--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+Date: Tue, 17 Nov 2020 10:45:05 +0800
+Subject: ah6: fix error return code in ah6_input()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit a5ebcbdf34b65fcc07f38eaf2d60563b42619a59 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Link: https://lore.kernel.org/r/1605581105-35295-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ah6.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -588,7 +588,8 @@ static int ah6_input(struct xfrm_state *
+ memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+ memset(ah->auth_data, 0, ahp->icv_trunc_len);
+
+- if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN))
++ err = ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN);
++ if (err)
+ goto out_free;
+
+ ip6h->priority = 0;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Mon, 16 Nov 2020 17:21:14 +0100
+Subject: atm: nicstar: Unmap DMA on send error
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 6dceaa9f56e22d0f9b4c4ad2ed9e04e315ce7fe5 ]
+
+The `skb' is mapped for DMA in ns_send() but does not unmap DMA in case
+push_scqe() fails to submit the `skb'. The memory of the `skb' is
+released so only the DMA mapping is leaking.
+
+Unmap the DMA mapping in case push_scqe() failed.
+
+Fixes: 864a3ff635fa7 ("atm: [nicstar] remove virt_to_bus() and support 64-bit platforms")
+Cc: Chas Williams <3chas3@gmail.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/atm/nicstar.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/atm/nicstar.c
++++ b/drivers/atm/nicstar.c
+@@ -1706,6 +1706,8 @@ static int ns_send(struct atm_vcc *vcc,
+
+ if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
+ atomic_inc(&vcc->stats->tx_err);
++ dma_unmap_single(&card->pcidev->dev, NS_PRV_DMA(skb), skb->len,
++ DMA_TO_DEVICE);
+ dev_kfree_skb_any(skb);
+ return -EIO;
+ }
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Sun, 15 Nov 2020 19:27:51 -0500
+Subject: bnxt_en: Fix counter overflow logic.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit fa97f303fa4cf8469fd3d1ef29da69c0a3f6ddc8 ]
+
+bnxt_add_one_ctr() adds a hardware counter to a software counter and
+adjusts for the hardware counter wraparound against the mask. The logic
+assumes that the hardware counter is always smaller than or equal to
+the mask.
+
+This assumption is mostly correct. But in some cases if the firmware
+is older and does not provide the accurate mask, the driver can use
+a mask that is smaller than the actual hardware mask. This can cause
+some extra carry bits to be added to the software counter, resulting in
+counters that far exceed the actual value. Fix it by masking the
+hardware counter with the mask passed into bnxt_add_one_ctr().
+
+Fixes: fea6b3335527 ("bnxt_en: Accumulate all counters.")
+Reviewed-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -7617,6 +7617,7 @@ static void bnxt_add_one_ctr(u64 hw, u64
+ {
+ u64 sw_tmp;
+
++ hw &= mask;
+ sw_tmp = (*sw & ~mask) | hw;
+ if (hw < (*sw & mask))
+ sw_tmp += mask + 1;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Sun, 15 Nov 2020 19:27:50 -0500
+Subject: bnxt_en: Free port stats during firmware reset.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit eba93de6d31c1734dee59909020a162de612e41e ]
+
+Firmware is unable to retain the port counters during any kind of
+fatal or non-fatal resets, so we must clear the port counters to
+avoid false detection of port counter overflow.
+
+Fixes: fea6b3335527 ("bnxt_en: Accumulate all counters.")
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Reviewed-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -4045,7 +4045,8 @@ static void bnxt_free_mem(struct bnxt *b
+ bnxt_free_ntp_fltrs(bp, irq_re_init);
+ if (irq_re_init) {
+ bnxt_free_ring_stats(bp);
+- if (!(bp->fw_cap & BNXT_FW_CAP_PORT_STATS_NO_RESET))
++ if (!(bp->fw_cap & BNXT_FW_CAP_PORT_STATS_NO_RESET) ||
++ test_bit(BNXT_STATE_IN_FW_RESET, &bp->state))
+ bnxt_free_port_stats(bp);
+ bnxt_free_ring_grps(bp);
+ bnxt_free_vnics(bp);
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Edwin Peer <edwin.peer@broadcom.com>
+Date: Sun, 15 Nov 2020 19:27:49 -0500
+Subject: bnxt_en: read EEPROM A2h address using page 0
+
+From: Edwin Peer <edwin.peer@broadcom.com>
+
+[ Upstream commit 4260330b32b14330cfe427d568ac5f5b29b5be3d ]
+
+The module eeprom address range returned by bnxt_get_module_eeprom()
+should be 256 bytes of A0h address space, the lower half of the A2h
+address space, and page 0 for the upper half of the A2h address space.
+
+Fix the firmware call by passing page_number 0 for the A2h slave address
+space.
+
+Fixes: 42ee18fe4ca2 ("bnxt_en: Add Support for ETHTOOL_GMODULEINFO and ETHTOOL_GMODULEEEPRO")
+Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -2742,7 +2742,7 @@ static int bnxt_get_module_eeprom(struct
+ /* Read A2 portion of the EEPROM */
+ if (length) {
+ start -= ETH_MODULE_SFF_8436_LEN;
+- rc = bnxt_read_sfp_module_eeprom_info(bp, I2C_DEV_ADDR_A2, 1,
++ rc = bnxt_read_sfp_module_eeprom_info(bp, I2C_DEV_ADDR_A2, 0,
+ start, length, data);
+ }
+ return rc;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Wang Hai <wanghai38@huawei.com>
+Date: Fri, 13 Nov 2020 19:16:22 +0800
+Subject: devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 849920c703392957f94023f77ec89ca6cf119d43 ]
+
+If sb_occ_port_pool_get() failed in devlink_nl_sb_port_pool_fill(),
+msg should be canceled by genlmsg_cancel().
+
+Fixes: df38dafd2559 ("devlink: implement shared buffer occupancy monitoring interface")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Link: https://lore.kernel.org/r/20201113111622.11040-1-wanghai38@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/devlink.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/core/devlink.c
++++ b/net/core/devlink.c
+@@ -1311,7 +1311,7 @@ static int devlink_nl_sb_port_pool_fill(
+ err = ops->sb_occ_port_pool_get(devlink_port, devlink_sb->index,
+ pool_index, &cur, &max);
+ if (err && err != -EOPNOTSUPP)
+- return err;
++ goto sb_occ_get_failure;
+ if (!err) {
+ if (nla_put_u32(msg, DEVLINK_ATTR_SB_OCC_CUR, cur))
+ goto nla_put_failure;
+@@ -1324,8 +1324,10 @@ static int devlink_nl_sb_port_pool_fill(
+ return 0;
+
+ nla_put_failure:
++ err = -EMSGSIZE;
++sb_occ_get_failure:
+ genlmsg_cancel(msg, hdr);
+- return -EMSGSIZE;
++ return err;
+ }
+
+ static int devlink_nl_cmd_sb_port_pool_get_doit(struct sk_buff *skb,
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Alex Marginean <alexandru.marginean@nxp.com>
+Date: Thu, 12 Nov 2020 20:26:08 +0200
+Subject: enetc: Workaround for MDIO register access issue
+
+From: Alex Marginean <alexandru.marginean@nxp.com>
+
+[ Upstream commit fd5736bf9f235d26c83cac8a16c70bbdafa55abe ]
+
+Due to a hardware issue, an access to MDIO registers
+that is concurrent with other ENETC register accesses
+may lead to the MDIO access being dropped or corrupted.
+The workaround introduces locking for all register accesses
+to the ENETC register space. To reduce performance impact,
+a readers-writers locking scheme has been implemented.
+The writer in this case is the MDIO access code (irrelevant
+whether that MDIO access is a register read or write), and
+the reader is any access code to non-MDIO ENETC registers.
+Also, the datapath functions acquire the read lock fewer times
+and use _hot accessors. All the rest of the code uses the _wa
+accessors which lock every register access.
+The commit introducing MDIO support is -
+commit ebfcb23d62ab ("enetc: Add ENETC PF level external MDIO support")
+but due to subsequent refactoring this patch is applicable on
+top of a later commit.
+
+Fixes: 6517798dd343 ("enetc: Make MDIO accessors more generic and export to include/linux/fsl")
+Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Link: https://lore.kernel.org/r/20201112182608.26177-1-claudiu.manoil@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/enetc/Kconfig | 1
+ drivers/net/ethernet/freescale/enetc/enetc.c | 62 ++++++++---
+ drivers/net/ethernet/freescale/enetc/enetc_hw.h | 115 ++++++++++++++++++++--
+ drivers/net/ethernet/freescale/enetc/enetc_mdio.c | 8 +
+ 4 files changed, 161 insertions(+), 25 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/enetc/Kconfig
++++ b/drivers/net/ethernet/freescale/enetc/Kconfig
+@@ -15,6 +15,7 @@ config FSL_ENETC
+ config FSL_ENETC_VF
+ tristate "ENETC VF driver"
+ depends on PCI && PCI_MSI
++ select FSL_ENETC_MDIO
+ select PHYLIB
+ select DIMLIB
+ help
+--- a/drivers/net/ethernet/freescale/enetc/enetc.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc.c
+@@ -34,7 +34,10 @@ netdev_tx_t enetc_xmit(struct sk_buff *s
+ return NETDEV_TX_BUSY;
+ }
+
++ enetc_lock_mdio();
+ count = enetc_map_tx_buffs(tx_ring, skb, priv->active_offloads);
++ enetc_unlock_mdio();
++
+ if (unlikely(!count))
+ goto drop_packet_err;
+
+@@ -240,7 +243,7 @@ static int enetc_map_tx_buffs(struct ene
+ skb_tx_timestamp(skb);
+
+ /* let H/W know BD ring has been updated */
+- enetc_wr_reg(tx_ring->tpir, i); /* includes wmb() */
++ enetc_wr_reg_hot(tx_ring->tpir, i); /* includes wmb() */
+
+ return count;
+
+@@ -263,12 +266,16 @@ static irqreturn_t enetc_msix(int irq, v
+ struct enetc_int_vector *v = data;
+ int i;
+
++ enetc_lock_mdio();
++
+ /* disable interrupts */
+- enetc_wr_reg(v->rbier, 0);
+- enetc_wr_reg(v->ricr1, v->rx_ictt);
++ enetc_wr_reg_hot(v->rbier, 0);
++ enetc_wr_reg_hot(v->ricr1, v->rx_ictt);
+
+ for_each_set_bit(i, &v->tx_rings_map, ENETC_MAX_NUM_TXQS)
+- enetc_wr_reg(v->tbier_base + ENETC_BDR_OFF(i), 0);
++ enetc_wr_reg_hot(v->tbier_base + ENETC_BDR_OFF(i), 0);
++
++ enetc_unlock_mdio();
+
+ napi_schedule(&v->napi);
+
+@@ -335,19 +342,23 @@ static int enetc_poll(struct napi_struct
+
+ v->rx_napi_work = false;
+
++ enetc_lock_mdio();
++
+ /* enable interrupts */
+- enetc_wr_reg(v->rbier, ENETC_RBIER_RXTIE);
++ enetc_wr_reg_hot(v->rbier, ENETC_RBIER_RXTIE);
+
+ for_each_set_bit(i, &v->tx_rings_map, ENETC_MAX_NUM_TXQS)
+- enetc_wr_reg(v->tbier_base + ENETC_BDR_OFF(i),
+- ENETC_TBIER_TXTIE);
++ enetc_wr_reg_hot(v->tbier_base + ENETC_BDR_OFF(i),
++ ENETC_TBIER_TXTIE);
++
++ enetc_unlock_mdio();
+
+ return work_done;
+ }
+
+ static int enetc_bd_ready_count(struct enetc_bdr *tx_ring, int ci)
+ {
+- int pi = enetc_rd_reg(tx_ring->tcir) & ENETC_TBCIR_IDX_MASK;
++ int pi = enetc_rd_reg_hot(tx_ring->tcir) & ENETC_TBCIR_IDX_MASK;
+
+ return pi >= ci ? pi - ci : tx_ring->bd_count - ci + pi;
+ }
+@@ -387,7 +398,10 @@ static bool enetc_clean_tx_ring(struct e
+
+ i = tx_ring->next_to_clean;
+ tx_swbd = &tx_ring->tx_swbd[i];
++
++ enetc_lock_mdio();
+ bds_to_clean = enetc_bd_ready_count(tx_ring, i);
++ enetc_unlock_mdio();
+
+ do_tstamp = false;
+
+@@ -430,16 +444,20 @@ static bool enetc_clean_tx_ring(struct e
+ tx_swbd = tx_ring->tx_swbd;
+ }
+
++ enetc_lock_mdio();
++
+ /* BD iteration loop end */
+ if (is_eof) {
+ tx_frm_cnt++;
+ /* re-arm interrupt source */
+- enetc_wr_reg(tx_ring->idr, BIT(tx_ring->index) |
+- BIT(16 + tx_ring->index));
++ enetc_wr_reg_hot(tx_ring->idr, BIT(tx_ring->index) |
++ BIT(16 + tx_ring->index));
+ }
+
+ if (unlikely(!bds_to_clean))
+ bds_to_clean = enetc_bd_ready_count(tx_ring, i);
++
++ enetc_unlock_mdio();
+ }
+
+ tx_ring->next_to_clean = i;
+@@ -516,8 +534,6 @@ static int enetc_refill_rx_ring(struct e
+ if (likely(j)) {
+ rx_ring->next_to_alloc = i; /* keep track from page reuse */
+ rx_ring->next_to_use = i;
+- /* update ENETC's consumer index */
+- enetc_wr_reg(rx_ring->rcir, i);
+ }
+
+ return j;
+@@ -535,8 +551,8 @@ static void enetc_get_rx_tstamp(struct n
+ u64 tstamp;
+
+ if (le16_to_cpu(rxbd->r.flags) & ENETC_RXBD_FLAG_TSTMP) {
+- lo = enetc_rd(hw, ENETC_SICTR0);
+- hi = enetc_rd(hw, ENETC_SICTR1);
++ lo = enetc_rd_reg_hot(hw->reg + ENETC_SICTR0);
++ hi = enetc_rd_reg_hot(hw->reg + ENETC_SICTR1);
+ rxbd = enetc_rxbd_ext(rxbd);
+ tstamp_lo = le32_to_cpu(rxbd->ext.tstamp);
+ if (lo <= tstamp_lo)
+@@ -685,23 +701,31 @@ static int enetc_clean_rx_ring(struct en
+ u32 bd_status;
+ u16 size;
+
++ enetc_lock_mdio();
++
+ if (cleaned_cnt >= ENETC_RXBD_BUNDLE) {
+ int count = enetc_refill_rx_ring(rx_ring, cleaned_cnt);
+
++ /* update ENETC's consumer index */
++ enetc_wr_reg_hot(rx_ring->rcir, rx_ring->next_to_use);
+ cleaned_cnt -= count;
+ }
+
+ rxbd = enetc_rxbd(rx_ring, i);
+ bd_status = le32_to_cpu(rxbd->r.lstatus);
+- if (!bd_status)
++ if (!bd_status) {
++ enetc_unlock_mdio();
+ break;
++ }
+
+- enetc_wr_reg(rx_ring->idr, BIT(rx_ring->index));
++ enetc_wr_reg_hot(rx_ring->idr, BIT(rx_ring->index));
+ dma_rmb(); /* for reading other rxbd fields */
+ size = le16_to_cpu(rxbd->r.buf_len);
+ skb = enetc_map_rx_buff_to_skb(rx_ring, i, size);
+- if (!skb)
++ if (!skb) {
++ enetc_unlock_mdio();
+ break;
++ }
+
+ enetc_get_offloads(rx_ring, rxbd, skb);
+
+@@ -713,6 +737,7 @@ static int enetc_clean_rx_ring(struct en
+
+ if (unlikely(bd_status &
+ ENETC_RXBD_LSTATUS(ENETC_RXBD_ERR_MASK))) {
++ enetc_unlock_mdio();
+ dev_kfree_skb(skb);
+ while (!(bd_status & ENETC_RXBD_LSTATUS_F)) {
+ dma_rmb();
+@@ -752,6 +777,8 @@ static int enetc_clean_rx_ring(struct en
+
+ enetc_process_skb(rx_ring, skb);
+
++ enetc_unlock_mdio();
++
+ napi_gro_receive(napi, skb);
+
+ rx_frm_cnt++;
+@@ -1226,6 +1253,7 @@ static void enetc_setup_rxbdr(struct ene
+ rx_ring->idr = hw->reg + ENETC_SIRXIDR;
+
+ enetc_refill_rx_ring(rx_ring, enetc_bd_unused(rx_ring));
++ enetc_wr(hw, ENETC_SIRXIDR, rx_ring->next_to_use);
+
+ /* enable ring */
+ enetc_rxbdr_wr(hw, idx, ENETC_RBMR, rbmr);
+--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+@@ -324,14 +324,100 @@ struct enetc_hw {
+ void __iomem *global;
+ };
+
+-/* general register accessors */
+-#define enetc_rd_reg(reg) ioread32((reg))
+-#define enetc_wr_reg(reg, val) iowrite32((val), (reg))
++/* ENETC register accessors */
++
++/* MDIO issue workaround (on LS1028A) -
++ * Due to a hardware issue, an access to MDIO registers
++ * that is concurrent with other ENETC register accesses
++ * may lead to the MDIO access being dropped or corrupted.
++ * To protect the MDIO accesses a readers-writers locking
++ * scheme is used, where the MDIO register accesses are
++ * protected by write locks to insure exclusivity, while
++ * the remaining ENETC registers are accessed under read
++ * locks since they only compete with MDIO accesses.
