diff --git a/blacklist.conf b/blacklist.conf index bd056df..8446103 100644 --- a/blacklist.conf +++ b/blacklist.conf @@ -1481,3 +1481,9 @@ f01b411f41f91fc3196eae4317cf8b4d872830a6 # Just a cleanup 1ac994525b9d3b6245c1a61632156f19ab73fccb # Tracepoint cleanup 780f66e59231fcf882f36c63f287252ee47cc75a # Comment fixup d18b2f43b9147c8005ae0844fb445d8cc6a87e31 # Wrong Fixes tag, bug fixed is not present in this branch +dce05aa6eec977f1472abed95ccd71276b9a3864 # just cleanup +e587e8f17433ddb26954f0edf5b2f95c42155ae9 # just cleanup +f400991bf872debffb01c46da882dc97d7e3248e # just cleanup +9d0a58fb9747afd27d490c02a97889a1b59f6be4 # kasan fix +380324734956c64cd060e1db4304f3117ac15809 # clang warning fix +5d4f78564c9ca38146102c4f8998edcad5afbc22 # optimization not worth regression risk diff --git a/patches.suse/ipmi-fix-hung-processes-in-__get_guid.patch b/patches.suse/ipmi-fix-hung-processes-in-__get_guid.patch index 085f74f..c045a00 100644 --- a/patches.suse/ipmi-fix-hung-processes-in-__get_guid.patch +++ b/patches.suse/ipmi-fix-hung-processes-in-__get_guid.patch @@ -1,10 +1,10 @@ From 32830a0534700f86366f371b150b17f0f0d140d7 Mon Sep 17 00:00:00 2001 From: Wen Yang Date: Fri, 3 Apr 2020 17:04:08 +0800 -Subject: [PATCH] ipmi: fix hung processes in __get_guid() +Subject: ipmi: fix hung processes in __get_guid() Git-commit: 32830a0534700f86366f371b150b17f0f0d140d7 Patch-mainline: v5.7-rc1 -References: bsc#1111666 +References: bsc#1111666 git-fixes The wait_event() function is used to detect command completion. When send_guid_cmd() returns an error, smi_send() has not been @@ -44,16 +44,13 @@ Cc: Greg Kroah-Hartman Cc: openipmi-developer@lists.sourceforge.net Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # 2.6.17- -Message-id: <20200403090408.58745-1-wenyang@linux.alibaba.com> +Message-Id: <20200403090408.58745-1-wenyang@linux.alibaba.com> Signed-off-by: Corey Minyard -Acked-by: Takashi Iwai - +Signed-off-by: Jiri Slaby --- drivers/char/ipmi/ipmi_msghandler.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c -index 64ba16dcb681..c48d8f086382 100644 --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -3193,8 +3193,8 @@ static void __get_guid(struct ipmi_smi *intf) @@ -67,6 +64,3 @@ index 64ba16dcb681..c48d8f086382 100644 /* dyn_guid_set makes the guid data available. */ smp_rmb(); --- -2.16.4 - diff --git a/patches.suse/ipv6-Fix-nlmsg_flags-when-splitting-a-multipath-rout.patch b/patches.suse/ipv6-Fix-nlmsg_flags-when-splitting-a-multipath-rout.patch new file mode 100644 index 0000000..de694db --- /dev/null +++ b/patches.suse/ipv6-Fix-nlmsg_flags-when-splitting-a-multipath-rout.patch @@ -0,0 +1,52 @@ +From: Benjamin Poirier +Date: Wed, 12 Feb 2020 10:41:07 +0900 +Subject: ipv6: Fix nlmsg_flags when splitting a multipath route +Git-commit: afecdb376bd81d7e16578f0cfe82a1aec7ae18f3 +Patch-mainline: 5.6-rc3 +References: networking-stable-20_03_01 + +When splitting an RTA_MULTIPATH request into multiple routes and adding the +second and later components, we must not simply remove NLM_F_REPLACE but +instead replace it by NLM_F_CREATE. Otherwise, it may look like the netlink +message was malformed. + +For example, + ip route add 2001:db8::1/128 dev dummy0 + ip route change 2001:db8::1/128 nexthop via fe80::30:1 dev dummy0 \ + nexthop via fe80::30:2 dev dummy0 +results in the following warnings: +[ 1035.057019] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE +[ 1035.057517] IPv6: NLM_F_CREATE should be set when creating new route + +This patch makes the nlmsg sequence look equivalent for __ip6_ins_rt() to +what it would get if the multipath route had been added in multiple netlink +operations: + ip route add 2001:db8::1/128 dev dummy0 + ip route change 2001:db8::1/128 nexthop via fe80::30:1 dev dummy0 + ip route append 2001:db8::1/128 nexthop via fe80::30:2 dev dummy0 + +Fixes: 27596472473a ("ipv6: fix ECMP route replacement") +Signed-off-by: Benjamin Poirier +Reviewed-by: Michal Kubecek +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Jiri Slaby +--- + net/ipv6/route.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 4fbdc60b4e07..2931224b674e 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -5198,6 +5198,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, + */ + cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL | + NLM_F_REPLACE); ++ cfg->fc_nlinfo.nlh->nlmsg_flags |= NLM_F_CREATE; + nhn++; + } + +-- +2.26.1 + diff --git a/patches.suse/ipv6-Fix-route-replacement-with-dev-only-route.patch b/patches.suse/ipv6-Fix-route-replacement-with-dev-only-route.patch new file mode 100644 index 0000000..fe8c26f --- /dev/null +++ b/patches.suse/ipv6-Fix-route-replacement-with-dev-only-route.patch @@ -0,0 +1,56 @@ +From: Benjamin Poirier +Date: Wed, 12 Feb 2020 10:41:06 +0900 +Subject: ipv6: Fix route replacement with dev-only route +Git-commit: e404b8c7cfb31654c9024d497cec58a501501692 +Patch-mainline: 5.6-rc3 +References: networking-stable-20_03_01 + +After commit 27596472473a ("ipv6: fix ECMP route replacement") it is no +longer possible to replace an ECMP-able route by a non ECMP-able route. +For example, + ip route add 2001:db8::1/128 via fe80::1 dev dummy0 + ip route replace 2001:db8::1/128 dev dummy0 +does not work as expected. + +Tweak the replacement logic so that point 3 in the log of the above commit +becomes: +3. If the new route is not ECMP-able, and no matching non-ECMP-able route +exists, replace matching ECMP-able route (if any) or add the new route. + +We can now summarize the entire replace semantics to: +When doing a replace, prefer replacing a matching route of the same +"ECMP-able-ness" as the replace argument. If there is no such candidate, +fallback to the first route found. + +Fixes: 27596472473a ("ipv6: fix ECMP route replacement") +Signed-off-by: Benjamin Poirier +Reviewed-by: Michal Kubecek +Signed-off-by: David S. Miller +Signed-off-by: Jiri Slaby +--- + net/ipv6/ip6_fib.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -794,8 +794,7 @@ static int fib6_add_rt2node(struct fib6_ + found++; + break; + } +- if (rt_can_ecmp) +- fallback_ins = fallback_ins ?: ins; ++ fallback_ins = fallback_ins ?: ins; + goto next_iter; + } + +@@ -835,7 +834,9 @@ next_iter: + } + + if (fallback_ins && !found) { +- /* No ECMP-able route found, replace first non-ECMP one */ ++ /* No matching route with same ecmp-able-ness found, replace ++ * first matching route ++ */ + ins = fallback_ins; + iter = *ins; + found++; diff --git a/patches.suse/kvm-s390-vsie-fix-possible-race-when-shadowing-region-3-tables b/patches.suse/kvm-s390-vsie-fix-possible-race-when-shadowing-region-3-tables new file mode 100644 index 0000000..46e722c --- /dev/null +++ b/patches.suse/kvm-s390-vsie-fix-possible-race-when-shadowing-region-3-tables @@ -0,0 +1,45 @@ +From: David Hildenbrand +Date: Fri, 3 Apr 2020 17:30:48 +0200 +Subject: KVM: s390: vsie: Fix possible race when shadowing region 3 tables +Git-commit: 1493e0f944f3c319d11e067c185c904d01c17ae5 +Patch-mainline: v5.7-rc1 +References: git-fixes + +We have to properly retry again by returning -EINVAL immediately in case +somebody else instantiated the table concurrently. We missed to add the +goto in this function only. The code now matches the other, similar +shadowing functions. + +We are overwriting an existing region 2 table entry. All allocated pages +are added to the crst_list to be freed later, so they are not lost +forever. However, when unshadowing the region 2 table, we wouldn't trigger +unshadowing of the original shadowed region 3 table that we replaced. It +would get unshadowed when the original region 3 table is modified. As it's +not connected to the page table hierarchy anymore, it's not going to get +used anymore. However, for a limited time, this page table will stick +around, so it's in some sense a temporary memory leak. + +Identified by manual code inspection. I don't think this classifies as +stable material. + +Fixes: 998f637cc4b9 ("s390/mm: avoid races on region/segment/page table shadowing") +Signed-off-by: David Hildenbrand +Link: https://lore.kernel.org/r/20200403153050.20569-4-david@redhat.com +Reviewed-by: Claudio Imbrenda +Reviewed-by: Christian Borntraeger +Signed-off-by: Christian Borntraeger +Acked-by: Petr Tesarik +--- + arch/s390/mm/gmap.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/s390/mm/gmap.c ++++ b/arch/s390/mm/gmap.c +@@ -1684,6 +1684,7 @@ int gmap_shadow_r3t(struct gmap *sg, uns + goto out_free; + } else if (*table & _REGION_ENTRY_ORIGIN) { + rc = -EAGAIN; /* Race with shadow */ ++ goto out_free; + } + crst_table_init(s_r3t, _REGION3_ENTRY_EMPTY); + /* mark as invalid as long as the parent table is not protected */ diff --git a/patches.suse/kvm-s390-vsie-fix-region-1-asce-sanity-shadow-address-checks b/patches.suse/kvm-s390-vsie-fix-region-1-asce-sanity-shadow-address-checks new file mode 100644 index 0000000..0a58037 --- /dev/null +++ b/patches.suse/kvm-s390-vsie-fix-region-1-asce-sanity-shadow-address-checks @@ -0,0 +1,53 @@ +From: David Hildenbrand +Date: Fri, 3 Apr 2020 17:30:46 +0200 +Subject: KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks +Git-commit: a1d032a49522cb5368e5dfb945a85899b4c74f65 +Patch-mainline: v5.7-rc1 +References: git-fixes + +In case we have a region 1 the following calculation +(31 + ((gmap->asce & _ASCE_TYPE_MASK) >> 2)*11) +results in 64. As shifts beyond the size are undefined the compiler is +free to use instructions like sllg. sllg will only use 6 bits of the +shift value (here 64) resulting in no shift at all. That means that ALL +addresses will be rejected. + +The can result in endless loops, e.g. when prefix cannot get mapped. + +Fixes: 4be130a08420 ("s390/mm: add shadow gmap support") +Tested-by: Janosch Frank +Reported-by: Janosch Frank +Cc: # v4.8+ +Signed-off-by: David Hildenbrand +Link: https://lore.kernel.org/r/20200403153050.20569-2-david@redhat.com +Reviewed-by: Claudio Imbrenda +Reviewed-by: Christian Borntraeger +[borntraeger@de.ibm.com: fix patch description, remove WARN_ON_ONCE] +Signed-off-by: Christian Borntraeger +Acked-by: Petr Tesarik +--- + arch/s390/mm/gmap.