From 3e1ee9d0136b38a3d04ee7d4f2aa8186214c8d83 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 22 Aug 2018 10:45:38 +0200 Subject: [PATCH] 3.18-stable patches added patches: arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch arm-dts-da850-fix-interrups-property-for-gpio.patch arm-imx_v4_v5_defconfig-select-ulpi-support.patch arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch arm64-make-secondary_start_kernel-notrace.patch bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch brcmfmac-stop-watchdog-before-detach-and-free-everything.patch cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch drm-armada-fix-colorkey-mode-property.patch drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch enic-initialize-enic-rfs_h.lock-in-enic_probe.patch ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch ixgbe-be-more-careful-when-modifying-mac-filters.patch locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch m68k-fix-bad-page-state-oops-on-coldfire-boot.patch md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch net-hamradio-use-eth_broadcast_addr.patch net-propagate-dev_get_valid_name-return-code.patch net-qca_spi-avoid-packet-drop-during-initial-sync.patch net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch perf-report-powerpc-fix-crash-if-callchain-is-empty.patch qlogic-check-kstrtoul-for-errors.patch selftests-sync-add-config-fragment-for-testing-sync-framework.patch smack-mark-inode-instant-in-smack_task_to_inode.patch smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch tracing-use-__printf-markup-to-silence-compiler.patch usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch --- ...le-reference-to-omap3-otg-controller.patch | 36 ++++++ ...437x-make-edt-ft5x06-a-wakeup-source.patch | 31 ++++++ ...a850-fix-interrups-property-for-gpio.patch | 37 ++++++ ..._v4_v5_defconfig-select-ulpi-support.patch | 35 ++++++ ...-of-icmr-registers-in-suspend-resume.patch | 45 ++++++++ ...-make-secondary_start_kernel-notrace.patch | 40 +++++++ ...x-timeout-in-error-or-recovery-state.patch | 77 +++++++++++++ ...og-before-detach-and-free-everything.patch | 76 +++++++++++++ ...abling-dcb-set-txq-dcb-priority-to-0.patch | 36 ++++++ ...off-by-one-in-k3_of_dma_simple_xlate.patch | 32 ++++++ ...rm-armada-fix-colorkey-mode-property.patch | 91 +++++++++++++++ ...16-61-yuv420-yvu420-and-yuv422-modes.patch | 96 ++++++++++++++++ ...ialize-enic-rfs_h.lock-in-enic_probe.patch | 98 ++++++++++++++++ ...port-interval-after-receiving-querys.patch | 58 ++++++++++ ...e-careful-when-modifying-mac-filters.patch | 56 ++++++++++ ...record-irq-state-within-lockdep-code.patch | 82 ++++++++++++++ ...bad-page-state-oops-on-coldfire-boot.patch | 64 +++++++++++ ...t-complete-recovery-after-reassemble.patch | 54 +++++++++ ...e-against-its-compatible-if-possible.patch | 34 ++++++ .../net-hamradio-use-eth_broadcast_addr.patch | 52 +++++++++ ...agate-dev_get_valid_name-return-code.patch | 42 +++++++ ...void-packet-drop-during-initial-sync.patch | 33 ++++++ ...-sure-the-qca7000-reset-is-triggered.patch | 34 ++++++ ...0-demote-allmulti-message-to-dev_dbg.patch | 37 ++++++ ...efrag-reduce-struct-net-memory-waste.patch | 72 ++++++++++++ ...-set-module-owner-for-icmp-6-matches.patch | 44 ++++++++ ...registers-configuration-on-mtu-setup.patch | 67 +++++++++++ ...erpc-fix-crash-if-callchain-is-empty.patch | 72 ++++++++++++ .../qlogic-check-kstrtoul-for-errors.patch | 31 ++++++ ...-fragment-for-testing-sync-framework.patch | 36 ++++++ queue-3.18/series | 36 ++++++ ...inode-instant-in-smack_task_to_inode.patch | 34 ++++++ ...-for-gigabit-link-up-hardware-errata.patch | 105 ++++++++++++++++++ ...ify-cryptic-messages-as-tcp-seq-bugs.patch | 54 +++++++++ ...-__printf-markup-to-silence-compiler.patch | 69 ++++++++++++ ...-isoc-split-in-transfer-with-no-data.patch | 59 ++++++++++ ...us-race-condition-when-set_interface.patch | 42 +++++++ 37 files changed, 1997 insertions(+) create mode 100644 queue-3.18/arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch create mode 100644 queue-3.18/arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch create mode 100644 queue-3.18/arm-dts-da850-fix-interrups-property-for-gpio.patch create mode 100644 queue-3.18/arm-imx_v4_v5_defconfig-select-ulpi-support.patch create mode 100644 queue-3.18/arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch create mode 100644 queue-3.18/arm64-make-secondary_start_kernel-notrace.patch create mode 100644 queue-3.18/bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch create mode 100644 queue-3.18/brcmfmac-stop-watchdog-before-detach-and-free-everything.patch create mode 100644 queue-3.18/cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch create mode 100644 queue-3.18/dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch create mode 100644 queue-3.18/drm-armada-fix-colorkey-mode-property.patch create mode 100644 queue-3.18/drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch create mode 100644 queue-3.18/enic-initialize-enic-rfs_h.lock-in-enic_probe.patch create mode 100644 queue-3.18/ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch create mode 100644 queue-3.18/ixgbe-be-more-careful-when-modifying-mac-filters.patch create mode 100644 queue-3.18/locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch create mode 100644 queue-3.18/m68k-fix-bad-page-state-oops-on-coldfire-boot.patch create mode 100644 queue-3.18/md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch create mode 100644 queue-3.18/net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch create mode 100644 queue-3.18/net-hamradio-use-eth_broadcast_addr.patch create mode 100644 queue-3.18/net-propagate-dev_get_valid_name-return-code.patch create mode 100644 queue-3.18/net-qca_spi-avoid-packet-drop-during-initial-sync.patch create mode 100644 queue-3.18/net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch create mode 100644 queue-3.18/net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch create mode 100644 queue-3.18/netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch create mode 100644 queue-3.18/netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch create mode 100644 queue-3.18/octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch create mode 100644 queue-3.18/perf-report-powerpc-fix-crash-if-callchain-is-empty.patch create mode 100644 queue-3.18/qlogic-check-kstrtoul-for-errors.patch create mode 100644 queue-3.18/selftests-sync-add-config-fragment-for-testing-sync-framework.patch create mode 100644 queue-3.18/smack-mark-inode-instant-in-smack_task_to_inode.patch create mode 100644 queue-3.18/smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch create mode 100644 queue-3.18/tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch create mode 100644 queue-3.18/tracing-use-__printf-markup-to-silence-compiler.patch create mode 100644 queue-3.18/usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch create mode 100644 queue-3.18/usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch diff --git a/queue-3.18/arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch b/queue-3.18/arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch new file mode 100644 index 00000000000..42fcf1c7dd0 --- /dev/null +++ b/queue-3.18/arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Adam Ford +Date: Wed, 11 Jul 2018 12:54:54 -0500 +Subject: ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller + +From: Adam Ford + +[ Upstream commit 923847413f7316b5ced3491769b3fefa6c56a79a ] + +The AM3517 has a different OTG controller location than the OMAP3, +which is included from omap3.dtsi. This results in a hwmod error. +Since the AM3517 has a different OTG controller address, this patch +disabes one that is isn't available. + +Signed-off-by: Adam Ford +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/am3517.dtsi | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/arm/boot/dts/am3517.dtsi ++++ b/arch/arm/boot/dts/am3517.dtsi +@@ -62,6 +62,11 @@ + }; + }; + ++/* Table Table 5-79 of the TRM shows 480ab000 is reserved */ ++&usb_otg_hs { ++ status = "disabled"; ++}; ++ + &iva { + status = "disabled"; + }; diff --git a/queue-3.18/arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch b/queue-3.18/arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch new file mode 100644 index 00000000000..96977635e0d --- /dev/null +++ b/queue-3.18/arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch @@ -0,0 +1,31 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Daniel Mack +Date: Sun, 17 Jun 2018 13:53:09 +0200 +Subject: ARM: dts: am437x: make edt-ft5x06 a wakeup source + +From: Daniel Mack + +[ Upstream commit 49a6ec5b807ea4ad7ebe1f58080ebb8497cb2d2c ] + +The touchscreen driver no longer configures the device as wakeup source by +default. A "wakeup-source" property is needed. + +Signed-off-by: Daniel Mack +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/am437x-sk-evm.dts | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm/boot/dts/am437x-sk-evm.dts ++++ b/arch/arm/boot/dts/am437x-sk-evm.dts +@@ -415,6 +415,8 @@ + + touchscreen-size-x = <480>; + touchscreen-size-y = <272>; ++ ++ wakeup-source; + }; + + tlv320aic3106: tlv320aic3106@1b { diff --git a/queue-3.18/arm-dts-da850-fix-interrups-property-for-gpio.patch b/queue-3.18/arm-dts-da850-fix-interrups-property-for-gpio.patch new file mode 100644 index 00000000000..be8ef006070 --- /dev/null +++ b/queue-3.18/arm-dts-da850-fix-interrups-property-for-gpio.