--- /dev/null
+From cd8e94958e22589bf6b6e5caa46fdcdecb1b3585 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 09:53:54 +0200
+Subject: block: delay freeing the gendisk
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 340e84573878b2b9d63210482af46883366361b9 ]
+
+blkdev_get_no_open acquires a reference to the block_device through
+the block device inode and then tries to acquire a device model
+reference to the gendisk. But at this point the disk migh already
+be freed (although the race is free). Fix this by only freeing the
+gendisk from the whole device bdevs ->free_inode callback as well.
+
+Fixes: 22ae8ce8b892 ("block: simplify bdev/disk lookup in blkdev_get")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20210722075402.983367-2-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/genhd.c | 3 +--
+ fs/block_dev.c | 2 ++
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/block/genhd.c b/block/genhd.c
+index ad7436bd60c1..e8968fd30b2b 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -1124,10 +1124,9 @@ static void disk_release(struct device *dev)
+ disk_release_events(disk);
+ kfree(disk->random);
+ xa_destroy(&disk->part_tbl);
+- bdput(disk->part0);
+ if (disk->queue)
+ blk_put_queue(disk->queue);
+- kfree(disk);
++ bdput(disk->part0); /* frees the disk */
+ }
+ struct class block_class = {
+ .name = "block",
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 6cc4d4cfe0c2..e4a80bd4ddf1 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -812,6 +812,8 @@ static void bdev_free_inode(struct inode *inode)
+ free_percpu(bdev->bd_stats);
+ kfree(bdev->bd_meta_info);
+
++ if (!bdev_is_partition(bdev))
++ kfree(bdev->bd_disk);
+ kmem_cache_free(bdev_cachep, BDEV_I(inode));
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 19df349ad0da3687ed66f8094fa4e30e987ecf86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 09:51:34 +0100
+Subject: bpf: Fix OOB read when printing XDP link fdinfo
+
+From: Lorenz Bauer <lmb@cloudflare.com>
+
+[ Upstream commit d6371c76e20d7d3f61b05fd67b596af4d14a8886 ]
+
+We got the following UBSAN report on one of our testing machines:
+
+ ================================================================================
+ UBSAN: array-index-out-of-bounds in kernel/bpf/syscall.c:2389:24
+ index 6 is out of range for type 'char *[6]'
+ CPU: 43 PID: 930921 Comm: systemd-coredum Tainted: G O 5.10.48-cloudflare-kasan-2021.7.0 #1
+ Hardware name: <snip>
+ Call Trace:
+ dump_stack+0x7d/0xa3
+ ubsan_epilogue+0x5/0x40
+ __ubsan_handle_out_of_bounds.cold+0x43/0x48
+ ? seq_printf+0x17d/0x250
+ bpf_link_show_fdinfo+0x329/0x380
+ ? bpf_map_value_size+0xe0/0xe0
+ ? put_files_struct+0x20/0x2d0
+ ? __kasan_kmalloc.constprop.0+0xc2/0xd0
+ seq_show+0x3f7/0x540
+ seq_read_iter+0x3f8/0x1040
+ seq_read+0x329/0x500
+ ? seq_read_iter+0x1040/0x1040
+ ? __fsnotify_parent+0x80/0x820
+ ? __fsnotify_update_child_dentry_flags+0x380/0x380
+ vfs_read+0x123/0x460
+ ksys_read+0xed/0x1c0
+ ? __x64_sys_pwrite64+0x1f0/0x1f0
+ do_syscall_64+0x33/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ <snip>
+ ================================================================================
+ ================================================================================
+ UBSAN: object-size-mismatch in kernel/bpf/syscall.c:2384:2
+
+From the report, we can infer that some array access in bpf_link_show_fdinfo at index 6
+is out of bounds. The obvious candidate is bpf_link_type_strs[BPF_LINK_TYPE_XDP] with
+BPF_LINK_TYPE_XDP == 6. It turns out that BPF_LINK_TYPE_XDP is missing from bpf_types.h
+and therefore doesn't have an entry in bpf_link_type_strs:
+
+ pos: 0
+ flags: 02000000
+ mnt_id: 13
+ link_type: (null)
+ link_id: 4
+ prog_tag: bcf7977d3b93787c
+ prog_id: 4
+ ifindex: 1
+
+Fixes: aa8d3a716b59 ("bpf, xdp: Add bpf_link-based XDP attachment API")
+Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210719085134.43325-2-lmb@cloudflare.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf_types.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h
+index f883f01a5061..def596a85752 100644
+--- a/include/linux/bpf_types.h
++++ b/include/linux/bpf_types.h
+@@ -132,4 +132,5 @@ BPF_LINK_TYPE(BPF_LINK_TYPE_CGROUP, cgroup)
+ BPF_LINK_TYPE(BPF_LINK_TYPE_ITER, iter)
+ #ifdef CONFIG_NET
+ BPF_LINK_TYPE(BPF_LINK_TYPE_NETNS, netns)
++BPF_LINK_TYPE(BPF_LINK_TYPE_XDP, xdp)
+ #endif
+--
+2.30.2
+
--- /dev/null
+From b194c2cdc8d1cc96eb6e4f922eabd1f179bdc78f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 09:04:58 -0700
+Subject: bpf, sockmap: Zap ingress queues after stopping strparser
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 343597d558e79fe704ba8846b5b2ed24056b89c2 ]
+
+We don't want strparser to run and pass skbs into skmsg handlers when
+the psock is null. We just sk_drop them in this case. When removing
+a live socket from map it means extra drops that we do not need to
+incur. Move the zap below strparser close to avoid this condition.
+
+This way we stop the stream parser first stopping it from processing
+packets and then delete the psock.
+
+Fixes: a136678c0bdbb ("bpf: sk_msg, zap ingress queue on psock down")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Link: https://lore.kernel.org/bpf/20210727160500.1713554-2-john.fastabend@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index b2410a1bfa23..45b3a3adc886 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -790,8 +790,6 @@ static void sk_psock_destroy(struct work_struct *work)
+
+ void sk_psock_drop(struct sock *sk, struct sk_psock *psock)
+ {
+- sk_psock_stop(psock, false);
+-
+ write_lock_bh(&sk->sk_callback_lock);
+ sk_psock_restore_proto(sk, psock);
+ rcu_assign_sk_user_data(sk, NULL);
+@@ -801,6 +799,8 @@ void sk_psock_drop(struct sock *sk, struct sk_psock *psock)
+ sk_psock_stop_verdict(sk, psock);
+ write_unlock_bh(&sk->sk_callback_lock);
+
++ sk_psock_stop(psock, false);
++
+ INIT_RCU_WORK(&psock->rwork, sk_psock_destroy);
+ queue_rcu_work(system_wq, &psock->rwork);
+ }
+--
+2.30.2
+
--- /dev/null
+From 3e40236ea55e5702d3d9c2cd4ad51e7a2a3f0384 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 17:12:46 +0300
+Subject: can: hi311x: fix a signedness bug in hi3110_cmd()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f6b3c7848e66e9046c8a79a5b88fd03461cc252b ]
+
+The hi3110_cmd() is supposed to return zero on success and negative
+error codes on failure, but it was accidentally declared as a u8 when
+it needs to be an int type.
+
+Fixes: 57e83fb9b746 ("can: hi311x: Add Holt HI-311x CAN driver")
+Link: https://lore.kernel.org/r/20210729141246.GA1267@kili
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/spi/hi311x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
+index 6f5d6d04a8b9..c84a198776c7 100644
+--- a/drivers/net/can/spi/hi311x.c
++++ b/drivers/net/can/spi/hi311x.c
+@@ -218,7 +218,7 @@ static int hi3110_spi_trans(struct spi_device *spi, int len)
+ return ret;
+ }
+
+-static u8 hi3110_cmd(struct spi_device *spi, u8 command)
++static int hi3110_cmd(struct spi_device *spi, u8 command)
+ {
+ struct hi3110_priv *priv = spi_get_drvdata(spi);
+
+--
+2.30.2
+
--- /dev/null
+From 401c2b55364c62d8d3a5affd5a2b69aeebf6e5e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Apr 2021 16:20:39 +0200
+Subject: can: mcp251xfd: mcp251xfd_irq(): stop timestamping worker in case
+ error in IRQ
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit ef68a717960658e6a1e5f08adb0574326e9a12c2 ]
+
+In case an error occurred in the IRQ handler, the chip status is
+dumped via devcoredump and all IRQs are disabled, but the chip stays
+powered for further analysis.
+
+The chip is in an undefined state and will not receive any CAN frames,
+so shut down the timestamping worker, which reads the TBC register
+regularly, too. This avoids any CRC read error messages if there is a
+communication problem with the chip.
+
+Fixes: efd8d98dfb90 ("can: mcp251xfd: add HW timestamp infrastructure")
+Link: https://lore.kernel.org/r/20210724155131.471303-1-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+index e0ae00e34c7b..d371af7ab496 100644
+--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+@@ -2300,6 +2300,7 @@ static irqreturn_t mcp251xfd_irq(int irq, void *dev_id)
+ err, priv->regs_status.intf);
+ mcp251xfd_dump(priv);
+ mcp251xfd_chip_interrupts_disable(priv);
++ mcp251xfd_timestamp_stop(priv);
+
+ return handled;
+ }
+--
+2.30.2
+
--- /dev/null
+From 3659ec9d82c02483f95bd1e546369f2e52d8adbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 05:52:25 -0400
+Subject: drm/i915/bios: Fix ports mask
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rodrigo Vivi <rodrigo.vivi@intel.com>
+
+[ Upstream commit d7f237df53457cf0cbdb9943b9b7c93a05e2fdb6 ]
+
+PORT_A to PORT_F are regular integers defined in the enum port,
+while for_each_port_masked requires a bit mask for the ports.
+
+Current given mask: 0b111
+Desired mask: 0b111111
+
+I noticed this while Christoph was reporting a bug found on headless
+GVT configuration which bisect blamed commit 3ae04c0c7e63 ("drm/i915/bios:
+limit default outputs to ports A through F")
+
+v2: Avoid unnecessary line continuations as pointed by CI and Christoph
+
+Cc: Christoph Hellwig <hch@infradead.org>
+Fixes: 3ae04c0c7e63 ("drm/i915/bios: limit default outputs to ports A through F")
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Tested-by: Christoph Hellwig <hch@infradead.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210723095225.562913-1-rodrigo.vivi@intel.com
+(cherry picked from commit 9b52aa720168859526bf90d77fa210fc0336f170)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_bios.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
+index 3d0c035b5e38..04c8d2ff7867 100644
+--- a/drivers/gpu/drm/i915/display/intel_bios.c
++++ b/drivers/gpu/drm/i915/display/intel_bios.c
+@@ -2130,7 +2130,8 @@ static void
+ init_vbt_missing_defaults(struct drm_i915_private *i915)
+ {
+ enum port port;
+- int ports = PORT_A | PORT_B | PORT_C | PORT_D | PORT_E | PORT_F;
++ int ports = BIT(PORT_A) | BIT(PORT_B) | BIT(PORT_C) |
++ BIT(PORT_D) | BIT(PORT_E) | BIT(PORT_F);
+
+ if (!HAS_DDI(i915) && !IS_CHERRYVIEW(i915))
+ return;
+--
+2.30.2
+
--- /dev/null
+From 640b07b158d6373a5ee1b3916ed1b4d86d9112de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 19:44:34 -0700
+Subject: drm/msm/dp: Initialize the INTF_CONFIG register
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit f9a39932fa54b6421e751ada7a285da809146421 ]
+
+Some bootloaders set the widebus enable bit in the INTF_CONFIG register,
+but configuration of widebus isn't yet supported ensure that the
+register has a known value, with widebus disabled.
+
+Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20210722024434.3313167-1-bjorn.andersson@linaro.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_catalog.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_catalog.c b/drivers/gpu/drm/msm/dp/dp_catalog.c
+index f4f53f23e331..146a223a997a 100644
+--- a/drivers/gpu/drm/msm/dp/dp_catalog.c
++++ b/drivers/gpu/drm/msm/dp/dp_catalog.c
+@@ -762,6 +762,7 @@ int dp_catalog_panel_timing_cfg(struct dp_catalog *dp_catalog)
+ dp_write_link(catalog, REG_DP_HSYNC_VSYNC_WIDTH_POLARITY,
+ dp_catalog->width_blanking);
+ dp_write_link(catalog, REG_DP_ACTIVE_HOR_VER, dp_catalog->dp_active);
++ dp_write_p0(catalog, MMSS_DP_INTF_CONFIG, 0);
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From e39c4508e79d9e8bf77455c7573ce52c4a8510a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 08:54:01 -0700
+Subject: drm/msm/dp: use dp_ctrl_off_link_stream during PHY compliance test
+ run
+
+From: Kuogee Hsieh <khsieh@codeaurora.org>
+
+[ Upstream commit 7591c532b818ef4b8e3e635d842547c08b3a32b4 ]
+
+DP cable should always connect to DPU during the entire PHY compliance
+testing run. Since DP PHY compliance test is executed at irq_hpd event
+context, dp_ctrl_off_link_stream() should be used instead of dp_ctrl_off().
+dp_ctrl_off() is used for unplug event which is triggered when DP cable is
+dis connected.
+
+Changes in V2:
+-- add fixes statement
+
+Fixes: f21c8a276c2d ("drm/msm/dp: handle irq_hpd with sink_count = 0 correctly")
+
+Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/1626191647-13901-2-git-send-email-khsieh@codeaurora.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_ctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+index 2a8955ca70d1..6856223e91e1 100644
+--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+@@ -1528,7 +1528,7 @@ static int dp_ctrl_process_phy_test_request(struct dp_ctrl_private *ctrl)
+ * running. Add the global reset just before disabling the
+ * link clocks and core clocks.
+ */
+- ret = dp_ctrl_off(&ctrl->dp_ctrl);
++ ret = dp_ctrl_off_link_stream(&ctrl->dp_ctrl);
+ if (ret) {
+ DRM_ERROR("failed to disable DP controller\n");
+ return ret;
+--
+2.30.2
+
--- /dev/null
+From c11afb63198e5e394b3aea9ca642e4c7802a254d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jun 2021 10:50:33 +0200
+Subject: drm/msm/dpu: Fix sm8250_mdp register length
+
+From: Robert Foss <robert.foss@linaro.org>
+
+[ Upstream commit b910a0206b59eb90ea8ff76d146f4c3156da61e9 ]
+
+The downstream dts lists this value as 0x494, and not
+0x45c.
+
+Fixes: af776a3e1c30 ("drm/msm/dpu: add SM8250 to hw catalog")
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+Link: https://lore.kernel.org/r/20210628085033.9905-1-robert.foss@linaro.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+index b569030a0847..2daf81f63076 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+@@ -268,7 +268,7 @@ static const struct dpu_mdp_cfg sc7180_mdp[] = {
+ static const struct dpu_mdp_cfg sm8250_mdp[] = {
+ {
+ .name = "top_0", .id = MDP_TOP,
+- .base = 0x0, .len = 0x45C,
++ .base = 0x0, .len = 0x494,
+ .features = 0,
+ .highest_bank_bit = 0x3, /* TODO: 2 for LP_DDR4 */
+ .clk_ctrls[DPU_CLK_CTRL_VIG0] = {
+--
+2.30.2
+
--- /dev/null
+From 6c3529cdbf54167e9850422a34a5cd77948d15cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jul 2021 23:17:37 +0530
+Subject: drm/panel: panel-simple: Fix proper bpc for ytc700tlag_05_201c
+
+From: Jagan Teki <jagan@amarulasolutions.com>
+
+[ Upstream commit 44379b986424b02acfa6e8c85ec5d68d89d3ccc4 ]
+
+ytc700tlag_05_201c panel support 8 bpc not 6 bpc as per
+recent testing in i.MX8MM platform.
+
+Fix it.
+
+Fixes: 7a1f4fa4a629 ("drm/panel: simple: Add YTC700TLAG-05-201C")
+Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210725174737.891106-1-jagan@amarulasolutions.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index be312b5c04dd..1301d42cfffb 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -4124,7 +4124,7 @@ static const struct drm_display_mode yes_optoelectronics_ytc700tlag_05_201c_mode
+ static const struct panel_desc yes_optoelectronics_ytc700tlag_05_201c = {
+ .modes = &yes_optoelectronics_ytc700tlag_05_201c_mode,
+ .num_modes = 1,
+- .bpc = 6,
++ .bpc = 8,
+ .size = {
+ .width = 154,
+ .height = 90,
+--
+2.30.2
+
--- /dev/null
+From 125381ba7ef4bb25c878a0779e16ef2296287375 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 May 2021 18:41:26 +0200
+Subject: i40e: Fix firmware LLDP agent related warning
+
+From: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+
+[ Upstream commit 71d6fdba4b2d82fdd883fec31dee77fbcf59773a ]
+
+Make warning meaningful for the user.
+
+Previously the trace:
+"Starting FW LLDP agent failed: error: I40E_ERR_ADMIN_QUEUE_ERROR, I40E_AQ_RC_EAGAIN"
+was produced when user tried to start Firmware LLDP agent,
+just after it was stopped with sequence:
+ethtool --set-priv-flags <dev> disable-fw-lldp on
+ethtool --set-priv-flags <dev> disable-fw-lldp off
+(without any delay between the commands)
+At that point the firmware is still processing stop command, the behavior
+is expected.
+
+Fixes: c1041d070437 ("i40e: Missing response checks in driver when starting/stopping FW LLDP")
+Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+Tested-by: Imam Hassan Reza Biswas <imam.hassan.reza.biswas@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index 3e822bad4851..d9e26f9713a5 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -5294,6 +5294,10 @@ flags_complete:
+ dev_warn(&pf->pdev->dev,
+ "Device configuration forbids SW from starting the LLDP agent.\n");
+ return -EINVAL;
++ case I40E_AQ_RC_EAGAIN:
++ dev_warn(&pf->pdev->dev,
++ "Stop FW LLDP agent command is still being processed, please try again in a second.\n");
++ return -EBUSY;
+ default:
+ dev_warn(&pf->pdev->dev,
+ "Starting FW LLDP agent failed: error: %s, %s\n",
+--
+2.30.2
+
--- /dev/null
+From d0e972ca2e573eaaff268df430d2f961d19ffbe5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jun 2021 08:49:49 +0000
+Subject: i40e: Fix log TC creation failure when max num of queues is exceeded
+
+From: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+
+[ Upstream commit ea52faae1d17cd3048681d86d2e8641f44de484d ]
+
+Fix missing failed message if driver does not have enough queues to
+complete TC command. Without this fix no message is displayed in dmesg.
+
+Fixes: a9ce82f744dc ("i40e: Enable 'channel' mode in mqprio for TC configs")
+Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
+Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+Tested-by: Imam Hassan Reza Biswas <imam.hassan.reza.biswas@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 0207c5ceecf6..4e5c53a6265c 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -7290,6 +7290,8 @@ static int i40e_validate_mqprio_qopt(struct i40e_vsi *vsi,
+ }
+ if (vsi->num_queue_pairs <
+ (mqprio_qopt->qopt.offset[i] + mqprio_qopt->qopt.count[i])) {
++ dev_err(&vsi->back->pdev->dev,
++ "Failed to create traffic channel, insufficient number of queues.\n");
+ return -EINVAL;
+ }
+ if (sum_max_rate > i40e_get_link_speed(vsi)) {
+--
+2.30.2
+
--- /dev/null
+From 1c137ab14a89e743077a85ef8d5573d8c71b0e0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 19:49:47 +0200
+Subject: i40e: Fix logic of disabling queues
+
+From: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+
+[ Upstream commit 65662a8dcdd01342b71ee44234bcfd0162e195af ]
+
+Correct the message flow between driver and firmware when disabling
+queues.
+
+Previously in case of PF reset (due to required reinit after reconfig),
+the error like: "VSI seid 397 Tx ring 60 disable timeout" could show up
+occasionally. The error was not a real issue of hardware or firmware,
+it was caused by wrong sequence of messages invoked by the driver.
