--- /dev/null
+From c834d4e992dbbb63e7bcf5804367b0dafdd4c33e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 12:36:42 +0100
+Subject: ath9k: fix build error with LEDS_CLASS=m
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit b64acb28da8394485f0762e657470c9fc33aca4d ]
+
+When CONFIG_ATH9K is built-in but LED support is in a loadable
+module, both ath9k drivers fails to link:
+
+x86_64-linux-ld: drivers/net/wireless/ath/ath9k/gpio.o: in function `ath_deinit_leds':
+gpio.c:(.text+0x36): undefined reference to `led_classdev_unregister'
+x86_64-linux-ld: drivers/net/wireless/ath/ath9k/gpio.o: in function `ath_init_leds':
+gpio.c:(.text+0x179): undefined reference to `led_classdev_register_ext'
+
+The problem is that the 'imply' keyword does not enforce any dependency
+but is only a weak hint to Kconfig to enable another symbol from a
+defconfig file.
+
+Change imply to a 'depends on LEDS_CLASS' that prevents the incorrect
+configuration but still allows building the driver without LED support.
+
+The 'select MAC80211_LEDS' is now ensures that the LED support is
+actually used if it is present, and the added Kconfig dependency
+on MAC80211_LEDS ensures that it cannot be enabled manually when it
+has no effect.
+
+Fixes: 197f466e93f5 ("ath9k_htc: Do not select MAC80211_LEDS by default")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210125113654.2408057-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/Kconfig | 8 ++------
+ net/mac80211/Kconfig | 2 +-
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
+index a84bb9b6573f8..e150d82eddb6c 100644
+--- a/drivers/net/wireless/ath/ath9k/Kconfig
++++ b/drivers/net/wireless/ath/ath9k/Kconfig
+@@ -21,11 +21,9 @@ config ATH9K_BTCOEX_SUPPORT
+ config ATH9K
+ tristate "Atheros 802.11n wireless cards support"
+ depends on MAC80211 && HAS_DMA
++ select MAC80211_LEDS if LEDS_CLASS=y || LEDS_CLASS=MAC80211
+ select ATH9K_HW
+ select ATH9K_COMMON
+- imply NEW_LEDS
+- imply LEDS_CLASS
+- imply MAC80211_LEDS
+ help
+ This module adds support for wireless adapters based on
+ Atheros IEEE 802.11n AR5008, AR9001 and AR9002 family
+@@ -176,11 +174,9 @@ config ATH9K_PCI_NO_EEPROM
+ config ATH9K_HTC
+ tristate "Atheros HTC based wireless cards support"
+ depends on USB && MAC80211
++ select MAC80211_LEDS if LEDS_CLASS=y || LEDS_CLASS=MAC80211
+ select ATH9K_HW
+ select ATH9K_COMMON
+- imply NEW_LEDS
+- imply LEDS_CLASS
+- imply MAC80211_LEDS
+ help
+ Support for Atheros HTC based cards.
+ Chipsets supported: AR9271
+diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
+index cd9a9bd242bab..51ec8256b7fa9 100644
+--- a/net/mac80211/Kconfig
++++ b/net/mac80211/Kconfig
+@@ -69,7 +69,7 @@ config MAC80211_MESH
+ config MAC80211_LEDS
+ bool "Enable LED triggers"
+ depends on MAC80211
+- depends on LEDS_CLASS
++ depends on LEDS_CLASS=y || LEDS_CLASS=MAC80211
+ select LEDS_TRIGGERS
+ help
+ This option enables a few LED triggers for different
+--
+2.27.0
+
--- /dev/null
+From edd66be3d1dd913afc07ddf62d2902751083bb1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 06:36:53 +0000
+Subject: bpf: Check for integer overflow when using roundup_pow_of_two()
+
+From: Bui Quang Minh <minhquangbui99@gmail.com>
+
+[ Upstream commit 6183f4d3a0a2ad230511987c6c362ca43ec0055f ]
+
+On 32-bit architecture, roundup_pow_of_two() can return 0 when the argument
+has upper most bit set due to resulting 1UL << 32. Add a check for this case.
+
+Fixes: d5a3b1f69186 ("bpf: introduce BPF_MAP_TYPE_STACK_TRACE")
+Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20210127063653.3576-1-minhquangbui99@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/stackmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index 06065fa271241..6e83bf8c080db 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -116,6 +116,8 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)
+
+ /* hash table size must be power of 2 */
+ n_buckets = roundup_pow_of_two(attr->max_entries);
++ if (!n_buckets)
++ return ERR_PTR(-E2BIG);
+
+ cost = n_buckets * sizeof(struct stack_map_bucket *) + sizeof(*smap);
+ cost += n_buckets * (value_size + sizeof(struct stack_map_bucket));
+--
+2.27.0
+
--- /dev/null
+From 2b0e2ff63c4e0f8e445423c46da75d8f367d93cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 23:06:36 -0800
+Subject: bpf: Unbreak BPF_PROG_TYPE_KPROBE when kprobe is called via do_int3
+
+From: Alexei Starovoitov <ast@kernel.org>
+
+[ Upstream commit 548f1191d86ccb9bde2a5305988877b7584c01eb ]
+
+The commit 0d00449c7a28 ("x86: Replace ist_enter() with nmi_enter()")
+converted do_int3 handler to be "NMI-like".
+That made old if (in_nmi()) check abort execution of bpf programs
+attached to kprobe when kprobe is firing via int3
+(For example when kprobe is placed in the middle of the function).
+Remove the check to restore user visible behavior.
+
+Fixes: 0d00449c7a28 ("x86: Replace ist_enter() with nmi_enter()")
+Reported-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Tested-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
+Link: https://lore.kernel.org/bpf/20210203070636.70926-1-alexei.starovoitov@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 0dde84b9d29fe..fcbfc95649967 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -93,9 +93,6 @@ unsigned int trace_call_bpf(struct trace_event_call *call, void *ctx)
+ {
+ unsigned int ret;
+
+- if (in_nmi()) /* not supported yet */
+- return 1;
+-
+ cant_sleep();
+
+ if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
+--
+2.27.0
+
--- /dev/null
+From af907d76125b1262dee0bfa9259aea75b841f5a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 17:37:17 +0800
+Subject: cgroup-v1: add disabled controller check in cgroup1_parse_param()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chen Zhou <chenzhou10@huawei.com>
+
+[ Upstream commit 61e960b07b637f0295308ad91268501d744c21b5 ]
+
+When mounting a cgroup hierarchy with disabled controller in cgroup v1,
+all available controllers will be attached.
+For example, boot with cgroup_no_v1=cpu or cgroup_disable=cpu, and then
+mount with "mount -t cgroup -ocpu cpu /sys/fs/cgroup/cpu", then all
+enabled controllers will be attached except cpu.
+
+Fix this by adding disabled controller check in cgroup1_parse_param().
+If the specified controller is disabled, just return error with information
+"Disabled controller xx" rather than attaching all the other enabled
+controllers.
+
+Fixes: f5dfb5315d34 ("cgroup: take options parsing into ->parse_monolithic()")
+Signed-off-by: Chen Zhou <chenzhou10@huawei.com>
+Reviewed-by: Zefan Li <lizefan.x@bytedance.com>
+Reviewed-by: Michal Koutný <mkoutny@suse.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cgroup-v1.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
+index 32596fdbcd5b8..a5751784ad740 100644
+--- a/kernel/cgroup/cgroup-v1.c
++++ b/kernel/cgroup/cgroup-v1.c
+@@ -917,6 +917,9 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param)
+ for_each_subsys(ss, i) {
+ if (strcmp(param->key, ss->legacy_name))
+ continue;
++ if (!cgroup_ssid_enabled(i) || cgroup1_ssid_disabled(i))
++ return invalfc(fc, "Disabled controller '%s'",
++ param->key);
+ ctx->subsys_mask |= (1 << i);
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From cd0b173e585ba0ed00d8e7da52a06ead1e0adcf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 18:58:56 +0100
+Subject: clk: sunxi-ng: mp: fix parent rate change flag check
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 245090ab2636c0869527ce563afbfb8aff29e825 ]
+
+CLK_SET_RATE_PARENT flag is checked on parent clock instead of current
+one. Fix that.
+
+Fixes: 3f790433c3cb ("clk: sunxi-ng: Adjust MP clock parent rate when allowed")
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Tested-by: Andre Heider <a.heider@gmail.com>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20210209175900.7092-2-jernej.skrabec@siol.net
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu_mp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu_mp.c b/drivers/clk/sunxi-ng/ccu_mp.c
+index fa4ecb9155909..9d3a76604d94c 100644
+--- a/drivers/clk/sunxi-ng/ccu_mp.c
++++ b/drivers/clk/sunxi-ng/ccu_mp.c
+@@ -108,7 +108,7 @@ static unsigned long ccu_mp_round_rate(struct ccu_mux_internal *mux,
+ max_m = cmp->m.max ?: 1 << cmp->m.width;
+ max_p = cmp->p.max ?: 1 << ((1 << cmp->p.width) - 1);
+
+- if (!(clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT)) {
++ if (!clk_hw_can_set_rate_parent(&cmp->common.hw)) {
+ ccu_mp_find_best(*parent_rate, rate, max_m, max_p, &m, &p);
+ rate = *parent_rate / p / m;
+ } else {
+--
+2.27.0
+
--- /dev/null
+From fa15b7baa4741257b0de5229989300cec2b521ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 08:26:14 -0700
+Subject: dmaengine: idxd: check device state before issue command
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit 89e3becd8f821e507052e012d2559dcda59f538e ]
+
+Add device state check before executing command. Without the check the
+command can be issued while device is in halt state and causes the driver to
+block while waiting for the completion of the command.
+
+Reported-by: Sanjay Kumar <sanjay.k.kumar@intel.com>
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Tested-by: Sanjay Kumar <sanjay.k.kumar@intel.com>
+Fixes: 0d5c10b4c84d ("dmaengine: idxd: add work queue drain support")
+Link: https://lore.kernel.org/r/161219313921.2976211.12222625226450097465.stgit@djiang5-desk3.ch.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/device.c | 23 ++++++++++++++++++++++-
+ drivers/dma/idxd/idxd.h | 2 +-
+ drivers/dma/idxd/init.c | 5 ++++-
+ 3 files changed, 27 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
+index 663344987e3f3..a6704838ffcb7 100644
+--- a/drivers/dma/idxd/device.c
++++ b/drivers/dma/idxd/device.c
+@@ -325,17 +325,31 @@ static inline bool idxd_is_enabled(struct idxd_device *idxd)
+ return false;
+ }
+
++static inline bool idxd_device_is_halted(struct idxd_device *idxd)
++{
++ union gensts_reg gensts;
++
++ gensts.bits = ioread32(idxd->reg_base + IDXD_GENSTATS_OFFSET);
++
++ return (gensts.state == IDXD_DEVICE_STATE_HALT);
++}
++
+ /*
+ * This is function is only used for reset during probe and will
+ * poll for completion. Once the device is setup with interrupts,
+ * all commands will be done via interrupt completion.
