--- /dev/null
+From 27f660ded1aecce6a00ddfa8015655828040790e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 17:24:19 -0800
+Subject: ACPI/IORT: Do not blindly trust DMA masks from firmware
+
+From: Moritz Fischer <mdf@kernel.org>
+
+[ Upstream commit a1df829ead5877d4a1061e976a50e2e665a16f24 ]
+
+Address issue observed on real world system with suboptimal IORT table
+where DMA masks of PCI devices would get set to 0 as result.
+
+iort_dma_setup() would query the root complex'/named component IORT
+entry for a DMA mask, and use that over the one the device has been
+configured with earlier.
+
+Ideally we want to use the minimum mask of what the IORT contains for
+the root complex and what the device was configured with.
+
+Fixes: 5ac65e8c8941 ("ACPI/IORT: Support address size limit for root complexes")
+Signed-off-by: Moritz Fischer <mdf@kernel.org>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Link: https://lore.kernel.org/r/20210122012419.95010-1-mdf@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/arm64/iort.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
+index 770d84071a328..94f34109695c9 100644
+--- a/drivers/acpi/arm64/iort.c
++++ b/drivers/acpi/arm64/iort.c
+@@ -1107,6 +1107,11 @@ static int nc_dma_get_range(struct device *dev, u64 *size)
+
+ ncomp = (struct acpi_iort_named_component *)node->node_data;
+
++ if (!ncomp->memory_address_limit) {
++ pr_warn(FW_BUG "Named component missing memory address limit\n");
++ return -EINVAL;
++ }
++
+ *size = ncomp->memory_address_limit >= 64 ? U64_MAX :
+ 1ULL<<ncomp->memory_address_limit;
+
+@@ -1126,6 +1131,11 @@ static int rc_dma_get_range(struct device *dev, u64 *size)
+
+ rc = (struct acpi_iort_root_complex *)node->node_data;
+
++ if (!rc->memory_address_limit) {
++ pr_warn(FW_BUG "Root complex missing memory address limit\n");
++ return -EINVAL;
++ }
++
+ *size = rc->memory_address_limit >= 64 ? U64_MAX :
+ 1ULL<<rc->memory_address_limit;
+
+@@ -1173,8 +1183,8 @@ void iort_dma_setup(struct device *dev, u64 *dma_addr, u64 *dma_size)
+ end = dmaaddr + size - 1;
+ mask = DMA_BIT_MASK(ilog2(end) + 1);
+ dev->bus_dma_limit = end;
+- dev->coherent_dma_mask = mask;
+- *dev->dma_mask = mask;
++ dev->coherent_dma_mask = min(dev->coherent_dma_mask, mask);
++ *dev->dma_mask = min(*dev->dma_mask, mask);
+ }
+
+ *dma_addr = dmaaddr;
+--
+2.27.0
+
--- /dev/null
+From b2884b704b2f62a162c45c13da74d72c4b9bd7b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 10:24:07 +0100
+Subject: ARM: dts: imx6qdl-kontron-samx6i: fix i2c_lcd/cam default status
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+[ Upstream commit 70b6ff4c549a62b59b286445f66cfec6c5327ac8 ]
+
+Fix typo so the gpio i2c busses are really disabled.
+
+Fixes: 2125212785c9 ("ARM: dts: imx6qdl-kontron-samx6i: add Kontron SMARC SoM Support")
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
+index f486d6d8fb4a7..92f9977d14822 100644
+--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
+@@ -167,7 +167,7 @@
+ i2c-gpio,delay-us = <2>; /* ~100 kHz */
+ #address-cells = <1>;
+ #size-cells = <0>;
+- status = "disabld";
++ status = "disabled";
+ };
+
+ i2c_cam: i2c-gpio-cam {
+@@ -179,7 +179,7 @@
+ i2c-gpio,delay-us = <2>; /* ~100 kHz */
+ #address-cells = <1>;
+ #size-cells = <0>;
+- status = "disabld";
++ status = "disabled";
+ };
+ };
+
+--
+2.27.0
+
--- /dev/null
+From b37f595fa0a461fd3d10ea530b401fd07822f5cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 10:53:06 +0000
+Subject: ARM: dts: imx6qdl-sr-som: fix some cubox-i platforms
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 2cc0bfc9c12784188482a8f3d751d44af45b0d97 ]
+
+The PHY address bit 2 is configured by the LED pin. Attaching a LED
+to this pin is not sufficient to guarantee this configuration pin is
+correctly read. This leads to some platforms having their PHY at
+address 0 and others at address 4.
+
+If there is no phy-handle specified, the FEC driver will scan the PHY
+bus for a PHY and use that. Consequently, adding the DT configuration
+of the PHY and the phy properties to the FEC driver broke some boards.
+
+Fix this by removing the phy-handle property, and listing two PHY
+entries for both possible PHY addresses, so that the DT configuration
+for the PHY can be found by the PHY driver.
+
+Fixes: 86b08bd5b994 ("ARM: dts: imx6-sr-som: add ethernet PHY configuration")
+Reported-by: Christoph Mattheis <christoph.mattheis@arcor.de>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-sr-som.dtsi | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-sr-som.dtsi b/arch/arm/boot/dts/imx6qdl-sr-som.dtsi
+index b06577808ff4e..7e4e5fd0143a1 100644
+--- a/arch/arm/boot/dts/imx6qdl-sr-som.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-sr-som.dtsi
+@@ -53,7 +53,6 @@
+ &fec {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_microsom_enet_ar8035>;
+- phy-handle = <&phy>;
+ phy-mode = "rgmii-id";
+ phy-reset-duration = <2>;
+ phy-reset-gpios = <&gpio4 15 GPIO_ACTIVE_LOW>;
+@@ -63,10 +62,19 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+- phy: ethernet-phy@0 {
++ /*
++ * The PHY can appear at either address 0 or 4 due to the
++ * configuration (LED) pin not being pulled sufficiently.
++ */
++ ethernet-phy@0 {
+ reg = <0>;
+ qca,clk-out-frequency = <125000000>;
+ };
++
++ ethernet-phy@4 {
++ reg = <4>;
++ qca,clk-out-frequency = <125000000>;
++ };
+ };
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 5b5e4ba0ab32ec9110e2d7939e7bf520368bb684 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 16:17:51 +0100
+Subject: ARM: imx: fix imx8m dependencies
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 097530bf8cd469ef7b3d52ef00cafb64b33bacb1 ]
+
+Selecting ARM_GIC_V3 on non-CP15 processors leads to build failures
+like
+
+arch/arm/include/asm/arch_gicv3.h: In function 'write_ICC_AP1R3_EL1':
+arch/arm/include/asm/arch_gicv3.h:36:40: error: 'c12' undeclared (first use in this function)
+ 36 | #define __ICC_AP1Rx(x) __ACCESS_CP15(c12, 0, c9, x)
+ | ^~~
+
+Add a dependency to only enable the gic driver when building for
+at an ARMv7 target, which is the closes approximation to the ARMv8
+processor that is actually in this chip.
+
+Fixes: fc40200ebf82 ("soc: imx: increase build coverage for imx8m soc driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/imx/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/imx/Kconfig b/drivers/soc/imx/Kconfig
+index a9370f4aacca9..05812f8ae7340 100644
+--- a/drivers/soc/imx/Kconfig
++++ b/drivers/soc/imx/Kconfig
+@@ -13,7 +13,7 @@ config SOC_IMX8M
+ depends on ARCH_MXC || COMPILE_TEST
+ default ARCH_MXC && ARM64
+ select SOC_BUS
+- select ARM_GIC_V3 if ARCH_MXC
++ select ARM_GIC_V3 if ARCH_MXC && ARCH_MULTI_V7
+ help
+ If you say yes here you get support for the NXP i.MX8M family
+ support, it will provide the SoC info like SoC family,
+--
+2.27.0
+
--- /dev/null
+From ba6bca557701f131a6daadf82eab7a24518ffb0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 09:18:05 +0800
+Subject: arm64: dts: imx8mp: Correct the gpio ranges of gpio3
+
+From: Jacky Bai <ping.bai@nxp.com>
+
+[ Upstream commit b764eb65e1c932f0500b30fcc06417cd9bc3e583 ]
+
+On i.MX8MP, The GPIO3's secondary gpio-ranges's 'gpio controller offset'
+cell value should be 26, so correct it.
+
+Signed-off-by: Jacky Bai <ping.bai@nxp.com>
+Fixes: 6d9b8d20431f ("arm64: dts: freescale: Add i.MX8MP dtsi support")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+index 6038f66aefc10..03ef0e5f909e4 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+@@ -259,7 +259,7 @@
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+- gpio-ranges = <&iomuxc 0 56 26>, <&iomuxc 0 144 4>;
++ gpio-ranges = <&iomuxc 0 56 26>, <&iomuxc 26 144 4>;
+ };
+
+ gpio4: gpio@30230000 {
+--
+2.27.0
+
--- /dev/null
+From 22613b4ed51b98bc6450a65aa9b5adcb31fd1dab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 22:26:22 +0100
+Subject: arm64: dts: ls1028a: fix the offset of the reset register
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit 1653e3d470629d25c64cd8a2f84adb20a9348b0c ]
+
+The offset of the reset request register is 0, the absolute address is
+0x1e60000. Boards without PSCI support will fail to perform a reset:
+
+[ 26.734700] reboot: Restarting system
+[ 27.743259] Unable to restart system
+[ 27.746845] Reboot failed -- System halted
+
+Fixes: 8897f3255c9c ("arm64: dts: Add support for NXP LS1028A SoC")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+index 33aa0efa2293a..62f4dcb96e70d 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+@@ -93,7 +93,7 @@
+ reboot {
+ compatible ="syscon-reboot";
+ regmap = <&rst>;
+- offset = <0xb0>;
++ offset = <0>;
+ mask = <0x02>;
+ };
+
+--
+2.27.0
+
--- /dev/null
+From ae4bed3c3a3e2fa62e3589d801be239b5064fc05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 17:15:26 +0000
+Subject: ASoC: dt-bindings: lpass: Fix and common up lpass dai ids
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 09a4f6f5d21cb1f2633f4e8b893336b60eee9a01 ]
+
+Existing header file design of having separate SoC specific header files
+for the common lpass driver has mutiple issues.
+This design is prone to break as an when new SoC header is added
+as the common DAI ids of other SoCs will be overwritten by the
+new ones.
+
+One of them surfaced by recent patch that adds support to sc7180, this
+one totally broke LPASS drivers on other Qualcomm SoCs.
+
+Before this gets worst, fix this by having a common header qcom,lpass.h.
+This should fix the issue and any new DAI ids should be added to the
+common header. This will be more sustainable then the existing design!
+
+Fixes: 12fbfc4cabec6595 ("ASoC: Add sc7180-lpass binding header hdmi define")
+Reported-by: Jun Nie <jun.nie@linaro.org>
+Reported-by: Stephan Gerhold <stephan@gerhold.net>
+Tested-by: Srinivasa Rao <srivasam@codeaurora.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210119171527.32145-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/dt-bindings/sound/apq8016-lpass.h | 7 +++----
+ include/dt-bindings/sound/qcom,lpass.h | 15 +++++++++++++++
+ include/dt-bindings/sound/sc7180-lpass.h | 6 ++----
+ 3 files changed, 20 insertions(+), 8 deletions(-)
+ create mode 100644 include/dt-bindings/sound/qcom,lpass.h
+
+diff --git a/include/dt-bindings/sound/apq8016-lpass.h b/include/dt-bindings/sound/apq8016-lpass.h
+index 3c3e16c0aadbf..dc605c4bc2249 100644
+--- a/include/dt-bindings/sound/apq8016-lpass.h
++++ b/include/dt-bindings/sound/apq8016-lpass.h
+@@ -2,9 +2,8 @@
+ #ifndef __DT_APQ8016_LPASS_H
+ #define __DT_APQ8016_LPASS_H
+
+-#define MI2S_PRIMARY 0
+-#define MI2S_SECONDARY 1
+-#define MI2S_TERTIARY 2
+-#define MI2S_QUATERNARY 3
++#include <dt-bindings/sound/qcom,lpass.h>
++
++/* NOTE: Use qcom,lpass.h to define any AIF ID's for LPASS */
+
+ #endif /* __DT_APQ8016_LPASS_H */
+diff --git a/include/dt-bindings/sound/qcom,lpass.h b/include/dt-bindings/sound/qcom,lpass.h
+new file mode 100644
+index 0000000000000..7b0b80b38699e
+--- /dev/null
++++ b/include/dt-bindings/sound/qcom,lpass.h
+@@ -0,0 +1,15 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __DT_QCOM_LPASS_H
++#define __DT_QCOM_LPASS_H
++
++#define MI2S_PRIMARY 0
++#define MI2S_SECONDARY 1
++#define MI2S_TERTIARY 2
++#define MI2S_QUATERNARY 3
++#define MI2S_QUINARY 4
++
++#define LPASS_DP_RX 5
++
++#define LPASS_MCLK0 0
++
++#endif /* __DT_QCOM_LPASS_H */
+diff --git a/include/dt-bindings/sound/sc7180-lpass.h b/include/dt-bindings/sound/sc7180-lpass.h
+index 56ecaafd2dc68..5c1ee8b36b197 100644
+--- a/include/dt-bindings/sound/sc7180-lpass.h
++++ b/include/dt-bindings/sound/sc7180-lpass.h
+@@ -2,10 +2,8 @@
+ #ifndef __DT_SC7180_LPASS_H
+ #define __DT_SC7180_LPASS_H
+
+-#define MI2S_PRIMARY 0
+-#define MI2S_SECONDARY 1
+-#define LPASS_DP_RX 2
++#include <dt-bindings/sound/qcom,lpass.h>
+
+-#define LPASS_MCLK0 0
++/* NOTE: Use qcom,lpass.h to define any AIF ID's for LPASS */
+
+ #endif /* __DT_APQ8016_LPASS_H */
+--
+2.27.0
+
--- /dev/null
+From fd49a8e081558aa1c99bd89da0104da8d672033d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 18:16:43 +0100
+Subject: ASoC: Intel: Skylake: skl-topology: Fix OOPs ib skl_tplg_complete
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+[ Upstream commit c1c3ba1f78354a20222d291ed6fedd17b7a74fd7 ]
+
+If dobj->control is not initialized we end up in an OOPs during
+skl_tplg_complete:
+
+[ 26.553358] BUG: kernel NULL pointer dereference, address:
+0000000000000078
+[ 26.561151] #PF: supervisor read access in kernel mode
+[ 26.566897] #PF: error_code(0x0000) - not-present page
+[ 26.572642] PGD 0 P4D 0
+[ 26.575479] Oops: 0000 [#1] PREEMPT SMP PTI
+[ 26.580158] CPU: 2 PID: 2082 Comm: udevd Tainted: G C
+5.4.81 #4
+[ 26.588232] Hardware name: HP Soraka/Soraka, BIOS
+Google_Soraka.10431.106.0 12/03/2019
+[ 26.597082] RIP: 0010:skl_tplg_complete+0x70/0x144 [snd_soc_skl]
+
+Fixes: 2d744ecf2b98 ("ASoC: Intel: Skylake: Automatic DMIC format configuration according to information from NHL")
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Tested-by: Lukasz Majczak <lma@semihalf.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210121171644.131059-1-ribalda@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/skylake/skl-topology.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
+index 40bee10b0c65a..d699e61eca3d0 100644
+--- a/sound/soc/intel/skylake/skl-topology.c
++++ b/sound/soc/intel/skylake/skl-topology.c
+@@ -3619,15 +3619,16 @@ static void skl_tplg_complete(struct snd_soc_component *component)
+
+ list_for_each_entry(dobj, &component->dobj_list, list) {
+ struct snd_kcontrol *kcontrol = dobj->control.kcontrol;
+- struct soc_enum *se =
+- (struct soc_enum *)kcontrol->private_value;
+- char **texts = dobj->control.dtexts;
++ struct soc_enum *se;
++ char **texts;
+ char chan_text[4];
+
+- if (dobj->type != SND_SOC_DOBJ_ENUM ||
+- dobj->control.kcontrol->put !=
+- skl_tplg_multi_config_set_dmic)
++ if (dobj->type != SND_SOC_DOBJ_ENUM || !kcontrol ||
++ kcontrol->put != skl_tplg_multi_config_set_dmic)
+ continue;
++
++ se = (struct soc_enum *)kcontrol->private_value;
++ texts = dobj->control.dtexts;
+ sprintf(chan_text, "c%d", mach->mach_params.dmic_num);
+
+ for (i = 0; i < se->items; i++) {
+--
+2.27.0
+
--- /dev/null
+From 6d178b0f83324fc2c4b74788fd795cf25e0f6118 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 17:15:27 +0000
+Subject: ASoC: qcom: Fix broken support to MI2S TERTIARY and QUATERNARY
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit cd3484f7f1386071b1af159023917ed12c182d39 ]
+
+lpass hdmi support patch totally removed support for MI2S TERTIARY
+and QUATERNARY.
+
+One of the major issue was spotted with the design of having
+separate SoC specific header files for the common lpass driver.
+This design is prone to break as an when new SoC header is added
+as the common DAI ids of other SoCs will be overwritten by the
+new ones.
+
+Having a common header qcom,lpass.h should fix the issue and any new
+DAI ids should be added to the common header.
+
+With this change lpass also needs a new of_xlate function to resolve
+dai name.