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Keerthy +Date: Tue, 5 Jun 2018 15:37:51 +0530 +Subject: ARM: dts: da850: Fix interrups property for gpio + +From: Keerthy + +[ Upstream commit 3eb1b955cd7ed1e621ace856710006c2a8a7f231 ] + +The intc #interrupt-cells is equal to 1. Currently gpio +node has 2 cells per IRQ which is wrong. Remove the additional +cell for each of the interrupts. + +Signed-off-by: Keerthy +Fixes: 2e38b946dc54 ("ARM: davinci: da850: add GPIO DT node") +Signed-off-by: Sekhar Nori +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/da850.dtsi | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/arch/arm/boot/dts/da850.dtsi ++++ b/arch/arm/boot/dts/da850.dtsi +@@ -267,11 +267,7 @@ + compatible = "ti,dm6441-gpio"; + gpio-controller; + reg = <0x226000 0x1000>; +- interrupts = <42 IRQ_TYPE_EDGE_BOTH +- 43 IRQ_TYPE_EDGE_BOTH 44 IRQ_TYPE_EDGE_BOTH +- 45 IRQ_TYPE_EDGE_BOTH 46 IRQ_TYPE_EDGE_BOTH +- 47 IRQ_TYPE_EDGE_BOTH 48 IRQ_TYPE_EDGE_BOTH +- 49 IRQ_TYPE_EDGE_BOTH 50 IRQ_TYPE_EDGE_BOTH>; ++ interrupts = <42 43 44 45 46 47 48 49 50>; + ti,ngpio = <144>; + ti,davinci-gpio-unbanked = <0>; + status = "disabled"; diff --git a/queue-3.18/arm-imx_v4_v5_defconfig-select-ulpi-support.patch b/queue-3.18/arm-imx_v4_v5_defconfig-select-ulpi-support.patch new file mode 100644 index 00000000000..2e060d3fb30 --- /dev/null +++ b/queue-3.18/arm-imx_v4_v5_defconfig-select-ulpi-support.patch @@ -0,0 +1,35 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Fabio Estevam +Date: Tue, 26 Jun 2018 08:37:09 -0300 +Subject: ARM: imx_v4_v5_defconfig: Select ULPI support + +From: Fabio Estevam + +[ Upstream commit 2ceb2780b790b74bc408a949f6aedbad8afa693e ] + +Select CONFIG_USB_CHIPIDEA_ULPI and CONFIG_USB_ULPI_BUS so that +USB ULPI can be functional on some boards like that use ULPI +interface. + +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/configs/imx_v4_v5_defconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm/configs/imx_v4_v5_defconfig ++++ b/arch/arm/configs/imx_v4_v5_defconfig +@@ -146,9 +146,11 @@ CONFIG_USB_STORAGE=y + CONFIG_USB_CHIPIDEA=y + CONFIG_USB_CHIPIDEA_UDC=y + CONFIG_USB_CHIPIDEA_HOST=y ++CONFIG_USB_CHIPIDEA_ULPI=y + CONFIG_NOP_USB_XCEIV=y + CONFIG_USB_GADGET=y + CONFIG_USB_ETH=m ++CONFIG_USB_ULPI_BUS=y + CONFIG_MMC=y + CONFIG_MMC_SDHCI=y + CONFIG_MMC_SDHCI_PLTFM=y diff --git a/queue-3.18/arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch b/queue-3.18/arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch new file mode 100644 index 00000000000..48b96f61570 --- /dev/null +++ b/queue-3.18/arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Daniel Mack +Date: Fri, 6 Jul 2018 22:15:00 +0200 +Subject: ARM: pxa: irq: fix handling of ICMR registers in suspend/resume + +From: Daniel Mack + +[ Upstream commit 0c1049dcb4ceec640d8bd797335bcbebdcab44d2 ] + +PXA3xx platforms have 56 interrupts that are stored in two ICMR +registers. The code in pxa_irq_suspend() and pxa_irq_resume() however +does a simple division by 32 which only leads to one register being +saved at suspend and restored at resume time. The NAND interrupt +setting, for instance, is lost. + +Fix this by using DIV_ROUND_UP() instead. + +Signed-off-by: Daniel Mack +Signed-off-by: Robert Jarzmik +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-pxa/irq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/mach-pxa/irq.c ++++ b/arch/arm/mach-pxa/irq.c +@@ -160,7 +160,7 @@ static int pxa_irq_suspend(void) + { + int i; + +- for (i = 0; i < pxa_internal_irq_nr / 32; i++) { ++ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) { + void __iomem *base = irq_base(i); + + saved_icmr[i] = __raw_readl(base + ICMR); +@@ -179,7 +179,7 @@ static void pxa_irq_resume(void) + { + int i; + +- for (i = 0; i < pxa_internal_irq_nr / 32; i++) { ++ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) { + void __iomem *base = irq_base(i); + + __raw_writel(saved_icmr[i], base + ICMR); diff --git a/queue-3.18/arm64-make-secondary_start_kernel-notrace.patch b/queue-3.18/arm64-make-secondary_start_kernel-notrace.patch new file mode 100644 index 00000000000..f25217742cf --- /dev/null +++ b/queue-3.18/arm64-make-secondary_start_kernel-notrace.patch @@ -0,0 +1,40 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Zhizhou Zhang +Date: Tue, 12 Jun 2018 17:07:37 +0800 +Subject: arm64: make secondary_start_kernel() notrace + +From: Zhizhou Zhang + +[ Upstream commit b154886f7892499d0d3054026e19dfb9a731df61 ] + +We can't call function trace hook before setup percpu offset. +When entering secondary_start_kernel(), percpu offset has not +been initialized. So this lead hotplug malfunction. +Here is the flow to reproduce this bug: + +echo 0 > /sys/devices/system/cpu/cpu1/online +echo function > /sys/kernel/debug/tracing/current_tracer +echo 1 > /sys/kernel/debug/tracing/tracing_on +echo 1 > /sys/devices/system/cpu/cpu1/online + +Acked-by: Mark Rutland +Tested-by: Suzuki K Poulose +Signed-off-by: Zhizhou Zhang +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/smp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -130,7 +130,7 @@ static void smp_store_cpu_info(unsigned + * This is the secondary CPU boot entry. We're using this CPUs + * idle thread stack, but a set of temporary page tables. + */ +-asmlinkage void secondary_start_kernel(void) ++asmlinkage notrace void secondary_start_kernel(void) + { + struct mm_struct *mm = &init_mm; + unsigned int cpu = smp_processor_id(); diff --git a/queue-3.18/bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch b/queue-3.18/bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch new file mode 100644 index 00000000000..f1bf4fed8ff --- /dev/null +++ b/queue-3.18/bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch @@ -0,0 +1,77 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Sudarsana Reddy Kalluru +Date: Thu, 28 Jun 2018 04:52:15 -0700 +Subject: bnx2x: Fix receiving tx-timeout in error or recovery state. + +From: Sudarsana Reddy Kalluru + +[ Upstream commit 484c016d9392786ce5c74017c206c706f29f823d ] + +Driver performs the internal reload when it receives tx-timeout event from +the OS. Internal reload might fail in some scenarios e.g., fatal HW issues. +In such cases OS still see the link, which would result in undesirable +functionalities such as re-generation of tx-timeouts. +The patch addresses this issue by indicating the link-down to OS when +tx-timeout is detected, and keeping the link in down state till the +internal reload is successful. + +Please consider applying it to 'net' branch. + +Signed-off-by: Sudarsana Reddy Kalluru +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 + + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 6 ++++++ + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 6 ++++++ + 3 files changed, 13 insertions(+) + +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +@@ -1613,6 +1613,7 @@ struct bnx2x { + struct link_vars link_vars; + u32 link_cnt; + struct bnx2x_link_report_data last_reported_link; ++ bool force_link_down; + + struct mdio_if_info mdio; + +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -1257,6 +1257,11 @@ void __bnx2x_link_report(struct bnx2x *b + { + struct bnx2x_link_report_data cur_data; + ++ if (bp->force_link_down) { ++ bp->link_vars.link_up = 0; ++ return; ++ } ++ + /* reread mf_cfg */ + if (IS_PF(bp) && !CHIP_IS_E1(bp)) + bnx2x_read_mf_cfg(bp); +@@ -2799,6 +2804,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int + bp->pending_max = 0; + } + ++ bp->force_link_down = false; + if (bp->port.pmf) { + rc = bnx2x_initial_phy_init(bp, load_mode); + if (rc) +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -10036,6 +10036,12 @@ static void bnx2x_sp_rtnl_task(struct wo + bp->sp_rtnl_state = 0; + smp_mb(); + ++ /* Immediately indicate link as down */ ++ bp->link_vars.link_up = 0; ++ bp->force_link_down = true; ++ netif_carrier_off(bp->dev); ++ BNX2X_ERR("Indicating link is down due to Tx-timeout\n"); ++ + bnx2x_nic_unload(bp, UNLOAD_NORMAL, true); + bnx2x_nic_load(bp, LOAD_NORMAL); + diff --git a/queue-3.18/brcmfmac-stop-watchdog-before-detach-and-free-everything.patch b/queue-3.18/brcmfmac-stop-watchdog-before-detach-and-free-everything.patch new file mode 100644 index 00000000000..666412e1a07 --- /dev/null +++ b/queue-3.18/brcmfmac-stop-watchdog-before-detach-and-free-everything.patch @@ -0,0 +1,76 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Michael Trimarchi +Date: Wed, 30 May 2018 11:06:34 +0200 +Subject: brcmfmac: stop watchdog before detach and free everything + +From: Michael Trimarchi + +[ Upstream commit 373c83a801f15b1e3d02d855fad89112bd4ccbe0 ] + +Using built-in in kernel image without a firmware in filesystem +or in the kernel image can lead to a kernel NULL pointer deference. +Watchdog need to be stopped in brcmf_sdio_remove + +The system is going down NOW! +[ 1348.110759] Unable to handle kernel NULL pointer dereference at virtual address 000002f8 +Sent SIGTERM to all processes +[ 1348.121412] Mem abort info: +[ 1348.126962] ESR = 0x96000004 +[ 1348.130023] Exception class = DABT (current EL), IL = 32 bits +[ 1348.135948] SET = 0, FnV = 0 +[ 1348.138997] EA = 0, S1PTW = 0 +[ 1348.142154] Data abort info: +[ 1348.145045] ISV = 0, ISS = 0x00000004 +[ 1348.148884] CM = 0, WnR = 0 +[ 1348.151861] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____) +[ 1348.158475] [00000000000002f8] pgd=0000000000000000 +[ 1348.163364] Internal error: Oops: 96000004 [#1] PREEMPT SMP +[ 1348.168927] Modules linked in: ipv6 +[ 1348.172421] CPU: 3 PID: 1421 Comm: brcmf_wdog/mmc0 Not tainted 4.17.0-rc5-next-20180517 #18 +[ 1348.180757] Hardware name: Amarula A64-Relic (DT) +[ 1348.185455] pstate: 60000005 (nZCv daif -PAN -UAO) +[ 1348.190251] pc : brcmf_sdiod_freezer_count+0x0/0x20 +[ 1348.195124] lr : brcmf_sdio_watchdog_thread+0x64/0x290 +[ 1348.200253] sp : ffff00000b85be30 +[ 1348.203561] x29: ffff00000b85be30 x28: 0000000000000000 +[ 1348.208868] x27: ffff00000b6cb918 x26: ffff80003b990638 +[ 1348.214176] x25: ffff0000087b1a20 x24: ffff80003b94f800 +[ 1348.219483] x23: ffff000008e620c8 x22: ffff000008f0b660 +[ 1348.224790] x21: ffff000008c6a858 x20: 00000000fffffe00 +[ 1348.230097] x19: ffff80003b94f800 x18: 0000000000000001 +[ 1348.235404] x17: 0000ffffab2e8a74 x16: ffff0000080d7de8 +[ 1348.240711] x15: 0000000000000000 x14: 0000000000000400 +[ 1348.246018] x13: 0000000000000400 x12: 0000000000000001 +[ 1348.251324] x11: 00000000000002c4 x10: 0000000000000a10 +[ 1348.256631] x9 : ffff00000b85bc40 x8 : ffff80003be11870 +[ 1348.261937] x7 : ffff80003dfc7308 x6 : 000000078ff08b55 +[ 1348.267243] x5 : 00000139e1058400 x4 : 0000000000000000 +[ 1348.272550] x3 : dead000000000100 x2 : 958f2788d6618100 +[ 1348.277856] x1 : 00000000fffffe00 x0 : 0000000000000000 + +Signed-off-by: Michael Trimarchi +Acked-by: Arend van Spriel +Tested-by: Andy Shevchenko +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c +@@ -4201,6 +4201,13 @@ void brcmf_sdio_remove(struct brcmf_sdio + brcmf_dbg(TRACE, "Enter\n"); + + if (bus) { ++ /* Stop watchdog task */ ++ if (bus->watchdog_tsk) { ++ send_sig(SIGTERM, bus->watchdog_tsk, 1); ++ kthread_stop(bus->watchdog_tsk); ++ bus->watchdog_tsk = NULL; ++ } ++ + /* De-register interrupt handler */ + brcmf_sdiod_intr_unregister(bus->sdiodev); + diff --git a/queue-3.18/cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch b/queue-3.18/cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch new file mode 100644 index 00000000000..9ff01b9ebab --- /dev/null +++ b/queue-3.18/cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Ganesh Goudar +Date: Sat, 23 Jun 2018 20:28:26 +0530 +Subject: cxgb4: when disabling dcb set txq dcb priority to 0 + +From: Ganesh Goudar + +[ Upstream commit 5ce36338a30f9814fc4824f9fe6c20cd83d872c7 ] + +When we are disabling DCB, store "0" in txq->dcb_prio +since that's used for future TX Work Request "OVLAN_IDX" +values. Setting non zero priority upon disabling DCB +would halt the traffic. + +Reported-by: AMG Zollner Robert +CC: David Ahern +Signed-off-by: Casey Leedom +Signed-off-by: Ganesh Goudar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +@@ -529,7 +529,7 @@ static void dcb_tx_queue_prio_enable(str + "Can't %s DCB Priority on port %d, TX Queue %d: err=%d\n", + enable ? "set" : "unset", pi->port_id, i, -err); + else +- txq->dcb_prio = value; ++ txq->dcb_prio = enable ? value : 0; + } + } + #endif /* CONFIG_CHELSIO_T4_DCB */ diff --git a/queue-3.18/dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch b/queue-3.18/dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch new file mode 100644 index 00000000000..2a4037826d1 --- /dev/null +++ b/queue-3.18/dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Dan Carpenter +Date: Fri, 22 Jun 2018 14:15:47 +0300 +Subject: dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate() + +From: Dan Carpenter + +[ Upstream commit c4c2b7644cc9a41f17a8cc8904efe3f66ae4c7ed ] + +The d->chans[] array has d->dma_requests elements so the > should be +>= here. + +Fixes: 8e6152bc660e ("dmaengine: Add hisilicon k3 DMA engine driver") +Signed-off-by: Dan Carpenter +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/k3dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/k3dma.c ++++ b/drivers/dma/k3dma.c +@@ -652,7 +652,7 @@ static struct dma_chan *k3_of_dma_simple + struct k3_dma_dev *d = ofdma->of_dma_data; + unsigned int request = dma_spec->args[0]; + +- if (request > d->dma_requests) ++ if (request >= d->dma_requests) + return NULL; + + return dma_get_slave_channel(&(d->chans[request].vc.chan)); diff --git a/queue-3.18/drm-armada-fix-colorkey-mode-property.patch b/queue-3.18/drm-armada-fix-colorkey-mode-property.patch new file mode 100644 index 00000000000..b02b51f949c --- /dev/null +++ b/queue-3.18/drm-armada-fix-colorkey-mode-property.patch @@ -0,0 +1,91 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Russell King +Date: Sun, 24 Jun 2018 14:35:10 +0100 +Subject: drm/armada: fix colorkey mode property + +From: Russell King + +[ Upstream commit d378859a667edc99e3473704847698cae97ca2b1 ] + +The colorkey mode property was not correctly disabling the colorkeying +when "disabled" mode was selected. Arrange for this to work as one +would expect. + +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/armada/armada_hw.h | 1 + + drivers/gpu/drm/armada/armada_overlay.c | 30 ++++++++++++++++++++++-------- + 2 files changed, 23 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/armada/armada_hw.h ++++ b/drivers/gpu/drm/armada/armada_hw.h +@@ -160,6 +160,7 @@ enum { + CFG_ALPHAM_GRA = 0x1 << 16, + CFG_ALPHAM_CFG = 0x2 << 16, + CFG_ALPHA_MASK = 0xff << 8, ++#define CFG_ALPHA(x) ((x) << 8) + CFG_PIXCMD_MASK = 0xff, + }; + +--- a/drivers/gpu/drm/armada/armada_overlay.c ++++ b/drivers/gpu/drm/armada/armada_overlay.c +@@ -26,6 +26,7 @@ struct armada_plane_properties { + uint16_t contrast; + uint16_t saturation; + uint32_t colorkey_mode; ++ uint32_t colorkey_enable; + }; + + struct armada_plane { +@@ -62,11 +63,13 @@ armada_ovl_update_attr(struct armada_pla + writel_relaxed(0x00002000, dcrtc->base + LCD_SPU_CBSH_HUE); + + spin_lock_irq(&dcrtc->irq_lock); +- armada_updatel(prop->colorkey_mode | CFG_ALPHAM_GRA, +- CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK, +- dcrtc->base + LCD_SPU_DMA_CTRL1); +- +- armada_updatel(ADV_GRACOLORKEY, 0, dcrtc->base + LCD_SPU_ADV_REG); ++ armada_updatel(prop->colorkey_mode, ++ CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK, ++ dcrtc->base + LCD_SPU_DMA_CTRL1); ++ if (dcrtc->variant->has_spu_adv_reg) ++ armada_updatel(prop->colorkey_enable, ++ ADV_GRACOLORKEY | ADV_VIDCOLORKEY, ++ dcrtc->base + LCD_SPU_ADV_REG); + spin_unlock_irq(&dcrtc->irq_lock); + } + +@@ -329,8 +332,17 @@ static int armada_plane_set_property(str + dplane->prop.colorkey_vb |= K2B(val); + update_attr = true; + } else if (property == priv->colorkey_mode_prop) { +- dplane->prop.colorkey_mode &= ~CFG_CKMODE_MASK; +- dplane->prop.colorkey_mode |= CFG_CKMODE(val); ++ if (val == CKMODE_DISABLE) { ++ dplane->prop.colorkey_mode = ++ CFG_CKMODE(CKMODE_DISABLE) | ++ CFG_ALPHAM_CFG | CFG_ALPHA(255); ++ dplane->prop.colorkey_enable = 0; ++ } else { ++ dplane->prop.colorkey_mode = ++ CFG_CKMODE(val) | ++ CFG_ALPHAM_GRA | CFG_ALPHA(0); ++ dplane->prop.colorkey_enable = ADV_GRACOLORKEY; ++ } + update_attr = true; + } else if (property == priv->brightness_prop) { + dplane->prop.brightness = val - 256; +@@ -449,7 +461,9 @@ int armada_overlay_plane_create(struct d + dplane->prop.colorkey_yr = 0xfefefe00; + dplane->prop.colorkey_ug = 0x01010100; + dplane->prop.colorkey_vb = 0x01010100; +- dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB); ++ dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB) | ++ CFG_ALPHAM_GRA | CFG_ALPHA(0); ++ dplane->prop.colorkey_enable = ADV_GRACOLORKEY; + dplane->prop.brightness = 0; + dplane->prop.contrast = 0x4000; + dplane->prop.saturation = 0x4000; diff --git a/queue-3.18/drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch b/queue-3.18/drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch new file mode 100644 index 00000000000..69c16f69e76 --- /dev/null +++ b/queue-3.18/drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch @@ -0,0 +1,96 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Marek Szyprowski +Date: Thu, 7 Jun 2018 13:06:13 +0200 +Subject: drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes + +From: Marek Szyprowski + +[ Upstream commit dd209ef809080ced903e7747ee3ef640c923a1d2 ] + +Fix following issues related to planar YUV pixel format configuration: +- NV16/61 modes were incorrectly programmed as NV12/21, +- YVU420 was programmed as YUV420 on source, +- YVU420 and YUV422 were programmed as YUV420 on output. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/exynos/exynos_drm_gsc.c | 29 ++++++++++++++++++++--------- + drivers/gpu/drm/exynos/regs-gsc.h | 1 + + 2 files changed, 21 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c +@@ -526,21 +526,25 @@ static int gsc_src_set_fmt(struct device + GSC_IN_CHROMA_ORDER_CRCB); + break; + case DRM_FORMAT_NV21: ++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_2P); ++ break; + case DRM_FORMAT_NV61: +- cfg |= (GSC_IN_CHROMA_ORDER_CRCB | +- GSC_IN_YUV420_2P); ++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV422_2P); + break; + case DRM_FORMAT_YUV422: + cfg |= GSC_IN_YUV422_3P; + break; + case DRM_FORMAT_YUV420: ++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_3P); ++ break; + case DRM_FORMAT_YVU420: +- cfg |= GSC_IN_YUV420_3P; ++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_3P); + break; + case DRM_FORMAT_NV12: ++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_2P); ++ break; + case DRM_FORMAT_NV16: +- cfg |= (GSC_IN_CHROMA_ORDER_CBCR | +- GSC_IN_YUV420_2P); ++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV422_2P); + break; + case DRM_FORMAT_NV12MT: + cfg |= (GSC_IN_TILE_C_16x8 | GSC_IN_TILE_MODE); +@@ -796,18 +800,25 @@ static int gsc_dst_set_fmt(struct device + GSC_OUT_CHROMA_ORDER_CRCB); + break; + case DRM_FORMAT_NV21: +- case DRM_FORMAT_NV61: + cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_2P); + break; ++ case DRM_FORMAT_NV61: ++ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV422_2P); ++ break; + case DRM_FORMAT_YUV422: ++ cfg |= GSC_OUT_YUV422_3P; ++ break; + case DRM_FORMAT_YUV420: ++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_3P); ++ break; + case DRM_FORMAT_YVU420: +- cfg |= GSC_OUT_YUV420_3P; ++ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_3P); + break; + case DRM_FORMAT_NV12: ++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_2P); ++ break; + case DRM_FORMAT_NV16: +- cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | +- GSC_OUT_YUV420_2P); ++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV422_2P); + break; + case DRM_FORMAT_NV12MT: + cfg |= (GSC_OUT_TILE_C_16x8 | GSC_OUT_TILE_MODE); +--- a/drivers/gpu/drm/exynos/regs-gsc.h ++++ b/drivers/gpu/drm/exynos/regs-gsc.h +@@ -138,6 +138,7 @@ + #define GSC_OUT_YUV420_3P (3 << 4) + #define GSC_OUT_YUV422_1P (4 << 4) + #define GSC_OUT_YUV422_2P (5 << 4) ++#define GSC_OUT_YUV422_3P (6 << 4) + #define GSC_OUT_YUV444 (7 << 4) + #define GSC_OUT_TILE_TYPE_MASK (1 << 2) + #define GSC_OUT_TILE_C_16x8 (0 << 2) diff --git a/queue-3.18/enic-initialize-enic-rfs_h.lock-in-enic_probe.patch b/queue-3.18/enic-initialize-enic-rfs_h.lock-in-enic_probe.patch new file mode 100644 index 00000000000..cf2f30f0d5a --- /dev/null +++ b/queue-3.18/enic-initialize-enic-rfs_h.lock-in-enic_probe.patch @@ -0,0 +1,98 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Govindarajulu Varadarajan +Date: Tue, 19 Jun 2018 08:15:24 -0700 +Subject: enic: initialize enic->rfs_h.lock in enic_probe + +From: Govindarajulu Varadarajan + +[ Upstream commit 3256d29fc7aecdf99feb1cb9475ed2252769a8a7 ] + +lockdep spotted that we are using rfs_h.lock in enic_get_rxnfc() without +initializing. rfs_h.lock is initialized in enic_open(). But ethtool_ops +can be called when interface is down. + +Move enic_rfs_flw_tbl_init to enic_probe. + +INFO: trying to register non-static key. +the code is fine but needs lockdep annotation. +turning off the locking correctness validator. +CPU: 18 PID: 1189 Comm: ethtool Not tainted 4.17.0-rc7-devel+ #27 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014 +Call Trace: +dump_stack+0x85/0xc0 +register_lock_class+0x550/0x560 +? __handle_mm_fault+0xa8b/0x1100 +__lock_acquire+0x81/0x670 +lock_acquire+0xb9/0x1e0 +? enic_get_rxnfc+0x139/0x2b0 [enic] +_raw_spin_lock_bh+0x38/0x80 +? enic_get_rxnfc+0x139/0x2b0 [enic] +enic_get_rxnfc+0x139/0x2b0 [enic] +ethtool_get_rxnfc+0x8d/0x1c0 +dev_ethtool+0x16c8/0x2400 +? __mutex_lock+0x64d/0xa00 +? dev_load+0x6a/0x150 +dev_ioctl+0x253/0x4b0 +sock_do_ioctl+0x9a/0x130 +sock_ioctl+0x1af/0x350 +do_vfs_ioctl+0x8e/0x670 +? syscall_trace_enter+0x1e2/0x380 +ksys_ioctl+0x60/0x90 +__x64_sys_ioctl+0x16/0x20 +do_syscall_64+0x5a/0x170 +entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Signed-off-by: Govindarajulu Varadarajan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cisco/enic/enic_clsf.c | 3 +-- + drivers/net/ethernet/cisco/enic/enic_main.c | 3 ++- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c ++++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c +@@ -78,7 +78,6 @@ void enic_rfs_flw_tbl_init(struct enic * + enic->rfs_h.max = enic->config.num_arfs; + enic->rfs_h.free = enic->rfs_h.max; + enic->rfs_h.toclean = 0; +- enic_rfs_timer_start(enic); + } + + void enic_rfs_flw_tbl_free(struct enic *enic) +@@ -87,7 +86,6 @@ void enic_rfs_flw_tbl_free(struct enic * + + enic_rfs_timer_stop(enic); + spin_lock_bh(&enic->rfs_h.lock); +- enic->rfs_h.free = 0; + for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) { + struct hlist_head *hhead; + struct hlist_node *tmp; +@@ -98,6 +96,7 @@ void enic_rfs_flw_tbl_free(struct enic * + enic_delfltr(enic, n->fltr_id); + hlist_del(&n->node); + kfree(n); ++ enic->rfs_h.free++; + } + } + spin_unlock_bh(&enic->rfs_h.lock); +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -1643,7 +1643,7 @@ static int enic_open(struct net_device * + vnic_intr_unmask(&enic->intr[i]); + + enic_notify_timer_start(enic); +- enic_rfs_flw_tbl_init(enic); ++ enic_rfs_timer_start(enic); + + return 0; + +@@ -2508,6 +2508,7 @@ static int enic_probe(struct pci_dev *pd + enic->notify_timer.function = enic_notify_timer; + enic->notify_timer.data = (unsigned long)enic; + ++ enic_rfs_flw_tbl_init(enic); + enic_set_rx_coal_setting(enic); + INIT_WORK(&enic->reset, enic_reset); + INIT_WORK(&enic->change_mtu_work, enic_change_mtu_work); diff --git a/queue-3.18/ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch b/queue-3.18/ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch new file mode 100644 index 00000000000..f4369d5b32d --- /dev/null +++ b/queue-3.18/ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch @@ -0,0 +1,58 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Hangbin Liu +Date: Thu, 21 Jun 2018 19:49:36 +0800 +Subject: ipv6: mcast: fix unsolicited report interval after receiving querys + +From: Hangbin Liu + +[ Upstream commit 6c6da92808442908287fae8ebb0ca041a52469f4 ] + +After recieving MLD querys, we update idev->mc_maxdelay with max_delay +from query header. This make the later unsolicited reports have the same +interval with mc_maxdelay, which means we may send unsolicited reports with +long interval time instead of default configured interval time. + +Also as we will not call ipv6_mc_reset() after device up. This issue will +be there even after leave the group and join other groups. + +Fixes: fc4eba58b4c14 ("ipv6: make unsolicited report intervals configurable for mld") +Signed-off-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/mcast.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -2062,7 +2062,8 @@ void ipv6_mc_dad_complete(struct inet6_d + mld_send_initial_cr(idev); + idev->mc_dad_count--; + if (idev->mc_dad_count) +- mld_dad_start_timer(idev, idev->mc_maxdelay); ++ mld_dad_start_timer(idev, ++ unsolicited_report_interval(idev)); + } + } + +@@ -2074,7 +2075,8 @@ static void mld_dad_timer_expire(unsigne + if (idev->mc_dad_count) { + idev->mc_dad_count--; + if (idev->mc_dad_count) +- mld_dad_start_timer(idev, idev->mc_maxdelay); ++ mld_dad_start_timer(idev, ++ unsolicited_report_interval(idev)); + } + in6_dev_put(idev); + } +@@ -2432,7 +2434,8 @@ static void mld_ifc_timer_expire(unsigne + if (idev->mc_ifc_count) { + idev->mc_ifc_count--; + if (idev->mc_ifc_count) +- mld_ifc_start_timer(idev, idev->mc_maxdelay); ++ mld_ifc_start_timer(idev, ++ unsolicited_report_interval(idev)); + } + in6_dev_put(idev); + } diff --git a/queue-3.18/ixgbe-be-more-careful-when-modifying-mac-filters.patch b/queue-3.18/ixgbe-be-more-careful-when-modifying-mac-filters.patch new file mode 100644 index 00000000000..d3500c47860 --- /dev/null +++ b/queue-3.18/ixgbe-be-more-careful-when-modifying-mac-filters.patch @@ -0,0 +1,56 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Alexander Duyck +Date: Mon, 18 Jun 2018 12:02:00 -0400 +Subject: ixgbe: Be more careful when modifying MAC filters + +From: Alexander Duyck + +[ Upstream commit d14c780c11fbc10f66c43e7b64eefe87ca442bd3 ] + +This change makes it so that we are much more explicit about the ordering +of updates to the receive address register (RAR) table. Prior to this patch +I believe we may have been updating the table while entries were still +active, or possibly allowing for reordering of things since we weren't +explicitly flushing writes to either the lower or upper portion of the +register prior to accessing the other half. + +Signed-off-by: Alexander Duyck +Reviewed-by: Shannon Nelson +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_common.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c +@@ -1781,7 +1781,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_h + if (enable_addr != 0) + rar_high |= IXGBE_RAH_AV; + ++ /* Record lower 32 bits of MAC address and then make ++ * sure that write is flushed to hardware before writing ++ * the upper 16 bits and setting the valid bit. ++ */ + IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low); ++ IXGBE_WRITE_FLUSH(hw); + IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high); + + return 0; +@@ -1813,8 +1818,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe + rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index)); + rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV); + +- IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0); ++ /* Clear the address valid bit and upper 16 bits of the address ++ * before clearing the lower bits. This way we aren't updating ++ * a live filter. ++ */ + IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high); ++ IXGBE_WRITE_FLUSH(hw); ++ IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0); + + /* clear VMDq pool/queue selection for this RAR */ + hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL); diff --git a/queue-3.18/locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch b/queue-3.18/locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch new file mode 100644 index 00000000000..4deba05d5fe --- /dev/null +++ b/queue-3.18/locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch @@ -0,0 +1,82 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: "Steven Rostedt (VMware)" +Date: Wed, 4 Apr 2018 14:06:30 -0400 +Subject: locking/lockdep: Do not record IRQ state within lockdep code + +From: "Steven Rostedt (VMware)" + +[ Upstream commit fcc784be837714a9173b372ff9fb9b514590dad9 ] + +While debugging where things were going wrong with mapping +enabling/disabling interrupts with the lockdep state and actual real +enabling and disabling interrupts, I had to silent the IRQ +disabling/enabling in debug_check_no_locks_freed() because it was +always showing up as it was called before the splat was. + +Use raw_local_irq_save/restore() for not only debug_check_no_locks_freed() +but for all internal lockdep functions, as they hide useful information +about where interrupts were used incorrectly last. + +Signed-off-by: Steven Rostedt (VMware) +Cc: Andrew Morton +Cc: Linus Torvalds +Cc: Paul E. McKenney +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Will Deacon +Link: https://lkml.kernel.org/lkml/20180404140630.3f4f4c7a@gandalf.local.home +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/locking/lockdep.