+ */
+-void idxd_device_init_reset(struct idxd_device *idxd)
++int idxd_device_init_reset(struct idxd_device *idxd)
+ {
+ struct device *dev = &idxd->pdev->dev;
+ union idxd_command_reg cmd;
+ unsigned long flags;
+
++ if (idxd_device_is_halted(idxd)) {
++ dev_warn(&idxd->pdev->dev, "Device is HALTED!\n");
++ return -ENXIO;
++ }
++
+ memset(&cmd, 0, sizeof(cmd));
+ cmd.cmd = IDXD_CMD_RESET_DEVICE;
+ dev_dbg(dev, "%s: sending reset for init.\n", __func__);
+@@ -346,6 +360,7 @@ void idxd_device_init_reset(struct idxd_device *idxd)
+ IDXD_CMDSTS_ACTIVE)
+ cpu_relax();
+ spin_unlock_irqrestore(&idxd->dev_lock, flags);
++ return 0;
+ }
+
+ static void idxd_cmd_exec(struct idxd_device *idxd, int cmd_code, u32 operand,
+@@ -355,6 +370,12 @@ static void idxd_cmd_exec(struct idxd_device *idxd, int cmd_code, u32 operand,
+ DECLARE_COMPLETION_ONSTACK(done);
+ unsigned long flags;
+
++ if (idxd_device_is_halted(idxd)) {
++ dev_warn(&idxd->pdev->dev, "Device is HALTED!\n");
++ *status = IDXD_CMDSTS_HW_ERR;
++ return;
++ }
++
+ memset(&cmd, 0, sizeof(cmd));
+ cmd.cmd = cmd_code;
+ cmd.operand = operand;
+diff --git a/drivers/dma/idxd/idxd.h b/drivers/dma/idxd/idxd.h
+index d48f193daacc0..953ef6536aac4 100644
+--- a/drivers/dma/idxd/idxd.h
++++ b/drivers/dma/idxd/idxd.h
+@@ -281,7 +281,7 @@ void idxd_mask_msix_vector(struct idxd_device *idxd, int vec_id);
+ void idxd_unmask_msix_vector(struct idxd_device *idxd, int vec_id);
+
+ /* device control */
+-void idxd_device_init_reset(struct idxd_device *idxd);
++int idxd_device_init_reset(struct idxd_device *idxd);
+ int idxd_device_enable(struct idxd_device *idxd);
+ int idxd_device_disable(struct idxd_device *idxd);
+ void idxd_device_reset(struct idxd_device *idxd);
+diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
+index 0a4432b063b5c..fa8c4228f358a 100644
+--- a/drivers/dma/idxd/init.c
++++ b/drivers/dma/idxd/init.c
+@@ -289,7 +289,10 @@ static int idxd_probe(struct idxd_device *idxd)
+ int rc;
+
+ dev_dbg(dev, "%s entered and resetting device\n", __func__);
+- idxd_device_init_reset(idxd);
++ rc = idxd_device_init_reset(idxd);
++ if (rc < 0)
++ return rc;
++
+ dev_dbg(dev, "IDXD reset complete\n");
+
+ idxd_read_caps(idxd);
+--
+2.27.0
+
--- /dev/null
+From 344f177c591e3c70f55a03393bd26881f5e4e1cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 14:52:33 -0700
+Subject: dmaengine: idxd: fix misc interrupt completion
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit f5cc9ace24fbdf41b4814effbb2f9bad7046e988 ]
+
+Nikhil reported the misc interrupt handler can sometimes miss handling
+the command interrupt when an error interrupt happens near the same time.
+Have the irq handling thread continue to process the misc interrupts until
+all interrupts are processed. This is a low usage interrupt and is not
+expected to handle high volume traffic. Therefore there is no concern of
+this thread running for a long time.
+
+Fixes: 0d5c10b4c84d ("dmaengine: idxd: add work queue drain support")
+Reported-by: Nikhil Rao <nikhil.rao@intel.com>
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/161074755329.2183844.13295528344116907983.stgit@djiang5-desk3.ch.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/irq.c | 36 +++++++++++++++++++++++++++---------
+ 1 file changed, 27 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c
+index 17a65a13fb649..552e2e2707058 100644
+--- a/drivers/dma/idxd/irq.c
++++ b/drivers/dma/idxd/irq.c
+@@ -53,19 +53,14 @@ irqreturn_t idxd_irq_handler(int vec, void *data)
+ return IRQ_WAKE_THREAD;
+ }
+
+-irqreturn_t idxd_misc_thread(int vec, void *data)
++static int process_misc_interrupts(struct idxd_device *idxd, u32 cause)
+ {
+- struct idxd_irq_entry *irq_entry = data;
+- struct idxd_device *idxd = irq_entry->idxd;
+ struct device *dev = &idxd->pdev->dev;
+ union gensts_reg gensts;
+- u32 cause, val = 0;
++ u32 val = 0;
+ int i;
+ bool err = false;
+
+- cause = ioread32(idxd->reg_base + IDXD_INTCAUSE_OFFSET);
+- iowrite32(cause, idxd->reg_base + IDXD_INTCAUSE_OFFSET);
+-
+ if (cause & IDXD_INTC_ERR) {
+ spin_lock_bh(&idxd->dev_lock);
+ for (i = 0; i < 4; i++)
+@@ -123,7 +118,7 @@ irqreturn_t idxd_misc_thread(int vec, void *data)
+ val);
+
+ if (!err)
+- goto out;
++ return 0;
+
+ gensts.bits = ioread32(idxd->reg_base + IDXD_GENSTATS_OFFSET);
+ if (gensts.state == IDXD_DEVICE_STATE_HALT) {
+@@ -144,10 +139,33 @@ irqreturn_t idxd_misc_thread(int vec, void *data)
+ gensts.reset_type == IDXD_DEVICE_RESET_FLR ?
+ "FLR" : "system reset");
+ spin_unlock_bh(&idxd->dev_lock);
++ return -ENXIO;
+ }
+ }
+
+- out:
++ return 0;
++}
++
++irqreturn_t idxd_misc_thread(int vec, void *data)
++{
++ struct idxd_irq_entry *irq_entry = data;
++ struct idxd_device *idxd = irq_entry->idxd;
++ int rc;
++ u32 cause;
++
++ cause = ioread32(idxd->reg_base + IDXD_INTCAUSE_OFFSET);
++ if (cause)
++ iowrite32(cause, idxd->reg_base + IDXD_INTCAUSE_OFFSET);
++
++ while (cause) {
++ rc = process_misc_interrupts(idxd, cause);
++ if (rc < 0)
++ break;
++ cause = ioread32(idxd->reg_base + IDXD_INTCAUSE_OFFSET);
++ if (cause)
++ iowrite32(cause, idxd->reg_base + IDXD_INTCAUSE_OFFSET);
++ }
++
+ idxd_unmask_msix_vector(idxd, irq_entry->id);
+ return IRQ_HANDLED;
+ }
+--
+2.27.0
+
--- /dev/null
+From 700bad093b2618f8e8d8b652ea17562823454776 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 18:58:58 +0100
+Subject: drm/sun4i: dw-hdmi: always set clock rate
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 36b53581fe0dc2e25b67de4e58920307f22d195a ]
+
+As expected, HDMI controller clock should always match pixel clock. In
+the past, changing HDMI controller rate would seemingly worsen
+situation. However, that was the result of other bugs which are now
+fixed.
+
+Fix that by removing set_rate quirk and always set clock rate.
+
+Fixes: 40bb9d3147b2 ("drm/sun4i: Add support for H6 DW HDMI controller")
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Tested-by: Andre Heider <a.heider@gmail.com>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-4-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 4 +---
+ drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h | 1 -
+ 2 files changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+index 92add2cef2e7d..23773a5e0650b 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+@@ -21,8 +21,7 @@ static void sun8i_dw_hdmi_encoder_mode_set(struct drm_encoder *encoder,
+ {
+ struct sun8i_dw_hdmi *hdmi = encoder_to_sun8i_dw_hdmi(encoder);
+
+- if (hdmi->quirks->set_rate)
+- clk_set_rate(hdmi->clk_tmds, mode->crtc_clock * 1000);
++ clk_set_rate(hdmi->clk_tmds, mode->crtc_clock * 1000);
+ }
+
+ static const struct drm_encoder_helper_funcs
+@@ -295,7 +294,6 @@ static int sun8i_dw_hdmi_remove(struct platform_device *pdev)
+
+ static const struct sun8i_dw_hdmi_quirks sun8i_a83t_quirks = {
+ .mode_valid = sun8i_dw_hdmi_mode_valid_a83t,
+- .set_rate = true,
+ };
+
+ static const struct sun8i_dw_hdmi_quirks sun50i_h6_quirks = {
+diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h
+index d983746fa194c..d4b55af0592f8 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h
++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h
+@@ -179,7 +179,6 @@ struct sun8i_dw_hdmi_quirks {
+ enum drm_mode_status (*mode_valid)(struct dw_hdmi *hdmi, void *data,
+ const struct drm_display_info *info,
+ const struct drm_display_mode *mode);
+- unsigned int set_rate : 1;
+ unsigned int use_drm_infoframe : 1;
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 119d7b0498e530645ef7b5723119fad6e747cd00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 18:59:00 +0100
+Subject: drm/sun4i: dw-hdmi: Fix max. frequency for H6
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 1926a0508d8947cf081280d85ff035300dc71da7 ]
+
+It turns out that reasoning for lowering max. supported frequency is
+wrong. Scrambling works just fine. Several now fixed bugs prevented
+proper functioning, even with rates lower than 340 MHz. Issues were just
+more pronounced with higher frequencies.
+
+Fix that by allowing max. supported frequency in HW and fix the comment.
+
+Fixes: cd9063757a22 ("drm/sun4i: DW HDMI: Lower max. supported rate for H6")
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Tested-by: Andre Heider <a.heider@gmail.com>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-6-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+index 23773a5e0650b..bbdfd5e26ec88 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+@@ -47,11 +47,9 @@ sun8i_dw_hdmi_mode_valid_h6(struct dw_hdmi *hdmi, void *data,
+ {
+ /*
+ * Controller support maximum of 594 MHz, which correlates to
+- * 4K@60Hz 4:4:4 or RGB. However, for frequencies greater than
+- * 340 MHz scrambling has to be enabled. Because scrambling is
+- * not yet implemented, just limit to 340 MHz for now.
++ * 4K@60Hz 4:4:4 or RGB.
+ */
+- if (mode->clock > 340000)
++ if (mode->clock > 594000)
+ return MODE_CLOCK_HIGH;
+
+ return MODE_OK;
+--
+2.27.0
+
--- /dev/null
+From a374fbccf265f15815e42936495caa48874b6b68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 18:58:59 +0100
+Subject: drm/sun4i: Fix H6 HDMI PHY configuration
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 6a155216c48f2f65c8dcb02c4c27549c170d24a9 ]
+
+As it turns out, vendor HDMI PHY driver for H6 has a pretty big table
+of predefined values for various pixel clocks. However, most of them are
+not useful/tested because they come from reference driver code. Vendor
+PHY driver is concerned with only few of those, namely 27 MHz, 74.25
+MHz, 148.5 MHz, 297 MHz and 594 MHz. These are all frequencies for
+standard CEA modes.
+
+Fix sun50i_h6_cur_ctr and sun50i_h6_phy_config with the values only for
+aforementioned frequencies.
+
+Table sun50i_h6_mpll_cfg doesn't need to be changed because values are
+actually frequency dependent and not so much SoC dependent. See i.MX6
+documentation for explanation of those values for similar PHY.