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/arch/s390/mm/gmap.c ++++ b/arch/s390/mm/gmap.c +@@ -759,14 +759,18 @@ static void gmap_call_notifier(struct gm + static inline unsigned long *gmap_table_walk(struct gmap *gmap, + unsigned long gaddr, int level) + { ++ const int asce_type = gmap->asce & _ASCE_TYPE_MASK; + unsigned long *table; + + if ((gmap->asce & _ASCE_TYPE_MASK) + 4 < (level * 4)) + return NULL; + if (gmap_is_shadow(gmap) && gmap->removed) + return NULL; +- if (gaddr & (-1UL << (31 + ((gmap->asce & _ASCE_TYPE_MASK) >> 2)*11))) ++ ++ if (asce_type != _ASCE_TYPE_REGION1 && ++ gaddr & (-1UL << (31 + (asce_type >> 2) * 11))) + return NULL; ++ + table = gmap->table; + switch (gmap->asce & _ASCE_TYPE_MASK) { + case _ASCE_TYPE_REGION1: diff --git a/patches.suse/net-dsa-bcm_sf2-Fix-overflow-checks.patch b/patches.suse/net-dsa-bcm_sf2-Fix-overflow-checks.patch new file mode 100644 index 0000000..914c4c5 --- /dev/null +++ b/patches.suse/net-dsa-bcm_sf2-Fix-overflow-checks.patch @@ -0,0 +1,56 @@ +From: Florian Fainelli +Date: Mon, 30 Mar 2020 14:38:46 -0700 +Subject: net: dsa: bcm_sf2: Fix overflow checks +Git-commit: d0802dc411f469569a537283b6f3833af47aece9 +Patch-mainline: 5.7-rc1 +References: git-fixes + +Commit f949a12fd697 ("net: dsa: bcm_sf2: fix buffer overflow doing +set_rxnfc") tried to fix the some user controlled buffer overflows in +bcm_sf2_cfp_rule_set() and bcm_sf2_cfp_rule_del() but the fix was using +CFP_NUM_RULES, which while it is correct not to overflow the bitmaps, is +not representative of what the device actually supports. Correct that by +using bcm_sf2_cfp_rule_size() instead. + +The latter subtracts the number of rules by 1, so change the checks from +greater than or equal to greater than accordingly. + +Fixes: f949a12fd697 ("net: dsa: bcm_sf2: fix buffer overflow doing set_rxnfc") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Jiri Slaby +--- + drivers/net/dsa/bcm_sf2_cfp.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/drivers/net/dsa/bcm_sf2_cfp.c ++++ b/drivers/net/dsa/bcm_sf2_cfp.c +@@ -130,17 +130,14 @@ static int bcm_sf2_cfp_rule_set(struct d + (fs->m_ext.vlan_etype || fs->m_ext.data[1])) + return -EINVAL; + +- if (fs->location != RX_CLS_LOC_ANY && fs->location >= CFP_NUM_RULES) ++ if (fs->location != RX_CLS_LOC_ANY && ++ fs->location > bcm_sf2_cfp_rule_size(priv)) + return -EINVAL; + + if (fs->location != RX_CLS_LOC_ANY && + test_bit(fs->location, priv->cfp.used)) + return -EBUSY; + +- if (fs->location != RX_CLS_LOC_ANY && +- fs->location > bcm_sf2_cfp_rule_size(priv)) +- return -EINVAL; +- + ip_frag = be32_to_cpu(fs->m_ext.data[0]); + + /* We do not support discarding packets, check that the +@@ -333,7 +330,7 @@ static int bcm_sf2_cfp_rule_del(struct b + int ret; + u32 reg; + +- if (loc >= CFP_NUM_RULES) ++ if (loc > bcm_sf2_cfp_rule_size(priv)) + return -EINVAL; + + /* Refuse deletion of unused rules, and the default reserved rule */ diff --git a/patches.suse/net-fib_rules-Correctly-set-table-field-when-table-n.patch b/patches.suse/net-fib_rules-Correctly-set-table-field-when-table-n.patch new file mode 100644 index 0000000..1b9ff0d --- /dev/null +++ b/patches.suse/net-fib_rules-Correctly-set-table-field-when-table-n.patch @@ -0,0 +1,35 @@ +From: Jethro Beekman +Date: Wed, 12 Feb 2020 16:43:41 +0100 +Subject: net: fib_rules: Correctly set table field when table number exceeds 8 + bits +Git-commit: 540e585a79e9d643ede077b73bcc7aa2d7b4d919 +Patch-mainline: 5.6-rc3 +References: networking-stable-20_03_01 + +In 709772e6e06564ed94ba740de70185ac3d792773, RT_TABLE_COMPAT was added to +allow legacy software to deal with routing table numbers >= 256, but the +same change to FIB rule queries was overlooked. + +Signed-off-by: Jethro Beekman +Signed-off-by: David S. Miller +Signed-off-by: Jiri Slaby +--- + net/core/fib_rules.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c +index 3e7e15278c46..bd7eba9066f8 100644 +--- a/net/core/fib_rules.c ++++ b/net/core/fib_rules.c +@@ -974,7 +974,7 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule, + + frh = nlmsg_data(nlh); + frh->family = ops->family; +- frh->table = rule->table; ++ frh->table = rule->table < 256 ? rule->table : RT_TABLE_COMPAT; + if (nla_put_u32(skb, FRA_TABLE, rule->table)) + goto nla_put_failure; + if (nla_put_u32(skb, FRA_SUPPRESS_PREFIXLEN, rule->suppress_prefixlen)) +-- +2.26.1 + diff --git a/patches.suse/net-phy-restore-mdio-regs-in-the-iproc-mdio-driver.patch b/patches.suse/net-phy-restore-mdio-regs-in-the-iproc-mdio-driver.patch new file mode 100644 index 0000000..bb72ea9 --- /dev/null +++ b/patches.suse/net-phy-restore-mdio-regs-in-the-iproc-mdio-driver.patch @@ -0,0 +1,63 @@ +From: Arun Parameswaran +Date: Fri, 14 Feb 2020 13:47:46 -0800 +Subject: net: phy: restore mdio regs in the iproc mdio driver +Git-commit: 6f08e98d62799e53c89dbf2c9a49d77e20ca648c +Patch-mainline: 5.6-rc3 +References: networking-stable-20_03_01 + +The mii management register in iproc mdio block +does not have a retention register so it is lost on suspend. +Save and restore value of register while resuming from suspend. + +Fixes: bb1a619735b4 ("net: phy: Initialize mdio clock at probe function") +Signed-off-by: Arun Parameswaran +Signed-off-by: Scott Branden +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Jiri Slaby +--- + drivers/net/phy/mdio-bcm-iproc.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/net/phy/mdio-bcm-iproc.c b/drivers/net/phy/mdio-bcm-iproc.c +index 7e9975d25066..f1ded03f0229 100644 +--- a/drivers/net/phy/mdio-bcm-iproc.c ++++ b/drivers/net/phy/mdio-bcm-iproc.c +@@ -178,6 +178,23 @@ static int iproc_mdio_remove(struct platform_device *pdev) + return 0; + } + ++#ifdef CONFIG_PM_SLEEP ++int iproc_mdio_resume(struct device *dev) ++{ ++ struct platform_device *pdev = to_platform_device(dev); ++ struct iproc_mdio_priv *priv = platform_get_drvdata(pdev); ++ ++ /* restore the mii clock configuration */ ++ iproc_mdio_config_clk(priv->base); ++ ++ return 0; ++} ++ ++static const struct dev_pm_ops iproc_mdio_pm_ops = { ++ .resume = iproc_mdio_resume ++}; ++#endif /* CONFIG_PM_SLEEP */ ++ + static const struct of_device_id iproc_mdio_of_match[] = { + { .compatible = "brcm,iproc-mdio", }, + { /* sentinel */ }, +@@ -188,6 +205,9 @@ static struct platform_driver iproc_mdio_driver = { + .driver = { + .name = "iproc-mdio", + .of_match_table = iproc_mdio_of_match, ++#ifdef CONFIG_PM_SLEEP ++ .pm = &iproc_mdio_pm_ops, ++#endif + }, + .probe = iproc_mdio_probe, + .remove = iproc_mdio_remove, +-- +2.26.1 + diff --git a/patches.suse/nfc-pn544-Fix-occasional-HW-initialization-failure.patch b/patches.suse/nfc-pn544-Fix-occasional-HW-initialization-failure.patch new file mode 100644 index 0000000..407f411 --- /dev/null +++ b/patches.suse/nfc-pn544-Fix-occasional-HW-initialization-failure.patch @@ -0,0 +1,46 @@ +From: Dmitry Osipenko +Date: Wed, 19 Feb 2020 18:01:22 +0300 +Subject: nfc: pn544: Fix occasional HW initialization failure +Git-commit: c3331d2fe3fd4d5e321f2467d01f72de7edfb5d0 +Patch-mainline: 5.6-rc3 +References: networking-stable-20_03_01 + +The PN544 driver checks the "enable" polarity during of driver's probe and +it's doing that by turning ON and OFF NFC with different polarities until +enabling succeeds. It takes some time for the hardware to power-down, and +thus, to deassert the IRQ that is raised by turning ON the hardware. +Since the delay after last power-down of the polarity-checking process is +missed in the code, the interrupt may trigger immediately after installing +the IRQ handler (right after the checking is done), which results in IRQ +handler trying to touch the disabled HW and ends with marking NFC as +'DEAD' during of the driver's probe: + + pn544_hci_i2c 1-002a: NFC: nfc_en polarity : active high + pn544_hci_i2c 1-002a: NFC: invalid len byte + shdlc: llc_shdlc_recv_frame: NULL Frame -> link is dead + +This patch fixes the occasional NFC initialization failure on Nexus 7 +device. + +Signed-off-by: Dmitry Osipenko +Signed-off-by: David S. Miller +Signed-off-by: Jiri Slaby +--- + drivers/nfc/pn544/i2c.