--- /dev/null
+From 45c4e3b0b07c06237da188666eeec1d9223da10f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jul 2021 09:35:23 +0100
+Subject: arm64: dts: qcom: c630: fix correct powerdown pin for WSA881x
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 9a253bb42f190efd1a1c156939ad7298b3529dca ]
+
+WSA881x powerdown pin is connected to GPIO1, GPIO2 not GPIO2 and GPIO3,
+so correct this. This was working so far due to a shift bug in gpio driver,
+however once that is fixed this will stop working, so fix this!
+
+For some reason we forgot to add this dts change in last merge cycle so
+currently audio is broken in 5.13 as the gpio driver fix already landed
+in 5.13.
+
+Reported-by: Shawn Guo <shawnguo@kernel.org>
+Fixes: 45021d35fcb2 ("arm64: dts: qcom: c630: Enable audio support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Tested-by: Shawn Guo <shawnguo@kernel.org>
+Link: https://lore.kernel.org/r/20210706083523.10601-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+index 888dc23a530e..ad6561843ba2 100644
+--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
++++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+@@ -564,7 +564,7 @@
+ left_spkr: wsa8810-left{
+ compatible = "sdw10217211000";
+ reg = <0 3>;
+- powerdown-gpios = <&wcdgpio 2 GPIO_ACTIVE_HIGH>;
++ powerdown-gpios = <&wcdgpio 1 GPIO_ACTIVE_HIGH>;
+ #thermal-sensor-cells = <0>;
+ sound-name-prefix = "SpkrLeft";
+ #sound-dai-cells = <0>;
+@@ -572,7 +572,7 @@
+
+ right_spkr: wsa8810-right{
+ compatible = "sdw10217211000";
+- powerdown-gpios = <&wcdgpio 3 GPIO_ACTIVE_HIGH>;
++ powerdown-gpios = <&wcdgpio 2 GPIO_ACTIVE_HIGH>;
+ reg = <0 4>;
+ #thermal-sensor-cells = <0>;
+ sound-name-prefix = "SpkrRight";
+--
+2.30.2
+
--- /dev/null
+From 76c3c824ca52306c698b74d2baf985727272a5f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 20:57:33 +0200
+Subject: arm64: dts: qcom: msm8992-bullhead: Remove PSCI
+
+From: Petr Vorel <petr.vorel@gmail.com>
+
+[ Upstream commit 9d1fc2e4f5a94a492c7dd1ca577c66fdb7571c84 ]
+
+Bullhead firmware obviously doesn't support PSCI as it fails to boot
+with this definition.
+
+Fixes: 329e16d5f8fc ("arm64: dts: qcom: msm8992: Add PSCI support.")
+Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
+Link: https://lore.kernel.org/r/20210713185734.380-2-petr.vorel@gmail.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
+index 5969b5cfdc85..cb82864a90ef 100644
+--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
++++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /* Copyright (c) 2015, LGE Inc. All rights reserved.
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2021, Petr Vorel <petr.vorel@gmail.com>
+ */
+
+ /dts-v1/;
+@@ -15,6 +16,9 @@
+ qcom,board-id = <0xb64 0>;
+ qcom,pmic-id = <0x10009 0x1000A 0x0 0x0>;
+
++ /* Bullhead firmware doesn't support PSCI */
++ /delete-node/ psci;
++
+ aliases {
+ serial0 = &blsp1_uart2;
+ };
+--
+2.30.2
+
--- /dev/null
+From a4700bae675c3f67bee218d09744c3cdca739c75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 14:42:42 -0700
+Subject: bnxt: count Tx drops
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit fb9f7190092d2bbd1f8f0b1cc252732cbe99a87e ]
+
+Drivers should count packets they are dropping.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index dd03e1e6279a..96b76b713dd8 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -406,6 +406,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ i = skb_get_queue_mapping(skb);
+ if (unlikely(i >= bp->tx_nr_rings)) {
+ dev_kfree_skb_any(skb);
++ atomic_long_inc(&dev->tx_dropped);
+ return NETDEV_TX_OK;
+ }
+
+@@ -655,6 +656,7 @@ tx_kick_pending:
+ if (txr->kick_pending)
+ bnxt_txr_db_kick(bp, txr, txr->tx_prod);
+ txr->tx_buf_ring[txr->tx_prod].skb = NULL;
++ atomic_long_inc(&dev->tx_dropped);
+ return NETDEV_TX_OK;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From c669f1b8ea3b884f4c4467ef1dc0c16d79bb34ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 14:42:40 -0700
+Subject: bnxt: disable napi before canceling DIM
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 01cca6b9330ac7460de44eeeb3a0607f8aae69ff ]
+
+napi schedules DIM, napi has to be disabled first,
+then DIM canceled.
+
+Noticed while reading the code.
+
+Fixes: 0bc0b97fca73 ("bnxt_en: cleanup DIM work on device shutdown")
+Fixes: 6a8788f25625 ("bnxt_en: add support for software dynamic interrupt moderation")
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 65e41612b9da..621346656af3 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8855,10 +8855,9 @@ static void bnxt_disable_napi(struct bnxt *bp)
+ for (i = 0; i < bp->cp_nr_rings; i++) {
+ struct bnxt_cp_ring_info *cpr = &bp->bnapi[i]->cp_ring;
+
++ napi_disable(&bp->bnapi[i]->napi);
+ if (bp->bnapi[i]->rx_ring)
+ cancel_work_sync(&cpr->dim.work);
+-
+- napi_disable(&bp->bnapi[i]->napi);
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From f62a60e55193601b9c2c7c26c72b888d5bc3141d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 14:42:39 -0700
+Subject: bnxt: don't lock the tx queue from napi poll
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 3c603136c9f82833813af77185618de5af67676c ]
+
+We can't take the tx lock from the napi poll routine, because
+netpoll can poll napi at any moment, including with the tx lock
+already held.
+
+The tx lock is protecting against two paths - the disable
+path, and (as Michael points out) the NETDEV_TX_BUSY case
+which may occur if NAPI completions race with start_xmit
+and both decide to re-enable the queue.
+
+For the disable/ifdown path use synchronize_net() to make sure
+closing the device does not race we restarting the queues.
+Annotate accesses to dev_state against data races.
+
+For the NAPI cleanup vs start_xmit path - appropriate barriers
+are already in place in the main spot where Tx queue is stopped
+but we need to do the same careful dance in the TX_BUSY case.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 54 ++++++++++++++---------
+ 1 file changed, 32 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 8f169508a90a..65e41612b9da 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -360,6 +360,26 @@ static u16 bnxt_xmit_get_cfa_action(struct sk_buff *skb)
+ return md_dst->u.port_info.port_id;
+ }
+
++static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp,
++ struct bnxt_tx_ring_info *txr,
++ struct netdev_queue *txq)
++{
++ netif_tx_stop_queue(txq);
++
++ /* netif_tx_stop_queue() must be done before checking
++ * tx index in bnxt_tx_avail() below, because in
++ * bnxt_tx_int(), we update tx index before checking for
++ * netif_tx_queue_stopped().
++ */
++ smp_mb();
++ if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) {
++ netif_tx_wake_queue(txq);
++ return false;
++ }
++
++ return true;
++}
++
+ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bnxt *bp = netdev_priv(dev);
+@@ -387,8 +407,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ free_size = bnxt_tx_avail(bp, txr);
+ if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) {
+- netif_tx_stop_queue(txq);
+- return NETDEV_TX_BUSY;
++ if (bnxt_txr_netif_try_stop_queue(bp, txr, txq))
++ return NETDEV_TX_BUSY;
+ }
+
+ length = skb->len;
+@@ -597,16 +617,7 @@ tx_done:
+ if (netdev_xmit_more() && !tx_buf->is_push)
+ bnxt_db_write(bp, &txr->tx_db, prod);
+
+- netif_tx_stop_queue(txq);
+-
+- /* netif_tx_stop_queue() must be done before checking
+- * tx index in bnxt_tx_avail() below, because in
+- * bnxt_tx_int(), we update tx index before checking for
+- * netif_tx_queue_stopped().
+- */
+- smp_mb();
+- if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh)
+- netif_tx_wake_queue(txq);
++ bnxt_txr_netif_try_stop_queue(bp, txr, txq);
+ }
+ return NETDEV_TX_OK;
+
+@@ -690,14 +701,9 @@ next_tx_int:
+ smp_mb();
+
+ if (unlikely(netif_tx_queue_stopped(txq)) &&
+- (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh)) {
+- __netif_tx_lock(txq, smp_processor_id());
+- if (netif_tx_queue_stopped(txq) &&
+- bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh &&
+- txr->dev_state != BNXT_DEV_STATE_CLOSING)
+- netif_tx_wake_queue(txq);
+- __netif_tx_unlock(txq);
+- }
++ bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh &&
++ READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING)
++ netif_tx_wake_queue(txq);
+ }
+
+ static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping,
+@@ -8885,9 +8891,11 @@ void bnxt_tx_disable(struct bnxt *bp)
+ if (bp->tx_ring) {
+ for (i = 0; i < bp->tx_nr_rings; i++) {
+ txr = &bp->tx_ring[i];
+- txr->dev_state = BNXT_DEV_STATE_CLOSING;
++ WRITE_ONCE(txr->dev_state, BNXT_DEV_STATE_CLOSING);
+ }
+ }
++ /* Make sure napi polls see @dev_state change */
++ synchronize_net();
+ /* Drop carrier first to prevent TX timeout */
+ netif_carrier_off(bp->dev);
+ /* Stop all TX queues */
+@@ -8901,8 +8909,10 @@ void bnxt_tx_enable(struct bnxt *bp)
+
+ for (i = 0; i < bp->tx_nr_rings; i++) {
+ txr = &bp->tx_ring[i];
+- txr->dev_state = 0;
++ WRITE_ONCE(txr->dev_state, 0);
+ }
++ /* Make sure napi polls see @dev_state change */
++ synchronize_net();
+ netif_tx_wake_all_queues(bp->dev);
+ if (bp->link_info.link_up)
+ netif_carrier_on(bp->dev);
+--
+2.30.2
+
--- /dev/null
+From 780a75bbd71ae1e4f8fe5d63dd994e0eb0a03462 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 14:42:41 -0700
+Subject: bnxt: make sure xmit_more + errors does not miss doorbells
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit e8d8c5d80f5e9d4586c68061b62c642752289095 ]
+
+skbs are freed on error and not put on the ring. We may, however,
+be in a situation where we're freeing the last skb of a batch,
+and there is a doorbell ring pending because of xmit_more() being
+true earlier. Make sure we ring the door bell in such situations.
+
+Since errors are rare don't pay attention to xmit_more() and just
+always flush the pending frames.
+
+The busy case should be safe to be left alone because it can
+only happen if start_xmit races with completions and they
+both enable the queue. In that case the kick can't be pending.
+
+Noticed while reading the code.
+
+Fixes: 4d172f21cefe ("bnxt_en: Implement xmit_more.")
