--- /dev/null
+From b51f0275a2370225ee26ba9885d0a7d8826a8360 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 08:39:12 +0530
+Subject: amd-xgbe: Update DMA coherency values
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit d75135082698140a26a56defe1bbc1b06f26a41f ]
+
+Based on the IOMMU configuration, the current cache control settings can
+result in possible coherency issues. The hardware team has recommended
+new settings for the PCI device path to eliminate the issue.
+
+Fixes: 6f595959c095 ("amd-xgbe: Adjust register settings to improve performance")
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
+index ba8321ec1ee7..3305979a9f7c 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
+@@ -180,9 +180,9 @@
+ #define XGBE_DMA_SYS_AWCR 0x30303030
+
+ /* DMA cache settings - PCI device */
+-#define XGBE_DMA_PCI_ARCR 0x00000003
+-#define XGBE_DMA_PCI_AWCR 0x13131313
+-#define XGBE_DMA_PCI_AWARCR 0x00000313
++#define XGBE_DMA_PCI_ARCR 0x000f0f0f
++#define XGBE_DMA_PCI_AWCR 0x0f0f0f0f
++#define XGBE_DMA_PCI_AWARCR 0x00000f0f
+
+ /* DMA channel interrupt modes */
+ #define XGBE_IRQ_MODE_EDGE 0
+--
+2.30.2
+
--- /dev/null
+From a6f99423d4baa82d13969e20c9702097e7e2290b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 15:01:03 +0200
+Subject: ARM: dts: imx6: pbab01: Set vmmc supply for both SD interfaces
+
+From: Stefan Riedmueller <s.riedmueller@phytec.de>
+
+[ Upstream commit f57011e72f5fe0421ec7a812beb1b57bdf4bb47f ]
+
+Setting the vmmc supplies is crucial since otherwise the supplying
+regulators get disabled and the SD interfaces are no longer powered
+which leads to system failures if the system is booted from that SD
+interface.
+
+Fixes: 1e44d3f880d5 ("ARM i.MX6Q: dts: Enable I2C1 with EEPROM and PMIC on Phytec phyFLEX-i.MX6 Ouad module")
+Signed-off-by: Stefan Riedmueller <s.riedmueller@phytec.de>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+index 7a1e53195785..f28a96fcf23e 100644
+--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+@@ -433,6 +433,7 @@
+ pinctrl-0 = <&pinctrl_usdhc2>;
+ cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+ wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
++ vmmc-supply = <&vdd_sd1_reg>;
+ status = "disabled";
+ };
+
+@@ -442,5 +443,6 @@
+ &pinctrl_usdhc3_cdwp>;
+ cd-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
+ wp-gpios = <&gpio1 29 GPIO_ACTIVE_HIGH>;
++ vmmc-supply = <&vdd_sd0_reg>;
+ status = "disabled";
+ };
+--
+2.30.2
+
--- /dev/null
+From bcb5e7c19d9de32fe36621f7dcbd57086612daaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Feb 2021 15:30:38 +0000
+Subject: ARM: dts: turris-omnia: fix hardware buffer management
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rui Salvaterra <rsalvaterra@gmail.com>
+
+[ Upstream commit 5b2c7e0ae762fff2b172caf16b2766cc3e1ad859 ]
+
+Hardware buffer management has never worked on the Turris Omnia, as the
+required MBus window hadn't been reserved. Fix thusly.
+
+Fixes: 018b88eee1a2 ("ARM: dts: turris-omnia: enable HW buffer management")
+
+Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
+Reviewed-by: Marek Behún <kabel@kernel.org>
+Tested-by: Klaus Kudielka <klaus.kudielka@gmail.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/armada-385-turris-omnia.dts | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/armada-385-turris-omnia.dts b/arch/arm/boot/dts/armada-385-turris-omnia.dts
+index b0f3fd8e1429..5bd6a66d2c2b 100644
+--- a/arch/arm/boot/dts/armada-385-turris-omnia.dts
++++ b/arch/arm/boot/dts/armada-385-turris-omnia.dts
+@@ -32,7 +32,8 @@
+ ranges = <MBUS_ID(0xf0, 0x01) 0 0xf1000000 0x100000
+ MBUS_ID(0x01, 0x1d) 0 0xfff00000 0x100000
+ MBUS_ID(0x09, 0x19) 0 0xf1100000 0x10000
+- MBUS_ID(0x09, 0x15) 0 0xf1110000 0x10000>;
++ MBUS_ID(0x09, 0x15) 0 0xf1110000 0x10000
++ MBUS_ID(0x0c, 0x04) 0 0xf1200000 0x100000>;
+
+ internal-regs {
+
+--
+2.30.2
+
--- /dev/null
+From ad332a08b2e711a490b60091185f06f83fea4011 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Mar 2021 18:41:01 +0200
+Subject: ARM: OMAP4: Fix PMIC voltage domains for bionic
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 30916faa1a6009122e10d0c42338b8db44a36fde ]
+
+We are now registering the mpu domain three times instead of registering
+mpu, core and iva domains like we should.