+
+Fixes: c71c9b2fee17 ("drm/sun4i: Add support for Synopsys HDMI PHY")
+Tested-by: Andre Heider <a.heider@gmail.com>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-5-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 26 +++++++++-----------------
+ 1 file changed, 9 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+index 35c2133724e2d..9994edf675096 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
++++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+@@ -104,29 +104,21 @@ static const struct dw_hdmi_mpll_config sun50i_h6_mpll_cfg[] = {
+
+ static const struct dw_hdmi_curr_ctrl sun50i_h6_cur_ctr[] = {
+ /* pixelclk bpp8 bpp10 bpp12 */
+- { 25175000, { 0x0000, 0x0000, 0x0000 }, },
+ { 27000000, { 0x0012, 0x0000, 0x0000 }, },
+- { 59400000, { 0x0008, 0x0008, 0x0008 }, },
+- { 72000000, { 0x0008, 0x0008, 0x001b }, },
+- { 74250000, { 0x0013, 0x0013, 0x0013 }, },
+- { 90000000, { 0x0008, 0x001a, 0x001b }, },
+- { 118800000, { 0x001b, 0x001a, 0x001b }, },
+- { 144000000, { 0x001b, 0x001a, 0x0034 }, },
+- { 180000000, { 0x001b, 0x0033, 0x0034 }, },
+- { 216000000, { 0x0036, 0x0033, 0x0034 }, },
+- { 237600000, { 0x0036, 0x0033, 0x001b }, },
+- { 288000000, { 0x0036, 0x001b, 0x001b }, },
+- { 297000000, { 0x0019, 0x001b, 0x0019 }, },
+- { 330000000, { 0x0036, 0x001b, 0x001b }, },
+- { 594000000, { 0x003f, 0x001b, 0x001b }, },
++ { 74250000, { 0x0013, 0x001a, 0x001b }, },
++ { 148500000, { 0x0019, 0x0033, 0x0034 }, },
++ { 297000000, { 0x0019, 0x001b, 0x001b }, },
++ { 594000000, { 0x0010, 0x001b, 0x001b }, },
+ { ~0UL, { 0x0000, 0x0000, 0x0000 }, }
+ };
+
+ static const struct dw_hdmi_phy_config sun50i_h6_phy_config[] = {
+ /*pixelclk symbol term vlev*/
+- { 74250000, 0x8009, 0x0004, 0x0232},
+- { 148500000, 0x8029, 0x0004, 0x0273},
+- { 594000000, 0x8039, 0x0004, 0x014a},
++ { 27000000, 0x8009, 0x0007, 0x02b0 },
++ { 74250000, 0x8009, 0x0006, 0x022d },
++ { 148500000, 0x8029, 0x0006, 0x0270 },
++ { 297000000, 0x8039, 0x0005, 0x01ab },
++ { 594000000, 0x8029, 0x0000, 0x008a },
+ { ~0UL, 0x0000, 0x0000, 0x0000}
+ };
+
+--
+2.27.0
+
--- /dev/null
+From abef385d32a7bfde3136f7b12335dac969d733d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 18:58:57 +0100
+Subject: drm/sun4i: tcon: set sync polarity for tcon1 channel
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 50791f5d7b6a14b388f46c8885f71d1b98216d1d ]
+
+Channel 1 has polarity bits for vsync and hsync signals but driver never
+sets them. It turns out that with pre-HDMI2 controllers seemingly there
+is no issue if polarity is not set. However, with HDMI2 controllers
+(H6) there often comes to de-synchronization due to phase shift. This
+causes flickering screen. It's safe to assume that similar issues might
+happen also with pre-HDMI2 controllers.
+
+Solve issue with setting vsync and hsync polarity. Note that display
+stacks with tcon top have polarity bits actually in tcon0 polarity
+register.
+
+Fixes: 9026e0d122ac ("drm: Add Allwinner A10 Display Engine support")
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Tested-by: Andre Heider <a.heider@gmail.com>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210209175900.7092-3-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_tcon.c | 25 +++++++++++++++++++++++++
+ drivers/gpu/drm/sun4i/sun4i_tcon.h | 6 ++++++
+ 2 files changed, 31 insertions(+)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+index eaaf5d70e3529..1e643bc7e786a 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+@@ -689,6 +689,30 @@ static void sun4i_tcon1_mode_set(struct sun4i_tcon *tcon,
+ SUN4I_TCON1_BASIC5_V_SYNC(vsync) |
+ SUN4I_TCON1_BASIC5_H_SYNC(hsync));
+
++ /* Setup the polarity of multiple signals */
++ if (tcon->quirks->polarity_in_ch0) {
++ val = 0;
++
++ if (mode->flags & DRM_MODE_FLAG_PHSYNC)
++ val |= SUN4I_TCON0_IO_POL_HSYNC_POSITIVE;
++
++ if (mode->flags & DRM_MODE_FLAG_PVSYNC)
++ val |= SUN4I_TCON0_IO_POL_VSYNC_POSITIVE;
++
++ regmap_write(tcon->regs, SUN4I_TCON0_IO_POL_REG, val);
++ } else {
++ /* according to vendor driver, this bit must be always set */
++ val = SUN4I_TCON1_IO_POL_UNKNOWN;
++
++ if (mode->flags & DRM_MODE_FLAG_PHSYNC)
++ val |= SUN4I_TCON1_IO_POL_HSYNC_POSITIVE;
++
++ if (mode->flags & DRM_MODE_FLAG_PVSYNC)
++ val |= SUN4I_TCON1_IO_POL_VSYNC_POSITIVE;
++
++ regmap_write(tcon->regs, SUN4I_TCON1_IO_POL_REG, val);
++ }
++
+ /* Map output pins to channel 1 */
+ regmap_update_bits(tcon->regs, SUN4I_TCON_GCTL_REG,
+ SUN4I_TCON_GCTL_IOMAP_MASK,
+@@ -1517,6 +1541,7 @@ static const struct sun4i_tcon_quirks sun8i_a83t_tv_quirks = {
+
+ static const struct sun4i_tcon_quirks sun8i_r40_tv_quirks = {
+ .has_channel_1 = true,
++ .polarity_in_ch0 = true,
+ .set_mux = sun8i_r40_tcon_tv_set_mux,
+ };
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.h b/drivers/gpu/drm/sun4i/sun4i_tcon.h
+index cfbf4e6c16799..ee555318e3c2f 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.h
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h
+@@ -153,6 +153,11 @@
+ #define SUN4I_TCON1_BASIC5_V_SYNC(height) (((height) - 1) & 0x3ff)
+
+ #define SUN4I_TCON1_IO_POL_REG 0xf0
++/* there is no documentation about this bit */
++#define SUN4I_TCON1_IO_POL_UNKNOWN BIT(26)
++#define SUN4I_TCON1_IO_POL_HSYNC_POSITIVE BIT(25)
++#define SUN4I_TCON1_IO_POL_VSYNC_POSITIVE BIT(24)
++
+ #define SUN4I_TCON1_IO_TRI_REG 0xf4
+
+ #define SUN4I_TCON_ECC_FIFO_REG 0xf8
+@@ -235,6 +240,7 @@ struct sun4i_tcon_quirks {
+ bool needs_de_be_mux; /* sun6i needs mux to select backend */
+ bool needs_edp_reset; /* a80 edp reset needed for tcon0 access */
+ bool supports_lvds; /* Does the TCON support an LVDS output? */
++ bool polarity_in_ch0; /* some tcon1 channels have polarity bits in tcon0 pol register */
+ u8 dclk_min_div; /* minimum divider for TCON0 DCLK */
+
+ /* callback to handle tcon muxing options */
+--
+2.27.0
+
--- /dev/null
+From 888ad067c1a92dbb2c0d736baac8e81165c1de63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 17:06:47 +0100
+Subject: drm/vc4: hvs: Fix buffer overflow with the dlist handling
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit facd93f4285c405f9a91b05166147cb39e860666 ]
+
+Commit 0a038c1c29a7 ("drm/vc4: Move LBM creation out of
+vc4_plane_mode_set()") changed the LBM allocation logic from first
+allocating the LBM memory for the plane to running mode_set,
+adding a gap in the LBM, and then running the dlist allocation filling
+that gap.
+
+The gap was introduced by incrementing the dlist array index, but was
+never checking whether or not we were over the array length, leading
+eventually to memory corruptions if we ever crossed this limit.
+
+vc4_dlist_write had that logic though, and was reallocating a larger
+dlist array when reaching the end of the buffer. Let's share the logic
+between both functions.
+
+Cc: Boris Brezillon <boris.brezillon@collabora.com>
+Cc: Eric Anholt <eric@anholt.net>
+Fixes: 0a038c1c29a7 ("drm/vc4: Move LBM creation out of vc4_plane_mode_set()")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210129160647.128373-1-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
+index 5612cab552270..af4b8944a6032 100644
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -220,7 +220,7 @@ static void vc4_plane_reset(struct drm_plane *plane)
+ __drm_atomic_helper_plane_reset(plane, &vc4_state->base);
+ }
+
+-static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val)
++static void vc4_dlist_counter_increment(struct vc4_plane_state *vc4_state)
+ {
+ if (vc4_state->dlist_count == vc4_state->dlist_size) {
+ u32 new_size = max(4u, vc4_state->dlist_count * 2);
+@@ -235,7 +235,15 @@ static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val)
+ vc4_state->dlist_size = new_size;
+ }
+
+- vc4_state->dlist[vc4_state->dlist_count++] = val;
++ vc4_state->dlist_count++;
++}
++
++static void vc4_dlist_write(struct vc4_plane_state *vc4_state, u32 val)
++{
++ unsigned int idx = vc4_state->dlist_count;
++
++ vc4_dlist_counter_increment(vc4_state);
++ vc4_state->dlist[idx] = val;
+ }
+
+ /* Returns the scl0/scl1 field based on whether the dimensions need to
+@@ -978,8 +986,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
+ * be set when calling vc4_plane_allocate_lbm().
+ */
+ if (vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
+- vc4_state->y_scaling[1] != VC4_SCALING_NONE)
+- vc4_state->lbm_offset = vc4_state->dlist_count++;
++ vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
++ vc4_state->lbm_offset = vc4_state->dlist_count;
++ vc4_dlist_counter_increment(vc4_state);
++ }
+
+ if (num_planes > 1) {
+ /* Emit Cb/Cr as channel 0 and Y as channel
+--
+2.27.0
+
--- /dev/null
+From b0eecfa1ed57da5333a0ed5501c637b5f7e00fd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 13:42:07 -0800
+Subject: firmware_loader: align .builtin_fw to 8
+
+From: Fangrui Song <maskray@google.com>
+
+[ Upstream commit 793f49a87aae24e5bcf92ad98d764153fc936570 ]
+
+arm64 references the start address of .builtin_fw (__start_builtin_fw)
+with a pair of R_AARCH64_ADR_PREL_PG_HI21/R_AARCH64_LDST64_ABS_LO12_NC
+relocations. The compiler is allowed to emit the
+R_AARCH64_LDST64_ABS_LO12_NC relocation because struct builtin_fw in
+include/linux/firmware.h is 8-byte aligned.
+
+The R_AARCH64_LDST64_ABS_LO12_NC relocation requires the address to be a
+multiple of 8, which may not be the case if .builtin_fw is empty.
