--- /dev/null
+From 829cbc4f65c73da409e6a80474d5c6225e70dc05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Oct 2021 09:21:22 +0200
+Subject: ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers
+
+From: Davide Baldo <davide@baldo.me>
+
+[ Upstream commit d94befbb5ae379f6dfd4fa6d460eacc09fa7b9c3 ]
+
+In laptop 'HP Spectre x360 Convertible 15-eb1xxx/8811' both front and
+rear speakers are silent, this patch fixes that by overriding the pin
+layout and by initializing the amplifier which needs a GPIO pin to be
+set to 1 then 0, similar to the existing HP Spectre x360 14 model.
+
+In order to have volume control, both front and rear speakers were
+forced to use the DAC1.
+
+This patch also correctly map the mute LED but since there is no
+microphone on/off switch exposed by the alsa subsystem it never turns
+on by itself.
+
+There are still known audio issues in this laptop: headset microphone
+doesn't work, the button to mute/unmute microphone is not yet mapped,
+the LED of the mute/unmute speakers doesn't seems to be exposed via
+GPIO and never turns on.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=213953
+Signed-off-by: Davide Baldo <davide@baldo.me>
+Link: https://lore.kernel.org/r/20211015072121.5287-1-davide@baldo.me
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 46 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 46 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 5b28275147057..2eb06351de1fb 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6363,6 +6363,44 @@ static void alc_fixup_no_int_mic(struct hda_codec *codec,
+ }
+ }
+
++/* GPIO1 = amplifier on/off
++ * GPIO3 = mic mute LED
++ */
++static void alc285_fixup_hp_spectre_x360_eb1(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ static const hda_nid_t conn[] = { 0x02 };
++
++ struct alc_spec *spec = codec->spec;
++ static const struct hda_pintbl pincfgs[] = {
++ { 0x14, 0x90170110 }, /* front/high speakers */
++ { 0x17, 0x90170130 }, /* back/bass speakers */
++ { }
++ };
++
++ //enable micmute led
++ alc_fixup_hp_gpio_led(codec, action, 0x00, 0x04);
++
++ switch (action) {
++ case HDA_FIXUP_ACT_PRE_PROBE:
++ spec->micmute_led_polarity = 1;
++ /* needed for amp of back speakers */
++ spec->gpio_mask |= 0x01;
++ spec->gpio_dir |= 0x01;
++ snd_hda_apply_pincfgs(codec, pincfgs);
++ /* share DAC to have unified volume control */
++ snd_hda_override_conn_list(codec, 0x14, ARRAY_SIZE(conn), conn);
++ snd_hda_override_conn_list(codec, 0x17, ARRAY_SIZE(conn), conn);
++ break;
++ case HDA_FIXUP_ACT_INIT:
++ /* need to toggle GPIO to enable the amp of back speakers */
++ alc_update_gpio_data(codec, 0x01, true);
++ msleep(100);
++ alc_update_gpio_data(codec, 0x01, false);
++ break;
++ }
++}
++
+ static void alc285_fixup_hp_spectre_x360(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -6515,6 +6553,7 @@ enum {
+ ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED,
+ ALC280_FIXUP_HP_9480M,
+ ALC245_FIXUP_HP_X360_AMP,
++ ALC285_FIXUP_HP_SPECTRE_X360_EB1,
+ ALC288_FIXUP_DELL_HEADSET_MODE,
+ ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC288_FIXUP_DELL_XPS_13,
+@@ -8205,6 +8244,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_hp_spectre_x360,
+ },
++ [ALC285_FIXUP_HP_SPECTRE_X360_EB1] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc285_fixup_hp_spectre_x360_eb1
++ },
+ [ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_ideapad_s740_coef,
+@@ -8555,6 +8598,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x87f7, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP),
+ SND_PCI_QUIRK(0x103c, 0x8805, "HP ProBook 650 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x880d, "HP EliteBook 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8811, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1),
++ SND_PCI_QUIRK(0x103c, 0x8812, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1),
+ SND_PCI_QUIRK(0x103c, 0x8846, "HP EliteBook 850 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8847, "HP EliteBook x360 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x884b, "HP EliteBook 840 Aero G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
+@@ -8979,6 +9024,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC245_FIXUP_HP_X360_AMP, .name = "alc245-hp-x360-amp"},
+ {.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"},
+ {.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"},
++ {.id = ALC285_FIXUP_HP_SPECTRE_X360_EB1, .name = "alc285-hp-spectre-x360-eb1"},
+ {.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"},
+ {.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"},
+ {.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"},
+--
+2.33.0
+
--- /dev/null
+From a6f65bcc4d20fbc37badad1d5564881b88e43c25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Sep 2021 08:17:21 +0000
+Subject: ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bastien Roucariès <rouca@debian.org>
+
+[ Upstream commit 55dd7e059098ce4bd0a55c251cb78e74604abb57 ]
+
+Commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay
+config") sets the RX/TX delay according to the phy-mode property in the
+device tree. For the A20-olinuxino-lime2 board this is "rgmii", which is the
+wrong setting.
+
+Following the example of a900cac3750b ("ARM: dts: sun7i: a20: bananapro:
+Fix ethernet phy-mode") the phy-mode is changed to "rgmii-id" which gets
+the Ethernet working again on this board.
+
+Signed-off-by: Bastien Roucariès <rouca@debian.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210916081721.237137-1-rouca@debian.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts
+index 9ba62774e89a1..488933b87ad5a 100644
+--- a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts
++++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts
+@@ -112,7 +112,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.33.0
+
--- /dev/null
+From 34bc79ec78f4c73059600d578ef9b2d87ac1b4c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Oct 2021 14:58:40 +0800
+Subject: ASoC: soc-core: fix null-ptr-deref in
+ snd_soc_del_component_unlocked()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit c448b7aa3e66042fc0f849d9a0fb90d1af82e948 ]
+
+'component' is allocated in snd_soc_register_component(), but component->list
+is not initalized, this may cause snd_soc_del_component_unlocked() deref null
+ptr in the error handing case.
+
+KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
+RIP: 0010:__list_del_entry_valid+0x81/0xf0
+Call Trace:
+ snd_soc_del_component_unlocked+0x69/0x1b0 [snd_soc_core]
+ snd_soc_add_component.cold+0x54/0x6c [snd_soc_core]
+ snd_soc_register_component+0x70/0x90 [snd_soc_core]
+ devm_snd_soc_register_component+0x5e/0xd0 [snd_soc_core]
+ tas2552_probe+0x265/0x320 [snd_soc_tas2552]
+ ? tas2552_component_probe+0x1e0/0x1e0 [snd_soc_tas2552]
+ i2c_device_probe+0xa31/0xbe0
+
+Fix by adding INIT_LIST_HEAD() to snd_soc_component_initialize().
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20211009065840.3196239-1-yangyingliang@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index e677422c10585..1332965968646 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -2454,6 +2454,7 @@ int snd_soc_component_initialize(struct snd_soc_component *component,
+ INIT_LIST_HEAD(&component->dai_list);
+ INIT_LIST_HEAD(&component->dobj_list);
+ INIT_LIST_HEAD(&component->card_list);
++ INIT_LIST_HEAD(&component->list);
+ mutex_init(&component->io_mutex);
+
+ component->name = fmt_single_name(dev, &component->id);
+--
+2.33.0
+
--- /dev/null
+From bf51c4f6f2dada12b7d6f1522a579005a89018b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Oct 2021 01:51:27 +0900
+Subject: block: schedule queue restart after BLK_STS_ZONE_RESOURCE
+
+From: Naohiro Aota <naohiro.aota@wdc.com>
+
+[ Upstream commit 9586e67b911c95ba158fcc247b230e9c2d718623 ]
+
+When dispatching a zone append write request to a SCSI zoned block device,
+if the target zone of the request is already locked, the device driver will
+return BLK_STS_ZONE_RESOURCE and the request will be pushed back to the
+hctx dipatch queue. The queue will be marked as RESTART in
+dd_finish_request() and restarted in __blk_mq_free_request(). However, this
+restart applies to the hctx of the completed request. If the requeued
+request is on a different hctx, dispatch will no be retried until another
+request is submitted or the next periodic queue run triggers, leading to up
+to 30 seconds latency for the requeued request.
+
+Fix this problem by scheduling a queue restart similarly to the
+BLK_STS_RESOURCE case or when we cannot get the budget.
+
+Also, consolidate the checks into the "need_resource" variable to simplify
+the condition.
+
+Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Cc: Niklas Cassel <Niklas.Cassel@wdc.com>
+Link: https://lore.kernel.org/r/20211026165127.4151055-1-naohiro.aota@wdc.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index eed9a4c1519df..69cc552c3dfc9 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1327,6 +1327,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list,
+ int errors, queued;
+ blk_status_t ret = BLK_STS_OK;
+ LIST_HEAD(zone_list);
++ bool needs_resource = false;
+
+ if (list_empty(list))
+ return false;
+@@ -1372,6 +1373,8 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list,
+ queued++;
+ break;
+ case BLK_STS_RESOURCE:
++ needs_resource = true;
++ fallthrough;
+ case BLK_STS_DEV_RESOURCE:
+ blk_mq_handle_dev_resource(rq, list);
+ goto out;
+@@ -1382,6 +1385,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list,
+ * accept.
+ */
+ blk_mq_handle_zone_resource(rq, &zone_list);
++ needs_resource = true;
+ break;
+ default:
+ errors++;
+@@ -1408,7 +1412,6 @@ out:
+ /* For non-shared tags, the RESTART check will suffice */
+ bool no_tag = prep == PREP_DISPATCH_NO_TAG &&
+ (hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED);
+- bool no_budget_avail = prep == PREP_DISPATCH_NO_BUDGET;
+
+ blk_mq_release_budgets(q, nr_budgets);
+
+@@ -1448,14 +1451,16 @@ out:
+ * If driver returns BLK_STS_RESOURCE and SCHED_RESTART
+ * bit is set, run queue after a delay to avoid IO stalls
+ * that could otherwise occur if the queue is idle. We'll do
+- * similar if we couldn't get budget and SCHED_RESTART is set.
++ * similar if we couldn't get budget or couldn't lock a zone
++ * and SCHED_RESTART is set.
+ */
+ needs_restart = blk_mq_sched_needs_restart(hctx);
++ if (prep == PREP_DISPATCH_NO_BUDGET)
++ needs_resource = true;
+ if (!needs_restart ||
+ (no_tag && list_empty_careful(&hctx->dispatch_wait.entry)))
+ blk_mq_run_hw_queue(hctx, true);
+- else if (needs_restart && (ret == BLK_STS_RESOURCE ||
+- no_budget_avail))
++ else if (needs_restart && needs_resource)
+ blk_mq_delay_run_hw_queue(hctx, BLK_MQ_RESOURCE_DELAY);
+
+ blk_mq_update_dispatch_busy(hctx, true);
+--
+2.33.0
+
--- /dev/null
+From c1e7e7052dab95580a32b910cf57dc78dd8883e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Oct 2021 15:25:52 +0100
+Subject: bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT
+
+From: Lorenz Bauer <lmb@cloudflare.com>
+
+[ Upstream commit 5d63ae908242f028bd10860cba98450d11c079b8 ]
+
+Expose the maximum amount of useable memory from the arm64 JIT.
