--- /dev/null
+From c41910f257a22dc406c60d8826b4a3b5398003a3 Mon Sep 17 00:00:00 2001
+From: David Heidelberg <david@ixit.cz>
+Date: Sat, 30 Oct 2021 12:04:12 +0200
+Subject: arm64: dts: qcom: msm8996: drop not documented adreno properties
+
+From: David Heidelberg <david@ixit.cz>
+
+commit c41910f257a22dc406c60d8826b4a3b5398003a3 upstream.
+
+These properties aren't documented nor implemented in the driver.
+Drop them.
+
+Fixes warnings as:
+$ make dtbs_check DT_SCHEMA_FILES=Documentation/devicetree/bindings/display/msm/gpu.yaml
+...
+arch/arm64/boot/dts/qcom/msm8996-mtp.dt.yaml: gpu@b00000: 'qcom,gpu-quirk-fault-detect-mask', 'qcom,gpu-quirk-two-pass-use-wfi' do not match any of the regexes: 'pinctrl-[0-9]+'
+ From schema: Documentation/devicetree/bindings/display/msm/gpu.yaml
+...
+
+Fixes: 69cc3114ab0f ("arm64: dts: Add Adreno GPU definitions")
+Signed-off-by: David Heidelberg <david@ixit.cz>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20211030100413.28370-1-david@ixit.cz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -645,9 +645,6 @@
+ nvmem-cells = <&gpu_speed_bin>;
+ nvmem-cell-names = "speed_bin";
+
+- qcom,gpu-quirk-two-pass-use-wfi;
+- qcom,gpu-quirk-fault-detect-mask;
+-
+ operating-points-v2 = <&gpu_opp_table>;
+
+ gpu_opp_table: opp-table {
--- /dev/null
+From 9deb48b53e7f4056c2eaa2dc2ee3338df619e4f6 Mon Sep 17 00:00:00 2001
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+Date: Thu, 13 Jan 2022 22:46:07 +0300
+Subject: bcmgenet: add WOL IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+commit 9deb48b53e7f4056c2eaa2dc2ee3338df619e4f6 upstream.
+
+The driver neglects to check the result of platform_get_irq_optional()'s
+call and blithely passes the negative error codes to devm_request_irq()
+(which takes *unsigned* IRQ #), causing it to fail with -EINVAL.
+Stop calling devm_request_irq() with the invalid IRQ #s.
+
+Fixes: 8562056f267d ("net: bcmgenet: request Wake-on-LAN interrupt")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -3962,10 +3962,12 @@ static int bcmgenet_probe(struct platfor
+
+ /* Request the WOL interrupt and advertise suspend if available */
+ priv->wol_irq_disabled = true;
+- err = devm_request_irq(&pdev->dev, priv->wol_irq, bcmgenet_wol_isr, 0,
+- dev->name, priv);
+- if (!err)
+- device_set_wakeup_capable(&pdev->dev, 1);
++ if (priv->wol_irq > 0) {
++ err = devm_request_irq(&pdev->dev, priv->wol_irq,
++ bcmgenet_wol_isr, 0, dev->name, priv);
++ if (!err)
++ device_set_wakeup_capable(&pdev->dev, 1);
++ }
+
+ /* Set the needed headroom to account for any possible
+ * features enabling/disabling at runtime
--- /dev/null
+From e9538f8270db24d272659e15841854c7ea11119e Mon Sep 17 00:00:00 2001
+From: Leon Romanovsky <leonro@nvidia.com>
+Date: Sun, 28 Nov 2021 14:14:46 +0200
+Subject: devlink: Remove misleading internal_flags from health reporter dump
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+commit e9538f8270db24d272659e15841854c7ea11119e upstream.
+
+DEVLINK_CMD_HEALTH_REPORTER_DUMP_GET command doesn't have .doit callback
+and has no use in internal_flags at all. Remove this misleading assignment.
+
+Fixes: e44ef4e4516c ("devlink: Hang reporter's dump method on a dumpit cb")
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/devlink.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/net/core/devlink.c
++++ b/net/core/devlink.c
+@@ -7852,8 +7852,6 @@ static const struct genl_small_ops devli
+ GENL_DONT_VALIDATE_DUMP_STRICT,
+ .dumpit = devlink_nl_cmd_health_reporter_dump_get_dumpit,
+ .flags = GENL_ADMIN_PERM,
+- .internal_flags = DEVLINK_NL_FLAG_NEED_DEVLINK_OR_PORT |
+- DEVLINK_NL_FLAG_NO_LOCK,
+ },
+ {
+ .cmd = DEVLINK_CMD_HEALTH_REPORTER_DUMP_CLEAR,
--- /dev/null
+From bccfb96b59179d4f96cbbd1ddff8fac6d335eae4 Mon Sep 17 00:00:00 2001
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+Date: Wed, 15 Dec 2021 13:01:04 +0200
+Subject: dmaengine: at_xdmac: Don't start transactions at tx_submit level
+
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+
+commit bccfb96b59179d4f96cbbd1ddff8fac6d335eae4 upstream.
+
+tx_submit is supposed to push the current transaction descriptor to a
+pending queue, waiting for issue_pending() to be called. issue_pending()
+must start the transfer, not tx_submit(), thus remove
+at_xdmac_start_xfer() from at_xdmac_tx_submit(). Clients of at_xdmac that
+assume that tx_submit() starts the transfer must be updated and call
+dma_async_issue_pending() if they miss to call it (one example is
+atmel_serial).
+
+As the at_xdmac_start_xfer() is now called only from
+at_xdmac_advance_work() when !at_xdmac_chan_is_enabled(), the
+at_xdmac_chan_is_enabled() check is no longer needed in
+at_xdmac_start_xfer(), thus remove it.
+
+Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20211215110115.191749-2-tudor.ambarus@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/at_xdmac.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -338,9 +338,6 @@ static void at_xdmac_start_xfer(struct a
+
+ dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, first);
+
+- if (at_xdmac_chan_is_enabled(atchan))
+- return;
+-
+ /* Set transfer as active to not try to start it again. */
+ first->active_xfer = true;
+
+@@ -430,9 +427,6 @@ static dma_cookie_t at_xdmac_tx_submit(s
+ dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_list\n",
+ __func__, atchan, desc);
+ list_add_tail(&desc->xfer_node, &atchan->xfers_list);
+- if (list_is_singular(&atchan->xfers_list))
+- at_xdmac_start_xfer(atchan, desc);
+-
+ spin_unlock_irqrestore(&atchan->lock, irqflags);
+ return cookie;
+ }
--- /dev/null
+From 912f7c6f7fac273f40e621447cf17d14b50d6e5b Mon Sep 17 00:00:00 2001
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+Date: Wed, 15 Dec 2021 13:01:13 +0200
+Subject: dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
+
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+
+commit 912f7c6f7fac273f40e621447cf17d14b50d6e5b upstream.
+
+The hardware channel next descriptor view structure contains just
+fields of 32 bits, while dma_addr_t can be of type u64 or u32
+depending on CONFIG_ARCH_DMA_ADDR_T_64BIT. Force u32 to comply with
+what the hardware expects.
+
+Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20211215110115.191749-11-tudor.ambarus@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/at_xdmac.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -221,15 +221,15 @@ struct at_xdmac {
+
+ /* Linked List Descriptor */
+ struct at_xdmac_lld {
+- dma_addr_t mbr_nda; /* Next Descriptor Member */
+- u32 mbr_ubc; /* Microblock Control Member */
+- dma_addr_t mbr_sa; /* Source Address Member */
+- dma_addr_t mbr_da; /* Destination Address Member */
+- u32 mbr_cfg; /* Configuration Register */
+- u32 mbr_bc; /* Block Control Register */
+- u32 mbr_ds; /* Data Stride Register */
+- u32 mbr_sus; /* Source Microblock Stride Register */
+- u32 mbr_dus; /* Destination Microblock Stride Register */
++ u32 mbr_nda; /* Next Descriptor Member */
++ u32 mbr_ubc; /* Microblock Control Member */
++ u32 mbr_sa; /* Source Address Member */
++ u32 mbr_da; /* Destination Address Member */
++ u32 mbr_cfg; /* Configuration Register */
++ u32 mbr_bc; /* Block Control Register */
++ u32 mbr_ds; /* Data Stride Register */
++ u32 mbr_sus; /* Source Microblock Stride Register */
++ u32 mbr_dus; /* Destination Microblock Stride Register */
+ };
+
+ /* 64-bit alignment needed to update CNDA and CUBC registers in an atomic way. */
--- /dev/null
+From 18deddea9184b62941395889ff7659529c877326 Mon Sep 17 00:00:00 2001
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+Date: Wed, 15 Dec 2021 13:01:10 +0200
+Subject: dmaengine: at_xdmac: Fix concurrency over xfers_list
+
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+
+commit 18deddea9184b62941395889ff7659529c877326 upstream.
+
+Since tx_submit can be called from a hard IRQ, xfers_list must be
+protected with a lock to avoid concurency on the list's elements.
+Since at_xdmac_handle_cyclic() is called from a tasklet, spin_lock_irq
+is enough to protect from a hard IRQ.
