--- /dev/null
+From 49bcaf49bda75e70ca8fd068c3f1548281118a8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jul 2021 09:35:23 +0100
+Subject: arm64: dts: qcom: c630: fix correct powerdown pin for WSA881x
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 9a253bb42f190efd1a1c156939ad7298b3529dca ]
+
+WSA881x powerdown pin is connected to GPIO1, GPIO2 not GPIO2 and GPIO3,
+so correct this. This was working so far due to a shift bug in gpio driver,
+however once that is fixed this will stop working, so fix this!
+
+For some reason we forgot to add this dts change in last merge cycle so
+currently audio is broken in 5.13 as the gpio driver fix already landed
+in 5.13.
+
+Reported-by: Shawn Guo <shawnguo@kernel.org>
+Fixes: 45021d35fcb2 ("arm64: dts: qcom: c630: Enable audio support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Tested-by: Shawn Guo <shawnguo@kernel.org>
+Link: https://lore.kernel.org/r/20210706083523.10601-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+index c2a709a384e9..d7591a4621a2 100644
+--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
++++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+@@ -700,7 +700,7 @@
+ left_spkr: wsa8810-left{
+ compatible = "sdw10217211000";
+ reg = <0 3>;
+- powerdown-gpios = <&wcdgpio 2 GPIO_ACTIVE_HIGH>;
++ powerdown-gpios = <&wcdgpio 1 GPIO_ACTIVE_HIGH>;
+ #thermal-sensor-cells = <0>;
+ sound-name-prefix = "SpkrLeft";
+ #sound-dai-cells = <0>;
+@@ -708,7 +708,7 @@
+
+ right_spkr: wsa8810-right{
+ compatible = "sdw10217211000";
+- powerdown-gpios = <&wcdgpio 3 GPIO_ACTIVE_HIGH>;
++ powerdown-gpios = <&wcdgpio 2 GPIO_ACTIVE_HIGH>;
+ reg = <0 4>;
+ #thermal-sensor-cells = <0>;
+ sound-name-prefix = "SpkrRight";
+--
+2.30.2
+
--- /dev/null
+From 79de348bb0fa56e51288294d5986d6b0350825e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 20:57:34 +0200
+Subject: arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem mapping
+
+From: Petr Vorel <petr.vorel@gmail.com>
+
+[ Upstream commit 3cb6a271f4b04f11270111638c24fa5c0b846dec ]
+
+cont_splash_mem has different memory mapping than generic from msm8994.dtsi:
+
+[ 0.000000] cma: Found cont_splash_mem@0, memory base 0x0000000003400000, size 12 MiB, limit 0xffffffffffffffff
+[ 0.000000] cma: CMA: reserved 12 MiB at 0x0000000003400000 for cont_splash_mem
+
+This fixes boot.
+
+Fixes: 976d321f32dc ("arm64: dts: qcom: msm8992: Make the DT an overlay on top of 8994")
+Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
+Link: https://lore.kernel.org/r/20210713185734.380-3-petr.vorel@gmail.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
+index 5c6e17f11ee9..1ccca83292ac 100644
+--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
++++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
+@@ -10,6 +10,9 @@
+ #include "pm8994.dtsi"
+ #include "pmi8994.dtsi"
+
++/* cont_splash_mem has different memory mapping */
++/delete-node/ &cont_splash_mem;
++
+ / {
+ model = "LG Nexus 5X";
+ compatible = "lg,bullhead", "qcom,msm8992";
+@@ -42,6 +45,11 @@
+ ftrace-size = <0x10000>;
+ pmsg-size = <0x20000>;
+ };
++
++ cont_splash_mem: memory@3400000 {
++ reg = <0 0x03400000 0 0x1200000>;
++ no-map;
++ };
+ };
+ };
+
+--
+2.30.2
+
--- /dev/null
+From ae08d4013dbd6a7247fc704079e9827b9534e1df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 20:57:33 +0200
+Subject: arm64: dts: qcom: msm8992-bullhead: Remove PSCI
+
+From: Petr Vorel <petr.vorel@gmail.com>
+
+[ Upstream commit 9d1fc2e4f5a94a492c7dd1ca577c66fdb7571c84 ]
+
+Bullhead firmware obviously doesn't support PSCI as it fails to boot
+with this definition.
+
+Fixes: 329e16d5f8fc ("arm64: dts: qcom: msm8992: Add PSCI support.")
+Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
+Link: https://lore.kernel.org/r/20210713185734.380-2-petr.vorel@gmail.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
+index 23cdcc9f7c72..5c6e17f11ee9 100644
+--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
++++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /* Copyright (c) 2015, LGE Inc. All rights reserved.
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2021, Petr Vorel <petr.vorel@gmail.com>
+ */
+
+ /dts-v1/;
+@@ -17,6 +18,9 @@
+ qcom,board-id = <0xb64 0>;
+ qcom,pmic-id = <0x10009 0x1000A 0x0 0x0>;
+
++ /* Bullhead firmware doesn't support PSCI */
++ /delete-node/ psci;
++
+ aliases {
+ serial0 = &blsp1_uart2;
+ };
+--
+2.30.2
+
--- /dev/null
+From 0e8c4e559b67a02185c6b56c0f079ef1a3205457 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jun 2021 21:10:19 +0200
+Subject: arm64: dts: qcom: msm8994-angler: Disable cont_splash_mem
+
+From: Petr Vorel <petr.vorel@gmail.com>
+
+[ Upstream commit 0e5ded926f2a0f8b57dfa7f0d69a30767e1ea2ce ]
+
+As the default definition breaks booting angler:
+[ 1.862561] printk: console [ttyMSM0] enabled
+[ 1.872260] msm_serial: driver initialized
+D - 15524 - pm_driver_init, Delta
+
+cont_splash_mem was introduced in 74d6d0a145835, but the problem
+manifested after commit '86588296acbf ("fdt: Properly handle "no-map"
+field in the memory region")'.
+
+Disabling it because Angler's firmware does not report where the memory
+is allocated (dmesg from downstream kernel):
+[ 0.000000] cma: Found cont_splash_mem@0, memory base 0x0000000000000000, size 16 MiB, limit 0x0000000000000000
+[ 0.000000] cma: CMA: reserved 16 MiB at 0x0000000000000000 for cont_splash_mem
+
+Similar issue might be on Google Nexus 5X (lg-bullhead). Other MSM8992/4
+are known to report correct address.
+
+Fixes: 74d6d0a145835 ("arm64: dts: qcom: msm8994/8994-kitakami: Fix up the memory map")
+Suggested-by: Konrad Dybcio <konradybcio@gmail.com>
+Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
+Link: https://lore.kernel.org/r/20210622191019.23771-1-petr.vorel@gmail.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts
+index baa55643b40f..801995af3dfc 100644
+--- a/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts
++++ b/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts
+@@ -1,12 +1,16 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /* Copyright (c) 2015, Huawei Inc. All rights reserved.
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2021, Petr Vorel <petr.vorel@gmail.com>
+ */
+
+ /dts-v1/;
+
+ #include "msm8994.dtsi"
+
++/* Angler's firmware does not report where the memory is allocated */
++/delete-node/ &cont_splash_mem;
++
+ / {
+ model = "Huawei Nexus 6P";
+ compatible = "huawei,angler", "qcom,msm8994";
+--
+2.30.2
+
--- /dev/null
+From 06b6ac0803817885428e97639c4515c5c8db96bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jul 2021 15:33:38 +0000
+Subject: arm64: dts: qcom: sdm845-oneplus: fix reserved-mem
+
+From: Caleb Connolly <caleb@connolly.tech>
+
+[ Upstream commit d77c95bf9a64d8620662151b2b10efd8221f4bcc ]
+
+Fix the upper guard and the "removed_region", this fixes the random
+crashes which used to occur in memory intensive loads. I'm not sure WHY
+the upper guard being 0x2000 instead of 0x1000 doesn't fix this, but it
+HAS to be 0x1000.
+
+Fixes: e60fd5ac1f68 ("arm64: dts: qcom: sdm845-oneplus-common: guard rmtfs-mem")
+Signed-off-by: Caleb Connolly <caleb@connolly.tech>
+Link: https://lore.kernel.org/r/20210720153125.43389-2-caleb@connolly.tech
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
+index f712771df0c7..846eebebd831 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
+@@ -69,7 +69,7 @@
+ };
+ rmtfs_upper_guard: memory@f5d01000 {
+ no-map;
+- reg = <0 0xf5d01000 0 0x2000>;
++ reg = <0 0xf5d01000 0 0x1000>;
+ };
+
+ /*
+@@ -78,7 +78,7 @@
+ */
+ removed_region: memory@88f00000 {
+ no-map;
+- reg = <0 0x88f00000 0 0x200000>;
++ reg = <0 0x88f00000 0 0x1c00000>;
+ };
+
+ ramoops: ramoops@ac300000 {
+--
+2.30.2
+
--- /dev/null
+From a6f804dcee06114d515767bd4b3f6e3d6d8e0d88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 14:42:42 -0700
+Subject: bnxt: count Tx drops
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit fb9f7190092d2bbd1f8f0b1cc252732cbe99a87e ]
+
+Drivers should count packets they are dropping.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index ea67c8c07a8b..a30ded73bba1 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -409,6 +409,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ i = skb_get_queue_mapping(skb);
+ if (unlikely(i >= bp->tx_nr_rings)) {
+ dev_kfree_skb_any(skb);
++ atomic_long_inc(&dev->tx_dropped);
+ return NETDEV_TX_OK;
+ }
+
+@@ -663,6 +664,7 @@ tx_kick_pending:
+ if (txr->kick_pending)
+ bnxt_txr_db_kick(bp, txr, txr->tx_prod);
+ txr->tx_buf_ring[txr->tx_prod].skb = NULL;
++ atomic_long_inc(&dev->tx_dropped);
+ return NETDEV_TX_OK;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From be11f5a1d0ca152eb79926391b4c2398be1fbce9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 14:42:40 -0700
+Subject: bnxt: disable napi before canceling DIM
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 01cca6b9330ac7460de44eeeb3a0607f8aae69ff ]
+
+napi schedules DIM, napi has to be disabled first,
+then DIM canceled.
+
+Noticed while reading the code.
+
+Fixes: 0bc0b97fca73 ("bnxt_en: cleanup DIM work on device shutdown")
+Fixes: 6a8788f25625 ("bnxt_en: add support for software dynamic interrupt moderation")
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index d0b3be7b1c1a..17ee5c436069 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -9024,10 +9024,9 @@ static void bnxt_disable_napi(struct bnxt *bp)
+ for (i = 0; i < bp->cp_nr_rings; i++) {
+ struct bnxt_cp_ring_info *cpr = &bp->bnapi[i]->cp_ring;
+
++ napi_disable(&bp->bnapi[i]->napi);
+ if (bp->bnapi[i]->rx_ring)
+ cancel_work_sync(&cpr->dim.work);
+-
+- napi_disable(&bp->bnapi[i]->napi);
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 141e6866975bd90173325522bb449d74973c42d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 14:42:39 -0700
+Subject: bnxt: don't lock the tx queue from napi poll
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 3c603136c9f82833813af77185618de5af67676c ]
+
+We can't take the tx lock from the napi poll routine, because
+netpoll can poll napi at any moment, including with the tx lock
+already held.
+
+The tx lock is protecting against two paths - the disable
+path, and (as Michael points out) the NETDEV_TX_BUSY case
+which may occur if NAPI completions race with start_xmit
+and both decide to re-enable the queue.
+
+For the disable/ifdown path use synchronize_net() to make sure
+closing the device does not race we restarting the queues.
+Annotate accesses to dev_state against data races.
+
+For the NAPI cleanup vs start_xmit path - appropriate barriers
+are already in place in the main spot where Tx queue is stopped
+but we need to do the same careful dance in the TX_BUSY case.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 54 ++++++++++++++---------
+ 1 file changed, 32 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 3c3aa9467310..d0b3be7b1c1a 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -362,6 +362,26 @@ static u16 bnxt_xmit_get_cfa_action(struct sk_buff *skb)
+ return md_dst->u.port_info.port_id;
+ }
+
++static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp,
++ struct bnxt_tx_ring_info *txr,
++ struct netdev_queue *txq)
++{
++ netif_tx_stop_queue(txq);
++
++ /* netif_tx_stop_queue() must be done before checking
++ * tx index in bnxt_tx_avail() below, because in
++ * bnxt_tx_int(), we update tx index before checking for
++ * netif_tx_queue_stopped().
++ */
++ smp_mb();
++ if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) {
++ netif_tx_wake_queue(txq);
++ return false;
++ }
++
++ return true;
++}
++
+ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bnxt *bp = netdev_priv(dev);
+@@ -390,8 +410,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ free_size = bnxt_tx_avail(bp, txr);
+ if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) {
+- netif_tx_stop_queue(txq);
+- return NETDEV_TX_BUSY;
++ if (bnxt_txr_netif_try_stop_queue(bp, txr, txq))
++ return NETDEV_TX_BUSY;
+ }
+
+ length = skb->len;
+@@ -605,16 +625,7 @@ tx_done:
+ if (netdev_xmit_more() && !tx_buf->is_push)
+ bnxt_db_write(bp, &txr->tx_db, prod);
+
+- netif_tx_stop_queue(txq);
+-
+- /* netif_tx_stop_queue() must be done before checking
+- * tx index in bnxt_tx_avail() below, because in
+- * bnxt_tx_int(), we update tx index before checking for
+- * netif_tx_queue_stopped().
+- */
+- smp_mb();
+- if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh)
+- netif_tx_wake_queue(txq);
++ bnxt_txr_netif_try_stop_queue(bp, txr, txq);
+ }
+ return NETDEV_TX_OK;
+
+@@ -698,14 +709,9 @@ next_tx_int:
+ smp_mb();
+
+ if (unlikely(netif_tx_queue_stopped(txq)) &&
+- (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh)) {
+- __netif_tx_lock(txq, smp_processor_id());
+- if (netif_tx_queue_stopped(txq) &&
+- bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh &&
+- txr->dev_state != BNXT_DEV_STATE_CLOSING)
+- netif_tx_wake_queue(txq);
+- __netif_tx_unlock(txq);
+- }
++ bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh &&
++ READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING)
++ netif_tx_wake_queue(txq);
+ }
+
+ static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping,
+@@ -9055,9 +9061,11 @@ void bnxt_tx_disable(struct bnxt *bp)
+ if (bp->tx_ring) {
+ for (i = 0; i < bp->tx_nr_rings; i++) {
+ txr = &bp->tx_ring[i];
+- txr->dev_state = BNXT_DEV_STATE_CLOSING;
++ WRITE_ONCE(txr->dev_state, BNXT_DEV_STATE_CLOSING);
+ }
+ }
++ /* Make sure napi polls see @dev_state change */
++ synchronize_net();
+ /* Drop carrier first to prevent TX timeout */
+ netif_carrier_off(bp->dev);
+ /* Stop all TX queues */
+@@ -9071,8 +9079,10 @@ void bnxt_tx_enable(struct bnxt *bp)
+
+ for (i = 0; i < bp->tx_nr_rings; i++) {
+ txr = &bp->tx_ring[i];
+- txr->dev_state = 0;
++ WRITE_ONCE(txr->dev_state, 0);
+ }
++ /* Make sure napi polls see @dev_state change */
++ synchronize_net();
+ netif_tx_wake_all_queues(bp->dev);
+ if (bp->link_info.link_up)
+ netif_carrier_on(bp->dev);
+--
+2.30.2
+
--- /dev/null
+From 6aab1d0181026b28a6914b62bd4276c6adb664c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 14:42:41 -0700
+Subject: bnxt: make sure xmit_more + errors does not miss doorbells
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit e8d8c5d80f5e9d4586c68061b62c642752289095 ]
+
+skbs are freed on error and not put on the ring. We may, however,
+be in a situation where we're freeing the last skb of a batch,
+and there is a doorbell ring pending because of xmit_more() being
+true earlier. Make sure we ring the door bell in such situations.
+
+Since errors are rare don't pay attention to xmit_more() and just
+always flush the pending frames.
+
+The busy case should be safe to be left alone because it can
+only happen if start_xmit races with completions and they
+both enable the queue. In that case the kick can't be pending.
+
+Noticed while reading the code.
+
+Fixes: 4d172f21cefe ("bnxt_en: Implement xmit_more.")
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 39 +++++++++++++++--------
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 +
+ 2 files changed, 27 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 17ee5c436069..ea67c8c07a8b 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -69,7 +69,8 @@
+ #include "bnxt_debugfs.h"
+
+ #define BNXT_TX_TIMEOUT (5 * HZ)
+-#define BNXT_DEF_MSG_ENABLE (NETIF_MSG_DRV | NETIF_MSG_HW)
++#define BNXT_DEF_MSG_ENABLE (NETIF_MSG_DRV | NETIF_MSG_HW | \
++ NETIF_MSG_TX_ERR)
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Broadcom BCM573xx network driver");
+@@ -362,6 +363,13 @@ static u16 bnxt_xmit_get_cfa_action(struct sk_buff *skb)
+ return md_dst->u.port_info.port_id;
+ }
+
++static void bnxt_txr_db_kick(struct bnxt *bp, struct bnxt_tx_ring_info *txr,
++ u16 prod)
++{
++ bnxt_db_write(bp, &txr->tx_db, prod);
++ txr->kick_pending = 0;
++}
++
+ static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp,
+ struct bnxt_tx_ring_info *txr,
+ struct netdev_queue *txq)
+@@ -410,6 +418,10 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ free_size = bnxt_tx_avail(bp, txr);
+ if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) {
++ /* We must have raced with NAPI cleanup */
++ if (net_ratelimit() && txr->kick_pending)
++ netif_warn(bp, tx_err, dev,
++ "bnxt: ring busy w/ flush pending!\n");
+ if (bnxt_txr_netif_try_stop_queue(bp, txr, txq))
+ return NETDEV_TX_BUSY;
+ }
+@@ -518,21 +530,16 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ normal_tx:
+ if (length < BNXT_MIN_PKT_SIZE) {
+ pad = BNXT_MIN_PKT_SIZE - length;
+- if (skb_pad(skb, pad)) {
++ if (skb_pad(skb, pad))
+ /* SKB already freed. */
+- tx_buf->skb = NULL;
+- return NETDEV_TX_OK;
+- }
++ goto tx_kick_pending;
+ length = BNXT_MIN_PKT_SIZE;
+ }
+
+ mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);
+
+- if (unlikely(dma_mapping_error(&pdev->dev, mapping))) {
+- dev_kfree_skb_any(skb);
+- tx_buf->skb = NULL;
+- return NETDEV_TX_OK;
+- }
++ if (unlikely(dma_mapping_error(&pdev->dev, mapping)))
++ goto tx_free;
+
+ dma_unmap_addr_set(tx_buf, mapping, mapping);
+ flags = (len << TX_BD_LEN_SHIFT) | TX_BD_TYPE_LONG_TX_BD |
+@@ -617,13 +624,15 @@ normal_tx:
+ txr->tx_prod = prod;
+
+ if (!netdev_xmit_more() || netif_xmit_stopped(txq))
+- bnxt_db_write(bp, &txr->tx_db, prod);
++ bnxt_txr_db_kick(bp, txr, prod);
++ else
++ txr->kick_pending = 1;
+
+ tx_done:
+
+ if (unlikely(bnxt_tx_avail(bp, txr) <= MAX_SKB_FRAGS + 1)) {
+ if (netdev_xmit_more() && !tx_buf->is_push)
+- bnxt_db_write(bp, &txr->tx_db, prod);
++ bnxt_txr_db_kick(bp, txr, prod);
+
+ bnxt_txr_netif_try_stop_queue(bp, txr, txq);
+ }
+@@ -635,7 +644,6 @@ tx_dma_error:
+ /* start back at beginning and unmap skb */
+ prod = txr->tx_prod;
+ tx_buf = &txr->tx_buf_ring[prod];
+- tx_buf->skb = NULL;
+ dma_unmap_single(&pdev->dev, dma_unmap_addr(tx_buf, mapping),
+ skb_headlen(skb), PCI_DMA_TODEVICE);
+ prod = NEXT_TX(prod);
+@@ -649,7 +657,12 @@ tx_dma_error:
+ PCI_DMA_TODEVICE);
+ }
+
++tx_free:
+ dev_kfree_skb_any(skb);
++tx_kick_pending:
++ if (txr->kick_pending)
++ bnxt_txr_db_kick(bp, txr, txr->tx_prod);
++ txr->tx_buf_ring[txr->tx_prod].skb = NULL;
+ return NETDEV_TX_OK;
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 30e47ea343f9..e2f38aaa474b 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -783,6 +783,7 @@ struct bnxt_tx_ring_info {
+ u16 tx_prod;
+ u16 tx_cons;
+ u16 txq_index;
++ u8 kick_pending;
+ struct bnxt_db_info tx_db;
+
+ struct tx_bd *tx_desc_ring[MAX_TX_PAGES];
+--
+2.30.2
+
--- /dev/null
+From 9484be931ffacc935ffba4fd30d3df0d736efb78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Aug 2021 16:15:37 -0400
+Subject: bnxt_en: Add missing DMA memory barriers
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 828affc27ed43441bd1efdaf4e07e96dd43a0362 ]
+
+Each completion ring entry has a valid bit to indicate that the entry
+contains a valid completion event. The driver's main poll loop
+__bnxt_poll_work() has the proper dma_rmb() to make sure the valid
+bit of the next entry has been checked before proceeding further.
