From: Greg Kroah-Hartman Date: Wed, 28 Feb 2018 15:17:27 +0000 (+0100) Subject: 3.18-stable patches X-Git-Tag: v3.18.98~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=70f0a1ed6901ceb87cf2bf40b992fd11ce5135e7;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: bnx2x-improve-reliability-in-case-of-nested-pci-errors.patch drm-ttm-check-the-return-value-of-kzalloc.patch e1000-fix-disabling-already-disabled-warning.patch ipv6-icmp6-allow-icmp-messages-to-be-looped-back.patch led-core-fix-brightness-setting-when-setting-delay_off-0.patch mdio-sun4i-fix-a-memory-leak.patch mtd-nand-gpmi-fix-failure-when-a-erased-page-has-a-bitflip-at-bbm.patch net-arc_emac-fix-arc_emac_rx-error-paths.patch net-gianfar_ptp-move-set_fipers-to-spinlock-protecting-area.patch s390-dasd-fix-wrongly-assigned-configuration-data.patch scsi-storvsc-fix-scsi_cmd-error-assignments-in-storvsc_handle_error.patch sctp-make-use-of-pre-calculated-len.patch sget-handle-failures-of-register_shrinker.patch solutionengine771x-fix-ether-platform-data.patch spi-atmel-fixed-spin_lock-usage-inside-atmel_spi_remove.patch tg3-add-workaround-to-restrict-5762-mrrs-to-2048.patch tg3-enable-phy-reset-in-mtu-change-path-for-5720.patch xen-gntdev-fix-off-by-one-error-when-unmapping-with-holes.patch xen-gntdev-fix-partial-gntdev_mmap-cleanup.patch xen-netfront-enable-device-after-manual-module-load.patch xfs-quota-check-result-of-register_shrinker.patch xfs-quota-fix-missed-destroy-of-qi_tree_lock.patch --- diff --git a/queue-3.18/bnx2x-improve-reliability-in-case-of-nested-pci-errors.patch b/queue-3.18/bnx2x-improve-reliability-in-case-of-nested-pci-errors.patch new file mode 100644 index 00000000000..d77a570f844 --- /dev/null +++ b/queue-3.18/bnx2x-improve-reliability-in-case-of-nested-pci-errors.patch @@ -0,0 +1,90 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: "Guilherme G. Piccoli" +Date: Fri, 22 Dec 2017 13:01:39 -0200 +Subject: bnx2x: Improve reliability in case of nested PCI errors + +From: "Guilherme G. Piccoli" + + +[ Upstream commit f7084059a9cb9e56a186e1677b1dcffd76c2cd24 ] + +While in recovery process of PCI error (called EEH on PowerPC arch), +another PCI transaction could be corrupted causing a situation of +nested PCI errors. Also, this scenario could be reproduced with +error injection mechanisms (for debug purposes). + +We observe that in case of nested PCI errors, bnx2x might attempt to +initialize its shmem and cause a kernel crash due to bad addresses +read from MCP. Multiple different stack traces were observed depending +on the point the second PCI error happens. + +This patch avoids the crashes by: + + * failing PCI recovery in case of nested errors (since multiple + PCI errors in a row are not expected to lead to a functional + adapter anyway), and by, + + * preventing access to adapter FW when MCP is failed (we mark it as + failed when shmem cannot get initialized properly). + +Reported-by: Abdul Haleem +Signed-off-by: Guilherme G. Piccoli +Acked-by: Shahed Shaikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 4 ++-- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 14 +++++++++++++- + 2 files changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -2994,7 +2994,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, i + + del_timer_sync(&bp->timer); + +- if (IS_PF(bp)) { ++ if (IS_PF(bp) && !BP_NOMCP(bp)) { + /* Set ALWAYS_ALIVE bit in shmem */ + bp->fw_drv_pulse_wr_seq |= DRV_PULSE_ALWAYS_ALIVE; + bnx2x_drv_pulse(bp); +@@ -3076,7 +3076,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, i + bp->cnic_loaded = false; + + /* Clear driver version indication in shmem */ +- if (IS_PF(bp)) ++ if (IS_PF(bp) && !BP_NOMCP(bp)) + bnx2x_update_mng_version(bp); + + /* Check if there are pending parity attentions. If there are - set +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -9472,6 +9472,15 @@ static int bnx2x_init_shmem(struct bnx2x + + do { + bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR); ++ ++ /* If we read all 0xFFs, means we are in PCI error state and ++ * should bail out to avoid crashes on adapter's FW reads. ++ */ ++ if (bp->common.shmem_base == 0xFFFFFFFF) { ++ bp->flags |= NO_MCP_FLAG; ++ return -ENODEV; ++ } ++ + if (bp->common.shmem_base) { + val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]); + if (val & SHR_MEM_VALIDITY_MB) +@@ -13743,7 +13752,10 @@ static pci_ers_result_t bnx2x_io_slot_re + BNX2X_ERR("IO slot reset --> driver unload\n"); + + /* MCP should have been reset; Need to wait for validity */ +- bnx2x_init_shmem(bp); ++ if (bnx2x_init_shmem(bp)) { ++ rtnl_unlock(); ++ return PCI_ERS_RESULT_DISCONNECT; ++ } + + if (IS_PF(bp) && SHMEM2_HAS(bp, drv_capabilities_flag)) { + u32 v; diff --git a/queue-3.18/drm-ttm-check-the-return-value-of-kzalloc.patch b/queue-3.18/drm-ttm-check-the-return-value-of-kzalloc.patch new file mode 100644 index 00000000000..6515b233403 --- /dev/null +++ b/queue-3.18/drm-ttm-check-the-return-value-of-kzalloc.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Xiongwei Song +Date: Tue, 2 Jan 2018 21:24:55 +0800 +Subject: drm/ttm: check the return value of kzalloc + +From: Xiongwei Song + + +[ Upstream commit 19d859a7205bc59ffc38303eb25ae394f61d21dc ] + +In the function ttm_page_alloc_init, kzalloc call is made for variable +_manager, we need to check its return value, it may return NULL. + +Signed-off-by: Xiongwei Song +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/ttm/ttm_page_alloc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c ++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c +@@ -818,6 +818,8 @@ int ttm_page_alloc_init(struct ttm_mem_g + pr_info("Initializing pool allocator\n"); + + _manager = kzalloc(sizeof(*_manager), GFP_KERNEL); ++ if (!