+
+Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20211215110115.191749-8-tudor.ambarus@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/at_xdmac.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -1559,14 +1559,17 @@ static void at_xdmac_handle_cyclic(struc
+ struct at_xdmac_desc *desc;
+ struct dma_async_tx_descriptor *txd;
+
+- if (!list_empty(&atchan->xfers_list)) {
+- desc = list_first_entry(&atchan->xfers_list,
+- struct at_xdmac_desc, xfer_node);
+- txd = &desc->tx_dma_desc;
+-
+- if (txd->flags & DMA_PREP_INTERRUPT)
+- dmaengine_desc_get_callback_invoke(txd, NULL);
++ spin_lock_irq(&atchan->lock);
++ if (list_empty(&atchan->xfers_list)) {
++ spin_unlock_irq(&atchan->lock);
++ return;
+ }
++ desc = list_first_entry(&atchan->xfers_list, struct at_xdmac_desc,
++ xfer_node);
++ spin_unlock_irq(&atchan->lock);
++ txd = &desc->tx_dma_desc;
++ if (txd->flags & DMA_PREP_INTERRUPT)
++ dmaengine_desc_get_callback_invoke(txd, NULL);
+ }
+
+ static void at_xdmac_handle_error(struct at_xdmac_chan *atchan)
--- /dev/null
+From 1385eb4d14d447cc5d744bc2ac34f43be66c9963 Mon Sep 17 00:00:00 2001
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+Date: Wed, 15 Dec 2021 13:01:12 +0200
+Subject: dmaengine: at_xdmac: Fix lld view setting
+
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+
+commit 1385eb4d14d447cc5d744bc2ac34f43be66c9963 upstream.
+
+AT_XDMAC_CNDC_NDVIEW_NDV3 was set even for AT_XDMAC_MBR_UBC_NDV2,
+because of the wrong bit handling. Fix it.
+
+Fixes: ee0fe35c8dcd ("dmaengine: xdmac: Handle descriptor's view 3 registers")
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20211215110115.191749-10-tudor.ambarus@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/at_xdmac.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -89,6 +89,7 @@
+ #define AT_XDMAC_CNDC_NDE (0x1 << 0) /* Channel x Next Descriptor Enable */
+ #define AT_XDMAC_CNDC_NDSUP (0x1 << 1) /* Channel x Next Descriptor Source Update */
+ #define AT_XDMAC_CNDC_NDDUP (0x1 << 2) /* Channel x Next Descriptor Destination Update */
++#define AT_XDMAC_CNDC_NDVIEW_MASK GENMASK(28, 27)
+ #define AT_XDMAC_CNDC_NDVIEW_NDV0 (0x0 << 3) /* Channel x Next Descriptor View 0 */
+ #define AT_XDMAC_CNDC_NDVIEW_NDV1 (0x1 << 3) /* Channel x Next Descriptor View 1 */
+ #define AT_XDMAC_CNDC_NDVIEW_NDV2 (0x2 << 3) /* Channel x Next Descriptor View 2 */
+@@ -353,7 +354,8 @@ static void at_xdmac_start_xfer(struct a
+ */
+ if (at_xdmac_chan_is_cyclic(atchan))
+ reg = AT_XDMAC_CNDC_NDVIEW_NDV1;
+- else if (first->lld.mbr_ubc & AT_XDMAC_MBR_UBC_NDV3)
++ else if ((first->lld.mbr_ubc &
++ AT_XDMAC_CNDC_NDVIEW_MASK) == AT_XDMAC_MBR_UBC_NDV3)
+ reg = AT_XDMAC_CNDC_NDVIEW_NDV3;
+ else
+ reg = AT_XDMAC_CNDC_NDVIEW_NDV2;
--- /dev/null
+From 5edc24ac876a928f36f407a0fcdb33b94a3a210f Mon Sep 17 00:00:00 2001
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+Date: Wed, 15 Dec 2021 13:01:06 +0200
+Subject: dmaengine: at_xdmac: Print debug message after realeasing the lock
+
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+
+commit 5edc24ac876a928f36f407a0fcdb33b94a3a210f upstream.
+
+It is desirable to do the prints without the lock held if possible, so
+move the print after the lock is released.
+
+Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20211215110115.191749-4-tudor.ambarus@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/at_xdmac.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -424,10 +424,12 @@ static dma_cookie_t at_xdmac_tx_submit(s
+ spin_lock_irqsave(&atchan->lock, irqflags);
+ cookie = dma_cookie_assign(tx);
+
+- dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_list\n",
+- __func__, atchan, desc);
+ list_add_tail(&desc->xfer_node, &atchan->xfers_list);
+ spin_unlock_irqrestore(&atchan->lock, irqflags);
++
++ dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_list\n",
++ __func__, atchan, desc);
++
+ return cookie;
+ }
+
--- /dev/null
+From e6af9b05bec63cd4d1de2a33968cd0be2a91282a Mon Sep 17 00:00:00 2001
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+Date: Wed, 15 Dec 2021 13:01:05 +0200
+Subject: dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending
+
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+
+commit e6af9b05bec63cd4d1de2a33968cd0be2a91282a upstream.
+
+Cyclic channels must too call issue_pending in order to start a transfer.
+Start the transfer in issue_pending regardless of the type of channel.
+This wrongly worked before, because in the past the transfer was started
+at tx_submit level when only a desc in the transfer list.
+
+Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20211215110115.191749-3-tudor.ambarus@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/at_xdmac.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -1718,11 +1718,9 @@ static void at_xdmac_issue_pending(struc
+
+ dev_dbg(chan2dev(&atchan->chan), "%s\n", __func__);
+
+- if (!at_xdmac_chan_is_cyclic(atchan)) {
+- spin_lock_irqsave(&atchan->lock, flags);
+- at_xdmac_advance_work(atchan);
+- spin_unlock_irqrestore(&atchan->lock, flags);
+- }
++ spin_lock_irqsave(&atchan->lock, flags);
++ at_xdmac_advance_work(atchan);
++ spin_unlock_irqrestore(&atchan->lock, flags);
+
+ return;
+ }
--- /dev/null
+From f7716b318568b22fbf0e3be99279a979e217cf71 Mon Sep 17 00:00:00 2001
+From: Guillaume Nault <gnault@redhat.com>
+Date: Mon, 10 Jan 2022 14:43:09 +0100
+Subject: gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst()
+
+From: Guillaume Nault <gnault@redhat.com>
+
+commit f7716b318568b22fbf0e3be99279a979e217cf71 upstream.
+
+Mask the ECN bits before initialising ->flowi4_tos. The tunnel key may
+have the last ECN bit set, which will interfere with the route lookup
+process as ip_route_output_key_hash() interpretes this bit specially
+(to restrict the route scope).
+
+Found by code inspection, compile tested only.
+
+Fixes: 962924fa2b7a ("ip_gre: Refactor collect metatdata mode tunnel xmit to ip_md_tunnel_xmit")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ip_gre.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -599,8 +599,9 @@ static int gre_fill_metadata_dst(struct
+
+ key = &info->key;
+ ip_tunnel_init_flow(&fl4, IPPROTO_GRE, key->u.ipv4.dst, key->u.ipv4.src,
+- tunnel_id_to_key32(key->tun_id), key->tos, 0,
+- skb->mark, skb_get_hash(skb));
++ tunnel_id_to_key32(key->tun_id),
++ key->tos & ~INET_ECN_MASK, 0, skb->mark,
++ skb_get_hash(skb));
+ rt = ip_route_output_key(dev_net(dev), &fl4);
+ if (IS_ERR(rt))
+ return PTR_ERR(rt);
--- /dev/null
+From 3fe6acd4dc922237b30e55473c9349c6ce0690f3 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Fri, 7 Jan 2022 12:09:36 -0800
+Subject: HID: vivaldi: fix handling devices not using numbered reports
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 3fe6acd4dc922237b30e55473c9349c6ce0690f3 upstream.
+
+Unfortunately details of USB HID transport bled into HID core and
+handling of numbered/unnumbered reports is quite a mess, with
+hid_report_len() calculating the length according to USB rules,
+and hid_hw_raw_request() adding report ID to the buffer for both
+numbered and unnumbered reports.
+
+Untangling it all requres a lot of changes in HID, so for now let's
+handle this in the driver.
+
+[jkosina@suse.cz: microoptimize field->report->id to report->id]
+Fixes: 14c9c014babe ("HID: add vivaldi HID driver")
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Tested-by: Stephen Boyd <swboyd@chromium.org> # CoachZ
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-vivaldi.c | 34 ++++++++++++++++++++++++++++------
+ 1 file changed, 28 insertions(+), 6 deletions(-)
+
+--- a/drivers/hid/hid-vivaldi.c
++++ b/drivers/hid/hid-vivaldi.c
+@@ -74,10 +74,11 @@ static void vivaldi_feature_mapping(stru
+ struct hid_usage *usage)
+ {
+ struct vivaldi_data *drvdata = hid_get_drvdata(hdev);
++ struct hid_report *report = field->report;
+ int fn_key;
+ int ret;
+ u32 report_len;
+- u8 *buf;
++ u8 *report_data, *buf;
+
+ if (field->logical != HID_USAGE_FN_ROW_PHYSMAP ||
+ (usage->hid & HID_USAGE_PAGE) != HID_UP_ORDINAL)
+@@ -89,12 +90,24 @@ static void vivaldi_feature_mapping(stru
+ if (fn_key > drvdata->max_function_row_key)
+ drvdata->max_function_row_key = fn_key;
+
+- buf = hid_alloc_report_buf(field->report, GFP_KERNEL);
+- if (!buf)
++ report_data = buf = hid_alloc_report_buf(report, GFP_KERNEL);
++ if (!report_data)
+ return;
+
+- report_len = hid_report_len(field->report);
+- ret = hid_hw_raw_request(hdev, field->report->id, buf,
++ report_len = hid_report_len(report);
++ if (!report->id) {
++ /*
++ * hid_hw_raw_request() will stuff report ID (which will be 0)
++ * into the first byte of the buffer even for unnumbered
++ * reports, so we need to account for this to avoid getting
++ * -EOVERFLOW in return.
