--- /dev/null
+From bb49c6fa8b845591b317b0d7afea4ae60ec7f3aa Mon Sep 17 00:00:00 2001
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Fri, 11 Feb 2022 10:01:36 +0100
+Subject: block: clear iocb->private in blkdev_bio_end_io_async()
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+commit bb49c6fa8b845591b317b0d7afea4ae60ec7f3aa upstream.
+
+iocb_bio_iopoll() expects iocb->private to be cleared before
+releasing the bio.
+
+We already do this in blkdev_bio_end_io(), but we forgot in the
+recently added blkdev_bio_end_io_async().
+
+Fixes: 54a88eb838d3 ("block: add single bio async direct IO helper")
+Cc: asml.silence@gmail.com
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20220211090136.44471-1-sgarzare@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/fops.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/block/fops.c
++++ b/block/fops.c
+@@ -289,6 +289,8 @@ static void blkdev_bio_end_io_async(stru
+ struct kiocb *iocb = dio->iocb;
+ ssize_t ret;
+
++ WRITE_ONCE(iocb->private, NULL);
++
+ if (likely(!bio->bi_status)) {
+ ret = dio->size;
+ iocb->ki_pos += ret;
--- /dev/null
+From e13ad1443684f7afaff24cf207e85e97885256bd Mon Sep 17 00:00:00 2001
+From: Manish Chopra <manishc@marvell.com>
+Date: Wed, 23 Feb 2022 00:57:20 -0800
+Subject: bnx2x: fix driver load from initrd
+
+From: Manish Chopra <manishc@marvell.com>
+
+commit e13ad1443684f7afaff24cf207e85e97885256bd upstream.
+
+Commit b7a49f73059f ("bnx2x: Utilize firmware 7.13.21.0") added
+new firmware support in the driver with maintaining older firmware
+compatibility. However, older firmware was not added in MODULE_FIRMWARE()
+which caused missing firmware files in initrd image leading to driver load
+failure from initrd. This patch adds MODULE_FIRMWARE() for older firmware
+version to have firmware files included in initrd.
+
+Fixes: b7a49f73059f ("bnx2x: Utilize firmware 7.13.21.0")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=215627
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Alok Prasad <palok@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Link: https://lore.kernel.org/r/20220223085720.12021-1-manishc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -100,6 +100,9 @@ MODULE_LICENSE("GPL");
+ MODULE_FIRMWARE(FW_FILE_NAME_E1);
+ MODULE_FIRMWARE(FW_FILE_NAME_E1H);
+ MODULE_FIRMWARE(FW_FILE_NAME_E2);
++MODULE_FIRMWARE(FW_FILE_NAME_E1_V15);
++MODULE_FIRMWARE(FW_FILE_NAME_E1H_V15);
++MODULE_FIRMWARE(FW_FILE_NAME_E2_V15);
+
+ int bnx2x_num_queues;
+ module_param_named(num_queues, bnx2x_num_queues, int, 0444);
--- /dev/null
+From 84d3c83e6ea7d46cf3de3a54578af73eb24a64f2 Mon Sep 17 00:00:00 2001
+From: Somnath Kotur <somnath.kotur@broadcom.com>
+Date: Sun, 20 Feb 2022 04:05:47 -0500
+Subject: bnxt_en: Fix active FEC reporting to ethtool
+
+From: Somnath Kotur <somnath.kotur@broadcom.com>
+
+commit 84d3c83e6ea7d46cf3de3a54578af73eb24a64f2 upstream.
+
+ethtool --show-fec <interface> does not show anything when the Active
+FEC setting in the chip is set to None. Fix it to properly return
+ETHTOOL_FEC_OFF in that case.
+
+Fixes: 8b2775890ad8 ("bnxt_en: Report FEC settings to ethtool.")
+Signed-off-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1944,6 +1944,9 @@ static int bnxt_get_fecparam(struct net_
+ case PORT_PHY_QCFG_RESP_ACTIVE_FEC_FEC_RS272_IEEE_ACTIVE:
+ fec->active_fec |= ETHTOOL_FEC_LLRS;
+ break;
++ case PORT_PHY_QCFG_RESP_ACTIVE_FEC_FEC_NONE_ACTIVE:
++ fec->active_fec |= ETHTOOL_FEC_OFF;
++ break;
+ }
+ return 0;
+ }
--- /dev/null
+From 1278d17a1fb860e7eab4bc3ff4b026a87cbf5105 Mon Sep 17 00:00:00 2001
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Date: Sun, 20 Feb 2022 04:05:53 -0500
+Subject: bnxt_en: Fix devlink fw_activate
+
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+
+commit 1278d17a1fb860e7eab4bc3ff4b026a87cbf5105 upstream.
+
+To install a livepatch, first flash the package to NVM, and then
+activate the patch through the "HWRM_FW_LIVEPATCH" fw command.
+To uninstall a patch from NVM, flash the removal package and then
+activate it through the "HWRM_FW_LIVEPATCH" fw command.
+
+The "HWRM_FW_LIVEPATCH" fw command has to consider following scenarios:
+
+1. no patch in NVM and no patch active. Do nothing.
+2. patch in NVM, but not active. Activate the patch currently in NVM.
+3. patch is not in NVM, but active. Deactivate the patch.
+4. patch in NVM and the patch active. Do nothing.
+
+Fix the code to handle these scenarios during devlink "fw_activate".
+
+To install and activate a live patch:
+devlink dev flash pci/0000:c1:00.0 file thor_patch.pkg
+devlink -f dev reload pci/0000:c1:00.0 action fw_activate limit no_reset
+
+To remove and deactivate a live patch:
+devlink dev flash pci/0000:c1:00.0 file thor_patch_rem.pkg
+devlink -f dev reload pci/0000:c1:00.0 action fw_activate limit no_reset
+
+Fixes: 3c4153394e2c ("bnxt_en: implement firmware live patching")
+Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com>
+Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 39 +++++++++++++++++-----
+ 1 file changed, 31 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+@@ -366,6 +366,16 @@ bnxt_dl_livepatch_report_err(struct bnxt
+ }
+ }
+
++/* Live patch status in NVM */
++#define BNXT_LIVEPATCH_NOT_INSTALLED 0
++#define BNXT_LIVEPATCH_INSTALLED FW_LIVEPATCH_QUERY_RESP_STATUS_FLAGS_INSTALL
++#define BNXT_LIVEPATCH_REMOVED FW_LIVEPATCH_QUERY_RESP_STATUS_FLAGS_ACTIVE
++#define BNXT_LIVEPATCH_MASK (FW_LIVEPATCH_QUERY_RESP_STATUS_FLAGS_INSTALL | \
++ FW_LIVEPATCH_QUERY_RESP_STATUS_FLAGS_ACTIVE)
++#define BNXT_LIVEPATCH_ACTIVATED BNXT_LIVEPATCH_MASK
++
++#define BNXT_LIVEPATCH_STATE(flags) ((flags) & BNXT_LIVEPATCH_MASK)
++
+ static int
+ bnxt_dl_livepatch_activate(struct bnxt *bp, struct netlink_ext_ack *extack)
+ {
+@@ -373,8 +383,9 @@ bnxt_dl_livepatch_activate(struct bnxt *
+ struct hwrm_fw_livepatch_query_input *query_req;
+ struct hwrm_fw_livepatch_output *patch_resp;
+ struct hwrm_fw_livepatch_input *patch_req;
++ u16 flags, live_patch_state;
++ bool activated = false;
+ u32 installed = 0;
+- u16 flags;
+ u8 target;
+ int rc;
+
+@@ -393,7 +404,6 @@ bnxt_dl_livepatch_activate(struct bnxt *
+ hwrm_req_drop(bp, query_req);
+ return rc;
+ }
+- patch_req->opcode = FW_LIVEPATCH_REQ_OPCODE_ACTIVATE;
+ patch_req->loadtype = FW_LIVEPATCH_REQ_LOADTYPE_NVM_INSTALL;
+ patch_resp = hwrm_req_hold(bp, patch_req);
+
+@@ -406,12 +416,20 @@ bnxt_dl_livepatch_activate(struct bnxt *
+ }
+
+ flags = le16_to_cpu(query_resp->status_flags);
+- if (~flags & FW_LIVEPATCH_QUERY_RESP_STATUS_FLAGS_INSTALL)
++ live_patch_state = BNXT_LIVEPATCH_STATE(flags);
++
++ if (live_patch_state == BNXT_LIVEPATCH_NOT_INSTALLED)
+ continue;
+- if ((flags & FW_LIVEPATCH_QUERY_RESP_STATUS_FLAGS_ACTIVE) &&
+- !strncmp(query_resp->active_ver, query_resp->install_ver,
+- sizeof(query_resp->active_ver)))
++
++ if (live_patch_state == BNXT_LIVEPATCH_ACTIVATED) {
++ activated = true;
+ continue;
++ }
++
++ if (live_patch_state == BNXT_LIVEPATCH_INSTALLED)
++ patch_req->opcode = FW_LIVEPATCH_REQ_OPCODE_ACTIVATE;
++ else if (live_patch_state == BNXT_LIVEPATCH_REMOVED)
++ patch_req->opcode = FW_LIVEPATCH_REQ_OPCODE_DEACTIVATE;
+
+ patch_req->fw_target = target;
+ rc = hwrm_req_send(bp, patch_req);
+@@ -423,8 +441,13 @@ bnxt_dl_livepatch_activate(struct bnxt *
+ }
+
+ if (!rc && !installed) {
+- NL_SET_ERR_MSG_MOD(extack, "No live patches found");
+- rc = -ENOENT;
++ if (activated) {
++ NL_SET_ERR_MSG_MOD(extack, "Live patch already activated");
++ rc = -EEXIST;
++ } else {
++ NL_SET_ERR_MSG_MOD(extack, "No live patches found");
++ rc = -ENOENT;
++ }
+ }
+ hwrm_req_drop(bp, query_req);
+ hwrm_req_drop(bp, patch_req);
--- /dev/null
+From 8cdb15924252e27af16c4a8fe0fc606ce5fd04dc Mon Sep 17 00:00:00 2001
+From: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Date: Sun, 20 Feb 2022 04:05:50 -0500
+Subject: bnxt_en: Fix incorrect multicast rx mask setting when not requested
+
+From: Pavan Chebbi <pavan.chebbi@broadcom.com>
+
+commit 8cdb15924252e27af16c4a8fe0fc606ce5fd04dc upstream.
+
+We should setup multicast only when net_device flags explicitly
+has IFF_MULTICAST set. Otherwise we will incorrectly turn it on
+even when not asked. Fix it by only passing the multicast table
+to the firmware if IFF_MULTICAST is set.
+
+Fixes: 7d2837dd7a32 ("bnxt_en: Setup multicast properly after resetting device.")
+Signed-off-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -4719,8 +4719,10 @@ static int bnxt_hwrm_cfa_l2_set_rx_mask(
+ return rc;
+
+ req->vnic_id = cpu_to_le32(vnic->fw_vnic_id);
+- req->num_mc_entries = cpu_to_le32(vnic->mc_list_count);
+- req->mc_tbl_addr = cpu_to_le64(vnic->mc_list_mapping);
++ if (vnic->rx_mask & CFA_L2_SET_RX_MASK_REQ_MASK_MCAST) {
++ req->num_mc_entries = cpu_to_le32(vnic->mc_list_count);
++ req->mc_tbl_addr = cpu_to_le64(vnic->mc_list_mapping);
++ }
+ req->mask = cpu_to_le32(vnic->rx_mask);
+ return hwrm_req_send_silent(bp, req);
+ }
+@@ -8635,7 +8637,7 @@ static int bnxt_init_chip(struct bnxt *b
+ if (bp->dev->flags & IFF_ALLMULTI) {
+ vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST;
+ vnic->mc_list_count = 0;
+- } else {
++ } else if (bp->dev->flags & IFF_MULTICAST) {
+ u32 mask = 0;
+
+ bnxt_mc_list_updated(bp, &mask);
+@@ -10759,7 +10761,7 @@ static void bnxt_set_rx_mode(struct net_
+ if (dev->flags & IFF_ALLMULTI) {
+ mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST;
+ vnic->mc_list_count = 0;
+- } else {
++ } else if (dev->flags & IFF_MULTICAST) {
+ mc_update = bnxt_mc_list_updated(bp, &mask);
+ }
+
+@@ -10827,9 +10829,10 @@ skip_uc:
+ !bnxt_promisc_ok(bp))
+ vnic->rx_mask &= ~CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS;
+ rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0);
+- if (rc && vnic->mc_list_count) {
++ if (rc && (vnic->rx_mask & CFA_L2_SET_RX_MASK_REQ_MASK_MCAST)) {
+ netdev_info(bp->dev, "Failed setting MC filters rc: %d, turning on ALL_MCAST mode\n",
+ rc);
++ vnic->rx_mask &= ~CFA_L2_SET_RX_MASK_REQ_MASK_MCAST;
+ vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST;
+ vnic->mc_list_count = 0;
+ rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0);
--- /dev/null
+From cfcab3b3b61584a02bb523ffa99564eafa761dfe Mon Sep 17 00:00:00 2001
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Sun, 20 Feb 2022 04:05:49 -0500
+Subject: bnxt_en: Fix occasional ethtool -t loopback test failures
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+commit cfcab3b3b61584a02bb523ffa99564eafa761dfe upstream.
+
+In the current code, we setup the port to PHY or MAC loopback mode
+and then transmit a test broadcast packet for the loopback test. This
+scheme fails sometime if the port is shared with management firmware
+that can also send packets. The driver may receive the management
+firmware's packet and the test will fail when the contents don't
+match the test packet.
+
+Change the test packet to use it's own MAC address as the destination
+and setup the port to only receive it's own MAC address. This should
+filter out other packets sent by management firmware.
+
+Fixes: 91725d89b97a ("bnxt_en: Add PHY loopback to ethtool self-test.")
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 7 +++++++
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 +
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +-
+ 3 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8623,6 +8623,9 @@ static int bnxt_init_chip(struct bnxt *b
+ vnic->uc_filter_count = 1;
+
+ vnic->rx_mask = 0;
++ if (test_bit(BNXT_STATE_HALF_OPEN, &bp->state))
++ goto skip_rx_mask;
++
+ if (bp->dev->flags & IFF_BROADCAST)
+ vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_BCAST;
+
+@@ -8643,6 +8646,7 @@ static int bnxt_init_chip(struct bnxt *b
+ if (rc)
+ goto err_out;
+
++skip_rx_mask:
+ rc = bnxt_hwrm_set_coal(bp);
+ if (rc)
+ netdev_warn(bp->dev, "HWRM set coalescing failure rc: %x\n",
+@@ -10315,8 +10319,10 @@ int bnxt_half_open_nic(struct bnxt *bp)
+ netdev_err(bp->dev, "bnxt_alloc_mem err: %x\n", rc);
+ goto half_open_err;
+ }
++ set_bit(BNXT_STATE_HALF_OPEN, &bp->state);
+ rc = bnxt_init_nic(bp, true);
+ if (rc) {
++ clear_bit(BNXT_STATE_HALF_OPEN, &bp->state);
+ netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc);
+ goto half_open_err;
+ }
+@@ -10337,6 +10343,7 @@ void bnxt_half_close_nic(struct bnxt *bp
+ bnxt_hwrm_resource_free(bp, false, true);
+ bnxt_free_skbs(bp);
+ bnxt_free_mem(bp, true);
++ clear_bit(BNXT_STATE_HALF_OPEN, &bp->state);
+ }
+
+ void bnxt_reenable_sriov(struct bnxt *bp)
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1919,6 +1919,7 @@ struct bnxt {
+ #define BNXT_STATE_RECOVER 12
+ #define BNXT_STATE_FW_NON_FATAL_COND 13
+ #define BNXT_STATE_FW_ACTIVATE_RESET 14
++#define BNXT_STATE_HALF_OPEN 15 /* For offline ethtool tests */
+
+ #define BNXT_NO_FW_ACCESS(bp) \
+ (test_bit(BNXT_STATE_FW_FATAL_COND, &(bp)->state) || \
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -3433,7 +3433,7 @@ static int bnxt_run_loopback(struct bnxt
+ if (!skb)
+ return -ENOMEM;
+ data = skb_put(skb, pkt_size);
+- eth_broadcast_addr(data);
++ ether_addr_copy(&data[i], bp->dev->dev_addr);
+ i += ETH_ALEN;
+ ether_addr_copy(&data[i], bp->dev->dev_addr);
+ i += ETH_ALEN;
--- /dev/null
+From 6758f937669dba14c6aac7ca004edda42ec1b18d Mon Sep 17 00:00:00 2001
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Sun, 20 Feb 2022 04:05:48 -0500
+Subject: bnxt_en: Fix offline ethtool selftest with RDMA enabled
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+commit 6758f937669dba14c6aac7ca004edda42ec1b18d upstream.
+
+For offline (destructive) self tests, we need to stop the RDMA driver
+first. Otherwise, the RDMA driver will run into unrecoverable errors
+when destructive firmware tests are being performed.
+
+The irq_re_init parameter used in the half close and half open
+sequence when preparing the NIC for offline tests should be set to
+true because the RDMA driver will free all IRQs before the offline
+tests begin.
+
+Fixes: 55fd0cf320c3 ("bnxt_en: Add external loopback test to ethtool selftest.")
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Reviewed-by: Ben Li <ben.li@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++-----
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 12 +++++++++---
+ 2 files changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -10310,12 +10310,12 @@ int bnxt_half_open_nic(struct bnxt *bp)
+ goto half_open_err;
+ }
+
+- rc = bnxt_alloc_mem(bp, false);
++ rc = bnxt_alloc_mem(bp, true);
+ if (rc) {
+ netdev_err(bp->dev, "bnxt_alloc_mem err: %x\n", rc);
+ goto half_open_err;
+ }
+- rc = bnxt_init_nic(bp, false);
++ rc = bnxt_init_nic(bp, true);
+ if (rc) {
+ netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc);
+ goto half_open_err;
+@@ -10324,7 +10324,7 @@ int bnxt_half_open_nic(struct bnxt *bp)
+
+ half_open_err:
+ bnxt_free_skbs(bp);
+- bnxt_free_mem(bp, false);
++ bnxt_free_mem(bp, true);
+ dev_close(bp->dev);
+ return rc;
+ }
+@@ -10334,9 +10334,9 @@ half_open_err:
+ */
+ void bnxt_half_close_nic(struct bnxt *bp)
+ {
+- bnxt_hwrm_resource_free(bp, false, false);
++ bnxt_hwrm_resource_free(bp, false, true);
+ bnxt_free_skbs(bp);
+- bnxt_free_mem(bp, false);
++ bnxt_free_mem(bp, true);
+ }
+
+ void bnxt_reenable_sriov(struct bnxt *bp)
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -25,6 +25,7 @@
+ #include "bnxt_hsi.h"
+ #include "bnxt.h"
+ #include "bnxt_hwrm.h"
++#include "bnxt_ulp.h"
+ #include "bnxt_xdp.h"
+ #include "bnxt_ptp.h"
+ #include "bnxt_ethtool.h"
+@@ -3526,9 +3527,12 @@ static void bnxt_self_test(struct net_de
+ if (!offline) {
+ bnxt_run_fw_tests(bp, test_mask, &test_results);
+ } else {
+- rc = bnxt_close_nic(bp, false, false);
+- if (rc)
++ bnxt_ulp_stop(bp);
++ rc = bnxt_close_nic(bp, true, false);
++ if (rc) {
++ bnxt_ulp_start(bp, rc);
+ return;
++ }
+ bnxt_run_fw_tests(bp, test_mask, &test_results);
+
+ buf[BNXT_MACLPBK_TEST_IDX] = 1;
+@@ -3538,6 +3542,7 @@ static void bnxt_self_test(struct net_de
+ if (rc) {
+ bnxt_hwrm_mac_loopback(bp, false);
+ etest->flags |= ETH_TEST_FL_FAILED;
++ bnxt_ulp_start(bp, rc);
+ return;
+ }
+ if (bnxt_run_loopback(bp))
+@@ -3563,7 +3568,8 @@ static void bnxt_self_test(struct net_de
+ }
+ bnxt_hwrm_phy_loopback(bp, false, false);
+ bnxt_half_close_nic(bp);
+- rc = bnxt_open_nic(bp, false, true);
++ rc = bnxt_open_nic(bp, true, true);
++ bnxt_ulp_start(bp, rc);
+ }
+ if (rc || bnxt_test_irq(bp)) {
+ buf[BNXT_IRQ_TEST_IDX] = 1;
--- /dev/null
+From 0e0e3c5358470cbad10bd7ca29f84a44d179d286 Mon Sep 17 00:00:00 2001
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Date: Sun, 20 Feb 2022 04:05:51 -0500
+Subject: bnxt_en: Restore the resets_reliable flag in bnxt_open()
+
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+
+commit 0e0e3c5358470cbad10bd7ca29f84a44d179d286 upstream.
+
+During ifdown, we call bnxt_inv_fw_health_reg() which will clear
+both the status_reliable and resets_reliable flags if these
+registers are mapped. This is correct because a FW reset during
+ifdown will clear these register mappings. If we detect that FW
+has gone through reset during the next ifup, we will remap these
+registers.
+
+But during normal ifup with no FW reset, we need to restore the
+resets_reliable flag otherwise we will not show the reset counter
+during devlink diagnose.
+
+Fixes: 8cc95ceb7087 ("bnxt_en: improve fw diagnose devlink health messages")
+Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -7776,6 +7776,19 @@ static int bnxt_map_fw_health_regs(struc
+ return 0;
+ }
+
++static void bnxt_remap_fw_health_regs(struct bnxt *bp)
++{
++ if (!bp->fw_health)
++ return;
++
++ if (bp->fw_cap & BNXT_FW_CAP_ERROR_RECOVERY) {
++ bp->fw_health->status_reliable = true;
++ bp->fw_health->resets_reliable = true;
++ } else {
++ bnxt_try_map_fw_health_reg(bp);
++ }
++}
++
+ static int bnxt_hwrm_error_recovery_qcfg(struct bnxt *bp)
+ {
+ struct bnxt_fw_health *fw_health = bp->fw_health;
+@@ -9836,8 +9849,8 @@ static int bnxt_hwrm_if_change(struct bn
+ resc_reinit = true;
+ if (flags & FUNC_DRV_IF_CHANGE_RESP_FLAGS_HOT_FW_RESET_DONE)
+ fw_reset = true;
+- else if (bp->fw_health && !bp->fw_health->status_reliable)
+- bnxt_try_map_fw_health_reg(bp);
++ else
++ bnxt_remap_fw_health_regs(bp);
+
+ if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state) && !fw_reset) {
+ netdev_err(bp->dev, "RESET_DONE not set during FW reset.\n");
--- /dev/null
+From 75134f16e7dd0007aa474b281935c5f42e79f2c8 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 17 Feb 2022 10:19:02 -0800
+Subject: bpf: Add schedule points in batch ops
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 75134f16e7dd0007aa474b281935c5f42e79f2c8 upstream.
+
+syzbot reported various soft lockups caused by bpf batch operations.
+
+ INFO: task kworker/1:1:27 blocked for more than 140 seconds.
+ INFO: task hung in rcu_barrier
+
+Nothing prevents batch ops to process huge amount of data,
+we need to add schedule points in them.
+
+Note that maybe_wait_bpf_programs(map) calls from
+generic_map_delete_batch() can be factorized by moving
+the call after the loop.
+
+This will be done later in -next tree once we get this fix merged,
+unless there is strong opinion doing this optimization sooner.
+
+Fixes: aa2e93b8e58e ("bpf: Add generic support for update and delete batch ops")
+Fixes: cb4d03ab499d ("bpf: Add generic support for lookup batch op")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Reviewed-by: Stanislav Fomichev <sdf@google.com>
+Acked-by: Brian Vazquez <brianvv@google.com>
+Link: https://lore.kernel.org/bpf/20220217181902.808742-1-eric.dumazet@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/syscall.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1354,6 +1354,7 @@ int generic_map_delete_batch(struct bpf_
+ maybe_wait_bpf_programs(map);
+ if (err)
+ break;
++ cond_resched();
+ }
+ if (copy_to_user(&uattr->batch.count, &cp, sizeof(cp)))
+ err = -EFAULT;
+@@ -1411,6 +1412,7 @@ int generic_map_update_batch(struct bpf_
+
+ if (err)
+ break;
++ cond_resched();
+ }
+
+ if (copy_to_user(&uattr->batch.count, &cp, sizeof(cp)))
+@@ -1508,6 +1510,7 @@ int generic_map_lookup_batch(struct bpf_
+ swap(prev_key, key);
+ retry = MAP_LOOKUP_RETRIES;
+ cp++;
++ cond_resched();
+ }
+
+ if (err == -EFAULT)
--- /dev/null
+From 4a11678f683814df82fca9018d964771e02d7e6d Mon Sep 17 00:00:00 2001
+From: Felix Maurer <fmaurer@redhat.com>
+Date: Wed, 9 Feb 2022 16:55:26 +0100
+Subject: bpf: Do not try bpf_msg_push_data with len 0
+
+From: Felix Maurer <fmaurer@redhat.com>
+
+commit 4a11678f683814df82fca9018d964771e02d7e6d upstream.
+
+If bpf_msg_push_data() is called with len 0 (as it happens during
+selftests/bpf/test_sockmap), we do not need to do anything and can
+return early.
+
+Calling bpf_msg_push_data() with len 0 previously lead to a wrong ENOMEM
+error: we later called get_order(copy + len); if len was 0, copy + len
+was also often 0 and get_order() returned some undefined value (at the
+moment 52). alloc_pages() caught that and failed, but then bpf_msg_push_data()
+returned ENOMEM. This was wrong because we are most probably not out of
+memory and actually do not need any additional memory.
