--- /dev/null
+From f83531d80397d6a088246d7840c7519d2383e2ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 20:48:44 +0100
+Subject: ASoC: cs4341: Add SPI device ID table
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 0cc3687eadd0971d5d38ff90d14819d88f854960 ]
+
+Currently autoloading for SPI devices does not use the DT ID table, it uses
+SPI modalises. Supporting OF modalises is going to be difficult if not
+impractical, an attempt was made but has been reverted, so ensure that
+module autoloading works for this driver by adding SPI IDs for parts that
+only have a compatible listed.
+
+Fixes: 96c8395e2166 ("spi: Revert modalias changes")
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: patches@opensource.cirrus.com
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20210924194844.45974-1-broonie@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs4341.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/codecs/cs4341.c b/sound/soc/codecs/cs4341.c
+index 7d3e54d8eef3..29d05e32d341 100644
+--- a/sound/soc/codecs/cs4341.c
++++ b/sound/soc/codecs/cs4341.c
+@@ -305,12 +305,19 @@ static int cs4341_spi_probe(struct spi_device *spi)
+ return cs4341_probe(&spi->dev);
+ }
+
++static const struct spi_device_id cs4341_spi_ids[] = {
++ { "cs4341a" },
++ { }
++};
++MODULE_DEVICE_TABLE(spi, cs4341_spi_ids);
++
+ static struct spi_driver cs4341_spi_driver = {
+ .driver = {
+ .name = "cs4341-spi",
+ .of_match_table = of_match_ptr(cs4341_dt_ids),
+ },
+ .probe = cs4341_spi_probe,
++ .id_table = cs4341_spi_ids,
+ };
+ #endif
+
+--
+2.33.0
+
--- /dev/null
+From 0627cc93043c7cfabe7c6ddc860811b7626907d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Sep 2021 17:18:30 +0800
+Subject: ASoC: fsl_xcvr: Fix channel swap issue with ARC
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 74b7ee0e7b61838a0a161a84d105aeff0d042646 ]
+
+With pause and resume test for ARC, there is occasionally
+channel swap issue. The reason is that currently driver set
+the DPATH out of reset first, then start the DMA, the first
+data got from FIFO may not be the Left channel.
+
+Moving DPATH out of reset operation after the dma enablement
+to fix this issue.
+
+Fixes: 28564486866f ("ASoC: fsl_xcvr: Add XCVR ASoC CPU DAI driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1631265510-27384-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_xcvr.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c
+index 477d16713e72..a9b6c2b0c871 100644
+--- a/sound/soc/fsl/fsl_xcvr.c
++++ b/sound/soc/fsl/fsl_xcvr.c
+@@ -487,8 +487,9 @@ static int fsl_xcvr_prepare(struct snd_pcm_substream *substream,
+ return ret;
+ }
+
+- /* clear DPATH RESET */
++ /* set DPATH RESET */
+ m_ctl |= FSL_XCVR_EXT_CTRL_DPTH_RESET(tx);
++ v_ctl |= FSL_XCVR_EXT_CTRL_DPTH_RESET(tx);
+ ret = regmap_update_bits(xcvr->regmap, FSL_XCVR_EXT_CTRL, m_ctl, v_ctl);
+ if (ret < 0) {
+ dev_err(dai->dev, "Error while setting EXT_CTRL: %d\n", ret);
+@@ -590,10 +591,6 @@ static void fsl_xcvr_shutdown(struct snd_pcm_substream *substream,
+ val |= FSL_XCVR_EXT_CTRL_CMDC_RESET(tx);
+ }
+
+- /* set DPATH RESET */
+- mask |= FSL_XCVR_EXT_CTRL_DPTH_RESET(tx);
+- val |= FSL_XCVR_EXT_CTRL_DPTH_RESET(tx);
+-
+ ret = regmap_update_bits(xcvr->regmap, FSL_XCVR_EXT_CTRL, mask, val);
+ if (ret < 0) {
+ dev_err(dai->dev, "Err setting DPATH RESET: %d\n", ret);
+@@ -643,6 +640,16 @@ static int fsl_xcvr_trigger(struct snd_pcm_substream *substream, int cmd,
+ dev_err(dai->dev, "Failed to enable DMA: %d\n", ret);
+ return ret;
+ }
++
++ /* clear DPATH RESET */
++ ret = regmap_update_bits(xcvr->regmap, FSL_XCVR_EXT_CTRL,
++ FSL_XCVR_EXT_CTRL_DPTH_RESET(tx),
++ 0);
++ if (ret < 0) {
++ dev_err(dai->dev, "Failed to clear DPATH RESET: %d\n", ret);
++ return ret;
++ }
++
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+--
+2.33.0
+
--- /dev/null
+From 24d7dbed331df9497a548b2e8dcfd7f9d12b5c5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 20:49:56 +0100
+Subject: ASoC: pcm179x: Add missing entries SPI to device ID table
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit ceef3240f9b7e592dd8d10d619c312c7336117fa ]
+
+Currently autoloading for SPI devices does not use the DT ID table, it uses
+SPI modalises. Supporting OF modalises is going to be difficult if not
+impractical, an attempt was made but has been reverted, so ensure that
+module autoloading works for this driver by adding SPI IDs for parts that
+only have a compatible listed.
+
+Fixes: 96c8395e2166 ("spi: Revert modalias changes")
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210924194956.46079-1-broonie@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/pcm179x-spi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/pcm179x-spi.c b/sound/soc/codecs/pcm179x-spi.c
+index 0a542924ec5f..ebf63ea90a1c 100644
+--- a/sound/soc/codecs/pcm179x-spi.c
++++ b/sound/soc/codecs/pcm179x-spi.c
+@@ -36,6 +36,7 @@ static const struct of_device_id pcm179x_of_match[] = {
+ MODULE_DEVICE_TABLE(of, pcm179x_of_match);
+
+ static const struct spi_device_id pcm179x_spi_ids[] = {
++ { "pcm1792a", 0 },
+ { "pcm179x", 0 },
+ { },
+ };
+--
+2.33.0
+
--- /dev/null
+From b989a9035a38a5912deac88ea75cde5950bb4020 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Sep 2021 16:49:39 +0200
+Subject: ASoC: pcm512x: Mend accesses to the I2S_1 and I2S_2 registers
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit 3f4b57ad07d9237acf1b8cff3f8bf530cacef87a ]
+
+Commit 25d27c4f68d2 ("ASoC: pcm512x: Add support for more data formats")
+breaks the TSE-850 device, which is using a pcm5142 in I2S and
+CBM_CFS mode (maybe not relevant). Without this fix, the result
+is:
+
+pcm512x 0-004c: Failed to set data format: -16
+
+And after that, no sound.
+
+This fix is not 100% correct. The datasheet of at least the pcm5142
+states that four bits (0xcc) in the I2S_1 register are "RSV"
+("Reserved. Do not access.") and no hint is given as to what the
+initial values are supposed to be. So, specifying defaults for
+these bits is wrong. But perhaps better than a broken driver?
+
+Fixes: 25d27c4f68d2 ("ASoC: pcm512x: Add support for more data formats")
+Cc: Liam Girdwood <lgirdwood@gmail.com>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Takashi Iwai <tiwai@suse.com>
+Cc: Kirill Marinushkin <kmarinushkin@birdec.com>
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Cc: alsa-devel@alsa-project.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Link: https://lore.kernel.org/r/2d221984-7a2e-7006-0f8a-ffb5f64ee885@axentia.se
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/pcm512x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
+index 4dc844f3c1fc..60dee41816dc 100644
+--- a/sound/soc/codecs/pcm512x.c
++++ b/sound/soc/codecs/pcm512x.c
+@@ -116,6 +116,8 @@ static const struct reg_default pcm512x_reg_defaults[] = {
+ { PCM512x_FS_SPEED_MODE, 0x00 },
+ { PCM512x_IDAC_1, 0x01 },
+ { PCM512x_IDAC_2, 0x00 },
++ { PCM512x_I2S_1, 0x02 },
++ { PCM512x_I2S_2, 0x00 },
+ };
+
+ static bool pcm512x_readable(struct device *dev, unsigned int reg)
+--
+2.33.0
+
--- /dev/null
+From 6c14b61b74c6f5503cdd4147ceb0a9a0893ef1ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Oct 2021 13:17:04 +0800
+Subject: ASoC: wm8960: Fix clock configuration on slave mode
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 6b9b546dc00797c74bef491668ce5431ff54e1e2 ]
+
+There is a noise issue for 8kHz sample rate on slave mode.
+Compared with master mode, the difference is the DACDIV
+setting, after correcting the DACDIV, the noise is gone.
+
+There is no noise issue for 48kHz sample rate, because
+the default value of DACDIV is correct for 48kHz.
+
+So wm8960_configure_clocking() should be functional for
+ADC and DAC function even if it is slave mode.
+
+In order to be compatible for old use case, just add
+condition for checking that sysclk is zero with
+slave mode.
+
+Fixes: 0e50b51aa22f ("ASoC: wm8960: Let wm8960 driver configure its bit clock and frame clock")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/1634102224-3922-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8960.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 9e621a254392..499604f1e178 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -742,9 +742,16 @@ static int wm8960_configure_clocking(struct snd_soc_component *component)
+ int i, j, k;
+ int ret;
+
+- if (!(iface1 & (1<<6))) {
+- dev_dbg(component->dev,
+- "Codec is slave mode, no need to configure clock\n");
++ /*
++ * For Slave mode clocking should still be configured,
++ * so this if statement should be removed, but some platform
++ * may not work if the sysclk is not configured, to avoid such
++ * compatible issue, just add '!wm8960->sysclk' condition in
++ * this if statement.
++ */
++ if (!(iface1 & (1 << 6)) && !wm8960->sysclk) {
++ dev_warn(component->dev,
++ "slave mode, but proceeding with no clock configuration\n");
+ return 0;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From c9ee18ce3d6877690b399caba387567cd79e435d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Oct 2021 22:19:43 +0200
+Subject: dma-debug: fix sg checks in debug_dma_map_sg()
+
+From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+
+[ Upstream commit 293d92cbbd2418ca2ba43fed07f1b92e884d1c77 ]
+
+The following warning occurred sporadically on s390:
+DMA-API: nvme 0006:00:00.0: device driver maps memory from kernel text or rodata [addr=0000000048cc5e2f] [len=131072]
+WARNING: CPU: 4 PID: 825 at kernel/dma/debug.c:1083 check_for_illegal_area+0xa8/0x138
+
+It is a false-positive warning, due to broken logic in debug_dma_map_sg().
+check_for_illegal_area() checks for overlay of sg elements with kernel text
+or rodata. It is called with sg_dma_len(s) instead of s->length as
+parameter. After the call to ->map_sg(), sg_dma_len() will contain the
+length of possibly combined sg elements in the DMA address space, and not
+the individual sg element length, which would be s->length.
+
+The check will then use the physical start address of an sg element, and
+add the DMA length for the overlap check, which could result in the false
+warning, because the DMA length can be larger than the actual single sg
+element length.
+
+In addition, the call to check_for_illegal_area() happens in the iteration
+over mapped_ents, which will not include all individual sg elements if
+any of them were combined in ->map_sg().
+
+Fix this by using s->length instead of sg_dma_len(s). Also put the call to
+check_for_illegal_area() in a separate loop, iterating over all the
+individual sg elements ("nents" instead of "mapped_ents").
+
+While at it, as suggested by Robin Murphy, also move check_for_stack()
+inside the new loop, as it is similarly concerned with validating the
+individual sg elements.
+
+Link: https://lore.kernel.org/lkml/20210705185252.4074653-1-gerald.schaefer@linux.ibm.com
+Fixes: 884d05970bfb ("dma-debug: use sg_dma_len accessor")
+Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/debug.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
+index 70519f67556f..fad3c77c1da1 100644
+--- a/kernel/dma/debug.c
++++ b/kernel/dma/debug.c
+@@ -1299,6 +1299,12 @@ void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,
+ if (unlikely(dma_debug_disabled()))
+ return;
+
++ for_each_sg(sg, s, nents, i) {
++ check_for_stack(dev, sg_page(s), s->offset);
++ if (!PageHighMem(sg_page(s)))
++ check_for_illegal_area(dev, sg_virt(s), s->length);
++ }
++
+ for_each_sg(sg, s, mapped_ents, i) {
+ entry = dma_entry_alloc();
+ if (!entry)
+@@ -1314,12 +1320,6 @@ void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,
+ entry->sg_call_ents = nents;
+ entry->sg_mapped_ents = mapped_ents;
+
+- check_for_stack(dev, sg_page(s), s->offset);
+-
+- if (!PageHighMem(sg_page(s))) {
+- check_for_illegal_area(dev, sg_virt(s), sg_dma_len(s));
+- }
+-
+ check_sg_segment(dev, s);
+
+ add_dma_entry(entry);
+--
+2.33.0
+
--- /dev/null
+From 2b51985965d727e4f7bf056a88e0d6595d486b73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 16:28:51 -0700
+Subject: drm/kmb: Corrected typo in handle_lcd_irq
+
+From: Anitha Chrisanthus <anitha.chrisanthus@intel.com>
+
+[ Upstream commit 004d2719806fb8e355c1bccd538e82c04319d391 ]
+
+Check for Overflow bits for layer3 in the irq handler.
+
+Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display")
+Signed-off-by: Anitha Chrisanthus <anitha.chrisanthus@intel.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211013233632.471892-5-anitha.chrisanthus@intel.com
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/kmb/kmb_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/kmb/kmb_drv.c b/drivers/gpu/drm/kmb/kmb_drv.c
+index f54392ec4fab..bb7eca9e13ae 100644
+--- a/drivers/gpu/drm/kmb/kmb_drv.c
++++ b/drivers/gpu/drm/kmb/kmb_drv.c
+@@ -381,7 +381,7 @@ static irqreturn_t handle_lcd_irq(struct drm_device *dev)
+ if (val & LAYER3_DMA_FIFO_UNDERFLOW)
+ drm_dbg(&kmb->drm,
+ "LAYER3:GL1 DMA UNDERFLOW val = 0x%lx", val);
+- if (val & LAYER3_DMA_FIFO_UNDERFLOW)
++ if (val & LAYER3_DMA_FIFO_OVERFLOW)
+ drm_dbg(&kmb->drm,
+ "LAYER3:GL1 DMA OVERFLOW val = 0x%lx", val);
+ }
+--
+2.33.0
+
--- /dev/null
+From 6360eef4acb7ff483e8245228e846752c0329b47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Oct 2021 16:03:48 -0700
+Subject: drm/kmb: Disable change of plane parameters
+
+From: Edmund Dea <edmund.j.dea@intel.com>
+
+[ Upstream commit 982f8ad666a1123028a077b6b009871a0dc9df26 ]
+
+Due to HW limitations, KMB cannot change height, width, or
+pixel format after initial plane configuration.
+
+v2: removed memset disp_cfg as it is already zero.
+
+Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display")
+Signed-off-by: Edmund Dea <edmund.j.dea@intel.com>
+Signed-off-by: Anitha Chrisanthus <anitha.chrisanthus@intel.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211013233632.471892-4-anitha.chrisanthus@intel.com
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/kmb/kmb_drv.h | 1 +
+ drivers/gpu/drm/kmb/kmb_plane.c | 43 ++++++++++++++++++++++++++++++++-
+ drivers/gpu/drm/kmb/kmb_plane.h | 6 +++++
+ 3 files changed, 49 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/kmb/kmb_drv.h b/drivers/gpu/drm/kmb/kmb_drv.h
+index ebbaa5f422d5..178aa14f2efc 100644
+--- a/drivers/gpu/drm/kmb/kmb_drv.h
++++ b/drivers/gpu/drm/kmb/kmb_drv.h
+@@ -45,6 +45,7 @@ struct kmb_drm_private {
+ spinlock_t irq_lock;
+ int irq_lcd;
+ int sys_clk_mhz;
++ struct disp_cfg init_disp_cfg[KMB_MAX_PLANES];
+ struct layer_status plane_status[KMB_MAX_PLANES];
+ int kmb_under_flow;
+ int kmb_flush_done;
+diff --git a/drivers/gpu/drm/kmb/kmb_plane.c b/drivers/gpu/drm/kmb/kmb_plane.c
+index ecee6782612d..45cb096455b5 100644
+--- a/drivers/gpu/drm/kmb/kmb_plane.c
++++ b/drivers/gpu/drm/kmb/kmb_plane.c
+@@ -67,8 +67,21 @@ static const u32 kmb_formats_v[] = {
+
+ static unsigned int check_pixel_format(struct drm_plane *plane, u32 format)
+ {
++ struct kmb_drm_private *kmb;
++ struct kmb_plane *kmb_plane = to_kmb_plane(plane);
+ int i;
++ int plane_id = kmb_plane->id;
++ struct disp_cfg init_disp_cfg;
+
++ kmb = to_kmb(plane->dev);
++ init_disp_cfg = kmb->init_disp_cfg[plane_id];
++ /* Due to HW limitations, changing pixel format after initial
++ * plane configuration is not supported.
