--- /dev/null
+From 782f7ca2f1b0d029efbdb8cf4a97166d64aa7e07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Sep 2021 18:11:33 +0100
+Subject: afs: Fix incorrect triggering of sillyrename on 3rd-party
+ invalidation
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 63d49d843ef5fffeea069e0ffdfbd2bf40ba01c6 ]
+
+The AFS filesystem is currently triggering the silly-rename cleanup from
+afs_d_revalidate() when it sees that a dentry has been changed by a third
+party[1]. It should not be doing this as the cleanup includes deleting the
+silly-rename target file on iput.
+
+Fix this by removing the places in the d_revalidate handling that validate
+anything other than the directory and the dirent. It probably should not
+be looking to validate the target inode of the dentry also.
+
+This includes removing the point in afs_d_revalidate() where the inode that
+a dentry used to point to was marked as being deleted (AFS_VNODE_DELETED).
+We don't know it got deleted. It could have been renamed or it could have
+hard links remaining.
+
+This was reproduced by cloning a git repo onto an afs volume on one
+machine, switching to another machine and doing "git status", then
+switching back to the first and doing "git status". The second status
+would show weird output due to ".git/index" getting deleted by the above
+mentioned mechanism.
+
+A simpler way to do it is to do:
+
+ machine 1: touch a
+ machine 2: touch b; mv -f b a
+ machine 1: stat a
+
+on an afs volume. The bug shows up as the stat failing with ENOENT and the
+file server log showing that machine 1 deleted "a".
+
+Fixes: 79ddbfa500b3 ("afs: Implement sillyrename for unlink and rename")
+Reported-by: Markus Suvanto <markus.suvanto@gmail.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Tested-by: Markus Suvanto <markus.suvanto@gmail.com>
+cc: linux-afs@lists.infradead.org
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=214217#c4 [1]
+Link: https://lore.kernel.org/r/163111668100.283156.3851669884664475428.stgit@warthog.procyon.org.uk/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/dir.c | 46 +++++++---------------------------------------
+ 1 file changed, 7 insertions(+), 39 deletions(-)
+
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index 92d7fd7436cb..262c0ae505af 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -997,9 +997,9 @@ static struct dentry *afs_lookup(struct inode *dir, struct dentry *dentry,
+ */
+ static int afs_d_revalidate_rcu(struct dentry *dentry)
+ {
+- struct afs_vnode *dvnode, *vnode;
++ struct afs_vnode *dvnode;
+ struct dentry *parent;
+- struct inode *dir, *inode;
++ struct inode *dir;
+ long dir_version, de_version;
+
+ _enter("%p", dentry);
+@@ -1029,18 +1029,6 @@ static int afs_d_revalidate_rcu(struct dentry *dentry)
+ return -ECHILD;
+ }
+
+- /* Check to see if the vnode referred to by the dentry still
+- * has a callback.
+- */
+- if (d_really_is_positive(dentry)) {
+- inode = d_inode_rcu(dentry);
+- if (inode) {
+- vnode = AFS_FS_I(inode);
+- if (!afs_check_validity(vnode))
+- return -ECHILD;
+- }
+- }
+-
+ return 1; /* Still valid */
+ }
+
+@@ -1076,17 +1064,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
+ if (IS_ERR(key))
+ key = NULL;
+
+- if (d_really_is_positive(dentry)) {
+- inode = d_inode(dentry);
+- if (inode) {
+- vnode = AFS_FS_I(inode);
+- afs_validate(vnode, key);
+- if (test_bit(AFS_VNODE_DELETED, &vnode->flags))
+- goto out_bad;
+- }
+- }
+-
+- /* lock down the parent dentry so we can peer at it */
++ /* Hold the parent dentry so we can peer at it */
+ parent = dget_parent(dentry);
+ dir = AFS_FS_I(d_inode(parent));
+
+@@ -1095,7 +1073,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
+
+ if (test_bit(AFS_VNODE_DELETED, &dir->flags)) {
+ _debug("%pd: parent dir deleted", dentry);
+- goto out_bad_parent;
++ goto not_found;
+ }
+
+ /* We only need to invalidate a dentry if the server's copy changed
+@@ -1121,12 +1099,12 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
+ case 0:
+ /* the filename maps to something */
+ if (d_really_is_negative(dentry))
+- goto out_bad_parent;
++ goto not_found;
+ inode = d_inode(dentry);
+ if (is_bad_inode(inode)) {
+ printk("kAFS: afs_d_revalidate: %pd2 has bad inode\n",
+ dentry);
+- goto out_bad_parent;
++ goto not_found;
+ }
+
+ vnode = AFS_FS_I(inode);
+@@ -1148,9 +1126,6 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
+ dentry, fid.unique,
+ vnode->fid.unique,
+ vnode->vfs_inode.i_generation);
+- write_seqlock(&vnode->cb_lock);
+- set_bit(AFS_VNODE_DELETED, &vnode->flags);
+- write_sequnlock(&vnode->cb_lock);
+ goto not_found;
+ }
+ goto out_valid;
+@@ -1165,7 +1140,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
+ default:
+ _debug("failed to iterate dir %pd: %d",
+ parent, ret);
+- goto out_bad_parent;
++ goto not_found;
+ }
+
+ out_valid:
+@@ -1176,16 +1151,9 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
+ _leave(" = 1 [valid]");
+ return 1;
+
+- /* the dirent, if it exists, now points to a different vnode */
+ not_found:
+- spin_lock(&dentry->d_lock);
+- dentry->d_flags |= DCACHE_NFSFS_RENAMED;
+- spin_unlock(&dentry->d_lock);
+-
+-out_bad_parent:
+ _debug("dropping dentry %pd2", dentry);
+ dput(parent);
+-out_bad:
+ key_put(key);
+
+ _leave(" = 0 [bad]");
+--
+2.33.0
+
--- /dev/null
+From 75e715874482d9aeeab1d18630f853c5d6e9e87f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Sep 2021 21:55:19 +0100
+Subject: afs: Fix updating of i_blocks on file/dir extension
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 9d37e1cab2a9d2cee2737973fa455e6f89eee46a ]
+
+When an afs file or directory is modified locally such that the total file
+size is extended, i_blocks needs to be recalculated too.
+
+Fix this by making afs_write_end() and afs_edit_dir_add() call
+afs_set_i_size() rather than setting inode->i_size directly as that also
+recalculates inode->i_blocks.
+
+This can be tested by creating and writing into directories and files and
+then examining them with du. Without this change, directories show a 4
+blocks (they start out at 2048 bytes) and files show 0 blocks; with this
+change, they should show a number of blocks proportional to the file size
+rounded up to 1024.
+
+Fixes: 31143d5d515e ("AFS: implement basic file write support")
+Fixes: 63a4681ff39c ("afs: Locally edit directory data for mkdir/create/unlink/...")
+Reported-by: Markus Suvanto <markus.suvanto@gmail.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
+Tested-by: Markus Suvanto <markus.suvanto@gmail.com>
+cc: linux-afs@lists.infradead.org
+Link: https://lore.kernel.org/r/163113612442.352844.11162345591911691150.stgit@warthog.procyon.org.uk/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/dir_edit.c | 4 ++--
+ fs/afs/inode.c | 10 ----------
+ fs/afs/internal.h | 10 ++++++++++
+ fs/afs/write.c | 2 +-
+ 4 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/fs/afs/dir_edit.c b/fs/afs/dir_edit.c
+index 2ffe09abae7f..3a9cffc081b9 100644
+--- a/fs/afs/dir_edit.c
++++ b/fs/afs/dir_edit.c
+@@ -264,7 +264,7 @@ void afs_edit_dir_add(struct afs_vnode *vnode,
+ if (b == nr_blocks) {
+ _debug("init %u", b);
+ afs_edit_init_block(meta, block, b);
+- i_size_write(&vnode->vfs_inode, (b + 1) * AFS_DIR_BLOCK_SIZE);
++ afs_set_i_size(vnode, (b + 1) * AFS_DIR_BLOCK_SIZE);
+ }
+
+ /* Only lower dir pages have a counter in the header. */
+@@ -297,7 +297,7 @@ void afs_edit_dir_add(struct afs_vnode *vnode,
+ new_directory:
+ afs_edit_init_block(meta, meta, 0);
+ i_size = AFS_DIR_BLOCK_SIZE;
+- i_size_write(&vnode->vfs_inode, i_size);
++ afs_set_i_size(vnode, i_size);
+ slot = AFS_DIR_RESV_BLOCKS0;
+ page = page0;
+ block = meta;
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index ae3016a9fb23..f81a972bdd29 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -53,16 +53,6 @@ static noinline void dump_vnode(struct afs_vnode *vnode, struct afs_vnode *paren
+ dump_stack();
+ }
+
+-/*
+- * Set the file size and block count. Estimate the number of 512 bytes blocks
+- * used, rounded up to nearest 1K for consistency with other AFS clients.