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nfc/pn544/i2c.c b/drivers/nfc/pn544/i2c.c +index 720c89d6066e..4ac8cb262559 100644 +--- a/drivers/nfc/pn544/i2c.c ++++ b/drivers/nfc/pn544/i2c.c +@@ -225,6 +225,7 @@ static void pn544_hci_i2c_platform_init(struct pn544_i2c_phy *phy) + + out: + gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity); ++ usleep_range(10000, 15000); + } + + static void pn544_hci_i2c_enable_mode(struct pn544_i2c_phy *phy, int run_mode) +-- +2.26.1 + diff --git a/patches.suse/qede-Fix-race-between-rdma-destroy-workqueue-and-lin.patch b/patches.suse/qede-Fix-race-between-rdma-destroy-workqueue-and-lin.patch new file mode 100644 index 0000000..55d00b7 --- /dev/null +++ b/patches.suse/qede-Fix-race-between-rdma-destroy-workqueue-and-lin.patch @@ -0,0 +1,104 @@ +From: Michal Kalderon +Date: Mon, 17 Feb 2020 13:37:18 +0200 +Subject: qede: Fix race between rdma destroy workqueue and link change event +Git-commit: af6565adb02d3129d3fae4d9d5da945abaf4417a +Patch-mainline: 5.6-rc3 +References: networking-stable-20_03_01 + +If an event is added while the rdma workqueue is being destroyed +it could lead to several races, list corruption, null pointer +dereference during queue_work or init_queue. +This fixes the race between the two flows which can occur during +shutdown. + +A kref object and a completion object are added to the rdma_dev +structure, these are initialized before the workqueue is created. +The refcnt is used to indicate work is being added to the +workqueue and ensures the cleanup flow won't start while we're in +the middle of adding the event. +Once the work is added, the refcnt is decreased and the cleanup flow +is safe to run. + +Fixes: cee9fbd8e2e ("qede: Add qedr framework") +Signed-off-by: Ariel Elior +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Jiri Slaby +--- + drivers/net/ethernet/qlogic/qede/qede.h | 2 + + drivers/net/ethernet/qlogic/qede/qede_rdma.c | 29 ++++++++++++++++++++++++++- + 2 files changed, 30 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/qlogic/qede/qede.h ++++ b/drivers/net/ethernet/qlogic/qede/qede.h +@@ -158,6 +158,8 @@ struct qede_rdma_dev { + struct list_head rdma_event_list; + struct workqueue_struct *rdma_wq; + bool exp_recovery; ++ struct kref refcnt; ++ struct completion event_comp; + }; + + struct qede_ptp; +--- a/drivers/net/ethernet/qlogic/qede/qede_rdma.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_rdma.c +@@ -57,6 +57,9 @@ static void _qede_rdma_dev_add(struct qe + static int qede_rdma_create_wq(struct qede_dev *edev) + { + INIT_LIST_HEAD(&edev->rdma_info.rdma_event_list); ++ kref_init(&edev->rdma_info.refcnt); ++ init_completion(&edev->rdma_info.event_comp); ++ + edev->rdma_info.rdma_wq = create_singlethread_workqueue("rdma_wq"); + if (!edev->rdma_info.rdma_wq) { + DP_NOTICE(edev, "qedr: Could not create workqueue\n"); +@@ -81,8 +84,23 @@ static void qede_rdma_cleanup_event(stru + } + } + ++static void qede_rdma_complete_event(struct kref *ref) ++{ ++ struct qede_rdma_dev *rdma_dev = ++ container_of(ref, struct qede_rdma_dev, refcnt); ++ ++ /* no more events will be added after this */ ++ complete(&rdma_dev->event_comp); ++} ++ + static void qede_rdma_destroy_wq(struct qede_dev *edev) + { ++ /* Avoid race with add_event flow, make sure it finishes before ++ * we start accessing the list and cleaning up the work ++ */ ++ kref_put(&edev->rdma_info.refcnt, qede_rdma_complete_event); ++ wait_for_completion(&edev->rdma_info.event_comp); ++ + qede_rdma_cleanup_event(edev); + destroy_workqueue(edev->rdma_info.rdma_wq); + } +@@ -287,15 +305,24 @@ static void qede_rdma_add_event(struct q + if (!edev->rdma_info.qedr_dev) + return; + ++ /* We don't want the cleanup flow to start while we're allocating and ++ * scheduling the work ++ */ ++ if (!kref_get_unless_zero(&edev->rdma_info.refcnt)) ++ return; /* already being destroyed */ ++ + event_node = qede_rdma_get_free_event_node(edev); + if (!event_node) +- return; ++ goto out; + + event_node->event = event; + event_node->ptr = edev; + + INIT_WORK(&event_node->work, qede_rdma_handle_event); + queue_work(edev->rdma_info.rdma_wq, &event_node->work); ++ ++out: ++ kref_put(&edev->rdma_info.refcnt, qede_rdma_complete_event); + } + + void qede_rdma_dev_event_open(struct qede_dev *edev) diff --git a/patches.suse/s390-cio-avoid-duplicated-add-uevents b/patches.suse/s390-cio-avoid-duplicated-add-uevents new file mode 100644 index 0000000..34ebc1f --- /dev/null +++ b/patches.suse/s390-cio-avoid-duplicated-add-uevents @@ -0,0 +1,58 @@ +From: Cornelia Huck +Date: Fri, 27 Mar 2020 13:45:02 +0100 +Subject: s390/cio: avoid duplicated 'ADD' uevents +Git-commit: 05ce3e53f375295c2940390b2b429e506e07655c +Patch-mainline: v5.7-rc1 +References: git-fixes + +The common I/O layer delays the ADD uevent for subchannels and +delegates generating this uevent to the individual subchannel +drivers. The io_subchannel driver will do so when the associated +ccw_device has been registered -- but unconditionally, so more +ADD uevents will be generated if a subchannel has been unbound +from the io_subchannel driver and later rebound. + +To fix this, only generate the ADD event if uevents were still +suppressed for the device. + +Fixes: fa1a8c23eb7d ("s390: cio: Delay uevents for subchannels") +Message-Id: <20200327124503.9794-2-cohuck@redhat.com> +Reported-by: Boris Fiuczynski +Reviewed-by: Peter Oberparleiter +Reviewed-by: Boris Fiuczynski +Signed-off-by: Cornelia Huck +Signed-off-by: Vasily Gorbik +Acked-by: Petr Tesarik +--- + drivers/s390/cio/device.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -870,8 +870,10 @@ static void io_subchannel_register(struc + * Now we know this subchannel will stay, we can throw + * our delayed uevent. + */ +- dev_set_uevent_suppress(&sch->dev, 0); +- kobject_uevent(&sch->dev.kobj, KOBJ_ADD); ++ if (dev_get_uevent_suppress(&sch->dev)) { ++ dev_set_uevent_suppress(&sch->dev, 0); ++ kobject_uevent(&sch->dev.kobj, KOBJ_ADD); ++ } + /* make it known to the system */ + ret = ccw_device_add(cdev); + if (ret) { +@@ -1079,8 +1081,11 @@ static int io_subchannel_probe(struct su + * Throw the delayed uevent for the subchannel, register + * the ccw_device and exit. + */ +- dev_set_uevent_suppress(&sch->dev, 0); +- kobject_uevent(&sch->dev.kobj, KOBJ_ADD); ++ if (dev_get_uevent_suppress(&sch->dev)) { ++ /* should always be the case for the console */ ++ dev_set_uevent_suppress(&sch->dev, 0); ++ kobject_uevent(&sch->dev.kobj, KOBJ_ADD); ++ } + cdev = sch_get_cdev(sch); + rc = ccw_device_add(cdev); + if (rc) { diff --git a/patches.suse/s390-cio-generate-delayed-uevent-for-vfio-ccw-subchannels b/patches.suse/s390-cio-generate-delayed-uevent-for-vfio-ccw-subchannels new file mode 100644 index 0000000..f695529 --- /dev/null +++ b/patches.suse/s390-cio-generate-delayed-uevent-for-vfio-ccw-subchannels @@ -0,0 +1,41 @@ +From: Cornelia Huck +Date: Fri, 27 Mar 2020 13:45:03 +0100 +Subject: s390/cio: generate delayed uevent for vfio-ccw subchannels +Git-commit: 2bc55eaeb88d30accfc1b6ac2708d4e4b81ca260 +Patch-mainline: v5.7-rc1 +References: git-fixes + +The common I/O layer delays the ADD uevent for subchannels and +delegates generating this uevent to the individual subchannel +drivers. The vfio-ccw I/O subchannel driver, however, did not +do that, and will not generate an ADD uevent for subchannels +that had not been bound to a different driver (or none at all, +which also triggers the uevent). + +Generate the ADD uevent at the end of the probe function if +uevents were still suppressed for the device. + +Message-Id: <20200327124503.9794-3-cohuck@redhat.com> +Fixes: 63f1934d562d ("vfio: ccw: basic implementation for vfio_ccw driver") +Reviewed-by: Eric Farman +Signed-off-by: Cornelia Huck +Signed-off-by: Vasily Gorbik +Acked-by: Petr Tesarik +--- + drivers/s390/cio/vfio_ccw_drv.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/s390/cio/vfio_ccw_drv.c ++++ b/drivers/s390/cio/vfio_ccw_drv.c +@@ -190,6 +190,11 @@ static int vfio_ccw_sch_probe(struct sub + atomic_set(&private->avail, 1); + private->state = VFIO_CCW_STATE_STANDBY; + ++ if (dev_get_uevent_suppress(&sch->dev)) { ++ dev_set_uevent_suppress(&sch->dev, 0); ++ kobject_uevent(&sch->dev.kobj, KOBJ_ADD); ++ } ++ + return 0; + + out_rm_group: diff --git a/patches.suse/s390-cpuinfo-fix-wrong-output-when-cpu0-is-offline b/patches.suse/s390-cpuinfo-fix-wrong-output-when-cpu0-is-offline new file mode 100644 index 0000000..92faef4 --- /dev/null +++ b/patches.suse/s390-cpuinfo-fix-wrong-output-when-cpu0-is-offline @@ -0,0 +1,42 @@ +From: Alexander Gordeev +Date: Mon, 16 Mar 2020 12:39:55 +0100 +Subject: s390/cpuinfo: fix wrong output when CPU0 is offline +Git-commit: 872f27103874a73783aeff2aac2b41a489f67d7c +Patch-mainline: v5.7-rc1 +References: git-fixes + +/proc/cpuinfo should not print information about CPU 0 when it is offline. + +Fixes: 281eaa8cb67c ("s390/cpuinfo: simplify locking and skip offline cpus early") +Signed-off-by: Alexander Gordeev +Reviewed-by: Heiko Carstens +[heiko.carstens@de.ibm.com: shortened commit message] +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Acked-by: Petr Tesarik +--- + arch/s390/kernel/processor.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/s390/kernel/processor.c ++++ b/arch/s390/kernel/processor.c +@@ -156,8 +156,9 @@ static void show_cpu_mhz(struct seq_file + static int show_cpuinfo(struct seq_file *m, void *v) + { + unsigned long n = (unsigned long) v - 1; ++ unsigned long first = cpumask_first(cpu_online_mask); + +- if (!n) ++ if (n == first) + show_cpu_summary(m, v); + if (!machine_has_cpu_mhz) + return 0; +@@ -170,6 +171,8 @@ static inline void *c_update(loff_t *pos + { + if (*pos) + *pos = cpumask_next(*pos - 1, cpu_online_mask); ++ else ++ *pos = cpumask_first(cpu_online_mask); + return *pos < nr_cpu_ids ? (void *)*pos + 1 : NULL; + } + diff --git a/patches.suse/s390-diag-fix-display-of-diagnose-call-statistics b/patches.suse/s390-diag-fix-display-of-diagnose-call-statistics new file mode 100644 index 0000000..ea40527 --- /dev/null +++ b/patches.suse/s390-diag-fix-display-of-diagnose-call-statistics @@ -0,0 +1,33 @@ +From: Michael Mueller +Date: Tue, 3 Mar 2020 16:42:01 +0100 +Subject: s390/diag: fix display of diagnose call statistics +Git-commit: 6c7c851f1b666a8a455678a0b480b9162de86052 +Patch-mainline: v5.7-rc1 +References: git-fixes + +Show the full diag statistic table and not just parts of it. + +The issue surfaced in a KVM guest with a number of vcpus +defined smaller than NR_DIAG_STAT. + +Fixes: 1ec2772e0c3c ("s390/diag: add a statistic for diagnose calls") +Cc: stable@vger.kernel.org +Signed-off-by: Michael Mueller +Reviewed-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Acked-by: Petr Tesarik +--- + arch/s390/kernel/diag.