++ */
++ if (init_disp_cfg.format && init_disp_cfg.format != format) {
++ drm_dbg(&kmb->drm, "Cannot change format after initial plane configuration");
++ return -EINVAL;
++ }
+ for (i = 0; i < plane->format_count; i++) {
+ if (plane->format_types[i] == format)
+ return 0;
+@@ -81,11 +94,17 @@ static int kmb_plane_atomic_check(struct drm_plane *plane,
+ {
+ struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state,
+ plane);
++ struct kmb_drm_private *kmb;
++ struct kmb_plane *kmb_plane = to_kmb_plane(plane);
++ int plane_id = kmb_plane->id;
++ struct disp_cfg init_disp_cfg;
+ struct drm_framebuffer *fb;
+ int ret;
+ struct drm_crtc_state *crtc_state;
+ bool can_position;
+
++ kmb = to_kmb(plane->dev);
++ init_disp_cfg = kmb->init_disp_cfg[plane_id];
+ fb = new_plane_state->fb;
+ if (!fb || !new_plane_state->crtc)
+ return 0;
+@@ -98,6 +117,16 @@ static int kmb_plane_atomic_check(struct drm_plane *plane,
+ return -EINVAL;
+ if (new_plane_state->crtc_w < KMB_MIN_WIDTH || new_plane_state->crtc_h < KMB_MIN_HEIGHT)
+ return -EINVAL;
++
++ /* Due to HW limitations, changing plane height or width after
++ * initial plane configuration is not supported.
++ */
++ if ((init_disp_cfg.width && init_disp_cfg.height) &&
++ (init_disp_cfg.width != fb->width ||
++ init_disp_cfg.height != fb->height)) {
++ drm_dbg(&kmb->drm, "Cannot change plane height or width after initial configuration");
++ return -EINVAL;
++ }
+ can_position = (plane->type == DRM_PLANE_TYPE_OVERLAY);
+ crtc_state =
+ drm_atomic_get_existing_crtc_state(state,
+@@ -296,6 +325,7 @@ static void kmb_plane_atomic_update(struct drm_plane *plane,
+ unsigned char plane_id;
+ int num_planes;
+ static dma_addr_t addr[MAX_SUB_PLANES];
++ struct disp_cfg *init_disp_cfg;
+
+ if (!plane || !new_plane_state || !old_plane_state)
+ return;
+@@ -317,7 +347,8 @@ static void kmb_plane_atomic_update(struct drm_plane *plane,
+ }
+ spin_unlock_irq(&kmb->irq_lock);
+
+- src_w = (new_plane_state->src_w >> 16);
++ init_disp_cfg = &kmb->init_disp_cfg[plane_id];
++ src_w = new_plane_state->src_w >> 16;
+ src_h = new_plane_state->src_h >> 16;
+ crtc_x = new_plane_state->crtc_x;
+ crtc_y = new_plane_state->crtc_y;
+@@ -448,6 +479,16 @@ static void kmb_plane_atomic_update(struct drm_plane *plane,
+
+ /* Enable DMA */
+ kmb_write_lcd(kmb, LCD_LAYERn_DMA_CFG(plane_id), dma_cfg);
++
++ /* Save initial display config */
++ if (!init_disp_cfg->width ||
++ !init_disp_cfg->height ||
++ !init_disp_cfg->format) {
++ init_disp_cfg->width = width;
++ init_disp_cfg->height = height;
++ init_disp_cfg->format = fb->format->format;
++ }
++
+ drm_dbg(&kmb->drm, "dma_cfg=0x%x LCD_DMA_CFG=0x%x\n", dma_cfg,
+ kmb_read_lcd(kmb, LCD_LAYERn_DMA_CFG(plane_id)));
+
+diff --git a/drivers/gpu/drm/kmb/kmb_plane.h b/drivers/gpu/drm/kmb/kmb_plane.h
+index 486490f7a3ec..99207b35365c 100644
+--- a/drivers/gpu/drm/kmb/kmb_plane.h
++++ b/drivers/gpu/drm/kmb/kmb_plane.h
+@@ -62,6 +62,12 @@ struct layer_status {
+ u32 ctrl;
+ };
+
++struct disp_cfg {
++ unsigned int width;
++ unsigned int height;
++ unsigned int format;
++};
++
+ struct kmb_plane *kmb_plane_init(struct drm_device *drm);
+ void kmb_plane_destroy(struct drm_plane *plane);
+ #endif /* __KMB_PLANE_H__ */
+--
+2.33.0
+
--- /dev/null
+From b619ab17b4476f21ac0b8377450071a904d6010a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jun 2021 14:17:11 -0700
+Subject: drm/kmb: Enable ADV bridge after modeset
+
+From: Anitha Chrisanthus <anitha.chrisanthus@intel.com>
+
+[ Upstream commit 74056092ff415e7e20ce2544689b32ee811c4f0b ]
+
+On KMB, ADV bridge must be programmed and powered on prior to
+MIPI DSI HW initialization.
+
+v2: changed to atomic_bridge_chain_enable (Sam)
+
+Fixes: 98521f4d4b4c ("drm/kmb: Mipi DSI part of the display driver")
+Co-developed-by: Edmund Dea <edmund.j.dea@intel.com>
+Signed-off-by: Edmund Dea <edmund.j.dea@intel.com>
+Signed-off-by: Anitha Chrisanthus <anitha.chrisanthus@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211019230719.789958-1-anitha.chrisanthus@intel.com
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/kmb/kmb_crtc.c | 7 ++++---
+ drivers/gpu/drm/kmb/kmb_dsi.c | 9 +++++----
+ drivers/gpu/drm/kmb/kmb_dsi.h | 2 +-
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/kmb/kmb_crtc.c b/drivers/gpu/drm/kmb/kmb_crtc.c
+index 44327bc629ca..4f240466cf63 100644
+--- a/drivers/gpu/drm/kmb/kmb_crtc.c
++++ b/drivers/gpu/drm/kmb/kmb_crtc.c
+@@ -66,7 +66,8 @@ static const struct drm_crtc_funcs kmb_crtc_funcs = {
+ .disable_vblank = kmb_crtc_disable_vblank,
+ };
+
+-static void kmb_crtc_set_mode(struct drm_crtc *crtc)
++static void kmb_crtc_set_mode(struct drm_crtc *crtc,
++ struct drm_atomic_state *old_state)
+ {
+ struct drm_device *dev = crtc->dev;
+ struct drm_display_mode *m = &crtc->state->adjusted_mode;
+@@ -75,7 +76,7 @@ static void kmb_crtc_set_mode(struct drm_crtc *crtc)
+ unsigned int val = 0;
+
+ /* Initialize mipi */
+- kmb_dsi_mode_set(kmb->kmb_dsi, m, kmb->sys_clk_mhz);
++ kmb_dsi_mode_set(kmb->kmb_dsi, m, kmb->sys_clk_mhz, old_state);
+ drm_info(dev,
+ "vfp= %d vbp= %d vsync_len=%d hfp=%d hbp=%d hsync_len=%d\n",
+ m->crtc_vsync_start - m->crtc_vdisplay,
+@@ -138,7 +139,7 @@ static void kmb_crtc_atomic_enable(struct drm_crtc *crtc,
+ struct kmb_drm_private *kmb = crtc_to_kmb_priv(crtc);
+
+ clk_prepare_enable(kmb->kmb_clk.clk_lcd);
+- kmb_crtc_set_mode(crtc);
++ kmb_crtc_set_mode(crtc, state);
+ drm_crtc_vblank_on(crtc);
+ }
+
+diff --git a/drivers/gpu/drm/kmb/kmb_dsi.c b/drivers/gpu/drm/kmb/kmb_dsi.c
+index 5bc6c84073a3..756490589e0a 100644
+--- a/drivers/gpu/drm/kmb/kmb_dsi.c
++++ b/drivers/gpu/drm/kmb/kmb_dsi.c
+@@ -1331,7 +1331,8 @@ static u32 mipi_tx_init_dphy(struct kmb_dsi *kmb_dsi,
+ return 0;
+ }
+
+-static void connect_lcd_to_mipi(struct kmb_dsi *kmb_dsi)
++static void connect_lcd_to_mipi(struct kmb_dsi *kmb_dsi,
++ struct drm_atomic_state *old_state)
+ {
+ struct regmap *msscam;
+
+@@ -1340,7 +1341,7 @@ static void connect_lcd_to_mipi(struct kmb_dsi *kmb_dsi)
+ dev_dbg(kmb_dsi->dev, "failed to get msscam syscon");
+ return;
+ }
+-
++ drm_atomic_bridge_chain_enable(adv_bridge, old_state);
+ /* DISABLE MIPI->CIF CONNECTION */
+ regmap_write(msscam, MSS_MIPI_CIF_CFG, 0);
+
+@@ -1351,7 +1352,7 @@ static void connect_lcd_to_mipi(struct kmb_dsi *kmb_dsi)
+ }
+
+ int kmb_dsi_mode_set(struct kmb_dsi *kmb_dsi, struct drm_display_mode *mode,
+- int sys_clk_mhz)
++ int sys_clk_mhz, struct drm_atomic_state *old_state)
+ {
+ u64 data_rate;
+
+@@ -1399,7 +1400,7 @@ int kmb_dsi_mode_set(struct kmb_dsi *kmb_dsi, struct drm_display_mode *mode,
+ /* Dphy initialization */
+ mipi_tx_init_dphy(kmb_dsi, &mipi_tx_init_cfg);
+
+- connect_lcd_to_mipi(kmb_dsi);
++ connect_lcd_to_mipi(kmb_dsi, old_state);
+ dev_info(kmb_dsi->dev, "mipi hw initialized");
+
+ return 0;
+diff --git a/drivers/gpu/drm/kmb/kmb_dsi.h b/drivers/gpu/drm/kmb/kmb_dsi.h
+index 66b7c500d9bc..09dc88743d77 100644
+--- a/drivers/gpu/drm/kmb/kmb_dsi.h
++++ b/drivers/gpu/drm/kmb/kmb_dsi.h
+@@ -380,7 +380,7 @@ int kmb_dsi_host_bridge_init(struct device *dev);
+ struct kmb_dsi *kmb_dsi_init(struct platform_device *pdev);
+ void kmb_dsi_host_unregister(struct kmb_dsi *kmb_dsi);
+ int kmb_dsi_mode_set(struct kmb_dsi *kmb_dsi, struct drm_display_mode *mode,
+- int sys_clk_mhz);
++ int sys_clk_mhz, struct drm_atomic_state *old_state);
+ int kmb_dsi_map_mmio(struct kmb_dsi *kmb_dsi);
+ int kmb_dsi_clk_init(struct kmb_dsi *kmb_dsi);
+ int kmb_dsi_encoder_init(struct drm_device *dev, struct kmb_dsi *kmb_dsi);
+--
+2.33.0
+
--- /dev/null
+From 04cd526408addd0aae6d99bd1c6baa0c5bc64b01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Apr 2021 15:31:53 -0700
+Subject: drm/kmb: Remove clearing DPHY regs
+
+From: Edmund Dea <edmund.j.dea@intel.com>
+
+[ Upstream commit 13047a092c6d3f23b7d684b5b3fe46b2b50423b9 ]
+
+Don't clear the shared DPHY registers common to MIPI Rx and MIPI Tx during
+DSI initialization since this was causing MIPI Rx reset. Rest of the
+writes are bitwise, so will not affect Mipi Rx side.
+
+Fixes: 98521f4d4b4c ("drm/kmb: Mipi DSI part of the display driver")
+Signed-off-by: Edmund Dea <edmund.j.dea@intel.com>
+Signed-off-by: Anitha Chrisanthus <anitha.chrisanthus@intel.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211013233632.471892-3-anitha.chrisanthus@intel.com
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/kmb/kmb_dsi.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/kmb/kmb_dsi.c b/drivers/gpu/drm/kmb/kmb_dsi.c
+index 7e2371ffcb18..5bc6c84073a3 100644
+--- a/drivers/gpu/drm/kmb/kmb_dsi.c
++++ b/drivers/gpu/drm/kmb/kmb_dsi.c
+@@ -1393,11 +1393,6 @@ int kmb_dsi_mode_set(struct kmb_dsi *kmb_dsi, struct drm_display_mode *mode,
+ mipi_tx_init_cfg.lane_rate_mbps = data_rate;
+ }
+
+- kmb_write_mipi(kmb_dsi, DPHY_ENABLE, 0);
+- kmb_write_mipi(kmb_dsi, DPHY_INIT_CTRL0, 0);
+- kmb_write_mipi(kmb_dsi, DPHY_INIT_CTRL1, 0);
+- kmb_write_mipi(kmb_dsi, DPHY_INIT_CTRL2, 0);
+-
+ /* Initialize mipi controller */
+ mipi_tx_init_cntrl(kmb_dsi, &mipi_tx_init_cfg);
+
+--
+2.33.0
+
--- /dev/null
+From a9570e3c41497cab36c18e9f519ae3cffef1d42b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 11:13:09 -0800
+Subject: drm/kmb: Work around for higher system clock
+
+From: Anitha Chrisanthus <anitha.chrisanthus@intel.com>
+
+[ Upstream commit 3e4c31e8f70251732529a10934355084c7fab0ac ]
+
+Use a different value for system clock offset in the
+ppl/llp ratio calculations for clocks higher than 500 Mhz.
+
+Fixes: 98521f4d4b4c ("drm/kmb: Mipi DSI part of the display driver")
+Signed-off-by: Anitha Chrisanthus <anitha.chrisanthus@intel.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211013233632.471892-1-anitha.chrisanthus@intel.com
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/kmb/kmb_dsi.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/kmb/kmb_dsi.c b/drivers/gpu/drm/kmb/kmb_dsi.c
+index 231041b269f5..7e2371ffcb18 100644
+--- a/drivers/gpu/drm/kmb/kmb_dsi.c
++++ b/drivers/gpu/drm/kmb/kmb_dsi.c
+@@ -482,6 +482,10 @@ static u32 mipi_tx_fg_section_cfg(struct kmb_dsi *kmb_dsi,
+ return 0;
+ }
+
++#define CLK_DIFF_LOW 50
++#define CLK_DIFF_HI 60
++#define SYSCLK_500 500
++
+ static void mipi_tx_fg_cfg_regs(struct kmb_dsi *kmb_dsi, u8 frame_gen,
+ struct mipi_tx_frame_timing_cfg *fg_cfg)
+ {
+@@ -492,7 +496,12 @@ static void mipi_tx_fg_cfg_regs(struct kmb_dsi *kmb_dsi, u8 frame_gen,
+ /* 500 Mhz system clock minus 50 to account for the difference in
+ * MIPI clock speed in RTL tests
+ */
+- sysclk = kmb_dsi->sys_clk_mhz - 50;
++ if (kmb_dsi->sys_clk_mhz == SYSCLK_500) {
++ sysclk = kmb_dsi->sys_clk_mhz - CLK_DIFF_LOW;
++ } else {
++ /* 700 Mhz clk*/
++ sysclk = kmb_dsi->sys_clk_mhz - CLK_DIFF_HI;
++ }
+
+ /* PPL-Pixel Packing Layer, LLP-Low Level Protocol
+ * Frame genartor timing parameters are clocked on the system clock,
+--
+2.33.0
+
--- /dev/null
+From d888380e4ef4f88a609da16c540c537c3398f0b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 23:48:18 +0200
+Subject: drm/panel: ilitek-ili9881c: Fix sync for Feixin K101-IM2BYL02 panel
+
+From: Dan Johansen <strit@manjaro.org>
+
+[ Upstream commit 772970620a839141835eaf2bc507d957b10adcca ]
+
+This adjusts sync values according to the datasheet
+
+Fixes: 1c243751c095 ("drm/panel: ilitek-ili9881c: add support for Feixin K101-IM2BYL02 panel")
+Co-developed-by: Marius Gripsgard <marius@ubports.com>
+Signed-off-by: Dan Johansen <strit@manjaro.org>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210818214818.298089-1-strit@manjaro.org
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+index 0145129d7c66..534dd7414d42 100644
+--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+@@ -590,14 +590,14 @@ static const struct drm_display_mode k101_im2byl02_default_mode = {
+ .clock = 69700,
+
+ .hdisplay = 800,
+- .hsync_start = 800 + 6,
+- .hsync_end = 800 + 6 + 15,
+- .htotal = 800 + 6 + 15 + 16,
++ .hsync_start = 800 + 52,
++ .hsync_end = 800 + 52 + 8,
++ .htotal = 800 + 52 + 8 + 48,
+
+ .vdisplay = 1280,
+- .vsync_start = 1280 + 8,
+- .vsync_end = 1280 + 8 + 48,
+- .vtotal = 1280 + 8 + 48 + 52,
++ .vsync_start = 1280 + 16,
++ .vsync_end = 1280 + 16 + 6,
++ .vtotal = 1280 + 16 + 6 + 15,
+
+ .width_mm = 135,
+ .height_mm = 217,
+--
+2.33.0
+
--- /dev/null
+From c81a6ca3f33734ecac499471fa8cd96a60676abf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Sep 2021 09:55:42 +0300
+Subject: e1000e: Fix packet loss on Tiger Lake and later
+
+From: Sasha Neftin <sasha.neftin@intel.com>
+
+[ Upstream commit 639e298f432fb058a9496ea16863f53b1ce935fe ]
+
+Update the HW MAC initialization flow. Do not gate DMA clock from
+the modPHY block. Keeping this clock will prevent dropped packets
+sent in burst mode on the Kumeran interface.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=213651
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=213377
+Fixes: fb776f5d57ee ("e1000e: Add support for Tiger Lake")
+Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Mark Pearson <markpearson@lenovo.com>
+Tested-by: Nechama Kraus <nechamax.kraus@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e1000e/ich8lan.c | 11 ++++++++++-
+ drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +++
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index a80336c4319b..58a96a0cf4aa 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -4804,7 +4804,7 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
+ static s32 e1000_init_hw_ich8lan(struct e1000_hw *hw)
+ {
+ struct e1000_mac_info *mac = &hw->mac;
+- u32 ctrl_ext, txdctl, snoop;
++ u32 ctrl_ext, txdctl, snoop, fflt_dbg;
+ s32 ret_val;
+ u16 i;
+
+@@ -4863,6 +4863,15 @@ static s32 e1000_init_hw_ich8lan(struct e1000_hw *hw)
+ snoop = (u32)~(PCIE_NO_SNOOP_ALL);
+ e1000e_set_pcie_no_snoop(hw, snoop);
+
++ /* Enable workaround for packet loss issue on TGP PCH
++ * Do not gate DMA clock from the modPHY block
++ */
++ if (mac->type >= e1000_pch_tgp) {
++ fflt_dbg = er32(FFLT_DBG);
++ fflt_dbg |= E1000_FFLT_DBG_DONT_GATE_WAKE_DMA_CLK;
++ ew32(FFLT_DBG, fflt_dbg);
++ }
++
+ ctrl_ext = er32(CTRL_EXT);
+ ctrl_ext |= E1000_CTRL_EXT_RO_DIS;
+ ew32(CTRL_EXT, ctrl_ext);
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+index e757896287eb..8f2a8f4ce0ee 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+@@ -286,6 +286,9 @@
+ /* Proprietary Latency Tolerance Reporting PCI Capability */
+ #define E1000_PCI_LTR_CAP_LPT 0xA8
+
++/* Don't gate wake DMA clock */
++#define E1000_FFLT_DBG_DONT_GATE_WAKE_DMA_CLK 0x1000
++
+ void e1000e_write_protect_nvm_ich8lan(struct e1000_hw *hw);
+ void e1000e_set_kmrn_lock_loss_workaround_ich8lan(struct e1000_hw *hw,
+ bool state);
+--
+2.33.0
+
--- /dev/null
+From 609338830e7348f9491b7f69fc30e4ad4410e1e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Oct 2021 19:18:04 -0700
+Subject: hamradio: baycom_epp: fix build for UML
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 0a9bb11a5e298e72b675255a4bb2893513000584 ]
+
+On i386, the baycom_epp driver wants to inspect X86 CPU features (TSC)
+and then act on that data, but that info is not available when running
+on UML, so prevent that test and do the default action.