+Unconditionally align .builtin_fw to fix the linker error. 32-bit
+architectures could use ALIGN(4) but that would add unnecessary
+complexity, so just use ALIGN(8).
+
+Link: https://lkml.kernel.org/r/20201208054646.2913063-1-maskray@google.com
+Link: https://github.com/ClangBuiltLinux/linux/issues/1204
+Fixes: 5658c76 ("firmware: allow firmware files to be built into kernel image")
+Signed-off-by: Fangrui Song <maskray@google.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Tested-by: Nick Desaulniers <ndesaulniers@google.com>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/vmlinux.lds.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index b2b3d81b1535a..b97c628ad91ff 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -459,7 +459,7 @@
+ } \
+ \
+ /* Built-in firmware blobs */ \
+- .builtin_fw : AT(ADDR(.builtin_fw) - LOAD_OFFSET) { \
++ .builtin_fw : AT(ADDR(.builtin_fw) - LOAD_OFFSET) ALIGN(8) { \
+ __start_builtin_fw = .; \
+ KEEP(*(.builtin_fw)) \
+ __end_builtin_fw = .; \
+--
+2.27.0
+
--- /dev/null
+From f28388e14af94965638f195c4ac929413ec4ff18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 20:52:54 -0800
+Subject: h8300: fix PREEMPTION build, TI_PRE_COUNT undefined
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit ade9679c159d5bbe14fb7e59e97daf6062872e2b ]
+
+Fix a build error for undefined 'TI_PRE_COUNT' by adding it to
+asm-offsets.c.
+
+ h8300-linux-ld: arch/h8300/kernel/entry.o: in function `resume_kernel': (.text+0x29a): undefined reference to `TI_PRE_COUNT'
+
+Link: https://lkml.kernel.org/r/20210212021650.22740-1-rdunlap@infradead.org
+Fixes: df2078b8daa7 ("h8300: Low level entry")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/h8300/kernel/asm-offsets.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/h8300/kernel/asm-offsets.c b/arch/h8300/kernel/asm-offsets.c
+index 85e60509f0a83..d4b53af657c84 100644
+--- a/arch/h8300/kernel/asm-offsets.c
++++ b/arch/h8300/kernel/asm-offsets.c
+@@ -63,6 +63,9 @@ int main(void)
+ OFFSET(TI_FLAGS, thread_info, flags);
+ OFFSET(TI_CPU, thread_info, cpu);
+ OFFSET(TI_PRE, thread_info, preempt_count);
++#ifdef CONFIG_PREEMPTION
++ DEFINE(TI_PRE_COUNT, offsetof(struct thread_info, preempt_count));
++#endif
+
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From d880ab89f1862f603b5b8bf36cf4cfcaa74341bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Feb 2021 12:36:02 +0100
+Subject: hv_netvsc: Reset the RSC count if NVSP_STAT_FAIL in netvsc_receive()
+
+From: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
+
+[ Upstream commit 12bc8dfb83b5292fe387b795210018b7632ee08b ]
+
+Commit 44144185951a0f ("hv_netvsc: Add validation for untrusted Hyper-V
+values") added validation to rndis_filter_receive_data() (and
+rndis_filter_receive()) which introduced NVSP_STAT_FAIL-scenarios where
+the count is not updated/reset. Fix this omission, and prevent similar
+scenarios from occurring in the future.
+
+Reported-by: Juan Vazquez <juvazq@microsoft.com>
+Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
+Fixes: 44144185951a0f ("hv_netvsc: Add validation for untrusted Hyper-V values")
+Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Link: https://lore.kernel.org/r/20210203113602.558916-1-parri.andrea@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/netvsc.c | 5 ++++-
+ drivers/net/hyperv/rndis_filter.c | 2 --
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index 0c3de94b51787..6a7ab930ef70d 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -1253,8 +1253,11 @@ static int netvsc_receive(struct net_device *ndev,
+ ret = rndis_filter_receive(ndev, net_device,
+ nvchan, data, buflen);
+
+- if (unlikely(ret != NVSP_STAT_SUCCESS))
++ if (unlikely(ret != NVSP_STAT_SUCCESS)) {
++ /* Drop incomplete packet */
++ nvchan->rsc.cnt = 0;
+ status = NVSP_STAT_FAIL;
++ }
+ }
+
+ enq_receive_complete(ndev, net_device, q_idx,
+diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
+index b22e47bcfeca1..90bc0008fa2fd 100644
+--- a/drivers/net/hyperv/rndis_filter.c
++++ b/drivers/net/hyperv/rndis_filter.c
+@@ -508,8 +508,6 @@ static int rndis_filter_receive_data(struct net_device *ndev,
+ return ret;
+
+ drop:
+- /* Drop incomplete packet */
+- nvchan->rsc.cnt = 0;
+ return NVSP_STAT_FAIL;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 2dd5774047b20787baa7ccddfbe5f495275f8579 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 09:51:40 +0100
+Subject: i2c: stm32f7: fix configuration of the digital filter
+
+From: Alain Volmat <alain.volmat@foss.st.com>
+
+[ Upstream commit 3d6a3d3a2a7a3a60a824e7c04e95fd50dec57812 ]
+
+The digital filter related computation are present in the driver
+however the programming of the filter within the IP is missing.
+The maximum value for the DNF is wrong and should be 15 instead of 16.
+
+Fixes: aeb068c57214 ("i2c: i2c-stm32f7: add driver")
+
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Signed-off-by: Pierre-Yves MORDRET <pierre-yves.mordret@foss.st.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-stm32f7.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index f41f51a176a1d..6747353345475 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -57,6 +57,8 @@
+ #define STM32F7_I2C_CR1_RXDMAEN BIT(15)
+ #define STM32F7_I2C_CR1_TXDMAEN BIT(14)
+ #define STM32F7_I2C_CR1_ANFOFF BIT(12)
++#define STM32F7_I2C_CR1_DNF_MASK GENMASK(11, 8)
++#define STM32F7_I2C_CR1_DNF(n) (((n) & 0xf) << 8)
+ #define STM32F7_I2C_CR1_ERRIE BIT(7)
+ #define STM32F7_I2C_CR1_TCIE BIT(6)
+ #define STM32F7_I2C_CR1_STOPIE BIT(5)
+@@ -160,7 +162,7 @@ enum {
+ };
+
+ #define STM32F7_I2C_DNF_DEFAULT 0
+-#define STM32F7_I2C_DNF_MAX 16
++#define STM32F7_I2C_DNF_MAX 15
+
+ #define STM32F7_I2C_ANALOG_FILTER_ENABLE 1
+ #define STM32F7_I2C_ANALOG_FILTER_DELAY_MIN 50 /* ns */
+@@ -725,6 +727,13 @@ static void stm32f7_i2c_hw_config(struct stm32f7_i2c_dev *i2c_dev)
+ else
+ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1,
+ STM32F7_I2C_CR1_ANFOFF);
++
++ /* Program the Digital Filter */
++ stm32f7_i2c_clr_bits(i2c_dev->base + STM32F7_I2C_CR1,
++ STM32F7_I2C_CR1_DNF_MASK);
++ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1,
++ STM32F7_I2C_CR1_DNF(i2c_dev->setup.dnf));
++
+ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1,
+ STM32F7_I2C_CR1_PE);
+ }
+--
+2.27.0
+
--- /dev/null
+From ed7bd75552b9a8e7ff09752f3d2acbaa0f398901 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 21:08:02 -0800
+Subject: ibmvnic: Clear failover_pending if unable to schedule
+
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+
+[ Upstream commit ef66a1eace968ff22a35f45e6e8ec36b668b6116 ]
+
+Normally we clear the failover_pending flag when processing the reset.
+But if we are unable to schedule a failover reset we must clear the
+flag ourselves. We could fail to schedule the reset if we are in PROBING
+state (eg: when booting via kexec) or because we could not allocate memory.
+
+Thanks to Cris Forno for helping isolate the problem and for testing.
+
+Fixes: 1d8504937478 ("powerpc/vnic: Extend "failover pending" window")
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Tested-by: Cristobal Forno <cforno12@linux.ibm.com>
+Link: https://lore.kernel.org/r/20210203050802.680772-1-sukadev@linux.ibm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 2f281d0f98070..ee16e0e4fa5fc 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -4813,7 +4813,22 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq,
+ complete(&adapter->init_done);
+ adapter->init_done_rc = -EIO;
+ }
+- ibmvnic_reset(adapter, VNIC_RESET_FAILOVER);
++ rc = ibmvnic_reset(adapter, VNIC_RESET_FAILOVER);
++ if (rc && rc != -EBUSY) {
++ /* We were unable to schedule the failover
++ * reset either because the adapter was still
++ * probing (eg: during kexec) or we could not
++ * allocate memory. Clear the failover_pending
++ * flag since no one else will. We ignore
++ * EBUSY because it means either FAILOVER reset
++ * is already scheduled or the adapter is
++ * being removed.
++ */
++ netdev_err(netdev,
++ "Error %ld scheduling failover reset\n",
++ rc);
++ adapter->failover_pending = false;
++ }
+ break;
+ case IBMVNIC_CRQ_INIT_COMPLETE:
+ dev_info(dev, "Partner initialization complete\n");
+--
+2.27.0
+
--- /dev/null
+From 88716ab83d2337c4917ac5da8ef47543033d6971 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 12:02:13 +0100
+Subject: mt76: dma: fix a possible memory leak in mt76_add_fragment()
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 93a1d4791c10d443bc67044def7efee2991d48b7 ]
+
+Fix a memory leak in mt76_add_fragment routine returning the buffer
+to the page_frag_cache when we receive a new fragment and the
+skb_shared_info frag array is full.
+
+Fixes: b102f0c522cf6 ("mt76: fix array overflow on receiving too many fragments for a packet")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Acked-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/4f9dd73407da88b2a552517ce8db242d86bf4d5c.1611616130.git.lorenzo@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/dma.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index 145e839fea4e5..917617aad8d3c 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -519,15 +519,17 @@ static void
+ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+ int len, bool more)
+ {
+- struct page *page = virt_to_head_page(data);
+- int offset = data - page_address(page);
+ struct sk_buff *skb = q->rx_head;
+ struct skb_shared_info *shinfo = skb_shinfo(skb);
+
+ if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) {
+- offset += q->buf_offset;
++ struct page *page = virt_to_head_page(data);
++ int offset = data - page_address(page) + q->buf_offset;
++
+ skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len,
+ q->buf_size);
++ } else {
++ skb_free_frag(data);
+ }
+
+ if (more)
+--
+2.27.0
+
--- /dev/null
+From 7a40641c732dceaddacbe2410fde526fd56d532d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 19:36:27 +0200
+Subject: net: dsa: felix: implement port flushing on .phylink_mac_link_down
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit eb4733d7cffc547e08fe5a216e4f03663bb71108 ]
+
+There are several issues which may be seen when the link goes down while
+forwarding traffic, all of which can be attributed to the fact that the
+port flushing procedure from the reference manual was not closely
+followed.
+
+With flow control enabled on both the ingress port and the egress port,
+it may happen when a link goes down that Ethernet packets are in flight.
+In flow control mode, frames are held back and not dropped. When there
+is enough traffic in flight (example: iperf3 TCP), then the ingress port
+might enter congestion and never exit that state. This is a problem,
+because it is the egress port's link that went down, and that has caused
+the inability of the ingress port to send packets to any other port.
