--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 19 Dec 2020 14:01:44 +0300
+Subject: atm: idt77252: call pci_disable_device() on error path
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8df66af5c1e5f80562fe728db5ec069b21810144 ]
+
+This error path needs to disable the pci device before returning.
+
+Fixes: ede58ef28e10 ("atm: remove deprecated use of pci api")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X93dmC4NX0vbTpGp@mwanda
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/atm/idt77252.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/atm/idt77252.c
++++ b/drivers/atm/idt77252.c
+@@ -3607,7 +3607,7 @@ static int idt77252_init_one(struct pci_
+
+ if ((err = dma_set_mask_and_coherent(&pcidev->dev, DMA_BIT_MASK(32)))) {
+ printk("idt77252: can't enable DMA for PCI device at %s\n", pci_name(pcidev));
+- return err;
++ goto err_out_disable_pdev;
+ }
+
+ card = kzalloc(sizeof(struct idt77252_dev), GFP_KERNEL);
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Mon, 28 Dec 2020 15:21:46 +0000
+Subject: bareudp: Fix use of incorrect min_headroom size
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit 10ad3e998fa0c25315f27cf3002ff8b02dc31c38 ]
+
+In the bareudp6_xmit_skb(), it calculates min_headroom.
+At that point, it uses struct iphdr, but it's not correct.
+So panic could occur.
+The struct ipv6hdr should be used.
+
+Test commands:
+ ip netns add A
+ ip netns add B
+ ip link add veth0 netns A type veth peer name veth1 netns B
+ ip netns exec A ip link set veth0 up
+ ip netns exec A ip a a 2001:db8:0::1/64 dev veth0
+ ip netns exec B ip link set veth1 up
+ ip netns exec B ip a a 2001:db8:0::2/64 dev veth1
+
+ for i in {10..1}
+ do
+ let A=$i-1
+ ip netns exec A ip link add bareudp$i type bareudp dstport $i \
+ ethertype 0x86dd
+ ip netns exec A ip link set bareudp$i up
+ ip netns exec A ip -6 a a 2001:db8:$i::1/64 dev bareudp$i
+ ip netns exec A ip -6 r a 2001:db8:$i::2 encap ip6 src \
+ 2001:db8:$A::1 dst 2001:db8:$A::2 via 2001:db8:$i::2 \
+ dev bareudp$i
+
+ ip netns exec B ip link add bareudp$i type bareudp dstport $i \
+ ethertype 0x86dd
+ ip netns exec B ip link set bareudp$i up
+ ip netns exec B ip -6 a a 2001:db8:$i::2/64 dev bareudp$i
+ ip netns exec B ip -6 r a 2001:db8:$i::1 encap ip6 src \
+ 2001:db8:$A::2 dst 2001:db8:$A::1 via 2001:db8:$i::1 \
+ dev bareudp$i
+ done
+ ip netns exec A ping 2001:db8:7::2
+
+Splat looks like:
+[ 66.436679][ C2] skbuff: skb_under_panic: text:ffffffff928614c8 len:454 put:14 head:ffff88810abb4000 data:ffff88810abb3ffa tail:0x1c0 end:0x3ec0 dev:veth0
+[ 66.441626][ C2] ------------[ cut here ]------------
+[ 66.443458][ C2] kernel BUG at net/core/skbuff.c:109!
+[ 66.445313][ C2] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
+[ 66.447606][ C2] CPU: 2 PID: 913 Comm: ping Not tainted 5.10.0+ #819
+[ 66.450251][ C2] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+[ 66.453713][ C2] RIP: 0010:skb_panic+0x15d/0x15f
+[ 66.455345][ C2] Code: 98 fe 4c 8b 4c 24 10 53 8b 4d 70 45 89 e0 48 c7 c7 60 8b 78 93 41 57 41 56 41 55 48 8b 54 24 20 48 8b 74 24 28 e8 b5 40 f9 ff <0f> 0b 48 8b 6c 24 20 89 34 24 e8 08 c9 98 fe 8b 34 24 48 c7 c1 80
+[ 66.462314][ C2] RSP: 0018:ffff888119209648 EFLAGS: 00010286
+[ 66.464281][ C2] RAX: 0000000000000089 RBX: ffff888003159000 RCX: 0000000000000000
+[ 66.467216][ C2] RDX: 0000000000000089 RSI: 0000000000000008 RDI: ffffed10232412c0
+[ 66.469768][ C2] RBP: ffff88810a53d440 R08: ffffed102328018d R09: ffffed102328018d
+[ 66.472297][ C2] R10: ffff888119400c67 R11: ffffed102328018c R12: 000000000000000e
+[ 66.474833][ C2] R13: ffff88810abb3ffa R14: 00000000000001c0 R15: 0000000000003ec0
+[ 66.477361][ C2] FS: 00007f37c0c72f00(0000) GS:ffff888119200000(0000) knlGS:0000000000000000
+[ 66.480214][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 66.482296][ C2] CR2: 000055a058808570 CR3: 000000011039e002 CR4: 00000000003706e0
+[ 66.484811][ C2] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 66.487793][ C2] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 66.490424][ C2] Call Trace:
+[ 66.491469][ C2] <IRQ>
+[ 66.492374][ C2] ? eth_header+0x28/0x190
+[ 66.494054][ C2] ? eth_header+0x28/0x190
+[ 66.495401][ C2] skb_push.cold.99+0x22/0x22
+[ 66.496700][ C2] eth_header+0x28/0x190
+[ 66.497867][ C2] neigh_resolve_output+0x3de/0x720
+[ 66.499615][ C2] ? __neigh_update+0x7e8/0x20a0
+[ 66.501176][ C2] __neigh_update+0x8bd/0x20a0
+[ 66.502749][ C2] ndisc_update+0x34/0xc0
+[ 66.504010][ C2] ndisc_recv_na+0x8da/0xb80
+[ 66.505041][ C2] ? pndisc_redo+0x20/0x20
+[ 66.505888][ C2] ? rcu_read_lock_sched_held+0xc0/0xc0
+[ 66.506965][ C2] ndisc_rcv+0x3a0/0x470
+[ 66.507797][ C2] icmpv6_rcv+0xad9/0x1b00
+[ 66.508645][ C2] ip6_protocol_deliver_rcu+0xcd6/0x1560
+[ 66.509719][ C2] ip6_input_finish+0x5b/0xf0
+[ 66.510615][ C2] ip6_input+0xcd/0x2d0
+[ 66.511406][ C2] ? ip6_input_finish+0xf0/0xf0
+[ 66.512327][ C2] ? rcu_read_lock_held+0x91/0xa0
+[ 66.513279][ C2] ? ip6_protocol_deliver_rcu+0x1560/0x1560
+[ 66.514414][ C2] ipv6_rcv+0xe8/0x300
+[ ... ]
+
+Acked-by: Guillaume Nault <gnault@redhat.com>
+Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Link: https://lore.kernel.org/r/20201228152146.24270-1-ap420073@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bareudp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/bareudp.c
++++ b/drivers/net/bareudp.c
+@@ -380,7 +380,7 @@ static int bareudp6_xmit_skb(struct sk_b
+ goto free_dst;
+
+ min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len +
+- BAREUDP_BASE_HLEN + info->options_len + sizeof(struct iphdr);
++ BAREUDP_BASE_HLEN + info->options_len + sizeof(struct ipv6hdr);
+
+ err = skb_cow_head(skb, min_headroom);
+ if (unlikely(err))
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Mon, 28 Dec 2020 15:21:36 +0000
+Subject: bareudp: set NETIF_F_LLTX flag
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit d9e44981739a96f1a468c13bbbd54ace378caf1c ]
+
+Like other tunneling interfaces, the bareudp doesn't need TXLOCK.
+So, It is good to set the NETIF_F_LLTX flag to improve performance and
+to avoid lockdep's false-positive warning.
+
+Test commands:
+ ip netns add A
+ ip netns add B
+ ip link add veth0 netns A type veth peer name veth1 netns B
+ ip netns exec A ip link set veth0 up
+ ip netns exec A ip a a 10.0.0.1/24 dev veth0
+ ip netns exec B ip link set veth1 up
+ ip netns exec B ip a a 10.0.0.2/24 dev veth1
+
+ for i in {2..1}
+ do
+ let A=$i-1
+ ip netns exec A ip link add bareudp$i type bareudp \
+ dstport $i ethertype ip
+ ip netns exec A ip link set bareudp$i up
+ ip netns exec A ip a a 10.0.$i.1/24 dev bareudp$i
+ ip netns exec A ip r a 10.0.$i.2 encap ip src 10.0.$A.1 \
+ dst 10.0.$A.2 via 10.0.$i.2 dev bareudp$i
+
+ ip netns exec B ip link add bareudp$i type bareudp \
+ dstport $i ethertype ip
+ ip netns exec B ip link set bareudp$i up
+ ip netns exec B ip a a 10.0.$i.2/24 dev bareudp$i
+ ip netns exec B ip r a 10.0.$i.1 encap ip src 10.0.$A.2 \
+ dst 10.0.$A.1 via 10.0.$i.1 dev bareudp$i
+ done
+ ip netns exec A ping 10.0.2.2
+
+Splat looks like:
+[ 96.992803][ T822] ============================================
+[ 96.993954][ T822] WARNING: possible recursive locking detected
+[ 96.995102][ T822] 5.10.0+ #819 Not tainted
+[ 96.995927][ T822] --------------------------------------------
+[ 96.997091][ T822] ping/822 is trying to acquire lock:
+[ 96.998083][ T822] ffff88810f753898 (_xmit_NONE#2){+.-.}-{2:2}, at: __dev_queue_xmit+0x1f52/0x2960
+[ 96.999813][ T822]
+[ 96.999813][ T822] but task is already holding lock:
+[ 97.001192][ T822] ffff88810c385498 (_xmit_NONE#2){+.-.}-{2:2}, at: __dev_queue_xmit+0x1f52/0x2960
+[ 97.002908][ T822]
+[ 97.002908][ T822] other info that might help us debug this:
+[ 97.004401][ T822] Possible unsafe locking scenario:
+[ 97.004401][ T822]
+[ 97.005784][ T822] CPU0
+[ 97.006407][ T822] ----
+[ 97.007010][ T822] lock(_xmit_NONE#2);
+[ 97.007779][ T822] lock(_xmit_NONE#2);
+[ 97.008550][ T822]
+[ 97.008550][ T822] *** DEADLOCK ***
+[ 97.008550][ T822]
+[ 97.010057][ T822] May be due to missing lock nesting notation
+[ 97.010057][ T822]
+[ 97.011594][ T822] 7 locks held by ping/822:
+[ 97.012426][ T822] #0: ffff888109a144f0 (sk_lock-AF_INET){+.+.}-{0:0}, at: raw_sendmsg+0x12f7/0x2b00
+[ 97.014191][ T822] #1: ffffffffbce2f5a0 (rcu_read_lock_bh){....}-{1:2}, at: ip_finish_output2+0x249/0x2020
+[ 97.016045][ T822] #2: ffffffffbce2f5a0 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x1fd/0x2960
+[ 97.017897][ T822] #3: ffff88810c385498 (_xmit_NONE#2){+.-.}-{2:2}, at: __dev_queue_xmit+0x1f52/0x2960
+[ 97.019684][ T822] #4: ffffffffbce2f600 (rcu_read_lock){....}-{1:2}, at: bareudp_xmit+0x31b/0x3690 [bareudp]
+[ 97.021573][ T822] #5: ffffffffbce2f5a0 (rcu_read_lock_bh){....}-{1:2}, at: ip_finish_output2+0x249/0x2020
+[ 97.023424][ T822] #6: ffffffffbce2f5a0 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x1fd/0x2960
+[ 97.025259][ T822]
+[ 97.025259][ T822] stack backtrace:
+[ 97.026349][ T822] CPU: 3 PID: 822 Comm: ping Not tainted 5.10.0+ #819
+[ 97.027609][ T822] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+[ 97.029407][ T822] Call Trace:
+[ 97.030015][ T822] dump_stack+0x99/0xcb
+[ 97.030783][ T822] __lock_acquire.cold.77+0x149/0x3a9
+[ 97.031773][ T822] ? stack_trace_save+0x81/0xa0
+[ 97.032661][ T822] ? register_lock_class+0x1910/0x1910
+[ 97.033673][ T822] ? register_lock_class+0x1910/0x1910
+[ 97.034679][ T822] ? rcu_read_lock_sched_held+0x91/0xc0
+[ 97.035697][ T822] ? rcu_read_lock_bh_held+0xa0/0xa0
+[ 97.036690][ T822] lock_acquire+0x1b2/0x730
+[ 97.037515][ T822] ? __dev_queue_xmit+0x1f52/0x2960
+[ 97.038466][ T822] ? check_flags+0x50/0x50
+[ 97.039277][ T822] ? netif_skb_features+0x296/0x9c0
+[ 97.040226][ T822] ? validate_xmit_skb+0x29/0xb10
+[ 97.041151][ T822] _raw_spin_lock+0x30/0x70
+[ 97.041977][ T822] ? __dev_queue_xmit+0x1f52/0x2960
+[ 97.042927][ T822] __dev_queue_xmit+0x1f52/0x2960
+[ 97.043852][ T822] ? netdev_core_pick_tx+0x290/0x290
+[ 97.044824][ T822] ? mark_held_locks+0xb7/0x120
+[ 97.045712][ T822] ? lockdep_hardirqs_on_prepare+0x12c/0x3e0
+[ 97.046824][ T822] ? __local_bh_enable_ip+0xa5/0xf0
+[ 97.047771][ T822] ? ___neigh_create+0x12a8/0x1eb0
+[ 97.048710][ T822] ? trace_hardirqs_on+0x41/0x120
+[ 97.049626][ T822] ? ___neigh_create+0x12a8/0x1eb0
+[ 97.050556][ T822] ? __local_bh_enable_ip+0xa5/0xf0
+[ 97.051509][ T822] ? ___neigh_create+0x12a8/0x1eb0
+[ 97.052443][ T822] ? check_chain_key+0x244/0x5f0
+[ 97.053352][ T822] ? rcu_read_lock_bh_held+0x56/0xa0
+[ 97.054317][ T822] ? ip_finish_output2+0x6ea/0x2020
+[ 97.055263][ T822] ? pneigh_lookup+0x410/0x410
+[ 97.056135][ T822] ip_finish_output2+0x6ea/0x2020
+[ ... ]
+
+Acked-by: Guillaume Nault <gnault@redhat.com>
+Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Link: https://lore.kernel.org/r/20201228152136.24215-1-ap420073@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bareudp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/bareudp.c
++++ b/drivers/net/bareudp.c
+@@ -534,6 +534,7 @@ static void bareudp_setup(struct net_dev
+ SET_NETDEV_DEVTYPE(dev, &bareudp_type);
+ dev->features |= NETIF_F_SG | NETIF_F_HW_CSUM;
+ dev->features |= NETIF_F_RXCSUM;
++ dev->features |= NETIF_F_LLTX;
+ dev->features |= NETIF_F_GSO_SOFTWARE;
+ dev->hw_features |= NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_RXCSUM;
+ dev->hw_features |= NETIF_F_GSO_SOFTWARE;
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Sun, 27 Dec 2020 14:18:18 -0500
+Subject: bnxt_en: Check TQM rings for maximum supported value.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit a029a2fef5d11bb85587433c3783615442abac96 ]
+
+TQM rings are hardware resources that require host context memory
+managed by the driver. The driver supports up to 9 TQM rings and
+the number of rings to use is requested by firmware during run-time.