+
+Prevents this build error on UML + i386:
+
+../drivers/net/hamradio/baycom_epp.c: In function ‘epp_bh’:
+../drivers/net/hamradio/baycom_epp.c:630:6: error: implicit declaration of function ‘boot_cpu_has’; did you mean ‘get_cpu_mask’? [-Werror=implicit-function-declaration]
+ if (boot_cpu_has(X86_FEATURE_TSC)) \
+ ^
+../drivers/net/hamradio/baycom_epp.c:658:2: note: in expansion of macro ‘GETTICK’
+ GETTICK(time1);
+
+Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: linux-um@lists.infradead.org
+Cc: Jeff Dike <jdike@addtoit.com>
+Cc: Richard Weinberger <richard@nod.at>
+Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Thomas Sailer <t.sailer@alumni.ethz.ch>
+Cc: linux-hams@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hamradio/baycom_epp.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/hamradio/baycom_epp.c b/drivers/net/hamradio/baycom_epp.c
+index 4435a1195194..8ea8d50f81c4 100644
+--- a/drivers/net/hamradio/baycom_epp.c
++++ b/drivers/net/hamradio/baycom_epp.c
+@@ -623,16 +623,16 @@ static int receive(struct net_device *dev, int cnt)
+
+ /* --------------------------------------------------------------------- */
+
+-#ifdef __i386__
++#if defined(__i386__) && !defined(CONFIG_UML)
+ #include <asm/msr.h>
+ #define GETTICK(x) \
+ ({ \
+ if (boot_cpu_has(X86_FEATURE_TSC)) \
+ x = (unsigned int)rdtsc(); \
+ })
+-#else /* __i386__ */
++#else /* __i386__ && !CONFIG_UML */
+ #define GETTICK(x)
+-#endif /* __i386__ */
++#endif /* __i386__ && !CONFIG_UML */
+
+ static void epp_bh(struct work_struct *work)
+ {
+--
+2.33.0
+
--- /dev/null
+From 05b598ddab8e48ba65c5e1683e8de7bcd5866b56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Oct 2021 13:04:16 -0700
+Subject: ice: Add missing E810 device ids
+
+From: Tony Nguyen <anthony.l.nguyen@intel.com>
+
+[ Upstream commit 7dcf78b870be6418d72bb1c4d4924bf0f5ca5052 ]
+
+As part of support for E810 XXV devices, some device ids were
+inadvertently left out. Add those missing ids.
+
+Fixes: 195fb97766da ("ice: add additional E810 device id")
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Acked-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_common.c | 2 ++
+ drivers/net/ethernet/intel/ice/ice_devids.h | 4 ++++
+ drivers/net/ethernet/intel/ice/ice_main.c | 2 ++
+ 3 files changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c
+index 2fb81e359cdf..df5ad4de1f00 100644
+--- a/drivers/net/ethernet/intel/ice/ice_common.c
++++ b/drivers/net/ethernet/intel/ice/ice_common.c
+@@ -25,6 +25,8 @@ static enum ice_status ice_set_mac_type(struct ice_hw *hw)
+ case ICE_DEV_ID_E810C_BACKPLANE:
+ case ICE_DEV_ID_E810C_QSFP:
+ case ICE_DEV_ID_E810C_SFP:
++ case ICE_DEV_ID_E810_XXV_BACKPLANE:
++ case ICE_DEV_ID_E810_XXV_QSFP:
+ case ICE_DEV_ID_E810_XXV_SFP:
+ hw->mac_type = ICE_MAC_E810;
+ break;
+diff --git a/drivers/net/ethernet/intel/ice/ice_devids.h b/drivers/net/ethernet/intel/ice/ice_devids.h
+index 9d8194671f6a..ef4392e6e244 100644
+--- a/drivers/net/ethernet/intel/ice/ice_devids.h
++++ b/drivers/net/ethernet/intel/ice/ice_devids.h
+@@ -21,6 +21,10 @@
+ #define ICE_DEV_ID_E810C_QSFP 0x1592
+ /* Intel(R) Ethernet Controller E810-C for SFP */
+ #define ICE_DEV_ID_E810C_SFP 0x1593
++/* Intel(R) Ethernet Controller E810-XXV for backplane */
++#define ICE_DEV_ID_E810_XXV_BACKPLANE 0x1599
++/* Intel(R) Ethernet Controller E810-XXV for QSFP */
++#define ICE_DEV_ID_E810_XXV_QSFP 0x159A
+ /* Intel(R) Ethernet Controller E810-XXV for SFP */
+ #define ICE_DEV_ID_E810_XXV_SFP 0x159B
+ /* Intel(R) Ethernet Connection E823-C for backplane */
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 3a47b03310f3..ed087fde2066 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -5020,6 +5020,8 @@ static const struct pci_device_id ice_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, ICE_DEV_ID_E810C_BACKPLANE), 0 },
+ { PCI_VDEVICE(INTEL, ICE_DEV_ID_E810C_QSFP), 0 },
+ { PCI_VDEVICE(INTEL, ICE_DEV_ID_E810C_SFP), 0 },
++ { PCI_VDEVICE(INTEL, ICE_DEV_ID_E810_XXV_BACKPLANE), 0 },
++ { PCI_VDEVICE(INTEL, ICE_DEV_ID_E810_XXV_QSFP), 0 },
+ { PCI_VDEVICE(INTEL, ICE_DEV_ID_E810_XXV_SFP), 0 },
+ { PCI_VDEVICE(INTEL, ICE_DEV_ID_E823C_BACKPLANE), 0 },
+ { PCI_VDEVICE(INTEL, ICE_DEV_ID_E823C_QSFP), 0 },
+--
+2.33.0
+
--- /dev/null
+From f2cb7961bfca615933464cc17b673775e6440453 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Oct 2021 05:15:25 -0700
+Subject: ice: Avoid crash from unnecessary IDA free
+
+From: Dave Ertman <david.m.ertman@intel.com>
+
+[ Upstream commit 73e30a62b19b9fbb4e6a3465c59da186630d5f2e ]
+
+In the remove path, there is an attempt to free the aux_idx IDA whether
+it was allocated or not. This can potentially cause a crash when
+unloading the driver on systems that do not initialize support for RDMA.
+But, this free cannot be gated by the status bit for RDMA, since it is
+allocated if the driver detects support for RDMA at probe time, but the
+driver can enter into a state where RDMA is not supported after the IDA
+has been allocated at probe time and this would lead to a memory leak.
+
+Initialize aux_idx to an invalid value and check for a valid value when
+unloading to determine if an IDA free is necessary.
+
+Fixes: d25a0fc41c1f9 ("ice: Initialize RDMA support")
+Reported-by: Jun Miao <jun.miao@windriver.com>
+Signed-off-by: Dave Ertman <david.m.ertman@intel.com>
+Tested-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index a8bd512d5b45..3a47b03310f3 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -4224,6 +4224,9 @@ ice_probe(struct pci_dev *pdev, const struct pci_device_id __always_unused *ent)
+ if (!pf)
+ return -ENOMEM;
+
++ /* initialize Auxiliary index to invalid value */
++ pf->aux_idx = -1;
++
+ /* set up for high or low DMA */
+ err = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
+ if (err)
+@@ -4615,7 +4618,8 @@ static void ice_remove(struct pci_dev *pdev)
+
+ ice_aq_cancel_waiting_tasks(pf);
+ ice_unplug_aux_dev(pf);
+- ida_free(&ice_aux_ida, pf->aux_idx);
++ if (pf->aux_idx >= 0)
++ ida_free(&ice_aux_ida, pf->aux_idx);
+ set_bit(ICE_DOWN, pf->state);
+
+ mutex_destroy(&(&pf->hw)->fdir_fltr_lock);
+--
+2.33.0
+
--- /dev/null
+From 0ce3ac67d86d98878a1144e251ee5f7785500fe7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jun 2021 10:53:45 -0700
+Subject: ice: Fix failure to re-add LAN/RDMA Tx queues
+
+From: Brett Creeley <brett.creeley@intel.com>
+
+[ Upstream commit ff7e93219442f5ac5b2cfd33e4fe4b7d5942f957 ]
+
+Currently if the VSI is rebuilt/removed and the RDMA PF driver is active
+the RDMA Tx queue scheduler node configuration will not be cleaned up.
+This will cause the rebuild/re-add of the VSI to fail due to the
+software structures not being correctly cleaned up for the VSI index.
+Fix this by always calling ice_rm_vsi_rdma_cfg() for all VSI. If there
+are no RDMA scheduler nodes created, then there is no harm in calling
+ice_rm_vsi_rdma_cfg(). This change applies to all VSI types, so if
+RDMA support is added for other VSI types they will also get this
+change.
+
+Fixes: 348048e724a0 ("ice: Implement iidc operations")
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Tested-by: Jerzy Wiktor Jurkowski <jerzy.wiktor.jurkowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_lib.c | 9 +++++++++
+ drivers/net/ethernet/intel/ice/ice_sched.c | 13 +++++++++++++
+ drivers/net/ethernet/intel/ice/ice_sched.h | 1 +
+ 3 files changed, 23 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
+index dde9802c6c72..b718e196af2a 100644
+--- a/drivers/net/ethernet/intel/ice/ice_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_lib.c
+@@ -2841,6 +2841,7 @@ void ice_napi_del(struct ice_vsi *vsi)
+ */
+ int ice_vsi_release(struct ice_vsi *vsi)
+ {
++ enum ice_status err;
+ struct ice_pf *pf;
+
+ if (!vsi->back)
+@@ -2912,6 +2913,10 @@ int ice_vsi_release(struct ice_vsi *vsi)
+
+ ice_fltr_remove_all(vsi);
+ ice_rm_vsi_lan_cfg(vsi->port_info, vsi->idx);
++ err = ice_rm_vsi_rdma_cfg(vsi->port_info, vsi->idx);
++ if (err)
++ dev_err(ice_pf_to_dev(vsi->back), "Failed to remove RDMA scheduler config for VSI %u, err %d\n",
++ vsi->vsi_num, err);
+ ice_vsi_delete(vsi);
+ ice_vsi_free_q_vectors(vsi);
+
+@@ -3092,6 +3097,10 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, bool init_vsi)
+ prev_num_q_vectors = ice_vsi_rebuild_get_coalesce(vsi, coalesce);
+
+ ice_rm_vsi_lan_cfg(vsi->port_info, vsi->idx);
++ ret = ice_rm_vsi_rdma_cfg(vsi->port_info, vsi->idx);
++ if (ret)
++ dev_err(ice_pf_to_dev(vsi->back), "Failed to remove RDMA scheduler config for VSI %u, err %d\n",
++ vsi->vsi_num, ret);
+ ice_vsi_free_q_vectors(vsi);
+
+ /* SR-IOV determines needed MSIX resources all at once instead of per
+diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c
+index 9f07b6641705..2d9b10277186 100644
+--- a/drivers/net/ethernet/intel/ice/ice_sched.c
++++ b/drivers/net/ethernet/intel/ice/ice_sched.c
+@@ -2070,6 +2070,19 @@ enum ice_status ice_rm_vsi_lan_cfg(struct ice_port_info *pi, u16 vsi_handle)
+ return ice_sched_rm_vsi_cfg(pi, vsi_handle, ICE_SCHED_NODE_OWNER_LAN);
+ }
+
++/**
++ * ice_rm_vsi_rdma_cfg - remove VSI and its RDMA children nodes
++ * @pi: port information structure
++ * @vsi_handle: software VSI handle
++ *
++ * This function clears the VSI and its RDMA children nodes from scheduler tree
++ * for all TCs.
++ */
++enum ice_status ice_rm_vsi_rdma_cfg(struct ice_port_info *pi, u16 vsi_handle)
++{
++ return ice_sched_rm_vsi_cfg(pi, vsi_handle, ICE_SCHED_NODE_OWNER_RDMA);
++}
++
+ /**
+ * ice_get_agg_info - get the aggregator ID
+ * @hw: pointer to the hardware structure
+diff --git a/drivers/net/ethernet/intel/ice/ice_sched.h b/drivers/net/ethernet/intel/ice/ice_sched.h
+index 9beef8f0ec76..fdf7a5882f07 100644
+--- a/drivers/net/ethernet/intel/ice/ice_sched.h
++++ b/drivers/net/ethernet/intel/ice/ice_sched.h
+@@ -89,6 +89,7 @@ enum ice_status
+ ice_sched_cfg_vsi(struct ice_port_info *pi, u16 vsi_handle, u8 tc, u16 maxqs,
+ u8 owner, bool enable);
+ enum ice_status ice_rm_vsi_lan_cfg(struct ice_port_info *pi, u16 vsi_handle);
++enum ice_status ice_rm_vsi_rdma_cfg(struct ice_port_info *pi, u16 vsi_handle);
+
+ /* Tx scheduler rate limiter functions */
+ enum ice_status
+--
+2.33.0
+
--- /dev/null
+From a042bf62c8ab111fe2a63e111be5ef10a6211c5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Sep 2021 19:25:05 -0400
+Subject: ice: fix getting UDP tunnel entry
+
+From: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+
+[ Upstream commit e4c2efa1393c6f1fbfabf91d1d83fcb4ae691ccb ]
+
+Correct parameters order in call to ice_tunnel_idx_to_entry function.
+
+Entry in sparse port table is correct when the idx is 0. For idx 1 one
+correct entry should be skipped, for idx 2 two of them should be skipped
+etc. Change if condition to be true when idx is 0, which means that
+previous valid entry of this tunnel type were skipped.