+
+Fixes: 6fff607e2f14b ("bpf: sk_msg program helper bpf_msg_push_data")
+Signed-off-by: Felix Maurer <fmaurer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Yonghong Song <yhs@fb.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/df69012695c7094ccb1943ca02b4920db3537466.1644421921.git.fmaurer@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/filter.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2711,6 +2711,9 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_
+ if (unlikely(flags))
+ return -EINVAL;
+
++ if (unlikely(len == 0))
++ return 0;
++
+ /* First find the starting scatterlist element */
+ i = msg->sg.start;
+ do {
--- /dev/null
+From 5eaed6eedbe9612f642ad2b880f961d1c6c8ec2b Mon Sep 17 00:00:00 2001
+From: Yonghong Song <yhs@fb.com>
+Date: Fri, 11 Feb 2022 11:49:53 -0800
+Subject: bpf: Fix a bpf_timer initialization issue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yonghong Song <yhs@fb.com>
+
+commit 5eaed6eedbe9612f642ad2b880f961d1c6c8ec2b upstream.
+
+The patch in [1] intends to fix a bpf_timer related issue,
+but the fix caused existing 'timer' selftest to fail with
+hang or some random errors. After some debug, I found
+an issue with check_and_init_map_value() in the hashtab.c.
+More specifically, in hashtab.c, we have code
+ l_new = bpf_map_kmalloc_node(&htab->map, ...)
+ check_and_init_map_value(&htab->map, l_new...)
+Note that bpf_map_kmalloc_node() does not do initialization
+so l_new contains random value.
+
+The function check_and_init_map_value() intends to zero the
+bpf_spin_lock and bpf_timer if they exist in the map.
+But I found bpf_spin_lock is zero'ed but bpf_timer is not zero'ed.
+With [1], later copy_map_value() skips copying of
+bpf_spin_lock and bpf_timer. The non-zero bpf_timer caused
+random failures for 'timer' selftest.
+Without [1], for both bpf_spin_lock and bpf_timer case,
+bpf_timer will be zero'ed, so 'timer' self test is okay.
+
+For check_and_init_map_value(), why bpf_spin_lock is zero'ed
+properly while bpf_timer not. In bpf uapi header, we have
+ struct bpf_spin_lock {
+ __u32 val;
+ };
+ struct bpf_timer {
+ __u64 :64;
+ __u64 :64;
+ } __attribute__((aligned(8)));
+
+The initialization code:
+ *(struct bpf_spin_lock *)(dst + map->spin_lock_off) =
+ (struct bpf_spin_lock){};
+ *(struct bpf_timer *)(dst + map->timer_off) =
+ (struct bpf_timer){};
+It appears the compiler has no obligation to initialize anonymous fields.
+For example, let us use clang with bpf target as below:
+ $ cat t.c
+ struct bpf_timer {
+ unsigned long long :64;
+ };
+ struct bpf_timer2 {
+ unsigned long long a;
+ };
+
+ void test(struct bpf_timer *t) {
+ *t = (struct bpf_timer){};
+ }
+ void test2(struct bpf_timer2 *t) {
+ *t = (struct bpf_timer2){};
+ }
+ $ clang -target bpf -O2 -c -g t.c
+ $ llvm-objdump -d t.o
+ ...
+ 0000000000000000 <test>:
+ 0: 95 00 00 00 00 00 00 00 exit
+ 0000000000000008 <test2>:
+ 1: b7 02 00 00 00 00 00 00 r2 = 0
+ 2: 7b 21 00 00 00 00 00 00 *(u64 *)(r1 + 0) = r2
+ 3: 95 00 00 00 00 00 00 00 exit
+
+gcc11.2 does not have the above issue. But from
+ INTERNATIONAL STANDARD ©ISO/IEC ISO/IEC 9899:201x
+ Programming languages — C
+ http://www.open-std.org/Jtc1/sc22/wg14/www/docs/n1547.pdf
+ page 157:
+ Except where explicitly stated otherwise, for the purposes of
+ this subclause unnamed members of objects of structure and union
+ type do not participate in initialization. Unnamed members of
+ structure objects have indeterminate value even after initialization.
+
+To fix the problem, let use memset for bpf_timer case in
+check_and_init_map_value(). For consistency, memset is also
+used for bpf_spin_lock case.
+
+ [1] https://lore.kernel.org/bpf/20220209070324.1093182-2-memxor@gmail.com/
+
+Fixes: 68134668c17f3 ("bpf: Add map side support for bpf timers.")
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20220211194953.3142152-1-yhs@fb.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/bpf.h | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -209,11 +209,9 @@ static inline bool map_value_has_timer(c
+ static inline void check_and_init_map_value(struct bpf_map *map, void *dst)
+ {
+ if (unlikely(map_value_has_spin_lock(map)))
+- *(struct bpf_spin_lock *)(dst + map->spin_lock_off) =
+- (struct bpf_spin_lock){};
++ memset(dst + map->spin_lock_off, 0, sizeof(struct bpf_spin_lock));
+ if (unlikely(map_value_has_timer(map)))
+- *(struct bpf_timer *)(dst + map->timer_off) =
+- (struct bpf_timer){};
++ memset(dst + map->timer_off, 0, sizeof(struct bpf_timer));
+ }
+
+ /* copy everything but bpf_spin_lock and bpf_timer. There could be one of each. */
--- /dev/null
+From a8abb0c3dc1e28454851a00f8b7333d9695d566c Mon Sep 17 00:00:00 2001
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Date: Wed, 9 Feb 2022 12:33:23 +0530
+Subject: bpf: Fix crash due to incorrect copy_map_value
+
+From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+
+commit a8abb0c3dc1e28454851a00f8b7333d9695d566c upstream.
+
+When both bpf_spin_lock and bpf_timer are present in a BPF map value,
+copy_map_value needs to skirt both objects when copying a value into and
+out of the map. However, the current code does not set both s_off and
+t_off in copy_map_value, which leads to a crash when e.g. bpf_spin_lock
+is placed in map value with bpf_timer, as bpf_map_update_elem call will
+be able to overwrite the other timer object.
+
+When the issue is not fixed, an overwriting can produce the following
+splat:
+
+[root@(none) bpf]# ./test_progs -t timer_crash
+[ 15.930339] bpf_testmod: loading out-of-tree module taints kernel.
+[ 16.037849] ==================================================================
+[ 16.038458] BUG: KASAN: user-memory-access in __pv_queued_spin_lock_slowpath+0x32b/0x520
+[ 16.038944] Write of size 8 at addr 0000000000043ec0 by task test_progs/325
+[ 16.039399]
+[ 16.039514] CPU: 0 PID: 325 Comm: test_progs Tainted: G OE 5.16.0+ #278
+[ 16.039983] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.15.0-1 04/01/2014
+[ 16.040485] Call Trace:
+[ 16.040645] <TASK>
+[ 16.040805] dump_stack_lvl+0x59/0x73
+[ 16.041069] ? __pv_queued_spin_lock_slowpath+0x32b/0x520
+[ 16.041427] kasan_report.cold+0x116/0x11b
+[ 16.041673] ? __pv_queued_spin_lock_slowpath+0x32b/0x520
+[ 16.042040] __pv_queued_spin_lock_slowpath+0x32b/0x520
+[ 16.042328] ? memcpy+0x39/0x60
+[ 16.042552] ? pv_hash+0xd0/0xd0
+[ 16.042785] ? lockdep_hardirqs_off+0x95/0xd0
+[ 16.043079] __bpf_spin_lock_irqsave+0xdf/0xf0
+[ 16.043366] ? bpf_get_current_comm+0x50/0x50
+[ 16.043608] ? jhash+0x11a/0x270
+[ 16.043848] bpf_timer_cancel+0x34/0xe0
+[ 16.044119] bpf_prog_c4ea1c0f7449940d_sys_enter+0x7c/0x81
+[ 16.044500] bpf_trampoline_6442477838_0+0x36/0x1000
+[ 16.044836] __x64_sys_nanosleep+0x5/0x140
+[ 16.045119] do_syscall_64+0x59/0x80
+[ 16.045377] ? lock_is_held_type+0xe4/0x140
+[ 16.045670] ? irqentry_exit_to_user_mode+0xa/0x40
+[ 16.046001] ? mark_held_locks+0x24/0x90
+[ 16.046287] ? asm_exc_page_fault+0x1e/0x30
+[ 16.046569] ? asm_exc_page_fault+0x8/0x30
+[ 16.046851] ? lockdep_hardirqs_on+0x7e/0x100
+[ 16.047137] entry_SYSCALL_64_after_hwframe+0x44/0xae
+[ 16.047405] RIP: 0033:0x7f9e4831718d
+[ 16.047602] Code: b4 0c 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b3 6c 0c 00 f7 d8 64 89 01 48
+[ 16.048764] RSP: 002b:00007fff488086b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000023
+[ 16.049275] RAX: ffffffffffffffda RBX: 00007f9e48683740 RCX: 00007f9e4831718d
+[ 16.049747] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff488086d0
+[ 16.050225] RBP: 00007fff488086f0 R08: 00007fff488085d7 R09: 00007f9e4cb594a0
+[ 16.050648] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f9e484cde30
+[ 16.051124] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+[ 16.051608] </TASK>
+[ 16.051762] ==================================================================
+
+Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.")
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20220209070324.1093182-2-memxor@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/bpf.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -224,7 +224,8 @@ static inline void copy_map_value(struct
+ if (unlikely(map_value_has_spin_lock(map))) {
+ s_off = map->spin_lock_off;
+ s_sz = sizeof(struct bpf_spin_lock);
+- } else if (unlikely(map_value_has_timer(map))) {
++ }
++ if (unlikely(map_value_has_timer(map))) {
+ t_off = map->timer_off;
+ t_sz = sizeof(struct bpf_timer);
+ }
--- /dev/null
+From 3494894afff4ad11f25d8342cc99699be496d082 Mon Sep 17 00:00:00 2001
+From: Konrad Dybcio <konrad.dybcio@somainline.org>
+Date: Fri, 18 Feb 2022 00:24:08 +0100
+Subject: clk: qcom: gcc-msm8994: Remove NoC clocks
+
+From: Konrad Dybcio <konrad.dybcio@somainline.org>
+
+commit 3494894afff4ad11f25d8342cc99699be496d082 upstream.
+
+Just like in commit 05cf3ec00d46 ("clk: qcom: gcc-msm8996: Drop (again)
+gcc_aggre1_pnoc_ahb_clk") adding NoC clocks turned out to be a huge
+mistake, as they cause a lot of issues at little benefit (basically
+letting Linux know about their children's frequencies), especially when
+mishandled or misconfigured.
+
+Adding these ones broke SDCC approx 99 out of 100 times, but that somehow
+went unnoticed. To prevent further issues like this one, remove them.
+
+This commit is effectively a revert of 74a33fac3aab ("clk: qcom:
+gcc-msm8994: Add missing NoC clocks") with ABI preservation.
+
+Fixes: 74a33fac3aab ("clk: qcom: gcc-msm8994: Add missing NoC clocks")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Link: https://lore.kernel.org/r/20220217232408.78932-1-konrad.dybcio@somainline.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/gcc-msm8994.c | 106 +++--------------------------------------
+ 1 file changed, 9 insertions(+), 97 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-msm8994.c
++++ b/drivers/clk/qcom/gcc-msm8994.c
+@@ -107,42 +107,6 @@ static const struct clk_parent_data gcc_
+ { .hw = &gpll4.clkr.hw },
+ };
+
+-static struct clk_rcg2 system_noc_clk_src = {
+- .cmd_rcgr = 0x0120,
+- .hid_width = 5,
+- .parent_map = gcc_xo_gpll0_map,
+- .clkr.hw.init = &(struct clk_init_data){
+- .name = "system_noc_clk_src",
+- .parent_data = gcc_xo_gpll0,
+- .num_parents = ARRAY_SIZE(gcc_xo_gpll0),
+- .ops = &clk_rcg2_ops,
+- },
+-};
+-
+-static struct clk_rcg2 config_noc_clk_src = {
+- .cmd_rcgr = 0x0150,
+- .hid_width = 5,
+- .parent_map = gcc_xo_gpll0_map,
+- .clkr.hw.init = &(struct clk_init_data){
+- .name = "config_noc_clk_src",
+- .parent_data = gcc_xo_gpll0,
+- .num_parents = ARRAY_SIZE(gcc_xo_gpll0),
+- .ops = &clk_rcg2_ops,
+- },
+-};
+-
+-static struct clk_rcg2 periph_noc_clk_src = {
+- .cmd_rcgr = 0x0190,
+- .hid_width = 5,
+- .parent_map = gcc_xo_gpll0_map,
+- .clkr.hw.init = &(struct clk_init_data){
+- .name = "periph_noc_clk_src",
+- .parent_data = gcc_xo_gpll0,
+- .num_parents = ARRAY_SIZE(gcc_xo_gpll0),
+- .ops = &clk_rcg2_ops,
+- },
+-};
+-
+ static struct freq_tbl ftbl_ufs_axi_clk_src[] = {
+ F(50000000, P_GPLL0, 12, 0, 0),
+ F(100000000, P_GPLL0, 6, 0, 0),
+@@ -1149,8 +1113,6 @@ static struct clk_branch gcc_blsp1_ahb_c
+ .enable_mask = BIT(17),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_blsp1_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1434,8 +1396,6 @@ static struct clk_branch gcc_blsp2_ahb_c
+ .enable_mask = BIT(15),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_blsp2_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1763,8 +1723,6 @@ static struct clk_branch gcc_lpass_q6_ax
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_lpass_q6_axi_clk",
+- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1777,8 +1735,6 @@ static struct clk_branch gcc_mss_q6_bimc
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_mss_q6_bimc_axi_clk",
+- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1806,9 +1762,6 @@ static struct clk_branch gcc_pcie_0_cfg_
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_0_cfg_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &config_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1821,9 +1774,6 @@ static struct clk_branch gcc_pcie_0_mstr
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_0_mstr_axi_clk",
+- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1853,9 +1803,6 @@ static struct clk_branch gcc_pcie_0_slv_
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_0_slv_axi_clk",
+- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1883,9 +1830,6 @@ static struct clk_branch gcc_pcie_1_cfg_
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_1_cfg_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &config_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1898,9 +1842,6 @@ static struct clk_branch gcc_pcie_1_mstr
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_1_mstr_axi_clk",
+- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1929,9 +1870,6 @@ static struct clk_branch gcc_pcie_1_slv_
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_1_slv_axi_clk",
+- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1959,8 +1897,6 @@ static struct clk_branch gcc_pdm_ahb_clk
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pdm_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -1988,9 +1924,6 @@ static struct clk_branch gcc_sdcc1_ahb_c
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_sdcc1_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2003,9 +1936,6 @@ static struct clk_branch gcc_sdcc2_ahb_c
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_sdcc2_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2033,9 +1963,6 @@ static struct clk_branch gcc_sdcc3_ahb_c
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_sdcc3_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2063,9 +1990,6 @@ static struct clk_branch gcc_sdcc4_ahb_c
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_sdcc4_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2123,8 +2047,6 @@ static struct clk_branch gcc_tsif_ahb_cl
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_tsif_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2152,8 +2074,6 @@ static struct clk_branch gcc_ufs_ahb_clk
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_ufs_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &config_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2197,8 +2117,6 @@ static struct clk_branch gcc_ufs_rx_symb
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_ufs_rx_symbol_0_clk",
+- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2212,8 +2130,6 @@ static struct clk_branch gcc_ufs_rx_symb
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_ufs_rx_symbol_1_clk",
+- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2242,8 +2158,6 @@ static struct clk_branch gcc_ufs_tx_symb
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_ufs_tx_symbol_0_clk",
+- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2257,8 +2171,6 @@ static struct clk_branch gcc_ufs_tx_symb
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_ufs_tx_symbol_1_clk",
+- .parent_hws = (const struct clk_hw *[]){ &system_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2363,8 +2275,6 @@ static struct clk_branch gcc_usb_hs_ahb_
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_usb_hs_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2487,8 +2397,6 @@ static struct clk_branch gcc_boot_rom_ah
+ .enable_mask = BIT(10),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_boot_rom_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &config_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2502,8 +2410,6 @@ static struct clk_branch gcc_prng_ahb_cl
+ .enable_mask = BIT(13),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_prng_ahb_clk",
+- .parent_hws = (const struct clk_hw *[]){ &periph_noc_clk_src.clkr.hw },
+- .num_parents = 1,
+ .ops = &clk_branch2_ops,
+ },
+ },
+@@ -2546,9 +2452,6 @@ static struct clk_regmap *gcc_msm8994_cl
+ [GPLL0] = &gpll0.clkr,
+ [GPLL4_EARLY] = &gpll4_early.clkr,
+ [GPLL4] = &gpll4.clkr,
+- [CONFIG_NOC_CLK_SRC] = &config_noc_clk_src.clkr,
+- [PERIPH_NOC_CLK_SRC] = &periph_noc_clk_src.clkr,
+- [SYSTEM_NOC_CLK_SRC] = &system_noc_clk_src.clkr,
+ [UFS_AXI_CLK_SRC] = &ufs_axi_clk_src.clkr,
+ [USB30_MASTER_CLK_SRC] = &usb30_master_clk_src.clkr,
+ [BLSP1_QUP1_I2C_APPS_CLK_SRC] = &blsp1_qup1_i2c_apps_clk_src.clkr,
+@@ -2695,6 +2598,15 @@ static struct clk_regmap *gcc_msm8994_cl
+ [USB_SS_PHY_LDO] = &usb_ss_phy_ldo.clkr,
+ [GCC_BOOT_ROM_AHB_CLK] = &gcc_boot_rom_ahb_clk.clkr,
+ [GCC_PRNG_AHB_CLK] = &gcc_prng_ahb_clk.clkr,
++
++ /*
++ * The following clocks should NOT be managed by this driver, but they once were
++ * mistakengly added. Now they are only here to indicate that they are not defined
++ * on purpose, even though the names will stay in the header file (for ABI sanity).
++ */
++ [CONFIG_NOC_CLK_SRC] = NULL,
++ [PERIPH_NOC_CLK_SRC] = NULL,
++ [SYSTEM_NOC_CLK_SRC] = NULL,
+ };
+
+ static struct gdsc *gcc_msm8994_gdscs[] = {
--- /dev/null
+From 4d22336f903930eb94588b939c310743a3640276 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <mdaenzer@redhat.com>
+Date: Tue, 15 Feb 2022 19:53:37 +0100
+Subject: drm/amd/display: For vblank_disable_immediate, check PSR is really used
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <mdaenzer@redhat.com>
+
+commit 4d22336f903930eb94588b939c310743a3640276 upstream.
+
+Even if PSR is allowed for a present GPU, there might be no eDP link
+which supports PSR.
+
+Fixes: 708978487304 ("drm/amdgpu/display: Only set vblank_disable_immediate when PSR is not enabled")
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -4232,6 +4232,9 @@ static int amdgpu_dm_initialize_drm_devi
+ }
+ #endif
+
++ /* Disable vblank IRQs aggressively for power-saving. */
++ adev_to_drm(adev)->vblank_disable_immediate = true;
++
+ /* loops over all connectors on the board */
+ for (i = 0; i < link_cnt; i++) {
+ struct dc_link *link = NULL;
+@@ -4277,19 +4280,17 @@ static int amdgpu_dm_initialize_drm_devi
+ update_connector_ext_caps(aconnector);
+ if (psr_feature_enabled)
+ amdgpu_dm_set_psr_caps(link);
++
++ /* TODO: Fix vblank control helpers to delay PSR entry to allow this when
++ * PSR is also supported.
++ */
++ if (link->psr_settings.psr_feature_enabled)
++ adev_to_drm(adev)->vblank_disable_immediate = false;
+ }
+
+
+ }
+
+- /*
+- * Disable vblank IRQs aggressively for power-saving.
+- *
+- * TODO: Fix vblank control helpers to delay PSR entry to allow this when PSR
+- * is also supported.
+- */
+- adev_to_drm(adev)->vblank_disable_immediate = !psr_feature_enabled;
+-
+ /* Software is initialized. Now we can register interrupt handlers. */
+ switch (adev->asic_type) {
+ #if defined(CONFIG_DRM_AMD_DC_SI)
--- /dev/null
+From ecbd4912a693b862e25cba0a6990a8c95b00721e Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 3 Feb 2022 12:54:16 +0100
+Subject: drm/edid: Always set RGB444
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+commit ecbd4912a693b862e25cba0a6990a8c95b00721e upstream.
+
+In order to fill the drm_display_info structure each time an EDID is
+read, the code currently will call drm_add_display_info with the parsed
+EDID.
+
+drm_add_display_info will then call drm_reset_display_info to reset all
+the fields to 0, and then set them to the proper value depending on the
+EDID.
+
+In the color_formats case, we will thus report that we don't support any
+color format, and then fill it back with RGB444 plus the additional
+formats described in the EDID Feature Support byte.
+
+However, since that byte only contains format-related bits since the 1.4
+specification, this doesn't happen if the EDID is following an earlier
+specification. In turn, it means that for one of these EDID, we end up
+with color_formats set to 0.
+
+The EDID 1.3 specification never really specifies what it means by RGB
+exactly, but since both HDMI and DVI will use RGB444, it's fairly safe
+to assume it's supposed to be RGB444.
+
+Let's move the addition of RGB444 to color_formats earlier in
+drm_add_display_info() so that it's always set for a digital display.
+
+Fixes: da05a5a71ad8 ("drm: parse color format support for digital displays")
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reported-by: Matthias Reichl <hias@horus.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220203115416.1137308-1-maxime@cerno.tech
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_edid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -5345,6 +5345,7 @@ u32 drm_add_display_info(struct drm_conn
+ if (!(edid->input & DRM_EDID_INPUT_DIGITAL))
+ return quirks;
+
++ info->color_formats |= DRM_COLOR_FORMAT_RGB444;
+ drm_parse_cea_ext(connector, edid);
+
+ /*
+@@ -5393,7 +5394,6 @@ u32 drm_add_display_info(struct drm_conn
+ DRM_DEBUG("%s: Assigning EDID-1.4 digital sink color depth as %d bpc.\n",
+ connector->name, info->bpc);
+
+- info->color_formats |= DRM_COLOR_FORMAT_RGB444;
+ if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB444)
+ info->color_formats |= DRM_COLOR_FORMAT_YCRCB444;
+ if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB422)
--- /dev/null
+From 28adef861233c6fce47372ebd2070b55eaa8e899 Mon Sep 17 00:00:00 2001
+From: Matt Roper <matthew.d.roper@intel.com>
+Date: Tue, 15 Feb 2022 08:35:45 -0800
+Subject: drm/i915/dg2: Print PHY name properly on calibration error
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+commit 28adef861233c6fce47372ebd2070b55eaa8e899 upstream.
+
+We need to use phy_name() to convert the PHY value into a human-readable
+character in the error message.
+
+Fixes: a6a128116e55 ("drm/i915/dg2: Wait for SNPS PHY calibration during display init")
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Swathi Dhanavanthri <swathi.dhanavanthri@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220215163545.2175730-1-matthew.d.roper@intel.com
+(cherry picked from commit 84073e568eec7b586b2f6fd5fb2fb08f59edec54)
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_snps_phy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_snps_phy.c
++++ b/drivers/gpu/drm/i915/display/intel_snps_phy.c
+@@ -34,7 +34,7 @@ void intel_snps_phy_wait_for_calibration
+ if (intel_de_wait_for_clear(dev_priv, ICL_PHY_MISC(phy),
+ DG2_PHY_DP_TX_ACK_MASK, 25))
+ DRM_ERROR("SNPS PHY %c failed to calibrate after 25ms.\n",
+- phy);
++ phy_name(phy));
+ }
+ }
+
--- /dev/null
+From 6764eb690e77ecded48587d6d4e346ba2e196546 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Thu, 3 Feb 2022 11:20:03 +0100
+Subject: drm/vc4: crtc: Fix runtime_pm reference counting
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+commit 6764eb690e77ecded48587d6d4e346ba2e196546 upstream.
+
+At boot on the BCM2711, if the HDMI controllers are running, the CRTC
+driver will disable itself and its associated HDMI controller to work
+around a hardware bug that would leave some pixels stuck in a FIFO.
+
+In order to avoid that issue, we need to run some operations in lockstep
+between the CRTC and HDMI controller, and we need to make sure the HDMI
+controller will be powered properly.
+
+However, since we haven't enabled it through KMS, the runtime_pm state
+is off at this point so we need to make sure the device is powered
+through pm_runtime_resume_and_get, and once the operations are complete,
+we call pm_runtime_put.
+
+However, the HDMI controller will do that itself in its
+post_crtc_powerdown, which means we'll end up calling pm_runtime_put for
+a single pm_runtime_get, throwing the reference counting off. Let's
+remove the pm_runtime_put call in the CRTC code in order to have the
+proper counting.
+
+Fixes: bca10db67bda ("drm/vc4: crtc: Make sure the HDMI controller is powered when disabling")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220203102003.1114673-1-maxime@cerno.tech
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -538,9 +538,11 @@ int vc4_crtc_disable_at_boot(struct drm_
+ if (ret)
+ return ret;
+
+- ret = pm_runtime_put(&vc4_hdmi->pdev->dev);
+- if (ret)
+- return ret;
++ /*
++ * post_crtc_powerdown will have called pm_runtime_put, so we
++ * don't need it here otherwise we'll get the reference counting
++ * wrong.
++ */
+
+ return 0;
+ }
--- /dev/null
+From 184b58fa816fb5ee1854daf0d430766422bf2a77 Mon Sep 17 00:00:00 2001
+From: Mikko Perttunen <mperttunen@nvidia.com>
+Date: Mon, 7 Feb 2022 15:19:31 +0200
+Subject: gpu: host1x: Always return syncpoint value when waiting
+
+From: Mikko Perttunen <mperttunen@nvidia.com>
+
+commit 184b58fa816fb5ee1854daf0d430766422bf2a77 upstream.