+
+Fixes: d44fa156dcb2 ("ARM: OMAP2+: Configure voltage controller for cpcap")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/pmic-cpcap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-omap2/pmic-cpcap.c b/arch/arm/mach-omap2/pmic-cpcap.c
+index 09076ad0576d..668dc84fd31e 100644
+--- a/arch/arm/mach-omap2/pmic-cpcap.c
++++ b/arch/arm/mach-omap2/pmic-cpcap.c
+@@ -246,10 +246,10 @@ int __init omap4_cpcap_init(void)
+ omap_voltage_register_pmic(voltdm, &omap443x_max8952_mpu);
+
+ if (of_machine_is_compatible("motorola,droid-bionic")) {
+- voltdm = voltdm_lookup("mpu");
++ voltdm = voltdm_lookup("core");
+ omap_voltage_register_pmic(voltdm, &omap_cpcap_core);
+
+- voltdm = voltdm_lookup("mpu");
++ voltdm = voltdm_lookup("iva");
+ omap_voltage_register_pmic(voltdm, &omap_cpcap_iva);
+ } else {
+ voltdm = voltdm_lookup("core");
+--
+2.30.2
+
--- /dev/null
+From 1955ae13b7aae10e09750f2a5c68ceb6d2d20aab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Mar 2021 18:35:44 +0200
+Subject: ARM: OMAP4: PM: update ROM return address for OSWR and OFF
+
+From: Carlos Leija <cileija@ti.com>
+
+[ Upstream commit b3d09a06d89f474cb52664e016849315a97e09d9 ]
+
+We need to add a dummy smc call to the cpuidle wakeup path to force the
+ROM code to save the return address after MMU is enabled again. This is
+needed to prevent random hangs on secure devices like droid4.
+
+Otherwise the system will eventually hang when entering deeper SoC idle
+states with the core and mpu domains in open-switch retention (OSWR).
+The hang happens as the ROM code tries to use the earlier physical return
+address set by omap-headsmp.S with MMU off while waking up CPU1 again.
+
+The hangs started happening in theory already with commit caf8c87d7ff2
+("ARM: OMAP2+: Allow core oswr for omap4"), but in practise the issue went
+unnoticed as various drivers were often blocking any deeper idle states
+with hardware autoidle features.
+
+This patch is based on an earlier TI Linux kernel tree commit 92f0b3028d9e
+("OMAP4: PM: update ROM return address for OSWR and OFF") written by
+Carlos Leija <cileija@ti.com>, Praneeth Bajjuri <praneeth@ti.com>, and
+Bryan Buckley <bryan.buckley@ti.com>. A later version of the patch was
+updated to use CPU_PM notifiers by Tero Kristo <t-kristo@ti.com>.