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 39 +++++++++++++++--------
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 +
+ 2 files changed, 27 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 621346656af3..dd03e1e6279a 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -69,7 +69,8 @@
+ #include "bnxt_debugfs.h"
+
+ #define BNXT_TX_TIMEOUT (5 * HZ)
+-#define BNXT_DEF_MSG_ENABLE (NETIF_MSG_DRV | NETIF_MSG_HW)
++#define BNXT_DEF_MSG_ENABLE (NETIF_MSG_DRV | NETIF_MSG_HW | \
++ NETIF_MSG_TX_ERR)
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Broadcom BCM573xx network driver");
+@@ -360,6 +361,13 @@ static u16 bnxt_xmit_get_cfa_action(struct sk_buff *skb)
+ return md_dst->u.port_info.port_id;
+ }
+
++static void bnxt_txr_db_kick(struct bnxt *bp, struct bnxt_tx_ring_info *txr,
++ u16 prod)
++{
++ bnxt_db_write(bp, &txr->tx_db, prod);
++ txr->kick_pending = 0;
++}
++
+ static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp,
+ struct bnxt_tx_ring_info *txr,
+ struct netdev_queue *txq)
+@@ -407,6 +415,10 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ free_size = bnxt_tx_avail(bp, txr);
+ if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) {
++ /* We must have raced with NAPI cleanup */
++ if (net_ratelimit() && txr->kick_pending)
++ netif_warn(bp, tx_err, dev,
++ "bnxt: ring busy w/ flush pending!\n");
+ if (bnxt_txr_netif_try_stop_queue(bp, txr, txq))
+ return NETDEV_TX_BUSY;
+ }
+@@ -510,21 +522,16 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ normal_tx:
+ if (length < BNXT_MIN_PKT_SIZE) {
+ pad = BNXT_MIN_PKT_SIZE - length;
+- if (skb_pad(skb, pad)) {
++ if (skb_pad(skb, pad))
+ /* SKB already freed. */
+- tx_buf->skb = NULL;
+- return NETDEV_TX_OK;
+- }
++ goto tx_kick_pending;
+ length = BNXT_MIN_PKT_SIZE;
+ }
+
+ mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);
+
+- if (unlikely(dma_mapping_error(&pdev->dev, mapping))) {
+- dev_kfree_skb_any(skb);
+- tx_buf->skb = NULL;
+- return NETDEV_TX_OK;
+- }
++ if (unlikely(dma_mapping_error(&pdev->dev, mapping)))
++ goto tx_free;
+
+ dma_unmap_addr_set(tx_buf, mapping, mapping);
+ flags = (len << TX_BD_LEN_SHIFT) | TX_BD_TYPE_LONG_TX_BD |
+@@ -609,13 +616,15 @@ normal_tx:
+ txr->tx_prod = prod;
+
+ if (!netdev_xmit_more() || netif_xmit_stopped(txq))
+- bnxt_db_write(bp, &txr->tx_db, prod);
++ bnxt_txr_db_kick(bp, txr, prod);
++ else
++ txr->kick_pending = 1;
+
+ tx_done:
+
+ if (unlikely(bnxt_tx_avail(bp, txr) <= MAX_SKB_FRAGS + 1)) {
+ if (netdev_xmit_more() && !tx_buf->is_push)
+- bnxt_db_write(bp, &txr->tx_db, prod);
++ bnxt_txr_db_kick(bp, txr, prod);
+
+ bnxt_txr_netif_try_stop_queue(bp, txr, txq);
+ }
+@@ -627,7 +636,6 @@ tx_dma_error:
+ /* start back at beginning and unmap skb */
+ prod = txr->tx_prod;
+ tx_buf = &txr->tx_buf_ring[prod];
+- tx_buf->skb = NULL;
+ dma_unmap_single(&pdev->dev, dma_unmap_addr(tx_buf, mapping),
+ skb_headlen(skb), PCI_DMA_TODEVICE);
+ prod = NEXT_TX(prod);
+@@ -641,7 +649,12 @@ tx_dma_error:
+ PCI_DMA_TODEVICE);
+ }
+
++tx_free:
+ dev_kfree_skb_any(skb);
++tx_kick_pending:
++ if (txr->kick_pending)
++ bnxt_txr_db_kick(bp, txr, txr->tx_prod);
++ txr->tx_buf_ring[txr->tx_prod].skb = NULL;
+ return NETDEV_TX_OK;
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index a95c5afa2f01..95d10e7bbb04 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -770,6 +770,7 @@ struct bnxt_tx_ring_info {
+ u16 tx_prod;
+ u16 tx_cons;
+ u16 txq_index;
++ u8 kick_pending;
+ struct bnxt_db_info tx_db;
+
+ struct tx_bd *tx_desc_ring[MAX_TX_PAGES];
+--
+2.30.2
+
--- /dev/null
+From 191939bd2eea404f0dcf4fc2b8b5eedb59960cfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Aug 2021 16:15:37 -0400
+Subject: bnxt_en: Add missing DMA memory barriers
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 828affc27ed43441bd1efdaf4e07e96dd43a0362 ]
+
+Each completion ring entry has a valid bit to indicate that the entry
+contains a valid completion event. The driver's main poll loop
+__bnxt_poll_work() has the proper dma_rmb() to make sure the valid
+bit of the next entry has been checked before proceeding further.
+But when we call bnxt_rx_pkt() to process the RX event, the RX
+completion event consists of two completion entries and only the
+first entry has been checked to be valid. We need the same barrier
+after checking the next completion entry. Add missing dma_rmb()
+barriers in bnxt_rx_pkt() and other similar locations.
+
+Fixes: 67a95e2022c7 ("bnxt_en: Need memory barrier when processing the completion ring.")
+Reported-by: Lance Richardson <lance.richardson@broadcom.com>
+Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
+Reviewed-by: Lance Richardson <lance.richardson@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index dbd99a8fd9c9..849ae99a955a 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1747,6 +1747,10 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+ if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons))
+ return -EBUSY;
+
++ /* The valid test of the entry must be done first before
++ * reading any further.
++ */
++ dma_rmb();
+ prod = rxr->rx_prod;
+
+ if (cmp_type == CMP_TYPE_RX_L2_TPA_START_CMP) {
+@@ -1950,6 +1954,10 @@ static int bnxt_force_rx_discard(struct bnxt *bp,
+ if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons))
+ return -EBUSY;
+
++ /* The valid test of the entry must be done first before
++ * reading any further.
++ */
++ dma_rmb();
+ cmp_type = RX_CMP_TYPE(rxcmp);
+ if (cmp_type == CMP_TYPE_RX_L2_CMP) {
+ rxcmp1->rx_cmp_cfa_code_errors_v2 |=
+@@ -2394,6 +2402,10 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget)
+ if (!TX_CMP_VALID(txcmp, raw_cons))
+ break;
+
++ /* The valid test of the entry must be done first before
++ * reading any further.
++ */
++ dma_rmb();
+ if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) {
+ tmp_raw_cons = NEXT_RAW_CMP(raw_cons);
+ cp_cons = RING_CMP(tmp_raw_cons);
+--
+2.30.2
+
--- /dev/null
+From a025cf17f6050ab9440d7177712ab942f889d6ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Aug 2021 16:15:36 -0400
+Subject: bnxt_en: Disable aRFS if running on 212 firmware
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 976e52b718c3de9077fff8f3f674afb159c57fb1 ]
+
+212 firmware broke aRFS, so disable it. Traffic may stop after ntuple
+filters are inserted and deleted by the 212 firmware.
+
+Fixes: ae10ae740ad2 ("bnxt_en: Add new hardware RFS mode.")
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 96b76b713dd8..dbd99a8fd9c9 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -10396,6 +10396,9 @@ static bool bnxt_rfs_supported(struct bnxt *bp)
+ return true;
+ return false;
+ }
++ /* 212 firmware is broken for aRFS */
++ if (BNXT_FW_MAJ(bp) == 212)
++ return false;
+ if (BNXT_PF(bp) && !BNXT_CHIP_TYPE_NITRO_A0(bp))
+ return true;
+ if (bp->flags & BNXT_FLAG_NEW_RSS_CAP)
+--
+2.30.2
+
--- /dev/null
+From e91a1f9dff88ab4f599a736c3e1eaec73d5f4c72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 17:18:10 +0200
+Subject: bpf: Clear zext_dst of dead insns
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 45c709f8c71b525b51988e782febe84ce933e7e0 ]
+
+"access skb fields ok" verifier test fails on s390 with the "verifier
+bug. zext_dst is set, but no reg is defined" message. The first insns
+of the test prog are ...
+
+ 0: 61 01 00 00 00 00 00 00 ldxw %r0,[%r1+0]
+ 8: 35 00 00 01 00 00 00 00 jge %r0,0,1
+ 10: 61 01 00 08 00 00 00 00 ldxw %r0,[%r1+8]
+
+... and the 3rd one is dead (this does not look intentional to me, but
+this is a separate topic).
+
+sanitize_dead_code() converts dead insns into "ja -1", but keeps
+zext_dst. When opt_subreg_zext_lo32_rnd_hi32() tries to parse such
+an insn, it sees this discrepancy and bails. This problem can be seen
+only with JITs whose bpf_jit_needs_zext() returns true.
+
+Fix by clearning dead insns' zext_dst.
+
+The commits that contributed to this problem are:
+
+1. 5aa5bd14c5f8 ("bpf: add initial suite for selftests"), which
+ introduced the test with the dead code.
+2. 5327ed3d44b7 ("bpf: verifier: mark verified-insn with
+ sub-register zext flag"), which introduced the zext_dst flag.
+3. 83a2881903f3 ("bpf: Account for BPF_FETCH in
+ insn_has_def32()"), which introduced the sanity check.
+4. 9183671af6db ("bpf: Fix leakage under speculation on
+ mispredicted branches"), which bisect points to.
+
+It's best to fix this on stable branches that contain the second one,
+since that's the point where the inconsistency was introduced.
+
+Fixes: 5327ed3d44b7 ("bpf: verifier: mark verified-insn with sub-register zext flag")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20210812151811.184086-2-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index ce1e9193365f..1410f128c404 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -10705,6 +10705,7 @@ static void sanitize_dead_code(struct bpf_verifier_env *env)
+ if (aux_data[i].seen)
+ continue;
+ memcpy(insn + i, &trap, sizeof(trap));
++ aux_data[i].zext_dst = false;
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From bf7ce78bb27c9541a76a5675eb80fffb1e2b4d75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 08:34:46 +0300
+Subject: bus: ti-sysc: Fix error handling for sysc_check_active_timer()
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 06a089ef644934372a3062528244fca3417d3430 ]
+
+We have changed the return type for sysc_check_active_timer() from -EBUSY
+to -ENXIO, but the gpt12 system timer fix still checks for -EBUSY. We are
+also not returning on other errors like we did earlier as noted by
+Pavel Machek <pavel@denx.de>.
+
+Commit 3ff340e24c9d ("bus: ti-sysc: Fix gpt12 system timer issue with
+reserved status") should have been updated for commit 65fb73676112
+("bus: ti-sysc: suppress err msg for timers used as clockevent/source").
+
+Let's fix the issue by checking for -ENXIO and returning on any other
+errors as suggested by Pavel Machek <pavel@denx.de>.
+
+Fixes: 3ff340e24c9d ("bus: ti-sysc: Fix gpt12 system timer issue with reserved status")
+Depends-on: 65fb73676112 ("bus: ti-sysc: suppress err msg for timers used as clockevent/source")
+Reported-by: Pavel Machek <pavel@denx.de>
+Reviewed-by: Pavel Machek (CIP) <pavel@denx.de>
+Cc: Grygorii Strashko <grygorii.strashko@ti.com>
+Cc: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index c3d8d44f28d7..159b57c6dc4d 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -3061,8 +3061,10 @@ static int sysc_probe(struct platform_device *pdev)
+ return error;
+
+ error = sysc_check_active_timer(ddata);
+- if (error == -EBUSY)
++ if (error == -ENXIO)
+ ddata->reserved = true;
++ else if (error)
++ return error;
+
+ error = sysc_get_clocks(ddata);
+ if (error)
+--
+2.30.2
+
--- /dev/null
+From cc55c4f0243ab22e9408c38a3775e073ba62f696 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jul 2021 00:56:01 +0200
+Subject: cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 484f2b7c61b9ae58cc00c5127bcbcd9177af8dfe ]
+
+The 1.2 GHz variant of the Armada 3720 SOC is unstable with DVFS: when
+the SOC boots, the WTMI firmware sets clocks and AVS values that work
+correctly with 1.2 GHz CPU frequency, but random crashes occur once
+cpufreq driver starts scaling.
+
+We do not know currently what is the reason:
+- it may be that the voltage value for L0 for 1.2 GHz variant provided
+ by the vendor in the OTP is simply incorrect when scaling is used,
+- it may be that some delay is needed somewhere,
+- it may be something else.
+
+The most sane solution now seems to be to simply forbid the cpufreq
+driver on 1.2 GHz variant.
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/armada-37xx-cpufreq.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index e4782f562e7a..2de7fd18f66a 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -102,7 +102,11 @@ struct armada_37xx_dvfs {
+ };
+
+ static struct armada_37xx_dvfs armada_37xx_dvfs[] = {
+- {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} },
++ /*
++ * The cpufreq scaling for 1.2 GHz variant of the SOC is currently
++ * unstable because we do not know how to configure it properly.
++ */
++ /* {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} }, */
+ {.cpu_freq_max = 1000*1000*1000, .divider = {1, 2, 4, 5} },
+ {.cpu_freq_max = 800*1000*1000, .divider = {1, 2, 3, 4} },
+ {.cpu_freq_max = 600*1000*1000, .divider = {2, 4, 5, 6} },
+--
+2.30.2
+
--- /dev/null
+From b9721271bd00e73bcfdbf3c9f9f6e0f489b92c47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Aug 2021 16:04:40 -0700
+Subject: dccp: add do-while-0 stubs for dccp_pr_debug macros
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 86aab09a4870bb8346c9579864588c3d7f555299 ]
+
+GCC complains about empty macros in an 'if' statement, so convert
+them to 'do {} while (0)' macros.
+
+Fixes these build warnings:
+
+net/dccp/output.c: In function 'dccp_xmit_packet':
+../net/dccp/output.c:283:71: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
+ 283 | dccp_pr_debug("transmit_skb() returned err=%d\n", err);
+net/dccp/ackvec.c: In function 'dccp_ackvec_update_old':
+../net/dccp/ackvec.c:163:80: warning: suggest braces around empty body in an 'else' statement [-Wempty-body]
+ 163 | (unsigned long long)seqno, state);
+
+Fixes: dc841e30eaea ("dccp: Extend CCID packet dequeueing interface")
+Fixes: 380240864451 ("dccp ccid-2: Update code for the Ack Vector input/registration routine")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: dccp@vger.kernel.org
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dccp/dccp.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
+index 9cc9d1ee6cdb..c5c1d2b8045e 100644
+--- a/net/dccp/dccp.h
++++ b/net/dccp/dccp.h
+@@ -41,9 +41,9 @@ extern bool dccp_debug;
+ #define dccp_pr_debug_cat(format, a...) DCCP_PRINTK(dccp_debug, format, ##a)
+ #define dccp_debug(fmt, a...) dccp_pr_debug_cat(KERN_DEBUG fmt, ##a)
+ #else
+-#define dccp_pr_debug(format, a...)
+-#define dccp_pr_debug_cat(format, a...)
+-#define dccp_debug(format, a...)
