From e7d70e9ca41f35fb6529ae74e758f3f9c671f0ef Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 22 Aug 2018 09:37:13 +0200 Subject: [PATCH] 4.17-stable patches added patches: acpi-ec-use-ec_no_wakeup-on-more-thinkpad-x1-carbon-6th-systems.patch acpi-ec-use-ec_no_wakeup-on-thinkpad-x1-carbon-6th.patch acpi-nfit-fix-cmd_rc-for-acpi_nfit_ctl-to-always-return-a-value.patch alsa-seq-fix-ubsan-warning-at-sndrv_seq_ioctl_query_next_client-ioctl.patch amd-dc-dce100-on-dce100-set-clocks-to-0-on-suspend.patch arc-configure-apb-gpio-controller-on-arc-hsdk-platform.patch arc-enable-machine_desc-init_per_cpu-for-config_smp.patch arc-explicitly-add-mmedium-calls-to-cflags.patch arc-improve-cmpxchg-syscall-implementation.patch arm-8780-1-ftrace-only-set-kernel-memory-back-to-read-only-after-boot.patch arm-davinci-board-da850-evm-fix-wp-pin-polarity-for-mmc-sd.patch arm-dra7-omap5-enable-actlr-enable-invalidates-of-btb-for-secondary-cores.patch arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch arm-dts-armada-fix-cooling-cells-property-s-name.patch arm-dts-bcm5301x-fix-i2c-controller-interrupt-type.patch arm-dts-cygnus-fix-i2c-controller-interrupt-type.patch arm-dts-cygnus-fix-pcie-controller-interrupt-type.patch arm-dts-da850-fix-interrups-property-for-gpio.patch arm-dts-hr2-fix-interrupt-types-for-i2c-and-pcie.patch arm-dts-imx6-rdu2-fix-irq-type-for-mv88e6xxx-switch.patch arm-dts-nsp-fix-i2c-controller-interrupt-type.patch arm-dts-nsp-fix-pcie-controllers-interrupt-types.patch arm-dts-omap4-droid4-fix-dts-w.r.t.-pwm.patch arm-imx_v4_v5_defconfig-select-ulpi-support.patch arm-imx_v6_v7_defconfig-select-ulpi-support.patch arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch arm64-avoid-flush_icache_range-in-alternatives-patching-code.patch arm64-dma-mapping-clear-buffers-allocated-with-force_contiguous-flag.patch arm64-dts-meson-axg-fix-ethernet-stability-issue.patch arm64-dts-meson-gxl-fix-mali-gpu-compatible-string.patch arm64-dts-msm8916-fix-coresight-etf-graph-connections.patch arm64-dts-ns2-fix-i2c-controller-interrupt-type.patch arm64-dts-ns2-fix-pcie-controller-interrupt-type.patch arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742k.patch arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742t.patch arm64-dts-stingray-fix-i2c-controller-interrupt-type.patch arm64-dts-uniphier-fix-widget-name-of-headphone-for-ld11-ld20-boards.patch arm64-make-secondary_start_kernel-notrace.patch ath10k-update-the-phymode-along-with-bandwidth-change-request.patch batman-adv-avoid-storing-non-tt-sync-flags-on-singular-entries-too.patch batman-adv-fix-bat_ogm_iv-best-gw-refcnt-after-netlink-dump.patch batman-adv-fix-bat_v-best-gw-refcnt-after-netlink-dump.patch batman-adv-fix-debugfs-path-for-renamed-hardif.patch batman-adv-fix-debugfs-path-for-renamed-softif.patch batman-adv-fix-multicast-tt-issues-with-bogus-roam-flags.patch blk-mq-debugfs-off-by-one-in-blk_mq_rq_state_name.patch blk-mq-don-t-queue-more-if-we-get-a-busy-return.patch block-sed-opal-fix-a-couple-off-by-one-bugs.patch bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch bnxt_en-always-set-output-parameters-in-bnxt_get_max_rings.patch bnxt_en-do-not-modify-max-irq-count-after-rdma-driver-requests-frees-irqs.patch bnxt_en-fix-for-system-hang-if-request_irq-fails.patch bnxt_en-fix-inconsistent-bnxt_flag_agg_rings-logic.patch bnxt_en-fix-the-vlan_tci-exact-match-check.patch bpf-fix-sk_skb-programs-without-skb-dev-assigned.patch bpf-hash-map-decrement-counter-on-error.patch bpf-s390-fix-potential-memleak-when-later-bpf_jit_prog-fails.patch brcmfmac-stop-watchdog-before-detach-and-free-everything.patch btrfs-scrub-don-t-use-inode-page-cache-in-scrub_handle_errored_block.patch ceph-fix-dentry-leak-in-splice_dentry.patch clk-davinci-cfgchip-testing-the-wrong-variable.patch clk-sunxi-ng-replace-lib-y-with-obj-y.patch clocksource-drivers-stm32-fix-error-return-code.patch crypto-arm-speck-fix-building-in-thumb2-mode.patch cxgb4-assume-flash-part-size-to-be-4mb-if-it-can-t-be-determined.patch cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch dev-dax-check_vma-ratelimit-dev_info-s.patch dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch dmaengine-pl330-report-burst-residue-granularity.patch dmaengine-ti-omap-dma-fix-omap1510-incorrect-residue_granularity.patch dpaa_eth-dpaa-sgt-needs-to-be-256b.patch drbd-fix-drbd_request_prepare-discard-handling.patch drivers-perf-xgene_pmu-fix-iob-slow-pmu-parser-error.patch drm-amd-powerplay-correct-vega12-thermal-support-as-true.patch drm-amdgpu-fix-swapped-emit_ib_size-in-vce3.patch drm-arm-malidp-ensure-that-the-crtcs-are-shutdown-before-removing-any-encoder-connector.patch drm-arm-malidp-preserve-layer_format-contents-when-setting-format.patch drm-armada-fix-colorkey-mode-property.patch drm-armada-fix-irq-handling.patch drm-bridge-sii8620-fix-display-modes-validation.patch drm-bridge-sii8620-fix-display-of-packed-pixel-modes-in-mhl2.patch drm-bridge-sii8620-fix-display-of-packed-pixel-modes.patch drm-bridge-sii8620-fix-loops-in-edid-fetch-logic.patch drm-bridge-sii8620-fix-potential-buffer-overflow.patch drm-exynos-decon5433-fix-per-plane-global-alpha-for-xrgb-modes.patch drm-exynos-decon5433-fix-winconx-reset-value.patch drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch drm-mali-dp-enable-global-se-interrupts-mask-for-dp500.patch drm-mali-dp-rectify-the-width-and-height-passed-to-rotmem_required.patch drm-nouveau-gem-off-by-one-bugs-in-nouveau_gem_pushbuf_reloc_apply.patch drm-sun4i-link-in-front-end-code-if-needed.patch drm-tegra-fix-comparison-operator-for-buffer-size.patch dwc2-gadget-fix-isoc-in-ddma-pid-bitfield-value-calculation.patch edac-add-missing-mem_lrddr4-entry-in-edac_mem_types.patch enic-initialize-enic-rfs_h.lock-in-enic_probe.patch fsl-fman-fix-parser-reporting-bad-checksum-on-short-frames.patch gpu-host1x-check-whether-size-of-unpin-isn-t-0.patch gpu-host1x-skip-iommu-initialization-if-firewall-is-enabled.patch hid-google-add-support-for-whiskers.patch hid-wacom-correct-touch-maximum-xy-of-2nd-gen-intuos.patch hv-netvsc-fix-handling-of-fallback-to-single-queue-mode.patch hwmon-dell-smm-disable-fan-support-for-dell-xps13-9333.patch hwmon-nct6775-fix-loop-limit.patch ib-mlx4-fix-an-error-handling-path-in-mlx4_ib_rereg_user_mr.patch ib-rxe-avoid-double-kfree-skb.patch ib-rxe-fix-missing-completion-for-mem_reg-work-requests.patch ibmvnic-fix-error-recovery-on-login-failure.patch ibmvnic-revise-rx-tx-queue-error-messages.patch ieee802154-6lowpan-set-ifla_link.patch ieee802154-at86rf230-switch-from-bug_on-to-warn_on-on-problem.patch ieee802154-at86rf230-use-__func__-macro-for-debug-messages.patch ieee802154-fakelb-switch-from-bug_on-to-warn_on-on-problem.patch ieee802154-mcr20a-add-missing-includes.patch iio-pressure-bmp280-fix-relative-humidity-unit.patch input-synaptics-rmi4-fix-axis-swap-behavior.patch ipfrag-really-prevent-allocation-on-netns-exit.patch ipmi-kcs_bmc-fix-irq-exception-if-the-channel-is-not-open.patch ipv6-make-ipv6_renew_options-interrupt-kernel-safe.patch ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch ipvlan-call-dev_change_flags-when-ipvlan-mode-is-reset.patch irqchip-gic-v2m-fix-spi-release-on-error-path.patch irqchip-gic-v3-its-fix-reprogramming-of-redistributors-on-cpu-hotplug.patch ixgbe-be-more-careful-when-modifying-mac-filters.patch ixgbe-off-by-one-in-ixgbe_ipsec_tx.patch kasan-fix-shadow_size-calculation-error-in-kasan_module_alloc.patch kbuild-suppress-warnings-from-getconf-lfs_.patch kconfig-fix-line-numbers-for-if-entries-in-menu-tree.patch kthread-sched-core-fix-kthread_parkme-again.patch kvm-arm-arm64-drop-resource-size-check-for-gicv-window.patch kvm-nvmx-restore-exit-qual-for-vm-entry-failure-due-to-msr-loading.patch kvmclock-fix-tsc-calibration-for-nested-guests.patch libahci-fix-possible-spectre-v1-pmp-indexing-in-ahci_led_store.patch locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch m68k-fix-bad-page-state-oops-on-coldfire-boot.patch mac80211-disable-bhs-preemption-in-ieee80211_tx_control_port.patch md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch mm-make-vm_area_alloc-initialize-core-fields.patch mm-make-vm_area_dup-actually-copy-the-old-vma-data.patch mm-use-helper-functions-for-allocating-and-freeing-vm_area-structs.patch mtd-dataflash-use-ull-suffix-for-64-bit-constants.patch nbd-add-the-nbd-nbd_disconnect_on_close-config-flag.patch nds32-fix-the-dts-pointer-is-not-passed-correctly-issue.patch net-9p-client.c-put-refcount-of-trans_mod-in-error-case-in-parse_opts.patch net-cavium-add-fine-granular-dependencies-on-pci.patch net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch net-ethernet-freescale-fman-fix-cross-build-error.patch net-hamradio-use-eth_broadcast_addr.patch net-ieee802154-adf7242-fix-erroneous-rx-enable.patch net-ieee802154-adf7242-fix-ocl-calibration-runs.patch net-macb-free-rx-ring-for-all-queues.patch net-mlx5-e-switch-disallow-vlan-spoofcheck-setup-if-not-being-esw-manager.patch net-phy-marvell-change-default-m88e1510-led-configuration.patch net-propagate-dev_get_valid_name-return-code.patch net-qca_spi-avoid-packet-drop-during-initial-sync.patch net-qca_spi-fix-log-level-if-probe-fails.patch net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch net-qrtr-broadcast-messages-only-from-control-port.patch net-qrtr-reset-the-node-and-port-id-of-broadcast-messages.patch net-sched-act_csum-fix-null-dereference-when-goto-chain-is-used.patch net-sched-act_tunnel_key-fix-null-dereference-when-goto-chain-is-used.patch net-smc-reset-recv-timeout-after-clc-handshake.patch net-stmmac-socfpga-add-additional-ocp-reset-line-for-stratix10.patch net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch netfilter-nf_conntrack-fix-possible-possible-crash-on-module-loading.patch netfilter-nf_ct_helper-fix-possible-panic-after-nf_conntrack_helper_unregister.patch netfilter-nf_log-fix-uninit-read-in-nf_log_proc_dostring.patch netfilter-nft_compat-explicitly-reject-error-and-standard-target.patch netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch nfc-pn533-fix-wrong-gfp-flag-usage.patch nfit-fix-unchecked-dereference-in-acpi_nfit_ctl.patch nfp-bpf-don-t-stop-offload-if-replace-failed.patch nfp-cast-sizeof-to-int-when-comparing-with-error-code.patch nl80211-check-nla_parse_nested-return-values.patch nl80211-relax-ht-operation-checks-for-mesh.patch nvme-ensure-forward-progress-during-admin-passthru.patch nvme-fix-handling-of-metadata_len-for-nvme_ioctl_io_cmd.patch nvme-pci-move-nvme_kill_queues-to-nvme_remove_dead_ctrl.patch nvme-rdma-fix-command-completion-race-at-error-recovery.patch nvme-rdma-fix-possible-double-free-condition-when-failing-to-create-a-controller.patch nvmem-don-t-let-a-null-cell_id-for-nvmem_cell_get-crash-us.patch nvmet-reset-keep-alive-timer-in-controller-enable.patch objtool-support-gcc-8-fnoreorder-functions.patch octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch of-overlay-update-phandle-cache-on-overlay-apply-and-remove.patch openrisc-entry-fix-delay-slot-exception-detection.patch packet-reset-network-header-if-packet-shorter-than-ll-reserved-space.patch pci-aardvark-fix-i-o-space-page-leak.patch pci-designware-fix-i-o-space-page-leak.patch pci-faraday-add-missing-of_node_put.patch pci-faraday-fix-i-o-space-page-leak.patch pci-mediatek-fix-i-o-space-page-leak.patch pci-of-fix-i-o-space-page-leak.patch pci-v3-semi-fix-i-o-space-page-leak.patch pci-versatile-fix-i-o-space-page-leak.patch pci-xgene-fix-i-o-space-page-leak.patch pci-xilinx-add-missing-of_node_put.patch pci-xilinx-nwl-add-missing-of_node_put.patch perf-bench-fix-numa-report-output-code.patch perf-llvm-utils-remove-bashism-from-kernel-include-fetch-script.patch perf-record-support-s390-random-socket_id-assignment.patch perf-report-powerpc-fix-crash-if-callchain-is-empty.patch perf-script-fix-crash-because-of-missing-evsel-priv.patch perf-script-python-fix-dict-reference-counting.patch perf-test-session-topology-fix-test-on-s390.patch perf-test-shell-prevent-temporary-editor-files-from-being-considered-test-scripts.patch perf-tests-add-event-parsing-error-handling-to-parse-events-test.patch perf-tools-fix-a-clang-7.0-compilation-error.patch perf-tools-fix-compilation-errors-on-gcc8.patch perf-tools-fix-crash-caused-by-accessing-feat_ops.patch perf-tools-fix-error-index-for-pmu-event-parser.patch perf-tools-use-python-config-includes-rather-than-cflags.patch pinctrl-ingenic-fix-inverted-direction-for-jz4770.patch pinctrl-nsp-fix-potential-null-dereference.patch pinctrl-nsp-off-by-ones-in-nsp_pinmux_enable.patch platform-x86-dell-laptop-fix-backlight-detection.patch pnfs-always-free-the-session-slot-on-error-in-nfs4_layoutget_handle_exception.patch posix-timers-fix-nanosleep_copyout-for-config_compat_32bit_time.patch powerpc-smp_send_stop-do-not-offline-stopped-cpus.patch pty-fix-o_cloexec-for-tiocgptpeer.patch qed-add-sanity-check-for-simd-fastpath-handler.patch qed-do-not-advertise-dcbx_lld_managed-capability.patch qed-fix-possible-memory-leak-in-rx-error-path-handling.patch qed-off-by-one-in-qed_parse_mcp_trace_buf.patch qlogic-check-kstrtoul-for-errors.patch r8169-fix-mac-address-change.patch ravb-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch ravb-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch rdma-mlx5-fix-memory-leak-in-mlx5_ib_create_srq-error-path.patch rdma-qedr-fix-null-pointer-dereference-when-running-over-iwarp-without-rdma-cm.patch rds-clean-up-loopback-rds_connections-on-netns-deletion.patch risc-v-don-t-include-irq-riscv-intc.h.patch risc-v-fix-ptrace_setregset-bug.patch risc-v-fix-r_riscv_add32-r_riscv_sub32-relocations.patch rtc-fix-alarm-read-and-set-offset.patch s390-qeth-consistently-re-enable-device-features.patch samples-bpf-add-missing-linux-if_vlan.h.patch samples-bpf-check-the-error-of-write-and-read.patch samples-bpf-check-the-result-of-system.patch samples-bpf-fix-tc-and-ip-paths-in-xdp2skb_meta.sh.patch sched-deadline-fix-switched_from_dl-warning.patch sched-fair-fix-bandwidth-timer-clock-drift-condition.patch sched-nohz-skip-remote-tick-on-idle-task-entirely.patch sched-util_est-fix-util_est_dequeue-for-throttled-cfs_rq.patch scsi-hpsa-correct-enclosure-sas-address.patch scsi-qedf-send-the-driver-state-to-mfw.patch scsi-qedi-send-driver-state-to-mfw.patch scsi-xen-scsifront-add-error-handling-for-xenbus_printf.patch sctp-fix-erroneous-inc-of-snmp-sctpfragusrmsgs.patch selftests-bpf-notification-about-privilege-required-to-run-test_kmod.sh-testing-script.patch selftests-bpf-test-offloads-even-with-bpf-programs-present.patch selftests-net-add-config-fragments.patch selftests-pstore-return-kselftest-skip-code-for-skipped-tests.patch selftests-static_keys-return-kselftest-skip-code-for-skipped-tests.patch selftests-sync-add-config-fragment-for-testing-sync-framework.patch selftests-sysctl-return-kselftest-skip-code-for-skipped-tests.patch selftests-user-return-kselftest-skip-code-for-skipped-tests.patch selftests-vm-return-kselftest-skip-code-for-skipped-tests.patch selftests-x86-sigreturn-64-fix-spurious-failures-on-amd-cpus.patch selftests-x86-sigreturn-do-minor-cleanups.patch selftests-zram-return-kselftest-skip-code-for-skipped-tests.patch sfc-avoid-hang-from-nested-use-of-the-filter_sem.patch sfc-hold-filter_sem-consistently-during-reset.patch sfp-ensure-we-clean-up-properly-on-bus-registration-failure.patch sfp-fix-module-initialisation-with-netdev-already-up.patch sh_eth-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch sh_eth-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch smack-mark-inode-instant-in-smack_task_to_inode.patch smb3-increase-initial-number-of-credits-requested-to-allow-write.patch smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch soc-imx-gpc-restrict-register-range-for-regmap-access.patch soc-imx-gpcv2-correct-pgc-offset.patch tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch tcp-remove-delayed-ack-events-in-dctcp.patch tipc-correct-discovery-message-handling-during-address-trial-period.patch tipc-fix-correct-setting-of-message-type-in-second-discoverer.patch tipc-fix-wrong-return-value-from-function-tipc_node_try_addr.patch tipc-make-function-tipc_net_finalize-thread-safe.patch tls-fix-skb_to_sgvec-returning-unhandled-error.patch tools-build-fixup-host-c-flags.patch tools-build-use-hostldflags-with-fixdep.patch tools-include-uapi-update-if_link.h-to-pick-ifla_-brport_isolated-vxlan_ttl_inherit.patch tools-testing-nvdimm-advertise-a-write-cache-for-nfit_test.patch tracing-use-__printf-markup-to-silence-compiler.patch typec-tcpm-fix-a-msecs-vs-jiffies-bug.patch usb-chipidea-host-fix-disconnection-detect-issue.patch usb-dwc2-alloc-dma-aligned-buffer-for-isoc-split-in.patch usb-dwc2-fix-host-exit-from-hibernation-flow.patch usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch usb-dwc2-gadget-fix-issue-in-dwc2_gadget_start_isoc.patch usb-dwc3-of-simple-fix-use-after-free-on-remove.patch usb-dwc3-pci-add-support-for-intel-icelake.patch usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch usb-gadget-dwc2-fix-memory-leak-in-gadget_init.patch usb-gadget-ffs-fix-bug-when-userland-exits-with-submitted-aio-transfers.patch usb-xhci-dbc-don-t-decrement-runtime-pm-counter-if-dbc-is-not-started.patch usb-xhci-increase-crs-timeout-value.patch usb-xhci-remove-the-code-build-warning.patch vfio-ccw-fix-error-return-in-vfio_ccw_sch_event.patch x86-microcode-intel-fix-memleak-in-save_microcode_patch.patch x86-mm-32-initialize-the-cr4-shadow-before-__flush_tlb_all.patch xen-add-error-handling-for-xenbus_printf.patch xen-scsiback-add-error-handling-for-xenbus_printf.patch --- ...-more-thinkpad-x1-carbon-6th-systems.patch | 33 ++ ..._no_wakeup-on-thinkpad-x1-carbon-6th.patch | 62 ++++ ...pi_nfit_ctl-to-always-return-a-value.patch | 42 +++ ...rv_seq_ioctl_query_next_client-ioctl.patch | 50 +++ ...on-dce100-set-clocks-to-0-on-suspend.patch | 55 +++ ...gpio-controller-on-arc-hsdk-platform.patch | 114 ++++++ ...ine_desc-init_per_cpu-for-config_smp.patch | 52 +++ ...plicitly-add-mmedium-calls-to-cflags.patch | 79 +++++ ...prove-cmpxchg-syscall-implementation.patch | 109 ++++++ ...-memory-back-to-read-only-after-boot.patch | 72 ++++ ...0-evm-fix-wp-pin-polarity-for-mmc-sd.patch | 33 ++ ...validates-of-btb-for-secondary-cores.patch | 87 +++++ ...le-reference-to-omap3-otg-controller.patch | 36 ++ ...437x-make-edt-ft5x06-a-wakeup-source.patch | 31 ++ ...da-fix-cooling-cells-property-s-name.patch | 30 ++ ...1x-fix-i2c-controller-interrupt-type.patch | 30 ++ ...us-fix-i2c-controller-interrupt-type.patch | 41 +++ ...s-fix-pcie-controller-interrupt-type.patch | 72 ++++ ...a850-fix-interrups-property-for-gpio.patch | 37 ++ ...fix-interrupt-types-for-i2c-and-pcie.patch | 88 +++++ ...u2-fix-irq-type-for-mv88e6xxx-switch.patch | 47 +++ ...sp-fix-i2c-controller-interrupt-type.patch | 31 ++ ...fix-pcie-controllers-interrupt-types.patch | 95 +++++ ...-dts-omap4-droid4-fix-dts-w.r.t.-pwm.patch | 51 +++ ..._v4_v5_defconfig-select-ulpi-support.patch | 35 ++ ..._v6_v7_defconfig-select-ulpi-support.patch | 42 +++ ...-of-icmr-registers-in-suspend-resume.patch | 45 +++ ..._range-in-alternatives-patching-code.patch | 154 ++++++++ ...allocated-with-force_contiguous-flag.patch | 48 +++ ...son-axg-fix-ethernet-stability-issue.patch | 56 +++ ...n-gxl-fix-mali-gpu-compatible-string.patch | 36 ++ ...-fix-coresight-etf-graph-connections.patch | 51 +++ ...s2-fix-i2c-controller-interrupt-type.patch | 41 +++ ...2-fix-pcie-controller-interrupt-type.patch | 41 +++ ....8v-emmc-capabilities-for-bcm958742k.patch | 34 ++ ....8v-emmc-capabilities-for-bcm958742t.patch | 31 ++ ...ay-fix-i2c-controller-interrupt-type.patch | 41 +++ ...me-of-headphone-for-ld11-ld20-boards.patch | 49 +++ ...-make-secondary_start_kernel-notrace.patch | 40 +++ ...-along-with-bandwidth-change-request.patch | 104 ++++++ ...t-sync-flags-on-singular-entries-too.patch | 41 +++ ...iv-best-gw-refcnt-after-netlink-dump.patch | 51 +++ ..._v-best-gw-refcnt-after-netlink-dump.patch | 49 +++ ...-fix-debugfs-path-for-renamed-hardif.patch | 111 ++++++ ...-fix-debugfs-path-for-renamed-softif.patch | 139 ++++++++ ...cast-tt-issues-with-bogus-roam-flags.patch | 49 +++ ...s-off-by-one-in-blk_mq_rq_state_name.patch | 33 ++ ...t-queue-more-if-we-get-a-busy-return.patch | 64 ++++ ...ed-opal-fix-a-couple-off-by-one-bugs.patch | 44 +++ ...x-timeout-in-error-or-recovery-state.patch | 77 ++++ ...put-parameters-in-bnxt_get_max_rings.patch | 39 ++ ...fter-rdma-driver-requests-frees-irqs.patch | 70 ++++ ...for-system-hang-if-request_irq-fails.patch | 43 +++ ...consistent-bnxt_flag_agg_rings-logic.patch | 43 +++ ...n-fix-the-vlan_tci-exact-match-check.patch | 79 +++++ ...kb-programs-without-skb-dev-assigned.patch | 43 +++ ...-hash-map-decrement-counter-on-error.patch | 64 ++++ ...emleak-when-later-bpf_jit_prog-fails.patch | 38 ++ ...og-before-detach-and-free-everything.patch | 76 ++++ ...-cache-in-scrub_handle_errored_block.patch | 88 +++++ ...eph-fix-dentry-leak-in-splice_dentry.patch | 31 ++ ...i-cfgchip-testing-the-wrong-variable.patch | 32 ++ ...lk-sunxi-ng-replace-lib-y-with-obj-y.patch | 109 ++++++ ...-drivers-stm32-fix-error-return-code.patch | 41 +++ ...rm-speck-fix-building-in-thumb2-mode.patch | 52 +++ ...-to-be-4mb-if-it-can-t-be-determined.patch | 104 ++++++ ...abling-dcb-set-txq-dcb-priority-to-0.patch | 36 ++ ...v-dax-check_vma-ratelimit-dev_info-s.patch | 59 ++++ ...off-by-one-in-k3_of_dma_simple_xlate.patch | 32 ++ ...330-report-burst-residue-granularity.patch | 32 ++ ...ap1510-incorrect-residue_granularity.patch | 66 ++++ .../dpaa_eth-dpaa-sgt-needs-to-be-256b.patch | 69 ++++ ...rbd_request_prepare-discard-handling.patch | 37 ++ ...ne_pmu-fix-iob-slow-pmu-parser-error.patch | 36 ++ ...rrect-vega12-thermal-support-as-true.patch | 30 ++ ...gpu-fix-swapped-emit_ib_size-in-vce3.patch | 39 ++ ...efore-removing-any-encoder-connector.patch | 56 +++ ..._format-contents-when-setting-format.patch | 46 +++ ...rm-armada-fix-colorkey-mode-property.patch | 91 +++++ queue-4.17/drm-armada-fix-irq-handling.patch | 66 ++++ ...sii8620-fix-display-modes-validation.patch | 136 +++++++ ...isplay-of-packed-pixel-modes-in-mhl2.patch | 65 ++++ ...20-fix-display-of-packed-pixel-modes.patch | 69 ++++ ...ii8620-fix-loops-in-edid-fetch-logic.patch | 75 ++++ ...ii8620-fix-potential-buffer-overflow.patch | 39 ++ ...er-plane-global-alpha-for-xrgb-modes.patch | 33 ++ ...os-decon5433-fix-winconx-reset-value.patch | 32 ++ ...16-61-yuv420-yvu420-and-yuv422-modes.patch | 96 +++++ ...-global-se-interrupts-mask-for-dp500.patch | 35 ++ ...and-height-passed-to-rotmem_required.patch | 36 ++ ...s-in-nouveau_gem_pushbuf_reloc_apply.patch | 41 +++ ...n4i-link-in-front-end-code-if-needed.patch | 45 +++ ...-comparison-operator-for-buffer-size.patch | 33 ++ ...-ddma-pid-bitfield-value-calculation.patch | 44 +++ ...g-mem_lrddr4-entry-in-edac_mem_types.patch | 36 ++ ...ialize-enic-rfs_h.lock-in-enic_probe.patch | 98 +++++ ...porting-bad-checksum-on-short-frames.patch | 46 +++ ...-check-whether-size-of-unpin-isn-t-0.patch | 33 ++ ...nitialization-if-firewall-is-enabled.patch | 35 ++ .../hid-google-add-support-for-whiskers.patch | 42 +++ ...t-touch-maximum-xy-of-2nd-gen-intuos.patch | 47 +++ ...ing-of-fallback-to-single-queue-mode.patch | 34 ++ ...able-fan-support-for-dell-xps13-9333.patch | 41 +++ queue-4.17/hwmon-nct6775-fix-loop-limit.patch | 42 +++ ...ndling-path-in-mlx4_ib_rereg_user_mr.patch | 37 ++ .../ib-rxe-avoid-double-kfree-skb.patch | 45 +++ ...completion-for-mem_reg-work-requests.patch | 35 ++ ...-fix-error-recovery-on-login-failure.patch | 40 +++ ...ic-revise-rx-tx-queue-error-messages.patch | 103 ++++++ .../ieee802154-6lowpan-set-ifla_link.patch | 42 +++ ...ch-from-bug_on-to-warn_on-on-problem.patch | 31 ++ ...se-__func__-macro-for-debug-messages.patch | 70 ++++ ...ch-from-bug_on-to-warn_on-on-problem.patch | 31 ++ ...ee802154-mcr20a-add-missing-includes.patch | 43 +++ ...re-bmp280-fix-relative-humidity-unit.patch | 43 +++ ...ynaptics-rmi4-fix-axis-swap-behavior.patch | 106 ++++++ ...lly-prevent-allocation-on-netns-exit.patch | 37 ++ ...exception-if-the-channel-is-not-open.patch | 115 ++++++ ..._renew_options-interrupt-kernel-safe.patch | 334 ++++++++++++++++++ ...port-interval-after-receiving-querys.patch | 58 +++ ...ange_flags-when-ipvlan-mode-is-reset.patch | 121 +++++++ ...ic-v2m-fix-spi-release-on-error-path.patch | 37 ++ ...ing-of-redistributors-on-cpu-hotplug.patch | 51 +++ ...e-careful-when-modifying-mac-filters.patch | 56 +++ .../ixgbe-off-by-one-in-ixgbe_ipsec_tx.patch | 35 ++ ...culation-error-in-kasan_module_alloc.patch | 69 ++++ ...-suppress-warnings-from-getconf-lfs_.patch | 40 +++ ...-numbers-for-if-entries-in-menu-tree.patch | 67 ++++ ...-sched-core-fix-kthread_parkme-again.patch | 212 +++++++++++ ...-resource-size-check-for-gicv-window.patch | 52 +++ ...-vm-entry-failure-due-to-msr-loading.patch | 48 +++ ...ix-tsc-calibration-for-nested-guests.patch | 38 ++ ...re-v1-pmp-indexing-in-ahci_led_store.patch | 55 +++ ...record-irq-state-within-lockdep-code.patch | 82 +++++ ...bad-page-state-oops-on-coldfire-boot.patch | 64 ++++ ...emption-in-ieee80211_tx_control_port.patch | 43 +++ ...t-complete-recovery-after-reassemble.patch | 54 +++ ...vm_area_alloc-initialize-core-fields.patch | 206 +++++++++++ ...a_dup-actually-copy-the-old-vma-data.patch | 87 +++++ ...locating-and-freeing-vm_area-structs.patch | 325 +++++++++++++++++ ...-use-ull-suffix-for-64-bit-constants.patch | 39 ++ ...-nbd_disconnect_on_close-config-flag.patch | 142 ++++++++ ...ointer-is-not-passed-correctly-issue.patch | 32 ++ ...rans_mod-in-error-case-in-parse_opts.patch | 52 +++ ...dd-fine-granular-dependencies-on-pci.patch | 74 ++++ ...e-against-its-compatible-if-possible.patch | 34 ++ ...freescale-fman-fix-cross-build-error.patch | 37 ++ .../net-hamradio-use-eth_broadcast_addr.patch | 52 +++ ...2154-adf7242-fix-erroneous-rx-enable.patch | 34 ++ ...154-adf7242-fix-ocl-calibration-runs.patch | 112 ++++++ ...net-macb-free-rx-ring-for-all-queues.patch | 49 +++ ...check-setup-if-not-being-esw-manager.patch | 99 ++++++ ...e-default-m88e1510-led-configuration.patch | 126 +++++++ ...agate-dev_get_valid_name-return-code.patch | 42 +++ ...void-packet-drop-during-initial-sync.patch | 33 ++ ...qca_spi-fix-log-level-if-probe-fails.patch | 62 ++++ ...-sure-the-qca7000-reset-is-triggered.patch | 34 ++ ...cast-messages-only-from-control-port.patch | 32 ++ ...de-and-port-id-of-broadcast-messages.patch | 39 ++ ...-dereference-when-goto-chain-is-used.patch | 155 ++++++++ ...-dereference-when-goto-chain-is-used.patch | 150 ++++++++ ...set-recv-timeout-after-clc-handshake.patch | 48 +++ ...itional-ocp-reset-line-for-stratix10.patch | 86 +++++ ...0-demote-allmulti-message-to-dev_dbg.patch | 37 ++ ...efrag-reduce-struct-net-memory-waste.patch | 72 ++++ ...ble-possible-crash-on-module-loading.patch | 64 ++++ ...after-nf_conntrack_helper_unregister.patch | 50 +++ ...-uninit-read-in-nf_log_proc_dostring.patch | 35 ++ ...tly-reject-error-and-standard-target.patch | 55 +++ ...-set-module-owner-for-icmp-6-matches.patch | 44 +++ .../nfc-pn533-fix-wrong-gfp-flag-usage.patch | 45 +++ ...checked-dereference-in-acpi_nfit_ctl.patch | 56 +++ ...don-t-stop-offload-if-replace-failed.patch | 70 ++++ ...o-int-when-comparing-with-error-code.patch | 34 ++ ...check-nla_parse_nested-return-values.patch | 51 +++ ...1-relax-ht-operation-checks-for-mesh.patch | 76 ++++ ...rward-progress-during-admin-passthru.patch | 123 +++++++ ...f-metadata_len-for-nvme_ioctl_io_cmd.patch | 34 ++ ...kill_queues-to-nvme_remove_dead_ctrl.patch | 58 +++ ...nd-completion-race-at-error-recovery.patch | 99 ++++++ ...-when-failing-to-create-a-controller.patch | 89 +++++ ...-cell_id-for-nvmem_cell_get-crash-us.patch | 75 ++++ ...eep-alive-timer-in-controller-enable.patch | 40 +++ ...l-support-gcc-8-fnoreorder-functions.patch | 102 ++++++ ...registers-configuration-on-mtu-setup.patch | 63 ++++ ...le-cache-on-overlay-apply-and-remove.patch | 95 +++++ ...y-fix-delay-slot-exception-detection.patch | 107 ++++++ ...acket-shorter-than-ll-reserved-space.patch | 35 ++ ...pci-aardvark-fix-i-o-space-page-leak.patch | 89 +++++ ...i-designware-fix-i-o-space-page-leak.patch | 92 +++++ .../pci-faraday-add-missing-of_node_put.patch | 41 +++ .../pci-faraday-fix-i-o-space-page-leak.patch | 88 +++++ ...pci-mediatek-fix-i-o-space-page-leak.patch | 90 +++++ .../pci-of-fix-i-o-space-page-leak.patch | 148 ++++++++ .../pci-v3-semi-fix-i-o-space-page-leak.patch | 89 +++++ ...ci-versatile-fix-i-o-space-page-leak.patch | 88 +++++ .../pci-xgene-fix-i-o-space-page-leak.patch | 89 +++++ .../pci-xilinx-add-missing-of_node_put.patch | 34 ++ ...i-xilinx-nwl-add-missing-of_node_put.patch | 35 ++ ...rf-bench-fix-numa-report-output-code.patch | 60 ++++ ...ism-from-kernel-include-fetch-script.patch | 62 ++++ ...ort-s390-random-socket_id-assignment.patch | 92 +++++ ...erpc-fix-crash-if-callchain-is-empty.patch | 72 ++++ ...-crash-because-of-missing-evsel-priv.patch | 75 ++++ ...t-python-fix-dict-reference-counting.patch | 68 ++++ ...st-session-topology-fix-test-on-s390.patch | 62 ++++ ...s-from-being-considered-test-scripts.patch | 48 +++ ...-error-handling-to-parse-events-test.patch | 87 +++++ ...ls-fix-a-clang-7.0-compilation-error.patch | 80 +++++ ...tools-fix-compilation-errors-on-gcc8.patch | 80 +++++ ...x-crash-caused-by-accessing-feat_ops.patch | 126 +++++++ ...fix-error-index-for-pmu-event-parser.patch | 61 ++++ ...n-config-includes-rather-than-cflags.patch | 50 +++ ...ic-fix-inverted-direction-for-jz4770.patch | 31 ++ ...l-nsp-fix-potential-null-dereference.patch | 46 +++ ...nsp-off-by-ones-in-nsp_pinmux_enable.patch | 35 ++ ...-dell-laptop-fix-backlight-detection.patch | 54 +++ ...r-in-nfs4_layoutget_handle_exception.patch | 68 ++++ ...copyout-for-config_compat_32bit_time.patch | 41 +++ ...end_stop-do-not-offline-stopped-cpus.patch | 77 ++++ .../pty-fix-o_cloexec-for-tiocgptpeer.patch | 32 ++ ...nity-check-for-simd-fastpath-handler.patch | 45 +++ ...dvertise-dcbx_lld_managed-capability.patch | 60 ++++ ...emory-leak-in-rx-error-path-handling.patch | 57 +++ ...ff-by-one-in-qed_parse_mcp_trace_buf.patch | 33 ++ .../qlogic-check-kstrtoul-for-errors.patch | 31 ++ queue-4.17/r8169-fix-mac-address-change.patch | 33 ++ ...-calling-auto-negotiation-by-ethtool.patch | 46 +++ ...ile-changing-link-options-by-ethtool.patch | 117 ++++++ ...eak-in-mlx5_ib_create_srq-error-path.patch | 55 +++ ...n-running-over-iwarp-without-rdma-cm.patch | 41 +++ ...ck-rds_connections-on-netns-deletion.patch | 166 +++++++++ ...isc-v-don-t-include-irq-riscv-intc.h.patch | 34 ++ .../risc-v-fix-ptrace_setregset-bug.patch | 31 ++ ...iscv_add32-r_riscv_sub32-relocations.patch | 39 ++ .../rtc-fix-alarm-read-and-set-offset.patch | 60 ++++ ...nsistently-re-enable-device-features.patch | 122 +++++++ ...ples-bpf-add-missing-linux-if_vlan.h.patch | 50 +++ ...pf-check-the-error-of-write-and-read.patch | 65 ++++ ...mples-bpf-check-the-result-of-system.patch | 87 +++++ ...x-tc-and-ip-paths-in-xdp2skb_meta.sh.patch | 50 +++ ...eadline-fix-switched_from_dl-warning.patch | 85 +++++ ...andwidth-timer-clock-drift-condition.patch | 133 +++++++ ...ip-remote-tick-on-idle-task-entirely.patch | 120 +++++++ ...til_est_dequeue-for-throttled-cfs_rq.patch | 69 ++++ ...i-hpsa-correct-enclosure-sas-address.patch | 77 ++++ ...si-qedf-send-the-driver-state-to-mfw.patch | 55 +++ .../scsi-qedi-send-driver-state-to-mfw.patch | 54 +++ ...add-error-handling-for-xenbus_printf.patch | 94 +++++ ...rroneous-inc-of-snmp-sctpfragusrmsgs.patch | 38 ++ ...d-to-run-test_kmod.sh-testing-script.patch | 41 +++ ...loads-even-with-bpf-programs-present.patch | 65 ++++ .../selftests-net-add-config-fragments.patch | 28 ++ ...selftest-skip-code-for-skipped-tests.patch | 49 +++ ...selftest-skip-code-for-skipped-tests.patch | 53 +++ ...-fragment-for-testing-sync-framework.patch | 36 ++ ...selftest-skip-code-for-skipped-tests.patch | 98 +++++ ...selftest-skip-code-for-skipped-tests.patch | 44 +++ ...selftest-skip-code-for-skipped-tests.patch | 149 ++++++++ ...64-fix-spurious-failures-on-amd-cpus.patch | 94 +++++ ...ests-x86-sigreturn-do-minor-cleanups.patch | 61 ++++ ...selftest-skip-code-for-skipped-tests.patch | 68 ++++ queue-4.17/series | 304 ++++++++++++++++ ...ng-from-nested-use-of-the-filter_sem.patch | 120 +++++++ ...filter_sem-consistently-during-reset.patch | 87 +++++ ...properly-on-bus-registration-failure.patch | 98 +++++ ...nitialisation-with-netdev-already-up.patch | 60 ++++ ...-calling-auto-negotiation-by-ethtool.patch | 49 +++ ...ile-changing-link-options-by-ethtool.patch | 122 +++++++ ...inode-instant-in-smack_task_to_inode.patch | 34 ++ ...-of-credits-requested-to-allow-write.patch | 40 +++ ...-for-gigabit-link-up-hardware-errata.patch | 105 ++++++ ...ict-register-range-for-regmap-access.patch | 88 +++++ .../soc-imx-gpcv2-correct-pgc-offset.patch | 58 +++ ...ify-cryptic-messages-as-tcp-seq-bugs.patch | 54 +++ ...p-remove-delayed-ack-events-in-dctcp.patch | 111 ++++++ ...handling-during-address-trial-period.patch | 49 +++ ...of-message-type-in-second-discoverer.patch | 58 +++ ...lue-from-function-tipc_node_try_addr.patch | 53 +++ ...nction-tipc_net_finalize-thread-safe.patch | 48 +++ ...b_to_sgvec-returning-unhandled-error.patch | 47 +++ .../tools-build-fixup-host-c-flags.patch | 43 +++ ...ls-build-use-hostldflags-with-fixdep.patch | 32 ++ ...a_-brport_isolated-vxlan_ttl_inherit.patch | 49 +++ ...dvertise-a-write-cache-for-nfit_test.patch | 38 ++ ...-__printf-markup-to-silence-compiler.patch | 69 ++++ ...ypec-tcpm-fix-a-msecs-vs-jiffies-bug.patch | 34 ++ ...-host-fix-disconnection-detect-issue.patch | 42 +++ ...dma-aligned-buffer-for-isoc-split-in.patch | 282 +++++++++++++++ ...-fix-host-exit-from-hibernation-flow.patch | 48 +++ ...-isoc-split-in-transfer-with-no-data.patch | 59 ++++ ...-fix-issue-in-dwc2_gadget_start_isoc.patch | 34 ++ ...-simple-fix-use-after-free-on-remove.patch | 35 ++ ...c3-pci-add-support-for-intel-icelake.patch | 37 ++ ...us-race-condition-when-set_interface.patch | 42 +++ ...-dwc2-fix-memory-leak-in-gadget_init.patch | 49 +++ ...d-exits-with-submitted-aio-transfers.patch | 130 +++++++ ...ime-pm-counter-if-dbc-is-not-started.patch | 71 ++++ .../usb-xhci-increase-crs-timeout-value.patch | 42 +++ ...b-xhci-remove-the-code-build-warning.patch | 39 ++ ...x-error-return-in-vfio_ccw_sch_event.patch | 54 +++ ...-fix-memleak-in-save_microcode_patch.patch | 39 ++ ...he-cr4-shadow-before-__flush_tlb_all.patch | 48 +++ ...add-error-handling-for-xenbus_printf.patch | 57 +++ ...add-error-handling-for-xenbus_printf.patch | 72 ++++ 305 files changed, 19900 insertions(+) create mode 100644 queue-4.17/acpi-ec-use-ec_no_wakeup-on-more-thinkpad-x1-carbon-6th-systems.patch create mode 100644 queue-4.17/acpi-ec-use-ec_no_wakeup-on-thinkpad-x1-carbon-6th.patch create mode 100644 queue-4.17/acpi-nfit-fix-cmd_rc-for-acpi_nfit_ctl-to-always-return-a-value.patch create mode 100644 queue-4.17/alsa-seq-fix-ubsan-warning-at-sndrv_seq_ioctl_query_next_client-ioctl.patch create mode 100644 queue-4.17/amd-dc-dce100-on-dce100-set-clocks-to-0-on-suspend.patch create mode 100644 queue-4.17/arc-configure-apb-gpio-controller-on-arc-hsdk-platform.patch create mode 100644 queue-4.17/arc-enable-machine_desc-init_per_cpu-for-config_smp.patch create mode 100644 queue-4.17/arc-explicitly-add-mmedium-calls-to-cflags.patch create mode 100644 queue-4.17/arc-improve-cmpxchg-syscall-implementation.patch create mode 100644 queue-4.17/arm-8780-1-ftrace-only-set-kernel-memory-back-to-read-only-after-boot.patch create mode 100644 queue-4.17/arm-davinci-board-da850-evm-fix-wp-pin-polarity-for-mmc-sd.patch create mode 100644 queue-4.17/arm-dra7-omap5-enable-actlr-enable-invalidates-of-btb-for-secondary-cores.patch create mode 100644 queue-4.17/arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch create mode 100644 queue-4.17/arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch create mode 100644 queue-4.17/arm-dts-armada-fix-cooling-cells-property-s-name.patch create mode 100644 queue-4.17/arm-dts-bcm5301x-fix-i2c-controller-interrupt-type.patch create mode 100644 queue-4.17/arm-dts-cygnus-fix-i2c-controller-interrupt-type.patch create mode 100644 queue-4.17/arm-dts-cygnus-fix-pcie-controller-interrupt-type.patch create mode 100644 queue-4.17/arm-dts-da850-fix-interrups-property-for-gpio.patch create mode 100644 queue-4.17/arm-dts-hr2-fix-interrupt-types-for-i2c-and-pcie.patch create mode 100644 queue-4.17/arm-dts-imx6-rdu2-fix-irq-type-for-mv88e6xxx-switch.patch create mode 100644 queue-4.17/arm-dts-nsp-fix-i2c-controller-interrupt-type.patch create mode 100644 queue-4.17/arm-dts-nsp-fix-pcie-controllers-interrupt-types.patch create mode 100644 queue-4.17/arm-dts-omap4-droid4-fix-dts-w.r.t.-pwm.patch create mode 100644 queue-4.17/arm-imx_v4_v5_defconfig-select-ulpi-support.patch create mode 100644 queue-4.17/arm-imx_v6_v7_defconfig-select-ulpi-support.patch create mode 100644 queue-4.17/arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch create mode 100644 queue-4.17/arm64-avoid-flush_icache_range-in-alternatives-patching-code.patch create mode 100644 queue-4.17/arm64-dma-mapping-clear-buffers-allocated-with-force_contiguous-flag.patch create mode 100644 queue-4.17/arm64-dts-meson-axg-fix-ethernet-stability-issue.patch create mode 100644 queue-4.17/arm64-dts-meson-gxl-fix-mali-gpu-compatible-string.patch create mode 100644 queue-4.17/arm64-dts-msm8916-fix-coresight-etf-graph-connections.patch create mode 100644 queue-4.17/arm64-dts-ns2-fix-i2c-controller-interrupt-type.patch create mode 100644 queue-4.17/arm64-dts-ns2-fix-pcie-controller-interrupt-type.patch create mode 100644 queue-4.17/arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742k.patch create mode 100644 queue-4.17/arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742t.patch create mode 100644 queue-4.17/arm64-dts-stingray-fix-i2c-controller-interrupt-type.patch create mode 100644 queue-4.17/arm64-dts-uniphier-fix-widget-name-of-headphone-for-ld11-ld20-boards.patch create mode 100644 queue-4.17/arm64-make-secondary_start_kernel-notrace.patch create mode 100644 queue-4.17/ath10k-update-the-phymode-along-with-bandwidth-change-request.patch create mode 100644 queue-4.17/batman-adv-avoid-storing-non-tt-sync-flags-on-singular-entries-too.patch create mode 100644 queue-4.17/batman-adv-fix-bat_ogm_iv-best-gw-refcnt-after-netlink-dump.patch create mode 100644 queue-4.17/batman-adv-fix-bat_v-best-gw-refcnt-after-netlink-dump.patch create mode 100644 queue-4.17/batman-adv-fix-debugfs-path-for-renamed-hardif.patch create mode 100644 queue-4.17/batman-adv-fix-debugfs-path-for-renamed-softif.patch create mode 100644 queue-4.17/batman-adv-fix-multicast-tt-issues-with-bogus-roam-flags.patch create mode 100644 queue-4.17/blk-mq-debugfs-off-by-one-in-blk_mq_rq_state_name.patch create mode 100644 queue-4.17/blk-mq-don-t-queue-more-if-we-get-a-busy-return.patch create mode 100644 queue-4.17/block-sed-opal-fix-a-couple-off-by-one-bugs.patch create mode 100644 queue-4.17/bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch create mode 100644 queue-4.17/bnxt_en-always-set-output-parameters-in-bnxt_get_max_rings.patch create mode 100644 queue-4.17/bnxt_en-do-not-modify-max-irq-count-after-rdma-driver-requests-frees-irqs.patch create mode 100644 queue-4.17/bnxt_en-fix-for-system-hang-if-request_irq-fails.patch create mode 100644 queue-4.17/bnxt_en-fix-inconsistent-bnxt_flag_agg_rings-logic.patch create mode 100644 queue-4.17/bnxt_en-fix-the-vlan_tci-exact-match-check.patch create mode 100644 queue-4.17/bpf-fix-sk_skb-programs-without-skb-dev-assigned.patch create mode 100644 queue-4.17/bpf-hash-map-decrement-counter-on-error.patch create mode 100644 queue-4.17/bpf-s390-fix-potential-memleak-when-later-bpf_jit_prog-fails.patch create mode 100644 queue-4.17/brcmfmac-stop-watchdog-before-detach-and-free-everything.patch create mode 100644 queue-4.17/btrfs-scrub-don-t-use-inode-page-cache-in-scrub_handle_errored_block.patch create mode 100644 queue-4.17/ceph-fix-dentry-leak-in-splice_dentry.patch create mode 100644 queue-4.17/clk-davinci-cfgchip-testing-the-wrong-variable.patch create mode 100644 queue-4.17/clk-sunxi-ng-replace-lib-y-with-obj-y.patch create mode 100644 queue-4.17/clocksource-drivers-stm32-fix-error-return-code.patch create mode 100644 queue-4.17/crypto-arm-speck-fix-building-in-thumb2-mode.patch create mode 100644 queue-4.17/cxgb4-assume-flash-part-size-to-be-4mb-if-it-can-t-be-determined.patch create mode 100644 queue-4.17/cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch create mode 100644 queue-4.17/dev-dax-check_vma-ratelimit-dev_info-s.patch create mode 100644 queue-4.17/dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch create mode 100644 queue-4.17/dmaengine-pl330-report-burst-residue-granularity.patch create mode 100644 queue-4.17/dmaengine-ti-omap-dma-fix-omap1510-incorrect-residue_granularity.patch create mode 100644 queue-4.17/dpaa_eth-dpaa-sgt-needs-to-be-256b.patch create mode 100644 queue-4.17/drbd-fix-drbd_request_prepare-discard-handling.patch create mode 100644 queue-4.17/drivers-perf-xgene_pmu-fix-iob-slow-pmu-parser-error.patch create mode 100644 queue-4.17/drm-amd-powerplay-correct-vega12-thermal-support-as-true.patch create mode 100644 queue-4.17/drm-amdgpu-fix-swapped-emit_ib_size-in-vce3.patch create mode 100644 queue-4.17/drm-arm-malidp-ensure-that-the-crtcs-are-shutdown-before-removing-any-encoder-connector.patch create mode 100644 queue-4.17/drm-arm-malidp-preserve-layer_format-contents-when-setting-format.patch create mode 100644 queue-4.17/drm-armada-fix-colorkey-mode-property.patch create mode 100644 queue-4.17/drm-armada-fix-irq-handling.patch create mode 100644 queue-4.17/drm-bridge-sii8620-fix-display-modes-validation.patch create mode 100644 queue-4.17/drm-bridge-sii8620-fix-display-of-packed-pixel-modes-in-mhl2.patch create mode 100644 queue-4.17/drm-bridge-sii8620-fix-display-of-packed-pixel-modes.patch create mode 100644 queue-4.17/drm-bridge-sii8620-fix-loops-in-edid-fetch-logic.patch create mode 100644 queue-4.17/drm-bridge-sii8620-fix-potential-buffer-overflow.patch create mode 100644 queue-4.17/drm-exynos-decon5433-fix-per-plane-global-alpha-for-xrgb-modes.patch create mode 100644 queue-4.17/drm-exynos-decon5433-fix-winconx-reset-value.patch create mode 100644 queue-4.17/drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch create mode 100644 queue-4.17/drm-mali-dp-enable-global-se-interrupts-mask-for-dp500.patch create mode 100644 queue-4.17/drm-mali-dp-rectify-the-width-and-height-passed-to-rotmem_required.patch create mode 100644 queue-4.17/drm-nouveau-gem-off-by-one-bugs-in-nouveau_gem_pushbuf_reloc_apply.patch create mode 100644 queue-4.17/drm-sun4i-link-in-front-end-code-if-needed.patch create mode 100644 queue-4.17/drm-tegra-fix-comparison-operator-for-buffer-size.patch create mode 100644 queue-4.17/dwc2-gadget-fix-isoc-in-ddma-pid-bitfield-value-calculation.patch create mode 100644 queue-4.17/edac-add-missing-mem_lrddr4-entry-in-edac_mem_types.patch create mode 100644 queue-4.17/enic-initialize-enic-rfs_h.lock-in-enic_probe.patch create mode 100644 queue-4.17/fsl-fman-fix-parser-reporting-bad-checksum-on-short-frames.patch create mode 100644 queue-4.17/gpu-host1x-check-whether-size-of-unpin-isn-t-0.patch create mode 100644 queue-4.17/gpu-host1x-skip-iommu-initialization-if-firewall-is-enabled.patch create mode 100644 queue-4.17/hid-google-add-support-for-whiskers.patch create mode 100644 queue-4.17/hid-wacom-correct-touch-maximum-xy-of-2nd-gen-intuos.patch create mode 100644 queue-4.17/hv-netvsc-fix-handling-of-fallback-to-single-queue-mode.patch create mode 100644 queue-4.17/hwmon-dell-smm-disable-fan-support-for-dell-xps13-9333.patch create mode 100644 queue-4.17/hwmon-nct6775-fix-loop-limit.patch create mode 100644 queue-4.17/ib-mlx4-fix-an-error-handling-path-in-mlx4_ib_rereg_user_mr.patch create mode 100644 queue-4.17/ib-rxe-avoid-double-kfree-skb.patch create mode 100644 queue-4.17/ib-rxe-fix-missing-completion-for-mem_reg-work-requests.patch create mode 100644 queue-4.17/ibmvnic-fix-error-recovery-on-login-failure.patch create mode 100644 queue-4.17/ibmvnic-revise-rx-tx-queue-error-messages.patch create mode 100644 queue-4.17/ieee802154-6lowpan-set-ifla_link.patch create mode 100644 queue-4.17/ieee802154-at86rf230-switch-from-bug_on-to-warn_on-on-problem.patch create mode 100644 queue-4.17/ieee802154-at86rf230-use-__func__-macro-for-debug-messages.patch create mode 100644 queue-4.17/ieee802154-fakelb-switch-from-bug_on-to-warn_on-on-problem.patch create mode 100644 queue-4.17/ieee802154-mcr20a-add-missing-includes.patch create mode 100644 queue-4.17/iio-pressure-bmp280-fix-relative-humidity-unit.patch create mode 100644 queue-4.17/input-synaptics-rmi4-fix-axis-swap-behavior.patch create mode 100644 queue-4.17/ipfrag-really-prevent-allocation-on-netns-exit.patch create mode 100644 queue-4.17/ipmi-kcs_bmc-fix-irq-exception-if-the-channel-is-not-open.patch create mode 100644 queue-4.17/ipv6-make-ipv6_renew_options-interrupt-kernel-safe.patch create mode 100644 queue-4.17/ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch create mode 100644 queue-4.17/ipvlan-call-dev_change_flags-when-ipvlan-mode-is-reset.patch create mode 100644 queue-4.17/irqchip-gic-v2m-fix-spi-release-on-error-path.patch create mode 100644 queue-4.17/irqchip-gic-v3-its-fix-reprogramming-of-redistributors-on-cpu-hotplug.patch create mode 100644 queue-4.17/ixgbe-be-more-careful-when-modifying-mac-filters.patch create mode 100644 queue-4.17/ixgbe-off-by-one-in-ixgbe_ipsec_tx.patch create mode 100644 queue-4.17/kasan-fix-shadow_size-calculation-error-in-kasan_module_alloc.patch create mode 100644 queue-4.17/kbuild-suppress-warnings-from-getconf-lfs_.patch create mode 100644 queue-4.17/kconfig-fix-line-numbers-for-if-entries-in-menu-tree.patch create mode 100644 queue-4.17/kthread-sched-core-fix-kthread_parkme-again.patch create mode 100644 queue-4.17/kvm-arm-arm64-drop-resource-size-check-for-gicv-window.patch create mode 100644 queue-4.17/kvm-nvmx-restore-exit-qual-for-vm-entry-failure-due-to-msr-loading.patch create mode 100644 queue-4.17/kvmclock-fix-tsc-calibration-for-nested-guests.patch create mode 100644 queue-4.17/libahci-fix-possible-spectre-v1-pmp-indexing-in-ahci_led_store.patch create mode 100644 queue-4.17/locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch create mode 100644 queue-4.17/m68k-fix-bad-page-state-oops-on-coldfire-boot.patch create mode 100644 queue-4.17/mac80211-disable-bhs-preemption-in-ieee80211_tx_control_port.patch create mode 100644 queue-4.17/md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch create mode 100644 queue-4.17/mm-make-vm_area_alloc-initialize-core-fields.patch create mode 100644 queue-4.17/mm-make-vm_area_dup-actually-copy-the-old-vma-data.patch create mode 100644 queue-4.17/mm-use-helper-functions-for-allocating-and-freeing-vm_area-structs.patch create mode 100644 queue-4.17/mtd-dataflash-use-ull-suffix-for-64-bit-constants.patch create mode 100644 queue-4.17/nbd-add-the-nbd-nbd_disconnect_on_close-config-flag.patch create mode 100644 queue-4.17/nds32-fix-the-dts-pointer-is-not-passed-correctly-issue.patch create mode 100644 queue-4.17/net-9p-client.c-put-refcount-of-trans_mod-in-error-case-in-parse_opts.patch create mode 100644 queue-4.17/net-cavium-add-fine-granular-dependencies-on-pci.patch create mode 100644 queue-4.17/net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch create mode 100644 queue-4.17/net-ethernet-freescale-fman-fix-cross-build-error.patch create mode 100644 queue-4.17/net-hamradio-use-eth_broadcast_addr.patch create mode 100644 queue-4.17/net-ieee802154-adf7242-fix-erroneous-rx-enable.patch create mode 100644 queue-4.17/net-ieee802154-adf7242-fix-ocl-calibration-runs.patch create mode 100644 queue-4.17/net-macb-free-rx-ring-for-all-queues.patch create mode 100644 queue-4.17/net-mlx5-e-switch-disallow-vlan-spoofcheck-setup-if-not-being-esw-manager.patch create mode 100644 queue-4.17/net-phy-marvell-change-default-m88e1510-led-configuration.patch create mode 100644 queue-4.17/net-propagate-dev_get_valid_name-return-code.patch create mode 100644 queue-4.17/net-qca_spi-avoid-packet-drop-during-initial-sync.patch create mode 100644 queue-4.17/net-qca_spi-fix-log-level-if-probe-fails.patch create mode 100644 queue-4.17/net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch create mode 100644 queue-4.17/net-qrtr-broadcast-messages-only-from-control-port.patch create mode 100644 queue-4.17/net-qrtr-reset-the-node-and-port-id-of-broadcast-messages.patch create mode 100644 queue-4.17/net-sched-act_csum-fix-null-dereference-when-goto-chain-is-used.patch create mode 100644 queue-4.17/net-sched-act_tunnel_key-fix-null-dereference-when-goto-chain-is-used.patch create mode 100644 queue-4.17/net-smc-reset-recv-timeout-after-clc-handshake.patch create mode 100644 queue-4.17/net-stmmac-socfpga-add-additional-ocp-reset-line-for-stratix10.patch create mode 100644 queue-4.17/net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch create mode 100644 queue-4.17/netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch create mode 100644 queue-4.17/netfilter-nf_conntrack-fix-possible-possible-crash-on-module-loading.patch create mode 100644 queue-4.17/netfilter-nf_ct_helper-fix-possible-panic-after-nf_conntrack_helper_unregister.patch create mode 100644 queue-4.17/netfilter-nf_log-fix-uninit-read-in-nf_log_proc_dostring.patch create mode 100644 queue-4.17/netfilter-nft_compat-explicitly-reject-error-and-standard-target.patch create mode 100644 queue-4.17/netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch create mode 100644 queue-4.17/nfc-pn533-fix-wrong-gfp-flag-usage.patch create mode 100644 queue-4.17/nfit-fix-unchecked-dereference-in-acpi_nfit_ctl.patch create mode 100644 queue-4.17/nfp-bpf-don-t-stop-offload-if-replace-failed.patch create mode 100644 queue-4.17/nfp-cast-sizeof-to-int-when-comparing-with-error-code.patch create mode 100644 queue-4.17/nl80211-check-nla_parse_nested-return-values.patch create mode 100644 queue-4.17/nl80211-relax-ht-operation-checks-for-mesh.patch create mode 100644 queue-4.17/nvme-ensure-forward-progress-during-admin-passthru.patch create mode 100644 queue-4.17/nvme-fix-handling-of-metadata_len-for-nvme_ioctl_io_cmd.patch create mode 100644 queue-4.17/nvme-pci-move-nvme_kill_queues-to-nvme_remove_dead_ctrl.patch create mode 100644 queue-4.17/nvme-rdma-fix-command-completion-race-at-error-recovery.patch create mode 100644 queue-4.17/nvme-rdma-fix-possible-double-free-condition-when-failing-to-create-a-controller.patch create mode 100644 queue-4.17/nvmem-don-t-let-a-null-cell_id-for-nvmem_cell_get-crash-us.patch create mode 100644 queue-4.17/nvmet-reset-keep-alive-timer-in-controller-enable.patch create mode 100644 queue-4.17/objtool-support-gcc-8-fnoreorder-functions.patch create mode 100644 queue-4.17/octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch create mode 100644 queue-4.17/of-overlay-update-phandle-cache-on-overlay-apply-and-remove.patch create mode 100644 queue-4.17/openrisc-entry-fix-delay-slot-exception-detection.patch create mode 100644 queue-4.17/packet-reset-network-header-if-packet-shorter-than-ll-reserved-space.patch create mode 100644 queue-4.17/pci-aardvark-fix-i-o-space-page-leak.patch create mode 100644 queue-4.17/pci-designware-fix-i-o-space-page-leak.patch create mode 100644 queue-4.17/pci-faraday-add-missing-of_node_put.patch create mode 100644 queue-4.17/pci-faraday-fix-i-o-space-page-leak.patch create mode 100644 queue-4.17/pci-mediatek-fix-i-o-space-page-leak.patch create mode 100644 queue-4.17/pci-of-fix-i-o-space-page-leak.patch create mode 100644 queue-4.17/pci-v3-semi-fix-i-o-space-page-leak.patch create mode 100644 queue-4.17/pci-versatile-fix-i-o-space-page-leak.patch create mode 100644 queue-4.17/pci-xgene-fix-i-o-space-page-leak.patch create mode 100644 queue-4.17/pci-xilinx-add-missing-of_node_put.patch create mode 100644 queue-4.17/pci-xilinx-nwl-add-missing-of_node_put.patch create mode 100644 queue-4.17/perf-bench-fix-numa-report-output-code.patch create mode 100644 queue-4.17/perf-llvm-utils-remove-bashism-from-kernel-include-fetch-script.patch create mode 100644 queue-4.17/perf-record-support-s390-random-socket_id-assignment.patch create mode 100644 queue-4.17/perf-report-powerpc-fix-crash-if-callchain-is-empty.patch create mode 100644 queue-4.17/perf-script-fix-crash-because-of-missing-evsel-priv.patch create mode 100644 queue-4.17/perf-script-python-fix-dict-reference-counting.patch create mode 100644 queue-4.17/perf-test-session-topology-fix-test-on-s390.patch create mode 100644 queue-4.17/perf-test-shell-prevent-temporary-editor-files-from-being-considered-test-scripts.patch create mode 100644 queue-4.17/perf-tests-add-event-parsing-error-handling-to-parse-events-test.patch create mode 100644 queue-4.17/perf-tools-fix-a-clang-7.0-compilation-error.patch create mode 100644 queue-4.17/perf-tools-fix-compilation-errors-on-gcc8.patch create mode 100644 queue-4.17/perf-tools-fix-crash-caused-by-accessing-feat_ops.patch create mode 100644 queue-4.17/perf-tools-fix-error-index-for-pmu-event-parser.patch create mode 100644 queue-4.17/perf-tools-use-python-config-includes-rather-than-cflags.patch create mode 100644 queue-4.17/pinctrl-ingenic-fix-inverted-direction-for-jz4770.patch create mode 100644 queue-4.17/pinctrl-nsp-fix-potential-null-dereference.patch create mode 100644 queue-4.17/pinctrl-nsp-off-by-ones-in-nsp_pinmux_enable.patch create mode 100644 queue-4.17/platform-x86-dell-laptop-fix-backlight-detection.patch create mode 100644 queue-4.17/pnfs-always-free-the-session-slot-on-error-in-nfs4_layoutget_handle_exception.patch create mode 100644 queue-4.17/posix-timers-fix-nanosleep_copyout-for-config_compat_32bit_time.patch create mode 100644 queue-4.17/powerpc-smp_send_stop-do-not-offline-stopped-cpus.patch create mode 100644 queue-4.17/pty-fix-o_cloexec-for-tiocgptpeer.patch create mode 100644 queue-4.17/qed-add-sanity-check-for-simd-fastpath-handler.patch create mode 100644 queue-4.17/qed-do-not-advertise-dcbx_lld_managed-capability.patch create mode 100644 queue-4.17/qed-fix-possible-memory-leak-in-rx-error-path-handling.patch create mode 100644 queue-4.17/qed-off-by-one-in-qed_parse_mcp_trace_buf.patch create mode 100644 queue-4.17/qlogic-check-kstrtoul-for-errors.patch create mode 100644 queue-4.17/r8169-fix-mac-address-change.patch create mode 100644 queue-4.17/ravb-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch create mode 100644 queue-4.17/ravb-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch create mode 100644 queue-4.17/rdma-mlx5-fix-memory-leak-in-mlx5_ib_create_srq-error-path.patch create mode 100644 queue-4.17/rdma-qedr-fix-null-pointer-dereference-when-running-over-iwarp-without-rdma-cm.patch create mode 100644 queue-4.17/rds-clean-up-loopback-rds_connections-on-netns-deletion.patch create mode 100644 queue-4.17/risc-v-don-t-include-irq-riscv-intc.h.patch create mode 100644 queue-4.17/risc-v-fix-ptrace_setregset-bug.patch create mode 100644 queue-4.17/risc-v-fix-r_riscv_add32-r_riscv_sub32-relocations.patch create mode 100644 queue-4.17/rtc-fix-alarm-read-and-set-offset.patch create mode 100644 queue-4.17/s390-qeth-consistently-re-enable-device-features.patch create mode 100644 queue-4.17/samples-bpf-add-missing-linux-if_vlan.h.patch create mode 100644 queue-4.17/samples-bpf-check-the-error-of-write-and-read.patch create mode 100644 queue-4.17/samples-bpf-check-the-result-of-system.patch create mode 100644 queue-4.17/samples-bpf-fix-tc-and-ip-paths-in-xdp2skb_meta.sh.patch create mode 100644 queue-4.17/sched-deadline-fix-switched_from_dl-warning.patch create mode 100644 queue-4.17/sched-fair-fix-bandwidth-timer-clock-drift-condition.patch create mode 100644 queue-4.17/sched-nohz-skip-remote-tick-on-idle-task-entirely.patch create mode 100644 queue-4.17/sched-util_est-fix-util_est_dequeue-for-throttled-cfs_rq.patch create mode 100644 queue-4.17/scsi-hpsa-correct-enclosure-sas-address.patch create mode 100644 queue-4.17/scsi-qedf-send-the-driver-state-to-mfw.patch create mode 100644 queue-4.17/scsi-qedi-send-driver-state-to-mfw.patch create mode 100644 queue-4.17/scsi-xen-scsifront-add-error-handling-for-xenbus_printf.patch create mode 100644 queue-4.17/sctp-fix-erroneous-inc-of-snmp-sctpfragusrmsgs.patch create mode 100644 queue-4.17/selftests-bpf-notification-about-privilege-required-to-run-test_kmod.sh-testing-script.patch create mode 100644 queue-4.17/selftests-bpf-test-offloads-even-with-bpf-programs-present.patch create mode 100644 queue-4.17/selftests-net-add-config-fragments.patch create mode 100644 queue-4.17/selftests-pstore-return-kselftest-skip-code-for-skipped-tests.patch create mode 100644 queue-4.17/selftests-static_keys-return-kselftest-skip-code-for-skipped-tests.patch create mode 100644 queue-4.17/selftests-sync-add-config-fragment-for-testing-sync-framework.patch create mode 100644 queue-4.17/selftests-sysctl-return-kselftest-skip-code-for-skipped-tests.patch create mode 100644 queue-4.17/selftests-user-return-kselftest-skip-code-for-skipped-tests.patch create mode 100644 queue-4.17/selftests-vm-return-kselftest-skip-code-for-skipped-tests.patch create mode 100644 queue-4.17/selftests-x86-sigreturn-64-fix-spurious-failures-on-amd-cpus.patch create mode 100644 queue-4.17/selftests-x86-sigreturn-do-minor-cleanups.patch create mode 100644 queue-4.17/selftests-zram-return-kselftest-skip-code-for-skipped-tests.patch create mode 100644 queue-4.17/series create mode 100644 queue-4.17/sfc-avoid-hang-from-nested-use-of-the-filter_sem.patch create mode 100644 queue-4.17/sfc-hold-filter_sem-consistently-during-reset.patch create mode 100644 queue-4.17/sfp-ensure-we-clean-up-properly-on-bus-registration-failure.patch create mode 100644 queue-4.17/sfp-fix-module-initialisation-with-netdev-already-up.patch create mode 100644 queue-4.17/sh_eth-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch create mode 100644 queue-4.17/sh_eth-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch create mode 100644 queue-4.17/smack-mark-inode-instant-in-smack_task_to_inode.patch create mode 100644 queue-4.17/smb3-increase-initial-number-of-credits-requested-to-allow-write.patch create mode 100644 queue-4.17/smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch create mode 100644 queue-4.17/soc-imx-gpc-restrict-register-range-for-regmap-access.patch create mode 100644 queue-4.17/soc-imx-gpcv2-correct-pgc-offset.patch create mode 100644 queue-4.17/tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch create mode 100644 queue-4.17/tcp-remove-delayed-ack-events-in-dctcp.patch create mode 100644 queue-4.17/tipc-correct-discovery-message-handling-during-address-trial-period.patch create mode 100644 queue-4.17/tipc-fix-correct-setting-of-message-type-in-second-discoverer.patch create mode 100644 queue-4.17/tipc-fix-wrong-return-value-from-function-tipc_node_try_addr.patch create mode 100644 queue-4.17/tipc-make-function-tipc_net_finalize-thread-safe.patch create mode 100644 queue-4.17/tls-fix-skb_to_sgvec-returning-unhandled-error.patch create mode 100644 queue-4.17/tools-build-fixup-host-c-flags.patch create mode 100644 queue-4.17/tools-build-use-hostldflags-with-fixdep.patch create mode 100644 queue-4.17/tools-include-uapi-update-if_link.h-to-pick-ifla_-brport_isolated-vxlan_ttl_inherit.patch create mode 100644 queue-4.17/tools-testing-nvdimm-advertise-a-write-cache-for-nfit_test.patch create mode 100644 queue-4.17/tracing-use-__printf-markup-to-silence-compiler.patch create mode 100644 queue-4.17/typec-tcpm-fix-a-msecs-vs-jiffies-bug.patch create mode 100644 queue-4.17/usb-chipidea-host-fix-disconnection-detect-issue.patch create mode 100644 queue-4.17/usb-dwc2-alloc-dma-aligned-buffer-for-isoc-split-in.patch create mode 100644 queue-4.17/usb-dwc2-fix-host-exit-from-hibernation-flow.patch create mode 100644 queue-4.17/usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch create mode 100644 queue-4.17/usb-dwc2-gadget-fix-issue-in-dwc2_gadget_start_isoc.patch create mode 100644 queue-4.17/usb-dwc3-of-simple-fix-use-after-free-on-remove.patch create mode 100644 queue-4.17/usb-dwc3-pci-add-support-for-intel-icelake.patch create mode 100644 queue-4.17/usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch create mode 100644 queue-4.17/usb-gadget-dwc2-fix-memory-leak-in-gadget_init.patch create mode 100644 queue-4.17/usb-gadget-ffs-fix-bug-when-userland-exits-with-submitted-aio-transfers.patch create mode 100644 queue-4.17/usb-xhci-dbc-don-t-decrement-runtime-pm-counter-if-dbc-is-not-started.patch create mode 100644 queue-4.17/usb-xhci-increase-crs-timeout-value.patch create mode 100644 queue-4.17/usb-xhci-remove-the-code-build-warning.patch create mode 100644 queue-4.17/vfio-ccw-fix-error-return-in-vfio_ccw_sch_event.patch create mode 100644 queue-4.17/x86-microcode-intel-fix-memleak-in-save_microcode_patch.patch create mode 100644 queue-4.17/x86-mm-32-initialize-the-cr4-shadow-before-__flush_tlb_all.patch create mode 100644 queue-4.17/xen-add-error-handling-for-xenbus_printf.patch create mode 100644 queue-4.17/xen-scsiback-add-error-handling-for-xenbus_printf.patch diff --git a/queue-4.17/acpi-ec-use-ec_no_wakeup-on-more-thinkpad-x1-carbon-6th-systems.patch b/queue-4.17/acpi-ec-use-ec_no_wakeup-on-more-thinkpad-x1-carbon-6th-systems.patch new file mode 100644 index 00000000000..12a3d0ae033 --- /dev/null +++ b/queue-4.17/acpi-ec-use-ec_no_wakeup-on-more-thinkpad-x1-carbon-6th-systems.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: "Robin H. Johnson" +Date: Fri, 13 Jul 2018 20:50:47 +0000 +Subject: ACPI / EC: Use ec_no_wakeup on more Thinkpad X1 Carbon 6th systems + +From: "Robin H. Johnson" + +[ Upstream commit 2c4d6baf1bc4f7729773ffcee9ba2a9781578633 ] + +The ec_no_wakeup matcher added for Thinkpad X1 Carbon 6th gen systems +beyond matched only a single DMI model (20KGS3JF01), that didn't cover +my laptop (20KH002JUS). Change to match based on DMI product family to +cover all X1 6th gen systems. + +Signed-off-by: Robin H. Johnson +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/ec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -2036,7 +2036,7 @@ static const struct dmi_system_id acpi_e + .ident = "Thinkpad X1 Carbon 6th", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_PRODUCT_NAME, "20KGS3JF01"), ++ DMI_MATCH(DMI_PRODUCT_FAMILY, "Thinkpad X1 Carbon 6th"), + }, + }, + { }, diff --git a/queue-4.17/acpi-ec-use-ec_no_wakeup-on-thinkpad-x1-carbon-6th.patch b/queue-4.17/acpi-ec-use-ec_no_wakeup-on-thinkpad-x1-carbon-6th.patch new file mode 100644 index 00000000000..bb054e63afa --- /dev/null +++ b/queue-4.17/acpi-ec-use-ec_no_wakeup-on-thinkpad-x1-carbon-6th.patch @@ -0,0 +1,62 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Mika Westerberg +Date: Mon, 18 Jun 2018 14:17:16 +0300 +Subject: ACPI / EC: Use ec_no_wakeup on Thinkpad X1 Carbon 6th + +From: Mika Westerberg + +[ Upstream commit 8195a655e5ce09550aff81b2573d9b015d520cb9 ] + +On this system EC interrupt triggers constantly kicking devices out of +low power states and thus blocking power management. The system also has +a PCIe root port hosting Alpine Ridge Thunderbolt controller and it +never gets a chance to go to D3cold because of this. + +Since the power button works the same regardless if EC interrupt is +enabled or not during s2idle, add a quirk for this machine that sets +ec_no_wakeup=true preventing spurious wakeups. + +Signed-off-by: Mika Westerberg +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/ec.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -2031,6 +2031,17 @@ static inline void acpi_ec_query_exit(vo + } + } + ++static const struct dmi_system_id acpi_ec_no_wakeup[] = { ++ { ++ .ident = "Thinkpad X1 Carbon 6th", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "20KGS3JF01"), ++ }, ++ }, ++ { }, ++}; ++ + int __init acpi_ec_init(void) + { + int result; +@@ -2041,6 +2052,15 @@ int __init acpi_ec_init(void) + if (result) + return result; + ++ /* ++ * Disable EC wakeup on following systems to prevent periodic ++ * wakeup from EC GPE. ++ */ ++ if (dmi_check_system(acpi_ec_no_wakeup)) { ++ ec_no_wakeup = true; ++ pr_debug("Disabling EC wakeup on suspend-to-idle\n"); ++ } ++ + /* Drivers must be started after acpi_ec_query_init() */ + dsdt_fail = acpi_bus_register_driver(&acpi_ec_driver); + /* diff --git a/queue-4.17/acpi-nfit-fix-cmd_rc-for-acpi_nfit_ctl-to-always-return-a-value.patch b/queue-4.17/acpi-nfit-fix-cmd_rc-for-acpi_nfit_ctl-to-always-return-a-value.patch new file mode 100644 index 00000000000..5a4cbee637e --- /dev/null +++ b/queue-4.17/acpi-nfit-fix-cmd_rc-for-acpi_nfit_ctl-to-always-return-a-value.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dave Jiang +Date: Thu, 28 Jun 2018 09:56:55 -0700 +Subject: acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value + +From: Dave Jiang + +[ Upstream commit c1985cefd844e26bd19673a6df8d8f0b1918c2db ] + +cmd_rc is passed in by reference to the acpi_nfit_ctl() function and the +caller expects a value returned. However, when the package is pass through +via the ND_CMD_CALL command, cmd_rc is not touched. Make sure cmd_rc is +always set. + +Fixes: aef253382266 ("libnvdimm, nfit: centralize command status translation") + +Signed-off-by: Dave Jiang +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/nfit/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -408,6 +408,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc + const guid_t *guid; + int rc, i; + ++ *cmd_rc = -EINVAL; + func = cmd; + if (cmd == ND_CMD_CALL) { + call_pkg = buf; +@@ -518,6 +519,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc + * If we return an error (like elsewhere) then caller wouldn't + * be able to rely upon data returned to make calculation. + */ ++ *cmd_rc = 0; + return 0; + } + diff --git a/queue-4.17/alsa-seq-fix-ubsan-warning-at-sndrv_seq_ioctl_query_next_client-ioctl.patch b/queue-4.17/alsa-seq-fix-ubsan-warning-at-sndrv_seq_ioctl_query_next_client-ioctl.patch new file mode 100644 index 00000000000..f78d5d3ae96 --- /dev/null +++ b/queue-4.17/alsa-seq-fix-ubsan-warning-at-sndrv_seq_ioctl_query_next_client-ioctl.patch @@ -0,0 +1,50 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Takashi Iwai +Date: Mon, 25 Jun 2018 11:13:59 +0200 +Subject: ALSA: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl + +From: Takashi Iwai + +[ Upstream commit c9a4c63888dbb79ce4d068ca1dd8b05bc3f156b1 ] + +The kernel may spew a WARNING with UBSAN undefined behavior at +handling ALSA sequencer ioctl SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT: + +UBSAN: Undefined behaviour in sound/core/seq/seq_clientmgr.c:2007:14 +signed integer overflow: +2147483647 + 1 cannot be represented in type 'int' +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x122/0x1c8 lib/dump_stack.c:113 + ubsan_epilogue+0x12/0x86 lib/ubsan.c:159 + handle_overflow+0x1c2/0x21f lib/ubsan.c:190 + __ubsan_handle_add_overflow+0x2a/0x31 lib/ubsan.c:198 + snd_seq_ioctl_query_next_client+0x1ac/0x1d0 sound/core/seq/seq_clientmgr.c:2007 + snd_seq_ioctl+0x264/0x3d0 sound/core/seq/seq_clientmgr.c:2144 + .... + +It happens only when INT_MAX is passed there, as we're incrementing it +unconditionally. So the fix is trivial, check the value with +INT_MAX. Although the bug itself is fairly harmless, it's better to +fix it so that fuzzers won't hit this again later. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200211 +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/seq/seq_clientmgr.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -2004,7 +2004,8 @@ static int snd_seq_ioctl_query_next_clie + struct snd_seq_client *cptr = NULL; + + /* search for next client */ +- info->client++; ++ if (info->client < INT_MAX) ++ info->client++; + if (info->client < 0) + info->client = 0; + for (; info->client < SNDRV_SEQ_MAX_CLIENTS; info->client++) { diff --git a/queue-4.17/amd-dc-dce100-on-dce100-set-clocks-to-0-on-suspend.patch b/queue-4.17/amd-dc-dce100-on-dce100-set-clocks-to-0-on-suspend.patch new file mode 100644 index 00000000000..34071d239fe --- /dev/null +++ b/queue-4.17/amd-dc-dce100-on-dce100-set-clocks-to-0-on-suspend.patch @@ -0,0 +1,55 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: David Francis +Date: Thu, 12 Jul 2018 10:07:49 -0400 +Subject: amd/dc/dce100: On dce100, set clocks to 0 on suspend + +From: David Francis + +[ Upstream commit 8d4235f71513cdccd9dc52b674323c3591552bc1 ] + +[Why] +When a dce100 asic was suspended, the clocks were not set to 0. +Upon resume, the new clock was compared to the existing clock, +they were found to be the same, and so the clock was not set. +This resulted in a pernicious blackscreen. + +[How] +In atomic commit, check to see if there are any active pipes. +If no, set clocks to 0 + +Signed-off-by: David Francis +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c | 19 +++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c +@@ -678,9 +678,22 @@ bool dce100_validate_bandwidth( + struct dc *dc, + struct dc_state *context) + { +- /* TODO implement when needed but for now hardcode max value*/ +- context->bw.dce.dispclk_khz = 681000; +- context->bw.dce.yclk_khz = 250000 * MEMORY_TYPE_MULTIPLIER; ++ int i; ++ bool at_least_one_pipe = false; ++ ++ for (i = 0; i < dc->res_pool->pipe_count; i++) { ++ if (context->res_ctx.pipe_ctx[i].stream) ++ at_least_one_pipe = true; ++ } ++ ++ if (at_least_one_pipe) { ++ /* TODO implement when needed but for now hardcode max value*/ ++ context->bw.dce.dispclk_khz = 681000; ++ context->bw.dce.yclk_khz = 250000 * MEMORY_TYPE_MULTIPLIER; ++ } else { ++ context->bw.dce.dispclk_khz = 0; ++ context->bw.dce.yclk_khz = 0; ++ } + + return true; + } diff --git a/queue-4.17/arc-configure-apb-gpio-controller-on-arc-hsdk-platform.patch b/queue-4.17/arc-configure-apb-gpio-controller-on-arc-hsdk-platform.patch new file mode 100644 index 00000000000..fd22ce16f19 --- /dev/null +++ b/queue-4.17/arc-configure-apb-gpio-controller-on-arc-hsdk-platform.patch @@ -0,0 +1,114 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Gustavo Pimentel +Date: Fri, 6 Jul 2018 11:32:37 +0100 +Subject: ARC: [plat-hsdk]: Configure APB GPIO controller on ARC HSDK platform + +From: Gustavo Pimentel + +[ Upstream commit ec58ba16e174d7ca24c8955a21cd0a53e0c32fdf ] + +In case of HSDK we have intermediate INTC in for of DW APB GPIO controller +which is used as a de-bounce logic for interrupt wires that come from +outside the board. + +We cannot use existing "irq-dw-apb-ictl" driver here because all input +lines are routed to corresponding output lines but not muxed into one +line (this is configured in RTL and we cannot change this in software). + +But even if we add such a feature to "irq-dw-apb-ictl" driver that won't +benefit us as higher-level INTC (in case of HSDK it is IDU) anyways has +per-input control so adding fully-controller intermediate INTC will only +bring some overhead on interrupt processing but no other benefits. + +Thus we just do one-time configuration of DW APB GPIO controller and +forget about it. + +Based on implementation available on arch/arc/plat-axs10x/axs10x.c file. + +Acked-by: Alexey Brodkin +Signed-off-by: Gustavo Pimentel +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arc/plat-hsdk/platform.c | 62 ++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 62 insertions(+) + +--- a/arch/arc/plat-hsdk/platform.c ++++ b/arch/arc/plat-hsdk/platform.c +@@ -42,6 +42,66 @@ static void __init hsdk_init_per_cpu(uns + #define SDIO_UHS_REG_EXT (SDIO_BASE + 0x108) + #define SDIO_UHS_REG_EXT_DIV_2 (2 << 30) + ++#define HSDK_GPIO_INTC (ARC_PERIPHERAL_BASE + 0x3000) ++ ++static void __init hsdk_enable_gpio_intc_wire(void) ++{ ++ /* ++ * Peripherals on CPU Card are wired to cpu intc via intermediate ++ * DW APB GPIO blocks (mainly for debouncing) ++ * ++ * --------------------- ++ * | snps,archs-intc | ++ * --------------------- ++ * | ++ * ---------------------- ++ * | snps,archs-idu-intc | ++ * ---------------------- ++ * | | | | | ++ * | [eth] [USB] [... other peripherals] ++ * | ++ * ------------------- ++ * | snps,dw-apb-intc | ++ * ------------------- ++ * | | | | ++ * [Bt] [HAPS] [... other peripherals] ++ * ++ * Current implementation of "irq-dw-apb-ictl" driver doesn't work well ++ * with stacked INTCs. In particular problem happens if its master INTC ++ * not yet instantiated. See discussion here - ++ * https://lkml.org/lkml/2015/3/4/755 ++ * ++ * So setup the first gpio block as a passive pass thru and hide it from ++ * DT hardware topology - connect intc directly to cpu intc ++ * The GPIO "wire" needs to be init nevertheless (here) ++ * ++ * One side adv is that peripheral interrupt handling avoids one nested ++ * intc ISR hop ++ * ++ * According to HSDK User's Manual [1], "Table 2 Interrupt Mapping" ++ * we have the following GPIO input lines used as sources of interrupt: ++ * - GPIO[0] - Bluetooth interrupt of RS9113 module ++ * - GPIO[2] - HAPS interrupt (on HapsTrak 3 connector) ++ * - GPIO[3] - Audio codec (MAX9880A) interrupt ++ * - GPIO[8-23] - Available on Arduino and PMOD_x headers ++ * For now there's no use of Arduino and PMOD_x headers in Linux ++ * use-case so we only enable lines 0, 2 and 3. ++ * ++ * [1] https://github.com/foss-for-synopsys-dwc-arc-processors/ARC-Development-Systems-Forum/wiki/docs/ARC_HSDK_User_Guide.pdf ++ */ ++#define GPIO_INTEN (HSDK_GPIO_INTC + 0x30) ++#define GPIO_INTMASK (HSDK_GPIO_INTC + 0x34) ++#define GPIO_INTTYPE_LEVEL (HSDK_GPIO_INTC + 0x38) ++#define GPIO_INT_POLARITY (HSDK_GPIO_INTC + 0x3c) ++#define GPIO_INT_CONNECTED_MASK 0x0d ++ ++ iowrite32(0xffffffff, (void __iomem *) GPIO_INTMASK); ++ iowrite32(~GPIO_INT_CONNECTED_MASK, (void __iomem *) GPIO_INTMASK); ++ iowrite32(0x00000000, (void __iomem *) GPIO_INTTYPE_LEVEL); ++ iowrite32(0xffffffff, (void __iomem *) GPIO_INT_POLARITY); ++ iowrite32(GPIO_INT_CONNECTED_MASK, (void __iomem *) GPIO_INTEN); ++} ++ + static void __init hsdk_init_early(void) + { + /* +@@ -62,6 +122,8 @@ static void __init hsdk_init_early(void) + * minimum possible div-by-2. + */ + iowrite32(SDIO_UHS_REG_EXT_DIV_2, (void __iomem *) SDIO_UHS_REG_EXT); ++ ++ hsdk_enable_gpio_intc_wire(); + } + + static const char *hsdk_compat[] __initconst = { diff --git a/queue-4.17/arc-enable-machine_desc-init_per_cpu-for-config_smp.patch b/queue-4.17/arc-enable-machine_desc-init_per_cpu-for-config_smp.patch new file mode 100644 index 00000000000..8813173de14 --- /dev/null +++ b/queue-4.17/arc-enable-machine_desc-init_per_cpu-for-config_smp.patch @@ -0,0 +1,52 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Alexey Brodkin +Date: Wed, 29 Nov 2017 11:21:45 +0300 +Subject: ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP + +From: Alexey Brodkin + +[ Upstream commit 2f24ef7413a4d91657ef04e77c27ce0b313e6c95 ] + +machine_desc->init_per_cpu() hook is supposed to be per cpu +initialization and would seem to apply equally to UP and/or SMP. +Infact the comment in header file seems to suggest it works for +UP too, which was not the case and this patch. + +This enables !CONFIG_SMP build for platforms such as hsdk. + +Signed-off-by: Alexey Brodkin +Signed-off-by: Vineet Gupta +[vgupta: trimmeed changelog] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arc/include/asm/mach_desc.h | 2 -- + arch/arc/kernel/irq.c | 2 +- + 2 files changed, 1 insertion(+), 3 deletions(-) + +--- a/arch/arc/include/asm/mach_desc.h ++++ b/arch/arc/include/asm/mach_desc.h +@@ -34,9 +34,7 @@ struct machine_desc { + const char *name; + const char **dt_compat; + void (*init_early)(void); +-#ifdef CONFIG_SMP + void (*init_per_cpu)(unsigned int); +-#endif + void (*init_machine)(void); + void (*init_late)(void); + +--- a/arch/arc/kernel/irq.c ++++ b/arch/arc/kernel/irq.c +@@ -31,10 +31,10 @@ void __init init_IRQ(void) + /* a SMP H/w block could do IPI IRQ request here */ + if (plat_smp_ops.init_per_cpu) + plat_smp_ops.init_per_cpu(smp_processor_id()); ++#endif + + if (machine_desc->init_per_cpu) + machine_desc->init_per_cpu(smp_processor_id()); +-#endif + } + + /* diff --git a/queue-4.17/arc-explicitly-add-mmedium-calls-to-cflags.patch b/queue-4.17/arc-explicitly-add-mmedium-calls-to-cflags.patch new file mode 100644 index 00000000000..ed746900608 --- /dev/null +++ b/queue-4.17/arc-explicitly-add-mmedium-calls-to-cflags.patch @@ -0,0 +1,79 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Alexey Brodkin +Date: Fri, 1 Jun 2018 14:34:33 +0300 +Subject: ARC: Explicitly add -mmedium-calls to CFLAGS + +From: Alexey Brodkin + +[ Upstream commit 74c11e300c103af47db5b658fdcf28002421e250 ] + +GCC built for arc*-*-linux has "-mmedium-calls" implicitly enabled by default +thus we don't see any problems during Linux kernel compilation. +----------------------------->8------------------------ +arc-linux-gcc -mcpu=arc700 -Q --help=target | grep calls + -mlong-calls [disabled] + -mmedium-calls [enabled] +----------------------------->8------------------------ + +But if we try to use so-called Elf32 toolchain with GCC configured for +arc*-*-elf* then we'd see the following failure: +----------------------------->8------------------------ +init/do_mounts.o: In function 'init_rootfs': +do_mounts.c:(.init.text+0x108): relocation truncated to fit: R_ARC_S21W_PCREL +against symbol 'unregister_filesystem' defined in .text section in fs/filesystems.o + +arc-elf32-ld: final link failed: Symbol needs debug section which does not exist +make: *** [vmlinux] Error 1 +----------------------------->8------------------------ + +That happens because neither "-mmedium-calls" nor "-mlong-calls" are enabled in +Elf32 GCC: +----------------------------->8------------------------ +arc-elf32-gcc -mcpu=arc700 -Q --help=target | grep calls + -mlong-calls [disabled] + -mmedium-calls [disabled] +----------------------------->8------------------------ + +Now to make it possible to use Elf32 toolchain for building Linux kernel +we're explicitly add "-mmedium-calls" to CFLAGS. + +And since we add "-mmedium-calls" to the global CFLAGS there's no point in +having per-file copies thus removing them. + +Signed-off-by: Alexey Brodkin +Signed-off-by: Vineet Gupta + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arc/Makefile | 15 +-------------- + 1 file changed, 1 insertion(+), 14 deletions(-) + +--- a/arch/arc/Makefile ++++ b/arch/arc/Makefile +@@ -16,7 +16,7 @@ endif + + KBUILD_DEFCONFIG := nsim_700_defconfig + +-cflags-y += -fno-common -pipe -fno-builtin -D__linux__ ++cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__ + cflags-$(CONFIG_ISA_ARCOMPACT) += -mA7 + cflags-$(CONFIG_ISA_ARCV2) += -mcpu=archs + +@@ -140,16 +140,3 @@ dtbs: scripts + + archclean: + $(Q)$(MAKE) $(clean)=$(boot) +- +-# Hacks to enable final link due to absence of link-time branch relexation +-# and gcc choosing optimal(shorter) branches at -O3 +-# +-# vineetg Feb 2010: -mlong-calls switched off for overall kernel build +-# However lib/decompress_inflate.o (.init.text) calls +-# zlib_inflate_workspacesize (.text) causing relocation errors. +-# Thus forcing all exten calls in this file to be long calls +-export CFLAGS_decompress_inflate.o = -mmedium-calls +-export CFLAGS_initramfs.o = -mmedium-calls +-ifdef CONFIG_SMP +-export CFLAGS_core.o = -mmedium-calls +-endif diff --git a/queue-4.17/arc-improve-cmpxchg-syscall-implementation.patch b/queue-4.17/arc-improve-cmpxchg-syscall-implementation.patch new file mode 100644 index 00000000000..17e6f35e651 --- /dev/null +++ b/queue-4.17/arc-improve-cmpxchg-syscall-implementation.patch @@ -0,0 +1,109 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Peter Zijlstra +Date: Tue, 19 Jun 2018 17:22:05 +0300 +Subject: ARC: Improve cmpxchg syscall implementation + +From: Peter Zijlstra + +[ Upstream commit e8708786d4fe21c043d38d760f768949a3d71185 ] + +This is used in configs lacking hardware atomics to emulate atomic r-m-w +for user space, implemented by disabling preemption in kernel. + +However there are issues in current implementation: + +1. Process not terminated if invalid user pointer passed: + i.e. __get_user() failed. + +2. The reason for this patch was __put_user() failure not being handled + either, specifically for the COW break scenario. + The zero page is initially wired up and read from __get_user() + succeeds. A subsequent write by __put_user() induces a + Protection Violation, but COW can't finish as Linux page fault + handler is disabled due to preempt disable. + And what's worse is we silently return the stale value to user space. + Fix this specific case by re-enabling preemption and explicitly + fixing up the fault and retrying the whole sequence over. + +Cc: Max Filippov +Cc: linux-arch@vger.kernel.org +Signed-off-by: Alexey Brodkin +Signed-off-by: Peter Zijlstra +Signed-off-by: Vineet Gupta +[vgupta: rewrote the changelog] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arc/kernel/process.c | 47 +++++++++++++++++++++++++++++++++++----------- + 1 file changed, 36 insertions(+), 11 deletions(-) + +--- a/arch/arc/kernel/process.c ++++ b/arch/arc/kernel/process.c +@@ -47,7 +47,8 @@ SYSCALL_DEFINE0(arc_gettls) + SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new) + { + struct pt_regs *regs = current_pt_regs(); +- int uval = -EFAULT; ++ u32 uval; ++ int ret; + + /* + * This is only for old cores lacking LLOCK/SCOND, which by defintion +@@ -60,23 +61,47 @@ SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, + /* Z indicates to userspace if operation succeded */ + regs->status32 &= ~STATUS_Z_MASK; + +- if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int))) +- return -EFAULT; ++ ret = access_ok(VERIFY_WRITE, uaddr, sizeof(*uaddr)); ++ if (!ret) ++ goto fail; + ++again: + preempt_disable(); + +- if (__get_user(uval, uaddr)) +- goto done; ++ ret = __get_user(uval, uaddr); ++ if (ret) ++ goto fault; + +- if (uval == expected) { +- if (!__put_user(new, uaddr)) +- regs->status32 |= STATUS_Z_MASK; +- } ++ if (uval != expected) ++ goto out; + +-done: +- preempt_enable(); ++ ret = __put_user(new, uaddr); ++ if (ret) ++ goto fault; ++ ++ regs->status32 |= STATUS_Z_MASK; + ++out: ++ preempt_enable(); + return uval; ++ ++fault: ++ preempt_enable(); ++ ++ if (unlikely(ret != -EFAULT)) ++ goto fail; ++ ++ down_read(¤t->mm->mmap_sem); ++ ret = fixup_user_fault(current, current->mm, (unsigned long) uaddr, ++ FAULT_FLAG_WRITE, NULL); ++ up_read(¤t->mm->mmap_sem); ++ ++ if (likely(!ret)) ++ goto again; ++ ++fail: ++ force_sig(SIGSEGV, current); ++ return ret; + } + + #ifdef CONFIG_ISA_ARCV2 diff --git a/queue-4.17/arm-8780-1-ftrace-only-set-kernel-memory-back-to-read-only-after-boot.patch b/queue-4.17/arm-8780-1-ftrace-only-set-kernel-memory-back-to-read-only-after-boot.patch new file mode 100644 index 00000000000..178b4d6317d --- /dev/null +++ b/queue-4.17/arm-8780-1-ftrace-only-set-kernel-memory-back-to-read-only-after-boot.patch @@ -0,0 +1,72 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: "Steven Rostedt (VMware)" +Date: Tue, 10 Jul 2018 08:22:40 +0100 +Subject: ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot + +From: "Steven Rostedt (VMware)" + +[ Upstream commit b4c7e2bd2eb4764afe3af9409ff3b1b87116fa30 ] + +Dynamic ftrace requires modifying the code segments that are usually +set to read-only. To do this, a per arch function is called both before +and after the ftrace modifications are performed. The "before" function +will set kernel code text to read-write to allow for ftrace to make the +modifications, and the "after" function will set the kernel code text +back to "read-only" to keep the kernel code text protected. + +The issue happens when dynamic ftrace is tested at boot up. The test is +done before the kernel code text has been set to read-only. But the +"before" and "after" calls are still performed. The "after" call will +change the kernel code text to read-only prematurely, and other boot +code that expects this code to be read-write will fail. + +The solution is to add a variable that is set when the kernel code text +is expected to be converted to read-only, and make the ftrace "before" +and "after" calls do nothing if that variable is not yet set. This is +similar to the x86 solution from commit 162396309745 ("ftrace, x86: +make kernel text writable only for conversions"). + +Link: http://lkml.kernel.org/r/20180620212906.24b7b66e@vmware.local.home + +Reported-by: Stefan Agner +Tested-by: Stefan Agner +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mm/init.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/arch/arm/mm/init.c ++++ b/arch/arm/mm/init.c +@@ -736,20 +736,29 @@ static int __mark_rodata_ro(void *unused + return 0; + } + ++static int kernel_set_to_readonly __read_mostly; ++ + void mark_rodata_ro(void) + { ++ kernel_set_to_readonly = 1; + stop_machine(__mark_rodata_ro, NULL, NULL); + debug_checkwx(); + } + + void set_kernel_text_rw(void) + { ++ if (!kernel_set_to_readonly) ++ return; ++ + set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), false, + current->active_mm); + } + + void set_kernel_text_ro(void) + { ++ if (!kernel_set_to_readonly) ++ return; ++ + set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), true, + current->active_mm); + } diff --git a/queue-4.17/arm-davinci-board-da850-evm-fix-wp-pin-polarity-for-mmc-sd.patch b/queue-4.17/arm-davinci-board-da850-evm-fix-wp-pin-polarity-for-mmc-sd.patch new file mode 100644 index 00000000000..bb6a4038d8e --- /dev/null +++ b/queue-4.17/arm-davinci-board-da850-evm-fix-wp-pin-polarity-for-mmc-sd.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Adam Ford +Date: Thu, 17 May 2018 20:20:52 -0500 +Subject: ARM: davinci: board-da850-evm: fix WP pin polarity for MMC/SD + +From: Adam Ford + +[ Upstream commit 1b6fe9798af8cb7d80fad5dd30ee1bcd1e0f51eb ] + +When booting from MMC/SD in rw mode on DA850 EVM, the system +crashes because the write protect pin should be active high +and not active low. This patch fixes the polarity of the WP pin. + +Fixes: bdf0e8364fd3 ("ARM: davinci: da850-evm: use gpio descriptor for mmc pins") +Signed-off-by: Adam Ford +Signed-off-by: Sekhar Nori +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-davinci/board-da850-evm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-davinci/board-da850-evm.c ++++ b/arch/arm/mach-davinci/board-da850-evm.c +@@ -773,7 +773,7 @@ static struct gpiod_lookup_table mmc_gpi + GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_CD_PIN, "cd", + GPIO_ACTIVE_LOW), + GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_WP_PIN, "wp", +- GPIO_ACTIVE_LOW), ++ GPIO_ACTIVE_HIGH), + }, + }; + diff --git a/queue-4.17/arm-dra7-omap5-enable-actlr-enable-invalidates-of-btb-for-secondary-cores.patch b/queue-4.17/arm-dra7-omap5-enable-actlr-enable-invalidates-of-btb-for-secondary-cores.patch new file mode 100644 index 00000000000..154b0ab9a13 --- /dev/null +++ b/queue-4.17/arm-dra7-omap5-enable-actlr-enable-invalidates-of-btb-for-secondary-cores.patch @@ -0,0 +1,87 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Nishanth Menon +Date: Tue, 10 Jul 2018 14:47:25 -0500 +Subject: ARM: DRA7/OMAP5: Enable ACTLR[0] (Enable invalidates of BTB) for secondary cores + +From: Nishanth Menon + +[ Upstream commit 2f8b5b21830aea95989a6e67d8a971297272a086 ] + +Call secure services to enable ACTLR[0] (Enable invalidates of BTB with +ICIALLU) when branch hardening is enabled for kernel. + +On GP devices OMAP5/DRA7, there is no possibility to update secure +side since "secure world" is ROM and there are no override mechanisms +possible. On HS devices, appropriate PPA should do the workarounds as +well. + +However, the configuration is only done for secondary core, since it is +expected that firmware/bootloader will have enabled the required +configuration for the primary boot core (note: bootloaders typically +will NOT enable secondary processors, since it has no need to do so). + +Signed-off-by: Nishanth Menon +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-omap2/omap-smp.c | 41 +++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 41 insertions(+) + +--- a/arch/arm/mach-omap2/omap-smp.c ++++ b/arch/arm/mach-omap2/omap-smp.c +@@ -109,6 +109,45 @@ void omap5_erratum_workaround_801819(voi + static inline void omap5_erratum_workaround_801819(void) { } + #endif + ++#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR ++/* ++ * Configure ACR and enable ACTLR[0] (Enable invalidates of BTB with ++ * ICIALLU) to activate the workaround for secondary Core. ++ * NOTE: it is assumed that the primary core's configuration is done ++ * by the boot loader (kernel will detect a misconfiguration and complain ++ * if this is not done). ++ * ++ * In General Purpose(GP) devices, ACR bit settings can only be done ++ * by ROM code in "secure world" using the smc call and there is no ++ * option to update the "firmware" on such devices. This also works for ++ * High security(HS) devices, as a backup option in case the ++ * "update" is not done in the "security firmware". ++ */ ++static void omap5_secondary_harden_predictor(void) ++{ ++ u32 acr, acr_mask; ++ ++ asm volatile ("mrc p15, 0, %0, c1, c0, 1" : "=r" (acr)); ++ ++ /* ++ * ACTLR[0] (Enable invalidates of BTB with ICIALLU) ++ */ ++ acr_mask = BIT(0); ++ ++ /* Do we already have it done.. if yes, skip expensive smc */ ++ if ((acr & acr_mask) == acr_mask) ++ return; ++ ++ acr |= acr_mask; ++ omap_smc1(OMAP5_DRA7_MON_SET_ACR_INDEX, acr); ++ ++ pr_debug("%s: ARM ACR setup for CVE_2017_5715 applied on CPU%d\n", ++ __func__, smp_processor_id()); ++} ++#else ++static inline void omap5_secondary_harden_predictor(void) { } ++#endif ++ + static void omap4_secondary_init(unsigned int cpu) + { + /* +@@ -131,6 +170,8 @@ static void omap4_secondary_init(unsigne + set_cntfreq(); + /* Configure ACR to disable streaming WA for 801819 */ + omap5_erratum_workaround_801819(); ++ /* Enable ACR to allow for ICUALLU workaround */ ++ omap5_secondary_harden_predictor(); + } + + /* diff --git a/queue-4.17/arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch b/queue-4.17/arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch new file mode 100644 index 00000000000..c5ba9ae2bf8 --- /dev/null +++ b/queue-4.17/arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Adam Ford +Date: Wed, 11 Jul 2018 12:54:54 -0500 +Subject: ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller + +From: Adam Ford + +[ Upstream commit 923847413f7316b5ced3491769b3fefa6c56a79a ] + +The AM3517 has a different OTG controller location than the OMAP3, +which is included from omap3.dtsi. This results in a hwmod error. +Since the AM3517 has a different OTG controller address, this patch +disabes one that is isn't available. + +Signed-off-by: Adam Ford +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/am3517.dtsi | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/arm/boot/dts/am3517.dtsi ++++ b/arch/arm/boot/dts/am3517.dtsi +@@ -91,6 +91,11 @@ + }; + }; + ++/* Table Table 5-79 of the TRM shows 480ab000 is reserved */ ++&usb_otg_hs { ++ status = "disabled"; ++}; ++ + &iva { + status = "disabled"; + }; diff --git a/queue-4.17/arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch b/queue-4.17/arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch new file mode 100644 index 00000000000..4ea850a9ee9 --- /dev/null +++ b/queue-4.17/arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch @@ -0,0 +1,31 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Daniel Mack +Date: Sun, 17 Jun 2018 13:53:09 +0200 +Subject: ARM: dts: am437x: make edt-ft5x06 a wakeup source + +From: Daniel Mack + +[ Upstream commit 49a6ec5b807ea4ad7ebe1f58080ebb8497cb2d2c ] + +The touchscreen driver no longer configures the device as wakeup source by +default. A "wakeup-source" property is needed. + +Signed-off-by: Daniel Mack +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/am437x-sk-evm.dts | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm/boot/dts/am437x-sk-evm.dts ++++ b/arch/arm/boot/dts/am437x-sk-evm.dts +@@ -537,6 +537,8 @@ + + touchscreen-size-x = <480>; + touchscreen-size-y = <272>; ++ ++ wakeup-source; + }; + + tlv320aic3106: tlv320aic3106@1b { diff --git a/queue-4.17/arm-dts-armada-fix-cooling-cells-property-s-name.patch b/queue-4.17/arm-dts-armada-fix-cooling-cells-property-s-name.patch new file mode 100644 index 00000000000..ead325c6305 --- /dev/null +++ b/queue-4.17/arm-dts-armada-fix-cooling-cells-property-s-name.patch @@ -0,0 +1,30 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Viresh Kumar +Date: Fri, 25 May 2018 16:01:47 +0530 +Subject: arm: dts: armada: Fix "#cooling-cells" property's name + +From: Viresh Kumar + +[ Upstream commit ac62cc9d9cd6fa4c79e171c13dc8d58c3862b678 ] + +It should be "#cooling-cells" instead of "cooling-cells". Fix it. + +Signed-off-by: Viresh Kumar +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/armada-385-synology-ds116.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/armada-385-synology-ds116.dts ++++ b/arch/arm/boot/dts/armada-385-synology-ds116.dts +@@ -139,7 +139,7 @@ + 3700 5 + 3900 6 + 4000 7>; +- cooling-cells = <2>; ++ #cooling-cells = <2>; + }; + + gpio-leds { diff --git a/queue-4.17/arm-dts-bcm5301x-fix-i2c-controller-interrupt-type.patch b/queue-4.17/arm-dts-bcm5301x-fix-i2c-controller-interrupt-type.patch new file mode 100644 index 00000000000..9e1a0ce1505 --- /dev/null +++ b/queue-4.17/arm-dts-bcm5301x-fix-i2c-controller-interrupt-type.patch @@ -0,0 +1,30 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Florian Fainelli +Date: Mon, 11 Jun 2018 15:53:40 -0700 +Subject: ARM: dts: BCM5301x: Fix i2c controller interrupt type + +From: Florian Fainelli + +[ Upstream commit a0a8338e905734518ab9b10b06e7fd0201228f8b ] + +The i2c controller should be using IRQ_TYPE_LEVEL_HIGH, fix that. + +Fixes: bb097e3e0045 ("ARM: dts: BCM5301X: Add I2C support to the DT") +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/bcm5301x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -365,7 +365,7 @@ + i2c0: i2c@18009000 { + compatible = "brcm,iproc-i2c"; + reg = <0x18009000 0x50>; +- interrupts = ; ++ interrupts = ; + #address-cells = <1>; + #size-cells = <0>; + clock-frequency = <100000>; diff --git a/queue-4.17/arm-dts-cygnus-fix-i2c-controller-interrupt-type.patch b/queue-4.17/arm-dts-cygnus-fix-i2c-controller-interrupt-type.patch new file mode 100644 index 00000000000..1031aef3e0b --- /dev/null +++ b/queue-4.17/arm-dts-cygnus-fix-i2c-controller-interrupt-type.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Ray Jui +Date: Tue, 12 Jun 2018 13:21:27 -0700 +Subject: ARM: dts: Cygnus: Fix I2C controller interrupt type + +From: Ray Jui + +[ Upstream commit 71ca3409703b62b6a092d0d9d13f366c121bc5d3 ] + +Fix I2C controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom +Cygnus SoC. + +Fixes: b51c05a331ff ("ARM: dts: add I2C device nodes for Broadcom Cygnus") +Signed-off-by: Ray Jui +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/bcm-cygnus.