--- /dev/null
+From 66fdfbcfbcdbf413ea1616c32d1baab8b54e49ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 18:49:39 +0100
+Subject: btrfs: fix RWF_NOWAIT writes blocking on extent locks and waiting for
+ IO
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 5dbb75ed6900048e146247b6325742d92c892548 ]
+
+A RWF_NOWAIT write is not supposed to wait on filesystem locks that can be
+held for a long time or for ongoing IO to complete.
+
+However when calling check_can_nocow(), if the inode has prealloc extents
+or has the NOCOW flag set, we can block on extent (file range) locks
+through the call to btrfs_lock_and_flush_ordered_range(). Such lock can
+take a significant amount of time to be available. For example, a fiemap
+task may be running, and iterating through the entire file range checking
+all extents and doing backref walking to determine if they are shared,
+or a readpage operation may be in progress.
+
+Also at btrfs_lock_and_flush_ordered_range(), called by check_can_nocow(),
+after locking the file range we wait for any existing ordered extent that
+is in progress to complete. Another operation that can take a significant
+amount of time and defeat the purpose of RWF_NOWAIT.
+
+So fix this by trying to lock the file range and if it's currently locked
+return -EAGAIN to user space. If we are able to lock the file range without
+waiting and there is an ordered extent in the range, return -EAGAIN as
+well, instead of waiting for it to complete. Finally, don't bother trying
+to lock the snapshot lock of the root when attempting a RWF_NOWAIT write,
+as that is only important for buffered writes.
+
+Fixes: edf064e7c6fec3 ("btrfs: nowait aio support")
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/file.c | 37 ++++++++++++++++++++++++++-----------
+ 1 file changed, 26 insertions(+), 11 deletions(-)
+
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 52d565ff66e2d..93244934d4f92 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1541,7 +1541,7 @@ lock_and_cleanup_extent_if_need(struct btrfs_inode *inode, struct page **pages,
+ }
+
+ static noinline int check_can_nocow(struct btrfs_inode *inode, loff_t pos,
+- size_t *write_bytes)
++ size_t *write_bytes, bool nowait)
+ {
+ struct btrfs_fs_info *fs_info = inode->root->fs_info;
+ struct btrfs_root *root = inode->root;
+@@ -1549,27 +1549,43 @@ static noinline int check_can_nocow(struct btrfs_inode *inode, loff_t pos,
+ u64 num_bytes;
+ int ret;
+
+- if (!btrfs_drew_try_write_lock(&root->snapshot_lock))
++ if (!nowait && !btrfs_drew_try_write_lock(&root->snapshot_lock))
+ return -EAGAIN;
+
+ lockstart = round_down(pos, fs_info->sectorsize);
+ lockend = round_up(pos + *write_bytes,
+ fs_info->sectorsize) - 1;
++ num_bytes = lockend - lockstart + 1;
+
+- btrfs_lock_and_flush_ordered_range(inode, lockstart,
+- lockend, NULL);
++ if (nowait) {
++ struct btrfs_ordered_extent *ordered;
++
++ if (!try_lock_extent(&inode->io_tree, lockstart, lockend))
++ return -EAGAIN;
++
++ ordered = btrfs_lookup_ordered_range(inode, lockstart,
++ num_bytes);
++ if (ordered) {
++ btrfs_put_ordered_extent(ordered);
++ ret = -EAGAIN;
++ goto out_unlock;
++ }
++ } else {
++ btrfs_lock_and_flush_ordered_range(inode, lockstart,
++ lockend, NULL);
++ }
+
+- num_bytes = lockend - lockstart + 1;
+ ret = can_nocow_extent(&inode->vfs_inode, lockstart, &num_bytes,
+ NULL, NULL, NULL);
+ if (ret <= 0) {
+ ret = 0;
+- btrfs_drew_write_unlock(&root->snapshot_lock);
++ if (!nowait)
++ btrfs_drew_write_unlock(&root->snapshot_lock);
+ } else {
+ *write_bytes = min_t(size_t, *write_bytes ,
+ num_bytes - pos + lockstart);
+ }
+-
++out_unlock:
+ unlock_extent(&inode->io_tree, lockstart, lockend);
+
+ return ret;
+@@ -1641,7 +1657,7 @@ static noinline ssize_t btrfs_buffered_write(struct kiocb *iocb,
+ if ((BTRFS_I(inode)->flags & (BTRFS_INODE_NODATACOW |
+ BTRFS_INODE_PREALLOC)) &&
+ check_can_nocow(BTRFS_I(inode), pos,
+- &write_bytes) > 0) {
++ &write_bytes, false) > 0) {
+ /*
+ * For nodata cow case, no need to reserve
+ * data space.
+@@ -1920,12 +1936,11 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
+ */
+ if (!(BTRFS_I(inode)->flags & (BTRFS_INODE_NODATACOW |
+ BTRFS_INODE_PREALLOC)) ||
+- check_can_nocow(BTRFS_I(inode), pos, &nocow_bytes) <= 0) {
++ check_can_nocow(BTRFS_I(inode), pos, &nocow_bytes,
++ true) <= 0) {
+ inode_unlock(inode);
+ return -EAGAIN;
+ }
+- /* check_can_nocow() locks the snapshot lock on success */
+- btrfs_drew_write_unlock(&root->snapshot_lock);
+ /*
+ * There are holes in the range or parts of the range that must
+ * be COWed (shared extents, RO block groups, etc), so just bail
+--
+2.25.1
+
--- /dev/null
+From 774120b19f804974a6700b8b0295816cfff7b83c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 01:51:35 +0530
+Subject: cxgb4: fix endian conversions for L4 ports in filters
+
+From: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+
+[ Upstream commit 63b53b0b99cd5f2d9754a21eda2ed8e706646cc9 ]
+
+The source and destination L4 ports in filter offload need to be
+in CPU endian. They will finally be converted to Big Endian after
+all operations are done and before giving them to hardware. The
+L4 ports for NAT are expected to be passed as a byte stream TCB.
+So, treat them as such.
+
+Fixes following sparse warnings in several places:
+cxgb4_tc_flower.c:159:33: warning: cast from restricted __be16
+cxgb4_tc_flower.c:159:33: warning: incorrect type in argument 1 (different
+base types)
+cxgb4_tc_flower.c:159:33: expected unsigned short [usertype] val
+cxgb4_tc_flower.c:159:33: got restricted __be16 [usertype] dst
+
+Fixes: dca4faeb812f ("cxgb4: Add LE hash collision bug fix path in LLD driver")
+Fixes: 62488e4b53ae ("cxgb4: add basic tc flower offload support")
+Fixes: 557ccbf9dfa8 ("cxgb4: add tc flower support for L3/L4 rewrite")
+Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 15 +++++++---
+ .../net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 +-
+ .../ethernet/chelsio/cxgb4/cxgb4_tc_flower.c | 30 +++++++------------
+ 3 files changed, 22 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+index 796555255207c..c6bf2648fe420 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+@@ -165,6 +165,9 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,
+ unsigned int tid, bool dip, bool sip, bool dp,
+ bool sp)
+ {
++ u8 *nat_lp = (u8 *)&f->fs.nat_lport;
++ u8 *nat_fp = (u8 *)&f->fs.nat_fport;
++
+ if (dip) {
+ if (f->fs.type) {
+ set_tcb_field(adap, f, tid, TCB_SND_UNA_RAW_W,
+@@ -236,8 +239,9 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,
+ }
+
+ set_tcb_field(adap, f, tid, TCB_PDU_HDR_LEN_W, WORD_MASK,
+- (dp ? f->fs.nat_lport : 0) |
+- (sp ? f->fs.nat_fport << 16 : 0), 1);
++ (dp ? (nat_lp[1] | nat_lp[0] << 8) : 0) |
++ (sp ? (nat_fp[1] << 16 | nat_fp[0] << 24) : 0),
++ 1);
+ }
+
+ /* Validate filter spec against configuration done on the card. */
+@@ -909,6 +913,9 @@ int set_filter_wr(struct adapter *adapter, int fidx)
+ fwr->fpm = htons(f->fs.mask.fport);
+
+ if (adapter->params.filter2_wr_support) {
++ u8 *nat_lp = (u8 *)&f->fs.nat_lport;
++ u8 *nat_fp = (u8 *)&f->fs.nat_fport;
++
+ fwr->natmode_to_ulp_type =
+ FW_FILTER2_WR_ULP_TYPE_V(f->fs.nat_mode ?
+ ULP_MODE_TCPDDP :
+@@ -916,8 +923,8 @@ int set_filter_wr(struct adapter *adapter, int fidx)
+ FW_FILTER2_WR_NATMODE_V(f->fs.nat_mode);
+ memcpy(fwr->newlip, f->fs.nat_lip, sizeof(fwr->newlip));
+ memcpy(fwr->newfip, f->fs.nat_fip, sizeof(fwr->newfip));
+- fwr->newlport = htons(f->fs.nat_lport);
+- fwr->newfport = htons(f->fs.nat_fport);
++ fwr->newlport = htons(nat_lp[1] | nat_lp[0] << 8);
++ fwr->newfport = htons(nat_fp[1] | nat_fp[0] << 8);
+ }
+
+ /* Mark the filter as "pending" and ship off the Filter Work Request.
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+index a70018f067aa8..e8934c48f09b6 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -2604,7 +2604,7 @@ int cxgb4_create_server_filter(const struct net_device *dev, unsigned int stid,
+
+ /* Clear out filter specifications */
+ memset(&f->fs, 0, sizeof(struct ch_filter_specification));
+- f->fs.val.lport = cpu_to_be16(sport);
++ f->fs.val.lport = be16_to_cpu(sport);
+ f->fs.mask.lport = ~0;
+ val = (u8 *)&sip;
+ if ((val[0] | val[1] | val[2] | val[3]) != 0) {
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+index 4a5fa9eba0b64..59b65d4db086e 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+@@ -58,10 +58,6 @@ static struct ch_tc_pedit_fields pedits[] = {
+ PEDIT_FIELDS(IP6_, DST_63_32, 4, nat_lip, 4),
+ PEDIT_FIELDS(IP6_, DST_95_64, 4, nat_lip, 8),
+ PEDIT_FIELDS(IP6_, DST_127_96, 4, nat_lip, 12),
+- PEDIT_FIELDS(TCP_, SPORT, 2, nat_fport, 0),
+- PEDIT_FIELDS(TCP_, DPORT, 2, nat_lport, 0),
+- PEDIT_FIELDS(UDP_, SPORT, 2, nat_fport, 0),
+- PEDIT_FIELDS(UDP_, DPORT, 2, nat_lport, 0),
+ };
+
+ static struct ch_tc_flower_entry *allocate_flower_entry(void)
+@@ -156,14 +152,14 @@ static void cxgb4_process_flow_match(struct net_device *dev,
+ struct flow_match_ports match;
+
+ flow_rule_match_ports(rule, &match);
+- fs->val.lport = cpu_to_be16(match.key->dst);
+- fs->mask.lport = cpu_to_be16(match.mask->dst);
+- fs->val.fport = cpu_to_be16(match.key->src);
+- fs->mask.fport = cpu_to_be16(match.mask->src);
++ fs->val.lport = be16_to_cpu(match.key->dst);
++ fs->mask.lport = be16_to_cpu(match.mask->dst);
++ fs->val.fport = be16_to_cpu(match.key->src);
++ fs->mask.fport = be16_to_cpu(match.mask->src);
+
+ /* also initialize nat_lport/fport to same values */
+- fs->nat_lport = cpu_to_be16(match.key->dst);
+- fs->nat_fport = cpu_to_be16(match.key->src);
++ fs->nat_lport = fs->val.lport;
++ fs->nat_fport = fs->val.fport;
+ }
+
+ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IP)) {
+@@ -354,12 +350,9 @@ static void process_pedit_field(struct ch_filter_specification *fs, u32 val,
+ switch (offset) {
+ case PEDIT_TCP_SPORT_DPORT:
+ if (~mask & PEDIT_TCP_UDP_SPORT_MASK)
+- offload_pedit(fs, cpu_to_be32(val) >> 16,
+- cpu_to_be32(mask) >> 16,
+- TCP_SPORT);
++ fs->nat_fport = val;
+ else
+- offload_pedit(fs, cpu_to_be32(val),
+- cpu_to_be32(mask), TCP_DPORT);
++ fs->nat_lport = val >> 16;
+ }
+ fs->nat_mode = NAT_MODE_ALL;
+ break;
+@@ -367,12 +360,9 @@ static void process_pedit_field(struct ch_filter_specification *fs, u32 val,
+ switch (offset) {
+ case PEDIT_UDP_SPORT_DPORT:
+ if (~mask & PEDIT_TCP_UDP_SPORT_MASK)
+- offload_pedit(fs, cpu_to_be32(val) >> 16,
+- cpu_to_be32(mask) >> 16,
+- UDP_SPORT);
++ fs->nat_fport = val;
+ else
+- offload_pedit(fs, cpu_to_be32(val),
+- cpu_to_be32(mask), UDP_DPORT);
++ fs->nat_lport = val >> 16;
+ }
+ fs->nat_mode = NAT_MODE_ALL;
+ }
+--
+2.25.1
+
--- /dev/null
+From 6404b5ce7f07b463a6a302535f2b5efc9cd5e6eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 01:51:37 +0530
+Subject: cxgb4: fix SGE queue dump destination buffer context
+
+From: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+
+[ Upstream commit 1992ded5d111997877a9a25205976d8d03c46814 ]
+
+The data in destination buffer is expected to be be parsed in big
+endian. So, use the right context.
+
+Fixes following sparse warning:
+cudbg_lib.c:2041:44: warning: incorrect type in assignment (different
+base types)
+cudbg_lib.c:2041:44: expected unsigned long long [usertype]
+cudbg_lib.c:2041:44: got restricted __be64 [usertype]
+
+Fixes: 736c3b94474e ("cxgb4: collect egress and ingress SGE queue contexts")
+Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+index 7b9cd69f98440..d8ab8e366818c 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+@@ -1975,7 +1975,6 @@ int cudbg_collect_dump_context(struct cudbg_init *pdbg_init,
+ u8 mem_type[CTXT_INGRESS + 1] = { 0 };
+ struct cudbg_buffer temp_buff = { 0 };
+ struct cudbg_ch_cntxt *buff;
+- u64 *dst_off, *src_off;
+ u8 *ctx_buf;
+ u8 i, k;
+ int rc;
+@@ -2044,8 +2043,11 @@ int cudbg_collect_dump_context(struct cudbg_init *pdbg_init,
+ }
+
+ for (j = 0; j < max_ctx_qid; j++) {
++ __be64 *dst_off;
++ u64 *src_off;
++
+ src_off = (u64 *)(ctx_buf + j * SGE_CTXT_SIZE);
+- dst_off = (u64 *)buff->data;
++ dst_off = (__be64 *)buff->data;
+
+ /* The data is stored in 64-bit cpu order. Convert it
+ * to big endian before parsing.
+--
+2.25.1
+
--- /dev/null
+From 64182aa08c97a26503ddec8202815b9a9107b237 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 01:51:34 +0530
+Subject: cxgb4: parse TC-U32 key values and masks natively
+
+From: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+
+[ Upstream commit 27f78cb245abdb86735529c13b0a579f57829e71 ]
+
+TC-U32 passes all keys values and masks in __be32 format. The parser
+already expects this and hence pass the value and masks in __be32
+natively to the parser.