++ */
++extern rwlock_t enetc_mdio_lock;
++
++/* use this locking primitive only on the fast datapath to
++ * group together multiple non-MDIO register accesses to
++ * minimize the overhead of the lock
++ */
++static inline void enetc_lock_mdio(void)
++{
++ read_lock(&enetc_mdio_lock);
++}
++
++static inline void enetc_unlock_mdio(void)
++{
++ read_unlock(&enetc_mdio_lock);
++}
++
++/* use these accessors only on the fast datapath under
++ * the enetc_lock_mdio() locking primitive to minimize
++ * the overhead of the lock
++ */
++static inline u32 enetc_rd_reg_hot(void __iomem *reg)
++{
++ lockdep_assert_held(&enetc_mdio_lock);
++
++ return ioread32(reg);
++}
++
++static inline void enetc_wr_reg_hot(void __iomem *reg, u32 val)
++{
++ lockdep_assert_held(&enetc_mdio_lock);
++
++ iowrite32(val, reg);
++}
++
++/* internal helpers for the MDIO w/a */
++static inline u32 _enetc_rd_reg_wa(void __iomem *reg)
++{
++ u32 val;
++
++ enetc_lock_mdio();
++ val = ioread32(reg);
++ enetc_unlock_mdio();
++
++ return val;
++}
++
++static inline void _enetc_wr_reg_wa(void __iomem *reg, u32 val)
++{
++ enetc_lock_mdio();
++ iowrite32(val, reg);
++ enetc_unlock_mdio();
++}
++
++static inline u32 _enetc_rd_mdio_reg_wa(void __iomem *reg)
++{
++ unsigned long flags;
++ u32 val;
++
++ write_lock_irqsave(&enetc_mdio_lock, flags);
++ val = ioread32(reg);
++ write_unlock_irqrestore(&enetc_mdio_lock, flags);
++
++ return val;
++}
++
++static inline void _enetc_wr_mdio_reg_wa(void __iomem *reg, u32 val)
++{
++ unsigned long flags;
++
++ write_lock_irqsave(&enetc_mdio_lock, flags);
++ iowrite32(val, reg);
++ write_unlock_irqrestore(&enetc_mdio_lock, flags);
++}
++
+ #ifdef ioread64
+-#define enetc_rd_reg64(reg) ioread64((reg))
++static inline u64 _enetc_rd_reg64(void __iomem *reg)
++{
++ return ioread64(reg);
++}
+ #else
+ /* using this to read out stats on 32b systems */
+-static inline u64 enetc_rd_reg64(void __iomem *reg)
++static inline u64 _enetc_rd_reg64(void __iomem *reg)
+ {
+ u32 low, high, tmp;
+
+@@ -345,12 +431,29 @@ static inline u64 enetc_rd_reg64(void __
+ }
+ #endif
+
++static inline u64 _enetc_rd_reg64_wa(void __iomem *reg)
++{
++ u64 val;
++
++ enetc_lock_mdio();
++ val = _enetc_rd_reg64(reg);
++ enetc_unlock_mdio();
++
++ return val;
++}
++
++/* general register accessors */
++#define enetc_rd_reg(reg) _enetc_rd_reg_wa((reg))
++#define enetc_wr_reg(reg, val) _enetc_wr_reg_wa((reg), (val))
+ #define enetc_rd(hw, off) enetc_rd_reg((hw)->reg + (off))
+ #define enetc_wr(hw, off, val) enetc_wr_reg((hw)->reg + (off), val)
+-#define enetc_rd64(hw, off) enetc_rd_reg64((hw)->reg + (off))
++#define enetc_rd64(hw, off) _enetc_rd_reg64_wa((hw)->reg + (off))
+ /* port register accessors - PF only */
+ #define enetc_port_rd(hw, off) enetc_rd_reg((hw)->port + (off))
+ #define enetc_port_wr(hw, off, val) enetc_wr_reg((hw)->port + (off), val)
++#define enetc_port_rd_mdio(hw, off) _enetc_rd_mdio_reg_wa((hw)->port + (off))
++#define enetc_port_wr_mdio(hw, off, val) _enetc_wr_mdio_reg_wa(\
++ (hw)->port + (off), val)
+ /* global register accessors - PF only */
+ #define enetc_global_rd(hw, off) enetc_rd_reg((hw)->global + (off))
+ #define enetc_global_wr(hw, off, val) enetc_wr_reg((hw)->global + (off), val)
+--- a/drivers/net/ethernet/freescale/enetc/enetc_mdio.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_mdio.c
+@@ -16,13 +16,13 @@
+
+ static inline u32 _enetc_mdio_rd(struct enetc_mdio_priv *mdio_priv, int off)
+ {
+- return enetc_port_rd(mdio_priv->hw, mdio_priv->mdio_base + off);
++ return enetc_port_rd_mdio(mdio_priv->hw, mdio_priv->mdio_base + off);
+ }
+
+ static inline void _enetc_mdio_wr(struct enetc_mdio_priv *mdio_priv, int off,
+ u32 val)
+ {
+- enetc_port_wr(mdio_priv->hw, mdio_priv->mdio_base + off, val);
++ enetc_port_wr_mdio(mdio_priv->hw, mdio_priv->mdio_base + off, val);
+ }
+
+ #define enetc_mdio_rd(mdio_priv, off) \
+@@ -174,3 +174,7 @@ struct enetc_hw *enetc_hw_alloc(struct d
+ return hw;
+ }
+ EXPORT_SYMBOL_GPL(enetc_hw_alloc);
++
++/* Lock for MDIO access errata on LS1028A */
++DEFINE_RWLOCK(enetc_mdio_lock);
++EXPORT_SYMBOL_GPL(enetc_mdio_lock);
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Jeff Dike <jdike@akamai.com>
+Date: Thu, 12 Nov 2020 20:58:15 -0500
+Subject: Exempt multicast addresses from five-second neighbor lifetime
+
+From: Jeff Dike <jdike@akamai.com>
+
+[ Upstream commit 8cf8821e15cd553339a5b48ee555a0439c2b2742 ]
+
+Commit 58956317c8de ("neighbor: Improve garbage collection")
+guarantees neighbour table entries a five-second lifetime. Processes
+which make heavy use of multicast can fill the neighour table with
+multicast addresses in five seconds. At that point, neighbour entries
+can't be GC-ed because they aren't five seconds old yet, the kernel
+log starts to fill up with "neighbor table overflow!" messages, and
+sends start to fail.
+
+This patch allows multicast addresses to be thrown out before they've
+lived out their five seconds. This makes room for non-multicast
+addresses and makes messages to all addresses more reliable in these
+circumstances.
+
+Fixes: 58956317c8de ("neighbor: Improve garbage collection")
+Signed-off-by: Jeff Dike <jdike@akamai.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/20201113015815.31397-1-jdike@akamai.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/neighbour.h | 1 +
+ net/core/neighbour.c | 2 ++
+ net/ipv4/arp.c | 6 ++++++
+ net/ipv6/ndisc.c | 7 +++++++
+ 4 files changed, 16 insertions(+)
+
+--- a/include/net/neighbour.h
++++ b/include/net/neighbour.h
+@@ -204,6 +204,7 @@ struct neigh_table {
+ int (*pconstructor)(struct pneigh_entry *);
+ void (*pdestructor)(struct pneigh_entry *);
+ void (*proxy_redo)(struct sk_buff *skb);
++ int (*is_multicast)(const void *pkey);
+ bool (*allow_add)(const struct net_device *dev,
+ struct netlink_ext_ack *extack);
+ char *id;
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -235,6 +235,8 @@ static int neigh_forced_gc(struct neigh_
+
+ write_lock(&n->lock);
+ if ((n->nud_state == NUD_FAILED) ||
++ (tbl->is_multicast &&
++ tbl->is_multicast(n->primary_key)) ||
+ time_after(tref, n->updated))
+ remove = true;
+ write_unlock(&n->lock);
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -125,6 +125,7 @@ static int arp_constructor(struct neighb
+ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb);
+ static void arp_error_report(struct neighbour *neigh, struct sk_buff *skb);
+ static void parp_redo(struct sk_buff *skb);
++static int arp_is_multicast(const void *pkey);
+
+ static const struct neigh_ops arp_generic_ops = {
+ .family = AF_INET,
+@@ -156,6 +157,7 @@ struct neigh_table arp_tbl = {
+ .key_eq = arp_key_eq,
+ .constructor = arp_constructor,
+ .proxy_redo = parp_redo,
++ .is_multicast = arp_is_multicast,
+ .id = "arp_cache",
+ .parms = {
+ .tbl = &arp_tbl,
+@@ -928,6 +930,10 @@ static void parp_redo(struct sk_buff *sk
+ arp_process(dev_net(skb->dev), NULL, skb);
+ }
+
++static int arp_is_multicast(const void *pkey)
++{
++ return ipv4_is_multicast(*((__be32 *)pkey));
++}
+
+ /*
+ * Receive an arp request from the device layer.
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -81,6 +81,7 @@ static void ndisc_error_report(struct ne
+ static int pndisc_constructor(struct pneigh_entry *n);
+ static void pndisc_destructor(struct pneigh_entry *n);
+ static void pndisc_redo(struct sk_buff *skb);
++static int ndisc_is_multicast(const void *pkey);
+
+ static const struct neigh_ops ndisc_generic_ops = {
+ .family = AF_INET6,
+@@ -115,6 +116,7 @@ struct neigh_table nd_tbl = {
+ .pconstructor = pndisc_constructor,
+ .pdestructor = pndisc_destructor,
+ .proxy_redo = pndisc_redo,
++ .is_multicast = ndisc_is_multicast,
+ .allow_add = ndisc_allow_add,
+ .id = "ndisc_cache",
+ .parms = {
+@@ -1706,6 +1708,11 @@ static void pndisc_redo(struct sk_buff *
+ kfree_skb(skb);
+ }
+
++static int ndisc_is_multicast(const void *pkey)
++{
++ return ipv6_addr_is_multicast((struct in6_addr *)pkey);
++}
++
+ static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
+ {
+ struct inet6_dev *idev = __in6_dev_get(skb->dev);
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Wang Hai <wanghai38@huawei.com>
+Date: Mon, 16 Nov 2020 16:20:18 +0800
+Subject: inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit e33de7c5317e2827b2ba6fd120a505e9eb727b05 ]
+
+nlmsg_cancel() needs to be called in the error path of
+inet_req_diag_fill to cancel the message.
+
+Fixes: d545caca827b ("net: inet: diag: expose the socket mark to privileged processes.")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Link: https://lore.kernel.org/r/20201116082018.16496-1-wanghai38@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/inet_diag.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -462,8 +462,10 @@ static int inet_req_diag_fill(struct soc
+ r->idiag_inode = 0;
+
+ if (net_admin && nla_put_u32(skb, INET_DIAG_MARK,
+- inet_rsk(reqsk)->ir_mark))
++ inet_rsk(reqsk)->ir_mark)) {
++ nlmsg_cancel(skb, nlh);
+ return -EMSGSIZE;
++ }
+
+ nlmsg_end(skb, nlh);
+ return 0;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Zhang Qilong <zhangqilong3@huawei.com>
+Date: Thu, 12 Nov 2020 16:09:50 +0800
+Subject: ipv6: Fix error path to cancel the meseage
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit ceb736e1d45c253f5e86b185ca9b497cdd43063f ]
+
+genlmsg_cancel() needs to be called in the error path of
+inet6_fill_ifmcaddr and inet6_fill_ifacaddr to cancel
+the message.
+
+Fixes: 6ecf4c37eb3e ("ipv6: enable IFA_TARGET_NETNSID for RTM_GETADDR")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201112080950.1476302-1-zhangqilong3@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/addrconf.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -5022,8 +5022,10 @@ static int inet6_fill_ifmcaddr(struct sk
+ return -EMSGSIZE;
+
+ if (args->netnsid >= 0 &&
+- nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid))
++ nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) {
++ nlmsg_cancel(skb, nlh);
+ return -EMSGSIZE;
++ }
+
+ put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
+ if (nla_put_in6_addr(skb, IFA_MULTICAST, &ifmca->mca_addr) < 0 ||
+@@ -5054,8 +5056,10 @@ static int inet6_fill_ifacaddr(struct sk
+ return -EMSGSIZE;
+
+ if (args->netnsid >= 0 &&
+- nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid))
++ nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) {
++ nlmsg_cancel(skb, nlh);
+ return -EMSGSIZE;
++ }
+
+ put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
+ if (nla_put_in6_addr(skb, IFA_ANYCAST, &ifaca->aca_addr) < 0 ||
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Sven Van Asbroeck <thesven73@gmail.com>
+Date: Thu, 12 Nov 2020 13:59:49 -0500
+Subject: lan743x: fix issue causing intermittent kernel log warnings
+
+From: Sven Van Asbroeck <thesven73@gmail.com>
+
+[ Upstream commit e35df62e04cc6fc4b9d90d054732f138349ff9b1 ]
+
+When running this chip on arm imx6, we intermittently observe
+the following kernel warning in the log, especially when the
+system is under high load:
+
+[ 50.119484] ------------[ cut here ]------------
+[ 50.124377] WARNING: CPU: 0 PID: 303 at kernel/softirq.c:169 __local_bh_enable_ip+0x100/0x184
+[ 50.132925] IRQs not enabled as expected
+[ 50.159250] CPU: 0 PID: 303 Comm: rngd Not tainted 5.7.8 #1
+[ 50.164837] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+[ 50.171395] [<c0111a38>] (unwind_backtrace) from [<c010be28>] (show_stack+0x10/0x14)
+[ 50.179162] [<c010be28>] (show_stack) from [<c05b9dec>] (dump_stack+0xac/0xd8)
+[ 50.186408] [<c05b9dec>] (dump_stack) from [<c0122e40>] (__warn+0xd0/0x10c)
+[ 50.193391] [<c0122e40>] (__warn) from [<c0123238>] (warn_slowpath_fmt+0x98/0xc4)
+[ 50.200892] [<c0123238>] (warn_slowpath_fmt) from [<c012b010>] (__local_bh_enable_ip+0x100/0x184)
+[ 50.209860] [<c012b010>] (__local_bh_enable_ip) from [<bf09ecbc>] (destroy_conntrack+0x48/0xd8 [nf_conntrack])
+[ 50.220038] [<bf09ecbc>] (destroy_conntrack [nf_conntrack]) from [<c0ac9b58>] (nf_conntrack_destroy+0x94/0x168)
+[ 50.230160] [<c0ac9b58>] (nf_conntrack_destroy) from [<c0a4aaa0>] (skb_release_head_state+0xa0/0xd0)
+[ 50.239314] [<c0a4aaa0>] (skb_release_head_state) from [<c0a4aadc>] (skb_release_all+0xc/0x24)
+[ 50.247946] [<c0a4aadc>] (skb_release_all) from [<c0a4b4cc>] (consume_skb+0x74/0x17c)
+[ 50.255796] [<c0a4b4cc>] (consume_skb) from [<c081a2dc>] (lan743x_tx_release_desc+0x120/0x124)
+[ 50.264428] [<c081a2dc>] (lan743x_tx_release_desc) from [<c081a98c>] (lan743x_tx_napi_poll+0x5c/0x18c)
+[ 50.273755] [<c081a98c>] (lan743x_tx_napi_poll) from [<c0a6b050>] (net_rx_action+0x118/0x4a4)
+[ 50.282306] [<c0a6b050>] (net_rx_action) from [<c0101364>] (__do_softirq+0x13c/0x53c)
+[ 50.290157] [<c0101364>] (__do_softirq) from [<c012b29c>] (irq_exit+0x150/0x17c)
+[ 50.297575] [<c012b29c>] (irq_exit) from [<c0196a08>] (__handle_domain_irq+0x60/0xb0)
+[ 50.305423] [<c0196a08>] (__handle_domain_irq) from [<c05d44fc>] (gic_handle_irq+0x4c/0x90)
+[ 50.313790] [<c05d44fc>] (gic_handle_irq) from [<c0100ed4>] (__irq_usr+0x54/0x80)
+[ 50.321287] Exception stack(0xecd99fb0 to 0xecd99ff8)
+[ 50.326355] 9fa0: 1cf1aa74 00000001 00000001 00000000
+[ 50.334547] 9fc0: 00000001 00000000 00000000 00000000 00000000 00000000 00004097 b6d17d14
+[ 50.342738] 9fe0: 00000001 b6d17c60 00000000 b6e71f94 800b0010 ffffffff
+[ 50.349364] irq event stamp: 2525027
+[ 50.352955] hardirqs last enabled at (2525026): [<c0a6afec>] net_rx_action+0xb4/0x4a4
+[ 50.360892] hardirqs last disabled at (2525027): [<c0d6d2fc>] _raw_spin_lock_irqsave+0x1c/0x50
+[ 50.369517] softirqs last enabled at (2524660): [<c01015b4>] __do_softirq+0x38c/0x53c
+[ 50.377446] softirqs last disabled at (2524693): [<c012b29c>] irq_exit+0x150/0x17c
+[ 50.385027] ---[ end trace c0b571db4bc8087d ]---
+
+The driver is calling dev_kfree_skb() from code inside a spinlock,
+where h/w interrupts are disabled. This is forbidden, as documented
+in include/linux/netdevice.h. The correct function to use
+dev_kfree_skb_irq(), or dev_kfree_skb_any().
