--- /dev/null
+From b3da9a4f301f9a7ed426799a4c16bcdf0d19c677 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 06:36:53 +0000
+Subject: bpf: Check for integer overflow when using roundup_pow_of_two()
+
+From: Bui Quang Minh <minhquangbui99@gmail.com>
+
+[ Upstream commit 6183f4d3a0a2ad230511987c6c362ca43ec0055f ]
+
+On 32-bit architecture, roundup_pow_of_two() can return 0 when the argument
+has upper most bit set due to resulting 1UL << 32. Add a check for this case.
+
+Fixes: d5a3b1f69186 ("bpf: introduce BPF_MAP_TYPE_STACK_TRACE")
+Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20210127063653.3576-1-minhquangbui99@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/stackmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index 173e983619d77..fba2ade28fb3a 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -112,6 +112,8 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)
+
+ /* hash table size must be power of 2 */
+ n_buckets = roundup_pow_of_two(attr->max_entries);
++ if (!n_buckets)
++ return ERR_PTR(-E2BIG);
+
+ cost = n_buckets * sizeof(struct stack_map_bucket *) + sizeof(*smap);
+ cost += n_buckets * (value_size + sizeof(struct stack_map_bucket));
+--
+2.27.0
+
--- /dev/null
+From 85fb22459cd84a3cee1a1d36a32ba119f7b1c5e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 17:37:17 +0800
+Subject: cgroup-v1: add disabled controller check in cgroup1_parse_param()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chen Zhou <chenzhou10@huawei.com>
+
+[ Upstream commit 61e960b07b637f0295308ad91268501d744c21b5 ]
+
+When mounting a cgroup hierarchy with disabled controller in cgroup v1,
+all available controllers will be attached.
+For example, boot with cgroup_no_v1=cpu or cgroup_disable=cpu, and then
+mount with "mount -t cgroup -ocpu cpu /sys/fs/cgroup/cpu", then all
+enabled controllers will be attached except cpu.
+
+Fix this by adding disabled controller check in cgroup1_parse_param().
+If the specified controller is disabled, just return error with information
+"Disabled controller xx" rather than attaching all the other enabled
+controllers.
+
+Fixes: f5dfb5315d34 ("cgroup: take options parsing into ->parse_monolithic()")
+Signed-off-by: Chen Zhou <chenzhou10@huawei.com>
+Reviewed-by: Zefan Li <lizefan.x@bytedance.com>
+Reviewed-by: Michal Koutný <mkoutny@suse.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cgroup-v1.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
+index 79682c23407c9..ebe541f46fe95 100644
+--- a/kernel/cgroup/cgroup-v1.c
++++ b/kernel/cgroup/cgroup-v1.c
+@@ -923,6 +923,9 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param)
+ for_each_subsys(ss, i) {
+ if (strcmp(param->key, ss->legacy_name))
+ continue;
++ if (!cgroup_ssid_enabled(i) || cgroup1_ssid_disabled(i))
++ return invalfc(fc, "Disabled controller '%s'",
++ param->key);
+ ctx->subsys_mask |= (1 << i);
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From 3126e6c769af1867f75706d5c969b909b12daa76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 18:58:56 +0100
+Subject: clk: sunxi-ng: mp: fix parent rate change flag check
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 245090ab2636c0869527ce563afbfb8aff29e825 ]
+
+CLK_SET_RATE_PARENT flag is checked on parent clock instead of current
+one. Fix that.
+
+Fixes: 3f790433c3cb ("clk: sunxi-ng: Adjust MP clock parent rate when allowed")
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Tested-by: Andre Heider <a.heider@gmail.com>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20210209175900.7092-2-jernej.skrabec@siol.net
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu_mp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu_mp.c b/drivers/clk/sunxi-ng/ccu_mp.c
+index fa4ecb9155909..9d3a76604d94c 100644
+--- a/drivers/clk/sunxi-ng/ccu_mp.c
++++ b/drivers/clk/sunxi-ng/ccu_mp.c
+@@ -108,7 +108,7 @@ static unsigned long ccu_mp_round_rate(struct ccu_mux_internal *mux,
+ max_m = cmp->m.max ?: 1 << cmp->m.width;
+ max_p = cmp->p.max ?: 1 << ((1 << cmp->p.width) - 1);
+
+- if (!(clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT)) {
++ if (!clk_hw_can_set_rate_parent(&cmp->common.hw)) {
+ ccu_mp_find_best(*parent_rate, rate, max_m, max_p, &m, &p);
+ rate = *parent_rate / p / m;
+ } else {
+--
+2.27.0
+
--- /dev/null
+From 146a46e2e5a1fca73684059606b5967a14fcc6b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 18:59:00 +0100
+Subject: drm/sun4i: dw-hdmi: Fix max. frequency for H6
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 1926a0508d8947cf081280d85ff035300dc71da7 ]
+
+It turns out that reasoning for lowering max. supported frequency is
+wrong. Scrambling works just fine. Several now fixed bugs prevented
+proper functioning, even with rates lower than 340 MHz. Issues were just
+more pronounced with higher frequencies.
+
+Fix that by allowing max. supported frequency in HW and fix the comment.
+
+Fixes: cd9063757a22 ("drm/sun4i: DW HDMI: Lower max. supported rate for H6")
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Tested-by: Andre Heider <a.heider@gmail.com>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-6-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+index 12fe241956213..8f721be26477b 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+@@ -49,11 +49,9 @@ sun8i_dw_hdmi_mode_valid_h6(struct drm_connector *connector,
+ {
+ /*
+ * Controller support maximum of 594 MHz, which correlates to
+- * 4K@60Hz 4:4:4 or RGB. However, for frequencies greater than
+- * 340 MHz scrambling has to be enabled. Because scrambling is
+- * not yet implemented, just limit to 340 MHz for now.
++ * 4K@60Hz 4:4:4 or RGB.
+ */
+- if (mode->clock > 340000)
++ if (mode->clock > 594000)
+ return MODE_CLOCK_HIGH;
+
+ return MODE_OK;
+--
+2.27.0
+
--- /dev/null
+From 1b6ecca60cbf12646e7abd0fe51baf0ce3ce698a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 18:58:59 +0100
+Subject: drm/sun4i: Fix H6 HDMI PHY configuration
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 6a155216c48f2f65c8dcb02c4c27549c170d24a9 ]
+
+As it turns out, vendor HDMI PHY driver for H6 has a pretty big table
+of predefined values for various pixel clocks. However, most of them are
+not useful/tested because they come from reference driver code. Vendor
+PHY driver is concerned with only few of those, namely 27 MHz, 74.25
+MHz, 148.5 MHz, 297 MHz and 594 MHz. These are all frequencies for
+standard CEA modes.