+
+Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20211014142554.53120-3-lmb@cloudflare.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/net/bpf_jit_comp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 345066b8e9fc8..064577ff9ff59 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -1134,6 +1134,11 @@ out:
+ return prog;
+ }
+
++u64 bpf_jit_alloc_exec_limit(void)
++{
++ return BPF_JIT_REGION_SIZE;
++}
++
+ void *bpf_jit_alloc_exec(unsigned long size)
+ {
+ return __vmalloc_node_range(size, PAGE_SIZE, BPF_JIT_REGION_START,
+--
+2.33.0
+
--- /dev/null
+From 17a62789e693a40e9de0eef45e48409acd38a954 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Oct 2021 15:25:53 +0100
+Subject: bpf: Prevent increasing bpf_jit_limit above max
+
+From: Lorenz Bauer <lmb@cloudflare.com>
+
+[ Upstream commit fadb7ff1a6c2c565af56b4aacdd086b067eed440 ]
+
+Restrict bpf_jit_limit to the maximum supported by the arch's JIT.
+
+Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20211014142554.53120-4-lmb@cloudflare.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 1 +
+ kernel/bpf/core.c | 4 +++-
+ net/core/sysctl_net_core.c | 2 +-
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 822b701c803d1..bc6ce4b202a80 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -998,6 +998,7 @@ extern int bpf_jit_enable;
+ extern int bpf_jit_harden;
+ extern int bpf_jit_kallsyms;
+ extern long bpf_jit_limit;
++extern long bpf_jit_limit_max;
+
+ typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);
+
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 72e4bf0ee5460..d3a1f25f8ec2e 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -528,6 +528,7 @@ int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
+ int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
+ int bpf_jit_harden __read_mostly;
+ long bpf_jit_limit __read_mostly;
++long bpf_jit_limit_max __read_mostly;
+
+ static void
+ bpf_prog_ksym_set_addr(struct bpf_prog *prog)
+@@ -821,7 +822,8 @@ u64 __weak bpf_jit_alloc_exec_limit(void)
+ static int __init bpf_jit_charge_init(void)
+ {
+ /* Only used as heuristic here to derive limit. */
+- bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2,
++ bpf_jit_limit_max = bpf_jit_alloc_exec_limit();
++ bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2,
+ PAGE_SIZE), LONG_MAX);
+ return 0;
+ }
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index d86d8d11cfe4a..2e0a4378e778a 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -419,7 +419,7 @@ static struct ctl_table net_core_table[] = {
+ .mode = 0600,
+ .proc_handler = proc_dolongvec_minmax_bpf_restricted,
+ .extra1 = &long_one,
+- .extra2 = &long_max,
++ .extra2 = &bpf_jit_limit_max,
+ },
+ #endif
+ {
+--
+2.33.0
+
--- /dev/null
+From 7d9d250ba90c44ae4751a57b2377ba1ff6337eee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Oct 2021 14:32:57 +0000
+Subject: cavium: Fix return values of the probe function
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit c69b2f46876825c726bd8a97c7fa852d8932bc32 ]
+
+During the process of driver probing, the probe function should return < 0
+for failure, otherwise, the kernel will treat value > 0 as success.
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+index f3b7b443f9648..c00f1a7ffc15f 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+@@ -1226,7 +1226,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
+ if (ret < 0) {
+ netdev_err(nic->netdev,
+ "Req for #%d msix vectors failed\n", nic->num_vec);
+- return 1;
++ return ret;
+ }
+
+ sprintf(nic->irq_name[irq], "%s Mbox", "NICVF");
+@@ -1245,7 +1245,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
+ if (!nicvf_check_pf_ready(nic)) {
+ nicvf_disable_intr(nic, NICVF_INTR_MBOX, 0);
+ nicvf_unregister_interrupts(nic);
+- return 1;
++ return -EIO;
+ }
+
+ return 0;
+--
+2.33.0
+
--- /dev/null
+From 793cffed19060eacb46ef7f9d7443b641f803770 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Oct 2021 02:16:22 +0000
+Subject: cavium: Return negative value when pci_alloc_irq_vectors() fails
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit b2cddb44bddc1a9c5949a978bb454bba863264db ]
+
+During the process of driver probing, the probe function should return < 0
+for failure, otherwise, the kernel will treat value > 0 as success.
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
+index 9361f964bb9b2..816453a4f8d6c 100644
+--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
+@@ -1193,7 +1193,7 @@ static int nic_register_interrupts(struct nicpf *nic)
+ dev_err(&nic->pdev->dev,
+ "Request for #%d msix vectors failed, returned %d\n",
+ nic->num_vec, ret);
+- return 1;
++ return ret;
+ }
+
+ /* Register mailbox interrupt handler */
+--
+2.33.0
+
--- /dev/null
+From d9d77fbe04b7bec5c9d975dd8e1b63295753191a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Oct 2021 09:24:33 -0500
+Subject: drm: panel-orientation-quirks: Add quirk for Aya Neo 2021
+
+From: Bryant Mairs <bryant@mai.rs>
+
+[ Upstream commit def0c3697287f6e85d5ac68b21302966c95474f9 ]
+
+Fixes screen orientation for the Aya Neo 2021 handheld gaming console.
+
+Signed-off-by: Bryant Mairs <bryant@mai.rs>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211019142433.4295-1-bryant@mai.rs
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index f6bdec7fa9253..30c17a76f49ae 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -134,6 +134,12 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"),
+ },
+ .driver_data = (void *)&lcd800x1280_rightside_up,
++ }, { /* AYA NEO 2021 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYADEVICE"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYA NEO 2021"),
++ },
++ .driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /* GPD MicroPC (generic strings, also match on bios date) */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
+--
+2.33.0
+
--- /dev/null
+From 800f64c18b8dd6f502e1f3d7c9f1ad64193cf36a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Oct 2021 13:27:37 +0200
+Subject: drm: panel-orientation-quirks: Add quirk for GPD Win3
+
+From: Mario <awxkrnl@gmail.com>
+
+[ Upstream commit 61b1d445f3bfe4c3ba4335ceeb7e8ba688fd31e2 ]
+
+Fixes screen orientation for GPD Win 3 handheld gaming console.
+
+Signed-off-by: Mario Risoldi <awxkrnl@gmail.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211026112737.9181-1-awxkrnl@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 30c17a76f49ae..e1b2ce4921ae7 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -191,6 +191,12 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
+ },
+ .driver_data = (void *)&gpd_win2,
++ }, { /* GPD Win 3 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1618-03")
++ },
++ .driver_data = (void *)&lcd720x1280_rightside_up,
+ }, { /* I.T.Works TW891 */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "To be filled by O.E.M."),
+--
+2.33.0
+
--- /dev/null
+From e420e542d792abe62efd72228da305c99a4113f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Oct 2021 16:02:47 +0200
+Subject: fcnal-test: kill hanging ping/nettest binaries on cleanup
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 1f83b835a3eaa5ae4bd825fb07182698bfc243ba ]
+
+On my box I see a bunch of ping/nettest processes hanging
+around after fcntal-test.sh is done.
+
+Clean those up before netns deletion.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Acked-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/20211021140247.29691-1-fw@strlen.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index 02b0b9ead40b9..225440f5f99eb 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -436,10 +436,13 @@ cleanup()
+ ip -netns ${NSA} link set dev ${NSA_DEV} down
+ ip -netns ${NSA} link del dev ${NSA_DEV}
+
++ ip netns pids ${NSA} | xargs kill 2>/dev/null
+ ip netns del ${NSA}
+ fi
+
++ ip netns pids ${NSB} | xargs kill 2>/dev/null
+ ip netns del ${NSB}
++ ip netns pids ${NSC} | xargs kill 2>/dev/null
+ ip netns del ${NSC} >/dev/null 2>&1
+ }
+
+--
+2.33.0
+
--- /dev/null
+From b6fa14e267516679a673e4092e61de9278b3d87c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Oct 2021 09:44:38 -0400
+Subject: gpio: mlxbf2.c: Add check for bgpio_init failure
+
+From: Asmaa Mnebhi <asmaa@nvidia.com>
+
+[ Upstream commit c0eee6fbfa2b3377f1efed10dad539abeb7312aa ]
+
+Add a check if bgpio_init fails.
+
+Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-mlxbf2.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpio/gpio-mlxbf2.c b/drivers/gpio/gpio-mlxbf2.c
+index befa5e1099439..d4b250b470b41 100644
+--- a/drivers/gpio/gpio-mlxbf2.c
++++ b/drivers/gpio/gpio-mlxbf2.c
+@@ -268,6 +268,11 @@ mlxbf2_gpio_probe(struct platform_device *pdev)
+ NULL,
+ 0);
+
++ if (ret) {
++ dev_err(dev, "bgpio_init failed\n");
++ return ret;
++ }
++
+ gc->direction_input = mlxbf2_gpio_direction_input;
+ gc->direction_output = mlxbf2_gpio_direction_output;
+ gc->ngpio = npins;
+--
+2.33.0
+
--- /dev/null
+From da6cb66515597774c262832614c0613c19d5b12b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Oct 2021 15:19:08 +0200
+Subject: hyperv/vmbus: include linux/bitops.h
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 8017c99680fa65e1e8d999df1583de476a187830 ]
+
+On arm64 randconfig builds, hyperv sometimes fails with this
+error:
+
+In file included from drivers/hv/hv_trace.c:3:
+In file included from drivers/hv/hyperv_vmbus.h:16:
+In file included from arch/arm64/include/asm/sync_bitops.h:5:
+arch/arm64/include/asm/bitops.h:11:2: error: only <linux/bitops.h> can be included directly
+In file included from include/asm-generic/bitops/hweight.h:5:
+include/asm-generic/bitops/arch_hweight.h:9:9: error: implicit declaration of function '__sw_hweight32' [-Werror,-Wimplicit-function-declaration]
+include/asm-generic/bitops/atomic.h:17:7: error: implicit declaration of function 'BIT_WORD' [-Werror,-Wimplicit-function-declaration]
+
+Include the correct header first.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20211018131929.2260087-1-arnd@kernel.org
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/hyperv_vmbus.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
+index 40e2b9f91163c..7845fa5de79e9 100644
+--- a/drivers/hv/hyperv_vmbus.h
++++ b/drivers/hv/hyperv_vmbus.h
+@@ -13,6 +13,7 @@
+ #define _HYPERV_VMBUS_H
+
+ #include <linux/list.h>
++#include <linux/bitops.h>
+ #include <asm/sync_bitops.h>
+ #include <asm/hyperv-tlfs.h>
+ #include <linux/atomic.h>
+--
+2.33.0
+
--- /dev/null
+From 60bf4004d940dab48bfad9770a6bcc2d39af8220 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Oct 2021 14:20:38 +0000
+Subject: mISDN: Fix return values of the probe function
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit e211210098cb7490db2183d725f5c0f10463a704 ]
+
+During the process of driver probing, the probe function should return < 0
+for failure, otherwise, the kernel will treat value > 0 as success.