+- */
+-static void afs_set_i_size(struct afs_vnode *vnode, u64 size)
+-{
+- i_size_write(&vnode->vfs_inode, size);
+- vnode->vfs_inode.i_blocks = ((size + 1023) >> 10) << 1;
+-}
+-
+ /*
+ * Initialise an inode from the vnode status.
+ */
+diff --git a/fs/afs/internal.h b/fs/afs/internal.h
+index ffe318ad2e02..dc08a3d9b3a8 100644
+--- a/fs/afs/internal.h
++++ b/fs/afs/internal.h
+@@ -1573,6 +1573,16 @@ static inline void afs_update_dentry_version(struct afs_operation *op,
+ (void *)(unsigned long)dir_vp->scb.status.data_version;
+ }
+
++/*
++ * Set the file size and block count. Estimate the number of 512 bytes blocks
++ * used, rounded up to nearest 1K for consistency with other AFS clients.
++ */
++static inline void afs_set_i_size(struct afs_vnode *vnode, u64 size)
++{
++ i_size_write(&vnode->vfs_inode, size);
++ vnode->vfs_inode.i_blocks = ((size + 1023) >> 10) << 1;
++}
++
+ /*
+ * Check for a conflicting operation on a directory that we just unlinked from.
+ * If someone managed to sneak a link or an unlink in on the file we just
+diff --git a/fs/afs/write.c b/fs/afs/write.c
+index d37b5cfcf28f..be60cf110382 100644
+--- a/fs/afs/write.c
++++ b/fs/afs/write.c
+@@ -184,7 +184,7 @@ int afs_write_end(struct file *file, struct address_space *mapping,
+ write_seqlock(&vnode->cb_lock);
+ i_size = i_size_read(&vnode->vfs_inode);
+ if (maybe_i_size > i_size)
+- i_size_write(&vnode->vfs_inode, maybe_i_size);
++ afs_set_i_size(vnode, maybe_i_size);
+ write_sequnlock(&vnode->cb_lock);
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 8fda30d07b2c73f65cbe27e10aa01ea34de26d02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Sep 2021 03:16:05 -0700
+Subject: atlantic: Fix issue in the pm resume flow.
+
+From: Sudarsana Reddy Kalluru <skalluru@marvell.com>
+
+[ Upstream commit 4d88c339c423eefe2fd48215016cb0c75fcb4c4d ]
+
+After fixing hibernation resume flow, another usecase was found which
+should be explicitly handled - resume when device is in "down" state.
+Invoke aq_nic_init jointly with aq_nic_start only if ndev was already
+up during suspend/hibernate. We still need to perform nic_deinit() if
+caller requests for it, to handle the freeze/resume scenarios.
+
+Fixes: 57f780f1c433 ("atlantic: Fix driver resume flow.")
+Signed-off-by: Sudarsana Reddy Kalluru <skalluru@marvell.com>
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+index f26d03735619..5b996330f228 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+@@ -419,13 +419,13 @@ static int atl_resume_common(struct device *dev, bool deep)
+ if (deep) {
+ /* Reinitialize Nic/Vecs objects */
+ aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol);
++ }
+
++ if (netif_running(nic->ndev)) {
+ ret = aq_nic_init(nic);
+ if (ret)
+ goto err_exit;
+- }
+
+- if (netif_running(nic->ndev)) {
+ ret = aq_nic_start(nic);
+ if (ret)
+ goto err_exit;
+--
+2.33.0
+
--- /dev/null
+From 460f9511d6cdd11063201562caf95bb16ef0e903 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Sep 2021 02:51:52 -0400
+Subject: bnxt_en: Fix TX timeout when TX ring size is set to the smallest
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 5bed8b0704c9ecccc8f4a2c377d7c8e21090a82e ]
+
+The smallest TX ring size we support must fit a TX SKB with MAX_SKB_FRAGS
++ 1. Because the first TX BD for a packet is always a long TX BD, we
+need an extra TX BD to fit this packet. Define BNXT_MIN_TX_DESC_CNT with
+this value to make this more clear. The current code uses a minimum
+that is off by 1. Fix it using this constant.
+
+The tx_wake_thresh to determine when to wake up the TX queue is half the
+ring size but we must have at least BNXT_MIN_TX_DESC_CNT for the next
+packet which may have maximum fragments. So the comparison of the
+available TX BDs with tx_wake_thresh should be >= instead of > in the
+current code. Otherwise, at the smallest ring size, we will never wake
+up the TX queue and will cause TX timeout.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadocm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++----
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 5 +++++
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +-
+ 3 files changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 26179e437bbf..cb0c270418a4 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -381,7 +381,7 @@ static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp,
+ * netif_tx_queue_stopped().
+ */
+ smp_mb();
+- if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) {
++ if (bnxt_tx_avail(bp, txr) >= bp->tx_wake_thresh) {
+ netif_tx_wake_queue(txq);
+ return false;
+ }
+@@ -717,7 +717,7 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts)
+ smp_mb();
+
+ if (unlikely(netif_tx_queue_stopped(txq)) &&
+- bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh &&
++ bnxt_tx_avail(bp, txr) >= bp->tx_wake_thresh &&
+ READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING)
+ netif_tx_wake_queue(txq);
+ }
+@@ -2300,7 +2300,7 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+ if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) {
+ tx_pkts++;
+ /* return full budget so NAPI will complete. */
+- if (unlikely(tx_pkts > bp->tx_wake_thresh)) {
++ if (unlikely(tx_pkts >= bp->tx_wake_thresh)) {
+ rx_pkts = budget;
+ raw_cons = NEXT_RAW_CMP(raw_cons);
+ if (budget)
+@@ -3431,7 +3431,7 @@ static int bnxt_init_tx_rings(struct bnxt *bp)
+ u16 i;
+
+ bp->tx_wake_thresh = max_t(int, bp->tx_ring_size / 2,
+- MAX_SKB_FRAGS + 1);
++ BNXT_MIN_TX_DESC_CNT);
+
+ for (i = 0; i < bp->tx_nr_rings; i++) {
+ struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 95d10e7bbb04..92f9f7f5240b 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -611,6 +611,11 @@ struct nqe_cn {
+ #define BNXT_MAX_RX_JUM_DESC_CNT (RX_DESC_CNT * MAX_RX_AGG_PAGES - 1)
+ #define BNXT_MAX_TX_DESC_CNT (TX_DESC_CNT * MAX_TX_PAGES - 1)
+
++/* Minimum TX BDs for a TX packet with MAX_SKB_FRAGS + 1. We need one extra
++ * BD because the first TX BD is always a long BD.
++ */
++#define BNXT_MIN_TX_DESC_CNT (MAX_SKB_FRAGS + 2)
++
+ #define RX_RING(x) (((x) & ~(RX_DESC_CNT - 1)) >> (BNXT_PAGE_SHIFT - 4))
+ #define RX_IDX(x) ((x) & (RX_DESC_CNT - 1))
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 1471c9a36238..6f9196ff2ac4 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -780,7 +780,7 @@ static int bnxt_set_ringparam(struct net_device *dev,
+
+ if ((ering->rx_pending > BNXT_MAX_RX_DESC_CNT) ||
+ (ering->tx_pending > BNXT_MAX_TX_DESC_CNT) ||
+- (ering->tx_pending <= MAX_SKB_FRAGS))
++ (ering->tx_pending < BNXT_MIN_TX_DESC_CNT))
+ return -EINVAL;
+
+ if (netif_running(dev))
+--
+2.33.0
+
--- /dev/null
+From b674524a98254def5d511f8e3c08f87298d4d660 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Sep 2021 13:22:05 +0300
+Subject: enetc: Fix illegal access when reading affinity_hint
+
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+
+[ Upstream commit 7237a494decfa17d0b9d0076e6cee3235719de90 ]
+
+irq_set_affinity_hit() stores a reference to the cpumask_t
+parameter in the irq descriptor, and that reference can be
+accessed later from irq_affinity_hint_proc_show(). Since
+the cpu_mask parameter passed to irq_set_affinity_hit() has
+only temporary storage (it's on the stack memory), later
+accesses to it are illegal. Thus reads from the corresponding
+procfs affinity_hint file can result in paging request oops.
+
+The issue is fixed by the get_cpu_mask() helper, which provides
+a permanent storage for the cpumask_t parameter.