+
+Fixes: 41c445ff0f48 ("i40e: main driver core")
+Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 58 ++++++++++++---------
+ 1 file changed, 34 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index f9fe500d4ec4..951423e5f2c0 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -4454,11 +4454,10 @@ int i40e_control_wait_tx_q(int seid, struct i40e_pf *pf, int pf_q,
+ }
+
+ /**
+- * i40e_vsi_control_tx - Start or stop a VSI's rings
++ * i40e_vsi_enable_tx - Start a VSI's rings
+ * @vsi: the VSI being configured
+- * @enable: start or stop the rings
+ **/
+-static int i40e_vsi_control_tx(struct i40e_vsi *vsi, bool enable)
++static int i40e_vsi_enable_tx(struct i40e_vsi *vsi)
+ {
+ struct i40e_pf *pf = vsi->back;
+ int i, pf_q, ret = 0;
+@@ -4467,7 +4466,7 @@ static int i40e_vsi_control_tx(struct i40e_vsi *vsi, bool enable)
+ for (i = 0; i < vsi->num_queue_pairs; i++, pf_q++) {
+ ret = i40e_control_wait_tx_q(vsi->seid, pf,
+ pf_q,
+- false /*is xdp*/, enable);
++ false /*is xdp*/, true);
+ if (ret)
+ break;
+
+@@ -4476,7 +4475,7 @@ static int i40e_vsi_control_tx(struct i40e_vsi *vsi, bool enable)
+
+ ret = i40e_control_wait_tx_q(vsi->seid, pf,
+ pf_q + vsi->alloc_queue_pairs,
+- true /*is xdp*/, enable);
++ true /*is xdp*/, true);
+ if (ret)
+ break;
+ }
+@@ -4574,32 +4573,25 @@ int i40e_control_wait_rx_q(struct i40e_pf *pf, int pf_q, bool enable)
+ }
+
+ /**
+- * i40e_vsi_control_rx - Start or stop a VSI's rings
++ * i40e_vsi_enable_rx - Start a VSI's rings
+ * @vsi: the VSI being configured
+- * @enable: start or stop the rings
+ **/
+-static int i40e_vsi_control_rx(struct i40e_vsi *vsi, bool enable)
++static int i40e_vsi_enable_rx(struct i40e_vsi *vsi)
+ {
+ struct i40e_pf *pf = vsi->back;
+ int i, pf_q, ret = 0;
+
+ pf_q = vsi->base_queue;
+ for (i = 0; i < vsi->num_queue_pairs; i++, pf_q++) {
+- ret = i40e_control_wait_rx_q(pf, pf_q, enable);
++ ret = i40e_control_wait_rx_q(pf, pf_q, true);
+ if (ret) {
+ dev_info(&pf->pdev->dev,
+- "VSI seid %d Rx ring %d %sable timeout\n",
+- vsi->seid, pf_q, (enable ? "en" : "dis"));
++ "VSI seid %d Rx ring %d enable timeout\n",
++ vsi->seid, pf_q);
+ break;
+ }
+ }
+
+- /* Due to HW errata, on Rx disable only, the register can indicate done
+- * before it really is. Needs 50ms to be sure
+- */
+- if (!enable)
+- mdelay(50);
+-
+ return ret;
+ }
+
+@@ -4612,29 +4604,47 @@ int i40e_vsi_start_rings(struct i40e_vsi *vsi)
+ int ret = 0;
+
+ /* do rx first for enable and last for disable */
+- ret = i40e_vsi_control_rx(vsi, true);
++ ret = i40e_vsi_enable_rx(vsi);
+ if (ret)
+ return ret;
+- ret = i40e_vsi_control_tx(vsi, true);
++ ret = i40e_vsi_enable_tx(vsi);
+
+ return ret;
+ }
+
++#define I40E_DISABLE_TX_GAP_MSEC 50
++
+ /**
+ * i40e_vsi_stop_rings - Stop a VSI's rings
+ * @vsi: the VSI being configured
+ **/
+ void i40e_vsi_stop_rings(struct i40e_vsi *vsi)
+ {
++ struct i40e_pf *pf = vsi->back;
++ int pf_q, err, q_end;
++
+ /* When port TX is suspended, don't wait */
+ if (test_bit(__I40E_PORT_SUSPENDED, vsi->back->state))
+ return i40e_vsi_stop_rings_no_wait(vsi);
+
+- /* do rx first for enable and last for disable
+- * Ignore return value, we need to shutdown whatever we can
+- */
+- i40e_vsi_control_tx(vsi, false);
+- i40e_vsi_control_rx(vsi, false);
++ q_end = vsi->base_queue + vsi->num_queue_pairs;
++ for (pf_q = vsi->base_queue; pf_q < q_end; pf_q++)
++ i40e_pre_tx_queue_cfg(&pf->hw, (u32)pf_q, false);
++
++ for (pf_q = vsi->base_queue; pf_q < q_end; pf_q++) {
++ err = i40e_control_wait_rx_q(pf, pf_q, false);
++ if (err)
++ dev_info(&pf->pdev->dev,
++ "VSI seid %d Rx ring %d dissable timeout\n",
++ vsi->seid, pf_q);
++ }
++
++ msleep(I40E_DISABLE_TX_GAP_MSEC);
++ pf_q = vsi->base_queue;
++ for (pf_q = vsi->base_queue; pf_q < q_end; pf_q++)
++ wr32(&pf->hw, I40E_QTX_ENA(pf_q), 0);
++
++ i40e_vsi_wait_queues_disabled(vsi);
+ }
+
+ /**
+--
+2.30.2
+
--- /dev/null
+From d36683f1f00a8c4a68d0b828ad0583e5ead05814 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jun 2021 00:47:03 +0000
+Subject: i40e: Fix queue-to-TC mapping on Tx
+
+From: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+
+[ Upstream commit 89ec1f0886c127c7e41ac61a6b6d539f4fb2510b ]
+
+In SW DCB mode the packets sent receive incorrect UP tags. They are
+constructed correctly and put into tx_ring, but UP is later remapped by
+HW on the basis of TCTUPR register contents according to Tx queue
+selected, and BW used is consistent with the new UP values. This is
+caused by Tx queue selection in kernel not taking into account DCB
+configuration. This patch fixes the issue by implementing the
+ndo_select_queue NDO callback.
+
+Fixes: fd0a05ce74ef ("i40e: transmit, receive, and NAPI")
+Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+Tested-by: Imam Hassan Reza Biswas <imam.hassan.reza.biswas@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 1 +
+ drivers/net/ethernet/intel/i40e/i40e_txrx.c | 50 +++++++++++++++++++++
+ drivers/net/ethernet/intel/i40e/i40e_txrx.h | 2 +
+ 3 files changed, 53 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 951423e5f2c0..0207c5ceecf6 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -13271,6 +13271,7 @@ static const struct net_device_ops i40e_netdev_ops = {
+ .ndo_poll_controller = i40e_netpoll,
+ #endif
+ .ndo_setup_tc = __i40e_setup_tc,
++ .ndo_select_queue = i40e_lan_select_queue,
+ .ndo_set_features = i40e_set_features,
+ .ndo_set_vf_mac = i40e_ndo_set_vf_mac,
+ .ndo_set_vf_vlan = i40e_ndo_set_vf_port_vlan,
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+index b883ab809df3..107fb472319e 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -3633,6 +3633,56 @@ dma_error:
+ return -1;
+ }
+
++static u16 i40e_swdcb_skb_tx_hash(struct net_device *dev,
++ const struct sk_buff *skb,
++ u16 num_tx_queues)
++{
++ u32 jhash_initval_salt = 0xd631614b;
++ u32 hash;
++
++ if (skb->sk && skb->sk->sk_hash)
++ hash = skb->sk->sk_hash;
++ else
++ hash = (__force u16)skb->protocol ^ skb->hash;
++
++ hash = jhash_1word(hash, jhash_initval_salt);
++
++ return (u16)(((u64)hash * num_tx_queues) >> 32);
++}
++
++u16 i40e_lan_select_queue(struct net_device *netdev,
++ struct sk_buff *skb,
++ struct net_device __always_unused *sb_dev)
++{
++ struct i40e_netdev_priv *np = netdev_priv(netdev);
++ struct i40e_vsi *vsi = np->vsi;
++ struct i40e_hw *hw;
++ u16 qoffset;
++ u16 qcount;
++ u8 tclass;
++ u16 hash;
++ u8 prio;
++
++ /* is DCB enabled at all? */
++ if (vsi->tc_config.numtc == 1)
++ return i40e_swdcb_skb_tx_hash(netdev, skb,
++ netdev->real_num_tx_queues);
++
++ prio = skb->priority;
++ hw = &vsi->back->hw;
++ tclass = hw->local_dcbx_config.etscfg.prioritytable[prio];
++ /* sanity check */
++ if (unlikely(!(vsi->tc_config.enabled_tc & BIT(tclass))))
++ tclass = 0;
++
++ /* select a queue assigned for the given TC */
++ qcount = vsi->tc_config.tc_info[tclass].qcount;
++ hash = i40e_swdcb_skb_tx_hash(netdev, skb, qcount);
++
++ qoffset = vsi->tc_config.tc_info[tclass].qoffset;
++ return qoffset + hash;
++}
++
+ /**
+ * i40e_xmit_xdp_ring - transmits an XDP buffer to an XDP Tx ring
+ * @xdpf: data to transmit
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.h b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
+index 86fed05b4f19..bfc2845c99d1 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
+@@ -451,6 +451,8 @@ static inline unsigned int i40e_rx_pg_order(struct i40e_ring *ring)
+
+ bool i40e_alloc_rx_buffers(struct i40e_ring *rxr, u16 cleaned_count);
+ netdev_tx_t i40e_lan_xmit_frame(struct sk_buff *skb, struct net_device *netdev);
++u16 i40e_lan_select_queue(struct net_device *netdev, struct sk_buff *skb,
++ struct net_device *sb_dev);
+ void i40e_clean_tx_ring(struct i40e_ring *tx_ring);
+ void i40e_clean_rx_ring(struct i40e_ring *rx_ring);
+ int i40e_setup_tx_descriptors(struct i40e_ring *tx_ring);
+--
+2.30.2
+
--- /dev/null
+From f0e37ac0c12251f14f2f52ec135e1e4ba74a9f70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 11:02:46 -0700
+Subject: ionic: catch no ptp support earlier
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit f79eef711eb57d56874b08ea11db69221de54a6d ]
+
+If PTP configuration is attempted on ports that don't support
+it, such as VF ports, the driver will return an error status
+-95, or EOPNOSUPP and print an error message
+ enp98s0: hwstamp set failed: -95
+
+Because some daemons can retry every few seconds, this can end
+up filling the dmesg log and pushing out other more useful
+messages.
+
+We can catch this issue earlier in our handling and return
+the error without a log message.
+
+Fixes: 829600ce5e4e ("ionic: add ts_config replay")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_lif.h | 7 ++-----
+ drivers/net/ethernet/pensando/ionic/ionic_phc.c | 10 +++++++---
+ 2 files changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.h b/drivers/net/ethernet/pensando/ionic/ionic_lif.h
+index af291303bd7a..69ab59fedb6c 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.h
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.h
+@@ -302,7 +302,7 @@ int ionic_lif_identify(struct ionic *ionic, u8 lif_type,
+ int ionic_lif_size(struct ionic *ionic);
+
+ #if IS_ENABLED(CONFIG_PTP_1588_CLOCK)
+-int ionic_lif_hwstamp_replay(struct ionic_lif *lif);
++void ionic_lif_hwstamp_replay(struct ionic_lif *lif);
+ int ionic_lif_hwstamp_set(struct ionic_lif *lif, struct ifreq *ifr);
+ int ionic_lif_hwstamp_get(struct ionic_lif *lif, struct ifreq *ifr);
+ ktime_t ionic_lif_phc_ktime(struct ionic_lif *lif, u64 counter);
+@@ -311,10 +311,7 @@ void ionic_lif_unregister_phc(struct ionic_lif *lif);
+ void ionic_lif_alloc_phc(struct ionic_lif *lif);
+ void ionic_lif_free_phc(struct ionic_lif *lif);
+ #else
+-static inline int ionic_lif_hwstamp_replay(struct ionic_lif *lif)
+-{
+- return -EOPNOTSUPP;
+-}
++static inline void ionic_lif_hwstamp_replay(struct ionic_lif *lif) {}
+
+ static inline int ionic_lif_hwstamp_set(struct ionic_lif *lif, struct ifreq *ifr)
+ {
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_phc.c b/drivers/net/ethernet/pensando/ionic/ionic_phc.c
+index a87c87e86aef..6e2403c71608 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_phc.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_phc.c
+@@ -188,6 +188,9 @@ int ionic_lif_hwstamp_set(struct ionic_lif *lif, struct ifreq *ifr)
+ struct hwtstamp_config config;
+ int err;
+
++ if (!lif->phc || !lif->phc->ptp)
++ return -EOPNOTSUPP;
++
+ if (copy_from_user(&config, ifr->ifr_data, sizeof(config)))
+ return -EFAULT;
+
+@@ -203,15 +206,16 @@ int ionic_lif_hwstamp_set(struct ionic_lif *lif, struct ifreq *ifr)
+ return 0;
+ }
+
+-int ionic_lif_hwstamp_replay(struct ionic_lif *lif)
++void ionic_lif_hwstamp_replay(struct ionic_lif *lif)
+ {
+ int err;
+
++ if (!lif->phc || !lif->phc->ptp)
++ return;
++
+ err = ionic_lif_hwstamp_set_ts_config(lif, NULL);
+ if (err)
+ netdev_info(lif->netdev, "hwstamp replay failed: %d\n", err);
+-
+- return err;
+ }
+
+ int ionic_lif_hwstamp_get(struct ionic_lif *lif, struct ifreq *ifr)
+--
+2.30.2
+
--- /dev/null
+From 8cc0938a2254faa499d0fc7ad74f330a801073bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 11:02:49 -0700
+Subject: ionic: count csum_none when offload enabled
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit f07f9815b7046e25cc32bf8542c9c0bbc5eb6e0e ]
+
+Be sure to count the csum_none cases when csum offload is
+enabled.
+
+Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+index 1c6e2b9fc96b..08870190e4d2 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+@@ -274,12 +274,11 @@ static void ionic_rx_clean(struct ionic_queue *q,
+ }
+ }
+
+- if (likely(netdev->features & NETIF_F_RXCSUM)) {
+- if (comp->csum_flags & IONIC_RXQ_COMP_CSUM_F_CALC) {
+- skb->ip_summed = CHECKSUM_COMPLETE;
+- skb->csum = (__force __wsum)le16_to_cpu(comp->csum);
+- stats->csum_complete++;
+- }
++ if (likely(netdev->features & NETIF_F_RXCSUM) &&
++ (comp->csum_flags & IONIC_RXQ_COMP_CSUM_F_CALC)) {
++ skb->ip_summed = CHECKSUM_COMPLETE;
++ skb->csum = (__force __wsum)le16_to_cpu(comp->csum);
++ stats->csum_complete++;
+ } else {
+ stats->csum_none++;
+ }
+--
+2.30.2
+
--- /dev/null
+From 15ac39d7de6136ccf9d3512783ccfad2803af041 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 11:02:48 -0700
+Subject: ionic: fix up dim accounting for tx and rx
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit 76ed8a4a00b484dcccef819ef2618bcf8e46f560 ]
+
+We need to count the correct Tx and/or Rx packets for dynamic
+interrupt moderation, depending on which we're processing on
+the queue interrupt.
+
+Fixes: 04a834592bf5 ("ionic: dynamic interrupt moderation")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/pensando/ionic/ionic_txrx.c | 28 ++++++++++++++-----
+ 1 file changed, 21 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+index 9d3a04110685..1c6e2b9fc96b 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+@@ -451,11 +451,12 @@ void ionic_rx_empty(struct ionic_queue *q)
+ q->tail_idx = 0;
+ }
+
+-static void ionic_dim_update(struct ionic_qcq *qcq)
++static void ionic_dim_update(struct ionic_qcq *qcq, int napi_mode)
+ {
+ struct dim_sample dim_sample;
+ struct ionic_lif *lif;
+ unsigned int qi;
++ u64 pkts, bytes;
+
+ if (!qcq->intr.dim_coal_hw)
+ return;
+@@ -463,10 +464,23 @@ static void ionic_dim_update(struct ionic_qcq *qcq)
+ lif = qcq->q.lif;
+ qi = qcq->cq.bound_q->index;
+
++ switch (napi_mode) {
++ case IONIC_LIF_F_TX_DIM_INTR:
++ pkts = lif->txqstats[qi].pkts;
++ bytes = lif->txqstats[qi].bytes;
++ break;
++ case IONIC_LIF_F_RX_DIM_INTR:
++ pkts = lif->rxqstats[qi].pkts;
++ bytes = lif->rxqstats[qi].bytes;
++ break;
++ default:
++ pkts = lif->txqstats[qi].pkts + lif->rxqstats[qi].pkts;
++ bytes = lif->txqstats[qi].bytes + lif->rxqstats[qi].bytes;
++ break;
++ }
++
+ dim_update_sample(qcq->cq.bound_intr->rearm_count,
+- lif->txqstats[qi].pkts,
+- lif->txqstats[qi].bytes,
+- &dim_sample);
++ pkts, bytes, &dim_sample);
+
+ net_dim(&qcq->dim, dim_sample);
+ }
+@@ -487,7 +501,7 @@ int ionic_tx_napi(struct napi_struct *napi, int budget)
+ ionic_tx_service, NULL, NULL);
+
+ if (work_done < budget && napi_complete_done(napi, work_done)) {
+- ionic_dim_update(qcq);
++ ionic_dim_update(qcq, IONIC_LIF_F_TX_DIM_INTR);
+ flags |= IONIC_INTR_CRED_UNMASK;
+ cq->bound_intr->rearm_count++;
+ }
+@@ -526,7 +540,7 @@ int ionic_rx_napi(struct napi_struct *napi, int budget)
+ ionic_rx_fill(cq->bound_q);
+
+ if (work_done < budget && napi_complete_done(napi, work_done)) {
+- ionic_dim_update(qcq);
++ ionic_dim_update(qcq, IONIC_LIF_F_RX_DIM_INTR);
+ flags |= IONIC_INTR_CRED_UNMASK;
+ cq->bound_intr->rearm_count++;
+ }
+@@ -572,7 +586,7 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget)
+ ionic_rx_fill(rxcq->bound_q);
+
+ if (rx_work_done < budget && napi_complete_done(napi, rx_work_done)) {
+- ionic_dim_update(qcq);
++ ionic_dim_update(qcq, 0);
+ flags |= IONIC_INTR_CRED_UNMASK;
+ rxcq->bound_intr->rearm_count++;
+ }
+--
+2.30.2
+
--- /dev/null
+From d7d158582d3155a516255efbea11a56d5fda8fff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 11:02:45 -0700
+Subject: ionic: make all rx_mode work threadsafe
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit 6840e17b8ea992453e2d6f460d403cb05d194e76 ]
+
+Move the bulk of the code from ionic_set_rx_mode(), which
+can be called from atomic context, into ionic_lif_rx_mode()
+which is a safe context.
+
+A call from the stack will get pushed off into a work thread,
+but it is also possible to simultaneously have a call driven
+by a queue reconfig request from an ethtool command or fw
+recovery event. We add a mutex around the rx_mode work to be
+sure they don't collide.