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/hardware/mISDN/hfcpci.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
+index e501cb03f211d..bd087cca1c1d2 100644
+--- a/drivers/isdn/hardware/mISDN/hfcpci.c
++++ b/drivers/isdn/hardware/mISDN/hfcpci.c
+@@ -1994,14 +1994,14 @@ setup_hw(struct hfc_pci *hc)
+ pci_set_master(hc->pdev);
+ if (!hc->irq) {
+ printk(KERN_WARNING "HFC-PCI: No IRQ for PCI card found\n");
+- return 1;
++ return -EINVAL;
+ }
+ hc->hw.pci_io =
+ (char __iomem *)(unsigned long)hc->pdev->resource[1].start;
+
+ if (!hc->hw.pci_io) {
+ printk(KERN_WARNING "HFC-PCI: No IO-Mem for PCI card found\n");
+- return 1;
++ return -ENOMEM;
+ }
+ /* Allocate memory for FIFOS */
+ /* the memory needs to be on a 32k boundary within the first 4G */
+@@ -2012,7 +2012,7 @@ setup_hw(struct hfc_pci *hc)
+ if (!buffer) {
+ printk(KERN_WARNING
+ "HFC-PCI: Error allocating memory for FIFO!\n");
+- return 1;
++ return -ENOMEM;
+ }
+ hc->hw.fifos = buffer;
+ pci_write_config_dword(hc->pdev, 0x80, hc->hw.dmahandle);
+@@ -2022,7 +2022,7 @@ setup_hw(struct hfc_pci *hc)
+ "HFC-PCI: Error in ioremap for PCI!\n");
+ dma_free_coherent(&hc->pdev->dev, 0x8000, hc->hw.fifos,
+ hc->hw.dmahandle);
+- return 1;
++ return -ENOMEM;
+ }
+
+ printk(KERN_INFO
+--
+2.33.0
+
--- /dev/null
+From 95ee9d32be62eeefc29b1bc8042de1d43d511da8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Oct 2021 10:59:49 -0700
+Subject: mmc: winbond: don't build on M68K
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 162079f2dccd02cb4b6654defd32ca387dd6d4d4 ]
+
+The Winbond MMC driver fails to build on ARCH=m68k so prevent
+that build config. Silences these build errors:
+
+../drivers/mmc/host/wbsd.c: In function 'wbsd_request_end':
+../drivers/mmc/host/wbsd.c:212:28: error: implicit declaration of function 'claim_dma_lock' [-Werror=implicit-function-declaration]
+ 212 | dmaflags = claim_dma_lock();
+../drivers/mmc/host/wbsd.c:215:17: error: implicit declaration of function 'release_dma_lock'; did you mean 'release_task'? [-Werror=implicit-function-declaration]
+ 215 | release_dma_lock(dmaflags);
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Pierre Ossman <pierre@ossman.eu>
+Cc: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20211017175949.23838-1-rdunlap@infradead.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
+index 31481c9fcc2ec..30ff42fd173e2 100644
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -503,7 +503,7 @@ config MMC_OMAP_HS
+
+ config MMC_WBSD
+ tristate "Winbond W83L51xD SD/MMC Card Interface support"
+- depends on ISA_DMA_API
++ depends on ISA_DMA_API && !M68K
+ help
+ This selects the Winbond(R) W83L51xD Secure digital and
+ Multimedia card Interface.
+--
+2.33.0
+
--- /dev/null
+From 21a123447b92df7545b4126da96360fb717864ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Oct 2021 22:14:25 +0200
+Subject: net: multicast: calculate csum of looped-back and forwarded packets
+
+From: Cyril Strejc <cyril.strejc@skoda.cz>
+
+[ Upstream commit 9122a70a6333705c0c35614ddc51c274ed1d3637 ]
+
+During a testing of an user-space application which transmits UDP
+multicast datagrams and utilizes multicast routing to send the UDP
+datagrams out of defined network interfaces, I've found a multicast
+router does not fill-in UDP checksum into locally produced, looped-back
+and forwarded UDP datagrams, if an original output NIC the datagrams
+are sent to has UDP TX checksum offload enabled.
+
+The datagrams are sent malformed out of the NIC the datagrams have been
+forwarded to.
+
+It is because:
+
+1. If TX checksum offload is enabled on the output NIC, UDP checksum
+ is not calculated by kernel and is not filled into skb data.
+
+2. dev_loopback_xmit(), which is called solely by
+ ip_mc_finish_output(), sets skb->ip_summed = CHECKSUM_UNNECESSARY
+ unconditionally.
+
+3. Since 35fc92a9 ("[NET]: Allow forwarding of ip_summed except
+ CHECKSUM_COMPLETE"), the ip_summed value is preserved during
+ forwarding.
+
+4. If ip_summed != CHECKSUM_PARTIAL, checksum is not calculated during
+ a packet egress.
+
+The minimum fix in dev_loopback_xmit():
+
+1. Preserves skb->ip_summed CHECKSUM_PARTIAL. This is the
+ case when the original output NIC has TX checksum offload enabled.
+ The effects are:
+
+ a) If the forwarding destination interface supports TX checksum
+ offloading, the NIC driver is responsible to fill-in the
+ checksum.
+
+ b) If the forwarding destination interface does NOT support TX
+ checksum offloading, checksums are filled-in by kernel before
+ skb is submitted to the NIC driver.
+
+ c) For local delivery, checksum validation is skipped as in the
+ case of CHECKSUM_UNNECESSARY, thanks to skb_csum_unnecessary().
+
+2. Translates ip_summed CHECKSUM_NONE to CHECKSUM_UNNECESSARY. It
+ means, for CHECKSUM_NONE, the behavior is unmodified and is there
+ to skip a looped-back packet local delivery checksum validation.
+
+Signed-off-by: Cyril Strejc <cyril.strejc@skoda.cz>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/udp.h | 5 +++--
+ net/core/dev.c | 3 ++-
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/include/net/udp.h b/include/net/udp.h
+index 949ae14a54250..435cc009e6eaa 100644
+--- a/include/net/udp.h
++++ b/include/net/udp.h
+@@ -488,8 +488,9 @@ static inline struct sk_buff *udp_rcv_segment(struct sock *sk,
+ * CHECKSUM_NONE in __udp_gso_segment. UDP GRO indeed builds partial
+ * packets in udp_gro_complete_segment. As does UDP GSO, verified by
+ * udp_send_skb. But when those packets are looped in dev_loopback_xmit
+- * their ip_summed is set to CHECKSUM_UNNECESSARY. Reset in this
+- * specific case, where PARTIAL is both correct and required.
++ * their ip_summed CHECKSUM_NONE is changed to CHECKSUM_UNNECESSARY.
++ * Reset in this specific case, where PARTIAL is both correct and
++ * required.
+ */
+ if (skb->pkt_type == PACKET_LOOPBACK)
+ skb->ip_summed = CHECKSUM_PARTIAL;
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 6a4e0e3c59fec..e14294e9ba321 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3867,7 +3867,8 @@ int dev_loopback_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
+ skb_reset_mac_header(skb);
+ __skb_pull(skb, skb_network_offset(skb));
+ skb->pkt_type = PACKET_LOOPBACK;
+- skb->ip_summed = CHECKSUM_UNNECESSARY;
++ if (skb->ip_summed == CHECKSUM_NONE)
++ skb->ip_summed = CHECKSUM_UNNECESSARY;
+ WARN_ON(!skb_dst(skb));
+ skb_dst_force(skb);
+ netif_rx_ni(skb);
+--
+2.33.0
+
--- /dev/null
+From f69416e990d8ab8a050daa49098b081a62abe38e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Oct 2021 15:13:47 +0800
+Subject: net/smc: Correct spelling mistake to TCPF_SYN_RECV
+
+From: Wen Gu <guwen@linux.alibaba.com>
+
+[ Upstream commit f3a3a0fe0b644582fa5d83dd94b398f99fc57914 ]
+
+There should use TCPF_SYN_RECV instead of TCP_SYN_RECV.
+
+Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
+Reviewed-by: Tony Lu <tonylu@linux.alibaba.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/af_smc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 030d7f30b13fe..cc2af94e74507 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1018,7 +1018,7 @@ static void smc_connect_work(struct work_struct *work)
+ if (smc->clcsock->sk->sk_err) {
+ smc->sk.sk_err = smc->clcsock->sk->sk_err;
+ } else if ((1 << smc->clcsock->sk->sk_state) &
+- (TCPF_SYN_SENT | TCP_SYN_RECV)) {
++ (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
+ rc = sk_stream_wait_connect(smc->clcsock->sk, &timeo);
+ if ((rc == -EPIPE) &&
+ ((1 << smc->clcsock->sk->sk_state) &
+--
+2.33.0
+
--- /dev/null
+From e80ec2c6832d6e21a3e58bcc45a25090d3393244 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Oct 2021 15:13:45 +0800
+Subject: net/smc: Fix smc_link->llc_testlink_time overflow
+
+From: Tony Lu <tonylu@linux.alibaba.com>
+
+[ Upstream commit c4a146c7cf5e8ad76231523b174d161bf152c6e7 ]
+
+The value of llc_testlink_time is set to the value stored in
+net->ipv4.sysctl_tcp_keepalive_time when linkgroup init. The value of
+sysctl_tcp_keepalive_time is already jiffies, so we don't need to
+multiply by HZ, which would cause smc_link->llc_testlink_time overflow,
+and test_link send flood.
+
+Signed-off-by: Tony Lu <tonylu@linux.alibaba.com>
+Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_llc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c
+index 2e7560eba9812..d8fe4e1f24d1f 100644
+--- a/net/smc/smc_llc.c
++++ b/net/smc/smc_llc.c
+@@ -1787,7 +1787,7 @@ void smc_llc_link_active(struct smc_link *link)
+ link->smcibdev->ibdev->name, link->ibport);
+ link->state = SMC_LNK_ACTIVE;
+ if (link->lgr->llc_testlink_time) {
+- link->llc_testlink_time = link->lgr->llc_testlink_time * HZ;
++ link->llc_testlink_time = link->lgr->llc_testlink_time;
+ schedule_delayed_work(&link->llc_testlink_wrk,
+ link->llc_testlink_time);
+ }
+--
+2.33.0
+
--- /dev/null
+From c70a9be5dfbdb5b6e7729746977fa8879d419fc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Oct 2021 12:00:36 +0200
+Subject: nfp: bpf: relax prog rejection for mtu check through max_pkt_offset
+
+From: Yu Xiao <yu.xiao@corigine.com>
+
+[ Upstream commit 90a881fc352a953f1c8beb61977a2db0818157d4 ]
+
+MTU change is refused whenever the value of new MTU is bigger than
+the max packet bytes that fits in NFP Cluster Target Memory (CTM).
+However, an eBPF program doesn't always need to access the whole
+packet data.
+
+The maximum direct packet access (DPA) offset has always been
+caculated by verifier and stored in the max_pkt_offset field of prog
+aux data.