+
+Fixes following sparse warnings in several places:
+cxgb4_tc_u32.c:57:21: warning: incorrect type in assignment (different base
+types)
+cxgb4_tc_u32.c:57:21: expected unsigned int [usertype] val
+cxgb4_tc_u32.c:57:21: got restricted __be32 [usertype] val
+cxgb4_tc_u32_parse.h:48:24: warning: cast to restricted __be32
+
+Fixes: 2e8aad7bf203 ("cxgb4: add parser to translate u32 filters to internal spec")
+Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c | 18 +--
+ .../chelsio/cxgb4/cxgb4_tc_u32_parse.h | 122 ++++++++++++------
+ 2 files changed, 91 insertions(+), 49 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
+index 3f3c11e54d970..dede02505ceb5 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
+@@ -48,7 +48,7 @@ static int fill_match_fields(struct adapter *adap,
+ bool next_header)
+ {
+ unsigned int i, j;
+- u32 val, mask;
++ __be32 val, mask;
+ int off, err;
+ bool found;
+
+@@ -228,7 +228,7 @@ int cxgb4_config_knode(struct net_device *dev, struct tc_cls_u32_offload *cls)
+ const struct cxgb4_next_header *next;
+ bool found = false;
+ unsigned int i, j;
+- u32 val, mask;
++ __be32 val, mask;
+ int off;
+
+ if (t->table[link_uhtid - 1].link_handle) {
+@@ -242,10 +242,10 @@ int cxgb4_config_knode(struct net_device *dev, struct tc_cls_u32_offload *cls)
+
+ /* Try to find matches that allow jumps to next header. */
+ for (i = 0; next[i].jump; i++) {
+- if (next[i].offoff != cls->knode.sel->offoff ||
+- next[i].shift != cls->knode.sel->offshift ||
+- next[i].mask != cls->knode.sel->offmask ||
+- next[i].offset != cls->knode.sel->off)
++ if (next[i].sel.offoff != cls->knode.sel->offoff ||
++ next[i].sel.offshift != cls->knode.sel->offshift ||
++ next[i].sel.offmask != cls->knode.sel->offmask ||
++ next[i].sel.off != cls->knode.sel->off)
+ continue;
+
+ /* Found a possible candidate. Find a key that
+@@ -257,9 +257,9 @@ int cxgb4_config_knode(struct net_device *dev, struct tc_cls_u32_offload *cls)
+ val = cls->knode.sel->keys[j].val;
+ mask = cls->knode.sel->keys[j].mask;
+
+- if (next[i].match_off == off &&
+- next[i].match_val == val &&
+- next[i].match_mask == mask) {
++ if (next[i].key.off == off &&
++ next[i].key.val == val &&
++ next[i].key.mask == mask) {
+ found = true;
+ break;
+ }
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h
+index 125868c6770a2..f59dd4b2ae6f9 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h
+@@ -38,12 +38,12 @@
+ struct cxgb4_match_field {
+ int off; /* Offset from the beginning of the header to match */
+ /* Fill the value/mask pair in the spec if matched */
+- int (*val)(struct ch_filter_specification *f, u32 val, u32 mask);
++ int (*val)(struct ch_filter_specification *f, __be32 val, __be32 mask);
+ };
+
+ /* IPv4 match fields */
+ static inline int cxgb4_fill_ipv4_tos(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ f->val.tos = (ntohl(val) >> 16) & 0x000000FF;
+ f->mask.tos = (ntohl(mask) >> 16) & 0x000000FF;
+@@ -52,7 +52,7 @@ static inline int cxgb4_fill_ipv4_tos(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv4_frag(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ u32 mask_val;
+ u8 frag_val;
+@@ -74,7 +74,7 @@ static inline int cxgb4_fill_ipv4_frag(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv4_proto(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ f->val.proto = (ntohl(val) >> 16) & 0x000000FF;
+ f->mask.proto = (ntohl(mask) >> 16) & 0x000000FF;
+@@ -83,7 +83,7 @@ static inline int cxgb4_fill_ipv4_proto(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv4_src_ip(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.fip[0], &val, sizeof(u32));
+ memcpy(&f->mask.fip[0], &mask, sizeof(u32));
+@@ -92,7 +92,7 @@ static inline int cxgb4_fill_ipv4_src_ip(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv4_dst_ip(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.lip[0], &val, sizeof(u32));
+ memcpy(&f->mask.lip[0], &mask, sizeof(u32));
+@@ -111,7 +111,7 @@ static const struct cxgb4_match_field cxgb4_ipv4_fields[] = {
+
+ /* IPv6 match fields */
+ static inline int cxgb4_fill_ipv6_tos(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ f->val.tos = (ntohl(val) >> 20) & 0x000000FF;
+ f->mask.tos = (ntohl(mask) >> 20) & 0x000000FF;
+@@ -120,7 +120,7 @@ static inline int cxgb4_fill_ipv6_tos(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_proto(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ f->val.proto = (ntohl(val) >> 8) & 0x000000FF;
+ f->mask.proto = (ntohl(mask) >> 8) & 0x000000FF;
+@@ -129,7 +129,7 @@ static inline int cxgb4_fill_ipv6_proto(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_src_ip0(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.fip[0], &val, sizeof(u32));
+ memcpy(&f->mask.fip[0], &mask, sizeof(u32));
+@@ -138,7 +138,7 @@ static inline int cxgb4_fill_ipv6_src_ip0(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_src_ip1(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.fip[4], &val, sizeof(u32));
+ memcpy(&f->mask.fip[4], &mask, sizeof(u32));
+@@ -147,7 +147,7 @@ static inline int cxgb4_fill_ipv6_src_ip1(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_src_ip2(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.fip[8], &val, sizeof(u32));
+ memcpy(&f->mask.fip[8], &mask, sizeof(u32));
+@@ -156,7 +156,7 @@ static inline int cxgb4_fill_ipv6_src_ip2(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_src_ip3(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.fip[12], &val, sizeof(u32));
+ memcpy(&f->mask.fip[12], &mask, sizeof(u32));
+@@ -165,7 +165,7 @@ static inline int cxgb4_fill_ipv6_src_ip3(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_dst_ip0(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.lip[0], &val, sizeof(u32));
+ memcpy(&f->mask.lip[0], &mask, sizeof(u32));
+@@ -174,7 +174,7 @@ static inline int cxgb4_fill_ipv6_dst_ip0(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_dst_ip1(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.lip[4], &val, sizeof(u32));
+ memcpy(&f->mask.lip[4], &mask, sizeof(u32));
+@@ -183,7 +183,7 @@ static inline int cxgb4_fill_ipv6_dst_ip1(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_dst_ip2(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.lip[8], &val, sizeof(u32));
+ memcpy(&f->mask.lip[8], &mask, sizeof(u32));
+@@ -192,7 +192,7 @@ static inline int cxgb4_fill_ipv6_dst_ip2(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_dst_ip3(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.lip[12], &val, sizeof(u32));
+ memcpy(&f->mask.lip[12], &mask, sizeof(u32));
+@@ -216,7 +216,7 @@ static const struct cxgb4_match_field cxgb4_ipv6_fields[] = {
+
+ /* TCP/UDP match */
+ static inline int cxgb4_fill_l4_ports(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ f->val.fport = ntohl(val) >> 16;
+ f->mask.fport = ntohl(mask) >> 16;
+@@ -237,19 +237,13 @@ static const struct cxgb4_match_field cxgb4_udp_fields[] = {
+ };
+
+ struct cxgb4_next_header {
+- unsigned int offset; /* Offset to next header */
+- /* offset, shift, and mask added to offset above
++ /* Offset, shift, and mask added to beginning of the header
+ * to get to next header. Useful when using a header
+ * field's value to jump to next header such as IHL field
+ * in IPv4 header.
+ */
+- unsigned int offoff;
+- u32 shift;
+- u32 mask;
+- /* match criteria to make this jump */
+- unsigned int match_off;
+- u32 match_val;
+- u32 match_mask;
++ struct tc_u32_sel sel;
++ struct tc_u32_key key;
+ /* location of jump to make */
+ const struct cxgb4_match_field *jump;
+ };
+@@ -258,26 +252,74 @@ struct cxgb4_next_header {
+ * IPv4 header.
+ */
+ static const struct cxgb4_next_header cxgb4_ipv4_jumps[] = {
+- { .offset = 0, .offoff = 0, .shift = 6, .mask = 0xF,
+- .match_off = 8, .match_val = 0x600, .match_mask = 0xFF00,
+- .jump = cxgb4_tcp_fields },
+- { .offset = 0, .offoff = 0, .shift = 6, .mask = 0xF,
+- .match_off = 8, .match_val = 0x1100, .match_mask = 0xFF00,
+- .jump = cxgb4_udp_fields },
+- { .jump = NULL }
++ {
++ /* TCP Jump */
++ .sel = {
++ .off = 0,
++ .offoff = 0,
++ .offshift = 6,
++ .offmask = cpu_to_be16(0x0f00),
++ },
++ .key = {
++ .off = 8,
++ .val = cpu_to_be32(0x00060000),
++ .mask = cpu_to_be32(0x00ff0000),
++ },
++ .jump = cxgb4_tcp_fields,
++ },
++ {
++ /* UDP Jump */
++ .sel = {
++ .off = 0,
++ .offoff = 0,
++ .offshift = 6,
++ .offmask = cpu_to_be16(0x0f00),
++ },
++ .key = {
++ .off = 8,
++ .val = cpu_to_be32(0x00110000),
++ .mask = cpu_to_be32(0x00ff0000),
++ },
++ .jump = cxgb4_udp_fields,
++ },
++ { .jump = NULL },
+ };
+
+ /* Accept a rule with a jump directly past the 40 Bytes of IPv6 fixed header
+ * to get to transport layer header.
+ */
+ static const struct cxgb4_next_header cxgb4_ipv6_jumps[] = {
+- { .offset = 0x28, .offoff = 0, .shift = 0, .mask = 0,
+- .match_off = 4, .match_val = 0x60000, .match_mask = 0xFF0000,
+- .jump = cxgb4_tcp_fields },
+- { .offset = 0x28, .offoff = 0, .shift = 0, .mask = 0,
+- .match_off = 4, .match_val = 0x110000, .match_mask = 0xFF0000,
+- .jump = cxgb4_udp_fields },
+- { .jump = NULL }
++ {
++ /* TCP Jump */
++ .sel = {
++ .off = 40,
++ .offoff = 0,
++ .offshift = 0,
++ .offmask = 0,
++ },
++ .key = {
++ .off = 4,
++ .val = cpu_to_be32(0x00000600),
++ .mask = cpu_to_be32(0x0000ff00),
++ },
++ .jump = cxgb4_tcp_fields,
++ },
++ {
++ /* UDP Jump */
++ .sel = {
++ .off = 40,
++ .offoff = 0,
++ .offshift = 0,
++ .offmask = 0,
++ },
++ .key = {
++ .off = 4,
++ .val = cpu_to_be32(0x00001100),
++ .mask = cpu_to_be32(0x0000ff00),
++ },
++ .jump = cxgb4_udp_fields,
++ },
++ { .jump = NULL },
+ };
+
+ struct cxgb4_link {
+--
+2.25.1
+
--- /dev/null
+From 43c1bcc404224dffc259bc8e282b43a089956cfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 01:51:36 +0530
+Subject: cxgb4: use correct type for all-mask IP address comparison
+
+From: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+
+[ Upstream commit f286dd8eaad5a2758750f407ab079298e0bcc8a5 ]
+
+Use correct type to check for all-mask exact match IP addresses.
+
+Fixes following sparse warnings due to big endian value checks
+against 0xffffffff in is_addr_all_mask():
+cxgb4_filter.c:977:25: warning: restricted __be32 degrades to integer
+cxgb4_filter.c:983:37: warning: restricted __be32 degrades to integer
+cxgb4_filter.c:984:37: warning: restricted __be32 degrades to integer
+cxgb4_filter.c:985:37: warning: restricted __be32 degrades to integer
+cxgb4_filter.c:986:37: warning: restricted __be32 degrades to integer
+
+Fixes: 3eb8b62d5a26 ("cxgb4: add support to create hash-filters via tc-flower offload")
+Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+index c6bf2648fe420..7a7f61a8cdf40 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+@@ -1112,16 +1112,16 @@ static bool is_addr_all_mask(u8 *ipmask, int family)
+ struct in_addr *addr;
+
+ addr = (struct in_addr *)ipmask;
+- if (addr->s_addr == 0xffffffff)
++ if (ntohl(addr->s_addr) == 0xffffffff)
+ return true;
+ } else if (family == AF_INET6) {
+ struct in6_addr *addr6;
+
+ addr6 = (struct in6_addr *)ipmask;
+- if (addr6->s6_addr32[0] == 0xffffffff &&
+- addr6->s6_addr32[1] == 0xffffffff &&
+- addr6->s6_addr32[2] == 0xffffffff &&
+- addr6->s6_addr32[3] == 0xffffffff)
++ if (ntohl(addr6->s6_addr32[0]) == 0xffffffff &&
++ ntohl(addr6->s6_addr32[1]) == 0xffffffff &&
++ ntohl(addr6->s6_addr32[2]) == 0xffffffff &&
++ ntohl(addr6->s6_addr32[3]) == 0xffffffff)
+ return true;
+ }
+ return false;
+--
+2.25.1
+
--- /dev/null
+From 938206e8b2513de7939e42f0b602ee543d49f748 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 01:51:33 +0530
+Subject: cxgb4: use unaligned conversion for fetching timestamp
+
+From: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+
+[ Upstream commit 589b1c9c166dce120e27b32a83a78f55464a7ef9 ]
+
+Use get_unaligned_be64() to fetch the timestamp needed for ns_to_ktime()
+conversion.
+
+Fixes following sparse warning:
+sge.c:3282:43: warning: cast to restricted __be64
+
+Fixes: a456950445a0 ("cxgb4: time stamping interface for PTP")
+Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/sge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+index db8106d9d6edf..28ce9856a0784 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+@@ -3300,7 +3300,7 @@ static noinline int t4_systim_to_hwstamp(struct adapter *adapter,
+
+ hwtstamps = skb_hwtstamps(skb);
+ memset(hwtstamps, 0, sizeof(*hwtstamps));
+- hwtstamps->hwtstamp = ns_to_ktime(be64_to_cpu(*((u64 *)data)));
++ hwtstamps->hwtstamp = ns_to_ktime(get_unaligned_be64(data));
+
+ return RX_PTP_PKT_SUC;
+ }
+--
+2.25.1
+
--- /dev/null
+From 9c4bf82d8a3c455001330b02cb0c8d15a12516be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jun 2020 09:48:59 +0800
+Subject: drm/msm/dpu: fix error return code in dpu_encoder_init
+
+From: Chen Tao <chentao107@huawei.com>
+
+[ Upstream commit aa472721c8dbe1713cf510f56ffbc56ae9e14247 ]
+
+Fix to return negative error code -ENOMEM with the use of
+ERR_PTR from dpu_encoder_init.
+
+Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
+Signed-off-by: Chen Tao <chentao107@huawei.com>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index a1b79ee2bd9d5..a2f6b688a9768 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -2173,7 +2173,7 @@ struct drm_encoder *dpu_encoder_init(struct drm_device *dev,
+
+ dpu_enc = devm_kzalloc(dev->dev, sizeof(*dpu_enc), GFP_KERNEL);
+ if (!dpu_enc)
+- return ERR_PTR(ENOMEM);
++ return ERR_PTR(-ENOMEM);
+
+ rc = drm_encoder_init(dev, &dpu_enc->base, &dpu_encoder_funcs,
+ drm_enc_mode, NULL);
+--
+2.25.1
+
--- /dev/null
+From b827d79ecd40ffe9f27953515f60993f110c6970 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 14:00:32 +0800
+Subject: drm: sun4i: hdmi: Remove extra HPD polling
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit bda8eaa6dee7525f4dac950810a85a88bf6c2ba0 ]
+
+The HPD sense mechanism in Allwinner's old HDMI encoder hardware is more
+or less an input-only GPIO. Other GPIO-based HPD implementations
+directly return the current state, instead of polling for a specific
+state and returning the other if that times out.
