlan_deletion" ++ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding vlan_deletion extern_learn" + NUM_NETIFS=4 + CHECK_TC="yes" + source lib.sh +@@ -109,6 +109,38 @@ vlan_deletion() + ping_ipv6 + } + ++extern_learn() ++{ ++ local mac=de:ad:be:ef:13:37 ++ local ageing_time ++ ++ # Test that externally learned FDB entries can roam, but not age out ++ RET=0 ++ ++ bridge fdb add de:ad:be:ef:13:37 dev $swp1 master extern_learn vlan 1 ++ ++ bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37 ++ check_err $? "Did not find FDB entry when should" ++ ++ # Wait for 10 seconds after the ageing time to make sure the FDB entry ++ # was not aged out ++ ageing_time=$(bridge_ageing_time_get br0) ++ sleep $((ageing_time + 10)) ++ ++ bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37 ++ check_err $? "FDB entry was aged out when should not" ++ ++ $MZ $h2 -c 1 -p 64 -a $mac -t ip -q ++ ++ bridge fdb show brport $swp2 | grep -q de:ad:be:ef:13:37 ++ check_err $? "FDB entry did not roam when should" ++ ++ log_test "Externally learned FDB entry - ageing & roaming" ++ ++ bridge fdb del de:ad:be:ef:13:37 dev $swp2 master vlan 1 &> /dev/null ++ bridge fdb del de:ad:be:ef:13:37 dev $swp1 master vlan 1 &> /dev/null ++} ++ + trap cleanup EXIT + + setup_prepare +-- +2.19.1 + diff --git a/queue-4.19/selftests-forwarding-add-a-test-for-vlan-deletion.patch b/queue-4.19/selftests-forwarding-add-a-test-for-vlan-deletion.patch new file mode 100644 index 00000000000..69cc6b75a77 --- /dev/null +++ b/queue-4.19/selftests-forwarding-add-a-test-for-vlan-deletion.patch @@ -0,0 +1,53 @@ +From 86ad912b01682921a429eb37f1cf9bd6a2cab17f Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Tue, 8 Jan 2019 16:48:14 +0000 +Subject: selftests: forwarding: Add a test for VLAN deletion + +[ Upstream commit 4fabf3bf93a194c7fa5288da3e0af37e4b943cf3 ] + +Add a VLAN on a bridge port, delete it and make sure the PVID VLAN is +not affected. + +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../selftests/net/forwarding/bridge_vlan_aware.sh | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh +index d8313d0438b74..04c6431b2bd8c 100755 +--- a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh ++++ b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh +@@ -1,7 +1,7 @@ + #!/bin/bash + # SPDX-License-Identifier: GPL-2.0 + +-ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding" ++ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding vlan_deletion" + NUM_NETIFS=4 + CHECK_TC="yes" + source lib.sh +@@ -96,6 +96,19 @@ flooding() + flood_test $swp2 $h1 $h2 + } + ++vlan_deletion() ++{ ++ # Test that the deletion of a VLAN on a bridge port does not affect ++ # the PVID VLAN ++ log_info "Add and delete a VLAN on bridge port $swp1" ++ ++ bridge vlan add vid 10 dev $swp1 ++ bridge vlan del vid 10 dev $swp1 ++ ++ ping_ipv4 ++ ping_ipv6 ++} ++ + trap cleanup EXIT + + setup_prepare +-- +2.19.1 + diff --git a/queue-4.19/selftests-tc-testing-drop-test-on-missing-tunnel-key.patch b/queue-4.19/selftests-tc-testing-drop-test-on-missing-tunnel-key.patch new file mode 100644 index 00000000000..461fd940afa --- /dev/null +++ b/queue-4.19/selftests-tc-testing-drop-test-on-missing-tunnel-key.patch @@ -0,0 +1,67 @@ +From 2c86aa76e6a5d4fce2f6636c6a83945dd7a1bac7 Mon Sep 17 00:00:00 2001 +From: Davide Caratti +Date: Fri, 11 Jan 2019 11:49:58 +0100 +Subject: selftests: tc-testing: drop test on missing tunnel key id + +[ Upstream commit e413615502a3324daba038f529932ba9a5248af0 ] + +After merge of commit 80ef0f22ceda ("net/sched: act_tunnel_key: Allow +key-less tunnels"), act_tunnel_key does not reject anymore requests to +install 'set' rules where the key id is missing. Therefore, drop the +following TDC testcase: + + ba4e - Add tunnel_key set action with missing mandatory id parameter + +because it's going to become a systematic fail as soon as userspace +iproute2 will start supporting key-less tunnels. + +Signed-off-by: Davide Caratti +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../tc-tests/actions/tunnel_key.json | 29 ------------------- + 1 file changed, 29 deletions(-) + +diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json +index 10b2d894e4362..af5e99d272296 100644 +--- a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json ++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json +@@ -81,35 +81,6 @@ + ] + ] + }, +- { +- "id": "ba4e", +- "name": "Add tunnel_key set action with missing mandatory id parameter", +- "category": [ +- "actions", +- "tunnel_key" +- ], +- "setup": [ +- [ +- "$TC actions flush action tunnel_key", +- 0, +- 1, +- 255 +- ] +- ], +- "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 20.20.20.2", +- "expExitCode": "255", +- "verifyCmd": "$TC actions list action tunnel_key", +- "matchPattern": "action order [0-9]+: tunnel_key set.