++#define dccp_pr_debug(format, a...) do {} while (0)
++#define dccp_pr_debug_cat(format, a...) do {} while (0)
++#define dccp_debug(format, a...) do {} while (0)
+ #endif
+
+ extern struct inet_hashinfo dccp_hashinfo;
+--
+2.30.2
+
--- /dev/null
+From 48203b3edb0830ef49bbee9d97e8162f83288f3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 10:55:03 +0800
+Subject: drm/mediatek: Add AAL output size configuration
+
+From: jason-jh.lin <jason-jh.lin@mediatek.com>
+
+[ Upstream commit 71ac6f390f6a3017f58d05d677b961bb1f851338 ]
+
+To avoid the output width and height is incorrect,
+AAL_OUTPUT_SIZE configuration should be set.
+
+Fixes: 0664d1392c26 ("drm/mediatek: Add AAL engine basic function")
+Signed-off-by: jason-jh.lin <jason-jh.lin@mediatek.com>
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+index fe58edcf57b5..e747ff7ba3dc 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+@@ -34,6 +34,7 @@
+
+ #define DISP_AAL_EN 0x0000
+ #define DISP_AAL_SIZE 0x0030
++#define DISP_AAL_OUTPUT_SIZE 0x04d8
+
+ #define DISP_CCORR_EN 0x0000
+ #define CCORR_EN BIT(0)
+@@ -181,6 +182,7 @@ static void mtk_aal_config(struct mtk_ddp_comp *comp, unsigned int w,
+ unsigned int bpc, struct cmdq_pkt *cmdq_pkt)
+ {
+ mtk_ddp_write(cmdq_pkt, w << 16 | h, comp, DISP_AAL_SIZE);
++ mtk_ddp_write(cmdq_pkt, w << 16 | h, comp, DISP_AAL_OUTPUT_SIZE);
+ }
+
+ static void mtk_aal_start(struct mtk_ddp_comp *comp)
+--
+2.30.2
+
--- /dev/null
+From 5f514173fc833fbff802adbc7ba6b7398078e6ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 15:43:47 +0800
+Subject: drm/mediatek: Fix aal size config
+
+From: Yongqiang Niu <yongqiang.niu@mediatek.com>
+
+[ Upstream commit 71dcadba34203d8dd35152e368720f977e9cdb81 ]
+
+The orginal setting is not correct, fix it to follow hardware data sheet.
+If keep this error setting, mt8173/mt8183 display ok
+but mt8192 display abnormal.
+
+Fixes: 0664d1392c26 ("drm/mediatek: Add AAL engine basic function")
+
+Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com>
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+index 3064eac1a750..fe58edcf57b5 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+@@ -180,7 +180,7 @@ static void mtk_aal_config(struct mtk_ddp_comp *comp, unsigned int w,
+ unsigned int h, unsigned int vrefresh,
+ unsigned int bpc, struct cmdq_pkt *cmdq_pkt)
+ {
+- mtk_ddp_write(cmdq_pkt, h << 16 | w, comp, DISP_AAL_SIZE);
++ mtk_ddp_write(cmdq_pkt, w << 16 | h, comp, DISP_AAL_SIZE);
+ }
+
+ static void mtk_aal_start(struct mtk_ddp_comp *comp)
+--
+2.30.2
+
--- /dev/null
+From b805bc18bb56d1e2783cf4c2a6948568dd17a266 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 10:42:16 -0700
+Subject: i40e: Fix ATR queue selection
+
+From: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+
+[ Upstream commit a222be597e316389f9f8c26033352c124ce93056 ]
+
+Without this patch, ATR does not work. Receive/transmit uses queue
+selection based on SW DCB hashing method.
+
+If traffic classes are not configured for PF, then use
+netdev_pick_tx function for selecting queue for packet transmission.
+Instead of calling i40e_swdcb_skb_tx_hash, call netdev_pick_tx,
+which ensures that packet is transmitted/received from CPU that is
+running the application.
+
+Reproduction steps:
+1. Load i40e driver
+2. Map each MSI interrupt of i40e port for each CPU
+3. Disable ntuple, enable ATR i.e.:
+ethtool -K $interface ntuple off
+ethtool --set-priv-flags $interface flow-director-atr
+4. Run application that is generating traffic and is bound to a
+single CPU, i.e.:
+taskset -c 9 netperf -H 1.1.1.1 -t TCP_RR -l 10
+5. Observe behavior:
+Application's traffic should be restricted to the CPU provided in
+taskset.
+
+Fixes: 89ec1f0886c1 ("i40e: Fix queue-to-TC mapping on Tx")
+Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+Tested-by: Dave Switzer <david.switzer@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_txrx.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+index 615802b07521..5ad28129fab2 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -3556,8 +3556,7 @@ u16 i40e_lan_select_queue(struct net_device *netdev,
+
+ /* is DCB enabled at all? */
+ if (vsi->tc_config.numtc == 1)
+- return i40e_swdcb_skb_tx_hash(netdev, skb,
+- netdev->real_num_tx_queues);
++ return netdev_pick_tx(netdev, skb, sb_dev);
+
+ prio = skb->priority;
+ hw = &vsi->back->hw;
+--
+2.30.2
+
--- /dev/null
+From abc6a7bcfb9e4802ae18ab5036d6308ae76d9f61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 10:42:17 -0700
+Subject: iavf: Fix ping is lost after untrusted VF had tried to change MAC
+
+From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+
+[ Upstream commit 8da80c9d50220a8e4190a4eaa0dd6aeefcbbb5bf ]
+
+Make changes to MAC address dependent on the response of PF.
+Disallow changes to HW MAC address and MAC filter from untrusted
+VF, thanks to that ping is not lost if VF tries to change MAC.
+Add a new field in iavf_mac_filter, to indicate whether there
+was response from PF for given filter. Based on this field pass
+or discard the filter.
+If untrusted VF tried to change it's address, it's not changed.
+Still filter was changed, because of that ping couldn't go through.
+
+Fixes: c5c922b3e09b ("iavf: fix MAC address setting for VFs when filter is rejected")
+Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Tested-by: Gurucharan G <Gurucharanx.g@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf.h | 1 +
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 1 +
+ .../net/ethernet/intel/iavf/iavf_virtchnl.c | 47 ++++++++++++++++++-
+ 3 files changed, 47 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h
+index 8a65525a7c0d..6766446a33f4 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf.h
++++ b/drivers/net/ethernet/intel/iavf/iavf.h
+@@ -134,6 +134,7 @@ struct iavf_q_vector {
+ struct iavf_mac_filter {
+ struct list_head list;
+ u8 macaddr[ETH_ALEN];
++ bool is_new_mac; /* filter is new, wait for PF decision */
+ bool remove; /* filter needs to be removed */
+ bool add; /* filter needs to be added */
+ };
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index c4ec9a91c7c5..7023aa147043 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -751,6 +751,7 @@ struct iavf_mac_filter *iavf_add_filter(struct iavf_adapter *adapter,
+
+ list_add_tail(&f->list, &adapter->mac_filter_list);
+ f->add = true;
++ f->is_new_mac = true;
+ adapter->aq_required |= IAVF_FLAG_AQ_ADD_MAC_FILTER;
+ } else {
+ f->remove = false;
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
+index ed08ace4f05a..8be3151f2c62 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
+@@ -537,6 +537,47 @@ void iavf_del_ether_addrs(struct iavf_adapter *adapter)
+ kfree(veal);
+ }
+
++/**
++ * iavf_mac_add_ok
++ * @adapter: adapter structure
++ *
++ * Submit list of filters based on PF response.
++ **/
++static void iavf_mac_add_ok(struct iavf_adapter *adapter)
++{
++ struct iavf_mac_filter *f, *ftmp;
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) {
++ f->is_new_mac = false;
++ }
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++}
++
++/**
++ * iavf_mac_add_reject
++ * @adapter: adapter structure
++ *
++ * Remove filters from list based on PF response.
++ **/
++static void iavf_mac_add_reject(struct iavf_adapter *adapter)
++{
++ struct net_device *netdev = adapter->netdev;
++ struct iavf_mac_filter *f, *ftmp;
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) {
++ if (f->remove && ether_addr_equal(f->macaddr, netdev->dev_addr))
++ f->remove = false;
++
++ if (f->is_new_mac) {
++ list_del(&f->list);
++ kfree(f);
++ }
++ }
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++}
++
+ /**
+ * iavf_add_vlans
+ * @adapter: adapter structure
+@@ -1295,6 +1336,7 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter,
+ case VIRTCHNL_OP_ADD_ETH_ADDR:
+ dev_err(&adapter->pdev->dev, "Failed to add MAC filter, error %s\n",
+ iavf_stat_str(&adapter->hw, v_retval));
++ iavf_mac_add_reject(adapter);
+ /* restore administratively set MAC address */
+ ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr);
+ break;
+@@ -1364,10 +1406,11 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter,
+ }
+ }
+ switch (v_opcode) {
+- case VIRTCHNL_OP_ADD_ETH_ADDR: {
++ case VIRTCHNL_OP_ADD_ETH_ADDR:
++ if (!v_retval)
++ iavf_mac_add_ok(adapter);
+ if (!ether_addr_equal(netdev->dev_addr, adapter->hw.mac.addr))
+ ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr);
+- }
+ break;
+ case VIRTCHNL_OP_GET_STATS: {
+ struct iavf_eth_stats *stats =
+--
+2.30.2
+
--- /dev/null
+From a7e6ef9ce115b47b33173103ae0f597851483828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jul 2021 09:47:37 +0200
+Subject: iommu: Check if group is NULL before remove device
+
+From: Frank Wunderlich <frank-w@public-files.de>
+
+[ Upstream commit 5aa95d8834e07907e64937d792c12ffef7fb271f ]
+
+If probe_device is failing, iommu_group is not initialized because
+iommu_group_add_device is not reached, so freeing it will result
+in NULL pointer access.
+
+iommu_bus_init
+ ->bus_iommu_probe
+ ->probe_iommu_group in for each:/* return -22 in fail case */
+ ->iommu_probe_device
+ ->__iommu_probe_device /* return -22 here.*/
+ -> ops->probe_device /* return -22 here.*/
+ -> iommu_group_get_for_dev
+ -> ops->device_group
+ -> iommu_group_add_device //good case
+ ->remove_iommu_group //in fail case, it will remove group
+ ->iommu_release_device
+ ->iommu_group_remove_device // here we don't have group
+
+In my case ops->probe_device (mtk_iommu_probe_device from
+mtk_iommu_v1.c) is due to failing fwspec->ops mismatch.
+
+Fixes: d72e31c93746 ("iommu: IOMMU Groups")
+Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
+Link: https://lore.kernel.org/r/20210731074737.4573-1-linux@fw-web.de
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 9b8664d388af..bcf060b5cf85 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -879,6 +879,9 @@ void iommu_group_remove_device(struct device *dev)
+ struct iommu_group *group = dev->iommu_group;
+ struct group_device *tmp_device, *device = NULL;
+
++ if (!group)
++ return;
++
+ dev_info(dev, "Removing from iommu group %d\n", group->id);
+
+ /* Pre-notify listeners that a device is being removed. */
+--
+2.30.2
+
--- /dev/null
+From 9b4b2c1b30796c5e543cf38fece4bb1d0761baeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 16:50:21 +0800
+Subject: iommu/vt-d: Consolidate duplicate cache invaliation code
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 9872f9bd9dbd68f75e8db782717d71e8594f6a02 ]
+
+The pasid based IOTLB and devTLB invalidation code is duplicate in
+several places. Consolidate them by using the common helpers.