+
+Remove the I/O polling from sun4i_hdmi_connector_detect() and directly
+return a known state based on the current reading. This also gets rid
+of excessive CPU usage by kworker as reported on Stack Exchange [1] and
+Armbian forums [2].
+
+ [1] https://superuser.com/questions/1515001/debian-10-buster-on-cubietruck-with-bug-in-sun4i-drm-hdmi
+ [2] https://forum.armbian.com/topic/14282-headless-systems-and-sun4i_drm_hdmi-a10a20/
+
+Fixes: 9c5681011a0c ("drm/sun4i: Add HDMI support")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200629060032.24134-1-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+index 68d4644ac2dcc..f07e0c32b93a2 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+@@ -262,9 +262,8 @@ sun4i_hdmi_connector_detect(struct drm_connector *connector, bool force)
+ struct sun4i_hdmi *hdmi = drm_connector_to_sun4i_hdmi(connector);
+ unsigned long reg;
+
+- if (readl_poll_timeout(hdmi->base + SUN4I_HDMI_HPD_REG, reg,
+- reg & SUN4I_HDMI_HPD_HIGH,
+- 0, 500000)) {
++ reg = readl(hdmi->base + SUN4I_HDMI_HPD_REG);
++ if (reg & SUN4I_HDMI_HPD_HIGH) {
+ cec_phys_addr_invalidate(hdmi->cec_adap);
+ return connector_status_disconnected;
+ }
+--
+2.25.1
+
--- /dev/null
+From bb1598ac1eec7e8683b6f83f098135337f07e0a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jun 2020 12:16:52 +0300
+Subject: enetc: Fix HW_VLAN_CTAG_TX|RX toggling
+
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+
+[ Upstream commit 9deba33f1b7266a3870c9da31f787b605748fc0c ]
+
+VLAN tag insertion/extraction offload is correctly
+activated at probe time but deactivation of this feature
+(i.e. via ethtool) is broken. Toggling works only for
+Tx/Rx ring 0 of a PF, and is ignored for the other rings,
+including the VF rings.
+To fix this, the existing VLAN offload toggling code
+was extended to all the rings assigned to a netdevice,
+instead of the default ring 0 (likely a leftover from the
+early validation days of this feature). And the code was
+moved to the common set_features() function to fix toggling
+for the VF driver too.
+
+Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers")
+Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc.c | 26 +++++++++++++++++++
+ .../net/ethernet/freescale/enetc/enetc_hw.h | 16 ++++++------
+ .../net/ethernet/freescale/enetc/enetc_pf.c | 9 -------
+ 3 files changed, 34 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
+index 9ac5cccfe0204..a7e4274d3f402 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc.c
+@@ -1587,6 +1587,24 @@ static int enetc_set_psfp(struct net_device *ndev, int en)
+ return 0;
+ }
+
++static void enetc_enable_rxvlan(struct net_device *ndev, bool en)
++{
++ struct enetc_ndev_priv *priv = netdev_priv(ndev);
++ int i;
++
++ for (i = 0; i < priv->num_rx_rings; i++)
++ enetc_bdr_enable_rxvlan(&priv->si->hw, i, en);
++}
++
++static void enetc_enable_txvlan(struct net_device *ndev, bool en)
++{
++ struct enetc_ndev_priv *priv = netdev_priv(ndev);
++ int i;
++
++ for (i = 0; i < priv->num_tx_rings; i++)
++ enetc_bdr_enable_txvlan(&priv->si->hw, i, en);
++}
++
+ int enetc_set_features(struct net_device *ndev,
+ netdev_features_t features)
+ {
+@@ -1595,6 +1613,14 @@ int enetc_set_features(struct net_device *ndev,
+ if (changed & NETIF_F_RXHASH)
+ enetc_set_rss(ndev, !!(features & NETIF_F_RXHASH));
+
++ if (changed & NETIF_F_HW_VLAN_CTAG_RX)
++ enetc_enable_rxvlan(ndev,
++ !!(features & NETIF_F_HW_VLAN_CTAG_RX));
++
++ if (changed & NETIF_F_HW_VLAN_CTAG_TX)
++ enetc_enable_txvlan(ndev,
++ !!(features & NETIF_F_HW_VLAN_CTAG_TX));
++
+ if (changed & NETIF_F_HW_TC)
+ enetc_set_psfp(ndev, !!(features & NETIF_F_HW_TC));
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+index 587974862f488..02efda266c468 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+@@ -531,22 +531,22 @@ struct enetc_msg_cmd_header {
+
+ /* Common H/W utility functions */
+
+-static inline void enetc_enable_rxvlan(struct enetc_hw *hw, int si_idx,
+- bool en)
++static inline void enetc_bdr_enable_rxvlan(struct enetc_hw *hw, int idx,
++ bool en)
+ {
+- u32 val = enetc_rxbdr_rd(hw, si_idx, ENETC_RBMR);
++ u32 val = enetc_rxbdr_rd(hw, idx, ENETC_RBMR);
+
+ val = (val & ~ENETC_RBMR_VTE) | (en ? ENETC_RBMR_VTE : 0);
+- enetc_rxbdr_wr(hw, si_idx, ENETC_RBMR, val);
++ enetc_rxbdr_wr(hw, idx, ENETC_RBMR, val);
+ }
+
+-static inline void enetc_enable_txvlan(struct enetc_hw *hw, int si_idx,
+- bool en)
++static inline void enetc_bdr_enable_txvlan(struct enetc_hw *hw, int idx,
++ bool en)
+ {
+- u32 val = enetc_txbdr_rd(hw, si_idx, ENETC_TBMR);
++ u32 val = enetc_txbdr_rd(hw, idx, ENETC_TBMR);
+
+ val = (val & ~ENETC_TBMR_VIH) | (en ? ENETC_TBMR_VIH : 0);
+- enetc_txbdr_wr(hw, si_idx, ENETC_TBMR, val);
++ enetc_txbdr_wr(hw, idx, ENETC_TBMR, val);
+ }
+
+ static inline void enetc_set_bdr_prio(struct enetc_hw *hw, int bdr_idx,
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+index eacd597b55f22..438648a06f2ae 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+@@ -667,15 +667,6 @@ static int enetc_pf_set_features(struct net_device *ndev,
+ netdev_features_t features)
+ {
+ netdev_features_t changed = ndev->features ^ features;
+- struct enetc_ndev_priv *priv = netdev_priv(ndev);
+-
+- if (changed & NETIF_F_HW_VLAN_CTAG_RX)
+- enetc_enable_rxvlan(&priv->si->hw, 0,
+- !!(features & NETIF_F_HW_VLAN_CTAG_RX));
+-
+- if (changed & NETIF_F_HW_VLAN_CTAG_TX)
+- enetc_enable_txvlan(&priv->si->hw, 0,
+- !!(features & NETIF_F_HW_VLAN_CTAG_TX));
+
+ if (changed & NETIF_F_LOOPBACK)
+ enetc_set_loopback(ndev, !!(features & NETIF_F_LOOPBACK));
+--
+2.25.1
+
--- /dev/null
+From e81160fbf47865ae4486dc0ef0b3efb6f01e1b22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Jun 2020 13:46:25 +0000
+Subject: hsr: avoid to create proc file after unregister
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit de0083c7ed7dba036d1ed6e012157649d45313c8 ]
+
+When an interface is being deleted, "/proc/net/dev_snmp6/<interface name>"
+is deleted.
+The function for this is addrconf_ifdown() in the addrconf_notify() and
+it is called by notification, which is NETDEV_UNREGISTER.
+But, if NETDEV_CHANGEMTU is triggered after NETDEV_UNREGISTER,
+this proc file will be created again.
+This recreated proc file will be deleted by netdev_wati_allrefs().
+Before netdev_wait_allrefs() is called, creating a new HSR interface
+routine can be executed and It tries to create a proc file but it will
+find an un-deleted proc file.
+At this point, it warns about it.
+
+To avoid this situation, it can use ->dellink() instead of
+->ndo_uninit() to release resources because ->dellink() is called
+before NETDEV_UNREGISTER.
+So, a proc file will not be recreated.
+
+Test commands
+ ip link add dummy0 type dummy
+ ip link add dummy1 type dummy
+ ip link set dummy0 mtu 1300
+
+ #SHELL1
+ while :
+ do
+ ip link add hsr0 type hsr slave1 dummy0 slave2 dummy1
+ done
+
+ #SHELL2
+ while :
+ do
+ ip link del hsr0
+ done
+
+Splat looks like:
+[ 9888.980852][ T2752] proc_dir_entry 'dev_snmp6/hsr0' already registered
+[ 9888.981797][ C2] WARNING: CPU: 2 PID: 2752 at fs/proc/generic.c:372 proc_register+0x2d5/0x430
+[ 9888.981798][ C2] Modules linked in: hsr dummy veth openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6x
+[ 9888.981814][ C2] CPU: 2 PID: 2752 Comm: ip Tainted: G W 5.8.0-rc1+ #616
+[ 9888.981815][ C2] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+[ 9888.981816][ C2] RIP: 0010:proc_register+0x2d5/0x430
+[ 9888.981818][ C2] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 65 01 00 00 49 8b b5 e0 00 00 00 48 89 ea 40
+[ 9888.981819][ C2] RSP: 0018:ffff8880628dedf0 EFLAGS: 00010286
+[ 9888.981821][ C2] RAX: dffffc0000000008 RBX: ffff888028c69170 RCX: ffffffffaae09a62
+[ 9888.981822][ C2] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88806c9f75ac
+[ 9888.981823][ C2] RBP: ffff888028c693f4 R08: ffffed100d9401bd R09: ffffed100d9401bd
+[ 9888.981824][ C2] R10: ffffffffaddf406f R11: 0000000000000001 R12: ffff888028c69308
+[ 9888.981825][ C2] R13: ffff8880663584c8 R14: dffffc0000000000 R15: ffffed100518d27e
+[ 9888.981827][ C2] FS: 00007f3876b3b0c0(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000
+[ 9888.981828][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 9888.981829][ C2] CR2: 00007f387601a8c0 CR3: 000000004101a002 CR4: 00000000000606e0
+[ 9888.981830][ C2] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 9888.981831][ C2] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 9888.981832][ C2] Call Trace:
+[ 9888.981833][ C2] ? snmp6_seq_show+0x180/0x180
+[ 9888.981834][ C2] proc_create_single_data+0x7c/0xa0
+[ 9888.981835][ C2] snmp6_register_dev+0xb0/0x130
+[ 9888.981836][ C2] ipv6_add_dev+0x4b7/0xf60
+[ 9888.981837][ C2] addrconf_notify+0x684/0x1ca0
+[ 9888.981838][ C2] ? __mutex_unlock_slowpath+0xd0/0x670
+[ 9888.981839][ C2] ? kasan_unpoison_shadow+0x30/0x40
+[ 9888.981840][ C2] ? wait_for_completion+0x250/0x250
+[ 9888.981841][ C2] ? inet6_ifinfo_notify+0x100/0x100
+[ 9888.981842][ C2] ? dropmon_net_event+0x227/0x410
+[ 9888.981843][ C2] ? notifier_call_chain+0x90/0x160
+[ 9888.981844][ C2] ? inet6_ifinfo_notify+0x100/0x100
+[ 9888.981845][ C2] notifier_call_chain+0x90/0x160
+[ 9888.981846][ C2] register_netdevice+0xbe5/0x1070
+[ ... ]
+
+Reported-by: syzbot+1d51c8b74efa4c44adeb@syzkaller.appspotmail.com
+Fixes: e0a4b99773d3 ("hsr: use upper/lower device infrastructure")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/hsr/hsr_device.c | 21 +--------------------
+ net/hsr/hsr_device.h | 2 +-
+ net/hsr/hsr_main.c | 9 ++++++---
+ net/hsr/hsr_netlink.c | 17 +++++++++++++++++
+ 4 files changed, 25 insertions(+), 24 deletions(-)
+
+diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
+index fc7027314ad80..ef100cfd2ac1b 100644
+--- a/net/hsr/hsr_device.c
++++ b/net/hsr/hsr_device.c
+@@ -341,7 +341,7 @@ static void hsr_announce(struct timer_list *t)
+ rcu_read_unlock();
+ }
+
+-static void hsr_del_ports(struct hsr_priv *hsr)
++void hsr_del_ports(struct hsr_priv *hsr)
+ {
+ struct hsr_port *port;
+
+@@ -358,31 +358,12 @@ static void hsr_del_ports(struct hsr_priv *hsr)
+ hsr_del_port(port);
+ }
+
+-/* This has to be called after all the readers are gone.
+- * Otherwise we would have to check the return value of
+- * hsr_port_get_hsr().
+- */
+-static void hsr_dev_destroy(struct net_device *hsr_dev)
+-{
+- struct hsr_priv *hsr = netdev_priv(hsr_dev);
+-
+- hsr_debugfs_term(hsr);
+- hsr_del_ports(hsr);
+-
+- del_timer_sync(&hsr->prune_timer);
+- del_timer_sync(&hsr->announce_timer);
+-
+- hsr_del_self_node(hsr);
+- hsr_del_nodes(&hsr->node_db);
+-}
+-
+ static const struct net_device_ops hsr_device_ops = {
+ .ndo_change_mtu = hsr_dev_change_mtu,
+ .ndo_open = hsr_dev_open,
+ .ndo_stop = hsr_dev_close,
+ .ndo_start_xmit = hsr_dev_xmit,
+ .ndo_fix_features = hsr_fix_features,
+- .ndo_uninit = hsr_dev_destroy,
+ };
+
+ static struct device_type hsr_type = {
+diff --git a/net/hsr/hsr_device.h b/net/hsr/hsr_device.h
+index a099d7de7e790..b8f9262ed101a 100644
+--- a/net/hsr/hsr_device.h
++++ b/net/hsr/hsr_device.h
+@@ -11,6 +11,7 @@
+ #include <linux/netdevice.h>
+ #include "hsr_main.h"
+
++void hsr_del_ports(struct hsr_priv *hsr);
+ void hsr_dev_setup(struct net_device *dev);
+ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
+ unsigned char multicast_spec, u8 protocol_version,
+@@ -18,5 +19,4 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
+ void hsr_check_carrier_and_operstate(struct hsr_priv *hsr);
+ bool is_hsr_master(struct net_device *dev);
+ int hsr_get_max_mtu(struct hsr_priv *hsr);
+-
+ #endif /* __HSR_DEVICE_H */
+diff --git a/net/hsr/hsr_main.c b/net/hsr/hsr_main.c
+index e2564de676038..144da15f0a817 100644
+--- a/net/hsr/hsr_main.c
++++ b/net/hsr/hsr_main.c
+@@ -6,6 +6,7 @@
+ */
+
+ #include <linux/netdevice.h>
++#include <net/rtnetlink.h>
+ #include <linux/rculist.h>
+ #include <linux/timer.h>
+ #include <linux/etherdevice.h>
+@@ -100,8 +101,10 @@ static int hsr_netdev_notify(struct notifier_block *nb, unsigned long event,
+ master = hsr_port_get_hsr(port->hsr, HSR_PT_MASTER);
+ hsr_del_port(port);
+ if (hsr_slave_empty(master->hsr)) {
+- unregister_netdevice_queue(master->dev,
+- &list_kill);
++ const struct rtnl_link_ops *ops;
++
++ ops = master->dev->rtnl_link_ops;
++ ops->dellink(master->dev, &list_kill);
+ unregister_netdevice_many(&list_kill);
+ }
+ }
+@@ -144,9 +147,9 @@ static int __init hsr_init(void)
+
+ static void __exit hsr_exit(void)
+ {
+- unregister_netdevice_notifier(&hsr_nb);
+ hsr_netlink_exit();
+ hsr_debugfs_remove_root();
++ unregister_netdevice_notifier(&hsr_nb);
+ }
+
+ module_init(hsr_init);
+diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c
+index 1decb25f6764a..6e14b7d226399 100644
+--- a/net/hsr/hsr_netlink.c
++++ b/net/hsr/hsr_netlink.c
+@@ -83,6 +83,22 @@ static int hsr_newlink(struct net *src_net, struct net_device *dev,
+ return hsr_dev_finalize(dev, link, multicast_spec, hsr_version, extack);
+ }
+
++static void hsr_dellink(struct net_device *dev, struct list_head *head)
++{
++ struct hsr_priv *hsr = netdev_priv(dev);
++
++ del_timer_sync(&hsr->prune_timer);
++ del_timer_sync(&hsr->announce_timer);
++
++ hsr_debugfs_term(hsr);
++ hsr_del_ports(hsr);
++
++ hsr_del_self_node(hsr);
++ hsr_del_nodes(&hsr->node_db);
++
++ unregister_netdevice_queue(dev, head);
++}
++
+ static int hsr_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ {
+ struct hsr_priv *hsr = netdev_priv(dev);
+@@ -118,6 +134,7 @@ static struct rtnl_link_ops hsr_link_ops __read_mostly = {
+ .priv_size = sizeof(struct hsr_priv),
+ .setup = hsr_dev_setup,
+ .newlink = hsr_newlink,
++ .dellink = hsr_dellink,
+ .fill_info = hsr_fill_info,
+ };
+
+--
+2.25.1
+
--- /dev/null
+From be4d2832a3805b1ba14f80c4529d334acc86c814 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2020 17:37:02 +0000
+Subject: hsr: remove hsr interface if all slaves are removed
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit 34a9c361dd480041d790fff3d6ea58513c8769e8 ]
+
+When all hsr slave interfaces are removed, hsr interface doesn't work.