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/bcm-cygnus.dtsi ++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi +@@ -216,7 +216,7 @@ + reg = <0x18008000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = ; ++ interrupts = ; + clock-frequency = <100000>; + status = "disabled"; + }; +@@ -245,7 +245,7 @@ + reg = <0x1800b000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = ; ++ interrupts = ; + clock-frequency = <100000>; + status = "disabled"; + }; diff --git a/queue-4.17/arm-dts-cygnus-fix-pcie-controller-interrupt-type.patch b/queue-4.17/arm-dts-cygnus-fix-pcie-controller-interrupt-type.patch new file mode 100644 index 00000000000..903c993a2e4 --- /dev/null +++ b/queue-4.17/arm-dts-cygnus-fix-pcie-controller-interrupt-type.patch @@ -0,0 +1,72 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Ray Jui +Date: Tue, 12 Jun 2018 13:21:28 -0700 +Subject: ARM: dts: Cygnus: Fix PCIe controller interrupt type + +From: Ray Jui + +[ Upstream commit 6cb1628ad3506b315cdddd7676db0ff2af378d28 ] + +Fix PCIe controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom +Cygnus SoC + +Fixes: cd590b50a936 ("ARM: dts: enable PCIe support for Cygnus") +Fixes: f6b889358a82 ("ARM: dts: Enable MSI support for Broadcom Cygnus") +Signed-off-by: Ray Jui +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/bcm-cygnus.dtsi | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/arch/arm/boot/dts/bcm-cygnus.dtsi ++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi +@@ -256,7 +256,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <0>; + +@@ -278,10 +278,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = , +- , +- , +- ; ++ interrupts = , ++ , ++ , ++ ; + }; + }; + +@@ -291,7 +291,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <1>; + +@@ -313,10 +313,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = , +- , +- , +- ; ++ interrupts = , ++ , ++ , ++ ; + }; + }; + diff --git a/queue-4.17/arm-dts-da850-fix-interrups-property-for-gpio.patch b/queue-4.17/arm-dts-da850-fix-interrups-property-for-gpio.patch new file mode 100644 index 00000000000..4cef8c428ff --- /dev/null +++ b/queue-4.17/arm-dts-da850-fix-interrups-property-for-gpio.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Keerthy +Date: Tue, 5 Jun 2018 15:37:51 +0530 +Subject: ARM: dts: da850: Fix interrups property for gpio + +From: Keerthy + +[ Upstream commit 3eb1b955cd7ed1e621ace856710006c2a8a7f231 ] + +The intc #interrupt-cells is equal to 1. Currently gpio +node has 2 cells per IRQ which is wrong. Remove the additional +cell for each of the interrupts. + +Signed-off-by: Keerthy +Fixes: 2e38b946dc54 ("ARM: davinci: da850: add GPIO DT node") +Signed-off-by: Sekhar Nori +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/da850.dtsi | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/arch/arm/boot/dts/da850.dtsi ++++ b/arch/arm/boot/dts/da850.dtsi +@@ -539,11 +539,7 @@ + gpio-controller; + #gpio-cells = <2>; + reg = <0x226000 0x1000>; +- interrupts = <42 IRQ_TYPE_EDGE_BOTH +- 43 IRQ_TYPE_EDGE_BOTH 44 IRQ_TYPE_EDGE_BOTH +- 45 IRQ_TYPE_EDGE_BOTH 46 IRQ_TYPE_EDGE_BOTH +- 47 IRQ_TYPE_EDGE_BOTH 48 IRQ_TYPE_EDGE_BOTH +- 49 IRQ_TYPE_EDGE_BOTH 50 IRQ_TYPE_EDGE_BOTH>; ++ interrupts = <42 43 44 45 46 47 48 49 50>; + ti,ngpio = <144>; + ti,davinci-gpio-unbanked = <0>; + status = "disabled"; diff --git a/queue-4.17/arm-dts-hr2-fix-interrupt-types-for-i2c-and-pcie.patch b/queue-4.17/arm-dts-hr2-fix-interrupt-types-for-i2c-and-pcie.patch new file mode 100644 index 00000000000..83ed210d150 --- /dev/null +++ b/queue-4.17/arm-dts-hr2-fix-interrupt-types-for-i2c-and-pcie.patch @@ -0,0 +1,88 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Florian Fainelli +Date: Mon, 11 Jun 2018 15:47:14 -0700 +Subject: ARM: dts: HR2: Fix interrupt types for i2c and PCIe + +From: Florian Fainelli + +[ Upstream commit dbe4a39331b7aa8bcac8ef2da780724e1af1619a ] + +The i2c and PCIe controllers had an incorrect type which should have +been set to IRQ_TYPE_LEVEL_HIGH, fix that. + +Fixes: b9099ec754b5 ("ARM: dts: Add Broadcom Hurricane 2 DTS include file") +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/bcm-hr2.dtsi | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/arch/arm/boot/dts/bcm-hr2.dtsi ++++ b/arch/arm/boot/dts/bcm-hr2.dtsi +@@ -264,7 +264,7 @@ + reg = <0x38000 0x50>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = ; ++ interrupts = ; + clock-frequency = <100000>; + }; + +@@ -279,7 +279,7 @@ + reg = <0x3b000 0x50>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = ; ++ interrupts = ; + clock-frequency = <100000>; + }; + }; +@@ -300,7 +300,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 186 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 186 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <0>; + +@@ -322,10 +322,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = , +- , +- , +- ; ++ interrupts = , ++ , ++ , ++ ; + brcm,pcie-msi-inten; + }; + }; +@@ -336,7 +336,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 192 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 192 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <1>; + +@@ -358,10 +358,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = , +- , +- , +- ; ++ interrupts = , ++ , ++ , ++ ; + brcm,pcie-msi-inten; + }; + }; diff --git a/queue-4.17/arm-dts-imx6-rdu2-fix-irq-type-for-mv88e6xxx-switch.patch b/queue-4.17/arm-dts-imx6-rdu2-fix-irq-type-for-mv88e6xxx-switch.patch new file mode 100644 index 00000000000..81b26a34ce6 --- /dev/null +++ b/queue-4.17/arm-dts-imx6-rdu2-fix-irq-type-for-mv88e6xxx-switch.patch @@ -0,0 +1,47 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: "Uwe Kleine-König" +Date: Thu, 19 Jul 2018 21:38:23 +0200 +Subject: ARM: dts: imx6: RDU2: fix irq type for mv88e6xxx switch + +From: "Uwe Kleine-König" + +[ Upstream commit e01a06c8089132bb4da035c6a83df23916ca3ebf ] + +The Marvell switches report their interrupts in a level sensitive way. +When using edge sensitive detection a race condition in the interrupt +handler of the swich might result in the OS to miss all future events +which might make the switch non-functional. + +The problem is that both mv88e6xxx_g2_irq_thread_fn() and +mv88e6xxx_g1_irq_thread_work() sample the irq cause register +(MV88E6XXX_G2_INT_SRC and MV88E6XXX_G1_STS respectively) once and then +handle the observed sources. If after sampling but before all observed +irq sources are handled a new irq source gets active this is not noticed +by the handler which returns unsuspecting, but the interrupt line stays +active which prevents the edge detector to kick in. + +All device trees but imx6qdl-zii-rdu2 get this right (most of them by +not specifying an interrupt parent). So fix imx6qdl-zii-rdu2 +accordingly. + +Signed-off-by: Uwe Kleine-König +Fixes: f64992d1a916 ("ARM: dts: imx6: RDU2: Add Switch interrupts") +Reviewed-by: Andrew Lunn +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi +@@ -672,7 +672,7 @@ + dsa,member = <0 0>; + eeprom-length = <512>; + interrupt-parent = <&gpio6>; +- interrupts = <3 IRQ_TYPE_EDGE_FALLING>; ++ interrupts = <3 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; + #interrupt-cells = <2>; + diff --git a/queue-4.17/arm-dts-nsp-fix-i2c-controller-interrupt-type.patch b/queue-4.17/arm-dts-nsp-fix-i2c-controller-interrupt-type.patch new file mode 100644 index 00000000000..39b8f5952fa --- /dev/null +++ b/queue-4.17/arm-dts-nsp-fix-i2c-controller-interrupt-type.patch @@ -0,0 +1,31 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Florian Fainelli +Date: Mon, 11 Jun 2018 15:47:12 -0700 +Subject: ARM: dts: NSP: Fix i2c controller interrupt type + +From: Florian Fainelli + +[ Upstream commit a3e32e78a40017756c71ef6dad429ffe3301126a ] + +The i2c controller should use IRQ_TYPE_LEVEL_HIGH instead of +IRQ_TYPE_NONE. + +Fixes: 0f9f27a36d09 ("ARM: dts: NSP: Add I2C support to the DT") +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/bcm-nsp.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/bcm-nsp.dtsi ++++ b/arch/arm/boot/dts/bcm-nsp.dtsi +@@ -391,7 +391,7 @@ + reg = <0x38000 0x50>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = ; ++ interrupts = ; + clock-frequency = <100000>; + dma-coherent; + status = "disabled"; diff --git a/queue-4.17/arm-dts-nsp-fix-pcie-controllers-interrupt-types.patch b/queue-4.17/arm-dts-nsp-fix-pcie-controllers-interrupt-types.patch new file mode 100644 index 00000000000..3694e50b7b5 --- /dev/null +++ b/queue-4.17/arm-dts-nsp-fix-pcie-controllers-interrupt-types.patch @@ -0,0 +1,95 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Florian Fainelli +Date: Mon, 11 Jun 2018 15:47:13 -0700 +Subject: ARM: dts: NSP: Fix PCIe controllers interrupt types + +From: Florian Fainelli + +[ Upstream commit 403fde644855bc71318c8db65646383e22653b13 ] + +The interrupts for the PCIe controllers should all be of type +IRQ_TYPE_LEVEL_HIGH instead of IRQ_TYPE_NONE. + +Fixes: d71eb9412088 ("ARM: dts: NSP: Add MSI support on PCI") +Fixes: 522199029fdc ("ARM: dts: NSP: Fix PCIE DT issue") +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/bcm-nsp.dtsi | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +--- a/arch/arm/boot/dts/bcm-nsp.dtsi ++++ b/arch/arm/boot/dts/bcm-nsp.dtsi +@@ -496,7 +496,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <0>; + +@@ -519,10 +519,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = , +- , +- , +- ; ++ interrupts = , ++ , ++ , ++ ; + brcm,pcie-msi-inten; + }; + }; +@@ -533,7 +533,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <1>; + +@@ -556,10 +556,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = , +- , +- , +- ; ++ interrupts = , ++ , ++ , ++ ; + brcm,pcie-msi-inten; + }; + }; +@@ -570,7 +570,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <2>; + +@@ -593,10 +593,10 @@ + compatible = "brcm,iproc-msi"; + msi-controller; + interrupt-parent = <&gic>; +- interrupts = , +- , +- , +- ; ++ interrupts = , ++ , ++ , ++ ; + brcm,pcie-msi-inten; + }; + }; diff --git a/queue-4.17/arm-dts-omap4-droid4-fix-dts-w.r.t.-pwm.patch b/queue-4.17/arm-dts-omap4-droid4-fix-dts-w.r.t.-pwm.patch new file mode 100644 index 00000000000..9a4088604d1 --- /dev/null +++ b/queue-4.17/arm-dts-omap4-droid4-fix-dts-w.r.t.-pwm.patch @@ -0,0 +1,51 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Pavel Machek +Date: Mon, 16 Jul 2018 09:10:48 +0200 +Subject: ARM: dts: omap4-droid4: fix dts w.r.t. pwm + +From: Pavel Machek + +[ Upstream commit d3f6daede246038cf2ea38b78d732f9dd8feb1d6 ] + +pwm node should not be under gpio6 node in the device tree. + +This fixes detection of the pwm on Droid 4. + +Fixes: 6d7bdd328da4 ("ARM: dts: omap4-droid4: update touchscreen") +Signed-off-by: Pavel Machek +Reviewed-by: Sebastian Reichel +[tony@atomide.com: added fixes tag] +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/omap4-droid4-xt894.dts | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts ++++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts +@@ -159,13 +159,7 @@ + + dais = <&mcbsp2_port>, <&mcbsp3_port>; + }; +-}; +- +-&dss { +- status = "okay"; +-}; + +-&gpio6 { + pwm8: dmtimer-pwm-8 { + pinctrl-names = "default"; + pinctrl-0 = <&vibrator_direction_pin>; +@@ -192,7 +186,10 @@ + pwm-names = "enable", "direction"; + direction-duty-cycle-ns = <10000000>; + }; ++}; + ++&dss { ++ status = "okay"; + }; + + &dsi1 { diff --git a/queue-4.17/arm-imx_v4_v5_defconfig-select-ulpi-support.patch b/queue-4.17/arm-imx_v4_v5_defconfig-select-ulpi-support.patch new file mode 100644 index 00000000000..ef9e8841667 --- /dev/null +++ b/queue-4.17/arm-imx_v4_v5_defconfig-select-ulpi-support.patch @@ -0,0 +1,35 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Fabio Estevam +Date: Tue, 26 Jun 2018 08:37:09 -0300 +Subject: ARM: imx_v4_v5_defconfig: Select ULPI support + +From: Fabio Estevam + +[ Upstream commit 2ceb2780b790b74bc408a949f6aedbad8afa693e ] + +Select CONFIG_USB_CHIPIDEA_ULPI and CONFIG_USB_ULPI_BUS so that +USB ULPI can be functional on some boards like that use ULPI +interface. + +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/configs/imx_v4_v5_defconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm/configs/imx_v4_v5_defconfig ++++ b/arch/arm/configs/imx_v4_v5_defconfig +@@ -141,9 +141,11 @@ CONFIG_USB_STORAGE=y + CONFIG_USB_CHIPIDEA=y + CONFIG_USB_CHIPIDEA_UDC=y + CONFIG_USB_CHIPIDEA_HOST=y ++CONFIG_USB_CHIPIDEA_ULPI=y + CONFIG_NOP_USB_XCEIV=y + CONFIG_USB_GADGET=y + CONFIG_USB_ETH=m ++CONFIG_USB_ULPI_BUS=y + CONFIG_MMC=y + CONFIG_MMC_SDHCI=y + CONFIG_MMC_SDHCI_PLTFM=y diff --git a/queue-4.17/arm-imx_v6_v7_defconfig-select-ulpi-support.patch b/queue-4.17/arm-imx_v6_v7_defconfig-select-ulpi-support.patch new file mode 100644 index 00000000000..2a198b2426d --- /dev/null +++ b/queue-4.17/arm-imx_v6_v7_defconfig-select-ulpi-support.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Fabio Estevam +Date: Mon, 25 Jun 2018 09:34:03 -0300 +Subject: ARM: imx_v6_v7_defconfig: Select ULPI support + +From: Fabio Estevam + +[ Upstream commit 157bcc06094c3c5800d3f4676527047b79b618e7 ] + +Select CONFIG_USB_CHIPIDEA_ULPI and CONFIG_USB_ULPI_BUS so that +USB ULPI can be functional on some boards like imx51-babbge. + +This fixes a kernel hang in 4.18-rc1 on i.mx51-babbage, caused by commit +03e6275ae381 ("usb: chipidea: Fix ULPI on imx51"). + +Suggested-by: Andrey Smirnov +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/configs/imx_v6_v7_defconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm/configs/imx_v6_v7_defconfig ++++ b/arch/arm/configs/imx_v6_v7_defconfig +@@ -294,6 +294,7 @@ CONFIG_USB_STORAGE=y + CONFIG_USB_CHIPIDEA=y + CONFIG_USB_CHIPIDEA_UDC=y + CONFIG_USB_CHIPIDEA_HOST=y ++CONFIG_USB_CHIPIDEA_ULPI=y + CONFIG_USB_SERIAL=m + CONFIG_USB_SERIAL_GENERIC=y + CONFIG_USB_SERIAL_FTDI_SIO=m +@@ -330,6 +331,7 @@ CONFIG_USB_GADGETFS=m + CONFIG_USB_FUNCTIONFS=m + CONFIG_USB_MASS_STORAGE=m + CONFIG_USB_G_SERIAL=m ++CONFIG_USB_ULPI_BUS=y + CONFIG_MMC=y + CONFIG_MMC_SDHCI=y + CONFIG_MMC_SDHCI_PLTFM=y diff --git a/queue-4.17/arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch b/queue-4.17/arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch new file mode 100644 index 00000000000..45ae95b3d81 --- /dev/null +++ b/queue-4.17/arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Daniel Mack +Date: Fri, 6 Jul 2018 22:15:00 +0200 +Subject: ARM: pxa: irq: fix handling of ICMR registers in suspend/resume + +From: Daniel Mack + +[ Upstream commit 0c1049dcb4ceec640d8bd797335bcbebdcab44d2 ] + +PXA3xx platforms have 56 interrupts that are stored in two ICMR +registers. The code in pxa_irq_suspend() and pxa_irq_resume() however +does a simple division by 32 which only leads to one register being +saved at suspend and restored at resume time. The NAND interrupt +setting, for instance, is lost. + +Fix this by using DIV_ROUND_UP() instead. + +Signed-off-by: Daniel Mack +Signed-off-by: Robert Jarzmik +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-pxa/irq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/mach-pxa/irq.c ++++ b/arch/arm/mach-pxa/irq.c +@@ -185,7 +185,7 @@ static int pxa_irq_suspend(void) + { + int i; + +- for (i = 0; i < pxa_internal_irq_nr / 32; i++) { ++ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) { + void __iomem *base = irq_base(i); + + saved_icmr[i] = __raw_readl(base + ICMR); +@@ -204,7 +204,7 @@ static void pxa_irq_resume(void) + { + int i; + +- for (i = 0; i < pxa_internal_irq_nr / 32; i++) { ++ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) { + void __iomem *base = irq_base(i); + + __raw_writel(saved_icmr[i], base + ICMR); diff --git a/queue-4.17/arm64-avoid-flush_icache_range-in-alternatives-patching-code.patch b/queue-4.17/arm64-avoid-flush_icache_range-in-alternatives-patching-code.patch new file mode 100644 index 00000000000..0f255bda349 --- /dev/null +++ b/queue-4.17/arm64-avoid-flush_icache_range-in-alternatives-patching-code.patch @@ -0,0 +1,154 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Will Deacon +Date: Fri, 22 Jun 2018 09:31:15 +0100 +Subject: arm64: Avoid flush_icache_range() in alternatives patching code + +From: Will Deacon + +[ Upstream commit 429388682dc266e7a693f9c27e3aabd341d55343 ] + +The implementation of flush_icache_range() includes instruction sequences +which are themselves patched at runtime, so it is not safe to call from +the patching framework. + +This patch reworks the alternatives cache-flushing code so that it rolls +its own internal D-cache maintenance using DC CIVAC before invalidating +the entire I-cache after all alternatives have been applied at boot. +Modules don't cause any issues, since flush_icache_range() is safe to +call by the time they are loaded. + +Acked-by: Mark Rutland +Reported-by: Rohit Khanna +Cc: Alexander Van Brunt +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/alternative.h | 7 ++++ + arch/arm64/kernel/alternative.c | 51 ++++++++++++++++++++++++++++++----- + arch/arm64/kernel/module.c | 5 +-- + 3 files changed, 52 insertions(+), 11 deletions(-) + +--- a/arch/arm64/include/asm/alternative.h ++++ b/arch/arm64/include/asm/alternative.h +@@ -28,7 +28,12 @@ typedef void (*alternative_cb_t)(struct + __le32 *origptr, __le32 *updptr, int nr_inst); + + void __init apply_alternatives_all(void); +-void apply_alternatives(void *start, size_t length); ++ ++#ifdef CONFIG_MODULES ++void apply_alternatives_module(void *start, size_t length); ++#else ++static inline void apply_alternatives_module(void *start, size_t length) { } ++#endif + + #define ALTINSTR_ENTRY(feature,cb) \ + " .word 661b - .\n" /* label */ \ +--- a/arch/arm64/kernel/alternative.c ++++ b/arch/arm64/kernel/alternative.c +@@ -122,7 +122,30 @@ static void patch_alternative(struct alt + } + } + +-static void __apply_alternatives(void *alt_region, bool use_linear_alias) ++/* ++ * We provide our own, private D-cache cleaning function so that we don't ++ * accidentally call into the cache.S code, which is patched by us at ++ * runtime. ++ */ ++static void clean_dcache_range_nopatch(u64 start, u64 end) ++{ ++ u64 cur, d_size, ctr_el0; ++ ++ ctr_el0 = read_sanitised_ftr_reg(SYS_CTR_EL0); ++ d_size = 4 << cpuid_feature_extract_unsigned_field(ctr_el0, ++ CTR_DMINLINE_SHIFT); ++ cur = start & ~(d_size - 1); ++ do { ++ /* ++ * We must clean+invalidate to the PoC in order to avoid ++ * Cortex-A53 errata 826319, 827319, 824069 and 819472 ++ * (this corresponds to ARM64_WORKAROUND_CLEAN_CACHE) ++ */ ++ asm volatile("dc civac, %0" : : "r" (cur) : "memory"); ++ } while (cur += d_size, cur < end); ++} ++ ++static void __apply_alternatives(void *alt_region, bool is_module) + { + struct alt_instr *alt; + struct alt_region *region = alt_region; +@@ -145,7 +168,7 @@ static void __apply_alternatives(void *a + pr_info_once("patching kernel code\n"); + + origptr = ALT_ORIG_PTR(alt); +- updptr = use_linear_alias ? lm_alias(origptr) : origptr; ++ updptr = is_module ? origptr : lm_alias(origptr); + nr_inst = alt->orig_len / AARCH64_INSN_SIZE; + + if (alt->cpufeature < ARM64_CB_PATCH) +@@ -155,8 +178,20 @@ static void __apply_alternatives(void *a + + alt_cb(alt, origptr, updptr, nr_inst); + +- flush_icache_range((uintptr_t)origptr, +- (uintptr_t)(origptr + nr_inst)); ++ if (!is_module) { ++ clean_dcache_range_nopatch((u64)origptr, ++ (u64)(origptr + nr_inst)); ++ } ++ } ++ ++ /* ++ * The core module code takes care of cache maintenance in ++ * flush_module_icache(). ++ */ ++ if (!is_module) { ++ dsb(ish); ++ __flush_icache_all(); ++ isb(); + } + } + +@@ -178,7 +213,7 @@ static int __apply_alternatives_multi_st + isb(); + } else { + BUG_ON(alternatives_applied); +- __apply_alternatives(®ion, true); ++ __apply_alternatives(®ion, false); + /* Barriers provided by the cache flushing */ + WRITE_ONCE(alternatives_applied, 1); + } +@@ -192,12 +227,14 @@ void __init apply_alternatives_all(void) + stop_machine(__apply_alternatives_multi_stop, NULL, cpu_online_mask); + } + +-void apply_alternatives(void *start, size_t length) ++#ifdef CONFIG_MODULES ++void apply_alternatives_module(void *start, size_t length) + { + struct alt_region region = { + .begin = start, + .end = start + length, + }; + +- __apply_alternatives(®ion, false); ++ __apply_alternatives(®ion, true); + } ++#endif +--- a/arch/arm64/kernel/module.c ++++ b/arch/arm64/kernel/module.c +@@ -448,9 +448,8 @@ int module_finalize(const Elf_Ehdr *hdr, + const char *secstrs = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; + + for (s = sechdrs, se = sechdrs + hdr->e_shnum; s < se; s++) { +- if (strcmp(".altinstructions", secstrs + s->sh_name) == 0) { +- apply_alternatives((void *)s->sh_addr, s->sh_size); +- } ++ if (strcmp(".altinstructions", secstrs + s->sh_name) == 0) ++ apply_alternatives_module((void *)s->sh_addr, s->sh_size); + #ifdef CONFIG_ARM64_MODULE_PLTS + if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) && + !strcmp(".text.ftrace_trampoline", secstrs + s->sh_name)) diff --git a/queue-4.17/arm64-dma-mapping-clear-buffers-allocated-with-force_contiguous-flag.patch b/queue-4.17/arm64-dma-mapping-clear-buffers-allocated-with-force_contiguous-flag.patch new file mode 100644 index 00000000000..f1a73ee5979 --- /dev/null +++ b/queue-4.17/arm64-dma-mapping-clear-buffers-allocated-with-force_contiguous-flag.patch @@ -0,0 +1,48 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Marek Szyprowski +Date: Tue, 12 Jun 2018 13:08:40 +0200 +Subject: arm64: dma-mapping: clear buffers allocated with FORCE_CONTIGUOUS flag + +From: Marek Szyprowski + +[ Upstream commit dd65a941f6ba473a5cb9d013d57fa43b48450a04 ] + +dma_alloc_*() buffers might be exposed to userspace via mmap() call, so +they should be cleared on allocation. In case of IOMMU-based dma-mapping +implementation such buffer clearing was missing in the code path for +DMA_ATTR_FORCE_CONTIGUOUS flag handling, because dma_alloc_from_contiguous() +doesn't honor __GFP_ZERO flag. This patch fixes this issue. For more +information on clearing buffers allocated by dma_alloc_* functions, +see commit 6829e274a623 ("arm64: dma-mapping: always clear allocated +buffers"). + +Fixes: 44176bb38fa4 ("arm64: Add support for DMA_ATTR_FORCE_CONTIGUOUS to IOMMU") +Signed-off-by: Marek Szyprowski +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/mm/dma-mapping.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/arch/arm64/mm/dma-mapping.c ++++ b/arch/arm64/mm/dma-mapping.c +@@ -588,13 +588,14 @@ static void *__iommu_alloc_attrs(struct + size >> PAGE_SHIFT); + return NULL; + } +- if (!coherent) +- __dma_flush_area(page_to_virt(page), iosize); +- + addr = dma_common_contiguous_remap(page, size, VM_USERMAP, + prot, + __builtin_return_address(0)); +- if (!addr) { ++ if (addr) { ++ memset(addr, 0, size); ++ if (!coherent) ++ __dma_flush_area(page_to_virt(page), iosize); ++ } else { + iommu_dma_unmap_page(dev, *handle, iosize, 0, attrs); + dma_release_from_contiguous(dev, page, + size >> PAGE_SHIFT); diff --git a/queue-4.17/arm64-dts-meson-axg-fix-ethernet-stability-issue.patch b/queue-4.17/arm64-dts-meson-axg-fix-ethernet-stability-issue.patch new file mode 100644 index 00000000000..b565dc72f6b --- /dev/null +++ b/queue-4.17/arm64-dts-meson-axg-fix-ethernet-stability-issue.patch @@ -0,0 +1,56 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jerome Brunet +Date: Mon, 25 Jun 2018 14:56:53 +0200 +Subject: ARM64: dts: meson-axg: fix ethernet stability issue + +From: Jerome Brunet + +[ Upstream commit 6d28d577510f1a51f7ffbe830fdbf42077e0058b ] + +Like the odroid-c2 and wetek, the s400 uses the RTL8211F and seems to +suffer from the kind of stability issue. + +Doing an iperf3 download test, we can see a significant number of LPI +interrupts on the tx path. After a short while (5 to 15 seconds), the +network connection dies. If using rootfs over NFS, the connection may +also break during the boot sequence. + +We still don't have a real explanation for this problem so let's disable +EEE once again. + +Fixes: f6f6ac914b82 ("ARM64: dts: meson-axg: enable ethernet for A113D S400 board") +Signed-off-by: Jerome Brunet +Reviewed-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/amlogic/meson-axg-s400.dts | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-axg-s400.dts +@@ -19,9 +19,22 @@ + + ðmac { + status = "okay"; +- phy-mode = "rgmii"; + pinctrl-0 = <ð_rgmii_y_pins>; + pinctrl-names = "default"; ++ phy-handle = <ð_phy0>; ++ phy-mode = "rgmii"; ++ ++ mdio { ++ compatible = "snps,dwmac-mdio"; ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ eth_phy0: ethernet-phy@0 { ++ /* Realtek RTL8211F (0x001cc916) */ ++ reg = <0>; ++ eee-broken-1000t; ++ }; ++ }; + }; + + &uart_A { diff --git a/queue-4.17/arm64-dts-meson-gxl-fix-mali-gpu-compatible-string.patch b/queue-4.17/arm64-dts-meson-gxl-fix-mali-gpu-compatible-string.patch new file mode 100644 index 00000000000..ffe91017050 --- /dev/null +++ b/queue-4.17/arm64-dts-meson-gxl-fix-mali-gpu-compatible-string.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Martin Blumenstingl +Date: Sat, 23 Jun 2018 17:00:56 +0200 +Subject: ARM64: dts: meson-gxl: fix Mali GPU compatible string + +From: Martin Blumenstingl + +[ Upstream commit 1c38f4afd5d40234b67635b3c608a4093be04b96 ] + +meson-gxl-mali.dtsi is only used on GXL SoCs. Thus it should use the GXL +specific compatible string instead of the GXBB one. +For now this is purely cosmetic since the (out-of-tree) lima driver for +this GPU currently uses the "arm,mali-450" match instead of the SoC +specific one. However, update the .dts to match the documentation since +this driver behavior might change in the future. + +Signed-off-by: Martin Blumenstingl +Acked-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-mali.dtsi +@@ -6,7 +6,7 @@ + + &apb { + mali: gpu@c0000 { +- compatible = "amlogic,meson-gxbb-mali", "arm,mali-450"; ++ compatible = "amlogic,meson-gxl-mali", "arm,mali-450"; + reg = <0x0 0xc0000 0x0 0x40000>; + interrupts = , + , diff --git a/queue-4.17/arm64-dts-msm8916-fix-coresight-etf-graph-connections.patch b/queue-4.17/arm64-dts-msm8916-fix-coresight-etf-graph-connections.patch new file mode 100644 index 00000000000..c07052647b5 --- /dev/null +++ b/queue-4.17/arm64-dts-msm8916-fix-coresight-etf-graph-connections.patch @@ -0,0 +1,51 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Rob Herring +Date: Tue, 8 May 2018 10:09:51 -0500 +Subject: arm64: dts: msm8916: fix Coresight ETF graph connections + +From: Rob Herring + +[ Upstream commit 6b4154a655a258c67bcfabbd4c3a06637e74ebcd ] + +The ETF input should be connected to the funnel output, and the ETF +output should be connected to the replicator input. The labels are wrong +and these got swapped: + +Warning (graph_endpoint): /soc/funnel@821000/ports/port@8/endpoint: graph connection to node '/soc/etf@825000/ports/port@1/endpoint' is not bidirectional +Warning (graph_endpoint): /soc/replicator@824000/ports/port@2/endpoint: graph connection to node '/soc/etf@825000/ports/port@0/endpoint' is not bidirectional + +Fixes: 7c10da373698 ("arm64: dts: qcom: Add msm8916 CoreSight components") +Cc: Ivan T. Ivanov +Cc: Mathieu Poirier +Cc: Andy Gross +Cc: David Brown +Cc: linux-arm-msm@vger.kernel.org +Signed-off-by: Rob Herring +Reviewed-by: Mathieu Poirier +Tested-by: Mathieu Poirier +Signed-off-by: Andy Gross +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -1191,14 +1191,14 @@ + + port@0 { + reg = <0>; +- etf_out: endpoint { ++ etf_in: endpoint { + slave-mode; + remote-endpoint = <&funnel0_out>; + }; + }; + port@1 { + reg = <0>; +- etf_in: endpoint { ++ etf_out: endpoint { + remote-endpoint = <&replicator_in>; + }; + }; diff --git a/queue-4.17/arm64-dts-ns2-fix-i2c-controller-interrupt-type.patch b/queue-4.17/arm64-dts-ns2-fix-i2c-controller-interrupt-type.patch new file mode 100644 index 00000000000..b337c4fd5ca --- /dev/null +++ b/queue-4.17/arm64-dts-ns2-fix-i2c-controller-interrupt-type.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Ray Jui +Date: Tue, 12 Jun 2018 13:21:29 -0700 +Subject: arm64: dts: ns2: Fix I2C controller interrupt type + +From: Ray Jui + +[ Upstream commit e605c287deed45624e8d35a15e3f0b4faab1a62d ] + +Fix I2C controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom NS2 +SoC. + +Fixes: 7ac674e8df7a ("arm64: dts: Add I2C nodes for NS2") +Signed-off-by: Ray Jui +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +@@ -566,7 +566,7 @@ + reg = <0x66080000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = ; ++ interrupts = ; + clock-frequency = <100000>; + status = "disabled"; + }; +@@ -594,7 +594,7 @@ + reg = <0x660b0000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = ; ++ interrupts = ; + clock-frequency = <100000>; + status = "disabled"; + }; diff --git a/queue-4.17/arm64-dts-ns2-fix-pcie-controller-interrupt-type.patch b/queue-4.17/arm64-dts-ns2-fix-pcie-controller-interrupt-type.patch new file mode 100644 index 00000000000..cc8d5799e2a --- /dev/null +++ b/queue-4.17/arm64-dts-ns2-fix-pcie-controller-interrupt-type.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Ray Jui +Date: Tue, 12 Jun 2018 13:21:30 -0700 +Subject: arm64: dts: ns2: Fix PCIe controller interrupt type + +From: Ray Jui + +[ Upstream commit d0b8aed9e80ab526dbb04020bfc94ecea7bddb44 ] + +Fix PCIe controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom +NS2 SoC. + +Fixes: fd5e5dd56a2f ("arm64: dts: Add PCIe0 and PCIe4 DT nodes for NS2") +Signed-off-by: Ray Jui +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +@@ -118,7 +118,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 281 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 281 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <0>; + +@@ -149,7 +149,7 @@ + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; +- interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 305 IRQ_TYPE_NONE>; ++ interrupt-map = <0 0 0 0 &gic 0 GIC_SPI 305 IRQ_TYPE_LEVEL_HIGH>; + + linux,pci-domain = <4>; + diff --git a/queue-4.17/arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742k.patch b/queue-4.17/arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742k.patch new file mode 100644 index 00000000000..1b83cde56d7 --- /dev/null +++ b/queue-4.17/arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742k.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Scott Branden +Date: Fri, 18 May 2018 08:21:20 -0700 +Subject: arm64: dts: specify 1.8V EMMC capabilities for bcm958742k + +From: Scott Branden + +[ Upstream commit eba92503e980c08ac353d0d669d0bb143979abcd ] + +Specify 1.8V EMMC capabilities for bcm958742k board to indicate support +for UHS mode. + +Fixes: d4b4aba6be8a ("arm64: dts: Initial DTS files for Broadcom Stingray SOC") +Signed-off-by: Scott Branden +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts ++++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742k.dts +@@ -43,6 +43,10 @@ + enet-phy-lane-swap; + }; + ++&sdio0 { ++ mmc-ddr-1_8v; ++}; ++ + &uart2 { + status = "okay"; + }; diff --git a/queue-4.17/arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742t.patch b/queue-4.17/arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742t.patch new file mode 100644 index 00000000000..bce8cd57b32 --- /dev/null +++ b/queue-4.17/arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742t.patch @@ -0,0 +1,31 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Scott Branden +Date: Tue, 22 May 2018 10:01:39 -0700 +Subject: arm64: dts: specify 1.8V EMMC capabilities for bcm958742t + +From: Scott Branden + +[ Upstream commit 37c2bd81a86ebb1cc934bf52a29c33d6f9abff7f ] + +Specify 1.8V EMMC capabilities for bcm958742t board to indicate support +for UHS mode. + +Fixes: d4b4aba6be8a ("arm64: dts: Initial DTS files for Broadcom Stingray SOC") +Signed-off-by: Scott Branden +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts ++++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742t.dts +@@ -42,3 +42,7 @@ + &gphy0 { + enet-phy-lane-swap; + }; ++ ++&sdio0 { ++ mmc-ddr-1_8v; ++}; diff --git a/queue-4.17/arm64-dts-stingray-fix-i2c-controller-interrupt-type.patch b/queue-4.17/arm64-dts-stingray-fix-i2c-controller-interrupt-type.patch new file mode 100644 index 00000000000..6d81ca26c2c --- /dev/null +++ b/queue-4.17/arm64-dts-stingray-fix-i2c-controller-interrupt-type.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Ray Jui +Date: Tue, 12 Jun 2018 13:21:31 -0700 +Subject: arm64: dts: Stingray: Fix I2C controller interrupt type + +From: Ray Jui + +[ Upstream commit 75af23c4736c5633894ea0baf9bca1cf6b248ca4 ] + +Fix I2C controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom +Stingray SoC. + +Fixes: 1256ea18875d ("arm64: dts: Add I2C DT nodes for Stingray SoC") +Signed-off-by: Ray Jui +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi ++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi +@@ -409,7 +409,7 @@ + reg = <0x000b0000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = ; ++ interrupts = ; + clock-frequency = <100000>; + status = "disabled"; + }; +@@ -453,7 +453,7 @@ + reg = <0x000e0000 0x100>; + #address-cells = <1>; + #size-cells = <0>; +- interrupts = ; ++ interrupts = ; + clock-frequency = <100000>; + status = "disabled"; + }; diff --git a/queue-4.17/arm64-dts-uniphier-fix-widget-name-of-headphone-for-ld11-ld20-boards.patch b/queue-4.17/arm64-dts-uniphier-fix-widget-name-of-headphone-for-ld11-ld20-boards.patch new file mode 100644 index 00000000000..792ab7788da --- /dev/null +++ b/queue-4.17/arm64-dts-uniphier-fix-widget-name-of-headphone-for-ld11-ld20-boards.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Katsuhiro Suzuki +Date: Tue, 19 Jun 2018 13:12:05 +0900 +Subject: arm64: dts: uniphier: fix widget name of headphone for LD11/LD20 boards + +From: Katsuhiro Suzuki + +[ Upstream commit 86676c4685f774d818f7a6c401c925bbf2a92903 ] + +This patch fixes wrong name of headphone widget for receiving events +of insert/remove headphone plug from simple-card or audio-graph-card. + +If we use wrong widget name then we get warning messages such as +"asoc-audio-graph-card sound: ASoC: DAPM unknown pin Headphones" +when the plug is inserted or removed from headphone jack. + +Fixes: fb21a0acaa2b7 ("arm64: dts: uniphier: add sound node") +Signed-off-by: Katsuhiro Suzuki +Signed-off-by: Masahiro Yamada +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts | 2 +- + arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts ++++ b/arch/arm64/boot/dts/socionext/uniphier-ld11-global.dts +@@ -54,7 +54,7 @@ + sound { + compatible = "audio-graph-card"; + label = "UniPhier LD11"; +- widgets = "Headphone", "Headphone Jack"; ++ widgets = "Headphone", "Headphones"; + dais = <&i2s_port2 + &i2s_port3 + &i2s_port4 +--- a/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts ++++ b/arch/arm64/boot/dts/socionext/uniphier-ld20-global.dts +@@ -54,7 +54,7 @@ + sound { + compatible = "audio-graph-card"; + label = "UniPhier LD20"; +- widgets = "Headphone", "Headphone Jack"; ++ widgets = "Headphone", "Headphones"; + dais = <&i2s_port2 + &i2s_port3 + &i2s_port4 diff --git a/queue-4.17/arm64-make-secondary_start_kernel-notrace.patch b/queue-4.17/arm64-make-secondary_start_kernel-notrace.patch new file mode 100644 index 00000000000..3938e2a0035 --- /dev/null +++ b/queue-4.17/arm64-make-secondary_start_kernel-notrace.patch @@ -0,0 +1,40 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Zhizhou Zhang +Date: Tue, 12 Jun 2018 17:07:37 +0800 +Subject: arm64: make secondary_start_kernel() notrace + +From: Zhizhou Zhang + +[ Upstream commit b154886f7892499d0d3054026e19dfb9a731df61 ] + +We can't call function trace hook before setup percpu offset. +When entering secondary_start_kernel(), percpu offset has not +been initialized. So this lead hotplug malfunction. +Here is the flow to reproduce this bug: + +echo 0 > /sys/devices/system/cpu/cpu1/online +echo function > /sys/kernel/debug/tracing/current_tracer +echo 1 > /sys/kernel/debug/tracing/tracing_on +echo 1 > /sys/devices/system/cpu/cpu1/online + +Acked-by: Mark Rutland +Tested-by: Suzuki K Poulose +Signed-off-by: Zhizhou Zhang +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/smp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -179,7 +179,7 @@ int __cpu_up(unsigned int cpu, struct ta + * This is the secondary CPU boot entry. We're using this CPUs + * idle thread stack, but a set of temporary page tables. + */ +-asmlinkage void secondary_start_kernel(void) ++asmlinkage notrace void secondary_start_kernel(void) + { + u64 mpidr = read_cpuid_mpidr() & MPIDR_HWID_BITMASK; + struct mm_struct *mm = &init_mm; diff --git a/queue-4.17/ath10k-update-the-phymode-along-with-bandwidth-change-request.patch b/queue-4.17/ath10k-update-the-phymode-along-with-bandwidth-change-request.patch new file mode 100644 index 00000000000..1f2ff299559 --- /dev/null +++ b/queue-4.17/ath10k-update-the-phymode-along-with-bandwidth-change-request.patch @@ -0,0 +1,104 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Ryan Hsu +Date: Mon, 18 Jun 2018 17:00:04 +0300 +Subject: ath10k: update the phymode along with bandwidth change request + +From: Ryan Hsu + +[ Upstream commit 9191fc2a431bade3dedc9ad17759495a9f82f41b ] + +In the case of Station connects to AP with narrower bandwidth at beginning. +And later the AP changes the bandwidth to winder bandwidth, the AP will +beacon with wider bandwidth IE, eg VHT20->VHT40->VHT80 or VHT40->VHT80. + +Since the supported BANDWIDTH will be limited by the PHYMODE, so while +Station receives the bandwidth change request, it will also need to +reconfigure the PHYMODE setting to firmware instead of just configuring +the BANDWIDTH info, otherwise it'll trigger a firmware crash with +non-support bandwidth. + +The issue was observed in WLAN.RM.4.4.1-00051-QCARMSWP-1, QCA6174 with +below scenario: + +AP xxx changed bandwidth, new config is 5200 MHz, width 2 (5190/0 MHz) +disconnect from AP xxx for new auth to yyy +RX ReassocResp from xxx (capab=0x1111 status=0 aid=102) +associated + +.... + +AP xxx changed bandwidth, new config is 5200 MHz, width 2 (5190/0 MHz) +AP xxx changed bandwidth, new config is 5200 MHz, width 3 (5210/0 MHz) + +.... + +firmware register dump: +[00]: 0x05030000 0x000015B3 0x00987291 0x00955B31 +[04]: 0x00987291 0x00060730 0x00000004 0x00000001 +[08]: 0x004089F0 0x00955A00 0x000A0B00 0x00400000 +[12]: 0x00000009 0x00000000 0x00952CD0 0x00952CE6 +[16]: 0x00952CC4 0x0098E25F 0x00000000 0x0091080D +[20]: 0x40987291 0x0040E7A8 0x00000000 0x0041EE3C +[24]: 0x809ABF05 0x0040E808 0x00000000 0xC0987291 +[28]: 0x809A650C 0x0040E948 0x0041FE40 0x004345C4 +[32]: 0x809A5C63 0x0040E988 0x0040E9AC 0x0042D1A8 +[36]: 0x8091D252 0x0040E9A8 0x00000002 0x00000001 +[40]: 0x809FDA9D 0x0040EA58 0x0043D554 0x0042D554 +[44]: 0x809F8B22 0x0040EA78 0x0043D554 0x00000001 +[48]: 0x80911210 0x0040EAC8 0x00000010 0x004041D0 +[52]: 0x80911154 0x0040EB28 0x00400000 0x00000000 +[56]: 0x8091122D 0x0040EB48 0x00000000 0x00400600 + +Reported-by: Rouven Czerwinski +Tested-by: Timur Kristóf +Signed-off-by: Ryan Hsu +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/mac.c | 16 ++++++++++++++-- + drivers/net/wireless/ath/ath10k/wmi.h | 1 + + 2 files changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -6018,8 +6018,19 @@ static void ath10k_sta_rc_update_wk(stru + ath10k_mac_max_vht_nss(vht_mcs_mask))); + + if (changed & IEEE80211_RC_BW_CHANGED) { +- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d\n", +- sta->addr, bw); ++ enum wmi_phy_mode mode; ++ ++ mode = chan_to_phymode(&def); ++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d phymode %d\n", ++ sta->addr, bw, mode); ++ ++ err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr, ++ WMI_PEER_PHYMODE, mode); ++ if (err) { ++ ath10k_warn(ar, "failed to update STA %pM peer phymode %d: %d\n", ++ sta->addr, mode, err); ++ goto exit; ++ } + + err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr, + WMI_PEER_CHAN_WIDTH, bw); +@@ -6060,6 +6071,7 @@ static void ath10k_sta_rc_update_wk(stru + sta->addr); + } + ++exit: + mutex_unlock(&ar->conf_mutex); + } + +--- a/drivers/net/wireless/ath/ath10k/wmi.h ++++ b/drivers/net/wireless/ath/ath10k/wmi.h +@@ -6098,6 +6098,7 @@ enum wmi_peer_param { + WMI_PEER_NSS = 0x5, + WMI_PEER_USE_4ADDR = 0x6, + WMI_PEER_DEBUG = 0xa, ++ WMI_PEER_PHYMODE = 0xd, + WMI_PEER_DUMMY_VAR = 0xff, /* dummy parameter for STA PS workaround */ + }; + diff --git a/queue-4.17/batman-adv-avoid-storing-non-tt-sync-flags-on-singular-entries-too.patch b/queue-4.17/batman-adv-avoid-storing-non-tt-sync-flags-on-singular-entries-too.patch new file mode 100644 index 00000000000..1b62673f16d --- /dev/null +++ b/queue-4.17/batman-adv-avoid-storing-non-tt-sync-flags-on-singular-entries-too.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: "Linus Lüssing" +Date: Thu, 7 Jun 2018 00:46:23 +0200 +Subject: batman-adv: Avoid storing non-TT-sync flags on singular entries too + +From: "Linus Lüssing" + +[ Upstream commit 4a519b83da16927fb98fd32b0f598e639d1f1859 ] + +Since commit 54e22f265e87 ("batman-adv: fix TT sync flag inconsistencies") +TT sync flags and TT non-sync'd flags are supposed to be stored +separately. + +The previous patch missed to apply this separation on a TT entry with +only a single TT orig entry. + +This is a minor fix because with only a single TT orig entry the DDoS +issue the former patch solves does not apply. + +Fixes: 54e22f265e87 ("batman-adv: fix TT sync flag inconsistencies") +Signed-off-by: Linus Lüssing +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/translation-table.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/batman-adv/translation-table.c ++++ b/net/batman-adv/translation-table.c +@@ -1705,7 +1705,8 @@ static bool batadv_tt_global_add(struct + ether_addr_copy(common->addr, tt_addr); + common->vid = vid; + +- common->flags = flags; ++ common->flags = flags & (~BATADV_TT_SYNC_MASK); ++ + tt_global_entry->roam_at = 0; + /* node must store current time in case of roaming. This is + * needed to purge this entry out on timeout (if nobody claims diff --git a/queue-4.17/batman-adv-fix-bat_ogm_iv-best-gw-refcnt-after-netlink-dump.patch b/queue-4.17/batman-adv-fix-bat_ogm_iv-best-gw-refcnt-after-netlink-dump.patch new file mode 100644 index 00000000000..7d1c9fc8b1f --- /dev/null +++ b/queue-4.17/batman-adv-fix-bat_ogm_iv-best-gw-refcnt-after-netlink-dump.patch @@ -0,0 +1,51 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sven Eckelmann +Date: Sat, 2 Jun 2018 17:26:34 +0200 +Subject: batman-adv: Fix bat_ogm_iv best gw refcnt after netlink dump + +From: Sven Eckelmann + +[ Upstream commit b5685d2687d6612adf5eac519eb7008f74dfd1ec ] + +A reference for the best gateway is taken when the list of gateways in the +mesh is sent via netlink. This is necessary to check whether the currently +dumped entry is the currently selected gateway or not. This information is +then transferred as flag BATADV_ATTR_FLAG_BEST. + +After the comparison of the current entry is done, +batadv_iv_gw_dump_entry() has to decrease the reference counter again. +Otherwise the reference will be held and thus prevents a proper shutdown of +the batman-adv interfaces (and some of the interfaces enslaved in it). + +Fixes: efb766af06e3 ("batman-adv: add B.A.T.M.A.N. IV bat_gw_dump implementations") +Reported-by: Andreas Ziegler +Tested-by: Andreas Ziegler +Signed-off-by: Sven Eckelmann +Acked-by: Marek Lindner +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/bat_iv_ogm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/batman-adv/bat_iv_ogm.c ++++ b/net/batman-adv/bat_iv_ogm.c +@@ -2732,7 +2732,7 @@ static int batadv_iv_gw_dump_entry(struc + { + struct batadv_neigh_ifinfo *router_ifinfo = NULL; + struct batadv_neigh_node *router; +- struct batadv_gw_node *curr_gw; ++ struct batadv_gw_node *curr_gw = NULL; + int ret = 0; + void *hdr; + +@@ -2780,6 +2780,8 @@ static int batadv_iv_gw_dump_entry(struc + ret = 0; + + out: ++ if (curr_gw) ++ batadv_gw_node_put(curr_gw); + if (router_ifinfo) + batadv_neigh_ifinfo_put(router_ifinfo); + if (router) diff --git a/queue-4.17/batman-adv-fix-bat_v-best-gw-refcnt-after-netlink-dump.patch b/queue-4.17/batman-adv-fix-bat_v-best-gw-refcnt-after-netlink-dump.patch new file mode 100644 index 00000000000..8d98f2c0ba3 --- /dev/null +++ b/queue-4.17/batman-adv-fix-bat_v-best-gw-refcnt-after-netlink-dump.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sven Eckelmann +Date: Sat, 2 Jun 2018 17:26:35 +0200 +Subject: batman-adv: Fix bat_v best gw refcnt after netlink dump + +From: Sven Eckelmann + +[ Upstream commit 9713cb0cf19f1cec6c007e3b37be0697042b6720 ] + +A reference for the best gateway is taken when the list of gateways in the +mesh is sent via netlink. This is necessary to check whether the currently +dumped entry is the currently selected gateway or not. This information is +then transferred as flag BATADV_ATTR_FLAG_BEST. + +After the comparison of the current entry is done, +batadv_v_gw_dump_entry() has to decrease the reference counter again. +Otherwise the reference will be held and thus prevents a proper shutdown of +the batman-adv interfaces (and some of the interfaces enslaved in it). + +Fixes: b71bb6f924fe ("batman-adv: add B.A.T.M.A.N. V bat_gw_dump implementations") +Signed-off-by: Sven Eckelmann +Acked-by: Marek Lindner +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/bat_v.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/batman-adv/bat_v.c ++++ b/net/batman-adv/bat_v.c +@@ -927,7 +927,7 @@ static int batadv_v_gw_dump_entry(struct + { + struct batadv_neigh_ifinfo *router_ifinfo = NULL; + struct batadv_neigh_node *router; +- struct batadv_gw_node *curr_gw; ++ struct batadv_gw_node *curr_gw = NULL; + int ret = 0; + void *hdr; + +@@ -995,6 +995,8 @@ static int batadv_v_gw_dump_entry(struct + ret = 0; + + out: ++ if (curr_gw) ++ batadv_gw_node_put(curr_gw); + if (router_ifinfo) + batadv_neigh_ifinfo_put(router_ifinfo); + if (router) diff --git a/queue-4.17/batman-adv-fix-debugfs-path-for-renamed-hardif.patch b/queue-4.17/batman-adv-fix-debugfs-path-for-renamed-hardif.patch new file mode 100644 index 00000000000..75f3767af20 --- /dev/null +++ b/queue-4.17/batman-adv-fix-debugfs-path-for-renamed-hardif.patch @@ -0,0 +1,111 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sven Eckelmann +Date: Fri, 1 Jun 2018 19:24:23 +0200 +Subject: batman-adv: Fix debugfs path for renamed hardif + +From: Sven Eckelmann + +[ Upstream commit 36dc621ceca1be3ec885aeade5fdafbbcc452a6d ] + +batman-adv is creating special debugfs directories in the init +net_namespace for each valid hard-interface (net_device). But it is +possible to rename a net_device to a completely different name then the +original one. + +It can therefore happen that a user registers a new net_device which gets +the name "wlan0" assigned by default. batman-adv is also adding a new +directory under $debugfs/batman-adv/ with the name "wlan0". + +The user then decides to rename this device to "wl_pri" and registers a +different device. The kernel may now decide to use the name "wlan0" again +for this new device. batman-adv will detect it as a valid net_device and +tries to create a directory with the name "wlan0" under +$debugfs/batman-adv/. But there already exists one with this name under +this path and thus this fails. batman-adv will detect a problem and +rollback the registering of this device. + +batman-adv must therefore take care of renaming the debugfs directories +for hard-interfaces whenever it detects such a net_device rename. + +Fixes: 5bc7c1eb44f2 ("batman-adv: add debugfs structure for information per interface") +Reported-by: John Soros +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/debugfs.c | 20 ++++++++++++++++++++ + net/batman-adv/debugfs.h | 6 ++++++ + net/batman-adv/hard-interface.c | 3 +++ + 3 files changed, 29 insertions(+) + +--- a/net/batman-adv/debugfs.c ++++ b/net/batman-adv/debugfs.c +@@ -19,6 +19,7 @@ + #include "debugfs.h" + #include "main.h" + ++#include + #include + #include + #include +@@ -344,6 +345,25 @@ out: + } + + /** ++ * batadv_debugfs_rename_hardif() - Fix debugfs path for renamed hardif ++ * @hard_iface: hard interface which was renamed ++ */ ++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface) ++{ ++ const char *name = hard_iface->net_dev->name; ++ struct dentry *dir; ++ struct dentry *d; ++ ++ dir = hard_iface->debug_dir; ++ if (!dir) ++ return; ++ ++ d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name); ++ if (!d) ++ pr_err("Can't rename debugfs dir to %s\n", name); ++} ++ ++/** + * batadv_debugfs_del_hardif() - delete the base directory for a hard interface + * in debugfs. + * @hard_iface: hard interface which is deleted. +--- a/net/batman-adv/debugfs.h ++++ b/net/batman-adv/debugfs.h +@@ -32,6 +32,7 @@ void batadv_debugfs_destroy(void); + int batadv_debugfs_add_meshif(struct net_device *dev); + void batadv_debugfs_del_meshif(struct net_device *dev); + int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface); ++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface); + void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface); + + #else +@@ -60,6 +61,11 @@ int batadv_debugfs_add_hardif(struct bat + } + + static inline ++void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface) ++{ ++} ++ ++static inline + void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface) + { + } +--- a/net/batman-adv/hard-interface.c ++++ b/net/batman-adv/hard-interface.c +@@ -1051,6 +1051,9 @@ static int batadv_hard_if_event(struct n + if (batadv_is_wifi_hardif(hard_iface)) + hard_iface->num_bcasts = BATADV_NUM_BCASTS_WIRELESS; + break; ++ case NETDEV_CHANGENAME: ++ batadv_debugfs_rename_hardif(hard_iface); ++ break; + default: + break; + } diff --git a/queue-4.17/batman-adv-fix-debugfs-path-for-renamed-softif.patch b/queue-4.17/batman-adv-fix-debugfs-path-for-renamed-softif.patch new file mode 100644 index 00000000000..6f2dd4c8f0b --- /dev/null +++ b/queue-4.17/batman-adv-fix-debugfs-path-for-renamed-softif.patch @@ -0,0 +1,139 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sven Eckelmann +Date: Fri, 1 Jun 2018 19:24:24 +0200 +Subject: batman-adv: Fix debugfs path for renamed softif + +From: Sven Eckelmann + +[ Upstream commit 6da7be7d24b2921f8215473ba7552796dff05fe1 ] + +batman-adv is creating special debugfs directories in the init +net_namespace for each created soft-interface (batadv net_device). But it +is possible to rename a net_device to a completely different name then the +original one. + +It can therefore happen that a user registers a new batadv net_device with +the name "bat0". batman-adv is then also adding a new directory under +$debugfs/batman-adv/ with the name "wlan0". + +The user then decides to rename this device to "bat1" and registers a +different batadv device with the name "bat0". batman-adv will then try to +create a directory with the name "bat0" under $debugfs/batman-adv/ again. +But there already exists one with this name under this path and thus this +fails. batman-adv will detect a problem and rollback the registering of +this device. + +batman-adv must therefore take care of renaming the debugfs directories for +soft-interfaces whenever it detects such a net_device rename. + +Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/debugfs.c | 20 ++++++++++++++++++++ + net/batman-adv/debugfs.h | 5 +++++ + net/batman-adv/hard-interface.c | 34 ++++++++++++++++++++++++++++------ + 3 files changed, 53 insertions(+), 6 deletions(-) + +--- a/net/batman-adv/debugfs.c ++++ b/net/batman-adv/debugfs.c +@@ -434,6 +434,26 @@ out: + } + + /** ++ * batadv_debugfs_rename_meshif() - Fix debugfs path for renamed softif ++ * @dev: net_device which was renamed ++ */ ++void batadv_debugfs_rename_meshif(struct net_device *dev) ++{ ++ struct batadv_priv *bat_priv = netdev_priv(dev); ++ const char *name = dev->name; ++ struct dentry *dir; ++ struct dentry *d; ++ ++ dir = bat_priv->debug_dir; ++ if (!dir) ++ return; ++ ++ d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name); ++ if (!d) ++ pr_err("Can't rename debugfs dir to %s\n", name); ++} ++ ++/** + * batadv_debugfs_del_meshif() - Remove interface dependent debugfs entries + * @dev: netdev struct of the soft interface + */ +--- a/net/batman-adv/debugfs.h ++++ b/net/batman-adv/debugfs.h +@@ -30,6 +30,7 @@ struct net_device; + void batadv_debugfs_init(void); + void batadv_debugfs_destroy(void); + int batadv_debugfs_add_meshif(struct net_device *dev); ++void batadv_debugfs_rename_meshif(struct net_device *dev); + void batadv_debugfs_del_meshif(struct net_device *dev); + int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface); + void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface); +@@ -50,6 +51,10 @@ static inline int batadv_debugfs_add_mes + return 0; + } + ++static inline void batadv_debugfs_rename_meshif(struct net_device *dev) ++{ ++} ++ + static inline void batadv_debugfs_del_meshif(struct net_device *dev) + { + } +--- a/net/batman-adv/hard-interface.c ++++ b/net/batman-adv/hard-interface.c +@@ -989,6 +989,32 @@ void batadv_hardif_remove_interfaces(voi + rtnl_unlock(); + } + ++/** ++ * batadv_hard_if_event_softif() - Handle events for soft interfaces ++ * @event: NETDEV_* event to handle ++ * @net_dev: net_device which generated an event ++ * ++ * Return: NOTIFY_* result ++ */ ++static int batadv_hard_if_event_softif(unsigned long event, ++ struct net_device *net_dev) ++{ ++ struct batadv_priv *bat_priv; ++ ++ switch (event) { ++ case NETDEV_REGISTER: ++ batadv_sysfs_add_meshif(net_dev); ++ bat_priv = netdev_priv(net_dev); ++ batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS); ++ break; ++ case NETDEV_CHANGENAME: ++ batadv_debugfs_rename_meshif(net_dev); ++ break; ++ } ++ ++ return NOTIFY_DONE; ++} ++ + static int batadv_hard_if_event(struct notifier_block *this, + unsigned long event, void *ptr) + { +@@ -997,12 +1023,8 @@ static int batadv_hard_if_event(struct n + struct batadv_hard_iface *primary_if = NULL; + struct batadv_priv *bat_priv; + +- if (batadv_softif_is_valid(net_dev) && event == NETDEV_REGISTER) { +- batadv_sysfs_add_meshif(net_dev); +- bat_priv = netdev_priv(net_dev); +- batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS); +- return NOTIFY_DONE; +- } ++ if (batadv_softif_is_valid(net_dev)) ++ return batadv_hard_if_event_softif(event, net_dev); + + hard_iface = batadv_hardif_get_by_netdev(net_dev); + if (!hard_iface && (event == NETDEV_REGISTER || diff --git a/queue-4.17/batman-adv-fix-multicast-tt-issues-with-bogus-roam-flags.patch b/queue-4.17/batman-adv-fix-multicast-tt-issues-with-bogus-roam-flags.patch new file mode 100644 index 00000000000..48b03c279dd --- /dev/null +++ b/queue-4.17/batman-adv-fix-multicast-tt-issues-with-bogus-roam-flags.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: "Linus Lüssing" +Date: Thu, 7 Jun 2018 00:46:24 +0200 +Subject: batman-adv: Fix multicast TT issues with bogus ROAM flags + +From: "Linus Lüssing" + +[ Upstream commit a44ebeff6bbd6ef50db41b4195fca87b21aefd20 ] + +When a (broken) node wrongly sends multicast TT entries with a ROAM +flag then this causes any receiving node to drop all entries for the +same multicast MAC address announced by other nodes, leading to +packet loss. + +Fix this DoS vector by only storing TT sync flags. For multicast TT +non-sync'ing flag bits like ROAM are unused so far anyway. + +Fixes: 1d8ab8d3c176 ("batman-adv: Modified forwarding behaviour for multicast packets") +Reported-by: Leonardo Mörlein +Signed-off-by: Linus Lüssing +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/translation-table.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/batman-adv/translation-table.c ++++ b/net/batman-adv/translation-table.c +@@ -1705,7 +1705,8 @@ static bool batadv_tt_global_add(struct + ether_addr_copy(common->addr, tt_addr); + common->vid = vid; + +- common->flags = flags & (~BATADV_TT_SYNC_MASK); ++ if (!is_multicast_ether_addr(common->addr)) ++ common->flags = flags & (~BATADV_TT_SYNC_MASK); + + tt_global_entry->roam_at = 0; + /* node must store current time in case of roaming. This is +@@ -1769,7 +1770,8 @@ static bool batadv_tt_global_add(struct + * TT_CLIENT_TEMP, therefore they have to be copied in the + * client entry + */ +- common->flags |= flags & (~BATADV_TT_SYNC_MASK); ++ if (!is_multicast_ether_addr(common->addr)) ++ common->flags |= flags & (~BATADV_TT_SYNC_MASK); + + /* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only + * one originator left in the list and we previously received a diff --git a/queue-4.17/blk-mq-debugfs-off-by-one-in-blk_mq_rq_state_name.patch b/queue-4.17/blk-mq-debugfs-off-by-one-in-blk_mq_rq_state_name.patch new file mode 100644 index 00000000000..91a2d4f7f4d --- /dev/null +++ b/queue-4.17/blk-mq-debugfs-off-by-one-in-blk_mq_rq_state_name.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Dan Carpenter +Date: Wed, 20 Jun 2018 13:45:05 +0300 +Subject: blk-mq-debugfs: Off by one in blk_mq_rq_state_name() + +From: Dan Carpenter + +[ Upstream commit a1e79188628580465ac6d7a93a313336ee3364f1 ] + +If rq_state == ARRAY_SIZE() then we read one element beyond the end of +the blk_mq_rq_state_name_array[] array. + +Fixes: ec6dcf63c55c ("blk-mq-debugfs: Show more request state information") +Reviewed-by: Bart Van Assche +Signed-off-by: Dan Carpenter +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-mq-debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -357,7 +357,7 @@ static const char *const blk_mq_rq_state + + static const char *blk_mq_rq_state_name(enum mq_rq_state rq_state) + { +- if (WARN_ON_ONCE((unsigned int)rq_state > ++ if (WARN_ON_ONCE((unsigned int)rq_state >= + ARRAY_SIZE(blk_mq_rq_state_name_array))) + return "(?)"; + return blk_mq_rq_state_name_array[rq_state]; diff --git a/queue-4.17/blk-mq-don-t-queue-more-if-we-get-a-busy-return.patch b/queue-4.17/blk-mq-don-t-queue-more-if-we-get-a-busy-return.patch new file mode 100644 index 00000000000..90ebb68ab0d --- /dev/null +++ b/queue-4.17/blk-mq-don-t-queue-more-if-we-get-a-busy-return.patch @@ -0,0 +1,64 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jens Axboe +Date: Thu, 28 Jun 2018 11:54:01 -0600 +Subject: blk-mq: don't queue more if we get a busy return + +From: Jens Axboe + +[ Upstream commit 1f57f8d442f8017587eeebd8617913bfc3661d3d ] + +Some devices have different queue limits depending on the type of IO. A +classic case is SATA NCQ, where some commands can queue, but others +cannot. If we have NCQ commands inflight and encounter a non-queueable +command, the driver returns busy. Currently we attempt to dispatch more +from the scheduler, if we were able to queue some commands. But for the +case where we ended up stopping due to BUSY, we should not attempt to +retrieve more from the scheduler. If we do, we can get into a situation +where we attempt to queue a non-queueable command, get BUSY, then +successfully retrieve more commands from that scheduler and queue those. +This can repeat forever, starving the non-queuable command indefinitely. + +Fix this by NOT attempting to pull more commands from the scheduler, if +we get a BUSY return. This should also be more optimal in terms of +letting requests stay in the scheduler for as long as possible, if we +get a BUSY due to the regular out-of-tags condition. + +Reviewed-by: Omar Sandoval +Reviewed-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-mq.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1174,6 +1174,9 @@ static bool blk_mq_mark_tag_wait(struct + + #define BLK_MQ_RESOURCE_DELAY 3 /* ms units */ + ++/* ++ * Returns true if we did some work AND can potentially do more. ++ */ + bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list, + bool got_budget) + { +@@ -1304,8 +1307,17 @@ bool blk_mq_dispatch_rq_list(struct requ + blk_mq_run_hw_queue(hctx, true); + else if (needs_restart && (ret == BLK_STS_RESOURCE)) + blk_mq_delay_run_hw_queue(hctx, BLK_MQ_RESOURCE_DELAY); ++ ++ return false; + } + ++ /* ++ * If the host/device is unable to accept more work, inform the ++ * caller of that. ++ */ ++ if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE) ++ return false; ++ + return (queued + errors) != 0; + } + diff --git a/queue-4.17/block-sed-opal-fix-a-couple-off-by-one-bugs.patch b/queue-4.17/block-sed-opal-fix-a-couple-off-by-one-bugs.patch new file mode 100644 index 00000000000..064e780409f --- /dev/null +++ b/queue-4.17/block-sed-opal-fix-a-couple-off-by-one-bugs.patch @@ -0,0 +1,44 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Dan Carpenter +Date: Wed, 20 Jun 2018 13:41:51 +0300 +Subject: block: sed-opal: Fix a couple off by one bugs + +From: Dan Carpenter + +[ Upstream commit ce042c183bcb94eb2919e8036473a1fc203420f9 ] + +resp->num is the number of tokens in resp->tok[]. It gets set in +response_parse(). So if n == resp->num then we're reading beyond the +end of the data. + +Fixes: 455a7b238cd6 ("block: Add Sed-opal library") +Reviewed-by: Scott Bauer +Tested-by: Scott Bauer +Signed-off-by: Dan Carpenter +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + block/sed-opal.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/block/sed-opal.c ++++ b/block/sed-opal.c +@@ -877,7 +877,7 @@ static size_t response_get_string(const + return 0; + } + +- if (n > resp->num) { ++ if (n >= resp->num) { + pr_debug("Response has %d tokens. Can't access %d\n", + resp->num, n); + return 0; +@@ -916,7 +916,7 @@ static u64 response_get_u64(const struct + return 0; + } + +- if (n > resp->num) { ++ if (n >= resp->num) { + pr_debug("Response has %d tokens. Can't access %d\n", + resp->num, n); + return 0; diff --git a/queue-4.17/bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch b/queue-4.17/bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch new file mode 100644 index 00000000000..8a2feac5110 --- /dev/null +++ b/queue-4.17/bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch @@ -0,0 +1,77 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sudarsana Reddy Kalluru +Date: Thu, 28 Jun 2018 04:52:15 -0700 +Subject: bnx2x: Fix receiving tx-timeout in error or recovery state. + +From: Sudarsana Reddy Kalluru + +[ Upstream commit 484c016d9392786ce5c74017c206c706f29f823d ] + +Driver performs the internal reload when it receives tx-timeout event from +the OS. Internal reload might fail in some scenarios e.g., fatal HW issues. +In such cases OS still see the link, which would result in undesirable +functionalities such as re-generation of tx-timeouts. +The patch addresses this issue by indicating the link-down to OS when +tx-timeout is detected, and keeping the link in down state till the +internal reload is successful. + +Please consider applying it to 'net' branch. + +Signed-off-by: Sudarsana Reddy Kalluru +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 + + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 6 ++++++ + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 6 ++++++ + 3 files changed, 13 insertions(+) + +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +@@ -1533,6 +1533,7 @@ struct bnx2x { + struct link_vars link_vars; + u32 link_cnt; + struct bnx2x_link_report_data last_reported_link; ++ bool force_link_down; + + struct mdio_if_info mdio; + +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -1261,6 +1261,11 @@ void __bnx2x_link_report(struct bnx2x *b + { + struct bnx2x_link_report_data cur_data; + ++ if (bp->force_link_down) { ++ bp->link_vars.link_up = 0; ++ return; ++ } ++ + /* reread mf_cfg */ + if (IS_PF(bp) && !CHIP_IS_E1(bp)) + bnx2x_read_mf_cfg(bp); +@@ -2817,6 +2822,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int + bp->pending_max = 0; + } + ++ bp->force_link_down = false; + if (bp->port.pmf) { + rc = bnx2x_initial_phy_init(bp, load_mode); + if (rc) +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -10279,6 +10279,12 @@ static void bnx2x_sp_rtnl_task(struct wo + bp->sp_rtnl_state = 0; + smp_mb(); + ++ /* Immediately indicate link as down */ ++ bp->link_vars.link_up = 0; ++ bp->force_link_down = true; ++ netif_carrier_off(bp->dev); ++ BNX2X_ERR("Indicating link is down due to Tx-timeout\n"); ++ + bnx2x_nic_unload(bp, UNLOAD_NORMAL, true); + /* When ret value shows failure of allocation failure, + * the nic is rebooted again. If open still fails, a error diff --git a/queue-4.17/bnxt_en-always-set-output-parameters-in-bnxt_get_max_rings.patch b/queue-4.17/bnxt_en-always-set-output-parameters-in-bnxt_get_max_rings.patch new file mode 100644 index 00000000000..d8b34e53e11 --- /dev/null +++ b/queue-4.17/bnxt_en-always-set-output-parameters-in-bnxt_get_max_rings.patch @@ -0,0 +1,39 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Michael Chan +Date: Mon, 9 Jul 2018 02:24:49 -0400 +Subject: bnxt_en: Always set output parameters in bnxt_get_max_rings(). + +From: Michael Chan + +[ Upstream commit 78f058a4aa0f2280dc4d45d2c4a95728398ef857 ] + +The current code returns -ENOMEM and does not bother to set the output +parameters to 0 when no rings are available. Some callers, such as +bnxt_get_channels() will display garbage ring numbers when that happens. +Fix it by always setting the output parameters. + +Fixes: 6e6c5a57fbe1 ("bnxt_en: Modify bnxt_get_max_rings() to support shared or non shared rings.") +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8467,11 +8467,11 @@ int bnxt_get_max_rings(struct bnxt *bp, + int rx, tx, cp; + + _bnxt_get_max_rings(bp, &rx, &tx, &cp); ++ *max_rx = rx; ++ *max_tx = tx; + if (!rx || !tx || !cp) + return -ENOMEM; + +- *max_rx = rx; +- *max_tx = tx; + return bnxt_trim_rings(bp, max_rx, max_tx, cp, shared); + } + diff --git a/queue-4.17/bnxt_en-do-not-modify-max-irq-count-after-rdma-driver-requests-frees-irqs.patch b/queue-4.17/bnxt_en-do-not-modify-max-irq-count-after-rdma-driver-requests-frees-irqs.patch new file mode 100644 index 00000000000..ec76fa591f2 --- /dev/null +++ b/queue-4.17/bnxt_en-do-not-modify-max-irq-count-after-rdma-driver-requests-frees-irqs.patch @@ -0,0 +1,70 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Michael Chan +Date: Mon, 9 Jul 2018 02:24:51 -0400 +Subject: bnxt_en: Do not modify max IRQ count after RDMA driver requests/frees IRQs. + +From: Michael Chan + +[ Upstream commit 30f529473ec962102e8bcd33a6a04f1e1b490ae2 ] + +Calling bnxt_set_max_func_irqs() to modify the max IRQ count requested or +freed by the RDMA driver is flawed. The max IRQ count is checked when +re-initializing the IRQ vectors and this can happen multiple times +during ifup or ethtool -L. If the max IRQ is reduced and the RDMA +driver is operational, we may not initailize IRQs correctly. This +problem shows up on VFs with very small number of MSIX. + +There is no other logic that relies on the IRQ count excluding the ones +used by RDMA. So we fix it by just removing the call to subtract or +add the IRQs used by RDMA. + +Fixes: a588e4580a7e ("bnxt_en: Add interface to support RDMA driver.") +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 - + drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 2 -- + 3 files changed, 1 insertion(+), 4 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -5915,7 +5915,7 @@ unsigned int bnxt_get_max_func_irqs(stru + return min_t(unsigned int, hw_resc->max_irqs, hw_resc->max_cp_rings); + } + +-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs) ++static void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs) + { + bp->hw_resc.max_irqs = max_irqs; + } +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1455,7 +1455,6 @@ void bnxt_set_max_func_stat_ctxs(struct + unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp); + void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max); + unsigned int bnxt_get_max_func_irqs(struct bnxt *bp); +-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max); + int bnxt_get_avail_msix(struct bnxt *bp, int num); + int bnxt_reserve_rings(struct bnxt *bp); + void bnxt_tx_disable(struct bnxt *bp); +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c +@@ -169,7 +169,6 @@ static int bnxt_req_msix_vecs(struct bnx + edev->ulp_tbl[ulp_id].msix_requested = avail_msix; + } + bnxt_fill_msix_vecs(bp, ent); +- bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) - avail_msix); + bnxt_set_max_func_cp_rings(bp, max_cp_rings - avail_msix); + edev->flags |= BNXT_EN_FLAG_MSIX_REQUESTED; + return avail_msix; +@@ -192,7 +191,6 @@ static int bnxt_free_msix_vecs(struct bn + msix_requested = edev->ulp_tbl[ulp_id].msix_requested; + bnxt_set_max_func_cp_rings(bp, max_cp_rings + msix_requested); + edev->ulp_tbl[ulp_id].msix_requested = 0; +- bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) + msix_requested); + edev->flags &= ~BNXT_EN_FLAG_MSIX_REQUESTED; + if (netif_running(dev)) { + bnxt_close_nic(bp, true, false); diff --git a/queue-4.17/bnxt_en-fix-for-system-hang-if-request_irq-fails.patch b/queue-4.17/bnxt_en-fix-for-system-hang-if-request_irq-fails.patch new file mode 100644 index 00000000000..64e07b3a1e3 --- /dev/null +++ b/queue-4.17/bnxt_en-fix-for-system-hang-if-request_irq-fails.patch @@ -0,0 +1,43 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Vikas Gupta +Date: Mon, 9 Jul 2018 02:24:52 -0400 +Subject: bnxt_en: Fix for system hang if request_irq fails + +From: Vikas Gupta + +[ Upstream commit c58387ab1614f6d7fb9e244f214b61e7631421fc ] + +Fix bug in the error code path when bnxt_request_irq() returns failure. +bnxt_disable_napi() should not be called in this error path because +NAPI has not been enabled yet. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Signed-off-by: Vikas Gupta +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -6875,7 +6875,7 @@ static int __bnxt_open_nic(struct bnxt * + rc = bnxt_request_irq(bp); + if (rc) { + netdev_err(bp->dev, "bnxt_request_irq err: %x\n", rc); +- goto open_err; ++ goto open_err_irq; + } + } + +@@ -6913,6 +6913,8 @@ static int __bnxt_open_nic(struct bnxt * + + open_err: + bnxt_disable_napi(bp); ++ ++open_err_irq: + bnxt_del_napi(bp); + + open_err_free_mem: diff --git a/queue-4.17/bnxt_en-fix-inconsistent-bnxt_flag_agg_rings-logic.patch b/queue-4.17/bnxt_en-fix-inconsistent-bnxt_flag_agg_rings-logic.patch new file mode 100644 index 00000000000..b3114cab05e --- /dev/null +++ b/queue-4.17/bnxt_en-fix-inconsistent-bnxt_flag_agg_rings-logic.patch @@ -0,0 +1,43 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Michael Chan +Date: Mon, 9 Jul 2018 02:24:48 -0400 +Subject: bnxt_en: Fix inconsistent BNXT_FLAG_AGG_RINGS logic. + +From: Michael Chan + +[ Upstream commit 07f4fde53d12eb8d921b465bb298e964e0bdc38c ] + +If there aren't enough RX rings available, the driver will attempt to +use a single RX ring without the aggregation ring. If that also +fails, the BNXT_FLAG_AGG_RINGS flag is cleared but the other ring +parameters are not set consistently to reflect that. If more RX +rings become available at the next open, the RX rings will be in +an inconsistent state and may crash when freeing the RX rings. + +Fix it by restoring the BNXT_FLAG_AGG_RINGS if not enough RX rings are +available to run without aggregation rings. + +Fixes: bdbd1eb59c56 ("bnxt_en: Handle no aggregation ring gracefully.") +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8485,8 +8485,11 @@ static int bnxt_get_dflt_rings(struct bn + /* Not enough rings, try disabling agg rings. */ + bp->flags &= ~BNXT_FLAG_AGG_RINGS; + rc = bnxt_get_max_rings(bp, max_rx, max_tx, shared); +- if (rc) ++ if (rc) { ++ /* set BNXT_FLAG_AGG_RINGS back for consistency */ ++ bp->flags |= BNXT_FLAG_AGG_RINGS; + return rc; ++ } + bp->flags |= BNXT_FLAG_NO_AGG_RINGS; + bp->dev->hw_features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW); + bp->dev->features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW); diff --git a/queue-4.17/bnxt_en-fix-the-vlan_tci-exact-match-check.patch b/queue-4.17/bnxt_en-fix-the-vlan_tci-exact-match-check.patch new file mode 100644 index 00000000000..af787a65c9d --- /dev/null +++ b/queue-4.17/bnxt_en-fix-the-vlan_tci-exact-match-check.patch @@ -0,0 +1,79 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Venkat Duvvuru +Date: Mon, 9 Jul 2018 02:24:47 -0400 +Subject: bnxt_en: Fix the vlan_tci exact match check. + +From: Venkat Duvvuru + +[ Upstream commit e32d4e60b350124065e0ffd9c91ac13a439aee9a ] + +It is possible that OVS may set don’t care for DEI/CFI bit in +vlan_tci mask. Hence, checking for vlan_tci exact match will endup +in a vlan flow rejection. + +This patch fixes the problem by checking for vlan_pcp and vid +separately, instead of checking for the entire vlan_tci. + +Fixes: e85a9be93cf1 (bnxt_en: do not allow wildcard matches for L2 flows) +Signed-off-by: Venkat Duvvuru +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 30 ++++++++++++++++++++++++--- + 1 file changed, 27 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +@@ -27,6 +27,15 @@ + #define BNXT_FID_INVALID 0xffff + #define VLAN_TCI(vid, prio) ((vid) | ((prio) << VLAN_PRIO_SHIFT)) + ++#define is_vlan_pcp_wildcarded(vlan_tci_mask) \ ++ ((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == 0x0000) ++#define is_vlan_pcp_exactmatch(vlan_tci_mask) \ ++ ((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == VLAN_PRIO_MASK) ++#define is_vlan_pcp_zero(vlan_tci) \ ++ ((ntohs(vlan_tci) & VLAN_PRIO_MASK) == 0x0000) ++#define is_vid_exactmatch(vlan_tci_mask) \ ++ ((ntohs(vlan_tci_mask) & VLAN_VID_MASK) == VLAN_VID_MASK) ++ + /* Return the dst fid of the func for flow forwarding + * For PFs: src_fid is the fid of the PF + * For VF-reps: src_fid the fid of the VF +@@ -389,6 +398,21 @@ static bool is_exactmatch(void *mask, in + return true; + } + ++static bool is_vlan_tci_allowed(__be16 vlan_tci_mask, ++ __be16 vlan_tci) ++{ ++ /* VLAN priority must be either exactly zero or fully wildcarded and ++ * VLAN id must be exact match. ++ */ ++ if (is_vid_exactmatch(vlan_tci_mask) && ++ ((is_vlan_pcp_exactmatch(vlan_tci_mask) && ++ is_vlan_pcp_zero(vlan_tci)) || ++ is_vlan_pcp_wildcarded(vlan_tci_mask))) ++ return true; ++ ++ return false; ++} ++ + static bool bits_set(void *key, int len) + { + const u8 *p = key; +@@ -803,9 +827,9 @@ static bool bnxt_tc_can_offload(struct b + /* Currently VLAN fields cannot be partial wildcard */ + if (bits_set(&flow->l2_key.inner_vlan_tci, + sizeof(flow->l2_key.inner_vlan_tci)) && +- !is_exactmatch(&flow->l2_mask.inner_vlan_tci, +- sizeof(flow->l2_mask.inner_vlan_tci))) { +- netdev_info(bp->dev, "Wildcard match unsupported for VLAN TCI\n"); ++ !is_vlan_tci_allowed(flow->l2_mask.inner_vlan_tci, ++ flow->l2_key.inner_vlan_tci)) { ++ netdev_info(bp->dev, "Unsupported VLAN TCI\n"); + return false; + } + if (bits_set(&flow->l2_key.inner_vlan_tpid, diff --git a/queue-4.17/bpf-fix-sk_skb-programs-without-skb-dev-assigned.patch b/queue-4.17/bpf-fix-sk_skb-programs-without-skb-dev-assigned.patch new file mode 100644 index 00000000000..d57fb90992f --- /dev/null +++ b/queue-4.17/bpf-fix-sk_skb-programs-without-skb-dev-assigned.patch @@ -0,0 +1,43 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: John Fastabend +Date: Thu, 5 Jul 2018 08:49:59 -0700 +Subject: bpf: fix sk_skb programs without skb->dev assigned + +From: John Fastabend + +[ Upstream commit 0c6bc6e531a6db36f49622f1f115770160f7afb0 ] + +Multiple BPF helpers in use by sk_skb programs calculate the max +skb length using the __bpf_skb_max_len function. However, this +calculates the max length using the skb->dev pointer which can be +NULL when an sk_skb program is paired with an sk_msg program. + +To force this a sk_msg program needs to redirect into the ingress +path of a sock with an attach sk_skb program. Then the the sk_skb +program would need to call one of the helpers that adjust the skb +size. + +To fix the null ptr dereference use SKB_MAX_ALLOC size if no dev +is available. + +Fixes: 8934ce2fd081 ("bpf: sockmap redirect ingress support") +Signed-off-by: John Fastabend +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/core/filter.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2516,7 +2516,8 @@ static int bpf_skb_net_shrink(struct sk_ + + static u32 __bpf_skb_max_len(const struct sk_buff *skb) + { +- return skb->dev->mtu + skb->dev->hard_header_len; ++ return skb->dev ? skb->dev->mtu + skb->dev->hard_header_len : ++ SKB_MAX_ALLOC; + } + + static int bpf_skb_adjust_net(struct sk_buff *skb, s32 len_diff) diff --git a/queue-4.17/bpf-hash-map-decrement-counter-on-error.patch b/queue-4.17/bpf-hash-map-decrement-counter-on-error.patch new file mode 100644 index 00000000000..ebba85a0566 --- /dev/null +++ b/queue-4.17/bpf-hash-map-decrement-counter-on-error.patch @@ -0,0 +1,64 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Mauricio Vasquez B +Date: Fri, 29 Jun 2018 14:48:20 +0200 +Subject: bpf: hash map: decrement counter on error + +From: Mauricio Vasquez B + +[ Upstream commit ed2b82c03dc187018307c7c6bf9299705f3db383 ] + +Decrement the number of elements in the map in case the allocation +of a new node fails. + +Fixes: 6c9059817432 ("bpf: pre-allocate hash map elements") +Signed-off-by: Mauricio Vasquez B +Acked-by: Alexei Starovoitov +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/hashtab.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/kernel/bpf/hashtab.c ++++ b/kernel/bpf/hashtab.c +@@ -743,13 +743,15 @@ static struct htab_elem *alloc_htab_elem + * old element will be freed immediately. + * Otherwise return an error + */ +- atomic_dec(&htab->count); +- return ERR_PTR(-E2BIG); ++ l_new = ERR_PTR(-E2BIG); ++ goto dec_count; + } + l_new = kmalloc_node(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN, + htab->map.numa_node); +- if (!l_new) +- return ERR_PTR(-ENOMEM); ++ if (!l_new) { ++ l_new = ERR_PTR(-ENOMEM); ++ goto dec_count; ++ } + } + + memcpy(l_new->key, key, key_size); +@@ -762,7 +764,8 @@ static struct htab_elem *alloc_htab_elem + GFP_ATOMIC | __GFP_NOWARN); + if (!pptr) { + kfree(l_new); +- return ERR_PTR(-ENOMEM); ++ l_new = ERR_PTR(-ENOMEM); ++ goto dec_count; + } + } + +@@ -776,6 +779,9 @@ static struct htab_elem *alloc_htab_elem + + l_new->hash = hash; + return l_new; ++dec_count: ++ atomic_dec(&htab->count); ++ return l_new; + } + + static int check_flags(struct bpf_htab *htab, struct htab_elem *l_old, diff --git a/queue-4.17/bpf-s390-fix-potential-memleak-when-later-bpf_jit_prog-fails.patch b/queue-4.17/bpf-s390-fix-potential-memleak-when-later-bpf_jit_prog-fails.patch new file mode 100644 index 00000000000..9f9217ab18b --- /dev/null +++ b/queue-4.17/bpf-s390-fix-potential-memleak-when-later-bpf_jit_prog-fails.patch @@ -0,0 +1,38 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Daniel Borkmann +Date: Thu, 28 Jun 2018 23:34:58 +0200 +Subject: bpf, s390: fix potential memleak when later bpf_jit_prog fails + +From: Daniel Borkmann + +[ Upstream commit f605ce5eb26ac934fb8106d75d46a2c875a2bf23 ] + +If we would ever fail in the bpf_jit_prog() pass that writes the +actual insns to the image after we got header via bpf_jit_binary_alloc() +then we also need to make sure to free it through bpf_jit_binary_free() +again when bailing out. Given we had prior bpf_jit_prog() passes to +initially probe for clobbered registers, program size and to fill in +addrs arrray for jump targets, this is more of a theoretical one, +but at least make sure this doesn't break with future changes. + +Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend") +Signed-off-by: Daniel Borkmann +Cc: Martin Schwidefsky +Acked-by: Alexei Starovoitov +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/net/bpf_jit_comp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -1391,6 +1391,7 @@ struct bpf_prog *bpf_int_jit_compile(str + goto free_addrs; + } + if (bpf_jit_prog(&jit, fp)) { ++ bpf_jit_binary_free(header); + fp = orig_fp; + goto free_addrs; + } diff --git a/queue-4.17/brcmfmac-stop-watchdog-before-detach-and-free-everything.patch b/queue-4.17/brcmfmac-stop-watchdog-before-detach-and-free-everything.patch new file mode 100644 index 00000000000..8bdf1bad432 --- /dev/null +++ b/queue-4.17/brcmfmac-stop-watchdog-before-detach-and-free-everything.patch @@ -0,0 +1,76 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Michael Trimarchi +Date: Wed, 30 May 2018 11:06:34 +0200 +Subject: brcmfmac: stop watchdog before detach and free everything + +From: Michael Trimarchi + +[ Upstream commit 373c83a801f15b1e3d02d855fad89112bd4ccbe0 ] + +Using built-in in kernel image without a firmware in filesystem +or in the kernel image can lead to a kernel NULL pointer deference. +Watchdog need to be stopped in brcmf_sdio_remove + +The system is going down NOW! +[ 1348.110759] Unable to handle kernel NULL pointer dereference at virtual address 000002f8 +Sent SIGTERM to all processes +[ 1348.121412] Mem abort info: +[ 1348.126962] ESR = 0x96000004 +[ 1348.130023] Exception class = DABT (current EL), IL = 32 bits +[ 1348.135948] SET = 0, FnV = 0 +[ 1348.138997] EA = 0, S1PTW = 0 +[ 1348.142154] Data abort info: +[ 1348.145045] ISV = 0, ISS = 0x00000004 +[ 1348.148884] CM = 0, WnR = 0 +[ 1348.151861] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____) +[ 1348.158475] [00000000000002f8] pgd=0000000000000000 +[ 1348.163364] Internal error: Oops: 96000004 [#1] PREEMPT SMP +[ 1348.168927] Modules linked in: ipv6 +[ 1348.172421] CPU: 3 PID: 1421 Comm: brcmf_wdog/mmc0 Not tainted 4.17.0-rc5-next-20180517 #18 +[ 1348.180757] Hardware name: Amarula A64-Relic (DT) +[ 1348.185455] pstate: 60000005 (nZCv daif -PAN -UAO) +[ 1348.190251] pc : brcmf_sdiod_freezer_count+0x0/0x20 +[ 1348.195124] lr : brcmf_sdio_watchdog_thread+0x64/0x290 +[ 1348.200253] sp : ffff00000b85be30 +[ 1348.203561] x29: ffff00000b85be30 x28: 0000000000000000 +[ 1348.208868] x27: ffff00000b6cb918 x26: ffff80003b990638 +[ 1348.214176] x25: ffff0000087b1a20 x24: ffff80003b94f800 +[ 1348.219483] x23: ffff000008e620c8 x22: ffff000008f0b660 +[ 1348.224790] x21: ffff000008c6a858 x20: 00000000fffffe00 +[ 1348.230097] x19: ffff80003b94f800 x18: 0000000000000001 +[ 1348.235404] x17: 0000ffffab2e8a74 x16: ffff0000080d7de8 +[ 1348.240711] x15: 0000000000000000 x14: 0000000000000400 +[ 1348.246018] x13: 0000000000000400 x12: 0000000000000001 +[ 1348.251324] x11: 00000000000002c4 x10: 0000000000000a10 +[ 1348.256631] x9 : ffff00000b85bc40 x8 : ffff80003be11870 +[ 1348.261937] x7 : ffff80003dfc7308 x6 : 000000078ff08b55 +[ 1348.267243] x5 : 00000139e1058400 x4 : 0000000000000000 +[ 1348.272550] x3 : dead000000000100 x2 : 958f2788d6618100 +[ 1348.277856] x1 : 00000000fffffe00 x0 : 0000000000000000 + +Signed-off-by: Michael Trimarchi +Acked-by: Arend van Spriel +Tested-by: Andy Shevchenko +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -4294,6 +4294,13 @@ void brcmf_sdio_remove(struct brcmf_sdio + brcmf_dbg(TRACE, "Enter\n"); + + if (bus) { ++ /* Stop watchdog task */ ++ if (bus->watchdog_tsk) { ++ send_sig(SIGTERM, bus->watchdog_tsk, 1); ++ kthread_stop(bus->watchdog_tsk); ++ bus->watchdog_tsk = NULL; ++ } ++ + /* De-register interrupt handler */ + brcmf_sdiod_intr_unregister(bus->sdiodev); + diff --git a/queue-4.17/btrfs-scrub-don-t-use-inode-page-cache-in-scrub_handle_errored_block.patch b/queue-4.17/btrfs-scrub-don-t-use-inode-page-cache-in-scrub_handle_errored_block.patch new file mode 100644 index 00000000000..8d2892747db --- /dev/null +++ b/queue-4.17/btrfs-scrub-don-t-use-inode-page-cache-in-scrub_handle_errored_block.patch @@ -0,0 +1,88 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Qu Wenruo +Date: Wed, 11 Jul 2018 13:41:21 +0800 +Subject: btrfs: scrub: Don't use inode page cache in scrub_handle_errored_block() + +From: Qu Wenruo + +[ Upstream commit 665d4953cde6d9e75c62a07ec8f4f8fd7d396ade ] + +In commit ac0b4145d662 ("btrfs: scrub: Don't use inode pages for device +replace") we removed the branch of copy_nocow_pages() to avoid +corruption for compressed nodatasum extents. + +However above commit only solves the problem in scrub_extent(), if +during scrub_pages() we failed to read some pages, +sctx->no_io_error_seen will be non-zero and we go to fixup function +scrub_handle_errored_block(). + +In scrub_handle_errored_block(), for sctx without csum (no matter if +we're doing replace or scrub) we go to scrub_fixup_nodatasum() routine, +which does the similar thing with copy_nocow_pages(), but does it +without the extra check in copy_nocow_pages() routine. + +So for test cases like btrfs/100, where we emulate read errors during +replace/scrub, we could corrupt compressed extent data again. + +This patch will fix it just by avoiding any "optimization" for +nodatasum, just falls back to the normal fixup routine by try read from +any good copy. + +This also solves WARN_ON() or dead lock caused by lame backref iteration +in scrub_fixup_nodatasum() routine. + +The deadlock or WARN_ON() won't be triggered before commit ac0b4145d662 +("btrfs: scrub: Don't use inode pages for device replace") since +copy_nocow_pages() have better locking and extra check for data extent, +and it's already doing the fixup work by try to read data from any good +copy, so it won't go scrub_fixup_nodatasum() anyway. + +This patch disables the faulty code and will be removed completely in a +followup patch. + +Fixes: ac0b4145d662 ("btrfs: scrub: Don't use inode pages for device replace") +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/scrub.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -1151,11 +1151,6 @@ static int scrub_handle_errored_block(st + return ret; + } + +- if (sctx->is_dev_replace && !is_metadata && !have_csum) { +- sblocks_for_recheck = NULL; +- goto nodatasum_case; +- } +- + /* + * read all mirrors one after the other. This includes to + * re-read the extent or metadata block that failed (that was +@@ -1268,13 +1263,19 @@ static int scrub_handle_errored_block(st + goto out; + } + +- if (!is_metadata && !have_csum) { ++ /* ++ * NOTE: Even for nodatasum case, it's still possible that it's a ++ * compressed data extent, thus scrub_fixup_nodatasum(), which write ++ * inode page cache onto disk, could cause serious data corruption. ++ * ++ * So here we could only read from disk, and hope our recovery could ++ * reach disk before the newer write. ++ */ ++ if (0 && !is_metadata && !have_csum) { + struct scrub_fixup_nodatasum *fixup_nodatasum; + + WARN_ON(sctx->is_dev_replace); + +-nodatasum_case: +- + /* + * !is_metadata and !have_csum, this means that the data + * might not be COWed, that it might be modified diff --git a/queue-4.17/ceph-fix-dentry-leak-in-splice_dentry.patch b/queue-4.17/ceph-fix-dentry-leak-in-splice_dentry.patch new file mode 100644 index 00000000000..5d5b71b92e5 --- /dev/null +++ b/queue-4.17/ceph-fix-dentry-leak-in-splice_dentry.patch @@ -0,0 +1,31 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: "Yan, Zheng" +Date: Tue, 19 Jun 2018 18:20:34 +0800 +Subject: ceph: fix dentry leak in splice_dentry() + +From: "Yan, Zheng" + +[ Upstream commit 8b8f53af1ed9df88a4c0fbfdf3db58f62060edf3 ] + +In any case, d_splice_alias() does not drop reference of original +dentry. + +Signed-off-by: "Yan, Zheng" +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/inode.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -1123,6 +1123,7 @@ static struct dentry *splice_dentry(stru + if (IS_ERR(realdn)) { + pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n", + PTR_ERR(realdn), dn, in, ceph_vinop(in)); ++ dput(dn); + dn = realdn; /* note realdn contains the error */ + goto out; + } else if (realdn) { diff --git a/queue-4.17/clk-davinci-cfgchip-testing-the-wrong-variable.patch b/queue-4.17/clk-davinci-cfgchip-testing-the-wrong-variable.patch new file mode 100644 index 00000000000..17ca9ea5e65 --- /dev/null +++ b/queue-4.17/clk-davinci-cfgchip-testing-the-wrong-variable.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dan Carpenter +Date: Sat, 2 Jun 2018 10:52:56 +0300 +Subject: clk: davinci: cfgchip: testing the wrong variable + +From: Dan Carpenter + +[ Upstream commit 0613de37373bbbc747d434f643620472bd13303b ] + +There is a copy and paste bug here. We should be testing "usb1" instead +of "usb0". + +Fixes: 58e1e2d2cd89 ("clk: davinci: cfgchip: Add TI DA8XX USB PHY clocks") +Signed-off-by: Dan Carpenter +Signed-off-by: David Lechner +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/davinci/da8xx-cfgchip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/davinci/da8xx-cfgchip.c ++++ b/drivers/clk/davinci/da8xx-cfgchip.c +@@ -672,7 +672,7 @@ static int of_da8xx_usb_phy_clk_init(str + + usb1 = da8xx_cfgchip_register_usb1_clk48(dev, regmap); + if (IS_ERR(usb1)) { +- if (PTR_ERR(usb0) == -EPROBE_DEFER) ++ if (PTR_ERR(usb1) == -EPROBE_DEFER) + return -EPROBE_DEFER; + + dev_warn(dev, "Failed to register usb1_clk48 (%ld)\n", diff --git a/queue-4.17/clk-sunxi-ng-replace-lib-y-with-obj-y.patch b/queue-4.17/clk-sunxi-ng-replace-lib-y-with-obj-y.patch new file mode 100644 index 00000000000..539cdbc46fb --- /dev/null +++ b/queue-4.17/clk-sunxi-ng-replace-lib-y-with-obj-y.patch @@ -0,0 +1,109 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Masahiro Yamada +Date: Wed, 18 Apr 2018 20:52:31 +0900 +Subject: clk: sunxi-ng: replace lib-y with obj-y + +From: Masahiro Yamada + +[ Upstream commit 12f8c553a503d98b519cca650b188bf51ebdbdbf ] + +We had commit 06e226c7fb23 ("clk: sunxi-ng: Move all clock types to a +library") and commit 799c43415442 ("kbuild: thin archives make default +for all archs") in the same development cycle, from different trees. + +With migration to the thin archive, the entire drivers/clk/sunxi-ng/lib.a +is linked to the vmlinux. This does not break build, but we do not get +any size saving. + +However, we do not need to go back to the individual Kconfig options. +The default configuration pulls in all (or most) of the CCU parts anyway. +Also, once we enable CONFIG_LD_DEAD_CODE_DATA_ELIMINATION, we can simply +list all files with obj-y, and the linker will drop all unused functions +by itself. + +After the long discussion [1], people there agreed to fix this, but +nobody sent a patch after all. I am doing it now. + +I lifted up CONFIG_SUNXI_CCU to drivers/clk/Makefile because everything +in drivers/clk/sunxi-ng/ depends on SUNXI_CCU. + +[1] https://patchwork.kernel.org/patch/9796521/ + +Signed-off-by: Masahiro Yamada +Acked-by: Stephen Boyd +Signed-off-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/Makefile | 2 +- + drivers/clk/sunxi-ng/Makefile | 39 +++++++++++++++------------------------ + 2 files changed, 16 insertions(+), 25 deletions(-) + +--- a/drivers/clk/Makefile ++++ b/drivers/clk/Makefile +@@ -94,7 +94,7 @@ obj-$(CONFIG_ARCH_SPRD) += sprd/ + obj-$(CONFIG_ARCH_STI) += st/ + obj-$(CONFIG_ARCH_STRATIX10) += socfpga/ + obj-$(CONFIG_ARCH_SUNXI) += sunxi/ +-obj-$(CONFIG_ARCH_SUNXI) += sunxi-ng/ ++obj-$(CONFIG_SUNXI_CCU) += sunxi-ng/ + obj-$(CONFIG_ARCH_TEGRA) += tegra/ + obj-y += ti/ + obj-$(CONFIG_CLK_UNIPHIER) += uniphier/ +--- a/drivers/clk/sunxi-ng/Makefile ++++ b/drivers/clk/sunxi-ng/Makefile +@@ -1,24 +1,24 @@ + # SPDX-License-Identifier: GPL-2.0 + # Common objects +-lib-$(CONFIG_SUNXI_CCU) += ccu_common.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_mmc_timing.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_reset.o ++obj-y += ccu_common.o ++obj-y += ccu_mmc_timing.o ++obj-y += ccu_reset.o + + # Base clock types +-lib-$(CONFIG_SUNXI_CCU) += ccu_div.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_frac.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_gate.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_mux.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_mult.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_phase.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_sdm.o ++obj-y += ccu_div.o ++obj-y += ccu_frac.o ++obj-y += ccu_gate.o ++obj-y += ccu_mux.o ++obj-y += ccu_mult.o ++obj-y += ccu_phase.o ++obj-y += ccu_sdm.o + + # Multi-factor clocks +-lib-$(CONFIG_SUNXI_CCU) += ccu_nk.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_nkm.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_nkmp.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_nm.o +-lib-$(CONFIG_SUNXI_CCU) += ccu_mp.o ++obj-y += ccu_nk.o ++obj-y += ccu_nkm.o ++obj-y += ccu_nkmp.o ++obj-y += ccu_nm.o ++obj-y += ccu_mp.o + + # SoC support + obj-$(CONFIG_SUN50I_A64_CCU) += ccu-sun50i-a64.o +@@ -37,12 +37,3 @@ obj-$(CONFIG_SUN8I_R40_CCU) += ccu-sun8i + obj-$(CONFIG_SUN9I_A80_CCU) += ccu-sun9i-a80.o + obj-$(CONFIG_SUN9I_A80_CCU) += ccu-sun9i-a80-de.o + obj-$(CONFIG_SUN9I_A80_CCU) += ccu-sun9i-a80-usb.o +- +-# The lib-y file goals is supposed to work only in arch/*/lib or lib/. In our +-# case, we want to use that goal, but even though lib.a will be properly +-# generated, it will not be linked in, eventually resulting in a linker error +-# for missing symbols. +-# +-# We can work around that by explicitly adding lib.a to the obj-y goal. This is +-# an undocumented behaviour, but works well for now. +-obj-$(CONFIG_SUNXI_CCU) += lib.a diff --git a/queue-4.17/clocksource-drivers-stm32-fix-error-return-code.patch b/queue-4.17/clocksource-drivers-stm32-fix-error-return-code.patch new file mode 100644 index 00000000000..ac07423a415 --- /dev/null +++ b/queue-4.17/clocksource-drivers-stm32-fix-error-return-code.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Julia Lawall +Date: Sun, 10 Jun 2018 16:24:15 +0200 +Subject: clocksource/drivers/stm32: Fix error return code + +From: Julia Lawall + +[ Upstream commit a26ed66c20f080c510fcf5bd448bce204f2c19d7 ] + +Return an error code on failure. + +Problem found using Coccinelle. + +Signed-off-by: Julia Lawall +Signed-off-by: Thomas Gleixner +Cc: Daniel Lezcano +Cc: kernel-janitors@vger.kernel.org +Cc: Maxime Coquelin +Cc: Alexandre Torgue +Cc: linux-arm-kernel@lists.infradead.org +Link: https://lkml.kernel.org/r1528640655-18948-3-git-send-email-Julia.Lawall@lip6.fr +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clocksource/timer-stm32.