+But when we call bnxt_rx_pkt() to process the RX event, the RX
+completion event consists of two completion entries and only the
+first entry has been checked to be valid. We need the same barrier
+after checking the next completion entry. Add missing dma_rmb()
+barriers in bnxt_rx_pkt() and other similar locations.
+
+Fixes: 67a95e2022c7 ("bnxt_en: Need memory barrier when processing the completion ring.")
+Reported-by: Lance Richardson <lance.richardson@broadcom.com>
+Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
+Reviewed-by: Lance Richardson <lance.richardson@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index e4c8c681a3af..b365768a2bda 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1754,6 +1754,10 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+ if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons))
+ return -EBUSY;
+
++ /* The valid test of the entry must be done first before
++ * reading any further.
++ */
++ dma_rmb();
+ prod = rxr->rx_prod;
+
+ if (cmp_type == CMP_TYPE_RX_L2_TPA_START_CMP) {
+@@ -1957,6 +1961,10 @@ static int bnxt_force_rx_discard(struct bnxt *bp,
+ if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons))
+ return -EBUSY;
+
++ /* The valid test of the entry must be done first before
++ * reading any further.
++ */
++ dma_rmb();
+ cmp_type = RX_CMP_TYPE(rxcmp);
+ if (cmp_type == CMP_TYPE_RX_L2_CMP) {
+ rxcmp1->rx_cmp_cfa_code_errors_v2 |=
+@@ -2421,6 +2429,10 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget)
+ if (!TX_CMP_VALID(txcmp, raw_cons))
+ break;
+
++ /* The valid test of the entry must be done first before
++ * reading any further.
++ */
++ dma_rmb();
+ if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) {
+ tmp_raw_cons = NEXT_RAW_CMP(raw_cons);
+ cp_cons = RING_CMP(tmp_raw_cons);
+--
+2.30.2
+
--- /dev/null
+From c37e36f84c67f42fb20a1276692f672af3001904 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Aug 2021 16:15:36 -0400
+Subject: bnxt_en: Disable aRFS if running on 212 firmware
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 976e52b718c3de9077fff8f3f674afb159c57fb1 ]
+
+212 firmware broke aRFS, so disable it. Traffic may stop after ntuple
+filters are inserted and deleted by the 212 firmware.
+
+Fixes: ae10ae740ad2 ("bnxt_en: Add new hardware RFS mode.")
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index a30ded73bba1..e4c8c681a3af 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -10668,6 +10668,9 @@ static bool bnxt_rfs_supported(struct bnxt *bp)
+ return true;
+ return false;
+ }
++ /* 212 firmware is broken for aRFS */
++ if (BNXT_FW_MAJ(bp) == 212)
++ return false;
+ if (BNXT_PF(bp) && !BNXT_CHIP_TYPE_NITRO_A0(bp))
+ return true;
+ if (bp->flags & BNXT_FLAG_NEW_RSS_CAP)
+--
+2.30.2
+
--- /dev/null
+From b3783109872464936d99a7d3e1629d2ff9e46778 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 17:18:10 +0200
+Subject: bpf: Clear zext_dst of dead insns
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 45c709f8c71b525b51988e782febe84ce933e7e0 ]
+
+"access skb fields ok" verifier test fails on s390 with the "verifier
+bug. zext_dst is set, but no reg is defined" message. The first insns
+of the test prog are ...
+
+ 0: 61 01 00 00 00 00 00 00 ldxw %r0,[%r1+0]
+ 8: 35 00 00 01 00 00 00 00 jge %r0,0,1
+ 10: 61 01 00 08 00 00 00 00 ldxw %r0,[%r1+8]
+
+... and the 3rd one is dead (this does not look intentional to me, but
+this is a separate topic).
+
+sanitize_dead_code() converts dead insns into "ja -1", but keeps
+zext_dst. When opt_subreg_zext_lo32_rnd_hi32() tries to parse such
+an insn, it sees this discrepancy and bails. This problem can be seen
+only with JITs whose bpf_jit_needs_zext() returns true.
+
+Fix by clearning dead insns' zext_dst.
+
+The commits that contributed to this problem are:
+
+1. 5aa5bd14c5f8 ("bpf: add initial suite for selftests"), which
+ introduced the test with the dead code.
+2. 5327ed3d44b7 ("bpf: verifier: mark verified-insn with
+ sub-register zext flag"), which introduced the zext_dst flag.
+3. 83a2881903f3 ("bpf: Account for BPF_FETCH in
+ insn_has_def32()"), which introduced the sanity check.
+4. 9183671af6db ("bpf: Fix leakage under speculation on
+ mispredicted branches"), which bisect points to.
+
+It's best to fix this on stable branches that contain the second one,
+since that's the point where the inconsistency was introduced.
+
+Fixes: 5327ed3d44b7 ("bpf: verifier: mark verified-insn with sub-register zext flag")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20210812151811.184086-2-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index eab48745231f..0fbe7ef6b155 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -11632,6 +11632,7 @@ static void sanitize_dead_code(struct bpf_verifier_env *env)
+ if (aux_data[i].seen)
+ continue;
+ memcpy(insn + i, &trap, sizeof(trap));
++ aux_data[i].zext_dst = false;
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From bef7240f78592eec3b636e59fdec1bee1e49340f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 08:34:46 +0300
+Subject: bus: ti-sysc: Fix error handling for sysc_check_active_timer()
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 06a089ef644934372a3062528244fca3417d3430 ]
+
+We have changed the return type for sysc_check_active_timer() from -EBUSY
+to -ENXIO, but the gpt12 system timer fix still checks for -EBUSY. We are
+also not returning on other errors like we did earlier as noted by
+Pavel Machek <pavel@denx.de>.
+
+Commit 3ff340e24c9d ("bus: ti-sysc: Fix gpt12 system timer issue with
+reserved status") should have been updated for commit 65fb73676112
+("bus: ti-sysc: suppress err msg for timers used as clockevent/source").
+
+Let's fix the issue by checking for -ENXIO and returning on any other
+errors as suggested by Pavel Machek <pavel@denx.de>.
+
+Fixes: 3ff340e24c9d ("bus: ti-sysc: Fix gpt12 system timer issue with reserved status")
+Depends-on: 65fb73676112 ("bus: ti-sysc: suppress err msg for timers used as clockevent/source")
+Reported-by: Pavel Machek <pavel@denx.de>
+Reviewed-by: Pavel Machek (CIP) <pavel@denx.de>
+Cc: Grygorii Strashko <grygorii.strashko@ti.com>
+Cc: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 0ef98e3ba341..148a4dd8cb9a 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -3097,8 +3097,10 @@ static int sysc_probe(struct platform_device *pdev)
+ return error;
+
+ error = sysc_check_active_timer(ddata);
+- if (error == -EBUSY)
++ if (error == -ENXIO)
+ ddata->reserved = true;
++ else if (error)
++ return error;
+
+ error = sysc_get_clocks(ddata);
+ if (error)
+--
+2.30.2
+
--- /dev/null
+From f8d69ac96c32839bb2b6a1e64dd111fde69db21b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 10:07:44 +0100
+Subject: cpufreq: arm_scmi: Fix error path when allocation failed
+
+From: Lukasz Luba <lukasz.luba@arm.com>
+
+[ Upstream commit f7d635883fb73414c7c4e2648b42adc296c5d40d ]
+
+Stop the initialization when cpumask allocation failed and return an
+error.
+
+Fixes: 80a064dbd556 ("scmi-cpufreq: Get opp_shared_cpus from opp-v2 for EM")
+Signed-off-by: Lukasz Luba <lukasz.luba@arm.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scmi-cpufreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index ec9a87ca2dbb..75f818d04b48 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -134,7 +134,7 @@ static int scmi_cpufreq_init(struct cpufreq_policy *policy)
+ }
+
+ if (!zalloc_cpumask_var(&opp_shared_cpus, GFP_KERNEL))
+- ret = -ENOMEM;
++ return -ENOMEM;
+
+ /* Obtain CPUs that share SCMI performance controls */
+ ret = scmi_get_sharing_cpus(cpu_dev, policy->cpus);
+--
+2.30.2
+
--- /dev/null
+From 2ff2f02916676ebed26489f64a91461465e305c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jul 2021 00:56:01 +0200
+Subject: cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 484f2b7c61b9ae58cc00c5127bcbcd9177af8dfe ]
+
+The 1.2 GHz variant of the Armada 3720 SOC is unstable with DVFS: when
+the SOC boots, the WTMI firmware sets clocks and AVS values that work
+correctly with 1.2 GHz CPU frequency, but random crashes occur once
+cpufreq driver starts scaling.
+
+We do not know currently what is the reason:
+- it may be that the voltage value for L0 for 1.2 GHz variant provided
+ by the vendor in the OTP is simply incorrect when scaling is used,
+- it may be that some delay is needed somewhere,
+- it may be something else.
+
+The most sane solution now seems to be to simply forbid the cpufreq
+driver on 1.2 GHz variant.
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/armada-37xx-cpufreq.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index 3fc98a3ffd91..c10fc33b29b1 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -104,7 +104,11 @@ struct armada_37xx_dvfs {
+ };
+
+ static struct armada_37xx_dvfs armada_37xx_dvfs[] = {
+- {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} },
++ /*
++ * The cpufreq scaling for 1.2 GHz variant of the SOC is currently
++ * unstable because we do not know how to configure it properly.
++ */
++ /* {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} }, */
+ {.cpu_freq_max = 1000*1000*1000, .divider = {1, 2, 4, 5} },
+ {.cpu_freq_max = 800*1000*1000, .divider = {1, 2, 3, 4} },
+ {.cpu_freq_max = 600*1000*1000, .divider = {2, 4, 5, 6} },
+--
+2.30.2
+
--- /dev/null
+From dd40e384c1f01cbf1274eac47f98173b7af54fb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Aug 2021 16:04:40 -0700
+Subject: dccp: add do-while-0 stubs for dccp_pr_debug macros
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 86aab09a4870bb8346c9579864588c3d7f555299 ]
+
+GCC complains about empty macros in an 'if' statement, so convert
+them to 'do {} while (0)' macros.
+
+Fixes these build warnings:
+
+net/dccp/output.c: In function 'dccp_xmit_packet':
+../net/dccp/output.c:283:71: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
+ 283 | dccp_pr_debug("transmit_skb() returned err=%d\n", err);
+net/dccp/ackvec.c: In function 'dccp_ackvec_update_old':
+../net/dccp/ackvec.c:163:80: warning: suggest braces around empty body in an 'else' statement [-Wempty-body]
+ 163 | (unsigned long long)seqno, state);
+
+Fixes: dc841e30eaea ("dccp: Extend CCID packet dequeueing interface")
+Fixes: 380240864451 ("dccp ccid-2: Update code for the Ack Vector input/registration routine")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: dccp@vger.kernel.org
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dccp/dccp.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
+index 9cc9d1ee6cdb..c5c1d2b8045e 100644
+--- a/net/dccp/dccp.h
++++ b/net/dccp/dccp.h
+@@ -41,9 +41,9 @@ extern bool dccp_debug;
+ #define dccp_pr_debug_cat(format, a...) DCCP_PRINTK(dccp_debug, format, ##a)
+ #define dccp_debug(fmt, a...) dccp_pr_debug_cat(KERN_DEBUG fmt, ##a)
+ #else
+-#define dccp_pr_debug(format, a...)
+-#define dccp_pr_debug_cat(format, a...)
+-#define dccp_debug(format, a...)
++#define dccp_pr_debug(format, a...) do {} while (0)
++#define dccp_pr_debug_cat(format, a...) do {} while (0)
++#define dccp_debug(format, a...) do {} while (0)
+ #endif
+
+ extern struct inet_hashinfo dccp_hashinfo;
+--
+2.30.2
+
--- /dev/null
+From 357a99201250f415086556ac25efcbeba47875ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 08:31:04 -0700
+Subject: drm/amd/display: Use DCN30 watermark calc for DCN301
+
+From: Zhan Liu <zhan.liu@amd.com>
+
+[ Upstream commit 37717b8c9f0e8c4dd73fc522769cc14649b4f657 ]
+
+[why]
+dcn301_calculate_wm_and_dl() causes flickering when external monitor is
+connected.
+
+This issue has been fixed before by commit 0e4c0ae59d7e
+("drm/amdgpu/display: drop dcn301_calculate_wm_and_dl for now"), however
+part of the fix was gone after commit 2cbcb78c9ee5 ("Merge tag 'amd-drm-next-5.13-2021-03-23' of https://gitlab.freedesktop.org/agd5f/linux into drm-next").
+
+[how]
+Use dcn30_calculate_wm_and_dlg() instead as in the original fix.
+
+Fixes: 2cbcb78c9ee5 ("Merge tag 'amd-drm-next-5.13-2021-03-23' of https://gitlab.freedesktop.org/agd5f/linux into drm-next")
+
+Signed-off-by: Nikola Cornij <nikola.cornij@amd.com>
+Reviewed-by: Zhan Liu <zhan.liu@amd.com>
+Tested-by: Zhan Liu <zhan.liu@amd.com>
+Tested-by: Oliver Logush <oliver.logush@amd.com>
+Signed-off-by: Zhan Liu <zhan.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/dcn301/dcn301_resource.c | 96 +------------------
+ 1 file changed, 1 insertion(+), 95 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c b/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c
+index 472696f949ac..63b09c1124c4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c
+@@ -1622,106 +1622,12 @@ static void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *b
+ dml_init_instance(&dc->dml, &dcn3_01_soc, &dcn3_01_ip, DML_PROJECT_DCN30);
+ }
+
+-static void calculate_wm_set_for_vlevel(
+- int vlevel,
+- struct wm_range_table_entry *table_entry,
+- struct dcn_watermarks *wm_set,
+- struct display_mode_lib *dml,
+- display_e2e_pipe_params_st *pipes,
+- int pipe_cnt)
+-{
+- double dram_clock_change_latency_cached = dml->soc.dram_clock_change_latency_us;
+-
+- ASSERT(vlevel < dml->soc.num_states);
+- /* only pipe 0 is read for voltage and dcf/soc clocks */
+- pipes[0].clks_cfg.voltage = vlevel;
+- pipes[0].clks_cfg.dcfclk_mhz = dml->soc.clock_limits[vlevel].dcfclk_mhz;
+- pipes[0].clks_cfg.socclk_mhz = dml->soc.clock_limits[vlevel].socclk_mhz;
+-
+- dml->soc.dram_clock_change_latency_us = table_entry->pstate_latency_us;
+- dml->soc.sr_exit_time_us = table_entry->sr_exit_time_us;
+- dml->soc.sr_enter_plus_exit_time_us = table_entry->sr_enter_plus_exit_time_us;
+-
+- wm_set->urgent_ns = get_wm_urgent(dml, pipes, pipe_cnt) * 1000;
+- wm_set->cstate_pstate.cstate_enter_plus_exit_ns = get_wm_stutter_enter_exit(dml, pipes, pipe_cnt) * 1000;
+- wm_set->cstate_pstate.cstate_exit_ns = get_wm_stutter_exit(dml, pipes, pipe_cnt) * 1000;
+- wm_set->cstate_pstate.pstate_change_ns = get_wm_dram_clock_change(dml, pipes, pipe_cnt) * 1000;
+- wm_set->pte_meta_urgent_ns = get_wm_memory_trip(dml, pipes, pipe_cnt) * 1000;
+- wm_set->frac_urg_bw_nom = get_fraction_of_urgent_bandwidth(dml, pipes, pipe_cnt) * 1000;
+- wm_set->frac_urg_bw_flip = get_fraction_of_urgent_bandwidth_imm_flip(dml, pipes, pipe_cnt) * 1000;
+- wm_set->urgent_latency_ns = get_urgent_latency(dml, pipes, pipe_cnt) * 1000;
+- dml->soc.dram_clock_change_latency_us = dram_clock_change_latency_cached;
+-
+-}
+-
+-static void dcn301_calculate_wm_and_dlg(
+- struct dc *dc, struct dc_state *context,
+- display_e2e_pipe_params_st *pipes,
+- int pipe_cnt,
+- int vlevel_req)
+-{
+- int i, pipe_idx;
+- int vlevel, vlevel_max;
+- struct wm_range_table_entry *table_entry;
+- struct clk_bw_params *bw_params = dc->clk_mgr->bw_params;
+-
+- ASSERT(bw_params);
+-
+- vlevel_max = bw_params->clk_table.num_entries - 1;
+-
+- /* WM Set D */
+- table_entry = &bw_params->wm_table.entries[WM_D];
+- if (table_entry->wm_type == WM_TYPE_RETRAINING)
+- vlevel = 0;
+- else
+- vlevel = vlevel_max;
+- calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.d,
+- &context->bw_ctx.dml, pipes, pipe_cnt);
+- /* WM Set C */
+- table_entry = &bw_params->wm_table.entries[WM_C];
+- vlevel = min(max(vlevel_req, 2), vlevel_max);
+- calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.c,
+- &context->bw_ctx.dml, pipes, pipe_cnt);
+- /* WM Set B */
+- table_entry = &bw_params->wm_table.entries[WM_B];
+- vlevel = min(max(vlevel_req, 1), vlevel_max);
+- calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.b,
+- &context->bw_ctx.dml, pipes, pipe_cnt);
+-
+- /* WM Set A */
+- table_entry = &bw_params->wm_table.entries[WM_A];
+- vlevel = min(vlevel_req, vlevel_max);
+- calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.a,
+- &context->bw_ctx.dml, pipes, pipe_cnt);
+-
+- for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) {
+- if (!context->res_ctx.pipe_ctx[i].stream)
+- continue;
+-
+- pipes[pipe_idx].clks_cfg.dispclk_mhz = get_dispclk_calculated(&context->bw_ctx.dml, pipes, pipe_cnt);
+- pipes[pipe_idx].clks_cfg.dppclk_mhz = get_dppclk_calculated(&context->bw_ctx.dml, pipes, pipe_cnt, pipe_idx);
+-
+- if (dc->config.forced_clocks) {
+- pipes[pipe_idx].clks_cfg.dispclk_mhz = context->bw_ctx.dml.soc.clock_limits[0].dispclk_mhz;
+- pipes[pipe_idx].clks_cfg.dppclk_mhz = context->bw_ctx.dml.soc.clock_limits[0].dppclk_mhz;
+- }
+- if (dc->debug.min_disp_clk_khz > pipes[pipe_idx].clks_cfg.dispclk_mhz * 1000)
+- pipes[pipe_idx].clks_cfg.dispclk_mhz = dc->debug.min_disp_clk_khz / 1000.0;
+- if (dc->debug.min_dpp_clk_khz > pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000)
+- pipes[pipe_idx].clks_cfg.dppclk_mhz = dc->debug.min_dpp_clk_khz / 1000.0;
+-
+- pipe_idx++;
+- }
+-
+- dcn20_calculate_dlg_params(dc, context, pipes, pipe_cnt, vlevel);
+-}
+-
+ static struct resource_funcs dcn301_res_pool_funcs = {
+ .destroy = dcn301_destroy_resource_pool,
+ .link_enc_create = dcn301_link_encoder_create,
+ .panel_cntl_create = dcn301_panel_cntl_create,
+ .validate_bandwidth = dcn30_validate_bandwidth,
+- .calculate_wm_and_dlg = dcn301_calculate_wm_and_dlg,
++ .calculate_wm_and_dlg = dcn30_calculate_wm_and_dlg,
+ .update_soc_for_wm_a = dcn30_update_soc_for_wm_a,
+ .populate_dml_pipes = dcn30_populate_dml_pipes_from_context,
+ .acquire_idle_pipe_for_layer = dcn20_acquire_idle_pipe_for_layer,
+--
+2.30.2
+
--- /dev/null
+From da5b61ed5f9bfe3d16e61b56d00c7b660f0caf9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 13:31:48 -0700
+Subject: drm/i915: Skip display interruption setup when display is not
+ available
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Roberto de Souza <jose.souza@intel.com>
+
+[ Upstream commit a844cfbe648d15d9f1031c45508c194f2d61c917 ]
+
+Return ealier in the functions doing interruption setup for GEN8+ also
+adding a warning in gen8_de_irq_handler() to let us know that
+something else is still missing.