+At that moment, it's fine to remove an unused hsr interface automatically
+for saving resources.
+That's a common behavior of virtual interfaces.
+
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/hsr/hsr_main.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/net/hsr/hsr_main.c b/net/hsr/hsr_main.c
+index 26d6c39f24e16..e2564de676038 100644
+--- a/net/hsr/hsr_main.c
++++ b/net/hsr/hsr_main.c
+@@ -15,12 +15,23 @@
+ #include "hsr_framereg.h"
+ #include "hsr_slave.h"
+
++static bool hsr_slave_empty(struct hsr_priv *hsr)
++{
++ struct hsr_port *port;
++
++ hsr_for_each_port(hsr, port)
++ if (port->type != HSR_PT_MASTER)
++ return false;
++ return true;
++}
++
+ static int hsr_netdev_notify(struct notifier_block *nb, unsigned long event,
+ void *ptr)
+ {
+- struct net_device *dev;
+ struct hsr_port *port, *master;
++ struct net_device *dev;
+ struct hsr_priv *hsr;
++ LIST_HEAD(list_kill);
+ int mtu_max;
+ int res;
+
+@@ -85,8 +96,15 @@ static int hsr_netdev_notify(struct notifier_block *nb, unsigned long event,
+ master->dev->mtu = mtu_max;
+ break;
+ case NETDEV_UNREGISTER:
+- if (!is_hsr_master(dev))
++ if (!is_hsr_master(dev)) {
++ master = hsr_port_get_hsr(port->hsr, HSR_PT_MASTER);
+ hsr_del_port(port);
++ if (hsr_slave_empty(master->hsr)) {
++ unregister_netdevice_queue(master->dev,
++ &list_kill);
++ unregister_netdevice_many(&list_kill);
++ }
++ }
+ break;
+ case NETDEV_PRE_TYPE_CHANGE:
+ /* HSR works only on Ethernet devices. Refuse slave to change
+--
+2.25.1
+
--- /dev/null
+From 3e48bd463e36c534b8cdfd796aa9ebd1525cec2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 13:32:42 +0900
+Subject: hwmon: (acpi_power_meter) Fix potential memory leak in
+ acpi_power_meter_add()
+
+From: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
+
+[ Upstream commit 8b97f9922211c44a739c5cbd9502ecbb9f17f6d1 ]
+
+Although it rarely happens, we should call free_capabilities()
+if error happens after read_capabilities() to free allocated strings.
+
+Fixes: de584afa5e188 ("hwmon driver for ACPI 4.0 power meters")
+Signed-off-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
+Link: https://lore.kernel.org/r/20200625043242.31175-1-misono.tomohiro@jp.fujitsu.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/acpi_power_meter.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
+index 0db8ef4fd6e18..a270b975e90bb 100644
+--- a/drivers/hwmon/acpi_power_meter.c
++++ b/drivers/hwmon/acpi_power_meter.c
+@@ -883,7 +883,7 @@ static int acpi_power_meter_add(struct acpi_device *device)
+
+ res = setup_attrs(resource);
+ if (res)
+- goto exit_free;
++ goto exit_free_capability;
+
+ resource->hwmon_dev = hwmon_device_register(&device->dev);
+ if (IS_ERR(resource->hwmon_dev)) {
+@@ -896,6 +896,8 @@ static int acpi_power_meter_add(struct acpi_device *device)
+
+ exit_remove:
+ remove_attrs(resource);
++exit_free_capability:
++ free_capabilities(resource);
+ exit_free:
+ kfree(resource);
+ exit:
+--
+2.25.1
+
--- /dev/null
+From b35eb3d728dff4363598eab94c6d748781cbb260 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jun 2020 22:13:08 +0000
+Subject: hwmon: (max6697) Make sure the OVERT mask is set correctly
+
+From: Chu Lin <linchuyuan@google.com>
+
+[ Upstream commit 016983d138cbe99a5c0aaae0103ee88f5300beb3 ]
+
+Per the datasheet for max6697, OVERT mask and ALERT mask are different.
+For example, the 7th bit of OVERT is the local channel but for alert
+mask, the 6th bit is the local channel. Therefore, we can't apply the
+same mask for both registers. In addition to that, the max6697 driver
+is supposed to be compatibale with different models. I manually went over
+all the listed chips and made sure all chip types have the same layout.
+
+Testing;
+ mask value of 0x9 should map to 0x44 for ALERT and 0x84 for OVERT.
+ I used iotool to read the reg value back to verify. I only tested this
+ change on max6581.
+
+Reference:
+https://datasheets.maximintegrated.com/en/ds/MAX6581.pdf
+https://datasheets.maximintegrated.com/en/ds/MAX6697.pdf
+https://datasheets.maximintegrated.com/en/ds/MAX6699.pdf
+
+Signed-off-by: Chu Lin <linchuyuan@google.com>
+Fixes: 5372d2d71c46e ("hwmon: Driver for Maxim MAX6697 and compatibles")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/max6697.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c
+index 743752a2467a2..64122eb38060d 100644
+--- a/drivers/hwmon/max6697.c
++++ b/drivers/hwmon/max6697.c
+@@ -38,8 +38,9 @@ static const u8 MAX6697_REG_CRIT[] = {
+ * Map device tree / platform data register bit map to chip bit map.
+ * Applies to alert register and over-temperature register.
+ */
+-#define MAX6697_MAP_BITS(reg) ((((reg) & 0x7e) >> 1) | \
++#define MAX6697_ALERT_MAP_BITS(reg) ((((reg) & 0x7e) >> 1) | \
+ (((reg) & 0x01) << 6) | ((reg) & 0x80))
++#define MAX6697_OVERT_MAP_BITS(reg) (((reg) >> 1) | (((reg) & 0x01) << 7))
+
+ #define MAX6697_REG_STAT(n) (0x44 + (n))
+
+@@ -562,12 +563,12 @@ static int max6697_init_chip(struct max6697_data *data,
+ return ret;
+
+ ret = i2c_smbus_write_byte_data(client, MAX6697_REG_ALERT_MASK,
+- MAX6697_MAP_BITS(pdata->alert_mask));
++ MAX6697_ALERT_MAP_BITS(pdata->alert_mask));
+ if (ret < 0)
+ return ret;
+
+ ret = i2c_smbus_write_byte_data(client, MAX6697_REG_OVERT_MASK,
+- MAX6697_MAP_BITS(pdata->over_temperature_mask));
++ MAX6697_OVERT_MAP_BITS(pdata->over_temperature_mask));
+ if (ret < 0)
+ return ret;
+
+--
+2.25.1
+
--- /dev/null
+From 65d773cbcc8c5a1dbc13327d67faac5ecc05a254 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jul 2020 10:39:11 +1200
+Subject: i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+[ Upstream commit cd217f2300793a106b49c7dfcbfb26e348bc7593 ]
+
+The PCA9665 datasheet says that I2CSTA = 78h indicates that SCL is stuck
+low, this differs to the PCA9564 which uses 90h for this indication.
+Treat either 0x78 or 0x90 as an indication that the SCL line is stuck.
+
+Based on looking through the PCA9564 and PCA9665 datasheets this should
+be safe for both chips. The PCA9564 should not return 0x78 for any valid
+state and the PCA9665 should not return 0x90.
+
+Fixes: eff9ec95efaa ("i2c-algo-pca: Add PCA9665 support")
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/algos/i2c-algo-pca.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
+index 7f10312d1b88f..388978775be04 100644
+--- a/drivers/i2c/algos/i2c-algo-pca.c
++++ b/drivers/i2c/algos/i2c-algo-pca.c
+@@ -314,7 +314,8 @@ static int pca_xfer(struct i2c_adapter *i2c_adap,
+ DEB2("BUS ERROR - SDA Stuck low\n");
+ pca_reset(adap);
+ goto out;
+- case 0x90: /* Bus error - SCL stuck low */
++ case 0x78: /* Bus error - SCL stuck low (PCA9665) */
++ case 0x90: /* Bus error - SCL stuck low (PCA9564) */
+ DEB2("BUS ERROR - SCL Stuck low\n");
+ pca_reset(adap);
+ goto out;
+--
+2.25.1
+
--- /dev/null
+From e454aa138117e0a8ed88b014171cc1715042c8aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jul 2020 12:33:21 +0200
+Subject: i2c: designware: platdrv: Set class based on DMI
+
+From: Ricardo Ribalda <ribalda@kernel.org>
+
+[ Upstream commit db2a8b6f1df93d5311970cca03052c01178de674 ]
+
+Current AMD's zen-based APUs use this core for some of its i2c-buses.
+
+With this patch we re-enable autodetection of hwmon-alike devices, so
+lm-sensors will be able to work automatically.
+
+It does not affect the boot-time of embedded devices, as the class is
+set based on the DMI information.
+
+DMI is probed only on Qtechnology QT5222 Industrial Camera Platform.
+
+DocLink: https://qtec.com/camera-technology-camera-platforms/
+Fixes: 3eddad96c439 ("i2c: designware: reverts "i2c: designware: Add support for AMD I2C controller"")
+Signed-off-by: Ricardo Ribalda <ribalda@kernel.org>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index 5536673060cc6..3a9c2cfbef974 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -234,6 +234,17 @@ static const u32 supported_speeds[] = {
+ I2C_MAX_STANDARD_MODE_FREQ,
+ };
+
++static const struct dmi_system_id dw_i2c_hwmon_class_dmi[] = {
++ {
++ .ident = "Qtechnology QT5222",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Qtechnology"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "QT5222"),
++ },
++ },
++ { } /* terminate list */
++};
++
+ static int dw_i2c_plat_probe(struct platform_device *pdev)
+ {
+ struct dw_i2c_platform_data *pdata = dev_get_platdata(&pdev->dev);
+@@ -349,7 +360,8 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
+
+ adap = &dev->adapter;
+ adap->owner = THIS_MODULE;
+- adap->class = I2C_CLASS_DEPRECATED;
++ adap->class = dmi_check_system(dw_i2c_hwmon_class_dmi) ?
++ I2C_CLASS_HWMON : I2C_CLASS_DEPRECATED;
+ ACPI_COMPANION_SET(&adap->dev, ACPI_COMPANION(&pdev->dev));
+ adap->dev.of_node = pdev->dev.of_node;
+ adap->nr = -1;
+--
+2.25.1
+
--- /dev/null
+From aaae906088c065c3031d70ae8bdc1b82f92b4e48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jun 2020 13:52:44 +0200
+Subject: i2c: mlxcpld: check correct size of maximum RECV_LEN packet
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 597911287fcd13c3a4b4aa3e0a52b33d431e0a8e ]
+
+I2C_SMBUS_BLOCK_MAX defines already the maximum number as defined in the
+SMBus 2.0 specs. I don't see a reason to add 1 here. Also, fix the errno
+to what is suggested for this error.
+
+Fixes: c9bfdc7c16cb ("i2c: mlxcpld: Add support for smbus block read transaction")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Michael Shych <michaelsh@mellanox.com>
+Tested-by: Michael Shych <michaelsh@mellanox.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mlxcpld.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mlxcpld.c b/drivers/i2c/busses/i2c-mlxcpld.c
+index 2fd717d8dd30e..71d7bae2cbcad 100644
+--- a/drivers/i2c/busses/i2c-mlxcpld.c
++++ b/drivers/i2c/busses/i2c-mlxcpld.c
+@@ -337,9 +337,9 @@ static int mlxcpld_i2c_wait_for_tc(struct mlxcpld_i2c_priv *priv)
+ if (priv->smbus_block && (val & MLXCPLD_I2C_SMBUS_BLK_BIT)) {
+ mlxcpld_i2c_read_comm(priv, MLXCPLD_LPCI2C_NUM_DAT_REG,
+ &datalen, 1);
+- if (unlikely(datalen > (I2C_SMBUS_BLOCK_MAX + 1))) {
++ if (unlikely(datalen > I2C_SMBUS_BLOCK_MAX)) {
+ dev_err(priv->dev, "Incorrect smbus block read message len\n");
+- return -E2BIG;
++ return -EPROTO;
+ }
+ } else {
+ datalen = priv->xfer.data_len;
+--
+2.25.1
+
--- /dev/null
+From 744035bdd5e179ca83aaef01e037ca72630f8b8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jul 2020 08:55:50 -0600
+Subject: io_uring: fix regression with always ignoring signals in
+ io_cqring_wait()
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit b7db41c9e03b5189bc94993bd50e4506ac9e34c1 ]
+
+When switching to TWA_SIGNAL for task_work notifications, we also made
+any signal based condition in io_cqring_wait() return -ERESTARTSYS.
+This breaks applications that rely on using signals to abort someone
+waiting for events.
+
+Check if we have a signal pending because of queued task_work, and
+repeat the signal check once we've run the task_work. This provides a
+reliable way of telling the two apart.
+
+Additionally, only use TWA_SIGNAL if we are using an eventfd. If not,
+we don't have the dependency situation described in the original commit,
+and we can get by with just using TWA_RESUME like we previously did.
+
+Fixes: ce593a6c480a ("io_uring: use signal based task_work running")
+Cc: stable@vger.kernel.org # v5.7
+Reported-by: Andres Freund <andres@anarazel.de>
+Tested-by: Andres Freund <andres@anarazel.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 29 ++++++++++++++++++++++-------
+ 1 file changed, 22 insertions(+), 7 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 51362a619fd50..2be6ea0103405 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -4136,14 +4136,22 @@ struct io_poll_table {
+ int error;
+ };
+
+-static int io_req_task_work_add(struct io_kiocb *req, struct callback_head *cb,
+- int notify)
++static int io_req_task_work_add(struct io_kiocb *req, struct callback_head *cb)
+ {
+ struct task_struct *tsk = req->task;
+- int ret;
++ struct io_ring_ctx *ctx = req->ctx;
++ int ret, notify = TWA_RESUME;
+
+- if (req->ctx->flags & IORING_SETUP_SQPOLL)
++ /*
++ * SQPOLL kernel thread doesn't need notification, just a wakeup.