+
+Signed-off-by: Yu Xiao <yu.xiao@corigine.com>
+Reviewed-by: Yinjun Zhang <yinjun.zhang@corigine.com>
+Reviewed-by: Niklas Soderlund <niklas.soderlund@corigine.com>
+Signed-off-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/bpf/main.c | 16 +++++++++++-----
+ drivers/net/ethernet/netronome/nfp/bpf/main.h | 2 ++
+ .../net/ethernet/netronome/nfp/bpf/offload.c | 17 +++++++++++++----
+ 3 files changed, 26 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c
+index 11c83a99b0140..f469950c72657 100644
+--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c
++++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c
+@@ -182,15 +182,21 @@ static int
+ nfp_bpf_check_mtu(struct nfp_app *app, struct net_device *netdev, int new_mtu)
+ {
+ struct nfp_net *nn = netdev_priv(netdev);
+- unsigned int max_mtu;
++ struct nfp_bpf_vnic *bv;
++ struct bpf_prog *prog;
+
+ if (~nn->dp.ctrl & NFP_NET_CFG_CTRL_BPF)
+ return 0;
+
+- max_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32;
+- if (new_mtu > max_mtu) {
+- nn_info(nn, "BPF offload active, MTU over %u not supported\n",
+- max_mtu);
++ if (nn->xdp_hw.prog) {
++ prog = nn->xdp_hw.prog;
++ } else {
++ bv = nn->app_priv;
++ prog = bv->tc_prog;
++ }
++
++ if (nfp_bpf_offload_check_mtu(nn, prog, new_mtu)) {
++ nn_info(nn, "BPF offload active, potential packet access beyond hardware packet boundary");
+ return -EBUSY;
+ }
+ return 0;
+diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.h b/drivers/net/ethernet/netronome/nfp/bpf/main.h
+index fac9c6f9e197b..c74620fcc539c 100644
+--- a/drivers/net/ethernet/netronome/nfp/bpf/main.h
++++ b/drivers/net/ethernet/netronome/nfp/bpf/main.h
+@@ -560,6 +560,8 @@ bool nfp_is_subprog_start(struct nfp_insn_meta *meta);
+ void nfp_bpf_jit_prepare(struct nfp_prog *nfp_prog);
+ int nfp_bpf_jit(struct nfp_prog *prog);
+ bool nfp_bpf_supported_opcode(u8 code);
++bool nfp_bpf_offload_check_mtu(struct nfp_net *nn, struct bpf_prog *prog,
++ unsigned int mtu);
+
+ int nfp_verify_insn(struct bpf_verifier_env *env, int insn_idx,
+ int prev_insn_idx);
+diff --git a/drivers/net/ethernet/netronome/nfp/bpf/offload.c b/drivers/net/ethernet/netronome/nfp/bpf/offload.c
+index 53851853562c6..9d97cd281f18e 100644
+--- a/drivers/net/ethernet/netronome/nfp/bpf/offload.c
++++ b/drivers/net/ethernet/netronome/nfp/bpf/offload.c
+@@ -481,19 +481,28 @@ int nfp_bpf_event_output(struct nfp_app_bpf *bpf, const void *data,
+ return 0;
+ }
+
++bool nfp_bpf_offload_check_mtu(struct nfp_net *nn, struct bpf_prog *prog,
++ unsigned int mtu)
++{
++ unsigned int fw_mtu, pkt_off;
++
++ fw_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32;
++ pkt_off = min(prog->aux->max_pkt_offset, mtu);
++
++ return fw_mtu < pkt_off;
++}
++
+ static int
+ nfp_net_bpf_load(struct nfp_net *nn, struct bpf_prog *prog,
+ struct netlink_ext_ack *extack)
+ {
+ struct nfp_prog *nfp_prog = prog->aux->offload->dev_priv;
+- unsigned int fw_mtu, pkt_off, max_stack, max_prog_len;
++ unsigned int max_stack, max_prog_len;
+ dma_addr_t dma_addr;
+ void *img;
+ int err;
+
+- fw_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32;
+- pkt_off = min(prog->aux->max_pkt_offset, nn->dp.netdev->mtu);
+- if (fw_mtu < pkt_off) {
++ if (nfp_bpf_offload_check_mtu(nn, prog, nn->dp.netdev->mtu)) {
+ NL_SET_ERR_MSG_MOD(extack, "BPF offload not supported with potential packet access beyond HW packet split boundary");
+ return -EOPNOTSUPP;
+ }
+--
+2.33.0
+
--- /dev/null
+From 80605dd7994b7638cdb513ec3d0391f9d9d5eaa6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Oct 2021 10:26:34 +0200
+Subject: nvmet-tcp: fix a memory leak when releasing a queue
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+[ Upstream commit 926245c7d22271307606c88b1fbb2539a8550e94 ]
+
+page_frag_free() won't completely release the memory
+allocated for the commands, the cache page must be explicitly
+freed by calling __page_frag_cache_drain().
+
+This bug can be easily reproduced by repeatedly
+executing the following command on the initiator:
+
+$echo 1 > /sys/devices/virtual/nvme-fabrics/ctl/nvme0/reset_controller
+
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: John Meneghini <jmeneghi@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index 5266d534c4b31..b4ef7e9e8461f 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -1398,6 +1398,7 @@ static void nvmet_tcp_uninit_data_in_cmds(struct nvmet_tcp_queue *queue)
+
+ static void nvmet_tcp_release_queue_work(struct work_struct *w)
+ {
++ struct page *page;
+ struct nvmet_tcp_queue *queue =
+ container_of(w, struct nvmet_tcp_queue, release_work);
+
+@@ -1417,6 +1418,8 @@ static void nvmet_tcp_release_queue_work(struct work_struct *w)
+ nvmet_tcp_free_crypto(queue);
+ ida_simple_remove(&nvmet_tcp_queue_ida, queue->idx);
+
++ page = virt_to_head_page(queue->pf_cache.va);
++ __page_frag_cache_drain(page, queue->pf_cache.pagecnt_bias);
+ kfree(queue);
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 83c12b907a4e30d4c6a955b8c2e8edfa4f30887c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Oct 2021 09:49:27 +0300
+Subject: nvmet-tcp: fix header digest verification
+
+From: Amit Engel <amit.engel@dell.com>
+
+[ Upstream commit 86aeda32b887cdaeb0f4b7bfc9971e36377181c7 ]
+
+Pass the correct length to nvmet_tcp_verify_hdgst, which is the pdu
+header length. This fixes a wrong behaviour where header digest
+verification passes although the digest is wrong.
+
+Signed-off-by: Amit Engel <amit.engel@dell.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index b4ef7e9e8461f..58dc517fe8678 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -1084,7 +1084,7 @@ recv:
+ }
+
+ if (queue->hdr_digest &&
+- nvmet_tcp_verify_hdgst(queue, &queue->pdu, queue->offset)) {
++ nvmet_tcp_verify_hdgst(queue, &queue->pdu, hdr->hlen)) {
+ nvmet_tcp_fatal_error(queue); /* fatal */
+ return -EPROTO;
+ }
+--
+2.33.0
+
--- /dev/null
+From cb095648374f416ff205b4b2d588d60b5287dc9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Oct 2021 07:12:42 +0000
+Subject: r8169: Add device 10ec:8162 to driver r8169
+
+From: Janghyub Seo <jhyub06@gmail.com>
+
+[ Upstream commit 72f898ca0ab85fde6facf78b14d9f67a4a7b32d1 ]
+
+This patch makes the driver r8169 pick up device Realtek Semiconductor Co.
+, Ltd. Device [10ec:8162].
+
+Signed-off-by: Janghyub Seo <jhyub06@gmail.com>
+Suggested-by: Rushab Shah <rushabshah32@gmail.com>
+Link: https://lore.kernel.org/r/1635231849296.1489250046.441294000@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 30be18bac8063..5eac3f494d9e9 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -157,6 +157,7 @@ static const struct pci_device_id rtl8169_pci_tbl[] = {
+ { PCI_VDEVICE(REALTEK, 0x8129) },
+ { PCI_VDEVICE(REALTEK, 0x8136), RTL_CFG_NO_GBIT },
+ { PCI_VDEVICE(REALTEK, 0x8161) },
++ { PCI_VDEVICE(REALTEK, 0x8162) },
+ { PCI_VDEVICE(REALTEK, 0x8167) },
+ { PCI_VDEVICE(REALTEK, 0x8168) },
+ { PCI_VDEVICE(NCUBE, 0x8168) },
+--
+2.33.0
+
--- /dev/null
+From 98d46c2d432d334d8ec46b54f399578c05b05eaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 19:19:36 +0100
+Subject: rds: stop using dmapool
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 42f2611cc1738b201701e717246e11e86bef4e1e ]
+
+RDMA ULPs should only perform DMA through the ib_dma_* API instead of
+using the hidden dma_device directly. In addition using the dma coherent
+API family that dmapool is a part of can be very ineffcient on plaforms
+that are not DMA coherent. Switch to use slab allocations and the
+ib_dma_* APIs instead.
+
+Link: https://lore.kernel.org/r/20201106181941.1878556-6-hch@lst.de
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/ib.c | 10 ----
+ net/rds/ib.h | 6 ---
+ net/rds/ib_cm.c | 128 ++++++++++++++++++++++++++++------------------
+ net/rds/ib_recv.c | 18 +++++--
+ net/rds/ib_send.c | 8 +++
+ 5 files changed, 101 insertions(+), 69 deletions(-)
+
+diff --git a/net/rds/ib.c b/net/rds/ib.c
+index deecbdcdae84e..24c9a9005a6fb 100644
+--- a/net/rds/ib.c
++++ b/net/rds/ib.c
+@@ -30,7 +30,6 @@
+ * SOFTWARE.
+ *
+ */
+-#include <linux/dmapool.h>
+ #include <linux/kernel.h>
+ #include <linux/in.h>
+ #include <linux/if.h>
+@@ -108,7 +107,6 @@ static void rds_ib_dev_free(struct work_struct *work)
+ rds_ib_destroy_mr_pool(rds_ibdev->mr_1m_pool);
+ if (rds_ibdev->pd)
+ ib_dealloc_pd(rds_ibdev->pd);
+- dma_pool_destroy(rds_ibdev->rid_hdrs_pool);
+
+ list_for_each_entry_safe(i_ipaddr, i_next, &rds_ibdev->ipaddr_list, list) {
+ list_del(&i_ipaddr->list);
+@@ -191,14 +189,6 @@ static int rds_ib_add_one(struct ib_device *device)
+ rds_ibdev->pd = NULL;
+ goto put_dev;
+ }
+- rds_ibdev->rid_hdrs_pool = dma_pool_create(device->name,
+- device->dma_device,
+- sizeof(struct rds_header),
+- L1_CACHE_BYTES, 0);
+- if (!rds_ibdev->rid_hdrs_pool) {
+- ret = -ENOMEM;
+- goto put_dev;
+- }
+
+ rds_ibdev->mr_1m_pool =
+ rds_ib_create_mr_pool(rds_ibdev, RDS_IB_MR_1M_POOL);
+diff --git a/net/rds/ib.h b/net/rds/ib.h
+index c23a11d9ad362..2ba71102b1f1f 100644
+--- a/net/rds/ib.h
++++ b/net/rds/ib.h
+@@ -246,7 +246,6 @@ struct rds_ib_device {
+ struct list_head conn_list;
+ struct ib_device *dev;
+ struct ib_pd *pd;
+- struct dma_pool *rid_hdrs_pool; /* RDS headers DMA pool */
+ u8 odp_capable:1;
+
+ unsigned int max_mrs;
+@@ -380,11 +379,6 @@ int rds_ib_cm_handle_connect(struct rdma_cm_id *cm_id,
+ int rds_ib_cm_initiate_connect(struct rdma_cm_id *cm_id, bool isv6);
+ void rds_ib_cm_connect_complete(struct rds_connection *conn,
+ struct rdma_cm_event *event);
+-struct rds_header **rds_dma_hdrs_alloc(struct ib_device *ibdev,
+- struct dma_pool *pool,
+- dma_addr_t **dma_addrs, u32 num_hdrs);
+-void rds_dma_hdrs_free(struct dma_pool *pool, struct rds_header **hdrs,
+- dma_addr_t *dma_addrs, u32 num_hdrs);
+
+ #define rds_ib_conn_error(conn, fmt...) \
+ __rds_ib_conn_error(conn, KERN_WARNING "RDS/IB: " fmt)
+diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
+index b36b60668b1da..f5cbe963cd8f7 100644
+--- a/net/rds/ib_cm.c
++++ b/net/rds/ib_cm.c
+@@ -30,7 +30,6 @@
+ * SOFTWARE.
