From ab0021f19dc760b27319005c65b5ebb4001b643c Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 8 Dec 2018 10:08:09 -0500 Subject: [PATCH] patches for 4.19 Signed-off-by: Sasha Levin --- ...est-virtual-apic-log-tail-address-re.patch | 38 +++ ...d-merged-fragment-buffer-for-full-pa.patch | 53 ++++ ...xplicit-tvlv-padding-for-elp-packets.patch | 64 +++++ ...que-dmae-channel-number-for-fw-dmae-.patch | 66 +++++ ...ing-time-in-bnxt_fill_coredump_recor.patch | 37 +++ ...fix-decoding-channel-info-for-160-mh.patch | 48 ++++ ...-rcar_can-fix-erroneous-registration.patch | 47 ++++ ...emove-set-but-not-used-variable-udev.patch | 41 ++++ ...eq-only-register-platform_device-whe.patch | 79 ++++++ ...ernet-qlogic-qed-qed_rdma.h-fix-typo.patch | 36 +++ ...support-amdgpu-max-bpc-connector-pro.patch | 110 +++++++++ ...amdgpu-max-bpc-connector-property-v2.patch | 73 ++++++ .../exec-make-de_thread-freezable.patch | 76 ++++++ ...-per-mirror-specified-stateid-for-io.patch | 129 ++++++++++ .../gpio-mockup-fix-indicated-direction.patch | 47 ++++ ...egacy-non-pinctrl-aware-builds-again.patch | 54 ++++ ...re-battery-reported-by-symbol-ds4308.patch | 56 +++++ ...dd-pointstick-support-for-cirque-tou.patch | 52 ++++ .../ibmvnic-fix-rx-queue-buffer-cleanup.patch | 35 +++ ...river-queues-after-change-in-ring-si.patch | 56 +++++ ...-vmsa-fix-crash-on-early-domain-free.patch | 55 +++++ ...ull-pointer-dereference-in-prq_event.patch | 38 +++ ...u-vt-d-use-memunmap-to-free-memremap.patch | 34 +++ ...for-non-ok-nack-conditions-while-cla.patch | 95 +++++++ ...unregister-device-nodes-first-then-r.patch | 44 ++++ ...isp-unregister-media-device-as-first.patch | 43 ++++ ...-vicodec-lower-minimum-height-to-360.patch | 37 +++ ...x-building-without-config_leds_class.patch | 86 +++++++ ...-qcom-namespace-prefix-some-commands.patch | 112 +++++++++ ...cadence-qspi-page-fault-kernel-panic.patch | 76 ++++++ .../net-amd-add-missing-of_node_put.patch | 43 ++++ ...h-during-failed-resume-from-hibernat.patch | 41 ++++ ...c100-remove-netif_running-netdev-che.patch | 55 +++++ ...bmnvic-fix-deadlock-problem-in-reset.patch | 197 +++++++++++++++ ...an-warning-of-signed-integer-overflo.patch | 45 ++++ ...x-uninitialized-variable-compilation.patch | 33 +++ ...ro-out-lkey-field-in-sw2hw_mpt-fw-co.patch | 47 ++++ ...4-fix-a-nfsv4-state-manager-deadlock.patch | 80 ++++++ ...o-not-allocate-memory-under-the-lock.patch | 120 +++++++++ ...c-resolve-io-failures-during-connect.patch | 194 +++++++++++++++ queue-4.19/qed-fix-bitmap_weight-check.patch | 39 +++ ...ng-offload_tc-by-protocols-without-a.patch | 82 +++++++ .../qed-fix-ptt-leak-in-qed_drain.patch | 35 +++ ...-getters-to-always-return-a-valid-pq.patch | 96 ++++++++ ...d-fix-rdma_info-structure-allocation.patch | 231 ++++++++++++++++++ ...eading-wrong-value-in-loop-condition.patch | 34 +++ ...-uhid-use-strlcpy-instead-of-strncpy.patch | 58 +++++ ...t-ffs-fix-bug-when-userland-exits-wi.patch | 93 +++++++ ...g-in-arch-riscv-include-asm-module.h.patch | 33 +++ ...mbe_mask-bit-before-smc-irq-handling.patch | 41 ++++ ...nix-ufs-bug-with-quirk-on-hi36xx-soc.patch | 92 +++++++ queue-4.19/series | 56 +++++ ...y-guard-against-lack-of-returncode-i.patch | 58 +++++ ...y-ignore-errors-when-decoding-stdout.patch | 38 +++ ...do-team_notify_peers-or-team_mcast_r.patch | 48 ++++ ...e-fix-error-return-getting-clobbered.patch | 38 +++ ...-dwc2-pci-fix-an-error-code-in-probe.patch | 34 +++ 57 files changed, 3778 insertions(+) create mode 100644 queue-4.19/amd-iommu-fix-guest-virtual-apic-log-tail-address-re.patch create mode 100644 queue-4.19/batman-adv-expand-merged-fragment-buffer-for-full-pa.patch create mode 100644 queue-4.19/batman-adv-use-explicit-tvlv-padding-for-elp-packets.patch create mode 100644 queue-4.19/bnx2x-assign-unique-dmae-channel-number-for-fw-dmae-.patch create mode 100644 queue-4.19/bnxt_en-fix-filling-time-in-bnxt_fill_coredump_recor.patch create mode 100644 queue-4.19/brcmutil-really-fix-decoding-channel-info-for-160-mh.patch create mode 100644 queue-4.19/can-rcar_can-fix-erroneous-registration.patch create mode 100644 queue-4.19/can-ucan-remove-set-but-not-used-variable-udev.patch create mode 100644 queue-4.19/cpufreq-ti-cpufreq-only-register-platform_device-whe.patch create mode 100644 queue-4.19/drivers-net-ethernet-qlogic-qed-qed_rdma.h-fix-typo.patch create mode 100644 queue-4.19/drm-amd-display-support-amdgpu-max-bpc-connector-pro.patch create mode 100644 queue-4.19/drm-amdgpu-add-amdgpu-max-bpc-connector-property-v2.patch create mode 100644 queue-4.19/exec-make-de_thread-freezable.patch create mode 100644 queue-4.19/flexfiles-use-per-mirror-specified-stateid-for-io.patch create mode 100644 queue-4.19/gpio-mockup-fix-indicated-direction.patch create mode 100644 queue-4.19/gpio-pxa-fix-legacy-non-pinctrl-aware-builds-again.patch create mode 100644 queue-4.19/hid-input-ignore-battery-reported-by-symbol-ds4308.patch create mode 100644 queue-4.19/hid-multitouch-add-pointstick-support-for-cirque-tou.patch create mode 100644 queue-4.19/ibmvnic-fix-rx-queue-buffer-cleanup.patch create mode 100644 queue-4.19/ibmvnic-update-driver-queues-after-change-in-ring-si.patch create mode 100644 queue-4.19/iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch create mode 100644 queue-4.19/iommu-vt-d-fix-null-pointer-dereference-in-prq_event.patch create mode 100644 queue-4.19/iommu-vt-d-use-memunmap-to-free-memremap.patch create mode 100644 queue-4.19/media-cec-check-for-non-ok-nack-conditions-while-cla.patch create mode 100644 queue-4.19/media-ipu3-cio2-unregister-device-nodes-first-then-r.patch create mode 100644 queue-4.19/media-omap3isp-unregister-media-device-as-first.patch create mode 100644 queue-4.19/media-vicodec-lower-minimum-height-to-360.patch create mode 100644 queue-4.19/mt76-fix-building-without-config_leds_class.patch create mode 100644 queue-4.19/mtd-rawnand-qcom-namespace-prefix-some-commands.patch create mode 100644 queue-4.19/mtd-spi-nor-fix-cadence-qspi-page-fault-kernel-panic.patch create mode 100644 queue-4.19/net-amd-add-missing-of_node_put.patch create mode 100644 queue-4.19/net-ena-fix-crash-during-failed-resume-from-hibernat.patch create mode 100644 queue-4.19/net-faraday-ftmac100-remove-netif_running-netdev-che.patch create mode 100644 queue-4.19/net-ibmnvic-fix-deadlock-problem-in-reset.patch create mode 100644 queue-4.19/net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch create mode 100644 queue-4.19/net-mlx4_core-fix-uninitialized-variable-compilation.patch create mode 100644 queue-4.19/net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch create mode 100644 queue-4.19/nfsv4-fix-a-nfsv4-state-manager-deadlock.patch create mode 100644 queue-4.19/nfsv4.2-copy-do-not-allocate-memory-under-the-lock.patch create mode 100644 queue-4.19/nvme-fc-resolve-io-failures-during-connect.patch create mode 100644 queue-4.19/qed-fix-bitmap_weight-check.patch create mode 100644 queue-4.19/qed-fix-overriding-offload_tc-by-protocols-without-a.patch create mode 100644 queue-4.19/qed-fix-ptt-leak-in-qed_drain.patch create mode 100644 queue-4.19/qed-fix-qm-getters-to-always-return-a-valid-pq.patch create mode 100644 queue-4.19/qed-fix-rdma_info-structure-allocation.patch create mode 100644 queue-4.19/qed-fix-reading-wrong-value-in-loop-condition.patch create mode 100644 queue-4.19/revert-hid-uhid-use-strlcpy-instead-of-strncpy.patch create mode 100644 queue-4.19/revert-usb-gadget-ffs-fix-bug-when-userland-exits-wi.patch create mode 100644 queue-4.19/riscv-fix-warning-in-arch-riscv-include-asm-module.h.patch create mode 100644 queue-4.19/s390-ism-clear-dmbe_mask-bit-before-smc-irq-handling.patch create mode 100644 queue-4.19/scsi-ufs-fix-hynix-ufs-bug-with-quirk-on-hi36xx-soc.patch create mode 100644 queue-4.19/series create mode 100644 queue-4.19/tc-testing-tdc.py-guard-against-lack-of-returncode-i.patch create mode 100644 queue-4.19/tc-testing-tdc.py-ignore-errors-when-decoding-stdout.patch create mode 100644 queue-4.19/team-no-need-to-do-team_notify_peers-or-team_mcast_r.patch create mode 100644 queue-4.19/test_firmware-fix-error-return-getting-clobbered.patch create mode 100644 queue-4.19/usb-dwc2-pci-fix-an-error-code-in-probe.patch diff --git a/queue-4.19/amd-iommu-fix-guest-virtual-apic-log-tail-address-re.patch b/queue-4.19/amd-iommu-fix-guest-virtual-apic-log-tail-address-re.patch new file mode 100644 index 00000000000..48905ac5c75 --- /dev/null +++ b/queue-4.19/amd-iommu-fix-guest-virtual-apic-log-tail-address-re.patch @@ -0,0 +1,38 @@ +From febdfddf53f9fcc9033097d19bb3f5475457e87f Mon Sep 17 00:00:00 2001 +From: Filippo Sironi +Date: Mon, 12 Nov 2018 12:26:30 +0000 +Subject: amd/iommu: Fix Guest Virtual APIC Log Tail Address Register + +[ Upstream commit ab99be4683d9db33b100497d463274ebd23bd67e ] + +This register should have been programmed with the physical address +of the memory location containing the shadow tail pointer for +the guest virtual APIC log instead of the base address. + +Fixes: 8bda0cfbdc1a ('iommu/amd: Detect and initialize guest vAPIC log') +Signed-off-by: Filippo Sironi +Signed-off-by: Wei Wang +Signed-off-by: Suravee Suthikulpanit +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu_init.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c +index 84b3e4445d46..e062ab9687c7 100644 +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -797,7 +797,8 @@ static int iommu_init_ga_log(struct amd_iommu *iommu) + entry = iommu_virt_to_phys(iommu->ga_log) | GA_LOG_SIZE_512; + memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_BASE_OFFSET, + &entry, sizeof(entry)); +- entry = (iommu_virt_to_phys(iommu->ga_log) & 0xFFFFFFFFFFFFFULL) & ~7ULL; ++ entry = (iommu_virt_to_phys(iommu->ga_log_tail) & ++ (BIT_ULL(52)-1)) & ~7ULL; + memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_TAIL_OFFSET, + &entry, sizeof(entry)); + writel(0x00, iommu->mmio_base + MMIO_GA_HEAD_OFFSET); +-- +2.19.1 + diff --git a/queue-4.19/batman-adv-expand-merged-fragment-buffer-for-full-pa.patch b/queue-4.19/batman-adv-expand-merged-fragment-buffer-for-full-pa.patch new file mode 100644 index 00000000000..ff06818cb63 --- /dev/null +++ b/queue-4.19/batman-adv-expand-merged-fragment-buffer-for-full-pa.patch @@ -0,0 +1,53 @@ +From 00958bfdfc73e23e9073cbcdf1995330c9cc12a1 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Wed, 7 Nov 2018 23:09:12 +0100 +Subject: batman-adv: Expand merged fragment buffer for full packet +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit d7d8bbb40a5b1f682ee6589e212934f4c6b8ad60 ] + +The complete size ("total_size") of the fragmented packet is stored in the +fragment header and in the size of the fragment chain. When the fragments +are ready for merge, the skbuff's tail of the first fragment is expanded to +have enough room after the data pointer for at least total_size. This means +that it gets expanded by total_size - first_skb->len. + +But this is ignoring the fact that after expanding the buffer, the fragment +header is pulled by from this buffer. Assuming that the tailroom of the +buffer was already 0, the buffer after the data pointer of the skbuff is +now only total_size - len(fragment_header) large. When the merge function +is then processing the remaining fragments, the code to copy the data over +to the merged skbuff will cause an skb_over_panic when it tries to actually +put enough data to fill the total_size bytes of the packet. + +The size of the skb_pull must therefore also be taken into account when the +buffer's tailroom is expanded. + +Fixes: 610bfc6bc99b ("batman-adv: Receive fragmented packets and merge") +Reported-by: Martin Weinelt +Co-authored-by: Linus Lüssing +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/fragmentation.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c +index 0fddc17106bd..5b71a289d04f 100644 +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -275,7 +275,7 @@ batadv_frag_merge_packets(struct hlist_head *chain) + kfree(entry); + + packet = (struct batadv_frag_packet *)skb_out->data; +- size = ntohs(packet->total_size); ++ size = ntohs(packet->total_size) + hdr_size; + + /* Make room for the rest of the fragments. */ + if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) { +-- +2.19.1 + diff --git a/queue-4.19/batman-adv-use-explicit-tvlv-padding-for-elp-packets.patch b/queue-4.19/batman-adv-use-explicit-tvlv-padding-for-elp-packets.patch new file mode 100644 index 00000000000..3c8598c4168 --- /dev/null +++ b/queue-4.19/batman-adv-use-explicit-tvlv-padding-for-elp-packets.patch @@ -0,0 +1,64 @@ +From ce8bdb355ad8012eede5a8a7b928fa206a9ea230 Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Tue, 30 Oct 2018 12:17:10 +0100 +Subject: batman-adv: Use explicit tvlv padding for ELP packets +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit f4156f9656feac21f4de712fac94fae964c5d402 ] + +The announcement messages of batman-adv COMPAT_VERSION 15 have the +possibility to announce additional information via a dynamic TVLV part. +This part is optional for the ELP packets and currently not parsed by the +Linux implementation. Still out-of-tree versions are using it to transport +things like neighbor hashes to optimize the rebroadcast behavior. + +Since the ELP broadcast packets are smaller than the minimal ethernet +packet, it often has to be padded. This is often done (as specified in +RFC894) with octets of zero and thus work perfectly fine with the TVLV +part (making it a zero length and thus empty). But not all ethernet +compatible hardware seems to follow this advice. To avoid ambiguous +situations when parsing the TVLV header, just force the 4 bytes (TVLV +length + padding) after the required ELP header to zero. + +Fixes: d6f94d91f766 ("batman-adv: ELP - adding basic infrastructure") +Reported-by: Linus Lüssing +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/bat_v_elp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c +index 9f481cfdf77d..e8090f099eb8 100644 +--- a/net/batman-adv/bat_v_elp.c ++++ b/net/batman-adv/bat_v_elp.c +@@ -352,19 +352,21 @@ out: + */ + int batadv_v_elp_iface_enable(struct batadv_hard_iface *hard_iface) + { ++ static const size_t tvlv_padding = sizeof(__be32); + struct batadv_elp_packet *elp_packet; + unsigned char *elp_buff; + u32 random_seqno; + size_t size; + int res = -ENOMEM; + +- size = ETH_HLEN + NET_IP_ALIGN + BATADV_ELP_HLEN; ++ size = ETH_HLEN + NET_IP_ALIGN + BATADV_ELP_HLEN + tvlv_padding; + hard_iface->bat_v.elp_skb = dev_alloc_skb(size); + if (!hard_iface->bat_v.elp_skb) + goto out; + + skb_reserve(hard_iface->bat_v.elp_skb, ETH_HLEN + NET_IP_ALIGN); +- elp_buff = skb_put_zero(hard_iface->bat_v.elp_skb, BATADV_ELP_HLEN); ++ elp_buff = skb_put_zero(hard_iface->bat_v.elp_skb, ++ BATADV_ELP_HLEN + tvlv_padding); + elp_packet = (struct batadv_elp_packet *)elp_buff; + + elp_packet->packet_type = BATADV_ELP; +-- +2.19.1 + diff --git a/queue-4.19/bnx2x-assign-unique-dmae-channel-number-for-fw-dmae-.patch b/queue-4.19/bnx2x-assign-unique-dmae-channel-number-for-fw-dmae-.patch new file mode 100644 index 00000000000..1082e284c66 --- /dev/null +++ b/queue-4.19/bnx2x-assign-unique-dmae-channel-number-for-fw-dmae-.patch @@ -0,0 +1,66 @@ +From 044b27d6c2d8f641add17c8db377982acc85e9be Mon Sep 17 00:00:00 2001 +From: Sudarsana Reddy Kalluru +Date: Sun, 11 Nov 2018 18:27:34 -0800 +Subject: bnx2x: Assign unique DMAE channel number for FW DMAE transactions. + +[ Upstream commit 77e461d14ed141253573eeeb4d34eccc51e38328 ] + +Driver assigns DMAE channel 0 for FW as part of START_RAMROD command. FW +uses this channel for DMAE operations (e.g., TIME_SYNC implementation). +Driver also uses the same channel 0 for DMAE operations for some of the PFs +(e.g., PF0 on Port0). This could lead to concurrent access to the DMAE +channel by FW and driver which is not legal. Hence need to assign unique +DMAE id for FW. +Currently following DMAE channels are used by the clients, + MFW - OCBB/OCSD functionality uses DMAE channel 14/15 + Driver 0-3 and 8-11 (for PF dmae operations) + 4 and 12 (for stats requests) +Assigning unique dmae_id '13' to the FW. + +Changes from previous version: +------------------------------ +v2: Incorporated the review comments. + +Signed-off-by: Sudarsana Reddy Kalluru +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller + +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 7 +++++++ + drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c | 1 + + 2 files changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +index be1506169076..0de487a8f0eb 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +@@ -2191,6 +2191,13 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id, + #define PMF_DMAE_C(bp) (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \ + E1HVN_MAX) + ++/* Following is the DMAE channel number allocation for the clients. ++ * MFW: OCBB/OCSD implementations use DMAE channels 14/15 respectively. ++ * Driver: 0-3 and 8-11 (for PF dmae operations) ++ * 4 and 12 (for stats requests) ++ */ ++#define BNX2X_FW_DMAE_C 13 /* Channel for FW DMAE operations */ ++ + /* PCIE link and speed */ + #define PCICFG_LINK_WIDTH 0x1f00000 + #define PCICFG_LINK_WIDTH_SHIFT 20 +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c +index 3f4d2c8da21a..a9eaaf3e73a4 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c +@@ -6149,6 +6149,7 @@ static inline int bnx2x_func_send_start(struct bnx2x *bp, + rdata->sd_vlan_tag = cpu_to_le16(start_params->sd_vlan_tag); + rdata->path_id = BP_PATH(bp); + rdata->network_cos_mode = start_params->network_cos_mode; ++ rdata->dmae_cmd_id = BNX2X_FW_DMAE_C; + + rdata->vxlan_dst_port = cpu_to_le16(start_params->vxlan_dst_port); + rdata->geneve_dst_port = cpu_to_le16(start_params->geneve_dst_port); +-- +2.19.1 + diff --git a/queue-4.19/bnxt_en-fix-filling-time-in-bnxt_fill_coredump_recor.patch b/queue-4.19/bnxt_en-fix-filling-time-in-bnxt_fill_coredump_recor.patch new file mode 100644 index 00000000000..10c22e0c639 --- /dev/null +++ b/queue-4.19/bnxt_en-fix-filling-time-in-bnxt_fill_coredump_recor.patch @@ -0,0 +1,37 @@ +From 212ae7781782004892808ea180c6b3d00448f06d Mon Sep 17 00:00:00 2001 +From: Vasundhara Volam +Date: Thu, 15 Nov 2018 03:25:42 -0500 +Subject: bnxt_en: Fix filling time in bnxt_fill_coredump_record() + +[ Upstream commit 