+
+Fix sun50i_h6_cur_ctr and sun50i_h6_phy_config with the values only for
+aforementioned frequencies.
+
+Table sun50i_h6_mpll_cfg doesn't need to be changed because values are
+actually frequency dependent and not so much SoC dependent. See i.MX6
+documentation for explanation of those values for similar PHY.
+
+Fixes: c71c9b2fee17 ("drm/sun4i: Add support for Synopsys HDMI PHY")
+Tested-by: Andre Heider <a.heider@gmail.com>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-5-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 26 +++++++++-----------------
+ 1 file changed, 9 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+index 43643ad317306..a4012ec13d4b3 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
++++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+@@ -104,29 +104,21 @@ static const struct dw_hdmi_mpll_config sun50i_h6_mpll_cfg[] = {
+
+ static const struct dw_hdmi_curr_ctrl sun50i_h6_cur_ctr[] = {
+ /* pixelclk bpp8 bpp10 bpp12 */
+- { 25175000, { 0x0000, 0x0000, 0x0000 }, },
+ { 27000000, { 0x0012, 0x0000, 0x0000 }, },
+- { 59400000, { 0x0008, 0x0008, 0x0008 }, },
+- { 72000000, { 0x0008, 0x0008, 0x001b }, },
+- { 74250000, { 0x0013, 0x0013, 0x0013 }, },
+- { 90000000, { 0x0008, 0x001a, 0x001b }, },
+- { 118800000, { 0x001b, 0x001a, 0x001b }, },
+- { 144000000, { 0x001b, 0x001a, 0x0034 }, },
+- { 180000000, { 0x001b, 0x0033, 0x0034 }, },
+- { 216000000, { 0x0036, 0x0033, 0x0034 }, },
+- { 237600000, { 0x0036, 0x0033, 0x001b }, },
+- { 288000000, { 0x0036, 0x001b, 0x001b }, },
+- { 297000000, { 0x0019, 0x001b, 0x0019 }, },
+- { 330000000, { 0x0036, 0x001b, 0x001b }, },
+- { 594000000, { 0x003f, 0x001b, 0x001b }, },
++ { 74250000, { 0x0013, 0x001a, 0x001b }, },
++ { 148500000, { 0x0019, 0x0033, 0x0034 }, },
++ { 297000000, { 0x0019, 0x001b, 0x001b }, },
++ { 594000000, { 0x0010, 0x001b, 0x001b }, },
+ { ~0UL, { 0x0000, 0x0000, 0x0000 }, }
+ };
+
+ static const struct dw_hdmi_phy_config sun50i_h6_phy_config[] = {
+ /*pixelclk symbol term vlev*/
+- { 74250000, 0x8009, 0x0004, 0x0232},
+- { 148500000, 0x8029, 0x0004, 0x0273},
+- { 594000000, 0x8039, 0x0004, 0x014a},
++ { 27000000, 0x8009, 0x0007, 0x02b0 },
++ { 74250000, 0x8009, 0x0006, 0x022d },
++ { 148500000, 0x8029, 0x0006, 0x0270 },
++ { 297000000, 0x8039, 0x0005, 0x01ab },
++ { 594000000, 0x8029, 0x0000, 0x008a },
+ { ~0UL, 0x0000, 0x0000, 0x0000}
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 403f81cada6b60ebc97cfea79ad7c7eade006272 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 18:58:57 +0100
+Subject: drm/sun4i: tcon: set sync polarity for tcon1 channel
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 50791f5d7b6a14b388f46c8885f71d1b98216d1d ]
+
+Channel 1 has polarity bits for vsync and hsync signals but driver never
+sets them. It turns out that with pre-HDMI2 controllers seemingly there
+is no issue if polarity is not set. However, with HDMI2 controllers
+(H6) there often comes to de-synchronization due to phase shift. This
+causes flickering screen. It's safe to assume that similar issues might
+happen also with pre-HDMI2 controllers.
+
+Solve issue with setting vsync and hsync polarity. Note that display
+stacks with tcon top have polarity bits actually in tcon0 polarity
+register.
+
+Fixes: 9026e0d122ac ("drm: Add Allwinner A10 Display Engine support")
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Tested-by: Andre Heider <a.heider@gmail.com>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-3-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_tcon.c | 25 +++++++++++++++++++++++++
+ drivers/gpu/drm/sun4i/sun4i_tcon.h | 6 ++++++
+ 2 files changed, 31 insertions(+)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+index ae7ae432aa4ab..6bf1425e8b0ca 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+@@ -665,6 +665,30 @@ static void sun4i_tcon1_mode_set(struct sun4i_tcon *tcon,
+ SUN4I_TCON1_BASIC5_V_SYNC(vsync) |
+ SUN4I_TCON1_BASIC5_H_SYNC(hsync));
+
++ /* Setup the polarity of multiple signals */
++ if (tcon->quirks->polarity_in_ch0) {
++ val = 0;
++
++ if (mode->flags & DRM_MODE_FLAG_PHSYNC)
++ val |= SUN4I_TCON0_IO_POL_HSYNC_POSITIVE;
++
++ if (mode->flags & DRM_MODE_FLAG_PVSYNC)
++ val |= SUN4I_TCON0_IO_POL_VSYNC_POSITIVE;
++
++ regmap_write(tcon->regs, SUN4I_TCON0_IO_POL_REG, val);
++ } else {
++ /* according to vendor driver, this bit must be always set */
++ val = SUN4I_TCON1_IO_POL_UNKNOWN;
++
++ if (mode->flags & DRM_MODE_FLAG_PHSYNC)
++ val |= SUN4I_TCON1_IO_POL_HSYNC_POSITIVE;
++
++ if (mode->flags & DRM_MODE_FLAG_PVSYNC)
++ val |= SUN4I_TCON1_IO_POL_VSYNC_POSITIVE;
++
++ regmap_write(tcon->regs, SUN4I_TCON1_IO_POL_REG, val);
++ }
++
+ /* Map output pins to channel 1 */
+ regmap_update_bits(tcon->regs, SUN4I_TCON_GCTL_REG,
+ SUN4I_TCON_GCTL_IOMAP_MASK,
+@@ -1482,6 +1506,7 @@ static const struct sun4i_tcon_quirks sun8i_a83t_tv_quirks = {
+
+ static const struct sun4i_tcon_quirks sun8i_r40_tv_quirks = {
+ .has_channel_1 = true,
++ .polarity_in_ch0 = true,
+ .set_mux = sun8i_r40_tcon_tv_set_mux,
+ };
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.h b/drivers/gpu/drm/sun4i/sun4i_tcon.h
+index a62ec826ae71e..5bdbaf0847824 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.h
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h
+@@ -153,6 +153,11 @@
+ #define SUN4I_TCON1_BASIC5_V_SYNC(height) (((height) - 1) & 0x3ff)
+
+ #define SUN4I_TCON1_IO_POL_REG 0xf0
++/* there is no documentation about this bit */
++#define SUN4I_TCON1_IO_POL_UNKNOWN BIT(26)