+
+The new TegraDRM UAPI uses syncpoint waiting with timeout set to
+zero to indicate reading the syncpoint value. To support that we
+need to return the syncpoint value always when waiting.
+
+Fixes: 44e961381354 ("drm/tegra: Implement syncpoint wait UAPI")
+Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/host1x/syncpt.c | 19 ++-----------------
+ 1 file changed, 2 insertions(+), 17 deletions(-)
+
+--- a/drivers/gpu/host1x/syncpt.c
++++ b/drivers/gpu/host1x/syncpt.c
+@@ -225,27 +225,12 @@ int host1x_syncpt_wait(struct host1x_syn
+ void *ref;
+ struct host1x_waitlist *waiter;
+ int err = 0, check_count = 0;
+- u32 val;
+
+ if (value)
+- *value = 0;
+-
+- /* first check cache */
+- if (host1x_syncpt_is_expired(sp, thresh)) {
+- if (value)
+- *value = host1x_syncpt_load(sp);
++ *value = host1x_syncpt_load(sp);
+
++ if (host1x_syncpt_is_expired(sp, thresh))
+ return 0;
+- }
+-
+- /* try to read from register */
+- val = host1x_hw_syncpt_load(sp->host, sp);
+- if (host1x_syncpt_is_expired(sp, thresh)) {
+- if (value)
+- *value = val;
+-
+- goto done;
+- }
+
+ if (!timeout) {
+ err = -EAGAIN;
--- /dev/null
+From cc20cced0598d9a5ff91ae4ab147b3b5e99ee819 Mon Sep 17 00:00:00 2001
+From: Tao Liu <thomas.liu@ucloud.cn>
+Date: Fri, 18 Feb 2022 22:35:24 +0800
+Subject: gso: do not skip outer ip header in case of ipip and net_failover
+
+From: Tao Liu <thomas.liu@ucloud.cn>
+
+commit cc20cced0598d9a5ff91ae4ab147b3b5e99ee819 upstream.
+
+We encounter a tcp drop issue in our cloud environment. Packet GROed in
+host forwards to a VM virtio_net nic with net_failover enabled. VM acts
+as a IPVS LB with ipip encapsulation. The full path like:
+host gro -> vm virtio_net rx -> net_failover rx -> ipvs fullnat
+ -> ipip encap -> net_failover tx -> virtio_net tx
+
+When net_failover transmits a ipip pkt (gso_type = 0x0103, which means
+SKB_GSO_TCPV4, SKB_GSO_DODGY and SKB_GSO_IPXIP4), there is no gso
+did because it supports TSO and GSO_IPXIP4. But network_header points to
+inner ip header.
+
+Call Trace:
+ tcp4_gso_segment ------> return NULL
+ inet_gso_segment ------> inner iph, network_header points to
+ ipip_gso_segment
+ inet_gso_segment ------> outer iph
+ skb_mac_gso_segment
+
+Afterwards virtio_net transmits the pkt, only inner ip header is modified.
+And the outer one just keeps unchanged. The pkt will be dropped in remote
+host.
+
+Call Trace:
+ inet_gso_segment ------> inner iph, outer iph is skipped
+ skb_mac_gso_segment
+ __skb_gso_segment
+ validate_xmit_skb
+ validate_xmit_skb_list
+ sch_direct_xmit
+ __qdisc_run
+ __dev_queue_xmit ------> virtio_net
+ dev_hard_start_xmit
+ __dev_queue_xmit ------> net_failover
+ ip_finish_output2
+ ip_output
+ iptunnel_xmit
+ ip_tunnel_xmit
+ ipip_tunnel_xmit ------> ipip
+ dev_hard_start_xmit
+ __dev_queue_xmit
+ ip_finish_output2
+ ip_output
+ ip_forward
+ ip_rcv
+ __netif_receive_skb_one_core
+ netif_receive_skb_internal
+ napi_gro_receive
+ receive_buf
+ virtnet_poll
+ net_rx_action
+
+The root cause of this issue is specific with the rare combination of
+SKB_GSO_DODGY and a tunnel device that adds an SKB_GSO_ tunnel option.
+SKB_GSO_DODGY is set from external virtio_net. We need to reset network
+header when callbacks.gso_segment() returns NULL.
+
+This patch also includes ipv6_gso_segment(), considering SIT, etc.
+
+Fixes: cb32f511a70b ("ipip: add GSO/TSO support")
+Signed-off-by: Tao Liu <thomas.liu@ucloud.cn>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/af_inet.c | 5 ++++-
+ net/ipv6/ip6_offload.c | 2 ++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -1376,8 +1376,11 @@ struct sk_buff *inet_gso_segment(struct
+ }
+
+ ops = rcu_dereference(inet_offloads[proto]);
+- if (likely(ops && ops->callbacks.gso_segment))
++ if (likely(ops && ops->callbacks.gso_segment)) {
+ segs = ops->callbacks.gso_segment(skb, features);
++ if (!segs)
++ skb->network_header = skb_mac_header(skb) + nhoff - skb->head;
++ }
+
+ if (IS_ERR_OR_NULL(segs))
+ goto out;
+--- a/net/ipv6/ip6_offload.c
++++ b/net/ipv6/ip6_offload.c
+@@ -114,6 +114,8 @@ static struct sk_buff *ipv6_gso_segment(
+ if (likely(ops && ops->callbacks.gso_segment)) {
+ skb_reset_transport_header(skb);
+ segs = ops->callbacks.gso_segment(skb, features);
++ if (!segs)
++ skb->network_header = skb_mac_header(skb) + nhoff - skb->head;
+ }
+
+ if (IS_ERR_OR_NULL(segs))
--- /dev/null
+From 1b5f517cca36292076d9e38fa6e33a257703e62e Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Mon, 21 Feb 2022 08:32:14 -0800
+Subject: hwmon: Handle failure to register sensor with thermal zone correctly
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 1b5f517cca36292076d9e38fa6e33a257703e62e upstream.
+
+If an attempt is made to a sensor with a thermal zone and it fails,
+the call to devm_thermal_zone_of_sensor_register() may return -ENODEV.
+This may result in crashes similar to the following.
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000000000003cd
+...
+Internal error: Oops: 96000021 [#1] PREEMPT SMP
+...
+pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : mutex_lock+0x18/0x60
+lr : thermal_zone_device_update+0x40/0x2e0
+sp : ffff800014c4fc60
+x29: ffff800014c4fc60 x28: ffff365ee3f6e000 x27: ffffdde218426790
+x26: ffff365ee3f6e000 x25: 0000000000000000 x24: ffff365ee3f6e000
+x23: ffffdde218426870 x22: ffff365ee3f6e000 x21: 00000000000003cd
+x20: ffff365ee8bf3308 x19: ffffffffffffffed x18: 0000000000000000
+x17: ffffdde21842689c x16: ffffdde1cb7a0b7c x15: 0000000000000040
+x14: ffffdde21a4889a0 x13: 0000000000000228 x12: 0000000000000000
+x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
+x8 : 0000000001120000 x7 : 0000000000000001 x6 : 0000000000000000
+x5 : 0068000878e20f07 x4 : 0000000000000000 x3 : 00000000000003cd
+x2 : ffff365ee3f6e000 x1 : 0000000000000000 x0 : 00000000000003cd
+Call trace:
+ mutex_lock+0x18/0x60
+ hwmon_notify_event+0xfc/0x110
+ 0xffffdde1cb7a0a90
+ 0xffffdde1cb7a0b7c
+ irq_thread_fn+0x2c/0xa0
+ irq_thread+0x134/0x240
+ kthread+0x178/0x190
+ ret_from_fork+0x10/0x20
+Code: d503201f d503201f d2800001 aa0103e4 (c8e47c02)
+
+Jon Hunter reports that the exact call sequence is:
+
+hwmon_notify_event()
+ --> hwmon_thermal_notify()
+ --> thermal_zone_device_update()
+ --> update_temperature()
+ --> mutex_lock()
+
+The hwmon core needs to handle all errors returned from calls
+to devm_thermal_zone_of_sensor_register(). If the call fails
+with -ENODEV, report that the sensor was not attached to a
+thermal zone but continue to register the hwmon device.
+
+Reported-by: Jon Hunter <jonathanh@nvidia.com>
+Cc: Dmitry Osipenko <digetx@gmail.com>
+Fixes: 1597b374af222 ("hwmon: Add notification support")
+Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/hwmon.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/hwmon/hwmon.c
++++ b/drivers/hwmon/hwmon.c
+@@ -214,12 +214,14 @@ static int hwmon_thermal_add_sensor(stru
+
+ tzd = devm_thermal_zone_of_sensor_register(dev, index, tdata,
+ &hwmon_thermal_ops);
+- /*
+- * If CONFIG_THERMAL_OF is disabled, this returns -ENODEV,
+- * so ignore that error but forward any other error.
+- */
+- if (IS_ERR(tzd) && (PTR_ERR(tzd) != -ENODEV))
+- return PTR_ERR(tzd);
++ if (IS_ERR(tzd)) {
++ if (PTR_ERR(tzd) != -ENODEV)
++ return PTR_ERR(tzd);
++ dev_info(dev, "temp%d_input not attached to any thermal zone\n",
++ index + 1);
++ devm_kfree(dev, tdata);
++ return 0;
++ }
+
+ err = devm_add_action(dev, hwmon_thermal_remove_sensor, &tdata->node);
+ if (err)
--- /dev/null
+From 277f2bb14361790a70e4b3c649e794b75a91a597 Mon Sep 17 00:00:00 2001
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Date: Mon, 21 Feb 2022 15:05:45 -0600
+Subject: ibmvnic: schedule failover only if vioctl fails
+
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+
+commit 277f2bb14361790a70e4b3c649e794b75a91a597 upstream.
+
+If client is unable to initiate a failover reset via H_VIOCTL hcall, then
+it should schedule a failover reset as a last resort. Otherwise, there is
+no need to do a last resort.
+
+Fixes: 334c42414729 ("ibmvnic: improve failover sysfs entry")
+Reported-by: Cris Forno <cforno12@outlook.com>
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Signed-off-by: Dany Madden <drt@linux.ibm.com>
+Link: https://lore.kernel.org/r/20220221210545.115283-1-drt@linux.ibm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -5919,10 +5919,14 @@ static ssize_t failover_store(struct dev
+ be64_to_cpu(session_token));
+ rc = plpar_hcall_norets(H_VIOCTL, adapter->vdev->unit_address,
+ H_SESSION_ERR_DETECTED, session_token, 0, 0);
+- if (rc)
++ if (rc) {
+ netdev_err(netdev,
+ "H_VIOCTL initiated failover failed, rc %ld\n",
+ rc);
++ goto last_resort;
++ }
++
++ return count;
+
+ last_resort:
+ netdev_dbg(netdev, "Trying to send CRQ_CMD, the last resort\n");
--- /dev/null
+From ed22d9c8d128293fc7b0b086c7d3654bcb99a8dd Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Mon, 14 Feb 2022 06:33:27 -0800
+Subject: ice: check the return of ice_ptp_gettimex64
+
+From: Tom Rix <trix@redhat.com>
+
+commit ed22d9c8d128293fc7b0b086c7d3654bcb99a8dd upstream.
+
+Clang static analysis reports this issue
+time64.h:69:50: warning: The left operand of '+'
+ is a garbage value
+ set_normalized_timespec64(&ts_delta, lhs.tv_sec + rhs.tv_sec,
+ ~~~~~~~~~~ ^
+In ice_ptp_adjtime_nonatomic(), the timespec64 variable 'now'
+is set by ice_ptp_gettimex64(). This function can fail
+with -EBUSY, so 'now' can have a gargbage value.
+So check the return.
+
+Fixes: 06c16d89d2cb ("ice: register 1588 PTP clock device object for E810 devices")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Tested-by: Gurucharan G <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_ptp.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
+@@ -1121,9 +1121,12 @@ exit:
+ static int ice_ptp_adjtime_nonatomic(struct ptp_clock_info *info, s64 delta)
+ {
+ struct timespec64 now, then;
++ int ret;
+
+ then = ns_to_timespec64(delta);
+- ice_ptp_gettimex64(info, &now, NULL);
++ ret = ice_ptp_gettimex64(info, &now, NULL);
++ if (ret)
++ return ret;
+ now = timespec64_add(now, then);
+
+ return ice_ptp_settime64(info, (const struct timespec64 *)&now);
--- /dev/null
+From fadead80fe4c033b5e514fcbadd20b55c4494112 Mon Sep 17 00:00:00 2001
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Mon, 7 Feb 2022 10:23:29 -0800
+Subject: ice: fix concurrent reset and removal of VFs
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+commit fadead80fe4c033b5e514fcbadd20b55c4494112 upstream.
+
+Commit c503e63200c6 ("ice: Stop processing VF messages during teardown")
+introduced a driver state flag, ICE_VF_DEINIT_IN_PROGRESS, which is
+intended to prevent some issues with concurrently handling messages from
+VFs while tearing down the VFs.
+
+This change was motivated by crashes caused while tearing down and
+bringing up VFs in rapid succession.
+
+It turns out that the fix actually introduces issues with the VF driver
+caused because the PF no longer responds to any messages sent by the VF
+during its .remove routine. This results in the VF potentially removing
+its DMA memory before the PF has shut down the device queues.
+
+Additionally, the fix doesn't actually resolve concurrency issues within
+the ice driver. It is possible for a VF to initiate a reset just prior
+to the ice driver removing VFs. This can result in the remove task
+concurrently operating while the VF is being reset. This results in
+similar memory corruption and panics purportedly fixed by that commit.
+
+Fix this concurrency at its root by protecting both the reset and
+removal flows using the existing VF cfg_lock. This ensures that we
+cannot remove the VF while any outstanding critical tasks such as a
+virtchnl message or a reset are occurring.
+
+This locking change also fixes the root cause originally fixed by commit
+c503e63200c6 ("ice: Stop processing VF messages during teardown"), so we
+can simply revert it.
+
+Note that I kept these two changes together because simply reverting the
+original commit alone would leave the driver vulnerable to worse race
+conditions.
+
+Fixes: c503e63200c6 ("ice: Stop processing VF messages during teardown")
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice.h | 1
+ drivers/net/ethernet/intel/ice/ice_main.c | 2 +
+ drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 42 +++++++++++++----------
+ 3 files changed, 27 insertions(+), 18 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice.h
++++ b/drivers/net/ethernet/intel/ice/ice.h
+@@ -280,7 +280,6 @@ enum ice_pf_state {
+ ICE_VFLR_EVENT_PENDING,
+ ICE_FLTR_OVERFLOW_PROMISC,
+ ICE_VF_DIS,
+- ICE_VF_DEINIT_IN_PROGRESS,
+ ICE_CFG_BUSY,
+ ICE_SERVICE_SCHED,
+ ICE_SERVICE_DIS,
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -1772,7 +1772,9 @@ static void ice_handle_mdd_event(struct
+ * reset, so print the event prior to reset.
+ */
+ ice_print_vf_rx_mdd_event(vf);
++ mutex_lock(&pf->vf[i].cfg_lock);
+ ice_reset_vf(&pf->vf[i], false);
++ mutex_unlock(&pf->vf[i].cfg_lock);
+ }
+ }
+ }
+--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
+@@ -617,8 +617,6 @@ void ice_free_vfs(struct ice_pf *pf)
+ struct ice_hw *hw = &pf->hw;
+ unsigned int tmp, i;
+
+- set_bit(ICE_VF_DEINIT_IN_PROGRESS, pf->state);
+-
+ if (!pf->vf)
+ return;
+
+@@ -636,22 +634,26 @@ void ice_free_vfs(struct ice_pf *pf)
+ else
+ dev_warn(dev, "VFs are assigned - not disabling SR-IOV\n");
+
+- /* Avoid wait time by stopping all VFs at the same time */
+- ice_for_each_vf(pf, i)
+- ice_dis_vf_qs(&pf->vf[i]);
+-
+ tmp = pf->num_alloc_vfs;
+ pf->num_qps_per_vf = 0;
+ pf->num_alloc_vfs = 0;
+ for (i = 0; i < tmp; i++) {
+- if (test_bit(ICE_VF_STATE_INIT, pf->vf[i].vf_states)) {
++ struct ice_vf *vf = &pf->vf[i];
++
++ mutex_lock(&vf->cfg_lock);
++
++ ice_dis_vf_qs(vf);
++
++ if (test_bit(ICE_VF_STATE_INIT, vf->vf_states)) {
+ /* disable VF qp mappings and set VF disable state */
+- ice_dis_vf_mappings(&pf->vf[i]);
+- set_bit(ICE_VF_STATE_DIS, pf->vf[i].vf_states);
+- ice_free_vf_res(&pf->vf[i]);
++ ice_dis_vf_mappings(vf);
++ set_bit(ICE_VF_STATE_DIS, vf->vf_states);
++ ice_free_vf_res(vf);
+ }
+
+- mutex_destroy(&pf->vf[i].cfg_lock);
++ mutex_unlock(&vf->cfg_lock);
++
++ mutex_destroy(&vf->cfg_lock);
+ }
+
+ if (ice_sriov_free_msix_res(pf))
+@@ -687,7 +689,6 @@ void ice_free_vfs(struct ice_pf *pf)
+ i);
+
+ clear_bit(ICE_VF_DIS, pf->state);
+- clear_bit(ICE_VF_DEINIT_IN_PROGRESS, pf->state);
+ clear_bit(ICE_FLAG_SRIOV_ENA, pf->flags);
+ }
+
+@@ -1613,6 +1614,8 @@ bool ice_reset_all_vfs(struct ice_pf *pf
+ ice_for_each_vf(pf, v) {
+ vf = &pf->vf[v];
+
++ mutex_lock(&vf->cfg_lock);
++
+ vf->driver_caps = 0;
+ ice_vc_set_default_allowlist(vf);
+
+@@ -1627,6 +1630,8 @@ bool ice_reset_all_vfs(struct ice_pf *pf
+ ice_vf_pre_vsi_rebuild(vf);
+ ice_vf_rebuild_vsi(vf);
+ ice_vf_post_vsi_rebuild(vf);
++
++ mutex_unlock(&vf->cfg_lock);
+ }
+
+ if (ice_is_eswitch_mode_switchdev(pf))
+@@ -1677,6 +1682,8 @@ bool ice_reset_vf(struct ice_vf *vf, boo
+ u32 reg;
+ int i;
+
++ lockdep_assert_held(&vf->cfg_lock);
++
+ dev = ice_pf_to_dev(pf);
+
+ if (test_bit(ICE_VF_RESETS_DISABLED, pf->state)) {
+@@ -2176,9 +2183,12 @@ void ice_process_vflr_event(struct ice_p
+ bit_idx = (hw->func_caps.vf_base_id + vf_id) % 32;
+ /* read GLGEN_VFLRSTAT register to find out the flr VFs */
+ reg = rd32(hw, GLGEN_VFLRSTAT(reg_idx));
+- if (reg & BIT(bit_idx))
++ if (reg & BIT(bit_idx)) {
+ /* GLGEN_VFLRSTAT bit will be cleared in ice_reset_vf */
++ mutex_lock(&vf->cfg_lock);
+ ice_reset_vf(vf, true);
++ mutex_unlock(&vf->cfg_lock);
++ }
+ }
+ }
+
+@@ -2255,7 +2265,9 @@ ice_vf_lan_overflow_event(struct ice_pf
+ if (!vf)
+ return;
+
++ mutex_lock(&vf->cfg_lock);
+ ice_vc_reset_vf(vf);
++ mutex_unlock(&vf->cfg_lock);
+ }
+
+ /**
+@@ -4651,10 +4663,6 @@ void ice_vc_process_vf_msg(struct ice_pf
+ struct device *dev;
+ int err = 0;
+
+- /* if de-init is underway, don't process messages from VF */
+- if (test_bit(ICE_VF_DEINIT_IN_PROGRESS, pf->state))
+- return;
+-
+ dev = ice_pf_to_dev(pf);
+ if (ice_validate_vf_id(pf, vf_id)) {
+ err = -EINVAL;
--- /dev/null
+From 932645c298c41aad64ef13016ff4c2034eef5aed Mon Sep 17 00:00:00 2001
+From: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Date: Mon, 3 Jan 2022 07:41:21 +0100
+Subject: ice: fix setting l4 port flag when adding filter
+
+From: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+
+commit 932645c298c41aad64ef13016ff4c2034eef5aed upstream.
+
+Accidentally filter flag for none encapsulated l4 port field is always
+set. Even if user wants to add encapsulated l4 port field.
+
+Remove this unnecessary flag setting.
+
+Fixes: 9e300987d4a81 ("ice: VXLAN and Geneve TC support")
+Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_tc_lib.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
+@@ -711,7 +711,7 @@ ice_tc_set_port(struct flow_match_ports
+ fltr->flags |= ICE_TC_FLWR_FIELD_ENC_DEST_L4_PORT;
+ else
+ fltr->flags |= ICE_TC_FLWR_FIELD_DEST_L4_PORT;
+- fltr->flags |= ICE_TC_FLWR_FIELD_DEST_L4_PORT;
++
+ headers->l4_key.dst_port = match.key->dst;
+ headers->l4_mask.dst_port = match.mask->dst;
+ }
+@@ -720,7 +720,7 @@ ice_tc_set_port(struct flow_match_ports
+ fltr->flags |= ICE_TC_FLWR_FIELD_ENC_SRC_L4_PORT;
+ else
+ fltr->flags |= ICE_TC_FLWR_FIELD_SRC_L4_PORT;
+- fltr->flags |= ICE_TC_FLWR_FIELD_SRC_L4_PORT;
++
+ headers->l4_key.src_port = match.key->src;
+ headers->l4_mask.src_port = match.mask->src;
+ }
--- /dev/null
+From 5950bdc88dd1d158f2845fdff8fb1de86476806c Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Mon, 14 Feb 2022 07:40:43 -0800
+Subject: ice: initialize local variable 'tlv'
+
+From: Tom Rix <trix@redhat.com>
+
+commit 5950bdc88dd1d158f2845fdff8fb1de86476806c upstream.
+
+Clang static analysis reports this issues
+ice_common.c:5008:21: warning: The left expression of the compound
+ assignment is an uninitialized value. The computed value will
+ also be garbage
+ ldo->phy_type_low |= ((u64)buf << (i * 16));
+ ~~~~~~~~~~~~~~~~~ ^
+
+When called from ice_cfg_phy_fec() ldo is the uninitialized local
+variable tlv. So initialize.
+
+Fixes: ea78ce4dab05 ("ice: add link lenient and default override support")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Tested-by: Gurucharan G <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_common.c
++++ b/drivers/net/ethernet/intel/ice/ice_common.c
+@@ -3319,7 +3319,7 @@ ice_cfg_phy_fec(struct ice_port_info *pi
+
+ if (fec == ICE_FEC_AUTO && ice_fw_supports_link_override(hw) &&
+ !ice_fw_supports_report_dflt_cfg(hw)) {
+- struct ice_link_default_override_tlv tlv;
++ struct ice_link_default_override_tlv tlv = { 0 };
+
+ status = ice_get_link_default_override(&tlv, pi);
+ if (status)
--- /dev/null
+From f240762f88b4b1b58561939ffd44837759756477 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 14 Feb 2022 20:10:03 -0800
+Subject: io_uring: add a schedule point in io_add_buffers()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit f240762f88b4b1b58561939ffd44837759756477 upstream.
+
+Looping ~65535 times doing kmalloc() calls can trigger soft lockups,
+especially with DEBUG features (like KASAN).
+
+[ 253.536212] watchdog: BUG: soft lockup - CPU#64 stuck for 26s! [b219417889:12575]
+[ 253.544433] Modules linked in: vfat fat i2c_mux_pca954x i2c_mux spidev cdc_acm xhci_pci xhci_hcd sha3_generic gq(O)
+[ 253.544451] CPU: 64 PID: 12575 Comm: b219417889 Tainted: G S O 5.17.0-smp-DEV #801
+[ 253.544457] RIP: 0010:kernel_text_address (./include/asm-generic/sections.h:192 ./include/linux/kallsyms.h:29 kernel/extable.c:67 kernel/extable.c:98)
+[ 253.544464] Code: 0f 93 c0 48 c7 c1 e0 63 d7 a4 48 39 cb 0f 92 c1 20 c1 0f b6 c1 5b 5d c3 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 53 48 89 fb <48> c7 c0 00 00 80 a0 41 be 01 00 00 00 48 39 c7 72 0c 48 c7 c0 40
+[ 253.544468] RSP: 0018:ffff8882d8baf4c0 EFLAGS: 00000246
+[ 253.544471] RAX: 1ffff1105b175e00 RBX: ffffffffa13ef09a RCX: 00000000a13ef001
+[ 253.544474] RDX: ffffffffa13ef09a RSI: ffff8882d8baf558 RDI: ffffffffa13ef09a
+[ 253.544476] RBP: ffff8882d8baf4d8 R08: ffff8882d8baf5e0 R09: 0000000000000004
+[ 253.544479] R10: ffff8882d8baf5e8 R11: ffffffffa0d59a50 R12: ffff8882eab20380
+[ 253.544481] R13: ffffffffa0d59a50 R14: dffffc0000000000 R15: 1ffff1105b175eb0
+[ 253.544483] FS: 00000000016d3380(0000) GS:ffff88af48c00000(0000) knlGS:0000000000000000
+[ 253.544486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 253.544488] CR2: 00000000004af0f0 CR3: 00000002eabfa004 CR4: 00000000003706e0
+[ 253.544491] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 253.544492] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 253.544494] Call Trace:
+[ 253.544496] <TASK>
+[ 253.544498] ? io_queue_sqe (fs/io_uring.c:7143)
+[ 253.544505] __kernel_text_address (kernel/extable.c:78)
+[ 253.544508] unwind_get_return_address (arch/x86/kernel/unwind_frame.c:19)
+[ 253.544514] arch_stack_walk (arch/x86/kernel/stacktrace.c:27)
+[ 253.544517] ? io_queue_sqe (fs/io_uring.c:7143)
+[ 253.544521] stack_trace_save (kernel/stacktrace.c:123)
+[ 253.544527] ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515)
+[ 253.544531] ? ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:515)
+[ 253.544533] ? __kasan_kmalloc (mm/kasan/common.c:524)
+[ 253.544535] ? kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567)
+[ 253.544541] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828)
+[ 253.544544] ? __io_queue_sqe (fs/io_uring.c:?)