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/kernel/diag.c ++++ b/arch/s390/kernel/diag.c +@@ -78,7 +78,7 @@ static int show_diag_stat(struct seq_fil + + static void *show_diag_stat_start(struct seq_file *m, loff_t *pos) + { +- return *pos <= nr_cpu_ids ? (void *)((unsigned long) *pos + 1) : NULL; ++ return *pos <= NR_DIAG_STAT ? (void *)((unsigned long) *pos + 1) : NULL; + } + + static void *show_diag_stat_next(struct seq_file *m, void *v, loff_t *pos) diff --git a/patches.suse/s390-gmap-return-proper-error-code-on-ksm-unsharing b/patches.suse/s390-gmap-return-proper-error-code-on-ksm-unsharing new file mode 100644 index 0000000..e69d2f7 --- /dev/null +++ b/patches.suse/s390-gmap-return-proper-error-code-on-ksm-unsharing @@ -0,0 +1,48 @@ +From: Christian Borntraeger +Date: Fri, 27 Mar 2020 08:06:42 +0100 +Subject: s390/gmap: return proper error code on ksm unsharing +Git-commit: 7a2653612bb6f18fb236c5b0c4d28f7b459bf7c2 +Patch-mainline: v5.7-rc1 +References: git-fixes + +If a signal is pending we might return -ENOMEM instead of -EINTR. +We should propagate the proper error during KSM unsharing. +unmerge_ksm_pages returns -ERESTARTSYS on signal_pending. This gets +translated by entry.S to -EINTR. It is important to get this error +code so that userspace can retry. + +To make this clearer we also add -EINTR to the documentation of the +PV_ENABLE call, which calls unmerge_ksm_pages. + +Fixes: 3ac8e38015d4 ("s390/mm: disable KSM for storage key enabled pages") +Reviewed-by: Janosch Frank +Reported-by: Marc Hartmayer +Tested-by: Marc Hartmayer +Reviewed-by: David Hildenbrand +Reviewed-by: Cornelia Huck +Signed-off-by: Christian Borntraeger +[ ptesarik: Documentaiton part omitted, becase SLE15 lacks upstream + commit 04ed89dc4aeba57ab99df16edbd9d06e43d0a2c4. + The patched code is in s390_enable_skey(), because we do not have + commit fa0c5eabbdd33012b369cf75d6a39389cc9ae707 either. ] +Acked-by: Petr Tesarik +--- + arch/s390/mm/gmap.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/s390/mm/gmap.c ++++ b/arch/s390/mm/gmap.c +@@ -2198,10 +2198,10 @@ int s390_enable_skey(void) + + mm->context.uses_skeys = 1; + for (vma = mm->mmap; vma; vma = vma->vm_next) { +- if (ksm_madvise(vma, vma->vm_start, vma->vm_end, +- MADV_UNMERGEABLE, &vma->vm_flags)) { ++ rc = ksm_madvise(vma, vma->vm_start, vma->vm_end, ++ MADV_UNMERGEABLE, &vma->vm_flags); ++ if (rc) { + mm->context.uses_skeys = 0; +- rc = -ENOMEM; + goto out_up; + } + } diff --git a/patches.suse/s390-qeth-cancel-rx-reclaim-work-earlier b/patches.suse/s390-qeth-cancel-rx-reclaim-work-earlier new file mode 100644 index 0000000..7ee5245 --- /dev/null +++ b/patches.suse/s390-qeth-cancel-rx-reclaim-work-earlier @@ -0,0 +1,55 @@ +From: Julian Wiedmann +Date: Tue, 10 Mar 2020 18:38:03 +0100 +Subject: s390/qeth: cancel RX reclaim work earlier +Git-commit: 0e635c2a8713e3e013b4adcb7cb7e28a048b7c42 +Patch-mainline: v5.6-rc6 +References: git-fixes + +When qeth's napi poll code fails to refill an entirely empty RX ring, it +kicks off buffer_reclaim_work to try again later. + +Make sure that this worker is cancelled when setting the qeth device +offline. Otherwise a RX refill action can unexpectedly end up running +concurrently to bigger re-configurations (eg. resizing the buffer pool), +without any locking. + +Fixes: b333293058aa ("qeth: add support for af_iucv HiperSockets transport") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Acked-by: Petr Tesarik +--- + drivers/s390/net/qeth_core_main.c | 1 - + drivers/s390/net/qeth_l2_main.c | 1 + + drivers/s390/net/qeth_l3_main.c | 1 + + 3 files changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -2593,7 +2593,6 @@ static void qeth_free_qdio_buffers(struc + return; + + qeth_free_cq(card); +- cancel_delayed_work_sync(&card->buffer_reclaim_work); + for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; ++j) { + if (card->qdio.in_q->bufs[j].rx_skb) + dev_kfree_skb_any(card->qdio.in_q->bufs[j].rx_skb); +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -435,6 +435,7 @@ static void qeth_l2_stop_card(struct qet + if (card->state == CARD_STATE_HARDSETUP) { + qeth_clear_qdio_buffers(card); + qeth_clear_working_pool_list(card); ++ cancel_delayed_work_sync(&card->buffer_reclaim_work); + card->state = CARD_STATE_DOWN; + } + if (card->state == CARD_STATE_DOWN) { +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -1904,6 +1904,7 @@ static void qeth_l3_stop_card(struct qet + if (card->state == CARD_STATE_HARDSETUP) { + qeth_clear_qdio_buffers(card); + qeth_clear_working_pool_list(card); ++ cancel_delayed_work_sync(&card->buffer_reclaim_work); + card->state = CARD_STATE_DOWN; + } + if (card->state == CARD_STATE_DOWN) { diff --git a/patches.suse/s390-qeth-don-t-return-enotsupp-to-userspace b/patches.suse/s390-qeth-don-t-return-enotsupp-to-userspace new file mode 100644 index 0000000..cd6ee88 --- /dev/null +++ b/patches.suse/s390-qeth-don-t-return-enotsupp-to-userspace @@ -0,0 +1,28 @@ +From: Julian Wiedmann +Date: Wed, 18 Dec 2019 16:32:28 +0100 +Subject: s390/qeth: don't return -ENOTSUPP to userspace +Git-commit: 39bdbf3e648d801596498a5a625fbc9fc1c0002f +Patch-mainline: v5.5-rc3 +References: git-fixes + +ENOTSUPP is not uapi, use EOPNOTSUPP instead. + +Fixes: d66cb37e9664 ("qeth: Add new priority queueing options") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Acked-by: Petr Tesarik +--- + drivers/s390/net/qeth_core_sys.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/s390/net/qeth_core_sys.c ++++ b/drivers/s390/net/qeth_core_sys.c +@@ -228,7 +228,7 @@ static ssize_t qeth_dev_prioqing_store(s + card->qdio.default_out_queue = QETH_DEFAULT_QUEUE; + } else if (sysfs_streq(buf, "prio_queueing_vlan")) { + if (IS_LAYER3(card)) { +- rc = -ENOTSUPP; ++ rc = -EOPNOTSUPP; + goto out; + } + card->qdio.do_prio_queueing = QETH_PRIO_Q_ING_VLAN; diff --git a/patches.suse/s390-qeth-don-t-warn-for-napi-with-0-budget b/patches.suse/s390-qeth-don-t-warn-for-napi-with-0-budget new file mode 100644 index 0000000..733b616 --- /dev/null +++ b/patches.suse/s390-qeth-don-t-warn-for-napi-with-0-budget @@ -0,0 +1,41 @@ +From: Julian Wiedmann +Date: Thu, 20 Feb 2020 15:54:55 +0100 +Subject: s390/qeth: don't warn for napi with 0 budget +Git-commit: 420579dba126c6111b5a3dea062f21a7e4e647c6 +Patch-mainline: v5.6-rc3 +References: git-fixes + +Calling napi->poll() with 0 budget is a legitimate use by netpoll. + +Fixes: a1c3ed4c9ca0 ("qeth: NAPI support for l2 and l3 discipline") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +[ ptesarik: SLE15 does not contain upstream commit + c04b116a2866b3e3a6b909a576769ccde3d622ac, so qeth_l2 and qeth_l3 + must be patched separately. ] +Signed-off-by: Petr Tesarik +--- + drivers/s390/net/qeth_l2_main.c | 1 - + drivers/s390/net/qeth_l3_main.c | 1 - + 2 files changed, 2 deletions(-) + +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -456,7 +456,6 @@ static int qeth_l2_process_inbound_buffe + unsigned int len; + + *done = 0; +- WARN_ON_ONCE(!budget); + while (budget) { + skb = qeth_core_get_next_skb(card, + &card->qdio.in_q->bufs[card->rx.b_index], +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -1759,7 +1759,6 @@ static int qeth_l3_process_inbound_buffe + __u16 magic; + + *done = 0; +- WARN_ON_ONCE(!budget); + while (budget) { + skb = qeth_core_get_next_skb(card, + &card->qdio.in_q->bufs[card->rx.b_index], diff --git a/patches.suse/s390-qeth-fix-off-by-one-in-rx-copybreak-check b/patches.suse/s390-qeth-fix-off-by-one-in-rx-copybreak-check new file mode 100644 index 0000000..525a2a8 --- /dev/null +++ b/patches.suse/s390-qeth-fix-off-by-one-in-rx-copybreak-check @@ -0,0 +1,29 @@ +From: Julian Wiedmann +Date: Thu, 20 Feb 2020 15:54:56 +0100 +Subject: s390/qeth: fix off-by-one in RX copybreak check +Git-commit: 54a61fbc020fd2e305680871c453abcf7fc0339b +Patch-mainline: v5.6-rc3 +References: git-fixes + +The RX copybreak is intended as the _max_ value where the frame's data +should be copied. So for frame_len == copybreak, don't build an SG skb. + +Fixes: 4a71df50047f ("qeth: new qeth device driver") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Acked-by: Petr Tesarik +--- + drivers/s390/net/qeth_core_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -5301,7 +5301,7 @@ struct sk_buff *qeth_core_get_next_skb(s + return NULL; + } + +- if (((skb_len >= card->options.rx_sg_cb) && ++ if (((skb_len > card->options.rx_sg_cb) && + (!