+Cap this number to the maximum supported to prevent accessing beyond
+the array. Future firmware may request more than 9 TQM rings. Define
+macros to remove the magic number 9 from the C code.
+
+Fixes: ac3158cb0108 ("bnxt_en: Allocate TQM ring context memory according to fw specification.")
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 7 +++++--
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 7 ++++++-
+ 2 files changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -6790,8 +6790,10 @@ static int bnxt_hwrm_func_backing_store_
+ ctx->tqm_fp_rings_count = resp->tqm_fp_rings_count;
+ if (!ctx->tqm_fp_rings_count)
+ ctx->tqm_fp_rings_count = bp->max_q;
++ else if (ctx->tqm_fp_rings_count > BNXT_MAX_TQM_FP_RINGS)
++ ctx->tqm_fp_rings_count = BNXT_MAX_TQM_FP_RINGS;
+
+- tqm_rings = ctx->tqm_fp_rings_count + 1;
++ tqm_rings = ctx->tqm_fp_rings_count + BNXT_MAX_TQM_SP_RINGS;
+ ctx_pg = kcalloc(tqm_rings, sizeof(*ctx_pg), GFP_KERNEL);
+ if (!ctx_pg) {
+ kfree(ctx);
+@@ -6925,7 +6927,8 @@ static int bnxt_hwrm_func_backing_store_
+ pg_attr = &req.tqm_sp_pg_size_tqm_sp_lvl,
+ pg_dir = &req.tqm_sp_page_dir,
+ ena = FUNC_BACKING_STORE_CFG_REQ_ENABLES_TQM_SP;
+- i < 9; i++, num_entries++, pg_attr++, pg_dir++, ena <<= 1) {
++ i < BNXT_MAX_TQM_RINGS;
++ i++, num_entries++, pg_attr++, pg_dir++, ena <<= 1) {
+ if (!(enables & ena))
+ continue;
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1435,6 +1435,11 @@ struct bnxt_ctx_pg_info {
+ struct bnxt_ctx_pg_info **ctx_pg_tbl;
+ };
+
++#define BNXT_MAX_TQM_SP_RINGS 1
++#define BNXT_MAX_TQM_FP_RINGS 8
++#define BNXT_MAX_TQM_RINGS \
++ (BNXT_MAX_TQM_SP_RINGS + BNXT_MAX_TQM_FP_RINGS)
++
+ struct bnxt_ctx_mem_info {
+ u32 qp_max_entries;
+ u16 qp_min_qp1_entries;
+@@ -1473,7 +1478,7 @@ struct bnxt_ctx_mem_info {
+ struct bnxt_ctx_pg_info stat_mem;
+ struct bnxt_ctx_pg_info mrav_mem;
+ struct bnxt_ctx_pg_info tim_mem;
+- struct bnxt_ctx_pg_info *tqm_mem[9];
++ struct bnxt_ctx_pg_info *tqm_mem[BNXT_MAX_TQM_RINGS];
+ };
+
+ struct bnxt_fw_health {
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Date: Sun, 27 Dec 2020 14:18:17 -0500
+Subject: bnxt_en: Fix AER recovery.
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit fb1e6e562b37b39adfe251919c9abfdb3e01f921 ]
+
+A recent change skips sending firmware messages to the firmware when
+pci_channel_offline() is true during fatal AER error. To make this
+complete, we need to move the re-initialization sequence to
+bnxt_io_resume(), otherwise the firmware messages to re-initialize
+will all be skipped. In any case, it is more correct to re-initialize
+in bnxt_io_resume().
+
+Also, fix the reverse x-mas tree format when defining variables
+in bnxt_io_slot_reset().
+
+Fixes: b340dc680ed4 ("bnxt_en: Avoid sending firmware messages when AER error is detected.")
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 31 +++++++++++++-----------------
+ 1 file changed, 14 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -12890,10 +12890,10 @@ static pci_ers_result_t bnxt_io_error_de
+ */
+ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev)
+ {
++ pci_ers_result_t result = PCI_ERS_RESULT_DISCONNECT;
+ struct net_device *netdev = pci_get_drvdata(pdev);
+ struct bnxt *bp = netdev_priv(netdev);
+ int err = 0, off;
+- pci_ers_result_t result = PCI_ERS_RESULT_DISCONNECT;
+
+ netdev_info(bp->dev, "PCI Slot Reset\n");
+
+@@ -12922,22 +12922,8 @@ static pci_ers_result_t bnxt_io_slot_res
+ pci_save_state(pdev);
+
+ err = bnxt_hwrm_func_reset(bp);
+- if (!err) {
+- err = bnxt_hwrm_func_qcaps(bp);
+- if (!err && netif_running(netdev))
+- err = bnxt_open(netdev);
+- }
+- bnxt_ulp_start(bp, err);
+- if (!err) {
+- bnxt_reenable_sriov(bp);
++ if (!err)
+ result = PCI_ERS_RESULT_RECOVERED;
+- }
+- }
+-
+- if (result != PCI_ERS_RESULT_RECOVERED) {
+- if (netif_running(netdev))
+- dev_close(netdev);
+- pci_disable_device(pdev);
+ }
+
+ rtnl_unlock();
+@@ -12955,10 +12941,21 @@ static pci_ers_result_t bnxt_io_slot_res
+ static void bnxt_io_resume(struct pci_dev *pdev)
+ {
+ struct net_device *netdev = pci_get_drvdata(pdev);
++ struct bnxt *bp = netdev_priv(netdev);
++ int err;
+
++ netdev_info(bp->dev, "PCI Slot Resume\n");
+ rtnl_lock();
+
+- netif_device_attach(netdev);
++ err = bnxt_hwrm_func_qcaps(bp);
++ if (!err && netif_running(netdev))
++ err = bnxt_open(netdev);
++
++ bnxt_ulp_start(bp, err);
++ if (!err) {
++ bnxt_reenable_sriov(bp);
++ netif_device_attach(netdev);
++ }
+
+ rtnl_unlock();
+ }
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Roland Dreier <roland@kernel.org>
+Date: Wed, 23 Dec 2020 19:21:16 -0800
+Subject: CDC-NCM: remove "connected" log message
+
+From: Roland Dreier <roland@kernel.org>
+
+[ Upstream commit 59b4a8fa27f5a895582ada1ae5034af7c94a57b5 ]
+
+The cdc_ncm driver passes network connection notifications up to
+usbnet_link_change(), which is the right place for any logging.
+Remove the netdev_info() duplicating this from the driver itself.
+
+This stops devices such as my "TRENDnet USB 10/100/1G/2.5G LAN"
+(ID 20f4:e02b) adapter from spamming the kernel log with
+
+ cdc_ncm 2-2:2.0 enp0s2u2c2: network connection: connected
+
+messages every 60 msec or so.
+
+Signed-off-by: Roland Dreier <roland@kernel.org>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20201224032116.2453938-1-roland@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/cdc_ncm.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1863,9 +1863,6 @@ static void cdc_ncm_status(struct usbnet
+ * USB_CDC_NOTIFY_NETWORK_CONNECTION notification shall be
+ * sent by device after USB_CDC_NOTIFY_SPEED_CHANGE.
+ */
+- netif_info(dev, link, dev->net,
+- "network connection: %sconnected\n",
+- !!event->wValue ? "" : "dis");
+ usbnet_link_change(dev, !!event->wValue, 0);
+ break;
+
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Mario Limonciello <mario.limonciello@dell.com>
+Date: Mon, 14 Dec 2020 13:29:33 -0600
+Subject: e1000e: bump up timeout to wait when ME un-configures ULP mode
+
+From: Mario Limonciello <mario.limonciello@dell.com>
+
+[ Upstream commit 3cf31b1a9effd859bb3d6ff9f8b5b0d5e6cac952 ]
+
+Per guidance from Intel ethernet architecture team, it may take
+up to 1 second for unconfiguring ULP mode.
+
+However in practice this seems to be taking up to 2 seconds on
+some Lenovo machines. Detect scenarios that take more than 1 second
+but less than 2.5 seconds and emit a warning on resume for those
+scenarios.
+
+Suggested-by: Aaron Ma <aaron.ma@canonical.com>
+Suggested-by: Sasha Netfin <sasha.neftin@intel.com>
+Suggested-by: Hans de Goede <hdegoede@redhat.com>
+CC: Mark Pearson <markpearson@lenovo.com>
+Fixes: f15bb6dde738cc8fa0 ("e1000e: Add support for S0ix")
+BugLink: https://bugs.launchpad.net/bugs/1865570
+Link: https://patchwork.ozlabs.org/project/intel-wired-lan/patch/20200323191639.48826-1-aaron.ma@canonical.com/
+Link: https://lkml.org/lkml/2020/12/13/15
+Link: https://lkml.org/lkml/2020/12/14/708
+Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Yijun Shen <Yijun.shen@dell.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000e/ich8lan.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -1240,6 +1240,9 @@ static s32 e1000_disable_ulp_lpt_lp(stru
+ return 0;
+
+ if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID) {
++ struct e1000_adapter *adapter = hw->adapter;
++ bool firmware_bug = false;
++
+ if (force) {
+ /* Request ME un-configure ULP mode in the PHY */
+ mac_reg = er32(H2ME);
+@@ -1248,16 +1251,24 @@ static s32 e1000_disable_ulp_lpt_lp(stru
+ ew32(H2ME, mac_reg);
+ }
+
+- /* Poll up to 300msec for ME to clear ULP_CFG_DONE. */
++ /* Poll up to 2.5 seconds for ME to clear ULP_CFG_DONE.
++ * If this takes more than 1 second, show a warning indicating a
++ * firmware bug
++ */
+ while (er32(FWSM) & E1000_FWSM_ULP_CFG_DONE) {
+- if (i++ == 30) {
++ if (i++ == 250) {
+ ret_val = -E1000_ERR_PHY;
+ goto out;
+ }
++ if (i > 100 && !firmware_bug)
++ firmware_bug = true;
+
+ usleep_range(10000, 11000);
+ }
+- e_dbg("ULP_CONFIG_DONE cleared after %dmsec\n", i * 10);
++ if (firmware_bug)
++ e_warn("ULP_CONFIG_DONE took %dmsec. This is a firmware bug\n", i * 10);
++ else
++ e_dbg("ULP_CONFIG_DONE cleared after %dmsec\n", i * 10);
+
+ if (force) {
+ mac_reg = er32(H2ME);
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Mario Limonciello <mario.limonciello@dell.com>
+Date: Mon, 14 Dec 2020 13:29:35 -0600
+Subject: e1000e: Export S0ix flags to ethtool
+
+From: Mario Limonciello <mario.limonciello@dell.com>
+
+[ Upstream commit 3c98cbf22a96c1b12f48c1b2a4680dfe5cb280f9 ]
+
+This flag can be used by an end user to disable S0ix flows on a
+buggy system or by an OEM for development purposes.
+
+If you need this flag to be persisted across reboots, it's suggested
+to use a udev rule to call adjust it until the kernel could have your
+configuration in a disallow list.