+[ 253.544551] __kasan_kmalloc (mm/kasan/common.c:524)
+[ 253.544553] kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.c:3567)
+[ 253.544556] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828)
+[ 253.544560] io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_uring.c:6828)
+[ 253.544564] ? __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469)
+[ 253.544567] ? __kasan_slab_alloc (mm/kasan/common.c:39 mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469)
+[ 253.544569] ? kmem_cache_alloc_bulk (mm/slab.h:732 mm/slab.c:3546)
+[ 253.544573] ? __io_alloc_req_refill (fs/io_uring.c:2078)
+[ 253.544578] ? io_submit_sqes (fs/io_uring.c:7441)
+[ 253.544581] ? __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uring.c:10096)
+[ 253.544584] ? __x64_sys_io_uring_enter (fs/io_uring.c:10096)
+[ 253.544587] ? do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
+[ 253.544590] ? entry_SYSCALL_64_after_hwframe (??:?)
+[ 253.544596] __io_queue_sqe (fs/io_uring.c:?)
+[ 253.544600] io_queue_sqe (fs/io_uring.c:7143)
+[ 253.544603] io_submit_sqe (fs/io_uring.c:?)
+[ 253.544608] io_submit_sqes (fs/io_uring.c:?)
+[ 253.544612] __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uring.c:10096)
+[ 253.544616] __x64_sys_io_uring_enter (fs/io_uring.c:10096)
+[ 253.544619] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
+[ 253.544623] entry_SYSCALL_64_after_hwframe (??:?)
+
+Fixes: ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Pavel Begunkov <asml.silence@gmail.com>
+Cc: io-uring <io-uring@vger.kernel.org>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Link: https://lore.kernel.org/r/20220215041003.2394784-1-eric.dumazet@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/io_uring.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -4477,6 +4477,7 @@ static int io_add_buffers(struct io_prov
+ } else {
+ list_add_tail(&buf->list, &(*head)->list);
+ }
++ cond_resched();
+ }
+
+ return i ? i : -ENOMEM;
--- /dev/null
+From f73c1194634506ab60af0debef04671fc431a435 Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Fri, 18 Feb 2022 13:35:42 -0800
+Subject: mptcp: add mibs counter for ignored incoming options
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit f73c1194634506ab60af0debef04671fc431a435 upstream.
+
+The MPTCP in kernel path manager has some constraints on incoming
+addresses announce processing, so that in edge scenarios it can
+end-up dropping (ignoring) some of such announces.
+
+The above is not very limiting in practice since such scenarios are
+very uncommon and MPTCP will recover due to ADD_ADDR retransmissions.
+
+This patch adds a few MIB counters to account for such drop events
+to allow easier introspection of the critical scenarios.
+
+Fixes: f7efc7771eac ("mptcp: drop argument port from mptcp_pm_announce_addr")
+Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/mib.c | 2 ++
+ net/mptcp/mib.h | 2 ++
+ net/mptcp/pm.c | 8 ++++++--
+ 3 files changed, 10 insertions(+), 2 deletions(-)
+
+--- a/net/mptcp/mib.c
++++ b/net/mptcp/mib.c
+@@ -35,12 +35,14 @@ static const struct snmp_mib mptcp_snmp_
+ SNMP_MIB_ITEM("AddAddr", MPTCP_MIB_ADDADDR),
+ SNMP_MIB_ITEM("EchoAdd", MPTCP_MIB_ECHOADD),
+ SNMP_MIB_ITEM("PortAdd", MPTCP_MIB_PORTADD),
++ SNMP_MIB_ITEM("AddAddrDrop", MPTCP_MIB_ADDADDRDROP),
+ SNMP_MIB_ITEM("MPJoinPortSynRx", MPTCP_MIB_JOINPORTSYNRX),
+ SNMP_MIB_ITEM("MPJoinPortSynAckRx", MPTCP_MIB_JOINPORTSYNACKRX),
+ SNMP_MIB_ITEM("MPJoinPortAckRx", MPTCP_MIB_JOINPORTACKRX),
+ SNMP_MIB_ITEM("MismatchPortSynRx", MPTCP_MIB_MISMATCHPORTSYNRX),
+ SNMP_MIB_ITEM("MismatchPortAckRx", MPTCP_MIB_MISMATCHPORTACKRX),
+ SNMP_MIB_ITEM("RmAddr", MPTCP_MIB_RMADDR),
++ SNMP_MIB_ITEM("RmAddrDrop", MPTCP_MIB_RMADDRDROP),
+ SNMP_MIB_ITEM("RmSubflow", MPTCP_MIB_RMSUBFLOW),
+ SNMP_MIB_ITEM("MPPrioTx", MPTCP_MIB_MPPRIOTX),
+ SNMP_MIB_ITEM("MPPrioRx", MPTCP_MIB_MPPRIORX),
+--- a/net/mptcp/mib.h
++++ b/net/mptcp/mib.h
+@@ -28,12 +28,14 @@ enum linux_mptcp_mib_field {
+ MPTCP_MIB_ADDADDR, /* Received ADD_ADDR with echo-flag=0 */
+ MPTCP_MIB_ECHOADD, /* Received ADD_ADDR with echo-flag=1 */
+ MPTCP_MIB_PORTADD, /* Received ADD_ADDR with a port-number */
++ MPTCP_MIB_ADDADDRDROP, /* Dropped incoming ADD_ADDR */
+ MPTCP_MIB_JOINPORTSYNRX, /* Received a SYN MP_JOIN with a different port-number */
+ MPTCP_MIB_JOINPORTSYNACKRX, /* Received a SYNACK MP_JOIN with a different port-number */
+ MPTCP_MIB_JOINPORTACKRX, /* Received an ACK MP_JOIN with a different port-number */
+ MPTCP_MIB_MISMATCHPORTSYNRX, /* Received a SYN MP_JOIN with a mismatched port-number */
+ MPTCP_MIB_MISMATCHPORTACKRX, /* Received an ACK MP_JOIN with a mismatched port-number */
+ MPTCP_MIB_RMADDR, /* Received RM_ADDR */
++ MPTCP_MIB_RMADDRDROP, /* Dropped incoming RM_ADDR */
+ MPTCP_MIB_RMSUBFLOW, /* Remove a subflow */
+ MPTCP_MIB_MPPRIOTX, /* Transmit a MP_PRIO */
+ MPTCP_MIB_MPPRIORX, /* Received a MP_PRIO */
+--- a/net/mptcp/pm.c
++++ b/net/mptcp/pm.c
+@@ -194,6 +194,8 @@ void mptcp_pm_add_addr_received(struct m
+ mptcp_pm_add_addr_send_ack(msk);
+ } else if (mptcp_pm_schedule_work(msk, MPTCP_PM_ADD_ADDR_RECEIVED)) {
+ pm->remote = *addr;
++ } else {
++ __MPTCP_INC_STATS(sock_net((struct sock *)msk), MPTCP_MIB_ADDADDRDROP);
+ }
+
+ spin_unlock_bh(&pm->lock);
+@@ -234,8 +236,10 @@ void mptcp_pm_rm_addr_received(struct mp
+ mptcp_event_addr_removed(msk, rm_list->ids[i]);
+
+ spin_lock_bh(&pm->lock);
+- mptcp_pm_schedule_work(msk, MPTCP_PM_RM_ADDR_RECEIVED);
+- pm->rm_list_rx = *rm_list;
++ if (mptcp_pm_schedule_work(msk, MPTCP_PM_RM_ADDR_RECEIVED))
++ pm->rm_list_rx = *rm_list;
++ else
++ __MPTCP_INC_STATS(sock_net((struct sock *)msk), MPTCP_MIB_RMADDRDROP);
+ spin_unlock_bh(&pm->lock);
+ }
+
--- /dev/null
+From 837cf45df163a3780bc04b555700231e95b31dc9 Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Fri, 18 Feb 2022 13:35:41 -0800
+Subject: mptcp: fix race in incoming ADD_ADDR option processing
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 837cf45df163a3780bc04b555700231e95b31dc9 upstream.
+
+If an MPTCP endpoint received multiple consecutive incoming
+ADD_ADDR options, mptcp_pm_add_addr_received() can overwrite
+the current remote address value after the PM lock is released
+in mptcp_pm_nl_add_addr_received() and before such address
+is echoed.
+
+Fix the issue caching the remote address value a little earlier
+and always using the cached value after releasing the PM lock.
+
+Fixes: f7efc7771eac ("mptcp: drop argument port from mptcp_pm_announce_addr")
+Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/pm_netlink.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/net/mptcp/pm_netlink.c
++++ b/net/mptcp/pm_netlink.c
+@@ -606,6 +606,7 @@ static void mptcp_pm_nl_add_addr_receive
+ unsigned int add_addr_accept_max;
+ struct mptcp_addr_info remote;
+ unsigned int subflows_max;
++ bool reset_port = false;
+ int i, nr;
+
+ add_addr_accept_max = mptcp_pm_get_add_addr_accept_max(msk);
+@@ -615,15 +616,19 @@ static void mptcp_pm_nl_add_addr_receive
+ msk->pm.add_addr_accepted, add_addr_accept_max,
+ msk->pm.remote.family);
+
+- if (lookup_subflow_by_daddr(&msk->conn_list, &msk->pm.remote))
++ remote = msk->pm.remote;
++ if (lookup_subflow_by_daddr(&msk->conn_list, &remote))
+ goto add_addr_echo;
+
++ /* pick id 0 port, if none is provided the remote address */
++ if (!remote.port) {
++ reset_port = true;
++ remote.port = sk->sk_dport;
++ }
++
+ /* connect to the specified remote address, using whatever
+ * local address the routing configuration will pick.
+ */
+- remote = msk->pm.remote;
+- if (!remote.port)
+- remote.port = sk->sk_dport;
+ nr = fill_local_addresses_vec(msk, addrs);
+
+ msk->pm.add_addr_accepted++;
+@@ -636,8 +641,12 @@ static void mptcp_pm_nl_add_addr_receive
+ __mptcp_subflow_connect(sk, &addrs[i], &remote);
+ spin_lock_bh(&msk->pm.lock);
+
++ /* be sure to echo exactly the received address */
++ if (reset_port)
++ remote.port = 0;
++
+ add_addr_echo:
+- mptcp_pm_announce_addr(msk, &msk->pm.remote, true);
++ mptcp_pm_announce_addr(msk, &remote, true);
+ mptcp_pm_nl_addr_send_ack(msk);
+ }
+
--- /dev/null
+From ef527f968ae05c6717c39f49c8709a7e2c19183a Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sun, 20 Feb 2022 07:40:52 -0800
+Subject: net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit ef527f968ae05c6717c39f49c8709a7e2c19183a upstream.
+
+Whenever one of these functions pull all data from an skb in a frag_list,
+use consume_skb() instead of kfree_skb() to avoid polluting drop
+monitoring.
+
+Fixes: 6fa01ccd8830 ("skbuff: Add pskb_extract() helper function")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20220220154052.1308469-1-eric.dumazet@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/skbuff.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2254,7 +2254,7 @@ void *__pskb_pull_tail(struct sk_buff *s
+ /* Free pulled out fragments. */
+ while ((list = skb_shinfo(skb)->frag_list) != insp) {
+ skb_shinfo(skb)->frag_list = list->next;
+- kfree_skb(list);
++ consume_skb(list);
+ }
+ /* And insert new clone at head. */
+ if (clone) {
+@@ -6227,7 +6227,7 @@ static int pskb_carve_frag_list(struct s
+ /* Free pulled out fragments. */
+ while ((list = shinfo->frag_list) != insp) {
+ shinfo->frag_list = list->next;
+- kfree_skb(list);
++ consume_skb(list);
+ }
+ /* And insert new clone at head. */
+ if (clone) {
--- /dev/null
+From 8940e6b669ca1196ce0a0549c819078096390f76 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Fri, 18 Feb 2022 14:13:02 +0200
+Subject: net: dsa: avoid call to __dev_set_promiscuity() while rtnl_mutex isn't held
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit 8940e6b669ca1196ce0a0549c819078096390f76 upstream.
+
+If the DSA master doesn't support IFF_UNICAST_FLT, then the following
+call path is possible:
+
+dsa_slave_switchdev_event_work
+-> dsa_port_host_fdb_add
+ -> dev_uc_add
+ -> __dev_set_rx_mode
+ -> __dev_set_promiscuity
+
+Since the blamed commit, dsa_slave_switchdev_event_work() no longer
+holds rtnl_lock(), which triggers the ASSERT_RTNL() from
+__dev_set_promiscuity().
+
+Taking rtnl_lock() around dev_uc_add() is impossible, because all the
+code paths that call dsa_flush_workqueue() do so from contexts where the
+rtnl_mutex is already held - so this would lead to an instant deadlock.
+
+dev_uc_add() in itself doesn't require the rtnl_mutex for protection.
+There is this comment in __dev_set_rx_mode() which assumes so:
+
+ /* Unicast addresses changes may only happen under the rtnl,
+ * therefore calling __dev_set_promiscuity here is safe.
+ */
+
+but it is from commit 4417da668c00 ("[NET]: dev: secondary unicast
+address support") dated June 2007, and in the meantime, commit
+f1f28aa3510d ("netdev: Add addr_list_lock to struct net_device."), dated
+July 2008, has added &dev->addr_list_lock to protect this instead of the
+global rtnl_mutex.
+
+Nonetheless, __dev_set_promiscuity() does assume rtnl_mutex protection,
+but it is the uncommon path of what we typically expect dev_uc_add()
+to do. So since only the uncommon path requires rtnl_lock(), just check
+ahead of time whether dev_uc_add() would result into a call to
+__dev_set_promiscuity(), and handle that condition separately.
+
+DSA already configures the master interface to be promiscuous if the
+tagger requires this. We can extend this to also cover the case where
+the master doesn't handle dev_uc_add() (doesn't support IFF_UNICAST_FLT),
+and on the premise that we'd end up making it promiscuous during
+operation anyway, either if a DSA slave has a non-inherited MAC address,
+or if the bridge notifies local FDB entries for its own MAC address, the
+address of a station learned on a foreign port, etc.
+
+Fixes: 0faf890fc519 ("net: dsa: drop rtnl_lock from dsa_slave_switchdev_event_work")
+Reported-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dsa/master.c | 7 ++++++-
+ net/dsa/port.c | 20 ++++++++++++++------
+ 2 files changed, 20 insertions(+), 7 deletions(-)
+
+--- a/net/dsa/master.c
++++ b/net/dsa/master.c
+@@ -260,11 +260,16 @@ static void dsa_netdev_ops_set(struct ne
+ dev->dsa_ptr->netdev_ops = ops;
+ }
+
++/* Keep the master always promiscuous if the tagging protocol requires that
++ * (garbles MAC DA) or if it doesn't support unicast filtering, case in which
++ * it would revert to promiscuous mode as soon as we call dev_uc_add() on it
++ * anyway.
++ */
+ static void dsa_master_set_promiscuity(struct net_device *dev, int inc)
+ {
+ const struct dsa_device_ops *ops = dev->dsa_ptr->tag_ops;
+
+- if (!ops->promisc_on_master)
++ if ((dev->priv_flags & IFF_UNICAST_FLT) && !ops->promisc_on_master)
+ return;
+
+ rtnl_lock();
+--- a/net/dsa/port.c
++++ b/net/dsa/port.c
+@@ -777,9 +777,15 @@ int dsa_port_host_fdb_add(struct dsa_por
+ struct dsa_port *cpu_dp = dp->cpu_dp;
+ int err;
+
+- err = dev_uc_add(cpu_dp->master, addr);
+- if (err)
+- return err;
++ /* Avoid a call to __dev_set_promiscuity() on the master, which
++ * requires rtnl_lock(), since we can't guarantee that is held here,
++ * and we can't take it either.
++ */
++ if (cpu_dp->master->priv_flags & IFF_UNICAST_FLT) {
++ err = dev_uc_add(cpu_dp->master, addr);
++ if (err)
++ return err;
++ }
+
+ return dsa_port_notify(dp, DSA_NOTIFIER_HOST_FDB_ADD, &info);
+ }
+@@ -796,9 +802,11 @@ int dsa_port_host_fdb_del(struct dsa_por
+ struct dsa_port *cpu_dp = dp->cpu_dp;
+ int err;
+
+- err = dev_uc_del(cpu_dp->master, addr);
+- if (err)
+- return err;
++ if (cpu_dp->master->priv_flags & IFF_UNICAST_FLT) {
++ err = dev_uc_del(cpu_dp->master, addr);
++ if (err)
++ return err;
++ }
+
+ return dsa_port_notify(dp, DSA_NOTIFIER_HOST_FDB_DEL, &info);
+ }
--- /dev/null
+From 5486f5bf790b5c664913076c3194b8f916a5c7ad Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+Date: Thu, 17 Feb 2022 14:35:49 +0100
+Subject: net: Force inlining of checksum functions in net/checksum.h
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+commit 5486f5bf790b5c664913076c3194b8f916a5c7ad upstream.
+
+All functions defined as static inline in net/checksum.h are
+meant to be inlined for performance reason.
+
+But since commit ac7c3e4ff401 ("compiler: enable
+CONFIG_OPTIMIZE_INLINING forcibly") the compiler is allowed to
+uninline functions when it wants.
+
+Fair enough in the general case, but for tiny performance critical
+checksum helpers that's counter-productive.
+
+The problem mainly arises when selecting CONFIG_CC_OPTIMISE_FOR_SIZE,
+Those helpers being 'static inline' in header files you suddenly find
+them duplicated many times in the resulting vmlinux.
+
+Here is a typical exemple when building powerpc pmac32_defconfig
+with CONFIG_CC_OPTIMISE_FOR_SIZE. csum_sub() appears 4 times:
+
+ c04a23cc <csum_sub>:
+ c04a23cc: 7c 84 20 f8 not r4,r4
+ c04a23d0: 7c 63 20 14 addc r3,r3,r4
+ c04a23d4: 7c 63 01 94 addze r3,r3
+ c04a23d8: 4e 80 00 20 blr
+ ...
+ c04a2ce8: 4b ff f6 e5 bl c04a23cc <csum_sub>
+ ...
+ c04a2d2c: 4b ff f6 a1 bl c04a23cc <csum_sub>
+ ...
+ c04a2d54: 4b ff f6 79 bl c04a23cc <csum_sub>
+ ...
+ c04a754c <csum_sub>:
+ c04a754c: 7c 84 20 f8 not r4,r4
+ c04a7550: 7c 63 20 14 addc r3,r3,r4
+ c04a7554: 7c 63 01 94 addze r3,r3
+ c04a7558: 4e 80 00 20 blr
+ ...
+ c04ac930: 4b ff ac 1d bl c04a754c <csum_sub>
+ ...
+ c04ad264: 4b ff a2 e9 bl c04a754c <csum_sub>
+ ...
+ c04e3b08 <csum_sub>:
+ c04e3b08: 7c 84 20 f8 not r4,r4
+ c04e3b0c: 7c 63 20 14 addc r3,r3,r4
+ c04e3b10: 7c 63 01 94 addze r3,r3
+ c04e3b14: 4e 80 00 20 blr
+ ...
+ c04e5788: 4b ff e3 81 bl c04e3b08 <csum_sub>
+ ...
+ c04e65c8: 4b ff d5 41 bl c04e3b08 <csum_sub>
+ ...
+ c0512d34 <csum_sub>:
+ c0512d34: 7c 84 20 f8 not r4,r4
+ c0512d38: 7c 63 20 14 addc r3,r3,r4
+ c0512d3c: 7c 63 01 94 addze r3,r3
+ c0512d40: 4e 80 00 20 blr
+ ...
+ c0512dfc: 4b ff ff 39 bl c0512d34 <csum_sub>
+ ...
+ c05138bc: 4b ff f4 79 bl c0512d34 <csum_sub>
+ ...
+
+Restore the expected behaviour by using __always_inline for all
+functions defined in net/checksum.h
+
+vmlinux size is even reduced by 256 bytes with this patch:
+
+ text data bss dec hex filename
+ 6980022 2515362 194384 9689768 93daa8 vmlinux.before
+ 6979862 2515266 194384 9689512 93d9a8 vmlinux.now
+
+Fixes: ac7c3e4ff401 ("compiler: enable CONFIG_OPTIMIZE_INLINING forcibly")
+Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/checksum.h | 45 +++++++++++++++++++++++----------------------
+ 1 file changed, 23 insertions(+), 22 deletions(-)
+
+--- a/include/net/checksum.h
++++ b/include/net/checksum.h
+@@ -22,7 +22,7 @@
+ #include <asm/checksum.h>
+
+ #ifndef _HAVE_ARCH_COPY_AND_CSUM_FROM_USER
+-static inline
++static __always_inline
+ __wsum csum_and_copy_from_user (const void __user *src, void *dst,
+ int len)
+ {
+@@ -33,7 +33,7 @@ __wsum csum_and_copy_from_user (const vo
+ #endif
+
+ #ifndef HAVE_CSUM_COPY_USER
+-static __inline__ __wsum csum_and_copy_to_user
++static __always_inline __wsum csum_and_copy_to_user
+ (const void *src, void __user *dst, int len)
+ {
+ __wsum sum = csum_partial(src, len, ~0U);
+@@ -45,7 +45,7 @@ static __inline__ __wsum csum_and_copy_t
+ #endif
+
+ #ifndef _HAVE_ARCH_CSUM_AND_COPY
+-static inline __wsum
++static __always_inline __wsum
+ csum_partial_copy_nocheck(const void *src, void *dst, int len)
+ {
+ memcpy(dst, src, len);
+@@ -54,7 +54,7 @@ csum_partial_copy_nocheck(const void *sr
+ #endif
+
+ #ifndef HAVE_ARCH_CSUM_ADD
+-static inline __wsum csum_add(__wsum csum, __wsum addend)
++static __always_inline __wsum csum_add(__wsum csum, __wsum addend)
+ {
+ u32 res = (__force u32)csum;
+ res += (__force u32)addend;
+@@ -62,12 +62,12 @@ static inline __wsum csum_add(__wsum csu
+ }
+ #endif
+
+-static inline __wsum csum_sub(__wsum csum, __wsum addend)
++static __always_inline __wsum csum_sub(__wsum csum, __wsum addend)
+ {
+ return csum_add(csum, ~addend);
+ }
+
+-static inline __sum16 csum16_add(__sum16 csum, __be16 addend)
++static __always_inline __sum16 csum16_add(__sum16 csum, __be16 addend)
+ {
+ u16 res = (__force u16)csum;
+
+@@ -75,12 +75,12 @@ static inline __sum16 csum16_add(__sum16
+ return (__force __sum16)(res + (res < (__force u16)addend));
+ }
+
+-static inline __sum16 csum16_sub(__sum16 csum, __be16 addend)
++static __always_inline __sum16 csum16_sub(__sum16 csum, __be16 addend)
+ {
+ return csum16_add(csum, ~addend);
+ }
+
+-static inline __wsum csum_shift(__wsum sum, int offset)
++static __always_inline __wsum csum_shift(__wsum sum, int offset)
+ {
+ /* rotate sum to align it with a 16b boundary */
+ if (offset & 1)
+@@ -88,42 +88,43 @@ static inline __wsum csum_shift(__wsum s
+ return sum;
+ }
+
+-static inline __wsum
++static __always_inline __wsum
+ csum_block_add(__wsum csum, __wsum csum2, int offset)
+ {
+ return csum_add(csum, csum_shift(csum2, offset));
+ }
+
+-static inline __wsum
++static __always_inline __wsum
+ csum_block_add_ext(__wsum csum, __wsum csum2, int offset, int len)
+ {
+ return csum_block_add(csum, csum2, offset);
+ }
+
+-static inline __wsum
++static __always_inline __wsum
+ csum_block_sub(__wsum csum, __wsum csum2, int offset)
+ {
+ return csum_block_add(csum, ~csum2, offset);
+ }
+
+-static inline __wsum csum_unfold(__sum16 n)
++static __always_inline __wsum csum_unfold(__sum16 n)
+ {
+ return (__force __wsum)n;
+ }
+
+-static inline __wsum csum_partial_ext(const void *buff, int len, __wsum sum)
++static __always_inline
++__wsum csum_partial_ext(const void *buff, int len, __wsum sum)
+ {
+ return csum_partial(buff, len, sum);
+ }
+
+ #define CSUM_MANGLED_0 ((__force __sum16)0xffff)
+
+-static inline void csum_replace_by_diff(__sum16 *sum, __wsum diff)
++static __always_inline void csum_replace_by_diff(__sum16 *sum, __wsum diff)
+ {
+ *sum = csum_fold(csum_add(diff, ~csum_unfold(*sum)));
+ }
+
+-static inline void csum_replace4(__sum16 *sum, __be32 from, __be32 to)
++static __always_inline void csum_replace4(__sum16 *sum, __be32 from, __be32 to)
+ {
+ __wsum tmp = csum_sub(~csum_unfold(*sum), (__force __wsum)from);
+
+@@ -136,7 +137,7 @@ static inline void csum_replace4(__sum16
+ * m : old value of a 16bit field
+ * m' : new value of a 16bit field
+ */
+-static inline void csum_replace2(__sum16 *sum, __be16 old, __be16 new)
++static __always_inline void csum_replace2(__sum16 *sum, __be16 old, __be16 new)
+ {
+ *sum = ~csum16_add(csum16_sub(~(*sum), old), new);
+ }
+@@ -155,16 +156,16 @@ void inet_proto_csum_replace16(__sum16 *
+ void inet_proto_csum_replace_by_diff(__sum16 *sum, struct sk_buff *skb,
+ __wsum diff, bool pseudohdr);
+
+-static inline void inet_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb,
+- __be16 from, __be16 to,
+- bool pseudohdr)
++static __always_inline
++void inet_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb,
++ __be16 from, __be16 to, bool pseudohdr)
+ {
+ inet_proto_csum_replace4(sum, skb, (__force __be32)from,
+ (__force __be32)to, pseudohdr);
+ }
+
+-static inline __wsum remcsum_adjust(void *ptr, __wsum csum,
+- int start, int offset)
++static __always_inline __wsum remcsum_adjust(void *ptr, __wsum csum,
++ int start, int offset)
+ {
+ __sum16 *psum = (__sum16 *)(ptr + offset);
+ __wsum delta;
+@@ -180,7 +181,7 @@ static inline __wsum remcsum_adjust(void
+ return delta;
+ }
+
+-static inline void remcsum_unadjust(__sum16 *psum, __wsum delta)
++static __always_inline void remcsum_unadjust(__sum16 *psum, __wsum delta)
+ {
+ *psum = csum_fold(csum_sub(delta, (__force __wsum)*psum));
+ }
--- /dev/null
+From b352c3465bb808ab700d03f5bac2f7a6f37c5350 Mon Sep 17 00:00:00 2001
+From: Xiaoke Wang <xkernel.wang@foxmail.com>
+Date: Fri, 18 Feb 2022 10:19:39 +0800
+Subject: net: ll_temac: check the return value of devm_kmalloc()
+
+From: Xiaoke Wang <xkernel.wang@foxmail.com>
+
+commit b352c3465bb808ab700d03f5bac2f7a6f37c5350 upstream.