+
+Reviewed-by: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210408203150.237947-1-jose.souza@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_irq.c | 39 +++++++++++++++++++++++++++------
+ 1 file changed, 32 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index 7eefbdec25a2..e0d0b300c4aa 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -2421,6 +2421,8 @@ gen8_de_irq_handler(struct drm_i915_private *dev_priv, u32 master_ctl)
+ u32 iir;
+ enum pipe pipe;
+
++ drm_WARN_ON_ONCE(&dev_priv->drm, !HAS_DISPLAY(dev_priv));
++
+ if (master_ctl & GEN8_DE_MISC_IRQ) {
+ iir = intel_uncore_read(&dev_priv->uncore, GEN8_DE_MISC_IIR);
+ if (iir) {
+@@ -3058,14 +3060,13 @@ static void cnp_display_clock_wa(struct drm_i915_private *dev_priv)
+ }
+ }
+
+-static void gen8_irq_reset(struct drm_i915_private *dev_priv)
++static void gen8_display_irq_reset(struct drm_i915_private *dev_priv)
+ {
+ struct intel_uncore *uncore = &dev_priv->uncore;
+ enum pipe pipe;
+
+- gen8_master_intr_disable(dev_priv->uncore.regs);
+-
+- gen8_gt_irq_reset(&dev_priv->gt);
++ if (!HAS_DISPLAY(dev_priv))
++ return;
+
+ intel_uncore_write(uncore, EDP_PSR_IMR, 0xffffffff);
+ intel_uncore_write(uncore, EDP_PSR_IIR, 0xffffffff);
+@@ -3077,6 +3078,16 @@ static void gen8_irq_reset(struct drm_i915_private *dev_priv)
+
+ GEN3_IRQ_RESET(uncore, GEN8_DE_PORT_);
+ GEN3_IRQ_RESET(uncore, GEN8_DE_MISC_);
++}
++
++static void gen8_irq_reset(struct drm_i915_private *dev_priv)
++{
++ struct intel_uncore *uncore = &dev_priv->uncore;
++
++ gen8_master_intr_disable(dev_priv->uncore.regs);
++
++ gen8_gt_irq_reset(&dev_priv->gt);
++ gen8_display_irq_reset(dev_priv);
+ GEN3_IRQ_RESET(uncore, GEN8_PCU_);
+
+ if (HAS_PCH_SPLIT(dev_priv))
+@@ -3092,6 +3103,9 @@ static void gen11_display_irq_reset(struct drm_i915_private *dev_priv)
+ u32 trans_mask = BIT(TRANSCODER_A) | BIT(TRANSCODER_B) |
+ BIT(TRANSCODER_C) | BIT(TRANSCODER_D);
+
++ if (!HAS_DISPLAY(dev_priv))
++ return;
++
+ intel_uncore_write(uncore, GEN11_DISPLAY_INT_CTL, 0);
+
+ if (DISPLAY_VER(dev_priv) >= 12) {
+@@ -3714,6 +3728,9 @@ static void gen8_de_irq_postinstall(struct drm_i915_private *dev_priv)
+ BIT(TRANSCODER_C) | BIT(TRANSCODER_D);
+ enum pipe pipe;
+
++ if (!HAS_DISPLAY(dev_priv))
++ return;
++
+ if (DISPLAY_VER(dev_priv) <= 10)
+ de_misc_masked |= GEN8_DE_MISC_GSE;
+
+@@ -3797,6 +3814,16 @@ static void gen8_irq_postinstall(struct drm_i915_private *dev_priv)
+ gen8_master_intr_enable(dev_priv->uncore.regs);
+ }
+
++static void gen11_de_irq_postinstall(struct drm_i915_private *dev_priv)
++{
++ if (!HAS_DISPLAY(dev_priv))
++ return;
++
++ gen8_de_irq_postinstall(dev_priv);
++
++ intel_uncore_write(&dev_priv->uncore, GEN11_DISPLAY_INT_CTL,
++ GEN11_DISPLAY_IRQ_ENABLE);
++}
+
+ static void gen11_irq_postinstall(struct drm_i915_private *dev_priv)
+ {
+@@ -3807,12 +3834,10 @@ static void gen11_irq_postinstall(struct drm_i915_private *dev_priv)
+ icp_irq_postinstall(dev_priv);
+
+ gen11_gt_irq_postinstall(&dev_priv->gt);
+- gen8_de_irq_postinstall(dev_priv);
++ gen11_de_irq_postinstall(dev_priv);
+
+ GEN3_IRQ_INIT(uncore, GEN11_GU_MISC_, ~gu_misc_masked, gu_misc_masked);
+
+- intel_uncore_write(&dev_priv->uncore, GEN11_DISPLAY_INT_CTL, GEN11_DISPLAY_IRQ_ENABLE);
+-
+ if (HAS_MASTER_UNIT_IRQ(dev_priv)) {
+ dg1_master_intr_enable(uncore->regs);
+ intel_uncore_posting_read(&dev_priv->uncore, DG1_MSTR_UNIT_INTR);
+--
+2.30.2
+
--- /dev/null
+From 57531da98216b3d9f09f9819030c963d5fcb74a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 17:01:12 +0530
+Subject: drm/i915: Tweaked Wa_14010685332 for all PCHs
+
+From: Anshuman Gupta <anshuman.gupta@intel.com>
+
+[ Upstream commit b8441b288d6031eac21390891ba36487b2cb398b ]
+
+dispcnlunit1_cp_xosc_clkreq clock observed to be active on TGL-H platform
+despite Wa_14010685332 original sequence,
+thus blocks entry to deeper s0ix state.
+
+The Tweaked Wa_14010685332 sequence fixes this issue, therefore use tweaked
+Wa_14010685332 sequence for every PCH since PCH_CNP.
+
+v2:
+- removed RKL from comment and simplified condition. [Rodrigo]
+
+Fixes: b896898c7369 ("drm/i915: Tweaked Wa_14010685332 for PCHs used on gen11 platforms")
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Imre Deak <imre.deak@intel.com>
+Signed-off-by: Anshuman Gupta <anshuman.gupta@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210810113112.31739-2-anshuman.gupta@intel.com
+(cherry picked from commit 8b46cc6577f4bbef7e5909bb926da31d705f350f)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/i915/display/intel_display_power.c | 16 +++++++-------
+ drivers/gpu/drm/i915/i915_irq.c | 21 -------------------
+ 2 files changed, 8 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_display_power.c b/drivers/gpu/drm/i915/display/intel_display_power.c
+index 99126caf5747..a8597444d515 100644
+--- a/drivers/gpu/drm/i915/display/intel_display_power.c
++++ b/drivers/gpu/drm/i915/display/intel_display_power.c
+@@ -5910,13 +5910,13 @@ void intel_display_power_suspend_late(struct drm_i915_private *i915)
+ {
+ if (DISPLAY_VER(i915) >= 11 || IS_GEN9_LP(i915)) {
+ bxt_enable_dc9(i915);
+- /* Tweaked Wa_14010685332:icp,jsp,mcc */
+- if (INTEL_PCH_TYPE(i915) >= PCH_ICP && INTEL_PCH_TYPE(i915) <= PCH_MCC)
+- intel_de_rmw(i915, SOUTH_CHICKEN1,
+- SBCLK_RUN_REFCLK_DIS, SBCLK_RUN_REFCLK_DIS);
+ } else if (IS_HASWELL(i915) || IS_BROADWELL(i915)) {
+ hsw_enable_pc8(i915);
+ }
++
++ /* Tweaked Wa_14010685332:cnp,icp,jsp,mcc,tgp,adp */
++ if (INTEL_PCH_TYPE(i915) >= PCH_CNP && INTEL_PCH_TYPE(i915) < PCH_DG1)
++ intel_de_rmw(i915, SOUTH_CHICKEN1, SBCLK_RUN_REFCLK_DIS, SBCLK_RUN_REFCLK_DIS);
+ }
+
+ void intel_display_power_resume_early(struct drm_i915_private *i915)
+@@ -5924,13 +5924,13 @@ void intel_display_power_resume_early(struct drm_i915_private *i915)
+ if (DISPLAY_VER(i915) >= 11 || IS_GEN9_LP(i915)) {
+ gen9_sanitize_dc_state(i915);
+ bxt_disable_dc9(i915);
+- /* Tweaked Wa_14010685332:icp,jsp,mcc */
+- if (INTEL_PCH_TYPE(i915) >= PCH_ICP && INTEL_PCH_TYPE(i915) <= PCH_MCC)
+- intel_de_rmw(i915, SOUTH_CHICKEN1, SBCLK_RUN_REFCLK_DIS, 0);
+-
+ } else if (IS_HASWELL(i915) || IS_BROADWELL(i915)) {
+ hsw_disable_pc8(i915);
+ }
++
++ /* Tweaked Wa_14010685332:cnp,icp,jsp,mcc,tgp,adp */
++ if (INTEL_PCH_TYPE(i915) >= PCH_CNP && INTEL_PCH_TYPE(i915) < PCH_DG1)
++ intel_de_rmw(i915, SOUTH_CHICKEN1, SBCLK_RUN_REFCLK_DIS, 0);
+ }
+
+ void intel_display_power_suspend(struct drm_i915_private *i915)
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index e0d0b300c4aa..783f25920d00 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -3042,24 +3042,6 @@ static void valleyview_irq_reset(struct drm_i915_private *dev_priv)
+ spin_unlock_irq(&dev_priv->irq_lock);
+ }
+
+-static void cnp_display_clock_wa(struct drm_i915_private *dev_priv)
+-{
+- struct intel_uncore *uncore = &dev_priv->uncore;
+-
+- /*
+- * Wa_14010685332:cnp/cmp,tgp,adp
+- * TODO: Clarify which platforms this applies to
+- * TODO: Figure out if this workaround can be applied in the s0ix suspend/resume handlers as
+- * on earlier platforms and whether the workaround is also needed for runtime suspend/resume
+- */
+- if (INTEL_PCH_TYPE(dev_priv) == PCH_CNP ||
+- (INTEL_PCH_TYPE(dev_priv) >= PCH_TGP && INTEL_PCH_TYPE(dev_priv) < PCH_DG1)) {
+- intel_uncore_rmw(uncore, SOUTH_CHICKEN1, SBCLK_RUN_REFCLK_DIS,
+- SBCLK_RUN_REFCLK_DIS);
+- intel_uncore_rmw(uncore, SOUTH_CHICKEN1, SBCLK_RUN_REFCLK_DIS, 0);
+- }
+-}
+-
+ static void gen8_display_irq_reset(struct drm_i915_private *dev_priv)
+ {
+ struct intel_uncore *uncore = &dev_priv->uncore;
+@@ -3093,7 +3075,6 @@ static void gen8_irq_reset(struct drm_i915_private *dev_priv)
+ if (HAS_PCH_SPLIT(dev_priv))
+ ibx_irq_reset(dev_priv);
+
+- cnp_display_clock_wa(dev_priv);
+ }
+
+ static void gen11_display_irq_reset(struct drm_i915_private *dev_priv)
+@@ -3137,8 +3118,6 @@ static void gen11_display_irq_reset(struct drm_i915_private *dev_priv)
+
+ if (INTEL_PCH_TYPE(dev_priv) >= PCH_ICP)
+ GEN3_IRQ_RESET(uncore, SDE);
+-
+- cnp_display_clock_wa(dev_priv);
+ }
+
+ static void gen11_irq_reset(struct drm_i915_private *dev_priv)
+--
+2.30.2
+
--- /dev/null
+From 692565da692c4d1a906d2ef50ccf58ebc001090e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 10:55:03 +0800
+Subject: drm/mediatek: Add AAL output size configuration
+
+From: jason-jh.lin <jason-jh.lin@mediatek.com>
+
+[ Upstream commit 71ac6f390f6a3017f58d05d677b961bb1f851338 ]
+
+To avoid the output width and height is incorrect,
+AAL_OUTPUT_SIZE configuration should be set.
+
+Fixes: 0664d1392c26 ("drm/mediatek: Add AAL engine basic function")
+Signed-off-by: jason-jh.lin <jason-jh.lin@mediatek.com>
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+index 75bc00e17fc4..50d20562e612 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+@@ -34,6 +34,7 @@
+
+ #define DISP_AAL_EN 0x0000
+ #define DISP_AAL_SIZE 0x0030
++#define DISP_AAL_OUTPUT_SIZE 0x04d8
+
+ #define DISP_DITHER_EN 0x0000
+ #define DITHER_EN BIT(0)
+@@ -197,6 +198,7 @@ static void mtk_aal_config(struct device *dev, unsigned int w,
+ struct mtk_ddp_comp_dev *priv = dev_get_drvdata(dev);
+
+ mtk_ddp_write(cmdq_pkt, w << 16 | h, &priv->cmdq_reg, priv->regs, DISP_AAL_SIZE);
++ mtk_ddp_write(cmdq_pkt, w << 16 | h, &priv->cmdq_reg, priv->regs, DISP_AAL_OUTPUT_SIZE);
+ }
+
+ static void mtk_aal_gamma_set(struct device *dev, struct drm_crtc_state *state)
+--
+2.30.2
+
--- /dev/null
+From 3c3fa4fa41960183b1338ca34eb27ee4848e840d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 12:01:48 +0800
+Subject: drm/mediatek: Add component_del in OVL and COLOR remove function
+
+From: jason-jh.lin <jason-jh.lin@mediatek.com>
+
+[ Upstream commit da4d4517ba70216799e3eb3b9bd71aa9dca065da ]
+
+Add component_del in OVL and COLOR remove function.
+
+Fixes: ff1395609e20 ("drm/mediatek: Move mtk_ddp_comp_init() from sub driver to DRM driver")
+Signed-off-by: jason-jh.lin <jason-jh.lin@mediatek.com>
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_disp_color.c | 2 ++
+ drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_disp_color.c b/drivers/gpu/drm/mediatek/mtk_disp_color.c
+index 63f411ab393b..bcb470caf009 100644
+--- a/drivers/gpu/drm/mediatek/mtk_disp_color.c
++++ b/drivers/gpu/drm/mediatek/mtk_disp_color.c
+@@ -134,6 +134,8 @@ static int mtk_disp_color_probe(struct platform_device *pdev)
+
+ static int mtk_disp_color_remove(struct platform_device *pdev)
+ {
++ component_del(&pdev->dev, &mtk_disp_color_component_ops);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+index 961f87f8d4d1..32a2922bbe5f 100644
+--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
++++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+@@ -424,6 +424,8 @@ static int mtk_disp_ovl_probe(struct platform_device *pdev)
+
+ static int mtk_disp_ovl_remove(struct platform_device *pdev)
+ {
++ component_del(&pdev->dev, &mtk_disp_ovl_component_ops);
++
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From f540f96d8e484113b229dc5e8a79837d5243abfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 10:42:16 -0700
+Subject: i40e: Fix ATR queue selection
+
+From: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+
+[ Upstream commit a222be597e316389f9f8c26033352c124ce93056 ]
+
+Without this patch, ATR does not work. Receive/transmit uses queue
+selection based on SW DCB hashing method.
+
+If traffic classes are not configured for PF, then use
+netdev_pick_tx function for selecting queue for packet transmission.
+Instead of calling i40e_swdcb_skb_tx_hash, call netdev_pick_tx,
+which ensures that packet is transmitted/received from CPU that is
+running the application.
+
+Reproduction steps:
+1. Load i40e driver
+2. Map each MSI interrupt of i40e port for each CPU
+3. Disable ntuple, enable ATR i.e.:
+ethtool -K $interface ntuple off
+ethtool --set-priv-flags $interface flow-director-atr
+4. Run application that is generating traffic and is bound to a
+single CPU, i.e.:
+taskset -c 9 netperf -H 1.1.1.1 -t TCP_RR -l 10
+5. Observe behavior:
+Application's traffic should be restricted to the CPU provided in
+taskset.
+
+Fixes: 89ec1f0886c1 ("i40e: Fix queue-to-TC mapping on Tx")
+Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+Tested-by: Dave Switzer <david.switzer@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_txrx.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+index 107fb472319e..b18ff0ed8527 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -3665,8 +3665,7 @@ u16 i40e_lan_select_queue(struct net_device *netdev,
+
+ /* is DCB enabled at all? */
+ if (vsi->tc_config.numtc == 1)
+- return i40e_swdcb_skb_tx_hash(netdev, skb,
+- netdev->real_num_tx_queues);
++ return netdev_pick_tx(netdev, skb, sb_dev);
+
+ prio = skb->priority;
+ hw = &vsi->back->hw;
+--
+2.30.2
+
--- /dev/null
+From ce0e26d240dbb6c129523534d7105193e16bfb29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 10:42:17 -0700
+Subject: iavf: Fix ping is lost after untrusted VF had tried to change MAC
+
+From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+
+[ Upstream commit 8da80c9d50220a8e4190a4eaa0dd6aeefcbbb5bf ]
+
+Make changes to MAC address dependent on the response of PF.
+Disallow changes to HW MAC address and MAC filter from untrusted
+VF, thanks to that ping is not lost if VF tries to change MAC.
+Add a new field in iavf_mac_filter, to indicate whether there
+was response from PF for given filter. Based on this field pass
+or discard the filter.
+If untrusted VF tried to change it's address, it's not changed.
+Still filter was changed, because of that ping couldn't go through.
+
+Fixes: c5c922b3e09b ("iavf: fix MAC address setting for VFs when filter is rejected")
+Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Tested-by: Gurucharan G <Gurucharanx.g@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf.h | 1 +
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 1 +
+ .../net/ethernet/intel/iavf/iavf_virtchnl.c | 47 ++++++++++++++++++-
+ 3 files changed, 47 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h
+index e8bd04100ecd..90793b36126e 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf.h
++++ b/drivers/net/ethernet/intel/iavf/iavf.h
+@@ -136,6 +136,7 @@ struct iavf_q_vector {
+ struct iavf_mac_filter {
+ struct list_head list;
+ u8 macaddr[ETH_ALEN];
++ bool is_new_mac; /* filter is new, wait for PF decision */
+ bool remove; /* filter needs to be removed */
+ bool add; /* filter needs to be added */
+ };
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index 244ec74ceca7..606a01ce4073 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -751,6 +751,7 @@ struct iavf_mac_filter *iavf_add_filter(struct iavf_adapter *adapter,
+
+ list_add_tail(&f->list, &adapter->mac_filter_list);
+ f->add = true;
++ f->is_new_mac = true;
+ adapter->aq_required |= IAVF_FLAG_AQ_ADD_MAC_FILTER;
+ } else {
+ f->remove = false;
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
+index 0eab3c43bdc5..3c735968e1b8 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
+@@ -540,6 +540,47 @@ void iavf_del_ether_addrs(struct iavf_adapter *adapter)
+ kfree(veal);
+ }
+
++/**
++ * iavf_mac_add_ok
++ * @adapter: adapter structure
++ *
++ * Submit list of filters based on PF response.
++ **/
++static void iavf_mac_add_ok(struct iavf_adapter *adapter)
++{
++ struct iavf_mac_filter *f, *ftmp;
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) {
++ f->is_new_mac = false;
++ }
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++}
++
++/**
++ * iavf_mac_add_reject
++ * @adapter: adapter structure
++ *
++ * Remove filters from list based on PF response.
++ **/
++static void iavf_mac_add_reject(struct iavf_adapter *adapter)
++{
++ struct net_device *netdev = adapter->netdev;
++ struct iavf_mac_filter *f, *ftmp;
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) {
++ if (f->remove && ether_addr_equal(f->macaddr, netdev->dev_addr))
++ f->remove = false;
++
++ if (f->is_new_mac) {
++ list_del(&f->list);
++ kfree(f);
++ }
++ }
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++}
++
+ /**
+ * iavf_add_vlans
+ * @adapter: adapter structure
+@@ -1492,6 +1533,7 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter,
+ case VIRTCHNL_OP_ADD_ETH_ADDR:
+ dev_err(&adapter->pdev->dev, "Failed to add MAC filter, error %s\n",
+ iavf_stat_str(&adapter->hw, v_retval));
++ iavf_mac_add_reject(adapter);
+ /* restore administratively set MAC address */
+ ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr);
+ break;
+@@ -1639,10 +1681,11 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter,
+ }
+ }
+ switch (v_opcode) {
+- case VIRTCHNL_OP_ADD_ETH_ADDR: {
++ case VIRTCHNL_OP_ADD_ETH_ADDR:
++ if (!v_retval)
++ iavf_mac_add_ok(adapter);
+ if (!ether_addr_equal(netdev->dev_addr, adapter->hw.mac.addr))
+ ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr);
+- }
+ break;
+ case VIRTCHNL_OP_GET_STATS: {
+ struct iavf_eth_stats *stats =
+--
+2.30.2
+
--- /dev/null
+From d81e8aca67f40e662dcc2cd351e7d2e700a7a31b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jul 2021 09:47:37 +0200
+Subject: iommu: Check if group is NULL before remove device
+
+From: Frank Wunderlich <frank-w@public-files.de>
+
+[ Upstream commit 5aa95d8834e07907e64937d792c12ffef7fb271f ]
+
+If probe_device is failing, iommu_group is not initialized because
+iommu_group_add_device is not reached, so freeing it will result
+in NULL pointer access.
+
+iommu_bus_init
+ ->bus_iommu_probe
+ ->probe_iommu_group in for each:/* return -22 in fail case */
+ ->iommu_probe_device
+ ->__iommu_probe_device /* return -22 here.*/
+ -> ops->probe_device /* return -22 here.*/
+ -> iommu_group_get_for_dev
+ -> ops->device_group
+ -> iommu_group_add_device //good case
+ ->remove_iommu_group //in fail case, it will remove group
+ ->iommu_release_device
+ ->iommu_group_remove_device // here we don't have group
+
+In my case ops->probe_device (mtk_iommu_probe_device from
+mtk_iommu_v1.c) is due to failing fwspec->ops mismatch.