(card->info.type == QETH_CARD_TYPE_OSN)) && + (!atomic_read(&card->force_alloc_skb))) || + (card->options.cq == QETH_CQ_ENABLED)) diff --git a/patches.suse/s390-qeth-fix-promiscuous-mode-after-reset b/patches.suse/s390-qeth-fix-promiscuous-mode-after-reset new file mode 100644 index 0000000..866fd98 --- /dev/null +++ b/patches.suse/s390-qeth-fix-promiscuous-mode-after-reset @@ -0,0 +1,64 @@ +From: Julian Wiedmann +Date: Wed, 18 Dec 2019 16:32:27 +0100 +Subject: s390/qeth: fix promiscuous mode after reset +Git-commit: 0f399305cd31e5c813086eaa264f7f47e205c10e +Patch-mainline: v5.5-rc3 +References: git-fixes + +When managing the promiscuous mode during an RX modeset, qeth caches the +current HW state to avoid repeated programming of the same state on each +modeset. + +But while tearing down a device, we forget to clear the cached state. So +when the device is later set online again, the initial RX modeset +doesn't program the promiscuous mode since we believe it is already +enabled. +Fix this by clearing the cached state in the tear-down path. + +Note that for the SBP variant of promiscuous mode, this accidentally +works right now because we unconditionally restore the SBP role while +re-initializing. + +Fixes: 4a71df50047f ("qeth: new qeth device driver") +Signed-off-by: Julian Wiedmann +Reviewed-by: Alexandra Winter +Signed-off-by: David S. Miller +Acked-by: Petr Tesarik +--- + drivers/s390/net/qeth_l2_main.c | 1 + + drivers/s390/net/qeth_l2_sys.c | 3 ++- + drivers/s390/net/qeth_l3_main.c | 1 + + 3 files changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -444,6 +444,7 @@ static void qeth_l2_stop_card(struct qet + } + + flush_workqueue(card->event_wq); ++ card->info.promisc_mode = 0; + } + + static int qeth_l2_process_inbound_buffer(struct qeth_card *card, +--- a/drivers/s390/net/qeth_l2_sys.c ++++ b/drivers/s390/net/qeth_l2_sys.c +@@ -271,7 +271,8 @@ void qeth_l2_setup_bridgeport_attrs(stru + return; + + mutex_lock(&card->sbp_lock); +- if (card->options.sbp.role != QETH_SBP_ROLE_NONE) { ++ if (!card->options.sbp.reflect_promisc && ++ card->options.sbp.role != QETH_SBP_ROLE_NONE) { + /* Conditional to avoid spurious error messages */ + qeth_bridgeport_setrole(card, card->options.sbp.role); + /* Let the callback function refresh the stored role value. */ +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -1914,6 +1914,7 @@ static void qeth_l3_stop_card(struct qet + } + + flush_workqueue(card->event_wq); ++ card->info.promisc_mode = 0; + } + + /* diff --git a/patches.suse/s390-qeth-fix-qdio-teardown-after-early-init-error b/patches.suse/s390-qeth-fix-qdio-teardown-after-early-init-error new file mode 100644 index 0000000..e21c914 --- /dev/null +++ b/patches.suse/s390-qeth-fix-qdio-teardown-after-early-init-error @@ -0,0 +1,135 @@ +From: Julian Wiedmann +Date: Mon, 23 Dec 2019 15:03:21 +0100 +Subject: s390/qeth: fix qdio teardown after early init error +Git-commit: 8b5026bc16938920e4780b9094c3bf20e1e0939d +Patch-mainline: v5.5-rc5 +References: git-fixes + +qeth_l?_set_online() goes through a number of initialization steps, and +on any error uses qeth_l?_stop_card() to tear down the residual state. + +The first initialization step is qeth_core_hardsetup_card(). When this +fails after having established a QDIO context on the device +(ie. somewhere after qeth_mpc_initialize()), qeth_l?_stop_card() doesn't +shut down this QDIO context again (since the card state hasn't +progressed from DOWN at this stage). + +Even worse, we then call qdio_free() as final teardown step to free the +QDIO data structures - while some of them are still hooked into wider +QDIO infrastructure such as the IRQ list. This is inevitably followed by +use-after-frees and other nastyness. + +Fix this by unconditionally calling qeth_qdio_clear_card() to shut down +the QDIO context, and also to halt/clear any pending activity on the +various IO channels. +Remove the naive attempt at handling the teardown in +qeth_mpc_initialize(), it clearly doesn't suffice and we're handling it +properly now in the wider teardown code. + +Fixes: 4a71df50047f ("qeth: new qeth device driver") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Acked-by: Petr Tesarik +--- + drivers/s390/net/qeth_core_main.c | 20 ++++++++------------ + drivers/s390/net/qeth_l2_main.c | 2 +- + drivers/s390/net/qeth_l3_main.c | 2 +- + 3 files changed, 10 insertions(+), 14 deletions(-) + +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -2675,50 +2675,46 @@ static int qeth_mpc_initialize(struct qe + rc = qeth_cm_enable(card); + if (rc) { + QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc); +- goto out_qdio; ++ return rc; + } + rc = qeth_cm_setup(card); + if (rc) { + QETH_DBF_TEXT_(SETUP, 2, "3err%d", rc); +- goto out_qdio; ++ return rc; + } + rc = qeth_ulp_enable(card); + if (rc) { + QETH_DBF_TEXT_(SETUP, 2, "4err%d", rc); +- goto out_qdio; ++ return rc; + } + rc = qeth_ulp_setup(card); + if (rc) { + QETH_DBF_TEXT_(SETUP, 2, "5err%d", rc); +- goto out_qdio; ++ return rc; + } + rc = qeth_alloc_qdio_buffers(card); + if (rc) { + QETH_DBF_TEXT_(SETUP, 2, "5err%d", rc); +- goto out_qdio; ++ return rc; + } + rc = qeth_qdio_establish(card); + if (rc) { + QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc); + qeth_free_qdio_buffers(card); +- goto out_qdio; ++ return rc; + } + rc = qeth_qdio_activate(card); + if (rc) { + QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc); +- goto out_qdio; ++ return rc; + } + rc = qeth_dm_act(card); + if (rc) { + QETH_DBF_TEXT_(SETUP, 2, "8err%d", rc); +- goto out_qdio; ++ return rc; + } + + return 0; +-out_qdio: +- qeth_qdio_clear_card(card, card->info.type != QETH_CARD_TYPE_IQD); +- qdio_free(CARD_DDEV(card)); +- return rc; + } + + void qeth_print_status_message(struct qeth_card *card) +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -433,7 +433,6 @@ static void qeth_l2_stop_card(struct qet + card->state = CARD_STATE_HARDSETUP; + } + if (card->state == CARD_STATE_HARDSETUP) { +- qeth_qdio_clear_card(card, 0); + qeth_clear_qdio_buffers(card); + qeth_clear_working_pool_list(card); + card->state = CARD_STATE_DOWN; +@@ -443,6 +442,7 @@ static void qeth_l2_stop_card(struct qet + qeth_clear_cmd_buffers(&card->write); + } + ++ qeth_qdio_clear_card(card, 0); + flush_workqueue(card->event_wq); + card->info.promisc_mode = 0; + } +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -1903,7 +1903,6 @@ static void qeth_l3_stop_card(struct qet + card->state = CARD_STATE_HARDSETUP; + } + if (card->state == CARD_STATE_HARDSETUP) { +- qeth_qdio_clear_card(card, 0); + qeth_clear_qdio_buffers(card); + qeth_clear_working_pool_list(card); + card->state = CARD_STATE_DOWN; +@@ -1913,6 +1912,7 @@ static void qeth_l3_stop_card(struct qet + qeth_clear_cmd_buffers(&card->write); + } + ++ qeth_qdio_clear_card(card, 0); + flush_workqueue(card->event_wq); + card->info.promisc_mode = 0; + } diff --git a/patches.suse/s390-qeth-handle-error-due-to-unsupported-transport-mode b/patches.suse/s390-qeth-handle-error-due-to-unsupported-transport-mode new file mode 100644 index 0000000..700b72b --- /dev/null +++ b/patches.suse/s390-qeth-handle-error-due-to-unsupported-transport-mode @@ -0,0 +1,76 @@ +From: Julian Wiedmann +Date: Wed, 18 Dec 2019 16:32:26 +0100 +Subject: s390/qeth: handle error due to unsupported transport mode +Git-commit: 2e3d7fa5d29b7ab649fdf8f9533ae0c0888a7fac +Patch-mainline: v5.5-rc3 +References: git-fixes + +Along with z/VM NICs, there's additional device types that only support +a specific transport mode (eg. external-bridged IQD). +Identify the corresponding error code, and raise a fitting error message +so that the user knows to adjust their device configuration. + +On top of that also fix the subsequent error path, so that the rejected +cmd doesn't need to wait for a timeout but gets cancelled straight away. + +Fixes: 4a71df50047f ("qeth: new qeth device driver") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Acked-by: Petr Tesarik +--- + drivers/s390/net/qeth_core_main.c | 14 +++++++------- + drivers/s390/net/qeth_core_mpc.h | 5 +++++ + 2 files changed, 12 insertions(+), 7 deletions(-) + +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -741,17 +741,17 @@ static int qeth_check_idx_response(struc + return 0; + + QETH_DBF_HEX(CTRL, 2, buffer, QETH_DBF_CTRL_LEN); +- if ((buffer[2] & 0xc0) == 0xc0) { ++ if ((buffer[2] & QETH_IDX_TERMINATE_MASK) == QETH_IDX_TERMINATE) { + QETH_DBF_MESSAGE(2, "received an IDX TERMINATE with cause code %#04x\n", + buffer[4]); + QETH_CARD_TEXT(card, 2, "ckidxres"); + QETH_CARD_TEXT(card, 2, " idxterm"); +- QETH_CARD_TEXT_(card, 2, " rc%d", -EIO); +- if (buffer[4] == 0xf6) { ++ QETH_CARD_TEXT_(card, 2, "rc%x", buffer[4]); ++ if (buffer[4] == QETH_IDX_TERM_BAD_TRANSPORT || ++ buffer[4] == QETH_IDX_TERM_BAD_TRANSPORT_VM) { + dev_err(&card->gdev->dev, +- "The qeth device is not configured " +- "for the OSI layer required by z/VM\n"); +- return -EPERM; ++ "The device does not support the configured transport mode\n"); ++ return -EPROTONOSUPPORT; + } + return -EIO; + } +@@ -879,10 +879,10 @@ static void qeth_send_control_data_cb(st + case 0: + break; + case -EIO: +- qeth_clear_ipacmd_list(card); + qeth_schedule_recovery(card); + /* fall through */ + default: ++ qeth_clear_ipacmd_list(card); + goto out; + } + +--- a/drivers/s390/net/qeth_core_mpc.h ++++ b/drivers/s390/net/qeth_core_mpc.h +@@ -901,6 +901,11 @@ extern unsigned char IDX_ACTIVATE_WRITE[ + #define QETH_IDX_ACT_ERR_AUTH 0x1E + #define QETH_IDX_ACT_ERR_AUTH_USER 0x20 + ++#define QETH_IDX_TERMINATE 0xc0 ++#define QETH_IDX_TERMINATE_MASK 0xc0 ++#define QETH_IDX_TERM_BAD_TRANSPORT 0x41 ++#define QETH_IDX_TERM_BAD_TRANSPORT_VM 0xf6 ++ + #define PDU_ENCAPSULATION(buffer) \ + (buffer + *(buffer + (*(buffer + 0x0b)) + \ + *(buffer + *(buffer + 0x0b) + 0x11) + 0x07)) diff --git a/patches.suse/s390-qeth-handle-error-when-backing-rx-buffer b/patches.suse/s390-qeth-handle-error-when-backing-rx-buffer new file mode 100644 index 0000000..6ca3543 --- /dev/null +++ b/patches.suse/s390-qeth-handle-error-when-backing-rx-buffer @@ -0,0 +1,54 @@ +From: Julian Wiedmann +Date: Tue, 10 Mar 2020 18:38:02 +0100 +Subject: s390/qeth: handle error when backing RX buffer +Git-commit: 17413852804d7e86e6f0576cca32c1541817800e +Patch-mainline: v5.6-rc6 +References: git-fixes + +qeth_init_qdio_queues() fills the RX ring with an initial set of +RX buffers. If qeth_init_input_buffer() fails to back one of the RX +buffers with memory, we need to bail out and report the error. + +Fixes: 4a71df50047f ("qeth: new qeth device driver") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Acked-by: Petr Tesarik +--- + drivers/s390/net/qeth_core_main.