_manager) ++ return -ENOMEM; + + ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc"); + diff --git a/queue-3.18/e1000-fix-disabling-already-disabled-warning.patch b/queue-3.18/e1000-fix-disabling-already-disabled-warning.patch new file mode 100644 index 00000000000..66b6314982e --- /dev/null +++ b/queue-3.18/e1000-fix-disabling-already-disabled-warning.patch @@ -0,0 +1,181 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Tushar Dave +Date: Wed, 6 Dec 2017 02:26:29 +0530 +Subject: e1000: fix disabling already-disabled warning + +From: Tushar Dave + + +[ Upstream commit 0b76aae741abb9d16d2c0e67f8b1e766576f897d ] + +This patch adds check so that driver does not disable already +disabled device. + +[ 44.637743] advantechwdt: Unexpected close, not stopping watchdog! +[ 44.997548] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input6 +[ 45.013419] e1000 0000:00:03.0: disabling already-disabled device +[ 45.013447] ------------[ cut here ]------------ +[ 45.014868] WARNING: CPU: 1 PID: 71 at drivers/pci/pci.c:1641 pci_disable_device+0xa1/0x105: + pci_disable_device at drivers/pci/pci.c:1640 +[ 45.016171] CPU: 1 PID: 71 Comm: rcu_perf_shutdo Not tainted 4.14.0-01330-g3c07399 #1 +[ 45.017197] task: ffff88011bee9e40 task.stack: ffffc90000860000 +[ 45.017987] RIP: 0010:pci_disable_device+0xa1/0x105: + pci_disable_device at drivers/pci/pci.c:1640 +[ 45.018603] RSP: 0000:ffffc90000863e30 EFLAGS: 00010286 +[ 45.019282] RAX: 0000000000000035 RBX: ffff88013a230008 RCX: 0000000000000000 +[ 45.020182] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000203 +[ 45.021084] RBP: ffff88013a3f31e8 R08: 0000000000000001 R09: 0000000000000000 +[ 45.021986] R10: ffffffff827ec29c R11: 0000000000000002 R12: 0000000000000001 +[ 45.022946] R13: ffff88013a230008 R14: ffff880117802b20 R15: ffffc90000863e8f +[ 45.023842] FS: 0000000000000000(0000) GS:ffff88013fd00000(0000) knlGS:0000000000000000 +[ 45.024863] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 45.025583] CR2: ffffc900006d4000 CR3: 000000000220f000 CR4: 00000000000006a0 +[ 45.026478] Call Trace: +[ 45.026811] __e1000_shutdown+0x1d4/0x1e2: + __e1000_shutdown at drivers/net/ethernet/intel/e1000/e1000_main.c:5162 +[ 45.027344] ? rcu_perf_cleanup+0x2a1/0x2a1: + rcu_perf_shutdown at kernel/rcu/rcuperf.c:627 +[ 45.027883] e1000_shutdown+0x14/0x3a: + e1000_shutdown at drivers/net/ethernet/intel/e1000/e1000_main.c:5235 +[ 45.028351] device_shutdown+0x110/0x1aa: + device_shutdown at drivers/base/core.c:2807 +[ 45.028858] kernel_power_off+0x31/0x64: + kernel_power_off at kernel/reboot.c:260 +[ 45.029343] rcu_perf_shutdown+0x9b/0xa7: + rcu_perf_shutdown at kernel/rcu/rcuperf.c:637 +[ 45.029852] ? __wake_up_common_lock+0xa2/0xa2: + autoremove_wake_function at kernel/sched/wait.c:376 +[ 45.030414] kthread+0x126/0x12e: + kthread at kernel/kthread.c:233 +[ 45.030834] ? __kthread_bind_mask+0x8e/0x8e: + kthread at kernel/kthread.c:190 +[ 45.031399] ? ret_from_fork+0x1f/0x30: + ret_from_fork at arch/x86/entry/entry_64.S:443 +[ 45.031883] ? kernel_init+0xa/0xf5: + kernel_init at init/main.c:997 +[ 45.032325] ret_from_fork+0x1f/0x30: + ret_from_fork at arch/x86/entry/entry_64.S:443 +[ 45.032777] Code: 00 48 85 ed 75 07 48 8b ab a8 00 00 00 48 8d bb 98 00 00 00 e8 aa d1 11 00 48 89 ea 48 89 c6 48 c7 c7 d8 e4 0b 82 e8 55 7d da ff <0f> ff b9 01 00 00 00 31 d2 be 01 00 00 00 48 c7 c7 f0 b1 61 82 +[ 45.035222] ---[ end trace c257137b1b1976ef ]--- +[ 45.037838] ACPI: Preparing to enter system sleep state S5 + +Signed-off-by: Tushar Dave +Tested-by: Fengguang Wu +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/e1000/e1000.h | 3 +- + drivers/net/ethernet/intel/e1000/e1000_main.c | 27 +++++++++++++++++++++----- + 2 files changed, 24 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/intel/e1000/e1000.h ++++ b/drivers/net/ethernet/intel/e1000/e1000.h +@@ -328,7 +328,8 @@ struct e1000_adapter { + enum e1000_state_t { + __E1000_TESTING, + __E1000_RESETTING, +- __E1000_DOWN ++ __E1000_DOWN, ++ __E1000_DISABLED + }; + + #undef pr_fmt +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -940,7 +940,7 @@ static int e1000_init_hw_struct(struct e + static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + { + struct net_device *netdev; +- struct e1000_adapter *adapter; ++ struct e1000_adapter *adapter = NULL; + struct e1000_hw *hw; + + static int cards_found = 0; +@@ -950,6 +950,7 @@ static int e1000_probe(struct pci_dev *p + u16 tmp = 0; + u16 eeprom_apme_mask = E1000_EEPROM_APME; + int bars, need_ioport; ++ bool disable_dev = false; + + /* do not allocate ioport bars when not needed */ + need_ioport = e1000_is_need_ioport(pdev); +@@ -1250,11 +1251,13 @@ err_mdio_ioremap: + iounmap(hw->ce4100_gbe_mdio_base_virt); + iounmap(hw->hw_addr); + err_ioremap: ++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags); + free_netdev(netdev); + err_alloc_etherdev: + pci_release_selected_regions(pdev, bars); + err_pci_reg: +- pci_disable_device(pdev); ++ if (!adapter || disable_dev) ++ pci_disable_device(pdev); + return err; + } + +@@ -1272,6 +1275,7 @@ static void e1000_remove(struct pci_dev + struct net_device *netdev = pci_get_drvdata(pdev); + struct e1000_adapter *adapter = netdev_priv(netdev); + struct e1000_hw *hw = &adapter->hw; ++ bool disable_dev; + + e1000_down_and_stop(adapter); + e1000_release_manageability(adapter); +@@ -1290,9 +1294,11 @@ static void e1000_remove(struct pci_dev + iounmap(hw->flash_address); + pci_release_selected_regions(pdev, adapter->bars); + ++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags); + free_netdev(netdev); + +- pci_disable_device(pdev); ++ if (disable_dev) ++ pci_disable_device(pdev); + } + + /** +@@ -5137,7 +5143,8 @@ static int __e1000_shutdown(struct pci_d + if (netif_running(netdev)) + e1000_free_irq(adapter); + +- pci_disable_device(pdev); ++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags)) ++ pci_disable_device(pdev); + + return 0; + } +@@ -5181,6 +5188,10 @@ static int e1000_resume(struct pci_dev * + pr_err("Cannot enable PCI device from suspend\n"); + return err; + } ++ ++ /* flush memory to make sure state is correct */ ++ smp_mb__before_atomic(); ++ clear_bit(__E1000_DISABLED, &adapter->flags); + pci_set_master(pdev); + + pci_enable_wake(pdev, PCI_D3hot, 0); +@@ -5255,7 +5266,9 @@ static pci_ers_result_t e1000_io_error_d + + if (netif_running(netdev)) + e1000_down(adapter); +- pci_disable_device(pdev); ++ ++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags)) ++ pci_disable_device(pdev); + + /* Request a slot slot reset. */ + return PCI_ERS_RESULT_NEED_RESET; +@@ -5283,6 +5296,10 @@ static pci_ers_result_t e1000_io_slot_re + pr_err("Cannot re-enable PCI device after reset.