+
+Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Yijun Shen <Yijun.shen@dell.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000e/e1000.h | 1
+ drivers/net/ethernet/intel/e1000e/ethtool.c | 46 ++++++++++++++++++++++++++++
+ drivers/net/ethernet/intel/e1000e/netdev.c | 9 +++--
+ 3 files changed, 52 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/intel/e1000e/e1000.h
++++ b/drivers/net/ethernet/intel/e1000e/e1000.h
+@@ -436,6 +436,7 @@ s32 e1000e_get_base_timinca(struct e1000
+ #define FLAG2_DFLT_CRC_STRIPPING BIT(12)
+ #define FLAG2_CHECK_RX_HWTSTAMP BIT(13)
+ #define FLAG2_CHECK_SYSTIM_OVERFLOW BIT(14)
++#define FLAG2_ENABLE_S0IX_FLOWS BIT(15)
+
+ #define E1000_RX_DESC_PS(R, i) \
+ (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
+--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
++++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
+@@ -23,6 +23,13 @@ struct e1000_stats {
+ int stat_offset;
+ };
+
++static const char e1000e_priv_flags_strings[][ETH_GSTRING_LEN] = {
++#define E1000E_PRIV_FLAGS_S0IX_ENABLED BIT(0)
++ "s0ix-enabled",
++};
++
++#define E1000E_PRIV_FLAGS_STR_LEN ARRAY_SIZE(e1000e_priv_flags_strings)
++
+ #define E1000_STAT(str, m) { \
+ .stat_string = str, \
+ .type = E1000_STATS, \
+@@ -1776,6 +1783,8 @@ static int e1000e_get_sset_count(struct
+ return E1000_TEST_LEN;
+ case ETH_SS_STATS:
+ return E1000_STATS_LEN;
++ case ETH_SS_PRIV_FLAGS:
++ return E1000E_PRIV_FLAGS_STR_LEN;
+ default:
+ return -EOPNOTSUPP;
+ }
+@@ -2097,6 +2106,10 @@ static void e1000_get_strings(struct net
+ p += ETH_GSTRING_LEN;
+ }
+ break;
++ case ETH_SS_PRIV_FLAGS:
++ memcpy(data, e1000e_priv_flags_strings,
++ E1000E_PRIV_FLAGS_STR_LEN * ETH_GSTRING_LEN);
++ break;
+ }
+ }
+
+@@ -2305,6 +2318,37 @@ static int e1000e_get_ts_info(struct net
+ return 0;
+ }
+
++static u32 e1000e_get_priv_flags(struct net_device *netdev)
++{
++ struct e1000_adapter *adapter = netdev_priv(netdev);
++ u32 priv_flags = 0;
++
++ if (adapter->flags2 & FLAG2_ENABLE_S0IX_FLOWS)
++ priv_flags |= E1000E_PRIV_FLAGS_S0IX_ENABLED;
++
++ return priv_flags;
++}
++
++static int e1000e_set_priv_flags(struct net_device *netdev, u32 priv_flags)
++{
++ struct e1000_adapter *adapter = netdev_priv(netdev);
++ unsigned int flags2 = adapter->flags2;
++
++ flags2 &= ~FLAG2_ENABLE_S0IX_FLOWS;
++ if (priv_flags & E1000E_PRIV_FLAGS_S0IX_ENABLED) {
++ struct e1000_hw *hw = &adapter->hw;
++
++ if (hw->mac.type < e1000_pch_cnp)
++ return -EINVAL;
++ flags2 |= FLAG2_ENABLE_S0IX_FLOWS;
++ }
++
++ if (flags2 != adapter->flags2)
++ adapter->flags2 = flags2;
++
++ return 0;
++}
++
+ static const struct ethtool_ops e1000_ethtool_ops = {
+ .supported_coalesce_params = ETHTOOL_COALESCE_RX_USECS,
+ .get_drvinfo = e1000_get_drvinfo,
+@@ -2336,6 +2380,8 @@ static const struct ethtool_ops e1000_et
+ .set_eee = e1000e_set_eee,
+ .get_link_ksettings = e1000_get_link_ksettings,
+ .set_link_ksettings = e1000_set_link_ksettings,
++ .get_priv_flags = e1000e_get_priv_flags,
++ .set_priv_flags = e1000e_set_priv_flags,
+ };
+
+ void e1000e_set_ethtool_ops(struct net_device *netdev)
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -6923,7 +6923,6 @@ static __maybe_unused int e1000e_pm_susp
+ struct net_device *netdev = pci_get_drvdata(to_pci_dev(dev));
+ struct e1000_adapter *adapter = netdev_priv(netdev);
+ struct pci_dev *pdev = to_pci_dev(dev);
+- struct e1000_hw *hw = &adapter->hw;
+ int rc;
+
+ e1000e_flush_lpic(pdev);
+@@ -6935,7 +6934,7 @@ static __maybe_unused int e1000e_pm_susp
+ e1000e_pm_thaw(dev);
+ } else {
+ /* Introduce S0ix implementation */
+- if (hw->mac.type >= e1000_pch_cnp)
++ if (adapter->flags2 & FLAG2_ENABLE_S0IX_FLOWS)
+ e1000e_s0ix_entry_flow(adapter);
+ }
+
+@@ -6947,11 +6946,10 @@ static __maybe_unused int e1000e_pm_resu
+ struct net_device *netdev = pci_get_drvdata(to_pci_dev(dev));
+ struct e1000_adapter *adapter = netdev_priv(netdev);
+ struct pci_dev *pdev = to_pci_dev(dev);
+- struct e1000_hw *hw = &adapter->hw;
+ int rc;
+
+ /* Introduce S0ix implementation */
+- if (hw->mac.type >= e1000_pch_cnp)
++ if (adapter->flags2 & FLAG2_ENABLE_S0IX_FLOWS)
+ e1000e_s0ix_exit_flow(adapter);
+
+ rc = __e1000_resume(pdev);
+@@ -7615,6 +7613,9 @@ static int e1000_probe(struct pci_dev *p
+ if (!(adapter->flags & FLAG_HAS_AMT))
+ e1000e_get_hw_control(adapter);
+
++ if (hw->mac.type >= e1000_pch_cnp)
++ adapter->flags2 |= FLAG2_ENABLE_S0IX_FLOWS;
++
+ strlcpy(netdev->name, "eth%d", sizeof(netdev->name));
+ err = register_netdev(netdev);
+ if (err)
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Mario Limonciello <mario.limonciello@dell.com>
+Date: Mon, 14 Dec 2020 13:29:32 -0600
+Subject: e1000e: Only run S0ix flows if shutdown succeeded
+
+From: Mario Limonciello <mario.limonciello@dell.com>
+
+[ Upstream commit 808e0d8832cc81738f3e8df12dff0688352baf50 ]
+
+If the shutdown failed, the part will be thawed and running
+S0ix flows will put it into an undefined state.
+
+Reported-by: Alexander Duyck <alexander.duyck@gmail.com>
+Reviewed-by: Alexander Duyck <alexander.duyck@gmail.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
+Tested-by: Yijun Shen <Yijun.shen@dell.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000e/netdev.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -6970,13 +6970,14 @@ static __maybe_unused int e1000e_pm_susp
+ e1000e_pm_freeze(dev);
+
+ rc = __e1000_shutdown(pdev, false);
+- if (rc)
++ if (rc) {
+ e1000e_pm_thaw(dev);
+-
+- /* Introduce S0ix implementation */
+- if (hw->mac.type >= e1000_pch_cnp &&
+- !e1000e_check_me(hw->adapter->pdev->device))
+- e1000e_s0ix_entry_flow(adapter);
++ } else {
++ /* Introduce S0ix implementation */
++ if (hw->mac.type >= e1000_pch_cnp &&
++ !e1000e_check_me(hw->adapter->pdev->device))
++ e1000e_s0ix_entry_flow(adapter);
++ }
+
+ return rc;
+ }
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Cong Wang <cong.wang@bytedance.com>
+Date: Sat, 26 Dec 2020 15:44:53 -0800
+Subject: erspan: fix version 1 check in gre_parse_header()
+
+From: Cong Wang <cong.wang@bytedance.com>
+
+[ Upstream commit 085c7c4e1c0e50d90b7d90f61a12e12b317a91e2 ]
+
+Both version 0 and version 1 use ETH_P_ERSPAN, but version 0 does not
+have an erspan header. So the check in gre_parse_header() is wrong,
+we have to distinguish version 1 from version 0.
+
+We can just check the gre header length like is_erspan_type1().
+
+Fixes: cb73ee40b1b3 ("net: ip_gre: use erspan key field for tunnel lookup")
+Reported-by: syzbot+f583ce3d4ddf9836b27a@syzkaller.appspotmail.com
+Cc: William Tu <u9012063@gmail.com>
+Cc: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: Cong Wang <cong.wang@bytedance.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/gre_demux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/gre_demux.c
++++ b/net/ipv4/gre_demux.c
+@@ -128,7 +128,7 @@ int gre_parse_header(struct sk_buff *skb
+ * to 0 and sets the configured key in the
+ * inner erspan header field
+ */
+- if (greh->protocol == htons(ETH_P_ERSPAN) ||
++ if ((greh->protocol == htons(ETH_P_ERSPAN) && hdr_len != 4) ||
+ greh->protocol == htons(ETH_P_ERSPAN2)) {
+ struct erspan_base_hdr *ershdr;
+
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Date: Fri, 18 Dec 2020 11:55:38 +0100
+Subject: ethernet: ucc_geth: fix use-after-free in ucc_geth_remove()
+
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+
+[ Upstream commit e925e0cd2a705aaacb0b907bb3691fcac3a973a4 ]
+
+ugeth is the netdiv_priv() part of the netdevice. Accessing the memory
+pointed to by ugeth (such as done by ucc_geth_memclean() and the two
+of_node_puts) after free_netdev() is thus use-after-free.
+
+Fixes: 80a9fad8e89a ("ucc_geth: fix module removal")
+Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/ucc_geth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/freescale/ucc_geth.c
++++ b/drivers/net/ethernet/freescale/ucc_geth.c
+@@ -3934,12 +3934,12 @@ static int ucc_geth_remove(struct platfo
+ struct device_node *np = ofdev->dev.of_node;
+
+ unregister_netdev(dev);
+- free_netdev(dev);
+ ucc_geth_memclean(ugeth);
+ if (of_phy_is_fixed_link(np))
+ of_phy_deregister_fixed_link(np);
+ of_node_put(ugeth->ug_info->tbi_node);
+ of_node_put(ugeth->ug_info->phy_node);
++ free_netdev(dev);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Date: Fri, 18 Dec 2020 11:55:36 +0100
+Subject: ethernet: ucc_geth: set dev->max_mtu to 1518
+
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+
+[ Upstream commit 1385ae5c30f238f81bc6528d897c6d7a0816783f ]
+
+All the buffers and registers are already set up appropriately for an
+MTU slightly above 1500, so we just need to expose this to the
+networking stack. AFAICT, there's no need to implement .ndo_change_mtu
+when the receive buffers are always set up to support the max_mtu.
+
+This fixes several warnings during boot on our mpc8309-board with an
+embedded mv88e6250 switch:
+
+mv88e6085 mdio@e0102120:10: nonfatal error -34 setting MTU 1500 on port 0
+...
+mv88e6085 mdio@e0102120:10: nonfatal error -34 setting MTU 1500 on port 4
+ucc_geth e0102000.ethernet eth1: error -22 setting MTU to 1504 to include DSA overhead
+
+The last line explains what the DSA stack tries to do: achieving an MTU
+of 1500 on-the-wire requires that the master netdevice connected to
+the CPU port supports an MTU of 1500+the tagging overhead.
+
+Fixes: bfcb813203e6 ("net: dsa: configure the MTU for switch ports")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/ucc_geth.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/freescale/ucc_geth.c
++++ b/drivers/net/ethernet/freescale/ucc_geth.c
+@@ -3889,6 +3889,7 @@ static int ucc_geth_probe(struct platfor
+ INIT_WORK(&ugeth->timeout_work, ucc_geth_timeout_work);
+ netif_napi_add(dev, &ugeth->napi, ucc_geth_poll, 64);
+ dev->mtu = 1500;
++ dev->max_mtu = 1518;
+
+ ugeth->msg_enable = netif_msg_init(debug.msg_enable, UGETH_MSG_DEFAULT);
+ ugeth->phy_interface = phy_interface;
--- /dev/null
+From foo@baz Sun Jan 10 11:18:58 AM CET 2021
+From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Date: Thu, 22 Oct 2020 12:39:36 +0200
+Subject: i40e: Fix Error I40E_AQ_RC_EINVAL when removing VFs
+
+From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+
+[ Upstream commit 3ac874fa84d1baaf0c0175f2a1499f5d88d528b2 ]
+
+When removing VFs for PF added to bridge there was
+an error I40E_AQ_RC_EINVAL. It was caused by not properly
+resetting and reinitializing PF when adding/removing VFs.
+Changed how reset is performed when adding/removing VFs
+to properly reinitialize PFs VSI.
+
+Fixes: fc60861e9b00 ("i40e: start up in VEPA mode by default")
+Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e.h | 3 +++
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 10 ++++++++++
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 ++--
+ 3 files changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -120,6 +120,7 @@ enum i40e_state_t {
+ __I40E_RESET_INTR_RECEIVED,
+ __I40E_REINIT_REQUESTED,
+ __I40E_PF_RESET_REQUESTED,
++ __I40E_PF_RESET_AND_REBUILD_REQUESTED,
+ __I40E_CORE_RESET_REQUESTED,
+ __I40E_GLOBAL_RESET_REQUESTED,
+ __I40E_EMP_RESET_INTR_RECEIVED,
+@@ -146,6 +147,8 @@ enum i40e_state_t {
+ };
+
+ #define I40E_PF_RESET_FLAG BIT_ULL(__I40E_PF_RESET_REQUESTED)
++#define I40E_PF_RESET_AND_REBUILD_FLAG \
++ BIT_ULL(__I40E_PF_RESET_AND_REBUILD_REQUESTED)
+
+ /* VSI state flags */
+ enum i40e_vsi_state_t {
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -36,6 +36,8 @@ static int i40e_setup_misc_vector(struct
+ static void i40e_determine_queue_usage(struct i40e_pf *pf);
+ static int i40e_setup_pf_filter_control(struct i40e_pf *pf);
+ static void i40e_prep_for_reset(struct i40e_pf *pf, bool lock_acquired);
++static void i40e_reset_and_rebuild(struct i40e_pf *pf, bool reinit,
++ bool lock_acquired);
+ static int i40e_reset(struct i40e_pf *pf);
+ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired);
+ static int i40e_setup_misc_vector_for_recovery_mode(struct i40e_pf *pf);
+@@ -8536,6 +8538,14 @@ void i40e_do_reset(struct i40e_pf *pf, u
+ "FW LLDP is disabled\n" :
+ "FW LLDP is enabled\n");
+
++ } else if (reset_flags & I40E_PF_RESET_AND_REBUILD_FLAG) {
++ /* Request a PF Reset
++ *
++ * Resets PF and reinitializes PFs VSI.
++ */
++ i40e_prep_for_reset(pf, lock_acquired);
++ i40e_reset_and_rebuild(pf, true, lock_acquired);
++
+ } else if (reset_flags & BIT_ULL(__I40E_REINIT_REQUESTED)) {
+ int v;
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1772,7 +1772,7 @@ int i40e_pci_sriov_configure(struct pci_
+ if (num_vfs) {
+ if (!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) {
+ pf->flags |= I40E_FLAG_VEB_MODE_ENABLED;
+- i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG);
++ i40e_do_reset_safe(pf, I40E_PF_RESET_AND_REBUILD_FLAG);
+ }
+ ret = i40e_pci_sriov_enable(pdev, num_vfs);
+ goto sriov_configure_out;
+@@ -1781,7 +1781,7 @@ int i40e_pci_sriov_configure(struct pci_
+ if (!pci_vfs_assigned(pf->pdev)) {
+ i40e_free_vfs(pf);
+ pf->flags &= ~I40E_FLAG_VEB_MODE_ENABLED;
+- i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG);
++ i40e_do_reset_safe(pf, I40E_PF_RESET_AND_REBUILD_FLAG);
+ } else {
+ dev_warn(&pdev->dev, "Unable to free VFs because some are assigned to VMs.\n");
+ ret = -EINVAL;
--- /dev/null
+From foo@baz Sun Jan 10 11:18:58 AM CET 2021
+From: Jakub Kicinski <kuba@kernel.org>
+Date: Wed, 2 Dec 2020 18:18:06 -0800
+Subject: iavf: fix double-release of rtnl_lock
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit f1340265726e0edf8a8cef28e665b28ad6302ce9 ]
+
+This code does not jump to exit on an error in iavf_lan_add_device(),
+so the rtnl_unlock() from the normal path will follow.