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/clocksource/timer-stm32.c ++++ b/drivers/clocksource/timer-stm32.c +@@ -304,8 +304,10 @@ static int __init stm32_timer_init(struc + + to->private_data = kzalloc(sizeof(struct stm32_timer_private), + GFP_KERNEL); +- if (!to->private_data) ++ if (!to->private_data) { ++ ret = -ENOMEM; + goto deinit; ++ } + + rstc = of_reset_control_get(node, NULL); + if (!IS_ERR(rstc)) { diff --git a/queue-4.17/crypto-arm-speck-fix-building-in-thumb2-mode.patch b/queue-4.17/crypto-arm-speck-fix-building-in-thumb2-mode.patch new file mode 100644 index 00000000000..2c6ef5b00a1 --- /dev/null +++ b/queue-4.17/crypto-arm-speck-fix-building-in-thumb2-mode.patch @@ -0,0 +1,52 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Eric Biggers +Date: Mon, 18 Jun 2018 15:33:23 -0700 +Subject: crypto: arm/speck - fix building in Thumb2 mode + +From: Eric Biggers + +[ Upstream commit a068b94d74ddb7776ca707b6d39d1ac0d2d057e6 ] + +Building the kernel with CONFIG_THUMB2_KERNEL=y and +CONFIG_CRYPTO_SPECK_NEON set fails with the following errors: + + arch/arm/crypto/speck-neon-core.S: Assembler messages: + + arch/arm/crypto/speck-neon-core.S:419: Error: r13 not allowed here -- `bic sp,#0xf' + arch/arm/crypto/speck-neon-core.S:423: Error: r13 not allowed here -- `bic sp,#0xf' + arch/arm/crypto/speck-neon-core.S:427: Error: r13 not allowed here -- `bic sp,#0xf' + arch/arm/crypto/speck-neon-core.S:431: Error: r13 not allowed here -- `bic sp,#0xf' + +The problem is that the 'bic' instruction can't operate on the 'sp' +register in Thumb2 mode. Fix it by using a temporary register. This +isn't in the main loop, so the performance difference is negligible. +This also matches what aes-neonbs-core.S does. + +Reported-by: Stefan Agner +Fixes: ede9622162fa ("crypto: arm/speck - add NEON-accelerated implementation of Speck-XTS") +Signed-off-by: Eric Biggers +Acked-by: Ard Biesheuvel +Reviewed-by: Stefan Agner +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/crypto/speck-neon-core.S | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/arm/crypto/speck-neon-core.S ++++ b/arch/arm/crypto/speck-neon-core.S +@@ -272,9 +272,11 @@ + * Allocate stack space to store 128 bytes worth of tweaks. For + * performance, this space is aligned to a 16-byte boundary so that we + * can use the load/store instructions that declare 16-byte alignment. ++ * For Thumb2 compatibility, don't do the 'bic' directly on 'sp'. + */ +- sub sp, #128 +- bic sp, #0xf ++ sub r12, sp, #128 ++ bic r12, #0xf ++ mov sp, r12 + + .if \n == 64 + // Load first tweak diff --git a/queue-4.17/cxgb4-assume-flash-part-size-to-be-4mb-if-it-can-t-be-determined.patch b/queue-4.17/cxgb4-assume-flash-part-size-to-be-4mb-if-it-can-t-be-determined.patch new file mode 100644 index 00000000000..b4fb58909db --- /dev/null +++ b/queue-4.17/cxgb4-assume-flash-part-size-to-be-4mb-if-it-can-t-be-determined.patch @@ -0,0 +1,104 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Casey Leedom +Date: Sat, 7 Jul 2018 12:38:07 +0530 +Subject: cxgb4: assume flash part size to be 4MB, if it can't be determined + +From: Casey Leedom + +[ Upstream commit 843789f6dd6ae1651a77ac99c13bcaf191ebe05c ] + +t4_get_flash_params() fails in a fatal fashion if the FLASH part isn't +one of the recognized parts. But this leads to desperate efforts to update +drivers when various FLASH parts which we are using suddenly become +unavailable and we need to substitute new FLASH parts. This has lead to +more than one Customer Field Emergency when a Customer has an old driver +and suddenly can't use newly shipped adapters. + +This commit fixes this by simply assuming that the FLASH part is 4MB in +size if it can't be identified. Note that all Chelsio adapters will have +flash parts which are at least 4MB in size. + +Signed-off-by: Casey Leedom +Signed-off-by: Ganesh Goudar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 35 ++++++++++------------------- + 1 file changed, 13 insertions(+), 22 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -8526,7 +8526,7 @@ static int t4_get_flash_params(struct ad + }; + + unsigned int part, manufacturer; +- unsigned int density, size; ++ unsigned int density, size = 0; + u32 flashid = 0; + int ret; + +@@ -8596,11 +8596,6 @@ static int t4_get_flash_params(struct ad + case 0x22: /* 256MB */ + size = 1 << 28; + break; +- +- default: +- dev_err(adap->pdev_dev, "Micron Flash Part has bad size, ID = %#x, Density code = %#x\n", +- flashid, density); +- return -EINVAL; + } + break; + } +@@ -8616,10 +8611,6 @@ static int t4_get_flash_params(struct ad + case 0x17: /* 64MB */ + size = 1 << 26; + break; +- default: +- dev_err(adap->pdev_dev, "ISSI Flash Part has bad size, ID = %#x, Density code = %#x\n", +- flashid, density); +- return -EINVAL; + } + break; + } +@@ -8635,10 +8626,6 @@ static int t4_get_flash_params(struct ad + case 0x18: /* 16MB */ + size = 1 << 24; + break; +- default: +- dev_err(adap->pdev_dev, "Macronix Flash Part has bad size, ID = %#x, Density code = %#x\n", +- flashid, density); +- return -EINVAL; + } + break; + } +@@ -8654,17 +8641,21 @@ static int t4_get_flash_params(struct ad + case 0x18: /* 16MB */ + size = 1 << 24; + break; +- default: +- dev_err(adap->pdev_dev, "Winbond Flash Part has bad size, ID = %#x, Density code = %#x\n", +- flashid, density); +- return -EINVAL; + } + break; + } +- default: +- dev_err(adap->pdev_dev, "Unsupported Flash Part, ID = %#x\n", +- flashid); +- return -EINVAL; ++ } ++ ++ /* If we didn't recognize the FLASH part, that's no real issue: the ++ * Hardware/Software contract says that Hardware will _*ALWAYS*_ ++ * use a FLASH part which is at least 4MB in size and has 64KB ++ * sectors. The unrecognized FLASH part is likely to be much larger ++ * than 4MB, but that's all we really need. ++ */ ++ if (size == 0) { ++ dev_warn(adap->pdev_dev, "Unknown Flash Part, ID = %#x, assuming 4MB\n", ++ flashid); ++ size = 1 << 22; + } + + /* Store decoded Flash size and fall through into vetting code. */ diff --git a/queue-4.17/cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch b/queue-4.17/cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch new file mode 100644 index 00000000000..e557bf843ec --- /dev/null +++ b/queue-4.17/cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Ganesh Goudar +Date: Sat, 23 Jun 2018 20:28:26 +0530 +Subject: cxgb4: when disabling dcb set txq dcb priority to 0 + +From: Ganesh Goudar + +[ Upstream commit 5ce36338a30f9814fc4824f9fe6c20cd83d872c7 ] + +When we are disabling DCB, store "0" in txq->dcb_prio +since that's used for future TX Work Request "OVLAN_IDX" +values. Setting non zero priority upon disabling DCB +would halt the traffic. + +Reported-by: AMG Zollner Robert +CC: David Ahern +Signed-off-by: Casey Leedom +Signed-off-by: Ganesh Goudar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +@@ -263,7 +263,7 @@ static void dcb_tx_queue_prio_enable(str + "Can't %s DCB Priority on port %d, TX Queue %d: err=%d\n", + enable ? "set" : "unset", pi->port_id, i, -err); + else +- txq->dcb_prio = value; ++ txq->dcb_prio = enable ? value : 0; + } + } + diff --git a/queue-4.17/dev-dax-check_vma-ratelimit-dev_info-s.patch b/queue-4.17/dev-dax-check_vma-ratelimit-dev_info-s.patch new file mode 100644 index 00000000000..4388867a78e --- /dev/null +++ b/queue-4.17/dev-dax-check_vma-ratelimit-dev_info-s.patch @@ -0,0 +1,59 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jeff Moyer +Date: Wed, 27 Jun 2018 11:43:58 -0400 +Subject: dev-dax: check_vma: ratelimit dev_info-s + +From: Jeff Moyer + +[ Upstream commit 5a14e91d559aee5bdb0e002e1153fd9c4338a29e ] + +This is easily triggered from userspace, so let's ratelimit the +messages. + +Signed-off-by: Jeff Moyer +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dax/device.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/dax/device.c ++++ b/drivers/dax/device.c +@@ -189,14 +189,16 @@ static int check_vma(struct dev_dax *dev + + /* prevent private mappings from being established */ + if ((vma->vm_flags & VM_MAYSHARE) != VM_MAYSHARE) { +- dev_info(dev, "%s: %s: fail, attempted private mapping\n", ++ dev_info_ratelimited(dev, ++ "%s: %s: fail, attempted private mapping\n", + current->comm, func); + return -EINVAL; + } + + mask = dax_region->align - 1; + if (vma->vm_start & mask || vma->vm_end & mask) { +- dev_info(dev, "%s: %s: fail, unaligned vma (%#lx - %#lx, %#lx)\n", ++ dev_info_ratelimited(dev, ++ "%s: %s: fail, unaligned vma (%#lx - %#lx, %#lx)\n", + current->comm, func, vma->vm_start, vma->vm_end, + mask); + return -EINVAL; +@@ -204,13 +206,15 @@ static int check_vma(struct dev_dax *dev + + if ((dax_region->pfn_flags & (PFN_DEV|PFN_MAP)) == PFN_DEV + && (vma->vm_flags & VM_DONTCOPY) == 0) { +- dev_info(dev, "%s: %s: fail, dax range requires MADV_DONTFORK\n", ++ dev_info_ratelimited(dev, ++ "%s: %s: fail, dax range requires MADV_DONTFORK\n", + current->comm, func); + return -EINVAL; + } + + if (!vma_is_dax(vma)) { +- dev_info(dev, "%s: %s: fail, vma is not DAX capable\n", ++ dev_info_ratelimited(dev, ++ "%s: %s: fail, vma is not DAX capable\n", + current->comm, func); + return -EINVAL; + } diff --git a/queue-4.17/dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch b/queue-4.17/dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch new file mode 100644 index 00000000000..dd10b5e3179 --- /dev/null +++ b/queue-4.17/dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dan Carpenter +Date: Fri, 22 Jun 2018 14:15:47 +0300 +Subject: dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate() + +From: Dan Carpenter + +[ Upstream commit c4c2b7644cc9a41f17a8cc8904efe3f66ae4c7ed ] + +The d->chans[] array has d->dma_requests elements so the > should be +>= here. + +Fixes: 8e6152bc660e ("dmaengine: Add hisilicon k3 DMA engine driver") +Signed-off-by: Dan Carpenter +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/k3dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/k3dma.c ++++ b/drivers/dma/k3dma.c +@@ -794,7 +794,7 @@ static struct dma_chan *k3_of_dma_simple + struct k3_dma_dev *d = ofdma->of_dma_data; + unsigned int request = dma_spec->args[0]; + +- if (request > d->dma_requests) ++ if (request >= d->dma_requests) + return NULL; + + return dma_get_slave_channel(&(d->chans[request].vc.chan)); diff --git a/queue-4.17/dmaengine-pl330-report-burst-residue-granularity.patch b/queue-4.17/dmaengine-pl330-report-burst-residue-granularity.patch new file mode 100644 index 00000000000..c8e104d0aad --- /dev/null +++ b/queue-4.17/dmaengine-pl330-report-burst-residue-granularity.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Marek Szyprowski +Date: Tue, 19 Jun 2018 15:20:50 +0200 +Subject: dmaengine: pl330: report BURST residue granularity + +From: Marek Szyprowski + +[ Upstream commit e3f329c600033f011a978a8bc4ddb1e2e94c4f4d ] + +The reported residue is already calculated in BURST unit granularity, so +advertise this capability properly to other devices in the system. + +Fixes: aee4d1fac887 ("dmaengine: pl330: improve pl330_tx_status() function") +Signed-off-by: Marek Szyprowski +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/pl330.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2924,7 +2924,7 @@ pl330_probe(struct amba_device *adev, co + pd->src_addr_widths = PL330_DMA_BUSWIDTHS; + pd->dst_addr_widths = PL330_DMA_BUSWIDTHS; + pd->directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV); +- pd->residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT; ++ pd->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST; + pd->max_burst = ((pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) ? + 1 : PL330_MAX_BURST); + diff --git a/queue-4.17/dmaengine-ti-omap-dma-fix-omap1510-incorrect-residue_granularity.patch b/queue-4.17/dmaengine-ti-omap-dma-fix-omap1510-incorrect-residue_granularity.patch new file mode 100644 index 00000000000..db49773a55e --- /dev/null +++ b/queue-4.17/dmaengine-ti-omap-dma-fix-omap1510-incorrect-residue_granularity.patch @@ -0,0 +1,66 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Janusz Krzysztofik +Date: Tue, 5 Jun 2018 18:59:57 +0200 +Subject: dmaengine: ti: omap-dma: Fix OMAP1510 incorrect residue_granularity + +From: Janusz Krzysztofik + +[ Upstream commit c9bd0946da243a8eb86b44ff613e2c813f9b683b ] + +Commit 0198d7bb8a0c ("ASoC: omap-mcbsp: Convert to use the sdma-pcm +instead of omap-pcm") resulted in broken audio playback on OMAP1510 +(discovered on Amstrad Delta). + +When running on OMAP1510, omap-pcm used to obtain DMA offset from +snd_dmaengine_pcm_pointer_no_residue() based on DMA interrupt triggered +software calculations instead of snd_dmaengine_pcm_pointer() which +depended on residue value calculated from omap_dma_get_src_pos(). +Similar code path is still available in now used +sound/soc/soc-generic-dmaengine-pcm.c but it is not triggered. + +It was verified already before that omap_get_dma_src_pos() from +arch/arm/plat-omap/dma.c didn't work correctly for OMAP1510 - see +commit 1bdd7419910c ("ASoC: OMAP: fix OMAP1510 broken PCM pointer +callback") for details. Apparently the same applies to its successor, +omap_dma_get_src_pos() from drivers/dma/ti/omap-dma.c. + +On the other hand, snd_dmaengine_pcm_pointer_no_residue() is described +as depreciated and discouraged for use in new drivers because of its +unreliable accuracy. However, it seems the only working option for +OPAM1510 now, as long as a software calculated residue is not +implemented as OMAP1510 fallback in omap-dma. + +Using snd_dmaengine_pcm_pointer_no_residue() code path instead of +snd_dmaengine_pcm_pointer() in sound/soc/soc-generic-dmaengine-pcm.c +can be triggered in two ways: +- by passing pcm->flags |= SND_DMAENGINE_PCM_FLAG_NO_RESIDUE from + sound/soc/omap/sdma-pcm.c, +- by passing dma_caps.residue_granularity = + DMA_RESIDUE_GRANULARITY_DESCRIPTOR from DMA engine. + +Let's do the latter. + +Signed-off-by: Janusz Krzysztofik +Acked-by: Peter Ujfalusi +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/omap-dma.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/dma/omap-dma.c ++++ b/drivers/dma/omap-dma.c +@@ -1485,7 +1485,11 @@ static int omap_dma_probe(struct platfor + od->ddev.src_addr_widths = OMAP_DMA_BUSWIDTHS; + od->ddev.dst_addr_widths = OMAP_DMA_BUSWIDTHS; + od->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV); +- od->ddev.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST; ++ if (__dma_omap15xx(od->plat->dma_attr)) ++ od->ddev.residue_granularity = ++ DMA_RESIDUE_GRANULARITY_DESCRIPTOR; ++ else ++ od->ddev.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST; + od->ddev.max_burst = SZ_16M - 1; /* CCEN: 24bit unsigned */ + od->ddev.dev = &pdev->dev; + INIT_LIST_HEAD(&od->ddev.channels); diff --git a/queue-4.17/dpaa_eth-dpaa-sgt-needs-to-be-256b.patch b/queue-4.17/dpaa_eth-dpaa-sgt-needs-to-be-256b.patch new file mode 100644 index 00000000000..2382ed1fba9 --- /dev/null +++ b/queue-4.17/dpaa_eth-dpaa-sgt-needs-to-be-256b.patch @@ -0,0 +1,69 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Madalin Bucur +Date: Thu, 28 Jun 2018 15:26:51 +0300 +Subject: dpaa_eth: DPAA SGT needs to be 256B + +From: Madalin Bucur + +[ Upstream commit 595e802e53f24642a145cf7f3e4ac9afab4c21ec ] + +The DPAA HW requires that at least 256 bytes from the start of the +first scatter-gather table entry are allocated and accessible. The +hardware reads the maximum size the table can have in one access, +thus requiring that the allocation and mapping to be done for the +maximum size of 256B even if there is a smaller number of entries +in the table. + +Signed-off-by: Madalin Bucur +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -125,6 +125,9 @@ MODULE_PARM_DESC(tx_timeout, "The Tx tim + /* Default alignment for start of data in an Rx FD */ + #define DPAA_FD_DATA_ALIGNMENT 16 + ++/* The DPAA requires 256 bytes reserved and mapped for the SGT */ ++#define DPAA_SGT_SIZE 256 ++ + /* Values for the L3R field of the FM Parse Results + */ + /* L3 Type field: First IP Present IPv4 */ +@@ -1617,8 +1620,8 @@ static struct sk_buff *dpaa_cleanup_tx_f + + if (unlikely(qm_fd_get_format(fd) == qm_fd_sg)) { + nr_frags = skb_shinfo(skb)->nr_frags; +- dma_unmap_single(dev, addr, qm_fd_get_offset(fd) + +- sizeof(struct qm_sg_entry) * (1 + nr_frags), ++ dma_unmap_single(dev, addr, ++ qm_fd_get_offset(fd) + DPAA_SGT_SIZE, + dma_dir); + + /* The sgt buffer has been allocated with netdev_alloc_frag(), +@@ -1903,8 +1906,7 @@ static int skb_to_sg_fd(struct dpaa_priv + void *sgt_buf; + + /* get a page frag to store the SGTable */ +- sz = SKB_DATA_ALIGN(priv->tx_headroom + +- sizeof(struct qm_sg_entry) * (1 + nr_frags)); ++ sz = SKB_DATA_ALIGN(priv->tx_headroom + DPAA_SGT_SIZE); + sgt_buf = netdev_alloc_frag(sz); + if (unlikely(!sgt_buf)) { + netdev_err(net_dev, "netdev_alloc_frag() failed for size %d\n", +@@ -1972,9 +1974,8 @@ static int skb_to_sg_fd(struct dpaa_priv + skbh = (struct sk_buff **)buffer_start; + *skbh = skb; + +- addr = dma_map_single(dev, buffer_start, priv->tx_headroom + +- sizeof(struct qm_sg_entry) * (1 + nr_frags), +- dma_dir); ++ addr = dma_map_single(dev, buffer_start, ++ priv->tx_headroom + DPAA_SGT_SIZE, dma_dir); + if (unlikely(dma_mapping_error(dev, addr))) { + dev_err(dev, "DMA mapping failed"); + err = -EINVAL; diff --git a/queue-4.17/drbd-fix-drbd_request_prepare-discard-handling.patch b/queue-4.17/drbd-fix-drbd_request_prepare-discard-handling.patch new file mode 100644 index 00000000000..3649f180e85 --- /dev/null +++ b/queue-4.17/drbd-fix-drbd_request_prepare-discard-handling.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Bart Van Assche +Date: Mon, 25 Jun 2018 15:51:30 -0700 +Subject: drbd: Fix drbd_request_prepare() discard handling + +From: Bart Van Assche + +[ Upstream commit fad2d4ef636654e926d374ef038f4cd4286661f6 ] + +Fix the test that verifies whether bio_op(bio) represents a discard +or write zeroes operation. Compile-tested only. + +Cc: Philipp Reisner +Cc: Lars Ellenberg +Fixes: 7435e9018f91 ("drbd: zero-out partial unaligned discards on local backend") +Signed-off-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/drbd/drbd_req.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/block/drbd/drbd_req.c ++++ b/drivers/block/drbd/drbd_req.c +@@ -1244,8 +1244,8 @@ drbd_request_prepare(struct drbd_device + _drbd_start_io_acct(device, req); + + /* process discards always from our submitter thread */ +- if ((bio_op(bio) & REQ_OP_WRITE_ZEROES) || +- (bio_op(bio) & REQ_OP_DISCARD)) ++ if (bio_op(bio) == REQ_OP_WRITE_ZEROES || ++ bio_op(bio) == REQ_OP_DISCARD) + goto queue_for_submitter_thread; + + if (rw == WRITE && req->private_bio && req->i.size diff --git a/queue-4.17/drivers-perf-xgene_pmu-fix-iob-slow-pmu-parser-error.patch b/queue-4.17/drivers-perf-xgene_pmu-fix-iob-slow-pmu-parser-error.patch new file mode 100644 index 00000000000..1759671524b --- /dev/null +++ b/queue-4.17/drivers-perf-xgene_pmu-fix-iob-slow-pmu-parser-error.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Hoan Tran +Date: Thu, 7 Jun 2018 14:35:01 +0100 +Subject: drivers/perf: xgene_pmu: Fix IOB SLOW PMU parser error + +From: Hoan Tran + +[ Upstream commit a45fc268db20ecd859bb61e25045912b3194b5e6 ] + +This patch fixes the below parser error of the IOB SLOW PMU. + + # perf stat -a -e iob-slow0/cycle-count/ sleep 1 + evenf syntax error: 'iob-slow0/cycle-count/' + \___ parser error + +It replaces the "-" character by "_" character inside the PMU name. + +Signed-off-by: Hoan Tran +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/perf/xgene_pmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/perf/xgene_pmu.c ++++ b/drivers/perf/xgene_pmu.c +@@ -1463,7 +1463,7 @@ static char *xgene_pmu_dev_name(struct d + case PMU_TYPE_IOB: + return devm_kasprintf(dev, GFP_KERNEL, "iob%d", id); + case PMU_TYPE_IOB_SLOW: +- return devm_kasprintf(dev, GFP_KERNEL, "iob-slow%d", id); ++ return devm_kasprintf(dev, GFP_KERNEL, "iob_slow%d", id); + case PMU_TYPE_MCB: + return devm_kasprintf(dev, GFP_KERNEL, "mcb%d", id); + case PMU_TYPE_MC: diff --git a/queue-4.17/drm-amd-powerplay-correct-vega12-thermal-support-as-true.patch b/queue-4.17/drm-amd-powerplay-correct-vega12-thermal-support-as-true.patch new file mode 100644 index 00000000000..9dc6739eb51 --- /dev/null +++ b/queue-4.17/drm-amd-powerplay-correct-vega12-thermal-support-as-true.patch @@ -0,0 +1,30 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Evan Quan +Date: Mon, 11 Jun 2018 16:46:40 +0800 +Subject: drm/amd/powerplay: correct vega12 thermal support as true + +From: Evan Quan + +[ Upstream commit 363a3d3fb7d478d7dd49b8c6294436b8ba5984cc ] + +Thermal support is enabled on vega12. + +Signed-off-by: Evan Quan +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c +@@ -82,6 +82,7 @@ static void vega12_set_default_registry_ + + data->registry_data.disallowed_features = 0x0; + data->registry_data.od_state_in_dc_support = 0; ++ data->registry_data.thermal_support = 1; + data->registry_data.skip_baco_hardware = 0; + + data->registry_data.log_avfs_param = 0; diff --git a/queue-4.17/drm-amdgpu-fix-swapped-emit_ib_size-in-vce3.patch b/queue-4.17/drm-amdgpu-fix-swapped-emit_ib_size-in-vce3.patch new file mode 100644 index 00000000000..ba8d72a7449 --- /dev/null +++ b/queue-4.17/drm-amdgpu-fix-swapped-emit_ib_size-in-vce3.patch @@ -0,0 +1,39 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Alex Deucher +Date: Thu, 28 Jun 2018 12:38:53 -0500 +Subject: drm/amdgpu: fix swapped emit_ib_size in vce3 + +From: Alex Deucher + +[ Upstream commit 0859df22ab7cfb3ad2df2caed76cadce6ac33a80 ] + +The phys and vm versions had the values swapped. + +Reviewed-by: Junwei Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c +@@ -899,7 +899,7 @@ static const struct amdgpu_ring_funcs vc + .emit_frame_size = + 4 + /* vce_v3_0_emit_pipeline_sync */ + 6, /* amdgpu_vce_ring_emit_fence x1 no user fence */ +- .emit_ib_size = 5, /* vce_v3_0_ring_emit_ib */ ++ .emit_ib_size = 4, /* amdgpu_vce_ring_emit_ib */ + .emit_ib = amdgpu_vce_ring_emit_ib, + .emit_fence = amdgpu_vce_ring_emit_fence, + .test_ring = amdgpu_vce_ring_test_ring, +@@ -923,7 +923,7 @@ static const struct amdgpu_ring_funcs vc + 6 + /* vce_v3_0_emit_vm_flush */ + 4 + /* vce_v3_0_emit_pipeline_sync */ + 6 + 6, /* amdgpu_vce_ring_emit_fence x2 vm fence */ +- .emit_ib_size = 4, /* amdgpu_vce_ring_emit_ib */ ++ .emit_ib_size = 5, /* vce_v3_0_ring_emit_ib */ + .emit_ib = vce_v3_0_ring_emit_ib, + .emit_vm_flush = vce_v3_0_emit_vm_flush, + .emit_pipeline_sync = vce_v3_0_emit_pipeline_sync, diff --git a/queue-4.17/drm-arm-malidp-ensure-that-the-crtcs-are-shutdown-before-removing-any-encoder-connector.patch b/queue-4.17/drm-arm-malidp-ensure-that-the-crtcs-are-shutdown-before-removing-any-encoder-connector.patch new file mode 100644 index 00000000000..976602b5bc1 --- /dev/null +++ b/queue-4.17/drm-arm-malidp-ensure-that-the-crtcs-are-shutdown-before-removing-any-encoder-connector.patch @@ -0,0 +1,56 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Ayan Kumar Halder +Date: Fri, 20 Apr 2018 15:44:57 +0100 +Subject: drm/arm/malidp: Ensure that the crtcs are shutdown before removing any encoder/connector + +From: Ayan Kumar Halder + +[ Upstream commit 109c4d18e57445afcaf728b8716a69375a3daab2 ] + +One needs to ensure that the crtcs are shutdown so that the +drm_crtc_state->connector_mask reflects that no connectors +are currently active. Further, it reduces the reference +count for each connector. This ensures that the connectors +and encoders can be cleanly removed either when _unbind +is called for the corresponding drivers or by +drm_mode_config_cleanup(). +We need drm_atomic_helper_shutdown() to be called before +component_unbind_all() otherwise the connectors attached to the +component device will have the wrong reference count value and will not +be cleanly removed. + +Signed-off-by: Ayan Kumar Halder +Acked-by: Liviu Dudau +Signed-off-by: Liviu Dudau +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/arm/malidp_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/arm/malidp_drv.c ++++ b/drivers/gpu/drm/arm/malidp_drv.c +@@ -278,7 +278,6 @@ static int malidp_init(struct drm_device + + static void malidp_fini(struct drm_device *drm) + { +- drm_atomic_helper_shutdown(drm); + drm_mode_config_cleanup(drm); + } + +@@ -646,6 +645,7 @@ vblank_fail: + malidp_de_irq_fini(drm); + drm->irq_enabled = false; + irq_init_fail: ++ drm_atomic_helper_shutdown(drm); + component_unbind_all(dev, drm); + bind_fail: + of_node_put(malidp->crtc.port); +@@ -681,6 +681,7 @@ static void malidp_unbind(struct device + malidp_se_irq_fini(drm); + malidp_de_irq_fini(drm); + drm->irq_enabled = false; ++ drm_atomic_helper_shutdown(drm); + component_unbind_all(dev, drm); + of_node_put(malidp->crtc.port); + malidp->crtc.port = NULL; diff --git a/queue-4.17/drm-arm-malidp-preserve-layer_format-contents-when-setting-format.patch b/queue-4.17/drm-arm-malidp-preserve-layer_format-contents-when-setting-format.patch new file mode 100644 index 00000000000..156aa5896c7 --- /dev/null +++ b/queue-4.17/drm-arm-malidp-preserve-layer_format-contents-when-setting-format.patch @@ -0,0 +1,46 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Ayan Kumar Halder +Date: Tue, 10 Apr 2018 19:25:03 +0100 +Subject: drm/arm/malidp: Preserve LAYER_FORMAT contents when setting format + +From: Ayan Kumar Halder + +[ Upstream commit ad7fda2e378f4356df621a39655f7c200b495d81 ] + +On some Mali-DP processors, the LAYER_FORMAT register contains fields +other than the format. These bits were unconditionally cleared when +setting the pixel format, whereas they should be preserved at their +reset values. + +Reported-by: Brian Starkey +Reported-by: Liviu Dudau +Signed-off-by: Ayan Kumar halder +Acked-by: Liviu Dudau +Signed-off-by: Liviu Dudau +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/arm/malidp_planes.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/arm/malidp_planes.c ++++ b/drivers/gpu/drm/arm/malidp_planes.c +@@ -23,6 +23,7 @@ + + /* Layer specific register offsets */ + #define MALIDP_LAYER_FORMAT 0x000 ++#define LAYER_FORMAT_MASK 0x3f + #define MALIDP_LAYER_CONTROL 0x004 + #define LAYER_ENABLE (1 << 0) + #define LAYER_FLOWCFG_MASK 7 +@@ -337,7 +338,9 @@ static void malidp_de_plane_update(struc + dest_w = plane->state->crtc_w; + dest_h = plane->state->crtc_h; + +- malidp_hw_write(mp->hwdev, ms->format, mp->layer->base); ++ val = malidp_hw_read(mp->hwdev, mp->layer->base); ++ val = (val & ~LAYER_FORMAT_MASK) | ms->format; ++ malidp_hw_write(mp->hwdev, val, mp->layer->base); + + for (i = 0; i < ms->n_planes; i++) { + /* calculate the offset for the layer's plane registers */ diff --git a/queue-4.17/drm-armada-fix-colorkey-mode-property.patch b/queue-4.17/drm-armada-fix-colorkey-mode-property.patch new file mode 100644 index 00000000000..cefe48beb43 --- /dev/null +++ b/queue-4.17/drm-armada-fix-colorkey-mode-property.patch @@ -0,0 +1,91 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Russell King +Date: Sun, 24 Jun 2018 14:35:10 +0100 +Subject: drm/armada: fix colorkey mode property + +From: Russell King + +[ Upstream commit d378859a667edc99e3473704847698cae97ca2b1 ] + +The colorkey mode property was not correctly disabling the colorkeying +when "disabled" mode was selected. Arrange for this to work as one +would expect. + +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/armada/armada_hw.h | 1 + + drivers/gpu/drm/armada/armada_overlay.c | 30 ++++++++++++++++++++++-------- + 2 files changed, 23 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/armada/armada_hw.h ++++ b/drivers/gpu/drm/armada/armada_hw.h +@@ -160,6 +160,7 @@ enum { + CFG_ALPHAM_GRA = 0x1 << 16, + CFG_ALPHAM_CFG = 0x2 << 16, + CFG_ALPHA_MASK = 0xff << 8, ++#define CFG_ALPHA(x) ((x) << 8) + CFG_PIXCMD_MASK = 0xff, + }; + +--- a/drivers/gpu/drm/armada/armada_overlay.c ++++ b/drivers/gpu/drm/armada/armada_overlay.c +@@ -28,6 +28,7 @@ struct armada_ovl_plane_properties { + uint16_t contrast; + uint16_t saturation; + uint32_t colorkey_mode; ++ uint32_t colorkey_enable; + }; + + struct armada_ovl_plane { +@@ -54,11 +55,13 @@ armada_ovl_update_attr(struct armada_ovl + writel_relaxed(0x00002000, dcrtc->base + LCD_SPU_CBSH_HUE); + + spin_lock_irq(&dcrtc->irq_lock); +- armada_updatel(prop->colorkey_mode | CFG_ALPHAM_GRA, +- CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK, +- dcrtc->base + LCD_SPU_DMA_CTRL1); +- +- armada_updatel(ADV_GRACOLORKEY, 0, dcrtc->base + LCD_SPU_ADV_REG); ++ armada_updatel(prop->colorkey_mode, ++ CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK, ++ dcrtc->base + LCD_SPU_DMA_CTRL1); ++ if (dcrtc->variant->has_spu_adv_reg) ++ armada_updatel(prop->colorkey_enable, ++ ADV_GRACOLORKEY | ADV_VIDCOLORKEY, ++ dcrtc->base + LCD_SPU_ADV_REG); + spin_unlock_irq(&dcrtc->irq_lock); + } + +@@ -321,8 +324,17 @@ static int armada_ovl_plane_set_property + dplane->prop.colorkey_vb |= K2B(val); + update_attr = true; + } else if (property == priv->colorkey_mode_prop) { +- dplane->prop.colorkey_mode &= ~CFG_CKMODE_MASK; +- dplane->prop.colorkey_mode |= CFG_CKMODE(val); ++ if (val == CKMODE_DISABLE) { ++ dplane->prop.colorkey_mode = ++ CFG_CKMODE(CKMODE_DISABLE) | ++ CFG_ALPHAM_CFG | CFG_ALPHA(255); ++ dplane->prop.colorkey_enable = 0; ++ } else { ++ dplane->prop.colorkey_mode = ++ CFG_CKMODE(val) | ++ CFG_ALPHAM_GRA | CFG_ALPHA(0); ++ dplane->prop.colorkey_enable = ADV_GRACOLORKEY; ++ } + update_attr = true; + } else if (property == priv->brightness_prop) { + dplane->prop.brightness = val - 256; +@@ -453,7 +465,9 @@ int armada_overlay_plane_create(struct d + dplane->prop.colorkey_yr = 0xfefefe00; + dplane->prop.colorkey_ug = 0x01010100; + dplane->prop.colorkey_vb = 0x01010100; +- dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB); ++ dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB) | ++ CFG_ALPHAM_GRA | CFG_ALPHA(0); ++ dplane->prop.colorkey_enable = ADV_GRACOLORKEY; + dplane->prop.brightness = 0; + dplane->prop.contrast = 0x4000; + dplane->prop.saturation = 0x4000; diff --git a/queue-4.17/drm-armada-fix-irq-handling.patch b/queue-4.17/drm-armada-fix-irq-handling.patch new file mode 100644 index 00000000000..f52c230c246 --- /dev/null +++ b/queue-4.17/drm-armada-fix-irq-handling.patch @@ -0,0 +1,66 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Russell King +Date: Tue, 26 Jun 2018 17:06:06 +0100 +Subject: drm/armada: fix irq handling + +From: Russell King + +[ Upstream commit 92298c1cd8e8a6b56322b602ad72b54e6237631d ] + +Add the missing locks to the IRQ enable/disable paths, and fix a comment +in the interrupt handler: reading the ISR clears down the status bits, +but does not reset the interrupt so it can signal again. That seems to +require a write. + +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/armada/armada_crtc.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/armada/armada_crtc.c ++++ b/drivers/gpu/drm/armada/armada_crtc.c +@@ -519,8 +519,9 @@ static irqreturn_t armada_drm_irq(int ir + u32 v, stat = readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR); + + /* +- * This is rediculous - rather than writing bits to clear, we +- * have to set the actual status register value. This is racy. ++ * Reading the ISR appears to clear bits provided CLEAN_SPU_IRQ_ISR ++ * is set. Writing has some other effect to acknowledge the IRQ - ++ * without this, we only get a single IRQ. + */ + writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR); + +@@ -1116,16 +1117,22 @@ armada_drm_crtc_set_property(struct drm_ + static int armada_drm_crtc_enable_vblank(struct drm_crtc *crtc) + { + struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc); ++ unsigned long flags; + ++ spin_lock_irqsave(&dcrtc->irq_lock, flags); + armada_drm_crtc_enable_irq(dcrtc, VSYNC_IRQ_ENA); ++ spin_unlock_irqrestore(&dcrtc->irq_lock, flags); + return 0; + } + + static void armada_drm_crtc_disable_vblank(struct drm_crtc *crtc) + { + struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc); ++ unsigned long flags; + ++ spin_lock_irqsave(&dcrtc->irq_lock, flags); + armada_drm_crtc_disable_irq(dcrtc, VSYNC_IRQ_ENA); ++ spin_unlock_irqrestore(&dcrtc->irq_lock, flags); + } + + static const struct drm_crtc_funcs armada_crtc_funcs = { +@@ -1415,6 +1422,7 @@ static int armada_drm_crtc_create(struct + CFG_PDWN64x66, dcrtc->base + LCD_SPU_SRAM_PARA1); + writel_relaxed(0x2032ff81, dcrtc->base + LCD_SPU_DMA_CTRL1); + writel_relaxed(dcrtc->irq_ena, dcrtc->base + LCD_SPU_IRQ_ENA); ++ readl_relaxed(dcrtc->base + LCD_SPU_IRQ_ISR); + writel_relaxed(0, dcrtc->base + LCD_SPU_IRQ_ISR); + + ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc", diff --git a/queue-4.17/drm-bridge-sii8620-fix-display-modes-validation.patch b/queue-4.17/drm-bridge-sii8620-fix-display-modes-validation.patch new file mode 100644 index 00000000000..4374d512653 --- /dev/null +++ b/queue-4.17/drm-bridge-sii8620-fix-display-modes-validation.patch @@ -0,0 +1,136 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Maciej Purski +Date: Fri, 2 Feb 2018 11:54:25 +0100 +Subject: drm/bridge/sii8620: fix display modes validation + +From: Maciej Purski + +[ Upstream commit ecba7cfa3afbe489288f2c819158b7402afd7ee9 ] + +Current implementation of mode_valid() and mode_fixup() callbacks +handle packed pixel modes improperly. + +Fix it by using proper maximum clock values from the documentation. + +Signed-off-by: Maciej Purski +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/1517568865-25219-1-git-send-email-m.purski@samsung.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/sil-sii8620.c | 78 +++++++++++++++++------------------ + 1 file changed, 40 insertions(+), 38 deletions(-) + +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -36,8 +36,11 @@ + + #define SII8620_BURST_BUF_LEN 288 + #define VAL_RX_HDMI_CTRL2_DEFVAL VAL_RX_HDMI_CTRL2_IDLE_CNT(3) +-#define MHL1_MAX_LCLK 225000 +-#define MHL3_MAX_LCLK 600000 ++ ++#define MHL1_MAX_PCLK 75000 ++#define MHL1_MAX_PCLK_PP_MODE 150000 ++#define MHL3_MAX_PCLK 200000 ++#define MHL3_MAX_PCLK_PP_MODE 300000 + + enum sii8620_mode { + CM_DISCONNECTED, +@@ -2277,17 +2280,43 @@ static void sii8620_detach(struct drm_br + rc_unregister_device(ctx->rc_dev); + } + ++static int sii8620_is_packing_required(struct sii8620 *ctx, ++ const struct drm_display_mode *mode) ++{ ++ int max_pclk, max_pclk_pp_mode; ++ ++ if (sii8620_is_mhl3(ctx)) { ++ max_pclk = MHL3_MAX_PCLK; ++ max_pclk_pp_mode = MHL3_MAX_PCLK_PP_MODE; ++ } else { ++ max_pclk = MHL1_MAX_PCLK; ++ max_pclk_pp_mode = MHL1_MAX_PCLK_PP_MODE; ++ } ++ ++ if (mode->clock < max_pclk) ++ return 0; ++ else if (mode->clock < max_pclk_pp_mode) ++ return 1; ++ else ++ return -1; ++} ++ + static enum drm_mode_status sii8620_mode_valid(struct drm_bridge *bridge, + const struct drm_display_mode *mode) + { + struct sii8620 *ctx = bridge_to_sii8620(bridge); ++ int pack_required = sii8620_is_packing_required(ctx, mode); + bool can_pack = ctx->devcap[MHL_DCAP_VID_LINK_MODE] & + MHL_DCAP_VID_LINK_PPIXEL; +- unsigned int max_pclk = sii8620_is_mhl3(ctx) ? MHL3_MAX_LCLK : +- MHL1_MAX_LCLK; +- max_pclk /= can_pack ? 2 : 3; + +- return (mode->clock > max_pclk) ? MODE_CLOCK_HIGH : MODE_OK; ++ switch (pack_required) { ++ case 0: ++ return MODE_OK; ++ case 1: ++ return (can_pack) ? MODE_OK : MODE_CLOCK_HIGH; ++ default: ++ return MODE_CLOCK_HIGH; ++ } + } + + static bool sii8620_mode_fixup(struct drm_bridge *bridge, +@@ -2295,43 +2324,16 @@ static bool sii8620_mode_fixup(struct dr + struct drm_display_mode *adjusted_mode) + { + struct sii8620 *ctx = bridge_to_sii8620(bridge); +- int max_lclk; +- bool ret = true; + + mutex_lock(&ctx->lock); + +- max_lclk = sii8620_is_mhl3(ctx) ? MHL3_MAX_LCLK : MHL1_MAX_LCLK; +- if (max_lclk > 3 * adjusted_mode->clock) { +- ctx->use_packed_pixel = 0; +- goto end; +- } +- if ((ctx->devcap[MHL_DCAP_VID_LINK_MODE] & MHL_DCAP_VID_LINK_PPIXEL) && +- max_lclk > 2 * adjusted_mode->clock) { +- ctx->use_packed_pixel = 1; +- goto end; +- } +- ret = false; +-end: +- if (ret) { +- u8 vic = drm_match_cea_mode(adjusted_mode); ++ ctx->use_packed_pixel = sii8620_is_packing_required(ctx, adjusted_mode); ++ ctx->video_code = drm_match_cea_mode(adjusted_mode); ++ ctx->pixel_clock = adjusted_mode->clock; + +- if (!vic) { +- union hdmi_infoframe frm; +- u8 mhl_vic[] = { 0, 95, 94, 93, 98 }; +- +- /* FIXME: We need the connector here */ +- drm_hdmi_vendor_infoframe_from_display_mode( +- &frm.vendor.hdmi, NULL, adjusted_mode); +- vic = frm.vendor.hdmi.vic; +- if (vic >= ARRAY_SIZE(mhl_vic)) +- vic = 0; +- vic = mhl_vic[vic]; +- } +- ctx->video_code = vic; +- ctx->pixel_clock = adjusted_mode->clock; +- } + mutex_unlock(&ctx->lock); +- return ret; ++ ++ return true; + } + + static const struct drm_bridge_funcs sii8620_bridge_funcs = { diff --git a/queue-4.17/drm-bridge-sii8620-fix-display-of-packed-pixel-modes-in-mhl2.patch b/queue-4.17/drm-bridge-sii8620-fix-display-of-packed-pixel-modes-in-mhl2.patch new file mode 100644 index 00000000000..c533fcff1eb --- /dev/null +++ b/queue-4.17/drm-bridge-sii8620-fix-display-of-packed-pixel-modes-in-mhl2.patch @@ -0,0 +1,65 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Maciej Purski +Date: Tue, 23 Jan 2018 12:17:19 +0100 +Subject: drm/bridge/sii8620: fix display of packed pixel modes in MHL2 + +From: Maciej Purski + +[ Upstream commit e8b92efa629dac0e70ea4145c5e70616de5f89c8 ] + +Currently packed pixel modes in MHL2 can't be displayed. The device +automatically recognizes output format, so setting format other than +RGB causes failure. Fix it by writing proper values to registers. + +Tested on MHL1 and MHL2 using various vendors' dongles both in +DVI and HDMI mode. + +Signed-off-by: Maciej Purski +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/1516706239-9104-1-git-send-email-m.purski@samsung.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/sil-sii8620.c | 17 +---------------- + 1 file changed, 1 insertion(+), 16 deletions(-) + +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -1060,20 +1060,11 @@ static void sii8620_stop_video(struct si + + static void sii8620_set_format(struct sii8620 *ctx) + { +- u8 out_fmt; +- + if (sii8620_is_mhl3(ctx)) { + sii8620_setbits(ctx, REG_M3_P0CTRL, + BIT_M3_P0CTRL_MHL3_P0_PIXEL_MODE_PACKED, + ctx->use_packed_pixel ? ~0 : 0); + } else { +- if (ctx->use_packed_pixel) +- sii8620_write_seq_static(ctx, +- REG_VID_MODE, BIT_VID_MODE_M1080P, +- REG_MHL_TOP_CTL, BIT_MHL_TOP_CTL_MHL_PP_SEL | 1, +- REG_MHLTX_CTL6, 0x60 +- ); +- else + sii8620_write_seq_static(ctx, + REG_VID_MODE, 0, + REG_MHL_TOP_CTL, 1, +@@ -1081,15 +1072,9 @@ static void sii8620_set_format(struct si + ); + } + +- if (ctx->use_packed_pixel) +- out_fmt = VAL_TPI_FORMAT(YCBCR422, FULL) | +- BIT_TPI_OUTPUT_CSCMODE709; +- else +- out_fmt = VAL_TPI_FORMAT(RGB, FULL); +- + sii8620_write_seq(ctx, + REG_TPI_INPUT, VAL_TPI_FORMAT(RGB, FULL), +- REG_TPI_OUTPUT, out_fmt, ++ REG_TPI_OUTPUT, VAL_TPI_FORMAT(RGB, FULL), + ); + } + diff --git a/queue-4.17/drm-bridge-sii8620-fix-display-of-packed-pixel-modes.patch b/queue-4.17/drm-bridge-sii8620-fix-display-of-packed-pixel-modes.patch new file mode 100644 index 00000000000..ef5d8580e18 --- /dev/null +++ b/queue-4.17/drm-bridge-sii8620-fix-display-of-packed-pixel-modes.patch @@ -0,0 +1,69 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Maciej Purski +Date: Thu, 28 Jun 2018 18:44:02 +0200 +Subject: drm/bridge/sii8620: Fix display of packed pixel modes + +From: Maciej Purski + +[ Upstream commit fdddc65ab35d575b42aab411b2dc687601eab680 ] + +Current implementation does not guarantee packed pixel modes working +with every dongle. There are some dongles, which require selecting +the output mode explicitly. + +Write proper values to registers in packed_pixel mode, based on how it +is done in vendor's code. Select output color space: RGB +(no packed pixel) or YCBCR422 (packed pixel). + +This reverts commit e8b92efa629dac0e70ea4145c5e70616de5f89c8 +("drm/bridge/sii8620: fix display of packed pixel modes in MHL2"). + +Signed-off-by: Maciej Purski +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/1530204243-6370-3-git-send-email-m.purski@samsung.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/sil-sii8620.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -1060,21 +1060,36 @@ static void sii8620_stop_video(struct si + + static void sii8620_set_format(struct sii8620 *ctx) + { ++ u8 out_fmt; ++ + if (sii8620_is_mhl3(ctx)) { + sii8620_setbits(ctx, REG_M3_P0CTRL, + BIT_M3_P0CTRL_MHL3_P0_PIXEL_MODE_PACKED, + ctx->use_packed_pixel ? ~0 : 0); + } else { ++ if (ctx->use_packed_pixel) { ++ sii8620_write_seq_static(ctx, ++ REG_VID_MODE, BIT_VID_MODE_M1080P, ++ REG_MHL_TOP_CTL, BIT_MHL_TOP_CTL_MHL_PP_SEL | 1, ++ REG_MHLTX_CTL6, 0x60 ++ ); ++ } else { + sii8620_write_seq_static(ctx, + REG_VID_MODE, 0, + REG_MHL_TOP_CTL, 1, + REG_MHLTX_CTL6, 0xa0 + ); ++ } + } + ++ if (ctx->use_packed_pixel) ++ out_fmt = VAL_TPI_FORMAT(YCBCR422, FULL); ++ else ++ out_fmt = VAL_TPI_FORMAT(RGB, FULL); ++ + sii8620_write_seq(ctx, + REG_TPI_INPUT, VAL_TPI_FORMAT(RGB, FULL), +- REG_TPI_OUTPUT, VAL_TPI_FORMAT(RGB, FULL), ++ REG_TPI_OUTPUT, out_fmt, + ); + } + diff --git a/queue-4.17/drm-bridge-sii8620-fix-loops-in-edid-fetch-logic.patch b/queue-4.17/drm-bridge-sii8620-fix-loops-in-edid-fetch-logic.patch new file mode 100644 index 00000000000..187caad1dd4 --- /dev/null +++ b/queue-4.17/drm-bridge-sii8620-fix-loops-in-edid-fetch-logic.patch @@ -0,0 +1,75 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Andrzej Hajda +Date: Mon, 15 Jan 2018 18:33:57 +0100 +Subject: drm/bridge/sii8620: fix loops in EDID fetch logic + +From: Andrzej Hajda + +[ Upstream commit 8e627a1b1ce8feb3e1da4428b71b9b4905f04888 ] + +Function should constantly check if cable is connected and finish +in finite time. + +Signed-off-by: Andrzej Hajda +Tested-by: Marek Szyprowski +Reviewed-by: Maciej Purski +Link: https://patchwork.freedesktop.org/patch/msgid/20180115173357.31067-4-a.hajda@samsung.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/sil-sii8620.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -807,6 +807,7 @@ static void sii8620_burst_rx_all(struct + static void sii8620_fetch_edid(struct sii8620 *ctx) + { + u8 lm_ddc, ddc_cmd, int3, cbus; ++ unsigned long timeout; + int fetched, i; + int edid_len = EDID_LENGTH; + u8 *edid; +@@ -856,23 +857,31 @@ static void sii8620_fetch_edid(struct si + REG_DDC_CMD, ddc_cmd | VAL_DDC_CMD_ENH_DDC_READ_NO_ACK + ); + +- do { +- int3 = sii8620_readb(ctx, REG_INTR3); ++ int3 = 0; ++ timeout = jiffies + msecs_to_jiffies(200); ++ for (;;) { + cbus = sii8620_readb(ctx, REG_CBUS_STATUS); +- +- if (int3 & BIT_DDC_CMD_DONE) +- break; +- +- if (!(cbus & BIT_CBUS_STATUS_CBUS_CONNECTED)) { ++ if (~cbus & BIT_CBUS_STATUS_CBUS_CONNECTED) { ++ kfree(edid); ++ edid = NULL; ++ goto end; ++ } ++ if (int3 & BIT_DDC_CMD_DONE) { ++ if (sii8620_readb(ctx, REG_DDC_DOUT_CNT) ++ >= FETCH_SIZE) ++ break; ++ } else { ++ int3 = sii8620_readb(ctx, REG_INTR3); ++ } ++ if (time_is_before_jiffies(timeout)) { ++ ctx->error = -ETIMEDOUT; ++ dev_err(ctx->dev, "timeout during EDID read\n"); + kfree(edid); + edid = NULL; + goto end; + } +- } while (1); +- +- sii8620_readb(ctx, REG_DDC_STATUS); +- while (sii8620_readb(ctx, REG_DDC_DOUT_CNT) < FETCH_SIZE) + usleep_range(10, 20); ++ } + + sii8620_read_buf(ctx, REG_DDC_DATA, edid + fetched, FETCH_SIZE); + if (fetched + FETCH_SIZE == EDID_LENGTH) { diff --git a/queue-4.17/drm-bridge-sii8620-fix-potential-buffer-overflow.patch b/queue-4.17/drm-bridge-sii8620-fix-potential-buffer-overflow.patch new file mode 100644 index 00000000000..128d29e3676 --- /dev/null +++ b/queue-4.17/drm-bridge-sii8620-fix-potential-buffer-overflow.patch @@ -0,0 +1,39 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Maciej Purski +Date: Wed, 22 Nov 2017 10:08:38 +0100 +Subject: drm/bridge/sii8620: fix potential buffer overflow + +From: Maciej Purski + +[ Upstream commit 9378cecb1ce5d618b8aff4d65113ddcf72fc1011 ] + +Buffer overflow error should not occur, as mode_fixup() callback +filters pixel clock value and it should never exceed 600000. However, +current implementation is not obviously safe and relies on +implementation of mode_fixup(). + +Make 'i' variable never reach unsafe value in order to avoid buffer +overflow error. + +Reported-by: Dan Carpenter +Fixes: bf1722ca ("drm/bridge/sii8620: rewrite hdmi start sequence") +Signed-off-by: Maciej Purski +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/1511341718-6974-1-git-send-email-m.purski@samsung.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/sil-sii8620.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -1228,7 +1228,7 @@ static void sii8620_start_video(struct s + int clk = ctx->pixel_clock * (ctx->use_packed_pixel ? 2 : 3); + int i; + +- for (i = 0; i < ARRAY_SIZE(clk_spec); ++i) ++ for (i = 0; i < ARRAY_SIZE(clk_spec) - 1; ++i) + if (clk < clk_spec[i].max_clk) + break; + diff --git a/queue-4.17/drm-exynos-decon5433-fix-per-plane-global-alpha-for-xrgb-modes.patch b/queue-4.17/drm-exynos-decon5433-fix-per-plane-global-alpha-for-xrgb-modes.patch new file mode 100644 index 00000000000..f95215f1b21 --- /dev/null +++ b/queue-4.17/drm-exynos-decon5433-fix-per-plane-global-alpha-for-xrgb-modes.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Marek Szyprowski +Date: Thu, 7 Jun 2018 13:07:40 +0200 +Subject: drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes + +From: Marek Szyprowski + +[ Upstream commit ab337fc274a1957ff0771f19e826c736253f7c39 ] + +Set per-plane global alpha to maximum value to get proper blending of +XRGB and ARGB planes. This fixes the strange order of overlapping planes. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c ++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c +@@ -351,8 +351,8 @@ static void decon_update_plane(struct ex + writel(val, ctx->addr + DECON_VIDOSDxB(win)); + } + +- val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) | +- VIDOSD_Wx_ALPHA_B_F(0x0); ++ val = VIDOSD_Wx_ALPHA_R_F(0xff) | VIDOSD_Wx_ALPHA_G_F(0xff) | ++ VIDOSD_Wx_ALPHA_B_F(0xff); + writel(val, ctx->addr + DECON_VIDOSDxC(win)); + + val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) | diff --git a/queue-4.17/drm-exynos-decon5433-fix-winconx-reset-value.patch b/queue-4.17/drm-exynos-decon5433-fix-winconx-reset-value.patch new file mode 100644 index 00000000000..bf48f35ab6c --- /dev/null +++ b/queue-4.17/drm-exynos-decon5433-fix-winconx-reset-value.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Marek Szyprowski +Date: Thu, 7 Jun 2018 13:07:49 +0200 +Subject: drm/exynos: decon5433: Fix WINCONx reset value + +From: Marek Szyprowski + +[ Upstream commit 7b7aa62c05eac9789c208b946f515983a9255d8d ] + +The only bits that should be preserved in decon_win_set_fmt() is +WINCONx_ENWIN_F. All other bits depends on the selected pixel formats and +are set by the mentioned function. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c ++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c +@@ -260,7 +260,7 @@ static void decon_win_set_pixfmt(struct + unsigned long val; + + val = readl(ctx->addr + DECON_WINCONx(win)); +- val &= ~WINCONx_BPPMODE_MASK; ++ val &= WINCONx_ENWIN_F; + + switch (fb->format->format) { + case DRM_FORMAT_XRGB1555: diff --git a/queue-4.17/drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch b/queue-4.17/drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch new file mode 100644 index 00000000000..30b1b981001 --- /dev/null +++ b/queue-4.17/drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch @@ -0,0 +1,96 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Marek Szyprowski +Date: Thu, 7 Jun 2018 13:06:13 +0200 +Subject: drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes + +From: Marek Szyprowski + +[ Upstream commit dd209ef809080ced903e7747ee3ef640c923a1d2 ] + +Fix following issues related to planar YUV pixel format configuration: +- NV16/61 modes were incorrectly programmed as NV12/21, +- YVU420 was programmed as YUV420 on source, +- YVU420 and YUV422 were programmed as YUV420 on output. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/exynos/exynos_drm_gsc.c | 29 ++++++++++++++++++++--------- + drivers/gpu/drm/exynos/regs-gsc.h | 1 + + 2 files changed, 21 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c +@@ -532,21 +532,25 @@ static int gsc_src_set_fmt(struct device + GSC_IN_CHROMA_ORDER_CRCB); + break; + case DRM_FORMAT_NV21: ++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_2P); ++ break; + case DRM_FORMAT_NV61: +- cfg |= (GSC_IN_CHROMA_ORDER_CRCB | +- GSC_IN_YUV420_2P); ++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV422_2P); + break; + case DRM_FORMAT_YUV422: + cfg |= GSC_IN_YUV422_3P; + break; + case DRM_FORMAT_YUV420: ++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_3P); ++ break; + case DRM_FORMAT_YVU420: +- cfg |= GSC_IN_YUV420_3P; ++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_3P); + break; + case DRM_FORMAT_NV12: ++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_2P); ++ break; + case DRM_FORMAT_NV16: +- cfg |= (GSC_IN_CHROMA_ORDER_CBCR | +- GSC_IN_YUV420_2P); ++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV422_2P); + break; + default: + dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt); +@@ -806,18 +810,25 @@ static int gsc_dst_set_fmt(struct device + GSC_OUT_CHROMA_ORDER_CRCB); + break; + case DRM_FORMAT_NV21: +- case DRM_FORMAT_NV61: + cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_2P); + break; ++ case DRM_FORMAT_NV61: ++ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV422_2P); ++ break; + case DRM_FORMAT_YUV422: ++ cfg |= GSC_OUT_YUV422_3P; ++ break; + case DRM_FORMAT_YUV420: ++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_3P); ++ break; + case DRM_FORMAT_YVU420: +- cfg |= GSC_OUT_YUV420_3P; ++ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_3P); + break; + case DRM_FORMAT_NV12: ++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_2P); ++ break; + case DRM_FORMAT_NV16: +- cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | +- GSC_OUT_YUV420_2P); ++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV422_2P); + break; + default: + dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt); +--- a/drivers/gpu/drm/exynos/regs-gsc.h ++++ b/drivers/gpu/drm/exynos/regs-gsc.h +@@ -138,6 +138,7 @@ + #define GSC_OUT_YUV420_3P (3 << 4) + #define GSC_OUT_YUV422_1P (4 << 4) + #define GSC_OUT_YUV422_2P (5 << 4) ++#define GSC_OUT_YUV422_3P (6 << 4) + #define GSC_OUT_YUV444 (7 << 4) + #define GSC_OUT_TILE_TYPE_MASK (1 << 2) + #define GSC_OUT_TILE_C_16x8 (0 << 2) diff --git a/queue-4.17/drm-mali-dp-enable-global-se-interrupts-mask-for-dp500.patch b/queue-4.17/drm-mali-dp-enable-global-se-interrupts-mask-for-dp500.patch new file mode 100644 index 00000000000..2c3dca783bf --- /dev/null +++ b/queue-4.17/drm-mali-dp-enable-global-se-interrupts-mask-for-dp500.patch @@ -0,0 +1,35 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Alison Wang +Date: Tue, 24 Apr 2018 10:42:32 +0800 +Subject: drm: mali-dp: Enable Global SE interrupts mask for DP500 + +From: Alison Wang + +[ Upstream commit 89610dc2c235e7b02bb9fba0ce247e12d4dde7cd ] + +In the situation that DE and SE aren’t shared the same interrupt number, +the Global SE interrupts mask bit MASK_IRQ_EN in MASKIRQ must be set, or +else other mask bits will not work and no SE interrupt will occur. This +patch enables MASK_IRQ_EN for SE to fix this problem. + +Signed-off-by: Alison Wang +Acked-by: Liviu Dudau +Signed-off-by: Liviu Dudau +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/arm/malidp_hw.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/arm/malidp_hw.c ++++ b/drivers/gpu/drm/arm/malidp_hw.c +@@ -634,7 +634,8 @@ const struct malidp_hw malidp_device[MAL + .vsync_irq = MALIDP500_DE_IRQ_VSYNC, + }, + .se_irq_map = { +- .irq_mask = MALIDP500_SE_IRQ_CONF_MODE, ++ .irq_mask = MALIDP500_SE_IRQ_CONF_MODE | ++ MALIDP500_SE_IRQ_GLOBAL, + .vsync_irq = 0, + }, + .dc_irq_map = { diff --git a/queue-4.17/drm-mali-dp-rectify-the-width-and-height-passed-to-rotmem_required.patch b/queue-4.17/drm-mali-dp-rectify-the-width-and-height-passed-to-rotmem_required.patch new file mode 100644 index 00000000000..9cb2594faf6 --- /dev/null +++ b/queue-4.17/drm-mali-dp-rectify-the-width-and-height-passed-to-rotmem_required.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Ayan Kumar Halder +Date: Mon, 18 Jun 2018 18:08:43 +0100 +Subject: drm/mali-dp: Rectify the width and height passed to rotmem_required() + +From: Ayan Kumar Halder + +[ Upstream commit c6cf387ec56c19028333274747bbb4ae145a2d13 ] + +The width and height needs to be swapped + +Signed-off-by: Ayan Kumar halder +Reviewed-by: Brian Starkey +Reviewed-by: Alexandru Gheorghe +Acked-by: Liviu Dudau +[rebased on top of v4.18-rc1] +Signed-off-by: Liviu Dudau +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/arm/malidp_planes.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/arm/malidp_planes.c ++++ b/drivers/gpu/drm/arm/malidp_planes.c +@@ -236,8 +236,8 @@ static int malidp_de_plane_check(struct + if (state->rotation & MALIDP_ROTATED_MASK) { + int val; + +- val = mp->hwdev->hw->rotmem_required(mp->hwdev, state->crtc_h, +- state->crtc_w, ++ val = mp->hwdev->hw->rotmem_required(mp->hwdev, state->crtc_w, ++ state->crtc_h, + fb->format->format); + if (val < 0) + return val; diff --git a/queue-4.17/drm-nouveau-gem-off-by-one-bugs-in-nouveau_gem_pushbuf_reloc_apply.patch b/queue-4.17/drm-nouveau-gem-off-by-one-bugs-in-nouveau_gem_pushbuf_reloc_apply.patch new file mode 100644 index 00000000000..5f3d23f0f8c --- /dev/null +++ b/queue-4.17/drm-nouveau-gem-off-by-one-bugs-in-nouveau_gem_pushbuf_reloc_apply.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dan Carpenter +Date: Tue, 3 Jul 2018 15:30:56 +0300 +Subject: drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply() + +From: Dan Carpenter + +[ Upstream commit 7f073d011f93e92d4d225526b9ab6b8b0bbd6613 ] + +The bo array has req->nr_buffers elements so the > should be >= so we +don't read beyond the end of the array. + +Fixes: a1606a9596e5 ("drm/nouveau: new gem pushbuf interface, bump to 0.0.16") +Signed-off-by: Dan Carpenter +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nouveau_gem.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_gem.c ++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c +@@ -617,7 +617,7 @@ nouveau_gem_pushbuf_reloc_apply(struct n + struct nouveau_bo *nvbo; + uint32_t data; + +- if (unlikely(r->bo_index > req->nr_buffers)) { ++ if (unlikely(r->bo_index >= req->nr_buffers)) { + NV_PRINTK(err, cli, "reloc bo index invalid\n"); + ret = -EINVAL; + break; +@@ -627,7 +627,7 @@ nouveau_gem_pushbuf_reloc_apply(struct n + if (b->presumed.valid) + continue; + +- if (unlikely(r->reloc_bo_index > req->nr_buffers)) { ++ if (unlikely(r->reloc_bo_index >= req->nr_buffers)) { + NV_PRINTK(err, cli, "reloc container bo index invalid\n"); + ret = -EINVAL; + break; diff --git a/queue-4.17/drm-sun4i-link-in-front-end-code-if-needed.patch b/queue-4.17/drm-sun4i-link-in-front-end-code-if-needed.patch new file mode 100644 index 00000000000..7d98d31449d --- /dev/null +++ b/queue-4.17/drm-sun4i-link-in-front-end-code-if-needed.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Arnd Bergmann +Date: Fri, 6 Jul 2018 16:28:28 +0200 +Subject: drm/sun4i: link in front-end code if needed + +From: Arnd Bergmann + +[ Upstream commit 3156b53c2e2fadafa1a16412a8791b38f94b5bdc ] + +When the base sun4i DRM driver is built-in but the back-end is +a loadable module, we run into a link error: + +drivers/gpu/drm/sun4i/sun4i_drv.o: In function `sun4i_drv_probe': +sun4i_drv.c:(.text+0x60c): undefined reference to `sun4i_frontend_of_table' + +The dependency is a bit tricky, the best workaround I have come up +with is to use a Makefile hack to to interpret both +CONFIG_DRM_SUN4I_BACKEND=m and CONFIG_DRM_SUN4I_BACKEND=y +as a directive to build the front-end the same way as the main module. + +Fixes: dd0421f47505 ("drm/sun4i: Add a driver for the display frontend") +Link: https://lore.kernel.org/lkml/20180301091908.zcptz3ezqr2c6ly5@flea/ +Signed-off-by: Arnd Bergmann +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20180706142847.2032381-1-arnd@arndb.de +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/sun4i/Makefile | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/sun4i/Makefile ++++ b/drivers/gpu/drm/sun4i/Makefile +@@ -29,7 +29,10 @@ obj-$(CONFIG_DRM_SUN4I) += sun4i-tcon.o + obj-$(CONFIG_DRM_SUN4I) += sun4i_tv.o + obj-$(CONFIG_DRM_SUN4I) += sun6i_drc.o + +-obj-$(CONFIG_DRM_SUN4I_BACKEND) += sun4i-backend.o sun4i-frontend.o ++obj-$(CONFIG_DRM_SUN4I_BACKEND) += sun4i-backend.o ++ifdef CONFIG_DRM_SUN4I_BACKEND ++obj-$(CONFIG_DRM_SUN4I) += sun4i-frontend.o ++endif + obj-$(CONFIG_DRM_SUN4I_HDMI) += sun4i-drm-hdmi.o + obj-$(CONFIG_DRM_SUN8I_DW_HDMI) += sun8i-drm-hdmi.o + obj-$(CONFIG_DRM_SUN8I_MIXER) += sun8i-mixer.o diff --git a/queue-4.17/drm-tegra-fix-comparison-operator-for-buffer-size.patch b/queue-4.17/drm-tegra-fix-comparison-operator-for-buffer-size.patch new file mode 100644 index 00000000000..9b621b682df --- /dev/null +++ b/queue-4.17/drm-tegra-fix-comparison-operator-for-buffer-size.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Mikko Perttunen +Date: Wed, 20 Jun 2018 16:03:58 +0300 +Subject: drm/tegra: Fix comparison operator for buffer size + +From: Mikko Perttunen + +[ Upstream commit 5265f0338bc0feec6c0d544dfe005dec1a93cb93 ] + +Here we are checking for the buffer length, not an offset for writing +to, so using > is correct. The current code incorrectly rejects a +command buffer ending at the memory buffer's end. + +Signed-off-by: Mikko Perttunen +Reviewed-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/tegra/drm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/tegra/drm.c ++++ b/drivers/gpu/drm/tegra/drm.c +@@ -436,7 +436,7 @@ int tegra_drm_submit(struct tegra_drm_co + * unaligned offset is malformed and cause commands stream + * corruption on the buffer address relocation. + */ +- if (offset & 3 || offset >= obj->gem.size) { ++ if (offset & 3 || offset > obj->gem.size) { + err = -EINVAL; + goto fail; + } diff --git a/queue-4.17/dwc2-gadget-fix-isoc-in-ddma-pid-bitfield-value-calculation.patch b/queue-4.17/dwc2-gadget-fix-isoc-in-ddma-pid-bitfield-value-calculation.patch new file mode 100644 index 00000000000..083d2f181da --- /dev/null +++ b/queue-4.17/dwc2-gadget-fix-isoc-in-ddma-pid-bitfield-value-calculation.patch @@ -0,0 +1,44 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Minas Harutyunyan +Date: Wed, 23 May 2018 16:24:44 +0400 +Subject: dwc2: gadget: Fix ISOC IN DDMA PID bitfield value calculation + +From: Minas Harutyunyan + +[ Upstream commit 1d8e5c00275825fc42aaa5597dab1d0b5b26bb64 ] + +PID bitfield in descriptor should be set based on particular request +length, not based on EP's mc value. PID value can't be set to 0 even +request length is 0. + +Signed-off-by: Minas Harutyunyan +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/gadget.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -808,6 +808,7 @@ static int dwc2_gadget_fill_isoc_desc(st + u32 index; + u32 maxsize = 0; + u32 mask = 0; ++ u8 pid = 0; + + maxsize = dwc2_gadget_get_desc_params(hs_ep, &mask); + if (len > maxsize) { +@@ -853,7 +854,11 @@ static int dwc2_gadget_fill_isoc_desc(st + ((len << DEV_DMA_NBYTES_SHIFT) & mask)); + + if (hs_ep->dir_in) { +- desc->status |= ((hs_ep->mc << DEV_DMA_ISOC_PID_SHIFT) & ++ if (len) ++ pid = DIV_ROUND_UP(len, hs_ep->ep.maxpacket); ++ else ++ pid = 1; ++ desc->status |= ((pid << DEV_DMA_ISOC_PID_SHIFT) & + DEV_DMA_ISOC_PID_MASK) | + ((len % hs_ep->ep.maxpacket) ? + DEV_DMA_SHORT : 0) | diff --git a/queue-4.17/edac-add-missing-mem_lrddr4-entry-in-edac_mem_types.patch b/queue-4.17/edac-add-missing-mem_lrddr4-entry-in-edac_mem_types.patch new file mode 100644 index 00000000000..3eb241b7204 --- /dev/null +++ b/queue-4.17/edac-add-missing-mem_lrddr4-entry-in-edac_mem_types.patch @@ -0,0 +1,36 @@ +From b748f2de4b2f578599f46c6000683a8da755bf68 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 10 Aug 2018 16:14:26 +0200 +Subject: EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[] + +From: Takashi Iwai + +commit b748f2de4b2f578599f46c6000683a8da755bf68 upstream. + +The edac_mem_types[] array misses a MEM_LRDDR4 entry, which leads to +NULL pointer dereference when accessed via sysfs or such. + +Signed-off-by: Takashi Iwai +Cc: Mauro Carvalho Chehab +Cc: Yazen Ghannam +Cc: linux-edac +Cc: +Link: http://lkml.kernel.org/r/20180810141426.8918-1-tiwai@suse.de +Fixes: 1e8096bb2031 ("EDAC: Add LRDDR4 DRAM type") +Signed-off-by: Borislav Petkov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/edac_mc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/edac/edac_mc.c ++++ b/drivers/edac/edac_mc.c +@@ -215,6 +215,7 @@ const char * const edac_mem_types[] = { + [MEM_LRDDR3] = "Load-Reduced-DDR3-RAM", + [MEM_DDR4] = "Unbuffered-DDR4", + [MEM_RDDR4] = "Registered-DDR4", ++ [MEM_LRDDR4] = "Load-Reduced-DDR4-RAM", + [MEM_NVDIMM] = "Non-volatile-RAM", + }; + EXPORT_SYMBOL_GPL(edac_mem_types); diff --git a/queue-4.17/enic-initialize-enic-rfs_h.lock-in-enic_probe.patch b/queue-4.17/enic-initialize-enic-rfs_h.lock-in-enic_probe.patch new file mode 100644 index 00000000000..b04ee4ad81b --- /dev/null +++ b/queue-4.17/enic-initialize-enic-rfs_h.lock-in-enic_probe.patch @@ -0,0 +1,98 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Govindarajulu Varadarajan +Date: Tue, 19 Jun 2018 08:15:24 -0700 +Subject: enic: initialize enic->rfs_h.lock in enic_probe + +From: Govindarajulu Varadarajan + +[ Upstream commit 3256d29fc7aecdf99feb1cb9475ed2252769a8a7 ] + +lockdep spotted that we are using rfs_h.lock in enic_get_rxnfc() without +initializing. rfs_h.lock is initialized in enic_open(). But ethtool_ops +can be called when interface is down. + +Move enic_rfs_flw_tbl_init to enic_probe. + +INFO: trying to register non-static key. +the code is fine but needs lockdep annotation. +turning off the locking correctness validator. +CPU: 18 PID: 1189 Comm: ethtool Not tainted 4.17.0-rc7-devel+ #27 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014 +Call Trace: +dump_stack+0x85/0xc0 +register_lock_class+0x550/0x560 +? __handle_mm_fault+0xa8b/0x1100 +__lock_acquire+0x81/0x670 +lock_acquire+0xb9/0x1e0 +? enic_get_rxnfc+0x139/0x2b0 [enic] +_raw_spin_lock_bh+0x38/0x80 +? enic_get_rxnfc+0x139/0x2b0 [enic] +enic_get_rxnfc+0x139/0x2b0 [enic] +ethtool_get_rxnfc+0x8d/0x1c0 +dev_ethtool+0x16c8/0x2400 +? __mutex_lock+0x64d/0xa00 +? dev_load+0x6a/0x150 +dev_ioctl+0x253/0x4b0 +sock_do_ioctl+0x9a/0x130 +sock_ioctl+0x1af/0x350 +do_vfs_ioctl+0x8e/0x670 +? syscall_trace_enter+0x1e2/0x380 +ksys_ioctl+0x60/0x90 +__x64_sys_ioctl+0x16/0x20 +do_syscall_64+0x5a/0x170 +entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Signed-off-by: Govindarajulu Varadarajan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cisco/enic/enic_clsf.c | 3 +-- + drivers/net/ethernet/cisco/enic/enic_main.c | 3 ++- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c ++++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c +@@ -79,7 +79,6 @@ void enic_rfs_flw_tbl_init(struct enic * + enic->rfs_h.max = enic->config.num_arfs; + enic->rfs_h.free = enic->rfs_h.max; + enic->rfs_h.toclean = 0; +- enic_rfs_timer_start(enic); + } + + void enic_rfs_flw_tbl_free(struct enic *enic) +@@ -88,7 +87,6 @@ void enic_rfs_flw_tbl_free(struct enic * + + enic_rfs_timer_stop(enic); + spin_lock_bh(&enic->rfs_h.lock); +- enic->rfs_h.free = 0; + for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) { + struct hlist_head *hhead; + struct hlist_node *tmp; +@@ -99,6 +97,7 @@ void enic_rfs_flw_tbl_free(struct enic * + enic_delfltr(enic, n->fltr_id); + hlist_del(&n->node); + kfree(n); ++ enic->rfs_h.free++; + } + } + spin_unlock_bh(&enic->rfs_h.lock); +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -1971,7 +1971,7 @@ static int enic_open(struct net_device * + vnic_intr_unmask(&enic->intr[i]); + + enic_notify_timer_start(enic); +- enic_rfs_flw_tbl_init(enic); ++ enic_rfs_timer_start(enic); + + return 0; + +@@ -2895,6 +2895,7 @@ static int enic_probe(struct pci_dev *pd + + timer_setup(&enic->notify_timer, enic_notify_timer, 0); + ++ enic_rfs_flw_tbl_init(enic); + enic_set_rx_coal_setting(enic); + INIT_WORK(&enic->reset, enic_reset); + INIT_WORK(&enic->tx_hang_reset, enic_tx_hang_reset); diff --git a/queue-4.17/fsl-fman-fix-parser-reporting-bad-checksum-on-short-frames.patch b/queue-4.17/fsl-fman-fix-parser-reporting-bad-checksum-on-short-frames.patch new file mode 100644 index 00000000000..64cb816c8c4 --- /dev/null +++ b/queue-4.17/fsl-fman-fix-parser-reporting-bad-checksum-on-short-frames.patch @@ -0,0 +1,46 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Madalin Bucur +Date: Thu, 28 Jun 2018 15:26:50 +0300 +Subject: fsl/fman: fix parser reporting bad checksum on short frames + +From: Madalin Bucur + +[ Upstream commit b95f6fbc8e15803a596ca5e5e21008fba29694c6 ] + +The FMan hardware parser needs to be configured to remove the +short frame padding from the checksum calculation, otherwise +short UDP and TCP frames are likely to be marked as having a +bad checksum. + +Signed-off-by: Madalin Bucur +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/fman/fman_port.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/net/ethernet/freescale/fman/fman_port.c ++++ b/drivers/net/ethernet/freescale/fman/fman_port.c +@@ -324,6 +324,10 @@ struct fman_port_qmi_regs { + #define HWP_HXS_PHE_REPORT 0x00000800 + #define HWP_HXS_PCAC_PSTAT 0x00000100 + #define HWP_HXS_PCAC_PSTOP 0x00000001 ++#define HWP_HXS_TCP_OFFSET 0xA ++#define HWP_HXS_UDP_OFFSET 0xB ++#define HWP_HXS_SH_PAD_REM 0x80000000 ++ + struct fman_port_hwp_regs { + struct { + u32 ssa; /* Soft Sequence Attachment */ +@@ -728,6 +732,10 @@ static void init_hwp(struct fman_port *p + iowrite32be(0xffffffff, ®s->pmda[i].lcv); + } + ++ /* Short packet padding removal from checksum calculation */ ++ iowrite32be(HWP_HXS_SH_PAD_REM, ®s->pmda[HWP_HXS_TCP_OFFSET].ssa); ++ iowrite32be(HWP_HXS_SH_PAD_REM, ®s->pmda[HWP_HXS_UDP_OFFSET].ssa); ++ + start_port_hwp(port); + } + diff --git a/queue-4.17/gpu-host1x-check-whether-size-of-unpin-isn-t-0.patch b/queue-4.17/gpu-host1x-check-whether-size-of-unpin-isn-t-0.patch new file mode 100644 index 00000000000..93acbc83402 --- /dev/null +++ b/queue-4.17/gpu-host1x-check-whether-size-of-unpin-isn-t-0.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dmitry Osipenko +Date: Fri, 6 Jul 2018 21:02:36 +0300 +Subject: gpu: host1x: Check whether size of unpin isn't 0 + +From: Dmitry Osipenko + +[ Upstream commit ec58923215dbbeef59ee82923ee94d745f73db58 ] + +Only gather pins are mapped by the Host1x driver, regular BO relocations +are not. Check whether size of unpin isn't 0, otherwise IOVA allocation at +0x0 could be erroneously released. + +Signed-off-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/host1x/job.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/host1x/job.c ++++ b/drivers/gpu/host1x/job.c +@@ -686,7 +686,8 @@ void host1x_job_unpin(struct host1x_job + for (i = 0; i < job->num_unpins; i++) { + struct host1x_job_unpin_data *unpin = &job->unpins[i]; + +- if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && host->domain) { ++ if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && ++ unpin->size && host->domain) { + iommu_unmap(host->domain, job->addr_phys[i], + unpin->size); + free_iova(&host->iova, diff --git a/queue-4.17/gpu-host1x-skip-iommu-initialization-if-firewall-is-enabled.patch b/queue-4.17/gpu-host1x-skip-iommu-initialization-if-firewall-is-enabled.patch new file mode 100644 index 00000000000..dfe53ab79b7 --- /dev/null +++ b/queue-4.17/gpu-host1x-skip-iommu-initialization-if-firewall-is-enabled.patch @@ -0,0 +1,35 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dmitry Osipenko +Date: Sat, 19 May 2018 04:07:10 +0300 +Subject: gpu: host1x: Skip IOMMU initialization if firewall is enabled + +From: Dmitry Osipenko + +[ Upstream commit 4466b1f0e022f94a026bd700fee34bff15cdc4ef ] + +Host1x's CDMA can't access the command buffers if IOMMU and Host1x +firewall are enabled in the kernels config because firewall doesn't map +the copied buffer into IOVA space. Fix this by skipping IOMMU +initialization if firewall is enabled as firewall merges sparse cmdbufs +into a single contiguous buffer and hence IOMMU isn't needed in this case. + +Signed-off-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/host1x/dev.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/host1x/dev.c ++++ b/drivers/gpu/host1x/dev.c +@@ -218,6 +218,9 @@ static int host1x_probe(struct platform_ + return err; + } + ++ if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) ++ goto skip_iommu; ++ + host->group = iommu_group_get(&pdev->dev); + if (host->group) { + struct iommu_domain_geometry *geometry; diff --git a/queue-4.17/hid-google-add-support-for-whiskers.patch b/queue-4.17/hid-google-add-support-for-whiskers.patch new file mode 100644 index 00000000000..e0afa7ae3ff --- /dev/null +++ b/queue-4.17/hid-google-add-support-for-whiskers.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Nicolas Boichat +Date: Fri, 8 Jun 2018 08:14:50 +0800 +Subject: HID: google: Add support for whiskers + +From: Nicolas Boichat + +[ Upstream commit 3e84c7651dde7cca43c5cfd7385086599cce5a5d ] + +Another device in the hammer class, with USB id 0x5030. + +Signed-off-by: Nicolas Boichat +Acked-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-google-hammer.c | 2 ++ + drivers/hid/hid-ids.h | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/hid/hid-google-hammer.c ++++ b/drivers/hid/hid-google-hammer.c +@@ -124,6 +124,8 @@ static const struct hid_device_id hammer + USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_STAFF) }, + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_WAND) }, ++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, ++ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_WHISKERS) }, + { } + }; + MODULE_DEVICE_TABLE(hid, hammer_devices); +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -452,6 +452,7 @@ + #define USB_DEVICE_ID_GOOGLE_TOUCH_ROSE 0x5028 + #define USB_DEVICE_ID_GOOGLE_STAFF 0x502b + #define USB_DEVICE_ID_GOOGLE_WAND 0x502d ++#define USB_DEVICE_ID_GOOGLE_WHISKERS 0x5030 + + #define USB_VENDOR_ID_GOTOP 0x08f2 + #define USB_DEVICE_ID_SUPER_Q2 0x007f diff --git a/queue-4.17/hid-wacom-correct-touch-maximum-xy-of-2nd-gen-intuos.patch b/queue-4.17/hid-wacom-correct-touch-maximum-xy-of-2nd-gen-intuos.patch new file mode 100644 index 00000000000..995a55820d5 --- /dev/null +++ b/queue-4.17/hid-wacom-correct-touch-maximum-xy-of-2nd-gen-intuos.patch @@ -0,0 +1,47 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jason Gerecke +Date: Tue, 26 Jun 2018 09:58:02 -0700 +Subject: HID: wacom: Correct touch maximum XY of 2nd-gen Intuos + +From: Jason Gerecke + +[ Upstream commit 3b8d573586d1b9dee33edf6cb6f2ca05f4bca568 ] + +The touch sensors on the 2nd-gen Intuos tablets don't use a 4096x4096 +sensor like other similar tablets (3rd-gen Bamboo, Intuos5, etc.). +The incorrect maximum XY values don't normally affect userspace since +touch input from these devices is typically relative rather than +absolute. It does, however, cause problems when absolute distances +need to be measured, e.g. for gesture recognition. Since the resolution +of the touch sensor on these devices is 10 units / mm (versus 100 for +the pen sensor), the proper maximum values can be calculated by simply +dividing by 10. + +Fixes: b5fd2a3e92 ("Input: wacom - add support for three new Intuos devices") +Signed-off-by: Jason Gerecke +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/wacom_wac.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -3361,8 +3361,14 @@ void wacom_setup_device_quirks(struct wa + if (features->type >= INTUOSHT && features->type <= BAMBOO_PT) + features->device_type |= WACOM_DEVICETYPE_PAD; + +- features->x_max = 4096; +- features->y_max = 4096; ++ if (features->type == INTUOSHT2) { ++ features->x_max = features->x_max / 10; ++ features->y_max = features->y_max / 10; ++ } ++ else { ++ features->x_max = 4096; ++ features->y_max = 4096; ++ } + } + else if (features->pktlen == WACOM_PKGLEN_BBTOUCH) { + features->device_type |= WACOM_DEVICETYPE_PAD; diff --git a/queue-4.17/hv-netvsc-fix-handling-of-fallback-to-single-queue-mode.patch b/queue-4.17/hv-netvsc-fix-handling-of-fallback-to-single-queue-mode.patch new file mode 100644 index 00000000000..040fb91d717 --- /dev/null +++ b/queue-4.17/hv-netvsc-fix-handling-of-fallback-to-single-queue-mode.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Stephen Hemminger +Date: Fri, 13 Jul 2018 10:38:38 -0700 +Subject: hv/netvsc: fix handling of fallback to single queue mode + +From: Stephen Hemminger + +[ Upstream commit 916c5e1413be058d1c1f6e502db350df890730ce ] + +The netvsc device may need to fallback to running in single queue +mode if host side only wants to support single queue. + +Recent change for handling mtu broke this in setup logic. + +Reported-by: Dan Carpenter +Fixes: 3ffe64f1a641 ("hv_netvsc: split sub-channel setup into async and sync") +Signed-off-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/hyperv/rndis_filter.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -1307,6 +1307,7 @@ out: + /* setting up multiple channels failed */ + net_device->max_chn = 1; + net_device->num_chn = 1; ++ return 0; + + err_dev_remv: + rndis_filter_device_remove(dev, net_device); diff --git a/queue-4.17/hwmon-dell-smm-disable-fan-support-for-dell-xps13-9333.patch b/queue-4.17/hwmon-dell-smm-disable-fan-support-for-dell-xps13-9333.patch new file mode 100644 index 00000000000..4f0e7c52d66 --- /dev/null +++ b/queue-4.17/hwmon-dell-smm-disable-fan-support-for-dell-xps13-9333.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Helge Eichelberg +Date: Tue, 5 Jun 2018 19:38:32 +0200 +Subject: hwmon: (dell-smm) Disable fan support for Dell XPS13 9333 + +From: Helge Eichelberg + +[ Upstream commit 536e0019b7da4eb3badb4da5acbb70ae29e1b5ef ] + +Calling fan related SMM functions implemented by Dell BIOS firmware on Dell +XPS13 9333 freeze kernel for about 500ms. Until Dell fixes it we need to +disable fan support for Dell XPS13 9333. + +Via "force" module param fan support can be enabled. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=195751 +Signed-off-by: Helge Eichelberg +Reviewed-by: Pali Rohár +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/dell-smm-hwmon.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/hwmon/dell-smm-hwmon.c ++++ b/drivers/hwmon/dell-smm-hwmon.c +@@ -1074,6 +1074,13 @@ static struct dmi_system_id i8k_blacklis + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Vostro 3360"), + }, + }, ++ { ++ .ident = "Dell XPS13 9333", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "XPS13 9333"), ++ }, ++ }, + { } + }; + diff --git a/queue-4.17/hwmon-nct6775-fix-loop-limit.patch b/queue-4.17/hwmon-nct6775-fix-loop-limit.patch new file mode 100644 index 00000000000..3cab1917b47 --- /dev/null +++ b/queue-4.17/hwmon-nct6775-fix-loop-limit.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Guenter Roeck +Date: Tue, 12 Jun 2018 15:19:35 -0700 +Subject: hwmon: (nct6775) Fix loop limit + +From: Guenter Roeck + +[ Upstream commit 91bb8f45f73f19a0150c233c0f11cdeb6d71d1e9 ] + +Commit cc66b3038254 ("hwmon: (nct6775) Rework temperature source and label +handling") changed a loop limit from "data->temp_label_num - 1" to "32", +as part of moving from a string array to a bit mask. This results in the +following error, reported by UBSAN. + +UBSAN: Undefined behaviour in drivers/hwmon/nct6775.c:4179:27 +shift exponent 32 is too large for 32-bit type 'long unsigned int' + +Similar to the original loop, the limit has to be one less than the +number of bits. + +Fixes: cc66b3038254 ("hwmon: (nct6775) Rework temperature source and label handling") +Reported-by: Paul Menzel +Cc: Paul Menzel +Tested-by: Paul Menzel +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/nct6775.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/nct6775.c ++++ b/drivers/hwmon/nct6775.c +@@ -4175,7 +4175,7 @@ static int nct6775_probe(struct platform + * The temperature is already monitored if the respective bit in + * is set. + */ +- for (i = 0; i < 32; i++) { ++ for (i = 0; i < 31; i++) { + if (!(data->temp_mask & BIT(i + 1))) + continue; + if (!reg_temp_alternate[i]) diff --git a/queue-4.17/ib-mlx4-fix-an-error-handling-path-in-mlx4_ib_rereg_user_mr.patch b/queue-4.17/ib-mlx4-fix-an-error-handling-path-in-mlx4_ib_rereg_user_mr.patch new file mode 100644 index 00000000000..9b15829ee79 --- /dev/null +++ b/queue-4.17/ib-mlx4-fix-an-error-handling-path-in-mlx4_ib_rereg_user_mr.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Christophe Jaillet +Date: Mon, 11 Jun 2018 20:15:11 +0200 +Subject: IB/mlx4: Fix an error handling path in 'mlx4_ib_rereg_user_mr()' + +From: Christophe Jaillet + +[ Upstream commit 3dc7c7badb7502ec3e3aa817a8bdd9e53aa54c52 ] + +Before returning -EPERM we should release some resources, as already done +in the other error handling path of the function. + +Fixes: d8f9cc328c88 ("IB/mlx4: Mark user MR as writable if actual virtual memory is writable") +Signed-off-by: Christophe JAILLET +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/mlx4/mr.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -486,8 +486,11 @@ int mlx4_ib_rereg_user_mr(struct ib_mr * + } + + if (flags & IB_MR_REREG_ACCESS) { +- if (ib_access_writable(mr_access_flags) && !mmr->umem->writable) +- return -EPERM; ++ if (ib_access_writable(mr_access_flags) && ++ !mmr->umem->writable) { ++ err = -EPERM; ++ goto release_mpt_entry; ++ } + + err = mlx4_mr_hw_change_access(dev->dev, *pmpt_entry, + convert_access(mr_access_flags)); diff --git a/queue-4.17/ib-rxe-avoid-double-kfree-skb.patch b/queue-4.17/ib-rxe-avoid-double-kfree-skb.patch new file mode 100644 index 00000000000..c748607889a --- /dev/null +++ b/queue-4.17/ib-rxe-avoid-double-kfree-skb.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Zhu Yanjun +Date: Thu, 7 Jun 2018 02:32:52 -0400 +Subject: IB/rxe: avoid double kfree skb + +From: Zhu Yanjun + +[ Upstream commit 828d810550abc1fffff9b20545fec4bc150d5e82 ] + +In rxe_send, when network_type is not RDMA_NETWORK_IPV4 or +RDMA_NETWORK_IPV6, skb is freed and -EINVAL is returned. +Then rxe_xmit_packet will return -EINVAL, too. In rxe_requester, +this skb is double freed. +In rxe_requester, kfree_skb is needed only after fill_packet fails. +So kfree_skb is moved from label err to test fill_packet. + +Fixes: 5793b4652155 ("IB/rxe: remove unnecessary skb_clone in xmit") +Reported-by: Dan Carpenter +Signed-off-by: Zhu Yanjun +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/sw/rxe/rxe_req.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -709,6 +709,7 @@ next_wqe: + + if (fill_packet(qp, wqe, &pkt, skb, payload)) { + pr_debug("qp#%d Error during fill packet\n", qp_num(qp)); ++ kfree_skb(skb); + goto err; + } + +@@ -740,7 +741,6 @@ next_wqe: + goto next_wqe; + + err: +- kfree_skb(skb); + wqe->status = IB_WC_LOC_PROT_ERR; + wqe->state = wqe_state_error; + __rxe_do_task(&qp->comp.task); diff --git a/queue-4.17/ib-rxe-fix-missing-completion-for-mem_reg-work-requests.patch b/queue-4.17/ib-rxe-fix-missing-completion-for-mem_reg-work-requests.patch new file mode 100644 index 00000000000..dcde2455425 --- /dev/null +++ b/queue-4.17/ib-rxe-fix-missing-completion-for-mem_reg-work-requests.patch @@ -0,0 +1,35 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Vijay Immanuel +Date: Tue, 12 Jun 2018 18:16:05 -0700 +Subject: IB/rxe: Fix missing completion for mem_reg work requests + +From: Vijay Immanuel + +[ Upstream commit 375dc53d032fc11e98036b5f228ad13f7c5933f5 ] + +Run the completer task to post a work completion after processing +a memory registration or invalidate work request. This covers the +case where the memory registration or invalidate was the last work +request posted to the qp. + +Signed-off-by: Vijay Immanuel +Reviewed-by: Yonatan Cohen +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/sw/rxe/rxe_req.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -645,6 +645,9 @@ next_wqe: + } else { + goto exit; + } ++ if ((wqe->wr.send_flags & IB_SEND_SIGNALED) || ++ qp->sq_sig_type == IB_SIGNAL_ALL_WR) ++ rxe_run_task(&qp->comp.task, 1); + qp->req.wqe_index = next_index(qp->sq.queue, + qp->req.wqe_index); + goto next_wqe; diff --git a/queue-4.17/ibmvnic-fix-error-recovery-on-login-failure.patch b/queue-4.17/ibmvnic-fix-error-recovery-on-login-failure.patch new file mode 100644 index 00000000000..9f5607e326d --- /dev/null +++ b/queue-4.17/ibmvnic-fix-error-recovery-on-login-failure.patch @@ -0,0 +1,40 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: John Allen +Date: Mon, 16 Jul 2018 10:29:30 -0500 +Subject: ibmvnic: Fix error recovery on login failure + +From: John Allen + +[ Upstream commit 3578a7ecb69920efc3885dbd610e98c00dbdf5db ] + +Testing has uncovered a failure case that is not handled properly. In the +event that a login fails and we are not able to recover on the spot, we +return 0 from do_reset, preventing any error recovery code from being +triggered. Additionally, the state is set to "probed" meaning that when we +are able to trigger the error recovery, the driver always comes up in the +probed state. To handle the case properly, we need to return a failure code +here and set the adapter state to the state that we entered the reset in +indicating the state that we would like to come out of the recovery reset +in. + +Signed-off-by: John Allen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ibm/ibmvnic.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1801,8 +1801,8 @@ static int do_reset(struct ibmvnic_adapt + + rc = ibmvnic_login(netdev); + if (rc) { +- adapter->state = VNIC_PROBED; +- return 0; ++ adapter->state = reset_state; ++ return rc; + } + + if (adapter->reset_reason == VNIC_RESET_CHANGE_PARAM || diff --git a/queue-4.17/ibmvnic-revise-rx-tx-queue-error-messages.patch b/queue-4.17/ibmvnic-revise-rx-tx-queue-error-messages.patch new file mode 100644 index 00000000000..04ba975f897 --- /dev/null +++ b/queue-4.17/ibmvnic-revise-rx-tx-queue-error-messages.patch @@ -0,0 +1,103 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Thomas Falcon +Date: Fri, 13 Jul 2018 12:03:32 -0500 +Subject: ibmvnic: Revise RX/TX queue error messages + +From: Thomas Falcon + +[ Upstream commit 2d14d3795294d42aacc278948984a480569bcc23 ] + +During a device failover, there may be latency between the loss +of the current backing device and a notification from firmware that +a failover has occurred. This latency can result in a large amount of +error printouts as firmware returns outgoing traffic with a generic +error code. These are not necessarily errors in this case as the +firmware is busy swapping in a new backing adapter and is not ready +to send packets yet. This patch reclassifies those error codes as +warnings with an explanation that a failover may be pending. All +other return codes will be considered errors. + +Signed-off-by: Thomas Falcon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ibm/ibmvnic.c | 39 +++++++++++++++++++++++++------------ + 1 file changed, 27 insertions(+), 12 deletions(-) + +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -319,7 +319,8 @@ static void replenish_rx_pool(struct ibm + return; + + failure: +- dev_info(dev, "replenish pools failure\n"); ++ if (lpar_rc != H_PARAMETER && lpar_rc != H_CLOSED) ++ dev_err_ratelimited(dev, "rx: replenish packet buffer failed\n"); + pool->free_map[pool->next_free] = index; + pool->rx_buff[index].skb = NULL; + +@@ -1594,7 +1595,8 @@ static int ibmvnic_xmit(struct sk_buff * + &tx_crq); + } + if (lpar_rc != H_SUCCESS) { +- dev_err(dev, "tx failed with code %ld\n", lpar_rc); ++ if (lpar_rc != H_CLOSED && lpar_rc != H_PARAMETER) ++ dev_err_ratelimited(dev, "tx: send failed\n"); + dev_kfree_skb_any(skb); + tx_buff->skb = NULL; + +@@ -3085,6 +3087,25 @@ static union ibmvnic_crq *ibmvnic_next_c + return crq; + } + ++static void print_subcrq_error(struct device *dev, int rc, const char *func) ++{ ++ switch (rc) { ++ case H_PARAMETER: ++ dev_warn_ratelimited(dev, ++ "%s failed: Send request is malformed or adapter failover pending. (rc=%d)\n", ++ func, rc); ++ break; ++ case H_CLOSED: ++ dev_warn_ratelimited(dev, ++ "%s failed: Backing queue closed. Adapter is down or failover pending. (rc=%d)\n", ++ func, rc); ++ break; ++ default: ++ dev_err_ratelimited(dev, "%s failed: (rc=%d)\n", func, rc); ++ break; ++ } ++} ++ + static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle, + union sub_crq *sub_crq) + { +@@ -3111,11 +3132,8 @@ static int send_subcrq(struct ibmvnic_ad + cpu_to_be64(u64_crq[2]), + cpu_to_be64(u64_crq[3])); + +- if (rc) { +- if (rc == H_CLOSED) +- dev_warn(dev, "CRQ Queue closed\n"); +- dev_err(dev, "Send error (rc=%d)\n", rc); +- } ++ if (rc) ++ print_subcrq_error(dev, rc, __func__); + + return rc; + } +@@ -3133,11 +3151,8 @@ static int send_subcrq_indirect(struct i + cpu_to_be64(remote_handle), + ioba, num_entries); + +- if (rc) { +- if (rc == H_CLOSED) +- dev_warn(dev, "CRQ Queue closed\n"); +- dev_err(dev, "Send (indirect) error (rc=%d)\n", rc); +- } ++ if (rc) ++ print_subcrq_error(dev, rc, __func__); + + return rc; + } diff --git a/queue-4.17/ieee802154-6lowpan-set-ifla_link.patch b/queue-4.17/ieee802154-6lowpan-set-ifla_link.patch new file mode 100644 index 00000000000..05d2468ef41 --- /dev/null +++ b/queue-4.17/ieee802154-6lowpan-set-ifla_link.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Lubomir Rintel +Date: Mon, 2 Jul 2018 11:21:47 +0200 +Subject: ieee802154: 6lowpan: set IFLA_LINK + +From: Lubomir Rintel + +[ Upstream commit b30c122c0bbb0a1dc413085e177ea09467e65fdb ] + +Otherwise NetworkManager (and iproute alike) is not able to identify the +parent IEEE 802.15.4 interface of a 6LoWPAN link. + +Signed-off-by: Lubomir Rintel +Acked-by: Alexander Aring +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ieee802154/6lowpan/core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/ieee802154/6lowpan/core.c ++++ b/net/ieee802154/6lowpan/core.c +@@ -90,12 +90,18 @@ static int lowpan_neigh_construct(struct + return 0; + } + ++static int lowpan_get_iflink(const struct net_device *dev) ++{ ++ return lowpan_802154_dev(dev)->wdev->ifindex; ++} ++ + static const struct net_device_ops lowpan_netdev_ops = { + .ndo_init = lowpan_dev_init, + .ndo_start_xmit = lowpan_xmit, + .ndo_open = lowpan_open, + .ndo_stop = lowpan_stop, + .ndo_neigh_construct = lowpan_neigh_construct, ++ .ndo_get_iflink = lowpan_get_iflink, + }; + + static void lowpan_setup(struct net_device *ldev) diff --git a/queue-4.17/ieee802154-at86rf230-switch-from-bug_on-to-warn_on-on-problem.patch b/queue-4.17/ieee802154-at86rf230-switch-from-bug_on-to-warn_on-on-problem.patch new file mode 100644 index 00000000000..f18b99cb0a4 --- /dev/null +++ b/queue-4.17/ieee802154-at86rf230-switch-from-bug_on-to-warn_on-on-problem.patch @@ -0,0 +1,31 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Stefan Schmidt +Date: Fri, 22 Sep 2017 14:13:53 +0200 +Subject: ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem + +From: Stefan Schmidt + +[ Upstream commit 20f330452ad8814f2289a589baf65e21270879a7 ] + +The check is valid but it does not warrant to crash the kernel. A +WARN_ON() is good enough here. +Found by checkpatch. + +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/at86rf230.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ieee802154/at86rf230.c ++++ b/drivers/net/ieee802154/at86rf230.c +@@ -940,7 +940,7 @@ at86rf230_xmit(struct ieee802154_hw *hw, + static int + at86rf230_ed(struct ieee802154_hw *hw, u8 *level) + { +- BUG_ON(!level); ++ WARN_ON(!level); + *level = 0xbe; + return 0; + } diff --git a/queue-4.17/ieee802154-at86rf230-use-__func__-macro-for-debug-messages.patch b/queue-4.17/ieee802154-at86rf230-use-__func__-macro-for-debug-messages.patch new file mode 100644 index 00000000000..834b1fc57d1 --- /dev/null +++ b/queue-4.17/ieee802154-at86rf230-use-__func__-macro-for-debug-messages.patch @@ -0,0 +1,70 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Stefan Schmidt +Date: Fri, 22 Sep 2017 14:13:54 +0200 +Subject: ieee802154: at86rf230: use __func__ macro for debug messages + +From: Stefan Schmidt + +[ Upstream commit 8a81388ec27c4c0adbdecd20e67bb5f411ab46b2 ] + +Instead of having the function name hard-coded (it might change and we +forgot to update them in the debug output) we can use __func__ instead +and also shorter the line so we do not need to break it. Also fix an +extra blank line while being here. +Found by checkpatch. + +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/at86rf230.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +--- a/drivers/net/ieee802154/at86rf230.c ++++ b/drivers/net/ieee802154/at86rf230.c +@@ -1121,8 +1121,7 @@ at86rf230_set_hw_addr_filt(struct ieee80 + if (changed & IEEE802154_AFILT_SADDR_CHANGED) { + u16 addr = le16_to_cpu(filt->short_addr); + +- dev_vdbg(&lp->spi->dev, +- "at86rf230_set_hw_addr_filt called for saddr\n"); ++ dev_vdbg(&lp->spi->dev, "%s called for saddr\n", __func__); + __at86rf230_write(lp, RG_SHORT_ADDR_0, addr); + __at86rf230_write(lp, RG_SHORT_ADDR_1, addr >> 8); + } +@@ -1130,8 +1129,7 @@ at86rf230_set_hw_addr_filt(struct ieee80 + if (changed & IEEE802154_AFILT_PANID_CHANGED) { + u16 pan = le16_to_cpu(filt->pan_id); + +- dev_vdbg(&lp->spi->dev, +- "at86rf230_set_hw_addr_filt called for pan id\n"); ++ dev_vdbg(&lp->spi->dev, "%s called for pan id\n", __func__); + __at86rf230_write(lp, RG_PAN_ID_0, pan); + __at86rf230_write(lp, RG_PAN_ID_1, pan >> 8); + } +@@ -1140,15 +1138,13 @@ at86rf230_set_hw_addr_filt(struct ieee80 + u8 i, addr[8]; + + memcpy(addr, &filt->ieee_addr, 8); +- dev_vdbg(&lp->spi->dev, +- "at86rf230_set_hw_addr_filt called for IEEE addr\n"); ++ dev_vdbg(&lp->spi->dev, "%s called for IEEE addr\n", __func__); + for (i = 0; i < 8; i++) + __at86rf230_write(lp, RG_IEEE_ADDR_0 + i, addr[i]); + } + + if (changed & IEEE802154_AFILT_PANC_CHANGED) { +- dev_vdbg(&lp->spi->dev, +- "at86rf230_set_hw_addr_filt called for panc change\n"); ++ dev_vdbg(&lp->spi->dev, "%s called for panc change\n", __func__); + if (filt->pan_coord) + at86rf230_write_subreg(lp, SR_AACK_I_AM_COORD, 1); + else +@@ -1252,7 +1248,6 @@ at86rf230_set_cca_mode(struct ieee802154 + return at86rf230_write_subreg(lp, SR_CCA_MODE, val); + } + +- + static int + at86rf230_set_cca_ed_level(struct ieee802154_hw *hw, s32 mbm) + { diff --git a/queue-4.17/ieee802154-fakelb-switch-from-bug_on-to-warn_on-on-problem.patch b/queue-4.17/ieee802154-fakelb-switch-from-bug_on-to-warn_on-on-problem.patch new file mode 100644 index 00000000000..5d65c43aed3 --- /dev/null +++ b/queue-4.17/ieee802154-fakelb-switch-from-bug_on-to-warn_on-on-problem.patch @@ -0,0 +1,31 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Stefan Schmidt +Date: Fri, 22 Sep 2017 14:14:05 +0200 +Subject: ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem + +From: Stefan Schmidt + +[ Upstream commit 8f2fbc6c60ff213369e06a73610fc882a42fdf20 ] + +The check is valid but it does not warrant to crash the kernel. A +WARN_ON() is good enough here. +Found by checkpatch. + +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/fakelb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ieee802154/fakelb.c ++++ b/drivers/net/ieee802154/fakelb.c +@@ -49,7 +49,7 @@ struct fakelb_phy { + + static int fakelb_hw_ed(struct ieee802154_hw *hw, u8 *level) + { +- BUG_ON(!level); ++ WARN_ON(!level); + *level = 0xbe; + + return 0; diff --git a/queue-4.17/ieee802154-mcr20a-add-missing-includes.patch b/queue-4.17/ieee802154-mcr20a-add-missing-includes.patch new file mode 100644 index 00000000000..016b0a48290 --- /dev/null +++ b/queue-4.17/ieee802154-mcr20a-add-missing-includes.patch @@ -0,0 +1,43 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Arnd Bergmann +Date: Wed, 30 May 2018 23:47:09 +0200 +Subject: ieee802154: mcr20a: add missing includes + +From: Arnd Bergmann + +[ Upstream commit a6032120d341badd9b034cb64411e7089d8f4285 ] + +Without CONFIG_GPIOLIB, some headers are not included implicitly, +leading to a build failure: + +drivers/net/ieee802154/mcr20a.c: In function 'mcr20a_probe': +drivers/net/ieee802154/mcr20a.c:1347:13: error: implicit declaration of function 'irq_get_trigger_type'; did you mean 'irq_get_irqchip_state'? [-Werror=implicit-function-declaration] + +This includes gpio/consumer.h and irq.h directly rather through the +gpiolib header. + +Fixes: 8c6ad9cc5157 ("ieee802154: Add NXP MCR20A IEEE 802.15.4 transceiver driver") +Signed-off-by: Arnd Bergmann +Acked-by: Xue Liu +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/mcr20a.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ieee802154/mcr20a.c ++++ b/drivers/net/ieee802154/mcr20a.c +@@ -15,10 +15,11 @@ + */ + #include + #include +-#include ++#include + #include + #include + #include ++#include + #include + #include + #include diff --git a/queue-4.17/iio-pressure-bmp280-fix-relative-humidity-unit.patch b/queue-4.17/iio-pressure-bmp280-fix-relative-humidity-unit.patch new file mode 100644 index 00000000000..125ae4946a1 --- /dev/null +++ b/queue-4.17/iio-pressure-bmp280-fix-relative-humidity-unit.patch @@ -0,0 +1,43 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Tomasz Duszynski +Date: Mon, 28 May 2018 17:38:59 +0200 +Subject: iio: pressure: bmp280: fix relative humidity unit + +From: Tomasz Duszynski + +[ Upstream commit 13399ff25f179811ce9c1df1523eb39f9e4a4772 ] + +According to IIO ABI relative humidity reading should be +returned in milli percent. + +This patch addresses that by applying proper scaling and +returning integer instead of fractional format type specifier. + +Note that the fixes tag is before the driver was heavily refactored +to introduce spi support, so the patch won't apply that far back. + +Signed-off-by: Tomasz Duszynski +Fixes: 14beaa8f5ab1 ("iio: pressure: bmp280: add humidity support") +Acked-by: Matt Ranostay +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/pressure/bmp280-core.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/iio/pressure/bmp280-core.c ++++ b/drivers/iio/pressure/bmp280-core.c +@@ -415,10 +415,9 @@ static int bmp280_read_humid(struct bmp2 + } + comp_humidity = bmp280_compensate_humidity(data, adc_humidity); + +- *val = comp_humidity; +- *val2 = 1024; ++ *val = comp_humidity * 1000 / 1024; + +- return IIO_VAL_FRACTIONAL; ++ return IIO_VAL_INT; + } + + static int bmp280_read_raw(struct iio_dev *indio_dev, diff --git a/queue-4.17/input-synaptics-rmi4-fix-axis-swap-behavior.patch b/queue-4.17/input-synaptics-rmi4-fix-axis-swap-behavior.patch new file mode 100644 index 00000000000..5ba7390df6b --- /dev/null +++ b/queue-4.17/input-synaptics-rmi4-fix-axis-swap-behavior.patch @@ -0,0 +1,106 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Lucas Stach +Date: Tue, 5 Jun 2018 10:34:54 -0700 +Subject: Input: synaptics-rmi4 - fix axis-swap behavior + +From: Lucas Stach + +[ Upstream commit 645a397d325db6e1bb36588095ae637738b37693 ] + +The documentation for the touchscreen-swapped-x-y property states that +swapping is done after inverting if both are used. RMI4 did it the other +way around, leading to inconsistent behavior with regard to other +touchscreens. + +Signed-off-by: Lucas Stach +Tested-by: Nick Dyer +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/rmi4/rmi_2d_sensor.c | 34 ++++++++++++++++------------------ + 1 file changed, 16 insertions(+), 18 deletions(-) + +--- a/drivers/input/rmi4/rmi_2d_sensor.c ++++ b/drivers/input/rmi4/rmi_2d_sensor.c +@@ -32,15 +32,15 @@ void rmi_2d_sensor_abs_process(struct rm + if (obj->type == RMI_2D_OBJECT_NONE) + return; + +- if (axis_align->swap_axes) +- swap(obj->x, obj->y); +- + if (axis_align->flip_x) + obj->x = sensor->max_x - obj->x; + + if (axis_align->flip_y) + obj->y = sensor->max_y - obj->y; + ++ if (axis_align->swap_axes) ++ swap(obj->x, obj->y); ++ + /* + * Here checking if X offset or y offset are specified is + * redundant. We just add the offsets or clip the values. +@@ -120,15 +120,15 @@ void rmi_2d_sensor_rel_report(struct rmi + x = min(RMI_2D_REL_POS_MAX, max(RMI_2D_REL_POS_MIN, (int)x)); + y = min(RMI_2D_REL_POS_MAX, max(RMI_2D_REL_POS_MIN, (int)y)); + +- if (axis_align->swap_axes) +- swap(x, y); +- + if (axis_align->flip_x) + x = min(RMI_2D_REL_POS_MAX, -x); + + if (axis_align->flip_y) + y = min(RMI_2D_REL_POS_MAX, -y); + ++ if (axis_align->swap_axes) ++ swap(x, y); ++ + if (x || y) { + input_report_rel(sensor->input, REL_X, x); + input_report_rel(sensor->input, REL_Y, y); +@@ -141,17 +141,10 @@ static void rmi_2d_sensor_set_input_para + struct input_dev *input = sensor->input; + int res_x; + int res_y; ++ int max_x, max_y; + int input_flags = 0; + + if (sensor->report_abs) { +- if (sensor->axis_align.swap_axes) { +- swap(sensor->max_x, sensor->max_y); +- swap(sensor->axis_align.clip_x_low, +- sensor->axis_align.clip_y_low); +- swap(sensor->axis_align.clip_x_high, +- sensor->axis_align.clip_y_high); +- } +- + sensor->min_x = sensor->axis_align.clip_x_low; + if (sensor->axis_align.clip_x_high) + sensor->max_x = min(sensor->max_x, +@@ -163,14 +156,19 @@ static void rmi_2d_sensor_set_input_para + sensor->axis_align.clip_y_high); + + set_bit(EV_ABS, input->evbit); +- input_set_abs_params(input, ABS_MT_POSITION_X, 0, sensor->max_x, +- 0, 0); +- input_set_abs_params(input, ABS_MT_POSITION_Y, 0, sensor->max_y, +- 0, 0); ++ ++ max_x = sensor->max_x; ++ max_y = sensor->max_y; ++ if (sensor->axis_align.swap_axes) ++ swap(max_x, max_y); ++ input_set_abs_params(input, ABS_MT_POSITION_X, 0, max_x, 0, 0); ++ input_set_abs_params(input, ABS_MT_POSITION_Y, 0, max_y, 0, 0); + + if (sensor->x_mm && sensor->y_mm) { + res_x = (sensor->max_x - sensor->min_x) / sensor->x_mm; + res_y = (sensor->max_y - sensor->min_y) / sensor->y_mm; ++ if (sensor->axis_align.swap_axes) ++ swap(res_x, res_y); + + input_abs_set_res(input, ABS_X, res_x); + input_abs_set_res(input, ABS_Y, res_y); diff --git a/queue-4.17/ipfrag-really-prevent-allocation-on-netns-exit.patch b/queue-4.17/ipfrag-really-prevent-allocation-on-netns-exit.patch new file mode 100644 index 00000000000..c4ab899ce5c --- /dev/null +++ b/queue-4.17/ipfrag-really-prevent-allocation-on-netns-exit.