+
+Signed-off-by: Carlos Leija <cileija@ti.com>
+Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>
+Signed-off-by: Bryan Buckley <bryan.buckley@ti.com>
+Signed-off-by: Tero Kristo <t-kristo@ti.com>
+Fixes: caf8c87d7ff2 ("ARM: OMAP2+: Allow core oswr for omap4")
+Reported-by: Carl Philipp Klemm <philipp@uvos.xyz>
+Reported-by: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Ivan Jelincic <parazyd@dyne.org>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Sebastian Reichel <sre@kernel.org>
+Cc: Tero Kristo <kristo@kernel.org>
+[tony@atomide.com: updated to apply, updated description]
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/omap-secure.c | 39 +++++++++++++++++++++++++++++++
+ arch/arm/mach-omap2/omap-secure.h | 1 +
+ 2 files changed, 40 insertions(+)
+
+diff --git a/arch/arm/mach-omap2/omap-secure.c b/arch/arm/mach-omap2/omap-secure.c
+index f70d561f37f7..0659ab4cb0af 100644
+--- a/arch/arm/mach-omap2/omap-secure.c
++++ b/arch/arm/mach-omap2/omap-secure.c
+@@ -9,6 +9,7 @@
+ */
+
+ #include <linux/arm-smccc.h>
++#include <linux/cpu_pm.h>
+ #include <linux/kernel.h>
+ #include <linux/init.h>
+ #include <linux/io.h>
+@@ -20,6 +21,7 @@
+
+ #include "common.h"
+ #include "omap-secure.h"
++#include "soc.h"
+
+ static phys_addr_t omap_secure_memblock_base;
+
+@@ -213,3 +215,40 @@ void __init omap_secure_init(void)
+ {
+ omap_optee_init_check();
+ }
++
++/*
++ * Dummy dispatcher call after core OSWR and MPU off. Updates the ROM return
++ * address after MMU has been re-enabled after CPU1 has been woken up again.
++ * Otherwise the ROM code will attempt to use the earlier physical return
++ * address that got set with MMU off when waking up CPU1. Only used on secure
++ * devices.
++ */
++static int cpu_notifier(struct notifier_block *nb, unsigned long cmd, void *v)
++{
++ switch (cmd) {
++ case CPU_CLUSTER_PM_EXIT:
++ omap_secure_dispatcher(OMAP4_PPA_SERVICE_0,
++ FLAG_START_CRITICAL,
++ 0, 0, 0, 0, 0);
++ break;
++ default:
++ break;
++ }
++
++ return NOTIFY_OK;
++}
++
++static struct notifier_block secure_notifier_block = {
++ .notifier_call = cpu_notifier,
++};
++
++static int __init secure_pm_init(void)
++{
++ if (omap_type() == OMAP2_DEVICE_TYPE_GP || !soc_is_omap44xx())
++ return 0;
++
++ cpu_pm_register_notifier(&secure_notifier_block);
++
++ return 0;
++}
++omap_arch_initcall(secure_pm_init);
+diff --git a/arch/arm/mach-omap2/omap-secure.h b/arch/arm/mach-omap2/omap-secure.h
+index 4aaa95706d39..172069f31616 100644
+--- a/arch/arm/mach-omap2/omap-secure.h
++++ b/arch/arm/mach-omap2/omap-secure.h
+@@ -50,6 +50,7 @@
+ #define OMAP5_DRA7_MON_SET_ACR_INDEX 0x107
+
+ /* Secure PPA(Primary Protected Application) APIs */
++#define OMAP4_PPA_SERVICE_0 0x21
+ #define OMAP4_PPA_L2_POR_INDEX 0x23
+ #define OMAP4_PPA_CPU_ACTRL_SMP_INDEX 0x25
+
+--
+2.30.2
+
--- /dev/null
+From c47b5516e121320189d072448d1ec8987ab27965 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 14:28:41 +0100
+Subject: arm64: dts: imx8mm/q: Fix pad control of SD1_DATA0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Oliver Stäbler <oliver.staebler@bytesatwork.ch>
+
+[ Upstream commit 5cfad4f45806f6f898b63b8c77cea7452c704cb3 ]
+
+Fix address of the pad control register
+(IOMUXC_SW_PAD_CTL_PAD_SD1_DATA0) for SD1_DATA0_GPIO2_IO2. This seems
+to be a typo but it leads to an exception when pinctrl is applied due to
+wrong memory address access.