+This is solved by flushing the egress port's queues when it goes down.
+
+There is also a problem when performing stream splitting for
+IEEE 802.1CB traffic (not yet upstream, but a sort of multicast,
+basically). There, if one port from the destination ports mask goes
+down, splitting the stream towards the other destinations will no longer
+be performed. This can be traced down to this line:
+
+ ocelot_port_writel(ocelot_port, 0, DEV_MAC_ENA_CFG);
+
+which should have been instead, as per the reference manual:
+
+ ocelot_port_rmwl(ocelot_port, 0, DEV_MAC_ENA_CFG_RX_ENA,
+ DEV_MAC_ENA_CFG);
+
+Basically only DEV_MAC_ENA_CFG_RX_ENA should be disabled, but not
+DEV_MAC_ENA_CFG_TX_ENA - I don't have further insight into why that is
+the case, but apparently multicasting to several ports will cause issues
+if at least one of them doesn't have DEV_MAC_ENA_CFG_TX_ENA set.
+
+I am not sure what the state of the Ocelot VSC7514 driver is, but
+probably not as bad as Felix/Seville, since VSC7514 uses phylib and has
+the following in ocelot_adjust_link:
+
+ if (!phydev->link)
+ return;
+
+therefore the port is not really put down when the link is lost, unlike
+the DSA drivers which use .phylink_mac_link_down for that.
+
+Nonetheless, I put ocelot_port_flush() in the common ocelot.c because it
+needs to access some registers from drivers/net/ethernet/mscc/ocelot_rew.h
+which are not exported in include/soc/mscc/ and a bugfix patch should
+probably not move headers around.
+
+Fixes: bdeced75b13f ("net: dsa: felix: Add PCS operations for PHYLINK")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/ocelot/felix.c | 17 ++++++++-
+ drivers/net/ethernet/mscc/ocelot.c | 54 +++++++++++++++++++++++++++
+ drivers/net/ethernet/mscc/ocelot_io.c | 8 ++++
+ include/soc/mscc/ocelot.h | 2 +
+ 4 files changed, 80 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
+index c444ef3da3e24..89d7c9b231863 100644
+--- a/drivers/net/dsa/ocelot/felix.c
++++ b/drivers/net/dsa/ocelot/felix.c
+@@ -214,9 +214,24 @@ static void felix_phylink_mac_link_down(struct dsa_switch *ds, int port,
+ {
+ struct ocelot *ocelot = ds->priv;
+ struct ocelot_port *ocelot_port = ocelot->ports[port];
++ int err;
++
++ ocelot_port_rmwl(ocelot_port, 0, DEV_MAC_ENA_CFG_RX_ENA,
++ DEV_MAC_ENA_CFG);
+
+- ocelot_port_writel(ocelot_port, 0, DEV_MAC_ENA_CFG);
+ ocelot_fields_write(ocelot, port, QSYS_SWITCH_PORT_MODE_PORT_ENA, 0);
++
++ err = ocelot_port_flush(ocelot, port);
++ if (err)
++ dev_err(ocelot->dev, "failed to flush port %d: %d\n",
++ port, err);
++
++ /* Put the port in reset. */
++ ocelot_port_writel(ocelot_port,
++ DEV_CLOCK_CFG_MAC_TX_RST |
++ DEV_CLOCK_CFG_MAC_RX_RST |
++ DEV_CLOCK_CFG_LINK_SPEED(OCELOT_SPEED_1000),
++ DEV_CLOCK_CFG);
+ }
+
+ static void felix_phylink_mac_link_up(struct dsa_switch *ds, int port,
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index d4768dcb6c699..aa400b925b08e 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -348,6 +348,60 @@ static void ocelot_vlan_init(struct ocelot *ocelot)
+ }
+ }
+
++static u32 ocelot_read_eq_avail(struct ocelot *ocelot, int port)
++{
++ return ocelot_read_rix(ocelot, QSYS_SW_STATUS, port);
++}
++
++int ocelot_port_flush(struct ocelot *ocelot, int port)
++{
++ int err, val;
++
++ /* Disable dequeuing from the egress queues */
++ ocelot_rmw_rix(ocelot, QSYS_PORT_MODE_DEQUEUE_DIS,
++ QSYS_PORT_MODE_DEQUEUE_DIS,
++ QSYS_PORT_MODE, port);
++
++ /* Disable flow control */
++ ocelot_fields_write(ocelot, port, SYS_PAUSE_CFG_PAUSE_ENA, 0);
++
++ /* Disable priority flow control */
++ ocelot_fields_write(ocelot, port,
++ QSYS_SWITCH_PORT_MODE_TX_PFC_ENA, 0);
++
++ /* Wait at least the time it takes to receive a frame of maximum length
++ * at the port.
++ * Worst-case delays for 10 kilobyte jumbo frames are:
++ * 8 ms on a 10M port
++ * 800 μs on a 100M port
++ * 80 μs on a 1G port
++ * 32 μs on a 2.5G port
++ */
++ usleep_range(8000, 10000);
++
++ /* Disable half duplex backpressure. */
++ ocelot_rmw_rix(ocelot, 0, SYS_FRONT_PORT_MODE_HDX_MODE,
++ SYS_FRONT_PORT_MODE, port);
++
++ /* Flush the queues associated with the port. */
++ ocelot_rmw_gix(ocelot, REW_PORT_CFG_FLUSH_ENA, REW_PORT_CFG_FLUSH_ENA,
++ REW_PORT_CFG, port);
++
++ /* Enable dequeuing from the egress queues. */
++ ocelot_rmw_rix(ocelot, 0, QSYS_PORT_MODE_DEQUEUE_DIS, QSYS_PORT_MODE,
++ port);
++
++ /* Wait until flushing is complete. */
++ err = read_poll_timeout(ocelot_read_eq_avail, val, !val,
++ 100, 2000000, false, ocelot, port);
++
++ /* Clear flushing again. */
++ ocelot_rmw_gix(ocelot, 0, REW_PORT_CFG_FLUSH_ENA, REW_PORT_CFG, port);
++
++ return err;
++}
++EXPORT_SYMBOL(ocelot_port_flush);
++
+ void ocelot_adjust_link(struct ocelot *ocelot, int port,
+ struct phy_device *phydev)
+ {
+diff --git a/drivers/net/ethernet/mscc/ocelot_io.c b/drivers/net/ethernet/mscc/ocelot_io.c
+index 0acb459484185..ea4e83410fe4d 100644
+--- a/drivers/net/ethernet/mscc/ocelot_io.c
++++ b/drivers/net/ethernet/mscc/ocelot_io.c
+@@ -71,6 +71,14 @@ void ocelot_port_writel(struct ocelot_port *port, u32 val, u32 reg)
+ }
+ EXPORT_SYMBOL(ocelot_port_writel);
+
++void ocelot_port_rmwl(struct ocelot_port *port, u32 val, u32 mask, u32 reg)
++{
++ u32 cur = ocelot_port_readl(port, reg);
++
++ ocelot_port_writel(port, (cur & (~mask)) | val, reg);
++}
++EXPORT_SYMBOL(ocelot_port_rmwl);
++
+ u32 __ocelot_target_read_ix(struct ocelot *ocelot, enum ocelot_target target,
+ u32 reg, u32 offset)
+ {
+diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h
+index 49b46df476f2c..4971b45860a4d 100644
+--- a/include/soc/mscc/ocelot.h
++++ b/include/soc/mscc/ocelot.h
+@@ -703,6 +703,7 @@ struct ocelot_policer {
+ /* I/O */
+ u32 ocelot_port_readl(struct ocelot_port *port, u32 reg);
+ void ocelot_port_writel(struct ocelot_port *port, u32 val, u32 reg);
++void ocelot_port_rmwl(struct ocelot_port *port, u32 val, u32 mask, u32 reg);
+ u32 __ocelot_read_ix(struct ocelot *ocelot, u32 reg, u32 offset);
+ void __ocelot_write_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 offset);
+ void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 mask, u32 reg,
+@@ -731,6 +732,7 @@ int ocelot_get_sset_count(struct ocelot *ocelot, int port, int sset);
+ int ocelot_get_ts_info(struct ocelot *ocelot, int port,
+ struct ethtool_ts_info *info);
+ void ocelot_set_ageing_time(struct ocelot *ocelot, unsigned int msecs);
++int ocelot_port_flush(struct ocelot *ocelot, int port);
+ void ocelot_adjust_link(struct ocelot *ocelot, int port,
+ struct phy_device *phydev);
+ int ocelot_port_vlan_filtering(struct ocelot *ocelot, int port, bool enabled,
+--
+2.27.0
+
--- /dev/null
+From e9ac6d084519e37806fbbb59eb3772229b95cff7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 15:45:11 +0200
+Subject: net: enetc: initialize the RFS and RSS memories
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 07bf34a50e327975b21a9dee64d220c3dcb72ee9 ]
+
+Michael tried to enable Advanced Error Reporting through the ENETC's
+Root Complex Event Collector, and the system started spitting out single
+bit correctable ECC errors coming from the ENETC interfaces:
+
+pcieport 0000:00:1f.0: AER: Multiple Corrected error received: 0000:00:00.0
+fsl_enetc 0000:00:00.0: PCIe Bus Error: severity=Corrected, type=Transaction Layer, (Receiver ID)
+fsl_enetc 0000:00:00.0: device [1957:e100] error status/mask=00004000/00000000
+fsl_enetc 0000:00:00.0: [14] CorrIntErr
+fsl_enetc 0000:00:00.1: PCIe Bus Error: severity=Corrected, type=Transaction Layer, (Receiver ID)
+fsl_enetc 0000:00:00.1: device [1957:e100] error status/mask=00004000/00000000
+fsl_enetc 0000:00:00.1: [14] CorrIntErr
+
+Further investigating the port correctable memory error detect register
+(PCMEDR) shows that these AER errors have an associated SOURCE_ID of 6
+(RFS/RSS):
+
+$ devmem 0x1f8010e10 32
+0xC0000006
+$ devmem 0x1f8050e10 32
+0xC0000006
+
+Discussion with the hardware design engineers reveals that on LS1028A,
+the hardware does not do initialization of that RFS/RSS memory, and that
+software should clear/initialize the entire table before starting to
+operate. That comes as a bit of a surprise, since the driver does not do
+initialization of the RFS memory. Also, the initialization of the
+Receive Side Scaling is done only partially.
+
+Even though the entire ENETC IP has a single shared flow steering
+memory, the flow steering service should returns matches only for TCAM
+entries that are within the range of the Station Interface that is doing
+the search. Therefore, it should be sufficient for a Station Interface
+to initialize all of its own entries in order to avoid any ECC errors,
+and only the Station Interfaces in use should need initialization.
+
+There are Physical Station Interfaces associated with PCIe PFs and
+Virtual Station Interfaces associated with PCIe VFs. We let the PF
+driver initialize the entire port's memory, which includes the RFS
+entries which are going to be used by the VF.