+
+devm_kmalloc() returns a pointer to allocated memory on success, NULL
+on failure. While lp->indirect_lock is allocated by devm_kmalloc()
+without proper check. It is better to check the value of it to
+prevent potential wrong memory access.
+
+Fixes: f14f5c11f051 ("net: ll_temac: Support indirect_mutex share within TEMAC IP")
+Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/xilinx/ll_temac_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -1427,6 +1427,8 @@ static int temac_probe(struct platform_d
+ lp->indirect_lock = devm_kmalloc(&pdev->dev,
+ sizeof(*lp->indirect_lock),
+ GFP_KERNEL);
++ if (!lp->indirect_lock)
++ return -ENOMEM;
+ spin_lock_init(lp->indirect_lock);
+ }
+
--- /dev/null
+From b6ad6261d27708567b309fdb3102b12c42a070cc Mon Sep 17 00:00:00 2001
+From: Baruch Siach <baruch.siach@siklu.com>
+Date: Mon, 21 Feb 2022 13:45:57 +0200
+Subject: net: mdio-ipq4019: add delay after clock enable
+
+From: Baruch Siach <baruch.siach@siklu.com>
+
+commit b6ad6261d27708567b309fdb3102b12c42a070cc upstream.
+
+Experimentation shows that PHY detect might fail when the code attempts
+MDIO bus read immediately after clock enable. Add delay to stabilize the
+clock before bus access.
+
+PHY detect failure started to show after commit 7590fc6f80ac ("net:
+mdio: Demote probed message to debug print") that removed coincidental
+delay between clock enable and bus access.
+
+10ms is meant to match the time it take to send the probed message over
+UART at 115200 bps. This might be a far overshoot.
+
+Fixes: 23a890d493e3 ("net: mdio: Add the reset function for IPQ MDIO driver")
+Signed-off-by: Baruch Siach <baruch.siach@siklu.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/mdio/mdio-ipq4019.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/mdio/mdio-ipq4019.c
++++ b/drivers/net/mdio/mdio-ipq4019.c
+@@ -200,7 +200,11 @@ static int ipq_mdio_reset(struct mii_bus
+ if (ret)
+ return ret;
+
+- return clk_prepare_enable(priv->mdio_clk);
++ ret = clk_prepare_enable(priv->mdio_clk);
++ if (ret == 0)
++ mdelay(10);
++
++ return ret;
+ }
+
+ static int ipq4019_mdio_probe(struct platform_device *pdev)
--- /dev/null
+From e5b2bc30c21139ae10f0e56989389d0bc7b7b1d6 Mon Sep 17 00:00:00 2001
+From: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Date: Fri, 24 Dec 2021 01:07:30 +0200
+Subject: net/mlx5: DR, Cache STE shadow memory
+
+From: Yevgeny Kliteynik <kliteyn@nvidia.com>
+
+commit e5b2bc30c21139ae10f0e56989389d0bc7b7b1d6 upstream.
+
+During rule insertion on each ICM memory chunk we also allocate shadow memory
+used for management. This includes the hw_ste, dr_ste and miss list per entry.
+Since the scale of these allocations is large we noticed a performance hiccup
+that happens once malloc and free are stressed.
+In extreme usecases when ~1M chunks are freed at once, it might take up to 40
+seconds to complete this, up to the point the kernel sees this as self-detected
+stall on CPU:
+
+ rcu: INFO: rcu_sched self-detected stall on CPU
+
+To resolve this we will increase the reuse of shadow memory.
+Doing this we see that a time in the aforementioned usecase dropped from ~40
+seconds to ~8-10 seconds.
+
+Fixes: 29cf8febd185 ("net/mlx5: DR, ICM pool memory allocator")
+Signed-off-by: Alex Vesker <valex@nvidia.com>
+Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/steering/dr_icm_pool.c | 109 ++++++----
+ drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h | 5
+ 2 files changed, 79 insertions(+), 35 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_icm_pool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_icm_pool.c
+@@ -136,37 +136,35 @@ static void dr_icm_pool_mr_destroy(struc
+ kvfree(icm_mr);
+ }
+
+-static int dr_icm_chunk_ste_init(struct mlx5dr_icm_chunk *chunk)
++static int dr_icm_buddy_get_ste_size(struct mlx5dr_icm_buddy_mem *buddy)
+ {
+- chunk->ste_arr = kvzalloc(chunk->num_of_entries *
+- sizeof(chunk->ste_arr[0]), GFP_KERNEL);
+- if (!chunk->ste_arr)
+- return -ENOMEM;
+-
+- chunk->hw_ste_arr = kvzalloc(chunk->num_of_entries *
+- DR_STE_SIZE_REDUCED, GFP_KERNEL);
+- if (!chunk->hw_ste_arr)
+- goto out_free_ste_arr;
+-
+- chunk->miss_list = kvmalloc(chunk->num_of_entries *
+- sizeof(chunk->miss_list[0]), GFP_KERNEL);
+- if (!chunk->miss_list)
+- goto out_free_hw_ste_arr;
++ /* We support only one type of STE size, both for ConnectX-5 and later
++ * devices. Once the support for match STE which has a larger tag is
++ * added (32B instead of 16B), the STE size for devices later than
++ * ConnectX-5 needs to account for that.
++ */
++ return DR_STE_SIZE_REDUCED;
++}
+
+- return 0;
++static void dr_icm_chunk_ste_init(struct mlx5dr_icm_chunk *chunk, int offset)
++{
++ struct mlx5dr_icm_buddy_mem *buddy = chunk->buddy_mem;
++ int index = offset / DR_STE_SIZE;
+
+-out_free_hw_ste_arr:
+- kvfree(chunk->hw_ste_arr);
+-out_free_ste_arr:
+- kvfree(chunk->ste_arr);
+- return -ENOMEM;
++ chunk->ste_arr = &buddy->ste_arr[index];
++ chunk->miss_list = &buddy->miss_list[index];
++ chunk->hw_ste_arr = buddy->hw_ste_arr +
++ index * dr_icm_buddy_get_ste_size(buddy);
+ }
+
+ static void dr_icm_chunk_ste_cleanup(struct mlx5dr_icm_chunk *chunk)
+ {
+- kvfree(chunk->miss_list);
+- kvfree(chunk->hw_ste_arr);
+- kvfree(chunk->ste_arr);
++ struct mlx5dr_icm_buddy_mem *buddy = chunk->buddy_mem;
++
++ memset(chunk->hw_ste_arr, 0,
++ chunk->num_of_entries * dr_icm_buddy_get_ste_size(buddy));
++ memset(chunk->ste_arr, 0,
++ chunk->num_of_entries * sizeof(chunk->ste_arr[0]));
+ }
+
+ static enum mlx5dr_icm_type
+@@ -189,6 +187,44 @@ static void dr_icm_chunk_destroy(struct
+ kvfree(chunk);
+ }
+
++static int dr_icm_buddy_init_ste_cache(struct mlx5dr_icm_buddy_mem *buddy)
++{
++ int num_of_entries =
++ mlx5dr_icm_pool_chunk_size_to_entries(buddy->pool->max_log_chunk_sz);
++
++ buddy->ste_arr = kvcalloc(num_of_entries,
++ sizeof(struct mlx5dr_ste), GFP_KERNEL);
++ if (!buddy->ste_arr)
++ return -ENOMEM;
++
++ /* Preallocate full STE size on non-ConnectX-5 devices since
++ * we need to support both full and reduced with the same cache.
++ */
++ buddy->hw_ste_arr = kvcalloc(num_of_entries,
++ dr_icm_buddy_get_ste_size(buddy), GFP_KERNEL);
++ if (!buddy->hw_ste_arr)
++ goto free_ste_arr;
++
++ buddy->miss_list = kvmalloc(num_of_entries * sizeof(struct list_head), GFP_KERNEL);
++ if (!buddy->miss_list)
++ goto free_hw_ste_arr;
++
++ return 0;
++
++free_hw_ste_arr:
++ kvfree(buddy->hw_ste_arr);
++free_ste_arr:
++ kvfree(buddy->ste_arr);
++ return -ENOMEM;
++}
++
++static void dr_icm_buddy_cleanup_ste_cache(struct mlx5dr_icm_buddy_mem *buddy)
++{
++ kvfree(buddy->ste_arr);
++ kvfree(buddy->hw_ste_arr);
++ kvfree(buddy->miss_list);
++}
++
+ static int dr_icm_buddy_create(struct mlx5dr_icm_pool *pool)
+ {
+ struct mlx5dr_icm_buddy_mem *buddy;
+@@ -208,11 +244,19 @@ static int dr_icm_buddy_create(struct ml
+ buddy->icm_mr = icm_mr;
+ buddy->pool = pool;
+
++ if (pool->icm_type == DR_ICM_TYPE_STE) {
++ /* Reduce allocations by preallocating and reusing the STE structures */
++ if (dr_icm_buddy_init_ste_cache(buddy))
++ goto err_cleanup_buddy;
++ }
++
+ /* add it to the -start- of the list in order to search in it first */
+ list_add(&buddy->list_node, &pool->buddy_mem_list);
+
+ return 0;
+
++err_cleanup_buddy:
++ mlx5dr_buddy_cleanup(buddy);
+ err_free_buddy:
+ kvfree(buddy);
+ free_mr:
+@@ -234,6 +278,9 @@ static void dr_icm_buddy_destroy(struct
+
+ mlx5dr_buddy_cleanup(buddy);
+
++ if (buddy->pool->icm_type == DR_ICM_TYPE_STE)
++ dr_icm_buddy_cleanup_ste_cache(buddy);
++
+ kvfree(buddy);
+ }
+
+@@ -261,26 +308,18 @@ dr_icm_chunk_create(struct mlx5dr_icm_po
+ chunk->byte_size =
+ mlx5dr_icm_pool_chunk_size_to_byte(chunk_size, pool->icm_type);
+ chunk->seg = seg;
++ chunk->buddy_mem = buddy_mem_pool;
+
+- if (pool->icm_type == DR_ICM_TYPE_STE && dr_icm_chunk_ste_init(chunk)) {
+- mlx5dr_err(pool->dmn,
+- "Failed to init ste arrays (order: %d)\n",
+- chunk_size);
+- goto out_free_chunk;
+- }
++ if (pool->icm_type == DR_ICM_TYPE_STE)
++ dr_icm_chunk_ste_init(chunk, offset);
+
+ buddy_mem_pool->used_memory += chunk->byte_size;
+- chunk->buddy_mem = buddy_mem_pool;
+ INIT_LIST_HEAD(&chunk->chunk_list);
+
+ /* chunk now is part of the used_list */
+ list_add_tail(&chunk->chunk_list, &buddy_mem_pool->used_list);
+
+ return chunk;
+-
+-out_free_chunk:
+- kvfree(chunk);
+- return NULL;
+ }
+
+ static bool dr_icm_pool_is_sync_required(struct mlx5dr_icm_pool *pool)
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h
+@@ -160,6 +160,11 @@ struct mlx5dr_icm_buddy_mem {
+ * sync_ste command sets them free.
+ */
+ struct list_head hot_list;
++
++ /* Memory optimisation */
++ struct mlx5dr_ste *ste_arr;
++ struct list_head *miss_list;
++ u8 *hw_ste_arr;
+ };
+
+ int mlx5dr_buddy_init(struct mlx5dr_icm_buddy_mem *buddy,
--- /dev/null
+From ffb0753b954763d94f52c901adfe58ed0d4005e6 Mon Sep 17 00:00:00 2001
+From: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Date: Thu, 13 Jan 2022 14:52:48 +0200
+Subject: net/mlx5: DR, Don't allow match on IP w/o matching on full ethertype/ip_version
+
+From: Yevgeny Kliteynik <kliteyn@nvidia.com>
+
+commit ffb0753b954763d94f52c901adfe58ed0d4005e6 upstream.
+
+Currently SMFS allows adding rule with matching on src/dst IP w/o matching
+on full ethertype or ip_version, which is not supported by HW.
+This patch fixes this issue and adds the check as it is done in DMFS.
+
+Fixes: 26d688e33f88 ("net/mlx5: DR, Add Steering entry (STE) utilities")
+Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Reviewed-by: Alex Vesker <valex@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/steering/dr_matcher.c | 20 +-----
+ drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c | 32 +++++++++-
+ drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h | 10 +++
+ 3 files changed, 45 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_matcher.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_matcher.c
+@@ -13,18 +13,6 @@ static bool dr_mask_is_dmac_set(struct m
+ return (spec->dmac_47_16 || spec->dmac_15_0);
+ }
+
+-static bool dr_mask_is_src_addr_set(struct mlx5dr_match_spec *spec)
+-{
+- return (spec->src_ip_127_96 || spec->src_ip_95_64 ||
+- spec->src_ip_63_32 || spec->src_ip_31_0);
+-}
+-
+-static bool dr_mask_is_dst_addr_set(struct mlx5dr_match_spec *spec)
+-{
+- return (spec->dst_ip_127_96 || spec->dst_ip_95_64 ||
+- spec->dst_ip_63_32 || spec->dst_ip_31_0);
+-}
+-
+ static bool dr_mask_is_l3_base_set(struct mlx5dr_match_spec *spec)
+ {
+ return (spec->ip_protocol || spec->frag || spec->tcp_flags ||
+@@ -480,11 +468,11 @@ static int dr_matcher_set_ste_builders(s
+ &mask, inner, rx);
+
+ if (outer_ipv == DR_RULE_IPV6) {
+- if (dr_mask_is_dst_addr_set(&mask.outer))
++ if (DR_MASK_IS_DST_IP_SET(&mask.outer))
+ mlx5dr_ste_build_eth_l3_ipv6_dst(ste_ctx, &sb[idx++],
+ &mask, inner, rx);
+
+- if (dr_mask_is_src_addr_set(&mask.outer))
++ if (DR_MASK_IS_SRC_IP_SET(&mask.outer))
+ mlx5dr_ste_build_eth_l3_ipv6_src(ste_ctx, &sb[idx++],
+ &mask, inner, rx);
+
+@@ -580,11 +568,11 @@ static int dr_matcher_set_ste_builders(s
+ &mask, inner, rx);
+
+ if (inner_ipv == DR_RULE_IPV6) {
+- if (dr_mask_is_dst_addr_set(&mask.inner))
++ if (DR_MASK_IS_DST_IP_SET(&mask.inner))
+ mlx5dr_ste_build_eth_l3_ipv6_dst(ste_ctx, &sb[idx++],
+ &mask, inner, rx);
+
+- if (dr_mask_is_src_addr_set(&mask.inner))
++ if (DR_MASK_IS_SRC_IP_SET(&mask.inner))
+ mlx5dr_ste_build_eth_l3_ipv6_src(ste_ctx, &sb[idx++],
+ &mask, inner, rx);
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste.c
+@@ -602,12 +602,34 @@ int mlx5dr_ste_set_action_decap_l3_list(
+ used_hw_action_num);
+ }
+
++static int dr_ste_build_pre_check_spec(struct mlx5dr_domain *dmn,
++ struct mlx5dr_match_spec *spec)
++{
++ if (spec->ip_version) {
++ if (spec->ip_version != 0xf) {
++ mlx5dr_err(dmn,
++ "Partial ip_version mask with src/dst IP is not supported\n");
++ return -EINVAL;
++ }
++ } else if (spec->ethertype != 0xffff &&
++ (DR_MASK_IS_SRC_IP_SET(spec) || DR_MASK_IS_DST_IP_SET(spec))) {
++ mlx5dr_err(dmn,
++ "Partial/no ethertype mask with src/dst IP is not supported\n");
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ int mlx5dr_ste_build_pre_check(struct mlx5dr_domain *dmn,
+ u8 match_criteria,
+ struct mlx5dr_match_param *mask,
+ struct mlx5dr_match_param *value)
+ {
+- if (!value && (match_criteria & DR_MATCHER_CRITERIA_MISC)) {
++ if (value)
++ return 0;
++
++ if (match_criteria & DR_MATCHER_CRITERIA_MISC) {
+ if (mask->misc.source_port && mask->misc.source_port != 0xffff) {
+ mlx5dr_err(dmn,
+ "Partial mask source_port is not supported\n");
+@@ -621,6 +643,14 @@ int mlx5dr_ste_build_pre_check(struct ml
+ }
+ }
+
++ if ((match_criteria & DR_MATCHER_CRITERIA_OUTER) &&
++ dr_ste_build_pre_check_spec(dmn, &mask->outer))
++ return -EINVAL;
++
++ if ((match_criteria & DR_MATCHER_CRITERIA_INNER) &&
++ dr_ste_build_pre_check_spec(dmn, &mask->inner))
++ return -EINVAL;
++
+ return 0;
+ }
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h
+@@ -739,6 +739,16 @@ struct mlx5dr_match_param {
+ (_misc3)->icmpv4_code || \
+ (_misc3)->icmpv4_header_data)
+
++#define DR_MASK_IS_SRC_IP_SET(_spec) ((_spec)->src_ip_127_96 || \
++ (_spec)->src_ip_95_64 || \
++ (_spec)->src_ip_63_32 || \
++ (_spec)->src_ip_31_0)
++
++#define DR_MASK_IS_DST_IP_SET(_spec) ((_spec)->dst_ip_127_96 || \
++ (_spec)->dst_ip_95_64 || \
++ (_spec)->dst_ip_63_32 || \
++ (_spec)->dst_ip_31_0)
++
+ struct mlx5dr_esw_caps {
+ u64 drop_icm_address_rx;
+ u64 drop_icm_address_tx;
--- /dev/null
+From 0aec12d97b2036af0946e3d582144739860ac07b Mon Sep 17 00:00:00 2001
+From: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Date: Tue, 11 Jan 2022 03:00:03 +0200
+Subject: net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte
+
+From: Yevgeny Kliteynik <kliteyn@nvidia.com>
+
+commit 0aec12d97b2036af0946e3d582144739860ac07b upstream.
+
+When adding a rule with 32 destinations, we hit the following out-of-band
+access issue:
+
+ BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70
+
+This patch fixes the issue by both increasing the allocated buffers to
+accommodate for the needed actions and by checking the number of actions
+to prevent this issue when a rule with too many actions is provided.
+
+Fixes: 1ffd498901c1 ("net/mlx5: DR, Increase supported num of actions to 32")
+Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Reviewed-by: Alex Vesker <valex@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c | 33 +++++++++++----
+ 1 file changed, 26 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c
+@@ -222,7 +222,11 @@ static bool contain_vport_reformat_actio
+ dst->dest_attr.vport.flags & MLX5_FLOW_DEST_VPORT_REFORMAT_ID;
+ }
+
+-#define MLX5_FLOW_CONTEXT_ACTION_MAX 32
++/* We want to support a rule with 32 destinations, which means we need to
++ * account for 32 destinations plus usually a counter plus one more action
++ * for a multi-destination flow table.
++ */
++#define MLX5_FLOW_CONTEXT_ACTION_MAX 34
+ static int mlx5_cmd_dr_create_fte(struct mlx5_flow_root_namespace *ns,
+ struct mlx5_flow_table *ft,
+ struct mlx5_flow_group *group,
+@@ -392,9 +396,9 @@ static int mlx5_cmd_dr_create_fte(struct
+ enum mlx5_flow_destination_type type = dst->dest_attr.type;
+ u32 id;
+
+- if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX ||
+- num_term_actions >= MLX5_FLOW_CONTEXT_ACTION_MAX) {
+- err = -ENOSPC;
++ if (fs_dr_num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX ||
++ num_term_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) {
++ err = -EOPNOTSUPP;
+ goto free_actions;
+ }
+
+@@ -464,8 +468,9 @@ static int mlx5_cmd_dr_create_fte(struct
+ MLX5_FLOW_DESTINATION_TYPE_COUNTER)
+ continue;
+
+- if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) {
+- err = -ENOSPC;
++ if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX ||
++ fs_dr_num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) {
++ err = -EOPNOTSUPP;
+ goto free_actions;
+ }
+
+@@ -485,14 +490,28 @@ static int mlx5_cmd_dr_create_fte(struct
+ params.match_sz = match_sz;
+ params.match_buf = (u64 *)fte->val;
+ if (num_term_actions == 1) {
+- if (term_actions->reformat)
++ if (term_actions->reformat) {
++ if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) {
++ err = -EOPNOTSUPP;
++ goto free_actions;
++ }
+ actions[num_actions++] = term_actions->reformat;
++ }
+
++ if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) {
++ err = -EOPNOTSUPP;
++ goto free_actions;
++ }
+ actions[num_actions++] = term_actions->dest;
+ } else if (num_term_actions > 1) {
+ bool ignore_flow_level =
+ !!(fte->action.flags & FLOW_ACT_IGNORE_FLOW_LEVEL);
+
++ if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX ||
++ fs_dr_num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) {
++ err = -EOPNOTSUPP;
++ goto free_actions;
++ }
+ tmp_action = mlx5dr_action_create_mult_dest_tbl(domain,
+ term_actions,
+ num_term_actions,
--- /dev/null
+From ecd9c5cd46e013659e2fad433057bad1ba66888e Mon Sep 17 00:00:00 2001
+From: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Date: Wed, 29 Dec 2021 22:22:05 +0200
+Subject: net/mlx5: DR, Fix the threshold that defines when pool sync is initiated
+
+From: Yevgeny Kliteynik <kliteyn@nvidia.com>
+
+commit ecd9c5cd46e013659e2fad433057bad1ba66888e upstream.
+
+When deciding whether to start syncing and actually free all the "hot"
+ICM chunks, we need to consider the type of the ICM chunks that we're
+dealing with. For instance, the amount of available ICM for MODIFY_ACTION
+is significantly lower than the usual STE ICM, so the threshold should
+account for that - otherwise we can deplete MODIFY_ACTION memory just by
+creating and deleting the same modify header action in a continuous loop.
+
+This patch replaces the hard-coded threshold with a dynamic value.
+
+Fixes: 1c58651412bb ("net/mlx5: DR, ICM memory pools sync optimization")
+Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Reviewed-by: Alex Vesker <valex@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/steering/dr_icm_pool.c | 11 ++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_icm_pool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_icm_pool.c
+@@ -4,7 +4,6 @@
+ #include "dr_types.h"
+
+ #define DR_ICM_MODIFY_HDR_ALIGN_BASE 64
+-#define DR_ICM_SYNC_THRESHOLD_POOL (64 * 1024 * 1024)
+
+ struct mlx5dr_icm_pool {
+ enum mlx5dr_icm_type icm_type;
+@@ -324,10 +323,14 @@ dr_icm_chunk_create(struct mlx5dr_icm_po
+
+ static bool dr_icm_pool_is_sync_required(struct mlx5dr_icm_pool *pool)
+ {
+- if (pool->hot_memory_size > DR_ICM_SYNC_THRESHOLD_POOL)
+- return true;
++ int allow_hot_size;
+
+- return false;
++ /* sync when hot memory reaches half of the pool size */
++ allow_hot_size =
++ mlx5dr_icm_pool_chunk_size_to_byte(pool->max_log_chunk_sz,
++ pool->icm_type) / 2;
++
++ return pool->hot_memory_size > allow_hot_size;
+ }
+
+ static int dr_icm_pool_sync_all_buddy_pools(struct mlx5dr_icm_pool *pool)
--- /dev/null
+From b645e57debca846f51b3209907546ea857ddd3f5 Mon Sep 17 00:00:00 2001
+From: Maor Gottlieb <maorg@nvidia.com>
+Date: Mon, 24 Jan 2022 21:25:04 +0200
+Subject: net/mlx5: Fix possible deadlock on rule deletion
+
+From: Maor Gottlieb <maorg@nvidia.com>
+
+commit b645e57debca846f51b3209907546ea857ddd3f5 upstream.
+
+Add missing call to up_write_ref_node() which releases the semaphore
+in case the FTE doesn't have destinations, such in drop rule case.