+
+Fixes: b66c7bc1cd4d ("iavf: Refactor init state machine")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -1834,11 +1834,9 @@ static int iavf_init_get_resources(struc
+ netif_tx_stop_all_queues(netdev);
+ if (CLIENT_ALLOWED(adapter)) {
+ err = iavf_lan_add_device(adapter);
+- if (err) {
+- rtnl_unlock();
++ if (err)
+ dev_info(&pdev->dev, "Failed to add VF to client API service list: %d\n",
+ err);
+- }
+ }
+ dev_info(&pdev->dev, "MAC address: %pM\n", adapter->hw.mac.addr);
+ if (netdev->features & NETIF_F_GRO)
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Lijun Pan <ljp@linux.ibm.com>
+Date: Sat, 19 Dec 2020 15:40:34 -0600
+Subject: ibmvnic: continue fatal error reset after passive init
+
+From: Lijun Pan <ljp@linux.ibm.com>
+
+[ Upstream commit 1f45dc22066797479072978feeada0852502e180 ]
+
+Commit f9c6cea0b385 ("ibmvnic: Skip fatal error reset after passive init")
+says "If the passive
+CRQ initialization occurs before the FATAL reset task is processed,
+the FATAL error reset task would try to access a CRQ message queue
+that was freed, causing an oops. The problem may be most likely to
+occur during DLPAR add vNIC with a non-default MTU, because the DLPAR
+process will automatically issue a change MTU request.
+Fix this by not processing fatal error reset if CRQ is passively
+initialized after client-driven CRQ initialization fails."
+
+Even with this commit, we still see similar kernel crashes. In order
+to completely solve this problem, we'd better continue the fatal error
+reset, capture the kernel crash, and try to fix it from that end.
+
+Fixes: f9c6cea0b385 ("ibmvnic: Skip fatal error reset after passive init")
+Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
+Link: https://lore.kernel.org/r/20201219214034.21123-1-ljp@linux.ibm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2248,8 +2248,7 @@ static void __ibmvnic_reset(struct work_
+ set_current_state(TASK_UNINTERRUPTIBLE);
+ schedule_timeout(60 * HZ);
+ }
+- } else if (!(rwi->reset_reason == VNIC_RESET_FATAL &&
+- adapter->from_passive_init)) {
++ } else {
+ rc = do_reset(adapter, rwi, reset_state);
+ }
+ kfree(rwi);
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Lijun Pan <ljp@linux.ibm.com>
+Date: Sat, 19 Dec 2020 15:39:19 -0600
+Subject: ibmvnic: fix login buffer memory leak
+
+From: Lijun Pan <ljp@linux.ibm.com>
+
+[ Upstream commit a0c8be56affa7d5ffbdec24c992223be54db3b6e ]
+
+Commit 34f0f4e3f488 ("ibmvnic: Fix login buffer memory leaks") frees
+login_rsp_buffer in release_resources() and send_login()
+because handle_login_rsp() does not free it.
+Commit f3ae59c0c015 ("ibmvnic: store RX and TX subCRQ handle array in
+ibmvnic_adapter struct") frees login_rsp_buffer in handle_login_rsp().
+It seems unnecessary to free it in release_resources() and send_login().
+There are chances that handle_login_rsp returns earlier without freeing
+buffers. Double-checking the buffer is harmless since
+release_login_buffer and release_login_rsp_buffer will
+do nothing if buffer is already freed.
+
+Fixes: f3ae59c0c015 ("ibmvnic: store RX and TX subCRQ handle array in ibmvnic_adapter struct")
+Fixes: 34f0f4e3f488 ("ibmvnic: Fix login buffer memory leaks")
+Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
+Link: https://lore.kernel.org/r/20201219213919.21045-1-ljp@linux.ibm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -932,6 +932,7 @@ static void release_resources(struct ibm
+ release_rx_pools(adapter);
+
+ release_napi(adapter);
++ release_login_buffer(adapter);
+ release_login_rsp_buffer(adapter);
+ }
+
+@@ -3768,7 +3769,9 @@ static int send_login(struct ibmvnic_ada
+ return -1;
+ }
+
++ release_login_buffer(adapter);
+ release_login_rsp_buffer(adapter);
++
+ client_data_len = vnic_client_data_len(adapter);
+
+ buffer_size =
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: YANG LI <abaci-bugfix@linux.alibaba.com>
+Date: Wed, 30 Dec 2020 15:23:14 +0800
+Subject: ibmvnic: fix: NULL pointer dereference.
+
+From: YANG LI <abaci-bugfix@linux.alibaba.com>
+
+[ Upstream commit 862aecbd9569e563b979c0e23a908b43cda4b0b9 ]
+
+The error is due to dereference a null pointer in function
+reset_one_sub_crq_queue():
+
+if (!scrq) {
+ netdev_dbg(adapter->netdev,
+ "Invalid scrq reset. irq (%d) or msgs(%p).\n",
+ scrq->irq, scrq->msgs);
+ return -EINVAL;
+}
+
+If the expression is true, scrq must be a null pointer and cannot
+dereference.
+
+Fixes: 9281cf2d5840 ("ibmvnic: avoid memset null scrq msgs")
+Signed-off-by: YANG LI <abaci-bugfix@linux.alibaba.com>
+Reported-by: Abaci <abaci@linux.alibaba.com>
+Acked-by: Lijun Pan <ljp@linux.ibm.com>
+Link: https://lore.kernel.org/r/1609312994-121032-1-git-send-email-abaci-bugfix@linux.alibaba.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2869,9 +2869,7 @@ static int reset_one_sub_crq_queue(struc
+ int rc;
+
+ if (!scrq) {
+- netdev_dbg(adapter->netdev,
+- "Invalid scrq reset. irq (%d) or msgs (%p).\n",
+- scrq->irq, scrq->msgs);
++ netdev_dbg(adapter->netdev, "Invalid scrq reset.\n");
+ return -EINVAL;
+ }
+
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Shannon Nelson <snelson@pensando.io>
+Date: Fri, 18 Dec 2020 13:50:01 -0800
+Subject: ionic: account for vlan tag len in rx buffer len
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit 83469893204281ecf65d572bddf02de29a19787c ]
+
+Let the FW know we have enough receive buffer space for the
+vlan tag if it isn't stripped.
+
+Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Link: https://lore.kernel.org/r/20201218215001.64696-1-snelson@pensando.io
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+@@ -337,7 +337,7 @@ void ionic_rx_fill(struct ionic_queue *q
+ unsigned int i, j;
+ unsigned int len;
+
+- len = netdev->mtu + ETH_HLEN;
++ len = netdev->mtu + ETH_HLEN + VLAN_HLEN;
+ nfrags = round_up(len, PAGE_SIZE) / PAGE_SIZE;
+
+ for (i = ionic_q_space_avail(q); i; i--) {
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Guillaume Nault <gnault@redhat.com>
+Date: Thu, 24 Dec 2020 20:01:09 +0100
+Subject: ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst()
+
+From: Guillaume Nault <gnault@redhat.com>
+
+[ Upstream commit 21fdca22eb7df2a1e194b8adb812ce370748b733 ]
+
+RT_TOS() only clears one of the ECN bits. Therefore, when
+fib_compute_spec_dst() resorts to a fib lookup, it can return
+different results depending on the value of the second ECN bit.
+
+For example, ECT(0) and ECT(1) packets could be treated differently.
+
+ $ ip netns add ns0
+ $ ip netns add ns1
+ $ ip link add name veth01 netns ns0 type veth peer name veth10 netns ns1
+ $ ip -netns ns0 link set dev lo up
+ $ ip -netns ns1 link set dev lo up
+ $ ip -netns ns0 link set dev veth01 up
+ $ ip -netns ns1 link set dev veth10 up
+
+ $ ip -netns ns0 address add 192.0.2.10/24 dev veth01
+ $ ip -netns ns1 address add 192.0.2.11/24 dev veth10
+
+ $ ip -netns ns1 address add 192.0.2.21/32 dev lo
+ $ ip -netns ns1 route add 192.0.2.10/32 tos 4 dev veth10 src 192.0.2.21
+ $ ip netns exec ns1 sysctl -wq net.ipv4.icmp_echo_ignore_broadcasts=0
+
+With TOS 4 and ECT(1), ns1 replies using source address 192.0.2.21
+(ping uses -Q to set all TOS and ECN bits):
+
+ $ ip netns exec ns0 ping -c 1 -b -Q 5 192.0.2.255
+ [...]
+ 64 bytes from 192.0.2.21: icmp_seq=1 ttl=64 time=0.544 ms
+
+But with TOS 4 and ECT(0), ns1 replies using source address 192.0.2.11
+because the "tos 4" route isn't matched:
+
+ $ ip netns exec ns0 ping -c 1 -b -Q 6 192.0.2.255
+ [...]
+ 64 bytes from 192.0.2.11: icmp_seq=1 ttl=64 time=0.597 ms
+
+After this patch the ECN bits don't affect the result anymore:
+
+ $ ip netns exec ns0 ping -c 1 -b -Q 6 192.0.2.255
+ [...]
+ 64 bytes from 192.0.2.21: icmp_seq=1 ttl=64 time=0.591 ms
+
+Fixes: 35ebf65e851c ("ipv4: Create and use fib_compute_spec_dst() helper.")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/fib_frontend.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -292,7 +292,7 @@ __be32 fib_compute_spec_dst(struct sk_bu
+ .flowi4_iif = LOOPBACK_IFINDEX,
+ .flowi4_oif = l3mdev_master_ifindex_rcu(dev),
+ .daddr = ip_hdr(skb)->saddr,
+- .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
++ .flowi4_tos = ip_hdr(skb)->tos & IPTOS_RT_MASK,
+ .flowi4_scope = scope,
+ .flowi4_mark = vmark ? skb->mark : 0,
+ };
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Petr Machata <me@pmachata.org>
+Date: Tue, 22 Dec 2020 22:49:44 +0100
+Subject: net: dcb: Validate netlink message in DCB handler
+
+From: Petr Machata <me@pmachata.org>
+
+[ Upstream commit 826f328e2b7e8854dd42ea44e6519cd75018e7b1 ]
+
+DCB uses the same handler function for both RTM_GETDCB and RTM_SETDCB
+messages. dcb_doit() bounces RTM_SETDCB mesasges if the user does not have
+the CAP_NET_ADMIN capability.
+
+However, the operation to be performed is not decided from the DCB message
+type, but from the DCB command. Thus DCB_CMD_*_GET commands are used for
+reading DCB objects, the corresponding SET and DEL commands are used for
+manipulation.
+
+The assumption is that set-like commands will be sent via an RTM_SETDCB
+message, and get-like ones via RTM_GETDCB. However, this assumption is not
+enforced.
+
+It is therefore possible to manipulate DCB objects without CAP_NET_ADMIN
+capability by sending the corresponding command in an RTM_GETDCB message.
+That is a bug. Fix it by validating the type of the request message against
+the type used for the response.
+
+Fixes: 2f90b8657ec9 ("ixgbe: this patch adds support for DCB to the kernel and ixgbe driver")
+Signed-off-by: Petr Machata <me@pmachata.org>
+Link: https://lore.kernel.org/r/a2a9b88418f3a58ef211b718f2970128ef9e3793.1608673640.git.me@pmachata.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dcb/dcbnl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/dcb/dcbnl.c
++++ b/net/dcb/dcbnl.c
+@@ -1765,6 +1765,8 @@ static int dcb_doit(struct sk_buff *skb,
+ fn = &reply_funcs[dcb->cmd];
+ if (!fn->cb)
+ return -EOPNOTSUPP;
++ if (fn->type != nlh->nlmsg_type)
++ return -EPERM;
+
+ if (!tb[DCB_ATTR_IFNAME])
+ return -EINVAL;
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Sun, 3 Jan 2021 02:25:43 +0100
+Subject: net: dsa: lantiq_gswip: Enable GSWIP_MII_CFG_EN also for internal PHYs
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit c1a9ec7e5d577a9391660800c806c53287fca991 ]
+
+Enable GSWIP_MII_CFG_EN also for internal PHYs to make traffic flow.
+Without this the PHY link is detected properly and ethtool statistics
+for TX are increasing but there's no RX traffic coming in.
+
+Fixes: 14fceff4771e51 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200")
+Suggested-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/lantiq_gswip.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/dsa/lantiq_gswip.c
++++ b/drivers/net/dsa/lantiq_gswip.c
+@@ -1541,9 +1541,7 @@ static void gswip_phylink_mac_link_up(st
+ {
+ struct gswip_priv *priv = ds->priv;
+
+- /* Enable the xMII interface only for the external PHY */
+- if (interface != PHY_INTERFACE_MODE_INTERNAL)
+- gswip_mii_mask_cfg(priv, 0, GSWIP_MII_CFG_EN, port);
++ gswip_mii_mask_cfg(priv, 0, GSWIP_MII_CFG_EN, port);
+ }
+
+ static void gswip_get_strings(struct dsa_switch *ds, int port, u32 stringset,
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Sun, 3 Jan 2021 02:25:44 +0100
+Subject: net: dsa: lantiq_gswip: Fix GSWIP_MII_CFG(p) register access
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 709a3c9dff2a639966ae7d8ba6239d2b8aba036d ]
+
+There is one GSWIP_MII_CFG register for each switch-port except the CPU
+port. The register offset for the first port is 0x0, 0x02 for the
+second, 0x04 for the third and so on.
+
+Update the driver to not only restrict the GSWIP_MII_CFG registers to
+ports 0, 1 and 5. Handle ports 0..5 instead but skip the CPU port. This
+means we are not overwriting the configuration for the third port (port
+two since we start counting from zero) with the settings for the sixth
+port (with number five) anymore.
+
+The GSWIP_MII_PCDU(p) registers are not updated because there's really
+only three (one for each of the following ports: 0, 1, 5).