++#define SUN4I_TCON1_IO_POL_HSYNC_POSITIVE BIT(25)
++#define SUN4I_TCON1_IO_POL_VSYNC_POSITIVE BIT(24)
++
+ #define SUN4I_TCON1_IO_TRI_REG 0xf4
+
+ #define SUN4I_TCON_ECC_FIFO_REG 0xf8
+@@ -224,6 +229,7 @@ struct sun4i_tcon_quirks {
+ bool needs_de_be_mux; /* sun6i needs mux to select backend */
+ bool needs_edp_reset; /* a80 edp reset needed for tcon0 access */
+ bool supports_lvds; /* Does the TCON support an LVDS output? */
++ bool polarity_in_ch0; /* some tcon1 channels have polarity bits in tcon0 pol register */
+ u8 dclk_min_div; /* minimum divider for TCON0 DCLK */
+
+ /* callback to handle tcon muxing options */
+--
+2.27.0
+
--- /dev/null
+From 90361b637019650a394f057901d7e9f54f2a6801 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 17:06:47 +0100
+Subject: drm/vc4: hvs: Fix buffer overflow with the dlist handling
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit facd93f4285c405f9a91b05166147cb39e860666 ]
+
+Commit 0a038c1c29a7 ("drm/vc4: Move LBM creation out of
+vc4_plane_mode_set()") changed the LBM allocation logic from first
+allocating the LBM memory for the plane to running mode_set,
+adding a gap in the LBM, and then running the dlist allocation filling
+that gap.
+
+The gap was introduced by incrementing the dlist array index, but was
+never checking whether or not we were over the array length, leading
+eventually to memory corruptions if we ever crossed this limit.
+
+vc4_dlist_write had that logic though, and was reallocating a larger
+dlist array when reaching the end of the buffer. Let's share the logic
+between both functions.
+
+Cc: Boris Brezillon <boris.brezillon@collabora.com>
+Cc: Eric Anholt <eric@anholt.net>
+Fixes: 0a038c1c29a7 ("drm/vc4: Move LBM creation out of vc4_plane_mode_set()")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210129160647.128373-1-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
+index 5e5f90810acaf..363f456ea7134 100644
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -205,7 +205,7 @@ static void vc4_plane_reset(struct drm_plane *plane)
+ __drm_atomic_helper_plane_reset(plane, &vc4_state->base);
+ }
+
+-static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val)
++static void vc4_dlist_counter_increment(struct vc4_plane_state *vc4_state)
+ {
+ if (vc4_state->dlist_count == vc4_state->dlist_size) {
+ u32 new_size = max(4u, vc4_state->dlist_count * 2);
+@@ -220,7 +220,15 @@ static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val)
+ vc4_state->dlist_size = new_size;
+ }
+
+- vc4_state->dlist[vc4_state->dlist_count++] = val;
++ vc4_state->dlist_count++;
++}
++
++static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val)
++{
++ unsigned int idx = vc4_state->dlist_count;
++
++ vc4_dlist_counter_increment(vc4_state);
++ vc4_state->dlist[idx] = val;
+ }
+
+ /* Returns the scl0/scl1 field based on whether the dimensions need to
+@@ -871,8 +879,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
+ * be set when calling vc4_plane_allocate_lbm().
+ */
+ if (vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
+- vc4_state->y_scaling[1] != VC4_SCALING_NONE)
+- vc4_state->lbm_offset = vc4_state->dlist_count++;
++ vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
++ vc4_state->lbm_offset = vc4_state->dlist_count;
++ vc4_dlist_counter_increment(vc4_state);
++ }
+
+ if (num_planes > 1) {
+ /* Emit Cb/Cr as channel 0 and Y as channel
+--
+2.27.0
+
--- /dev/null
+From f672e65d207c4790020fd696f27823886789a41c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 13:42:07 -0800
+Subject: firmware_loader: align .builtin_fw to 8
+
+From: Fangrui Song <maskray@google.com>
+
+[ Upstream commit 793f49a87aae24e5bcf92ad98d764153fc936570 ]
+
+arm64 references the start address of .builtin_fw (__start_builtin_fw)
+with a pair of R_AARCH64_ADR_PREL_PG_HI21/R_AARCH64_LDST64_ABS_LO12_NC
+relocations. The compiler is allowed to emit the
+R_AARCH64_LDST64_ABS_LO12_NC relocation because struct builtin_fw in
+include/linux/firmware.h is 8-byte aligned.
+
+The R_AARCH64_LDST64_ABS_LO12_NC relocation requires the address to be a
+multiple of 8, which may not be the case if .builtin_fw is empty.
+Unconditionally align .builtin_fw to fix the linker error. 32-bit
+architectures could use ALIGN(4) but that would add unnecessary
+complexity, so just use ALIGN(8).
+
+Link: https://lkml.kernel.org/r/20201208054646.2913063-1-maskray@google.com
+Link: https://github.com/ClangBuiltLinux/linux/issues/1204
+Fixes: 5658c76 ("firmware: allow firmware files to be built into kernel image")
+Signed-off-by: Fangrui Song <maskray@google.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Tested-by: Nick Desaulniers <ndesaulniers@google.com>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/vmlinux.lds.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index 9a4a5a43e8867..2267b7c763c64 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -396,7 +396,7 @@
+ } \
+ \
+ /* Built-in firmware blobs */ \
+- .builtin_fw : AT(ADDR(.builtin_fw) - LOAD_OFFSET) { \
++ .builtin_fw : AT(ADDR(.builtin_fw) - LOAD_OFFSET) ALIGN(8) { \
+ __start_builtin_fw = .; \
+ KEEP(*(.builtin_fw)) \
+ __end_builtin_fw = .; \
+--
+2.27.0
+
--- /dev/null
+From 72cf0d8c01acc7aa359dae193ac04980479036f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 20:52:54 -0800
+Subject: h8300: fix PREEMPTION build, TI_PRE_COUNT undefined
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit ade9679c159d5bbe14fb7e59e97daf6062872e2b ]
+
+Fix a build error for undefined 'TI_PRE_COUNT' by adding it to
+asm-offsets.c.