+
+Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers")
+Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
+index df4a858c8001..6877f8e2047b 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc.c
+@@ -1320,7 +1320,6 @@ static void enetc_clear_bdrs(struct enetc_ndev_priv *priv)
+ static int enetc_setup_irqs(struct enetc_ndev_priv *priv)
+ {
+ struct pci_dev *pdev = priv->si->pdev;
+- cpumask_t cpu_mask;
+ int i, j, err;
+
+ for (i = 0; i < priv->bdr_int_num; i++) {
+@@ -1349,9 +1348,7 @@ static int enetc_setup_irqs(struct enetc_ndev_priv *priv)
+
+ enetc_wr(hw, ENETC_SIMSITRV(idx), entry);
+ }
+- cpumask_clear(&cpu_mask);
+- cpumask_set_cpu(i % num_online_cpus(), &cpu_mask);
+- irq_set_affinity_hint(irq, &cpu_mask);
++ irq_set_affinity_hint(irq, get_cpu_mask(i % num_online_cpus()));
+ }
+
+ return 0;
+--
+2.33.0
+
--- /dev/null
+From e511a8ad49d21c933689909aecd9a3599e49d9f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Sep 2021 13:22:06 +0300
+Subject: enetc: Fix uninitialized struct dim_sample field usage
+
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+
+[ Upstream commit 9f7afa05c9522b086327929ae622facab0f0f72b ]
+
+The only struct dim_sample member that does not get
+initialized by dim_update_sample() is comp_ctr. (There
+is special API to initialize comp_ctr:
+dim_update_sample_with_comps(), and it is currently used
+only for RDMA.) comp_ctr is used to compute curr_stats->cmps
+and curr_stats->cpe_ratio (see dim_calc_stats()) which in
+turn are consumed by the rdma_dim_*() API. Therefore,
+functionally, the net_dim*() API consumers are not affected.
+Nevertheless, fix the computation of statistics based
+on an uninitialized variable, even if the mentioned statistics
+are not used at the moment.
+
+Fixes: ae0e6a5d1627 ("enetc: Add adaptive interrupt coalescing")
+Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
+index 6877f8e2047b..15aa3b3c0089 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc.c
+@@ -299,7 +299,7 @@ static void enetc_rx_dim_work(struct work_struct *w)
+
+ static void enetc_rx_net_dim(struct enetc_int_vector *v)
+ {
+- struct dim_sample dim_sample;
++ struct dim_sample dim_sample = {};
+
+ v->comp_cnt++;
+
+--
+2.33.0
+
--- /dev/null
+From 1d54a09ecda30e7118fae1e4e2459e71227a10cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Sep 2021 20:19:35 +0900
+Subject: gpio: uniphier: Fix void functions to remove return value
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 2dd824cca3407bc9a2bd11b00f6e117b66fcfcf1 ]
+
+The return type of irq_chip.irq_mask() and irq_chip.irq_unmask() should
+be void.
+
+Fixes: dbe776c2ca54 ("gpio: uniphier: add UniPhier GPIO controller driver")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-uniphier.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-uniphier.c b/drivers/gpio/gpio-uniphier.c
+index f99f3c10bed0..39dca147d587 100644
+--- a/drivers/gpio/gpio-uniphier.c
++++ b/drivers/gpio/gpio-uniphier.c
+@@ -184,7 +184,7 @@ static void uniphier_gpio_irq_mask(struct irq_data *data)
+
+ uniphier_gpio_reg_update(priv, UNIPHIER_GPIO_IRQ_EN, mask, 0);
+
+- return irq_chip_mask_parent(data);
++ irq_chip_mask_parent(data);
+ }
+
+ static void uniphier_gpio_irq_unmask(struct irq_data *data)
+@@ -194,7 +194,7 @@ static void uniphier_gpio_irq_unmask(struct irq_data *data)
+
+ uniphier_gpio_reg_update(priv, UNIPHIER_GPIO_IRQ_EN, mask, mask);
+
+- return irq_chip_unmask_parent(data);
++ irq_chip_unmask_parent(data);
+ }
+
+ static int uniphier_gpio_irq_set_type(struct irq_data *data, unsigned int type)
+--
+2.33.0
+
--- /dev/null
+From 16b631896bd210aff1ee934bc28076dfcefbf406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 14:42:40 +0100
+Subject: kselftest/arm64: signal: Add SVE to the set of features we can check
+ for
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit d4e4dc4fab686c5f3f185272a19b83930664bef5 ]
+
+Allow testcases for SVE signal handling to flag the dependency and be
+skipped on systems without SVE support.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210819134245.13935-2-broonie@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/signal/test_signals.h | 2 ++
+ tools/testing/selftests/arm64/signal/test_signals_utils.c | 3 +++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/tools/testing/selftests/arm64/signal/test_signals.h b/tools/testing/selftests/arm64/signal/test_signals.h
+index f96baf1cef1a..ebe8694dbef0 100644
+--- a/tools/testing/selftests/arm64/signal/test_signals.h
++++ b/tools/testing/selftests/arm64/signal/test_signals.h
+@@ -33,10 +33,12 @@
+ */
+ enum {
+ FSSBS_BIT,
++ FSVE_BIT,
+ FMAX_END
+ };
+
+ #define FEAT_SSBS (1UL << FSSBS_BIT)
++#define FEAT_SVE (1UL << FSVE_BIT)
+
+ /*
+ * A descriptor used to describe and configure a test case.
+diff --git a/tools/testing/selftests/arm64/signal/test_signals_utils.c b/tools/testing/selftests/arm64/signal/test_signals_utils.c
+index 2de6e5ed5e25..6836510a522f 100644
+--- a/tools/testing/selftests/arm64/signal/test_signals_utils.c
++++ b/tools/testing/selftests/arm64/signal/test_signals_utils.c
+@@ -26,6 +26,7 @@ static int sig_copyctx = SIGTRAP;
+
+ static char const *const feats_names[FMAX_END] = {
+ " SSBS ",
++ " SVE ",
+ };
+
+ #define MAX_FEATS_SZ 128
+@@ -263,6 +264,8 @@ int test_init(struct tdescr *td)
+ */
+ if (getauxval(AT_HWCAP) & HWCAP_SSBS)
+ td->feats_supported |= FEAT_SSBS;
++ if (getauxval(AT_HWCAP) & HWCAP_SVE)
++ td->feats_supported |= FEAT_SVE;
+ if (feats_ok(td))
+ fprintf(stderr,
+ "Required Features: [%s] supported\n",
+--
+2.33.0
+
--- /dev/null
+From f21150d4bfe629e0c234a019d857866da793326e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Sep 2021 13:12:28 +0100
+Subject: kselftest/arm64: signal: Skip tests if required features are missing
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit 0e3dbf765fe22060acbcb8eb8c4d256e655a1247 ]
+
+During initialization of a signal testcase, features declared as required
+are properly checked against the running system but no action is then taken
+to effectively skip such a testcase.
+
+Fix core signals test logic to abort initialization and report such a
+testcase as skipped to the KSelfTest framework.
+
+Fixes: f96bf4340316 ("kselftest: arm64: mangle_pstate_invalid_compat_toggle and common utils")
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210920121228.35368-1-cristian.marussi@arm.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/signal/test_signals_utils.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/arm64/signal/test_signals_utils.c b/tools/testing/selftests/arm64/signal/test_signals_utils.c
+index 6836510a522f..22722abc9dfa 100644
+--- a/tools/testing/selftests/arm64/signal/test_signals_utils.c
++++ b/tools/testing/selftests/arm64/signal/test_signals_utils.c
+@@ -266,16 +266,19 @@ int test_init(struct tdescr *td)
+ td->feats_supported |= FEAT_SSBS;
+ if (getauxval(AT_HWCAP) & HWCAP_SVE)
+ td->feats_supported |= FEAT_SVE;
+- if (feats_ok(td))
++ if (feats_ok(td)) {
+ fprintf(stderr,
+ "Required Features: [%s] supported\n",
+ feats_to_string(td->feats_required &
+ td->feats_supported));
+- else
++ } else {
+ fprintf(stderr,
+ "Required Features: [%s] NOT supported\n",
+ feats_to_string(td->feats_required &
+ ~td->feats_supported));
++ td->result = KSFT_SKIP;
++ return 0;
++ }
+ }
+
+ /* Perform test specific additional initialization */
+--
+2.33.0
+
--- /dev/null
+From 397b2e7e1aa711f521b1e5ebf7070fe6e54729ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Sep 2021 00:42:08 +0300
+Subject: net: dsa: don't allocate the slave_mii_bus using devres
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 5135e96a3dd2f4555ae6981c3155a62bcf3227f6 ]
+
+The Linux device model permits both the ->shutdown and ->remove driver
+methods to get called during a shutdown procedure. Example: a DSA switch
+which sits on an SPI bus, and the SPI bus driver calls this on its
+->shutdown method:
+
+spi_unregister_controller
+-> device_for_each_child(&ctlr->dev, NULL, __unregister);
+ -> spi_unregister_device(to_spi_device(dev));
+ -> device_del(&spi->dev);
+
+So this is a simple pattern which can theoretically appear on any bus,
+although the only other buses on which I've been able to find it are
+I2C:
+
+i2c_del_adapter
+-> device_for_each_child(&adap->dev, NULL, __unregister_client);
+ -> i2c_unregister_device(client);
+ -> device_unregister(&client->dev);
+
+The implication of this pattern is that devices on these buses can be
+unregistered after having been shut down. The drivers for these devices
+might choose to return early either from ->remove or ->shutdown if the
+other callback has already run once, and they might choose that the
+->shutdown method should only perform a subset of the teardown done by
+->remove (to avoid unnecessary delays when rebooting).