+
+Fixes: 81dbc24147f9 ("ionic: change set_rx_mode from_ndo to can_sleep")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/pensando/ionic/ionic_lif.c | 183 ++++++++----------
+ .../net/ethernet/pensando/ionic/ionic_lif.h | 4 +-
+ 2 files changed, 85 insertions(+), 102 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+index af3a5368529c..7815e9034fb8 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -29,7 +29,7 @@ static const u8 ionic_qtype_versions[IONIC_QTYPE_MAX] = {
+ */
+ };
+
+-static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode);
++static void ionic_lif_rx_mode(struct ionic_lif *lif);
+ static int ionic_lif_addr_add(struct ionic_lif *lif, const u8 *addr);
+ static int ionic_lif_addr_del(struct ionic_lif *lif, const u8 *addr);
+ static void ionic_link_status_check(struct ionic_lif *lif);
+@@ -77,7 +77,7 @@ static void ionic_lif_deferred_work(struct work_struct *work)
+
+ switch (w->type) {
+ case IONIC_DW_TYPE_RX_MODE:
+- ionic_lif_rx_mode(lif, w->rx_mode);
++ ionic_lif_rx_mode(lif);
+ break;
+ case IONIC_DW_TYPE_RX_ADDR_ADD:
+ ionic_lif_addr_add(lif, w->addr);
+@@ -1301,10 +1301,8 @@ static int ionic_lif_addr_del(struct ionic_lif *lif, const u8 *addr)
+ return 0;
+ }
+
+-static int ionic_lif_addr(struct ionic_lif *lif, const u8 *addr, bool add,
+- bool can_sleep)
++static int ionic_lif_addr(struct ionic_lif *lif, const u8 *addr, bool add)
+ {
+- struct ionic_deferred_work *work;
+ unsigned int nmfilters;
+ unsigned int nufilters;
+
+@@ -1330,97 +1328,46 @@ static int ionic_lif_addr(struct ionic_lif *lif, const u8 *addr, bool add,
+ lif->nucast--;
+ }
+
+- if (!can_sleep) {
+- work = kzalloc(sizeof(*work), GFP_ATOMIC);
+- if (!work)
+- return -ENOMEM;
+- work->type = add ? IONIC_DW_TYPE_RX_ADDR_ADD :
+- IONIC_DW_TYPE_RX_ADDR_DEL;
+- memcpy(work->addr, addr, ETH_ALEN);
+- netdev_dbg(lif->netdev, "deferred: rx_filter %s %pM\n",
+- add ? "add" : "del", addr);
+- ionic_lif_deferred_enqueue(&lif->deferred, work);
+- } else {
+- netdev_dbg(lif->netdev, "rx_filter %s %pM\n",
+- add ? "add" : "del", addr);
+- if (add)
+- return ionic_lif_addr_add(lif, addr);
+- else
+- return ionic_lif_addr_del(lif, addr);
+- }
++ netdev_dbg(lif->netdev, "rx_filter %s %pM\n",
++ add ? "add" : "del", addr);
++ if (add)
++ return ionic_lif_addr_add(lif, addr);
++ else
++ return ionic_lif_addr_del(lif, addr);
+
+ return 0;
+ }
+
+ static int ionic_addr_add(struct net_device *netdev, const u8 *addr)
+ {
+- return ionic_lif_addr(netdev_priv(netdev), addr, ADD_ADDR, CAN_SLEEP);
+-}
+-
+-static int ionic_ndo_addr_add(struct net_device *netdev, const u8 *addr)
+-{
+- return ionic_lif_addr(netdev_priv(netdev), addr, ADD_ADDR, CAN_NOT_SLEEP);
++ return ionic_lif_addr(netdev_priv(netdev), addr, ADD_ADDR);
+ }
+
+ static int ionic_addr_del(struct net_device *netdev, const u8 *addr)
+ {
+- return ionic_lif_addr(netdev_priv(netdev), addr, DEL_ADDR, CAN_SLEEP);
++ return ionic_lif_addr(netdev_priv(netdev), addr, DEL_ADDR);
+ }
+
+-static int ionic_ndo_addr_del(struct net_device *netdev, const u8 *addr)
++static void ionic_lif_rx_mode(struct ionic_lif *lif)
+ {
+- return ionic_lif_addr(netdev_priv(netdev), addr, DEL_ADDR, CAN_NOT_SLEEP);
+-}
+-
+-static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode)
+-{
+- struct ionic_admin_ctx ctx = {
+- .work = COMPLETION_INITIALIZER_ONSTACK(ctx.work),
+- .cmd.rx_mode_set = {
+- .opcode = IONIC_CMD_RX_MODE_SET,
+- .lif_index = cpu_to_le16(lif->index),
+- .rx_mode = cpu_to_le16(rx_mode),
+- },
+- };
++ struct net_device *netdev = lif->netdev;
++ unsigned int nfilters;
++ unsigned int nd_flags;
+ char buf[128];
+- int err;
++ u16 rx_mode;
+ int i;
+ #define REMAIN(__x) (sizeof(buf) - (__x))
+
+- i = scnprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:",
+- lif->rx_mode, rx_mode);
+- if (rx_mode & IONIC_RX_MODE_F_UNICAST)
+- i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST");
+- if (rx_mode & IONIC_RX_MODE_F_MULTICAST)
+- i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST");
+- if (rx_mode & IONIC_RX_MODE_F_BROADCAST)
+- i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST");
+- if (rx_mode & IONIC_RX_MODE_F_PROMISC)
+- i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC");
+- if (rx_mode & IONIC_RX_MODE_F_ALLMULTI)
+- i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI");
+- netdev_dbg(lif->netdev, "lif%d %s\n", lif->index, buf);
+-
+- err = ionic_adminq_post_wait(lif, &ctx);
+- if (err)
+- netdev_warn(lif->netdev, "set rx_mode 0x%04x failed: %d\n",
+- rx_mode, err);
+- else
+- lif->rx_mode = rx_mode;
+-}
++ mutex_lock(&lif->config_lock);
+
+-static void ionic_set_rx_mode(struct net_device *netdev, bool can_sleep)
+-{
+- struct ionic_lif *lif = netdev_priv(netdev);
+- struct ionic_deferred_work *work;
+- unsigned int nfilters;
+- unsigned int rx_mode;
++ /* grab the flags once for local use */
++ nd_flags = netdev->flags;
+
+ rx_mode = IONIC_RX_MODE_F_UNICAST;
+- rx_mode |= (netdev->flags & IFF_MULTICAST) ? IONIC_RX_MODE_F_MULTICAST : 0;
+- rx_mode |= (netdev->flags & IFF_BROADCAST) ? IONIC_RX_MODE_F_BROADCAST : 0;
+- rx_mode |= (netdev->flags & IFF_PROMISC) ? IONIC_RX_MODE_F_PROMISC : 0;
+- rx_mode |= (netdev->flags & IFF_ALLMULTI) ? IONIC_RX_MODE_F_ALLMULTI : 0;
++ rx_mode |= (nd_flags & IFF_MULTICAST) ? IONIC_RX_MODE_F_MULTICAST : 0;
++ rx_mode |= (nd_flags & IFF_BROADCAST) ? IONIC_RX_MODE_F_BROADCAST : 0;
++ rx_mode |= (nd_flags & IFF_PROMISC) ? IONIC_RX_MODE_F_PROMISC : 0;
++ rx_mode |= (nd_flags & IFF_ALLMULTI) ? IONIC_RX_MODE_F_ALLMULTI : 0;
+
+ /* sync unicast addresses
+ * next check to see if we're in an overflow state
+@@ -1429,49 +1376,83 @@ static void ionic_set_rx_mode(struct net_device *netdev, bool can_sleep)
+ * we remove our overflow flag and check the netdev flags
+ * to see if we can disable NIC PROMISC
+ */
+- if (can_sleep)
+- __dev_uc_sync(netdev, ionic_addr_add, ionic_addr_del);
+- else
+- __dev_uc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
++ __dev_uc_sync(netdev, ionic_addr_add, ionic_addr_del);
+ nfilters = le32_to_cpu(lif->identity->eth.max_ucast_filters);
+ if (netdev_uc_count(netdev) + 1 > nfilters) {
+ rx_mode |= IONIC_RX_MODE_F_PROMISC;
+ lif->uc_overflow = true;
+ } else if (lif->uc_overflow) {
+ lif->uc_overflow = false;
+- if (!(netdev->flags & IFF_PROMISC))
++ if (!(nd_flags & IFF_PROMISC))
+ rx_mode &= ~IONIC_RX_MODE_F_PROMISC;
+ }
+
+ /* same for multicast */
+- if (can_sleep)
+- __dev_mc_sync(netdev, ionic_addr_add, ionic_addr_del);
+- else
+- __dev_mc_sync(netdev, ionic_ndo_addr_add, ionic_ndo_addr_del);
++ __dev_mc_sync(netdev, ionic_addr_add, ionic_addr_del);
+ nfilters = le32_to_cpu(lif->identity->eth.max_mcast_filters);
+ if (netdev_mc_count(netdev) > nfilters) {
+ rx_mode |= IONIC_RX_MODE_F_ALLMULTI;
+ lif->mc_overflow = true;
+ } else if (lif->mc_overflow) {
+ lif->mc_overflow = false;
+- if (!(netdev->flags & IFF_ALLMULTI))
++ if (!(nd_flags & IFF_ALLMULTI))
+ rx_mode &= ~IONIC_RX_MODE_F_ALLMULTI;
+ }
+
++ i = scnprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:",
++ lif->rx_mode, rx_mode);
++ if (rx_mode & IONIC_RX_MODE_F_UNICAST)
++ i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST");
++ if (rx_mode & IONIC_RX_MODE_F_MULTICAST)
++ i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST");
++ if (rx_mode & IONIC_RX_MODE_F_BROADCAST)
++ i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST");
++ if (rx_mode & IONIC_RX_MODE_F_PROMISC)
++ i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC");
++ if (rx_mode & IONIC_RX_MODE_F_ALLMULTI)
++ i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI");
++ if (rx_mode & IONIC_RX_MODE_F_RDMA_SNIFFER)
++ i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_RDMA_SNIFFER");
++ netdev_dbg(netdev, "lif%d %s\n", lif->index, buf);
++
+ if (lif->rx_mode != rx_mode) {
+- if (!can_sleep) {
+- work = kzalloc(sizeof(*work), GFP_ATOMIC);
+- if (!work) {
+- netdev_err(lif->netdev, "rxmode change dropped\n");
+- return;
+- }
+- work->type = IONIC_DW_TYPE_RX_MODE;
+- work->rx_mode = rx_mode;
+- netdev_dbg(lif->netdev, "deferred: rx_mode\n");
+- ionic_lif_deferred_enqueue(&lif->deferred, work);
+- } else {
+- ionic_lif_rx_mode(lif, rx_mode);
++ struct ionic_admin_ctx ctx = {
++ .work = COMPLETION_INITIALIZER_ONSTACK(ctx.work),
++ .cmd.rx_mode_set = {
++ .opcode = IONIC_CMD_RX_MODE_SET,
++ .lif_index = cpu_to_le16(lif->index),
++ },
++ };
++ int err;
++
++ ctx.cmd.rx_mode_set.rx_mode = cpu_to_le16(rx_mode);
++ err = ionic_adminq_post_wait(lif, &ctx);
++ if (err)
++ netdev_warn(netdev, "set rx_mode 0x%04x failed: %d\n",
++ rx_mode, err);
++ else
++ lif->rx_mode = rx_mode;
++ }
++
++ mutex_unlock(&lif->config_lock);
++}
++
++static void ionic_set_rx_mode(struct net_device *netdev, bool can_sleep)
++{
++ struct ionic_lif *lif = netdev_priv(netdev);
++ struct ionic_deferred_work *work;
++
++ if (!can_sleep) {
++ work = kzalloc(sizeof(*work), GFP_ATOMIC);
++ if (!work) {
++ netdev_err(lif->netdev, "rxmode change dropped\n");
++ return;
+ }
++ work->type = IONIC_DW_TYPE_RX_MODE;
++ netdev_dbg(lif->netdev, "deferred: rx_mode\n");
++ ionic_lif_deferred_enqueue(&lif->deferred, work);
++ } else {
++ ionic_lif_rx_mode(lif);
+ }
+ }
+
+@@ -3058,6 +3039,7 @@ void ionic_lif_deinit(struct ionic_lif *lif)
+ ionic_lif_qcq_deinit(lif, lif->notifyqcq);
+ ionic_lif_qcq_deinit(lif, lif->adminqcq);
+
++ mutex_destroy(&lif->config_lock);
+ mutex_destroy(&lif->queue_lock);
+ ionic_lif_reset(lif);
+ }
+@@ -3185,7 +3167,7 @@ static int ionic_station_set(struct ionic_lif *lif)
+ */
+ if (!ether_addr_equal(ctx.comp.lif_getattr.mac,
+ netdev->dev_addr))
+- ionic_lif_addr(lif, netdev->dev_addr, ADD_ADDR, CAN_SLEEP);
++ ionic_lif_addr(lif, netdev->dev_addr, ADD_ADDR);
+ } else {
+ /* Update the netdev mac with the device's mac */
+ memcpy(addr.sa_data, ctx.comp.lif_getattr.mac, netdev->addr_len);
+@@ -3202,7 +3184,7 @@ static int ionic_station_set(struct ionic_lif *lif)
+
+ netdev_dbg(lif->netdev, "adding station MAC addr %pM\n",
+ netdev->dev_addr);
+- ionic_lif_addr(lif, netdev->dev_addr, ADD_ADDR, CAN_SLEEP);
++ ionic_lif_addr(lif, netdev->dev_addr, ADD_ADDR);
+
+ return 0;
+ }
+@@ -3225,6 +3207,7 @@ int ionic_lif_init(struct ionic_lif *lif)
+
+ lif->hw_index = le16_to_cpu(comp.hw_index);
+ mutex_init(&lif->queue_lock);
++ mutex_init(&lif->config_lock);
+
+ /* now that we have the hw_index we can figure out our doorbell page */
+ lif->dbid_count = le32_to_cpu(lif->ionic->ident.dev.ndbpgs_per_lif);
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.h b/drivers/net/ethernet/pensando/ionic/ionic_lif.h
+index 346506f01715..af291303bd7a 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.h
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.h
+@@ -108,7 +108,6 @@ struct ionic_deferred_work {
+ struct list_head list;
+ enum ionic_deferred_work_type type;
+ union {
+- unsigned int rx_mode;
+ u8 addr[ETH_ALEN];
+ u8 fw_status;
+ };
+@@ -179,6 +178,7 @@ struct ionic_lif {
+ unsigned int index;
+ unsigned int hw_index;
+ struct mutex queue_lock; /* lock for queue structures */
++ struct mutex config_lock; /* lock for config actions */
+ spinlock_t adminq_lock; /* lock for AdminQ operations */
+ struct ionic_qcq *adminqcq;
+ struct ionic_qcq *notifyqcq;
+@@ -199,7 +199,7 @@ struct ionic_lif {
+ unsigned int nrxq_descs;
+ u32 rx_copybreak;
+ u64 rxq_features;
+- unsigned int rx_mode;
++ u16 rx_mode;
+ u64 hw_features;
+ bool registered;
+ bool mc_overflow;
+--
+2.30.2
+
--- /dev/null
+From e52d69cf8302984bec1c8a731acfefe6953b3255 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 11:02:47 -0700
+Subject: ionic: remove intr coalesce update from napi
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit a6ff85e0a2d9d074a4b4c291ba9ec1e5b0aba22b ]
+
+Move the interrupt coalesce value update out of the napi
+thread and into the dim_work thread and set it only when it
+has actually changed.
+
+Fixes: 04a834592bf5 ("ionic: dynamic interrupt moderation")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 14 +++++++++++++-
+ drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 4 ----
+ 2 files changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+index 7815e9034fb8..e795fa63ca12 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -53,7 +53,19 @@ static void ionic_dim_work(struct work_struct *work)
+ cur_moder = net_dim_get_rx_moderation(dim->mode, dim->profile_ix);
+ qcq = container_of(dim, struct ionic_qcq, dim);
+ new_coal = ionic_coal_usec_to_hw(qcq->q.lif->ionic, cur_moder.usec);
+- qcq->intr.dim_coal_hw = new_coal ? new_coal : 1;
++ new_coal = new_coal ? new_coal : 1;
++
++ if (qcq->intr.dim_coal_hw != new_coal) {
++ unsigned int qi = qcq->cq.bound_q->index;
++ struct ionic_lif *lif = qcq->q.lif;
++
++ qcq->intr.dim_coal_hw = new_coal;
++
++ ionic_intr_coal_init(lif->ionic->idev.intr_ctrl,
++ lif->rxqcqs[qi]->intr.index,
++ qcq->intr.dim_coal_hw);
++ }
++
+ dim->state = DIM_START_MEASURE;
+ }
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+index 08934888575c..9d3a04110685 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+@@ -463,10 +463,6 @@ static void ionic_dim_update(struct ionic_qcq *qcq)
+ lif = qcq->q.lif;
+ qi = qcq->cq.bound_q->index;
+
+- ionic_intr_coal_init(lif->ionic->idev.intr_ctrl,
+- lif->rxqcqs[qi]->intr.index,
+- qcq->intr.dim_coal_hw);
+-
+ dim_update_sample(qcq->cq.bound_intr->rearm_count,
+ lif->txqstats[qi].pkts,
+ lif->txqstats[qi].bytes,
+--
+2.30.2
+
--- /dev/null
+From bc9f8e9ac210584710bfadcfd415150a5c00e022 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 22:09:56 +0000
+Subject: KVM: selftests: Fix missing break in dirty_log_perf_test arg parsing
+
+From: David Matlack <dmatlack@google.com>
+
+[ Upstream commit 15b7b737deb30e1f8f116a08e723173b55ebd2f3 ]
+
+There is a missing break statement which causes a fallthrough to the
+next statement where optarg will be null and a segmentation fault will
+be generated.
+
+Fixes: 9e965bb75aae ("KVM: selftests: Add backing src parameter to dirty_log_perf_test")
+Reviewed-by: Ben Gardon <bgardon@google.com>
+Signed-off-by: David Matlack <dmatlack@google.com>
+Message-Id: <20210713220957.3493520-6-dmatlack@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kvm/dirty_log_perf_test.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/kvm/dirty_log_perf_test.c b/tools/testing/selftests/kvm/dirty_log_perf_test.c
+index 04a2641261be..80cbd3a748c0 100644
+--- a/tools/testing/selftests/kvm/dirty_log_perf_test.c
++++ b/tools/testing/selftests/kvm/dirty_log_perf_test.c
+@@ -312,6 +312,7 @@ int main(int argc, char *argv[])
+ break;
+ case 'o':
+ p.partition_vcpu_memory_access = false;
++ break;
+ case 's':
+ p.backing_src = parse_backing_src_type(optarg);
+ break;
+--
+2.30.2
+
--- /dev/null
+From d3070ba46927dc5bf476ea620153e70106dff9a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 14:30:18 +0200
+Subject: KVM: x86: Check the right feature bit for MSR_KVM_ASYNC_PF_ACK access
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+[ Upstream commit 0a31df6823232516f61f174907e444f710941dfe ]
+
+MSR_KVM_ASYNC_PF_ACK MSR is part of interrupt based asynchronous page fault
+interface and not the original (deprecated) KVM_FEATURE_ASYNC_PF. This is
+stated in Documentation/virt/kvm/msr.rst.
+
+Fixes: 66570e966dd9 ("kvm: x86: only provide PV features if enabled in guest's CPUID")
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
+Reviewed-by: Oliver Upton <oupton@google.com>
+Message-Id: <20210722123018.260035-1-vkuznets@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/x86.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index b5a3de788b5f..d6a9f0518784 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3314,7 +3314,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ return 1;
+ break;
+ case MSR_KVM_ASYNC_PF_ACK:
+- if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF))
++ if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF_INT))
+ return 1;
+ if (data & 0x1) {
+ vcpu->arch.apf.pageready_pending = false;
+@@ -3646,7 +3646,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ msr_info->data = vcpu->arch.apf.msr_int_val;
+ break;
+ case MSR_KVM_ASYNC_PF_ACK:
+- if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF))
++ if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF_INT))
+ return 1;
+
+ msr_info->data = 0;
+--
+2.30.2
+
--- /dev/null
+From 64d638da22c887cd929ca0aa651c6412f7ae8edc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jul 2021 23:40:34 +0900
+Subject: loop: reintroduce global lock for safe loop_validate_file() traversal
+
+From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+
+[ Upstream commit 3ce6e1f662a910970880188ea7bfd00542bd3934 ]
+
+Commit 6cc8e7430801fa23 ("loop: scale loop device by introducing per
+device lock") re-opened a race window for NULL pointer dereference at
+loop_validate_file() where commit 310ca162d779efee ("block/loop: Use
+global lock for ioctl() operation.") has closed.