+
+Fixes: 7cb37b7bd0d3 ("ASoC: qcom: Add support for lpass hdmi driver")
+Reported-by: Jun Nie <jun.nie@linaro.org>
+Reported-by: Stephan Gerhold <stephan@gerhold.net>
+Tested-by: Srinivasa Rao <srivasam@codeaurora.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Tested-by: Stephan Gerhold <stephan@gerhold.net>
+Link: https://lore.kernel.org/r/20210119171527.32145-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-cpu.c | 22 ++++++++++++++++++++++
+ sound/soc/qcom/lpass-platform.c | 12 ++++++++++++
+ sound/soc/qcom/lpass-sc7180.c | 9 +++------
+ sound/soc/qcom/lpass.h | 2 +-
+ 4 files changed, 38 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c
+index 97b920ab50685..46bb24afeacf0 100644
+--- a/sound/soc/qcom/lpass-cpu.c
++++ b/sound/soc/qcom/lpass-cpu.c
+@@ -344,8 +344,30 @@ int asoc_qcom_lpass_cpu_dai_probe(struct snd_soc_dai *dai)
+ }
+ EXPORT_SYMBOL_GPL(asoc_qcom_lpass_cpu_dai_probe);
+
++static int asoc_qcom_of_xlate_dai_name(struct snd_soc_component *component,
++ struct of_phandle_args *args,
++ const char **dai_name)
++{
++ struct lpass_data *drvdata = snd_soc_component_get_drvdata(component);
++ struct lpass_variant *variant = drvdata->variant;
++ int id = args->args[0];
++ int ret = -EINVAL;
++ int i;
++
++ for (i = 0; i < variant->num_dai; i++) {
++ if (variant->dai_driver[i].id == id) {
++ *dai_name = variant->dai_driver[i].name;
++ ret = 0;
++ break;
++ }
++ }
++
++ return ret;
++}
++
+ static const struct snd_soc_component_driver lpass_cpu_comp_driver = {
+ .name = "lpass-cpu",
++ .of_xlate_dai_name = asoc_qcom_of_xlate_dai_name,
+ };
+
+ static bool lpass_cpu_regmap_writeable(struct device *dev, unsigned int reg)
+diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
+index 232deee6fde56..71122e9eb2305 100644
+--- a/sound/soc/qcom/lpass-platform.c
++++ b/sound/soc/qcom/lpass-platform.c
+@@ -257,6 +257,9 @@ static int lpass_platform_pcmops_hw_params(struct snd_soc_component *component,
+ break;
+ case MI2S_PRIMARY:
+ case MI2S_SECONDARY:
++ case MI2S_TERTIARY:
++ case MI2S_QUATERNARY:
++ case MI2S_QUINARY:
+ ret = regmap_fields_write(dmactl->intf, id,
+ LPAIF_DMACTL_AUDINTF(dma_port));
+ if (ret) {
+@@ -507,6 +510,9 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ break;
+ case MI2S_PRIMARY:
+ case MI2S_SECONDARY:
++ case MI2S_TERTIARY:
++ case MI2S_QUATERNARY:
++ case MI2S_QUINARY:
+ reg_irqclr = LPAIF_IRQCLEAR_REG(v, LPAIF_IRQ_PORT_HOST);
+ val_irqclr = LPAIF_IRQ_ALL(ch);
+
+@@ -559,6 +565,9 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ break;
+ case MI2S_PRIMARY:
+ case MI2S_SECONDARY:
++ case MI2S_TERTIARY:
++ case MI2S_QUATERNARY:
++ case MI2S_QUINARY:
+ reg_irqen = LPAIF_IRQEN_REG(v, LPAIF_IRQ_PORT_HOST);
+ val_mask = LPAIF_IRQ_ALL(ch);
+ val_irqen = 0;
+@@ -655,6 +664,9 @@ static irqreturn_t lpass_dma_interrupt_handler(
+ break;
+ case MI2S_PRIMARY:
+ case MI2S_SECONDARY:
++ case MI2S_TERTIARY:
++ case MI2S_QUATERNARY:
++ case MI2S_QUINARY:
+ map = drvdata->lpaif_map;
+ reg = LPAIF_IRQCLEAR_REG(v, LPAIF_IRQ_PORT_HOST);
+ val = 0;
+diff --git a/sound/soc/qcom/lpass-sc7180.c b/sound/soc/qcom/lpass-sc7180.c
+index bc998d5016000..c647e627897a2 100644
+--- a/sound/soc/qcom/lpass-sc7180.c
++++ b/sound/soc/qcom/lpass-sc7180.c
+@@ -20,7 +20,7 @@
+ #include "lpass.h"
+
+ static struct snd_soc_dai_driver sc7180_lpass_cpu_dai_driver[] = {
+- [MI2S_PRIMARY] = {
++ {
+ .id = MI2S_PRIMARY,
+ .name = "Primary MI2S",
+ .playback = {
+@@ -43,9 +43,7 @@ static struct snd_soc_dai_driver sc7180_lpass_cpu_dai_driver[] = {
+ },
+ .probe = &asoc_qcom_lpass_cpu_dai_probe,
+ .ops = &asoc_qcom_lpass_cpu_dai_ops,
+- },
+-
+- [MI2S_SECONDARY] = {
++ }, {
+ .id = MI2S_SECONDARY,
+ .name = "Secondary MI2S",
+ .playback = {
+@@ -59,8 +57,7 @@ static struct snd_soc_dai_driver sc7180_lpass_cpu_dai_driver[] = {
+ },
+ .probe = &asoc_qcom_lpass_cpu_dai_probe,
+ .ops = &asoc_qcom_lpass_cpu_dai_ops,
+- },
+- [LPASS_DP_RX] = {
++ }, {
+ .id = LPASS_DP_RX,
+ .name = "Hdmi",
+ .playback = {
+diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h
+index bccd1a05d771e..868c1c8dbd455 100644
+--- a/sound/soc/qcom/lpass.h
++++ b/sound/soc/qcom/lpass.h
+@@ -12,7 +12,7 @@
+ #include <linux/compiler.h>
+ #include <linux/platform_device.h>
+ #include <linux/regmap.h>
+-#include <dt-bindings/sound/sc7180-lpass.h>
++#include <dt-bindings/sound/qcom,lpass.h>
+ #include "lpass-hdmi.h"
+
+ #define LPASS_AHBIX_CLOCK_FREQUENCY 131072000
+--
+2.27.0
+
--- /dev/null
+From a231b7b6e80435c8abb399dde6fb321159a1c1c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 13:38:33 +0530
+Subject: ASoC: qcom: Fix incorrect volatile registers
+
+From: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+
+[ Upstream commit 315fbe4cef98ee5fb6085bc54c7f25eb06466c70 ]
+
+MI2S and DMA control registers are not volatile, so remove these from volatile registers list.
+Registers reset state check by reading non volatile registers makes no use,
+so remove error check from cpu and platform trigger callbacks.
+Initialized map variable two times in lpass platform trigger API,
+so remove redundant initialization.
+
+Fixes commit b1824968221cc ("ASoC: qcom: Fix enabling BCLK and LRCLK in LPAIF invalid state")
+
+Signed-off-by: V Sujith Kumar Reddy <vsujithk@codeaurora.org>
+Signed-off-by: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+Link: https://lore.kernel.org/r/1608192514-29695-2-git-send-email-srivasam@codeaurora.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-cpu.c | 20 ++------------------
+ sound/soc/qcom/lpass-platform.c | 15 ---------------
+ 2 files changed, 2 insertions(+), 33 deletions(-)
+
+diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c
+index 426235a217ec6..97b920ab50685 100644
+--- a/sound/soc/qcom/lpass-cpu.c
++++ b/sound/soc/qcom/lpass-cpu.c
+@@ -270,18 +270,6 @@ static int lpass_cpu_daiops_trigger(struct snd_pcm_substream *substream,
+ struct lpaif_i2sctl *i2sctl = drvdata->i2sctl;
+ unsigned int id = dai->driver->id;
+ int ret = -EINVAL;
+- unsigned int val = 0;
+-
+- ret = regmap_read(drvdata->lpaif_map,
+- LPAIF_I2SCTL_REG(drvdata->variant, dai->driver->id), &val);
+- if (ret) {
+- dev_err(dai->dev, "error reading from i2sctl reg: %d\n", ret);
+- return ret;
+- }
+- if (val == LPAIF_I2SCTL_RESET_STATE) {
+- dev_err(dai->dev, "error in i2sctl register state\n");
+- return -ENOTRECOVERABLE;
+- }
+
+ switch (cmd) {
+ case SNDRV_PCM_TRIGGER_START:
+@@ -454,20 +442,16 @@ static bool lpass_cpu_regmap_volatile(struct device *dev, unsigned int reg)
+ struct lpass_variant *v = drvdata->variant;
+ int i;
+
+- for (i = 0; i < v->i2s_ports; ++i)
+- if (reg == LPAIF_I2SCTL_REG(v, i))
+- return true;
+ for (i = 0; i < v->irq_ports; ++i)
+ if (reg == LPAIF_IRQSTAT_REG(v, i))
+ return true;
+
+ for (i = 0; i < v->rdma_channels; ++i)
+- if (reg == LPAIF_RDMACURR_REG(v, i) || reg == LPAIF_RDMACTL_REG(v, i))
++ if (reg == LPAIF_RDMACURR_REG(v, i))
+ return true;
+
+ for (i = 0; i < v->wrdma_channels; ++i)
+- if (reg == LPAIF_WRDMACURR_REG(v, i + v->wrdma_channel_start) ||
+- reg == LPAIF_WRDMACTL_REG(v, i + v->wrdma_channel_start))
++ if (reg == LPAIF_WRDMACURR_REG(v, i + v->wrdma_channel_start))
+ return true;
+
+ return false;
+diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
+index 80b09dede5f9c..232deee6fde56 100644
+--- a/sound/soc/qcom/lpass-platform.c
++++ b/sound/soc/qcom/lpass-platform.c
+@@ -452,7 +452,6 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ unsigned int reg_irqclr = 0, val_irqclr = 0;
+ unsigned int reg_irqen = 0, val_irqen = 0, val_mask = 0;
+ unsigned int dai_id = cpu_dai->driver->id;
+- unsigned int dma_ctrl_reg = 0;
+
+ ch = pcm_data->dma_ch;
+ if (dir == SNDRV_PCM_STREAM_PLAYBACK) {
+@@ -469,17 +468,7 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ id = pcm_data->dma_ch - v->wrdma_channel_start;
+ map = drvdata->lpaif_map;
+ }
+- ret = regmap_read(map, LPAIF_DMACTL_REG(v, ch, dir, dai_id), &dma_ctrl_reg);
+- if (ret) {
+- dev_err(soc_runtime->dev, "error reading from rdmactl reg: %d\n", ret);
+- return ret;
+- }
+
+- if (dma_ctrl_reg == LPAIF_DMACTL_RESET_STATE ||
+- dma_ctrl_reg == LPAIF_DMACTL_RESET_STATE + 1) {
+- dev_err(soc_runtime->dev, "error in rdmactl register state\n");
+- return -ENOTRECOVERABLE;
+- }
+ switch (cmd) {
+ case SNDRV_PCM_TRIGGER_START:
+ case SNDRV_PCM_TRIGGER_RESUME:
+@@ -500,7 +489,6 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ "error writing to rdmactl reg: %d\n", ret);
+ return ret;
+ }
+- map = drvdata->hdmiif_map;
+ reg_irqclr = LPASS_HDMITX_APP_IRQCLEAR_REG(v);
+ val_irqclr = (LPAIF_IRQ_ALL(ch) |
+ LPAIF_IRQ_HDMI_REQ_ON_PRELOAD(ch) |
+@@ -519,7 +507,6 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ break;
+ case MI2S_PRIMARY:
+ case MI2S_SECONDARY:
+- map = drvdata->lpaif_map;
+ reg_irqclr = LPAIF_IRQCLEAR_REG(v, LPAIF_IRQ_PORT_HOST);
+ val_irqclr = LPAIF_IRQ_ALL(ch);
+
+@@ -563,7 +550,6 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ "error writing to rdmactl reg: %d\n", ret);
+ return ret;
+ }
+- map = drvdata->hdmiif_map;
+ reg_irqen = LPASS_HDMITX_APP_IRQEN_REG(v);
+ val_mask = (LPAIF_IRQ_ALL(ch) |
+ LPAIF_IRQ_HDMI_REQ_ON_PRELOAD(ch) |
+@@ -573,7 +559,6 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ break;
+ case MI2S_PRIMARY:
+ case MI2S_SECONDARY:
+- map = drvdata->lpaif_map;
+ reg_irqen = LPAIF_IRQEN_REG(v, LPAIF_IRQ_PORT_HOST);
+ val_mask = LPAIF_IRQ_ALL(ch);
+ val_irqen = 0;
+--
+2.27.0
+
--- /dev/null
+From f3d3274aa72af6366a4cfef1a5a51154aca8cd69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 12:33:29 -0800
+Subject: ASoC: qcom: Fix number of HDMI RDMA channels on sc7180
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 7dfe20ee92f681ab1342015254ddb77a18f40cdb ]
+
+Suspending/resuming with an HDMI dongle attached leads to crashes from
+an audio regmap.
+
+ Unable to handle kernel paging request at virtual address ffffffc018068000
+ Mem abort info:
+ ESR = 0x96000047
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ Data abort info:
+ ISV = 0, ISS = 0x00000047
+ CM = 0, WnR = 1
+ swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000081b12000
+ [ffffffc018068000] pgd=0000000275d14003, pud=0000000275d14003, pmd=000000026365d003, pte=0000000000000000
+ Internal error: Oops: 96000047 [#1] PREEMPT SMP
+ Call trace:
+ regmap_mmio_write32le+0x2c/0x40
+ regmap_mmio_write+0x48/0x6c
+ _regmap_bus_reg_write+0x34/0x44
+ _regmap_write+0x100/0x150
+ regcache_default_sync+0xc0/0x138
+ regcache_sync+0x188/0x26c
+ lpass_platform_pcmops_resume+0x48/0x54 [snd_soc_lpass_platform]
+ snd_soc_component_resume+0x28/0x40
+ soc_resume_deferred+0x6c/0x178
+ process_one_work+0x208/0x3c8
+ worker_thread+0x23c/0x3e8
+ kthread+0x144/0x178
+ ret_from_fork+0x10/0x18
+ Code: d503201f d50332bf f94002a8 8b344108 (b9000113)
+
+I can reliably reproduce this problem by running 'tail' on the registers
+file in debugfs for the hdmi regmap.
+
+ # tail /sys/kernel/debug/regmap/62d87000.lpass-lpass_hdmi/registers
+ [ 84.658733] Unable to handle kernel paging request at virtual address ffffffd0128e800c
+
+This crash happens because we're trying to read registers from the
+regmap beyond the length of the mapping created by ioremap().
+
+The number of hdmi_rdma_channels determines the size of the regmap via
+this code in sound/soc/qcom/lpass-cpu.c:
+
+ lpass_hdmi_regmap_config.max_register = LPAIF_HDMI_RDMAPER_REG(variant, variant->hdmi_rdma_channels);
+
+According to debugfs the size of the regmap is 0x68010 but according to
+the DTS file posted in [1] the size is only 0x68000 (see the first reg
+property of the lpass_cpu node). Let's change the number of channels to
+be 3 instead of 4 so the math works out to have a max register of
+0x67010, nicely fitting inside of the region size of 0x68000.
+
+Note: I tried to bump up the size of the register region to the next
+page to include the 0x68010 register but then the tail command caused
+SErrors with an async abort, implying that the register region doesn't
+exist or it isn't clocked because the bus is telling us that the
+register read failed. I reduce the number of channels and played audio
+through the HDMI channel and it kept working so I think this is correct.
+
+Fixes: 2ad63dc8df6b ("ASoC: qcom: sc7180: Add support for audio over DP")
+Link: https://lore.kernel.org/r/1601448168-18396-2-git-send-email-srivasam@codeaurora.org [1]
+Cc: V Sujith Kumar Reddy <vsujithk@codeaurora.org>
+Cc: Srinivasa Rao <srivasam@codeaurora.org>
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Cc: Cheng-Yi Chiang <cychiang@chromium.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20210115203329.846824-1-swboyd@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-sc7180.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/qcom/lpass-sc7180.c b/sound/soc/qcom/lpass-sc7180.c
+index c647e627897a2..c33da7faaf913 100644
+--- a/sound/soc/qcom/lpass-sc7180.c
++++ b/sound/soc/qcom/lpass-sc7180.c
+@@ -170,7 +170,7 @@ static struct lpass_variant sc7180_data = {
+ .rdma_channels = 5,
+ .hdmi_rdma_reg_base = 0x64000,
+ .hdmi_rdma_reg_stride = 0x1000,
+- .hdmi_rdma_channels = 4,
++ .hdmi_rdma_channels = 3,
+ .dmactl_audif_start = 1,
+ .wrdma_reg_base = 0x18000,
+ .wrdma_reg_stride = 0x1000,
+--
+2.27.0
+
--- /dev/null
+From 3fc011a4618c1a2ea8abbbb0deeb906b3772d296 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 11:44:42 +0100
+Subject: ASoC: qcom: lpass: Fix out-of-bounds DAI ID lookup
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 70041000450d0a071bf9931d634c8e2820340236 ]
+
+The "dai_id" given into LPAIF_INTFDMA_REG(...) is already the real
+DAI ID, not an index into v->dai_driver. Looking it up again seems
+entirely redundant.
+
+For IPQ806x (and SC7180 since commit 09a4f6f5d21c
+("ASoC: dt-bindings: lpass: Fix and common up lpass dai ids") this is
+now often an out-of-bounds read because the indexes in the "dai_driver"
+array no longer match the actual DAI ID.
+
+Cc: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Fixes: 7cb37b7bd0d3 ("ASoC: qcom: Add support for lpass hdmi driver")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210125104442.135899-1-stephan@gerhold.net
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-lpaif-reg.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/qcom/lpass-lpaif-reg.h b/sound/soc/qcom/lpass-lpaif-reg.h
+index 405542832e994..baf72f124ea9b 100644
+--- a/sound/soc/qcom/lpass-lpaif-reg.h
++++ b/sound/soc/qcom/lpass-lpaif-reg.h
+@@ -133,7 +133,7 @@
+ #define LPAIF_WRDMAPERCNT_REG(v, chan) LPAIF_WRDMA_REG_ADDR(v, 0x14, (chan))
+
+ #define LPAIF_INTFDMA_REG(v, chan, reg, dai_id) \
+- ((v->dai_driver[dai_id].id == LPASS_DP_RX) ? \
++ ((dai_id == LPASS_DP_RX) ? \
+ LPAIF_HDMI_RDMA##reg##_REG(v, chan) : \
+ LPAIF_RDMA##reg##_REG(v, chan))
+
+--
+2.27.0
+
--- /dev/null
+From a7fb184bf9661b4d18b38a1eaef3508920f678b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 17:47:00 +0000
+Subject: ASoC: qcom: lpass-ipq806x: fix bitwidth regmap field
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 1e066a23e76f90c9c39c189fe0dbf7c6e3dd5044 ]
+
+BIT_WIDTH field in I2S_CTL register is two bits wide, however
+recent regmap field conversion patch trimmed it down to one bit.
+Fix this by correcting the bit range!
+
+Fixes: b5022a36d28f ("ASoC: qcom: lpass: Use regmap_field for i2sctl and dmactl registers")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210119174700.32639-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-ipq806x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/qcom/lpass-ipq806x.c b/sound/soc/qcom/lpass-ipq806x.c
+index 832a9161484e7..3a45e6a26f04b 100644
+--- a/sound/soc/qcom/lpass-ipq806x.c
++++ b/sound/soc/qcom/lpass-ipq806x.c
+@@ -131,7 +131,7 @@ static struct lpass_variant ipq806x_data = {
+ .micmode = REG_FIELD_ID(0x0010, 4, 7, 5, 0x4),
+ .micmono = REG_FIELD_ID(0x0010, 3, 3, 5, 0x4),
+ .wssrc = REG_FIELD_ID(0x0010, 2, 2, 5, 0x4),
+- .bitwidth = REG_FIELD_ID(0x0010, 0, 0, 5, 0x4),
++ .bitwidth = REG_FIELD_ID(0x0010, 0, 1, 5, 0x4),
+
+ .rdma_dyncclk = REG_FIELD_ID(0x6000, 12, 12, 4, 0x1000),
+ .rdma_bursten = REG_FIELD_ID(0x6000, 11, 11, 4, 0x1000),
+--
+2.27.0
+
--- /dev/null
+From 4ba14bd3d539535293d1e23577412ce07bd0a346 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 18:57:24 -0600
+Subject: ASoC: SOF: Intel: soundwire: fix select/depend unmet dependencies
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit bd9038faa9d7f162b47e1577e35ec5eac39f9d90 ]
+
+The LKP bot reports the following issue:
+
+WARNING: unmet direct dependencies detected for SOUNDWIRE_INTEL
+ Depends on [m]: SOUNDWIRE [=m] && ACPI [=y] && SND_SOC [=y]
+ Selected by [y]:
+ - SND_SOC_SOF_INTEL_SOUNDWIRE [=y] && SOUND [=y] && !UML &&
+ SND [=y] && SND_SOC [=y] && SND_SOC_SOF_TOPLEVEL [=y] &&
+ SND_SOC_SOF_INTEL_TOPLEVEL [=y] && SND_SOC_SOF_INTEL_PCI [=y]
+
+This comes from having tristates being configured independently, when
+in practice the CONFIG_SOUNDWIRE needs to be aligned with the SOF
+choices: when the SOF code is compiled as built-in, the
+CONFIG_SOUNDWIRE also needs to be 'y'.
+
+The easiest fix is to replace the 'depends' with a 'select' and have a
+single user selection to activate SoundWire on Intel platforms. This
+still allows regmap to be compiled independently as a module.
+
+This is just a temporary fix, the select/depend usage will be
+revisited and the SOF Kconfig re-organized, as suggested by Arnd
+Bergman.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: a115ab9b8b93e ('ASoC: SOF: Intel: add build support for SoundWire')
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210122005725.94163-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/Kconfig b/sound/soc/sof/intel/Kconfig
+index 5bfc2f8b13b90..de7ff2d097ab9 100644
+--- a/sound/soc/sof/intel/Kconfig
++++ b/sound/soc/sof/intel/Kconfig
+@@ -337,7 +337,7 @@ config SND_SOC_SOF_HDA
+
+ config SND_SOC_SOF_INTEL_SOUNDWIRE_LINK
+ bool "SOF support for SoundWire"
+- depends on SOUNDWIRE && ACPI
++ depends on ACPI
+ help
+ This adds support for SoundWire with Sound Open Firmware
+ for Intel(R) platforms.
+@@ -353,6 +353,7 @@ config SND_SOC_SOF_INTEL_SOUNDWIRE_LINK_BASELINE
+
+ config SND_SOC_SOF_INTEL_SOUNDWIRE
+ tristate
++ select SOUNDWIRE
+ select SOUNDWIRE_INTEL
+ help
+ This option is not user-selectable but automagically handled by
+--
+2.27.0
+
--- /dev/null
+From 2bb481fdde8719c46d6e7a86bb05df1b0bbac639 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 09:08:05 +0300
+Subject: can: dev: prevent potential information leak in can_fill_info()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b552766c872f5b0d90323b24e4c9e8fa67486dd5 ]
+
+The "bec" struct isn't necessarily always initialized. For example, the
+mcp251xfd_get_berr_counter() function doesn't initialize anything if the
+interface is down.