+
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20210114085021.717041-1-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/pasid.c | 18 ++----------
+ drivers/iommu/intel/svm.c | 55 ++++++-------------------------------
+ 2 files changed, 11 insertions(+), 62 deletions(-)
+
+diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
+index 1e7c17989084..77fbe9908abd 100644
+--- a/drivers/iommu/intel/pasid.c
++++ b/drivers/iommu/intel/pasid.c
+@@ -466,20 +466,6 @@ pasid_cache_invalidation_with_pasid(struct intel_iommu *iommu,
+ qi_submit_sync(iommu, &desc, 1, 0);
+ }
+
+-static void
+-iotlb_invalidation_with_pasid(struct intel_iommu *iommu, u16 did, u32 pasid)
+-{
+- struct qi_desc desc;
+-
+- desc.qw0 = QI_EIOTLB_PASID(pasid) | QI_EIOTLB_DID(did) |
+- QI_EIOTLB_GRAN(QI_GRAN_NONG_PASID) | QI_EIOTLB_TYPE;
+- desc.qw1 = 0;
+- desc.qw2 = 0;
+- desc.qw3 = 0;
+-
+- qi_submit_sync(iommu, &desc, 1, 0);
+-}
+-
+ static void
+ devtlb_invalidation_with_pasid(struct intel_iommu *iommu,
+ struct device *dev, u32 pasid)
+@@ -524,7 +510,7 @@ void intel_pasid_tear_down_entry(struct intel_iommu *iommu, struct device *dev,
+ clflush_cache_range(pte, sizeof(*pte));
+
+ pasid_cache_invalidation_with_pasid(iommu, did, pasid);
+- iotlb_invalidation_with_pasid(iommu, did, pasid);
++ qi_flush_piotlb(iommu, did, pasid, 0, -1, 0);
+
+ /* Device IOTLB doesn't need to be flushed in caching mode. */
+ if (!cap_caching_mode(iommu->cap))
+@@ -540,7 +526,7 @@ static void pasid_flush_caches(struct intel_iommu *iommu,
+
+ if (cap_caching_mode(iommu->cap)) {
+ pasid_cache_invalidation_with_pasid(iommu, did, pasid);
+- iotlb_invalidation_with_pasid(iommu, did, pasid);
++ qi_flush_piotlb(iommu, did, pasid, 0, -1, 0);
+ } else {
+ iommu_flush_write_buffer(iommu);
+ }
+diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c
+index 6168dec7cb40..aabf56272b86 100644
+--- a/drivers/iommu/intel/svm.c
++++ b/drivers/iommu/intel/svm.c
+@@ -123,53 +123,16 @@ static void __flush_svm_range_dev(struct intel_svm *svm,
+ unsigned long address,
+ unsigned long pages, int ih)
+ {
+- struct qi_desc desc;
++ struct device_domain_info *info = get_domain_info(sdev->dev);
+
+- if (pages == -1) {
+- desc.qw0 = QI_EIOTLB_PASID(svm->pasid) |
+- QI_EIOTLB_DID(sdev->did) |
+- QI_EIOTLB_GRAN(QI_GRAN_NONG_PASID) |
+- QI_EIOTLB_TYPE;
+- desc.qw1 = 0;
+- } else {
+- int mask = ilog2(__roundup_pow_of_two(pages));
+-
+- desc.qw0 = QI_EIOTLB_PASID(svm->pasid) |
+- QI_EIOTLB_DID(sdev->did) |
+- QI_EIOTLB_GRAN(QI_GRAN_PSI_PASID) |
+- QI_EIOTLB_TYPE;
+- desc.qw1 = QI_EIOTLB_ADDR(address) |
+- QI_EIOTLB_IH(ih) |
+- QI_EIOTLB_AM(mask);
+- }
+- desc.qw2 = 0;
+- desc.qw3 = 0;
+- qi_submit_sync(sdev->iommu, &desc, 1, 0);
+-
+- if (sdev->dev_iotlb) {
+- desc.qw0 = QI_DEV_EIOTLB_PASID(svm->pasid) |
+- QI_DEV_EIOTLB_SID(sdev->sid) |
+- QI_DEV_EIOTLB_QDEP(sdev->qdep) |
+- QI_DEIOTLB_TYPE;
+- if (pages == -1) {
+- desc.qw1 = QI_DEV_EIOTLB_ADDR(-1ULL >> 1) |
+- QI_DEV_EIOTLB_SIZE;
+- } else if (pages > 1) {
+- /* The least significant zero bit indicates the size. So,
+- * for example, an "address" value of 0x12345f000 will
+- * flush from 0x123440000 to 0x12347ffff (256KiB). */
+- unsigned long last = address + ((unsigned long)(pages - 1) << VTD_PAGE_SHIFT);
+- unsigned long mask = __rounddown_pow_of_two(address ^ last);
+-
+- desc.qw1 = QI_DEV_EIOTLB_ADDR((address & ~mask) |
+- (mask - 1)) | QI_DEV_EIOTLB_SIZE;
+- } else {
+- desc.qw1 = QI_DEV_EIOTLB_ADDR(address);
+- }
+- desc.qw2 = 0;
+- desc.qw3 = 0;
+- qi_submit_sync(sdev->iommu, &desc, 1, 0);
+- }
++ if (WARN_ON(!pages))
++ return;
++
++ qi_flush_piotlb(sdev->iommu, sdev->did, svm->pasid, address, pages, ih);
++ if (info->ats_enabled)
++ qi_flush_dev_iotlb_pasid(sdev->iommu, sdev->sid, info->pfsid,
++ svm->pasid, sdev->qdep, address,
++ order_base_2(pages));
+ }
+
+ static void intel_flush_svm_range_dev(struct intel_svm *svm,
+--
+2.30.2
+
--- /dev/null
+From e86594c91d33b1de9aebd0685bce315a74858d1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 20:43:21 +0800
+Subject: iommu/vt-d: Fix incomplete cache flush in
+ intel_pasid_tear_down_entry()
+
+From: Liu Yi L <yi.l.liu@intel.com>
+
+[ Upstream commit 8798d36411196da86e70b994725349c16c1119f6 ]
+
+This fixes improper iotlb invalidation in intel_pasid_tear_down_entry().
+When a PASID was used as nested mode, released and reused, the following
+error message will appear:
+
+[ 180.187556] Unexpected page request in Privilege Mode
+[ 180.187565] Unexpected page request in Privilege Mode
+[ 180.279933] Unexpected page request in Privilege Mode
+[ 180.279937] Unexpected page request in Privilege Mode
+
+Per chapter 6.5.3.3 of VT-d spec 3.3, when tear down a pasid entry, the
+software should use Domain selective IOTLB flush if the PGTT of the pasid
+entry is SL only or Nested, while for the pasid entries whose PGTT is FL
+only or PT using PASID-based IOTLB flush is enough.
+
+Fixes: 2cd1311a26673 ("iommu/vt-d: Add set domain DOMAIN_ATTR_NESTING attr")
+Signed-off-by: Kumar Sanjay K <sanjay.k.kumar@intel.com>
+Signed-off-by: Liu Yi L <yi.l.liu@intel.com>
+Tested-by: Yi Sun <yi.y.sun@intel.com>
+Link: https://lore.kernel.org/r/20210817042425.1784279-1-yi.l.liu@intel.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20210817124321.1517985-3-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/pasid.c | 10 ++++++++--
+ drivers/iommu/intel/pasid.h | 6 ++++++
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
+index 77fbe9908abd..fb911b6c418f 100644
+--- a/drivers/iommu/intel/pasid.c
++++ b/drivers/iommu/intel/pasid.c
+@@ -497,20 +497,26 @@ void intel_pasid_tear_down_entry(struct intel_iommu *iommu, struct device *dev,
+ u32 pasid, bool fault_ignore)
+ {
+ struct pasid_entry *pte;
+- u16 did;
++ u16 did, pgtt;
+
+ pte = intel_pasid_get_entry(dev, pasid);
+ if (WARN_ON(!pte))
+ return;
+
+ did = pasid_get_domain_id(pte);
++ pgtt = pasid_pte_get_pgtt(pte);
++
+ intel_pasid_clear_entry(dev, pasid, fault_ignore);
+
+ if (!ecap_coherent(iommu->ecap))
+ clflush_cache_range(pte, sizeof(*pte));
+
+ pasid_cache_invalidation_with_pasid(iommu, did, pasid);
+- qi_flush_piotlb(iommu, did, pasid, 0, -1, 0);
++
++ if (pgtt == PASID_ENTRY_PGTT_PT || pgtt == PASID_ENTRY_PGTT_FL_ONLY)
++ qi_flush_piotlb(iommu, did, pasid, 0, -1, 0);
++ else
++ iommu->flush.flush_iotlb(iommu, did, 0, 0, DMA_TLB_DSI_FLUSH);
+
+ /* Device IOTLB doesn't need to be flushed in caching mode. */
+ if (!cap_caching_mode(iommu->cap))
+diff --git a/drivers/iommu/intel/pasid.h b/drivers/iommu/intel/pasid.h
+index 086ebd697319..30cb30046b15 100644
+--- a/drivers/iommu/intel/pasid.h
++++ b/drivers/iommu/intel/pasid.h
+@@ -99,6 +99,12 @@ static inline bool pasid_pte_is_present(struct pasid_entry *pte)
+ return READ_ONCE(pte->val[0]) & PASID_PTE_PRESENT;
+ }
+
++/* Get PGTT field of a PASID table entry */
++static inline u16 pasid_pte_get_pgtt(struct pasid_entry *pte)
++{
++ return (u16)((READ_ONCE(pte->val[0]) >> 6) & 0x7);
++}
++
+ extern unsigned int intel_pasid_max_id;
+ int intel_pasid_alloc_id(void *ptr, int start, int end, gfp_t gfp);
+ void intel_pasid_free_id(u32 pasid);
+--
+2.30.2
+
--- /dev/null
+From 46369460f0752e5cb0486d0703870cbf6c059021 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 13:37:36 -0700
+Subject: ixgbe, xsk: clean up the resources in ixgbe_xsk_pool_enable error
+ path
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 1b80fec7b043552e01609bae7d0aad07aa742adc ]
+
+In ixgbe_xsk_pool_enable(), if ixgbe_xsk_wakeup() fails,
+We should restore the previous state and clean up the
+resources. Add the missing clear af_xdp_zc_qps and unmap dma
+to fix this bug.
+
+Fixes: d49e286d354e ("ixgbe: add tracking of AF_XDP zero-copy state for each queue pair")
+Fixes: 4a9b32f30f80 ("ixgbe: fix potential RX buffer starvation for AF_XDP")
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Tested-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://lore.kernel.org/r/20210817203736.3529939-1-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
+index f72d2978263b..d60da7a89092 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
+@@ -52,8 +52,11 @@ static int ixgbe_xsk_pool_enable(struct ixgbe_adapter *adapter,
+
+ /* Kick start the NAPI context so that receiving will start */
+ err = ixgbe_xsk_wakeup(adapter->netdev, qid, XDP_WAKEUP_RX);
+- if (err)
++ if (err) {
++ clear_bit(qid, adapter->af_xdp_zc_qps);
++ xsk_pool_dma_unmap(pool, IXGBE_RX_DMA_ATTR);
+ return err;
++ }
+ }
+
+ return 0;
+--
+2.30.2
+
--- /dev/null
+From c4e142995ccb88ba02d01f92a9cd9c4eee8c38dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 18:14:33 +0300
+Subject: net: 6pack: fix slab-out-of-bounds in decode_data
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 19d1532a187669ce86d5a2696eb7275310070793 ]
+
+Syzbot reported slab-out-of bounds write in decode_data().
+The problem was in missing validation checks.
+
+Syzbot's reproducer generated malicious input, which caused
+decode_data() to be called a lot in sixpack_decode(). Since
+rx_count_cooked is only 400 bytes and noone reported before,
+that 400 bytes is not enough, let's just check if input is malicious
+and complain about buffer overrun.
+
+Fail log:
+==================================================================
+BUG: KASAN: slab-out-of-bounds in drivers/net/hamradio/6pack.c:843
+Write of size 1 at addr ffff888087c5544e by task kworker/u4:0/7
+
+CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.6.0-rc3-syzkaller #0
+...
+Workqueue: events_unbound flush_to_ldisc
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x197/0x210 lib/dump_stack.c:118
+ print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
+ __kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506
+ kasan_report+0x12/0x20 mm/kasan/common.c:641
+ __asan_report_store1_noabort+0x17/0x20 mm/kasan/generic_report.c:137
+ decode_data.part.0+0x23b/0x270 drivers/net/hamradio/6pack.c:843
+ decode_data drivers/net/hamradio/6pack.c:965 [inline]
+ sixpack_decode drivers/net/hamradio/6pack.c:968 [inline]
+
+Reported-and-tested-by: syzbot+fc8cd9a673d4577fb2e4@syzkaller.appspotmail.com
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hamradio/6pack.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index 71d6629e65c9..da13683d52d1 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -839,6 +839,12 @@ static void decode_data(struct sixpack *sp, unsigned char inbyte)
+ return;
+ }
+
++ if (sp->rx_count_cooked + 2 >= sizeof(sp->cooked_buf)) {
++ pr_err("6pack: cooked buffer overrun, data loss\n");
++ sp->rx_count = 0;
++ return;
++ }
++
+ buf = sp->raw_buf;
+ sp->cooked_buf[sp->rx_count_cooked++] =
+ buf[0] | ((buf[1] << 2) & 0xc0);
+--
+2.30.2
+
--- /dev/null
+From a8d2674555f302f07f8e6233a62fc1c0f5bb4c2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 20:38:02 -0700
+Subject: net: mdio-mux: Don't ignore memory allocation errors
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit 99d81e942474cc7677d12f673f42a7ea699e2589 ]
+
+If we are seeing memory allocation errors, don't try to continue
+registering child mdiobus devices. It's unlikely they'll succeed.