+
+Although we need to guarantee that other loop devices will not change
+during traversal, we can't take remote "struct loop_device"->lo_mutex
+inside loop_validate_file() in order to avoid AB-BA deadlock. Therefore,
+introduce a global lock dedicated for loop_validate_file() which is
+conditionally taken before local "struct loop_device"->lo_mutex is taken.
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Fixes: 6cc8e7430801fa23 ("loop: scale loop device by introducing per device lock")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 128 ++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 97 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 8271df125153..e81298b91227 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -86,6 +86,47 @@
+
+ static DEFINE_IDR(loop_index_idr);
+ static DEFINE_MUTEX(loop_ctl_mutex);
++static DEFINE_MUTEX(loop_validate_mutex);
++
++/**
++ * loop_global_lock_killable() - take locks for safe loop_validate_file() test
++ *
++ * @lo: struct loop_device
++ * @global: true if @lo is about to bind another "struct loop_device", false otherwise
++ *
++ * Returns 0 on success, -EINTR otherwise.
++ *
++ * Since loop_validate_file() traverses on other "struct loop_device" if
++ * is_loop_device() is true, we need a global lock for serializing concurrent
++ * loop_configure()/loop_change_fd()/__loop_clr_fd() calls.
++ */
++static int loop_global_lock_killable(struct loop_device *lo, bool global)
++{
++ int err;
++
++ if (global) {
++ err = mutex_lock_killable(&loop_validate_mutex);
++ if (err)
++ return err;
++ }
++ err = mutex_lock_killable(&lo->lo_mutex);
++ if (err && global)
++ mutex_unlock(&loop_validate_mutex);
++ return err;
++}
++
++/**
++ * loop_global_unlock() - release locks taken by loop_global_lock_killable()
++ *
++ * @lo: struct loop_device
++ * @global: true if @lo was about to bind another "struct loop_device", false otherwise
++ */
++static void loop_global_unlock(struct loop_device *lo, bool global)
++{
++ mutex_unlock(&lo->lo_mutex);
++ if (global)
++ mutex_unlock(&loop_validate_mutex);
++}
+
+ static int max_part;
+ static int part_shift;
+@@ -676,13 +717,15 @@ static int loop_validate_file(struct file *file, struct block_device *bdev)
+ while (is_loop_device(f)) {
+ struct loop_device *l;
+
++ lockdep_assert_held(&loop_validate_mutex);
+ if (f->f_mapping->host->i_rdev == bdev->bd_dev)
+ return -EBADF;
+
+ l = I_BDEV(f->f_mapping->host)->bd_disk->private_data;
+- if (l->lo_state != Lo_bound) {
++ if (l->lo_state != Lo_bound)
+ return -EINVAL;
+- }
++ /* Order wrt setting lo->lo_backing_file in loop_configure(). */
++ rmb();
+ f = l->lo_backing_file;
+ }
+ if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
+@@ -701,13 +744,18 @@ static int loop_validate_file(struct file *file, struct block_device *bdev)
+ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev,
+ unsigned int arg)
+ {
+- struct file *file = NULL, *old_file;
+- int error;
+- bool partscan;
++ struct file *file = fget(arg);
++ struct file *old_file;
++ int error;
++ bool partscan;
++ bool is_loop;
+
+- error = mutex_lock_killable(&lo->lo_mutex);
++ if (!file)
++ return -EBADF;
++ is_loop = is_loop_device(file);
++ error = loop_global_lock_killable(lo, is_loop);
+ if (error)
+- return error;
++ goto out_putf;
+ error = -ENXIO;
+ if (lo->lo_state != Lo_bound)
+ goto out_err;
+@@ -717,11 +765,6 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev,
+ if (!(lo->lo_flags & LO_FLAGS_READ_ONLY))
+ goto out_err;
+
+- error = -EBADF;
+- file = fget(arg);
+- if (!file)
+- goto out_err;
+-
+ error = loop_validate_file(file, bdev);
+ if (error)
+ goto out_err;
+@@ -744,7 +787,16 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev,
+ loop_update_dio(lo);
+ blk_mq_unfreeze_queue(lo->lo_queue);
+ partscan = lo->lo_flags & LO_FLAGS_PARTSCAN;
+- mutex_unlock(&lo->lo_mutex);
++ loop_global_unlock(lo, is_loop);
++
++ /*
++ * Flush loop_validate_file() before fput(), for l->lo_backing_file
++ * might be pointing at old_file which might be the last reference.
++ */
++ if (!is_loop) {
++ mutex_lock(&loop_validate_mutex);
++ mutex_unlock(&loop_validate_mutex);
++ }
+ /*
+ * We must drop file reference outside of lo_mutex as dropping
+ * the file ref can take bd_mutex which creates circular locking
+@@ -756,9 +808,9 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev,
+ return 0;
+
+ out_err:
+- mutex_unlock(&lo->lo_mutex);
+- if (file)
+- fput(file);
++ loop_global_unlock(lo, is_loop);
++out_putf:
++ fput(file);
+ return error;
+ }
+
+@@ -1067,22 +1119,22 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
+ struct block_device *bdev,
+ const struct loop_config *config)
+ {
+- struct file *file;
+- struct inode *inode;
++ struct file *file = fget(config->fd);
++ struct inode *inode;
+ struct address_space *mapping;
+- int error;
+- loff_t size;
+- bool partscan;
+- unsigned short bsize;
++ int error;
++ loff_t size;
++ bool partscan;
++ unsigned short bsize;
++ bool is_loop;
++
++ if (!file)
++ return -EBADF;
++ is_loop = is_loop_device(file);
+
+ /* This is safe, since we have a reference from open(). */
+ __module_get(THIS_MODULE);
+
+- error = -EBADF;
+- file = fget(config->fd);
+- if (!file)
+- goto out;
+-
+ /*
+ * If we don't hold exclusive handle for the device, upgrade to it
+ * here to avoid changing device under exclusive owner.
+@@ -1093,7 +1145,7 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
+ goto out_putf;
+ }
+
+- error = mutex_lock_killable(&lo->lo_mutex);
++ error = loop_global_lock_killable(lo, is_loop);
+ if (error)
+ goto out_bdev;
+
+@@ -1162,6 +1214,9 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
+ size = get_loop_size(lo, file);
+ loop_set_size(lo, size);
+
++ /* Order wrt reading lo_state in loop_validate_file(). */
++ wmb();
++
+ lo->lo_state = Lo_bound;
+ if (part_shift)
+ lo->lo_flags |= LO_FLAGS_PARTSCAN;
+@@ -1173,7 +1228,7 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
+ * put /dev/loopXX inode. Later in __loop_clr_fd() we bdput(bdev).
+ */
+ bdgrab(bdev);
+- mutex_unlock(&lo->lo_mutex);
++ loop_global_unlock(lo, is_loop);
+ if (partscan)
+ loop_reread_partitions(lo, bdev);
+ if (!(mode & FMODE_EXCL))
+@@ -1181,13 +1236,12 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
+ return 0;
+
+ out_unlock:
+- mutex_unlock(&lo->lo_mutex);
++ loop_global_unlock(lo, is_loop);
+ out_bdev:
+ if (!(mode & FMODE_EXCL))
+ bd_abort_claiming(bdev, loop_configure);
+ out_putf:
+ fput(file);
+-out:
+ /* This is safe: open() is still holding a reference. */
+ module_put(THIS_MODULE);
+ return error;
+@@ -1202,6 +1256,18 @@ static int __loop_clr_fd(struct loop_device *lo, bool release)
+ bool partscan = false;
+ int lo_number;
+
++ /*
++ * Flush loop_configure() and loop_change_fd(). It is acceptable for
++ * loop_validate_file() to succeed, for actual clear operation has not
++ * started yet.
++ */
++ mutex_lock(&loop_validate_mutex);
++ mutex_unlock(&loop_validate_mutex);
++ /*
++ * loop_validate_file() now fails because l->lo_state != Lo_bound
++ * became visible.
++ */
++
+ mutex_lock(&lo->lo_mutex);
+ if (WARN_ON_ONCE(lo->lo_state != Lo_rundown)) {
+ err = -ENXIO;
+--
+2.30.2
+
--- /dev/null
+From b06b38f1ea0e2bc1e1fb672827ae24a840aebd0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jul 2021 07:01:11 +0200
+Subject: mac80211: fix enabling 4-address mode on a sta vif after assoc
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit a5d3cbdb09ff1f52cbe040932e06c8b9915c6dad ]
+
+Notify the driver about the 4-address mode change and also send a nulldata
+packet to the AP to notify it about the change
+
+Fixes: 1ff4e8f2dec8 ("mac80211: notify the driver when a sta uses 4-address mode")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20210702050111.47546-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/cfg.c | 19 +++++++++++++++++++
+ net/mac80211/ieee80211_i.h | 2 ++
+ net/mac80211/mlme.c | 4 ++--
+ 3 files changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 7a99892e5aba..9f1443459852 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -152,6 +152,8 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
+ struct vif_params *params)
+ {
+ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++ struct ieee80211_local *local = sdata->local;
++ struct sta_info *sta;
+ int ret;
+
+ ret = ieee80211_if_change_type(sdata, type);
+@@ -162,7 +164,24 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
+ RCU_INIT_POINTER(sdata->u.vlan.sta, NULL);
+ ieee80211_check_fast_rx_iface(sdata);
+ } else if (type == NL80211_IFTYPE_STATION && params->use_4addr >= 0) {
++ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
++
++ if (params->use_4addr == ifmgd->use_4addr)
++ return 0;
++
+ sdata->u.mgd.use_4addr = params->use_4addr;
++ if (!ifmgd->associated)
++ return 0;
++
++ mutex_lock(&local->sta_mtx);
++ sta = sta_info_get(sdata, ifmgd->bssid);
++ if (sta)
++ drv_sta_set_4addr(local, sdata, &sta->sta,
++ params->use_4addr);
++ mutex_unlock(&local->sta_mtx);
++
++ if (params->use_4addr)
++ ieee80211_send_4addr_nullfunc(local, sdata);
+ }
+
+ if (sdata->vif.type == NL80211_IFTYPE_MONITOR) {
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 648696b49f89..1e1d2e72de4a 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2045,6 +2045,8 @@ void ieee80211_dynamic_ps_timer(struct timer_list *t);
+ void ieee80211_send_nullfunc(struct ieee80211_local *local,
+ struct ieee80211_sub_if_data *sdata,
+ bool powersave);
++void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
++ struct ieee80211_sub_if_data *sdata);
+ void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
+ struct ieee80211_hdr *hdr, bool ack, u16 tx_time);
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index b1c44fa63a06..9bed6464c5bd 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1115,8 +1115,8 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
+ ieee80211_tx_skb(sdata, skb);
+ }
+
+-static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
+- struct ieee80211_sub_if_data *sdata)
++void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
++ struct ieee80211_sub_if_data *sdata)
+ {
+ struct sk_buff *skb;
+ struct ieee80211_hdr *nullfunc;
+--
+2.30.2
+
--- /dev/null
+From df288123e2debce17e266f291cf07134d8c357f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 18:36:09 +0800
+Subject: mlx4: Fix missing error code in mlx4_load_one()
+
+From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+
+[ Upstream commit 7e4960b3d66d7248b23de3251118147812b42da2 ]
+
+The error code is missing in this code scenario, add the error code
+'-EINVAL' to the return value 'err'.
+
+Eliminate the follow smatch warning:
+
+drivers/net/ethernet/mellanox/mlx4/main.c:3538 mlx4_load_one() warn:
+missing error code 'err'.
+
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Fixes: 7ae0e400cd93 ("net/mlx4_core: Flexible (asymmetric) allocation of EQs and MSI-X vectors for PF/VFs")
+Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index 00c84656b2e7..28ac4693da3c 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -3535,6 +3535,7 @@ slave_start:
+
+ if (!SRIOV_VALID_STATE(dev->flags)) {
+ mlx4_err(dev, "Invalid SRIOV state\n");
++ err = -EINVAL;
+ goto err_close;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From 091898ed8648a9262b997d12d0d9f202a35e4af3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 16:05:51 +0300
+Subject: net: dsa: mv88e6xxx: silently accept the deletion of VID 0 too
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit c92c74131a84b508aa8f079a25d7bbe10748449e ]
+
+The blamed commit modified the driver to accept the addition of VID 0
+without doing anything, but deleting that VID still fails:
+
+[ 32.080780] mv88e6085 d0032004.mdio-mii:10 lan8: failed to kill vid 0081/0
+
+Modify mv88e6xxx_port_vlan_leave() to do the same thing as the addition.
+
+Fixes: b8b79c414eca ("net: dsa: mv88e6xxx: Fix adding vlan 0")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index beb41572d04e..272b0535d946 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2155,7 +2155,7 @@ static int mv88e6xxx_port_vlan_leave(struct mv88e6xxx_chip *chip,
+ int i, err;
+
+ if (!vid)
+- return -EOPNOTSUPP;
++ return 0;
+
+ err = mv88e6xxx_vtu_get(chip, vid, &vlan);
+ if (err)
+--
+2.30.2
+
--- /dev/null
+From d8daab303926bc7009fe012b8b9d4223cddeee1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jul 2021 00:11:59 +0300
+Subject: net: llc: fix skb_over_panic
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit c7c9d2102c9c098916ab9e0ab248006107d00d6c ]
+
+Syzbot reported skb_over_panic() in llc_pdu_init_as_xid_cmd(). The
+problem was in wrong LCC header manipulations.
+
+Syzbot's reproducer tries to send XID packet. llc_ui_sendmsg() is
+doing following steps:
+
+ 1. skb allocation with size = len + header size
+ len is passed from userpace and header size
+ is 3 since addr->sllc_xid is set.
+
+ 2. skb_reserve() for header_len = 3
+ 3. filling all other space with memcpy_from_msg()
+
+Ok, at this moment we have fully loaded skb, only headers needs to be
+filled.
+
+Then code comes to llc_sap_action_send_xid_c(). This function pushes 3
+bytes for LLC PDU header and initializes it. Then comes
+llc_pdu_init_as_xid_cmd(). It initalizes next 3 bytes *AFTER* LLC PDU
+header and call skb_push(skb, 3). This looks wrong for 2 reasons:
+
+ 1. Bytes rigth after LLC header are user data, so this function
+ was overwriting payload.
+
+ 2. skb_push(skb, 3) call can cause skb_over_panic() since
+ all free space was filled in llc_ui_sendmsg(). (This can
+ happen is user passed 686 len: 686 + 14 (eth header) + 3 (LLC
+ header) = 703. SKB_DATA_ALIGN(703) = 704)
+
+So, in this patch I added 2 new private constansts: LLC_PDU_TYPE_U_XID
+and LLC_PDU_LEN_U_XID. LLC_PDU_LEN_U_XID is used to correctly reserve
+header size to handle LLC + XID case. LLC_PDU_TYPE_U_XID is used by
+llc_pdu_header_init() function to push 6 bytes instead of 3. And finally
+I removed skb_push() call from llc_pdu_init_as_xid_cmd().
+
+This changes should not affect other parts of LLC, since after
+all steps we just transmit buffer.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-and-tested-by: syzbot+5e5a981ad7cc54c4b2b4@syzkaller.appspotmail.com
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/llc_pdu.h | 31 +++++++++++++++++++++++--------
+ net/llc/af_llc.c | 10 +++++++++-
+ net/llc/llc_s_ac.c | 2 +-
+ 3 files changed, 33 insertions(+), 10 deletions(-)
+
+diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h
+index c0f0a13ed818..49aa79c7b278 100644
+--- a/include/net/llc_pdu.h
++++ b/include/net/llc_pdu.h
+@@ -15,9 +15,11 @@
+ #include <linux/if_ether.h>
+
+ /* Lengths of frame formats */
+-#define LLC_PDU_LEN_I 4 /* header and 2 control bytes */
+-#define LLC_PDU_LEN_S 4
+-#define LLC_PDU_LEN_U 3 /* header and 1 control byte */
++#define LLC_PDU_LEN_I 4 /* header and 2 control bytes */
++#define LLC_PDU_LEN_S 4
++#define LLC_PDU_LEN_U 3 /* header and 1 control byte */
++/* header and 1 control byte and XID info */
++#define LLC_PDU_LEN_U_XID (LLC_PDU_LEN_U + sizeof(struct llc_xid_info))
+ /* Known SAP addresses */
+ #define LLC_GLOBAL_SAP 0xFF
+ #define LLC_NULL_SAP 0x00 /* not network-layer visible */
+@@ -50,9 +52,10 @@
+ #define LLC_PDU_TYPE_U_MASK 0x03 /* 8-bit control field */
+ #define LLC_PDU_TYPE_MASK 0x03
+
+-#define LLC_PDU_TYPE_I 0 /* first bit */
+-#define LLC_PDU_TYPE_S 1 /* first two bits */
+-#define LLC_PDU_TYPE_U 3 /* first two bits */
++#define LLC_PDU_TYPE_I 0 /* first bit */
++#define LLC_PDU_TYPE_S 1 /* first two bits */
++#define LLC_PDU_TYPE_U 3 /* first two bits */
++#define LLC_PDU_TYPE_U_XID 4 /* private type for detecting XID commands */
+
+ #define LLC_PDU_TYPE_IS_I(pdu) \
+ ((!(pdu->ctrl_1 & LLC_PDU_TYPE_I_MASK)) ? 1 : 0)
+@@ -230,9 +233,18 @@ static inline struct llc_pdu_un *llc_pdu_un_hdr(struct sk_buff *skb)
+ static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type,
+ u8 ssap, u8 dsap, u8 cr)
+ {
+- const int hlen = type == LLC_PDU_TYPE_U ? 3 : 4;
++ int hlen = 4; /* default value for I and S types */
+ struct llc_pdu_un *pdu;
+
++ switch (type) {
++ case LLC_PDU_TYPE_U:
++ hlen = 3;
++ break;
++ case LLC_PDU_TYPE_U_XID:
++ hlen = 6;
++ break;
++ }
++
+ skb_push(skb, hlen);
+ skb_reset_network_header(skb);
+ pdu = llc_pdu_un_hdr(skb);
+@@ -374,7 +386,10 @@ static inline void llc_pdu_init_as_xid_cmd(struct sk_buff *skb,
+ xid_info->fmt_id = LLC_XID_FMT_ID; /* 0x81 */
+ xid_info->type = svcs_supported;
+ xid_info->rw = rx_window << 1; /* size of receive window */
+- skb_put(skb, sizeof(struct llc_xid_info));
++
++ /* no need to push/put since llc_pdu_header_init() has already
++ * pushed 3 + 3 bytes
++ */
+ }
+
+ /**
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index 7180979114e4..ac5cadd02cfa 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -98,8 +98,16 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
+ {
+ u8 rc = LLC_PDU_LEN_U;
+
+- if (addr->sllc_test || addr->sllc_xid)
++ if (addr->sllc_test)
+ rc = LLC_PDU_LEN_U;
++ else if (addr->sllc_xid)
++ /* We need to expand header to sizeof(struct llc_xid_info)
++ * since llc_pdu_init_as_xid_cmd() sets 4,5,6 bytes of LLC header
++ * as XID PDU. In llc_ui_sendmsg() we reserved header size and then
++ * filled all other space with user data. If we won't reserve this
++ * bytes, llc_pdu_init_as_xid_cmd() will overwrite user data
++ */
++ rc = LLC_PDU_LEN_U_XID;
+ else if (sk->sk_type == SOCK_STREAM)
+ rc = LLC_PDU_LEN_I;
+ return rc;
+diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c
+index b554f26c68ee..79d1cef8f15a 100644
+--- a/net/llc/llc_s_ac.c
++++ b/net/llc/llc_s_ac.c
+@@ -79,7 +79,7 @@ int llc_sap_action_send_xid_c(struct llc_sap *sap, struct sk_buff *skb)
+ struct llc_sap_state_ev *ev = llc_sap_ev(skb);
+ int rc;
+
+- llc_pdu_header_init(skb, LLC_PDU_TYPE_U, ev->saddr.lsap,
++ llc_pdu_header_init(skb, LLC_PDU_TYPE_U_XID, ev->saddr.lsap,
+ ev->daddr.lsap, LLC_PDU_CMD);
+ llc_pdu_init_as_xid_cmd(skb, LLC_XID_NULL_CLASS_2, 0);
+ rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac);
+--
+2.30.2
+
--- /dev/null
+From 1ee60f00843b2653828d15c31aa3138cd1bb0170 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jun 2021 14:17:07 +0300
+Subject: net/mlx5: E-Switch, handle devcom events only for ports on the same
+ device
+
+From: Roi Dayan <roid@nvidia.com>
+
+[ Upstream commit dd3fddb82780bfa24124834edd90bbc63bd689cc ]
+
+This is the same check as LAG mode checks if to enable lag.