+
+Fixes: 465e7baab6d9 ("net/mlx5: Fix deletion of duplicate rules")
+Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -2073,6 +2073,8 @@ void mlx5_del_flow_rules(struct mlx5_flo
+ fte->node.del_hw_func = NULL;
+ up_write_ref_node(&fte->node, false);
+ tree_put_node(&fte->node, false);
++ } else {
++ up_write_ref_node(&fte->node, false);
+ }
+ kfree(handle);
+ }
--- /dev/null
+From be7f4b0ab149afd19514929fad824b2117d238c9 Mon Sep 17 00:00:00 2001
+From: Chris Mi <cmi@nvidia.com>
+Date: Tue, 14 Dec 2021 03:52:53 +0200
+Subject: net/mlx5: Fix tc max supported prio for nic mode
+
+From: Chris Mi <cmi@nvidia.com>
+
+commit be7f4b0ab149afd19514929fad824b2117d238c9 upstream.
+
+Only prio 1 is supported if firmware doesn't support ignore flow
+level for nic mode. The offending commit removed the check wrongly.
+Add it back.
+
+Fixes: 9a99c8f1253a ("net/mlx5e: E-Switch, Offload all chain 0 priorities when modify header and forward action is not supported")
+Signed-off-by: Chris Mi <cmi@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_chains.c
+@@ -121,6 +121,9 @@ u32 mlx5_chains_get_nf_ft_chain(struct m
+
+ u32 mlx5_chains_get_prio_range(struct mlx5_fs_chains *chains)
+ {
++ if (!mlx5_chains_prios_supported(chains))
++ return 1;
++
+ if (mlx5_chains_ignore_flow_level_supported(chains))
+ return UINT_MAX;
+
--- /dev/null
+From 07666c75ad17d7389b18ac0235c8cf41e1504ea8 Mon Sep 17 00:00:00 2001
+From: Ariel Levkovich <lariel@nvidia.com>
+Date: Sat, 29 Jan 2022 01:39:24 +0200
+Subject: net/mlx5: Fix wrong limitation of metadata match on ecpf
+
+From: Ariel Levkovich <lariel@nvidia.com>
+
+commit 07666c75ad17d7389b18ac0235c8cf41e1504ea8 upstream.
+
+Match metadata support check returns false for ecpf device.
+However, this support does exist for ecpf and therefore this
+limitation should be removed to allow feature such as stacked
+devices and internal port offloaded to be supported.
+
+Fixes: 92ab1eb392c6 ("net/mlx5: E-Switch, Enable vport metadata matching if firmware supports it")
+Signed-off-by: Ariel Levkovich <lariel@nvidia.com>
+Reviewed-by: Maor Dickman <maord@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+@@ -2838,10 +2838,6 @@ bool mlx5_esw_vport_match_metadata_suppo
+ if (!MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source))
+ return false;
+
+- if (mlx5_core_is_ecpf_esw_manager(esw->dev) ||
+- mlx5_ecpf_vport_exists(esw->dev))
+- return false;
+-
+ return true;
+ }
+
--- /dev/null
+From 7f839965b2d77e1926ad08b23c51d60988f10a99 Mon Sep 17 00:00:00 2001
+From: Maher Sanalla <msanalla@nvidia.com>
+Date: Wed, 16 Feb 2022 11:01:04 +0200
+Subject: net/mlx5: Update log_max_qp value to be 17 at most
+
+From: Maher Sanalla <msanalla@nvidia.com>
+
+commit 7f839965b2d77e1926ad08b23c51d60988f10a99 upstream.
+
+Currently, log_max_qp value is dependent on what FW reports as its max capability.
+In reality, due to a bug, some FWs report a value greater than 17, even though they
+don't support log_max_qp > 17.
+
+This FW issue led the driver to exhaust memory on startup.
+Thus, log_max_qp value is set to be no more than 17 regardless
+of what FW reports, as it was before the cited commit.
+
+Fixes: f79a609ea6bf ("net/mlx5: Update log_max_qp value to FW max capability")
+Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
+Reviewed-by: Avihai Horon <avihaih@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -510,7 +510,7 @@ static int handle_hca_cap(struct mlx5_co
+
+ /* Check log_max_qp from HCA caps to set in current profile */
+ if (prof->log_max_qp == LOG_MAX_SUPPORTED_QPS) {
+- prof->log_max_qp = MLX5_CAP_GEN_MAX(dev, log_max_qp);
++ prof->log_max_qp = min_t(u8, 17, MLX5_CAP_GEN_MAX(dev, log_max_qp));
+ } else if (MLX5_CAP_GEN_MAX(dev, log_max_qp) < prof->log_max_qp) {
+ mlx5_core_warn(dev, "log_max_qp value in current profile is %d, changing it to HCA capability limit (%d)\n",
+ prof->log_max_qp,
--- /dev/null
+From f908a35b22180c4da64cf2647e4f5f0cd3054da7 Mon Sep 17 00:00:00 2001
+From: Meir Lichtinger <meirl@nvidia.com>
+Date: Mon, 10 Jan 2022 10:14:41 +0200
+Subject: net/mlx5: Update the list of the PCI supported devices
+
+From: Meir Lichtinger <meirl@nvidia.com>
+
+commit f908a35b22180c4da64cf2647e4f5f0cd3054da7 upstream.
+
+Add the upcoming BlueField-4 and ConnectX-8 device IDs.
+
+Fixes: 2e9d3e83ab82 ("net/mlx5: Update the list of the PCI supported devices")
+Signed-off-by: Meir Lichtinger <meirl@nvidia.com>
+Reviewed-by: Gal Pressman <gal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -1796,10 +1796,12 @@ static const struct pci_device_id mlx5_c
+ { PCI_VDEVICE(MELLANOX, 0x101e), MLX5_PCI_DEV_IS_VF}, /* ConnectX Family mlx5Gen Virtual Function */
+ { PCI_VDEVICE(MELLANOX, 0x101f) }, /* ConnectX-6 LX */
+ { PCI_VDEVICE(MELLANOX, 0x1021) }, /* ConnectX-7 */
++ { PCI_VDEVICE(MELLANOX, 0x1023) }, /* ConnectX-8 */
+ { PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */
+ { PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */
+ { PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */
+ { PCI_VDEVICE(MELLANOX, 0xa2dc) }, /* BlueField-3 integrated ConnectX-7 network controller */
++ { PCI_VDEVICE(MELLANOX, 0xa2df) }, /* BlueField-4 integrated ConnectX-8 network controller */
+ { 0, }
+ };
+
--- /dev/null
+From 5ee02b7a800654ff9549807bcf0b4c9fd5cf25f9 Mon Sep 17 00:00:00 2001
+From: Lama Kayal <lkayal@nvidia.com>
+Date: Mon, 21 Feb 2022 12:26:11 +0200
+Subject: net/mlx5e: Add missing increment of count
+
+From: Lama Kayal <lkayal@nvidia.com>
+
+commit 5ee02b7a800654ff9549807bcf0b4c9fd5cf25f9 upstream.
+
+Add mistakenly missing increment of count variable when looping over
+output buffer in mlx5e_self_test().
+
+This resolves the issue of garbage values output when querying with self
+test via ethtool.
+
+before:
+$ ethtool -t eth2
+The test result is PASS
+The test extra info:
+Link Test 0
+Speed Test 1768697188
+Health Test 758528120
+Loopback Test 3288687
+
+after:
+$ ethtool -t eth2
+The test result is PASS
+The test extra info:
+Link Test 0
+Speed Test 0
+Health Test 0
+Loopback Test 0
+
+Fixes: 7990b1b5e8bd ("net/mlx5e: loopback test is not supported in switchdev mode")
+Signed-off-by: Lama Kayal <lkayal@nvidia.com>
+Reviewed-by: Gal Pressman <gal@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+@@ -334,6 +334,7 @@ void mlx5e_self_test(struct net_device *
+ netdev_info(ndev, "\t[%d] %s start..\n", i, st.name);
+ buf[count] = st.st_func(priv);
+ netdev_info(ndev, "\t[%d] %s end: result(%lld)\n", i, st.name, buf[count]);
++ count++;
+ }
+
+ mutex_unlock(&priv->state_lock);
--- /dev/null
+From 0b89429722353d112f8b8b29ca397e95fa994d27 Mon Sep 17 00:00:00 2001
+From: Gal Pressman <gal@nvidia.com>
+Date: Wed, 2 Feb 2022 16:07:21 +0200
+Subject: net/mlx5e: Fix wrong return value on ioctl EEPROM query failure
+
+From: Gal Pressman <gal@nvidia.com>
+
+commit 0b89429722353d112f8b8b29ca397e95fa994d27 upstream.
+
+The ioctl EEPROM query wrongly returns success on read failures, fix
+that by returning the appropriate error code.
+
+Fixes: bb64143eee8c ("net/mlx5e: Add ethtool support for dump module EEPROM")
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -1752,7 +1752,7 @@ static int mlx5e_get_module_eeprom(struc
+ if (size_read < 0) {
+ netdev_err(priv->netdev, "%s: mlx5_query_eeprom failed:0x%x\n",
+ __func__, size_read);
+- return 0;
++ return size_read;
+ }
+
+ i += size_read;
--- /dev/null
+From 7eaf1f37b8817c608c4e959d69986ef459d345cd Mon Sep 17 00:00:00 2001
+From: Tariq Toukan <tariqt@nvidia.com>
+Date: Mon, 31 Jan 2022 10:26:19 +0200
+Subject: net/mlx5e: kTLS, Use CHECKSUM_UNNECESSARY for device-offloaded packets
+
+From: Tariq Toukan <tariqt@nvidia.com>
+
+commit 7eaf1f37b8817c608c4e959d69986ef459d345cd upstream.
+
+For RX TLS device-offloaded packets, the HW spec guarantees checksum
+validation for the offloaded packets, but does not define whether the
+CQE.checksum field matches the original packet (ciphertext) or
+the decrypted one (plaintext). This latitude allows architetctural
+improvements between generations of chips, resulting in different decisions
+regarding the value type of CQE.checksum.
+
+Hence, for these packets, the device driver should not make use of this CQE
+field. Here we block CHECKSUM_COMPLETE usage for RX TLS device-offloaded
+packets, and use CHECKSUM_UNNECESSARY instead.
+
+Value of the packet's tcp_hdr.csum is not modified by the HW, and it always
+matches the original ciphertext.
+
+Fixes: 1182f3659357 ("net/mlx5e: kTLS, Add kTLS RX HW offload support")
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -1348,7 +1348,8 @@ static inline void mlx5e_handle_csum(str
+ }
+
+ /* True when explicitly set via priv flag, or XDP prog is loaded */
+- if (test_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &rq->state))
++ if (test_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &rq->state) ||
++ get_cqe_tls_offload(cqe))
+ goto csum_unnecessary;
+
+ /* CQE csum doesn't cover padding octets in short ethernet
--- /dev/null
+From fdc18e4e4bded2a08638cdcd22dc087a64b9ddad Mon Sep 17 00:00:00 2001
+From: Maor Dickman <maord@nvidia.com>
+Date: Thu, 6 Jan 2022 14:46:24 +0200
+Subject: net/mlx5e: MPLSoUDP decap, fix check for unsupported matches
+
+From: Maor Dickman <maord@nvidia.com>
+
+commit fdc18e4e4bded2a08638cdcd22dc087a64b9ddad upstream.
+
+Currently offload of rule on bareudp device require tunnel key
+in order to match on mpls fields and without it the mpls fields
+are ignored, this is incorrect due to the fact udp tunnel doesn't
+have key to match on.
+
+Fix by returning error in case flow is matching on tunnel key.
+
+Fixes: 72046a91d134 ("net/mlx5e: Allow to match on mpls parameters")
+Signed-off-by: Maor Dickman <maord@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_mplsoudp.c | 28 ++++-------
+ 1 file changed, 11 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_mplsoudp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_mplsoudp.c
+@@ -60,37 +60,31 @@ static int parse_tunnel(struct mlx5e_pri
+ void *headers_v)
+ {
+ struct flow_rule *rule = flow_cls_offload_flow_rule(f);
+- struct flow_match_enc_keyid enc_keyid;
+ struct flow_match_mpls match;
+ void *misc2_c;
+ void *misc2_v;
+
+- misc2_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
+- misc_parameters_2);
+- misc2_v = MLX5_ADDR_OF(fte_match_param, spec->match_value,
+- misc_parameters_2);
+-
+- if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_MPLS))
+- return 0;
+-
+- if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_KEYID))
+- return 0;
+-
+- flow_rule_match_enc_keyid(rule, &enc_keyid);
+-
+- if (!enc_keyid.mask->keyid)
+- return 0;
+-
+ if (!MLX5_CAP_ETH(priv->mdev, tunnel_stateless_mpls_over_udp) &&
+ !(MLX5_CAP_GEN(priv->mdev, flex_parser_protocols) & MLX5_FLEX_PROTO_CW_MPLS_UDP))
+ return -EOPNOTSUPP;
+
++ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_KEYID))
++ return -EOPNOTSUPP;
++
++ if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_MPLS))
++ return 0;
++
+ flow_rule_match_mpls(rule, &match);
+
+ /* Only support matching the first LSE */
+ if (match.mask->used_lses != 1)
+ return -EOPNOTSUPP;
+
++ misc2_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
++ misc_parameters_2);
++ misc2_v = MLX5_ADDR_OF(fte_match_param, spec->match_value,
++ misc_parameters_2);
++
+ MLX5_SET(fte_match_set_misc2, misc2_c,
+ outer_first_mpls_over_udp.mpls_label,
+ match.mask->ls[0].mpls_label);
--- /dev/null
+From 23216d387c40b090b221ad457c95912fb47eb11e Mon Sep 17 00:00:00 2001
+From: Roi Dayan <roid@nvidia.com>
+Date: Tue, 4 Jan 2022 10:38:02 +0200
+Subject: net/mlx5e: TC, Reject rules with drop and modify hdr action
+
+From: Roi Dayan <roid@nvidia.com>
+
+commit 23216d387c40b090b221ad457c95912fb47eb11e upstream.
+
+This kind of action is not supported by firmware and generates a
+syndrome.
+
+kernel: mlx5_core 0000:08:00.0: mlx5_cmd_check:777:(pid 102063): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0x8708c3)
+
+Fixes: d7e75a325cb2 ("net/mlx5e: Add offloading of E-Switch TC pedit (header re-write) actions")
+Signed-off-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Maor Dickman <maord@nvidia.com>
+Reviewed-by: Oz Shlomo <ozsh@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -3440,6 +3440,12 @@ actions_match_supported(struct mlx5e_pri
+ }
+
+ if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR &&
++ actions & MLX5_FLOW_CONTEXT_ACTION_DROP) {
++ NL_SET_ERR_MSG_MOD(extack, "Drop with modify header action is not supported");
++ return false;
++ }
++
++ if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR &&
+ !modify_header_match_supported(priv, &parse_attr->spec, flow_action,
+ actions, ct_flow, ct_clear, extack))
+ return false;
--- /dev/null
+From 3d65492a86d4e6675734646929759138a023d914 Mon Sep 17 00:00:00 2001
+From: Roi Dayan <roid@nvidia.com>
+Date: Mon, 17 Jan 2022 15:00:30 +0200
+Subject: net/mlx5e: TC, Reject rules with forward and drop actions
+
+From: Roi Dayan <roid@nvidia.com>
+
+commit 3d65492a86d4e6675734646929759138a023d914 upstream.
+
+Such rules are redundant but allowed and passed to the driver.
+The driver does not support offloading such rules so return an error.
+
+Fixes: 03a9d11e6eeb ("net/mlx5e: Add TC drop and mirred/redirect action parsing for SRIOV offloads")
+Signed-off-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Oz Shlomo <ozsh@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -3427,6 +3427,12 @@ actions_match_supported(struct mlx5e_pri
+ return false;
+ }
+
++ if (!(~actions &
++ (MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_DROP))) {
++ NL_SET_ERR_MSG_MOD(extack, "Rule cannot support forward+drop action");
++ return false;
++ }
++
+ if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR &&
+ actions & MLX5_FLOW_CONTEXT_ACTION_DROP) {
+ NL_SET_ERR_MSG_MOD(extack, "Drop with modify header action is not supported");
--- /dev/null
+From 42404d8f1c01861b22ccfa1d70f950242720ae57 Mon Sep 17 00:00:00 2001
+From: Mauri Sandberg <maukka@ext.kapsi.fi>
+Date: Wed, 23 Feb 2022 16:23:37 +0200
+Subject: net: mv643xx_eth: process retval from of_get_mac_address
+
+From: Mauri Sandberg <maukka@ext.kapsi.fi>
+
+commit 42404d8f1c01861b22ccfa1d70f950242720ae57 upstream.
+
+Obtaining a MAC address may be deferred in cases when the MAC is stored
+in an NVMEM block, for example, and it may not be ready upon the first
+retrieval attempt and return EPROBE_DEFER.
+
+It is also possible that a port that does not rely on NVMEM has been
+already created when getting the defer request. Thus, also the resources
+allocated previously must be freed when doing a roll-back.
+
+Fixes: 76723bca2802 ("net: mv643xx_eth: add DT parsing support")
+Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20220223142337.41757-1-maukka@ext.kapsi.fi
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mv643xx_eth.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
++++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
+@@ -2700,6 +2700,16 @@ MODULE_DEVICE_TABLE(of, mv643xx_eth_shar
+
+ static struct platform_device *port_platdev[3];
+
++static void mv643xx_eth_shared_of_remove(void)
++{
++ int n;
++
++ for (n = 0; n < 3; n++) {
++ platform_device_del(port_platdev[n]);
++ port_platdev[n] = NULL;
++ }
++}
++
+ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev,
+ struct device_node *pnp)
+ {
+@@ -2736,7 +2746,9 @@ static int mv643xx_eth_shared_of_add_por
+ return -EINVAL;
+ }
+
+- of_get_mac_address(pnp, ppd.mac_addr);
++ ret = of_get_mac_address(pnp, ppd.mac_addr);
++ if (ret)
++ return ret;
+
+ mv643xx_eth_property(pnp, "tx-queue-size", ppd.tx_queue_size);
+ mv643xx_eth_property(pnp, "tx-sram-addr", ppd.tx_sram_addr);
+@@ -2800,21 +2812,13 @@ static int mv643xx_eth_shared_of_probe(s
+ ret = mv643xx_eth_shared_of_add_port(pdev, pnp);
+ if (ret) {
+ of_node_put(pnp);
++ mv643xx_eth_shared_of_remove();
+ return ret;
+ }
+ }
+ return 0;
+ }
+
+-static void mv643xx_eth_shared_of_remove(void)
+-{
+- int n;
+-
+- for (n = 0; n < 3; n++) {
+- platform_device_del(port_platdev[n]);
+- port_platdev[n] = NULL;
+- }
+-}
+ #else
+ static inline int mv643xx_eth_shared_of_probe(struct platform_device *pdev)
+ {
--- /dev/null
+From 2f131de361f6d0eaff17db26efdb844c178432f8 Mon Sep 17 00:00:00 2001
+From: Paul Blakey <paulb@nvidia.com>
+Date: Thu, 17 Feb 2022 11:30:48 +0200
+Subject: net/sched: act_ct: Fix flow table lookup after ct clear or switching zones
+
+From: Paul Blakey <paulb@nvidia.com>
+
+commit 2f131de361f6d0eaff17db26efdb844c178432f8 upstream.
+
+Flow table lookup is skipped if packet either went through ct clear
+action (which set the IP_CT_UNTRACKED flag on the packet), or while
+switching zones and there is already a connection associated with
+the packet. This will result in no SW offload of the connection,
+and the and connection not being removed from flow table with
+TCP teardown (fin/rst packet).
+
+To fix the above, remove these unneccary checks in flow
+table lookup.
+
+Fixes: 46475bb20f4b ("net/sched: act_ct: Software offload of established flows")
+Signed-off-by: Paul Blakey <paulb@nvidia.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/act_ct.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/net/sched/act_ct.c
++++ b/net/sched/act_ct.c
+@@ -516,11 +516,6 @@ static bool tcf_ct_flow_table_lookup(str
+ struct nf_conn *ct;
+ u8 dir;
+
+- /* Previously seen or loopback */
+- ct = nf_ct_get(skb, &ctinfo);
+- if ((ct && !nf_ct_is_template(ct)) || ctinfo == IP_CT_UNTRACKED)
+- return false;
+-
+ switch (family) {
+ case NFPROTO_IPV4:
+ if (!tcf_ct_flow_table_fill_tuple_ipv4(skb, &tuple, &tcph))
--- /dev/null
+From 7ff57e98fb78ad94edafbdc7435f2d745e9e6bb5 Mon Sep 17 00:00:00 2001
+From: "Fabio M. De Francesco" <fmdefrancesco@gmail.com>
+Date: Wed, 23 Feb 2022 11:02:52 +0100
+Subject: net/smc: Use a mutex for locking "struct smc_pnettable"
+
+From: Fabio M. De Francesco <fmdefrancesco@gmail.com>
+
+commit 7ff57e98fb78ad94edafbdc7435f2d745e9e6bb5 upstream.
+
+smc_pnetid_by_table_ib() uses read_lock() and then it calls smc_pnet_apply_ib()
+which, in turn, calls mutex_lock(&smc_ib_devices.mutex).
+
+read_lock() disables preemption. Therefore, the code acquires a mutex while in
+atomic context and it leads to a SAC bug.
+
+Fix this bug by replacing the rwlock with a mutex.
+
+Reported-and-tested-by: syzbot+4f322a6d84e991c38775@syzkaller.appspotmail.com
+Fixes: 64e28b52c7a6 ("net/smc: add pnet table namespace support")
+Confirmed-by: Tony Lu <tonylu@linux.alibaba.com>
+Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com>
+Acked-by: Karsten Graul <kgraul@linux.ibm.com>
+Link: https://lore.kernel.org/r/20220223100252.22562-1-fmdefrancesco@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/smc/smc_pnet.c | 42 +++++++++++++++++++++---------------------
+ net/smc/smc_pnet.h | 2 +-
+ 2 files changed, 22 insertions(+), 22 deletions(-)
+
+--- a/net/smc/smc_pnet.c
++++ b/net/smc/smc_pnet.c
+@@ -112,7 +112,7 @@ static int smc_pnet_remove_by_pnetid(str
+ pnettable = &sn->pnettable;
+
+ /* remove table entry */
+- write_lock(&pnettable->lock);
++ mutex_lock(&pnettable->lock);
+ list_for_each_entry_safe(pnetelem, tmp_pe, &pnettable->pnetlist,
+ list) {
+ if (!pnet_name ||
+@@ -130,7 +130,7 @@ static int smc_pnet_remove_by_pnetid(str
+ rc = 0;
+ }
+ }
+- write_unlock(&pnettable->lock);
++ mutex_unlock(&pnettable->lock);
+
+ /* if this is not the initial namespace, stop here */
+ if (net != &init_net)
+@@ -191,7 +191,7 @@ static int smc_pnet_add_by_ndev(struct n
+ sn = net_generic(net, smc_net_id);
+ pnettable = &sn->pnettable;
+
+- write_lock(&pnettable->lock);
++ mutex_lock(&pnettable->lock);
+ list_for_each_entry_safe(pnetelem, tmp_pe, &pnettable->pnetlist, list) {
+ if (pnetelem->type == SMC_PNET_ETH && !pnetelem->ndev &&
+ !strncmp(pnetelem->eth_name, ndev->name, IFNAMSIZ)) {
+@@ -205,7 +205,7 @@ static int smc_pnet_add_by_ndev(struct n
+ break;
+ }
+ }
+- write_unlock(&pnettable->lock);
++ mutex_unlock(&pnettable->lock);
+ return rc;
+ }
+
+@@ -223,7 +223,7 @@ static int smc_pnet_remove_by_ndev(struc
+ sn = net_generic(net, smc_net_id);
+ pnettable = &sn->pnettable;
+
+- write_lock(&pnettable->lock);
++ mutex_lock(&pnettable->lock);
+ list_for_each_entry_safe(pnetelem, tmp_pe, &pnettable->pnetlist, list) {
+ if (pnetelem->type == SMC_PNET_ETH && pnetelem->ndev == ndev) {
+ dev_put(pnetelem->ndev);
+@@ -236,7 +236,7 @@ static int smc_pnet_remove_by_ndev(struc
+ break;
+ }
+ }
+- write_unlock(&pnettable->lock);
++ mutex_unlock(&pnettable->lock);
+ return rc;
+ }
+
+@@ -371,7 +371,7 @@ static int smc_pnet_add_eth(struct smc_p
+
+ rc = -EEXIST;
+ new_netdev = true;
+- write_lock(&pnettable->lock);
++ mutex_lock(&pnettable->lock);
+ list_for_each_entry(tmp_pe, &pnettable->pnetlist, list) {
+ if (tmp_pe->type == SMC_PNET_ETH &&
+ !strncmp(tmp_pe->eth_name, eth_name, IFNAMSIZ)) {
+@@ -381,9 +381,9 @@ static int smc_pnet_add_eth(struct smc_p
+ }
+ if (new_netdev) {
+ list_add_tail(&new_pe->list, &pnettable->pnetlist);
+- write_unlock(&pnettable->lock);
++ mutex_unlock(&pnettable->lock);
+ } else {
+- write_unlock(&pnettable->lock);
++ mutex_unlock(&pnettable->lock);
+ kfree(new_pe);
+ goto out_put;
+ }
+@@ -444,7 +444,7 @@ static int smc_pnet_add_ib(struct smc_pn
+ new_pe->ib_port = ib_port;
+
+ new_ibdev = true;
+- write_lock(&pnettable->lock);
++ mutex_lock(&pnettable->lock);
+ list_for_each_entry(tmp_pe, &pnettable->pnetlist, list) {
+ if (tmp_pe->type == SMC_PNET_IB &&
+ !strncmp(tmp_pe->ib_name, ib_name, IB_DEVICE_NAME_MAX)) {
+@@ -454,9 +454,9 @@ static int smc_pnet_add_ib(struct smc_pn
+ }
+ if (new_ibdev) {
+ list_add_tail(&new_pe->list, &pnettable->pnetlist);
+- write_unlock(&pnettable->lock);
++ mutex_unlock(&pnettable->lock);
+ } else {
+- write_unlock(&pnettable->lock);
++ mutex_unlock(&pnettable->lock);
+ kfree(new_pe);
+ }
+ return (new_ibdev) ? 0 : -EEXIST;
+@@ -601,7 +601,7 @@ static int _smc_pnet_dump(struct net *ne
+ pnettable = &sn->pnettable;
+
+ /* dump pnettable entries */
+- read_lock(&pnettable->lock);
++ mutex_lock(&pnettable->lock);
+ list_for_each_entry(pnetelem, &pnettable->pnetlist, list) {
+ if (pnetid && !smc_pnet_match(pnetelem->pnet_name, pnetid))
+ continue;
+@@ -616,7 +616,7 @@ static int _smc_pnet_dump(struct net *ne
+ break;
+ }
+ }
+- read_unlock(&pnettable->lock);
++ mutex_unlock(&pnettable->lock);
+ return idx;
+ }
+
+@@ -860,7 +860,7 @@ int smc_pnet_net_init(struct net *net)
+ struct smc_pnetids_ndev *pnetids_ndev = &sn->pnetids_ndev;
+
+ INIT_LIST_HEAD(&pnettable->pnetlist);
+- rwlock_init(&pnettable->lock);
++ mutex_init(&pnettable->lock);
+ INIT_LIST_HEAD(&pnetids_ndev->list);
+ rwlock_init(&pnetids_ndev->lock);
+
+@@ -940,7 +940,7 @@ static int smc_pnet_find_ndev_pnetid_by_
+ sn = net_generic(net, smc_net_id);
+ pnettable = &sn->pnettable;
+
+- read_lock(&pnettable->lock);
++ mutex_lock(&pnettable->lock);
+ list_for_each_entry(pnetelem, &pnettable->pnetlist, list) {
+ if (pnetelem->type == SMC_PNET_ETH && ndev == pnetelem->ndev) {
+ /* get pnetid of netdev device */
+@@ -949,7 +949,7 @@ static int smc_pnet_find_ndev_pnetid_by_
+ break;
+ }
+ }
+- read_unlock(&pnettable->lock);
++ mutex_unlock(&pnettable->lock);
+ return rc;
+ }
+
+@@ -1141,7 +1141,7 @@ int smc_pnetid_by_table_ib(struct smc_ib
+ sn = net_generic(&init_net, smc_net_id);
+ pnettable = &sn->pnettable;
+
+- read_lock(&pnettable->lock);
++ mutex_lock(&pnettable->lock);
+ list_for_each_entry(tmp_pe, &pnettable->pnetlist, list) {
+ if (tmp_pe->type == SMC_PNET_IB &&
+ !strncmp(tmp_pe->ib_name, ib_name, IB_DEVICE_NAME_MAX) &&
+@@ -1151,7 +1151,7 @@ int smc_pnetid_by_table_ib(struct smc_ib
+ break;
+ }
+ }
+- read_unlock(&pnettable->lock);
++ mutex_unlock(&pnettable->lock);
+
+ return rc;
+ }
+@@ -1170,7 +1170,7 @@ int smc_pnetid_by_table_smcd(struct smcd
+ sn = net_generic(&init_net, smc_net_id);
+ pnettable = &sn->pnettable;
+
+- read_lock(&pnettable->lock);
++ mutex_lock(&pnettable->lock);
+ list_for_each_entry(tmp_pe, &pnettable->pnetlist, list) {
+ if (tmp_pe->type == SMC_PNET_IB &&
+ !strncmp(tmp_pe->ib_name, ib_name, IB_DEVICE_NAME_MAX)) {
+@@ -1179,7 +1179,7 @@ int smc_pnetid_by_table_smcd(struct smcd
+ break;
+ }
+ }
+- read_unlock(&pnettable->lock);
++ mutex_unlock(&pnettable->lock);
+
+ return rc;
+ }
+--- a/net/smc/smc_pnet.h
++++ b/net/smc/smc_pnet.h
+@@ -29,7 +29,7 @@ struct smc_link_group;
+ * @pnetlist: List of PNETIDs
+ */
+ struct smc_pnettable {
+- rwlock_t lock;
++ struct mutex lock;
+ struct list_head pnetlist;
+ };
+
--- /dev/null
+From dad3bdeef45f81a6e90204bcc85360bb76eccec7 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Mon, 21 Feb 2022 13:31:49 +0100
+Subject: netfilter: nf_tables: fix memory leak during stateful obj update
+
+From: Florian Westphal <fw@strlen.de>
+
+commit dad3bdeef45f81a6e90204bcc85360bb76eccec7 upstream.