8dc5ae2d48976764cf3498e97963fa06befefb0e ] + +Fix the year and month offset while storing it in +bnxt_fill_coredump_record(). + +Fixes: 6c5657d085ae ("bnxt_en: Add support for ethtool get dump.") +Signed-off-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index e52d7af3ab3e..da9b87689996 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -2862,8 +2862,8 @@ bnxt_fill_coredump_record(struct bnxt *bp, struct bnxt_coredump_record *record, + record->asic_state = 0; + strlcpy(record->system_name, utsname()->nodename, + sizeof(record->system_name)); +- record->year = cpu_to_le16(tm.tm_year); +- record->month = cpu_to_le16(tm.tm_mon); ++ record->year = cpu_to_le16(tm.tm_year + 1900); ++ record->month = cpu_to_le16(tm.tm_mon + 1); + record->day = cpu_to_le16(tm.tm_mday); + record->hour = cpu_to_le16(tm.tm_hour); + record->minute = cpu_to_le16(tm.tm_min); +-- +2.19.1 + diff --git a/queue-4.19/brcmutil-really-fix-decoding-channel-info-for-160-mh.patch b/queue-4.19/brcmutil-really-fix-decoding-channel-info-for-160-mh.patch new file mode 100644 index 00000000000..52651626420 --- /dev/null +++ b/queue-4.19/brcmutil-really-fix-decoding-channel-info-for-160-mh.patch @@ -0,0 +1,48 @@ +From fce5b3d696ed8d7b2951e1a603ae32f6f809611d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Fri, 26 Oct 2018 12:50:39 +0200 +Subject: brcmutil: really fix decoding channel info for 160 MHz bandwidth +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 3401d42c7ea2d064d15c66698ff8eb96553179ce ] + +Previous commit /adding/ support for 160 MHz chanspecs was incomplete. +It didn't set bandwidth info and didn't extract control channel info. As +the result it was also using uninitialized "sb" var. + +This change has been tested for two chanspecs found to be reported by +some devices/firmwares: +1) 60/160 (0xee32) + Before: chnum:50 control_ch_num:36 + After: chnum:50 control_ch_num:60 +2) 120/160 (0xed72) + Before: chnum:114 control_ch_num:100 + After: chnum:114 control_ch_num:120 + +Fixes: 330994e8e8ec ("brcmfmac: fix for proper support of 160MHz bandwidth") +Signed-off-by: Rafał Miłecki +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c +index e7584b842dce..eb5db94f5745 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c +@@ -193,6 +193,9 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch) + } + break; + case BRCMU_CHSPEC_D11AC_BW_160: ++ ch->bw = BRCMU_CHAN_BW_160; ++ ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK, ++ BRCMU_CHSPEC_D11AC_SB_SHIFT); + switch (ch->sb) { + case BRCMU_CHAN_SB_LLL: + ch->control_ch_num -= CH_70MHZ_APART; +-- +2.19.1 + diff --git a/queue-4.19/can-rcar_can-fix-erroneous-registration.patch b/queue-4.19/can-rcar_can-fix-erroneous-registration.patch new file mode 100644 index 00000000000..f2fb359f85c --- /dev/null +++ b/queue-4.19/can-rcar_can-fix-erroneous-registration.patch @@ -0,0 +1,47 @@ +From fa4fe6f939e5a75f822644bd1edf2210ad68fdcf Mon Sep 17 00:00:00 2001 +From: Fabrizio Castro +Date: Mon, 10 Sep 2018 11:43:13 +0100 +Subject: can: rcar_can: Fix erroneous registration + +[ Upstream commit 68c8d209cd4337da4fa04c672f0b62bb735969bc ] + +Assigning 2 to "renesas,can-clock-select" tricks the driver into +registering the CAN interface, even though we don't want that. +This patch improves one of the checks to prevent that from happening. + +Fixes: 862e2b6af9413b43 ("can: rcar_can: support all input clocks") +Signed-off-by: Fabrizio Castro +Signed-off-by: Chris Paterson +Reviewed-by: Simon Horman +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rcar/rcar_can.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c +index 11662f479e76..771a46083739 100644 +--- a/drivers/net/can/rcar/rcar_can.c ++++ b/drivers/net/can/rcar/rcar_can.c +@@ -24,6 +24,9 @@ + + #define RCAR_CAN_DRV_NAME "rcar_can" + ++#define RCAR_SUPPORTED_CLOCKS (BIT(CLKR_CLKP1) | BIT(CLKR_CLKP2) | \ ++ BIT(CLKR_CLKEXT)) ++ + /* Mailbox configuration: + * mailbox 60 - 63 - Rx FIFO mailboxes + * mailbox 56 - 59 - Tx FIFO mailboxes +@@ -789,7 +792,7 @@ static int rcar_can_probe(struct platform_device *pdev) + goto fail_clk; + } + +- if (clock_select >= ARRAY_SIZE(clock_names)) { ++ if (!(BIT(clock_select) & RCAR_SUPPORTED_CLOCKS)) { + err = -EINVAL; + dev_err(&pdev->dev, "invalid CAN clock selected\n"); + goto fail_clk; +-- +2.19.1 + diff --git a/queue-4.19/can-ucan-remove-set-but-not-used-variable-udev.patch b/queue-4.19/can-ucan-remove-set-but-not-used-variable-udev.patch new file mode 100644 index 00000000000..3f13e68a147 --- /dev/null +++ b/queue-4.19/can-ucan-remove-set-but-not-used-variable-udev.patch @@ -0,0 +1,41 @@ +From 7d4465ddb12ac8874bee0ff89cf4a59e66980455 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Wed, 29 Aug 2018 01:46:54 +0000 +Subject: can: ucan: remove set but not used variable 'udev' + +[ Upstream commit 207681fc5f3d5d398f106d1ae0080fc2373f707a ] + +Fixes gcc '-Wunused-but-set-variable' warning: + +drivers/net/can/usb/ucan.c: In function 'ucan_disconnect': +drivers/net/can/usb/ucan.c:1578:21: warning: + variable 'udev' set but not used [-Wunused-but-set-variable] + struct usb_device *udev; + +Signed-off-by: YueHaibing +Reviewed-by: Martin Elshuber +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/ucan.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/can/usb/ucan.c b/drivers/net/can/usb/ucan.c +index 0678a38b1af4..c9fd83e8d947 100644 +--- a/drivers/net/can/usb/ucan.c ++++ b/drivers/net/can/usb/ucan.c +@@ -1575,11 +1575,8 @@ err_firmware_needs_update: + /* disconnect the device */ + static void ucan_disconnect(struct usb_interface *intf) + { +- struct usb_device *udev; + struct ucan_priv *up = usb_get_intfdata(intf); + +- udev = interface_to_usbdev(intf); +- + usb_set_intfdata(intf, NULL); + + if (up) { +-- +2.19.1 + diff --git a/queue-4.19/cpufreq-ti-cpufreq-only-register-platform_device-whe.patch b/queue-4.19/cpufreq-ti-cpufreq-only-register-platform_device-whe.patch new file mode 100644 index 00000000000..60812ce2787 --- /dev/null +++ b/queue-4.19/cpufreq-ti-cpufreq-only-register-platform_device-whe.patch @@ -0,0 +1,79 @@ +From 8bd74b34049c6007e42781406dbb6fcfb1b83da1 Mon Sep 17 00:00:00 2001 +From: Dave Gerlach +Date: Tue, 13 Nov 2018 13:30:40 -0600 +Subject: cpufreq: ti-cpufreq: Only register platform_device when supported + +[ Upstream commit d98ccfc3948ab63152494bb6b9c17e15295c0310 ] + +Currently the ti-cpufreq driver blindly registers a 'ti-cpufreq' to force +the driver to probe on any platforms where the driver is built in. +However, this should only happen on platforms that actually can make use +of the driver. There is already functionality in place to match the +SoC compatible so let's factor this out into a separate call and +make sure we find a match before creating the ti-cpufreq platform device. + +Reviewed-by: Johan Hovold +Signed-off-by: Dave Gerlach +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/ti-cpufreq.c | 26 +++++++++++++++++++++----- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c +index 3f0e2a14895a..22b53bf26817 100644 +--- a/drivers/cpufreq/ti-cpufreq.c ++++ b/drivers/cpufreq/ti-cpufreq.c +@@ -201,19 +201,28 @@ static const struct of_device_id ti_cpufreq_of_match[] = { + {}, + }; + ++static const struct of_device_id *ti_cpufreq_match_node(void) ++{ ++ struct device_node *np; ++ const struct of_device_id *match; ++ ++ np = of_find_node_by_path("/"); ++ match = of_match_node(ti_cpufreq_of_match, np); ++ of_node_put(np); ++ ++ return match; ++} ++ + static int ti_cpufreq_probe(struct platform_device *pdev) + { + u32 version[VERSION_COUNT]; +- struct device_node *np; + const struct of_device_id *match; + struct opp_table *ti_opp_table; + struct ti_cpufreq_data *opp_data; + const char * const reg_names[] = {"vdd", "vbb"}; + int ret; + +- np = of_find_node_by_path("/"); +- match = of_match_node(ti_cpufreq_of_match, np); +- of_node_put(np); ++ match = dev_get_platdata(&pdev->dev); + if (!match) + return -ENODEV; + +@@ -290,7 +299,14 @@ fail_put_node: + + static int ti_cpufreq_init(void) + { +- platform_device_register_simple("ti-cpufreq", -1, NULL, 0); ++ const struct of_device_id *match; ++ ++ /* Check to ensure we are on a compatible platform */ ++ match = ti_cpufreq_match_node(); ++ if (match) ++ platform_device_register_data(NULL, "ti-cpufreq", -1, match, ++ sizeof(*match)); ++ + return 0; + } + module_init(ti_cpufreq_init); +-- +2.19.1 + diff --git a/queue-4.19/drivers-net-ethernet-qlogic-qed-qed_rdma.h-fix-typo.patch b/queue-4.19/drivers-net-ethernet-qlogic-qed-qed_rdma.h-fix-typo.patch new file mode 100644 index 00000000000..c471a4f9bbf --- /dev/null +++ b/queue-4.19/drivers-net-ethernet-qlogic-qed-qed_rdma.h-fix-typo.patch @@ -0,0 +1,36 @@ +From 60423f77fbd66249640619a8ad8110d9c8d82262 Mon Sep 17 00:00:00 2001 +From: Andrew Morton +Date: Thu, 15 Nov 2018 16:15:20 -0800 +Subject: drivers/net/ethernet/qlogic/qed/qed_rdma.h: fix typo + +[ Upstream commit a97b9565338350d70d8d971c4ee6f0d4fa967418 ] + +Add missing semicolon. + +Fixes: 291d57f67d244973 ("qed: Fix rdma_info structure allocation") +Cc: Michal Kalderon +Cc: Denis Bolotin +Cc: David S. Miller +Signed-off-by: Andrew Morton +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_rdma.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.h b/drivers/net/ethernet/qlogic/qed/qed_rdma.h +index 50d609c0e108..3689fe3e5935 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.h +@@ -183,7 +183,7 @@ void qed_rdma_info_free(struct qed_hwfn *p_hwfn); + static inline void qed_rdma_dpm_conf(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) {} + static inline void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn, + struct qed_ptt *p_ptt) {} +-static inline int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn) {return -EINVAL} ++static inline int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn) {return -EINVAL;} + static inline void qed_rdma_info_free(struct qed_hwfn *p_hwfn) {} + #endif + +-- +2.19.1 + diff --git a/queue-4.19/drm-amd-display-support-amdgpu-max-bpc-connector-pro.patch b/queue-4.19/drm-amd-display-support-amdgpu-max-bpc-connector-pro.patch new file mode 100644 index 00000000000..09b0feb59a7 --- /dev/null +++ b/queue-4.19/drm-amd-display-support-amdgpu-max-bpc-connector-pro.patch @@ -0,0 +1,110 @@ +From 43a019b40f4326beee125022764058913ae78f65 Mon Sep 17 00:00:00 2001 +From: Nicholas Kazlauskas +Date: Thu, 15 Nov 2018 17:21:34 -0500 +Subject: drm/amd/display: Support amdgpu "max bpc" connector property (v2) + +[ Upstream commit 07e3a1cfb0568b6d8d7862077029af96af6690ea ] + +[Why] +Many panels support more than 8bpc but some modes are unavailable while +running at greater than 8bpc due to DP/HDMI bandwidth constraints. + +Support for more than 8bpc was added recently in the driver but it +defaults to the maximum supported bpc - locking out these modes. + +This should be a user configurable option such that the user can select +what bpc configuration they would like. + +[How] +This patch adds support for getting and setting the amdgpu driver +specific "max bpc" property on the connector. + +It also adds support for limiting the output bpc based on the property +value. The default limitation is the lowest value in the range, 8bpc. +This was the old value before the range was uncapped. + +This patch should be updated/replaced later once common drm support +for max bpc lands. + +Bugzilla: https://bugs.freedesktop.org/108542 +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201585 +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200645 +Fixes: e03fd3f300f6 ("drm/amd/display: Do not limit color depth to 8bpc") + +v2: rebase on upstream (Alex) + +Signed-off-by: Nicholas Kazlauskas +Acked-by: Alex Deucher +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 16 ++++++++++++++++ + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 1 + + 2 files changed, 17 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index ef5c6af4d964..299def84e69c 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2213,8 +2213,15 @@ static void update_stream_scaling_settings(const struct drm_display_mode *mode, + static enum dc_color_depth + convert_color_depth_from_display_info(const struct drm_connector *connector) + { ++ struct dm_connector_state *dm_conn_state = ++ to_dm_connector_state(connector->state); + uint32_t bpc = connector->display_info.bpc; + ++ /* TODO: Remove this when there's support for max_bpc in drm */ ++ if (dm_conn_state && bpc > dm_conn_state->max_bpc) ++ /* Round down to nearest even number. */ ++ bpc = dm_conn_state->max_bpc - (dm_conn_state->max_bpc & 1); ++ + switch (bpc) { + case 0: + /* Temporary Work around, DRM don't parse color depth for +@@ -2796,6 +2803,9 @@ int amdgpu_dm_connector_atomic_set_property(struct drm_connector *connector, + } else if (property == adev->mode_info.underscan_property) { + dm_new_state->underscan_enable = val; + ret = 0; ++ } else if (property == adev->mode_info.max_bpc_property) { ++ dm_new_state->max_bpc = val; ++ ret = 0; + } + + return ret; +@@ -2838,6 +2848,9 @@ int amdgpu_dm_connector_atomic_get_property(struct drm_connector *connector, + } else if (property == adev->mode_info.underscan_property) { + *val = dm_state->underscan_enable; + ret = 0; ++ } else if (property == adev->mode_info.max_bpc_property) { ++ *val = dm_state->max_bpc; ++ ret = 0; + } + return ret; + } +@@ -3658,6 +3671,9 @@ void amdgpu_dm_connector_init_helper(struct amdgpu_display_manager *dm, + drm_object_attach_property(&aconnector->base.base, + adev->mode_info.underscan_vborder_property, + 0); ++ drm_object_attach_property(&aconnector->base.base, ++ adev->mode_info.max_bpc_property, ++ 0); + + } + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +index aba2c5c1d2f8..74aedcffc4bb 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +@@ -213,6 +213,7 @@ struct dm_connector_state { + enum amdgpu_rmx_type scaling; + uint8_t underscan_vborder; + uint8_t underscan_hborder; ++ uint8_t max_bpc; + bool underscan_enable; + struct mod_freesync_user_enable user_enable; + bool freesync_capable; +-- +2.19.1 + diff --git a/queue-4.19/drm-amdgpu-add-amdgpu-max-bpc-connector-property-v2.patch b/queue-4.19/drm-amdgpu-add-amdgpu-max-bpc-connector-property-v2.patch new file mode 100644 index 00000000000..13f11771fac --- /dev/null +++ b/queue-4.19/drm-amdgpu-add-amdgpu-max-bpc-connector-property-v2.patch @@ -0,0 +1,73 @@ +From 60ecc80d90b74214169395d7a45cdece1c11b52e Mon Sep 17 00:00:00 2001 +From: Nicholas Kazlauskas +Date: Thu, 15 Nov 2018 17:19:12 -0500 +Subject: drm/amdgpu: Add amdgpu "max bpc" connector property (v2) + +[ Upstream commit 69756c6ff0de478c10100481f16c966dde3b5339 ] + +[Why] +Many panels support more than 8bpc but some modes are unavailable while +running at greater than 8bpc due to DP/HDMI bandwidth constraints. + +Support for more than 8bpc was added recently in the driver but it +defaults to the maximum supported bpc - locking out these modes. + +This should be a user configurable option such that the user can select +what bpc configuration they would like. + +[How] +This patch introduces the "max bpc" amdgpu driver specific connector +property so the user can limit the maximum bpc. It ranges from 8 to 16. + +This doesn't directly set the preferred bpc for the panel since it +follows Intel's existing driver conventions. + +This proprety should be removed once common drm support for max bpc +lands. + +v2: rebase on upstream (Alex) + +Signed-off-by: Nicholas Kazlauskas +Acked-by: Alex Deucher +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 7 +++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h | 2 ++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +index 6748cd7fc129..686a26de50f9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +@@ -626,6 +626,13 @@ int amdgpu_display_modeset_create_props(struct amdgpu_device *adev) + "dither", + amdgpu_dither_enum_list, sz); + ++ if (amdgpu_device_has_dc_support(adev)) { ++ adev->mode_info.max_bpc_property = ++ drm_property_create_range(adev->ddev, 0, "max bpc", 8, 16); ++ if (!adev->mode_info.max_bpc_property) ++ return -ENOMEM; ++ } ++ + return 0; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h +index b9e9e8b02fb7..d1b4d9b6aae0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h +@@ -339,6 +339,8 @@ struct amdgpu_mode_info { + struct drm_property *audio_property; + /* FMT dithering */ + struct drm_property *dither_property; ++ /* maximum number of bits per channel for monitor color */ ++ struct drm_property *max_bpc_property; + /* hardcoded DFP edid from BIOS */ + struct edid *bios_hardcoded_edid; + int bios_hardcoded_edid_size; +-- +2.19.1 + diff --git a/queue-4.19/exec-make-de_thread-freezable.patch b/queue-4.19/exec-make-de_thread-freezable.patch new file mode 100644 index 00000000000..bd891a60d6d --- /dev/null +++ b/queue-4.19/exec-make-de_thread-freezable.patch @@ -0,0 +1,76 @@ +From 03fe98edae2fb05c36314d59d19dc9d277462db3 Mon Sep 17 00:00:00 2001 +From: Chanho Min +Date: Mon, 12 Nov 2018 12:54:45 +0900 +Subject: exec: make de_thread() freezable + +[ Upstream commit c22397888f1eed98cd59f0a88f2a5f6925f80e15 ] + +Suspend fails due to the exec family of functions blocking the freezer. +The casue is that de_thread() sleeps in TASK_UNINTERRUPTIBLE waiting for +all sub-threads to die, and we have the deadlock if one of them is frozen. +This also can occur with the schedule() waiting for the group thread leader +to exit if it is frozen. + +In our machine, it causes freeze timeout as bellows. + +Freezing of tasks failed after 20.010 seconds (1 tasks refusing to freeze, wq_busy=0): +setcpushares-ls D ffffffc00008ed70 0 5817 1483 0x0040000d + Call trace: +[] __switch_to+0x88/0xa0 +[] __schedule+0x1bc/0x720 +[] schedule+0x40/0xa8 +[] flush_old_exec+0xdc/0x640 +[] load_elf_binary+0x2a8/0x1090 +[] search_binary_handler+0x9c/0x240 +[] load_script+0x20c/0x228 +[] search_binary_handler+0x9c/0x240 +[] do_execveat_common.isra.14+0x4f8/0x6e8 +[] compat_SyS_execve+0x38/0x48 +[] el0_svc_naked+0x24/0x28 + +To fix this, make de_thread() freezable. It looks safe and works fine. + +Suggested-by: Oleg Nesterov +Signed-off-by: Chanho Min +Acked-by: Oleg Nesterov +Acked-by: Pavel Machek +Acked-by: Michal Hocko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + fs/exec.