+ *
+ */
+-#include <linux/dmapool.h>
+ #include <linux/kernel.h>
+ #include <linux/in.h>
+ #include <linux/slab.h>
+@@ -441,42 +440,87 @@ static inline void ibdev_put_vector(struct rds_ib_device *rds_ibdev, int index)
+ rds_ibdev->vector_load[index]--;
+ }
+
++static void rds_dma_hdr_free(struct ib_device *dev, struct rds_header *hdr,
++ dma_addr_t dma_addr, enum dma_data_direction dir)
++{
++ ib_dma_unmap_single(dev, dma_addr, sizeof(*hdr), dir);
++ kfree(hdr);
++}
++
++static struct rds_header *rds_dma_hdr_alloc(struct ib_device *dev,
++ dma_addr_t *dma_addr, enum dma_data_direction dir)
++{
++ struct rds_header *hdr;
++
++ hdr = kzalloc_node(sizeof(*hdr), GFP_KERNEL, ibdev_to_node(dev));
++ if (!hdr)
++ return NULL;
++
++ *dma_addr = ib_dma_map_single(dev, hdr, sizeof(*hdr),
++ DMA_BIDIRECTIONAL);
++ if (ib_dma_mapping_error(dev, *dma_addr)) {
++ kfree(hdr);
++ return NULL;
++ }
++
++ return hdr;
++}
++
++/* Free the DMA memory used to store struct rds_header.
++ *
++ * @dev: the RDS IB device
++ * @hdrs: pointer to the array storing DMA memory pointers
++ * @dma_addrs: pointer to the array storing DMA addresses
++ * @num_hdars: number of headers to free.
++ */
++static void rds_dma_hdrs_free(struct rds_ib_device *dev,
++ struct rds_header **hdrs, dma_addr_t *dma_addrs, u32 num_hdrs,
++ enum dma_data_direction dir)
++{
++ u32 i;
++
++ for (i = 0; i < num_hdrs; i++)
++ rds_dma_hdr_free(dev->dev, hdrs[i], dma_addrs[i], dir);
++ kvfree(hdrs);
++ kvfree(dma_addrs);
++}
++
++
+ /* Allocate DMA coherent memory to be used to store struct rds_header for
+ * sending/receiving packets. The pointers to the DMA memory and the
+ * associated DMA addresses are stored in two arrays.
+ *
+- * @ibdev: the IB device
+- * @pool: the DMA memory pool
++ * @dev: the RDS IB device
+ * @dma_addrs: pointer to the array for storing DMA addresses
+ * @num_hdrs: number of headers to allocate
+ *
+ * It returns the pointer to the array storing the DMA memory pointers. On
+ * error, NULL pointer is returned.
+ */
+-struct rds_header **rds_dma_hdrs_alloc(struct ib_device *ibdev,
+- struct dma_pool *pool,
+- dma_addr_t **dma_addrs, u32 num_hdrs)
++static struct rds_header **rds_dma_hdrs_alloc(struct rds_ib_device *dev,
++ dma_addr_t **dma_addrs, u32 num_hdrs,
++ enum dma_data_direction dir)
+ {
+ struct rds_header **hdrs;
+ dma_addr_t *hdr_daddrs;
+ u32 i;
+
+ hdrs = kvmalloc_node(sizeof(*hdrs) * num_hdrs, GFP_KERNEL,
+- ibdev_to_node(ibdev));
++ ibdev_to_node(dev->dev));
+ if (!hdrs)
+ return NULL;
+
+ hdr_daddrs = kvmalloc_node(sizeof(*hdr_daddrs) * num_hdrs, GFP_KERNEL,
+- ibdev_to_node(ibdev));
++ ibdev_to_node(dev->dev));
+ if (!hdr_daddrs) {
+ kvfree(hdrs);
+ return NULL;
+ }
+
+ for (i = 0; i < num_hdrs; i++) {
+- hdrs[i] = dma_pool_zalloc(pool, GFP_KERNEL, &hdr_daddrs[i]);
++ hdrs[i] = rds_dma_hdr_alloc(dev->dev, &hdr_daddrs[i], dir);
+ if (!hdrs[i]) {
+- rds_dma_hdrs_free(pool, hdrs, hdr_daddrs, i);
++ rds_dma_hdrs_free(dev, hdrs, hdr_daddrs, i, dir);
+ return NULL;
+ }
+ }
+@@ -485,24 +529,6 @@ struct rds_header **rds_dma_hdrs_alloc(struct ib_device *ibdev,
+ return hdrs;
+ }
+
+-/* Free the DMA memory used to store struct rds_header.
+- *
+- * @pool: the DMA memory pool
+- * @hdrs: pointer to the array storing DMA memory pointers
+- * @dma_addrs: pointer to the array storing DMA addresses
+- * @num_hdars: number of headers to free.
+- */
+-void rds_dma_hdrs_free(struct dma_pool *pool, struct rds_header **hdrs,
+- dma_addr_t *dma_addrs, u32 num_hdrs)
+-{
+- u32 i;
+-
+- for (i = 0; i < num_hdrs; i++)
+- dma_pool_free(pool, hdrs[i], dma_addrs[i]);
+- kvfree(hdrs);
+- kvfree(dma_addrs);
+-}
+-
+ /*
+ * This needs to be very careful to not leave IS_ERR pointers around for
+ * cleanup to trip over.
+@@ -516,7 +542,6 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
+ struct rds_ib_device *rds_ibdev;
+ unsigned long max_wrs;
+ int ret, fr_queue_space;
+- struct dma_pool *pool;
+
+ /*
+ * It's normal to see a null device if an incoming connection races
+@@ -612,25 +637,26 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
+ goto recv_cq_out;
+ }
+
+- pool = rds_ibdev->rid_hdrs_pool;
+- ic->i_send_hdrs = rds_dma_hdrs_alloc(dev, pool, &ic->i_send_hdrs_dma,
+- ic->i_send_ring.w_nr);
++ ic->i_send_hdrs = rds_dma_hdrs_alloc(rds_ibdev, &ic->i_send_hdrs_dma,
++ ic->i_send_ring.w_nr,
++ DMA_TO_DEVICE);
+ if (!ic->i_send_hdrs) {
+ ret = -ENOMEM;
+ rdsdebug("DMA send hdrs alloc failed\n");
+ goto qp_out;
+ }
+
+- ic->i_recv_hdrs = rds_dma_hdrs_alloc(dev, pool, &ic->i_recv_hdrs_dma,
+- ic->i_recv_ring.w_nr);
++ ic->i_recv_hdrs = rds_dma_hdrs_alloc(rds_ibdev, &ic->i_recv_hdrs_dma,
++ ic->i_recv_ring.w_nr,
++ DMA_FROM_DEVICE);
+ if (!ic->i_recv_hdrs) {
+ ret = -ENOMEM;
+ rdsdebug("DMA recv hdrs alloc failed\n");
+ goto send_hdrs_dma_out;
+ }
+
+- ic->i_ack = dma_pool_zalloc(pool, GFP_KERNEL,
+- &ic->i_ack_dma);
++ ic->i_ack = rds_dma_hdr_alloc(rds_ibdev->dev, &ic->i_ack_dma,
++ DMA_TO_DEVICE);
+ if (!ic->i_ack) {
+ ret = -ENOMEM;
+ rdsdebug("DMA ack header alloc failed\n");
+@@ -666,18 +692,19 @@ sends_out:
+ vfree(ic->i_sends);
+
+ ack_dma_out:
+- dma_pool_free(pool, ic->i_ack, ic->i_ack_dma);
++ rds_dma_hdr_free(rds_ibdev->dev, ic->i_ack, ic->i_ack_dma,
++ DMA_TO_DEVICE);
+ ic->i_ack = NULL;
+
+ recv_hdrs_dma_out:
+- rds_dma_hdrs_free(pool, ic->i_recv_hdrs, ic->i_recv_hdrs_dma,
+- ic->i_recv_ring.w_nr);
++ rds_dma_hdrs_free(rds_ibdev, ic->i_recv_hdrs, ic->i_recv_hdrs_dma,
++ ic->i_recv_ring.w_nr, DMA_FROM_DEVICE);
+ ic->i_recv_hdrs = NULL;
+ ic->i_recv_hdrs_dma = NULL;
+
+ send_hdrs_dma_out:
+- rds_dma_hdrs_free(pool, ic->i_send_hdrs, ic->i_send_hdrs_dma,
+- ic->i_send_ring.w_nr);
++ rds_dma_hdrs_free(rds_ibdev, ic->i_send_hdrs, ic->i_send_hdrs_dma,
++ ic->i_send_ring.w_nr, DMA_TO_DEVICE);
+ ic->i_send_hdrs = NULL;
+ ic->i_send_hdrs_dma = NULL;
+
+@@ -1110,29 +1137,30 @@ void rds_ib_conn_path_shutdown(struct rds_conn_path *cp)
+ }
+
+ if (ic->rds_ibdev) {
+- struct dma_pool *pool;
+-
+- pool = ic->rds_ibdev->rid_hdrs_pool;
+-
+ /* then free the resources that ib callbacks use */
+ if (ic->i_send_hdrs) {
+- rds_dma_hdrs_free(pool, ic->i_send_hdrs,
++ rds_dma_hdrs_free(ic->rds_ibdev,
++ ic->i_send_hdrs,
+ ic->i_send_hdrs_dma,
+- ic->i_send_ring.w_nr);
++ ic->i_send_ring.w_nr,
++ DMA_TO_DEVICE);
+ ic->i_send_hdrs = NULL;
+ ic->i_send_hdrs_dma = NULL;
+ }
+
+ if (ic->i_recv_hdrs) {
+- rds_dma_hdrs_free(pool, ic->i_recv_hdrs,
++ rds_dma_hdrs_free(ic->rds_ibdev,
++ ic->i_recv_hdrs,
+ ic->i_recv_hdrs_dma,
+- ic->i_recv_ring.w_nr);
++ ic->i_recv_ring.w_nr,
++ DMA_FROM_DEVICE);
+ ic->i_recv_hdrs = NULL;
+ ic->i_recv_hdrs_dma = NULL;
+ }
+
+ if (ic->i_ack) {
+- dma_pool_free(pool, ic->i_ack, ic->i_ack_dma);
++ rds_dma_hdr_free(ic->rds_ibdev->dev, ic->i_ack,
++ ic->i_ack_dma, DMA_TO_DEVICE);
+ ic->i_ack = NULL;
+ }
+ } else {
+diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
+index 3cffcec5fb371..6fdedd9dbbc28 100644
+--- a/net/rds/ib_recv.c
++++ b/net/rds/ib_recv.c
+@@ -662,10 +662,16 @@ static void rds_ib_send_ack(struct rds_ib_connection *ic, unsigned int adv_credi
+ seq = rds_ib_get_ack(ic);
+
+ rdsdebug("send_ack: ic %p ack %llu\n", ic, (unsigned long long) seq);
++
++ ib_dma_sync_single_for_cpu(ic->rds_ibdev->dev, ic->i_ack_dma,
++ sizeof(*hdr), DMA_TO_DEVICE);
+ rds_message_populate_header(hdr, 0, 0, 0);
+ hdr->h_ack = cpu_to_be64(seq);
+ hdr->h_credit = adv_credits;
+ rds_message_make_checksum(hdr);
++ ib_dma_sync_single_for_device(ic->rds_ibdev->dev, ic->i_ack_dma,