+
+Reported-by: Michael Walle <michael@walle.cc>
+Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Tested-by: Michael Walle <michael@walle.cc>
+Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Link: https://lore.kernel.org/r/20210204134511.2640309-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/freescale/enetc/enetc_hw.h | 2 +
+ .../net/ethernet/freescale/enetc/enetc_pf.c | 59 +++++++++++++++++++
+ 2 files changed, 61 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+index 4cbf1667d7ff4..014ca6ae121f8 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+@@ -196,6 +196,8 @@ enum enetc_bdr_type {TX, RX};
+ #define ENETC_CBS_BW_MASK GENMASK(6, 0)
+ #define ENETC_PTCCBSR1(n) (0x1114 + (n) * 8) /* n = 0 to 7*/
+ #define ENETC_RSSHASH_KEY_SIZE 40
++#define ENETC_PRSSCAPR 0x1404
++#define ENETC_PRSSCAPR_GET_NUM_RSS(val) (BIT((val) & 0xf) * 32)
+ #define ENETC_PRSSK(n) (0x1410 + (n) * 4) /* n = [0..9] */
+ #define ENETC_PSIVLANFMR 0x1700
+ #define ENETC_PSIVLANFMR_VS BIT(0)
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+index 419306342ac51..06514af0df106 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+@@ -1004,6 +1004,51 @@ static void enetc_phylink_destroy(struct enetc_ndev_priv *priv)
+ phylink_destroy(priv->phylink);
+ }
+
++/* Initialize the entire shared memory for the flow steering entries
++ * of this port (PF + VFs)
++ */
++static int enetc_init_port_rfs_memory(struct enetc_si *si)
++{
++ struct enetc_cmd_rfse rfse = {0};
++ struct enetc_hw *hw = &si->hw;
++ int num_rfs, i, err = 0;
++ u32 val;
++
++ val = enetc_port_rd(hw, ENETC_PRFSCAPR);
++ num_rfs = ENETC_PRFSCAPR_GET_NUM_RFS(val);
++
++ for (i = 0; i < num_rfs; i++) {
++ err = enetc_set_fs_entry(si, &rfse, i);
++ if (err)
++ break;
++ }
++
++ return err;
++}
++
++static int enetc_init_port_rss_memory(struct enetc_si *si)
++{
++ struct enetc_hw *hw = &si->hw;
++ int num_rss, err;
++ int *rss_table;
++ u32 val;
++
++ val = enetc_port_rd(hw, ENETC_PRSSCAPR);
++ num_rss = ENETC_PRSSCAPR_GET_NUM_RSS(val);
++ if (!num_rss)
++ return 0;
++
++ rss_table = kcalloc(num_rss, sizeof(*rss_table), GFP_KERNEL);
++ if (!rss_table)
++ return -ENOMEM;
++
++ err = enetc_set_rss_table(si, rss_table, num_rss);
++
++ kfree(rss_table);
++
++ return err;
++}
++
+ static int enetc_pf_probe(struct pci_dev *pdev,
+ const struct pci_device_id *ent)
+ {
+@@ -1058,6 +1103,18 @@ static int enetc_pf_probe(struct pci_dev *pdev,
+ goto err_alloc_si_res;
+ }
+
++ err = enetc_init_port_rfs_memory(si);
++ if (err) {
++ dev_err(&pdev->dev, "Failed to initialize RFS memory\n");
++ goto err_init_port_rfs;
++ }
++
++ err = enetc_init_port_rss_memory(si);
++ if (err) {
++ dev_err(&pdev->dev, "Failed to initialize RSS memory\n");
++ goto err_init_port_rss;
++ }
++
+ err = enetc_alloc_msix(priv);
+ if (err) {
+ dev_err(&pdev->dev, "MSIX alloc failed\n");
+@@ -1086,6 +1143,8 @@ err_phylink_create:
+ enetc_mdiobus_destroy(pf);
+ err_mdiobus_create:
+ enetc_free_msix(priv);
++err_init_port_rss:
++err_init_port_rfs:
+ err_alloc_msix:
+ enetc_free_si_resources(priv);
+ err_alloc_si_res:
+--
+2.27.0
+
--- /dev/null
+From 59b1ae81cab7fedc4d8c678c10762f83c85b2263 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 23:15:41 -0800
+Subject: net: hdlc_x25: Return meaningful error code in x25_open
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 81b8be68ef8e8915d0cc6cedd2ac425c74a24813 ]
+
+It's not meaningful to pass on LAPB error codes to HDLC code or other
+parts of the system, because they will not understand the error codes.
+
+Instead, use system-wide recognizable error codes.
+
+Fixes: f362e5fe0f1f ("wan/hdlc_x25: make lapb params configurable")
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Acked-by: Martin Schiller <ms@dev.tdt.de>
+Link: https://lore.kernel.org/r/20210203071541.86138-1-xie.he.0141@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/hdlc_x25.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
+index f52b9fed05931..34bc53facd11c 100644
+--- a/drivers/net/wan/hdlc_x25.c
++++ b/drivers/net/wan/hdlc_x25.c
+@@ -171,11 +171,11 @@ static int x25_open(struct net_device *dev)
+
+ result = lapb_register(dev, &cb);
+ if (result != LAPB_OK)
+- return result;
++ return -ENOMEM;
+
+ result = lapb_getparms(dev, ¶ms);
+ if (result != LAPB_OK)
+- return result;
++ return -EINVAL;
+
+ if (state(hdlc)->settings.dce)
+ params.mode = params.mode | LAPB_DCE;
+@@ -190,7 +190,7 @@ static int x25_open(struct net_device *dev)
+
+ result = lapb_setparms(dev, ¶ms);
+ if (result != LAPB_OK)
+- return result;
++ return -EINVAL;
+
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From dbf192ec038e115629b3fd34bf20c7df5a54107a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 17:03:07 +0800
+Subject: net: hns3: add a check for index in hclge_get_rss_key()
+
+From: Yufeng Mo <moyufeng@huawei.com>
+
+[ Upstream commit 532cfc0df1e4d68e74522ef4a0dcbf6ebbe68287 ]
+
+The index is received from vf, if use it directly,
+an out-of-bound issue may be caused, so add a check for
+this index before using it in hclge_get_rss_key().
+
+Fixes: a638b1d8cc87 ("net: hns3: fix get VF RSS issue")
+Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+index c997c90371550..9c8004fc9dc4f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+@@ -591,6 +591,17 @@ static void hclge_get_rss_key(struct hclge_vport *vport,
+
+ index = mbx_req->msg.data[0];
+
++ /* Check the query index of rss_hash_key from VF, make sure no
++ * more than the size of rss_hash_key.
++ */
++ if (((index + 1) * HCLGE_RSS_MBX_RESP_LEN) >
++ sizeof(vport[0].rss_hash_key)) {
++ dev_warn(&hdev->pdev->dev,
++ "failed to get the rss hash key, the index(%u) invalid !\n",
++ index);
++ return;
++ }
++
+ memcpy(resp_msg->data,
+ &hdev->vport[0].rss_hash_key[index * HCLGE_RSS_MBX_RESP_LEN],
+ HCLGE_RSS_MBX_RESP_LEN);
+--
+2.27.0
+
--- /dev/null
+From 3b8614e887498680a37e0ffe1b1cf1f8a9a4bc75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 17:03:05 +0800
+Subject: net: hns3: add a check for queue_id in hclge_reset_vf_queue()
+
+From: Yufeng Mo <moyufeng@huawei.com>
+
+[ Upstream commit 67a69f84cab60484f02eb8cbc7a76edffbb28a25 ]
+
+The queue_id is received from vf, if use it directly,
+an out-of-bound issue may be caused, so add a check for
+this queue_id before using it in hclge_reset_vf_queue().
+
+Fixes: 1a426f8b40fc ("net: hns3: fix the VF queue reset flow error")
+Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 4321132a4f630..c40820baf48a6 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -9404,12 +9404,19 @@ int hclge_reset_tqp(struct hnae3_handle *handle, u16 queue_id)
+
+ void hclge_reset_vf_queue(struct hclge_vport *vport, u16 queue_id)
+ {
++ struct hnae3_handle *handle = &vport->nic;
+ struct hclge_dev *hdev = vport->back;
+ int reset_try_times = 0;
+ int reset_status;
+ u16 queue_gid;
+ int ret;
+
++ if (queue_id >= handle->kinfo.num_tqps) {
++ dev_warn(&hdev->pdev->dev, "Invalid vf queue id(%u)\n",
++ queue_id);
++ return;
++ }
++
+ queue_gid = hclge_covert_handle_qid_global(&vport->nic, queue_id);
+
+ ret = hclge_send_reset_tqp_cmd(hdev, queue_gid, true);
+--
+2.27.0
+
--- /dev/null
+From 0649776003cebc1fa8f0b65b426ab7489fa3419a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 17:03:06 +0800
+Subject: net: hns3: add a check for tqp_index in
+ hclge_get_ring_chain_from_mbx()
+
+From: Yufeng Mo <moyufeng@huawei.com>
+
+[ Upstream commit 326334aad024a60f46dc5e7dbe1efe32da3ca66f ]
+
+The tqp_index is received from vf, if use it directly,
+an out-of-bound issue may be caused, so add a check for
+this tqp_index before using it in hclge_get_ring_chain_from_mbx().
+
+Fixes: 84e095d64ed9 ("net: hns3: Change PF to add ring-vect binding & resetQ to mailbox")
+Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+index 3ab6db2588d31..c997c90371550 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+@@ -158,21 +158,31 @@ static int hclge_get_ring_chain_from_mbx(
+ struct hclge_vport *vport)
+ {
+ struct hnae3_ring_chain_node *cur_chain, *new_chain;
++ struct hclge_dev *hdev = vport->back;
+ int ring_num;
+- int i = 0;
++ int i;
+
+ ring_num = req->msg.ring_num;
+
+ if (ring_num > HCLGE_MBX_MAX_RING_CHAIN_PARAM_NUM)
+ return -ENOMEM;
+
++ for (i = 0; i < ring_num; i++) {
++ if (req->msg.param[i].tqp_index >= vport->nic.kinfo.rss_size) {
++ dev_err(&hdev->pdev->dev, "tqp index(%u) is out of range(0-%u)\n",
++ req->msg.param[i].tqp_index,
++ vport->nic.kinfo.rss_size - 1);
++ return -EINVAL;
++ }
++ }
++
+ hnae3_set_bit(ring_chain->flag, HNAE3_RING_TYPE_B,
+- req->msg.param[i].ring_type);
++ req->msg.param[0].ring_type);
+ ring_chain->tqp_index =
+ hclge_get_queue_id(vport->nic.kinfo.tqp
+- [req->msg.param[i].tqp_index]);
++ [req->msg.param[0].tqp_index]);
+ hnae3_set_field(ring_chain->int_gl_idx, HNAE3_RING_GL_IDX_M,
+- HNAE3_RING_GL_IDX_S, req->msg.param[i].int_gl_index);
++ HNAE3_RING_GL_IDX_S, req->msg.param[0].int_gl_index);
+
+ cur_chain = ring_chain;
+
+--
+2.27.0
+
--- /dev/null
+From 61fdd785b8df62daa6c0cb94fe88145500b722ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Feb 2021 19:06:55 -0600
+Subject: net: ipa: set error code in gsi_channel_setup()
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 1d23a56b0296d29e7047b41fe0a42a001036160d ]
+
+In gsi_channel_setup(), we check to see if the configuration data
+contains any information about channels that are not supported by
+the hardware. If one is found, we abort the setup process, but
+the error code (ret) is not set in this case. Fix this bug.
