--- /dev/null
+From fb1af5bea4670c835e42fc0c14c49d3499468774 Mon Sep 17 00:00:00 2001
+From: Geraldo Nascimento <geraldogabriel@gmail.com>
+Date: Sat, 4 Dec 2021 15:52:24 -0300
+Subject: ALSA: usb-audio: Reorder snd_djm_devices[] entries
+
+From: Geraldo Nascimento <geraldogabriel@gmail.com>
+
+commit fb1af5bea4670c835e42fc0c14c49d3499468774 upstream.
+
+Olivia Mackintosh has posted to alsa-devel reporting that
+there's a potential bug that could break mixer quirks for Pioneer
+devices introduced by 6d27788160362a7ee6c0d317636fe4b1ddbe59a7
+"ALSA: usb-audio: Add support for the Pioneer DJM 750MK2
+Mixer/Soundcard".
+
+This happened because the DJM 750 MK2 was added last to the Pioneer DJM
+device table index and defined as 0x4 but was added to snd_djm_devices[]
+just after the DJM 750 (MK1) entry instead of last, after the DJM 900
+NXS2. This escaped review.
+
+To prevent that from ever happening again, Takashi Iwai suggested to use
+C99 array designators in snd_djm_devices[] instead of simply reordering
+the entries.
+
+Fixes: 6d2778816036 ("ALSA: usb-audio: Add support for the Pioneer DJM 750MK2")
+Reported-by: Olivia Mackintosh <livvy@base.nu>
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
+Link: https://lore.kernel.org/r/Yau46FDzoql0SNnW@geday
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_quirks.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -3016,11 +3016,11 @@ static const struct snd_djm_ctl snd_djm_
+
+
+ static const struct snd_djm_device snd_djm_devices[] = {
+- SND_DJM_DEVICE(250mk2),
+- SND_DJM_DEVICE(750),
+- SND_DJM_DEVICE(750mk2),
+- SND_DJM_DEVICE(850),
+- SND_DJM_DEVICE(900nxs2)
++ [SND_DJM_250MK2_IDX] = SND_DJM_DEVICE(250mk2),
++ [SND_DJM_750_IDX] = SND_DJM_DEVICE(750),
++ [SND_DJM_850_IDX] = SND_DJM_DEVICE(850),
++ [SND_DJM_900NXS2_IDX] = SND_DJM_DEVICE(900nxs2),
++ [SND_DJM_750MK2_IDX] = SND_DJM_DEVICE(750mk2),
+ };
+
+
--- /dev/null
+From 23ba28616d3063bd4c4953598ed5e439ca891101 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Tue, 30 Nov 2021 16:05:04 +0000
+Subject: ASoC: codecs: wcd934x: handle channel mappping list correctly
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+commit 23ba28616d3063bd4c4953598ed5e439ca891101 upstream.
+
+Currently each channel is added as list to dai channel list, however
+there is danger of adding same channel to multiple dai channel list
+which endups corrupting the other list where its already added.
+
+This patch ensures that the channel is actually free before adding to
+the dai channel list and also ensures that the channel is on the list
+before deleting it.
+
+This check was missing previously, and we did not hit this issue as
+we were testing very simple usecases with sequence of amixer commands.
+
+Fixes: a70d9245759a ("ASoC: wcd934x: add capture dapm widgets")
+Fixes: dd9eb19b5673 ("ASoC: wcd934x: add playback dapm widgets")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20211130160507.22180-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wcd934x.c | 119 +++++++++++++++++++++++++++++++++------------
+ 1 file changed, 88 insertions(+), 31 deletions(-)
+
+--- a/sound/soc/codecs/wcd934x.c
++++ b/sound/soc/codecs/wcd934x.c
+@@ -3326,6 +3326,31 @@ static int slim_rx_mux_get(struct snd_kc
+ return 0;
+ }
+
++static int slim_rx_mux_to_dai_id(int mux)
++{
++ int aif_id;
++
++ switch (mux) {
++ case 1:
++ aif_id = AIF1_PB;
++ break;
++ case 2:
++ aif_id = AIF2_PB;
++ break;
++ case 3:
++ aif_id = AIF3_PB;
++ break;
++ case 4:
++ aif_id = AIF4_PB;
++ break;
++ default:
++ aif_id = -1;
++ break;
++ }
++
++ return aif_id;
++}
++
+ static int slim_rx_mux_put(struct snd_kcontrol *kc,
+ struct snd_ctl_elem_value *ucontrol)
+ {
+@@ -3333,43 +3358,59 @@ static int slim_rx_mux_put(struct snd_kc
+ struct wcd934x_codec *wcd = dev_get_drvdata(w->dapm->dev);
+ struct soc_enum *e = (struct soc_enum *)kc->private_value;
+ struct snd_soc_dapm_update *update = NULL;
++ struct wcd934x_slim_ch *ch, *c;
+ u32 port_id = w->shift;
++ bool found = false;
++ int mux_idx;
++ int prev_mux_idx = wcd->rx_port_value[port_id];
++ int aif_id;
+
+- if (wcd->rx_port_value[port_id] == ucontrol->value.enumerated.item[0])
+- return 0;
++ mux_idx = ucontrol->value.enumerated.item[0];
+
+- wcd->rx_port_value[port_id] = ucontrol->value.enumerated.item[0];
++ if (mux_idx == prev_mux_idx)
++ return 0;
+
+- switch (wcd->rx_port_value[port_id]) {
++ switch(mux_idx) {
+ case 0:
+- list_del_init(&wcd->rx_chs[port_id].list);
+- break;
+- case 1:
+- list_add_tail(&wcd->rx_chs[port_id].list,
+- &wcd->dai[AIF1_PB].slim_ch_list);
+- break;
+- case 2:
+- list_add_tail(&wcd->rx_chs[port_id].list,
+- &wcd->dai[AIF2_PB].slim_ch_list);
+- break;
+- case 3:
+- list_add_tail(&wcd->rx_chs[port_id].list,
+- &wcd->dai[AIF3_PB].slim_ch_list);
++ aif_id = slim_rx_mux_to_dai_id(prev_mux_idx);
++ if (aif_id < 0)
++ return 0;
++
++ list_for_each_entry_safe(ch, c, &wcd->dai[aif_id].slim_ch_list, list) {
++ if (ch->port == port_id + WCD934X_RX_START) {
++ found = true;
++ list_del_init(&ch->list);
++ break;
++ }
++ }
++ if (!found)
++ return 0;
++
+ break;
+- case 4:
+- list_add_tail(&wcd->rx_chs[port_id].list,
+- &wcd->dai[AIF4_PB].slim_ch_list);
++ case 1 ... 4:
++ aif_id = slim_rx_mux_to_dai_id(mux_idx);
++ if (aif_id < 0)
++ return 0;
++
++ if (list_empty(&wcd->rx_chs[port_id].list)) {
++ list_add_tail(&wcd->rx_chs[port_id].list,
++ &wcd->dai[aif_id].slim_ch_list);
++ } else {
++ dev_err(wcd->dev ,"SLIM_RX%d PORT is busy\n", port_id);
++ return 0;
++ }
+ break;
++
+ default:
+- dev_err(wcd->dev, "Unknown AIF %d\n",
+- wcd->rx_port_value[port_id]);
++ dev_err(wcd->dev, "Unknown AIF %d\n", mux_idx);
+ goto err;
+ }
+
++ wcd->rx_port_value[port_id] = mux_idx;
+ snd_soc_dapm_mux_update_power(w->dapm, kc, wcd->rx_port_value[port_id],
+ e, update);
+
+- return 0;
++ return 1;
+ err:
+ return -EINVAL;
+ }
+@@ -3815,6 +3856,7 @@ static int slim_tx_mixer_put(struct snd_
+ struct soc_mixer_control *mixer =
+ (struct soc_mixer_control *)kc->private_value;
+ int enable = ucontrol->value.integer.value[0];
++ struct wcd934x_slim_ch *ch, *c;
+ int dai_id = widget->shift;
+ int port_id = mixer->shift;
+
+@@ -3822,17 +3864,32 @@ static int slim_tx_mixer_put(struct snd_
+ if (enable == wcd->tx_port_value[port_id])
+ return 0;
+
+- wcd->tx_port_value[port_id] = enable;
+-
+- if (enable)
+- list_add_tail(&wcd->tx_chs[port_id].list,
+- &wcd->dai[dai_id].slim_ch_list);
+- else
+- list_del_init(&wcd->tx_chs[port_id].list);
++ if (enable) {
++ if (list_empty(&wcd->tx_chs[port_id].list)) {
++ list_add_tail(&wcd->tx_chs[port_id].list,
++ &wcd->dai[dai_id].slim_ch_list);
++ } else {
++ dev_err(wcd->dev ,"SLIM_TX%d PORT is busy\n", port_id);
++ return 0;
++ }
++ } else {
++ bool found = false;
++
++ list_for_each_entry_safe(ch, c, &wcd->dai[dai_id].slim_ch_list, list) {
++ if (ch->port == port_id) {
++ found = true;
++ list_del_init(&wcd->tx_chs[port_id].list);
++ break;
++ }
++ }
++ if (!found)
++ return 0;
++ }
+
++ wcd->tx_port_value[port_id] = enable;
+ snd_soc_dapm_mixer_update_power(widget->dapm, kc, enable, update);
+
+- return 0;
++ return 1;
+ }
+
+ static const struct snd_kcontrol_new aif1_slim_cap_mixer[] = {
--- /dev/null
+From d9be0ff4796d1b6f5ee391c1b7e3653a43cedfab Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Tue, 30 Nov 2021 16:05:06 +0000
+Subject: ASoC: codecs: wcd934x: return correct value from mixer put
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+commit d9be0ff4796d1b6f5ee391c1b7e3653a43cedfab upstream.
+
+wcd934x_compander_set() currently returns zero eventhough it changes the value.
+Fix this, so that change notifications are sent correctly.
+
+Fixes: 1cde8b822332 ("ASoC: wcd934x: add basic controls")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20211130160507.22180-4-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wcd934x.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/wcd934x.c
++++ b/sound/soc/codecs/wcd934x.c
+@@ -3256,6 +3256,9 @@ static int wcd934x_compander_set(struct
+ int value = ucontrol->value.integer.value[0];
+ int sel;
+
++ if (wcd->comp_enabled[comp] == value)
++ return 0;
++
+ wcd->comp_enabled[comp] = value;
+ sel = value ? WCD934X_HPH_GAIN_SRC_SEL_COMPANDER :
+ WCD934X_HPH_GAIN_SRC_SEL_REGISTER;
+@@ -3279,10 +3282,10 @@ static int wcd934x_compander_set(struct
+ case COMPANDER_8:
+ break;
+ default:
+- break;
++ return 0;
+ }
+
+- return 0;
++ return 1;
+ }
+
+ static int wcd934x_rx_hph_mode_get(struct snd_kcontrol *kc,
--- /dev/null
+From 3fc27e9a1f619b50700f020e6cd270c1b74755f0 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Tue, 30 Nov 2021 16:05:07 +0000
+Subject: ASoC: codecs: wsa881x: fix return values from kcontrol put
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+commit 3fc27e9a1f619b50700f020e6cd270c1b74755f0 upstream.
+
+wsa881x_set_port() and wsa881x_put_pa_gain() currently returns zero eventhough
+it changes the value. Fix this, so that change notifications are sent
+correctly.
+
+Fixes: a0aab9e1404a ("ASoC: codecs: add wsa881x amplifier support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20211130160507.22180-5-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wsa881x.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/codecs/wsa881x.c
++++ b/sound/soc/codecs/wsa881x.c
+@@ -772,7 +772,8 @@ static int wsa881x_put_pa_gain(struct sn
+
+ usleep_range(1000, 1010);
+ }
+- return 0;
++
++ return 1;
+ }
+
+ static int wsa881x_get_port(struct snd_kcontrol *kcontrol,
+@@ -816,15 +817,22 @@ static int wsa881x_set_port(struct snd_k
+ (struct soc_mixer_control *)kcontrol->private_value;
+ int portidx = mixer->reg;
+
+- if (ucontrol->value.integer.value[0])
++ if (ucontrol->value.integer.value[0]) {
++ if (data->port_enable[portidx])
++ return 0;
++
+ data->port_enable[portidx] = true;
+- else
++ } else {
++ if (!data->port_enable[portidx])
++ return 0;
++
+ data->port_enable[portidx] = false;
++ }
+
+ if (portidx == WSA881X_PORT_BOOST) /* Boost Switch */
+ wsa881x_boost_ctrl(comp, data->port_enable[portidx]);
+
+- return 0;
++ return 1;
+ }
+
+ static const char * const smart_boost_lvl_text[] = {
--- /dev/null
+From 4739d88ad8e1900f809f8a5c98f3c1b65bf76220 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Tue, 30 Nov 2021 16:31:10 +0000
+Subject: ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+commit 4739d88ad8e1900f809f8a5c98f3c1b65bf76220 upstream.
+
+msm_routing_put_audio_mixer() can return incorrect value in various scenarios.
+
+scenario 1:
+amixer cset iface=MIXER,name='SLIMBUS_0_RX Audio Mixer MultiMedia1' 1
+amixer cset iface=MIXER,name='SLIMBUS_0_RX Audio Mixer MultiMedia1' 0
+
+return value is 0 instead of 1 eventhough value was changed
+
+scenario 2:
+amixer cset iface=MIXER,name='SLIMBUS_0_RX Audio Mixer MultiMedia1' 1
+amixer cset iface=MIXER,name='SLIMBUS_0_RX Audio Mixer MultiMedia1' 1
+
+return value is 1 instead of 0 eventhough the value was not changed
+
+scenario 3:
+amixer cset iface=MIXER,name='SLIMBUS_0_RX Audio Mixer MultiMedia1' 0
+return value is 1 instead of 0 eventhough the value was not changed
+
+Fix this by adding checks, so that change notifications are sent correctly.