++ * Note that hid_alloc_report_buf() adds 7 bytes to the size
++ * so we can safely say that we have space for an extra byte.
++ */
++ report_len++;
++ }
++
++ ret = hid_hw_raw_request(hdev, report->id, report_data,
+ report_len, HID_FEATURE_REPORT,
+ HID_REQ_GET_REPORT);
+ if (ret < 0) {
+@@ -103,7 +116,16 @@ static void vivaldi_feature_mapping(stru
+ goto out;
+ }
+
+- ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf,
++ if (!report->id) {
++ /*
++ * Undo the damage from hid_hw_raw_request() for unnumbered
++ * reports.
++ */
++ report_data++;
++ report_len--;
++ }
++
++ ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, report_data,
+ report_len, 0);
+ if (ret) {
+ dev_warn(&hdev->dev, "failed to report feature %d\n",
--- /dev/null
+From 91341fa0003befd097e190ec2a4bf63ad957c49a Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 13 Jan 2022 01:22:29 -0800
+Subject: inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 91341fa0003befd097e190ec2a4bf63ad957c49a upstream.
+
+Both fields can be read/written without synchronization,
+add proper accessors and documentation.
+
+Fixes: d5dd88794a13 ("inet: fix various use-after-free in defrags units")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/inet_frag.h | 11 +++++++++--
+ include/net/ipv6_frag.h | 3 ++-
+ net/ipv4/inet_fragment.c | 8 +++++---
+ net/ipv4/ip_fragment.c | 3 ++-
+ 4 files changed, 18 insertions(+), 7 deletions(-)
+
+--- a/include/net/inet_frag.h
++++ b/include/net/inet_frag.h
+@@ -116,8 +116,15 @@ int fqdir_init(struct fqdir **fqdirp, st
+
+ static inline void fqdir_pre_exit(struct fqdir *fqdir)
+ {
+- fqdir->high_thresh = 0; /* prevent creation of new frags */
+- fqdir->dead = true;
++ /* Prevent creation of new frags.
++ * Pairs with READ_ONCE() in inet_frag_find().
++ */
++ WRITE_ONCE(fqdir->high_thresh, 0);
++
++ /* Pairs with READ_ONCE() in inet_frag_kill(), ip_expire()
++ * and ip6frag_expire_frag_queue().
++ */
++ WRITE_ONCE(fqdir->dead, true);
+ }
+ void fqdir_exit(struct fqdir *fqdir);
+
+--- a/include/net/ipv6_frag.h
++++ b/include/net/ipv6_frag.h
+@@ -67,7 +67,8 @@ ip6frag_expire_frag_queue(struct net *ne
+ struct sk_buff *head;
+
+ rcu_read_lock();
+- if (fq->q.fqdir->dead)
++ /* Paired with the WRITE_ONCE() in fqdir_pre_exit(). */
++ if (READ_ONCE(fq->q.fqdir->dead))
+ goto out_rcu_unlock;
+ spin_lock(&fq->q.lock);
+
+--- a/net/ipv4/inet_fragment.c
++++ b/net/ipv4/inet_fragment.c
+@@ -204,9 +204,9 @@ void inet_frag_kill(struct inet_frag_que
+ /* The RCU read lock provides a memory barrier
+ * guaranteeing that if fqdir->dead is false then
+ * the hash table destruction will not start until
+- * after we unlock. Paired with inet_frags_exit_net().
++ * after we unlock. Paired with fqdir_pre_exit().
+ */
+- if (!fqdir->dead) {
++ if (!READ_ONCE(fqdir->dead)) {
+ rhashtable_remove_fast(&fqdir->rhashtable, &fq->node,
+ fqdir->f->rhash_params);
+ refcount_dec(&fq->refcnt);
+@@ -321,9 +321,11 @@ static struct inet_frag_queue *inet_frag
+ /* TODO : call from rcu_read_lock() and no longer use refcount_inc_not_zero() */
+ struct inet_frag_queue *inet_frag_find(struct fqdir *fqdir, void *key)
+ {
++ /* This pairs with WRITE_ONCE() in fqdir_pre_exit(). */
++ long high_thresh = READ_ONCE(fqdir->high_thresh);
+ struct inet_frag_queue *fq = NULL, *prev;
+
+- if (!fqdir->high_thresh || frag_mem_limit(fqdir) > fqdir->high_thresh)
++ if (!high_thresh || frag_mem_limit(fqdir) > high_thresh)
+ return NULL;
+
+ rcu_read_lock();
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -144,7 +144,8 @@ static void ip_expire(struct timer_list
+
+ rcu_read_lock();
+
+- if (qp->q.fqdir->dead)
++ /* Paired with WRITE_ONCE() in fqdir_pre_exit(). */
++ if (READ_ONCE(qp->q.fqdir->dead))
+ goto out_rcu_unlock;
+
+ spin_lock(&qp->q.lock);
--- /dev/null
+From a915deaa9abe4fb3a440312c954253a6a733608e Mon Sep 17 00:00:00 2001
+From: Guillaume Nault <gnault@redhat.com>
+Date: Mon, 10 Jan 2022 14:43:11 +0100
+Subject: libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()
+
+From: Guillaume Nault <gnault@redhat.com>
+
+commit a915deaa9abe4fb3a440312c954253a6a733608e upstream.
+
+Mask the ECN bits before calling ip_route_output_ports(). The tos
+variable might be passed directly from an IPv4 header, so it may have
+the last ECN bit set. This interferes with the route lookup process as
+ip_route_output_key_hash() interpretes this bit specially (to restrict
+the route scope).
+
+Found by code inspection, compile tested only.
+
+Fixes: 804c2f3e36ef ("libcxgb,iw_cxgb4,cxgbit: add cxgb_find_route()")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c
++++ b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c
+@@ -32,6 +32,7 @@
+
+ #include <linux/tcp.h>
+ #include <linux/ipv6.h>
++#include <net/inet_ecn.h>
+ #include <net/route.h>
+ #include <net/ip6_route.h>
+
+@@ -99,7 +100,7 @@ cxgb_find_route(struct cxgb4_lld_info *l
+
+ rt = ip_route_output_ports(&init_net, &fl4, NULL, peer_ip, local_ip,
+ peer_port, local_port, IPPROTO_TCP,
+- tos, 0);
++ tos & ~INET_ECN_MASK, 0);
+ if (IS_ERR(rt))
+ return NULL;
+ n = dst_neigh_lookup(&rt->dst, &peer_ip);
--- /dev/null
+From 95978df6fa328df619c15312e65ece469c2be2d2 Mon Sep 17 00:00:00 2001
+From: Robert Hancock <robert.hancock@calian.com>
+Date: Tue, 18 Jan 2022 15:41:27 -0600
+Subject: net: axienet: add missing memory barriers
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+commit 95978df6fa328df619c15312e65ece469c2be2d2 upstream.
+
+This driver was missing some required memory barriers:
+
+Use dma_rmb to ensure we see all updates to the descriptor after we see
+that an entry has been completed.
+
+Use wmb and rmb to avoid stale descriptor status between the TX path and
+TX complete IRQ path.
+
+Fixes: 8a3b7a252dca9 ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -632,6 +632,8 @@ static int axienet_free_tx_chain(struct
+ if (nr_bds == -1 && !(status & XAXIDMA_BD_STS_COMPLETE_MASK))
+ break;
+
++ /* Ensure we see complete descriptor update */
++ dma_rmb();
+ phys = desc_get_phys_addr(lp, cur_p);
+ dma_unmap_single(ndev->dev.parent, phys,
+ (cur_p->cntrl & XAXIDMA_BD_CTRL_LENGTH_MASK),
+@@ -645,8 +647,10 @@ static int axienet_free_tx_chain(struct
+ cur_p->app1 = 0;
+ cur_p->app2 = 0;
+ cur_p->app4 = 0;
+- cur_p->status = 0;
+ cur_p->skb = NULL;
++ /* ensure our transmit path and device don't prematurely see status cleared */
++ wmb();
++ cur_p->status = 0;
+
+ if (sizep)
+ *sizep += status & XAXIDMA_BD_STS_ACTUAL_LEN_MASK;
+@@ -704,6 +708,9 @@ static inline int axienet_check_tx_bd_sp
+ int num_frag)
+ {
+ struct axidma_bd *cur_p;
++
++ /* Ensure we see all descriptor updates from device or TX IRQ path */
++ rmb();
+ cur_p = &lp->tx_bd_v[(lp->tx_bd_tail + num_frag) % lp->tx_bd_num];
+ if (cur_p->status & XAXIDMA_BD_STS_ALL_MASK)
+ return NETDEV_TX_BUSY;
+@@ -843,6 +850,8 @@ static void axienet_recv(struct net_devi
+
+ tail_p = lp->rx_bd_p + sizeof(*lp->rx_bd_v) * lp->rx_bd_ci;
+
++ /* Ensure we see complete descriptor update */
++ dma_rmb();
+ phys = desc_get_phys_addr(lp, cur_p);
+ dma_unmap_single(ndev->dev.parent, phys, lp->max_frm_size,
+ DMA_FROM_DEVICE);
--- /dev/null
+From bb193e3db8b86a63f26889c99e14fd30c9ebd72a Mon Sep 17 00:00:00 2001
+From: Robert Hancock <robert.hancock@calian.com>
+Date: Tue, 18 Jan 2022 15:41:31 -0600
+Subject: net: axienet: fix for TX busy handling
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+commit bb193e3db8b86a63f26889c99e14fd30c9ebd72a upstream.