+This will fix adding peer miss rules if lag is not supported
+and even an incorrect rules in socket direct mode.
+
+Also fix the incorrect comment on mlx5_get_next_phys_dev() as flow #1
+doesn't exists.
+
+Fixes: ac004b832128 ("net/mlx5e: E-Switch, Add peer miss rules")
+Signed-off-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Maor Dickman <maord@nvidia.com>
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/dev.c | 5 +----
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 3 +++
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+index ceebfc20f65e..def2156e50ee 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+@@ -500,10 +500,7 @@ static int next_phys_dev(struct device *dev, const void *data)
+ return 1;
+ }
+
+-/* This function is called with two flows:
+- * 1. During initialization of mlx5_core_dev and we don't need to lock it.
+- * 2. During LAG configure stage and caller holds &mlx5_intf_mutex.
+- */
++/* Must be called with intf_mutex held */
+ struct mlx5_core_dev *mlx5_get_next_phys_dev(struct mlx5_core_dev *dev)
+ {
+ struct auxiliary_device *adev;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+index 91571156a89d..b66e12753f37 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+@@ -2351,6 +2351,9 @@ static int mlx5_esw_offloads_devcom_event(int event,
+
+ switch (event) {
+ case ESW_OFFLOADS_DEVCOM_PAIR:
++ if (mlx5_get_next_phys_dev(esw->dev) != peer_esw->dev)
++ break;
++
+ if (mlx5_eswitch_vport_match_metadata_enabled(esw) !=
+ mlx5_eswitch_vport_match_metadata_enabled(peer_esw))
+ break;
+--
+2.30.2
+
--- /dev/null
+From 1ee570fe0021e6bf695c5c05fa8f457c0b2beff1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 17:07:02 +0300
+Subject: net/mlx5: E-Switch, Set destination vport vhca id only when merged
+ eswitch is supported
+
+From: Maor Dickman <maord@nvidia.com>
+
+[ Upstream commit c671972534c6f7fce789ac8156a2bc3bd146f806 ]
+
+Destination vport vhca id is valid flag is set only merged eswitch isn't supported.
+Change destination vport vhca id value to be set also only when merged eswitch
+is supported.
+
+Fixes: e4ad91f23f10 ("net/mlx5e: Split offloaded eswitch TC rules for port mirroring")
+Signed-off-by: Maor Dickman <maord@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+index d18a28a6e9a6..91571156a89d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+@@ -382,10 +382,11 @@ esw_setup_vport_dest(struct mlx5_flow_destination *dest, struct mlx5_flow_act *f
+ {
+ dest[dest_idx].type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
+ dest[dest_idx].vport.num = esw_attr->dests[attr_idx].rep->vport;
+- dest[dest_idx].vport.vhca_id =
+- MLX5_CAP_GEN(esw_attr->dests[attr_idx].mdev, vhca_id);
+- if (MLX5_CAP_ESW(esw->dev, merged_eswitch))
++ if (MLX5_CAP_ESW(esw->dev, merged_eswitch)) {
++ dest[dest_idx].vport.vhca_id =
++ MLX5_CAP_GEN(esw_attr->dests[attr_idx].mdev, vhca_id);
+ dest[dest_idx].vport.flags |= MLX5_FLOW_DEST_VPORT_VHCA_ID;
++ }
+ if (esw_attr->dests[attr_idx].flags & MLX5_ESW_DEST_ENCAP) {
+ if (pkt_reformat) {
+ flow_act->action |= MLX5_FLOW_CONTEXT_ACTION_PACKET_REFORMAT;
+--
+2.30.2
+
--- /dev/null
+From a4f73c16f44be72a3577dd9b6f4d5ca33d9376a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 09:20:14 +0300
+Subject: net/mlx5: Fix flow table chaining
+
+From: Maor Gottlieb <maorg@nvidia.com>
+
+[ Upstream commit 8b54874ef1617185048029a3083d510569e93751 ]
+
+Fix a bug when flow table is created in priority that already
+has other flow tables as shown in the below diagram.
+If the new flow table (FT-B) has the lowest level in the priority,
+we need to connect the flow tables from the previous priority (p0)
+to this new table. In addition when this flow table is destroyed
+(FT-B), we need to connect the flow tables from the previous
+priority (p0) to the next level flow table (FT-C) in the same
+priority of the destroyed table (if exists).
+
+ ---------
+ |root_ns|
+ ---------
+ |
+ --------------------------------
+ | | |
+ ---------- ---------- ---------
+ |p(prio)-x| | p-y | | p-n |
+ ---------- ---------- ---------
+ | |
+ ---------------- ------------------
+ |ns(e.g bypass)| |ns(e.g. kernel) |
+ ---------------- ------------------
+ | | |
+ ------- ------ ----
+ | p0 | | p1 | |p2|
+ ------- ------ ----
+ | | \
+ -------- ------- ------
+ | FT-A | |FT-B | |FT-C|
+ -------- ------- ------
+
+Fixes: f90edfd279f3 ("net/mlx5_core: Connect flow tables")
+Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index f74d2c834037..48fc242e066f 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -1024,17 +1024,19 @@ static int connect_fwd_rules(struct mlx5_core_dev *dev,
+ static int connect_flow_table(struct mlx5_core_dev *dev, struct mlx5_flow_table *ft,
+ struct fs_prio *prio)
+ {
+- struct mlx5_flow_table *next_ft;
++ struct mlx5_flow_table *next_ft, *first_ft;
+ int err = 0;
+
+ /* Connect_prev_fts and update_root_ft_create are mutually exclusive */
+
+- if (list_empty(&prio->node.children)) {
++ first_ft = list_first_entry_or_null(&prio->node.children,
++ struct mlx5_flow_table, node.list);
++ if (!first_ft || first_ft->level > ft->level) {
+ err = connect_prev_fts(dev, ft, prio);
+ if (err)
+ return err;
+
+- next_ft = find_next_chained_ft(prio);
++ next_ft = first_ft ? first_ft : find_next_chained_ft(prio);
+ err = connect_fwd_rules(dev, ft, next_ft);
+ if (err)
+ return err;
+@@ -2109,7 +2111,7 @@ static int disconnect_flow_table(struct mlx5_flow_table *ft)
+ node.list) == ft))
+ return 0;
+
+- next_ft = find_next_chained_ft(prio);
++ next_ft = find_next_ft(ft);
+ err = connect_fwd_rules(dev, next_ft, ft);
+ if (err)
+ return err;
+--
+2.30.2
+
--- /dev/null
+From 2842ac999696a610c981afc65f4ade679cf47524 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 11:06:37 +0800
+Subject: net/mlx5: Fix mlx5_vport_tbl_attr chain from u16 to u32
+
+From: Chris Mi <cmi@nvidia.com>
+
+[ Upstream commit 740452e09cf5fc489ce60831cf11abef117b5d26 ]
+
+The offending refactor commit uses u16 chain wrongly. Actually, it
+should be u32.
+
+Fixes: c620b772152b ("net/mlx5: Refactor tc flow attributes structure")
+CC: Ariel Levkovich <lariel@nvidia.com>
+Signed-off-by: Chris Mi <cmi@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+index 64ccb2bc0b58..e0f6f75fd9d6 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+@@ -629,7 +629,7 @@ struct esw_vport_tbl_namespace {
+ };
+
+ struct mlx5_vport_tbl_attr {
+- u16 chain;
++ u32 chain;
+ u16 prio;
+ u16 vport;
+ const struct esw_vport_tbl_namespace *vport_ns;
+--
+2.30.2
+
--- /dev/null
+From ce19066721f4c0d3c33f08afe63ac808e39ae8f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jun 2021 19:11:03 +0300
+Subject: net/mlx5: Unload device upon firmware fatal error
+
+From: Aya Levin <ayal@nvidia.com>
+
+[ Upstream commit 7f331bf0f060c2727e36d64f9b098b4ee5f3dfad ]
+
+When fw_fatal reporter reports an error, the firmware in not responding.
+Unload the device to ensure that the driver closes all its resources,
+even if recovery is not due (user disabled auto-recovery or reporter is
+in grace period). On successful recovery the device is loaded back up.
+
+Fixes: b3bd076f7501 ("net/mlx5: Report devlink health on FW fatal issues")
+Signed-off-by: Aya Levin <ayal@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/health.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
+index 9ff163c5bcde..9abeb80ffa31 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
+@@ -626,8 +626,16 @@ static void mlx5_fw_fatal_reporter_err_work(struct work_struct *work)
+ }
+ fw_reporter_ctx.err_synd = health->synd;
+ fw_reporter_ctx.miss_counter = health->miss_counter;
+- devlink_health_report(health->fw_fatal_reporter,
+- "FW fatal error reported", &fw_reporter_ctx);
++ if (devlink_health_report(health->fw_fatal_reporter,
++ "FW fatal error reported", &fw_reporter_ctx) == -ECANCELED) {
++ /* If recovery wasn't performed, due to grace period,
++ * unload the driver. This ensures that the driver
++ * closes all its resources and it is not subjected to
++ * requests from the kernel.
++ */
++ mlx5_core_err(dev, "Driver is in error state. Unloading\n");
++ mlx5_unload_one(dev);
++ }
+ }
+
+ static const struct devlink_health_reporter_ops mlx5_fw_fatal_reporter_ops = {
+--
+2.30.2
+
--- /dev/null
+From 16394c1f921e186045dcd73d5aa0043443c20b4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jun 2021 13:33:31 +0300
+Subject: net/mlx5e: Add NETIF_F_HW_TC to hw_features when HTB offload is
+ available
+
+From: Maxim Mikityanskiy <maximmi@nvidia.com>
+
+[ Upstream commit 9841d58f3550d11c6181424427e8ad8c9c80f1b6 ]
+
+If a feature flag is only present in features, but not in hw_features,
+the user can't reset it. Although hw_features may contain NETIF_F_HW_TC
+by the point where the driver checks whether HTB offload is supported,
+this flag is controlled by another condition that may not hold. Set it
+explicitly to make sure the user can disable it.
+
+Fixes: 214baf22870c ("net/mlx5e: Support HTB offload")
+Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 86a27b0b42cb..d0d9acb17253 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -4866,6 +4866,9 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
+ if (MLX5_CAP_ETH(mdev, scatter_fcs))
+ netdev->hw_features |= NETIF_F_RXFCS;
+
++ if (mlx5_qos_is_supported(mdev))
++ netdev->hw_features |= NETIF_F_HW_TC;
++
+ netdev->features = netdev->hw_features;
+
+ /* Defaults */
+@@ -4886,8 +4889,6 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
+ netdev->hw_features |= NETIF_F_NTUPLE;
+ #endif
+ }
+- if (mlx5_qos_is_supported(mdev))
+- netdev->features |= NETIF_F_HW_TC;
+
+ netdev->features |= NETIF_F_HIGHDMA;
+ netdev->features |= NETIF_F_HW_VLAN_STAG_FILTER;
+--
+2.30.2
+
--- /dev/null
+From 192caa212e56bcf4aa6f39ecb848dc41223f10c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jul 2021 15:24:58 +0300
+Subject: net/mlx5e: Disable Rx ntuple offload for uplink representor
+
+From: Maor Dickman <maord@nvidia.com>
+
+[ Upstream commit 90b22b9bcd242a3ba238f2c6f7eab771799001f8 ]
+
+Rx ntuple offload is not supported in switchdev mode.
+Tryng to enable it cause kernel panic.
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000008
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 80000001065a5067 P4D 80000001065a5067 PUD 106594067 PMD 0
+ Oops: 0000 [#1] SMP PTI
+ CPU: 7 PID: 1089 Comm: ethtool Not tainted 5.13.0-rc7_for_upstream_min_debug_2021_06_23_16_44 #1
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ RIP: 0010:mlx5e_arfs_enable+0x70/0xd0 [mlx5_core]
+ Code: 44 24 10 00 00 00 00 48 c7 44 24 18 00 00 00 00 49 63 c4 48 89 e2 44 89 e6 48 69 c0 20 08 00 00 48 89 ef 48 03 85 68 ac 00 00 <48> 8b 40 08 48 89 44 24 08 e8 d2 aa fd ff 48 83 05 82 96 18 00 01
+ RSP: 0018:ffff8881047679e0 EFLAGS: 00010246
+ RAX: 0000000000000000 RBX: 0000004000000000 RCX: 0000004000000000
+ RDX: ffff8881047679e0 RSI: 0000000000000000 RDI: ffff888115100880
+ RBP: ffff888115100880 R08: ffffffffa00f6cb0 R09: ffff888104767a18
+ R10: ffff8881151000a0 R11: ffff888109479540 R12: 0000000000000000
+ R13: ffff888104767bb8 R14: ffff888115100000 R15: ffff8881151000a0
+ FS: 00007f41a64ab740(0000) GS:ffff8882f5dc0000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000008 CR3: 0000000104cbc005 CR4: 0000000000370ea0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ set_feature_arfs+0x1e/0x40 [mlx5_core]
+ mlx5e_handle_feature+0x43/0xa0 [mlx5_core]
+ mlx5e_set_features+0x139/0x1b0 [mlx5_core]
+ __netdev_update_features+0x2b3/0xaf0
+ ethnl_set_features+0x176/0x3a0
+ ? __nla_parse+0x22/0x30
+ genl_family_rcv_msg_doit+0xe2/0x140
+ genl_rcv_msg+0xde/0x1d0
+ ? features_reply_size+0xe0/0xe0
+ ? genl_get_cmd+0xd0/0xd0
+ netlink_rcv_skb+0x4e/0xf0
+ genl_rcv+0x24/0x40
+ netlink_unicast+0x1f6/0x2b0
+ netlink_sendmsg+0x225/0x450
+ sock_sendmsg+0x33/0x40
+ __sys_sendto+0xd4/0x120
+ ? __sys_recvmsg+0x4e/0x90
+ ? exc_page_fault+0x219/0x740
+ __x64_sys_sendto+0x25/0x30
+ do_syscall_64+0x3f/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+ RIP: 0033:0x7f41a65b0cba
+ Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 c3 0f 1f 44 00 00 55 48 83 ec 30 44 89 4c
+ RSP: 002b:00007ffd8d688358 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
+ RAX: ffffffffffffffda RBX: 00000000010f42a0 RCX: 00007f41a65b0cba
+ RDX: 0000000000000058 RSI: 00000000010f43b0 RDI: 0000000000000003
+ RBP: 000000000047ae60 R08: 00007f41a667c000 R09: 000000000000000c
+ R10: 0000000000000000 R11: 0000000000000246 R12: 00000000010f4340
+ R13: 00000000010f4350 R14: 00007ffd8d688400 R15: 00000000010f42a0
+ Modules linked in: mlx5_vdpa vhost_iotlb vdpa xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad ib_ipoib rdma_cm iw_cm ib_cm mlx5_ib ib_uverbs ib_core overlay mlx5_core ptp pps_core fuse
+ CR2: 0000000000000008
+ ---[ end trace c66523f2aba94b43 ]---
+
+Fixes: 7a9fb35e8c3a ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode")
+Signed-off-by: Maor Dickman <maord@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 29 +++++++++++++------
+ 1 file changed, 20 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index d26b8ed51195..86a27b0b42cb 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3825,6 +3825,24 @@ int mlx5e_set_features(struct net_device *netdev, netdev_features_t features)
+ return 0;
+ }
+
++static netdev_features_t mlx5e_fix_uplink_rep_features(struct net_device *netdev,
++ netdev_features_t features)
++{
++ features &= ~NETIF_F_HW_TLS_RX;
++ if (netdev->features & NETIF_F_HW_TLS_RX)
++ netdev_warn(netdev, "Disabling hw_tls_rx, not supported in switchdev mode\n");
++
++ features &= ~NETIF_F_HW_TLS_TX;
++ if (netdev->features & NETIF_F_HW_TLS_TX)
++ netdev_warn(netdev, "Disabling hw_tls_tx, not supported in switchdev mode\n");
++
++ features &= ~NETIF_F_NTUPLE;
++ if (netdev->features & NETIF_F_NTUPLE)
++ netdev_warn(netdev, "Disabling ntuple, not supported in switchdev mode\n");
++
++ return features;
++}
++
+ static netdev_features_t mlx5e_fix_features(struct net_device *netdev,
+ netdev_features_t features)
+ {
+@@ -3856,15 +3874,8 @@ static netdev_features_t mlx5e_fix_features(struct net_device *netdev,
+ netdev_warn(netdev, "Disabling rxhash, not supported when CQE compress is active\n");
+ }
+
+- if (mlx5e_is_uplink_rep(priv)) {
+- features &= ~NETIF_F_HW_TLS_RX;
+- if (netdev->features & NETIF_F_HW_TLS_RX)
+- netdev_warn(netdev, "Disabling hw_tls_rx, not supported in switchdev mode\n");
+-
+- features &= ~NETIF_F_HW_TLS_TX;
+- if (netdev->features & NETIF_F_HW_TLS_TX)
+- netdev_warn(netdev, "Disabling hw_tls_tx, not supported in switchdev mode\n");
+- }
++ if (mlx5e_is_uplink_rep(priv))
++ features = mlx5e_fix_uplink_rep_features(netdev, features);
+
+ mutex_unlock(&priv->state_lock);
+
+--
+2.30.2
+
--- /dev/null
+From f5add50d0963ba6c34ccf93dfaf56751e68ae0bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 15:16:26 +0300
+Subject: net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev()
+
+From: Dima Chumak <dchumak@nvidia.com>
+
+[ Upstream commit b1c2f6312c5005c928a72e668bf305a589d828d4 ]
+
+The result of __dev_get_by_index() is not checked for NULL and then gets
+dereferenced immediately.
+
+Also, __dev_get_by_index() must be called while holding either RTNL lock
+or @dev_base_lock, which isn't satisfied by mlx5e_hairpin_get_mdev() or
+its callers. This makes the underlying hlist_for_each_entry() loop not
+safe, and can have adverse effects in itself.
+
+Fix by using dev_get_by_index() and handling nullptr return value when
+ifindex device is not found. Update mlx5e_hairpin_get_mdev() callers to
+check for possible PTR_ERR() result.
+
+Fixes: 77ab67b7f0f9 ("net/mlx5e: Basic setup of hairpin object")
+Addresses-Coverity: ("Dereference null return value")
+Signed-off-by: Dima Chumak <dchumak@nvidia.com>
+Reviewed-by: Vlad Buslov <vladbu@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/en_tc.c | 33 +++++++++++++++++--
+ 1 file changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index d4b0f270b6bb..47bd20ad8108 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -424,12 +424,32 @@ static void mlx5e_detach_mod_hdr(struct mlx5e_priv *priv,
+ static
+ struct mlx5_core_dev *mlx5e_hairpin_get_mdev(struct net *net, int ifindex)
+ {
++ struct mlx5_core_dev *mdev;
+ struct net_device *netdev;
+ struct mlx5e_priv *priv;
+
+- netdev = __dev_get_by_index(net, ifindex);
++ netdev = dev_get_by_index(net, ifindex);
++ if (!netdev)
++ return ERR_PTR(-ENODEV);
++
+ priv = netdev_priv(netdev);
+- return priv->mdev;
++ mdev = priv->mdev;
++ dev_put(netdev);
++
++ /* Mirred tc action holds a refcount on the ifindex net_device (see
++ * net/sched/act_mirred.c:tcf_mirred_get_dev). So, it's okay to continue using mdev
++ * after dev_put(netdev), while we're in the context of adding a tc flow.