+
+Fixes: e3a33673e845 ("ASoC: qdsp6: q6routing: Add q6routing driver")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20211130163110.5628-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/qcom/qdsp6/q6routing.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/qcom/qdsp6/q6routing.c
++++ b/sound/soc/qcom/qdsp6/q6routing.c
+@@ -492,14 +492,16 @@ static int msm_routing_put_audio_mixer(s
+ struct session_data *session = &data->sessions[session_id];
+
+ if (ucontrol->value.integer.value[0]) {
++ if (session->port_id == be_id)
++ return 0;
++
+ session->port_id = be_id;
+ snd_soc_dapm_mixer_update_power(dapm, kcontrol, 1, update);
+ } else {
+- if (session->port_id == be_id) {
+- session->port_id = -1;
++ if (session->port_id == -1 || session->port_id != be_id)
+ return 0;
+- }
+
++ session->port_id = -1;
+ snd_soc_dapm_mixer_update_power(dapm, kcontrol, 0, update);
+ }
+
--- /dev/null
+From 4999d703c0e66f9f196b6edc0b8fdeca8846b8b6 Mon Sep 17 00:00:00 2001
+From: Rob Clark <robdclark@chromium.org>
+Date: Wed, 17 Nov 2021 17:04:52 -0800
+Subject: ASoC: rt5682: Fix crash due to out of scope stack vars
+
+From: Rob Clark <robdclark@chromium.org>
+
+commit 4999d703c0e66f9f196b6edc0b8fdeca8846b8b6 upstream.
+
+Move the declaration of temporary arrays to somewhere that won't go out
+of scope before the devm_clk_hw_register() call, lest we be at the whim
+of the compiler for whether those stack variables get overwritten.
+
+Fixes a crash seen with gcc version 11.2.1 20210728 (Red Hat 11.2.1-1)
+
+Fixes: edbd24ea1e5c ("ASoC: rt5682: Drop usage of __clk_get_name()")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20211118010453.843286-1-robdclark@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/rt5682.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/codecs/rt5682.c
++++ b/sound/soc/codecs/rt5682.c
+@@ -2840,6 +2840,8 @@ static int rt5682_register_dai_clks(stru
+
+ for (i = 0; i < RT5682_DAI_NUM_CLKS; ++i) {
+ struct clk_init_data init = { };
++ struct clk_parent_data parent_data;
++ const struct clk_hw *parent;
+
+ dai_clk_hw = &rt5682->dai_clks_hw[i];
+
+@@ -2847,17 +2849,17 @@ static int rt5682_register_dai_clks(stru
+ case RT5682_DAI_WCLK_IDX:
+ /* Make MCLK the parent of WCLK */
+ if (rt5682->mclk) {
+- init.parent_data = &(struct clk_parent_data){
++ parent_data = (struct clk_parent_data){
+ .fw_name = "mclk",
+ };
++ init.parent_data = &parent_data;
+ init.num_parents = 1;
+ }
+ break;
+ case RT5682_DAI_BCLK_IDX:
+ /* Make WCLK the parent of BCLK */
+- init.parent_hws = &(const struct clk_hw *){
+- &rt5682->dai_clks_hw[RT5682_DAI_WCLK_IDX]
+- };
++ parent = &rt5682->dai_clks_hw[RT5682_DAI_WCLK_IDX];
++ init.parent_hws = &parent;
+ init.num_parents = 1;
+ break;
+ default:
--- /dev/null
+From e6a59aac8a8713f335a37d762db0dbe80e7f6d38 Mon Sep 17 00:00:00 2001
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Fri, 10 Dec 2021 10:20:58 -0800
+Subject: block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
+
+From: Davidlohr Bueso <dave@stgolabs.net>
+
+commit e6a59aac8a8713f335a37d762db0dbe80e7f6d38 upstream.
+
+do_each_pid_thread(PIDTYPE_PGID) can race with a concurrent
+change_pid(PIDTYPE_PGID) that can move the task from one hlist
+to another while iterating. Serialize ioprio_get to take
+the tasklist_lock in this case, just like it's set counterpart.
+
+Fixes: d69b78ba1de (ioprio: grab rcu_read_lock in sys_ioprio_{set,get}())
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Link: https://lore.kernel.org/r/20211210182058.43417-1-dave@stgolabs.net
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/ioprio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/block/ioprio.c
++++ b/block/ioprio.c
+@@ -220,6 +220,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which,
+ pgrp = task_pgrp(current);
+ else
+ pgrp = find_vpid(who);
++ read_lock(&tasklist_lock);
+ do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
+ tmpio = get_task_ioprio(p);
+ if (tmpio < 0)
+@@ -229,6 +230,8 @@ SYSCALL_DEFINE2(ioprio_get, int, which,
+ else
+ ret = ioprio_best(ret, tmpio);
+ } while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
++ read_unlock(&tasklist_lock);
++
+ break;
+ case IOPRIO_WHO_USER:
+ uid = make_kuid(current_user_ns(), who);
--- /dev/null
+From c0d95d3380ee099d735e08618c0d599e72f6c8b0 Mon Sep 17 00:00:00 2001
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Fri, 19 Nov 2021 10:14:18 -0800
+Subject: bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+commit c0d95d3380ee099d735e08618c0d599e72f6c8b0 upstream.
+
+When a sock is added to a sock map we evaluate what proto op hooks need to
+be used. However, when the program is removed from the sock map we have not
+been evaluating if that changes the required program layout.
+
+Before the patch listed in the 'fixes' tag this was not causing failures
+because the base program set handles all cases. Specifically, the case with
+a stream parser and the case with out a stream parser are both handled. With
+the fix below we identified a race when running with a proto op that attempts
+to read skbs off both the stream parser and the skb->receive_queue. Namely,
+that a race existed where when the stream parser is empty checking the
+skb->receive_queue from recvmsg at the precies moment when the parser is
+paused and the receive_queue is not empty could result in skipping the stream
+parser. This may break a RX policy depending on the parser to run.
+
+The fix tag then loads a specific proto ops that resolved this race. But, we
+missed removing that proto ops recv hook when the sock is removed from the
+sockmap. The result is the stream parser is stopped so no more skbs will be
+aggregated there, but the hook and BPF program continues to be attached on
+the psock. User space will then get an EBUSY when trying to read the socket
+because the recvmsg() handler is now waiting on a stopped stream parser.
+
+To fix we rerun the proto ops init() function which will look at the new set
+of progs attached to the psock and rest the proto ops hook to the correct
+handlers. And in the above case where we remove the sock from the sock map
+the RX prog will no longer be listed so the proto ops is removed.
+
+Fixes: c5d2177a72a16 ("bpf, sockmap: Fix race in ingress receive verdict with redirect to self")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20211119181418.353932-3-john.fastabend@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/skmsg.c | 5 +++++
+ net/core/sock_map.c | 5 ++++-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -1124,6 +1124,8 @@ void sk_psock_start_strp(struct sock *sk
+
+ void sk_psock_stop_strp(struct sock *sk, struct sk_psock *psock)
+ {
++ psock_set_prog(&psock->progs.stream_parser, NULL);
++
+ if (!psock->saved_data_ready)
+ return;
+
+@@ -1212,6 +1214,9 @@ void sk_psock_start_verdict(struct sock
+
+ void sk_psock_stop_verdict(struct sock *sk, struct sk_psock *psock)
+ {
++ psock_set_prog(&psock->progs.stream_verdict, NULL);
++ psock_set_prog(&psock->progs.skb_verdict, NULL);
++
+ if (!psock->saved_data_ready)
+ return;
+
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -167,8 +167,11 @@ static void sock_map_del_link(struct soc
+ write_lock_bh(&sk->sk_callback_lock);
+ if (strp_stop)
+ sk_psock_stop_strp(sk, psock);
+- else
++ if (verdict_stop)
+ sk_psock_stop_verdict(sk, psock);
++
++ if (psock->psock_update_sk_prot)
++ psock->psock_update_sk_prot(sk, psock, false);
+ write_unlock_bh(&sk->sk_callback_lock);
+ }
+ }
--- /dev/null
+From eee377b8f44e7ac4f76bbf2440e5cbbc1d25c25f Mon Sep 17 00:00:00 2001
+From: Miles Chen <miles.chen@mediatek.com>
+Date: Sun, 5 Sep 2021 07:54:18 +0800
+Subject: clk: imx: use module_platform_driver
+
+From: Miles Chen <miles.chen@mediatek.com>
+
+commit eee377b8f44e7ac4f76bbf2440e5cbbc1d25c25f upstream.
+
+Replace builtin_platform_driver_probe with module_platform_driver_probe
+because CONFIG_CLK_IMX8QXP can be set to =m (kernel module).
+
+Fixes: e0d0d4d86c766 ("clk: imx8qxp: Support building i.MX8QXP clock driver as module")
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Miles Chen <miles.chen@mediatek.com>
+Link: https://lore.kernel.org/r/20210904235418.2442-1-miles.chen@mediatek.com
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/imx/clk-imx8qxp-lpcg.c | 2 +-
+ drivers/clk/imx/clk-imx8qxp.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/imx/clk-imx8qxp-lpcg.c
++++ b/drivers/clk/imx/clk-imx8qxp-lpcg.c
+@@ -370,7 +370,7 @@ static struct platform_driver imx8qxp_lp
+ .probe = imx8qxp_lpcg_clk_probe,
+ };
+
+-builtin_platform_driver(imx8qxp_lpcg_clk_driver);
++module_platform_driver(imx8qxp_lpcg_clk_driver);
+
+ MODULE_AUTHOR("Aisheng Dong <aisheng.dong@nxp.com>");
+ MODULE_DESCRIPTION("NXP i.MX8QXP LPCG clock driver");
+--- a/drivers/clk/imx/clk-imx8qxp.c
++++ b/drivers/clk/imx/clk-imx8qxp.c
+@@ -308,7 +308,7 @@ static struct platform_driver imx8qxp_cl
+ },
+ .probe = imx8qxp_clk_probe,
+ };
+-builtin_platform_driver(imx8qxp_clk_driver);
++module_platform_driver(imx8qxp_clk_driver);
+
+ MODULE_AUTHOR("Aisheng Dong <aisheng.dong@nxp.com>");
+ MODULE_DESCRIPTION("NXP i.MX8QXP clock driver");
--- /dev/null
+From a1f0019c342bd83240b05be68c9888549dde7935 Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Tue, 23 Nov 2021 08:25:08 -0800
+Subject: clk: qcom: clk-alpha-pll: Don't reconfigure running Trion
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+commit a1f0019c342bd83240b05be68c9888549dde7935 upstream.
+
+In the event that the bootloader has configured the Trion PLL as source
+for the display clocks, e.g. for the continuous splashscreen, then there
+will also be RCGs that are clocked by this instance.
+
+Reconfiguring, and in particular disabling the output of, the PLL will
+cause issues for these downstream RCGs and has been shown to prevent
+them from being re-parented.
+
+Follow downstream and skip configuration if it's determined that the PLL
+is already running.
+
+Fixes: 59128c20a6a9 ("clk: qcom: clk-alpha-pll: Add support for controlling Lucid PLLs")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Reviewed-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20211123162508.153711-1-bjorn.andersson@linaro.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/clk-alpha-pll.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/clk/qcom/clk-alpha-pll.c
++++ b/drivers/clk/qcom/clk-alpha-pll.c
+@@ -1429,6 +1429,15 @@ EXPORT_SYMBOL_GPL(clk_alpha_pll_postdiv_
+ void clk_trion_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap,
+ const struct alpha_pll_config *config)
+ {
++ /*
++ * If the bootloader left the PLL enabled it's likely that there are
++ * RCGs that will lock up if we disable the PLL below.
++ */
++ if (trion_pll_is_enabled(pll, regmap)) {
++ pr_debug("Trion PLL is already enabled, skipping configuration\n");
++ return;
++ }
++
+ clk_alpha_pll_write_config(regmap, PLL_L_VAL(pll), config->l);
+ regmap_write(regmap, PLL_CAL_L_VAL(pll), TRION_PLL_CAL_VAL);
+ clk_alpha_pll_write_config(regmap, PLL_ALPHA_VAL(pll), config->alpha);
--- /dev/null
+From 6a631c0432dcccbcf45839016a07c015e335e9ae Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Sat, 27 Nov 2021 17:31:59 +0100
+Subject: Documentation/locking/locktypes: Update migrate_disable() bits.
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+commit 6a631c0432dcccbcf45839016a07c015e335e9ae upstream.
+
+The initial implementation of migrate_disable() for mainline was a
+wrapper around preempt_disable(). RT kernels substituted this with
+a real migrate disable implementation.
+
+Later on mainline gained true migrate disable support, but the
+documentation was not updated.
+
+Update the documentation, remove the claims about migrate_disable()
+mapping to preempt_disable() on non-PREEMPT_RT kernels.
+
+Fixes: 74d862b682f51 ("sched: Make migrate_disable/enable() independent of RT")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20211127163200.10466-2-bigeasy@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/locking/locktypes.rst | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/Documentation/locking/locktypes.rst
++++ b/Documentation/locking/locktypes.rst
+@@ -439,11 +439,9 @@ preemption. The following substitution w
+ spin_lock(&p->lock);
+ p->count += this_cpu_read(var2);
+
+-On a non-PREEMPT_RT kernel migrate_disable() maps to preempt_disable()
+-which makes the above code fully equivalent. On a PREEMPT_RT kernel
+ migrate_disable() ensures that the task is pinned on the current CPU which
+ in turn guarantees that the per-CPU access to var1 and var2 are staying on
+-the same CPU.