*src_ip 10.10.10.1.*dst_ip 20.20.20.2", +- "matchCount": "0", +- "teardown": [ +- [ +- "$TC actions flush action tunnel_key", +- 0, +- 1, +- 255 +- ] +- ] +- }, + { + "id": "a5e0", + "name": "Add tunnel_key set action with invalid src_ip parameter", +-- +2.19.1 + diff --git a/queue-4.19/selftests-tc-testing-fix-parsing-of-ife-type.patch b/queue-4.19/selftests-tc-testing-fix-parsing-of-ife-type.patch new file mode 100644 index 00000000000..f2736081d1a --- /dev/null +++ b/queue-4.19/selftests-tc-testing-fix-parsing-of-ife-type.patch @@ -0,0 +1,464 @@ +From 296555901349ac17467a972b22eec1c2611dff66 Mon Sep 17 00:00:00 2001 +From: Davide Caratti +Date: Mon, 14 Jan 2019 18:16:44 +0100 +Subject: selftests: tc-testing: fix parsing of ife type + +[ Upstream commit 91fa038d9446b5bf5ea80822790af7dd9bcbb5a2 ] + +In iproute2 commit 90c5c969f0b9 ("fix print_0xhex on 32 bit"), the format +specifier for the ife type changed from 0x%X to %#llX, causing systematic +failures in the following TDC test cases: + + 7682 - Create valid ife encode action with mark and pass control + ef47 - Create valid ife encode action with mark and pipe control + df43 - Create valid ife encode action with mark and continue control + e4cf - Create valid ife encode action with mark and drop control + ccba - Create valid ife encode action with mark and reclassify control + a1cf - Create valid ife encode action with mark and jump control + cb3d - Create valid ife encode action with mark value at 32-bit maximum + 95ed - Create valid ife encode action with prio and pass control + aa17 - Create valid ife encode action with prio and pipe control + 74c7 - Create valid ife encode action with prio and continue control + 7a97 - Create valid ife encode action with prio and drop control + f66b - Create valid ife encode action with prio and reclassify control + 3056 - Create valid ife encode action with prio and jump control + 7dd3 - Create valid ife encode action with prio value at 32-bit maximum + 05bb - Create valid ife encode action with tcindex and pass control + ce65 - Create valid ife encode action with tcindex and pipe control + 09cd - Create valid ife encode action with tcindex and continue control + 8eb5 - Create valid ife encode action with tcindex and continue control + 451a - Create valid ife encode action with tcindex and drop control + d76c - Create valid ife encode action with tcindex and reclassify control + e731 - Create valid ife encode action with tcindex and jump control + b7b8 - Create valid ife encode action with tcindex value at 16-bit maximum + 2a9c - Create valid ife encode action with mac src parameter + cf5c - Create valid ife encode action with mac dst parameter + 2353 - Create valid ife encode action with mac src and mac dst parameters + 552c - Create valid ife encode action with mark and type parameters + 0421 - Create valid ife encode action with prio and type parameters + 4017 - Create valid ife encode action with tcindex and type parameters + fac3 - Create valid ife encode action with index at 32-bit maximnum + 7c25 - Create valid ife decode action with pass control + dccb - Create valid ife decode action with pipe control + 7bb9 - Create valid ife decode action with continue control + d9ad - Create valid ife decode action with drop control + 219f - Create valid ife decode action with reclassify control + 8f44 - Create valid ife decode action with jump control + b330 - Create ife encode action with cookie + +Change 'matchPattern' values, allowing '0' and '0x0' if ife type is equal +to 0, and accepting both '0x' and '0X' otherwise, to let these tests pass +both with old and new tc binaries. +While at it, fix a small typo in test case fac3 ('maximnum'->'maximum'). + +Signed-off-by: Davide Caratti +Acked-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../tc-testing/tc-tests/actions/ife.json | 88 +++++++++---------- + 1 file changed, 44 insertions(+), 44 deletions(-) + +diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json +index 637ea0219617f..0da3545cabdb6 100644 +--- a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json ++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json +@@ -17,7 +17,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 2", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 2", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -41,7 +41,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 10 pipe index 2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 2", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark.*index 2", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark.*index 2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -65,7 +65,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow mark continue index 2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 2", +- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*allow mark.*index 2", ++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*allow mark.*index 2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -89,7 +89,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 789 drop index 2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 2", +- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*use mark 789.*index 2", ++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*use mark 789.*index 2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -113,7 +113,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 656768 reclassify index 2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 2", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 656768.*index 2", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 656768.*index 2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -137,7 +137,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 65 jump 1 index 2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 2", +- "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0xED3E.*use mark 65.*index 2", ++ "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0[xX]ED3E.*use mark 65.*index 2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -161,7 +161,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295 reclassify index 90", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 90", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 4294967295.*index 90", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 4294967295.*index 90", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -185,7 +185,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295999 pipe index 90", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 90", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark 4294967295999.*index 90", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark 4294967295999.*index 90", + "matchCount": "0", + "teardown": [] + }, +@@ -207,7 +207,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow prio pass index 9", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 9", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow prio.*index 9", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow prio.*index 9", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -231,7 +231,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 7 pipe index 9", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 9", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 7.*index 9", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 7.*index 9", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -255,7 +255,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 3 continue index 9", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 9", +- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use prio 3.*index 9", ++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use prio 3.*index 9", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -279,7 +279,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow prio drop index 9", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 9", +- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow prio.*index 9", ++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow prio.*index 9", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -303,7 +303,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 998877 reclassify index 9", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 9", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 998877.*index 9", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 998877.*index 9", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -327,7 +327,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 998877 jump 10 index 9", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 9", +- "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0xED3E.