+
+Fix by using the correct dev_kfree_skb_xxx() functions:
+
+in lan743x_tx_release_desc():
+ called by lan743x_tx_release_completed_descriptors()
+ called by in lan743x_tx_napi_poll()
+ which holds a spinlock
+ called by lan743x_tx_release_all_descriptors()
+ called by lan743x_tx_close()
+ which can-sleep
+conclusion: use dev_kfree_skb_any()
+
+in lan743x_tx_xmit_frame():
+ which holds a spinlock
+conclusion: use dev_kfree_skb_irq()
+
+in lan743x_tx_close():
+ which can-sleep
+conclusion: use dev_kfree_skb()
+
+in lan743x_rx_release_ring_element():
+ called by lan743x_rx_close()
+ which can-sleep
+ called by lan743x_rx_open()
+ which can-sleep
+conclusion: use dev_kfree_skb()
+
+Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver")
+Signed-off-by: Sven Van Asbroeck <thesven73@gmail.com>
+Link: https://lore.kernel.org/r/20201112185949.11315-1-TheSven73@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/microchip/lan743x_main.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -1308,13 +1308,13 @@ clean_up_data_descriptor:
+ goto clear_active;
+
+ if (!(buffer_info->flags & TX_BUFFER_INFO_FLAG_TIMESTAMP_REQUESTED)) {
+- dev_kfree_skb(buffer_info->skb);
++ dev_kfree_skb_any(buffer_info->skb);
+ goto clear_skb;
+ }
+
+ if (cleanup) {
+ lan743x_ptp_unrequest_tx_timestamp(tx->adapter);
+- dev_kfree_skb(buffer_info->skb);
++ dev_kfree_skb_any(buffer_info->skb);
+ } else {
+ ignore_sync = (buffer_info->flags &
+ TX_BUFFER_INFO_FLAG_IGNORE_SYNC) != 0;
+@@ -1624,7 +1624,7 @@ static netdev_tx_t lan743x_tx_xmit_frame
+ if (required_number_of_descriptors >
+ lan743x_tx_get_avail_desc(tx)) {
+ if (required_number_of_descriptors > (tx->ring_size - 1)) {
+- dev_kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ } else {
+ /* save to overflow buffer */
+ tx->overflow_skb = skb;
+@@ -1657,7 +1657,7 @@ static netdev_tx_t lan743x_tx_xmit_frame
+ start_frame_length,
+ do_timestamp,
+ skb->ip_summed == CHECKSUM_PARTIAL)) {
+- dev_kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ goto unlock;
+ }
+
+@@ -1676,7 +1676,7 @@ static netdev_tx_t lan743x_tx_xmit_frame
+ * frame assembler clean up was performed inside
+ * lan743x_tx_frame_add_fragment
+ */
+- dev_kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ goto unlock;
+ }
+ }
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Sven Van Asbroeck <thesven73@gmail.com>
+Date: Thu, 12 Nov 2020 15:47:41 -0500
+Subject: lan743x: prevent entire kernel HANG on open, for some platforms
+
+From: Sven Van Asbroeck <thesven73@gmail.com>
+
+[ Upstream commit 796a2665ca3e91ebaba7222f76fd9a035714e2d8 ]
+
+On arm imx6, when opening the chip's netdev, the whole Linux
+kernel intermittently hangs/freezes.
+
+This is caused by a bug in the driver code which tests if pcie
+interrupts are working correctly, using the software interrupt:
+
+1. open: enable the software interrupt
+2. open: tell the chip to assert the software interrupt
+3. open: wait for flag
+4. ISR: acknowledge s/w interrupt, set flag
+5. open: notice flag, disable the s/w interrupt, continue
+
+Unfortunately the ISR only acknowledges the s/w interrupt, but
+does not disable it. This will re-trigger the ISR in a tight
+loop.
+
+On some (lucky) platforms, open proceeds to disable the s/w
+interrupt even while the ISR is 'spinning'. On arm imx6,
+the spinning ISR does not allow open to proceed, resulting
+in a hung Linux kernel.
+
+Fix minimally by disabling the s/w interrupt in the ISR, which
+will prevent it from spinning. This won't break anything because
+the s/w interrupt is used as a one-shot interrupt.
+
+Note that this is a minimal fix, overlooking many possible
+cleanups, e.g.:
+- lan743x_intr_software_isr() is completely redundant and reads
+ INT_STS twice for no apparent reason
+- disabling the s/w interrupt in lan743x_intr_test_isr() is now
+ redundant, but harmless
+- waiting on software_isr_flag can be converted from a sleeping
+ poll loop to wait_event_timeout()
+
+Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver")
+Tested-by: Sven Van Asbroeck <thesven73@gmail.com> # arm imx6 lan7430
+Signed-off-by: Sven Van Asbroeck <thesven73@gmail.com>
+Link: https://lore.kernel.org/r/20201112204741.12375-1-TheSven73@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/microchip/lan743x_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -148,7 +148,8 @@ static void lan743x_intr_software_isr(vo
+
+ int_sts = lan743x_csr_read(adapter, INT_STS);
+ if (int_sts & INT_BIT_SW_GP_) {
+- lan743x_csr_write(adapter, INT_STS, INT_BIT_SW_GP_);
++ /* disable the interrupt to prevent repeated re-triggering */
++ lan743x_csr_write(adapter, INT_EN_CLR, INT_BIT_SW_GP_);
+ intr->software_isr_flag = 1;
+ }
+ }
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Ido Schimmel <idosch@nvidia.com>
+Date: Tue, 17 Nov 2020 19:33:52 +0200
+Subject: mlxsw: core: Use variable timeout for EMAD retries
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 1f492eab67bced119a0ac7db75ef2047e29a30c6 ]
+
+The driver sends Ethernet Management Datagram (EMAD) packets to the
+device for configuration purposes and waits for up to 200ms for a reply.
+A request is retried up to 5 times.
+
+When the system is under heavy load, replies are not always processed in
+time and EMAD transactions fail.
+
+Make the process more robust to such delays by using exponential
+backoff. First wait for up to 200ms, then retransmit and wait for up to
+400ms and so on.
+
+Fixes: caf7297e7ab5 ("mlxsw: core: Introduce support for asynchronous EMAD register access")
+Reported-by: Denis Yulevich <denisyu@nvidia.com>
+Tested-by: Denis Yulevich <denisyu@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -558,7 +558,8 @@ static void mlxsw_emad_trans_timeout_sch
+ if (trans->core->fw_flash_in_progress)
+ timeout = msecs_to_jiffies(MLXSW_EMAD_TIMEOUT_DURING_FW_FLASH_MS);
+
+- queue_delayed_work(trans->core->emad_wq, &trans->timeout_dw, timeout);
++ queue_delayed_work(trans->core->emad_wq, &trans->timeout_dw,
++ timeout << trans->retries);
+ }
+
+ static int mlxsw_emad_transmit(struct mlxsw_core *mlxsw_core,
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+Date: Tue, 17 Nov 2020 11:02:11 +0800
+Subject: net: b44: fix error return code in b44_init_one()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 7b027c249da54f492699c43e26cba486cfd48035 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 39a6f4bce6b4 ("b44: replace the ssb_dma API with the generic DMA API")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://lore.kernel.org/r/1605582131-36735-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/b44.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/b44.c
++++ b/drivers/net/ethernet/broadcom/b44.c
+@@ -2383,7 +2383,8 @@ static int b44_init_one(struct ssb_devic
+ goto err_out_free_dev;
+ }
+
+- if (dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30))) {
++ err = dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30));
++ if (err) {
+ dev_err(sdev->dev,
+ "Required 30BIT DMA mask unsupported by the system\n");
+ goto err_out_powerdown;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 13 Nov 2020 10:27:27 +0100
+Subject: net: bridge: add missing counters to ndo_get_stats64 callback
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 7a30ecc9237681bb125cbd30eee92bef7e86293d ]
+
+In br_forward.c and br_input.c fields dev->stats.tx_dropped and
+dev->stats.multicast are populated, but they are ignored in
+ndo_get_stats64.
+
+Fixes: 28172739f0a2 ("net: fix 64 bit counters on 32 bit arches")
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://lore.kernel.org/r/58ea9963-77ad-a7cf-8dfd-fc95ab95f606@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bridge/br_device.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/bridge/br_device.c
++++ b/net/bridge/br_device.c
+@@ -223,6 +223,7 @@ static void br_get_stats64(struct net_de
+ sum.rx_packets += tmp.rx_packets;
+ }
+
++ netdev_stats_to_stats64(stats, &dev->stats);
+ stats->tx_bytes = sum.tx_bytes;
+ stats->tx_packets = sum.tx_packets;
+ stats->rx_bytes = sum.rx_bytes;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Tobias Waldekranz <tobias@waldekranz.com>
+Date: Thu, 12 Nov 2020 12:43:35 +0100
+Subject: net: dsa: mv88e6xxx: Avoid VTU corruption on 6097
+
+From: Tobias Waldekranz <tobias@waldekranz.com>
+
+[ Upstream commit 92307069a96c07d9b6e74b96b79390e7cd7d2111 ]
+
+As soon as you add the second port to a VLAN, all other port
+membership configuration is overwritten with zeroes. The HW interprets
+this as all ports being "unmodified members" of the VLAN.
+
+In the simple case when all ports belong to the same VLAN, switching
+will still work. But using multiple VLANs or trying to set multiple
+ports as tagged members will not work.
+
+On the 6352, doing a VTU GetNext op, followed by an STU GetNext op
+will leave you with both the member- and state- data in the VTU/STU
+data registers. But on the 6097 (which uses the same implementation),
+the STU GetNext will override the information gathered from the VTU
+GetNext.
+
+Separate the two stages, parsing the result of the VTU GetNext before
+doing the STU GetNext.
+
+We opt to update the existing implementation for all applicable chips,
+as opposed to creating a separate callback for 6097, because although
+the previous implementation did work for (at least) 6352, the
+datasheet does not mention the masking behavior.
+
+Fixes: ef6fcea37f01 ("net: dsa: mv88e6xxx: get STU entry on VTU GetNext")
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+Link: https://lore.kernel.org/r/20201112114335.27371-1-tobias@waldekranz.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/mv88e6xxx/global1_vtu.c | 59 ++++++++++++++++++++++++++------
+ 1 file changed, 49 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/dsa/mv88e6xxx/global1_vtu.c
++++ b/drivers/net/dsa/mv88e6xxx/global1_vtu.c
+@@ -125,11 +125,9 @@ static int mv88e6xxx_g1_vtu_vid_write(st
+ * Offset 0x08: VTU/STU Data Register 2
+ * Offset 0x09: VTU/STU Data Register 3
+ */
+-
+-static int mv88e6185_g1_vtu_data_read(struct mv88e6xxx_chip *chip,
+- struct mv88e6xxx_vtu_entry *entry)
++static int mv88e6185_g1_vtu_stu_data_read(struct mv88e6xxx_chip *chip,
++ u16 *regs)
+ {
+- u16 regs[3];
+ int i;
+
+ /* Read all 3 VTU/STU Data registers */
+@@ -142,12 +140,45 @@ static int mv88e6185_g1_vtu_data_read(st
+ return err;
+ }
+
+- /* Extract MemberTag and PortState data */
++ return 0;
++}
++
++static int mv88e6185_g1_vtu_data_read(struct mv88e6xxx_chip *chip,
++ struct mv88e6xxx_vtu_entry *entry)
++{
++ u16 regs[3];
++ int err;
++ int i;
++
++ err = mv88e6185_g1_vtu_stu_data_read(chip, regs);
++ if (err)
++ return err;
++
++ /* Extract MemberTag data */
+ for (i = 0; i < mv88e6xxx_num_ports(chip); ++i) {
+ unsigned int member_offset = (i % 4) * 4;
+- unsigned int state_offset = member_offset + 2;
+
+ entry->member[i] = (regs[i / 4] >> member_offset) & 0x3;
++ }
++
++ return 0;
++}
++
++static int mv88e6185_g1_stu_data_read(struct mv88e6xxx_chip *chip,
++ struct mv88e6xxx_vtu_entry *entry)
++{
++ u16 regs[3];
++ int err;
++ int i;
++
++ err = mv88e6185_g1_vtu_stu_data_read(chip, regs);
++ if (err)
++ return err;
++
++ /* Extract PortState data */
++ for (i = 0; i < mv88e6xxx_num_ports(chip); ++i) {
++ unsigned int state_offset = (i % 4) * 4 + 2;
++
+ entry->state[i] = (regs[i / 4] >> state_offset) & 0x3;
+ }
+
+@@ -349,6 +380,10 @@ int mv88e6185_g1_vtu_getnext(struct mv88
+ if (err)
+ return err;
+
++ err = mv88e6185_g1_stu_data_read(chip, entry);
++ if (err)
++ return err;
++
+ /* VTU DBNum[3:0] are located in VTU Operation 3:0
+ * VTU DBNum[7:4] are located in VTU Operation 11:8
+ */
+@@ -374,16 +409,20 @@ int mv88e6352_g1_vtu_getnext(struct mv88
+ return err;
+
+ if (entry->valid) {
+- /* Fetch (and mask) VLAN PortState data from the STU */
+- err = mv88e6xxx_g1_vtu_stu_get(chip, entry);
++ err = mv88e6185_g1_vtu_data_read(chip, entry);
+ if (err)
+ return err;
+
+- err = mv88e6185_g1_vtu_data_read(chip, entry);
++ err = mv88e6xxx_g1_vtu_fid_read(chip, entry);
+ if (err)
+ return err;
+
+- err = mv88e6xxx_g1_vtu_fid_read(chip, entry);
++ /* Fetch VLAN PortState data from the STU */
++ err = mv88e6xxx_g1_vtu_stu_get(chip, entry);
++ if (err)
++ return err;
++
++ err = mv88e6185_g1_stu_data_read(chip, entry);
+ if (err)
+ return err;
+ }
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+Date: Thu, 12 Nov 2020 19:34:39 +0800
+Subject: net: ethernet: mtk-star-emac: fix error return code in mtk_star_enable()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit baee1991fad928d6c8dd5be3197ecb413c420c97 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 8c7bd5a454ff ("net: ethernet: mtk-star-emac: new driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Acked-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Link: https://lore.kernel.org/r/1605180879-2573-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mediatek/mtk_star_emac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mediatek/mtk_star_emac.c
++++ b/drivers/net/ethernet/mediatek/mtk_star_emac.c
+@@ -966,6 +966,7 @@ static int mtk_star_enable(struct net_de
+ mtk_star_adjust_link, 0, priv->phy_intf);
+ if (!priv->phydev) {
+ netdev_err(ndev, "failed to connect to PHY\n");
++ ret = -ENODEV;
+ goto err_free_irq;
+ }
+
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: "Vincent Stehlé" <vincent.stehle@laposte.net>
+Date: Thu, 12 Nov 2020 09:48:33 +0100
+Subject: net: ethernet: mtk-star-emac: return ok when xmit drops
+
+From: "Vincent Stehlé" <vincent.stehle@laposte.net>
+
+[ Upstream commit e8aa6d520b448efc88670a98eccd196713639f2f ]
+
+The ndo_start_xmit() method must return NETDEV_TX_OK if the DMA mapping
+fails, after freeing the socket buffer.
+Fix the mtk_star_netdev_start_xmit() function accordingly.
+
+Fixes: 8c7bd5a454ff ("net: ethernet: mtk-star-emac: new driver")
+Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
+Acked-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Link: https://lore.kernel.org/r/20201112084833.21842-1-vincent.stehle@laposte.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mediatek/mtk_star_emac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_star_emac.c
++++ b/drivers/net/ethernet/mediatek/mtk_star_emac.c
+@@ -1054,7 +1054,7 @@ static int mtk_star_netdev_start_xmit(st
+ err_drop_packet:
+ dev_kfree_skb(skb);
+ ndev->stats.tx_dropped++;
+- return NETDEV_TX_BUSY;
++ return NETDEV_TX_OK;
+ }
+
+ /* Returns the number of bytes sent or a negative number on the first
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Wang Qing <wangqing@vivo.com>
+Date: Thu, 12 Nov 2020 18:45:41 +0200
+Subject: net: ethernet: ti: am65-cpts: update ret when ptp_clock is ERROR
+
+From: Wang Qing <wangqing@vivo.com>
+
+[ Upstream commit 81e329e93b860b31c216b40eb5e1373db0ffe0ba ]
+
+We always have to update the value of ret, otherwise the
+ error value may be the previous one.
+
+Fixes: f6bd59526ca5 ("net: ethernet: ti: introduce am654 common platform time sync driver")
+Signed-off-by: Wang Qing <wangqing@vivo.com>
+[grygorii.strashko@ti.com: fix build warn, subj add fixes tag]
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Link: https://lore.kernel.org/r/20201112164541.3223-1-grygorii.strashko@ti.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/am65-cpts.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/ti/am65-cpts.c
++++ b/drivers/net/ethernet/ti/am65-cpts.c
+@@ -1016,8 +1016,7 @@ struct am65_cpts *am65_cpts_create(struc
+ if (IS_ERR_OR_NULL(cpts->ptp_clock)) {
+ dev_err(dev, "Failed to register ptp clk %ld\n",
+ PTR_ERR(cpts->ptp_clock));
+- if (!cpts->ptp_clock)
+- ret = -ENODEV;
++ ret = cpts->ptp_clock ? PTR_ERR(cpts->ptp_clock) : -ENODEV;
+ goto refclk_disable;
+ }
+ cpts->phc_index = ptp_clock_index(cpts->ptp_clock);
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Thu, 12 Nov 2020 13:15:46 +0200
+Subject: net: ethernet: ti: cpsw: fix cpts irq after suspend
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit 2b5668733050fca85f0ab458c5b91732f9496a38 ]
+
+Depending on the SoC/platform the CPSW can completely lose context after a
+suspend/resume cycle, including CPSW wrapper (WR) which will cause reset of
+WR_C0_MISC_EN register, so CPTS IRQ will became disabled.
+
+Fix it by moving CPTS IRQ enabling in cpsw_ndo_open() where CPTS is
+actually started.