+
+Fixes: d72e31c93746 ("iommu: IOMMU Groups")
+Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
+Link: https://lore.kernel.org/r/20210731074737.4573-1-linux@fw-web.de
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 808ab70d5df5..db966a7841fe 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -924,6 +924,9 @@ void iommu_group_remove_device(struct device *dev)
+ struct iommu_group *group = dev->iommu_group;
+ struct group_device *tmp_device, *device = NULL;
+
++ if (!group)
++ return;
++
+ dev_info(dev, "Removing from iommu group %d\n", group->id);
+
+ /* Pre-notify listeners that a device is being removed. */
+--
+2.30.2
+
--- /dev/null
+From 16bc0fb398c19f3441c2dd95dd799297cab7ac13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 20:43:21 +0800
+Subject: iommu/vt-d: Fix incomplete cache flush in
+ intel_pasid_tear_down_entry()
+
+From: Liu Yi L <yi.l.liu@intel.com>
+
+[ Upstream commit 8798d36411196da86e70b994725349c16c1119f6 ]
+
+This fixes improper iotlb invalidation in intel_pasid_tear_down_entry().
+When a PASID was used as nested mode, released and reused, the following
+error message will appear:
+
+[ 180.187556] Unexpected page request in Privilege Mode
+[ 180.187565] Unexpected page request in Privilege Mode
+[ 180.279933] Unexpected page request in Privilege Mode
+[ 180.279937] Unexpected page request in Privilege Mode
+
+Per chapter 6.5.3.3 of VT-d spec 3.3, when tear down a pasid entry, the
+software should use Domain selective IOTLB flush if the PGTT of the pasid
+entry is SL only or Nested, while for the pasid entries whose PGTT is FL
+only or PT using PASID-based IOTLB flush is enough.
+
+Fixes: 2cd1311a26673 ("iommu/vt-d: Add set domain DOMAIN_ATTR_NESTING attr")
+Signed-off-by: Kumar Sanjay K <sanjay.k.kumar@intel.com>
+Signed-off-by: Liu Yi L <yi.l.liu@intel.com>
+Tested-by: Yi Sun <yi.y.sun@intel.com>
+Link: https://lore.kernel.org/r/20210817042425.1784279-1-yi.l.liu@intel.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20210817124321.1517985-3-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/pasid.c | 10 ++++++++--
+ drivers/iommu/intel/pasid.h | 6 ++++++
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
+index 72dc84821dad..581c694b7cf4 100644
+--- a/drivers/iommu/intel/pasid.c
++++ b/drivers/iommu/intel/pasid.c
+@@ -511,7 +511,7 @@ void intel_pasid_tear_down_entry(struct intel_iommu *iommu, struct device *dev,
+ u32 pasid, bool fault_ignore)
+ {
+ struct pasid_entry *pte;
+- u16 did;
++ u16 did, pgtt;
+
+ pte = intel_pasid_get_entry(dev, pasid);
+ if (WARN_ON(!pte))
+@@ -521,13 +521,19 @@ void intel_pasid_tear_down_entry(struct intel_iommu *iommu, struct device *dev,
+ return;
+
+ did = pasid_get_domain_id(pte);
++ pgtt = pasid_pte_get_pgtt(pte);
++
+ intel_pasid_clear_entry(dev, pasid, fault_ignore);
+
+ if (!ecap_coherent(iommu->ecap))
+ clflush_cache_range(pte, sizeof(*pte));
+
+ pasid_cache_invalidation_with_pasid(iommu, did, pasid);
+- qi_flush_piotlb(iommu, did, pasid, 0, -1, 0);
++
++ if (pgtt == PASID_ENTRY_PGTT_PT || pgtt == PASID_ENTRY_PGTT_FL_ONLY)
++ qi_flush_piotlb(iommu, did, pasid, 0, -1, 0);
++ else
++ iommu->flush.flush_iotlb(iommu, did, 0, 0, DMA_TLB_DSI_FLUSH);
+
+ /* Device IOTLB doesn't need to be flushed in caching mode. */
+ if (!cap_caching_mode(iommu->cap))
+diff --git a/drivers/iommu/intel/pasid.h b/drivers/iommu/intel/pasid.h
+index 5ff61c3d401f..c11bc8b833b8 100644
+--- a/drivers/iommu/intel/pasid.h
++++ b/drivers/iommu/intel/pasid.h
+@@ -99,6 +99,12 @@ static inline bool pasid_pte_is_present(struct pasid_entry *pte)
+ return READ_ONCE(pte->val[0]) & PASID_PTE_PRESENT;
+ }
+
++/* Get PGTT field of a PASID table entry */
++static inline u16 pasid_pte_get_pgtt(struct pasid_entry *pte)
++{
++ return (u16)((READ_ONCE(pte->val[0]) >> 6) & 0x7);
++}
++
+ extern unsigned int intel_pasid_max_id;
+ int intel_pasid_alloc_table(struct device *dev);
+ void intel_pasid_free_table(struct device *dev);
+--
+2.30.2
+
--- /dev/null
+From 1c04848ba4030b0479ffa1528dc635d5f6a6be63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 13:37:36 -0700
+Subject: ixgbe, xsk: clean up the resources in ixgbe_xsk_pool_enable error
+ path
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 1b80fec7b043552e01609bae7d0aad07aa742adc ]
+
+In ixgbe_xsk_pool_enable(), if ixgbe_xsk_wakeup() fails,
+We should restore the previous state and clean up the
+resources. Add the missing clear af_xdp_zc_qps and unmap dma
+to fix this bug.
+
+Fixes: d49e286d354e ("ixgbe: add tracking of AF_XDP zero-copy state for each queue pair")
+Fixes: 4a9b32f30f80 ("ixgbe: fix potential RX buffer starvation for AF_XDP")
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Tested-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://lore.kernel.org/r/20210817203736.3529939-1-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
+index f72d2978263b..d60da7a89092 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
+@@ -52,8 +52,11 @@ static int ixgbe_xsk_pool_enable(struct ixgbe_adapter *adapter,
+
+ /* Kick start the NAPI context so that receiving will start */
+ err = ixgbe_xsk_wakeup(adapter->netdev, qid, XDP_WAKEUP_RX);
+- if (err)
++ if (err) {
++ clear_bit(qid, adapter->af_xdp_zc_qps);
++ xsk_pool_dma_unmap(pool, IXGBE_RX_DMA_ATTR);
+ return err;
++ }
+ }
+
+ return 0;
+--
+2.30.2
+
--- /dev/null
+From 7b77e7cb5eead926402345fb294a8331ddd7659a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 12:12:22 +0200
+Subject: mac80211: fix locking in ieee80211_restart_work()
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 276e189f8e4e3cce1634d6bac4ed0d9ca242441b ]
+
+Ilan's change to move locking around accidentally lost the
+wiphy_lock() during some porting, add it back.
+
+Fixes: 45daaa131841 ("mac80211: Properly WARN on HW scan before restart")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://lore.kernel.org/r/20210817121210.47bdb177064f.Ib1ef79440cd27f318c028ddfc0c642406917f512@changeid
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 2481bfdfafd0..efe5c3295455 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -260,6 +260,8 @@ static void ieee80211_restart_work(struct work_struct *work)
+ flush_work(&local->radar_detected_work);
+
+ rtnl_lock();
++ /* we might do interface manipulations, so need both */
++ wiphy_lock(local->hw.wiphy);
+
+ WARN(test_bit(SCAN_HW_SCANNING, &local->scanning),
+ "%s called with hardware scan in progress\n", __func__);
+--
+2.30.2
+
--- /dev/null
+From d7909f425be4cb0f1873ddb33be3bb4201c6c65b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 16:42:36 -0700
+Subject: mptcp: fix memory leak on address flush
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit a0eea5f10eeb5180d115452b0d77afa6603dfe18 ]
+
+The endpoint cleanup path is prone to a memory leak, as reported
+by syzkaller:
+
+ BUG: memory leak
+ unreferenced object 0xffff88810680ea00 (size 64):
+ comm "syz-executor.6", pid 6191, jiffies 4295756280 (age 24.138s)
+ hex dump (first 32 bytes):
+ 58 75 7d 3c 80 88 ff ff 22 01 00 00 00 00 ad de Xu}<....".......
+ 01 00 02 00 00 00 00 00 ac 1e 00 07 00 00 00 00 ................
+ backtrace:
+ [<0000000072a9f72a>] kmalloc include/linux/slab.h:591 [inline]
+ [<0000000072a9f72a>] mptcp_nl_cmd_add_addr+0x287/0x9f0 net/mptcp/pm_netlink.c:1170
+ [<00000000f6e931bf>] genl_family_rcv_msg_doit.isra.0+0x225/0x340 net/netlink/genetlink.c:731
+ [<00000000f1504a2c>] genl_family_rcv_msg net/netlink/genetlink.c:775 [inline]
+ [<00000000f1504a2c>] genl_rcv_msg+0x341/0x5b0 net/netlink/genetlink.c:792
+ [<0000000097e76f6a>] netlink_rcv_skb+0x148/0x430 net/netlink/af_netlink.c:2504
+ [<00000000ceefa2b8>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:803
+ [<000000008ff91aec>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
+ [<000000008ff91aec>] netlink_unicast+0x537/0x750 net/netlink/af_netlink.c:1340
+ [<0000000041682c35>] netlink_sendmsg+0x846/0xd80 net/netlink/af_netlink.c:1929
+ [<00000000df3aa8e7>] sock_sendmsg_nosec net/socket.c:704 [inline]
+ [<00000000df3aa8e7>] sock_sendmsg+0x14e/0x190 net/socket.c:724
+ [<000000002154c54c>] ____sys_sendmsg+0x709/0x870 net/socket.c:2403
+ [<000000001aab01d7>] ___sys_sendmsg+0xff/0x170 net/socket.c:2457
+ [<00000000fa3b1446>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486
+ [<00000000db2ee9c7>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ [<00000000db2ee9c7>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
+ [<000000005873517d>] entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+We should not require an allocation to cleanup stuff.
+
+Rework the code a bit so that the additional RCU work is no more needed.
+
+Fixes: 1729cf186d8a ("mptcp: create the listening socket for new port")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/pm_netlink.c | 44 ++++++++++++------------------------------
+ 1 file changed, 12 insertions(+), 32 deletions(-)
+
+diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
+index fce1d057d19e..45b414efc001 100644
+--- a/net/mptcp/pm_netlink.c
++++ b/net/mptcp/pm_netlink.c
+@@ -1135,36 +1135,12 @@ next:
+ return 0;
+ }
+
+-struct addr_entry_release_work {
+- struct rcu_work rwork;
+- struct mptcp_pm_addr_entry *entry;
+-};
+-
+-static void mptcp_pm_release_addr_entry(struct work_struct *work)
++/* caller must ensure the RCU grace period is already elapsed */
++static void __mptcp_pm_release_addr_entry(struct mptcp_pm_addr_entry *entry)
+ {
+- struct addr_entry_release_work *w;
+- struct mptcp_pm_addr_entry *entry;
+-
+- w = container_of(to_rcu_work(work), struct addr_entry_release_work, rwork);
+- entry = w->entry;
+- if (entry) {
+- if (entry->lsk)
+- sock_release(entry->lsk);
+- kfree(entry);
+- }
+- kfree(w);
+-}
+-
+-static void mptcp_pm_free_addr_entry(struct mptcp_pm_addr_entry *entry)
+-{
+- struct addr_entry_release_work *w;
+-
+- w = kmalloc(sizeof(*w), GFP_ATOMIC);
+- if (w) {
+- INIT_RCU_WORK(&w->rwork, mptcp_pm_release_addr_entry);
+- w->entry = entry;
+- queue_rcu_work(system_wq, &w->rwork);
+- }
++ if (entry->lsk)
++ sock_release(entry->lsk);
++ kfree(entry);
+ }
+
+ static int mptcp_nl_remove_id_zero_address(struct net *net,
+@@ -1244,7 +1220,8 @@ static int mptcp_nl_cmd_del_addr(struct sk_buff *skb, struct genl_info *info)
+ spin_unlock_bh(&pernet->lock);
+
+ mptcp_nl_remove_subflow_and_signal_addr(sock_net(skb->sk), &entry->addr);
+- mptcp_pm_free_addr_entry(entry);
++ synchronize_rcu();
++ __mptcp_pm_release_addr_entry(entry);
+
+ return ret;
+ }
+@@ -1297,6 +1274,7 @@ static void mptcp_nl_remove_addrs_list(struct net *net,
+ }
+ }
+
++/* caller must ensure the RCU grace period is already elapsed */
+ static void __flush_addrs(struct list_head *list)
+ {
+ while (!list_empty(list)) {
+@@ -1305,7 +1283,7 @@ static void __flush_addrs(struct list_head *list)
+ cur = list_entry(list->next,
+ struct mptcp_pm_addr_entry, list);
+ list_del_rcu(&cur->list);
+- mptcp_pm_free_addr_entry(cur);
++ __mptcp_pm_release_addr_entry(cur);
+ }
+ }
+
+@@ -1329,6 +1307,7 @@ static int mptcp_nl_cmd_flush_addrs(struct sk_buff *skb, struct genl_info *info)
+ bitmap_zero(pernet->id_bitmap, MAX_ADDR_ID + 1);
+ spin_unlock_bh(&pernet->lock);
+ mptcp_nl_remove_addrs_list(sock_net(skb->sk), &free_list);
++ synchronize_rcu();
+ __flush_addrs(&free_list);
+ return 0;
+ }
+@@ -1936,7 +1915,8 @@ static void __net_exit pm_nl_exit_net(struct list_head *net_list)
+ struct pm_nl_pernet *pernet = net_generic(net, pm_nl_pernet_id);
+
+ /* net is removed from namespace list, can't race with
+- * other modifiers
++ * other modifiers, also netns core already waited for a
++ * RCU grace period.
+ */
+ __flush_addrs(&pernet->local_addr_list);
+ }
+--
+2.30.2
+
--- /dev/null
+From c4f5123a2aa852a235984fd7c739b55ab7919eb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 16:42:37 -0700
+Subject: mptcp: full fully established support after ADD_ADDR
+
+From: Matthieu Baerts <matthieu.baerts@tessares.net>
+
+[ Upstream commit 67b12f792d5eaeb8b4fca3b2053e6b819eb3bf0f ]
+
+If directly after an MP_CAPABLE 3WHS, the client receives an ADD_ADDR
+with HMAC from the server, it is enough to switch to a "fully
+established" mode because it has received more MPTCP options.
+
+It was then OK to enable the "fully_established" flag on the MPTCP
+socket. Still, best to check if the ADD_ADDR looks valid by looking if
+it contains an HMAC (no 'echo' bit). If an ADD_ADDR echo is received
+while we are not in "fully established" mode, it is strange and then
+we should not switch to this mode now.
+
+But that is not enough. On one hand, the path-manager has be notified
+the state has changed. On the other hand, the "fully_established" flag
+on the subflow socket should be turned on as well not to re-send the
+MP_CAPABLE 3rd ACK content with the next ACK.
+
+Fixes: 84dfe3677a6f ("mptcp: send out dedicated ADD_ADDR packet")
+Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/options.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/net/mptcp/options.c b/net/mptcp/options.c
+index 4f08e04e1ab7..f3ec85779733 100644
+--- a/net/mptcp/options.c
++++ b/net/mptcp/options.c
+@@ -843,20 +843,16 @@ static bool check_fully_established(struct mptcp_sock *msk, struct sock *ssk,
+ return subflow->mp_capable;
+ }
+
+- if (mp_opt->dss && mp_opt->use_ack) {
++ if ((mp_opt->dss && mp_opt->use_ack) ||
++ (mp_opt->add_addr && !mp_opt->echo)) {
+ /* subflows are fully established as soon as we get any
+- * additional ack.
++ * additional ack, including ADD_ADDR.
+ */
+ subflow->fully_established = 1;
+ WRITE_ONCE(msk->fully_established, true);
+ goto fully_established;
+ }
+
+- if (mp_opt->add_addr) {
+- WRITE_ONCE(msk->fully_established, true);
+- return true;
+- }
+-
+ /* If the first established packet does not contain MP_CAPABLE + data
+ * then fallback to TCP. Fallback scenarios requires a reset for
+ * MP_JOIN subflows.
+--
+2.30.2
+
--- /dev/null
+From 5291628fed5ac3a1b5f4316eccc0d10a352df643 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 17:06:56 +0200
+Subject: mt76: fix enum type mismatch
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit abf3d98dee7c4038152ce88833ddc2189f68cbd4 ]
+
+There is no 'NONE' version of 'enum mcu_cipher_type', and returning
+'MT_CIPHER_NONE' causes a warning:
+
+drivers/net/wireless/mediatek/mt76/mt7921/mcu.c: In function 'mt7921_mcu_get_cipher':
+drivers/net/wireless/mediatek/mt76/mt7921/mcu.c:114:24: error: implicit conversion from 'enum mt76_cipher_type' to 'enum mcu_cipher_type' [-Werror=enum-conversion]
+ 114 | return MT_CIPHER_NONE;
+ | ^~~~~~~~~~~~~~
+
+Add the missing MCU_CIPHER_NONE defintion that fits in here with
+the same value.
+
+Fixes: c368362c36d3 ("mt76: fix iv and CCMP header insertion")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210721150745.1914829-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +-
+ drivers/net/wireless/mediatek/mt76/mt7915/mcu.h | 3 ++-
+ drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 2 +-
+ drivers/net/wireless/mediatek/mt76/mt7921/mcu.h | 3 ++-
+ 4 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index 607980321d27..106177072d18 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -111,7 +111,7 @@ mt7915_mcu_get_cipher(int cipher)
+ case WLAN_CIPHER_SUITE_SMS4:
+ return MCU_CIPHER_WAPI;
+ default:
+- return MT_CIPHER_NONE;
++ return MCU_CIPHER_NONE;
+ }
+ }
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h
+index 517621044d9e..c0255c3ac7d0 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h
+@@ -1035,7 +1035,8 @@ enum {
+ };
+
+ enum mcu_cipher_type {
+- MCU_CIPHER_WEP40 = 1,
++ MCU_CIPHER_NONE = 0,
++ MCU_CIPHER_WEP40,
+ MCU_CIPHER_WEP104,
+ MCU_CIPHER_WEP128,
+ MCU_CIPHER_TKIP,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+index 47843b055959..fc0d7dc3a5f3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+@@ -111,7 +111,7 @@ mt7921_mcu_get_cipher(int cipher)
+ case WLAN_CIPHER_SUITE_SMS4:
+ return MCU_CIPHER_WAPI;
+ default:
+- return MT_CIPHER_NONE;
++ return MCU_CIPHER_NONE;
+ }
+ }
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.h
+index 07abe86f07a9..adad20819341 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.h
+@@ -198,7 +198,8 @@ struct sta_rec_sec {
+ } __packed;
+
+ enum mcu_cipher_type {
+- MCU_CIPHER_WEP40 = 1,
++ MCU_CIPHER_NONE = 0,
++ MCU_CIPHER_WEP40,
+ MCU_CIPHER_WEP104,
+ MCU_CIPHER_WEP128,
+ MCU_CIPHER_TKIP,
+--
+2.30.2
+
--- /dev/null
+From 6f280aeb21ff4c593303e4b4e712073ed93494fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jun 2021 16:37:25 +0300
+Subject: mtd: rawnand: Add a check in of_get_nand_secure_regions()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 14f97f0b8e2b9950c028d0cb7311ffe26a3cc1c0 ]
+
+Check for whether of_property_count_elems_of_size() returns a negative
+error code.
+
+Fixes: 13b89768275d ("mtd: rawnand: Add support for secure regions in NAND memory")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/YMtQFXE0F1w7mUh+@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/nand_base.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
+index fb072c444495..b18c089a7dca 100644
+--- a/drivers/mtd/nand/raw/nand_base.c
++++ b/drivers/mtd/nand/raw/nand_base.c
+@@ -5059,8 +5059,8 @@ static int of_get_nand_secure_regions(struct nand_chip *chip)
+ int nr_elem, i, j;
+
+ nr_elem = of_property_count_elems_of_size(dn, "secure-regions", sizeof(u64));
+- if (!nr_elem)
+- return 0;
++ if (nr_elem <= 0)
++ return nr_elem;
+
+ chip->nr_secure_regions = nr_elem / 2;
+ chip->secure_regions = kcalloc(chip->nr_secure_regions, sizeof(*chip->secure_regions),
+--
+2.30.2
+
--- /dev/null
+From fa5115d2e5783992db2fed7443ea62cc8ae64b8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 11:58:13 +0530
+Subject: mtd: rawnand: Fix probe failure due to of_get_nand_secure_regions()
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit b48027083a78b13356695555a05b0e085e378687 ]
+
+Due to 14f97f0b8e2b, the rawnand platforms without "secure-regions"
+property defined in DT fails to probe. The issue is,
+of_get_nand_secure_regions() errors out if
+of_property_count_elems_of_size() returns a negative error code.