*use prio 998877.*index 9", ++ "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0[xX]ED3E.*use prio 998877.*index 9", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -351,7 +351,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 4294967295 reclassify index 99", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 99", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 4294967295.*index 99", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 4294967295.*index 99", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -375,7 +375,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 4294967298 pipe index 99", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 99", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 4294967298.*index 99", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 4294967298.*index 99", + "matchCount": "0", + "teardown": [] + }, +@@ -397,7 +397,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow tcindex pass index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -421,7 +421,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use tcindex 111 pipe index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 111.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 111.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -445,7 +445,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -469,7 +469,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -493,7 +493,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow tcindex drop index 77", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 77", +- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow tcindex.*index 77", ++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow tcindex.*index 77", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -517,7 +517,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow tcindex reclassify index 77", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 77", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*allow tcindex.*index 77", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*allow tcindex.*index 77", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -541,7 +541,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow tcindex jump 999 index 77", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 77", +- "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0xED3E.*allow tcindex.*index 77", ++ "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0[xX]ED3E.*allow tcindex.*index 77", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -565,7 +565,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use tcindex 65535 pass index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*use tcindex 65535.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*use tcindex 65535.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -589,7 +589,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use tcindex 65539 pipe index 1", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 65539.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 65539.*index 1", + "matchCount": "0", + "teardown": [] + }, +@@ -611,7 +611,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow mark src 00:11:22:33:44:55 pipe index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow mark src 00:11:22:33:44:55.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow mark src 00:11:22:33:44:55.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -635,7 +635,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 9876 dst 00:11:22:33:44:55 reclassify index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -659,7 +659,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow tcindex src 00:aa:bb:cc:dd:ee dst 00:11:22:33:44:55 pass index 11", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 11", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -683,7 +683,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use mark 7 type 0xfefe pass index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xFEFE.*use mark 7.*index 1", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]FEFE.*use mark 7.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -707,7 +707,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use prio 444 type 0xabba pipe index 21", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 21", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xABBA.