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/exec.c b/fs/exec.c +index 1ebf6e5a521d..6da8745857cb 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -62,6 +62,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -1083,7 +1084,7 @@ static int de_thread(struct task_struct *tsk) + while (sig->notify_count) { + __set_current_state(TASK_KILLABLE); + spin_unlock_irq(lock); +- schedule(); ++ freezable_schedule(); + if (unlikely(__fatal_signal_pending(tsk))) + goto killed; + spin_lock_irq(lock); +@@ -1111,7 +1112,7 @@ static int de_thread(struct task_struct *tsk) + __set_current_state(TASK_KILLABLE); + write_unlock_irq(&tasklist_lock); + cgroup_threadgroup_change_end(tsk); +- schedule(); ++ freezable_schedule(); + if (unlikely(__fatal_signal_pending(tsk))) + goto killed; + } +-- +2.19.1 + diff --git a/queue-4.19/flexfiles-use-per-mirror-specified-stateid-for-io.patch b/queue-4.19/flexfiles-use-per-mirror-specified-stateid-for-io.patch new file mode 100644 index 00000000000..521afe720ff --- /dev/null +++ b/queue-4.19/flexfiles-use-per-mirror-specified-stateid-for-io.patch @@ -0,0 +1,129 @@ +From 83e3bc01d9c703a2f0182ad834fee4b4b41b7607 Mon Sep 17 00:00:00 2001 +From: Tigran Mkrtchyan +Date: Wed, 21 Nov 2018 12:25:41 +0100 +Subject: flexfiles: use per-mirror specified stateid for IO + +[ Upstream commit bb21ce0ad227b69ec0f83279297ee44232105d96 ] + +rfc8435 says: + + For tight coupling, ffds_stateid provides the stateid to be used by + the client to access the file. + +However current implementation replaces per-mirror provided stateid with +by open or lock stateid. + +Ensure that per-mirror stateid is used by ff_layout_write_prepare_v4 and +nfs4_ff_layout_prepare_ds. + +Signed-off-by: Tigran Mkrtchyan +Signed-off-by: Rick Macklem +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/flexfilelayout/flexfilelayout.c | 21 +++++++++------------ + fs/nfs/flexfilelayout/flexfilelayout.h | 4 ++++ + fs/nfs/flexfilelayout/flexfilelayoutdev.c | 19 +++++++++++++++++++ + 3 files changed, 32 insertions(+), 12 deletions(-) + +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c +index cae43333ef16..86ac2c5b93fe 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -1361,12 +1361,7 @@ static void ff_layout_read_prepare_v4(struct rpc_task *task, void *data) + task)) + return; + +- if (ff_layout_read_prepare_common(task, hdr)) +- return; +- +- if (nfs4_set_rw_stateid(&hdr->args.stateid, hdr->args.context, +- hdr->args.lock_context, FMODE_READ) == -EIO) +- rpc_exit(task, -EIO); /* lost lock, terminate I/O */ ++ ff_layout_read_prepare_common(task, hdr); + } + + static void ff_layout_read_call_done(struct rpc_task *task, void *data) +@@ -1542,12 +1537,7 @@ static void ff_layout_write_prepare_v4(struct rpc_task *task, void *data) + task)) + return; + +- if (ff_layout_write_prepare_common(task, hdr)) +- return; +- +- if (nfs4_set_rw_stateid(&hdr->args.stateid, hdr->args.context, +- hdr->args.lock_context, FMODE_WRITE) == -EIO) +- rpc_exit(task, -EIO); /* lost lock, terminate I/O */ ++ ff_layout_write_prepare_common(task, hdr); + } + + static void ff_layout_write_call_done(struct rpc_task *task, void *data) +@@ -1742,6 +1732,10 @@ ff_layout_read_pagelist(struct nfs_pgio_header *hdr) + fh = nfs4_ff_layout_select_ds_fh(lseg, idx); + if (fh) + hdr->args.fh = fh; ++ ++ if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid)) ++ goto out_failed; ++ + /* + * Note that if we ever decide to split across DSes, + * then we may need to handle dense-like offsets. +@@ -1804,6 +1798,9 @@ ff_layout_write_pagelist(struct nfs_pgio_header *hdr, int sync) + if (fh) + hdr->args.fh = fh; + ++ if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid)) ++ goto out_failed; ++ + /* + * Note that if we ever decide to split across DSes, + * then we may need to handle dense-like offsets. +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h +index 411798346e48..de50a342d5a5 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.h ++++ b/fs/nfs/flexfilelayout/flexfilelayout.h +@@ -215,6 +215,10 @@ unsigned int ff_layout_fetch_ds_ioerr(struct pnfs_layout_hdr *lo, + unsigned int maxnum); + struct nfs_fh * + nfs4_ff_layout_select_ds_fh(struct pnfs_layout_segment *lseg, u32 mirror_idx); ++int ++nfs4_ff_layout_select_ds_stateid(struct pnfs_layout_segment *lseg, ++ u32 mirror_idx, ++ nfs4_stateid *stateid); + + struct nfs4_pnfs_ds * + nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx, +diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +index 59aa04976331..a8df2f496898 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c ++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +@@ -370,6 +370,25 @@ out: + return fh; + } + ++int ++nfs4_ff_layout_select_ds_stateid(struct pnfs_layout_segment *lseg, ++ u32 mirror_idx, ++ nfs4_stateid *stateid) ++{ ++ struct nfs4_ff_layout_mirror *mirror = FF_LAYOUT_COMP(lseg, mirror_idx); ++ ++ if (!ff_layout_mirror_valid(lseg, mirror, false)) { ++ pr_err_ratelimited("NFS: %s: No data server for mirror offset index %d\n", ++ __func__, mirror_idx); ++ goto out; ++ } ++ ++ nfs4_stateid_copy(stateid, &mirror->stateid); ++ return 1; ++out: ++ return 0; ++} ++ + /** + * nfs4_ff_layout_prepare_ds - prepare a DS connection for an RPC call + * @lseg: the layout segment we're operating on +-- +2.19.1 + diff --git a/queue-4.19/gpio-mockup-fix-indicated-direction.patch b/queue-4.19/gpio-mockup-fix-indicated-direction.patch new file mode 100644 index 00000000000..61e0c184f2f --- /dev/null +++ b/queue-4.19/gpio-mockup-fix-indicated-direction.patch @@ -0,0 +1,47 @@ +From db693788224880eb1262bba75d40b91df003001e Mon Sep 17 00:00:00 2001 +From: Bartosz Golaszewski +Date: Thu, 8 Nov 2018 17:52:53 +0100 +Subject: gpio: mockup: fix indicated direction + +[ Upstream commit bff466bac59994cfcceabe4d0be5fdc1c20cd5b8 ] + +Commit 3edfb7bd76bd ("gpiolib: Show correct direction from the +beginning") fixed an existing issue but broke libgpiod tests by +changing the default direction of dummy lines to output. + +We don't break user-space so make gpio-mockup behave as before. + +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mockup.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c +index d66b7a768ecd..945bd13e5e79 100644 +--- a/drivers/gpio/gpio-mockup.c ++++ b/drivers/gpio/gpio-mockup.c +@@ -32,8 +32,8 @@ + #define gpio_mockup_err(...) pr_err(GPIO_MOCKUP_NAME ": " __VA_ARGS__) + + enum { +- GPIO_MOCKUP_DIR_OUT = 0, +- GPIO_MOCKUP_DIR_IN = 1, ++ GPIO_MOCKUP_DIR_IN = 0, ++ GPIO_MOCKUP_DIR_OUT = 1, + }; + + /* +@@ -135,7 +135,7 @@ static int gpio_mockup_get_direction(struct gpio_chip *gc, unsigned int offset) + { + struct gpio_mockup_chip *chip = gpiochip_get_data(gc); + +- return chip->lines[offset].dir; ++ return !chip->lines[offset].dir; + } + + static int gpio_mockup_to_irq(struct gpio_chip *gc, unsigned int offset) +-- +2.19.1 + diff --git a/queue-4.19/gpio-pxa-fix-legacy-non-pinctrl-aware-builds-again.patch b/queue-4.19/gpio-pxa-fix-legacy-non-pinctrl-aware-builds-again.patch new file mode 100644 index 00000000000..59719a3d54a --- /dev/null +++ b/queue-4.19/gpio-pxa-fix-legacy-non-pinctrl-aware-builds-again.patch @@ -0,0 +1,54 @@ +From 822cdcbb4e9e56bf6fb65d9f96e2e92c76dd4228 Mon Sep 17 00:00:00 2001 +From: Robert Jarzmik +Date: Thu, 15 Nov 2018 18:16:38 +0100 +Subject: gpio: pxa: fix legacy non pinctrl aware builds again + +[ Upstream commit 70cdb6ad6dc342d9643a00c9092e88f0075f2b9a ] + +As pointed out by Gregor, spitz keyboard matrix is broken, with or +without CONFIG_PINCTRL set, quoting : +"The gpio matrix keypard on the Zaurus C3x00 (see spitz.c) does not work +properly. Noticeable are that rshift+c does nothing where as lshift+c +creates C. Opposite it is for rshift+a vs lshift+a, here only rshift +works. This affects a few other combinations using the rshift or lshift +buttons." + +As a matter of fact, as for platform_data based builds CONFIG_PINCTRL=n +is required for now (as opposed for devicetree builds where it should be +set), this means gpio driver should change the direction, which is what +was attempted by commit c4e5ffb6f224 ("gpio: pxa: fix legacy non pinctrl +aware builds"). + +Unfortunately, the input case was inverted, and the direction change was +never done. This wasn't seen up until now because the initial platform +setup (MFP) was setting this direction. Yet in Gregory's case, the +matrix-keypad driver changes back and forth the direction dynamically, +and this is why he's the first to report it. + +Fixes: c4e5ffb6f224 ("gpio: pxa: fix legacy non pinctrl aware builds") +Tested-by: Greg +Signed-off-by: Robert Jarzmik +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-pxa.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c +index c18712dabf93..9f3f166f1760 100644 +--- a/drivers/gpio/gpio-pxa.c ++++ b/drivers/gpio/gpio-pxa.c +@@ -268,8 +268,8 @@ static int pxa_gpio_direction_input(struct gpio_chip *chip, unsigned offset) + + if (pxa_gpio_has_pinctrl()) { + ret = pinctrl_gpio_direction_input(chip->base + offset); +- if (!ret) +- return 0; ++ if (ret) ++ return ret; + } + + spin_lock_irqsave(&gpio_lock, flags); +-- +2.19.1 + diff --git a/queue-4.19/hid-input-ignore-battery-reported-by-symbol-ds4308.patch b/queue-4.19/hid-input-ignore-battery-reported-by-symbol-ds4308.patch new file mode 100644 index 00000000000..48f6f22e44d --- /dev/null +++ b/queue-4.19/hid-input-ignore-battery-reported-by-symbol-ds4308.patch @@ -0,0 +1,56 @@ +From db735935e1cd09da3db03001db063bfeba322b75 Mon Sep 17 00:00:00 2001 +From: Benson Leung +Date: Thu, 8 Nov 2018 15:59:21 -0800 +Subject: HID: input: Ignore battery reported by Symbol DS4308 + +[ Upstream commit 0fd791841a6d67af1155a9c3de54dea51220721e ] + +The Motorola/Zebra Symbol DS4308-HD is a handheld USB barcode scanner +which does not have a battery, but reports one anyway that always has +capacity 2. + +Let's apply the IGNORE quirk to prevent it from being treated like a +power supply so that userspaces don't get confused that this +accessory is almost out of power and warn the user that they need to charge +their wired barcode scanner. + +Reported here: https://bugs.chromium.org/p/chromium/issues/detail?id=804720 + +Signed-off-by: Benson Leung +Reviewed-by: Benjamin Tissoires +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-input.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 501c05cbec7e..a2d25055cd7f 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1038,6 +1038,7 @@ + #define USB_VENDOR_ID_SYMBOL 0x05e0 + #define USB_DEVICE_ID_SYMBOL_SCANNER_1 0x0800 + #define USB_DEVICE_ID_SYMBOL_SCANNER_2 0x1300 ++#define USB_DEVICE_ID_SYMBOL_SCANNER_3 0x1200 + + #define USB_VENDOR_ID_SYNAPTICS 0x06cb + #define USB_DEVICE_ID_SYNAPTICS_TP 0x0001 +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index a481eaf39e88..a3916e58dbf5 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -325,6 +325,9 @@ static const struct hid_device_id hid_battery_quirks[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, + USB_DEVICE_ID_ELECOM_BM084), + HID_BATTERY_QUIRK_IGNORE }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_SYMBOL, ++ USB_DEVICE_ID_SYMBOL_SCANNER_3), ++ HID_BATTERY_QUIRK_IGNORE }, + {} + }; + +-- +2.19.1 + diff --git a/queue-4.19/hid-multitouch-add-pointstick-support-for-cirque-tou.patch b/queue-4.19/hid-multitouch-add-pointstick-support-for-cirque-tou.patch new file mode 100644 index 00000000000..8c55a87f8d9 --- /dev/null +++ b/queue-4.19/hid-multitouch-add-pointstick-support-for-cirque-tou.patch @@ -0,0 +1,52 @@ +From c6b7a5c2cd241cb1f7bbb83534a4ba274201a663 Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Wed, 14 Nov 2018 05:35:20 +0000 +Subject: HID: multitouch: Add pointstick support for Cirque Touchpad + +[ Upstream commit 12d43aacf9a74d0eb66fd0ea54ebeb79ca28940f ] + +Cirque Touchpad/Pointstick combo is similar to Alps devices, it requires +MT_CLS_WIN_8_DUAL to expose its pointstick as a mouse. + +Signed-off-by: Kai-Heng Feng +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-multitouch.c | 6 ++++++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index a2d25055cd7f..b71c3600f470 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -271,6 +271,9 @@ + + #define USB_VENDOR_ID_CIDC 0x1677 + ++#define I2C_VENDOR_ID_CIRQUE 0x0488 ++#define I2C_PRODUCT_ID_CIRQUE_121F 0x121F ++ + #define USB_VENDOR_ID_CJTOUCH 0x24b8 + #define USB_DEVICE_ID_CJTOUCH_MULTI_TOUCH_0020 0x0020 + #define USB_DEVICE_ID_CJTOUCH_MULTI_TOUCH_0040 0x0040 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index da954f3f4da7..2faf5421fdd0 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1822,6 +1822,12 @@ static const struct hid_device_id mt_devices[] = { + MT_USB_DEVICE(USB_VENDOR_ID_CHUNGHWAT, + USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH) }, + ++ /* Cirque devices */ ++ { .driver_data = MT_CLS_WIN_8_DUAL, ++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, ++ I2C_VENDOR_ID_CIRQUE, ++ I2C_PRODUCT_ID_CIRQUE_121F) }, ++ + /* CJTouch panels */ + { .driver_data = MT_CLS_NSMU, + MT_USB_DEVICE(USB_VENDOR_ID_CJTOUCH, +-- +2.19.1 + diff --git a/queue-4.19/ibmvnic-fix-rx-queue-buffer-cleanup.patch b/queue-4.19/ibmvnic-fix-rx-queue-buffer-cleanup.patch new file mode 100644 index 00000000000..c29df75d275 --- /dev/null +++ b/queue-4.19/ibmvnic-fix-rx-queue-buffer-cleanup.patch @@ -0,0 +1,35 @@ +From 87db546507dd8c8fabd0233143832bd7c561f2dd Mon Sep 17 00:00:00 2001 +From: Thomas Falcon +Date: Wed, 21 Nov 2018 11:17:58 -0600 +Subject: ibmvnic: Fix RX queue buffer cleanup + +[ Upstream commit b7cdec3d699db2e5985ad39de0f25d3b6111928e ] + +The wrong index is used when cleaning up RX buffer objects during release +of RX queues. Update to use the correct index counter. + +Signed-off-by: Thomas Falcon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index a646de07cbdc..f1d4d7a1278b 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -485,8 +485,8 @@ static void release_rx_pools(struct ibmvnic_adapter *adapter) + + for (j = 0; j < rx_pool->size; j++) { + if (rx_pool->rx_buff[j].skb) { +- dev_kfree_skb_any(rx_pool->rx_buff[i].skb); +- rx_pool->rx_buff[i].skb = NULL; ++ dev_kfree_skb_any(rx_pool->rx_buff[j].skb); ++ rx_pool->rx_buff[j].skb = NULL; + } + } + +-- +2.19.1 + diff --git a/queue-4.19/ibmvnic-update-driver-queues-after-change-in-ring-si.patch b/queue-4.19/ibmvnic-update-driver-queues-after-change-in-ring-si.patch new file mode 100644 index 00000000000..deab71c0dbc --- /dev/null +++ b/queue-4.19/ibmvnic-update-driver-queues-after-change-in-ring-si.patch @@ -0,0 +1,56 @@ +From aecab503305f455fc85056e53bad435bf67e69ba Mon Sep 17 00:00:00 2001 +From: Thomas Falcon +Date: Wed, 21 Nov 2018 11:17:59 -0600 +Subject: ibmvnic: Update driver queues after change in ring size support + +[ Upstream commit 5bf032ef08e6a110edc1e3bfb3c66a208fb55125 ] + +During device reset, queue memory is not being updated to accommodate +changes in ring buffer sizes supported by backing hardware. Track +any differences in ring buffer sizes following the reset and update +queue memory when possible. + +Signed-off-by: Thomas Falcon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index f1d4d7a1278b..5ab21a1b5444 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1737,6 +1737,7 @@ static int do_reset(struct ibmvnic_adapter *adapter, + struct ibmvnic_rwi *rwi, u32 reset_state) + { + u64 old_num_rx_queues, old_num_tx_queues; ++ u64 old_num_rx_slots, old_num_tx_slots; + struct net_device *netdev = adapter->netdev; + int i, rc; + +@@ -1748,6 +1749,8 @@ static int do_reset(struct ibmvnic_adapter *adapter, + + old_num_rx_queues = adapter->req_rx_queues; + old_num_tx_queues = adapter->req_tx_queues; ++ old_num_rx_slots = adapter->req_rx_add_entries_per_subcrq; ++ old_num_tx_slots = adapter->req_tx_entries_per_subcrq; + + ibmvnic_cleanup(netdev); + +@@ -1810,7 +1813,11 @@ static int do_reset(struct ibmvnic_adapter *adapter, + if (rc) + return rc; + } else if (adapter->req_rx_queues != old_num_rx_queues || +- adapter->req_tx_queues != old_num_tx_queues) { ++ adapter->req_tx_queues != old_num_tx_queues || ++ adapter->req_rx_add_entries_per_subcrq != ++ old_num_rx_slots || ++ adapter->req_tx_entries_per_subcrq != ++ old_num_tx_slots) { + release_rx_pools(adapter); + release_tx_pools(adapter); + release_napi(adapter); +-- +2.19.1 + diff --git a/queue-4.19/iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch b/queue-4.19/iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch new file mode 100644 index 00000000000..ebe7356e731 --- /dev/null +++ b/queue-4.19/iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch @@ -0,0 +1,55 @@ +From 0d85a2116449017e422dc13f45c3735d03831921 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Wed, 7 Nov 2018 14:18:50 +0100 +Subject: iommu/ipmmu-vmsa: Fix crash on early domain free + +[ Upstream commit e5b78f2e349eef5d4fca5dc1cf5a3b4b2cc27abd ] + +If iommu_ops.add_device() fails, iommu_ops.domain_free() is still +called, leading to a crash, as the domain was only partially +initialized: + + ipmmu-vmsa e67b0000.mmu: Cannot accommodate DMA translation for IOMMU page tables + sata_rcar ee300000.sata: Unable to initialize IPMMU context + iommu: Failed to add device ee300000.sata to group 0: -22 + Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 + ... + Call trace: + ipmmu_domain_free+0x1c/0xa0 + iommu_group_release+0x48/0x68 + kobject_put+0x74/0xe8 + kobject_del.part.0+0x3c/0x50 + kobject_put+0x60/0xe8 + iommu_group_get_for_dev+0xa8/0x1f0 + ipmmu_add_device+0x1c/0x40 + of_iommu_configure+0x118/0x190 + +Fix this by checking if the domain's context already exists, before +trying to destroy it. + +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Robin Murphy +Fixes: d25a2a16f0889 ('iommu: Add driver for Renesas VMSA-compatible IPMMU') +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/ipmmu-vmsa.