+
+Fixes: 342fa1964439 ("mdio: mux: make child bus walking more permissive and errors more verbose")
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Tested-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Kevin Hilman <khilman@baylibre.com>
+Tested-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/mdio/mdio-mux.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/mdio/mdio-mux.c b/drivers/net/mdio/mdio-mux.c
+index 6a1d3540210b..c96ef3b3fa3a 100644
+--- a/drivers/net/mdio/mdio-mux.c
++++ b/drivers/net/mdio/mdio-mux.c
+@@ -82,6 +82,17 @@ out:
+
+ static int parent_count;
+
++static void mdio_mux_uninit_children(struct mdio_mux_parent_bus *pb)
++{
++ struct mdio_mux_child_bus *cb = pb->children;
++
++ while (cb) {
++ mdiobus_unregister(cb->mii_bus);
++ mdiobus_free(cb->mii_bus);
++ cb = cb->next;
++ }
++}
++
+ int mdio_mux_init(struct device *dev,
+ struct device_node *mux_node,
+ int (*switch_fn)(int cur, int desired, void *data),
+@@ -144,7 +155,7 @@ int mdio_mux_init(struct device *dev,
+ cb = devm_kzalloc(dev, sizeof(*cb), GFP_KERNEL);
+ if (!cb) {
+ ret_val = -ENOMEM;
+- continue;
++ goto err_loop;
+ }
+ cb->bus_number = v;
+ cb->parent = pb;
+@@ -152,8 +163,7 @@ int mdio_mux_init(struct device *dev,
+ cb->mii_bus = mdiobus_alloc();
+ if (!cb->mii_bus) {
+ ret_val = -ENOMEM;
+- devm_kfree(dev, cb);
+- continue;
++ goto err_loop;
+ }
+ cb->mii_bus->priv = cb;
+
+@@ -182,6 +192,10 @@ int mdio_mux_init(struct device *dev,
+
+ dev_err(dev, "Error: No acceptable child buses found\n");
+ devm_kfree(dev, pb);
++
++err_loop:
++ mdio_mux_uninit_children(pb);
++ of_node_put(child_bus_node);
+ err_pb_kz:
+ put_device(&parent_bus->dev);
+ err_parent_bus:
+@@ -193,14 +207,8 @@ EXPORT_SYMBOL_GPL(mdio_mux_init);
+ void mdio_mux_uninit(void *mux_handle)
+ {
+ struct mdio_mux_parent_bus *pb = mux_handle;
+- struct mdio_mux_child_bus *cb = pb->children;
+-
+- while (cb) {
+- mdiobus_unregister(cb->mii_bus);
+- mdiobus_free(cb->mii_bus);
+- cb = cb->next;
+- }
+
++ mdio_mux_uninit_children(pb);
+ put_device(&pb->mii_bus->dev);
+ }
+ EXPORT_SYMBOL_GPL(mdio_mux_uninit);
+--
+2.30.2
+
--- /dev/null
+From ff54e9bb2afcd37e8c23d0d799c3551f5421572a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 20:38:03 -0700
+Subject: net: mdio-mux: Handle -EPROBE_DEFER correctly
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit 7bd0cef5dac685f09ef8b0b2a7748ff42d284dc7 ]
+
+When registering mdiobus children, if we get an -EPROBE_DEFER, we shouldn't
+ignore it and continue registering the rest of the mdiobus children. This
+would permanently prevent the deferring child mdiobus from working instead
+of reattempting it in the future. So, if a child mdiobus needs to be
+reattempted in the future, defer the entire mdio-mux initialization.
+
+This fixes the issue where PHYs sitting under the mdio-mux aren't
+initialized correctly if the PHY's interrupt controller is not yet ready
+when the mdio-mux is being probed. Additional context in the link below.
+
+Fixes: 0ca2997d1452 ("netdev/of/phy: Add MDIO bus multiplexer support.")
+Link: https://lore.kernel.org/lkml/CAGETcx95kHrv8wA-O+-JtfH7H9biJEGJtijuPVN0V5dUKUAB3A@mail.gmail.com/#t
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Tested-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Kevin Hilman <khilman@baylibre.com>
+Tested-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/mdio/mdio-mux.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/mdio/mdio-mux.c b/drivers/net/mdio/mdio-mux.c
+index c96ef3b3fa3a..ccb3ee704eb1 100644
+--- a/drivers/net/mdio/mdio-mux.c
++++ b/drivers/net/mdio/mdio-mux.c
+@@ -175,11 +175,15 @@ int mdio_mux_init(struct device *dev,
+ cb->mii_bus->write = mdio_mux_write;
+ r = of_mdiobus_register(cb->mii_bus, child_bus_node);
+ if (r) {
++ mdiobus_free(cb->mii_bus);
++ if (r == -EPROBE_DEFER) {
++ ret_val = r;
++ goto err_loop;
++ }
++ devm_kfree(dev, cb);
+ dev_err(dev,
+ "Error: Failed to register MDIO bus for child %pOF\n",
+ child_bus_node);
+- mdiobus_free(cb->mii_bus);
+- devm_kfree(dev, cb);
+ } else {
+ cb->next = pb->children;
+ pb->children = cb;
+--
+2.30.2
+
--- /dev/null
+From 65717ed978a5b841ccf7cb8ebbe909b9a2f209e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 21:14:04 +0800
+Subject: net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 0a298d133893c72c96e2156ed7cb0f0c4a306a3e ]
+
+qlcnic_83xx_unlock_flash() is called on all paths after we call
+qlcnic_83xx_lock_flash(), except for one error path on failure
+of QLCRD32(), which may cause a deadlock. This bug is suggested
+by a static analysis tool, please advise.
+
+Fixes: 81d0aeb0a4fff ("qlcnic: flash template based firmware reset recovery")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Link: https://lore.kernel.org/r/20210816131405.24024-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+index d8882d0b6b49..d51bac7ba5af 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+@@ -3156,8 +3156,10 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr,
+
+ indirect_addr = QLC_83XX_FLASH_DIRECT_DATA(addr);
+ ret = QLCRD32(adapter, indirect_addr, &err);
+- if (err == -EIO)
++ if (err == -EIO) {
++ qlcnic_83xx_unlock_flash(adapter);
+ return err;
++ }
+
+ word = ret;
+ *(u32 *)p_data = word;
+--
+2.30.2
+
--- /dev/null
+From 8105e61167fcb04d2a26f52895a6d6c8efb93a2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 10:22:15 +0800
+Subject: ovs: clear skb->tstamp in forwarding path
+
+From: kaixi.fan <fankaixi.li@bytedance.com>
+
+[ Upstream commit 01634047bf0d5c2d9b7d8095bb4de1663dbeedeb ]
+
+fq qdisc requires tstamp to be cleared in the forwarding path. Now ovs
+doesn't clear skb->tstamp. We encountered a problem with linux
+version 5.4.56 and ovs version 2.14.1, and packets failed to
+dequeue from qdisc when fq qdisc was attached to ovs port.
+
+Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC")
+Signed-off-by: kaixi.fan <fankaixi.li@bytedance.com>
+Signed-off-by: xiexiaohui <xiexiaohui.xxh@bytedance.com>
+Reviewed-by: Cong Wang <cong.wang@bytedance.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/vport.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
+index 82d801f063b7..1c05d4bef331 100644
+--- a/net/openvswitch/vport.c
++++ b/net/openvswitch/vport.c
+@@ -503,6 +503,7 @@ void ovs_vport_send(struct vport *vport, struct sk_buff *skb, u8 mac_proto)
+ }
+
+ skb->dev = vport->dev;
++ skb->tstamp = 0;
+ vport->ops->send(skb);
+ return;
+
+--
+2.30.2
+
--- /dev/null
+From 3d99b5c3f24714d29215a6107be0a0b3d7063a20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 10:04:43 -0700
+Subject: pipe: avoid unnecessary EPOLLET wakeups under normal loads
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 3b844826b6c6affa80755254da322b017358a2f4 ]
+
+I had forgotten just how sensitive hackbench is to extra pipe wakeups,
+and commit 3a34b13a88ca ("pipe: make pipe writes always wake up
+readers") ended up causing a quite noticeable regression on larger
+machines.
+
+Now, hackbench isn't necessarily a hugely meaningful benchmark, and it's
+not clear that this matters in real life all that much, but as Mel
+points out, it's used often enough when comparing kernels and so the
+performance regression shows up like a sore thumb.
+
+It's easy enough to fix at least for the common cases where pipes are
+used purely for data transfer, and you never have any exciting poll
+usage at all. So set a special 'poll_usage' flag when there is polling
+activity, and make the ugly "EPOLLET has crazy legacy expectations"
+semantics explicit to only that case.
+
+I would love to limit it to just the broken EPOLLET case, but the pipe
+code can't see the difference between epoll and regular select/poll, so
+any non-read/write waiting will trigger the extra wakeup behavior. That
+is sufficient for at least the hackbench case.
+
+Apart from making the odd extra wakeup cases more explicitly about
+EPOLLET, this also makes the extra wakeup be at the _end_ of the pipe
+write, not at the first write chunk. That is actually much saner
+semantics (as much as you can call any of the legacy edge-triggered
+expectations for EPOLLET "sane") since it means that you know the wakeup
+will happen once the write is done, rather than possibly in the middle
+of one.
+
+[ For stable people: I'm putting a "Fixes" tag on this, but I leave it
+ up to you to decide whether you actually want to backport it or not.
+ It likely has no impact outside of synthetic benchmarks - Linus ]
+
+Link: https://lore.kernel.org/lkml/20210802024945.GA8372@xsang-OptiPlex-9020/
+Fixes: 3a34b13a88ca ("pipe: make pipe writes always wake up readers")
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Tested-by: Sandeep Patil <sspatil@android.com>
+Tested-by: Mel Gorman <mgorman@techsingularity.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pipe.c | 15 +++++++++------
+ include/linux/pipe_fs_i.h | 2 ++
+ 2 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 28b2e973f10e..48abe65333c4 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -444,9 +444,6 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
+ #endif
+
+ /*
+- * Epoll nonsensically wants a wakeup whether the pipe
+- * was already empty or not.
+- *
+ * If it wasn't empty we try to merge new data into
+ * the last buffer.
+ *
+@@ -455,9 +452,9 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
+ * spanning multiple pages.
+ */
+ head = pipe->head;
+- was_empty = true;
++ was_empty = pipe_empty(head, pipe->tail);
+ chars = total_len & (PAGE_SIZE-1);
+- if (chars && !pipe_empty(head, pipe->tail)) {
++ if (chars && !was_empty) {
+ unsigned int mask = pipe->ring_size - 1;
+ struct pipe_buffer *buf = &pipe->bufs[(head - 1) & mask];
+ int offset = buf->offset + buf->len;
+@@ -590,8 +587,11 @@ out:
+ * This is particularly important for small writes, because of
+ * how (for example) the GNU make jobserver uses small writes to
+ * wake up pending jobs
++ *
++ * Epoll nonsensically wants a wakeup whether the pipe
++ * was already empty or not.
+ */
+- if (was_empty) {
++ if (was_empty || pipe->poll_usage) {
+ wake_up_interruptible_sync_poll(&pipe->rd_wait, EPOLLIN | EPOLLRDNORM);
+ kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+ }
+@@ -654,6 +654,9 @@ pipe_poll(struct file *filp, poll_table *wait)
+ struct pipe_inode_info *pipe = filp->private_data;
+ unsigned int head, tail;
+
++ /* Epoll has some historical nasty semantics, this enables them */
++ pipe->poll_usage = 1;
++
+ /*
+ * Reading pipe state only -- no need for acquiring the semaphore.
+ *
+diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
+index 5d2705f1d01c..fc5642431b92 100644
+--- a/include/linux/pipe_fs_i.h
++++ b/include/linux/pipe_fs_i.h
+@@ -48,6 +48,7 @@ struct pipe_buffer {
+ * @files: number of struct file referring this pipe (protected by ->i_lock)
+ * @r_counter: reader counter
+ * @w_counter: writer counter
++ * @poll_usage: is this pipe used for epoll, which has crazy wakeups?
+ * @fasync_readers: reader side fasync
+ * @fasync_writers: writer side fasync
+ * @bufs: the circular array of pipe buffers
+@@ -70,6 +71,7 @@ struct pipe_inode_info {
+ unsigned int files;
+ unsigned int r_counter;
+ unsigned int w_counter;
++ unsigned int poll_usage;
+ struct page *tmp_page;
+ struct fasync_struct *fasync_readers;
+ struct fasync_struct *fasync_writers;
+--
+2.30.2
+
--- /dev/null
+From 76adf1446a1be6da4b1182a4b27305f05c9ee520 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 20:33:27 +0300
+Subject: ptp_pch: Restore dependency on PCI
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 55c8fca1dae1fb0d11deaa21b65a647dedb1bc50 ]
+
+During the swap dependency on PCH_GBE to selection PTP_1588_CLOCK_PCH
+incidentally dropped the implicit dependency on the PCI. Restore it.
+
+Fixes: 18d359ceb044 ("pch_gbe, ptp_pch: Fix the dependency direction between these drivers")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig
+index deb429a3dff1..3e377f3c69e5 100644
+--- a/drivers/ptp/Kconfig
++++ b/drivers/ptp/Kconfig
+@@ -90,7 +90,8 @@ config PTP_1588_CLOCK_INES
+ config PTP_1588_CLOCK_PCH
+ tristate "Intel PCH EG20T as PTP clock"
+ depends on X86_32 || COMPILE_TEST
+- depends on HAS_IOMEM && NET
++ depends on HAS_IOMEM && PCI
++ depends on NET
+ imply PTP_1588_CLOCK
+ help
+ This driver adds support for using the PCH EG20T as a PTP
+--
+2.30.2
+
--- /dev/null
+From 06be8bb1b147f5d55f2ed7139d34a59b71548a07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 11:05:36 +0800
+Subject: r8152: fix writing USB_BP2_EN
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit a876a33d2a1102f99fc782fefb784f4dd4841d8c ]
+
+The register of USB_BP2_EN is 16 bits, so we should use
+ocp_write_word(), not ocp_write_byte().
+
+Fixes: 9370f2d05a2a ("support request_firmware for RTL8153")
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 105622e1defa..0bb5b1c78654 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -3432,7 +3432,7 @@ static void rtl_clear_bp(struct r8152 *tp, u16 type)
+ case RTL_VER_09:
+ default:
+ if (type == MCU_TYPE_USB) {
+- ocp_write_byte(tp, MCU_TYPE_USB, USB_BP2_EN, 0);
++ ocp_write_word(tp, MCU_TYPE_USB, USB_BP2_EN, 0);
+
+ ocp_write_word(tp, MCU_TYPE_USB, USB_BP_8, 0);
+ ocp_write_word(tp, MCU_TYPE_USB, USB_BP_9, 0);
+--
+2.30.2
+
--- /dev/null
+From 88617e79c6c9525b58779924c43bd2cf2f854f08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 13:58:42 +0300
+Subject: Revert "flow_offload: action should not be NULL when it is
+ referenced"
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit fa05bdb89b01b098aad19ec0ebc4d1cc7b11177e ]
+
+This reverts commit 9ea3e52c5bc8bb4a084938dc1e3160643438927a.