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -1253,11 +1253,11 @@ unsigned long lockdep_count_forward_deps + this.parent = NULL; + this.class = class; + +- local_irq_save(flags); ++ raw_local_irq_save(flags); + arch_spin_lock(&lockdep_lock); + ret = __lockdep_count_forward_deps(&this); + arch_spin_unlock(&lockdep_lock); +- local_irq_restore(flags); ++ raw_local_irq_restore(flags); + + return ret; + } +@@ -1280,11 +1280,11 @@ unsigned long lockdep_count_backward_dep + this.parent = NULL; + this.class = class; + +- local_irq_save(flags); ++ raw_local_irq_save(flags); + arch_spin_lock(&lockdep_lock); + ret = __lockdep_count_backward_deps(&this); + arch_spin_unlock(&lockdep_lock); +- local_irq_restore(flags); ++ raw_local_irq_restore(flags); + + return ret; + } +@@ -4083,7 +4083,7 @@ void debug_check_no_locks_freed(const vo + if (unlikely(!debug_locks)) + return; + +- local_irq_save(flags); ++ raw_local_irq_save(flags); + for (i = 0; i < curr->lockdep_depth; i++) { + hlock = curr->held_locks + i; + +@@ -4094,7 +4094,7 @@ void debug_check_no_locks_freed(const vo + print_freed_lock_bug(curr, mem_from, mem_from + mem_len, hlock); + break; + } +- local_irq_restore(flags); ++ raw_local_irq_restore(flags); + } + EXPORT_SYMBOL_GPL(debug_check_no_locks_freed); + diff --git a/queue-3.18/m68k-fix-bad-page-state-oops-on-coldfire-boot.patch b/queue-3.18/m68k-fix-bad-page-state-oops-on-coldfire-boot.patch new file mode 100644 index 00000000000..e96e30b9808 --- /dev/null +++ b/queue-3.18/m68k-fix-bad-page-state-oops-on-coldfire-boot.patch @@ -0,0 +1,64 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Greg Ungerer +Date: Mon, 18 Jun 2018 15:34:14 +1000 +Subject: m68k: fix "bad page state" oops on ColdFire boot + +From: Greg Ungerer + +[ Upstream commit ecd60532e060e45c63c57ecf1c8549b1d656d34d ] + +Booting a ColdFire m68k core with MMU enabled causes a "bad page state" +oops since commit 1d40a5ea01d5 ("mm: mark pages in use for page tables"): + + BUG: Bad page state in process sh pfn:01ce2 + page:004fefc8 count:0 mapcount:-1024 mapping:00000000 index:0x0 + flags: 0x0() + raw: 00000000 00000000 00000000 fffffbff 00000000 00000100 00000200 00000000 + raw: 039c4000 + page dumped because: nonzero mapcount + Modules linked in: + CPU: 0 PID: 22 Comm: sh Not tainted 4.17.0-07461-g1d40a5ea01d5 #13 + +Fix by calling pgtable_page_dtor() in our __pte_free_tlb() code path, +so that the PG_table flag is cleared before we free the pte page. + +Note that I had to change the type of pte_free() to be static from +extern. Otherwise you get a lot of warnings like this: + +./arch/m68k/include/asm/mcf_pgalloc.h:80:2: warning: ‘pgtable_page_dtor’ is static but used in inline function ‘pte_free’ which is not static + pgtable_page_dtor(page); + ^ + +And making it static is consistent with our use of this in the other +m68k pgalloc definitions of pte_free(). + +Signed-off-by: Greg Ungerer +CC: Matthew Wilcox +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/m68k/include/asm/mcf_pgalloc.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/m68k/include/asm/mcf_pgalloc.h ++++ b/arch/m68k/include/asm/mcf_pgalloc.h +@@ -43,6 +43,7 @@ extern inline pmd_t *pmd_alloc_kernel(pg + static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page, + unsigned long address) + { ++ pgtable_page_dtor(page); + __free_page(page); + } + +@@ -73,8 +74,9 @@ static inline struct page *pte_alloc_one + return page; + } + +-extern inline void pte_free(struct mm_struct *mm, struct page *page) ++static inline void pte_free(struct mm_struct *mm, struct page *page) + { ++ pgtable_page_dtor(page); + __free_page(page); + } + diff --git a/queue-3.18/md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch b/queue-3.18/md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch new file mode 100644 index 00000000000..1cf0a5a6f3f --- /dev/null +++ b/queue-3.18/md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch @@ -0,0 +1,54 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: BingJing Chang +Date: Thu, 28 Jun 2018 18:40:11 +0800 +Subject: md/raid10: fix that replacement cannot complete recovery after reassemble + +From: BingJing Chang + +[ Upstream commit bda3153998f3eb2cafa4a6311971143628eacdbc ] + +During assemble, the spare marked for replacement is not checked. +conf->fullsync cannot be updated to be 1. As a result, recovery will +treat it as a clean array. All recovering sectors are skipped. Original +device is replaced with the not-recovered spare. + +mdadm -C /dev/md0 -l10 -n4 -pn2 /dev/loop[0123] +mdadm /dev/md0 -a /dev/loop4 +mdadm /dev/md0 --replace /dev/loop0 +mdadm -S /dev/md0 # stop array during recovery + +mdadm -A /dev/md0 /dev/loop[01234] + +After reassemble, you can see recovery go on, but it completes +immediately. In fact, recovery is not actually processed. + +To solve this problem, we just add the missing logics for replacment +spares. (In raid1.c or raid5.c, they have already been checked.) + +Reported-by: Alex Chen +Reviewed-by: Alex Wu +Reviewed-by: Chung-Chiang Cheng +Signed-off-by: BingJing Chang +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/raid10.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3770,6 +3770,13 @@ static int run(struct mddev *mddev) + disk->rdev->saved_raid_disk < 0) + conf->fullsync = 1; + } ++ ++ if (disk->replacement && ++ !test_bit(In_sync, &disk->replacement->flags) && ++ disk->replacement->saved_raid_disk < 0) { ++ conf->fullsync = 1; ++ } ++ + disk->recovery_disabled = mddev->recovery_disabled - 1; + } + diff --git a/queue-3.18/net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch b/queue-3.18/net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch new file mode 100644 index 00000000000..543945c2c19 --- /dev/null +++ b/queue-3.18/net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Bartosz Golaszewski +Date: Wed, 20 Jun 2018 10:03:56 +0200 +Subject: net: davinci_emac: match the mdio device against its compatible if possible + +From: Bartosz Golaszewski + +[ Upstream commit ea0820bb771175c7d4192fc6f5b5c56b3c6d5239 ] + +Device tree based systems without of_dev_auxdata will have the mdio +device named differently than "davinci_mdio(.0)". In this case use the +device's parent's compatible string for matching + +Signed-off-by: Bartosz Golaszewski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/davinci_emac.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -1514,6 +1514,10 @@ static int emac_devioctl(struct net_devi + + static int match_first_device(struct device *dev, void *data) + { ++ if (dev->parent && dev->parent->of_node) ++ return of_device_is_compatible(dev->parent->of_node, ++ "ti,davinci_mdio"); ++ + return !strncmp(dev_name(dev), "davinci_mdio", 12); + } + diff --git a/queue-3.18/net-hamradio-use-eth_broadcast_addr.patch b/queue-3.18/net-hamradio-use-eth_broadcast_addr.patch new file mode 100644 index 00000000000..f69220c4403 --- /dev/null +++ b/queue-3.18/net-hamradio-use-eth_broadcast_addr.patch @@ -0,0 +1,52 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Stefan Agner +Date: Sun, 17 Jun 2018 23:40:53 +0200 +Subject: net: hamradio: use eth_broadcast_addr + +From: Stefan Agner + +[ Upstream commit 4e8439aa34802deab11cee68b0ecb18f887fb153 ] + +The array bpq_eth_addr is only used to get the size of an +address, whereas the bcast_addr is used to set the broadcast +address. This leads to a warning when using clang: +drivers/net/hamradio/bpqether.c:94:13: warning: variable 'bpq_eth_addr' is not + needed and will not be emitted [-Wunneeded-internal-declaration] +static char bpq_eth_addr[6]; + ^ + +Remove both variables and use the common eth_broadcast_addr +to set the broadcast address. + +Signed-off-by: Stefan Agner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/hamradio/bpqether.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/net/hamradio/bpqether.c ++++ b/drivers/net/hamradio/bpqether.c +@@ -90,10 +90,6 @@ + static const char banner[] __initconst = KERN_INFO \ + "AX.25: bpqether driver version 004\n"; + +-static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF}; +- +-static char bpq_eth_addr[6]; +- + static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *); + static int bpq_device_event(struct notifier_block *, unsigned long, void *); + +@@ -512,8 +508,8 @@ static int bpq_new_device(struct net_dev + bpq->ethdev = edev; + bpq->axdev = ndev; + +- memcpy(bpq->dest_addr, bcast_addr, sizeof(bpq_eth_addr)); +- memcpy(bpq->acpt_addr, bcast_addr, sizeof(bpq_eth_addr)); ++ eth_broadcast_addr(bpq->dest_addr); ++ eth_broadcast_addr(bpq->acpt_addr); + + err = register_netdevice(ndev); + if (err) diff --git a/queue-3.18/net-propagate-dev_get_valid_name-return-code.patch b/queue-3.18/net-propagate-dev_get_valid_name-return-code.patch new file mode 100644 index 00000000000..3f2e4dd836c --- /dev/null +++ b/queue-3.18/net-propagate-dev_get_valid_name-return-code.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Li RongQing +Date: Tue, 19 Jun 2018 17:23:17 +0800 +Subject: net: propagate dev_get_valid_name return code + +From: Li RongQing + +[ Upstream commit 7892bd081045222b9e4027fec279a28d6fe7aa66 ] + +if dev_get_valid_name failed, propagate its return code + +and remove the setting err to ENODEV, it will be set to +0 again before dev_change_net_namespace exits. + +Signed-off-by: Li RongQing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/core/dev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -6911,7 +6911,8 @@ int dev_change_net_namespace(struct net_ + /* We get here if we can't use the current device name */ + if (!pat) + goto out; +- if (dev_get_valid_name(net, dev, pat) < 0) ++ err = dev_get_valid_name(net, dev, pat); ++ if (err < 0) + goto out; + } + +@@ -6923,7 +6924,6 @@ int dev_change_net_namespace(struct net_ + dev_close(dev); + + /* And unlink it from device chain */ +- err = -ENODEV; + unlist_netdevice(dev); + + synchronize_net(); diff --git a/queue-3.18/net-qca_spi-avoid-packet-drop-during-initial-sync.patch b/queue-3.18/net-qca_spi-avoid-packet-drop-during-initial-sync.patch new file mode 100644 index 00000000000..e8870c2d463 --- /dev/null +++ b/queue-3.18/net-qca_spi-avoid-packet-drop-during-initial-sync.