+
+Network driver documentation indicates we should be avoiding returning
+NETDEV_TX_BUSY from ndo_start_xmit in normal cases, since it requires
+the packets to be requeued. Instead the queue should be stopped after
+a packet is added to the TX ring when there may not be enough room for an
+additional one. Also, when TX ring entries are completed, we should only
+wake the queue if we know there is room for another full maximally
+fragmented packet.
+
+Print a warning if there is insufficient space at the start of start_xmit,
+since this should no longer happen.
+
+Combined with increasing the default TX ring size (in a subsequent
+patch), this appears to recover the TX performance lost by previous changes
+to actually manage the TX ring state properly.
+
+Fixes: 8a3b7a252dca9 ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 86 ++++++++++++----------
+ 1 file changed, 47 insertions(+), 39 deletions(-)
+
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -661,6 +661,32 @@ static int axienet_free_tx_chain(struct
+ }
+
+ /**
++ * axienet_check_tx_bd_space - Checks if a BD/group of BDs are currently busy
++ * @lp: Pointer to the axienet_local structure
++ * @num_frag: The number of BDs to check for
++ *
++ * Return: 0, on success
++ * NETDEV_TX_BUSY, if any of the descriptors are not free
++ *
++ * This function is invoked before BDs are allocated and transmission starts.
++ * This function returns 0 if a BD or group of BDs can be allocated for
++ * transmission. If the BD or any of the BDs are not free the function
++ * returns a busy status. This is invoked from axienet_start_xmit.
++ */
++static inline int axienet_check_tx_bd_space(struct axienet_local *lp,
++ int num_frag)
++{
++ struct axidma_bd *cur_p;
++
++ /* Ensure we see all descriptor updates from device or TX IRQ path */
++ rmb();
++ cur_p = &lp->tx_bd_v[(lp->tx_bd_tail + num_frag) % lp->tx_bd_num];
++ if (cur_p->cntrl)
++ return NETDEV_TX_BUSY;
++ return 0;
++}
++
++/**
+ * axienet_start_xmit_done - Invoked once a transmit is completed by the
+ * Axi DMA Tx channel.
+ * @ndev: Pointer to the net_device structure
+@@ -689,33 +715,8 @@ static void axienet_start_xmit_done(stru
+ /* Matches barrier in axienet_start_xmit */
+ smp_mb();
+
+- netif_wake_queue(ndev);
+-}
+-
+-/**
+- * axienet_check_tx_bd_space - Checks if a BD/group of BDs are currently busy
+- * @lp: Pointer to the axienet_local structure
+- * @num_frag: The number of BDs to check for
+- *
+- * Return: 0, on success
+- * NETDEV_TX_BUSY, if any of the descriptors are not free
+- *
+- * This function is invoked before BDs are allocated and transmission starts.
+- * This function returns 0 if a BD or group of BDs can be allocated for
+- * transmission. If the BD or any of the BDs are not free the function
+- * returns a busy status. This is invoked from axienet_start_xmit.
+- */
+-static inline int axienet_check_tx_bd_space(struct axienet_local *lp,
+- int num_frag)
+-{
+- struct axidma_bd *cur_p;
+-
+- /* Ensure we see all descriptor updates from device or TX IRQ path */
+- rmb();
+- cur_p = &lp->tx_bd_v[(lp->tx_bd_tail + num_frag) % lp->tx_bd_num];
+- if (cur_p->cntrl)
+- return NETDEV_TX_BUSY;
+- return 0;
++ if (!axienet_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1))
++ netif_wake_queue(ndev);
+ }
+
+ /**
+@@ -748,19 +749,14 @@ axienet_start_xmit(struct sk_buff *skb,
+ cur_p = &lp->tx_bd_v[lp->tx_bd_tail];
+
+ if (axienet_check_tx_bd_space(lp, num_frag + 1)) {
+- if (netif_queue_stopped(ndev))
+- return NETDEV_TX_BUSY;
+-
++ /* Should not happen as last start_xmit call should have
++ * checked for sufficient space and queue should only be
++ * woken when sufficient space is available.
++ */
+ netif_stop_queue(ndev);
+-
+- /* Matches barrier in axienet_start_xmit_done */
+- smp_mb();
+-
+- /* Space might have just been freed - check again */
+- if (axienet_check_tx_bd_space(lp, num_frag + 1))
+- return NETDEV_TX_BUSY;
+-
+- netif_wake_queue(ndev);
++ if (net_ratelimit())
++ netdev_warn(ndev, "TX ring unexpectedly full\n");
++ return NETDEV_TX_BUSY;
+ }
+
+ if (skb->ip_summed == CHECKSUM_PARTIAL) {
+@@ -821,6 +817,18 @@ axienet_start_xmit(struct sk_buff *skb,
+ if (++lp->tx_bd_tail >= lp->tx_bd_num)
+ lp->tx_bd_tail = 0;
+
++ /* Stop queue if next transmit may not have space */
++ if (axienet_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) {
++ netif_stop_queue(ndev);
++
++ /* Matches barrier in axienet_start_xmit_done */
++ smp_mb();
++
++ /* Space might have just been freed - check again */
++ if (!axienet_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1))
++ netif_wake_queue(ndev);
++ }
++
+ return NETDEV_TX_OK;
+ }
+
--- /dev/null
+From aba57a823d2985a2cc8c74a2535f3a88e68d9424 Mon Sep 17 00:00:00 2001
+From: Robert Hancock <robert.hancock@calian.com>
+Date: Tue, 18 Jan 2022 15:41:30 -0600
+Subject: net: axienet: fix number of TX ring slots for available check
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+commit aba57a823d2985a2cc8c74a2535f3a88e68d9424 upstream.
+
+The check for the number of available TX ring slots was off by 1 since a
+slot is required for the skb header as well as each fragment. This could
+result in overwriting a TX ring slot that was still in use.
+
+Fixes: 8a3b7a252dca9 ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -747,7 +747,7 @@ axienet_start_xmit(struct sk_buff *skb,
+ num_frag = skb_shinfo(skb)->nr_frags;
+ cur_p = &lp->tx_bd_v[lp->tx_bd_tail];
+
+- if (axienet_check_tx_bd_space(lp, num_frag)) {
++ if (axienet_check_tx_bd_space(lp, num_frag + 1)) {
+ if (netif_queue_stopped(ndev))
+ return NETDEV_TX_BUSY;
+
+@@ -757,7 +757,7 @@ axienet_start_xmit(struct sk_buff *skb,
+ smp_mb();
+
+ /* Space might have just been freed - check again */
+- if (axienet_check_tx_bd_space(lp, num_frag))
++ if (axienet_check_tx_bd_space(lp, num_frag + 1))
+ return NETDEV_TX_BUSY;
+
+ netif_wake_queue(ndev);
--- /dev/null
+From 996defd7f8b5dafc1d480b7585c7c62437f80c3c Mon Sep 17 00:00:00 2001
+From: Robert Hancock <robert.hancock@calian.com>
+Date: Tue, 18 Jan 2022 15:41:29 -0600
+Subject: net: axienet: Fix TX ring slot available check
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+commit 996defd7f8b5dafc1d480b7585c7c62437f80c3c upstream.
+
+The check for whether a TX ring slot was available was incorrect,
+since a slot which had been loaded with transmit data but the device had
+not started transmitting would be treated as available, potentially
+causing non-transmitted slots to be overwritten. The control field in
+the descriptor should be checked, rather than the status field (which may
+only be updated when the device completes the entry).
+
+Fixes: 8a3b7a252dca9 ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -643,7 +643,6 @@ static int axienet_free_tx_chain(struct
+ if (cur_p->skb && (status & XAXIDMA_BD_STS_COMPLETE_MASK))
+ dev_consume_skb_irq(cur_p->skb);
+
+- cur_p->cntrl = 0;
+ cur_p->app0 = 0;
+ cur_p->app1 = 0;
+ cur_p->app2 = 0;
+@@ -651,6 +650,7 @@ static int axienet_free_tx_chain(struct
+ cur_p->skb = NULL;
+ /* ensure our transmit path and device don't prematurely see status cleared */
+ wmb();
++ cur_p->cntrl = 0;
+ cur_p->status = 0;
+
+ if (sizep)
+@@ -713,7 +713,7 @@ static inline int axienet_check_tx_bd_sp
+ /* Ensure we see all descriptor updates from device or TX IRQ path */
+ rmb();
+ cur_p = &lp->tx_bd_v[(lp->tx_bd_tail + num_frag) % lp->tx_bd_num];
+- if (cur_p->status & XAXIDMA_BD_STS_ALL_MASK)
++ if (cur_p->cntrl)
+ return NETDEV_TX_BUSY;
+ return 0;
+ }
--- /dev/null
+From 2d19c3fd80178160dd505ccd7fed1643831227a5 Mon Sep 17 00:00:00 2001
+From: Robert Hancock <robert.hancock@calian.com>
+Date: Tue, 18 Jan 2022 15:41:32 -0600
+Subject: net: axienet: increase default TX ring size to 128
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+commit 2d19c3fd80178160dd505ccd7fed1643831227a5 upstream.
+
+With previous changes to make the driver handle the TX ring size more
+correctly, the default TX ring size of 64 appears to significantly
+bottleneck TX performance to around 600 Mbps on a 1 Gbps link on ZynqMP.
+Increasing this to 128 seems to bring performance up to near line rate and
+shouldn't cause excess bufferbloat (this driver doesn't yet support modern
+byte-based queue management).