+
+Fixes: 14fceff4771e51 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/lantiq_gswip.c | 23 ++++++-----------------
+ 1 file changed, 6 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/dsa/lantiq_gswip.c
++++ b/drivers/net/dsa/lantiq_gswip.c
+@@ -92,9 +92,7 @@
+ GSWIP_MDIO_PHY_FDUP_MASK)
+
+ /* GSWIP MII Registers */
+-#define GSWIP_MII_CFG0 0x00
+-#define GSWIP_MII_CFG1 0x02
+-#define GSWIP_MII_CFG5 0x04
++#define GSWIP_MII_CFGp(p) (0x2 * (p))
+ #define GSWIP_MII_CFG_EN BIT(14)
+ #define GSWIP_MII_CFG_LDCLKDIS BIT(12)
+ #define GSWIP_MII_CFG_MODE_MIIP 0x0
+@@ -392,17 +390,9 @@ static void gswip_mii_mask(struct gswip_
+ static void gswip_mii_mask_cfg(struct gswip_priv *priv, u32 clear, u32 set,
+ int port)
+ {
+- switch (port) {
+- case 0:
+- gswip_mii_mask(priv, clear, set, GSWIP_MII_CFG0);
+- break;
+- case 1:
+- gswip_mii_mask(priv, clear, set, GSWIP_MII_CFG1);
+- break;
+- case 5:
+- gswip_mii_mask(priv, clear, set, GSWIP_MII_CFG5);
+- break;
+- }
++ /* There's no MII_CFG register for the CPU port */
++ if (!dsa_is_cpu_port(priv->ds, port))
++ gswip_mii_mask(priv, clear, set, GSWIP_MII_CFGp(port));
+ }
+
+ static void gswip_mii_mask_pcdu(struct gswip_priv *priv, u32 clear, u32 set,
+@@ -822,9 +812,8 @@ static int gswip_setup(struct dsa_switch
+ gswip_mdio_mask(priv, 0xff, 0x09, GSWIP_MDIO_MDC_CFG1);
+
+ /* Disable the xMII link */
+- gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, 0);
+- gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, 1);
+- gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, 5);
++ for (i = 0; i < priv->hw_info->max_ports; i++)
++ gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, i);
+
+ /* enable special tag insertion on cpu port */
+ gswip_switch_mask(priv, 0, GSWIP_FDMA_PCTRL_STEN,
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Date: Wed, 23 Dec 2020 19:06:12 +0800
+Subject: net: ethernet: Fix memleak in ethoc_probe
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 5d41f9b7ee7a5a5138894f58846a4ffed601498a ]
+
+When mdiobus_register() fails, priv->mdio allocated
+by mdiobus_alloc() has not been freed, which leads
+to memleak.
+
+Fixes: e7f4dc3536a4 ("mdio: Move allocation of interrupts into core")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20201223110615.31389-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ethoc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/ethoc.c
++++ b/drivers/net/ethernet/ethoc.c
+@@ -1211,7 +1211,7 @@ static int ethoc_probe(struct platform_d
+ ret = mdiobus_register(priv->mdio);
+ if (ret) {
+ dev_err(&netdev->dev, "failed to register MDIO bus\n");
+- goto free2;
++ goto free3;
+ }
+
+ ret = ethoc_mdio_probe(netdev);
+@@ -1243,6 +1243,7 @@ error2:
+ netif_napi_del(&priv->napi);
+ error:
+ mdiobus_unregister(priv->mdio);
++free3:
+ mdiobus_free(priv->mdio);
+ free2:
+ clk_disable_unprepare(priv->clk);
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Date: Sun, 20 Dec 2020 16:29:30 +0800
+Subject: net: ethernet: mvneta: Fix error handling in mvneta_probe
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 58f60329a6be35a5653edb3fd2023ccef9eb9943 ]
+
+When mvneta_port_power_up() fails, we should execute
+cleanup functions after label err_netdev to avoid memleak.
+
+Fixes: 41c2b6b4f0f80 ("net: ethernet: mvneta: Add back interface mode validation")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Link: https://lore.kernel.org/r/20201220082930.21623-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -5232,7 +5232,7 @@ static int mvneta_probe(struct platform_
+ err = mvneta_port_power_up(pp, pp->phy_interface);
+ if (err < 0) {
+ dev_err(&pdev->dev, "can't power up port\n");
+- return err;
++ goto err_netdev;
+ }
+
+ /* Armada3700 network controller does not support per-cpu
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Thu, 24 Dec 2020 18:24:05 +0200
+Subject: net: ethernet: ti: cpts: fix ethtool output when no ptp_clock registered
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit 4614792eebcbf81c60ad3604c1aeeb2b0899cea4 ]
+
+The CPTS driver registers PTP PHC clock when first netif is going up and
+unregister it when all netif are down. Now ethtool will show:
+ - PTP PHC clock index 0 after boot until first netif is up;
+ - the last assigned PTP PHC clock index even if PTP PHC clock is not
+registered any more after all netifs are down.
+
+This patch ensures that -1 is returned by ethtool when PTP PHC clock is not
+registered any more.
+
+Fixes: 8a2c9a5ab4b9 ("net: ethernet: ti: cpts: rework initialization/deinitialization")
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Link: https://lore.kernel.org/r/20201224162405.28032-1-grygorii.strashko@ti.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/cpts.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/ti/cpts.c
++++ b/drivers/net/ethernet/ti/cpts.c
+@@ -599,6 +599,7 @@ void cpts_unregister(struct cpts *cpts)
+
+ ptp_clock_unregister(cpts->clock);
+ cpts->clock = NULL;
++ cpts->phc_index = -1;
+
+ cpts_write32(cpts, 0, int_enable);
+ cpts_write32(cpts, 0, control);
+@@ -784,6 +785,7 @@ struct cpts *cpts_create(struct device *
+ cpts->cc.read = cpts_systim_read;
+ cpts->cc.mask = CLOCKSOURCE_MASK(32);
+ cpts->info = cpts_info;
++ cpts->phc_index = -1;
+
+ if (n_ext_ts)
+ cpts->info.n_ext_ts = n_ext_ts;
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Xie He <xie.he.0141@gmail.com>
+Date: Sun, 27 Dec 2020 18:53:39 -0800
+Subject: net: hdlc_ppp: Fix issues when mod_timer is called while timer is running
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 1fef73597fa545c35fddc953979013882fbd4e55 ]
+
+ppp_cp_event is called directly or indirectly by ppp_rx with "ppp->lock"
+held. It may call mod_timer to add a new timer. However, at the same time
+ppp_timer may be already running and waiting for "ppp->lock". In this
+case, there's no need for ppp_timer to continue running and it can just
+exit.
+
+If we let ppp_timer continue running, it may call add_timer. This causes
+kernel panic because add_timer can't be called with a timer pending.
+This patch fixes this problem.
+
+Fixes: e022c2f07ae5 ("WAN: new synchronous PPP implementation for generic HDLC.")
+Cc: Krzysztof Halasa <khc@pm.waw.pl>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wan/hdlc_ppp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wan/hdlc_ppp.c
++++ b/drivers/net/wan/hdlc_ppp.c
+@@ -569,6 +569,13 @@ static void ppp_timer(struct timer_list
+ unsigned long flags;
+
+ spin_lock_irqsave(&ppp->lock, flags);
++ /* mod_timer could be called after we entered this function but
++ * before we got the lock.
++ */
++ if (timer_pending(&proto->timer)) {
++ spin_unlock_irqrestore(&ppp->lock, flags);
++ return;
++ }
+ switch (proto->state) {
+ case STOPPING:
+ case REQ_SENT:
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Yunjian Wang <wangyunjian@huawei.com>
+Date: Sat, 26 Dec 2020 16:10:05 +0800
+Subject: net: hns: fix return value check in __lb_other_process()
+
+From: Yunjian Wang <wangyunjian@huawei.com>
+
+[ Upstream commit 5ede3ada3da7f050519112b81badc058190b9f9f ]
+
+The function skb_copy() could return NULL, the return value
+need to be checked.
+
+Fixes: b5996f11ea54 ("net: add Hisilicon Network Subsystem basic ethernet support")
+Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+@@ -415,6 +415,10 @@ static void __lb_other_process(struct hn
+ /* for mutl buffer*/
+ new_skb = skb_copy(skb, GFP_ATOMIC);
+ dev_kfree_skb_any(skb);
++ if (!new_skb) {
++ netdev_err(ndev, "skb alloc failed\n");
++ return;
++ }
+ skb = new_skb;
+
+ check_ok = 0;
--- /dev/null
+From foo@baz Sun Jan 10 11:18:58 AM CET 2021
+From: Stefan Chulski <stefanc@marvell.com>
+Date: Thu, 17 Dec 2020 20:30:17 +0200
+Subject: net: mvpp2: Add TCAM entry to drop flow control pause frames
+
+From: Stefan Chulski <stefanc@marvell.com>
+
+[ Upstream commit 3f48fab62bb81a7f9d01e9d43c40395fad011dd5 ]
+
+Issue:
+Flow control frame used to pause GoP(MAC) was delivered to the CPU
+and created a load on the CPU. Since XOFF/XON frames are used only
+by MAC, these frames should be dropped inside MAC.
+
+Fix:
+According to 802.3-2012 - IEEE Standard for Ethernet pause frame
+has unique destination MAC address 01-80-C2-00-00-01.
+Add TCAM parser entry to track and drop pause frames by destination MAC.
+
+Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
+Signed-off-by: Stefan Chulski <stefanc@marvell.com>
+Link: https://lore.kernel.org/r/1608229817-21951-1-git-send-email-stefanc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 33 +++++++++++++++++++++++++
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h | 2 -
+ 2 files changed, 34 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -405,6 +405,38 @@ static int mvpp2_prs_tcam_first_free(str
+ return -EINVAL;
+ }
+
++/* Drop flow control pause frames */
++static void mvpp2_prs_drop_fc(struct mvpp2 *priv)
++{
++ unsigned char da[ETH_ALEN] = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x01 };
++ struct mvpp2_prs_entry pe;
++ unsigned int len;
++
++ memset(&pe, 0, sizeof(pe));
++
++ /* For all ports - drop flow control frames */
++ pe.index = MVPP2_PE_FC_DROP;
++ mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC);
++
++ /* Set match on DA */
++ len = ETH_ALEN;
++ while (len--)
++ mvpp2_prs_tcam_data_byte_set(&pe, len, da[len], 0xff);
++
++ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_DROP_MASK,
++ MVPP2_PRS_RI_DROP_MASK);
++
++ mvpp2_prs_sram_bits_set(&pe, MVPP2_PRS_SRAM_LU_GEN_BIT, 1);
++ mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_FLOWS);
++
++ /* Mask all ports */
++ mvpp2_prs_tcam_port_map_set(&pe, MVPP2_PRS_PORT_MASK);
++
++ /* Update shadow table and hw entry */
++ mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_MAC);
++ mvpp2_prs_hw_write(priv, &pe);
++}
++
+ /* Enable/disable dropping all mac da's */
+ static void mvpp2_prs_mac_drop_all_set(struct mvpp2 *priv, int port, bool add)
+ {
+@@ -1162,6 +1194,7 @@ static void mvpp2_prs_mac_init(struct mv
+ mvpp2_prs_hw_write(priv, &pe);
+
+ /* Create dummy entries for drop all and promiscuous modes */
++ mvpp2_prs_drop_fc(priv);
+ mvpp2_prs_mac_drop_all_set(priv, 0, false);
+ mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_UNI_CAST, false);
+ mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_MULTI_CAST, false);
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h
+@@ -129,7 +129,7 @@
+ #define MVPP2_PE_VID_EDSA_FLTR_DEFAULT (MVPP2_PRS_TCAM_SRAM_SIZE - 7)
+ #define MVPP2_PE_VLAN_DBL (MVPP2_PRS_TCAM_SRAM_SIZE - 6)
+ #define MVPP2_PE_VLAN_NONE (MVPP2_PRS_TCAM_SRAM_SIZE - 5)
+-/* reserved */
++#define MVPP2_PE_FC_DROP (MVPP2_PRS_TCAM_SRAM_SIZE - 4)
+ #define MVPP2_PE_MAC_MC_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 3)
+ #define MVPP2_PE_MAC_UC_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 2)
+ #define MVPP2_PE_MAC_NON_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 1)
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Stefan Chulski <stefanc@marvell.com>
+Date: Sun, 20 Dec 2020 13:02:29 +0200
+Subject: net: mvpp2: Fix GoP port 3 Networking Complex Control configurations
+
+From: Stefan Chulski <stefanc@marvell.com>
+
+[ Upstream commit 2575bc1aa9d52a62342b57a0b7d0a12146cf6aed ]
+
+During GoP port 2 Networking Complex Control mode of operation configurations,
+also GoP port 3 mode of operation was wrongly set.
+Patch removes these configurations.
+
+Fixes: f84bf386f395 ("net: mvpp2: initialize the GoP")
+Acked-by: Marcin Wojtas <mw@semihalf.com>
+Signed-off-by: Stefan Chulski <stefanc@marvell.com>
+Link: https://lore.kernel.org/r/1608462149-1702-1-git-send-email-stefanc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -1231,7 +1231,7 @@ static void mvpp22_gop_init_rgmii(struct
+
+ regmap_read(priv->sysctrl_base, GENCONF_CTRL0, &val);
+ if (port->gop_id == 2)
+- val |= GENCONF_CTRL0_PORT0_RGMII | GENCONF_CTRL0_PORT1_RGMII;
++ val |= GENCONF_CTRL0_PORT0_RGMII;
+ else if (port->gop_id == 3)
+ val |= GENCONF_CTRL0_PORT1_RGMII_MII;
+ regmap_write(priv->sysctrl_base, GENCONF_CTRL0, val);
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Stefan Chulski <stefanc@marvell.com>
+Date: Wed, 23 Dec 2020 20:35:21 +0200
+Subject: net: mvpp2: fix pkt coalescing int-threshold configuration
+
+From: Stefan Chulski <stefanc@marvell.com>
+
+[ Upstream commit 4f374d2c43a9e5e773f1dee56db63bd6b8a36276 ]
+
+The packet coalescing interrupt threshold has separated registers
+for different aggregated/cpu (sw-thread). The required value should
+be loaded for every thread but not only for 1 current cpu.
+
+Fixes: 213f428f5056 ("net: mvpp2: add support for TX interrupts and RX queue distribution modes")
+Signed-off-by: Stefan Chulski <stefanc@marvell.com>
+Link: https://lore.kernel.org/r/1608748521-11033-1-git-send-email-stefanc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -2370,17 +2370,18 @@ static void mvpp2_rx_pkts_coal_set(struc
+ static void mvpp2_tx_pkts_coal_set(struct mvpp2_port *port,
+ struct mvpp2_tx_queue *txq)
+ {
+- unsigned int thread = mvpp2_cpu_to_thread(port->priv, get_cpu());
++ unsigned int thread;
+ u32 val;
+
+ if (txq->done_pkts_coal > MVPP2_TXQ_THRESH_MASK)
+ txq->done_pkts_coal = MVPP2_TXQ_THRESH_MASK;
+
+ val = (txq->done_pkts_coal << MVPP2_TXQ_THRESH_OFFSET);
+- mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_NUM_REG, txq->id);
+- mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_THRESH_REG, val);
+-
+- put_cpu();
++ /* PKT-coalescing registers are per-queue + per-thread */
++ for (thread = 0; thread < MVPP2_MAX_THREADS; thread++) {
++ mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_NUM_REG, txq->id);
++ mvpp2_thread_write(port->priv, thread, MVPP2_TXQ_THRESH_REG, val);
++ }
+ }
+
+ static u32 mvpp2_usec_to_cycles(u32 usec, unsigned long clk_hz)
--- /dev/null
+From foo@baz Sun Jan 10 11:18:58 AM CET 2021
+From: Stefan Chulski <stefanc@marvell.com>
+Date: Thu, 17 Dec 2020 20:37:46 +0200
+Subject: net: mvpp2: prs: fix PPPoE with ipv6 packet parse
+
+From: Stefan Chulski <stefanc@marvell.com>
+
+[ Upstream commit fec6079b2eeab319d9e3d074f54d3b6f623e9701 ]
+
+Current PPPoE+IPv6 entry is jumping to 'next-hdr'
+field and not to 'DIP' field as done for IPv4.