+
+stateful objects can be updated from the control plane.
+The transaction logic allocates a temporary object for this purpose.
+
+The ->init function was called for this object, so plain kfree() leaks
+resources. We must call ->destroy function of the object.
+
+nft_obj_destroy does this, but it also decrements the module refcount,
+but the update path doesn't increment it.
+
+To avoid special-casing the update object release, do module_get for
+the update case too and release it via nft_obj_destroy().
+
+Fixes: d62d0ba97b58 ("netfilter: nf_tables: Introduce stateful object update operation")
+Cc: Fernando Fernandez Mancera <ffmancera@riseup.net>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -6535,12 +6535,15 @@ static int nf_tables_updobj(const struct
+ {
+ struct nft_object *newobj;
+ struct nft_trans *trans;
+- int err;
++ int err = -ENOMEM;
++
++ if (!try_module_get(type->owner))
++ return -ENOENT;
+
+ trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ,
+ sizeof(struct nft_trans_obj));
+ if (!trans)
+- return -ENOMEM;
++ goto err_trans;
+
+ newobj = nft_obj_init(ctx, type, attr);
+ if (IS_ERR(newobj)) {
+@@ -6557,6 +6560,8 @@ static int nf_tables_updobj(const struct
+
+ err_free_trans:
+ kfree(trans);
++err_trans:
++ module_put(type->owner);
+ return err;
+ }
+
+@@ -8169,7 +8174,7 @@ static void nft_obj_commit_update(struct
+ if (obj->ops->update)
+ obj->ops->update(obj, newobj);
+
+- kfree(newobj);
++ nft_obj_destroy(&trans->ctx, newobj);
+ }
+
+ static void nft_commit_release(struct nft_trans *trans)
+@@ -8914,7 +8919,7 @@ static int __nf_tables_abort(struct net
+ break;
+ case NFT_MSG_NEWOBJ:
+ if (nft_trans_obj_update(trans)) {
+- kfree(nft_trans_obj_newobj(trans));
++ nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans));
+ nft_trans_destroy(trans);
+ } else {
+ trans->ctx.table->use--;
--- /dev/null
+From 6069da443bf65f513bb507bb21e2f87cfb1ad0b6 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Fri, 18 Feb 2022 12:45:32 +0100
+Subject: netfilter: nf_tables: unregister flowtable hooks on netns exit
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit 6069da443bf65f513bb507bb21e2f87cfb1ad0b6 upstream.
+
+Unregister flowtable hooks before they are releases via
+nf_tables_flowtable_destroy() otherwise hook core reports UAF.
+
+BUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142
+Read of size 4 at addr ffff8880736f7438 by task syz-executor579/3666
+
+CPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106
+ dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106
+ print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247
+ __kasan_report mm/kasan/report.c:433 [inline]
+ __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450
+ kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450
+ nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142
+ __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429
+ nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571
+ nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232
+ nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430
+ nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]
+ nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]
+ nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652
+ nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652
+ nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652
+
+__nft_release_hook() calls nft_unregister_flowtable_net_hooks() which
+only unregisters the hooks, then after RCU grace period, it is
+guaranteed that no packets add new entries to the flowtable (no flow
+offload rules and flowtable hooks are reachable from packet path), so it
+is safe to call nf_flow_table_free() which cleans up the remaining
+entries from the flowtable (both software and hardware) and it unbinds
+the flow_block.
+
+Fixes: ff4bf2f42a40 ("netfilter: nf_tables: add nft_unregister_flowtable_hook()")
+Reported-by: syzbot+e918523f77e62790d6d9@syzkaller.appspotmail.com
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -9574,10 +9574,13 @@ EXPORT_SYMBOL_GPL(__nft_release_basechai
+
+ static void __nft_release_hook(struct net *net, struct nft_table *table)
+ {
++ struct nft_flowtable *flowtable;
+ struct nft_chain *chain;
+
+ list_for_each_entry(chain, &table->chains, list)
+ nf_tables_unregister_hook(net, table, chain);
++ list_for_each_entry(flowtable, &table->flowtables, list)
++ nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list);
+ }
+
+ static void __nft_release_hooks(struct net *net)
--- /dev/null
+From 3a14d0888eb4b0045884126acc69abfb7b87814d Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Fri, 18 Feb 2022 14:15:35 +0100
+Subject: nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 3a14d0888eb4b0045884126acc69abfb7b87814d upstream.
+
+ida_simple_get() returns an id between min (0) and max (NFP_MAX_MAC_INDEX)
+inclusive.
+So NFP_MAX_MAC_INDEX (0xff) is a valid id.
+
+In order for the error handling path to work correctly, the 'invalid'
+value for 'ida_idx' should not be in the 0..NFP_MAX_MAC_INDEX range,
+inclusive.
+
+So set it to -1.
+
+Fixes: 20cce8865098 ("nfp: flower: enable MAC address sharing for offloadable devs")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20220218131535.100258-1-simon.horman@corigine.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
+@@ -922,8 +922,8 @@ nfp_tunnel_add_shared_mac(struct nfp_app
+ int port, bool mod)
+ {
+ struct nfp_flower_priv *priv = app->priv;
+- int ida_idx = NFP_MAX_MAC_INDEX, err;
+ struct nfp_tun_offloaded_mac *entry;
++ int ida_idx = -1, err;
+ u16 nfp_mac_idx = 0;
+
+ entry = nfp_tunnel_lookup_offloaded_macs(app, netdev->dev_addr);
+@@ -997,7 +997,7 @@ err_remove_hash:
+ err_free_entry:
+ kfree(entry);
+ err_free_ida:
+- if (ida_idx != NFP_MAX_MAC_INDEX)
++ if (ida_idx != -1)
+ ida_simple_remove(&priv->tun.mac_off_ids, ida_idx);
+
+ return err;
--- /dev/null
+From 602e57c9799c19f27e440639deed3ec45cfe1651 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Wed, 16 Feb 2022 14:14:58 +0100
+Subject: nvme: also mark passthrough-only namespaces ready in nvme_update_ns_info
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 602e57c9799c19f27e440639deed3ec45cfe1651 upstream.
+
+Commit e7d65803e2bb ("nvme-multipath: revalidate paths during rescan")
+introduced the NVME_NS_READY flag, which nvme_path_is_disabled() uses
+to check if a path can be used or not. We also need to set this flag
+for devices that fail the ZNS feature validation and which are available
+through passthrough devices only to that they can be used in multipathing
+setups.
+
+Fixes: e7d65803e2bb ("nvme-multipath: revalidate paths during rescan")
+Reported-by: Kanchan Joshi <joshi.k@samsung.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Tested-by: Kanchan Joshi <joshi.k@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1936,7 +1936,7 @@ static int nvme_update_ns_info(struct nv
+ if (blk_queue_is_zoned(ns->queue)) {
+ ret = nvme_revalidate_zones(ns);
+ if (ret && !nvme_first_scan(ns->disk))
+- goto out;
++ return ret;
+ }
+
+ if (nvme_ns_head_multipath(ns->head)) {
+@@ -1951,16 +1951,16 @@ static int nvme_update_ns_info(struct nv
+ return 0;
+
+ out_unfreeze:
+- blk_mq_unfreeze_queue(ns->disk->queue);
+-out:
+ /*
+ * If probing fails due an unsupported feature, hide the block device,
+ * but still allow other access.
+ */
+ if (ret == -ENODEV) {
+ ns->disk->flags |= GENHD_FL_HIDDEN;
++ set_bit(NVME_NS_READY, &ns->flags);
+ ret = 0;
+ }
++ blk_mq_unfreeze_queue(ns->disk->queue);
+ return ret;
+ }
+
--- /dev/null
+From d9b5ae5c1b241b91480aa30408be12fe91af834a Mon Sep 17 00:00:00 2001
+From: Paul Blakey <paulb@nvidia.com>
+Date: Wed, 23 Feb 2022 18:34:16 +0200
+Subject: openvswitch: Fix setting ipv6 fields causing hw csum failure
+
+From: Paul Blakey <paulb@nvidia.com>
+
+commit d9b5ae5c1b241b91480aa30408be12fe91af834a upstream.
+
+Ipv6 ttl, label and tos fields are modified without first
+pulling/pushing the ipv6 header, which would have updated
+the hw csum (if available). This might cause csum validation
+when sending the packet to the stack, as can be seen in
+the trace below.
+
+Fix this by updating skb->csum if available.
+
+Trace resulted by ipv6 ttl dec and then sending packet
+to conntrack [actions: set(ipv6(hlimit=63)),ct(zone=99)]:
+[295241.900063] s_pf0vf2: hw csum failure
+[295241.923191] Call Trace:
+[295241.925728] <IRQ>
+[295241.927836] dump_stack+0x5c/0x80
+[295241.931240] __skb_checksum_complete+0xac/0xc0
+[295241.935778] nf_conntrack_tcp_packet+0x398/0xba0 [nf_conntrack]
+[295241.953030] nf_conntrack_in+0x498/0x5e0 [nf_conntrack]
+[295241.958344] __ovs_ct_lookup+0xac/0x860 [openvswitch]
+[295241.968532] ovs_ct_execute+0x4a7/0x7c0 [openvswitch]
+[295241.979167] do_execute_actions+0x54a/0xaa0 [openvswitch]
+[295242.001482] ovs_execute_actions+0x48/0x100 [openvswitch]
+[295242.006966] ovs_dp_process_packet+0x96/0x1d0 [openvswitch]
+[295242.012626] ovs_vport_receive+0x6c/0xc0 [openvswitch]
+[295242.028763] netdev_frame_hook+0xc0/0x180 [openvswitch]
+[295242.034074] __netif_receive_skb_core+0x2ca/0xcb0
+[295242.047498] netif_receive_skb_internal+0x3e/0xc0
+[295242.052291] napi_gro_receive+0xba/0xe0
+[295242.056231] mlx5e_handle_rx_cqe_mpwrq_rep+0x12b/0x250 [mlx5_core]
+[295242.062513] mlx5e_poll_rx_cq+0xa0f/0xa30 [mlx5_core]
+[295242.067669] mlx5e_napi_poll+0xe1/0x6b0 [mlx5_core]
+[295242.077958] net_rx_action+0x149/0x3b0
+[295242.086762] __do_softirq+0xd7/0x2d6
+[295242.090427] irq_exit+0xf7/0x100
+[295242.093748] do_IRQ+0x7f/0xd0
+[295242.096806] common_interrupt+0xf/0xf
+[295242.100559] </IRQ>
+[295242.102750] RIP: 0033:0x7f9022e88cbd
+[295242.125246] RSP: 002b:00007f9022282b20 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffda
+[295242.132900] RAX: 0000000000000005 RBX: 0000000000000010 RCX: 0000000000000000
+[295242.140120] RDX: 00007f9022282ba8 RSI: 00007f9022282a30 RDI: 00007f9014005c30
+[295242.147337] RBP: 00007f9014014d60 R08: 0000000000000020 R09: 00007f90254a8340
+[295242.154557] R10: 00007f9022282a28 R11: 0000000000000246 R12: 0000000000000000
+[295242.161775] R13: 00007f902308c000 R14: 000000000000002b R15: 00007f9022b71f40
+
+Fixes: 3fdbd1ce11e5 ("openvswitch: add ipv6 'set' action")
+Signed-off-by: Paul Blakey <paulb@nvidia.com>
+Link: https://lore.kernel.org/r/20220223163416.24096-1-paulb@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/checksum.h | 5 +++++
+ net/openvswitch/actions.c | 46 ++++++++++++++++++++++++++++++++++++++--------
+ 2 files changed, 43 insertions(+), 8 deletions(-)
+
+--- a/include/net/checksum.h
++++ b/include/net/checksum.h
+@@ -141,6 +141,11 @@ static inline void csum_replace2(__sum16
+ *sum = ~csum16_add(csum16_sub(~(*sum), old), new);
+ }
+
++static inline void csum_replace(__wsum *csum, __wsum old, __wsum new)
++{
++ *csum = csum_add(csum_sub(*csum, old), new);
++}
++
+ struct sk_buff;
+ void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
+ __be32 from, __be32 to, bool pseudohdr);
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -423,12 +423,43 @@ static void set_ipv6_addr(struct sk_buff
+ memcpy(addr, new_addr, sizeof(__be32[4]));
+ }
+
+-static void set_ipv6_fl(struct ipv6hdr *nh, u32 fl, u32 mask)
++static void set_ipv6_dsfield(struct sk_buff *skb, struct ipv6hdr *nh, u8 ipv6_tclass, u8 mask)
+ {
++ u8 old_ipv6_tclass = ipv6_get_dsfield(nh);
++
++ ipv6_tclass = OVS_MASKED(old_ipv6_tclass, ipv6_tclass, mask);
++
++ if (skb->ip_summed == CHECKSUM_COMPLETE)
++ csum_replace(&skb->csum, (__force __wsum)(old_ipv6_tclass << 12),
++ (__force __wsum)(ipv6_tclass << 12));
++
++ ipv6_change_dsfield(nh, ~mask, ipv6_tclass);
++}
++
++static void set_ipv6_fl(struct sk_buff *skb, struct ipv6hdr *nh, u32 fl, u32 mask)
++{
++ u32 ofl;
++
++ ofl = nh->flow_lbl[0] << 16 | nh->flow_lbl[1] << 8 | nh->flow_lbl[2];
++ fl = OVS_MASKED(ofl, fl, mask);
++
+ /* Bits 21-24 are always unmasked, so this retains their values. */
+- OVS_SET_MASKED(nh->flow_lbl[0], (u8)(fl >> 16), (u8)(mask >> 16));
+- OVS_SET_MASKED(nh->flow_lbl[1], (u8)(fl >> 8), (u8)(mask >> 8));
+- OVS_SET_MASKED(nh->flow_lbl[2], (u8)fl, (u8)mask);
++ nh->flow_lbl[0] = (u8)(fl >> 16);
++ nh->flow_lbl[1] = (u8)(fl >> 8);
++ nh->flow_lbl[2] = (u8)fl;
++
++ if (skb->ip_summed == CHECKSUM_COMPLETE)
++ csum_replace(&skb->csum, (__force __wsum)htonl(ofl), (__force __wsum)htonl(fl));
++}
++
++static void set_ipv6_ttl(struct sk_buff *skb, struct ipv6hdr *nh, u8 new_ttl, u8 mask)
++{
++ new_ttl = OVS_MASKED(nh->hop_limit, new_ttl, mask);
++
++ if (skb->ip_summed == CHECKSUM_COMPLETE)
++ csum_replace(&skb->csum, (__force __wsum)(nh->hop_limit << 8),
++ (__force __wsum)(new_ttl << 8));
++ nh->hop_limit = new_ttl;
+ }
+
+ static void set_ip_ttl(struct sk_buff *skb, struct iphdr *nh, u8 new_ttl,
+@@ -546,18 +577,17 @@ static int set_ipv6(struct sk_buff *skb,
+ }
+ }
+ if (mask->ipv6_tclass) {
+- ipv6_change_dsfield(nh, ~mask->ipv6_tclass, key->ipv6_tclass);
++ set_ipv6_dsfield(skb, nh, key->ipv6_tclass, mask->ipv6_tclass);
+ flow_key->ip.tos = ipv6_get_dsfield(nh);
+ }
+ if (mask->ipv6_label) {
+- set_ipv6_fl(nh, ntohl(key->ipv6_label),
++ set_ipv6_fl(skb, nh, ntohl(key->ipv6_label),
+ ntohl(mask->ipv6_label));
+ flow_key->ipv6.label =
+ *(__be32 *)nh & htonl(IPV6_FLOWINFO_FLOWLABEL);
+ }
+ if (mask->ipv6_hlimit) {
+- OVS_SET_MASKED(nh->hop_limit, key->ipv6_hlimit,
+- mask->ipv6_hlimit);
++ set_ipv6_ttl(skb, nh, key->ipv6_hlimit, mask->ipv6_hlimit);
+ flow_key->ip.ttl = nh->hop_limit;
+ }
+ return 0;
--- /dev/null
+From 69560e366fc4d5fca7bebb0e44edbfafc8bcaf05 Mon Sep 17 00:00:00 2001
+From: Alexey Bayduraev <alexey.v.bayduraev@linux.intel.com>
+Date: Fri, 18 Feb 2022 18:23:41 +0300
+Subject: perf data: Fix double free in perf_session__delete()
+
+From: Alexey Bayduraev <alexey.v.bayduraev@linux.intel.com>
+
+commit 69560e366fc4d5fca7bebb0e44edbfafc8bcaf05 upstream.
+
+When perf_data__create_dir() fails, it calls close_dir(), but
+perf_session__delete() also calls close_dir() and since dir.version and
+dir.nr were initialized by perf_data__create_dir(), a double free occurs.
+
+This patch moves the initialization of dir.version and dir.nr after
+successful initialization of dir.files, that prevents double freeing.
+This behavior is already implemented in perf_data__open_dir().
+
+Fixes: 145520631130bd64 ("perf data: Add perf_data__(create_dir|close_dir) functions")
+Signed-off-by: Alexey Bayduraev <alexey.v.bayduraev@linux.intel.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Antonov <alexander.antonov@linux.intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexei Budankov <abudankov@huawei.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20220218152341.5197-2-alexey.v.bayduraev@linux.intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/data.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/tools/perf/util/data.c
++++ b/tools/perf/util/data.c
+@@ -44,10 +44,6 @@ int perf_data__create_dir(struct perf_da
+ if (!files)
+ return -ENOMEM;
+
+- data->dir.version = PERF_DIR_VERSION;
+- data->dir.files = files;
+- data->dir.nr = nr;
+-
+ for (i = 0; i < nr; i++) {
+ struct perf_data_file *file = &files[i];
+
+@@ -62,6 +58,9 @@ int perf_data__create_dir(struct perf_da
+ file->fd = ret;
+ }
+
++ data->dir.version = PERF_DIR_VERSION;
++ data->dir.files = files;
++ data->dir.nr = nr;
+ return 0;
+
+ out_err:
--- /dev/null
+From 8a3d2ee0de3828e0d01f9682d35ee53704659bd0 Mon Sep 17 00:00:00 2001
+From: Zhengjun Xing <zhengjun.xing@linux.intel.com>
+Date: Fri, 18 Feb 2022 17:31:27 +0800
+Subject: perf evlist: Fix failed to use cpu list for uncore events
+
+From: Zhengjun Xing <zhengjun.xing@linux.intel.com>
+
+commit 8a3d2ee0de3828e0d01f9682d35ee53704659bd0 upstream.
+
+The 'perf record' and 'perf stat' commands have supported the option
+'-C/--cpus' to count or collect only on the list of CPUs provided.
+
+Commit 1d3351e631fc34d7 ("perf tools: Enable on a list of CPUs for
+hybrid") add it to be supported for hybrid. For hybrid support, it
+checks the cpu list are available on hybrid PMU. But when we test only
+uncore events(or events not in cpu_core and cpu_atom), there is a bug:
+
+Before:
+
+ # perf stat -C0 -e uncore_clock/clockticks/ sleep 1
+ failed to use cpu list 0
+
+In this case, for uncore event, its pmu_name is not cpu_core or
+cpu_atom, so in evlist__fix_hybrid_cpus, perf_pmu__find_hybrid_pmu
+should return NULL,both events_nr and unmatched_count should be 0 ,then
+the cpu list check function evlist__fix_hybrid_cpus return -1 and the
+error "failed to use cpu list 0" will happen. Bypass "events_nr=0" case
+then the issue is fixed.
+
+After:
+
+ # perf stat -C0 -e uncore_clock/clockticks/ sleep 1
+
+ Performance counter stats for 'CPU(s) 0':
+
+ 195,476,873 uncore_clock/clockticks/
+
+ 1.004518677 seconds time elapsed
+
+When testing with at least one core event and uncore events, it has no
+issue.
+
+ # perf stat -C0 -e cpu_core/cpu-cycles/,uncore_clock/clockticks/ sleep 1
+
+ Performance counter stats for 'CPU(s) 0':
+
+ 5,993,774 cpu_core/cpu-cycles/
+ 301,025,912 uncore_clock/clockticks/
+
+ 1.003964934 seconds time elapsed
+
+Fixes: 1d3351e631fc34d7 ("perf tools: Enable on a list of CPUs for hybrid")
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Zhengjun Xing <zhengjun.xing@linux.intel.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: alexander.shishkin@intel.com
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jin Yao <yao.jin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/20220218093127.1844241-1-zhengjun.xing@linux.intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/evlist-hybrid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/util/evlist-hybrid.c
++++ b/tools/perf/util/evlist-hybrid.c
+@@ -153,8 +153,8 @@ int evlist__fix_hybrid_cpus(struct evlis
+ perf_cpu_map__put(matched_cpus);
+ perf_cpu_map__put(unmatched_cpus);
+ }
+-
+- ret = (unmatched_count == events_nr) ? -1 : 0;
++ if (events_nr)
++ ret = (unmatched_count == events_nr) ? -1 : 0;
+ out:
+ perf_cpu_map__put(cpus);
+ return ret;
--- /dev/null
+From cd33bdcbead882c2e58fdb4a54a7bd75b610a452 Mon Sep 17 00:00:00 2001
+From: Xin Long <lucien.xin@gmail.com>
+Date: Wed, 23 Feb 2022 22:41:08 -0500
+Subject: ping: remove pr_err from ping_lookup
+
+From: Xin Long <lucien.xin@gmail.com>
+
+commit cd33bdcbead882c2e58fdb4a54a7bd75b610a452 upstream.