+
+Fixes: 650d1603825d8 ("soc: qcom: ipa: the generic software interface")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Alex Elder <elder@linaro.org>
+Link: https://lore.kernel.org/r/20210204010655.15619-1-elder@linaro.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipa/gsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ipa/gsi.c b/drivers/net/ipa/gsi.c
+index 4a68da7115d19..2a65efd3e8da9 100644
+--- a/drivers/net/ipa/gsi.c
++++ b/drivers/net/ipa/gsi.c
+@@ -1573,6 +1573,7 @@ static int gsi_channel_setup(struct gsi *gsi, bool legacy)
+ if (!channel->gsi)
+ continue; /* Ignore uninitialized channels */
+
++ ret = -EINVAL;
+ dev_err(gsi->dev, "channel %u not supported by hardware\n",
+ channel_id - 1);
+ channel_id = gsi->channel_count;
+--
+2.27.0
+
--- /dev/null
+From 24742f3976c97ab02cda64ada1daa78f6426fafb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 22:03:16 +0800
+Subject: net: stmmac: set TxQ mode back to DCB after disabling CBS
+
+From: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
+
+[ Upstream commit f317e2ea8c88737aa36228167b2292baef3f0430 ]
+
+When disable CBS, mode_to_use parameter is not updated even the operation
+mode of Tx Queue is changed to Data Centre Bridging (DCB). Therefore,
+when tc_setup_cbs() function is called to re-enable CBS, the operation
+mode of Tx Queue remains at DCB, which causing CBS fails to work.
+
+This patch updates the value of mode_to_use parameter to MTL_QUEUE_DCB
+after operation mode of Tx Queue is changed to DCB in stmmac_dma_qmode()
+callback function.
+
+Fixes: 1f705bc61aee ("net: stmmac: Add support for CBS QDISC")
+Suggested-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
+Signed-off-by: Song, Yoong Siang <yoong.siang.song@intel.com>
+Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Link: https://lore.kernel.org/r/1612447396-20351-1-git-send-email-yoong.siang.song@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+index 06553d028d746..6088071cb1923 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -330,7 +330,12 @@ static int tc_setup_cbs(struct stmmac_priv *priv,
+
+ priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_AVB;
+ } else if (!qopt->enable) {
+- return stmmac_dma_qmode(priv, priv->ioaddr, queue, MTL_QUEUE_DCB);
++ ret = stmmac_dma_qmode(priv, priv->ioaddr, queue,
++ MTL_QUEUE_DCB);
++ if (ret)
++ return ret;
++
++ priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB;
+ }
+
+ /* Port Transmit Rate and Speed Divider */
+--
+2.27.0
+
--- /dev/null
+From 7760b03753f29c63c2726311c5c66027c440b275 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 12:56:43 +0100
+Subject: netfilter: conntrack: skip identical origin tuple in same zone only
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 07998281c268592963e1cd623fe6ab0270b65ae4 ]
+
+The origin skip check needs to re-test the zone. Else, we might skip
+a colliding tuple in the reply direction.
+
+This only occurs when using 'directional zones' where origin tuples
+reside in different zones but the reply tuples share the same zone.
+
+This causes the new conntrack entry to be dropped at confirmation time
+because NAT clash resolution was elided.
+
+Fixes: 4e35c1cb9460240 ("netfilter: nf_nat: skip nat clash resolution for same-origin entries")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 234b7cab37c30..ff0168736f6ea 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1229,7 +1229,8 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
+ * Let nf_ct_resolve_clash() deal with this later.
+ */
+ if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+- &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple))
++ &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple) &&
++ nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL))
+ continue;
+
+ NF_CT_STAT_INC_ATOMIC(net, found);
+--
+2.27.0
+
--- /dev/null
+From cd02e627cd67f64ab6bacc63b93fa5b166644c40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 18:01:16 +0100
+Subject: netfilter: flowtable: fix tcp and udp header checksum update
+
+From: Sven Auhagen <sven.auhagen@voleatech.de>
+
+[ Upstream commit 8d6bca156e47d68551750a384b3ff49384c67be3 ]
+
+When updating the tcp or udp header checksum on port nat the function
+inet_proto_csum_replace2 with the last parameter pseudohdr as true.
+This leads to an error in the case that GRO is used and packets are
+split up in GSO. The tcp or udp checksum of all packets is incorrect.
+
+The error is probably masked due to the fact the most network driver
+implement tcp/udp checksum offloading. It also only happens when GRO is
+applied and not on single packets.
+
+The error is most visible when using a pppoe connection which is not
+triggering the tcp/udp checksum offload.
+
+Fixes: ac2a66665e23 ("netfilter: add generic flow table infrastructure")
+Signed-off-by: Sven Auhagen <sven.auhagen@voleatech.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_flow_table_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index 513f78db3cb2f..4a4acbba78ff7 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -399,7 +399,7 @@ static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff,
+ return -1;
+
+ tcph = (void *)(skb_network_header(skb) + thoff);
+- inet_proto_csum_replace2(&tcph->check, skb, port, new_port, true);
++ inet_proto_csum_replace2(&tcph->check, skb, port, new_port, false);
+
+ return 0;
+ }
+@@ -415,7 +415,7 @@ static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff,
+ udph = (void *)(skb_network_header(skb) + thoff);
+ if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
+ inet_proto_csum_replace2(&udph->check, skb, port,
+- new_port, true);
++ new_port, false);
+ if (!udph->check)
+ udph->check = CSUM_MANGLED_0;
+ }
+--
+2.27.0
+
--- /dev/null
+From d56326dca321dbef2990181245ce446fcdd6769a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 16:07:37 +0100
+Subject: netfilter: nftables: fix possible UAF over chains from packet path in
+ netns
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 767d1216bff82507c945e92fe719dff2083bb2f4 ]
+
+Although hooks are released via call_rcu(), chain and rule objects are
+immediately released while packets are still walking over these bits.
+
+This patch adds the .pre_exit callback which is invoked before
+synchronize_rcu() in the netns framework to stay safe.
+
+Remove a comment which is not valid anymore since the core does not use
+synchronize_net() anymore since 8c873e219970 ("netfilter: core: free
+hooks with call_rcu").
+
+Suggested-by: Florian Westphal <fw@strlen.de>
+Fixes: df05ef874b28 ("netfilter: nf_tables: release objects on netns destruction")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 9a080767667b7..8739ef135156b 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -8775,6 +8775,17 @@ int __nft_release_basechain(struct nft_ctx *ctx)
+ }
+ EXPORT_SYMBOL_GPL(__nft_release_basechain);
+
++static void __nft_release_hooks(struct net *net)
++{
++ struct nft_table *table;
++ struct nft_chain *chain;
++
++ list_for_each_entry(table, &net->nft.tables, list) {
++ list_for_each_entry(chain, &table->chains, list)
++ nf_tables_unregister_hook(net, table, chain);
++ }
++}
++
+ static void __nft_release_tables(struct net *net)
+ {
+ struct nft_flowtable *flowtable, *nf;
+@@ -8790,10 +8801,6 @@ static void __nft_release_tables(struct net *net)
+
+ list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
+ ctx.family = table->family;
+-
+- list_for_each_entry(chain, &table->chains, list)
+- nf_tables_unregister_hook(net, table, chain);
+- /* No packets are walking on these chains anymore. */
+ ctx.table = table;
+ list_for_each_entry(chain, &table->chains, list) {
+ ctx.chain = chain;
+@@ -8842,6 +8849,11 @@ static int __net_init nf_tables_init_net(struct net *net)
+ return 0;
+ }
+
++static void __net_exit nf_tables_pre_exit_net(struct net *net)
++{
++ __nft_release_hooks(net);
++}
++
+ static void __net_exit nf_tables_exit_net(struct net *net)
+ {
+ mutex_lock(&net->nft.commit_mutex);
+@@ -8855,8 +8867,9 @@ static void __net_exit nf_tables_exit_net(struct net *net)
+ }
+
+ static struct pernet_operations nf_tables_net_ops = {
+- .init = nf_tables_init_net,
+- .exit = nf_tables_exit_net,
++ .init = nf_tables_init_net,
++ .pre_exit = nf_tables_pre_exit_net,
++ .exit = nf_tables_exit_net,
+ };
+
+ static int __init nf_tables_module_init(void)
+--
+2.27.0
+
--- /dev/null
+From c12a2b3b47309bfbfd2ae06bca190ec705740b45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 20:57:43 +0100
+Subject: netfilter: xt_recent: Fix attempt to update deleted entry
+
+From: Jozsef Kadlecsik <kadlec@mail.kfki.hu>
+
+[ Upstream commit b1bdde33b72366da20d10770ab7a49fe87b5e190 ]
+
+When both --reap and --update flag are specified, there's a code
+path at which the entry to be updated is reaped beforehand,
+which then leads to kernel crash. Reap only entries which won't be
+updated.
+
+Fixes kernel bugzilla #207773.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=207773
+Reported-by: Reindl Harald <h.reindl@thelounge.net>
+Fixes: 0079c5aee348 ("netfilter: xt_recent: add an entry reaper")
+Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/xt_recent.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
+index 606411869698e..0446307516cdf 100644
+--- a/net/netfilter/xt_recent.c
++++ b/net/netfilter/xt_recent.c
+@@ -152,7 +152,8 @@ static void recent_entry_remove(struct recent_table *t, struct recent_entry *e)
+ /*
+ * Drop entries with timestamps older then 'time'.
+ */
+-static void recent_entry_reap(struct recent_table *t, unsigned long time)
++static void recent_entry_reap(struct recent_table *t, unsigned long time,
++ struct recent_entry *working, bool update)
+ {
+ struct recent_entry *e;
+
+@@ -161,6 +162,12 @@ static void recent_entry_reap(struct recent_table *t, unsigned long time)
+ */
+ e = list_entry(t->lru_list.next, struct recent_entry, lru_list);
+
++ /*
++ * Do not reap the entry which are going to be updated.
++ */
++ if (e == working && update)
++ return;
++
+ /*
+ * The last time stamp is the most recent.
+ */
+@@ -303,7 +310,8 @@ recent_mt(const struct sk_buff *skb, struct xt_action_param *par)
+
+ /* info->seconds must be non-zero */
+ if (info->check_set & XT_RECENT_REAP)
+- recent_entry_reap(t, time);
++ recent_entry_reap(t, time, e,
++ info->check_set & XT_RECENT_UPDATE && ret);
+ }
+
+ if (info->check_set & XT_RECENT_SET ||
+--
+2.27.0
+
--- /dev/null
+From 13dfd3314563746b11b3e78dcea6d0f30bfec958 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 12:17:34 +0100
+Subject: scsi: scsi_debug: Fix a memory leak
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+[ Upstream commit f852c596f2ee6f0eb364ea8f28f89da6da0ae7b5 ]
+
+The sdebug_q_arr pointer must be freed when the module is unloaded.