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index 22b94f8a9a04..d8598e44e381 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -501,6 +501,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain) + + static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain) + { ++ if (!domain->mmu) ++ return; ++ + /* + * Disable the context. Flush the TLB as required when modifying the + * context registers. +-- +2.19.1 + diff --git a/queue-4.19/iommu-vt-d-fix-null-pointer-dereference-in-prq_event.patch b/queue-4.19/iommu-vt-d-fix-null-pointer-dereference-in-prq_event.patch new file mode 100644 index 00000000000..45ef6e9c1dc --- /dev/null +++ b/queue-4.19/iommu-vt-d-fix-null-pointer-dereference-in-prq_event.patch @@ -0,0 +1,38 @@ +From 9ec3ed2d16b41c6fc4f8be4b838803802339c475 Mon Sep 17 00:00:00 2001 +From: Lu Baolu +Date: Mon, 5 Nov 2018 10:18:58 +0800 +Subject: iommu/vt-d: Fix NULL pointer dereference in prq_event_thread() + +[ Upstream commit 19ed3e2dd8549c1a34914e8dad01b64e7837645a ] + +When handling page request without pasid event, go to "no_pasid" +branch instead of "bad_req". Otherwise, a NULL pointer deference +will happen there. + +Cc: Ashok Raj +Cc: Jacob Pan +Cc: Sohil Mehta +Signed-off-by: Lu Baolu +Fixes: a222a7f0bb6c9 'iommu/vt-d: Implement page request handling' +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-svm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c +index 4a03e5090952..188f4eaed6e5 100644 +--- a/drivers/iommu/intel-svm.c ++++ b/drivers/iommu/intel-svm.c +@@ -596,7 +596,7 @@ static irqreturn_t prq_event_thread(int irq, void *d) + pr_err("%s: Page request without PASID: %08llx %08llx\n", + iommu->name, ((unsigned long long *)req)[0], + ((unsigned long long *)req)[1]); +- goto bad_req; ++ goto no_pasid; + } + + if (!svm || svm->pasid != req->pasid) { +-- +2.19.1 + diff --git a/queue-4.19/iommu-vt-d-use-memunmap-to-free-memremap.patch b/queue-4.19/iommu-vt-d-use-memunmap-to-free-memremap.patch new file mode 100644 index 00000000000..cca52b8de36 --- /dev/null +++ b/queue-4.19/iommu-vt-d-use-memunmap-to-free-memremap.patch @@ -0,0 +1,34 @@ +From f6b039a383f3ef5c012019608b51bdaa93a69620 Mon Sep 17 00:00:00 2001 +From: Pan Bian +Date: Wed, 21 Nov 2018 17:53:47 +0800 +Subject: iommu/vt-d: Use memunmap to free memremap + +[ Upstream commit 829383e183728dec7ed9150b949cd6de64127809 ] + +memunmap() should be used to free the return of memremap(), not +iounmap(). + +Fixes: dfddb969edf0 ('iommu/vt-d: Switch from ioremap_cache to memremap') +Signed-off-by: Pan Bian +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index bedc801b06a0..a76c47f20587 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -3100,7 +3100,7 @@ static int copy_context_table(struct intel_iommu *iommu, + } + + if (old_ce) +- iounmap(old_ce); ++ memunmap(old_ce); + + ret = 0; + if (devfn < 0x80) +-- +2.19.1 + diff --git a/queue-4.19/media-cec-check-for-non-ok-nack-conditions-while-cla.patch b/queue-4.19/media-cec-check-for-non-ok-nack-conditions-while-cla.patch new file mode 100644 index 00000000000..43103e85d19 --- /dev/null +++ b/queue-4.19/media-cec-check-for-non-ok-nack-conditions-while-cla.patch @@ -0,0 +1,95 @@ +From eba2666a7b094fa6e426554e44e751cbd622e103 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Wed, 10 Oct 2018 07:12:15 -0400 +Subject: media: cec: check for non-OK/NACK conditions while claiming a LA + +[ Upstream commit 55623b4169056d7bb493d1c6f715991f8db67302 ] + +During the configuration phase of a CEC adapter it is trying to claim a +free logical address by polling. + +However, the code doesn't check if there were errors other than OK or NACK, +those are just treated as if the poll was NACKed. + +Instead check for such errors and retry the poll. And if the problem persists +then don't claim this LA since there is something weird going on. + +Signed-off-by: Hans Verkuil +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/cec-adap.c | 47 ++++++++++++++++++++++++++++-------- + 1 file changed, 37 insertions(+), 10 deletions(-) + +diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c +index dd8bad74a1f0..a537e518384b 100644 +--- a/drivers/media/cec/cec-adap.c ++++ b/drivers/media/cec/cec-adap.c +@@ -1167,6 +1167,8 @@ static int cec_config_log_addr(struct cec_adapter *adap, + { + struct cec_log_addrs *las = &adap->log_addrs; + struct cec_msg msg = { }; ++ const unsigned int max_retries = 2; ++ unsigned int i; + int err; + + if (cec_has_log_addr(adap, log_addr)) +@@ -1175,19 +1177,44 @@ static int cec_config_log_addr(struct cec_adapter *adap, + /* Send poll message */ + msg.len = 1; + msg.msg[0] = (log_addr << 4) | log_addr; +- err = cec_transmit_msg_fh(adap, &msg, NULL, true); + +- /* +- * While trying to poll the physical address was reset +- * and the adapter was unconfigured, so bail out. +- */ +- if (!adap->is_configuring) +- return -EINTR; ++ for (i = 0; i < max_retries; i++) { ++ err = cec_transmit_msg_fh(adap, &msg, NULL, true); + +- if (err) +- return err; ++ /* ++ * While trying to poll the physical address was reset ++ * and the adapter was unconfigured, so bail out. ++ */ ++ if (!adap->is_configuring) ++ return -EINTR; ++ ++ if (err) ++ return err; + +- if (msg.tx_status & CEC_TX_STATUS_OK) ++ /* ++ * The message was aborted due to a disconnect or ++ * unconfigure, just bail out. ++ */ ++ if (msg.tx_status & CEC_TX_STATUS_ABORTED) ++ return -EINTR; ++ if (msg.tx_status & CEC_TX_STATUS_OK) ++ return 0; ++ if (msg.tx_status & CEC_TX_STATUS_NACK) ++ break; ++ /* ++ * Retry up to max_retries times if the message was neither ++ * OKed or NACKed. This can happen due to e.g. a Lost ++ * Arbitration condition. ++ */ ++ } ++ ++ /* ++ * If we are unable to get an OK or a NACK after max_retries attempts ++ * (and note that each attempt already consists of four polls), then ++ * then we assume that something is really weird and that it is not a ++ * good idea to try and claim this logical address. ++ */ ++ if (i == max_retries) + return 0; + + /* +-- +2.19.1 + diff --git a/queue-4.19/media-ipu3-cio2-unregister-device-nodes-first-then-r.patch b/queue-4.19/media-ipu3-cio2-unregister-device-nodes-first-then-r.patch new file mode 100644 index 00000000000..7bf5ab8927d --- /dev/null +++ b/queue-4.19/media-ipu3-cio2-unregister-device-nodes-first-then-r.patch @@ -0,0 +1,44 @@ +From 7f4a5db8a2e6ff35089a1c99b3d16d62bd036425 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Wed, 10 Oct 2018 04:01:05 -0400 +Subject: media: ipu3-cio2: Unregister device nodes first, then release + resources + +[ Upstream commit 32388d6ef7cffc7d8291b67f8dfa26acd45217fd ] + +While there are issues related to object lifetime management, unregister +the media device first, followed immediately by other device nodes when +the driver is being unbound. Only then the resources needed by the driver +may be released. This is slightly safer. + +Signed-off-by: Sakari Ailus +Tested-by: Bingbu Cao +Reviewed-by: Bingbu Cao +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu3/ipu3-cio2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c +index 29027159eced..ca1a4d8e972e 100644 +--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c ++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c +@@ -1846,12 +1846,12 @@ static void cio2_pci_remove(struct pci_dev *pci_dev) + struct cio2_device *cio2 = pci_get_drvdata(pci_dev); + unsigned int i; + ++ media_device_unregister(&cio2->media_dev); + cio2_notifier_exit(cio2); +- cio2_fbpt_exit_dummy(cio2); + for (i = 0; i < CIO2_QUEUES; i++) + cio2_queue_exit(cio2, &cio2->queue[i]); ++ cio2_fbpt_exit_dummy(cio2); + v4l2_device_unregister(&cio2->v4l2_dev); +- media_device_unregister(&cio2->media_dev); + media_device_cleanup(&cio2->media_dev); + mutex_destroy(&cio2->lock); + } +-- +2.19.1 + diff --git a/queue-4.19/media-omap3isp-unregister-media-device-as-first.patch b/queue-4.19/media-omap3isp-unregister-media-device-as-first.patch new file mode 100644 index 00000000000..b88d218a87b --- /dev/null +++ b/queue-4.19/media-omap3isp-unregister-media-device-as-first.patch @@ -0,0 +1,43 @@ +From 0f2061a6e1ded5fc73d9b23afcd9da5001857d31 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Tue, 9 Oct 2018 07:49:49 -0400 +Subject: media: omap3isp: Unregister media device as first + +[ Upstream commit 30efae3d789cd0714ef795545a46749236e29558 ] + +While there are issues related to object lifetime management, unregister the +media device first when the driver is being unbound. This is slightly +safer. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/isp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c +index 842e2235047d..432bc7fbedc9 100644 +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -1587,6 +1587,8 @@ static void isp_pm_complete(struct device *dev) + + static void isp_unregister_entities(struct isp_device *isp) + { ++ media_device_unregister(&isp->media_dev); ++ + omap3isp_csi2_unregister_entities(&isp->isp_csi2a); + omap3isp_ccp2_unregister_entities(&isp->isp_ccp2); + omap3isp_ccdc_unregister_entities(&isp->isp_ccdc); +@@ -1597,7 +1599,6 @@ static void isp_unregister_entities(struct isp_device *isp) + omap3isp_stat_unregister_entities(&isp->isp_hist); + + v4l2_device_unregister(&isp->v4l2_dev); +- media_device_unregister(&isp->media_dev); + media_device_cleanup(&isp->media_dev); + } + +-- +2.19.1 + diff --git a/queue-4.19/media-vicodec-lower-minimum-height-to-360.patch b/queue-4.19/media-vicodec-lower-minimum-height-to-360.patch new file mode 100644 index 00000000000..145c85c39e9 --- /dev/null +++ b/queue-4.19/media-vicodec-lower-minimum-height-to-360.patch @@ -0,0 +1,37 @@ +From ea246f381a6163b0e357f66f3174876569f50aec Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Wed, 10 Oct 2018 03:03:43 -0400 +Subject: media: vicodec: lower minimum height to 360 + +[ Upstream commit 7cf7b2e977abf3f992036939e35a8eab60013aff ] + +Lower the minimum height to 360 to be consistent with the webcam input of vivid. + +The 480 was rather arbitrary but it made it harder to use vivid as a source for +encoding since the default resolution when you load vivid is 640x360. + +Signed-off-by: Hans Verkuil +Reviewed-by: Kieran Bingham +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vicodec/vicodec-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c +index 408cd55d3580..daa5caa6adc6 100644 +--- a/drivers/media/platform/vicodec/vicodec-core.c ++++ b/drivers/media/platform/vicodec/vicodec-core.c +@@ -42,7 +42,7 @@ MODULE_PARM_DESC(debug, " activates debug info"); + #define MAX_WIDTH 4096U + #define MIN_WIDTH 640U + #define MAX_HEIGHT 2160U +-#define MIN_HEIGHT 480U ++#define MIN_HEIGHT 360U + + #define dprintk(dev, fmt, arg...) \ + v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: " fmt, __func__, ## arg) +-- +2.19.1 + diff --git a/queue-4.19/mt76-fix-building-without-config_leds_class.patch b/queue-4.19/mt76-fix-building-without-config_leds_class.patch new file mode 100644 index 00000000000..e520672d006 --- /dev/null +++ b/queue-4.19/mt76-fix-building-without-config_leds_class.patch @@ -0,0 +1,86 @@ +From 76817aedd0124891eff75028ccd2dc2aa1662531 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 5 Nov 2018 16:51:47 +0100 +Subject: mt76: fix building without CONFIG_LEDS_CLASS + +[ Upstream commit b374e8686fc35ae124e62dc78725ea656ba1ef8a ] + +When CONFIG_LEDS_CLASS is disabled, or it is a loadable module while +mt76 is built-in, we run into a link error: + +drivers/net/wireless/mediatek/mt76/mac80211.o: In function `mt76_register_device': +mac80211.c:(.text+0xb78): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `devm_of_led_classdev_register' + +We don't really need a hard dependency here as the driver can presumably +work just fine without LEDs, so this follows the iwlwifi example and +adds a separate Kconfig option for the LED support, this will be available +whenever it will link, and otherwise the respective code gets left out from +the driver object. + +Fixes: 17f1de56df05 ("mt76: add common code shared between multiple chipsets") +Signed-off-by: Arnd Bergmann +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/Kconfig | 6 ++++++ + drivers/net/wireless/mediatek/mt76/mac80211.c | 8 +++++--- + drivers/net/wireless/mediatek/mt76/mt76x2_init.c | 6 ++++-- + 3 files changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/Kconfig b/drivers/net/wireless/mediatek/mt76/Kconfig +index b6c5f17dca30..27826217ff76 100644 +--- a/drivers/net/wireless/mediatek/mt76/Kconfig ++++ b/drivers/net/wireless/mediatek/mt76/Kconfig +@@ -1,6 +1,12 @@ + config MT76_CORE + tristate + ++config MT76_LEDS ++ bool ++ depends on MT76_CORE ++ depends on LEDS_CLASS=y || MT76_CORE=LEDS_CLASS ++ default y ++ + config MT76_USB + tristate + depends on MT76_CORE +diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c +index 029d54bce9e8..ade4a2029a24 100644 +--- a/drivers/net/wireless/mediatek/mt76/mac80211.c ++++ b/drivers/net/wireless/mediatek/mt76/mac80211.c +@@ -342,9 +342,11 @@ int mt76_register_device(struct mt76_dev *dev, bool vht, + mt76_check_sband(dev, NL80211_BAND_2GHZ); + mt76_check_sband(dev, NL80211_BAND_5GHZ); + +- ret = mt76_led_init(dev); +- if (ret) +- return ret; ++ if (IS_ENABLED(CONFIG_MT76_LEDS)) { ++ ret = mt76_led_init(dev); ++ if (ret) ++ return ret; ++ } + + return ieee80211_register_hw(hw); + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2_init.c +index b814391f79ac..03b103c45d69 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x2_init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_init.c +@@ -581,8 +581,10 @@ int mt76x2_register_device(struct mt76x2_dev *dev) + mt76x2_dfs_init_detector(dev); + + /* init led callbacks */ +- dev->mt76.led_cdev.brightness_set = mt76x2_led_set_brightness; +- dev->mt76.led_cdev.blink_set = mt76x2_led_set_blink; ++ if (IS_ENABLED(CONFIG_MT76_LEDS)) { ++ dev->mt76.led_cdev.brightness_set = mt76x2_led_set_brightness; ++ dev->mt76.led_cdev.blink_set = mt76x2_led_set_blink; ++ } + + ret = mt76_register_device(&dev->mt76, true, mt76x2_rates, + ARRAY_SIZE(mt76x2_rates)); +-- +2.19.1 + diff --git a/queue-4.19/mtd-rawnand-qcom-namespace-prefix-some-commands.patch b/queue-4.19/mtd-rawnand-qcom-namespace-prefix-some-commands.patch new file mode 100644 index 00000000000..28c54ee21f0 --- /dev/null +++ b/queue-4.19/mtd-rawnand-qcom-namespace-prefix-some-commands.patch @@ -0,0 +1,112 @@ +From 89e82b8c703c04f875fac0d9ef72ea64fd71e3b6 Mon Sep 17 00:00:00 2001 +From: Olof Johansson +Date: Fri, 16 Nov 2018 19:43:27 -0800 +Subject: mtd: rawnand: qcom: Namespace prefix some commands + +[ Upstream commit 33bf5519ae5dd356b182a94e3622f42860274a38 ] + +PAGE_READ is used by RISC-V arch code included through mm headers, +and it makes sense to bring in a prefix on these in the driver. + +drivers/mtd/nand/raw/qcom_nandc.c:153: warning: "PAGE_READ" redefined + #define PAGE_READ 0x2 +In file included from include/linux/memremap.h:7, + from include/linux/mm.h:27, + from include/linux/scatterlist.h:8, + from include/linux/dma-mapping.h:11, + from drivers/mtd/nand/raw/qcom_nandc.c:17: +arch/riscv/include/asm/pgtable.h:48: note: this is the location of the previous definition + +Caught by riscv allmodconfig. + +Signed-off-by: Olof Johansson +Reviewed-by: Miquel Raynal +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/qcom_nandc.c | 32 +++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c +index d1d470bb32e4..8815f3e2b718 100644 +--- a/drivers/mtd/nand/raw/qcom_nandc.c ++++ b/drivers/mtd/nand/raw/qcom_nandc.c +@@ -151,15 +151,15 @@ + #define NAND_VERSION_MINOR_SHIFT 16 + + /* NAND OP_CMDs */ +-#define PAGE_READ 0x2 +-#define PAGE_READ_WITH_ECC 0x3 +-#define PAGE_READ_WITH_ECC_SPARE 0x4 +-#define PROGRAM_PAGE 0x6 +-#define PAGE_PROGRAM_WITH_ECC 0x7 +-#define PROGRAM_PAGE_SPARE 0x9 +-#define BLOCK_ERASE 0xa +-#define FETCH_ID 0xb +-#define RESET_DEVICE 0xd ++#define OP_PAGE_READ 0x2 ++#define OP_PAGE_READ_WITH_ECC 0x3 ++#define OP_PAGE_READ_WITH_ECC_SPARE 0x4 ++#define OP_PROGRAM_PAGE 0x6 ++#define OP_PAGE_PROGRAM_WITH_ECC 0x7 ++#define OP_PROGRAM_PAGE_SPARE 0x9 ++#define OP_BLOCK_ERASE 0xa ++#define OP_FETCH_ID 0xb ++#define OP_RESET_DEVICE 0xd + + /* Default Value for NAND_DEV_CMD_VLD */ + #define NAND_DEV_CMD_VLD_VAL (READ_START_VLD | WRITE_START_VLD | \ +@@ -692,11 +692,11 @@ static void update_rw_regs(struct qcom_nand_host *host, int num_cw, bool read) + + if (read) { + if (host->use_ecc) +- cmd = PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE; ++ cmd = OP_PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE; + else +- cmd = PAGE_READ | PAGE_ACC | LAST_PAGE; ++ cmd = OP_PAGE_READ | PAGE_ACC | LAST_PAGE; + } else { +- cmd = PROGRAM_PAGE | PAGE_ACC | LAST_PAGE; ++ cmd = OP_PROGRAM_PAGE | PAGE_ACC | LAST_PAGE; + } + + if (host->use_ecc) { +@@ -1170,7 +1170,7 @@ static int nandc_param(struct qcom_nand_host *host) + * in use. we configure the controller to perform a raw read of 512 + * bytes to read onfi params + */ +- nandc_set_reg(nandc, NAND_FLASH_CMD, PAGE_READ | PAGE_ACC | LAST_PAGE); ++ nandc_set_reg(nandc, NAND_FLASH_CMD, OP_PAGE_READ | PAGE_ACC | LAST_PAGE); + nandc_set_reg(nandc, NAND_ADDR0, 0); + nandc_set_reg(nandc, NAND_ADDR1, 0); + nandc_set_reg(nandc, NAND_DEV0_CFG0, 0 << CW_PER_PAGE +@@ -1224,7 +1224,7 @@ static int erase_block(struct qcom_nand_host *host, int page_addr) + struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip); + + nandc_set_reg(nandc, NAND_FLASH_CMD, +- BLOCK_ERASE | PAGE_ACC | LAST_PAGE); ++ OP_BLOCK_ERASE | PAGE_ACC | LAST_PAGE); + nandc_set_reg(nandc, NAND_ADDR0, page_addr); + nandc_set_reg(nandc, NAND_ADDR1, 0); + nandc_set_reg(nandc, NAND_DEV0_CFG0, +@@ -1255,7 +1255,7 @@ static int read_id(struct qcom_nand_host *host, int column) + if (column == -1) + return 0; + +- nandc_set_reg(nandc, NAND_FLASH_CMD, FETCH_ID); ++ nandc_set_reg(nandc, NAND_FLASH_CMD, OP_FETCH_ID); + nandc_set_reg(nandc, NAND_ADDR0, column); + nandc_set_reg(nandc, NAND_ADDR1, 0); + nandc_set_reg(nandc, NAND_FLASH_CHIP_SELECT, +@@ -1276,7 +1276,7 @@ static int reset(struct qcom_nand_host *host) + struct nand_chip *chip = &host->chip; + struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip); + +- nandc_set_reg(nandc, NAND_FLASH_CMD, RESET_DEVICE); ++ nandc_set_reg(nandc, NAND_FLASH_CMD, OP_RESET_DEVICE); + nandc_set_reg(nandc, NAND_EXEC_CMD, 1); + + write_reg_dma(nandc, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL); +-- +2.19.1 + diff --git a/queue-4.19/mtd-spi-nor-fix-cadence-qspi-page-fault-kernel-panic.patch b/queue-4.19/mtd-spi-nor-fix-cadence-qspi-page-fault-kernel-panic.patch new file mode 100644 index 00000000000..eeb8d078171 --- /dev/null +++ b/queue-4.19/mtd-spi-nor-fix-cadence-qspi-page-fault-kernel-panic.patch @@ -0,0 +1,76 @@ +From 2391ae21f7af06229999b186bde40e2034dc545b Mon Sep 17 00:00:00 2001 +From: Thor Thayer +Date: Fri, 16 Nov 2018 08:25:49 -0600 +Subject: mtd: spi-nor: Fix Cadence QSPI page fault kernel panic + +[ Upstream commit a6a66f80c85e8e20573ca03fabf32445954a88d5 ] + +The current Cadence QSPI driver caused a kernel panic sporadically +when writing to QSPI. The problem was caused by writing more bytes +than needed because the QSPI operated on 4 bytes at a time. + +[ 11.202044] Unable to handle kernel paging request at virtual address bffd3000 +[ 11.209254] pgd = e463054d +[ 11.211948] [bffd3000] *pgd=2fffb811, *pte=00000000, *ppte=00000000 +[ 11.218202] Internal error: Oops: 7 [#1] SMP ARM +[ 11.222797] Modules linked in: +[ 11.225844] CPU: 1 PID: 1317 Comm: systemd-hwdb Not tainted 4.17.7-d0c45cd44a8f +[ 11.235796] Hardware name: Altera SOCFPGA Arria10 +[ 11.240487] PC is at __raw_writesl+0x70/0xd4 +[ 11.244741] LR is at cqspi_write+0x1a0/0x2cc + +On a page boundary limit the number of bytes copied from the tx buffer +to remain within the page. + +This patch uses a temporary buffer to hold the 4 bytes to write and then +copies only the bytes required from the tx buffer. + +Reported-by: Adrian Amborzewicz +Signed-off-by: Thor Thayer +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/cadence-quadspi.