++ * If we're not using an eventfd, then TWA_RESUME is always fine,
++ * as we won't have dependencies between request completions for
++ * other kernel wait conditions.
++ */
++ if (ctx->flags & IORING_SETUP_SQPOLL)
+ notify = 0;
++ else if (ctx->cq_ev_fd)
++ notify = TWA_SIGNAL;
+
+ ret = task_work_add(tsk, cb, notify);
+ if (!ret)
+@@ -4174,7 +4182,7 @@ static int __io_async_wake(struct io_kiocb *req, struct io_poll_iocb *poll,
+ * of executing it. We can't safely execute it anyway, as we may not
+ * have the needed state needed for it anyway.
+ */
+- ret = io_req_task_work_add(req, &req->task_work, TWA_SIGNAL);
++ ret = io_req_task_work_add(req, &req->task_work);
+ if (unlikely(ret)) {
+ WRITE_ONCE(poll->canceled, true);
+ tsk = io_wq_get_task(req->ctx->io_wq);
+@@ -6279,7 +6287,14 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events,
+ if (current->task_works)
+ task_work_run();
+ if (signal_pending(current)) {
+- ret = -ERESTARTSYS;
++ if (current->jobctl & JOBCTL_TASK_WORK) {
++ spin_lock_irq(¤t->sighand->siglock);
++ current->jobctl &= ~JOBCTL_TASK_WORK;
++ recalc_sigpending();
++ spin_unlock_irq(¤t->sighand->siglock);
++ continue;
++ }
++ ret = -EINTR;
+ break;
+ }
+ if (io_should_wake(&iowq, false))
+@@ -6288,7 +6303,7 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events,
+ } while (1);
+ finish_wait(&ctx->wait, &iowq.wq);
+
+- restore_saved_sigmask_unless(ret == -ERESTARTSYS);
++ restore_saved_sigmask_unless(ret == -EINTR);
+
+ return READ_ONCE(rings->cq.head) == READ_ONCE(rings->cq.tail) ? ret : 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From e112f1584706c734c31c28330c54d608186977b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jun 2020 13:23:45 +0800
+Subject: irqchip/gic-v4.1: Use readx_poll_timeout_atomic() to fix sleep in
+ atomic
+
+From: Zenghui Yu <yuzenghui@huawei.com>
+
+[ Upstream commit 31dbb6b1d025506b3b8b8b74e9b697df47b9f696 ]
+
+readx_poll_timeout() can sleep if @sleep_us is specified by the caller,
+and is therefore unsafe to be used inside the atomic context, which is
+this case when we use it to poll the GICR_VPENDBASER.Dirty bit in
+irq_set_vcpu_affinity() callback.
+
+Let's convert to its atomic version instead which helps to get the v4.1
+board back to life!
+
+Fixes: 96806229ca03 ("irqchip/gic-v4.1: Add support for VPENDBASER's Dirty+Valid signaling")
+Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20200605052345.1494-1-yuzenghui@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 124251b0ccbae..b3e16a06c13b7 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -3681,10 +3681,10 @@ static void its_wait_vpt_parse_complete(void)
+ if (!gic_rdists->has_vpend_valid_dirty)
+ return;
+
+- WARN_ON_ONCE(readq_relaxed_poll_timeout(vlpi_base + GICR_VPENDBASER,
+- val,
+- !(val & GICR_VPENDBASER_Dirty),
+- 10, 500));
++ WARN_ON_ONCE(readq_relaxed_poll_timeout_atomic(vlpi_base + GICR_VPENDBASER,
++ val,
++ !(val & GICR_VPENDBASER_Dirty),
++ 10, 500));
+ }
+
+ static void its_vpe_schedule(struct its_vpe *vpe)
+--
+2.25.1
+
--- /dev/null
+From 88f3389631349cc31df367bf898616fa8c3ea728 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 May 2020 12:09:34 -0400
+Subject: kthread: save thread function
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit 52782c92ac85c4e393eb4a903a62e6c24afa633f ]
+
+It's handy to keep the kthread_fn just as a unique cookie to identify
+classes of kthreads. E.g. if you can verify that a given task is
+running your thread_fn, then you may know what sort of type kthread_data
+points to.
+
+We'll use this in nfsd to pass some information into the vfs. Note it
+will need kthread_data() exported too.
+
+Original-patch-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/kthread.h | 1 +
+ kernel/kthread.c | 17 +++++++++++++++++
+ 2 files changed, 18 insertions(+)
+
+diff --git a/include/linux/kthread.h b/include/linux/kthread.h
+index 8bbcaad7ef0f4..c2a274b79c429 100644
+--- a/include/linux/kthread.h
++++ b/include/linux/kthread.h
+@@ -57,6 +57,7 @@ bool kthread_should_stop(void);
+ bool kthread_should_park(void);
+ bool __kthread_should_park(struct task_struct *k);
+ bool kthread_freezable_should_stop(bool *was_frozen);
++void *kthread_func(struct task_struct *k);
+ void *kthread_data(struct task_struct *k);
+ void *kthread_probe_data(struct task_struct *k);
+ int kthread_park(struct task_struct *k);
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index bfbfa481be3a5..b84fc7eec0358 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -46,6 +46,7 @@ struct kthread_create_info
+ struct kthread {
+ unsigned long flags;
+ unsigned int cpu;
++ int (*threadfn)(void *);
+ void *data;
+ struct completion parked;
+ struct completion exited;
+@@ -152,6 +153,20 @@ bool kthread_freezable_should_stop(bool *was_frozen)
+ }
+ EXPORT_SYMBOL_GPL(kthread_freezable_should_stop);
+
++/**
++ * kthread_func - return the function specified on kthread creation
++ * @task: kthread task in question
++ *
++ * Returns NULL if the task is not a kthread.
++ */
++void *kthread_func(struct task_struct *task)
++{
++ if (task->flags & PF_KTHREAD)
++ return to_kthread(task)->threadfn;
++ return NULL;
++}
++EXPORT_SYMBOL_GPL(kthread_func);
++
+ /**
+ * kthread_data - return data value specified on kthread creation
+ * @task: kthread task in question
+@@ -164,6 +179,7 @@ void *kthread_data(struct task_struct *task)
+ {
+ return to_kthread(task)->data;
+ }
++EXPORT_SYMBOL_GPL(kthread_data);
+
+ /**
+ * kthread_probe_data - speculative version of kthread_data()
+@@ -244,6 +260,7 @@ static int kthread(void *_create)
+ do_exit(-ENOMEM);
+ }
+
++ self->threadfn = threadfn;
+ self->data = data;
+ init_completion(&self->exited);
+ init_completion(&self->parked);
+--
+2.25.1
+
--- /dev/null
+From e871776272f5c174ca45140881cb4d1c0e1e257e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 12:08:57 +0200
+Subject: mptcp: drop MP_JOIN request sock on syn cookies
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 9e365ff576b7c1623bbc5ef31ec652c533e2f65e ]
+
+Currently any MPTCP socket using syn cookies will fallback to
+TCP at 3rd ack time. In case of MP_JOIN requests, the RFC mandate
+closing the child and sockets, but the existing error paths
+do not handle the syncookie scenario correctly.
+
+Address the issue always forcing the child shutdown in case of
+MP_JOIN fallback.
+
+Fixes: ae2dd7164943 ("mptcp: handle tcp fallback when using syn cookies")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/subflow.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
+index db3e4e74e7857..0112ead58fd8b 100644
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -424,22 +424,25 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
+ struct mptcp_subflow_context *listener = mptcp_subflow_ctx(sk);
+ struct mptcp_subflow_request_sock *subflow_req;
+ struct mptcp_options_received mp_opt;
+- bool fallback_is_fatal = false;
++ bool fallback, fallback_is_fatal;
+ struct sock *new_msk = NULL;
+- bool fallback = false;
+ struct sock *child;
+
+ pr_debug("listener=%p, req=%p, conn=%p", listener, req, listener->conn);
+
+- /* we need later a valid 'mp_capable' value even when options are not
+- * parsed
++ /* After child creation we must look for 'mp_capable' even when options
++ * are not parsed
+ */
+ mp_opt.mp_capable = 0;
+- if (tcp_rsk(req)->is_mptcp == 0)
++
++ /* hopefully temporary handling for MP_JOIN+syncookie */
++ subflow_req = mptcp_subflow_rsk(req);
++ fallback_is_fatal = subflow_req->mp_join;
++ fallback = !tcp_rsk(req)->is_mptcp;
++ if (fallback)
+ goto create_child;
+
+ /* if the sk is MP_CAPABLE, we try to fetch the client key */
+- subflow_req = mptcp_subflow_rsk(req);
+ if (subflow_req->mp_capable) {
+ if (TCP_SKB_CB(skb)->seq != subflow_req->ssn_offset + 1) {
+ /* here we can receive and accept an in-window,
+@@ -460,12 +463,11 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
+ if (!new_msk)
+ fallback = true;
+ } else if (subflow_req->mp_join) {
+- fallback_is_fatal = true;
+ mptcp_get_options(skb, &mp_opt);
+ if (!mp_opt.mp_join ||
+ !subflow_hmac_valid(req, &mp_opt)) {
+ SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKMAC);
+- return NULL;
++ fallback = true;
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 1fb48a8a4a30056ec19efa35b7516bbca684edcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 May 2020 08:53:17 +0800
+Subject: net: enetc: add hw tc hw offload features for PSPF capability
+
+From: Po Liu <Po.Liu@nxp.com>
+
+[ Upstream commit 79e499829f3ff5b8f70c87baf1b03ebb3401a3e4 ]
+
+This patch is to let ethtool enable/disable the tc flower offload
+features. Hardware ENETC has the feature of PSFP which is for per-stream
+policing. When enable the tc hw offloading feature, driver would enable
+the IEEE 802.1Qci feature. It is only set the register enable bit for
+this feature not enable for any entry of per stream filtering and stream
+gate or stream identify but get how much capabilities for each feature.
+
+Signed-off-by: Po Liu <Po.Liu@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc.c | 23 +++++++++
+ drivers/net/ethernet/freescale/enetc/enetc.h | 48 +++++++++++++++++++
+ .../net/ethernet/freescale/enetc/enetc_hw.h | 17 +++++++
+ .../net/ethernet/freescale/enetc/enetc_pf.c | 8 ++++
+ 4 files changed, 96 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
+index 4486a0db8ef0c..9ac5cccfe0204 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc.c
+@@ -756,6 +756,9 @@ void enetc_get_si_caps(struct enetc_si *si)
+
+ if (val & ENETC_SIPCAPR0_QBV)
+ si->hw_features |= ENETC_SI_F_QBV;
++
++ if (val & ENETC_SIPCAPR0_PSFP)
++ si->hw_features |= ENETC_SI_F_PSFP;
+ }
+
+ static int enetc_dma_alloc_bdr(struct enetc_bdr *r, size_t bd_size)
+@@ -1567,6 +1570,23 @@ static int enetc_set_rss(struct net_device *ndev, int en)
+ return 0;
+ }
+
++static int enetc_set_psfp(struct net_device *ndev, int en)
++{
++ struct enetc_ndev_priv *priv = netdev_priv(ndev);
++
++ if (en) {
++ priv->active_offloads |= ENETC_F_QCI;
++ enetc_get_max_cap(priv);
++ enetc_psfp_enable(&priv->si->hw);
++ } else {
++ priv->active_offloads &= ~ENETC_F_QCI;
++ memset(&priv->psfp_cap, 0, sizeof(struct psfp_cap));
++ enetc_psfp_disable(&priv->si->hw);
++ }
++
++ return 0;
++}
++
+ int enetc_set_features(struct net_device *ndev,
+ netdev_features_t features)
+ {
+@@ -1575,6 +1595,9 @@ int enetc_set_features(struct net_device *ndev,
+ if (changed & NETIF_F_RXHASH)
+ enetc_set_rss(ndev, !!(features & NETIF_F_RXHASH));
+
++ if (changed & NETIF_F_HW_TC)
++ enetc_set_psfp(ndev, !!(features & NETIF_F_HW_TC));
++
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h
+index 56c43f35b633b..2cfe877c37786 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc.h
+@@ -151,6 +151,7 @@ enum enetc_errata {
+ };
+
+ #define ENETC_SI_F_QBV BIT(0)
++#define ENETC_SI_F_PSFP BIT(1)
+
+ /* PCI IEP device data */
+ struct enetc_si {
+@@ -203,12 +204,20 @@ struct enetc_cls_rule {
+ };
+
+ #define ENETC_MAX_BDR_INT 2 /* fixed to max # of available cpus */
++struct psfp_cap {
++ u32 max_streamid;
++ u32 max_psfp_filter;
++ u32 max_psfp_gate;
++ u32 max_psfp_gatelist;
++ u32 max_psfp_meter;
++};
+
+ /* TODO: more hardware offloads */
+ enum enetc_active_offloads {
+ ENETC_F_RX_TSTAMP = BIT(0),
+ ENETC_F_TX_TSTAMP = BIT(1),
+ ENETC_F_QBV = BIT(2),
++ ENETC_F_QCI = BIT(3),
+ };
+
+ struct enetc_ndev_priv {
+@@ -231,6 +240,8 @@ struct enetc_ndev_priv {
+
+ struct enetc_cls_rule *cls_rules;
+
++ struct psfp_cap psfp_cap;
++
+ struct device_node *phy_node;
+ phy_interface_t if_mode;
+ };
+@@ -289,9 +300,46 @@ int enetc_setup_tc_taprio(struct net_device *ndev, void *type_data);
+ void enetc_sched_speed_set(struct net_device *ndev);
+ int enetc_setup_tc_cbs(struct net_device *ndev, void *type_data);
+ int enetc_setup_tc_txtime(struct net_device *ndev, void *type_data);
++
++static inline void enetc_get_max_cap(struct enetc_ndev_priv *priv)
++{
++ u32 reg;
++
++ reg = enetc_port_rd(&priv->si->hw, ENETC_PSIDCAPR);
++ priv->psfp_cap.max_streamid = reg & ENETC_PSIDCAPR_MSK;
++ /* Port stream filter capability */
++ reg = enetc_port_rd(&priv->si->hw, ENETC_PSFCAPR);
++ priv->psfp_cap.max_psfp_filter = reg & ENETC_PSFCAPR_MSK;
++ /* Port stream gate capability */
++ reg = enetc_port_rd(&priv->si->hw, ENETC_PSGCAPR);
++ priv->psfp_cap.max_psfp_gate = (reg & ENETC_PSGCAPR_SGIT_MSK);
++ priv->psfp_cap.max_psfp_gatelist = (reg & ENETC_PSGCAPR_GCL_MSK) >> 16;
++ /* Port flow meter capability */
++ reg = enetc_port_rd(&priv->si->hw, ENETC_PFMCAPR);
++ priv->psfp_cap.max_psfp_meter = reg & ENETC_PFMCAPR_MSK;
++}
++
++static inline void enetc_psfp_enable(struct enetc_hw *hw)
++{
++ enetc_wr(hw, ENETC_PPSFPMR, enetc_rd(hw, ENETC_PPSFPMR) |
++ ENETC_PPSFPMR_PSFPEN | ENETC_PPSFPMR_VS |
++ ENETC_PPSFPMR_PVC | ENETC_PPSFPMR_PVZC);
++}
++
++static inline void enetc_psfp_disable(struct enetc_hw *hw)
++{
++ enetc_wr(hw, ENETC_PPSFPMR, enetc_rd(hw, ENETC_PPSFPMR) &
++ ~ENETC_PPSFPMR_PSFPEN & ~ENETC_PPSFPMR_VS &
++ ~ENETC_PPSFPMR_PVC & ~ENETC_PPSFPMR_PVZC);
++}
+ #else
+ #define enetc_setup_tc_taprio(ndev, type_data) -EOPNOTSUPP
+ #define enetc_sched_speed_set(ndev) (void)0
+ #define enetc_setup_tc_cbs(ndev, type_data) -EOPNOTSUPP
+ #define enetc_setup_tc_txtime(ndev, type_data) -EOPNOTSUPP
++#define enetc_get_max_cap(p) \
++ memset(&((p)->psfp_cap), 0, sizeof(struct psfp_cap))
++
++#define enetc_psfp_enable(hw) (void)0
++#define enetc_psfp_disable(hw) (void)0
+ #endif
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+index 2a6523136947d..587974862f488 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+@@ -19,6 +19,7 @@
+ #define ENETC_SICTR1 0x1c
+ #define ENETC_SIPCAPR0 0x20
+ #define ENETC_SIPCAPR0_QBV BIT(4)
++#define ENETC_SIPCAPR0_PSFP BIT(9)
+ #define ENETC_SIPCAPR0_RSS BIT(8)
+ #define ENETC_SIPCAPR1 0x24
+ #define ENETC_SITGTGR 0x30
+@@ -228,6 +229,15 @@ enum enetc_bdr_type {TX, RX};
+ #define ENETC_PM0_IFM_RLP (BIT(5) | BIT(11))
+ #define ENETC_PM0_IFM_RGAUTO (BIT(15) | ENETC_PMO_IFM_RG | BIT(1))
+ #define ENETC_PM0_IFM_XGMII BIT(12)
++#define ENETC_PSIDCAPR 0x1b08
++#define ENETC_PSIDCAPR_MSK GENMASK(15, 0)
++#define ENETC_PSFCAPR 0x1b18
++#define ENETC_PSFCAPR_MSK GENMASK(15, 0)
++#define ENETC_PSGCAPR 0x1b28
++#define ENETC_PSGCAPR_GCL_MSK GENMASK(18, 16)
++#define ENETC_PSGCAPR_SGIT_MSK GENMASK(15, 0)
++#define ENETC_PFMCAPR 0x1b38
++#define ENETC_PFMCAPR_MSK GENMASK(15, 0)
+
+ /* MAC counters */
+ #define ENETC_PM0_REOCT 0x8100
+@@ -621,3 +631,10 @@ struct enetc_cbd {
+ /* Port time specific departure */
+ #define ENETC_PTCTSDR(n) (0x1210 + 4 * (n))
+ #define ENETC_TSDE BIT(31)
++
++/* PSFP setting */
++#define ENETC_PPSFPMR 0x11b00
++#define ENETC_PPSFPMR_PSFPEN BIT(0)
++#define ENETC_PPSFPMR_VS BIT(1)
++#define ENETC_PPSFPMR_PVC BIT(2)
++#define ENETC_PPSFPMR_PVZC BIT(3)
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+index 85e2b741df414..eacd597b55f22 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+@@ -739,6 +739,14 @@ static void enetc_pf_netdev_setup(struct enetc_si *si, struct net_device *ndev,
+ if (si->hw_features & ENETC_SI_F_QBV)
+ priv->active_offloads |= ENETC_F_QBV;
+
++ if (si->hw_features & ENETC_SI_F_PSFP) {
++ priv->active_offloads |= ENETC_F_QCI;
++ ndev->features |= NETIF_F_HW_TC;
++ ndev->hw_features |= NETIF_F_HW_TC;
++ enetc_get_max_cap(priv);
++ enetc_psfp_enable(&si->hw);
++ }
++
+ /* pick up primary MAC address from SI */
+ enetc_get_primary_mac_addr(&si->hw, ndev->dev_addr);
+ }
+--
+2.25.1
+
--- /dev/null
+From 14afb49cf00c95d3a499e1919f4b946b676783af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jul 2017 16:35:15 -0400
+Subject: nfsd: clients don't need to break their own delegations
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit 28df3d1539de5090f7916f6fff03891b67f366f4 ]
+
+We currently revoke read delegations on any write open or any operation
+that modifies file data or metadata (including rename, link, and
+unlink). But if the delegation in question is the only read delegation
+and is held by the client performing the operation, that's not really
+necessary.