+
+Fixes: 8a3b7a252dca9 ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -41,7 +41,7 @@
+ #include "xilinx_axienet.h"
+
+ /* Descriptors defines for Tx and Rx DMA */
+-#define TX_BD_NUM_DEFAULT 64
++#define TX_BD_NUM_DEFAULT 128
+ #define RX_BD_NUM_DEFAULT 1024
+ #define TX_BD_NUM_MIN (MAX_SKB_FRAGS + 1)
+ #define TX_BD_NUM_MAX 4096
--- /dev/null
+From 70f5817deddbc6ef3faa35841cab83c280cc653a Mon Sep 17 00:00:00 2001
+From: Robert Hancock <robert.hancock@calian.com>
+Date: Tue, 18 Jan 2022 15:41:28 -0600
+Subject: net: axienet: limit minimum TX ring size
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+commit 70f5817deddbc6ef3faa35841cab83c280cc653a upstream.
+
+The driver will not work properly if the TX ring size is set to below
+MAX_SKB_FRAGS + 1 since it needs to hold at least one full maximally
+fragmented packet in the TX ring. Limit setting the ring size to below
+this value.
+
+Fixes: 8b09ca823ffb4 ("net: axienet: Make RX/TX ring sizes configurable")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -43,6 +43,7 @@
+ /* Descriptors defines for Tx and Rx DMA */
+ #define TX_BD_NUM_DEFAULT 64
+ #define RX_BD_NUM_DEFAULT 1024
++#define TX_BD_NUM_MIN (MAX_SKB_FRAGS + 1)
+ #define TX_BD_NUM_MAX 4096
+ #define RX_BD_NUM_MAX 4096
+
+@@ -1373,7 +1374,8 @@ static int axienet_ethtools_set_ringpara
+ if (ering->rx_pending > RX_BD_NUM_MAX ||
+ ering->rx_mini_pending ||
+ ering->rx_jumbo_pending ||
+- ering->rx_pending > TX_BD_NUM_MAX)
++ ering->tx_pending < TX_BD_NUM_MIN ||
++ ering->tx_pending > TX_BD_NUM_MAX)
+ return -EINVAL;
+
+ if (netif_running(ndev))
--- /dev/null
+From 04cc2da39698efd7eb2e30c112538922d26f848e Mon Sep 17 00:00:00 2001
+From: Robert Hancock <robert.hancock@calian.com>
+Date: Tue, 18 Jan 2022 15:41:26 -0600
+Subject: net: axienet: reset core on initialization prior to MDIO access
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+commit 04cc2da39698efd7eb2e30c112538922d26f848e upstream.
+
+In some cases where the Xilinx Ethernet core was used in 1000Base-X or
+SGMII modes, which use the internal PCS/PMA PHY, and the MGT
+transceiver clock source for the PCS was not running at the time the
+FPGA logic was loaded, the core would come up in a state where the
+PCS could not be found on the MDIO bus. To fix this, the Ethernet core
+(including the PCS) should be reset after enabling the clocks, prior to
+attempting to access the PCS using of_mdio_find_device.
+
+Fixes: 1a02556086fc (net: axienet: Properly handle PCS/PMA PHY for 1000BaseX mode)
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -2024,6 +2024,11 @@ static int axienet_probe(struct platform
+ lp->coalesce_count_rx = XAXIDMA_DFT_RX_THRESHOLD;
+ lp->coalesce_count_tx = XAXIDMA_DFT_TX_THRESHOLD;
+
++ /* Reset core now that clocks are enabled, prior to accessing MDIO */
++ ret = __axienet_device_reset(lp);
++ if (ret)
++ goto cleanup_clk;
++
+ lp->phy_node = of_parse_phandle(pdev->dev.of_node, "phy-handle", 0);
+ if (lp->phy_node) {
+ ret = axienet_mdio_setup(lp);
--- /dev/null
+From 4e5bd03ae34652cd932ab4c91c71c511793df75c Mon Sep 17 00:00:00 2001
+From: Jie Wang <wangjie125@huawei.com>
+Date: Wed, 12 Jan 2022 20:54:18 +0800
+Subject: net: bonding: fix bond_xmit_broadcast return value error bug
+
+From: Jie Wang <wangjie125@huawei.com>
+
+commit 4e5bd03ae34652cd932ab4c91c71c511793df75c upstream.
+
+In Linux bonding scenario, one packet is copied to several copies and sent
+by all slave device of bond0 in mode 3(broadcast mode). The mode 3 xmit
+function bond_xmit_broadcast() only ueses the last slave device's tx result
+as the final result. In this case, if the last slave device is down, then
+it always return NET_XMIT_DROP, even though the other slave devices xmit
+success. It may cause the tx statistics error, and cause the application
+(e.g. scp) consider the network is unreachable.
+
+For example, use the following command to configure server A.
+
+echo 3 > /sys/class/net/bond0/bonding/mode
+ifconfig bond0 up
+ifenslave bond0 eth0 eth1
+ifconfig bond0 192.168.1.125
+ifconfig eth0 up
+ifconfig eth1 down
+The slave device eth0 and eth1 are connected to server B(192.168.1.107).
+Run the ping 192.168.1.107 -c 3 -i 0.2 command, the following information
+is displayed.
+
+PING 192.168.1.107 (192.168.1.107) 56(84) bytes of data.
+64 bytes from 192.168.1.107: icmp_seq=1 ttl=64 time=0.077 ms
+64 bytes from 192.168.1.107: icmp_seq=2 ttl=64 time=0.056 ms
+64 bytes from 192.168.1.107: icmp_seq=3 ttl=64 time=0.051 ms
+
+ 192.168.1.107 ping statistics
+0 packets transmitted, 3 received
+
+Actually, the slave device eth0 of the bond successfully sends three
+ICMP packets, but the result shows that 0 packets are transmitted.
+
+Also if we use scp command to get remote files, the command end with the
+following printings.
+
+ssh_exchange_identification: read: Connection timed out
+
+So this patch modifies the bond_xmit_broadcast to return NET_XMIT_SUCCESS
+if one slave device in the bond sends packets successfully. If all slave
+devices send packets fail, the discarded packets stats is increased. The
+skb is released when there is no slave device in the bond or the last slave
+device is down.
+
+Fixes: ae46f184bc1f ("bonding: propagate transmit status")
+Signed-off-by: Jie Wang <wangjie125@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_main.c | 30 ++++++++++++++++++++++--------
+ 1 file changed, 22 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4562,25 +4562,39 @@ static netdev_tx_t bond_xmit_broadcast(s
+ struct bonding *bond = netdev_priv(bond_dev);
+ struct slave *slave = NULL;
+ struct list_head *iter;
++ bool xmit_suc = false;
++ bool skb_used = false;
+
+ bond_for_each_slave_rcu(bond, slave, iter) {
+- if (bond_is_last_slave(bond, slave))
+- break;
+- if (bond_slave_is_up(slave) && slave->link == BOND_LINK_UP) {
+- struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
++ struct sk_buff *skb2;
+
++ if (!(bond_slave_is_up(slave) && slave->link == BOND_LINK_UP))
++ continue;
++
++ if (bond_is_last_slave(bond, slave)) {
++ skb2 = skb;
++ skb_used = true;
++ } else {
++ skb2 = skb_clone(skb, GFP_ATOMIC);
+ if (!skb2) {
+ net_err_ratelimited("%s: Error: %s: skb_clone() failed\n",
+ bond_dev->name, __func__);
+ continue;
+ }
+- bond_dev_queue_xmit(bond, skb2, slave->dev);
+ }
++
++ if (bond_dev_queue_xmit(bond, skb2, slave->dev) == NETDEV_TX_OK)
++ xmit_suc = true;
+ }
+- if (slave && bond_slave_is_up(slave) && slave->link == BOND_LINK_UP)
+- return bond_dev_queue_xmit(bond, skb, slave->dev);
+
+- return bond_tx_drop(bond_dev, skb);
++ if (!skb_used)
++ dev_kfree_skb_any(skb);
++
++ if (xmit_suc)
++ return NETDEV_TX_OK;
++
++ atomic_long_inc(&bond_dev->tx_dropped);
++ return NET_XMIT_DROP;
+ }
+
+ /*------------------------- Device initialization ---------------------------*/
--- /dev/null
+From 214b3369ab9b0a6f28d6c970220c209417edbc65 Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Sat, 15 Jan 2022 09:49:18 -0800
+Subject: net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config()
+
+From: Tom Rix <trix@redhat.com>
+
+commit 214b3369ab9b0a6f28d6c970220c209417edbc65 upstream.
+
+Clang static analysis reports this problem
+mtk_eth_soc.c:394:7: warning: Branch condition evaluates
+ to a garbage value
+ if (err)
+ ^~~
+
+err is not initialized and only conditionally set.
+So intitialize err.
+
+Fixes: 7e538372694b ("net: ethernet: mediatek: Re-add support SGMII")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -215,7 +215,7 @@ static void mtk_mac_config(struct phylin
+ phylink_config);
+ struct mtk_eth *eth = mac->hw;
+ u32 mcr_cur, mcr_new, sid, i;
+- int val, ge_mode, err;
++ int val, ge_mode, err = 0;
+
+ /* MT76x8 has no hardware settings between for the MAC */
+ if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628) &&
--- /dev/null
+From baa59504c1cd0cca7d41954a45ee0b3dc78e41a0 Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Tue, 18 Jan 2022 05:41:10 -0800
+Subject: net: mscc: ocelot: fix using match before it is set
+
+From: Tom Rix <trix@redhat.com>
+
+commit baa59504c1cd0cca7d41954a45ee0b3dc78e41a0 upstream.