\n"); + return PCI_ERS_RESULT_DISCONNECT; + } ++ ++ /* flush memory to make sure state is correct */ ++ smp_mb__before_atomic(); ++ clear_bit(__E1000_DISABLED, &adapter->flags); + pci_set_master(pdev); + + pci_enable_wake(pdev, PCI_D3hot, 0); diff --git a/queue-3.18/ipv6-icmp6-allow-icmp-messages-to-be-looped-back.patch b/queue-3.18/ipv6-icmp6-allow-icmp-messages-to-be-looped-back.patch new file mode 100644 index 00000000000..5c6aac301e4 --- /dev/null +++ b/queue-3.18/ipv6-icmp6-allow-icmp-messages-to-be-looped-back.patch @@ -0,0 +1,44 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Brendan McGrath +Date: Wed, 13 Dec 2017 22:14:57 +1100 +Subject: ipv6: icmp6: Allow icmp messages to be looped back + +From: Brendan McGrath + + +[ Upstream commit 588753f1eb18978512b1c9b85fddb457d46f9033 ] + +One example of when an ICMPv6 packet is required to be looped back is +when a host acts as both a Multicast Listener and a Multicast Router. + +A Multicast Router will listen on address ff02::16 for MLDv2 messages. + +Currently, MLDv2 messages originating from a Multicast Listener running +on the same host as the Multicast Router are not being delivered to the +Multicast Router. This is due to dst.input being assigned the default +value of dst_discard. + +This results in the packet being looped back but discarded before being +delivered to the Multicast Router. + +This patch sets dst.input to ip6_input to ensure a looped back packet +is delivered to the Multicast Router. + +Signed-off-by: Brendan McGrath +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/route.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1367,6 +1367,7 @@ struct dst_entry *icmp6_dst_alloc(struct + } + + rt->dst.flags |= DST_HOST; ++ rt->dst.input = ip6_input; + rt->dst.output = ip6_output; + atomic_set(&rt->dst.__refcnt, 1); + rt->rt6i_gateway = fl6->daddr; diff --git a/queue-3.18/led-core-fix-brightness-setting-when-setting-delay_off-0.patch b/queue-3.18/led-core-fix-brightness-setting-when-setting-delay_off-0.patch new file mode 100644 index 00000000000..cdf64a08c1e --- /dev/null +++ b/queue-3.18/led-core-fix-brightness-setting-when-setting-delay_off-0.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Matthieu CASTET +Date: Tue, 12 Dec 2017 11:10:44 +0100 +Subject: led: core: Fix brightness setting when setting delay_off=0 + +From: Matthieu CASTET + + +[ Upstream commit 2b83ff96f51d0b039c4561b9f95c824d7bddb85c ] + +With the current code, the following sequence won't work : +echo timer > trigger + +echo 0 > delay_off +* at this point we call +** led_delay_off_store +** led_blink_set +--- + drivers/leds/led-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/leds/led-core.c ++++ b/drivers/leds/led-core.c +@@ -76,7 +76,7 @@ void led_blink_set(struct led_classdev * + unsigned long *delay_on, + unsigned long *delay_off) + { +- del_timer_sync(&led_cdev->blink_timer); ++ led_stop_software_blink(led_cdev); + + led_cdev->flags &= ~LED_BLINK_ONESHOT; + led_cdev->flags &= ~LED_BLINK_ONESHOT_STOP; diff --git a/queue-3.18/mdio-sun4i-fix-a-memory-leak.patch b/queue-3.18/mdio-sun4i-fix-a-memory-leak.patch new file mode 100644 index 00000000000..0902823a096 --- /dev/null +++ b/queue-3.18/mdio-sun4i-fix-a-memory-leak.patch @@ -0,0 +1,39 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Christophe JAILLET +Date: Sat, 6 Jan 2018 09:00:09 +0100 +Subject: mdio-sun4i: Fix a memory leak + +From: Christophe JAILLET + + +[ Upstream commit 56c0290202ab94a2f2780c449395d4ae8495fab4 ] + +If the probing of the regulator is deferred, the memory allocated by +'mdiobus_alloc_size()' will be leaking. +It should be freed before the next call to 'sun4i_mdio_probe()' which will +reallocate it. + +Fixes: 4bdcb1dd9feb ("net: Add MDIO bus driver for the Allwinner EMAC") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/mdio-sun4i.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/phy/mdio-sun4i.c ++++ b/drivers/net/phy/mdio-sun4i.c +@@ -128,8 +128,10 @@ static int sun4i_mdio_probe(struct platf + + data->regulator = devm_regulator_get(&pdev->dev, "phy"); + if (IS_ERR(data->regulator)) { +- if (PTR_ERR(data->regulator) == -EPROBE_DEFER) +- return -EPROBE_DEFER; ++ if (PTR_ERR(data->regulator) == -EPROBE_DEFER) { ++ ret = -EPROBE_DEFER; ++ goto err_out_free_mdiobus; ++ } + + dev_info(&pdev->dev, "no regulator found\n"); + } else { diff --git a/queue-3.18/mtd-nand-gpmi-fix-failure-when-a-erased-page-has-a-bitflip-at-bbm.patch b/queue-3.18/mtd-nand-gpmi-fix-failure-when-a-erased-page-has-a-bitflip-at-bbm.patch new file mode 100644 index 00000000000..acf05003b6d --- /dev/null +++ b/queue-3.18/mtd-nand-gpmi-fix-failure-when-a-erased-page-has-a-bitflip-at-bbm.patch @@ -0,0 +1,63 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Sascha Hauer +Date: Tue, 5 Dec 2017 11:51:40 +0100 +Subject: mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM + +From: Sascha Hauer + + +[ Upstream commit fdf2e821052958a114618a95ab18a300d0b080cb ] + +When erased subpages are read then the BCH decoder returns STATUS_ERASED +if they are all empty, or STATUS_UNCORRECTABLE if there are bitflips. +When there are bitflips, we have to set these bits again to show the +upper layers a completely erased page. When a bitflip happens in the +exact byte where the bad block marker is, then this byte is swapped +with another byte in block_mark_swapping(). The correction code then +detects a bitflip in another subpage and no longer corrects the bitflip +where it really happens. + +Correct this behaviour by calling block_mark_swapping() after the +bitflips have been corrected. + +In our case UBIFS failed with this bug because it expects erased +pages to be really empty: + +UBIFS error (pid 187): ubifs_scan: corrupt empty space at