+
+Fixes: 52c793f24054 ("can: netlink support for bus-error reporting and counters")
+Link: https://lore.kernel.org/r/YAkaRdRJncsJO8Ve@mwanda
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 09879aea9f7cc..24cd3c1027ecc 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -1163,7 +1163,7 @@ static int can_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ {
+ struct can_priv *priv = netdev_priv(dev);
+ struct can_ctrlmode cm = {.flags = priv->ctrlmode};
+- struct can_berr_counter bec;
++ struct can_berr_counter bec = { };
+ enum can_state state = priv->state;
+
+ if (priv->do_get_state)
+--
+2.27.0
+
--- /dev/null
+From 24104531ef694acfd989239f154134885e290b07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 19:32:59 -0800
+Subject: firmware: imx: select SOC_BUS to fix firmware build
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 82c082784e03a9a9c043345f9bc04bc8254cf6da ]
+
+Fix build error in firmware/imx/ selecting SOC_BUS.
+
+riscv32-linux-ld: drivers/firmware/imx/imx-scu-soc.o: in function `.L9':
+imx-scu-soc.c:(.text+0x1b0): undefined reference to `soc_device_register'
+
+Fixes: edbee095fafb ("firmware: imx: add SCU firmware driver support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Atish Patra <atish.patra@wdc.com>
+Cc: Palmer Dabbelt <palmerdabbelt@google.com>
+Cc: Ard Biesheuvel <ardb@kernel.org>
+Cc: Anson Huang <Anson.Huang@nxp.com>
+Cc: Daniel Baluta <daniel.baluta@nxp.com>
+Reviewed-by: Dong Aisheng <aisheng.dong@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/imx/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/imx/Kconfig b/drivers/firmware/imx/Kconfig
+index 1d2e5b85d7ca8..c027d99f2a599 100644
+--- a/drivers/firmware/imx/Kconfig
++++ b/drivers/firmware/imx/Kconfig
+@@ -13,6 +13,7 @@ config IMX_DSP
+ config IMX_SCU
+ bool "IMX SCU Protocol driver"
+ depends on IMX_MBOX
++ select SOC_BUS
+ help
+ The System Controller Firmware (SCFW) is a low-level system function
+ which runs on a dedicated Cortex-M core to provide power, clock, and
+--
+2.27.0
+
--- /dev/null
+From 288b1f97d0458cf2f13eedefa68a91dfd4b5ff66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 14:12:57 +0100
+Subject: i40e: acquire VSI pointer only after VF is initialized
+
+From: Stefan Assmann <sassmann@kpanic.de>
+
+[ Upstream commit 67a3c6b3cc40bb217c3ff947a55053151a00fea0 ]
+
+This change simplifies the VF initialization check and also minimizes
+the delay between acquiring the VSI pointer and using it. As known by
+the commit being fixed, there is a risk of the VSI pointer getting
+changed. Therefore minimize the delay between getting and using the
+pointer.
+
+Fixes: 9889707b06ac ("i40e: Fix crash caused by stress setting of VF MAC addresses")
+Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 61968e9174dab..2872c4dc77f07 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -4046,20 +4046,16 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
+ goto error_param;
+
+ vf = &pf->vf[vf_id];
+- vsi = pf->vsi[vf->lan_vsi_idx];
+
+ /* When the VF is resetting wait until it is done.
+ * It can take up to 200 milliseconds,
+ * but wait for up to 300 milliseconds to be safe.
+- * If the VF is indeed in reset, the vsi pointer has
+- * to show on the newly loaded vsi under pf->vsi[id].
++ * Acquire the VSI pointer only after the VF has been
++ * properly initialized.
+ */
+ for (i = 0; i < 15; i++) {
+- if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) {
+- if (i > 0)
+- vsi = pf->vsi[vf->lan_vsi_idx];
++ if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states))
+ break;
+- }
+ msleep(20);
+ }
+ if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) {
+@@ -4068,6 +4064,7 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
+ ret = -EAGAIN;
+ goto error_param;
+ }
++ vsi = pf->vsi[vf->lan_vsi_idx];
+
+ if (is_multicast_ether_addr(mac)) {
+ dev_err(&pf->pdev->dev,
+--
+2.27.0
+
--- /dev/null
+From 9d5579c70a7896370243d529c286087992c04945 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 10:38:05 -0800
+Subject: ice: Don't allow more channels than LAN MSI-X available
+
+From: Brett Creeley <brett.creeley@intel.com>
+
+[ Upstream commit 943b881e35829403da638fcb34a959125deafef3 ]
+
+Currently users could create more channels than LAN MSI-X available.
+This is happening because there is no check against pf->num_lan_msix
+when checking the max allowed channels and will cause performance issues
+if multiple Tx and Rx queues are tied to a single MSI-X. Fix this by not
+allowing more channels than LAN MSI-X available in pf->num_lan_msix.
+
+Fixes: 87324e747fde ("ice: Implement ethtool ops for channels")
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_ethtool.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index 9e8e9531cd871..69c113a4de7e6 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -3258,8 +3258,8 @@ ice_set_rxfh(struct net_device *netdev, const u32 *indir, const u8 *key,
+ */
+ static int ice_get_max_txq(struct ice_pf *pf)
+ {
+- return min_t(int, num_online_cpus(),
+- pf->hw.func_caps.common_cap.num_txq);
++ return min3(pf->num_lan_msix, (u16)num_online_cpus(),
++ (u16)pf->hw.func_caps.common_cap.num_txq);
+ }
+
+ /**
+@@ -3268,8 +3268,8 @@ static int ice_get_max_txq(struct ice_pf *pf)
+ */
+ static int ice_get_max_rxq(struct ice_pf *pf)
+ {
+- return min_t(int, num_online_cpus(),
+- pf->hw.func_caps.common_cap.num_rxq);
++ return min3(pf->num_lan_msix, (u16)num_online_cpus(),
++ (u16)pf->hw.func_caps.common_cap.num_rxq);
+ }
+
+ /**
+--
+2.27.0
+
--- /dev/null
+From 4277f042e7ba4b633a753060519d6dfa355e6d31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 16:38:30 -0800
+Subject: ice: fix FDir IPv6 flexbyte
+
+From: Henry Tieman <henry.w.tieman@intel.com>
+
+[ Upstream commit 29e2d9eb82647654abff150ff02fa1e07362214f ]
+
+The packet classifier would occasionally misrecognize an IPv6 training
+packet when the next protocol field was 0. The correct value for
+unspecified protocol is IPPROTO_NONE.
+
+Fixes: 165d80d6adab ("ice: Support IPv6 Flow Director filters")
+Signed-off-by: Henry Tieman <henry.w.tieman@intel.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
+index 2d27f66ac8534..192729546bbfc 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
+@@ -1576,7 +1576,13 @@ ice_set_fdir_input_set(struct ice_vsi *vsi, struct ethtool_rx_flow_spec *fsp,
+ sizeof(struct in6_addr));
+ input->ip.v6.l4_header = fsp->h_u.usr_ip6_spec.l4_4_bytes;
+ input->ip.v6.tc = fsp->h_u.usr_ip6_spec.tclass;
+- input->ip.v6.proto = fsp->h_u.usr_ip6_spec.l4_proto;
++
++ /* if no protocol requested, use IPPROTO_NONE */
++ if (!fsp->m_u.usr_ip6_spec.l4_proto)
++ input->ip.v6.proto = IPPROTO_NONE;
++ else
++ input->ip.v6.proto = fsp->h_u.usr_ip6_spec.l4_proto;
++
+ memcpy(input->mask.v6.dst_ip, fsp->m_u.usr_ip6_spec.ip6dst,
+ sizeof(struct in6_addr));
+ memcpy(input->mask.v6.src_ip, fsp->m_u.usr_ip6_spec.ip6src,
+--
+2.27.0
+
--- /dev/null
+From 30db4ed3bcdbb9c94691d1bb7a95f9212ca73c85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 10:38:06 -0800
+Subject: ice: Fix MSI-X vector fallback logic
+
+From: Brett Creeley <brett.creeley@intel.com>
+
+[ Upstream commit f3fe97f64384fa4073d9dc0278c4b351c92e295c ]
+
+The current MSI-X enablement logic tries to enable best-case MSI-X
+vectors and if that fails we only support a bare-minimum set. This
+includes a single MSI-X for 1 Tx and 1 Rx queue and a single MSI-X
+for the OICR interrupt. Unfortunately, the driver fails to load when we
+don't get as many MSI-X as requested for a couple reasons.
+
+First, the code to allocate MSI-X in the driver tries to allocate
+num_online_cpus() MSI-X for LAN traffic without caring about the number
+of MSI-X actually enabled/requested from the kernel for LAN traffic.
+So, when calling ice_get_res() for the PF VSI, it returns failure
+because the number of available vectors is less than requested. Fix
+this by not allowing the PF VSI to allocation more than
+pf->num_lan_msix MSI-X vectors and pf->num_lan_msix Rx/Tx queues.
+Limiting the number of queues is done because we don't want more than
+1 Tx/Rx queue per interrupt due to performance conerns.
+
+Second, the driver assigns pf->num_lan_msix = 2, to account for LAN
+traffic and the OICR. However, pf->num_lan_msix is only meant for LAN
+MSI-X. This is causing a failure when the PF VSI tries to
+allocate/reserve the minimum pf->num_lan_msix because the OICR MSI-X has
+already been reserved, so there may not be enough MSI-X vectors left.
+Fix this by setting pf->num_lan_msix = 1 for the failure case. Then the
+ICE_MIN_MSIX accounts for the LAN MSI-X and the OICR MSI-X needed for
+the failure case.
+
+Update the related defines used in ice_ena_msix_range() to align with
+the above behavior and remove the unused RDMA defines because RDMA is
+currently not supported. Also, remove the now incorrect comment.
+
+Fixes: 152b978a1f90 ("ice: Rework ice_ena_msix_range")
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice.h | 4 +++-
+ drivers/net/ethernet/intel/ice/ice_lib.c | 14 +++++++++-----
+ drivers/net/ethernet/intel/ice/ice_main.c | 8 ++------
+ 3 files changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
+index a0723831c4e48..54cf382fddaf9 100644
+--- a/drivers/net/ethernet/intel/ice/ice.h
++++ b/drivers/net/ethernet/intel/ice/ice.h
+@@ -68,7 +68,9 @@
+ #define ICE_INT_NAME_STR_LEN (IFNAMSIZ + 16)
+ #define ICE_AQ_LEN 64
+ #define ICE_MBXSQ_LEN 64
+-#define ICE_MIN_MSIX 2
++#define ICE_MIN_LAN_TXRX_MSIX 1
++#define ICE_MIN_LAN_OICR_MSIX 1
++#define ICE_MIN_MSIX (ICE_MIN_LAN_TXRX_MSIX + ICE_MIN_LAN_OICR_MSIX)
+ #define ICE_FDIR_MSIX 1
+ #define ICE_NO_VSI 0xffff
+ #define ICE_VSI_MAP_CONTIG 0
+diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
+index 3df67486d42d9..ad9c22a1b97a0 100644
+--- a/drivers/net/ethernet/intel/ice/ice_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_lib.c
+@@ -161,8 +161,9 @@ static void ice_vsi_set_num_qs(struct ice_vsi *vsi, u16 vf_id)
+
+ switch (vsi->type) {
+ case ICE_VSI_PF:
+- vsi->alloc_txq = min_t(int, ice_get_avail_txq_count(pf),
+- num_online_cpus());
++ vsi->alloc_txq = min3(pf->num_lan_msix,
++ ice_get_avail_txq_count(pf),
++ (u16)num_online_cpus());
+ if (vsi->req_txq) {
+ vsi->alloc_txq = vsi->req_txq;
+ vsi->num_txq = vsi->req_txq;
+@@ -174,8 +175,9 @@ static void ice_vsi_set_num_qs(struct ice_vsi *vsi, u16 vf_id)
+ if (!test_bit(ICE_FLAG_RSS_ENA, pf->flags)) {
+ vsi->alloc_rxq = 1;
+ } else {
+- vsi->alloc_rxq = min_t(int, ice_get_avail_rxq_count(pf),
+- num_online_cpus());
++ vsi->alloc_rxq = min3(pf->num_lan_msix,
++ ice_get_avail_rxq_count(pf),
++ (u16)num_online_cpus());
+ if (vsi->req_rxq) {
+ vsi->alloc_rxq = vsi->req_rxq;
+ vsi->num_rxq = vsi->req_rxq;
+@@ -184,7 +186,9 @@ static void ice_vsi_set_num_qs(struct ice_vsi *vsi, u16 vf_id)
+
+ pf->num_lan_rx = vsi->alloc_rxq;
+
+- vsi->num_q_vectors = max_t(int, vsi->alloc_rxq, vsi->alloc_txq);
++ vsi->num_q_vectors = min_t(int, pf->num_lan_msix,
++ max_t(int, vsi->alloc_rxq,
++ vsi->alloc_txq));
+ break;
+ case ICE_VSI_VF:
+ vf = &pf->vf[vsi->vf_id];
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 7986c677cab59..bacb368063e34 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -3433,18 +3433,14 @@ static int ice_ena_msix_range(struct ice_pf *pf)
+ if (v_actual < v_budget) {
+ dev_warn(dev, "not enough OS MSI-X vectors. requested = %d, obtained = %d\n",
+ v_budget, v_actual);
+-/* 2 vectors each for LAN and RDMA (traffic + OICR), one for flow director */
+-#define ICE_MIN_LAN_VECS 2
+-#define ICE_MIN_RDMA_VECS 2
+-#define ICE_MIN_VECS (ICE_MIN_LAN_VECS + ICE_MIN_RDMA_VECS + 1)
+
+- if (v_actual < ICE_MIN_LAN_VECS) {
++ if (v_actual < ICE_MIN_MSIX) {
+ /* error if we can't get minimum vectors */
+ pci_disable_msix(pf->pdev);
+ err = -ERANGE;
+ goto msix_err;
+ } else {
+- pf->num_lan_msix = ICE_MIN_LAN_VECS;
++ pf->num_lan_msix = ICE_MIN_LAN_TXRX_MSIX;
+ }
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 9f452f206f0bfd110695cafd101de175ecc13d91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 16:38:31 -0800
+Subject: ice: Implement flow for IPv6 next header (extension header)
+
+From: Nick Nunley <nicholas.d.nunley@intel.com>
+
+[ Upstream commit 1b0b0b581b945ee27beb70e8199270a22dd5a2f6 ]
+
+This patch is based on a similar change to i40e by Slawomir Laba:
+"i40e: Implement flow for IPv6 next header (extension header)".
+
+When a packet contains an IPv6 header with next header which is
+an extension header and not a protocol one, the kernel function
+skb_transport_header called with such sk_buff will return a
+pointer to the extension header and not to the TCP one.
+
+The above explained call caused a problem with packet processing
+for skb with encapsulation for tunnel with ICE_TX_CTX_EIPT_IPV6.
+The extension header was not skipped at all.
+
+The ipv6_skip_exthdr function does check if next header of the IPV6
+header is an extension header and doesn't modify the l4_proto pointer
+if it points to a protocol header value so its safe to omit the
+comparison of exthdr and l4.hdr pointers. The ipv6_skip_exthdr can
+return value -1. This means that the skipping process failed
+and there is something wrong with the packet so it will be dropped.
+
+Fixes: a4e82a81f573 ("ice: Add support for tunnel offloads")
+Signed-off-by: Nick Nunley <nicholas.d.nunley@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_txrx.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
+index 23eca2f0a03b1..af5b7f33db9af 100644
+--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
+@@ -1923,12 +1923,15 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off)
+ ICE_TX_CTX_EIPT_IPV4_NO_CSUM;
+ l4_proto = ip.v4->protocol;
+ } else if (first->tx_flags & ICE_TX_FLAGS_IPV6) {
++ int ret;
++
+ tunnel |= ICE_TX_CTX_EIPT_IPV6;
+ exthdr = ip.hdr + sizeof(*ip.v6);
+ l4_proto = ip.v6->nexthdr;
+- if (l4.hdr != exthdr)
+- ipv6_skip_exthdr(skb, exthdr - skb->data,
+- &l4_proto, &frag_off);
++ ret = ipv6_skip_exthdr(skb, exthdr - skb->data,
++ &l4_proto, &frag_off);
++ if (ret < 0)
++ return -1;
+ }
+
+ /* define outer transport */
+--
+2.27.0
+
--- /dev/null
+From b0021141b20e454c4ff9d6174ac645683729d649 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 16:38:33 -0800
+Subject: ice: update dev_addr in ice_set_mac_address even if HW filter exists
+
+From: Nick Nunley <nicholas.d.nunley@intel.com>
+
+[ Upstream commit 13ed5e8a9b9ccd140a79e80283f69d724c9bb2be ]
+
+Fix the driver to copy the MAC address configured in ndo_set_mac_address
+into dev_addr, even if the MAC filter already exists in HW. In some
+situations (e.g. bonding) the netdev's dev_addr could have been modified
+outside of the driver, with no change to the HW filter, so the driver
+cannot assume that they match.
+
+Fixes: 757976ab16be ("ice: Fix check for removing/adding mac filters")
+Signed-off-by: Nick Nunley <nicholas.d.nunley@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 2dea4d0e9415c..7986c677cab59 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -4887,9 +4887,15 @@ static int ice_set_mac_address(struct net_device *netdev, void *pi)
+ goto err_update_filters;
+ }
+
+- /* Add filter for new MAC. If filter exists, just return success */
++ /* Add filter for new MAC. If filter exists, return success */
+ status = ice_fltr_add_mac(vsi, mac, ICE_FWD_TO_VSI);
+ if (status == ICE_ERR_ALREADY_EXISTS) {
++ /* Although this MAC filter is already present in hardware it's
++ * possible in some cases (e.g. bonding) that dev_addr was
++ * modified outside of the driver and needs to be restored back
++ * to this value.
++ */
++ memcpy(netdev->dev_addr, mac, netdev->addr_len);
+ netdev_dbg(netdev, "filter for MAC %pM already exists\n", mac);
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From d3f5a339e1b634135ea9b5f54aaf5253f2fee7f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 20:50:40 +0100
+Subject: igc: fix link speed advertising
+
+From: Corinna Vinschen <vinschen@redhat.com>
+
+[ Upstream commit 329a3678ec69962aa67c91397efbd46d36635f91 ]
+
+Link speed advertising in igc has two problems:
+
+- When setting the advertisement via ethtool, the link speed is converted
+ to the legacy 32 bit representation for the intel PHY code.
+ This inadvertently drops ETHTOOL_LINK_MODE_2500baseT_Full_BIT (being
+ beyond bit 31). As a result, any call to `ethtool -s ...' drops the
+ 2500Mbit/s link speed from the PHY settings. Only reloading the driver
+ alleviates that problem.
+
+ Fix this by converting the ETHTOOL_LINK_MODE_2500baseT_Full_BIT to the
+ Intel PHY ADVERTISE_2500_FULL bit explicitly.
+
+- Rather than checking the actual PHY setting, the .get_link_ksettings
+ function always fills link_modes.advertising with all link speeds
+ the device is capable of.
+
+ Fix this by checking the PHY autoneg_advertised settings and report
+ only the actually advertised speeds up to ethtool.
+
+Fixes: 8c5ad0dae93c ("igc: Add ethtool support")
+Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_ethtool.c | 24 +++++++++++++++-----
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c
+index 61d331ce38cdd..831f2f09de5fb 100644
+--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c
++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c
+@@ -1675,12 +1675,18 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev,
+ cmd->base.phy_address = hw->phy.addr;
+
+ /* advertising link modes */
+- ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half);
+- ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full);
+- ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half);
+- ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full);
+- ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full);
+- ethtool_link_ksettings_add_link_mode(cmd, advertising, 2500baseT_Full);
++ if (hw->phy.autoneg_advertised & ADVERTISE_10_HALF)
++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half);
++ if (hw->phy.autoneg_advertised & ADVERTISE_10_FULL)
++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full);
++ if (hw->phy.autoneg_advertised & ADVERTISE_100_HALF)
++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half);
++ if (hw->phy.autoneg_advertised & ADVERTISE_100_FULL)
++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full);
++ if (hw->phy.autoneg_advertised & ADVERTISE_1000_FULL)
++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full);
++ if (hw->phy.autoneg_advertised & ADVERTISE_2500_FULL)
++ ethtool_link_ksettings_add_link_mode(cmd, advertising, 2500baseT_Full);
+
+ /* set autoneg settings */
+ if (hw->mac.autoneg == 1) {
+@@ -1792,6 +1798,12 @@ igc_ethtool_set_link_ksettings(struct net_device *netdev,
+
+ ethtool_convert_link_mode_to_legacy_u32(&advertising,
+ cmd->link_modes.advertising);
++ /* Converting to legacy u32 drops ETHTOOL_LINK_MODE_2500baseT_Full_BIT.