++the same CPU while the task remains preemptible.
+
+ The migrate_disable() substitution is not valid for the following
+ scenario::
+@@ -456,9 +454,8 @@ scenario::
+ p = this_cpu_ptr(&var1);
+ p->val = func2();
+
+-While correct on a non-PREEMPT_RT kernel, this breaks on PREEMPT_RT because
+-here migrate_disable() does not protect against reentrancy from a
+-preempting task. A correct substitution for this case is::
++This breaks because migrate_disable() does not protect against reentrancy from
++a preempting task. A correct substitution for this case is::
+
+ func()
+ {
--- /dev/null
+From af6902ec415655236adea91826bd96ed0ab16f42 Mon Sep 17 00:00:00 2001
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Date: Tue, 23 Nov 2021 11:56:38 -0500
+Subject: drm/amd/display: Fix DPIA outbox timeout after S3/S4/reset
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+commit af6902ec415655236adea91826bd96ed0ab16f42 upstream.
+
+[Why]
+The HW interrupt gets disabled after S3/S4/reset so we don't receive
+notifications for HPD or AUX from DMUB - leading to timeout and
+black screen with (or without) DPIA links connected.
+
+[How]
+Re-enable the interrupt after S3/S4/reset like we do for the other
+DC interrupts.
+
+Guard both instances of the outbox interrupt enable or we'll hang
+during restore on ASIC that don't support it.
+
+Fixes: 6eff272dbee7ad ("drm/amd/display: Fix DPIA outbox timeout after GPU reset")
+
+Reviewed-by: Jude Shih <Jude.Shih@amd.com>
+Acked-by: Pavle Kotarac <Pavle.Kotarac@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -2213,7 +2213,8 @@ static int dm_resume(void *handle)
+ if (amdgpu_in_reset(adev)) {
+ dc_state = dm->cached_dc_state;
+
+- amdgpu_dm_outbox_init(adev);
++ if (dc_enable_dmub_notifications(adev->dm.dc))
++ amdgpu_dm_outbox_init(adev);
+
+ r = dm_dmub_hw_init(adev);
+ if (r)
+@@ -2262,6 +2263,10 @@ static int dm_resume(void *handle)
+ /* TODO: Remove dc_state->dccg, use dc->dccg directly. */
+ dc_resource_state_construct(dm->dc, dm_state->context);
+
++ /* Re-enable outbox interrupts for DPIA. */
++ if (dc_enable_dmub_notifications(adev->dm.dc))
++ amdgpu_dm_outbox_init(adev);
++
+ /* Before powering on DC we need to re-initialize DMUB. */
+ r = dm_dmub_hw_init(adev);
+ if (r)
--- /dev/null
+From 96db48c9d777a73a33b1d516c5cfed7a417a5f40 Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+Date: Tue, 30 Nov 2021 09:27:56 +0100
+Subject: dt-bindings: net: Reintroduce PHY no lane swap binding
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+commit 96db48c9d777a73a33b1d516c5cfed7a417a5f40 upstream.
+
+This binding was already documented in phy.txt, commit 252ae5330daa
+("Documentation: devicetree: Add PHY no lane swap binding"), but got
+accidently removed during YAML conversion in commit d8704342c109
+("dt-bindings: net: Add a YAML schemas for the generic PHY options").
+
+Note: 'enet-phy-lane-no-swap' and the absence of 'enet-phy-lane-swap' are
+not identical, as the former one disable this feature, while the latter
+one doesn't change anything.
+
+Fixes: d8704342c109 ("dt-bindings: net: Add a YAML schemas for the generic PHY options")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20211130082756.713919-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/net/ethernet-phy.yaml | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/Documentation/devicetree/bindings/net/ethernet-phy.yaml
++++ b/Documentation/devicetree/bindings/net/ethernet-phy.yaml
+@@ -91,6 +91,14 @@ properties:
+ compensate for the board being designed with the lanes
+ swapped.
+
++ enet-phy-lane-no-swap:
++ $ref: /schemas/types.yaml#/definitions/flag
++ description:
++ If set, indicates that PHY will disable swap of the
++ TX/RX lanes. This property allows the PHY to work correcly after
++ e.g. wrong bootstrap configuration caused by issues in PCB
++ layout design.
++
+ eee-broken-100tx:
+ $ref: /schemas/types.yaml#/definitions/flag
+ description:
--- /dev/null
+From dbd3e6eaf3d813939b28e8a66e29d81cdc836445 Mon Sep 17 00:00:00 2001
+From: Armin Wolf <W_Armin@gmx.de>
+Date: Fri, 12 Nov 2021 18:14:40 +0100
+Subject: hwmon: (dell-smm) Fix warning on /proc/i8k creation error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+commit dbd3e6eaf3d813939b28e8a66e29d81cdc836445 upstream.
+
+The removal function is called regardless of whether
+/proc/i8k was created successfully or not, the later
+causing a WARN() on module removal.
+Fix that by only registering the removal function
+if /proc/i8k was created successfully.
+
+Tested on a Inspiron 3505.
+
+Fixes: 039ae58503f3 ("hwmon: Allow to compile dell-smm-hwmon driver without /proc/i8k")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Acked-by: Pali Rohár <pali@kernel.org>
+Link: https://lore.kernel.org/r/20211112171440.59006-1-W_Armin@gmx.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/dell-smm-hwmon.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -623,10 +623,9 @@ static void __init i8k_init_procfs(struc
+ {
+ struct dell_smm_data *data = dev_get_drvdata(dev);
+
+- /* Register the proc entry */
+- proc_create_data("i8k", 0, NULL, &i8k_proc_ops, data);
+-
+- devm_add_action_or_reset(dev, i8k_exit_procfs, NULL);
++ /* Only register exit function if creation was successful */
++ if (proc_create_data("i8k", 0, NULL, &i8k_proc_ops, data))
++ devm_add_action_or_reset(dev, i8k_exit_procfs, NULL);
+ }
+
+ #else
--- /dev/null
+From a74c313aca266fab0d1d1a72becbb8b7b5286b6e Mon Sep 17 00:00:00 2001
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Date: Tue, 7 Dec 2021 17:21:44 +1300
+Subject: i2c: mpc: Use atomic read and fix break condition
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+commit a74c313aca266fab0d1d1a72becbb8b7b5286b6e upstream.
+
+Maxime points out that the polling code in mpc_i2c_isr should use the
+_atomic API because it is called in an irq context and that the
+behaviour of the MCF bit is that it is 1 when the byte transfer is
+complete. All of this means the original code was effectively a
+udelay(100).
+
+Fix this by using readb_poll_timeout_atomic() and removing the negation
+of the break condition.
+
+Fixes: 4a8ac5e45cda ("i2c: mpc: Poll for MCF")
+Reported-by: Maxime Bizon <mbizon@freebox.fr>
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Tested-by: Maxime Bizon <mbizon@freebox.fr>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-mpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-mpc.c
++++ b/drivers/i2c/busses/i2c-mpc.c
+@@ -636,7 +636,7 @@ static irqreturn_t mpc_i2c_isr(int irq,
+ status = readb(i2c->base + MPC_I2C_SR);
+ if (status & CSR_MIF) {
+ /* Wait up to 100us for transfer to properly complete */
+- readb_poll_timeout(i2c->base + MPC_I2C_SR, status, !(status & CSR_MCF), 0, 100);
++ readb_poll_timeout_atomic(i2c->base + MPC_I2C_SR, status, status & CSR_MCF, 0, 100);
+ writeb(0, i2c->base + MPC_I2C_SR);
+ mpc_i2c_do_intr(i2c, status);
+ return IRQ_HANDLED;
--- /dev/null
+From 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 Mon Sep 17 00:00:00 2001
+From: Karen Sornek <karen.sornek@intel.com>
+Date: Fri, 14 May 2021 11:43:13 +0200
+Subject: i40e: Fix failed opcode appearing if handling messages from VF
+
+From: Karen Sornek <karen.sornek@intel.com>
+
+commit 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 upstream.
+
+Fix failed operation code appearing if handling messages from VF.
+Implemented by waiting for VF appropriate state if request starts
+handle while VF reset.
+Without this patch the message handling request while VF is in
+a reset state ends with error -5 (I40E_ERR_PARAM).
+
+Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface")
+Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
+Signed-off-by: Karen Sornek <karen.sornek@intel.com>
+Tested-by: Tony Brelinski <tony.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 70 ++++++++++++++-------
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 2
+ 2 files changed, 50 insertions(+), 22 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1949,6 +1949,32 @@ static int i40e_vc_send_resp_to_vf(struc
+ }
+
+ /**
++ * i40e_sync_vf_state
++ * @vf: pointer to the VF info
++ * @state: VF state
++ *
++ * Called from a VF message to synchronize the service with a potential
++ * VF reset state
++ **/
++static bool i40e_sync_vf_state(struct i40e_vf *vf, enum i40e_vf_states state)
++{
++ int i;
++
++ /* When handling some messages, it needs VF state to be set.
++ * It is possible that this flag is cleared during VF reset,
++ * so there is a need to wait until the end of the reset to
++ * handle the request message correctly.
++ */
++ for (i = 0; i < I40E_VF_STATE_WAIT_COUNT; i++) {
++ if (test_bit(state, &vf->vf_states))
++ return true;
++ usleep_range(10000, 20000);
++ }
++
++ return test_bit(state, &vf->vf_states);
++}
++
++/**
+ * i40e_vc_get_version_msg
+ * @vf: pointer to the VF info
+ * @msg: pointer to the msg buffer
+@@ -2008,7 +2034,7 @@ static int i40e_vc_get_vf_resources_msg(
+ size_t len = 0;
+ int ret;
+
+- if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_INIT)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto err;
+ }
+@@ -2131,7 +2157,7 @@ static int i40e_vc_config_promiscuous_mo
+ bool allmulti = false;
+ bool alluni = false;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto err_out;
+ }
+@@ -2219,7 +2245,7 @@ static int i40e_vc_config_queues_msg(str
+ struct i40e_vsi *vsi;
+ u16 num_qps_all = 0;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto error_param;
+ }
+@@ -2368,7 +2394,7 @@ static int i40e_vc_config_irq_map_msg(st
+ i40e_status aq_ret = 0;
+ int i;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto error_param;
+ }
+@@ -2540,7 +2566,7 @@ static int i40e_vc_disable_queues_msg(st
+ struct i40e_pf *pf = vf->pf;
+ i40e_status aq_ret = 0;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto error_param;
+ }
+@@ -2590,7 +2616,7 @@ static int i40e_vc_request_queues_msg(st
+ u8 cur_pairs = vf->num_queue_pairs;
+ struct i40e_pf *pf = vf->pf;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states))
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE))
+ return -EINVAL;
+
+ if (req_pairs > I40E_MAX_VF_QUEUES) {
+@@ -2635,7 +2661,7 @@ static int i40e_vc_get_stats_msg(struct
+
+ memset(&stats, 0, sizeof(struct i40e_eth_stats));
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto error_param;
+ }
+@@ -2752,7 +2778,7 @@ static int i40e_vc_add_mac_addr_msg(stru
+ i40e_status ret = 0;
+ int i;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states) ||
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE) ||
+ !i40e_vc_isvalid_vsi_id(vf, al->vsi_id)) {
+ ret = I40E_ERR_PARAM;
+ goto error_param;
+@@ -2824,7 +2850,7 @@ static int i40e_vc_del_mac_addr_msg(stru
+ i40e_status ret = 0;
+ int i;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states) ||
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE) ||
+ !i40e_vc_isvalid_vsi_id(vf, al->vsi_id)) {
+ ret = I40E_ERR_PARAM;
+ goto error_param;
+@@ -2968,7 +2994,7 @@ static int i40e_vc_remove_vlan_msg(struc
+ i40e_status aq_ret = 0;
+ int i;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states) ||
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE) ||
+ !i40e_vc_isvalid_vsi_id(vf, vfl->vsi_id)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto error_param;
+@@ -3088,9 +3114,9 @@ static int i40e_vc_config_rss_key(struct
+ struct i40e_vsi *vsi = NULL;
+ i40e_status aq_ret = 0;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states) ||
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE) ||
+ !i40e_vc_isvalid_vsi_id(vf, vrk->vsi_id) ||
+- (vrk->key_len != I40E_HKEY_ARRAY_SIZE)) {
++ vrk->key_len != I40E_HKEY_ARRAY_SIZE) {
+ aq_ret = I40E_ERR_PARAM;
+ goto err;
+ }
+@@ -3119,9 +3145,9 @@ static int i40e_vc_config_rss_lut(struct
+ i40e_status aq_ret = 0;
+ u16 i;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states) ||
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE) ||
+ !i40e_vc_isvalid_vsi_id(vf, vrl->vsi_id) ||
+- (vrl->lut_entries != I40E_VF_HLUT_ARRAY_SIZE)) {
++ vrl->lut_entries != I40E_VF_HLUT_ARRAY_SIZE) {
+ aq_ret = I40E_ERR_PARAM;
+ goto err;
+ }
+@@ -3154,7 +3180,7 @@ static int i40e_vc_get_rss_hena(struct i
+ i40e_status aq_ret = 0;
+ int len = 0;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto err;
+ }
+@@ -3190,7 +3216,7 @@ static int i40e_vc_set_rss_hena(struct i
+ struct i40e_hw *hw = &pf->hw;
+ i40e_status aq_ret = 0;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto err;
+ }
+@@ -3215,7 +3241,7 @@ static int i40e_vc_enable_vlan_stripping
+ i40e_status aq_ret = 0;
+ struct i40e_vsi *vsi;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto err;
+ }
+@@ -3241,7 +3267,7 @@ static int i40e_vc_disable_vlan_strippin
+ i40e_status aq_ret = 0;
+ struct i40e_vsi *vsi;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto err;
+ }
+@@ -3468,7 +3494,7 @@ static int i40e_vc_del_cloud_filter(stru
+ i40e_status aq_ret = 0;
+ int i, ret;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto err;
+ }
+@@ -3599,7 +3625,7 @@ static int i40e_vc_add_cloud_filter(stru
+ i40e_status aq_ret = 0;
+ int i, ret;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto err_out;
+ }
+@@ -3708,7 +3734,7 @@ static int i40e_vc_add_qch_msg(struct i4
+ i40e_status aq_ret = 0;
+ u64 speed = 0;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto err;
+ }
+@@ -3824,7 +3850,7 @@ static int i40e_vc_del_qch_msg(struct i4
+ struct i40e_pf *pf = vf->pf;
+ i40e_status aq_ret = 0;
+
+- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto err;
+ }
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
+@@ -18,6 +18,8 @@
+
+ #define I40E_MAX_VF_PROMISC_FLAGS 3
+
++#define I40E_VF_STATE_WAIT_COUNT 20
++
+ /* Various queue ctrls */
+ enum i40e_queue_ctrl {
+ I40E_QUEUE_CTRL_UNKNOWN = 0,
--- /dev/null
+From 23ec111bf3549aae37140330c31a16abfc172421 Mon Sep 17 00:00:00 2001
+From: Norbert Zulinski <norbertx.zulinski@intel.com>
+Date: Mon, 22 Nov 2021 12:29:05 +0100
+Subject: i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
+
+From: Norbert Zulinski <norbertx.zulinski@intel.com>
+
+commit 23ec111bf3549aae37140330c31a16abfc172421 upstream.