+
+So in other words, the device driver may choose on ->remove to not
+do anything (therefore to not unregister an MDIO bus it has registered
+on ->probe), because this ->remove is actually triggered by the
+device_shutdown path, and its ->shutdown method has already run and done
+the minimally required cleanup.
+
+This used to be fine until the blamed commit, but now, the following
+BUG_ON triggers:
+
+void mdiobus_free(struct mii_bus *bus)
+{
+ /* For compatibility with error handling in drivers. */
+ if (bus->state == MDIOBUS_ALLOCATED) {
+ kfree(bus);
+ return;
+ }
+
+ BUG_ON(bus->state != MDIOBUS_UNREGISTERED);
+ bus->state = MDIOBUS_RELEASED;
+
+ put_device(&bus->dev);
+}
+
+In other words, there is an attempt to free an MDIO bus which was not
+unregistered. The attempt to free it comes from the devres release
+callbacks of the SPI device, which are executed after the device is
+unregistered.
+
+I'm not saying that the fact that MDIO buses allocated using devres
+would automatically get unregistered wasn't strange. I'm just saying
+that the commit didn't care about auditing existing call paths in the
+kernel, and now, the following code sequences are potentially buggy:
+
+(a) devm_mdiobus_alloc followed by plain mdiobus_register, for a device
+ located on a bus that unregisters its children on shutdown. After
+ the blamed patch, either both the alloc and the register should use
+ devres, or none should.
+
+(b) devm_mdiobus_alloc followed by plain mdiobus_register, and then no
+ mdiobus_unregister at all in the remove path. After the blamed
+ patch, nobody unregisters the MDIO bus anymore, so this is even more
+ buggy than the previous case which needs a specific bus
+ configuration to be seen, this one is an unconditional bug.
+
+In this case, DSA falls into category (a), it tries to be helpful and
+registers an MDIO bus on behalf of the switch, which might be on such a
+bus. I've no idea why it does it under devres.
+
+It does this on probe:
+
+ if (!ds->slave_mii_bus && ds->ops->phy_read)
+ alloc and register mdio bus
+
+and this on remove:
+
+ if (ds->slave_mii_bus && ds->ops->phy_read)
+ unregister mdio bus
+
+I _could_ imagine using devres because the condition used on remove is
+different than the condition used on probe. So strictly speaking, DSA
+cannot determine whether the ds->slave_mii_bus it sees on remove is the
+ds->slave_mii_bus that _it_ has allocated on probe. Using devres would
+have solved that problem. But nonetheless, the existing code already
+proceeds to unregister the MDIO bus, even though it might be
+unregistering an MDIO bus it has never registered. So I can only guess
+that no driver that implements ds->ops->phy_read also allocates and
+registers ds->slave_mii_bus itself.
+
+So in that case, if unregistering is fine, freeing must be fine too.
+
+Stop using devres and free the MDIO bus manually. This will make devres
+stop attempting to free a still registered MDIO bus on ->shutdown.
+
+Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()")
+Reported-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Tested-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/dsa2.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
+index 3ada338d7e08..71c8ef7d4087 100644
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -459,7 +459,7 @@ static int dsa_switch_setup(struct dsa_switch *ds)
+ devlink_params_publish(ds->devlink);
+
+ if (!ds->slave_mii_bus && ds->ops->phy_read) {
+- ds->slave_mii_bus = devm_mdiobus_alloc(ds->dev);
++ ds->slave_mii_bus = mdiobus_alloc();
+ if (!ds->slave_mii_bus) {
+ err = -ENOMEM;
+ goto teardown;
+@@ -469,13 +469,16 @@ static int dsa_switch_setup(struct dsa_switch *ds)
+
+ err = mdiobus_register(ds->slave_mii_bus);
+ if (err < 0)
+- goto teardown;
++ goto free_slave_mii_bus;
+ }
+
+ ds->setup = true;
+
+ return 0;
+
++free_slave_mii_bus:
++ if (ds->slave_mii_bus && ds->ops->phy_read)
++ mdiobus_free(ds->slave_mii_bus);
+ teardown:
+ if (ds->ops->teardown)
+ ds->ops->teardown(ds);
+@@ -500,8 +503,11 @@ static void dsa_switch_teardown(struct dsa_switch *ds)
+ if (!ds->setup)
+ return;
+
+- if (ds->slave_mii_bus && ds->ops->phy_read)
++ if (ds->slave_mii_bus && ds->ops->phy_read) {
+ mdiobus_unregister(ds->slave_mii_bus);
++ mdiobus_free(ds->slave_mii_bus);
++ ds->slave_mii_bus = NULL;
++ }
+
+ dsa_switch_unregister_notifier(ds);
+
+--
+2.33.0
+
--- /dev/null
+From ff6dea7ac63ab341a35b4f6083de89e6110b1b18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Sep 2021 00:42:09 +0300
+Subject: net: dsa: realtek: register the MDIO bus under devres
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 74b6d7d13307b016f4b5bba8198297824c0ee6df ]
+
+The Linux device model permits both the ->shutdown and ->remove driver
+methods to get called during a shutdown procedure. Example: a DSA switch
+which sits on an SPI bus, and the SPI bus driver calls this on its
+->shutdown method:
+
+spi_unregister_controller
+-> device_for_each_child(&ctlr->dev, NULL, __unregister);
+ -> spi_unregister_device(to_spi_device(dev));
+ -> device_del(&spi->dev);
+
+So this is a simple pattern which can theoretically appear on any bus,
+although the only other buses on which I've been able to find it are
+I2C:
+
+i2c_del_adapter
+-> device_for_each_child(&adap->dev, NULL, __unregister_client);
+ -> i2c_unregister_device(client);
+ -> device_unregister(&client->dev);
+
+The implication of this pattern is that devices on these buses can be
+unregistered after having been shut down. The drivers for these devices
+might choose to return early either from ->remove or ->shutdown if the
+other callback has already run once, and they might choose that the
+->shutdown method should only perform a subset of the teardown done by
+->remove (to avoid unnecessary delays when rebooting).
+
+So in other words, the device driver may choose on ->remove to not
+do anything (therefore to not unregister an MDIO bus it has registered
+on ->probe), because this ->remove is actually triggered by the
+device_shutdown path, and its ->shutdown method has already run and done
+the minimally required cleanup.
+
+This used to be fine until the blamed commit, but now, the following
+BUG_ON triggers:
+
+void mdiobus_free(struct mii_bus *bus)
+{
+ /* For compatibility with error handling in drivers. */
+ if (bus->state == MDIOBUS_ALLOCATED) {
+ kfree(bus);
+ return;
+ }
+
+ BUG_ON(bus->state != MDIOBUS_UNREGISTERED);
+ bus->state = MDIOBUS_RELEASED;
+
+ put_device(&bus->dev);
+}
+
+In other words, there is an attempt to free an MDIO bus which was not
+unregistered. The attempt to free it comes from the devres release
+callbacks of the SPI device, which are executed after the device is
+unregistered.
+
+I'm not saying that the fact that MDIO buses allocated using devres
+would automatically get unregistered wasn't strange. I'm just saying
+that the commit didn't care about auditing existing call paths in the
+kernel, and now, the following code sequences are potentially buggy:
+
+(a) devm_mdiobus_alloc followed by plain mdiobus_register, for a device
+ located on a bus that unregisters its children on shutdown. After
+ the blamed patch, either both the alloc and the register should use
+ devres, or none should.
+
+(b) devm_mdiobus_alloc followed by plain mdiobus_register, and then no
+ mdiobus_unregister at all in the remove path. After the blamed
+ patch, nobody unregisters the MDIO bus anymore, so this is even more
+ buggy than the previous case which needs a specific bus
+ configuration to be seen, this one is an unconditional bug.
+
+In this case, the Realtek drivers fall under category (b). To solve it,
+we can register the MDIO bus under devres too, which restores the
+previous behavior.