++ * We have to check this and convert it to ADVERTISE_2500_FULL
++ * (aka ETHTOOL_LINK_MODE_2500baseX_Full_BIT) explicitly.
++ */
++ if (ethtool_link_ksettings_test_link_mode(cmd, advertising, 2500baseT_Full))
++ advertising |= ADVERTISE_2500_FULL;
+
+ if (cmd->base.autoneg == AUTONEG_ENABLE) {
+ hw->mac.autoneg = 1;
+--
+2.27.0
+
--- /dev/null
+From 2065067f8909b6eb68ed1c066997881bce23a8e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 07:50:02 -0600
+Subject: iommu/amd: Use IVHD EFR for early initialization of IOMMU features
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+[ Upstream commit a44092e326d403c7878018ba532369f84d31dbfa ]
+
+IOMMU Extended Feature Register (EFR) is used to communicate
+the supported features for each IOMMU to the IOMMU driver.
+This is normally read from the PCI MMIO register offset 0x30,
+and used by the iommu_feature() helper function.
+
+However, there are certain scenarios where the information is needed
+prior to PCI initialization, and the iommu_feature() function is used
+prematurely w/o warning. This has caused incorrect initialization of IOMMU.
+This is the case for the commit 6d39bdee238f ("iommu/amd: Enforce 4k
+mapping for certain IOMMU data structures")
+
+Since, the EFR is also available in the IVHD header, and is available to
+the driver prior to PCI initialization. Therefore, default to using
+the IVHD EFR instead.
+
+Fixes: 6d39bdee238f ("iommu/amd: Enforce 4k mapping for certain IOMMU data structures")
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Tested-by: Brijesh Singh <brijesh.singh@amd.com>
+Reviewed-by: Robert Richter <rrichter@amd.com>
+Link: https://lore.kernel.org/r/20210120135002.2682-1-suravee.suthikulpanit@amd.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/amd_iommu.h | 7 ++--
+ drivers/iommu/amd/amd_iommu_types.h | 4 +++
+ drivers/iommu/amd/init.c | 56 +++++++++++++++++++++++++++--
+ 3 files changed, 60 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/iommu/amd/amd_iommu.h b/drivers/iommu/amd/amd_iommu.h
+index 6b8cbdf717140..b4adab6985632 100644
+--- a/drivers/iommu/amd/amd_iommu.h
++++ b/drivers/iommu/amd/amd_iommu.h
+@@ -84,12 +84,9 @@ static inline bool is_rd890_iommu(struct pci_dev *pdev)
+ (pdev->device == PCI_DEVICE_ID_RD890_IOMMU);
+ }
+
+-static inline bool iommu_feature(struct amd_iommu *iommu, u64 f)
++static inline bool iommu_feature(struct amd_iommu *iommu, u64 mask)
+ {
+- if (!(iommu->cap & (1 << IOMMU_CAP_EFR)))
+- return false;
+-
+- return !!(iommu->features & f);
++ return !!(iommu->features & mask);
+ }
+
+ static inline u64 iommu_virt_to_phys(void *vaddr)
+diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
+index 494b42a31b7ae..33446c9d3bac8 100644
+--- a/drivers/iommu/amd/amd_iommu_types.h
++++ b/drivers/iommu/amd/amd_iommu_types.h
+@@ -379,6 +379,10 @@
+ #define IOMMU_CAP_NPCACHE 26
+ #define IOMMU_CAP_EFR 27
+
++/* IOMMU IVINFO */
++#define IOMMU_IVINFO_OFFSET 36
++#define IOMMU_IVINFO_EFRSUP BIT(0)
++
+ /* IOMMU Feature Reporting Field (for IVHD type 10h */
+ #define IOMMU_FEAT_GASUP_SHIFT 6
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 23a790f8f5506..c842545368fdd 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -257,6 +257,8 @@ static void init_device_table_dma(void);
+
+ static bool amd_iommu_pre_enabled = true;
+
++static u32 amd_iommu_ivinfo __initdata;
++
+ bool translation_pre_enabled(struct amd_iommu *iommu)
+ {
+ return (iommu->flags & AMD_IOMMU_FLAG_TRANS_PRE_ENABLED);
+@@ -296,6 +298,18 @@ int amd_iommu_get_num_iommus(void)
+ return amd_iommus_present;
+ }
+
++/*
++ * For IVHD type 0x11/0x40, EFR is also available via IVHD.
++ * Default to IVHD EFR since it is available sooner
++ * (i.e. before PCI init).
++ */
++static void __init early_iommu_features_init(struct amd_iommu *iommu,
++ struct ivhd_header *h)
++{
++ if (amd_iommu_ivinfo & IOMMU_IVINFO_EFRSUP)
++ iommu->features = h->efr_reg;
++}
++
+ /* Access to l1 and l2 indexed register spaces */
+
+ static u32 iommu_read_l1(struct amd_iommu *iommu, u16 l1, u8 address)
+@@ -1584,6 +1598,9 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
+ if ((h->efr_reg & BIT(IOMMU_EFR_XTSUP_SHIFT)) &&
+ (h->efr_reg & BIT(IOMMU_EFR_MSICAPMMIOSUP_SHIFT)))
+ amd_iommu_xt_mode = IRQ_REMAP_X2APIC_MODE;
++
++ early_iommu_features_init(iommu, h);
++
+ break;
+ default:
+ return -EINVAL;
+@@ -1775,6 +1792,35 @@ static const struct attribute_group *amd_iommu_groups[] = {
+ NULL,
+ };
+
++/*
++ * Note: IVHD 0x11 and 0x40 also contains exact copy
++ * of the IOMMU Extended Feature Register [MMIO Offset 0030h].
++ * Default to EFR in IVHD since it is available sooner (i.e. before PCI init).
++ */
++static void __init late_iommu_features_init(struct amd_iommu *iommu)
++{
++ u64 features;
++
++ if (!(iommu->cap & (1 << IOMMU_CAP_EFR)))
++ return;
++
++ /* read extended feature bits */
++ features = readq(iommu->mmio_base + MMIO_EXT_FEATURES);
++
++ if (!iommu->features) {
++ iommu->features = features;
++ return;
++ }
++
++ /*
++ * Sanity check and warn if EFR values from
++ * IVHD and MMIO conflict.
++ */
++ if (features != iommu->features)
++ pr_warn(FW_WARN "EFR mismatch. Use IVHD EFR (%#llx : %#llx\n).",
++ features, iommu->features);
++}
++
+ static int __init iommu_init_pci(struct amd_iommu *iommu)
+ {
+ int cap_ptr = iommu->cap_ptr;
+@@ -1794,8 +1840,7 @@ static int __init iommu_init_pci(struct amd_iommu *iommu)
+ if (!(iommu->cap & (1 << IOMMU_CAP_IOTLB)))
+ amd_iommu_iotlb_sup = false;
+
+- /* read extended feature bits */
+- iommu->features = readq(iommu->mmio_base + MMIO_EXT_FEATURES);
++ late_iommu_features_init(iommu);
+
+ if (iommu_feature(iommu, FEATURE_GT)) {
+ int glxval;
+@@ -2525,6 +2570,11 @@ static void __init free_dma_resources(void)
+ free_unity_maps();
+ }
+
++static void __init ivinfo_init(void *ivrs)
++{
++ amd_iommu_ivinfo = *((u32 *)(ivrs + IOMMU_IVINFO_OFFSET));
++}
++
+ /*
+ * This is the hardware init function for AMD IOMMU in the system.
+ * This function is called either from amd_iommu_init or from the interrupt
+@@ -2579,6 +2629,8 @@ static int __init early_amd_iommu_init(void)
+ if (ret)
+ goto out;
+
++ ivinfo_init(ivrs_base);
++
+ amd_iommu_target_ivhd_type = get_highest_supported_ivhd_type(ivrs_base);
+ DUMP_printk("Using IVHD type %#x\n", amd_iommu_target_ivhd_type);
+
+--
+2.27.0
+
--- /dev/null
+From 01cc3d609e0b28a261ea02d4fb326455a81e5b87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 12:35:00 +0800
+Subject: iommu/vt-d: Correctly check addr alignment in
+ qi_flush_dev_iotlb_pasid()
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 494b3688bb11a21af12e92a344a1313486693d47 ]
+
+An incorrect address mask is being used in the qi_flush_dev_iotlb_pasid()
+to check the address alignment. This leads to a lot of spurious kernel
+warnings:
+
+[ 485.837093] DMAR: Invalidate non-aligned address 7f76f47f9000, order 0
+[ 485.837098] DMAR: Invalidate non-aligned address 7f76f47f9000, order 0
+[ 492.494145] qi_flush_dev_iotlb_pasid: 5734 callbacks suppressed
+[ 492.494147] DMAR: Invalidate non-aligned address 7f7728800000, order 11
+[ 492.508965] DMAR: Invalidate non-aligned address 7f7728800000, order 11
+
+Fix it by checking the alignment in right way.
+
+Fixes: 288d08e780088 ("iommu/vt-d: Handle non-page aligned address")
+Reported-and-tested-by: Guo Kaijie <Kaijie.Guo@intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Cc: Liu Yi L <yi.l.liu@intel.com>
+Link: https://lore.kernel.org/r/20210119043500.1539596-1-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/dmar.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c
+index 004feaed3c72c..02e7c10a4224b 100644
+--- a/drivers/iommu/intel/dmar.c
++++ b/drivers/iommu/intel/dmar.c
+@@ -1496,7 +1496,7 @@ void qi_flush_dev_iotlb_pasid(struct intel_iommu *iommu, u16 sid, u16 pfsid,
+ * Max Invs Pending (MIP) is set to 0 for now until we have DIT in
+ * ECAP.
+ */
+- if (addr & GENMASK_ULL(size_order + VTD_PAGE_SHIFT, 0))
++ if (!IS_ALIGNED(addr, VTD_PAGE_SIZE << size_order))
+ pr_warn_ratelimited("Invalidate non-aligned address %llx, order %d\n",
+ addr, size_order);
+
+--
+2.27.0
+
--- /dev/null
+From 1554fd0a30b79fa9c170afcbffd504bd3fa11c11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 13:05:49 +0200
+Subject: iwlwifi: pcie: avoid potential PNVM leaks
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 34b9434cd0d425330a0467e767f8d047ef62964d ]
+
+If we erroneously try to set the PNVM data again after it has
+already been set, we could leak the old DMA memory. Avoid that
+and warn, we shouldn't be doing this.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Fixes: 6972592850c0 ("iwlwifi: read and parse PNVM file")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20210115130252.929c2d680429.I086b9490e6c005f3bcaa881b617e9f61908160f3@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+index 5512e3c630c31..eeb87cf5ee857 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+@@ -341,6 +341,9 @@ int iwl_trans_pcie_ctx_info_gen3_set_pnvm(struct iwl_trans *trans,
+ return ret;
+ }
+
++ if (WARN_ON(prph_sc_ctrl->pnvm_cfg.pnvm_size))
++ return -EBUSY;
++
+ prph_sc_ctrl->pnvm_cfg.pnvm_base_addr =
+ cpu_to_le64(trans_pcie->pnvm_dram.physical);
+ prph_sc_ctrl->pnvm_cfg.pnvm_size =
+--
+2.27.0
+
--- /dev/null
+From 6a0745f818e7cd8874bf1527fde6ca67a7f1304a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 13:05:58 +0200
+Subject: iwlwifi: pcie: reschedule in long-running memory reads
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 3d372c4edfd4dffb7dea71c6b096fb414782b776 ]
+
+If we spin for a long time in memory reads that (for some reason in
+hardware) take a long time, then we'll eventually get messages such
+as
+
+ watchdog: BUG: soft lockup - CPU#2 stuck for 24s! [kworker/2:2:272]
+
+This is because the reading really does take a very long time, and
+we don't schedule, so we're hogging the CPU with this task, at least
+if CONFIG_PREEMPT is not set, e.g. with CONFIG_PREEMPT_VOLUNTARY=y.
+
+Previously I misinterpreted the situation and thought that this was
+only going to happen if we had interrupts disabled, and then fixed
+this (which is good anyway, however), but that didn't always help;
+looking at it again now I realized that the spin unlock will only
+reschedule if CONFIG_PREEMPT is used.
+
+In order to avoid this issue, change the code to cond_resched() if
+we've been spinning for too long here.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Fixes: 04516706bb99 ("iwlwifi: pcie: limit memory read spin time")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20210115130253.217a9d6a6a12.If964cb582ab0aaa94e81c4ff3b279eaafda0fd3f@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index c7161f121c0c2..1a222469b5b4e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -2162,6 +2162,7 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
+ while (offs < dwords) {
+ /* limit the time we spin here under lock to 1/2s */
+ unsigned long end = jiffies + HZ / 2;
++ bool resched = false;
+
+ if (iwl_trans_grab_nic_access(trans, &flags)) {
+ iwl_write32(trans, HBUS_TARG_MEM_RADDR,
+@@ -2172,10 +2173,15 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
+ HBUS_TARG_MEM_RDAT);
+ offs++;
+
+- if (time_after(jiffies, end))
++ if (time_after(jiffies, end)) {
++ resched = true;
+ break;
++ }
+ }
+ iwl_trans_release_nic_access(trans, &flags);
++
++ if (resched)
++ cond_resched();
+ } else {
+ return -EBUSY;
+ }
+--
+2.27.0
+
--- /dev/null
+From aa90239f6d9c4346173cdf36f1f0b13050916cb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 13:05:54 +0200
+Subject: iwlwifi: pcie: set LTR on more devices
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit ed0022da8bd9a3ba1c0e1497457be28d52afa7e1 ]
+
+To avoid completion timeouts during device boot, set up the
+LTR timeouts on more devices - similar to what we had before
+for AX210.
+
+This also corrects the AX210 workaround to be done only on
+discrete (non-integrated) devices, otherwise the registers
+have no effect.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Fixes: edb625208d84 ("iwlwifi: pcie: set LTR to avoid completion timeout")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20210115130252.fb819e19530b.I0396f82922db66426f52fbb70d32a29c8fd66951@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-prph.h | 6 +++
+ .../intel/iwlwifi/pcie/ctxt-info-gen3.c | 39 +++++++++++--------
+ 2 files changed, 28 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+index fa3f15778fc7b..579578534f9d9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+@@ -355,6 +355,12 @@
+ #define RADIO_RSP_ADDR_POS (6)
+ #define RADIO_RSP_RD_CMD (3)
+
++/* LTR control (Qu only) */
++#define HPM_MAC_LTR_CSR 0xa0348c
++#define HPM_MAC_LRT_ENABLE_ALL 0xf
++/* also uses CSR_LTR_* for values */
++#define HPM_UMAC_LTR 0xa03480
++
+ /* FW monitor */
+ #define MON_BUFF_SAMPLE_CTL (0xa03c00)
+ #define MON_BUFF_BASE_ADDR (0xa03c1c)
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+index eeb87cf5ee857..d719e433a59bf 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+@@ -122,6 +122,15 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
+ const struct fw_img *fw)
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++ u32 ltr_val = CSR_LTR_LONG_VAL_AD_NO_SNOOP_REQ |
++ u32_encode_bits(CSR_LTR_LONG_VAL_AD_SCALE_USEC,
++ CSR_LTR_LONG_VAL_AD_NO_SNOOP_SCALE) |
++ u32_encode_bits(250,
++ CSR_LTR_LONG_VAL_AD_NO_SNOOP_VAL) |
++ CSR_LTR_LONG_VAL_AD_SNOOP_REQ |
++ u32_encode_bits(CSR_LTR_LONG_VAL_AD_SCALE_USEC,
++ CSR_LTR_LONG_VAL_AD_SNOOP_SCALE) |
++ u32_encode_bits(250, CSR_LTR_LONG_VAL_AD_SNOOP_VAL);
+ struct iwl_context_info_gen3 *ctxt_info_gen3;
+ struct iwl_prph_scratch *prph_scratch;
+ struct iwl_prph_scratch_ctrl_cfg *prph_sc_ctrl;
+@@ -253,23 +262,19 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
+ iwl_set_bit(trans, CSR_CTXT_INFO_BOOT_CTRL,
+ CSR_AUTO_FUNC_BOOT_ENA);
+
+- if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_AX210) {
+- /*
+- * The firmware initializes this again later (to a smaller
+- * value), but for the boot process initialize the LTR to
+- * ~250 usec.
+- */
+- u32 val = CSR_LTR_LONG_VAL_AD_NO_SNOOP_REQ |
+- u32_encode_bits(CSR_LTR_LONG_VAL_AD_SCALE_USEC,
+- CSR_LTR_LONG_VAL_AD_NO_SNOOP_SCALE) |
+- u32_encode_bits(250,
+- CSR_LTR_LONG_VAL_AD_NO_SNOOP_VAL) |
+- CSR_LTR_LONG_VAL_AD_SNOOP_REQ |
+- u32_encode_bits(CSR_LTR_LONG_VAL_AD_SCALE_USEC,
+- CSR_LTR_LONG_VAL_AD_SNOOP_SCALE) |
+- u32_encode_bits(250, CSR_LTR_LONG_VAL_AD_SNOOP_VAL);
+-
+- iwl_write32(trans, CSR_LTR_LONG_VAL_AD, val);
++ /*
++ * To workaround hardware latency issues during the boot process,
++ * initialize the LTR to ~250 usec (see ltr_val above).
++ * The firmware initializes this again later (to a smaller value).
++ */
++ if ((trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_AX210 ||
++ trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000) &&
++ !trans->trans_cfg->integrated) {
++ iwl_write32(trans, CSR_LTR_LONG_VAL_AD, ltr_val);
++ } else if (trans->trans_cfg->integrated &&
++ trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000) {
++ iwl_write_prph(trans, HPM_MAC_LTR_CSR, HPM_MAC_LRT_ENABLE_ALL);
++ iwl_write_prph(trans, HPM_UMAC_LTR, ltr_val);
+ }
+
+ if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210)
+--
+2.27.0
+
--- /dev/null
+From 7b3ab3d47925af5482f41e5c99563896ccba6c9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 13:05:57 +0200
+Subject: iwlwifi: pcie: use jiffies for memory read spin time limit
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 6701317476bbfb1f341aa935ddf75eb73af784f9 ]
+
+There's no reason to use ktime_get() since we don't need any better
+precision than jiffies, and since we no longer disable interrupts
+around this code (when grabbing NIC access), jiffies will work fine.
+Use jiffies instead of ktime_get().
+
+This cleanup is preparation for the following patch "iwlwifi: pcie: reschedule
+in long-running memory reads". The code gets simpler with the weird clock use
+etc. removed before we add cond_resched().