+
+Fixes: b20e6c17c468 ("ice: convert to new udp_tunnel infrastructure")
+Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: Gurucharan G <gurucharanx.g@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_flex_pipe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
+index 06ac9badee77..1ac96dc66d0d 100644
+--- a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
++++ b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
+@@ -1668,7 +1668,7 @@ static u16 ice_tunnel_idx_to_entry(struct ice_hw *hw, enum ice_tunnel_type type,
+ for (i = 0; i < hw->tnl.count && i < ICE_TUNNEL_MAX_ENTRIES; i++)
+ if (hw->tnl.tbl[i].valid &&
+ hw->tnl.tbl[i].type == type &&
+- idx--)
++ idx-- == 0)
+ return i;
+
+ WARN_ON_ONCE(1);
+@@ -1828,7 +1828,7 @@ int ice_udp_tunnel_set_port(struct net_device *netdev, unsigned int table,
+ u16 index;
+
+ tnl_type = ti->type == UDP_TUNNEL_TYPE_VXLAN ? TNL_VXLAN : TNL_GENEVE;
+- index = ice_tunnel_idx_to_entry(&pf->hw, idx, tnl_type);
++ index = ice_tunnel_idx_to_entry(&pf->hw, tnl_type, idx);
+
+ status = ice_create_tunnel(&pf->hw, index, tnl_type, ntohs(ti->port));
+ if (status) {
+--
+2.33.0
+
--- /dev/null
+From 1b0226aaf324c4c2f2e67da32cdd41dbfa08aac9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Sep 2021 11:21:50 -0700
+Subject: ice: Print the api_patch as part of the fw.mgmt.api
+
+From: Brett Creeley <brett.creeley@intel.com>
+
+[ Upstream commit b726ddf984a56a385c9df406a66c221f3a77c951 ]
+
+Currently when a user uses "devlink dev info", the fw.mgmt.api will be
+the major.minor numbers as shown below:
+
+devlink dev info pci/0000:3b:00.0
+pci/0000:3b:00.0:
+ driver ice
+ serial_number 00-01-00-ff-ff-00-00-00
+ versions:
+ fixed:
+ board.id K91258-000
+ running:
+ fw.mgmt 6.1.2
+ fw.mgmt.api 1.7 <--- No patch number included
+ fw.mgmt.build 0xd75e7d06
+ fw.mgmt.srev 5
+ fw.undi 1.2992.0
+ fw.undi.srev 5
+ fw.psid.api 3.10
+ fw.bundle_id 0x800085cc
+ fw.app.name ICE OS Default Package
+ fw.app 1.3.27.0
+ fw.app.bundle_id 0xc0000001
+ fw.netlist 3.10.2000-3.1e.0
+ fw.netlist.build 0x2a76e110
+ stored:
+ fw.mgmt.srev 5
+ fw.undi 1.2992.0
+ fw.undi.srev 5
+ fw.psid.api 3.10
+ fw.bundle_id 0x800085cc
+ fw.netlist 3.10.2000-3.1e.0
+ fw.netlist.build 0x2a76e110
+
+There are many features in the driver that depend on the major, minor,
+and patch version of the FW. Without the patch number in the output for
+fw.mgmt.api debugging issues related to the FW API version is difficult.
+Also, using major.minor.patch aligns with the existing firmware version
+which uses a 3 digit value.
+
+Fix this by making the fw.mgmt.api print the major.minor.patch
+versions. Shown below is the result:
+
+devlink dev info pci/0000:3b:00.0
+pci/0000:3b:00.0:
+ driver ice
+ serial_number 00-01-00-ff-ff-00-00-00
+ versions:
+ fixed:
+ board.id K91258-000
+ running:
+ fw.mgmt 6.1.2
+ fw.mgmt.api 1.7.9 <--- patch number included
+ fw.mgmt.build 0xd75e7d06
+ fw.mgmt.srev 5
+ fw.undi 1.2992.0
+ fw.undi.srev 5
+ fw.psid.api 3.10
+ fw.bundle_id 0x800085cc
+ fw.app.name ICE OS Default Package
+ fw.app 1.3.27.0
+ fw.app.bundle_id 0xc0000001
+ fw.netlist 3.10.2000-3.1e.0
+ fw.netlist.build 0x2a76e110
+ stored:
+ fw.mgmt.srev 5
+ fw.undi 1.2992.0
+ fw.undi.srev 5
+ fw.psid.api 3.10
+ fw.bundle_id 0x800085cc
+ fw.netlist 3.10.2000-3.1e.0
+ fw.netlist.build 0x2a76e110
+
+Fixes: ff2e5c700e08 ("ice: add basic handler for devlink .info_get")
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Tested-by: Gurucharan G <gurucharanx.g@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/networking/devlink/ice.rst | 9 +++++----
+ drivers/net/ethernet/intel/ice/ice_devlink.c | 3 ++-
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/Documentation/networking/devlink/ice.rst b/Documentation/networking/devlink/ice.rst
+index a432dc419fa4..5d97cee9457b 100644
+--- a/Documentation/networking/devlink/ice.rst
++++ b/Documentation/networking/devlink/ice.rst
+@@ -30,10 +30,11 @@ The ``ice`` driver reports the following versions
+ PHY, link, etc.
+ * - ``fw.mgmt.api``
+ - running
+- - 1.5
+- - 2-digit version number of the API exported over the AdminQ by the
+- management firmware. Used by the driver to identify what commands
+- are supported.
++ - 1.5.1
++ - 3-digit version number (major.minor.patch) of the API exported over
++ the AdminQ by the management firmware. Used by the driver to
++ identify what commands are supported. Historical versions of the
++ kernel only displayed a 2-digit version number (major.minor).
+ * - ``fw.mgmt.build``
+ - running
+ - 0x305d955f
+diff --git a/drivers/net/ethernet/intel/ice/ice_devlink.c b/drivers/net/ethernet/intel/ice/ice_devlink.c
+index 7fe6e8ea39f0..64bea7659cf7 100644
+--- a/drivers/net/ethernet/intel/ice/ice_devlink.c
++++ b/drivers/net/ethernet/intel/ice/ice_devlink.c
+@@ -63,7 +63,8 @@ static int ice_info_fw_api(struct ice_pf *pf, struct ice_info_ctx *ctx)
+ {
+ struct ice_hw *hw = &pf->hw;
+
+- snprintf(ctx->buf, sizeof(ctx->buf), "%u.%u", hw->api_maj_ver, hw->api_min_ver);
++ snprintf(ctx->buf, sizeof(ctx->buf), "%u.%u.%u", hw->api_maj_ver,
++ hw->api_min_ver, hw->api_patch);
+
+ return 0;
+ }
+--
+2.33.0
+
--- /dev/null
+From 57637fdc35eb9152da328c4f74661dad1fdabdd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Sep 2021 20:49:04 +0300
+Subject: igc: Update I226_K device ID
+
+From: Sasha Neftin <sasha.neftin@intel.com>
+
+[ Upstream commit 79cc8322b6d82747cb63ea464146c0bf5b5a6bc1 ]
+
+The device ID for I226_K was incorrectly assigned, update the device
+ID to the correct one.
+
+Fixes: bfa5e98c9de4 ("igc: Add new device ID")
+Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Nechama Kraus <nechamax.kraus@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_hw.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_hw.h b/drivers/net/ethernet/intel/igc/igc_hw.h
+index 4461f8b9a864..4e0203336c6b 100644
+--- a/drivers/net/ethernet/intel/igc/igc_hw.h
++++ b/drivers/net/ethernet/intel/igc/igc_hw.h
+@@ -22,8 +22,8 @@
+ #define IGC_DEV_ID_I220_V 0x15F7
+ #define IGC_DEV_ID_I225_K 0x3100
+ #define IGC_DEV_ID_I225_K2 0x3101
++#define IGC_DEV_ID_I226_K 0x3102
+ #define IGC_DEV_ID_I225_LMVP 0x5502
+-#define IGC_DEV_ID_I226_K 0x5504
+ #define IGC_DEV_ID_I225_IT 0x0D9F
+ #define IGC_DEV_ID_I226_LM 0x125B
+ #define IGC_DEV_ID_I226_V 0x125C
+--
+2.33.0
+
--- /dev/null
+From 059bebd0dc3744b47916e6fe0f24950c6f253e11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Oct 2021 09:08:45 -0400
+Subject: ipv6: When forwarding count rx stats on the orig netdev
+
+From: Stephen Suryaputra <ssuryaextr@gmail.com>
+
+[ Upstream commit 0857d6f8c759d95f89d0436f86cdfd189ef99f20 ]
+
+Commit bdb7cc643fc9 ("ipv6: Count interface receive statistics on the
+ingress netdev") does not work when ip6_forward() executes on the skbs
+with vrf-enslaved netdev. Use IP6CB(skb)->iif to get to the right one.
+
+Add a selftest script to verify.
+
+Fixes: bdb7cc643fc9 ("ipv6: Count interface receive statistics on the ingress netdev")
+Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/20211014130845.410602-1-ssuryaextr@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ip6_output.c | 3 +-
+ .../testing/selftests/net/forwarding/Makefile | 1 +
+ .../net/forwarding/forwarding.config.sample | 2 +
+ .../net/forwarding/ip6_forward_instats_vrf.sh | 172 ++++++++++++++++++
+ tools/testing/selftests/net/forwarding/lib.sh | 8 +
+ 5 files changed, 185 insertions(+), 1 deletion(-)
+ create mode 100755 tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 8e6ca9ad6812..80b1a7838cff 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -488,13 +488,14 @@ static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
+
+ int ip6_forward(struct sk_buff *skb)
+ {
+- struct inet6_dev *idev = __in6_dev_get_safely(skb->dev);
+ struct dst_entry *dst = skb_dst(skb);
+ struct ipv6hdr *hdr = ipv6_hdr(skb);
+ struct inet6_skb_parm *opt = IP6CB(skb);
+ struct net *net = dev_net(dst->dev);
++ struct inet6_dev *idev;
+ u32 mtu;
+
++ idev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)->iif));
+ if (net->ipv6.devconf_all->forwarding == 0)
+ goto error;
+
+diff --git a/tools/testing/selftests/net/forwarding/Makefile b/tools/testing/selftests/net/forwarding/Makefile
+index d97bd6889446..72ee644d47bf 100644
+--- a/tools/testing/selftests/net/forwarding/Makefile
++++ b/tools/testing/selftests/net/forwarding/Makefile
+@@ -9,6 +9,7 @@ TEST_PROGS = bridge_igmp.sh \
+ gre_inner_v4_multipath.sh \
+ gre_inner_v6_multipath.sh \
+ gre_multipath.sh \
++ ip6_forward_instats_vrf.sh \
+ ip6gre_inner_v4_multipath.sh \
+ ip6gre_inner_v6_multipath.sh \
+ ipip_flat_gre_key.sh \
+diff --git a/tools/testing/selftests/net/forwarding/forwarding.config.sample b/tools/testing/selftests/net/forwarding/forwarding.config.sample
+index b802c14d2950..e5e2fbeca22e 100644
+--- a/tools/testing/selftests/net/forwarding/forwarding.config.sample
++++ b/tools/testing/selftests/net/forwarding/forwarding.config.sample
+@@ -39,3 +39,5 @@ NETIF_CREATE=yes
+ # Timeout (in seconds) before ping exits regardless of how many packets have
+ # been sent or received
+ PING_TIMEOUT=5
++# IPv6 traceroute utility name.
++TROUTE6=traceroute6
+diff --git a/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh b/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh
+new file mode 100755
+index 000000000000..9f5b3e2e5e95
+--- /dev/null
++++ b/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh
+@@ -0,0 +1,172 @@
++#!/bin/bash
++# SPDX-License-Identifier: GPL-2.0
++
++# Test ipv6 stats on the incoming if when forwarding with VRF
++
++ALL_TESTS="
++ ipv6_ping
++ ipv6_in_too_big_err
++ ipv6_in_hdr_err
++ ipv6_in_addr_err
++ ipv6_in_discard
++"
++
++NUM_NETIFS=4
++source lib.sh
++
++h1_create()
++{
++ simple_if_init $h1 2001:1:1::2/64
++ ip -6 route add vrf v$h1 2001:1:2::/64 via 2001:1:1::1
++}
++
++h1_destroy()
++{
++ ip -6 route del vrf v$h1 2001:1:2::/64 via 2001:1:1::1
++ simple_if_fini $h1 2001:1:1::2/64
++}
++
++router_create()
++{
++ vrf_create router
++ __simple_if_init $rtr1 router 2001:1:1::1/64
++ __simple_if_init $rtr2 router 2001:1:2::1/64
++ mtu_set $rtr2 1280
++}
++
++router_destroy()
++{
++ mtu_restore $rtr2
++ __simple_if_fini $rtr2 2001:1:2::1/64
++ __simple_if_fini $rtr1 2001:1:1::1/64
++ vrf_destroy router
++}
++
++h2_create()
++{
++ simple_if_init $h2 2001:1:2::2/64
++ ip -6 route add vrf v$h2 2001:1:1::/64 via 2001:1:2::1
++ mtu_set $h2 1280
++}
++
++h2_destroy()
++{
++ mtu_restore $h2
++ ip -6 route del vrf v$h2 2001:1:1::/64 via 2001:1:2::1
++ simple_if_fini $h2 2001:1:2::2/64
++}
++
++setup_prepare()
++{
++ h1=${NETIFS[p1]}
++ rtr1=${NETIFS[p2]}
++
++ rtr2=${NETIFS[p3]}
++ h2=${NETIFS[p4]}
++
++ vrf_prepare
++ h1_create
++ router_create
++ h2_create
++
++ forwarding_enable
++}
++
++cleanup()
++{
++ pre_cleanup
++
++ forwarding_restore
++
++ h2_destroy
++ router_destroy
++ h1_destroy
++ vrf_cleanup
++}
++
++ipv6_in_too_big_err()
++{
++ RET=0
++
++ local t0=$(ipv6_stats_get $rtr1 Ip6InTooBigErrors)
++ local vrf_name=$(master_name_get $h1)
++
++ # Send too big packets
++ ip vrf exec $vrf_name \
++ $PING6 -s 1300 2001:1:2::2 -c 1 -w $PING_TIMEOUT &> /dev/null
++
++ local t1=$(ipv6_stats_get $rtr1 Ip6InTooBigErrors)
++ test "$((t1 - t0))" -ne 0
++ check_err $?
++ log_test "Ip6InTooBigErrors"
++}
++
++ipv6_in_hdr_err()
++{
++ RET=0
++
++ local t0=$(ipv6_stats_get $rtr1 Ip6InHdrErrors)
++ local vrf_name=$(master_name_get $h1)
++
++ # Send packets with hop limit 1, easiest with traceroute6 as some ping6
++ # doesn't allow hop limit to be specified
++ ip vrf exec $vrf_name \
++ $TROUTE6 2001:1:2::2 &> /dev/null
++
++ local t1=$(ipv6_stats_get $rtr1 Ip6InHdrErrors)
++ test "$((t1 - t0))" -ne 0
++ check_err $?
++ log_test "Ip6InHdrErrors"
++}
++
++ipv6_in_addr_err()
++{
++ RET=0
++
++ local t0=$(ipv6_stats_get $rtr1 Ip6InAddrErrors)
++ local vrf_name=$(master_name_get $h1)
++
++ # Disable forwarding temporary while sending the packet
++ sysctl -qw net.ipv6.conf.all.forwarding=0
++ ip vrf exec $vrf_name \
++ $PING6 2001:1:2::2 -c 1 -w $PING_TIMEOUT &> /dev/null
++ sysctl -qw net.ipv6.conf.all.forwarding=1
++
++ local t1=$(ipv6_stats_get $rtr1 Ip6InAddrErrors)
++ test "$((t1 - t0))" -ne 0
++ check_err $?
++ log_test "Ip6InAddrErrors"
++}
++
++ipv6_in_discard()
++{
++ RET=0
++
++ local t0=$(ipv6_stats_get $rtr1 Ip6InDiscards)
++ local vrf_name=$(master_name_get $h1)
++
++ # Add a policy to discard
++ ip xfrm policy add dst 2001:1:2::2/128 dir fwd action block
++ ip vrf exec $vrf_name \
++ $PING6 2001:1:2::2 -c 1 -w $PING_TIMEOUT &> /dev/null
++ ip xfrm policy del dst 2001:1:2::2/128 dir fwd
++
++ local t1=$(ipv6_stats_get $rtr1 Ip6InDiscards)
++ test "$((t1 - t0))" -ne 0
++ check_err $?
++ log_test "Ip6InDiscards"
++}
++ipv6_ping()
++{
++ RET=0
++
++ ping6_test $h1 2001:1:2::2
++}
++
++trap cleanup EXIT
++
++setup_prepare
++setup_wait
++tests_run
++
++exit $EXIT_STATUS
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index 42e28c983d41..5140980f5475 100644
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -748,6 +748,14 @@ qdisc_parent_stats_get()
+ | jq '.[] | select(.parent == "'"$parent"'") | '"$selector"
+ }
+
++ipv6_stats_get()
++{
++ local dev=$1; shift
++ local stat=$1; shift
++
++ cat /proc/net/dev_snmp6/$dev | grep "^$stat" | cut -f2
++}
++
+ humanize()
+ {
+ local speed=$1; shift
+--
+2.33.0
+
--- /dev/null
+From 37966be73ee991ce4cd9f9bff42d51edb428b6e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Oct 2021 10:01:41 +0100
+Subject: KVM: arm64: Fix host stage-2 PGD refcount
+
+From: Quentin Perret <qperret@google.com>
+
+[ Upstream commit 1d58a17ef54599506d44c45ac95be27273a4d2b1 ]
+
+The KVM page-table library refcounts the pages of concatenated stage-2
+PGDs individually. However, when running KVM in protected mode, the
+host's stage-2 PGD is currently managed by EL2 as a single high-order
+compound page, which can cause the refcount of the tail pages to reach 0
+when they shouldn't, hence corrupting the page-table.
+
+Fix this by introducing a new hyp_split_page() helper in the EL2 page
+allocator (matching the kernel's split_page() function), and make use of
+it from host_s2_zalloc_pages_exact().