+
+Clang static analysis reports this issue
+ocelot_flower.c:563:8: warning: 1st function call argument
+ is an uninitialized value
+ !is_zero_ether_addr(match.mask->dst)) {
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The variable match is used before it is set. So move the
+block.
+
+Fixes: 75944fda1dfe ("net: mscc: ocelot: offload ingress skbedit and vlan actions to VCAP IS1")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mscc/ocelot_flower.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mscc/ocelot_flower.c
++++ b/drivers/net/ethernet/mscc/ocelot_flower.c
+@@ -462,13 +462,6 @@ ocelot_flower_parse_key(struct ocelot *o
+ return -EOPNOTSUPP;
+ }
+
+- if (filter->block_id == VCAP_IS1 &&
+- !is_zero_ether_addr(match.mask->dst)) {
+- NL_SET_ERR_MSG_MOD(extack,
+- "Key type S1_NORMAL cannot match on destination MAC");
+- return -EOPNOTSUPP;
+- }
+-
+ /* The hw support mac matches only for MAC_ETYPE key,
+ * therefore if other matches(port, tcp flags, etc) are added
+ * then just bail out
+@@ -483,6 +476,14 @@ ocelot_flower_parse_key(struct ocelot *o
+ return -EOPNOTSUPP;
+
+ flow_rule_match_eth_addrs(rule, &match);
++
++ if (filter->block_id == VCAP_IS1 &&
++ !is_zero_ether_addr(match.mask->dst)) {
++ NL_SET_ERR_MSG_MOD(extack,
++ "Key type S1_NORMAL cannot match on destination MAC");
++ return -EOPNOTSUPP;
++ }
++
+ filter->key_type = OCELOT_VCAP_KEY_ETYPE;
+ ether_addr_copy(filter->key.etype.dmac.value,
+ match.key->dst);
--- /dev/null
+From 5765cee119bf5a36c94d20eceb37c445508934be Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Mon, 17 Jan 2022 14:52:33 +0000
+Subject: net: sfp: fix high power modules without diagnostic monitoring
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+
+commit 5765cee119bf5a36c94d20eceb37c445508934be upstream.
+
+Commit 7cfa9c92d0a3 ("net: sfp: avoid power switch on address-change
+modules") unintetionally changed the semantics for high power modules
+without the digital diagnostics monitoring. We repeatedly attempt to
+read the power status from the non-existing 0xa2 address in a futile
+hope this failure is temporary:
+
+[ 8.856051] sfp sfp-eth3: module NTT 0000000000000000 rev 0000 sn 0000000000000000 dc 160408
+[ 8.865843] mvpp2 f4000000.ethernet eth3: switched to inband/1000base-x link mode
+[ 8.873469] sfp sfp-eth3: Failed to read EEPROM: -5
+[ 8.983251] sfp sfp-eth3: Failed to read EEPROM: -5
+[ 9.103250] sfp sfp-eth3: Failed to read EEPROM: -5
+
+We previosuly assumed such modules were powered up in the correct mode,
+continuing without further configuration as long as the required power
+class was supported by the host.
+
+Restore this behaviour, while preserving the intent of subsequent
+patches to avoid the "Address Change Sequence not supported" warning
+if we are not going to be accessing the DDM address.
+
+Fixes: 7cfa9c92d0a3 ("net: sfp: avoid power switch on address-change modules")
+Reported-by: 照山周一郎 <teruyama@springboard-inc.jp>
+Tested-by: 照山周一郎 <teruyama@springboard-inc.jp>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/sfp.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -1589,17 +1589,20 @@ static int sfp_sm_probe_for_phy(struct s
+ static int sfp_module_parse_power(struct sfp *sfp)
+ {
+ u32 power_mW = 1000;
++ bool supports_a2;
+
+ if (sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_POWER_DECL))
+ power_mW = 1500;
+ if (sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_HIGH_POWER_LEVEL))
+ power_mW = 2000;
+
++ supports_a2 = sfp->id.ext.sff8472_compliance !=
++ SFP_SFF8472_COMPLIANCE_NONE ||
++ sfp->id.ext.diagmon & SFP_DIAGMON_DDM;
++
+ if (power_mW > sfp->max_power_mW) {
+ /* Module power specification exceeds the allowed maximum. */
+- if (sfp->id.ext.sff8472_compliance ==
+- SFP_SFF8472_COMPLIANCE_NONE &&
+- !(sfp->id.ext.diagmon & SFP_DIAGMON_DDM)) {
++ if (!supports_a2) {
+ /* The module appears not to implement bus address
+ * 0xa2, so assume that the module powers up in the
+ * indicated mode.
+@@ -1616,11 +1619,25 @@ static int sfp_module_parse_power(struct
+ }
+ }
+
++ if (power_mW <= 1000) {
++ /* Modules below 1W do not require a power change sequence */
++ sfp->module_power_mW = power_mW;
++ return 0;
++ }
++
++ if (!supports_a2) {
++ /* The module power level is below the host maximum and the
++ * module appears not to implement bus address 0xa2, so assume
++ * that the module powers up in the indicated mode.
++ */
++ return 0;
++ }
++
+ /* If the module requires a higher power mode, but also requires
+ * an address change sequence, warn the user that the module may
+ * not be functional.
+ */
+- if (sfp->id.ext.diagmon & SFP_DIAGMON_ADDRMODE && power_mW > 1000) {
++ if (sfp->id.ext.diagmon & SFP_DIAGMON_ADDRMODE) {
+ dev_warn(sfp->dev,
+ "Address Change Sequence not supported but module requires %u.%uW, module may not be functional\n",
+ power_mW / 1000, (power_mW / 100) % 10);
--- /dev/null
+From fb80445c438c78b40b547d12b8d56596ce4ccfeb Mon Sep 17 00:00:00 2001
+From: Kevin Bracey <kevin@bracey.fi>
+Date: Wed, 12 Jan 2022 19:02:10 +0200
+Subject: net_sched: restore "mpu xxx" handling
+
+From: Kevin Bracey <kevin@bracey.fi>
+
+commit fb80445c438c78b40b547d12b8d56596ce4ccfeb upstream.
+
+commit 56b765b79e9a ("htb: improved accuracy at high rates") broke
+"overhead X", "linklayer atm" and "mpu X" attributes.
+
+"overhead X" and "linklayer atm" have already been fixed. This restores
+the "mpu X" handling, as might be used by DOCSIS or Ethernet shaping:
+
+ tc class add ... htb rate X overhead 4 mpu 64
+
+The code being fixed is used by htb, tbf and act_police. Cake has its
+own mpu handling. qdisc_calculate_pkt_len still uses the size table
+containing values adjusted for mpu by user space.
+
+iproute2 tc has always passed mpu into the kernel via a tc_ratespec
+structure, but the kernel never directly acted on it, merely stored it
+so that it could be read back by `tc class show`.
+
+Rather, tc would generate length-to-time tables that included the mpu
+(and linklayer) in their construction, and the kernel used those tables.
+
+Since v3.7, the tables were no longer used. Along with "mpu", this also
+broke "overhead" and "linklayer" which were fixed in 01cb71d2d47b
+("net_sched: restore "overhead xxx" handling", v3.10) and 8a8e3d84b171
+("net_sched: restore "linklayer atm" handling", v3.11).
+
+"overhead" was fixed by simply restoring use of tc_ratespec::overhead -
+this had originally been used by the kernel but was initially omitted
+from the new non-table-based calculations.
+
+"linklayer" had been handled in the table like "mpu", but the mode was
+not originally passed in tc_ratespec. The new implementation was made to
+handle it by getting new versions of tc to pass the mode in an extended
+tc_ratespec, and for older versions of tc the table contents were analysed
+at load time to deduce linklayer.
+
+As "mpu" has always been given to the kernel in tc_ratespec,
+accompanying the mpu-based table, we can restore system functionality
+with no userspace change by making the kernel act on the tc_ratespec
+value.
+
+Fixes: 56b765b79e9a ("htb: improved accuracy at high rates")
+Signed-off-by: Kevin Bracey <kevin@bracey.fi>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jiri Pirko <jiri@resnulli.us>
+Cc: Vimalkumar <j.vimal@gmail.com>
+Link: https://lore.kernel.org/r/20220112170210.1014351-1-kevin@bracey.fi
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/sch_generic.h | 5 +++++
+ net/sched/sch_generic.c | 1 +
+ 2 files changed, 6 insertions(+)
+
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -1261,6 +1261,7 @@ struct psched_ratecfg {
+ u64 rate_bytes_ps; /* bytes per second */
+ u32 mult;
+ u16 overhead;
++ u16 mpu;
+ u8 linklayer;
+ u8 shift;
+ };
+@@ -1270,6 +1271,9 @@ static inline u64 psched_l2t_ns(const st
+ {
+ len += r->overhead;
+
++ if (len < r->mpu)
++ len = r->mpu;
++
+ if (unlikely(r->linklayer == TC_LINKLAYER_ATM))
+ return ((u64)(DIV_ROUND_UP(len,48)*53) * r->mult) >> r->shift;
+
+@@ -1292,6 +1296,7 @@ static inline void psched_ratecfg_getrat
+ res->rate = min_t(u64, r->rate_bytes_ps, ~0U);
+
+ res->overhead = r->overhead;
++ res->mpu = r->mpu;
+ res->linklayer = (r->linklayer & TC_LINKLAYER_MASK);
+ }
+
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -1386,6 +1386,7 @@ void psched_ratecfg_precompute(struct ps
+ {
+ memset(r, 0, sizeof(*r));
+ r->overhead = conf->overhead;
++ r->mpu = conf->mpu;
+ r->rate_bytes_ps = max_t(u64, conf->rate, rate64);
+ r->linklayer = (conf->linklayer & TC_LINKLAYER_MASK);
+ r->mult = 1;
--- /dev/null
+From 2836615aa22de55b8fca5e32fe1b27a67cda625e Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 18 Jan 2022 03:43:40 -0800
+Subject: netns: add schedule point in ops_exit_list()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 2836615aa22de55b8fca5e32fe1b27a67cda625e upstream.