+
+Cited commit added a check to make sure 'action' is not NULL, but
+'action' is already dereferenced before the check, when calling
+flow_offload_has_one_action().
+
+Therefore, the check does not make any sense and results in a smatch
+warning:
+
+include/net/flow_offload.h:322 flow_action_mixed_hw_stats_check() warn:
+variable dereferenced before check 'action' (see line 319)
+
+Fix by reverting this commit.
+
+Cc: gushengxian <gushengxian@yulong.com>
+Fixes: 9ea3e52c5bc8 ("flow_offload: action should not be NULL when it is referenced")
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Link: https://lore.kernel.org/r/20210819105842.1315705-1-idosch@idosch.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/flow_offload.h | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/include/net/flow_offload.h b/include/net/flow_offload.h
+index 161b90979038..123b1e9ea304 100644
+--- a/include/net/flow_offload.h
++++ b/include/net/flow_offload.h
+@@ -312,14 +312,12 @@ flow_action_mixed_hw_stats_check(const struct flow_action *action,
+ if (flow_offload_has_one_action(action))
+ return true;
+
+- if (action) {
+- flow_action_for_each(i, action_entry, action) {
+- if (i && action_entry->hw_stats != last_hw_stats) {
+- NL_SET_ERR_MSG_MOD(extack, "Mixing HW stats types for actions is not supported");
+- return false;
+- }
+- last_hw_stats = action_entry->hw_stats;
++ flow_action_for_each(i, action_entry, action) {
++ if (i && action_entry->hw_stats != last_hw_stats) {
++ NL_SET_ERR_MSG_MOD(extack, "Mixing HW stats types for actions is not supported");
++ return false;
+ }
++ last_hw_stats = action_entry->hw_stats;
+ }
+ return true;
+ }
+--
+2.30.2
+
--- /dev/null
+From e4203030e0fb590793570d76e039146e8a607cac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 13:59:17 +0200
+Subject: sch_cake: fix srchost/dsthost hashing mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 86b9bbd332d0510679c7fedcee3e3bd278be5756 ]
+
+When adding support for using the skb->hash value as the flow hash in CAKE,
+I accidentally introduced a logic error that broke the host-only isolation
+modes of CAKE (srchost and dsthost keywords). Specifically, the flow_hash
+variable should stay initialised to 0 in cake_hash() in pure host-based
+hashing mode. Add a check for this before using the skb->hash value as
+flow_hash.
+
+Fixes: b0c19ed6088a ("sch_cake: Take advantage of skb->hash where appropriate")
+Reported-by: Pete Heist <pete@heistp.net>
+Tested-by: Pete Heist <pete@heistp.net>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_cake.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
+index 5c15968b5155..c2c37ffd94f2 100644
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -720,7 +720,7 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb,
+ skip_hash:
+ if (flow_override)
+ flow_hash = flow_override - 1;
+- else if (use_skbhash)
++ else if (use_skbhash && (flow_mode & CAKE_FLOW_FLOWS))
+ flow_hash = skb->hash;
+ if (host_override) {
+ dsthost_hash = host_override - 1;
+--
+2.30.2
+
drm-amd-display-fix-dynamic-bpp-issue-with-8k30-with.patch
drm-amd-display-workaround-for-hard-hang-on-hpd-on-n.patch
bluetooth-hidp-use-correct-wait-queue-when-removing-.patch
+arm64-dts-qcom-c630-fix-correct-powerdown-pin-for-ws.patch
+arm64-dts-qcom-msm8992-bullhead-remove-psci.patch
+iommu-check-if-group-is-null-before-remove-device.patch
+cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch
+dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch
+virtio-protect-vqs-list-access.patch
+vhost-vdpa-fix-integer-overflow-in-vhost_vdpa_proces.patch
+bus-ti-sysc-fix-error-handling-for-sysc_check_active.patch
+vhost-fix-the-calculation-in-vhost_overflow.patch
+vdpa-mlx5-avoid-destroying-mr-on-empty-iotlb.patch
+soc-drm-mediatek-move-ddp-component-defines-into-mtk.patch
+drm-mediatek-fix-aal-size-config.patch
+drm-mediatek-add-aal-output-size-configuration.patch
+bpf-clear-zext_dst-of-dead-insns.patch
+bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch
+bnxt-disable-napi-before-canceling-dim.patch
+bnxt-make-sure-xmit_more-errors-does-not-miss-doorbe.patch
+bnxt-count-tx-drops.patch
+net-6pack-fix-slab-out-of-bounds-in-decode_data.patch
+ptp_pch-restore-dependency-on-pci.patch
+bnxt_en-disable-arfs-if-running-on-212-firmware.patch
+bnxt_en-add-missing-dma-memory-barriers.patch
+vrf-reset-skb-conntrack-connection-on-vrf-rcv.patch
+virtio-net-support-xdp-when-not-more-queues.patch
+virtio-net-use-netif_f_gro_hw-instead-of-netif_f_lro.patch
+net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch
+ixgbe-xsk-clean-up-the-resources-in-ixgbe_xsk_pool_e.patch
+sch_cake-fix-srchost-dsthost-hashing-mode.patch
+net-mdio-mux-don-t-ignore-memory-allocation-errors.patch
+net-mdio-mux-handle-eprobe_defer-correctly.patch
+ovs-clear-skb-tstamp-in-forwarding-path.patch
+iommu-vt-d-consolidate-duplicate-cache-invaliation-c.patch
+iommu-vt-d-fix-incomplete-cache-flush-in-intel_pasid.patch
+pipe-avoid-unnecessary-epollet-wakeups-under-normal-.patch
+r8152-fix-writing-usb_bp2_en.patch
+i40e-fix-atr-queue-selection.patch
+iavf-fix-ping-is-lost-after-untrusted-vf-had-tried-t.patch
+revert-flow_offload-action-should-not-be-null-when-i.patch
--- /dev/null
+From 76836af482c148d81071d6e40f57168ab92a502c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Oct 2020 21:33:17 +0200
+Subject: soc / drm: mediatek: Move DDP component defines into mtk-mmsys.h
+
+From: Yongqiang Niu <yongqiang.niu@mediatek.com>
+
+[ Upstream commit 51c0e618b219c025ddaaf14baea8942cb7e2105b ]
+
+MMSYS is the driver which controls the routing of these DDP components,
+so the definition of the mtk_ddp_comp_id enum should be placed in mtk-mmsys.h
+
+Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Reviewed-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Link: https://lore.kernel.org/r/20201006193320.405529-2-enric.balletbo@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h | 34 +--------------------
+ drivers/soc/mediatek/mtk-mmsys.c | 4 +--
+ include/linux/soc/mediatek/mtk-mmsys.h | 33 ++++++++++++++++++++
+ 3 files changed, 35 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h
+index 1d9e00b69462..5aa52b7afeec 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h
++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h
+@@ -7,6 +7,7 @@
+ #define MTK_DRM_DDP_COMP_H
+
+ #include <linux/io.h>
++#include <linux/soc/mediatek/mtk-mmsys.h>
+
+ struct device;
+ struct device_node;
+@@ -35,39 +36,6 @@ enum mtk_ddp_comp_type {
+ MTK_DDP_COMP_TYPE_MAX,
+ };
+
+-enum mtk_ddp_comp_id {
+- DDP_COMPONENT_AAL0,
+- DDP_COMPONENT_AAL1,
+- DDP_COMPONENT_BLS,
+- DDP_COMPONENT_CCORR,
+- DDP_COMPONENT_COLOR0,
+- DDP_COMPONENT_COLOR1,
+- DDP_COMPONENT_DITHER,
+- DDP_COMPONENT_DPI0,
+- DDP_COMPONENT_DPI1,
+- DDP_COMPONENT_DSI0,
+- DDP_COMPONENT_DSI1,
+- DDP_COMPONENT_DSI2,
+- DDP_COMPONENT_DSI3,
+- DDP_COMPONENT_GAMMA,
+- DDP_COMPONENT_OD0,
+- DDP_COMPONENT_OD1,
+- DDP_COMPONENT_OVL0,
+- DDP_COMPONENT_OVL_2L0,
+- DDP_COMPONENT_OVL_2L1,
+- DDP_COMPONENT_OVL1,
+- DDP_COMPONENT_PWM0,
+- DDP_COMPONENT_PWM1,
+- DDP_COMPONENT_PWM2,
+- DDP_COMPONENT_RDMA0,
+- DDP_COMPONENT_RDMA1,
+- DDP_COMPONENT_RDMA2,
+- DDP_COMPONENT_UFOE,
+- DDP_COMPONENT_WDMA0,
+- DDP_COMPONENT_WDMA1,
+- DDP_COMPONENT_ID_MAX,
+-};
+-
+ struct mtk_ddp_comp;
+ struct cmdq_pkt;
+ struct mtk_ddp_comp_funcs {
+diff --git a/drivers/soc/mediatek/mtk-mmsys.c b/drivers/soc/mediatek/mtk-mmsys.c
+index a55f25511173..36ad66bb221b 100644
+--- a/drivers/soc/mediatek/mtk-mmsys.c
++++ b/drivers/soc/mediatek/mtk-mmsys.c
+@@ -5,13 +5,11 @@
+ */
+
+ #include <linux/device.h>
++#include <linux/io.h>
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ #include <linux/soc/mediatek/mtk-mmsys.h>
+
+-#include "../../gpu/drm/mediatek/mtk_drm_ddp.h"
+-#include "../../gpu/drm/mediatek/mtk_drm_ddp_comp.h"
+-
+ #define DISP_REG_CONFIG_DISP_OVL0_MOUT_EN 0x040
+ #define DISP_REG_CONFIG_DISP_OVL1_MOUT_EN 0x044
+ #define DISP_REG_CONFIG_DISP_OD_MOUT_EN 0x048
+diff --git a/include/linux/soc/mediatek/mtk-mmsys.h b/include/linux/soc/mediatek/mtk-mmsys.h
+index 7bab5d9a3d31..2228bf6133da 100644
+--- a/include/linux/soc/mediatek/mtk-mmsys.h
++++ b/include/linux/soc/mediatek/mtk-mmsys.h
+@@ -9,6 +9,39 @@
+ enum mtk_ddp_comp_id;
+ struct device;
+
++enum mtk_ddp_comp_id {
++ DDP_COMPONENT_AAL0,
++ DDP_COMPONENT_AAL1,
++ DDP_COMPONENT_BLS,
++ DDP_COMPONENT_CCORR,
++ DDP_COMPONENT_COLOR0,
++ DDP_COMPONENT_COLOR1,
++ DDP_COMPONENT_DITHER,
++ DDP_COMPONENT_DPI0,
++ DDP_COMPONENT_DPI1,
++ DDP_COMPONENT_DSI0,
++ DDP_COMPONENT_DSI1,
++ DDP_COMPONENT_DSI2,
++ DDP_COMPONENT_DSI3,
++ DDP_COMPONENT_GAMMA,
++ DDP_COMPONENT_OD0,
++ DDP_COMPONENT_OD1,
++ DDP_COMPONENT_OVL0,
++ DDP_COMPONENT_OVL_2L0,
++ DDP_COMPONENT_OVL_2L1,
++ DDP_COMPONENT_OVL1,
++ DDP_COMPONENT_PWM0,
++ DDP_COMPONENT_PWM1,
++ DDP_COMPONENT_PWM2,
++ DDP_COMPONENT_RDMA0,
++ DDP_COMPONENT_RDMA1,
++ DDP_COMPONENT_RDMA2,
++ DDP_COMPONENT_UFOE,
++ DDP_COMPONENT_WDMA0,
++ DDP_COMPONENT_WDMA1,
++ DDP_COMPONENT_ID_MAX,
++};
++
+ void mtk_mmsys_ddp_connect(struct device *dev,
+ enum mtk_ddp_comp_id cur,
+ enum mtk_ddp_comp_id next);
+--
+2.30.2
+
--- /dev/null
+From 8bc18ce78d58f28a029ad98894aa6dad07dfd555 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 08:37:13 +0300
+Subject: vdpa/mlx5: Avoid destroying MR on empty iotlb
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit 08dbd5660232bede7916d8568003012c1182cc9a ]
+
+The current code treats an empty iotlb provdied in set_map() as a
+special case and destroy the memory region object. This must not be done
+since the virtqueue objects reference this MR. Doing so will cause the
+driver unload to emit errors and log timeouts caused by the firmware
+complaining on busy resources.
+
+This patch treats an empty iotlb as any other change of mapping. In this
+case, mlx5_vdpa_create_mr() will fail and the entire set_map() call to
+fail.
+
+This issue has not been encountered before but was seen to occur in a
+non-official version of qemu. Since qemu is a userspace program, the
+driver must protect against such case.