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Stefan Wahren +Date: Wed, 18 Jul 2018 08:31:43 +0200 +Subject: net: qca_spi: Avoid packet drop during initial sync + +From: Stefan Wahren + +[ Upstream commit b2bab426dc715de147f8039a3fccff27d795f4eb ] + +As long as the synchronization with the QCA7000 isn't finished, we +cannot accept packets from the upper layers. So let the SPI thread +enable the TX queue after sync and avoid unwanted packet drop. + +Signed-off-by: Stefan Wahren +Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qualcomm/qca_spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -636,7 +636,7 @@ qcaspi_netdev_open(struct net_device *de + return ret; + } + +- netif_start_queue(qca->net_dev); ++ /* SPI thread takes care of TX queue */ + + return 0; + } diff --git a/queue-3.18/net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch b/queue-3.18/net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch new file mode 100644 index 00000000000..e05e834de06 --- /dev/null +++ b/queue-3.18/net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Stefan Wahren +Date: Wed, 18 Jul 2018 08:31:44 +0200 +Subject: net: qca_spi: Make sure the QCA7000 reset is triggered + +From: Stefan Wahren + +[ Upstream commit 711c62dfa6bdb4326ca6c587f295ea5c4f7269de ] + +In case the SPI thread is not running, a simple reset of sync +state won't fix the transmit timeout. We also need to wake up the kernel +thread. + +Signed-off-by: Stefan Wahren +Fixes: ed7d42e24eff ("net: qca_spi: fix transmit queue timeout handling") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qualcomm/qca_spi.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -740,6 +740,9 @@ qcaspi_netdev_tx_timeout(struct net_devi + qca->net_dev->stats.tx_errors++; + /* Trigger tx queue flush and QCA7000 reset */ + qca->sync = QCASPI_SYNC_UNKNOWN; ++ ++ if (qca->spi_thread) ++ wake_up_process(qca->spi_thread); + } + + static int diff --git a/queue-3.18/net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch b/queue-3.18/net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch new file mode 100644 index 00000000000..34f733a0530 --- /dev/null +++ b/queue-3.18/net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: David Lechner +Date: Mon, 16 Jul 2018 17:58:10 -0500 +Subject: net: usb: rtl8150: demote allmulti message to dev_dbg() + +From: David Lechner + +[ Upstream commit 3a9b0455062ffb9d2f6cd4473a76e3456f318c9f ] + +This driver can spam the kernel log with multiple messages of: + + net eth0: eth0: allmulti set + +Usually 4 or 8 at a time (probably because of using ConnMan). + +This message doesn't seem useful, so let's demote it from dev_info() +to dev_dbg(). + +Signed-off-by: David Lechner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/rtl8150.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct + (netdev->flags & IFF_ALLMULTI)) { + rx_creg &= 0xfffe; + rx_creg |= 0x0002; +- dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name); ++ dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name); + } else { + /* ~RX_MULTICAST, ~RX_PROMISCUOUS */ + rx_creg &= 0x00fc; diff --git a/queue-3.18/netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch b/queue-3.18/netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch new file mode 100644 index 00000000000..30289c971be --- /dev/null +++ b/queue-3.18/netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch @@ -0,0 +1,72 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Eric Dumazet +Date: Wed, 13 Jun 2018 10:11:56 -0700 +Subject: netfilter: ipv6: nf_defrag: reduce struct net memory waste + +From: Eric Dumazet + +[ Upstream commit 9ce7bc036ae4cfe3393232c86e9e1fea2153c237 ] + +It is a waste of memory to use a full "struct netns_sysctl_ipv6" +while only one pointer is really used, considering netns_sysctl_ipv6 +keeps growing. + +Also, since "struct netns_frags" has cache line alignment, +it is better to move the frags_hdr pointer outside, otherwise +we spend a full cache line for this pointer. + +This saves 192 bytes of memory per netns. + +Fixes: c038a767cd69 ("ipv6: add a new namespace for nf_conntrack_reasm") +Signed-off-by: Eric Dumazet +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/net_namespace.h | 1 + + include/net/netns/ipv6.h | 1 - + net/ipv6/netfilter/nf_conntrack_reasm.c | 6 +++--- + 3 files changed, 4 insertions(+), 4 deletions(-) + +--- a/include/net/net_namespace.h ++++ b/include/net/net_namespace.h +@@ -112,6 +112,7 @@ struct net { + #endif + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + struct netns_nf_frag nf_frag; ++ struct ctl_table_header *nf_frag_frags_hdr; + #endif + struct sock *nfnl; + struct sock *nfnl_stash; +--- a/include/net/netns/ipv6.h ++++ b/include/net/netns/ipv6.h +@@ -81,7 +81,6 @@ struct netns_ipv6 { + + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + struct netns_nf_frag { +- struct netns_sysctl_ipv6 sysctl; + struct netns_frags frags; + }; + #endif +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -118,7 +118,7 @@ static int nf_ct_frag6_sysctl_register(s + if (hdr == NULL) + goto err_reg; + +- net->nf_frag.sysctl.frags_hdr = hdr; ++ net->nf_frag_frags_hdr = hdr; + return 0; + + err_reg: +@@ -132,8 +132,8 @@ static void __net_exit nf_ct_frags6_sysc + { + struct ctl_table *table; + +- table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg; +- unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr); ++ table = net->nf_frag_frags_hdr->ctl_table_arg; ++ unregister_net_sysctl_table(net->nf_frag_frags_hdr); + if (!net_eq(net, &init_net)) + kfree(table); + } diff --git a/queue-3.18/netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch b/queue-3.18/netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch new file mode 100644 index 00000000000..dee7cc04e4e --- /dev/null +++ b/queue-3.18/netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch @@ -0,0 +1,44 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Florian Westphal +Date: Wed, 4 Jul 2018 20:25:32 +0200 +Subject: netfilter: x_tables: set module owner for icmp(6) matches + +From: Florian Westphal + +[ Upstream commit d376bef9c29b3c65aeee4e785fffcd97ef0a9a81 ] + +nft_compat relies on xt_request_find_match to increment +refcount of the module that provides the match/target. + +The (builtin) icmp matches did't set the module owner so it +was possible to rmmod ip(6)tables while icmp extensions were still in use. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/netfilter/ip_tables.c | 1 + + net/ipv6/netfilter/ip6_tables.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -2069,6 +2069,7 @@ static struct xt_match ipt_builtin_mt[] + .checkentry = icmp_checkentry, + .proto = IPPROTO_ICMP, + .family = NFPROTO_IPV4, ++ .me = THIS_MODULE, + }, + }; + +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -2071,6 +2071,7 @@ static struct xt_match ip6t_builtin_mt[] + .checkentry = icmp6_checkentry, + .proto = IPPROTO_ICMPV6, + .family = NFPROTO_IPV6, ++ .me = THIS_MODULE, + }, + }; + diff --git a/queue-3.18/octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch b/queue-3.18/octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch new file mode 100644 index 00000000000..372dae6dff1 --- /dev/null +++ b/queue-3.18/octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch @@ -0,0 +1,67 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Alexander Sverdlin +Date: Fri, 13 Jul 2018 17:31:50 +0200 +Subject: octeon_mgmt: Fix MIX registers configuration on MTU setup + +From: Alexander Sverdlin + +[ Upstream commit 4aac0b43474d18f6160302a3caa147d77fa3baa1 ] + +octeon_mgmt driver doesn't drop RX frames that are 1-4 bytes bigger than +MTU set for the corresponding interface. The problem is in the +AGL_GMX_RX0/1_FRM_MAX register setting, which should not account for VLAN +tagging. + +According to Octeon HW manual: +"For tagged frames, MAX increases by four bytes for each VLAN found up to a +maximum of two VLANs, or MAX + 8 bytes." + +OCTEON_FRAME_HEADER_LEN "define" is fine for ring buffer management, but +should not be used for AGL_GMX_RX0/1_FRM_MAX. + +The problem could be easily reproduced using "ping" command. If affected +system has default MTU 1500, other host (having MTU >= 1504) can +successfully "ping" the affected system with payload size 1473-1476, +resulting in IP packets of size 1501-1504 accepted by the mgmt driver. +Fixed system still accepts IP packets of 1500 bytes even with VLAN tagging, +because the limits are lifted in HW as expected, for every VLAN tag. + +Signed-off-by: Alexander Sverdlin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/octeon/octeon_mgmt.