+
+Fixes: 84ea9c0a95d7 ("net: ethernet: ti: cpsw: enable cpts irq")
+Reported-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Tested-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20201112111546.20343-1-grygorii.strashko@ti.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/cpsw.c | 10 ++++++----
+ drivers/net/ethernet/ti/cpsw_new.c | 9 ++++++---
+ 2 files changed, 12 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -838,9 +838,12 @@ static int cpsw_ndo_open(struct net_devi
+ if (ret < 0)
+ goto err_cleanup;
+
+- if (cpts_register(cpsw->cpts))
+- dev_err(priv->dev, "error registering cpts device\n");
+-
++ if (cpsw->cpts) {
++ if (cpts_register(cpsw->cpts))
++ dev_err(priv->dev, "error registering cpts device\n");
++ else
++ writel(0x10, &cpsw->wr_regs->misc_en);
++ }
+ }
+
+ cpsw_restore(priv);
+@@ -1722,7 +1725,6 @@ static int cpsw_probe(struct platform_de
+
+ /* Enable misc CPTS evnt_pend IRQ */
+ cpts_set_irqpoll(cpsw->cpts, false);
+- writel(0x10, &cpsw->wr_regs->misc_en);
+
+ skip_cpts:
+ cpsw_notice(priv, probe,
+--- a/drivers/net/ethernet/ti/cpsw_new.c
++++ b/drivers/net/ethernet/ti/cpsw_new.c
+@@ -873,8 +873,12 @@ static int cpsw_ndo_open(struct net_devi
+ if (ret < 0)
+ goto err_cleanup;
+
+- if (cpts_register(cpsw->cpts))
+- dev_err(priv->dev, "error registering cpts device\n");
++ if (cpsw->cpts) {
++ if (cpts_register(cpsw->cpts))
++ dev_err(priv->dev, "error registering cpts device\n");
++ else
++ writel(0x10, &cpsw->wr_regs->misc_en);
++ }
+
+ napi_enable(&cpsw->napi_rx);
+ napi_enable(&cpsw->napi_tx);
+@@ -2009,7 +2013,6 @@ static int cpsw_probe(struct platform_de
+
+ /* Enable misc CPTS evnt_pend IRQ */
+ cpts_set_irqpoll(cpsw->cpts, false);
+- writel(0x10, &cpsw->wr_regs->misc_en);
+
+ skip_cpts:
+ ret = cpsw_register_notifiers(cpsw);
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+Date: Fri, 13 Nov 2020 14:49:33 +0800
+Subject: net: ethernet: ti: cpsw: fix error return code in cpsw_probe()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 35f735c665114840dcd3142f41148d07870f51f7 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 83a8471ba255 ("net: ethernet: ti: cpsw: refactor probe to group common hw initialization")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Link: https://lore.kernel.org/r/1605250173-18438-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/cpsw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -1640,6 +1640,7 @@ static int cpsw_probe(struct platform_de
+ CPSW_MAX_QUEUES, CPSW_MAX_QUEUES);
+ if (!ndev) {
+ dev_err(dev, "error allocating net_device\n");
++ ret = -ENOMEM;
+ goto clean_cpts;
+ }
+
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Zhang Qilong <zhangqilong3@huawei.com>
+Date: Tue, 10 Nov 2020 17:29:33 +0800
+Subject: net: fec: Fix reference count leak in fec series ops
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit da875fa5040b0f951cb4bf7efbf59f6dcff44d3c ]
+
+pm_runtime_get_sync() will increment pm usage at first and it will
+resume the device later. If runtime of the device has error or
+device is in inaccessible state(or other error state), resume
+operation will fail. If we do not call put operation to decrease
+the reference, it will result in reference count leak. Moreover,
+this device cannot enter the idle state and always stay busy or other
+non-idle state later. So we fixed it by replacing it with
+pm_runtime_resume_and_get.
+
+Fixes: 8fff755e9f8d0 ("net: fec: Ensure clocks are enabled while using mdio bus")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -1808,7 +1808,7 @@ static int fec_enet_mdio_read(struct mii
+ int ret = 0, frame_start, frame_addr, frame_op;
+ bool is_c45 = !!(regnum & MII_ADDR_C45);
+
+- ret = pm_runtime_get_sync(dev);
++ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0)
+ return ret;
+
+@@ -1867,11 +1867,9 @@ static int fec_enet_mdio_write(struct mi
+ int ret, frame_start, frame_addr;
+ bool is_c45 = !!(regnum & MII_ADDR_C45);
+
+- ret = pm_runtime_get_sync(dev);
++ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0)
+ return ret;
+- else
+- ret = 0;
+
+ if (is_c45) {
+ frame_start = FEC_MMFR_ST_C45;
+@@ -2276,7 +2274,7 @@ static void fec_enet_get_regs(struct net
+ u32 i, off;
+ int ret;
+
+- ret = pm_runtime_get_sync(dev);
++ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0)
+ return;
+
+@@ -2977,7 +2975,7 @@ fec_enet_open(struct net_device *ndev)
+ int ret;
+ bool reset_again;
+
+- ret = pm_runtime_get_sync(&fep->pdev->dev);
++ ret = pm_runtime_resume_and_get(&fep->pdev->dev);
+ if (ret < 0)
+ return ret;
+
+@@ -3771,7 +3769,7 @@ fec_drv_remove(struct platform_device *p
+ struct device_node *np = pdev->dev.of_node;
+ int ret;
+
+- ret = pm_runtime_get_sync(&pdev->dev);
++ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret < 0)
+ return ret;
+
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Joel Stanley <joel@jms.id.au>
+Date: Tue, 17 Nov 2020 13:14:48 +1030
+Subject: net: ftgmac100: Fix crash when removing driver
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit 3d5179458d22dc0b4fdc724e4bed4231a655112a ]
+
+When removing the driver we would hit BUG_ON(!list_empty(&dev->ptype_specific))
+in net/core/dev.c due to still having the NC-SI packet handler
+registered.
+
+ # echo 1e660000.ethernet > /sys/bus/platform/drivers/ftgmac100/unbind
+ ------------[ cut here ]------------
+ kernel BUG at net/core/dev.c:10254!
+ Internal error: Oops - BUG: 0 [#1] SMP ARM
+ CPU: 0 PID: 115 Comm: sh Not tainted 5.10.0-rc3-next-20201111-00007-g02e0365710c4 #46
+ Hardware name: Generic DT based system
+ PC is at netdev_run_todo+0x314/0x394
+ LR is at cpumask_next+0x20/0x24
+ pc : [<806f5830>] lr : [<80863cb0>] psr: 80000153
+ sp : 855bbd58 ip : 00000001 fp : 855bbdac
+ r10: 80c03d00 r9 : 80c06228 r8 : 81158c54
+ r7 : 00000000 r6 : 80c05dec r5 : 80c05d18 r4 : 813b9280
+ r3 : 813b9054 r2 : 8122c470 r1 : 00000002 r0 : 00000002
+ Flags: Nzcv IRQs on FIQs off Mode SVC_32 ISA ARM Segment none
+ Control: 00c5387d Table: 85514008 DAC: 00000051
+ Process sh (pid: 115, stack limit = 0x7cb5703d)
+ ...
+ Backtrace:
+ [<806f551c>] (netdev_run_todo) from [<80707eec>] (rtnl_unlock+0x18/0x1c)
+ r10:00000051 r9:854ed710 r8:81158c54 r7:80c76bb0 r6:81158c10 r5:8115b410
+ r4:813b9000
+ [<80707ed4>] (rtnl_unlock) from [<806f5db8>] (unregister_netdev+0x2c/0x30)
+ [<806f5d8c>] (unregister_netdev) from [<805a8180>] (ftgmac100_remove+0x20/0xa8)
+ r5:8115b410 r4:813b9000
+ [<805a8160>] (ftgmac100_remove) from [<805355e4>] (platform_drv_remove+0x34/0x4c)
+
+Fixes: bd466c3fb5a4 ("net/faraday: Support NCSI mode")
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Link: https://lore.kernel.org/r/20201117024448.1170761-1-joel@jms.id.au
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/faraday/ftgmac100.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/faraday/ftgmac100.c
++++ b/drivers/net/ethernet/faraday/ftgmac100.c
+@@ -1907,6 +1907,8 @@ err_register_netdev:
+ clk_disable_unprepare(priv->rclk);
+ clk_disable_unprepare(priv->clk);
+ err_ncsi_dev:
++ if (priv->ndev)
++ ncsi_unregister_dev(priv->ndev);
+ ftgmac100_destroy_mdio(netdev);
+ err_setup_mdio:
+ iounmap(priv->base);
+@@ -1926,6 +1928,8 @@ static int ftgmac100_remove(struct platf
+ netdev = platform_get_drvdata(pdev);
+ priv = netdev_priv(netdev);
+
++ if (priv->ndev)
++ ncsi_unregister_dev(priv->ndev);
+ unregister_netdev(netdev);
+
+ clk_disable_unprepare(priv->rclk);
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Mon, 16 Nov 2020 19:52:34 -0800
+Subject: net: Have netpoll bring-up DSA management interface
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 1532b9778478577152201adbafa7738b1e844868 ]
+
+DSA network devices rely on having their DSA management interface up and
+running otherwise their ndo_open() will return -ENETDOWN. Without doing
+this it would not be possible to use DSA devices as netconsole when
+configured on the command line. These devices also do not utilize the
+upper/lower linking so the check about the netpoll device having upper
+is not going to be a problem.
+
+The solution adopted here is identical to the one done for
+net/ipv4/ipconfig.c with 728c02089a0e ("net: ipv4: handle DSA enabled
+master network devices"), with the network namespace scope being
+restricted to that of the process configuring netpoll.
+
+Fixes: 04ff53f96a93 ("net: dsa: Add netconsole support")
+Tested-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20201117035236.22658-1-f.fainelli@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/netpoll.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -29,6 +29,7 @@
+ #include <linux/slab.h>
+ #include <linux/export.h>
+ #include <linux/if_vlan.h>
++#include <net/dsa.h>
+ #include <net/tcp.h>
+ #include <net/udp.h>
+ #include <net/addrconf.h>
+@@ -657,15 +658,15 @@ EXPORT_SYMBOL_GPL(__netpoll_setup);
+
+ int netpoll_setup(struct netpoll *np)
+ {
+- struct net_device *ndev = NULL;
++ struct net_device *ndev = NULL, *dev = NULL;
++ struct net *net = current->nsproxy->net_ns;
+ struct in_device *in_dev;
+ int err;
+
+ rtnl_lock();
+- if (np->dev_name[0]) {
+- struct net *net = current->nsproxy->net_ns;
++ if (np->dev_name[0])
+ ndev = __dev_get_by_name(net, np->dev_name);
+- }
++
+ if (!ndev) {
+ np_err(np, "%s doesn't exist, aborting\n", np->dev_name);
+ err = -ENODEV;
+@@ -673,6 +674,19 @@ int netpoll_setup(struct netpoll *np)
+ }
+ dev_hold(ndev);
+
++ /* bring up DSA management network devices up first */
++ for_each_netdev(net, dev) {
++ if (!netdev_uses_dsa(dev))
++ continue;
++
++ err = dev_change_flags(dev, dev->flags | IFF_UP, NULL);
++ if (err < 0) {
++ np_err(np, "%s failed to open %s\n",
++ np->dev_name, dev->name);
++ goto put;
++ }
++ }
++
+ if (netdev_master_upper_dev_get(ndev)) {
+ np_err(np, "%s is a slave device, aborting\n", np->dev_name);
+ err = -EBUSY;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Alex Elder <elder@linaro.org>
+Date: Sat, 14 Nov 2020 12:20:17 -0600
+Subject: net: ipa: lock when freeing transaction
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 064c9c32b17ca9b36f95eba32ee790dbbebd9a5f ]
+
+Transactions sit on one of several lists, depending on their state
+(allocated, pending, complete, or polled). A spinlock protects
+against concurrent access when transactions are moved between these
+lists.
+
+Transactions are also reference counted. A newly-allocated
+transaction has an initial count of 1; a transaction is released in
+gsi_trans_free() only if its decremented reference count reaches 0.
+Releasing a transaction includes removing it from the polled (or if
+unused, allocated) list, so the spinlock is acquired when we release
+a transaction.
+
+The reference count is used to allow a caller to synchronously wait
+for a committed transaction to complete. In this case, the waiter
+takes an extra reference to the transaction *before* committing it
+(so it won't be freed), and releases its reference (calls
+gsi_trans_free()) when it is done with it.
+
+Similarly, gsi_channel_update() takes an extra reference to ensure a
+transaction isn't released before the function is done operating on
+it. Until the transaction is moved to the completed list (by this
+function) it won't be freed, so this reference is taken "safely."
+
+But in the quiesce path, we want to wait for the "last" transaction,
+which we find in the completed or polled list. Transactions on
+these lists can be freed at any time, so we (try to) prevent that
+by taking the reference while holding the spinlock.
+
+Currently gsi_trans_free() decrements a transaction's reference
+count unconditionally, acquiring the lock to remove the transaction
+from its list *only* when the count reaches 0. This does not
+protect the quiesce path, which depends on the lock to ensure its
+extra reference prevents release of the transaction.
+
+Fix this by only dropping the last reference to a transaction
+in gsi_trans_free() while holding the spinlock.
+
+Fixes: 9dd441e4ed575 ("soc: qcom: ipa: GSI transactions")
+Reported-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Alex Elder <elder@linaro.org>
+Link: https://lore.kernel.org/r/20201114182017.28270-1-elder@linaro.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ipa/gsi_trans.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ipa/gsi_trans.c
++++ b/drivers/net/ipa/gsi_trans.c
+@@ -363,22 +363,31 @@ struct gsi_trans *gsi_channel_trans_allo
+ return trans;
+ }
+
+-/* Free a previously-allocated transaction (used only in case of error) */
++/* Free a previously-allocated transaction */
+ void gsi_trans_free(struct gsi_trans *trans)
+ {
++ refcount_t *refcount = &trans->refcount;
+ struct gsi_trans_info *trans_info;
++ bool last;
+
+- if (!refcount_dec_and_test(&trans->refcount))
++ /* We must hold the lock to release the last reference */
++ if (refcount_dec_not_one(refcount))
+ return;
+
+ trans_info = &trans->gsi->channel[trans->channel_id].trans_info;
+
+ spin_lock_bh(&trans_info->spinlock);
+
+- list_del(&trans->links);
++ /* Reference might have been added before we got the lock */
++ last = refcount_dec_and_test(refcount);
++ if (last)
++ list_del(&trans->links);
+
+ spin_unlock_bh(&trans_info->spinlock);
+
++ if (!last)
++ return;
++
+ ipa_gsi_trans_release(trans);
+
+ /* Releasing the reserved TREs implicitly frees the sgl[] and
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Sun, 15 Nov 2020 17:57:57 +0100
+Subject: net: lantiq: Wait for the GPHY firmware to be ready
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 2a1828e378c1b5ba1ff283ed8f8c5cc37bb391dc ]
+
+A user reports (slightly shortened from the original message):
+ libphy: lantiq,xrx200-mdio: probed
+ mdio_bus 1e108000.switch-mii: MDIO device at address 17 is missing.
+ gswip 1e108000.switch lan: no phy at 2
+ gswip 1e108000.switch lan: failed to connect to port 2: -19
+ lantiq,xrx200-net 1e10b308.eth eth0: error -19 setting up slave phy
+
+This is a single-port board using the internal Fast Ethernet PHY. The
+user reports that switching to PHY scanning instead of configuring the
+PHY within device-tree works around this issue.
+
+The documentation for the standalone variant of the PHY11G (which is
+probably very similar to what is used inside the xRX200 SoCs but having
+the firmware burnt onto that standalone chip in the factory) states that
+the PHY needs 300ms to be ready for MDIO communication after releasing
+the reset.
+
+Add a 300ms delay after initializing all GPHYs to ensure that the GPHY
+firmware had enough time to initialize and to appear on the MDIO bus.
+Unfortunately there is no (known) documentation on what the minimum time
+to wait after releasing the reset on an internal PHY so play safe and
+take the one for the external variant. Only wait after the last GPHY
+firmware is loaded to not slow down the initialization too much (
+xRX200 has two GPHYs but newer SoCs have at least three GPHYs).
+
+Fixes: 14fceff4771e51 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20201115165757.552641-1-martin.blumenstingl@googlemail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/lantiq_gswip.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/net/dsa/lantiq_gswip.c
++++ b/drivers/net/dsa/lantiq_gswip.c
+@@ -26,6 +26,7 @@
+ */
+
+ #include <linux/clk.h>
++#include <linux/delay.h>
+ #include <linux/etherdevice.h>
+ #include <linux/firmware.h>
+ #include <linux/if_bridge.h>
+@@ -1821,6 +1822,16 @@ static int gswip_gphy_fw_list(struct gsw
+ i++;
+ }
+
++ /* The standalone PHY11G requires 300ms to be fully
++ * initialized and ready for any MDIO communication after being
++ * taken out of reset. For the SoC-internal GPHY variant there
++ * is no (known) documentation for the minimum time after a
++ * reset. Use the same value as for the standalone variant as
++ * some users have reported internal PHYs not being detected
++ * without any delay.
++ */
++ msleep(300);
++
+ return 0;
+
+ remove_gphy:
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Aya Levin <ayal@nvidia.com>
+Date: Wed, 18 Nov 2020 10:19:22 +0200
+Subject: net/mlx4_core: Fix init_hca fields offset
+
+From: Aya Levin <ayal@nvidia.com>
+
+[ Upstream commit 6d9c8d15af0ef20a66a0b432cac0d08319920602 ]
+
+Slave function read the following capabilities from the wrong offset:
+1. log_mc_entry_sz
+2. fs_log_entry_sz
+3. log_mc_hash_sz
+
+Fix that by adjusting these capabilities offset to match firmware
+layout.
+
+Due to the wrong offset read, the following issues might occur:
+1+2. Negative value reported at max_mcast_qp_attach.
+3. Driver to init FW with multicast hash size of zero.