+
+If the "secure-regions" property is not present in DT, then also we'll
+get -EINVAL from of_property_count_elems_of_size() but it should not
+be treated as an error for platforms not declaring "secure-regions"
+in DT.
+
+So fix this behaviour by checking for the existence of that property in
+DT and return 0 if it is not present.
+
+Fixes: 14f97f0b8e2b ("mtd: rawnand: Add a check in of_get_nand_secure_regions()")
+Reported-by: Martin Kaiser <martin@kaiser.cx>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Martin Kaiser <martin@kaiser.cx>
+Tested-by: Martin Kaiser <martin@kaiser.cx>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210727062813.32619-1-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/nand_base.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
+index b18c089a7dca..4412fdc240a2 100644
+--- a/drivers/mtd/nand/raw/nand_base.c
++++ b/drivers/mtd/nand/raw/nand_base.c
+@@ -5056,8 +5056,14 @@ static bool of_get_nand_on_flash_bbt(struct device_node *np)
+ static int of_get_nand_secure_regions(struct nand_chip *chip)
+ {
+ struct device_node *dn = nand_get_flash_node(chip);
++ struct property *prop;
+ int nr_elem, i, j;
+
++ /* Only proceed if the "secure-regions" property is present in DT */
++ prop = of_find_property(dn, "secure-regions", NULL);
++ if (!prop)
++ return 0;
++
+ nr_elem = of_property_count_elems_of_size(dn, "secure-regions", sizeof(u64));
+ if (nr_elem <= 0)
+ return nr_elem;
+--
+2.30.2
+
--- /dev/null
+From fd01ef33c00610f097684ffe4572e149b0b611be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 18:14:33 +0300
+Subject: net: 6pack: fix slab-out-of-bounds in decode_data
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 19d1532a187669ce86d5a2696eb7275310070793 ]
+
+Syzbot reported slab-out-of bounds write in decode_data().
+The problem was in missing validation checks.
+
+Syzbot's reproducer generated malicious input, which caused
+decode_data() to be called a lot in sixpack_decode(). Since
+rx_count_cooked is only 400 bytes and noone reported before,
+that 400 bytes is not enough, let's just check if input is malicious
+and complain about buffer overrun.
+
+Fail log:
+==================================================================
+BUG: KASAN: slab-out-of-bounds in drivers/net/hamradio/6pack.c:843
+Write of size 1 at addr ffff888087c5544e by task kworker/u4:0/7
+
+CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.6.0-rc3-syzkaller #0
+...
+Workqueue: events_unbound flush_to_ldisc
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x197/0x210 lib/dump_stack.c:118
+ print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
+ __kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506
+ kasan_report+0x12/0x20 mm/kasan/common.c:641
+ __asan_report_store1_noabort+0x17/0x20 mm/kasan/generic_report.c:137
+ decode_data.part.0+0x23b/0x270 drivers/net/hamradio/6pack.c:843
+ decode_data drivers/net/hamradio/6pack.c:965 [inline]
+ sixpack_decode drivers/net/hamradio/6pack.c:968 [inline]
+
+Reported-and-tested-by: syzbot+fc8cd9a673d4577fb2e4@syzkaller.appspotmail.com
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hamradio/6pack.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index 80f41945709f..da6a2a4b6cc7 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -833,6 +833,12 @@ static void decode_data(struct sixpack *sp, unsigned char inbyte)
+ return;
+ }
+
++ if (sp->rx_count_cooked + 2 >= sizeof(sp->cooked_buf)) {
++ pr_err("6pack: cooked buffer overrun, data loss\n");
++ sp->rx_count = 0;
++ return;
++ }
++
+ buf = sp->raw_buf;
+ sp->cooked_buf[sp->rx_count_cooked++] =
+ buf[0] | ((buf[1] << 2) & 0xc0);
+--
+2.30.2
+
--- /dev/null
+From f273137eae967d3677ad7c82156e0523b6fb86ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 17:17:55 +0300
+Subject: net: dpaa2-switch: disable the control interface on error path
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit cd0a719fbd702eb4b455a6ad986483750125588a ]
+
+Currently dpaa2_switch_takedown has a funny name and does not do the
+opposite of dpaa2_switch_init, which makes probing fail when we need to
+handle an -EPROBE_DEFER.
+
+A sketch of what dpaa2_switch_init does:
+
+ dpsw_open
+
+ dpaa2_switch_detect_features
+
+ dpsw_reset
+
+ for (i = 0; i < ethsw->sw_attr.num_ifs; i++) {
+ dpsw_if_disable
+
+ dpsw_if_set_stp
+
+ dpsw_vlan_remove_if_untagged
+
+ dpsw_if_set_tci
+
+ dpsw_vlan_remove_if
+ }
+
+ dpsw_vlan_remove
+
+ alloc_ordered_workqueue
+
+ dpsw_fdb_remove
+
+ dpaa2_switch_ctrl_if_setup
+
+When dpaa2_switch_takedown is called from the error path of
+dpaa2_switch_probe(), the control interface, enabled by
+dpaa2_switch_ctrl_if_setup from dpaa2_switch_init, remains enabled,
+because dpaa2_switch_takedown does not call
+dpaa2_switch_ctrl_if_teardown.
+
+Since dpaa2_switch_probe might fail due to EPROBE_DEFER of a PHY, this
+means that a second probe of the driver will happen with the control
+interface directly enabled.
+
+This will trigger a second error:
+
+[ 93.273528] fsl_dpaa2_switch dpsw.0: dpsw_ctrl_if_set_pools() failed
+[ 93.281966] fsl_dpaa2_switch dpsw.0: fsl_mc_driver_probe failed: -13
+[ 93.288323] fsl_dpaa2_switch: probe of dpsw.0 failed with error -13
+
+Which if we investigate the /dev/dpaa2_mc_console log, we find out is
+caused by:
+
+[E, ctrl_if_set_pools:2211, DPMNG] ctrl_if must be disabled
+
+So make dpaa2_switch_takedown do the opposite of dpaa2_switch_init (in
+reasonable limits, no reason to change STP state, re-add VLANs etc), and
+rename it to something more conventional, like dpaa2_switch_teardown.
+
+Fixes: 613c0a5810b7 ("staging: dpaa2-switch: enable the control interface")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Link: https://lore.kernel.org/r/20210819141755.1931423-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/freescale/dpaa2/dpaa2-switch.c | 36 +++++++++----------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+index 87321b7239cf..58964d22cb17 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+@@ -3038,26 +3038,30 @@ static int dpaa2_switch_port_init(struct ethsw_port_priv *port_priv, u16 port)
+ return err;
+ }
+
+-static void dpaa2_switch_takedown(struct fsl_mc_device *sw_dev)
++static void dpaa2_switch_ctrl_if_teardown(struct ethsw_core *ethsw)
++{
++ dpsw_ctrl_if_disable(ethsw->mc_io, 0, ethsw->dpsw_handle);
++ dpaa2_switch_free_dpio(ethsw);
++ dpaa2_switch_destroy_rings(ethsw);
++ dpaa2_switch_drain_bp(ethsw);
++ dpaa2_switch_free_dpbp(ethsw);
++}
++
++static void dpaa2_switch_teardown(struct fsl_mc_device *sw_dev)
+ {
+ struct device *dev = &sw_dev->dev;
+ struct ethsw_core *ethsw = dev_get_drvdata(dev);
+ int err;
+
++ dpaa2_switch_ctrl_if_teardown(ethsw);
++
++ destroy_workqueue(ethsw->workqueue);
++
+ err = dpsw_close(ethsw->mc_io, 0, ethsw->dpsw_handle);
+ if (err)
+ dev_warn(dev, "dpsw_close err %d\n", err);
+ }
+
+-static void dpaa2_switch_ctrl_if_teardown(struct ethsw_core *ethsw)
+-{
+- dpsw_ctrl_if_disable(ethsw->mc_io, 0, ethsw->dpsw_handle);
+- dpaa2_switch_free_dpio(ethsw);
+- dpaa2_switch_destroy_rings(ethsw);
+- dpaa2_switch_drain_bp(ethsw);
+- dpaa2_switch_free_dpbp(ethsw);
+-}
+-
+ static int dpaa2_switch_remove(struct fsl_mc_device *sw_dev)
+ {
+ struct ethsw_port_priv *port_priv;
+@@ -3068,8 +3072,6 @@ static int dpaa2_switch_remove(struct fsl_mc_device *sw_dev)
+ dev = &sw_dev->dev;
+ ethsw = dev_get_drvdata(dev);
+
+- dpaa2_switch_ctrl_if_teardown(ethsw);
+-
+ dpaa2_switch_teardown_irqs(sw_dev);
+
+ dpsw_disable(ethsw->mc_io, 0, ethsw->dpsw_handle);
+@@ -3084,9 +3086,7 @@ static int dpaa2_switch_remove(struct fsl_mc_device *sw_dev)
+ kfree(ethsw->acls);
+ kfree(ethsw->ports);
+
+- dpaa2_switch_takedown(sw_dev);
+-
+- destroy_workqueue(ethsw->workqueue);
++ dpaa2_switch_teardown(sw_dev);
+
+ fsl_mc_portal_free(ethsw->mc_io);
+
+@@ -3199,7 +3199,7 @@ static int dpaa2_switch_probe(struct fsl_mc_device *sw_dev)
+ GFP_KERNEL);
+ if (!(ethsw->ports)) {
+ err = -ENOMEM;
+- goto err_takedown;
++ goto err_teardown;
+ }
+
+ ethsw->fdbs = kcalloc(ethsw->sw_attr.num_ifs, sizeof(*ethsw->fdbs),
+@@ -3270,8 +3270,8 @@ err_free_fdbs:
+ err_free_ports:
+ kfree(ethsw->ports);
+
+-err_takedown:
+- dpaa2_switch_takedown(sw_dev);
++err_teardown:
++ dpaa2_switch_teardown(sw_dev);
+
+ err_free_cmdport:
+ fsl_mc_portal_free(ethsw->mc_io);
+--
+2.30.2
+
--- /dev/null
+From 982d76a6d0381e17567278c10ef9fb87b7d6589b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 20:38:02 -0700
+Subject: net: mdio-mux: Don't ignore memory allocation errors
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit 99d81e942474cc7677d12f673f42a7ea699e2589 ]
+
+If we are seeing memory allocation errors, don't try to continue
+registering child mdiobus devices. It's unlikely they'll succeed.
+
+Fixes: 342fa1964439 ("mdio: mux: make child bus walking more permissive and errors more verbose")
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Tested-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Kevin Hilman <khilman@baylibre.com>
+Tested-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/mdio/mdio-mux.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/mdio/mdio-mux.c b/drivers/net/mdio/mdio-mux.c
+index 110e4ee85785..d6ed9033339c 100644
+--- a/drivers/net/mdio/mdio-mux.c
++++ b/drivers/net/mdio/mdio-mux.c
+@@ -82,6 +82,17 @@ out:
+
+ static int parent_count;
+
++static void mdio_mux_uninit_children(struct mdio_mux_parent_bus *pb)
++{
++ struct mdio_mux_child_bus *cb = pb->children;
++
++ while (cb) {
++ mdiobus_unregister(cb->mii_bus);
++ mdiobus_free(cb->mii_bus);
++ cb = cb->next;
++ }
++}
++
+ int mdio_mux_init(struct device *dev,
+ struct device_node *mux_node,
+ int (*switch_fn)(int cur, int desired, void *data),
+@@ -144,7 +155,7 @@ int mdio_mux_init(struct device *dev,
+ cb = devm_kzalloc(dev, sizeof(*cb), GFP_KERNEL);
+ if (!cb) {
+ ret_val = -ENOMEM;
+- continue;
++ goto err_loop;
+ }
+ cb->bus_number = v;
+ cb->parent = pb;
+@@ -152,8 +163,7 @@ int mdio_mux_init(struct device *dev,
+ cb->mii_bus = mdiobus_alloc();
+ if (!cb->mii_bus) {
+ ret_val = -ENOMEM;
+- devm_kfree(dev, cb);
+- continue;
++ goto err_loop;
+ }
+ cb->mii_bus->priv = cb;
+
+@@ -182,6 +192,10 @@ int mdio_mux_init(struct device *dev,
+
+ dev_err(dev, "Error: No acceptable child buses found\n");
+ devm_kfree(dev, pb);
++
++err_loop:
++ mdio_mux_uninit_children(pb);
++ of_node_put(child_bus_node);
+ err_pb_kz:
+ put_device(&parent_bus->dev);
+ err_parent_bus:
+@@ -193,14 +207,8 @@ EXPORT_SYMBOL_GPL(mdio_mux_init);
+ void mdio_mux_uninit(void *mux_handle)
+ {
+ struct mdio_mux_parent_bus *pb = mux_handle;
+- struct mdio_mux_child_bus *cb = pb->children;
+-
+- while (cb) {
+- mdiobus_unregister(cb->mii_bus);
+- mdiobus_free(cb->mii_bus);
+- cb = cb->next;
+- }
+
++ mdio_mux_uninit_children(pb);
+ put_device(&pb->mii_bus->dev);
+ }
+ EXPORT_SYMBOL_GPL(mdio_mux_uninit);
+--
+2.30.2
+
--- /dev/null
+From 5991a8634b50e3c851207ab5c2222906ad04bc19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 20:38:03 -0700
+Subject: net: mdio-mux: Handle -EPROBE_DEFER correctly
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit 7bd0cef5dac685f09ef8b0b2a7748ff42d284dc7 ]
+
+When registering mdiobus children, if we get an -EPROBE_DEFER, we shouldn't
+ignore it and continue registering the rest of the mdiobus children. This
+would permanently prevent the deferring child mdiobus from working instead
+of reattempting it in the future. So, if a child mdiobus needs to be
+reattempted in the future, defer the entire mdio-mux initialization.
+
+This fixes the issue where PHYs sitting under the mdio-mux aren't
+initialized correctly if the PHY's interrupt controller is not yet ready
+when the mdio-mux is being probed. Additional context in the link below.
+
+Fixes: 0ca2997d1452 ("netdev/of/phy: Add MDIO bus multiplexer support.")
+Link: https://lore.kernel.org/lkml/CAGETcx95kHrv8wA-O+-JtfH7H9biJEGJtijuPVN0V5dUKUAB3A@mail.gmail.com/#t
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Tested-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Kevin Hilman <khilman@baylibre.com>
+Tested-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/mdio/mdio-mux.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/mdio/mdio-mux.c b/drivers/net/mdio/mdio-mux.c
+index d6ed9033339c..3dde0c2b3e09 100644
+--- a/drivers/net/mdio/mdio-mux.c
++++ b/drivers/net/mdio/mdio-mux.c
+@@ -175,11 +175,15 @@ int mdio_mux_init(struct device *dev,
+ cb->mii_bus->write = mdio_mux_write;
+ r = of_mdiobus_register(cb->mii_bus, child_bus_node);
+ if (r) {
++ mdiobus_free(cb->mii_bus);
++ if (r == -EPROBE_DEFER) {
++ ret_val = r;
++ goto err_loop;
++ }
++ devm_kfree(dev, cb);
+ dev_err(dev,
+ "Error: Failed to register MDIO bus for child %pOF\n",
+ child_bus_node);
+- mdiobus_free(cb->mii_bus);
+- devm_kfree(dev, cb);
+ } else {
+ cb->next = pb->children;
+ pb->children = cb;
+--
+2.30.2
+
--- /dev/null
+From 1df8e344f9436042bfb7365bf3d6d9d280bc53f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 19:04:25 +0300
+Subject: net: mscc: ocelot: allow forwarding from bridge ports to the
+ tag_8021q CPU port
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit c1930148a3941f891ddbd76fceaa4e10a957ccf2 ]
+
+Currently we are unable to ping a bridge on top of a felix switch which
+uses the ocelot-8021q tagger. The packets are dropped on the ingress of
+the user port and the 'drop_local' counter increments (the counter which
+denotes drops due to no valid destinations).
+
+Dumping the PGID tables, it becomes clear that the PGID_SRC of the user
+port is zero, so it has no valid destinations.
+
+But looking at the code, the cpu_fwd_mask (the bit mask of DSA tag_8021q
+ports) is clearly missing from the forwarding mask of ports that are
+under a bridge. So this has always been broken.
+
+Looking at the version history of the patch, in v7
+https://patchwork.kernel.org/project/netdevbpf/patch/20210125220333.1004365-12-olteanv@gmail.com/
+the code looked like this:
+
+ /* Standalone ports forward only to DSA tag_8021q CPU ports */
+ unsigned long mask = cpu_fwd_mask;
+
+(...)
+ } else if (ocelot->bridge_fwd_mask & BIT(port)) {
+ mask |= ocelot->bridge_fwd_mask & ~BIT(port);
+
+while in v8 (the merged version)
+https://patchwork.kernel.org/project/netdevbpf/patch/20210129010009.3959398-12-olteanv@gmail.com/
+it looked like this:
+
+ unsigned long mask;
+
+(...)
+ } else if (ocelot->bridge_fwd_mask & BIT(port)) {
+ mask = ocelot->bridge_fwd_mask & ~BIT(port);
+
+So the breakage was introduced between v7 and v8 of the patch.
+
+Fixes: e21268efbe26 ("net: dsa: felix: perform switch setup for tag_8021q")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://lore.kernel.org/r/20210817160425.3702809-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index adfb9781799e..2948d731a1c1 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -1334,6 +1334,7 @@ void ocelot_apply_bridge_fwd_mask(struct ocelot *ocelot)
+ struct net_device *bond = ocelot_port->bond;
+
+ mask = ocelot_get_bridge_fwd_mask(ocelot, bridge);
++ mask |= cpu_fwd_mask;
+ mask &= ~BIT(port);
+ if (bond) {
+ mask &= ~ocelot_get_bond_mask(ocelot, bond,
+--
+2.30.2
+
--- /dev/null
+From 4cf2f88ee730dae592ff8c7b1b972ff0f9e8e663 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 21:14:04 +0800
+Subject: net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 0a298d133893c72c96e2156ed7cb0f0c4a306a3e ]
+
+qlcnic_83xx_unlock_flash() is called on all paths after we call
+qlcnic_83xx_lock_flash(), except for one error path on failure
+of QLCRD32(), which may cause a deadlock. This bug is suggested
+by a static analysis tool, please advise.