LEB 36:118735 +UBIFS error (pid 187): ubifs_scanned_corruption: corruption at LEB 36:118735 +UBIFS error (pid 187): ubifs_scanned_corruption: first 8192 bytes from LEB 36:118735 +UBIFS error (pid 187): ubifs_scan: LEB 36 scanning failed +UBIFS error (pid 187): do_commit: commit failed, error -117 + +Signed-off-by: Sascha Hauer +Reviewed-by: Richard Weinberger +Acked-by: Boris Brezillon +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c +@@ -1025,9 +1025,6 @@ static int gpmi_ecc_read_page(struct mtd + return ret; + } + +- /* handle the block mark swapping */ +- block_mark_swapping(this, payload_virt, auxiliary_virt); +- + /* Loop over status bytes, accumulating ECC status. */ + status = auxiliary_virt + nfc_geo->auxiliary_status_offset; + +@@ -1043,6 +1040,9 @@ static int gpmi_ecc_read_page(struct mtd + max_bitflips = max_t(unsigned int, max_bitflips, *status); + } + ++ /* handle the block mark swapping */ ++ block_mark_swapping(this, buf, auxiliary_virt); ++ + if (oob_required) { + /* + * It's time to deliver the OOB bytes. See gpmi_ecc_read_oob() diff --git a/queue-3.18/net-arc_emac-fix-arc_emac_rx-error-paths.patch b/queue-3.18/net-arc_emac-fix-arc_emac_rx-error-paths.patch new file mode 100644 index 00000000000..80eb5501fa8 --- /dev/null +++ b/queue-3.18/net-arc_emac-fix-arc_emac_rx-error-paths.patch @@ -0,0 +1,100 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Alexander Kochetkov +Date: Fri, 15 Dec 2017 20:20:06 +0300 +Subject: net: arc_emac: fix arc_emac_rx() error paths + +From: Alexander Kochetkov + + +[ Upstream commit e688822d035b494071ecbadcccbd6f3325fb0f59 ] + +arc_emac_rx() has some issues found by code review. + +In case netdev_alloc_skb_ip_align() or dma_map_single() failure +rx fifo entry will not be returned to EMAC. + +In case dma_map_single() failure previously allocated skb became +lost to driver. At the same time address of newly allocated skb +will not be provided to EMAC. + +Signed-off-by: Alexander Kochetkov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/arc/emac_main.c | 53 ++++++++++++++++++++--------------- + 1 file changed, 31 insertions(+), 22 deletions(-) + +--- a/drivers/net/ethernet/arc/emac_main.c ++++ b/drivers/net/ethernet/arc/emac_main.c +@@ -250,39 +250,48 @@ static int arc_emac_rx(struct net_device + continue; + } + +- pktlen = info & LEN_MASK; +- stats->rx_packets++; +- stats->rx_bytes += pktlen; +- skb = rx_buff->skb; +- skb_put(skb, pktlen); +- skb->dev = ndev; +- skb->protocol = eth_type_trans(skb, ndev); +- +- dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr), +- dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE); +- +- /* Prepare the BD for next cycle */ +- rx_buff->skb = netdev_alloc_skb_ip_align(ndev, +- EMAC_BUFFER_SIZE); +- if (unlikely(!rx_buff->skb)) { ++ /* Prepare the BD for next cycle. netif_receive_skb() ++ * only if new skb was allocated and mapped to avoid holes ++ * in the RX fifo. ++ */ ++ skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE); ++ if (unlikely(!skb)) { ++ if (net_ratelimit()) ++ netdev_err(ndev, "cannot allocate skb\n"); ++ /* Return ownership to EMAC */ ++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE); + stats->rx_errors++; +- /* Because receive_skb is below, increment rx_dropped */ + stats->rx_dropped++; + continue; + } + +- /* receive_skb only if new skb was allocated to avoid holes */ +- netif_receive_skb(skb); +- +- addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data, ++ addr = dma_map_single(&ndev->dev, (void *)skb->data, + EMAC_BUFFER_SIZE, DMA_FROM_DEVICE); + if (dma_mapping_error(&ndev->dev, addr)) { + if (net_ratelimit()) +- netdev_err(ndev, "cannot dma map\n"); +- dev_kfree_skb(rx_buff->skb); ++ netdev_err(ndev, "cannot map dma buffer\n"); ++ dev_kfree_skb(skb); ++ /* Return ownership to EMAC */ ++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE); + stats->rx_errors++; ++ stats->rx_dropped++; + continue; + } ++ ++ /* unmap previosly mapped skb */ ++ dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr), ++ dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE); ++ ++ pktlen = info & LEN_MASK; ++ stats->rx_packets++; ++ stats->rx_bytes += pktlen; ++ skb_put(rx_buff->skb, pktlen); ++ rx_buff->skb->dev = ndev; ++ rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev); ++ ++ netif_receive_skb(rx_buff->skb); ++ ++ rx_buff->skb = skb; + dma_unmap_addr_set(rx_buff, addr, addr); + dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE); + diff --git a/queue-3.18/net-gianfar_ptp-move-set_fipers-to-spinlock-protecting-area.patch b/queue-3.18/net-gianfar_ptp-move-set_fipers-to-spinlock-protecting-area.patch new file mode 100644 index 00000000000..522243c72bc --- /dev/null +++ b/queue-3.18/net-gianfar_ptp-move-set_fipers-to-spinlock-protecting-area.patch @@ -0,0 +1,40 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Yangbo Lu +Date: Tue, 9 Jan 2018 11:02:33 +0800 +Subject: net: gianfar_ptp: move set_fipers() to spinlock protecting area + +From: Yangbo Lu + + +[ Upstream commit 11d827a993a969c3c6ec56758ff63a44ba19b466 ] + +set_fipers() calling should be protected by spinlock in +case that any interrupt breaks related registers setting +and the function we expect. This patch is to move set_fipers() +to spinlock protecting area in ptp_gianfar_adjtime(). + +Signed-off-by: Yangbo Lu +Acked-by: Richard Cochran +Reviewed-by: Fabio Estevam +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/gianfar_ptp.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/ethernet/freescale/gianfar_ptp.c ++++ b/drivers/net/ethernet/freescale/gianfar_ptp.c +@@ -314,11 +314,10 @@ static int ptp_gianfar_adjtime(struct pt + now = tmr_cnt_read(etsects); + now += delta; + tmr_cnt_write(etsects, now); ++ set_fipers(etsects); + + spin_unlock_irqrestore(&etsects->lock, flags); + +- set_fipers(etsects); +- + return 0; + } + diff --git a/queue-3.18/s390-dasd-fix-wrongly-assigned-configuration-data.patch b/queue-3.18/s390-dasd-fix-wrongly-assigned-configuration-data.patch new file mode 100644 index 00000000000..4770c6bca88 --- /dev/null +++ b/queue-3.18/s390-dasd-fix-wrongly-assigned-configuration-data.