+
+Fixes: 1025c8c0c6ac ("KVM: arm64: Wrap the host with a stage 2")
+Acked-by: Will Deacon <will@kernel.org>
+Suggested-by: Will Deacon <will@kernel.org>
+Signed-off-by: Quentin Perret <qperret@google.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20211005090155.734578-5-qperret@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kvm/hyp/include/nvhe/gfp.h | 1 +
+ arch/arm64/kvm/hyp/nvhe/mem_protect.c | 13 ++++++++++++-
+ arch/arm64/kvm/hyp/nvhe/page_alloc.c | 14 ++++++++++++++
+ 3 files changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/kvm/hyp/include/nvhe/gfp.h b/arch/arm64/kvm/hyp/include/nvhe/gfp.h
+index fb0f523d1492..0a048dc06a7d 100644
+--- a/arch/arm64/kvm/hyp/include/nvhe/gfp.h
++++ b/arch/arm64/kvm/hyp/include/nvhe/gfp.h
+@@ -24,6 +24,7 @@ struct hyp_pool {
+
+ /* Allocation */
+ void *hyp_alloc_pages(struct hyp_pool *pool, unsigned short order);
++void hyp_split_page(struct hyp_page *page);
+ void hyp_get_page(struct hyp_pool *pool, void *addr);
+ void hyp_put_page(struct hyp_pool *pool, void *addr);
+
+diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
+index a6ce991b1467..b79ce0059e7b 100644
+--- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c
++++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
+@@ -35,7 +35,18 @@ static const u8 pkvm_hyp_id = 1;
+
+ static void *host_s2_zalloc_pages_exact(size_t size)
+ {
+- return hyp_alloc_pages(&host_s2_pool, get_order(size));
++ void *addr = hyp_alloc_pages(&host_s2_pool, get_order(size));
++
++ hyp_split_page(hyp_virt_to_page(addr));
++
++ /*
++ * The size of concatenated PGDs is always a power of two of PAGE_SIZE,
++ * so there should be no need to free any of the tail pages to make the
++ * allocation exact.
++ */
++ WARN_ON(size != (PAGE_SIZE << get_order(size)));
++
++ return addr;
+ }
+
+ static void *host_s2_zalloc_page(void *pool)
+diff --git a/arch/arm64/kvm/hyp/nvhe/page_alloc.c b/arch/arm64/kvm/hyp/nvhe/page_alloc.c
+index 41fc25bdfb34..a6e874e61a40 100644
+--- a/arch/arm64/kvm/hyp/nvhe/page_alloc.c
++++ b/arch/arm64/kvm/hyp/nvhe/page_alloc.c
+@@ -193,6 +193,20 @@ void hyp_get_page(struct hyp_pool *pool, void *addr)
+ hyp_spin_unlock(&pool->lock);
+ }
+
++void hyp_split_page(struct hyp_page *p)
++{
++ unsigned short order = p->order;
++ unsigned int i;
++
++ p->order = 0;
++ for (i = 1; i < (1 << order); i++) {
++ struct hyp_page *tail = p + i;
++
++ tail->order = 0;
++ hyp_set_page_refcounted(tail);
++ }
++}
++
+ void *hyp_alloc_pages(struct hyp_pool *pool, unsigned short order)
+ {
+ unsigned short i = order;
+--
+2.33.0
+
--- /dev/null
+From fe773595dd20ce85d3c38c8509f641d50b4e7a22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Oct 2021 13:20:31 +0100
+Subject: KVM: arm64: Release mmap_lock when using VM_SHARED with MTE
+
+From: Quentin Perret <qperret@google.com>
+
+[ Upstream commit 6e6a8ef088e1222cb1250942f51ad9c1ab219ab2 ]
+
+VM_SHARED mappings are currently forbidden in a memslot with MTE to
+prevent two VMs racing to sanitise the same page. However, this check
+is performed while holding current->mm's mmap_lock, but fails to release
+it. Fix this by releasing the lock when needed.
+
+Fixes: ea7fc1bb1cd1 ("KVM: arm64: Introduce MTE VM feature")
+Signed-off-by: Quentin Perret <qperret@google.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20211005122031.809857-1-qperret@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kvm/mmu.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
+index 0625bf2353c2..3fcdacfee579 100644
+--- a/arch/arm64/kvm/mmu.c
++++ b/arch/arm64/kvm/mmu.c
+@@ -1477,8 +1477,10 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
+ * when updating the PG_mte_tagged page flag, see
+ * sanitise_mte_tags for more details.
+ */
+- if (kvm_has_mte(kvm) && vma->vm_flags & VM_SHARED)
+- return -EINVAL;
++ if (kvm_has_mte(kvm) && vma->vm_flags & VM_SHARED) {
++ ret = -EINVAL;
++ break;
++ }
+
+ if (vma->vm_flags & VM_PFNMAP) {
+ /* IO region dirty page logging not allowed */
+--
+2.33.0
+
--- /dev/null
+From d2ffa506892944e6600f7aaa04e5a1591d4926eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Oct 2021 15:07:54 +0200
+Subject: lan78xx: select CRC32
+
+From: Vegard Nossum <vegard.nossum@oracle.com>
+
+[ Upstream commit 46393d61a328d7c4e3264252dae891921126c674 ]
+
+Fix the following build/link error by adding a dependency on the CRC32
+routines:
+
+ ld: drivers/net/usb/lan78xx.o: in function `lan78xx_set_multicast':
+ lan78xx.c:(.text+0x48cf): undefined reference to `crc32_le'
+
+The actual use of crc32_le() comes indirectly through ether_crc().
+
+Fixes: 55d7de9de6c30 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
+Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
+index f87f17503373..b554054a7560 100644
+--- a/drivers/net/usb/Kconfig
++++ b/drivers/net/usb/Kconfig
+@@ -117,6 +117,7 @@ config USB_LAN78XX
+ select PHYLIB
+ select MICROCHIP_PHY
+ select FIXED_PHY
++ select CRC32
+ help
+ This option adds support for Microchip LAN78XX based USB 2
+ & USB 3 10/100/1000 Ethernet adapters.
+--
+2.33.0
+
--- /dev/null
+From 39d53a2ea597d28f9a68ec5ab2d1fc93e38e5665 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Oct 2021 21:59:00 +0200
+Subject: net: dsa: Fix an error handling path in 'dsa_switch_parse_ports_of()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ba69fd9101f20a6d05a96ab743341d4e7b1a2178 ]
+
+If we return before the end of the 'for_each_child_of_node()' iterator, the
+reference taken on 'port' must be released.
+
+Add the missing 'of_node_put()' calls.
+
+Fixes: 83c0afaec7b7 ("net: dsa: Add new binding implementation")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/15d5310d1d55ad51c1af80775865306d92432e03.1634587046.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/dsa2.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
+index 76ed5ef0e36a..28326ca34b52 100644
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -1283,12 +1283,15 @@ static int dsa_switch_parse_ports_of(struct dsa_switch *ds,
+
+ for_each_available_child_of_node(ports, port) {
+ err = of_property_read_u32(port, "reg", ®);
+- if (err)
++ if (err) {
++ of_node_put(port);
+ goto out_put_node;
++ }
+
+ if (reg >= ds->num_ports) {
+ dev_err(ds->dev, "port %pOF index %u exceeds num_ports (%zu)\n",
+ port, reg, ds->num_ports);
++ of_node_put(port);
+ err = -EINVAL;
+ goto out_put_node;
+ }
+@@ -1296,8 +1299,10 @@ static int dsa_switch_parse_ports_of(struct dsa_switch *ds,
+ dp = dsa_to_port(ds, reg);
+
+ err = dsa_port_parse_of(dp, port);
+- if (err)
++ if (err) {
++ of_node_put(port);
+ goto out_put_node;
++ }
+ }
+
+ out_put_node:
+--
+2.33.0
+
--- /dev/null
+From 0788fcd8c63fcf5e26dfe328ee739d9136d90692 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Oct 2021 00:10:20 +0200
+Subject: net: dsa: lantiq_gswip: fix register definition
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit 66d262804a2276721eac86cf18fcd61046149193 ]
+
+I compared the register definitions with the D-Link DWR-966
+GPL sources and found that the PUAFD field definition was
+incorrect. This definition is unused and causes no issues.
+
+Fixes: 14fceff4771e ("net: dsa: Add Lantiq / Intel DSA driver for vrx200")
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/lantiq_gswip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c
+index 267324889dd6..1b9b7569c371 100644
+--- a/drivers/net/dsa/lantiq_gswip.c
++++ b/drivers/net/dsa/lantiq_gswip.c
+@@ -230,7 +230,7 @@
+ #define GSWIP_SDMA_PCTRLp(p) (0xBC0 + ((p) * 0x6))
+ #define GSWIP_SDMA_PCTRL_EN BIT(0) /* SDMA Port Enable */
+ #define GSWIP_SDMA_PCTRL_FCEN BIT(1) /* Flow Control Enable */
+-#define GSWIP_SDMA_PCTRL_PAUFWD BIT(1) /* Pause Frame Forwarding */
++#define GSWIP_SDMA_PCTRL_PAUFWD BIT(3) /* Pause Frame Forwarding */
+
+ #define GSWIP_TABLE_ACTIVE_VLAN 0x01
+ #define GSWIP_TABLE_VLAN_MAPPING 0x02
+--
+2.33.0
+
--- /dev/null
+From cb9072d3e817b1ba8fc68cf389bede035aa89548 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Oct 2021 19:52:06 +0300
+Subject: net: enetc: fix ethtool counter name for PM0_TERR
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit fb8dc5fc8cbdfd62ecd16493848aee2f42ed84d9 ]
+
+There are two counters named "MAC tx frames", one of them is actually
+incorrect. The correct name for that counter should be "MAC tx error
+frames", which is symmetric to the existing "MAC rx error frames".
+
+Fixes: 16eb4c85c964 ("enetc: Add ethtool statistics")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: <Claudiu Manoil <claudiu.manoil@nxp.com>
+Link: https://lore.kernel.org/r/20211020165206.1069889-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
+index ebccaf02411c..8b618c15984d 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
+@@ -157,7 +157,7 @@ static const struct {
+ { ENETC_PM0_TFRM, "MAC tx frames" },
+ { ENETC_PM0_TFCS, "MAC tx fcs errors" },
+ { ENETC_PM0_TVLAN, "MAC tx VLAN frames" },
+- { ENETC_PM0_TERR, "MAC tx frames" },
++ { ENETC_PM0_TERR, "MAC tx frame errors" },
+ { ENETC_PM0_TUCA, "MAC tx unicast frames" },
+ { ENETC_PM0_TMCA, "MAC tx multicast frames" },
+ { ENETC_PM0_TBCA, "MAC tx broadcast frames" },
+--
+2.33.0
+
--- /dev/null
+From 7397244a41a77af5baed39e099d30bc5aad5d9e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Oct 2021 20:33:40 +0300
+Subject: net: enetc: make sure all traffic classes can send large frames
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit e378f4967c8edd64c680f2e279cb646ee06b6f2d ]
+
+The enetc driver does not implement .ndo_change_mtu, instead it
+configures the MAC register field PTC{Traffic Class}MSDUR[MAXSDU]
+statically to a large value during probe time.
+
+The driver used to configure only the max SDU for traffic class 0, and
+that was fine while the driver could only use traffic class 0. But with
+the introduction of mqprio, sending a large frame into any other TC than
+0 is broken.
+
+This patch fixes that by replicating per traffic class the static
+configuration done in enetc_configure_port_mac().
+
+Fixes: cbe9e835946f ("enetc: Enable TC offloading with mqprio")
+Reported-by: Richie Pearn <richard.pearn@nxp.com>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: <Claudiu Manoil <claudiu.manoil@nxp.com>
+Link: https://lore.kernel.org/r/20211020173340.1089992-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc_pf.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+index cf00709caea4..3ac324509f43 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+@@ -517,10 +517,13 @@ static void enetc_port_si_configure(struct enetc_si *si)
+
+ static void enetc_configure_port_mac(struct enetc_hw *hw)
+ {
++ int tc;
++
+ enetc_port_wr(hw, ENETC_PM0_MAXFRM,
+ ENETC_SET_MAXFRM(ENETC_RX_MAXFRM_SIZE));
+
+- enetc_port_wr(hw, ENETC_PTCMSDUR(0), ENETC_MAC_MAXFRM_SIZE);
++ for (tc = 0; tc < 8; tc++)
++ enetc_port_wr(hw, ENETC_PTCMSDUR(tc), ENETC_MAC_MAXFRM_SIZE);
+
+ enetc_port_wr(hw, ENETC_PM0_CMD_CFG, ENETC_PM0_CMD_PHY_TX_EN |
+ ENETC_PM0_CMD_TXP | ENETC_PM0_PROMISC);
+--
+2.33.0
+
--- /dev/null
+From 5a44526c71b418d07cd3c17076b4b99b95c15ae5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Oct 2021 22:16:28 +0800
+Subject: net: hns3: Add configuration of TM QCN error event
+
+From: Jiaran Zhang <zhangjiaran@huawei.com>
+
+[ Upstream commit 60484103d5c387df49bd60de4b16c88022747048 ]
+
+Add configuration of interrupt type and fifo interrupt enable of TM QCN
+error event if enabled, otherwise this event will not be reported when
+there is error.
+
+Fixes: d914971df022 ("net: hns3: remove redundant query in hclge_config_tm_hw_err_int()")
+Signed-off-by: Jiaran Zhang <zhangjiaran@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c | 5 ++++-
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.h | 2 ++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
+index 2eeafd61a07e..c63b440fd654 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
+@@ -995,8 +995,11 @@ static int hclge_config_tm_hw_err_int(struct hclge_dev *hdev, bool en)
+
+ /* configure TM QCN hw errors */
+ hclge_cmd_setup_basic_desc(&desc, HCLGE_TM_QCN_MEM_INT_CFG, false);
+- if (en)
++ desc.data[0] = cpu_to_le32(HCLGE_TM_QCN_ERR_INT_TYPE);
++ if (en) {
++ desc.data[0] |= cpu_to_le32(HCLGE_TM_QCN_FIFO_INT_EN);
+ desc.data[1] = cpu_to_le32(HCLGE_TM_QCN_MEM_ERR_INT_EN);
++ }
+
+ ret = hclge_cmd_send(&hdev->hw, &desc, 1);
+ if (ret)
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.h
+index 07987fb8332e..d811eeefe2c0 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.h
+@@ -50,6 +50,8 @@
+ #define HCLGE_PPP_MPF_ECC_ERR_INT3_EN 0x003F
+ #define HCLGE_PPP_MPF_ECC_ERR_INT3_EN_MASK 0x003F
+ #define HCLGE_TM_SCH_ECC_ERR_INT_EN 0x3
++#define HCLGE_TM_QCN_ERR_INT_TYPE 0x29
++#define HCLGE_TM_QCN_FIFO_INT_EN 0xFFFF00
+ #define HCLGE_TM_QCN_MEM_ERR_INT_EN 0xFFFFFF
+ #define HCLGE_NCSI_ERR_INT_EN 0x3
+ #define HCLGE_NCSI_ERR_INT_TYPE 0x9
+--
+2.33.0
+
--- /dev/null
+From 07eb2f17470851a363d7bcb21e36deb10438fcb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Oct 2021 22:16:30 +0800
+Subject: net: hns3: add limit ets dwrr bandwidth cannot be 0
+
+From: Guangbin Huang <huangguangbin2@huawei.com>
+
+[ Upstream commit 731797fdffa3d083db536e2fdd07ceb050bb40b1 ]
+
+If ets dwrr bandwidth of tc is set to 0, the hardware will switch to SP
+mode. In this case, this tc may occupy all the tx bandwidth if it has
+huge traffic, so it violates the purpose of the user setting.
+
+To fix this problem, limit the ets dwrr bandwidth must greater than 0.
+
+Fixes: cacde272dd00 ("net: hns3: Add hclge_dcb module for the support of DCB feature")
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+index c90bfde2aecf..c60d0626062c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+@@ -133,6 +133,15 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,
+ *changed = true;
+ break;
+ case IEEE_8021QAZ_TSA_ETS:
++ /* The hardware will switch to sp mode if bandwidth is
++ * 0, so limit ets bandwidth must be greater than 0.
++ */
++ if (!ets->tc_tx_bw[i]) {
++ dev_err(&hdev->pdev->dev,
++ "tc%u ets bw cannot be 0\n", i);
++ return -EINVAL;
++ }
++
+ if (hdev->tm_info.tc_info[i].tc_sch_mode !=
+ HCLGE_SCH_MODE_DWRR)
+ *changed = true;
+--
+2.33.0
+
--- /dev/null
+From d3e42561bd9b70f08bd6c7f5a386fc76ff3fc176 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Oct 2021 22:16:35 +0800
+Subject: net: hns3: disable sriov before unload hclge layer
+
+From: Peng Li <lipeng321@huawei.com>
+
+[ Upstream commit 0dd8a25f355b4df2d41c08df1716340854c7d4c5 ]
+
+HNS3 driver includes hns3.ko, hnae3.ko and hclge.ko.
+hns3.ko includes network stack and pci_driver, hclge.ko includes
+HW device action, algo_ops and timer task, hnae3.ko includes some
+register function.
+
+When SRIOV is enable and hclge.ko is removed, HW device is unloaded
+but VF still exists, PF will not reply VF mbx messages, and cause
+errors.
+
+This patch fix it by disable SRIOV before remove hclge.ko.