++ sizeof(*hdr), DMA_TO_DEVICE);
++
+ ic->i_ack_queued = jiffies;
+
+ ret = ib_post_send(ic->i_cm_id->qp, &ic->i_ack_wr, NULL);
+@@ -845,6 +851,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
+ struct rds_ib_connection *ic = conn->c_transport_data;
+ struct rds_ib_incoming *ibinc = ic->i_ibinc;
+ struct rds_header *ihdr, *hdr;
++ dma_addr_t dma_addr = ic->i_recv_hdrs_dma[recv - ic->i_recvs];
+
+ /* XXX shut down the connection if port 0,0 are seen? */
+
+@@ -863,6 +870,8 @@ static void rds_ib_process_recv(struct rds_connection *conn,
+
+ ihdr = ic->i_recv_hdrs[recv - ic->i_recvs];
+
++ ib_dma_sync_single_for_cpu(ic->rds_ibdev->dev, dma_addr,
++ sizeof(*ihdr), DMA_FROM_DEVICE);
+ /* Validate the checksum. */
+ if (!rds_message_verify_checksum(ihdr)) {
+ rds_ib_conn_error(conn, "incoming message "
+@@ -870,7 +879,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
+ "forcing a reconnect\n",
+ &conn->c_faddr);
+ rds_stats_inc(s_recv_drop_bad_checksum);
+- return;
++ goto done;
+ }
+
+ /* Process the ACK sequence which comes with every packet */
+@@ -899,7 +908,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
+ */
+ rds_ib_frag_free(ic, recv->r_frag);
+ recv->r_frag = NULL;
+- return;
++ goto done;
+ }
+
+ /*
+@@ -933,7 +942,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
+ hdr->h_dport != ihdr->h_dport) {
+ rds_ib_conn_error(conn,
+ "fragment header mismatch; forcing reconnect\n");
+- return;
++ goto done;
+ }
+ }
+
+@@ -965,6 +974,9 @@ static void rds_ib_process_recv(struct rds_connection *conn,
+
+ rds_inc_put(&ibinc->ii_inc);
+ }
++done:
++ ib_dma_sync_single_for_device(ic->rds_ibdev->dev, dma_addr,
++ sizeof(*ihdr), DMA_FROM_DEVICE);
+ }
+
+ void rds_ib_recv_cqe_handler(struct rds_ib_connection *ic,
+diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
+index dfe778220657a..92b4a8689aae7 100644
+--- a/net/rds/ib_send.c
++++ b/net/rds/ib_send.c
+@@ -638,6 +638,10 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
+ send->s_sge[0].length = sizeof(struct rds_header);
+ send->s_sge[0].lkey = ic->i_pd->local_dma_lkey;
+
++ ib_dma_sync_single_for_cpu(ic->rds_ibdev->dev,
++ ic->i_send_hdrs_dma[pos],
++ sizeof(struct rds_header),
++ DMA_TO_DEVICE);
+ memcpy(ic->i_send_hdrs[pos], &rm->m_inc.i_hdr,
+ sizeof(struct rds_header));
+
+@@ -688,6 +692,10 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
+ adv_credits = 0;
+ rds_ib_stats_inc(s_ib_tx_credit_updates);
+ }
++ ib_dma_sync_single_for_device(ic->rds_ibdev->dev,
++ ic->i_send_hdrs_dma[pos],
++ sizeof(struct rds_header),
++ DMA_TO_DEVICE);
+
+ if (prev)
+ prev->s_wr.next = &send->s_wr;
+--
+2.33.0
+
--- /dev/null
+From e3092e28fd743a8113555056e72988d3c227e17d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Sep 2021 14:41:41 +0200
+Subject: reset: socfpga: add empty driver allowing consumers to probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paweł Anikiel <pan@semihalf.com>
+
+[ Upstream commit 3ad60b4b3570937f3278509fe6797a5093ce53f8 ]
+
+The early reset driver doesn't ever probe, which causes consuming
+devices to be unable to probe. Add an empty driver to set this device
+as available, allowing consumers to probe.
+
+Signed-off-by: Paweł Anikiel <pan@semihalf.com>
+Link: https://lore.kernel.org/r/20210920124141.1166544-4-pan@semihalf.com
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/reset-socfpga.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/reset/reset-socfpga.c b/drivers/reset/reset-socfpga.c
+index bdd9842961960..f9fa7fde7afb1 100644
+--- a/drivers/reset/reset-socfpga.c
++++ b/drivers/reset/reset-socfpga.c
+@@ -85,3 +85,29 @@ void __init socfpga_reset_init(void)
+ for_each_matching_node(np, socfpga_early_reset_dt_ids)
+ a10_reset_init(np);
+ }
++
++/*
++ * The early driver is problematic, because it doesn't register
++ * itself as a driver. This causes certain device links to prevent
++ * consumer devices from probing. The hacky solution is to register
++ * an empty driver, whose only job is to attach itself to the reset
++ * manager and call probe.
++ */
++static const struct of_device_id socfpga_reset_dt_ids[] = {
++ { .compatible = "altr,rst-mgr", },
++ { /* sentinel */ },
++};
++
++static int reset_simple_probe(struct platform_device *pdev)
++{
++ return 0;
++}
++
++static struct platform_driver reset_socfpga_driver = {
++ .probe = reset_simple_probe,
++ .driver = {
++ .name = "socfpga-reset",
++ .of_match_table = socfpga_reset_dt_ids,
++ },
++};
++builtin_platform_driver(reset_socfpga_driver);
+--
+2.33.0
+
--- /dev/null
+From c69a43097a24911f61670941846f886211c8776a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 11:55:14 +0300
+Subject: reset: tegra-bpmp: Handle errors in BPMP response
+
+From: Mikko Perttunen <mperttunen@nvidia.com>
+
+[ Upstream commit c045ceb5a145d2a9a4bf33cbc55185ddf99f60ab ]
+
+The return value from tegra_bpmp_transfer indicates the success or
+failure of the IPC transaction with BPMP. If the transaction
+succeeded, we also need to check the actual command's result code.
+Add code to do this.
+
+Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
+Link: https://lore.kernel.org/r/20210915085517.1669675-2-mperttunen@nvidia.com
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/tegra/reset-bpmp.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/reset/tegra/reset-bpmp.c b/drivers/reset/tegra/reset-bpmp.c
+index 24d3395964cc4..4c5bba52b1059 100644
+--- a/drivers/reset/tegra/reset-bpmp.c
++++ b/drivers/reset/tegra/reset-bpmp.c
+@@ -20,6 +20,7 @@ static int tegra_bpmp_reset_common(struct reset_controller_dev *rstc,
+ struct tegra_bpmp *bpmp = to_tegra_bpmp(rstc);
+ struct mrq_reset_request request;
+ struct tegra_bpmp_message msg;
++ int err;
+
+ memset(&request, 0, sizeof(request));
+ request.cmd = command;
+@@ -30,7 +31,13 @@ static int tegra_bpmp_reset_common(struct reset_controller_dev *rstc,
+ msg.tx.data = &request;
+ msg.tx.size = sizeof(request);
+
+- return tegra_bpmp_transfer(bpmp, &msg);
++ err = tegra_bpmp_transfer(bpmp, &msg);
++ if (err)
++ return err;
++ if (msg.rx.ret)
++ return -EINVAL;
++
++ return 0;
+ }
+
+ static int tegra_bpmp_reset_module(struct reset_controller_dev *rstc,
+--
+2.33.0
+
--- /dev/null
+From e2ef701336f070cd609aef9da9e682853e4f4d37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Oct 2021 15:26:50 +0300
+Subject: scsi: qla2xxx: Fix unmap of already freed sgl
+
+From: Dmitry Bogdanov <d.bogdanov@yadro.com>
+
+[ Upstream commit 4a8f71014b4d56c4fb287607e844c0a9f68f46d9 ]
+
+The sgl is freed in the target stack in target_release_cmd_kref() before
+calling qlt_free_cmd() but there is an unmap of sgl in qlt_free_cmd() that
+causes a panic if sgl is not yet DMA unmapped:
+
+NIP dma_direct_unmap_sg+0xdc/0x180
+LR dma_direct_unmap_sg+0xc8/0x180
+Call Trace:
+ ql_dbg_prefix+0x68/0xc0 [qla2xxx] (unreliable)
+ dma_unmap_sg_attrs+0x54/0xf0
+ qlt_unmap_sg.part.19+0x54/0x1c0 [qla2xxx]
+ qlt_free_cmd+0x124/0x1d0 [qla2xxx]
+ tcm_qla2xxx_release_cmd+0x4c/0xa0 [tcm_qla2xxx]
+ target_put_sess_cmd+0x198/0x370 [target_core_mod]
+ transport_generic_free_cmd+0x6c/0x1b0 [target_core_mod]
+ tcm_qla2xxx_complete_free+0x6c/0x90 [tcm_qla2xxx]
+
+The sgl may be left unmapped in error cases of response sending. For
+instance, qlt_rdy_to_xfer() maps sgl and exits when session is being
+deleted keeping the sgl mapped.
+
+This patch removes use-after-free of the sgl and ensures that the sgl is
+unmapped for any command that was not sent to firmware.