+
+Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()")
+Reported-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
+Reported-by: Alvin Šipraga <alsi@bang-olufsen.dk>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/realtek-smi-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/realtek-smi-core.c b/drivers/net/dsa/realtek-smi-core.c
+index 8e49d4f85d48..6bf46d76c028 100644
+--- a/drivers/net/dsa/realtek-smi-core.c
++++ b/drivers/net/dsa/realtek-smi-core.c
+@@ -368,7 +368,7 @@ int realtek_smi_setup_mdio(struct realtek_smi *smi)
+ smi->slave_mii_bus->parent = smi->dev;
+ smi->ds->slave_mii_bus = smi->slave_mii_bus;
+
+- ret = of_mdiobus_register(smi->slave_mii_bus, mdio_np);
++ ret = devm_of_mdiobus_register(smi->dev, smi->slave_mii_bus, mdio_np);
+ if (ret) {
+ dev_err(smi->dev, "unable to register MDIO bus %s\n",
+ smi->slave_mii_bus->id);
+--
+2.33.0
+
--- /dev/null
+From d48657ed6ac9813b6299f5ecf1a7c6bec33422a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 21:52:09 +0800
+Subject: net: hns3: check queue id range before using
+
+From: Yufeng Mo <moyufeng@huawei.com>
+
+[ Upstream commit 63b1279d9905100a14da9e043de7b28e99dba3f8 ]
+
+The input parameters may not be reliable. Before using the
+queue id, we should check this parameter. Otherwise, memory
+overwriting may occur.
+
+Fixes: d34100184685 ("net: hns3: refactor the mailbox message between PF and VF")
+Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+index 8c528ea33406..8932af32e89d 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+@@ -581,9 +581,17 @@ static void hclge_get_queue_id_in_pf(struct hclge_vport *vport,
+ struct hclge_mbx_vf_to_pf_cmd *mbx_req,
+ struct hclge_respond_to_vf_msg *resp_msg)
+ {
++ struct hnae3_handle *handle = &vport->nic;
++ struct hclge_dev *hdev = vport->back;
+ u16 queue_id, qid_in_pf;
+
+ memcpy(&queue_id, mbx_req->msg.data, sizeof(queue_id));
++ if (queue_id >= handle->kinfo.num_tqps) {
++ dev_err(&hdev->pdev->dev, "Invalid queue id(%u) from VF %u\n",
++ queue_id, mbx_req->mbx_src_vfid);
++ return;
++ }
++
+ qid_in_pf = hclge_covert_handle_qid_global(&vport->nic, queue_id);
+ memcpy(resp_msg->data, &qid_in_pf, sizeof(qid_in_pf));
+ resp_msg->len = sizeof(qid_in_pf);
+--
+2.33.0
+
--- /dev/null
+From ee49b171b9770dc620bcc50daf33d065c3bd429b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 21:52:06 +0800
+Subject: net: hns3: fix change RSS 'hfunc' ineffective issue
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit e184cec5e29d8eb3c3435b12a9074b75e2d69e4a ]
+
+When user change rss 'hfunc' without set rss 'hkey' by ethtool
+-X command, the driver will ignore the 'hfunc' for the hkey is
+NULL. It's unreasonable. So fix it.
+
+Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Fixes: 374ad291762a ("net: hns3: Add RSS general configuration support for VF")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hisilicon/hns3/hns3pf/hclge_main.c | 45 ++++++++++------
+ .../hisilicon/hns3/hns3vf/hclgevf_main.c | 52 ++++++++++++-------
+ 2 files changed, 64 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 59ec538eba1f..24357e907155 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -4377,6 +4377,24 @@ static int hclge_get_rss(struct hnae3_handle *handle, u32 *indir,
+ return 0;
+ }
+
++static int hclge_parse_rss_hfunc(struct hclge_vport *vport, const u8 hfunc,
++ u8 *hash_algo)
++{
++ switch (hfunc) {
++ case ETH_RSS_HASH_TOP:
++ *hash_algo = HCLGE_RSS_HASH_ALGO_TOEPLITZ;
++ return 0;
++ case ETH_RSS_HASH_XOR:
++ *hash_algo = HCLGE_RSS_HASH_ALGO_SIMPLE;
++ return 0;
++ case ETH_RSS_HASH_NO_CHANGE:
++ *hash_algo = vport->rss_algo;
++ return 0;
++ default:
++ return -EINVAL;
++ }
++}
++
+ static int hclge_set_rss(struct hnae3_handle *handle, const u32 *indir,
+ const u8 *key, const u8 hfunc)
+ {
+@@ -4385,30 +4403,27 @@ static int hclge_set_rss(struct hnae3_handle *handle, const u32 *indir,
+ u8 hash_algo;
+ int ret, i;
+
++ ret = hclge_parse_rss_hfunc(vport, hfunc, &hash_algo);
++ if (ret) {
++ dev_err(&hdev->pdev->dev, "invalid hfunc type %u\n", hfunc);
++ return ret;
++ }
++
+ /* Set the RSS Hash Key if specififed by the user */
+ if (key) {
+- switch (hfunc) {
+- case ETH_RSS_HASH_TOP:
+- hash_algo = HCLGE_RSS_HASH_ALGO_TOEPLITZ;
+- break;
+- case ETH_RSS_HASH_XOR:
+- hash_algo = HCLGE_RSS_HASH_ALGO_SIMPLE;
+- break;
+- case ETH_RSS_HASH_NO_CHANGE:
+- hash_algo = vport->rss_algo;
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+ ret = hclge_set_rss_algo_key(hdev, hash_algo, key);
+ if (ret)
+ return ret;
+
+ /* Update the shadow RSS key with user specified qids */
+ memcpy(vport->rss_hash_key, key, HCLGE_RSS_KEY_SIZE);
+- vport->rss_algo = hash_algo;
++ } else {
++ ret = hclge_set_rss_algo_key(hdev, hash_algo,
++ vport->rss_hash_key);
++ if (ret)
++ return ret;
+ }
++ vport->rss_algo = hash_algo;
+
+ /* Update the shadow RSS table with user specified qids */
+ for (i = 0; i < HCLGE_RSS_IND_TBL_SIZE; i++)
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 447457cacf97..3641d7c31451 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -785,40 +785,56 @@ static int hclgevf_get_rss(struct hnae3_handle *handle, u32 *indir, u8 *key,
+ return 0;
+ }
+
++static int hclgevf_parse_rss_hfunc(struct hclgevf_dev *hdev, const u8 hfunc,
++ u8 *hash_algo)
++{
++ switch (hfunc) {
++ case ETH_RSS_HASH_TOP:
++ *hash_algo = HCLGEVF_RSS_HASH_ALGO_TOEPLITZ;
++ return 0;
++ case ETH_RSS_HASH_XOR:
++ *hash_algo = HCLGEVF_RSS_HASH_ALGO_SIMPLE;
++ return 0;
++ case ETH_RSS_HASH_NO_CHANGE:
++ *hash_algo = hdev->rss_cfg.hash_algo;
++ return 0;
++ default:
++ return -EINVAL;
++ }
++}
++
+ static int hclgevf_set_rss(struct hnae3_handle *handle, const u32 *indir,
+ const u8 *key, const u8 hfunc)
+ {
+ struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle);
+ struct hclgevf_rss_cfg *rss_cfg = &hdev->rss_cfg;
++ u8 hash_algo;
+ int ret, i;
+
+ if (hdev->ae_dev->dev_version >= HNAE3_DEVICE_VERSION_V2) {
++ ret = hclgevf_parse_rss_hfunc(hdev, hfunc, &hash_algo);
++ if (ret)
++ return ret;
++
+ /* Set the RSS Hash Key if specififed by the user */
+ if (key) {
+- switch (hfunc) {
+- case ETH_RSS_HASH_TOP:
+- rss_cfg->hash_algo =
+- HCLGEVF_RSS_HASH_ALGO_TOEPLITZ;
+- break;
+- case ETH_RSS_HASH_XOR:
+- rss_cfg->hash_algo =
+- HCLGEVF_RSS_HASH_ALGO_SIMPLE;
+- break;
+- case ETH_RSS_HASH_NO_CHANGE:
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- ret = hclgevf_set_rss_algo_key(hdev, rss_cfg->hash_algo,
+- key);
+- if (ret)
++ ret = hclgevf_set_rss_algo_key(hdev, hash_algo, key);
++ if (ret) {
++ dev_err(&hdev->pdev->dev,
++ "invalid hfunc type %u\n", hfunc);
+ return ret;
++ }
+
+ /* Update the shadow RSS key with user specified qids */
+ memcpy(rss_cfg->rss_hash_key, key,
+ HCLGEVF_RSS_KEY_SIZE);
++ } else {
++ ret = hclgevf_set_rss_algo_key(hdev, hash_algo,
++ rss_cfg->rss_hash_key);
++ if (ret)
++ return ret;
+ }
++ rss_cfg->hash_algo = hash_algo;
+ }
+
+ /* update the shadow RSS table with user specified qids */
+--
+2.33.0
+
--- /dev/null
+From 843ecf796fbf62361c849df9c7a55bab98dd490e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 21:52:08 +0800
+Subject: net: hns3: fix misuse vf id and vport id in some logs
+
+From: Jiaran Zhang <zhangjiaran@huawei.com>
+
+[ Upstream commit 311c0aaa9b4bb8dc65f22634e15963316b17c921 ]
+
+vport_id include PF and VFs, vport_id = 0 means PF, other values mean VFs.