+
+It's not always possible to prevent this in the NFSv4.0 case, because
+there's not always a way to determine which client an NFSv4.0 delegation
+came from. (In theory we could try to guess this from the transport
+layer, e.g., by assuming all traffic on a given TCP connection comes
+from the same client. But that's not really correct.)
+
+In the NFSv4.1 case the session layer always tells us the client.
+
+This patch should remove such self-conflicts in all cases where we can
+reliably determine the client from the compound.
+
+To do that we need to track "who" is performing a given (possibly
+lease-breaking) file operation. We're doing that by storing the
+information in the svc_rqst and using kthread_data() to map the current
+task back to a svc_rqst.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/filesystems/locking.rst | 2 ++
+ fs/locks.c | 3 +++
+ fs/nfsd/nfs4proc.c | 2 ++
+ fs/nfsd/nfs4state.c | 14 ++++++++++++++
+ fs/nfsd/nfsd.h | 2 ++
+ fs/nfsd/nfssvc.c | 6 ++++++
+ include/linux/fs.h | 1 +
+ include/linux/sunrpc/svc.h | 1 +
+ 8 files changed, 31 insertions(+)
+
+diff --git a/Documentation/filesystems/locking.rst b/Documentation/filesystems/locking.rst
+index 5057e4d9dcd1d..9fdcec4166142 100644
+--- a/Documentation/filesystems/locking.rst
++++ b/Documentation/filesystems/locking.rst
+@@ -425,6 +425,7 @@ prototypes::
+ int (*lm_grant)(struct file_lock *, struct file_lock *, int);
+ void (*lm_break)(struct file_lock *); /* break_lease callback */
+ int (*lm_change)(struct file_lock **, int);
++ bool (*lm_breaker_owns_lease)(struct file_lock *);
+
+ locking rules:
+
+@@ -435,6 +436,7 @@ lm_notify: yes yes no
+ lm_grant: no no no
+ lm_break: yes no no
+ lm_change yes no no
++lm_breaker_owns_lease: no no no
+ ========== ============= ================= =========
+
+ buffer_head
+diff --git a/fs/locks.c b/fs/locks.c
+index b8a31c1c4fff3..a3f186846e93e 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -1557,6 +1557,9 @@ static bool leases_conflict(struct file_lock *lease, struct file_lock *breaker)
+ {
+ bool rc;
+
++ if (lease->fl_lmops->lm_breaker_owns_lease
++ && lease->fl_lmops->lm_breaker_owns_lease(lease))
++ return false;
+ if ((breaker->fl_flags & FL_LAYOUT) != (lease->fl_flags & FL_LAYOUT)) {
+ rc = false;
+ goto trace;
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 0e75f7fb5fec0..a6d73aa51ce4e 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -2302,6 +2302,8 @@ nfsd4_proc_compound(struct svc_rqst *rqstp)
+ }
+ check_if_stalefh_allowed(args);
+
++ rqstp->rq_lease_breaker = (void **)&cstate->clp;
++
+ trace_nfsd_compound(rqstp, args->opcnt);
+ while (!status && resp->opcnt < args->opcnt) {
+ op = &args->ops[resp->opcnt++];
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index c107caa565254..f71e5590967bb 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -4522,6 +4522,19 @@ nfsd_break_deleg_cb(struct file_lock *fl)
+ return ret;
+ }
+
++static bool nfsd_breaker_owns_lease(struct file_lock *fl)
++{
++ struct nfs4_delegation *dl = fl->fl_owner;
++ struct svc_rqst *rqst;
++ struct nfs4_client *clp;
++
++ if (!i_am_nfsd())
++ return NULL;
++ rqst = kthread_data(current);
++ clp = *(rqst->rq_lease_breaker);
++ return dl->dl_stid.sc_client == clp;
++}
++
+ static int
+ nfsd_change_deleg_cb(struct file_lock *onlist, int arg,
+ struct list_head *dispose)
+@@ -4533,6 +4546,7 @@ nfsd_change_deleg_cb(struct file_lock *onlist, int arg,
+ }
+
+ static const struct lock_manager_operations nfsd_lease_mng_ops = {
++ .lm_breaker_owns_lease = nfsd_breaker_owns_lease,
+ .lm_break = nfsd_break_deleg_cb,
+ .lm_change = nfsd_change_deleg_cb,
+ };
+diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h
+index 2ab5569126b8a..36cdd81b6688a 100644
+--- a/fs/nfsd/nfsd.h
++++ b/fs/nfsd/nfsd.h
+@@ -88,6 +88,8 @@ int nfsd_pool_stats_release(struct inode *, struct file *);
+
+ void nfsd_destroy(struct net *net);
+
++bool i_am_nfsd(void);
++
+ struct nfsdfs_client {
+ struct kref cl_ref;
+ void (*cl_release)(struct kref *kref);
+diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
+index ca9fd348548b8..4f588c0eaaf44 100644
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -601,6 +601,11 @@ static const struct svc_serv_ops nfsd_thread_sv_ops = {
+ .svo_module = THIS_MODULE,
+ };
+
++bool i_am_nfsd()
++{
++ return kthread_func(current) == nfsd;
++}
++
+ int nfsd_create_serv(struct net *net)
+ {
+ int error;
+@@ -1011,6 +1016,7 @@ nfsd_dispatch(struct svc_rqst *rqstp, __be32 *statp)
+ *statp = rpc_garbage_args;
+ return 1;
+ }
++ rqstp->rq_lease_breaker = NULL;
+ /*
+ * Give the xdr decoder a chance to change this if it wants
+ * (necessary in the NFSv4.0 compound case)
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 45cc10cdf6ddd..70a0ac7b8f66a 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -1045,6 +1045,7 @@ struct lock_manager_operations {
+ bool (*lm_break)(struct file_lock *);
+ int (*lm_change)(struct file_lock *, int, struct list_head *);
+ void (*lm_setup)(struct file_lock *, void **);
++ bool (*lm_breaker_owns_lease)(struct file_lock *);
+ };
+
+ struct lock_manager {
+diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
+index fd390894a5849..abf4a57ce4a7d 100644
+--- a/include/linux/sunrpc/svc.h
++++ b/include/linux/sunrpc/svc.h
+@@ -299,6 +299,7 @@ struct svc_rqst {
+ struct net *rq_bc_net; /* pointer to backchannel's
+ * net namespace
+ */
++ void ** rq_lease_breaker; /* The v4 client breaking a lease */
+ };
+
+ #define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
+--
+2.25.1
+
--- /dev/null
+From 7eebfe411aaf1780e977cd7235a39320ac9834f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jun 2020 21:01:19 -0400
+Subject: nfsd: fix nfsdfs inode reference count leak
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit bf2654017e0268cc83dc88d56f0e67ff4406631d ]
+
+I don't understand this code well, but I'm seeing a warning about a
+still-referenced inode on unmount, and every other similar filesystem
+does a dput() here.
+
+Fixes: e8a79fb14f6b ("nfsd: add nfsd/clients directory")
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfsctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
+index 9b22d857549c3..f298aad41070f 100644
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -1335,6 +1335,7 @@ void nfsd_client_rmdir(struct dentry *dentry)
+ WARN_ON_ONCE(ret);
+ fsnotify_rmdir(dir, dentry);
+ d_delete(dentry);
++ dput(dentry);
+ inode_unlock(dir);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From b706c5495fc492b4d72fece8d8f78a5e2102a8a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jun 2020 16:00:33 -0400
+Subject: nfsd4: fix nfsdfs reference count loop
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit 681370f4b00af0fcc65bbfb9f82de526ab7ceb0a ]
+
+We don't drop the reference on the nfsdfs filesystem with
+mntput(nn->nfsd_mnt) until nfsd_exit_net(), but that won't be called
+until the nfsd module's unloaded, and we can't unload the module as long
+as there's a reference on nfsdfs. So this prevents module unloading.
+
+Fixes: 2c830dd7209b ("nfsd: persist nfsd filesystem across mounts")
+Reported-and-Tested-by: Luo Xiaogang <lxgrxd@163.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 8 +++++++-
+ fs/nfsd/nfsctl.c | 22 ++++++++++++----------
+ fs/nfsd/nfsd.h | 3 +++
+ 3 files changed, 22 insertions(+), 11 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index f71e5590967bb..95e459a1dd7dc 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -7873,9 +7873,14 @@ nfs4_state_start_net(struct net *net)
+ struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+ int ret;
+
+- ret = nfs4_state_create_net(net);
++ ret = get_nfsdfs(net);
+ if (ret)
+ return ret;
++ ret = nfs4_state_create_net(net);
++ if (ret) {
++ mntput(nn->nfsd_mnt);
++ return ret;
++ }
+ locks_start_grace(net, &nn->nfsd4_manager);
+ nfsd4_client_tracking_init(net);
+ if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0)
+@@ -7944,6 +7949,7 @@ nfs4_state_shutdown_net(struct net *net)
+
+ nfsd4_client_tracking_exit(net);
+ nfs4_state_destroy_net(net);
++ mntput(nn->nfsd_mnt);
+ }
+
+ void
+diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
+index 71687d99b0901..9b22d857549c3 100644
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -1424,6 +1424,18 @@ static struct file_system_type nfsd_fs_type = {
+ };
+ MODULE_ALIAS_FS("nfsd");
+
++int get_nfsdfs(struct net *net)
++{
++ struct nfsd_net *nn = net_generic(net, nfsd_net_id);
++ struct vfsmount *mnt;
++
++ mnt = vfs_kern_mount(&nfsd_fs_type, SB_KERNMOUNT, "nfsd", NULL);
++ if (IS_ERR(mnt))
++ return PTR_ERR(mnt);
++ nn->nfsd_mnt = mnt;
++ return 0;
++}
++
+ #ifdef CONFIG_PROC_FS
+ static int create_proc_exports_entry(void)
+ {
+@@ -1451,7 +1463,6 @@ unsigned int nfsd_net_id;
+ static __net_init int nfsd_init_net(struct net *net)
+ {
+ int retval;
+- struct vfsmount *mnt;
+ struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+
+ retval = nfsd_export_init(net);
+@@ -1478,16 +1489,8 @@ static __net_init int nfsd_init_net(struct net *net)
+ init_waitqueue_head(&nn->ntf_wq);
+ seqlock_init(&nn->boot_lock);
+
+- mnt = vfs_kern_mount(&nfsd_fs_type, SB_KERNMOUNT, "nfsd", NULL);
+- if (IS_ERR(mnt)) {
+- retval = PTR_ERR(mnt);
+- goto out_mount_err;
+- }
+- nn->nfsd_mnt = mnt;
+ return 0;
+
+-out_mount_err:
+- nfsd_reply_cache_shutdown(nn);
+ out_drc_error:
+ nfsd_idmap_shutdown(net);
+ out_idmap_error:
+@@ -1500,7 +1503,6 @@ static __net_exit void nfsd_exit_net(struct net *net)
+ {
+ struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+
+- mntput(nn->nfsd_mnt);
+ nfsd_reply_cache_shutdown(nn);
+ nfsd_idmap_shutdown(net);
+ nfsd_export_shutdown(net);
+diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h
+index 36cdd81b6688a..57c832d1b30fd 100644
+--- a/fs/nfsd/nfsd.h
++++ b/fs/nfsd/nfsd.h
+@@ -90,6 +90,8 @@ void nfsd_destroy(struct net *net);
+
+ bool i_am_nfsd(void);
+
++int get_nfsdfs(struct net *);
++
+ struct nfsdfs_client {
+ struct kref cl_ref;
+ void (*cl_release)(struct kref *kref);
+@@ -100,6 +102,7 @@ struct dentry *nfsd_client_mkdir(struct nfsd_net *nn,
+ struct nfsdfs_client *ncl, u32 id, const struct tree_descr *);
+ void nfsd_client_rmdir(struct dentry *dentry);
+
++
+ #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
+ #ifdef CONFIG_NFSD_V2_ACL
+ extern const struct svc_version nfsd_acl_version2;
+--
+2.25.1
+
--- /dev/null
+From 3e1ecbf187336cdd7ce72756f83346d11e3f0efc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 16:30:19 +0200
+Subject: nvme: fix a crash in nvme_mpath_add_disk
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 72d447113bb751ded97b2e2c38f886e4a4139082 ]
+
+For private namespaces ns->head_disk is NULL, so add a NULL check
+before updating the BDI capabilities.