+
+When trying to dump VFs VSI RX/TX descriptors
+using debugfs there was a crash
+due to NULL pointer dereference in i40e_dbg_dump_desc.
+Added a check to i40e_dbg_dump_desc that checks if
+VSI type is correct for dumping RX/TX descriptors.
+
+Fixes: 02e9c290814c ("i40e: debugfs interface")
+Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Signed-off-by: Norbert Zulinski <norbertx.zulinski@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Tested-by: Gurucharan G <gurucharanx.g@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+@@ -553,6 +553,14 @@ static void i40e_dbg_dump_desc(int cnt,
+ dev_info(&pf->pdev->dev, "vsi %d not found\n", vsi_seid);
+ return;
+ }
++ if (vsi->type != I40E_VSI_MAIN &&
++ vsi->type != I40E_VSI_FDIR &&
++ vsi->type != I40E_VSI_VMDQ2) {
++ dev_info(&pf->pdev->dev,
++ "vsi %d type %d descriptor rings not available\n",
++ vsi_seid, vsi->type);
++ return;
++ }
+ if (type == RING_TYPE_XDP && !i40e_enabled_xdp_vsi(vsi)) {
+ dev_info(&pf->pdev->dev, "XDP not enabled on VSI %d\n", vsi_seid);
+ return;
--- /dev/null
+From 8aa55ab422d9d0d825ebfb877702ed661e96e682 Mon Sep 17 00:00:00 2001
+From: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Date: Fri, 16 Jul 2021 11:33:56 +0200
+Subject: i40e: Fix pre-set max number of queues for VF
+
+From: Mateusz Palczewski <mateusz.palczewski@intel.com>
+
+commit 8aa55ab422d9d0d825ebfb877702ed661e96e682 upstream.
+
+After setting pre-set combined to 16 queues and reserving 16 queues by
+tc qdisc, pre-set maximum combined queues returned to default value
+after VF reset being 4 and this generated errors during removing tc.
+Fixed by removing clear num_req_queues before reset VF.
+
+Fixes: e284fc280473 (i40e: Add and delete cloud filter)
+Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Tested-by: Bindushree P <Bindushree.p@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -3823,11 +3823,6 @@ static int i40e_vc_add_qch_msg(struct i4
+
+ /* set this flag only after making sure all inputs are sane */
+ vf->adq_enabled = true;
+- /* num_req_queues is set when user changes number of queues via ethtool
+- * and this causes issue for default VSI(which depends on this variable)
+- * when ADq is enabled, hence reset it.
+- */
+- vf->num_req_queues = 0;
+
+ /* reset the VF in order to allocate resources */
+ i40e_vc_reset_vf(vf, true);
--- /dev/null
+From 9472335eaa1452b51dc8e8edaa1a342997cb80c7 Mon Sep 17 00:00:00 2001
+From: Herve Codina <herve.codina@bootlin.com>
+Date: Fri, 19 Nov 2021 16:03:16 +0100
+Subject: mtd: rawnand: fsmc: Fix timing computation
+
+From: Herve Codina <herve.codina@bootlin.com>
+
+commit 9472335eaa1452b51dc8e8edaa1a342997cb80c7 upstream.
+
+Under certain circumstances, the timing settings calculated by
+the FSMC NAND controller driver were inaccurate.
+These settings led to incorrect data reads or fallback to
+timing mode 0 depending on the NAND chip used.
+
+The timing computation did not take into account the following
+constraint given in SPEAr3xx reference manual:
+ twait >= tCEA - (tset * TCLK) + TOUTDEL + TINDEL
+
+Enhance the timings calculation by taking into account this
+additional constraint.
+
+This change has no impact on slow timing modes such as mode 0.
+Indeed, on mode 0, computed values are the same with and
+without the patch.
+
+NANDs which previously stayed in mode 0 because of fallback to
+mode 0 can now work at higher speeds and NANDs which were not
+working at all because of the corrupted data work at high
+speeds without troubles.
+
+Overall improvement on a Micron/MT29F1G08 (flash_speed tool):
+ mode0 mode3
+eraseblock write speed 3220 KiB/s 4511 KiB/s
+eraseblock read speed 4491 KiB/s 7529 KiB/s
+
+Fixes: d9fb079571833 ("mtd: nand: fsmc: add support for SDR timings")
+Signed-off-by: Herve Codina <herve.codina@bootlin.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20211119150316.43080-5-herve.codina@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/fsmc_nand.c | 32 ++++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+--- a/drivers/mtd/nand/raw/fsmc_nand.c
++++ b/drivers/mtd/nand/raw/fsmc_nand.c
+@@ -94,6 +94,14 @@
+
+ #define FSMC_BUSY_WAIT_TIMEOUT (1 * HZ)
+
++/*
++ * According to SPEAr300 Reference Manual (RM0082)
++ * TOUDEL = 7ns (Output delay from the flip-flops to the board)
++ * TINDEL = 5ns (Input delay from the board to the flipflop)
++ */
++#define TOUTDEL 7000
++#define TINDEL 5000
++
+ struct fsmc_nand_timings {
+ u8 tclr;
+ u8 tar;
+@@ -278,7 +286,7 @@ static int fsmc_calc_timings(struct fsmc
+ {
+ unsigned long hclk = clk_get_rate(host->clk);
+ unsigned long hclkn = NSEC_PER_SEC / hclk;
+- u32 thiz, thold, twait, tset;
++ u32 thiz, thold, twait, tset, twait_min;
+
+ if (sdrt->tRC_min < 30000)
+ return -EOPNOTSUPP;
+@@ -310,13 +318,6 @@ static int fsmc_calc_timings(struct fsmc
+ else if (tims->thold > FSMC_THOLD_MASK)
+ tims->thold = FSMC_THOLD_MASK;
+
+- twait = max(sdrt->tRP_min, sdrt->tWP_min);
+- tims->twait = DIV_ROUND_UP(twait / 1000, hclkn) - 1;
+- if (tims->twait == 0)
+- tims->twait = 1;
+- else if (tims->twait > FSMC_TWAIT_MASK)
+- tims->twait = FSMC_TWAIT_MASK;
+-
+ tset = max(sdrt->tCS_min - sdrt->tWP_min,
+ sdrt->tCEA_max - sdrt->tREA_max);
+ tims->tset = DIV_ROUND_UP(tset / 1000, hclkn) - 1;
+@@ -325,6 +326,21 @@ static int fsmc_calc_timings(struct fsmc
+ else if (tims->tset > FSMC_TSET_MASK)
+ tims->tset = FSMC_TSET_MASK;
+
++ /*
++ * According to SPEAr300 Reference Manual (RM0082) which gives more
++ * information related to FSMSC timings than the SPEAr600 one (RM0305),
++ * twait >= tCEA - (tset * TCLK) + TOUTDEL + TINDEL
++ */
++ twait_min = sdrt->tCEA_max - ((tims->tset + 1) * hclkn * 1000)
++ + TOUTDEL + TINDEL;
++ twait = max3(sdrt->tRP_min, sdrt->tWP_min, twait_min);
++
++ tims->twait = DIV_ROUND_UP(twait / 1000, hclkn) - 1;
++ if (tims->twait == 0)
++ tims->twait = 1;
++ else if (tims->twait > FSMC_TWAIT_MASK)
++ tims->twait = FSMC_TWAIT_MASK;
++
+ return 0;
+ }
+
--- /dev/null
+From a4ca0c439f2d5ce9a3dc118d882f9f03449864c8 Mon Sep 17 00:00:00 2001
+From: Herve Codina <herve.codina@bootlin.com>
+Date: Fri, 19 Nov 2021 16:03:15 +0100
+Subject: mtd: rawnand: fsmc: Take instruction delay into account
+
+From: Herve Codina <herve.codina@bootlin.com>
+
+commit a4ca0c439f2d5ce9a3dc118d882f9f03449864c8 upstream.
+
+The FSMC NAND controller should apply a delay after the
+instruction has been issued on the bus.
+The FSMC NAND controller driver did not handle this delay.
+
+Add this waiting delay in the FSMC NAND controller driver.
+
+Fixes: 4da712e70294 ("mtd: nand: fsmc: use ->exec_op()")
+Signed-off-by: Herve Codina <herve.codina@bootlin.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20211119150316.43080-4-herve.codina@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/fsmc_nand.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mtd/nand/raw/fsmc_nand.c
++++ b/drivers/mtd/nand/raw/fsmc_nand.c
+@@ -15,6 +15,7 @@
+
+ #include <linux/clk.h>
+ #include <linux/completion.h>
++#include <linux/delay.h>
+ #include <linux/dmaengine.h>
+ #include <linux/dma-direction.h>
+ #include <linux/dma-mapping.h>
+@@ -664,6 +665,9 @@ static int fsmc_exec_op(struct nand_chip
+ instr->ctx.waitrdy.timeout_ms);
+ break;
+ }
++
++ if (instr->delay_ns)
++ ndelay(instr->delay_ns);
+ }
+
+ return ret;
--- /dev/null
+From badd7857f5c933a3dc34942a2c11d67fdbdc24de Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 3 Dec 2021 13:11:28 +0300
+Subject: net: altera: set a couple error code in probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit badd7857f5c933a3dc34942a2c11d67fdbdc24de upstream.
+
+There are two error paths which accidentally return success instead of
+a negative error code.
+
+Fixes: bbd2190ce96d ("Altera TSE: Add main and header file for Altera Ethernet Driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/altera/altera_tse_main.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/altera/altera_tse_main.c
++++ b/drivers/net/ethernet/altera/altera_tse_main.c
+@@ -1430,16 +1430,19 @@ static int altera_tse_probe(struct platf
+ priv->rxdescmem_busaddr = dma_res->start;
+
+ } else {
++ ret = -ENODEV;
+ goto err_free_netdev;
+ }
+
+- if (!dma_set_mask(priv->device, DMA_BIT_MASK(priv->dmaops->dmamask)))
++ if (!dma_set_mask(priv->device, DMA_BIT_MASK(priv->dmaops->dmamask))) {
+ dma_set_coherent_mask(priv->device,
+ DMA_BIT_MASK(priv->dmaops->dmamask));
+- else if (!dma_set_mask(priv->device, DMA_BIT_MASK(32)))
++ } else if (!dma_set_mask(priv->device, DMA_BIT_MASK(32))) {
+ dma_set_coherent_mask(priv->device, DMA_BIT_MASK(32));
+- else
++ } else {
++ ret = -EIO;
+ goto err_free_netdev;
++ }
+
+ /* MAC address space */
+ ret = request_and_map(pdev, "control_port", &control_port,
--- /dev/null
+From 2be6d4d16a0849455a5c22490e3c5983495fed00 Mon Sep 17 00:00:00 2001
+From: Lee Jones <lee.jones@linaro.org>
+Date: Thu, 2 Dec 2021 14:34:37 +0000
+Subject: net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lee Jones <lee.jones@linaro.org>
+
+commit 2be6d4d16a0849455a5c22490e3c5983495fed00 upstream.
+
+Currently, due to the sequential use of min_t() and clamp_t() macros,
+in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is not set, the logic
+sets tx_max to 0. This is then used to allocate the data area of the
+SKB requested later in cdc_ncm_fill_tx_frame().
+
+This does not cause an issue presently because when memory is
+allocated during initialisation phase of SKB creation, more memory
+(512b) is allocated than is required for the SKB headers alone (320b),
+leaving some space (512b - 320b = 192b) for CDC data (172b).