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -2828,12 +2828,12 @@ static int qeth_init_input_buffer(struct + buf->rx_skb = netdev_alloc_skb(card->dev, + QETH_RX_PULL_LEN + ETH_HLEN); + if (!buf->rx_skb) +- return 1; ++ return -ENOMEM; + } + + pool_entry = qeth_find_free_buffer_pool_entry(card); + if (!pool_entry) +- return 1; ++ return -ENOBUFS; + + /* + * since the buffer is accessed only from the input_tasklet +@@ -2865,10 +2865,15 @@ int qeth_init_qdio_queues(struct qeth_ca + /* inbound queue */ + qdio_reset_buffers(card->qdio.in_q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q); + memset(&card->rx, 0, sizeof(struct qeth_rx)); ++ + qeth_initialize_working_pool_list(card); + /*give only as many buffers to hardware as we have buffer pool entries*/ +- for (i = 0; i < card->qdio.in_buf_pool.buf_count - 1; ++i) +- qeth_init_input_buffer(card, &card->qdio.in_q->bufs[i]); ++ for (i = 0; i < card->qdio.in_buf_pool.buf_count - 1; i++) { ++ rc = qeth_init_input_buffer(card, &card->qdio.in_q->bufs[i]); ++ if (rc) ++ return rc; ++ } ++ + card->qdio.in_q->next_buf_to_init = + card->qdio.in_buf_pool.buf_count - 1; + rc = do_QDIO(CARD_DDEV(card), QDIO_FLAG_SYNC_INPUT, 0, 0, diff --git a/patches.suse/s390-qeth-lock-the-card-while-changing-its-hsuid b/patches.suse/s390-qeth-lock-the-card-while-changing-its-hsuid new file mode 100644 index 0000000..e4e1e5e --- /dev/null +++ b/patches.suse/s390-qeth-lock-the-card-while-changing-its-hsuid @@ -0,0 +1,114 @@ +From: Julian Wiedmann +Date: Mon, 23 Dec 2019 15:03:22 +0100 +Subject: s390/qeth: lock the card while changing its hsuid +Git-commit: 5b6c7b55cfe26224b0f41b1c226d3534c542787f +Patch-mainline: v5.5-rc5 +References: git-fixes + +qeth_l3_dev_hsuid_store() initially checks the card state, but doesn't +take the conf_mutex to ensure that the card stays in this state while +being reconfigured. + +Rework the code to take this lock, and drop a redundant state check in a +helper function. + +Fixes: b333293058aa ("qeth: add support for af_iucv HiperSockets transport") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +[ ptesarik: All other returns under mutex also converted to gotos. ] +Signed-off-by: Petr Tesarik +--- + drivers/s390/net/qeth_core_main.c | 6 ----- + drivers/s390/net/qeth_l3_sys.c | 40 ++++++++++++++++++++++++++------------ + 2 files changed, 28 insertions(+), 18 deletions(-) + +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -3519,12 +3519,6 @@ int qeth_configure_cq(struct qeth_card * + goto out; + } + +- if (card->state != CARD_STATE_DOWN && +- card->state != CARD_STATE_RECOVER) { +- rc = -1; +- goto out; +- } +- + qeth_free_qdio_buffers(card); + card->options.cq = cq; + rc = 0; +--- a/drivers/s390/net/qeth_l3_sys.c ++++ b/drivers/s390/net/qeth_l3_sys.c +@@ -271,25 +271,37 @@ static ssize_t qeth_l3_dev_hsuid_store(s + struct device_attribute *attr, const char *buf, size_t count) + { + struct qeth_card *card = dev_get_drvdata(dev); ++ int rc = 0; + char *tmp; +- int rc; + + if (!card) + return -EINVAL; + + if (card->info.type != QETH_CARD_TYPE_IQD) + return -EPERM; ++ ++ mutex_lock(&card->conf_mutex); + if (card->state != CARD_STATE_DOWN && +- card->state != CARD_STATE_RECOVER) +- return -EPERM; +- if (card->options.sniffer) +- return -EPERM; +- if (card->options.cq == QETH_CQ_NOTAVAILABLE) +- return -EPERM; ++ card->state != CARD_STATE_RECOVER) { ++ rc = -EPERM; ++ goto out; ++ } ++ ++ if (card->options.sniffer) { ++ rc = -EPERM; ++ goto out; ++ } ++ ++ if (card->options.cq == QETH_CQ_NOTAVAILABLE) { ++ rc = -EPERM; ++ goto out; ++ } + + tmp = strsep((char **)&buf, "\n"); +- if (strlen(tmp) > 8) +- return -EINVAL; ++ if (strlen(tmp) > 8) { ++ rc = -EINVAL; ++ goto out; ++ } + + if (card->options.hsuid[0]) + /* delete old ip address */ +@@ -300,11 +312,13 @@ static ssize_t qeth_l3_dev_hsuid_store(s + card->options.hsuid[0] = '\0'; + memcpy(card->dev->perm_addr, card->options.hsuid, 9); + qeth_configure_cq(card, QETH_CQ_DISABLED); +- return count; ++ goto out; + } + +- if (qeth_configure_cq(card, QETH_CQ_ENABLED)) +- return -EPERM; ++ if (qeth_configure_cq(card, QETH_CQ_ENABLED)) { ++ rc = -EPERM; ++ goto out; ++ } + + snprintf(card->options.hsuid, sizeof(card->options.hsuid), + "%-8s", tmp); +@@ -313,6 +327,8 @@ static ssize_t qeth_l3_dev_hsuid_store(s + + rc = qeth_l3_modify_hsuid(card, true); + ++out: ++ mutex_unlock(&card->conf_mutex); + return rc ? rc : count; + } + diff --git a/patches.suse/s390-qeth-support-net-namespaces-for-l3-devices b/patches.suse/s390-qeth-support-net-namespaces-for-l3-devices new file mode 100644 index 0000000..0377f2a --- /dev/null +++ b/patches.suse/s390-qeth-support-net-namespaces-for-l3-devices @@ -0,0 +1,32 @@ +From: Julian Wiedmann +Date: Fri, 27 Mar 2020 12:00:42 +0100 +Subject: s390/qeth: support net namespaces for L3 devices +Git-commit: b8f14878e6ae210cad4025bfc97dca877b4df721 +Patch-mainline: v5.7-rc1 +References: git-fixes + +Enable the L3 driver's IPv4 address notifier to watch for events on qeth +devices that have been moved into a net namespace. We need to program +those IPs into the HW just as usual, otherwise inbound traffic won't +flow. + +Fixes: 6133fb1aa137 ("[NETNS]: Disable inetaddr notifiers in namespaces other than initial.") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Acked-by: Petr Tesarik +--- + drivers/s390/net/qeth_l3_main.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -3306,9 +3306,6 @@ static int qeth_l3_ip_event(struct notif + struct qeth_ipaddr addr; + struct qeth_card *card; + +- if (dev_net(dev) != &init_net) +- return NOTIFY_DONE; +- + card = qeth_l3_get_card_from_dev(dev); + if (!card) + return NOTIFY_DONE; diff --git a/patches.suse/s390-time-fix-clk-type-in-get_tod_clock b/patches.suse/s390-time-fix-clk-type-in-get_tod_clock new file mode 100644 index 0000000..212e77a --- /dev/null +++ b/patches.suse/s390-time-fix-clk-type-in-get_tod_clock @@ -0,0 +1,51 @@ +From: Nathan Chancellor +Date: Sat, 8 Feb 2020 07:08:59 -0700 +Subject: s390/time: Fix clk type in get_tod_clock +Git-commit: 0f8a206df7c920150d2aa45574fba0ab7ff6be4f +Patch-mainline: v5.6-rc2 +References: git-fixes + +Clang warns: + +In file included from ../arch/s390/boot/startup.c:3: +In file included from ../include/linux/elf.h:5: +In file included from ../arch/s390/include/asm/elf.h:132: +In file included from ../include/linux/compat.h:10: +In file included from ../include/linux/time.h:74: +In file included from ../include/linux/time32.h:13: +In file included from ../include/linux/timex.h:65: +../arch/s390/include/asm/timex.h:160:20: warning: passing 'unsigned char +[16]' to parameter of type 'char *' converts between pointers to integer +types with different sign [-Wpointer-sign] + get_tod_clock_ext(clk); + ^~~ +../arch/s390/include/asm/timex.h:149:44: note: passing argument to +parameter 'clk' here +static inline void get_tod_clock_ext(char *clk) + ^ + +Change clk's type to just be char so that it matches what happens in +get_tod_clock_ext. + +Fixes: 57b28f66316d ("[S390] s390_hypfs: Add new attributes") +Link: https://github.com/ClangBuiltLinux/linux/issues/861 +Link: http://lkml.kernel.org/r/20200208140858.47970-1-natechancellor@gmail.com +Reviewed-by: Nick Desaulniers +Signed-off-by: Nathan Chancellor +Signed-off-by: Vasily Gorbik +Acked-by: Petr Tesarik +--- + arch/s390/include/asm/timex.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/include/asm/timex.h ++++ b/arch/s390/include/asm/timex.h +@@ -151,7 +151,7 @@ static inline void get_tod_clock_ext(cha + + static inline unsigned long long get_tod_clock(void) + { +- unsigned char clk[STORE_CLOCK_EXT_SIZE]; ++ char clk[STORE_CLOCK_EXT_SIZE]; + + get_tod_clock_ext(clk); + return *((unsigned long long *)&clk[1]); diff --git a/patches.suse/scsi-zfcp-fix-missing-erp_lock-in-port-recovery-trigger-for-point-to-point b/patches.suse/scsi-zfcp-fix-missing-erp_lock-in-port-recovery-trigger-for-point-to-point new file mode 100644 index 0000000..29c989a --- /dev/null +++ b/patches.suse/scsi-zfcp-fix-missing-erp_lock-in-port-recovery-trigger-for-point-to-point @@ -0,0 +1,77 @@ +From: Steffen Maier +Date: Thu, 12 Mar 2020 18:44:56 +0100 +Subject: scsi: zfcp: fix missing erp_lock in port recovery trigger for + point-to-point +Git-commit: 819732be9fea728623e1ed84eba28def7384ad1f +Patch-mainline: v5.7-rc1 +References: git-fixes + +v2.6.27 commit cc8c282963bd ("[SCSI] zfcp: Automatically attach remote +ports") introduced zfcp automatic port scan. + +Before that, the user had to use the sysfs attribute "port_add" of an FCP +device (adapter) to add and open remote (target) ports, even for the remote +peer port in point-to-point topology. That code path did a proper port open +recovery trigger taking the erp_lock. + +Since above commit, a new helper function zfcp_erp_open_ptp_port() +performed an UNlocked port open recovery trigger. This can race with other +parallel recovery triggers. In zfcp_erp_action_enqueue() this could corrupt +e.g. adapter->erp_total_count or