+
+ h8300-linux-ld: arch/h8300/kernel/entry.o: in function `resume_kernel': (.text+0x29a): undefined reference to `TI_PRE_COUNT'
+
+Link: https://lkml.kernel.org/r/20210212021650.22740-1-rdunlap@infradead.org
+Fixes: df2078b8daa7 ("h8300: Low level entry")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/h8300/kernel/asm-offsets.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/h8300/kernel/asm-offsets.c b/arch/h8300/kernel/asm-offsets.c
+index 85e60509f0a83..d4b53af657c84 100644
+--- a/arch/h8300/kernel/asm-offsets.c
++++ b/arch/h8300/kernel/asm-offsets.c
+@@ -63,6 +63,9 @@ int main(void)
+ OFFSET(TI_FLAGS, thread_info, flags);
+ OFFSET(TI_CPU, thread_info, cpu);
+ OFFSET(TI_PRE, thread_info, preempt_count);
++#ifdef CONFIG_PREEMPTION
++ DEFINE(TI_PRE_COUNT, offsetof(struct thread_info, preempt_count));
++#endif
+
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From a31be2b529e266ed0c5f8b4a93cc836f1cd93ff9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 09:51:40 +0100
+Subject: i2c: stm32f7: fix configuration of the digital filter
+
+From: Alain Volmat <alain.volmat@foss.st.com>
+
+[ Upstream commit 3d6a3d3a2a7a3a60a824e7c04e95fd50dec57812 ]
+
+The digital filter related computation are present in the driver
+however the programming of the filter within the IP is missing.
+The maximum value for the DNF is wrong and should be 15 instead of 16.
+
+Fixes: aeb068c57214 ("i2c: i2c-stm32f7: add driver")
+
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Signed-off-by: Pierre-Yves MORDRET <pierre-yves.mordret@foss.st.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-stm32f7.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index b2634afe066d3..a7977eef2ead5 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -53,6 +53,8 @@
+ #define STM32F7_I2C_CR1_RXDMAEN BIT(15)
+ #define STM32F7_I2C_CR1_TXDMAEN BIT(14)
+ #define STM32F7_I2C_CR1_ANFOFF BIT(12)
++#define STM32F7_I2C_CR1_DNF_MASK GENMASK(11, 8)
++#define STM32F7_I2C_CR1_DNF(n) (((n) & 0xf) << 8)
+ #define STM32F7_I2C_CR1_ERRIE BIT(7)
+ #define STM32F7_I2C_CR1_TCIE BIT(6)
+ #define STM32F7_I2C_CR1_STOPIE BIT(5)
+@@ -151,7 +153,7 @@
+ #define STM32F7_I2C_MAX_SLAVE 0x2
+
+ #define STM32F7_I2C_DNF_DEFAULT 0
+-#define STM32F7_I2C_DNF_MAX 16
++#define STM32F7_I2C_DNF_MAX 15
+
+ #define STM32F7_I2C_ANALOG_FILTER_ENABLE 1
+ #define STM32F7_I2C_ANALOG_FILTER_DELAY_MIN 50 /* ns */
+@@ -657,6 +659,13 @@ static void stm32f7_i2c_hw_config(struct stm32f7_i2c_dev *i2c_dev)
+ else
+ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1,
+ STM32F7_I2C_CR1_ANFOFF);
++
++ /* Program the Digital Filter */
++ stm32f7_i2c_clr_bits(i2c_dev->base + STM32F7_I2C_CR1,
++ STM32F7_I2C_CR1_DNF_MASK);
++ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1,
++ STM32F7_I2C_CR1_DNF(i2c_dev->setup.dnf));
++
+ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1,
+ STM32F7_I2C_CR1_PE);
+ }
+--
+2.27.0
+
--- /dev/null
+From 60562e04528b6585a266b81d0743e9a8dbce3ff9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 21:08:02 -0800
+Subject: ibmvnic: Clear failover_pending if unable to schedule
+
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+
+[ Upstream commit ef66a1eace968ff22a35f45e6e8ec36b668b6116 ]
+
+Normally we clear the failover_pending flag when processing the reset.
+But if we are unable to schedule a failover reset we must clear the
+flag ourselves. We could fail to schedule the reset if we are in PROBING
+state (eg: when booting via kexec) or because we could not allocate memory.
+
+Thanks to Cris Forno for helping isolate the problem and for testing.
+
+Fixes: 1d8504937478 ("powerpc/vnic: Extend "failover pending" window")
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Tested-by: Cristobal Forno <cforno12@linux.ibm.com>
+Link: https://lore.kernel.org/r/20210203050802.680772-1-sukadev@linux.ibm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index c3079f436f6d7..0f35eec967ae8 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -4595,7 +4595,22 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq,
+ complete(&adapter->init_done);
+ adapter->init_done_rc = -EIO;
+ }
+- ibmvnic_reset(adapter, VNIC_RESET_FAILOVER);
++ rc = ibmvnic_reset(adapter, VNIC_RESET_FAILOVER);
++ if (rc && rc != -EBUSY) {
++ /* We were unable to schedule the failover
++ * reset either because the adapter was still
++ * probing (eg: during kexec) or we could not
++ * allocate memory. Clear the failover_pending
++ * flag since no one else will. We ignore
++ * EBUSY because it means either FAILOVER reset
++ * is already scheduled or the adapter is
++ * being removed.
++ */
++ netdev_err(netdev,
++ "Error %ld scheduling failover reset\n",
++ rc);
++ adapter->failover_pending = false;
++ }
+ break;
+ case IBMVNIC_CRQ_INIT_COMPLETE:
+ dev_info(dev, "Partner initialization complete\n");
+--
+2.27.0
+
--- /dev/null
+From dc9c03690122553217879d16ba56934e392b5df5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 12:02:13 +0100
+Subject: mt76: dma: fix a possible memory leak in mt76_add_fragment()
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 93a1d4791c10d443bc67044def7efee2991d48b7 ]
+
+Fix a memory leak in mt76_add_fragment routine returning the buffer
+to the page_frag_cache when we receive a new fragment and the
+skb_shared_info frag array is full.