++ *
++ * The mdev pointer corresponds to the peer/out net_device of a hairpin. It is then
++ * stored in a hairpin object, which exists until all flows, that refer to it, get
++ * removed.
++ *
++ * On the other hand, after a hairpin object has been created, the peer net_device may
++ * be removed/unbound while there are still some hairpin flows that are using it. This
++ * case is handled by mlx5e_tc_hairpin_update_dead_peer, which is hooked to
++ * NETDEV_UNREGISTER event of the peer net_device.
++ */
++ return mdev;
+ }
+
+ static int mlx5e_hairpin_create_transport(struct mlx5e_hairpin *hp)
+@@ -638,6 +658,10 @@ mlx5e_hairpin_create(struct mlx5e_priv *priv, struct mlx5_hairpin_params *params
+
+ func_mdev = priv->mdev;
+ peer_mdev = mlx5e_hairpin_get_mdev(dev_net(priv->netdev), peer_ifindex);
++ if (IS_ERR(peer_mdev)) {
++ err = PTR_ERR(peer_mdev);
++ goto create_pair_err;
++ }
+
+ pair = mlx5_core_hairpin_create(func_mdev, peer_mdev, params);
+ if (IS_ERR(pair)) {
+@@ -776,6 +800,11 @@ static int mlx5e_hairpin_flow_add(struct mlx5e_priv *priv,
+ int err;
+
+ peer_mdev = mlx5e_hairpin_get_mdev(dev_net(priv->netdev), peer_ifindex);
++ if (IS_ERR(peer_mdev)) {
++ NL_SET_ERR_MSG_MOD(extack, "invalid ifindex of mirred device");
++ return PTR_ERR(peer_mdev);
++ }
++
+ if (!MLX5_CAP_GEN(priv->mdev, hairpin) || !MLX5_CAP_GEN(peer_mdev, hairpin)) {
+ NL_SET_ERR_MSG_MOD(extack, "hairpin is not supported");
+ return -EOPNOTSUPP;
+--
+2.30.2
+
--- /dev/null
+From cf46a8d652afa87428ff3d0365daeff7c1fc55da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 10:24:17 +0300
+Subject: net/mlx5e: Fix page allocation failure for ptp-RQ over SF
+
+From: Aya Levin <ayal@nvidia.com>
+
+[ Upstream commit 678b1ae1af4aef488fcc42baa663e737b9a531ba ]
+
+Set the correct pci-device pointer to the ptp-RQ. This allows access to
+dma_mask and avoids allocation request with wrong pci-device.
+
+Fixes: a099da8ffcf6 ("net/mlx5e: Add RQ to PTP channel")
+Signed-off-by: Aya Levin <ayal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
+index 778e229310a9..0f6b3231ca1d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
+@@ -494,7 +494,7 @@ static int mlx5e_init_ptp_rq(struct mlx5e_ptp *c, struct mlx5e_params *params,
+ int err;
+
+ rq->wq_type = params->rq_wq_type;
+- rq->pdev = mdev->device;
++ rq->pdev = c->pdev;
+ rq->netdev = priv->netdev;
+ rq->priv = priv;
+ rq->clock = &mdev->clock;
+--
+2.30.2
+
--- /dev/null
+From 9872b1b1cfac02b15d2a6ffed783aaa8fc3aec1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jun 2021 18:04:07 +0300
+Subject: net/mlx5e: Fix page allocation failure for trap-RQ over SF
+
+From: Aya Levin <ayal@nvidia.com>
+
+[ Upstream commit 497008e783452a2ec45c7ec5835cfe6950dcb097 ]
+
+Set the correct device pointer to the trap-RQ, to allow access to
+dma_mask and avoid allocation request with the wrong pci-dev.
+
+WARNING: CPU: 1 PID: 12005 at kernel/dma/mapping.c:151 dma_map_page_attrs+0x139/0x1c0
+...
+all Trace:
+<IRQ>
+? __page_pool_alloc_pages_slow+0x5a/0x210
+mlx5e_post_rx_wqes+0x258/0x400 [mlx5_core]
+mlx5e_trap_napi_poll+0x44/0xc0 [mlx5_core]
+__napi_poll+0x24/0x150
+net_rx_action+0x22b/0x280
+__do_softirq+0xc7/0x27e
+do_softirq+0x61/0x80
+</IRQ>
+__local_bh_enable_ip+0x4b/0x50
+mlx5e_handle_action_trap+0x2dd/0x4d0 [mlx5_core]
+blocking_notifier_call_chain+0x5a/0x80
+mlx5_devlink_trap_action_set+0x8b/0x100 [mlx5_core]
+
+Fixes: 5543e989fe5e ("net/mlx5e: Add trap entity to ETH driver")
+Signed-off-by: Aya Levin <ayal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/trap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c b/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c
+index 86ab4e864fe6..7f94508594fb 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c
+@@ -37,7 +37,7 @@ static void mlx5e_init_trap_rq(struct mlx5e_trap *t, struct mlx5e_params *params
+ struct mlx5e_priv *priv = t->priv;
+
+ rq->wq_type = params->rq_wq_type;
+- rq->pdev = mdev->device;
++ rq->pdev = t->pdev;
+ rq->netdev = priv->netdev;
+ rq->priv = priv;
+ rq->clock = &mdev->clock;
+--
+2.30.2
+
--- /dev/null
+From c36d07fd753e4acf3b94b628bb3e4833f7a4b571 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jun 2021 13:45:05 +0300
+Subject: net/mlx5e: RX, Avoid possible data corruption when relaxed ordering
+ and LRO combined
+
+From: Tariq Toukan <tariqt@nvidia.com>
+
+[ Upstream commit e2351e517068718724f1d3b4010e2a41ec91fa76 ]
+
+When HW aggregates packets for an LRO session, it writes the payload
+of two consecutive packets of a flow contiguously, so that they usually
+share a cacheline.
+
+The first byte of a packet's payload is written immediately after
+the last byte of the preceding packet.
+In this flow, there are two consecutive write requests to the shared
+cacheline:
+1. Regular write for the earlier packet.
+2. Read-modify-write for the following packet.
+
+In case of relaxed-ordering on, these two writes might be re-ordered.
+Using the end padding optimization (to avoid partial write for the last
+cacheline of a packet) becomes problematic if the two writes occur
+out-of-order, as the padding would overwrite payload that belongs to
+the following packet, causing data corruption.
+
+Avoid this by disabling the end padding optimization when both
+LRO and relaxed-ordering are enabled.
+
+Fixes: 17347d5430c4 ("net/mlx5e: Add support for PCI relaxed ordering")
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
+index f410c1268422..133eb13facfd 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
+@@ -471,6 +471,15 @@ static void mlx5e_build_rx_cq_param(struct mlx5_core_dev *mdev,
+ param->cq_period_mode = params->rx_cq_moderation.cq_period_mode;
+ }
+
++static u8 rq_end_pad_mode(struct mlx5_core_dev *mdev, struct mlx5e_params *params)
++{
++ bool ro = pcie_relaxed_ordering_enabled(mdev->pdev) &&
++ MLX5_CAP_GEN(mdev, relaxed_ordering_write);
++
++ return ro && params->lro_en ?
++ MLX5_WQ_END_PAD_MODE_NONE : MLX5_WQ_END_PAD_MODE_ALIGN;
++}
++
+ int mlx5e_build_rq_param(struct mlx5_core_dev *mdev,
+ struct mlx5e_params *params,
+ struct mlx5e_xsk_param *xsk,
+@@ -508,7 +517,7 @@ int mlx5e_build_rq_param(struct mlx5_core_dev *mdev,
+ }
+
+ MLX5_SET(wq, wq, wq_type, params->rq_wq_type);
+- MLX5_SET(wq, wq, end_padding_mode, MLX5_WQ_END_PAD_MODE_ALIGN);
++ MLX5_SET(wq, wq, end_padding_mode, rq_end_pad_mode(mdev, params));
+ MLX5_SET(wq, wq, log_wq_stride,
+ mlx5e_get_rqwq_log_stride(params->rq_wq_type, ndsegs));
+ MLX5_SET(wq, wq, pd, mdev->mlx5e_res.hw_objs.pdn);
+--
+2.30.2
+
--- /dev/null
+From 36ae64557a2a273c3a85403cc344c72d4e50b815 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 21:59:27 +0800
+Subject: net: phy: broadcom: re-add check for PHY_BRCM_DIS_TXCRXC_NOENRGY on
+ the BCM54811 PHY
+
+From: Kevin Lo <kevlo@kevlo.org>
+
+[ Upstream commit ad4e1e48a6291f7fb53fbef38ca264966ffd65c9 ]
+
+Restore PHY_ID_BCM54811 accidently removed by commit 5d4358ede8eb.
+
+Fixes: 5d4358ede8eb ("net: phy: broadcom: Allow BCM54210E to configure APD")
+Signed-off-by: Kevin Lo <kevlo@kevlo.org>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/broadcom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
+index 7bf3011b8e77..83aea5c5cd03 100644
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -288,7 +288,7 @@ static void bcm54xx_adjust_rxrefclk(struct phy_device *phydev)
+ if (phydev->dev_flags & PHY_BRCM_DIS_TXCRXC_NOENRGY) {
+ if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54210E ||
+ BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54810 ||
+- BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54210E)
++ BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54811)
+ val |= BCM54XX_SHD_SCR3_RXCTXC_DIS;
+ else
+ val |= BCM54XX_SHD_SCR3_TRDDAPD;
+--
+2.30.2
+
--- /dev/null
+From 6de346802514bd123bdde033625c65b0f0bd84d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 18:31:32 +0300
+Subject: net: qrtr: fix memory leaks
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 52f3456a96c06760b9bfae460e39596fec7af22e ]
+
+Syzbot reported memory leak in qrtr. The problem was in unputted
+struct sock. qrtr_local_enqueue() function calls qrtr_port_lookup()
+which takes sock reference if port was found. Then there is the following
+check:
+
+if (!ipc || &ipc->sk == skb->sk) {
+ ...
+ return -ENODEV;
+}
+
+Since we should drop the reference before returning from this function and
+ipc can be non-NULL inside this if, we should add qrtr_port_put() inside
+this if.
+
+The similar corner case is in qrtr_endpoint_post() as Manivannan
+reported. In case of sock_queue_rcv_skb() failure we need to put
+port reference to avoid leaking struct sock pointer.
+
+Fixes: e04df98adf7d ("net: qrtr: Remove receive worker")
+Fixes: bdabad3e363d ("net: Add Qualcomm IPC router")
+Reported-and-tested-by: syzbot+35a511c72ea7356cdcf3@syzkaller.appspotmail.com
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/qrtr/qrtr.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index f2efaa4225f9..67993bcfecde 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -518,8 +518,10 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
+ if (!ipc)
+ goto err;
+
+- if (sock_queue_rcv_skb(&ipc->sk, skb))
++ if (sock_queue_rcv_skb(&ipc->sk, skb)) {
++ qrtr_port_put(ipc);
+ goto err;
++ }
+
+ qrtr_port_put(ipc);
+ }
+@@ -839,6 +841,8 @@ static int qrtr_local_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+
+ ipc = qrtr_port_lookup(to->sq_port);
+ if (!ipc || &ipc->sk == skb->sk) { /* do not send to self */
++ if (ipc)
++ qrtr_port_put(ipc);
+ kfree_skb(skb);
+ return -ENODEV;
+ }
+--
+2.30.2
+
--- /dev/null
+From 8918836b629ee3a46baa6e27cc623e371a5d42c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 20:01:28 +0300
+Subject: net: Set true network header for ECN decapsulation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gilad Naaman <gnaaman@drivenets.com>
+
+[ Upstream commit 227adfb2b1dfbc53dfc53b9dd7a93a6298ff7c56 ]
+
+In cases where the header straight after the tunnel header was
+another ethernet header (TEB), instead of the network header,
+the ECN decapsulation code would treat the ethernet header as if
+it was an IP header, resulting in mishandling and possible
+wrong drops or corruption of the IP header.
+
+In this case, ECT(1) is sent, so IP_ECN_decapsulate tries to copy it to the
+inner IPv4 header, and correct its checksum.
+
+The offset of the ECT bits in an IPv4 header corresponds to the
+lower 2 bits of the second octet of the destination MAC address
+in the ethernet header.
+The IPv4 checksum corresponds to end of the source address.
+
+In order to reproduce:
+
+ $ ip netns add A
+ $ ip netns add B
+ $ ip -n A link add _v0 type veth peer name _v1 netns B
+ $ ip -n A link set _v0 up
+ $ ip -n A addr add dev _v0 10.254.3.1/24
+ $ ip -n A route add default dev _v0 scope global
+ $ ip -n B link set _v1 up
+ $ ip -n B addr add dev _v1 10.254.1.6/24
+ $ ip -n B route add default dev _v1 scope global
+ $ ip -n B link add gre1 type gretap local 10.254.1.6 remote 10.254.3.1 key 0x49000000
+ $ ip -n B link set gre1 up
+
+ # Now send an IPv4/GRE/Eth/IPv4 frame where the outer header has ECT(1),
+ # and the inner header has no ECT bits set:
+
+ $ cat send_pkt.py
+ #!/usr/bin/env python3
+ from scapy.all import *
+
+ pkt = IP(b'E\x01\x00\xa7\x00\x00\x00\x00@/`%\n\xfe\x03\x01\n\xfe\x01\x06 \x00eXI\x00'
+ b'\x00\x00\x18\xbe\x92\xa0\xee&\x18\xb0\x92\xa0l&\x08\x00E\x00\x00}\x8b\x85'
+ b'@\x00\x01\x01\xe4\xf2\x82\x82\x82\x01\x82\x82\x82\x02\x08\x00d\x11\xa6\xeb'
+ b'3\x1e\x1e\\xf3\\xf7`\x00\x00\x00\x00ZN\x00\x00\x00\x00\x00\x00\x10\x11\x12'
+ b'\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !"#$%&\'()*+,-./01234'
+ b'56789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ')
+
+ send(pkt)
+ $ sudo ip netns exec B tcpdump -neqlllvi gre1 icmp & ; sleep 1
+ $ sudo ip netns exec A python3 send_pkt.py
+
+In the original packet, the source/destinatio MAC addresses are
+dst=18:be:92:a0:ee:26 src=18:b0:92:a0:6c:26
+
+In the received packet, they are
+dst=18:bd:92:a0:ee:26 src=18:b0:92:a0:6c:27
+
+Thanks to Lahav Schlesinger <lschlesinger@drivenets.com> and Isaac Garzon <isaac@speed.io>
+for helping me pinpoint the origin.
+
+Fixes: b723748750ec ("tunnel: Propagate ECT(1) when decapsulating as recommended by RFC6040")
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
+Cc: David Ahern <dsahern@kernel.org>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Gilad Naaman <gnaaman@drivenets.com>
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_tunnel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 0dca00745ac3..be75b409445c 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -390,7 +390,7 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
+ tunnel->i_seqno = ntohl(tpi->seq) + 1;
+ }
+
+- skb_reset_network_header(skb);
++ skb_set_network_header(skb, (tunnel->dev->type == ARPHRD_ETHER) ? ETH_HLEN : 0);
+
+ err = IP_ECN_decapsulate(iph, skb);
+ if (unlikely(err)) {
+--
+2.30.2
+
--- /dev/null
+From e7f4a0954957e0190ac9194edecea001a3f263bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Jul 2021 18:36:00 +0200
+Subject: netfilter: conntrack: adjust stop timestamp to real expiry value
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 30a56a2b881821625f79837d4d968c679852444e ]
+
+In case the entry is evicted via garbage collection there is
+delay between the timeout value and the eviction event.
+
+This adjusts the stop value based on how much time has passed.
+
+Fixes: b87a2f9199ea82 ("netfilter: conntrack: add gc worker to remove timed-out entries")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_core.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index e0befcf8113a..69079a382d3a 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -666,8 +666,13 @@ bool nf_ct_delete(struct nf_conn *ct, u32 portid, int report)
+ return false;
+
+ tstamp = nf_conn_tstamp_find(ct);
+- if (tstamp && tstamp->stop == 0)
++ if (tstamp) {
++ s32 timeout = ct->timeout - nfct_time_stamp;
++
+ tstamp->stop = ktime_get_real_ns();
++ if (timeout < 0)
++ tstamp->stop -= jiffies_to_nsecs(-timeout);
++ }
+
+ if (nf_conntrack_event_report(IPCT_DESTROY, ct,
+ portid, report) < 0) {
+--
+2.30.2
+
--- /dev/null
+From 5aff144014312f2980cdc094e91bea4984d85ee0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 11:27:03 +0800
+Subject: netfilter: nf_tables: fix audit memory leak in nf_tables_commit
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+[ Upstream commit cfbe3650dd3ef2ea9a4420ca89d9a4df98af3fb6 ]
+
+In nf_tables_commit, if nf_tables_commit_audit_alloc fails, it does not
+free the adp variable.
+
+Fix this by adding nf_tables_commit_audit_free which frees
+the linked list with the head node adl.
+
+backtrace:
+ kmalloc include/linux/slab.h:591 [inline]
+ kzalloc include/linux/slab.h:721 [inline]
+ nf_tables_commit_audit_alloc net/netfilter/nf_tables_api.c:8439 [inline]
+ nf_tables_commit+0x16e/0x1760 net/netfilter/nf_tables_api.c:8508
+ nfnetlink_rcv_batch+0x512/0xa80 net/netfilter/nfnetlink.c:562
+ nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]
+ nfnetlink_rcv+0x1fa/0x220 net/netfilter/nfnetlink.c:652
+ netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
+ netlink_unicast+0x2c7/0x3e0 net/netlink/af_netlink.c:1340
+ netlink_sendmsg+0x36b/0x6b0 net/netlink/af_netlink.c:1929
+ sock_sendmsg_nosec net/socket.c:702 [inline]
+ sock_sendmsg+0x56/0x80 net/socket.c:722
+
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: c520292f29b8 ("audit: log nftables configuration change events once per table")
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index a5db7c59ad4e..7512bb819dff 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -8479,6 +8479,16 @@ static int nf_tables_commit_audit_alloc(struct list_head *adl,
+ return 0;
+ }
+
++static void nf_tables_commit_audit_free(struct list_head *adl)
++{
++ struct nft_audit_data *adp, *adn;
++
++ list_for_each_entry_safe(adp, adn, adl, list) {
++ list_del(&adp->list);
++ kfree(adp);
++ }
++}
++
+ static void nf_tables_commit_audit_collect(struct list_head *adl,
+ struct nft_table *table, u32 op)
+ {
+@@ -8543,6 +8553,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+ ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table);
+ if (ret) {
+ nf_tables_commit_chain_prepare_cancel(net);
++ nf_tables_commit_audit_free(&adl);
+ return ret;
+ }
+ if (trans->msg_type == NFT_MSG_NEWRULE ||
+@@ -8552,6 +8563,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+ ret = nf_tables_commit_chain_prepare(net, chain);
+ if (ret < 0) {
+ nf_tables_commit_chain_prepare_cancel(net);
++ nf_tables_commit_audit_free(&adl);
+ return ret;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From b4b27be804d551c94395673715be1fc0bf98ad2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jul 2021 18:22:50 +0200
+Subject: netfilter: nft_nat: allow to specify layer 4 protocol NAT only
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit a33f387ecd5aafae514095c2c4a8c24f7aea7e8b ]
+
+nft_nat reports a bogus EAFNOSUPPORT if no layer 3 information is specified.
+
+Fixes: d07db9884a5f ("netfilter: nf_tables: introduce nft_validate_register_load()")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_nat.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
+index 0840c635b752..be1595d6979d 100644
+--- a/net/netfilter/nft_nat.c
++++ b/net/netfilter/nft_nat.c
+@@ -201,7 +201,9 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ alen = sizeof_field(struct nf_nat_range, min_addr.ip6);
+ break;
+ default:
+- return -EAFNOSUPPORT;
++ if (tb[NFTA_NAT_REG_ADDR_MIN])
++ return -EAFNOSUPPORT;
++ break;
+ }
+ priv->family = family;
+
+--
+2.30.2
+
--- /dev/null
+From 4fc951136053697a9f7888b85df1165e09196dd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jul 2021 13:29:37 +0530
+Subject: octeontx2-pf: Dont enable backpressure on LBK links
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 4c85e57575fb9e6405d02d55aef8025c60abb824 ]
+
+Avoid configure backpressure for LBK links as they
+don't support it and enable lmacs before configuration
+pause frames.