+
+Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
+Reported-by: Liron Himi <lironh@marvell.com>
+Signed-off-by: Stefan Chulski <stefanc@marvell.com>
+Link: https://lore.kernel.org/r/1608230266-22111-1-git-send-email-stefanc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -1680,8 +1680,9 @@ static int mvpp2_prs_pppoe_init(struct m
+ mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP6);
+ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP6,
+ MVPP2_PRS_RI_L3_PROTO_MASK);
+- /* Skip eth_type + 4 bytes of IPv6 header */
+- mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 4,
++ /* Jump to DIP of IPV6 header */
++ mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 8 +
++ MVPP2_MAX_L3_ADDR_SIZE,
+ MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD);
+ /* Set L3 offset */
+ mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3,
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: John Wang <wangzhiqiang.bj@bytedance.com>
+Date: Wed, 23 Dec 2020 13:55:23 +0800
+Subject: net/ncsi: Use real net-device for response handler
+
+From: John Wang <wangzhiqiang.bj@bytedance.com>
+
+[ Upstream commit 427c940558560bff2583d07fc119a21094675982 ]
+
+When aggregating ncsi interfaces and dedicated interfaces to bond
+interfaces, the ncsi response handler will use the wrong net device to
+find ncsi_dev, so that the ncsi interface will not work properly.
+Here, we use the original net device to fix it.
+
+Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler")
+Signed-off-by: John Wang <wangzhiqiang.bj@bytedance.com>
+Link: https://lore.kernel.org/r/20201223055523.2069-1-wangzhiqiang.bj@bytedance.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ncsi/ncsi-rsp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ncsi/ncsi-rsp.c
++++ b/net/ncsi/ncsi-rsp.c
+@@ -1120,7 +1120,7 @@ int ncsi_rcv_rsp(struct sk_buff *skb, st
+ int payload, i, ret;
+
+ /* Find the NCSI device */
+- nd = ncsi_find_dev(dev);
++ nd = ncsi_find_dev(orig_dev);
+ ndp = nd ? TO_NCSI_DEV_PRIV(nd) : NULL;
+ if (!ndp)
+ return -ENODEV;
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Thu, 24 Dec 2020 22:23:44 -0800
+Subject: net: sched: prevent invalid Scell_log shift count
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit bd1248f1ddbc48b0c30565fce897a3b6423313b8 ]
+
+Check Scell_log shift size in red_check_params() and modify all callers
+of red_check_params() to pass Scell_log.
+
+This prevents a shift out-of-bounds as detected by UBSAN:
+ UBSAN: shift-out-of-bounds in ./include/net/red.h:252:22
+ shift exponent 72 is too large for 32-bit type 'int'
+
+Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: syzbot+97c5bd9cc81eca63d36e@syzkaller.appspotmail.com
+Cc: Nogah Frankel <nogahf@mellanox.com>
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Cong Wang <xiyou.wangcong@gmail.com>
+Cc: Jiri Pirko <jiri@resnulli.us>
+Cc: netdev@vger.kernel.org
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/red.h | 4 +++-
+ net/sched/sch_choke.c | 2 +-
+ net/sched/sch_gred.c | 2 +-
+ net/sched/sch_red.c | 2 +-
+ net/sched/sch_sfq.c | 2 +-
+ 5 files changed, 7 insertions(+), 5 deletions(-)
+
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -168,12 +168,14 @@ static inline void red_set_vars(struct r
+ v->qcount = -1;
+ }
+
+-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog)
++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log)
+ {
+ if (fls(qth_min) + Wlog > 32)
+ return false;
+ if (fls(qth_max) + Wlog > 32)
+ return false;
++ if (Scell_log >= 32)
++ return false;
+ if (qth_max < qth_min)
+ return false;
+ return true;
+--- a/net/sched/sch_choke.c
++++ b/net/sched/sch_choke.c
+@@ -362,7 +362,7 @@ static int choke_change(struct Qdisc *sc
+
+ ctl = nla_data(tb[TCA_CHOKE_PARMS]);
+
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+ return -EINVAL;
+
+ if (ctl->limit > CHOKE_MAX_QUEUE)
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -480,7 +480,7 @@ static inline int gred_change_vq(struct
+ struct gred_sched *table = qdisc_priv(sch);
+ struct gred_sched_data *q = table->tab[dp];
+
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) {
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) {
+ NL_SET_ERR_MSG_MOD(extack, "invalid RED parameters");
+ return -EINVAL;
+ }
+--- a/net/sched/sch_red.c
++++ b/net/sched/sch_red.c
+@@ -250,7 +250,7 @@ static int __red_change(struct Qdisc *sc
+ max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0;
+
+ ctl = nla_data(tb[TCA_RED_PARMS]);
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+ return -EINVAL;
+
+ err = red_get_flags(ctl->flags, TC_RED_HISTORIC_FLAGS,
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -647,7 +647,7 @@ static int sfq_change(struct Qdisc *sch,
+ }
+
+ if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
+- ctl_v1->Wlog))
++ ctl_v1->Wlog, ctl_v1->Scell_log))
+ return -EINVAL;
+ if (ctl_v1 && ctl_v1->qth_min) {
+ p = kmalloc(sizeof(*p), GFP_KERNEL);
--- /dev/null
+From foo@baz Sun Jan 10 11:18:58 AM CET 2021
+From: Davide Caratti <dcaratti@redhat.com>
+Date: Thu, 17 Dec 2020 22:29:46 +0100
+Subject: net/sched: sch_taprio: ensure to reset/destroy all child qdiscs
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+[ Upstream commit 698285da79f5b0b099db15a37ac661ac408c80eb ]
+
+taprio_graft() can insert a NULL element in the array of child qdiscs. As
+a consquence, taprio_reset() might not reset child qdiscs completely, and
+taprio_destroy() might leak resources. Fix it by ensuring that loops that
+iterate over q->qdiscs[] don't end when they find the first NULL item.
+
+Fixes: 44d4775ca518 ("net/sched: sch_taprio: reset child qdiscs before freeing them")
+Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler")
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Link: https://lore.kernel.org/r/13edef6778fef03adc751582562fba4a13e06d6a.1608240532.git.dcaratti@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_taprio.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/net/sched/sch_taprio.c
++++ b/net/sched/sch_taprio.c
+@@ -1604,8 +1604,9 @@ static void taprio_reset(struct Qdisc *s
+
+ hrtimer_cancel(&q->advance_timer);
+ if (q->qdiscs) {
+- for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++)
+- qdisc_reset(q->qdiscs[i]);
++ for (i = 0; i < dev->num_tx_queues; i++)
++ if (q->qdiscs[i])
++ qdisc_reset(q->qdiscs[i]);
+ }
+ sch->qstats.backlog = 0;
+ sch->q.qlen = 0;
+@@ -1625,7 +1626,7 @@ static void taprio_destroy(struct Qdisc
+ taprio_disable_offload(dev, q, NULL);
+
+ if (q->qdiscs) {
+- for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++)
++ for (i = 0; i < dev->num_tx_queues; i++)
+ qdisc_put(q->qdiscs[i]);
+
+ kfree(q->qdiscs);
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Sat, 19 Dec 2020 14:50:36 +0100
+Subject: net: stmmac: dwmac-meson8b: ignore the second clock input
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit f87777a3c30cf50c66a20e1d153f0e003bb30774 ]
+
+The dwmac glue registers on Amlogic Meson8b and newer SoCs has two clock
+inputs:
+- Meson8b and Meson8m2: MPLL2 and MPLL2 (the same parent is wired to
+ both inputs)
+- GXBB, GXL, GXM, AXG, G12A, G12B, SM1: FCLK_DIV2 and MPLL2
+
+All known vendor kernels and u-boots are using the first input only. We
+let the common clock framework automatically choose the "right" parent.
+For some boards this causes a problem though, specificially with G12A and
+newer SoCs. The clock input is used for generating the 125MHz RGMII TX
+clock. For the two input clocks this means on G12A:
+- FCLK_DIV2: 999999985Hz / 8 = 124999998.125Hz
+- MPLL2: 499999993Hz / 4 = 124999998.25Hz
+
+In theory MPLL2 is the "better" clock input because it's gets us 0.125Hz
+closer to the requested frequency than FCLK_DIV2. In reality however
+there is a resource conflict because MPLL2 is needed to generate some of
+the audio clocks. dwmac-meson8b probes first and sets up the clock tree
+with MPLL2. This works fine until the audio driver comes and "steals"
+the MPLL2 clocks and configures it with it's own rate (294909637Hz). The
+common clock framework happily changes the MPLL2 rate but does not
+reconfigure our RGMII TX clock tree, which then ends up at 73727409Hz,
+which is more than 40% off the requested 125MHz.
+
+Don't use the second clock input for now to force the common clock
+framework to always select the first parent. This mimics the behavior
+from the vendor driver and fixes the clock resource conflict with the
+audio driver on G12A boards. Once the common clock framework can handle
+this situation this change can be reverted again.
+
+Fixes: 566e8251625304 ("net: stmmac: add a glue driver for the Amlogic Meson 8b / GXBB DWMAC")
+Reported-by: Thomas Graichen <thomas.graichen@gmail.com>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Tested-by: thomas graichen <thomas.graichen@gmail.com>
+Link: https://lore.kernel.org/r/20201219135036.3216017-1-martin.blumenstingl@googlemail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+@@ -135,7 +135,7 @@ static int meson8b_init_rgmii_tx_clk(str
+ struct device *dev = dwmac->dev;
+ static const struct clk_parent_data mux_parents[] = {
+ { .fw_name = "clkin0", },
+- { .fw_name = "clkin1", },
++ { .index = -1, },
+ };
+ static const struct clk_div_table div_table[] = {
+ { .div = 2, .val = 2, },
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Antoine Tenart <atenart@kernel.org>
+Date: Wed, 23 Dec 2020 22:23:21 +0100
+Subject: net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit fb25038586d0064123e393cadf1fadd70a9df97a ]
+
+Accesses to dev->xps_cpus_map (when using dev->num_tc) should be
+protected by the rtnl lock, like we do for netif_set_xps_queue. I didn't
+see an actual bug being triggered, but let's be safe here and take the
+rtnl lock while accessing the map in sysfs.
+
+Fixes: 184c449f91fe ("net: Add support for XPS with QoS via traffic classes")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 29 ++++++++++++++++++++++-------
+ 1 file changed, 22 insertions(+), 7 deletions(-)
+
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1317,8 +1317,8 @@ static const struct attribute_group dql_
+ static ssize_t xps_cpus_show(struct netdev_queue *queue,
+ char *buf)
+ {
++ int cpu, len, ret, num_tc = 1, tc = 0;
+ struct net_device *dev = queue->dev;
+- int cpu, len, num_tc = 1, tc = 0;
+ struct xps_dev_maps *dev_maps;
+ cpumask_var_t mask;
+ unsigned long index;
+@@ -1328,22 +1328,31 @@ static ssize_t xps_cpus_show(struct netd
+
+ index = get_netdev_queue_index(queue);
+
++ if (!rtnl_trylock())
++ return restart_syscall();
++
+ if (dev->num_tc) {
+ /* Do not allow XPS on subordinate device directly */
+ num_tc = dev->num_tc;
+- if (num_tc < 0)
+- return -EINVAL;
++ if (num_tc < 0) {
++ ret = -EINVAL;
++ goto err_rtnl_unlock;
++ }
+
+ /* If queue belongs to subordinate dev use its map */
+ dev = netdev_get_tx_queue(dev, index)->sb_dev ? : dev;
+
+ tc = netdev_txq_to_tc(dev, index);
+- if (tc < 0)
+- return -EINVAL;
++ if (tc < 0) {
++ ret = -EINVAL;
++ goto err_rtnl_unlock;
++ }
+ }
+
+- if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+- return -ENOMEM;
++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) {
++ ret = -ENOMEM;
++ goto err_rtnl_unlock;
++ }
+
+ rcu_read_lock();
+ dev_maps = rcu_dereference(dev->xps_cpus_map);
+@@ -1366,9 +1375,15 @@ static ssize_t xps_cpus_show(struct netd
+ }
+ rcu_read_unlock();
+
++ rtnl_unlock();
++
+ len = snprintf(buf, PAGE_SIZE, "%*pb\n", cpumask_pr_args(mask));
+ free_cpumask_var(mask);
+ return len < PAGE_SIZE ? len : -EINVAL;
++
++err_rtnl_unlock:
++ rtnl_unlock();
++ return ret;
+ }
+
+ static ssize_t xps_cpus_store(struct netdev_queue *queue,
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Antoine Tenart <atenart@kernel.org>
+Date: Wed, 23 Dec 2020 22:23:23 +0100
+Subject: net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit 4ae2bb81649dc03dfc95875f02126b14b773f7ab ]
+
+Accesses to dev->xps_rxqs_map (when using dev->num_tc) should be
+protected by the rtnl lock, like we do for netif_set_xps_queue. I didn't
+see an actual bug being triggered, but let's be safe here and take the
+rtnl lock while accessing the map in sysfs.