+
+$ cat /sys/kernel/debug/kmemleak
+unreferenced object 0xffff888e1cfb0000 (size 4096):
+ comm "modprobe", pid 165555, jiffies 4325987516 (age 685.194s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<00000000458f4f5d>] 0xffffffffc06702d9
+ [<000000003edc4b1f>] do_one_initcall+0xe9/0x57d
+ [<00000000da7d518c>] do_init_module+0x1d1/0x6f0
+ [<000000009a6a9248>] load_module+0x36bd/0x4f50
+ [<00000000ddb0c3ce>] __do_sys_init_module+0x1db/0x260
+ [<000000009532db57>] do_syscall_64+0xa5/0x420
+ [<000000002916b13d>] entry_SYSCALL_64_after_hwframe+0x6a/0xdf
+
+Fixes: 87c715dcde63 ("scsi: scsi_debug: Add per_host_store option")
+Link: https://lore.kernel.org/r/20210208111734.34034-1-mlombard@redhat.com
+Acked-by: Douglas Gilbert <dgilbert@interlog.com>
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_debug.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
+index 4a08c450b756f..b6540b92f5661 100644
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -6881,6 +6881,7 @@ static void __exit scsi_debug_exit(void)
+
+ sdebug_erase_all_stores(false);
+ xa_destroy(per_store_ap);
++ kfree(sdebug_q_arr);
+ }
+
+ device_initcall(scsi_debug_init);
+--
+2.27.0
+
--- /dev/null
+From 1aba20a562bf56d6da7310f1fd4483104e6c0d57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Jan 2021 11:14:25 +0100
+Subject: selftests: netfilter: fix current year
+
+From: Fabian Frederick <fabf@skynet.be>
+
+[ Upstream commit a3005b0f83f217c888393c6bf9cd36e3d1616bca ]
+
+use date %Y instead of %G to read current year
+Problem appeared when running lkp-tests on 01/01/2021
+
+Fixes: 48d072c4e8cd ("selftests: netfilter: add time counter check")
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Signed-off-by: Fabian Frederick <fabf@skynet.be>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/netfilter/nft_meta.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/netfilter/nft_meta.sh b/tools/testing/selftests/netfilter/nft_meta.sh
+index 087f0e6e71ce7..f33154c04d344 100755
+--- a/tools/testing/selftests/netfilter/nft_meta.sh
++++ b/tools/testing/selftests/netfilter/nft_meta.sh
+@@ -23,7 +23,7 @@ ip -net "$ns0" addr add 127.0.0.1 dev lo
+
+ trap cleanup EXIT
+
+-currentyear=$(date +%G)
++currentyear=$(date +%Y)
+ lastyear=$((currentyear-1))
+ ip netns exec "$ns0" nft -f /dev/stdin <<EOF
+ table inet filter {
+--
+2.27.0
+
--- /dev/null
+From 9e88d30a4ff2d89200b72ee244b20bec970fa20e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 20:50:34 +0300
+Subject: selftests: txtimestamp: fix compilation issue
+
+From: Vadim Fedorenko <vfedorenko@novek.ru>
+
+[ Upstream commit 647b8dd5184665432cc8a2b5bca46a201f690c37 ]
+
+PACKET_TX_TIMESTAMP is defined in if_packet.h but it is not included in
+test. Include it instead of <netpacket/packet.h> otherwise the error of
+redefinition arrives.
+Also fix the compiler warning about ambiguous control flow by adding
+explicit braces.
+
+Fixes: 8fe2f761cae9 ("net-timestamp: expand documentation")
+Suggested-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
+Signed-off-by: Vadim Fedorenko <vfedorenko@novek.ru>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Link: https://lore.kernel.org/r/1612461034-24524-1-git-send-email-vfedorenko@novek.ru
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/txtimestamp.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/net/txtimestamp.c b/tools/testing/selftests/net/txtimestamp.c
+index 490a8cca708a8..fabb1d555ee5c 100644
+--- a/tools/testing/selftests/net/txtimestamp.c
++++ b/tools/testing/selftests/net/txtimestamp.c
+@@ -26,6 +26,7 @@
+ #include <inttypes.h>
+ #include <linux/errqueue.h>
+ #include <linux/if_ether.h>
++#include <linux/if_packet.h>
+ #include <linux/ipv6.h>
+ #include <linux/net_tstamp.h>
+ #include <netdb.h>
+@@ -34,7 +35,6 @@
+ #include <netinet/ip.h>
+ #include <netinet/udp.h>
+ #include <netinet/tcp.h>
+-#include <netpacket/packet.h>
+ #include <poll.h>
+ #include <stdarg.h>
+ #include <stdbool.h>
+@@ -495,12 +495,12 @@ static void do_test(int family, unsigned int report_opt)
+ total_len = cfg_payload_len;
+ if (cfg_use_pf_packet || cfg_proto == SOCK_RAW) {
+ total_len += sizeof(struct udphdr);
+- if (cfg_use_pf_packet || cfg_ipproto == IPPROTO_RAW)
++ if (cfg_use_pf_packet || cfg_ipproto == IPPROTO_RAW) {
+ if (family == PF_INET)
+ total_len += sizeof(struct iphdr);
+ else
+ total_len += sizeof(struct ipv6hdr);
+-
++ }
+ /* special case, only rawv6_sendmsg:
+ * pass proto in sin6_port if not connected
+ * also see ANK comment in net/ipv4/raw.c
+--
+2.27.0
+
lkdtm-don-t-move-ctors-to-.rodata.patch
arm64-mte-allow-ptrace_peekmtetags-access-to-the-zer.patch
kvm-x86-cleanup-cr3-reserved-bits-checks.patch
+cgroup-v1-add-disabled-controller-check-in-cgroup1_p.patch
+dmaengine-idxd-fix-misc-interrupt-completion.patch
+ath9k-fix-build-error-with-leds_class-m.patch
+mt76-dma-fix-a-possible-memory-leak-in-mt76_add_frag.patch
+drm-vc4-hvs-fix-buffer-overflow-with-the-dlist-handl.patch
+dmaengine-idxd-check-device-state-before-issue-comma.patch
+bpf-unbreak-bpf_prog_type_kprobe-when-kprobe-is-call.patch
+bpf-check-for-integer-overflow-when-using-roundup_po.patch
+netfilter-xt_recent-fix-attempt-to-update-deleted-en.patch
+selftests-netfilter-fix-current-year.patch
+netfilter-nftables-fix-possible-uaf-over-chains-from.patch
+netfilter-flowtable-fix-tcp-and-udp-header-checksum-.patch
+xen-netback-avoid-race-in-xenvif_rx_ring_slots_avail.patch
+net-hdlc_x25-return-meaningful-error-code-in-x25_ope.patch
+net-ipa-set-error-code-in-gsi_channel_setup.patch
+hv_netvsc-reset-the-rsc-count-if-nvsp_stat_fail-in-n.patch
+net-enetc-initialize-the-rfs-and-rss-memories.patch
+selftests-txtimestamp-fix-compilation-issue.patch
+net-stmmac-set-txq-mode-back-to-dcb-after-disabling-.patch
+ibmvnic-clear-failover_pending-if-unable-to-schedule.patch
+netfilter-conntrack-skip-identical-origin-tuple-in-s.patch
+scsi-scsi_debug-fix-a-memory-leak.patch
+x86-build-disable-cet-instrumentation-in-the-kernel-.patch
+net-dsa-felix-implement-port-flushing-on-.phylink_ma.patch
+net-hns3-add-a-check-for-queue_id-in-hclge_reset_vf_.patch
+net-hns3-add-a-check-for-tqp_index-in-hclge_get_ring.patch
+net-hns3-add-a-check-for-index-in-hclge_get_rss_key.patch
+firmware_loader-align-.builtin_fw-to-8.patch
+drm-sun4i-tcon-set-sync-polarity-for-tcon1-channel.patch
+drm-sun4i-dw-hdmi-always-set-clock-rate.patch
+drm-sun4i-fix-h6-hdmi-phy-configuration.patch
+drm-sun4i-dw-hdmi-fix-max.-frequency-for-h6.patch
+clk-sunxi-ng-mp-fix-parent-rate-change-flag-check.patch
+i2c-stm32f7-fix-configuration-of-the-digital-filter.patch
+h8300-fix-preemption-build-ti_pre_count-undefined.patch
--- /dev/null
+From ffa63377425cd852f6e35d1c9d614f0b043bb424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 16:43:30 +0100
+Subject: x86/build: Disable CET instrumentation in the kernel for 32-bit too
+
+From: Borislav Petkov <bp@suse.de>
+
+[ Upstream commit 256b92af784d5043eeb7d559b6d5963dcc2ecb10 ]
+
+Commit
+
+ 20bf2b378729 ("x86/build: Disable CET instrumentation in the kernel")
+
+disabled CET instrumentation which gets added by default by the Ubuntu
+gcc9 and 10 by default, but did that only for 64-bit builds. It would
+still fail when building a 32-bit target. So disable CET for all x86
+builds.
+
+Fixes: 20bf2b378729 ("x86/build: Disable CET instrumentation in the kernel")
+Reported-by: AC <achirvasub@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Tested-by: AC <achirvasub@gmail.com>
+Link: https://lkml.kernel.org/r/YCCIgMHkzh/xT4ex@arch-chirva.localdomain
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Makefile | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index 6a7efa78eba22..0a6d497221e49 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -57,6 +57,9 @@ export BITS
+ KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow
+ KBUILD_CFLAGS += $(call cc-option,-mno-avx,)
+
++# Intel CET isn't enabled in the kernel
++KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
++
+ ifeq ($(CONFIG_X86_32),y)
+ BITS := 32
+ UTS_MACHINE := i386
+@@ -127,9 +130,6 @@ else
+
+ KBUILD_CFLAGS += -mno-red-zone
+ KBUILD_CFLAGS += -mcmodel=kernel
+-
+- # Intel CET isn't enabled in the kernel
+- KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
+ endif
+
+ ifdef CONFIG_X86_X32
+--
+2.27.0
+
--- /dev/null
+From 92722f97078aa1c8c8446412377773962dc5e05c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 08:09:38 +0100
+Subject: xen/netback: avoid race in xenvif_rx_ring_slots_available()
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit ec7d8e7dd3a59528e305a18e93f1cb98f7faf83b ]
+
+Since commit 23025393dbeb3b8b3 ("xen/netback: use lateeoi irq binding")
+xenvif_rx_ring_slots_available() is no longer called only from the rx
+queue kernel thread, so it needs to access the rx queue with the
+associated queue held.
+
+Reported-by: Igor Druzhinin <igor.druzhinin@citrix.com>
+Fixes: 23025393dbeb3b8b3 ("xen/netback: use lateeoi irq binding")
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Acked-by: Wei Liu <wl@xen.org>
+Link: https://lore.kernel.org/r/20210202070938.7863-1-jgross@suse.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/xen-netback/rx.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c
+index b8febe1d1bfd3..accc991d153f7 100644
+--- a/drivers/net/xen-netback/rx.c
++++ b/drivers/net/xen-netback/rx.c
+@@ -38,10 +38,15 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
+ RING_IDX prod, cons;
+ struct sk_buff *skb;
+ int needed;
++ unsigned long flags;
++
++ spin_lock_irqsave(&queue->rx_queue.lock, flags);
+
+ skb = skb_peek(&queue->rx_queue);
+- if (!skb)
++ if (!skb) {
++ spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
+ return false;
++ }
+
+ needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE);
+ if (skb_is_gso(skb))
+@@ -49,6 +54,8 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
+ if (skb->sw_hash)
+ needed++;
+
++ spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
++
+ do {
+ prod = queue->rx.sring->req_prod;
+ cons = queue->rx.req_cons;
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