adapter->erp_ready_head. + +As already found for fabric topology in v4.17 commit fa89adba1941 ("scsi: +zfcp: fix infinite iteration on ERP ready list"), there was an endless loop +during tracing of rport (un)block. A subsequent v4.18 commit 9e156c54ace3 +("scsi: zfcp: assert that the ERP lock is held when tracing a recovery +trigger") introduced a lockdep assertion for that case. + +As a side effect, that lockdep assertion now uncovered the unlocked code +path for PtP. It is from within an adapter ERP action: + +zfcp_erp_strategy[1479] intentionally DROPs erp lock around + zfcp_erp_strategy_do_action() +zfcp_erp_strategy_do_action[1441] NO erp lock +zfcp_erp_adapter_strategy[876] NO erp lock +zfcp_erp_adapter_strategy_open[855] NO erp lock +zfcp_erp_adapter_strategy_open_fsf[806]NO erp lock +zfcp_erp_adapter_strat_fsf_xconf[772] erp lock only around + zfcp_erp_action_to_running(), + BUT *_not_* around + zfcp_erp_enqueue_ptp_port() +zfcp_erp_enqueue_ptp_port[728] BUG: *_not_* taking erp lock +_zfcp_erp_port_reopen[432] assumes to be called with erp lock +zfcp_erp_action_enqueue[314] assumes to be called with erp lock +zfcp_dbf_rec_trig[288] _checks_ to be called with erp lock: + lockdep_assert_held(&adapter->erp_lock); + +It causes the following lockdep warning: + +WARNING: CPU: 2 PID: 775 at drivers/s390/scsi/zfcp_dbf.c:288 + zfcp_dbf_rec_trig+0x16a/0x188 +no locks held by zfcperp0.0.17c0/775. + +Fix this by using the proper locked recovery trigger helper function. + +Link: https://lore.kernel.org/r/20200312174505.51294-2-maier@linux.ibm.com +Fixes: cc8c282963bd ("[SCSI] zfcp: Automatically attach remote ports") +Cc: #v2.6.27+ +Reviewed-by: Jens Remus +Reviewed-by: Benjamin Block +Signed-off-by: Steffen Maier +Signed-off-by: Martin K. Petersen +Acked-by: Petr Tesarik +--- + drivers/s390/scsi/zfcp_erp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/s390/scsi/zfcp_erp.c ++++ b/drivers/s390/scsi/zfcp_erp.c +@@ -743,7 +743,7 @@ static void zfcp_erp_enqueue_ptp_port(st + adapter->peer_d_id); + if (IS_ERR(port)) /* error or port already attached */ + return; +- _zfcp_erp_port_reopen(port, 0, "ereptp1"); ++ zfcp_erp_port_reopen(port, 0, "ereptp1"); + } + + static int zfcp_erp_adapter_strat_fsf_xconf(struct zfcp_erp_action *erp_action) diff --git a/patches.suse/sctp-move-the-format-error-check-out-of-__sctp_sf_do.patch b/patches.suse/sctp-move-the-format-error-check-out-of-__sctp_sf_do.patch new file mode 100644 index 0000000..3333822 --- /dev/null +++ b/patches.suse/sctp-move-the-format-error-check-out-of-__sctp_sf_do.patch @@ -0,0 +1,101 @@ +From: Xin Long +Date: Tue, 18 Feb 2020 12:07:53 +0800 +Subject: sctp: move the format error check out of __sctp_sf_do_9_1_abort +Git-commit: 245709ec8be89af46ea7ef0444c9c80913999d99 +Patch-mainline: 5.6-rc3 +References: networking-stable-20_03_01 + +When T2 timer is to be stopped, the asoc should also be deleted, +otherwise, there will be no chance to call sctp_association_free +and the asoc could last in memory forever. + +However, in sctp_sf_shutdown_sent_abort(), after adding the cmd +SCTP_CMD_TIMER_STOP for T2 timer, it may return error due to the +format error from __sctp_sf_do_9_1_abort() and miss adding +SCTP_CMD_ASSOC_FAILED where the asoc will be deleted. + +This patch is to fix it by moving the format error check out of +__sctp_sf_do_9_1_abort(), and do it before adding the cmd +SCTP_CMD_TIMER_STOP for T2 timer. + +Thanks Hangbin for reporting this issue by the fuzz testing. + +v1->v2: + - improve the comment in the code as Marcelo's suggestion. + +Fixes: 96ca468b86b0 ("sctp: check invalid value of length parameter in error cause") +Reported-by: Hangbin Liu +Acked-by: Marcelo Ricardo Leitner +Signed-off-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Jiri Slaby +--- + net/sctp/sm_statefuns.c | 28 ++++++++++++++++++++-------- + 1 file changed, 20 insertions(+), 8 deletions(-) + +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -176,6 +176,16 @@ sctp_chunk_length_valid(struct sctp_chun + return true; + } + ++/* Check for format error in an ABORT chunk */ ++static inline bool sctp_err_chunk_valid(struct sctp_chunk *chunk) ++{ ++ sctp_errhdr_t *err; ++ ++ sctp_walk_errors(err, chunk->chunk_hdr); ++ ++ return (void *)err == (void *)chunk->chunk_end; ++} ++ + /********************************************************** + * These are the state functions for handling chunk events. + **********************************************************/ +@@ -2188,6 +2198,9 @@ sctp_disposition_t sctp_sf_shutdown_pend + sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) + return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); + ++ if (!sctp_err_chunk_valid(chunk)) ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); ++ + return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands); + } + +@@ -2230,6 +2243,9 @@ sctp_disposition_t sctp_sf_shutdown_sent + sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) + return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); + ++ if (!sctp_err_chunk_valid(chunk)) ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); ++ + /* Stop the T2-shutdown timer. */ + sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, + SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN)); +@@ -2495,6 +2511,9 @@ sctp_disposition_t sctp_sf_do_9_1_abort( + sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) + return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); + ++ if (!sctp_err_chunk_valid(chunk)) ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); ++ + return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands); + } + +@@ -2511,15 +2530,8 @@ static sctp_disposition_t __sctp_sf_do_9 + + /* See if we have an error cause code in the chunk. */ + len = ntohs(chunk->chunk_hdr->length); +- if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr)) { +- +- sctp_errhdr_t *err; +- sctp_walk_errors(err, chunk->chunk_hdr); +- if ((void *)err != (void *)chunk->chunk_end) +- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); +- ++ if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr)) + error = ((sctp_errhdr_t *)chunk->skb->data)->cause; +- } + + sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET)); + /* ASSOC_FAILED will DELETE_TCB. */ diff --git a/patches.suse/x86-xen-fix-booting-32-bit-pv-guest.patch b/patches.suse/x86-xen-fix-booting-32-bit-pv-guest.patch new file mode 100644 index 0000000..fc6c1c9 --- /dev/null +++ b/patches.suse/x86-xen-fix-booting-32-bit-pv-guest.patch @@ -0,0 +1,35 @@ +From: Juergen Gross +Date: Thu, 9 Apr 2020 09:00:01 +0200 +Subject: x86/xen: fix booting 32-bit pv guest +Git-commit: d6f34f4c6b4a962eb7a86c923fea206f866a40be +Patch-mainline: v5.7-rc1 +References: bsc#1071995 + +Commit 2f62f36e62daec ("x86/xen: Make the boot CPU idle task reliable") +introduced a regression for booting 32 bit Xen PV guests: the address +of the initial stack needs to be a virtual one. + +Fixes: 2f62f36e62daec ("x86/xen: Make the boot CPU idle task reliable") +Signed-off-by: Juergen Gross +Reviewed-by: Boris Ostrovsky +Link: https://lore.kernel.org/r/20200409070001.16675-1-jgross@suse.com +Signed-off-by: Juergen Gross +Acked-by: Miroslav Benes +--- + arch/x86/xen/xen-head.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S +index 7d1c4fcbe8f7..1ba601df3a37 100644 +--- a/arch/x86/xen/xen-head.S ++++ b/arch/x86/xen/xen-head.S +@@ -38,7 +38,7 @@ SYM_CODE_START(startup_xen) + #ifdef CONFIG_X86_64 + mov initial_stack(%rip), %rsp + #else +- mov pa(initial_stack), %esp ++ mov initial_stack, %esp + #endif + + #ifdef CONFIG_X86_64 + diff --git a/patches.suse/x86-xen-make-the-boot-cpu-idle-task-reliable.patch b/patches.suse/x86-xen-make-the-boot-cpu-idle-task-reliable.patch new file mode 100644 index 0000000..cd9a635 --- /dev/null +++ b/patches.suse/x86-xen-make-the-boot-cpu-idle-task-reliable.patch @@ -0,0 +1,50 @@ +From: Miroslav Benes +Date: Thu, 26 Mar 2020 10:26:02 +0100 +Subject: x86/xen: Make the boot CPU idle task reliable +Git-commit: 2f62f36e62daec43aa7b9633ef7f18e042a80bed +Patch-mainline: v5.7-rc1 +References: bsc#1071995 + +The unwinder reports the boot CPU idle task's stack on XEN PV as +unreliable, which affects at least live patching. There are two reasons +for this. First, the task does not follow the x86 convention that its +stack starts at the offset right below saved pt_regs. It allows the +unwinder to easily detect the end of the stack and verify it. Second, +startup_xen() function does not store the return address before jumping +to xen_start_kernel() which confuses the unwinder. + +Amend both issues by moving the starting point of initial stack in +startup_xen() and storing the return address before the jump, which is +exactly what call instruction does. + +Signed-off-by: Miroslav Benes +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +--- + arch/x86/xen/xen-head.S | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/arch/x86/xen/xen-head.S ++++ b/arch/x86/xen/xen-head.S +@@ -34,7 +34,11 @@ ENTRY(startup_xen) + rep __ASM_SIZE(stos) + + mov %_ASM_SI, xen_start_info +- mov $init_thread_union+THREAD_SIZE, %_ASM_SP ++#ifdef CONFIG_X86_64 ++ mov initial_stack(%rip), %rsp ++#else ++ mov pa(initial_stack), %esp ++#endif + + #ifdef CONFIG_X86_64 + /* Set up %gs. +@@ -50,7 +54,7 @@ ENTRY(startup_xen) + wrmsr + #endif + +- jmp xen_start_kernel ++ call xen_start_kernel + END(startup_xen) + __FINIT + #endif diff --git a/patches.suse/x86-xen-make-the-secondary-cpu-idle-tasks-reliable.patch