+
+Fixes: a40ded604365 ("net/mlx4_core: Add masking for a few queries on HCA caps")
+Signed-off-by: Aya Levin <ayal@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Eran Ben Elisha <eranbe@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://lore.kernel.org/r/20201118081922.553-1-tariqt@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/fw.c | 6 +++---
+ drivers/net/ethernet/mellanox/mlx4/fw.h | 4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
+@@ -1864,8 +1864,8 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev,
+ #define INIT_HCA_LOG_RD_OFFSET (INIT_HCA_QPC_OFFSET + 0x77)
+ #define INIT_HCA_MCAST_OFFSET 0x0c0
+ #define INIT_HCA_MC_BASE_OFFSET (INIT_HCA_MCAST_OFFSET + 0x00)
+-#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x12)
+-#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x16)
++#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x13)
++#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x17)
+ #define INIT_HCA_UC_STEERING_OFFSET (INIT_HCA_MCAST_OFFSET + 0x18)
+ #define INIT_HCA_LOG_MC_TABLE_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x1b)
+ #define INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN 0x6
+@@ -1873,7 +1873,7 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev,
+ #define INIT_HCA_DRIVER_VERSION_SZ 0x40
+ #define INIT_HCA_FS_PARAM_OFFSET 0x1d0
+ #define INIT_HCA_FS_BASE_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x00)
+-#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x12)
++#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x13)
+ #define INIT_HCA_FS_A0_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x18)
+ #define INIT_HCA_FS_LOG_TABLE_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x1b)
+ #define INIT_HCA_FS_ETH_BITS_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x21)
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.h
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.h
+@@ -182,8 +182,8 @@ struct mlx4_init_hca_param {
+ u64 cmpt_base;
+ u64 mtt_base;
+ u64 global_caps;
+- u16 log_mc_entry_sz;
+- u16 log_mc_hash_sz;
++ u8 log_mc_entry_sz;
++ u8 log_mc_hash_sz;
+ u16 hca_core_clock; /* Internal Clock Frequency (in MHz) */
+ u8 log_num_qps;
+ u8 log_num_srqs;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Michael Guralnik <michaelgur@nvidia.com>
+Date: Mon, 2 Nov 2020 17:34:44 +0200
+Subject: net/mlx5: Add handling of port type in rule deletion
+
+From: Michael Guralnik <michaelgur@nvidia.com>
+
+[ Upstream commit 8cbcc5ef2a281f6bb10099f4572a08cb765ffbf4 ]
+
+Handle destruction of rules with port destination type to enable
+full destruction of flow.
+
+Without this handling of TX rules the deletion of these rules fails.
+Dmesg of flow destruction failure:
+
+[ 203.714146] mlx5_core 0000:00:0b.0: mlx5_cmd_check:753:(pid 342): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0x144b7a)
+[ 210.547387] ------------[ cut here ]------------
+[ 210.548663] refcount_t: decrement hit 0; leaking memory.
+[ 210.550651] WARNING: CPU: 4 PID: 342 at lib/refcount.c:31 refcount_warn_saturate+0x5c/0x110
+[ 210.550654] Modules linked in: mlx5_ib mlx5_core ib_ipoib rdma_ucm rdma_cm iw_cm ib_cm ib_umad ib_uverbs ib_core
+[ 210.550675] CPU: 4 PID: 342 Comm: test Not tainted 5.8.0-rc2+ #116
+[ 210.550678] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+[ 210.550680] RIP: 0010:refcount_warn_saturate+0x5c/0x110
+[ 210.550685] Code: c6 d1 1b 01 00 0f 84 ad 00 00 00 5b 5d c3 80 3d b5 d1 1b 01 00 75 f4 48 c7 c7 20 d1 15 82 c6 05 a5 d1 1b 01 01 e8 a7 eb af ff <0f> 0b eb dd 80 3d 99 d1 1b 01 00 75 d4 48 c7 c7 c0 cf 15 82 c6 05
+[ 210.550687] RSP: 0018:ffff8881642e77e8 EFLAGS: 00010282
+[ 210.550691] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000
+[ 210.550694] RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffffed102c85ceef
+[ 210.550696] RBP: ffff888161720428 R08: ffffffff8124c10e R09: ffffed103243beae
+[ 210.550698] R10: ffff8881921df56b R11: ffffed103243bead R12: ffff8881841b4180
+[ 210.550701] R13: ffff888161720428 R14: ffff8881616d0000 R15: ffff888161720380
+[ 210.550704] FS: 00007fc27f025740(0000) GS:ffff888192000000(0000) knlGS:0000000000000000
+[ 210.550706] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 210.550708] CR2: 0000557e4b41a6a0 CR3: 0000000002415004 CR4: 0000000000360ea0
+[ 210.550711] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 210.550713] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 210.550715] Call Trace:
+[ 210.550717] mlx5_del_flow_rules+0x484/0x490 [mlx5_core]
+[ 210.550720] ? mlx5_cmd_set_fte+0xa80/0xa80 [mlx5_core]
+[ 210.550722] mlx5_ib_destroy_flow+0x17f/0x280 [mlx5_ib]
+[ 210.550724] uverbs_free_flow+0x4c/0x90 [ib_uverbs]
+[ 210.550726] destroy_hw_idr_uobject+0x41/0xb0 [ib_uverbs]
+[ 210.550728] uverbs_destroy_uobject+0xaa/0x390 [ib_uverbs]
+[ 210.550731] __uverbs_cleanup_ufile+0x129/0x1b0 [ib_uverbs]
+[ 210.550733] ? uverbs_destroy_uobject+0x390/0x390 [ib_uverbs]
+[ 210.550735] uverbs_destroy_ufile_hw+0x78/0x190 [ib_uverbs]
+[ 210.550737] ib_uverbs_close+0x36/0x140 [ib_uverbs]
+[ 210.550739] __fput+0x181/0x380
+[ 210.550741] task_work_run+0x88/0xd0
+[ 210.550743] do_exit+0x5f6/0x13b0
+[ 210.550745] ? sched_clock_cpu+0x30/0x140
+[ 210.550747] ? is_current_pgrp_orphaned+0x70/0x70
+[ 210.550750] ? lock_downgrade+0x360/0x360
+[ 210.550752] ? mark_held_locks+0x1d/0x90
+[ 210.550754] do_group_exit+0x8a/0x140
+[ 210.550756] get_signal+0x20a/0xf50
+[ 210.550758] do_signal+0x8c/0xbe0
+[ 210.550760] ? hrtimer_nanosleep+0x1d8/0x200
+[ 210.550762] ? nanosleep_copyout+0x50/0x50
+[ 210.550764] ? restore_sigcontext+0x320/0x320
+[ 210.550766] ? __hrtimer_init+0xf0/0xf0
+[ 210.550768] ? timespec64_add_safe+0x150/0x150
+[ 210.550770] ? mark_held_locks+0x1d/0x90
+[ 210.550772] ? lockdep_hardirqs_on_prepare+0x14c/0x240
+[ 210.550774] __prepare_exit_to_usermode+0x119/0x170
+[ 210.550776] do_syscall_64+0x65/0x300
+[ 210.550778] ? trace_hardirqs_off+0x10/0x120
+[ 210.550781] ? mark_held_locks+0x1d/0x90
+[ 210.550783] ? asm_sysvec_apic_timer_interrupt+0xa/0x20
+[ 210.550785] ? lockdep_hardirqs_on+0x112/0x190
+[ 210.550787] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 210.550789] RIP: 0033:0x7fc27f1cd157
+[ 210.550791] Code: Bad RIP value.
+[ 210.550793] RSP: 002b:00007ffd4db27ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000023
+[ 210.550798] RAX: fffffffffffffdfc RBX: ffffffffffffff80 RCX: 00007fc27f1cd157
+[ 210.550800] RDX: 00007fc27f025740 RSI: 00007ffd4db27eb0 RDI: 00007ffd4db27eb0
+[ 210.550803] RBP: 0000000000000016 R08: 0000000000000000 R09: 000000000000000e
+[ 210.550805] R10: 00007ffd4db27dc7 R11: 0000000000000246 R12: 0000000000400c00
+[ 210.550808] R13: 00007ffd4db285f0 R14: 0000000000000000 R15: 0000000000000000
+[ 210.550809] irq event stamp: 49399
+[ 210.550812] hardirqs last enabled at (49399): [<ffffffff81172d36>] console_unlock+0x556/0x6f0
+[ 210.550815] hardirqs last disabled at (49398): [<ffffffff81172897>] console_unlock+0xb7/0x6f0
+[ 210.550818] softirqs last enabled at (48706): [<ffffffff81e0037b>] __do_softirq+0x37b/0x60c
+[ 210.550820] softirqs last disabled at (48697): [<ffffffff81c00e2f>] asm_call_on_stack+0xf/0x20
+[ 210.550822] ---[ end trace ad18c0e6fa846454 ]---
+[ 210.581862] mlx5_core 0000:00:0c.0: mlx5_destroy_flow_table:2132:(pid 342): Flow table 262150 wasn't destroyed, refcount > 1
+
+Fixes: a7ee18bdee83 ("RDMA/mlx5: Allow creating a matcher for a NIC TX flow table")
+Signed-off-by: Michael Guralnik <michaelgur@nvidia.com>
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -519,6 +519,13 @@ static void del_sw_hw_rule(struct fs_nod
+ goto out;
+ }
+
++ if (rule->dest_attr.type == MLX5_FLOW_DESTINATION_TYPE_PORT &&
++ --fte->dests_size) {
++ fte->modify_mask |= BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_ACTION);
++ fte->action.action &= ~MLX5_FLOW_CONTEXT_ACTION_ALLOW;
++ goto out;
++ }
++
+ if ((fte->action.action & MLX5_FLOW_CONTEXT_ACTION_FWD_DEST) &&
+ --fte->dests_size) {
+ fte->modify_mask |=
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Vladyslav Tarasiuk <vladyslavt@nvidia.com>
+Date: Mon, 2 Nov 2020 13:45:24 +0200
+Subject: net/mlx5: Clear bw_share upon VF disable
+
+From: Vladyslav Tarasiuk <vladyslavt@nvidia.com>
+
+[ Upstream commit 1ce5fc724a26e0b476e42c5d588bdb80caea003b ]
+
+Currently, if user disables VFs with some min and max rates configured,
+they are cleared. But QoS data is not cleared and restored upon next VF
+enable placing limits on minimal rate for given VF, when user expects
+none.
+
+To match cleared vport->info struct with QoS-related min and max rates
+upon VF disable, clear vport->qos struct too.
+
+Fixes: 556b9d16d3f5 ("net/mlx5: Clear VF's configuration on disabling SRIOV")
+Signed-off-by: Vladyslav Tarasiuk <vladyslavt@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -1408,6 +1408,7 @@ static void mlx5_eswitch_clear_vf_vports
+ int i;
+
+ mlx5_esw_for_each_vf_vport(esw, i, vport, esw->esw_funcs.num_vfs) {
++ memset(&vport->qos, 0, sizeof(vport->qos));
+ memset(&vport->info, 0, sizeof(vport->info));
+ vport->info.link_state = MLX5_VPORT_ADMIN_STATE_AUTO;
+ }
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Vladyslav Tarasiuk <vladyslavt@nvidia.com>
+Date: Wed, 21 Oct 2020 11:05:41 +0300
+Subject: net/mlx5: Disable QoS when min_rates on all VFs are zero
+
+From: Vladyslav Tarasiuk <vladyslavt@nvidia.com>
+
+[ Upstream commit 470b74758260e4abc2508cf1614573c00a00465c ]
+
+Currently when QoS is enabled for VF and any min_rate is configured,
+the driver sets bw_share value to at least 1 and doesn’t allow to set
+it to 0 to make minimal rate unlimited. It means there is always a
+minimal rate configured for every VF, even if user tries to remove it.
+
+In order to make QoS disable possible, check whether all vports have
+configured min_rate = 0. If this is true, set their bw_share to 0 to
+disable min_rate limitations.
+
+Fixes: c9497c98901c ("net/mlx5: Add support for setting VF min rate")
+Signed-off-by: Vladyslav Tarasiuk <vladyslavt@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -2222,12 +2222,15 @@ static u32 calculate_vports_min_rate_div
+ max_guarantee = evport->info.min_rate;
+ }
+
+- return max_t(u32, max_guarantee / fw_max_bw_share, 1);
++ if (max_guarantee)
++ return max_t(u32, max_guarantee / fw_max_bw_share, 1);
++ return 0;
+ }
+
+-static int normalize_vports_min_rate(struct mlx5_eswitch *esw, u32 divider)
++static int normalize_vports_min_rate(struct mlx5_eswitch *esw)
+ {
+ u32 fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share);
++ u32 divider = calculate_vports_min_rate_divider(esw);
+ struct mlx5_vport *evport;
+ u32 vport_max_rate;
+ u32 vport_min_rate;
+@@ -2240,9 +2243,9 @@ static int normalize_vports_min_rate(str
+ continue;
+ vport_min_rate = evport->info.min_rate;
+ vport_max_rate = evport->info.max_rate;
+- bw_share = MLX5_MIN_BW_SHARE;
++ bw_share = 0;
+
+- if (vport_min_rate)
++ if (divider)
+ bw_share = MLX5_RATE_TO_BW_SHARE(vport_min_rate,
+ divider,
+ fw_max_bw_share);
+@@ -2267,7 +2270,6 @@ int mlx5_eswitch_set_vport_rate(struct m
+ struct mlx5_vport *evport = mlx5_eswitch_get_vport(esw, vport);
+ u32 fw_max_bw_share;
+ u32 previous_min_rate;
+- u32 divider;
+ bool min_rate_supported;
+ bool max_rate_supported;
+ int err = 0;
+@@ -2292,8 +2294,7 @@ int mlx5_eswitch_set_vport_rate(struct m
+
+ previous_min_rate = evport->info.min_rate;
+ evport->info.min_rate = min_rate;
+- divider = calculate_vports_min_rate_divider(esw);
+- err = normalize_vports_min_rate(esw, divider);
++ err = normalize_vports_min_rate(esw);
+ if (err) {
+ evport->info.min_rate = previous_min_rate;
+ goto unlock;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Maor Dickman <maord@nvidia.com>
+Date: Wed, 4 Nov 2020 14:10:30 +0200
+Subject: net/mlx5e: Fix check if netdev is bond slave
+
+From: Maor Dickman <maord@nvidia.com>
+
+[ Upstream commit 219b3267ca102a35092f5998921a9e6f99074af2 ]
+
+Bond events handler uses bond_slave_get_rtnl to check if net device
+is bond slave. bond_slave_get_rtnl return the rcu rx_handler pointer
+from the netdev which exists for bond slaves but also exists for
+devices that are attached to linux bridge so using it as indication
+for bond slave is wrong.
+
+Fix by using netif_is_lag_port instead.
+
+Fixes: 7e51891a237f ("net/mlx5e: Use netdev events to set/del egress acl forward-to-vport rule")
+Signed-off-by: Maor Dickman <maord@nvidia.com>
+Reviewed-by: Raed Salem <raeds@nvidia.com>
+Reviewed-by: Ariel Levkovich <lariel@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c
+@@ -187,7 +187,7 @@ static bool mlx5e_rep_is_lag_netdev(stru
+ struct mlx5e_priv *priv;
+
+ /* A given netdev is not a representor or not a slave of LAG configuration */
+- if (!mlx5e_eswitch_rep(netdev) || !bond_slave_get_rtnl(netdev))
++ if (!mlx5e_eswitch_rep(netdev) || !netif_is_lag_port(netdev))
+ return false;
+
+ priv = netdev_priv(netdev);
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+Date: Thu, 8 Oct 2020 12:34:10 +0300
+Subject: net/mlx5e: Fix refcount leak on kTLS RX resync
+
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+
+[ Upstream commit ea63609857321c38fd4ad096388b413b66001c6c ]
+
+On resync, the driver calls inet_lookup_established
+(__inet6_lookup_established) that increases sk_refcnt of the socket. To
+decrease it, the driver set skb->destructor to sock_edemux. However, it
+didn't work well, because the TCP stack also sets this destructor for
+early demux, and the refcount gets decreased only once, while increased
+two times (in mlx5e and in the TCP stack). It leads to a socket leak, a
+TLS context leak, which in the end leads to calling tls_dev_del twice:
+on socket close and on driver unload, which in turn leads to a crash.
+
+This commit fixes the refcount leak by calling sock_gen_put right away
+after using the socket, thus fixing all the subsequent issues.
+
+Fixes: 0419d8c9d8f8 ("net/mlx5e: kTLS, Add kTLS RX resync support")
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
+@@ -476,19 +476,22 @@ static void resync_update_sn(struct mlx5
+
+ depth += sizeof(struct tcphdr);
+
+- if (unlikely(!sk || sk->sk_state == TCP_TIME_WAIT))
++ if (unlikely(!sk))
+ return;
+
+- if (unlikely(!resync_queue_get_psv(sk)))
+- return;
++ if (unlikely(sk->sk_state == TCP_TIME_WAIT))
++ goto unref;
+
+- skb->sk = sk;
+- skb->destructor = sock_edemux;
++ if (unlikely(!resync_queue_get_psv(sk)))
++ goto unref;
+
+ seq = th->seq;
+ datalen = skb->len - depth;
+ tls_offload_rx_resync_async_request_start(sk, seq, datalen);
+ rq->stats->tls_resync_req_start++;
++
++unref:
++ sock_gen_put(sk);
+ }
+
+ void mlx5e_ktls_rx_resync(struct net_device *netdev, struct sock *sk,
--- /dev/null
+From foo@baz Sun Nov 22 10:24:41 AM CET 2020
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 13 Nov 2020 19:16:57 +0100
+Subject: net: mvneta: fix possible memory leak in mvneta_swbm_add_rx_fragment
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 9c79a8ab5f124db01eb1d7287454a702f0d4252f ]
+
+Recycle the page running page_pool_put_full_page() in
+mvneta_swbm_add_rx_fragment routine when the last descriptor
+contains just the FCS or if the received packet contains more than
+MAX_SKB_FRAGS fragments
+
+Fixes: ca0e014609f0 ("net: mvneta: move skb build after descriptors processing")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/df6a2bad70323ee58d3901491ada31c1ca2a40b9.1605291228.git.lorenzo@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -2287,6 +2287,7 @@ mvneta_swbm_add_rx_fragment(struct mvnet
+ dma_sync_single_for_cpu(dev->dev.parent,
+ rx_desc->buf_phys_addr,
+ len, dma_dir);
++ rx_desc->buf_phys_addr = 0;
+
+ if (data_len > 0 && sinfo->nr_frags < MAX_SKB_FRAGS) {
+ skb_frag_t *frag = &sinfo->frags[sinfo->nr_frags];
+@@ -2295,8 +2296,8 @@ mvneta_swbm_add_rx_fragment(struct mvnet
+ skb_frag_size_set(frag, data_len);
+ __skb_frag_set_page(frag, page);
+ sinfo->nr_frags++;
+-
+- rx_desc->buf_phys_addr = 0;
++ } else {
++ page_pool_put_full_page(rxq->page_pool, page, true);
+ }
+ *size -= len;
+ }
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Joel Stanley <joel@jms.id.au>
+Date: Thu, 12 Nov 2020 16:42:10 +1030
+Subject: net/ncsi: Fix netlink registration
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit 1922a46b8c18cb09d33e06a6cc2e43844ac1b9d0 ]
+
+If a user unbinds and re-binds a NC-SI aware driver the kernel will
+attempt to register the netlink interface at runtime. The structure is
+marked __ro_after_init so registration fails spectacularly at this point.