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20210115130253.621c948b1fad.I3ee9f4bc4e74a0c9125d42fb7c35cd80df4698a1@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 2fffbbc8462fc..c7161f121c0c2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -2161,7 +2161,7 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
+
+ while (offs < dwords) {
+ /* limit the time we spin here under lock to 1/2s */
+- ktime_t timeout = ktime_add_us(ktime_get(), 500 * USEC_PER_MSEC);
++ unsigned long end = jiffies + HZ / 2;
+
+ if (iwl_trans_grab_nic_access(trans, &flags)) {
+ iwl_write32(trans, HBUS_TARG_MEM_RADDR,
+@@ -2172,11 +2172,7 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
+ HBUS_TARG_MEM_RDAT);
+ offs++;
+
+- /* calling ktime_get is expensive so
+- * do it once in 128 reads
+- */
+- if (offs % 128 == 0 && ktime_after(ktime_get(),
+- timeout))
++ if (time_after(jiffies, end))
+ break;
+ }
+ iwl_trans_release_nic_access(trans, &flags);
+--
+2.27.0
+
--- /dev/null
+From 0575b7db3583ccb9be00125ae756bda978a4d9ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 13:05:50 +0200
+Subject: iwlwifi: pnvm: don't skip everything when not reloading
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 1c58bed4b7f7551239b9005ad0a9a6566a3d9fbe ]
+
+Even if we don't reload the file from disk, we still need to
+trigger the PNVM load flow with the device; fix that.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Fixes: 6972592850c0 ("iwlwifi: read and parse PNVM file")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20210115130252.85ef56c4ef8c.I3b853ce041a0755d45e448035bef1837995d191b@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 50 ++++++++++----------
+ 1 file changed, 25 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+index 6d8f7bff12432..ebd1a09a2fb8a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+@@ -224,40 +224,40 @@ static int iwl_pnvm_parse(struct iwl_trans *trans, const u8 *data,
+ int iwl_pnvm_load(struct iwl_trans *trans,
+ struct iwl_notif_wait_data *notif_wait)
+ {
+- const struct firmware *pnvm;
+ struct iwl_notification_wait pnvm_wait;
+ static const u16 ntf_cmds[] = { WIDE_ID(REGULATORY_AND_NVM_GROUP,
+ PNVM_INIT_COMPLETE_NTFY) };
+- char pnvm_name[64];
+- int ret;
+
+ /* if the SKU_ID is empty, there's nothing to do */
+ if (!trans->sku_id[0] && !trans->sku_id[1] && !trans->sku_id[2])
+ return 0;
+
+- /* if we already have it, nothing to do either */
+- if (trans->pnvm_loaded)
+- return 0;
++ /* load from disk only if we haven't done it before */
++ if (!trans->pnvm_loaded) {
++ const struct firmware *pnvm;
++ char pnvm_name[64];
++ int ret;
++
++ /*
++ * The prefix unfortunately includes a hyphen at the end, so
++ * don't add the dot here...
++ */
++ snprintf(pnvm_name, sizeof(pnvm_name), "%spnvm",
++ trans->cfg->fw_name_pre);
++
++ /* ...but replace the hyphen with the dot here. */
++ if (strlen(trans->cfg->fw_name_pre) < sizeof(pnvm_name))
++ pnvm_name[strlen(trans->cfg->fw_name_pre) - 1] = '.';
++
++ ret = firmware_request_nowarn(&pnvm, pnvm_name, trans->dev);
++ if (ret) {
++ IWL_DEBUG_FW(trans, "PNVM file %s not found %d\n",
++ pnvm_name, ret);
++ } else {
++ iwl_pnvm_parse(trans, pnvm->data, pnvm->size);
+
+- /*
+- * The prefix unfortunately includes a hyphen at the end, so
+- * don't add the dot here...
+- */
+- snprintf(pnvm_name, sizeof(pnvm_name), "%spnvm",
+- trans->cfg->fw_name_pre);
+-
+- /* ...but replace the hyphen with the dot here. */
+- if (strlen(trans->cfg->fw_name_pre) < sizeof(pnvm_name))
+- pnvm_name[strlen(trans->cfg->fw_name_pre) - 1] = '.';
+-
+- ret = firmware_request_nowarn(&pnvm, pnvm_name, trans->dev);
+- if (ret) {
+- IWL_DEBUG_FW(trans, "PNVM file %s not found %d\n",
+- pnvm_name, ret);
+- } else {
+- iwl_pnvm_parse(trans, pnvm->data, pnvm->size);
+-
+- release_firmware(pnvm);
++ release_firmware(pnvm);
++ }
+ }
+
+ iwl_init_notification_wait(notif_wait, &pnvm_wait,
+--
+2.27.0
+
--- /dev/null
+From 63d6eb8390517ea2460f9de9ed18c000054caa59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 13:05:51 +0200
+Subject: iwlwifi: pnvm: don't try to load after failures
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 82a08d0cd7b503be426fb856a0fb73c9c976aae1 ]
+
+If loading the PNVM file failed on the first try during the
+interface up, the file is unlikely to show up later, and we
+already don't try to reload it if it changes, so just don't
+try loading it again and again.
+
+This also fixes some issues where we may try to load it at
+resume time, which may not be possible yet.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Fixes: 6972592850c0 ("iwlwifi: read and parse PNVM file")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20210115130252.5ac6828a0bbe.I7d308358b21d3c0c84b1086999dbc7267f86e219@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+index ebd1a09a2fb8a..895a907acdf0f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+@@ -232,7 +232,7 @@ int iwl_pnvm_load(struct iwl_trans *trans,
+ if (!trans->sku_id[0] && !trans->sku_id[1] && !trans->sku_id[2])
+ return 0;
+
+- /* load from disk only if we haven't done it before */
++ /* load from disk only if we haven't done it (or tried) before */
+ if (!trans->pnvm_loaded) {
+ const struct firmware *pnvm;
+ char pnvm_name[64];
+@@ -253,6 +253,12 @@ int iwl_pnvm_load(struct iwl_trans *trans,
+ if (ret) {
+ IWL_DEBUG_FW(trans, "PNVM file %s not found %d\n",
+ pnvm_name, ret);
++ /*
++ * Pretend we've loaded it - at least we've tried and
++ * couldn't load it at all, so there's no point in
++ * trying again over and over.
++ */
++ trans->pnvm_loaded = true;
+ } else {
+ iwl_pnvm_parse(trans, pnvm->data, pnvm->size);
+
+--
+2.27.0
+
--- /dev/null
+From bde56464e5020f87f8f192d2ee343504bdbbe3ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 17:11:16 +0100
+Subject: mac80211: pause TX while changing interface type
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 054c9939b4800a91475d8d89905827bf9e1ad97a ]
+
+syzbot reported a crash that happened when changing the interface
+type around a lot, and while it might have been easy to fix just
+the symptom there, a little deeper investigation found that really
+the reason is that we allowed packets to be transmitted while in
+the middle of changing the interface type.
+
+Disallow TX by stopping the queues while changing the type.
+
+Fixes: 34d4bc4d41d2 ("mac80211: support runtime interface type changes")
+Reported-by: syzbot+d7a3b15976bf7de2238a@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20210122171115.b321f98f4d4f.I6997841933c17b093535c31d29355be3c0c39628@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/ieee80211_i.h | 1 +
+ net/mac80211/iface.c | 6 ++++++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 2a21226fb518a..d6913784be2bd 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1082,6 +1082,7 @@ enum queue_stop_reason {
+ IEEE80211_QUEUE_STOP_REASON_FLUSH,
+ IEEE80211_QUEUE_STOP_REASON_TDLS_TEARDOWN,
+ IEEE80211_QUEUE_STOP_REASON_RESERVE_TID,
++ IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE,
+
+ IEEE80211_QUEUE_STOP_REASONS,
+ };
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 44154cc596cd4..f3c3557a9e4c4 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1654,6 +1654,10 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
+ if (ret)
+ return ret;
+
++ ieee80211_stop_vif_queues(local, sdata,
++ IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
++ synchronize_net();
++
+ ieee80211_do_stop(sdata, false);
+
+ ieee80211_teardown_sdata(sdata);
+@@ -1676,6 +1680,8 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
+ err = ieee80211_do_open(&sdata->wdev, false);
+ WARN(err, "type change: do_open returned %d", err);
+
++ ieee80211_wake_vif_queues(local, sdata,
++ IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
+ return ret;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From cda941a8e1a9ce4f88f7443791153feac4ffd555 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 17:31:26 +0200
+Subject: net/mlx5: CT: Fix incorrect removal of tuple_nat_node from nat
+ rhashtable
+
+From: Paul Blakey <paulb@nvidia.com>
+
+[ Upstream commit e2194a1744e8594e82a861687808c1adca419b85 ]
+
+If a non nat tuple entry is inserted just to the regular tuples
+rhashtable (ct_tuples_ht) and not to natted tuples rhashtable
+(ct_nat_tuples_ht). Commit bc562be9674b ("net/mlx5e: CT: Save ct entries
+tuples in hashtables") mixed up the return labels and names sot that on
+cleanup or failure we still try to remove for the natted tuples rhashtable.
+
+Fix that by correctly checking if a natted tuples insertion
+before removing it. While here make it more readable.
+
+Fixes: bc562be9674b ("net/mlx5e: CT: Save ct entries tuples in hashtables")
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Paul Blakey <paulb@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/en/tc_ct.c | 20 ++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+index 072363e73f1ce..6bc6b48a56dc7 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+@@ -167,6 +167,12 @@ static const struct rhashtable_params tuples_nat_ht_params = {
+ .min_size = 16 * 1024,
+ };
+
++static bool
++mlx5_tc_ct_entry_has_nat(struct mlx5_ct_entry *entry)
++{
++ return !!(entry->tuple_nat_node.next);
++}
++
+ static int
+ mlx5_tc_ct_rule_to_tuple(struct mlx5_ct_tuple *tuple, struct flow_rule *rule)
+ {
+@@ -911,13 +917,13 @@ mlx5_tc_ct_block_flow_offload_add(struct mlx5_ct_ft *ft,
+ err_insert:
+ mlx5_tc_ct_entry_del_rules(ct_priv, entry);
+ err_rules:
+- rhashtable_remove_fast(&ct_priv->ct_tuples_nat_ht,
+- &entry->tuple_nat_node, tuples_nat_ht_params);
++ if (mlx5_tc_ct_entry_has_nat(entry))
++ rhashtable_remove_fast(&ct_priv->ct_tuples_nat_ht,
++ &entry->tuple_nat_node, tuples_nat_ht_params);
+ err_tuple_nat:
+- if (entry->tuple_node.next)
+- rhashtable_remove_fast(&ct_priv->ct_tuples_ht,
+- &entry->tuple_node,
+- tuples_ht_params);
++ rhashtable_remove_fast(&ct_priv->ct_tuples_ht,
++ &entry->tuple_node,
++ tuples_ht_params);
+ err_tuple:
+ err_set:
+ kfree(entry);
+@@ -932,7 +938,7 @@ mlx5_tc_ct_del_ft_entry(struct mlx5_tc_ct_priv *ct_priv,
+ {
+ mlx5_tc_ct_entry_del_rules(ct_priv, entry);
+ mutex_lock(&ct_priv->shared_counter_lock);
+- if (entry->tuple_node.next)
++ if (mlx5_tc_ct_entry_has_nat(entry))
+ rhashtable_remove_fast(&ct_priv->ct_tuples_nat_ht,
+ &entry->tuple_nat_node,
+ tuples_nat_ht_params);
+--
+2.27.0
+
--- /dev/null
+From a0e7d42a839826b40573393bd84a815c8bacb0d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jan 2021 14:04:29 +0200
+Subject: net/mlx5: Fix memory leak on flow table creation error flow
+
+From: Roi Dayan <roid@nvidia.com>
+
+[ Upstream commit 487c6ef81eb98d0a43cb08be91b1fcc9b4250626 ]
+
+When we create the ft object we also init rhltable in ft->fgs_hash.
+So in error flow before kfree of ft we need to destroy that rhltable.
+
+Fixes: 693c6883bbc4 ("net/mlx5: Add hash table for flow groups in flow table")
+Signed-off-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Maor Dickman <maord@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index 9fdd99272e310..634c2bfd25be1 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -1141,6 +1141,7 @@ static struct mlx5_flow_table *__mlx5_create_flow_table(struct mlx5_flow_namespa
+ destroy_ft:
+ root->cmds->destroy_flow_table(root, ft);
+ free_ft:
++ rhltable_destroy(&ft->fgs_hash);
+ kfree(ft);
+ unlock_root:
+ mutex_unlock(&root->chain_lock);
+--
+2.27.0
+
--- /dev/null
+From 61ddf46b18fd11d01ab227894a50cc28f1d141f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 23:13:53 +0200
+Subject: net/mlx5: Maintain separate page trees for ECPF and PF functions
+
+From: Daniel Jurgens <danielj@nvidia.com>
+
+[ Upstream commit 0aa128475d33d2d0095947eeab6b3e4d22dbd578 ]
+
+Pages for the host PF and ECPF were stored in the same tree, so the ECPF
+pages were being freed along with the host PF's when the host driver
+unloaded.
+
+Combine the function ID and ECPF flag to use as an index into the
+x-array containing the trees to get a different tree for the host PF and
+ECPF.
+
+Fixes: c6168161f693 ("net/mlx5: Add support for release all pages event")
+Signed-off-by: Daniel Jurgens <danielj@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/pagealloc.c | 58 +++++++++++--------
+ 1 file changed, 34 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index 4d7f8a357df76..a3e0c71831928 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -58,7 +58,7 @@ struct fw_page {
+ struct rb_node rb_node;
+ u64 addr;
+ struct page *page;
+- u16 func_id;
++ u32 function;
+ unsigned long bitmask;
+ struct list_head list;
+ unsigned free_count;
+@@ -74,12 +74,17 @@ enum {
+ MLX5_NUM_4K_IN_PAGE = PAGE_SIZE / MLX5_ADAPTER_PAGE_SIZE,
+ };
+
+-static struct rb_root *page_root_per_func_id(struct mlx5_core_dev *dev, u16 func_id)
++static u32 get_function(u16 func_id, bool ec_function)
++{
++ return func_id & (ec_function << 16);
++}
++
++static struct rb_root *page_root_per_function(struct mlx5_core_dev *dev, u32 function)
+ {
+ struct rb_root *root;
+ int err;
+
+- root = xa_load(&dev->priv.page_root_xa, func_id);
++ root = xa_load(&dev->priv.page_root_xa, function);
+ if (root)
+ return root;
+
+@@ -87,7 +92,7 @@ static struct rb_root *page_root_per_func_id(struct mlx5_core_dev *dev, u16 func
+ if (!root)
+ return ERR_PTR(-ENOMEM);
+
+- err = xa_insert(&dev->priv.page_root_xa, func_id, root, GFP_KERNEL);
++ err = xa_insert(&dev->priv.page_root_xa, function, root, GFP_KERNEL);
+ if (err) {
+ kfree(root);
+ return ERR_PTR(err);
+@@ -98,7 +103,7 @@ static struct rb_root *page_root_per_func_id(struct mlx5_core_dev *dev, u16 func
+ return root;
+ }
+
+-static int insert_page(struct mlx5_core_dev *dev, u64 addr, struct page *page, u16 func_id)
++static int insert_page(struct mlx5_core_dev *dev, u64 addr, struct page *page, u32 function)
+ {
+ struct rb_node *parent = NULL;
+ struct rb_root *root;
+@@ -107,7 +112,7 @@ static int insert_page(struct mlx5_core_dev *dev, u64 addr, struct page *page, u
+ struct fw_page *tfp;
+ int i;
+
+- root = page_root_per_func_id(dev, func_id);
++ root = page_root_per_function(dev, function);
+ if (IS_ERR(root))
+ return PTR_ERR(root);
+
+@@ -130,7 +135,7 @@ static int insert_page(struct mlx5_core_dev *dev, u64 addr, struct page *page, u
+
+ nfp->addr = addr;
+ nfp->page = page;
+- nfp->func_id = func_id;
++ nfp->function = function;
+ nfp->free_count = MLX5_NUM_4K_IN_PAGE;
+ for (i = 0; i < MLX5_NUM_4K_IN_PAGE; i++)
+ set_bit(i, &nfp->bitmask);
+@@ -143,14 +148,14 @@ static int insert_page(struct mlx5_core_dev *dev, u64 addr, struct page *page, u
+ }
+
+ static struct fw_page *find_fw_page(struct mlx5_core_dev *dev, u64 addr,
+- u32 func_id)
++ u32 function)
+ {
+ struct fw_page *result = NULL;
+ struct rb_root *root;
+ struct rb_node *tmp;
+ struct fw_page *tfp;
+
+- root = xa_load(&dev->priv.page_root_xa, func_id);
++ root = xa_load(&dev->priv.page_root_xa, function);
+ if (WARN_ON_ONCE(!root))
+ return NULL;
+
+@@ -194,14 +199,14 @@ static int mlx5_cmd_query_pages(struct mlx5_core_dev *dev, u16 *func_id,
+ return err;
+ }
+
+-static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr, u16 func_id)
++static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr, u32 function)
+ {
+ struct fw_page *fp = NULL;
+ struct fw_page *iter;
+ unsigned n;
+
+ list_for_each_entry(iter, &dev->priv.free_list, list) {
+- if (iter->func_id != func_id)
++ if (iter->function != function)
+ continue;
+ fp = iter;
+ }
+@@ -231,7 +236,7 @@ static void free_fwp(struct mlx5_core_dev *dev, struct fw_page *fwp,
+ {
+ struct rb_root *root;
+
+- root = xa_load(&dev->priv.page_root_xa, fwp->func_id);
++ root = xa_load(&dev->priv.page_root_xa, fwp->function);
+ if (WARN_ON_ONCE(!root))
+ return;
+
+@@ -244,12 +249,12 @@ static void free_fwp(struct mlx5_core_dev *dev, struct fw_page *fwp,
+ kfree(fwp);
+ }
+
+-static void free_4k(struct mlx5_core_dev *dev, u64 addr, u32 func_id)
++static void free_4k(struct mlx5_core_dev *dev, u64 addr, u32 function)
+ {
+ struct fw_page *fwp;
+ int n;
+
+- fwp = find_fw_page(dev, addr & MLX5_U64_4K_PAGE_MASK, func_id);
++ fwp = find_fw_page(dev, addr & MLX5_U64_4K_PAGE_MASK, function);
+ if (!fwp) {
+ mlx5_core_warn_rl(dev, "page not found\n");
+ return;
+@@ -263,7 +268,7 @@ static void free_4k(struct mlx5_core_dev *dev, u64 addr, u32 func_id)
+ list_add(&fwp->list, &dev->priv.free_list);
+ }
+
+-static int alloc_system_page(struct mlx5_core_dev *dev, u16 func_id)
++static int alloc_system_page(struct mlx5_core_dev *dev, u32 function)
+ {
+ struct device *device = mlx5_core_dma_dev(dev);
+ int nid = dev_to_node(device);
+@@ -291,7 +296,7 @@ map:
+ goto map;
+ }
+
+- err = insert_page(dev, addr, page, func_id);
++ err = insert_page(dev, addr, page, function);
+ if (err) {
+ mlx5_core_err(dev, "failed to track allocated page\n");
+ dma_unmap_page(device, addr, PAGE_SIZE, DMA_BIDIRECTIONAL);
+@@ -328,6 +333,7 @@ static void page_notify_fail(struct mlx5_core_dev *dev, u16 func_id,
+ static int give_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
+ int notify_fail, bool ec_function)
+ {
++ u32 function = get_function(func_id, ec_function);
+ u32 out[MLX5_ST_SZ_DW(manage_pages_out)] = {0};
+ int inlen = MLX5_ST_SZ_BYTES(manage_pages_in);
+ u64 addr;
+@@ -345,10 +351,10 @@ static int give_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
+
+ for (i = 0; i < npages; i++) {
+ retry:
+- err = alloc_4k(dev, &addr, func_id);
++ err = alloc_4k(dev, &addr, function);
+ if (err) {
+ if (err == -ENOMEM)
+- err = alloc_system_page(dev, func_id);
++ err = alloc_system_page(dev, function);
+ if (err)
+ goto out_4k;
+
+@@ -384,7 +390,7 @@ retry:
+
+ out_4k:
+ for (i--; i >= 0; i--)
+- free_4k(dev, MLX5_GET64(manage_pages_in, in, pas[i]), func_id);
++ free_4k(dev, MLX5_GET64(manage_pages_in, in, pas[i]), function);
+ out_free:
+ kvfree(in);
+ if (notify_fail)
+@@ -392,14 +398,15 @@ out_free:
+ return err;
+ }
+
+-static void release_all_pages(struct mlx5_core_dev *dev, u32 func_id,
++static void release_all_pages(struct mlx5_core_dev *dev, u16 func_id,
+ bool ec_function)
+ {
++ u32 function = get_function(func_id, ec_function);
+ struct rb_root *root;
+ struct rb_node *p;
+ int npages = 0;
+
+- root = xa_load(&dev->priv.page_root_xa, func_id);
++ root = xa_load(&dev->priv.page_root_xa, function);
+ if (WARN_ON_ONCE(!root))
+ return;
+
+@@ -446,6 +453,7 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+ struct rb_root *root;
+ struct fw_page *fwp;
+ struct rb_node *p;
++ bool ec_function;
+ u32 func_id;
+ u32 npages;
+ u32 i = 0;
+@@ -456,8 +464,9 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+ /* No hard feelings, we want our pages back! */
+ npages = MLX5_GET(manage_pages_in, in, input_num_entries);
+ func_id = MLX5_GET(manage_pages_in, in, function_id);
++ ec_function = MLX5_GET(manage_pages_in, in, embedded_cpu_function);
+
+- root = xa_load(&dev->priv.page_root_xa, func_id);
++ root = xa_load(&dev->priv.page_root_xa, get_function(func_id, ec_function));
+ if (WARN_ON_ONCE(!root))
+ return -EEXIST;
+
+@@ -473,9 +482,10 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+ return 0;
+ }
+
+-static int reclaim_pages(struct mlx5_core_dev *dev, u32 func_id, int npages,
++static int reclaim_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
+ int *nclaimed, bool ec_function)
+ {
++ u32 function = get_function(func_id, ec_function);
+ int outlen = MLX5_ST_SZ_BYTES(manage_pages_out);
+ u32 in[MLX5_ST_SZ_DW(manage_pages_in)] = {};
+ int num_claimed;
+@@ -514,7 +524,7 @@ static int reclaim_pages(struct mlx5_core_dev *dev, u32 func_id, int npages,
+ }
+
+ for (i = 0; i < num_claimed; i++)
+- free_4k(dev, MLX5_GET64(manage_pages_out, out, pas[i]), func_id);
++ free_4k(dev, MLX5_GET64(manage_pages_out, out, pas[i]), function);
+
+ if (nclaimed)
+ *nclaimed = num_claimed;
+--
+2.27.0
+
--- /dev/null
+From 0246a1c51401fc37dd78dff2723833811934fa4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 12:56:56 +0200
+Subject: net/mlx5e: Correctly handle changing the number of queues when the
+ interface is down
+
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+
+[ Upstream commit 57ac4a31c48377a3e675b2a731ceacbefefcd34d ]
+
+This commit addresses two issues related to changing the number of
+queues when the channels are closed:
+
+1. Missing call to mlx5e_num_channels_changed to update
+real_num_tx_queues when the number of TCs is changed.