+
+Fixes: 8af2c06ff4b1 ("net-sysfs: Add interface for Rx queue(s) map per Tx queue")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1429,22 +1429,29 @@ static struct netdev_queue_attribute xps
+
+ static ssize_t xps_rxqs_show(struct netdev_queue *queue, char *buf)
+ {
++ int j, len, ret, num_tc = 1, tc = 0;
+ struct net_device *dev = queue->dev;
+ struct xps_dev_maps *dev_maps;
+ unsigned long *mask, index;
+- int j, len, num_tc = 1, tc = 0;
+
+ index = get_netdev_queue_index(queue);
+
++ if (!rtnl_trylock())
++ return restart_syscall();
++
+ if (dev->num_tc) {
+ num_tc = dev->num_tc;
+ tc = netdev_txq_to_tc(dev, index);
+- if (tc < 0)
+- return -EINVAL;
++ if (tc < 0) {
++ ret = -EINVAL;
++ goto err_rtnl_unlock;
++ }
+ }
+ mask = bitmap_zalloc(dev->num_rx_queues, GFP_KERNEL);
+- if (!mask)
+- return -ENOMEM;
++ if (!mask) {
++ ret = -ENOMEM;
++ goto err_rtnl_unlock;
++ }
+
+ rcu_read_lock();
+ dev_maps = rcu_dereference(dev->xps_rxqs_map);
+@@ -1470,10 +1477,16 @@ static ssize_t xps_rxqs_show(struct netd
+ out_no_maps:
+ rcu_read_unlock();
+
++ rtnl_unlock();
++
+ len = bitmap_print_to_pagebuf(false, buf, mask, dev->num_rx_queues);
+ bitmap_free(mask);
+
+ return len < PAGE_SIZE ? len : -EINVAL;
++
++err_rtnl_unlock:
++ rtnl_unlock();
++ return ret;
+ }
+
+ static ssize_t xps_rxqs_store(struct netdev_queue *queue, const char *buf,
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Antoine Tenart <atenart@kernel.org>
+Date: Wed, 23 Dec 2020 22:23:20 +0100
+Subject: net-sysfs: take the rtnl lock when storing xps_cpus
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit 1ad58225dba3f2f598d2c6daed4323f24547168f ]
+
+Two race conditions can be triggered when storing xps cpus, resulting in
+various oops and invalid memory accesses:
+
+1. Calling netdev_set_num_tc while netif_set_xps_queue:
+
+ - netif_set_xps_queue uses dev->tc_num as one of the parameters to
+ compute the size of new_dev_maps when allocating it. dev->tc_num is
+ also used to access the map, and the compiler may generate code to
+ retrieve this field multiple times in the function.
+
+ - netdev_set_num_tc sets dev->tc_num.
+
+ If new_dev_maps is allocated using dev->tc_num and then dev->tc_num
+ is set to a higher value through netdev_set_num_tc, later accesses to
+ new_dev_maps in netif_set_xps_queue could lead to accessing memory
+ outside of new_dev_maps; triggering an oops.
+
+2. Calling netif_set_xps_queue while netdev_set_num_tc is running:
+
+ 2.1. netdev_set_num_tc starts by resetting the xps queues,
+ dev->tc_num isn't updated yet.
+
+ 2.2. netif_set_xps_queue is called, setting up the map with the
+ *old* dev->num_tc.
+
+ 2.3. netdev_set_num_tc updates dev->tc_num.
+
+ 2.4. Later accesses to the map lead to out of bound accesses and
+ oops.
+
+ A similar issue can be found with netdev_reset_tc.
+
+One way of triggering this is to set an iface up (for which the driver
+uses netdev_set_num_tc in the open path, such as bnx2x) and writing to
+xps_cpus in a concurrent thread. With the right timing an oops is
+triggered.
+
+Both issues have the same fix: netif_set_xps_queue, netdev_set_num_tc
+and netdev_reset_tc should be mutually exclusive. We do that by taking
+the rtnl lock in xps_cpus_store.
+
+Fixes: 184c449f91fe ("net: Add support for XPS with QoS via traffic classes")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1396,7 +1396,13 @@ static ssize_t xps_cpus_store(struct net
+ return err;
+ }
+
++ if (!rtnl_trylock()) {
++ free_cpumask_var(mask);
++ return restart_syscall();
++ }
++
+ err = netif_set_xps_queue(dev, mask, index);
++ rtnl_unlock();
+
+ free_cpumask_var(mask);
+
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Antoine Tenart <atenart@kernel.org>
+Date: Wed, 23 Dec 2020 22:23:22 +0100
+Subject: net-sysfs: take the rtnl lock when storing xps_rxqs
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit 2d57b4f142e0b03e854612b8e28978935414bced ]
+
+Two race conditions can be triggered when storing xps rxqs, resulting in
+various oops and invalid memory accesses:
+
+1. Calling netdev_set_num_tc while netif_set_xps_queue:
+
+ - netif_set_xps_queue uses dev->tc_num as one of the parameters to
+ compute the size of new_dev_maps when allocating it. dev->tc_num is
+ also used to access the map, and the compiler may generate code to
+ retrieve this field multiple times in the function.
+
+ - netdev_set_num_tc sets dev->tc_num.
+
+ If new_dev_maps is allocated using dev->tc_num and then dev->tc_num
+ is set to a higher value through netdev_set_num_tc, later accesses to
+ new_dev_maps in netif_set_xps_queue could lead to accessing memory
+ outside of new_dev_maps; triggering an oops.
+
+2. Calling netif_set_xps_queue while netdev_set_num_tc is running:
+
+ 2.1. netdev_set_num_tc starts by resetting the xps queues,
+ dev->tc_num isn't updated yet.
+
+ 2.2. netif_set_xps_queue is called, setting up the map with the
+ *old* dev->num_tc.
+
+ 2.3. netdev_set_num_tc updates dev->tc_num.
+
+ 2.4. Later accesses to the map lead to out of bound accesses and
+ oops.
+
+ A similar issue can be found with netdev_reset_tc.
+
+One way of triggering this is to set an iface up (for which the driver
+uses netdev_set_num_tc in the open path, such as bnx2x) and writing to
+xps_rxqs in a concurrent thread. With the right timing an oops is
+triggered.
+
+Both issues have the same fix: netif_set_xps_queue, netdev_set_num_tc
+and netdev_reset_tc should be mutually exclusive. We do that by taking
+the rtnl lock in xps_rxqs_store.
+
+Fixes: 8af2c06ff4b1 ("net-sysfs: Add interface for Rx queue(s) map per Tx queue")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/net-sysfs.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1499,10 +1499,17 @@ static ssize_t xps_rxqs_store(struct net
+ return err;
+ }
+
++ if (!rtnl_trylock()) {
++ bitmap_free(mask);
++ return restart_syscall();
++ }
++
+ cpus_read_lock();
+ err = __netif_set_xps_queue(dev, mask, index, true);
+ cpus_read_unlock();
+
++ rtnl_unlock();
++
+ bitmap_free(mask);
+ return err ? : len;
+ }
--- /dev/null
+From foo@baz Sun Jan 10 11:18:58 AM CET 2021
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 18 Dec 2020 09:38:43 -0800
+Subject: net: systemport: set dev->max_mtu to UMAC_MAX_MTU_SIZE
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 54ddbdb024882e226055cc4c3c246592ddde2ee5 ]
+
+The driver is already allocating receive buffers of 2KiB and the
+Ethernet MAC is configured to accept frames up to UMAC_MAX_MTU_SIZE.
+
+Fixes: bfcb813203e6 ("net: dsa: configure the MTU for switch ports")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://lore.kernel.org/r/20201218173843.141046-1-f.fainelli@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2577,6 +2577,7 @@ static int bcm_sysport_probe(struct plat
+ NETIF_F_HW_VLAN_CTAG_TX;
+ dev->hw_features |= dev->features;
+ dev->vlan_features |= dev->features;
++ dev->max_mtu = UMAC_MAX_MTU_SIZE;
+
+ /* Request the WOL interrupt and advertise suspend if available */
+ priv->wol_irq_disabled = 1;
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: "Bjørn Mork" <bjorn@mork.no>
+Date: Wed, 30 Dec 2020 16:24:51 +0100
+Subject: net: usb: qmi_wwan: add Quectel EM160R-GL
+
+From: "Bjørn Mork" <bjorn@mork.no>
+
+[ Upstream commit cfd82dfc9799c53ef109343a23af006a0f6860a9 ]
+
+New modem using ff/ff/30 for QCDM, ff/00/00 for AT and NMEA,
+and ff/ff/ff for RMNET/QMI.
+
+T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
+D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1
+P: Vendor=2c7c ProdID=0620 Rev= 4.09
+S: Manufacturer=Quectel
+S: Product=EM160R-GL
+S: SerialNumber=e31cedc1
+C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none)
+E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20201230152451.245271-1-bjorn@mork.no
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1036,6 +1036,7 @@ static const struct usb_device_id produc
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
++ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)}, /* Quectel EM160R-GL */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */
+
+ /* 3. Combined interface devices matching on interface number */
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Manish Chopra <manishc@marvell.com>
+Date: Mon, 21 Dec 2020 06:55:30 -0800
+Subject: qede: fix offload for IPIP tunnel packets
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit 5d5647dad259bb416fd5d3d87012760386d97530 ]
+
+IPIP tunnels packets are unknown to device,
+hence these packets are incorrectly parsed and
+caused the packet corruption, so disable offlods
+for such packets at run time.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Sudarsana Kalluru <skalluru@marvell.com>
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Link: https://lore.kernel.org/r/20201221145530.7771-1-manishc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+@@ -1799,6 +1799,11 @@ netdev_features_t qede_features_check(st
+ ntohs(udp_hdr(skb)->dest) != gnv_port))
+ return features & ~(NETIF_F_CSUM_MASK |
+ NETIF_F_GSO_MASK);
++ } else if (l4_proto == IPPROTO_IPIP) {
++ /* IPIP tunnels are unknown to the device or at least unsupported natively,
++ * offloads for them can't be done trivially, so disable them for such skb.
++ */
++ return features & ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
+ }
+ }
+
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 30 Dec 2020 19:33:34 +0100
+Subject: r8169: work around power-saving bug on some chip versions
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit e80bd76fbf563cc7ed8c9e9f3bbcdf59b0897f69 ]
+
+A user reported failing network with RTL8168dp (a quite rare chip
+version). Realtek confirmed that few chip versions suffer from a PLL
+power-down hw bug.
+
+Fixes: 07df5bd874f0 ("r8169: power down chip in probe")
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://lore.kernel.org/r/a1c39460-d533-7f9e-fa9d-2b8990b02426@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2243,7 +2243,8 @@ static void rtl_pll_power_down(struct rt
+ }
+
+ switch (tp->mac_version) {
+- case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33:
++ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26:
++ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33:
+ case RTL_GIGA_MAC_VER_37:
+ case RTL_GIGA_MAC_VER_39:
+ case RTL_GIGA_MAC_VER_43:
+@@ -2269,7 +2270,8 @@ static void rtl_pll_power_down(struct rt
+ static void rtl_pll_power_up(struct rtl8169_private *tp)
+ {
+ switch (tp->mac_version) {
+- case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33:
++ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26:
++ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33:
+ case RTL_GIGA_MAC_VER_37:
+ case RTL_GIGA_MAC_VER_39:
+ case RTL_GIGA_MAC_VER_43:
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Mario Limonciello <mario.limonciello@dell.com>
+Date: Mon, 14 Dec 2020 13:29:34 -0600
+Subject: Revert "e1000e: disable s0ix entry and exit flows for ME systems"
+
+From: Mario Limonciello <mario.limonciello@dell.com>
+
+[ Upstream commit 6cecf02e77ab9bf97e9252f9fcb8f0738a6de12c ]
+
+commit e086ba2fccda ("e1000e: disable s0ix entry and exit flows for ME
+systems") disabled s0ix flows for systems that have various incarnations of
+the i219-LM ethernet controller. This changed caused power consumption
+regressions on the following shipping Dell Comet Lake based laptops:
+* Latitude 5310
+* Latitude 5410
+* Latitude 5410
+* Latitude 5510
+* Precision 3550
+* Latitude 5411
+* Latitude 5511
+* Precision 3551
+* Precision 7550
+* Precision 7750
+
+This commit was introduced because of some regressions on certain Thinkpad
+laptops. This comment was potentially caused by an earlier
+commit 632fbd5eb5b0e ("e1000e: fix S0ix flows for cable connected case").
+or it was possibly caused by a system not meeting platform architectural
+requirements for low power consumption. Other changes made in the driver
+with extended timeouts are expected to make the driver more impervious to
+platform firmware behavior.
+
+Fixes: e086ba2fccda ("e1000e: disable s0ix entry and exit flows for ME systems")
+Reviewed-by: Alexander Duyck <alexander.duyck@gmail.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Yijun Shen <Yijun.shen@dell.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000e/netdev.c | 45 +----------------------------
+ 1 file changed, 2 insertions(+), 43 deletions(-)
+
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -103,45 +103,6 @@ static const struct e1000_reg_info e1000
+ {0, NULL}
+ };
+
+-struct e1000e_me_supported {
+- u16 device_id; /* supported device ID */
+-};
+-
+-static const struct e1000e_me_supported me_supported[] = {
+- {E1000_DEV_ID_PCH_LPT_I217_LM},
+- {E1000_DEV_ID_PCH_LPTLP_I218_LM},
+- {E1000_DEV_ID_PCH_I218_LM2},
+- {E1000_DEV_ID_PCH_I218_LM3},
+- {E1000_DEV_ID_PCH_SPT_I219_LM},
+- {E1000_DEV_ID_PCH_SPT_I219_LM2},
+- {E1000_DEV_ID_PCH_LBG_I219_LM3},
+- {E1000_DEV_ID_PCH_SPT_I219_LM4},
+- {E1000_DEV_ID_PCH_SPT_I219_LM5},
+- {E1000_DEV_ID_PCH_CNP_I219_LM6},
+- {E1000_DEV_ID_PCH_CNP_I219_LM7},
+- {E1000_DEV_ID_PCH_ICP_I219_LM8},
+- {E1000_DEV_ID_PCH_ICP_I219_LM9},
+- {E1000_DEV_ID_PCH_CMP_I219_LM10},
+- {E1000_DEV_ID_PCH_CMP_I219_LM11},
+- {E1000_DEV_ID_PCH_CMP_I219_LM12},
+- {E1000_DEV_ID_PCH_TGP_I219_LM13},
+- {E1000_DEV_ID_PCH_TGP_I219_LM14},
+- {E1000_DEV_ID_PCH_TGP_I219_LM15},
+- {0}
+-};
+-
+-static bool e1000e_check_me(u16 device_id)
+-{
+- struct e1000e_me_supported *id;
+-
+- for (id = (struct e1000e_me_supported *)me_supported;
+- id->device_id; id++)
+- if (device_id == id->device_id)
+- return true;
+-
+- return false;
+-}
+-
+ /**
+ * __ew32_prepare - prepare to write to MAC CSR register on certain parts
+ * @hw: pointer to the HW structure
+@@ -6974,8 +6935,7 @@ static __maybe_unused int e1000e_pm_susp
+ e1000e_pm_thaw(dev);
+ } else {
+ /* Introduce S0ix implementation */
+- if (hw->mac.type >= e1000_pch_cnp &&
+- !e1000e_check_me(hw->adapter->pdev->device))
++ if (hw->mac.type >= e1000_pch_cnp)
+ e1000e_s0ix_entry_flow(adapter);
+ }
+
+@@ -6991,8 +6951,7 @@ static __maybe_unused int e1000e_pm_resu
+ int rc;
+
+ /* Introduce S0ix implementation */
+- if (hw->mac.type >= e1000_pch_cnp &&
+- !e1000e_check_me(hw->adapter->pdev->device))
++ if (hw->mac.type >= e1000_pch_cnp)
+ e1000e_s0ix_exit_flow(adapter);
+
+ rc = __e1000_resume(pdev);
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Ido Schimmel <idosch@nvidia.com>
+Date: Wed, 30 Dec 2020 13:42:51 +0200
+Subject: selftests: mlxsw: Set headroom size of correct port
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 2ff2c7e274392871bfdee00ff2adbb8ebae5d240 ]
+
+The test was setting the headroom size of the wrong port. This was not
+visible because of a firmware bug that canceled this bug.