+
+However, if more elements (for example 3 x u64 = [24b]) were added to
+one of the SKB header structs, say 'struct skb_shared_info',
+increasing its original size (320b [320b aligned]) to something larger
+(344b [384b aligned]), then suddenly the CDC data (172b) no longer
+fits in the spare SKB data area (512b - 384b = 128b).
+
+Consequently the SKB bounds checking semantics fails and panics:
+
+ skbuff: skb_over_panic: text:ffffffff830a5b5f len:184 put:172 \
+ head:ffff888119227c00 data:ffff888119227c00 tail:0xb8 end:0x80 dev:<NULL>
+
+ ------------[ cut here ]------------
+ kernel BUG at net/core/skbuff.c:110!
+ RIP: 0010:skb_panic+0x14f/0x160 net/core/skbuff.c:106
+ <snip>
+ Call Trace:
+ <IRQ>
+ skb_over_panic+0x2c/0x30 net/core/skbuff.c:115
+ skb_put+0x205/0x210 net/core/skbuff.c:1877
+ skb_put_zero include/linux/skbuff.h:2270 [inline]
+ cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1116 [inline]
+ cdc_ncm_fill_tx_frame+0x127f/0x3d50 drivers/net/usb/cdc_ncm.c:1293
+ cdc_ncm_tx_fixup+0x98/0xf0 drivers/net/usb/cdc_ncm.c:1514
+
+By overriding the max value with the default CDC_NCM_NTB_MAX_SIZE_TX
+when not offered through the system provided params, we ensure enough
+data space is allocated to handle the CDC data, meaning no crash will
+occur.
+
+Cc: Oliver Neukum <oliver@neukum.org>
+Fixes: 289507d3364f9 ("net: cdc_ncm: use sysfs for rx/tx aggregation tuning")
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Reviewed-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20211202143437.1411410-1-lee.jones@linaro.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/cdc_ncm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -181,6 +181,8 @@ static u32 cdc_ncm_check_tx_max(struct u
+ min = ctx->max_datagram_size + ctx->max_ndp_size + sizeof(struct usb_cdc_ncm_nth32);
+
+ max = min_t(u32, CDC_NCM_NTB_MAX_SIZE_TX, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize));
++ if (max == 0)
++ max = CDC_NCM_NTB_MAX_SIZE_TX; /* dwNtbOutMaxSize not set */
+
+ /* some devices set dwNtbOutMaxSize too low for the above default */
+ min = min(min, max);
--- /dev/null
+From b5bd95d17102b6719e3531d627875b9690371383 Mon Sep 17 00:00:00 2001
+From: Joakim Zhang <qiangqing.zhang@nxp.com>
+Date: Mon, 6 Dec 2021 21:54:57 +0800
+Subject: net: fec: only clear interrupt of handling queue in fec_enet_rx_queue()
+
+From: Joakim Zhang <qiangqing.zhang@nxp.com>
+
+commit b5bd95d17102b6719e3531d627875b9690371383 upstream.
+
+Background:
+We have a customer is running a Profinet stack on the 8MM which receives and
+responds PNIO packets every 4ms and PNIO-CM packets every 40ms. However, from
+time to time the received PNIO-CM package is "stock" and is only handled when
+receiving a new PNIO-CM or DCERPC-Ping packet (tcpdump shows the PNIO-CM and
+the DCERPC-Ping packet at the same time but the PNIO-CM HW timestamp is from
+the expected 40 ms and not the 2s delay of the DCERPC-Ping).
+
+After debugging, we noticed PNIO, PNIO-CM and DCERPC-Ping packets would
+be handled by different RX queues.
+
+The root cause should be driver ack all queues' interrupt when handle a
+specific queue in fec_enet_rx_queue(). The blamed patch is introduced to
+receive as much packets as possible once to avoid interrupt flooding.
+But it's unreasonable to clear other queues'interrupt when handling one
+queue, this patch tries to fix it.
+
+Fixes: ed63f1dcd578 (net: fec: clear receive interrupts before processing a packet)
+Cc: Russell King <rmk+kernel@arm.linux.org.uk>
+Reported-by: Nicolas Diaz <nicolas.diaz@nxp.com>
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Link: https://lore.kernel.org/r/20211206135457.15946-1-qiangqing.zhang@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/fec.h | 3 +++
+ drivers/net/ethernet/freescale/fec_main.c | 2 +-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/freescale/fec.h
++++ b/drivers/net/ethernet/freescale/fec.h
+@@ -377,6 +377,9 @@ struct bufdesc_ex {
+ #define FEC_ENET_WAKEUP ((uint)0x00020000) /* Wakeup request */
+ #define FEC_ENET_TXF (FEC_ENET_TXF_0 | FEC_ENET_TXF_1 | FEC_ENET_TXF_2)
+ #define FEC_ENET_RXF (FEC_ENET_RXF_0 | FEC_ENET_RXF_1 | FEC_ENET_RXF_2)
++#define FEC_ENET_RXF_GET(X) (((X) == 0) ? FEC_ENET_RXF_0 : \
++ (((X) == 1) ? FEC_ENET_RXF_1 : \
++ FEC_ENET_RXF_2))
+ #define FEC_ENET_TS_AVAIL ((uint)0x00010000)
+ #define FEC_ENET_TS_TIMER ((uint)0x00008000)
+
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -1480,7 +1480,7 @@ fec_enet_rx_queue(struct net_device *nde
+ break;
+ pkt_received++;
+
+- writel(FEC_ENET_RXF, fep->hwp + FEC_IEVENT);
++ writel(FEC_ENET_RXF_GET(queue_id), fep->hwp + FEC_IEVENT);
+
+ /* Check for errors. */
+ status ^= BD_ENET_RX_LAST;
--- /dev/null
+From e195e9b5dee6459d8c8e6a314cc71a644a0537fd Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 6 Dec 2021 08:53:29 -0800
+Subject: net, neigh: clear whole pneigh_entry at alloc time
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit e195e9b5dee6459d8c8e6a314cc71a644a0537fd upstream.
+
+Commit 2c611ad97a82 ("net, neigh: Extend neigh->flags to 32 bit
+to allow for extensions") enables a new KMSAM warning [1]
+
+I think the bug is actually older, because the following intruction
+only occurred if ndm->ndm_flags had NTF_PROXY set.
+
+ pn->flags = ndm->ndm_flags;
+
+Let's clear all pneigh_entry fields at alloc time.
+
+[1]
+BUG: KMSAN: uninit-value in pneigh_fill_info+0x986/0xb30 net/core/neighbour.c:2593
+ pneigh_fill_info+0x986/0xb30 net/core/neighbour.c:2593
+ pneigh_dump_table net/core/neighbour.c:2715 [inline]
+ neigh_dump_info+0x1e3f/0x2c60 net/core/neighbour.c:2832
+ netlink_dump+0xaca/0x16a0 net/netlink/af_netlink.c:2265
+ __netlink_dump_start+0xd1c/0xee0 net/netlink/af_netlink.c:2370
+ netlink_dump_start include/linux/netlink.h:254 [inline]
+ rtnetlink_rcv_msg+0x181b/0x18c0 net/core/rtnetlink.c:5534
+ netlink_rcv_skb+0x447/0x800 net/netlink/af_netlink.c:2491
+ rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5589
+ netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
+ netlink_unicast+0x1095/0x1360 net/netlink/af_netlink.c:1345
+ netlink_sendmsg+0x16f3/0x1870 net/netlink/af_netlink.c:1916
+ sock_sendmsg_nosec net/socket.c:704 [inline]
+ sock_sendmsg net/socket.c:724 [inline]
+ sock_write_iter+0x594/0x690 net/socket.c:1057
+ call_write_iter include/linux/fs.h:2162 [inline]
+ new_sync_write fs/read_write.c:503 [inline]
+ vfs_write+0x1318/0x2030 fs/read_write.c:590
+ ksys_write+0x28c/0x520 fs/read_write.c:643
+ __do_sys_write fs/read_write.c:655 [inline]
+ __se_sys_write fs/read_write.c:652 [inline]
+ __x64_sys_write+0xdb/0x120 fs/read_write.c:652
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Uninit was created at:
+ slab_post_alloc_hook mm/slab.h:524 [inline]
+ slab_alloc_node mm/slub.c:3251 [inline]
+ slab_alloc mm/slub.c:3259 [inline]
+ __kmalloc+0xc3c/0x12d0 mm/slub.c:4437
+ kmalloc include/linux/slab.h:595 [inline]
+ pneigh_lookup+0x60f/0xd70 net/core/neighbour.c:766
+ arp_req_set_public net/ipv4/arp.c:1016 [inline]
+ arp_req_set+0x430/0x10a0 net/ipv4/arp.c:1032
+ arp_ioctl+0x8d4/0xb60 net/ipv4/arp.c:1232
+ inet_ioctl+0x4ef/0x820 net/ipv4/af_inet.c:947
+ sock_do_ioctl net/socket.c:1118 [inline]
+ sock_ioctl+0xa3f/0x13e0 net/socket.c:1235
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:874 [inline]
+ __se_sys_ioctl+0x2df/0x4a0 fs/ioctl.c:860
+ __x64_sys_ioctl+0xd8/0x110 fs/ioctl.c:860
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+CPU: 1 PID: 20001 Comm: syz-executor.0 Not tainted 5.16.0-rc3-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+
+Fixes: 62dd93181aaa ("[IPV6] NDISC: Set per-entry is_router flag in Proxy NA.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Roopa Prabhu <roopa@nvidia.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/20211206165329.1049835-1-eric.dumazet@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/neighbour.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -733,11 +733,10 @@ struct pneigh_entry * pneigh_lookup(stru
+
+ ASSERT_RTNL();
+
+- n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
++ n = kzalloc(sizeof(*n) + key_len, GFP_KERNEL);
+ if (!n)
+ goto out;
+
+- n->protocol = 0;
+ write_pnet(&n->net, net);
+ memcpy(n->key, pkey, key_len);
+ n->dev = dev;
--- /dev/null
+From d17b9737c2bc09b4ac6caf469826e5a7ce3ffab7 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 7 Dec 2021 11:24:16 +0300
+Subject: net/qla3xxx: fix an error code in ql_adapter_up()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit d17b9737c2bc09b4ac6caf469826e5a7ce3ffab7 upstream.
+
+The ql_wait_for_drvr_lock() fails and returns false, then this
+function should return an error code instead of returning success.
+
+The other problem is that the success path prints an error message
+netdev_err(ndev, "Releasing driver lock\n"); Delete that and
+re-order the code a little to make it more clear.
+
+Fixes: 5a4faa873782 ("[PATCH] qla3xxx NIC driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20211207082416.GA16110@kili
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qla3xxx.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -3478,20 +3478,19 @@ static int ql_adapter_up(struct ql3_adap
+
+ spin_lock_irqsave(&qdev->hw_lock, hw_flags);
+
+- err = ql_wait_for_drvr_lock(qdev);
+- if (err) {
+- err = ql_adapter_initialize(qdev);
+- if (err) {
+- netdev_err(ndev, "Unable to initialize adapter\n");
+- goto err_init;
+- }
+- netdev_err(ndev, "Releasing driver lock\n");
+- ql_sem_unlock(qdev, QL_DRVR_SEM_MASK);
+- } else {
++ if (!ql_wait_for_drvr_lock(qdev)) {
+ netdev_err(ndev, "Could not acquire driver lock\n");
++ err = -ENODEV;
+ goto err_lock;
+ }
+
++ err = ql_adapter_initialize(qdev);
++ if (err) {
++ netdev_err(ndev, "Unable to initialize adapter\n");
++ goto err_init;
++ }
++ ql_sem_unlock(qdev, QL_DRVR_SEM_MASK);
++
+ spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
+
+ set_bit(QL_ADAPTER_UP, &qdev->flags);
--- /dev/null
+From 4ffbe87e2d5b53bcb0213d8650bbe70bf942de6a Mon Sep 17 00:00:00 2001
+From: Ian Rogers <irogers@google.com>
+Date: Tue, 23 Nov 2021 16:12:29 -0800
+Subject: perf tools: Fix SMT detection fast read path
+
+From: Ian Rogers <irogers@google.com>
+
+commit 4ffbe87e2d5b53bcb0213d8650bbe70bf942de6a upstream.
+
+sysfs__read_int() returns 0 on success, and so the fast read path was
+always failing.
+
+Fixes: bb629484d924118e ("perf tools: Simplify checking if SMT is active.")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: John Garry <john.garry@huawei.com>
+Cc: Kajol Jain <kjain@linux.ibm.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Konstantin Khlebnikov <koct9i@gmail.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Paul Clarke <pc@us.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lore.kernel.org/lkml/20211124001231.3277836-2-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/smt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/util/smt.c
++++ b/tools/perf/util/smt.c
+@@ -15,7 +15,7 @@ int smt_on(void)
+ if (cached)
+ return cached_result;
+
+- if (sysfs__read_int("devices/system/cpu/smt/active", &cached_result) > 0)
++ if (sysfs__read_int("devices/system/cpu/smt/active", &cached_result) >= 0)
+ goto done;
+
+ ncpu = sysconf(_SC_NPROCESSORS_CONF);
--- /dev/null
+From 444dd878e85fb33fcfb2682cfdab4c236f33ea3e Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Fri, 3 Dec 2021 17:19:47 +0100
+Subject: PM: runtime: Fix pm_runtime_active() kerneldoc comment
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 444dd878e85fb33fcfb2682cfdab4c236f33ea3e upstream.
+
+The kerneldoc comment of pm_runtime_active() does not reflect the
+behavior of the function, so update it accordingly.