+
+2. When mlx5e_num_channels_changed returns an error, the channel
+parameters must be reverted.
+
+Two Fixes: tags correspond to the first commits where these two issues
+were introduced.
+
+Fixes: 3909a12e7913 ("net/mlx5e: Fix configuration of XPS cpumasks and netdev queues in corner cases")
+Fixes: fa3748775b92 ("net/mlx5e: Handle errors from netif_set_real_num_{tx,rx}_queues")
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 8 +++++++-
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 +++++++
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index f01395a9fd8df..e596f050c4316 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -444,12 +444,18 @@ int mlx5e_ethtool_set_channels(struct mlx5e_priv *priv,
+ goto out;
+ }
+
+- new_channels.params = priv->channels.params;
++ new_channels.params = *cur_params;
+ new_channels.params.num_channels = count;
+
+ if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
++ struct mlx5e_params old_params;
++
++ old_params = *cur_params;
+ *cur_params = new_channels.params;
+ err = mlx5e_num_channels_changed(priv);
++ if (err)
++ *cur_params = old_params;
++
+ goto out;
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index ba6c75618a710..000dacaa3333c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3580,7 +3580,14 @@ static int mlx5e_setup_tc_mqprio(struct mlx5e_priv *priv,
+ new_channels.params.num_tc = tc ? tc : 1;
+
+ if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
++ struct mlx5e_params old_params;
++
++ old_params = priv->channels.params;
+ priv->channels.params = new_channels.params;
++ err = mlx5e_num_channels_changed(priv);
++ if (err)
++ priv->channels.params = old_params;
++
+ goto out;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 473f7f4f9b98128dd92c6923c57d5b288637cfa6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Jan 2021 17:21:25 +0200
+Subject: net/mlx5e: Disable hw-tc-offload when MLX5_CLS_ACT config is disabled
+
+From: Maor Dickman <maord@nvidia.com>
+
+[ Upstream commit 156878d0e697187c7d207ee6c22afe50b7f3678c ]
+
+The cited commit introduce new CONFIG_MLX5_CLS_ACT kconfig variable
+to control compilation of TC hardware offloads implementation.
+When this configuration is disabled the driver is still wrongly
+reports in ethtool that hw-tc-offload is supported.
+
+Fixed by reporting hw-tc-offload is supported only when
+CONFIG_MLX5_CLS_ACT is enabled.
+
+Fixes: d956873f908c ("net/mlx5e: Introduce kconfig var for TC support")
+Signed-off-by: Maor Dickman <maord@nvidia.com>
+Reviewed-by: Vlad Buslov <vladbu@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 +-
+ drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index ebce97921e03c..ba6c75618a710 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -4990,7 +4990,7 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
+ FT_CAP(modify_root) &&
+ FT_CAP(identified_miss_table_mode) &&
+ FT_CAP(flow_table_modify)) {
+-#ifdef CONFIG_MLX5_ESWITCH
++#if IS_ENABLED(CONFIG_MLX5_CLS_ACT)
+ netdev->hw_features |= NETIF_F_HW_TC;
+ #endif
+ #ifdef CONFIG_MLX5_EN_ARFS
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+index 67247c33b9fd6..304435e561170 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+@@ -738,7 +738,9 @@ static void mlx5e_build_rep_netdev(struct net_device *netdev)
+
+ netdev->features |= NETIF_F_NETNS_LOCAL;
+
++#if IS_ENABLED(CONFIG_MLX5_CLS_ACT)
+ netdev->hw_features |= NETIF_F_HW_TC;
++#endif
+ netdev->hw_features |= NETIF_F_SG;
+ netdev->hw_features |= NETIF_F_IP_CSUM;
+ netdev->hw_features |= NETIF_F_IPV6_CSUM;
+--
+2.27.0
+
--- /dev/null
+From afb62282527b468e14f316c9d8ac461e5eeb5ddd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jan 2021 16:13:22 +0200
+Subject: net/mlx5e: E-switch, Fix rate calculation for overflow
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 1fe3e3166b35240615ab7f8276af2bbf2e51f559 ]
+
+rate_bytes_ps is a 64-bit field. It passed as 32-bit field to
+apply_police_params(). Due to this when police rate is higher
+than 4Gbps, 32-bit calculation ignores the carry. This results
+in incorrect rate configurationn the device.
+
+Fix it by performing 64-bit calculation.
+
+Fixes: fcb64c0f5640 ("net/mlx5: E-Switch, add ingress rate support")
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Reviewed-by: Eli Cohen <elic@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index ce710f22b1fff..98cd5d8b0cd8b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -67,6 +67,7 @@
+ #include "lib/geneve.h"
+ #include "lib/fs_chains.h"
+ #include "diag/en_tc_tracepoint.h"
++#include <asm/div64.h>
+
+ #define nic_chains(priv) ((priv)->fs.tc.chains)
+ #define MLX5_MH_ACT_SZ MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto)
+@@ -5009,13 +5010,13 @@ errout:
+ return err;
+ }
+
+-static int apply_police_params(struct mlx5e_priv *priv, u32 rate,
++static int apply_police_params(struct mlx5e_priv *priv, u64 rate,
+ struct netlink_ext_ack *extack)
+ {
+ struct mlx5e_rep_priv *rpriv = priv->ppriv;
+ struct mlx5_eswitch *esw;
++ u32 rate_mbps = 0;
+ u16 vport_num;
+- u32 rate_mbps;
+ int err;
+
+ vport_num = rpriv->rep->vport;
+@@ -5032,7 +5033,11 @@ static int apply_police_params(struct mlx5e_priv *priv, u32 rate,
+ * Moreover, if rate is non zero we choose to configure to a minimum of
+ * 1 mbit/sec.
+ */
+- rate_mbps = rate ? max_t(u32, (rate * 8 + 500000) / 1000000, 1) : 0;
++ if (rate) {
++ rate = (rate * BITS_PER_BYTE) + 500000;
++ rate_mbps = max_t(u32, do_div(rate, 1000000), 1);
++ }
++
+ err = mlx5_esw_modify_vport_rate(esw, vport_num, rate_mbps);
+ if (err)
+ NL_SET_ERR_MSG_MOD(extack, "failed applying action to hardware");
+--
+2.27.0
+
--- /dev/null
+From 78a09bc2e9b7f75e663f0dbe1d9e2b7accd1e570 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 10:06:45 +0200
+Subject: net/mlx5e: Fix CT rule + encap slow path offload and deletion
+
+From: Paul Blakey <paulb@nvidia.com>
+
+[ Upstream commit 89e394675818bde8e30e135611c506455fa03fb7 ]
+
+Currently, if a neighbour isn't valid when offloading tunnel encap rules,
+we offload the original match and replace the original action with
+"goto slow path" action. For this we use a temporary flow attribute based
+on the original flow attribute and then change the action. Flow flags,
+which among those is the CT flag, are still shared for the slow path rule
+offload, so we end up parsing this flow as a CT + goto slow path rule.
+
+Besides being unnecessary, CT action offload saves extra information in
+the passed flow attribute, such as created ct_flow and mod_hdr, which
+is lost onces the temporary flow attribute is freed.
+
+When a neigh is updated and is valid, we offload the original CT rule
+with original CT action, which again creates a ct_flow and mod_hdr
+and saves it in the flow's original attribute. Then we delete the slow
+path rule with a temporary flow attribute based on original updated
+flow attribute, and we free the relevant ct_flow and mod_hdr.
+
+Then when tc deletes this flow, we try to free the ct_flow and mod_hdr
+on the flow's attribute again.
+
+To fix the issue, skip all furture proccesing (CT/Sample/Split rules)
+in offload/unoffload of slow path rules.
+
+Call trace:
+[ 758.850525] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000218
+[ 758.952987] Internal error: Oops: 96000005 [#1] PREEMPT SMP
+[ 758.964170] Modules linked in: act_csum(E) act_pedit(E) act_tunnel_key(E) act_ct(E) nf_flow_table(E) xt_nat(E) ip6table_filter(E) ip6table_nat(E) xt_comment(E) ip6_tables(E) xt_conntrack(E) xt_MASQUERADE(E) nf_conntrack_netlink(E) xt_addrtype(E) iptable_filter(E) iptable_nat(E) bpfilter(E) br_netfilter(E) bridge(E) stp(E) llc(E) xfrm_user(E) overlay(E) act_mirred(E) act_skbedit(E) rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) esp6_offload(E) esp6(E) esp4_offload(E) esp4(E) xfrm_algo(E) mlx5_ib(OE) ib_uverbs(OE) geneve(E) ip6_udp_tunnel(E) udp_tunnel(E) nfnetlink_cttimeout(E) nfnetlink(E) mlx5_core(OE) act_gact(E) cls_flower(E) sch_ingress(E) openvswitch(E) nsh(E) nf_conncount(E) nf_nat(E) mlxfw(OE) psample(E) nf_conntrack(E) nf_defrag_ipv4(E) vfio_mdev(E) mdev(E) ib_core(OE) mlx_compat(OE) crct10dif_ce(E) uio_pdrv_genirq(E) uio(E) i2c_mlx(E) mlxbf_pmc(E) sbsa_gwdt(E) mlxbf_gige(E) gpio_mlxbf2(E) mlxbf_pka(E) mlx_trio(E) mlx_bootctl(E) bluefield_edac(E) knem(O)
+[ 758.964225] ip_tables(E) mlxbf_tmfifo(E) ipv6(E) crc_ccitt(E) nf_defrag_ipv6(E)
+[ 759.154186] CPU: 5 PID: 122 Comm: kworker/u16:1 Tainted: G OE 5.4.60-mlnx.52.gde81e85 #1
+[ 759.172870] Hardware name: https://www.mellanox.com BlueField SoC/BlueField SoC, BIOS BlueField:3.5.0-2-gc1b5d64 Jan 4 2021
+[ 759.195466] Workqueue: mlx5e mlx5e_rep_neigh_update [mlx5_core]
+[ 759.207344] pstate: a0000005 (NzCv daif -PAN -UAO)
+[ 759.217003] pc : mlx5_del_flow_rules+0x5c/0x160 [mlx5_core]
+[ 759.228229] lr : mlx5_del_flow_rules+0x34/0x160 [mlx5_core]
+[ 759.405858] Call trace:
+[ 759.410804] mlx5_del_flow_rules+0x5c/0x160 [mlx5_core]
+[ 759.421337] __mlx5_eswitch_del_rule.isra.43+0x5c/0x1c8 [mlx5_core]
+[ 759.433963] mlx5_eswitch_del_offloaded_rule_ct+0x34/0x40 [mlx5_core]
+[ 759.446942] mlx5_tc_rule_delete_ct+0x68/0x74 [mlx5_core]
+[ 759.457821] mlx5_tc_ct_delete_flow+0x160/0x21c [mlx5_core]
+[ 759.469051] mlx5e_tc_unoffload_fdb_rules+0x158/0x168 [mlx5_core]
+[ 759.481325] mlx5e_tc_encap_flows_del+0x140/0x26c [mlx5_core]
+[ 759.492901] mlx5e_rep_update_flows+0x11c/0x1ec [mlx5_core]
+[ 759.504127] mlx5e_rep_neigh_update+0x160/0x200 [mlx5_core]
+[ 759.515314] process_one_work+0x178/0x400
+[ 759.523350] worker_thread+0x58/0x3e8
+[ 759.530685] kthread+0x100/0x12c
+[ 759.537152] ret_from_fork+0x10/0x18
+[ 759.544320] Code: 97ffef55 51000673 3100067f 54ffff41 (b9421ab3)
+[ 759.556548] ---[ end trace fab818bb1085832d ]---
+
+Fixes: 4c3844d9e97e ("net/mlx5e: CT: Introduce connection tracking")
+Signed-off-by: Paul Blakey <paulb@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Vlad Buslov <vladbu@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index 3be34b1128731..4b8a442f09cd6 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -1165,6 +1165,9 @@ mlx5e_tc_offload_fdb_rules(struct mlx5_eswitch *esw,
+ struct mlx5e_tc_mod_hdr_acts *mod_hdr_acts;
+ struct mlx5_flow_handle *rule;
+
++ if (attr->flags & MLX5_ESW_ATTR_FLAG_SLOW_PATH)
++ return mlx5_eswitch_add_offloaded_rule(esw, spec, attr);
++
+ if (flow_flag_test(flow, CT)) {
+ mod_hdr_acts = &attr->parse_attr->mod_hdr_acts;
+
+@@ -1195,6 +1198,9 @@ mlx5e_tc_unoffload_fdb_rules(struct mlx5_eswitch *esw,
+ {
+ flow_flag_clear(flow, OFFLOADED);
+
++ if (attr->flags & MLX5_ESW_ATTR_FLAG_SLOW_PATH)
++ goto offload_rule_0;
++
+ if (flow_flag_test(flow, CT)) {
+ mlx5_tc_ct_delete_flow(get_ct_priv(flow->priv), flow, attr);
+ return;
+@@ -1203,6 +1209,7 @@ mlx5e_tc_unoffload_fdb_rules(struct mlx5_eswitch *esw,
+ if (attr->esw_attr->split_count)
+ mlx5_eswitch_del_fwd_rule(esw, flow->rule[1], attr);
+
++offload_rule_0:
+ mlx5_eswitch_del_offloaded_rule(esw, flow->rule[0], attr);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 7169d6e70824d1d40ccc9dc497862551b98ae8dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 20:58:30 -0800
+Subject: net/mlx5e: free page before return
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 258ed19f075fbc834fe5d69d8b54983fc11e0d4a ]
+
+Instead of directly return, goto the error handling label to free
+allocated page.
+
+Fixes: 5f29458b77d5 ("net/mlx5e: Support dump callback in TX reporter")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/health.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/health.c b/drivers/net/ethernet/mellanox/mlx5/core/en/health.c
+index 69a05da0e3e3d..e03e78a35df00 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/health.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/health.c
+@@ -275,7 +275,7 @@ int mlx5e_health_rsc_fmsg_dump(struct mlx5e_priv *priv, struct mlx5_rsc_key *key
+
+ err = devlink_fmsg_binary_pair_nest_start(fmsg, "data");
+ if (err)
+- return err;
++ goto free_page;
+
+ cmd = mlx5_rsc_dump_cmd_create(mdev, key);
+ if (IS_ERR(cmd)) {
+--
+2.27.0
+
--- /dev/null
+From f29094393528dc12cd40450c2314639896755d15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 17:21:38 +0200
+Subject: net/mlx5e: Reduce tc unsupported key print level
+
+From: Maor Dickman <maord@nvidia.com>
+
+[ Upstream commit 48470a90a42a64dd2f70743a149894a292b356e0 ]
+
+"Unsupported key used:" appears in kernel log when flows with
+unsupported key are used, arp fields for example.
+
+OpenVSwitch was changed to match on arp fields by default that
+caused this warning to appear in kernel log for every arp rule, which
+can be a lot.
+
+Fix by lowering print level from warning to debug.
+
+Fixes: e3a2b7ed018e ("net/mlx5e: Support offload cls_flower with drop action")
+Signed-off-by: Maor Dickman <maord@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index 98cd5d8b0cd8b..3be34b1128731 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -2272,8 +2272,8 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
+ BIT(FLOW_DISSECTOR_KEY_ENC_OPTS) |
+ BIT(FLOW_DISSECTOR_KEY_MPLS))) {
+ NL_SET_ERR_MSG_MOD(extack, "Unsupported key");
+- netdev_warn(priv->netdev, "Unsupported key used: 0x%x\n",
+- dissector->used_keys);
++ netdev_dbg(priv->netdev, "Unsupported key used: 0x%x\n",
++ dissector->used_keys);
+ return -EOPNOTSUPP;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From b7109f2e52591d62411ba1dab5d6b89f6db07e43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 12:34:01 +0200
+Subject: net/mlx5e: Revert parameters on errors when changing trust state
+ without reset
+
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+
+[ Upstream commit 912c9b5fcca1ab65b806c19dd3b3cb12d73c6fe2 ]
+
+Trust state may be changed without recreating the channels. It happens
+when the channels are closed, and when channel parameters (min inline
+mode) stay the same after changing the trust state. Changing the trust
+state is a hardware command that may fail. The current code didn't
+restore the channel parameters to their old values if an error happened
+and the channels were closed. This commit adds handling for this case.
+
+Fixes: 6e0504c69811 ("net/mlx5e: Change inline mode correctly when changing trust state")
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+index d20243d6a0326..f23c67575073a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+@@ -1151,6 +1151,7 @@ static int mlx5e_set_trust_state(struct mlx5e_priv *priv, u8 trust_state)
+ {
+ struct mlx5e_channels new_channels = {};
+ bool reset_channels = true;
++ bool opened;
+ int err = 0;
+
+ mutex_lock(&priv->state_lock);
+@@ -1159,22 +1160,24 @@ static int mlx5e_set_trust_state(struct mlx5e_priv *priv, u8 trust_state)
+ mlx5e_params_calc_trust_tx_min_inline_mode(priv->mdev, &new_channels.params,
+ trust_state);
+
+- if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
+- priv->channels.params = new_channels.params;
++ opened = test_bit(MLX5E_STATE_OPENED, &priv->state);
++ if (!opened)
+ reset_channels = false;
+- }
+
+ /* Skip if tx_min_inline is the same */
+ if (new_channels.params.tx_min_inline_mode ==
+ priv->channels.params.tx_min_inline_mode)
+ reset_channels = false;
+
+- if (reset_channels)
++ if (reset_channels) {
+ err = mlx5e_safe_switch_channels(priv, &new_channels,
+ mlx5e_update_trust_state_hw,
+ &trust_state);
+- else
++ } else {
+ err = mlx5e_update_trust_state_hw(priv, &trust_state);
++ if (!err && !opened)
++ priv->channels.params = new_channels.params;
++ }
+
+ mutex_unlock(&priv->state_lock);
+
+--
+2.27.0
+
--- /dev/null
+From f179a987592c9f467506ca78ee47ee5b801dce7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 16:05:01 +0200
+Subject: net/mlx5e: Revert parameters on errors when changing MTU and LRO
+ state without reset
+
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+
+[ Upstream commit 8355060f5ec381abda77659f91f56302203df535 ]
+
+Sometimes, channel params are changed without recreating the channels.