*use prio 444.*index 21", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ABBA.*use prio 444.*index 21", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -731,7 +731,7 @@ + "cmdUnderTest": "$TC actions add action ife encode use tcindex 5000 type 0xabcd reclassify index 21", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 21", +- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xABCD.*use tcindex 5000.*index 21", ++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ABCD.*use tcindex 5000.*index 21", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -739,7 +739,7 @@ + }, + { + "id": "fac3", +- "name": "Create valid ife encode action with index at 32-bit maximnum", ++ "name": "Create valid ife encode action with index at 32-bit maximum", + "category": [ + "actions", + "ife" +@@ -755,7 +755,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 4294967295", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -779,7 +779,7 @@ + "cmdUnderTest": "$TC actions add action ife decode pass index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife decode action pass.*type 0x0.*allow mark allow tcindex allow prio.*index 1", ++ "matchPattern": "action order [0-9]*: ife decode action pass.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -803,7 +803,7 @@ + "cmdUnderTest": "$TC actions add action ife decode pipe index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0x0.*allow mark allow tcindex allow prio.*index 1", ++ "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -827,7 +827,7 @@ + "cmdUnderTest": "$TC actions add action ife decode continue index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife decode action continue.*type 0x0.*allow mark allow tcindex allow prio.*index 1", ++ "matchPattern": "action order [0-9]*: ife decode action continue.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -851,7 +851,7 @@ + "cmdUnderTest": "$TC actions add action ife decode drop index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife decode action drop.*type 0x0.*allow mark allow tcindex allow prio.*index 1", ++ "matchPattern": "action order [0-9]*: ife decode action drop.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -875,7 +875,7 @@ + "cmdUnderTest": "$TC actions add action ife decode reclassify index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0x0.*allow mark allow tcindex allow prio.*index 1", ++ "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -899,7 +899,7 @@ + "cmdUnderTest": "$TC actions add action ife decode jump 10 index 1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 1", +- "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0x0.*allow mark allow tcindex allow prio.*index 1", ++ "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -923,7 +923,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295999", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 4294967295999", +- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295999", ++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295999", + "matchCount": "0", + "teardown": [] + }, +@@ -945,7 +945,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow mark kuka index 4", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 4", +- "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0xED3E.*allow mark.*index 4", ++ "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0[xX]ED3E.*allow mark.*index 4", + "matchCount": "0", + "teardown": [] + }, +@@ -967,7 +967,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow prio pipe index 4 cookie aabbccddeeff112233445566778800a1", + "expExitCode": "0", + "verifyCmd": "$TC actions get action ife index 4", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1", + "matchCount": "1", + "teardown": [ + "$TC actions flush action ife" +@@ -991,7 +991,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow foo pipe index 4", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 4", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow foo.*index 4", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow foo.*index 4", + "matchCount": "0", + "teardown": [] + }, +@@ -1013,7 +1013,7 @@ + "cmdUnderTest": "$TC actions add action ife encode allow prio type 70000 pipe index 4", + "expExitCode": "255", + "verifyCmd": "$TC actions get action ife index 4", +- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0x11170.*allow prio.*index 4", ++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]11170.*allow prio.