+
+When under stress, cleanup_net() can have to dismantle
+netns in big numbers. ops_exit_list() currently calls
+many helpers [1] that have no schedule point, and we can
+end up with soft lockups, particularly on hosts
+with many cpus.
+
+Even for moderate amount of netns processed by cleanup_net()
+this patch avoids latency spikes.
+
+[1] Some of these helpers like fib_sync_up() and fib_sync_down_dev()
+are very slow because net/ipv4/fib_semantics.c uses host-wide hash tables,
+and ifindex is used as the only input of two hash functions.
+ ifindexes tend to be the same for all netns (lo.ifindex==1 per instance)
+ This will be fixed in a separate patch.
+
+Fixes: 72ad937abd0a ("net: Add support for batching network namespace cleanups")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net_namespace.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -183,8 +183,10 @@ static void ops_exit_list(const struct p
+ {
+ struct net *net;
+ if (ops->exit) {
+- list_for_each_entry(net, net_exit_list, exit_list)
++ list_for_each_entry(net, net_exit_list, exit_list) {
+ ops->exit(net);
++ cond_resched();
++ }
+ }
+ if (ops->exit_batch)
+ ops->exit_batch(net_exit_list);
--- /dev/null
+From 4624f199327a704dd1069aca1c3cadb8f2a28c6f Mon Sep 17 00:00:00 2001
+From: Zechuan Chen <chenzechuan1@huawei.com>
+Date: Tue, 28 Dec 2021 19:13:38 +0800
+Subject: perf probe: Fix ppc64 'perf probe add events failed' case
+
+From: Zechuan Chen <chenzechuan1@huawei.com>
+
+commit 4624f199327a704dd1069aca1c3cadb8f2a28c6f upstream.
+
+Because of commit bf794bf52a80c627 ("powerpc/kprobes: Fix kallsyms
+lookup across powerpc ABIv1 and ABIv2"), in ppc64 ABIv1, our perf
+command eliminates the need to use the prefix "." at the symbol name.
+
+But when the command "perf probe -a schedule" is executed on ppc64
+ABIv1, it obtains two symbol address information through /proc/kallsyms,
+for example:
+
+ cat /proc/kallsyms | grep -w schedule
+ c000000000657020 T .schedule
+ c000000000d4fdb8 D schedule
+
+The symbol "D schedule" is not a function symbol, and perf will print:
+"p:probe/schedule _text+13958584"Failed to write event: Invalid argument
+
+Therefore, when searching symbols from map and adding probe point for
+them, a symbol type check is added. If the type of symbol is not a
+function, skip it.
+
+Fixes: bf794bf52a80c627 ("powerpc/kprobes: Fix kallsyms lookup across powerpc ABIv1 and ABIv2")
+Signed-off-by: Zechuan Chen <chenzechuan1@huawei.com>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jianlin Lv <Jianlin.Lv@arm.com>
+Cc: Jin Yao <yao.jin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Cc: Yang Jihong <yangjihong1@huawei.com>
+Link: https://lore.kernel.org/r/20211228111338.218602-1-chenzechuan1@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/probe-event.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/tools/perf/util/probe-event.c
++++ b/tools/perf/util/probe-event.c
+@@ -3035,6 +3035,9 @@ static int find_probe_trace_events_from_
+ for (j = 0; j < num_matched_functions; j++) {
+ sym = syms[j];
+
++ if (sym->type != STT_FUNC)
++ continue;
++
+ /* There can be duplicated symbols in the map */
+ for (i = 0; i < j; i++)
+ if (sym->start == syms[i]->start) {
--- /dev/null
+From 62942e9fda9fd1def10ffcbd5e1c025b3c9eec17 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Wed, 12 Jan 2022 10:50:57 +0200
+Subject: perf script: Fix hex dump character output
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 62942e9fda9fd1def10ffcbd5e1c025b3c9eec17 upstream.
+
+Using grep -C with perf script -D can give erroneous results as grep loses
+lines due to non-printable characters, for example, below the 0020, 0060
+and 0070 lines are missing:
+
+ $ perf script -D | grep -C10 AUX | head
+ . 0010: 08 00 00 00 00 00 00 00 1f 00 00 00 00 00 00 00 ................
+ . 0030: 01 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 ................
+ . 0040: 00 08 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ................
+ . 0050: 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
+ . 0080: 02 00 00 00 00 00 00 00 1b 00 00 00 00 00 00 00 ................
+ . 0090: 00 00 00 00 00 00 00 00 ........
+
+ 0 0 0x450 [0x98]: PERF_RECORD_AUXTRACE_INFO type: 1
+ PMU Type 8
+ Time Shift 31
+
+perf's isprint() is a custom implementation from the kernel, but the
+kernel's _ctype appears to include characters from Latin-1 Supplement which
+is not compatible with, for example, UTF-8. Fix by checking also isascii().
+
+After:
+
+ $ tools/perf/perf script -D | grep -C10 AUX | head
+ . 0010: 08 00 00 00 00 00 00 00 1f 00 00 00 00 00 00 00 ................
+ . 0020: 03 84 32 2f 00 00 00 00 63 7c 4f d2 fa ff ff ff ..2/....c|O.....
+ . 0030: 01 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 ................
+ . 0040: 00 08 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ................
+ . 0050: 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
+ . 0060: 00 02 00 00 00 00 00 00 00 c0 03 00 00 00 00 00 ................
+ . 0070: e2 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ................
+ . 0080: 02 00 00 00 00 00 00 00 1b 00 00 00 00 00 00 00 ................
+ . 0090: 00 00 00 00 00 00 00 00 ........
+
+Fixes: 3052ba56bcb58904 ("tools perf: Move from sane_ctype.h obtained from git to the Linux's original")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Link: http://lore.kernel.org/lkml/20220112085057.277205-1-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/debug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/util/debug.c
++++ b/tools/perf/util/debug.c
+@@ -145,7 +145,7 @@ static int trace_event_printer(enum bina
+ break;
+ case BINARY_PRINT_CHAR_DATA:
+ printed += color_fprintf(fp, color, "%c",
+- isprint(ch) ? ch : '.');
++ isprint(ch) && isascii(ch) ? ch : '.');
+ break;
+ case BINARY_PRINT_CHAR_PAD:
+ printed += color_fprintf(fp, color, " ");
--- /dev/null
+From 34127b3632b21e5c391756e724b1198eb9917981 Mon Sep 17 00:00:00 2001
+From: Laurence de Bruxelles <lfdebrux@gmail.com>
+Date: Sat, 1 Jan 2022 15:41:49 +0000
+Subject: rtc: pxa: fix null pointer dereference
+
+From: Laurence de Bruxelles <lfdebrux@gmail.com>
+
+commit 34127b3632b21e5c391756e724b1198eb9917981 upstream.
+
+With the latest stable kernel versions the rtc on the PXA based
+Zaurus does not work, when booting I see the following kernel messages:
+
+pxa-rtc pxa-rtc: failed to find rtc clock source
+pxa-rtc pxa-rtc: Unable to init SA1100 RTC sub-device
+pxa-rtc: probe of pxa-rtc failed with error -2
+hctosys: unable to open rtc device (rtc0)
+
+I think this is because commit f2997775b111 ("rtc: sa1100: fix possible
+race condition") moved the allocation of the rtc_device struct out of
+sa1100_rtc_init and into sa1100_rtc_probe. This means that pxa_rtc_probe
+also needs to do allocation for the rtc_device struct, otherwise
+sa1100_rtc_init will try to dereference a null pointer. This patch adds
+that allocation by copying how sa1100_rtc_probe in
+drivers/rtc/rtc-sa1100.c does it; after the IRQs are set up a managed
+rtc_device is allocated.
+
+I've tested this patch with `qemu-system-arm -machine akita` and with a
+real Zaurus SL-C1000 applied to 4.19, 5.4, and 5.10.