+
+ # echo 1e660000.ethernet > /sys/bus/platform/drivers/ftgmac100/unbind
+ # echo 1e660000.ethernet > /sys/bus/platform/drivers/ftgmac100/bind
+ ftgmac100 1e660000.ethernet: Read MAC address 52:54:00:12:34:56 from chip
+ ftgmac100 1e660000.ethernet: Using NCSI interface
+ 8<--- cut here ---
+ Unable to handle kernel paging request at virtual address 80a8f858
+ pgd = 8c768dd6
+ [80a8f858] *pgd=80a0841e(bad)
+ Internal error: Oops: 80d [#1] SMP ARM
+ CPU: 0 PID: 116 Comm: sh Not tainted 5.10.0-rc3-next-20201111-00003-gdd25b227ec1e #51
+ Hardware name: Generic DT based system
+ PC is at genl_register_family+0x1f8/0x6d4
+ LR is at 0xff26ffff
+ pc : [<8073f930>] lr : [<ff26ffff>] psr: 20000153
+ sp : 8553bc80 ip : 81406244 fp : 8553bd04
+ r10: 8085d12c r9 : 80a8f73c r8 : 85739000
+ r7 : 00000017 r6 : 80a8f860 r5 : 80c8ab98 r4 : 80a8f858
+ r3 : 00000000 r2 : 00000000 r1 : 81406130 r0 : 00000017
+ Flags: nzCv IRQs on FIQs off Mode SVC_32 ISA ARM Segment none
+ Control: 00c5387d Table: 85524008 DAC: 00000051
+ Process sh (pid: 116, stack limit = 0x1f1988d6)
+ ...
+ Backtrace:
+ [<8073f738>] (genl_register_family) from [<80860ac0>] (ncsi_init_netlink+0x20/0x48)
+ r10:8085d12c r9:80c8fb0c r8:85739000 r7:00000000 r6:81218000 r5:85739000
+ r4:8121c000
+ [<80860aa0>] (ncsi_init_netlink) from [<8085d740>] (ncsi_register_dev+0x1b0/0x210)
+ r5:8121c400 r4:8121c000
+ [<8085d590>] (ncsi_register_dev) from [<805a8060>] (ftgmac100_probe+0x6e0/0x778)
+ r10:00000004 r9:80950228 r8:8115bc10 r7:8115ab00 r6:9eae2c24 r5:813b6f88
+ r4:85739000
+ [<805a7980>] (ftgmac100_probe) from [<805355ec>] (platform_drv_probe+0x58/0xa8)
+ r9:80c76bb0 r8:00000000 r7:80cd4974 r6:80c76bb0 r5:8115bc10 r4:00000000
+ [<80535594>] (platform_drv_probe) from [<80532d58>] (really_probe+0x204/0x514)
+ r7:80cd4974 r6:00000000 r5:80cd4868 r4:8115bc10
+
+Jakub pointed out that ncsi_register_dev is obviously broken, because
+there is only one family so it would never work if there was more than
+one ncsi netdev.
+
+Fix the crash by registering the netlink family once on boot, and drop
+the code to unregister it.
+
+Fixes: 955dc68cb9b2 ("net/ncsi: Add generic netlink family")
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
+Link: https://lore.kernel.org/r/20201112061210.914621-1-joel@jms.id.au
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ncsi/ncsi-manage.c | 5 -----
+ net/ncsi/ncsi-netlink.c | 22 +++-------------------
+ net/ncsi/ncsi-netlink.h | 3 ---
+ 3 files changed, 3 insertions(+), 27 deletions(-)
+
+--- a/net/ncsi/ncsi-manage.c
++++ b/net/ncsi/ncsi-manage.c
+@@ -1726,9 +1726,6 @@ struct ncsi_dev *ncsi_register_dev(struc
+ ndp->ptype.dev = dev;
+ dev_add_pack(&ndp->ptype);
+
+- /* Set up generic netlink interface */
+- ncsi_init_netlink(dev);
+-
+ pdev = to_platform_device(dev->dev.parent);
+ if (pdev) {
+ np = pdev->dev.of_node;
+@@ -1892,8 +1889,6 @@ void ncsi_unregister_dev(struct ncsi_dev
+ list_del_rcu(&ndp->node);
+ spin_unlock_irqrestore(&ncsi_dev_lock, flags);
+
+- ncsi_unregister_netlink(nd->dev);
+-
+ kfree(ndp);
+ }
+ EXPORT_SYMBOL_GPL(ncsi_unregister_dev);
+--- a/net/ncsi/ncsi-netlink.c
++++ b/net/ncsi/ncsi-netlink.c
+@@ -766,24 +766,8 @@ static struct genl_family ncsi_genl_fami
+ .n_ops = ARRAY_SIZE(ncsi_ops),
+ };
+
+-int ncsi_init_netlink(struct net_device *dev)
++static int __init ncsi_init_netlink(void)
+ {
+- int rc;
+-
+- rc = genl_register_family(&ncsi_genl_family);
+- if (rc)
+- netdev_err(dev, "ncsi: failed to register netlink family\n");
+-
+- return rc;
+-}
+-
+-int ncsi_unregister_netlink(struct net_device *dev)
+-{
+- int rc;
+-
+- rc = genl_unregister_family(&ncsi_genl_family);
+- if (rc)
+- netdev_err(dev, "ncsi: failed to unregister netlink family\n");
+-
+- return rc;
++ return genl_register_family(&ncsi_genl_family);
+ }
++subsys_initcall(ncsi_init_netlink);
+--- a/net/ncsi/ncsi-netlink.h
++++ b/net/ncsi/ncsi-netlink.h
+@@ -22,7 +22,4 @@ int ncsi_send_netlink_err(struct net_dev
+ struct nlmsghdr *nlhdr,
+ int err);
+
+-int ncsi_init_netlink(struct net_device *dev);
+-int ncsi_unregister_netlink(struct net_device *dev);
+-
+ #endif /* __NCSI_NETLINK_H__ */
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Steen Hegelund <steen.hegelund@microchip.com>
+Date: Fri, 13 Nov 2020 10:11:16 +0100
+Subject: net: phy: mscc: remove non-MACSec compatible phy
+
+From: Steen Hegelund <steen.hegelund@microchip.com>
+
+[ Upstream commit aa6306a8481e0223f3783d24045daea80897238e ]
+
+Selecting VSC8575 as a MACSec PHY was not correct
+
+The relevant datasheet can be found here:
+ - VSC8575: https://www.microchip.com/wwwproducts/en/VSC8575
+
+History:
+v1 -> v2:
+ - Corrected the sha in the "Fixes:" tag
+
+Fixes: 1bbe0ecc2a1a ("net: phy: mscc: macsec initialization")
+Signed-off-by: Steen Hegelund <steen.hegelund@microchip.com>
+Reviewed-by: Antoine Tenart <atenart@kernel.org>
+Link: https://lore.kernel.org/r/20201113091116.1102450-1-steen.hegelund@microchip.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/mscc/mscc_macsec.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/phy/mscc/mscc_macsec.c
++++ b/drivers/net/phy/mscc/mscc_macsec.c
+@@ -981,7 +981,6 @@ int vsc8584_macsec_init(struct phy_devic
+
+ switch (phydev->phy_id & phydev->drv->phy_id_mask) {
+ case PHY_ID_VSC856X:
+- case PHY_ID_VSC8575:
+ case PHY_ID_VSC8582:
+ case PHY_ID_VSC8584:
+ INIT_LIST_HEAD(&vsc8531->macsec_flows);
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
+Date: Fri, 13 Nov 2020 13:12:05 -0700
+Subject: net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup
+
+From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
+
+[ Upstream commit fc70f5bf5e525dde81565f0a30d5e39168062eba ]
+
+During rmnet unregistration, the real device rx_handler is first cleared
+followed by the removal of rx_handler_data after the rcu synchronization.
+
+Any packets in the receive path may observe that the rx_handler is NULL.
+However, there is no check when dereferencing this value to use the
+rmnet_port information.
+
+This fixes following splat by adding the NULL check.
+
+Unable to handle kernel NULL pointer dereference at virtual
+address 000000000000000d
+pc : rmnet_rx_handler+0x124/0x284
+lr : rmnet_rx_handler+0x124/0x284
+ rmnet_rx_handler+0x124/0x284
+ __netif_receive_skb_core+0x758/0xd74
+ __netif_receive_skb+0x50/0x17c
+ process_backlog+0x15c/0x1b8
+ napi_poll+0x88/0x284
+ net_rx_action+0xbc/0x23c
+ __do_softirq+0x20c/0x48c
+
+Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
+Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
+Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
+Link: https://lore.kernel.org/r/1605298325-3705-1-git-send-email-subashab@codeaurora.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+@@ -188,6 +188,11 @@ rx_handler_result_t rmnet_rx_handler(str
+
+ dev = skb->dev;
+ port = rmnet_get_port_rcu(dev);
++ if (unlikely(!port)) {
++ atomic_long_inc(&skb->dev->rx_nohandler);
++ kfree_skb(skb);
++ goto done;
++ }
+
+ switch (port->rmnet_mode) {
+ case RMNET_EPMODE_VND:
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Karsten Graul <kgraul@linux.ibm.com>
+Date: Wed, 18 Nov 2020 22:40:38 +0100
+Subject: net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid()
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+[ Upstream commit 41a0be3f8f6be893860b991eb10c47fc3ee09d7f ]
+
+Sparse complaints 3 times about:
+net/smc/smc_ib.c:203:52: warning: incorrect type in argument 1 (different address spaces)
+net/smc/smc_ib.c:203:52: expected struct net_device const *dev
+net/smc/smc_ib.c:203:52: got struct net_device [noderef] __rcu *const ndev
+
+Fix that by using the existing and validated ndev variable instead of
+accessing attr->ndev directly.
+
+Fixes: 5102eca9039b ("net/smc: Use rdma_read_gid_l2_fields to L2 fields")
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/smc/smc_ib.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/smc/smc_ib.c
++++ b/net/smc/smc_ib.c
+@@ -198,9 +198,9 @@ int smc_ib_determine_gid(struct smc_ib_d
+ rcu_read_lock();
+ ndev = rdma_read_gid_attr_ndev_rcu(attr);
+ if (!IS_ERR(ndev) &&
+- ((!vlan_id && !is_vlan_dev(attr->ndev)) ||
+- (vlan_id && is_vlan_dev(attr->ndev) &&
+- vlan_dev_vlan_id(attr->ndev) == vlan_id)) &&
++ ((!vlan_id && !is_vlan_dev(ndev)) ||
++ (vlan_id && is_vlan_dev(ndev) &&
++ vlan_dev_vlan_id(ndev) == vlan_id)) &&
+ attr->gid_type == IB_GID_TYPE_ROCE) {
+ rcu_read_unlock();
+ if (gid)
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Wong Vee Khee <vee.khee.wong@intel.com>
+Date: Sun, 15 Nov 2020 15:42:10 +0800
+Subject: net: stmmac: Use rtnl_lock/unlock on netif_set_real_num_rx_queues() call
+
+From: Wong Vee Khee <vee.khee.wong@intel.com>
+
+[ Upstream commit 8e5debed39017836a850c6c7bfacc93299d19bad ]
+
+Fix an issue where dump stack is printed on suspend resume flow due to
+netif_set_real_num_rx_queues() is not called with rtnl_lock held().
+
+Fixes: 686cff3d7022 ("net: stmmac: Fix incorrect location to set real_num_rx|tx_queues")
+Reported-by: Christophe ROULLIER <christophe.roullier@st.com>
+Tested-by: Christophe ROULLIER <christophe.roullier@st.com>
+Cc: Alexandre TORGUE <alexandre.torgue@st.com>
+Reviewed-by: Ong Boon Leong <boon.leong.ong@intel.com>
+Signed-off-by: Wong Vee Khee <vee.khee.wong@intel.com>
+Link: https://lore.kernel.org/r/20201115074210.23605-1-vee.khee.wong@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -5170,6 +5170,7 @@ int stmmac_resume(struct device *dev)
+ return ret;
+ }
+
++ rtnl_lock();
+ mutex_lock(&priv->lock);
+
+ stmmac_reset_queues_param(priv);
+@@ -5185,6 +5186,7 @@ int stmmac_resume(struct device *dev)
+ stmmac_enable_all_queues(priv);
+
+ mutex_unlock(&priv->lock);
++ rtnl_unlock();
+
+ if (!device_may_wakeup(priv->device) || !priv->plat->pmt) {
+ rtnl_lock();
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Vadim Fedorenko <vfedorenko@novek.ru>
+Date: Sun, 15 Nov 2020 07:16:00 +0300
+Subject: net/tls: fix corrupted data in recvmsg
+
+From: Vadim Fedorenko <vfedorenko@novek.ru>
+
+[ Upstream commit 3fe16edf6767decd640fa2654308bc64f8d656dc ]
+
+If tcp socket has more data than Encrypted Handshake Message then
+tls_sw_recvmsg will try to decrypt next record instead of returning
+full control message to userspace as mentioned in comment. The next
+message - usually Application Data - gets corrupted because it uses
+zero copy for decryption that's why the data is not stored in skb
+for next iteration. Revert check to not decrypt next record if
+current is not Application Data.
+
+Fixes: 692d7b5d1f91 ("tls: Fix recvmsg() to be able to peek across multiple records")
+Signed-off-by: Vadim Fedorenko <vfedorenko@novek.ru>
+Link: https://lore.kernel.org/r/1605413760-21153-1-git-send-email-vfedorenko@novek.ru
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tls/tls_sw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1913,7 +1913,7 @@ pick_next_record:
+ * another message type
+ */
+ msg->msg_flags |= MSG_EOR;
+- if (ctx->control != TLS_RECORD_TYPE_DATA)
++ if (control != TLS_RECORD_TYPE_DATA)
+ goto recv_end;
+ } else {
+ break;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:41 AM CET 2020
+From: Tariq Toukan <tariqt@nvidia.com>
+Date: Sun, 15 Nov 2020 15:14:48 +0200
+Subject: net/tls: Fix wrong record sn in async mode of device resync
+
+From: Tariq Toukan <tariqt@nvidia.com>
+
+[ Upstream commit 138559b9f99d3b6b1d5e75c78facc067a23871c6 ]
+
+In async_resync mode, we log the TCP seq of records until the async request
+is completed. Later, in case one of the logged seqs matches the resync
+request, we return it, together with its record serial number. Before this
+fix, we mistakenly returned the serial number of the current record
+instead.