+
+Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hnae3.c | 21 +++++++++++++++++++
+ drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 +
+ .../hisilicon/hns3/hns3pf/hclge_main.c | 1 +
+ 3 files changed, 23 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+index eef1b2764d34..67b0bf310daa 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+@@ -10,6 +10,27 @@ static LIST_HEAD(hnae3_ae_algo_list);
+ static LIST_HEAD(hnae3_client_list);
+ static LIST_HEAD(hnae3_ae_dev_list);
+
++void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo)
++{
++ const struct pci_device_id *pci_id;
++ struct hnae3_ae_dev *ae_dev;
++
++ if (!ae_algo)
++ return;
++
++ list_for_each_entry(ae_dev, &hnae3_ae_dev_list, node) {
++ if (!hnae3_get_bit(ae_dev->flag, HNAE3_DEV_INITED_B))
++ continue;
++
++ pci_id = pci_match_id(ae_algo->pdev_id_table, ae_dev->pdev);
++ if (!pci_id)
++ continue;
++ if (IS_ENABLED(CONFIG_PCI_IOV))
++ pci_disable_sriov(ae_dev->pdev);
++ }
++}
++EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare);
++
+ /* we are keeping things simple and using single lock for all the
+ * list. This is a non-critical code so other updations, if happen
+ * in parallel, can wait.
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index 32987bd134a1..dc5cce127d8e 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -850,6 +850,7 @@ struct hnae3_handle {
+ int hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev);
+ void hnae3_unregister_ae_dev(struct hnae3_ae_dev *ae_dev);
+
++void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo);
+ void hnae3_unregister_ae_algo(struct hnae3_ae_algo *ae_algo);
+ void hnae3_register_ae_algo(struct hnae3_ae_algo *ae_algo);
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 9920e76b4f41..be46b164b0e2 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -13023,6 +13023,7 @@ static int hclge_init(void)
+
+ static void hclge_exit(void)
+ {
++ hnae3_unregister_ae_algo_prepare(&ae_algo);
+ hnae3_unregister_ae_algo(&ae_algo);
+ destroy_workqueue(hclge_wq);
+ }
+--
+2.33.0
+
--- /dev/null
+From a273b8b3206adb3c9f1c1f394a65f471fb71d9ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Oct 2021 22:16:34 +0800
+Subject: net: hns3: fix vf reset workqueue cannot exit
+
+From: Yufeng Mo <moyufeng@huawei.com>
+
+[ Upstream commit 1385cc81baeb3bd8cbbbcdc1557f038ac1712529 ]
+
+The task of VF reset is performed through the workqueue. It checks the
+value of hdev->reset_pending to determine whether to exit the loop.
+However, the value of hdev->reset_pending may also be assigned by
+the interrupt function hclgevf_misc_irq_handle(), which may cause the
+loop fail to exit and keep occupying the workqueue. This loop is not
+necessary, so remove it and the workqueue will be rescheduled if the
+reset needs to be retried or a new reset occurs.
+
+Fixes: 1cc9bc6e5867 ("net: hns3: split hclgevf_reset() into preparing and rebuilding part")
+Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 22cf66004dfa..b8414f684e89 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -2271,9 +2271,9 @@ static void hclgevf_reset_service_task(struct hclgevf_dev *hdev)
+ hdev->reset_attempts = 0;
+
+ hdev->last_reset_time = jiffies;
+- while ((hdev->reset_type =
+- hclgevf_get_reset_level(hdev, &hdev->reset_pending))
+- != HNAE3_NONE_RESET)
++ hdev->reset_type =
++ hclgevf_get_reset_level(hdev, &hdev->reset_pending);
++ if (hdev->reset_type != HNAE3_NONE_RESET)
+ hclgevf_reset(hdev);
+ } else if (test_and_clear_bit(HCLGEVF_RESET_REQUESTED,
+ &hdev->reset_state)) {
+--
+2.33.0
+
--- /dev/null
+From ebb177489042fda7877b3ece55786cc7c21b09bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Oct 2021 22:16:29 +0800
+Subject: net: hns3: reset DWRR of unused tc to zero
+
+From: Guangbin Huang <huangguangbin2@huawei.com>
+
+[ Upstream commit b63fcaab959807282e9822e659034edf95fc8bd1 ]
+
+Currently, DWRR of tc will be initialized to a fixed value when this tc
+is enabled, but it is not been reset to 0 when this tc is disabled. It
+cause a problem that the DWRR of unused tc is not 0 after using tc tool
+to add and delete multi-tc parameters.
+
+For examples, after enabling 4 TCs and restoring to 1 TC by follow
+tc commands:
+
+$ tc qdisc add dev eth0 root mqprio num_tc 4 map 0 1 2 3 0 1 2 3 queues \
+ 8@0 8@8 8@16 8@24 hw 1 mode channel
+$ tc qdisc del dev eth0 root
+
+Now there is just one TC is enabled for eth0, but the tc info querying by
+debugfs is shown as follow:
+
+$ cat /mnt/hns3/0000:7d:00.0/tm/tc_sch_info
+enabled tc number: 1
+weight_offset: 14
+TC MODE WEIGHT
+0 dwrr 100
+1 dwrr 100
+2 dwrr 100
+3 dwrr 100
+4 dwrr 0
+5 dwrr 0
+6 dwrr 0
+7 dwrr 0
+
+This patch fixes it by resetting DWRR of tc to 0 when tc is disabled.
+
+Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver")
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index f314dbd3ce11..95074e91a846 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -752,6 +752,8 @@ static void hclge_tm_pg_info_init(struct hclge_dev *hdev)
+ hdev->tm_info.pg_info[i].tc_bit_map = hdev->hw_tc_map;
+ for (k = 0; k < hdev->tm_info.num_tc; k++)
+ hdev->tm_info.pg_info[i].tc_dwrr[k] = BW_PERCENT;
++ for (; k < HNAE3_MAX_TC; k++)
++ hdev->tm_info.pg_info[i].tc_dwrr[k] = 0;
+ }
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 86a6f11c268bcff78888384d33c8bf9ec2210e59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Oct 2021 22:16:33 +0800
+Subject: net: hns3: schedule the polling again when allocation fails
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 68752b24f51a71d4f350a764d890b670f59062c5 ]
+
+Currently when there is a rx page allocation failure, it is
+possible that polling may be stopped if there is no more packet
+to be reveiced, which may cause queue stall problem under memory
+pressure.
+
+This patch makes sure polling is scheduled again when there is
+any rx page allocation failure, and polling will try to allocate
+receive buffers until it succeeds.
+
+Now the allocation retry is added, it is unnecessary to do the rx
+page allocation at the end of rx cleaning, so remove it. And reset
+the unused_count to zero after calling hns3_nic_alloc_rx_buffers()
+to avoid calling hns3_nic_alloc_rx_buffers() repeatedly under
+memory pressure.
+
+Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/hisilicon/hns3/hns3_enet.c | 22 ++++++++++---------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 114692c4f797..796886b112c7 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -3488,7 +3488,8 @@ static int hns3_desc_unused(struct hns3_enet_ring *ring)
+ return ((ntc >= ntu) ? 0 : ring->desc_num) + ntc - ntu;
+ }
+
+-static void hns3_nic_alloc_rx_buffers(struct hns3_enet_ring *ring,
++/* Return true if there is any allocation failure */
++static bool hns3_nic_alloc_rx_buffers(struct hns3_enet_ring *ring,
+ int cleand_count)
+ {
+ struct hns3_desc_cb *desc_cb;
+@@ -3513,7 +3514,10 @@ static void hns3_nic_alloc_rx_buffers(struct hns3_enet_ring *ring,
+ hns3_rl_err(ring_to_netdev(ring),
+ "alloc rx buffer failed: %d\n",
+ ret);
+- break;
++
++ writel(i, ring->tqp->io_base +
++ HNS3_RING_RX_RING_HEAD_REG);
++ return true;
+ }
+ hns3_replace_buffer(ring, ring->next_to_use, &res_cbs);
+
+@@ -3526,6 +3530,7 @@ static void hns3_nic_alloc_rx_buffers(struct hns3_enet_ring *ring,
+ }
+
+ writel(i, ring->tqp->io_base + HNS3_RING_RX_RING_HEAD_REG);
++ return false;
+ }
+
+ static bool hns3_can_reuse_page(struct hns3_desc_cb *cb)
+@@ -4159,6 +4164,7 @@ int hns3_clean_rx_ring(struct hns3_enet_ring *ring, int budget,
+ {
+ #define RCB_NOF_ALLOC_RX_BUFF_ONCE 16
+ int unused_count = hns3_desc_unused(ring);
++ bool failure = false;
+ int recv_pkts = 0;
+ int err;
+
+@@ -4167,9 +4173,9 @@ int hns3_clean_rx_ring(struct hns3_enet_ring *ring, int budget,
+ while (recv_pkts < budget) {
+ /* Reuse or realloc buffers */
+ if (unused_count >= RCB_NOF_ALLOC_RX_BUFF_ONCE) {
+- hns3_nic_alloc_rx_buffers(ring, unused_count);
+- unused_count = hns3_desc_unused(ring) -
+- ring->pending_buf;
++ failure = failure ||
++ hns3_nic_alloc_rx_buffers(ring, unused_count);
++ unused_count = 0;
+ }
+
+ /* Poll one pkt */
+@@ -4188,11 +4194,7 @@ int hns3_clean_rx_ring(struct hns3_enet_ring *ring, int budget,
+ }
+
+ out:
+- /* Make all data has been write before submit */
+- if (unused_count > 0)
+- hns3_nic_alloc_rx_buffers(ring, unused_count);
+-
+- return recv_pkts;
++ return failure ? budget : recv_pkts;
+ }
+
+ static void hns3_update_rx_int_coalesce(struct hns3_enet_tqp_vector *tqp_vector)
+--
+2.33.0
+
--- /dev/null
+From 64285acf61e5acabc560d9ec20ce904c4358100e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Oct 2021 15:30:09 +0300
+Subject: net/mlx5e: IPsec: Fix a misuse of the software parser's fields
+
+From: Emeel Hakim <ehakim@nvidia.com>
+
+[ Upstream commit d10457f85d4ae4d32c0df0cd65358a78c577fbe6 ]
+
+IPsec crypto offload current Software Parser (SWP) fields settings in
+the ethernet segment (eseg) are not aligned with PRM/HW expectations.
+Among others in case of IP|ESP|TCP packet, current driver sets the
+offsets for inner_l3 and inner_l4 although there is no inner l3/l4
+headers relative to ESP header in such packets.
+
+SWP provides the offsets for HW ,so it can be used to find csum fields
+to offload the checksum, however these are not necessarily used by HW
+and are used as fallback in case HW fails to parse the packet, e.g
+when performing IPSec Transport Aware (IP | ESP | TCP) there is no
+need to add SW parse on inner packet. So in some cases packets csum
+was calculated correctly , whereas in other cases it failed. The later
+faced csum errors (caused by wrong packet length calculations) which
+led to lots of packet drops hence the low throughput.
+
+Fix by setting the SWP fields as expected in a IP|ESP|TCP packet.
+
+the following describe the expected SWP offsets:
+* Tunnel Mode:
+* SWP: OutL3 InL3 InL4
+* Pkt: MAC IP ESP IP L4
+*
+* Transport Mode:
+* SWP: OutL3 OutL4
+* Pkt: MAC IP ESP L4
+*
+* Tunnel(VXLAN TCP/UDP) over Transport Mode
+* SWP: OutL3 InL3 InL4
+* Pkt: MAC IP ESP UDP VXLAN IP L4
+
+Fixes: f1267798c980 ("net/mlx5: Fix checksum issue of VXLAN and IPsec crypto offload")
+Signed-off-by: Emeel Hakim <ehakim@nvidia.com>
+Reviewed-by: Raed Salem <raeds@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/en_accel/ipsec_rxtx.c | 51 ++++++++++---------
+ 1 file changed, 27 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c
+index 33de8f0092a6..fb5397324aa4 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c
+@@ -141,8 +141,7 @@ static void mlx5e_ipsec_set_swp(struct sk_buff *skb,
+ * Pkt: MAC IP ESP IP L4
+ *
+ * Transport Mode:
+- * SWP: OutL3 InL4
+- * InL3
++ * SWP: OutL3 OutL4
+ * Pkt: MAC IP ESP L4
+ *
+ * Tunnel(VXLAN TCP/UDP) over Transport Mode
+@@ -171,31 +170,35 @@ static void mlx5e_ipsec_set_swp(struct sk_buff *skb,
+ return;
+
+ if (!xo->inner_ipproto) {
+- eseg->swp_inner_l3_offset = skb_network_offset(skb) / 2;
+- eseg->swp_inner_l4_offset = skb_inner_transport_offset(skb) / 2;
+- if (skb->protocol == htons(ETH_P_IPV6))
+- eseg->swp_flags |= MLX5_ETH_WQE_SWP_INNER_L3_IPV6;
+- if (xo->proto == IPPROTO_UDP)
++ switch (xo->proto) {
++ case IPPROTO_UDP:
++ eseg->swp_flags |= MLX5_ETH_WQE_SWP_OUTER_L4_UDP;
++ fallthrough;
++ case IPPROTO_TCP:
++ /* IP | ESP | TCP */
++ eseg->swp_outer_l4_offset = skb_inner_transport_offset(skb) / 2;
++ break;
++ default:
++ break;
++ }
++ } else {
++ /* Tunnel(VXLAN TCP/UDP) over Transport Mode */
++ switch (xo->inner_ipproto) {
++ case IPPROTO_UDP:
+ eseg->swp_flags |= MLX5_ETH_WQE_SWP_INNER_L4_UDP;
+- return;
+- }
+-
+- /* Tunnel(VXLAN TCP/UDP) over Transport Mode */
+- switch (xo->inner_ipproto) {
+- case IPPROTO_UDP:
+- eseg->swp_flags |= MLX5_ETH_WQE_SWP_INNER_L4_UDP;
+- fallthrough;
+- case IPPROTO_TCP:
+- eseg->swp_inner_l3_offset = skb_inner_network_offset(skb) / 2;
+- eseg->swp_inner_l4_offset = (skb->csum_start + skb->head - skb->data) / 2;
+- if (skb->protocol == htons(ETH_P_IPV6))
+- eseg->swp_flags |= MLX5_ETH_WQE_SWP_INNER_L3_IPV6;
+- break;
+- default:
+- break;
++ fallthrough;
++ case IPPROTO_TCP:
++ eseg->swp_inner_l3_offset = skb_inner_network_offset(skb) / 2;
++ eseg->swp_inner_l4_offset =
++ (skb->csum_start + skb->head - skb->data) / 2;
++ if (skb->protocol == htons(ETH_P_IPV6))
++ eseg->swp_flags |= MLX5_ETH_WQE_SWP_INNER_L3_IPV6;
++ break;
++ default:
++ break;
++ }
+ }
+
+- return;
+ }
+
+ void mlx5e_ipsec_set_iv_esn(struct sk_buff *skb, struct xfrm_state *x,
+--
+2.33.0
+
--- /dev/null
+From 2386c3b06336a4339ffec653ef28cf430fa36741 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Oct 2021 15:31:19 +0300
+Subject: net/mlx5e: IPsec: Fix work queue entry ethernet segment checksum
+ flags
+
+From: Emeel Hakim <ehakim@nvidia.com>
+
+[ Upstream commit 1d000323940137332d4d62c6332b6daf5f07aba7 ]
+
+Current Work Queue Entry (WQE) checksum (csum) flags in the ethernet
+segment (eseg) in case of IPsec crypto offload datapath are not aligned
+with PRM/HW expectations.
+
+Currently the driver always sets the l3_inner_csum flag in case of IPsec
+because of the wrong usage of skb->encapsulation as indicator for inner
+IPsec header since skb->encapsulation is always ON for IPsec packets
+since IPsec itself is an encapsulation protocol. The above forced a
+failing attempts of calculating csum of non-existing segments (like in
+the IP|ESP|TCP packet case which does not have an l3_inner) which led
+to lots of packet drops hence the low throughput.