+So the actual vf id is equal to vport_id minus 1.
+
+Some VF print logs are actually vport, and logs of vf id actually use
+vport id, so this patch fixes them.
+
+Fixes: ac887be5b0fe ("net: hns3: change print level of RAS error log from warning to error")
+Fixes: adcf738b804b ("net: hns3: cleanup some print format warning")
+Signed-off-by: Jiaran Zhang <zhangjiaran@huawei.com>
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c | 8 ++++----
+ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 10 ++++++----
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 2 +-
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 +-
+ 4 files changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
+index 3226ca176155..b7fb4f49bc3f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
+@@ -1742,12 +1742,12 @@ static void hclge_handle_over_8bd_err(struct hclge_dev *hdev,
+ return;
+ }
+
+- dev_err(dev, "PPU_PF_ABNORMAL_INT_ST over_8bd_no_fe found, vf_id(%u), queue_id(%u)\n",
++ dev_err(dev, "PPU_PF_ABNORMAL_INT_ST over_8bd_no_fe found, vport(%u), queue_id(%u)\n",
+ vf_id, q_id);
+
+ if (vf_id) {
+ if (vf_id >= hdev->num_alloc_vport) {
+- dev_err(dev, "invalid vf id(%u)\n", vf_id);
++ dev_err(dev, "invalid vport(%u)\n", vf_id);
+ return;
+ }
+
+@@ -1760,8 +1760,8 @@ static void hclge_handle_over_8bd_err(struct hclge_dev *hdev,
+
+ ret = hclge_inform_reset_assert_to_vf(&hdev->vport[vf_id]);
+ if (ret)
+- dev_err(dev, "inform reset to vf(%u) failed %d!\n",
+- hdev->vport->vport_id, ret);
++ dev_err(dev, "inform reset to vport(%u) failed %d!\n",
++ vf_id, ret);
+ } else {
+ set_bit(HNAE3_FUNC_RESET, reset_requests);
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 24357e907155..a00d71ad82b1 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -3418,7 +3418,8 @@ static int hclge_set_all_vf_rst(struct hclge_dev *hdev, bool reset)
+ if (ret) {
+ dev_err(&hdev->pdev->dev,
+ "set vf(%u) rst failed %d!\n",
+- vport->vport_id, ret);
++ vport->vport_id - HCLGE_VF_VPORT_START_NUM,
++ ret);
+ return ret;
+ }
+
+@@ -3433,7 +3434,8 @@ static int hclge_set_all_vf_rst(struct hclge_dev *hdev, bool reset)
+ if (ret)
+ dev_warn(&hdev->pdev->dev,
+ "inform reset to vf(%u) failed %d!\n",
+- vport->vport_id, ret);
++ vport->vport_id - HCLGE_VF_VPORT_START_NUM,
++ ret);
+ }
+
+ return 0;
+@@ -10043,11 +10045,11 @@ static void hclge_clear_resetting_state(struct hclge_dev *hdev)
+ struct hclge_vport *vport = &hdev->vport[i];
+ int ret;
+
+- /* Send cmd to clear VF's FUNC_RST_ING */
++ /* Send cmd to clear vport's FUNC_RST_ING */
+ ret = hclge_set_vf_rst(hdev, vport->vport_id, false);
+ if (ret)
+ dev_warn(&hdev->pdev->dev,
+- "clear vf(%u) rst failed %d!\n",
++ "clear vport(%u) rst failed %d!\n",
+ vport->vport_id, ret);
+ }
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+index ff9d84a7147f..8c528ea33406 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+@@ -557,7 +557,7 @@ static int hclge_reset_vf(struct hclge_vport *vport)
+ struct hclge_dev *hdev = vport->back;
+
+ dev_warn(&hdev->pdev->dev, "PF received VF reset request from VF %u!",
+- vport->vport_id);
++ vport->vport_id - HCLGE_VF_VPORT_START_NUM);
+
+ return hclge_func_reset_cmd(hdev, vport->vport_id);
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index e8495f58a1a8..801ba349498f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -546,7 +546,7 @@ int hclge_tm_qs_shaper_cfg(struct hclge_vport *vport, int max_tx_rate)
+ ret = hclge_cmd_send(&hdev->hw, &desc, 1);
+ if (ret) {
+ dev_err(&hdev->pdev->dev,
+- "vf%u, qs%u failed to set tx_rate:%d, ret=%d\n",
++ "vport%u, qs%u failed to set tx_rate:%d, ret=%d\n",
+ vport->vport_id, shap_cfg_cmd->qs_id,
+ max_tx_rate, ret);
+ return ret;
+--
+2.33.0
+
--- /dev/null
+From 4a4aba8169ef3cd2c8a62f68d5f34865730a08da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Sep 2021 09:51:45 +0300
+Subject: net/mlx4_en: Don't allow aRFS for encapsulated packets
+
+From: Aya Levin <ayal@nvidia.com>
+
+[ Upstream commit fdbccea419dc782079ce5881d2705cc9e3881480 ]
+
+Driver doesn't support aRFS for encapsulated packets, return early error
+in such a case.
+
+Fixes: 1eb8c695bda9 ("net/mlx4_en: Add accelerated RFS support")
+Signed-off-by: Aya Levin <ayal@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 49a11406b6ab..00fe2e2893cd 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -372,6 +372,9 @@ mlx4_en_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
+ int nhoff = skb_network_offset(skb);
+ int ret = 0;
+
++ if (skb->encapsulation)
++ return -EPROTONOSUPPORT;
++
+ if (skb->protocol != htons(ETH_P_IP))
+ return -EPROTONOSUPPORT;
+
+--
+2.33.0
+
--- /dev/null
+From d161613ee7b68dba877408f5edc8fe9d0fa2646a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Sep 2021 14:55:45 +0300
+Subject: net/mlx4_en: Resolve bad operstate value
+
+From: Lama Kayal <lkayal@nvidia.com>
+
+[ Upstream commit 72a3c58d18fd780eecd80178bb2132ce741a0a74 ]
+
+Any link state change that's done prior to net device registration
+isn't reflected on the state, thus the operational state is left
+obsolete, with 'UNKNOWN' status.
+
+To resolve the issue, query link state from FW upon open operations
+to ensure operational state is updated.