+
+Fixes: ed9b7646b06a ("net/tls: Add asynchronous resync")
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Reviewed-by: Boris Pismenny <borisp@nvidia.com>
+Link: https://lore.kernel.org/r/20201115131448.2702-1-tariqt@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/tls.h | 16 +++++++++++++++-
+ net/tls/tls_device.c | 37 +++++++++++++++++++++++++++----------
+ 2 files changed, 42 insertions(+), 11 deletions(-)
+
+--- a/include/net/tls.h
++++ b/include/net/tls.h
+@@ -300,7 +300,8 @@ enum tls_offload_sync_type {
+ #define TLS_DEVICE_RESYNC_ASYNC_LOGMAX 13
+ struct tls_offload_resync_async {
+ atomic64_t req;
+- u32 loglen;
++ u16 loglen;
++ u16 rcd_delta;
+ u32 log[TLS_DEVICE_RESYNC_ASYNC_LOGMAX];
+ };
+
+@@ -471,6 +472,18 @@ static inline bool tls_bigint_increment(
+ return (i == -1);
+ }
+
++static inline void tls_bigint_subtract(unsigned char *seq, int n)
++{
++ u64 rcd_sn;
++ __be64 *p;
++
++ BUILD_BUG_ON(TLS_MAX_REC_SEQ_SIZE != 8);
++
++ p = (__be64 *)seq;
++ rcd_sn = be64_to_cpu(*p);
++ *p = cpu_to_be64(rcd_sn - n);
++}
++
+ static inline struct tls_context *tls_get_ctx(const struct sock *sk)
+ {
+ struct inet_connection_sock *icsk = inet_csk(sk);
+@@ -639,6 +652,7 @@ tls_offload_rx_resync_async_request_star
+ atomic64_set(&rx_ctx->resync_async->req, ((u64)ntohl(seq) << 32) |
+ ((u64)len << 16) | RESYNC_REQ | RESYNC_REQ_ASYNC);
+ rx_ctx->resync_async->loglen = 0;
++ rx_ctx->resync_async->rcd_delta = 0;
+ }
+
+ static inline void
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -694,36 +694,51 @@ static void tls_device_resync_rx(struct
+
+ static bool
+ tls_device_rx_resync_async(struct tls_offload_resync_async *resync_async,
+- s64 resync_req, u32 *seq)
++ s64 resync_req, u32 *seq, u16 *rcd_delta)
+ {
+ u32 is_async = resync_req & RESYNC_REQ_ASYNC;
+ u32 req_seq = resync_req >> 32;
+ u32 req_end = req_seq + ((resync_req >> 16) & 0xffff);
++ u16 i;
++
++ *rcd_delta = 0;
+
+ if (is_async) {
++ /* shouldn't get to wraparound:
++ * too long in async stage, something bad happened
++ */
++ if (WARN_ON_ONCE(resync_async->rcd_delta == USHRT_MAX))
++ return false;
++
+ /* asynchronous stage: log all headers seq such that
+ * req_seq <= seq <= end_seq, and wait for real resync request
+ */
+- if (between(*seq, req_seq, req_end) &&
++ if (before(*seq, req_seq))
++ return false;
++ if (!after(*seq, req_end) &&
+ resync_async->loglen < TLS_DEVICE_RESYNC_ASYNC_LOGMAX)
+ resync_async->log[resync_async->loglen++] = *seq;
+
++ resync_async->rcd_delta++;
++
+ return false;
+ }
+
+ /* synchronous stage: check against the logged entries and
+ * proceed to check the next entries if no match was found
+ */
+- while (resync_async->loglen) {
+- if (req_seq == resync_async->log[resync_async->loglen - 1] &&
+- atomic64_try_cmpxchg(&resync_async->req,
+- &resync_req, 0)) {
+- resync_async->loglen = 0;
++ for (i = 0; i < resync_async->loglen; i++)
++ if (req_seq == resync_async->log[i] &&
++ atomic64_try_cmpxchg(&resync_async->req, &resync_req, 0)) {
++ *rcd_delta = resync_async->rcd_delta - i;
+ *seq = req_seq;
++ resync_async->loglen = 0;
++ resync_async->rcd_delta = 0;
+ return true;
+ }
+- resync_async->loglen--;
+- }
++
++ resync_async->loglen = 0;
++ resync_async->rcd_delta = 0;
+
+ if (req_seq == *seq &&
+ atomic64_try_cmpxchg(&resync_async->req,
+@@ -741,6 +756,7 @@ void tls_device_rx_resync_new_rec(struct
+ u32 sock_data, is_req_pending;
+ struct tls_prot_info *prot;
+ s64 resync_req;
++ u16 rcd_delta;
+ u32 req_seq;
+
+ if (tls_ctx->rx_conf != TLS_HW)
+@@ -786,8 +802,9 @@ void tls_device_rx_resync_new_rec(struct
+ return;
+
+ if (!tls_device_rx_resync_async(rx_ctx->resync_async,
+- resync_req, &seq))
++ resync_req, &seq, &rcd_delta))
+ return;
++ tls_bigint_subtract(rcd_sn, rcd_delta);
+ break;
+ }
+
--- /dev/null
+From foo@baz Sun Nov 22 10:24:41 AM CET 2020
+From: Filip Moc <dev@moc6.cz>
+Date: Tue, 17 Nov 2020 18:36:31 +0100
+Subject: net: usb: qmi_wwan: Set DTR quirk for MR400
+
+From: Filip Moc <dev@moc6.cz>
+
+[ Upstream commit df8d85d8c69d6837817e54dcb73c84a8b5a13877 ]
+
+LTE module MR400 embedded in TL-MR6400 v4 requires DTR to be set.
+
+Signed-off-by: Filip Moc <dev@moc6.cz>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20201117173631.GA550981@moc6.cz
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1092,7 +1092,7 @@ static const struct usb_device_id produc
+ {QMI_FIXED_INTF(0x05c6, 0x9011, 4)},
+ {QMI_FIXED_INTF(0x05c6, 0x9021, 1)},
+ {QMI_FIXED_INTF(0x05c6, 0x9022, 2)},
+- {QMI_FIXED_INTF(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */
++ {QMI_QUIRK_SET_DTR(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */
+ {QMI_FIXED_INTF(0x05c6, 0x9026, 3)},
+ {QMI_FIXED_INTF(0x05c6, 0x902e, 5)},
+ {QMI_FIXED_INTF(0x05c6, 0x9031, 5)},
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Xie He <xie.he.0141@gmail.com>
+Date: Thu, 12 Nov 2020 02:35:06 -0800
+Subject: net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 4ee18c179e5e815fa5575e0d2db0c05795a804ee ]
+
+The x25_disconnect function in x25_subr.c would decrease the refcount of
+"x25->neighbour" (struct x25_neigh) and reset this pointer to NULL.
+
+However, the x25_rx_call_request function in af_x25.c, which is called
+when we receive a connection request, does not increase the refcount when
+it assigns the pointer.
+
+Fix this issue by increasing the refcount of "struct x25_neigh" in
+x25_rx_call_request.
+
+This patch fixes frequent kernel crashes when using AF_X25 sockets.
+
+Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Link: https://lore.kernel.org/r/20201112103506.5875-1-xie.he.0141@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/x25/af_x25.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -1050,6 +1050,7 @@ int x25_rx_call_request(struct sk_buff *
+ makex25->lci = lci;
+ makex25->dest_addr = dest_addr;
+ makex25->source_addr = source_addr;
++ x25_neigh_hold(nb);
+ makex25->neighbour = nb;
+ makex25->facilities = facilities;
+ makex25->dte_facilities= dte_facilities;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Sun, 15 Nov 2020 10:30:41 +0000
+Subject: netdevsim: set .owner to THIS_MODULE
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit a5bbcbf29089a1252c201b1a7fd38151de355db9 ]
+
+If THIS_MODULE is not set, the module would be removed while debugfs is
+being used.
+It eventually makes kernel panic.
+
+Fixes: 82c93a87bf8b ("netdevsim: implement couple of testing devlink health reporters")
+Fixes: 424be63ad831 ("netdevsim: add UDP tunnel port offload support")
+Fixes: 4418f862d675 ("netdevsim: implement support for devlink region and snapshots")
+Fixes: d3cbb907ae57 ("netdevsim: add ACL trap reporting cookie as a metadata")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Link: https://lore.kernel.org/r/20201115103041.30701-1-ap420073@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/netdevsim/dev.c | 2 ++
+ drivers/net/netdevsim/health.c | 1 +
+ drivers/net/netdevsim/udp_tunnels.c | 1 +
+ 3 files changed, 4 insertions(+)
+
+--- a/drivers/net/netdevsim/dev.c
++++ b/drivers/net/netdevsim/dev.c
+@@ -94,6 +94,7 @@ static const struct file_operations nsim
+ .open = simple_open,
+ .write = nsim_dev_take_snapshot_write,
+ .llseek = generic_file_llseek,
++ .owner = THIS_MODULE,
+ };
+
+ static ssize_t nsim_dev_trap_fa_cookie_read(struct file *file,
+@@ -186,6 +187,7 @@ static const struct file_operations nsim
+ .read = nsim_dev_trap_fa_cookie_read,
+ .write = nsim_dev_trap_fa_cookie_write,
+ .llseek = generic_file_llseek,
++ .owner = THIS_MODULE,
+ };
+
+ static int nsim_dev_debugfs_init(struct nsim_dev *nsim_dev)
+--- a/drivers/net/netdevsim/health.c
++++ b/drivers/net/netdevsim/health.c
+@@ -261,6 +261,7 @@ static const struct file_operations nsim
+ .open = simple_open,
+ .write = nsim_dev_health_break_write,
+ .llseek = generic_file_llseek,
++ .owner = THIS_MODULE,
+ };
+
+ int nsim_dev_health_init(struct nsim_dev *nsim_dev, struct devlink *devlink)
+--- a/drivers/net/netdevsim/udp_tunnels.c
++++ b/drivers/net/netdevsim/udp_tunnels.c
+@@ -119,6 +119,7 @@ static const struct file_operations nsim
+ .open = simple_open,
+ .write = nsim_udp_tunnels_info_reset_write,
+ .llseek = generic_file_llseek,
++ .owner = THIS_MODULE,
+ };
+
+ int nsim_udp_tunnels_info_create(struct nsim_dev *nsim_dev,
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Paul Moore <paul@paul-moore.com>
+Date: Fri, 13 Nov 2020 16:30:40 -0500
+Subject: netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit 1ba86d4366e023d96df3dbe415eea7f1dc08c303 ]
+
+Static checking revealed that a previous fix to
+netlbl_unlabel_staticlist() leaves a stack variable uninitialized,
+this patches fixes that.
+
+Fixes: 866358ec331f ("netlabel: fix our progress tracking in netlbl_unlabel_staticlist()")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Reviewed-by: James Morris <jamorris@linux.microsoft.com>
+Link: https://lore.kernel.org/r/160530304068.15651.18355773009751195447.stgit@sifl
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netlabel/netlabel_unlabeled.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netlabel/netlabel_unlabeled.c
++++ b/net/netlabel/netlabel_unlabeled.c
+@@ -1167,7 +1167,7 @@ static int netlbl_unlabel_staticlist(str
+ u32 skip_bkt = cb->args[0];
+ u32 skip_chain = cb->args[1];
+ u32 skip_addr4 = cb->args[2];
+- u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0;
++ u32 iter_bkt, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
+ struct netlbl_unlhsh_iface *iface;
+ struct list_head *iter_list;
+ struct netlbl_af4list *addr4;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Paul Moore <paul@paul-moore.com>
+Date: Sun, 8 Nov 2020 09:08:26 -0500
+Subject: netlabel: fix our progress tracking in netlbl_unlabel_staticlist()
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit 866358ec331f8faa394995fb4b511af1db0247c8 ]
+
+The current NetLabel code doesn't correctly keep track of the netlink
+dump state in some cases, in particular when multiple interfaces with
+large configurations are loaded. The problem manifests itself by not
+reporting the full configuration to userspace, even though it is
+loaded and active in the kernel. This patch fixes this by ensuring
+that the dump state is properly reset when necessary inside the
+netlbl_unlabel_staticlist() function.
+
+Fixes: 8cc44579d1bd ("NetLabel: Introduce static network labels for unlabeled connections")
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Link: https://lore.kernel.org/r/160484450633.3752.16512718263560813473.stgit@sifl
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netlabel/netlabel_unlabeled.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/net/netlabel/netlabel_unlabeled.c
++++ b/net/netlabel/netlabel_unlabeled.c
+@@ -1166,12 +1166,13 @@ static int netlbl_unlabel_staticlist(str
+ struct netlbl_unlhsh_walk_arg cb_arg;
+ u32 skip_bkt = cb->args[0];
+ u32 skip_chain = cb->args[1];
+- u32 iter_bkt;
+- u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
++ u32 skip_addr4 = cb->args[2];
++ u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0;
+ struct netlbl_unlhsh_iface *iface;
+ struct list_head *iter_list;
+ struct netlbl_af4list *addr4;
+ #if IS_ENABLED(CONFIG_IPV6)
++ u32 skip_addr6 = cb->args[3];
+ struct netlbl_af6list *addr6;
+ #endif
+
+@@ -1182,7 +1183,7 @@ static int netlbl_unlabel_staticlist(str
+ rcu_read_lock();
+ for (iter_bkt = skip_bkt;
+ iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
+- iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) {
++ iter_bkt++) {
+ iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
+ list_for_each_entry_rcu(iface, iter_list, list) {
+ if (!iface->valid ||
+@@ -1190,7 +1191,7 @@ static int netlbl_unlabel_staticlist(str
+ continue;
+ netlbl_af4list_foreach_rcu(addr4,
+ &iface->addr4_list) {
+- if (iter_addr4++ < cb->args[2])
++ if (iter_addr4++ < skip_addr4)
+ continue;
+ if (netlbl_unlabel_staticlist_gen(
+ NLBL_UNLABEL_C_STATICLIST,
+@@ -1203,10 +1204,12 @@ static int netlbl_unlabel_staticlist(str
+ goto unlabel_staticlist_return;
+ }
+ }
++ iter_addr4 = 0;
++ skip_addr4 = 0;
+ #if IS_ENABLED(CONFIG_IPV6)
+ netlbl_af6list_foreach_rcu(addr6,
+ &iface->addr6_list) {
+- if (iter_addr6++ < cb->args[3])
++ if (iter_addr6++ < skip_addr6)
+ continue;
+ if (netlbl_unlabel_staticlist_gen(
+ NLBL_UNLABEL_C_STATICLIST,
+@@ -1219,8 +1222,12 @@ static int netlbl_unlabel_staticlist(str
+ goto unlabel_staticlist_return;
+ }
+ }
++ iter_addr6 = 0;
++ skip_addr6 = 0;
+ #endif /* IPv6 */
+ }
++ iter_chain = 0;
++ skip_chain = 0;
+ }
+
+ unlabel_staticlist_return:
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Dongli Zhang <dongli.zhang@oracle.com>
+Date: Sun, 15 Nov 2020 12:10:29 -0800
+Subject: page_frag: Recover from memory pressure
+
+From: Dongli Zhang <dongli.zhang@oracle.com>
+
+[ Upstream commit d8c19014bba8f565d8a2f1f46b4e38d1d97bf1a7 ]
+
+The ethernet driver may allocate skb (and skb->data) via napi_alloc_skb().
+This ends up to page_frag_alloc() to allocate skb->data from
+page_frag_cache->va.
+
+During the memory pressure, page_frag_cache->va may be allocated as
+pfmemalloc page. As a result, the skb->pfmemalloc is always true as
+skb->data is from page_frag_cache->va. The skb will be dropped if the
+sock (receiver) does not have SOCK_MEMALLOC. This is expected behaviour
+under memory pressure.
+
+However, once kernel is not under memory pressure any longer (suppose large
+amount of memory pages are just reclaimed), the page_frag_alloc() may still
+re-use the prior pfmemalloc page_frag_cache->va to allocate skb->data. As a
+result, the skb->pfmemalloc is always true unless page_frag_cache->va is
+re-allocated, even if the kernel is not under memory pressure any longer.
+
+Here is how kernel runs into issue.
+
+1. The kernel is under memory pressure and allocation of
+PAGE_FRAG_CACHE_MAX_ORDER in __page_frag_cache_refill() will fail. Instead,
+the pfmemalloc page is allocated for page_frag_cache->va.
+
+2: All skb->data from page_frag_cache->va (pfmemalloc) will have
+skb->pfmemalloc=true. The skb will always be dropped by sock without
+SOCK_MEMALLOC. This is an expected behaviour.
+
+3. Suppose a large amount of pages are reclaimed and kernel is not under
+memory pressure any longer. We expect skb->pfmemalloc drop will not happen.
+
+4. Unfortunately, page_frag_alloc() does not proactively re-allocate
+page_frag_alloc->va and will always re-use the prior pfmemalloc page. The
+skb->pfmemalloc is always true even kernel is not under memory pressure any
+longer.
+
+Fix this by freeing and re-allocating the page instead of recycling it.
+
+References: https://lore.kernel.org/lkml/20201103193239.1807-1-dongli.zhang@oracle.com/
+References: https://lore.kernel.org/linux-mm/20201105042140.5253-1-willy@infradead.org/
+Suggested-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Cc: Aruna Ramakrishna <aruna.ramakrishna@oracle.com>
+Cc: Bert Barbe <bert.barbe@oracle.com>
+Cc: Rama Nichanamatlu <rama.nichanamatlu@oracle.com>
+Cc: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
+Cc: Manjunath Patil <manjunath.b.patil@oracle.com>
+Cc: Joe Jin <joe.jin@oracle.com>
+Cc: SRINIVAS <srinivas.eeda@oracle.com>
+Fixes: 79930f5892e1 ("net: do not deplete pfmemalloc reserve")
+Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20201115201029.11903-1-dongli.zhang@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/page_alloc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5053,6 +5053,11 @@ refill:
+ if (!page_ref_sub_and_test(page, nc->pagecnt_bias))
+ goto refill;
+
++ if (unlikely(nc->pfmemalloc)) {
++ free_the_page(page, compound_order(page));
++ goto refill;
++ }
++
+ #if (PAGE_SIZE < PAGE_FRAG_CACHE_MAX_SIZE)
+ /* if size can vary use size else just use PAGE_SIZE */
+ size = nc->size;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Zhang Qilong <zhangqilong3@huawei.com>
+Date: Tue, 10 Nov 2020 17:29:32 +0800
+Subject: PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit dd8088d5a8969dc2b42f71d7bc01c25c61a78066 ]
+
+In many case, we need to check return value of pm_runtime_get_sync, but
+it brings a trouble to the usage counter processing. Many callers forget
+to decrease the usage counter when it failed, which could resulted in
+reference leak. It has been discussed a lot[0][1]. So we add a function
+to deal with the usage counter for better coding.
+
+[0]https://lkml.org/lkml/2020/6/14/88
+[1]https://patchwork.ozlabs.org/project/linux-tegra/list/?series=178139
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/pm_runtime.h | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/include/linux/pm_runtime.h
++++ b/include/linux/pm_runtime.h
+@@ -387,6 +387,27 @@ static inline int pm_runtime_get_sync(st
+ }
+
+ /**
++ * pm_runtime_resume_and_get - Bump up usage counter of a device and resume it.
++ * @dev: Target device.
++ *
++ * Resume @dev synchronously and if that is successful, increment its runtime
++ * PM usage counter. Return 0 if the runtime PM usage counter of @dev has been
++ * incremented or a negative error code otherwise.