+
+Fix by using xo->inner_ipproto as indicator for inner IPsec header
+instead of skb->encapsulation in addition to setting the csum flags
+as following:
+* Tunnel Mode:
+* Pkt: MAC IP ESP IP L4
+* CSUM: l3_cs | l3_inner_cs | l4_inner_cs
+*
+* Transport Mode:
+* Pkt: MAC IP ESP L4
+* CSUM: l3_cs [ | l4_cs (checksum partial case)]
+*
+* Tunnel(VXLAN TCP/UDP) over Transport Mode
+* Pkt: MAC IP ESP UDP VXLAN IP L4
+* CSUM: l3_cs | l3_inner_cs | l4_inner_cs
+
+Fixes: f1267798c980 ("net/mlx5: Fix checksum issue of VXLAN and IPsec crypto offload")
+Signed-off-by: Emeel Hakim <ehakim@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/en_tx.c | 20 ++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+index c63d78eda606..188994d091c5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+@@ -213,19 +213,18 @@ static inline void mlx5e_insert_vlan(void *start, struct sk_buff *skb, u16 ihs)
+ memcpy(&vhdr->h_vlan_encapsulated_proto, skb->data + cpy1_sz, cpy2_sz);
+ }
+
+-/* If packet is not IP's CHECKSUM_PARTIAL (e.g. icmd packet),
+- * need to set L3 checksum flag for IPsec
+- */
+ static void
+ ipsec_txwqe_build_eseg_csum(struct mlx5e_txqsq *sq, struct sk_buff *skb,
+ struct mlx5_wqe_eth_seg *eseg)
+ {
++ struct xfrm_offload *xo = xfrm_offload(skb);
++
+ eseg->cs_flags = MLX5_ETH_WQE_L3_CSUM;
+- if (skb->encapsulation) {
+- eseg->cs_flags |= MLX5_ETH_WQE_L3_INNER_CSUM;
++ if (xo->inner_ipproto) {
++ eseg->cs_flags |= MLX5_ETH_WQE_L4_INNER_CSUM | MLX5_ETH_WQE_L3_INNER_CSUM;
++ } else if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) {
++ eseg->cs_flags |= MLX5_ETH_WQE_L4_CSUM;
+ sq->stats->csum_partial_inner++;
+- } else {
+- sq->stats->csum_partial++;
+ }
+ }
+
+@@ -234,6 +233,11 @@ mlx5e_txwqe_build_eseg_csum(struct mlx5e_txqsq *sq, struct sk_buff *skb,
+ struct mlx5e_accel_tx_state *accel,
+ struct mlx5_wqe_eth_seg *eseg)
+ {
++ if (unlikely(mlx5e_ipsec_eseg_meta(eseg))) {
++ ipsec_txwqe_build_eseg_csum(sq, skb, eseg);
++ return;
++ }
++
+ if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) {
+ eseg->cs_flags = MLX5_ETH_WQE_L3_CSUM;
+ if (skb->encapsulation) {
+@@ -249,8 +253,6 @@ mlx5e_txwqe_build_eseg_csum(struct mlx5e_txqsq *sq, struct sk_buff *skb,
+ eseg->cs_flags = MLX5_ETH_WQE_L3_CSUM | MLX5_ETH_WQE_L4_CSUM;
+ sq->stats->csum_partial++;
+ #endif
+- } else if (unlikely(mlx5e_ipsec_eseg_meta(eseg))) {
+- ipsec_txwqe_build_eseg_csum(sq, skb, eseg);
+ } else
+ sq->stats->csum_none++;
+ }
+--
+2.33.0
+
--- /dev/null
+From 4879b1078fee6e657075190545a0e11df9484830 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Oct 2021 14:58:51 +0300
+Subject: net/sched: act_ct: Fix byte count on fragmented packets
+
+From: Paul Blakey <paulb@nvidia.com>
+
+[ Upstream commit 2dc4e9e88cfcc38454d52b01ed3422238c134003 ]
+
+First fragmented packets (frag offset = 0) byte len is zeroed
+when stolen by ip_defrag(). And since act_ct update the stats
+only afterwards (at end of execute), bytes aren't correctly
+accounted for such packets.
+
+To fix this, move stats update to start of action execute.
+
+Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct")
+Signed-off-by: Paul Blakey <paulb@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_ct.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
+index 1b4b3514c94f..07f4dce7b535 100644
+--- a/net/sched/act_ct.c
++++ b/net/sched/act_ct.c
+@@ -960,6 +960,7 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
+ tmpl = p->tmpl;
+
+ tcf_lastuse_update(&c->tcf_tm);
++ tcf_action_update_bstats(&c->common, skb);
+
+ if (clear) {
+ qdisc_skb_cb(skb)->post_ct = false;
+@@ -1049,7 +1050,6 @@ out_push:
+
+ qdisc_skb_cb(skb)->post_ct = true;
+ out_clear:
+- tcf_action_update_bstats(&c->common, skb);
+ if (defrag)
+ qdisc_skb_cb(skb)->pkt_len = skb->len;
+ return retval;
+--
+2.33.0
+
--- /dev/null
+From 5ab033b51ef8b08d49b302a05373285484297f52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Oct 2021 09:04:33 +0200
+Subject: net: stmmac: Fix E2E delay mechanism
+
+From: Kurt Kanzenbach <kurt@linutronix.de>
+
+[ Upstream commit 3cb958027cb8b78d3ee639ce9af54c2ef1bf964f ]
+
+When utilizing End to End delay mechanism, the following error messages show up:
+
+|root@ehl1:~# ptp4l --tx_timestamp_timeout=50 -H -i eno2 -E -m
+|ptp4l[950.573]: selected /dev/ptp3 as PTP clock
+|ptp4l[950.586]: port 1: INITIALIZING to LISTENING on INIT_COMPLETE
+|ptp4l[950.586]: port 0: INITIALIZING to LISTENING on INIT_COMPLETE
+|ptp4l[952.879]: port 1: new foreign master 001395.fffe.4897b4-1
+|ptp4l[956.879]: selected best master clock 001395.fffe.4897b4
+|ptp4l[956.879]: port 1: assuming the grand master role
+|ptp4l[956.879]: port 1: LISTENING to GRAND_MASTER on RS_GRAND_MASTER
+|ptp4l[962.017]: port 1: received DELAY_REQ without timestamp
+|ptp4l[962.273]: port 1: received DELAY_REQ without timestamp
+|ptp4l[963.090]: port 1: received DELAY_REQ without timestamp
+
+Commit f2fb6b6275eb ("net: stmmac: enable timestamp snapshot for required PTP
+packets in dwmac v5.10a") already addresses this problem for the dwmac
+v5.10. However, same holds true for all dwmacs above version v4.10. Correct the
+check accordingly. Afterwards everything works as expected.
+
+Tested on Intel Atom(R) x6414RE Processor.
+
+Fixes: 14f347334bf2 ("net: stmmac: Correctly take timestamp for PTPv2")
+Fixes: f2fb6b6275eb ("net: stmmac: enable timestamp snapshot for required PTP packets in dwmac v5.10a")
+Suggested-by: Ong Boon Leong <boon.leong.ong@intel.com>
+Signed-off-by: Kurt Kanzenbach <kurt@linutronix.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 6b2a5e5769e8..14e577787415 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -736,7 +736,7 @@ static int stmmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr)
+ config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+ ptp_v2 = PTP_TCR_TSVER2ENA;
+ snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+- if (priv->synopsys_id != DWMAC_CORE_5_10)
++ if (priv->synopsys_id < DWMAC_CORE_4_10)
+ ts_event_en = PTP_TCR_TSEVNTENA;
+ ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+ ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+--
+2.33.0
+
--- /dev/null
+From 76c9e9060a90a091b620a6df566408aa46c5cbe7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Oct 2021 08:18:13 -0400
+Subject: netfilter: ip6t_rt: fix rt0_hdr parsing in rt_mt6
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit a482c5e00a9b5a194085bcd372ac36141028becb ]
+
+In rt_mt6(), when it's a nonlinear skb, the 1st skb_header_pointer()
+only copies sizeof(struct ipv6_rt_hdr) to _route that rh points to.
+The access by ((const struct rt0_hdr *)rh)->reserved will overflow
+the buffer. So this access should be moved below the 2nd call to
+skb_header_pointer().
+
+Besides, after the 2nd skb_header_pointer(), its return value should
+also be checked, othersize, *rp may cause null-pointer-ref.
+
+v1->v2:
+ - clean up some old debugging log.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/netfilter/ip6t_rt.c | 48 +++++-------------------------------
+ 1 file changed, 6 insertions(+), 42 deletions(-)
+
+diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
+index 733c83d38b30..4ad8b2032f1f 100644
+--- a/net/ipv6/netfilter/ip6t_rt.c
++++ b/net/ipv6/netfilter/ip6t_rt.c
+@@ -25,12 +25,7 @@ MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
+ static inline bool
+ segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)
+ {
+- bool r;
+- pr_debug("segsleft_match:%c 0x%x <= 0x%x <= 0x%x\n",
+- invert ? '!' : ' ', min, id, max);
+- r = (id >= min && id <= max) ^ invert;
+- pr_debug(" result %s\n", r ? "PASS" : "FAILED");
+- return r;
++ return (id >= min && id <= max) ^ invert;
+ }
+
+ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
+@@ -65,30 +60,6 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
+ return false;
+ }
+
+- pr_debug("IPv6 RT LEN %u %u ", hdrlen, rh->hdrlen);
+- pr_debug("TYPE %04X ", rh->type);
+- pr_debug("SGS_LEFT %u %02X\n", rh->segments_left, rh->segments_left);
+-
+- pr_debug("IPv6 RT segsleft %02X ",
+- segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
+- rh->segments_left,
+- !!(rtinfo->invflags & IP6T_RT_INV_SGS)));
+- pr_debug("type %02X %02X %02X ",
+- rtinfo->rt_type, rh->type,
+- (!(rtinfo->flags & IP6T_RT_TYP) ||
+- ((rtinfo->rt_type == rh->type) ^
+- !!(rtinfo->invflags & IP6T_RT_INV_TYP))));
+- pr_debug("len %02X %04X %02X ",
+- rtinfo->hdrlen, hdrlen,
+- !(rtinfo->flags & IP6T_RT_LEN) ||
+- ((rtinfo->hdrlen == hdrlen) ^
+- !!(rtinfo->invflags & IP6T_RT_INV_LEN)));
+- pr_debug("res %02X %02X %02X ",
+- rtinfo->flags & IP6T_RT_RES,
+- ((const struct rt0_hdr *)rh)->reserved,
+- !((rtinfo->flags & IP6T_RT_RES) &&
+- (((const struct rt0_hdr *)rh)->reserved)));
+-
+ ret = (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
+ rh->segments_left,
+ !!(rtinfo->invflags & IP6T_RT_INV_SGS))) &&
+@@ -107,22 +78,22 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
+ reserved),
+ sizeof(_reserved),
+ &_reserved);
++ if (!rp) {
++ par->hotdrop = true;
++ return false;
++ }
+
+ ret = (*rp == 0);
+ }
+
+- pr_debug("#%d ", rtinfo->addrnr);
+ if (!(rtinfo->flags & IP6T_RT_FST)) {
+ return ret;
+ } else if (rtinfo->flags & IP6T_RT_FST_NSTRICT) {
+- pr_debug("Not strict ");
+ if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
+- pr_debug("There isn't enough space\n");
+ return false;
+ } else {
+ unsigned int i = 0;
+
+- pr_debug("#%d ", rtinfo->addrnr);
+ for (temp = 0;
+ temp < (unsigned int)((hdrlen - 8) / 16);
+ temp++) {
+@@ -138,26 +109,20 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
+ return false;
+ }
+
+- if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
+- pr_debug("i=%d temp=%d;\n", i, temp);
++ if (ipv6_addr_equal(ap, &rtinfo->addrs[i]))
+ i++;
+- }
+ if (i == rtinfo->addrnr)
+ break;
+ }
+- pr_debug("i=%d #%d\n", i, rtinfo->addrnr);
+ if (i == rtinfo->addrnr)
+ return ret;
+ else
+ return false;
+ }
+ } else {
+- pr_debug("Strict ");
+ if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
+- pr_debug("There isn't enough space\n");
+ return false;
+ } else {
+- pr_debug("#%d ", rtinfo->addrnr);
+ for (temp = 0; temp < rtinfo->addrnr; temp++) {
+ ap = skb_header_pointer(skb,
+ ptr
+@@ -173,7 +138,6 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
+ if (!ipv6_addr_equal(ap, &rtinfo->addrs[temp]))
+ break;
+ }
+- pr_debug("temp=%d #%d\n", temp, rtinfo->addrnr);
+ if (temp == rtinfo->addrnr &&
+ temp == (unsigned int)((hdrlen - 8) / 16))
+ return ret;
+--
+2.33.0
+
--- /dev/null
+From 62595ef7d87c666c5bbac6e79a58ef83a7e1ffee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Oct 2021 16:54:37 +0200
+Subject: netfilter: ipvs: make global sysctl readonly in non-init netns
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit 174c376278949c44aad89c514a6b5db6cee8db59 ]
+
+Because the data pointer of net/ipv4/vs/debug_level is not updated per
+netns, it must be marked as read-only in non-init netns.
+
+Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_ctl.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index c25097092a06..29ec3ef63edc 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -4090,6 +4090,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
+ tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
+ tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
+ tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
++#ifdef CONFIG_IP_VS_DEBUG
++ /* Global sysctls must be ro in non-init netns */
++ if (!net_eq(net, &init_net))
++ tbl[idx++].mode = 0444;
++#endif
+
+ ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
+ if (ipvs->sysctl_hdr == NULL) {
+--
+2.33.0
+
--- /dev/null
+From 551246a4109d10da52aaece2866a028e0cd1da24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Oct 2021 16:20:34 +0200
+Subject: netfilter: nf_tables: skip netdev events generated on netns removal
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 68a3765c659f809dcaac20030853a054646eb739 ]
+
+syzbot reported following (harmless) WARN:
+
+ WARNING: CPU: 1 PID: 2648 at net/netfilter/core.c:468
+ nft_netdev_unregister_hooks net/netfilter/nf_tables_api.c:230 [inline]
+ nf_tables_unregister_hook include/net/netfilter/nf_tables.h:1090 [inline]
+ __nft_release_basechain+0x138/0x640 net/netfilter/nf_tables_api.c:9524
+ nft_netdev_event net/netfilter/nft_chain_filter.c:351 [inline]
+ nf_tables_netdev_event+0x521/0x8a0 net/netfilter/nft_chain_filter.c:382
+
+reproducer:
+unshare -n bash -c 'ip link add br0 type bridge; nft add table netdev t ; \
+ nft add chain netdev t ingress \{ type filter hook ingress device "br0" \
+ priority 0\; policy drop\; \}'
+
+Problem is that when netns device exit hooks create the UNREGISTER
+event, the .pre_exit hook for nf_tables core has already removed the
+base hook. Notifier attempts to do this again.
+
+The need to do base hook unregister unconditionally was needed in the past,
+because notifier was last stage where reg->dev dereference was safe.
+
+Now that nf_tables does the hook removal in .pre_exit, this isn't
+needed anymore.
+
+Reported-and-tested-by: syzbot+154bd5be532a63aa778b@syzkaller.appspotmail.com
+Fixes: 767d1216bff825 ("netfilter: nftables: fix possible UAF over chains from packet path in netns")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_chain_filter.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c
+index 5b02408a920b..3ced0eb6b7c3 100644
+--- a/net/netfilter/nft_chain_filter.c
++++ b/net/netfilter/nft_chain_filter.c
+@@ -342,12 +342,6 @@ static void nft_netdev_event(unsigned long event, struct net_device *dev,
+ return;
+ }
+
+- /* UNREGISTER events are also happening on netns exit.
+- *
+- * Although nf_tables core releases all tables/chains, only this event
+- * handler provides guarantee that hook->ops.dev is still accessible,
+- * so we cannot skip exiting net namespaces.
+- */
+ __nft_release_basechain(ctx);
+ }
+
+@@ -366,6 +360,9 @@ static int nf_tables_netdev_event(struct notifier_block *this,
+ event != NETDEV_CHANGENAME)
+ return NOTIFY_DONE;
+
++ if (!check_net(ctx.net))
++ return NOTIFY_DONE;
++
+ nft_net = nft_pernet(ctx.net);
+ mutex_lock(&nft_net->commit_mutex);
+ list_for_each_entry(table, &nft_net->tables, list) {
+--
+2.33.0
+
--- /dev/null
+From 7e7761c3bd2582e860bb7398a39cf5e12f49d35f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Oct 2021 21:14:38 +0900
+Subject: netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has
+ garbage value
+
+From: Juhee Kang <claudiajkang@gmail.com>
+
+[ Upstream commit 902c0b1887522a099aa4e1e6b4b476c2fe5dd13e ]
+
+Currently, when the rule related to IDLETIMER is added, idletimer_tg timer
+structure is initialized by kmalloc on executing idletimer_tg_create
+function. However, in this process timer->timer_type is not defined to
+a specific value. Thus, timer->timer_type has garbage value and it occurs
+kernel panic. So, this commit fixes the panic by initializing
+timer->timer_type using kzalloc instead of kmalloc.