+
+Fixes: b2ce4d90690b ("nvme-multipath: set bdi capabilities once")
+Reported-by: Avinash M N <Avinash.M.N@wdc.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 03bc3aba09871..36db7d2e6a896 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -673,10 +673,11 @@ void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id)
+ }
+
+ if (bdi_cap_stable_pages_required(ns->queue->backing_dev_info)) {
+- struct backing_dev_info *info =
+- ns->head->disk->queue->backing_dev_info;
++ struct gendisk *disk = ns->head->disk;
+
+- info->capabilities |= BDI_CAP_STABLE_WRITES;
++ if (disk)
++ disk->queue->backing_dev_info->capabilities |=
++ BDI_CAP_STABLE_WRITES;
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From fe10fb04b35ad79c7a4288c2bc9849fc8e40312b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 10:46:29 -0700
+Subject: nvme: fix identify error status silent ignore
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit ea43d9709f727e728e933a8157a7a7ca1a868281 ]
+
+Commit 59c7c3caaaf8 intended to only silently ignore non retry-able
+errors (DNR bit set) such that we can still identify misbehaving
+controllers, and in the other hand propagate retry-able errors (DNR bit
+cleared) so we don't wrongly abandon a namespace just because it happens
+to be temporarily inaccessible.
+
+The goal remains the same as the original commit where this was
+introduced but unfortunately had the logic backwards.
+
+Fixes: 59c7c3caaaf8 ("nvme: fix possible hang when ns scanning fails during error recovery")
+Reported-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 85ce6c682849e..71d63ed62071e 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1120,10 +1120,16 @@ static int nvme_identify_ns_descs(struct nvme_ctrl *ctrl, unsigned nsid,
+ dev_warn(ctrl->device,
+ "Identify Descriptors failed (%d)\n", status);
+ /*
+- * Don't treat an error as fatal, as we potentially already
+- * have a NGUID or EUI-64.
++ * Don't treat non-retryable errors as fatal, as we potentially
++ * already have a NGUID or EUI-64. If we failed with DNR set,
++ * we want to silently ignore the error as we can still
++ * identify the device, but if the status has DNR set, we want
++ * to propagate the error back specifically for the disk
++ * revalidation flow to make sure we don't abandon the
++ * device just because of a temporal retry-able error (such
++ * as path of transport errors).
+ */
+- if (status > 0 && !(status & NVME_SC_DNR))
++ if (status > 0 && (status & NVME_SC_DNR))
+ status = 0;
+ goto free_data;
+ }
+--
+2.25.1
+
--- /dev/null
+From 24e523923ba71ac95459104e4af70aee5e16f825 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Jun 2020 14:00:00 +0300
+Subject: RDMA/counter: Query a counter before release
+
+From: Mark Zhang <markz@mellanox.com>
+
+[ Upstream commit c1d869d64a1955817c4d6fff08ecbbe8e59d36f8 ]
+
+Query a dynamically-allocated counter before release it, to update it's
+hwcounters and log all of them into history data. Otherwise all values of
+these hwcounters will be lost.
+
+Fixes: f34a55e497e8 ("RDMA/core: Get sum value of all counters when perform a sysfs stat read")
+Link: https://lore.kernel.org/r/20200621110000.56059-1-leon@kernel.org
+Signed-off-by: Mark Zhang <markz@mellanox.com>
+Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/counters.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c
+index 2257d7f7810fd..738d1faf4bba5 100644
+--- a/drivers/infiniband/core/counters.c
++++ b/drivers/infiniband/core/counters.c
+@@ -202,7 +202,7 @@ static int __rdma_counter_unbind_qp(struct ib_qp *qp)
+ return ret;
+ }
+
+-static void counter_history_stat_update(const struct rdma_counter *counter)
++static void counter_history_stat_update(struct rdma_counter *counter)
+ {
+ struct ib_device *dev = counter->device;
+ struct rdma_port_counter *port_counter;
+@@ -212,6 +212,8 @@ static void counter_history_stat_update(const struct rdma_counter *counter)
+ if (!port_counter->hstats)
+ return;
+
++ rdma_counter_query_stats(counter);
++
+ for (i = 0; i < counter->stats->num_counters; i++)
+ port_counter->hstats->value[i] += counter->stats->value[i];
+ }
+--
+2.25.1
+
--- /dev/null
+From c54d0d54d8e3a55e79da6de3e8928fd10434ab8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 15:46:33 +0100
+Subject: rxrpc: Fix afs large storage transmission performance drop
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 02c28dffb13abbaaedece1e4a6493b48ad3f913a ]
+
+Commit 2ad6691d988c, which moved the modification of the status annotation
+for a packet in the Tx buffer prior to the retransmission moved the state
+clearance, but managed to lose the bit that set it to UNACK.
+
+Consequently, if a retransmission occurs, the packet is accidentally
+changed to the ACK state (ie. 0) by masking it off, which means that the
+packet isn't counted towards the tally of newly-ACK'd packets if it gets
+hard-ACK'd. This then prevents the congestion control algorithm from
+recovering properly.
+
+Fix by reinstating the change of state to UNACK.
+
+Spotted by the generic/460 xfstest.
+
+Fixes: 2ad6691d988c ("rxrpc: Fix race between incoming ACK parser and retransmitter")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/call_event.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
+index 985fb89202d0c..9ff85ee8337cd 100644
+--- a/net/rxrpc/call_event.c
++++ b/net/rxrpc/call_event.c
+@@ -253,7 +253,7 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
+ * confuse things
+ */
+ annotation &= ~RXRPC_TX_ANNO_MASK;
+- annotation |= RXRPC_TX_ANNO_RESENT;
++ annotation |= RXRPC_TX_ANNO_UNACK | RXRPC_TX_ANNO_RESENT;
+ call->rxtx_annotations[ix] = annotation;
+
+ skb = call->rxtx_buffer[ix];
+--
+2.25.1
+
--- /dev/null
+From 597a4360a65d885fcf2227c8172c6176ecc711df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 15:15:21 -0700
+Subject: samples/vfs: avoid warning in statx override
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit c3eeaae9fd736b7f2afbda8d3cbb1cbae06decf3 ]
+
+Something changed recently to uncover this warning:
+
+ samples/vfs/test-statx.c:24:15: warning: `struct foo' declared inside parameter list will not be visible outside of this definition or declaration
+ 24 | #define statx foo
+ | ^~~
+
+Which is due the use of "struct statx" (here, "struct foo") in a function
+prototype argument list before it has been defined:
+
+ int
+ # 56 "/usr/include/x86_64-linux-gnu/bits/statx-generic.h"
+ foo
+ # 56 "/usr/include/x86_64-linux-gnu/bits/statx-generic.h" 3 4
+ (int __dirfd, const char *__restrict __path, int __flags,
+ unsigned int __mask, struct
+ # 57 "/usr/include/x86_64-linux-gnu/bits/statx-generic.h"
+ foo
+ # 57 "/usr/include/x86_64-linux-gnu/bits/statx-generic.h" 3 4
+ *__restrict __buf)
+ __attribute__ ((__nothrow__ , __leaf__)) __attribute__ ((__nonnull__ (2, 5)));
+
+Add explicit struct before #include to avoid warning.
+
+Fixes: f1b5618e013a ("vfs: Add a sample program for the new mount API")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Miklos Szeredi <mszeredi@redhat.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: David Howells <dhowells@redhat.com>
+Link: http://lkml.kernel.org/r/202006282213.C516EA6@keescook
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/vfs/test-statx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/samples/vfs/test-statx.c b/samples/vfs/test-statx.c
+index a3d68159fb510..507f09c38b49f 100644
+--- a/samples/vfs/test-statx.c
++++ b/samples/vfs/test-statx.c
+@@ -23,6 +23,8 @@
+ #include <linux/fcntl.h>
+ #define statx foo
+ #define statx_timestamp foo_timestamp
++struct statx;
++struct statx_timestamp;
+ #include <sys/stat.h>
+ #undef statx
+ #undef statx_timestamp
+--
+2.25.1
+
--- /dev/null
+From b581062924859ae74df526f9ac0c40bd1b77699f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 17:30:41 +0300
+Subject: scsi: qla2xxx: Fix a condition in qla2x00_find_all_fabric_devs()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 1fc98aaf7f85fadcca57c4a86ef17e1940cad2d3 ]
+
+This code doesn't make sense unless the correct "fcport" was found.
+
+Link: https://lore.kernel.org/r/20200619143041.GD267142@mwanda
+Fixes: 9dd9686b1419 ("scsi: qla2xxx: Add changes for devloss timeout in driver")
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Reviewed-by: Shyam Sundar <ssundar@marvell.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index caa6b840e4594..cfbb4294fb8bb 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -5933,7 +5933,7 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha)
+ break;
+ }
+
+- if (NVME_TARGET(vha->hw, fcport)) {
++ if (found && NVME_TARGET(vha->hw, fcport)) {
+ if (fcport->disc_state == DSC_DELETE_PEND) {
+ qla2x00_set_fcport_disc_state(fcport, DSC_GNL);
+ vha->fcport_count--;
+--
+2.25.1
+
--- /dev/null
+From e51e64309f0219e2a271d385c004216de86f9f5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jun 2020 00:21:35 +0200
+Subject: security: Fix hook iteration and default value for
+ inode_copy_up_xattr
+
+From: KP Singh <kpsingh@google.com>
+
+[ Upstream commit 23e390cdbe6f85827a43d38f9288dcd3066fa376 ]
+
+inode_copy_up_xattr returns 0 to indicate the acceptance of the xattr
+and 1 to reject it. If the LSM does not know about the xattr, it's
+expected to return -EOPNOTSUPP, which is the correct default value for
+this hook. BPF LSM, currently, uses 0 as the default value and thereby
+falsely allows all overlay fs xattributes to be copied up.
+
+The iteration logic is also updated from the "bail-on-fail"
+call_int_hook to continue on the non-decisive -EOPNOTSUPP and bail out
+on other values.
+
+Fixes: 98e828a0650f ("security: Refactor declaration of LSM hooks")
+Signed-off-by: KP Singh <kpsingh@google.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/lsm_hook_defs.h | 2 +-
+ security/security.c | 17 ++++++++++++++++-
+ 2 files changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
+index 5616b2567aa7f..c2d073c49bf8a 100644
+--- a/include/linux/lsm_hook_defs.h
++++ b/include/linux/lsm_hook_defs.h
+@@ -149,7 +149,7 @@ LSM_HOOK(int, 0, inode_listsecurity, struct inode *inode, char *buffer,
+ size_t buffer_size)
+ LSM_HOOK(void, LSM_RET_VOID, inode_getsecid, struct inode *inode, u32 *secid)
+ LSM_HOOK(int, 0, inode_copy_up, struct dentry *src, struct cred **new)
+-LSM_HOOK(int, 0, inode_copy_up_xattr, const char *name)
++LSM_HOOK(int, -EOPNOTSUPP, inode_copy_up_xattr, const char *name)
+ LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir,
+ struct kernfs_node *kn)
+ LSM_HOOK(int, 0, file_permission, struct file *file, int mask)
+diff --git a/security/security.c b/security/security.c
+index 51de970fbb1ed..8b4d342ade5e1 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -1409,7 +1409,22 @@ EXPORT_SYMBOL(security_inode_copy_up);
+
+ int security_inode_copy_up_xattr(const char *name)
+ {
+- return call_int_hook(inode_copy_up_xattr, -EOPNOTSUPP, name);
++ struct security_hook_list *hp;
++ int rc;
++
++ /*
++ * The implementation can return 0 (accept the xattr), 1 (discard the
++ * xattr), -EOPNOTSUPP if it does not know anything about the xattr or
++ * any other error code incase of an error.
++ */
++ hlist_for_each_entry(hp,
++ &security_hook_heads.inode_copy_up_xattr, list) {
++ rc = hp->hook.inode_copy_up_xattr(name);
++ if (rc != LSM_RET_DEFAULT(inode_copy_up_xattr))
++ return rc;
++ }
++
++ return LSM_RET_DEFAULT(inode_copy_up_xattr);
+ }
+ EXPORT_SYMBOL(security_inode_copy_up_xattr);
+
+--
+2.25.1
+
crypto-af_alg-fix-use-after-free-in-af_alg_accept-due-to-bh_lock_sock.patch
task_work-teach-task_work_add-to-do-signal_wake_up.patch
io_uring-use-signal-based-task_work-running.patch
+drm-msm-dpu-fix-error-return-code-in-dpu_encoder_ini.patch
+btrfs-fix-rwf_nowait-writes-blocking-on-extent-locks.patch
+rxrpc-fix-afs-large-storage-transmission-performance.patch
+mptcp-drop-mp_join-request-sock-on-syn-cookies.patch
+net-enetc-add-hw-tc-hw-offload-features-for-pspf-cap.patch
+enetc-fix-hw_vlan_ctag_tx-rx-toggling.patch
+irqchip-gic-v4.1-use-readx_poll_timeout_atomic-to-fi.patch
+rdma-counter-query-a-counter-before-release.patch
+xfs-fix-use-after-free-on-cil-context-on-shutdown.patch
+hsr-remove-hsr-interface-if-all-slaves-are-removed.patch
+hsr-avoid-to-create-proc-file-after-unregister.patch
+cxgb4-use-unaligned-conversion-for-fetching-timestam.patch
+cxgb4-parse-tc-u32-key-values-and-masks-natively.patch
+cxgb4-fix-endian-conversions-for-l4-ports-in-filters.patch
+cxgb4-use-correct-type-for-all-mask-ip-address-compa.patch
+cxgb4-fix-sge-queue-dump-destination-buffer-context.patch
+security-fix-hook-iteration-and-default-value-for-in.patch
+hwmon-max6697-make-sure-the-overt-mask-is-set-correc.patch
+hwmon-acpi_power_meter-fix-potential-memory-leak-in-.patch
+scsi-qla2xxx-fix-a-condition-in-qla2x00_find_all_fab.patch
+thermal-drivers-mediatek-fix-bank-number-settings-on.patch
+thermal-drivers-sprd-fix-return-value-of-sprd_thm_pr.patch
+thermal-drivers-rcar_gen3-fix-undefined-temperature-.patch
+kthread-save-thread-function.patch
+nfsd-clients-don-t-need-to-break-their-own-delegatio.patch
+nfsd4-fix-nfsdfs-reference-count-loop.patch
+nfsd-fix-nfsdfs-inode-reference-count-leak.patch
+drm-sun4i-hdmi-remove-extra-hpd-polling.patch
+virtio-blk-free-vblk-vqs-in-error-path-of-virtblk_pr.patch
+smb3-honor-posix-flag-for-multiuser-mounts.patch
+nvme-fix-identify-error-status-silent-ignore.patch
+nvme-fix-a-crash-in-nvme_mpath_add_disk.patch
+tpm-ibmvtpm-wait-for-ready-buffer-before-probing-for.patch
+samples-vfs-avoid-warning-in-statx-override.patch
+i2c-algo-pca-add-0x78-as-scl-stuck-low-status-for-pc.patch
+i2c-designware-platdrv-set-class-based-on-dmi.patch
+i2c-mlxcpld-check-correct-size-of-maximum-recv_len-p.patch
+io_uring-fix-regression-with-always-ignoring-signals.patch
--- /dev/null
+From 04008619c677c445cb93ac5fa8994671c2955333 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 12:58:09 -0700
+Subject: SMB3: Honor 'posix' flag for multiuser mounts
+
+From: Paul Aurich <paul@darkrain42.org>
+
+[ Upstream commit 5391b8e1b7b7e5cfa2dd4ffdc4b8c6b64dfd1866 ]
+
+The flag from the primary tcon needs to be copied into the volume info
+so that cifs_get_tcon will try to enable extensions on the per-user
+tcon. At that point, since posix extensions must have already been
+enabled on the superblock, don't try to needlessly adjust the mount
+flags.