+It happens in two basic cases: when the channels are closed, and when
+the parameter being changed doesn't affect how channels are configured.
+Such changes invoke a hardware command that might fail. The whole
+operation should be reverted in such cases, but the code that restores
+the parameters' values in the driver was missing. This commit adds this
+handling.
+
+Fixes: 2e20a151205b ("net/mlx5e: Fail safe mtu and lro setting")
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 30 +++++++++++++------
+ 1 file changed, 21 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 000dacaa3333c..c9b5d7f29911e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3730,7 +3730,7 @@ static int set_feature_lro(struct net_device *netdev, bool enable)
+ struct mlx5e_priv *priv = netdev_priv(netdev);
+ struct mlx5_core_dev *mdev = priv->mdev;
+ struct mlx5e_channels new_channels = {};
+- struct mlx5e_params *old_params;
++ struct mlx5e_params *cur_params;
+ int err = 0;
+ bool reset;
+
+@@ -3743,8 +3743,8 @@ static int set_feature_lro(struct net_device *netdev, bool enable)
+ goto out;
+ }
+
+- old_params = &priv->channels.params;
+- if (enable && !MLX5E_GET_PFLAG(old_params, MLX5E_PFLAG_RX_STRIDING_RQ)) {
++ cur_params = &priv->channels.params;
++ if (enable && !MLX5E_GET_PFLAG(cur_params, MLX5E_PFLAG_RX_STRIDING_RQ)) {
+ netdev_warn(netdev, "can't set LRO with legacy RQ\n");
+ err = -EINVAL;
+ goto out;
+@@ -3752,18 +3752,23 @@ static int set_feature_lro(struct net_device *netdev, bool enable)
+
+ reset = test_bit(MLX5E_STATE_OPENED, &priv->state);
+
+- new_channels.params = *old_params;
++ new_channels.params = *cur_params;
+ new_channels.params.lro_en = enable;
+
+- if (old_params->rq_wq_type != MLX5_WQ_TYPE_CYCLIC) {
+- if (mlx5e_rx_mpwqe_is_linear_skb(mdev, old_params, NULL) ==
++ if (cur_params->rq_wq_type != MLX5_WQ_TYPE_CYCLIC) {
++ if (mlx5e_rx_mpwqe_is_linear_skb(mdev, cur_params, NULL) ==
+ mlx5e_rx_mpwqe_is_linear_skb(mdev, &new_channels.params, NULL))
+ reset = false;
+ }
+
+ if (!reset) {
+- *old_params = new_channels.params;
++ struct mlx5e_params old_params;
++
++ old_params = *cur_params;
++ *cur_params = new_channels.params;
+ err = mlx5e_modify_tirs_lro(priv);
++ if (err)
++ *cur_params = old_params;
+ goto out;
+ }
+
+@@ -4037,9 +4042,16 @@ int mlx5e_change_mtu(struct net_device *netdev, int new_mtu,
+ }
+
+ if (!reset) {
++ unsigned int old_mtu = params->sw_mtu;
++
+ params->sw_mtu = new_mtu;
+- if (preactivate)
+- preactivate(priv, NULL);
++ if (preactivate) {
++ err = preactivate(priv, NULL);
++ if (err) {
++ params->sw_mtu = old_mtu;
++ goto out;
++ }
++ }
+ netdev->mtu = params->sw_mtu;
+ goto out;
+ }
+--
+2.27.0
+
--- /dev/null
+From 28a3b031bd3fafa0f74a634b8a5d288e98b33c75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 11:30:33 +0100
+Subject: nvme-multipath: Early exit if no path is available
+
+From: Daniel Wagner <dwagner@suse.de>
+
+[ Upstream commit d1bcf006a9d3d63c1bcb65a993cb13756954cd9c ]
+
+nvme_round_robin_path() should test if the return ns pointer is valid.
+nvme_next_ns() will return a NULL pointer if there is no path left.
+
+Fixes: 75c10e732724 ("nvme-multipath: round-robin I/O policy")
+Signed-off-by: Daniel Wagner <dwagner@suse.de>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 74896be40c176..292e535a385d4 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -221,7 +221,7 @@ static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head,
+ }
+
+ for (ns = nvme_next_ns(head, old);
+- ns != old;
++ ns && ns != old;
+ ns = nvme_next_ns(head, ns)) {
+ if (nvme_path_is_disabled(ns))
+ continue;
+--
+2.27.0
+
--- /dev/null
+From 07f51d1a811ef8cf9b95afab52bbc9ae4771d87e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 18:52:03 +0800
+Subject: of/device: Update dma_range_map only when dev has valid dma-ranges
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+[ Upstream commit 89c7cb1608ac3c7ecc19436469f35ed12da97e1d ]
+
+The commit e0d072782c73 ("dma-mapping: introduce DMA range map,
+supplanting dma_pfn_offset") always update dma_range_map even though it was
+already set, like in the sunxi_mbus driver. the issue is reported at [1].
+This patch avoid this(Updating it only when dev has valid dma-ranges).
+
+Meanwhile, dma_range_map contains the devices' dma_ranges information,
+This patch moves dma_range_map before of_iommu_configure. The iommu
+driver may need to know the dma_address requirements of its iommu
+consumer devices.
+
+[1] https://lore.kernel.org/linux-arm-kernel/5c7946f3-b56e-da00-a750-be097c7ceb32@arm.com/
+
+CC: Frank Rowand <frowand.list@gmail.com>
+Fixes: e0d072782c73 ("dma-mapping: introduce DMA range map, supplanting dma_pfn_offset"),
+Suggested-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20210119105203.15530-1-yong.wu@mediatek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/device.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index aedfaaafd3e7e..1122daa8e2736 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -162,9 +162,11 @@ int of_dma_configure_id(struct device *dev, struct device_node *np,
+ mask = DMA_BIT_MASK(ilog2(end) + 1);
+ dev->coherent_dma_mask &= mask;
+ *dev->dma_mask &= mask;
+- /* ...but only set bus limit if we found valid dma-ranges earlier */
+- if (!ret)
++ /* ...but only set bus limit and range map if we found valid dma-ranges earlier */
++ if (!ret) {
+ dev->bus_dma_limit = end;
++ dev->dma_range_map = map;
++ }
+
+ coherent = of_dma_is_coherent(np);
+ dev_dbg(dev, "device is%sdma coherent\n",
+@@ -172,6 +174,9 @@ int of_dma_configure_id(struct device *dev, struct device_node *np,
+
+ iommu = of_iommu_configure(dev, np, id);
+ if (PTR_ERR(iommu) == -EPROBE_DEFER) {
++ /* Don't touch range map if it wasn't set from a valid dma-ranges */
++ if (!ret)
++ dev->dma_range_map = NULL;
+ kfree(map);
+ return -EPROBE_DEFER;
+ }
+@@ -181,7 +186,6 @@ int of_dma_configure_id(struct device *dev, struct device_node *np,
+
+ arch_setup_dma_ops(dev, dma_start, size, iommu, coherent);
+
+- dev->dma_range_map = map;
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(of_dma_configure_id);
+--
+2.27.0
+
--- /dev/null
+From 9c13132c324b85fcfffc19a7ba4dcd8132970cd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 16:34:37 -0500
+Subject: pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 814b84971388cd5fb182f2e914265b3827758455 ]
+
+If the server returns a new stateid that does not match the one in our
+cache, then pnfs_layout_process() will leak the layout segments returned
+by pnfs_mark_layout_stateid_invalid().
+
+Fixes: 9888d837f3cf ("pNFS: Force a retry of LAYOUTGET if the stateid doesn't match our cache")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pnfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 471bfa273dade..426877f72441e 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -2418,6 +2418,7 @@ out_forget:
+ spin_unlock(&ino->i_lock);
+ lseg->pls_layout = lo;
+ NFS_SERVER(ino)->pnfs_curr_ld->free_lseg(lseg);
++ pnfs_free_lseg_list(&free_me);
+ return ERR_PTR(-EAGAIN);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 692e3dcc674ddf55ee14335d679ca96143495116 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 13:51:50 -0500
+Subject: pNFS/NFSv4: Update the layout barrier when we schedule a layoutreturn
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 1bcf34fdac5f8c2fcd16796495db75744612ca27 ]
+
+When we're scheduling a layoutreturn, we need to ignore any further
+incoming layouts with sequence ids that are going to be affected by the
+layout return.
+
+Fixes: 44ea8dfce021 ("NFS/pnfs: Reference the layout cred in pnfs_prepare_layoutreturn()")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pnfs.c | 39 +++++++++++++++++++++------------------
+ 1 file changed, 21 insertions(+), 18 deletions(-)
+
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 426877f72441e..cbadcf6ca4da2 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -324,6 +324,21 @@ pnfs_grab_inode_layout_hdr(struct pnfs_layout_hdr *lo)
+ return NULL;
+ }
+
++/*
++ * Compare 2 layout stateid sequence ids, to see which is newer,
++ * taking into account wraparound issues.
++ */
++static bool pnfs_seqid_is_newer(u32 s1, u32 s2)
++{
++ return (s32)(s1 - s2) > 0;
++}
++
++static void pnfs_barrier_update(struct pnfs_layout_hdr *lo, u32 newseq)
++{
++ if (pnfs_seqid_is_newer(newseq, lo->plh_barrier))
++ lo->plh_barrier = newseq;
++}
++
+ static void
+ pnfs_set_plh_return_info(struct pnfs_layout_hdr *lo, enum pnfs_iomode iomode,
+ u32 seq)
+@@ -335,6 +350,7 @@ pnfs_set_plh_return_info(struct pnfs_layout_hdr *lo, enum pnfs_iomode iomode,
+ if (seq != 0) {
+ WARN_ON_ONCE(lo->plh_return_seq != 0 && lo->plh_return_seq != seq);
+ lo->plh_return_seq = seq;
++ pnfs_barrier_update(lo, seq);
+ }
+ }
+
+@@ -639,15 +655,6 @@ static int mark_lseg_invalid(struct pnfs_layout_segment *lseg,
+ return rv;
+ }
+
+-/*
+- * Compare 2 layout stateid sequence ids, to see which is newer,
+- * taking into account wraparound issues.
+- */
+-static bool pnfs_seqid_is_newer(u32 s1, u32 s2)
+-{
+- return (s32)(s1 - s2) > 0;
+-}
+-
+ static bool
+ pnfs_should_free_range(const struct pnfs_layout_range *lseg_range,
+ const struct pnfs_layout_range *recall_range)
+@@ -984,8 +991,7 @@ pnfs_set_layout_stateid(struct pnfs_layout_hdr *lo, const nfs4_stateid *new,
+ new_barrier = be32_to_cpu(new->seqid);
+ else if (new_barrier == 0)
+ return;
+- if (pnfs_seqid_is_newer(new_barrier, lo->plh_barrier))
+- lo->plh_barrier = new_barrier;
++ pnfs_barrier_update(lo, new_barrier);
+ }
+
+ static bool
+@@ -1183,20 +1189,17 @@ pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo,
+ return false;
+ set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags);
+ pnfs_get_layout_hdr(lo);
++ nfs4_stateid_copy(stateid, &lo->plh_stateid);
++ *cred = get_cred(lo->plh_lc_cred);
+ if (test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) {
+- nfs4_stateid_copy(stateid, &lo->plh_stateid);
+- *cred = get_cred(lo->plh_lc_cred);
+ if (lo->plh_return_seq != 0)
+ stateid->seqid = cpu_to_be32(lo->plh_return_seq);
+ if (iomode != NULL)
+ *iomode = lo->plh_return_iomode;
+ pnfs_clear_layoutreturn_info(lo);
+- return true;
+- }
+- nfs4_stateid_copy(stateid, &lo->plh_stateid);
+- *cred = get_cred(lo->plh_lc_cred);
+- if (iomode != NULL)
++ } else if (iomode != NULL)
+ *iomode = IOMODE_ANY;
++ pnfs_barrier_update(lo, be32_to_cpu(stateid->seqid));
+ return true;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From ea859c898128edb7b4414f4313d638b030ddc073 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Jan 2021 16:12:44 +1000
+Subject: powerpc/64s: prevent recursive replay_soft_interrupts causing
+ superfluous interrupt
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 4025c784c573cab7e3f84746cc82b8033923ec62 ]
+
+When an asynchronous interrupt calls irq_exit, it checks for softirqs
+that may have been created, and runs them. Running softirqs enables
+local irqs, which can replay pending interrupts causing recursion in
+replay_soft_interrupts. This abridged trace shows how this can occur:
+
+! NIP replay_soft_interrupts
+ LR interrupt_exit_kernel_prepare
+ Call Trace:
+ interrupt_exit_kernel_prepare (unreliable)
+ interrupt_return
+ --- interrupt: ea0 at __rb_reserve_next
+ NIP __rb_reserve_next
+ LR __rb_reserve_next
+ Call Trace:
+ ring_buffer_lock_reserve
+ trace_function
+ function_trace_call
+ ftrace_call
+ __do_softirq
+ irq_exit
+ timer_interrupt
+! replay_soft_interrupts
+ interrupt_exit_kernel_prepare
+ interrupt_return
+ --- interrupt: ea0 at arch_local_irq_restore
+
+This can not be prevented easily, because softirqs must not block hard
+irqs, so it has to be dealt with.
+
+The recursion is bounded by design in the softirq code because softirq
+replay disables softirqs and loops around again to check for new
+softirqs created while it ran, so that's not a problem.
+
+However it does mess up interrupt replay state, causing superfluous
+interrupts when the second replay_soft_interrupts clears a pending
+interrupt, leaving it still set in the first call in the 'happened'
+local variable.
+
+Fix this by not caching a copy of irqs_happened across interrupt
+handler calls.
+
+Fixes: 3282a3da25bd ("powerpc/64: Implement soft interrupt replay in C")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210123061244.2076145-1-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/irq.c | 28 ++++++++++++++++------------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
+index 6b1eca53e36cc..cc7a6271b6b4e 100644
+--- a/arch/powerpc/kernel/irq.c
++++ b/arch/powerpc/kernel/irq.c
+@@ -180,13 +180,18 @@ void notrace restore_interrupts(void)
+
+ void replay_soft_interrupts(void)
+ {
++ struct pt_regs regs;
++
+ /*
+- * We use local_paca rather than get_paca() to avoid all
+- * the debug_smp_processor_id() business in this low level
+- * function
++ * Be careful here, calling these interrupt handlers can cause
++ * softirqs to be raised, which they may run when calling irq_exit,
++ * which will cause local_irq_enable() to be run, which can then
++ * recurse into this function. Don't keep any state across
++ * interrupt handler calls which may change underneath us.
++ *
++ * We use local_paca rather than get_paca() to avoid all the
++ * debug_smp_processor_id() business in this low level function.
+ */
+- unsigned char happened = local_paca->irq_happened;
+- struct pt_regs regs;
+
+ ppc_save_regs(®s);
+ regs.softe = IRQS_ENABLED;
+@@ -209,7 +214,7 @@ again:
+ * This is a higher priority interrupt than the others, so
+ * replay it first.
+ */
+- if (IS_ENABLED(CONFIG_PPC_BOOK3S) && (happened & PACA_IRQ_HMI)) {
++ if (IS_ENABLED(CONFIG_PPC_BOOK3S) && (local_paca->irq_happened & PACA_IRQ_HMI)) {
+ local_paca->irq_happened &= ~PACA_IRQ_HMI;
+ regs.trap = 0xe60;
+ handle_hmi_exception(®s);
+@@ -217,7 +222,7 @@ again:
+ hard_irq_disable();
+ }
+
+- if (happened & PACA_IRQ_DEC) {
++ if (local_paca->irq_happened & PACA_IRQ_DEC) {
+ local_paca->irq_happened &= ~PACA_IRQ_DEC;
+ regs.trap = 0x900;
+ timer_interrupt(®s);
+@@ -225,7 +230,7 @@ again:
+ hard_irq_disable();
+ }
+
+- if (happened & PACA_IRQ_EE) {
++ if (local_paca->irq_happened & PACA_IRQ_EE) {
+ local_paca->irq_happened &= ~PACA_IRQ_EE;
+ regs.trap = 0x500;
+ do_IRQ(®s);
+@@ -233,7 +238,7 @@ again:
+ hard_irq_disable();
+ }
+
+- if (IS_ENABLED(CONFIG_PPC_DOORBELL) && (happened & PACA_IRQ_DBELL)) {
++ if (IS_ENABLED(CONFIG_PPC_DOORBELL) && (local_paca->irq_happened & PACA_IRQ_DBELL)) {
+ local_paca->irq_happened &= ~PACA_IRQ_DBELL;
+ if (IS_ENABLED(CONFIG_PPC_BOOK3E))
+ regs.trap = 0x280;
+@@ -245,7 +250,7 @@ again:
+ }
+
+ /* Book3E does not support soft-masking PMI interrupts */
+- if (IS_ENABLED(CONFIG_PPC_BOOK3S) && (happened & PACA_IRQ_PMI)) {
++ if (IS_ENABLED(CONFIG_PPC_BOOK3S) && (local_paca->irq_happened & PACA_IRQ_PMI)) {
+ local_paca->irq_happened &= ~PACA_IRQ_PMI;
+ regs.trap = 0xf00;
+ performance_monitor_exception(®s);
+@@ -253,8 +258,7 @@ again:
+ hard_irq_disable();
+ }
+
+- happened = local_paca->irq_happened;
+- if (happened & ~PACA_IRQ_HARD_DIS) {
++ if (local_paca->irq_happened & ~PACA_IRQ_HARD_DIS) {
+ /*
+ * We are responding to the next interrupt, so interrupt-off
+ * latencies should be reset here.
+--
+2.27.0
+
--- /dev/null
+From 5e7a40f7a9a98fbcfa126f4c551d782a3c475bd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 21:14:23 +0200
+Subject: RDMA/cxgb4: Fix the reported max_recv_sge value
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit a372173bf314d374da4dd1155549d8ca7fc44709 ]
+
+The max_recv_sge value is wrongly reported when calling query_qp, This is
+happening due to a typo when assigning the max_recv_sge value, the value
+of sq_max_sges was assigned instead of rq_max_sges.
+
+Fixes: 3e5c02c9ef9a ("iw_cxgb4: Support query_qp() verb")
+Link: https://lore.kernel.org/r/20210114191423.423529-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Reviewed-by: Potnuri Bharat Teja <bharat@chelsio.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/qp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
+index f20379e4e2ec2..5df4bb52bb10f 100644
+--- a/drivers/infiniband/hw/cxgb4/qp.c
++++ b/drivers/infiniband/hw/cxgb4/qp.c
+@@ -2471,7 +2471,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ init_attr->cap.max_send_wr = qhp->attr.sq_num_entries;
+ init_attr->cap.max_recv_wr = qhp->attr.rq_num_entries;
+ init_attr->cap.max_send_sge = qhp->attr.sq_max_sges;
+- init_attr->cap.max_recv_sge = qhp->attr.sq_max_sges;
++ init_attr->cap.max_recv_sge = qhp->attr.rq_max_sges;
+ init_attr->cap.max_inline_data = T4_MAX_SEND_INLINE;
+ init_attr->sq_sig_type = qhp->sq_sig_all ? IB_SIGNAL_ALL_WR : 0;
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From 82b276c3161b983c25ca64dd6d32d5ff60ec6c12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 16:48:19 +0200
+Subject: selftests: forwarding: Specify interface when invoking mausezahn
+
+From: Danielle Ratson <danieller@nvidia.com>
+
+[ Upstream commit 11df27f7fdf02cc2bb354358ad482e1fdd690589 ]
+
+Specify the interface through which packets should be transmitted so
+that the test will pass regardless of the libnet version against which
+mausezahn is linked.