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index 6e9cbd1a0b6d..0806c7a81c0f 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -644,9 +644,23 @@ static int cqspi_indirect_write_execute(struct spi_nor *nor, loff_t to_addr, + ndelay(cqspi->wr_delay); + + while (remaining > 0) { ++ size_t write_words, mod_bytes; ++ + write_bytes = remaining > page_size ? page_size : remaining; +- iowrite32_rep(cqspi->ahb_base, txbuf, +- DIV_ROUND_UP(write_bytes, 4)); ++ write_words = write_bytes / 4; ++ mod_bytes = write_bytes % 4; ++ /* Write 4 bytes at a time then single bytes. */ ++ if (write_words) { ++ iowrite32_rep(cqspi->ahb_base, txbuf, write_words); ++ txbuf += (write_words * 4); ++ } ++ if (mod_bytes) { ++ unsigned int temp = 0xFFFFFFFF; ++ ++ memcpy(&temp, txbuf, mod_bytes); ++ iowrite32(temp, cqspi->ahb_base); ++ txbuf += mod_bytes; ++ } + + if (!wait_for_completion_timeout(&cqspi->transfer_complete, + msecs_to_jiffies(CQSPI_TIMEOUT_MS))) { +@@ -655,7 +669,6 @@ static int cqspi_indirect_write_execute(struct spi_nor *nor, loff_t to_addr, + goto failwr; + } + +- txbuf += write_bytes; + remaining -= write_bytes; + + if (remaining > 0) +-- +2.19.1 + diff --git a/queue-4.19/net-amd-add-missing-of_node_put.patch b/queue-4.19/net-amd-add-missing-of_node_put.patch new file mode 100644 index 00000000000..73154c7ed2d --- /dev/null +++ b/queue-4.19/net-amd-add-missing-of_node_put.patch @@ -0,0 +1,43 @@ +From 439267f52ec632d1451ce1ef56064a083017f6fb Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Thu, 22 Nov 2018 07:34:41 -0500 +Subject: net: amd: add missing of_node_put() + +[ Upstream commit c44c749d3b6fdfca39002e7e48e03fe9f9fe37a3 ] + +of_find_node_by_path() acquires a reference to the node +returned by it and that reference needs to be dropped by its caller. +This place doesn't do that, so fix it. + +Signed-off-by: Yangtao Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/sunlance.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c +index cdd7a611479b..19f89d9b1781 100644 +--- a/drivers/net/ethernet/amd/sunlance.c ++++ b/drivers/net/ethernet/amd/sunlance.c +@@ -1419,7 +1419,7 @@ static int sparc_lance_probe_one(struct platform_device *op, + + prop = of_get_property(nd, "tpe-link-test?", NULL); + if (!prop) +- goto no_link_test; ++ goto node_put; + + if (strcmp(prop, "true")) { + printk(KERN_NOTICE "SunLance: warning: overriding option " +@@ -1428,6 +1428,8 @@ static int sparc_lance_probe_one(struct platform_device *op, + "to ecd@skynet.be\n"); + auxio_set_lte(AUXIO_LTE_ON); + } ++node_put: ++ of_node_put(nd); + no_link_test: + lp->auto_select = 1; + lp->tpe = 0; +-- +2.19.1 + diff --git a/queue-4.19/net-ena-fix-crash-during-failed-resume-from-hibernat.patch b/queue-4.19/net-ena-fix-crash-during-failed-resume-from-hibernat.patch new file mode 100644 index 00000000000..9444f97603c --- /dev/null +++ b/queue-4.19/net-ena-fix-crash-during-failed-resume-from-hibernat.patch @@ -0,0 +1,41 @@ +From df97a86d22b62d7468388cfefa5be5fc854df448 Mon Sep 17 00:00:00 2001 +From: Arthur Kiyanovski +Date: Mon, 19 Nov 2018 12:05:20 +0200 +Subject: net: ena: fix crash during failed resume from hibernation + +[ Upstream commit e76ad21d070f79e566ac46ce0b0584c3c93e1b43 ] + +During resume from hibernation if ena_restore_device fails, +ena_com_dev_reset() is called, and uses the readless read mechanism, +which was already destroyed by the call to +ena_com_mmio_reg_read_request_destroy(). This causes a NULL pointer +reference. + +In this commit we switch the call order of the above two functions +to avoid this crash. + +Fixes: d7703ddbd7c9 ("net: ena: fix rare bug when failed restart/resume is followed by driver removal") +Signed-off-by: Arthur Kiyanovski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index d906293ce07d..4b73131a0f20 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -2627,8 +2627,8 @@ err_device_destroy: + ena_com_abort_admin_commands(ena_dev); + ena_com_wait_for_abort_completion(ena_dev); + ena_com_admin_destroy(ena_dev); +- ena_com_mmio_reg_read_request_destroy(ena_dev); + ena_com_dev_reset(ena_dev, ENA_REGS_RESET_DRIVER_INVALID_STATE); ++ ena_com_mmio_reg_read_request_destroy(ena_dev); + err: + clear_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags); + clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags); +-- +2.19.1 + diff --git a/queue-4.19/net-faraday-ftmac100-remove-netif_running-netdev-che.patch b/queue-4.19/net-faraday-ftmac100-remove-netif_running-netdev-che.patch new file mode 100644 index 00000000000..ba4d911a8aa --- /dev/null +++ b/queue-4.19/net-faraday-ftmac100-remove-netif_running-netdev-che.patch @@ -0,0 +1,55 @@ +From 6bd45d7279c8075a533252ddd9864efbdf58cdf8 Mon Sep 17 00:00:00 2001 +From: Vincent Chen +Date: Wed, 21 Nov 2018 09:38:11 +0800 +Subject: net: faraday: ftmac100: remove netif_running(netdev) check before + disabling interrupts + +[ Upstream commit 426a593e641ebf0d9288f0a2fcab644a86820220 ] + +In the original ftmac100_interrupt(), the interrupts are only disabled when +the condition "netif_running(netdev)" is true. However, this condition +causes kerenl hang in the following case. When the user requests to +disable the network device, kernel will clear the bit __LINK_STATE_START +from the dev->state and then call the driver's ndo_stop function. Network +device interrupts are not blocked during this process. If an interrupt +occurs between clearing __LINK_STATE_START and stopping network device, +kernel cannot disable the interrupts due to the condition +"netif_running(netdev)" in the ISR. Hence, kernel will hang due to the +continuous interruption of the network device. + +In order to solve the above problem, the interrupts of the network device +should always be disabled in the ISR without being restricted by the +condition "netif_running(netdev)". + +[V2] +Remove unnecessary curly braces. + +Signed-off-by: Vincent Chen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/faraday/ftmac100.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c +index a1197d3adbe0..9015bd911bee 100644 +--- a/drivers/net/ethernet/faraday/ftmac100.c ++++ b/drivers/net/ethernet/faraday/ftmac100.c +@@ -872,11 +872,10 @@ static irqreturn_t ftmac100_interrupt(int irq, void *dev_id) + struct net_device *netdev = dev_id; + struct ftmac100 *priv = netdev_priv(netdev); + +- if (likely(netif_running(netdev))) { +- /* Disable interrupts for polling */ +- ftmac100_disable_all_int(priv); ++ /* Disable interrupts for polling */ ++ ftmac100_disable_all_int(priv); ++ if (likely(netif_running(netdev))) + napi_schedule(&priv->napi); +- } + + return IRQ_HANDLED; + } +-- +2.19.1 + diff --git a/queue-4.19/net-ibmnvic-fix-deadlock-problem-in-reset.patch b/queue-4.19/net-ibmnvic-fix-deadlock-problem-in-reset.patch new file mode 100644 index 00000000000..f3a77a3fbcb --- /dev/null +++ b/queue-4.19/net-ibmnvic-fix-deadlock-problem-in-reset.patch @@ -0,0 +1,197 @@ +From 2f5e8e6973e876633b0a5d2b8ef48474b3b1c124 Mon Sep 17 00:00:00 2001 +From: Juliet Kim +Date: Mon, 19 Nov 2018 15:59:22 -0600 +Subject: net/ibmnvic: Fix deadlock problem in reset + +[ Upstream commit a5681e20b541a507c7d4fd48ae4a4040d32ee1ef ] + +This patch changes to use rtnl_lock only during a reset to avoid +deadlock that could occur when a thread operating close is holding +rtnl_lock and waiting for reset_lock acquired by another thread, +which is waiting for rtnl_lock in order to set the number of tx/rx +queues during a reset. + +Also, we now setting the number of tx/rx queues during a soft reset +for failover or LPM events. + +Signed-off-by: Juliet Kim +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 59 +++++++++++------------------- + drivers/net/ethernet/ibm/ibmvnic.h | 2 +- + 2 files changed, 22 insertions(+), 39 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 7661064c815b..a646de07cbdc 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1103,20 +1103,15 @@ static int ibmvnic_open(struct net_device *netdev) + return 0; + } + +- mutex_lock(&adapter->reset_lock); +- + if (adapter->state != VNIC_CLOSED) { + rc = ibmvnic_login(netdev); +- if (rc) { +- mutex_unlock(&adapter->reset_lock); ++ if (rc) + return rc; +- } + + rc = init_resources(adapter); + if (rc) { + netdev_err(netdev, "failed to initialize resources\n"); + release_resources(adapter); +- mutex_unlock(&adapter->reset_lock); + return rc; + } + } +@@ -1124,8 +1119,6 @@ static int ibmvnic_open(struct net_device *netdev) + rc = __ibmvnic_open(netdev); + netif_carrier_on(netdev); + +- mutex_unlock(&adapter->reset_lock); +- + return rc; + } + +@@ -1269,10 +1262,8 @@ static int ibmvnic_close(struct net_device *netdev) + return 0; + } + +- mutex_lock(&adapter->reset_lock); + rc = __ibmvnic_close(netdev); + ibmvnic_cleanup(netdev); +- mutex_unlock(&adapter->reset_lock); + + return rc; + } +@@ -1820,20 +1811,15 @@ static int do_reset(struct ibmvnic_adapter *adapter, + return rc; + } else if (adapter->req_rx_queues != old_num_rx_queues || + adapter->req_tx_queues != old_num_tx_queues) { +- adapter->map_id = 1; + release_rx_pools(adapter); + release_tx_pools(adapter); +- rc = init_rx_pools(netdev); +- if (rc) +- return rc; +- rc = init_tx_pools(netdev); +- if (rc) +- return rc; +- + release_napi(adapter); +- rc = init_napi(adapter); ++ release_vpd_data(adapter); ++ ++ rc = init_resources(adapter); + if (rc) + return rc; ++ + } else { + rc = reset_tx_pools(adapter); + if (rc) +@@ -1917,17 +1903,8 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter, + adapter->state = VNIC_PROBED; + return 0; + } +- /* netif_set_real_num_xx_queues needs to take rtnl lock here +- * unless wait_for_reset is set, in which case the rtnl lock +- * has already been taken before initializing the reset +- */ +- if (!adapter->wait_for_reset) { +- rtnl_lock(); +- rc = init_resources(adapter); +- rtnl_unlock(); +- } else { +- rc = init_resources(adapter); +- } ++ ++ rc = init_resources(adapter); + if (rc) + return rc; + +@@ -1986,13 +1963,21 @@ static void __ibmvnic_reset(struct work_struct *work) + struct ibmvnic_rwi *rwi; + struct ibmvnic_adapter *adapter; + struct net_device *netdev; ++ bool we_lock_rtnl = false; + u32 reset_state; + int rc = 0; + + adapter = container_of(work, struct ibmvnic_adapter, ibmvnic_reset); + netdev = adapter->netdev; + +- mutex_lock(&adapter->reset_lock); ++ /* netif_set_real_num_xx_queues needs to take rtnl lock here ++ * unless wait_for_reset is set, in which case the rtnl lock ++ * has already been taken before initializing the reset ++ */ ++ if (!adapter->wait_for_reset) { ++ rtnl_lock(); ++ we_lock_rtnl = true; ++ } + reset_state = adapter->state; + + rwi = get_next_rwi(adapter); +@@ -2020,12 +2005,11 @@ static void __ibmvnic_reset(struct work_struct *work) + if (rc) { + netdev_dbg(adapter->netdev, "Reset failed\n"); + free_all_rwi(adapter); +- mutex_unlock(&adapter->reset_lock); +- return; + } + + adapter->resetting = false; +- mutex_unlock(&adapter->reset_lock); ++ if (we_lock_rtnl) ++ rtnl_unlock(); + } + + static int ibmvnic_reset(struct ibmvnic_adapter *adapter, +@@ -4709,7 +4693,6 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id) + + INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset); + INIT_LIST_HEAD(&adapter->rwi_list); +- mutex_init(&adapter->reset_lock); + mutex_init(&adapter->rwi_lock); + adapter->resetting = false; + +@@ -4781,8 +4764,8 @@ static int ibmvnic_remove(struct vio_dev *dev) + struct ibmvnic_adapter *adapter = netdev_priv(netdev); + + adapter->state = VNIC_REMOVING; +- unregister_netdev(netdev); +- mutex_lock(&adapter->reset_lock); ++ rtnl_lock(); ++ unregister_netdevice(netdev); + + release_resources(adapter); + release_sub_crqs(adapter, 1); +@@ -4793,7 +4776,7 @@ static int ibmvnic_remove(struct vio_dev *dev) + + adapter->state = VNIC_REMOVED; + +- mutex_unlock(&adapter->reset_lock); ++ rtnl_unlock(); + device_remove_file(&dev->dev, &dev_attr_failover); + free_netdev(netdev); + dev_set_drvdata(&dev->dev, NULL); +diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h +index f06eec145ca6..735f481b1870 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.h ++++ b/drivers/net/ethernet/ibm/ibmvnic.h +@@ -1068,7 +1068,7 @@ struct ibmvnic_adapter { + struct tasklet_struct tasklet; + enum vnic_state state; + enum ibmvnic_reset_reason reset_reason; +- struct mutex reset_lock, rwi_lock; ++ struct mutex rwi_lock; + struct list_head rwi_list; + struct work_struct ibmvnic_reset; + bool resetting; +-- +2.19.1 + diff --git a/queue-4.19/net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch b/queue-4.19/net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch new file mode 100644 index 00000000000..a809508537e --- /dev/null +++ b/queue-4.19/net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch @@ -0,0 +1,45 @@ +From b1a8cc10a611ccdbae61506dd1c76200eff2293c Mon Sep 17 00:00:00 2001 +From: Aya Levin +Date: Thu, 15 Nov 2018 18:05:15 +0200 +Subject: net/mlx4: Fix UBSAN warning of signed integer overflow + +[ Upstream commit a463146e67c848cbab5ce706d6528281b7cded08 ] + +UBSAN: Undefined behavior in +drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:626:29 +signed integer overflow: 1802201963 + 1802201963 cannot be represented +in type 'int' + +The union of res_reserved and res_port_rsvd[MLX4_MAX_PORTS] monitors +granting of reserved resources. The grant operation is calculated and +protected, thus both members of the union cannot be negative. Changed +type of res_reserved and of res_port_rsvd[MLX4_MAX_PORTS] from signed +int to unsigned int, allowing large value. + +Fixes: 5a0d0a6161ae ("mlx4: Structures and init/teardown for VF resource quotas") +Signed-off-by: Aya Levin +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/mlx4.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +index ebcd2778eeb3..23f1b5b512c2 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +@@ -540,8 +540,8 @@ struct slave_list { + struct resource_allocator { + spinlock_t alloc_lock; /* protect quotas */ + union { +- int res_reserved; +- int res_port_rsvd[MLX4_MAX_PORTS]; ++ unsigned int res_reserved; ++ unsigned int res_port_rsvd[MLX4_MAX_PORTS]; + }; + union { + int res_free; +-- +2.19.1 + diff --git a/queue-4.19/net-mlx4_core-fix-uninitialized-variable-compilation.patch b/queue-4.19/net-mlx4_core-fix-uninitialized-variable-compilation.patch new file mode 100644 index 00000000000..60cf60f73c4 --- /dev/null +++ b/queue-4.19/net-mlx4_core-fix-uninitialized-variable-compilation.patch @@ -0,0 +1,33 @@ +From eab088463f64c1aa413ad80afda5f7b2124ef11e Mon Sep 17 00:00:00 2001 +From: Tariq Toukan +Date: Thu, 15 Nov 2018 18:05:14 +0200 +Subject: net/mlx4_core: Fix uninitialized variable compilation warning + +[ Upstream commit 3ea7e7ea53c9f6ee41cb69a29c375fe9dd9a56a7 ] + +Initialize the uid variable to zero to avoid the compilation warning. + +Fixes: 7a89399ffad7 ("net/mlx4: Add mlx4_bitmap zone allocator") +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c +index 4bdf25059542..21788d4f9881 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c ++++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c +@@ -337,7 +337,7 @@ void mlx4_zone_allocator_destroy(struct mlx4_zone_allocator *zone_alloc) + static u32 __mlx4_alloc_from_zone(struct mlx4_zone_entry *zone, int count, + int align, u32 skip_mask, u32 *puid) + { +- u32 uid; ++ u32 uid = 0; + u32 res; + struct mlx4_zone_allocator *zone_alloc = zone->allocator; + struct mlx4_zone_entry *curr_node; +-- +2.19.1 + diff --git a/queue-4.19/net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch b/queue-4.19/net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch new file mode 100644 index 00000000000..12142f5dd08 --- /dev/null +++ b/queue-4.19/net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch @@ -0,0 +1,47 @@ +From f2e15057351795ec0fe24d70f43ff9f2c9e796b8 Mon Sep 17 00:00:00 2001 +From: Jack Morgenstein +Date: Thu, 15 Nov 2018 18:05:13 +0200 +Subject: net/mlx4_core: Zero out lkey field in SW2HW_MPT fw command + +[ Upstream commit bd85fbc2038a1bbe84990b23ff69b6fc81a32b2c ] + +When re-registering a user mr, the mpt information for the +existing mr when running SRIOV is obtained via the QUERY_MPT +fw command. The returned information includes the mpt's lkey. + +This retrieved mpt information is used to move the mpt back +to hardware ownership in the rereg flow (via the SW2HW_MPT +fw command when running SRIOV). + +The fw API spec states that for SW2HW_MPT, the lkey field +must be zero. Any ConnectX-3 PF driver which checks for strict spec +adherence will return failure for SW2HW_MPT if the lkey field is not +zero (although the fw in practice ignores this field for SW2HW_MPT). + +Thus, in order to conform to the fw API spec, set the lkey field to zero +before invoking SW2HW_MPT when running SRIOV. + +Fixes: e630664c8383 ("mlx4_core: Add helper functions to support MR re-registration") +Signed-off-by: Jack Morgenstein +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/mr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c +index 2e84f10f59ba..1a11bc0e1612 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mr.c ++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c +@@ -363,6 +363,7 @@ int mlx4_mr_hw_write_mpt(struct mlx4_dev *dev, struct mlx4_mr *mmr, + container_of((void *)mpt_entry, struct mlx4_cmd_mailbox, + buf); + ++ (*mpt_entry)->lkey = 0; + err = mlx4_SW2HW_MPT(dev, mailbox, key); + } + +-- +2.19.1 + diff --git a/queue-4.19/nfsv4-fix-a-nfsv4-state-manager-deadlock.patch b/queue-4.19/nfsv4-fix-a-nfsv4-state-manager-deadlock.patch new file mode 100644 index 00000000000..868177c8750 --- /dev/null +++ b/queue-4.19/nfsv4-fix-a-nfsv4-state-manager-deadlock.patch @@ -0,0 +1,80 @@ +From 708db9a7570b1856d8c0d7394b41aff720590926 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Mon, 19 Nov 2018 20:11:45 -0500 +Subject: NFSv4: Fix a NFSv4 state manager deadlock + +[ Upstream commit aeabb3c96186a0f944fc2b1f25c84d5eb3a93fa9 ] + +Fix a deadlock whereby the NFSv4 state manager can get stuck in the +delegation return code, waiting for a layout return to complete in +another thread. If the server reboots before that other thread +completes, then we need to be able to start a second state +manager thread in order to perform recovery. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4_fs.h | 2 ++ + fs/nfs/nfs4state.c | 16 +++++++++++----- + 2 files changed, 13 insertions(+), 5 deletions(-) + +diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h +index 3a6904173214..63287d911c08 100644 +--- a/fs/nfs/nfs4_fs.h ++++ b/fs/nfs/nfs4_fs.h +@@ -41,6 +41,8 @@ enum nfs4_client_state { + NFS4CLNT_MOVED, + NFS4CLNT_LEASE_MOVED, + NFS4CLNT_DELEGATION_EXPIRED, ++ NFS4CLNT_RUN_MANAGER, ++ NFS4CLNT_DELEGRETURN_RUNNING, + }; + + #define NFS4_RENEW_TIMEOUT 0x01 +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 18920152da14..d2f645d34eb1 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1210,6 +1210,7 @@ void nfs4_schedule_state_manager(struct nfs_client *clp) + struct task_struct *task; + char buf[INET6_ADDRSTRLEN + sizeof("-manager") + 1]; + ++ set_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state); + if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) + return; + __module_get(THIS_MODULE); +@@ -2485,6 +2486,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + + /* Ensure exclusive access to NFSv4 state */ + do { ++ clear_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state); + if (test_bit(NFS4CLNT_PURGE_STATE, &clp->cl_state)) { + section = "purge state"; + status = nfs4_purge_lease(clp); +@@ -2575,14 +2577,18 @@ static void nfs4_state_manager(struct nfs_client *clp) + } + + nfs4_end_drain_session(clp); +- if (test_and_clear_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state)) { +- nfs_client_return_marked_delegations(clp); +- continue; ++ nfs4_clear_state_manager_bit(clp); ++ ++ if (!test_and_set_bit(NFS4CLNT_DELEGRETURN_RUNNING, &clp->cl_state)) { ++ if (test_and_clear_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state)) { ++ nfs_client_return_marked_delegations(clp); ++ set_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state); ++ } ++ clear_bit(NFS4CLNT_DELEGRETURN_RUNNING, &clp->cl_state); + } + +- nfs4_clear_state_manager_bit(clp); + /* Did we race with an attempt to give us more work? */ +- if (clp->cl_state == 0) ++ if (!test_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state)) + return; + if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) + return; +-- +2.19.1 + diff --git a/queue-4.19/nfsv4.2-copy-do-not-allocate-memory-under-the-lock.patch b/queue-4.19/nfsv4.2-copy-do-not-allocate-memory-under-the-lock.patch new file mode 100644 index 00000000000..eaf52f369dd --- /dev/null +++ b/queue-4.19/nfsv4.2-copy-do-not-allocate-memory-under-the-lock.patch @@ -0,0 +1,120 @@ +From 4767db5139ea6a454245ca53d15c16075f209eca Mon Sep 17 00:00:00 2001 +From: Olga Kornievskaia +Date: Wed, 21 Nov 2018 11:24:22 -0500 +Subject: NFSv4.2 copy do not allocate memory under the lock + +[ Upstream commit 99f2c55591fb5c1b536263970d98c2ebc2089906 ] + +Bruce pointed out that we shouldn't allocate memory while holding +a lock in the nfs4_callback_offload() and handle_async_copy() +that deal with a racing CB_OFFLOAD and reply to COPY case. + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/callback_proc.c | 22 +++++++++++----------- + fs/nfs/nfs42proc.c | 19 ++++++++++--------- + 2 files changed, 21 insertions(+), 20 deletions(-) + +diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c +index 7b861bbc0b43..315967354954 100644 +--- a/fs/nfs/callback_proc.c ++++ b/fs/nfs/callback_proc.c +@@ -686,20 +686,24 @@ __be32 nfs4_callback_offload(void *data, void *dummy, + { + struct cb_offloadargs *args = data; + struct nfs_server *server; +- struct nfs4_copy_state *copy; ++ struct nfs4_copy_state *copy, *tmp_copy; + bool found = false; + ++ copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS); ++ if (!copy) ++ return htonl(NFS4ERR_SERVERFAULT); ++ + spin_lock(&cps->clp->cl_lock); + rcu_read_lock(); + list_for_each_entry_rcu(server, &cps->clp->cl_superblocks, + client_link) { +- list_for_each_entry(copy, &server->ss_copies, copies) { ++ list_for_each_entry(tmp_copy, &server->ss_copies, copies) { + if (memcmp(args->coa_stateid.other, +- copy->stateid.other, ++ tmp_copy->stateid.other, + sizeof(args->coa_stateid.other))) + continue; +- nfs4_copy_cb_args(copy, args); +- complete(©->completion); ++ nfs4_copy_cb_args(tmp_copy, args); ++ complete(&tmp_copy->completion); + found = true; + goto out; + } +@@ -707,15 +711,11 @@ __be32 nfs4_callback_offload(void *data, void *dummy, + out: + rcu_read_unlock(); + if (!found) { +- copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS); +- if (!copy) { +- spin_unlock(&cps->clp->cl_lock); +- return htonl(NFS4ERR_SERVERFAULT); +- } + memcpy(©->stateid, &args->coa_stateid, NFS4_STATEID_SIZE); + nfs4_copy_cb_args(copy, args); + list_add_tail(©->copies, &cps->clp->pending_cb_stateids); +- } ++ } else ++ kfree(copy); + spin_unlock(&cps->clp->cl_lock); + + return 0; +diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c +index ac5b784a1de0..fed06fd9998d 100644 +--- a/fs/nfs/nfs42proc.c ++++ b/fs/nfs/nfs42proc.c +@@ -137,31 +137,32 @@ static int handle_async_copy(struct nfs42_copy_res *res, + struct file *dst, + nfs4_stateid *src_stateid) + { +- struct nfs4_copy_state *copy; ++ struct nfs4_copy_state *copy, *tmp_copy; + int status = NFS4_OK; + bool found_pending = false; + struct nfs_open_context *ctx = nfs_file_open_context(dst); + ++ copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS); ++ if (!copy) ++ return -ENOMEM; ++ + spin_lock(&server->nfs_client->cl_lock); +- list_for_each_entry(copy, &server->nfs_client->pending_cb_stateids, ++ list_for_each_entry(tmp_copy, &server->nfs_client->pending_cb_stateids, + copies) { +- if (memcmp(&res->write_res.stateid, ©->stateid, ++ if (memcmp(&res->write_res.stateid, &tmp_copy->stateid, + NFS4_STATEID_SIZE)) + continue; + found_pending = true; +- list_del(©->copies); ++ list_del(&tmp_copy->copies); + break; + } + if (found_pending) { + spin_unlock(&server->nfs_client->cl_lock); ++ kfree(copy); ++ copy = tmp_copy; + goto out; + } + +- copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS); +- if (!copy) { +- spin_unlock(&server->nfs_client->cl_lock); +- return -ENOMEM; +- } + memcpy(©->stateid, &res->write_res.stateid, NFS4_STATEID_SIZE); + init_completion(©->completion); + copy->parent_state = ctx->state; +-- +2.19.1 + diff --git a/queue-4.19/nvme-fc-resolve-io-failures-during-connect.patch b/queue-4.19/nvme-fc-resolve-io-failures-during-connect.patch new file mode 100644 index 00000000000..c78cf65db89 --- /dev/null +++ b/queue-4.19/nvme-fc-resolve-io-failures-during-connect.patch @@ -0,0 +1,194 @@ +From 128e196b9444c5fccea425905093eeec1edf7f05 Mon Sep 17 00:00:00 2001 +From: James Smart +Date: Wed, 14 Nov 2018 16:35:10 -0800 +Subject: nvme-fc: resolve io failures during connect + +[ Upstream commit 4cff280a5fccf6513ed9e895bb3a4e7ad8b0cedc ] + +If an io error occurs on an io issued while connecting, recovery +of the io falls flat as the state checking ends up nooping the error +handler. + +Create an err_work work item that is scheduled upon an io error while +connecting. The work thread terminates all io on all queues and marks +the queues as not connected. The termination of the io will return +back to the callee, which will then back out of the connection attempt +and will reschedule, if possible, the connection attempt. + +The changes: +- in case there are several commands hitting the error handler, a + state flag is kept so that the error work is only scheduled once, + on the first error. The subsequent errors can be ignored. +- The calling sequence to stop keep alive and terminate the queues + and their io is lifted from the reset routine. Made a small + service routine used by both reset and err_work. +- During debugging, found that the teardown path can reference + an uninitialized pointer, resulting in a NULL pointer oops. + The aen_ops weren't initialized yet. Add validation on their + initialization before calling the teardown routine. + +Signed-off-by: James Smart +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 73 ++++++++++++++++++++++++++++++++++++------ + 1 file changed, 63 insertions(+), 10 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 611e70cae754..9375fa705d82 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -144,6 +144,7 @@ struct nvme_fc_ctrl { + + bool ioq_live; + bool assoc_active; ++ atomic_t err_work_active; + u64 association_id; + + struct list_head ctrl_list; /* rport->ctrl_list */ +@@ -152,6 +153,7 @@ struct nvme_fc_ctrl { + struct blk_mq_tag_set tag_set; + + struct delayed_work connect_work; ++ struct work_struct err_work; + + struct kref ref; + u32 flags; +@@ -1523,6 +1525,10 @@ nvme_fc_abort_aen_ops(struct nvme_fc_ctrl *ctrl) + struct nvme_fc_fcp_op *aen_op = ctrl->aen_ops; + int i; + ++ /* ensure we've initialized the ops once */ ++ if (!(aen_op->flags & FCOP_FLAGS_AEN)) ++ return; ++ + for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++) + __nvme_fc_abort_op(ctrl, aen_op); + } +@@ -2036,7 +2042,25 @@ nvme_fc_nvme_ctrl_freed(struct nvme_ctrl *nctrl) + static void + nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg) + { +- /* only proceed if in LIVE state - e.g. on first error */ ++ int active; ++ ++ /* ++ * if an error (io timeout, etc) while (re)connecting, ++ * it's an error on creating the new association. ++ * Start the error recovery thread if it hasn't already ++ * been started. It is expected there could be multiple ++ * ios hitting this path before things are cleaned up. ++ */ ++ if (ctrl->ctrl.state == NVME_CTRL_CONNECTING) { ++ active = atomic_xchg(&ctrl->err_work_active, 1); ++ if (!active && !schedule_work(&ctrl->err_work)) { ++ atomic_set(&ctrl->err_work_active, 0); ++ WARN_ON(1); ++ } ++ return; ++ } ++ ++ /* Otherwise, only proceed if in LIVE state - e.g. on first error */ + if (ctrl->ctrl.state != NVME_CTRL_LIVE) + return; + +@@ -2802,6 +2826,7 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nctrl) + { + struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl); + ++ cancel_work_sync(&ctrl->err_work); + cancel_delayed_work_sync(&ctrl->connect_work); + /* + * kill the association on the link side. this will block +@@ -2854,23 +2879,30 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status) + } + + static void +-nvme_fc_reset_ctrl_work(struct work_struct *work) ++__nvme_fc_terminate_io(struct nvme_fc_ctrl *ctrl) + { +- struct nvme_fc_ctrl *ctrl = +- container_of(work, struct nvme_fc_ctrl, ctrl.reset_work); +- int ret; +- +- nvme_stop_ctrl(&ctrl->ctrl); ++ nvme_stop_keep_alive(&ctrl->ctrl); + + /* will block will waiting for io to terminate */ + nvme_fc_delete_association(ctrl); + +- if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) { ++ if (ctrl->ctrl.state != NVME_CTRL_CONNECTING && ++ !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) + dev_err(ctrl->ctrl.device, + "NVME-FC{%d}: error_recovery: Couldn't change state " + "to CONNECTING\n", ctrl->cnum); +- return; +- } ++} ++ ++static void ++nvme_fc_reset_ctrl_work(struct work_struct *work) ++{ ++ struct nvme_fc_ctrl *ctrl = ++ container_of(work, struct nvme_fc_ctrl, ctrl.reset_work); ++ int ret; ++ ++ __nvme_fc_terminate_io(ctrl); ++ ++ nvme_stop_ctrl(&ctrl->ctrl); + + if (ctrl->rport->remoteport.port_state == FC_OBJSTATE_ONLINE) + ret = nvme_fc_create_association(ctrl); +@@ -2885,6 +2917,24 @@ nvme_fc_reset_ctrl_work(struct work_struct *work) + ctrl->cnum); + } + ++static void ++nvme_fc_connect_err_work(struct work_struct *work) ++{ ++ struct nvme_fc_ctrl *ctrl = ++ container_of(work, struct nvme_fc_ctrl, err_work); ++ ++ __nvme_fc_terminate_io(ctrl); ++ ++ atomic_set(&ctrl->err_work_active, 0); ++ ++ /* ++ * Rescheduling the connection after recovering ++ * from the io error is left to the reconnect work ++ * item, which is what should have stalled waiting on ++ * the io that had the error that scheduled this work. ++ */ ++} ++ + static const struct nvme_ctrl_ops nvme_fc_ctrl_ops = { + .name = "fc", + .module = THIS_MODULE, +@@ -2995,6 +3045,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, + ctrl->cnum = idx; + ctrl->ioq_live = false; + ctrl->assoc_active = false; ++ atomic_set(&ctrl->err_work_active, 0); + init_waitqueue_head(&ctrl->ioabort_wait); + + get_device(ctrl->dev); +@@ -3002,6 +3053,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, + + INIT_WORK(&ctrl->ctrl.reset_work, nvme_fc_reset_ctrl_work); + INIT_DELAYED_WORK(&ctrl->connect_work, nvme_fc_connect_ctrl_work); ++ INIT_WORK(&ctrl->err_work, nvme_fc_connect_err_work); + spin_lock_init(&ctrl->lock); + + /* io queue count */ +@@ -3092,6 +3144,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, + fail_ctrl: + nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING); + cancel_work_sync(&ctrl->ctrl.reset_work); ++ cancel_work_sync(&ctrl->err_work); + cancel_delayed_work_sync(&ctrl->connect_work); + + ctrl->ctrl.opts = NULL; +-- +2.19.1 + diff --git a/queue-4.19/qed-fix-bitmap_weight-check.patch b/queue-4.19/qed-fix-bitmap_weight-check.patch new file mode 100644 index 00000000000..4c33d3997b3 --- /dev/null +++ b/queue-4.19/qed-fix-bitmap_weight-check.patch @@ -0,0 +1,39 @@ +From a6bf3deef8c09771725de850d683d3fa8c63d48d Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Mon, 19 Nov 2018 16:28:30 +0200 +Subject: qed: Fix bitmap_weight() check + +[ Upstream commit 276d43f0ae963312c0cd0e2b9a85fd11ac65dfcc ] + +Fix the condition which verifies that only one flag is set. The API +bitmap_weight() should receive size in bits instead of bytes. + +Fixes: b5a9ee7cf3be ("qed: Revise QM cofiguration") +Signed-off-by: Denis Bolotin +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c +index 9d2d18c32162..d2ead4eb1b9a 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c +@@ -478,8 +478,11 @@ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn, + struct qed_qm_info *qm_info = &p_hwfn->qm_info; + + /* Can't have multiple flags set here */ +- if (bitmap_weight((unsigned long *)&pq_flags, sizeof(pq_flags)) > 1) ++ if (bitmap_weight((unsigned long *)&pq_flags, ++ sizeof(pq_flags) * BITS_PER_BYTE) > 1) { ++ DP_ERR(p_hwfn, "requested multiple pq flags 0x%x\n", pq_flags); + goto err; ++ } + + switch (pq_flags) { + case PQ_FLAGS_RLS: +-- +2.19.1 + diff --git a/queue-4.19/qed-fix-overriding-offload_tc-by-protocols-without-a.patch b/queue-4.19/qed-fix-overriding-offload_tc-by-protocols-without-a.patch new file mode 100644 index 00000000000..ddced5f90f2 --- /dev/null +++ b/queue-4.19/qed-fix-overriding-offload_tc-by-protocols-without-a.patch @@ -0,0 +1,82 @@ +From b2038dbbfb126d6b995ce9f9bddb19a645a80eba Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Mon, 12 Nov 2018 12:50:21 +0200 +Subject: qed: Fix overriding offload_tc by protocols without APP TLV + +[ Upstream commit e90202ed1cf9672c48a363c84a929932ebfe6fc0 ] + +The TC received from APP TLV is stored in offload_tc, and should not be +set by protocols which did not receive an APP TLV. Fixed the condition +when overriding the offload_tc. + +Signed-off-by: Denis Bolotin +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_dcbx.