*index 4", + "matchCount": "0", + "teardown": [] + }, +-- +2.19.1 + diff --git a/queue-4.19/selftests-tc-testing-fix-tunnel_key-failure-if-dst_p.patch b/queue-4.19/selftests-tc-testing-fix-tunnel_key-failure-if-dst_p.patch new file mode 100644 index 00000000000..74e70b52122 --- /dev/null +++ b/queue-4.19/selftests-tc-testing-fix-tunnel_key-failure-if-dst_p.patch @@ -0,0 +1,41 @@ +From 3a13b4905d21b715a41022364efcf1db0d5b0b26 Mon Sep 17 00:00:00 2001 +From: Davide Caratti +Date: Fri, 11 Jan 2019 15:08:23 +0100 +Subject: selftests: tc-testing: fix tunnel_key failure if dst_port is + unspecified + +[ Upstream commit 5216bd77798e2ed773ecd45f3f368dcaec63e5dd ] + +After commit 1c25324caf82 ("net/sched: act_tunnel_key: Don't dump dst port +if it wasn't set"), act_tunnel_key doesn't dump anymore the destination +port, unless it was explicitly configured. This caused systematic failures +in the following TDC test case: + + 7a88 - Add tunnel_key action with cookie parameter + +Avoid matching zero values of TCA_TUNNEL_KEY_ENC_DST_PORT to let the test +pass again. + +Signed-off-by: Davide Caratti +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../selftests/tc-testing/tc-tests/actions/tunnel_key.json | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json +index af5e99d272296..e7e15a7336b6d 100644 +--- a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json ++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json +@@ -605,7 +605,7 @@ + "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 10.10.10.2 id 7 index 4 cookie aa11bb22cc33dd44ee55ff66aa11b1b2", + "expExitCode": "0", + "verifyCmd": "$TC actions get action tunnel_key index 4", +- "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*dst_port 0.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2", ++ "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2", + "matchCount": "1", + "teardown": [ + "$TC actions flush action tunnel_key" +-- +2.19.1 + diff --git a/queue-4.19/series b/queue-4.19/series index f4d180e99ad..463dbdf0110 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -13,3 +13,85 @@ proc-oom-do-not-report-alien-mms-when-setting-oom_score_adj.patch alsa-hda-realtek-headset-microphone-and-internal-speaker-support-for-system76-oryp5.patch alsa-hda-realtek-disable-pc-beep-in-passthrough-on-alc285.patch keys-allow-reaching-the-keys-quotas-exactly.patch +backlight-pwm_bl-fix-devicetree-parsing-with-auto-ge.patch +mfd-ti_am335x_tscadc-use-platform_devid_auto-while-r.patch +pvcalls-front-read-all-data-before-closing-the-conne.patch +pvcalls-front-don-t-try-to-free-unallocated-rings.patch +pvcalls-front-properly-allocate-sk.patch +pvcalls-back-set-enotconn-in-pvcalls_conn_back_read.patch +mfd-twl-core-fix-section-annotations-on-un-protect_p.patch +mfd-db8500-prcmu-fix-some-section-annotations.patch +mfd-mt6397-do-not-call-irq_domain_remove-if-pmic-uns.patch +mfd-ab8500-core-return-zero-in-get_register_interrup.patch +mfd-bd9571mwv-add-volatile-register-to-make-dvfs-wor.patch +mfd-qcom_rpm-write-fw_version-to-ctrl_reg.patch +mfd-wm5110-add-missing-asrc-rate-register.patch +mfd-axp20x-add-ac-power-supply-cell-for-axp813.patch +mfd-axp20x-re-align-mfd-cell-entries.patch +mfd-axp20x-add-supported-cells-for-axp803.patch +mfd-cros_ec_dev-add-missing-mfd_remove_devices-call-.patch +mfd-tps65218-use-devm_regmap_add_irq_chip-and-clean-.patch +mfd-mc13xxx-fix-a-missing-check-of-a-register-read-f.patch +xen-pvcalls-remove-set-but-not-used-variable-intf.patch +qed-fix-qed_chain_set_prod-for-pbl-chains-with-non-p.patch +qed-fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch +net-hns-fix-use-after-free-identified-by-slub-debug.patch +bpf-fix-1-rewrite-in-sys_sendmsg.patch +selftests-bpf-test-1-rewrite-in-sys_sendmsg-in-test_.patch +watchdog-mt7621_wdt-rt2880_wdt-fix-compilation-probl.patch +net-mlx4-get-rid-of-page-operation-after-dma_alloc_c.patch +mips-ath79-enable-of-serial-ports-in-the-default-con.patch +xprtrdma-double-free-in-rpcrdma_sendctxs_create.patch +mlxsw-spectrum_acl-add-cleanup-after-c-tcam-update-e.patch +selftests-forwarding-add-a-test-for-vlan-deletion.patch +netfilter-nf_tables-fix-leaking-object-reference-cou.patch +scsi-qla4xxx-check-return-code-of-qla4xxx_copy_from_.patch +scsi-isci-initialize-shost-fully-before-calling-scsi.patch +include-linux-compiler-.h-fix-optimizer_hide_var.patch +mips-jazz-fix-64bit-build.patch +netfilter-nft_flow_offload-fix-reverse-route-lookup.patch +bpf-correctly-set-initial-window-on-active-fast-open.patch +pvcalls-front-avoid-get_free_pages-gfp_kernel-under-.patch +bpf-fix-panic-in-stack_map_get_build_id-on-i386-and-.patch +netfilter-nft_flow_offload-fix-interaction-with-vrf-.patch +rdma-mthca-clear-qp-objects-during-their-allocation.patch +powerpc-8xx-fix-setting-of-pagetable-for-abatron-bdi.patch +acpi-nfit-fix-race-accessing-memdev-in-nfit_get_smbi.patch +net-stmmac-fix-pci-module-removal-leak.patch +net-stmmac-dwxgmac2-only-clear-interrupts-that-are-a.patch +net-stmmac-check-if-cbs-is-supported-before-configur.patch +net-stmmac-fix-the-logic-of-checking-if-rx-watchdog-.patch +net-stmmac-prevent-rx-starvation-in-stmmac_napi_poll.patch +isdn-i4l-isdn_tty-fix-some-concurrency-double-free-b.patch +scsi-tcmu-avoid-cmd-qfull-timers-updated-whenever-a-.patch +scsi-ufs-fix-system-suspend-status.patch +scsi-qedi-add-ep_state-for-login-completion-on-un-re.patch +scsi-ufs-fix-geometry-descriptor-size.patch +scsi-cxgb4i-add-wait_for_completion.patch +netfilter-nft_flow_offload-fix-checking-method-of-co.patch +always-clear-the-x2apic_enable-bit-for-pv-guest.patch +drm-meson-add-missing-of_node_put.patch +drm-amdkfd-don-t-assign-dgpus-to-apu-topology-device.patch +drm-amd-display-fix-pme-notification-not-working-in-.patch +vhost-return-einval-if-iovecs-size-does-not-match-th.patch +drm-sun4i-backend-add-missing-of_node_puts.patch +pvcalls-front-fix-potential-null-dereference.patch +selftests-tc-testing-drop-test-on-missing-tunnel-key.patch +selftests-tc-testing-fix-tunnel_key-failure-if-dst_p.patch +selftests-tc-testing-fix-parsing-of-ife-type.patch +afs-don-t-set-vnode-cb_s_break-in-afs_validate.patch +afs-fix-key-refcounting-in-file-locking-code.patch +bpf-don-t-assume-build-id-length-is-always-20-bytes.patch +bpf-zero-out-build_id-for-bpf_stack_build_id_ip.patch +selftests-bpf-retry-tests-that-expect-build-id.patch +atm-he-fix-sign-extension-overflow-on-large-shift.patch +hwmon-tmp421-correct-the-misspelling-of-the-tmp442-c.patch +leds-lp5523-fix-a-missing-check-of-return-value-of-l.patch +bpf-bpf_setsockopt-reset-sock-dst-on-so_mark-changes.patch +dpaa_eth-netif_f_lltx-requires-to-do-our-own-update-.patch +mlxsw-pci-return-error-on-pci-reset-timeout.patch +net-bridge-mark-fdb-entries-that-were-added-by-user-.patch +mlxsw-spectrum_switchdev-do-not-treat-static-fdb-ent.patch +selftests-forwarding-add-a-test-case-for-externally-.patch +net-mlx5e-fix-wrong-zero-tx-drop-counter-indication-.patch +isdn-avm-fix-string-plus-integer-warning-from-clang.patch diff --git a/queue-4.19/vhost-return-einval-if-iovecs-size-does-not-match-th.patch b/queue-4.19/vhost-return-einval-if-iovecs-size-does-not-match-th.patch new file mode 100644 index 00000000000..da2a6e496ab --- /dev/null +++ b/queue-4.19/vhost-return-einval-if-iovecs-size-does-not-match-th.patch @@ -0,0 +1,72 @@ +From b91fb869e84f3036e6424b88951868004928c51e Mon Sep 17 00:00:00 2001 +From: Pavel Tikhomirov +Date: Thu, 13 Dec 2018 17:53:50 +0300 +Subject: vhost: return EINVAL if iovecs size does not match the message size + +[ Upstream commit 74ad7419489ddade8044e3c9ab064ad656520306 ] + +We've failed to copy and process vhost_iotlb_msg so let userspace at +least know about it. For instance before these patch the code below runs +without any error: + +int main() +{ + struct vhost_msg msg; + struct iovec iov; + int fd; + + fd = open("/dev/vhost-net", O_RDWR); + if (fd == -1) { + perror("open"); + return 1; + } + + iov.iov_base = &msg; + iov.iov_len = sizeof(msg)-4; + + if (writev(fd, &iov,1) == -1) { + perror("writev"); + return 1; + } + + return 0; +} + +Signed-off-by: Pavel Tikhomirov +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/vhost.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 5eaeca805c95c..b214a72d5caad 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -1035,8 +1035,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev, + int type, ret; + + ret = copy_from_iter(&type, sizeof(type), from); +- if (ret != sizeof(type)) ++ if (ret != sizeof(type)) { ++ ret = -EINVAL; + goto done; ++ } + + switch (type) { + case VHOST_IOTLB_MSG: +@@ -1055,8 +1057,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev, + + iov_iter_advance(from, offset); + ret = copy_from_iter(&msg, sizeof(msg), from); +- if (ret != sizeof(msg)) ++ if (ret != sizeof(msg)) { ++ ret = -EINVAL; + goto done; ++ } + if (vhost_process_iotlb_msg(dev, &msg)) { + ret = -EFAULT; + goto done; +-- +2.19.1 + diff --git a/queue-4.19/watchdog-mt7621_wdt-rt2880_wdt-fix-compilation-probl.patch