+
+Fixes: cab14d1087d9 ("selftests: Add version of router_multipath.sh using nexthop objects")
+Fixes: 3d578d879517 ("selftests: forwarding: Test IPv4 weighted nexthops")
+Signed-off-by: Danielle Ratson <danieller@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/forwarding/router_mpath_nh.sh | 2 +-
+ tools/testing/selftests/net/forwarding/router_multipath.sh | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/router_mpath_nh.sh b/tools/testing/selftests/net/forwarding/router_mpath_nh.sh
+index cf3d26c233e8e..7fcc42bc076fa 100755
+--- a/tools/testing/selftests/net/forwarding/router_mpath_nh.sh
++++ b/tools/testing/selftests/net/forwarding/router_mpath_nh.sh
+@@ -197,7 +197,7 @@ multipath4_test()
+ t0_rp12=$(link_stats_tx_packets_get $rp12)
+ t0_rp13=$(link_stats_tx_packets_get $rp13)
+
+- ip vrf exec vrf-h1 $MZ -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \
++ ip vrf exec vrf-h1 $MZ $h1 -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \
+ -d 1msec -t udp "sp=1024,dp=0-32768"
+
+ t1_rp12=$(link_stats_tx_packets_get $rp12)
+diff --git a/tools/testing/selftests/net/forwarding/router_multipath.sh b/tools/testing/selftests/net/forwarding/router_multipath.sh
+index 79a2099279621..464821c587a5e 100755
+--- a/tools/testing/selftests/net/forwarding/router_multipath.sh
++++ b/tools/testing/selftests/net/forwarding/router_multipath.sh
+@@ -178,7 +178,7 @@ multipath4_test()
+ t0_rp12=$(link_stats_tx_packets_get $rp12)
+ t0_rp13=$(link_stats_tx_packets_get $rp13)
+
+- ip vrf exec vrf-h1 $MZ -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \
++ ip vrf exec vrf-h1 $MZ $h1 -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \
+ -d 1msec -t udp "sp=1024,dp=0-32768"
+
+ t1_rp12=$(link_stats_tx_packets_get $rp12)
+--
+2.27.0
+
--- /dev/null
+From c2bb20c2e1e4d47da2a3283924a54d9492328bd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 17:52:04 +0800
+Subject: selftests: xfrm: fix test return value override issue in
+ xfrm_policy.sh
+
+From: Po-Hsu Lin <po-hsu.lin@canonical.com>
+
+[ Upstream commit f6e9ceb7a7fc321a31a9dde93a99b7b4b016a3b3 ]
+
+When running this xfrm_policy.sh test script, even with some cases
+marked as FAIL, the overall test result will still be PASS:
+
+$ sudo ./xfrm_policy.sh
+PASS: policy before exception matches
+FAIL: expected ping to .254 to fail (exceptions)
+PASS: direct policy matches (exceptions)
+PASS: policy matches (exceptions)
+FAIL: expected ping to .254 to fail (exceptions and block policies)
+PASS: direct policy matches (exceptions and block policies)
+PASS: policy matches (exceptions and block policies)
+FAIL: expected ping to .254 to fail (exceptions and block policies after hresh changes)
+PASS: direct policy matches (exceptions and block policies after hresh changes)
+PASS: policy matches (exceptions and block policies after hresh changes)
+FAIL: expected ping to .254 to fail (exceptions and block policies after hthresh change in ns3)
+PASS: direct policy matches (exceptions and block policies after hthresh change in ns3)
+PASS: policy matches (exceptions and block policies after hthresh change in ns3)
+FAIL: expected ping to .254 to fail (exceptions and block policies after htresh change to normal)
+PASS: direct policy matches (exceptions and block policies after htresh change to normal)
+PASS: policy matches (exceptions and block policies after htresh change to normal)
+PASS: policies with repeated htresh change
+$ echo $?
+0
+
+This is because the $lret in check_xfrm() is not a local variable.
+Therefore when a test failed in check_exceptions(), the non-zero $lret
+will later get reset to 0 when the next test calls check_xfrm().
+
+With this fix, the final return value will be 1. Make it easier for
+testers to spot this failure.
+
+Fixes: 39aa6928d462d0 ("xfrm: policy: fix netlink/pf_key policy lookups")
+Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/xfrm_policy.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh
+index 7a1bf94c5bd38..5922941e70c6c 100755
+--- a/tools/testing/selftests/net/xfrm_policy.sh
++++ b/tools/testing/selftests/net/xfrm_policy.sh
+@@ -202,7 +202,7 @@ check_xfrm() {
+ # 1: iptables -m policy rule count != 0
+ rval=$1
+ ip=$2
+- lret=0
++ local lret=0
+
+ ip netns exec ns1 ping -q -c 1 10.0.2.$ip > /dev/null
+
+--
+2.27.0
+
netfilter-nft_dynset-add-timeout-extension-to-template.patch
revert-rdma-mlx5-fix-devlink-deadlock-on-net-namespace-deletion.patch
revert-block-simplify-set_init_blocksize-to-regain-lost-performance.patch
+xfrm-fix-oops-in-xfrm_replay_advance_bmp.patch
+xfrm-fix-disable_xfrm-sysctl-when-used-on-xfrm-inter.patch
+selftests-xfrm-fix-test-return-value-override-issue-.patch
+xfrm-fix-wraparound-in-xfrm_policy_addr_delta.patch
+arm64-dts-ls1028a-fix-the-offset-of-the-reset-regist.patch
+arm-imx-fix-imx8m-dependencies.patch
+arm-dts-imx6qdl-kontron-samx6i-fix-i2c_lcd-cam-defau.patch
+arm-dts-imx6qdl-sr-som-fix-some-cubox-i-platforms.patch
+arm64-dts-imx8mp-correct-the-gpio-ranges-of-gpio3.patch
+firmware-imx-select-soc_bus-to-fix-firmware-build.patch
+rdma-cxgb4-fix-the-reported-max_recv_sge-value.patch
+asoc-dt-bindings-lpass-fix-and-common-up-lpass-dai-i.patch
+asoc-qcom-fix-incorrect-volatile-registers.patch
+asoc-qcom-fix-broken-support-to-mi2s-tertiary-and-qu.patch
+asoc-qcom-lpass-ipq806x-fix-bitwidth-regmap-field.patch
+spi-altera-fix-memory-leak-on-error-path.patch
+asoc-qcom-fix-number-of-hdmi-rdma-channels-on-sc7180.patch
+asoc-intel-skylake-skl-topology-fix-oops-ib-skl_tplg.patch
+powerpc-64s-prevent-recursive-replay_soft_interrupts.patch
+pnfs-nfsv4-fix-a-layout-segment-leak-in-pnfs_layout_.patch
+pnfs-nfsv4-update-the-layout-barrier-when-we-schedul.patch
+asoc-sof-intel-soundwire-fix-select-depend-unmet-dep.patch
+asoc-qcom-lpass-fix-out-of-bounds-dai-id-lookup.patch
+iwlwifi-pcie-avoid-potential-pnvm-leaks.patch
+iwlwifi-pnvm-don-t-skip-everything-when-not-reloadin.patch
+iwlwifi-pnvm-don-t-try-to-load-after-failures.patch
+iwlwifi-pcie-set-ltr-on-more-devices.patch
+iwlwifi-pcie-use-jiffies-for-memory-read-spin-time-l.patch
+iwlwifi-pcie-reschedule-in-long-running-memory-reads.patch
+mac80211-pause-tx-while-changing-interface-type.patch
+ice-fix-fdir-ipv6-flexbyte.patch
+ice-implement-flow-for-ipv6-next-header-extension-he.patch
+ice-update-dev_addr-in-ice_set_mac_address-even-if-h.patch
+ice-don-t-allow-more-channels-than-lan-msi-x-availab.patch
+ice-fix-msi-x-vector-fallback-logic.patch
+i40e-acquire-vsi-pointer-only-after-vf-is-initialize.patch
+igc-fix-link-speed-advertising.patch
+net-mlx5-fix-memory-leak-on-flow-table-creation-erro.patch
+net-mlx5e-e-switch-fix-rate-calculation-for-overflow.patch
+net-mlx5e-free-page-before-return.patch
+net-mlx5e-reduce-tc-unsupported-key-print-level.patch
+net-mlx5-maintain-separate-page-trees-for-ecpf-and-p.patch
+net-mlx5e-disable-hw-tc-offload-when-mlx5_cls_act-co.patch
+net-mlx5e-fix-ct-rule-encap-slow-path-offload-and-de.patch
+net-mlx5e-correctly-handle-changing-the-number-of-qu.patch
+net-mlx5e-revert-parameters-on-errors-when-changing-.patch
+net-mlx5e-revert-parameters-on-errors-when-changing-.patch-14032
+net-mlx5-ct-fix-incorrect-removal-of-tuple_nat_node-.patch
+can-dev-prevent-potential-information-leak-in-can_fi.patch
+acpi-iort-do-not-blindly-trust-dma-masks-from-firmwa.patch
+of-device-update-dma_range_map-only-when-dev-has-val.patch
+iommu-amd-use-ivhd-efr-for-early-initialization-of-i.patch
+iommu-vt-d-correctly-check-addr-alignment-in-qi_flus.patch
+nvme-multipath-early-exit-if-no-path-is-available.patch
+selftests-forwarding-specify-interface-when-invoking.patch
--- /dev/null
+From c7992751cd36d1ce56e99008faf0ae6f433ace5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 00:26:35 -0800
+Subject: spi: altera: Fix memory leak on error path
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 55a8b42e8645a6dab88674a30cb6ed328e660680 ]
+
+Release master that have been previously allocated if the number of
+chipselect is invalid.
+
+Fixes: 8e04187c1bc7 ("spi: altera: add SPI core parameters support via platform data.")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Tom Rix <trix@redhat.com>
+Link: https://lore.kernel.org/r/20210120082635.49304-1-bianpan2016@163.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-altera.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-altera.c b/drivers/spi/spi-altera.c
+index cbc4c28c1541c..62ea0c9e321b4 100644
+--- a/drivers/spi/spi-altera.c
++++ b/drivers/spi/spi-altera.c
+@@ -254,7 +254,8 @@ static int altera_spi_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev,
+ "Invalid number of chipselect: %hu\n",
+ pdata->num_chipselect);
+- return -EINVAL;
++ err = -EINVAL;
++ goto exit;
+ }
+
+ master->num_chipselect = pdata->num_chipselect;
+--
+2.27.0
+
--- /dev/null
+From 72a9832a58bbf1b3f66d9fc8b4cded6fea961088 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Dec 2020 17:00:46 +0200
+Subject: xfrm: fix disable_xfrm sysctl when used on xfrm interfaces
+
+From: Eyal Birger <eyal.birger@gmail.com>
+
+[ Upstream commit 9f8550e4bd9d78a8436c2061ad2530215f875376 ]
+
+The disable_xfrm flag signals that xfrm should not be performed during
+routing towards a device before reaching device xmit.
+
+For xfrm interfaces this is usually desired as they perform the outbound
+policy lookup as part of their xmit using their if_id.
+
+Before this change enabling this flag on xfrm interfaces prevented them
+from xmitting as xfrm_lookup_with_ifid() would not perform a policy lookup
+in case the original dst had the DST_NOXFRM flag.
+
+This optimization is incorrect when the lookup is done by the xfrm
+interface xmit logic.
+
+Fix by performing policy lookup when invoked by xfrmi as if_id != 0.
+
+Similarly it's unlikely for the 'no policy exists on net' check to yield
+any performance benefits when invoked from xfrmi.
+
+Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
+Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_policy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index d622c2548d229..2f84136af48ab 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -3078,8 +3078,8 @@ struct dst_entry *xfrm_lookup_with_ifid(struct net *net,
+ xflo.flags = flags;
+
+ /* To accelerate a bit... */
+- if ((dst_orig->flags & DST_NOXFRM) ||
+- !net->xfrm.policy_count[XFRM_POLICY_OUT])
++ if (!if_id && ((dst_orig->flags & DST_NOXFRM) ||
++ !net->xfrm.policy_count[XFRM_POLICY_OUT]))
+ goto nopol;
+
+ xdst = xfrm_bundle_lookup(net, fl, family, dir, &xflo, if_id);
+--
+2.27.0
+
--- /dev/null
+From bbdb654a0fb9147a4f6023923329222c1bddf987 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 15:38:32 +0200
+Subject: xfrm: Fix oops in xfrm_replay_advance_bmp
+
+From: Shmulik Ladkani <shmulik@metanetworks.com>
+
+[ Upstream commit 56ce7c25ae1525d83cf80a880cf506ead1914250 ]
+
+When setting xfrm replay_window to values higher than 32, a rare
+page-fault occurs in xfrm_replay_advance_bmp:
+
+ BUG: unable to handle page fault for address: ffff8af350ad7920
+ #PF: supervisor write access in kernel mode
+ #PF: error_code(0x0002) - not-present page
+ PGD ad001067 P4D ad001067 PUD 0
+ Oops: 0002 [#1] SMP PTI
+ CPU: 3 PID: 30 Comm: ksoftirqd/3 Kdump: loaded Not tainted 5.4.52-050452-generic #202007160732
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
+ RIP: 0010:xfrm_replay_advance_bmp+0xbb/0x130
+ RSP: 0018:ffffa1304013ba40 EFLAGS: 00010206
+ RAX: 000000000000010d RBX: 0000000000000002 RCX: 00000000ffffff4b
+ RDX: 0000000000000018 RSI: 00000000004c234c RDI: 00000000ffb3dbff
+ RBP: ffffa1304013ba50 R08: ffff8af330ad7920 R09: 0000000007fffffa
+ R10: 0000000000000800 R11: 0000000000000010 R12: ffff8af29d6258c0
+ R13: ffff8af28b95c700 R14: 0000000000000000 R15: ffff8af29d6258fc
+ FS: 0000000000000000(0000) GS:ffff8af339ac0000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: ffff8af350ad7920 CR3: 0000000015ee4000 CR4: 00000000001406e0
+ Call Trace:
+ xfrm_input+0x4e5/0xa10
+ xfrm4_rcv_encap+0xb5/0xe0
+ xfrm4_udp_encap_rcv+0x140/0x1c0
+
+Analysis revealed offending code is when accessing:
+
+ replay_esn->bmp[nr] |= (1U << bitnr);
+
+with 'nr' being 0x07fffffa.
+
+This happened in an SMP system when reordering of packets was present;
+A packet arrived with a "too old" sequence number (outside the window,
+i.e 'diff > replay_window'), and therefore the following calculation:
+
+ bitnr = replay_esn->replay_window - (diff - pos);
+
+yields a negative result, but since bitnr is u32 we get a large unsigned
+quantity (in crash dump above: 0xffffff4b seen in ecx).
+
+This was supposed to be protected by xfrm_input()'s former call to:
+
+ if (x->repl->check(x, skb, seq)) {
+
+However, the state's spinlock x->lock is *released* after '->check()'
+is performed, and gets re-acquired before '->advance()' - which gives a
+chance for a different core to update the xfrm state, e.g. by advancing
+'replay_esn->seq' when it encounters more packets - leading to a
+'diff > replay_window' situation when original core continues to
+xfrm_replay_advance_bmp().
+
+An attempt to fix this issue was suggested in commit bcf66bf54aab
+("xfrm: Perform a replay check after return from async codepaths"),
+by calling 'x->repl->recheck()' after lock is re-acquired, but fix
+applied only to asyncronous crypto algorithms.
+
+Augment the fix, by *always* calling 'recheck()' - irrespective if we're
+using async crypto.
+
+Fixes: 0ebea8ef3559 ("[IPSEC]: Move state lock into x->type->input")
+Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_input.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index 37456d022cfa3..61e6220ddd5ae 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -660,7 +660,7 @@ resume:
+ /* only the first xfrm gets the encap type */
+ encap_type = 0;
+
+- if (async && x->repl->recheck(x, skb, seq)) {
++ if (x->repl->recheck(x, skb, seq)) {
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
+ goto drop_unlock;
+ }
+--
+2.27.0
+
--- /dev/null
+From 847620c1136e4e44593372de83c5b2d903ad552d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 16:15:53 +0000
+Subject: xfrm: Fix wraparound in xfrm_policy_addr_delta()
+
+From: Visa Hankala <visa@hankala.org>
+
+[ Upstream commit da64ae2d35d3673233f0403b035d4c6acbf71965 ]
+
+Use three-way comparison for address components to avoid integer
+wraparound in the result of xfrm_policy_addr_delta(). This ensures
+that the search trees are built and traversed correctly.
+
+Treat IPv4 and IPv6 similarly by returning 0 when prefixlen == 0.
+Prefix /0 has only one equivalence class.
+
+Fixes: 9cf545ebd591d ("xfrm: policy: store inexact policies in a tree ordered by destination address")
+Signed-off-by: Visa Hankala <visa@hankala.org>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_policy.c | 26 +++++++++----
+ tools/testing/selftests/net/xfrm_policy.sh | 43 ++++++++++++++++++++++
+ 2 files changed, 61 insertions(+), 8 deletions(-)
+
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 2f84136af48ab..b74f28cabe24f 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -793,15 +793,22 @@ static int xfrm_policy_addr_delta(const xfrm_address_t *a,
+ const xfrm_address_t *b,
+ u8 prefixlen, u16 family)
+ {
++ u32 ma, mb, mask;
+ unsigned int pdw, pbi;
+ int delta = 0;
+
+ switch (family) {
+ case AF_INET:
+- if (sizeof(long) == 4 && prefixlen == 0)
+- return ntohl(a->a4) - ntohl(b->a4);
+- return (ntohl(a->a4) & ((~0UL << (32 - prefixlen)))) -
+- (ntohl(b->a4) & ((~0UL << (32 - prefixlen))));
++ if (prefixlen == 0)
++ return 0;
++ mask = ~0U << (32 - prefixlen);
++ ma = ntohl(a->a4) & mask;
++ mb = ntohl(b->a4) & mask;
++ if (ma < mb)
++ delta = -1;
++ else if (ma > mb)
++ delta = 1;
++ break;
+ case AF_INET6:
+ pdw = prefixlen >> 5;
+ pbi = prefixlen & 0x1f;
+@@ -812,10 +819,13 @@ static int xfrm_policy_addr_delta(const xfrm_address_t *a,
+ return delta;
+ }
+ if (pbi) {
+- u32 mask = ~0u << (32 - pbi);
+-
+- delta = (ntohl(a->a6[pdw]) & mask) -
+- (ntohl(b->a6[pdw]) & mask);
++ mask = ~0U << (32 - pbi);
++ ma = ntohl(a->a6[pdw]) & mask;
++ mb = ntohl(b->a6[pdw]) & mask;
++ if (ma < mb)
++ delta = -1;
++ else if (ma > mb)
++ delta = 1;
+ }
+ break;
+ default:
+diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh
+index 5922941e70c6c..bdf450eaf60cf 100755
+--- a/tools/testing/selftests/net/xfrm_policy.sh
++++ b/tools/testing/selftests/net/xfrm_policy.sh
+@@ -287,6 +287,47 @@ check_hthresh_repeat()
+ return 0
+ }
+
++# insert non-overlapping policies in a random order and check that
++# all of them can be fetched using the traffic selectors.
++check_random_order()
++{
++ local ns=$1
++ local log=$2
++
++ for i in $(seq 100); do
++ ip -net $ns xfrm policy flush
++ for j in $(seq 0 16 255 | sort -R); do
++ ip -net $ns xfrm policy add dst $j.0.0.0/24 dir out priority 10 action allow
++ done
++ for j in $(seq 0 16 255); do
++ if ! ip -net $ns xfrm policy get dst $j.0.0.0/24 dir out > /dev/null; then
++ echo "FAIL: $log" 1>&2
++ return 1
++ fi
++ done
++ done
++
++ for i in $(seq 100); do
++ ip -net $ns xfrm policy flush
++ for j in $(seq 0 16 255 | sort -R); do
++ local addr=$(printf "e000:0000:%02x00::/56" $j)
++ ip -net $ns xfrm policy add dst $addr dir out priority 10 action allow
++ done
++ for j in $(seq 0 16 255); do
++ local addr=$(printf "e000:0000:%02x00::/56" $j)
++ if ! ip -net $ns xfrm policy get dst $addr dir out > /dev/null; then
++ echo "FAIL: $log" 1>&2
++ return 1
++ fi
++ done
++ done
++
++ ip -net $ns xfrm policy flush
++
++ echo "PASS: $log"
++ return 0
++}
++
+ #check for needed privileges
+ if [ "$(id -u)" -ne 0 ];then
+ echo "SKIP: Need root privileges"
+@@ -438,6 +479,8 @@ check_exceptions "exceptions and block policies after htresh change to normal"
+
+ check_hthresh_repeat "policies with repeated htresh change"
+
++check_random_order ns3 "policies inserted in random order"
++
+ for i in 1 2 3 4;do ip netns del ns$i;done
+
+ exit $ret
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