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c +index f5459de6d60a..5900a506bf8d 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c +@@ -191,7 +191,7 @@ qed_dcbx_dp_protocol(struct qed_hwfn *p_hwfn, struct qed_dcbx_results *p_data) + static void + qed_dcbx_set_params(struct qed_dcbx_results *p_data, + struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, +- bool enable, u8 prio, u8 tc, ++ bool app_tlv, bool enable, u8 prio, u8 tc, + enum dcbx_protocol_type type, + enum qed_pci_personality personality) + { +@@ -210,7 +210,7 @@ qed_dcbx_set_params(struct qed_dcbx_results *p_data, + p_data->arr[type].dont_add_vlan0 = true; + + /* QM reconf data */ +- if (p_hwfn->hw_info.personality == personality) ++ if (app_tlv && p_hwfn->hw_info.personality == personality) + qed_hw_info_set_offload_tc(&p_hwfn->hw_info, tc); + + /* Configure dcbx vlan priority in doorbell block for roce EDPM */ +@@ -225,7 +225,7 @@ qed_dcbx_set_params(struct qed_dcbx_results *p_data, + static void + qed_dcbx_update_app_info(struct qed_dcbx_results *p_data, + struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, +- bool enable, u8 prio, u8 tc, ++ bool app_tlv, bool enable, u8 prio, u8 tc, + enum dcbx_protocol_type type) + { + enum qed_pci_personality personality; +@@ -240,7 +240,7 @@ qed_dcbx_update_app_info(struct qed_dcbx_results *p_data, + + personality = qed_dcbx_app_update[i].personality; + +- qed_dcbx_set_params(p_data, p_hwfn, p_ptt, enable, ++ qed_dcbx_set_params(p_data, p_hwfn, p_ptt, app_tlv, enable, + prio, tc, type, personality); + } + } +@@ -318,8 +318,8 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, + enable = true; + } + +- qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable, +- priority, tc, type); ++ qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, true, ++ enable, priority, tc, type); + } + } + +@@ -340,7 +340,7 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, + continue; + + enable = (type == DCBX_PROTOCOL_ETH) ? false : !!dcbx_version; +- qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable, ++ qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, false, enable, + priority, tc, type); + } + +-- +2.19.1 + diff --git a/queue-4.19/qed-fix-ptt-leak-in-qed_drain.patch b/queue-4.19/qed-fix-ptt-leak-in-qed_drain.patch new file mode 100644 index 00000000000..94478e6d8d7 --- /dev/null +++ b/queue-4.19/qed-fix-ptt-leak-in-qed_drain.patch @@ -0,0 +1,35 @@ +From fa89bcc52a62149c20bf07164f86d1a82d9e4b43 Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Mon, 12 Nov 2018 12:50:20 +0200 +Subject: qed: Fix PTT leak in qed_drain() + +[ Upstream commit 9aaa4e8ba12972d674caeefbc5f88d83235dd697 ] + +Release PTT before entering error flow. + +Signed-off-by: Denis Bolotin +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c +index 2094d86a7a08..cf3b0e3dc350 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -1634,9 +1634,9 @@ static int qed_drain(struct qed_dev *cdev) + return -EBUSY; + } + rc = qed_mcp_drain(hwfn, ptt); ++ qed_ptt_release(hwfn, ptt); + if (rc) + return rc; +- qed_ptt_release(hwfn, ptt); + } + + return 0; +-- +2.19.1 + diff --git a/queue-4.19/qed-fix-qm-getters-to-always-return-a-valid-pq.patch b/queue-4.19/qed-fix-qm-getters-to-always-return-a-valid-pq.patch new file mode 100644 index 00000000000..725038797e3 --- /dev/null +++ b/queue-4.19/qed-fix-qm-getters-to-always-return-a-valid-pq.patch @@ -0,0 +1,96 @@ +From 22cda88222b4fbe802dc7af3a30f2d04749ed185 Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Mon, 19 Nov 2018 16:28:31 +0200 +Subject: qed: Fix QM getters to always return a valid pq + +[ Upstream commit eb62cca9bee842e5b23bd0ddfb1f271ca95e8759 ] + +The getter callers doesn't know the valid Physical Queues (PQ) values. +This patch makes sure that a valid PQ will always be returned. + +The patch consists of 3 fixes: + + - When qed_init_qm_get_idx_from_flags() receives a disabled flag, it + returned PQ 0, which can potentially be another function's pq. Verify + that flag is enabled, otherwise return default start_pq. + + - When qed_init_qm_get_idx_from_flags() receives an unknown flag, it + returned NULL and could lead to a segmentation fault. Return default + start_pq instead. + + - A modulo operation was added to MCOS/VFS PQ getters to make sure the + PQ returned is in range of the required flag. + +Fixes: b5a9ee7cf3be ("qed: Revise QM cofiguration") +Signed-off-by: Denis Bolotin +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_dev.c | 24 +++++++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c +index d2ead4eb1b9a..2f69ee9221c6 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c +@@ -484,6 +484,11 @@ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn, + goto err; + } + ++ if (!(qed_get_pq_flags(p_hwfn) & pq_flags)) { ++ DP_ERR(p_hwfn, "pq flag 0x%x is not set\n", pq_flags); ++ goto err; ++ } ++ + switch (pq_flags) { + case PQ_FLAGS_RLS: + return &qm_info->first_rl_pq; +@@ -506,8 +511,7 @@ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn, + } + + err: +- DP_ERR(p_hwfn, "BAD pq flags %d\n", pq_flags); +- return NULL; ++ return &qm_info->start_pq; + } + + /* save pq index in qm info */ +@@ -531,20 +535,32 @@ u16 qed_get_cm_pq_idx_mcos(struct qed_hwfn *p_hwfn, u8 tc) + { + u8 max_tc = qed_init_qm_get_num_tcs(p_hwfn); + ++ if (max_tc == 0) { ++ DP_ERR(p_hwfn, "pq with flag 0x%lx do not exist\n", ++ PQ_FLAGS_MCOS); ++ return p_hwfn->qm_info.start_pq; ++ } ++ + if (tc > max_tc) + DP_ERR(p_hwfn, "tc %d must be smaller than %d\n", tc, max_tc); + +- return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_MCOS) + tc; ++ return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_MCOS) + (tc % max_tc); + } + + u16 qed_get_cm_pq_idx_vf(struct qed_hwfn *p_hwfn, u16 vf) + { + u16 max_vf = qed_init_qm_get_num_vfs(p_hwfn); + ++ if (max_vf == 0) { ++ DP_ERR(p_hwfn, "pq with flag 0x%lx do not exist\n", ++ PQ_FLAGS_VFS); ++ return p_hwfn->qm_info.start_pq; ++ } ++ + if (vf > max_vf) + DP_ERR(p_hwfn, "vf %d must be smaller than %d\n", vf, max_vf); + +- return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_VFS) + vf; ++ return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_VFS) + (vf % max_vf); + } + + u16 qed_get_cm_pq_idx_ofld_mtc(struct qed_hwfn *p_hwfn, u8 tc) +-- +2.19.1 + diff --git a/queue-4.19/qed-fix-rdma_info-structure-allocation.patch b/queue-4.19/qed-fix-rdma_info-structure-allocation.patch new file mode 100644 index 00000000000..fa68899bc40 --- /dev/null +++ b/queue-4.19/qed-fix-rdma_info-structure-allocation.patch @@ -0,0 +1,231 @@ +From 37db81adf9b8e9b288cf202d87cb9e23a36a9340 Mon Sep 17 00:00:00 2001 +From: Michal Kalderon +Date: Mon, 12 Nov 2018 12:50:22 +0200 +Subject: qed: Fix rdma_info structure allocation + +[ Upstream commit 291d57f67d2449737d1e370ab5b9a583818eaa0c ] + +Certain flows need to access the rdma-info structure, for example dcbx +update flows. In some cases there can be a race between the allocation or +deallocation of the structure which was done in roce start / roce stop and +an asynchrounous dcbx event that tries to access the structure. +For this reason, we move the allocation of the rdma_info structure to be +similar to the iscsi/fcoe info structures which are allocated during device +setup. +We add a new field of "active" to the struct to define whether roce has +already been started or not, and this is checked instead of whether the +pointer to the info structure. + +Fixes: 51ff17251c9c ("qed: Add support for RoCE hw init") +Signed-off-by: Michal Kalderon +Signed-off-by: Denis Bolotin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_dev.c | 15 +++++-- + drivers/net/ethernet/qlogic/qed/qed_rdma.c | 50 +++++++++++++--------- + drivers/net/ethernet/qlogic/qed/qed_rdma.h | 5 +++ + 3 files changed, 45 insertions(+), 25 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c +index 97f073fd3725..9d2d18c32162 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c +@@ -179,6 +179,10 @@ void qed_resc_free(struct qed_dev *cdev) + qed_iscsi_free(p_hwfn); + qed_ooo_free(p_hwfn); + } ++ ++ if (QED_IS_RDMA_PERSONALITY(p_hwfn)) ++ qed_rdma_info_free(p_hwfn); ++ + qed_iov_free(p_hwfn); + qed_l2_free(p_hwfn); + qed_dmae_info_free(p_hwfn); +@@ -1074,6 +1078,12 @@ int qed_resc_alloc(struct qed_dev *cdev) + goto alloc_err; + } + ++ if (QED_IS_RDMA_PERSONALITY(p_hwfn)) { ++ rc = qed_rdma_info_alloc(p_hwfn); ++ if (rc) ++ goto alloc_err; ++ } ++ + /* DMA info initialization */ + rc = qed_dmae_info_alloc(p_hwfn); + if (rc) +@@ -2091,11 +2101,8 @@ int qed_hw_start_fastpath(struct qed_hwfn *p_hwfn) + if (!p_ptt) + return -EAGAIN; + +- /* If roce info is allocated it means roce is initialized and should +- * be enabled in searcher. +- */ + if (p_hwfn->p_rdma_info && +- p_hwfn->b_rdma_enabled_in_prs) ++ p_hwfn->p_rdma_info->active && p_hwfn->b_rdma_enabled_in_prs) + qed_wr(p_hwfn, p_ptt, p_hwfn->rdma_prs_search_reg, 0x1); + + /* Re-open incoming traffic */ +diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c +index 62113438c880..7873d6dfd91f 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c +@@ -140,22 +140,34 @@ static u32 qed_rdma_get_sb_id(void *p_hwfn, u32 rel_sb_id) + return FEAT_NUM((struct qed_hwfn *)p_hwfn, QED_PF_L2_QUE) + rel_sb_id; + } + +-static int qed_rdma_alloc(struct qed_hwfn *p_hwfn, +- struct qed_ptt *p_ptt, +- struct qed_rdma_start_in_params *params) ++int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn) + { + struct qed_rdma_info *p_rdma_info; +- u32 num_cons, num_tasks; +- int rc = -ENOMEM; + +- DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocating RDMA\n"); +- +- /* Allocate a struct with current pf rdma info */ + p_rdma_info = kzalloc(sizeof(*p_rdma_info), GFP_KERNEL); + if (!p_rdma_info) +- return rc; ++ return -ENOMEM; ++ ++ spin_lock_init(&p_rdma_info->lock); + + p_hwfn->p_rdma_info = p_rdma_info; ++ return 0; ++} ++ ++void qed_rdma_info_free(struct qed_hwfn *p_hwfn) ++{ ++ kfree(p_hwfn->p_rdma_info); ++ p_hwfn->p_rdma_info = NULL; ++} ++ ++static int qed_rdma_alloc(struct qed_hwfn *p_hwfn) ++{ ++ struct qed_rdma_info *p_rdma_info = p_hwfn->p_rdma_info; ++ u32 num_cons, num_tasks; ++ int rc = -ENOMEM; ++ ++ DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocating RDMA\n"); ++ + if (QED_IS_IWARP_PERSONALITY(p_hwfn)) + p_rdma_info->proto = PROTOCOLID_IWARP; + else +@@ -183,7 +195,7 @@ static int qed_rdma_alloc(struct qed_hwfn *p_hwfn, + /* Allocate a struct with device params and fill it */ + p_rdma_info->dev = kzalloc(sizeof(*p_rdma_info->dev), GFP_KERNEL); + if (!p_rdma_info->dev) +- goto free_rdma_info; ++ return rc; + + /* Allocate a struct with port params and fill it */ + p_rdma_info->port = kzalloc(sizeof(*p_rdma_info->port), GFP_KERNEL); +@@ -298,8 +310,6 @@ free_rdma_port: + kfree(p_rdma_info->port); + free_rdma_dev: + kfree(p_rdma_info->dev); +-free_rdma_info: +- kfree(p_rdma_info); + + return rc; + } +@@ -370,8 +380,6 @@ static void qed_rdma_resc_free(struct qed_hwfn *p_hwfn) + + kfree(p_rdma_info->port); + kfree(p_rdma_info->dev); +- +- kfree(p_rdma_info); + } + + static void qed_rdma_free_tid(void *rdma_cxt, u32 itid) +@@ -679,8 +687,6 @@ static int qed_rdma_setup(struct qed_hwfn *p_hwfn, + + DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "RDMA setup\n"); + +- spin_lock_init(&p_hwfn->p_rdma_info->lock); +- + qed_rdma_init_devinfo(p_hwfn, params); + qed_rdma_init_port(p_hwfn); + qed_rdma_init_events(p_hwfn, params); +@@ -727,7 +733,7 @@ static int qed_rdma_stop(void *rdma_cxt) + /* Disable RoCE search */ + qed_wr(p_hwfn, p_ptt, p_hwfn->rdma_prs_search_reg, 0); + p_hwfn->b_rdma_enabled_in_prs = false; +- ++ p_hwfn->p_rdma_info->active = 0; + qed_wr(p_hwfn, p_ptt, PRS_REG_ROCE_DEST_QP_MAX_PF, 0); + + ll2_ethertype_en = qed_rd(p_hwfn, p_ptt, PRS_REG_LIGHT_L2_ETHERTYPE_EN); +@@ -1236,7 +1242,8 @@ qed_rdma_create_qp(void *rdma_cxt, + u8 max_stats_queues; + int rc; + +- if (!rdma_cxt || !in_params || !out_params || !p_hwfn->p_rdma_info) { ++ if (!rdma_cxt || !in_params || !out_params || ++ !p_hwfn->p_rdma_info->active) { + DP_ERR(p_hwfn->cdev, + "qed roce create qp failed due to NULL entry (rdma_cxt=%p, in=%p, out=%p, roce_info=?\n", + rdma_cxt, in_params, out_params); +@@ -1802,8 +1809,8 @@ bool qed_rdma_allocated_qps(struct qed_hwfn *p_hwfn) + { + bool result; + +- /* if rdma info has not been allocated, naturally there are no qps */ +- if (!p_hwfn->p_rdma_info) ++ /* if rdma wasn't activated yet, naturally there are no qps */ ++ if (!p_hwfn->p_rdma_info->active) + return false; + + spin_lock_bh(&p_hwfn->p_rdma_info->lock); +@@ -1849,7 +1856,7 @@ static int qed_rdma_start(void *rdma_cxt, + if (!p_ptt) + goto err; + +- rc = qed_rdma_alloc(p_hwfn, p_ptt, params); ++ rc = qed_rdma_alloc(p_hwfn); + if (rc) + goto err1; + +@@ -1858,6 +1865,7 @@ static int qed_rdma_start(void *rdma_cxt, + goto err2; + + qed_ptt_release(p_hwfn, p_ptt); ++ p_hwfn->p_rdma_info->active = 1; + + return rc; + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.h b/drivers/net/ethernet/qlogic/qed/qed_rdma.h +index 6f722ee8ee94..50d609c0e108 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.h +@@ -102,6 +102,7 @@ struct qed_rdma_info { + u16 max_queue_zones; + enum protocol_type proto; + struct qed_iwarp_info iwarp; ++ u8 active:1; + }; + + struct qed_rdma_qp { +@@ -176,10 +177,14 @@ struct qed_rdma_qp { + #if IS_ENABLED(CONFIG_QED_RDMA) + void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt); + void qed_rdma_dpm_conf(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt); ++int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn); ++void qed_rdma_info_free(struct qed_hwfn *p_hwfn); + #else + static inline void qed_rdma_dpm_conf(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) {} + static inline void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn, + struct qed_ptt *p_ptt) {} ++static inline int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn) {return -EINVAL} ++static inline void qed_rdma_info_free(struct qed_hwfn *p_hwfn) {} + #endif + + int +-- +2.19.1 + diff --git a/queue-4.19/qed-fix-reading-wrong-value-in-loop-condition.patch b/queue-4.19/qed-fix-reading-wrong-value-in-loop-condition.patch new file mode 100644 index 00000000000..14ae8f6ec66 --- /dev/null +++ b/queue-4.19/qed-fix-reading-wrong-value-in-loop-condition.patch @@ -0,0 +1,34 @@ +From d8e5ea622bda00b5ccf110f4596a016f4fdad45d Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Mon, 12 Nov 2018 12:50:23 +0200 +Subject: qed: Fix reading wrong value in loop condition + +[ Upstream commit ed4eac20dcffdad47709422e0cb925981b056668 ] + +The value of "sb_index" is written by the hardware. Reading its value and +writing it to "index" must finish before checking the loop condition. + +Signed-off-by: Denis Bolotin +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_int.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c +index 0f0aba793352..b22f464ea3fa 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_int.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c +@@ -992,6 +992,8 @@ static int qed_int_attentions(struct qed_hwfn *p_hwfn) + */ + do { + index = p_sb_attn->sb_index; ++ /* finish reading index before the loop condition */ ++ dma_rmb(); + attn_bits = le32_to_cpu(p_sb_attn->atten_bits); + attn_acks = le32_to_cpu(p_sb_attn->atten_ack); + } while (index != p_sb_attn->sb_index); +-- +2.19.1 + diff --git a/queue-4.19/revert-hid-uhid-use-strlcpy-instead-of-strncpy.patch b/queue-4.19/revert-hid-uhid-use-strlcpy-instead-of-strncpy.patch new file mode 100644 index 00000000000..4bcbe0d5468 --- /dev/null +++ b/queue-4.19/revert-hid-uhid-use-strlcpy-instead-of-strncpy.patch @@ -0,0 +1,58 @@ +From 5d47f20a63a4f83e5a5e69a6ba3863dad55311d9 Mon Sep 17 00:00:00 2001 +From: David Herrmann +Date: Wed, 14 Nov 2018 14:16:42 +0100 +Subject: Revert "HID: uhid: use strlcpy() instead of strncpy()" + +[ Upstream commit 4d26d1d1e8065bb3326a7c06d5d4698e581443a9 ] + +This reverts commit 336fd4f5f25157e9e8bd50e898a1bbcd99eaea46. + +Please note that `strlcpy()` does *NOT* do what you think it does. +strlcpy() *ALWAYS* reads the full input string, regardless of the +'length' parameter. That is, if the input is not zero-terminated, +strlcpy() will *READ* beyond input boundaries. It does this, because it +always returns the size it *would* copy if the target was big enough, +not the truncated size it actually copied. + +The original code was perfectly fine. The hid device is +zero-initialized and the strncpy() functions copied up to n-1 +characters. The result is always zero-terminated this way. + +This is the third time someone tried to replace strncpy with strlcpy in +this function, and gets it wrong. I now added a comment that should at +least make people reconsider. + +Signed-off-by: David Herrmann +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/uhid.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c +index 051639c09f72..840634e0f1e3 100644 +--- a/drivers/hid/uhid.c ++++ b/drivers/hid/uhid.c +@@ -497,12 +497,13 @@ static int uhid_dev_create2(struct uhid_device *uhid, + goto err_free; + } + +- len = min(sizeof(hid->name), sizeof(ev->u.create2.name)); +- strlcpy(hid->name, ev->u.create2.name, len); +- len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys)); +- strlcpy(hid->phys, ev->u.create2.phys, len); +- len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq)); +- strlcpy(hid->uniq, ev->u.create2.uniq, len); ++ /* @hid is zero-initialized, strncpy() is correct, strlcpy() not */ ++ len = min(sizeof(hid->name), sizeof(ev->u.create2.name)) - 1; ++ strncpy(hid->name, ev->u.create2.name, len); ++ len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys)) - 1; ++ strncpy(hid->phys, ev->u.create2.phys, len); ++ len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq)) - 1; ++ strncpy(hid->uniq, ev->u.create2.uniq, len); + + hid->ll_driver = &uhid_hid_driver; + hid->bus = ev->u.create2.bus; +-- +2.19.1 + diff --git a/queue-4.19/revert-usb-gadget-ffs-fix-bug-when-userland-exits-wi.patch b/queue-4.19/revert-usb-gadget-ffs-fix-bug-when-userland-exits-wi.patch new file mode 100644 index 00000000000..b4c6f023a66 --- /dev/null +++ b/queue-4.19/revert-usb-gadget-ffs-fix-bug-when-userland-exits-wi.patch @@ -0,0 +1,93 @@ +From 9b876be279c5e3d052befde731eb95650548bc25 Mon Sep 17 00:00:00 2001 +From: Shen Jing +Date: Thu, 1 Nov 2018 15:35:17 +0530 +Subject: Revert "usb: gadget: ffs: Fix BUG when userland exits with submitted + AIO transfers" + +[ Upstream commit a9c859033f6ec772f8e3228c343bb1321584ae0e ] + +This reverts commit b4194da3f9087dd38d91b40f9bec42d59ce589a8 +since it causes list corruption followed by kernel panic: + +Workqueue: adb ffs_aio_cancel_worker +RIP: 0010:__list_add_valid+0x4d/0x70 +Call Trace: +insert_work+0x47/0xb0 +__queue_work+0xf6/0x400 +queue_work_on+0x65/0x70 +dwc3_gadget_giveback+0x44/0x50 [dwc3] +dwc3_gadget_ep_dequeue+0x83/0x2d0 [dwc3] +? finish_wait+0x80/0x80 +usb_ep_dequeue+0x1e/0x90 +process_one_work+0x18c/0x3b0 +worker_thread+0x3c/0x390 +? process_one_work+0x3b0/0x3b0 +kthread+0x11e/0x140 +? kthread_create_worker_on_cpu+0x70/0x70 +ret_from_fork+0x3a/0x50 + +This issue is seen with warm reboot stability testing. + +Signed-off-by: Shen Jing +Signed-off-by: Saranya Gopal +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 26 ++++++++------------------ + 1 file changed, 8 insertions(+), 18 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 3ada83d81bda..31e8bf3578c8 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -215,7 +215,6 @@ struct ffs_io_data { + + struct mm_struct *mm; + struct work_struct work; +- struct work_struct cancellation_work; + + struct usb_ep *ep; + struct usb_request *req; +@@ -1073,31 +1072,22 @@ ffs_epfile_open(struct inode *inode, struct file *file) + return 0; + } + +-static void ffs_aio_cancel_worker(struct work_struct *work) +-{ +- struct ffs_io_data *io_data = container_of(work, struct ffs_io_data, +- cancellation_work); +- +- ENTER(); +- +- usb_ep_dequeue(io_data->ep, io_data->req); +-} +- + static int ffs_aio_cancel(struct kiocb *kiocb) + { + struct ffs_io_data *io_data = kiocb->private; +- struct ffs_data *ffs = io_data->ffs; ++ struct ffs_epfile *epfile = kiocb->ki_filp->private_data; + int value; + + ENTER(); + +- if (likely(io_data && io_data->ep && io_data->req)) { +- INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker); +- queue_work(ffs->io_completion_wq, &io_data->cancellation_work); +- value = -EINPROGRESS; +- } else { ++ spin_lock_irq(&epfile->ffs->eps_lock); ++ ++ if (likely(io_data && io_data->ep && io_data->req)) ++ value = usb_ep_dequeue(io_data->ep, io_data->req); ++ else + value = -EINVAL; +- } ++ ++ spin_unlock_irq(&epfile->ffs->eps_lock); + + return value; + } +-- +2.19.1 + diff --git a/queue-4.19/riscv-fix-warning-in-arch-riscv-include-asm-module.h.patch b/queue-4.19/riscv-fix-warning-in-arch-riscv-include-asm-module.h.patch new file mode 100644 index 00000000000..ffef4872222 --- /dev/null +++ b/queue-4.19/riscv-fix-warning-in-arch-riscv-include-asm-module.h.patch @@ -0,0 +1,33 @@ +From 9169d6de164f1adcf041895b12884100a915a8c1 Mon Sep 17 00:00:00 2001 +From: David Abdurachmanov +Date: Thu, 8 Nov 2018 20:07:00 +0100 +Subject: riscv: fix warning in arch/riscv/include/asm/module.h + +[ Upstream commit 0138ebb90c633f76bc71617f8f23635ce41c84fd ] + +Fixes warning: 'struct module' declared inside parameter list will not be +visible outside of this definition or declaration + +Signed-off-by: David Abdurachmanov +Acked-by: Olof Johansson +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/module.