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Paolo Abeni +Date: Fri, 6 Jul 2018 12:30:20 +0200 +Subject: ipfrag: really prevent allocation on netns exit + +From: Paolo Abeni + +[ Upstream commit f6f2a4a2eb92bc73671204198bb2f8ab53ff59fb ] + +Setting the low threshold to 0 has no effect on frags allocation, +we need to clear high_thresh instead. + +The code was pre-existent to commit 648700f76b03 ("inet: frags: +use rhashtables for reassembly units"), but before the above, +such assignment had a different role: prevent concurrent eviction +from the worker and the netns cleanup helper. + +Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") +Signed-off-by: Paolo Abeni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/inet_fragment.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/inet_fragment.c ++++ b/net/ipv4/inet_fragment.c +@@ -90,7 +90,7 @@ static void inet_frags_free_cb(void *ptr + + void inet_frags_exit_net(struct netns_frags *nf) + { +- nf->low_thresh = 0; /* prevent creation of new frags */ ++ nf->high_thresh = 0; /* prevent creation of new frags */ + + rhashtable_free_and_destroy(&nf->rhashtable, inet_frags_free_cb, NULL); + } diff --git a/queue-4.17/ipmi-kcs_bmc-fix-irq-exception-if-the-channel-is-not-open.patch b/queue-4.17/ipmi-kcs_bmc-fix-irq-exception-if-the-channel-is-not-open.patch new file mode 100644 index 00000000000..02351acb79b --- /dev/null +++ b/queue-4.17/ipmi-kcs_bmc-fix-irq-exception-if-the-channel-is-not-open.patch @@ -0,0 +1,115 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Haiyue Wang +Date: Sat, 23 Jun 2018 21:51:13 +0800 +Subject: ipmi: kcs_bmc: fix IRQ exception if the channel is not open + +From: Haiyue Wang + +[ Upstream commit dc0f0a026d33819bb82d5c26ab2fca838e2004be ] + +When kcs_bmc_handle_event calls kcs_force_abort function to handle the +not open (no user running) KCS channel transaction, the returned status +value -ENODEV causes the low level IRQ handler indicating that the irq +was not for him by returning IRQ_NONE. After some time, this IRQ will +be treated to be spurious one, and the exception dump happens. + + irq 30: nobody cared (try booting with the "irqpoll" option) + CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.10.15-npcm750 #1 + Hardware name: NPCMX50 Chip family + [] (unwind_backtrace) from [] (show_stack+0x20/0x24) + [] (show_stack) from [] (dump_stack+0x8c/0xa0) + [] (dump_stack) from [] (__report_bad_irq+0x3c/0xdc) + [] (__report_bad_irq) from [] (note_interrupt+0x29c/0x2ec) + [] (note_interrupt) from [] (handle_irq_event_percpu+0x5c/0x68) + [] (handle_irq_event_percpu) from [] (handle_irq_event+0x48/0x6c) + [] (handle_irq_event) from [] (handle_fasteoi_irq+0xc8/0x198) + [] (handle_fasteoi_irq) from [] (__handle_domain_irq+0x90/0xe8) + [] (__handle_domain_irq) from [] (gic_handle_irq+0x58/0x9c) + [] (gic_handle_irq) from [] (__irq_svc+0x6c/0x90) + Exception stack(0xc0a01de8 to 0xc0a01e30) + 1de0: 00002080 c0a6fbc0 00000000 00000000 00000000 c096d294 + 1e00: 00000000 00000001 dc406400 f03ff100 00000082 c0a01e94 c0a6fbc0 c0a01e38 + 1e20: 00200102 c01015bc 60000113 ffffffff + [] (__irq_svc) from [] (__do_softirq+0xbc/0x358) + [] (__do_softirq) from [] (irq_exit+0xb8/0xec) + [] (irq_exit) from [] (__handle_domain_irq+0x94/0xe8) + [] (__handle_domain_irq) from [] (gic_handle_irq+0x58/0x9c) + [] (gic_handle_irq) from [] (__irq_svc+0x6c/0x90) + Exception stack(0xc0a01ef8 to 0xc0a01f40) + 1ee0: 00000000 000003ae + 1f00: dcc0f338 c0111060 c0a00000 c0a0cc44 c0a0cbe4 c0a1c22b c07bc218 00000001 + 1f20: dcffca40 c0a01f54 c0a01f58 c0a01f48 c0103524 c0103528 60000013 ffffffff + [] (__irq_svc) from [] (arch_cpu_idle+0x48/0x4c) + [] (arch_cpu_idle) from [] (default_idle_call+0x30/0x3c) + [] (default_idle_call) from [] (do_idle+0xc8/0x134) + [] (do_idle) from [] (cpu_startup_entry+0x28/0x2c) + [] (cpu_startup_entry) from [] (rest_init+0x84/0x88) + [] (rest_init) from [] (start_kernel+0x388/0x394) + [] (start_kernel) from [<0000807c>] (0x807c) + handlers: + [] npcm7xx_kcs_irq + Disabling IRQ #30 + +It needs to change the returned status from -ENODEV to 0. The -ENODEV +was originally used to tell the low level IRQ handler that no user was +running, but not consider the IRQ handling desgin. + +And multiple KCS channels share one IRQ handler, it needs to check the +IBF flag before doing force abort. If the IBF is set, after handling, +return 0 to low level IRQ handler to indicate that the IRQ is handled. + +Signed-off-by: Haiyue Wang +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/ipmi/kcs_bmc.c | 31 ++++++++++--------------------- + 1 file changed, 10 insertions(+), 21 deletions(-) + +--- a/drivers/char/ipmi/kcs_bmc.c ++++ b/drivers/char/ipmi/kcs_bmc.c +@@ -210,34 +210,23 @@ static void kcs_bmc_handle_cmd(struct kc + int kcs_bmc_handle_event(struct kcs_bmc *kcs_bmc) + { + unsigned long flags; +- int ret = 0; ++ int ret = -ENODATA; + u8 status; + + spin_lock_irqsave(&kcs_bmc->lock, flags); + +- if (!kcs_bmc->running) { +- kcs_force_abort(kcs_bmc); +- ret = -ENODEV; +- goto out_unlock; +- } +- +- status = read_status(kcs_bmc) & (KCS_STATUS_IBF | KCS_STATUS_CMD_DAT); +- +- switch (status) { +- case KCS_STATUS_IBF | KCS_STATUS_CMD_DAT: +- kcs_bmc_handle_cmd(kcs_bmc); +- break; +- +- case KCS_STATUS_IBF: +- kcs_bmc_handle_data(kcs_bmc); +- break; ++ status = read_status(kcs_bmc); ++ if (status & KCS_STATUS_IBF) { ++ if (!kcs_bmc->running) ++ kcs_force_abort(kcs_bmc); ++ else if (status & KCS_STATUS_CMD_DAT) ++ kcs_bmc_handle_cmd(kcs_bmc); ++ else ++ kcs_bmc_handle_data(kcs_bmc); + +- default: +- ret = -ENODATA; +- break; ++ ret = 0; + } + +-out_unlock: + spin_unlock_irqrestore(&kcs_bmc->lock, flags); + + return ret; diff --git a/queue-4.17/ipv6-make-ipv6_renew_options-interrupt-kernel-safe.patch b/queue-4.17/ipv6-make-ipv6_renew_options-interrupt-kernel-safe.patch new file mode 100644 index 00000000000..e61d47ebf0c --- /dev/null +++ b/queue-4.17/ipv6-make-ipv6_renew_options-interrupt-kernel-safe.patch @@ -0,0 +1,334 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Paul Moore +Date: Wed, 4 Jul 2018 09:58:05 -0400 +Subject: ipv6: make ipv6_renew_options() interrupt/kernel safe + +From: Paul Moore + +[ Upstream commit a9ba23d48dbc6ffd08426bb10f05720e0b9f5c14 ] + +At present the ipv6_renew_options_kern() function ends up calling into +access_ok() which is problematic if done from inside an interrupt as +access_ok() calls WARN_ON_IN_IRQ() on some (all?) architectures +(x86-64 is affected). Example warning/backtrace is shown below: + + WARNING: CPU: 1 PID: 3144 at lib/usercopy.c:11 _copy_from_user+0x85/0x90 + ... + Call Trace: + + ipv6_renew_option+0xb2/0xf0 + ipv6_renew_options+0x26a/0x340 + ipv6_renew_options_kern+0x2c/0x40 + calipso_req_setattr+0x72/0xe0 + netlbl_req_setattr+0x126/0x1b0 + selinux_netlbl_inet_conn_request+0x80/0x100 + selinux_inet_conn_request+0x6d/0xb0 + security_inet_conn_request+0x32/0x50 + tcp_conn_request+0x35f/0xe00 + ? __lock_acquire+0x250/0x16c0 + ? selinux_socket_sock_rcv_skb+0x1ae/0x210 + ? tcp_rcv_state_process+0x289/0x106b + tcp_rcv_state_process+0x289/0x106b + ? tcp_v6_do_rcv+0x1a7/0x3c0 + tcp_v6_do_rcv+0x1a7/0x3c0 + tcp_v6_rcv+0xc82/0xcf0 + ip6_input_finish+0x10d/0x690 + ip6_input+0x45/0x1e0 + ? ip6_rcv_finish+0x1d0/0x1d0 + ipv6_rcv+0x32b/0x880 + ? ip6_make_skb+0x1e0/0x1e0 + __netif_receive_skb_core+0x6f2/0xdf0 + ? process_backlog+0x85/0x250 + ? process_backlog+0x85/0x250 + ? process_backlog+0xec/0x250 + process_backlog+0xec/0x250 + net_rx_action+0x153/0x480 + __do_softirq+0xd9/0x4f7 + do_softirq_own_stack+0x2a/0x40 + + ... + +While not present in the backtrace, ipv6_renew_option() ends up calling +access_ok() via the following chain: + + access_ok() + _copy_from_user() + copy_from_user() + ipv6_renew_option() + +The fix presented in this patch is to perform the userspace copy +earlier in the call chain such that it is only called when the option +data is actually coming from userspace; that place is +do_ipv6_setsockopt(). Not only does this solve the problem seen in +the backtrace above, it also allows us to simplify the code quite a +bit by removing ipv6_renew_options_kern() completely. We also take +this opportunity to cleanup ipv6_renew_options()/ipv6_renew_option() +a small amount as well. + +This patch is heavily based on a rough patch by Al Viro. I've taken +his original patch, converted a kmemdup() call in do_ipv6_setsockopt() +to a memdup_user() call, made better use of the e_inval jump target in +the same function, and cleaned up the use ipv6_renew_option() by +ipv6_renew_options(). + +CC: Al Viro +Signed-off-by: Paul Moore +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/ipv6.h | 9 --- + net/ipv6/calipso.c | 9 +-- + net/ipv6/exthdrs.c | 111 ++++++++++++----------------------------------- + net/ipv6/ipv6_sockglue.c | 27 ++++++++--- + 4 files changed, 53 insertions(+), 103 deletions(-) + +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -354,14 +354,7 @@ struct ipv6_txoptions *ipv6_dup_options( + struct ipv6_txoptions *ipv6_renew_options(struct sock *sk, + struct ipv6_txoptions *opt, + int newtype, +- struct ipv6_opt_hdr __user *newopt, +- int newoptlen); +-struct ipv6_txoptions * +-ipv6_renew_options_kern(struct sock *sk, +- struct ipv6_txoptions *opt, +- int newtype, +- struct ipv6_opt_hdr *newopt, +- int newoptlen); ++ struct ipv6_opt_hdr *newopt); + struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space, + struct ipv6_txoptions *opt); + +--- a/net/ipv6/calipso.c ++++ b/net/ipv6/calipso.c +@@ -799,8 +799,7 @@ static int calipso_opt_update(struct soc + { + struct ipv6_txoptions *old = txopt_get(inet6_sk(sk)), *txopts; + +- txopts = ipv6_renew_options_kern(sk, old, IPV6_HOPOPTS, +- hop, hop ? ipv6_optlen(hop) : 0); ++ txopts = ipv6_renew_options(sk, old, IPV6_HOPOPTS, hop); + txopt_put(old); + if (IS_ERR(txopts)) + return PTR_ERR(txopts); +@@ -1222,8 +1221,7 @@ static int calipso_req_setattr(struct re + if (IS_ERR(new)) + return PTR_ERR(new); + +- txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, +- new, new ? ipv6_optlen(new) : 0); ++ txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new); + + kfree(new); + +@@ -1260,8 +1258,7 @@ static void calipso_req_delattr(struct r + if (calipso_opt_del(req_inet->ipv6_opt->hopopt, &new)) + return; /* Nothing to do */ + +- txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, +- new, new ? ipv6_optlen(new) : 0); ++ txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new); + + if (!IS_ERR(txopts)) { + txopts = xchg(&req_inet->ipv6_opt, txopts); +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -1028,29 +1028,21 @@ ipv6_dup_options(struct sock *sk, struct + } + EXPORT_SYMBOL_GPL(ipv6_dup_options); + +-static int ipv6_renew_option(void *ohdr, +- struct ipv6_opt_hdr __user *newopt, int newoptlen, +- int inherit, +- struct ipv6_opt_hdr **hdr, +- char **p) ++static void ipv6_renew_option(int renewtype, ++ struct ipv6_opt_hdr **dest, ++ struct ipv6_opt_hdr *old, ++ struct ipv6_opt_hdr *new, ++ int newtype, char **p) + { +- if (inherit) { +- if (ohdr) { +- memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr)); +- *hdr = (struct ipv6_opt_hdr *)*p; +- *p += CMSG_ALIGN(ipv6_optlen(*hdr)); +- } +- } else { +- if (newopt) { +- if (copy_from_user(*p, newopt, newoptlen)) +- return -EFAULT; +- *hdr = (struct ipv6_opt_hdr *)*p; +- if (ipv6_optlen(*hdr) > newoptlen) +- return -EINVAL; +- *p += CMSG_ALIGN(newoptlen); +- } +- } +- return 0; ++ struct ipv6_opt_hdr *src; ++ ++ src = (renewtype == newtype ? new : old); ++ if (!src) ++ return; ++ ++ memcpy(*p, src, ipv6_optlen(src)); ++ *dest = (struct ipv6_opt_hdr *)*p; ++ *p += CMSG_ALIGN(ipv6_optlen(*dest)); + } + + /** +@@ -1076,13 +1068,11 @@ static int ipv6_renew_option(void *ohdr, + */ + struct ipv6_txoptions * + ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt, +- int newtype, +- struct ipv6_opt_hdr __user *newopt, int newoptlen) ++ int newtype, struct ipv6_opt_hdr *newopt) + { + int tot_len = 0; + char *p; + struct ipv6_txoptions *opt2; +- int err; + + if (opt) { + if (newtype != IPV6_HOPOPTS && opt->hopopt) +@@ -1095,8 +1085,8 @@ ipv6_renew_options(struct sock *sk, stru + tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt)); + } + +- if (newopt && newoptlen) +- tot_len += CMSG_ALIGN(newoptlen); ++ if (newopt) ++ tot_len += CMSG_ALIGN(ipv6_optlen(newopt)); + + if (!tot_len) + return NULL; +@@ -1111,29 +1101,19 @@ ipv6_renew_options(struct sock *sk, stru + opt2->tot_len = tot_len; + p = (char *)(opt2 + 1); + +- err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen, +- newtype != IPV6_HOPOPTS, +- &opt2->hopopt, &p); +- if (err) +- goto out; +- +- err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen, +- newtype != IPV6_RTHDRDSTOPTS, +- &opt2->dst0opt, &p); +- if (err) +- goto out; +- +- err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen, +- newtype != IPV6_RTHDR, +- (struct ipv6_opt_hdr **)&opt2->srcrt, &p); +- if (err) +- goto out; +- +- err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen, +- newtype != IPV6_DSTOPTS, +- &opt2->dst1opt, &p); +- if (err) +- goto out; ++ ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt, ++ (opt ? opt->hopopt : NULL), ++ newopt, newtype, &p); ++ ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt, ++ (opt ? opt->dst0opt : NULL), ++ newopt, newtype, &p); ++ ipv6_renew_option(IPV6_RTHDR, ++ (struct ipv6_opt_hdr **)&opt2->srcrt, ++ (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL), ++ newopt, newtype, &p); ++ ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt, ++ (opt ? opt->dst1opt : NULL), ++ newopt, newtype, &p); + + opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) + + (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) + +@@ -1141,37 +1121,6 @@ ipv6_renew_options(struct sock *sk, stru + opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0); + + return opt2; +-out: +- sock_kfree_s(sk, opt2, opt2->tot_len); +- return ERR_PTR(err); +-} +- +-/** +- * ipv6_renew_options_kern - replace a specific ext hdr with a new one. +- * +- * @sk: sock from which to allocate memory +- * @opt: original options +- * @newtype: option type to replace in @opt +- * @newopt: new option of type @newtype to replace (kernel-mem) +- * @newoptlen: length of @newopt +- * +- * See ipv6_renew_options(). The difference is that @newopt is +- * kernel memory, rather than user memory. +- */ +-struct ipv6_txoptions * +-ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt, +- int newtype, struct ipv6_opt_hdr *newopt, +- int newoptlen) +-{ +- struct ipv6_txoptions *ret_val; +- const mm_segment_t old_fs = get_fs(); +- +- set_fs(KERNEL_DS); +- ret_val = ipv6_renew_options(sk, opt, newtype, +- (struct ipv6_opt_hdr __user *)newopt, +- newoptlen); +- set_fs(old_fs); +- return ret_val; + } + + struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space, +--- a/net/ipv6/ipv6_sockglue.c ++++ b/net/ipv6/ipv6_sockglue.c +@@ -398,6 +398,12 @@ static int do_ipv6_setsockopt(struct soc + case IPV6_DSTOPTS: + { + struct ipv6_txoptions *opt; ++ struct ipv6_opt_hdr *new = NULL; ++ ++ /* hop-by-hop / destination options are privileged option */ ++ retv = -EPERM; ++ if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW)) ++ break; + + /* remove any sticky options header with a zero option + * length, per RFC3542. +@@ -409,17 +415,22 @@ static int do_ipv6_setsockopt(struct soc + else if (optlen < sizeof(struct ipv6_opt_hdr) || + optlen & 0x7 || optlen > 8 * 255) + goto e_inval; +- +- /* hop-by-hop / destination options are privileged option */ +- retv = -EPERM; +- if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW)) +- break; ++ else { ++ new = memdup_user(optval, optlen); ++ if (IS_ERR(new)) { ++ retv = PTR_ERR(new); ++ break; ++ } ++ if (unlikely(ipv6_optlen(new) > optlen)) { ++ kfree(new); ++ goto e_inval; ++ } ++ } + + opt = rcu_dereference_protected(np->opt, + lockdep_sock_is_held(sk)); +- opt = ipv6_renew_options(sk, opt, optname, +- (struct ipv6_opt_hdr __user *)optval, +- optlen); ++ opt = ipv6_renew_options(sk, opt, optname, new); ++ kfree(new); + if (IS_ERR(opt)) { + retv = PTR_ERR(opt); + break; diff --git a/queue-4.17/ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch b/queue-4.17/ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch new file mode 100644 index 00000000000..9fb9db516cc --- /dev/null +++ b/queue-4.17/ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch @@ -0,0 +1,58 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Hangbin Liu +Date: Thu, 21 Jun 2018 19:49:36 +0800 +Subject: ipv6: mcast: fix unsolicited report interval after receiving querys + +From: Hangbin Liu + +[ Upstream commit 6c6da92808442908287fae8ebb0ca041a52469f4 ] + +After recieving MLD querys, we update idev->mc_maxdelay with max_delay +from query header. This make the later unsolicited reports have the same +interval with mc_maxdelay, which means we may send unsolicited reports with +long interval time instead of default configured interval time. + +Also as we will not call ipv6_mc_reset() after device up. This issue will +be there even after leave the group and join other groups. + +Fixes: fc4eba58b4c14 ("ipv6: make unsolicited report intervals configurable for mld") +Signed-off-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/mcast.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -2081,7 +2081,8 @@ void ipv6_mc_dad_complete(struct inet6_d + mld_send_initial_cr(idev); + idev->mc_dad_count--; + if (idev->mc_dad_count) +- mld_dad_start_timer(idev, idev->mc_maxdelay); ++ mld_dad_start_timer(idev, ++ unsolicited_report_interval(idev)); + } + } + +@@ -2093,7 +2094,8 @@ static void mld_dad_timer_expire(struct + if (idev->mc_dad_count) { + idev->mc_dad_count--; + if (idev->mc_dad_count) +- mld_dad_start_timer(idev, idev->mc_maxdelay); ++ mld_dad_start_timer(idev, ++ unsolicited_report_interval(idev)); + } + in6_dev_put(idev); + } +@@ -2451,7 +2453,8 @@ static void mld_ifc_timer_expire(struct + if (idev->mc_ifc_count) { + idev->mc_ifc_count--; + if (idev->mc_ifc_count) +- mld_ifc_start_timer(idev, idev->mc_maxdelay); ++ mld_ifc_start_timer(idev, ++ unsolicited_report_interval(idev)); + } + in6_dev_put(idev); + } diff --git a/queue-4.17/ipvlan-call-dev_change_flags-when-ipvlan-mode-is-reset.patch b/queue-4.17/ipvlan-call-dev_change_flags-when-ipvlan-mode-is-reset.patch new file mode 100644 index 00000000000..b887f1b3c3c --- /dev/null +++ b/queue-4.17/ipvlan-call-dev_change_flags-when-ipvlan-mode-is-reset.patch @@ -0,0 +1,121 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Hangbin Liu +Date: Sun, 1 Jul 2018 16:21:21 +0800 +Subject: ipvlan: call dev_change_flags when ipvlan mode is reset + +From: Hangbin Liu + +[ Upstream commit 5dc2d3996a8b221c20dd0900bdad45031a572530 ] + +After we change the ipvlan mode from l3 to l2, or vice versa, we only +reset IFF_NOARP flag, but don't flush the ARP table cache, which will +cause eth->h_dest to be equal to eth->h_source in ipvlan_xmit_mode_l2(). +Then the message will not come out of host. + +Here is the reproducer on local host: + +ip link set eth1 up +ip addr add 192.168.1.1/24 dev eth1 +ip link add link eth1 ipvlan1 type ipvlan mode l3 + +ip netns add net1 +ip link set ipvlan1 netns net1 +ip netns exec net1 ip link set ipvlan1 up +ip netns exec net1 ip addr add 192.168.2.1/24 dev ipvlan1 + +ip route add 192.168.2.0/24 via 192.168.1.2 +ping 192.168.2.2 -c 2 + +ip netns exec net1 ip link set ipvlan1 type ipvlan mode l2 +ping 192.168.2.2 -c 2 + +Add the same configuration on remote host. After we set the mode to l2, +we could find that the src/dst MAC addresses are the same on eth1: + +21:26:06.648565 00:b7:13:ad:d3:05 > 00:b7:13:ad:d3:05, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 58356, offset 0, flags [DF], proto ICMP (1), length 84) + 192.168.2.1 > 192.168.2.2: ICMP echo request, id 22686, seq 1, length 64 + +Fix this by calling dev_change_flags(), which will call netdevice notifier +with flag change info. + +v2: +a) As pointed out by Wang Cong, check return value for dev_change_flags() when +change dev flags. +b) As suggested by Stefano and Sabrina, move flags setting before l3mdev_ops. +So we don't need to redo ipvlan_{, un}register_nf_hook() again in err path. + +Reported-by: Jianlin Shi +Reviewed-by: Stefano Brivio +Reviewed-by: Sabrina Dubroca +Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver.") +Signed-off-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ipvlan/ipvlan_main.c | 36 ++++++++++++++++++++++++++++-------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +--- a/drivers/net/ipvlan/ipvlan_main.c ++++ b/drivers/net/ipvlan/ipvlan_main.c +@@ -75,10 +75,23 @@ static int ipvlan_set_port_mode(struct i + { + struct ipvl_dev *ipvlan; + struct net_device *mdev = port->dev; +- int err = 0; ++ unsigned int flags; ++ int err; + + ASSERT_RTNL(); + if (port->mode != nval) { ++ list_for_each_entry(ipvlan, &port->ipvlans, pnode) { ++ flags = ipvlan->dev->flags; ++ if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S) { ++ err = dev_change_flags(ipvlan->dev, ++ flags | IFF_NOARP); ++ } else { ++ err = dev_change_flags(ipvlan->dev, ++ flags & ~IFF_NOARP); ++ } ++ if (unlikely(err)) ++ goto fail; ++ } + if (nval == IPVLAN_MODE_L3S) { + /* New mode is L3S */ + err = ipvlan_register_nf_hook(read_pnet(&port->pnet)); +@@ -86,21 +99,28 @@ static int ipvlan_set_port_mode(struct i + mdev->l3mdev_ops = &ipvl_l3mdev_ops; + mdev->priv_flags |= IFF_L3MDEV_MASTER; + } else +- return err; ++ goto fail; + } else if (port->mode == IPVLAN_MODE_L3S) { + /* Old mode was L3S */ + mdev->priv_flags &= ~IFF_L3MDEV_MASTER; + ipvlan_unregister_nf_hook(read_pnet(&port->pnet)); + mdev->l3mdev_ops = NULL; + } +- list_for_each_entry(ipvlan, &port->ipvlans, pnode) { +- if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S) +- ipvlan->dev->flags |= IFF_NOARP; +- else +- ipvlan->dev->flags &= ~IFF_NOARP; +- } + port->mode = nval; + } ++ return 0; ++ ++fail: ++ /* Undo the flags changes that have been done so far. */ ++ list_for_each_entry_continue_reverse(ipvlan, &port->ipvlans, pnode) { ++ flags = ipvlan->dev->flags; ++ if (port->mode == IPVLAN_MODE_L3 || ++ port->mode == IPVLAN_MODE_L3S) ++ dev_change_flags(ipvlan->dev, flags | IFF_NOARP); ++ else ++ dev_change_flags(ipvlan->dev, flags & ~IFF_NOARP); ++ } ++ + return err; + } + diff --git a/queue-4.17/irqchip-gic-v2m-fix-spi-release-on-error-path.patch b/queue-4.17/irqchip-gic-v2m-fix-spi-release-on-error-path.patch new file mode 100644 index 00000000000..adfd739252e --- /dev/null +++ b/queue-4.17/irqchip-gic-v2m-fix-spi-release-on-error-path.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Marc Zyngier +Date: Fri, 22 Jun 2018 10:52:50 +0100 +Subject: irqchip/gic-v2m: Fix SPI release on error path + +From: Marc Zyngier + +[ Upstream commit cbaf45a6be497c272e80500e4fd9bccdf20d5050 ] + +On failing to allocate the required SPIs, the actual number of interrupts +should be freed and not its log2 value. + +Fixes: de337ee30142 ("irqchip/gic-v2m: Add PCI Multi-MSI support") +Signed-off-by: Marc Zyngier +Signed-off-by: Thomas Gleixner +Cc: Jason Cooper +Cc: Alexandre Belloni +Cc: Yang Yingliang +Cc: Sumit Garg +Link: https://lkml.kernel.org/r/20180622095254.5906-4-marc.zyngier@arm.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-gic-v2m.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/irqchip/irq-gic-v2m.c ++++ b/drivers/irqchip/irq-gic-v2m.c +@@ -199,7 +199,7 @@ static int gicv2m_irq_domain_alloc(struc + + fail: + irq_domain_free_irqs_parent(domain, virq, nr_irqs); +- gicv2m_unalloc_msi(v2m, hwirq, get_count_order(nr_irqs)); ++ gicv2m_unalloc_msi(v2m, hwirq, nr_irqs); + return err; + } + diff --git a/queue-4.17/irqchip-gic-v3-its-fix-reprogramming-of-redistributors-on-cpu-hotplug.patch b/queue-4.17/irqchip-gic-v3-its-fix-reprogramming-of-redistributors-on-cpu-hotplug.patch new file mode 100644 index 00000000000..42e7984ce36 --- /dev/null +++ b/queue-4.17/irqchip-gic-v3-its-fix-reprogramming-of-redistributors-on-cpu-hotplug.patch @@ -0,0 +1,51 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Marc Zyngier +Date: Fri, 22 Jun 2018 10:52:54 +0100 +Subject: irqchip/gic-v3-its: Fix reprogramming of redistributors on CPU hotplug + +From: Marc Zyngier + +[ Upstream commit 82f499c8811149069ec958b72a86643a7a289b25 ] + +Enabling LPIs was made a lot stricter recently, by checking that they are +disabled before enabling them. By doing so, the CPU hotplug case was missed +altogether, which leaves LPIs enabled on hotplug off (expecting the CPU to +eventually come back), and won't write a different value anyway on hotplug +on. + +So skip that check if that particular case is detected + +Fixes: 6eb486b66a30 ("irqchip/gic-v3: Ensure GICR_CTLR.EnableLPI=0 is observed before enabling") +Reported-by: Sumit Garg +Signed-off-by: Marc Zyngier +Signed-off-by: Thomas Gleixner +Tested-by: Sumit Garg +Cc: Jason Cooper +Cc: Alexandre Belloni +Cc: Yang Yingliang +Link: https://lkml.kernel.org/r/20180622095254.5906-8-marc.zyngier@arm.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-gic-v3-its.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -3405,6 +3405,16 @@ static int redist_disable_lpis(void) + u64 timeout = USEC_PER_SEC; + u64 val; + ++ /* ++ * If coming via a CPU hotplug event, we don't need to disable ++ * LPIs before trying to re-enable them. They are already ++ * configured and all is well in the world. Detect this case ++ * by checking the allocation of the pending table for the ++ * current CPU. ++ */ ++ if (gic_data_rdist()->pend_page) ++ return 0; ++ + if (!gic_rdists_supports_plpis()) { + pr_info("CPU%d: LPIs not supported\n", smp_processor_id()); + return -ENXIO; diff --git a/queue-4.17/ixgbe-be-more-careful-when-modifying-mac-filters.patch b/queue-4.17/ixgbe-be-more-careful-when-modifying-mac-filters.patch new file mode 100644 index 00000000000..f4dd33b1eea --- /dev/null +++ b/queue-4.17/ixgbe-be-more-careful-when-modifying-mac-filters.patch @@ -0,0 +1,56 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Alexander Duyck +Date: Mon, 18 Jun 2018 12:02:00 -0400 +Subject: ixgbe: Be more careful when modifying MAC filters + +From: Alexander Duyck + +[ Upstream commit d14c780c11fbc10f66c43e7b64eefe87ca442bd3 ] + +This change makes it so that we are much more explicit about the ordering +of updates to the receive address register (RAR) table. Prior to this patch +I believe we may have been updating the table while entries were still +active, or possibly allowing for reordering of things since we weren't +explicitly flushing writes to either the lower or upper portion of the +register prior to accessing the other half. + +Signed-off-by: Alexander Duyck +Reviewed-by: Shannon Nelson +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_common.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c +@@ -1897,7 +1897,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_h + if (enable_addr != 0) + rar_high |= IXGBE_RAH_AV; + ++ /* Record lower 32 bits of MAC address and then make ++ * sure that write is flushed to hardware before writing ++ * the upper 16 bits and setting the valid bit. ++ */ + IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low); ++ IXGBE_WRITE_FLUSH(hw); + IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high); + + return 0; +@@ -1929,8 +1934,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe + rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index)); + rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV); + +- IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0); ++ /* Clear the address valid bit and upper 16 bits of the address ++ * before clearing the lower bits. This way we aren't updating ++ * a live filter. ++ */ + IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high); ++ IXGBE_WRITE_FLUSH(hw); ++ IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0); + + /* clear VMDq pool/queue selection for this RAR */ + hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL); diff --git a/queue-4.17/ixgbe-off-by-one-in-ixgbe_ipsec_tx.patch b/queue-4.17/ixgbe-off-by-one-in-ixgbe_ipsec_tx.patch new file mode 100644 index 00000000000..85c048c586f --- /dev/null +++ b/queue-4.17/ixgbe-off-by-one-in-ixgbe_ipsec_tx.patch @@ -0,0 +1,35 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dan Carpenter +Date: Wed, 4 Jul 2018 12:53:37 +0300 +Subject: ixgbe: Off by one in ixgbe_ipsec_tx() + +From: Dan Carpenter + +[ Upstream commit c411104115e6821f26fc8f6de8b235ddf98de688 ] + +The ipsec->tx_tbl[] has IXGBE_IPSEC_MAX_SA_COUNT elements so the > needs +to be changed to >= so we don't read one element beyond the end of the +array. + +Fixes: 592594704761 ("ixgbe: process the Tx ipsec offload") +Signed-off-by: Dan Carpenter +Acked-by: Shannon Nelson +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +@@ -759,7 +759,7 @@ int ixgbe_ipsec_tx(struct ixgbe_ring *tx + } + + itd->sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_TX_INDEX; +- if (unlikely(itd->sa_idx > IXGBE_IPSEC_MAX_SA_COUNT)) { ++ if (unlikely(itd->sa_idx >= IXGBE_IPSEC_MAX_SA_COUNT)) { + netdev_err(tx_ring->netdev, "%s: bad sa_idx=%d handle=%lu\n", + __func__, itd->sa_idx, xs->xso.offload_handle); + return 0; diff --git a/queue-4.17/kasan-fix-shadow_size-calculation-error-in-kasan_module_alloc.patch b/queue-4.17/kasan-fix-shadow_size-calculation-error-in-kasan_module_alloc.patch new file mode 100644 index 00000000000..2590df1e543 --- /dev/null +++ b/queue-4.17/kasan-fix-shadow_size-calculation-error-in-kasan_module_alloc.patch @@ -0,0 +1,69 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Zhen Lei +Date: Tue, 3 Jul 2018 17:02:46 -0700 +Subject: kasan: fix shadow_size calculation error in kasan_module_alloc + +From: Zhen Lei + +[ Upstream commit 1e8e18f694a52d703665012ca486826f64bac29d ] + +There is a special case that the size is "(N << KASAN_SHADOW_SCALE_SHIFT) +Pages plus X", the value of X is [1, KASAN_SHADOW_SCALE_SIZE-1]. The +operation "size >> KASAN_SHADOW_SCALE_SHIFT" will drop X, and the +roundup operation can not retrieve the missed one page. For example: +size=0x28006, PAGE_SIZE=0x1000, KASAN_SHADOW_SCALE_SHIFT=3, we will get +shadow_size=0x5000, but actually we need 6 pages. + + shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT, PAGE_SIZE); + +This can lead to a kernel crash when kasan is enabled and the value of +mod->core_layout.size or mod->init_layout.size is like above. Because +the shadow memory of X has not been allocated and mapped. + +move_module: + ptr = module_alloc(mod->core_layout.size); + ... + memset(ptr, 0, mod->core_layout.size); //crashed + + Unable to handle kernel paging request at virtual address ffff0fffff97b000 + ...... + Call trace: + __asan_storeN+0x174/0x1a8 + memset+0x24/0x48 + layout_and_allocate+0xcd8/0x1800 + load_module+0x190/0x23e8 + SyS_finit_module+0x148/0x180 + +Link: http://lkml.kernel.org/r/1529659626-12660-1-git-send-email-thunder.leizhen@huawei.com +Signed-off-by: Zhen Lei +Reviewed-by: Dmitriy Vyukov +Acked-by: Andrey Ryabinin +Cc: Alexander Potapenko +Cc: Hanjun Guo +Cc: Libin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + mm/kasan/kasan.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/mm/kasan/kasan.c ++++ b/mm/kasan/kasan.c +@@ -619,12 +619,13 @@ void kasan_kfree_large(void *ptr, unsign + int kasan_module_alloc(void *addr, size_t size) + { + void *ret; ++ size_t scaled_size; + size_t shadow_size; + unsigned long shadow_start; + + shadow_start = (unsigned long)kasan_mem_to_shadow(addr); +- shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT, +- PAGE_SIZE); ++ scaled_size = (size + KASAN_SHADOW_MASK) >> KASAN_SHADOW_SCALE_SHIFT; ++ shadow_size = round_up(scaled_size, PAGE_SIZE); + + if (WARN_ON(!PAGE_ALIGNED(shadow_start))) + return -EINVAL; diff --git a/queue-4.17/kbuild-suppress-warnings-from-getconf-lfs_.patch b/queue-4.17/kbuild-suppress-warnings-from-getconf-lfs_.patch new file mode 100644 index 00000000000..11133827806 --- /dev/null +++ b/queue-4.17/kbuild-suppress-warnings-from-getconf-lfs_.patch @@ -0,0 +1,40 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Masahiro Yamada +Date: Thu, 12 Jul 2018 19:38:36 +0900 +Subject: kbuild: suppress warnings from 'getconf LFS_*' + +From: Masahiro Yamada + +[ Upstream commit 6d79a7b424a5630a6fcab31fd7c38af4ea9c9a0f ] + +Suppress warnings for systems that do not recognize LFS_*. + + getconf: no such configuration parameter `LFS_CFLAGS' + getconf: no such configuration parameter `LFS_LDFLAGS' + getconf: no such configuration parameter `LFS_LIBS' + +Fixes: d7f14c66c273 ("kbuild: Enable Large File Support for hostprogs") +Reported-by: Chen Feng +Signed-off-by: Masahiro Yamada +Acked-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Makefile | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/Makefile ++++ b/Makefile +@@ -356,9 +356,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" + else if [ -x /bin/bash ]; then echo /bin/bash; \ + else echo sh; fi ; fi) + +-HOST_LFS_CFLAGS := $(shell getconf LFS_CFLAGS) +-HOST_LFS_LDFLAGS := $(shell getconf LFS_LDFLAGS) +-HOST_LFS_LIBS := $(shell getconf LFS_LIBS) ++HOST_LFS_CFLAGS := $(shell getconf LFS_CFLAGS 2>/dev/null) ++HOST_LFS_LDFLAGS := $(shell getconf LFS_LDFLAGS 2>/dev/null) ++HOST_LFS_LIBS := $(shell getconf LFS_LIBS 2>/dev/null) + + HOSTCC = gcc + HOSTCXX = g++ diff --git a/queue-4.17/kconfig-fix-line-numbers-for-if-entries-in-menu-tree.patch b/queue-4.17/kconfig-fix-line-numbers-for-if-entries-in-menu-tree.patch new file mode 100644 index 00000000000..66b135a11bd --- /dev/null +++ b/queue-4.17/kconfig-fix-line-numbers-for-if-entries-in-menu-tree.patch @@ -0,0 +1,67 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dirk Gouders +Date: Thu, 21 Jun 2018 15:30:54 +0200 +Subject: kconfig: fix line numbers for if-entries in menu tree + +From: Dirk Gouders + +[ Upstream commit b2d00d7c61c84edd150310af3f556f8a3c6e2e67 ] + +The line numers for if-entries in the menu tree are off by one or more +lines which is confusing when debugging for correctness of unrelated changes. + +According to the git log, commit a02f0570ae201c49 (kconfig: improve +error handling in the parser) was the last one that changed that part +of the parser and replaced + + "if_entry: T_IF expr T_EOL" +by + "if_entry: T_IF expr nl" + +but the commit message does not state why this has been done. + +When reverting that part of the commit, only the line numers are +corrected (checked with cdebug = DEBUG_PARSE in zconf.y), otherwise +the menu tree remains unchanged (checked with zconfdump() enabled in +conf.c). + +An example for the corrected line numbers: + +drivers/soc/Kconfig:15:source drivers/soc/tegra/Kconfig +drivers/soc/tegra/Kconfig:4:if +drivers/soc/tegra/Kconfig:6:if + +changes to: + +drivers/soc/Kconfig:15:source drivers/soc/tegra/Kconfig +drivers/soc/tegra/Kconfig:1:if +drivers/soc/tegra/Kconfig:4:if + +Signed-off-by: Dirk Gouders +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + scripts/kconfig/zconf.y | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/scripts/kconfig/zconf.y ++++ b/scripts/kconfig/zconf.y +@@ -31,7 +31,7 @@ struct symbol *symbol_hash[SYMBOL_HASHSI + static struct menu *current_menu, *current_entry; + + %} +-%expect 32 ++%expect 31 + + %union + { +@@ -345,7 +345,7 @@ choice_block: + + /* if entry */ + +-if_entry: T_IF expr nl ++if_entry: T_IF expr T_EOL + { + printd(DEBUG_PARSE, "%s:%d:if\n", zconf_curname(), zconf_lineno()); + menu_add_entry(NULL); diff --git a/queue-4.17/kthread-sched-core-fix-kthread_parkme-again.patch b/queue-4.17/kthread-sched-core-fix-kthread_parkme-again.patch new file mode 100644 index 00000000000..0d116a6851f --- /dev/null +++ b/queue-4.17/kthread-sched-core-fix-kthread_parkme-again.patch @@ -0,0 +1,212 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Peter Zijlstra +Date: Thu, 7 Jun 2018 11:45:49 +0200 +Subject: kthread, sched/core: Fix kthread_parkme() (again...) + +From: Peter Zijlstra + +[ Upstream commit 1cef1150ef40ec52f507436a14230cbc2623299c ] + +Gaurav reports that commit: + + 85f1abe0019f ("kthread, sched/wait: Fix kthread_parkme() completion issue") + +isn't working for him. Because of the following race: + +> controller Thread CPUHP Thread +> takedown_cpu +> kthread_park +> kthread_parkme +> Set KTHREAD_SHOULD_PARK +> smpboot_thread_fn +> set Task interruptible +> +> +> wake_up_process +> if (!(p->state & state)) +> goto out; +> +> Kthread_parkme +> SET TASK_PARKED +> schedule +> raw_spin_lock(&rq->lock) +> ttwu_remote +> waiting for __task_rq_lock +> context_switch +> +> finish_lock_switch +> +> +> +> Case TASK_PARKED +> kthread_park_complete +> +> +> SET Running + +Furthermore, Oleg noticed that the whole scheduler TASK_PARKED +handling is buggered because the TASK_DEAD thing is done with +preemption disabled, the current code can still complete early on +preemption :/ + +So basically revert that earlier fix and go with a variant of the +alternative mentioned in the commit. Promote TASK_PARKED to special +state to avoid the store-store issue on task->state leading to the +WARN in kthread_unpark() -> __kthread_bind(). + +But in addition, add wait_task_inactive() to kthread_park() to ensure +the task really is PARKED when we return from kthread_park(). This +avoids the whole kthread still gets migrated nonsense -- although it +would be really good to get this done differently. + +Reported-by: Gaurav Kohli +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Oleg Nesterov +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: 85f1abe0019f ("kthread, sched/wait: Fix kthread_parkme() completion issue") +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/kthread.h | 1 - + include/linux/sched.h | 2 +- + kernel/kthread.c | 30 ++++++++++++++++++++++++------ + kernel/sched/core.c | 31 +++++++++++-------------------- + 4 files changed, 36 insertions(+), 28 deletions(-) + +--- a/include/linux/kthread.h ++++ b/include/linux/kthread.h +@@ -62,7 +62,6 @@ void *kthread_probe_data(struct task_str + int kthread_park(struct task_struct *k); + void kthread_unpark(struct task_struct *k); + void kthread_parkme(void); +-void kthread_park_complete(struct task_struct *k); + + int kthreadd(void *unused); + extern struct task_struct *kthreadd_task; +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -117,7 +117,7 @@ struct task_group; + * the comment with set_special_state(). + */ + #define is_special_task_state(state) \ +- ((state) & (__TASK_STOPPED | __TASK_TRACED | TASK_DEAD)) ++ ((state) & (__TASK_STOPPED | __TASK_TRACED | TASK_PARKED | TASK_DEAD)) + + #define __set_current_state(state_value) \ + do { \ +--- a/kernel/kthread.c ++++ b/kernel/kthread.c +@@ -177,9 +177,20 @@ void *kthread_probe_data(struct task_str + static void __kthread_parkme(struct kthread *self) + { + for (;;) { +- set_current_state(TASK_PARKED); ++ /* ++ * TASK_PARKED is a special state; we must serialize against ++ * possible pending wakeups to avoid store-store collisions on ++ * task->state. ++ * ++ * Such a collision might possibly result in the task state ++ * changin from TASK_PARKED and us failing the ++ * wait_task_inactive() in kthread_park(). ++ */ ++ set_special_state(TASK_PARKED); + if (!test_bit(KTHREAD_SHOULD_PARK, &self->flags)) + break; ++ ++ complete_all(&self->parked); + schedule(); + } + __set_current_state(TASK_RUNNING); +@@ -191,11 +202,6 @@ void kthread_parkme(void) + } + EXPORT_SYMBOL_GPL(kthread_parkme); + +-void kthread_park_complete(struct task_struct *k) +-{ +- complete_all(&to_kthread(k)->parked); +-} +- + static int kthread(void *_create) + { + /* Copy data: it's on kthread's stack */ +@@ -467,6 +473,9 @@ void kthread_unpark(struct task_struct * + + reinit_completion(&kthread->parked); + clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags); ++ /* ++ * __kthread_parkme() will either see !SHOULD_PARK or get the wakeup. ++ */ + wake_up_state(k, TASK_PARKED); + } + EXPORT_SYMBOL_GPL(kthread_unpark); +@@ -493,7 +502,16 @@ int kthread_park(struct task_struct *k) + set_bit(KTHREAD_SHOULD_PARK, &kthread->flags); + if (k != current) { + wake_up_process(k); ++ /* ++ * Wait for __kthread_parkme() to complete(), this means we ++ * _will_ have TASK_PARKED and are about to call schedule(). ++ */ + wait_for_completion(&kthread->parked); ++ /* ++ * Now wait for that schedule() to complete and the task to ++ * get scheduled out. ++ */ ++ WARN_ON_ONCE(!wait_task_inactive(k, TASK_PARKED)); + } + + return 0; +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -7,7 +7,6 @@ + */ + #include "sched.h" + +-#include + #include + + #include +@@ -2738,28 +2737,20 @@ static struct rq *finish_task_switch(str + membarrier_mm_sync_core_before_usermode(mm); + mmdrop(mm); + } +- if (unlikely(prev_state & (TASK_DEAD|TASK_PARKED))) { +- switch (prev_state) { +- case TASK_DEAD: +- if (prev->sched_class->task_dead) +- prev->sched_class->task_dead(prev); +- +- /* +- * Remove function-return probe instances associated with this +- * task and put them back on the free list. +- */ +- kprobe_flush_task(prev); ++ if (unlikely(prev_state == TASK_DEAD)) { ++ if (prev->sched_class->task_dead) ++ prev->sched_class->task_dead(prev); + +- /* Task is done with its stack. */ +- put_task_stack(prev); ++ /* ++ * Remove function-return probe instances associated with this ++ * task and put them back on the free list. ++ */ ++ kprobe_flush_task(prev); + +- put_task_struct(prev); +- break; ++ /* Task is done with its stack. */ ++ put_task_stack(prev); + +- case TASK_PARKED: +- kthread_park_complete(prev); +- break; +- } ++ put_task_struct(prev); + } + + tick_nohz_task_switch(); diff --git a/queue-4.17/kvm-arm-arm64-drop-resource-size-check-for-gicv-window.patch b/queue-4.17/kvm-arm-arm64-drop-resource-size-check-for-gicv-window.patch new file mode 100644 index 00000000000..5754b7bcf8e --- /dev/null +++ b/queue-4.17/kvm-arm-arm64-drop-resource-size-check-for-gicv-window.patch @@ -0,0 +1,52 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Ard Biesheuvel +Date: Fri, 1 Jun 2018 17:06:28 +0200 +Subject: KVM: arm/arm64: Drop resource size check for GICV window + +From: Ard Biesheuvel + +[ Upstream commit ba56bc3a0786992755e6804fbcbdc60ef6cfc24c ] + +When booting a 64 KB pages kernel on a ACPI GICv3 system that +implements support for v2 emulation, the following warning is +produced + + GICV size 0x2000 not a multiple of page size 0x10000 + +and support for v2 emulation is disabled, preventing GICv2 VMs +from being able to run on such hosts. + +The reason is that vgic_v3_probe() performs a sanity check on the +size of the window (it should be a multiple of the page size), +while the ACPI MADT parsing code hardcodes the size of the window +to 8 KB. This makes sense, considering that ACPI does not bother +to describe the size in the first place, under the assumption that +platforms implementing ACPI will follow the architecture and not +put anything else in the same 64 KB window. + +So let's just drop the sanity check altogether, and assume that +the window is at least 64 KB in size. + +Fixes: 909777324588 ("KVM: arm/arm64: vgic-new: vgic_init: implement kvm_vgic_hyp_init") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Marc Zyngier +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + virt/kvm/arm/vgic/vgic-v3.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/virt/kvm/arm/vgic/vgic-v3.c ++++ b/virt/kvm/arm/vgic/vgic-v3.c +@@ -552,11 +552,6 @@ int vgic_v3_probe(const struct gic_kvm_i + pr_warn("GICV physical address 0x%llx not page aligned\n", + (unsigned long long)info->vcpu.start); + kvm_vgic_global_state.vcpu_base = 0; +- } else if (!PAGE_ALIGNED(resource_size(&info->vcpu))) { +- pr_warn("GICV size 0x%llx not a multiple of page size 0x%lx\n", +- (unsigned long long)resource_size(&info->vcpu), +- PAGE_SIZE); +- kvm_vgic_global_state.vcpu_base = 0; + } else { + kvm_vgic_global_state.vcpu_base = info->vcpu.start; + kvm_vgic_global_state.can_emulate_gicv2 = true; diff --git a/queue-4.17/kvm-nvmx-restore-exit-qual-for-vm-entry-failure-due-to-msr-loading.patch b/queue-4.17/kvm-nvmx-restore-exit-qual-for-vm-entry-failure-due-to-msr-loading.patch new file mode 100644 index 00000000000..390f213a7c4 --- /dev/null +++ b/queue-4.17/kvm-nvmx-restore-exit-qual-for-vm-entry-failure-due-to-msr-loading.patch @@ -0,0 +1,48 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jim Mattson +Date: Wed, 30 May 2018 16:00:02 -0700 +Subject: kvm: nVMX: Restore exit qual for VM-entry failure due to MSR loading + +From: Jim Mattson + +[ Upstream commit 0b88abdc3f964c28ec03bc69eb17cb6b3b034564 ] + +This exit qualification was inadvertently dropped when the two +VM-entry failure blocks were coalesced. + +Fixes: e79f245ddec1 ("X86/KVM: Properly update 'tsc_offset' to represent the running guest") +Signed-off-by: Jim Mattson +Reviewed-by: Krish Sadhukhan +Reviewed-by: David Hildenbrand +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/vmx.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -11791,7 +11791,6 @@ static int enter_vmx_non_root_mode(struc + { + struct vcpu_vmx *vmx = to_vmx(vcpu); + struct vmcs12 *vmcs12 = get_vmcs12(vcpu); +- u32 msr_entry_idx; + u32 exit_qual; + int r; + +@@ -11813,10 +11812,10 @@ static int enter_vmx_non_root_mode(struc + nested_get_vmcs12_pages(vcpu, vmcs12); + + r = EXIT_REASON_MSR_LOAD_FAIL; +- msr_entry_idx = nested_vmx_load_msr(vcpu, +- vmcs12->vm_entry_msr_load_addr, +- vmcs12->vm_entry_msr_load_count); +- if (msr_entry_idx) ++ exit_qual = nested_vmx_load_msr(vcpu, ++ vmcs12->vm_entry_msr_load_addr, ++ vmcs12->vm_entry_msr_load_count); ++ if (exit_qual) + goto fail; + + /* diff --git a/queue-4.17/kvmclock-fix-tsc-calibration-for-nested-guests.patch b/queue-4.17/kvmclock-fix-tsc-calibration-for-nested-guests.patch new file mode 100644 index 00000000000..54c3abe1164 --- /dev/null +++ b/queue-4.17/kvmclock-fix-tsc-calibration-for-nested-guests.patch @@ -0,0 +1,38 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Peng Hao +Date: Sat, 14 Jul 2018 23:28:29 +0800 +Subject: kvmclock: fix TSC calibration for nested guests + +From: Peng Hao + +[ Upstream commit e10f7805032365cc11c739a97f226ebb48aee042 ] + +Inside a nested guest, access to hardware can be slow enough that +tsc_read_refs always return ULLONG_MAX, causing tsc_refine_calibration_work +to be called periodically and the nested guest to spend a lot of time +reading the ACPI timer. + +However, if the TSC frequency is available from the pvclock page, +we can just set X86_FEATURE_TSC_KNOWN_FREQ and avoid the recalibration. +'refine' operation. + +Suggested-by: Peter Zijlstra +Signed-off-by: Peng Hao +[Commit message rewritten. - Paolo] +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/kvmclock.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/kernel/kvmclock.c ++++ b/arch/x86/kernel/kvmclock.c +@@ -138,6 +138,7 @@ static unsigned long kvm_get_tsc_khz(voi + src = &hv_clock[cpu].pvti; + tsc_khz = pvclock_tsc_khz(src); + put_cpu(); ++ setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ); + return tsc_khz; + } + diff --git a/queue-4.17/libahci-fix-possible-spectre-v1-pmp-indexing-in-ahci_led_store.patch b/queue-4.17/libahci-fix-possible-spectre-v1-pmp-indexing-in-ahci_led_store.patch new file mode 100644 index 00000000000..4fafd8f9d6d --- /dev/null +++ b/queue-4.17/libahci-fix-possible-spectre-v1-pmp-indexing-in-ahci_led_store.patch @@ -0,0 +1,55 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: John Garry +Date: Fri, 8 Jun 2018 18:26:33 +0800 +Subject: libahci: Fix possible Spectre-v1 pmp indexing in ahci_led_store() + +From: John Garry + +[ Upstream commit fae2a63737e5973f1426bc139935a0f42e232844 ] + +Currently smatch warns of possible Spectre-V1 issue in ahci_led_store(): +drivers/ata/libahci.c:1150 ahci_led_store() warn: potential spectre issue 'pp->em_priv' (local cap) + +Userspace controls @pmp from following callchain: +em_message->store() +->ata_scsi_em_message_store() +-->ap->ops->em_store() +--->ahci_led_store() + +After the mask+shift @pmp is effectively an 8b value, which is used to +index into an array of length 8, so sanitize the array index. + +Signed-off-by: John Garry +Signed-off-by: Tejun Heo + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libahci.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1146,10 +1147,12 @@ static ssize_t ahci_led_store(struct ata + + /* get the slot number from the message */ + pmp = (state & EM_MSG_LED_PMP_SLOT) >> 8; +- if (pmp < EM_MAX_SLOTS) ++ if (pmp < EM_MAX_SLOTS) { ++ pmp = array_index_nospec(pmp, EM_MAX_SLOTS); + emp = &pp->em_priv[pmp]; +- else ++ } else { + return -EINVAL; ++ } + + /* mask off the activity bits if we are in sw_activity + * mode, user should turn off sw_activity before setting diff --git a/queue-4.17/locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch b/queue-4.17/locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch new file mode 100644 index 00000000000..80b5461613d --- /dev/null +++ b/queue-4.17/locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch @@ -0,0 +1,82 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: "Steven Rostedt (VMware)" +Date: Wed, 4 Apr 2018 14:06:30 -0400 +Subject: locking/lockdep: Do not record IRQ state within lockdep code + +From: "Steven Rostedt (VMware)" + +[ Upstream commit fcc784be837714a9173b372ff9fb9b514590dad9 ] + +While debugging where things were going wrong with mapping +enabling/disabling interrupts with the lockdep state and actual real +enabling and disabling interrupts, I had to silent the IRQ +disabling/enabling in debug_check_no_locks_freed() because it was +always showing up as it was called before the splat was. + +Use raw_local_irq_save/restore() for not only debug_check_no_locks_freed() +but for all internal lockdep functions, as they hide useful information +about where interrupts were used incorrectly last. + +Signed-off-by: Steven Rostedt (VMware) +Cc: Andrew Morton +Cc: Linus Torvalds +Cc: Paul E. McKenney +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Will Deacon +Link: https://lkml.kernel.org/lkml/20180404140630.3f4f4c7a@gandalf.local.home +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/locking/lockdep.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -1261,11 +1261,11 @@ unsigned long lockdep_count_forward_deps + this.parent = NULL; + this.class = class; + +- local_irq_save(flags); ++ raw_local_irq_save(flags); + arch_spin_lock(&lockdep_lock); + ret = __lockdep_count_forward_deps(&this); + arch_spin_unlock(&lockdep_lock); +- local_irq_restore(flags); ++ raw_local_irq_restore(flags); + + return ret; + } +@@ -1288,11 +1288,11 @@ unsigned long lockdep_count_backward_dep + this.parent = NULL; + this.class = class; + +- local_irq_save(flags); ++ raw_local_irq_save(flags); + arch_spin_lock(&lockdep_lock); + ret = __lockdep_count_backward_deps(&this); + arch_spin_unlock(&lockdep_lock); +- local_irq_restore(flags); ++ raw_local_irq_restore(flags); + + return ret; + } +@@ -4407,7 +4407,7 @@ void debug_check_no_locks_freed(const vo + if (unlikely(!debug_locks)) + return; + +- local_irq_save(flags); ++ raw_local_irq_save(flags); + for (i = 0; i < curr->lockdep_depth; i++) { + hlock = curr->held_locks + i; + +@@ -4418,7 +4418,7 @@ void debug_check_no_locks_freed(const vo + print_freed_lock_bug(curr, mem_from, mem_from + mem_len, hlock); + break; + } +- local_irq_restore(flags); ++ raw_local_irq_restore(flags); + } + EXPORT_SYMBOL_GPL(debug_check_no_locks_freed); + diff --git a/queue-4.17/m68k-fix-bad-page-state-oops-on-coldfire-boot.patch b/queue-4.17/m68k-fix-bad-page-state-oops-on-coldfire-boot.patch new file mode 100644 index 00000000000..e489dfd8f5d --- /dev/null +++ b/queue-4.17/m68k-fix-bad-page-state-oops-on-coldfire-boot.patch @@ -0,0 +1,64 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Greg Ungerer +Date: Mon, 18 Jun 2018 15:34:14 +1000 +Subject: m68k: fix "bad page state" oops on ColdFire boot + +From: Greg Ungerer + +[ Upstream commit ecd60532e060e45c63c57ecf1c8549b1d656d34d ] + +Booting a ColdFire m68k core with MMU enabled causes a "bad page state" +oops since commit 1d40a5ea01d5 ("mm: mark pages in use for page tables"): + + BUG: Bad page state in process sh pfn:01ce2 + page:004fefc8 count:0 mapcount:-1024 mapping:00000000 index:0x0 + flags: 0x0() + raw: 00000000 00000000 00000000 fffffbff 00000000 00000100 00000200 00000000 + raw: 039c4000 + page dumped because: nonzero mapcount + Modules linked in: + CPU: 0 PID: 22 Comm: sh Not tainted 4.17.0-07461-g1d40a5ea01d5 #13 + +Fix by calling pgtable_page_dtor() in our __pte_free_tlb() code path, +so that the PG_table flag is cleared before we free the pte page. + +Note that I had to change the type of pte_free() to be static from +extern. Otherwise you get a lot of warnings like this: + +./arch/m68k/include/asm/mcf_pgalloc.h:80:2: warning: ‘pgtable_page_dtor’ is static but used in inline function ‘pte_free’ which is not static + pgtable_page_dtor(page); + ^ + +And making it static is consistent with our use of this in the other +m68k pgalloc definitions of pte_free(). + +Signed-off-by: Greg Ungerer +CC: Matthew Wilcox +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/m68k/include/asm/mcf_pgalloc.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/m68k/include/asm/mcf_pgalloc.h ++++ b/arch/m68k/include/asm/mcf_pgalloc.h +@@ -44,6 +44,7 @@ extern inline pmd_t *pmd_alloc_kernel(pg + static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page, + unsigned long address) + { ++ pgtable_page_dtor(page); + __free_page(page); + } + +@@ -74,8 +75,9 @@ static inline struct page *pte_alloc_one + return page; + } + +-extern inline void pte_free(struct mm_struct *mm, struct page *page) ++static inline void pte_free(struct mm_struct *mm, struct page *page) + { ++ pgtable_page_dtor(page); + __free_page(page); + } + diff --git a/queue-4.17/mac80211-disable-bhs-preemption-in-ieee80211_tx_control_port.patch b/queue-4.17/mac80211-disable-bhs-preemption-in-ieee80211_tx_control_port.patch new file mode 100644 index 00000000000..b894ad7d535 --- /dev/null +++ b/queue-4.17/mac80211-disable-bhs-preemption-in-ieee80211_tx_control_port.patch @@ -0,0 +1,43 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Denis Kenzior +Date: Tue, 19 Jun 2018 10:39:50 -0500 +Subject: mac80211: disable BHs/preemption in ieee80211_tx_control_port() + +From: Denis Kenzior + +[ Upstream commit e7441c9274a6a5453e06f4c2b8b5f72eca0a3f17 ] + +On pre-emption enabled kernels the following print was being seen due to +missing local_bh_disable/local_bh_enable calls. mac80211 assumes that +pre-emption is disabled in the data path. + + BUG: using smp_processor_id() in preemptible [00000000] code: iwd/517 + caller is __ieee80211_subif_start_xmit+0x144/0x210 [mac80211] + [...] + Call Trace: + dump_stack+0x5c/0x80 + check_preemption_disabled.cold.0+0x46/0x51 + __ieee80211_subif_start_xmit+0x144/0x210 [mac80211] + +Fixes: 911806491425 ("mac80211: Add support for tx_control_port") +Signed-off-by: Denis Kenzior +[commit message rewrite, fixes tag] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/tx.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -4800,7 +4800,9 @@ int ieee80211_tx_control_port(struct wip + skb_reset_network_header(skb); + skb_reset_mac_header(skb); + ++ local_bh_disable(); + __ieee80211_subif_start_xmit(skb, skb->dev, flags); ++ local_bh_enable(); + + return 0; + } diff --git a/queue-4.17/md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch b/queue-4.17/md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch new file mode 100644 index 00000000000..9560ab786ef --- /dev/null +++ b/queue-4.17/md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch @@ -0,0 +1,54 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: BingJing Chang +Date: Thu, 28 Jun 2018 18:40:11 +0800 +Subject: md/raid10: fix that replacement cannot complete recovery after reassemble + +From: BingJing Chang + +[ Upstream commit bda3153998f3eb2cafa4a6311971143628eacdbc ] + +During assemble, the spare marked for replacement is not checked. +conf->fullsync cannot be updated to be 1. As a result, recovery will +treat it as a clean array. All recovering sectors are skipped. Original +device is replaced with the not-recovered spare. + +mdadm -C /dev/md0 -l10 -n4 -pn2 /dev/loop[0123] +mdadm /dev/md0 -a /dev/loop4 +mdadm /dev/md0 --replace /dev/loop0 +mdadm -S /dev/md0 # stop array during recovery + +mdadm -A /dev/md0 /dev/loop[01234] + +After reassemble, you can see recovery go on, but it completes +immediately. In fact, recovery is not actually processed. + +To solve this problem, we just add the missing logics for replacment +spares. (In raid1.c or raid5.c, they have already been checked.) + +Reported-by: Alex Chen +Reviewed-by: Alex Wu +Reviewed-by: Chung-Chiang Cheng +Signed-off-by: BingJing Chang +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/raid10.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3892,6 +3892,13 @@ static int raid10_run(struct mddev *mdde + disk->rdev->saved_raid_disk < 0) + conf->fullsync = 1; + } ++ ++ if (disk->replacement && ++ !test_bit(In_sync, &disk->replacement->flags) && ++ disk->replacement->saved_raid_disk < 0) { ++ conf->fullsync = 1; ++ } ++ + disk->recovery_disabled = mddev->recovery_disabled - 1; + } + diff --git a/queue-4.17/mm-make-vm_area_alloc-initialize-core-fields.patch b/queue-4.17/mm-make-vm_area_alloc-initialize-core-fields.patch new file mode 100644 index 00000000000..e0aa1f22d13 --- /dev/null +++ b/queue-4.17/mm-make-vm_area_alloc-initialize-core-fields.patch @@ -0,0 +1,206 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Linus Torvalds +Date: Sat, 21 Jul 2018 15:24:03 -0700 +Subject: mm: make vm_area_alloc() initialize core fields + +From: Linus Torvalds + +[ Upstream commit 490fc053865c9cc40f1085ef8a5504f5341f79d2 ] + +Like vm_area_dup(), it initializes the anon_vma_chain head, and the +basic mm pointer. + +The rest of the fields end up being different for different users, +although the plan is to also initialize the 'vm_ops' field to a dummy +entry. + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/ia64/kernel/perfmon.c | 4 +--- + arch/ia64/mm/init.c | 8 ++------ + fs/exec.c | 4 +--- + include/linux/mm.h | 2 +- + kernel/fork.c | 10 ++++++++-- + mm/mmap.c | 12 +++--------- + mm/nommu.c | 3 +-- + 7 files changed, 17 insertions(+), 26 deletions(-) + +--- a/arch/ia64/kernel/perfmon.c ++++ b/arch/ia64/kernel/perfmon.c +@@ -2278,17 +2278,15 @@ pfm_smpl_buffer_alloc(struct task_struct + DPRINT(("smpl_buf @%p\n", smpl_buf)); + + /* allocate vma */ +- vma = vm_area_alloc(); ++ vma = vm_area_alloc(mm); + if (!vma) { + DPRINT(("Cannot allocate vma\n")); + goto error_kmem; + } +- INIT_LIST_HEAD(&vma->anon_vma_chain); + + /* + * partially initialize the vma for the sampling buffer + */ +- vma->vm_mm = mm; + vma->vm_file = get_file(filp); + vma->vm_flags = VM_READ|VM_MAYREAD|VM_DONTEXPAND|VM_DONTDUMP; + vma->vm_page_prot = PAGE_READONLY; /* XXX may need to change */ +--- a/arch/ia64/mm/init.c ++++ b/arch/ia64/mm/init.c +@@ -114,10 +114,8 @@ ia64_init_addr_space (void) + * the problem. When the process attempts to write to the register backing store + * for the first time, it will get a SEGFAULT in this case. + */ +- vma = vm_area_alloc(); ++ vma = vm_area_alloc(current->mm); + if (vma) { +- INIT_LIST_HEAD(&vma->anon_vma_chain); +- vma->vm_mm = current->mm; + vma->vm_start = current->thread.rbs_bot & PAGE_MASK; + vma->vm_end = vma->vm_start + PAGE_SIZE; + vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT; +@@ -133,10 +131,8 @@ ia64_init_addr_space (void) + + /* map NaT-page at address zero to speed up speculative dereferencing of NULL: */ + if (!(current->personality & MMAP_PAGE_ZERO)) { +- vma = vm_area_alloc(); ++ vma = vm_area_alloc(current->mm); + if (vma) { +- INIT_LIST_HEAD(&vma->anon_vma_chain); +- vma->vm_mm = current->mm; + vma->vm_end = PAGE_SIZE; + vma->vm_page_prot = __pgprot(pgprot_val(PAGE_READONLY) | _PAGE_MA_NAT); + vma->vm_flags = VM_READ | VM_MAYREAD | VM_IO | +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -290,7 +290,7 @@ static int __bprm_mm_init(struct linux_b + struct vm_area_struct *vma = NULL; + struct mm_struct *mm = bprm->mm; + +- bprm->vma = vma = vm_area_alloc(); ++ bprm->vma = vma = vm_area_alloc(mm); + if (!vma) + return -ENOMEM; + +@@ -298,7 +298,6 @@ static int __bprm_mm_init(struct linux_b + err = -EINTR; + goto err_free; + } +- vma->vm_mm = mm; + + /* + * Place the stack at the largest stack address the architecture +@@ -311,7 +310,6 @@ static int __bprm_mm_init(struct linux_b + vma->vm_start = vma->vm_end - PAGE_SIZE; + vma->vm_flags = VM_SOFTDIRTY | VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP; + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags); +- INIT_LIST_HEAD(&vma->anon_vma_chain); + + err = insert_vm_struct(mm, vma); + if (err) +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -154,7 +154,7 @@ extern int overcommit_kbytes_handler(str + * mmap() functions). + */ + +-struct vm_area_struct *vm_area_alloc(void); ++struct vm_area_struct *vm_area_alloc(struct mm_struct *); + struct vm_area_struct *vm_area_dup(struct vm_area_struct *); + void vm_area_free(struct vm_area_struct *); + +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -308,9 +308,15 @@ static struct kmem_cache *vm_area_cachep + /* SLAB cache for mm_struct structures (tsk->mm) */ + static struct kmem_cache *mm_cachep; + +-struct vm_area_struct *vm_area_alloc(void) ++struct vm_area_struct *vm_area_alloc(struct mm_struct *mm) + { +- return kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ struct vm_area_struct *vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ ++ if (vma) { ++ vma->vm_mm = mm; ++ INIT_LIST_HEAD(&vma->anon_vma_chain); ++ } ++ return vma; + } + + struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig) +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -1729,19 +1729,17 @@ unsigned long mmap_region(struct file *f + * specific mapper. the address has already been validated, but + * not unmapped, but the maps are removed from the list. + */ +- vma = vm_area_alloc(); ++ vma = vm_area_alloc(mm); + if (!vma) { + error = -ENOMEM; + goto unacct_error; + } + +- vma->vm_mm = mm; + vma->vm_start = addr; + vma->vm_end = addr + len; + vma->vm_flags = vm_flags; + vma->vm_page_prot = vm_get_page_prot(vm_flags); + vma->vm_pgoff = pgoff; +- INIT_LIST_HEAD(&vma->anon_vma_chain); + + if (file) { + if (vm_flags & VM_DENYWRITE) { +@@ -2979,14 +2977,12 @@ static int do_brk_flags(unsigned long ad + /* + * create a vma struct for an anonymous mapping + */ +- vma = vm_area_alloc(); ++ vma = vm_area_alloc(mm); + if (!vma) { + vm_unacct_memory(len >> PAGE_SHIFT); + return -ENOMEM; + } + +- INIT_LIST_HEAD(&vma->anon_vma_chain); +- vma->vm_mm = mm; + vma->vm_start = addr; + vma->vm_end = addr + len; + vma->vm_pgoff = pgoff; +@@ -3343,12 +3339,10 @@ static struct vm_area_struct *__install_ + int ret; + struct vm_area_struct *vma; + +- vma = vm_area_alloc(); ++ vma = vm_area_alloc(mm); + if (unlikely(vma == NULL)) + return ERR_PTR(-ENOMEM); + +- INIT_LIST_HEAD(&vma->anon_vma_chain); +- vma->vm_mm = mm; + vma->vm_start = addr; + vma->vm_end = addr + len; + +--- a/mm/nommu.c ++++ b/mm/nommu.c +@@ -1204,7 +1204,7 @@ unsigned long do_mmap(struct file *file, + if (!region) + goto error_getting_region; + +- vma = vm_area_alloc(); ++ vma = vm_area_alloc(current->mm); + if (!vma) + goto error_getting_vma; + +@@ -1212,7 +1212,6 @@ unsigned long do_mmap(struct file *file, + region->vm_flags = vm_flags; + region->vm_pgoff = pgoff; + +- INIT_LIST_HEAD(&vma->anon_vma_chain); + vma->vm_flags = vm_flags; + vma->vm_pgoff = pgoff; + diff --git a/queue-4.17/mm-make-vm_area_dup-actually-copy-the-old-vma-data.patch b/queue-4.17/mm-make-vm_area_dup-actually-copy-the-old-vma-data.patch new file mode 100644 index 00000000000..8aede491a63 --- /dev/null +++ b/queue-4.17/mm-make-vm_area_dup-actually-copy-the-old-vma-data.patch @@ -0,0 +1,87 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Linus Torvalds +Date: Sat, 21 Jul 2018 14:48:45 -0700 +Subject: mm: make vm_area_dup() actually copy the old vma data + +From: Linus Torvalds + +[ Upstream commit 95faf6992df468f617edb788da8c21c6eed0dfa7 ] + +.. and re-initialize th eanon_vma_chain head. + +This removes some boiler-plate from the users, and also makes it clear +why it didn't need use the 'zalloc()' version. + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/fork.c | 10 +++++++--- + mm/mmap.c | 7 ------- + mm/nommu.c | 1 - + 3 files changed, 7 insertions(+), 11 deletions(-) + +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -315,7 +315,13 @@ struct vm_area_struct *vm_area_alloc(voi + + struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig) + { +- return kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); ++ struct vm_area_struct *new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); ++ ++ if (new) { ++ *new = *orig; ++ INIT_LIST_HEAD(&new->anon_vma_chain); ++ } ++ return new; + } + + void vm_area_free(struct vm_area_struct *vma) +@@ -473,8 +479,6 @@ static __latent_entropy int dup_mmap(str + tmp = vm_area_dup(mpnt); + if (!tmp) + goto fail_nomem; +- *tmp = *mpnt; +- INIT_LIST_HEAD(&tmp->anon_vma_chain); + retval = vma_dup_policy(mpnt, tmp); + if (retval) + goto fail_nomem_policy; +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -2624,11 +2624,6 @@ int __split_vma(struct mm_struct *mm, st + if (!new) + return -ENOMEM; + +- /* most fields are the same, copy all, and then fixup */ +- *new = *vma; +- +- INIT_LIST_HEAD(&new->anon_vma_chain); +- + if (new_below) + new->vm_end = addr; + else { +@@ -3205,13 +3200,11 @@ struct vm_area_struct *copy_vma(struct v + new_vma = vm_area_dup(vma); + if (!new_vma) + goto out; +- *new_vma = *vma; + new_vma->vm_start = addr; + new_vma->vm_end = addr + len; + new_vma->vm_pgoff = pgoff; + if (vma_dup_policy(vma, new_vma)) + goto out_free_vma; +- INIT_LIST_HEAD(&new_vma->anon_vma_chain); + if (anon_vma_clone(new_vma, vma)) + goto out_free_mempol; + if (new_vma->vm_file) +--- a/mm/nommu.c ++++ b/mm/nommu.c +@@ -1476,7 +1476,6 @@ int split_vma(struct mm_struct *mm, stru + } + + /* most fields are the same, copy all, and then fixup */ +- *new = *vma; + *region = *vma->vm_region; + new->vm_region = region; + diff --git a/queue-4.17/mm-use-helper-functions-for-allocating-and-freeing-vm_area-structs.patch b/queue-4.17/mm-use-helper-functions-for-allocating-and-freeing-vm_area-structs.patch new file mode 100644 index 00000000000..a06e0c5e8da --- /dev/null +++ b/queue-4.17/mm-use-helper-functions-for-allocating-and-freeing-vm_area-structs.patch @@ -0,0 +1,325 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Linus Torvalds +Date: Sat, 21 Jul 2018 13:48:51 -0700 +Subject: mm: use helper functions for allocating and freeing vm_area structs + +From: Linus Torvalds + +[ Upstream commit 3928d4f5ee37cdc523894f6e549e6aae521d8980 ] + +The vm_area_struct is one of the most fundamental memory management +objects, but the management of it is entirely open-coded evertwhere, +ranging from allocation and freeing (using kmem_cache_[z]alloc and +kmem_cache_free) to initializing all the fields. + +We want to unify this in order to end up having some unified +initialization of the vmas, and the first step to this is to at least +have basic allocation functions. + +Right now those functions are literally just wrappers around the +kmem_cache_*() calls. This is a purely mechanical conversion: + + # new vma: + kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL) -> vm_area_alloc() + + # copy old vma + kmem_cache_alloc(vm_area_cachep, GFP_KERNEL) -> vm_area_dup(old) + + # free vma + kmem_cache_free(vm_area_cachep, vma) -> vm_area_free(vma) + +to the point where the old vma passed in to the vm_area_dup() function +isn't even used yet (because I've left all the old manual initialization +alone). + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/ia64/kernel/perfmon.c | 4 ++-- + arch/ia64/mm/init.c | 8 ++++---- + fs/exec.c | 4 ++-- + include/linux/mm.h | 4 +++- + kernel/fork.c | 21 ++++++++++++++++++--- + mm/mmap.c | 22 +++++++++++----------- + mm/nommu.c | 8 ++++---- + 7 files changed, 44 insertions(+), 27 deletions(-) + +--- a/arch/ia64/kernel/perfmon.c ++++ b/arch/ia64/kernel/perfmon.c +@@ -2278,7 +2278,7 @@ pfm_smpl_buffer_alloc(struct task_struct + DPRINT(("smpl_buf @%p\n", smpl_buf)); + + /* allocate vma */ +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(); + if (!vma) { + DPRINT(("Cannot allocate vma\n")); + goto error_kmem; +@@ -2346,7 +2346,7 @@ pfm_smpl_buffer_alloc(struct task_struct + return 0; + + error: +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + error_kmem: + pfm_rvfree(smpl_buf, size); + +--- a/arch/ia64/mm/init.c ++++ b/arch/ia64/mm/init.c +@@ -114,7 +114,7 @@ ia64_init_addr_space (void) + * the problem. When the process attempts to write to the register backing store + * for the first time, it will get a SEGFAULT in this case. + */ +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(); + if (vma) { + INIT_LIST_HEAD(&vma->anon_vma_chain); + vma->vm_mm = current->mm; +@@ -125,7 +125,7 @@ ia64_init_addr_space (void) + down_write(¤t->mm->mmap_sem); + if (insert_vm_struct(current->mm, vma)) { + up_write(¤t->mm->mmap_sem); +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + return; + } + up_write(¤t->mm->mmap_sem); +@@ -133,7 +133,7 @@ ia64_init_addr_space (void) + + /* map NaT-page at address zero to speed up speculative dereferencing of NULL: */ + if (!(current->personality & MMAP_PAGE_ZERO)) { +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(); + if (vma) { + INIT_LIST_HEAD(&vma->anon_vma_chain); + vma->vm_mm = current->mm; +@@ -144,7 +144,7 @@ ia64_init_addr_space (void) + down_write(¤t->mm->mmap_sem); + if (insert_vm_struct(current->mm, vma)) { + up_write(¤t->mm->mmap_sem); +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + return; + } + up_write(¤t->mm->mmap_sem); +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -290,7 +290,7 @@ static int __bprm_mm_init(struct linux_b + struct vm_area_struct *vma = NULL; + struct mm_struct *mm = bprm->mm; + +- bprm->vma = vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ bprm->vma = vma = vm_area_alloc(); + if (!vma) + return -ENOMEM; + +@@ -326,7 +326,7 @@ err: + up_write(&mm->mmap_sem); + err_free: + bprm->vma = NULL; +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + return err; + } + +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -154,7 +154,9 @@ extern int overcommit_kbytes_handler(str + * mmap() functions). + */ + +-extern struct kmem_cache *vm_area_cachep; ++struct vm_area_struct *vm_area_alloc(void); ++struct vm_area_struct *vm_area_dup(struct vm_area_struct *); ++void vm_area_free(struct vm_area_struct *); + + #ifndef CONFIG_MMU + extern struct rb_root nommu_region_tree; +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -303,11 +303,26 @@ struct kmem_cache *files_cachep; + struct kmem_cache *fs_cachep; + + /* SLAB cache for vm_area_struct structures */ +-struct kmem_cache *vm_area_cachep; ++static struct kmem_cache *vm_area_cachep; + + /* SLAB cache for mm_struct structures (tsk->mm) */ + static struct kmem_cache *mm_cachep; + ++struct vm_area_struct *vm_area_alloc(void) ++{ ++ return kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++} ++ ++struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig) ++{ ++ return kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); ++} ++ ++void vm_area_free(struct vm_area_struct *vma) ++{ ++ kmem_cache_free(vm_area_cachep, vma); ++} ++ + static void account_kernel_stack(struct task_struct *tsk, int account) + { + void *stack = task_stack_page(tsk); +@@ -455,7 +470,7 @@ static __latent_entropy int dup_mmap(str + goto fail_nomem; + charge = len; + } +- tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); ++ tmp = vm_area_dup(mpnt); + if (!tmp) + goto fail_nomem; + *tmp = *mpnt; +@@ -539,7 +554,7 @@ fail_uprobe_end: + fail_nomem_anon_vma_fork: + mpol_put(vma_policy(tmp)); + fail_nomem_policy: +- kmem_cache_free(vm_area_cachep, tmp); ++ vm_area_free(tmp); + fail_nomem: + retval = -ENOMEM; + vm_unacct_memory(charge); +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -182,7 +182,7 @@ static struct vm_area_struct *remove_vma + if (vma->vm_file) + fput(vma->vm_file); + mpol_put(vma_policy(vma)); +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + return next; + } + +@@ -911,7 +911,7 @@ again: + anon_vma_merge(vma, next); + mm->map_count--; + mpol_put(vma_policy(next)); +- kmem_cache_free(vm_area_cachep, next); ++ vm_area_free(next); + /* + * In mprotect's case 6 (see comments on vma_merge), + * we must remove another next too. It would clutter +@@ -1729,7 +1729,7 @@ unsigned long mmap_region(struct file *f + * specific mapper. the address has already been validated, but + * not unmapped, but the maps are removed from the list. + */ +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(); + if (!vma) { + error = -ENOMEM; + goto unacct_error; +@@ -1832,7 +1832,7 @@ allow_write_and_free_vma: + if (vm_flags & VM_DENYWRITE) + allow_write_access(file); + free_vma: +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + unacct_error: + if (charged) + vm_unacct_memory(charged); +@@ -2620,7 +2620,7 @@ int __split_vma(struct mm_struct *mm, st + return err; + } + +- new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); ++ new = vm_area_dup(vma); + if (!new) + return -ENOMEM; + +@@ -2669,7 +2669,7 @@ int __split_vma(struct mm_struct *mm, st + out_free_mpol: + mpol_put(vma_policy(new)); + out_free_vma: +- kmem_cache_free(vm_area_cachep, new); ++ vm_area_free(new); + return err; + } + +@@ -2984,7 +2984,7 @@ static int do_brk_flags(unsigned long ad + /* + * create a vma struct for an anonymous mapping + */ +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(); + if (!vma) { + vm_unacct_memory(len >> PAGE_SHIFT); + return -ENOMEM; +@@ -3202,7 +3202,7 @@ struct vm_area_struct *copy_vma(struct v + } + *need_rmap_locks = (new_vma->vm_pgoff <= vma->vm_pgoff); + } else { +- new_vma = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); ++ new_vma = vm_area_dup(vma); + if (!new_vma) + goto out; + *new_vma = *vma; +@@ -3226,7 +3226,7 @@ struct vm_area_struct *copy_vma(struct v + out_free_mempol: + mpol_put(vma_policy(new_vma)); + out_free_vma: +- kmem_cache_free(vm_area_cachep, new_vma); ++ vm_area_free(new_vma); + out: + return NULL; + } +@@ -3350,7 +3350,7 @@ static struct vm_area_struct *__install_ + int ret; + struct vm_area_struct *vma; + +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(); + if (unlikely(vma == NULL)) + return ERR_PTR(-ENOMEM); + +@@ -3376,7 +3376,7 @@ static struct vm_area_struct *__install_ + return vma; + + out: +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + return ERR_PTR(ret); + } + +--- a/mm/nommu.c ++++ b/mm/nommu.c +@@ -769,7 +769,7 @@ static void delete_vma(struct mm_struct + if (vma->vm_file) + fput(vma->vm_file); + put_nommu_region(vma->vm_region); +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + } + + /* +@@ -1204,7 +1204,7 @@ unsigned long do_mmap(struct file *file, + if (!region) + goto error_getting_region; + +- vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); ++ vma = vm_area_alloc(); + if (!vma) + goto error_getting_vma; + +@@ -1368,7 +1368,7 @@ error: + kmem_cache_free(vm_region_jar, region); + if (vma->vm_file) + fput(vma->vm_file); +- kmem_cache_free(vm_area_cachep, vma); ++ vm_area_free(vma); + return ret; + + sharing_violation: +@@ -1469,7 +1469,7 @@ int split_vma(struct mm_struct *mm, stru + if (!region) + return -ENOMEM; + +- new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL); ++ new = vm_area_dup(vma); + if (!new) { + kmem_cache_free(vm_region_jar, region); + return -ENOMEM; diff --git a/queue-4.17/mtd-dataflash-use-ull-suffix-for-64-bit-constants.patch b/queue-4.17/mtd-dataflash-use-ull-suffix-for-64-bit-constants.patch new file mode 100644 index 00000000000..59ad08dc0f8 --- /dev/null +++ b/queue-4.17/mtd-dataflash-use-ull-suffix-for-64-bit-constants.patch @@ -0,0 +1,39 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Geert Uytterhoeven +Date: Fri, 22 Jun 2018 09:04:25 +0200 +Subject: mtd: dataflash: Use ULL suffix for 64-bit constants + +From: Geert Uytterhoeven + +[ Upstream commit cbdceb9b3e1928554fffd0d889adf2d0d8edee4d ] + +With gcc 4.1.2 when compiling for 32-bit: + + drivers/mtd/devices/mtd_dataflash.c:736: warning: integer constant is too large for ‘long’ type + drivers/mtd/devices/mtd_dataflash.c:737: warning: integer constant is too large for ‘long’ type + +Add the missing "ULL" suffixes to fix this. + +Fixes: 67e4145ebf2c161d ("mtd: dataflash: Add flash_info for AT45DB641E") +Signed-off-by: Geert Uytterhoeven +Acked-by: Andrey Smirnov +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/devices/mtd_dataflash.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/devices/mtd_dataflash.c ++++ b/drivers/mtd/devices/mtd_dataflash.c +@@ -733,8 +733,8 @@ static struct flash_info dataflash_data[ + { "AT45DB642x", 0x1f2800, 8192, 1056, 11, SUP_POW2PS}, + { "at45db642d", 0x1f2800, 8192, 1024, 10, SUP_POW2PS | IS_POW2PS}, + +- { "AT45DB641E", 0x1f28000100, 32768, 264, 9, SUP_EXTID | SUP_POW2PS}, +- { "at45db641e", 0x1f28000100, 32768, 256, 8, SUP_EXTID | SUP_POW2PS | IS_POW2PS}, ++ { "AT45DB641E", 0x1f28000100ULL, 32768, 264, 9, SUP_EXTID | SUP_POW2PS}, ++ { "at45db641e", 0x1f28000100ULL, 32768, 256, 8, SUP_EXTID | SUP_POW2PS | IS_POW2PS}, + }; + + static struct flash_info *jedec_lookup(struct spi_device *spi, diff --git a/queue-4.17/nbd-add-the-nbd-nbd_disconnect_on_close-config-flag.patch b/queue-4.17/nbd-add-the-nbd-nbd_disconnect_on_close-config-flag.patch new file mode 100644 index 00000000000..bad4c033731 --- /dev/null +++ b/queue-4.17/nbd-add-the-nbd-nbd_disconnect_on_close-config-flag.patch @@ -0,0 +1,142 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Doron Roberts-Kedes +Date: Fri, 15 Jun 2018 14:05:32 -0700 +Subject: nbd: Add the nbd NBD_DISCONNECT_ON_CLOSE config flag. + +From: Doron Roberts-Kedes + +[ Upstream commit 08ba91ee6e2c1c08d3f0648f978cbb5dbf3491d8 ] + +If NBD_DISCONNECT_ON_CLOSE is set on a device, then the driver will +issue a disconnect from nbd_release if the device has no remaining +bdev->bd_openers. + +Fix ret val so reconfigure with only setting the flag succeeds. + +Reviewed-by: Josef Bacik +Signed-off-by: Doron Roberts-Kedes +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/nbd.c | 40 +++++++++++++++++++++++++++++++++------- + include/uapi/linux/nbd.h | 3 +++ + 2 files changed, 36 insertions(+), 7 deletions(-) + +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -76,6 +76,7 @@ struct link_dead_args { + #define NBD_HAS_CONFIG_REF 4 + #define NBD_BOUND 5 + #define NBD_DESTROY_ON_DISCONNECT 6 ++#define NBD_DISCONNECT_ON_CLOSE 7 + + struct nbd_config { + u32 flags; +@@ -138,6 +139,7 @@ static void nbd_config_put(struct nbd_de + static void nbd_connect_reply(struct genl_info *info, int index); + static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info); + static void nbd_dead_link_work(struct work_struct *work); ++static void nbd_disconnect_and_put(struct nbd_device *nbd); + + static inline struct device *nbd_to_dev(struct nbd_device *nbd) + { +@@ -1291,6 +1293,12 @@ out: + static void nbd_release(struct gendisk *disk, fmode_t mode) + { + struct nbd_device *nbd = disk->private_data; ++ struct block_device *bdev = bdget_disk(disk, 0); ++ ++ if (test_bit(NBD_DISCONNECT_ON_CLOSE, &nbd->config->runtime_flags) && ++ bdev->bd_openers == 0) ++ nbd_disconnect_and_put(nbd); ++ + nbd_config_put(nbd); + nbd_put(nbd); + } +@@ -1690,6 +1698,10 @@ again: + &config->runtime_flags); + put_dev = true; + } ++ if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) { ++ set_bit(NBD_DISCONNECT_ON_CLOSE, ++ &config->runtime_flags); ++ } + } + + if (info->attrs[NBD_ATTR_SOCKETS]) { +@@ -1734,6 +1746,16 @@ out: + return ret; + } + ++static void nbd_disconnect_and_put(struct nbd_device *nbd) ++{ ++ mutex_lock(&nbd->config_lock); ++ nbd_disconnect(nbd); ++ mutex_unlock(&nbd->config_lock); ++ if (test_and_clear_bit(NBD_HAS_CONFIG_REF, ++ &nbd->config->runtime_flags)) ++ nbd_config_put(nbd); ++} ++ + static int nbd_genl_disconnect(struct sk_buff *skb, struct genl_info *info) + { + struct nbd_device *nbd; +@@ -1766,12 +1788,7 @@ static int nbd_genl_disconnect(struct sk + nbd_put(nbd); + return 0; + } +- mutex_lock(&nbd->config_lock); +- nbd_disconnect(nbd); +- mutex_unlock(&nbd->config_lock); +- if (test_and_clear_bit(NBD_HAS_CONFIG_REF, +- &nbd->config->runtime_flags)) +- nbd_config_put(nbd); ++ nbd_disconnect_and_put(nbd); + nbd_config_put(nbd); + nbd_put(nbd); + return 0; +@@ -1782,7 +1799,7 @@ static int nbd_genl_reconfigure(struct s + struct nbd_device *nbd = NULL; + struct nbd_config *config; + int index; +- int ret = -EINVAL; ++ int ret = 0; + bool put_dev = false; + + if (!netlink_capable(skb, CAP_SYS_ADMIN)) +@@ -1822,6 +1839,7 @@ static int nbd_genl_reconfigure(struct s + !nbd->task_recv) { + dev_err(nbd_to_dev(nbd), + "not configured, cannot reconfigure\n"); ++ ret = -EINVAL; + goto out; + } + +@@ -1846,6 +1864,14 @@ static int nbd_genl_reconfigure(struct s + &config->runtime_flags)) + refcount_inc(&nbd->refs); + } ++ ++ if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) { ++ set_bit(NBD_DISCONNECT_ON_CLOSE, ++ &config->runtime_flags); ++ } else { ++ clear_bit(NBD_DISCONNECT_ON_CLOSE, ++ &config->runtime_flags); ++ } + } + + if (info->attrs[NBD_ATTR_SOCKETS]) { +--- a/include/uapi/linux/nbd.h ++++ b/include/uapi/linux/nbd.h +@@ -53,6 +53,9 @@ enum { + /* These are client behavior specific flags. */ + #define NBD_CFLAG_DESTROY_ON_DISCONNECT (1 << 0) /* delete the nbd device on + disconnect. */ ++#define NBD_CFLAG_DISCONNECT_ON_CLOSE (1 << 1) /* disconnect the nbd device on ++ * close by last opener. ++ */ + + /* userspace doesn't need the nbd_device structure */ + diff --git a/queue-4.17/nds32-fix-the-dts-pointer-is-not-passed-correctly-issue.patch b/queue-4.17/nds32-fix-the-dts-pointer-is-not-passed-correctly-issue.patch new file mode 100644 index 00000000000..1591e5a2f42 --- /dev/null +++ b/queue-4.17/nds32-fix-the-dts-pointer-is-not-passed-correctly-issue.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Greentime Hu +Date: Thu, 28 Jun 2018 18:29:21 +0800 +Subject: nds32: Fix the dts pointer is not passed correctly issue. + +From: Greentime Hu + +[ Upstream commit 6897e6ecb3167598cb45e1a1424dd4d5e3778837 ] + +We found that the original implementation will only use the built-in dtb +pointer instead of the pointer pass from bootloader. This bug is fixed +by this patch. + +Signed-off-by: Greentime Hu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/nds32/kernel/setup.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/nds32/kernel/setup.c ++++ b/arch/nds32/kernel/setup.c +@@ -278,7 +278,8 @@ static void __init setup_memory(void) + + void __init setup_arch(char **cmdline_p) + { +- early_init_devtree( __dtb_start); ++ early_init_devtree(__atags_pointer ? \ ++ phys_to_virt(__atags_pointer) : __dtb_start); + + setup_cpuinfo(); + diff --git a/queue-4.17/net-9p-client.c-put-refcount-of-trans_mod-in-error-case-in-parse_opts.patch b/queue-4.17/net-9p-client.c-put-refcount-of-trans_mod-in-error-case-in-parse_opts.patch new file mode 100644 index 00000000000..87d7ca2efb7 --- /dev/null +++ b/queue-4.17/net-9p-client.c-put-refcount-of-trans_mod-in-error-case-in-parse_opts.patch @@ -0,0 +1,52 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: piaojun +Date: Fri, 13 Jul 2018 16:59:06 -0700 +Subject: net/9p/client.c: put refcount of trans_mod in error case in parse_opts() + +From: piaojun + +[ Upstream commit c290fba8c4ce6530cd941ea14db5a4ac2f77183f ] + +In my testing, the second mount will fail after umounting successfully. +The reason is that we put refcount of trans_mod in the correct case +rather than the error case in parse_opts() at last. That will cause the +refcount decrease to -1, and when we try to get trans_mod again in +try_module_get(), we could only increase refcount to 0 which will cause +failure as follows: + +parse_opts + v9fs_get_trans_by_name + try_module_get : return NULL to caller which cause error + +So we should put refcount of trans_mod in error case. + +Link: http://lkml.kernel.org/r/5B3F39A0.2030509@huawei.com +Fixes: 9421c3e64137ec ("net/9p/client.c: fix potential refcnt problem of trans module") +Signed-off-by: Jun Piao +Reviewed-by: Yiwen Jiang +Reviewed-by: Greg Kurz +Reviewed-by: Dominique Martinet +Tested-by: Dominique Martinet +Cc: Eric Van Hensbergen +Cc: Ron Minnich +Cc: Latchesar Ionkov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/9p/client.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -228,7 +228,8 @@ static int parse_opts(char *opts, struct + } + + free_and_return: +- v9fs_put_trans(clnt->trans_mod); ++ if (ret) ++ v9fs_put_trans(clnt->trans_mod); + kfree(tmp_options); + return ret; + } diff --git a/queue-4.17/net-cavium-add-fine-granular-dependencies-on-pci.patch b/queue-4.17/net-cavium-add-fine-granular-dependencies-on-pci.patch new file mode 100644 index 00000000000..808b7a02c11 --- /dev/null +++ b/queue-4.17/net-cavium-add-fine-granular-dependencies-on-pci.patch @@ -0,0 +1,74 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Alexander Sverdlin +Date: Tue, 17 Jul 2018 18:23:58 +0200 +Subject: net: cavium: Add fine-granular dependencies on PCI + +From: Alexander Sverdlin + +[ Upstream commit e40562abdf81f32356218d4196c33f5f93c040f7 ] + +Add dependencies on PCI where necessary. + +Fixes: 7e2bc7fb65 ("net: cavium: Drop dependency of NET_VENDOR_CAVIUM on PCI") +Signed-off-by: Alexander Sverdlin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cavium/Kconfig | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/cavium/Kconfig ++++ b/drivers/net/ethernet/cavium/Kconfig +@@ -15,7 +15,7 @@ if NET_VENDOR_CAVIUM + + config THUNDER_NIC_PF + tristate "Thunder Physical function driver" +- depends on 64BIT ++ depends on 64BIT && PCI + select THUNDER_NIC_BGX + ---help--- + This driver supports Thunder's NIC physical function. +@@ -28,13 +28,13 @@ config THUNDER_NIC_PF + config THUNDER_NIC_VF + tristate "Thunder Virtual function driver" + imply CAVIUM_PTP +- depends on 64BIT ++ depends on 64BIT && PCI + ---help--- + This driver supports Thunder's NIC virtual function + + config THUNDER_NIC_BGX + tristate "Thunder MAC interface driver (BGX)" +- depends on 64BIT ++ depends on 64BIT && PCI + select PHYLIB + select MDIO_THUNDER + select THUNDER_NIC_RGX +@@ -44,7 +44,7 @@ config THUNDER_NIC_BGX + + config THUNDER_NIC_RGX + tristate "Thunder MAC interface driver (RGX)" +- depends on 64BIT ++ depends on 64BIT && PCI + select PHYLIB + select MDIO_THUNDER + ---help--- +@@ -53,7 +53,7 @@ config THUNDER_NIC_RGX + + config CAVIUM_PTP + tristate "Cavium PTP coprocessor as PTP clock" +- depends on 64BIT ++ depends on 64BIT && PCI + imply PTP_1588_CLOCK + default y + ---help--- +@@ -65,7 +65,7 @@ config CAVIUM_PTP + + config LIQUIDIO + tristate "Cavium LiquidIO support" +- depends on 64BIT ++ depends on 64BIT && PCI + depends on MAY_USE_DEVLINK + imply PTP_1588_CLOCK + select FW_LOADER diff --git a/queue-4.17/net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch b/queue-4.17/net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch new file mode 100644 index 00000000000..15cdb40b8dc --- /dev/null +++ b/queue-4.17/net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Bartosz Golaszewski +Date: Wed, 20 Jun 2018 10:03:56 +0200 +Subject: net: davinci_emac: match the mdio device against its compatible if possible + +From: Bartosz Golaszewski + +[ Upstream commit ea0820bb771175c7d4192fc6f5b5c56b3c6d5239 ] + +Device tree based systems without of_dev_auxdata will have the mdio +device named differently than "davinci_mdio(.0)". In this case use the +device's parent's compatible string for matching + +Signed-off-by: Bartosz Golaszewski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/davinci_emac.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -1387,6 +1387,10 @@ static int emac_devioctl(struct net_devi + + static int match_first_device(struct device *dev, void *data) + { ++ if (dev->parent && dev->parent->of_node) ++ return of_device_is_compatible(dev->parent->of_node, ++ "ti,davinci_mdio"); ++ + return !strncmp(dev_name(dev), "davinci_mdio", 12); + } + diff --git a/queue-4.17/net-ethernet-freescale-fman-fix-cross-build-error.patch b/queue-4.17/net-ethernet-freescale-fman-fix-cross-build-error.patch new file mode 100644 index 00000000000..ae43cb9f7b7 --- /dev/null +++ b/queue-4.17/net-ethernet-freescale-fman-fix-cross-build-error.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Randy Dunlap +Date: Fri, 13 Jul 2018 21:25:19 -0700 +Subject: net/ethernet/freescale/fman: fix cross-build error + +From: Randy Dunlap + +[ Upstream commit c133459765fae249ba482f62e12f987aec4376f0 ] + + CC [M] drivers/net/ethernet/freescale/fman/fman.o +In file included from ../drivers/net/ethernet/freescale/fman/fman.c:35: +../include/linux/fsl/guts.h: In function 'guts_set_dmacr': +../include/linux/fsl/guts.h:165:2: error: implicit declaration of function 'clrsetbits_be32' [-Werror=implicit-function-declaration] + clrsetbits_be32(&guts->dmacr, 3 << shift, device << shift); + ^~~~~~~~~~~~~~~ + +Signed-off-by: Randy Dunlap +Cc: Madalin Bucur +Cc: netdev@vger.kernel.org +Cc: linuxppc-dev@lists.ozlabs.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/fsl/guts.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/linux/fsl/guts.h ++++ b/include/linux/fsl/guts.h +@@ -16,6 +16,7 @@ + #define __FSL_GUTS_H__ + + #include ++#include + + /** + * Global Utility Registers. diff --git a/queue-4.17/net-hamradio-use-eth_broadcast_addr.patch b/queue-4.17/net-hamradio-use-eth_broadcast_addr.patch new file mode 100644 index 00000000000..a4ecd99a2ae --- /dev/null +++ b/queue-4.17/net-hamradio-use-eth_broadcast_addr.patch @@ -0,0 +1,52 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Stefan Agner +Date: Sun, 17 Jun 2018 23:40:53 +0200 +Subject: net: hamradio: use eth_broadcast_addr + +From: Stefan Agner + +[ Upstream commit 4e8439aa34802deab11cee68b0ecb18f887fb153 ] + +The array bpq_eth_addr is only used to get the size of an +address, whereas the bcast_addr is used to set the broadcast +address. This leads to a warning when using clang: +drivers/net/hamradio/bpqether.c:94:13: warning: variable 'bpq_eth_addr' is not + needed and will not be emitted [-Wunneeded-internal-declaration] +static char bpq_eth_addr[6]; + ^ + +Remove both variables and use the common eth_broadcast_addr +to set the broadcast address. + +Signed-off-by: Stefan Agner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/hamradio/bpqether.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/net/hamradio/bpqether.c ++++ b/drivers/net/hamradio/bpqether.c +@@ -89,10 +89,6 @@ + static const char banner[] __initconst = KERN_INFO \ + "AX.25: bpqether driver version 004\n"; + +-static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF}; +- +-static char bpq_eth_addr[6]; +- + static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *); + static int bpq_device_event(struct notifier_block *, unsigned long, void *); + +@@ -515,8 +511,8 @@ static int bpq_new_device(struct net_dev + bpq->ethdev = edev; + bpq->axdev = ndev; + +- memcpy(bpq->dest_addr, bcast_addr, sizeof(bpq_eth_addr)); +- memcpy(bpq->acpt_addr, bcast_addr, sizeof(bpq_eth_addr)); ++ eth_broadcast_addr(bpq->dest_addr); ++ eth_broadcast_addr(bpq->acpt_addr); + + err = register_netdevice(ndev); + if (err) diff --git a/queue-4.17/net-ieee802154-adf7242-fix-erroneous-rx-enable.patch b/queue-4.17/net-ieee802154-adf7242-fix-erroneous-rx-enable.patch new file mode 100644 index 00000000000..bc5534b99a2 --- /dev/null +++ b/queue-4.17/net-ieee802154-adf7242-fix-erroneous-rx-enable.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Michael Hennerich +Date: Mon, 25 Jun 2018 16:49:51 +0300 +Subject: net: ieee802154: adf7242: Fix erroneous RX enable + +From: Michael Hennerich + +[ Upstream commit 36d26d6b6208399070a9d7993534fef9fc26b1ba ] + +Only enable RX mode if the netdev is opened. + +Signed-off-by: Michael Hennerich +Signed-off-by: Alexandru Ardelean +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/adf7242.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/ieee802154/adf7242.c ++++ b/drivers/net/ieee802154/adf7242.c +@@ -719,7 +719,10 @@ static int adf7242_channel(struct ieee80 + adf7242_write_reg(lp, REG_CH_FREQ1, freq >> 8); + adf7242_write_reg(lp, REG_CH_FREQ2, freq >> 16); + +- return adf7242_cmd(lp, CMD_RC_RX); ++ if (test_bit(FLAG_START, &lp->flags)) ++ return adf7242_cmd_rx(lp); ++ else ++ return adf7242_cmd(lp, CMD_RC_PHY_RDY); + } + + static int adf7242_set_hw_addr_filt(struct ieee802154_hw *hw, diff --git a/queue-4.17/net-ieee802154-adf7242-fix-ocl-calibration-runs.patch b/queue-4.17/net-ieee802154-adf7242-fix-ocl-calibration-runs.patch new file mode 100644 index 00000000000..9692bb30168 --- /dev/null +++ b/queue-4.17/net-ieee802154-adf7242-fix-ocl-calibration-runs.patch @@ -0,0 +1,112 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Michael Hennerich +Date: Mon, 25 Jun 2018 16:57:37 +0300 +Subject: net: ieee802154: adf7242: Fix OCL calibration runs + +From: Michael Hennerich + +[ Upstream commit 58e9683d14752debc6f22daf6b23e031787df31f ] + +Reissuing RC_RX every 400ms - to adjust for offset drift in +receiver see datasheet page 61, OCL section. + +Signed-off-by: Michael Hennerich +Signed-off-by: Alexandru Ardelean +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/adf7242.c | 29 ++++++++++++++++++++++++++++- + 1 file changed, 28 insertions(+), 1 deletion(-) + +--- a/drivers/net/ieee802154/adf7242.c ++++ b/drivers/net/ieee802154/adf7242.c +@@ -275,6 +275,8 @@ struct adf7242_local { + struct spi_message stat_msg; + struct spi_transfer stat_xfer; + struct dentry *debugfs_root; ++ struct delayed_work work; ++ struct workqueue_struct *wqueue; + unsigned long flags; + int tx_stat; + bool promiscuous; +@@ -575,10 +577,26 @@ static int adf7242_cmd_rx(struct adf7242 + /* Wait until the ACK is sent */ + adf7242_wait_status(lp, RC_STATUS_PHY_RDY, RC_STATUS_MASK, __LINE__); + adf7242_clear_irqstat(lp); ++ mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400)); + + return adf7242_cmd(lp, CMD_RC_RX); + } + ++static void adf7242_rx_cal_work(struct work_struct *work) ++{ ++ struct adf7242_local *lp = ++ container_of(work, struct adf7242_local, work.work); ++ ++ /* Reissuing RC_RX every 400ms - to adjust for offset ++ * drift in receiver (datasheet page 61, OCL section) ++ */ ++ ++ if (!test_bit(FLAG_XMIT, &lp->flags)) { ++ adf7242_cmd(lp, CMD_RC_PHY_RDY); ++ adf7242_cmd_rx(lp); ++ } ++} ++ + static int adf7242_set_txpower(struct ieee802154_hw *hw, int mbm) + { + struct adf7242_local *lp = hw->priv; +@@ -686,7 +704,7 @@ static int adf7242_start(struct ieee8021 + enable_irq(lp->spi->irq); + set_bit(FLAG_START, &lp->flags); + +- return adf7242_cmd(lp, CMD_RC_RX); ++ return adf7242_cmd_rx(lp); + } + + static void adf7242_stop(struct ieee802154_hw *hw) +@@ -694,6 +712,7 @@ static void adf7242_stop(struct ieee8021 + struct adf7242_local *lp = hw->priv; + + disable_irq(lp->spi->irq); ++ cancel_delayed_work_sync(&lp->work); + adf7242_cmd(lp, CMD_RC_IDLE); + clear_bit(FLAG_START, &lp->flags); + adf7242_clear_irqstat(lp); +@@ -817,6 +836,7 @@ static int adf7242_xmit(struct ieee80215 + /* ensure existing instances of the IRQ handler have completed */ + disable_irq(lp->spi->irq); + set_bit(FLAG_XMIT, &lp->flags); ++ cancel_delayed_work_sync(&lp->work); + reinit_completion(&lp->tx_complete); + adf7242_cmd(lp, CMD_RC_PHY_RDY); + adf7242_clear_irqstat(lp); +@@ -955,6 +975,7 @@ static irqreturn_t adf7242_isr(int irq, + unsigned int xmit; + u8 irq1; + ++ mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400)); + adf7242_read_reg(lp, REG_IRQ1_SRC1, &irq1); + + if (!