+
+Fixes: 94abbccdf291 ("vdpa/mlx5: Add shared memory registration code")
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Link: https://lore.kernel.org/r/20210811053713.66658-1-elic@nvidia.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/mlx5/core/mr.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c
+index aa656f57bf5b..32c9925de473 100644
+--- a/drivers/vdpa/mlx5/core/mr.c
++++ b/drivers/vdpa/mlx5/core/mr.c
+@@ -454,11 +454,6 @@ out:
+ mutex_unlock(&mr->mkey_mtx);
+ }
+
+-static bool map_empty(struct vhost_iotlb *iotlb)
+-{
+- return !vhost_iotlb_itree_first(iotlb, 0, U64_MAX);
+-}
+-
+ int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
+ bool *change_map)
+ {
+@@ -466,10 +461,6 @@ int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *io
+ int err = 0;
+
+ *change_map = false;
+- if (map_empty(iotlb)) {
+- mlx5_vdpa_destroy_mr(mvdev);
+- return 0;
+- }
+ mutex_lock(&mr->mkey_mtx);
+ if (mr->initialized) {
+ mlx5_vdpa_info(mvdev, "memory map update\n");
+--
+2.30.2
+
--- /dev/null
+From 1938851a5839b463757a9de857a3c1197d9eb23d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 21:07:56 +0800
+Subject: vhost: Fix the calculation in vhost_overflow()
+
+From: Xie Yongji <xieyongji@bytedance.com>
+
+[ Upstream commit f7ad318ea0ad58ebe0e595e59aed270bb643b29b ]
+
+This fixes the incorrect calculation for integer overflow
+when the last address of iova range is 0xffffffff.
+
+Fixes: ec33d031a14b ("vhost: detect 32 bit integer wrap around")
+Reported-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://lore.kernel.org/r/20210728130756.97-2-xieyongji@bytedance.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vhost.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 5ccb0705beae..f41463ab4031 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -735,10 +735,16 @@ static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz)
+ (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8);
+ }
+
++/* Make sure 64 bit math will not overflow. */
+ static bool vhost_overflow(u64 uaddr, u64 size)
+ {
+- /* Make sure 64 bit math will not overflow. */
+- return uaddr > ULONG_MAX || size > ULONG_MAX || uaddr > ULONG_MAX - size;
++ if (uaddr > ULONG_MAX || size > ULONG_MAX)
++ return true;
++
++ if (!size)
++ return false;
++
++ return uaddr > ULONG_MAX - size + 1;
+ }
+
+ /* Caller should have vq mutex and device mutex. */
+--
+2.30.2
+
--- /dev/null
+From 2b02d1dea8f0f73d4581d48048776bde55e065e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 21:07:55 +0800
+Subject: vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update()
+
+From: Xie Yongji <xieyongji@bytedance.com>
+
+[ Upstream commit 0e398290cff997610b66e73573faaee70c9a700e ]
+
+The "msg->iova + msg->size" addition can have an integer overflow
+if the iotlb message is from a malicious user space application.
+So let's fix it.
+
+Fixes: 1b48dc03e575 ("vhost: vdpa: report iova range")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://lore.kernel.org/r/20210728130756.97-1-xieyongji@bytedance.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vdpa.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
+index 80184153ac7d..c4d53ff06bf8 100644
+--- a/drivers/vhost/vdpa.c
++++ b/drivers/vhost/vdpa.c
+@@ -623,7 +623,8 @@ static int vhost_vdpa_process_iotlb_update(struct vhost_vdpa *v,
+ long pinned;
+ int ret = 0;
+
+- if (msg->iova < v->range.first ||
++ if (msg->iova < v->range.first || !msg->size ||
++ msg->iova > U64_MAX - msg->size + 1 ||
+ msg->iova + msg->size - 1 > v->range.last)
+ return -EINVAL;
+
+--
+2.30.2
+
--- /dev/null
+From 763e0b11d269494862e97eab8ea24d2d31fdce32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Mar 2021 10:24:45 +0800
+Subject: virtio-net: support XDP when not more queues
+
+From: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+
+[ Upstream commit 97c2c69e1926260c78c7f1c0b2c987934f1dc7a1 ]
+
+The number of queues implemented by many virtio backends is limited,
+especially some machines have a large number of CPUs. In this case, it
+is often impossible to allocate a separate queue for
+XDP_TX/XDP_REDIRECT, then xdp cannot be loaded to work, even xdp does
+not use the XDP_TX/XDP_REDIRECT.
+
+This patch allows XDP_TX/XDP_REDIRECT to run by reuse the existing SQ
+with __netif_tx_lock() hold when there are not enough queues.
+
+Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 62 +++++++++++++++++++++++++++++++---------
+ 1 file changed, 49 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 7d1f609306f9..a47cf77a0b08 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -195,6 +195,9 @@ struct virtnet_info {
+ /* # of XDP queue pairs currently used by the driver */
+ u16 xdp_queue_pairs;
+
++ /* xdp_queue_pairs may be 0, when xdp is already loaded. So add this. */
++ bool xdp_enabled;
++
+ /* I like... big packets and I cannot lie! */
+ bool big_packets;
+
+@@ -485,12 +488,41 @@ static int __virtnet_xdp_xmit_one(struct virtnet_info *vi,
+ return 0;
+ }
+
+-static struct send_queue *virtnet_xdp_sq(struct virtnet_info *vi)
+-{
+- unsigned int qp;
+-
+- qp = vi->curr_queue_pairs - vi->xdp_queue_pairs + smp_processor_id();
+- return &vi->sq[qp];
++/* when vi->curr_queue_pairs > nr_cpu_ids, the txq/sq is only used for xdp tx on
++ * the current cpu, so it does not need to be locked.
++ *
++ * Here we use marco instead of inline functions because we have to deal with
++ * three issues at the same time: 1. the choice of sq. 2. judge and execute the
++ * lock/unlock of txq 3. make sparse happy. It is difficult for two inline
++ * functions to perfectly solve these three problems at the same time.
++ */
++#define virtnet_xdp_get_sq(vi) ({ \
++ struct netdev_queue *txq; \
++ typeof(vi) v = (vi); \
++ unsigned int qp; \
++ \
++ if (v->curr_queue_pairs > nr_cpu_ids) { \
++ qp = v->curr_queue_pairs - v->xdp_queue_pairs; \
++ qp += smp_processor_id(); \
++ txq = netdev_get_tx_queue(v->dev, qp); \
++ __netif_tx_acquire(txq); \
++ } else { \
++ qp = smp_processor_id() % v->curr_queue_pairs; \
++ txq = netdev_get_tx_queue(v->dev, qp); \
++ __netif_tx_lock(txq, raw_smp_processor_id()); \
++ } \
++ v->sq + qp; \
++})
++
++#define virtnet_xdp_put_sq(vi, q) { \
++ struct netdev_queue *txq; \
++ typeof(vi) v = (vi); \
++ \
++ txq = netdev_get_tx_queue(v->dev, (q) - v->sq); \
++ if (v->curr_queue_pairs > nr_cpu_ids) \
++ __netif_tx_release(txq); \
++ else \
++ __netif_tx_unlock(txq); \
+ }
+
+ static int virtnet_xdp_xmit(struct net_device *dev,
+@@ -516,7 +548,7 @@ static int virtnet_xdp_xmit(struct net_device *dev,
+ if (!xdp_prog)
+ return -ENXIO;
+
+- sq = virtnet_xdp_sq(vi);
++ sq = virtnet_xdp_get_sq(vi);
+
+ if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
+ ret = -EINVAL;
+@@ -564,12 +596,13 @@ out:
+ sq->stats.kicks += kicks;
+ u64_stats_update_end(&sq->stats.syncp);
+
++ virtnet_xdp_put_sq(vi, sq);
+ return ret;
+ }
+
+ static unsigned int virtnet_get_headroom(struct virtnet_info *vi)
+ {
+- return vi->xdp_queue_pairs ? VIRTIO_XDP_HEADROOM : 0;
++ return vi->xdp_enabled ? VIRTIO_XDP_HEADROOM : 0;
+ }
+
+ /* We copy the packet for XDP in the following cases:
+@@ -1473,12 +1506,13 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
+ xdp_do_flush();
+
+ if (xdp_xmit & VIRTIO_XDP_TX) {
+- sq = virtnet_xdp_sq(vi);
++ sq = virtnet_xdp_get_sq(vi);
+ if (virtqueue_kick_prepare(sq->vq) && virtqueue_notify(sq->vq)) {
+ u64_stats_update_begin(&sq->stats.syncp);
+ sq->stats.kicks++;
+ u64_stats_update_end(&sq->stats.syncp);
+ }
++ virtnet_xdp_put_sq(vi, sq);
+ }
+
+ return received;
+@@ -2453,10 +2487,9 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
+
+ /* XDP requires extra queues for XDP_TX */
+ if (curr_qp + xdp_qp > vi->max_queue_pairs) {
+- NL_SET_ERR_MSG_MOD(extack, "Too few free TX rings available");
+- netdev_warn(dev, "request %i queues but max is %i\n",
++ netdev_warn(dev, "XDP request %i queues but max is %i. XDP_TX and XDP_REDIRECT will operate in a slower locked tx mode.\n",
+ curr_qp + xdp_qp, vi->max_queue_pairs);
+- return -ENOMEM;
++ xdp_qp = 0;
+ }
+
+ old_prog = rtnl_dereference(vi->rq[0].xdp_prog);
+@@ -2490,11 +2523,14 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
+ vi->xdp_queue_pairs = xdp_qp;
+
+ if (prog) {
++ vi->xdp_enabled = true;
+ for (i = 0; i < vi->max_queue_pairs; i++) {
+ rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
+ if (i == 0 && !old_prog)
+ virtnet_clear_guest_offloads(vi);
+ }
++ } else {
++ vi->xdp_enabled = false;
+ }
+
+ for (i = 0; i < vi->max_queue_pairs; i++) {
+@@ -2562,7 +2598,7 @@ static int virtnet_set_features(struct net_device *dev,
+ int err;
+
+ if ((dev->features ^ features) & NETIF_F_LRO) {
+- if (vi->xdp_queue_pairs)
++ if (vi->xdp_enabled)
+ return -EBUSY;
+
+ if (features & NETIF_F_LRO)
+--
+2.30.2
+
--- /dev/null
+From c0441e76930e7798e0533ccacbe8221e16391f52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 16:06:59 +0800
+Subject: virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO
+
+From: Jason Wang <jasowang@redhat.com>
+
+[ Upstream commit dbcf24d153884439dad30484a0e3f02350692e4c ]
+
+Commit a02e8964eaf92 ("virtio-net: ethtool configurable LRO")
+maps LRO to virtio guest offloading features and allows the
+administrator to enable and disable those features via ethtool.
+
+This leads to several issues:
+
+- For a device that doesn't support control guest offloads, the "LRO"
+ can't be disabled triggering WARN in dev_disable_lro() when turning
+ off LRO or when enabling forwarding bridging etc.
+
+- For a device that supports control guest offloads, the guest
+ offloads are disabled in cases of bridging, forwarding etc slowing
+ down the traffic.
+
+Fix this by using NETIF_F_GRO_HW instead. Though the spec does not
+guarantee packets to be re-segmented as the original ones,
+we can add that to the spec, possibly with a flag for devices to
+differentiate between GRO and LRO.
+
+Further, we never advertised LRO historically before a02e8964eaf92
+("virtio-net: ethtool configurable LRO") and so bridged/forwarded
+configs effectively always relied on virtio receive offloads behaving
+like GRO - thus even if this breaks any configs it is at least not
+a regression.
+
+Fixes: a02e8964eaf92 ("virtio-net: ethtool configurable LRO")
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Reported-by: Ivan <ivan@prestigetransportation.com>
+Tested-by: Ivan <ivan@prestigetransportation.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index a47cf77a0b08..cbe47eed7cc3 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -63,7 +63,7 @@ static const unsigned long guest_offloads[] = {
+ VIRTIO_NET_F_GUEST_CSUM
+ };
+
+-#define GUEST_OFFLOAD_LRO_MASK ((1ULL << VIRTIO_NET_F_GUEST_TSO4) | \
++#define GUEST_OFFLOAD_GRO_HW_MASK ((1ULL << VIRTIO_NET_F_GUEST_TSO4) | \
+ (1ULL << VIRTIO_NET_F_GUEST_TSO6) | \
+ (1ULL << VIRTIO_NET_F_GUEST_ECN) | \
+ (1ULL << VIRTIO_NET_F_GUEST_UFO))
+@@ -2466,7 +2466,7 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
+ virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_ECN) ||
+ virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO) ||
+ virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))) {
+- NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO/CSUM, disable LRO/CSUM first");
++ NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing GRO_HW/CSUM, disable GRO_HW/CSUM first");
+ return -EOPNOTSUPP;
+ }
+
+@@ -2597,15 +2597,15 @@ static int virtnet_set_features(struct net_device *dev,
+ u64 offloads;
+ int err;
+
+- if ((dev->features ^ features) & NETIF_F_LRO) {
++ if ((dev->features ^ features) & NETIF_F_GRO_HW) {
+ if (vi->xdp_enabled)
+ return -EBUSY;
+
+- if (features & NETIF_F_LRO)
++ if (features & NETIF_F_GRO_HW)
+ offloads = vi->guest_offloads_capable;
+ else
+ offloads = vi->guest_offloads_capable &
+- ~GUEST_OFFLOAD_LRO_MASK;
++ ~GUEST_OFFLOAD_GRO_HW_MASK;
+
+ err = virtnet_set_guest_offloads(vi, offloads);
+ if (err)
+@@ -3080,9 +3080,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ dev->features |= NETIF_F_RXCSUM;
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
+ virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6))
+- dev->features |= NETIF_F_LRO;
++ dev->features |= NETIF_F_GRO_HW;
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_GUEST_OFFLOADS))
+- dev->hw_features |= NETIF_F_LRO;
++ dev->hw_features |= NETIF_F_GRO_HW;
+
+ dev->vlan_features = dev->features;
+
+--
+2.30.2
+
--- /dev/null
+From 6eb9d7e5ed44b6101ff89dd5eeea889c470e83b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 17:26:47 +0300
+Subject: virtio: Protect vqs list access
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 0e566c8f0f2e8325e35f6f97e13cde5356b41814 ]
+
+VQs may be accessed to mark the device broken while they are
+created/destroyed. Hence protect the access to the vqs list.