+
+Fixes: b102f0c522cf6 ("mt76: fix array overflow on receiving too many fragments for a packet")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Acked-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/4f9dd73407da88b2a552517ce8db242d86bf4d5c.1611616130.git.lorenzo@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/dma.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index 026d996612fbe..781952b686ed2 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -452,15 +452,17 @@ static void
+ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+ int len, bool more)
+ {
+- struct page *page = virt_to_head_page(data);
+- int offset = data - page_address(page);
+ struct sk_buff *skb = q->rx_head;
+ struct skb_shared_info *shinfo = skb_shinfo(skb);
+
+ if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) {
+- offset += q->buf_offset;
++ struct page *page = virt_to_head_page(data);
++ int offset = data - page_address(page) + q->buf_offset;
++
+ skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len,
+ q->buf_size);
++ } else {
++ skb_free_frag(data);
+ }
+
+ if (more)
+--
+2.27.0
+
--- /dev/null
+From a94a9f7ac90d7c37c99635fc366db67419fb440b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 15:45:11 +0200
+Subject: net: enetc: initialize the RFS and RSS memories
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 07bf34a50e327975b21a9dee64d220c3dcb72ee9 ]
+
+Michael tried to enable Advanced Error Reporting through the ENETC's
+Root Complex Event Collector, and the system started spitting out single
+bit correctable ECC errors coming from the ENETC interfaces:
+
+pcieport 0000:00:1f.0: AER: Multiple Corrected error received: 0000:00:00.0
+fsl_enetc 0000:00:00.0: PCIe Bus Error: severity=Corrected, type=Transaction Layer, (Receiver ID)
+fsl_enetc 0000:00:00.0: device [1957:e100] error status/mask=00004000/00000000
+fsl_enetc 0000:00:00.0: [14] CorrIntErr
+fsl_enetc 0000:00:00.1: PCIe Bus Error: severity=Corrected, type=Transaction Layer, (Receiver ID)
+fsl_enetc 0000:00:00.1: device [1957:e100] error status/mask=00004000/00000000
+fsl_enetc 0000:00:00.1: [14] CorrIntErr
+
+Further investigating the port correctable memory error detect register
+(PCMEDR) shows that these AER errors have an associated SOURCE_ID of 6
+(RFS/RSS):
+
+$ devmem 0x1f8010e10 32
+0xC0000006
+$ devmem 0x1f8050e10 32
+0xC0000006
+
+Discussion with the hardware design engineers reveals that on LS1028A,
+the hardware does not do initialization of that RFS/RSS memory, and that
+software should clear/initialize the entire table before starting to
+operate. That comes as a bit of a surprise, since the driver does not do
+initialization of the RFS memory. Also, the initialization of the
+Receive Side Scaling is done only partially.
+
+Even though the entire ENETC IP has a single shared flow steering
+memory, the flow steering service should returns matches only for TCAM
+entries that are within the range of the Station Interface that is doing
+the search. Therefore, it should be sufficient for a Station Interface
+to initialize all of its own entries in order to avoid any ECC errors,
+and only the Station Interfaces in use should need initialization.
+
+There are Physical Station Interfaces associated with PCIe PFs and
+Virtual Station Interfaces associated with PCIe VFs. We let the PF
+driver initialize the entire port's memory, which includes the RFS
+entries which are going to be used by the VF.
+
+Reported-by: Michael Walle <michael@walle.cc>
+Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Tested-by: Michael Walle <michael@walle.cc>
+Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Link: https://lore.kernel.org/r/20210204134511.2640309-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/freescale/enetc/enetc_hw.h | 2 +
+ .../net/ethernet/freescale/enetc/enetc_pf.c | 59 +++++++++++++++++++
+ 2 files changed, 61 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+index 7428f62408a20..fac80831d5327 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+@@ -181,6 +181,8 @@ enum enetc_bdr_type {TX, RX};
+ #define ENETC_PTCCBSR0(n) (0x1110 + (n) * 8) /* n = 0 to 7*/
+ #define ENETC_PTCCBSR1(n) (0x1114 + (n) * 8) /* n = 0 to 7*/
+ #define ENETC_RSSHASH_KEY_SIZE 40
++#define ENETC_PRSSCAPR 0x1404
++#define ENETC_PRSSCAPR_GET_NUM_RSS(val) (BIT((val) & 0xf) * 32)
+ #define ENETC_PRSSK(n) (0x1410 + (n) * 4) /* n = [0..9] */
+ #define ENETC_PSIVLANFMR 0x1700
+ #define ENETC_PSIVLANFMR_VS BIT(0)
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+index 74847aa644f12..22f70638a4055 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+@@ -809,6 +809,51 @@ static void enetc_of_put_phy(struct enetc_ndev_priv *priv)
+ of_node_put(priv->phy_node);
+ }
+
++/* Initialize the entire shared memory for the flow steering entries
++ * of this port (PF + VFs)
++ */
++static int enetc_init_port_rfs_memory(struct enetc_si *si)
++{
++ struct enetc_cmd_rfse rfse = {0};
++ struct enetc_hw *hw = &si->hw;
++ int num_rfs, i, err = 0;
++ u32 val;
++
++ val = enetc_port_rd(hw, ENETC_PRFSCAPR);
++ num_rfs = ENETC_PRFSCAPR_GET_NUM_RFS(val);
++
++ for (i = 0; i < num_rfs; i++) {
++ err = enetc_set_fs_entry(si, &rfse, i);
++ if (err)
++ break;
++ }
++
++ return err;
++}
++
++static int enetc_init_port_rss_memory(struct enetc_si *si)
++{
++ struct enetc_hw *hw = &si->hw;
++ int num_rss, err;
++ int *rss_table;
++ u32 val;
++
++ val = enetc_port_rd(hw, ENETC_PRSSCAPR);
++ num_rss = ENETC_PRSSCAPR_GET_NUM_RSS(val);
++ if (!num_rss)
++ return 0;
++
++ rss_table = kcalloc(num_rss, sizeof(*rss_table), GFP_KERNEL);
++ if (!rss_table)
++ return -ENOMEM;
++
++ err = enetc_set_rss_table(si, rss_table, num_rss);
++
++ kfree(rss_table);
++
++ return err;
++}
++
+ static int enetc_pf_probe(struct pci_dev *pdev,
+ const struct pci_device_id *ent)
+ {
+@@ -863,6 +908,18 @@ static int enetc_pf_probe(struct pci_dev *pdev,
+ goto err_alloc_si_res;
+ }
+
++ err = enetc_init_port_rfs_memory(si);
++ if (err) {
++ dev_err(&pdev->dev, "Failed to initialize RFS memory\n");
++ goto err_init_port_rfs;
++ }
++
++ err = enetc_init_port_rss_memory(si);
++ if (err) {
++ dev_err(&pdev->dev, "Failed to initialize RSS memory\n");
++ goto err_init_port_rss;
++ }
++
+ err = enetc_alloc_msix(priv);
+ if (err) {
+ dev_err(&pdev->dev, "MSIX alloc failed\n");
+@@ -888,6 +945,8 @@ err_reg_netdev:
+ enetc_mdio_remove(pf);
+ enetc_of_put_phy(priv);
+ enetc_free_msix(priv);
++err_init_port_rss:
++err_init_port_rfs:
+ err_alloc_msix:
+ enetc_free_si_resources(priv);
+ err_alloc_si_res:
+--
+2.27.0
+
--- /dev/null
+From edba6f7dd462d4900262910bdb3bc01aa404316d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 17:03:05 +0800
+Subject: net: hns3: add a check for queue_id in hclge_reset_vf_queue()
+
+From: Yufeng Mo <moyufeng@huawei.com>
+
+[ Upstream commit 67a69f84cab60484f02eb8cbc7a76edffbb28a25 ]
+
+The queue_id is received from vf, if use it directly,
+an out-of-bound issue may be caused, so add a check for
+this queue_id before using it in hclge_reset_vf_queue().