+
+Link: https://lore.kernel.org/r/20211018122650.11846-1-d.bogdanov@yadro.com
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 14 +++++---------
+ 1 file changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 8d4976725a75a..ebed14bed7835 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -3256,8 +3256,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ "RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n",
+ vha->flags.online, qla2x00_reset_active(vha),
+ cmd->reset_count, qpair->chip_reset);
+- spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+- return 0;
++ goto out_unmap_unlock;
+ }
+
+ /* Does F/W have an IOCBs for this request */
+@@ -3380,10 +3379,6 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
+ prm.sg = NULL;
+ prm.req_cnt = 1;
+
+- /* Calculate number of entries and segments required */
+- if (qlt_pci_map_calc_cnt(&prm) != 0)
+- return -EAGAIN;
+-
+ if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) ||
+ (cmd->sess && cmd->sess->deleted)) {
+ /*
+@@ -3401,6 +3396,10 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
+ return 0;
+ }
+
++ /* Calculate number of entries and segments required */
++ if (qlt_pci_map_calc_cnt(&prm) != 0)
++ return -EAGAIN;
++
+ spin_lock_irqsave(qpair->qp_lock_ptr, flags);
+ /* Does F/W have an IOCBs for this request */
+ res = qlt_check_reserve_free_req(qpair, prm.req_cnt);
+@@ -3805,9 +3804,6 @@ void qlt_free_cmd(struct qla_tgt_cmd *cmd)
+
+ BUG_ON(cmd->cmd_in_wq);
+
+- if (cmd->sg_mapped)
+- qlt_unmap_sg(cmd->vha, cmd);
+-
+ if (!cmd->q_full)
+ qlt_decr_num_pend_cmds(cmd->vha);
+
+--
+2.33.0
+
--- /dev/null
+From 72c6f870af389de94fe0b622e017e163bd7fddef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Oct 2021 01:56:21 +0000
+Subject: scsi: qla2xxx: Return -ENOMEM if kzalloc() fails
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit 06634d5b6e923ed0d4772aba8def5a618f44c7fe ]
+
+The driver probing function should return < 0 for failure, otherwise
+kernel will treat value > 0 as success.
+
+Link: https://lore.kernel.org/r/1634522181-31166-1-git-send-email-zheyuma97@gmail.com
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index e075f855f298e..813abaf1b0872 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -4079,7 +4079,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
+ ql_dbg_pci(ql_dbg_init, ha->pdev,
+ 0xe0ee, "%s: failed alloc dsd\n",
+ __func__);
+- return 1;
++ return -ENOMEM;
+ }
+ ha->dif_bundle_kallocs++;
+
+--
+2.33.0
+
x86-sme-use-define-use_early_pgtable_l5-in-mem_encrypt_identity.c.patch
x86-cpu-fix-migration-safety-with-x86_bug_null_sel.patch
x86-irq-ensure-pi-wakeup-handler-is-unregistered-before-module-unload.patch
+asoc-soc-core-fix-null-ptr-deref-in-snd_soc_del_comp.patch
+alsa-hda-realtek-fixes-hp-spectre-x360-15-eb1xxx-spe.patch
+cavium-return-negative-value-when-pci_alloc_irq_vect.patch
+scsi-qla2xxx-return-enomem-if-kzalloc-fails.patch
+scsi-qla2xxx-fix-unmap-of-already-freed-sgl.patch
+misdn-fix-return-values-of-the-probe-function.patch
+cavium-fix-return-values-of-the-probe-function.patch
+sfc-export-fibre-specific-supported-link-modes.patch
+sfc-don-t-use-netif_info-before-net_device-setup.patch
+hyperv-vmbus-include-linux-bitops.h.patch
+arm-dts-sun7i-a20-olinuxino-lime2-fix-ethernet-phy-m.patch
+reset-tegra-bpmp-handle-errors-in-bpmp-response.patch
+reset-socfpga-add-empty-driver-allowing-consumers-to.patch
+mmc-winbond-don-t-build-on-m68k.patch
+drm-panel-orientation-quirks-add-quirk-for-aya-neo-2.patch
+fcnal-test-kill-hanging-ping-nettest-binaries-on-cle.patch
+bpf-define-bpf_jit_alloc_exec_limit-for-arm64-jit.patch
+bpf-prevent-increasing-bpf_jit_limit-above-max.patch
+gpio-mlxbf2.c-add-check-for-bgpio_init-failure.patch
+xen-netfront-stop-tx-queues-during-live-migration.patch
+nvmet-tcp-fix-a-memory-leak-when-releasing-a-queue.patch
+spi-spl022-fix-microwire-full-duplex-mode.patch
+net-multicast-calculate-csum-of-looped-back-and-forw.patch
+watchdog-fix-omap-watchdog-early-handling.patch
+drm-panel-orientation-quirks-add-quirk-for-gpd-win3.patch
+block-schedule-queue-restart-after-blk_sts_zone_reso.patch
+nvmet-tcp-fix-header-digest-verification.patch
+r8169-add-device-10ec-8162-to-driver-r8169.patch
+vmxnet3-do-not-stop-tx-queues-after-netif_device_det.patch
+nfp-bpf-relax-prog-rejection-for-mtu-check-through-m.patch
+net-smc-fix-smc_link-llc_testlink_time-overflow.patch
+net-smc-correct-spelling-mistake-to-tcpf_syn_recv.patch
+rds-stop-using-dmapool.patch
--- /dev/null
+From c1561fe59bc43574d34eff4f5654035fdd9266d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Oct 2021 00:40:16 +0200
+Subject: sfc: Don't use netif_info before net_device setup
+
+From: Erik Ekman <erik@kryo.se>
+
+[ Upstream commit bf6abf345dfa77786aca554bc58c64bd428ecb1d ]
+
+Use pci_info instead to avoid unnamed/uninitialized noise:
+
+[197088.688729] sfc 0000:01:00.0: Solarflare NIC detected
+[197088.690333] sfc 0000:01:00.0: Part Number : SFN5122F
+[197088.729061] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no SR-IOV VFs probed
+[197088.729071] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no PTP support
+
+Inspired by fa44821a4ddd ("sfc: don't use netif_info et al before
+net_device is registered") from Heiner Kallweit.
+
+Signed-off-by: Erik Ekman <erik@kryo.se>
+Acked-by: Martin Habets <habetsm.xilinx@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ptp.c | 4 ++--
+ drivers/net/ethernet/sfc/siena_sriov.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
+index a39c5143b3864..797e51802ccbb 100644
+--- a/drivers/net/ethernet/sfc/ptp.c
++++ b/drivers/net/ethernet/sfc/ptp.c
+@@ -648,7 +648,7 @@ static int efx_ptp_get_attributes(struct efx_nic *efx)
+ } else if (rc == -EINVAL) {
+ fmt = MC_CMD_PTP_OUT_GET_ATTRIBUTES_SECONDS_NANOSECONDS;
+ } else if (rc == -EPERM) {
+- netif_info(efx, probe, efx->net_dev, "no PTP support\n");
++ pci_info(efx->pci_dev, "no PTP support\n");
+ return rc;
+ } else {
+ efx_mcdi_display_error(efx, MC_CMD_PTP, sizeof(inbuf),
+@@ -824,7 +824,7 @@ static int efx_ptp_disable(struct efx_nic *efx)
+ * should only have been called during probe.
+ */
+ if (rc == -ENOSYS || rc == -EPERM)
+- netif_info(efx, probe, efx->net_dev, "no PTP support\n");
++ pci_info(efx->pci_dev, "no PTP support\n");
+ else if (rc)
+ efx_mcdi_display_error(efx, MC_CMD_PTP,
+ MC_CMD_PTP_IN_DISABLE_LEN,
+diff --git a/drivers/net/ethernet/sfc/siena_sriov.c b/drivers/net/ethernet/sfc/siena_sriov.c
+index 83dcfcae3d4b5..441e7f3e53751 100644
+--- a/drivers/net/ethernet/sfc/siena_sriov.c
++++ b/drivers/net/ethernet/sfc/siena_sriov.c
+@@ -1057,7 +1057,7 @@ void efx_siena_sriov_probe(struct efx_nic *efx)
+ return;
+
+ if (efx_siena_sriov_cmd(efx, false, &efx->vi_scale, &count)) {
+- netif_info(efx, probe, efx->net_dev, "no SR-IOV VFs probed\n");
++ pci_info(efx->pci_dev, "no SR-IOV VFs probed\n");
+ return;
+ }
+ if (count > 0 && count > max_vfs)
+--
+2.33.0
+
--- /dev/null
+From cb5df82c95041cdaa92ef8ada3039ae2eba0f55e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Oct 2021 23:13:32 +0200
+Subject: sfc: Export fibre-specific supported link modes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Erik Ekman <erik@kryo.se>
+
+[ Upstream commit c62041c5baa9ded3bc6fd38d3f724de70683b489 ]
+
+The 1/10GbaseT modes were set up for cards with SFP+ cages in
+3497ed8c852a5 ("sfc: report supported link speeds on SFP connections").
+10GbaseT was likely used since no 10G fibre mode existed.
+
+The missing fibre modes for 1/10G were added to ethtool.h in 5711a9822144
+("net: ethtool: add support for 1000BaseX and missing 10G link modes")
+shortly thereafter.
+
+The user guide available at https://support-nic.xilinx.com/wp/drivers
+lists support for the following cable and transceiver types in section 2.9:
+- QSFP28 100G Direct Attach Cables
+- QSFP28 100G SR Optical Transceivers (with SR4 modules listed)
+- SFP28 25G Direct Attach Cables
+- SFP28 25G SR Optical Transceivers
+- QSFP+ 40G Direct Attach Cables
+- QSFP+ 40G Active Optical Cables
+- QSFP+ 40G SR4 Optical Transceivers
+- QSFP+ to SFP+ Breakout Direct Attach Cables
+- QSFP+ to SFP+ Breakout Active Optical Cables
+- SFP+ 10G Direct Attach Cables
+- SFP+ 10G SR Optical Transceivers
+- SFP+ 10G LR Optical Transceivers
+- SFP 1000BASE‐T Transceivers
+- 1G Optical Transceivers
+(From user guide issue 28. Issue 16 which also includes older cards like
+SFN5xxx/SFN6xxx has matching lists for 1/10/40G transceiver types.)
+
+Regarding SFP+ 10GBASE‐T transceivers the latest guide says:
+"Solarflare adapters do not support 10GBASE‐T transceiver modules."
+
+Tested using SFN5122F-R7 (with 2 SFP+ ports). Supported link modes do not change
+depending on module used (tested with 1000BASE-T, 1000BASE-BX10, 10GBASE-LR).