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Stefan Haberland +Date: Wed, 6 Dec 2017 10:30:39 +0100 +Subject: s390/dasd: fix wrongly assigned configuration data + +From: Stefan Haberland + + +[ Upstream commit 8a9bd4f8ebc6800bfc0596e28631ff6809a2f615 ] + +We store per path and per device configuration data to identify the +path or device correctly. The per path configuration data might get +mixed up if the original request gets into error recovery and is +started with a random path mask. + +This would lead to a wrong identification of a path in case of a CUIR +event for example. + +Fix by copying the path mask from the original request to the error +recovery request in case it is a path verification request. + +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd_3990_erp.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/s390/block/dasd_3990_erp.c ++++ b/drivers/s390/block/dasd_3990_erp.c +@@ -2743,6 +2743,16 @@ dasd_3990_erp_action(struct dasd_ccw_req + erp = dasd_3990_erp_handle_match_erp(cqr, erp); + } + ++ ++ /* ++ * For path verification work we need to stick with the path that was ++ * originally chosen so that the per path configuration data is ++ * assigned correctly. ++ */ ++ if (test_bit(DASD_CQR_VERIFY_PATH, &erp->flags) && cqr->lpm) { ++ erp->lpm = cqr->lpm; ++ } ++ + if (device->features & DASD_FEATURE_ERPLOG) { + /* print current erp_chain */ + dev_err(&device->cdev->dev, diff --git a/queue-3.18/scsi-storvsc-fix-scsi_cmd-error-assignments-in-storvsc_handle_error.patch b/queue-3.18/scsi-storvsc-fix-scsi_cmd-error-assignments-in-storvsc_handle_error.patch new file mode 100644 index 00000000000..fa682335143 --- /dev/null +++ b/queue-3.18/scsi-storvsc-fix-scsi_cmd-error-assignments-in-storvsc_handle_error.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Cathy Avery +Date: Tue, 19 Dec 2017 13:32:48 -0500 +Subject: scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error + +From: Cathy Avery + + +[ Upstream commit d1b8b2391c24751e44f618fcf86fb55d9a9247fd ] + +When an I/O is returned with an srb_status of SRB_STATUS_INVALID_LUN +which has zero good_bytes it must be assigned an error. Otherwise the +I/O will be continuously requeued and will cause a deadlock in the case +where disks are being hot added and removed. sd_probe_async will wait +forever for its I/O to complete while holding scsi_sd_probe_domain. + +Also returning the default error of DID_TARGET_FAILURE causes multipath +to not retry the I/O resulting in applications receiving I/O errors +before a failover can occur. + +Signed-off-by: Cathy Avery +Signed-off-by: Long Li +Reviewed-by: Stephen Hemminger +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/storvsc_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1029,10 +1029,11 @@ static void storvsc_handle_error(struct + case TEST_UNIT_READY: + break; + default: +- set_host_byte(scmnd, DID_TARGET_FAILURE); ++ set_host_byte(scmnd, DID_ERROR); + } + break; + case SRB_STATUS_INVALID_LUN: ++ set_host_byte(scmnd, DID_NO_CONNECT); + do_work = true; + process_err_fn = storvsc_remove_lun; + break; diff --git a/queue-3.18/sctp-make-use-of-pre-calculated-len.patch b/queue-3.18/sctp-make-use-of-pre-calculated-len.patch new file mode 100644 index 00000000000..f1b6150c402 --- /dev/null +++ b/queue-3.18/sctp-make-use-of-pre-calculated-len.patch @@ -0,0 +1,94 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Marcelo Ricardo Leitner +Date: Mon, 8 Jan 2018 19:02:29 -0200 +Subject: sctp: make use of pre-calculated len + +From: Marcelo Ricardo Leitner + + +[ Upstream commit c76f97c99ae6d26d14c7f0e50e074382bfbc9f98 ] + +Some sockopt handling functions were calculating the length of the +buffer to be written to userspace and then calculating it again when +actually writing the buffer, which could lead to some write not using +an up-to-date length. + +This patch updates such places to just make use of the len variable. + +Also, replace some sizeof(type) to sizeof(var). + +Signed-off-by: Marcelo Ricardo Leitner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/socket.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -4458,7 +4458,7 @@ static int sctp_getsockopt_autoclose(str + len = sizeof(int); + if (put_user(len, optlen)) + return -EFAULT; +- if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int))) ++ if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len)) + return -EFAULT; + return 0; + } +@@ -5035,6 +5035,9 @@ copy_getaddrs: + err = -EFAULT; + goto out; + } ++ /* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too, ++ * but we can't change it anymore. ++ */ + if (put_user(bytes_copied, optlen)) + err = -EFAULT; + out: +@@ -5471,7 +5474,7 @@ static int sctp_getsockopt_maxseg(struct + params.assoc_id = 0; + } else if (len >= sizeof(struct sctp_assoc_value)) { + len = sizeof(struct sctp_assoc_value); +- if (copy_from_user(¶ms, optval, sizeof(params))) ++ if (copy_from_user(¶ms, optval, len)) + return -EFAULT; + } else + return -EINVAL; +@@ -5635,7 +5638,9 @@ static int sctp_getsockopt_active_key(st + + if (len < sizeof(struct sctp_authkeyid)) + return -EINVAL; +- if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid))) ++ ++ len = sizeof(struct sctp_authkeyid); ++ if (copy_from_user(&val, optval, len)) + return -EFAULT; + + asoc = sctp_id2assoc(sk, val.scact_assoc_id); +@@ -5647,7 +5652,6 @@ static int sctp_getsockopt_active_key(st + else + val.scact_keynumber = ep->active_key_id; + +- len = sizeof(struct sctp_authkeyid); + if (put_user(len, optlen)) + return -EFAULT; + if (copy_to_user(optval, &val, len)) +@@ -5673,7 +5677,7 @@ static int sctp_getsockopt_peer_auth_chu + if (len < sizeof(struct sctp_authchunks)) + return -EINVAL; + +- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) ++ if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + + to = p->gauth_chunks; +@@ -5718,7 +5722,7 @@ static int sctp_getsockopt_local_auth_ch + if (len < sizeof(struct sctp_authchunks)) + return -EINVAL; + +- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) ++ if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + + to = p->gauth_chunks; diff --git a/queue-3.18/series b/queue-3.18/series index ba7f03e895b..44f22fff7ba 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -1,2 +1,24 @@ ipv6-skip-xfrm-lookup-if-dst_entry-in-socket-cache-is-valid.patch hrtimer-ensure-posix-compliance-relative-clock_realtime-hrtimers.patch +mtd-nand-gpmi-fix-failure-when-a-erased-page-has-a-bitflip-at-bbm.patch +ipv6-icmp6-allow-icmp-messages-to-be-looped-back.patch +sget-handle-failures-of-register_shrinker.patch +spi-atmel-fixed-spin_lock-usage-inside-atmel_spi_remove.patch +net-arc_emac-fix-arc_emac_rx-error-paths.patch +scsi-storvsc-fix-scsi_cmd-error-assignments-in-storvsc_handle_error.patch +tg3-add-workaround-to-restrict-5762-mrrs-to-2048.patch +tg3-enable-phy-reset-in-mtu-change-path-for-5720.patch +bnx2x-improve-reliability-in-case-of-nested-pci-errors.patch +led-core-fix-brightness-setting-when-setting-delay_off-0.patch +s390-dasd-fix-wrongly-assigned-configuration-data.patch +xfs-quota-fix-missed-destroy-of-qi_tree_lock.patch +xfs-quota-check-result-of-register_shrinker.patch +e1000-fix-disabling-already-disabled-warning.patch +drm-ttm-check-the-return-value-of-kzalloc.patch +xen-netfront-enable-device-after-manual-module-load.patch +mdio-sun4i-fix-a-memory-leak.patch +solutionengine771x-fix-ether-platform-data.patch +xen-gntdev-fix-off-by-one-error-when-unmapping-with-holes.patch +xen-gntdev-fix-partial-gntdev_mmap-cleanup.patch +sctp-make-use-of-pre-calculated-len.patch +net-gianfar_ptp-move-set_fipers-to-spinlock-protecting-area.patch diff --git a/queue-3.18/sget-handle-failures-of-register_shrinker.patch b/queue-3.18/sget-handle-failures-of-register_shrinker.patch new file mode 100644 index 00000000000..abedf0e1e1a --- /dev/null +++ b/queue-3.18/sget-handle-failures-of-register_shrinker.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Al Viro +Date: Mon, 18 Dec 2017 15:05:07 -0500 +Subject: sget(): handle failures of register_shrinker() + +From: Al Viro + + +[ Upstream commit 9ee332d99e4d5a97548943b81c54668450ce641b ] + +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/super.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/fs/super.c ++++ b/fs/super.c +@@ -476,7 +476,11 @@ retry: + hlist_add_head(&s->s_instances, &type->fs_supers); + spin_unlock(&sb_lock); + get_filesystem(type); +- register_shrinker(&s->s_shrink); ++ err = register_shrinker(&s->s_shrink); ++ if (err) { ++ deactivate_locked_super(s); ++ s = ERR_PTR(err); ++ } + return s; + } + diff --git a/queue-3.18/solutionengine771x-fix-ether-platform-data.patch b/queue-3.18/solutionengine771x-fix-ether-platform-data.patch new file mode 100644 index 00000000000..33ed0fb1d9b --- /dev/null +++ b/queue-3.18/solutionengine771x-fix-ether-platform-data.patch @@ -0,0 +1,65 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Sergei Shtylyov +Date: Sat, 6 Jan 2018 21:53:26 +0300 +Subject: SolutionEngine771x: fix Ether platform data + +From: Sergei Shtylyov + + +[ Upstream commit 195e2addbce09e5afbc766efc1e6567c9ce840d3 ] + +The 'sh_eth' driver's probe() method would fail on the SolutionEngine7710 +board and crash on SolutionEngine7712 board as the platform code is +hopelessly behind the driver's platform data -- it passes the PHY address +instead of 'struct sh_eth_plat_data *'; pass the latter to the driver in +order to fix the bug... + +Fixes: 71557a37adb5 ("[netdrvr] sh_eth: Add SH7619 support") +Signed-off-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/sh/boards/mach-se/770x/setup.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/arch/sh/boards/mach-se/770x/setup.c ++++ b/arch/sh/boards/mach-se/770x/setup.c +@@ -8,6 +8,7 @@ + */ + #include + #include ++#include + #include + #include + #include +@@ -114,6 +115,11 @@ static struct platform_device heartbeat_ + #if defined(CONFIG_CPU_SUBTYPE_SH7710) ||\ + defined(CONFIG_CPU_SUBTYPE_SH7712) + /* SH771X Ethernet driver */ ++static struct sh_eth_plat_data sh_eth_plat = { ++ .phy = PHY_ID, ++ .phy_interface = PHY_INTERFACE_MODE_MII, ++}; ++ + static struct resource sh_eth0_resources[] = { + [0] = { + .start = SH_ETH0_BASE, +@@ -131,7 +137,7 @@ static struct platform_device sh_eth0_de + .name = "sh771x-ether", + .id = 0, + .dev = { +- .platform_data = PHY_ID, ++ .platform_data = &sh_eth_plat, + }, + .num_resources = ARRAY_SIZE(sh_eth0_resources), + .resource = sh_eth0_resources, +@@ -154,7 +160,7 @@ static struct platform_device sh_eth1_de + .name = "sh771x-ether", + .id = 1, + .dev = { +- .platform_data = PHY_ID, ++ .platform_data = &sh_eth_plat, + }, + .num_resources = ARRAY_SIZE(sh_eth1_resources), + .resource = sh_eth1_resources, diff --git a/queue-3.18/spi-atmel-fixed-spin_lock-usage-inside-atmel_spi_remove.patch b/queue-3.18/spi-atmel-fixed-spin_lock-usage-inside-atmel_spi_remove.patch new file mode 100644 index 00000000000..c1bb14796d5 --- /dev/null +++ b/queue-3.18/spi-atmel-fixed-spin_lock-usage-inside-atmel_spi_remove.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Radu Pirea +Date: Fri, 15 Dec 2017 17:40:17 +0200 +Subject: spi: atmel: fixed spin_lock usage inside atmel_spi_remove + +From: Radu Pirea + + +[ Upstream commit 66e900a3d225575c8b48b59ae1fe74bb6e5a65cc ] + +The only part of atmel_spi_remove which needs to be atomic is hardware +reset. + +atmel_spi_stop_dma calls dma_terminate_all and this needs interrupts +enabled. +atmel_spi_release_dma calls dma_release_channel and dma_release_channel +locks a mutex inside of spin_lock. + +So the call of these functions can't be inside a spin_lock. + +Reported-by: Jia-Ju Bai +Signed-off-by: Radu Pirea +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-atmel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1416,12 +1416,12 @@ static int atmel_spi_remove(struct platf + struct atmel_spi *as = spi_master_get_devdata(master); + + /* reset the hardware and block queue progress */ +- spin_lock_irq(&as->lock); + if (as->use_dma) { + atmel_spi_stop_dma(as); + atmel_spi_release_dma(as); + } + ++ spin_lock_irq(&as->lock); + spi_writel(as, CR, SPI_BIT(SWRST)); + spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */ + spi_readl(as, SR); diff --git a/queue-3.18/tg3-add-workaround-to-restrict-5762-mrrs-to-2048.patch b/queue-3.18/tg3-add-workaround-to-restrict-5762-mrrs-to-2048.patch new file mode 100644 index 00000000000..80993945f25 --- /dev/null +++ b/queue-3.18/tg3-add-workaround-to-restrict-5762-mrrs-to-2048.patch @@ -0,0 +1,64 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Siva Reddy Kallam +Date: Fri, 22 Dec 2017 16:05:28 +0530 +Subject: tg3: Add workaround to restrict 5762 MRRS to 2048 + +From: Siva Reddy Kallam + + +[ Upstream commit 4419bb1cedcda0272e1dc410345c5a1d1da0e367 ] + +One of AMD based server with 5762 hangs with jumbo frame traffic. +This AMD platform has southbridge limitation which is restricting MRRS +to 4000. As a work around, driver to restricts the MRRS to 2048 for +this particular 5762 NX1 card. + +Signed-off-by: Siva Reddy Kallam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/tg3.c | 10 ++++++++++ + drivers/net/ethernet/broadcom/tg3.h | 4 ++++ + 2 files changed, 14 insertions(+) + +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -10028,6 +10028,16 @@ static int tg3_reset_hw(struct tg3 *tp, + + tw32(GRC_MODE, tp->grc_mode | val); + ++ /* On one of the AMD platform, MRRS is restricted to 4000 because of ++ * south bridge limitation. As a workaround, Driver is setting MRRS ++ * to 2048 instead of default 4096. ++ */ ++ if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL && ++ tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) { ++ val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK; ++ tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048); ++ } ++ + /* Setup the timer prescalar register. Clock is always 66Mhz. */ + val = tr32(GRC_MISC_CFG); + val &= ~0xff; +--- a/drivers/net/ethernet/broadcom/tg3.h ++++ b/drivers/net/ethernet/broadcom/tg3.h +@@ -95,6 +95,7 @@ + #define TG3PCI_SUBDEVICE_ID_DELL_JAGUAR 0x0106 + #define TG3PCI_SUBDEVICE_ID_DELL_MERLOT 0x0109 + #define TG3PCI_SUBDEVICE_ID_DELL_SLIM_MERLOT 0x010a ++#define TG3PCI_SUBDEVICE_ID_DELL_5762 0x07f0 + #define TG3PCI_SUBVENDOR_ID_COMPAQ PCI_VENDOR_ID_COMPAQ + #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE 0x007c + #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE_2 0x009a +@@ -280,6 +281,9 @@ + #define TG3PCI_STD_RING_PROD_IDX 0x00000098 /* 64-bit */ + #define TG3PCI_RCV_RET_RING_CON_IDX 0x000000a0 /* 64-bit */ + /* 0xa8 --> 0xb8 unused */ ++#define TG3PCI_DEV_STATUS_CTRL 0x000000b4 ++#define MAX_READ_REQ_SIZE_2048 0x00004000 ++#define MAX_READ_REQ_MASK 0x00007000 + #define TG3PCI_DUAL_MAC_CTRL 0x000000b8 + #define DUAL_MAC_CTRL_CH_MASK 0x00000003 + #define DUAL_MAC_CTRL_ID 0x00000004 diff --git a/queue-3.18/tg3-enable-phy-reset-in-mtu-change-path-for-5720.patch b/queue-3.18/tg3-enable-phy-reset-in-mtu-change-path-for-5720.patch new file mode 100644 index 00000000000..c4e10e34227 --- /dev/null +++ b/queue-3.18/tg3-enable-phy-reset-in-mtu-change-path-for-5720.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Siva Reddy Kallam +Date: Fri, 22 Dec 2017 16:05:29 +0530 +Subject: tg3: Enable PHY reset in MTU change path for 5720 + +From: Siva Reddy Kallam + + +[ Upstream commit e60ee41aaf898584205a6af5c996860d0fe6a836 ] + +A customer noticed RX path hang when MTU is changed on the fly while +running heavy traffic with NCSI enabled for 5717 and 5719. Since 5720 +belongs to same ASIC family, we observed same issue and same fix +could solve this problem for 5720. + +Signed-off-by: Siva Reddy Kallam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/tg3.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -14214,7 +14214,8 @@ static int tg3_change_mtu(struct net_dev + */ + if (tg3_asic_rev(tp) == ASIC_REV_57766 || + tg3_asic_rev(tp) == ASIC_REV_5717 || +- tg3_asic_rev(tp) == ASIC_REV_5719) ++ tg3_asic_rev(tp) == ASIC_REV_5719 || ++ tg3_asic_rev(tp) == ASIC_REV_5720) + reset_phy = true; + + err = tg3_restart_hw(tp, reset_phy); diff --git a/queue-3.18/xen-gntdev-fix-off-by-one-error-when-unmapping-with-holes.patch b/queue-3.18/xen-gntdev-fix-off-by-one-error-when-unmapping-with-holes.patch new file mode 100644 index 00000000000..698496561dc --- /dev/null +++ b/queue-3.18/xen-gntdev-fix-off-by-one-error-when-unmapping-with-holes.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Ross Lagerwall +Date: Tue, 9 Jan 2018 12:10:21 +0000 +Subject: xen/gntdev: Fix off-by-one error when unmapping with holes + +From: Ross Lagerwall + + +[ Upstream commit 951a010233625b77cde3430b4b8785a9a22968d1 ] + +If the requested range has a hole, the calculation of the number of +pages to unmap is off by one. Fix it. + +Signed-off-by: Ross Lagerwall +Reviewed-by: Boris Ostrovsky +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/gntdev.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -348,10 +348,8 @@ static int unmap_grant_pages(struct gran + } + range = 0; + while (range < pages) { +- if (map->unmap_ops[offset+range].handle == -1) { +- range--; ++ if (map->unmap_ops[offset+range].handle == -1) + break; +- } + range++; + } + err = __unmap_grant_pages(map, offset, range); diff --git a/queue-3.18/xen-gntdev-fix-partial-gntdev_mmap-cleanup.patch b/queue-3.18/xen-gntdev-fix-partial-gntdev_mmap-cleanup.patch new file mode 100644 index 00000000000..00ec7bf3a78 --- /dev/null +++ b/queue-3.18/xen-gntdev-fix-partial-gntdev_mmap-cleanup.