+
+Fixes: 1a426f8b40fc ("net: hns3: fix the VF queue reset flow error")
+Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 6887b7fda6e07..08040cafc06bc 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -8563,12 +8563,19 @@ int hclge_reset_tqp(struct hnae3_handle *handle, u16 queue_id)
+
+ void hclge_reset_vf_queue(struct hclge_vport *vport, u16 queue_id)
+ {
++ struct hnae3_handle *handle = &vport->nic;
+ struct hclge_dev *hdev = vport->back;
+ int reset_try_times = 0;
+ int reset_status;
+ u16 queue_gid;
+ int ret;
+
++ if (queue_id >= handle->kinfo.num_tqps) {
++ dev_warn(&hdev->pdev->dev, "Invalid vf queue id(%u)\n",
++ queue_id);
++ return;
++ }
++
+ queue_gid = hclge_covert_handle_qid_global(&vport->nic, queue_id);
+
+ ret = hclge_send_reset_tqp_cmd(hdev, queue_gid, true);
+--
+2.27.0
+
--- /dev/null
+From 05e542c854b6845988865fc9b593f039b43af175 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 22:03:16 +0800
+Subject: net: stmmac: set TxQ mode back to DCB after disabling CBS
+
+From: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
+
+[ Upstream commit f317e2ea8c88737aa36228167b2292baef3f0430 ]
+
+When disable CBS, mode_to_use parameter is not updated even the operation
+mode of Tx Queue is changed to Data Centre Bridging (DCB). Therefore,
+when tc_setup_cbs() function is called to re-enable CBS, the operation
+mode of Tx Queue remains at DCB, which causing CBS fails to work.
+
+This patch updates the value of mode_to_use parameter to MTL_QUEUE_DCB
+after operation mode of Tx Queue is changed to DCB in stmmac_dma_qmode()
+callback function.
+
+Fixes: 1f705bc61aee ("net: stmmac: Add support for CBS QDISC")
+Suggested-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
+Signed-off-by: Song, Yoong Siang <yoong.siang.song@intel.com>
+Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Link: https://lore.kernel.org/r/1612447396-20351-1-git-send-email-yoong.siang.song@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+index 1d135b02ea021..52b453b605979 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -332,7 +332,12 @@ static int tc_setup_cbs(struct stmmac_priv *priv,
+
+ priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_AVB;
+ } else if (!qopt->enable) {
+- return stmmac_dma_qmode(priv, priv->ioaddr, queue, MTL_QUEUE_DCB);
++ ret = stmmac_dma_qmode(priv, priv->ioaddr, queue,
++ MTL_QUEUE_DCB);
++ if (ret)
++ return ret;
++
++ priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB;
+ }
+
+ /* Port Transmit Rate and Speed Divider */
+--
+2.27.0
+
--- /dev/null
+From 12dc3f653ece848d684afcee7177c3616e460e57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 12:56:43 +0100
+Subject: netfilter: conntrack: skip identical origin tuple in same zone only
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 07998281c268592963e1cd623fe6ab0270b65ae4 ]
+
+The origin skip check needs to re-test the zone. Else, we might skip
+a colliding tuple in the reply direction.
+
+This only occurs when using 'directional zones' where origin tuples
+reside in different zones but the reply tuples share the same zone.
+
+This causes the new conntrack entry to be dropped at confirmation time
+because NAT clash resolution was elided.
+
+Fixes: 4e35c1cb9460240 ("netfilter: nf_nat: skip nat clash resolution for same-origin entries")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 200cdad3ff3ab..9a40312b1f161 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1091,7 +1091,8 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
+ * Let nf_ct_resolve_clash() deal with this later.
+ */
+ if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+- &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple))
++ &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple) &&
++ nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL))
+ continue;
+
+ NF_CT_STAT_INC_ATOMIC(net, found);
+--
+2.27.0
+
--- /dev/null
+From 18ddabbe52e56d5371ad5e880a34053b84d34b94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 18:01:16 +0100
+Subject: netfilter: flowtable: fix tcp and udp header checksum update
+
+From: Sven Auhagen <sven.auhagen@voleatech.de>
+
+[ Upstream commit 8d6bca156e47d68551750a384b3ff49384c67be3 ]
+
+When updating the tcp or udp header checksum on port nat the function
+inet_proto_csum_replace2 with the last parameter pseudohdr as true.
+This leads to an error in the case that GRO is used and packets are
+split up in GSO. The tcp or udp checksum of all packets is incorrect.
+
+The error is probably masked due to the fact the most network driver
+implement tcp/udp checksum offloading. It also only happens when GRO is
+applied and not on single packets.
+
+The error is most visible when using a pppoe connection which is not
+triggering the tcp/udp checksum offload.
+
+Fixes: ac2a66665e23 ("netfilter: add generic flow table infrastructure")
+Signed-off-by: Sven Auhagen <sven.auhagen@voleatech.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_flow_table_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index 128245efe84ab..e05e5df803d68 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -354,7 +354,7 @@ static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff,
+ return -1;
+
+ tcph = (void *)(skb_network_header(skb) + thoff);
+- inet_proto_csum_replace2(&tcph->check, skb, port, new_port, true);
++ inet_proto_csum_replace2(&tcph->check, skb, port, new_port, false);
+
+ return 0;
+ }
+@@ -371,7 +371,7 @@ static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff,
+ udph = (void *)(skb_network_header(skb) + thoff);
+ if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
+ inet_proto_csum_replace2(&udph->check, skb, port,
+- new_port, true);
++ new_port, false);
+ if (!udph->check)
+ udph->check = CSUM_MANGLED_0;
+ }
+--
+2.27.0
+
--- /dev/null
+From cabae139e8ddcab6990bac5a67bda554170882f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 16:07:37 +0100
+Subject: netfilter: nftables: fix possible UAF over chains from packet path in
+ netns
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 767d1216bff82507c945e92fe719dff2083bb2f4 ]
+
+Although hooks are released via call_rcu(), chain and rule objects are
+immediately released while packets are still walking over these bits.