+
+Test commands:
+ # iptables -A OUTPUT -j IDLETIMER --timeout 1 --label test
+ $ cat /sys/class/xt_idletimer/timers/test
+ Killed
+
+Splat looks like:
+ BUG: KASAN: user-memory-access in alarm_expires_remaining+0x49/0x70
+ Read of size 8 at addr 0000002e8c7bc4c8 by task cat/917
+ CPU: 12 PID: 917 Comm: cat Not tainted 5.14.0+ #3 79940a339f71eb14fc81aee1757a20d5bf13eb0e
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014
+ Call Trace:
+ dump_stack_lvl+0x6e/0x9c
+ kasan_report.cold+0x112/0x117
+ ? alarm_expires_remaining+0x49/0x70
+ __asan_load8+0x86/0xb0
+ alarm_expires_remaining+0x49/0x70
+ idletimer_tg_show+0xe5/0x19b [xt_IDLETIMER 11219304af9316a21bee5ba9d58f76a6b9bccc6d]
+ dev_attr_show+0x3c/0x60
+ sysfs_kf_seq_show+0x11d/0x1f0
+ ? device_remove_bin_file+0x20/0x20
+ kernfs_seq_show+0xa4/0xb0
+ seq_read_iter+0x29c/0x750
+ kernfs_fop_read_iter+0x25a/0x2c0
+ ? __fsnotify_parent+0x3d1/0x570
+ ? iov_iter_init+0x70/0x90
+ new_sync_read+0x2a7/0x3d0
+ ? __x64_sys_llseek+0x230/0x230
+ ? rw_verify_area+0x81/0x150
+ vfs_read+0x17b/0x240
+ ksys_read+0xd9/0x180
+ ? vfs_write+0x460/0x460
+ ? do_syscall_64+0x16/0xc0
+ ? lockdep_hardirqs_on+0x79/0x120
+ __x64_sys_read+0x43/0x50
+ do_syscall_64+0x3b/0xc0
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+ RIP: 0033:0x7f0cdc819142
+ Code: c0 e9 c2 fe ff ff 50 48 8d 3d 3a ca 0a 00 e8 f5 19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24
+ RSP: 002b:00007fff28eee5b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
+ RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f0cdc819142
+ RDX: 0000000000020000 RSI: 00007f0cdc032000 RDI: 0000000000000003
+ RBP: 00007f0cdc032000 R08: 00007f0cdc031010 R09: 0000000000000000
+ R10: 0000000000000022 R11: 0000000000000246 R12: 00005607e9ee31f0
+ R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
+
+Fixes: 68983a354a65 ("netfilter: xtables: Add snapshot of hardidletimer target")
+Signed-off-by: Juhee Kang <claudiajkang@gmail.com>
+Reviewed-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/xt_IDLETIMER.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
+index 7b2f359bfce4..2f7cf5ecebf4 100644
+--- a/net/netfilter/xt_IDLETIMER.c
++++ b/net/netfilter/xt_IDLETIMER.c
+@@ -137,7 +137,7 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
+ {
+ int ret;
+
+- info->timer = kmalloc(sizeof(*info->timer), GFP_KERNEL);
++ info->timer = kzalloc(sizeof(*info->timer), GFP_KERNEL);
+ if (!info->timer) {
+ ret = -ENOMEM;
+ goto out;
+--
+2.33.0
+
--- /dev/null
+From a2aaba9b6382deae969332d4b4dcf8df5bb10c90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Oct 2021 00:56:06 -0700
+Subject: NIOS2: irqflags: rename a redefined register name
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 4cce60f15c04d69eff6ffc539ab09137dbe15070 ]
+
+Both arch/nios2/ and drivers/mmc/host/tmio_mmc.c define a macro
+with the name "CTL_STATUS". Change the one in arch/nios2/ to be
+"CTL_FSTATUS" (flags status) to eliminate the build warning.
+
+In file included from ../drivers/mmc/host/tmio_mmc.c:22:
+drivers/mmc/host/tmio_mmc.h:31: warning: "CTL_STATUS" redefined
+ 31 | #define CTL_STATUS 0x1c
+arch/nios2/include/asm/registers.h:14: note: this is the location of the previous definition
+ 14 | #define CTL_STATUS 0
+
+Fixes: b31ebd8055ea ("nios2: Nios2 registers")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/nios2/include/asm/irqflags.h | 4 ++--
+ arch/nios2/include/asm/registers.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/nios2/include/asm/irqflags.h b/arch/nios2/include/asm/irqflags.h
+index b3ec3e510706..25acf27862f9 100644
+--- a/arch/nios2/include/asm/irqflags.h
++++ b/arch/nios2/include/asm/irqflags.h
+@@ -9,7 +9,7 @@
+
+ static inline unsigned long arch_local_save_flags(void)
+ {
+- return RDCTL(CTL_STATUS);
++ return RDCTL(CTL_FSTATUS);
+ }
+
+ /*
+@@ -18,7 +18,7 @@ static inline unsigned long arch_local_save_flags(void)
+ */
+ static inline void arch_local_irq_restore(unsigned long flags)
+ {
+- WRCTL(CTL_STATUS, flags);
++ WRCTL(CTL_FSTATUS, flags);
+ }
+
+ static inline void arch_local_irq_disable(void)
+diff --git a/arch/nios2/include/asm/registers.h b/arch/nios2/include/asm/registers.h
+index 183c720e454d..95b67dd16f81 100644
+--- a/arch/nios2/include/asm/registers.h
++++ b/arch/nios2/include/asm/registers.h
+@@ -11,7 +11,7 @@
+ #endif
+
+ /* control register numbers */
+-#define CTL_STATUS 0
++#define CTL_FSTATUS 0
+ #define CTL_ESTATUS 1
+ #define CTL_BSTATUS 2
+ #define CTL_IENABLE 3
+--
+2.33.0
+
--- /dev/null
+From 09e42608bbaa971b5b4f006adfacbcff132ab3b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Oct 2021 12:39:02 -0500
+Subject: powerpc/smp: do not decrement idle task preempt count in CPU offline
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit 787252a10d9422f3058df9a4821f389e5326c440 ]
+
+With PREEMPT_COUNT=y, when a CPU is offlined and then onlined again, we
+get:
+
+BUG: scheduling while atomic: swapper/1/0/0x00000000
+no locks held by swapper/1/0.
+CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.0-rc2+ #100
+Call Trace:
+ dump_stack_lvl+0xac/0x108
+ __schedule_bug+0xac/0xe0
+ __schedule+0xcf8/0x10d0
+ schedule_idle+0x3c/0x70
+ do_idle+0x2d8/0x4a0
+ cpu_startup_entry+0x38/0x40
+ start_secondary+0x2ec/0x3a0
+ start_secondary_prolog+0x10/0x14
+
+This is because powerpc's arch_cpu_idle_dead() decrements the idle task's
+preempt count, for reasons explained in commit a7c2bb8279d2 ("powerpc:
+Re-enable preemption before cpu_die()"), specifically "start_secondary()
+expects a preempt_count() of 0."
+
+However, since commit 2c669ef6979c ("powerpc/preempt: Don't touch the idle
+task's preempt_count during hotplug") and commit f1a0a376ca0c ("sched/core:
+Initialize the idle task with preemption disabled"), that justification no
+longer holds.
+
+The idle task isn't supposed to re-enable preemption, so remove the
+vestigial preempt_enable() from the CPU offline path.
+
+Tested with pseries and powernv in qemu, and pseries on PowerVM.
+
+Fixes: 2c669ef6979c ("powerpc/preempt: Don't touch the idle task's preempt_count during hotplug")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
+Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20211015173902.2278118-1-nathanl@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/smp.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index 12c75b95646a..3c5eb9dc101b 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -1703,8 +1703,6 @@ void __cpu_die(unsigned int cpu)
+
+ void arch_cpu_idle_dead(void)
+ {
+- sched_preempt_enable_no_resched();
+-
+ /*
+ * Disable on the down path. This will be re-enabled by
+ * start_secondary() via start_secondary_resume() below
+--
+2.33.0
+
--- /dev/null
+From c3ac08abd1e1af506091b1ef073b95726c4e140a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Oct 2021 16:18:34 +0800
+Subject: ptp: Fix possible memory leak in ptp_clock_register()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 4225fea1cb28370086e17e82c0f69bec2779dca0 ]
+
+I got memory leak as follows when doing fault injection test:
+
+unreferenced object 0xffff88800906c618 (size 8):
+ comm "i2c-idt82p33931", pid 4421, jiffies 4294948083 (age 13.188s)
+ hex dump (first 8 bytes):
+ 70 74 70 30 00 00 00 00 ptp0....
+ backtrace:
+ [<00000000312ed458>] __kmalloc_track_caller+0x19f/0x3a0
+ [<0000000079f6e2ff>] kvasprintf+0xb5/0x150
+ [<0000000026aae54f>] kvasprintf_const+0x60/0x190
+ [<00000000f323a5f7>] kobject_set_name_vargs+0x56/0x150
+ [<000000004e35abdd>] dev_set_name+0xc0/0x100
+ [<00000000f20cfe25>] ptp_clock_register+0x9f4/0xd30 [ptp]
+ [<000000008bb9f0de>] idt82p33_probe.cold+0x8b6/0x1561 [ptp_idt82p33]
+
+When posix_clock_register() returns an error, the name allocated
+in dev_set_name() will be leaked, the put_device() should be used
+to give up the device reference, then the name will be freed in
+kobject_cleanup() and other memory will be freed in ptp_clock_release().
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: a33121e5487b ("ptp: fix the race between the release of ptp_clock and cdev")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_clock.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
+index 4dfc52e06704..7fd02aabd79a 100644
+--- a/drivers/ptp/ptp_clock.c
++++ b/drivers/ptp/ptp_clock.c
+@@ -283,15 +283,22 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
+ /* Create a posix clock and link it to the device. */
+ err = posix_clock_register(&ptp->clock, &ptp->dev);
+ if (err) {
++ if (ptp->pps_source)
++ pps_unregister_source(ptp->pps_source);
++
++ kfree(ptp->vclock_index);
++
++ if (ptp->kworker)
++ kthread_destroy_worker(ptp->kworker);
++
++ put_device(&ptp->dev);
++
+ pr_err("failed to create posix clock\n");
+- goto no_clock;
++ return ERR_PTR(err);
+ }
+
+ return ptp;
+
+-no_clock:
+- if (ptp->pps_source)
+- pps_unregister_source(ptp->pps_source);
+ no_pps:
+ ptp_cleanup_pin_groups(ptp);
+ no_pin_groups:
+--
+2.33.0
+
--- /dev/null
+From 0fc7c3efcbe6a2ee6b645d806434eec3841cf18b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Oct 2021 00:50:55 -0400
+Subject: sctp: fix transport encap_port update in sctp_vtag_verify
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 075718fdaf0efe20223571236c1bf14ca35a7aa1 ]
+
+transport encap_port update should be updated when sctp_vtag_verify()
+succeeds, namely, returns 1, not returns 0. Correct it in this patch.
+
+While at it, also fix the indentation.
+
+Fixes: a1dd2cf2f1ae ("sctp: allow changing transport encap_port by peer packets")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sctp/sm.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
+index 2eb6d7c2c931..f37c7a558d6d 100644
+--- a/include/net/sctp/sm.h
++++ b/include/net/sctp/sm.h
+@@ -384,11 +384,11 @@ sctp_vtag_verify(const struct sctp_chunk *chunk,
+ * Verification Tag value does not match the receiver's own
+ * tag value, the receiver shall silently discard the packet...
+ */
+- if (ntohl(chunk->sctp_hdr->vtag) == asoc->c.my_vtag)
+- return 1;
++ if (ntohl(chunk->sctp_hdr->vtag) != asoc->c.my_vtag)
++ return 0;
+
+ chunk->transport->encap_port = SCTP_INPUT_CB(chunk->skb)->encap_port;
+- return 0;
++ return 1;
+ }
+
+ /* Check VTAG of the packet matches the sender's own tag and the T bit is
+--
+2.33.0
+
powerpc-bpf-validate-branch-ranges.patch
powerpc-security-add-a-helper-to-query-stf_barrier-t.patch
powerpc-bpf-emit-stf-barrier-instruction-sequences-f.patch
+asoc-pcm512x-mend-accesses-to-the-i2s_1-and-i2s_2-re.patch
+asoc-fsl_xcvr-fix-channel-swap-issue-with-arc.patch
+asoc-pcm179x-add-missing-entries-spi-to-device-id-ta.patch
+asoc-cs4341-add-spi-device-id-table.patch
+kvm-arm64-fix-host-stage-2-pgd-refcount.patch
+kvm-arm64-release-mmap_lock-when-using-vm_shared-wit.patch
+netfilter-xt_idletimer-fix-panic-that-occurs-when-ti.patch
+netfilter-nf_tables-skip-netdev-events-generated-on-.patch
+dma-debug-fix-sg-checks-in-debug_dma_map_sg.patch
+asoc-wm8960-fix-clock-configuration-on-slave-mode.patch
+ice-fix-failure-to-re-add-lan-rdma-tx-queues.patch
+ice-avoid-crash-from-unnecessary-ida-free.patch
+ice-fix-getting-udp-tunnel-entry.patch
+ice-print-the-api_patch-as-part-of-the-fw.mgmt.api.patch
+netfilter-ip6t_rt-fix-rt0_hdr-parsing-in-rt_mt6.patch
+netfilter-ipvs-make-global-sysctl-readonly-in-non-in.patch
+sctp-fix-transport-encap_port-update-in-sctp_vtag_ve.patch
+lan78xx-select-crc32.patch
+tcp-md5-fix-overlap-between-vrf-and-non-vrf-keys.patch
+ipv6-when-forwarding-count-rx-stats-on-the-orig-netd.patch
+hamradio-baycom_epp-fix-build-for-uml.patch
+net-dsa-lantiq_gswip-fix-register-definition.patch
+net-sched-act_ct-fix-byte-count-on-fragmented-packet.patch
+nios2-irqflags-rename-a-redefined-register-name.patch
+net-dsa-fix-an-error-handling-path-in-dsa_switch_par.patch
+powerpc-smp-do-not-decrement-idle-task-preempt-count.patch
+net-hns3-add-configuration-of-tm-qcn-error-event.patch
+net-hns3-reset-dwrr-of-unused-tc-to-zero.patch
+net-hns3-add-limit-ets-dwrr-bandwidth-cannot-be-0.patch
+net-hns3-schedule-the-polling-again-when-allocation-.patch
+net-hns3-fix-vf-reset-workqueue-cannot-exit.patch
+net-hns3-disable-sriov-before-unload-hclge-layer.patch
+net-stmmac-fix-e2e-delay-mechanism.patch
+ptp-fix-possible-memory-leak-in-ptp_clock_register.patch
+e1000e-fix-packet-loss-on-tiger-lake-and-later.patch
+igc-update-i226_k-device-id.patch
+ice-add-missing-e810-device-ids.patch
+net-mlx5e-ipsec-fix-a-misuse-of-the-software-parser-.patch
+net-mlx5e-ipsec-fix-work-queue-entry-ethernet-segmen.patch
+drm-panel-ilitek-ili9881c-fix-sync-for-feixin-k101-i.patch
+drm-kmb-work-around-for-higher-system-clock.patch
+drm-kmb-remove-clearing-dphy-regs.patch
+drm-kmb-disable-change-of-plane-parameters.patch
+drm-kmb-corrected-typo-in-handle_lcd_irq.patch
+drm-kmb-enable-adv-bridge-after-modeset.patch
+net-enetc-fix-ethtool-counter-name-for-pm0_terr.patch
+net-enetc-make-sure-all-traffic-classes-can-send-lar.patch
--- /dev/null
+From 861baf893aaeba9d9cf8cdff338059a563b711fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Oct 2021 10:26:04 +0300
+Subject: tcp: md5: Fix overlap between vrf and non-vrf keys
+
+From: Leonard Crestez <cdleonard@gmail.com>
+
+[ Upstream commit 86f1e3a8489f6a0232c1f3bc2bdb379f5ccdecec ]
+
+With net.ipv4.tcp_l3mdev_accept=1 it is possible for a listen socket to
+accept connection from the same client address in different VRFs. It is
+also possible to set different MD5 keys for these clients which differ
+only in the tcpm_l3index field.
+
+This appears to work when distinguishing between different VRFs but not
+between non-VRF and VRF connections. In particular:
+
+ * tcp_md5_do_lookup_exact will match a non-vrf key against a vrf key.
+This means that adding a key with l3index != 0 after a key with l3index
+== 0 will cause the earlier key to be deleted. Both keys can be present
+if the non-vrf key is added later.
+ * _tcp_md5_do_lookup can match a non-vrf key before a vrf key. This
+casues failures if the passwords differ.
+
+Fix this by making tcp_md5_do_lookup_exact perform an actual exact
+comparison on l3index and by making __tcp_md5_do_lookup perfer
+vrf-bound keys above other considerations like prefixlen.
+
+Fixes: dea53bb80e07 ("tcp: Add l3index to tcp_md5sig_key and md5 functions")
+Signed-off-by: Leonard Crestez <cdleonard@gmail.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_ipv4.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index db07c05736b2..609d7048d04d 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1037,6 +1037,20 @@ static void tcp_v4_reqsk_destructor(struct request_sock *req)
+ DEFINE_STATIC_KEY_FALSE(tcp_md5_needed);
+ EXPORT_SYMBOL(tcp_md5_needed);
+
++static bool better_md5_match(struct tcp_md5sig_key *old, struct tcp_md5sig_key *new)
++{
++ if (!old)
++ return true;
++
++ /* l3index always overrides non-l3index */
++ if (old->l3index && new->l3index == 0)
++ return false;
++ if (old->l3index == 0 && new->l3index)
++ return true;
++
++ return old->prefixlen < new->prefixlen;
++}
++
+ /* Find the Key structure for an address. */
+ struct tcp_md5sig_key *__tcp_md5_do_lookup(const struct sock *sk, int l3index,
+ const union tcp_md5_addr *addr,
+@@ -1074,8 +1088,7 @@ struct tcp_md5sig_key *__tcp_md5_do_lookup(const struct sock *sk, int l3index,
+ match = false;
+ }
+
+- if (match && (!best_match ||
+- key->prefixlen > best_match->prefixlen))
++ if (match && better_md5_match(best_match, key))
+ best_match = key;
+ }
+ return best_match;
+@@ -1105,7 +1118,7 @@ static struct tcp_md5sig_key *tcp_md5_do_lookup_exact(const struct sock *sk,
+ lockdep_sock_is_held(sk)) {
+ if (key->family != family)
+ continue;
+- if (key->l3index && key->l3index != l3index)
++ if (key->l3index != l3index)
+ continue;
+ if (!memcmp(&key->addr, addr, size) &&
+ key->prefixlen == prefixlen)
+--
+2.33.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