(irq1 & (IRQ_RX_PKT_RCVD | IRQ_CSMA_CA))) +@@ -1244,6 +1265,9 @@ static int adf7242_probe(struct spi_devi + spi_message_add_tail(&lp->stat_xfer, &lp->stat_msg); + + spi_set_drvdata(spi, lp); ++ INIT_DELAYED_WORK(&lp->work, adf7242_rx_cal_work); ++ lp->wqueue = alloc_ordered_workqueue(dev_name(&spi->dev), ++ WQ_MEM_RECLAIM); + + ret = adf7242_hw_init(lp); + if (ret) +@@ -1287,6 +1311,9 @@ static int adf7242_remove(struct spi_dev + if (!IS_ERR_OR_NULL(lp->debugfs_root)) + debugfs_remove_recursive(lp->debugfs_root); + ++ cancel_delayed_work_sync(&lp->work); ++ destroy_workqueue(lp->wqueue); ++ + ieee802154_unregister_hw(lp->hw); + mutex_destroy(&lp->bmux); + ieee802154_free_hw(lp->hw); diff --git a/queue-4.17/net-macb-free-rx-ring-for-all-queues.patch b/queue-4.17/net-macb-free-rx-ring-for-all-queues.patch new file mode 100644 index 00000000000..2433c5c2c6c --- /dev/null +++ b/queue-4.17/net-macb-free-rx-ring-for-all-queues.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Harini Katakam +Date: Fri, 6 Jul 2018 12:18:57 +0530 +Subject: net: macb: Free RX ring for all queues + +From: Harini Katakam + +[ Upstream commit e50b770ea5c9eff0013e8ae714d20182ed50d5e6 ] + +rx ring is allocated for all queues in macb_alloc_consistent. +Free the same for all queues instead of just Q0. + +Signed-off-by: Harini Katakam +Reviewed-by: Claudiu Beznea +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cadence/macb_main.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -1818,13 +1818,7 @@ static void macb_free_consistent(struct + struct macb_queue *queue; + unsigned int q; + +- queue = &bp->queues[0]; + bp->macbgem_ops.mog_free_rx_buffers(bp); +- if (queue->rx_ring) { +- dma_free_coherent(&bp->pdev->dev, RX_RING_BYTES(bp), +- queue->rx_ring, queue->rx_ring_dma); +- queue->rx_ring = NULL; +- } + + for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) { + kfree(queue->tx_skb); +@@ -1834,6 +1828,11 @@ static void macb_free_consistent(struct + queue->tx_ring, queue->tx_ring_dma); + queue->tx_ring = NULL; + } ++ if (queue->rx_ring) { ++ dma_free_coherent(&bp->pdev->dev, RX_RING_BYTES(bp), ++ queue->rx_ring, queue->rx_ring_dma); ++ queue->rx_ring = NULL; ++ } + } + } + diff --git a/queue-4.17/net-mlx5-e-switch-disallow-vlan-spoofcheck-setup-if-not-being-esw-manager.patch b/queue-4.17/net-mlx5-e-switch-disallow-vlan-spoofcheck-setup-if-not-being-esw-manager.patch new file mode 100644 index 00000000000..e65d73376a9 --- /dev/null +++ b/queue-4.17/net-mlx5-e-switch-disallow-vlan-spoofcheck-setup-if-not-being-esw-manager.patch @@ -0,0 +1,99 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Eli Cohen +Date: Thu, 31 May 2018 12:24:48 +0300 +Subject: net/mlx5: E-Switch, Disallow vlan/spoofcheck setup if not being esw manager + +From: Eli Cohen + +[ Upstream commit a8d70a054a718b63058b3d3ac58b6181815e4289 ] + +In smartnic env, if the host (PF) driver is not an e-switch manager, we +are not allowed to apply eswitch ports setups such as vlan (VST), +spoof-checks, min/max rate or state. + +Make sure we are eswitch manager when coming to issue these callbacks +and err otherwise. + +Also fix the definition of ESW_ALLOWED to rely on eswitch_manager +capability and on the vport_group_manger. + +Operations on the VF nic vport context, such as setting a mac or reading +the vport counters are allowed to the PF in this scheme. + +The modify nic vport guid code was modified to omit checking the +nic_vport_node_guid_modify eswitch capability. +The reason for doing so is that modifying node guid requires vport group +manager capability, and there's no need to check further capabilities. + +1. set_vf_vlan - disallowed +2. set_vf_spoofchk - disallowed +3. set_vf_mac - allowed +4. get_vf_config - allowed +5. set_vf_trust - disallowed +6. set_vf_rate - disallowed +7. get_vf_stat - allowed +8. set_vf_link_state - disallowed + +Fixes: f942380c1239 ('net/mlx5: E-Switch, Vport ingress/egress ACLs rules for spoofchk') +Signed-off-by: Eli Cohen +Reviewed-by: Or Gerlitz +Tested-by: Or Gerlitz +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 12 +++++------- + drivers/net/ethernet/mellanox/mlx5/core/vport.c | 2 -- + 2 files changed, 5 insertions(+), 9 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -1594,17 +1594,15 @@ static void esw_disable_vport(struct mlx + } + + /* Public E-Switch API */ +-#define ESW_ALLOWED(esw) ((esw) && MLX5_VPORT_MANAGER((esw)->dev)) ++#define ESW_ALLOWED(esw) ((esw) && MLX5_ESWITCH_MANAGER((esw)->dev)) ++ + + int mlx5_eswitch_enable_sriov(struct mlx5_eswitch *esw, int nvfs, int mode) + { + int err; + int i, enabled_events; + +- if (!ESW_ALLOWED(esw)) +- return 0; +- +- if (!MLX5_ESWITCH_MANAGER(esw->dev) || ++ if (!ESW_ALLOWED(esw) || + !MLX5_CAP_ESW_FLOWTABLE_FDB(esw->dev, ft_support)) { + esw_warn(esw->dev, "E-Switch FDB is not supported, aborting ...\n"); + return -EOPNOTSUPP; +@@ -1806,7 +1804,7 @@ int mlx5_eswitch_set_vport_mac(struct ml + u64 node_guid; + int err = 0; + +- if (!ESW_ALLOWED(esw)) ++ if (!MLX5_CAP_GEN(esw->dev, vport_group_manager)) + return -EPERM; + if (!LEGAL_VPORT(esw, vport) || is_multicast_ether_addr(mac)) + return -EINVAL; +@@ -1883,7 +1881,7 @@ int mlx5_eswitch_get_vport_config(struct + { + struct mlx5_vport *evport; + +- if (!ESW_ALLOWED(esw)) ++ if (!MLX5_CAP_GEN(esw->dev, vport_group_manager)) + return -EPERM; + if (!LEGAL_VPORT(esw, vport)) + return -EINVAL; +--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c +@@ -549,8 +549,6 @@ int mlx5_modify_nic_vport_node_guid(stru + return -EINVAL; + if (!MLX5_CAP_GEN(mdev, vport_group_manager)) + return -EACCES; +- if (!MLX5_CAP_ESW(mdev, nic_vport_node_guid_modify)) +- return -EOPNOTSUPP; + + in = kvzalloc(inlen, GFP_KERNEL); + if (!in) diff --git a/queue-4.17/net-phy-marvell-change-default-m88e1510-led-configuration.patch b/queue-4.17/net-phy-marvell-change-default-m88e1510-led-configuration.patch new file mode 100644 index 00000000000..ecf3a4ecc6e --- /dev/null +++ b/queue-4.17/net-phy-marvell-change-default-m88e1510-led-configuration.patch @@ -0,0 +1,126 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Wang Dongsheng +Date: Sun, 1 Jul 2018 23:15:46 -0700 +Subject: net: phy: marvell: change default m88e1510 LED configuration + +From: Wang Dongsheng + +[ Upstream commit 077772468ec141b22e1e7c0c58bc09e2f9dc8762 ] + +The m88e1121 LED default configuration does not apply m88e151x. +So add a function to relpace m88e1121 LED configuration. + +Signed-off-by: Wang Dongsheng +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/marvell.c | 54 +++++++++++++++++++++++++++++--------------- + include/linux/marvell_phy.h | 2 + + 2 files changed, 38 insertions(+), 18 deletions(-) + +--- a/drivers/net/phy/marvell.c ++++ b/drivers/net/phy/marvell.c +@@ -130,8 +130,9 @@ + #define MII_88E1318S_PHY_WOL_CTRL_CLEAR_WOL_STATUS BIT(12) + #define MII_88E1318S_PHY_WOL_CTRL_MAGIC_PACKET_MATCH_ENABLE BIT(14) + +-#define MII_88E1121_PHY_LED_CTRL 16 ++#define MII_PHY_LED_CTRL 16 + #define MII_88E1121_PHY_LED_DEF 0x0030 ++#define MII_88E1510_PHY_LED_DEF 0x1177 + + #define MII_M1011_PHY_STATUS 0x11 + #define MII_M1011_PHY_STATUS_1000 0x8000 +@@ -632,8 +633,40 @@ error: + return err; + } + ++static void marvell_config_led(struct phy_device *phydev) ++{ ++ u16 def_config; ++ int err; ++ ++ switch (MARVELL_PHY_FAMILY_ID(phydev->phy_id)) { ++ /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */ ++ case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1121R): ++ case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1318S): ++ def_config = MII_88E1121_PHY_LED_DEF; ++ break; ++ /* Default PHY LED config: ++ * LED[0] .. 1000Mbps Link ++ * LED[1] .. 100Mbps Link ++ * LED[2] .. Blink, Activity ++ */ ++ case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1510): ++ def_config = MII_88E1510_PHY_LED_DEF; ++ break; ++ default: ++ return; ++ } ++ ++ err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE, MII_PHY_LED_CTRL, ++ def_config); ++ if (err < 0) ++ pr_warn("Fail to config marvell phy LED.\n"); ++} ++ + static int marvell_config_init(struct phy_device *phydev) + { ++ /* Set defalut LED */ ++ marvell_config_led(phydev); ++ + /* Set registers from marvell,reg-init DT property */ + return marvell_of_reg_init(phydev); + } +@@ -813,21 +846,6 @@ static int m88e1111_config_init(struct p + return genphy_soft_reset(phydev); + } + +-static int m88e1121_config_init(struct phy_device *phydev) +-{ +- int err; +- +- /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */ +- err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE, +- MII_88E1121_PHY_LED_CTRL, +- MII_88E1121_PHY_LED_DEF); +- if (err < 0) +- return err; +- +- /* Set marvell,reg-init configuration from device tree */ +- return marvell_config_init(phydev); +-} +- + static int m88e1318_config_init(struct phy_device *phydev) + { + if (phy_interrupt_is_valid(phydev)) { +@@ -841,7 +859,7 @@ static int m88e1318_config_init(struct p + return err; + } + +- return m88e1121_config_init(phydev); ++ return marvell_config_init(phydev); + } + + static int m88e1510_config_init(struct phy_device *phydev) +@@ -2090,7 +2108,7 @@ static struct phy_driver marvell_drivers + .features = PHY_GBIT_FEATURES, + .flags = PHY_HAS_INTERRUPT, + .probe = &m88e1121_probe, +- .config_init = &m88e1121_config_init, ++ .config_init = &marvell_config_init, + .config_aneg = &m88e1121_config_aneg, + .read_status = &marvell_read_status, + .ack_interrupt = &marvell_ack_interrupt, +--- a/include/linux/marvell_phy.h ++++ b/include/linux/marvell_phy.h +@@ -27,6 +27,8 @@ + */ + #define MARVELL_PHY_ID_88E6390 0x01410f90 + ++#define MARVELL_PHY_FAMILY_ID(id) ((id) >> 4) ++ + /* struct phy_device dev_flags definitions */ + #define MARVELL_PHY_M1145_FLAGS_RESISTANCE 0x00000001 + #define MARVELL_PHY_M1118_DNS323_LEDS 0x00000002 diff --git a/queue-4.17/net-propagate-dev_get_valid_name-return-code.patch b/queue-4.17/net-propagate-dev_get_valid_name-return-code.patch new file mode 100644 index 00000000000..fe0106fa6eb --- /dev/null +++ b/queue-4.17/net-propagate-dev_get_valid_name-return-code.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Li RongQing +Date: Tue, 19 Jun 2018 17:23:17 +0800 +Subject: net: propagate dev_get_valid_name return code + +From: Li RongQing + +[ Upstream commit 7892bd081045222b9e4027fec279a28d6fe7aa66 ] + +if dev_get_valid_name failed, propagate its return code + +and remove the setting err to ENODEV, it will be set to +0 again before dev_change_net_namespace exits. + +Signed-off-by: Li RongQing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/core/dev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -8608,7 +8608,8 @@ int dev_change_net_namespace(struct net_ + /* We get here if we can't use the current device name */ + if (!pat) + goto out; +- if (dev_get_valid_name(net, dev, pat) < 0) ++ err = dev_get_valid_name(net, dev, pat); ++ if (err < 0) + goto out; + } + +@@ -8620,7 +8621,6 @@ int dev_change_net_namespace(struct net_ + dev_close(dev); + + /* And unlink it from device chain */ +- err = -ENODEV; + unlist_netdevice(dev); + + synchronize_net(); diff --git a/queue-4.17/net-qca_spi-avoid-packet-drop-during-initial-sync.patch b/queue-4.17/net-qca_spi-avoid-packet-drop-during-initial-sync.patch new file mode 100644 index 00000000000..c11623db7e7 --- /dev/null +++ b/queue-4.17/net-qca_spi-avoid-packet-drop-during-initial-sync.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Stefan Wahren +Date: Wed, 18 Jul 2018 08:31:43 +0200 +Subject: net: qca_spi: Avoid packet drop during initial sync + +From: Stefan Wahren + +[ Upstream commit b2bab426dc715de147f8039a3fccff27d795f4eb ] + +As long as the synchronization with the QCA7000 isn't finished, we +cannot accept packets from the upper layers. So let the SPI thread +enable the TX queue after sync and avoid unwanted packet drop. + +Signed-off-by: Stefan Wahren +Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qualcomm/qca_spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -658,7 +658,7 @@ qcaspi_netdev_open(struct net_device *de + return ret; + } + +- netif_start_queue(qca->net_dev); ++ /* SPI thread takes care of TX queue */ + + return 0; + } diff --git a/queue-4.17/net-qca_spi-fix-log-level-if-probe-fails.patch b/queue-4.17/net-qca_spi-fix-log-level-if-probe-fails.patch new file mode 100644 index 00000000000..39b133bbc7e --- /dev/null +++ b/queue-4.17/net-qca_spi-fix-log-level-if-probe-fails.patch @@ -0,0 +1,62 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Stefan Wahren +Date: Wed, 18 Jul 2018 08:31:45 +0200 +Subject: net: qca_spi: Fix log level if probe fails + +From: Stefan Wahren + +[ Upstream commit 50973993260a6934f0a00da53d9b746cfbea89ab ] + +In cases the probing fails the log level of the messages should +be an error. + +Signed-off-by: Stefan Wahren +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qualcomm/qca_spi.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -881,22 +881,22 @@ qca_spi_probe(struct spi_device *spi) + + if ((qcaspi_clkspeed < QCASPI_CLK_SPEED_MIN) || + (qcaspi_clkspeed > QCASPI_CLK_SPEED_MAX)) { +- dev_info(&spi->dev, "Invalid clkspeed: %d\n", +- qcaspi_clkspeed); ++ dev_err(&spi->dev, "Invalid clkspeed: %d\n", ++ qcaspi_clkspeed); + return -EINVAL; + } + + if ((qcaspi_burst_len < QCASPI_BURST_LEN_MIN) || + (qcaspi_burst_len > QCASPI_BURST_LEN_MAX)) { +- dev_info(&spi->dev, "Invalid burst len: %d\n", +- qcaspi_burst_len); ++ dev_err(&spi->dev, "Invalid burst len: %d\n", ++ qcaspi_burst_len); + return -EINVAL; + } + + if ((qcaspi_pluggable < QCASPI_PLUGGABLE_MIN) || + (qcaspi_pluggable > QCASPI_PLUGGABLE_MAX)) { +- dev_info(&spi->dev, "Invalid pluggable: %d\n", +- qcaspi_pluggable); ++ dev_err(&spi->dev, "Invalid pluggable: %d\n", ++ qcaspi_pluggable); + return -EINVAL; + } + +@@ -958,8 +958,8 @@ qca_spi_probe(struct spi_device *spi) + } + + if (register_netdev(qcaspi_devs)) { +- dev_info(&spi->dev, "Unable to register net device %s\n", +- qcaspi_devs->name); ++ dev_err(&spi->dev, "Unable to register net device %s\n", ++ qcaspi_devs->name); + free_netdev(qcaspi_devs); + return -EFAULT; + } diff --git a/queue-4.17/net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch b/queue-4.17/net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch new file mode 100644 index 00000000000..b5079d1f8bc --- /dev/null +++ b/queue-4.17/net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Stefan Wahren +Date: Wed, 18 Jul 2018 08:31:44 +0200 +Subject: net: qca_spi: Make sure the QCA7000 reset is triggered + +From: Stefan Wahren + +[ Upstream commit 711c62dfa6bdb4326ca6c587f295ea5c4f7269de ] + +In case the SPI thread is not running, a simple reset of sync +state won't fix the transmit timeout. We also need to wake up the kernel +thread. + +Signed-off-by: Stefan Wahren +Fixes: ed7d42e24eff ("net: qca_spi: fix transmit queue timeout handling") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qualcomm/qca_spi.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -760,6 +760,9 @@ qcaspi_netdev_tx_timeout(struct net_devi + qca->net_dev->stats.tx_errors++; + /* Trigger tx queue flush and QCA7000 reset */ + qca->sync = QCASPI_SYNC_UNKNOWN; ++ ++ if (qca->spi_thread) ++ wake_up_process(qca->spi_thread); + } + + static int diff --git a/queue-4.17/net-qrtr-broadcast-messages-only-from-control-port.patch b/queue-4.17/net-qrtr-broadcast-messages-only-from-control-port.patch new file mode 100644 index 00000000000..09daf8bd7bf --- /dev/null +++ b/queue-4.17/net-qrtr-broadcast-messages-only-from-control-port.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Arun Kumar Neelakantam +Date: Wed, 4 Jul 2018 19:49:32 +0530 +Subject: net: qrtr: Broadcast messages only from control port + +From: Arun Kumar Neelakantam + +[ Upstream commit fdf5fd3975666804118e62c69de25dc85cc0909c ] + +The broadcast node id should only be sent with the control port id. + +Signed-off-by: Arun Kumar Neelakantam +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/qrtr/qrtr.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -764,6 +764,10 @@ static int qrtr_sendmsg(struct socket *s + node = NULL; + if (addr->sq_node == QRTR_NODE_BCAST) { + enqueue_fn = qrtr_bcast_enqueue; ++ if (addr->sq_port != QRTR_PORT_CTRL) { ++ release_sock(sk); ++ return -ENOTCONN; ++ } + } else if (addr->sq_node == ipc->us.sq_node) { + enqueue_fn = qrtr_local_enqueue; + } else { diff --git a/queue-4.17/net-qrtr-reset-the-node-and-port-id-of-broadcast-messages.patch b/queue-4.17/net-qrtr-reset-the-node-and-port-id-of-broadcast-messages.patch new file mode 100644 index 00000000000..8543bade5e9 --- /dev/null +++ b/queue-4.17/net-qrtr-reset-the-node-and-port-id-of-broadcast-messages.patch @@ -0,0 +1,39 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Arun Kumar Neelakantam +Date: Wed, 4 Jul 2018 19:49:33 +0530 +Subject: net: qrtr: Reset the node and port ID of broadcast messages + +From: Arun Kumar Neelakantam + +[ Upstream commit d27e77a3de2866b0a772803fd03cd667b5ff8a9a ] + +All the control messages broadcast to remote routers are using +QRTR_NODE_BCAST instead of using local router NODE ID which cause +the packets to be dropped on remote router due to invalid NODE ID. + +Signed-off-by: Arun Kumar Neelakantam +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/qrtr/qrtr.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -191,8 +191,13 @@ static int qrtr_node_enqueue(struct qrtr + hdr->type = cpu_to_le32(type); + hdr->src_node_id = cpu_to_le32(from->sq_node); + hdr->src_port_id = cpu_to_le32(from->sq_port); +- hdr->dst_node_id = cpu_to_le32(to->sq_node); +- hdr->dst_port_id = cpu_to_le32(to->sq_port); ++ if (to->sq_port == QRTR_PORT_CTRL) { ++ hdr->dst_node_id = cpu_to_le32(node->nid); ++ hdr->dst_port_id = cpu_to_le32(QRTR_NODE_BCAST); ++ } else { ++ hdr->dst_node_id = cpu_to_le32(to->sq_node); ++ hdr->dst_port_id = cpu_to_le32(to->sq_port); ++ } + + hdr->size = cpu_to_le32(len); + hdr->confirm_rx = 0; diff --git a/queue-4.17/net-sched-act_csum-fix-null-dereference-when-goto-chain-is-used.patch b/queue-4.17/net-sched-act_csum-fix-null-dereference-when-goto-chain-is-used.patch new file mode 100644 index 00000000000..ac3c184c172 --- /dev/null +++ b/queue-4.17/net-sched-act_csum-fix-null-dereference-when-goto-chain-is-used.patch @@ -0,0 +1,155 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Davide Caratti +Date: Fri, 6 Jul 2018 21:01:05 +0200 +Subject: net/sched: act_csum: fix NULL dereference when 'goto chain' is used + +From: Davide Caratti + +[ Upstream commit 11a245e2f7bf25fc21f47e4c9c8491841b128890 ] + +the control action in the common member of struct tcf_csum must be a valid +value, as it can contain the chain index when 'goto chain' is used. Ensure +that the control action can be read as x->tcfa_action, when x is a pointer +to struct tc_action and x->ops->type is TCA_ACT_CSUM, to prevent the +following command: + + # tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \ + > $tcflags dst_mac $h2mac action csum ip or tcp or udp or sctp goto chain 1 + +from triggering a NULL pointer dereference when a matching packet is +received. + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 + PGD 800000010416b067 P4D 800000010416b067 PUD 1041be067 PMD 0 + Oops: 0000 [#1] SMP PTI + CPU: 0 PID: 3072 Comm: mausezahn Tainted: G E 4.18.0-rc2.auguri+ #421 + Hardware name: Hewlett-Packard HP Z220 CMT Workstation/1790, BIOS K51 v01.58 02/07/2013 + RIP: 0010:tcf_action_exec+0xb8/0x100 + Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 + RSP: 0018:ffffa020dea03c40 EFLAGS: 00010246 + RAX: 0000000020000001 RBX: ffffa020d7ccef00 RCX: 0000000000000054 + RDX: 0000000000000000 RSI: ffffa020ca5ae000 RDI: ffffa020d7ccef00 + RBP: ffffa020dea03e60 R08: 0000000000000000 R09: ffffa020dea03c9c + R10: ffffa020dea03c78 R11: 0000000000000008 R12: ffffa020d3fe4f00 + R13: ffffa020d3fe4f08 R14: 0000000000000001 R15: ffffa020d53ca300 + FS: 00007f5a46942740(0000) GS:ffffa020dea00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000000 CR3: 0000000104218002 CR4: 00000000001606f0 + Call Trace: + + fl_classify+0x1ad/0x1c0 [cls_flower] + ? arp_rcv+0x121/0x1b0 + ? __x2apic_send_IPI_dest+0x40/0x40 + ? smp_reschedule_interrupt+0x1c/0xd0 + ? reschedule_interrupt+0xf/0x20 + ? reschedule_interrupt+0xa/0x20 + ? device_is_rmrr_locked+0xe/0x50 + ? iommu_should_identity_map+0x49/0xd0 + ? __intel_map_single+0x30/0x140 + ? e1000e_update_rdt_wa.isra.52+0x22/0xb0 [e1000e] + ? e1000_alloc_rx_buffers+0x233/0x250 [e1000e] + ? kmem_cache_alloc+0x38/0x1c0 + tcf_classify+0x89/0x140 + __netif_receive_skb_core+0x5ea/0xb70 + ? enqueue_task_fair+0xb6/0x7d0 + ? process_backlog+0x97/0x150 + process_backlog+0x97/0x150 + net_rx_action+0x14b/0x3e0 + __do_softirq+0xde/0x2b4 + do_softirq_own_stack+0x2a/0x40 + + do_softirq.part.18+0x49/0x50 + __local_bh_enable_ip+0x49/0x50 + __dev_queue_xmit+0x4ab/0x8a0 + ? wait_woken+0x80/0x80 + ? packet_sendmsg+0x38f/0x810 + ? __dev_queue_xmit+0x8a0/0x8a0 + packet_sendmsg+0x38f/0x810 + sock_sendmsg+0x36/0x40 + __sys_sendto+0x10e/0x140 + ? do_vfs_ioctl+0xa4/0x630 + ? syscall_trace_enter+0x1df/0x2e0 + ? __audit_syscall_exit+0x22a/0x290 + __x64_sys_sendto+0x24/0x30 + do_syscall_64+0x5b/0x180 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + RIP: 0033:0x7f5a45cbec93 + Code: 48 8b 0d 18 83 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 59 c7 20 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 2b f7 ff ff 48 89 04 24 + RSP: 002b:00007ffd0ee6d748 EFLAGS: 00000246 ORIG_RAX: 000000000000002c + RAX: ffffffffffffffda RBX: 0000000001161010 RCX: 00007f5a45cbec93 + RDX: 0000000000000062 RSI: 0000000001161322 RDI: 0000000000000003 + RBP: 00007ffd0ee6d780 R08: 00007ffd0ee6d760 R09: 0000000000000014 + R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000062 + R13: 0000000001161322 R14: 00007ffd0ee6d760 R15: 0000000000000003 + Modules linked in: act_csum act_gact cls_flower sch_ingress vrf veth act_tunnel_key(E) xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel snd_hda_codec_hdmi snd_hda_codec_realtek kvm snd_hda_codec_generic hp_wmi iTCO_wdt sparse_keymap rfkill mei_wdt iTCO_vendor_support wmi_bmof gpio_ich irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel snd_hda_intel crypto_simd cryptd snd_hda_codec glue_helper snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm pcspkr i2c_i801 snd_timer snd sg lpc_ich soundcore wmi mei_me + mei ie31200_edac nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sr_mod cdrom sd_mod ahci libahci crc32c_intel i915 ixgbe serio_raw libata video dca i2c_algo_bit sfc drm_kms_helper syscopyarea mtd sysfillrect mdio sysimgblt fb_sys_fops drm e1000e i2c_core + CR2: 0000000000000000 + ---[ end trace 3c9e9d1a77df4026 ]--- + RIP: 0010:tcf_action_exec+0xb8/0x100 + Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 + RSP: 0018:ffffa020dea03c40 EFLAGS: 00010246 + RAX: 0000000020000001 RBX: ffffa020d7ccef00 RCX: 0000000000000054 + RDX: 0000000000000000 RSI: ffffa020ca5ae000 RDI: ffffa020d7ccef00 + RBP: ffffa020dea03e60 R08: 0000000000000000 R09: ffffa020dea03c9c + R10: ffffa020dea03c78 R11: 0000000000000008 R12: ffffa020d3fe4f00 + R13: ffffa020d3fe4f08 R14: 0000000000000001 R15: ffffa020d53ca300 + FS: 00007f5a46942740(0000) GS:ffffa020dea00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000000 CR3: 0000000104218002 CR4: 00000000001606f0 + Kernel panic - not syncing: Fatal exception in interrupt + Kernel Offset: 0x26400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) + ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- + +Fixes: 9c5f69bbd75a ("net/sched: act_csum: don't use spinlock in the fast path") +Signed-off-by: Davide Caratti +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/tc_act/tc_csum.h | 1 - + net/sched/act_csum.c | 6 +++--- + 2 files changed, 3 insertions(+), 4 deletions(-) + +--- a/include/net/tc_act/tc_csum.h ++++ b/include/net/tc_act/tc_csum.h +@@ -7,7 +7,6 @@ + #include + + struct tcf_csum_params { +- int action; + u32 update_flags; + struct rcu_head rcu; + }; +--- a/net/sched/act_csum.c ++++ b/net/sched/act_csum.c +@@ -91,7 +91,7 @@ static int tcf_csum_init(struct net *net + } + params_old = rtnl_dereference(p->params); + +- params_new->action = parm->action; ++ p->tcf_action = parm->action; + params_new->update_flags = parm->update_flags; + rcu_assign_pointer(p->params, params_new); + if (params_old) +@@ -561,7 +561,7 @@ static int tcf_csum(struct sk_buff *skb, + tcf_lastuse_update(&p->tcf_tm); + bstats_cpu_update(this_cpu_ptr(p->common.cpu_bstats), skb); + +- action = params->action; ++ action = READ_ONCE(p->tcf_action); + if (unlikely(action == TC_ACT_SHOT)) + goto drop_stats; + +@@ -599,11 +599,11 @@ static int tcf_csum_dump(struct sk_buff + .index = p->tcf_index, + .refcnt = p->tcf_refcnt - ref, + .bindcnt = p->tcf_bindcnt - bind, ++ .action = p->tcf_action, + }; + struct tcf_t t; + + params = rtnl_dereference(p->params); +- opt.action = params->action; + opt.update_flags = params->update_flags; + + if (nla_put(skb, TCA_CSUM_PARMS, sizeof(opt), &opt)) diff --git a/queue-4.17/net-sched-act_tunnel_key-fix-null-dereference-when-goto-chain-is-used.patch b/queue-4.17/net-sched-act_tunnel_key-fix-null-dereference-when-goto-chain-is-used.patch new file mode 100644 index 00000000000..bedfbf8f65e --- /dev/null +++ b/queue-4.17/net-sched-act_tunnel_key-fix-null-dereference-when-goto-chain-is-used.patch @@ -0,0 +1,150 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Davide Caratti +Date: Fri, 6 Jul 2018 21:01:06 +0200 +Subject: net/sched: act_tunnel_key: fix NULL dereference when 'goto chain' is used + +From: Davide Caratti + +[ Upstream commit 38230a3e0e0933bbcf5df6fa469ba0667f667568 ] + +the control action in the common member of struct tcf_tunnel_key must be a +valid value, as it can contain the chain index when 'goto chain' is used. +Ensure that the control action can be read as x->tcfa_action, when x is a +pointer to struct tc_action and x->ops->type is TCA_ACT_TUNNEL_KEY, to +prevent the following command: + + # tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \ + > $tcflags dst_mac $h2mac action tunnel_key unset goto chain 1 + +from causing a NULL dereference when a matching packet is received: + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 + PGD 80000001097ac067 P4D 80000001097ac067 PUD 103b0a067 PMD 0 + Oops: 0000 [#1] SMP PTI + CPU: 0 PID: 3491 Comm: mausezahn Tainted: G E 4.18.0-rc2.auguri+ #421 + Hardware name: Hewlett-Packard HP Z220 CMT Workstation/1790, BIOS K51 v01.58 02/07/2013 + RIP: 0010:tcf_action_exec+0xb8/0x100 + Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 + RSP: 0018:ffff95145ea03c40 EFLAGS: 00010246 + RAX: 0000000020000001 RBX: ffff9514499e5800 RCX: 0000000000000001 + RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 + RBP: ffff95145ea03e60 R08: 0000000000000000 R09: ffff95145ea03c9c + R10: ffff95145ea03c78 R11: 0000000000000008 R12: ffff951456a69800 + R13: ffff951456a69808 R14: 0000000000000001 R15: ffff95144965ee40 + FS: 00007fd67ee11740(0000) GS:ffff95145ea00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000000 CR3: 00000001038a2006 CR4: 00000000001606f0 + Call Trace: + + fl_classify+0x1ad/0x1c0 [cls_flower] + ? __update_load_avg_se.isra.47+0x1ca/0x1d0 + ? __update_load_avg_se.isra.47+0x1ca/0x1d0 + ? update_load_avg+0x665/0x690 + ? update_load_avg+0x665/0x690 + ? kmem_cache_alloc+0x38/0x1c0 + tcf_classify+0x89/0x140 + __netif_receive_skb_core+0x5ea/0xb70 + ? enqueue_entity+0xd0/0x270 + ? process_backlog+0x97/0x150 + process_backlog+0x97/0x150 + net_rx_action+0x14b/0x3e0 + __do_softirq+0xde/0x2b4 + do_softirq_own_stack+0x2a/0x40 + + do_softirq.part.18+0x49/0x50 + __local_bh_enable_ip+0x49/0x50 + __dev_queue_xmit+0x4ab/0x8a0 + ? wait_woken+0x80/0x80 + ? packet_sendmsg+0x38f/0x810 + ? __dev_queue_xmit+0x8a0/0x8a0 + packet_sendmsg+0x38f/0x810 + sock_sendmsg+0x36/0x40 + __sys_sendto+0x10e/0x140 + ? do_vfs_ioctl+0xa4/0x630 + ? syscall_trace_enter+0x1df/0x2e0 + ? __audit_syscall_exit+0x22a/0x290 + __x64_sys_sendto+0x24/0x30 + do_syscall_64+0x5b/0x180 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + RIP: 0033:0x7fd67e18dc93 + Code: 48 8b 0d 18 83 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 59 c7 20 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 2b f7 ff ff 48 89 04 24 + RSP: 002b:00007ffe0189b748 EFLAGS: 00000246 ORIG_RAX: 000000000000002c + RAX: ffffffffffffffda RBX: 00000000020ca010 RCX: 00007fd67e18dc93 + RDX: 0000000000000062 RSI: 00000000020ca322 RDI: 0000000000000003 + RBP: 00007ffe0189b780 R08: 00007ffe0189b760 R09: 0000000000000014 + R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000062 + R13: 00000000020ca322 R14: 00007ffe0189b760 R15: 0000000000000003 + Modules linked in: act_tunnel_key act_gact cls_flower sch_ingress vrf veth act_csum(E) xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter intel_rapl snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp snd_hda_codec_realtek coretemp snd_hda_codec_generic kvm_intel kvm irqbypass snd_hda_intel crct10dif_pclmul crc32_pclmul hp_wmi ghash_clmulni_intel pcbc snd_hda_codec aesni_intel sparse_keymap rfkill snd_hda_core snd_hwdep snd_seq crypto_simd iTCO_wdt gpio_ich iTCO_vendor_support wmi_bmof cryptd mei_wdt glue_helper snd_seq_device snd_pcm pcspkr snd_timer snd i2c_i801 lpc_ich sg soundcore wmi mei_me + mei ie31200_edac nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod sr_mod cdrom i915 video i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ahci crc32c_intel libahci serio_raw sfc libata mtd drm ixgbe mdio i2c_core e1000e dca + CR2: 0000000000000000 + ---[ end trace 1ab8b5b5d4639dfc ]--- + RIP: 0010:tcf_action_exec+0xb8/0x100 + Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 + RSP: 0018:ffff95145ea03c40 EFLAGS: 00010246 + RAX: 0000000020000001 RBX: ffff9514499e5800 RCX: 0000000000000001 + RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 + RBP: ffff95145ea03e60 R08: 0000000000000000 R09: ffff95145ea03c9c + R10: ffff95145ea03c78 R11: 0000000000000008 R12: ffff951456a69800 + R13: ffff951456a69808 R14: 0000000000000001 R15: ffff95144965ee40 + FS: 00007fd67ee11740(0000) GS:ffff95145ea00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000000 CR3: 00000001038a2006 CR4: 00000000001606f0 + Kernel panic - not syncing: Fatal exception in interrupt + Kernel Offset: 0x11400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) + ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- + +Fixes: d0f6dd8a914f ("net/sched: Introduce act_tunnel_key") +Signed-off-by: Davide Caratti +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/tc_act/tc_tunnel_key.h | 1 - + net/sched/act_tunnel_key.c | 6 +++--- + 2 files changed, 3 insertions(+), 4 deletions(-) + +--- a/include/net/tc_act/tc_tunnel_key.h ++++ b/include/net/tc_act/tc_tunnel_key.h +@@ -18,7 +18,6 @@ + struct tcf_tunnel_key_params { + struct rcu_head rcu; + int tcft_action; +- int action; + struct metadata_dst *tcft_enc_metadata; + }; + +--- a/net/sched/act_tunnel_key.c ++++ b/net/sched/act_tunnel_key.c +@@ -36,7 +36,7 @@ static int tunnel_key_act(struct sk_buff + + tcf_lastuse_update(&t->tcf_tm); + bstats_cpu_update(this_cpu_ptr(t->common.cpu_bstats), skb); +- action = params->action; ++ action = READ_ONCE(t->tcf_action); + + switch (params->tcft_action) { + case TCA_TUNNEL_KEY_ACT_RELEASE: +@@ -182,7 +182,7 @@ static int tunnel_key_init(struct net *n + + params_old = rtnl_dereference(t->params); + +- params_new->action = parm->action; ++ t->tcf_action = parm->action; + params_new->tcft_action = parm->t_action; + params_new->tcft_enc_metadata = metadata; + +@@ -254,13 +254,13 @@ static int tunnel_key_dump(struct sk_buf + .index = t->tcf_index, + .refcnt = t->tcf_refcnt - ref, + .bindcnt = t->tcf_bindcnt - bind, ++ .action = t->tcf_action, + }; + struct tcf_t tm; + + params = rtnl_dereference(t->params); + + opt.t_action = params->tcft_action; +- opt.action = params->action; + + if (nla_put(skb, TCA_TUNNEL_KEY_PARMS, sizeof(opt), &opt)) + goto nla_put_failure; diff --git a/queue-4.17/net-smc-reset-recv-timeout-after-clc-handshake.patch b/queue-4.17/net-smc-reset-recv-timeout-after-clc-handshake.patch new file mode 100644 index 00000000000..8304ad8cc6d --- /dev/null +++ b/queue-4.17/net-smc-reset-recv-timeout-after-clc-handshake.patch @@ -0,0 +1,48 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Karsten Graul +Date: Wed, 18 Jul 2018 15:22:51 +0200 +Subject: net/smc: reset recv timeout after clc handshake + +From: Karsten Graul + +[ Upstream commit f6bdc42f021194ec095914b92c7a8b1a09789e6d ] + +During clc handshake the receive timeout is set to CLC_WAIT_TIME. +Remember and reset the original timeout value after the receive calls, +and remove a duplicate assignment of CLC_WAIT_TIME. + +Signed-off-by: Karsten Graul +Signed-off-by: Ursula Braun +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/smc/smc_clc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/smc/smc_clc.c ++++ b/net/smc/smc_clc.c +@@ -250,6 +250,7 @@ out: + int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen, + u8 expected_type) + { ++ long rcvtimeo = smc->clcsock->sk->sk_rcvtimeo; + struct sock *clc_sk = smc->clcsock->sk; + struct smc_clc_msg_hdr *clcm = buf; + struct msghdr msg = {NULL, 0}; +@@ -306,7 +307,6 @@ int smc_clc_wait_msg(struct smc_sock *sm + memset(&msg, 0, sizeof(struct msghdr)); + iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &vec, 1, datlen); + krflags = MSG_WAITALL; +- smc->clcsock->sk->sk_rcvtimeo = CLC_WAIT_TIME; + len = sock_recvmsg(smc->clcsock, &msg, krflags); + if (len < datlen || !smc_clc_msg_hdr_valid(clcm)) { + smc->sk.sk_err = EPROTO; +@@ -322,6 +322,7 @@ int smc_clc_wait_msg(struct smc_sock *sm + } + + out: ++ smc->clcsock->sk->sk_rcvtimeo = rcvtimeo; + return reason_code; + } + diff --git a/queue-4.17/net-stmmac-socfpga-add-additional-ocp-reset-line-for-stratix10.patch b/queue-4.17/net-stmmac-socfpga-add-additional-ocp-reset-line-for-stratix10.patch new file mode 100644 index 00000000000..d04b89edb1f --- /dev/null +++ b/queue-4.17/net-stmmac-socfpga-add-additional-ocp-reset-line-for-stratix10.patch @@ -0,0 +1,86 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Dinh Nguyen +Date: Tue, 19 Jun 2018 10:35:38 -0500 +Subject: net: stmmac: socfpga: add additional ocp reset line for Stratix10 + +From: Dinh Nguyen + +[ Upstream commit bc8a2d9bcbf1ca548b1deb315d14e1da81945bea ] + +The Stratix10 platform has an additional reset line, OCP(Open Core Protocol), +that also needs to get deasserted for the stmmac ethernet controller to work. +Thus we need to update the Kconfig to include ARCH_STRATIX10 in order to build +dwmac-socfpga. + +Also, remove the redundant check for the reset controller pointer. The +reset driver already checks for the pointer and returns 0 if the pointer +is NULL. + +Signed-off-by: Dinh Nguyen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/Kconfig | 2 +- + drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 18 ++++++++++++++---- + 2 files changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig ++++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig +@@ -111,7 +111,7 @@ config DWMAC_ROCKCHIP + config DWMAC_SOCFPGA + tristate "SOCFPGA dwmac support" + default ARCH_SOCFPGA +- depends on OF && (ARCH_SOCFPGA || COMPILE_TEST) ++ depends on OF && (ARCH_SOCFPGA || ARCH_STRATIX10 || COMPILE_TEST) + select MFD_SYSCON + help + Support for ethernet controller on Altera SOCFPGA +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +@@ -55,6 +55,7 @@ struct socfpga_dwmac { + struct device *dev; + struct regmap *sys_mgr_base_addr; + struct reset_control *stmmac_rst; ++ struct reset_control *stmmac_ocp_rst; + void __iomem *splitter_base; + bool f2h_ptp_ref_clk; + struct tse_pcs pcs; +@@ -262,8 +263,8 @@ static int socfpga_dwmac_set_phy_mode(st + val = SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII; + + /* Assert reset to the enet controller before changing the phy mode */ +- if (dwmac->stmmac_rst) +- reset_control_assert(dwmac->stmmac_rst); ++ reset_control_assert(dwmac->stmmac_ocp_rst); ++ reset_control_assert(dwmac->stmmac_rst); + + regmap_read(sys_mgr_base_addr, reg_offset, &ctrl); + ctrl &= ~(SYSMGR_EMACGRP_CTRL_PHYSEL_MASK << reg_shift); +@@ -288,8 +289,8 @@ static int socfpga_dwmac_set_phy_mode(st + /* Deassert reset for the phy configuration to be sampled by + * the enet controller, and operation to start in requested mode + */ +- if (dwmac->stmmac_rst) +- reset_control_deassert(dwmac->stmmac_rst); ++ reset_control_deassert(dwmac->stmmac_ocp_rst); ++ reset_control_deassert(dwmac->stmmac_rst); + if (phymode == PHY_INTERFACE_MODE_SGMII) { + if (tse_pcs_init(dwmac->pcs.tse_pcs_base, &dwmac->pcs) != 0) { + dev_err(dwmac->dev, "Unable to initialize TSE PCS"); +@@ -324,6 +325,15 @@ static int socfpga_dwmac_probe(struct pl + goto err_remove_config_dt; + } + ++ dwmac->stmmac_ocp_rst = devm_reset_control_get_optional(dev, "stmmaceth-ocp"); ++ if (IS_ERR(dwmac->stmmac_ocp_rst)) { ++ ret = PTR_ERR(dwmac->stmmac_ocp_rst); ++ dev_err(dev, "error getting reset control of ocp %d\n", ret); ++ goto err_remove_config_dt; ++ } ++ ++ reset_control_deassert(dwmac->stmmac_ocp_rst); ++ + ret = socfpga_dwmac_parse_data(dwmac, dev); + if (ret) { + dev_err(dev, "Unable to parse OF data\n"); diff --git a/queue-4.17/net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch b/queue-4.17/net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch new file mode 100644 index 00000000000..715b29c8cad --- /dev/null +++ b/queue-4.17/net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: David Lechner +Date: Mon, 16 Jul 2018 17:58:10 -0500 +Subject: net: usb: rtl8150: demote allmulti message to dev_dbg() + +From: David Lechner + +[ Upstream commit 3a9b0455062ffb9d2f6cd4473a76e3456f318c9f ] + +This driver can spam the kernel log with multiple messages of: + + net eth0: eth0: allmulti set + +Usually 4 or 8 at a time (probably because of using ConnMan). + +This message doesn't seem useful, so let's demote it from dev_info() +to dev_dbg(). + +Signed-off-by: David Lechner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/rtl8150.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct + (netdev->flags & IFF_ALLMULTI)) { + rx_creg &= 0xfffe; + rx_creg |= 0x0002; +- dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name); ++ dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name); + } else { + /* ~RX_MULTICAST, ~RX_PROMISCUOUS */ + rx_creg &= 0x00fc; diff --git a/queue-4.17/netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch b/queue-4.17/netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch new file mode 100644 index 00000000000..63219092a76 --- /dev/null +++ b/queue-4.17/netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch @@ -0,0 +1,72 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Eric Dumazet +Date: Wed, 13 Jun 2018 10:11:56 -0700 +Subject: netfilter: ipv6: nf_defrag: reduce struct net memory waste + +From: Eric Dumazet + +[ Upstream commit 9ce7bc036ae4cfe3393232c86e9e1fea2153c237 ] + +It is a waste of memory to use a full "struct netns_sysctl_ipv6" +while only one pointer is really used, considering netns_sysctl_ipv6 +keeps growing. + +Also, since "struct netns_frags" has cache line alignment, +it is better to move the frags_hdr pointer outside, otherwise +we spend a full cache line for this pointer. + +This saves 192 bytes of memory per netns. + +Fixes: c038a767cd69 ("ipv6: add a new namespace for nf_conntrack_reasm") +Signed-off-by: Eric Dumazet +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/net_namespace.h | 1 + + include/net/netns/ipv6.h | 1 - + net/ipv6/netfilter/nf_conntrack_reasm.c | 6 +++--- + 3 files changed, 4 insertions(+), 4 deletions(-) + +--- a/include/net/net_namespace.h ++++ b/include/net/net_namespace.h +@@ -128,6 +128,7 @@ struct net { + #endif + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + struct netns_nf_frag nf_frag; ++ struct ctl_table_header *nf_frag_frags_hdr; + #endif + struct sock *nfnl; + struct sock *nfnl_stash; +--- a/include/net/netns/ipv6.h ++++ b/include/net/netns/ipv6.h +@@ -107,7 +107,6 @@ struct netns_ipv6 { + + #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + struct netns_nf_frag { +- struct netns_sysctl_ipv6 sysctl; + struct netns_frags frags; + }; + #endif +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -107,7 +107,7 @@ static int nf_ct_frag6_sysctl_register(s + if (hdr == NULL) + goto err_reg; + +- net->nf_frag.sysctl.frags_hdr = hdr; ++ net->nf_frag_frags_hdr = hdr; + return 0; + + err_reg: +@@ -121,8 +121,8 @@ static void __net_exit nf_ct_frags6_sysc + { + struct ctl_table *table; + +- table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg; +- unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr); ++ table = net->nf_frag_frags_hdr->ctl_table_arg; ++ unregister_net_sysctl_table(net->nf_frag_frags_hdr); + if (!net_eq(net, &init_net)) + kfree(table); + } diff --git a/queue-4.17/netfilter-nf_conntrack-fix-possible-possible-crash-on-module-loading.patch b/queue-4.17/netfilter-nf_conntrack-fix-possible-possible-crash-on-module-loading.patch new file mode 100644 index 00000000000..02109224634 --- /dev/null +++ b/queue-4.17/netfilter-nf_conntrack-fix-possible-possible-crash-on-module-loading.patch @@ -0,0 +1,64 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Andrey Ryabinin +Date: Fri, 6 Jul 2018 16:38:53 +0300 +Subject: netfilter: nf_conntrack: Fix possible possible crash on module loading. + +From: Andrey Ryabinin + +[ Upstream commit 2045cdfa1b40d66f126f3fd05604fc7c754f0022 ] + +Loading the nf_conntrack module with doubled hashsize parameter, i.e. + modprobe nf_conntrack hashsize=12345 hashsize=12345 +causes NULL-ptr deref. + +If 'hashsize' specified twice, the nf_conntrack_set_hashsize() function +will be called also twice. +The first nf_conntrack_set_hashsize() call will set the +'nf_conntrack_htable_size' variable: + + nf_conntrack_set_hashsize() + ... + /* On boot, we can set this without any fancy locking. */ + if (!nf_conntrack_htable_size) + return param_set_uint(val, kp); + +But on the second invocation, the nf_conntrack_htable_size is already set, +so the nf_conntrack_set_hashsize() will take a different path and call +the nf_conntrack_hash_resize() function. Which will crash on the attempt +to dereference 'nf_conntrack_hash' pointer: + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 + RIP: 0010:nf_conntrack_hash_resize+0x255/0x490 [nf_conntrack] + Call Trace: + nf_conntrack_set_hashsize+0xcd/0x100 [nf_conntrack] + parse_args+0x1f9/0x5a0 + load_module+0x1281/0x1a50 + __se_sys_finit_module+0xbe/0xf0 + do_syscall_64+0x7c/0x390 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Fix this, by checking !nf_conntrack_hash instead of +!nf_conntrack_htable_size. nf_conntrack_hash will be initialized only +after the module loaded, so the second invocation of the +nf_conntrack_set_hashsize() won't crash, it will just reinitialize +nf_conntrack_htable_size again. + +Signed-off-by: Andrey Ryabinin +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conntrack_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -1972,7 +1972,7 @@ int nf_conntrack_set_hashsize(const char + return -EOPNOTSUPP; + + /* On boot, we can set this without any fancy locking. */ +- if (!nf_conntrack_htable_size) ++ if (!nf_conntrack_hash) + return param_set_uint(val, kp); + + rc = kstrtouint(val, 0, &hashsize); diff --git a/queue-4.17/netfilter-nf_ct_helper-fix-possible-panic-after-nf_conntrack_helper_unregister.patch b/queue-4.17/netfilter-nf_ct_helper-fix-possible-panic-after-nf_conntrack_helper_unregister.patch new file mode 100644 index 00000000000..4d8ecbd8c02 --- /dev/null +++ b/queue-4.17/netfilter-nf_ct_helper-fix-possible-panic-after-nf_conntrack_helper_unregister.patch @@ -0,0 +1,50 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Gao Feng +Date: Wed, 13 Jun 2018 12:26:13 +0800 +Subject: netfilter: nf_ct_helper: Fix possible panic after nf_conntrack_helper_unregister + +From: Gao Feng + +[ Upstream commit ad9852af97587b8abe8102f9ddcb05c9769656f6 ] + +The helper module would be unloaded after nf_conntrack_helper_unregister, +so it may cause a possible panic caused by race. + +nf_ct_iterate_destroy(unhelp, me) reset the helper of conntrack as NULL, +but maybe someone has gotten the helper pointer during this period. Then +it would panic, when it accesses the helper and the module was unloaded. + +Take an example as following: +CPU0 CPU1 +ctnetlink_dump_helpinfo +helper = rcu_dereference(help->helper); + unhelp + set helper as NULL + unload helper module +helper->to_nlattr(skb, ct); + +As above, the cpu0 tries to access the helper and its module is unloaded, +then the panic happens. + +Signed-off-by: Gao Feng +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conntrack_helper.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/netfilter/nf_conntrack_helper.c ++++ b/net/netfilter/nf_conntrack_helper.c +@@ -465,6 +465,11 @@ void nf_conntrack_helper_unregister(stru + + nf_ct_expect_iterate_destroy(expect_iter_me, NULL); + nf_ct_iterate_destroy(unhelp, me); ++ ++ /* Maybe someone has gotten the helper already when unhelp above. ++ * So need to wait it. ++ */ ++ synchronize_rcu(); + } + EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister); + diff --git a/queue-4.17/netfilter-nf_log-fix-uninit-read-in-nf_log_proc_dostring.patch b/queue-4.17/netfilter-nf_log-fix-uninit-read-in-nf_log_proc_dostring.patch new file mode 100644 index 00000000000..0855cfcba2d --- /dev/null +++ b/queue-4.17/netfilter-nf_log-fix-uninit-read-in-nf_log_proc_dostring.patch @@ -0,0 +1,35 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jann Horn +Date: Wed, 20 Jun 2018 18:33:45 +0200 +Subject: netfilter: nf_log: fix uninit read in nf_log_proc_dostring + +From: Jann Horn + +[ Upstream commit dffd22aed2aa1e804bccf19b30a421e89ee2ae61 ] + +When proc_dostring() is called with a non-zero offset in strict mode, it +doesn't just write to the ->data buffer, it also reads. Make sure it +doesn't read uninitialized data. + +Fixes: c6ac37d8d884 ("netfilter: nf_log: fix error on write NONE to [...]") +Signed-off-by: Jann Horn +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_log.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/netfilter/nf_log.c ++++ b/net/netfilter/nf_log.c +@@ -439,6 +439,10 @@ static int nf_log_proc_dostring(struct c + if (write) { + struct ctl_table tmp = *table; + ++ /* proc_dostring() can append to existing strings, so we need to ++ * initialize it as an empty string. ++ */ ++ buf[0] = '\0'; + tmp.data = buf; + r = proc_dostring(&tmp, write, buffer, lenp, ppos); + if (r) diff --git a/queue-4.17/netfilter-nft_compat-explicitly-reject-error-and-standard-target.patch b/queue-4.17/netfilter-nft_compat-explicitly-reject-error-and-standard-target.patch new file mode 100644 index 00000000000..b3dc169bd28 --- /dev/null +++ b/queue-4.17/netfilter-nft_compat-explicitly-reject-error-and-standard-target.patch @@ -0,0 +1,55 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Florian Westphal +Date: Fri, 6 Jul 2018 20:06:05 +0200 +Subject: netfilter: nft_compat: explicitly reject ERROR and standard target + +From: Florian Westphal + +[ Upstream commit 21d5e078192d244df3d6049f9464fff2f72cfd68 ] + +iptables-nft never requests these, but make this explicitly illegal. +If it were quested, kernel could oops as ->eval is NULL, furthermore, +the builtin targets have no owning module so its possible to rmmod +eb/ip/ip6_tables module even if they would be loaded. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nft_compat.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/net/netfilter/nft_compat.c ++++ b/net/netfilter/nft_compat.c +@@ -825,10 +825,18 @@ nft_target_select_ops(const struct nft_c + rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV])); + family = ctx->family; + ++ if (strcmp(tg_name, XT_ERROR_TARGET) == 0 || ++ strcmp(tg_name, XT_STANDARD_TARGET) == 0 || ++ strcmp(tg_name, "standard") == 0) ++ return ERR_PTR(-EINVAL); ++ + /* Re-use the existing target if it's already loaded. */ + list_for_each_entry(nft_target, &nft_target_list, head) { + struct xt_target *target = nft_target->ops.data; + ++ if (!target->target) ++ continue; ++ + if (nft_target_cmp(target, tg_name, rev, family)) + return &nft_target->ops; + } +@@ -837,6 +845,11 @@ nft_target_select_ops(const struct nft_c + if (IS_ERR(target)) + return ERR_PTR(-ENOENT); + ++ if (!target->target) { ++ err = -EINVAL; ++ goto err; ++ } ++ + if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) { + err = -EINVAL; + goto err; diff --git a/queue-4.17/netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch b/queue-4.17/netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch new file mode 100644 index 00000000000..ba56dc557c8 --- /dev/null +++ b/queue-4.17/netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch @@ -0,0 +1,44 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Florian Westphal +Date: Wed, 4 Jul 2018 20:25:32 +0200 +Subject: netfilter: x_tables: set module owner for icmp(6) matches + +From: Florian Westphal + +[ Upstream commit d376bef9c29b3c65aeee4e785fffcd97ef0a9a81 ] + +nft_compat relies on xt_request_find_match to increment +refcount of the module that provides the match/target. + +The (builtin) icmp matches did't set the module owner so it +was possible to rmmod ip(6)tables while icmp extensions were still in use. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/netfilter/ip_tables.c | 1 + + net/ipv6/netfilter/ip6_tables.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -1895,6 +1895,7 @@ static struct xt_match ipt_builtin_mt[] + .checkentry = icmp_checkentry, + .proto = IPPROTO_ICMP, + .family = NFPROTO_IPV4, ++ .me = THIS_MODULE, + }, + }; + +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -1907,6 +1907,7 @@ static struct xt_match ip6t_builtin_mt[] + .checkentry = icmp6_checkentry, + .proto = IPPROTO_ICMPV6, + .family = NFPROTO_IPV6, ++ .me = THIS_MODULE, + }, + }; + diff --git a/queue-4.17/nfc-pn533-fix-wrong-gfp-flag-usage.patch b/queue-4.17/nfc-pn533-fix-wrong-gfp-flag-usage.patch new file mode 100644 index 00000000000..d0af2f75821 --- /dev/null +++ b/queue-4.17/nfc-pn533-fix-wrong-gfp-flag-usage.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Hans de Goede +Date: Thu, 7 Jun 2018 15:54:48 +0200 +Subject: NFC: pn533: Fix wrong GFP flag usage + +From: Hans de Goede + +[ Upstream commit ecc443c03fb14abfb8a6af5e3b2d43b5257e60f2 ] + +pn533_recv_response() is an urb completion handler, so it must use +GFP_ATOMIC. pn533_usb_send_frame() OTOH runs from a regular sleeping +context, so the pn533_submit_urb_for_response() there (and only there) +can use the regular GFP_KERNEL flags. + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1514134 +Fixes: 9815c7cf22da ("NFC: pn533: Separate physical layer from ...") +Cc: Michael Thalmeier +Signed-off-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nfc/pn533/usb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/nfc/pn533/usb.c ++++ b/drivers/nfc/pn533/usb.c +@@ -74,7 +74,7 @@ static void pn533_recv_response(struct u + struct sk_buff *skb = NULL; + + if (!urb->status) { +- skb = alloc_skb(urb->actual_length, GFP_KERNEL); ++ skb = alloc_skb(urb->actual_length, GFP_ATOMIC); + if (!skb) { + nfc_err(&phy->udev->dev, "failed to alloc memory\n"); + } else { +@@ -186,7 +186,7 @@ static int pn533_usb_send_frame(struct p + + if (dev->protocol_type == PN533_PROTO_REQ_RESP) { + /* request for response for sent packet directly */ +- rc = pn533_submit_urb_for_response(phy, GFP_ATOMIC); ++ rc = pn533_submit_urb_for_response(phy, GFP_KERNEL); + if (rc) + goto error; + } else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) { diff --git a/queue-4.17/nfit-fix-unchecked-dereference-in-acpi_nfit_ctl.patch b/queue-4.17/nfit-fix-unchecked-dereference-in-acpi_nfit_ctl.patch new file mode 100644 index 00000000000..2a4e6ba9086 --- /dev/null +++ b/queue-4.17/nfit-fix-unchecked-dereference-in-acpi_nfit_ctl.patch @@ -0,0 +1,56 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dave Jiang +Date: Wed, 11 Jul 2018 10:10:11 -0700 +Subject: nfit: fix unchecked dereference in acpi_nfit_ctl + +From: Dave Jiang + +[ Upstream commit ee6581ceba7f8314b81b2f2a81f1cf3f67c679e2 ] + +Incremental patch to fix the unchecked dereference in acpi_nfit_ctl. +Reported by Dan Carpenter: + +"acpi/nfit: fix cmd_rc for acpi_nfit_ctl to +always return a value" from Jun 28, 2018, leads to the following +Smatch complaint: + + drivers/acpi/nfit/core.c:578 acpi_nfit_ctl() + warn: variable dereferenced before check 'cmd_rc' (see line 411) + +drivers/acpi/nfit/core.c + 410 + 411 *cmd_rc = -EINVAL; + ^^^^^^^^^^^^^^^^^^ +Patch adds unchecked dereference. + +Fixes: c1985cefd844 ("acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value") + +Signed-off-by: Dave Jiang +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/nfit/core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -408,7 +408,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc + const guid_t *guid; + int rc, i; + +- *cmd_rc = -EINVAL; ++ if (cmd_rc) ++ *cmd_rc = -EINVAL; + func = cmd; + if (cmd == ND_CMD_CALL) { + call_pkg = buf; +@@ -519,7 +520,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc + * If we return an error (like elsewhere) then caller wouldn't + * be able to rely upon data returned to make calculation. + */ +- *cmd_rc = 0; ++ if (cmd_rc) ++ *cmd_rc = 0; + return 0; + } + diff --git a/queue-4.17/nfp-bpf-don-t-stop-offload-if-replace-failed.patch b/queue-4.17/nfp-bpf-don-t-stop-offload-if-replace-failed.patch new file mode 100644 index 00000000000..908227ba923 --- /dev/null +++ b/queue-4.17/nfp-bpf-don-t-stop-offload-if-replace-failed.patch @@ -0,0 +1,70 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jakub Kicinski +Date: Fri, 22 Jun 2018 11:56:56 -0700 +Subject: nfp: bpf: don't stop offload if replace failed + +From: Jakub Kicinski + +[ Upstream commit 68d676a089625daed9d61df56ac63b5cd7189efe ] + +Stopping offload completely if replace of program failed dates +back to days of transparent offload. Back then we wanted to +silently fall back to the in-driver processing. Today we mark +programs for offload when they are loaded into the kernel, so +the transparent offload is no longer a reality. + +Flags check in the driver will only allow replace of a driver +program with another driver program or an offload program with +another offload program. + +When driver program is replaced stopping offload is a no-op, +because driver program isn't offloaded. When replacing +offloaded program if the offload fails the entire operation +will fail all the way back to user space and we should continue +using the old program. IOW when replacing a driver program +stopping offload is unnecessary and when replacing offloaded +program - it's a bug, old program should continue to run. + +In practice this bug would mean that if offload operation was to +fail (either due to FW communication error, kernel OOM or new +program being offloaded but for a different netdev) driver +would continue reporting that previous XDP program is offloaded +but in fact no program will be loaded in hardware. The failure +is fairly unlikely (found by inspection, when working on the code) +but it's unpleasant. + +Backport note: even though the bug was introduced in commit +cafa92ac2553 ("nfp: bpf: add support for XDP_FLAGS_HW_MODE"), +this fix depends on commit 441a33031fe5 ("net: xdp: don't allow +device-bound programs in driver mode"), so this fix is sufficient +only in v4.15 or newer. Kernels v4.13.x and v4.14.x do need to +stop offload if it was transparent/opportunistic, i.e. if +XDP_FLAGS_HW_MODE was not set on running program. + +Fixes: cafa92ac2553 ("nfp: bpf: add support for XDP_FLAGS_HW_MODE") +Signed-off-by: Jakub Kicinski +Reviewed-by: Quentin Monnet +Acked-by: Song Liu +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/netronome/nfp/bpf/main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c ++++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c +@@ -73,10 +73,10 @@ nfp_bpf_xdp_offload(struct nfp_app *app, + + ret = nfp_net_bpf_offload(nn, prog, running, extack); + /* Stop offload if replace not possible */ +- if (ret && prog) +- nfp_bpf_xdp_offload(app, nn, NULL, extack); ++ if (ret) ++ return ret; + +- nn->dp.bpf_offload_xdp = prog && !ret; ++ nn->dp.bpf_offload_xdp = !!prog; + return ret; + } + diff --git a/queue-4.17/nfp-cast-sizeof-to-int-when-comparing-with-error-code.patch b/queue-4.17/nfp-cast-sizeof-to-int-when-comparing-with-error-code.patch new file mode 100644 index 00000000000..89e5f9d3946 --- /dev/null +++ b/queue-4.17/nfp-cast-sizeof-to-int-when-comparing-with-error-code.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Chengguang Xu +Date: Tue, 26 Jun 2018 09:16:31 +0800 +Subject: nfp: cast sizeof() to int when comparing with error code + +From: Chengguang Xu + +[ Upstream commit 2d2595719a97c876f35b1e60e5768e58753b268c ] + +sizeof() will return unsigned value so in the error check +negative error code will be always larger than sizeof(). + +Fixes: a0d8e02c35ff ("nfp: add support for reading nffw info") + +Signed-off-by: Chengguang Xu +Acked-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c ++++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nffw.c +@@ -232,7 +232,7 @@ struct nfp_nffw_info *nfp_nffw_info_open + err = nfp_cpp_read(cpp, nfp_resource_cpp_id(state->res), + nfp_resource_address(state->res), + fwinf, sizeof(*fwinf)); +- if (err < sizeof(*fwinf)) ++ if (err < (int)sizeof(*fwinf)) + goto err_release; + + if (!nffw_res_flg_init_get(fwinf)) diff --git a/queue-4.17/nl80211-check-nla_parse_nested-return-values.patch b/queue-4.17/nl80211-check-nla_parse_nested-return-values.patch new file mode 100644 index 00000000000..9a208563ceb --- /dev/null +++ b/queue-4.17/nl80211-check-nla_parse_nested-return-values.patch @@ -0,0 +1,51 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Johannes Berg +Date: Fri, 29 Jun 2018 09:33:39 +0200 +Subject: nl80211: check nla_parse_nested() return values + +From: Johannes Berg + +[ Upstream commit 95bca62fb723a121954fc7ae5473bb2c1f0d5986 ] + +At the very least we should check the return value if +nla_parse_nested() is called with a non-NULL policy. + +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/nl80211.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -10703,9 +10703,12 @@ static int nl80211_set_wowlan(struct sk_ + rem) { + u8 *mask_pat; + +- nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, +- nl80211_packet_pattern_policy, +- info->extack); ++ err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, ++ nl80211_packet_pattern_policy, ++ info->extack); ++ if (err) ++ goto error; ++ + err = -EINVAL; + if (!pat_tb[NL80211_PKTPAT_MASK] || + !pat_tb[NL80211_PKTPAT_PATTERN]) +@@ -10954,8 +10957,11 @@ static int nl80211_parse_coalesce_rule(s + rem) { + u8 *mask_pat; + +- nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, +- nl80211_packet_pattern_policy, NULL); ++ err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, ++ nl80211_packet_pattern_policy, NULL); ++ if (err) ++ return err; ++ + if (!pat_tb[NL80211_PKTPAT_MASK] || + !pat_tb[NL80211_PKTPAT_PATTERN]) + return -EINVAL; diff --git a/queue-4.17/nl80211-relax-ht-operation-checks-for-mesh.patch b/queue-4.17/nl80211-relax-ht-operation-checks-for-mesh.patch new file mode 100644 index 00000000000..8c3ee3dec2e --- /dev/null +++ b/queue-4.17/nl80211-relax-ht-operation-checks-for-mesh.patch @@ -0,0 +1,76 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Bob Copeland +Date: Sun, 24 Jun 2018 21:10:49 -0400 +Subject: nl80211: relax ht operation checks for mesh + +From: Bob Copeland + +[ Upstream commit 188f60ab8e787fcbb5ac9d64ede23a0070231f09 ] + +Commit 9757235f451c, "nl80211: correct checks for +NL80211_MESHCONF_HT_OPMODE value") relaxed the range for the HT +operation field in meshconf, while also adding checks requiring +the non-greenfield and non-ht-sta bits to be set in certain +circumstances. The latter bit is actually reserved for mesh BSSes +according to Table 9-168 in 802.11-2016, so in fact it should not +be set. + +wpa_supplicant sets these bits because the mesh and AP code share +the same implementation, but authsae does not. As a result, some +meshconf updates from authsae which set only the NONHT_MIXED +protection bits were being rejected. + +In order to avoid breaking userspace by changing the rules again, +simply accept the values with or without the bits set, and mask +off the reserved bit to match the spec. + +While in here, update the 802.11-2012 reference to 802.11-2016. + +Fixes: 9757235f451c ("nl80211: correct checks for NL80211_MESHCONF_HT_OPMODE value") +Cc: Masashi Honma +Signed-off-by: Bob Copeland +Reviewed-by: Masashi Honma +Reviewed-by: Masashi Honma +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/nl80211.c | 19 +++---------------- + 1 file changed, 3 insertions(+), 16 deletions(-) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -6061,7 +6061,7 @@ do { \ + nl80211_check_s32); + /* + * Check HT operation mode based on +- * IEEE 802.11 2012 8.4.2.59 HT Operation element. ++ * IEEE 802.11-2016 9.4.2.57 HT Operation element. + */ + if (tb[NL80211_MESHCONF_HT_OPMODE]) { + ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); +@@ -6071,22 +6071,9 @@ do { \ + IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) + return -EINVAL; + +- if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) && +- (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) +- return -EINVAL; ++ /* NON_HT_STA bit is reserved, but some programs set it */ ++ ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT; + +- switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) { +- case IEEE80211_HT_OP_MODE_PROTECTION_NONE: +- case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ: +- if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT) +- return -EINVAL; +- break; +- case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER: +- case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED: +- if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) +- return -EINVAL; +- break; +- } + cfg->ht_opmode = ht_opmode; + mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); + } diff --git a/queue-4.17/nvme-ensure-forward-progress-during-admin-passthru.patch b/queue-4.17/nvme-ensure-forward-progress-during-admin-passthru.patch new file mode 100644 index 00000000000..52434bad2cb --- /dev/null +++ b/queue-4.17/nvme-ensure-forward-progress-during-admin-passthru.patch @@ -0,0 +1,123 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Scott Bauer +Date: Fri, 29 Jun 2018 13:03:28 -0600 +Subject: nvme: ensure forward progress during Admin passthru + +From: Scott Bauer + +[ Upstream commit cf39a6bc342b980f10f344d88035829638a89a48 ] + +If the controller supports effects and goes down during the passthru admin +command we will deadlock during namespace revalidation. + +[ 363.488275] INFO: task kworker/u16:5:231 blocked for more than 120 seconds. +[ 363.488290] Not tainted 4.17.0+ #2 +[ 363.488296] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 363.488303] kworker/u16:5 D 0 231 2 0x80000000 +[ 363.488331] Workqueue: nvme-reset-wq nvme_reset_work [nvme] +[ 363.488338] Call Trace: +[ 363.488385] schedule+0x75/0x190 +[ 363.488396] rwsem_down_read_failed+0x1c3/0x2f0 +[ 363.488481] call_rwsem_down_read_failed+0x14/0x30 +[ 363.488504] down_read+0x1d/0x80 +[ 363.488523] nvme_stop_queues+0x1e/0xa0 [nvme_core] +[ 363.488536] nvme_dev_disable+0xae4/0x1620 [nvme] +[ 363.488614] nvme_reset_work+0xd1e/0x49d9 [nvme] +[ 363.488911] process_one_work+0x81a/0x1400 +[ 363.488934] worker_thread+0x87/0xe80 +[ 363.488955] kthread+0x2db/0x390 +[ 363.488977] ret_from_fork+0x35/0x40 + +Fixes: 84fef62d135b6 ("nvme: check admin passthru command effects") +Signed-off-by: Scott Bauer +Reviewed-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/core.c | 50 ++++++++++++++++++++++++----------------------- + 1 file changed, 26 insertions(+), 24 deletions(-) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -100,6 +100,22 @@ static struct class *nvme_subsys_class; + static void nvme_ns_remove(struct nvme_ns *ns); + static int nvme_revalidate_disk(struct gendisk *disk); + static void nvme_put_subsystem(struct nvme_subsystem *subsys); ++static void nvme_remove_invalid_namespaces(struct nvme_ctrl *ctrl, ++ unsigned nsid); ++ ++static void nvme_set_queue_dying(struct nvme_ns *ns) ++{ ++ /* ++ * Revalidating a dead namespace sets capacity to 0. This will end ++ * buffered writers dirtying pages that can't be synced. ++ */ ++ if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags)) ++ return; ++ revalidate_disk(ns->disk); ++ blk_set_queue_dying(ns->queue); ++ /* Forcibly unquiesce queues to avoid blocking dispatch */ ++ blk_mq_unquiesce_queue(ns->queue); ++} + + int nvme_reset_ctrl(struct nvme_ctrl *ctrl) + { +@@ -1130,19 +1146,15 @@ static u32 nvme_passthru_start(struct nv + + static void nvme_update_formats(struct nvme_ctrl *ctrl) + { +- struct nvme_ns *ns, *next; +- LIST_HEAD(rm_list); ++ struct nvme_ns *ns; + +- down_write(&ctrl->namespaces_rwsem); +- list_for_each_entry(ns, &ctrl->namespaces, list) { +- if (ns->disk && nvme_revalidate_disk(ns->disk)) { +- list_move_tail(&ns->list, &rm_list); +- } +- } +- up_write(&ctrl->namespaces_rwsem); ++ down_read(&ctrl->namespaces_rwsem); ++ list_for_each_entry(ns, &ctrl->namespaces, list) ++ if (ns->disk && nvme_revalidate_disk(ns->disk)) ++ nvme_set_queue_dying(ns); ++ up_read(&ctrl->namespaces_rwsem); + +- list_for_each_entry_safe(ns, next, &rm_list, list) +- nvme_ns_remove(ns); ++ nvme_remove_invalid_namespaces(ctrl, NVME_NSID_ALL); + } + + static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects) +@@ -3110,7 +3122,7 @@ static void nvme_remove_invalid_namespac + + down_write(&ctrl->namespaces_rwsem); + list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) { +- if (ns->head->ns_id > nsid) ++ if (ns->head->ns_id > nsid || test_bit(NVME_NS_DEAD, &ns->flags)) + list_move_tail(&ns->list, &rm_list); + } + up_write(&ctrl->namespaces_rwsem); +@@ -3488,19 +3500,9 @@ void nvme_kill_queues(struct nvme_ctrl * + if (ctrl->admin_q) + blk_mq_unquiesce_queue(ctrl->admin_q); + +- list_for_each_entry(ns, &ctrl->namespaces, list) { +- /* +- * Revalidating a dead namespace sets capacity to 0. This will +- * end buffered writers dirtying pages that can't be synced. +- */ +- if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags)) +- continue; +- revalidate_disk(ns->disk); +- blk_set_queue_dying(ns->queue); ++ list_for_each_entry(ns, &ctrl->namespaces, list) ++ nvme_set_queue_dying(ns); + +- /* Forcibly unquiesce queues to avoid blocking dispatch */ +- blk_mq_unquiesce_queue(ns->queue); +- } + up_read(&ctrl->namespaces_rwsem); + } + EXPORT_SYMBOL_GPL(nvme_kill_queues); diff --git a/queue-4.17/nvme-fix-handling-of-metadata_len-for-nvme_ioctl_io_cmd.patch b/queue-4.17/nvme-fix-handling-of-metadata_len-for-nvme_ioctl_io_cmd.patch new file mode 100644 index 00000000000..38ce2a31e13 --- /dev/null +++ b/queue-4.17/nvme-fix-handling-of-metadata_len-for-nvme_ioctl_io_cmd.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Roland Dreier +Date: Thu, 19 Jul 2018 20:07:59 -0700 +Subject: nvme: fix handling of metadata_len for NVME_IOCTL_IO_CMD + +From: Roland Dreier + +[ Upstream commit 9b382768135ee3ff282f828c906574a8478e036b ] + +The old code in nvme_user_cmd() passed the userspace virtual address +from nvme_passthru_cmd.metadata as the length of the metadata buffer +as well as the address to nvme_submit_user_cmd(). + +Fixes: 63263d60 ("nvme: Use metadata for passthrough commands") +Signed-off-by: Roland Dreier +Reviewed-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1209,7 +1209,7 @@ static int nvme_user_cmd(struct nvme_ctr + effects = nvme_passthru_start(ctrl, ns, cmd.opcode); + status = nvme_submit_user_cmd(ns ? ns->queue : ctrl->admin_q, &c, + (void __user *)(uintptr_t)cmd.addr, cmd.data_len, +- (void __user *)(uintptr_t)cmd.metadata, cmd.metadata, ++ (void __user *)(uintptr_t)cmd.metadata, cmd.metadata_len, + 0, &cmd.result, timeout); + nvme_passthru_end(ctrl, effects); + diff --git a/queue-4.17/nvme-pci-move-nvme_kill_queues-to-nvme_remove_dead_ctrl.patch b/queue-4.17/nvme-pci-move-nvme_kill_queues-to-nvme_remove_dead_ctrl.patch new file mode 100644 index 00000000000..54495ff9038 --- /dev/null +++ b/queue-4.17/nvme-pci-move-nvme_kill_queues-to-nvme_remove_dead_ctrl.patch @@ -0,0 +1,58 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jianchao Wang +Date: Wed, 20 Jun 2018 13:42:22 +0800 +Subject: nvme-pci: move nvme_kill_queues to nvme_remove_dead_ctrl + +From: Jianchao Wang + +[ Upstream commit 9f9cafc14016f23f982d3ce18f9057923bd3037a ] + +There is race between nvme_remove and nvme_reset_work that can +lead to io hang. + +nvme_remove nvme_reset_work + -> nvme_remove_dead_ctrl + -> nvme_dev_disable + -> quiesce request_queue + -> queue remove_work +-> cancel_work_sync reset_work +-> nvme_remove_namespaces + -> splice ctrl->namespaces + nvme_remove_dead_ctrl_work + -> nvme_kill_queues + -> nvme_ns_remove do nothing + -> blk_cleanup_queue + -> blk_freeze_queue + +Finally, the request_queue is quiesced state when wait freeze, +we will get io hang here. To fix it, move the nvme_kill_queues +from nvme_remove_dead_ctrl_work to nvme_remove_dead_ctrl. + +Suggested-by: Keith Busch +Signed-off-by: Jianchao Wang +Reviewed-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2291,6 +2291,7 @@ static void nvme_remove_dead_ctrl(struct + + nvme_get_ctrl(&dev->ctrl); + nvme_dev_disable(dev, false); ++ nvme_kill_queues(&dev->ctrl); + if (!queue_work(nvme_wq, &dev->remove_work)) + nvme_put_ctrl(&dev->ctrl); + } +@@ -2407,7 +2408,6 @@ static void nvme_remove_dead_ctrl_work(s + struct nvme_dev *dev = container_of(work, struct nvme_dev, remove_work); + struct pci_dev *pdev = to_pci_dev(dev->dev); + +- nvme_kill_queues(&dev->ctrl); + if (pci_get_drvdata(pdev)) + device_release_driver(&pdev->dev); + nvme_put_ctrl(&dev->ctrl); diff --git a/queue-4.17/nvme-rdma-fix-command-completion-race-at-error-recovery.patch b/queue-4.17/nvme-rdma-fix-command-completion-race-at-error-recovery.patch new file mode 100644 index 00000000000..ef2e9e0267f --- /dev/null +++ b/queue-4.17/nvme-rdma-fix-command-completion-race-at-error-recovery.patch @@ -0,0 +1,99 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Israel Rukshin +Date: Tue, 19 Jun 2018 15:34:11 +0300 +Subject: nvme-rdma: Fix command completion race at error recovery + +From: Israel Rukshin + +[ Upstream commit c947657b15379505a9bba36a02005882b66abe57 ] + +The race is between completing the request at error recovery work and +rdma completions. If we cancel the request before getting the good +rdma completion we get a NULL deref of the request MR at +nvme_rdma_process_nvme_rsp(). + +When Canceling the request we return its mr to the mr pool (set mr to +NULL) and also unmap its data. Canceling the requests while the rdma +queues are active is not safe. Because rdma queues are active and we +get good rdma completions that can use the mr pointer which may be NULL. +Completing the request too soon may lead also to performing DMA to/from +user buffers which might have been already unmapped. + +The commit fixes the race by draining the QP before starting the abort +commands mechanism. + +Signed-off-by: Israel Rukshin +Reviewed-by: Max Gurtovoy +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/rdma.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -734,7 +734,6 @@ out: + static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl, + bool remove) + { +- nvme_rdma_stop_queue(&ctrl->queues[0]); + if (remove) { + blk_cleanup_queue(ctrl->ctrl.admin_q); + nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset); +@@ -819,7 +818,6 @@ out_free_queue: + static void nvme_rdma_destroy_io_queues(struct nvme_rdma_ctrl *ctrl, + bool remove) + { +- nvme_rdma_stop_io_queues(ctrl); + if (remove) { + blk_cleanup_queue(ctrl->ctrl.connect_q); + nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset); +@@ -949,6 +947,7 @@ static void nvme_rdma_reconnect_ctrl_wor + return; + + destroy_admin: ++ nvme_rdma_stop_queue(&ctrl->queues[0]); + nvme_rdma_destroy_admin_queue(ctrl, false); + requeue: + dev_info(ctrl->ctrl.device, "Failed reconnect attempt %d\n", +@@ -965,12 +964,14 @@ static void nvme_rdma_error_recovery_wor + + if (ctrl->ctrl.queue_count > 1) { + nvme_stop_queues(&ctrl->ctrl); ++ nvme_rdma_stop_io_queues(ctrl); + blk_mq_tagset_busy_iter(&ctrl->tag_set, + nvme_cancel_request, &ctrl->ctrl); + nvme_rdma_destroy_io_queues(ctrl, false); + } + + blk_mq_quiesce_queue(ctrl->ctrl.admin_q); ++ nvme_rdma_stop_queue(&ctrl->queues[0]); + blk_mq_tagset_busy_iter(&ctrl->admin_tag_set, + nvme_cancel_request, &ctrl->ctrl); + nvme_rdma_destroy_admin_queue(ctrl, false); +@@ -1720,6 +1721,7 @@ static void nvme_rdma_shutdown_ctrl(stru + { + if (ctrl->ctrl.queue_count > 1) { + nvme_stop_queues(&ctrl->ctrl); ++ nvme_rdma_stop_io_queues(ctrl); + blk_mq_tagset_busy_iter(&ctrl->tag_set, + nvme_cancel_request, &ctrl->ctrl); + nvme_rdma_destroy_io_queues(ctrl, shutdown); +@@ -1731,6 +1733,7 @@ static void nvme_rdma_shutdown_ctrl(stru + nvme_disable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap); + + blk_mq_quiesce_queue(ctrl->ctrl.admin_q); ++ nvme_rdma_stop_queue(&ctrl->queues[0]); + blk_mq_tagset_busy_iter(&ctrl->admin_tag_set, + nvme_cancel_request, &ctrl->ctrl); + blk_mq_unquiesce_queue(ctrl->ctrl.admin_q); +@@ -1996,6 +1999,7 @@ static struct nvme_ctrl *nvme_rdma_creat + return &ctrl->ctrl; + + out_remove_admin_queue: ++ nvme_rdma_stop_queue(&ctrl->queues[0]); + nvme_rdma_destroy_admin_queue(ctrl, true); + out_uninit_ctrl: + nvme_uninit_ctrl(&ctrl->ctrl); diff --git a/queue-4.17/nvme-rdma-fix-possible-double-free-condition-when-failing-to-create-a-controller.patch b/queue-4.17/nvme-rdma-fix-possible-double-free-condition-when-failing-to-create-a-controller.patch new file mode 100644 index 00000000000..1d34727a701 --- /dev/null +++ b/queue-4.17/nvme-rdma-fix-possible-double-free-condition-when-failing-to-create-a-controller.patch @@ -0,0 +1,89 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Sagi Grimberg +Date: Tue, 19 Jun 2018 15:34:09 +0300 +Subject: nvme-rdma: fix possible double free condition when failing to create a controller + +From: Sagi Grimberg + +[ Upstream commit 3d0641015bf73aaa1cb54c936674959e7805070f ] + +Failures after nvme_init_ctrl will defer resource cleanups to .free_ctrl +when the reference is released, hence we should not free the controller +queues for these failures. + +Fix that by moving controller queues allocation before controller +initialization and correctly freeing them for failures before +initialization and skip them for failures after initialization. + +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/rdma.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -888,9 +888,9 @@ static void nvme_rdma_free_ctrl(struct n + list_del(&ctrl->list); + mutex_unlock(&nvme_rdma_ctrl_mutex); + +- kfree(ctrl->queues); + nvmf_free_options(nctrl->opts); + free_ctrl: ++ kfree(ctrl->queues); + kfree(ctrl); + } + +@@ -1916,11 +1916,6 @@ static struct nvme_ctrl *nvme_rdma_creat + goto out_free_ctrl; + } + +- ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_rdma_ctrl_ops, +- 0 /* no quirks, we're perfect! */); +- if (ret) +- goto out_free_ctrl; +- + INIT_DELAYED_WORK(&ctrl->reconnect_work, + nvme_rdma_reconnect_ctrl_work); + INIT_WORK(&ctrl->err_work, nvme_rdma_error_recovery_work); +@@ -1934,14 +1929,19 @@ static struct nvme_ctrl *nvme_rdma_creat + ctrl->queues = kcalloc(ctrl->ctrl.queue_count, sizeof(*ctrl->queues), + GFP_KERNEL); + if (!ctrl->queues) +- goto out_uninit_ctrl; ++ goto out_free_ctrl; ++ ++ ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_rdma_ctrl_ops, ++ 0 /* no quirks, we're perfect! */); ++ if (ret) ++ goto out_kfree_queues; + + changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING); + WARN_ON_ONCE(!changed); + + ret = nvme_rdma_configure_admin_queue(ctrl, true); + if (ret) +- goto out_kfree_queues; ++ goto out_uninit_ctrl; + + /* sanity check icdoff */ + if (ctrl->ctrl.icdoff) { +@@ -1997,14 +1997,14 @@ static struct nvme_ctrl *nvme_rdma_creat + + out_remove_admin_queue: + nvme_rdma_destroy_admin_queue(ctrl, true); +-out_kfree_queues: +- kfree(ctrl->queues); + out_uninit_ctrl: + nvme_uninit_ctrl(&ctrl->ctrl); + nvme_put_ctrl(&ctrl->ctrl); + if (ret > 0) + ret = -EIO; + return ERR_PTR(ret); ++out_kfree_queues: ++ kfree(ctrl->queues); + out_free_ctrl: + kfree(ctrl); + return ERR_PTR(ret); diff --git a/queue-4.17/nvmem-don-t-let-a-null-cell_id-for-nvmem_cell_get-crash-us.patch b/queue-4.17/nvmem-don-t-let-a-null-cell_id-for-nvmem_cell_get-crash-us.patch new file mode 100644 index 00000000000..e2f194e48a9 --- /dev/null +++ b/queue-4.17/nvmem-don-t-let-a-null-cell_id-for-nvmem_cell_get-crash-us.patch @@ -0,0 +1,75 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Douglas Anderson +Date: Mon, 18 Jun 2018 18:30:43 +0100 +Subject: nvmem: Don't let a NULL cell_id for nvmem_cell_get() crash us + +From: Douglas Anderson + +[ Upstream commit 87ed1405ef09d29a14df43295f7b6a93b63bfe6e ] + +In commit ca04d9d3e1b1 ("phy: qcom-qusb2: New driver for QUSB2 PHY on +Qcom chips") you can see a call like: + + devm_nvmem_cell_get(dev, NULL); + +Note that the cell ID passed to the function is NULL. This is because +the qcom-qusb2 driver is expected to work only on systems where the +PHY node is hooked up via device-tree and is nameless. + +This works OK for the most part. The first thing nvmem_cell_get() +does is to call of_nvmem_cell_get() and there it's documented that a +NULL name is fine. The problem happens when the call to +of_nvmem_cell_get() returns -EINVAL. In such a case we'll fall back +to nvmem_cell_get_from_list() and eventually might (if nvmem_cells +isn't an empty list) crash with something that looks like: + + strcmp + nvmem_find_cell + __nvmem_device_get + nvmem_cell_get_from_list + nvmem_cell_get + devm_nvmem_cell_get + qusb2_phy_probe + +There are several different ways we could fix this problem: + +One could argue that perhaps the qcom-qusb2 driver should be changed +to use of_nvmem_cell_get() which is allowed to have a NULL name. In +that case, we'd need to add a patche to introduce +devm_of_nvmem_cell_get() since the qcom-qusb2 driver is using devm +managed resources. + +One could also argue that perhaps we could just add a name to +qcom-qusb2. That would be OK but I believe it effectively changes the +device tree bindings, so maybe it's a no-go. + +In this patch I have chosen to fix the problem by simply not crashing +when a NULL cell_id is passed to nvmem_cell_get(). + +NOTE: that for the qcom-qusb2 driver the "nvmem-cells" property is +defined to be optional and thus it's expected to be a common case that +we would hit this crash and this is more than just a theoretical fix. + +Fixes: ca04d9d3e1b1 ("phy: qcom-qusb2: New driver for QUSB2 PHY on Qcom chips") +Signed-off-by: Douglas Anderson +Signed-off-by: Srinivas Kandagatla +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -924,6 +924,10 @@ struct nvmem_cell *nvmem_cell_get(struct + return cell; + } + ++ /* NULL cell_id only allowed for device tree; invalid otherwise */ ++ if (!cell_id) ++ return ERR_PTR(-EINVAL); ++ + return nvmem_cell_get_from_list(cell_id); + } + EXPORT_SYMBOL_GPL(nvmem_cell_get); diff --git a/queue-4.17/nvmet-reset-keep-alive-timer-in-controller-enable.patch b/queue-4.17/nvmet-reset-keep-alive-timer-in-controller-enable.patch new file mode 100644 index 00000000000..a3ec0a862f1 --- /dev/null +++ b/queue-4.17/nvmet-reset-keep-alive-timer-in-controller-enable.patch @@ -0,0 +1,40 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Max Gurtuvoy +Date: Tue, 19 Jun 2018 15:45:33 +0300 +Subject: nvmet: reset keep alive timer in controller enable + +From: Max Gurtuvoy + +[ Upstream commit d68a90e148f5a82aa67654c5012071e31c0e4baa ] + +Controllers that are not yet enabled should not really enforce keep alive +timeouts, but we still want to track a timeout and cleanup in case a host +died before it enabled the controller. Hence, simply reset the keep +alive timer when the controller is enabled. + +Suggested-by: Max Gurtovoy +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/target/core.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -624,6 +624,14 @@ static void nvmet_start_ctrl(struct nvme + } + + ctrl->csts = NVME_CSTS_RDY; ++ ++ /* ++ * Controllers that are not yet enabled should not really enforce the ++ * keep alive timeout, but we still want to track a timeout and cleanup ++ * in case a host died before it enabled the controller. Hence, simply ++ * reset the keep alive timer when the controller is enabled. ++ */ ++ mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ); + } + + static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl) diff --git a/queue-4.17/objtool-support-gcc-8-fnoreorder-functions.patch b/queue-4.17/objtool-support-gcc-8-fnoreorder-functions.patch new file mode 100644 index 00000000000..9b284379ac0 --- /dev/null +++ b/queue-4.17/objtool-support-gcc-8-fnoreorder-functions.patch @@ -0,0 +1,102 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Josh Poimboeuf +Date: Wed, 27 Jun 2018 17:03:45 -0500 +Subject: objtool: Support GCC 8 '-fnoreorder-functions' + +From: Josh Poimboeuf + +[ Upstream commit 08b393d01c88aff27347ed2b1b354eb4db2f1532 ] + +Since the following commit: + + cd77849a69cf ("objtool: Fix GCC 8 cold subfunction detection for aliased functions") + +... if the kernel is built with EXTRA_CFLAGS='-fno-reorder-functions', +objtool can get stuck in an infinite loop. + +That flag causes the new GCC 8 cold subfunctions to be placed in .text +instead of .text.unlikely. But it also has an unfortunate quirk: in the +symbol table, the subfunction (e.g., nmi_panic.cold.7) is nested inside +the parent (nmi_panic). + +That function overlap confuses objtool, and causes it to get into an +infinite loop in next_insn_same_func(). Here's Allan's description of +the loop: + + "Objtool iterates through the instructions in nmi_panic using + next_insn_same_func. Once it reaches the end of nmi_panic at 0x534 it + jumps to 0x528 as that's the start of nmi_panic.cold.7. However, since + the instructions starting at 0x528 are still associated with nmi_panic + objtool will get stuck in a loop, continually jumping back to 0x528 + after reaching 0x534." + +Fix it by shortening the length of the parent function so that the +functions no longer overlap. + +Reported-and-analyzed-by: Allan Xavier +Signed-off-by: Josh Poimboeuf +Cc: Allan Xavier +Cc: Andy Lutomirski +Cc: Borislav Petkov +Cc: Brian Gerst +Cc: Denys Vlasenko +Cc: H. Peter Anvin +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/9e704c52bee651129b036be14feda317ae5606ae.1530136978.git.jpoimboe@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/objtool/elf.c | 37 ++++++++++++++++++++++++++----------- + 1 file changed, 26 insertions(+), 11 deletions(-) + +--- a/tools/objtool/elf.c ++++ b/tools/objtool/elf.c +@@ -302,19 +302,34 @@ static int read_symbols(struct elf *elf) + continue; + sym->pfunc = sym->cfunc = sym; + coldstr = strstr(sym->name, ".cold."); +- if (coldstr) { +- coldstr[0] = '\0'; +- pfunc = find_symbol_by_name(elf, sym->name); +- coldstr[0] = '.'; ++ if (!coldstr) ++ continue; ++ ++ coldstr[0] = '\0'; ++ pfunc = find_symbol_by_name(elf, sym->name); ++ coldstr[0] = '.'; ++ ++ if (!pfunc) { ++ WARN("%s(): can't find parent function", ++ sym->name); ++ goto err; ++ } + +- if (!pfunc) { +- WARN("%s(): can't find parent function", +- sym->name); +- goto err; +- } ++ sym->pfunc = pfunc; ++ pfunc->cfunc = sym; + +- sym->pfunc = pfunc; +- pfunc->cfunc = sym; ++ /* ++ * Unfortunately, -fnoreorder-functions puts the child ++ * inside the parent. Remove the overlap so we can ++ * have sane assumptions. ++ * ++ * Note that pfunc->len now no longer matches ++ * pfunc->sym.st_size. ++ */ ++ if (sym->sec == pfunc->sec && ++ sym->offset >= pfunc->offset && ++ sym->offset + sym->len == pfunc->offset + pfunc->len) { ++ pfunc->len -= sym->len; + } + } + } diff --git a/queue-4.17/octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch b/queue-4.17/octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch new file mode 100644 index 00000000000..b5a5776da74 --- /dev/null +++ b/queue-4.17/octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch @@ -0,0 +1,63 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Alexander Sverdlin +Date: Fri, 13 Jul 2018 17:31:50 +0200 +Subject: octeon_mgmt: Fix MIX registers configuration on MTU setup + +From: Alexander Sverdlin + +[ Upstream commit 4aac0b43474d18f6160302a3caa147d77fa3baa1 ] + +octeon_mgmt driver doesn't drop RX frames that are 1-4 bytes bigger than +MTU set for the corresponding interface. The problem is in the +AGL_GMX_RX0/1_FRM_MAX register setting, which should not account for VLAN +tagging. + +According to Octeon HW manual: +"For tagged frames, MAX increases by four bytes for each VLAN found up to a +maximum of two VLANs, or MAX + 8 bytes." + +OCTEON_FRAME_HEADER_LEN "define" is fine for ring buffer management, but +should not be used for AGL_GMX_RX0/1_FRM_MAX. + +The problem could be easily reproduced using "ping" command. If affected +system has default MTU 1500, other host (having MTU >= 1504) can +successfully "ping" the affected system with payload size 1473-1476, +resulting in IP packets of size 1501-1504 accepted by the mgmt driver. +Fixed system still accepts IP packets of 1500 bytes even with VLAN tagging, +because the limits are lifted in HW as expected, for every VLAN tag. + +Signed-off-by: Alexander Sverdlin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cavium/octeon/octeon_mgmt.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c ++++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c +@@ -643,13 +643,21 @@ static int octeon_mgmt_set_mac_address(s + static int octeon_mgmt_change_mtu(struct net_device *netdev, int new_mtu) + { + struct octeon_mgmt *p = netdev_priv(netdev); +- int size_without_fcs = new_mtu + OCTEON_MGMT_RX_HEADROOM; ++ int max_packet = new_mtu + ETH_HLEN + ETH_FCS_LEN; + + netdev->mtu = new_mtu; + +- cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, size_without_fcs); ++ /* HW lifts the limit if the frame is VLAN tagged ++ * (+4 bytes per each tag, up to two tags) ++ */ ++ cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, max_packet); ++ /* Set the hardware to truncate packets larger than the MTU. The jabber ++ * register must be set to a multiple of 8 bytes, so round up. JABBER is ++ * an unconditional limit, so we need to account for two possible VLAN ++ * tags. ++ */ + cvmx_write_csr(p->agl + AGL_GMX_RX_JABBER, +- (size_without_fcs + 7) & 0xfff8); ++ (max_packet + 7 + VLAN_HLEN * 2) & 0xfff8); + + return 0; + } diff --git a/queue-4.17/of-overlay-update-phandle-cache-on-overlay-apply-and-remove.patch b/queue-4.17/of-overlay-update-phandle-cache-on-overlay-apply-and-remove.patch new file mode 100644 index 00000000000..4c15c303357 --- /dev/null +++ b/queue-4.17/of-overlay-update-phandle-cache-on-overlay-apply-and-remove.patch @@ -0,0 +1,95 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Frank Rowand +Date: Thu, 12 Jul 2018 14:00:07 -0700 +Subject: of: overlay: update phandle cache on overlay apply and remove + +From: Frank Rowand + +[ Upstream commit b9952b5218added5577e4a3443969bc20884cea9 ] + +A comment in the review of the patch adding the phandle cache said that +the cache would have to be updated when modules are applied and removed. +This patch implements the cache updates. + +Fixes: 0b3ce78e90fc ("of: cache phandle nodes to reduce cost of of_find_node_by_phandle()") +Reported-by: Alan Tull +Suggested-by: Alan Tull +Signed-off-by: Frank Rowand +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/of/base.c | 6 +++--- + drivers/of/of_private.h | 2 ++ + drivers/of/overlay.c | 11 +++++++++++ + 3 files changed, 16 insertions(+), 3 deletions(-) + +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -102,7 +102,7 @@ static u32 phandle_cache_mask; + * - the phandle lookup overhead reduction provided by the cache + * will likely be less + */ +-static void of_populate_phandle_cache(void) ++void of_populate_phandle_cache(void) + { + unsigned long flags; + u32 cache_entries; +@@ -134,8 +134,7 @@ out: + raw_spin_unlock_irqrestore(&devtree_lock, flags); + } + +-#ifndef CONFIG_MODULES +-static int __init of_free_phandle_cache(void) ++int of_free_phandle_cache(void) + { + unsigned long flags; + +@@ -148,6 +147,7 @@ static int __init of_free_phandle_cache( + + return 0; + } ++#if !defined(CONFIG_MODULES) + late_initcall_sync(of_free_phandle_cache); + #endif + +--- a/drivers/of/of_private.h ++++ b/drivers/of/of_private.h +@@ -79,6 +79,8 @@ int of_resolve_phandles(struct device_no + #if defined(CONFIG_OF_OVERLAY) + void of_overlay_mutex_lock(void); + void of_overlay_mutex_unlock(void); ++int of_free_phandle_cache(void); ++void of_populate_phandle_cache(void); + #else + static inline void of_overlay_mutex_lock(void) {}; + static inline void of_overlay_mutex_unlock(void) {}; +--- a/drivers/of/overlay.c ++++ b/drivers/of/overlay.c +@@ -804,6 +804,8 @@ static int of_overlay_apply(const void * + goto err_free_overlay_changeset; + } + ++ of_populate_phandle_cache(); ++ + ret = __of_changeset_apply_notify(&ovcs->cset); + if (ret) + pr_err("overlay changeset entry notify error %d\n", ret); +@@ -1046,8 +1048,17 @@ int of_overlay_remove(int *ovcs_id) + + list_del(&ovcs->ovcs_list); + ++ /* ++ * Disable phandle cache. Avoids race condition that would arise ++ * from removing cache entry when the associated node is deleted. ++ */ ++ of_free_phandle_cache(); ++ + ret_apply = 0; + ret = __of_changeset_revert_entries(&ovcs->cset, &ret_apply); ++ ++ of_populate_phandle_cache(); ++ + if (ret) { + if (ret_apply) + devicetree_state_flags |= DTSF_REVERT_FAIL; diff --git a/queue-4.17/openrisc-entry-fix-delay-slot-exception-detection.patch b/queue-4.17/openrisc-entry-fix-delay-slot-exception-detection.patch new file mode 100644 index 00000000000..1d517333640 --- /dev/null +++ b/queue-4.17/openrisc-entry-fix-delay-slot-exception-detection.patch @@ -0,0 +1,107 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Stafford Horne +Date: Sun, 1 Jul 2018 14:17:36 +0900 +Subject: openrisc: entry: Fix delay slot exception detection + +From: Stafford Horne + +[ Upstream commit ae15a41a641449f536578b0d9ec0e4ade130deb5 ] + +Originally in patch e6d20c55a4 ("openrisc: entry: Fix delay slot +detection") I fixed delay slot detection, but only for QEMU. We missed +that hardware delay slot detection using delay slot exception flag (DSX) +was still broken. This was because QEMU set the DSX flag in both +pre-exception supervision register (ESR) and supervision register (SR) +register, but on real hardware the DSX flag is only set on the SR +register during exceptions. + +Fix this by carrying the DSX flag into the SR register during exception. +We also update the DSX flag read locations to read the value from the SR +register not the pt_regs SR register which represents ESR. The ESR +should never have the DSX flag set. + +In the process I updated/removed a few comments to match the current +state. Including removing a comment saying that the DSX detection logic +was inefficient and needed to be rewritten. + +I have tested this on QEMU with a patch ensuring it matches the hardware +specification. + +Link: https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg00000.html +Fixes: e6d20c55a4 ("openrisc: entry: Fix delay slot detection") +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/openrisc/kernel/entry.S | 8 +------- + arch/openrisc/kernel/head.S | 9 ++++++--- + arch/openrisc/kernel/traps.c | 2 +- + 3 files changed, 8 insertions(+), 11 deletions(-) + +--- a/arch/openrisc/kernel/entry.S ++++ b/arch/openrisc/kernel/entry.S +@@ -277,12 +277,6 @@ EXCEPTION_ENTRY(_data_page_fault_handler + l.addi r3,r1,0 // pt_regs + /* r4 set be EXCEPTION_HANDLE */ // effective address of fault + +- /* +- * __PHX__: TODO +- * +- * all this can be written much simpler. look at +- * DTLB miss handler in the CONFIG_GUARD_PROTECTED_CORE part +- */ + #ifdef CONFIG_OPENRISC_NO_SPR_SR_DSX + l.lwz r6,PT_PC(r3) // address of an offending insn + l.lwz r6,0(r6) // instruction that caused pf +@@ -314,7 +308,7 @@ EXCEPTION_ENTRY(_data_page_fault_handler + + #else + +- l.lwz r6,PT_SR(r3) // SR ++ l.mfspr r6,r0,SPR_SR // SR + l.andi r6,r6,SPR_SR_DSX // check for delay slot exception + l.sfne r6,r0 // exception happened in delay slot + l.bnf 7f +--- a/arch/openrisc/kernel/head.S ++++ b/arch/openrisc/kernel/head.S +@@ -210,8 +210,7 @@ + * r4 - EEAR exception EA + * r10 - current pointing to current_thread_info struct + * r12 - syscall 0, since we didn't come from syscall +- * r13 - temp it actually contains new SR, not needed anymore +- * r31 - handler address of the handler we'll jump to ++ * r30 - handler address of the handler we'll jump to + * + * handler has to save remaining registers to the exception + * ksp frame *before* tainting them! +@@ -244,6 +243,7 @@ + /* r1 is KSP, r30 is __pa(KSP) */ ;\ + tophys (r30,r1) ;\ + l.sw PT_GPR12(r30),r12 ;\ ++ /* r4 use for tmp before EA */ ;\ + l.mfspr r12,r0,SPR_EPCR_BASE ;\ + l.sw PT_PC(r30),r12 ;\ + l.mfspr r12,r0,SPR_ESR_BASE ;\ +@@ -263,7 +263,10 @@ + /* r12 == 1 if we come from syscall */ ;\ + CLEAR_GPR(r12) ;\ + /* ----- turn on MMU ----- */ ;\ +- l.ori r30,r0,(EXCEPTION_SR) ;\ ++ /* Carry DSX into exception SR */ ;\ ++ l.mfspr r30,r0,SPR_SR ;\ ++ l.andi r30,r30,SPR_SR_DSX ;\ ++ l.ori r30,r30,(EXCEPTION_SR) ;\ + l.mtspr r0,r30,SPR_ESR_BASE ;\ + /* r30: EA address of handler */ ;\ + LOAD_SYMBOL_2_GPR(r30,handler) ;\ +--- a/arch/openrisc/kernel/traps.c ++++ b/arch/openrisc/kernel/traps.c +@@ -317,7 +317,7 @@ static inline int in_delay_slot(struct p + return 0; + } + #else +- return regs->sr & SPR_SR_DSX; ++ return mfspr(SPR_SR) & SPR_SR_DSX; + #endif + } + diff --git a/queue-4.17/packet-reset-network-header-if-packet-shorter-than-ll-reserved-space.patch b/queue-4.17/packet-reset-network-header-if-packet-shorter-than-ll-reserved-space.patch new file mode 100644 index 00000000000..0a580e924c0 --- /dev/null +++ b/queue-4.17/packet-reset-network-header-if-packet-shorter-than-ll-reserved-space.patch @@ -0,0 +1,35 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Willem de Bruijn +Date: Wed, 11 Jul 2018 12:00:45 -0400 +Subject: packet: reset network header if packet shorter than ll reserved space + +From: Willem de Bruijn + +[ Upstream commit 993675a3100b16a4c80dfd70cbcde8ea7127b31d ] + +If variable length link layer headers result in a packet shorter +than dev->hard_header_len, reset the network header offset. Else +skb->mac_len may exceed skb->len after skb_mac_reset_len. + +packet_sendmsg_spkt already has similar logic. + +Fixes: b84bbaf7a6c8 ("packet: in packet_snd start writing at link layer allocation") +Signed-off-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/packet/af_packet.