b/patches.suse/x86-xen-make-the-secondary-cpu-idle-tasks-reliable.patch new file mode 100644 index 0000000..68448e8 --- /dev/null +++ b/patches.suse/x86-xen-make-the-secondary-cpu-idle-tasks-reliable.patch @@ -0,0 +1,66 @@ +From: Miroslav Benes +Date: Thu, 26 Mar 2020 10:26:03 +0100 +Subject: x86/xen: Make the secondary CPU idle tasks reliable +Git-commit: c3881eb58d56116c79ac4ee4f40fd15ead124c4b +Patch-mainline: v5.7-rc1 +References: bsc#1071995 + +The unwinder reports the secondary CPU idle tasks' stack on XEN PV as +unreliable, which affects at least live patching. +cpu_initialize_context() sets up the context of the CPU through +VCPUOP_initialise hypercall. After it is woken up, the idle task starts +in cpu_bringup_and_idle() function and its stack starts at the offset +right below pt_regs. The unwinder correctly detects the end of stack +there but it is confused by NULL return address in the last frame. + +Introduce a wrapper in assembly, which just calls +cpu_bringup_and_idle(). The return address is thus pushed on the stack +and the wrapper contains the annotation hint for the unwinder regarding +the stack state. + +Signed-off-by: Miroslav Benes +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +--- + arch/x86/xen/smp_pv.c | 3 ++- + arch/x86/xen/xen-head.S | 10 ++++++++++ + 2 files changed, 12 insertions(+), 1 deletion(-) + +--- a/arch/x86/xen/smp_pv.c ++++ b/arch/x86/xen/smp_pv.c +@@ -51,6 +51,7 @@ static DEFINE_PER_CPU(struct xen_common_ + static DEFINE_PER_CPU(struct xen_common_irq, xen_pmu_irq) = { .irq = -1 }; + + static irqreturn_t xen_irq_work_interrupt(int irq, void *dev_id); ++void asm_cpu_bringup_and_idle(void); + + static void cpu_bringup(void) + { +@@ -305,7 +306,7 @@ cpu_initialize_context(unsigned int cpu, + * pointing just below where pt_regs would be if it were a normal + * kernel entry. + */ +- ctxt->user_regs.eip = (unsigned long)cpu_bringup_and_idle; ++ ctxt->user_regs.eip = (unsigned long)asm_cpu_bringup_and_idle; + ctxt->flags = VGCF_IN_KERNEL; + ctxt->user_regs.eflags = 0x1000; /* IOPL_RING1 */ + ctxt->user_regs.ds = __USER_DS; +--- a/arch/x86/xen/xen-head.S ++++ b/arch/x86/xen/xen-head.S +@@ -57,6 +57,16 @@ ENTRY(startup_xen) + call xen_start_kernel + END(startup_xen) + __FINIT ++ ++#ifdef CONFIG_XEN_PV_SMP ++.pushsection .text ++ENTRY(asm_cpu_bringup_and_idle) ++ UNWIND_HINT_EMPTY ++ ++ call cpu_bringup_and_idle ++END(asm_cpu_bringup_and_idle) ++.popsection ++#endif + #endif + + .pushsection .text diff --git a/series.conf b/series.conf index 0ef7de1..677d025 100644 --- a/series.conf +++ b/series.conf @@ -52322,6 +52322,9 @@ patches.suse/net-qlogic-Fix-error-paths-in-ql_alloc_large_buffers.patch patches.suse/net-nfc-nci-fix-a-possible-sleep-in-atomic-context-b.patch patches.suse/net-sysctl-Fix-compiler-warning-when-only-cBPF-is-pr.patch + patches.suse/s390-qeth-handle-error-due-to-unsupported-transport-mode + patches.suse/s390-qeth-fix-promiscuous-mode-after-reset + patches.suse/s390-qeth-don-t-return-enotsupp-to-userspace patches.suse/net-hisilicon-Fix-a-BUG-trigered-by-wrong-bytes_comp.patch patches.suse/qede-Disable-hardware-gro-when-xdp-prog-is-installed.patch patches.suse/mod_devicetable-fix-PHY-module-format.patch @@ -52336,6 +52339,8 @@ patches.suse/cifs-Adjust-indentation-in-smb2_open_file.patch patches.suse/cifs-Optimize-readdir-on-reparse-points.patch patches.suse/udp-fix-integer-overflow-while-computing-available-s.patch + patches.suse/s390-qeth-fix-qdio-teardown-after-early-init-error + patches.suse/s390-qeth-lock-the-card-while-changing-its-hsuid patches.suse/net-mlxfw-Fix-out-of-memory-error-in-mfa2-flash-burn.patch patches.suse/pstore-ram-Write-new-dumps-to-start-of-recycled-zone.patch patches.suse/0001-drm-sun4i-hdmi-Remove-duplicate-cleanup-calls.patch @@ -52851,6 +52856,7 @@ patches.suse/perf-x86-intel-fix-inaccurate-period-in-context-switch-for-auto-reload patches.suse/hwmon-pmbus-ltc2978-Fix-PMBus-polling-of-MFR_COMMON-.patch patches.suse/s390-uv-fix-handling-of-length-extensions + patches.suse/s390-time-fix-clk-type-in-get_tod_clock patches.suse/RDMA-hfi1-Fix-memory-leak-in-_dev_comp_vect_mappings.patch patches.suse/IB-hfi1-Close-window-for-pq-and-request-coliding.patch patches.suse/Input-synaptics-switch-T470s-to-RMI4-by-default.patch @@ -52880,9 +52886,18 @@ patches.suse/ALSA-hda-Use-scnprintf-for-printing-texts-for-sysfs-.patch patches.suse/ASoC-sun8i-codec-Fix-setting-DAI-data-format.patch patches.suse/iommu-vt-d-fix-compile-warning-from-intel-svm-h + patches.suse/ipv6-Fix-route-replacement-with-dev-only-route.patch + patches.suse/ipv6-Fix-nlmsg_flags-when-splitting-a-multipath-rout.patch + patches.suse/net-fib_rules-Correctly-set-table-field-when-table-n.patch + patches.suse/net-phy-restore-mdio-regs-in-the-iproc-mdio-driver.patch patches.suse/NFC-pn544-Fix-a-typo-in-a-debug-message.patch patches.suse/net-sched-correct-flower-port-blocking.patch + patches.suse/sctp-move-the-format-error-check-out-of-__sctp_sf_do.patch + patches.suse/qede-Fix-race-between-rdma-destroy-workqueue-and-lin.patch + patches.suse/nfc-pn544-Fix-occasional-HW-initialization-failure.patch patches.suse/bpf-offload-Replace-bitwise-AND-by-logical-AND-in-bp.patch + patches.suse/s390-qeth-don-t-warn-for-napi-with-0-budget + patches.suse/s390-qeth-fix-off-by-one-in-rx-copybreak-check patches.suse/bnxt_en-Improve-device-shutdown-method.patch patches.suse/bnxt_en-Issue-PCIe-FLR-in-kdump-kernel-to-cleanup-pe.patch patches.suse/drm-nouveau-kms-gv100-re-set-lut-after-clearing-for-modesets @@ -52997,6 +53012,8 @@ patches.suse/batman-adv-Don-t-schedule-OGM-for-disabled-interface.patch patches.suse/cgroup-memcg-net-do-not-associate-sock-with-unrelated-cgroup.patch patches.suse/ibmvnic-Do-not-process-device-remove-during-device-r.patch + patches.suse/s390-qeth-handle-error-when-backing-rx-buffer + patches.suse/s390-qeth-cancel-rx-reclaim-work-earlier patches.suse/mac80211-Do-not-send-mesh-HWMP-PREQ-if-HWMP-is-disab.patch patches.suse/drm-i915-gvt-fix-unnecessary-schedule-timer-when-no-vgpu-exits patches.suse/iommu-vt-d-fix-a-bug-in-intel_iommu_iova_to_phys-for-huge-page @@ -53084,8 +53101,10 @@ patches.suse/Bluetooth-RFCOMM-fix-ODEBUG-bug-in-rfcomm_dev_ioctl.patch patches.suse/mwifiex-set-needed_headroom-not-hard_header_len.patch patches.suse/ath9k-Handle-txpower-changes-even-when-TPC-is-disabl.patch + patches.suse/s390-qeth-support-net-namespaces-for-l3-devices patches.suse/Crypto-chelsio-Fixes-a-hang-issue-during-driver-regi.patch patches.suse/Crypto-chelsio-Fixes-a-deadlock-between-rtnl_lock-an.patch + patches.suse/net-dsa-bcm_sf2-Fix-overflow-checks.patch patches.suse/crypto-tcrypt-fix-printed-skcipher-a-sync-mode.patch patches.suse/crypto-arm64-sha-ce-implement-export-import.patch patches.suse/crypto-mxs-dcp-fix-scatterlist-linearization-for-has.patch @@ -53097,6 +53116,7 @@ patches.suse/drm-sun4i-dsi-Use-NULL-to-signify-no-panel.patch patches.suse/drm-amd-display-Fix-wrongly-passed-static-prefix.patch patches.suse/drm-v3d-Replace-wait_for-macros-to-remove-use-of-msl.patch + patches.suse/s390-gmap-return-proper-error-code-on-ksm-unsharing patches.suse/ALSA-hda-ca0132-Add-Recon3Di-quirk-to-handle-integra.patch patches.suse/ALSA-hda-realtek-Enable-mute-LED-on-an-HP-system.patch patches.suse/ALSA-hda-realtek-a-fake-key-event-is-triggered-by-ru.patch @@ -53201,10 +53221,15 @@ patches.suse/scsi-ibmvfc-Avoid-loss-of-all-paths-during-SVC-node-.patch patches.suse/ibmvfc-Fix-NULL-return-compiler-warning.patch patches.suse/scsi-core-avoid-repetitive-logging-of-device-offline.patch + patches.suse/scsi-zfcp-fix-missing-erp_lock-in-port-recovery-trigger-for-point-to-point + patches.suse/x86-xen-make-the-boot-cpu-idle-task-reliable.patch + patches.suse/x86-xen-make-the-secondary-cpu-idle-tasks-reliable.patch patches.suse/PCI-ASPM-Clear-the-correct-bits-when-enabling-L1-sub.patch patches.suse/pci-pciehp-fix-msi-interrupt-race patches.suse/PCI-endpoint-Fix-clearing-start-entry-in-configfs.patch patches.suse/misc-pci_endpoint_test-Fix-to-support-10-pci-endpoin.patch + patches.suse/s390-cpuinfo-fix-wrong-output-when-cpu0-is-offline + patches.suse/s390-diag-fix-display-of-diagnose-call-statistics patches.suse/ftrace-kprobe-show-the-maxactive-number-on-kprobe_events.patch patches.suse/ext4-Avoid-ENOSPC-when-avoiding-to-reuse-recently-de.patch patches.suse/ext4-fix-incorrect-inodes-per-group-in-error-message.patch @@ -53226,7 +53251,11 @@ patches.suse/mfd-dln2-Fix-sanity-checking-for-endpoints.patch patches.suse/thermal-devfreq_cooling-inline-all-stubs-for-CONFIG_.patch patches.suse/drm-vc4-fix-hdmi-mode-validation.patch + patches.suse/kvm-s390-vsie-fix-region-1-asce-sanity-shadow-address-checks + patches.suse/kvm-s390-vsie-fix-possible-race-when-shadowing-region-3-tables patches.suse/iommu-amd-fix-the-configuration-of-gcr3-table-root-pointer + patches.suse/s390-cio-avoid-duplicated-add-uevents + patches.suse/s390-cio-generate-delayed-uevent-for-vfio-ccw-subchannels patches.suse/ALSA-pcm-oss-Fix-regression-by-buffer-overflow-fix.patch patches.suse/ALSA-hda-Fix-potential-access-overflow-in-beep-helpe.patch patches.suse/ALSA-ice1724-Fix-invalid-access-for-enumerated-ctl-i.patch @@ -53238,6 +53267,7 @@ patches.suse/pwm-renesas-tpu-Fix-late-Runtime-PM-enablement.patch patches.suse/pwm-pca9685-Fix-PWM-GPIO-inter-operation.patch patches.suse/0001-xen-blkfront-fix-memory-allocation-flags-in-blkfront.patch + patches.suse/x86-xen-fix-booting-32-bit-pv-guest.patch patches.suse/cifs-ignore-cached-share-root-handle-closing-errors.patch # davem/net