+
+Fixes: 81d0aeb0a4fff ("qlcnic: flash template based firmware reset recovery")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Link: https://lore.kernel.org/r/20210816131405.24024-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+index d8882d0b6b49..d51bac7ba5af 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+@@ -3156,8 +3156,10 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr,
+
+ indirect_addr = QLC_83XX_FLASH_DIRECT_DATA(addr);
+ ret = QLCRD32(adapter, indirect_addr, &err);
+- if (err == -EIO)
++ if (err == -EIO) {
++ qlcnic_83xx_unlock_flash(adapter);
+ return err;
++ }
+
+ word = ret;
+ *(u32 *)p_data = word;
+--
+2.30.2
+
--- /dev/null
+From 04368fb278bb6b0d01badb37d7ca590be4b0e7a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jun 2021 10:27:21 +0200
+Subject: net: usb: asix: refactor asix_read_phy_addr() and handle errors on
+ return
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 7e88b11a862afe59ee0c365123ea5fb96a26cb3b ]
+
+Refactor asix_read_phy_addr() to return usable error value directly and
+make sure all callers handle this error.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/asix.h | 3 +--
+ drivers/net/usb/asix_common.c | 31 ++++++++++++++++---------------
+ drivers/net/usb/asix_devices.c | 15 ++++++++++++---
+ drivers/net/usb/ax88172a.c | 5 +++++
+ 4 files changed, 34 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/usb/asix.h b/drivers/net/usb/asix.h
+index 3b53685301de..edb94efd265e 100644
+--- a/drivers/net/usb/asix.h
++++ b/drivers/net/usb/asix.h
+@@ -205,8 +205,7 @@ struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+ int asix_set_sw_mii(struct usbnet *dev, int in_pm);
+ int asix_set_hw_mii(struct usbnet *dev, int in_pm);
+
+-int asix_read_phy_addr(struct usbnet *dev, int internal);
+-int asix_get_phy_addr(struct usbnet *dev);
++int asix_read_phy_addr(struct usbnet *dev, bool internal);
+
+ int asix_sw_reset(struct usbnet *dev, u8 flags, int in_pm);
+
+diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
+index 7bc6e8f856fe..e1109f1a8dd5 100644
+--- a/drivers/net/usb/asix_common.c
++++ b/drivers/net/usb/asix_common.c
+@@ -288,32 +288,33 @@ int asix_set_hw_mii(struct usbnet *dev, int in_pm)
+ return ret;
+ }
+
+-int asix_read_phy_addr(struct usbnet *dev, int internal)
++int asix_read_phy_addr(struct usbnet *dev, bool internal)
+ {
+- int offset = (internal ? 1 : 0);
++ int ret, offset;
+ u8 buf[2];
+- int ret = asix_read_cmd(dev, AX_CMD_READ_PHY_ID, 0, 0, 2, buf, 0);
+
+- netdev_dbg(dev->net, "asix_get_phy_addr()\n");
++ ret = asix_read_cmd(dev, AX_CMD_READ_PHY_ID, 0, 0, 2, buf, 0);
++ if (ret < 0)
++ goto error;
+
+ if (ret < 2) {
+- netdev_err(dev->net, "Error reading PHYID register: %02x\n", ret);
+- goto out;
++ ret = -EIO;
++ goto error;
+ }
+- netdev_dbg(dev->net, "asix_get_phy_addr() returning 0x%04x\n",
+- *((__le16 *)buf));
++
++ offset = (internal ? 1 : 0);
+ ret = buf[offset];
+
+-out:
++ netdev_dbg(dev->net, "%s PHY address 0x%x\n",
++ internal ? "internal" : "external", ret);
++
+ return ret;
+-}
+
+-int asix_get_phy_addr(struct usbnet *dev)
+-{
+- /* return the address of the internal phy */
+- return asix_read_phy_addr(dev, 1);
+-}
++error:
++ netdev_err(dev->net, "Error reading PHY_ID register: %02x\n", ret);
+
++ return ret;
++}
+
+ int asix_sw_reset(struct usbnet *dev, u8 flags, int in_pm)
+ {
+diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
+index 19a8fafb8f04..fb523734bf31 100644
+--- a/drivers/net/usb/asix_devices.c
++++ b/drivers/net/usb/asix_devices.c
+@@ -262,7 +262,10 @@ static int ax88172_bind(struct usbnet *dev, struct usb_interface *intf)
+ dev->mii.mdio_write = asix_mdio_write;
+ dev->mii.phy_id_mask = 0x3f;
+ dev->mii.reg_num_mask = 0x1f;
+- dev->mii.phy_id = asix_get_phy_addr(dev);
++
++ dev->mii.phy_id = asix_read_phy_addr(dev, true);
++ if (dev->mii.phy_id < 0)
++ return dev->mii.phy_id;
+
+ dev->net->netdev_ops = &ax88172_netdev_ops;
+ dev->net->ethtool_ops = &ax88172_ethtool_ops;
+@@ -717,7 +720,10 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
+ dev->mii.mdio_write = asix_mdio_write;
+ dev->mii.phy_id_mask = 0x1f;
+ dev->mii.reg_num_mask = 0x1f;
+- dev->mii.phy_id = asix_get_phy_addr(dev);
++
++ dev->mii.phy_id = asix_read_phy_addr(dev, true);
++ if (dev->mii.phy_id < 0)
++ return dev->mii.phy_id;
+
+ dev->net->netdev_ops = &ax88772_netdev_ops;
+ dev->net->ethtool_ops = &ax88772_ethtool_ops;
+@@ -1081,7 +1087,10 @@ static int ax88178_bind(struct usbnet *dev, struct usb_interface *intf)
+ dev->mii.phy_id_mask = 0x1f;
+ dev->mii.reg_num_mask = 0xff;
+ dev->mii.supports_gmii = 1;
+- dev->mii.phy_id = asix_get_phy_addr(dev);
++
++ dev->mii.phy_id = asix_read_phy_addr(dev, true);
++ if (dev->mii.phy_id < 0)
++ return dev->mii.phy_id;
+
+ dev->net->netdev_ops = &ax88178_netdev_ops;
+ dev->net->ethtool_ops = &ax88178_ethtool_ops;
+diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
+index b404c9462dce..c8ca5187eece 100644
+--- a/drivers/net/usb/ax88172a.c
++++ b/drivers/net/usb/ax88172a.c
+@@ -220,6 +220,11 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf)
+ }
+
+ priv->phy_addr = asix_read_phy_addr(dev, priv->use_embdphy);
++ if (priv->phy_addr < 0) {
++ ret = priv->phy_addr;
++ goto free;
++ }
++
+ ax88172a_reset_phy(dev, priv->use_embdphy);
+
+ /* Asix framing packs multiple eth frames into a 2K usb bulk transfer */
+--
+2.30.2
+
--- /dev/null
+From 26e2aad1e4b930ae12ef48e17cf88ea0db00126b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 10:22:15 +0800
+Subject: ovs: clear skb->tstamp in forwarding path
+
+From: kaixi.fan <fankaixi.li@bytedance.com>
+
+[ Upstream commit 01634047bf0d5c2d9b7d8095bb4de1663dbeedeb ]
+
+fq qdisc requires tstamp to be cleared in the forwarding path. Now ovs
+doesn't clear skb->tstamp. We encountered a problem with linux
+version 5.4.56 and ovs version 2.14.1, and packets failed to
+dequeue from qdisc when fq qdisc was attached to ovs port.
+
+Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC")
+Signed-off-by: kaixi.fan <fankaixi.li@bytedance.com>
+Signed-off-by: xiexiaohui <xiexiaohui.xxh@bytedance.com>
+Reviewed-by: Cong Wang <cong.wang@bytedance.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/vport.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
+index 88deb5b41429..cf2ce5812489 100644
+--- a/net/openvswitch/vport.c
++++ b/net/openvswitch/vport.c
+@@ -507,6 +507,7 @@ void ovs_vport_send(struct vport *vport, struct sk_buff *skb, u8 mac_proto)
+ }
+
+ skb->dev = vport->dev;
++ skb->tstamp = 0;
+ vport->ops->send(skb);
+ return;
+
+--
+2.30.2
+
--- /dev/null
+From 8e54829b8657913b6c2e8812adf28cef16137c27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 13:21:44 +0000
+Subject: PCI/sysfs: Use correct variable for the legacy_mem sysfs object
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Wilczyński <kw@linux.com>
+
+[ Upstream commit 045a9277b5615846c7b662ffaba84e781f08a172 ]
+
+Two legacy PCI sysfs objects "legacy_io" and "legacy_mem" were updated
+to use an unified address space in the commit 636b21b50152 ("PCI: Revoke
+mappings like devmem"). This allows for revocations to be managed from
+a single place when drivers want to take over and mmap() a /dev/mem
+range.
+
+Following the update, both of the sysfs objects should leverage the
+iomem_get_mapping() function to get an appropriate address range, but
+only the "legacy_io" has been correctly updated - the second attribute
+seems to be using a wrong variable to pass the iomem_get_mapping()
+function to.
+
+Thus, correct the variable name used so that the "legacy_mem" sysfs
+object would also correctly call the iomem_get_mapping() function.
+
+Fixes: 636b21b50152 ("PCI: Revoke mappings like devmem")
+Link: https://lore.kernel.org/r/20210812132144.791268-1-kw@linux.com
+Signed-off-by: Krzysztof Wilczyński <kw@linux.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index beb8d1f4fafe..fb667d78e7b3 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -978,7 +978,7 @@ void pci_create_legacy_files(struct pci_bus *b)
+ b->legacy_mem->size = 1024*1024;
+ b->legacy_mem->attr.mode = 0600;
+ b->legacy_mem->mmap = pci_mmap_legacy_mem;
+- b->legacy_io->mapping = iomem_get_mapping();
++ b->legacy_mem->mapping = iomem_get_mapping();
+ pci_adjust_legacy_attr(b, pci_mmap_mem);
+ error = device_create_bin_file(&b->dev, b->legacy_mem);
+ if (error)
+--
+2.30.2
+
--- /dev/null
+From e1a59cd6661205fa704484f06408751eb5451a5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 10:04:43 -0700
+Subject: pipe: avoid unnecessary EPOLLET wakeups under normal loads
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 3b844826b6c6affa80755254da322b017358a2f4 ]
+
+I had forgotten just how sensitive hackbench is to extra pipe wakeups,
+and commit 3a34b13a88ca ("pipe: make pipe writes always wake up
+readers") ended up causing a quite noticeable regression on larger
+machines.
+
+Now, hackbench isn't necessarily a hugely meaningful benchmark, and it's
+not clear that this matters in real life all that much, but as Mel
+points out, it's used often enough when comparing kernels and so the
+performance regression shows up like a sore thumb.
+
+It's easy enough to fix at least for the common cases where pipes are
+used purely for data transfer, and you never have any exciting poll
+usage at all. So set a special 'poll_usage' flag when there is polling
+activity, and make the ugly "EPOLLET has crazy legacy expectations"
+semantics explicit to only that case.
+
+I would love to limit it to just the broken EPOLLET case, but the pipe
+code can't see the difference between epoll and regular select/poll, so
+any non-read/write waiting will trigger the extra wakeup behavior. That
+is sufficient for at least the hackbench case.
+
+Apart from making the odd extra wakeup cases more explicitly about
+EPOLLET, this also makes the extra wakeup be at the _end_ of the pipe
+write, not at the first write chunk. That is actually much saner
+semantics (as much as you can call any of the legacy edge-triggered
+expectations for EPOLLET "sane") since it means that you know the wakeup
+will happen once the write is done, rather than possibly in the middle
+of one.
+
+[ For stable people: I'm putting a "Fixes" tag on this, but I leave it
+ up to you to decide whether you actually want to backport it or not.
+ It likely has no impact outside of synthetic benchmarks - Linus ]
+
+Link: https://lore.kernel.org/lkml/20210802024945.GA8372@xsang-OptiPlex-9020/
+Fixes: 3a34b13a88ca ("pipe: make pipe writes always wake up readers")
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Tested-by: Sandeep Patil <sspatil@android.com>
+Tested-by: Mel Gorman <mgorman@techsingularity.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pipe.c | 15 +++++++++------
+ include/linux/pipe_fs_i.h | 2 ++
+ 2 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 8e6ef62aeb1c..678dee2a8228 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -444,9 +444,6 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
+ #endif
+
+ /*
+- * Epoll nonsensically wants a wakeup whether the pipe
+- * was already empty or not.
+- *
+ * If it wasn't empty we try to merge new data into
+ * the last buffer.
+ *
+@@ -455,9 +452,9 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
+ * spanning multiple pages.
+ */
+ head = pipe->head;
+- was_empty = true;
++ was_empty = pipe_empty(head, pipe->tail);
+ chars = total_len & (PAGE_SIZE-1);
+- if (chars && !pipe_empty(head, pipe->tail)) {
++ if (chars && !was_empty) {
+ unsigned int mask = pipe->ring_size - 1;
+ struct pipe_buffer *buf = &pipe->bufs[(head - 1) & mask];
+ int offset = buf->offset + buf->len;
+@@ -590,8 +587,11 @@ out:
+ * This is particularly important for small writes, because of
+ * how (for example) the GNU make jobserver uses small writes to
+ * wake up pending jobs
++ *
++ * Epoll nonsensically wants a wakeup whether the pipe
++ * was already empty or not.
+ */
+- if (was_empty) {
++ if (was_empty || pipe->poll_usage) {
+ wake_up_interruptible_sync_poll(&pipe->rd_wait, EPOLLIN | EPOLLRDNORM);
+ kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+ }
+@@ -654,6 +654,9 @@ pipe_poll(struct file *filp, poll_table *wait)
+ struct pipe_inode_info *pipe = filp->private_data;
+ unsigned int head, tail;
+
++ /* Epoll has some historical nasty semantics, this enables them */
++ pipe->poll_usage = 1;
++
+ /*
+ * Reading pipe state only -- no need for acquiring the semaphore.
+ *
+diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
+index 5d2705f1d01c..fc5642431b92 100644
+--- a/include/linux/pipe_fs_i.h
++++ b/include/linux/pipe_fs_i.h
+@@ -48,6 +48,7 @@ struct pipe_buffer {
+ * @files: number of struct file referring this pipe (protected by ->i_lock)
+ * @r_counter: reader counter
+ * @w_counter: writer counter
++ * @poll_usage: is this pipe used for epoll, which has crazy wakeups?
+ * @fasync_readers: reader side fasync
+ * @fasync_writers: writer side fasync
+ * @bufs: the circular array of pipe buffers
+@@ -70,6 +71,7 @@ struct pipe_inode_info {
+ unsigned int files;
+ unsigned int r_counter;
+ unsigned int w_counter;
++ unsigned int poll_usage;
+ struct page *tmp_page;
+ struct fasync_struct *fasync_readers;
+ struct fasync_struct *fasync_writers;
+--
+2.30.2
+
--- /dev/null
+From b35045213c53f49b4be7b5d27894c38bec22367e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 20:33:27 +0300
+Subject: ptp_pch: Restore dependency on PCI
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 55c8fca1dae1fb0d11deaa21b65a647dedb1bc50 ]
+
+During the swap dependency on PCH_GBE to selection PTP_1588_CLOCK_PCH
+incidentally dropped the implicit dependency on the PCI. Restore it.
+
+Fixes: 18d359ceb044 ("pch_gbe, ptp_pch: Fix the dependency direction between these drivers")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig
+index 8c20e524e9ad..e085c255da0c 100644
+--- a/drivers/ptp/Kconfig
++++ b/drivers/ptp/Kconfig
+@@ -90,7 +90,8 @@ config PTP_1588_CLOCK_INES
+ config PTP_1588_CLOCK_PCH
+ tristate "Intel PCH EG20T as PTP clock"
+ depends on X86_32 || COMPILE_TEST
+- depends on HAS_IOMEM && NET
++ depends on HAS_IOMEM && PCI
++ depends on NET
+ imply PTP_1588_CLOCK
+ help
+ This driver adds support for using the PCH EG20T as a PTP
+--
+2.30.2
+
--- /dev/null
+From dc59f1cf674d85003daa3fe4c483c75d18888dd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 11:05:37 +0800
+Subject: r8152: fix the maximum number of PLA bp for RTL8153C
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit 6633fb83f1faddbfcac09e35edcae96bd0468335 ]
+
+The maximum PLA bp number of RTL8153C is 16, not 8. That is, the
+bp 0 ~ 15 are at 0xfc28 ~ 0xfc46, and the bp_en is at 0xfc48.
+
+Fixes: 195aae321c82 ("r8152: support new chips")
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index b2b77edf72b8..a044f37e87ae 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -3953,13 +3953,24 @@ static void rtl_clear_bp(struct r8152 *tp, u16 type)
+ case RTL_VER_06:
+ ocp_write_byte(tp, type, PLA_BP_EN, 0);
+ break;
++ case RTL_VER_14:
++ ocp_write_word(tp, type, USB_BP2_EN, 0);
++
++ ocp_write_word(tp, type, USB_BP_8, 0);
++ ocp_write_word(tp, type, USB_BP_9, 0);
++ ocp_write_word(tp, type, USB_BP_10, 0);
++ ocp_write_word(tp, type, USB_BP_11, 0);
++ ocp_write_word(tp, type, USB_BP_12, 0);
++ ocp_write_word(tp, type, USB_BP_13, 0);
++ ocp_write_word(tp, type, USB_BP_14, 0);
++ ocp_write_word(tp, type, USB_BP_15, 0);
++ break;
+ case RTL_VER_08:
+ case RTL_VER_09:
+ case RTL_VER_10:
+ case RTL_VER_11:
+ case RTL_VER_12:
+ case RTL_VER_13:
+- case RTL_VER_14:
+ case RTL_VER_15:
+ default:
+ if (type == MCU_TYPE_USB) {
+@@ -4329,7 +4340,6 @@ static bool rtl8152_is_fw_mac_ok(struct r8152 *tp, struct fw_mac *mac)
+ case RTL_VER_11:
+ case RTL_VER_12:
+ case RTL_VER_13:
+- case RTL_VER_14:
+ case RTL_VER_15:
+ fw_reg = 0xf800;
+ bp_ba_addr = PLA_BP_BA;
+@@ -4337,6 +4347,13 @@ static bool rtl8152_is_fw_mac_ok(struct r8152 *tp, struct fw_mac *mac)
+ bp_start = PLA_BP_0;
+ max_bp = 8;
+ break;
++ case RTL_VER_14:
++ fw_reg = 0xf800;
++ bp_ba_addr = PLA_BP_BA;
++ bp_en_addr = USB_BP2_EN;
++ bp_start = PLA_BP_0;
++ max_bp = 16;
++ break;
+ default:
+ goto out;
+ }
+--
+2.30.2
+
--- /dev/null
+From 6ff23c8938a8c7786bbe744272b6d86a00d038e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 11:05:36 +0800
+Subject: r8152: fix writing USB_BP2_EN
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit a876a33d2a1102f99fc782fefb784f4dd4841d8c ]
+
+The register of USB_BP2_EN is 16 bits, so we should use
+ocp_write_word(), not ocp_write_byte().
+
+Fixes: 9370f2d05a2a ("support request_firmware for RTL8153")
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 2cf763b4ea84..b2b77edf72b8 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -3963,7 +3963,7 @@ static void rtl_clear_bp(struct r8152 *tp, u16 type)
+ case RTL_VER_15:
+ default:
+ if (type == MCU_TYPE_USB) {
+- ocp_write_byte(tp, MCU_TYPE_USB, USB_BP2_EN, 0);
++ ocp_write_word(tp, MCU_TYPE_USB, USB_BP2_EN, 0);
+
+ ocp_write_word(tp, MCU_TYPE_USB, USB_BP_8, 0);
+ ocp_write_word(tp, MCU_TYPE_USB, USB_BP_9, 0);
+--
+2.30.2
+
--- /dev/null
+From 1d7fb122f951eb5122368c6c3aec337c3213ecdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 13:58:42 +0300
+Subject: Revert "flow_offload: action should not be NULL when it is
+ referenced"
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit fa05bdb89b01b098aad19ec0ebc4d1cc7b11177e ]
+
+This reverts commit 9ea3e52c5bc8bb4a084938dc1e3160643438927a.
+
+Cited commit added a check to make sure 'action' is not NULL, but
+'action' is already dereferenced before the check, when calling
+flow_offload_has_one_action().
+
+Therefore, the check does not make any sense and results in a smatch
+warning:
+
+include/net/flow_offload.h:322 flow_action_mixed_hw_stats_check() warn:
+variable dereferenced before check 'action' (see line 319)
+
+Fix by reverting this commit.
+
+Cc: gushengxian <gushengxian@yulong.com>
+Fixes: 9ea3e52c5bc8 ("flow_offload: action should not be NULL when it is referenced")
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Link: https://lore.kernel.org/r/20210819105842.1315705-1-idosch@idosch.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/flow_offload.h | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/include/net/flow_offload.h b/include/net/flow_offload.h
+index 69c9eabf8325..dc5c1e69cd9f 100644
+--- a/include/net/flow_offload.h
++++ b/include/net/flow_offload.h
+@@ -319,14 +319,12 @@ flow_action_mixed_hw_stats_check(const struct flow_action *action,
+ if (flow_offload_has_one_action(action))
+ return true;
+
+- if (action) {
+- flow_action_for_each(i, action_entry, action) {
+- if (i && action_entry->hw_stats != last_hw_stats) {
+- NL_SET_ERR_MSG_MOD(extack, "Mixing HW stats types for actions is not supported");
+- return false;
+- }
+- last_hw_stats = action_entry->hw_stats;
++ flow_action_for_each(i, action_entry, action) {
++ if (i && action_entry->hw_stats != last_hw_stats) {
++ NL_SET_ERR_MSG_MOD(extack, "Mixing HW stats types for actions is not supported");
++ return false;
+ }
++ last_hw_stats = action_entry->hw_stats;
+ }
+ return true;
+ }
+--
+2.30.2
+
--- /dev/null
+From ba8932d9ff32980577edf79e64e4acc0bcba4dce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 13:59:17 +0200
+Subject: sch_cake: fix srchost/dsthost hashing mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 86b9bbd332d0510679c7fedcee3e3bd278be5756 ]
+
+When adding support for using the skb->hash value as the flow hash in CAKE,
+I accidentally introduced a logic error that broke the host-only isolation
+modes of CAKE (srchost and dsthost keywords). Specifically, the flow_hash
+variable should stay initialised to 0 in cake_hash() in pure host-based
+hashing mode. Add a check for this before using the skb->hash value as
+flow_hash.