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2910,6 +2910,8 @@ static int packet_snd(struct socket *soc + goto out_free; + } else if (reserve) { + skb_reserve(skb, -reserve); ++ if (len < reserve) ++ skb_reset_network_header(skb); + } + + /* Returns -EFAULT on error */ diff --git a/queue-4.17/pci-aardvark-fix-i-o-space-page-leak.patch b/queue-4.17/pci-aardvark-fix-i-o-space-page-leak.patch new file mode 100644 index 00000000000..5f9badf9f46 --- /dev/null +++ b/queue-4.17/pci-aardvark-fix-i-o-space-page-leak.patch @@ -0,0 +1,89 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sergei Shtylyov +Date: Wed, 18 Jul 2018 15:40:53 -0500 +Subject: PCI: aardvark: Fix I/O space page leak + +From: Sergei Shtylyov + +[ Upstream commit 1df3e5b3feebf29a3ecfa0c0f06f79544ca573e4 ] + +When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY +driver was left disabled, the kernel crashed with this BUG: + + kernel BUG at lib/ioremap.c:72! + Internal error: Oops - BUG: 0 [#1] PREEMPT SMP + Modules linked in: + CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 + Hardware name: Renesas Condor board based on r8a77980 (DT) + Workqueue: events deferred_probe_work_func + pstate: 80000005 (Nzcv daif -PAN -UAO) + pc : ioremap_page_range+0x370/0x3c8 + lr : ioremap_page_range+0x40/0x3c8 + sp : ffff000008da39e0 + x29: ffff000008da39e0 x28: 00e8000000000f07 + x27: ffff7dfffee00000 x26: 0140000000000000 + x25: ffff7dfffef00000 x24: 00000000000fe100 + x23: ffff80007b906000 x22: ffff000008ab8000 + x21: ffff000008bb1d58 x20: ffff7dfffef00000 + x19: ffff800009c30fb8 x18: 0000000000000001 + x17: 00000000000152d0 x16: 00000000014012d0 + x15: 0000000000000000 x14: 0720072007200720 + x13: 0720072007200720 x12: 0720072007200720 + x11: 0720072007300730 x10: 00000000000000ae + x9 : 0000000000000000 x8 : ffff7dffff000000 + x7 : 0000000000000000 x6 : 0000000000000100 + x5 : 0000000000000000 x4 : 000000007b906000 + x3 : ffff80007c61a880 x2 : ffff7dfffeefffff + x1 : 0000000040000000 x0 : 00e80000fe100f07 + Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) + Call trace: + ioremap_page_range+0x370/0x3c8 + pci_remap_iospace+0x7c/0xac + pci_parse_request_of_pci_ranges+0x13c/0x190 + rcar_pcie_probe+0x4c/0xb04 + platform_drv_probe+0x50/0xbc + driver_probe_device+0x21c/0x308 + __device_attach_driver+0x98/0xc8 + bus_for_each_drv+0x54/0x94 + __device_attach+0xc4/0x12c + device_initial_probe+0x10/0x18 + bus_probe_device+0x90/0x98 + deferred_probe_work_func+0xb0/0x150 + process_one_work+0x12c/0x29c + worker_thread+0x200/0x3fc + kthread+0x108/0x134 + ret_from_fork+0x10/0x18 + Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000) + +It turned out that pci_remap_iospace() wasn't undone when the driver's +probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER, +the probe was retried, finally causing the BUG due to trying to remap +already remapped pages. + +The Aardvark PCI controller driver has the same issue. +Replace pci_remap_iospace() with its devm_ managed version to fix the bug. + +Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver") +Signed-off-by: Sergei Shtylyov +[lorenzo.pieralisi@arm.com: updated the commit log] +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Thomas Petazzoni +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/host/pci-aardvark.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/host/pci-aardvark.c ++++ b/drivers/pci/host/pci-aardvark.c +@@ -848,7 +848,7 @@ static int advk_pcie_parse_request_of_pc + 0, 0xF8000000, 0, + lower_32_bits(res->start), + OB_PCIE_IO); +- err = pci_remap_iospace(res, iobase); ++ err = devm_pci_remap_iospace(dev, res, iobase); + if (err) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + err, res); diff --git a/queue-4.17/pci-designware-fix-i-o-space-page-leak.patch b/queue-4.17/pci-designware-fix-i-o-space-page-leak.patch new file mode 100644 index 00000000000..16f34e66ac4 --- /dev/null +++ b/queue-4.17/pci-designware-fix-i-o-space-page-leak.patch @@ -0,0 +1,92 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sergei Shtylyov +Date: Wed, 18 Jul 2018 15:40:46 -0500 +Subject: PCI: designware: Fix I/O space page leak + +From: Sergei Shtylyov + +[ Upstream commit fd07f5e19c6fcdfa318944764248cf44eb06e532 ] + +When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY +driver is left disabled, the kernel crashed with this BUG: + + kernel BUG at lib/ioremap.c:72! + Internal error: Oops - BUG: 0 [#1] PREEMPT SMP + Modules linked in: + CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 + Hardware name: Renesas Condor board based on r8a77980 (DT) + Workqueue: events deferred_probe_work_func + pstate: 80000005 (Nzcv daif -PAN -UAO) + pc : ioremap_page_range+0x370/0x3c8 + lr : ioremap_page_range+0x40/0x3c8 + sp : ffff000008da39e0 + x29: ffff000008da39e0 x28: 00e8000000000f07 + x27: ffff7dfffee00000 x26: 0140000000000000 + x25: ffff7dfffef00000 x24: 00000000000fe100 + x23: ffff80007b906000 x22: ffff000008ab8000 + x21: ffff000008bb1d58 x20: ffff7dfffef00000 + x19: ffff800009c30fb8 x18: 0000000000000001 + x17: 00000000000152d0 x16: 00000000014012d0 + x15: 0000000000000000 x14: 0720072007200720 + x13: 0720072007200720 x12: 0720072007200720 + x11: 0720072007300730 x10: 00000000000000ae + x9 : 0000000000000000 x8 : ffff7dffff000000 + x7 : 0000000000000000 x6 : 0000000000000100 + x5 : 0000000000000000 x4 : 000000007b906000 + x3 : ffff80007c61a880 x2 : ffff7dfffeefffff + x1 : 0000000040000000 x0 : 00e80000fe100f07 + Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) + Call trace: + ioremap_page_range+0x370/0x3c8 + pci_remap_iospace+0x7c/0xac + pci_parse_request_of_pci_ranges+0x13c/0x190 + rcar_pcie_probe+0x4c/0xb04 + platform_drv_probe+0x50/0xbc + driver_probe_device+0x21c/0x308 + __device_attach_driver+0x98/0xc8 + bus_for_each_drv+0x54/0x94 + __device_attach+0xc4/0x12c + device_initial_probe+0x10/0x18 + bus_probe_device+0x90/0x98 + deferred_probe_work_func+0xb0/0x150 + process_one_work+0x12c/0x29c + worker_thread+0x200/0x3fc + kthread+0x108/0x134 + ret_from_fork+0x10/0x18 + Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000) + +It turned out that pci_remap_iospace() wasn't undone when the driver's +probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER, +the probe was retried, finally causing the BUG due to trying to remap +already remapped pages. + +The DesignWare PCIe controller driver has the same issue. + +Replace devm_pci_remap_iospace() with a devm_ managed version to fix the +bug. + +Fixes: cbce7900598c ("PCI: designware: Make driver arch-agnostic") +Signed-off-by: Sergei Shtylyov +[lorenzo.pieralisi@arm.com: updated the commit log] +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Linus Walleij +Acked-by: Jingoo Han +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/dwc/pcie-designware-host.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/pci/dwc/pcie-designware-host.c ++++ b/drivers/pci/dwc/pcie-designware-host.c +@@ -355,7 +355,8 @@ int dw_pcie_host_init(struct pcie_port * + resource_list_for_each_entry_safe(win, tmp, &bridge->windows) { + switch (resource_type(win->res)) { + case IORESOURCE_IO: +- ret = pci_remap_iospace(win->res, pp->io_base); ++ ret = devm_pci_remap_iospace(dev, win->res, ++ pp->io_base); + if (ret) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + ret, win->res); diff --git a/queue-4.17/pci-faraday-add-missing-of_node_put.patch b/queue-4.17/pci-faraday-add-missing-of_node_put.patch new file mode 100644 index 00000000000..a0266564330 --- /dev/null +++ b/queue-4.17/pci-faraday-add-missing-of_node_put.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Nicholas Mc Guire +Date: Fri, 29 Jun 2018 13:50:27 -0500 +Subject: PCI: faraday: Add missing of_node_put() + +From: Nicholas Mc Guire + +[ Upstream commit 3dc6ddfedc2818eaaa36842fbb049191e0c5e50f ] + +The call to of_get_next_child() returns a node pointer with refcount +incremented thus it must be explicitly decremented here in the error +path and after the last usage. + +Fixes: d3c68e0a7e34 ("PCI: faraday: Add Faraday Technology FTPCI100 PCI Host Bridge driver") +Signed-off-by: Nicholas Mc Guire +[lorenzo.pieralisi@arm.com: updated commit log] +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/host/pci-ftpci100.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/pci/host/pci-ftpci100.c ++++ b/drivers/pci/host/pci-ftpci100.c +@@ -353,11 +353,13 @@ static int faraday_pci_setup_cascaded_ir + irq = of_irq_get(intc, 0); + if (irq <= 0) { + dev_err(p->dev, "failed to get parent IRQ\n"); ++ of_node_put(intc); + return irq ?: -EINVAL; + } + + p->irqdomain = irq_domain_add_linear(intc, PCI_NUM_INTX, + &faraday_pci_irqdomain_ops, p); ++ of_node_put(intc); + if (!p->irqdomain) { + dev_err(p->dev, "failed to create Gemini PCI IRQ domain\n"); + return -EINVAL; diff --git a/queue-4.17/pci-faraday-fix-i-o-space-page-leak.patch b/queue-4.17/pci-faraday-fix-i-o-space-page-leak.patch new file mode 100644 index 00000000000..b2be6a8fbec --- /dev/null +++ b/queue-4.17/pci-faraday-fix-i-o-space-page-leak.patch @@ -0,0 +1,88 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sergei Shtylyov +Date: Wed, 18 Jul 2018 15:40:59 -0500 +Subject: PCI: faraday: Fix I/O space page leak + +From: Sergei Shtylyov + +[ Upstream commit e30609454b39139a91faf631685f503b7ea3f27d ] + +When testing the R-Car PCIe driver on the Condor board, if +the PCIe PHY driver was left disabled, the kernel crashed with this BUG: + + kernel BUG at lib/ioremap.c:72! + Internal error: Oops - BUG: 0 [#1] PREEMPT SMP + Modules linked in: + CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 + Hardware name: Renesas Condor board based on r8a77980 (DT) + Workqueue: events deferred_probe_work_func + pstate: 80000005 (Nzcv daif -PAN -UAO) + pc : ioremap_page_range+0x370/0x3c8 + lr : ioremap_page_range+0x40/0x3c8 + sp : ffff000008da39e0 + x29: ffff000008da39e0 x28: 00e8000000000f07 + x27: ffff7dfffee00000 x26: 0140000000000000 + x25: ffff7dfffef00000 x24: 00000000000fe100 + x23: ffff80007b906000 x22: ffff000008ab8000 + x21: ffff000008bb1d58 x20: ffff7dfffef00000 + x19: ffff800009c30fb8 x18: 0000000000000001 + x17: 00000000000152d0 x16: 00000000014012d0 + x15: 0000000000000000 x14: 0720072007200720 + x13: 0720072007200720 x12: 0720072007200720 + x11: 0720072007300730 x10: 00000000000000ae + x9 : 0000000000000000 x8 : ffff7dffff000000 + x7 : 0000000000000000 x6 : 0000000000000100 + x5 : 0000000000000000 x4 : 000000007b906000 + x3 : ffff80007c61a880 x2 : ffff7dfffeefffff + x1 : 0000000040000000 x0 : 00e80000fe100f07 + Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) + Call trace: + ioremap_page_range+0x370/0x3c8 + pci_remap_iospace+0x7c/0xac + pci_parse_request_of_pci_ranges+0x13c/0x190 + rcar_pcie_probe+0x4c/0xb04 + platform_drv_probe+0x50/0xbc + driver_probe_device+0x21c/0x308 + __device_attach_driver+0x98/0xc8 + bus_for_each_drv+0x54/0x94 + __device_attach+0xc4/0x12c + device_initial_probe+0x10/0x18 + bus_probe_device+0x90/0x98 + deferred_probe_work_func+0xb0/0x150 + process_one_work+0x12c/0x29c + worker_thread+0x200/0x3fc + kthread+0x108/0x134 + ret_from_fork+0x10/0x18 + Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000) + +It turned out that pci_remap_iospace() wasn't undone when the driver's +probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER, +the probe was retried, finally causing the BUG due to trying to remap +already remapped pages. + +The Faraday PCI driver has the same issue. Replace pci_remap_iospace() +with its devm_ managed version to fix the bug. + +Fixes: d3c68e0a7e34 ("PCI: faraday: Add Faraday Technology FTPCI100 PCI Host Bridge driver") +Signed-off-by: Sergei Shtylyov +[lorenzo.pieralisi@arm.com: updated the commit log] +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/host/pci-ftpci100.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/host/pci-ftpci100.c ++++ b/drivers/pci/host/pci-ftpci100.c +@@ -501,7 +501,7 @@ static int faraday_pci_probe(struct plat + dev_err(dev, "illegal IO mem size\n"); + return -EINVAL; + } +- ret = pci_remap_iospace(io, io_base); ++ ret = devm_pci_remap_iospace(dev, io, io_base); + if (ret) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + ret, io); diff --git a/queue-4.17/pci-mediatek-fix-i-o-space-page-leak.patch b/queue-4.17/pci-mediatek-fix-i-o-space-page-leak.patch new file mode 100644 index 00000000000..fdb657fc4c3 --- /dev/null +++ b/queue-4.17/pci-mediatek-fix-i-o-space-page-leak.patch @@ -0,0 +1,90 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sergei Shtylyov +Date: Wed, 18 Jul 2018 15:41:05 -0500 +Subject: PCI: mediatek: Fix I/O space page leak + +From: Sergei Shtylyov + +[ Upstream commit 438477b9a089e45ea7c8fb549553e52833117ed8 ] + +When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY +driver was left disabled, the kernel crashed with this BUG: + + kernel BUG at lib/ioremap.c:72! + Internal error: Oops - BUG: 0 [#1] PREEMPT SMP + Modules linked in: + CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 + Hardware name: Renesas Condor board based on r8a77980 (DT) + Workqueue: events deferred_probe_work_func + pstate: 80000005 (Nzcv daif -PAN -UAO) + pc : ioremap_page_range+0x370/0x3c8 + lr : ioremap_page_range+0x40/0x3c8 + sp : ffff000008da39e0 + x29: ffff000008da39e0 x28: 00e8000000000f07 + x27: ffff7dfffee00000 x26: 0140000000000000 + x25: ffff7dfffef00000 x24: 00000000000fe100 + x23: ffff80007b906000 x22: ffff000008ab8000 + x21: ffff000008bb1d58 x20: ffff7dfffef00000 + x19: ffff800009c30fb8 x18: 0000000000000001 + x17: 00000000000152d0 x16: 00000000014012d0 + x15: 0000000000000000 x14: 0720072007200720 + x13: 0720072007200720 x12: 0720072007200720 + x11: 0720072007300730 x10: 00000000000000ae + x9 : 0000000000000000 x8 : ffff7dffff000000 + x7 : 0000000000000000 x6 : 0000000000000100 + x5 : 0000000000000000 x4 : 000000007b906000 + x3 : ffff80007c61a880 x2 : ffff7dfffeefffff + x1 : 0000000040000000 x0 : 00e80000fe100f07 + Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) + Call trace: + ioremap_page_range+0x370/0x3c8 + pci_remap_iospace+0x7c/0xac + pci_parse_request_of_pci_ranges+0x13c/0x190 + rcar_pcie_probe+0x4c/0xb04 + platform_drv_probe+0x50/0xbc + driver_probe_device+0x21c/0x308 + __device_attach_driver+0x98/0xc8 + bus_for_each_drv+0x54/0x94 + __device_attach+0xc4/0x12c + device_initial_probe+0x10/0x18 + bus_probe_device+0x90/0x98 + deferred_probe_work_func+0xb0/0x150 + process_one_work+0x12c/0x29c + worker_thread+0x200/0x3fc + kthread+0x108/0x134 + ret_from_fork+0x10/0x18 + Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000) + +It turned out that pci_remap_iospace() wasn't undone when the driver's +probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER, +the probe was retried, finally causing the BUG due to trying to remap +already remapped pages. + +The MediaTek PCIe driver has the same issue. + +Replace devm_pci_remap_iospace() with its devm_ managed counterpart +to fix the bug. + +Fixes: 637cfacae96f ("PCI: mediatek: Add MediaTek PCIe host controller support") +Signed-off-by: Sergei Shtylyov +[lorenzo.pieralisi@arm.com: updated the commit log] +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/host/pcie-mediatek.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/host/pcie-mediatek.c ++++ b/drivers/pci/host/pcie-mediatek.c +@@ -1063,7 +1063,7 @@ static int mtk_pcie_request_resources(st + if (err < 0) + return err; + +- pci_remap_iospace(&pcie->pio, pcie->io.start); ++ devm_pci_remap_iospace(dev, &pcie->pio, pcie->io.start); + + return 0; + } diff --git a/queue-4.17/pci-of-fix-i-o-space-page-leak.patch b/queue-4.17/pci-of-fix-i-o-space-page-leak.patch new file mode 100644 index 00000000000..17cdef41f5a --- /dev/null +++ b/queue-4.17/pci-of-fix-i-o-space-page-leak.patch @@ -0,0 +1,148 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sergei Shtylyov +Date: Wed, 18 Jul 2018 15:40:26 -0500 +Subject: PCI: OF: Fix I/O space page leak + +From: Sergei Shtylyov + +[ Upstream commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 ] + +When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY +driver was left disabled, the kernel crashed with this BUG: + + kernel BUG at lib/ioremap.c:72! + Internal error: Oops - BUG: 0 [#1] PREEMPT SMP + Modules linked in: + CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 + Hardware name: Renesas Condor board based on r8a77980 (DT) + Workqueue: events deferred_probe_work_func + pstate: 80000005 (Nzcv daif -PAN -UAO) + pc : ioremap_page_range+0x370/0x3c8 + lr : ioremap_page_range+0x40/0x3c8 + sp : ffff000008da39e0 + x29: ffff000008da39e0 x28: 00e8000000000f07 + x27: ffff7dfffee00000 x26: 0140000000000000 + x25: ffff7dfffef00000 x24: 00000000000fe100 + x23: ffff80007b906000 x22: ffff000008ab8000 + x21: ffff000008bb1d58 x20: ffff7dfffef00000 + x19: ffff800009c30fb8 x18: 0000000000000001 + x17: 00000000000152d0 x16: 00000000014012d0 + x15: 0000000000000000 x14: 0720072007200720 + x13: 0720072007200720 x12: 0720072007200720 + x11: 0720072007300730 x10: 00000000000000ae + x9 : 0000000000000000 x8 : ffff7dffff000000 + x7 : 0000000000000000 x6 : 0000000000000100 + x5 : 0000000000000000 x4 : 000000007b906000 + x3 : ffff80007c61a880 x2 : ffff7dfffeefffff + x1 : 0000000040000000 x0 : 00e80000fe100f07 + Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) + Call trace: + ioremap_page_range+0x370/0x3c8 + pci_remap_iospace+0x7c/0xac + pci_parse_request_of_pci_ranges+0x13c/0x190 + rcar_pcie_probe+0x4c/0xb04 + platform_drv_probe+0x50/0xbc + driver_probe_device+0x21c/0x308 + __device_attach_driver+0x98/0xc8 + bus_for_each_drv+0x54/0x94 + __device_attach+0xc4/0x12c + device_initial_probe+0x10/0x18 + bus_probe_device+0x90/0x98 + deferred_probe_work_func+0xb0/0x150 + process_one_work+0x12c/0x29c + worker_thread+0x200/0x3fc + kthread+0x108/0x134 + ret_from_fork+0x10/0x18 + Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000) + +It turned out that pci_remap_iospace() wasn't undone when the driver's +probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER, +the probe was retried, finally causing the BUG due to trying to remap +already remapped pages. + +Introduce the devm_pci_remap_iospace() managed API and replace the +pci_remap_iospace() call with it to fix the bug. + +Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API") +Signed-off-by: Sergei Shtylyov +[lorenzo.pieralisi@arm.com: split commit/updated the commit log] +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/of.c | 2 +- + drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++ + include/linux/pci.h | 2 ++ + 3 files changed, 41 insertions(+), 1 deletion(-) + +--- a/drivers/pci/of.c ++++ b/drivers/pci/of.c +@@ -617,7 +617,7 @@ int pci_parse_request_of_pci_ranges(stru + + switch (resource_type(res)) { + case IORESOURCE_IO: +- err = pci_remap_iospace(res, iobase); ++ err = devm_pci_remap_iospace(dev, res, iobase); + if (err) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + err, res); +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -3573,6 +3573,44 @@ void pci_unmap_iospace(struct resource * + } + EXPORT_SYMBOL(pci_unmap_iospace); + ++static void devm_pci_unmap_iospace(struct device *dev, void *ptr) ++{ ++ struct resource **res = ptr; ++ ++ pci_unmap_iospace(*res); ++} ++ ++/** ++ * devm_pci_remap_iospace - Managed pci_remap_iospace() ++ * @dev: Generic device to remap IO address for ++ * @res: Resource describing the I/O space ++ * @phys_addr: physical address of range to be mapped ++ * ++ * Managed pci_remap_iospace(). Map is automatically unmapped on driver ++ * detach. ++ */ ++int devm_pci_remap_iospace(struct device *dev, const struct resource *res, ++ phys_addr_t phys_addr) ++{ ++ const struct resource **ptr; ++ int error; ++ ++ ptr = devres_alloc(devm_pci_unmap_iospace, sizeof(*ptr), GFP_KERNEL); ++ if (!ptr) ++ return -ENOMEM; ++ ++ error = pci_remap_iospace(res, phys_addr); ++ if (error) { ++ devres_free(ptr); ++ } else { ++ *ptr = res; ++ devres_add(dev, ptr); ++ } ++ ++ return error; ++} ++EXPORT_SYMBOL(devm_pci_remap_iospace); ++ + /** + * devm_pci_remap_cfgspace - Managed pci_remap_cfgspace() + * @dev: Generic device to remap IO address for +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -1236,6 +1236,8 @@ int pci_register_io_range(struct fwnode_ + unsigned long pci_address_to_pio(phys_addr_t addr); + phys_addr_t pci_pio_to_address(unsigned long pio); + int pci_remap_iospace(const struct resource *res, phys_addr_t phys_addr); ++int devm_pci_remap_iospace(struct device *dev, const struct resource *res, ++ phys_addr_t phys_addr); + void pci_unmap_iospace(struct resource *res); + void __iomem *devm_pci_remap_cfgspace(struct device *dev, + resource_size_t offset, diff --git a/queue-4.17/pci-v3-semi-fix-i-o-space-page-leak.patch b/queue-4.17/pci-v3-semi-fix-i-o-space-page-leak.patch new file mode 100644 index 00000000000..ab563fbafe8 --- /dev/null +++ b/queue-4.17/pci-v3-semi-fix-i-o-space-page-leak.patch @@ -0,0 +1,89 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sergei Shtylyov +Date: Wed, 18 Jul 2018 15:41:11 -0500 +Subject: PCI: v3-semi: Fix I/O space page leak + +From: Sergei Shtylyov + +[ Upstream commit 270ed733e68955049b693bea8f4a1efb293a96ae ] + +When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY +driver was left disabled, the kernel crashed with this BUG: + + kernel BUG at lib/ioremap.c:72! + Internal error: Oops - BUG: 0 [#1] PREEMPT SMP + Modules linked in: + CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 + Hardware name: Renesas Condor board based on r8a77980 (DT) + Workqueue: events deferred_probe_work_func + pstate: 80000005 (Nzcv daif -PAN -UAO) + pc : ioremap_page_range+0x370/0x3c8 + lr : ioremap_page_range+0x40/0x3c8 + sp : ffff000008da39e0 + x29: ffff000008da39e0 x28: 00e8000000000f07 + x27: ffff7dfffee00000 x26: 0140000000000000 + x25: ffff7dfffef00000 x24: 00000000000fe100 + x23: ffff80007b906000 x22: ffff000008ab8000 + x21: ffff000008bb1d58 x20: ffff7dfffef00000 + x19: ffff800009c30fb8 x18: 0000000000000001 + x17: 00000000000152d0 x16: 00000000014012d0 + x15: 0000000000000000 x14: 0720072007200720 + x13: 0720072007200720 x12: 0720072007200720 + x11: 0720072007300730 x10: 00000000000000ae + x9 : 0000000000000000 x8 : ffff7dffff000000 + x7 : 0000000000000000 x6 : 0000000000000100 + x5 : 0000000000000000 x4 : 000000007b906000 + x3 : ffff80007c61a880 x2 : ffff7dfffeefffff + x1 : 0000000040000000 x0 : 00e80000fe100f07 + Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) + Call trace: + ioremap_page_range+0x370/0x3c8 + pci_remap_iospace+0x7c/0xac + pci_parse_request_of_pci_ranges+0x13c/0x190 + rcar_pcie_probe+0x4c/0xb04 + platform_drv_probe+0x50/0xbc + driver_probe_device+0x21c/0x308 + __device_attach_driver+0x98/0xc8 + bus_for_each_drv+0x54/0x94 + __device_attach+0xc4/0x12c + device_initial_probe+0x10/0x18 + bus_probe_device+0x90/0x98 + deferred_probe_work_func+0xb0/0x150 + process_one_work+0x12c/0x29c + worker_thread+0x200/0x3fc + kthread+0x108/0x134 + ret_from_fork+0x10/0x18 + Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000) + +It turned out that pci_remap_iospace() wasn't undone when the driver's +probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER, +the probe was retried, finally causing the BUG due to trying to remap +already remapped pages. + +The V3 Semiconductor PCI driver has the same issue. +Replace devm_pci_remap_iospace() with its devm_ managed version to fix +the bug. + +Fixes: 68a15eb7bd0c ("PCI: v3-semi: Add V3 Semiconductor PCI host driver") +Signed-off-by: Sergei Shtylyov +[lorenzo.pieralisi@arm.com: updated the commit log] +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/host/pci-v3-semi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/host/pci-v3-semi.c ++++ b/drivers/pci/host/pci-v3-semi.c +@@ -535,7 +535,7 @@ static int v3_pci_setup_resource(struct + v3->io_bus_addr = io->start - win->offset; + dev_dbg(dev, "I/O window %pR, bus addr %pap\n", + io, &v3->io_bus_addr); +- ret = pci_remap_iospace(io, io_base); ++ ret = devm_pci_remap_iospace(dev, io, io_base); + if (ret) { + dev_warn(dev, + "error %d: failed to map resource %pR\n", diff --git a/queue-4.17/pci-versatile-fix-i-o-space-page-leak.patch b/queue-4.17/pci-versatile-fix-i-o-space-page-leak.patch new file mode 100644 index 00000000000..6cf92887440 --- /dev/null +++ b/queue-4.17/pci-versatile-fix-i-o-space-page-leak.patch @@ -0,0 +1,88 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sergei Shtylyov +Date: Wed, 18 Jul 2018 15:40:40 -0500 +Subject: PCI: versatile: Fix I/O space page leak + +From: Sergei Shtylyov + +[ Upstream commit 0018b265adf7e251f90d3ca1c7c0e32e2a0ad262 ] + +When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY +driver was left disabled, the kernel crashed with this BUG: + + kernel BUG at lib/ioremap.c:72! + Internal error: Oops - BUG: 0 [#1] PREEMPT SMP + Modules linked in: + CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 + Hardware name: Renesas Condor board based on r8a77980 (DT) + Workqueue: events deferred_probe_work_func + pstate: 80000005 (Nzcv daif -PAN -UAO) + pc : ioremap_page_range+0x370/0x3c8 + lr : ioremap_page_range+0x40/0x3c8 + sp : ffff000008da39e0 + x29: ffff000008da39e0 x28: 00e8000000000f07 + x27: ffff7dfffee00000 x26: 0140000000000000 + x25: ffff7dfffef00000 x24: 00000000000fe100 + x23: ffff80007b906000 x22: ffff000008ab8000 + x21: ffff000008bb1d58 x20: ffff7dfffef00000 + x19: ffff800009c30fb8 x18: 0000000000000001 + x17: 00000000000152d0 x16: 00000000014012d0 + x15: 0000000000000000 x14: 0720072007200720 + x13: 0720072007200720 x12: 0720072007200720 + x11: 0720072007300730 x10: 00000000000000ae + x9 : 0000000000000000 x8 : ffff7dffff000000 + x7 : 0000000000000000 x6 : 0000000000000100 + x5 : 0000000000000000 x4 : 000000007b906000 + x3 : ffff80007c61a880 x2 : ffff7dfffeefffff + x1 : 0000000040000000 x0 : 00e80000fe100f07 + Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) + Call trace: + ioremap_page_range+0x370/0x3c8 + pci_remap_iospace+0x7c/0xac + pci_parse_request_of_pci_ranges+0x13c/0x190 + rcar_pcie_probe+0x4c/0xb04 + platform_drv_probe+0x50/0xbc + driver_probe_device+0x21c/0x308 + __device_attach_driver+0x98/0xc8 + bus_for_each_drv+0x54/0x94 + __device_attach+0xc4/0x12c + device_initial_probe+0x10/0x18 + bus_probe_device+0x90/0x98 + deferred_probe_work_func+0xb0/0x150 + process_one_work+0x12c/0x29c + worker_thread+0x200/0x3fc + kthread+0x108/0x134 + ret_from_fork+0x10/0x18 + Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000) + +It turned out that pci_remap_iospace() wasn't undone when the driver's +probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER, +the probe was retried, finally causing the BUG due to trying to remap +already remapped pages. + +The Versatile PCI controller driver has the same issue. +Replace pci_remap_iospace() with the devm_ managed version to fix the bug. + +Fixes: b7e78170efd4 ("PCI: versatile: Add DT-based ARM Versatile PB PCIe host driver") +Signed-off-by: Sergei Shtylyov +[lorenzo.pieralisi@arm.com: updated the commit log] +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/host/pci-versatile.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/host/pci-versatile.c ++++ b/drivers/pci/host/pci-versatile.c +@@ -81,7 +81,7 @@ static int versatile_pci_parse_request_o + + switch (resource_type(res)) { + case IORESOURCE_IO: +- err = pci_remap_iospace(res, iobase); ++ err = devm_pci_remap_iospace(dev, res, iobase); + if (err) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + err, res); diff --git a/queue-4.17/pci-xgene-fix-i-o-space-page-leak.patch b/queue-4.17/pci-xgene-fix-i-o-space-page-leak.patch new file mode 100644 index 00000000000..1a01d409383 --- /dev/null +++ b/queue-4.17/pci-xgene-fix-i-o-space-page-leak.patch @@ -0,0 +1,89 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sergei Shtylyov +Date: Wed, 18 Jul 2018 15:40:34 -0500 +Subject: PCI: xgene: Fix I/O space page leak + +From: Sergei Shtylyov + +[ Upstream commit 925652d03589084850023d8924b376b7ee3c1b1b ] + +When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY +driver was left disabled, the kernel crashed with this BUG: + + kernel BUG at lib/ioremap.c:72! + Internal error: Oops - BUG: 0 [#1] PREEMPT SMP + Modules linked in: + CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 + Hardware name: Renesas Condor board based on r8a77980 (DT) + Workqueue: events deferred_probe_work_func + pstate: 80000005 (Nzcv daif -PAN -UAO) + pc : ioremap_page_range+0x370/0x3c8 + lr : ioremap_page_range+0x40/0x3c8 + sp : ffff000008da39e0 + x29: ffff000008da39e0 x28: 00e8000000000f07 + x27: ffff7dfffee00000 x26: 0140000000000000 + x25: ffff7dfffef00000 x24: 00000000000fe100 + x23: ffff80007b906000 x22: ffff000008ab8000 + x21: ffff000008bb1d58 x20: ffff7dfffef00000 + x19: ffff800009c30fb8 x18: 0000000000000001 + x17: 00000000000152d0 x16: 00000000014012d0 + x15: 0000000000000000 x14: 0720072007200720 + x13: 0720072007200720 x12: 0720072007200720 + x11: 0720072007300730 x10: 00000000000000ae + x9 : 0000000000000000 x8 : ffff7dffff000000 + x7 : 0000000000000000 x6 : 0000000000000100 + x5 : 0000000000000000 x4 : 000000007b906000 + x3 : ffff80007c61a880 x2 : ffff7dfffeefffff + x1 : 0000000040000000 x0 : 00e80000fe100f07 + Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) + Call trace: + ioremap_page_range+0x370/0x3c8 + pci_remap_iospace+0x7c/0xac + pci_parse_request_of_pci_ranges+0x13c/0x190 + rcar_pcie_probe+0x4c/0xb04 + platform_drv_probe+0x50/0xbc + driver_probe_device+0x21c/0x308 + __device_attach_driver+0x98/0xc8 + bus_for_each_drv+0x54/0x94 + __device_attach+0xc4/0x12c + device_initial_probe+0x10/0x18 + bus_probe_device+0x90/0x98 + deferred_probe_work_func+0xb0/0x150 + process_one_work+0x12c/0x29c + worker_thread+0x200/0x3fc + kthread+0x108/0x134 + ret_from_fork+0x10/0x18 + Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000) + +It turned out that pci_remap_iospace() wasn't undone when the driver's +probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER, +the probe was retried, finally causing the BUG due to trying to remap +already remapped pages. + +The X-Gene PCI controller driver has the same issue. +Replace pci_remap_iospace() with the devm_ managed version so that the +pages get unmapped automagically on any probe failure. + +Fixes: 5f6b6ccdbe1c ("PCI: xgene: Add APM X-Gene PCIe driver") +Signed-off-by: Sergei Shtylyov +[lorenzo.pieralisi@arm.com: updated the commit log] +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/host/pci-xgene.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/host/pci-xgene.c ++++ b/drivers/pci/host/pci-xgene.c +@@ -421,7 +421,7 @@ static int xgene_pcie_map_ranges(struct + case IORESOURCE_IO: + xgene_pcie_setup_ob_reg(port, res, OMR3BARL, io_base, + res->start - window->offset); +- ret = pci_remap_iospace(res, io_base); ++ ret = devm_pci_remap_iospace(dev, res, io_base); + if (ret < 0) + return ret; + break; diff --git a/queue-4.17/pci-xilinx-add-missing-of_node_put.patch b/queue-4.17/pci-xilinx-add-missing-of_node_put.patch new file mode 100644 index 00000000000..4c20b8a755e --- /dev/null +++ b/queue-4.17/pci-xilinx-add-missing-of_node_put.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Nicholas Mc Guire +Date: Fri, 29 Jun 2018 13:49:54 -0500 +Subject: PCI: xilinx: Add missing of_node_put() + +From: Nicholas Mc Guire + +[ Upstream commit 8c3f9bd851a4d3acf0a0f222d4e9e41c0cd1ea8e ] + +The call to of_get_next_child() returns a node pointer with refcount +incremented thus it must be explicitly decremented here after the last +usage. + +Fixes: 8961def56845 ("PCI: xilinx: Add Xilinx AXI PCIe Host Bridge IP driver") +Signed-off-by: Nicholas Mc Guire +[lorenzo.pieralisi@arm.com: reworked commit log] +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/host/pcie-xilinx.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pci/host/pcie-xilinx.c ++++ b/drivers/pci/host/pcie-xilinx.c +@@ -507,6 +507,7 @@ static int xilinx_pcie_init_irq_domain(s + port->leg_domain = irq_domain_add_linear(pcie_intc_node, PCI_NUM_INTX, + &intx_domain_ops, + port); ++ of_node_put(pcie_intc_node); + if (!port->leg_domain) { + dev_err(dev, "Failed to get a INTx IRQ domain\n"); + return -ENODEV; diff --git a/queue-4.17/pci-xilinx-nwl-add-missing-of_node_put.patch b/queue-4.17/pci-xilinx-nwl-add-missing-of_node_put.patch new file mode 100644 index 00000000000..07a6c9294f8 --- /dev/null +++ b/queue-4.17/pci-xilinx-nwl-add-missing-of_node_put.patch @@ -0,0 +1,35 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Nicholas Mc Guire +Date: Fri, 29 Jun 2018 13:50:10 -0500 +Subject: PCI: xilinx-nwl: Add missing of_node_put() + +From: Nicholas Mc Guire + +[ Upstream commit 342639d996f18bc0a4db2f42a84230c0a966dc94 ] + +The call to of_get_next_child() returns a node pointer with +refcount incremented thus it must be explicitly decremented +here after the last usage. + +Fixes: ab597d35ef11 ("PCI: xilinx-nwl: Add support for Xilinx NWL PCIe Host Controller") +Signed-off-by: Nicholas Mc Guire +[lorenzo.pieralisi@arm.com: updated commit log] +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/host/pcie-xilinx-nwl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/host/pcie-xilinx-nwl.c ++++ b/drivers/pci/host/pcie-xilinx-nwl.c +@@ -557,7 +557,7 @@ static int nwl_pcie_init_irq_domain(stru + PCI_NUM_INTX, + &legacy_domain_ops, + pcie); +- ++ of_node_put(legacy_intc_node); + if (!pcie->legacy_irq_domain) { + dev_err(dev, "failed to create IRQ domain\n"); + return -ENOMEM; diff --git a/queue-4.17/perf-bench-fix-numa-report-output-code.patch b/queue-4.17/perf-bench-fix-numa-report-output-code.patch new file mode 100644 index 00000000000..153baff4b2f --- /dev/null +++ b/queue-4.17/perf-bench-fix-numa-report-output-code.patch @@ -0,0 +1,60 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jiri Olsa +Date: Wed, 20 Jun 2018 11:40:36 +0200 +Subject: perf bench: Fix numa report output code + +From: Jiri Olsa + +[ Upstream commit 983107072be1a39cbde67d45cb0059138190e015 ] + +Currently we can hit following assert when running numa bench: + + $ perf bench numa mem -p 3 -t 1 -P 512 -s 100 -zZ0cm --thp 1 + perf: bench/numa.c:1577: __bench_numa: Assertion `!(!(((wait_stat) & 0x7f) == 0))' failed. + +The assertion is correct, because we hit the SIGFPE in following line: + + Thread 2.2 "thread 0/0" received signal SIGFPE, Arithmetic exception. + [Switching to Thread 0x7fffd28c6700 (LWP 11750)] + 0x000.. in worker_thread (__tdata=0x7.. ) at bench/numa.c:1257 + 1257 td->speed_gbs = bytes_done / (td->runtime_ns / NSEC_PER_SEC) / 1e9; + +We don't check if the runtime is actually bigger than 1 second, +and thus this might end up with zero division within FPU. + +Adding the check to prevent this. + +Signed-off-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: David Ahern +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/20180620094036.17278-1-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/bench/numa.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/tools/perf/bench/numa.c ++++ b/tools/perf/bench/numa.c +@@ -1098,7 +1098,7 @@ static void *worker_thread(void *__tdata + u8 *global_data; + u8 *process_data; + u8 *thread_data; +- u64 bytes_done; ++ u64 bytes_done, secs; + long work_done; + u32 l; + struct rusage rusage; +@@ -1254,7 +1254,8 @@ static void *worker_thread(void *__tdata + timersub(&stop, &start0, &diff); + td->runtime_ns = diff.tv_sec * NSEC_PER_SEC; + td->runtime_ns += diff.tv_usec * NSEC_PER_USEC; +- td->speed_gbs = bytes_done / (td->runtime_ns / NSEC_PER_SEC) / 1e9; ++ secs = td->runtime_ns / NSEC_PER_SEC; ++ td->speed_gbs = secs ? bytes_done / secs / 1e9 : 0; + + getrusage(RUSAGE_THREAD, &rusage); + td->system_time_ns = rusage.ru_stime.tv_sec * NSEC_PER_SEC; diff --git a/queue-4.17/perf-llvm-utils-remove-bashism-from-kernel-include-fetch-script.patch b/queue-4.17/perf-llvm-utils-remove-bashism-from-kernel-include-fetch-script.patch new file mode 100644 index 00000000000..035bac593cf --- /dev/null +++ b/queue-4.17/perf-llvm-utils-remove-bashism-from-kernel-include-fetch-script.patch @@ -0,0 +1,62 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Kim Phillips +Date: Fri, 29 Jun 2018 12:46:52 -0500 +Subject: perf llvm-utils: Remove bashism from kernel include fetch script + +From: Kim Phillips + +[ Upstream commit f6432b9f65001651412dbc3589d251534822d4ab ] + +Like system(), popen() calls /bin/sh, which may/may not be bash. + +Script when run on dash and encounters the line, yields: + + exit: Illegal number: -1 + +checkbashisms report on script content: + + possible bashism (exit|return with negative status code): + exit -1 + +Remove the bashism and use the more portable non-zero failure +status code 1. + +Signed-off-by: Kim Phillips +Cc: Alexander Shishkin +Cc: Hendrik Brueckner +Cc: Jiri Olsa +Cc: Michael Petlan +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Sandipan Das +Cc: Thomas Richter +Link: http://lkml.kernel.org/r/20180629124652.8d0af7e2281fd3fd8262cacc@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/llvm-utils.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/tools/perf/util/llvm-utils.c ++++ b/tools/perf/util/llvm-utils.c +@@ -265,16 +265,16 @@ static const char *kinc_fetch_script = + "#!/usr/bin/env sh\n" + "if ! test -d \"$KBUILD_DIR\"\n" + "then\n" +-" exit -1\n" ++" exit 1\n" + "fi\n" + "if ! test -f \"$KBUILD_DIR/include/generated/autoconf.h\"\n" + "then\n" +-" exit -1\n" ++" exit 1\n" + "fi\n" + "TMPDIR=`mktemp -d`\n" + "if test -z \"$TMPDIR\"\n" + "then\n" +-" exit -1\n" ++" exit 1\n" + "fi\n" + "cat << EOF > $TMPDIR/Makefile\n" + "obj-y := dummy.o\n" diff --git a/queue-4.17/perf-record-support-s390-random-socket_id-assignment.patch b/queue-4.17/perf-record-support-s390-random-socket_id-assignment.patch new file mode 100644 index 00000000000..6875db80ec7 --- /dev/null +++ b/queue-4.17/perf-record-support-s390-random-socket_id-assignment.patch @@ -0,0 +1,92 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Thomas Richter +Date: Mon, 11 Jun 2018 09:31:52 +0200 +Subject: perf record: Support s390 random socket_id assignment + +From: Thomas Richter + +[ Upstream commit 01766229533f9bdb1144a41b4345c8c7286da7b4 ] + +On s390 the socket identifier assigned to a CPU identifier is random and +(depending on the configuration of the LPAR) may be higher than the CPU +identifier. This is currently not supported. + +Fix this by allowing arbitrary socket identifiers being assigned to +CPU id. + +Output before: + + [root@p23lp27 perf]# ./perf report --header -I -v + ... + socket_id number is too big.You may need to upgrade the perf tool. + Error: + The perf.data file has no samples! + # ======== + # captured on : Tue May 29 09:29:57 2018 + # header version : 1 + ... + # Core ID and Socket ID information is not available + ... + [root@p23lp27 perf]# + +Output after: + + [root@p23lp27 perf]# ./perf report --header -I -v + ... + Error: + The perf.data file has no samples! + # ======== + # captured on : Tue May 29 09:29:57 2018 + # header version : 1 + ... + # CPU 0: Core ID 0, Socket ID 6 + # CPU 1: Core ID 1, Socket ID 3 + # CPU 2: Core ID -1, Socket ID -1 + ... + [root@p23lp27 perf]# + +Signed-off-by: Thomas Richter +Reviewed-by: Hendrik Brueckner +Cc: Heiko Carstens +Cc: Martin Schwidefsky +Link: http://lkml.kernel.org/r/20180611073153.15592-1-tmricht@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/header.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -2113,6 +2113,7 @@ static int process_cpu_topology(struct f + int cpu_nr = ff->ph->env.nr_cpus_avail; + u64 size = 0; + struct perf_header *ph = ff->ph; ++ bool do_core_id_test = true; + + ph->env.cpu = calloc(cpu_nr, sizeof(*ph->env.cpu)); + if (!ph->env.cpu) +@@ -2167,6 +2168,13 @@ static int process_cpu_topology(struct f + return 0; + } + ++ /* On s390 the socket_id number is not related to the numbers of cpus. ++ * The socket_id number might be higher than the numbers of cpus. ++ * This depends on the configuration. ++ */ ++ if (ph->env.arch && !strncmp(ph->env.arch, "s390", 4)) ++ do_core_id_test = false; ++ + for (i = 0; i < (u32)cpu_nr; i++) { + if (do_read_u32(ff, &nr)) + goto free_cpu; +@@ -2176,7 +2184,7 @@ static int process_cpu_topology(struct f + if (do_read_u32(ff, &nr)) + goto free_cpu; + +- if (nr != (u32)-1 && nr > (u32)cpu_nr) { ++ if (do_core_id_test && nr != (u32)-1 && nr > (u32)cpu_nr) { + pr_debug("socket_id number is too big." + "You may need to upgrade the perf tool.\n"); + goto free_cpu; diff --git a/queue-4.17/perf-report-powerpc-fix-crash-if-callchain-is-empty.patch b/queue-4.17/perf-report-powerpc-fix-crash-if-callchain-is-empty.patch new file mode 100644 index 00000000000..6c6323a4782 --- /dev/null +++ b/queue-4.17/perf-report-powerpc-fix-crash-if-callchain-is-empty.patch @@ -0,0 +1,72 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sandipan Das +Date: Mon, 11 Jun 2018 16:10:49 +0530 +Subject: perf report powerpc: Fix crash if callchain is empty + +From: Sandipan Das + +[ Upstream commit 143c99f6ac6812d23254e80844d6e34be897d3e1 ] + +For some cases, the callchain provided by the kernel may be empty. So, +the callchain ip filtering code will cause a crash if we do not check +whether the struct ip_callchain pointer is NULL before accessing any +members. + +This can be observed on a powerpc64le system running Fedora 27 as shown +below. + + # perf record -b -e cycles:u ls + +Before: + + # perf report --branch-history + + perf: Segmentation fault + -------- backtrace -------- + perf[0x1027615c] + linux-vdso64.so.1(__kernel_sigtramp_rt64+0x0)[0x7fff856304d8] + perf(arch_skip_callchain_idx+0x44)[0x10257c58] + perf[0x1017f2e4] + perf(thread__resolve_callchain+0x124)[0x1017ff5c] + perf(sample__resolve_callchain+0xf0)[0x10172788] + ... + +After: + + # perf report --branch-history + + Samples: 25 of event 'cycles:u', Event count (approx.): 2306870 + Overhead Source:Line Symbol Shared Object + + 11.60% _init+35736 [.] _init ls + + 9.84% strcoll_l.c:137 [.] __strcoll_l libc-2.26.so + + 9.16% memcpy.S:175 [.] __memcpy_power7 libc-2.26.so + + 9.01% gconv_charset.h:54 [.] _nl_find_locale libc-2.26.so + + 8.87% dl-addr.c:52 [.] _dl_addr libc-2.26.so + + 8.83% _init+236 [.] _init ls + ... + +Reported-by: Ravi Bangoria +Signed-off-by: Sandipan Das +Acked-by: Ravi Bangoria +Cc: Jiri Olsa +Cc: Naveen N. Rao +Cc: Sukadev Bhattiprolu +Link: http://lkml.kernel.org/r/20180611104049.11048-1-sandipan@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/arch/powerpc/util/skip-callchain-idx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c ++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +@@ -243,7 +243,7 @@ int arch_skip_callchain_idx(struct threa + u64 ip; + u64 skip_slot = -1; + +- if (chain->nr < 3) ++ if (!chain || chain->nr < 3) + return skip_slot; + + ip = chain->ips[2]; diff --git a/queue-4.17/perf-script-fix-crash-because-of-missing-evsel-priv.patch b/queue-4.17/perf-script-fix-crash-because-of-missing-evsel-priv.patch new file mode 100644 index 00000000000..c155cf238cc --- /dev/null +++ b/queue-4.17/perf-script-fix-crash-because-of-missing-evsel-priv.patch @@ -0,0 +1,75 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Ravi Bangoria +Date: Mon, 25 Jun 2018 18:12:19 +0530 +Subject: perf script: Fix crash because of missing evsel->priv + +From: Ravi Bangoria + +[ Upstream commit a3af66f51bd0bca72881ead4bf2bd19cb366582b ] + +'perf script' in piped mode is crashing because evsel->priv is not set +properly. Fix it. + +Before: + + # perf record -o - -- ls | perf script + + Segmentation fault (core dumped) + # + +After: + + # perf record -o - -- ls | perf script + + ls 2282 1031.731974: 250000 cpu-clock:uhH: 7effe4b3d29e + ls 2282 1031.732222: 250000 cpu-clock:uhH: 7effe4b3a650 + # + +Signed-off-by: Ravi Bangoria +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: David Ahern +Cc: David Carrillo-Cisneros +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Namhyung Kim +Fixes: a14390fde64e ("perf script: Allow creating per-event dump files") +Link: http://lkml.kernel.org/r/20180625124220.6434-3-ravi.bangoria@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-script.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -1832,6 +1832,7 @@ static int process_attr(struct perf_tool + struct perf_evlist *evlist; + struct perf_evsel *evsel, *pos; + int err; ++ static struct perf_evsel_script *es; + + err = perf_event__process_attr(tool, event, pevlist); + if (err) +@@ -1840,6 +1841,19 @@ static int process_attr(struct perf_tool + evlist = *pevlist; + evsel = perf_evlist__last(*pevlist); + ++ if (!evsel->priv) { ++ if (scr->per_event_dump) { ++ evsel->priv = perf_evsel_script__new(evsel, ++ scr->session->data); ++ } else { ++ es = zalloc(sizeof(*es)); ++ if (!es) ++ return -ENOMEM; ++ es->fp = stdout; ++ evsel->priv = es; ++ } ++ } ++ + if (evsel->attr.type >= PERF_TYPE_MAX && + evsel->attr.type != PERF_TYPE_SYNTH) + return 0; diff --git a/queue-4.17/perf-script-python-fix-dict-reference-counting.patch b/queue-4.17/perf-script-python-fix-dict-reference-counting.patch new file mode 100644 index 00000000000..99b23fe70fe --- /dev/null +++ b/queue-4.17/perf-script-python-fix-dict-reference-counting.patch @@ -0,0 +1,68 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Janne Huttunen +Date: Mon, 9 Jul 2018 13:59:50 +0300 +Subject: perf script python: Fix dict reference counting + +From: Janne Huttunen + +[ Upstream commit db0ba84c04ef2cf293aaada5ae97531127844d9d ] + +The dictionaries are attached to the parameter tuple that steals the +references and takes care of releasing them when appropriate. The code +should not decrement the reference counts explicitly. E.g. if libpython +has been built with reference debugging enabled, the superfluous DECREFs +will trigger this error when running perf script: + + Fatal Python error: Objects/tupleobject.c:238 object at + 0x7f10f2041b40 has negative ref count -1 + Aborted (core dumped) + +If the reference debugging is not enabled, the superfluous DECREFs might +cause the dict objects to be silently released while they are still in +use. This may trigger various other assertions or just cause perf +crashes and/or weird and unexpected data changes in the stored Python +objects. + +Signed-off-by: Janne Huttunen +Acked-by: Jiri Olsa +Acked-by: Namhyung Kim +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jaroslav Skarvada +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/1531133990-17485-1-git-send-email-janne.huttunen@nokia.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/scripting-engines/trace-event-python.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/tools/perf/util/scripting-engines/trace-event-python.c ++++ b/tools/perf/util/scripting-engines/trace-event-python.c +@@ -676,14 +676,11 @@ static void python_process_tracepoint(st + if (_PyTuple_Resize(&t, n) == -1) + Py_FatalError("error resizing Python tuple"); + +- if (!dict) { ++ if (!dict) + call_object(handler, t, handler_name); +- } else { ++ else + call_object(handler, t, default_handler_name); +- Py_DECREF(dict); +- } + +- Py_XDECREF(all_entries_dict); + Py_DECREF(t); + } + +@@ -1003,7 +1000,6 @@ static void python_process_general_event + + call_object(handler, t, handler_name); + +- Py_DECREF(dict); + Py_DECREF(t); + } + diff --git a/queue-4.17/perf-test-session-topology-fix-test-on-s390.patch b/queue-4.17/perf-test-session-topology-fix-test-on-s390.patch new file mode 100644 index 00000000000..13b71bd2abc --- /dev/null +++ b/queue-4.17/perf-test-session-topology-fix-test-on-s390.patch @@ -0,0 +1,62 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Thomas Richter +Date: Mon, 11 Jun 2018 09:31:53 +0200 +Subject: perf test session topology: Fix test on s390 + +From: Thomas Richter + +[ Upstream commit b930e62ecd362843002bdf84c2940439822af321 ] + +On s390 this test case fails because the socket identifiction numbers +assigned to the CPU are higher than the CPU identification numbers. + +F/ix this by adding the platform architecture into the perf data header +flag information. This helps identifiing the test platform and handles +s390 specifics in process_cpu_topology(). + +Before: + + [root@p23lp27 perf]# perf test -vvvvv -F 39 + 39: Session topology : + --- start --- + templ file: /tmp/perf-test-iUv755 + socket_id number is too big.You may need to upgrade the perf tool. + ---- end ---- + Session topology: Skip + [root@p23lp27 perf]# + +After: + + [root@p23lp27 perf]# perf test -vvvvv -F 39 + 39: Session topology : + --- start --- + templ file: /tmp/perf-test-8X8VTs + CPU 0, core 0, socket 6 + CPU 1, core 1, socket 3 + ---- end ---- + Session topology: Ok + [root@p23lp27 perf]# + +Signed-off-by: Thomas Richter +Reviewed-by: Hendrik Brueckner +Cc: Heiko Carstens +Cc: Martin Schwidefsky +Fixes: c84974ed9fb6 ("perf test: Add entry to test cpu topology") +Link: http://lkml.kernel.org/r/20180611073153.15592-2-tmricht@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/tests/topology.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/tools/perf/tests/topology.c ++++ b/tools/perf/tests/topology.c +@@ -45,6 +45,7 @@ static int session_write_header(char *pa + + perf_header__set_feat(&session->header, HEADER_CPU_TOPOLOGY); + perf_header__set_feat(&session->header, HEADER_NRCPUS); ++ perf_header__set_feat(&session->header, HEADER_ARCH); + + session->header.data_size += DATA_SIZE; + diff --git a/queue-4.17/perf-test-shell-prevent-temporary-editor-files-from-being-considered-test-scripts.patch b/queue-4.17/perf-test-shell-prevent-temporary-editor-files-from-being-considered-test-scripts.patch new file mode 100644 index 00000000000..c08c51cea34 --- /dev/null +++ b/queue-4.17/perf-test-shell-prevent-temporary-editor-files-from-being-considered-test-scripts.patch @@ -0,0 +1,48 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Kim Phillips +Date: Fri, 29 Jun 2018 12:46:58 -0500 +Subject: perf test shell: Prevent temporary editor files from being considered test scripts + +From: Kim Phillips + +[ Upstream commit db8fec583f250557ddd6def1505a6c466c9747aa ] + +Allows a perf shell test developer to concurrently edit and run their +test scripts, avoiding perf test attempts to execute their editor +temporary files, such as seen here: + + $ sudo taskset -c 0 ./perf test -vvvvvvvv -F 63 + 63: 0VIM 8.0 : + --- start --- + sh: 1: ./tests/shell/.record+probe_libc_inet_pton.sh.swp: Permission denied + ---- end ---- + 0VIM 8.0: FAILED! + +Signed-off-by: Kim Phillips +Cc: Alexander Shishkin +Cc: Hendrik Brueckner +Cc: Jiri Olsa +Cc: Michael Petlan +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Sandipan Das +Cc: Thomas Richter +Link: http://lkml.kernel.org/r/20180629124658.15a506b41fc4539c08eb9426@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/tests/builtin-test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/tests/builtin-test.c ++++ b/tools/perf/tests/builtin-test.c +@@ -422,7 +422,7 @@ static const char *shell_test__descripti + + #define for_each_shell_test(dir, base, ent) \ + while ((ent = readdir(dir)) != NULL) \ +- if (!is_directory(base, ent)) ++ if (!is_directory(base, ent) && ent->d_name[0] != '.') + + static const char *shell_tests__dir(char *path, size_t size) + { diff --git a/queue-4.17/perf-tests-add-event-parsing-error-handling-to-parse-events-test.patch b/queue-4.17/perf-tests-add-event-parsing-error-handling-to-parse-events-test.patch new file mode 100644 index 00000000000..6f9fb59e084 --- /dev/null +++ b/queue-4.17/perf-tests-add-event-parsing-error-handling-to-parse-events-test.patch @@ -0,0 +1,87 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jiri Olsa +Date: Mon, 11 Jun 2018 11:34:21 +0200 +Subject: perf tests: Add event parsing error handling to parse events test + +From: Jiri Olsa + +[ Upstream commit 933ccf2002aaef1037cb676622a694f5390c3d59 ] + +Add missing error handling for parse_events calls in test_event function +that led to following segfault on s390: + + running test 52 'intel_pt//u' + perf: Segmentation fault + ... + /lib64/libc.so.6(vasprintf+0xe6) [0x3fffca3f106] + /lib64/libc.so.6(asprintf+0x46) [0x3fffca1aa96] + ./perf(parse_events_add_pmu+0xb8) [0x80132088] + ./perf(parse_events_parse+0xc62) [0x8019529a] + ./perf(parse_events+0x98) [0x801341c0] + ./perf(test__parse_events+0x48) [0x800cd140] + ./perf(cmd_test+0x26a) [0x800bd44a] + test child interrupted + +Adding the struct parse_events_error argument to parse_events call. Also +adding parse_events_print_error to get more details on the parsing +failures, like: + + # perf test 6 -v + running test 52 'intel_pt//u'failed to parse event 'intel_pt//u', err 1, str 'Cannot find PMU `intel_pt'. Missing kernel support?' + event syntax error: 'intel_pt//u' + \___ Cannot find PMU `intel_pt'. Missing kernel support? + +Committer note: + +Use named initializers in the struct parse_events_error variable to +avoid breaking the build on centos5, 6 and others with a similar gcc: + + cc1: warnings being treated as errors + tests/parse-events.c: In function 'test_event': + tests/parse-events.c:1696: error: missing initializer + tests/parse-events.c:1696: error: (near initialization for 'err.str') + +Reported-by: Kim Phillips +Signed-off-by: Jiri Olsa +Tested-by: Kim Phillips +Cc: Alexander Shishkin +Cc: David Ahern +Cc: Heiko Carstens +Cc: Hendrik Brueckner +Cc: Martin Schwidefsky +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Thomas Richter +Link: http://lkml.kernel.org/r/20180611093422.1005-1-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/tests/parse-events.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/tools/perf/tests/parse-events.c ++++ b/tools/perf/tests/parse-events.c +@@ -1672,6 +1672,7 @@ static struct terms_test test__terms[] = + + static int test_event(struct evlist_test *e) + { ++ struct parse_events_error err = { .idx = 0, }; + struct perf_evlist *evlist; + int ret; + +@@ -1679,10 +1680,11 @@ static int test_event(struct evlist_test + if (evlist == NULL) + return -ENOMEM; + +- ret = parse_events(evlist, e->name, NULL); ++ ret = parse_events(evlist, e->name, &err); + if (ret) { +- pr_debug("failed to parse event '%s', err %d\n", +- e->name, ret); ++ pr_debug("failed to parse event '%s', err %d, str '%s'\n", ++ e->name, ret, err.str); ++ parse_events_print_error(&err, e->name); + } else { + ret = e->check(evlist); + } diff --git a/queue-4.17/perf-tools-fix-a-clang-7.0-compilation-error.patch b/queue-4.17/perf-tools-fix-a-clang-7.0-compilation-error.patch new file mode 100644 index 00000000000..bccaeef7efd --- /dev/null +++ b/queue-4.17/perf-tools-fix-a-clang-7.0-compilation-error.patch @@ -0,0 +1,80 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Yonghong Song +Date: Sat, 16 Jun 2018 10:47:39 -0700 +Subject: perf tools: Fix a clang 7.0 compilation error + +From: Yonghong Song + +[ Upstream commit c6555c14572aeadf4fe2819abd971c4e7608b926 ] + +Arnaldo reported the perf build failure with latest llvm/clang compiler +(7.0). + + $ make LIBCLANGLLVM=1 -C tools/perf/ + + CC /tmp/tmp.t53Qo38zci/tests/kmod-path.o + util/c++/clang.cpp: In function ‘std::unique_ptr > + perf::getBPFObjectFromModule(llvm::Module*)’: + util/c++/clang.cpp:150:43: error: no matching function for call to + ‘llvm::TargetMachine::addPassesToEmitFile(llvm::legacy::PassManager&, + llvm::raw_svector_ostream&, llvm::TargetMachine::CodeGenFileType)’ + TargetMachine::CGFT_ObjectFile)) { + ^ + In file included from util/c++/clang.cpp:25:0: + /usr/local/include/llvm/Target/TargetMachine.h:254:16: note: candidate: + virtual bool llvm::TargetMachine::addPassesToEmitFile( + llvm::legacy::PassManagerBase&, llvm::raw_pwrite_stream&, + llvm::raw_pwrite_stream*, llvm::TargetMachine::CodeGenFileType, bool, + llvm::MachineModuleInfo*) + virtual bool addPassesToEmitFile(PassManagerBase &, raw_pwrite_stream &, + ^~~~~~~~~~~~~~~~~~~ + /usr/local/include/llvm/Target/TargetMachine.h:254:16: note: + candidate expects 6 arguments, 3 provided + mv: cannot stat '/tmp/tmp.t53Qo38zci/util/c++/.clang.o.tmp': No such file or directory + make[7]: *** [/home/acme/git/perf/tools/build/Makefile.build:101: + /tmp/tmp.t53Qo38zci/util/c++/clang.o] Error 1 + make[6]: *** [/home/acme/git/perf/tools/build/Makefile.build:139: c++] Error 2 + make[5]: *** [/home/acme/git/perf/tools/build/Makefile.build:139: util] Error 2 + make[5]: *** Waiting for unfinished jobs.... + CC /tmp/tmp.t53Qo38zci/tests/thread-map.o + +The function addPassesToEmitFile signature changed in llvm 7.0 and such +a change caused the failure. This patch fixed the issue with using +proper function signatures under different compiler versions. + +Reported-by: Arnaldo Carvalho de Melo +Signed-off-by: Yonghong Song +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexei Starovoitov +Cc: Daniel Borkmann +Cc: Jiri Olsa +Cc: Martin KaFai Lau +Cc: Wang Nan +Link: http://lkml.kernel.org/r/20180616174739.1076733-1-yhs@fb.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/c++/clang.cpp | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/tools/perf/util/c++/clang.cpp ++++ b/tools/perf/util/c++/clang.cpp +@@ -146,8 +146,15 @@ getBPFObjectFromModule(llvm::Module *Mod + raw_svector_ostream ostream(*Buffer); + + legacy::PassManager PM; +- if (TargetMachine->addPassesToEmitFile(PM, ostream, +- TargetMachine::CGFT_ObjectFile)) { ++ bool NotAdded; ++#if CLANG_VERSION_MAJOR < 7 ++ NotAdded = TargetMachine->addPassesToEmitFile(PM, ostream, ++ TargetMachine::CGFT_ObjectFile); ++#else ++ NotAdded = TargetMachine->addPassesToEmitFile(PM, ostream, nullptr, ++ TargetMachine::CGFT_ObjectFile); ++#endif ++ if (NotAdded) { + llvm::errs() << "TargetMachine can't emit a file of this type\n"; + return std::unique_ptr>(nullptr);; + } diff --git a/queue-4.17/perf-tools-fix-compilation-errors-on-gcc8.patch b/queue-4.17/perf-tools-fix-compilation-errors-on-gcc8.patch new file mode 100644 index 00000000000..91874f31f1e --- /dev/null +++ b/queue-4.17/perf-tools-fix-compilation-errors-on-gcc8.patch @@ -0,0 +1,80 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jiri Olsa +Date: Mon, 2 Jul 2018 15:42:01 +0200 +Subject: perf tools: Fix compilation errors on gcc8 + +From: Jiri Olsa + +[ Upstream commit a09603f851045b031e990d2d663958ccb49db525 ] + +We are getting following warnings on gcc8 that break compilation: + + $ make + CC jvmti/jvmti_agent.o + jvmti/jvmti_agent.c: In function ‘jvmti_open’: + jvmti/jvmti_agent.c:252:35: error: ‘/jit-’ directive output may be truncated \ + writing 5 bytes into a region of size between 1 and 4096 [-Werror=format-truncation=] + snprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid()); + +There's no point in checking the result of snprintf call in +jvmti_open, the following open call will fail in case the +name is mangled or too long. + +Using tools/lib/ function scnprintf that touches the return value from +the snprintf() calls and thus get rid of those warnings. + + $ make DEBUG=1 + CC arch/x86/util/perf_regs.o + arch/x86/util/perf_regs.c: In function ‘arch_sdt_arg_parse_op’: + arch/x86/util/perf_regs.c:229:4: error: ‘strncpy’ output truncated before terminating nul + copying 2 bytes from a string of the same length [-Werror=stringop-truncation] + strncpy(prefix, "+0", 2); + ^~~~~~~~~~~~~~~~~~~~~~~~ + +Using scnprintf instead of the strncpy (which we know is safe in here) +to get rid of that warning. + +Signed-off-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: David Ahern +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/20180702134202.17745-1-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/arch/x86/util/perf_regs.c | 2 +- + tools/perf/jvmti/jvmti_agent.c | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/tools/perf/arch/x86/util/perf_regs.c ++++ b/tools/perf/arch/x86/util/perf_regs.c +@@ -226,7 +226,7 @@ int arch_sdt_arg_parse_op(char *old_op, + else if (rm[2].rm_so != rm[2].rm_eo) + prefix[0] = '+'; + else +- strncpy(prefix, "+0", 2); ++ scnprintf(prefix, sizeof(prefix), "+0"); + } + + /* Rename register */ +--- a/tools/perf/jvmti/jvmti_agent.c ++++ b/tools/perf/jvmti/jvmti_agent.c +@@ -35,6 +35,7 @@ + #include + #include /* for gettid() */ + #include ++#include + + #include "jvmti_agent.h" + #include "../util/jitdump.h" +@@ -249,7 +250,7 @@ void *jvmti_open(void) + /* + * jitdump file name + */ +- snprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid()); ++ scnprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid()); + + fd = open(dump_path, O_CREAT|O_TRUNC|O_RDWR, 0666); + if (fd == -1) diff --git a/queue-4.17/perf-tools-fix-crash-caused-by-accessing-feat_ops.patch b/queue-4.17/perf-tools-fix-crash-caused-by-accessing-feat_ops.patch new file mode 100644 index 00000000000..e8ebace1dba --- /dev/null +++ b/queue-4.17/perf-tools-fix-crash-caused-by-accessing-feat_ops.patch @@ -0,0 +1,126 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Ravi Bangoria +Date: Mon, 25 Jun 2018 18:12:20 +0530 +Subject: perf tools: Fix crash caused by accessing feat_ops[HEADER_LAST_FEATURE] + +From: Ravi Bangoria + +[ Upstream commit 92ead7ee30c80f8852d28735cbcb9d79bc85f715 ] + +perf_event__process_feature() accesses feat_ops[HEADER_LAST_FEATURE] +which is not defined and thus perf is crashing. HEADER_LAST_FEATURE is +used as an end marker for the perf report but it's unused for perf +script/annotate. Ignore HEADER_LAST_FEATURE for perf script/annotate, +just like it is done in 'perf report'. + +Before: + # perf record -o - ls | perf script + + Segmentation fault (core dumped) + # + +After: + # perf record -o - ls | perf script + + Segmentation fault (core dumped) + ls 7031 4392.099856: 250000 cpu-clock:uhH: 7f5e0ce7cd60 + ls 7031 4392.100355: 250000 cpu-clock:uhH: 7f5e0c706ef7 + # + +Signed-off-by: Ravi Bangoria +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: David Ahern +Cc: David Carrillo-Cisneros +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Namhyung Kim +Fixes: 57b5de463925 ("perf report: Support forced leader feature in pipe mode") +Link: http://lkml.kernel.org/r/20180625124220.6434-4-ravi.bangoria@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-annotate.c | 11 ++++++++++- + tools/perf/builtin-report.c | 3 ++- + tools/perf/builtin-script.c | 11 ++++++++++- + tools/perf/util/header.c | 2 +- + 4 files changed, 23 insertions(+), 4 deletions(-) + +--- a/tools/perf/builtin-annotate.c ++++ b/tools/perf/builtin-annotate.c +@@ -283,6 +283,15 @@ out_put: + return ret; + } + ++static int process_feature_event(struct perf_tool *tool, ++ union perf_event *event, ++ struct perf_session *session) ++{ ++ if (event->feat.feat_id < HEADER_LAST_FEATURE) ++ return perf_event__process_feature(tool, event, session); ++ return 0; ++} ++ + static int hist_entry__tty_annotate(struct hist_entry *he, + struct perf_evsel *evsel, + struct perf_annotate *ann) +@@ -471,7 +480,7 @@ int cmd_annotate(int argc, const char ** + .attr = perf_event__process_attr, + .build_id = perf_event__process_build_id, + .tracing_data = perf_event__process_tracing_data, +- .feature = perf_event__process_feature, ++ .feature = process_feature_event, + .ordered_events = true, + .ordering_requires_timestamps = true, + }, +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -226,7 +226,8 @@ static int process_feature_event(struct + } + + /* +- * All features are received, we can force the ++ * (feat_id = HEADER_LAST_FEATURE) is the end marker which ++ * means all features are received, now we can force the + * group if needed. + */ + setup_forced_leader(rep, session->evlist); +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -3042,6 +3042,15 @@ int process_cpu_map_event(struct perf_to + return set_maps(script); + } + ++static int process_feature_event(struct perf_tool *tool, ++ union perf_event *event, ++ struct perf_session *session) ++{ ++ if (event->feat.feat_id < HEADER_LAST_FEATURE) ++ return perf_event__process_feature(tool, event, session); ++ return 0; ++} ++ + #ifdef HAVE_AUXTRACE_SUPPORT + static int perf_script__process_auxtrace_info(struct perf_tool *tool, + union perf_event *event, +@@ -3086,7 +3095,7 @@ int cmd_script(int argc, const char **ar + .attr = process_attr, + .event_update = perf_event__process_event_update, + .tracing_data = perf_event__process_tracing_data, +- .feature = perf_event__process_feature, ++ .feature = process_feature_event, + .build_id = perf_event__process_build_id, + .id_index = perf_event__process_id_index, + .auxtrace_info = perf_script__process_auxtrace_info, +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -3450,7 +3450,7 @@ int perf_event__process_feature(struct p + pr_warning("invalid record type %d in pipe-mode\n", type); + return 0; + } +- if (feat == HEADER_RESERVED || feat > HEADER_LAST_FEATURE) { ++ if (feat == HEADER_RESERVED || feat >= HEADER_LAST_FEATURE) { + pr_warning("invalid record type %d in pipe-mode\n", type); + return -1; + } diff --git a/queue-4.17/perf-tools-fix-error-index-for-pmu-event-parser.patch b/queue-4.17/perf-tools-fix-error-index-for-pmu-event-parser.patch new file mode 100644 index 00000000000..e776077cfdc --- /dev/null +++ b/queue-4.17/perf-tools-fix-error-index-for-pmu-event-parser.patch @@ -0,0 +1,61 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Jiri Olsa +Date: Thu, 7 Jun 2018 00:15:05 +0200 +Subject: perf tools: Fix error index for pmu event parser + +From: Jiri Olsa + +[ Upstream commit f7fa827f5f432a0b1f34e10fc49da93aeef9f817 ] + +For events we provide specific error message we need to set error column +index, PMU parser is missing that, adding it. + +Before: + + $ perf stat -e cycles,krava/cycles/ kill + event syntax error: 'cycles,krava/cycles/' + \___ Cannot find PMU `krava'. Missing kernel support? + +After: + + $ perf stat -e cycles,krava/cycles/ kill + event syntax error: 'cycles,krava/cycles/' + \___ Cannot find PMU `krava'. Missing kernel support? + +Signed-off-by: Jiri Olsa +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: David Ahern +Cc: Frederic Weisbecker +Cc: Milian Wolff +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: http://lkml.kernel.org/r/20180606221513.11302-3-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/parse-events.y | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/tools/perf/util/parse-events.y ++++ b/tools/perf/util/parse-events.y +@@ -227,11 +227,16 @@ event_def: event_pmu | + event_pmu: + PE_NAME opt_pmu_config + { ++ struct parse_events_state *parse_state = _parse_state; ++ struct parse_events_error *error = parse_state->error; + struct list_head *list, *orig_terms, *terms; + + if (parse_events_copy_term_list($2, &orig_terms)) + YYABORT; + ++ if (error) ++ error->idx = @1.first_column; ++ + ALLOC_LIST(list); + if (parse_events_add_pmu(_parse_state, list, $1, $2, false, false)) { + struct perf_pmu *pmu = NULL; diff --git a/queue-4.17/perf-tools-use-python-config-includes-rather-than-cflags.patch b/queue-4.17/perf-tools-use-python-config-includes-rather-than-cflags.patch new file mode 100644 index 00000000000..1bb27f43471 --- /dev/null +++ b/queue-4.17/perf-tools-use-python-config-includes-rather-than-cflags.patch @@ -0,0 +1,50 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jeremy Cline +Date: Tue, 10 Jul 2018 11:46:12 -0400 +Subject: perf tools: Use python-config --includes rather than --cflags + +From: Jeremy Cline + +[ Upstream commit 32aa928a7b817140c84987b726d5014911808fa4 ] + +Builds started failing in Fedora on Python 3.7 with: + + `.gnu.debuglto_.debug_macro' referenced in section + `.gnu.debuglto_.debug_macro' of + util/scripting-engines/trace-event-python.o: defined in discarded + section + +In Fedora, Python 3.7 added -flto to the list of --cflags and since it +was only applied to util/scripting-engines/trace-event-python.c and +scripts/python/Perf-Trace-Util/Context.c, linking failed. + +It's not the first time the addition of flags has broken builds: commit +c6707fdef7e2 ("perf tools: Fix up build in hardnened environments") +appears to have fixed a similar problem. "python-config --includes" +provides the proper -I flags and doesn't introduce additional CFLAGS. + +Signed-off-by: Jeremy Cline +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/20180710154612.6285-1-jcline@redhat.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/Makefile.config | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -207,8 +207,7 @@ ifdef PYTHON_CONFIG + PYTHON_EMBED_LDOPTS := $(shell $(PYTHON_CONFIG_SQ) --ldflags 2>/dev/null) + PYTHON_EMBED_LDFLAGS := $(call strip-libs,$(PYTHON_EMBED_LDOPTS)) + PYTHON_EMBED_LIBADD := $(call grep-libs,$(PYTHON_EMBED_LDOPTS)) -lutil +- PYTHON_EMBED_CCOPTS := $(shell $(PYTHON_CONFIG_SQ) --cflags 2>/dev/null) +- PYTHON_EMBED_CCOPTS := $(filter-out -specs=%,$(PYTHON_EMBED_CCOPTS)) ++ PYTHON_EMBED_CCOPTS := $(shell $(PYTHON_CONFIG_SQ) --includes 2>/dev/null) + FLAGS_PYTHON_EMBED := $(PYTHON_EMBED_CCOPTS) $(PYTHON_EMBED_LDOPTS) + endif + diff --git a/queue-4.17/pinctrl-ingenic-fix-inverted-direction-for-jz4770.patch b/queue-4.17/pinctrl-ingenic-fix-inverted-direction-for-jz4770.patch new file mode 100644 index 00000000000..fb0ccca2019 --- /dev/null +++ b/queue-4.17/pinctrl-ingenic-fix-inverted-direction-for-jz4770.patch @@ -0,0 +1,31 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Paul Cercueil +Date: Wed, 27 Jun 2018 13:49:02 +0200 +Subject: pinctrl: ingenic: Fix inverted direction for < JZ4770 + +From: Paul Cercueil + +[ Upstream commit 0084a786ca8c84b443f67c4a697b4f2552761650 ] + +The .gpio_set_direction() callback was setting inverted direction +for SoCs older than the JZ4770, this restores the correct behaviour. + +Signed-off-by: Paul Cercueil +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-ingenic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/pinctrl-ingenic.c ++++ b/drivers/pinctrl/pinctrl-ingenic.c +@@ -536,7 +536,7 @@ static int ingenic_pinmux_gpio_set_direc + ingenic_config_pin(jzpc, pin, JZ4770_GPIO_PAT1, input); + } else { + ingenic_config_pin(jzpc, pin, JZ4740_GPIO_SELECT, false); +- ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, input); ++ ingenic_config_pin(jzpc, pin, JZ4740_GPIO_DIR, !input); + ingenic_config_pin(jzpc, pin, JZ4740_GPIO_FUNC, false); + } + diff --git a/queue-4.17/pinctrl-nsp-fix-potential-null-dereference.patch b/queue-4.17/pinctrl-nsp-fix-potential-null-dereference.patch new file mode 100644 index 00000000000..a577c701b6c --- /dev/null +++ b/queue-4.17/pinctrl-nsp-fix-potential-null-dereference.patch @@ -0,0 +1,46 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Wei Yongjun +Date: Wed, 11 Jul 2018 12:34:21 +0000 +Subject: pinctrl: nsp: Fix potential NULL dereference + +From: Wei Yongjun + +[ Upstream commit c29e9da56bebb4c2c794e871b0dc0298bbf08142 ] + +platform_get_resource() may fail and return NULL, so we should +better check it's return value to avoid a NULL pointer dereference +a bit later in the code. + +This is detected by Coccinelle semantic patch. + +@@ +expression pdev, res, n, t, e, e1, e2; +@@ + +res = platform_get_resource(pdev, t, n); ++ if (!res) ++ return -EINVAL; +... when != res == NULL +e = devm_ioremap_nocache(e1, res->start, e2); + +Fixes: cc4fa83f66e9 ("pinctrl: nsp: add pinmux driver support for Broadcom NSP SoC") +Signed-off-by: Wei Yongjun +Reviewed-by: Ray Jui +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/bcm/pinctrl-nsp-mux.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c ++++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c +@@ -577,6 +577,8 @@ static int nsp_pinmux_probe(struct platf + return PTR_ERR(pinctrl->base0); + + res = platform_get_resource(pdev, IORESOURCE_MEM, 1); ++ if (!res) ++ return -EINVAL; + pinctrl->base1 = devm_ioremap_nocache(&pdev->dev, res->start, + resource_size(res)); + if (!pinctrl->base1) { diff --git a/queue-4.17/pinctrl-nsp-off-by-ones-in-nsp_pinmux_enable.patch b/queue-4.17/pinctrl-nsp-off-by-ones-in-nsp_pinmux_enable.patch new file mode 100644 index 00000000000..1b38f9c12f3 --- /dev/null +++ b/queue-4.17/pinctrl-nsp-off-by-ones-in-nsp_pinmux_enable.patch @@ -0,0 +1,35 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dan Carpenter +Date: Tue, 3 Jul 2018 15:04:25 +0300 +Subject: pinctrl: nsp: off by ones in nsp_pinmux_enable() + +From: Dan Carpenter + +[ Upstream commit f90a21c898db58eaea14b8ad7e9af3b9e15e5f8a ] + +The > comparisons should be >= or else we read beyond the end of the +pinctrl->functions[] array. + +Fixes: cc4fa83f66e9 ("pinctrl: nsp: add pinmux driver support for Broadcom NSP SoC") +Signed-off-by: Dan Carpenter +Reviewed-by: Ray Jui +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/bcm/pinctrl-nsp-mux.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c ++++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c +@@ -460,8 +460,8 @@ static int nsp_pinmux_enable(struct pinc + const struct nsp_pin_function *func; + const struct nsp_pin_group *grp; + +- if (grp_select > pinctrl->num_groups || +- func_select > pinctrl->num_functions) ++ if (grp_select >= pinctrl->num_groups || ++ func_select >= pinctrl->num_functions) + return -EINVAL; + + func = &pinctrl->functions[func_select]; diff --git a/queue-4.17/platform-x86-dell-laptop-fix-backlight-detection.patch b/queue-4.17/platform-x86-dell-laptop-fix-backlight-detection.patch new file mode 100644 index 00000000000..28c738b9f5c --- /dev/null +++ b/queue-4.17/platform-x86-dell-laptop-fix-backlight-detection.patch @@ -0,0 +1,54 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: "Damien Thébault" +Date: Wed, 18 Jul 2018 12:06:01 +0200 +Subject: platform/x86: dell-laptop: Fix backlight detection + +From: "Damien Thébault" + +[ Upstream commit 2502e5a025935b7b476b69eda4959b3c4022c72b ] + +Fix return code check for "max brightness" ACPI call. + +The Dell laptop ACPI video brightness control is not present on dell +laptops anymore, but was present in older kernel versions. + +The code that checks the return value is incorrect since the SMM +refactoring. + +The old code was: + if (buffer->output[0] == 0) + +Which was changed to: + ret = dell_send_request(...) + if (ret) + +However, dell_send_request() will return 0 if buffer->output[0] == 0, +so we must change the check to: + if (ret == 0) + +This issue was found on a Dell M4800 laptop, and the fix tested on it +as well. + +Fixes: 549b4930f057 ("dell-smbios: Introduce dispatcher for SMM calls") +Signed-off-by: Damien Thébault +Tested-by: Damien Thébault +Reviewed-by: Pali Rohár +Reviewed-by: Mario Limonciello +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/dell-laptop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/x86/dell-laptop.c ++++ b/drivers/platform/x86/dell-laptop.c +@@ -2170,7 +2170,7 @@ static int __init dell_init(void) + dell_fill_request(&buffer, token->location, 0, 0, 0); + ret = dell_send_request(&buffer, + CLASS_TOKEN_READ, SELECT_TOKEN_AC); +- if (ret) ++ if (ret == 0) + max_intensity = buffer.output[3]; + } + diff --git a/queue-4.17/pnfs-always-free-the-session-slot-on-error-in-nfs4_layoutget_handle_exception.patch b/queue-4.17/pnfs-always-free-the-session-slot-on-error-in-nfs4_layoutget_handle_exception.patch new file mode 100644 index 00000000000..cfff61695f3 --- /dev/null +++ b/queue-4.17/pnfs-always-free-the-session-slot-on-error-in-nfs4_layoutget_handle_exception.patch @@ -0,0 +1,68 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Trond Myklebust +Date: Fri, 15 Jun 2018 15:58:45 -0400 +Subject: pNFS: Always free the session slot on error in nfs4_layoutget_handle_exception + +From: Trond Myklebust + +[ Upstream commit 2dbf8dffbf35fd8f611083b9d9fe74fdccf912a3 ] + +Right now, we can call nfs_commit_inode() while holding the session slot, +which could lead to NFSv4 deadlocks. Ensure we only keep the slot if +the server returned a layout that we have to process. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/nfs4proc.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -8620,6 +8620,8 @@ nfs4_layoutget_handle_exception(struct r + + dprintk("--> %s tk_status => %d\n", __func__, -task->tk_status); + ++ nfs4_sequence_free_slot(&lgp->res.seq_res); ++ + switch (nfs4err) { + case 0: + goto out; +@@ -8684,7 +8686,6 @@ nfs4_layoutget_handle_exception(struct r + goto out; + } + +- nfs4_sequence_free_slot(&lgp->res.seq_res); + err = nfs4_handle_exception(server, nfs4err, exception); + if (!status) { + if (exception->retry) +@@ -8810,20 +8811,22 @@ nfs4_proc_layoutget(struct nfs4_layoutge + if (IS_ERR(task)) + return ERR_CAST(task); + status = rpc_wait_for_completion_task(task); +- if (status == 0) { ++ if (status != 0) ++ goto out; ++ ++ /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */ ++ if (task->tk_status < 0 || lgp->res.layoutp->len == 0) { + status = nfs4_layoutget_handle_exception(task, lgp, &exception); + *timeout = exception.timeout; +- } +- ++ } else ++ lseg = pnfs_layout_process(lgp); ++out: + trace_nfs4_layoutget(lgp->args.ctx, + &lgp->args.range, + &lgp->res.range, + &lgp->res.stateid, + status); + +- /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */ +- if (status == 0 && lgp->res.layoutp->len) +- lseg = pnfs_layout_process(lgp); + rpc_put_task(task); + dprintk("<-- %s status=%d\n", __func__, status); + if (status) diff --git a/queue-4.17/posix-timers-fix-nanosleep_copyout-for-config_compat_32bit_time.patch b/queue-4.17/posix-timers-fix-nanosleep_copyout-for-config_compat_32bit_time.patch new file mode 100644 index 00000000000..d8886851d10 --- /dev/null +++ b/queue-4.17/posix-timers-fix-nanosleep_copyout-for-config_compat_32bit_time.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Arnd Bergmann +Date: Mon, 18 Jun 2018 16:07:59 +0200 +Subject: posix-timers: Fix nanosleep_copyout() for CONFIG_COMPAT_32BIT_TIME + +From: Arnd Bergmann + +[ Upstream commit 0fe2795516b9e1c59b58b02bdf8658698117ec4e ] + +Commit b5793b0d92c9 added support for building the nanosleep compat system +call on 32-bit architectures, but missed one change in nanosleep_copyout(), +which would trigger a BUG() as soon as any architecture is switched over to +use it. + +Use the proper config symbol to enable the code path. + +Fixes: Commit b5793b0d92c9 ("posix-timers: Make compat syscalls depend on CONFIG_COMPAT_32BIT_TIME") +Signed-off-by: Arnd Bergmann +Signed-off-by: Thomas Gleixner +Cc: y2038@lists.linaro.org +Cc: Anna-Maria Gleixner +Cc: Deepa Dinamani +Cc: "Rafael J. Wysocki" +Link: https://lkml.kernel.org/r/20180618140811.2998503-1-arnd@arndb.de +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/hrtimer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -1659,7 +1659,7 @@ EXPORT_SYMBOL_GPL(hrtimer_init_sleeper); + int nanosleep_copyout(struct restart_block *restart, struct timespec64 *ts) + { + switch(restart->nanosleep.type) { +-#ifdef CONFIG_COMPAT ++#ifdef CONFIG_COMPAT_32BIT_TIME + case TT_COMPAT: + if (compat_put_timespec64(ts, restart->nanosleep.compat_rmtp)) + return -EFAULT; diff --git a/queue-4.17/powerpc-smp_send_stop-do-not-offline-stopped-cpus.patch b/queue-4.17/powerpc-smp_send_stop-do-not-offline-stopped-cpus.patch new file mode 100644 index 00000000000..b45d027c008 --- /dev/null +++ b/queue-4.17/powerpc-smp_send_stop-do-not-offline-stopped-cpus.patch @@ -0,0 +1,77 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Nicholas Piggin +Date: Sat, 19 May 2018 14:35:53 +1000 +Subject: powerpc: smp_send_stop do not offline stopped CPUs + +From: Nicholas Piggin + +[ Upstream commit de6e5d38417e6cdb005843db420a2974993d36ff ] + +Marking CPUs stopped by smp_send_stop as offline can cause warnings +due to cross-CPU wakeups. This trace was noticed on a busy system +running a sysrq+c crash test, after the injected crash: + +WARNING: CPU: 51 PID: 1546 at kernel/sched/core.c:1179 set_task_cpu+0x22c/0x240 +CPU: 51 PID: 1546 Comm: kworker/u352:1 Tainted: G D +Workqueue: mlx5e mlx5e_update_stats_work [mlx5_core] +[...] +NIP [c00000000017c21c] set_task_cpu+0x22c/0x240 +LR [c00000000017d580] try_to_wake_up+0x230/0x720 +Call Trace: +[c000000001017700] runqueues+0x0/0xb00 (unreliable) +[c00000000017d580] try_to_wake_up+0x230/0x720 +[c00000000015a214] insert_work+0x104/0x140 +[c00000000015adb0] __queue_work+0x230/0x690 +[c000003fc5007910] [c00000000015b26c] queue_work_on+0x5c/0x90 +[c0080000135fc8f8] mlx5_cmd_exec+0x538/0xcb0 [mlx5_core] +[c008000013608fd0] mlx5_core_access_reg+0x140/0x1d0 [mlx5_core] +[c00800001362777c] mlx5e_update_pport_counters.constprop.59+0x6c/0x90 [mlx5_core] +[c008000013628868] mlx5e_update_ndo_stats+0x28/0x90 [mlx5_core] +[c008000013625558] mlx5e_update_stats_work+0x68/0xb0 [mlx5_core] +[c00000000015bcec] process_one_work+0x1bc/0x5f0 +[c00000000015ecac] worker_thread+0xac/0x6b0 +[c000000000168338] kthread+0x168/0x1b0 +[c00000000000b628] ret_from_kernel_thread+0x5c/0xb4 + +This happens because firstly the CPU is not really offline in the +usual sense, processes and interrupts have not been migrated away. +Secondly smp_send_stop does not happen atomically on all CPUs, so +one CPU can have marked itself offline, while another CPU is still +running processes or interrupts which can affect the first CPU. + +Fix this by just not marking the CPU as offline. It's more like +frozen in time, so offline does not really reflect its state properly +anyway. There should be nothing in the crash/panic path that walks +online CPUs and synchronously waits for them, so this change should +not introduce new hangs. + +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/smp.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/arch/powerpc/kernel/smp.c ++++ b/arch/powerpc/kernel/smp.c +@@ -579,9 +579,6 @@ static void nmi_stop_this_cpu(struct pt_ + nmi_ipi_busy_count--; + nmi_ipi_unlock(); + +- /* Remove this CPU */ +- set_cpu_online(smp_processor_id(), false); +- + spin_begin(); + while (1) + spin_cpu_relax(); +@@ -596,9 +593,6 @@ void smp_send_stop(void) + + static void stop_this_cpu(void *dummy) + { +- /* Remove this CPU */ +- set_cpu_online(smp_processor_id(), false); +- + hard_irq_disable(); + spin_begin(); + while (1) diff --git a/queue-4.17/pty-fix-o_cloexec-for-tiocgptpeer.patch b/queue-4.17/pty-fix-o_cloexec-for-tiocgptpeer.patch new file mode 100644 index 00000000000..927cb6cdb1a --- /dev/null +++ b/queue-4.17/pty-fix-o_cloexec-for-tiocgptpeer.patch @@ -0,0 +1,32 @@ +From 36ecc1481dc8d8c52d43ba18c6b642c1d2fde789 Mon Sep 17 00:00:00 2001 +From: Matthijs van Duin +Date: Thu, 19 Jul 2018 10:43:46 +0200 +Subject: pty: fix O_CLOEXEC for TIOCGPTPEER + +From: Matthijs van Duin + +commit 36ecc1481dc8d8c52d43ba18c6b642c1d2fde789 upstream. + +It was being ignored because the flags were not passed to fd allocation. + +Fixes: 54ebbfb16034 ("tty: add TIOCGPTPEER ioctl") +Signed-off-by: Matthijs van Duin +Acked-by: Aleksa Sarai +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/pty.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/pty.c ++++ b/drivers/tty/pty.c +@@ -625,7 +625,7 @@ int ptm_open_peer(struct file *master, s + if (tty->driver != ptm_driver) + return -EIO; + +- fd = get_unused_fd_flags(0); ++ fd = get_unused_fd_flags(flags); + if (fd < 0) { + retval = fd; + goto err; diff --git a/queue-4.17/qed-add-sanity-check-for-simd-fastpath-handler.patch b/queue-4.17/qed-add-sanity-check-for-simd-fastpath-handler.patch new file mode 100644 index 00000000000..118828a12e0 --- /dev/null +++ b/queue-4.17/qed-add-sanity-check-for-simd-fastpath-handler.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Sudarsana Reddy Kalluru +Date: Mon, 18 Jun 2018 21:58:01 -0700 +Subject: qed: Add sanity check for SIMD fastpath handler. + +From: Sudarsana Reddy Kalluru + +[ Upstream commit 3935a70968820c3994db4de7e6e1c7e814bff875 ] + +Avoid calling a SIMD fastpath handler if it is NULL. The check is needed +to handle an unlikely scenario where unsolicited interrupt is destined to +a PF in INTa mode. + +Fixes: fe56b9e6a ("qed: Add module with basic common support") +Signed-off-by: Sudarsana Reddy Kalluru +Signed-off-by: Ariel Elior +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_main.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -566,8 +566,16 @@ static irqreturn_t qed_single_int(int ir + /* Fastpath interrupts */ + for (j = 0; j < 64; j++) { + if ((0x2ULL << j) & status) { +- hwfn->simd_proto_handler[j].func( +- hwfn->simd_proto_handler[j].token); ++ struct qed_simd_fp_handler *p_handler = ++ &hwfn->simd_proto_handler[j]; ++ ++ if (p_handler->func) ++ p_handler->func(p_handler->token); ++ else ++ DP_NOTICE(hwfn, ++ "Not calling fastpath handler as it is NULL [handler #%d, status 0x%llx]\n", ++ j, status); ++ + status &= ~(0x2ULL << j); + rc = IRQ_HANDLED; + } diff --git a/queue-4.17/qed-do-not-advertise-dcbx_lld_managed-capability.patch b/queue-4.17/qed-do-not-advertise-dcbx_lld_managed-capability.patch new file mode 100644 index 00000000000..56ed2cea219 --- /dev/null +++ b/queue-4.17/qed-do-not-advertise-dcbx_lld_managed-capability.patch @@ -0,0 +1,60 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Sudarsana Reddy Kalluru +Date: Mon, 18 Jun 2018 21:58:02 -0700 +Subject: qed: Do not advertise DCBX_LLD_MANAGED capability. + +From: Sudarsana Reddy Kalluru + +[ Upstream commit ff54d5cd9ec15546abc870452dd0b66eef4b4606 ] + +Do not advertise DCBX_LLD_MANAGED capability i.e., do not allow +external agent to manage the dcbx/lldp negotiation. MFW acts as lldp agent +for qed* devices, and no other lldp agent is allowed to coexist with mfw. + +Also updated a debug print, to not to display the redundant info. + +Fixes: a1d8d8a51 ("qed: Add dcbnl support.") +Signed-off-by: Sudarsana Reddy Kalluru +Signed-off-by: Ariel Elior +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_dcbx.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c +@@ -255,9 +255,8 @@ qed_dcbx_get_app_protocol_type(struct qe + *type = DCBX_PROTOCOL_ROCE_V2; + } else { + *type = DCBX_MAX_PROTOCOL_TYPE; +- DP_ERR(p_hwfn, +- "No action required, App TLV id = 0x%x app_prio_bitmap = 0x%x\n", +- id, app_prio_bitmap); ++ DP_ERR(p_hwfn, "No action required, App TLV entry = 0x%x\n", ++ app_prio_bitmap); + return false; + } + +@@ -1469,8 +1468,8 @@ static u8 qed_dcbnl_getcap(struct qed_de + *cap = 0x80; + break; + case DCB_CAP_ATTR_DCBX: +- *cap = (DCB_CAP_DCBX_LLD_MANAGED | DCB_CAP_DCBX_VER_CEE | +- DCB_CAP_DCBX_VER_IEEE | DCB_CAP_DCBX_STATIC); ++ *cap = (DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_VER_IEEE | ++ DCB_CAP_DCBX_STATIC); + break; + default: + *cap = false; +@@ -1538,8 +1537,6 @@ static u8 qed_dcbnl_getdcbx(struct qed_d + if (!dcbx_info) + return 0; + +- if (dcbx_info->operational.enabled) +- mode |= DCB_CAP_DCBX_LLD_MANAGED; + if (dcbx_info->operational.ieee) + mode |= DCB_CAP_DCBX_VER_IEEE; + if (dcbx_info->operational.cee) diff --git a/queue-4.17/qed-fix-possible-memory-leak-in-rx-error-path-handling.patch b/queue-4.17/qed-fix-possible-memory-leak-in-rx-error-path-handling.patch new file mode 100644 index 00000000000..09dca995bd3 --- /dev/null +++ b/queue-4.17/qed-fix-possible-memory-leak-in-rx-error-path-handling.patch @@ -0,0 +1,57 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Sudarsana Reddy Kalluru +Date: Mon, 18 Jun 2018 21:58:00 -0700 +Subject: qed: Fix possible memory leak in Rx error path handling. + +From: Sudarsana Reddy Kalluru + +[ Upstream commit 4f9de4df901fb84709fe3a864dfa4eaf35700f68 ] + +Memory for packet buffers need to be freed in the error paths as there is +no consumer (e.g., upper layer) for such packets and that memory will never +get freed. +The issue was uncovered when port was attacked with flood of isatap +packets, these are multicast packets hence were directed at all the PFs. +For foce PF, this meant they were routed to the ll2 module which in turn +drops such packets. + +Fixes: 0a7fb11c ("qed: Add Light L2 support") +Signed-off-by: Sudarsana Reddy Kalluru +Signed-off-by: Ariel Elior +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_ll2.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c +@@ -201,8 +201,9 @@ void qed_ll2b_complete_rx_packet(void *c + + skb = build_skb(buffer->data, 0); + if (!skb) { +- rc = -ENOMEM; +- goto out_post; ++ DP_INFO(cdev, "Failed to build SKB\n"); ++ kfree(buffer->data); ++ goto out_post1; + } + + data->u.placement_offset += NET_SKB_PAD; +@@ -224,8 +225,14 @@ void qed_ll2b_complete_rx_packet(void *c + cdev->ll2->cbs->rx_cb(cdev->ll2->cb_cookie, skb, + data->opaque_data_0, + data->opaque_data_1); ++ } else { ++ DP_VERBOSE(p_hwfn, (NETIF_MSG_RX_STATUS | NETIF_MSG_PKTDATA | ++ QED_MSG_LL2 | QED_MSG_STORAGE), ++ "Dropping the packet\n"); ++ kfree(buffer->data); + } + ++out_post1: + /* Update Buffer information and update FW producer */ + buffer->data = new_data; + buffer->phys_addr = new_phys_addr; diff --git a/queue-4.17/qed-off-by-one-in-qed_parse_mcp_trace_buf.patch b/queue-4.17/qed-off-by-one-in-qed_parse_mcp_trace_buf.patch new file mode 100644 index 00000000000..219c1379f8c --- /dev/null +++ b/queue-4.17/qed-off-by-one-in-qed_parse_mcp_trace_buf.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dan Carpenter +Date: Wed, 4 Jul 2018 12:52:36 +0300 +Subject: qed: off by one in qed_parse_mcp_trace_buf() + +From: Dan Carpenter + +[ Upstream commit 0df8adbb88db8283f102a2afa91610a502245cb2 ] + +If format_idx == s_mcp_trace_meta.formats_num then we read one element +beyond the end of the s_mcp_trace_meta.formats[] array. + +Fixes: 50bc60cb155c ("qed*: Utilize FW 8.33.11.0") +Signed-off-by: Dan Carpenter +Acked-by: Tomer Tayar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c +@@ -6663,7 +6663,7 @@ static enum dbg_status qed_parse_mcp_tra + format_idx = header & MFW_TRACE_EVENTID_MASK; + + /* Skip message if its index doesn't exist in the meta data */ +- if (format_idx > s_mcp_trace_meta.formats_num) { ++ if (format_idx >= s_mcp_trace_meta.formats_num) { + u8 format_size = + (u8)((header & MFW_TRACE_PRM_SIZE_MASK) >> + MFW_TRACE_PRM_SIZE_SHIFT); diff --git a/queue-4.17/qlogic-check-kstrtoul-for-errors.patch b/queue-4.17/qlogic-check-kstrtoul-for-errors.patch new file mode 100644 index 00000000000..b4ec2f6704c --- /dev/null +++ b/queue-4.17/qlogic-check-kstrtoul-for-errors.patch @@ -0,0 +1,31 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dan Carpenter +Date: Thu, 12 Jul 2018 15:23:45 +0300 +Subject: qlogic: check kstrtoul() for errors + +From: Dan Carpenter + +[ Upstream commit 5fc853cc01c68f84984ecc2d5fd777ecad78240f ] + +We accidentally left out the error handling for kstrtoul(). + +Fixes: a520030e326a ("qlcnic: Implement flash sysfs callback for 83xx adapter") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c +@@ -1128,6 +1128,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_w + struct qlcnic_adapter *adapter = dev_get_drvdata(dev); + + ret = kstrtoul(buf, 16, &data); ++ if (ret) ++ return ret; + + switch (data) { + case QLC_83XX_FLASH_SECTOR_ERASE_CMD: diff --git a/queue-4.17/r8169-fix-mac-address-change.patch b/queue-4.17/r8169-fix-mac-address-change.patch new file mode 100644 index 00000000000..16290f5cac0 --- /dev/null +++ b/queue-4.17/r8169-fix-mac-address-change.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Heiner Kallweit +Date: Mon, 2 Jul 2018 22:49:35 +0200 +Subject: r8169: fix mac address change + +From: Heiner Kallweit + +[ Upstream commit 2d0ec5440bef4a0a8858d52d45c31725540c3e74 ] + +Network core refuses to change mac address because flag +IFF_LIVE_ADDR_CHANGE isn't set. Set this missing flag. + +Fixes: 1f7aa2bc268e ("r8169: simplify rtl_set_mac_address") +Reported-by: Corinna Vinschen +Signed-off-by: Heiner Kallweit +Tested-by: Corinna Vinschen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/realtek/r8169.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -8345,6 +8345,7 @@ static int rtl_init_one(struct pci_dev * + NETIF_F_HW_VLAN_CTAG_RX; + dev->vlan_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO | + NETIF_F_HIGHDMA; ++ dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; + + tp->cp_cmd |= RxChkSum | RxVlan; + diff --git a/queue-4.17/ravb-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch b/queue-4.17/ravb-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch new file mode 100644 index 00000000000..a3554bc86f2 --- /dev/null +++ b/queue-4.17/ravb-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch @@ -0,0 +1,46 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Vladimir Zapolskiy +Date: Wed, 4 Jul 2018 11:14:50 +0300 +Subject: ravb: fix invalid context bug while calling auto-negotiation by ethtool + +From: Vladimir Zapolskiy + +[ Upstream commit 0973a4dd79fe56a3beecfcff675ba4c01df0b0c1 ] + +Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O +potentially sleeping") phy_start_aneg() function utilizes a mutex +to serialize changes to phy state, however the helper function is +called in atomic context. + +The bug can be reproduced by running "ethtool -r" command, the bug +is reported if CONFIG_DEBUG_ATOMIC_SLEEP build option is enabled. + +Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") +Signed-off-by: Vladimir Zapolskiy +Reviewed-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/renesas/ravb_main.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1152,15 +1152,10 @@ error_exit: + + static int ravb_nway_reset(struct net_device *ndev) + { +- struct ravb_private *priv = netdev_priv(ndev); + int error = -ENODEV; +- unsigned long flags; + +- if (ndev->phydev) { +- spin_lock_irqsave(&priv->lock, flags); ++ if (ndev->phydev) + error = phy_start_aneg(ndev->phydev); +- spin_unlock_irqrestore(&priv->lock, flags); +- } + + return error; + } diff --git a/queue-4.17/ravb-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch b/queue-4.17/ravb-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch new file mode 100644 index 00000000000..52e0bd7a60f --- /dev/null +++ b/queue-4.17/ravb-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch @@ -0,0 +1,117 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Vladimir Zapolskiy +Date: Wed, 4 Jul 2018 11:14:51 +0300 +Subject: ravb: fix invalid context bug while changing link options by ethtool + +From: Vladimir Zapolskiy + +[ Upstream commit 05925e52a7d379192a5fdff2c33710f573190ead ] + +The change fixes sleep in atomic context bug, which is encountered +every time when link settings are changed by ethtool. + +Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O +potentially sleeping") phy_start_aneg() function utilizes a mutex +to serialize changes to phy state, however that helper function is +called in atomic context under a grabbed spinlock, because +phy_start_aneg() is called by phy_ethtool_ksettings_set() and by +replaced phy_ethtool_sset() helpers from phylib. + +Now duplex mode setting is enforced in ravb_adjust_link() only, also +now RX/TX is disabled when link is put down or modifications to E-MAC +registers ECMR and GECMR are expected for both cases of checked and +ignored link status pin state from E-MAC interrupt handler. + +Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") +Signed-off-by: Vladimir Zapolskiy +Reviewed-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/renesas/ravb_main.c | 49 +++++++++---------------------- + 1 file changed, 15 insertions(+), 34 deletions(-) + +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -980,6 +980,13 @@ static void ravb_adjust_link(struct net_ + struct ravb_private *priv = netdev_priv(ndev); + struct phy_device *phydev = ndev->phydev; + bool new_state = false; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&priv->lock, flags); ++ ++ /* Disable TX and RX right over here, if E-MAC change is ignored */ ++ if (priv->no_avb_link) ++ ravb_rcv_snd_disable(ndev); + + if (phydev->link) { + if (phydev->duplex != priv->duplex) { +@@ -997,18 +1004,21 @@ static void ravb_adjust_link(struct net_ + ravb_modify(ndev, ECMR, ECMR_TXF, 0); + new_state = true; + priv->link = phydev->link; +- if (priv->no_avb_link) +- ravb_rcv_snd_enable(ndev); + } + } else if (priv->link) { + new_state = true; + priv->link = 0; + priv->speed = 0; + priv->duplex = -1; +- if (priv->no_avb_link) +- ravb_rcv_snd_disable(ndev); + } + ++ /* Enable TX and RX right over here, if E-MAC change is ignored */ ++ if (priv->no_avb_link && phydev->link) ++ ravb_rcv_snd_enable(ndev); ++ ++ mmiowb(); ++ spin_unlock_irqrestore(&priv->lock, flags); ++ + if (new_state && netif_msg_link(priv)) + phy_print_status(phydev); + } +@@ -1115,39 +1125,10 @@ static int ravb_get_link_ksettings(struc + static int ravb_set_link_ksettings(struct net_device *ndev, + const struct ethtool_link_ksettings *cmd) + { +- struct ravb_private *priv = netdev_priv(ndev); +- unsigned long flags; +- int error; +- + if (!ndev->phydev) + return -ENODEV; + +- spin_lock_irqsave(&priv->lock, flags); +- +- /* Disable TX and RX */ +- ravb_rcv_snd_disable(ndev); +- +- error = phy_ethtool_ksettings_set(ndev->phydev, cmd); +- if (error) +- goto error_exit; +- +- if (cmd->base.duplex == DUPLEX_FULL) +- priv->duplex = 1; +- else +- priv->duplex = 0; +- +- ravb_set_duplex(ndev); +- +-error_exit: +- mdelay(1); +- +- /* Enable TX and RX */ +- ravb_rcv_snd_enable(ndev); +- +- mmiowb(); +- spin_unlock_irqrestore(&priv->lock, flags); +- +- return error; ++ return phy_ethtool_ksettings_set(ndev->phydev, cmd); + } + + static int ravb_nway_reset(struct net_device *ndev) diff --git a/queue-4.17/rdma-mlx5-fix-memory-leak-in-mlx5_ib_create_srq-error-path.patch b/queue-4.17/rdma-mlx5-fix-memory-leak-in-mlx5_ib_create_srq-error-path.patch new file mode 100644 index 00000000000..7742a73d997 --- /dev/null +++ b/queue-4.17/rdma-mlx5-fix-memory-leak-in-mlx5_ib_create_srq-error-path.patch @@ -0,0 +1,55 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Kamal Heib +Date: Tue, 10 Jul 2018 11:56:50 +0300 +Subject: RDMA/mlx5: Fix memory leak in mlx5_ib_create_srq() error path + +From: Kamal Heib + +[ Upstream commit d63c46734c545ad0488761059004a65c46efdde3 ] + +Fix memory leak in the error path of mlx5_ib_create_srq() by making sure +to free the allocated srq. + +Fixes: c2b37f76485f ("IB/mlx5: Fix integer overflows in mlx5_ib_create_srq") +Signed-off-by: Kamal Heib +Acked-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/mlx5/srq.