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/octeon/octeon_mgmt.c ++++ b/drivers/net/ethernet/octeon/octeon_mgmt.c +@@ -644,7 +644,7 @@ static int octeon_mgmt_set_mac_address(s + static int octeon_mgmt_change_mtu(struct net_device *netdev, int new_mtu) + { + struct octeon_mgmt *p = netdev_priv(netdev); +- int size_without_fcs = new_mtu + OCTEON_MGMT_RX_HEADROOM; ++ int max_packet = new_mtu + ETH_HLEN + ETH_FCS_LEN; + + /* Limit the MTU to make sure the ethernet packets are between + * 64 bytes and 16383 bytes. +@@ -658,9 +658,17 @@ static int octeon_mgmt_change_mtu(struct + + netdev->mtu = new_mtu; + +- cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, size_without_fcs); ++ /* HW lifts the limit if the frame is VLAN tagged ++ * (+4 bytes per each tag, up to two tags) ++ */ ++ cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, max_packet); ++ /* Set the hardware to truncate packets larger than the MTU. The jabber ++ * register must be set to a multiple of 8 bytes, so round up. JABBER is ++ * an unconditional limit, so we need to account for two possible VLAN ++ * tags. ++ */ + cvmx_write_csr(p->agl + AGL_GMX_RX_JABBER, +- (size_without_fcs + 7) & 0xfff8); ++ (max_packet + 7 + VLAN_HLEN * 2) & 0xfff8); + + return 0; + } diff --git a/queue-3.18/perf-report-powerpc-fix-crash-if-callchain-is-empty.patch b/queue-3.18/perf-report-powerpc-fix-crash-if-callchain-is-empty.patch new file mode 100644 index 00000000000..878414b79c3 --- /dev/null +++ b/queue-3.18/perf-report-powerpc-fix-crash-if-callchain-is-empty.patch @@ -0,0 +1,72 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Sandipan Das +Date: Mon, 11 Jun 2018 16:10:49 +0530 +Subject: perf report powerpc: Fix crash if callchain is empty + +From: Sandipan Das + +[ Upstream commit 143c99f6ac6812d23254e80844d6e34be897d3e1 ] + +For some cases, the callchain provided by the kernel may be empty. So, +the callchain ip filtering code will cause a crash if we do not check +whether the struct ip_callchain pointer is NULL before accessing any +members. + +This can be observed on a powerpc64le system running Fedora 27 as shown +below. + + # perf record -b -e cycles:u ls + +Before: + + # perf report --branch-history + + perf: Segmentation fault + -------- backtrace -------- + perf[0x1027615c] + linux-vdso64.so.1(__kernel_sigtramp_rt64+0x0)[0x7fff856304d8] + perf(arch_skip_callchain_idx+0x44)[0x10257c58] + perf[0x1017f2e4] + perf(thread__resolve_callchain+0x124)[0x1017ff5c] + perf(sample__resolve_callchain+0xf0)[0x10172788] + ... + +After: + + # perf report --branch-history + + Samples: 25 of event 'cycles:u', Event count (approx.): 2306870 + Overhead Source:Line Symbol Shared Object + + 11.60% _init+35736 [.] _init ls + + 9.84% strcoll_l.c:137 [.] __strcoll_l libc-2.26.so + + 9.16% memcpy.S:175 [.] __memcpy_power7 libc-2.26.so + + 9.01% gconv_charset.h:54 [.] _nl_find_locale libc-2.26.so + + 8.87% dl-addr.c:52 [.] _dl_addr libc-2.26.so + + 8.83% _init+236 [.] _init ls + ... + +Reported-by: Ravi Bangoria +Signed-off-by: Sandipan Das +Acked-by: Ravi Bangoria +Cc: Jiri Olsa +Cc: Naveen N. Rao +Cc: Sukadev Bhattiprolu +Link: http://lkml.kernel.org/r/20180611104049.11048-1-sandipan@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/arch/powerpc/util/skip-callchain-idx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c ++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +@@ -230,7 +230,7 @@ int arch_skip_callchain_idx(struct machi + u64 ip; + u64 skip_slot = -1; + +- if (chain->nr < 3) ++ if (!chain || chain->nr < 3) + return skip_slot; + + ip = chain->ips[2]; diff --git a/queue-3.18/qlogic-check-kstrtoul-for-errors.patch b/queue-3.18/qlogic-check-kstrtoul-for-errors.patch new file mode 100644 index 00000000000..e38c0d9477f --- /dev/null +++ b/queue-3.18/qlogic-check-kstrtoul-for-errors.patch @@ -0,0 +1,31 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Dan Carpenter +Date: Thu, 12 Jul 2018 15:23:45 +0300 +Subject: qlogic: check kstrtoul() for errors + +From: Dan Carpenter + +[ Upstream commit 5fc853cc01c68f84984ecc2d5fd777ecad78240f ] + +We accidentally left out the error handling for kstrtoul(). + +Fixes: a520030e326a ("qlcnic: Implement flash sysfs callback for 83xx adapter") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c +@@ -1136,6 +1136,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_w + return QL_STATUS_INVALID_PARAM; + + ret = kstrtoul(buf, 16, &data); ++ if (ret) ++ return ret; + + switch (data) { + case QLC_83XX_FLASH_SECTOR_ERASE_CMD: diff --git a/queue-3.18/selftests-sync-add-config-fragment-for-testing-sync-framework.patch b/queue-3.18/selftests-sync-add-config-fragment-for-testing-sync-framework.patch new file mode 100644 index 00000000000..6d867568877 --- /dev/null +++ b/queue-3.18/selftests-sync-add-config-fragment-for-testing-sync-framework.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Fathi Boudra +Date: Thu, 14 Jun 2018 11:57:08 +0200 +Subject: selftests: sync: add config fragment for testing sync framework + +From: Fathi Boudra + +[ Upstream commit d6a3e55131fcb1e5ca1753f4b6f297a177b2fc91 ] + +Unless the software synchronization objects (CONFIG_SW_SYNC) is enabled, +the sync test will be skipped: + +TAP version 13 +1..0 # Skipped: Sync framework not supported by kernel + +Add a config fragment file to be able to run "make kselftest-merge" to +enable relevant configuration required in order to run the sync test. + +Signed-off-by: Fathi Boudra +Link: https://lkml.org/lkml/2017/5/5/14 +Signed-off-by: Anders Roxell +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/sync/config | 4 ++++ + 1 file changed, 4 insertions(+) + create mode 100644 tools/testing/selftests/sync/config + +--- /dev/null ++++ b/tools/testing/selftests/sync/config +@@ -0,0 +1,4 @@ ++CONFIG_STAGING=y ++CONFIG_ANDROID=y ++CONFIG_SYNC=y ++CONFIG_SW_SYNC=y diff --git a/queue-3.18/series b/queue-3.18/series index 7f2c82bf5d0..aa0e356032b 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -13,3 +13,39 @@ usb-serial-sierra-fix-potential-deadlock-at-close.patch serial-8250_dw-always-set-baud-rate-in-dw8250_set_termios.patch bluetooth-avoid-killing-an-already-killed-socket.patch isdn-disable-iiocdbgvar.patch +netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch +selftests-sync-add-config-fragment-for-testing-sync-framework.patch +usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch +usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch +arm64-make-secondary_start_kernel-notrace.patch +enic-initialize-enic-rfs_h.lock-in-enic_probe.patch +net-hamradio-use-eth_broadcast_addr.patch +net-propagate-dev_get_valid_name-return-code.patch +net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch +locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch +ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch +smack-mark-inode-instant-in-smack_task_to_inode.patch +cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch +brcmfmac-stop-watchdog-before-detach-and-free-everything.patch +arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch +perf-report-powerpc-fix-crash-if-callchain-is-empty.patch +arm-dts-da850-fix-interrups-property-for-gpio.patch +dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch +md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch +drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch +bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch +m68k-fix-bad-page-state-oops-on-coldfire-boot.patch +arm-imx_v4_v5_defconfig-select-ulpi-support.patch +tracing-use-__printf-markup-to-silence-compiler.patch +smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch +netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch +arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch +drm-armada-fix-colorkey-mode-property.patch +arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch +ixgbe-be-more-careful-when-modifying-mac-filters.patch +qlogic-check-kstrtoul-for-errors.patch +octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch +net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch +net-qca_spi-avoid-packet-drop-during-initial-sync.patch +net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch +tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch diff --git a/queue-3.18/smack-mark-inode-instant-in-smack_task_to_inode.patch b/queue-3.18/smack-mark-inode-instant-in-smack_task_to_inode.patch new file mode 100644 index 00000000000..a3e32dc5925 --- /dev/null +++ b/queue-3.18/smack-mark-inode-instant-in-smack_task_to_inode.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Casey Schaufler +Date: Fri, 22 Jun 2018 10:54:45 -0700 +Subject: Smack: Mark inode instant in smack_task_to_inode + +From: Casey Schaufler + +[ Upstream commit 7b4e88434c4e7982fb053c49657e1c8bbb8692d9 ] + +Smack: Mark inode instant in smack_task_to_inode + +/proc clean-up in commit 1bbc55131e59bd099fdc568d3aa0b42634dbd188 +resulted in smack_task_to_inode() being called before smack_d_instantiate. +This resulted in the smk_inode value being ignored, even while present +for files in /proc/self. Marking the inode as instant here fixes that. + +Signed-off-by: Casey Schaufler +Signed-off-by: James Morris +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + security/smack/smack_lsm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2037,6 +2037,7 @@ static void smack_task_to_inode(struct t + struct smack_known *skp = smk_of_task_struct(p); + + isp->smk_inode = skp; ++ isp->smk_flags |= SMK_INODE_INSTANT; + } + + /* diff --git a/queue-3.18/smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch b/queue-3.18/smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch new file mode 100644 index 00000000000..77ff610740b --- /dev/null +++ b/queue-3.18/smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch @@ -0,0 +1,105 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Yuiko Oshino +Date: Tue, 3 Jul 2018 11:21:46 -0400 +Subject: smsc75xx: Add workaround for gigabit link up hardware errata. + +From: Yuiko Oshino + +[ Upstream commit d461e3da905332189aad546b2ad9adbe6071c7cc ] + +In certain conditions, the device may not be able to link in gigabit mode. This software workaround ensures that the device will not enter the failure state. + +Fixes: d0cad871703b898a442e4049c532ec39168e5b57 ("SMSC75XX USB 2.0 Gigabit Ethernet Devices") +Signed-off-by: Yuiko Oshino +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/smsc75xx.c | 62 +++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 62 insertions(+) + +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -81,6 +81,9 @@ static bool turbo_mode = true; + module_param(turbo_mode, bool, 0644); + MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction"); + ++static int smsc75xx_link_ok_nopm(struct usbnet *dev); ++static int smsc75xx_phy_gig_workaround(struct usbnet *dev); ++ + static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index, + u32 *data, int