+Before:
+
+$ ethtool ext
+Settings for ext:
+ Supported ports: [ FIBRE ]
+ Supported link modes: 1000baseT/Full
+ 10000baseT/Full
+ Supported pause frame use: Symmetric Receive-only
+ Supports auto-negotiation: No
+ Supported FEC modes: Not reported
+ Advertised link modes: Not reported
+ Advertised pause frame use: No
+ Advertised auto-negotiation: No
+ Advertised FEC modes: Not reported
+ Link partner advertised link modes: Not reported
+ Link partner advertised pause frame use: No
+ Link partner advertised auto-negotiation: No
+ Link partner advertised FEC modes: Not reported
+ Speed: 1000Mb/s
+ Duplex: Full
+ Auto-negotiation: off
+ Port: FIBRE
+ PHYAD: 255
+ Transceiver: internal
+ Current message level: 0x000020f7 (8439)
+ drv probe link ifdown ifup rx_err tx_err hw
+ Link detected: yes
+
+After:
+
+$ ethtool ext
+Settings for ext:
+ Supported ports: [ FIBRE ]
+ Supported link modes: 1000baseT/Full
+ 1000baseX/Full
+ 10000baseCR/Full
+ 10000baseSR/Full
+ 10000baseLR/Full
+ Supported pause frame use: Symmetric Receive-only
+ Supports auto-negotiation: No
+ Supported FEC modes: Not reported
+ Advertised link modes: Not reported
+ Advertised pause frame use: No
+ Advertised auto-negotiation: No
+ Advertised FEC modes: Not reported
+ Link partner advertised link modes: Not reported
+ Link partner advertised pause frame use: No
+ Link partner advertised auto-negotiation: No
+ Link partner advertised FEC modes: Not reported
+ Speed: 1000Mb/s
+ Duplex: Full
+ Auto-negotiation: off
+ Port: FIBRE
+ PHYAD: 255
+ Transceiver: internal
+ Supports Wake-on: g
+ Wake-on: d
+ Current message level: 0x000020f7 (8439)
+ drv probe link ifdown ifup rx_err tx_err hw
+ Link detected: yes
+
+Signed-off-by: Erik Ekman <erik@kryo.se>
+Acked-by: Martin Habets <habetsm.xilinx@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/mcdi_port_common.c | 37 +++++++++++++++------
+ 1 file changed, 26 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/sfc/mcdi_port_common.c b/drivers/net/ethernet/sfc/mcdi_port_common.c
+index 4bd3ef8f3384e..c4fe3c48ac46a 100644
+--- a/drivers/net/ethernet/sfc/mcdi_port_common.c
++++ b/drivers/net/ethernet/sfc/mcdi_port_common.c
+@@ -132,16 +132,27 @@ void mcdi_to_ethtool_linkset(u32 media, u32 cap, unsigned long *linkset)
+ case MC_CMD_MEDIA_SFP_PLUS:
+ case MC_CMD_MEDIA_QSFP_PLUS:
+ SET_BIT(FIBRE);
+- if (cap & (1 << MC_CMD_PHY_CAP_1000FDX_LBN))
++ if (cap & (1 << MC_CMD_PHY_CAP_1000FDX_LBN)) {
+ SET_BIT(1000baseT_Full);
+- if (cap & (1 << MC_CMD_PHY_CAP_10000FDX_LBN))
+- SET_BIT(10000baseT_Full);
+- if (cap & (1 << MC_CMD_PHY_CAP_40000FDX_LBN))
++ SET_BIT(1000baseX_Full);
++ }
++ if (cap & (1 << MC_CMD_PHY_CAP_10000FDX_LBN)) {
++ SET_BIT(10000baseCR_Full);
++ SET_BIT(10000baseLR_Full);
++ SET_BIT(10000baseSR_Full);
++ }
++ if (cap & (1 << MC_CMD_PHY_CAP_40000FDX_LBN)) {
+ SET_BIT(40000baseCR4_Full);
+- if (cap & (1 << MC_CMD_PHY_CAP_100000FDX_LBN))
++ SET_BIT(40000baseSR4_Full);
++ }
++ if (cap & (1 << MC_CMD_PHY_CAP_100000FDX_LBN)) {
+ SET_BIT(100000baseCR4_Full);
+- if (cap & (1 << MC_CMD_PHY_CAP_25000FDX_LBN))
++ SET_BIT(100000baseSR4_Full);
++ }
++ if (cap & (1 << MC_CMD_PHY_CAP_25000FDX_LBN)) {
+ SET_BIT(25000baseCR_Full);
++ SET_BIT(25000baseSR_Full);
++ }
+ if (cap & (1 << MC_CMD_PHY_CAP_50000FDX_LBN))
+ SET_BIT(50000baseCR2_Full);
+ break;
+@@ -192,15 +203,19 @@ u32 ethtool_linkset_to_mcdi_cap(const unsigned long *linkset)
+ result |= (1 << MC_CMD_PHY_CAP_100FDX_LBN);
+ if (TEST_BIT(1000baseT_Half))
+ result |= (1 << MC_CMD_PHY_CAP_1000HDX_LBN);
+- if (TEST_BIT(1000baseT_Full) || TEST_BIT(1000baseKX_Full))
++ if (TEST_BIT(1000baseT_Full) || TEST_BIT(1000baseKX_Full) ||
++ TEST_BIT(1000baseX_Full))
+ result |= (1 << MC_CMD_PHY_CAP_1000FDX_LBN);
+- if (TEST_BIT(10000baseT_Full) || TEST_BIT(10000baseKX4_Full))
++ if (TEST_BIT(10000baseT_Full) || TEST_BIT(10000baseKX4_Full) ||
++ TEST_BIT(10000baseCR_Full) || TEST_BIT(10000baseLR_Full) ||
++ TEST_BIT(10000baseSR_Full))
+ result |= (1 << MC_CMD_PHY_CAP_10000FDX_LBN);
+- if (TEST_BIT(40000baseCR4_Full) || TEST_BIT(40000baseKR4_Full))
++ if (TEST_BIT(40000baseCR4_Full) || TEST_BIT(40000baseKR4_Full) ||
++ TEST_BIT(40000baseSR4_Full))
+ result |= (1 << MC_CMD_PHY_CAP_40000FDX_LBN);
+- if (TEST_BIT(100000baseCR4_Full))
++ if (TEST_BIT(100000baseCR4_Full) || TEST_BIT(100000baseSR4_Full))
+ result |= (1 << MC_CMD_PHY_CAP_100000FDX_LBN);
+- if (TEST_BIT(25000baseCR_Full))
++ if (TEST_BIT(25000baseCR_Full) || TEST_BIT(25000baseSR_Full))
+ result |= (1 << MC_CMD_PHY_CAP_25000FDX_LBN);
+ if (TEST_BIT(50000baseCR2_Full))
+ result |= (1 << MC_CMD_PHY_CAP_50000FDX_LBN);
+--
+2.33.0
+
--- /dev/null
+From d386e8ac715d2fdb2fb80b649fd485e09925043a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Oct 2021 16:21:04 +0200
+Subject: spi: spl022: fix Microwire full duplex mode
+
+From: Thomas Perrot <thomas.perrot@bootlin.com>
+
+[ Upstream commit d81d0e41ed5fe7229a2c9a29d13bad288c7cf2d2 ]
+
+There are missing braces in the function that verify controller parameters,
+then an error is always returned when the parameter to select Microwire
+frames operation is used on devices allowing it.
+
+Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com>
+Link: https://lore.kernel.org/r/20211022142104.1386379-1-thomas.perrot@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pl022.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
+index d1776fea287e5..e4ee8b0847993 100644
+--- a/drivers/spi/spi-pl022.c
++++ b/drivers/spi/spi-pl022.c
+@@ -1723,12 +1723,13 @@ static int verify_controller_parameters(struct pl022 *pl022,
+ return -EINVAL;
+ }
+ } else {
+- if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX)
++ if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) {
+ dev_err(&pl022->adev->dev,
+ "Microwire half duplex mode requested,"
+ " but this is only available in the"
+ " ST version of PL022\n");
+- return -EINVAL;
++ return -EINVAL;
++ }
+ }
+ }
+ return 0;
+--
+2.33.0
+
--- /dev/null
+From fba971bdfa425fe9007f7948a306d5b099243d4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Oct 2021 14:50:31 -0700
+Subject: vmxnet3: do not stop tx queues after netif_device_detach()
+
+From: Dongli Zhang <dongli.zhang@oracle.com>
+
+[ Upstream commit 9159f102402a64ac85e676b75cc1f9c62c5b4b73 ]
+
+The netif_device_detach() conditionally stops all tx queues if the queues
+are running. There is no need to call netif_tx_stop_all_queues() again.
+
+Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vmxnet3/vmxnet3_drv.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
+index 336504b7531d9..932a39945cc62 100644
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -3765,7 +3765,6 @@ vmxnet3_suspend(struct device *device)
+ vmxnet3_free_intr_resources(adapter);
+
+ netif_device_detach(netdev);
+- netif_tx_stop_all_queues(netdev);
+
+ /* Create wake-up filters. */
+ pmConf = adapter->pm_conf;
+--
+2.33.0
+
--- /dev/null
+From 6d0237bdb7dbc1bc0d023e5da32518cb4eabb073 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Oct 2021 12:22:29 +0200
+Subject: watchdog: Fix OMAP watchdog early handling
+
+From: Walter Stoll <walter.stoll@duagon.com>
+
+[ Upstream commit cd004d8299f1dc6cfa6a4eea8f94cb45eaedf070 ]
+
+TI's implementation does not service the watchdog even if the kernel
+command line parameter omap_wdt.early_enable is set to 1. This patch
+fixes the issue.
+
+Signed-off-by: Walter Stoll <walter.stoll@duagon.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/88a8fe5229cd68fa0f1fd22f5d66666c1b7057a0.camel@duagon.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/omap_wdt.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
+index 1616f93dfad7f..74d785b2b478f 100644
+--- a/drivers/watchdog/omap_wdt.c
++++ b/drivers/watchdog/omap_wdt.c
+@@ -268,8 +268,12 @@ static int omap_wdt_probe(struct platform_device *pdev)
+ wdev->wdog.bootstatus = WDIOF_CARDRESET;
+ }
+
+- if (!early_enable)
++ if (early_enable) {
++ omap_wdt_start(&wdev->wdog);
++ set_bit(WDOG_HW_RUNNING, &wdev->wdog.status);
++ } else {
+ omap_wdt_disable(wdev);
++ }
+
+ ret = watchdog_register_device(&wdev->wdog);
+ if (ret) {
+--
+2.33.0
+
--- /dev/null
+From f993295b6fb95efe0a8c74eb2b4691191eff2811 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Oct 2021 16:31:39 -0700
+Subject: xen/netfront: stop tx queues during live migration
+
+From: Dongli Zhang <dongli.zhang@oracle.com>
+
+[ Upstream commit 042b2046d0f05cf8124c26ff65dbb6148a4404fb ]
+
+The tx queues are not stopped during the live migration. As a result, the
+ndo_start_xmit() may access netfront_info->queues which is freed by
+talk_to_netback()->xennet_destroy_queues().
+
+This patch is to netif_device_detach() at the beginning of xen-netfront
+resuming, and netif_device_attach() at the end of resuming.
+
+ CPU A CPU B
+
+ talk_to_netback()
+ -> if (info->queues)
+ xennet_destroy_queues(info);
+ to free netfront_info->queues
+
+ xennet_start_xmit()
+ to access netfront_info->queues
+
+ -> err = xennet_create_queues(info, &num_queues);
+
+The idea is borrowed from virtio-net.
+
+Cc: Joe Jin <joe.jin@oracle.com>
+Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/xen-netfront.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 3e9895bec15f0..dd79534910b05 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1671,6 +1671,10 @@ static int netfront_resume(struct xenbus_device *dev)
+
+ dev_dbg(&dev->dev, "%s\n", dev->nodename);
+
++ netif_tx_lock_bh(info->netdev);
++ netif_device_detach(info->netdev);
++ netif_tx_unlock_bh(info->netdev);
++
+ xennet_disconnect_backend(info);
+ return 0;
+ }
+@@ -2285,6 +2289,10 @@ static int xennet_connect(struct net_device *dev)
+ * domain a kick because we've probably just requeued some
+ * packets.
+ */
++ netif_tx_lock_bh(np->netdev);
++ netif_device_attach(np->netdev);
++ netif_tx_unlock_bh(np->netdev);
++
+ netif_carrier_on(np->netdev);
+ for (j = 0; j < num_queues; ++j) {
+ queue = &np->queues[j];
+--
+2.33.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