+
+Fixes: b0c19ed6088a ("sch_cake: Take advantage of skb->hash where appropriate")
+Reported-by: Pete Heist <pete@heistp.net>
+Tested-by: Pete Heist <pete@heistp.net>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_cake.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
+index 951542843cab..28af8b1e1bb1 100644
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -720,7 +720,7 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb,
+ skip_hash:
+ if (flow_override)
+ flow_hash = flow_override - 1;
+- else if (use_skbhash)
++ else if (use_skbhash && (flow_mode & CAKE_FLOW_FLOWS))
+ flow_hash = skb->hash;
+ if (host_override) {
+ dsthost_hash = host_override - 1;
+--
+2.30.2
+
drm-amd-display-fix-dynamic-bpp-issue-with-8k30-with.patch
drm-amd-display-workaround-for-hard-hang-on-hpd-on-n.patch
kyber-make-trace_block_rq-call-consistent-with-docum.patch
+mtd-rawnand-add-a-check-in-of_get_nand_secure_region.patch
+arm64-dts-qcom-c630-fix-correct-powerdown-pin-for-ws.patch
+arm64-dts-qcom-msm8992-bullhead-remove-psci.patch
+arm64-dts-qcom-msm8992-bullhead-fix-cont_splash_mem-.patch
+iommu-check-if-group-is-null-before-remove-device.patch
+cpufreq-arm_scmi-fix-error-path-when-allocation-fail.patch
+arm64-dts-qcom-msm8994-angler-disable-cont_splash_me.patch
+arm64-dts-qcom-sdm845-oneplus-fix-reserved-mem.patch
+mt76-fix-enum-type-mismatch.patch
+mtd-rawnand-fix-probe-failure-due-to-of_get_nand_sec.patch
+soc-fsl-qe-convert-qe-interrupt-controller-to-platfo.patch
+cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch
+dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch
+virtio-protect-vqs-list-access.patch
+vhost-vdpa-fix-integer-overflow-in-vhost_vdpa_proces.patch
+bus-ti-sysc-fix-error-handling-for-sysc_check_active.patch
+vhost-fix-the-calculation-in-vhost_overflow.patch
+vdpa_sim-fix-return-value-check-for-vdpa_alloc_devic.patch
+vp_vdpa-fix-return-value-check-for-vdpa_alloc_device.patch
+vdpa-ifcvf-fix-return-value-check-for-vdpa_alloc_dev.patch
+vdpa-mlx5-avoid-destroying-mr-on-empty-iotlb.patch
+vdpa-mlx5-fix-queue-type-selection-logic.patch
+drm-mediatek-add-aal-output-size-configuration.patch
+drm-mediatek-add-component_del-in-ovl-and-color-remo.patch
+bpf-clear-zext_dst-of-dead-insns.patch
+bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch
+bnxt-disable-napi-before-canceling-dim.patch
+bnxt-make-sure-xmit_more-errors-does-not-miss-doorbe.patch
+bnxt-count-tx-drops.patch
+soc-fsl-qe-fix-static-checker-warning.patch
+net-6pack-fix-slab-out-of-bounds-in-decode_data.patch
+ptp_pch-restore-dependency-on-pci.patch
+bnxt_en-disable-arfs-if-running-on-212-firmware.patch
+bnxt_en-add-missing-dma-memory-barriers.patch
+vrf-reset-skb-conntrack-connection-on-vrf-rcv.patch
+virtio-net-use-netif_f_gro_hw-instead-of-netif_f_lro.patch
+mac80211-fix-locking-in-ieee80211_restart_work.patch
+net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch
+ixgbe-xsk-clean-up-the-resources-in-ixgbe_xsk_pool_e.patch
+sch_cake-fix-srchost-dsthost-hashing-mode.patch
+net-mdio-mux-don-t-ignore-memory-allocation-errors.patch
+net-mdio-mux-handle-eprobe_defer-correctly.patch
+ovs-clear-skb-tstamp-in-forwarding-path.patch
+net-usb-asix-refactor-asix_read_phy_addr-and-handle-.patch
+iommu-vt-d-fix-incomplete-cache-flush-in-intel_pasid.patch
+drm-i915-skip-display-interruption-setup-when-displa.patch
+drm-i915-tweaked-wa_14010685332-for-all-pchs.patch
+pipe-avoid-unnecessary-epollet-wakeups-under-normal-.patch
+drm-amd-display-use-dcn30-watermark-calc-for-dcn301.patch
+net-mscc-ocelot-allow-forwarding-from-bridge-ports-t.patch
+mptcp-fix-memory-leak-on-address-flush.patch
+mptcp-full-fully-established-support-after-add_addr.patch
+r8152-fix-writing-usb_bp2_en.patch
+r8152-fix-the-maximum-number-of-pla-bp-for-rtl8153c.patch
+pci-sysfs-use-correct-variable-for-the-legacy_mem-sy.patch
+i40e-fix-atr-queue-selection.patch
+iavf-fix-ping-is-lost-after-untrusted-vf-had-tried-t.patch
+revert-flow_offload-action-should-not-be-null-when-i.patch
+net-dpaa2-switch-disable-the-control-interface-on-er.patch
--- /dev/null
+From 1131b9b5fa9a0fd47e7fad7e54e9fa085123511d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 14:35:38 +0300
+Subject: soc: fsl: qe: convert QE interrupt controller to platform_device
+
+From: Maxim Kochetkov <fido_max@inbox.ru>
+
+[ Upstream commit be7ecbd240b2f9ec544d3ce6fccf4cec3cd15dca ]
+
+Since 5.13 QE's ucc nodes can't get interrupts from devicetree:
+
+ ucc@2000 {
+ cell-index = <1>;
+ reg = <0x2000 0x200>;
+ interrupts = <32>;
+ interrupt-parent = <&qeic>;
+ };
+
+Now fw_devlink expects driver to create and probe a struct device
+for interrupt controller.
+
+So lets convert this driver to simple platform_device with probe().
+Also use platform_get_ and devm_ family function to get/allocate
+resources and drop unused .compatible = "qeic".
+
+[1] - https://lore.kernel.org/lkml/CAGETcx9PiX==mLxB9PO8Myyk6u2vhPVwTMsA5NkD-ywH5xhusw@mail.gmail.com
+Fixes: e590474768f1 ("driver core: Set fw_devlink=on by default")
+Fixes: ea718c699055 ("Revert "Revert "driver core: Set fw_devlink=on by default""")
+Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Saravana Kannan <saravanak@google.com>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/qe/qe_ic.c | 75 ++++++++++++++++++++++----------------
+ 1 file changed, 44 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/soc/fsl/qe/qe_ic.c b/drivers/soc/fsl/qe/qe_ic.c
+index 3f711c1a0996..e710d554425d 100644
+--- a/drivers/soc/fsl/qe/qe_ic.c
++++ b/drivers/soc/fsl/qe/qe_ic.c
+@@ -23,6 +23,7 @@
+ #include <linux/signal.h>
+ #include <linux/device.h>
+ #include <linux/spinlock.h>
++#include <linux/platform_device.h>
+ #include <asm/irq.h>
+ #include <asm/io.h>
+ #include <soc/fsl/qe/qe.h>
+@@ -404,41 +405,40 @@ static void qe_ic_cascade_muxed_mpic(struct irq_desc *desc)
+ chip->irq_eoi(&desc->irq_data);
+ }
+
+-static void __init qe_ic_init(struct device_node *node)
++static int qe_ic_init(struct platform_device *pdev)
+ {
++ struct device *dev = &pdev->dev;
+ void (*low_handler)(struct irq_desc *desc);
+ void (*high_handler)(struct irq_desc *desc);
+ struct qe_ic *qe_ic;
+- struct resource res;
+- u32 ret;
++ struct resource *res;
++ struct device_node *node = pdev->dev.of_node;
+
+- ret = of_address_to_resource(node, 0, &res);
+- if (ret)
+- return;
++ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (res == NULL) {
++ dev_err(dev, "no memory resource defined\n");
++ return -ENODEV;
++ }
+
+- qe_ic = kzalloc(sizeof(*qe_ic), GFP_KERNEL);
++ qe_ic = devm_kzalloc(dev, sizeof(*qe_ic), GFP_KERNEL);
+ if (qe_ic == NULL)
+- return;
++ return -ENOMEM;
+
+- qe_ic->irqhost = irq_domain_add_linear(node, NR_QE_IC_INTS,
+- &qe_ic_host_ops, qe_ic);
+- if (qe_ic->irqhost == NULL) {
+- kfree(qe_ic);
+- return;
++ qe_ic->regs = devm_ioremap(dev, res->start, resource_size(res));
++ if (qe_ic->regs == NULL) {
++ dev_err(dev, "failed to ioremap() registers\n");
++ return -ENODEV;
+ }
+
+- qe_ic->regs = ioremap(res.start, resource_size(&res));
+-
+ qe_ic->hc_irq = qe_ic_irq_chip;
+
+- qe_ic->virq_high = irq_of_parse_and_map(node, 0);
+- qe_ic->virq_low = irq_of_parse_and_map(node, 1);
++ qe_ic->virq_high = platform_get_irq(pdev, 0);
++ qe_ic->virq_low = platform_get_irq(pdev, 1);
+
+- if (!qe_ic->virq_low) {
+- printk(KERN_ERR "Failed to map QE_IC low IRQ\n");
+- kfree(qe_ic);
+- return;
++ if (qe_ic->virq_low < 0) {
++ return -ENODEV;
+ }
++
+ if (qe_ic->virq_high != qe_ic->virq_low) {
+ low_handler = qe_ic_cascade_low;
+ high_handler = qe_ic_cascade_high;
+@@ -447,6 +447,13 @@ static void __init qe_ic_init(struct device_node *node)
+ high_handler = NULL;
+ }
+
++ qe_ic->irqhost = irq_domain_add_linear(node, NR_QE_IC_INTS,
++ &qe_ic_host_ops, qe_ic);
++ if (qe_ic->irqhost == NULL) {
++ dev_err(dev, "failed to add irq domain\n");
++ return -ENODEV;
++ }
++
+ qe_ic_write(qe_ic->regs, QEIC_CICR, 0);
+
+ irq_set_handler_data(qe_ic->virq_low, qe_ic);
+@@ -456,20 +463,26 @@ static void __init qe_ic_init(struct device_node *node)
+ irq_set_handler_data(qe_ic->virq_high, qe_ic);
+ irq_set_chained_handler(qe_ic->virq_high, high_handler);
+ }
++ return 0;
+ }
++static const struct of_device_id qe_ic_ids[] = {
++ { .compatible = "fsl,qe-ic"},
++ { .type = "qeic"},
++ {},
++};
+
+-static int __init qe_ic_of_init(void)
++static struct platform_driver qe_ic_driver =
+ {
+- struct device_node *np;
++ .driver = {
++ .name = "qe-ic",
++ .of_match_table = qe_ic_ids,
++ },
++ .probe = qe_ic_init,
++};
+
+- np = of_find_compatible_node(NULL, NULL, "fsl,qe-ic");
+- if (!np) {
+- np = of_find_node_by_type(NULL, "qeic");
+- if (!np)
+- return -ENODEV;
+- }
+- qe_ic_init(np);
+- of_node_put(np);
++static int __init qe_ic_of_init(void)
++{
++ platform_driver_register(&qe_ic_driver);
+ return 0;
+ }
+ subsys_initcall(qe_ic_of_init);
+--
+2.30.2
+
--- /dev/null
+From 3f65ea470fc0fb58e68ae228bc0c4e11a09a2e66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 10:10:36 +0300
+Subject: soc: fsl: qe: fix static checker warning
+
+From: Maxim Kochetkov <fido_max@inbox.ru>
+
+[ Upstream commit c1e64c0aec8cb0499e61af7ea086b59abba97945 ]
+
+The patch be7ecbd240b2: "soc: fsl: qe: convert QE interrupt
+controller to platform_device" from Aug 3, 2021, leads to the
+following static checker warning:
+
+ drivers/soc/fsl/qe/qe_ic.c:438 qe_ic_init()
+ warn: unsigned 'qe_ic->virq_low' is never less than zero.
+
+In old variant irq_of_parse_and_map() returns zero if failed so
+unsigned int for virq_high/virq_low was ok.
+In new variant platform_get_irq() returns negative error codes
+if failed so we need to use int for virq_high/virq_low.
+
+Also simplify high_handler checking and remove the curly braces
+to make checkpatch happy.
+
+Fixes: be7ecbd240b2 ("soc: fsl: qe: convert QE interrupt controller to platform_device")
+Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/qe/qe_ic.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/soc/fsl/qe/qe_ic.c b/drivers/soc/fsl/qe/qe_ic.c
+index e710d554425d..bbae3d39c7be 100644
+--- a/drivers/soc/fsl/qe/qe_ic.c
++++ b/drivers/soc/fsl/qe/qe_ic.c
+@@ -54,8 +54,8 @@ struct qe_ic {
+ struct irq_chip hc_irq;
+
+ /* VIRQ numbers of QE high/low irqs */
+- unsigned int virq_high;
+- unsigned int virq_low;
++ int virq_high;
++ int virq_low;
+ };
+
+ /*
+@@ -435,11 +435,10 @@ static int qe_ic_init(struct platform_device *pdev)
+ qe_ic->virq_high = platform_get_irq(pdev, 0);
+ qe_ic->virq_low = platform_get_irq(pdev, 1);
+
+- if (qe_ic->virq_low < 0) {
++ if (qe_ic->virq_low <= 0)
+ return -ENODEV;
+- }
+
+- if (qe_ic->virq_high != qe_ic->virq_low) {
++ if (qe_ic->virq_high > 0 && qe_ic->virq_high != qe_ic->virq_low) {
+ low_handler = qe_ic_cascade_low;
+ high_handler = qe_ic_cascade_high;
+ } else {
+@@ -459,7 +458,7 @@ static int qe_ic_init(struct platform_device *pdev)
+ irq_set_handler_data(qe_ic->virq_low, qe_ic);
+ irq_set_chained_handler(qe_ic->virq_low, low_handler);
+
+- if (qe_ic->virq_high && qe_ic->virq_high != qe_ic->virq_low) {
++ if (high_handler) {
+ irq_set_handler_data(qe_ic->virq_high, qe_ic);
+ irq_set_chained_handler(qe_ic->virq_high, high_handler);
+ }
+--
+2.30.2
+
--- /dev/null
+From 862b3800ff7c2521c2dcc1ea0b550c6a514432ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 16:00:25 +0800
+Subject: vDPA/ifcvf: Fix return value check for vdpa_alloc_device()
+
+From: Xie Yongji <xieyongji@bytedance.com>
+
+[ Upstream commit 1057afa0121db8bd3ca4718c8e0ca12388ab7759 ]
+
+The vdpa_alloc_device() returns an error pointer upon
+failure, not NULL. To handle the failure correctly, this
+replaces NULL check with IS_ERR() check and propagate the
+error upwards.
+
+Fixes: 5a2414bc454e ("virtio: Intel IFC VF driver for VDPA")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
+Link: https://lore.kernel.org/r/20210715080026.242-3-xieyongji@bytedance.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/ifcvf/ifcvf_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vdpa/ifcvf/ifcvf_main.c b/drivers/vdpa/ifcvf/ifcvf_main.c
+index ab0ab5cf0f6e..1c6cd5276a50 100644
+--- a/drivers/vdpa/ifcvf/ifcvf_main.c
++++ b/drivers/vdpa/ifcvf/ifcvf_main.c
+@@ -477,9 +477,9 @@ static int ifcvf_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ adapter = vdpa_alloc_device(struct ifcvf_adapter, vdpa,
+ dev, &ifc_vdpa_ops, NULL);
+- if (adapter == NULL) {
++ if (IS_ERR(adapter)) {
+ IFCVF_ERR(pdev, "Failed to allocate vDPA structure");
+- return -ENOMEM;
++ return PTR_ERR(adapter);
+ }
+
+ pci_set_master(pdev);
+--
+2.30.2
+
--- /dev/null
+From fb3c774132b1edc6a6ecdf53c3f6b8dc7f00fdca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 08:37:13 +0300
+Subject: vdpa/mlx5: Avoid destroying MR on empty iotlb
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit 08dbd5660232bede7916d8568003012c1182cc9a ]
+
+The current code treats an empty iotlb provdied in set_map() as a
+special case and destroy the memory region object. This must not be done
+since the virtqueue objects reference this MR. Doing so will cause the
+driver unload to emit errors and log timeouts caused by the firmware
+complaining on busy resources.
+
+This patch treats an empty iotlb as any other change of mapping. In this
+case, mlx5_vdpa_create_mr() will fail and the entire set_map() call to
+fail.
+
+This issue has not been encountered before but was seen to occur in a
+non-official version of qemu. Since qemu is a userspace program, the
+driver must protect against such case.
+
+Fixes: 94abbccdf291 ("vdpa/mlx5: Add shared memory registration code")
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Link: https://lore.kernel.org/r/20210811053713.66658-1-elic@nvidia.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/mlx5/core/mr.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c
+index cfa56a58b271..0ca39ef20c6d 100644
+--- a/drivers/vdpa/mlx5/core/mr.c
++++ b/drivers/vdpa/mlx5/core/mr.c
+@@ -454,11 +454,6 @@ out:
+ mutex_unlock(&mr->mkey_mtx);
+ }
+
+-static bool map_empty(struct vhost_iotlb *iotlb)
+-{
+- return !vhost_iotlb_itree_first(iotlb, 0, U64_MAX);
+-}
+-
+ int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb,
+ bool *change_map)
+ {
+@@ -466,10 +461,6 @@ int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *io
+ int err = 0;
+
+ *change_map = false;
+- if (map_empty(iotlb)) {
+- mlx5_vdpa_destroy_mr(mvdev);
+- return 0;
+- }
+ mutex_lock(&mr->mkey_mtx);
+ if (mr->initialized) {
+ mlx5_vdpa_info(mvdev, "memory map update\n");
+--
+2.30.2
+
--- /dev/null
+From 843fb63200957788026aa40062ba0ddb5540a922 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 08:37:59 +0300
+Subject: vdpa/mlx5: Fix queue type selection logic
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit 879753c816dbbdb2a9a395aa4448d29feee92d1a ]
+
+get_queue_type() comments that splict virtqueue is preferred, however,
+the actual logic preferred packed virtqueues. Since firmware has not
+supported packed virtqueues we ended up using split virtqueues as was
+desired.
+
+Since we do not advertise support for packed virtqueues, we add a check
+to verify split virtqueues are indeed supported.
+
+Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices")
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Link: https://lore.kernel.org/r/20210811053759.66752-1-elic@nvidia.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/mlx5/net/mlx5_vnet.c | 14 ++++++++++----
+ include/linux/mlx5/mlx5_ifc_vdpa.h | 10 ++++++----
+ 2 files changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+index f3495386698a..103d8f70df8e 100644
+--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+@@ -752,12 +752,12 @@ static int get_queue_type(struct mlx5_vdpa_net *ndev)
+ type_mask = MLX5_CAP_DEV_VDPA_EMULATION(ndev->mvdev.mdev, virtio_queue_type);
+
+ /* prefer split queue */
+- if (type_mask & MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_PACKED)
+- return MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_PACKED;
++ if (type_mask & MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_SPLIT)
++ return MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_SPLIT;
+
+- WARN_ON(!(type_mask & MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_SPLIT));
++ WARN_ON(!(type_mask & MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_PACKED));
+
+- return MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_SPLIT;
++ return MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_PACKED;
+ }
+
+ static bool vq_is_tx(u16 idx)
+@@ -2010,6 +2010,12 @@ static int mlx5_vdpa_dev_add(struct vdpa_mgmt_dev *v_mdev, const char *name)
+ return -ENOSPC;
+
+ mdev = mgtdev->madev->mdev;
++ if (!(MLX5_CAP_DEV_VDPA_EMULATION(mdev, virtio_queue_type) &
++ MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_SPLIT)) {
++ dev_warn(mdev->device, "missing support for split virtqueues\n");
++ return -EOPNOTSUPP;
++ }
++
+ /* we save one virtqueue for control virtqueue should we require it */
+ max_vqs = MLX5_CAP_DEV_VDPA_EMULATION(mdev, max_num_virtio_queues);
+ max_vqs = min_t(u32, max_vqs, MLX5_MAX_SUPPORTED_VQS);
+diff --git a/include/linux/mlx5/mlx5_ifc_vdpa.h b/include/linux/mlx5/mlx5_ifc_vdpa.h
+index 98b56b75c625..1a9c9d94cb59 100644
+--- a/include/linux/mlx5/mlx5_ifc_vdpa.h
++++ b/include/linux/mlx5/mlx5_ifc_vdpa.h
+@@ -11,13 +11,15 @@ enum {
+ };
+
+ enum {
+- MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_SPLIT = 0x1, // do I check this caps?
+- MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_PACKED = 0x2,
++ MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_SPLIT = 0,
++ MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_PACKED = 1,
+ };
+
+ enum {
+- MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_SPLIT = 0,
+- MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_PACKED = 1,
++ MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_SPLIT =
++ BIT(MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_SPLIT),
++ MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_PACKED =
++ BIT(MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_PACKED),
+ };
+
+ struct mlx5_ifc_virtio_q_bits {
+--
+2.30.2
+
--- /dev/null
+From d1f880a21b0c5f56d5382efb872b258510cff1bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 16:00:23 +0800
+Subject: vdpa_sim: Fix return value check for vdpa_alloc_device()
+
+From: Xie Yongji <xieyongji@bytedance.com>
+
+[ Upstream commit 2b847f21145d84e2e1dde99d3e2c00a5468f02e4 ]
+
+The vdpa_alloc_device() returns an error pointer upon
+failure, not NULL. To handle the failure correctly, this
+replaces NULL check with IS_ERR() check and propagate the
+error upwards.
+
+Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
+Link: https://lore.kernel.org/r/20210715080026.242-1-xieyongji@bytedance.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/vdpa_sim/vdpa_sim.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c
+index 98f793bc9376..26337ba42445 100644
+--- a/drivers/vdpa/vdpa_sim/vdpa_sim.c
++++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c
+@@ -251,8 +251,10 @@ struct vdpasim *vdpasim_create(struct vdpasim_dev_attr *dev_attr)
+
+ vdpasim = vdpa_alloc_device(struct vdpasim, vdpa, NULL, ops,
+ dev_attr->name);
+- if (!vdpasim)
++ if (IS_ERR(vdpasim)) {
++ ret = PTR_ERR(vdpasim);
+ goto err_alloc;
++ }
+
+ vdpasim->dev_attr = *dev_attr;
+ INIT_WORK(&vdpasim->work, dev_attr->work_fn);
+--
+2.30.2
+
--- /dev/null
+From 7bae92a95ccc44bc165ffb07e6292938dfe05cc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 21:07:56 +0800
+Subject: vhost: Fix the calculation in vhost_overflow()
+
+From: Xie Yongji <xieyongji@bytedance.com>
+
+[ Upstream commit f7ad318ea0ad58ebe0e595e59aed270bb643b29b ]
+
+This fixes the incorrect calculation for integer overflow
+when the last address of iova range is 0xffffffff.