+
+This patch adds the .pre_exit callback which is invoked before
+synchronize_rcu() in the netns framework to stay safe.
+
+Remove a comment which is not valid anymore since the core does not use
+synchronize_net() anymore since 8c873e219970 ("netfilter: core: free
+hooks with call_rcu").
+
+Suggested-by: Florian Westphal <fw@strlen.de>
+Fixes: df05ef874b28 ("netfilter: nf_tables: release objects on netns destruction")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 40216c2a7dd72..373ea0e49f12d 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -7696,6 +7696,17 @@ int __nft_release_basechain(struct nft_ctx *ctx)
+ }
+ EXPORT_SYMBOL_GPL(__nft_release_basechain);
+
++static void __nft_release_hooks(struct net *net)
++{
++ struct nft_table *table;
++ struct nft_chain *chain;
++
++ list_for_each_entry(table, &net->nft.tables, list) {
++ list_for_each_entry(chain, &table->chains, list)
++ nf_tables_unregister_hook(net, table, chain);
++ }
++}
++
+ static void __nft_release_tables(struct net *net)
+ {
+ struct nft_flowtable *flowtable, *nf;
+@@ -7711,10 +7722,6 @@ static void __nft_release_tables(struct net *net)
+
+ list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
+ ctx.family = table->family;
+-
+- list_for_each_entry(chain, &table->chains, list)
+- nf_tables_unregister_hook(net, table, chain);
+- /* No packets are walking on these chains anymore. */
+ ctx.table = table;
+ list_for_each_entry(chain, &table->chains, list) {
+ ctx.chain = chain;
+@@ -7762,6 +7769,11 @@ static int __net_init nf_tables_init_net(struct net *net)
+ return 0;
+ }
+
++static void __net_exit nf_tables_pre_exit_net(struct net *net)
++{
++ __nft_release_hooks(net);
++}
++
+ static void __net_exit nf_tables_exit_net(struct net *net)
+ {
+ mutex_lock(&net->nft.commit_mutex);
+@@ -7774,8 +7786,9 @@ static void __net_exit nf_tables_exit_net(struct net *net)
+ }
+
+ static struct pernet_operations nf_tables_net_ops = {
+- .init = nf_tables_init_net,
+- .exit = nf_tables_exit_net,
++ .init = nf_tables_init_net,
++ .pre_exit = nf_tables_pre_exit_net,
++ .exit = nf_tables_exit_net,
+ };
+
+ static int __init nf_tables_module_init(void)
+--
+2.27.0
+
--- /dev/null
+From 515dedf6ce8007ecd23c173f50be2a63679b37f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 20:57:43 +0100
+Subject: netfilter: xt_recent: Fix attempt to update deleted entry
+
+From: Jozsef Kadlecsik <kadlec@mail.kfki.hu>
+
+[ Upstream commit b1bdde33b72366da20d10770ab7a49fe87b5e190 ]
+
+When both --reap and --update flag are specified, there's a code
+path at which the entry to be updated is reaped beforehand,
+which then leads to kernel crash. Reap only entries which won't be
+updated.
+
+Fixes kernel bugzilla #207773.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=207773
+Reported-by: Reindl Harald <h.reindl@thelounge.net>
+Fixes: 0079c5aee348 ("netfilter: xt_recent: add an entry reaper")
+Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/xt_recent.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
+index 6c2582a197667..3469b60736103 100644
+--- a/net/netfilter/xt_recent.c
++++ b/net/netfilter/xt_recent.c
+@@ -152,7 +152,8 @@ static void recent_entry_remove(struct recent_table *t, struct recent_entry *e)
+ /*
+ * Drop entries with timestamps older then 'time'.
+ */
+-static void recent_entry_reap(struct recent_table *t, unsigned long time)
++static void recent_entry_reap(struct recent_table *t, unsigned long time,
++ struct recent_entry *working, bool update)
+ {
+ struct recent_entry *e;
+
+@@ -161,6 +162,12 @@ static void recent_entry_reap(struct recent_table *t, unsigned long time)
+ */
+ e = list_entry(t->lru_list.next, struct recent_entry, lru_list);
+
++ /*
++ * Do not reap the entry which are going to be updated.
++ */
++ if (e == working && update)
++ return;
++
+ /*
+ * The last time stamp is the most recent.
+ */
+@@ -303,7 +310,8 @@ recent_mt(const struct sk_buff *skb, struct xt_action_param *par)
+
+ /* info->seconds must be non-zero */
+ if (info->check_set & XT_RECENT_REAP)
+- recent_entry_reap(t, time);
++ recent_entry_reap(t, time, e,
++ info->check_set & XT_RECENT_UPDATE && ret);
+ }
+
+ if (info->check_set & XT_RECENT_SET ||
+--
+2.27.0
+
--- /dev/null
+From 2cfea6f022e54e5eb404c635ee946fd47121327a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 20:50:34 +0300
+Subject: selftests: txtimestamp: fix compilation issue
+
+From: Vadim Fedorenko <vfedorenko@novek.ru>
+
+[ Upstream commit 647b8dd5184665432cc8a2b5bca46a201f690c37 ]
+
+PACKET_TX_TIMESTAMP is defined in if_packet.h but it is not included in
+test. Include it instead of <netpacket/packet.h> otherwise the error of
+redefinition arrives.
+Also fix the compiler warning about ambiguous control flow by adding
+explicit braces.