+
+Fixes: ce558b0e17f8 ("smb3: Add posix create context for smb3.11 posix mounts")
+Fixes: b326614ea215 ("smb3: allow "posix" mount option to enable new SMB311 protocol extensions")
+Signed-off-by: Paul Aurich <paul@darkrain42.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 47b9fbb70bf5e..fd8d886e09390 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -5307,6 +5307,7 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
+ vol_info->nohandlecache = master_tcon->nohandlecache;
+ vol_info->local_lease = master_tcon->local_lease;
+ vol_info->no_linux_ext = !master_tcon->unix_ext;
++ vol_info->linux_ext = master_tcon->posix_extensions;
+ vol_info->sectype = master_tcon->ses->sectype;
+ vol_info->sign = master_tcon->ses->sign;
+
+@@ -5334,10 +5335,6 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
+ goto out;
+ }
+
+- /* if new SMB3.11 POSIX extensions are supported do not remap / and \ */
+- if (tcon->posix_extensions)
+- cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_POSIX_PATHS;
+-
+ if (cap_unix(ses))
+ reset_cifs_unix_caps(0, tcon, NULL, vol_info);
+
+--
+2.25.1
+
--- /dev/null
+From 03ac8110486bdb0f321004905109d804c69d6726 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2020 20:15:35 +0800
+Subject: thermal/drivers/mediatek: Fix bank number settings on mt8183
+
+From: Michael Kao <michael.kao@mediatek.com>
+
+[ Upstream commit 14533a5a6c12e8d7de79d309d4085bf186058fe1 ]
+
+MT8183_NUM_ZONES should be set to 1
+because MT8183 doesn't have multiple banks.
+
+Fixes: a4ffe6b52d27 ("thermal: mediatek: add support for MT8183")
+Signed-off-by: Michael Kao <michael.kao@mediatek.com>
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20200323121537.22697-6-michael.kao@mediatek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/mtk_thermal.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
+index 76e30603d4d58..6b7ef1993d7e2 100644
+--- a/drivers/thermal/mtk_thermal.c
++++ b/drivers/thermal/mtk_thermal.c
+@@ -211,6 +211,9 @@ enum {
+ /* The total number of temperature sensors in the MT8183 */
+ #define MT8183_NUM_SENSORS 6
+
++/* The number of banks in the MT8183 */
++#define MT8183_NUM_ZONES 1
++
+ /* The number of sensing points per bank */
+ #define MT8183_NUM_SENSORS_PER_ZONE 6
+
+@@ -497,7 +500,7 @@ static const struct mtk_thermal_data mt7622_thermal_data = {
+ */
+ static const struct mtk_thermal_data mt8183_thermal_data = {
+ .auxadc_channel = MT8183_TEMP_AUXADC_CHANNEL,
+- .num_banks = MT8183_NUM_SENSORS_PER_ZONE,
++ .num_banks = MT8183_NUM_ZONES,
+ .num_sensors = MT8183_NUM_SENSORS,
+ .vts_index = mt8183_vts_index,
+ .cali_val = MT8183_CALIBRATION,
+--
+2.25.1
+
--- /dev/null
+From baa5a8a9893f2781f759f8224b786ed187c02ed8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 20:38:19 +0900
+Subject: thermal/drivers/rcar_gen3: Fix undefined temperature if negative
+
+From: Dien Pham <dien.pham.ry@renesas.com>
+
+[ Upstream commit 5f8f06425a0dcdad7bedbb77e67f5c65ab4dacfc ]
+
+As description for DIV_ROUND_CLOSEST in file include/linux/kernel.h.
+ "Result is undefined for negative divisors if the dividend variable
+ type is unsigned and for negative dividends if the divisor variable
+ type is unsigned."
+
+In current code, the FIXPT_DIV uses DIV_ROUND_CLOSEST but has not
+checked sign of divisor before using. It makes undefined temperature
+value in case the value is negative.
+
+This patch fixes to satisfy DIV_ROUND_CLOSEST description
+and fix bug too. Note that the variable name "reg" is not good
+because it should be the same type as rcar_gen3_thermal_read().
+However, it's better to rename the "reg" in a further patch as
+cleanup.
+
+Signed-off-by: Van Do <van.do.xw@renesas.com>
+Signed-off-by: Dien Pham <dien.pham.ry@renesas.com>
+[shimoda: minor fixes, add Fixes tag]
+Fixes: 564e73d283af ("thermal: rcar_gen3_thermal: Add R-Car Gen3 thermal driver")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Niklas Soderlund <niklas.soderlund+renesas@ragnatech.se>
+Tested-by: Niklas Soderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Amit Kucheria <amit.kucheria@linaro.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/1593085099-2057-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/rcar_gen3_thermal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/rcar_gen3_thermal.c b/drivers/thermal/rcar_gen3_thermal.c
+index 58fe7c1ef00b1..c48c5e9b8f203 100644
+--- a/drivers/thermal/rcar_gen3_thermal.c
++++ b/drivers/thermal/rcar_gen3_thermal.c
+@@ -167,7 +167,7 @@ static int rcar_gen3_thermal_get_temp(void *devdata, int *temp)
+ {
+ struct rcar_gen3_thermal_tsc *tsc = devdata;
+ int mcelsius, val;
+- u32 reg;
++ int reg;
+
+ /* Read register and convert to mili Celsius */
+ reg = rcar_gen3_thermal_read(tsc, REG_GEN3_TEMP) & CTEMP_MASK;
+--
+2.25.1
+
--- /dev/null
+From 05609e3d8f3c185e1a190731fa78f8163b1407dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 May 2020 09:59:01 +0800
+Subject: thermal/drivers/sprd: Fix return value of sprd_thm_probe()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit b4147917ad4ff2c755e01a7ca296b14030d2d507 ]
+
+When call function devm_platform_ioremap_resource(), we should use IS_ERR()
+to check the return value and return PTR_ERR() if failed.
+
+Fixes: 554fdbaf19b1 ("thermal: sprd: Add Spreadtrum thermal driver support")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Reviewed-by: Baolin Wang <baolin.wang7@gmail.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/1590371941-25430-1-git-send-email-yangtiezhu@loongson.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/sprd_thermal.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/sprd_thermal.c b/drivers/thermal/sprd_thermal.c
+index a340374e8c51a..4cde70dcf6556 100644
+--- a/drivers/thermal/sprd_thermal.c
++++ b/drivers/thermal/sprd_thermal.c
+@@ -348,8 +348,8 @@ static int sprd_thm_probe(struct platform_device *pdev)
+
+ thm->var_data = pdata;
+ thm->base = devm_platform_ioremap_resource(pdev, 0);
+- if (!thm->base)
+- return -ENOMEM;
++ if (IS_ERR(thm->base))
++ return PTR_ERR(thm->base);
+
+ thm->nr_sensors = of_get_child_count(np);
+ if (thm->nr_sensors == 0 || thm->nr_sensors > SPRD_THM_MAX_SENSOR) {
+--
+2.25.1
+
--- /dev/null
+From a557e5af059e681352793be251ed08aefa62ee08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 13:30:40 +1000
+Subject: tpm: ibmvtpm: Wait for ready buffer before probing for TPM2
+ attributes
+
+From: David Gibson <david@gibson.dropbear.id.au>
+
+[ Upstream commit 72d0556dca39f45eca6c4c085e9eb0fc70aec025 ]
+
+The tpm2_get_cc_attrs_tbl() call will result in TPM commands being issued,
+which will need the use of the internal command/response buffer. But,
+we're issuing this *before* we've waited to make sure that buffer is
+allocated.
+
+This can result in intermittent failures to probe if the hypervisor / TPM
+implementation doesn't respond quickly enough. I find it fails almost
+every time with an 8 vcpu guest under KVM with software emulated TPM.
+
+To fix it, just move the tpm2_get_cc_attrs_tlb() call after the
+existing code to wait for initialization, which will ensure the buffer
+is allocated.
+
+Fixes: 18b3670d79ae9 ("tpm: ibmvtpm: Add support for TPM2")
+Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
+Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_ibmvtpm.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
+index 09fe45246b8cc..994385bf37c0c 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -683,13 +683,6 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
+ if (rc)
+ goto init_irq_cleanup;
+
+- if (!strcmp(id->compat, "IBM,vtpm20")) {
+- chip->flags |= TPM_CHIP_FLAG_TPM2;
+- rc = tpm2_get_cc_attrs_tbl(chip);
+- if (rc)
+- goto init_irq_cleanup;
+- }
+-
+ if (!wait_event_timeout(ibmvtpm->crq_queue.wq,
+ ibmvtpm->rtce_buf != NULL,
+ HZ)) {
+@@ -697,6 +690,13 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
+ goto init_irq_cleanup;
+ }
+
++ if (!strcmp(id->compat, "IBM,vtpm20")) {
++ chip->flags |= TPM_CHIP_FLAG_TPM2;
++ rc = tpm2_get_cc_attrs_tbl(chip);
++ if (rc)
++ goto init_irq_cleanup;
++ }
++
+ return tpm_chip_register(chip);
+ init_irq_cleanup:
+ do {
+--
+2.25.1
+
--- /dev/null
+From 9ef618a6db3e0c6be6ec803b8ab857699e767ae8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 12:14:59 +0800
+Subject: virtio-blk: free vblk-vqs in error path of virtblk_probe()
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit e7eea44eefbdd5f0345a0a8b80a3ca1c21030d06 ]
+
+Else there will be memory leak if alloc_disk() fails.
+
+Fixes: 6a27b656fc02 ("block: virtio-blk: support multi virt queues per virtio-blk device")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/virtio_blk.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 9d21bf0f155ee..980df853ee497 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -878,6 +878,7 @@ static int virtblk_probe(struct virtio_device *vdev)
+ put_disk(vblk->disk);
+ out_free_vq:
+ vdev->config->del_vqs(vdev);
++ kfree(vblk->vqs);
+ out_free_vblk:
+ kfree(vblk);
+ out_free_index:
+--
+2.25.1
+
--- /dev/null
+From 7db2c9a4f24742ea1dd3f3ba666e939d83547b23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2020 08:57:43 -0700
+Subject: xfs: fix use-after-free on CIL context on shutdown
+
+From: Dave Chinner <dchinner@redhat.com>
+
+[ Upstream commit c7f87f3984cfa1e6d32806a715f35c5947ad9c09 ]
+
+xlog_wait() on the CIL context can reference a freed context if the
+waiter doesn't get scheduled before the CIL context is freed. This
+can happen when a task is on the hard throttle and the CIL push
+aborts due to a shutdown. This was detected by generic/019:
+
+thread 1 thread 2
+
+__xfs_trans_commit
+ xfs_log_commit_cil
+ <CIL size over hard throttle limit>
+ xlog_wait
+ schedule
+ xlog_cil_push_work
+ wake_up_all
+ <shutdown aborts commit>
+ xlog_cil_committed
+ kmem_free
+
+ remove_wait_queue
+ spin_lock_irqsave --> UAF
+
+Fix it by moving the wait queue to the CIL rather than keeping it in
+in the CIL context that gets freed on push completion. Because the
+wait queue is now independent of the CIL context and we might have
+multiple contexts in flight at once, only wake the waiters on the
+push throttle when the context we are pushing is over the hard
+throttle size threshold.
+
+Fixes: 0e7ab7efe7745 ("xfs: Throttle commits on delayed background CIL push")
+Reported-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_log_cil.c | 10 +++++-----
+ fs/xfs/xfs_log_priv.h | 2 +-
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
+index b43f0e8f43f2e..9ed90368ab311 100644
+--- a/fs/xfs/xfs_log_cil.c
++++ b/fs/xfs/xfs_log_cil.c
+@@ -671,7 +671,8 @@ xlog_cil_push_work(
+ /*
+ * Wake up any background push waiters now this context is being pushed.
+ */
+- wake_up_all(&ctx->push_wait);
++ if (ctx->space_used >= XLOG_CIL_BLOCKING_SPACE_LIMIT(log))
++ wake_up_all(&cil->xc_push_wait);
+
+ /*
+ * Check if we've anything to push. If there is nothing, then we don't
+@@ -743,13 +744,12 @@ xlog_cil_push_work(
+
+ /*
+ * initialise the new context and attach it to the CIL. Then attach
+- * the current context to the CIL committing lsit so it can be found
++ * the current context to the CIL committing list so it can be found
+ * during log forces to extract the commit lsn of the sequence that
+ * needs to be forced.
+ */
+ INIT_LIST_HEAD(&new_ctx->committing);
+ INIT_LIST_HEAD(&new_ctx->busy_extents);
+- init_waitqueue_head(&new_ctx->push_wait);
+ new_ctx->sequence = ctx->sequence + 1;
+ new_ctx->cil = cil;
+ cil->xc_ctx = new_ctx;
+@@ -937,7 +937,7 @@ xlog_cil_push_background(
+ if (cil->xc_ctx->space_used >= XLOG_CIL_BLOCKING_SPACE_LIMIT(log)) {
+ trace_xfs_log_cil_wait(log, cil->xc_ctx->ticket);
+ ASSERT(cil->xc_ctx->space_used < log->l_logsize);
+- xlog_wait(&cil->xc_ctx->push_wait, &cil->xc_push_lock);
++ xlog_wait(&cil->xc_push_wait, &cil->xc_push_lock);
+ return;
+ }
+
+@@ -1216,12 +1216,12 @@ xlog_cil_init(
+ INIT_LIST_HEAD(&cil->xc_committing);
+ spin_lock_init(&cil->xc_cil_lock);
+ spin_lock_init(&cil->xc_push_lock);
++ init_waitqueue_head(&cil->xc_push_wait);
+ init_rwsem(&cil->xc_ctx_lock);
+ init_waitqueue_head(&cil->xc_commit_wait);
+
+ INIT_LIST_HEAD(&ctx->committing);
+ INIT_LIST_HEAD(&ctx->busy_extents);
+- init_waitqueue_head(&ctx->push_wait);
+ ctx->sequence = 1;
+ ctx->cil = cil;
+ cil->xc_ctx = ctx;
+diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h
+index ec22c7a3867f1..75a62870b63af 100644
+--- a/fs/xfs/xfs_log_priv.h
++++ b/fs/xfs/xfs_log_priv.h
+@@ -240,7 +240,6 @@ struct xfs_cil_ctx {
+ struct xfs_log_vec *lv_chain; /* logvecs being pushed */
+ struct list_head iclog_entry;
+ struct list_head committing; /* ctx committing list */
+- wait_queue_head_t push_wait; /* background push throttle */
+ struct work_struct discard_endio_work;
+ };
+
+@@ -274,6 +273,7 @@ struct xfs_cil {
+ wait_queue_head_t xc_commit_wait;
+ xfs_lsn_t xc_current_sequence;
+ struct work_struct xc_push_work;
++ wait_queue_head_t xc_push_wait; /* background push throttle */
+ } ____cacheline_aligned_in_smp;
+
+ /*
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