+
+Set the headroom size of the correct port, so that the test will pass
+with both old and new firmware versions.
+
+Fixes: bfa804784e32 ("selftests: mlxsw: Add a PFC test")
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Link: https://lore.kernel.org/r/20201230114251.394009-1-idosch@idosch.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/drivers/net/mlxsw/qos_pfc.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/drivers/net/mlxsw/qos_pfc.sh
++++ b/tools/testing/selftests/drivers/net/mlxsw/qos_pfc.sh
+@@ -230,7 +230,7 @@ switch_create()
+ __mlnx_qos -i $swp4 --pfc=0,1,0,0,0,0,0,0 >/dev/null
+ # PG0 will get autoconfigured to Xoff, give PG1 arbitrarily 100K, which
+ # is (-2*MTU) about 80K of delay provision.
+- __mlnx_qos -i $swp3 --buffer_size=0,$_100KB,0,0,0,0,0,0 >/dev/null
++ __mlnx_qos -i $swp4 --buffer_size=0,$_100KB,0,0,0,0,0,0 >/dev/null
+
+ # bridges
+ # -------
+i40e-fix-error-i40e_aq_rc_einval-when-removing-vfs.patch
+iavf-fix-double-release-of-rtnl_lock.patch
+net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch
+net-mvpp2-add-tcam-entry-to-drop-flow-control-pause-frames.patch
+net-mvpp2-prs-fix-pppoe-with-ipv6-packet-parse.patch
+net-systemport-set-dev-max_mtu-to-umac_max_mtu_size.patch
+ethernet-ucc_geth-fix-use-after-free-in-ucc_geth_remove.patch
+ethernet-ucc_geth-set-dev-max_mtu-to-1518.patch
+ionic-account-for-vlan-tag-len-in-rx-buffer-len.patch
+atm-idt77252-call-pci_disable_device-on-error-path.patch
+net-mvpp2-fix-gop-port-3-networking-complex-control-configurations.patch
+net-stmmac-dwmac-meson8b-ignore-the-second-clock-input.patch
+ibmvnic-fix-login-buffer-memory-leak.patch
+ibmvnic-continue-fatal-error-reset-after-passive-init.patch
+net-ethernet-mvneta-fix-error-handling-in-mvneta_probe.patch
+qede-fix-offload-for-ipip-tunnel-packets.patch
+virtio_net-fix-recursive-call-to-cpus_read_lock.patch
+net-dcb-validate-netlink-message-in-dcb-handler.patch
+net-ncsi-use-real-net-device-for-response-handler.patch
+net-ethernet-fix-memleak-in-ethoc_probe.patch
+net-sysfs-take-the-rtnl-lock-when-storing-xps_cpus.patch
+net-sysfs-take-the-rtnl-lock-when-accessing-xps_cpus_map-and-num_tc.patch
+net-sysfs-take-the-rtnl-lock-when-storing-xps_rxqs.patch
+net-sysfs-take-the-rtnl-lock-when-accessing-xps_rxqs_map-and-num_tc.patch
+net-ethernet-ti-cpts-fix-ethtool-output-when-no-ptp_clock-registered.patch
+tun-fix-return-value-when-the-number-of-iovs-exceeds-max_skb_frags.patch
+e1000e-only-run-s0ix-flows-if-shutdown-succeeded.patch
+e1000e-bump-up-timeout-to-wait-when-me-un-configures-ulp-mode.patch
+revert-e1000e-disable-s0ix-entry-and-exit-flows-for-me-systems.patch
+e1000e-export-s0ix-flags-to-ethtool.patch
+bnxt_en-check-tqm-rings-for-maximum-supported-value.patch
+net-mvpp2-fix-pkt-coalescing-int-threshold-configuration.patch
+bnxt_en-fix-aer-recovery.patch
+ipv4-ignore-ecn-bits-for-fib-lookups-in-fib_compute_spec_dst.patch
+net-sched-prevent-invalid-scell_log-shift-count.patch
+net-hns-fix-return-value-check-in-__lb_other_process.patch
+erspan-fix-version-1-check-in-gre_parse_header.patch
+net-hdlc_ppp-fix-issues-when-mod_timer-is-called-while-timer-is-running.patch
+bareudp-set-netif_f_lltx-flag.patch
+bareudp-fix-use-of-incorrect-min_headroom-size.patch
+vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch
+r8169-work-around-power-saving-bug-on-some-chip-versions.patch
+net-dsa-lantiq_gswip-enable-gswip_mii_cfg_en-also-for-internal-phys.patch
+net-dsa-lantiq_gswip-fix-gswip_mii_cfg-p-register-access.patch
+cdc-ncm-remove-connected-log-message.patch
+ibmvnic-fix-null-pointer-dereference.patch
+net-usb-qmi_wwan-add-quectel-em160r-gl.patch
+selftests-mlxsw-set-headroom-size-of-correct-port.patch
+stmmac-intel-add-pci-ids-for-tgl-h-platform.patch
selftests-vm-fix-building-protection-keys-test.patch
block-add-debugfs-stanza-for-queue_flag_nowait.patch
workqueue-kick-a-worker-based-on-the-actual-activati.patch
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Noor Azura Ahmad Tarmizi <noor.azura.ahmad.tarmizi@intel.com>
+Date: Wed, 23 Dec 2020 00:03:37 +0800
+Subject: stmmac: intel: Add PCI IDs for TGL-H platform
+
+From: Noor Azura Ahmad Tarmizi <noor.azura.ahmad.tarmizi@intel.com>
+
+[ Upstream commit 8450e23f142f629e40bd67afc8375c86c7fbf8f1 ]
+
+Add TGL-H PCI info and PCI IDs for the new TSN Controller to the list
+of supported devices.
+
+Signed-off-by: Noor Azura Ahmad Tarmizi <noor.azura.ahmad.tarmizi@intel.com>
+Signed-off-by: Voon Weifeng <weifeng.voon@intel.com>
+Signed-off-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
+Link: https://lore.kernel.org/r/20201222160337.30870-1-muhammad.husaini.zulkifli@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c
+@@ -725,6 +725,8 @@ static SIMPLE_DEV_PM_OPS(intel_eth_pm_op
+ #define PCI_DEVICE_ID_INTEL_EHL_PSE1_RGMII1G_ID 0x4bb0
+ #define PCI_DEVICE_ID_INTEL_EHL_PSE1_SGMII1G_ID 0x4bb1
+ #define PCI_DEVICE_ID_INTEL_EHL_PSE1_SGMII2G5_ID 0x4bb2
++#define PCI_DEVICE_ID_INTEL_TGLH_SGMII1G_0_ID 0x43ac
++#define PCI_DEVICE_ID_INTEL_TGLH_SGMII1G_1_ID 0x43a2
+ #define PCI_DEVICE_ID_INTEL_TGL_SGMII1G_ID 0xa0ac
+
+ static const struct pci_device_id intel_eth_pci_id_table[] = {
+@@ -739,6 +741,8 @@ static const struct pci_device_id intel_
+ { PCI_DEVICE_DATA(INTEL, EHL_PSE1_SGMII1G_ID, &ehl_pse1_sgmii1g_info) },
+ { PCI_DEVICE_DATA(INTEL, EHL_PSE1_SGMII2G5_ID, &ehl_pse1_sgmii1g_info) },
+ { PCI_DEVICE_DATA(INTEL, TGL_SGMII1G_ID, &tgl_sgmii1g_info) },
++ { PCI_DEVICE_DATA(INTEL, TGLH_SGMII1G_0_ID, &tgl_sgmii1g_info) },
++ { PCI_DEVICE_DATA(INTEL, TGLH_SGMII1G_1_ID, &tgl_sgmii1g_info) },
+ {}
+ };
+ MODULE_DEVICE_TABLE(pci, intel_eth_pci_id_table);
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Yunjian Wang <wangyunjian@huawei.com>
+Date: Fri, 25 Dec 2020 10:52:16 +0800
+Subject: tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS
+
+From: Yunjian Wang <wangyunjian@huawei.com>
+
+[ Upstream commit 950271d7cc0b4546af3549d8143c4132d6e1f138 ]
+
+Currently the tun_napi_alloc_frags() function returns -ENOMEM when the
+number of iovs exceeds MAX_SKB_FRAGS + 1. However this is inappropriate,
+we should use -EMSGSIZE instead of -ENOMEM.
+
+The following distinctions are matters:
+1. the caller need to drop the bad packet when -EMSGSIZE is returned,
+ which means meeting a persistent failure.
+2. the caller can try again when -ENOMEM is returned, which means
+ meeting a transient failure.
+
+Fixes: 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver")
+Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Link: https://lore.kernel.org/r/1608864736-24332-1-git-send-email-wangyunjian@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/tun.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1401,7 +1401,7 @@ static struct sk_buff *tun_napi_alloc_fr
+ int i;
+
+ if (it->nr_segs > MAX_SKB_FRAGS + 1)
+- return ERR_PTR(-ENOMEM);
++ return ERR_PTR(-EMSGSIZE);
+
+ local_bh_disable();
+ skb = napi_get_frags(&tfile->napi);
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Yunjian Wang <wangyunjian@huawei.com>
+Date: Tue, 29 Dec 2020 10:01:48 +0800
+Subject: vhost_net: fix ubuf refcount incorrectly when sendmsg fails
+
+From: Yunjian Wang <wangyunjian@huawei.com>
+
+[ Upstream commit 01e31bea7e622f1890c274f4aaaaf8bccd296aa5 ]
+
+Currently the vhost_zerocopy_callback() maybe be called to decrease
+the refcount when sendmsg fails in tun. The error handling in vhost
+handle_tx_zerocopy() will try to decrease the same refcount again.
+This is wrong. To fix this issue, we only call vhost_net_ubuf_put()
+when vq->heads[nvq->desc].len == VHOST_DMA_IN_PROGRESS.
+
+Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support")
+Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://lore.kernel.org/r/1609207308-20544-1-git-send-email-wangyunjian@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vhost/net.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -863,6 +863,7 @@ static void handle_tx_zerocopy(struct vh
+ size_t len, total_len = 0;
+ int err;
+ struct vhost_net_ubuf_ref *ubufs;
++ struct ubuf_info *ubuf;
+ bool zcopy_used;
+ int sent_pkts = 0;
+
+@@ -895,9 +896,7 @@ static void handle_tx_zerocopy(struct vh
+
+ /* use msg_control to pass vhost zerocopy ubuf info to skb */
+ if (zcopy_used) {
+- struct ubuf_info *ubuf;
+ ubuf = nvq->ubuf_info + nvq->upend_idx;
+-
+ vq->heads[nvq->upend_idx].id = cpu_to_vhost32(vq, head);
+ vq->heads[nvq->upend_idx].len = VHOST_DMA_IN_PROGRESS;
+ ubuf->callback = vhost_zerocopy_callback;
+@@ -927,7 +926,8 @@ static void handle_tx_zerocopy(struct vh
+ err = sock->ops->sendmsg(sock, &msg, len);
+ if (unlikely(err < 0)) {
+ if (zcopy_used) {
+- vhost_net_ubuf_put(ubufs);
++ if (vq->heads[ubuf->desc].len == VHOST_DMA_IN_PROGRESS)
++ vhost_net_ubuf_put(ubufs);
+ nvq->upend_idx = ((unsigned)nvq->upend_idx - 1)
+ % UIO_MAXIOV;
+ }
--- /dev/null
+From foo@baz Sun Jan 10 11:18:59 AM CET 2021
+From: Jeff Dike <jdike@akamai.com>
+Date: Tue, 22 Dec 2020 21:54:21 -0500
+Subject: virtio_net: Fix recursive call to cpus_read_lock()
+
+From: Jeff Dike <jdike@akamai.com>
+
+[ Upstream commit de33212f768c5d9e2fe791b008cb26f92f0aa31c ]
+
+virtnet_set_channels can recursively call cpus_read_lock if CONFIG_XPS
+and CONFIG_HOTPLUG are enabled.
+
+The path is:
+ virtnet_set_channels - calls get_online_cpus(), which is a trivial
+wrapper around cpus_read_lock()
+ netif_set_real_num_tx_queues
+ netif_reset_xps_queues_gt
+ netif_reset_xps_queues - calls cpus_read_lock()
+
+This call chain and potential deadlock happens when the number of TX
+queues is reduced.
+
+This commit the removes netif_set_real_num_[tr]x_queues calls from
+inside the get/put_online_cpus section, as they don't require that it
+be held.
+
+Fixes: 47be24796c13 ("virtio-net: fix the set affinity bug when CPU IDs are not consecutive")
+Signed-off-by: Jeff Dike <jdike@akamai.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Link: https://lore.kernel.org/r/20201223025421.671-1-jdike@akamai.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/virtio_net.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -2093,14 +2093,16 @@ static int virtnet_set_channels(struct n
+
+ get_online_cpus();
+ err = _virtnet_set_queues(vi, queue_pairs);
+- if (!err) {
+- netif_set_real_num_tx_queues(dev, queue_pairs);
+- netif_set_real_num_rx_queues(dev, queue_pairs);
+-
+- virtnet_set_affinity(vi);
++ if (err) {
++ put_online_cpus();
++ goto err;
+ }
++ virtnet_set_affinity(vi);
+ put_online_cpus();
+
++ netif_set_real_num_tx_queues(dev, queue_pairs);
++ netif_set_real_num_rx_queues(dev, queue_pairs);
++ err:
+ return err;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