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/infiniband/hw/mlx5/srq.c ++++ b/drivers/infiniband/hw/mlx5/srq.c +@@ -266,18 +266,24 @@ struct ib_srq *mlx5_ib_create_srq(struct + + desc_size = sizeof(struct mlx5_wqe_srq_next_seg) + + srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg); +- if (desc_size == 0 || srq->msrq.max_gs > desc_size) +- return ERR_PTR(-EINVAL); ++ if (desc_size == 0 || srq->msrq.max_gs > desc_size) { ++ err = -EINVAL; ++ goto err_srq; ++ } + desc_size = roundup_pow_of_two(desc_size); + desc_size = max_t(size_t, 32, desc_size); +- if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) +- return ERR_PTR(-EINVAL); ++ if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) { ++ err = -EINVAL; ++ goto err_srq; ++ } + srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) / + sizeof(struct mlx5_wqe_data_seg); + srq->msrq.wqe_shift = ilog2(desc_size); + buf_size = srq->msrq.max * desc_size; +- if (buf_size < desc_size) +- return ERR_PTR(-EINVAL); ++ if (buf_size < desc_size) { ++ err = -EINVAL; ++ goto err_srq; ++ } + in.type = init_attr->srq_type; + + if (pd->uobject) diff --git a/queue-4.17/rdma-qedr-fix-null-pointer-dereference-when-running-over-iwarp-without-rdma-cm.patch b/queue-4.17/rdma-qedr-fix-null-pointer-dereference-when-running-over-iwarp-without-rdma-cm.patch new file mode 100644 index 00000000000..6cc2ce69ed3 --- /dev/null +++ b/queue-4.17/rdma-qedr-fix-null-pointer-dereference-when-running-over-iwarp-without-rdma-cm.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: "Kalderon, Michal" +Date: Mon, 11 Jun 2018 10:20:20 +0300 +Subject: RDMA/qedr: Fix NULL pointer dereference when running over iWARP without RDMA-CM + +From: "Kalderon, Michal" + +[ Upstream commit 425cf5c1350a98b81f3ddda160b99c3be613a213 ] + +Some RoCE specific code in qedr_modify_qp was run over an iWARP device +when running perftest benchmarks without the -R option. + +The commit 3e44e0ee0893 ("IB/providers: Avoid null netdev check for RoCE") +exposed this. Dropping the check for NULL pointer on ndev in +qedr_modify_qp lead to a null pointer dereference when running over +iWARP. Before the code would identify ndev as being NULL and return an +error. + +Fixes: 3e44e0ee0893 ("IB/providers: Avoid null netdev check for RoCE") +Signed-off-by: Ariel Elior +Signed-off-by: Michal Kalderon +Reviewed-by: Parav Pandit +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/qedr/verbs.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -1957,6 +1957,9 @@ int qedr_modify_qp(struct ib_qp *ibqp, s + } + + if (attr_mask & (IB_QP_AV | IB_QP_PATH_MTU)) { ++ if (rdma_protocol_iwarp(&dev->ibdev, 1)) ++ return -EINVAL; ++ + if (attr_mask & IB_QP_PATH_MTU) { + if (attr->path_mtu < IB_MTU_256 || + attr->path_mtu > IB_MTU_4096) { diff --git a/queue-4.17/rds-clean-up-loopback-rds_connections-on-netns-deletion.patch b/queue-4.17/rds-clean-up-loopback-rds_connections-on-netns-deletion.patch new file mode 100644 index 00000000000..c3a18943c8d --- /dev/null +++ b/queue-4.17/rds-clean-up-loopback-rds_connections-on-netns-deletion.patch @@ -0,0 +1,166 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Sowmini Varadhan +Date: Mon, 25 Jun 2018 06:41:25 -0700 +Subject: rds: clean up loopback rds_connections on netns deletion + +From: Sowmini Varadhan + +[ Upstream commit c809195f5523dd4d09403bbb1c9732d548aa0d1e ] + +The RDS core module creates rds_connections based on callbacks +from rds_loop_transport when sending/receiving packets to local +addresses. + +These connections will need to be cleaned up when they are +created from a netns that is not init_net, and that netns is deleted. + +Add the changes aligned with the changes from +commit ebeeb1ad9b8a ("rds: tcp: use rds_destroy_pending() to synchronize +netns/module teardown and rds connection/workq management") for +rds_loop_transport + +Reported-and-tested-by: syzbot+4c20b3866171ce8441d2@syzkaller.appspotmail.com +Acked-by: Santosh Shilimkar +Signed-off-by: Sowmini Varadhan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/rds/connection.c | 11 +++++++++- + net/rds/loop.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++ + net/rds/loop.h | 2 + + 3 files changed, 68 insertions(+), 1 deletion(-) + +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -659,11 +659,19 @@ static void rds_conn_info(struct socket + + int rds_conn_init(void) + { ++ int ret; ++ ++ ret = rds_loop_net_init(); /* register pernet callback */ ++ if (ret) ++ return ret; ++ + rds_conn_slab = kmem_cache_create("rds_connection", + sizeof(struct rds_connection), + 0, 0, NULL); +- if (!rds_conn_slab) ++ if (!rds_conn_slab) { ++ rds_loop_net_exit(); + return -ENOMEM; ++ } + + rds_info_register_func(RDS_INFO_CONNECTIONS, rds_conn_info); + rds_info_register_func(RDS_INFO_SEND_MESSAGES, +@@ -676,6 +684,7 @@ int rds_conn_init(void) + + void rds_conn_exit(void) + { ++ rds_loop_net_exit(); /* unregister pernet callback */ + rds_loop_exit(); + + WARN_ON(!hlist_empty(rds_conn_hash)); +--- a/net/rds/loop.c ++++ b/net/rds/loop.c +@@ -33,6 +33,8 @@ + #include + #include + #include ++#include ++#include + + #include "rds_single_path.h" + #include "rds.h" +@@ -40,6 +42,17 @@ + + static DEFINE_SPINLOCK(loop_conns_lock); + static LIST_HEAD(loop_conns); ++static atomic_t rds_loop_unloading = ATOMIC_INIT(0); ++ ++static void rds_loop_set_unloading(void) ++{ ++ atomic_set(&rds_loop_unloading, 1); ++} ++ ++static bool rds_loop_is_unloading(struct rds_connection *conn) ++{ ++ return atomic_read(&rds_loop_unloading) != 0; ++} + + /* + * This 'loopback' transport is a special case for flows that originate +@@ -165,6 +178,8 @@ void rds_loop_exit(void) + struct rds_loop_connection *lc, *_lc; + LIST_HEAD(tmp_list); + ++ rds_loop_set_unloading(); ++ synchronize_rcu(); + /* avoid calling conn_destroy with irqs off */ + spin_lock_irq(&loop_conns_lock); + list_splice(&loop_conns, &tmp_list); +@@ -177,6 +192,46 @@ void rds_loop_exit(void) + } + } + ++static void rds_loop_kill_conns(struct net *net) ++{ ++ struct rds_loop_connection *lc, *_lc; ++ LIST_HEAD(tmp_list); ++ ++ spin_lock_irq(&loop_conns_lock); ++ list_for_each_entry_safe(lc, _lc, &loop_conns, loop_node) { ++ struct net *c_net = read_pnet(&lc->conn->c_net); ++ ++ if (net != c_net) ++ continue; ++ list_move_tail(&lc->loop_node, &tmp_list); ++ } ++ spin_unlock_irq(&loop_conns_lock); ++ ++ list_for_each_entry_safe(lc, _lc, &tmp_list, loop_node) { ++ WARN_ON(lc->conn->c_passive); ++ rds_conn_destroy(lc->conn); ++ } ++} ++ ++static void __net_exit rds_loop_exit_net(struct net *net) ++{ ++ rds_loop_kill_conns(net); ++} ++ ++static struct pernet_operations rds_loop_net_ops = { ++ .exit = rds_loop_exit_net, ++}; ++ ++int rds_loop_net_init(void) ++{ ++ return register_pernet_device(&rds_loop_net_ops); ++} ++ ++void rds_loop_net_exit(void) ++{ ++ unregister_pernet_device(&rds_loop_net_ops); ++} ++ + /* + * This is missing .xmit_* because loop doesn't go through generic + * rds_send_xmit() and doesn't call rds_recv_incoming(). .listen_stop and +@@ -194,4 +249,5 @@ struct rds_transport rds_loop_transport + .inc_free = rds_loop_inc_free, + .t_name = "loopback", + .t_type = RDS_TRANS_LOOP, ++ .t_unloading = rds_loop_is_unloading, + }; +--- a/net/rds/loop.h ++++ b/net/rds/loop.h +@@ -5,6 +5,8 @@ + /* loop.c */ + extern struct rds_transport rds_loop_transport; + ++int rds_loop_net_init(void); ++void rds_loop_net_exit(void); + void rds_loop_exit(void); + + #endif diff --git a/queue-4.17/risc-v-don-t-include-irq-riscv-intc.h.patch b/queue-4.17/risc-v-don-t-include-irq-riscv-intc.h.patch new file mode 100644 index 00000000000..bbb7e87efd2 --- /dev/null +++ b/queue-4.17/risc-v-don-t-include-irq-riscv-intc.h.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Palmer Dabbelt +Date: Fri, 22 Jun 2018 15:46:28 -0700 +Subject: RISC-V: Don't include irq-riscv-intc.h + +From: Palmer Dabbelt + +[ Upstream commit 8606544890d7dc4f7a740963f70dc1e1d54f8e30 ] + +This file has never existed in the upstream kernel, but it's guarded by +an #ifdef that's also never existed in the upstream kernel. As a part +of our interrupt controller refactoring this header is no longer +necessary, but this reference managed to sneak in anyway. + +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/kernel/irq.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/arch/riscv/kernel/irq.c ++++ b/arch/riscv/kernel/irq.c +@@ -16,10 +16,6 @@ + #include + #include + +-#ifdef CONFIG_RISCV_INTC +-#include +-#endif +- + void __init init_IRQ(void) + { + irqchip_init(); diff --git a/queue-4.17/risc-v-fix-ptrace_setregset-bug.patch b/queue-4.17/risc-v-fix-ptrace_setregset-bug.patch new file mode 100644 index 00000000000..ec140a6faf6 --- /dev/null +++ b/queue-4.17/risc-v-fix-ptrace_setregset-bug.patch @@ -0,0 +1,31 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jim Wilson +Date: Mon, 11 Jun 2018 14:48:22 -0700 +Subject: RISC-V: Fix PTRACE_SETREGSET bug. + +From: Jim Wilson + +[ Upstream commit 1db9b80980d26fe95c942e0bb8bde2ca715029ad ] + +In riscv_gpr_set, pass regs instead of ®s to user_regset_copyin to fix +gdb segfault. + +Signed-off-by: Jim Wilson +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/kernel/ptrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/riscv/kernel/ptrace.c ++++ b/arch/riscv/kernel/ptrace.c +@@ -50,7 +50,7 @@ static int riscv_gpr_set(struct task_str + struct pt_regs *regs; + + regs = task_pt_regs(target); +- ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, ®s, 0, -1); ++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, regs, 0, -1); + return ret; + } + diff --git a/queue-4.17/risc-v-fix-r_riscv_add32-r_riscv_sub32-relocations.patch b/queue-4.17/risc-v-fix-r_riscv_add32-r_riscv_sub32-relocations.patch new file mode 100644 index 00000000000..3c0dbefbdc0 --- /dev/null +++ b/queue-4.17/risc-v-fix-r_riscv_add32-r_riscv_sub32-relocations.patch @@ -0,0 +1,39 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Andreas Schwab +Date: Tue, 12 Jun 2018 19:26:36 +0200 +Subject: RISC-V: fix R_RISCV_ADD32/R_RISCV_SUB32 relocations + +From: Andreas Schwab + +[ Upstream commit 781c8fe2da3d2c7c95cd7ffddbab63b80a79da4d ] + +The R_RISCV_ADD32/R_RISCV_SUB32 relocations should add/subtract the +address of the symbol (without overflow check), not its contents. + +Signed-off-by: Andreas Schwab +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/kernel/module.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/riscv/kernel/module.c ++++ b/arch/riscv/kernel/module.c +@@ -252,14 +252,14 @@ static int apply_r_riscv_align_rela(stru + static int apply_r_riscv_add32_rela(struct module *me, u32 *location, + Elf_Addr v) + { +- *(u32 *)location += (*(u32 *)v); ++ *(u32 *)location += (u32)v; + return 0; + } + + static int apply_r_riscv_sub32_rela(struct module *me, u32 *location, + Elf_Addr v) + { +- *(u32 *)location -= (*(u32 *)v); ++ *(u32 *)location -= (u32)v; + return 0; + } + diff --git a/queue-4.17/rtc-fix-alarm-read-and-set-offset.patch b/queue-4.17/rtc-fix-alarm-read-and-set-offset.patch new file mode 100644 index 00000000000..1c7049eb238 --- /dev/null +++ b/queue-4.17/rtc-fix-alarm-read-and-set-offset.patch @@ -0,0 +1,60 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Alexandre Belloni +Date: Thu, 12 Jul 2018 12:22:44 +0200 +Subject: rtc: fix alarm read and set offset + +From: Alexandre Belloni + +[ Upstream commit fd6792bb022e43faa0c4a45b6f25285e21206f9d ] + +The offset needs to be added after reading the alarm value. + +It also needs to be subtracted after the now < alarm test. + +Tested-by: Jon Hunter +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/interface.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -265,8 +265,10 @@ int __rtc_read_alarm(struct rtc_device * + return err; + + /* full-function RTCs won't have such missing fields */ +- if (rtc_valid_tm(&alarm->time) == 0) ++ if (rtc_valid_tm(&alarm->time) == 0) { ++ rtc_add_offset(rtc, &alarm->time); + return 0; ++ } + + /* get the "after" timestamp, to detect wrapped fields */ + err = rtc_read_time(rtc, &now); +@@ -409,7 +411,6 @@ static int __rtc_set_alarm(struct rtc_de + if (err) + return err; + +- rtc_subtract_offset(rtc, &alarm->time); + scheduled = rtc_tm_to_time64(&alarm->time); + + /* Make sure we're not setting alarms in the past */ +@@ -426,6 +427,8 @@ static int __rtc_set_alarm(struct rtc_de + * over right here, before we set the alarm. + */ + ++ rtc_subtract_offset(rtc, &alarm->time); ++ + if (!rtc->ops) + err = -ENODEV; + else if (!rtc->ops->set_alarm) +@@ -467,7 +470,6 @@ int rtc_set_alarm(struct rtc_device *rtc + + mutex_unlock(&rtc->ops_lock); + +- rtc_add_offset(rtc, &alarm->time); + return err; + } + EXPORT_SYMBOL_GPL(rtc_set_alarm); diff --git a/queue-4.17/s390-qeth-consistently-re-enable-device-features.patch b/queue-4.17/s390-qeth-consistently-re-enable-device-features.patch new file mode 100644 index 00000000000..65f2287b5ff --- /dev/null +++ b/queue-4.17/s390-qeth-consistently-re-enable-device-features.patch @@ -0,0 +1,122 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Julian Wiedmann +Date: Fri, 29 Jun 2018 19:45:54 +0200 +Subject: s390/qeth: consistently re-enable device features + +From: Julian Wiedmann + +[ Upstream commit d025da9eb1e48d3e5f2a2ff13ac5ac536ba4be43 ] + +commit e830baa9c3f0 ("qeth: restore device features after recovery") and +commit ce3443564145 ("s390/qeth: rely on kernel for feature recovery") +made sure that the HW functions for device features get re-programmed +after recovery. + +But we missed that the same handling is also required when a card is +first set offline (destroying all HW context), and then online again. +Fix this by moving the re-enable action out of the recovery-only path. + +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/net/qeth_core.h | 2 +- + drivers/s390/net/qeth_core_main.c | 23 +++++++++++------------ + drivers/s390/net/qeth_l2_main.c | 5 ++--- + drivers/s390/net/qeth_l3_main.c | 3 ++- + 4 files changed, 16 insertions(+), 17 deletions(-) + +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -1003,7 +1003,7 @@ struct qeth_cmd_buffer *qeth_get_setassp + __u16, __u16, + enum qeth_prot_versions); + int qeth_set_features(struct net_device *, netdev_features_t); +-void qeth_recover_features(struct net_device *dev); ++void qeth_enable_hw_features(struct net_device *dev); + netdev_features_t qeth_fix_features(struct net_device *, netdev_features_t); + netdev_features_t qeth_features_check(struct sk_buff *skb, + struct net_device *dev, +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -6432,28 +6432,27 @@ static int qeth_set_ipa_tso(struct qeth_ + #define QETH_HW_FEATURES (NETIF_F_RXCSUM | NETIF_F_IP_CSUM | NETIF_F_TSO) + + /** +- * qeth_recover_features() - Restore device features after recovery +- * @dev: the recovering net_device +- * +- * Caller must hold rtnl lock. ++ * qeth_enable_hw_features() - (Re-)Enable HW functions for device features ++ * @dev: a net_device + */ +-void qeth_recover_features(struct net_device *dev) ++void qeth_enable_hw_features(struct net_device *dev) + { +- netdev_features_t features = dev->features; + struct qeth_card *card = dev->ml_priv; ++ netdev_features_t features; + ++ rtnl_lock(); ++ features = dev->features; + /* force-off any feature that needs an IPA sequence. + * netdev_update_features() will restart them. + */ + dev->features &= ~QETH_HW_FEATURES; + netdev_update_features(dev); +- +- if (features == dev->features) +- return; +- dev_warn(&card->gdev->dev, +- "Device recovery failed to restore all offload features\n"); ++ if (features != dev->features) ++ dev_warn(&card->gdev->dev, ++ "Device recovery failed to restore all offload features\n"); ++ rtnl_unlock(); + } +-EXPORT_SYMBOL_GPL(qeth_recover_features); ++EXPORT_SYMBOL_GPL(qeth_enable_hw_features); + + int qeth_set_features(struct net_device *dev, netdev_features_t features) + { +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -1130,6 +1130,8 @@ static int __qeth_l2_set_online(struct c + netif_carrier_off(card->dev); + + qeth_set_allowed_threads(card, 0xffffffff, 0); ++ ++ qeth_enable_hw_features(card->dev); + if (recover_flag == CARD_STATE_RECOVER) { + if (recovery_mode && + card->info.type != QETH_CARD_TYPE_OSN) { +@@ -1141,9 +1143,6 @@ static int __qeth_l2_set_online(struct c + } + /* this also sets saved unicast addresses */ + qeth_l2_set_rx_mode(card->dev); +- rtnl_lock(); +- qeth_recover_features(card->dev); +- rtnl_unlock(); + } + /* let user_space know that device is online */ + kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE); +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -2792,6 +2792,8 @@ static int __qeth_l3_set_online(struct c + netif_carrier_on(card->dev); + else + netif_carrier_off(card->dev); ++ ++ qeth_enable_hw_features(card->dev); + if (recover_flag == CARD_STATE_RECOVER) { + rtnl_lock(); + if (recovery_mode) +@@ -2799,7 +2801,6 @@ static int __qeth_l3_set_online(struct c + else + dev_open(card->dev); + qeth_l3_set_rx_mode(card->dev); +- qeth_recover_features(card->dev); + rtnl_unlock(); + } + qeth_trace_features(card); diff --git a/queue-4.17/samples-bpf-add-missing-linux-if_vlan.h.patch b/queue-4.17/samples-bpf-add-missing-linux-if_vlan.h.patch new file mode 100644 index 00000000000..ae8ae55dda9 --- /dev/null +++ b/queue-4.17/samples-bpf-add-missing-linux-if_vlan.h.patch @@ -0,0 +1,50 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Taeung Song +Date: Wed, 4 Jul 2018 22:36:36 +0900 +Subject: samples/bpf: add missing + +From: Taeung Song + +[ Upstream commit 4d5d33a085335ef469c9a87792bcaaaa8e64d8c4 ] + +This fixes build error regarding redefinition: + + CLANG-bpf samples/bpf/parse_varlen.o + samples/bpf/parse_varlen.c:111:8: error: redefinition of 'vlan_hdr' + struct vlan_hdr { + ^ + ./include/linux/if_vlan.h:38:8: note: previous definition is here + +So remove duplicate 'struct vlan_hdr' in sample code and include if_vlan.h + +Signed-off-by: Taeung Song +Acked-by: David S. Miller +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + samples/bpf/parse_varlen.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/samples/bpf/parse_varlen.c ++++ b/samples/bpf/parse_varlen.c +@@ -6,6 +6,7 @@ + */ + #define KBUILD_MODNAME "foo" + #include ++#include + #include + #include + #include +@@ -108,11 +109,6 @@ static int parse_ipv6(void *data, uint64 + return 0; + } + +-struct vlan_hdr { +- uint16_t h_vlan_TCI; +- uint16_t h_vlan_encapsulated_proto; +-}; +- + SEC("varlen") + int handle_ingress(struct __sk_buff *skb) + { diff --git a/queue-4.17/samples-bpf-check-the-error-of-write-and-read.patch b/queue-4.17/samples-bpf-check-the-error-of-write-and-read.patch new file mode 100644 index 00000000000..b876ada826f --- /dev/null +++ b/queue-4.17/samples-bpf-check-the-error-of-write-and-read.patch @@ -0,0 +1,65 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Taeung Song +Date: Wed, 4 Jul 2018 22:36:38 +0900 +Subject: samples/bpf: Check the error of write() and read() + +From: Taeung Song + +[ Upstream commit 02a2f000a3629274bfad60bfc4de9edec49e63e7 ] + +test_task_rename() and test_urandom_read() +can be failed during write() and read(), +So check the result of them. + +Reviewed-by: David Laight +Signed-off-by: Taeung Song +Acked-by: David S. Miller +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + samples/bpf/test_overhead_user.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/samples/bpf/test_overhead_user.c ++++ b/samples/bpf/test_overhead_user.c +@@ -6,6 +6,7 @@ + */ + #define _GNU_SOURCE + #include ++#include + #include + #include + #include +@@ -44,8 +45,13 @@ static void test_task_rename(int cpu) + exit(1); + } + start_time = time_get_ns(); +- for (i = 0; i < MAX_CNT; i++) +- write(fd, buf, sizeof(buf)); ++ for (i = 0; i < MAX_CNT; i++) { ++ if (write(fd, buf, sizeof(buf)) < 0) { ++ printf("task rename failed: %s\n", strerror(errno)); ++ close(fd); ++ return; ++ } ++ } + printf("task_rename:%d: %lld events per sec\n", + cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time)); + close(fd); +@@ -63,8 +69,13 @@ static void test_urandom_read(int cpu) + exit(1); + } + start_time = time_get_ns(); +- for (i = 0; i < MAX_CNT; i++) +- read(fd, buf, sizeof(buf)); ++ for (i = 0; i < MAX_CNT; i++) { ++ if (read(fd, buf, sizeof(buf)) < 0) { ++ printf("failed to read from /dev/urandom: %s\n", strerror(errno)); ++ close(fd); ++ return; ++ } ++ } + printf("urandom_read:%d: %lld events per sec\n", + cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time)); + close(fd); diff --git a/queue-4.17/samples-bpf-check-the-result-of-system.patch b/queue-4.17/samples-bpf-check-the-result-of-system.patch new file mode 100644 index 00000000000..b7332782f03 --- /dev/null +++ b/queue-4.17/samples-bpf-check-the-result-of-system.patch @@ -0,0 +1,87 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Taeung Song +Date: Wed, 4 Jul 2018 22:36:37 +0900 +Subject: samples/bpf: Check the result of system() + +From: Taeung Song + +[ Upstream commit 492b7e894587c151be681f86d4d1d086375f7b45 ] + +To avoid the below build warning message, +use new generate_load() checking the return value. + + ignoring return value of ‘system’, declared with attribute warn_unused_result + +And it also refactors the duplicate code of both +test_perf_event_all_cpu() and test_perf_event_task() + +Cc: Teng Qin +Signed-off-by: Taeung Song +Acked-by: David S. Miller +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + samples/bpf/trace_event_user.c | 27 ++++++++++++++++++++++++--- + 1 file changed, 24 insertions(+), 3 deletions(-) + +--- a/samples/bpf/trace_event_user.c ++++ b/samples/bpf/trace_event_user.c +@@ -121,6 +121,16 @@ static void print_stacks(void) + } + } + ++static inline int generate_load(void) ++{ ++ if (system("dd if=/dev/zero of=/dev/null count=5000k status=none") < 0) { ++ printf("failed to generate some load with dd: %s\n", strerror(errno)); ++ return -1; ++ } ++ ++ return 0; ++} ++ + static void test_perf_event_all_cpu(struct perf_event_attr *attr) + { + int nr_cpus = sysconf(_SC_NPROCESSORS_CONF); +@@ -141,7 +151,11 @@ static void test_perf_event_all_cpu(stru + assert(ioctl(pmu_fd[i], PERF_EVENT_IOC_SET_BPF, prog_fd[0]) == 0); + assert(ioctl(pmu_fd[i], PERF_EVENT_IOC_ENABLE) == 0); + } +- system("dd if=/dev/zero of=/dev/null count=5000k status=none"); ++ ++ if (generate_load() < 0) { ++ error = 1; ++ goto all_cpu_err; ++ } + print_stacks(); + all_cpu_err: + for (i--; i >= 0; i--) { +@@ -155,7 +169,7 @@ all_cpu_err: + + static void test_perf_event_task(struct perf_event_attr *attr) + { +- int pmu_fd; ++ int pmu_fd, error = 0; + + /* per task perf event, enable inherit so the "dd ..." command can be traced properly. + * Enabling inherit will cause bpf_perf_prog_read_time helper failure. +@@ -170,10 +184,17 @@ static void test_perf_event_task(struct + } + assert(ioctl(pmu_fd, PERF_EVENT_IOC_SET_BPF, prog_fd[0]) == 0); + assert(ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE) == 0); +- system("dd if=/dev/zero of=/dev/null count=5000k status=none"); ++ ++ if (generate_load() < 0) { ++ error = 1; ++ goto err; ++ } + print_stacks(); ++err: + ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE); + close(pmu_fd); ++ if (error) ++ int_exit(0); + } + + static void test_bpf_perf_event(void) diff --git a/queue-4.17/samples-bpf-fix-tc-and-ip-paths-in-xdp2skb_meta.sh.patch b/queue-4.17/samples-bpf-fix-tc-and-ip-paths-in-xdp2skb_meta.sh.patch new file mode 100644 index 00000000000..1655ad78bf1 --- /dev/null +++ b/queue-4.17/samples-bpf-fix-tc-and-ip-paths-in-xdp2skb_meta.sh.patch @@ -0,0 +1,50 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Taeung Song +Date: Tue, 10 Jul 2018 02:51:21 +0900 +Subject: samples/bpf: Fix tc and ip paths in xdp2skb_meta.sh + +From: Taeung Song + +[ Upstream commit b9626f45abccd044f8048269c67720f0719f2d4e ] + +The below path error can occur: + + # ./xdp2skb_meta.sh --dev eth0 --list + ./xdp2skb_meta.sh: line 61: /usr/sbin/tc: No such file or directory + +So just use command names instead of absolute paths of tc and ip. +In addition, it allow callers to redefine $TC and $IP paths + +Fixes: 36e04a2d78d9 ("samples/bpf: xdp2skb_meta shows transferring info from XDP to SKB") +Reviewed-by: Jesper Dangaard Brouer +Signed-off-by: Taeung Song +Acked-by: Jesper Dangaard Brouer +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + samples/bpf/xdp2skb_meta.sh | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/samples/bpf/xdp2skb_meta.sh ++++ b/samples/bpf/xdp2skb_meta.sh +@@ -16,8 +16,8 @@ + BPF_FILE=xdp2skb_meta_kern.o + DIR=$(dirname $0) + +-export TC=/usr/sbin/tc +-export IP=/usr/sbin/ip ++[ -z "$TC" ] && TC=tc ++[ -z "$IP" ] && IP=ip + + function usage() { + echo "" +@@ -53,7 +53,7 @@ function _call_cmd() { + local allow_fail="$2" + shift 2 + if [[ -n "$VERBOSE" ]]; then +- echo "$(basename $cmd) $@" ++ echo "$cmd $@" + fi + if [[ -n "$DRYRUN" ]]; then + return diff --git a/queue-4.17/sched-deadline-fix-switched_from_dl-warning.patch b/queue-4.17/sched-deadline-fix-switched_from_dl-warning.patch new file mode 100644 index 00000000000..f1fb23c07a8 --- /dev/null +++ b/queue-4.17/sched-deadline-fix-switched_from_dl-warning.patch @@ -0,0 +1,85 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Juri Lelli +Date: Wed, 11 Jul 2018 09:29:48 +0200 +Subject: sched/deadline: Fix switched_from_dl() warning + +From: Juri Lelli + +[ Upstream commit e117cb52bdb4d376b711bee34af6434c9e314b3b ] + +Mark noticed that syzkaller is able to reliably trigger the following warning: + + dl_rq->running_bw > dl_rq->this_bw + WARNING: CPU: 1 PID: 153 at kernel/sched/deadline.c:124 switched_from_dl+0x454/0x608 + Kernel panic - not syncing: panic_on_warn set ... + + CPU: 1 PID: 153 Comm: syz-executor253 Not tainted 4.18.0-rc3+ #29 + Hardware name: linux,dummy-virt (DT) + Call trace: + dump_backtrace+0x0/0x458 + show_stack+0x20/0x30 + dump_stack+0x180/0x250 + panic+0x2dc/0x4ec + __warn_printk+0x0/0x150 + report_bug+0x228/0x2d8 + bug_handler+0xa0/0x1a0 + brk_handler+0x2f0/0x568 + do_debug_exception+0x1bc/0x5d0 + el1_dbg+0x18/0x78 + switched_from_dl+0x454/0x608 + __sched_setscheduler+0x8cc/0x2018 + sys_sched_setattr+0x340/0x758 + el0_svc_naked+0x30/0x34 + +syzkaller reproducer runs a bunch of threads that constantly switch +between DEADLINE and NORMAL classes while interacting through futexes. + +The splat above is caused by the fact that if a DEADLINE task is setattr +back to NORMAL while in non_contending state (blocked on a futex - +inactive timer armed), its contribution to running_bw is not removed +before sub_rq_bw() gets called (!task_on_rq_queued() branch) and the +latter sees running_bw > this_bw. + +Fix it by removing a task contribution from running_bw if the task is +not queued and in non_contending state while switched to a different +class. + +Reported-by: Mark Rutland +Signed-off-by: Juri Lelli +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Daniel Bristot de Oliveira +Reviewed-by: Luca Abeni +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: claudio@evidence.eu.com +Cc: rostedt@goodmis.org +Link: http://lkml.kernel.org/r/20180711072948.27061-1-juri.lelli@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/deadline.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -2296,8 +2296,17 @@ static void switched_from_dl(struct rq * + if (task_on_rq_queued(p) && p->dl.dl_runtime) + task_non_contending(p); + +- if (!task_on_rq_queued(p)) ++ if (!task_on_rq_queued(p)) { ++ /* ++ * Inactive timer is armed. However, p is leaving DEADLINE and ++ * might migrate away from this rq while continuing to run on ++ * some other class. We need to remove its contribution from ++ * this rq running_bw now, or sub_rq_bw (below) will complain. ++ */ ++ if (p->dl.dl_non_contending) ++ sub_running_bw(&p->dl, &rq->dl); + sub_rq_bw(&p->dl, &rq->dl); ++ } + + /* + * We cannot use inactive_task_timer() to invoke sub_running_bw() diff --git a/queue-4.17/sched-fair-fix-bandwidth-timer-clock-drift-condition.patch b/queue-4.17/sched-fair-fix-bandwidth-timer-clock-drift-condition.patch new file mode 100644 index 00000000000..d7c5541ab51 --- /dev/null +++ b/queue-4.17/sched-fair-fix-bandwidth-timer-clock-drift-condition.patch @@ -0,0 +1,133 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Xunlei Pang +Date: Wed, 20 Jun 2018 18:18:33 +0800 +Subject: sched/fair: Fix bandwidth timer clock drift condition + +From: Xunlei Pang + +[ Upstream commit 512ac999d2755d2b7109e996a76b6fb8b888631d ] + +I noticed that cgroup task groups constantly get throttled even +if they have low CPU usage, this causes some jitters on the response +time to some of our business containers when enabling CPU quotas. + +It's very simple to reproduce: + + mkdir /sys/fs/cgroup/cpu/test + cd /sys/fs/cgroup/cpu/test + echo 100000 > cpu.cfs_quota_us + echo $$ > tasks + +then repeat: + + cat cpu.stat | grep nr_throttled # nr_throttled will increase steadily + +After some analysis, we found that cfs_rq::runtime_remaining will +be cleared by expire_cfs_rq_runtime() due to two equal but stale +"cfs_{b|q}->runtime_expires" after period timer is re-armed. + +The current condition to judge clock drift in expire_cfs_rq_runtime() +is wrong, the two runtime_expires are actually the same when clock +drift happens, so this condtion can never hit. The orginal design was +correctly done by this commit: + + a9cf55b28610 ("sched: Expire invalid runtime") + +... but was changed to be the current implementation due to its locking bug. + +This patch introduces another way, it adds a new field in both structures +cfs_rq and cfs_bandwidth to record the expiration update sequence, and +uses them to figure out if clock drift happens (true if they are equal). + +Signed-off-by: Xunlei Pang +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Ben Segall +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: 51f2176d74ac ("sched/fair: Fix unlocked reads of some cfs_b->quota/period") +Link: http://lkml.kernel.org/r/20180620101834.24455-1-xlpang@linux.alibaba.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/fair.c | 14 ++++++++------ + kernel/sched/sched.h | 6 ++++-- + 2 files changed, 12 insertions(+), 8 deletions(-) + +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4549,6 +4549,7 @@ void __refill_cfs_bandwidth_runtime(stru + now = sched_clock_cpu(smp_processor_id()); + cfs_b->runtime = cfs_b->quota; + cfs_b->runtime_expires = now + ktime_to_ns(cfs_b->period); ++ cfs_b->expires_seq++; + } + + static inline struct cfs_bandwidth *tg_cfs_bandwidth(struct task_group *tg) +@@ -4571,6 +4572,7 @@ static int assign_cfs_rq_runtime(struct + struct task_group *tg = cfs_rq->tg; + struct cfs_bandwidth *cfs_b = tg_cfs_bandwidth(tg); + u64 amount = 0, min_amount, expires; ++ int expires_seq; + + /* note: this is a positive sum as runtime_remaining <= 0 */ + min_amount = sched_cfs_bandwidth_slice() - cfs_rq->runtime_remaining; +@@ -4587,6 +4589,7 @@ static int assign_cfs_rq_runtime(struct + cfs_b->idle = 0; + } + } ++ expires_seq = cfs_b->expires_seq; + expires = cfs_b->runtime_expires; + raw_spin_unlock(&cfs_b->lock); + +@@ -4596,8 +4599,10 @@ static int assign_cfs_rq_runtime(struct + * spread between our sched_clock and the one on which runtime was + * issued. + */ +- if ((s64)(expires - cfs_rq->runtime_expires) > 0) ++ if (cfs_rq->expires_seq != expires_seq) { ++ cfs_rq->expires_seq = expires_seq; + cfs_rq->runtime_expires = expires; ++ } + + return cfs_rq->runtime_remaining > 0; + } +@@ -4623,12 +4628,9 @@ static void expire_cfs_rq_runtime(struct + * has not truly expired. + * + * Fortunately we can check determine whether this the case by checking +- * whether the global deadline has advanced. It is valid to compare +- * cfs_b->runtime_expires without any locks since we only care about +- * exact equality, so a partial write will still work. ++ * whether the global deadline(cfs_b->expires_seq) has advanced. + */ +- +- if (cfs_rq->runtime_expires != cfs_b->runtime_expires) { ++ if (cfs_rq->expires_seq == cfs_b->expires_seq) { + /* extend local deadline, drift is bounded above by 2 ticks */ + cfs_rq->runtime_expires += TICK_NSEC; + } else { +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -334,9 +334,10 @@ struct cfs_bandwidth { + u64 runtime; + s64 hierarchical_quota; + u64 runtime_expires; ++ int expires_seq; + +- int idle; +- int period_active; ++ short idle; ++ short period_active; + struct hrtimer period_timer; + struct hrtimer slack_timer; + struct list_head throttled_cfs_rq; +@@ -551,6 +552,7 @@ struct cfs_rq { + + #ifdef CONFIG_CFS_BANDWIDTH + int runtime_enabled; ++ int expires_seq; + u64 runtime_expires; + s64 runtime_remaining; + diff --git a/queue-4.17/sched-nohz-skip-remote-tick-on-idle-task-entirely.patch b/queue-4.17/sched-nohz-skip-remote-tick-on-idle-task-entirely.patch new file mode 100644 index 00000000000..de980506af8 --- /dev/null +++ b/queue-4.17/sched-nohz-skip-remote-tick-on-idle-task-entirely.patch @@ -0,0 +1,120 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Frederic Weisbecker +Date: Thu, 28 Jun 2018 18:29:41 +0200 +Subject: sched/nohz: Skip remote tick on idle task entirely + +From: Frederic Weisbecker + +[ Upstream commit d9c0ffcabd6aae7ff1e34e8078354c13bb9f1183 ] + +Some people have reported that the warning in sched_tick_remote() +occasionally triggers, especially in favour of some RCU-Torture +pressure: + + WARNING: CPU: 11 PID: 906 at kernel/sched/core.c:3138 sched_tick_remote+0xb6/0xc0 + Modules linked in: + CPU: 11 PID: 906 Comm: kworker/u32:3 Not tainted 4.18.0-rc2+ #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 + Workqueue: events_unbound sched_tick_remote + RIP: 0010:sched_tick_remote+0xb6/0xc0 + Code: e8 0f 06 b8 00 c6 03 00 fb eb 9d 8b 43 04 85 c0 75 8d 48 8b 83 e0 0a 00 00 48 85 c0 75 81 eb 88 48 89 df e8 bc fe ff ff eb aa <0f> 0b eb + +c5 66 0f 1f 44 00 00 bf 17 00 00 00 e8 b6 2e fe ff 0f b6 + Call Trace: + process_one_work+0x1df/0x3b0 + worker_thread+0x44/0x3d0 + kthread+0xf3/0x130 + ? set_worker_desc+0xb0/0xb0 + ? kthread_create_worker_on_cpu+0x70/0x70 + ret_from_fork+0x35/0x40 + +This happens when the remote tick applies on an idle task. Usually the +idle_cpu() check avoids that, but it is performed before we lock the +runqueue and it is therefore racy. It was intended to be that way in +order to prevent from useless runqueue locks since idle task tick +callback is a no-op. + +Now if the racy check slips out of our hands and we end up remotely +ticking an idle task, the empty task_tick_idle() is harmless. Still +it won't pass the WARN_ON_ONCE() test that ensures rq_clock_task() is +not too far from curr->se.exec_start because update_curr_idle() doesn't +update the exec_start value like other scheduler policies. Hence the +reported false positive. + +So let's have another check, while the rq is locked, to make sure we +don't remote tick on an idle task. The lockless idle_cpu() still applies +to avoid unecessary rq lock contention. + +Reported-by: Jacek Tomaka +Reported-by: Paul E. McKenney +Reported-by: Anna-Maria Gleixner +Signed-off-by: Frederic Weisbecker +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/1530203381-31234-1-git-send-email-frederic@kernel.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/core.c | 40 +++++++++++++++++++++++----------------- + 1 file changed, 23 insertions(+), 17 deletions(-) + +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -3127,7 +3127,9 @@ static void sched_tick_remote(struct wor + struct tick_work *twork = container_of(dwork, struct tick_work, work); + int cpu = twork->cpu; + struct rq *rq = cpu_rq(cpu); ++ struct task_struct *curr; + struct rq_flags rf; ++ u64 delta; + + /* + * Handle the tick only if it appears the remote CPU is running in full +@@ -3136,24 +3138,28 @@ static void sched_tick_remote(struct wor + * statistics and checks timeslices in a time-independent way, regardless + * of when exactly it is running. + */ +- if (!idle_cpu(cpu) && tick_nohz_tick_stopped_cpu(cpu)) { +- struct task_struct *curr; +- u64 delta; +- +- rq_lock_irq(rq, &rf); +- update_rq_clock(rq); +- curr = rq->curr; +- delta = rq_clock_task(rq) - curr->se.exec_start; +- +- /* +- * Make sure the next tick runs within a reasonable +- * amount of time. +- */ +- WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3); +- curr->sched_class->task_tick(rq, curr, 0); +- rq_unlock_irq(rq, &rf); +- } ++ if (idle_cpu(cpu) || !tick_nohz_tick_stopped_cpu(cpu)) ++ goto out_requeue; + ++ rq_lock_irq(rq, &rf); ++ curr = rq->curr; ++ if (is_idle_task(curr)) ++ goto out_unlock; ++ ++ update_rq_clock(rq); ++ delta = rq_clock_task(rq) - curr->se.exec_start; ++ ++ /* ++ * Make sure the next tick runs within a reasonable ++ * amount of time. ++ */ ++ WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3); ++ curr->sched_class->task_tick(rq, curr, 0); ++ ++out_unlock: ++ rq_unlock_irq(rq, &rf); ++ ++out_requeue: + /* + * Run the remote tick once per second (1Hz). This arbitrary + * frequency is large enough to avoid overload but short enough diff --git a/queue-4.17/sched-util_est-fix-util_est_dequeue-for-throttled-cfs_rq.patch b/queue-4.17/sched-util_est-fix-util_est_dequeue-for-throttled-cfs_rq.patch new file mode 100644 index 00000000000..7026c2b15ea --- /dev/null +++ b/queue-4.17/sched-util_est-fix-util_est_dequeue-for-throttled-cfs_rq.patch @@ -0,0 +1,69 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Vincent Guittot +Date: Thu, 14 Jun 2018 12:33:00 +0200 +Subject: sched/util_est: Fix util_est_dequeue() for throttled cfs_rq + +From: Vincent Guittot + +[ Upstream commit 3482d98bbc730758b63a5d1cf41d05ea17481412 ] + +When a cfs_rq is throttled, parent cfs_rq->nr_running is decreased and +everything happens at cfs_rq level. Currently util_est stays unchanged +in such case and it keeps accounting the utilization of throttled tasks. +This can somewhat make sense as we don't dequeue tasks but only throttled +cfs_rq. + +If a task of another group is enqueued/dequeued and root cfs_rq becomes +idle during the dequeue, util_est will be cleared whereas it was +accounting util_est of throttled tasks before. So the behavior of util_est +is not always the same regarding throttled tasks and depends of side +activity. Furthermore, util_est will not be updated when the cfs_rq is +unthrottled as everything happens at cfs_rq level. Main results is that +util_est will stay null whereas we now have running tasks. We have to wait +for the next dequeue/enqueue of the previously throttled tasks to get an +up to date util_est. + +Remove the assumption that cfs_rq's estimated utilization of a CPU is 0 +if there is no running task so the util_est of a task remains until the +latter is dequeued even if its cfs_rq has been throttled. + +Signed-off-by: Vincent Guittot +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Patrick Bellasi +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: 7f65ea42eb00 ("sched/fair: Add util_est on top of PELT") +Link: http://lkml.kernel.org/r/1528972380-16268-1-git-send-email-vincent.guittot@linaro.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/fair.c | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3941,18 +3941,10 @@ util_est_dequeue(struct cfs_rq *cfs_rq, + if (!sched_feat(UTIL_EST)) + return; + +- /* +- * Update root cfs_rq's estimated utilization +- * +- * If *p is the last task then the root cfs_rq's estimated utilization +- * of a CPU is 0 by definition. +- */ +- ue.enqueued = 0; +- if (cfs_rq->nr_running) { +- ue.enqueued = cfs_rq->avg.util_est.enqueued; +- ue.enqueued -= min_t(unsigned int, ue.enqueued, +- (_task_util_est(p) | UTIL_AVG_UNCHANGED)); +- } ++ /* Update root cfs_rq's estimated utilization */ ++ ue.enqueued = cfs_rq->avg.util_est.enqueued; ++ ue.enqueued -= min_t(unsigned int, ue.enqueued, ++ (_task_util_est(p) | UTIL_AVG_UNCHANGED)); + WRITE_ONCE(cfs_rq->avg.util_est.enqueued, ue.enqueued); + + /* diff --git a/queue-4.17/scsi-hpsa-correct-enclosure-sas-address.patch b/queue-4.17/scsi-hpsa-correct-enclosure-sas-address.patch new file mode 100644 index 00000000000..faba4e80f50 --- /dev/null +++ b/queue-4.17/scsi-hpsa-correct-enclosure-sas-address.patch @@ -0,0 +1,77 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Don Brace +Date: Tue, 3 Jul 2018 17:34:48 -0500 +Subject: scsi: hpsa: correct enclosure sas address + +From: Don Brace + +[ Upstream commit 01d0e789a14aa735ddcfddd468ef06d4f917e06d ] + +The original complaint was the lsscsi -t showed the same SAS address of the +two enclosures (SEP devices). In fact the SAS address was being set to the +Enclosure Logical Identifier (ELI). + +Reviewed-by: Scott Teel +Reviewed-by: Kevin Barnett +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/hpsa.c | 25 +++++++++++++++++++++---- + drivers/scsi/hpsa.h | 1 + + 2 files changed, 22 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -3438,11 +3438,11 @@ static void hpsa_get_enclosure_info(stru + struct ext_report_lun_entry *rle = &rlep->LUN[rle_index]; + u16 bmic_device_index = 0; + +- bmic_device_index = GET_BMIC_DRIVE_NUMBER(&rle->lunid[0]); +- +- encl_dev->sas_address = ++ encl_dev->eli = + hpsa_get_enclosure_logical_identifier(h, scsi3addr); + ++ bmic_device_index = GET_BMIC_DRIVE_NUMBER(&rle->lunid[0]); ++ + if (encl_dev->target == -1 || encl_dev->lun == -1) { + rc = IO_OK; + goto out; +@@ -9695,7 +9695,24 @@ hpsa_sas_get_linkerrors(struct sas_phy * + static int + hpsa_sas_get_enclosure_identifier(struct sas_rphy *rphy, u64 *identifier) + { +- *identifier = rphy->identify.sas_address; ++ struct Scsi_Host *shost = phy_to_shost(rphy); ++ struct ctlr_info *h; ++ struct hpsa_scsi_dev_t *sd; ++ ++ if (!shost) ++ return -ENXIO; ++ ++ h = shost_to_hba(shost); ++ ++ if (!h) ++ return -ENXIO; ++ ++ sd = hpsa_find_device_by_sas_rphy(h, rphy); ++ if (!sd) ++ return -ENXIO; ++ ++ *identifier = sd->eli; ++ + return 0; + } + +--- a/drivers/scsi/hpsa.h ++++ b/drivers/scsi/hpsa.h +@@ -68,6 +68,7 @@ struct hpsa_scsi_dev_t { + #define RAID_CTLR_LUNID "\0\0\0\0\0\0\0\0" + unsigned char device_id[16]; /* from inquiry pg. 0x83 */ + u64 sas_address; ++ u64 eli; /* from report diags. */ + unsigned char vendor[8]; /* bytes 8-15 of inquiry data */ + unsigned char model[16]; /* bytes 16-31 of inquiry data */ + unsigned char rev; /* byte 2 of inquiry data */ diff --git a/queue-4.17/scsi-qedf-send-the-driver-state-to-mfw.patch b/queue-4.17/scsi-qedf-send-the-driver-state-to-mfw.patch new file mode 100644 index 00000000000..22cb1a0ae6a --- /dev/null +++ b/queue-4.17/scsi-qedf-send-the-driver-state-to-mfw.patch @@ -0,0 +1,55 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Saurav Kashyap +Date: Thu, 5 Jul 2018 07:01:33 -0700 +Subject: scsi: qedf: Send the driver state to MFW + +From: Saurav Kashyap + +[ Upstream commit 6ac174756dfc9884f08b23af840ca911155f5578 ] + +Need to notify firmware when driver is loaded and unloaded. + +Signed-off-by: Saurav Kashyap +Signed-off-by: Chad Dupuis +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qedf/qedf_main.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -3241,6 +3241,11 @@ static int __qedf_probe(struct pci_dev * + + init_completion(&qedf->flogi_compl); + ++ status = qed_ops->common->update_drv_state(qedf->cdev, true); ++ if (status) ++ QEDF_ERR(&(qedf->dbg_ctx), ++ "Failed to send drv state to MFW.\n"); ++ + memset(&link_params, 0, sizeof(struct qed_link_params)); + link_params.link_up = true; + status = qed_ops->common->set_link(qedf->cdev, &link_params); +@@ -3289,6 +3294,7 @@ static int qedf_probe(struct pci_dev *pd + static void __qedf_remove(struct pci_dev *pdev, int mode) + { + struct qedf_ctx *qedf; ++ int rc; + + if (!pdev) { + QEDF_ERR(NULL, "pdev is NULL.\n"); +@@ -3383,6 +3389,12 @@ static void __qedf_remove(struct pci_dev + qed_ops->common->set_power_state(qedf->cdev, PCI_D0); + pci_set_drvdata(pdev, NULL); + } ++ ++ rc = qed_ops->common->update_drv_state(qedf->cdev, false); ++ if (rc) ++ QEDF_ERR(&(qedf->dbg_ctx), ++ "Failed to send drv state to MFW.\n"); ++ + qed_ops->common->slowpath_stop(qedf->cdev); + qed_ops->common->remove(qedf->cdev); + diff --git a/queue-4.17/scsi-qedi-send-driver-state-to-mfw.patch b/queue-4.17/scsi-qedi-send-driver-state-to-mfw.patch new file mode 100644 index 00000000000..f8dacfcf054 --- /dev/null +++ b/queue-4.17/scsi-qedi-send-driver-state-to-mfw.patch @@ -0,0 +1,54 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Manish Rangankar +Date: Mon, 2 Jul 2018 23:52:31 -0700 +Subject: scsi: qedi: Send driver state to MFW + +From: Manish Rangankar + +[ Upstream commit a3440d0d2f57f7ba102fc332086961cf261180af ] + +In case of iSCSI offload BFS environment, MFW requires to mark virtual +link based upon qedi load status. + +Signed-off-by: Manish Rangankar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qedi/qedi_main.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -2075,6 +2075,7 @@ kset_free: + static void __qedi_remove(struct pci_dev *pdev, int mode) + { + struct qedi_ctx *qedi = pci_get_drvdata(pdev); ++ int rval; + + if (qedi->tmf_thread) { + flush_workqueue(qedi->tmf_thread); +@@ -2104,6 +2105,10 @@ static void __qedi_remove(struct pci_dev + if (mode == QEDI_MODE_NORMAL) + qedi_free_iscsi_pf_param(qedi); + ++ rval = qedi_ops->common->update_drv_state(qedi->cdev, false); ++ if (rval) ++ QEDI_ERR(&qedi->dbg_ctx, "Failed to send drv state to MFW\n"); ++ + if (!test_bit(QEDI_IN_OFFLINE, &qedi->flags)) { + qedi_ops->common->slowpath_stop(qedi->cdev); + qedi_ops->common->remove(qedi->cdev); +@@ -2378,6 +2383,12 @@ static int __qedi_probe(struct pci_dev * + if (qedi_setup_boot_info(qedi)) + QEDI_ERR(&qedi->dbg_ctx, + "No iSCSI boot target configured\n"); ++ ++ rc = qedi_ops->common->update_drv_state(qedi->cdev, true); ++ if (rc) ++ QEDI_ERR(&qedi->dbg_ctx, ++ "Failed to send drv state to MFW\n"); ++ + } + + return 0; diff --git a/queue-4.17/scsi-xen-scsifront-add-error-handling-for-xenbus_printf.patch b/queue-4.17/scsi-xen-scsifront-add-error-handling-for-xenbus_printf.patch new file mode 100644 index 00000000000..8fff942f7f5 --- /dev/null +++ b/queue-4.17/scsi-xen-scsifront-add-error-handling-for-xenbus_printf.patch @@ -0,0 +1,94 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Zhouyang Jia +Date: Sat, 16 Jun 2018 01:05:01 +0800 +Subject: scsi: xen-scsifront: add error handling for xenbus_printf + +From: Zhouyang Jia + +[ Upstream commit 93efbd39870474cc536b9caf4a6efeb03b0bc56f ] + +When xenbus_printf fails, the lack of error-handling code may +cause unexpected results. + +This patch adds error-handling code after calling xenbus_printf. + +Signed-off-by: Zhouyang Jia +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/xen-scsifront.c | 33 ++++++++++++++++++++++++++------- + 1 file changed, 26 insertions(+), 7 deletions(-) + +--- a/drivers/scsi/xen-scsifront.c ++++ b/drivers/scsi/xen-scsifront.c +@@ -654,10 +654,17 @@ static int scsifront_dev_reset_handler(s + static int scsifront_sdev_configure(struct scsi_device *sdev) + { + struct vscsifrnt_info *info = shost_priv(sdev->host); ++ int err; + +- if (info && current == info->curr) +- xenbus_printf(XBT_NIL, info->dev->nodename, ++ if (info && current == info->curr) { ++ err = xenbus_printf(XBT_NIL, info->dev->nodename, + info->dev_state_path, "%d", XenbusStateConnected); ++ if (err) { ++ xenbus_dev_error(info->dev, err, ++ "%s: writing dev_state_path", __func__); ++ return err; ++ } ++ } + + return 0; + } +@@ -665,10 +672,15 @@ static int scsifront_sdev_configure(stru + static void scsifront_sdev_destroy(struct scsi_device *sdev) + { + struct vscsifrnt_info *info = shost_priv(sdev->host); ++ int err; + +- if (info && current == info->curr) +- xenbus_printf(XBT_NIL, info->dev->nodename, ++ if (info && current == info->curr) { ++ err = xenbus_printf(XBT_NIL, info->dev->nodename, + info->dev_state_path, "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(info->dev, err, ++ "%s: writing dev_state_path", __func__); ++ } + } + + static struct scsi_host_template scsifront_sht = { +@@ -1003,9 +1015,12 @@ static void scsifront_do_lun_hotplug(str + + if (scsi_add_device(info->host, chn, tgt, lun)) { + dev_err(&dev->dev, "scsi_add_device\n"); +- xenbus_printf(XBT_NIL, dev->nodename, ++ err = xenbus_printf(XBT_NIL, dev->nodename, + info->dev_state_path, + "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(dev, err, ++ "%s: writing dev_state_path", __func__); + } + break; + case VSCSIFRONT_OP_DEL_LUN: +@@ -1019,10 +1034,14 @@ static void scsifront_do_lun_hotplug(str + } + break; + case VSCSIFRONT_OP_READD_LUN: +- if (device_state == XenbusStateConnected) +- xenbus_printf(XBT_NIL, dev->nodename, ++ if (device_state == XenbusStateConnected) { ++ err = xenbus_printf(XBT_NIL, dev->nodename, + info->dev_state_path, + "%d", XenbusStateConnected); ++ if (err) ++ xenbus_dev_error(dev, err, ++ "%s: writing dev_state_path", __func__); ++ } + break; + default: + break; diff --git a/queue-4.17/sctp-fix-erroneous-inc-of-snmp-sctpfragusrmsgs.patch b/queue-4.17/sctp-fix-erroneous-inc-of-snmp-sctpfragusrmsgs.patch new file mode 100644 index 00000000000..d3fb91c3963 --- /dev/null +++ b/queue-4.17/sctp-fix-erroneous-inc-of-snmp-sctpfragusrmsgs.patch @@ -0,0 +1,38 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Marcelo Ricardo Leitner +Date: Wed, 20 Jun 2018 12:47:52 -0300 +Subject: sctp: fix erroneous inc of snmp SctpFragUsrMsgs + +From: Marcelo Ricardo Leitner + +[ Upstream commit fedb1bd3d274b33c432cb83c80c6b3cf54d509c8 ] + +Currently it is incrementing SctpFragUsrMsgs when the user message size +is of the exactly same size as the maximum fragment size, which is wrong. + +The fix is to increment it only when user message is bigger than the +maximum fragment size. + +Fixes: bfd2e4b8734d ("sctp: refactor sctp_datamsg_from_user") +Signed-off-by: Marcelo Ricardo Leitner +Acked-by: Neil Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/chunk.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/sctp/chunk.c ++++ b/net/sctp/chunk.c +@@ -247,7 +247,9 @@ struct sctp_datamsg *sctp_datamsg_from_u + /* Account for a different sized first fragment */ + if (msg_len >= first_len) { + msg->can_delay = 0; +- SCTP_INC_STATS(sock_net(asoc->base.sk), SCTP_MIB_FRAGUSRMSGS); ++ if (msg_len > first_len) ++ SCTP_INC_STATS(sock_net(asoc->base.sk), ++ SCTP_MIB_FRAGUSRMSGS); + } else { + /* Which may be the only one... */ + first_len = msg_len; diff --git a/queue-4.17/selftests-bpf-notification-about-privilege-required-to-run-test_kmod.sh-testing-script.patch b/queue-4.17/selftests-bpf-notification-about-privilege-required-to-run-test_kmod.sh-testing-script.patch new file mode 100644 index 00000000000..96851a7107a --- /dev/null +++ b/queue-4.17/selftests-bpf-notification-about-privilege-required-to-run-test_kmod.sh-testing-script.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jeffrin Jose T +Date: Thu, 21 Jun 2018 22:30:20 +0530 +Subject: selftests: bpf: notification about privilege required to run test_kmod.sh testing script + +From: Jeffrin Jose T + +[ Upstream commit 81e167c2a216e7b54e6add9d2badcda267fe33b1 ] + +The test_kmod.sh script require root privilege for the successful +execution of the test. + +This patch is to notify the user about the privilege the script +demands for the successful execution of the test. + +Signed-off-by: Jeffrin Jose T (Rajagiri SET) +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/bpf/test_kmod.sh | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/tools/testing/selftests/bpf/test_kmod.sh ++++ b/tools/testing/selftests/bpf/test_kmod.sh +@@ -1,6 +1,15 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ ++msg="skip all tests:" ++if [ "$(id -u)" != "0" ]; then ++ echo $msg please run this as root >&2 ++ exit $ksft_skip ++fi ++ + SRC_TREE=../../../../ + + test_run() diff --git a/queue-4.17/selftests-bpf-test-offloads-even-with-bpf-programs-present.patch b/queue-4.17/selftests-bpf-test-offloads-even-with-bpf-programs-present.patch new file mode 100644 index 00000000000..a23ea44b32b --- /dev/null +++ b/queue-4.17/selftests-bpf-test-offloads-even-with-bpf-programs-present.patch @@ -0,0 +1,65 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Jakub Kicinski +Date: Thu, 14 Jun 2018 11:06:56 -0700 +Subject: selftests/bpf: test offloads even with BPF programs present + +From: Jakub Kicinski + +[ Upstream commit 47cf52a246e526e2092d60ac01c54af9bd45dcc9 ] + +Modern distroes increasingly make use of BPF programs. Default +Ubuntu 18.04 installation boots with a number of cgroup_skb +programs loaded. + +test_offloads.py tries to check if programs and maps are not +leaked on error paths by confirming the list of programs on the +system is empty between tests. + +Since we can no longer expect the system to have no BPF objects +at boot try to remember the programs and maps present at the start, +and skip those when scanning the system. + +Signed-off-by: Jakub Kicinski +Reviewed-by: Quentin Monnet +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/bpf/test_offload.py | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/bpf/test_offload.py ++++ b/tools/testing/selftests/bpf/test_offload.py +@@ -163,6 +163,10 @@ def bpftool(args, JSON=True, ns="", fail + + def bpftool_prog_list(expected=None, ns=""): + _, progs = bpftool("prog show", JSON=True, ns=ns, fail=True) ++ # Remove the base progs ++ for p in base_progs: ++ if p in progs: ++ progs.remove(p) + if expected is not None: + if len(progs) != expected: + fail(True, "%d BPF programs loaded, expected %d" % +@@ -171,6 +175,10 @@ def bpftool_prog_list(expected=None, ns= + + def bpftool_map_list(expected=None, ns=""): + _, maps = bpftool("map show", JSON=True, ns=ns, fail=True) ++ # Remove the base maps ++ for m in base_maps: ++ if m in maps: ++ maps.remove(m) + if expected is not None: + if len(maps) != expected: + fail(True, "%d BPF maps loaded, expected %d" % +@@ -585,8 +593,8 @@ skip(os.getuid() != 0, "test must be run + # Check tools + ret, progs = bpftool("prog", fail=False) + skip(ret != 0, "bpftool not installed") +-# Check no BPF programs are loaded +-skip(len(progs) != 0, "BPF programs already loaded on the system") ++base_progs = progs ++_, base_maps = bpftool("map") + + # Check netdevsim + ret, out = cmd("modprobe netdevsim", fail=False) diff --git a/queue-4.17/selftests-net-add-config-fragments.patch b/queue-4.17/selftests-net-add-config-fragments.patch new file mode 100644 index 00000000000..ce278705cb9 --- /dev/null +++ b/queue-4.17/selftests-net-add-config-fragments.patch @@ -0,0 +1,28 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Anders Roxell +Date: Tue, 19 Jun 2018 18:41:11 +0200 +Subject: selftests: net: add config fragments + +From: Anders Roxell + +[ Upstream commit 73f9c33beb9e85850a11a1597b35a13650352509 ] + +Add fragments to pass bridge and vlan tests. + +Fixes: 33b01b7b4f19 ("selftests: add rtnetlink test script") +Signed-off-by: Anders Roxell +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/config | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/tools/testing/selftests/net/config ++++ b/tools/testing/selftests/net/config +@@ -12,3 +12,5 @@ CONFIG_NET_IPVTI=y + CONFIG_INET6_XFRM_MODE_TUNNEL=y + CONFIG_IPV6_VTI=y + CONFIG_DUMMY=y ++CONFIG_BRIDGE=y ++CONFIG_VLAN_8021Q=y diff --git a/queue-4.17/selftests-pstore-return-kselftest-skip-code-for-skipped-tests.patch b/queue-4.17/selftests-pstore-return-kselftest-skip-code-for-skipped-tests.patch new file mode 100644 index 00000000000..be2ad942d34 --- /dev/null +++ b/queue-4.17/selftests-pstore-return-kselftest-skip-code-for-skipped-tests.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Tue, 12 Jun 2018 16:46:03 -0600 +Subject: selftests: pstore: return Kselftest Skip code for skipped tests + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit 856e7c4b619af622d56b3b454f7bec32a170ac99 ] + +When pstore_post_reboot test gets skipped because of unmet dependencies +and/or unsupported configuration, it returns 0 which is treated as a pass +by the Kselftest framework. This leads to false positive result even when +the test could not be run. + +Change it to return kselftest skip code when a test gets skipped to clearly +report that the test could not be run. + +Kselftest framework SKIP code is 4 and the framework prints appropriate +messages to indicate that the test is skipped. + +Signed-off-by: Shuah Khan (Samsung OSG) +Reviewed-by: Kees Cook +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/pstore/pstore_post_reboot_tests | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/tools/testing/selftests/pstore/pstore_post_reboot_tests ++++ b/tools/testing/selftests/pstore/pstore_post_reboot_tests +@@ -7,13 +7,16 @@ + # + # Released under the terms of the GPL v2. + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + . ./common_tests + + if [ -e $REBOOT_FLAG ]; then + rm $REBOOT_FLAG + else + prlog "pstore_crash_test has not been executed yet. we skip further tests." +- exit 0 ++ exit $ksft_skip + fi + + prlog -n "Mounting pstore filesystem ... " diff --git a/queue-4.17/selftests-static_keys-return-kselftest-skip-code-for-skipped-tests.patch b/queue-4.17/selftests-static_keys-return-kselftest-skip-code-for-skipped-tests.patch new file mode 100644 index 00000000000..afa28c69804 --- /dev/null +++ b/queue-4.17/selftests-static_keys-return-kselftest-skip-code-for-skipped-tests.patch @@ -0,0 +1,53 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Tue, 12 Jun 2018 17:40:31 -0600 +Subject: selftests: static_keys: return Kselftest Skip code for skipped tests + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit 8781578087b8fb8829558bac96c3c24e5ba26f82 ] + +When static_keys test is skipped because of unmet dependencies and/or +unsupported configuration, it exits with error which is treated as a fail +by the Kselftest framework. This leads to false negative result even when +the test could not be run. + +Change it to return kselftest skip code when a test gets skipped to clearly +report that the test could not be run. + +Added an explicit searches for test_static_key_base and test_static_keys +modules and return skip code if they aren't found to differentiate between +the failure to load the module condition and module not found condition. + +Kselftest framework SKIP code is 4 and the framework prints appropriate +messages to indicate that the test is skipped. + +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/static_keys/test_static_keys.sh | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/tools/testing/selftests/static_keys/test_static_keys.sh ++++ b/tools/testing/selftests/static_keys/test_static_keys.sh +@@ -2,6 +2,19 @@ + # SPDX-License-Identifier: GPL-2.0 + # Runs static keys kernel module tests + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ ++if ! /sbin/modprobe -q -n test_static_key_base; then ++ echo "static_key: module test_static_key_base is not found [SKIP]" ++ exit $ksft_skip ++fi ++ ++if ! /sbin/modprobe -q -n test_static_keys; then ++ echo "static_key: module test_static_keys is not found [SKIP]" ++ exit $ksft_skip ++fi ++ + if /sbin/modprobe -q test_static_key_base; then + if /sbin/modprobe -q test_static_keys; then + echo "static_key: ok" diff --git a/queue-4.17/selftests-sync-add-config-fragment-for-testing-sync-framework.patch b/queue-4.17/selftests-sync-add-config-fragment-for-testing-sync-framework.patch new file mode 100644 index 00000000000..8f32dfb526e --- /dev/null +++ b/queue-4.17/selftests-sync-add-config-fragment-for-testing-sync-framework.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Fathi Boudra +Date: Thu, 14 Jun 2018 11:57:08 +0200 +Subject: selftests: sync: add config fragment for testing sync framework + +From: Fathi Boudra + +[ Upstream commit d6a3e55131fcb1e5ca1753f4b6f297a177b2fc91 ] + +Unless the software synchronization objects (CONFIG_SW_SYNC) is enabled, +the sync test will be skipped: + +TAP version 13 +1..0 # Skipped: Sync framework not supported by kernel + +Add a config fragment file to be able to run "make kselftest-merge" to +enable relevant configuration required in order to run the sync test. + +Signed-off-by: Fathi Boudra +Link: https://lkml.org/lkml/2017/5/5/14 +Signed-off-by: Anders Roxell +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/sync/config | 4 ++++ + 1 file changed, 4 insertions(+) + create mode 100644 tools/testing/selftests/sync/config + +--- /dev/null ++++ b/tools/testing/selftests/sync/config +@@ -0,0 +1,4 @@ ++CONFIG_STAGING=y ++CONFIG_ANDROID=y ++CONFIG_SYNC=y ++CONFIG_SW_SYNC=y diff --git a/queue-4.17/selftests-sysctl-return-kselftest-skip-code-for-skipped-tests.patch b/queue-4.17/selftests-sysctl-return-kselftest-skip-code-for-skipped-tests.patch new file mode 100644 index 00000000000..c4a546adb43 --- /dev/null +++ b/queue-4.17/selftests-sysctl-return-kselftest-skip-code-for-skipped-tests.patch @@ -0,0 +1,98 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Tue, 12 Jun 2018 18:11:37 -0600 +Subject: selftests: sysctl: return Kselftest Skip code for skipped tests + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit c7db6ffb831fd36a03485a0d88b1e505378975ad ] + +When sysctl test is skipped because of unmet dependencies and/or +unsupported configuration, it exits with error which is treated as +a fail by the Kselftest framework. This leads to false negative result +even when the test could not be run. + +Change it to return kselftest skip code when a test gets skipped to +clearly report that the test could not be run. + +Changed return code to kselftest skip code in skip error legs that check +requirements and module probe test error leg. + +Kselftest framework SKIP code is 4 and the framework prints appropriate +messages to indicate that the test is skipped. + +Signed-off-by: Shuah Khan (Samsung OSG) +Reviewed-by: Kees Cook +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/sysctl/sysctl.sh | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/tools/testing/selftests/sysctl/sysctl.sh ++++ b/tools/testing/selftests/sysctl/sysctl.sh +@@ -14,6 +14,9 @@ + + # This performs a series tests against the proc sysctl interface. + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + TEST_NAME="sysctl" + TEST_DRIVER="test_${TEST_NAME}" + TEST_DIR=$(dirname $0) +@@ -41,7 +44,7 @@ test_modprobe() + echo "$0: $DIR not present" >&2 + echo "You must have the following enabled in your kernel:" >&2 + cat $TEST_DIR/config >&2 +- exit 1 ++ exit $ksft_skip + fi + } + +@@ -98,28 +101,30 @@ test_reqs() + uid=$(id -u) + if [ $uid -ne 0 ]; then + echo $msg must be run as root >&2 +- exit 0 ++ exit $ksft_skip + fi + + if ! which perl 2> /dev/null > /dev/null; then + echo "$0: You need perl installed" +- exit 1 ++ exit $ksft_skip + fi + if ! which getconf 2> /dev/null > /dev/null; then + echo "$0: You need getconf installed" +- exit 1 ++ exit $ksft_skip + fi + if ! which diff 2> /dev/null > /dev/null; then + echo "$0: You need diff installed" +- exit 1 ++ exit $ksft_skip + fi + } + + function load_req_mod() + { +- trap "test_modprobe" EXIT +- + if [ ! -d $DIR ]; then ++ if ! modprobe -q -n $TEST_DRIVER; then ++ echo "$0: module $TEST_DRIVER not found [SKIP]" ++ exit $ksft_skip ++ fi + modprobe $TEST_DRIVER + if [ $? -ne 0 ]; then + exit +@@ -765,6 +770,7 @@ function parse_args() + test_reqs + allow_user_defaults + check_production_sysctl_writes_strict ++test_modprobe + load_req_mod + + trap "test_finish" EXIT diff --git a/queue-4.17/selftests-user-return-kselftest-skip-code-for-skipped-tests.patch b/queue-4.17/selftests-user-return-kselftest-skip-code-for-skipped-tests.patch new file mode 100644 index 00000000000..86520f28bb4 --- /dev/null +++ b/queue-4.17/selftests-user-return-kselftest-skip-code-for-skipped-tests.patch @@ -0,0 +1,44 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Wed, 13 Jun 2018 21:10:48 -0600 +Subject: selftests: user: return Kselftest Skip code for skipped tests + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit d7d5311d4aa9611fe1a5a851e6f75733237a668a ] + +When user test is skipped because of unmet dependencies and/or +unsupported configuration, it exits with error which is treated as +a fail by the Kselftest framework. This leads to false negative result +even when the test could not be run. + +Change it to return kselftest skip code when a test gets skipped to +clearly report that the test could not be run. Add an explicit check +for module presence and return skip code if module isn't present. + +Kselftest framework SKIP code is 4 and the framework prints appropriate +messages to indicate that the test is skipped. + +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/user/test_user_copy.sh | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/tools/testing/selftests/user/test_user_copy.sh ++++ b/tools/testing/selftests/user/test_user_copy.sh +@@ -2,6 +2,13 @@ + # SPDX-License-Identifier: GPL-2.0 + # Runs copy_to/from_user infrastructure using test_user_copy kernel module + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ ++if ! /sbin/modprobe -q -n test_user_copy; then ++ echo "user: module test_user_copy is not found [SKIP]" ++ exit $ksft_skip ++fi + if /sbin/modprobe -q test_user_copy; then + /sbin/modprobe -q -r test_user_copy + echo "user_copy: ok" diff --git a/queue-4.17/selftests-vm-return-kselftest-skip-code-for-skipped-tests.patch b/queue-4.17/selftests-vm-return-kselftest-skip-code-for-skipped-tests.patch new file mode 100644 index 00000000000..b1c3e146d12 --- /dev/null +++ b/queue-4.17/selftests-vm-return-kselftest-skip-code-for-skipped-tests.patch @@ -0,0 +1,149 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Wed, 13 Jun 2018 21:31:43 -0600 +Subject: selftests: vm: return Kselftest Skip code for skipped tests + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit a4d7537789724985cafbc9260a31ca4f2b7cf123 ] + +When vm test is skipped because of unmet dependencies and/or unsupported +configuration, it exits with error which is treated as a fail by the +Kselftest framework. This leads to false negative result even when the +test could not be run. + +Change it to return kselftest skip code when a test gets skipped to +clearly report that the test could not be run. + +Kselftest framework SKIP code is 4 and the framework prints appropriate +messages to indicate that the test is skipped. + +Signed-off-by: Shuah Khan (Samsung OSG) +Acked-by: Mike Rapoport +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/vm/compaction_test.c | 4 +++- + tools/testing/selftests/vm/mlock2-tests.c | 12 +++++++----- + tools/testing/selftests/vm/run_vmtests | 5 ++++- + tools/testing/selftests/vm/userfaultfd.c | 4 +++- + 4 files changed, 17 insertions(+), 8 deletions(-) + +--- a/tools/testing/selftests/vm/compaction_test.c ++++ b/tools/testing/selftests/vm/compaction_test.c +@@ -16,6 +16,8 @@ + #include + #include + ++#include "../kselftest.h" ++ + #define MAP_SIZE 1048576 + + struct map_list { +@@ -169,7 +171,7 @@ int main(int argc, char **argv) + printf("Either the sysctl compact_unevictable_allowed is not\n" + "set to 1 or couldn't read the proc file.\n" + "Skipping the test\n"); +- return 0; ++ return KSFT_SKIP; + } + + lim.rlim_cur = RLIM_INFINITY; +--- a/tools/testing/selftests/vm/mlock2-tests.c ++++ b/tools/testing/selftests/vm/mlock2-tests.c +@@ -9,6 +9,8 @@ + #include + #include "mlock2.h" + ++#include "../kselftest.h" ++ + struct vm_boundaries { + unsigned long start; + unsigned long end; +@@ -303,7 +305,7 @@ static int test_mlock_lock() + if (mlock2_(map, 2 * page_size, 0)) { + if (errno == ENOSYS) { + printf("Cannot call new mlock family, skipping test\n"); +- _exit(0); ++ _exit(KSFT_SKIP); + } + perror("mlock2(0)"); + goto unmap; +@@ -412,7 +414,7 @@ static int test_mlock_onfault() + if (mlock2_(map, 2 * page_size, MLOCK_ONFAULT)) { + if (errno == ENOSYS) { + printf("Cannot call new mlock family, skipping test\n"); +- _exit(0); ++ _exit(KSFT_SKIP); + } + perror("mlock2(MLOCK_ONFAULT)"); + goto unmap; +@@ -425,7 +427,7 @@ static int test_mlock_onfault() + if (munlock(map, 2 * page_size)) { + if (errno == ENOSYS) { + printf("Cannot call new mlock family, skipping test\n"); +- _exit(0); ++ _exit(KSFT_SKIP); + } + perror("munlock()"); + goto unmap; +@@ -457,7 +459,7 @@ static int test_lock_onfault_of_present( + if (mlock2_(map, 2 * page_size, MLOCK_ONFAULT)) { + if (errno == ENOSYS) { + printf("Cannot call new mlock family, skipping test\n"); +- _exit(0); ++ _exit(KSFT_SKIP); + } + perror("mlock2(MLOCK_ONFAULT)"); + goto unmap; +@@ -583,7 +585,7 @@ static int test_vma_management(bool call + if (call_mlock && mlock2_(map, 3 * page_size, MLOCK_ONFAULT)) { + if (errno == ENOSYS) { + printf("Cannot call new mlock family, skipping test\n"); +- _exit(0); ++ _exit(KSFT_SKIP); + } + perror("mlock(ONFAULT)\n"); + goto out; +--- a/tools/testing/selftests/vm/run_vmtests ++++ b/tools/testing/selftests/vm/run_vmtests +@@ -2,6 +2,9 @@ + # SPDX-License-Identifier: GPL-2.0 + #please run as root + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + mnt=./huge + exitcode=0 + +@@ -36,7 +39,7 @@ if [ -n "$freepgs" ] && [ -n "$hpgsize_K + echo $(( $lackpgs + $nr_hugepgs )) > /proc/sys/vm/nr_hugepages + if [ $? -ne 0 ]; then + echo "Please run this test as root" +- exit 1 ++ exit $ksft_skip + fi + while read name size unit; do + if [ "$name" = "HugePages_Free:" ]; then +--- a/tools/testing/selftests/vm/userfaultfd.c ++++ b/tools/testing/selftests/vm/userfaultfd.c +@@ -69,6 +69,8 @@ + #include + #include + ++#include "../kselftest.h" ++ + #ifdef __NR_userfaultfd + + static unsigned long nr_cpus, nr_pages, nr_pages_per_cpu, page_size; +@@ -1322,7 +1324,7 @@ int main(int argc, char **argv) + int main(void) + { + printf("skip: Skipping userfaultfd test (missing __NR_userfaultfd)\n"); +- return 0; ++ return KSFT_SKIP; + } + + #endif /* __NR_userfaultfd */ diff --git a/queue-4.17/selftests-x86-sigreturn-64-fix-spurious-failures-on-amd-cpus.patch b/queue-4.17/selftests-x86-sigreturn-64-fix-spurious-failures-on-amd-cpus.patch new file mode 100644 index 00000000000..90e11374f3b --- /dev/null +++ b/queue-4.17/selftests-x86-sigreturn-64-fix-spurious-failures-on-amd-cpus.patch @@ -0,0 +1,94 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Andy Lutomirski +Date: Tue, 26 Jun 2018 22:17:17 -0700 +Subject: selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs + +From: Andy Lutomirski + +[ Upstream commit ec348020566009d3da9b99f07c05814d13969c78 ] + +When I wrote the sigreturn test, I didn't realize that AMD's busted +IRET behavior was different from Intel's busted IRET behavior: + +On AMD CPUs, the CPU leaks the high 32 bits of the kernel stack pointer +to certain userspace contexts. Gee, thanks. There's very little +the kernel can do about it. Modify the test so it passes. + +Signed-off-by: Andy Lutomirski +Cc: Borislav Petkov +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/86e7fd3564497f657de30a36da4505799eebef01.1530076529.git.luto@kernel.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/x86/sigreturn.c | 46 ++++++++++++++++++++------------ + 1 file changed, 29 insertions(+), 17 deletions(-) + +--- a/tools/testing/selftests/x86/sigreturn.c ++++ b/tools/testing/selftests/x86/sigreturn.c +@@ -612,19 +612,38 @@ static int test_valid_sigreturn(int cs_b + greg_t req = requested_regs[i], res = resulting_regs[i]; + if (i == REG_TRAPNO || i == REG_IP) + continue; /* don't care */ +- if (i == REG_SP) { +- printf("\tSP: %llx -> %llx\n", (unsigned long long)req, +- (unsigned long long)res); + ++ if (i == REG_SP) { + /* +- * In many circumstances, the high 32 bits of rsp +- * are zeroed. For example, we could be a real +- * 32-bit program, or we could hit any of a number +- * of poorly-documented IRET or segmented ESP +- * oddities. If this happens, it's okay. ++ * If we were using a 16-bit stack segment, then ++ * the kernel is a bit stuck: IRET only restores ++ * the low 16 bits of ESP/RSP if SS is 16-bit. ++ * The kernel uses a hack to restore bits 31:16, ++ * but that hack doesn't help with bits 63:32. ++ * On Intel CPUs, bits 63:32 end up zeroed, and, on ++ * AMD CPUs, they leak the high bits of the kernel ++ * espfix64 stack pointer. There's very little that ++ * the kernel can do about it. ++ * ++ * Similarly, if we are returning to a 32-bit context, ++ * the CPU will often lose the high 32 bits of RSP. + */ +- if (res == (req & 0xFFFFFFFF)) +- continue; /* OK; not expected to work */ ++ ++ if (res == req) ++ continue; ++ ++ if (cs_bits != 64 && ((res ^ req) & 0xFFFFFFFF) == 0) { ++ printf("[NOTE]\tSP: %llx -> %llx\n", ++ (unsigned long long)req, ++ (unsigned long long)res); ++ continue; ++ } ++ ++ printf("[FAIL]\tSP mismatch: requested 0x%llx; got 0x%llx\n", ++ (unsigned long long)requested_regs[i], ++ (unsigned long long)resulting_regs[i]); ++ nerrs++; ++ continue; + } + + bool ignore_reg = false; +@@ -663,13 +682,6 @@ static int test_valid_sigreturn(int cs_b + } + + if (requested_regs[i] != resulting_regs[i] && !ignore_reg) { +- /* +- * SP is particularly interesting here. The +- * usual cause of failures is that we hit the +- * nasty IRET case of returning to a 16-bit SS, +- * in which case bits 16:31 of the *kernel* +- * stack pointer persist in ESP. +- */ + printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n", + i, (unsigned long long)requested_regs[i], + (unsigned long long)resulting_regs[i]); diff --git a/queue-4.17/selftests-x86-sigreturn-do-minor-cleanups.patch b/queue-4.17/selftests-x86-sigreturn-do-minor-cleanups.patch new file mode 100644 index 00000000000..39773ef4882 --- /dev/null +++ b/queue-4.17/selftests-x86-sigreturn-do-minor-cleanups.patch @@ -0,0 +1,61 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Andy Lutomirski +Date: Tue, 26 Jun 2018 22:17:18 -0700 +Subject: selftests/x86/sigreturn: Do minor cleanups + +From: Andy Lutomirski + +[ Upstream commit e8a445dea219c32727016af14f847d2e8f7ebec8 ] + +We have short names for the requested and resulting register values. +Use them instead of spelling out the whole register entry for each +case. + +Signed-off-by: Andy Lutomirski +Cc: Borislav Petkov +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/bb3bc1f923a2f6fe7912d22a1068fe29d6033d38.1530076529.git.luto@kernel.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/x86/sigreturn.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/tools/testing/selftests/x86/sigreturn.c ++++ b/tools/testing/selftests/x86/sigreturn.c +@@ -610,6 +610,7 @@ static int test_valid_sigreturn(int cs_b + */ + for (int i = 0; i < NGREG; i++) { + greg_t req = requested_regs[i], res = resulting_regs[i]; ++ + if (i == REG_TRAPNO || i == REG_IP) + continue; /* don't care */ + +@@ -673,18 +674,18 @@ static int test_valid_sigreturn(int cs_b + #endif + + /* Sanity check on the kernel */ +- if (i == REG_CX && requested_regs[i] != resulting_regs[i]) { ++ if (i == REG_CX && req != res) { + printf("[FAIL]\tCX (saved SP) mismatch: requested 0x%llx; got 0x%llx\n", +- (unsigned long long)requested_regs[i], +- (unsigned long long)resulting_regs[i]); ++ (unsigned long long)req, ++ (unsigned long long)res); + nerrs++; + continue; + } + +- if (requested_regs[i] != resulting_regs[i] && !ignore_reg) { ++ if (req != res && !ignore_reg) { + printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n", +- i, (unsigned long long)requested_regs[i], +- (unsigned long long)resulting_regs[i]); ++ i, (unsigned long long)req, ++ (unsigned long long)res); + nerrs++; + } + } diff --git a/queue-4.17/selftests-zram-return-kselftest-skip-code-for-skipped-tests.patch b/queue-4.17/selftests-zram-return-kselftest-skip-code-for-skipped-tests.patch new file mode 100644 index 00000000000..a9186f5ab76 --- /dev/null +++ b/queue-4.17/selftests-zram-return-kselftest-skip-code-for-skipped-tests.patch @@ -0,0 +1,68 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Thu, 14 Jun 2018 16:56:13 -0600 +Subject: selftests: zram: return Kselftest Skip code for skipped tests + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit 685814466bf8398192cf855415a0bb2cefc1930e ] + +When zram test is skipped because of unmet dependencies and/or +unsupported configuration, it exits with error which is treated as +a fail by the Kselftest framework. This leads to false negative result +even when the test could not be run. + +Change it to return kselftest skip code when a test gets skipped to +clearly report that the test could not be run. + +Kselftest framework SKIP code is 4 and the framework prints appropriate +messages to indicate that the test is skipped. + +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/zram/zram.sh | 5 ++++- + tools/testing/selftests/zram/zram_lib.sh | 5 ++++- + 2 files changed, 8 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/zram/zram.sh ++++ b/tools/testing/selftests/zram/zram.sh +@@ -2,6 +2,9 @@ + # SPDX-License-Identifier: GPL-2.0 + TCID="zram.sh" + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + . ./zram_lib.sh + + run_zram () { +@@ -24,5 +27,5 @@ elif [ -b /dev/zram0 ]; then + else + echo "$TCID : No zram.ko module or /dev/zram0 device file not found" + echo "$TCID : CONFIG_ZRAM is not set" +- exit 1 ++ exit $ksft_skip + fi +--- a/tools/testing/selftests/zram/zram_lib.sh ++++ b/tools/testing/selftests/zram/zram_lib.sh +@@ -18,6 +18,9 @@ MODULE=0 + dev_makeswap=-1 + dev_mounted=-1 + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + trap INT + + check_prereqs() +@@ -27,7 +30,7 @@ check_prereqs() + + if [ $uid -ne 0 ]; then + echo $msg must be run as root >&2 +- exit 0 ++ exit $ksft_skip + fi + } + diff --git a/queue-4.17/series b/queue-4.17/series new file mode 100644 index 00000000000..04b64cebd95 --- /dev/null +++ b/queue-4.17/series @@ -0,0 +1,304 @@ +arm-dts-armada-fix-cooling-cells-property-s-name.patch +vfio-ccw-fix-error-return-in-vfio_ccw_sch_event.patch +perf-tools-fix-error-index-for-pmu-event-parser.patch +hid-google-add-support-for-whiskers.patch +ib-rxe-avoid-double-kfree-skb.patch +rdma-qedr-fix-null-pointer-dereference-when-running-over-iwarp-without-rdma-cm.patch +input-synaptics-rmi4-fix-axis-swap-behavior.patch +ib-mlx4-fix-an-error-handling-path-in-mlx4_ib_rereg_user_mr.patch +clocksource-drivers-stm32-fix-error-return-code.patch +drm-bridge-sii8620-fix-loops-in-edid-fetch-logic.patch +drm-bridge-sii8620-fix-display-modes-validation.patch +drm-bridge-sii8620-fix-potential-buffer-overflow.patch +arc-explicitly-add-mmedium-calls-to-cflags.patch +selftests-bpf-test-offloads-even-with-bpf-programs-present.patch +smb3-increase-initial-number-of-credits-requested-to-allow-write.patch +hwmon-dell-smm-disable-fan-support-for-dell-xps13-9333.patch +hwmon-nct6775-fix-loop-limit.patch +soc-imx-gpcv2-correct-pgc-offset.patch +usb-dwc3-pci-add-support-for-intel-icelake.patch +usb-gadget-ffs-fix-bug-when-userland-exits-with-submitted-aio-transfers.patch +usb-dwc2-gadget-fix-issue-in-dwc2_gadget_start_isoc.patch +usb-dwc3-of-simple-fix-use-after-free-on-remove.patch +acpi-ec-use-ec_no_wakeup-on-thinkpad-x1-carbon-6th.patch +netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch +netfilter-nf_ct_helper-fix-possible-panic-after-nf_conntrack_helper_unregister.patch +selftests-pstore-return-kselftest-skip-code-for-skipped-tests.patch +selftests-static_keys-return-kselftest-skip-code-for-skipped-tests.patch +selftests-sysctl-return-kselftest-skip-code-for-skipped-tests.patch +selftests-user-return-kselftest-skip-code-for-skipped-tests.patch +selftests-zram-return-kselftest-skip-code-for-skipped-tests.patch +selftests-vm-return-kselftest-skip-code-for-skipped-tests.patch +selftests-sync-add-config-fragment-for-testing-sync-framework.patch +arm-dts-nsp-fix-i2c-controller-interrupt-type.patch +arm-dts-nsp-fix-pcie-controllers-interrupt-types.patch +arm-dts-hr2-fix-interrupt-types-for-i2c-and-pcie.patch +arm-dts-bcm5301x-fix-i2c-controller-interrupt-type.patch +arm-dts-cygnus-fix-i2c-controller-interrupt-type.patch +arm-dts-cygnus-fix-pcie-controller-interrupt-type.patch +arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742k.patch +arm64-dts-specify-1.8v-emmc-capabilities-for-bcm958742t.patch +arm64-dts-ns2-fix-i2c-controller-interrupt-type.patch +arm64-dts-ns2-fix-pcie-controller-interrupt-type.patch +arm64-dts-stingray-fix-i2c-controller-interrupt-type.patch +drivers-perf-xgene_pmu-fix-iob-slow-pmu-parser-error.patch +drm-arm-malidp-ensure-that-the-crtcs-are-shutdown-before-removing-any-encoder-connector.patch +drm-mali-dp-enable-global-se-interrupts-mask-for-dp500.patch +drm-arm-malidp-preserve-layer_format-contents-when-setting-format.patch +drm-mali-dp-rectify-the-width-and-height-passed-to-rotmem_required.patch +ib-rxe-fix-missing-completion-for-mem_reg-work-requests.patch +libahci-fix-possible-spectre-v1-pmp-indexing-in-ahci_led_store.patch +dmaengine-ti-omap-dma-fix-omap1510-incorrect-residue_granularity.patch +posix-timers-fix-nanosleep_copyout-for-config_compat_32bit_time.patch +usb-dwc2-fix-host-exit-from-hibernation-flow.patch +usb-dwc2-alloc-dma-aligned-buffer-for-isoc-split-in.patch +usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch +usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch +usb-gadget-dwc2-fix-memory-leak-in-gadget_init.patch +dwc2-gadget-fix-isoc-in-ddma-pid-bitfield-value-calculation.patch +powerpc-smp_send_stop-do-not-offline-stopped-cpus.patch +xen-add-error-handling-for-xenbus_printf.patch +pnfs-always-free-the-session-slot-on-error-in-nfs4_layoutget_handle_exception.patch +scsi-xen-scsifront-add-error-handling-for-xenbus_printf.patch +xen-scsiback-add-error-handling-for-xenbus_printf.patch +arm64-dma-mapping-clear-buffers-allocated-with-force_contiguous-flag.patch +arm64-make-secondary_start_kernel-notrace.patch +qed-fix-possible-memory-leak-in-rx-error-path-handling.patch +qed-add-sanity-check-for-simd-fastpath-handler.patch +qed-do-not-advertise-dcbx_lld_managed-capability.patch +enic-initialize-enic-rfs_h.lock-in-enic_probe.patch +net-hamradio-use-eth_broadcast_addr.patch +net-propagate-dev_get_valid_name-return-code.patch +net-stmmac-socfpga-add-additional-ocp-reset-line-for-stratix10.patch +nvme-rdma-fix-possible-double-free-condition-when-failing-to-create-a-controller.patch +nvme-rdma-fix-command-completion-race-at-error-recovery.patch +nvmet-reset-keep-alive-timer-in-controller-enable.patch +blk-mq-debugfs-off-by-one-in-blk_mq_rq_state_name.patch +block-sed-opal-fix-a-couple-off-by-one-bugs.patch +arc-enable-machine_desc-init_per_cpu-for-config_smp.patch +selftests-net-add-config-fragments.patch +nbd-add-the-nbd-nbd_disconnect_on_close-config-flag.patch +net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch +sctp-fix-erroneous-inc-of-snmp-sctpfragusrmsgs.patch +kvm-arm-arm64-drop-resource-size-check-for-gicv-window.patch +drm-bridge-sii8620-fix-display-of-packed-pixel-modes-in-mhl2.patch +nvme-pci-move-nvme_kill_queues-to-nvme_remove_dead_ctrl.patch +clk-sunxi-ng-replace-lib-y-with-obj-y.patch +locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch +selftests-bpf-notification-about-privilege-required-to-run-test_kmod.sh-testing-script.patch +mtd-dataflash-use-ull-suffix-for-64-bit-constants.patch +irqchip-gic-v2m-fix-spi-release-on-error-path.patch +irqchip-gic-v3-its-fix-reprogramming-of-redistributors-on-cpu-hotplug.patch +x86-microcode-intel-fix-memleak-in-save_microcode_patch.patch +ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch +smack-mark-inode-instant-in-smack_task_to_inode.patch +arm64-dts-msm8916-fix-coresight-etf-graph-connections.patch +batman-adv-fix-bat_ogm_iv-best-gw-refcnt-after-netlink-dump.patch +batman-adv-fix-bat_v-best-gw-refcnt-after-netlink-dump.patch +batman-adv-fix-debugfs-path-for-renamed-hardif.patch +batman-adv-fix-debugfs-path-for-renamed-softif.patch +batman-adv-avoid-storing-non-tt-sync-flags-on-singular-entries-too.patch +batman-adv-fix-multicast-tt-issues-with-bogus-roam-flags.patch +cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch +iio-pressure-bmp280-fix-relative-humidity-unit.patch +brcmfmac-stop-watchdog-before-detach-and-free-everything.patch +ipmi-kcs_bmc-fix-irq-exception-if-the-channel-is-not-open.patch +arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch +alsa-seq-fix-ubsan-warning-at-sndrv_seq_ioctl_query_next_client-ioctl.patch +nfp-bpf-don-t-stop-offload-if-replace-failed.patch +usb-xhci-remove-the-code-build-warning.patch +usb-xhci-increase-crs-timeout-value.patch +nfc-pn533-fix-wrong-gfp-flag-usage.patch +typec-tcpm-fix-a-msecs-vs-jiffies-bug.patch +kconfig-fix-line-numbers-for-if-entries-in-menu-tree.patch +perf-record-support-s390-random-socket_id-assignment.patch +perf-test-session-topology-fix-test-on-s390.patch +perf-report-powerpc-fix-crash-if-callchain-is-empty.patch +perf-tests-add-event-parsing-error-handling-to-parse-events-test.patch +tools-include-uapi-update-if_link.h-to-pick-ifla_-brport_isolated-vxlan_ttl_inherit.patch +perf-tools-fix-a-clang-7.0-compilation-error.patch +perf-bench-fix-numa-report-output-code.patch +perf-script-fix-crash-because-of-missing-evsel-priv.patch +perf-tools-fix-crash-caused-by-accessing-feat_ops.patch +clk-davinci-cfgchip-testing-the-wrong-variable.patch +usb-chipidea-host-fix-disconnection-detect-issue.patch +arm-davinci-board-da850-evm-fix-wp-pin-polarity-for-mmc-sd.patch +netfilter-nf_log-fix-uninit-read-in-nf_log_proc_dostring.patch +ceph-fix-dentry-leak-in-splice_dentry.patch +net-mlx5-e-switch-disallow-vlan-spoofcheck-setup-if-not-being-esw-manager.patch +rds-clean-up-loopback-rds_connections-on-netns-deletion.patch +nfp-cast-sizeof-to-int-when-comparing-with-error-code.patch +selftests-x86-sigreturn-64-fix-spurious-failures-on-amd-cpus.patch +selftests-x86-sigreturn-do-minor-cleanups.patch +arm-dts-da850-fix-interrups-property-for-gpio.patch +arm64-dts-uniphier-fix-widget-name-of-headphone-for-ld11-ld20-boards.patch +arm64-avoid-flush_icache_range-in-alternatives-patching-code.patch +arm64-dts-meson-axg-fix-ethernet-stability-issue.patch +arm64-dts-meson-gxl-fix-mali-gpu-compatible-string.patch +dmaengine-pl330-report-burst-residue-granularity.patch +dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch +ath10k-update-the-phymode-along-with-bandwidth-change-request.patch +drm-amd-powerplay-correct-vega12-thermal-support-as-true.patch +md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch +dev-dax-check_vma-ratelimit-dev_info-s.patch +mac80211-disable-bhs-preemption-in-ieee80211_tx_control_port.patch +nl80211-relax-ht-operation-checks-for-mesh.patch +nl80211-check-nla_parse_nested-return-values.patch +drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch +drm-exynos-decon5433-fix-per-plane-global-alpha-for-xrgb-modes.patch +drm-exynos-decon5433-fix-winconx-reset-value.patch +blk-mq-don-t-queue-more-if-we-get-a-busy-return.patch +drbd-fix-drbd_request_prepare-discard-handling.patch +bpf-s390-fix-potential-memleak-when-later-bpf_jit_prog-fails.patch +pci-xilinx-add-missing-of_node_put.patch +pci-xilinx-nwl-add-missing-of_node_put.patch +pci-faraday-add-missing-of_node_put.patch +bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch +fsl-fman-fix-parser-reporting-bad-checksum-on-short-frames.patch +dpaa_eth-dpaa-sgt-needs-to-be-256b.patch +s390-qeth-consistently-re-enable-device-features.patch +acpi-nfit-fix-cmd_rc-for-acpi_nfit_ctl-to-always-return-a-value.patch +tools-testing-nvdimm-advertise-a-write-cache-for-nfit_test.patch +openrisc-entry-fix-delay-slot-exception-detection.patch +crypto-arm-speck-fix-building-in-thumb2-mode.patch +m68k-fix-bad-page-state-oops-on-coldfire-boot.patch +objtool-support-gcc-8-fnoreorder-functions.patch +ipvlan-call-dev_change_flags-when-ipvlan-mode-is-reset.patch +usb-xhci-dbc-don-t-decrement-runtime-pm-counter-if-dbc-is-not-started.patch +drm-amdgpu-fix-swapped-emit_ib_size-in-vce3.patch +nds32-fix-the-dts-pointer-is-not-passed-correctly-issue.patch +sched-nohz-skip-remote-tick-on-idle-task-entirely.patch +sched-fair-fix-bandwidth-timer-clock-drift-condition.patch +sched-util_est-fix-util_est_dequeue-for-throttled-cfs_rq.patch +kthread-sched-core-fix-kthread_parkme-again.patch +x86-mm-32-initialize-the-cr4-shadow-before-__flush_tlb_all.patch +hid-wacom-correct-touch-maximum-xy-of-2nd-gen-intuos.patch +arm-imx_v6_v7_defconfig-select-ulpi-support.patch +arm-imx_v4_v5_defconfig-select-ulpi-support.patch +tls-fix-skb_to_sgvec-returning-unhandled-error.patch +r8169-fix-mac-address-change.patch +bpf-hash-map-decrement-counter-on-error.patch +tracing-use-__printf-markup-to-silence-compiler.patch +kasan-fix-shadow_size-calculation-error-in-kasan_module_alloc.patch +net-phy-marvell-change-default-m88e1510-led-configuration.patch +smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch +drm-bridge-sii8620-fix-display-of-packed-pixel-modes.patch +risc-v-fix-r_riscv_add32-r_riscv_sub32-relocations.patch +risc-v-don-t-include-irq-riscv-intc.h.patch +risc-v-fix-ptrace_setregset-bug.patch +samples-bpf-add-missing-linux-if_vlan.h.patch +samples-bpf-check-the-result-of-system.patch +samples-bpf-check-the-error-of-write-and-read.patch +ieee802154-mcr20a-add-missing-includes.patch +ieee802154-6lowpan-set-ifla_link.patch +netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch +qed-off-by-one-in-qed_parse_mcp_trace_buf.patch +ipv6-make-ipv6_renew_options-interrupt-kernel-safe.patch +net-qrtr-broadcast-messages-only-from-control-port.patch +net-qrtr-reset-the-node-and-port-id-of-broadcast-messages.patch +sh_eth-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch +sh_eth-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch +ravb-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch +ravb-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch +tipc-fix-wrong-return-value-from-function-tipc_node_try_addr.patch +tipc-correct-discovery-message-handling-during-address-trial-period.patch +tipc-fix-correct-setting-of-message-type-in-second-discoverer.patch +tipc-make-function-tipc_net_finalize-thread-safe.patch +cxgb4-assume-flash-part-size-to-be-4mb-if-it-can-t-be-determined.patch +arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch +net-macb-free-rx-ring-for-all-queues.patch +net-sched-act_csum-fix-null-dereference-when-goto-chain-is-used.patch +net-sched-act_tunnel_key-fix-null-dereference-when-goto-chain-is-used.patch +nvmem-don-t-let-a-null-cell_id-for-nvmem_cell_get-crash-us.patch +bpf-fix-sk_skb-programs-without-skb-dev-assigned.patch +ipfrag-really-prevent-allocation-on-netns-exit.patch +drm-sun4i-link-in-front-end-code-if-needed.patch +ieee802154-at86rf230-switch-from-bug_on-to-warn_on-on-problem.patch +ieee802154-at86rf230-use-__func__-macro-for-debug-messages.patch +ieee802154-fakelb-switch-from-bug_on-to-warn_on-on-problem.patch +gpu-host1x-skip-iommu-initialization-if-firewall-is-enabled.patch +gpu-host1x-check-whether-size-of-unpin-isn-t-0.patch +drm-tegra-fix-comparison-operator-for-buffer-size.patch +net-ieee802154-adf7242-fix-erroneous-rx-enable.patch +net-ieee802154-adf7242-fix-ocl-calibration-runs.patch +drm-armada-fix-colorkey-mode-property.patch +drm-armada-fix-irq-handling.patch +netfilter-nft_compat-explicitly-reject-error-and-standard-target.patch +netfilter-nf_conntrack-fix-possible-possible-crash-on-module-loading.patch +arc-configure-apb-gpio-controller-on-arc-hsdk-platform.patch +arc-improve-cmpxchg-syscall-implementation.patch +bnxt_en-fix-the-vlan_tci-exact-match-check.patch +bnxt_en-fix-inconsistent-bnxt_flag_agg_rings-logic.patch +bnxt_en-always-set-output-parameters-in-bnxt_get_max_rings.patch +bnxt_en-do-not-modify-max-irq-count-after-rdma-driver-requests-frees-irqs.patch +bnxt_en-fix-for-system-hang-if-request_irq-fails.patch +samples-bpf-fix-tc-and-ip-paths-in-xdp2skb_meta.sh.patch +scsi-hpsa-correct-enclosure-sas-address.patch +scsi-qedf-send-the-driver-state-to-mfw.patch +scsi-qedi-send-driver-state-to-mfw.patch +perf-llvm-utils-remove-bashism-from-kernel-include-fetch-script.patch +perf-test-shell-prevent-temporary-editor-files-from-being-considered-test-scripts.patch +perf-tools-fix-compilation-errors-on-gcc8.patch +perf-script-python-fix-dict-reference-counting.patch +perf-tools-use-python-config-includes-rather-than-cflags.patch +nfit-fix-unchecked-dereference-in-acpi_nfit_ctl.patch +rdma-mlx5-fix-memory-leak-in-mlx5_ib_create_srq-error-path.patch +arm-8780-1-ftrace-only-set-kernel-memory-back-to-read-only-after-boot.patch +sfp-ensure-we-clean-up-properly-on-bus-registration-failure.patch +sfp-fix-module-initialisation-with-netdev-already-up.patch +arm-dra7-omap5-enable-actlr-enable-invalidates-of-btb-for-secondary-cores.patch +arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch +ixgbe-be-more-careful-when-modifying-mac-filters.patch +amd-dc-dce100-on-dce100-set-clocks-to-0-on-suspend.patch +ixgbe-off-by-one-in-ixgbe_ipsec_tx.patch +tools-build-fixup-host-c-flags.patch +tools-build-use-hostldflags-with-fixdep.patch +kbuild-suppress-warnings-from-getconf-lfs_.patch +sfc-avoid-hang-from-nested-use-of-the-filter_sem.patch +sfc-hold-filter_sem-consistently-during-reset.patch +packet-reset-network-header-if-packet-shorter-than-ll-reserved-space.patch +rtc-fix-alarm-read-and-set-offset.patch +qlogic-check-kstrtoul-for-errors.patch +tcp-remove-delayed-ack-events-in-dctcp.patch +pinctrl-ingenic-fix-inverted-direction-for-jz4770.patch +pinctrl-nsp-off-by-ones-in-nsp_pinmux_enable.patch +pinctrl-nsp-fix-potential-null-dereference.patch +net-9p-client.c-put-refcount-of-trans_mod-in-error-case-in-parse_opts.patch +kvm-nvmx-restore-exit-qual-for-vm-entry-failure-due-to-msr-loading.patch +sched-deadline-fix-switched_from_dl-warning.patch +drm-nouveau-gem-off-by-one-bugs-in-nouveau_gem_pushbuf_reloc_apply.patch +of-overlay-update-phandle-cache-on-overlay-apply-and-remove.patch +ibmvnic-revise-rx-tx-queue-error-messages.patch +hv-netvsc-fix-handling-of-fallback-to-single-queue-mode.patch +net-ethernet-freescale-fman-fix-cross-build-error.patch +ibmvnic-fix-error-recovery-on-login-failure.patch +arm-dts-omap4-droid4-fix-dts-w.r.t.