+
+Fixes: 403d2d116ec0 ("PM: runtime: Add kerneldoc comments to multiple helpers")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/pm_runtime.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/pm_runtime.h
++++ b/include/linux/pm_runtime.h
+@@ -129,7 +129,7 @@ static inline bool pm_runtime_suspended(
+ * pm_runtime_active - Check whether or not a device is runtime-active.
+ * @dev: Target device.
+ *
+- * Return %true if runtime PM is enabled for @dev and its runtime PM status is
++ * Return %true if runtime PM is disabled for @dev or its runtime PM status is
+ * %RPM_ACTIVE, or %false otherwise.
+ *
+ * Note that the return value of this function can only be trusted if it is
--- /dev/null
+From 8e227b198a55859bf790dc7f4b1e30c0859c6756 Mon Sep 17 00:00:00 2001
+From: Manish Chopra <manishc@marvell.com>
+Date: Fri, 3 Dec 2021 09:44:13 -0800
+Subject: qede: validate non LSO skb length
+
+From: Manish Chopra <manishc@marvell.com>
+
+commit 8e227b198a55859bf790dc7f4b1e30c0859c6756 upstream.
+
+Although it is unlikely that stack could transmit a non LSO
+skb with length > MTU, however in some cases or environment such
+occurrences actually resulted into firmware asserts due to packet
+length being greater than the max supported by the device (~9700B).
+
+This patch adds the safeguard for such odd cases to avoid firmware
+asserts.
+
+v2: Added "Fixes" tag with one of the initial driver commit
+ which enabled the TX traffic actually (as this was probably
+ day1 issue which was discovered recently by some customer
+ environment)
+
+Fixes: a2ec6172d29c ("qede: Add support for link")
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Alok Prasad <palok@marvell.com>
+Signed-off-by: Prabhakar Kushwaha <pkushwaha@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Link: https://lore.kernel.org/r/20211203174413.13090-1-manishc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qede/qede_fp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+@@ -1643,6 +1643,13 @@ netdev_tx_t qede_start_xmit(struct sk_bu
+ data_split = true;
+ }
+ } else {
++ if (unlikely(skb->len > ETH_TX_MAX_NON_LSO_PKT_LEN)) {
++ DP_ERR(edev, "Unexpected non LSO skb length = 0x%x\n", skb->len);
++ qede_free_failed_tx_pkt(txq, first_bd, 0, false);
++ qede_update_tx_producer(txq);
++ return NETDEV_TX_OK;
++ }
++
+ val |= ((skb->len & ETH_TX_DATA_1ST_BD_PKT_LEN_MASK) <<
+ ETH_TX_DATA_1ST_BD_PKT_LEN_SHIFT);
+ }
--- /dev/null
+From b0969f83890bf8b47f5c8bd42539599b2b52fdeb Mon Sep 17 00:00:00 2001
+From: Yangyang Li <liyangyang20@huawei.com>
+Date: Tue, 23 Nov 2021 22:24:02 +0800
+Subject: RDMA/hns: Do not destroy QP resources in the hw resetting phase
+
+From: Yangyang Li <liyangyang20@huawei.com>
+
+commit b0969f83890bf8b47f5c8bd42539599b2b52fdeb upstream.
+
+When hns_roce_v2_destroy_qp() is called, the brief calling process of the
+driver is as follows:
+
+ ......
+ hns_roce_v2_destroy_qp
+ hns_roce_v2_qp_modify
+ hns_roce_cmd_mbox
+ hns_roce_qp_destroy
+
+If hns_roce_cmd_mbox() detects that the hardware is being reset during the
+execution of the hns_roce_cmd_mbox(), the driver will not be able to get
+the return value from the hardware (the firmware cannot respond to the
+driver's mailbox during the hardware reset phase).
+
+The driver needs to wait for the hardware reset to complete before
+continuing to execute hns_roce_qp_destroy(), otherwise it may happen that
+the driver releases the resources but the hardware is still accessing. In
+order to fix this problem, HNS RoCE needs to add a piece of code to wait
+for the hardware reset to complete.
+
+The original interface get_hw_reset_stat() is the instantaneous state of
+the hardware reset, which cannot accurately reflect whether the hardware
+reset is completed, so it needs to be replaced with the ae_dev_reset_cnt
+interface.
+
+The sign that the hardware reset is complete is that the return value of
+the ae_dev_reset_cnt interface is greater than the original value
+reset_cnt recorded by the driver.
+
+Fixes: 6a04aed6afae ("RDMA/hns: Fix the chip hanging caused by sending mailbox&CMQ during reset")
+Link: https://lore.kernel.org/r/20211123142402.26936-1-liangwenpeng@huawei.com
+Signed-off-by: Yangyang Li <liyangyang20@huawei.com>
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -33,6 +33,7 @@
+ #include <linux/acpi.h>
+ #include <linux/etherdevice.h>
+ #include <linux/interrupt.h>
++#include <linux/iopoll.h>
+ #include <linux/kernel.h>
+ #include <linux/types.h>
+ #include <net/addrconf.h>
+@@ -1050,9 +1051,14 @@ static u32 hns_roce_v2_cmd_hw_resetting(
+ unsigned long instance_stage,
+ unsigned long reset_stage)
+ {
++#define HW_RESET_TIMEOUT_US 1000000
++#define HW_RESET_SLEEP_US 1000
++
+ struct hns_roce_v2_priv *priv = hr_dev->priv;
+ struct hnae3_handle *handle = priv->handle;
+ const struct hnae3_ae_ops *ops = handle->ae_algo->ops;
++ unsigned long val;
++ int ret;
+
+ /* When hardware reset is detected, we should stop sending mailbox&cmq&
+ * doorbell to hardware. If now in .init_instance() function, we should
+@@ -1064,7 +1070,11 @@ static u32 hns_roce_v2_cmd_hw_resetting(
+ * again.
+ */
+ hr_dev->dis_db = true;
+- if (!ops->get_hw_reset_stat(handle))
++
++ ret = read_poll_timeout(ops->ae_dev_reset_cnt, val,
++ val > hr_dev->reset_cnt, HW_RESET_SLEEP_US,
++ HW_RESET_TIMEOUT_US, false, handle);
++ if (!ret)
+ hr_dev->is_reset = true;
+
+ if (!hr_dev->is_reset || reset_stage == HNS_ROCE_STATE_RST_INIT ||
--- /dev/null
+From 52414e27d6b568120b087d1fbafbb4482b0ccaab Mon Sep 17 00:00:00 2001
+From: Yangyang Li <liyangyang20@huawei.com>
+Date: Tue, 23 Nov 2021 16:48:09 +0800
+Subject: RDMA/hns: Do not halt commands during reset until later
+
+From: Yangyang Li <liyangyang20@huawei.com>
+
+commit 52414e27d6b568120b087d1fbafbb4482b0ccaab upstream.
+
+is_reset is used to indicate whether the hardware starts to reset. When
+hns_roce_hw_v2_reset_notify_down() is called, the hardware has not yet
+started to reset. If is_reset is set at this time, all mailbox operations
+of resource destroy actions will be intercepted by driver. When the driver
+cleans up resources, but the hardware is still accessed, the following
+errors will appear:
+
+ arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received:
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000350100000010
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x000002088000003f
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x00000000a50e0800
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000000000000000
+ arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received:
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000350100000010
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x000002088000043e
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x00000000a50a0800
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000000000000000
+ arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received:
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000350100000010
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000020880000436
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x00000000a50a0880
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000000000000000
+ arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received:
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000350100000010
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x000002088000043a
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x00000000a50e0840
+ hns3 0000:35:00.0: INT status: CMDQ(0x0) HW errors(0x0) other(0x0)
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000000000000000
+ hns3 0000:35:00.0: received unknown or unhandled event of vector0
+ arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received:
+ arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000350100000010
+ {34}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 7
+
+is_reset will be set correctly in check_aedev_reset_status(), so the
+setting in hns_roce_hw_v2_reset_notify_down() should be deleted.
+
+Fixes: 726be12f5ca0 ("RDMA/hns: Set reset flag when hw resetting")
+Link: https://lore.kernel.org/r/20211123084809.37318-1-liangwenpeng@huawei.com
+Signed-off-by: Yangyang Li <liyangyang20@huawei.com>
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -6397,10 +6397,8 @@ static int hns_roce_hw_v2_reset_notify_d
+ if (!hr_dev)
+ return 0;
+
+- hr_dev->is_reset = true;
+ hr_dev->active = false;
+ hr_dev->dis_db = true;
+-
+ hr_dev->state = HNS_ROCE_DEVICE_STATE_RST_DOWN;
+
+ return 0;
--- /dev/null
+From 39bd54d43b3f8b3c7b3a75f5d868d8bb858860e7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <kabel@kernel.org>
+Date: Thu, 25 Nov 2021 17:01:48 +0100
+Subject: Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+commit 39bd54d43b3f8b3c7b3a75f5d868d8bb858860e7 upstream.
+
+This reverts commit 239edf686c14a9ff926dec2f350289ed7adfefe2.
+
+239edf686c14 ("PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated
+bridge") added support for the Type 1 Expansion ROM BAR at config offset
+0x38, based on the register being listed in the Marvell Armada A3720 spec.
+But the spec doesn't document it at all for RC mode, and there is no ROM in
+the SOC, so remove this emulation for now.
+
+The PCI bridge which represents aardvark's PCIe Root Port has an Expansion
+ROM Base Address register at offset 0x30, but its meaning is different than
+PCI's Expansion ROM BAR register, although the layout is the same. (This
+is why we thought it does the same thing.)
+
+First: there is no ROM (or part of BootROM) in the A3720 SOC dedicated for
+PCIe Root Port (or controller in RC mode) containing executable code that
+would initialize the Root Port, suitable for execution in bootloader (this
+is how Expansion ROM BAR is used on x86).
+
+Second: in A3720 spec the register (address 0xD0070030) is not documented
+at all for Root Complex mode, but similar to other BAR registers, it has an
+"entangled partner" in register 0xD0075920, which does address translation
+for the BAR in 0xD0070030:
+
+ - the BAR register sets the address from the view of PCIe bus
+
+ - the translation register sets the address from the view of the CPU
+
+The other BAR registers also have this entangled partner, and they can be
+used to:
+
+ - in RC mode: address-checking on the receive side of the RC (they can
+ define address ranges for memory accesses from remote Endpoints to the
+ RC)
+
+ - in Endpoint mode: allow the remote CPU to access memory on A3720
+
+The Expansion ROM BAR has only the Endpoint part documented, but from the
+similarities we think that it can also be used in RC mode in that way.
+
+So either Expansion ROM BAR has different meaning (if the hypothesis above
+is true), or we don't know it's meaning (since it is not documented for RC
+mode).
+
+Remove the register from the emulated bridge accessing functions.
+
+[bhelgaas: summarize reason for removal (first paragraph)]
+Fixes: 239edf686c14 ("PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge")
+Link: https://lore.kernel.org/r/20211125160148.26029-3-kabel@kernel.org
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/pci-aardvark.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -32,7 +32,6 @@
+ #define PCIE_CORE_DEV_ID_REG 0x0
+ #define PCIE_CORE_CMD_STATUS_REG 0x4
+ #define PCIE_CORE_DEV_REV_REG 0x8
+-#define PCIE_CORE_EXP_ROM_BAR_REG 0x30
+ #define PCIE_CORE_PCIEXP_CAP 0xc0
+ #define PCIE_CORE_ERR_CAPCTL_REG 0x118
+ #define PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX BIT(5)
+@@ -774,10 +773,6 @@ advk_pci_bridge_emul_base_conf_read(stru
+ *value = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG);
+ return PCI_BRIDGE_EMUL_HANDLED;
+
+- case PCI_ROM_ADDRESS1:
+- *value = advk_readl(pcie, PCIE_CORE_EXP_ROM_BAR_REG);
+- return PCI_BRIDGE_EMUL_HANDLED;
+-
+ case PCI_INTERRUPT_LINE: {
+ /*
+ * From the whole 32bit register we support reading from HW only
+@@ -810,10 +805,6 @@ advk_pci_bridge_emul_base_conf_write(str
+ advk_writel(pcie, new, PCIE_CORE_CMD_STATUS_REG);
+ break;
+
+- case PCI_ROM_ADDRESS1:
+- advk_writel(pcie, new, PCIE_CORE_EXP_ROM_BAR_REG);
+- break;
+-
+ case PCI_INTERRUPT_LINE:
+ if (mask & (PCI_BRIDGE_CTL_BUS_RESET << 16)) {
+ u32 val = advk_readl(pcie, PCIE_CORE_CTRL1_REG);
--- /dev/null
+From 653926205741add87a6cf452e21950eebc6ac10b Mon Sep 17 00:00:00 2001
+From: Igor Pylypiv <ipylypiv@google.com>
+Date: Tue, 30 Nov 2021 20:16:27 -0800
+Subject: scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()
+
+From: Igor Pylypiv <ipylypiv@google.com>
+
+commit 653926205741add87a6cf452e21950eebc6ac10b upstream.
+
+Calling scsi_remove_host() before scsi_add_host() results in a crash:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000108
+ RIP: 0010:device_del+0x63/0x440
+ Call Trace:
+ device_unregister+0x17/0x60
+ scsi_remove_host+0xee/0x2a0
+ pm8001_pci_probe+0x6ef/0x1b90 [pm80xx]
+ local_pci_probe+0x3f/0x90
+
+We cannot call scsi_remove_host() in pm8001_alloc() because scsi_add_host()
+has not been called yet at that point in time.