+
+Fixes: e2dcdfe95c0b ("virtio: virtio_break_device() to mark all virtqueues broken.")
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Link: https://lore.kernel.org/r/20210721142648.1525924-4-parav@nvidia.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio.c | 1 +
+ drivers/virtio/virtio_ring.c | 8 ++++++++
+ include/linux/virtio.h | 1 +
+ 3 files changed, 10 insertions(+)
+
+diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
+index 42e09cc1b8ac..84b5dec5d29c 100644
+--- a/drivers/virtio/virtio.c
++++ b/drivers/virtio/virtio.c
+@@ -357,6 +357,7 @@ int register_virtio_device(struct virtio_device *dev)
+ virtio_add_status(dev, VIRTIO_CONFIG_S_ACKNOWLEDGE);
+
+ INIT_LIST_HEAD(&dev->vqs);
++ spin_lock_init(&dev->vqs_list_lock);
+
+ /*
+ * device_add() causes the bus infrastructure to look for a matching
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 71e16b53e9c1..6b7aa26c5384 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -1668,7 +1668,9 @@ static struct virtqueue *vring_create_virtqueue_packed(
+ cpu_to_le16(vq->packed.event_flags_shadow);
+ }
+
++ spin_lock(&vdev->vqs_list_lock);
+ list_add_tail(&vq->vq.list, &vdev->vqs);
++ spin_unlock(&vdev->vqs_list_lock);
+ return &vq->vq;
+
+ err_desc_extra:
+@@ -2126,7 +2128,9 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
+ memset(vq->split.desc_state, 0, vring.num *
+ sizeof(struct vring_desc_state_split));
+
++ spin_lock(&vdev->vqs_list_lock);
+ list_add_tail(&vq->vq.list, &vdev->vqs);
++ spin_unlock(&vdev->vqs_list_lock);
+ return &vq->vq;
+ }
+ EXPORT_SYMBOL_GPL(__vring_new_virtqueue);
+@@ -2210,7 +2214,9 @@ void vring_del_virtqueue(struct virtqueue *_vq)
+ }
+ if (!vq->packed_ring)
+ kfree(vq->split.desc_state);
++ spin_lock(&vq->vq.vdev->vqs_list_lock);
+ list_del(&_vq->list);
++ spin_unlock(&vq->vq.vdev->vqs_list_lock);
+ kfree(vq);
+ }
+ EXPORT_SYMBOL_GPL(vring_del_virtqueue);
+@@ -2274,10 +2280,12 @@ void virtio_break_device(struct virtio_device *dev)
+ {
+ struct virtqueue *_vq;
+
++ spin_lock(&dev->vqs_list_lock);
+ list_for_each_entry(_vq, &dev->vqs, list) {
+ struct vring_virtqueue *vq = to_vvq(_vq);
+ vq->broken = true;
+ }
++ spin_unlock(&dev->vqs_list_lock);
+ }
+ EXPORT_SYMBOL_GPL(virtio_break_device);
+
+diff --git a/include/linux/virtio.h b/include/linux/virtio.h
+index 55ea329fe72a..8ecc2e208d61 100644
+--- a/include/linux/virtio.h
++++ b/include/linux/virtio.h
+@@ -110,6 +110,7 @@ struct virtio_device {
+ bool config_enabled;
+ bool config_change_pending;
+ spinlock_t config_lock;
++ spinlock_t vqs_list_lock; /* Protects VQs list access */
+ struct device dev;
+ struct virtio_device_id id;
+ const struct virtio_config_ops *config;
+--
+2.30.2
+
--- /dev/null
+From 887975d0f7a3ba97e25ffc3890ac05a2e924ce98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Aug 2021 12:00:02 +0000
+Subject: vrf: Reset skb conntrack connection on VRF rcv
+
+From: Lahav Schlesinger <lschlesinger@drivenets.com>
+
+[ Upstream commit 09e856d54bda5f288ef8437a90ab2b9b3eab83d1 ]
+
+To fix the "reverse-NAT" for replies.
+
+When a packet is sent over a VRF, the POST_ROUTING hooks are called
+twice: Once from the VRF interface, and once from the "actual"
+interface the packet will be sent from:
+1) First SNAT: l3mdev_l3_out() -> vrf_l3_out() -> .. -> vrf_output_direct()
+ This causes the POST_ROUTING hooks to run.
+2) Second SNAT: 'ip_output()' calls POST_ROUTING hooks again.
+
+Similarly for replies, first ip_rcv() calls PRE_ROUTING hooks, and
+second vrf_l3_rcv() calls them again.
+
+As an example, consider the following SNAT rule:
+> iptables -t nat -A POSTROUTING -p udp -m udp --dport 53 -j SNAT --to-source 2.2.2.2 -o vrf_1
+
+In this case sending over a VRF will create 2 conntrack entries.
+The first is from the VRF interface, which performs the IP SNAT.
+The second will run the SNAT, but since the "expected reply" will remain
+the same, conntrack randomizes the source port of the packet:
+e..g With a socket bound to 1.1.1.1:10000, sending to 3.3.3.3:53, the conntrack
+rules are:
+udp 17 29 src=2.2.2.2 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 [UNREPLIED] src=3.3.3.3 dst=2.2.2.2 sport=53 dport=61033 packets=0 bytes=0 mark=0 use=1
+udp 17 29 src=1.1.1.1 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 [UNREPLIED] src=3.3.3.3 dst=2.2.2.2 sport=53 dport=10000 packets=0 bytes=0 mark=0 use=1
+
+i.e. First SNAT IP from 1.1.1.1 --> 2.2.2.2, and second the src port is
+SNAT-ed from 10000 --> 61033.
+
+But when a reply is sent (3.3.3.3:53 -> 2.2.2.2:61033) only the later
+conntrack entry is matched:
+udp 17 29 src=2.2.2.2 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 src=3.3.3.3 dst=2.2.2.2 sport=53 dport=61033 packets=1 bytes=49 mark=0 use=1
+udp 17 28 src=1.1.1.1 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 [UNREPLIED] src=3.3.3.3 dst=2.2.2.2 sport=53 dport=10000 packets=0 bytes=0 mark=0 use=1
+
+And a "port 61033 unreachable" ICMP packet is sent back.
+
+The issue is that when PRE_ROUTING hooks are called from vrf_l3_rcv(),
+the skb already has a conntrack flow attached to it, which means
+nf_conntrack_in() will not resolve the flow again.
+
+This means only the dest port is "reverse-NATed" (61033 -> 10000) but
+the dest IP remains 2.2.2.2, and since the socket is bound to 1.1.1.1 it's
+not received.
+This can be verified by logging the 4-tuple of the packet in '__udp4_lib_rcv()'.
+
+The fix is then to reset the flow when skb is received on a VRF, to let
+conntrack resolve the flow again (which now will hit the earlier flow).
+
+To reproduce: (Without the fix "Got pkt_to_nat_port" will not be printed by
+ running 'bash ./repro'):
+ $ cat run_in_A1.py
+ import logging
+ logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
+ from scapy.all import *
+ import argparse
+
+ def get_packet_to_send(udp_dst_port, msg_name):
+ return Ether(src='11:22:33:44:55:66', dst=iface_mac)/ \
+ IP(src='3.3.3.3', dst='2.2.2.2')/ \
+ UDP(sport=53, dport=udp_dst_port)/ \
+ Raw(f'{msg_name}\x0012345678901234567890')
+
+ parser = argparse.ArgumentParser()
+ parser.add_argument('-iface_mac', dest="iface_mac", type=str, required=True,
+ help="From run_in_A3.py")
+ parser.add_argument('-socket_port', dest="socket_port", type=str,
+ required=True, help="From run_in_A3.py")
+ parser.add_argument('-v1_mac', dest="v1_mac", type=str, required=True,
+ help="From script")
+
+ args, _ = parser.parse_known_args()
+ iface_mac = args.iface_mac
+ socket_port = int(args.socket_port)
+ v1_mac = args.v1_mac
+
+ print(f'Source port before NAT: {socket_port}')
+
+ while True:
+ pkts = sniff(iface='_v0', store=True, count=1, timeout=10)
+ if 0 == len(pkts):
+ print('Something failed, rerun the script :(', flush=True)
+ break
+ pkt = pkts[0]
+ if not pkt.haslayer('UDP'):
+ continue
+
+ pkt_sport = pkt.getlayer('UDP').sport
+ print(f'Source port after NAT: {pkt_sport}', flush=True)
+
+ pkt_to_send = get_packet_to_send(pkt_sport, 'pkt_to_nat_port')
+ sendp(pkt_to_send, '_v0', verbose=False) # Will not be received
+
+ pkt_to_send = get_packet_to_send(socket_port, 'pkt_to_socket_port')
+ sendp(pkt_to_send, '_v0', verbose=False)
+ break
+
+ $ cat run_in_A2.py
+ import socket
+ import netifaces
+
+ print(f"{netifaces.ifaddresses('e00000')[netifaces.AF_LINK][0]['addr']}",
+ flush=True)
+ s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+ s.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE,
+ str('vrf_1' + '\0').encode('utf-8'))
+ s.connect(('3.3.3.3', 53))
+ print(f'{s. getsockname()[1]}', flush=True)
+ s.settimeout(5)
+
+ while True:
+ try:
+ # Periodically send in order to keep the conntrack entry alive.
+ s.send(b'a'*40)
+ resp = s.recvfrom(1024)
+ msg_name = resp[0].decode('utf-8').split('\0')[0]
+ print(f"Got {msg_name}", flush=True)
+ except Exception as e:
+ pass
+
+ $ cat repro.sh
+ ip netns del A1 2> /dev/null
+ ip netns del A2 2> /dev/null
+ ip netns add A1
+ ip netns add A2
+
+ ip -n A1 link add _v0 type veth peer name _v1 netns A2
+ ip -n A1 link set _v0 up
+
+ ip -n A2 link add e00000 type bond
+ ip -n A2 link add lo0 type dummy
+ ip -n A2 link add vrf_1 type vrf table 10001
+ ip -n A2 link set vrf_1 up
+ ip -n A2 link set e00000 master vrf_1
+
+ ip -n A2 addr add 1.1.1.1/24 dev e00000
+ ip -n A2 link set e00000 up
+ ip -n A2 link set _v1 master e00000
+ ip -n A2 link set _v1 up
+ ip -n A2 link set lo0 up
+ ip -n A2 addr add 2.2.2.2/32 dev lo0
+
+ ip -n A2 neigh add 1.1.1.10 lladdr 77:77:77:77:77:77 dev e00000
+ ip -n A2 route add 3.3.3.3/32 via 1.1.1.10 dev e00000 table 10001
+
+ ip netns exec A2 iptables -t nat -A POSTROUTING -p udp -m udp --dport 53 -j \
+ SNAT --to-source 2.2.2.2 -o vrf_1
+
+ sleep 5
+ ip netns exec A2 python3 run_in_A2.py > x &
+ XPID=$!
+ sleep 5
+
+ IFACE_MAC=`sed -n 1p x`
+ SOCKET_PORT=`sed -n 2p x`
+ V1_MAC=`ip -n A2 link show _v1 | sed -n 2p | awk '{print $2'}`
+ ip netns exec A1 python3 run_in_A1.py -iface_mac ${IFACE_MAC} -socket_port \
+ ${SOCKET_PORT} -v1_mac ${SOCKET_PORT}
+ sleep 5
+
+ kill -9 $XPID
+ wait $XPID 2> /dev/null
+ ip netns del A1
+ ip netns del A2
+ tail x -n 2
+ rm x
+ set +x
+
+Fixes: 73e20b761acf ("net: vrf: Add support for PREROUTING rules on vrf device")
+Signed-off-by: Lahav Schlesinger <lschlesinger@drivenets.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/20210815120002.2787653-1-lschlesinger@drivenets.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vrf.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
+index 2746f77745e4..d406da82b4fb 100644
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -1313,6 +1313,8 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
+ bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
+ bool is_ndisc = ipv6_ndisc_frame(skb);
+
++ nf_reset_ct(skb);
++
+ /* loopback, multicast & non-ND link-local traffic; do not push through
+ * packet taps again. Reset pkt_type for upper layers to process skb.
+ * For strict packets with a source LLA, determine the dst using the
+@@ -1369,6 +1371,8 @@ static struct sk_buff *vrf_ip_rcv(struct net_device *vrf_dev,
+ skb->skb_iif = vrf_dev->ifindex;
+ IPCB(skb)->flags |= IPSKB_L3SLAVE;
+
++ nf_reset_ct(skb);
++
+ if (ipv4_is_multicast(ip_hdr(skb)->daddr))
+ goto out;
+
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