+
+Fixes: ec33d031a14b ("vhost: detect 32 bit integer wrap around")
+Reported-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://lore.kernel.org/r/20210728130756.97-2-xieyongji@bytedance.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vhost.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 5ccb0705beae..f41463ab4031 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -735,10 +735,16 @@ static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz)
+ (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8);
+ }
+
++/* Make sure 64 bit math will not overflow. */
+ static bool vhost_overflow(u64 uaddr, u64 size)
+ {
+- /* Make sure 64 bit math will not overflow. */
+- return uaddr > ULONG_MAX || size > ULONG_MAX || uaddr > ULONG_MAX - size;
++ if (uaddr > ULONG_MAX || size > ULONG_MAX)
++ return true;
++
++ if (!size)
++ return false;
++
++ return uaddr > ULONG_MAX - size + 1;
+ }
+
+ /* Caller should have vq mutex and device mutex. */
+--
+2.30.2
+
--- /dev/null
+From 16b3e848bebd3560a27fb1a9b857d4e9b0c975cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 21:07:55 +0800
+Subject: vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update()
+
+From: Xie Yongji <xieyongji@bytedance.com>
+
+[ Upstream commit 0e398290cff997610b66e73573faaee70c9a700e ]
+
+The "msg->iova + msg->size" addition can have an integer overflow
+if the iotlb message is from a malicious user space application.
+So let's fix it.
+
+Fixes: 1b48dc03e575 ("vhost: vdpa: report iova range")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://lore.kernel.org/r/20210728130756.97-1-xieyongji@bytedance.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vdpa.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
+index fb41db3da611..b5201bedf93f 100644
+--- a/drivers/vhost/vdpa.c
++++ b/drivers/vhost/vdpa.c
+@@ -614,7 +614,8 @@ static int vhost_vdpa_process_iotlb_update(struct vhost_vdpa *v,
+ long pinned;
+ int ret = 0;
+
+- if (msg->iova < v->range.first ||
++ if (msg->iova < v->range.first || !msg->size ||
++ msg->iova > U64_MAX - msg->size + 1 ||
+ msg->iova + msg->size - 1 > v->range.last)
+ return -EINVAL;
+
+--
+2.30.2
+
--- /dev/null
+From 4dea7f1023c5d26885ea71d36f46aaddcd939598 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 16:06:59 +0800
+Subject: virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO
+
+From: Jason Wang <jasowang@redhat.com>
+
+[ Upstream commit dbcf24d153884439dad30484a0e3f02350692e4c ]
+
+Commit a02e8964eaf92 ("virtio-net: ethtool configurable LRO")
+maps LRO to virtio guest offloading features and allows the
+administrator to enable and disable those features via ethtool.
+
+This leads to several issues:
+
+- For a device that doesn't support control guest offloads, the "LRO"
+ can't be disabled triggering WARN in dev_disable_lro() when turning
+ off LRO or when enabling forwarding bridging etc.
+
+- For a device that supports control guest offloads, the guest
+ offloads are disabled in cases of bridging, forwarding etc slowing
+ down the traffic.
+
+Fix this by using NETIF_F_GRO_HW instead. Though the spec does not
+guarantee packets to be re-segmented as the original ones,
+we can add that to the spec, possibly with a flag for devices to
+differentiate between GRO and LRO.
+
+Further, we never advertised LRO historically before a02e8964eaf92
+("virtio-net: ethtool configurable LRO") and so bridged/forwarded
+configs effectively always relied on virtio receive offloads behaving
+like GRO - thus even if this breaks any configs it is at least not
+a regression.
+
+Fixes: a02e8964eaf92 ("virtio-net: ethtool configurable LRO")
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Reported-by: Ivan <ivan@prestigetransportation.com>
+Tested-by: Ivan <ivan@prestigetransportation.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 6af227964413..d397dc6b0ebf 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -63,7 +63,7 @@ static const unsigned long guest_offloads[] = {
+ VIRTIO_NET_F_GUEST_CSUM
+ };
+
+-#define GUEST_OFFLOAD_LRO_MASK ((1ULL << VIRTIO_NET_F_GUEST_TSO4) | \
++#define GUEST_OFFLOAD_GRO_HW_MASK ((1ULL << VIRTIO_NET_F_GUEST_TSO4) | \
+ (1ULL << VIRTIO_NET_F_GUEST_TSO6) | \
+ (1ULL << VIRTIO_NET_F_GUEST_ECN) | \
+ (1ULL << VIRTIO_NET_F_GUEST_UFO))
+@@ -2490,7 +2490,7 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
+ virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_ECN) ||
+ virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO) ||
+ virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))) {
+- NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO/CSUM, disable LRO/CSUM first");
++ NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing GRO_HW/CSUM, disable GRO_HW/CSUM first");
+ return -EOPNOTSUPP;
+ }
+
+@@ -2621,15 +2621,15 @@ static int virtnet_set_features(struct net_device *dev,
+ u64 offloads;
+ int err;
+
+- if ((dev->features ^ features) & NETIF_F_LRO) {
++ if ((dev->features ^ features) & NETIF_F_GRO_HW) {
+ if (vi->xdp_enabled)
+ return -EBUSY;
+
+- if (features & NETIF_F_LRO)
++ if (features & NETIF_F_GRO_HW)
+ offloads = vi->guest_offloads_capable;
+ else
+ offloads = vi->guest_offloads_capable &
+- ~GUEST_OFFLOAD_LRO_MASK;
++ ~GUEST_OFFLOAD_GRO_HW_MASK;
+
+ err = virtnet_set_guest_offloads(vi, offloads);
+ if (err)
+@@ -3109,9 +3109,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ dev->features |= NETIF_F_RXCSUM;
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
+ virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6))
+- dev->features |= NETIF_F_LRO;
++ dev->features |= NETIF_F_GRO_HW;
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_GUEST_OFFLOADS))
+- dev->hw_features |= NETIF_F_LRO;
++ dev->hw_features |= NETIF_F_GRO_HW;
+
+ dev->vlan_features = dev->features;
+
+--
+2.30.2
+
--- /dev/null
+From aefa1dd04e13c813eaeb800bfcb475b07ccd85a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 17:26:47 +0300
+Subject: virtio: Protect vqs list access
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 0e566c8f0f2e8325e35f6f97e13cde5356b41814 ]
+
+VQs may be accessed to mark the device broken while they are
+created/destroyed. Hence protect the access to the vqs list.
+
+Fixes: e2dcdfe95c0b ("virtio: virtio_break_device() to mark all virtqueues broken.")
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Link: https://lore.kernel.org/r/20210721142648.1525924-4-parav@nvidia.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio.c | 1 +
+ drivers/virtio/virtio_ring.c | 8 ++++++++
+ include/linux/virtio.h | 1 +
+ 3 files changed, 10 insertions(+)
+
+diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
+index 4b15c00c0a0a..49984d2cba24 100644
+--- a/drivers/virtio/virtio.c
++++ b/drivers/virtio/virtio.c
+@@ -355,6 +355,7 @@ int register_virtio_device(struct virtio_device *dev)
+ virtio_add_status(dev, VIRTIO_CONFIG_S_ACKNOWLEDGE);
+
+ INIT_LIST_HEAD(&dev->vqs);
++ spin_lock_init(&dev->vqs_list_lock);
+
+ /*
+ * device_add() causes the bus infrastructure to look for a matching
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 71e16b53e9c1..6b7aa26c5384 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -1668,7 +1668,9 @@ static struct virtqueue *vring_create_virtqueue_packed(
+ cpu_to_le16(vq->packed.event_flags_shadow);
+ }
+
++ spin_lock(&vdev->vqs_list_lock);
+ list_add_tail(&vq->vq.list, &vdev->vqs);
++ spin_unlock(&vdev->vqs_list_lock);
+ return &vq->vq;
+
+ err_desc_extra:
+@@ -2126,7 +2128,9 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
+ memset(vq->split.desc_state, 0, vring.num *
+ sizeof(struct vring_desc_state_split));
+
++ spin_lock(&vdev->vqs_list_lock);
+ list_add_tail(&vq->vq.list, &vdev->vqs);
++ spin_unlock(&vdev->vqs_list_lock);
+ return &vq->vq;
+ }
+ EXPORT_SYMBOL_GPL(__vring_new_virtqueue);
+@@ -2210,7 +2214,9 @@ void vring_del_virtqueue(struct virtqueue *_vq)
+ }
+ if (!vq->packed_ring)
+ kfree(vq->split.desc_state);
++ spin_lock(&vq->vq.vdev->vqs_list_lock);
+ list_del(&_vq->list);
++ spin_unlock(&vq->vq.vdev->vqs_list_lock);
+ kfree(vq);
+ }
+ EXPORT_SYMBOL_GPL(vring_del_virtqueue);
+@@ -2274,10 +2280,12 @@ void virtio_break_device(struct virtio_device *dev)
+ {
+ struct virtqueue *_vq;
+
++ spin_lock(&dev->vqs_list_lock);
+ list_for_each_entry(_vq, &dev->vqs, list) {
+ struct vring_virtqueue *vq = to_vvq(_vq);
+ vq->broken = true;
+ }
++ spin_unlock(&dev->vqs_list_lock);
+ }
+ EXPORT_SYMBOL_GPL(virtio_break_device);
+
+diff --git a/include/linux/virtio.h b/include/linux/virtio.h
+index b1894e0323fa..41edbc01ffa4 100644
+--- a/include/linux/virtio.h
++++ b/include/linux/virtio.h
+@@ -110,6 +110,7 @@ struct virtio_device {
+ bool config_enabled;
+ bool config_change_pending;
+ spinlock_t config_lock;
++ spinlock_t vqs_list_lock; /* Protects VQs list access */
+ struct device dev;
+ struct virtio_device_id id;
+ const struct virtio_config_ops *config;
+--
+2.30.2
+
--- /dev/null
+From f05c1d7b03cd14215f64ae66cc6b86621ef80e77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 16:00:24 +0800
+Subject: vp_vdpa: Fix return value check for vdpa_alloc_device()
+
+From: Xie Yongji <xieyongji@bytedance.com>
+
+[ Upstream commit 9632e78e82648aa98340df78eab9106f63da151e ]
+
+The vdpa_alloc_device() returns an error pointer upon
+failure, not NULL. To handle the failure correctly, this
+replaces NULL check with IS_ERR() check and propagate the
+error upwards.
+
+Fixes: 64b9f64f80a6 ("vdpa: introduce virtio pci driver")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
+Link: https://lore.kernel.org/r/20210715080026.242-2-xieyongji@bytedance.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/virtio_pci/vp_vdpa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vdpa/virtio_pci/vp_vdpa.c b/drivers/vdpa/virtio_pci/vp_vdpa.c
+index 9145e0624565..54b313e4e63f 100644
+--- a/drivers/vdpa/virtio_pci/vp_vdpa.c
++++ b/drivers/vdpa/virtio_pci/vp_vdpa.c
+@@ -400,9 +400,9 @@ static int vp_vdpa_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ vp_vdpa = vdpa_alloc_device(struct vp_vdpa, vdpa,
+ dev, &vp_vdpa_ops, NULL);
+- if (vp_vdpa == NULL) {
++ if (IS_ERR(vp_vdpa)) {
+ dev_err(dev, "vp_vdpa: Failed to allocate vDPA structure\n");
+- return -ENOMEM;
++ return PTR_ERR(vp_vdpa);
+ }
+
+ mdev = &vp_vdpa->mdev;
+--
+2.30.2
+
--- /dev/null
+From d44c5d718c19b7c54d52d7da93e882758088d7a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Aug 2021 12:00:02 +0000
+Subject: vrf: Reset skb conntrack connection on VRF rcv
+
+From: Lahav Schlesinger <lschlesinger@drivenets.com>
+
+[ Upstream commit 09e856d54bda5f288ef8437a90ab2b9b3eab83d1 ]
+
+To fix the "reverse-NAT" for replies.
+
+When a packet is sent over a VRF, the POST_ROUTING hooks are called
+twice: Once from the VRF interface, and once from the "actual"
+interface the packet will be sent from:
+1) First SNAT: l3mdev_l3_out() -> vrf_l3_out() -> .. -> vrf_output_direct()
+ This causes the POST_ROUTING hooks to run.
+2) Second SNAT: 'ip_output()' calls POST_ROUTING hooks again.
+
+Similarly for replies, first ip_rcv() calls PRE_ROUTING hooks, and
+second vrf_l3_rcv() calls them again.
+
+As an example, consider the following SNAT rule:
+> iptables -t nat -A POSTROUTING -p udp -m udp --dport 53 -j SNAT --to-source 2.2.2.2 -o vrf_1
+
+In this case sending over a VRF will create 2 conntrack entries.
+The first is from the VRF interface, which performs the IP SNAT.
+The second will run the SNAT, but since the "expected reply" will remain
+the same, conntrack randomizes the source port of the packet:
+e..g With a socket bound to 1.1.1.1:10000, sending to 3.3.3.3:53, the conntrack
+rules are:
+udp 17 29 src=2.2.2.2 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 [UNREPLIED] src=3.3.3.3 dst=2.2.2.2 sport=53 dport=61033 packets=0 bytes=0 mark=0 use=1
+udp 17 29 src=1.1.1.1 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 [UNREPLIED] src=3.3.3.3 dst=2.2.2.2 sport=53 dport=10000 packets=0 bytes=0 mark=0 use=1
+
+i.e. First SNAT IP from 1.1.1.1 --> 2.2.2.2, and second the src port is
+SNAT-ed from 10000 --> 61033.
+
+But when a reply is sent (3.3.3.3:53 -> 2.2.2.2:61033) only the later
+conntrack entry is matched:
+udp 17 29 src=2.2.2.2 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 src=3.3.3.3 dst=2.2.2.2 sport=53 dport=61033 packets=1 bytes=49 mark=0 use=1
+udp 17 28 src=1.1.1.1 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 [UNREPLIED] src=3.3.3.3 dst=2.2.2.2 sport=53 dport=10000 packets=0 bytes=0 mark=0 use=1
+
+And a "port 61033 unreachable" ICMP packet is sent back.
+
+The issue is that when PRE_ROUTING hooks are called from vrf_l3_rcv(),
+the skb already has a conntrack flow attached to it, which means
+nf_conntrack_in() will not resolve the flow again.
+
+This means only the dest port is "reverse-NATed" (61033 -> 10000) but
+the dest IP remains 2.2.2.2, and since the socket is bound to 1.1.1.1 it's
+not received.
+This can be verified by logging the 4-tuple of the packet in '__udp4_lib_rcv()'.
+
+The fix is then to reset the flow when skb is received on a VRF, to let
+conntrack resolve the flow again (which now will hit the earlier flow).
+
+To reproduce: (Without the fix "Got pkt_to_nat_port" will not be printed by
+ running 'bash ./repro'):
+ $ cat run_in_A1.py
+ import logging
+ logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
+ from scapy.all import *
+ import argparse
+
+ def get_packet_to_send(udp_dst_port, msg_name):
+ return Ether(src='11:22:33:44:55:66', dst=iface_mac)/ \
+ IP(src='3.3.3.3', dst='2.2.2.2')/ \
+ UDP(sport=53, dport=udp_dst_port)/ \
+ Raw(f'{msg_name}\x0012345678901234567890')
+
+ parser = argparse.ArgumentParser()
+ parser.add_argument('-iface_mac', dest="iface_mac", type=str, required=True,
+ help="From run_in_A3.py")
+ parser.add_argument('-socket_port', dest="socket_port", type=str,
+ required=True, help="From run_in_A3.py")
+ parser.add_argument('-v1_mac', dest="v1_mac", type=str, required=True,
+ help="From script")
+
+ args, _ = parser.parse_known_args()
+ iface_mac = args.iface_mac
+ socket_port = int(args.socket_port)
+ v1_mac = args.v1_mac
+
+ print(f'Source port before NAT: {socket_port}')
+
+ while True:
+ pkts = sniff(iface='_v0', store=True, count=1, timeout=10)
+ if 0 == len(pkts):
+ print('Something failed, rerun the script :(', flush=True)
+ break
+ pkt = pkts[0]
+ if not pkt.haslayer('UDP'):
+ continue
+
+ pkt_sport = pkt.getlayer('UDP').sport
+ print(f'Source port after NAT: {pkt_sport}', flush=True)
+
+ pkt_to_send = get_packet_to_send(pkt_sport, 'pkt_to_nat_port')
+ sendp(pkt_to_send, '_v0', verbose=False) # Will not be received
+
+ pkt_to_send = get_packet_to_send(socket_port, 'pkt_to_socket_port')
+ sendp(pkt_to_send, '_v0', verbose=False)
+ break
+
+ $ cat run_in_A2.py
+ import socket
+ import netifaces
+
+ print(f"{netifaces.ifaddresses('e00000')[netifaces.AF_LINK][0]['addr']}",
+ flush=True)
+ s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+ s.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE,
+ str('vrf_1' + '\0').encode('utf-8'))
+ s.connect(('3.3.3.3', 53))
+ print(f'{s. getsockname()[1]}', flush=True)
+ s.settimeout(5)
+
+ while True:
+ try:
+ # Periodically send in order to keep the conntrack entry alive.
+ s.send(b'a'*40)
+ resp = s.recvfrom(1024)
+ msg_name = resp[0].decode('utf-8').split('\0')[0]
+ print(f"Got {msg_name}", flush=True)
+ except Exception as e:
+ pass
+
+ $ cat repro.sh
+ ip netns del A1 2> /dev/null
+ ip netns del A2 2> /dev/null
+ ip netns add A1
+ ip netns add A2
+
+ ip -n A1 link add _v0 type veth peer name _v1 netns A2
+ ip -n A1 link set _v0 up
+
+ ip -n A2 link add e00000 type bond
+ ip -n A2 link add lo0 type dummy
+ ip -n A2 link add vrf_1 type vrf table 10001
+ ip -n A2 link set vrf_1 up
+ ip -n A2 link set e00000 master vrf_1
+
+ ip -n A2 addr add 1.1.1.1/24 dev e00000
+ ip -n A2 link set e00000 up
+ ip -n A2 link set _v1 master e00000
+ ip -n A2 link set _v1 up
+ ip -n A2 link set lo0 up
+ ip -n A2 addr add 2.2.2.2/32 dev lo0
+
+ ip -n A2 neigh add 1.1.1.10 lladdr 77:77:77:77:77:77 dev e00000
+ ip -n A2 route add 3.3.3.3/32 via 1.1.1.10 dev e00000 table 10001
+
+ ip netns exec A2 iptables -t nat -A POSTROUTING -p udp -m udp --dport 53 -j \
+ SNAT --to-source 2.2.2.2 -o vrf_1
+
+ sleep 5
+ ip netns exec A2 python3 run_in_A2.py > x &
+ XPID=$!
+ sleep 5
+
+ IFACE_MAC=`sed -n 1p x`
+ SOCKET_PORT=`sed -n 2p x`
+ V1_MAC=`ip -n A2 link show _v1 | sed -n 2p | awk '{print $2'}`
+ ip netns exec A1 python3 run_in_A1.py -iface_mac ${IFACE_MAC} -socket_port \
+ ${SOCKET_PORT} -v1_mac ${SOCKET_PORT}
+ sleep 5
+
+ kill -9 $XPID
+ wait $XPID 2> /dev/null
+ ip netns del A1
+ ip netns del A2
+ tail x -n 2
+ rm x
+ set +x
+
+Fixes: 73e20b761acf ("net: vrf: Add support for PREROUTING rules on vrf device")
+Signed-off-by: Lahav Schlesinger <lschlesinger@drivenets.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/20210815120002.2787653-1-lschlesinger@drivenets.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vrf.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
+index 414afcb0a23f..b1c451d10a5d 100644
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -1367,6 +1367,8 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
+ bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
+ bool is_ndisc = ipv6_ndisc_frame(skb);
+
++ nf_reset_ct(skb);
++
+ /* loopback, multicast & non-ND link-local traffic; do not push through
+ * packet taps again. Reset pkt_type for upper layers to process skb.
+ * For strict packets with a source LLA, determine the dst using the
+@@ -1429,6 +1431,8 @@ static struct sk_buff *vrf_ip_rcv(struct net_device *vrf_dev,
+ skb->skb_iif = vrf_dev->ifindex;
+ IPCB(skb)->flags |= IPSKB_L3SLAVE;
+
++ nf_reset_ct(skb);
++
+ if (ipv4_is_multicast(ip_hdr(skb)->daddr))
+ goto out;
+
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