++ */
++static inline int pm_runtime_resume_and_get(struct device *dev)
++{
++ int ret;
++
++ ret = __pm_runtime_resume(dev, RPM_GET_PUT);
++ if (ret < 0) {
++ pm_runtime_put_noidle(dev);
++ return ret;
++ }
++
++ return 0;
++}
++
++/**
+ * pm_runtime_put - Drop device usage counter and queue up "idle check" if 0.
+ * @dev: Target device.
+ *
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+Date: Mon, 16 Nov 2020 21:07:13 +0800
+Subject: qed: fix error return code in qed_iwarp_ll2_start()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit cb47d16ea21045c66eebbf5ed792e74a8537e27a ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 469981b17a4f ("qed: Add unaligned and packed packet processing")
+Fixes: fcb39f6c10b2 ("qed: Add mpa buffer descriptors for storing and processing mpa fpdus")
+Fixes: 1e28eaad07ea ("qed: Add iWARP support for fpdu spanned over more than two tcp packets")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
+Link: https://lore.kernel.org/r/1605532033-27373-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+@@ -2754,14 +2754,18 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_h
+ iwarp_info->partial_fpdus = kcalloc((u16)p_hwfn->p_rdma_info->num_qps,
+ sizeof(*iwarp_info->partial_fpdus),
+ GFP_KERNEL);
+- if (!iwarp_info->partial_fpdus)
++ if (!iwarp_info->partial_fpdus) {
++ rc = -ENOMEM;
+ goto err;
++ }
+
+ iwarp_info->max_num_partial_fpdus = (u16)p_hwfn->p_rdma_info->num_qps;
+
+ iwarp_info->mpa_intermediate_buf = kzalloc(buff_size, GFP_KERNEL);
+- if (!iwarp_info->mpa_intermediate_buf)
++ if (!iwarp_info->mpa_intermediate_buf) {
++ rc = -ENOMEM;
+ goto err;
++ }
+
+ /* The mpa_bufs array serves for pending RX packets received on the
+ * mpa ll2 that don't have place on the tx ring and require later
+@@ -2771,8 +2775,10 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_h
+ iwarp_info->mpa_bufs = kcalloc(data.input.rx_num_desc,
+ sizeof(*iwarp_info->mpa_bufs),
+ GFP_KERNEL);
+- if (!iwarp_info->mpa_bufs)
++ if (!iwarp_info->mpa_bufs) {
++ rc = -ENOMEM;
+ goto err;
++ }
+
+ INIT_LIST_HEAD(&iwarp_info->mpa_buf_pending_list);
+ INIT_LIST_HEAD(&iwarp_info->mpa_buf_list);
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Dmitry Bogdanov <dbogdanov@marvell.com>
+Date: Mon, 16 Nov 2020 16:29:44 +0300
+Subject: qed: fix ILT configuration of SRC block
+
+From: Dmitry Bogdanov <dbogdanov@marvell.com>
+
+[ Upstream commit 93be52612431e71ee8cb980ef11468997857e4c4 ]
+
+The code refactoring of ILT configuration was not complete, the old
+unused variables were used for the SRC block. That could lead to the memory
+corruption by HW when rx filters are configured.
+This patch completes that refactoring.
+
+Fixes: 8a52bbab39c9 (qed: Debug feature: ilt and mdump)
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: Dmitry Bogdanov <dbogdanov@marvell.com>
+Link: https://lore.kernel.org/r/20201116132944.2055-1-dbogdanov@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_cxt.c | 4 ++--
+ drivers/net/ethernet/qlogic/qed/qed_cxt.h | 3 ---
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+@@ -1647,9 +1647,9 @@ static void qed_src_init_pf(struct qed_h
+ ilog2(rounded_conn_num));
+
+ STORE_RT_REG_AGG(p_hwfn, SRC_REG_FIRSTFREE_RT_OFFSET,
+- p_hwfn->p_cxt_mngr->first_free);
++ p_hwfn->p_cxt_mngr->src_t2.first_free);
+ STORE_RT_REG_AGG(p_hwfn, SRC_REG_LASTFREE_RT_OFFSET,
+- p_hwfn->p_cxt_mngr->last_free);
++ p_hwfn->p_cxt_mngr->src_t2.last_free);
+ }
+
+ /* Timers PF */
+--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.h
+@@ -326,9 +326,6 @@ struct qed_cxt_mngr {
+
+ /* SRC T2 */
+ struct qed_src_t2 src_t2;
+- u32 t2_num_pages;
+- u64 first_free;
+- u64 last_free;
+
+ /* total number of SRQ's for this hwfn */
+ u32 srq_count;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+Date: Fri, 13 Nov 2020 14:16:26 +0800
+Subject: qlcnic: fix error return code in qlcnic_83xx_restart_hw()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 3beb9be165083c2964eba1923601c3bfac0b02d4 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 3ced0a88cd4c ("qlcnic: Add support to run firmware POST")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Link: https://lore.kernel.org/r/1605248186-16013-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+@@ -2232,7 +2232,8 @@ static int qlcnic_83xx_restart_hw(struct
+
+ /* Boot either flash image or firmware image from host file system */
+ if (qlcnic_load_fw_file == 1) {
+- if (qlcnic_83xx_load_fw_image_from_host(adapter))
++ err = qlcnic_83xx_load_fw_image_from_host(adapter);
++ if (err)
+ return err;
+ } else {
+ QLC_SHARED_REG_WR32(adapter, QLCNIC_FW_IMG_VALID,
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Xin Long <lucien.xin@gmail.com>
+Date: Sat, 14 Nov 2020 13:22:53 +0800
+Subject: sctp: change to hold/put transport for proto_unreach_timer
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 057a10fa1f73d745c8e69aa54ab147715f5630ae ]
+
+A call trace was found in Hangbin's Codenomicon testing with debug kernel:
+
+ [ 2615.981988] ODEBUG: free active (active state 0) object type: timer_list hint: sctp_generate_proto_unreach_event+0x0/0x3a0 [sctp]
+ [ 2615.995050] WARNING: CPU: 17 PID: 0 at lib/debugobjects.c:328 debug_print_object+0x199/0x2b0
+ [ 2616.095934] RIP: 0010:debug_print_object+0x199/0x2b0
+ [ 2616.191533] Call Trace:
+ [ 2616.194265] <IRQ>
+ [ 2616.202068] debug_check_no_obj_freed+0x25e/0x3f0
+ [ 2616.207336] slab_free_freelist_hook+0xeb/0x140
+ [ 2616.220971] kfree+0xd6/0x2c0
+ [ 2616.224293] rcu_do_batch+0x3bd/0xc70
+ [ 2616.243096] rcu_core+0x8b9/0xd00
+ [ 2616.256065] __do_softirq+0x23d/0xacd
+ [ 2616.260166] irq_exit+0x236/0x2a0
+ [ 2616.263879] smp_apic_timer_interrupt+0x18d/0x620
+ [ 2616.269138] apic_timer_interrupt+0xf/0x20
+ [ 2616.273711] </IRQ>
+
+This is because it holds asoc when transport->proto_unreach_timer starts
+and puts asoc when the timer stops, and without holding transport the
+transport could be freed when the timer is still running.
+
+So fix it by holding/putting transport instead for proto_unreach_timer
+in transport, just like other timers in transport.
+
+v1->v2:
+ - Also use sctp_transport_put() for the "out_unlock:" path in
+ sctp_generate_proto_unreach_event(), as Marcelo noticed.
+
+Fixes: 50b5d6ad6382 ("sctp: Fix a race between ICMP protocol unreachable and connect()")
+Reported-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Link: https://lore.kernel.org/r/102788809b554958b13b95d33440f5448113b8d6.1605331373.git.lucien.xin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/input.c | 4 ++--
+ net/sctp/sm_sideeffect.c | 4 ++--
+ net/sctp/transport.c | 2 +-
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -449,7 +449,7 @@ void sctp_icmp_proto_unreachable(struct
+ else {
+ if (!mod_timer(&t->proto_unreach_timer,
+ jiffies + (HZ/20)))
+- sctp_association_hold(asoc);
++ sctp_transport_hold(t);
+ }
+ } else {
+ struct net *net = sock_net(sk);
+@@ -458,7 +458,7 @@ void sctp_icmp_proto_unreachable(struct
+ "encountered!\n", __func__);
+
+ if (del_timer(&t->proto_unreach_timer))
+- sctp_association_put(asoc);
++ sctp_transport_put(t);
+
+ sctp_do_sm(net, SCTP_EVENT_T_OTHER,
+ SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -419,7 +419,7 @@ void sctp_generate_proto_unreach_event(s
+ /* Try again later. */
+ if (!mod_timer(&transport->proto_unreach_timer,
+ jiffies + (HZ/20)))
+- sctp_association_hold(asoc);
++ sctp_transport_hold(transport);
+ goto out_unlock;
+ }
+
+@@ -435,7 +435,7 @@ void sctp_generate_proto_unreach_event(s
+
+ out_unlock:
+ bh_unlock_sock(sk);
+- sctp_association_put(asoc);
++ sctp_transport_put(transport);
+ }
+
+ /* Handle the timeout of the RE-CONFIG timer. */
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -133,7 +133,7 @@ void sctp_transport_free(struct sctp_tra
+
+ /* Delete the ICMP proto unreachable timer if it's active. */
+ if (del_timer(&transport->proto_unreach_timer))
+- sctp_association_put(transport->asoc);
++ sctp_transport_put(transport);
+
+ sctp_transport_put(transport);
+ }
--- /dev/null
+ah6-fix-error-return-code-in-ah6_input.patch
+atm-nicstar-unmap-dma-on-send-error.patch
+bnxt_en-read-eeprom-a2h-address-using-page-0.patch
+devlink-add-missing-genlmsg_cancel-in-devlink_nl_sb_port_pool_fill.patch
+enetc-workaround-for-mdio-register-access-issue.patch
+exempt-multicast-addresses-from-five-second-neighbor-lifetime.patch
+inet_diag-fix-error-path-to-cancel-the-meseage-in-inet_req_diag_fill.patch
+ipv6-fix-error-path-to-cancel-the-meseage.patch
+lan743x-fix-issue-causing-intermittent-kernel-log-warnings.patch
+lan743x-prevent-entire-kernel-hang-on-open-for-some-platforms.patch
+mlxsw-core-use-variable-timeout-for-emad-retries.patch
+net-b44-fix-error-return-code-in-b44_init_one.patch
+net-bridge-add-missing-counters-to-ndo_get_stats64-callback.patch
+netdevsim-set-.owner-to-this_module.patch
+net-dsa-mv88e6xxx-avoid-vtu-corruption-on-6097.patch
+net-ethernet-mtk-star-emac-fix-error-return-code-in-mtk_star_enable.patch
+net-ethernet-mtk-star-emac-return-ok-when-xmit-drops.patch
+net-ethernet-ti-am65-cpts-update-ret-when-ptp_clock-is-error.patch
+net-ethernet-ti-cpsw-fix-cpts-irq-after-suspend.patch
+net-ethernet-ti-cpsw-fix-error-return-code-in-cpsw_probe.patch
+net-ftgmac100-fix-crash-when-removing-driver.patch
+net-have-netpoll-bring-up-dsa-management-interface.patch
+net-ipa-lock-when-freeing-transaction.patch
+netlabel-fix-our-progress-tracking-in-netlbl_unlabel_staticlist.patch
+netlabel-fix-an-uninitialized-warning-in-netlbl_unlabel_staticlist.patch
+net-lantiq-wait-for-the-gphy-firmware-to-be-ready.patch
+net-mlx4_core-fix-init_hca-fields-offset.patch
+net-mlx5e-fix-refcount-leak-on-ktls-rx-resync.patch
+net-ncsi-fix-netlink-registration.patch
+net-phy-mscc-remove-non-macsec-compatible-phy.patch
+net-qualcomm-rmnet-fix-incorrect-receive-packet-handling-during-cleanup.patch
+net-smc-fix-direct-access-to-ib_gid_addr-ndev-in-smc_ib_determine_gid.patch
+net-stmmac-use-rtnl_lock-unlock-on-netif_set_real_num_rx_queues-call.patch
+net-tls-fix-corrupted-data-in-recvmsg.patch
+net-x25-increase-refcnt-of-struct-x25_neigh-in-x25_rx_call_request.patch
+page_frag-recover-from-memory-pressure.patch
+qed-fix-error-return-code-in-qed_iwarp_ll2_start.patch
+qed-fix-ilt-configuration-of-src-block.patch
+qlcnic-fix-error-return-code-in-qlcnic_83xx_restart_hw.patch
+sctp-change-to-hold-put-transport-for-proto_unreach_timer.patch
+tcp-only-postpone-probe_rtt-if-rtt-is-current-min_rtt-estimate.patch
+vsock-forward-all-packets-to-the-host-when-no-h2g-is-registered.patch
+net-mlx5e-fix-check-if-netdev-is-bond-slave.patch
+net-mlx5-add-handling-of-port-type-in-rule-deletion.patch
+net-mlx5-clear-bw_share-upon-vf-disable.patch
+net-mlx5-disable-qos-when-min_rates-on-all-vfs-are-zero.patch
+pm-runtime-add-pm_runtime_resume_and_get-to-deal-with-usage-counter.patch
+net-fec-fix-reference-count-leak-in-fec-series-ops.patch
+bnxt_en-fix-counter-overflow-logic.patch
+bnxt_en-free-port-stats-during-firmware-reset.patch
+net-mvneta-fix-possible-memory-leak-in-mvneta_swbm_add_rx_fragment.patch
+net-tls-fix-wrong-record-sn-in-async-mode-of-device-resync.patch
+net-usb-qmi_wwan-set-dtr-quirk-for-mr400.patch
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Ryan Sharpelletti <sharpelletti@google.com>
+Date: Mon, 16 Nov 2020 17:44:13 +0000
+Subject: tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
+
+From: Ryan Sharpelletti <sharpelletti@google.com>
+
+[ Upstream commit 1b9e2a8c99a5c021041bfb2d512dc3ed92a94ffd ]
+
+During loss recovery, retransmitted packets are forced to use TCP
+timestamps to calculate the RTT samples, which have a millisecond
+granularity. BBR is designed using a microsecond granularity. As a
+result, multiple RTT samples could be truncated to the same RTT value
+during loss recovery. This is problematic, as BBR will not enter
+PROBE_RTT if the RTT sample is <= the current min_rtt sample, meaning
+that if there are persistent losses, PROBE_RTT will constantly be
+pushed off and potentially never re-entered. This patch makes sure
+that BBR enters PROBE_RTT by checking if RTT sample is < the current
+min_rtt sample, rather than <=.
+
+The Netflix transport/TCP team discovered this bug in the Linux TCP
+BBR code during lab tests.
+
+Fixes: 0f8782ea1497 ("tcp_bbr: add BBR congestion control")
+Signed-off-by: Ryan Sharpelletti <sharpelletti@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Link: https://lore.kernel.org/r/20201116174412.1433277-1-sharpelletti.kdev@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_bbr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_bbr.c
++++ b/net/ipv4/tcp_bbr.c
+@@ -945,7 +945,7 @@ static void bbr_update_min_rtt(struct so
+ filter_expired = after(tcp_jiffies32,
+ bbr->min_rtt_stamp + bbr_min_rtt_win_sec * HZ);
+ if (rs->rtt_us >= 0 &&
+- (rs->rtt_us <= bbr->min_rtt_us ||
++ (rs->rtt_us < bbr->min_rtt_us ||
+ (filter_expired && !rs->is_ack_delayed))) {
+ bbr->min_rtt_us = rs->rtt_us;
+ bbr->min_rtt_stamp = tcp_jiffies32;
--- /dev/null
+From foo@baz Sun Nov 22 10:24:40 AM CET 2020
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Thu, 12 Nov 2020 14:38:37 +0100
+Subject: vsock: forward all packets to the host when no H2G is registered
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+[ Upstream commit 65b422d9b61ba12c08150784e8012fa1892ad03e ]
+
+Before commit c0cfa2d8a788 ("vsock: add multi-transports support"),
+if a G2H transport was loaded (e.g. virtio transport), every packets
+was forwarded to the host, regardless of the destination CID.
+The H2G transports implemented until then (vhost-vsock, VMCI) always
+responded with an error, if the destination CID was not
+VMADDR_CID_HOST.
+
+>From that commit, we are using the remote CID to decide which
+transport to use, so packets with remote CID > VMADDR_CID_HOST(2)
+are sent only through H2G transport. If no H2G is available, packets
+are discarded directly in the guest.
+
+Some use cases (e.g. Nitro Enclaves [1]) rely on the old behaviour
+to implement sibling VMs communication, so we restore the old
+behavior when no H2G is registered.
+It will be up to the host to discard packets if the destination is
+not the right one. As it was already implemented before adding
+multi-transport support.
+
+Tested with nested QEMU/KVM by me and Nitro Enclaves by Andra.
+
+[1] Documentation/virt/ne_overview.rst
+
+Cc: Jorgen Hansen <jhansen@vmware.com>
+Cc: Dexuan Cui <decui@microsoft.com>
+Fixes: c0cfa2d8a788 ("vsock: add multi-transports support")
+Reported-by: Andra Paraschiv <andraprs@amazon.com>
+Tested-by: Andra Paraschiv <andraprs@amazon.com>
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Link: https://lore.kernel.org/r/20201112133837.34183-1-sgarzare@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/vmw_vsock/af_vsock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -438,7 +438,7 @@ int vsock_assign_transport(struct vsock_
+ case SOCK_STREAM:
+ if (vsock_use_local_transport(remote_cid))
+ new_transport = transport_local;
+- else if (remote_cid <= VMADDR_CID_HOST)
++ else if (remote_cid <= VMADDR_CID_HOST || !transport_h2g)
+ new_transport = transport_g2h;
+ else
+ new_transport = transport_h2g;
projects / thirdparty / kernel / stable-queue.git / commitdiff