+
+Fixes: 75f36270990c ("octeontx2-pf: Support to enable/disable pause frames via ethtool")
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 2 +-
+ .../ethernet/marvell/octeontx2/nic/otx2_common.c | 14 ++++++++------
+ 2 files changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+index fac6474ad694..f43cb1407e8c 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+@@ -1243,8 +1243,8 @@ static int cgx_lmac_init(struct cgx *cgx)
+
+ /* Add reference */
+ cgx->lmac_idmap[lmac->lmac_id] = lmac;
+- cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, true);
+ set_bit(lmac->lmac_id, &cgx->lmac_bmap);
++ cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, true);
+ }
+
+ return cgx_lmac_verify_fwi_version(cgx);
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+index cf7875d51d87..16ba457197a2 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+@@ -921,12 +921,14 @@ static int otx2_cq_init(struct otx2_nic *pfvf, u16 qidx)
+ aq->cq.drop = RQ_DROP_LVL_CQ(pfvf->hw.rq_skid, cq->cqe_cnt);
+ aq->cq.drop_ena = 1;
+
+- /* Enable receive CQ backpressure */
+- aq->cq.bp_ena = 1;
+- aq->cq.bpid = pfvf->bpid[0];
++ if (!is_otx2_lbkvf(pfvf->pdev)) {
++ /* Enable receive CQ backpressure */
++ aq->cq.bp_ena = 1;
++ aq->cq.bpid = pfvf->bpid[0];
+
+- /* Set backpressure level is same as cq pass level */
+- aq->cq.bp = RQ_PASS_LVL_CQ(pfvf->hw.rq_skid, qset->rqe_cnt);
++ /* Set backpressure level is same as cq pass level */
++ aq->cq.bp = RQ_PASS_LVL_CQ(pfvf->hw.rq_skid, qset->rqe_cnt);
++ }
+ }
+
+ /* Fill AQ info */
+@@ -1183,7 +1185,7 @@ static int otx2_aura_init(struct otx2_nic *pfvf, int aura_id,
+ aq->aura.fc_hyst_bits = 0; /* Store count on all updates */
+
+ /* Enable backpressure for RQ aura */
+- if (aura_id < pfvf->hw.rqpool_cnt) {
++ if (aura_id < pfvf->hw.rqpool_cnt && !is_otx2_lbkvf(pfvf->pdev)) {
+ aq->aura.bp_ena = 0;
+ aq->aura.nix0_bpid = pfvf->bpid[0];
+ /* Set backpressure level for RQ's Aura */
+--
+2.30.2
+
--- /dev/null
+From 583a5c3779329e19e2df3c2074043c9ab7a20999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jul 2021 13:29:03 +0530
+Subject: octeontx2-pf: Fix interface down flag on error
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit 69f0aeb13bb548e2d5710a350116e03f0273302e ]
+
+In the existing code while changing the number of TX/RX
+queues using ethtool the PF/VF interface resources are
+freed and reallocated (otx2_stop and otx2_open is called)
+if the device is in running state. If any resource allocation
+fails in otx2_open, driver free already allocated resources
+and return. But again, when the number of queues changes
+as the device state still running oxt2_stop is called.
+In which we try to free already freed resources leading
+to driver crash.
+This patch fixes the issue by setting the INTF_DOWN flag on
+error and free the resources in otx2_stop only if the flag is
+not set.
+
+Fixes: 50fe6c02e5ad ("octeontx2-pf: Register and handle link notifications")
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Signed-off-by: Sunil Kovvuri Goutham <Sunil.Goutham@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 7 +++----
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 5 +++++
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
+index 9d9a2e438acf..ae06eeeb5a45 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
+@@ -292,15 +292,14 @@ static int otx2_set_channels(struct net_device *dev,
+ err = otx2_set_real_num_queues(dev, channel->tx_count,
+ channel->rx_count);
+ if (err)
+- goto fail;
++ return err;
+
+ pfvf->hw.rx_queues = channel->rx_count;
+ pfvf->hw.tx_queues = channel->tx_count;
+ pfvf->qset.cq_cnt = pfvf->hw.tx_queues + pfvf->hw.rx_queues;
+
+-fail:
+ if (if_up)
+- dev->netdev_ops->ndo_open(dev);
++ err = dev->netdev_ops->ndo_open(dev);
+
+ netdev_info(dev, "Setting num Tx rings to %d, Rx rings to %d success\n",
+ pfvf->hw.tx_queues, pfvf->hw.rx_queues);
+@@ -404,7 +403,7 @@ static int otx2_set_ringparam(struct net_device *netdev,
+ qs->rqe_cnt = rx_count;
+
+ if (if_up)
+- netdev->netdev_ops->ndo_open(netdev);
++ return netdev->netdev_ops->ndo_open(netdev);
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+index 03004fdac0c6..2af50250d13c 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+@@ -1648,6 +1648,7 @@ int otx2_open(struct net_device *netdev)
+ err_tx_stop_queues:
+ netif_tx_stop_all_queues(netdev);
+ netif_carrier_off(netdev);
++ pf->flags |= OTX2_FLAG_INTF_DOWN;
+ err_free_cints:
+ otx2_free_cints(pf, qidx);
+ vec = pci_irq_vector(pf->pdev,
+@@ -1675,6 +1676,10 @@ int otx2_stop(struct net_device *netdev)
+ struct otx2_rss_info *rss;
+ int qidx, vec, wrk;
+
++ /* If the DOWN flag is set resources are already freed */
++ if (pf->flags & OTX2_FLAG_INTF_DOWN)
++ return 0;
++
+ netif_carrier_off(netdev);
+ netif_tx_stop_all_queues(netdev);
+
+--
+2.30.2
+
--- /dev/null
+From e5774522943df92f9b87e69663811b4d6dcbd3e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jun 2021 14:17:57 +0530
+Subject: platform/x86: amd-pmc: Fix command completion code
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 95e1b60f8dc8f225b14619e9aca9bdd7d99167db ]
+
+The protocol to submit a job request to SMU is to wait for
+AMD_PMC_REGISTER_RESPONSE to return 1,meaning SMU is ready to take
+requests. PMC driver has to make sure that the response code is always
+AMD_PMC_RESULT_OK before making any command submissions.
+
+When we submit a message to SMU, we have to wait until it processes
+the request. Adding a read_poll_timeout() check as this was missing in
+the existing code.
+
+Also, add a mutex to protect amd_pmc_send_cmd() calls to SMU.
+
+Fixes: 156ec4731cb2 ("platform/x86: amd-pmc: Add AMD platform support for S2Idle")
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Acked-by: Raul E Rangel <rrangel@chromium.org>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20210629084803.248498-2-Shyam-sundar.S-k@amd.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd-pmc.c | 38 ++++++++++++++++++++++++++++++++--
+ 1 file changed, 36 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/amd-pmc.c b/drivers/platform/x86/amd-pmc.c
+index b9da58ee9b1e..1b5f149932c1 100644
+--- a/drivers/platform/x86/amd-pmc.c
++++ b/drivers/platform/x86/amd-pmc.c
+@@ -68,6 +68,7 @@ struct amd_pmc_dev {
+ u32 base_addr;
+ u32 cpu_id;
+ struct device *dev;
++ struct mutex lock; /* generic mutex lock */
+ #if IS_ENABLED(CONFIG_DEBUG_FS)
+ struct dentry *dbgfs_dir;
+ #endif /* CONFIG_DEBUG_FS */
+@@ -138,9 +139,10 @@ static int amd_pmc_send_cmd(struct amd_pmc_dev *dev, bool set)
+ u8 msg;
+ u32 val;
+
++ mutex_lock(&dev->lock);
+ /* Wait until we get a valid response */
+ rc = readx_poll_timeout(ioread32, dev->regbase + AMD_PMC_REGISTER_RESPONSE,
+- val, val > 0, PMC_MSG_DELAY_MIN_US,
++ val, val != 0, PMC_MSG_DELAY_MIN_US,
+ PMC_MSG_DELAY_MIN_US * RESPONSE_REGISTER_LOOP_MAX);
+ if (rc) {
+ dev_err(dev->dev, "failed to talk to SMU\n");
+@@ -156,7 +158,37 @@ static int amd_pmc_send_cmd(struct amd_pmc_dev *dev, bool set)
+ /* Write message ID to message ID register */
+ msg = (dev->cpu_id == AMD_CPU_ID_RN) ? MSG_OS_HINT_RN : MSG_OS_HINT_PCO;
+ amd_pmc_reg_write(dev, AMD_PMC_REGISTER_MESSAGE, msg);
+- return 0;
++ /* Wait until we get a valid response */
++ rc = readx_poll_timeout(ioread32, dev->regbase + AMD_PMC_REGISTER_RESPONSE,
++ val, val != 0, PMC_MSG_DELAY_MIN_US,
++ PMC_MSG_DELAY_MIN_US * RESPONSE_REGISTER_LOOP_MAX);
++ if (rc) {
++ dev_err(dev->dev, "SMU response timed out\n");
++ goto out_unlock;
++ }
++
++ switch (val) {
++ case AMD_PMC_RESULT_OK:
++ break;
++ case AMD_PMC_RESULT_CMD_REJECT_BUSY:
++ dev_err(dev->dev, "SMU not ready. err: 0x%x\n", val);
++ rc = -EBUSY;
++ goto out_unlock;
++ case AMD_PMC_RESULT_CMD_UNKNOWN:
++ dev_err(dev->dev, "SMU cmd unknown. err: 0x%x\n", val);
++ rc = -EINVAL;
++ goto out_unlock;
++ case AMD_PMC_RESULT_CMD_REJECT_PREREQ:
++ case AMD_PMC_RESULT_FAILED:
++ default:
++ dev_err(dev->dev, "SMU cmd failed. err: 0x%x\n", val);
++ rc = -EIO;
++ goto out_unlock;
++ }
++
++out_unlock:
++ mutex_unlock(&dev->lock);
++ return rc;
+ }
+
+ static int __maybe_unused amd_pmc_suspend(struct device *dev)
+@@ -259,6 +291,7 @@ static int amd_pmc_probe(struct platform_device *pdev)
+
+ amd_pmc_dump_registers(dev);
+
++ mutex_init(&dev->lock);
+ platform_set_drvdata(pdev, dev);
+ amd_pmc_dbgfs_register(dev);
+ return 0;
+@@ -269,6 +302,7 @@ static int amd_pmc_remove(struct platform_device *pdev)
+ struct amd_pmc_dev *dev = platform_get_drvdata(pdev);
+
+ amd_pmc_dbgfs_unregister(dev);
++ mutex_destroy(&dev->lock);
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 4ebc30769e598815b3aaffb89ae4cd2f02ec9eeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 15:43:27 +0800
+Subject: platform/x86: amd-pmc: Fix missing unlock on error in
+ amd_pmc_send_cmd()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 95edbbf78c3bdbd1daa921dd4a2e61c751e469ba ]
+
+Add the missing unlock before return from function amd_pmc_send_cmd()
+in the error handling case.
+
+Fixes: 95e1b60f8dc8 ("platform/x86: amd-pmc: Fix command completion code")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20210715074327.1966083-1-yangyingliang@huawei.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd-pmc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/amd-pmc.c b/drivers/platform/x86/amd-pmc.c
+index b1d6175a13b2..ca95c2a52e26 100644
+--- a/drivers/platform/x86/amd-pmc.c
++++ b/drivers/platform/x86/amd-pmc.c
+@@ -140,7 +140,7 @@ static int amd_pmc_send_cmd(struct amd_pmc_dev *dev, bool set)
+ PMC_MSG_DELAY_MIN_US * RESPONSE_REGISTER_LOOP_MAX);
+ if (rc) {
+ dev_err(dev->dev, "failed to talk to SMU\n");
+- return rc;
++ goto out_unlock;
+ }
+
+ /* Write zero to response register */
+--
+2.30.2
+
--- /dev/null
+From debcf394b0c81aaa8e9be0910808cde1e2c982cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jun 2021 14:17:58 +0530
+Subject: platform/x86: amd-pmc: Fix SMU firmware reporting mechanism
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 4c06d35dfedf4c1fd03702e0f05292a69d020e21 ]
+
+It was lately understood that the current mechanism available in the
+driver to get SMU firmware info works only on internal SMU builds and
+there is a separate way to get all the SMU logging counters (addressed
+in the next patch). Hence remove all the smu info shown via debugfs as it
+is no more useful.
+
+Fixes: 156ec4731cb2 ("platform/x86: amd-pmc: Add AMD platform support for S2Idle")
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20210629084803.248498-3-Shyam-sundar.S-k@amd.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd-pmc.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/drivers/platform/x86/amd-pmc.c b/drivers/platform/x86/amd-pmc.c
+index 1b5f149932c1..b1d6175a13b2 100644
+--- a/drivers/platform/x86/amd-pmc.c
++++ b/drivers/platform/x86/amd-pmc.c
+@@ -52,7 +52,6 @@
+ #define AMD_CPU_ID_PCO AMD_CPU_ID_RV
+ #define AMD_CPU_ID_CZN AMD_CPU_ID_RN
+
+-#define AMD_SMU_FW_VERSION 0x0
+ #define PMC_MSG_DELAY_MIN_US 100
+ #define RESPONSE_REGISTER_LOOP_MAX 200
+
+@@ -89,11 +88,6 @@ static inline void amd_pmc_reg_write(struct amd_pmc_dev *dev, int reg_offset, u3
+ #ifdef CONFIG_DEBUG_FS
+ static int smu_fw_info_show(struct seq_file *s, void *unused)
+ {
+- struct amd_pmc_dev *dev = s->private;
+- u32 value;
+-
+- value = ioread32(dev->smu_base + AMD_SMU_FW_VERSION);
+- seq_printf(s, "SMU FW Info: %x\n", value);
+ return 0;
+ }
+ DEFINE_SHOW_ATTRIBUTE(smu_fw_info);
+@@ -280,10 +274,6 @@ static int amd_pmc_probe(struct platform_device *pdev)
+ pci_dev_put(rdev);
+ base_addr = ((u64)base_addr_hi << 32 | base_addr_lo);
+
+- dev->smu_base = devm_ioremap(dev->dev, base_addr, AMD_PMC_MAPPING_SIZE);
+- if (!dev->smu_base)
+- return -ENOMEM;
+-
+ dev->regbase = devm_ioremap(dev->dev, base_addr + AMD_PMC_BASE_ADDR_OFFSET,
+ AMD_PMC_MAPPING_SIZE);
+ if (!dev->regbase)
+--
+2.30.2
+
--- /dev/null
+From 60a6256aa322258c3aa37f09fa948dfe5a553df3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jul 2021 06:31:36 -0700
+Subject: RDMA/bnxt_re: Fix stats counters
+
+From: Naresh Kumar PBS <nareshkumar.pbs@broadcom.com>
+
+[ Upstream commit 0c23af52ccd1605926480b5dfd1dd857ef604611 ]
+
+Statistical counters are not incrementing in some adapter versions with
+newer FW. This is due to the stats context length mismatch between FW and
+driver. Since the L2 driver updates the length correctly, use the stats
+length from L2 driver while allocating the DMA'able memory and creating
+the stats context.
+
+Fixes: 9d6b648c3112 ("bnxt_en: Update firmware interface spec to 1.10.1.65.")
+Link: https://lore.kernel.org/r/1626010296-6076-1-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Naresh Kumar PBS <nareshkumar.pbs@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/main.c | 4 +++-
+ drivers/infiniband/hw/bnxt_re/qplib_res.c | 10 ++++------
+ drivers/infiniband/hw/bnxt_re/qplib_res.h | 1 +
+ 3 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
+index 8bfbf0231a9e..25550d982238 100644
+--- a/drivers/infiniband/hw/bnxt_re/main.c
++++ b/drivers/infiniband/hw/bnxt_re/main.c
+@@ -120,6 +120,7 @@ static int bnxt_re_setup_chip_ctx(struct bnxt_re_dev *rdev, u8 wqe_mode)
+ if (!chip_ctx)
+ return -ENOMEM;
+ chip_ctx->chip_num = bp->chip_num;
++ chip_ctx->hw_stats_size = bp->hw_ring_stats_size;
+
+ rdev->chip_ctx = chip_ctx;
+ /* rest members to follow eventually */
+@@ -547,6 +548,7 @@ static int bnxt_re_net_stats_ctx_alloc(struct bnxt_re_dev *rdev,
+ dma_addr_t dma_map,
+ u32 *fw_stats_ctx_id)
+ {
++ struct bnxt_qplib_chip_ctx *chip_ctx = rdev->chip_ctx;
+ struct hwrm_stat_ctx_alloc_output resp = {0};
+ struct hwrm_stat_ctx_alloc_input req = {0};
+ struct bnxt_en_dev *en_dev = rdev->en_dev;
+@@ -563,7 +565,7 @@ static int bnxt_re_net_stats_ctx_alloc(struct bnxt_re_dev *rdev,
+ bnxt_re_init_hwrm_hdr(rdev, (void *)&req, HWRM_STAT_CTX_ALLOC, -1, -1);
+ req.update_period_ms = cpu_to_le32(1000);
+ req.stats_dma_addr = cpu_to_le64(dma_map);
+- req.stats_dma_length = cpu_to_le16(sizeof(struct ctx_hw_stats_ext));
++ req.stats_dma_length = cpu_to_le16(chip_ctx->hw_stats_size);
+ req.stat_ctx_flags = STAT_CTX_ALLOC_REQ_STAT_CTX_FLAGS_ROCE;
+ bnxt_re_fill_fw_msg(&fw_msg, (void *)&req, sizeof(req), (void *)&resp,
+ sizeof(resp), DFLT_HWRM_CMD_TIMEOUT);
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c
+index 3ca47004b752..754dcebeb4ca 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c
+@@ -56,6 +56,7 @@
+ static void bnxt_qplib_free_stats_ctx(struct pci_dev *pdev,
+ struct bnxt_qplib_stats *stats);
+ static int bnxt_qplib_alloc_stats_ctx(struct pci_dev *pdev,
++ struct bnxt_qplib_chip_ctx *cctx,
+ struct bnxt_qplib_stats *stats);
+
+ /* PBL */
+@@ -559,7 +560,7 @@ int bnxt_qplib_alloc_ctx(struct bnxt_qplib_res *res,
+ goto fail;
+ stats_alloc:
+ /* Stats */
+- rc = bnxt_qplib_alloc_stats_ctx(res->pdev, &ctx->stats);
++ rc = bnxt_qplib_alloc_stats_ctx(res->pdev, res->cctx, &ctx->stats);
+ if (rc)
+ goto fail;
+
+@@ -889,15 +890,12 @@ static void bnxt_qplib_free_stats_ctx(struct pci_dev *pdev,
+ }
+
+ static int bnxt_qplib_alloc_stats_ctx(struct pci_dev *pdev,
++ struct bnxt_qplib_chip_ctx *cctx,
+ struct bnxt_qplib_stats *stats)
+ {
+ memset(stats, 0, sizeof(*stats));
+ stats->fw_id = -1;
+- /* 128 byte aligned context memory is required only for 57500.
+- * However making this unconditional, it does not harm previous
+- * generation.