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/include/asm/module.h b/arch/riscv/include/asm/module.h +index 349df33808c4..cd2af4b013e3 100644 +--- a/arch/riscv/include/asm/module.h ++++ b/arch/riscv/include/asm/module.h +@@ -8,6 +8,7 @@ + + #define MODULE_ARCH_VERMAGIC "riscv" + ++struct module; + u64 module_emit_got_entry(struct module *mod, u64 val); + u64 module_emit_plt_entry(struct module *mod, u64 val); + +-- +2.19.1 + diff --git a/queue-4.19/s390-ism-clear-dmbe_mask-bit-before-smc-irq-handling.patch b/queue-4.19/s390-ism-clear-dmbe_mask-bit-before-smc-irq-handling.patch new file mode 100644 index 00000000000..382422d529b --- /dev/null +++ b/queue-4.19/s390-ism-clear-dmbe_mask-bit-before-smc-irq-handling.patch @@ -0,0 +1,41 @@ +From 6ed49bc0ca8c68c33b7d15869fb2c9a946167879 Mon Sep 17 00:00:00 2001 +From: Ursula Braun +Date: Mon, 12 Nov 2018 17:06:12 +0100 +Subject: s390/ism: clear dmbe_mask bit before SMC IRQ handling + +[ Upstream commit 007b656851ed7f94ba0fa358ac3e5d7705da6846 ] + +SMC-D stress workload showed connection stalls. Since the firmware +decides to skip raising an interrupt if the SBA DMBE mask bit is +still set, this SBA DMBE mask bit should be cleared before the +IRQ handling in the SMC code runs. Otherwise there are small windows +possible with missing interrupts for incoming data. +SMC-D currently does not care about the old value of the SBA DMBE +mask. + +Acked-by: Sebastian Ott +Signed-off-by: Ursula Braun +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/ism_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c +index c0631895154e..8684bcec8ff4 100644 +--- a/drivers/s390/net/ism_drv.c ++++ b/drivers/s390/net/ism_drv.c +@@ -415,9 +415,9 @@ static irqreturn_t ism_handle_irq(int irq, void *data) + break; + + clear_bit_inv(bit, bv); ++ ism->sba->dmbe_mask[bit + ISM_DMB_BIT_OFFSET] = 0; + barrier(); + smcd_handle_irq(ism->smcd, bit + ISM_DMB_BIT_OFFSET); +- ism->sba->dmbe_mask[bit + ISM_DMB_BIT_OFFSET] = 0; + } + + if (ism->sba->e) { +-- +2.19.1 + diff --git a/queue-4.19/scsi-ufs-fix-hynix-ufs-bug-with-quirk-on-hi36xx-soc.patch b/queue-4.19/scsi-ufs-fix-hynix-ufs-bug-with-quirk-on-hi36xx-soc.patch new file mode 100644 index 00000000000..a4bfd797340 --- /dev/null +++ b/queue-4.19/scsi-ufs-fix-hynix-ufs-bug-with-quirk-on-hi36xx-soc.patch @@ -0,0 +1,92 @@ +From b99f6663a826d3e11d248d12f99df7ecddcb5c7d Mon Sep 17 00:00:00 2001 +From: Wei Li +Date: Thu, 8 Nov 2018 09:08:29 -0800 +Subject: scsi: ufs: Fix hynix ufs bug with quirk on hi36xx SoC + +[ Upstream commit 8e4829c6f7470722c1f5a1dc5769ebe09ef036d6 ] + +Hynix ufs has deviations on hi36xx platform which will result in ufs bursts +transfer failures. + +To fix the problem, the Hynix device must set the register +VS_DebugSaveConfigTime to 0x10, which will set time reference for +SaveConfigTime is 250 ns. The time reference for SaveConfigTime is 40 ns by +default. + +This patch is necessary to boot on HiKey960 boards that use Hynix UFS chips +(H28U62301AMR model: hB8aL1). + +Cc: Vinayak Holikatti +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: linux-scsi@vger.kernel.org +Signed-off-by: Wei Li +Signed-off-by: Dmitry Shmidt +[jstultz: Forward ported from older code, slight tweak to commit message] +Signed-off-by: John Stultz +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs-hisi.c | 9 +++++++++ + drivers/scsi/ufs/ufs_quirks.h | 6 ++++++ + drivers/scsi/ufs/ufshcd.c | 2 ++ + 3 files changed, 17 insertions(+) + +diff --git a/drivers/scsi/ufs/ufs-hisi.c b/drivers/scsi/ufs/ufs-hisi.c +index 46df707e6f2c..452e19f8fb47 100644 +--- a/drivers/scsi/ufs/ufs-hisi.c ++++ b/drivers/scsi/ufs/ufs-hisi.c +@@ -20,6 +20,7 @@ + #include "unipro.h" + #include "ufs-hisi.h" + #include "ufshci.h" ++#include "ufs_quirks.h" + + static int ufs_hisi_check_hibern8(struct ufs_hba *hba) + { +@@ -390,6 +391,14 @@ static void ufs_hisi_set_dev_cap(struct ufs_hisi_dev_params *hisi_param) + + static void ufs_hisi_pwr_change_pre_change(struct ufs_hba *hba) + { ++ if (hba->dev_quirks & UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME) { ++ pr_info("ufs flash device must set VS_DebugSaveConfigTime 0x10\n"); ++ /* VS_DebugSaveConfigTime */ ++ ufshcd_dme_set(hba, UIC_ARG_MIB(0xD0A0), 0x10); ++ /* sync length */ ++ ufshcd_dme_set(hba, UIC_ARG_MIB(0x1556), 0x48); ++ } ++ + /* update */ + ufshcd_dme_set(hba, UIC_ARG_MIB(0x15A8), 0x1); + /* PA_TxSkip */ +diff --git a/drivers/scsi/ufs/ufs_quirks.h b/drivers/scsi/ufs/ufs_quirks.h +index 71f73d1d1ad1..5d2dfdb41a6f 100644 +--- a/drivers/scsi/ufs/ufs_quirks.h ++++ b/drivers/scsi/ufs/ufs_quirks.h +@@ -131,4 +131,10 @@ struct ufs_dev_fix { + */ + #define UFS_DEVICE_QUIRK_HOST_PA_SAVECONFIGTIME (1 << 8) + ++/* ++ * Some UFS devices require VS_DebugSaveConfigTime is 0x10, ++ * enabling this quirk ensure this. ++ */ ++#define UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME (1 << 9) ++ + #endif /* UFS_QUIRKS_H_ */ +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 54074dd483a7..0b81d9d03357 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -230,6 +230,8 @@ static struct ufs_dev_fix ufs_fixups[] = { + UFS_FIX(UFS_VENDOR_SKHYNIX, UFS_ANY_MODEL, UFS_DEVICE_NO_VCCQ), + UFS_FIX(UFS_VENDOR_SKHYNIX, UFS_ANY_MODEL, + UFS_DEVICE_QUIRK_HOST_PA_SAVECONFIGTIME), ++ UFS_FIX(UFS_VENDOR_SKHYNIX, "hB8aL1" /*H28U62301AMR*/, ++ UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME), + + END_FIX + }; +-- +2.19.1 + diff --git a/queue-4.19/series b/queue-4.19/series new file mode 100644 index 00000000000..860638073fa --- /dev/null +++ b/queue-4.19/series @@ -0,0 +1,56 @@ +media-vicodec-lower-minimum-height-to-360.patch +media-cec-check-for-non-ok-nack-conditions-while-cla.patch +media-omap3isp-unregister-media-device-as-first.patch +media-ipu3-cio2-unregister-device-nodes-first-then-r.patch +iommu-vt-d-fix-null-pointer-dereference-in-prq_event.patch +brcmutil-really-fix-decoding-channel-info-for-160-mh.patch +mt76-fix-building-without-config_leds_class.patch +iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch +scsi-ufs-fix-hynix-ufs-bug-with-quirk-on-hi36xx-soc.patch +can-ucan-remove-set-but-not-used-variable-udev.patch +can-rcar_can-fix-erroneous-registration.patch +test_firmware-fix-error-return-getting-clobbered.patch +hid-input-ignore-battery-reported-by-symbol-ds4308.patch +batman-adv-use-explicit-tvlv-padding-for-elp-packets.patch +batman-adv-expand-merged-fragment-buffer-for-full-pa.patch +amd-iommu-fix-guest-virtual-apic-log-tail-address-re.patch +bnx2x-assign-unique-dmae-channel-number-for-fw-dmae-.patch +qed-fix-ptt-leak-in-qed_drain.patch +qed-fix-overriding-offload_tc-by-protocols-without-a.patch +qed-fix-rdma_info-structure-allocation.patch +qed-fix-reading-wrong-value-in-loop-condition.patch +usb-dwc2-pci-fix-an-error-code-in-probe.patch +revert-usb-gadget-ffs-fix-bug-when-userland-exits-wi.patch +s390-ism-clear-dmbe_mask-bit-before-smc-irq-handling.patch +nvme-fc-resolve-io-failures-during-connect.patch +bnxt_en-fix-filling-time-in-bnxt_fill_coredump_recor.patch +drm-amdgpu-add-amdgpu-max-bpc-connector-property-v2.patch +drm-amd-display-support-amdgpu-max-bpc-connector-pro.patch +net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch +net-mlx4_core-fix-uninitialized-variable-compilation.patch +net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch +drivers-net-ethernet-qlogic-qed-qed_rdma.h-fix-typo.patch +gpio-pxa-fix-legacy-non-pinctrl-aware-builds-again.patch +gpio-mockup-fix-indicated-direction.patch +tc-testing-tdc.py-ignore-errors-when-decoding-stdout.patch +tc-testing-tdc.py-guard-against-lack-of-returncode-i.patch +mtd-rawnand-qcom-namespace-prefix-some-commands.patch +cpufreq-ti-cpufreq-only-register-platform_device-whe.patch +exec-make-de_thread-freezable.patch +revert-hid-uhid-use-strlcpy-instead-of-strncpy.patch +hid-multitouch-add-pointstick-support-for-cirque-tou.patch +mtd-spi-nor-fix-cadence-qspi-page-fault-kernel-panic.patch +net-ena-fix-crash-during-failed-resume-from-hibernat.patch +nfsv4-fix-a-nfsv4-state-manager-deadlock.patch +qed-fix-bitmap_weight-check.patch +qed-fix-qm-getters-to-always-return-a-valid-pq.patch +net-ibmnvic-fix-deadlock-problem-in-reset.patch +riscv-fix-warning-in-arch-riscv-include-asm-module.h.patch +net-faraday-ftmac100-remove-netif_running-netdev-che.patch +iommu-vt-d-use-memunmap-to-free-memremap.patch +nfsv4.2-copy-do-not-allocate-memory-under-the-lock.patch +flexfiles-use-per-mirror-specified-stateid-for-io.patch +ibmvnic-fix-rx-queue-buffer-cleanup.patch +ibmvnic-update-driver-queues-after-change-in-ring-si.patch +team-no-need-to-do-team_notify_peers-or-team_mcast_r.patch +net-amd-add-missing-of_node_put.patch diff --git a/queue-4.19/tc-testing-tdc.py-guard-against-lack-of-returncode-i.patch b/queue-4.19/tc-testing-tdc.py-guard-against-lack-of-returncode-i.patch new file mode 100644 index 00000000000..ecf54117483 --- /dev/null +++ b/queue-4.19/tc-testing-tdc.py-guard-against-lack-of-returncode-i.patch @@ -0,0 +1,58 @@ +From 9f18cc1fe4ec067e05c644c3c51de8ff488094a0 Mon Sep 17 00:00:00 2001 +From: "Brenda J. Butler" +Date: Fri, 16 Nov 2018 17:37:56 -0500 +Subject: tc-testing: tdc.py: Guard against lack of returncode in executed + command + +[ Upstream commit c6cecf4ae44e4ce9158ef8806358142c3512cd33 ] + +Add some defensive coding in case one of the subprocesses created by tdc +returns nothing. If no object is returned from exec_cmd, then tdc will +halt with an unhandled exception. + +Signed-off-by: Brenda J. Butler +Signed-off-by: Lucas Bates +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/tc-testing/tdc.py | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/tc-testing/tdc.py b/tools/testing/selftests/tc-testing/tdc.py +index 9b3f414ff1e9..7607ba3e3cbe 100755 +--- a/tools/testing/selftests/tc-testing/tdc.py ++++ b/tools/testing/selftests/tc-testing/tdc.py +@@ -169,6 +169,8 @@ def prepare_env(args, pm, stage, prefix, cmdlist, output = None): + file=sys.stderr) + print("\n{} *** Error message: \"{}\"".format(prefix, foutput), + file=sys.stderr) ++ print("returncode {}; expected {}".format(proc.returncode, ++ exit_codes)) + print("\n{} *** Aborting test run.".format(prefix), file=sys.stderr) + print("\n\n{} *** stdout ***".format(proc.stdout), file=sys.stderr) + print("\n\n{} *** stderr ***".format(proc.stderr), file=sys.stderr) +@@ -195,12 +197,18 @@ def run_one_test(pm, args, index, tidx): + print('-----> execute stage') + pm.call_pre_execute() + (p, procout) = exec_cmd(args, pm, 'execute', tidx["cmdUnderTest"]) +- exit_code = p.returncode ++ if p: ++ exit_code = p.returncode ++ else: ++ exit_code = None ++ + pm.call_post_execute() + +- if (exit_code != int(tidx["expExitCode"])): ++ if (exit_code is None or exit_code != int(tidx["expExitCode"])): + result = False +- print("exit:", exit_code, int(tidx["expExitCode"])) ++ print("exit: {!r}".format(exit_code)) ++ print("exit: {}".format(int(tidx["expExitCode"]))) ++ #print("exit: {!r} {}".format(exit_code, int(tidx["expExitCode"]))) + print(procout) + else: + if args.verbose > 0: +-- +2.19.1 + diff --git a/queue-4.19/tc-testing-tdc.py-ignore-errors-when-decoding-stdout.patch b/queue-4.19/tc-testing-tdc.py-ignore-errors-when-decoding-stdout.patch new file mode 100644 index 00000000000..5cfe428d615 --- /dev/null +++ b/queue-4.19/tc-testing-tdc.py-ignore-errors-when-decoding-stdout.patch @@ -0,0 +1,38 @@ +From ff8a346cd1ddcb38269e7b4c25e6ec68c2143e41 Mon Sep 17 00:00:00 2001 +From: Lucas Bates +Date: Fri, 16 Nov 2018 17:37:55 -0500 +Subject: tc-testing: tdc.py: ignore errors when decoding stdout/stderr + +[ Upstream commit 5aaf6428526bcad98d6f51f2f679c919bb75d7e9 ] + +Prevent exceptions from being raised while decoding output +from an executed command. There is no impact on tdc's +execution and the verify command phase would fail the pattern +match. + +Signed-off-by: Lucas Bates +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/tc-testing/tdc.py | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/tc-testing/tdc.py b/tools/testing/selftests/tc-testing/tdc.py +index 87a04a8a5945..9b3f414ff1e9 100755 +--- a/tools/testing/selftests/tc-testing/tdc.py ++++ b/tools/testing/selftests/tc-testing/tdc.py +@@ -134,9 +134,9 @@ def exec_cmd(args, pm, stage, command): + (rawout, serr) = proc.communicate() + + if proc.returncode != 0 and len(serr) > 0: +- foutput = serr.decode("utf-8") ++ foutput = serr.decode("utf-8", errors="ignore") + else: +- foutput = rawout.decode("utf-8") ++ foutput = rawout.decode("utf-8", errors="ignore") + + proc.stdout.close() + proc.stderr.close() +-- +2.19.1 + diff --git a/queue-4.19/team-no-need-to-do-team_notify_peers-or-team_mcast_r.patch b/queue-4.19/team-no-need-to-do-team_notify_peers-or-team_mcast_r.patch new file mode 100644 index 00000000000..856a916c0d9 --- /dev/null +++ b/queue-4.19/team-no-need-to-do-team_notify_peers-or-team_mcast_r.patch @@ -0,0 +1,48 @@ +From 81a8167acbbb38eb55c5a42f041785a4748d35d0 Mon Sep 17 00:00:00 2001 +From: Hangbin Liu +Date: Thu, 22 Nov 2018 16:15:28 +0800 +Subject: team: no need to do team_notify_peers or team_mcast_rejoin when + disabling port + +[ Upstream commit 5ed9dc99107144f83b6c1bb52a69b58875baf540 ] + +team_notify_peers() will send ARP and NA to notify peers. team_mcast_rejoin() +will send multicast join group message to notify peers. We should do this when +enabling/changed to a new port. But it doesn't make sense to do it when a port +is disabled. + +On the other hand, when we set mcast_rejoin_count to 2, and do a failover, +team_port_disable() will increase mcast_rejoin.count_pending to 2 and then +team_port_enable() will increase mcast_rejoin.count_pending to 4. We will send +4 mcast rejoin messages at latest, which will make user confused. The same +with notify_peers.count. + +Fix it by deleting team_notify_peers() and team_mcast_rejoin() in +team_port_disable(). + +Reported-by: Liang Li +Fixes: fc423ff00df3a ("team: add peer notification") +Fixes: 492b200efdd20 ("team: add support for sending multicast rejoins") +Signed-off-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/team/team.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index d887016e54b6..4b6572f0188a 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -985,8 +985,6 @@ static void team_port_disable(struct team *team, + team->en_port_count--; + team_queue_override_port_del(team, port); + team_adjust_ops(team); +- team_notify_peers(team); +- team_mcast_rejoin(team); + team_lower_state_changed(port); + } + +-- +2.19.1 + diff --git a/queue-4.19/test_firmware-fix-error-return-getting-clobbered.patch b/queue-4.19/test_firmware-fix-error-return-getting-clobbered.patch new file mode 100644 index 00000000000..448532ed967 --- /dev/null +++ b/queue-4.19/test_firmware-fix-error-return-getting-clobbered.patch @@ -0,0 +1,38 @@ +From b7687433bb1ef3911d8ab403529e24c707104a38 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Fri, 19 Oct 2018 13:58:01 +0100 +Subject: test_firmware: fix error return getting clobbered + +[ Upstream commit 8bb0a88600f0267cfcc245d34f8c4abe8c282713 ] + +In the case where eq->fw->size > PAGE_SIZE the error return rc +is being set to EINVAL however this is being overwritten to +rc = req->fw->size because the error exit path via label 'out' is +not being taken. Fix this by adding the jump to the error exit +path 'out'. + +Detected by CoverityScan, CID#1453465 ("Unused value") + +Fixes: c92316bf8e94 ("test_firmware: add batched firmware tests") +Signed-off-by: Colin Ian King +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + lib/test_firmware.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lib/test_firmware.c b/lib/test_firmware.c +index b984806d7d7b..7cab9a9869ac 100644 +--- a/lib/test_firmware.c ++++ b/lib/test_firmware.c +@@ -837,6 +837,7 @@ static ssize_t read_firmware_show(struct device *dev, + if (req->fw->size > PAGE_SIZE) { + pr_err("Testing interface must use PAGE_SIZE firmware for now\n"); + rc = -EINVAL; ++ goto out; + } + memcpy(buf, req->fw->data, req->fw->size); + +-- +2.19.1 + diff --git a/queue-4.19/usb-dwc2-pci-fix-an-error-code-in-probe.patch b/queue-4.19/usb-dwc2-pci-fix-an-error-code-in-probe.patch new file mode 100644 index 00000000000..40b82c0aa07 --- /dev/null +++ b/queue-4.19/usb-dwc2-pci-fix-an-error-code-in-probe.patch @@ -0,0 +1,34 @@ +From 18a1cd13b991d5d557dcf7923a5cbba0d7710b78 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 18 Oct 2018 10:36:47 +0300 +Subject: usb: dwc2: pci: Fix an error code in probe + +[ Upstream commit 3c135e8900199e3b9375c1eff808cceba2ee37de ] + +We added some error handling to this function but forgot to set the +error code on this path. + +Fixes: ecd29dabb2ba ("usb: dwc2: pci: Handle error cleanup in probe") +Acked-by: Minas Harutyunyan +Signed-off-by: Dan Carpenter +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/dwc2/pci.c b/drivers/usb/dwc2/pci.c +index d257c541e51b..7afc10872f1f 100644 +--- a/drivers/usb/dwc2/pci.c ++++ b/drivers/usb/dwc2/pci.c +@@ -120,6 +120,7 @@ static int dwc2_pci_probe(struct pci_dev *pci, + dwc2 = platform_device_alloc("dwc2", PLATFORM_DEVID_AUTO); + if (!dwc2) { + dev_err(dev, "couldn't allocate dwc2 device\n"); ++ ret = -ENOMEM; + goto err; + } + +-- +2.19.1 + -- 2.47.3