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Ross Lagerwall +Date: Tue, 9 Jan 2018 12:10:22 +0000 +Subject: xen/gntdev: Fix partial gntdev_mmap() cleanup + +From: Ross Lagerwall + + +[ Upstream commit cf2acf66ad43abb39735568f55e1f85f9844e990 ] + +When cleaning up after a partially successful gntdev_mmap(), unmap the +successfully mapped grant pages otherwise Xen will kill the domain if +in debug mode (Attempt to implicitly unmap a granted PTE) or Linux will +kill the process and emit "BUG: Bad page map in process" if Xen is in +release mode. + +This is only needed when use_ptemod is true because gntdev_put_map() +will unmap grant pages itself when use_ptemod is false. + +Signed-off-by: Ross Lagerwall +Reviewed-by: Boris Ostrovsky +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/gntdev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -817,8 +817,10 @@ unlock_out: + out_unlock_put: + mutex_unlock(&priv->lock); + out_put_map: +- if (use_ptemod) ++ if (use_ptemod) { + map->vma = NULL; ++ unmap_grant_pages(map, 0, map->count); ++ } + gntdev_put_map(priv, map); + return err; + } diff --git a/queue-3.18/xen-netfront-enable-device-after-manual-module-load.patch b/queue-3.18/xen-netfront-enable-device-after-manual-module-load.patch new file mode 100644 index 00000000000..7488c23bef7 --- /dev/null +++ b/queue-3.18/xen-netfront-enable-device-after-manual-module-load.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Eduardo Otubo +Date: Fri, 5 Jan 2018 09:42:16 +0100 +Subject: xen-netfront: enable device after manual module load + +From: Eduardo Otubo + + +[ Upstream commit b707fda2df4070785d0fa8a278aa13944c5f51f8 ] + +When loading the module after unloading it, the network interface would +not be enabled and thus wouldn't have a backend counterpart and unable +to be used by the guest. + +The guest would face errors like: + + [root@guest ~]# ethtool -i eth0 + Cannot get driver information: No such device + + [root@guest ~]# ifconfig eth0 + eth0: error fetching interface information: Device not found + +This patch initializes the state of the netfront device whenever it is +loaded manually, this state would communicate the netback to create its +device and establish the connection between them. + +Signed-off-by: Eduardo Otubo +Reviewed-by: Boris Ostrovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/xen-netfront.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -1358,6 +1358,7 @@ static struct net_device *xennet_create_ + + netif_carrier_off(netdev); + ++ xenbus_switch_state(dev, XenbusStateInitialising); + return netdev; + + exit: diff --git a/queue-3.18/xfs-quota-check-result-of-register_shrinker.patch b/queue-3.18/xfs-quota-check-result-of-register_shrinker.patch new file mode 100644 index 00000000000..f18b91cd6d9 --- /dev/null +++ b/queue-3.18/xfs-quota-check-result-of-register_shrinker.patch @@ -0,0 +1,108 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Aliaksei Karaliou +Date: Thu, 21 Dec 2017 13:18:26 -0800 +Subject: xfs: quota: check result of register_shrinker() + +From: Aliaksei Karaliou + + +[ Upstream commit 3a3882ff26fbdbaf5f7e13f6a0bccfbf7121041d ] + +xfs_qm_init_quotainfo() does not check result of register_shrinker() +which was tagged as __must_check recently, reported by sparse. + +Signed-off-by: Aliaksei Karaliou +[darrick: move xfs_qm_destroy_quotainos nearer xfs_qm_init_quotainos] +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/xfs/xfs_qm.c | 45 +++++++++++++++++++++++++++++---------------- + 1 file changed, 29 insertions(+), 16 deletions(-) + +--- a/fs/xfs/xfs_qm.c ++++ b/fs/xfs/xfs_qm.c +@@ -49,7 +49,7 @@ + STATIC int xfs_qm_init_quotainos(xfs_mount_t *); + STATIC int xfs_qm_init_quotainfo(xfs_mount_t *); + +- ++STATIC void xfs_qm_destroy_quotainos(xfs_quotainfo_t *qi); + STATIC void xfs_qm_dqfree_one(struct xfs_dquot *dqp); + /* + * We use the batch lookup interface to iterate over the dquots as it +@@ -662,9 +662,17 @@ xfs_qm_init_quotainfo( + qinf->qi_shrinker.scan_objects = xfs_qm_shrink_scan; + qinf->qi_shrinker.seeks = DEFAULT_SEEKS; + qinf->qi_shrinker.flags = SHRINKER_NUMA_AWARE; +- register_shrinker(&qinf->qi_shrinker); ++ ++ error = register_shrinker(&qinf->qi_shrinker); ++ if (error) ++ goto out_free_inos; ++ + return 0; + ++out_free_inos: ++ mutex_destroy(&qinf->qi_quotaofflock); ++ mutex_destroy(&qinf->qi_tree_lock); ++ xfs_qm_destroy_quotainos(qinf); + out_free_lru: + list_lru_destroy(&qinf->qi_lru); + out_free_qinf: +@@ -673,7 +681,6 @@ out_free_qinf: + return error; + } + +- + /* + * Gets called when unmounting a filesystem or when all quotas get + * turned off. +@@ -690,19 +697,7 @@ xfs_qm_destroy_quotainfo( + + unregister_shrinker(&qi->qi_shrinker); + list_lru_destroy(&qi->qi_lru); +- +- if (qi->qi_uquotaip) { +- IRELE(qi->qi_uquotaip); +- qi->qi_uquotaip = NULL; /* paranoia */ +- } +- if (qi->qi_gquotaip) { +- IRELE(qi->qi_gquotaip); +- qi->qi_gquotaip = NULL; +- } +- if (qi->qi_pquotaip) { +- IRELE(qi->qi_pquotaip); +- qi->qi_pquotaip = NULL; +- } ++ xfs_qm_destroy_quotainos(qi); + mutex_destroy(&qi->qi_tree_lock); + mutex_destroy(&qi->qi_quotaofflock); + kmem_free(qi); +@@ -1574,6 +1569,24 @@ error_rele: + } + + STATIC void ++xfs_qm_destroy_quotainos( ++ xfs_quotainfo_t *qi) ++{ ++ if (qi->qi_uquotaip) { ++ IRELE(qi->qi_uquotaip); ++ qi->qi_uquotaip = NULL; /* paranoia */ ++ } ++ if (qi->qi_gquotaip) { ++ IRELE(qi->qi_gquotaip); ++ qi->qi_gquotaip = NULL; ++ } ++ if (qi->qi_pquotaip) { ++ IRELE(qi->qi_pquotaip); ++ qi->qi_pquotaip = NULL; ++ } ++} ++ ++STATIC void + xfs_qm_dqfree_one( + struct xfs_dquot *dqp) + { diff --git a/queue-3.18/xfs-quota-fix-missed-destroy-of-qi_tree_lock.patch b/queue-3.18/xfs-quota-fix-missed-destroy-of-qi_tree_lock.patch new file mode 100644 index 00000000000..c951bffbe22 --- /dev/null +++ b/queue-3.18/xfs-quota-fix-missed-destroy-of-qi_tree_lock.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Feb 28 16:16:23 CET 2018 +From: Aliaksei Karaliou +Date: Thu, 21 Dec 2017 13:18:26 -0800 +Subject: xfs: quota: fix missed destroy of qi_tree_lock + +From: Aliaksei Karaliou + + +[ Upstream commit 2196881566225f3c3428d1a5f847a992944daa5b ] + +xfs_qm_destroy_quotainfo() does not destroy quotainfo->qi_tree_lock +while destroys quotainfo->qi_quotaofflock. + +Signed-off-by: Aliaksei Karaliou +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/xfs/xfs_qm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/xfs/xfs_qm.c ++++ b/fs/xfs/xfs_qm.c +@@ -703,6 +703,7 @@ xfs_qm_destroy_quotainfo( + IRELE(qi->qi_pquotaip); + qi->qi_pquotaip = NULL; + } ++ mutex_destroy(&qi->qi_tree_lock); + mutex_destroy(&qi->qi_quotaofflock); + kmem_free(qi); + mp->m_quotainfo = NULL;