+
+Function call tree:
+
+ pm8001_pci_probe()
+ |
+ `- pm8001_pci_alloc()
+ | |
+ | `- pm8001_alloc()
+ | |
+ | `- scsi_remove_host()
+ |
+ `- scsi_add_host()
+
+Link: https://lore.kernel.org/r/20211201041627.1592487-1-ipylypiv@google.com
+Fixes: 05c6c029a44d ("scsi: pm80xx: Increase number of supported queues")
+Reviewed-by: Vishakha Channapattan <vishakhavc@google.com>
+Acked-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Igor Pylypiv <ipylypiv@google.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/pm8001/pm8001_init.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/pm8001/pm8001_init.c
++++ b/drivers/scsi/pm8001/pm8001_init.c
+@@ -281,12 +281,12 @@ static int pm8001_alloc(struct pm8001_hb
+ if (rc) {
+ pm8001_dbg(pm8001_ha, FAIL,
+ "pm8001_setup_irq failed [ret: %d]\n", rc);
+- goto err_out_shost;
++ goto err_out;
+ }
+ /* Request Interrupt */
+ rc = pm8001_request_irq(pm8001_ha);
+ if (rc)
+- goto err_out_shost;
++ goto err_out;
+
+ count = pm8001_ha->max_q_num;
+ /* Queues are chosen based on the number of cores/msix availability */
+@@ -422,8 +422,6 @@ static int pm8001_alloc(struct pm8001_hb
+ pm8001_tag_init(pm8001_ha);
+ return 0;
+
+-err_out_shost:
+- scsi_remove_host(pm8001_ha->shost);
+ err_out_nodev:
+ for (i = 0; i < pm8001_ha->max_memcnt; i++) {
+ if (pm8001_ha->memoryMap.region[i].virt_ptr != NULL) {
--- /dev/null
+From 7db0e0c8190a086ef92ce5bb960836cde49540aa Mon Sep 17 00:00:00 2001
+From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Date: Tue, 7 Dec 2021 10:06:38 +0900
+Subject: scsi: scsi_debug: Fix buffer size of REPORT ZONES command
+
+From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+
+commit 7db0e0c8190a086ef92ce5bb960836cde49540aa upstream.
+
+According to ZBC and SPC specifications, the unit of ALLOCATION LENGTH
+field of REPORT ZONES command is byte. However, current scsi_debug
+implementation handles it as number of zones to calculate buffer size to
+report zones. When the ALLOCATION LENGTH has a large number, this results
+in too large buffer size and causes memory allocation failure. Fix the
+failure by handling ALLOCATION LENGTH as byte unit.
+
+Link: https://lore.kernel.org/r/20211207010638.124280-1-shinichiro.kawasaki@wdc.com
+Fixes: f0d1cf9378bd ("scsi: scsi_debug: Add ZBC zone commands")
+Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/scsi_debug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -4334,7 +4334,7 @@ static int resp_report_zones(struct scsi
+ rep_max_zones = min((alloc_len - 64) >> ilog2(RZONES_DESC_HD),
+ max_zones);
+
+- arr = kcalloc(RZONES_DESC_HD, alloc_len, GFP_ATOMIC);
++ arr = kzalloc(alloc_len, GFP_ATOMIC);
+ if (!arr) {
+ mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC,
+ INSUFF_RES_ASCQ);
--- /dev/null
+From f6071e5e3961eeb5300bd0901c9e128598730ae3 Mon Sep 17 00:00:00 2001
+From: Peilin Ye <peilin.ye@bytedance.com>
+Date: Tue, 30 Nov 2021 16:47:20 -0800
+Subject: selftests/fib_tests: Rework fib_rp_filter_test()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peilin Ye <peilin.ye@bytedance.com>
+
+commit f6071e5e3961eeb5300bd0901c9e128598730ae3 upstream.
+
+Currently rp_filter tests in fib_tests.sh:fib_rp_filter_test() are
+failing. ping sockets are bound to dummy1 using the "-I" option
+(SO_BINDTODEVICE), but socket lookup is failing when receiving ping
+replies, since the routing table thinks they belong to dummy0.
+
+For example, suppose ping is using a SOCK_RAW socket for ICMP messages.
+When receiving ping replies, in __raw_v4_lookup(), sk->sk_bound_dev_if
+is 3 (dummy1), but dif (skb_rtable(skb)->rt_iif) says 2 (dummy0), so the
+raw_sk_bound_dev_eq() check fails. Similar things happen in
+ping_lookup() for SOCK_DGRAM sockets.
+
+These tests used to pass due to a bug [1] in iputils, where "ping -I"
+actually did not bind ICMP message sockets to device. The bug has been
+fixed by iputils commit f455fee41c07 ("ping: also bind the ICMP socket
+to the specific device") in 2016, which is why our rp_filter tests
+started to fail. See [2] .
+
+Fixing the tests while keeping everything in one netns turns out to be
+nontrivial. Rework the tests and build the following topology:
+
+ ┌─────────────────────────────┐ ┌─────────────────────────────┐
+ │ network namespace 1 (ns1) │ │ network namespace 2 (ns2) │
+ │ │ │ │
+ │ ┌────┐ ┌─────┐ │ │ ┌─────┐ ┌────┐ │
+ │ │ lo │<───>│veth1│<────────┼────┼─>│veth2│<──────────>│ lo │ │
+ │ └────┘ ├─────┴──────┐ │ │ ├─────┴──────┐ └────┘ │
+ │ │192.0.2.1/24│ │ │ │192.0.2.1/24│ │
+ │ └────────────┘ │ │ └────────────┘ │
+ └─────────────────────────────┘ └─────────────────────────────┘
+
+Consider sending an ICMP_ECHO packet A in ns2. Both source and
+destination IP addresses are 192.0.2.1, and we use strict mode rp_filter
+in both ns1 and ns2:
+
+ 1. A is routed to lo since its destination IP address is one of ns2's
+ local addresses (veth2);
+ 2. A is redirected from lo's egress to veth2's egress using mirred;
+ 3. A arrives at veth1's ingress in ns1;
+ 4. A is redirected from veth1's ingress to lo's ingress, again, using
+ mirred;
+ 5. In __fib_validate_source(), fib_info_nh_uses_dev() returns false,
+ since A was received on lo, but reverse path lookup says veth1;
+ 6. However A is not dropped since we have relaxed this check for lo in
+ commit 66f8209547cc ("fib: relax source validation check for loopback
+ packets");
+
+Making sure A is not dropped here in this corner case is the whole point
+of having this test.
+
+ 7. As A reaches the ICMP layer, an ICMP_ECHOREPLY packet, B, is
+ generated;
+ 8. Similarly, B is redirected from lo's egress to veth1's egress (in
+ ns1), then redirected once again from veth2's ingress to lo's
+ ingress (in ns2), using mirred.
+
+Also test "ping 127.0.0.1" from ns2. It does not trigger the relaxed
+check in __fib_validate_source(), but just to make sure the topology
+works with loopback addresses.
+
+Tested with ping from iputils 20210722-41-gf9fb573:
+
+$ ./fib_tests.sh -t rp_filter
+
+IPv4 rp_filter tests
+ TEST: rp_filter passes local packets [ OK ]
+ TEST: rp_filter passes loopback packets [ OK ]
+
+[1] https://github.com/iputils/iputils/issues/55
+[2] https://github.com/iputils/iputils/commit/f455fee41c077d4b700a473b2f5b3487b8febc1d
+
+Reported-by: Hangbin Liu <liuhangbin@gmail.com>
+Fixes: adb701d6cfa4 ("selftests: add a test case for rp_filter")
+Reviewed-by: Cong Wang <cong.wang@bytedance.com>
+Signed-off-by: Peilin Ye <peilin.ye@bytedance.com>
+Acked-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/20211201004720.6357-1-yepeilin.cs@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/fib_tests.sh | 59 +++++++++++++++++++++++++------
+ 1 file changed, 49 insertions(+), 10 deletions(-)
+
+--- a/tools/testing/selftests/net/fib_tests.sh
++++ b/tools/testing/selftests/net/fib_tests.sh
+@@ -444,24 +444,63 @@ fib_rp_filter_test()
+ setup
+
+ set -e
++ ip netns add ns2
++ ip netns set ns2 auto
++
++ ip -netns ns2 link set dev lo up
++
++ $IP link add name veth1 type veth peer name veth2
++ $IP link set dev veth2 netns ns2
++ $IP address add 192.0.2.1/24 dev veth1
++ ip -netns ns2 address add 192.0.2.1/24 dev veth2
++ $IP link set dev veth1 up
++ ip -netns ns2 link set dev veth2 up
++
+ $IP link set dev lo address 52:54:00:6a:c7:5e
+- $IP link set dummy0 address 52:54:00:6a:c7:5e
+- $IP link add dummy1 type dummy
+- $IP link set dummy1 address 52:54:00:6a:c7:5e
+- $IP link set dev dummy1 up
++ $IP link set dev veth1 address 52:54:00:6a:c7:5e
++ ip -netns ns2 link set dev lo address 52:54:00:6a:c7:5e
++ ip -netns ns2 link set dev veth2 address 52:54:00:6a:c7:5e
++
++ # 1. (ns2) redirect lo's egress to veth2's egress
++ ip netns exec ns2 tc qdisc add dev lo parent root handle 1: fq_codel
++ ip netns exec ns2 tc filter add dev lo parent 1: protocol arp basic \
++ action mirred egress redirect dev veth2
++ ip netns exec ns2 tc filter add dev lo parent 1: protocol ip basic \
++ action mirred egress redirect dev veth2
++
++ # 2. (ns1) redirect veth1's ingress to lo's ingress
++ $NS_EXEC tc qdisc add dev veth1 ingress
++ $NS_EXEC tc filter add dev veth1 ingress protocol arp basic \
++ action mirred ingress redirect dev lo
++ $NS_EXEC tc filter add dev veth1 ingress protocol ip basic \
++ action mirred ingress redirect dev lo
++
++ # 3. (ns1) redirect lo's egress to veth1's egress
++ $NS_EXEC tc qdisc add dev lo parent root handle 1: fq_codel
++ $NS_EXEC tc filter add dev lo parent 1: protocol arp basic \
++ action mirred egress redirect dev veth1
++ $NS_EXEC tc filter add dev lo parent 1: protocol ip basic \
++ action mirred egress redirect dev veth1
++
++ # 4. (ns2) redirect veth2's ingress to lo's ingress
++ ip netns exec ns2 tc qdisc add dev veth2 ingress
++ ip netns exec ns2 tc filter add dev veth2 ingress protocol arp basic \
++ action mirred ingress redirect dev lo
++ ip netns exec ns2 tc filter add dev veth2 ingress protocol ip basic \
++ action mirred ingress redirect dev lo
++
+ $NS_EXEC sysctl -qw net.ipv4.conf.all.rp_filter=1
+ $NS_EXEC sysctl -qw net.ipv4.conf.all.accept_local=1
+ $NS_EXEC sysctl -qw net.ipv4.conf.all.route_localnet=1
+-
+- $NS_EXEC tc qd add dev dummy1 parent root handle 1: fq_codel
+- $NS_EXEC tc filter add dev dummy1 parent 1: protocol arp basic action mirred egress redirect dev lo
+- $NS_EXEC tc filter add dev dummy1 parent 1: protocol ip basic action mirred egress redirect dev lo
++ ip netns exec ns2 sysctl -qw net.ipv4.conf.all.rp_filter=1
++ ip netns exec ns2 sysctl -qw net.ipv4.conf.all.accept_local=1
++ ip netns exec ns2 sysctl -qw net.ipv4.conf.all.route_localnet=1
+ set +e
+
+- run_cmd "ip netns exec ns1 ping -I dummy1 -w1 -c1 198.51.100.1"
++ run_cmd "ip netns exec ns2 ping -w1 -c1 192.0.2.1"
+ log_test $? 0 "rp_filter passes local packets"
+
+- run_cmd "ip netns exec ns1 ping -I dummy1 -w1 -c1 127.0.0.1"
++ run_cmd "ip netns exec ns2 ping -w1 -c1 127.0.0.1"
+ log_test $? 0 "rp_filter passes loopback packets"
+
+ cleanup
signalfd-use-wake_up_pollfree.patch
aio-keep-poll-requests-on-waitqueue-until-completed.patch
aio-fix-use-after-free-due-to-missing-pollfree-handling.patch
+tracefs-set-all-files-to-the-same-group-ownership-as-the-mount-option.patch
+i2c-mpc-use-atomic-read-and-fix-break-condition.patch
+block-fix-ioprio_get-ioprio_who_pgrp-vs-setuid-2.patch
+scsi-pm80xx-do-not-call-scsi_remove_host-in-pm8001_alloc.patch
+scsi-scsi_debug-fix-buffer-size-of-report-zones-command.patch
+alsa-usb-audio-reorder-snd_djm_devices-entries.patch
+qede-validate-non-lso-skb-length.patch
+pm-runtime-fix-pm_runtime_active-kerneldoc-comment.patch
+asoc-rt5682-fix-crash-due-to-out-of-scope-stack-vars.patch
+asoc-qdsp6-q6routing-fix-return-value-from-msm_routing_put_audio_mixer.patch
+asoc-codecs-wsa881x-fix-return-values-from-kcontrol-put.patch
+asoc-codecs-wcd934x-handle-channel-mappping-list-correctly.patch
+asoc-codecs-wcd934x-return-correct-value-from-mixer-put.patch
+rdma-hns-do-not-halt-commands-during-reset-until-later.patch
+rdma-hns-do-not-destroy-qp-resources-in-the-hw-resetting-phase.patch
+hwmon-dell-smm-fix-warning-on-proc-i8k-creation-error.patch
+clk-imx-use-module_platform_driver.patch
+clk-qcom-clk-alpha-pll-don-t-reconfigure-running-trion.patch
+i40e-fix-failed-opcode-appearing-if-handling-messages-from-vf.patch
+i40e-fix-pre-set-max-number-of-queues-for-vf.patch
+mtd-rawnand-fsmc-take-instruction-delay-into-account.patch
+mtd-rawnand-fsmc-fix-timing-computation.patch
+bpf-sockmap-re-evaluate-proto-ops-when-psock-is-removed-from-sockmap.patch
+i40e-fix-null-pointer-dereference-in-i40e_dbg_dump_desc.patch
+revert-pci-aardvark-fix-support-for-pci_rom_address1-on-emulated-bridge.patch
+drm-amd-display-fix-dpia-outbox-timeout-after-s3-s4-reset.patch
+perf-tools-fix-smt-detection-fast-read-path.patch
+documentation-locking-locktypes-update-migrate_disable-bits.patch
+dt-bindings-net-reintroduce-phy-no-lane-swap-binding.patch
+tools-build-remove-needless-libpython-version-feature-check-that-breaks-test-all-fast-path.patch
+net-cdc_ncm-allow-for-dwntboutmaxsize-to-be-unset-or-zero.patch
+net-altera-set-a-couple-error-code-in-probe.patch
+net-fec-only-clear-interrupt-of-handling-queue-in-fec_enet_rx_queue.patch
+net-neigh-clear-whole-pneigh_entry-at-alloc-time.patch
+net-qla3xxx-fix-an-error-code-in-ql_adapter_up.patch
+selftests-fib_tests-rework-fib_rp_filter_test.patch
--- /dev/null
+From 3d1d57debee2d342a47615707588b96658fabb85 Mon Sep 17 00:00:00 2001
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+Date: Tue, 30 Nov 2021 10:12:41 -0300
+Subject: tools build: Remove needless libpython-version feature check that breaks test-all fast path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+commit 3d1d57debee2d342a47615707588b96658fabb85 upstream.