+
+Signed-off-by: Laurence de Bruxelles <lfdebrux@gmail.com>
+Fixes: f2997775b111 ("rtc: sa1100: fix possible race condition")
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20220101154149.12026-1-lfdebrux@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-pxa.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/rtc/rtc-pxa.c
++++ b/drivers/rtc/rtc-pxa.c
+@@ -330,6 +330,10 @@ static int __init pxa_rtc_probe(struct p
+ if (sa1100_rtc->irq_alarm < 0)
+ return -ENXIO;
+
++ sa1100_rtc->rtc = devm_rtc_allocate_device(&pdev->dev);
++ if (IS_ERR(sa1100_rtc->rtc))
++ return PTR_ERR(sa1100_rtc->rtc);
++
+ pxa_rtc->base = devm_ioremap(dev, pxa_rtc->ress->start,
+ resource_size(pxa_rtc->ress));
+ if (!pxa_rtc->base) {
net-smc-fix-hung_task-when-removing-smc-r-devices.patch
net-axienet-increase-reset-timeout.patch
net-axienet-wait-for-phyrstcmplt-after-core-reset.patch
+net-axienet-reset-core-on-initialization-prior-to-mdio-access.patch
+net-axienet-add-missing-memory-barriers.patch
+net-axienet-limit-minimum-tx-ring-size.patch
+net-axienet-fix-tx-ring-slot-available-check.patch
+net-axienet-fix-number-of-tx-ring-slots-for-available-check.patch
+net-axienet-fix-for-tx-busy-handling.patch
+net-axienet-increase-default-tx-ring-size-to-128.patch
+hid-vivaldi-fix-handling-devices-not-using-numbered-reports.patch
+rtc-pxa-fix-null-pointer-dereference.patch
+vdpa-mlx5-fix-wrong-configuration-of-virtio_version_1_0.patch
+virtio_ring-mark-ring-unused-on-error.patch
+taskstats-cleanup-the-use-of-task-exit_code.patch
+inet-frags-annotate-races-around-fqdir-dead-and-fqdir-high_thresh.patch
+netns-add-schedule-point-in-ops_exit_list.patch
+xfrm-don-t-accidentally-set-rto_onlink-in-decode_session4.patch
+gre-don-t-accidentally-set-rto_onlink-in-gre_fill_metadata_dst.patch
+libcxgb-don-t-accidentally-set-rto_onlink-in-cxgb_find_route.patch
+perf-script-fix-hex-dump-character-output.patch
+dmaengine-at_xdmac-don-t-start-transactions-at-tx_submit-level.patch
+dmaengine-at_xdmac-start-transfer-for-cyclic-channels-in-issue_pending.patch
+dmaengine-at_xdmac-print-debug-message-after-realeasing-the-lock.patch
+dmaengine-at_xdmac-fix-concurrency-over-xfers_list.patch
+dmaengine-at_xdmac-fix-lld-view-setting.patch
+dmaengine-at_xdmac-fix-at_xdmac_lld-struct-definition.patch
+perf-probe-fix-ppc64-perf-probe-add-events-failed-case.patch
+devlink-remove-misleading-internal_flags-from-health-reporter-dump.patch
+arm64-dts-qcom-msm8996-drop-not-documented-adreno-properties.patch
+net-bonding-fix-bond_xmit_broadcast-return-value-error-bug.patch
+net_sched-restore-mpu-xxx-handling.patch
+bcmgenet-add-wol-irq-check.patch
+net-ethernet-mtk_eth_soc-fix-error-checking-in-mtk_mac_config.patch
+net-sfp-fix-high-power-modules-without-diagnostic-monitoring.patch
+net-mscc-ocelot-fix-using-match-before-it-is-set.patch
--- /dev/null
+From 1b5a42d9c85f0e731f01c8d1129001fd8531a8a0 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Mon, 3 Jan 2022 11:32:36 -0600
+Subject: taskstats: Cleanup the use of task->exit_code
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+commit 1b5a42d9c85f0e731f01c8d1129001fd8531a8a0 upstream.
+
+In the function bacct_add_task the code reading task->exit_code was
+introduced in commit f3cef7a99469 ("[PATCH] csa: basic accounting over
+taskstats"), and it is not entirely clear what the taskstats interface
+is trying to return as only returning the exit_code of the first task
+in a process doesn't make a lot of sense.
+
+As best as I can figure the intent is to return task->exit_code after
+a task exits. The field is returned with per task fields, so the
+exit_code of the entire process is not wanted. Only the value of the
+first task is returned so this is not a useful way to get the per task
+ptrace stop code. The ordinary case of returning this value is
+returning after a task exits, which also precludes use for getting
+a ptrace value.
+
+It is common to for the first task of a process to also be the last
+task of a process so this field may have done something reasonable by
+accident in testing.
+
+Make ac_exitcode a reliable per task value by always returning it for
+every exited task.
+
+Setting ac_exitcode in a sensible mannter makes it possible to continue
+to provide this value going forward.
+
+Cc: Balbir Singh <bsingharora@gmail.com>
+Fixes: f3cef7a99469 ("[PATCH] csa: basic accounting over taskstats")
+Link: https://lkml.kernel.org/r/20220103213312.9144-5-ebiederm@xmission.com
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/tsacct.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/kernel/tsacct.c
++++ b/kernel/tsacct.c
+@@ -38,11 +38,10 @@ void bacct_add_tsk(struct user_namespace
+ stats->ac_btime = clamp_t(time64_t, btime, 0, U32_MAX);
+ stats->ac_btime64 = btime;
+
+- if (thread_group_leader(tsk)) {
++ if (tsk->flags & PF_EXITING)
+ stats->ac_exitcode = tsk->exit_code;
+- if (tsk->flags & PF_FORKNOEXEC)
+- stats->ac_flag |= AFORK;
+- }
++ if (thread_group_leader(tsk) && (tsk->flags & PF_FORKNOEXEC))
++ stats->ac_flag |= AFORK;
+ if (tsk->flags & PF_SUPERPRIV)
+ stats->ac_flag |= ASU;
+ if (tsk->flags & PF_DUMPCORE)
--- /dev/null
+From 97143b70aa847f2b0a1f959dde126b76ff7b5376 Mon Sep 17 00:00:00 2001
+From: Eli Cohen <elic@nvidia.com>
+Date: Thu, 30 Dec 2021 16:20:24 +0200
+Subject: vdpa/mlx5: Fix wrong configuration of virtio_version_1_0
+
+From: Eli Cohen <elic@nvidia.com>
+
+commit 97143b70aa847f2b0a1f959dde126b76ff7b5376 upstream.
+
+Remove overriding of virtio_version_1_0 which forced the virtqueue
+object to version 1.
+
+Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices")
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Link: https://lore.kernel.org/r/20211230142024.142979-1-elic@nvidia.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Parav Pandit <parav@nvidia.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+@@ -812,8 +812,6 @@ static int create_virtqueue(struct mlx5_
+ MLX5_SET(virtio_q, vq_ctx, umem_3_id, mvq->umem3.id);
+ MLX5_SET(virtio_q, vq_ctx, umem_3_size, mvq->umem3.size);
+ MLX5_SET(virtio_q, vq_ctx, pd, ndev->mvdev.res.pdn);
+- if (MLX5_CAP_DEV_VDPA_EMULATION(ndev->mvdev.mdev, eth_frame_offload_type))
+- MLX5_SET(virtio_q, vq_ctx, virtio_version_1_0, 1);
+
+ err = mlx5_cmd_exec(ndev->mvdev.mdev, in, inlen, out, sizeof(out));
+ if (err)
--- /dev/null
+From 1861ba626ae9b98136f3e504208cdef6b29cd3ec Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Thu, 6 Jan 2022 07:57:46 -0500
+Subject: virtio_ring: mark ring unused on error
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+commit 1861ba626ae9b98136f3e504208cdef6b29cd3ec upstream.
+
+A recently added error path does not mark ring unused when exiting on
+OOM, which will lead to BUG on the next entry in debug builds.
+
+TODO: refactor code so we have START_USE and END_USE in the same function.
+
+Fixes: fc6d70f40b3d ("virtio_ring: check desc == NULL when using indirect with packed")
+Cc: "Xuan Zhuo" <xuanzhuo@linux.alibaba.com>
+Cc: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/virtio/virtio_ring.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -1124,8 +1124,10 @@ static inline int virtqueue_add_packed(s
+ if (virtqueue_use_indirect(_vq, total_sg)) {
+ err = virtqueue_add_indirect_packed(vq, sgs, total_sg, out_sgs,
+ in_sgs, data, gfp);
+- if (err != -ENOMEM)
++ if (err != -ENOMEM) {
++ END_USE(vq);
+ return err;
++ }
+
+ /* fall back on direct */
+ }
--- /dev/null
+From 23e7b1bfed61e301853b5e35472820d919498278 Mon Sep 17 00:00:00 2001
+From: Guillaume Nault <gnault@redhat.com>
+Date: Mon, 10 Jan 2022 14:43:06 +0100
+Subject: xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
+
+From: Guillaume Nault <gnault@redhat.com>
+
+commit 23e7b1bfed61e301853b5e35472820d919498278 upstream.
+
+Similar to commit 94e2238969e8 ("xfrm4: strip ECN bits from tos field"),
+clear the ECN bits from iph->tos when setting ->flowi4_tos.
+This ensures that the last bit of ->flowi4_tos is cleared, so
+ip_route_output_key_hash() isn't going to restrict the scope of the
+route lookup.
+
+Use ~INET_ECN_MASK instead of IPTOS_RT_MASK, because we have no reason
+to clear the high order bits.
+
+Found by code inspection, compile tested only.
+
+Fixes: 4da3089f2b58 ("[IPSEC]: Use TOS when doing tunnel lookups")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/xfrm_policy.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -31,6 +31,7 @@
+ #include <linux/if_tunnel.h>
+ #include <net/dst.h>
+ #include <net/flow.h>
++#include <net/inet_ecn.h>
+ #include <net/xfrm.h>
+ #include <net/ip.h>
+ #include <net/gre.h>
+@@ -3294,7 +3295,7 @@ decode_session4(struct sk_buff *skb, str
+ fl4->flowi4_proto = iph->protocol;
+ fl4->daddr = reverse ? iph->saddr : iph->daddr;
+ fl4->saddr = reverse ? iph->daddr : iph->saddr;
+- fl4->flowi4_tos = iph->tos;
++ fl4->flowi4_tos = iph->tos & ~INET_ECN_MASK;
+
+ if (!ip_is_fragment(iph)) {
+ switch (iph->protocol) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