+
+Fixes: 8fe2f761cae9 ("net-timestamp: expand documentation")
+Suggested-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
+Signed-off-by: Vadim Fedorenko <vfedorenko@novek.ru>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Link: https://lore.kernel.org/r/1612461034-24524-1-git-send-email-vfedorenko@novek.ru
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testing/selftests/networking/timestamping/txtimestamp.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/networking/timestamping/txtimestamp.c b/tools/testing/selftests/networking/timestamping/txtimestamp.c
+index 7e386be471201..2fce2e8f47f55 100644
+--- a/tools/testing/selftests/networking/timestamping/txtimestamp.c
++++ b/tools/testing/selftests/networking/timestamping/txtimestamp.c
+@@ -26,6 +26,7 @@
+ #include <inttypes.h>
+ #include <linux/errqueue.h>
+ #include <linux/if_ether.h>
++#include <linux/if_packet.h>
+ #include <linux/ipv6.h>
+ #include <linux/net_tstamp.h>
+ #include <netdb.h>
+@@ -34,7 +35,6 @@
+ #include <netinet/ip.h>
+ #include <netinet/udp.h>
+ #include <netinet/tcp.h>
+-#include <netpacket/packet.h>
+ #include <poll.h>
+ #include <stdarg.h>
+ #include <stdbool.h>
+@@ -396,12 +396,12 @@ static void do_test(int family, unsigned int report_opt)
+ total_len = cfg_payload_len;
+ if (cfg_use_pf_packet || cfg_proto == SOCK_RAW) {
+ total_len += sizeof(struct udphdr);
+- if (cfg_use_pf_packet || cfg_ipproto == IPPROTO_RAW)
++ if (cfg_use_pf_packet || cfg_ipproto == IPPROTO_RAW) {
+ if (family == PF_INET)
+ total_len += sizeof(struct iphdr);
+ else
+ total_len += sizeof(struct ipv6hdr);
+-
++ }
+ /* special case, only rawv6_sendmsg:
+ * pass proto in sin6_port if not connected
+ * also see ANK comment in net/ipv4/raw.c
+--
+2.27.0
+
arm-kexec-fix-oops-after-tlb-are-invalidated.patch
vmlinux.lds.h-create-section-for-protection-against-.patch
lkdtm-don-t-move-ctors-to-.rodata.patch
+cgroup-v1-add-disabled-controller-check-in-cgroup1_p.patch
+mt76-dma-fix-a-possible-memory-leak-in-mt76_add_frag.patch
+drm-vc4-hvs-fix-buffer-overflow-with-the-dlist-handl.patch
+bpf-check-for-integer-overflow-when-using-roundup_po.patch
+netfilter-xt_recent-fix-attempt-to-update-deleted-en.patch
+netfilter-nftables-fix-possible-uaf-over-chains-from.patch
+netfilter-flowtable-fix-tcp-and-udp-header-checksum-.patch
+xen-netback-avoid-race-in-xenvif_rx_ring_slots_avail.patch
+net-enetc-initialize-the-rfs-and-rss-memories.patch
+selftests-txtimestamp-fix-compilation-issue.patch
+net-stmmac-set-txq-mode-back-to-dcb-after-disabling-.patch
+ibmvnic-clear-failover_pending-if-unable-to-schedule.patch
+netfilter-conntrack-skip-identical-origin-tuple-in-s.patch
+x86-build-disable-cet-instrumentation-in-the-kernel-.patch
+net-hns3-add-a-check-for-queue_id-in-hclge_reset_vf_.patch
+firmware_loader-align-.builtin_fw-to-8.patch
+drm-sun4i-tcon-set-sync-polarity-for-tcon1-channel.patch
+drm-sun4i-fix-h6-hdmi-phy-configuration.patch
+drm-sun4i-dw-hdmi-fix-max.-frequency-for-h6.patch
+clk-sunxi-ng-mp-fix-parent-rate-change-flag-check.patch
+i2c-stm32f7-fix-configuration-of-the-digital-filter.patch
+h8300-fix-preemption-build-ti_pre_count-undefined.patch
--- /dev/null
+From e578a500b345d8643d0f31cd03e57b19a1dd6f3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 16:43:30 +0100
+Subject: x86/build: Disable CET instrumentation in the kernel for 32-bit too
+
+From: Borislav Petkov <bp@suse.de>
+
+[ Upstream commit 256b92af784d5043eeb7d559b6d5963dcc2ecb10 ]
+
+Commit
+
+ 20bf2b378729 ("x86/build: Disable CET instrumentation in the kernel")
+
+disabled CET instrumentation which gets added by default by the Ubuntu
+gcc9 and 10 by default, but did that only for 64-bit builds. It would
+still fail when building a 32-bit target. So disable CET for all x86
+builds.
+
+Fixes: 20bf2b378729 ("x86/build: Disable CET instrumentation in the kernel")
+Reported-by: AC <achirvasub@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Tested-by: AC <achirvasub@gmail.com>
+Link: https://lkml.kernel.org/r/YCCIgMHkzh/xT4ex@arch-chirva.localdomain
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Makefile | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index b5e3bfd4facea..8ca3cf7c5ec97 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -61,6 +61,9 @@ endif
+ KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow
+ KBUILD_CFLAGS += $(call cc-option,-mno-avx,)
+
++# Intel CET isn't enabled in the kernel
++KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
++
+ ifeq ($(CONFIG_X86_32),y)
+ BITS := 32
+ UTS_MACHINE := i386
+@@ -131,9 +134,6 @@ else
+
+ KBUILD_CFLAGS += -mno-red-zone
+ KBUILD_CFLAGS += -mcmodel=kernel
+-
+- # Intel CET isn't enabled in the kernel
+- KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
+ endif
+
+ ifdef CONFIG_X86_X32
+--
+2.27.0
+
--- /dev/null
+From fd21f43d70d5336aa59774b2df23b743dd8b7a1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 08:09:38 +0100
+Subject: xen/netback: avoid race in xenvif_rx_ring_slots_available()
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit ec7d8e7dd3a59528e305a18e93f1cb98f7faf83b ]
+
+Since commit 23025393dbeb3b8b3 ("xen/netback: use lateeoi irq binding")
+xenvif_rx_ring_slots_available() is no longer called only from the rx
+queue kernel thread, so it needs to access the rx queue with the
+associated queue held.
+
+Reported-by: Igor Druzhinin <igor.druzhinin@citrix.com>
+Fixes: 23025393dbeb3b8b3 ("xen/netback: use lateeoi irq binding")
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Acked-by: Wei Liu <wl@xen.org>
+Link: https://lore.kernel.org/r/20210202070938.7863-1-jgross@suse.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/xen-netback/rx.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c
+index 9b62f65b630e4..48e2006f96ce6 100644
+--- a/drivers/net/xen-netback/rx.c
++++ b/drivers/net/xen-netback/rx.c
+@@ -38,10 +38,15 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
+ RING_IDX prod, cons;
+ struct sk_buff *skb;
+ int needed;
++ unsigned long flags;
++
++ spin_lock_irqsave(&queue->rx_queue.lock, flags);
+
+ skb = skb_peek(&queue->rx_queue);
+- if (!skb)
++ if (!skb) {
++ spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
+ return false;
++ }
+
+ needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE);
+ if (skb_is_gso(skb))
+@@ -49,6 +54,8 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
+ if (skb->sw_hash)
+ needed++;
+
++ spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
++
+ do {
+ prod = queue->rx.sring->req_prod;
+ cons = queue->rx.req_cons;
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