+- */
+- stats->size = ALIGN(sizeof(struct ctx_hw_stats), 128);
++ stats->size = cctx->hw_stats_size;
+ stats->dma = dma_alloc_coherent(&pdev->dev, stats->size,
+ &stats->dma_map, GFP_KERNEL);
+ if (!stats->dma) {
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.h b/drivers/infiniband/hw/bnxt_re/qplib_res.h
+index 7a1ab38b95da..58bad6f78456 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_res.h
++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.h
+@@ -60,6 +60,7 @@ struct bnxt_qplib_chip_ctx {
+ u16 chip_num;
+ u8 chip_rev;
+ u8 chip_metal;
++ u16 hw_stats_size;
+ struct bnxt_qplib_drv_modes modes;
+ };
+
+--
+2.30.2
+
--- /dev/null
+From ff5a0a2107ead65bef19c2563f242a5954d52613 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jul 2021 11:41:54 -0500
+Subject: RDMA/rxe: Fix memory leak in error path code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit b18c7da63fcb46e2f9a093cc18d7c219e13a887c ]
+
+In rxe_mr_init_user() at the third error the driver fails to free the
+memory at mr->map. This patch adds code to do that. This error only
+occurs if page_address() fails to return a non zero address which should
+never happen for 64 bit architectures.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20210705164153.17652-1-rpearsonhpe@gmail.com
+Reported by: Haakon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Reviewed-by: Zhu Yanjun <zyjzyj2000@gmail.com>
+Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_mr.c | 27 +++++++++++++++++----------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index fe2b7d223183..fa3d29825ef6 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -130,13 +130,14 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova,
+ int num_buf;
+ void *vaddr;
+ int err;
++ int i;
+
+ umem = ib_umem_get(pd->ibpd.device, start, length, access);
+ if (IS_ERR(umem)) {
+- pr_warn("err %d from rxe_umem_get\n",
+- (int)PTR_ERR(umem));
++ pr_warn("%s: Unable to pin memory region err = %d\n",
++ __func__, (int)PTR_ERR(umem));
+ err = PTR_ERR(umem);
+- goto err1;
++ goto err_out;
+ }
+
+ mr->umem = umem;
+@@ -146,9 +147,9 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova,
+
+ err = rxe_mr_alloc(mr, num_buf);
+ if (err) {
+- pr_warn("err %d from rxe_mr_alloc\n", err);
+- ib_umem_release(umem);
+- goto err1;
++ pr_warn("%s: Unable to allocate memory for map\n",
++ __func__);
++ goto err_release_umem;
+ }
+
+ mr->page_shift = PAGE_SHIFT;
+@@ -168,10 +169,10 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova,
+
+ vaddr = page_address(sg_page_iter_page(&sg_iter));
+ if (!vaddr) {
+- pr_warn("null vaddr\n");
+- ib_umem_release(umem);
++ pr_warn("%s: Unable to get virtual address\n",
++ __func__);
+ err = -ENOMEM;
+- goto err1;
++ goto err_cleanup_map;
+ }
+
+ buf->addr = (uintptr_t)vaddr;
+@@ -194,7 +195,13 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova,
+
+ return 0;
+
+-err1:
++err_cleanup_map:
++ for (i = 0; i < mr->num_map; i++)
++ kfree(mr->map[i]);
++ kfree(mr->map);
++err_release_umem:
++ ib_umem_release(umem);
++err_out:
+ return err;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 6c32b0406eb2253056b7584985cafd0275256a54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 23:40:54 -0300
+Subject: sctp: fix return value check in __sctp_rcv_asconf_lookup
+
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+
+[ Upstream commit 557fb5862c9272ad9b21407afe1da8acfd9b53eb ]
+
+As Ben Hutchings noticed, this check should have been inverted: the call
+returns true in case of success.
+
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Fixes: 0c5dc070ff3d ("sctp: validate from_addr_param return")
+Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Reviewed-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/input.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sctp/input.c b/net/sctp/input.c
+index f72bff93745c..ddb5b5c2550e 100644
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -1175,7 +1175,7 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
+ if (unlikely(!af))
+ return NULL;
+
+- if (af->from_addr_param(&paddr, param, peer_port, 0))
++ if (!af->from_addr_param(&paddr, param, peer_port, 0))
+ return NULL;
+
+ return __sctp_lookup_association(net, laddr, &paddr, transportp);
+--
+2.30.2
+
io_uring-don-t-block-level-reissue-off-completion-path.patch
io_uring-fix-poll-requests-leaking-second-poll-entries.patch
cfg80211-fix-possible-memory-leak-in-function-cfg80211_bss_update.patch
+rdma-bnxt_re-fix-stats-counters.patch
+platform-x86-amd-pmc-fix-command-completion-code.patch
+platform-x86-amd-pmc-fix-smu-firmware-reporting-mech.patch
+platform-x86-amd-pmc-fix-missing-unlock-on-error-in-.patch
+rdma-rxe-fix-memory-leak-in-error-path-code.patch
+netfilter-nf_tables-fix-audit-memory-leak-in-nf_tabl.patch
+bpf-fix-oob-read-when-printing-xdp-link-fdinfo.patch
+mac80211-fix-enabling-4-address-mode-on-a-sta-vif-af.patch
+netfilter-conntrack-adjust-stop-timestamp-to-real-ex.patch
+netfilter-nft_nat-allow-to-specify-layer-4-protocol-.patch
+i40e-fix-logic-of-disabling-queues.patch
+i40e-fix-firmware-lldp-agent-related-warning.patch
+i40e-fix-queue-to-tc-mapping-on-tx.patch
+i40e-fix-log-tc-creation-failure-when-max-num-of-que.patch
+tipc-fix-implicit-connect-for-syn.patch
+tipc-fix-sleeping-in-tipc-accept-routine.patch
+net-set-true-network-header-for-ecn-decapsulation.patch
+net-dsa-mv88e6xxx-silently-accept-the-deletion-of-vi.patch
+loop-reintroduce-global-lock-for-safe-loop_validate_.patch
+net-qrtr-fix-memory-leaks.patch
+ionic-make-all-rx_mode-work-threadsafe.patch
+ionic-catch-no-ptp-support-earlier.patch
+ionic-remove-intr-coalesce-update-from-napi.patch
+ionic-fix-up-dim-accounting-for-tx-and-rx.patch
+ionic-count-csum_none-when-offload-enabled.patch
+can-mcp251xfd-mcp251xfd_irq-stop-timestamping-worker.patch
+tipc-do-not-write-skb_shinfo-frags-when-doing-decryt.patch
+octeontx2-pf-fix-interface-down-flag-on-error.patch
+octeontx2-pf-dont-enable-backpressure-on-lbk-links.patch
+net-phy-broadcom-re-add-check-for-phy_brcm_dis_txcrx.patch
+mlx4-fix-missing-error-code-in-mlx4_load_one.patch
+drm-panel-panel-simple-fix-proper-bpc-for-ytc700tlag.patch
+drm-i915-bios-fix-ports-mask.patch
+kvm-x86-check-the-right-feature-bit-for-msr_kvm_asyn.patch
+net-llc-fix-skb_over_panic.patch
+drm-msm-dpu-fix-sm8250_mdp-register-length.patch
+drm-msm-dp-use-dp_ctrl_off_link_stream-during-phy-co.patch
+drm-msm-dp-initialize-the-intf_config-register.patch
+kvm-selftests-fix-missing-break-in-dirty_log_perf_te.patch
+bpf-sockmap-zap-ingress-queues-after-stopping-strpar.patch
+net-mlx5-fix-flow-table-chaining.patch
+net-mlx5e-disable-rx-ntuple-offload-for-uplink-repre.patch
+net-mlx5-e-switch-set-destination-vport-vhca-id-only.patch
+net-mlx5-e-switch-handle-devcom-events-only-for-port.patch
+net-mlx5e-rx-avoid-possible-data-corruption-when-rel.patch
+net-mlx5e-add-netif_f_hw_tc-to-hw_features-when-htb-.patch
+net-mlx5e-fix-page-allocation-failure-for-trap-rq-ov.patch
+net-mlx5e-fix-page-allocation-failure-for-ptp-rq-ove.patch
+net-mlx5-unload-device-upon-firmware-fatal-error.patch
+net-mlx5e-fix-nullptr-in-mlx5e_hairpin_get_mdev.patch
+net-mlx5-fix-mlx5_vport_tbl_attr-chain-from-u16-to-u.patch
+block-delay-freeing-the-gendisk.patch
+sctp-fix-return-value-check-in-__sctp_rcv_asconf_loo.patch
+tulip-windbond-840-fix-missing-pci_disable_device-in.patch
+sis900-fix-missing-pci_disable_device-in-probe-and-r.patch
+can-hi311x-fix-a-signedness-bug-in-hi3110_cmd.patch
--- /dev/null
+From a6eb0dfb37233f98c61f0c8dbfbeb5aebfc11b80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 20:11:07 +0800
+Subject: sis900: Fix missing pci_disable_device() in probe and remove
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 89fb62fde3b226f99b7015280cf132e2a7438edf ]
+
+Replace pci_enable_device() with pcim_enable_device(),
+pci_disable_device() and pci_release_regions() will be
+called in release automatically.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sis/sis900.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c
+index 620c26f71be8..e267b7ce3a45 100644
+--- a/drivers/net/ethernet/sis/sis900.c
++++ b/drivers/net/ethernet/sis/sis900.c
+@@ -443,7 +443,7 @@ static int sis900_probe(struct pci_dev *pci_dev,
+ #endif
+
+ /* setup various bits in PCI command register */
+- ret = pci_enable_device(pci_dev);
++ ret = pcim_enable_device(pci_dev);
+ if(ret) return ret;
+
+ i = dma_set_mask(&pci_dev->dev, DMA_BIT_MASK(32));
+@@ -469,7 +469,7 @@ static int sis900_probe(struct pci_dev *pci_dev,
+ ioaddr = pci_iomap(pci_dev, 0, 0);
+ if (!ioaddr) {
+ ret = -ENOMEM;
+- goto err_out_cleardev;
++ goto err_out;
+ }
+
+ sis_priv = netdev_priv(net_dev);
+@@ -581,8 +581,6 @@ err_unmap_tx:
+ sis_priv->tx_ring_dma);
+ err_out_unmap:
+ pci_iounmap(pci_dev, ioaddr);
+-err_out_cleardev:
+- pci_release_regions(pci_dev);
+ err_out:
+ free_netdev(net_dev);
+ return ret;
+@@ -2499,7 +2497,6 @@ static void sis900_remove(struct pci_dev *pci_dev)
+ sis_priv->tx_ring_dma);
+ pci_iounmap(pci_dev, sis_priv->ioaddr);
+ free_netdev(net_dev);
+- pci_release_regions(pci_dev);
+ }
+
+ static int __maybe_unused sis900_suspend(struct device *dev)
+--
+2.30.2
+
--- /dev/null
+From 218166b8d4ae742060f8aef1aef759797ce5c99e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 18:46:01 -0400
+Subject: tipc: do not write skb_shinfo frags when doing decrytion
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 3cf4375a090473d240281a0d2b04a3a5aaeac34b ]
+
+One skb's skb_shinfo frags are not writable, and they can be shared with
+other skbs' like by pskb_copy(). To write the frags may cause other skb's
+data crash.
+
+So before doing en/decryption, skb_cow_data() should always be called for
+a cloned or nonlinear skb if req dst is using the same sg as req src.
+While at it, the likely branch can be removed, as it will be covered
+by skb_cow_data().
+
+Note that esp_input() has the same issue, and I will fix it in another
+patch. tipc_aead_encrypt() doesn't have this issue, as it only processes
+linear data in the unlikely branch.
+
+Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
+Reported-by: Shuang Li <shuali@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Jon Maloy <jmaloy@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/crypto.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c
+index e5c43d4d5a75..c9391d38de85 100644
+--- a/net/tipc/crypto.c
++++ b/net/tipc/crypto.c
+@@ -898,16 +898,10 @@ static int tipc_aead_decrypt(struct net *net, struct tipc_aead *aead,
+ if (unlikely(!aead))
+ return -ENOKEY;
+
+- /* Cow skb data if needed */
+- if (likely(!skb_cloned(skb) &&
+- (!skb_is_nonlinear(skb) || !skb_has_frag_list(skb)))) {
+- nsg = 1 + skb_shinfo(skb)->nr_frags;
+- } else {
+- nsg = skb_cow_data(skb, 0, &unused);
+- if (unlikely(nsg < 0)) {
+- pr_err("RX: skb_cow_data() returned %d\n", nsg);
+- return nsg;
+- }
++ nsg = skb_cow_data(skb, 0, &unused);
++ if (unlikely(nsg < 0)) {
++ pr_err("RX: skb_cow_data() returned %d\n", nsg);
++ return nsg;
+ }
+
+ /* Allocate memory for the AEAD operation */
+--
+2.30.2
+
--- /dev/null
+From 24144554c03425fc1cf6470810b9d6ed0a16fb5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 12:05:41 -0400
+Subject: tipc: fix implicit-connect for SYN+
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit f8dd60de194817c86bf812700980762bb5a8d9a4 ]
+
+For implicit-connect, when it's either SYN- or SYN+, an ACK should
+be sent back to the client immediately. It's not appropriate for
+the client to enter established state only after receiving data
+from the server.
+
+On client side, after the SYN is sent out, tipc_wait_for_connect()
+should be called to wait for the ACK if timeout is set.
+
+This patch also restricts __tipc_sendstream() to call __sendmsg()
+only when it's in TIPC_OPEN state, so that the client can program
+in a single loop doing both connecting and data sending like:
+
+ for (...)
+ sendmsg(dest, buf);
+
+This makes the implicit-connect more implicit.
+
+Fixes: b97bf3fd8f6a ("[TIPC] Initial merge")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Jon Maloy <jmaloy@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/socket.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 53af72824c9c..c52b0d00887b 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -160,6 +160,7 @@ static void tipc_sk_remove(struct tipc_sock *tsk);
+ static int __tipc_sendstream(struct socket *sock, struct msghdr *m, size_t dsz);
+ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dsz);
+ static void tipc_sk_push_backlog(struct tipc_sock *tsk, bool nagle_ack);
++static int tipc_wait_for_connect(struct socket *sock, long *timeo_p);
+
+ static const struct proto_ops packet_ops;
+ static const struct proto_ops stream_ops;
+@@ -1525,8 +1526,13 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen)
+ rc = 0;
+ }
+
+- if (unlikely(syn && !rc))
++ if (unlikely(syn && !rc)) {
+ tipc_set_sk_state(sk, TIPC_CONNECTING);
++ if (timeout) {
++ timeout = msecs_to_jiffies(timeout);
++ tipc_wait_for_connect(sock, &timeout);
++ }
++ }
+
+ return rc ? rc : dlen;
+ }
+@@ -1574,7 +1580,7 @@ static int __tipc_sendstream(struct socket *sock, struct msghdr *m, size_t dlen)
+ return -EMSGSIZE;
+
+ /* Handle implicit connection setup */
+- if (unlikely(dest)) {
++ if (unlikely(dest && sk->sk_state == TIPC_OPEN)) {
+ rc = __tipc_sendmsg(sock, m, dlen);
+ if (dlen && dlen == rc) {
+ tsk->peer_caps = tipc_node_get_capabilities(net, dnode);
+@@ -2708,9 +2714,10 @@ static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags,
+ bool kern)
+ {
+ struct sock *new_sk, *sk = sock->sk;
+- struct sk_buff *buf;
+ struct tipc_sock *new_tsock;
++ struct msghdr m = {NULL,};
+ struct tipc_msg *msg;
++ struct sk_buff *buf;
+ long timeo;
+ int res;
+
+@@ -2755,19 +2762,17 @@ static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags,
+ }
+
+ /*
+- * Respond to 'SYN-' by discarding it & returning 'ACK'-.
+- * Respond to 'SYN+' by queuing it on new socket.
++ * Respond to 'SYN-' by discarding it & returning 'ACK'.
++ * Respond to 'SYN+' by queuing it on new socket & returning 'ACK'.
+ */
+ if (!msg_data_sz(msg)) {
+- struct msghdr m = {NULL,};
+-
+ tsk_advance_rx_queue(sk);
+- __tipc_sendstream(new_sock, &m, 0);
+ } else {
+ __skb_dequeue(&sk->sk_receive_queue);
+ __skb_queue_head(&new_sk->sk_receive_queue, buf);
+ skb_set_owner_r(buf, new_sk);
+ }
++ __tipc_sendstream(new_sock, &m, 0);
+ release_sock(new_sk);
+ exit:
+ release_sock(sk);
+--
+2.30.2
+
--- /dev/null
+From 8b4b9b3971199d0cf55f92accadf85a522f23398 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 09:25:34 +0700
+Subject: tipc: fix sleeping in tipc accept routine
+
+From: Hoang Le <hoang.h.le@dektech.com.au>
+
+[ Upstream commit d237a7f11719ff9320721be5818352e48071aab6 ]
+
+The release_sock() is blocking function, it would change the state
+after sleeping. In order to evaluate the stated condition outside
+the socket lock context, switch to use wait_woken() instead.
+
+Fixes: 6398e23cdb1d8 ("tipc: standardize accept routine")
+Acked-by: Jon Maloy <jmaloy@redhat.com>
+Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/socket.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index c52b0d00887b..9bdc5147a65a 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -2671,7 +2671,7 @@ static int tipc_listen(struct socket *sock, int len)
+ static int tipc_wait_for_accept(struct socket *sock, long timeo)
+ {
+ struct sock *sk = sock->sk;
+- DEFINE_WAIT(wait);
++ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ int err;
+
+ /* True wake-one mechanism for incoming connections: only
+@@ -2680,12 +2680,12 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo)
+ * anymore, the common case will execute the loop only once.
+ */
+ for (;;) {
+- prepare_to_wait_exclusive(sk_sleep(sk), &wait,
+- TASK_INTERRUPTIBLE);
+ if (timeo && skb_queue_empty(&sk->sk_receive_queue)) {
++ add_wait_queue(sk_sleep(sk), &wait);
+ release_sock(sk);
+- timeo = schedule_timeout(timeo);
++ timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
+ lock_sock(sk);
++ remove_wait_queue(sk_sleep(sk), &wait);
+ }
+ err = 0;
+ if (!skb_queue_empty(&sk->sk_receive_queue))
+@@ -2697,7 +2697,6 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo)
+ if (signal_pending(current))
+ break;
+ }
+- finish_wait(sk_sleep(sk), &wait);
+ return err;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 9c0b7ef4719cb57643102ccb53da28bd1a8792bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 15:43:13 +0800
+Subject: tulip: windbond-840: Fix missing pci_disable_device() in probe and
+ remove
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 76a16be07b209a3f507c72abe823bd3af1c8661a ]
+
+Replace pci_enable_device() with pcim_enable_device(),
+pci_disable_device() and pci_release_regions() will be
+called in release automatically.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dec/tulip/winbond-840.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/dec/tulip/winbond-840.c b/drivers/net/ethernet/dec/tulip/winbond-840.c
+index 514df170ec5d..c967e0e859e5 100644
+--- a/drivers/net/ethernet/dec/tulip/winbond-840.c
++++ b/drivers/net/ethernet/dec/tulip/winbond-840.c
+@@ -357,7 +357,7 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
+ int i, option = find_cnt < MAX_UNITS ? options[find_cnt] : 0;
+ void __iomem *ioaddr;
+
+- i = pci_enable_device(pdev);
++ i = pcim_enable_device(pdev);
+ if (i) return i;
+
+ pci_set_master(pdev);
+@@ -379,7 +379,7 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ ioaddr = pci_iomap(pdev, TULIP_BAR, netdev_res_size);
+ if (!ioaddr)
+- goto err_out_free_res;
++ goto err_out_netdev;
+
+ for (i = 0; i < 3; i++)
+ ((__le16 *)dev->dev_addr)[i] = cpu_to_le16(eeprom_read(ioaddr, i));
+@@ -458,8 +458,6 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ err_out_cleardev:
+ pci_iounmap(pdev, ioaddr);
+-err_out_free_res:
+- pci_release_regions(pdev);
+ err_out_netdev:
+ free_netdev (dev);
+ return -ENODEV;
+@@ -1526,7 +1524,6 @@ static void w840_remove1(struct pci_dev *pdev)
+ if (dev) {
+ struct netdev_private *np = netdev_priv(dev);
+ unregister_netdev(dev);
+- pci_release_regions(pdev);
+ pci_iounmap(pdev, np->base_addr);
+ free_netdev(dev);
+ }
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