+
+Since 66dfdff03d196e51 ("perf tools: Add Python 3 support") we don't use
+the tools/build/feature/test-libpython-version.c version in any Makefile
+feature check:
+
+ $ find tools/ -type f | xargs grep feature-libpython-version
+ $
+
+The only place where this was used was removed in 66dfdff03d196e51:
+
+ - ifneq ($(feature-libpython-version), 1)
+ - $(warning Python 3 is not yet supported; please set)
+ - $(warning PYTHON and/or PYTHON_CONFIG appropriately.)
+ - $(warning If you also have Python 2 installed, then)
+ - $(warning try something like:)
+ - $(warning $(and ,))
+ - $(warning $(and ,) make PYTHON=python2)
+ - $(warning $(and ,))
+ - $(warning Otherwise, disable Python support entirely:)
+ - $(warning $(and ,))
+ - $(warning $(and ,) make NO_LIBPYTHON=1)
+ - $(warning $(and ,))
+ - $(error $(and ,))
+ - else
+ - LDFLAGS += $(PYTHON_EMBED_LDFLAGS)
+ - EXTLIBS += $(PYTHON_EMBED_LIBADD)
+ - LANG_BINDINGS += $(obj-perf)python/perf.so
+ - $(call detected,CONFIG_LIBPYTHON)
+ - endif
+
+And nowadays we either build with PYTHON=python3 or just install the
+python3 devel packages and perf will build against it.
+
+But the leftover feature-libpython-version check made the fast path
+feature detection to break in all cases except when python2 devel files
+were installed:
+
+ $ rpm -qa | grep python.*devel
+ python3-devel-3.9.7-1.fc34.x86_64
+ $ rm -rf /tmp/build/perf ; mkdir -p /tmp/build/perf ;
+ $ make -C tools/perf O=/tmp/build/perf install-bin
+ make: Entering directory '/var/home/acme/git/perf/tools/perf'
+ BUILD: Doing 'make -j32' parallel build
+ HOSTCC /tmp/build/perf/fixdep.o
+ <SNIP>
+ $ cat /tmp/build/perf/feature/test-all.make.output
+ In file included from test-all.c:18:
+ test-libpython-version.c:5:10: error: #error
+ 5 | #error
+ | ^~~~~
+ $ ldd ~/bin/perf | grep python
+ libpython3.9.so.1.0 => /lib64/libpython3.9.so.1.0 (0x00007fda6dbcf000)
+ $
+
+As python3 is the norm these days, fix this by just removing the unused
+feature-libpython-version feature check, making the test-all fast path
+to work with the common case.
+
+With this:
+
+ $ rm -rf /tmp/build/perf ; mkdir -p /tmp/build/perf ;
+ $ make -C tools/perf O=/tmp/build/perf install-bin |& head
+ make: Entering directory '/var/home/acme/git/perf/tools/perf'
+ BUILD: Doing 'make -j32' parallel build
+ HOSTCC /tmp/build/perf/fixdep.o
+ HOSTLD /tmp/build/perf/fixdep-in.o
+ LINK /tmp/build/perf/fixdep
+
+ Auto-detecting system features:
+ ... dwarf: [ on ]
+ ... dwarf_getlocations: [ on ]
+ ... glibc: [ on ]
+ $ ldd ~/bin/perf | grep python
+ libpython3.9.so.1.0 => /lib64/libpython3.9.so.1.0 (0x00007f58800b0000)
+ $ cat /tmp/build/perf/feature/test-all.make.output
+ $
+
+Reviewed-by: James Clark <james.clark@arm.com>
+Fixes: 66dfdff03d196e51 ("perf tools: Add Python 3 support")
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jaroslav Škarvada <jskarvad@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/lkml/YaYmeeC6CS2b8OSz@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/build/Makefile.feature | 1 -
+ tools/build/feature/Makefile | 4 ----
+ tools/build/feature/test-all.c | 5 -----
+ tools/build/feature/test-libpython-version.c | 11 -----------
+ tools/perf/Makefile.config | 2 --
+ 5 files changed, 23 deletions(-)
+ delete mode 100644 tools/build/feature/test-libpython-version.c
+
+--- a/tools/build/Makefile.feature
++++ b/tools/build/Makefile.feature
+@@ -48,7 +48,6 @@ FEATURE_TESTS_BASIC :=
+ numa_num_possible_cpus \
+ libperl \
+ libpython \
+- libpython-version \
+ libslang \
+ libslang-include-subdir \
+ libtraceevent \
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -32,7 +32,6 @@ FILES=
+ test-numa_num_possible_cpus.bin \
+ test-libperl.bin \
+ test-libpython.bin \
+- test-libpython-version.bin \
+ test-libslang.bin \
+ test-libslang-include-subdir.bin \
+ test-libtraceevent.bin \
+@@ -223,9 +222,6 @@ $(OUTPUT)test-libperl.bin:
+ $(OUTPUT)test-libpython.bin:
+ $(BUILD) $(FLAGS_PYTHON_EMBED)
+
+-$(OUTPUT)test-libpython-version.bin:
+- $(BUILD)
+-
+ $(OUTPUT)test-libbfd.bin:
+ $(BUILD) -DPACKAGE='"perf"' -lbfd -ldl
+
+--- a/tools/build/feature/test-all.c
++++ b/tools/build/feature/test-all.c
+@@ -14,10 +14,6 @@
+ # include "test-libpython.c"
+ #undef main
+
+-#define main main_test_libpython_version
+-# include "test-libpython-version.c"
+-#undef main
+-
+ #define main main_test_libperl
+ # include "test-libperl.c"
+ #undef main
+@@ -177,7 +173,6 @@
+ int main(int argc, char *argv[])
+ {
+ main_test_libpython();
+- main_test_libpython_version();
+ main_test_libperl();
+ main_test_hello();
+ main_test_libelf();
+--- a/tools/build/feature/test-libpython-version.c
++++ /dev/null
+@@ -1,11 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-#include <Python.h>
+-
+-#if PY_VERSION_HEX >= 0x03000000
+- #error
+-#endif
+-
+-int main(void)
+-{
+- return 0;
+-}
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -271,8 +271,6 @@ endif
+
+ FEATURE_CHECK_CFLAGS-libpython := $(PYTHON_EMBED_CCOPTS)
+ FEATURE_CHECK_LDFLAGS-libpython := $(PYTHON_EMBED_LDOPTS)
+-FEATURE_CHECK_CFLAGS-libpython-version := $(PYTHON_EMBED_CCOPTS)
+-FEATURE_CHECK_LDFLAGS-libpython-version := $(PYTHON_EMBED_LDOPTS)
+
+ FEATURE_CHECK_LDFLAGS-libaio = -lrt
+
--- /dev/null
+From 48b27b6b5191e2e1f2798cd80877b6e4ef47c351 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Tue, 7 Dec 2021 17:17:29 -0500
+Subject: tracefs: Set all files to the same group ownership as the mount option
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+commit 48b27b6b5191e2e1f2798cd80877b6e4ef47c351 upstream.
+
+As people have been asking to allow non-root processes to have access to
+the tracefs directory, it was considered best to only allow groups to have
+access to the directory, where it is easier to just set the tracefs file
+system to a specific group (as other would be too dangerous), and that way
+the admins could pick which processes would have access to tracefs.
+
+Unfortunately, this broke tooling on Android that expected the other bit
+to be set. For some special cases, for non-root tools to trace the system,
+tracefs would be mounted and change the permissions of the top level
+directory which gave access to all running tasks permission to the
+tracing directory. Even though this would be dangerous to do in a
+production environment, for testing environments this can be useful.
+
+Now with the new changes to not allow other (which is still the proper
+thing to do), it breaks the testing tooling. Now more code needs to be
+loaded on the system to change ownership of the tracing directory.
+
+The real solution is to have tracefs honor the gid=xxx option when
+mounting. That is,
+
+(tracing group tracing has value 1003)
+
+ mount -t tracefs -o gid=1003 tracefs /sys/kernel/tracing
+
+should have it that all files in the tracing directory should be of the
+given group.
+
+Copy the logic from d_walk() from dcache.c and simplify it for the mount
+case of tracefs if gid is set. All the files in tracefs will be walked and
+their group will be set to the value passed in.
+
+Link: https://lkml.kernel.org/r/20211207171729.2a54e1b3@gandalf.local.home
+
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: linux-fsdevel@vger.kernel.org
+Cc: Al Viro <viro@ZenIV.linux.org.uk>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reported-by: Kalesh Singh <kaleshsingh@google.com>
+Reported-by: Yabin Cui <yabinc@google.com>
+Fixes: 49d67e445742 ("tracefs: Have tracefs directories not set OTH permission bits by default")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/tracefs/inode.c | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 72 insertions(+)
+
+--- a/fs/tracefs/inode.c
++++ b/fs/tracefs/inode.c
+@@ -161,6 +161,77 @@ struct tracefs_fs_info {
+ struct tracefs_mount_opts mount_opts;
+ };
+
++static void change_gid(struct dentry *dentry, kgid_t gid)
++{
++ if (!dentry->d_inode)
++ return;
++ dentry->d_inode->i_gid = gid;
++}
++
++/*
++ * Taken from d_walk, but without he need for handling renames.
++ * Nothing can be renamed while walking the list, as tracefs
++ * does not support renames. This is only called when mounting
++ * or remounting the file system, to set all the files to
++ * the given gid.
++ */
++static void set_gid(struct dentry *parent, kgid_t gid)
++{
++ struct dentry *this_parent;
++ struct list_head *next;
++
++ this_parent = parent;
++ spin_lock(&this_parent->d_lock);
++
++ change_gid(this_parent, gid);
++repeat:
++ next = this_parent->d_subdirs.next;
++resume:
++ while (next != &this_parent->d_subdirs) {
++ struct list_head *tmp = next;
++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child);
++ next = tmp->next;
++
++ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
++
++ change_gid(dentry, gid);
++
++ if (!list_empty(&dentry->d_subdirs)) {
++ spin_unlock(&this_parent->d_lock);
++ spin_release(&dentry->d_lock.dep_map, _RET_IP_);
++ this_parent = dentry;
++ spin_acquire(&this_parent->d_lock.dep_map, 0, 1, _RET_IP_);
++ goto repeat;
++ }
++ spin_unlock(&dentry->d_lock);
++ }
++ /*
++ * All done at this level ... ascend and resume the search.
++ */
++ rcu_read_lock();
++ascend:
++ if (this_parent != parent) {
++ struct dentry *child = this_parent;
++ this_parent = child->d_parent;
++
++ spin_unlock(&child->d_lock);
++ spin_lock(&this_parent->d_lock);
++
++ /* go into the first sibling still alive */
++ do {
++ next = child->d_child.next;
++ if (next == &this_parent->d_subdirs)
++ goto ascend;
++ child = list_entry(next, struct dentry, d_child);
++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
++ rcu_read_unlock();
++ goto resume;
++ }
++ rcu_read_unlock();
++ spin_unlock(&this_parent->d_lock);
++ return;
++}
++
+ static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts)
+ {
+ substring_t args[MAX_OPT_ARGS];
+@@ -193,6 +264,7 @@ static int tracefs_parse_options(char *d
+ if (!gid_valid(gid))
+ return -EINVAL;
+ opts->gid = gid;
++ set_gid(tracefs_mount->mnt_root, gid);
+ break;
+ case Opt_mode:
+ if (match_octal(&args[0], &option))
projects / thirdparty / kernel / stable-queue.git / commitdiff