-pwm.patch +btrfs-scrub-don-t-use-inode-page-cache-in-scrub_handle_errored_block.patch +nvme-ensure-forward-progress-during-admin-passthru.patch +octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch +net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch +kvmclock-fix-tsc-calibration-for-nested-guests.patch +net-smc-reset-recv-timeout-after-clc-handshake.patch +pci-of-fix-i-o-space-page-leak.patch +pci-xgene-fix-i-o-space-page-leak.patch +pci-versatile-fix-i-o-space-page-leak.patch +pci-designware-fix-i-o-space-page-leak.patch +pci-aardvark-fix-i-o-space-page-leak.patch +pci-faraday-fix-i-o-space-page-leak.patch +pci-mediatek-fix-i-o-space-page-leak.patch +pci-v3-semi-fix-i-o-space-page-leak.patch +net-qca_spi-avoid-packet-drop-during-initial-sync.patch +net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch +net-qca_spi-fix-log-level-if-probe-fails.patch +net-cavium-add-fine-granular-dependencies-on-pci.patch +tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch +soc-imx-gpc-restrict-register-range-for-regmap-access.patch +acpi-ec-use-ec_no_wakeup-on-more-thinkpad-x1-carbon-6th-systems.patch +arm-dts-imx6-rdu2-fix-irq-type-for-mv88e6xxx-switch.patch +platform-x86-dell-laptop-fix-backlight-detection.patch +nvme-fix-handling-of-metadata_len-for-nvme_ioctl_io_cmd.patch +mm-use-helper-functions-for-allocating-and-freeing-vm_area-structs.patch +mm-make-vm_area_dup-actually-copy-the-old-vma-data.patch +mm-make-vm_area_alloc-initialize-core-fields.patch +edac-add-missing-mem_lrddr4-entry-in-edac_mem_types.patch +pty-fix-o_cloexec-for-tiocgptpeer.patch diff --git a/queue-4.17/sfc-avoid-hang-from-nested-use-of-the-filter_sem.patch b/queue-4.17/sfc-avoid-hang-from-nested-use-of-the-filter_sem.patch new file mode 100644 index 00000000000..a7864be0790 --- /dev/null +++ b/queue-4.17/sfc-avoid-hang-from-nested-use-of-the-filter_sem.patch @@ -0,0 +1,120 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Bert Kenward +Date: Wed, 11 Jul 2018 11:44:25 +0100 +Subject: sfc: avoid hang from nested use of the filter_sem + +From: Bert Kenward + +[ Upstream commit 1c56c0994a533ce564843a0d17af7a3e6e68f269 ] + +In some situations we may end up calling down_read while already +holding the semaphore for write, thus hanging. This has been seen +when setting the MAC address for the interface. The hung task log +in this situation includes this stack: + down_read + efx_ef10_filter_insert + efx_ef10_filter_insert_addr_list + efx_ef10_filter_vlan_sync_rx_mode + efx_ef10_filter_add_vlan + efx_ef10_filter_table_probe + efx_ef10_set_mac_address + efx_set_mac_address + dev_set_mac_address + +In addition, lockdep rightly points out that nested calling of +down_read is incorrect. + +Fixes: c2bebe37c6b6 ("sfc: give ef10 its own rwsem in the filter table instead of filter_lock") +Tested-by: Jarod Wilson +Signed-off-by: Bert Kenward +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/sfc/ef10.c | 30 +++++++++++++++++++++--------- + 1 file changed, 21 insertions(+), 9 deletions(-) + +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -4288,9 +4288,9 @@ static int efx_ef10_filter_pri(struct ef + return -EPROTONOSUPPORT; + } + +-static s32 efx_ef10_filter_insert(struct efx_nic *efx, +- struct efx_filter_spec *spec, +- bool replace_equal) ++static s32 efx_ef10_filter_insert_locked(struct efx_nic *efx, ++ struct efx_filter_spec *spec, ++ bool replace_equal) + { + DECLARE_BITMAP(mc_rem_map, EFX_EF10_FILTER_SEARCH_LIMIT); + struct efx_ef10_nic_data *nic_data = efx->nic_data; +@@ -4307,7 +4307,7 @@ static s32 efx_ef10_filter_insert(struct + bool is_mc_recip; + s32 rc; + +- down_read(&efx->filter_sem); ++ WARN_ON(!rwsem_is_locked(&efx->filter_sem)); + table = efx->filter_state; + down_write(&table->lock); + +@@ -4498,10 +4498,22 @@ out_unlock: + if (rss_locked) + mutex_unlock(&efx->rss_lock); + up_write(&table->lock); +- up_read(&efx->filter_sem); + return rc; + } + ++static s32 efx_ef10_filter_insert(struct efx_nic *efx, ++ struct efx_filter_spec *spec, ++ bool replace_equal) ++{ ++ s32 ret; ++ ++ down_read(&efx->filter_sem); ++ ret = efx_ef10_filter_insert_locked(efx, spec, replace_equal); ++ up_read(&efx->filter_sem); ++ ++ return ret; ++} ++ + static void efx_ef10_filter_update_rx_scatter(struct efx_nic *efx) + { + /* no need to do anything here on EF10 */ +@@ -5284,7 +5296,7 @@ static int efx_ef10_filter_insert_addr_l + EFX_WARN_ON_PARANOID(ids[i] != EFX_EF10_FILTER_ID_INVALID); + efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0); + efx_filter_set_eth_local(&spec, vlan->vid, addr_list[i].addr); +- rc = efx_ef10_filter_insert(efx, &spec, true); ++ rc = efx_ef10_filter_insert_locked(efx, &spec, true); + if (rc < 0) { + if (rollback) { + netif_info(efx, drv, efx->net_dev, +@@ -5313,7 +5325,7 @@ static int efx_ef10_filter_insert_addr_l + efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0); + eth_broadcast_addr(baddr); + efx_filter_set_eth_local(&spec, vlan->vid, baddr); +- rc = efx_ef10_filter_insert(efx, &spec, true); ++ rc = efx_ef10_filter_insert_locked(efx, &spec, true); + if (rc < 0) { + netif_warn(efx, drv, efx->net_dev, + "Broadcast filter insert failed rc=%d\n", rc); +@@ -5369,7 +5381,7 @@ static int efx_ef10_filter_insert_def(st + if (vlan->vid != EFX_FILTER_VID_UNSPEC) + efx_filter_set_eth_local(&spec, vlan->vid, NULL); + +- rc = efx_ef10_filter_insert(efx, &spec, true); ++ rc = efx_ef10_filter_insert_locked(efx, &spec, true); + if (rc < 0) { + const char *um = multicast ? "Multicast" : "Unicast"; + const char *encap_name = ""; +@@ -5429,7 +5441,7 @@ static int efx_ef10_filter_insert_def(st + filter_flags, 0); + eth_broadcast_addr(baddr); + efx_filter_set_eth_local(&spec, vlan->vid, baddr); +- rc = efx_ef10_filter_insert(efx, &spec, true); ++ rc = efx_ef10_filter_insert_locked(efx, &spec, true); + if (rc < 0) { + netif_warn(efx, drv, efx->net_dev, + "Broadcast filter insert failed rc=%d\n", diff --git a/queue-4.17/sfc-hold-filter_sem-consistently-during-reset.patch b/queue-4.17/sfc-hold-filter_sem-consistently-during-reset.patch new file mode 100644 index 00000000000..cd3c530a83d --- /dev/null +++ b/queue-4.17/sfc-hold-filter_sem-consistently-during-reset.patch @@ -0,0 +1,87 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Bert Kenward +Date: Wed, 11 Jul 2018 11:45:10 +0100 +Subject: sfc: hold filter_sem consistently during reset + +From: Bert Kenward + +[ Upstream commit 193f20033c54db0dc9563f722fbafbcd5fa0e80d ] + +We should take and release the filter_sem consistently during the +reset process, in the same manner as the mac_lock and reset_lock. + +For lockdep consistency we also take the filter_sem for write around +other calls to efx->type->init(). + +Fixes: c2bebe37c6b6 ("sfc: give ef10 its own rwsem in the filter table instead of filter_lock") +Signed-off-by: Bert Kenward +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/sfc/efx.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +--- a/drivers/net/ethernet/sfc/efx.c ++++ b/drivers/net/ethernet/sfc/efx.c +@@ -1840,12 +1840,6 @@ static void efx_remove_filters(struct ef + up_write(&efx->filter_sem); + } + +-static void efx_restore_filters(struct efx_nic *efx) +-{ +- down_read(&efx->filter_sem); +- efx->type->filter_table_restore(efx); +- up_read(&efx->filter_sem); +-} + + /************************************************************************** + * +@@ -2657,6 +2651,7 @@ void efx_reset_down(struct efx_nic *efx, + efx_disable_interrupts(efx); + + mutex_lock(&efx->mac_lock); ++ down_write(&efx->filter_sem); + mutex_lock(&efx->rss_lock); + if (efx->port_initialized && method != RESET_TYPE_INVISIBLE && + method != RESET_TYPE_DATAPATH) +@@ -2714,9 +2709,8 @@ int efx_reset_up(struct efx_nic *efx, en + if (efx->type->rx_restore_rss_contexts) + efx->type->rx_restore_rss_contexts(efx); + mutex_unlock(&efx->rss_lock); +- down_read(&efx->filter_sem); +- efx_restore_filters(efx); +- up_read(&efx->filter_sem); ++ efx->type->filter_table_restore(efx); ++ up_write(&efx->filter_sem); + if (efx->type->sriov_reset) + efx->type->sriov_reset(efx); + +@@ -2733,6 +2727,7 @@ fail: + efx->port_initialized = false; + + mutex_unlock(&efx->rss_lock); ++ up_write(&efx->filter_sem); + mutex_unlock(&efx->mac_lock); + + return rc; +@@ -3440,7 +3435,9 @@ static int efx_pci_probe_main(struct efx + + efx_init_napi(efx); + ++ down_write(&efx->filter_sem); + rc = efx->type->init(efx); ++ up_write(&efx->filter_sem); + if (rc) { + netif_err(efx, probe, efx->net_dev, + "failed to initialise NIC\n"); +@@ -3729,7 +3726,9 @@ static int efx_pm_resume(struct device * + rc = efx->type->reset(efx, RESET_TYPE_ALL); + if (rc) + return rc; ++ down_write(&efx->filter_sem); + rc = efx->type->init(efx); ++ up_write(&efx->filter_sem); + if (rc) + return rc; + rc = efx_pm_thaw(dev); diff --git a/queue-4.17/sfp-ensure-we-clean-up-properly-on-bus-registration-failure.patch b/queue-4.17/sfp-ensure-we-clean-up-properly-on-bus-registration-failure.patch new file mode 100644 index 00000000000..ceceeedaba5 --- /dev/null +++ b/queue-4.17/sfp-ensure-we-clean-up-properly-on-bus-registration-failure.patch @@ -0,0 +1,98 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Russell King +Date: Tue, 10 Jul 2018 12:05:31 +0100 +Subject: sfp: ensure we clean up properly on bus registration failure + +From: Russell King + +[ Upstream commit f20a4c46b984331a509528fa2b84125c617ef98b ] + +We fail to correctly clean up after a bus registration failure, which +can lead to an incorrect assumption about the registration state of +the upstream or sfp cage. + +Signed-off-by: Russell King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/sfp-bus.c | 31 ++++++++++++++++++++++++------- + 1 file changed, 24 insertions(+), 7 deletions(-) + +--- a/drivers/net/phy/sfp-bus.c ++++ b/drivers/net/phy/sfp-bus.c +@@ -436,6 +436,13 @@ void sfp_upstream_stop(struct sfp_bus *b + } + EXPORT_SYMBOL_GPL(sfp_upstream_stop); + ++static void sfp_upstream_clear(struct sfp_bus *bus) ++{ ++ bus->upstream_ops = NULL; ++ bus->upstream = NULL; ++ bus->netdev = NULL; ++} ++ + /** + * sfp_register_upstream() - Register the neighbouring device + * @fwnode: firmware node for the SFP bus +@@ -462,8 +469,11 @@ struct sfp_bus *sfp_register_upstream(st + bus->upstream = upstream; + bus->netdev = ndev; + +- if (bus->sfp) ++ if (bus->sfp) { + ret = sfp_register_bus(bus); ++ if (ret) ++ sfp_upstream_clear(bus); ++ } + rtnl_unlock(); + } + +@@ -488,8 +498,7 @@ void sfp_unregister_upstream(struct sfp_ + rtnl_lock(); + if (bus->sfp) + sfp_unregister_bus(bus); +- bus->upstream = NULL; +- bus->netdev = NULL; ++ sfp_upstream_clear(bus); + rtnl_unlock(); + + sfp_bus_put(bus); +@@ -561,6 +570,13 @@ void sfp_module_remove(struct sfp_bus *b + } + EXPORT_SYMBOL_GPL(sfp_module_remove); + ++static void sfp_socket_clear(struct sfp_bus *bus) ++{ ++ bus->sfp_dev = NULL; ++ bus->sfp = NULL; ++ bus->socket_ops = NULL; ++} ++ + struct sfp_bus *sfp_register_socket(struct device *dev, struct sfp *sfp, + const struct sfp_socket_ops *ops) + { +@@ -573,8 +589,11 @@ struct sfp_bus *sfp_register_socket(stru + bus->sfp = sfp; + bus->socket_ops = ops; + +- if (bus->netdev) ++ if (bus->netdev) { + ret = sfp_register_bus(bus); ++ if (ret) ++ sfp_socket_clear(bus); ++ } + rtnl_unlock(); + } + +@@ -592,9 +611,7 @@ void sfp_unregister_socket(struct sfp_bu + rtnl_lock(); + if (bus->netdev) + sfp_unregister_bus(bus); +- bus->sfp_dev = NULL; +- bus->sfp = NULL; +- bus->socket_ops = NULL; ++ sfp_socket_clear(bus); + rtnl_unlock(); + + sfp_bus_put(bus); diff --git a/queue-4.17/sfp-fix-module-initialisation-with-netdev-already-up.patch b/queue-4.17/sfp-fix-module-initialisation-with-netdev-already-up.patch new file mode 100644 index 00000000000..4db5499ac1f --- /dev/null +++ b/queue-4.17/sfp-fix-module-initialisation-with-netdev-already-up.patch @@ -0,0 +1,60 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Russell King +Date: Tue, 10 Jul 2018 12:05:36 +0100 +Subject: sfp: fix module initialisation with netdev already up + +From: Russell King + +[ Upstream commit 576cd32082351620a4e76b8babc4d5ae9b4bbb98 ] + +It was been observed that with a particular order of initialisation, +the netdev can be up, but the SFP module still has its TX_DISABLE +signal asserted. This occurs when the network device brought up before +the SFP kernel module has been inserted by userspace. + +This occurs because sfp-bus layer does not hear about the change in +network device state, and so assumes that it is still down. Set +netdev->sfp when the upstream is registered to work around this problem. + +Signed-off-by: Russell King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/sfp-bus.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/phy/sfp-bus.c ++++ b/drivers/net/phy/sfp-bus.c +@@ -349,7 +349,6 @@ static int sfp_register_bus(struct sfp_b + } + if (bus->started) + bus->socket_ops->start(bus->sfp); +- bus->netdev->sfp_bus = bus; + bus->registered = true; + return 0; + } +@@ -364,7 +363,6 @@ static void sfp_unregister_bus(struct sf + if (bus->phydev && ops && ops->disconnect_phy) + ops->disconnect_phy(bus->upstream); + } +- bus->netdev->sfp_bus = NULL; + bus->registered = false; + } + +@@ -440,6 +438,7 @@ static void sfp_upstream_clear(struct sf + { + bus->upstream_ops = NULL; + bus->upstream = NULL; ++ bus->netdev->sfp_bus = NULL; + bus->netdev = NULL; + } + +@@ -468,6 +467,7 @@ struct sfp_bus *sfp_register_upstream(st + bus->upstream_ops = ops; + bus->upstream = upstream; + bus->netdev = ndev; ++ ndev->sfp_bus = bus; + + if (bus->sfp) { + ret = sfp_register_bus(bus); diff --git a/queue-4.17/sh_eth-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch b/queue-4.17/sh_eth-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch new file mode 100644 index 00000000000..109d787020b --- /dev/null +++ b/queue-4.17/sh_eth-fix-invalid-context-bug-while-calling-auto-negotiation-by-ethtool.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Vladimir Zapolskiy +Date: Wed, 4 Jul 2018 11:12:39 +0300 +Subject: sh_eth: fix invalid context bug while calling auto-negotiation by ethtool + +From: Vladimir Zapolskiy + +[ Upstream commit 53a710b5044d8475faa6813000b6dd659400ef7b ] + +Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O +potentially sleeping") phy_start_aneg() function utilizes a mutex +to serialize changes to phy state, however the helper function is +called in atomic context. + +The bug can be reproduced by running "ethtool -r" command, the bug +is reported if CONFIG_DEBUG_ATOMIC_SLEEP build option is enabled. + +Fixes: dc19e4e5e02f ("sh: sh_eth: Add support ethtool") +Signed-off-by: Vladimir Zapolskiy +Reviewed-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/renesas/sh_eth.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -2193,18 +2193,10 @@ static void sh_eth_get_regs(struct net_d + + static int sh_eth_nway_reset(struct net_device *ndev) + { +- struct sh_eth_private *mdp = netdev_priv(ndev); +- unsigned long flags; +- int ret; +- + if (!ndev->phydev) + return -ENODEV; + +- spin_lock_irqsave(&mdp->lock, flags); +- ret = phy_start_aneg(ndev->phydev); +- spin_unlock_irqrestore(&mdp->lock, flags); +- +- return ret; ++ return phy_start_aneg(ndev->phydev); + } + + static u32 sh_eth_get_msglevel(struct net_device *ndev) diff --git a/queue-4.17/sh_eth-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch b/queue-4.17/sh_eth-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch new file mode 100644 index 00000000000..e1cd8705ae0 --- /dev/null +++ b/queue-4.17/sh_eth-fix-invalid-context-bug-while-changing-link-options-by-ethtool.patch @@ -0,0 +1,122 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Vladimir Zapolskiy +Date: Wed, 4 Jul 2018 11:12:40 +0300 +Subject: sh_eth: fix invalid context bug while changing link options by ethtool + +From: Vladimir Zapolskiy + +[ Upstream commit 5cb3f52a11e18628fc4bee76dd14b1f0b76349de ] + +The change fixes sleep in atomic context bug, which is encountered +every time when link settings are changed by ethtool. + +Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O +potentially sleeping") phy_start_aneg() function utilizes a mutex +to serialize changes to phy state, however that helper function is +called in atomic context under a grabbed spinlock, because +phy_start_aneg() is called by phy_ethtool_ksettings_set() and by +replaced phy_ethtool_sset() helpers from phylib. + +Now duplex mode setting is enforced in sh_eth_adjust_link() only, +also now RX/TX is disabled when link is put down or modifications +to E-MAC registers ECMR and GECMR are expected for both cases of +checked and ignored link status pin state from E-MAC interrupt handler. + +For reference the change is a partial rework of commit 1e1b812bbe10 +("sh_eth: fix handling of no LINK signal"). + +Fixes: dc19e4e5e02f ("sh: sh_eth: Add support ethtool") +Signed-off-by: Vladimir Zapolskiy +Reviewed-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/renesas/sh_eth.c | 49 ++++++++++------------------------ + 1 file changed, 15 insertions(+), 34 deletions(-) + +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -1855,8 +1855,15 @@ static void sh_eth_adjust_link(struct ne + { + struct sh_eth_private *mdp = netdev_priv(ndev); + struct phy_device *phydev = ndev->phydev; ++ unsigned long flags; + int new_state = 0; + ++ spin_lock_irqsave(&mdp->lock, flags); ++ ++ /* Disable TX and RX right over here, if E-MAC change is ignored */ ++ if (mdp->cd->no_psr || mdp->no_ether_link) ++ sh_eth_rcv_snd_disable(ndev); ++ + if (phydev->link) { + if (phydev->duplex != mdp->duplex) { + new_state = 1; +@@ -1875,18 +1882,21 @@ static void sh_eth_adjust_link(struct ne + sh_eth_modify(ndev, ECMR, ECMR_TXF, 0); + new_state = 1; + mdp->link = phydev->link; +- if (mdp->cd->no_psr || mdp->no_ether_link) +- sh_eth_rcv_snd_enable(ndev); + } + } else if (mdp->link) { + new_state = 1; + mdp->link = 0; + mdp->speed = 0; + mdp->duplex = -1; +- if (mdp->cd->no_psr || mdp->no_ether_link) +- sh_eth_rcv_snd_disable(ndev); + } + ++ /* Enable TX and RX right over here, if E-MAC change is ignored */ ++ if ((mdp->cd->no_psr || mdp->no_ether_link) && phydev->link) ++ sh_eth_rcv_snd_enable(ndev); ++ ++ mmiowb(); ++ spin_unlock_irqrestore(&mdp->lock, flags); ++ + if (new_state && netif_msg_link(mdp)) + phy_print_status(phydev); + } +@@ -1977,39 +1987,10 @@ static int sh_eth_get_link_ksettings(str + static int sh_eth_set_link_ksettings(struct net_device *ndev, + const struct ethtool_link_ksettings *cmd) + { +- struct sh_eth_private *mdp = netdev_priv(ndev); +- unsigned long flags; +- int ret; +- + if (!ndev->phydev) + return -ENODEV; + +- spin_lock_irqsave(&mdp->lock, flags); +- +- /* disable tx and rx */ +- sh_eth_rcv_snd_disable(ndev); +- +- ret = phy_ethtool_ksettings_set(ndev->phydev, cmd); +- if (ret) +- goto error_exit; +- +- if (cmd->base.duplex == DUPLEX_FULL) +- mdp->duplex = 1; +- else +- mdp->duplex = 0; +- +- if (mdp->cd->set_duplex) +- mdp->cd->set_duplex(ndev); +- +-error_exit: +- mdelay(1); +- +- /* enable tx and rx */ +- sh_eth_rcv_snd_enable(ndev); +- +- spin_unlock_irqrestore(&mdp->lock, flags); +- +- return ret; ++ return phy_ethtool_ksettings_set(ndev->phydev, cmd); + } + + /* If it is ever necessary to increase SH_ETH_REG_DUMP_MAX_REGS, the diff --git a/queue-4.17/smack-mark-inode-instant-in-smack_task_to_inode.patch b/queue-4.17/smack-mark-inode-instant-in-smack_task_to_inode.patch new file mode 100644 index 00000000000..6fef2c6bfe4 --- /dev/null +++ b/queue-4.17/smack-mark-inode-instant-in-smack_task_to_inode.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Casey Schaufler +Date: Fri, 22 Jun 2018 10:54:45 -0700 +Subject: Smack: Mark inode instant in smack_task_to_inode + +From: Casey Schaufler + +[ Upstream commit 7b4e88434c4e7982fb053c49657e1c8bbb8692d9 ] + +Smack: Mark inode instant in smack_task_to_inode + +/proc clean-up in commit 1bbc55131e59bd099fdc568d3aa0b42634dbd188 +resulted in smack_task_to_inode() being called before smack_d_instantiate. +This resulted in the smk_inode value being ignored, even while present +for files in /proc/self. Marking the inode as instant here fixes that. + +Signed-off-by: Casey Schaufler +Signed-off-by: James Morris +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + security/smack/smack_lsm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2296,6 +2296,7 @@ static void smack_task_to_inode(struct t + struct smack_known *skp = smk_of_task_struct(p); + + isp->smk_inode = skp; ++ isp->smk_flags |= SMK_INODE_INSTANT; + } + + /* diff --git a/queue-4.17/smb3-increase-initial-number-of-credits-requested-to-allow-write.patch b/queue-4.17/smb3-increase-initial-number-of-credits-requested-to-allow-write.patch new file mode 100644 index 00000000000..fcd1546f506 --- /dev/null +++ b/queue-4.17/smb3-increase-initial-number-of-credits-requested-to-allow-write.patch @@ -0,0 +1,40 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Steve French +Date: Wed, 13 Jun 2018 17:05:58 -0500 +Subject: smb3: increase initial number of credits requested to allow write + +From: Steve French + +[ Upstream commit d409014e4feeab486fb36b350abfc4c94de8be37 ] + +Compared to other clients the Linux smb3 client ramps up +credits very slowly, taking more than 128 operations before a +maximum size write could be sent (since the number of credits +requested is only 2 per small operation, causing the credit +limit to grow very slowly). + +This lack of credits initially would impact large i/o performance, +when large i/o is tried early before enough credits are built up. + +Signed-off-by: Steve French +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/smb2pdu.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -923,8 +923,9 @@ SMB2_sess_alloc_buffer(struct SMB2_sess_ + req->PreviousSessionId = sess_data->previous_session; + + req->Flags = 0; /* MBZ */ +- /* to enable echos and oplocks */ +- req->sync_hdr.CreditRequest = cpu_to_le16(3); ++ ++ /* enough to enable echos and oplocks and one max size write */ ++ req->sync_hdr.CreditRequest = cpu_to_le16(130); + + /* only one of SMB2 signing flags may be set in SMB2 request */ + if (server->sign) diff --git a/queue-4.17/smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch b/queue-4.17/smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch new file mode 100644 index 00000000000..62d93124826 --- /dev/null +++ b/queue-4.17/smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch @@ -0,0 +1,105 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Yuiko Oshino +Date: Tue, 3 Jul 2018 11:21:46 -0400 +Subject: smsc75xx: Add workaround for gigabit link up hardware errata. + +From: Yuiko Oshino + +[ Upstream commit d461e3da905332189aad546b2ad9adbe6071c7cc ] + +In certain conditions, the device may not be able to link in gigabit mode. This software workaround ensures that the device will not enter the failure state. + +Fixes: d0cad871703b898a442e4049c532ec39168e5b57 ("SMSC75XX USB 2.0 Gigabit Ethernet Devices") +Signed-off-by: Yuiko Oshino +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/smsc75xx.c | 62 +++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 62 insertions(+) + +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -82,6 +82,9 @@ static bool turbo_mode = true; + module_param(turbo_mode, bool, 0644); + MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction"); + ++static int smsc75xx_link_ok_nopm(struct usbnet *dev); ++static int smsc75xx_phy_gig_workaround(struct usbnet *dev); ++ + static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index, + u32 *data, int in_pm) + { +@@ -852,6 +855,9 @@ static int smsc75xx_phy_initialize(struc + return -EIO; + } + ++ /* phy workaround for gig link */ ++ smsc75xx_phy_gig_workaround(dev); ++ + smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE, + ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP | + ADVERTISE_PAUSE_ASYM); +@@ -987,6 +993,62 @@ static int smsc75xx_wait_ready(struct us + return -EIO; + } + ++static int smsc75xx_phy_gig_workaround(struct usbnet *dev) ++{ ++ struct mii_if_info *mii = &dev->mii; ++ int ret = 0, timeout = 0; ++ u32 buf, link_up = 0; ++ ++ /* Set the phy in Gig loopback */ ++ smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040); ++ ++ /* Wait for the link up */ ++ do { ++ link_up = smsc75xx_link_ok_nopm(dev); ++ usleep_range(10000, 20000); ++ timeout++; ++ } while ((!link_up) && (timeout < 1000)); ++ ++ if (timeout >= 1000) { ++ netdev_warn(dev->net, "Timeout waiting for PHY link up\n"); ++ return -EIO; ++ } ++ ++ /* phy reset */ ++ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf); ++ if (ret < 0) { ++ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret); ++ return ret; ++ } ++ ++ buf |= PMT_CTL_PHY_RST; ++ ++ ret = smsc75xx_write_reg(dev, PMT_CTL, buf); ++ if (ret < 0) { ++ netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret); ++ return ret; ++ } ++ ++ timeout = 0; ++ do { ++ usleep_range(10000, 20000); ++ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf); ++ if (ret < 0) { ++ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ++ ret); ++ return ret; ++ } ++ timeout++; ++ } while ((buf & PMT_CTL_PHY_RST) && (timeout < 100)); ++ ++ if (timeout >= 100) { ++ netdev_warn(dev->net, "timeout waiting for PHY Reset\n"); ++ return -EIO; ++ } ++ ++ return 0; ++} ++ + static int smsc75xx_reset(struct usbnet *dev) + { + struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]); diff --git a/queue-4.17/soc-imx-gpc-restrict-register-range-for-regmap-access.patch b/queue-4.17/soc-imx-gpc-restrict-register-range-for-regmap-access.patch new file mode 100644 index 00000000000..8c1b98694c6 --- /dev/null +++ b/queue-4.17/soc-imx-gpc-restrict-register-range-for-regmap-access.patch @@ -0,0 +1,88 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Anson Huang +Date: Tue, 17 Jul 2018 11:28:46 +0800 +Subject: soc: imx: gpc: restrict register range for regmap access + +From: Anson Huang + +[ Upstream commit de2d9b5284bcb5c159c5882ac69f6bfd4dec7c67 ] + +GPC registers are NOT continuous, some registers are +reserved and accessing them from userspace will trigger +external abort, add regmap register access table to +avoid below abort: + +root@imx6slevk:~# cat /sys/kernel/debug/regmap/20dc000.gpc/registers +[ 108.480477] Unhandled fault: imprecise external abort (0x1406) at 0xb6db5004 +[ 108.487985] pgd = 42b54bfd +[ 108.490741] [b6db5004] *pgd=ba1b7831 +[ 108.494386] Internal error: : 1406 [#1] SMP ARM +[ 108.498943] Modules linked in: +[ 108.502043] CPU: 0 PID: 389 Comm: cat Not tainted 4.18.0-rc1-00074-gc9f1f60-dirty #482 +[ 108.509982] Hardware name: Freescale i.MX6 SoloLite (Device Tree) +[ 108.516123] PC is at regmap_mmio_read32le+0x20/0x24 +[ 108.521031] LR is at regmap_mmio_read+0x40/0x60 +[ 108.525586] pc : [] lr : [] psr: 20060093 +[ 108.531875] sp : eccf1d98 ip : eccf1da8 fp : eccf1da4 +[ 108.537122] r10: ec2d3800 r9 : eccf1f60 r8 : ecfc0000 +[ 108.542370] r7 : eccf1e2c r6 : eccf1e2c r5 : 00000028 r4 : ec338e00 +[ 108.548920] r3 : 00000000 r2 : eccf1e2c r1 : f0980028 r0 : 00000000 +[ 108.555474] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none +[ 108.562720] Control: 10c5387d Table: acf4004a DAC: 00000051 +[ 108.568491] Process cat (pid: 389, stack limit = 0xd4318a65) +[ 108.574174] Stack: (0xeccf1d98 to 0xeccf2000) + +Fixes: 721cabf6c660 ("soc: imx: move PGC handling to a new GPC driver") +Signed-off-by: Anson Huang +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/imx/gpc.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +--- a/drivers/soc/imx/gpc.c ++++ b/drivers/soc/imx/gpc.c +@@ -27,9 +27,16 @@ + #define GPC_PGC_SW2ISO_SHIFT 0x8 + #define GPC_PGC_SW_SHIFT 0x0 + ++#define GPC_PGC_PCI_PDN 0x200 ++#define GPC_PGC_PCI_SR 0x20c ++ + #define GPC_PGC_GPU_PDN 0x260 + #define GPC_PGC_GPU_PUPSCR 0x264 + #define GPC_PGC_GPU_PDNSCR 0x268 ++#define GPC_PGC_GPU_SR 0x26c ++ ++#define GPC_PGC_DISP_PDN 0x240 ++#define GPC_PGC_DISP_SR 0x24c + + #define GPU_VPU_PUP_REQ BIT(1) + #define GPU_VPU_PDN_REQ BIT(0) +@@ -318,10 +325,24 @@ static const struct of_device_id imx_gpc + { } + }; + ++static const struct regmap_range yes_ranges[] = { ++ regmap_reg_range(GPC_CNTR, GPC_CNTR), ++ regmap_reg_range(GPC_PGC_PCI_PDN, GPC_PGC_PCI_SR), ++ regmap_reg_range(GPC_PGC_GPU_PDN, GPC_PGC_GPU_SR), ++ regmap_reg_range(GPC_PGC_DISP_PDN, GPC_PGC_DISP_SR), ++}; ++ ++static const struct regmap_access_table access_table = { ++ .yes_ranges = yes_ranges, ++ .n_yes_ranges = ARRAY_SIZE(yes_ranges), ++}; ++ + static const struct regmap_config imx_gpc_regmap_config = { + .reg_bits = 32, + .val_bits = 32, + .reg_stride = 4, ++ .rd_table = &access_table, ++ .wr_table = &access_table, + .max_register = 0x2ac, + }; + diff --git a/queue-4.17/soc-imx-gpcv2-correct-pgc-offset.patch b/queue-4.17/soc-imx-gpcv2-correct-pgc-offset.patch new file mode 100644 index 00000000000..23b06254d7a --- /dev/null +++ b/queue-4.17/soc-imx-gpcv2-correct-pgc-offset.patch @@ -0,0 +1,58 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Anson Huang +Date: Wed, 30 May 2018 09:30:42 +0800 +Subject: soc: imx: gpcv2: correct PGC offset + +From: Anson Huang + +[ Upstream commit 3637f12faf507b0a4b8ac1e7115fc99583ab1db3 ] + +Correct MIPI/PCIe/USB_HSIC's PGC offset based on +design RTL, the values in the Reference Manual +(Rev. 1, 01/2018 and the older ones) are incorrect. + +The correct offset values should be as below: + +0x800 ~ 0x83F: PGC for core0 of A7 platform; +0x840 ~ 0x87F: PGC for core1 of A7 platform; +0x880 ~ 0x8BF: PGC for SCU of A7 platform; +0xA00 ~ 0xA3F: PGC for fastmix/megamix; +0xC00 ~ 0xC3F: PGC for MIPI PHY; +0xC40 ~ 0xC7F: PGC for PCIe_PHY; +0xC80 ~ 0xCBF: PGC for USB OTG1 PHY; +0xCC0 ~ 0xCFF: PGC for USB OTG2 PHY; +0xD00 ~ 0xD3F: PGC for USB HSIC PHY; + +Signed-off-by: Anson Huang +Fixes: 03aa12629fc4 ("soc: imx: Add GPCv2 power gating driver") +Acked-by: Andrey Smirnov +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/imx/gpcv2.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/soc/imx/gpcv2.c ++++ b/drivers/soc/imx/gpcv2.c +@@ -39,10 +39,15 @@ + + #define GPC_M4_PU_PDN_FLG 0x1bc + +- +-#define PGC_MIPI 4 +-#define PGC_PCIE 5 +-#define PGC_USB_HSIC 8 ++/* ++ * The PGC offset values in Reference Manual ++ * (Rev. 1, 01/2018 and the older ones) GPC chapter's ++ * GPC_PGC memory map are incorrect, below offset ++ * values are from design RTL. ++ */ ++#define PGC_MIPI 16 ++#define PGC_PCIE 17 ++#define PGC_USB_HSIC 20 + #define GPC_PGC_CTRL(n) (0x800 + (n) * 0x40) + #define GPC_PGC_SR(n) (GPC_PGC_CTRL(n) + 0xc) + diff --git a/queue-4.17/tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch b/queue-4.17/tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch new file mode 100644 index 00000000000..bc602d99533 --- /dev/null +++ b/queue-4.17/tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch @@ -0,0 +1,54 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Randy Dunlap +Date: Tue, 17 Jul 2018 18:27:45 -0700 +Subject: tcp: identify cryptic messages as TCP seq # bugs + +From: Randy Dunlap + +[ Upstream commit e56b8ce363a36fb7b74b80aaa5cc9084f2c908b4 ] + +Attempt to make cryptic TCP seq number error messages clearer by +(1) identifying the source of the message as "TCP", (2) identifying the +errors as "seq # bug", and (3) grouping the field identifiers and values +by separating them with commas. + +E.g., the following message is changed from: + +recvmsg bug 2: copied 73BCB6CD seq 70F17CBE rcvnxt 73BCB9AA fl 0 +WARNING: CPU: 2 PID: 1501 at /linux/net/ipv4/tcp.c:1881 tcp_recvmsg+0x649/0xb90 + +to: + +TCP recvmsg seq # bug 2: copied 73BCB6CD, seq 70F17CBE, rcvnxt 73BCB9AA, fl 0 +WARNING: CPU: 2 PID: 1501 at /linux/net/ipv4/tcp.c:2011 tcp_recvmsg+0x694/0xba0 + +Suggested-by: 積丹尼 Dan Jacobson +Signed-off-by: Randy Dunlap +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1845,7 +1845,7 @@ int tcp_recvmsg(struct sock *sk, struct + * shouldn't happen. + */ + if (WARN(before(*seq, TCP_SKB_CB(skb)->seq), +- "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n", ++ "TCP recvmsg seq # bug: copied %X, seq %X, rcvnxt %X, fl %X\n", + *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, + flags)) + break; +@@ -1860,7 +1860,7 @@ int tcp_recvmsg(struct sock *sk, struct + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) + goto found_fin_ok; + WARN(!(flags & MSG_PEEK), +- "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n", ++ "TCP recvmsg seq # bug 2: copied %X, seq %X, rcvnxt %X, fl %X\n", + *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags); + } + diff --git a/queue-4.17/tcp-remove-delayed-ack-events-in-dctcp.patch b/queue-4.17/tcp-remove-delayed-ack-events-in-dctcp.patch new file mode 100644 index 00000000000..64525a3546a --- /dev/null +++ b/queue-4.17/tcp-remove-delayed-ack-events-in-dctcp.patch @@ -0,0 +1,111 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Yuchung Cheng +Date: Thu, 12 Jul 2018 06:04:53 -0700 +Subject: tcp: remove DELAYED ACK events in DCTCP + +From: Yuchung Cheng + +[ Upstream commit a69258f7aa2623e0930212f09c586fd06674ad79 ] + +After fixing the way DCTCP tracking delayed ACKs, the delayed-ACK +related callbacks are no longer needed + +Signed-off-by: Yuchung Cheng +Signed-off-by: Eric Dumazet +Acked-by: Neal Cardwell +Acked-by: Lawrence Brakmo +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/tcp.h | 2 -- + net/ipv4/tcp_dctcp.c | 25 ------------------------- + net/ipv4/tcp_output.c | 4 ---- + 3 files changed, 31 deletions(-) + +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -907,8 +907,6 @@ enum tcp_ca_event { + CA_EVENT_LOSS, /* loss timeout */ + CA_EVENT_ECN_NO_CE, /* ECT set, but not CE marked */ + CA_EVENT_ECN_IS_CE, /* received CE marked IP packet */ +- CA_EVENT_DELAYED_ACK, /* Delayed ack is sent */ +- CA_EVENT_NON_DELAYED_ACK, + }; + + /* Information about inbound ACK, passed to cong_ops->in_ack_event() */ +--- a/net/ipv4/tcp_dctcp.c ++++ b/net/ipv4/tcp_dctcp.c +@@ -55,7 +55,6 @@ struct dctcp { + u32 dctcp_alpha; + u32 next_seq; + u32 ce_state; +- u32 delayed_ack_reserved; + u32 loss_cwnd; + }; + +@@ -96,7 +95,6 @@ static void dctcp_init(struct sock *sk) + + ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA); + +- ca->delayed_ack_reserved = 0; + ca->loss_cwnd = 0; + ca->ce_state = 0; + +@@ -230,25 +228,6 @@ static void dctcp_state(struct sock *sk, + } + } + +-static void dctcp_update_ack_reserved(struct sock *sk, enum tcp_ca_event ev) +-{ +- struct dctcp *ca = inet_csk_ca(sk); +- +- switch (ev) { +- case CA_EVENT_DELAYED_ACK: +- if (!ca->delayed_ack_reserved) +- ca->delayed_ack_reserved = 1; +- break; +- case CA_EVENT_NON_DELAYED_ACK: +- if (ca->delayed_ack_reserved) +- ca->delayed_ack_reserved = 0; +- break; +- default: +- /* Don't care for the rest. */ +- break; +- } +-} +- + static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev) + { + switch (ev) { +@@ -258,10 +237,6 @@ static void dctcp_cwnd_event(struct sock + case CA_EVENT_ECN_NO_CE: + dctcp_ce_state_1_to_0(sk); + break; +- case CA_EVENT_DELAYED_ACK: +- case CA_EVENT_NON_DELAYED_ACK: +- dctcp_update_ack_reserved(sk, ev); +- break; + default: + /* Don't care for the rest. */ + break; +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3545,8 +3545,6 @@ void tcp_send_delayed_ack(struct sock *s + int ato = icsk->icsk_ack.ato; + unsigned long timeout; + +- tcp_ca_event(sk, CA_EVENT_DELAYED_ACK); +- + if (ato > TCP_DELACK_MIN) { + const struct tcp_sock *tp = tcp_sk(sk); + int max_ato = HZ / 2; +@@ -3603,8 +3601,6 @@ void __tcp_send_ack(struct sock *sk, u32 + if (sk->sk_state == TCP_CLOSE) + return; + +- tcp_ca_event(sk, CA_EVENT_NON_DELAYED_ACK); +- + /* We are not putting this on the write queue, so + * tcp_transmit_skb() will set the ownership to this + * sock. diff --git a/queue-4.17/tipc-correct-discovery-message-handling-during-address-trial-period.patch b/queue-4.17/tipc-correct-discovery-message-handling-during-address-trial-period.patch new file mode 100644 index 00000000000..45e0ad66f21 --- /dev/null +++ b/queue-4.17/tipc-correct-discovery-message-handling-during-address-trial-period.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jon Maloy +Date: Fri, 6 Jul 2018 20:10:04 +0200 +Subject: tipc: correct discovery message handling during address trial period + +From: Jon Maloy + +[ Upstream commit e415577f57f4452150642500364cbe5fa6112813 ] + +With the duplicate address discovery protocol for tipc nodes addresses +we introduced a one second trial period before a node is allocated a +hash number to use as address. + +Unfortunately, we miss to handle the case when a regular LINK REQUEST/ +RESPONSE arrives from a cluster node during the trial period. Such +messages are not ignored as they should be, leading to links setup +attempts while the node still has no address. + +Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash values") +Signed-off-by: Jon Maloy +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/discover.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/tipc/discover.c ++++ b/net/tipc/discover.c +@@ -133,6 +133,8 @@ static void disc_dupl_alert(struct tipc_ + } + + /* tipc_disc_addr_trial(): - handle an address uniqueness trial from peer ++ * Returns true if message should be dropped by caller, i.e., if it is a ++ * trial message or we are inside trial period. Otherwise false. + */ + static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d, + struct tipc_media_addr *maddr, +@@ -168,8 +170,9 @@ static bool tipc_disc_addr_trial_msg(str + msg_set_type(buf_msg(d->skb), DSC_REQ_MSG); + } + ++ /* Accept regular link requests/responses only after trial period */ + if (mtyp != DSC_TRIAL_MSG) +- return false; ++ return trial; + + sugg_addr = tipc_node_try_addr(net, peer_id, src); + if (sugg_addr) diff --git a/queue-4.17/tipc-fix-correct-setting-of-message-type-in-second-discoverer.patch b/queue-4.17/tipc-fix-correct-setting-of-message-type-in-second-discoverer.patch new file mode 100644 index 00000000000..7955aad3c36 --- /dev/null +++ b/queue-4.17/tipc-fix-correct-setting-of-message-type-in-second-discoverer.patch @@ -0,0 +1,58 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jon Maloy +Date: Fri, 6 Jul 2018 20:10:05 +0200 +Subject: tipc: fix correct setting of message type in second discoverer + +From: Jon Maloy + +[ Upstream commit 92018c7ca959ccd346d6235dac03cf7fc1ba51f7 ] + +The duplicate address discovery protocol is not safe against two +discoverers running in parallel. The one executing first after the +trial period is over will set the node address and change its own +message type to DSC_REQ_MSG. The one executing last may find that the +node address is already set, and never change message type, with the +result that its links may never be established. + +In this commmit we ensure that the message type always is set correctly +after the trial period is over. + +Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash values") +Signed-off-by: Jon Maloy +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/discover.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/net/tipc/discover.c ++++ b/net/tipc/discover.c +@@ -287,7 +287,6 @@ static void tipc_disc_timeout(struct tim + { + struct tipc_discoverer *d = from_timer(d, t, timer); + struct tipc_net *tn = tipc_net(d->net); +- u32 self = tipc_own_addr(d->net); + struct tipc_media_addr maddr; + struct sk_buff *skb = NULL; + struct net *net = d->net; +@@ -301,12 +300,14 @@ static void tipc_disc_timeout(struct tim + goto exit; + } + +- /* Did we just leave the address trial period ? */ +- if (!self && !time_before(jiffies, tn->addr_trial_end)) { +- self = tn->trial_addr; +- tipc_net_finalize(net, self); +- msg_set_prevnode(buf_msg(d->skb), self); ++ /* Trial period over ? */ ++ if (!time_before(jiffies, tn->addr_trial_end)) { ++ /* Did we just leave it ? */ ++ if (!tipc_own_addr(net)) ++ tipc_net_finalize(net, tn->trial_addr); ++ + msg_set_type(buf_msg(d->skb), DSC_REQ_MSG); ++ msg_set_prevnode(buf_msg(d->skb), tipc_own_addr(net)); + } + + /* Adjust timeout interval according to discovery phase */ diff --git a/queue-4.17/tipc-fix-wrong-return-value-from-function-tipc_node_try_addr.patch b/queue-4.17/tipc-fix-wrong-return-value-from-function-tipc_node_try_addr.patch new file mode 100644 index 00000000000..ef6b173dce5 --- /dev/null +++ b/queue-4.17/tipc-fix-wrong-return-value-from-function-tipc_node_try_addr.patch @@ -0,0 +1,53 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jon Maloy +Date: Fri, 6 Jul 2018 20:10:03 +0200 +Subject: tipc: fix wrong return value from function tipc_node_try_addr() + +From: Jon Maloy + +[ Upstream commit 2a57f182420174c7fd4b19db979a2d135231a963 ] + +The function for checking if there is an node address conflict is +supposed to return a suggestion for a new address if it finds a +conflict, and zero otherwise. But in case the peer being checked +is previously unknown it does instead return a "suggestion" for +the checked address itself. This results in a DSC_TRIAL_FAIL_MSG +being sent unecessarily to the peer, and sometimes makes the trial +period starting over again. + +Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash values") +Signed-off-by: Jon Maloy +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/node.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/net/tipc/node.c ++++ b/net/tipc/node.c +@@ -776,6 +776,7 @@ static u32 tipc_node_suggest_addr(struct + } + + /* tipc_node_try_addr(): Check if addr can be used by peer, suggest other if not ++ * Returns suggested address if any, otherwise 0 + */ + u32 tipc_node_try_addr(struct net *net, u8 *id, u32 addr) + { +@@ -798,12 +799,14 @@ u32 tipc_node_try_addr(struct net *net, + if (n) { + addr = n->addr; + tipc_node_put(n); ++ return addr; + } +- /* Even this node may be in trial phase */ ++ ++ /* Even this node may be in conflict */ + if (tn->trial_addr == addr) + return tipc_node_suggest_addr(net, addr); + +- return addr; ++ return 0; + } + + void tipc_node_check_dest(struct net *net, u32 addr, diff --git a/queue-4.17/tipc-make-function-tipc_net_finalize-thread-safe.patch b/queue-4.17/tipc-make-function-tipc_net_finalize-thread-safe.patch new file mode 100644 index 00000000000..7788fcf1bd9 --- /dev/null +++ b/queue-4.17/tipc-make-function-tipc_net_finalize-thread-safe.patch @@ -0,0 +1,48 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Jon Maloy +Date: Fri, 6 Jul 2018 20:10:06 +0200 +Subject: tipc: make function tipc_net_finalize() thread safe + +From: Jon Maloy + +[ Upstream commit 9faa89d4ed9d7d326f4763d262842270450f9b1f ] + +The setting of the node address is not thread safe, meaning that +two discoverers may decide to set it simultanously, with a duplicate +entry in the name table as result. We fix that with this commit. + +Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash values") +Signed-off-by: Jon Maloy +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/net.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/net/tipc/net.c ++++ b/net/tipc/net.c +@@ -121,12 +121,17 @@ int tipc_net_init(struct net *net, u8 *n + + void tipc_net_finalize(struct net *net, u32 addr) + { +- tipc_set_node_addr(net, addr); +- smp_mb(); +- tipc_named_reinit(net); +- tipc_sk_reinit(net); +- tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr, +- TIPC_CLUSTER_SCOPE, 0, addr); ++ struct tipc_net *tn = tipc_net(net); ++ ++ spin_lock_bh(&tn->node_list_lock); ++ if (!tipc_own_addr(net)) { ++ tipc_set_node_addr(net, addr); ++ tipc_named_reinit(net); ++ tipc_sk_reinit(net); ++ tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr, ++ TIPC_CLUSTER_SCOPE, 0, addr); ++ } ++ spin_unlock_bh(&tn->node_list_lock); + } + + void tipc_net_stop(struct net *net) diff --git a/queue-4.17/tls-fix-skb_to_sgvec-returning-unhandled-error.patch b/queue-4.17/tls-fix-skb_to_sgvec-returning-unhandled-error.patch new file mode 100644 index 00000000000..f853ba97247 --- /dev/null +++ b/queue-4.17/tls-fix-skb_to_sgvec-returning-unhandled-error.patch @@ -0,0 +1,47 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Doron Roberts-Kedes +Date: Mon, 2 Jul 2018 10:25:05 -0700 +Subject: tls: fix skb_to_sgvec returning unhandled error. + +From: Doron Roberts-Kedes + +[ Upstream commit 52ee6ef36ee10dd493cf2067311e56ca8015eb8d ] + +The current code does not inspect the return value of skb_to_sgvec. This +can cause a nullptr kernel panic when the malformed sgvec is passed into +the crypto request. + +Checking the return value of skb_to_sgvec and skipping decryption if it +is negative fixes this problem. + +Fixes: c46234ebb4d1 ("tls: RX path for ktls") +Acked-by: Dave Watson +Signed-off-by: Doron Roberts-Kedes +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/tls/tls_sw.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -705,6 +705,10 @@ static int decrypt_skb(struct sock *sk, + nsg = skb_to_sgvec(skb, &sgin[1], + rxm->offset + tls_ctx->rx.prepend_size, + rxm->full_len - tls_ctx->rx.prepend_size); ++ if (nsg < 0) { ++ ret = nsg; ++ goto out; ++ } + + tls_make_aad(ctx->rx_aad_ciphertext, + rxm->full_len - tls_ctx->rx.overhead_size, +@@ -716,6 +720,7 @@ static int decrypt_skb(struct sock *sk, + rxm->full_len - tls_ctx->rx.overhead_size, + skb, sk->sk_allocation); + ++out: + if (sgin != &sgin_arr[0]) + kfree(sgin); + diff --git a/queue-4.17/tools-build-fixup-host-c-flags.patch b/queue-4.17/tools-build-fixup-host-c-flags.patch new file mode 100644 index 00000000000..c1d5e056f7b --- /dev/null +++ b/queue-4.17/tools-build-fixup-host-c-flags.patch @@ -0,0 +1,43 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Laura Abbott +Date: Mon, 9 Jul 2018 17:45:56 -0700 +Subject: tools: build: Fixup host c flags + +From: Laura Abbott + +[ Upstream commit 6fdbd824fd7a3876aac43d32fdf1f30b9ef72ce4 ] + +Commit 0c3b7e42616f ("tools build: Add support for host programs format") +introduced host_c_flags which referenced CHOSTFLAGS. The actual name of the +variable is HOSTCFLAGS. Fix this up. + +Fixes: 0c3b7e42616f ("tools build: Add support for host programs format") +Signed-off-by: Laura Abbott +Acked-by: Jiri Olsa +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/build/Build.include | 2 +- + tools/perf/pmu-events/Build | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/build/Build.include ++++ b/tools/build/Build.include +@@ -98,4 +98,4 @@ cxx_flags = -Wp,-MD,$(depfile) -Wp,-MT,$ + ### + ## HOSTCC C flags + +-host_c_flags = -Wp,-MD,$(depfile) -Wp,-MT,$@ $(CHOSTFLAGS) -D"BUILD_STR(s)=\#s" $(CHOSTFLAGS_$(basetarget).o) $(CHOSTFLAGS_$(obj)) ++host_c_flags = -Wp,-MD,$(depfile) -Wp,-MT,$@ $(HOSTCFLAGS) -D"BUILD_STR(s)=\#s" $(HOSTCFLAGS_$(basetarget).o) $(HOSTCFLAGS_$(obj)) +--- a/tools/perf/pmu-events/Build ++++ b/tools/perf/pmu-events/Build +@@ -1,7 +1,7 @@ + hostprogs := jevents + + jevents-y += json.o jsmn.o jevents.o +-CHOSTFLAGS_jevents.o = -I$(srctree)/tools/include ++HOSTCFLAGS_jevents.o = -I$(srctree)/tools/include + pmu-events-y += pmu-events.o + JDIR = pmu-events/arch/$(SRCARCH) + JSON = $(shell [ -d $(JDIR) ] && \ diff --git a/queue-4.17/tools-build-use-hostldflags-with-fixdep.patch b/queue-4.17/tools-build-use-hostldflags-with-fixdep.patch new file mode 100644 index 00000000000..3e82d5d1b61 --- /dev/null +++ b/queue-4.17/tools-build-use-hostldflags-with-fixdep.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Laura Abbott +Date: Mon, 9 Jul 2018 17:45:57 -0700 +Subject: tools: build: Use HOSTLDFLAGS with fixdep + +From: Laura Abbott + +[ Upstream commit 8b247a92ebd0cda7dec49a6f771d9c4950f3d3ad ] + +The final link of fixdep uses LDFLAGS but not the existing HOSTLDFLAGS. +Fix this. + +Signed-off-by: Laura Abbott +Acked-by: Jiri Olsa +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/build/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/build/Makefile ++++ b/tools/build/Makefile +@@ -43,7 +43,7 @@ $(OUTPUT)fixdep-in.o: FORCE + $(Q)$(MAKE) $(build)=fixdep + + $(OUTPUT)fixdep: $(OUTPUT)fixdep-in.o +- $(QUIET_LINK)$(HOSTCC) $(LDFLAGS) -o $@ $< ++ $(QUIET_LINK)$(HOSTCC) $(HOSTLDFLAGS) -o $@ $< + + FORCE: + diff --git a/queue-4.17/tools-include-uapi-update-if_link.h-to-pick-ifla_-brport_isolated-vxlan_ttl_inherit.patch b/queue-4.17/tools-include-uapi-update-if_link.h-to-pick-ifla_-brport_isolated-vxlan_ttl_inherit.patch new file mode 100644 index 00000000000..6de40eeb8a4 --- /dev/null +++ b/queue-4.17/tools-include-uapi-update-if_link.h-to-pick-ifla_-brport_isolated-vxlan_ttl_inherit.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Arnaldo Carvalho de Melo +Date: Fri, 15 Jun 2018 16:46:57 -0300 +Subject: tools include uapi: Update if_link.h to pick IFLA_{BRPORT_ISOLATED,VXLAN_TTL_INHERIT} + +From: Arnaldo Carvalho de Melo + +[ Upstream commit bb9a33cb8a807e5ae9906563f5c1533904651b8b ] + +The IFLA_BRPORT_ISOLATED and IFLA_VXLAN_TTL_INHERIT defines were added in: + + 7d850abd5f4e ("net: bridge: add support for port isolation") + 72f6d71e491e ("vxlan: add ttl inherit support") + +Pick them, silencing this build warning: + + Warning: Kernel ABI header at 'tools/include/uapi/linux/if_link.h' differs from latest version at 'include/uapi/linux/if_link.h' + +Cc: Alexei Starovoitov +Cc: David S. Miller +Cc: Eric Leblond +Cc: Hangbin Liu +Cc: Nikolay Aleksandrov +Link: https://lkml.kernel.org/n/tip-ezi5u0mmdqm0wfm0y2y8176r@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/include/uapi/linux/if_link.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/tools/include/uapi/linux/if_link.h ++++ b/tools/include/uapi/linux/if_link.h +@@ -333,6 +333,7 @@ enum { + IFLA_BRPORT_BCAST_FLOOD, + IFLA_BRPORT_GROUP_FWD_MASK, + IFLA_BRPORT_NEIGH_SUPPRESS, ++ IFLA_BRPORT_ISOLATED, + __IFLA_BRPORT_MAX + }; + #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1) +@@ -516,6 +517,7 @@ enum { + IFLA_VXLAN_COLLECT_METADATA, + IFLA_VXLAN_LABEL, + IFLA_VXLAN_GPE, ++ IFLA_VXLAN_TTL_INHERIT, + __IFLA_VXLAN_MAX + }; + #define IFLA_VXLAN_MAX (__IFLA_VXLAN_MAX - 1) diff --git a/queue-4.17/tools-testing-nvdimm-advertise-a-write-cache-for-nfit_test.patch b/queue-4.17/tools-testing-nvdimm-advertise-a-write-cache-for-nfit_test.patch new file mode 100644 index 00000000000..6f737272844 --- /dev/null +++ b/queue-4.17/tools-testing-nvdimm-advertise-a-write-cache-for-nfit_test.patch @@ -0,0 +1,38 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Vishal Verma +Date: Mon, 18 Jun 2018 17:17:02 -0600 +Subject: tools/testing/nvdimm: advertise a write cache for nfit_test + +From: Vishal Verma + +[ Upstream commit 1273c253c32b9a073a4d8921ed079177ccc7c8af ] + +Commit 546eb0317cfa "libnvdimm, pmem: Do not flush power-fail protected CPU caches" +fixed the write_cache detection to correctly show the lack of a write +cache based on the platform capabilities described in the ACPI NFIT. The +nfit_test unit tests expected a write cache to be present, so change the +nfit test namespaces to only advertise a persistence domain limited to +the memory controller. This allows the kernel to show a write_cache +attribute, and the test behaviour remains unchanged. + +Signed-off-by: Vishal Verma +Reviewed-by: Ross Zwisler +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/nvdimm/test/nfit.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/tools/testing/nvdimm/test/nfit.c ++++ b/tools/testing/nvdimm/test/nfit.c +@@ -1989,8 +1989,7 @@ static void nfit_test0_setup(struct nfit + pcap->header.type = ACPI_NFIT_TYPE_CAPABILITIES; + pcap->header.length = sizeof(*pcap); + pcap->highest_capability = 1; +- pcap->capabilities = ACPI_NFIT_CAPABILITY_CACHE_FLUSH | +- ACPI_NFIT_CAPABILITY_MEM_FLUSH; ++ pcap->capabilities = ACPI_NFIT_CAPABILITY_MEM_FLUSH; + offset += pcap->header.length; + + if (t->setup_hotplug) { diff --git a/queue-4.17/tracing-use-__printf-markup-to-silence-compiler.patch b/queue-4.17/tracing-use-__printf-markup-to-silence-compiler.patch new file mode 100644 index 00000000000..899fa7d1e7f --- /dev/null +++ b/queue-4.17/tracing-use-__printf-markup-to-silence-compiler.patch @@ -0,0 +1,69 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Mathieu Malaterre +Date: Thu, 8 Mar 2018 21:58:43 +0100 +Subject: tracing: Use __printf markup to silence compiler + +From: Mathieu Malaterre + +[ Upstream commit 26b68dd2f48fe7699a89f0cfbb9f4a650dc1c837 ] + +Silence warnings (triggered at W=1) by adding relevant __printf attributes. + + CC kernel/trace/trace.o +kernel/trace/trace.c: In function ‘__trace_array_vprintk’: +kernel/trace/trace.c:2979:2: warning: function might be possible candidate for ‘gnu_printf’ format attribute [-Wsuggest-attribute=format] + len = vscnprintf(tbuffer, TRACE_BUF_SIZE, fmt, args); + ^~~ + AR kernel/trace/built-in.o + +Link: http://lkml.kernel.org/r/20180308205843.27447-1-malat@debian.org + +Signed-off-by: Mathieu Malaterre +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -2962,6 +2962,7 @@ out_nobuffer: + } + EXPORT_SYMBOL_GPL(trace_vbprintk); + ++__printf(3, 0) + static int + __trace_array_vprintk(struct ring_buffer *buffer, + unsigned long ip, const char *fmt, va_list args) +@@ -3016,12 +3017,14 @@ out_nobuffer: + return len; + } + ++__printf(3, 0) + int trace_array_vprintk(struct trace_array *tr, + unsigned long ip, const char *fmt, va_list args) + { + return __trace_array_vprintk(tr->trace_buffer.buffer, ip, fmt, args); + } + ++__printf(3, 0) + int trace_array_printk(struct trace_array *tr, + unsigned long ip, const char *fmt, ...) + { +@@ -3037,6 +3040,7 @@ int trace_array_printk(struct trace_arra + return ret; + } + ++__printf(3, 4) + int trace_array_printk_buf(struct ring_buffer *buffer, + unsigned long ip, const char *fmt, ...) + { +@@ -3052,6 +3056,7 @@ int trace_array_printk_buf(struct ring_b + return ret; + } + ++__printf(2, 0) + int trace_vprintk(unsigned long ip, const char *fmt, va_list args) + { + return trace_array_vprintk(&global_trace, ip, fmt, args); diff --git a/queue-4.17/typec-tcpm-fix-a-msecs-vs-jiffies-bug.patch b/queue-4.17/typec-tcpm-fix-a-msecs-vs-jiffies-bug.patch new file mode 100644 index 00000000000..54cb8c7b3dd --- /dev/null +++ b/queue-4.17/typec-tcpm-fix-a-msecs-vs-jiffies-bug.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dan Carpenter +Date: Thu, 7 Jun 2018 16:17:14 +0300 +Subject: typec: tcpm: Fix a msecs vs jiffies bug + +From: Dan Carpenter + +[ Upstream commit 9578bcd0bb487b8ecef4b7eee799aafb678aa441 ] + +The tcpm_set_state() function take msecs not jiffies. + +Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)") +Signed-off-by: Dan Carpenter +Acked-by: Heikki Krogerus +Reviewed-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/typec/tcpm.c ++++ b/drivers/usb/typec/tcpm.c +@@ -2543,7 +2543,8 @@ static void run_state_machine(struct tcp + tcpm_port_is_sink(port) && + time_is_after_jiffies(port->delayed_runtime)) { + tcpm_set_state(port, SNK_DISCOVERY, +- port->delayed_runtime - jiffies); ++ jiffies_to_msecs(port->delayed_runtime - ++ jiffies)); + break; + } + tcpm_set_state(port, unattached_state(port), 0); diff --git a/queue-4.17/usb-chipidea-host-fix-disconnection-detect-issue.patch b/queue-4.17/usb-chipidea-host-fix-disconnection-detect-issue.patch new file mode 100644 index 00000000000..9824a15d1ad --- /dev/null +++ b/queue-4.17/usb-chipidea-host-fix-disconnection-detect-issue.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Peter Chen +Date: Wed, 6 Jun 2018 09:43:27 +0800 +Subject: usb: chipidea: host: fix disconnection detect issue + +From: Peter Chen + +[ Upstream commit 90f26cc6bb90b35040f4da0347f480ea9df6e2fc ] + +The commit 4e88d4c08301 ("usb: add a flag to skip PHY +initialization to struct usb_hcd") delete the assignment +for hcd->usb_phy, it causes usb_phy_notify_connect{disconnect) +are not called, the USB PHY driver is not notified of hot plug +event, then the disconnection will not be detected by hardware. + +Fixes: 4e88d4c08301 ("usb: add a flag to skip PHY initialization + to struct usb_hcd") +Acked-by: Martin Blumenstingl +Reported-by: Mats Karrman +Tested-by: Mats Karrman +Signed-off-by: Peter Chen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/chipidea/host.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/usb/chipidea/host.c ++++ b/drivers/usb/chipidea/host.c +@@ -124,8 +124,11 @@ static int host_start(struct ci_hdrc *ci + + hcd->power_budget = ci->platdata->power_budget; + hcd->tpl_support = ci->platdata->tpl_support; +- if (ci->phy || ci->usb_phy) ++ if (ci->phy || ci->usb_phy) { + hcd->skip_phy_initialization = 1; ++ if (ci->usb_phy) ++ hcd->usb_phy = ci->usb_phy; ++ } + + ehci = hcd_to_ehci(hcd); + ehci->caps = ci->hw_bank.cap; diff --git a/queue-4.17/usb-dwc2-alloc-dma-aligned-buffer-for-isoc-split-in.patch b/queue-4.17/usb-dwc2-alloc-dma-aligned-buffer-for-isoc-split-in.patch new file mode 100644 index 00000000000..30e3700938b --- /dev/null +++ b/queue-4.17/usb-dwc2-alloc-dma-aligned-buffer-for-isoc-split-in.patch @@ -0,0 +1,282 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: William Wu +Date: Fri, 11 May 2018 17:46:31 +0800 +Subject: usb: dwc2: alloc dma aligned buffer for isoc split in + +From: William Wu + +[ Upstream commit af424a410749ed7e0c2bffd3cedbc7c274d0ff6f ] + +The commit 3bc04e28a030 ("usb: dwc2: host: Get aligned DMA in +a more supported way") rips out a lot of code to simply the +allocation of aligned DMA. However, it also introduces a new +issue when use isoc split in transfer. + +In my test case, I connect the dwc2 controller with an usb hs +Hub (GL852G-12), and plug an usb fs audio device (Plantronics +headset) into the downstream port of Hub. Then use the usb mic +to record, we can find noise when playback. + +It's because that the usb Hub uses an MDATA for the first +transaction and a DATA0 for the second transaction for the isoc +split in transaction. An typical isoc split in transaction sequence +like this: + +- SSPLIT IN transaction +- CSPLIT IN transaction + - MDATA packet +- CSPLIT IN transaction + - DATA0 packet + +The DMA address of MDATA (urb->dma) is always DWORD-aligned, but +the DMA address of DATA0 (urb->dma + qtd->isoc_split_offset) may +not be DWORD-aligned, it depends on the qtd->isoc_split_offset (the +length of MDATA). In my test case, the length of MDATA is usually +unaligned, this cause DATA0 packet transmission error. + +This patch use kmem_cache to allocate aligned DMA buf for isoc +split in transaction. Note that according to usb 2.0 spec, the +maximum data payload size is 1023 bytes for each fs isoc ep, +and the maximum allowable interrupt data payload size is 64 bytes +or less for fs interrupt ep. So we set the size of object to be +1024 bytes in the kmem cache. + +Tested-by: Gevorg Sahakyan +Tested-by: Heiko Stuebner +Acked-by: Minas Harutyunyan hminas@synopsys.com> +Signed-off-by: William Wu +Reviewed-by: Douglas Anderson +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/core.h | 3 + + drivers/usb/dwc2/hcd.c | 89 ++++++++++++++++++++++++++++++++++++++++--- + drivers/usb/dwc2/hcd.h | 8 +++ + drivers/usb/dwc2/hcd_intr.c | 8 +++ + drivers/usb/dwc2/hcd_queue.c | 3 + + 5 files changed, 106 insertions(+), 5 deletions(-) + +--- a/drivers/usb/dwc2/core.h ++++ b/drivers/usb/dwc2/core.h +@@ -915,6 +915,7 @@ struct dwc2_hregs_backup { + * @frame_list_sz: Frame list size + * @desc_gen_cache: Kmem cache for generic descriptors + * @desc_hsisoc_cache: Kmem cache for hs isochronous descriptors ++ * @unaligned_cache: Kmem cache for DMA mode to handle non-aligned buf + * + * These are for peripheral mode: + * +@@ -1061,6 +1062,8 @@ struct dwc2_hsotg { + u32 frame_list_sz; + struct kmem_cache *desc_gen_cache; + struct kmem_cache *desc_hsisoc_cache; ++ struct kmem_cache *unaligned_cache; ++#define DWC2_KMEM_UNALIGNED_BUF_SIZE 1024 + + #endif /* CONFIG_USB_DWC2_HOST || CONFIG_USB_DWC2_DUAL_ROLE */ + +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -1567,11 +1567,20 @@ static void dwc2_hc_start_transfer(struc + } + + if (hsotg->params.host_dma) { +- dwc2_writel((u32)chan->xfer_dma, +- hsotg->regs + HCDMA(chan->hc_num)); ++ dma_addr_t dma_addr; ++ ++ if (chan->align_buf) { ++ if (dbg_hc(chan)) ++ dev_vdbg(hsotg->dev, "align_buf\n"); ++ dma_addr = chan->align_buf; ++ } else { ++ dma_addr = chan->xfer_dma; ++ } ++ dwc2_writel((u32)dma_addr, hsotg->regs + HCDMA(chan->hc_num)); ++ + if (dbg_hc(chan)) + dev_vdbg(hsotg->dev, "Wrote %08lx to HCDMA(%d)\n", +- (unsigned long)chan->xfer_dma, chan->hc_num); ++ (unsigned long)dma_addr, chan->hc_num); + } + + /* Start the split */ +@@ -2625,6 +2634,35 @@ static void dwc2_hc_init_xfer(struct dwc + } + } + ++static int dwc2_alloc_split_dma_aligned_buf(struct dwc2_hsotg *hsotg, ++ struct dwc2_qh *qh, ++ struct dwc2_host_chan *chan) ++{ ++ if (!hsotg->unaligned_cache || ++ chan->max_packet > DWC2_KMEM_UNALIGNED_BUF_SIZE) ++ return -ENOMEM; ++ ++ if (!qh->dw_align_buf) { ++ qh->dw_align_buf = kmem_cache_alloc(hsotg->unaligned_cache, ++ GFP_ATOMIC | GFP_DMA); ++ if (!qh->dw_align_buf) ++ return -ENOMEM; ++ } ++ ++ qh->dw_align_buf_dma = dma_map_single(hsotg->dev, qh->dw_align_buf, ++ DWC2_KMEM_UNALIGNED_BUF_SIZE, ++ DMA_FROM_DEVICE); ++ ++ if (dma_mapping_error(hsotg->dev, qh->dw_align_buf_dma)) { ++ dev_err(hsotg->dev, "can't map align_buf\n"); ++ chan->align_buf = 0; ++ return -EINVAL; ++ } ++ ++ chan->align_buf = qh->dw_align_buf_dma; ++ return 0; ++} ++ + #define DWC2_USB_DMA_ALIGN 4 + + static void dwc2_free_dma_aligned_buffer(struct urb *urb) +@@ -2804,6 +2842,32 @@ static int dwc2_assign_and_init_hc(struc + /* Set the transfer attributes */ + dwc2_hc_init_xfer(hsotg, chan, qtd); + ++ /* For non-dword aligned buffers */ ++ if (hsotg->params.host_dma && qh->do_split && ++ chan->ep_is_in && (chan->xfer_dma & 0x3)) { ++ dev_vdbg(hsotg->dev, "Non-aligned buffer\n"); ++ if (dwc2_alloc_split_dma_aligned_buf(hsotg, qh, chan)) { ++ dev_err(hsotg->dev, ++ "Failed to allocate memory to handle non-aligned buffer\n"); ++ /* Add channel back to free list */ ++ chan->align_buf = 0; ++ chan->multi_count = 0; ++ list_add_tail(&chan->hc_list_entry, ++ &hsotg->free_hc_list); ++ qtd->in_process = 0; ++ qh->channel = NULL; ++ return -ENOMEM; ++ } ++ } else { ++ /* ++ * We assume that DMA is always aligned in non-split ++ * case or split out case. Warn if not. ++ */ ++ WARN_ON_ONCE(hsotg->params.host_dma && ++ (chan->xfer_dma & 0x3)); ++ chan->align_buf = 0; ++ } ++ + if (chan->ep_type == USB_ENDPOINT_XFER_INT || + chan->ep_type == USB_ENDPOINT_XFER_ISOC) + /* +@@ -5248,6 +5312,19 @@ int dwc2_hcd_init(struct dwc2_hsotg *hso + } + } + ++ if (hsotg->params.host_dma) { ++ /* ++ * Create kmem caches to handle non-aligned buffer ++ * in Buffer DMA mode. ++ */ ++ hsotg->unaligned_cache = kmem_cache_create("dwc2-unaligned-dma", ++ DWC2_KMEM_UNALIGNED_BUF_SIZE, 4, ++ SLAB_CACHE_DMA, NULL); ++ if (!hsotg->unaligned_cache) ++ dev_err(hsotg->dev, ++ "unable to create dwc2 unaligned cache\n"); ++ } ++ + hsotg->otg_port = 1; + hsotg->frame_list = NULL; + hsotg->frame_list_dma = 0; +@@ -5282,8 +5359,9 @@ int dwc2_hcd_init(struct dwc2_hsotg *hso + return 0; + + error4: +- kmem_cache_destroy(hsotg->desc_gen_cache); ++ kmem_cache_destroy(hsotg->unaligned_cache); + kmem_cache_destroy(hsotg->desc_hsisoc_cache); ++ kmem_cache_destroy(hsotg->desc_gen_cache); + error3: + dwc2_hcd_release(hsotg); + error2: +@@ -5324,8 +5402,9 @@ void dwc2_hcd_remove(struct dwc2_hsotg * + usb_remove_hcd(hcd); + hsotg->priv = NULL; + +- kmem_cache_destroy(hsotg->desc_gen_cache); ++ kmem_cache_destroy(hsotg->unaligned_cache); + kmem_cache_destroy(hsotg->desc_hsisoc_cache); ++ kmem_cache_destroy(hsotg->desc_gen_cache); + + dwc2_hcd_release(hsotg); + usb_put_hcd(hcd); +--- a/drivers/usb/dwc2/hcd.h ++++ b/drivers/usb/dwc2/hcd.h +@@ -76,6 +76,8 @@ struct dwc2_qh; + * (micro)frame + * @xfer_buf: Pointer to current transfer buffer position + * @xfer_dma: DMA address of xfer_buf ++ * @align_buf: In Buffer DMA mode this will be used if xfer_buf is not ++ * DWORD aligned + * @xfer_len: Total number of bytes to transfer + * @xfer_count: Number of bytes transferred so far + * @start_pkt_count: Packet count at start of transfer +@@ -133,6 +135,7 @@ struct dwc2_host_chan { + + u8 *xfer_buf; + dma_addr_t xfer_dma; ++ dma_addr_t align_buf; + u32 xfer_len; + u32 xfer_count; + u16 start_pkt_count; +@@ -303,6 +306,9 @@ struct dwc2_hs_transfer_time { + * is tightly packed. + * @ls_duration_us: Duration on the low speed bus schedule. + * @ntd: Actual number of transfer descriptors in a list ++ * @dw_align_buf: Used instead of original buffer if its physical address ++ * is not dword-aligned ++ * @dw_align_buf_dma: DMA address for dw_align_buf + * @qtd_list: List of QTDs for this QH + * @channel: Host channel currently processing transfers for this QH + * @qh_list_entry: Entry for QH in either the periodic or non-periodic +@@ -350,6 +356,8 @@ struct dwc2_qh { + struct dwc2_hs_transfer_time hs_transfers[DWC2_HS_SCHEDULE_UFRAMES]; + u32 ls_start_schedule_slice; + u16 ntd; ++ u8 *dw_align_buf; ++ dma_addr_t dw_align_buf_dma; + struct list_head qtd_list; + struct dwc2_host_chan *channel; + struct list_head qh_list_entry; +--- a/drivers/usb/dwc2/hcd_intr.c ++++ b/drivers/usb/dwc2/hcd_intr.c +@@ -938,6 +938,14 @@ static int dwc2_xfercomp_isoc_split_in(s + + frame_desc->actual_length += len; + ++ if (chan->align_buf) { ++ dev_vdbg(hsotg->dev, "non-aligned buffer\n"); ++ dma_unmap_single(hsotg->dev, chan->qh->dw_align_buf_dma, ++ DWC2_KMEM_UNALIGNED_BUF_SIZE, DMA_FROM_DEVICE); ++ memcpy(qtd->urb->buf + (chan->xfer_dma - qtd->urb->dma), ++ chan->qh->dw_align_buf, len); ++ } ++ + qtd->isoc_split_offset += len; + + hctsiz = dwc2_readl(hsotg->regs + HCTSIZ(chnum)); +--- a/drivers/usb/dwc2/hcd_queue.c ++++ b/drivers/usb/dwc2/hcd_queue.c +@@ -1695,6 +1695,9 @@ void dwc2_hcd_qh_free(struct dwc2_hsotg + + if (qh->desc_list) + dwc2_hcd_qh_free_ddma(hsotg, qh); ++ else if (hsotg->unaligned_cache && qh->dw_align_buf) ++ kmem_cache_free(hsotg->unaligned_cache, qh->dw_align_buf); ++ + kfree(qh); + } + diff --git a/queue-4.17/usb-dwc2-fix-host-exit-from-hibernation-flow.patch b/queue-4.17/usb-dwc2-fix-host-exit-from-hibernation-flow.patch new file mode 100644 index 00000000000..32a67693053 --- /dev/null +++ b/queue-4.17/usb-dwc2-fix-host-exit-from-hibernation-flow.patch @@ -0,0 +1,48 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Artur Petrosyan +Date: Wed, 23 May 2018 09:26:08 -0400 +Subject: usb: dwc2: Fix host exit from hibernation flow. + +From: Artur Petrosyan + +[ Upstream commit 22bb5cfdf13ae70c6a34508a16cfeee48f162443 ] + +In case when a hub is connected to DWC2 host +auto suspend occurs and host goes to +hibernation. When any device connected to hub +host hibernation exiting incorrectly. + +- Added dwc2_hcd_rem_wakeup() function call to + exit from suspend state by remote wakeup. + +- Increase timeout value for port suspend bit to be set. + +Acked-by: Minas Harutyunyan +Signed-off-by: Artur Petrosyan +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/hcd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -5437,7 +5437,7 @@ int dwc2_host_enter_hibernation(struct d + dwc2_writel(hprt0, hsotg->regs + HPRT0); + + /* Wait for the HPRT0.PrtSusp register field to be set */ +- if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 300)) ++ if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 3000)) + dev_warn(hsotg->dev, "Suspend wasn't generated\n"); + + /* +@@ -5618,6 +5618,8 @@ int dwc2_host_exit_hibernation(struct dw + return ret; + } + ++ dwc2_hcd_rem_wakeup(hsotg); ++ + hsotg->hibernated = 0; + hsotg->bus_suspended = 0; + hsotg->lx_state = DWC2_L0; diff --git a/queue-4.17/usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch b/queue-4.17/usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch new file mode 100644 index 00000000000..2dd9efd53d9 --- /dev/null +++ b/queue-4.17/usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch @@ -0,0 +1,59 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: William Wu +Date: Fri, 11 May 2018 17:46:32 +0800 +Subject: usb: dwc2: fix isoc split in transfer with no data + +From: William Wu + +[ Upstream commit 70c3c8cb83856758025c2a211dd022bc0478922a ] + +If isoc split in transfer with no data (the length of DATA0 +packet is zero), we can't simply return immediately. Because +the DATA0 can be the first transaction or the second transaction +for the isoc split in transaction. If the DATA0 packet with no +data is in the first transaction, we can return immediately. +But if the DATA0 packet with no data is in the second transaction +of isoc split in transaction sequence, we need to increase the +qtd->isoc_frame_index and giveback urb to device driver if needed, +otherwise, the MDATA packet will be lost. + +A typical test case is that connect the dwc2 controller with an +usb hs Hub (GL852G-12), and plug an usb fs audio device (Plantronics +headset) into the downstream port of Hub. Then use the usb mic +to record, we can find noise when playback. + +In the case, the isoc split in transaction sequence like this: + +- SSPLIT IN transaction +- CSPLIT IN transaction + - MDATA packet (176 bytes) +- CSPLIT IN transaction + - DATA0 packet (0 byte) + +This patch use both the length of DATA0 and qtd->isoc_split_offset +to check if the DATA0 is in the second transaction. + +Tested-by: Gevorg Sahakyan +Tested-by: Heiko Stuebner +Acked-by: Minas Harutyunyan hminas@synopsys.com> +Signed-off-by: William Wu +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/hcd_intr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/dwc2/hcd_intr.c ++++ b/drivers/usb/dwc2/hcd_intr.c +@@ -930,9 +930,8 @@ static int dwc2_xfercomp_isoc_split_in(s + frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index]; + len = dwc2_get_actual_xfer_length(hsotg, chan, chnum, qtd, + DWC2_HC_XFER_COMPLETE, NULL); +- if (!len) { ++ if (!len && !qtd->isoc_split_offset) { + qtd->complete_split = 0; +- qtd->isoc_split_offset = 0; + return 0; + } + diff --git a/queue-4.17/usb-dwc2-gadget-fix-issue-in-dwc2_gadget_start_isoc.patch b/queue-4.17/usb-dwc2-gadget-fix-issue-in-dwc2_gadget_start_isoc.patch new file mode 100644 index 00000000000..395932e1388 --- /dev/null +++ b/queue-4.17/usb-dwc2-gadget-fix-issue-in-dwc2_gadget_start_isoc.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Minas Harutyunyan +Date: Tue, 12 Jun 2018 12:37:29 +0400 +Subject: usb: dwc2: gadget: Fix issue in dwc2_gadget_start_isoc() + +From: Minas Harutyunyan + +[ Upstream commit 1ffba9058737af2ddeebc813faa8ea9b16bc892a ] + +In case of requests queue is empty reset EP target_frame to +initial value. + +This allow restarting ISOC traffic in case when function +driver queued requests with interruptions. + +Tested-by: Zeng Tao +Signed-off-by: Minas Harutyunyan +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/gadget.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -892,6 +892,7 @@ static void dwc2_gadget_start_isoc_ddma( + u32 ctrl; + + if (list_empty(&hs_ep->queue)) { ++ hs_ep->target_frame = TARGET_FRAME_INITIAL; + dev_dbg(hsotg->dev, "%s: No requests in queue\n", __func__); + return; + } diff --git a/queue-4.17/usb-dwc3-of-simple-fix-use-after-free-on-remove.patch b/queue-4.17/usb-dwc3-of-simple-fix-use-after-free-on-remove.patch new file mode 100644 index 00000000000..d4b126c601d --- /dev/null +++ b/queue-4.17/usb-dwc3-of-simple-fix-use-after-free-on-remove.patch @@ -0,0 +1,35 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Johan Hovold +Date: Thu, 31 May 2018 16:45:52 +0200 +Subject: usb: dwc3: of-simple: fix use-after-free on remove + +From: Johan Hovold + +[ Upstream commit 896e518883f18e601335908192e33426c1f599a4 ] + +The clocks have already been explicitly disabled and put as part of +remove() so the runtime suspend callback must not be run when balancing +the runtime PM usage count before returning. + +Fixes: 16adc674d0d6 ("usb: dwc3: add generic OF glue layer") +Signed-off-by: Johan Hovold +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-of-simple.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/dwc3-of-simple.c ++++ b/drivers/usb/dwc3/dwc3-of-simple.c +@@ -165,8 +165,9 @@ static int dwc3_of_simple_remove(struct + + reset_control_put(simple->resets); + +- pm_runtime_put_sync(dev); + pm_runtime_disable(dev); ++ pm_runtime_put_noidle(dev); ++ pm_runtime_set_suspended(dev); + + return 0; + } diff --git a/queue-4.17/usb-dwc3-pci-add-support-for-intel-icelake.patch b/queue-4.17/usb-dwc3-pci-add-support-for-intel-icelake.patch new file mode 100644 index 00000000000..5537e762665 --- /dev/null +++ b/queue-4.17/usb-dwc3-pci-add-support-for-intel-icelake.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Heikki Krogerus +Date: Thu, 15 Jun 2017 12:57:30 +0300 +Subject: usb: dwc3: pci: add support for Intel IceLake + +From: Heikki Krogerus + +[ Upstream commit 00908693c481f7298adf8cf4d2ff3dfbea8c375f ] + +PCI IDs for Intel IceLake. + +Signed-off-by: Heikki Krogerus +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -34,6 +34,7 @@ + #define PCI_DEVICE_ID_INTEL_GLK 0x31aa + #define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee + #define PCI_DEVICE_ID_INTEL_CNPH 0xa36e ++#define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" + #define PCI_INTEL_BXT_FUNC_PMU_PWR 4 +@@ -289,6 +290,7 @@ static const struct pci_device_id dwc3_p + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_GLK), }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPLP), }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPH), }, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICLLP), }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), }, + { } /* Terminating Entry */ + }; diff --git a/queue-4.17/usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch b/queue-4.17/usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch new file mode 100644 index 00000000000..1ef85dfe081 --- /dev/null +++ b/queue-4.17/usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Chunfeng Yun +Date: Fri, 25 May 2018 17:24:57 +0800 +Subject: usb: gadget: composite: fix delayed_status race condition when set_interface + +From: Chunfeng Yun + +[ Upstream commit 980900d6318066b9f8314bfb87329a20fd0d1ca4 ] + +It happens when enable debug log, if set_alt() returns +USB_GADGET_DELAYED_STATUS and usb_composite_setup_continue() +is called before increasing count of @delayed_status, +so fix it by using spinlock of @cdev->lock. + +Signed-off-by: Chunfeng Yun +Tested-by: Jay Hsu +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/composite.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -1719,6 +1719,8 @@ composite_setup(struct usb_gadget *gadge + */ + if (w_value && !f->get_alt) + break; ++ ++ spin_lock(&cdev->lock); + value = f->set_alt(f, w_index, w_value); + if (value == USB_GADGET_DELAYED_STATUS) { + DBG(cdev, +@@ -1728,6 +1730,7 @@ composite_setup(struct usb_gadget *gadge + DBG(cdev, "delayed_status count %d\n", + cdev->delayed_status); + } ++ spin_unlock(&cdev->lock); + break; + case USB_REQ_GET_INTERFACE: + if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE)) diff --git a/queue-4.17/usb-gadget-dwc2-fix-memory-leak-in-gadget_init.patch b/queue-4.17/usb-gadget-dwc2-fix-memory-leak-in-gadget_init.patch new file mode 100644 index 00000000000..d79d538e5cb --- /dev/null +++ b/queue-4.17/usb-gadget-dwc2-fix-memory-leak-in-gadget_init.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Grigor Tovmasyan +Date: Thu, 24 May 2018 18:22:30 +0400 +Subject: usb: gadget: dwc2: fix memory leak in gadget_init() + +From: Grigor Tovmasyan + +[ Upstream commit 9bb073a053f0464ea74a4d4c331fdb7da58568d6 ] + +Freed allocated request for ep0 to prevent memory leak in case when +dwc2_driver_probe() failed. + +Cc: Stefan Wahren +Cc: Marek Szyprowski +Tested-by: Stefan Wahren +Tested-by: Marek Szyprowski +Acked-by: Minas Harutyunyan +Signed-off-by: Grigor Tovmasyan +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/gadget.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -4721,9 +4721,11 @@ int dwc2_gadget_init(struct dwc2_hsotg * + } + + ret = usb_add_gadget_udc(dev, &hsotg->gadget); +- if (ret) ++ if (ret) { ++ dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, ++ hsotg->ctrl_req); + return ret; +- ++ } + dwc2_hsotg_dump(hsotg); + + return 0; +@@ -4736,6 +4738,7 @@ int dwc2_gadget_init(struct dwc2_hsotg * + int dwc2_hsotg_remove(struct dwc2_hsotg *hsotg) + { + usb_del_gadget_udc(&hsotg->gadget); ++ dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, hsotg->ctrl_req); + + return 0; + } diff --git a/queue-4.17/usb-gadget-ffs-fix-bug-when-userland-exits-with-submitted-aio-transfers.patch b/queue-4.17/usb-gadget-ffs-fix-bug-when-userland-exits-with-submitted-aio-transfers.patch new file mode 100644 index 00000000000..0f5757a59e0 --- /dev/null +++ b/queue-4.17/usb-gadget-ffs-fix-bug-when-userland-exits-with-submitted-aio-transfers.patch @@ -0,0 +1,130 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Vincent Pelletier +Date: Wed, 13 Jun 2018 11:05:06 +0000 +Subject: usb: gadget: ffs: Fix BUG when userland exits with submitted AIO transfers + +From: Vincent Pelletier + +[ Upstream commit d52e4d0c0c428bf2ba35074a7495cdb28e2efbae ] + +This bug happens only when the UDC needs to sleep during usb_ep_dequeue, +as is the case for (at least) dwc3. + +[ 382.200896] BUG: scheduling while atomic: screen/1808/0x00000100 +[ 382.207124] 4 locks held by screen/1808: +[ 382.211266] #0: (rcu_callback){....}, at: [] rcu_process_callbacks+0x260/0x440 +[ 382.219949] #1: (rcu_read_lock_sched){....}, at: [] percpu_ref_switch_to_atomic_rcu+0xb0/0x130 +[ 382.230034] #2: (&(&ctx->ctx_lock)->rlock){....}, at: [] free_ioctx_users+0x23/0xd0 +[ 382.230096] #3: (&(&ffs->eps_lock)->rlock){....}, at: [] ffs_aio_cancel+0x20/0x60 [usb_f_fs] +[ 382.230160] Modules linked in: usb_f_fs libcomposite configfs bnep btsdio bluetooth ecdh_generic brcmfmac brcmutil intel_powerclamp coretemp dwc3 kvm_intel ulpi udc_core kvm irqbypass crc32_pclmul crc32c_intel pcbc dwc3_pci aesni_intel aes_i586 crypto_simd cryptd ehci_pci ehci_hcd gpio_keys usbcore basincove_gpadc industrialio usb_common +[ 382.230407] CPU: 1 PID: 1808 Comm: screen Not tainted 4.14.0-edison+ #117 +[ 382.230416] Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542 2015.01.21:18.19.48 +[ 382.230425] Call Trace: +[ 382.230438] +[ 382.230466] dump_stack+0x47/0x62 +[ 382.230498] __schedule_bug+0x61/0x80 +[ 382.230522] __schedule+0x43/0x7a0 +[ 382.230587] schedule+0x5f/0x70 +[ 382.230625] dwc3_gadget_ep_dequeue+0x14c/0x270 [dwc3] +[ 382.230669] ? do_wait_intr_irq+0x70/0x70 +[ 382.230724] usb_ep_dequeue+0x19/0x90 [udc_core] +[ 382.230770] ffs_aio_cancel+0x37/0x60 [usb_f_fs] +[ 382.230798] kiocb_cancel+0x31/0x40 +[ 382.230822] free_ioctx_users+0x4d/0xd0 +[ 382.230858] percpu_ref_switch_to_atomic_rcu+0x10a/0x130 +[ 382.230881] ? percpu_ref_exit+0x40/0x40 +[ 382.230904] rcu_process_callbacks+0x2b3/0x440 +[ 382.230965] __do_softirq+0xf8/0x26b +[ 382.231011] ? __softirqentry_text_start+0x8/0x8 +[ 382.231033] do_softirq_own_stack+0x22/0x30 +[ 382.231042] +[ 382.231071] irq_exit+0x45/0xc0 +[ 382.231089] smp_apic_timer_interrupt+0x13c/0x150 +[ 382.231118] apic_timer_interrupt+0x35/0x3c +[ 382.231132] EIP: __copy_user_ll+0xe2/0xf0 +[ 382.231142] EFLAGS: 00210293 CPU: 1 +[ 382.231154] EAX: bfd4508c EBX: 00000004 ECX: 00000003 EDX: f3d8fe50 +[ 382.231165] ESI: f3d8fe51 EDI: bfd4508d EBP: f3d8fe14 ESP: f3d8fe08 +[ 382.231176] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 +[ 382.231265] core_sys_select+0x25f/0x320 +[ 382.231346] ? __wake_up_common_lock+0x62/0x80 +[ 382.231399] ? tty_ldisc_deref+0x13/0x20 +[ 382.231438] ? ldsem_up_read+0x1b/0x40 +[ 382.231459] ? tty_ldisc_deref+0x13/0x20 +[ 382.231479] ? tty_write+0x29f/0x2e0 +[ 382.231514] ? n_tty_ioctl+0xe0/0xe0 +[ 382.231541] ? tty_write_unlock+0x30/0x30 +[ 382.231566] ? __vfs_write+0x22/0x110 +[ 382.231604] ? security_file_permission+0x2f/0xd0 +[ 382.231635] ? rw_verify_area+0xac/0x120 +[ 382.231677] ? vfs_write+0x103/0x180 +[ 382.231711] SyS_select+0x87/0xc0 +[ 382.231739] ? SyS_write+0x42/0x90 +[ 382.231781] do_fast_syscall_32+0xd6/0x1a0 +[ 382.231836] entry_SYSENTER_32+0x47/0x71 +[ 382.231848] EIP: 0xb7f75b05 +[ 382.231857] EFLAGS: 00000246 CPU: 1 +[ 382.231868] EAX: ffffffda EBX: 00000400 ECX: bfd4508c EDX: bfd4510c +[ 382.231878] ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: bfd45020 +[ 382.231889] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b +[ 382.232281] softirq: huh, entered softirq 9 RCU c10b4d90 with preempt_count 00000100, exited with 00000000? + +Tested-by: Sam Protsenko +Signed-off-by: Vincent Pelletier +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_fs.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -215,6 +215,7 @@ struct ffs_io_data { + + struct mm_struct *mm; + struct work_struct work; ++ struct work_struct cancellation_work; + + struct usb_ep *ep; + struct usb_request *req; +@@ -1072,22 +1073,31 @@ ffs_epfile_open(struct inode *inode, str + return 0; + } + ++static void ffs_aio_cancel_worker(struct work_struct *work) ++{ ++ struct ffs_io_data *io_data = container_of(work, struct ffs_io_data, ++ cancellation_work); ++ ++ ENTER(); ++ ++ usb_ep_dequeue(io_data->ep, io_data->req); ++} ++ + static int ffs_aio_cancel(struct kiocb *kiocb) + { + struct ffs_io_data *io_data = kiocb->private; +- struct ffs_epfile *epfile = kiocb->ki_filp->private_data; ++ struct ffs_data *ffs = io_data->ffs; + int value; + + ENTER(); + +- spin_lock_irq(&epfile->ffs->eps_lock); +- +- if (likely(io_data && io_data->ep && io_data->req)) +- value = usb_ep_dequeue(io_data->ep, io_data->req); +- else ++ if (likely(io_data && io_data->ep && io_data->req)) { ++ INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker); ++ queue_work(ffs->io_completion_wq, &io_data->cancellation_work); ++ value = -EINPROGRESS; ++ } else { + value = -EINVAL; +- +- spin_unlock_irq(&epfile->ffs->eps_lock); ++ } + + return value; + } diff --git a/queue-4.17/usb-xhci-dbc-don-t-decrement-runtime-pm-counter-if-dbc-is-not-started.patch b/queue-4.17/usb-xhci-dbc-don-t-decrement-runtime-pm-counter-if-dbc-is-not-started.patch new file mode 100644 index 00000000000..69feadc4c4b --- /dev/null +++ b/queue-4.17/usb-xhci-dbc-don-t-decrement-runtime-pm-counter-if-dbc-is-not-started.patch @@ -0,0 +1,71 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Kai-Heng Feng +Date: Mon, 2 Jul 2018 17:13:31 +0300 +Subject: usb: xhci: dbc: Don't decrement runtime PM counter if DBC is not started + +From: Kai-Heng Feng + +[ Upstream commit 74cb319bd97dd62881f97ea5a3228f7c2546bf56 ] + +pm_runtime_put_sync() gets called everytime in xhci_dbc_stop(). + +If dbc is not started, this makes the runtime PM counter incorrectly +becomes 0, and calls autosuspend function. Then we'll keep seeing this: +[54664.762220] xhci_hcd 0000:00:14.0: Root hub is not suspended + +So only calls pm_runtime_put_sync() when dbc was started. + +Signed-off-by: Kai-Heng Feng +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-dbgcap.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/xhci-dbgcap.c ++++ b/drivers/usb/host/xhci-dbgcap.c +@@ -507,16 +507,18 @@ static int xhci_do_dbc_start(struct xhci + return 0; + } + +-static void xhci_do_dbc_stop(struct xhci_hcd *xhci) ++static int xhci_do_dbc_stop(struct xhci_hcd *xhci) + { + struct xhci_dbc *dbc = xhci->dbc; + + if (dbc->state == DS_DISABLED) +- return; ++ return -1; + + writel(0, &dbc->regs->control); + xhci_dbc_mem_cleanup(xhci); + dbc->state = DS_DISABLED; ++ ++ return 0; + } + + static int xhci_dbc_start(struct xhci_hcd *xhci) +@@ -543,6 +545,7 @@ static int xhci_dbc_start(struct xhci_hc + + static void xhci_dbc_stop(struct xhci_hcd *xhci) + { ++ int ret; + unsigned long flags; + struct xhci_dbc *dbc = xhci->dbc; + struct dbc_port *port = &dbc->port; +@@ -555,10 +558,11 @@ static void xhci_dbc_stop(struct xhci_hc + xhci_dbc_tty_unregister_device(xhci); + + spin_lock_irqsave(&dbc->lock, flags); +- xhci_do_dbc_stop(xhci); ++ ret = xhci_do_dbc_stop(xhci); + spin_unlock_irqrestore(&dbc->lock, flags); + +- pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller); ++ if (!ret) ++ pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller); + } + + static void diff --git a/queue-4.17/usb-xhci-increase-crs-timeout-value.patch b/queue-4.17/usb-xhci-increase-crs-timeout-value.patch new file mode 100644 index 00000000000..387e45c463b --- /dev/null +++ b/queue-4.17/usb-xhci-increase-crs-timeout-value.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Ajay Gupta +Date: Thu, 21 Jun 2018 16:19:45 +0300 +Subject: usb: xhci: increase CRS timeout value + +From: Ajay Gupta + +[ Upstream commit 305886ca87be480ae159908c2affd135c04215cf ] + +Some controllers take almost 55ms to complete controller +restore state (CRS). +There is no timeout limit mentioned in xhci specification so +fixing the issue by increasing the timeout limit to 100ms + +[reformat code comment -Mathias] +Signed-off-by: Ajay Gupta +Signed-off-by: Nagaraj Annaiah +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1014,8 +1014,13 @@ int xhci_resume(struct xhci_hcd *xhci, b + command = readl(&xhci->op_regs->command); + command |= CMD_CRS; + writel(command, &xhci->op_regs->command); ++ /* ++ * Some controllers take up to 55+ ms to complete the controller ++ * restore so setting the timeout to 100ms. Xhci specification ++ * doesn't mention any timeout value. ++ */ + if (xhci_handshake(&xhci->op_regs->status, +- STS_RESTORE, 0, 10 * 1000)) { ++ STS_RESTORE, 0, 100 * 1000)) { + xhci_warn(xhci, "WARN: xHC restore state timeout\n"); + spin_unlock_irq(&xhci->lock); + return -ETIMEDOUT; diff --git a/queue-4.17/usb-xhci-remove-the-code-build-warning.patch b/queue-4.17/usb-xhci-remove-the-code-build-warning.patch new file mode 100644 index 00000000000..6b654e64627 --- /dev/null +++ b/queue-4.17/usb-xhci-remove-the-code-build-warning.patch @@ -0,0 +1,39 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Dongjiu Geng +Date: Thu, 21 Jun 2018 16:19:43 +0300 +Subject: usb: xhci: remove the code build warning + +From: Dongjiu Geng + +[ Upstream commit 36eb93509c45d0bdbd8d09a01ab9d857972f5963 ] + +Initialize the 'err' variate to remove the build warning, +the warning is shown as below: + +drivers/usb/host/xhci-tegra.c: In function 'tegra_xusb_mbox_thread': +drivers/usb/host/xhci-tegra.c:552:6: warning: 'err' may be used uninitialized in this function [-Wuninitialized] +drivers/usb/host/xhci-tegra.c:482:6: note: 'err' was declared here + +Fixes: e84fce0f8837 ("usb: xhci: Add NVIDIA Tegra XUSB controller driver") +Signed-off-by: Dongjiu Geng +Acked-by: Thierry Reding +Acked-by: Jon Hunter +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -479,7 +479,7 @@ static void tegra_xusb_mbox_handle(struc + unsigned long mask; + unsigned int port; + bool idle, enable; +- int err; ++ int err = 0; + + memset(&rsp, 0, sizeof(rsp)); + diff --git a/queue-4.17/vfio-ccw-fix-error-return-in-vfio_ccw_sch_event.patch b/queue-4.17/vfio-ccw-fix-error-return-in-vfio_ccw_sch_event.patch new file mode 100644 index 00000000000..45a738a639f --- /dev/null +++ b/queue-4.17/vfio-ccw-fix-error-return-in-vfio_ccw_sch_event.patch @@ -0,0 +1,54 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Dong Jia Shi +Date: Wed, 2 May 2018 09:25:59 +0200 +Subject: vfio: ccw: fix error return in vfio_ccw_sch_event + +From: Dong Jia Shi + +[ Upstream commit 2c861d89ccda2fbcea9358eff9cc5f8fae548be5 ] + +If the device has not been registered, or there is work pending, +we should reschedule a sch_event call again. + +Signed-off-by: Dong Jia Shi +Message-Id: <20180502072559.50691-1-bjsdjshi@linux.vnet.ibm.com> +Reviewed-by: Cornelia Huck +Signed-off-by: Cornelia Huck +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/cio/vfio_ccw_drv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/s390/cio/vfio_ccw_drv.c ++++ b/drivers/s390/cio/vfio_ccw_drv.c +@@ -177,6 +177,7 @@ static int vfio_ccw_sch_event(struct sub + { + struct vfio_ccw_private *private = dev_get_drvdata(&sch->dev); + unsigned long flags; ++ int rc = -EAGAIN; + + spin_lock_irqsave(sch->lock, flags); + if (!device_is_registered(&sch->dev)) +@@ -187,6 +188,7 @@ static int vfio_ccw_sch_event(struct sub + + if (cio_update_schib(sch)) { + vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER); ++ rc = 0; + goto out_unlock; + } + +@@ -195,11 +197,12 @@ static int vfio_ccw_sch_event(struct sub + private->state = private->mdev ? VFIO_CCW_STATE_IDLE : + VFIO_CCW_STATE_STANDBY; + } ++ rc = 0; + + out_unlock: + spin_unlock_irqrestore(sch->lock, flags); + +- return 0; ++ return rc; + } + + static struct css_device_id vfio_ccw_sch_ids[] = { diff --git a/queue-4.17/x86-microcode-intel-fix-memleak-in-save_microcode_patch.patch b/queue-4.17/x86-microcode-intel-fix-memleak-in-save_microcode_patch.patch new file mode 100644 index 00000000000..2dd14f80477 --- /dev/null +++ b/queue-4.17/x86-microcode-intel-fix-memleak-in-save_microcode_patch.patch @@ -0,0 +1,39 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Zhenzhong Duan +Date: Fri, 22 Jun 2018 13:51:26 +0200 +Subject: x86/microcode/intel: Fix memleak in save_microcode_patch() + +From: Zhenzhong Duan + +[ Upstream commit 0218c766263e70795c5eaa17d75ed54bca350950 ] + +Free useless ucode_patch entry when it's replaced. + +[ bp: Drop the memfree_patch() two-liner. ] + +Signed-off-by: Zhenzhong Duan +Signed-off-by: Borislav Petkov +Signed-off-by: Thomas Gleixner +Cc: Srinivas REDDY Eeda +Link: http://lkml.kernel.org/r/888102f0-fd22-459d-b090-a1bd8a00cb2b@default +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/microcode/intel.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/microcode/intel.c ++++ b/arch/x86/kernel/cpu/microcode/intel.c +@@ -190,8 +190,11 @@ static void save_microcode_patch(void *d + p = memdup_patch(data, size); + if (!p) + pr_err("Error allocating buffer %p\n", data); +- else ++ else { + list_replace(&iter->plist, &p->plist); ++ kfree(iter->data); ++ kfree(iter); ++ } + } + } + diff --git a/queue-4.17/x86-mm-32-initialize-the-cr4-shadow-before-__flush_tlb_all.patch b/queue-4.17/x86-mm-32-initialize-the-cr4-shadow-before-__flush_tlb_all.patch new file mode 100644 index 00000000000..0bc11408175 --- /dev/null +++ b/queue-4.17/x86-mm-32-initialize-the-cr4-shadow-before-__flush_tlb_all.patch @@ -0,0 +1,48 @@ +From foo@baz Wed Aug 22 09:16:56 CEST 2018 +From: Zhenzhong Duan +Date: Mon, 2 Jul 2018 23:49:54 -0700 +Subject: x86/mm/32: Initialize the CR4 shadow before __flush_tlb_all() + +From: Zhenzhong Duan + +[ Upstream commit 4fb5f58e8d191f7c81637ad81284e4848afb4244 ] + +On 32-bit kernels, __flush_tlb_all() may have read the CR4 shadow before the +initialization of CR4 shadow in cpu_init(). + +Fix it by adding an explicit cr4_init_shadow() call into start_secondary() +which is the first function called on non-boot SMP CPUs - ahead of the +__flush_tlb_all() call. + +( This is somewhat of a layering violation, but start_secondary() does + CR4 bootstrap in the PCID case anyway. ) + +Signed-off-by: Zhenzhong Duan +Cc: Andy Lutomirski +Cc: Borislav Petkov +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: "H. Peter Anvin" +Link: http://lkml.kernel.org/r/b07b6ae9-4b57-4b40-b9bc-50c2c67f1d91@default +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/smpboot.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -222,6 +222,11 @@ static void notrace start_secondary(void + #ifdef CONFIG_X86_32 + /* switch away from the initial page table */ + load_cr3(swapper_pg_dir); ++ /* ++ * Initialize the CR4 shadow before doing anything that could ++ * try to read it. ++ */ ++ cr4_init_shadow(); + __flush_tlb_all(); + #endif + load_current_idt(); diff --git a/queue-4.17/xen-add-error-handling-for-xenbus_printf.patch b/queue-4.17/xen-add-error-handling-for-xenbus_printf.patch new file mode 100644 index 00000000000..3efdf08e14a --- /dev/null +++ b/queue-4.17/xen-add-error-handling-for-xenbus_printf.patch @@ -0,0 +1,57 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Zhouyang Jia +Date: Fri, 15 Jun 2018 07:34:52 +0800 +Subject: xen: add error handling for xenbus_printf + +From: Zhouyang Jia + +[ Upstream commit 84c029a73327cef571eaa61c7d6e67e8031b52ec ] + +When xenbus_printf fails, the lack of error-handling code may +cause unexpected results. + +This patch adds error-handling code after calling xenbus_printf. + +Signed-off-by: Zhouyang Jia +Reviewed-by: Boris Ostrovsky +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/manage.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -289,8 +289,15 @@ static void sysrq_handler(struct xenbus_ + return; + } + +- if (sysrq_key != '\0') +- xenbus_printf(xbt, "control", "sysrq", "%c", '\0'); ++ if (sysrq_key != '\0') { ++ err = xenbus_printf(xbt, "control", "sysrq", "%c", '\0'); ++ if (err) { ++ pr_err("%s: Error %d writing sysrq in control/sysrq\n", ++ __func__, err); ++ xenbus_transaction_end(xbt, 1); ++ return; ++ } ++ } + + err = xenbus_transaction_end(xbt, 0); + if (err == -EAGAIN) +@@ -342,7 +349,12 @@ static int setup_shutdown_watcher(void) + continue; + snprintf(node, FEATURE_PATH_SIZE, "feature-%s", + shutdown_handlers[idx].command); +- xenbus_printf(XBT_NIL, "control", node, "%u", 1); ++ err = xenbus_printf(XBT_NIL, "control", node, "%u", 1); ++ if (err) { ++ pr_err("%s: Error %d writing %s\n", __func__, ++ err, node); ++ return err; ++ } + } + + return 0; diff --git a/queue-4.17/xen-scsiback-add-error-handling-for-xenbus_printf.patch b/queue-4.17/xen-scsiback-add-error-handling-for-xenbus_printf.patch new file mode 100644 index 00000000000..612f8bc610c --- /dev/null +++ b/queue-4.17/xen-scsiback-add-error-handling-for-xenbus_printf.patch @@ -0,0 +1,72 @@ +From foo@baz Wed Aug 22 09:16:55 CEST 2018 +From: Zhouyang Jia +Date: Sat, 16 Jun 2018 08:14:37 +0800 +Subject: xen/scsiback: add error handling for xenbus_printf + +From: Zhouyang Jia + +[ Upstream commit 7c63ca24c878e0051c91904b72174029320ef4bd ] + +When xenbus_printf fails, the lack of error-handling code may +cause unexpected results. + +This patch adds error-handling code after calling xenbus_printf. + +Signed-off-by: Zhouyang Jia +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/xen-scsiback.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/drivers/xen/xen-scsiback.c ++++ b/drivers/xen/xen-scsiback.c +@@ -1012,6 +1012,7 @@ static void scsiback_do_add_lun(struct v + { + struct v2p_entry *entry; + unsigned long flags; ++ int err; + + if (try) { + spin_lock_irqsave(&info->v2p_lock, flags); +@@ -1027,8 +1028,11 @@ static void scsiback_do_add_lun(struct v + scsiback_del_translation_entry(info, vir); + } + } else if (!try) { +- xenbus_printf(XBT_NIL, info->dev->nodename, state, ++ err = xenbus_printf(XBT_NIL, info->dev->nodename, state, + "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(info->dev, err, ++ "%s: writing %s", __func__, state); + } + } + +@@ -1067,8 +1071,11 @@ static void scsiback_do_1lun_hotplug(str + snprintf(str, sizeof(str), "vscsi-devs/%s/p-dev", ent); + val = xenbus_read(XBT_NIL, dev->nodename, str, NULL); + if (IS_ERR(val)) { +- xenbus_printf(XBT_NIL, dev->nodename, state, ++ err = xenbus_printf(XBT_NIL, dev->nodename, state, + "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(info->dev, err, ++ "%s: writing %s", __func__, state); + return; + } + strlcpy(phy, val, VSCSI_NAMELEN); +@@ -1079,8 +1086,11 @@ static void scsiback_do_1lun_hotplug(str + err = xenbus_scanf(XBT_NIL, dev->nodename, str, "%u:%u:%u:%u", + &vir.hst, &vir.chn, &vir.tgt, &vir.lun); + if (XENBUS_EXIST_ERR(err)) { +- xenbus_printf(XBT_NIL, dev->nodename, state, ++ err = xenbus_printf(XBT_NIL, dev->nodename, state, + "%d", XenbusStateClosed); ++ if (err) ++ xenbus_dev_error(info->dev, err, ++ "%s: writing %s", __func__, state); + return; + } + -- 2.47.3