+
+Fixes: c27a02cd94d6 ("mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC")
+Signed-off-by: Lama Kayal <lkayal@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx4/en_netdev.c | 47 ++++++++++++-------
+ drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 1 -
+ 2 files changed, 29 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index d8a20e83d904..49a11406b6ab 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1269,7 +1269,6 @@ static void mlx4_en_do_set_rx_mode(struct work_struct *work)
+ if (!netif_carrier_ok(dev)) {
+ if (!mlx4_en_QUERY_PORT(mdev, priv->port)) {
+ if (priv->port_state.link_state) {
+- priv->last_link_state = MLX4_DEV_EVENT_PORT_UP;
+ netif_carrier_on(dev);
+ en_dbg(LINK, priv, "Link Up\n");
+ }
+@@ -1557,26 +1556,36 @@ static void mlx4_en_service_task(struct work_struct *work)
+ mutex_unlock(&mdev->state_lock);
+ }
+
+-static void mlx4_en_linkstate(struct work_struct *work)
++static void mlx4_en_linkstate(struct mlx4_en_priv *priv)
++{
++ struct mlx4_en_port_state *port_state = &priv->port_state;
++ struct mlx4_en_dev *mdev = priv->mdev;
++ struct net_device *dev = priv->dev;
++ bool up;
++
++ if (mlx4_en_QUERY_PORT(mdev, priv->port))
++ port_state->link_state = MLX4_PORT_STATE_DEV_EVENT_PORT_DOWN;
++
++ up = port_state->link_state == MLX4_PORT_STATE_DEV_EVENT_PORT_UP;
++ if (up == netif_carrier_ok(dev))
++ netif_carrier_event(dev);
++ if (!up) {
++ en_info(priv, "Link Down\n");
++ netif_carrier_off(dev);
++ } else {
++ en_info(priv, "Link Up\n");
++ netif_carrier_on(dev);
++ }
++}
++
++static void mlx4_en_linkstate_work(struct work_struct *work)
+ {
+ struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv,
+ linkstate_task);
+ struct mlx4_en_dev *mdev = priv->mdev;
+- int linkstate = priv->link_state;
+
+ mutex_lock(&mdev->state_lock);
+- /* If observable port state changed set carrier state and
+- * report to system log */
+- if (priv->last_link_state != linkstate) {
+- if (linkstate == MLX4_DEV_EVENT_PORT_DOWN) {
+- en_info(priv, "Link Down\n");
+- netif_carrier_off(priv->dev);
+- } else {
+- en_info(priv, "Link Up\n");
+- netif_carrier_on(priv->dev);
+- }
+- }
+- priv->last_link_state = linkstate;
++ mlx4_en_linkstate(priv);
+ mutex_unlock(&mdev->state_lock);
+ }
+
+@@ -2080,9 +2089,11 @@ static int mlx4_en_open(struct net_device *dev)
+ mlx4_en_clear_stats(dev);
+
+ err = mlx4_en_start_port(dev);
+- if (err)
++ if (err) {
+ en_err(priv, "Failed starting port:%d\n", priv->port);
+-
++ goto out;
++ }
++ mlx4_en_linkstate(priv);
+ out:
+ mutex_unlock(&mdev->state_lock);
+ return err;
+@@ -3173,7 +3184,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
+ spin_lock_init(&priv->stats_lock);
+ INIT_WORK(&priv->rx_mode_task, mlx4_en_do_set_rx_mode);
+ INIT_WORK(&priv->restart_task, mlx4_en_restart);
+- INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate);
++ INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate_work);
+ INIT_DELAYED_WORK(&priv->stats_task, mlx4_en_do_get_stats);
+ INIT_DELAYED_WORK(&priv->service_task, mlx4_en_service_task);
+ #ifdef CONFIG_RFS_ACCEL
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+index 0aa4a23ad3de..c1f23dc3b0e6 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -571,7 +571,6 @@ struct mlx4_en_priv {
+
+ struct mlx4_hwq_resources res;
+ int link_state;
+- int last_link_state;
+ bool port_up;
+ int port;
+ int registered;
+--
+2.33.0
+
--- /dev/null
+From a9e859ff4327d2fb76b787590acfe1b6fe86f75c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Sep 2021 21:18:14 +0200
+Subject: net/smc: add missing error check in smc_clc_prfx_set()
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+[ Upstream commit 6c90731980655280ea07ce4b21eb97457bf86286 ]
+
+Coverity stumbled over a missing error check in smc_clc_prfx_set():
+
+*** CID 1475954: Error handling issues (CHECKED_RETURN)
+/net/smc/smc_clc.c: 233 in smc_clc_prfx_set()
+>>> CID 1475954: Error handling issues (CHECKED_RETURN)
+>>> Calling "kernel_getsockname" without checking return value (as is done elsewhere 8 out of 10 times).
+233 kernel_getsockname(clcsock, (struct sockaddr *)&addrs);
+
+Add the return code check in smc_clc_prfx_set().
+
+Fixes: c246d942eabc ("net/smc: restructure netinfo for CLC proposal msgs")
+Reported-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_clc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
+index 696d89c2dce4..5ee5b2ce29a6 100644
+--- a/net/smc/smc_clc.c
++++ b/net/smc/smc_clc.c
+@@ -230,7 +230,8 @@ static int smc_clc_prfx_set(struct socket *clcsock,
+ goto out_rel;
+ }
+ /* get address to which the internal TCP socket is bound */
+- kernel_getsockname(clcsock, (struct sockaddr *)&addrs);
++ if (kernel_getsockname(clcsock, (struct sockaddr *)&addrs) < 0)
++ goto out_rel;
+ /* analyze IP specific data of net_device belonging to TCP socket */
+ addr6 = (struct sockaddr_in6 *)&addrs;
+ rcu_read_lock();
+--
+2.33.0
+
--- /dev/null
+From 5a54a9e366090820f69a29e53914d47bead538fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Sep 2021 21:18:15 +0200
+Subject: net/smc: fix 'workqueue leaked lock' in smc_conn_abort_work
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+[ Upstream commit a18cee4791b1123d0a6579a7c89f4b87e48abe03 ]
+
+The abort_work is scheduled when a connection was detected to be
+out-of-sync after a link failure. The work calls smc_conn_kill(),
+which calls smc_close_active_abort() and that might end up calling
+smc_close_cancel_work().
+smc_close_cancel_work() cancels any pending close_work and tx_work but
+needs to release the sock_lock before and acquires the sock_lock again
+afterwards. So when the sock_lock was NOT acquired before then it may
+be held after the abort_work completes. Thats why the sock_lock is
+acquired before the call to smc_conn_kill() in __smc_lgr_terminate(),
+but this is missing in smc_conn_abort_work().
+
+Fix that by acquiring the sock_lock first and release it after the
+call to smc_conn_kill().
+
+Fixes: b286a0651e44 ("net/smc: handle incoming CDC validation message")
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index af96f813c075..c491dd8e67cd 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -1089,7 +1089,9 @@ static void smc_conn_abort_work(struct work_struct *work)
+ abort_work);
+ struct smc_sock *smc = container_of(conn, struct smc_sock, conn);
+
++ lock_sock(&smc->sk);
+ smc_conn_kill(conn, true);
++ release_sock(&smc->sk);
+ sock_put(&smc->sk); /* sock_hold done by schedulers of abort_work */
+ }
+
+--
+2.33.0
+
--- /dev/null
+From d5780e3e6bbe86a1054c26258719e3e91e40ca90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 17:53:10 +0300
+Subject: platform/x86/intel: punit_ipc: Drop wrong use of ACPI_PTR()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 349bff48ae0f5f8aa2075d0bdc2091a30bd634f6 ]
+
+ACPI_PTR() is more harmful than helpful. For example, in this case
+if CONFIG_ACPI=n, the ID table left unused which is not what we want.
+
+Instead of adding ifdeffery here and there, drop ACPI_PTR()
+and unused acpi.h.
+
+Fixes: fdca4f16f57d ("platform:x86: add Intel P-Unit mailbox IPC driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210827145310.76239-1-andriy.shevchenko@linux.intel.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel_punit_ipc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c
+index f58b8543f6ac..66bb39fd0ef9 100644
+--- a/drivers/platform/x86/intel_punit_ipc.c
++++ b/drivers/platform/x86/intel_punit_ipc.c
+@@ -8,7 +8,6 @@
+ * which provide mailbox interface for power management usage.
+ */
+
+-#include <linux/acpi.h>
+ #include <linux/bitops.h>
+ #include <linux/delay.h>
+ #include <linux/device.h>
+@@ -319,7 +318,7 @@ static struct platform_driver intel_punit_ipc_driver = {
+ .remove = intel_punit_ipc_remove,
+ .driver = {
+ .name = "intel_punit_ipc",
+- .acpi_match_table = ACPI_PTR(punit_ipc_acpi_ids),
++ .acpi_match_table = punit_ipc_acpi_ids,
+ },
+ };
+
+--
+2.33.0
+
--- /dev/null
+From f91d5896e68a142a2edd8243120caae2936ce9cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Sep 2021 13:53:26 +0300
+Subject: qed: rdma - don't wait for resources under hw error recovery flow
+
+From: Shai Malin <smalin@marvell.com>
+
+[ Upstream commit 1ea7812326004afd2803cc968a4776ae5120a597 ]
+
+If the HW device is during recovery, the HW resources will never return,
+hence we shouldn't wait for the CID (HW context ID) bitmaps to clear.
+This fix speeds up the error recovery flow.
+
+Fixes: 64515dc899df ("qed: Add infrastructure for error detection and recovery")
+Signed-off-by: Michal Kalderon <mkalderon@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: Shai Malin <smalin@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 8 ++++++++
+ drivers/net/ethernet/qlogic/qed/qed_roce.c | 8 ++++++++
+ 2 files changed, 16 insertions(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+index a99861124630..68fbe536a1f3 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+@@ -1297,6 +1297,14 @@ qed_iwarp_wait_cid_map_cleared(struct qed_hwfn *p_hwfn, struct qed_bmap *bmap)
+ prev_weight = weight;
+
+ while (weight) {
++ /* If the HW device is during recovery, all resources are
++ * immediately reset without receiving a per-cid indication
++ * from HW. In this case we don't expect the cid_map to be
++ * cleared.
++ */
++ if (p_hwfn->cdev->recov_in_prog)
++ return 0;
++
+ msleep(QED_IWARP_MAX_CID_CLEAN_TIME);
+
+ weight = bitmap_weight(bmap->bitmap, bmap->max_count);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c
+index f16a157bb95a..cf5baa5e59bc 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
+@@ -77,6 +77,14 @@ void qed_roce_stop(struct qed_hwfn *p_hwfn)
+ * Beyond the added delay we clear the bitmap anyway.
+ */
+ while (bitmap_weight(rcid_map->bitmap, rcid_map->max_count)) {
++ /* If the HW device is during recovery, all resources are
++ * immediately reset without receiving a per-cid indication
++ * from HW. In this case we don't expect the cid bitmap to be
++ * cleared.