b/queue-4.19/watchdog-mt7621_wdt-rt2880_wdt-fix-compilation-probl.patch new file mode 100644 index 00000000000..37ccbf195e5 --- /dev/null +++ b/queue-4.19/watchdog-mt7621_wdt-rt2880_wdt-fix-compilation-probl.patch @@ -0,0 +1,49 @@ +From 72f17ac2c35ac906a0b09b31faa792235d484182 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Sun, 30 Dec 2018 14:21:52 +1100 +Subject: watchdog: mt7621_wdt/rt2880_wdt: Fix compilation problem + +[ Upstream commit 3aa8b8bbc142eeaac89891de584535ceb7fce405 ] + +These files need + #include +to compile correctly. + +Fixes: ac3167257b9f ("headers: separate linux/mod_devicetable.h from linux/platform_device.h") +Signed-off-by: NeilBrown +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/mt7621_wdt.c | 1 + + drivers/watchdog/rt2880_wdt.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/watchdog/mt7621_wdt.c b/drivers/watchdog/mt7621_wdt.c +index 5c4a764717c4d..81208cd3f4ecb 100644 +--- a/drivers/watchdog/mt7621_wdt.c ++++ b/drivers/watchdog/mt7621_wdt.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #include + +diff --git a/drivers/watchdog/rt2880_wdt.c b/drivers/watchdog/rt2880_wdt.c +index 98967f0a7d10e..db7c57d82cfdc 100644 +--- a/drivers/watchdog/rt2880_wdt.c ++++ b/drivers/watchdog/rt2880_wdt.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + #include + +-- +2.19.1 + diff --git a/queue-4.19/xen-pvcalls-remove-set-but-not-used-variable-intf.patch b/queue-4.19/xen-pvcalls-remove-set-but-not-used-variable-intf.patch new file mode 100644 index 00000000000..0a2b8e89f20 --- /dev/null +++ b/queue-4.19/xen-pvcalls-remove-set-but-not-used-variable-intf.patch @@ -0,0 +1,44 @@ +From 648e8c434fbde60daa1ebcdc9b4e20fe62dd20e2 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Fri, 4 Jan 2019 06:03:40 +0000 +Subject: xen/pvcalls: remove set but not used variable 'intf' + +[ Upstream commit 1f8ce09b36c41a026a37a24b20efa32000892a64 ] + +Fixes gcc '-Wunused-but-set-variable' warning: + +drivers/xen/pvcalls-back.c: In function 'pvcalls_sk_state_change': +drivers/xen/pvcalls-back.c:286:28: warning: + variable 'intf' set but not used [-Wunused-but-set-variable] + +It not used since e6587cdbd732 ("pvcalls-back: set -ENOTCONN in +pvcalls_conn_back_read") + +Signed-off-by: YueHaibing +Reviewed-by: Boris Ostrovsky +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + drivers/xen/pvcalls-back.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c +index e8b3ff8e7868b..d4ea33581ac26 100644 +--- a/drivers/xen/pvcalls-back.c ++++ b/drivers/xen/pvcalls-back.c +@@ -283,12 +283,10 @@ static int pvcalls_back_socket(struct xenbus_device *dev, + static void pvcalls_sk_state_change(struct sock *sock) + { + struct sock_mapping *map = sock->sk_user_data; +- struct pvcalls_data_intf *intf; + + if (map == NULL) + return; + +- intf = map->ring; + atomic_inc(&map->read); + notify_remote_via_irq(map->irq); + } +-- +2.19.1 + diff --git a/queue-4.19/xprtrdma-double-free-in-rpcrdma_sendctxs_create.patch b/queue-4.19/xprtrdma-double-free-in-rpcrdma_sendctxs_create.patch new file mode 100644 index 00000000000..08513b7574c --- /dev/null +++ b/queue-4.19/xprtrdma-double-free-in-rpcrdma_sendctxs_create.patch @@ -0,0 +1,46 @@ +From ffc93b49d83bb12f69ca6739d976127a65350b3d Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sat, 5 Jan 2019 16:06:48 +0300 +Subject: xprtrdma: Double free in rpcrdma_sendctxs_create() + +[ Upstream commit 6e17f58c486d9554341f70aa5b63b8fbed07b3fa ] + +The clean up is handled by the caller, rpcrdma_buffer_create(), so this +call to rpcrdma_sendctxs_destroy() leads to a double free. + +Fixes: ae72950abf99 ("xprtrdma: Add data structure to manage RDMA Send arguments") +Signed-off-by: Dan Carpenter +Reviewed-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtrdma/verbs.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 956a5ea47b58e..3d6bf790cf1fb 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -872,7 +872,7 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt) + for (i = 0; i <= buf->rb_sc_last; i++) { + sc = rpcrdma_sendctx_create(&r_xprt->rx_ia); + if (!sc) +- goto out_destroy; ++ return -ENOMEM; + + sc->sc_xprt = r_xprt; + buf->rb_sc_ctxs[i] = sc; +@@ -880,10 +880,6 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt) + buf->rb_flags = 0; + + return 0; +- +-out_destroy: +- rpcrdma_sendctxs_destroy(buf); +- return -ENOMEM; + } + + /* The sendctx queue is not guaranteed to have a size that is a +-- +2.19.1 +