+
+As Jakub noticed, prints should be avoided on the datapath.
+Also, as packets would never come to the else branch in
+ping_lookup(), remove pr_err() from ping_lookup().
+
+Fixes: 35a79e64de29 ("ping: fix the dif and sdif check in ping_lookup")
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Link: https://lore.kernel.org/r/1ef3f2fcd31bd681a193b1fcf235eee1603819bd.1645674068.git.lucien.xin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ping.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -187,7 +187,6 @@ static struct sock *ping_lookup(struct n
+ (int)ident, &ipv6_hdr(skb)->daddr, dif);
+ #endif
+ } else {
+- pr_err("ping: protocol(%x) is not supported\n", ntohs(skb->protocol));
+ return NULL;
+ }
+
--- /dev/null
+From fe20371578ef640069e6ae9fa8038f60e7908565 Mon Sep 17 00:00:00 2001
+From: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Date: Wed, 23 Feb 2022 09:53:47 -0800
+Subject: Revert "i40e: Fix reset bw limit when DCB enabled with 1 TC"
+
+From: Mateusz Palczewski <mateusz.palczewski@intel.com>
+
+commit fe20371578ef640069e6ae9fa8038f60e7908565 upstream.
+
+Revert of a patch that instead of fixing a AQ error when trying
+to reset BW limit introduced several regressions related to
+creation and managing TC. Currently there are errors when creating
+a TC on both PF and VF.
+
+Error log:
+[17428.783095] i40e 0000:3b:00.1: AQ command Config VSI BW allocation per TC failed = 14
+[17428.783107] i40e 0000:3b:00.1: Failed configuring TC map 0 for VSI 391
+[17428.783254] i40e 0000:3b:00.1: AQ command Config VSI BW allocation per TC failed = 14
+[17428.783259] i40e 0000:3b:00.1: Unable to configure TC map 0 for VSI 391
+
+This reverts commit 3d2504663c41104b4359a15f35670cfa82de1bbf.
+
+Fixes: 3d2504663c41 (i40e: Fix reset bw limit when DCB enabled with 1 TC)
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://lore.kernel.org/r/20220223175347.1690692-1-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -5372,15 +5372,7 @@ static int i40e_vsi_configure_bw_alloc(s
+ /* There is no need to reset BW when mqprio mode is on. */
+ if (pf->flags & I40E_FLAG_TC_MQPRIO)
+ return 0;
+-
+- if (!vsi->mqprio_qopt.qopt.hw) {
+- if (pf->flags & I40E_FLAG_DCB_ENABLED)
+- goto skip_reset;
+-
+- if (IS_ENABLED(CONFIG_I40E_DCB) &&
+- i40e_dcb_hw_get_num_tc(&pf->hw) == 1)
+- goto skip_reset;
+-
++ if (!vsi->mqprio_qopt.qopt.hw && !(pf->flags & I40E_FLAG_DCB_ENABLED)) {
+ ret = i40e_set_bw_limit(vsi, vsi->seid, 0);
+ if (ret)
+ dev_info(&pf->pdev->dev,
+@@ -5388,8 +5380,6 @@ static int i40e_vsi_configure_bw_alloc(s
+ vsi->seid);
+ return ret;
+ }
+-
+-skip_reset:
+ memset(&bw_data, 0, sizeof(bw_data));
+ bw_data.tc_valid_bits = enabled_tc;
+ for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++)
--- /dev/null
+From 61d06f01f9710b327a53492e5add9f972eb909b3 Mon Sep 17 00:00:00 2001
+From: Felix Maurer <fmaurer@redhat.com>
+Date: Fri, 11 Feb 2022 18:43:36 +0100
+Subject: selftests: bpf: Check bpf_msg_push_data return value
+
+From: Felix Maurer <fmaurer@redhat.com>
+
+commit 61d06f01f9710b327a53492e5add9f972eb909b3 upstream.
+
+bpf_msg_push_data may return a non-zero value to indicate an error. The
+return value should be checked to prevent undetected errors.
+
+To indicate an error, the BPF programs now perform a different action
+than their intended one to make the userspace test program notice the
+error, i.e., the programs supposed to pass/redirect drop, the program
+supposed to drop passes.
+
+Fixes: 84fbfe026acaa ("bpf: test_sockmap add options to use msg_push_data")
+Signed-off-by: Felix Maurer <fmaurer@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/89f767bb44005d6b4dd1f42038c438f76b3ebfad.1644601294.git.fmaurer@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/bpf/progs/test_sockmap_kern.h | 26 ++++++++++++------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+--- a/tools/testing/selftests/bpf/progs/test_sockmap_kern.h
++++ b/tools/testing/selftests/bpf/progs/test_sockmap_kern.h
+@@ -235,7 +235,7 @@ SEC("sk_msg1")
+ int bpf_prog4(struct sk_msg_md *msg)
+ {
+ int *bytes, zero = 0, one = 1, two = 2, three = 3, four = 4, five = 5;
+- int *start, *end, *start_push, *end_push, *start_pop, *pop;
++ int *start, *end, *start_push, *end_push, *start_pop, *pop, err = 0;
+
+ bytes = bpf_map_lookup_elem(&sock_apply_bytes, &zero);
+ if (bytes)
+@@ -249,8 +249,11 @@ int bpf_prog4(struct sk_msg_md *msg)
+ bpf_msg_pull_data(msg, *start, *end, 0);
+ start_push = bpf_map_lookup_elem(&sock_bytes, &two);
+ end_push = bpf_map_lookup_elem(&sock_bytes, &three);
+- if (start_push && end_push)
+- bpf_msg_push_data(msg, *start_push, *end_push, 0);
++ if (start_push && end_push) {
++ err = bpf_msg_push_data(msg, *start_push, *end_push, 0);
++ if (err)
++ return SK_DROP;
++ }
+ start_pop = bpf_map_lookup_elem(&sock_bytes, &four);
+ pop = bpf_map_lookup_elem(&sock_bytes, &five);
+ if (start_pop && pop)
+@@ -263,6 +266,7 @@ int bpf_prog6(struct sk_msg_md *msg)
+ {
+ int zero = 0, one = 1, two = 2, three = 3, four = 4, five = 5, key = 0;
+ int *bytes, *start, *end, *start_push, *end_push, *start_pop, *pop, *f;
++ int err = 0;
+ __u64 flags = 0;
+
+ bytes = bpf_map_lookup_elem(&sock_apply_bytes, &zero);
+@@ -279,8 +283,11 @@ int bpf_prog6(struct sk_msg_md *msg)
+
+ start_push = bpf_map_lookup_elem(&sock_bytes, &two);
+ end_push = bpf_map_lookup_elem(&sock_bytes, &three);
+- if (start_push && end_push)
+- bpf_msg_push_data(msg, *start_push, *end_push, 0);
++ if (start_push && end_push) {
++ err = bpf_msg_push_data(msg, *start_push, *end_push, 0);
++ if (err)
++ return SK_DROP;
++ }
+
+ start_pop = bpf_map_lookup_elem(&sock_bytes, &four);
+ pop = bpf_map_lookup_elem(&sock_bytes, &five);
+@@ -338,7 +345,7 @@ SEC("sk_msg5")
+ int bpf_prog10(struct sk_msg_md *msg)
+ {
+ int *bytes, *start, *end, *start_push, *end_push, *start_pop, *pop;
+- int zero = 0, one = 1, two = 2, three = 3, four = 4, five = 5;
++ int zero = 0, one = 1, two = 2, three = 3, four = 4, five = 5, err = 0;
+
+ bytes = bpf_map_lookup_elem(&sock_apply_bytes, &zero);
+ if (bytes)
+@@ -352,8 +359,11 @@ int bpf_prog10(struct sk_msg_md *msg)
+ bpf_msg_pull_data(msg, *start, *end, 0);
+ start_push = bpf_map_lookup_elem(&sock_bytes, &two);
+ end_push = bpf_map_lookup_elem(&sock_bytes, &three);
+- if (start_push && end_push)
+- bpf_msg_push_data(msg, *start_push, *end_push, 0);
++ if (start_push && end_push) {
++ err = bpf_msg_push_data(msg, *start_push, *end_push, 0);
++ if (err)
++ return SK_PASS;
++ }
+ start_pop = bpf_map_lookup_elem(&sock_bytes, &four);
+ pop = bpf_map_lookup_elem(&sock_bytes, &five);
+ if (start_pop && pop)
--- /dev/null
+From e35f885b357d47e04380a2056d1b2cc3e6f4f24b Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Fri, 18 Feb 2022 13:35:44 -0800
+Subject: selftests: mptcp: be more conservative with cookie MPJ limits
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit e35f885b357d47e04380a2056d1b2cc3e6f4f24b upstream.
+
+Since commit 2843ff6f36db ("mptcp: remote addresses fullmesh"), an
+MPTCP client can attempt creating multiple MPJ subflow simultaneusly.
+
+In such scenario the server, when syncookies are enabled, could end-up
+accepting incoming MPJ syn even above the configured subflow limit, as
+the such limit can be enforced in a reliable way only after the subflow
+creation. In case of syncookie, only after the 3rd ack reception.
+
+As a consequence the related self-tests case sporadically fails, as it
+verify that the server always accept the expected number of MPJ syn.
+
+Address the issues relaxing the MPJ syn number constrain. Note that the
+check on the accepted number of MPJ 3rd ack still remains intact.
+
+Fixes: 2843ff6f36db ("mptcp: remote addresses fullmesh")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_join.sh | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+@@ -624,6 +624,7 @@ chk_join_nr()
+ local ack_nr=$4
+ local count
+ local dump_stats
++ local with_cookie
+
+ printf "%02u %-36s %s" "$TEST_COUNT" "$msg" "syn"
+ count=`ip netns exec $ns1 nstat -as | grep MPTcpExtMPJoinSynRx | awk '{print $2}'`
+@@ -637,12 +638,20 @@ chk_join_nr()
+ fi
+
+ echo -n " - synack"
++ with_cookie=`ip netns exec $ns2 sysctl -n net.ipv4.tcp_syncookies`
+ count=`ip netns exec $ns2 nstat -as | grep MPTcpExtMPJoinSynAckRx | awk '{print $2}'`
+ [ -z "$count" ] && count=0
+ if [ "$count" != "$syn_ack_nr" ]; then
+- echo "[fail] got $count JOIN[s] synack expected $syn_ack_nr"
+- ret=1
+- dump_stats=1
++ # simult connections exceeding the limit with cookie enabled could go up to
++ # synack validation as the conn limit can be enforced reliably only after
++ # the subflow creation
++ if [ "$with_cookie" = 2 ] && [ "$count" -gt "$syn_ack_nr" ] && [ "$count" -le "$syn_nr" ]; then
++ echo -n "[ ok ]"
++ else
++ echo "[fail] got $count JOIN[s] synack expected $syn_ack_nr"
++ ret=1
++ dump_stats=1
++ fi
+ else
+ echo -n "[ ok ]"
+ fi
--- /dev/null
+From 0cd33c5ffec12bd77a1c02db2469fac08f840939 Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Fri, 18 Feb 2022 13:35:38 -0800
+Subject: selftests: mptcp: fix diag instability
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 0cd33c5ffec12bd77a1c02db2469fac08f840939 upstream.
+
+Instead of waiting for an arbitrary amount of time for the MPTCP
+MP_CAPABLE handshake to complete, explicitly wait for the relevant
+socket to enter into the established status.
+
+Additionally let the data transfer application use the slowest
+transfer mode available (-r), to cope with very slow host, or
+high jitter caused by hosting VMs.
+
+Fixes: df62f2ec3df6 ("selftests/mptcp: add diag interface tests")
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/258
+Reported-and-tested-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/diag.sh | 44 +++++++++++++++++++++++++-----
+ 1 file changed, 37 insertions(+), 7 deletions(-)
+
+--- a/tools/testing/selftests/net/mptcp/diag.sh
++++ b/tools/testing/selftests/net/mptcp/diag.sh
+@@ -71,6 +71,36 @@ chk_msk_remote_key_nr()
+ __chk_nr "grep -c remote_key" $*
+ }
+
++# $1: ns, $2: port
++wait_local_port_listen()
++{
++ local listener_ns="${1}"
++ local port="${2}"
++
++ local port_hex i
++
++ port_hex="$(printf "%04X" "${port}")"
++ for i in $(seq 10); do
++ ip netns exec "${listener_ns}" cat /proc/net/tcp | \
++ awk "BEGIN {rc=1} {if (\$2 ~ /:${port_hex}\$/ && \$4 ~ /0A/) {rc=0; exit}} END {exit rc}" &&
++ break
++ sleep 0.1
++ done
++}
++
++wait_connected()
++{
++ local listener_ns="${1}"
++ local port="${2}"
++
++ local port_hex i
++
++ port_hex="$(printf "%04X" "${port}")"
++ for i in $(seq 10); do
++ ip netns exec ${listener_ns} grep -q " 0100007F:${port_hex} " /proc/net/tcp && break
++ sleep 0.1
++ done
++}
+
+ trap cleanup EXIT
+ ip netns add $ns
+@@ -81,15 +111,15 @@ echo "a" | \
+ ip netns exec $ns \
+ ./mptcp_connect -p 10000 -l -t ${timeout_poll} \
+ 0.0.0.0 >/dev/null &
+-sleep 0.1
++wait_local_port_listen $ns 10000
+ chk_msk_nr 0 "no msk on netns creation"
+
+ echo "b" | \
+ timeout ${timeout_test} \
+ ip netns exec $ns \
+- ./mptcp_connect -p 10000 -j -t ${timeout_poll} \
++ ./mptcp_connect -p 10000 -r 0 -t ${timeout_poll} \
+ 127.0.0.1 >/dev/null &
+-sleep 0.1
++wait_connected $ns 10000
+ chk_msk_nr 2 "after MPC handshake "
+ chk_msk_remote_key_nr 2 "....chk remote_key"
+ chk_msk_fallback_nr 0 "....chk no fallback"
+@@ -101,13 +131,13 @@ echo "a" | \
+ ip netns exec $ns \
+ ./mptcp_connect -p 10001 -l -s TCP -t ${timeout_poll} \
+ 0.0.0.0 >/dev/null &
+-sleep 0.1
++wait_local_port_listen $ns 10001
+ echo "b" | \
+ timeout ${timeout_test} \
+ ip netns exec $ns \
+- ./mptcp_connect -p 10001 -j -t ${timeout_poll} \
++ ./mptcp_connect -p 10001 -r 0 -t ${timeout_poll} \
+ 127.0.0.1 >/dev/null &
+-sleep 0.1
++wait_connected $ns 10001
+ chk_msk_fallback_nr 1 "check fallback"
+ flush_pids
+
+@@ -119,7 +149,7 @@ for I in `seq 1 $NR_CLIENTS`; do
+ ./mptcp_connect -p $((I+10001)) -l -w 10 \
+ -t ${timeout_poll} 0.0.0.0 >/dev/null &
+ done
+-sleep 0.1
++wait_local_port_listen $ns $((NR_CLIENTS + 10001))
+
+ for I in `seq 1 $NR_CLIENTS`; do
+ echo "b" | \
netfilter-xt_socket-fix-a-typo-in-socket_mt_destroy.patch
netfilter-xt_socket-missing-ifdef-config_ip6_nf_iptables-dependency.patch
netfilter-nf_tables_offload-incorrect-flow-offload-action-array-size.patch
+ping-remove-pr_err-from-ping_lookup.patch
+revert-i40e-fix-reset-bw-limit-when-dcb-enabled-with-1-tc.patch
+gpu-host1x-always-return-syncpoint-value-when-waiting.patch
+perf-evlist-fix-failed-to-use-cpu-list-for-uncore-events.patch
+perf-data-fix-double-free-in-perf_session__delete.patch
+mptcp-fix-race-in-incoming-add_addr-option-processing.patch
+mptcp-add-mibs-counter-for-ignored-incoming-options.patch
+selftests-mptcp-fix-diag-instability.patch
+selftests-mptcp-be-more-conservative-with-cookie-mpj-limits.patch
+bnx2x-fix-driver-load-from-initrd.patch
+bnxt_en-fix-devlink-fw_activate.patch
+bnxt_en-fix-active-fec-reporting-to-ethtool.patch
+bnxt_en-fix-offline-ethtool-selftest-with-rdma-enabled.patch
+bnxt_en-fix-occasional-ethtool-t-loopback-test-failures.patch
+bnxt_en-fix-incorrect-multicast-rx-mask-setting-when-not-requested.patch
+bnxt_en-restore-the-resets_reliable-flag-in-bnxt_open.patch
+hwmon-handle-failure-to-register-sensor-with-thermal-zone-correctly.patch
+net-mlx5-fix-tc-max-supported-prio-for-nic-mode.patch
+ice-fix-setting-l4-port-flag-when-adding-filter.patch
+ice-fix-concurrent-reset-and-removal-of-vfs.patch
+ice-check-the-return-of-ice_ptp_gettimex64.patch
+ice-initialize-local-variable-tlv.patch
+net-mlx5-update-the-list-of-the-pci-supported-devices.patch
+bpf-fix-crash-due-to-incorrect-copy_map_value.patch
+bpf-do-not-try-bpf_msg_push_data-with-len-0.patch
+selftests-bpf-check-bpf_msg_push_data-return-value.patch
+bpf-fix-a-bpf_timer-initialization-issue.patch
+bpf-add-schedule-points-in-batch-ops.patch
+io_uring-add-a-schedule-point-in-io_add_buffers.patch
+net-__pskb_pull_tail-pskb_carve_frag_list-drop_monitor-friends.patch
+nvme-also-mark-passthrough-only-namespaces-ready-in-nvme_update_ns_info.patch
+tipc-fix-end-of-loop-tests-for-list_for_each_entry.patch
+clk-qcom-gcc-msm8994-remove-noc-clocks.patch
+gso-do-not-skip-outer-ip-header-in-case-of-ipip-and-net_failover.patch
+net-mv643xx_eth-process-retval-from-of_get_mac_address.patch
+openvswitch-fix-setting-ipv6-fields-causing-hw-csum-failure.patch
+drm-edid-always-set-rgb444.patch
+net-mlx5e-fix-wrong-return-value-on-ioctl-eeprom-query-failure.patch
+net-mlx5e-tc-reject-rules-with-forward-and-drop-actions.patch
+net-mlx5e-tc-reject-rules-with-drop-and-modify-hdr-action.patch
+block-clear-iocb-private-in-blkdev_bio_end_io_async.patch
+drm-vc4-crtc-fix-runtime_pm-reference-counting.patch
+drm-i915-dg2-print-phy-name-properly-on-calibration-error.patch
+drm-amd-display-for-vblank_disable_immediate-check-psr-is-really-used.patch
+net-sched-act_ct-fix-flow-table-lookup-after-ct-clear-or-switching-zones.patch
+net-ll_temac-check-the-return-value-of-devm_kmalloc.patch
+net-force-inlining-of-checksum-functions-in-net-checksum.h.patch
+netfilter-nf_tables-unregister-flowtable-hooks-on-netns-exit.patch
+net-dsa-avoid-call-to-__dev_set_promiscuity-while-rtnl_mutex-isn-t-held.patch
+nfp-flower-fix-a-potential-leak-in-nfp_tunnel_add_shared_mac.patch
+net-mdio-ipq4019-add-delay-after-clock-enable.patch
+netfilter-nf_tables-fix-memory-leak-during-stateful-obj-update.patch
+net-smc-use-a-mutex-for-locking-struct-smc_pnettable.patch
+surface-surface3_power-fix-battery-readings-on-batteries-without-a-serial-number.patch
+udp_tunnel-fix-end-of-loop-test-in-udp_tunnel_nic_unregister.patch
+net-mlx5-dr-cache-ste-shadow-memory.patch
+ibmvnic-schedule-failover-only-if-vioctl-fails.patch
+net-mlx5-dr-don-t-allow-match-on-ip-w-o-matching-on-full-ethertype-ip_version.patch
+net-mlx5-fix-possible-deadlock-on-rule-deletion.patch
+net-mlx5-fix-wrong-limitation-of-metadata-match-on-ecpf.patch
+net-mlx5-dr-fix-the-threshold-that-defines-when-pool-sync-is-initiated.patch
+net-mlx5e-mplsoudp-decap-fix-check-for-unsupported-matches.patch
+net-mlx5e-ktls-use-checksum_unnecessary-for-device-offloaded-packets.patch
+net-mlx5-dr-fix-slab-out-of-bounds-in-mlx5_cmd_dr_create_fte.patch
+net-mlx5-update-log_max_qp-value-to-be-17-at-most.patch
+net-mlx5e-add-missing-increment-of-count.patch
--- /dev/null
+From 21d90aaee8d5c2a097ef41f1430d97661233ecc6 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 24 Feb 2022 11:18:48 +0100
+Subject: surface: surface3_power: Fix battery readings on batteries without a serial number
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 21d90aaee8d5c2a097ef41f1430d97661233ecc6 upstream.
+
+The battery on the 2nd hand Surface 3 which I recently bought appears to
+not have a serial number programmed in. This results in any I2C reads from
+the registers containing the serial number failing with an I2C NACK.
+
+This was causing mshw0011_bix() to fail causing the battery readings to
+not work at all.
+
+Ignore EREMOTEIO (I2C NACK) errors when retrieving the serial number and
+continue with an empty serial number to fix this.
+
+Fixes: b1f81b496b0d ("platform/x86: surface3_power: MSHW0011 rev-eng implementation")
+BugLink: https://github.com/linux-surface/linux-surface/issues/608
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20220224101848.7219-1-hdegoede@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/surface/surface3_power.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/platform/surface/surface3_power.c
++++ b/drivers/platform/surface/surface3_power.c
+@@ -232,14 +232,21 @@ static int mshw0011_bix(struct mshw0011_
+ }
+ bix->last_full_charg_capacity = ret;
+
+- /* get serial number */
++ /*
++ * Get serial number, on some devices (with unofficial replacement
++ * battery?) reading any of the serial number range addresses gets
++ * nacked in this case just leave the serial number empty.
++ */
+ ret = i2c_smbus_read_i2c_block_data(client, MSHW0011_BAT0_REG_SERIAL_NO,
+ sizeof(buf), buf);
+- if (ret != sizeof(buf)) {
++ if (ret == -EREMOTEIO) {
++ /* no serial number available */
++ } else if (ret != sizeof(buf)) {
+ dev_err(&client->dev, "Error reading serial no: %d\n", ret);
+ return ret;
++ } else {
++ snprintf(bix->serial, ARRAY_SIZE(bix->serial), "%3pE%6pE", buf + 7, buf);
+ }
+- snprintf(bix->serial, ARRAY_SIZE(bix->serial), "%3pE%6pE", buf + 7, buf);
+
+ /* get cycle count */
+ ret = i2c_smbus_read_word_data(client, MSHW0011_BAT0_REG_CYCLE_CNT);
--- /dev/null
+From a1f8fec4dac8bc7b172b2bdbd881e015261a6322 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 22 Feb 2022 16:43:12 +0300
+Subject: tipc: Fix end of loop tests for list_for_each_entry()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit a1f8fec4dac8bc7b172b2bdbd881e015261a6322 upstream.
+
+These tests are supposed to check if the loop exited via a break or not.
+However the tests are wrong because if we did not exit via a break then
+"p" is not a valid pointer. In that case, it's the equivalent of
+"if (*(u32 *)sr == *last_key) {". That's going to work most of the time,
+but there is a potential for those to be equal.
+
+Fixes: 1593123a6a49 ("tipc: add name table dump to new netlink api")
+Fixes: 1a1a143daf84 ("tipc: add publication dump to new netlink api")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/name_table.c | 2 +-
+ net/tipc/socket.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/tipc/name_table.c
++++ b/net/tipc/name_table.c
+@@ -967,7 +967,7 @@ static int __tipc_nl_add_nametable_publ(
+ list_for_each_entry(p, &sr->all_publ, all_publ)
+ if (p->key == *last_key)
+ break;
+- if (p->key != *last_key)
++ if (list_entry_is_head(p, &sr->all_publ, all_publ))
+ return -EPIPE;
+ } else {
+ p = list_first_entry(&sr->all_publ,
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -3749,7 +3749,7 @@ static int __tipc_nl_list_sk_publ(struct
+ if (p->key == *last_publ)
+ break;
+ }
+- if (p->key != *last_publ) {
++ if (list_entry_is_head(p, &tsk->publications, binding_sock)) {
+ /* We never set seq or call nl_dump_check_consistent()
+ * this means that setting prev_seq here will cause the
+ * consistence check to fail in the netlink callback
--- /dev/null
+From de7b2efacf4e83954aed3f029d347dfc0b7a4f49 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 22 Feb 2022 16:42:51 +0300
+Subject: udp_tunnel: Fix end of loop test in udp_tunnel_nic_unregister()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit de7b2efacf4e83954aed3f029d347dfc0b7a4f49 upstream.
+
+This test is checking if we exited the list via break or not. However
+if it did not exit via a break then "node" does not point to a valid
+udp_tunnel_nic_shared_node struct. It will work because of the way
+the structs are laid out it's the equivalent of
+"if (info->shared->udp_tunnel_nic_info != dev)" which will always be
+true, but it's not the right way to test.
+
+Fixes: 74cc6d182d03 ("udp_tunnel: add the ability to share port tables")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/udp_tunnel_nic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/udp_tunnel_nic.c
++++ b/net/ipv4/udp_tunnel_nic.c
+@@ -846,7 +846,7 @@ udp_tunnel_nic_unregister(struct net_dev
+ list_for_each_entry(node, &info->shared->devices, list)
+ if (node->dev == dev)
+ break;
+- if (node->dev != dev)
++ if (list_entry_is_head(node, &info->shared->devices, list))
+ return;
+
+ list_del(&node->list);
projects / thirdparty / kernel / stable-queue.git / commitdiff