++ */
++ if (p_hwfn->cdev->recov_in_prog)
++ return;
++
+ msleep(100);
+ if (wait_count++ > 20) {
+ DP_NOTICE(p_hwfn, "cid bitmap wait timed out\n");
+--
+2.33.0
+
--- /dev/null
+From 840557f46ba3f39a0989d53ab62ad226dec63e7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Sep 2021 16:52:17 +0200
+Subject: s390/qeth: fix deadlock during failing recovery
+
+From: Alexandra Winter <wintera@linux.ibm.com>
+
+[ Upstream commit d2b59bd4b06d84a4eadb520b0f71c62fe8ec0a62 ]
+
+Commit 0b9902c1fcc5 ("s390/qeth: fix deadlock during recovery") removed
+taking discipline_mutex inside qeth_do_reset(), fixing potential
+deadlocks. An error path was missed though, that still takes
+discipline_mutex and thus has the original deadlock potential.
+
+Intermittent deadlocks were seen when a qeth channel path is configured
+offline, causing a race between qeth_do_reset and ccwgroup_remove.
+Call qeth_set_offline() directly in the qeth_do_reset() error case and
+then a new variant of ccwgroup_set_offline(), without taking
+discipline_mutex.
+
+Fixes: b41b554c1ee7 ("s390/qeth: fix locking for discipline setup / removal")
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Reviewed-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/ccwgroup.h | 2 +-
+ drivers/s390/cio/ccwgroup.c | 10 ++++++++--
+ drivers/s390/net/qeth_core_main.c | 3 ++-
+ 3 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/arch/s390/include/asm/ccwgroup.h b/arch/s390/include/asm/ccwgroup.h
+index ad3acb1e882b..8a22da9a735a 100644
+--- a/arch/s390/include/asm/ccwgroup.h
++++ b/arch/s390/include/asm/ccwgroup.h
+@@ -58,7 +58,7 @@ struct ccwgroup_device *get_ccwgroupdev_by_busid(struct ccwgroup_driver *gdrv,
+ char *bus_id);
+
+ extern int ccwgroup_set_online(struct ccwgroup_device *gdev);
+-extern int ccwgroup_set_offline(struct ccwgroup_device *gdev);
++int ccwgroup_set_offline(struct ccwgroup_device *gdev, bool call_gdrv);
+
+ extern int ccwgroup_probe_ccwdev(struct ccw_device *cdev);
+ extern void ccwgroup_remove_ccwdev(struct ccw_device *cdev);
+diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
+index 483a9ecfcbb1..cfdc1c7825d0 100644
+--- a/drivers/s390/cio/ccwgroup.c
++++ b/drivers/s390/cio/ccwgroup.c
+@@ -98,12 +98,13 @@ EXPORT_SYMBOL(ccwgroup_set_online);
+ /**
+ * ccwgroup_set_offline() - disable a ccwgroup device
+ * @gdev: target ccwgroup device
++ * @call_gdrv: Call the registered gdrv set_offline function
+ *
+ * This function attempts to put the ccwgroup device into the offline state.
+ * Returns:
+ * %0 on success and a negative error value on failure.
+ */
+-int ccwgroup_set_offline(struct ccwgroup_device *gdev)
++int ccwgroup_set_offline(struct ccwgroup_device *gdev, bool call_gdrv)
+ {
+ struct ccwgroup_driver *gdrv = to_ccwgroupdrv(gdev->dev.driver);
+ int ret = -EINVAL;
+@@ -112,11 +113,16 @@ int ccwgroup_set_offline(struct ccwgroup_device *gdev)
+ return -EAGAIN;
+ if (gdev->state == CCWGROUP_OFFLINE)
+ goto out;
++ if (!call_gdrv) {
++ ret = 0;
++ goto offline;
++ }
+ if (gdrv->set_offline)
+ ret = gdrv->set_offline(gdev);
+ if (ret)
+ goto out;
+
++offline:
+ gdev->state = CCWGROUP_OFFLINE;
+ out:
+ atomic_set(&gdev->onoff, 0);
+@@ -145,7 +151,7 @@ static ssize_t ccwgroup_online_store(struct device *dev,
+ if (value == 1)
+ ret = ccwgroup_set_online(gdev);
+ else if (value == 0)
+- ret = ccwgroup_set_offline(gdev);
++ ret = ccwgroup_set_offline(gdev, true);
+ else
+ ret = -EINVAL;
+ out:
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 7b0155b0e99e..15477bfb5bd8 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -5406,7 +5406,8 @@ static int qeth_do_reset(void *data)
+ dev_info(&card->gdev->dev,
+ "Device successfully recovered!\n");
+ } else {
+- ccwgroup_set_offline(card->gdev);
++ qeth_set_offline(card, disc, true);
++ ccwgroup_set_offline(card->gdev, false);
+ dev_warn(&card->gdev->dev,
+ "The qeth device driver failed to recover an error on the device\n");
+ }
+--
+2.33.0
+
--- /dev/null
+From 44afeea40901165b55c38292448b6fa19e1a84a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Sep 2021 16:52:15 +0200
+Subject: s390/qeth: fix NULL deref in qeth_clear_working_pool_list()
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 248f064af222a1f97ee02c84a98013dfbccad386 ]
+
+When qeth_set_online() calls qeth_clear_working_pool_list() to roll
+back after an error exit from qeth_hardsetup_card(), we are at risk of
+accessing card->qdio.in_q before it was allocated by
+qeth_alloc_qdio_queues() via qeth_mpc_initialize().
+
+qeth_clear_working_pool_list() then dereferences NULL, and by writing to
+queue->bufs[i].pool_entry scribbles all over the CPU's lowcore.
+Resulting in a crash when those lowcore areas are used next (eg. on
+the next machine-check interrupt).
+
+Such a scenario would typically happen when the device is first set
+online and its queues aren't allocated yet. An early IO error or certain
+misconfigs (eg. mismatched transport mode, bad portno) then cause us to
+error out from qeth_hardsetup_card() with card->qdio.in_q still being
+NULL.
+
+Fix it by checking the pointer for NULL before accessing it.
+
+Note that we also have (rare) paths inside qeth_mpc_initialize() where
+a configuration change can cause us to free the existing queues,
+expecting that subsequent code will allocate them again. If we then
+error out before that re-allocation happens, the same bug occurs.
+
+Fixes: eff73e16ee11 ("s390/qeth: tolerate pre-filled RX buffer")
+Reported-by: Stefan Raspl <raspl@linux.ibm.com>
+Root-caused-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_core_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 4d51c4ace8ea..7b0155b0e99e 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -210,6 +210,9 @@ static void qeth_clear_working_pool_list(struct qeth_card *card)
+ &card->qdio.in_buf_pool.entry_list, list)
+ list_del(&pool_entry->list);
+
++ if (!queue)
++ return;
++
+ for (i = 0; i < ARRAY_SIZE(queue->bufs); i++)
+ queue->bufs[i].pool_entry = NULL;
+ }
+--
+2.33.0
+
drm-amd-pm-update-intermediate-power-state-for-si.patch
net-hso-fix-muxed-tty-registration.patch
comedi-fix-memory-leak-in-compat_insnlist.patch
+afs-fix-incorrect-triggering-of-sillyrename-on-3rd-p.patch
+afs-fix-updating-of-i_blocks-on-file-dir-extension.patch
+platform-x86-intel-punit_ipc-drop-wrong-use-of-acpi_.patch
+enetc-fix-illegal-access-when-reading-affinity_hint.patch
+enetc-fix-uninitialized-struct-dim_sample-field-usag.patch
+net-mlx4_en-resolve-bad-operstate-value.patch
+bnxt_en-fix-tx-timeout-when-tx-ring-size-is-set-to-t.patch
+net-hns3-fix-change-rss-hfunc-ineffective-issue.patch
+net-hns3-fix-misuse-vf-id-and-vport-id-in-some-logs.patch
+net-hns3-check-queue-id-range-before-using.patch
+net-smc-add-missing-error-check-in-smc_clc_prfx_set.patch
+net-smc-fix-workqueue-leaked-lock-in-smc_conn_abort_.patch
+net-dsa-don-t-allocate-the-slave_mii_bus-using-devre.patch
+net-dsa-realtek-register-the-mdio-bus-under-devres.patch
+kselftest-arm64-signal-add-sve-to-the-set-of-feature.patch
+kselftest-arm64-signal-skip-tests-if-required-featur.patch
+s390-qeth-fix-null-deref-in-qeth_clear_working_pool_.patch
+s390-qeth-fix-deadlock-during-failing-recovery.patch
+gpio-uniphier-fix-void-functions-to-remove-return-va.patch
+qed-rdma-don-t-wait-for-resources-under-hw-error-rec.patch
+net-mlx4_en-don-t-allow-arfs-for-encapsulated-packet.patch
+atlantic-fix-issue-in-the-pm-resume-flow.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