in_pm) + { +@@ -840,6 +843,9 @@ static int smsc75xx_phy_initialize(struc + return -EIO; + } + ++ /* phy workaround for gig link */ ++ smsc75xx_phy_gig_workaround(dev); ++ + smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE, + ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP | + ADVERTISE_PAUSE_ASYM); +@@ -978,6 +984,62 @@ static int smsc75xx_wait_ready(struct us + return -EIO; + } + ++static int smsc75xx_phy_gig_workaround(struct usbnet *dev) ++{ ++ struct mii_if_info *mii = &dev->mii; ++ int ret = 0, timeout = 0; ++ u32 buf, link_up = 0; ++ ++ /* Set the phy in Gig loopback */ ++ smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040); ++ ++ /* Wait for the link up */ ++ do { ++ link_up = smsc75xx_link_ok_nopm(dev); ++ usleep_range(10000, 20000); ++ timeout++; ++ } while ((!link_up) && (timeout < 1000)); ++ ++ if (timeout >= 1000) { ++ netdev_warn(dev->net, "Timeout waiting for PHY link up\n"); ++ return -EIO; ++ } ++ ++ /* phy reset */ ++ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf); ++ if (ret < 0) { ++ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret); ++ return ret; ++ } ++ ++ buf |= PMT_CTL_PHY_RST; ++ ++ ret = smsc75xx_write_reg(dev, PMT_CTL, buf); ++ if (ret < 0) { ++ netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret); ++ return ret; ++ } ++ ++ timeout = 0; ++ do { ++ usleep_range(10000, 20000); ++ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf); ++ if (ret < 0) { ++ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ++ ret); ++ return ret; ++ } ++ timeout++; ++ } while ((buf & PMT_CTL_PHY_RST) && (timeout < 100)); ++ ++ if (timeout >= 100) { ++ netdev_warn(dev->net, "timeout waiting for PHY Reset\n"); ++ return -EIO; ++ } ++ ++ return 0; ++} ++ + static int smsc75xx_reset(struct usbnet *dev) + { + struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]); diff --git a/queue-3.18/tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch b/queue-3.18/tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch new file mode 100644 index 00000000000..a6f36ba3d32 --- /dev/null +++ b/queue-3.18/tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch @@ -0,0 +1,54 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Randy Dunlap +Date: Tue, 17 Jul 2018 18:27:45 -0700 +Subject: tcp: identify cryptic messages as TCP seq # bugs + +From: Randy Dunlap + +[ Upstream commit e56b8ce363a36fb7b74b80aaa5cc9084f2c908b4 ] + +Attempt to make cryptic TCP seq number error messages clearer by +(1) identifying the source of the message as "TCP", (2) identifying the +errors as "seq # bug", and (3) grouping the field identifiers and values +by separating them with commas. + +E.g., the following message is changed from: + +recvmsg bug 2: copied 73BCB6CD seq 70F17CBE rcvnxt 73BCB9AA fl 0 +WARNING: CPU: 2 PID: 1501 at /linux/net/ipv4/tcp.c:1881 tcp_recvmsg+0x649/0xb90 + +to: + +TCP recvmsg seq # bug 2: copied 73BCB6CD, seq 70F17CBE, rcvnxt 73BCB9AA, fl 0 +WARNING: CPU: 2 PID: 1501 at /linux/net/ipv4/tcp.c:2011 tcp_recvmsg+0x694/0xba0 + +Suggested-by: 積丹尼 Dan Jacobson +Signed-off-by: Randy Dunlap +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1668,7 +1668,7 @@ int tcp_recvmsg(struct kiocb *iocb, stru + * shouldn't happen. + */ + if (WARN(before(*seq, TCP_SKB_CB(skb)->seq), +- "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n", ++ "TCP recvmsg seq # bug: copied %X, seq %X, rcvnxt %X, fl %X\n", + *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, + flags)) + break; +@@ -1681,7 +1681,7 @@ int tcp_recvmsg(struct kiocb *iocb, stru + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) + goto found_fin_ok; + WARN(!(flags & MSG_PEEK), +- "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n", ++ "TCP recvmsg seq # bug 2: copied %X, seq %X, rcvnxt %X, fl %X\n", + *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags); + } + diff --git a/queue-3.18/tracing-use-__printf-markup-to-silence-compiler.patch b/queue-3.18/tracing-use-__printf-markup-to-silence-compiler.patch new file mode 100644 index 00000000000..b418a33ede5 --- /dev/null +++ b/queue-3.18/tracing-use-__printf-markup-to-silence-compiler.patch @@ -0,0 +1,69 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Mathieu Malaterre +Date: Thu, 8 Mar 2018 21:58:43 +0100 +Subject: tracing: Use __printf markup to silence compiler + +From: Mathieu Malaterre + +[ Upstream commit 26b68dd2f48fe7699a89f0cfbb9f4a650dc1c837 ] + +Silence warnings (triggered at W=1) by adding relevant __printf attributes. + + CC kernel/trace/trace.o +kernel/trace/trace.c: In function ‘__trace_array_vprintk’: +kernel/trace/trace.c:2979:2: warning: function might be possible candidate for ‘gnu_printf’ format attribute [-Wsuggest-attribute=format] + len = vscnprintf(tbuffer, TRACE_BUF_SIZE, fmt, args); + ^~~ + AR kernel/trace/built-in.o + +Link: http://lkml.kernel.org/r/20180308205843.27447-1-malat@debian.org + +Signed-off-by: Mathieu Malaterre +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -2137,6 +2137,7 @@ out: + } + EXPORT_SYMBOL_GPL(trace_vbprintk); + ++__printf(3, 0) + static int + __trace_array_vprintk(struct ring_buffer *buffer, + unsigned long ip, const char *fmt, va_list args) +@@ -2190,12 +2191,14 @@ __trace_array_vprintk(struct ring_buffer + return len; + } + ++__printf(3, 0) + int trace_array_vprintk(struct trace_array *tr, + unsigned long ip, const char *fmt, va_list args) + { + return __trace_array_vprintk(tr->trace_buffer.buffer, ip, fmt, args); + } + ++__printf(3, 0) + int trace_array_printk(struct trace_array *tr, + unsigned long ip, const char *fmt, ...) + { +@@ -2211,6 +2214,7 @@ int trace_array_printk(struct trace_arra + return ret; + } + ++__printf(3, 4) + int trace_array_printk_buf(struct ring_buffer *buffer, + unsigned long ip, const char *fmt, ...) + { +@@ -2226,6 +2230,7 @@ int trace_array_printk_buf(struct ring_b + return ret; + } + ++__printf(2, 0) + int trace_vprintk(unsigned long ip, const char *fmt, va_list args) + { + return trace_array_vprintk(&global_trace, ip, fmt, args); diff --git a/queue-3.18/usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch b/queue-3.18/usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch new file mode 100644 index 00000000000..23cdc0d99a2 --- /dev/null +++ b/queue-3.18/usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch @@ -0,0 +1,59 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: William Wu +Date: Fri, 11 May 2018 17:46:32 +0800 +Subject: usb: dwc2: fix isoc split in transfer with no data + +From: William Wu + +[ Upstream commit 70c3c8cb83856758025c2a211dd022bc0478922a ] + +If isoc split in transfer with no data (the length of DATA0 +packet is zero), we can't simply return immediately. Because +the DATA0 can be the first transaction or the second transaction +for the isoc split in transaction. If the DATA0 packet with no +data is in the first transaction, we can return immediately. +But if the DATA0 packet with no data is in the second transaction +of isoc split in transaction sequence, we need to increase the +qtd->isoc_frame_index and giveback urb to device driver if needed, +otherwise, the MDATA packet will be lost. + +A typical test case is that connect the dwc2 controller with an +usb hs Hub (GL852G-12), and plug an usb fs audio device (Plantronics +headset) into the downstream port of Hub. Then use the usb mic +to record, we can find noise when playback. + +In the case, the isoc split in transaction sequence like this: + +- SSPLIT IN transaction +- CSPLIT IN transaction + - MDATA packet (176 bytes) +- CSPLIT IN transaction + - DATA0 packet (0 byte) + +This patch use both the length of DATA0 and qtd->isoc_split_offset +to check if the DATA0 is in the second transaction. + +Tested-by: Gevorg Sahakyan +Tested-by: Heiko Stuebner +Acked-by: Minas Harutyunyan hminas@synopsys.com> +Signed-off-by: William Wu +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/hcd_intr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/dwc2/hcd_intr.c ++++ b/drivers/usb/dwc2/hcd_intr.c +@@ -913,9 +913,8 @@ static int dwc2_xfercomp_isoc_split_in(s + frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index]; + len = dwc2_get_actual_xfer_length(hsotg, chan, chnum, qtd, + DWC2_HC_XFER_COMPLETE, NULL); +- if (!len) { ++ if (!len && !qtd->isoc_split_offset) { + qtd->complete_split = 0; +- qtd->isoc_split_offset = 0; + return 0; + } + diff --git a/queue-3.18/usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch b/queue-3.18/usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch new file mode 100644 index 00000000000..83251b7a04e --- /dev/null +++ b/queue-3.18/usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Aug 22 10:36:41 CEST 2018 +From: Chunfeng Yun +Date: Fri, 25 May 2018 17:24:57 +0800 +Subject: usb: gadget: composite: fix delayed_status race condition when set_interface + +From: Chunfeng Yun + +[ Upstream commit 980900d6318066b9f8314bfb87329a20fd0d1ca4 ] + +It happens when enable debug log, if set_alt() returns +USB_GADGET_DELAYED_STATUS and usb_composite_setup_continue() +is called before increasing count of @delayed_status, +so fix it by using spinlock of @cdev->lock. + +Signed-off-by: Chunfeng Yun +Tested-by: Jay Hsu +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/composite.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -1530,6 +1530,8 @@ composite_setup(struct usb_gadget *gadge + break; + if (w_value && !f->set_alt) + break; ++ ++ spin_lock(&cdev->lock); + value = f->set_alt(f, w_index, w_value); + if (value == USB_GADGET_DELAYED_STATUS) { + DBG(cdev, +@@ -1539,6 +1541,7 @@ composite_setup(struct usb_gadget *gadge + DBG(cdev, "delayed_status count %d\n", + cdev->delayed_status); + } ++ spin_unlock(&cdev->lock); + break; + case USB_REQ_GET_INTERFACE: + if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE)) -- 2.47.3