+
+Signed-off-by: Oliver Stäbler <oliver.staebler@bytesatwork.ch>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Fixes: c1c9d41319c3 ("dt-bindings: imx: Add pinctrl binding doc for imx8mm")
+Fixes: 748f908cc882 ("arm64: add basic DTS for i.MX8MQ")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h | 2 +-
+ arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h
+index 5ccc4cc91959..a003e6af3353 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h
++++ b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h
+@@ -124,7 +124,7 @@
+ #define MX8MM_IOMUXC_SD1_CMD_USDHC1_CMD 0x0A4 0x30C 0x000 0x0 0x0
+ #define MX8MM_IOMUXC_SD1_CMD_GPIO2_IO1 0x0A4 0x30C 0x000 0x5 0x0
+ #define MX8MM_IOMUXC_SD1_DATA0_USDHC1_DATA0 0x0A8 0x310 0x000 0x0 0x0
+-#define MX8MM_IOMUXC_SD1_DATA0_GPIO2_IO2 0x0A8 0x31 0x000 0x5 0x0
++#define MX8MM_IOMUXC_SD1_DATA0_GPIO2_IO2 0x0A8 0x310 0x000 0x5 0x0
+ #define MX8MM_IOMUXC_SD1_DATA1_USDHC1_DATA1 0x0AC 0x314 0x000 0x0 0x0
+ #define MX8MM_IOMUXC_SD1_DATA1_GPIO2_IO3 0x0AC 0x314 0x000 0x5 0x0
+ #define MX8MM_IOMUXC_SD1_DATA2_USDHC1_DATA2 0x0B0 0x318 0x000 0x0 0x0
+diff --git a/arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h b/arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h
+index b94b02080a34..68e8fa172974 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h
++++ b/arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h
+@@ -130,7 +130,7 @@
+ #define MX8MQ_IOMUXC_SD1_CMD_USDHC1_CMD 0x0A4 0x30C 0x000 0x0 0x0
+ #define MX8MQ_IOMUXC_SD1_CMD_GPIO2_IO1 0x0A4 0x30C 0x000 0x5 0x0
+ #define MX8MQ_IOMUXC_SD1_DATA0_USDHC1_DATA0 0x0A8 0x310 0x000 0x0 0x0
+-#define MX8MQ_IOMUXC_SD1_DATA0_GPIO2_IO2 0x0A8 0x31 0x000 0x5 0x0
++#define MX8MQ_IOMUXC_SD1_DATA0_GPIO2_IO2 0x0A8 0x310 0x000 0x5 0x0
+ #define MX8MQ_IOMUXC_SD1_DATA1_USDHC1_DATA1 0x0AC 0x314 0x000 0x0 0x0
+ #define MX8MQ_IOMUXC_SD1_DATA1_GPIO2_IO3 0x0AC 0x314 0x000 0x5 0x0
+ #define MX8MQ_IOMUXC_SD1_DATA2_USDHC1_DATA2 0x0B0 0x318 0x000 0x0 0x0
+--
+2.30.2
+
--- /dev/null
+From 444e0d07488e81db5d899814d0ed72ca7518301f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Mar 2021 11:37:21 -0500
+Subject: ASoC: SOF: Intel: HDA: fix core status verification
+
+From: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+
+[ Upstream commit 927280909fa7d8e61596800d82f18047c6cfbbe4 ]
+
+When checking for enabled cores it isn't enough to check that
+some of the requested cores are running, we have to check that
+all of them are.
+
+Fixes: 747503b1813a ("ASoC: SOF: Intel: Add Intel specific HDA DSP HW operations")
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210322163728.16616-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-dsp.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda-dsp.c b/sound/soc/sof/intel/hda-dsp.c
+index 012bac41fee0..ea8e7ad8684d 100644
+--- a/sound/soc/sof/intel/hda-dsp.c
++++ b/sound/soc/sof/intel/hda-dsp.c
+@@ -226,10 +226,17 @@ bool hda_dsp_core_is_enabled(struct snd_sof_dev *sdev,
+
+ val = snd_sof_dsp_read(sdev, HDA_DSP_BAR, HDA_DSP_REG_ADSPCS);
+
+- is_enable = (val & HDA_DSP_ADSPCS_CPA_MASK(core_mask)) &&
+- (val & HDA_DSP_ADSPCS_SPA_MASK(core_mask)) &&
+- !(val & HDA_DSP_ADSPCS_CRST_MASK(core_mask)) &&
+- !(val & HDA_DSP_ADSPCS_CSTALL_MASK(core_mask));
++#define MASK_IS_EQUAL(v, m, field) ({ \
++ u32 _m = field(m); \
++ ((v) & _m) == _m; \
++})
++
++ is_enable = MASK_IS_EQUAL(val, core_mask, HDA_DSP_ADSPCS_CPA_MASK) &&
++ MASK_IS_EQUAL(val, core_mask, HDA_DSP_ADSPCS_SPA_MASK) &&
++ !(val & HDA_DSP_ADSPCS_CRST_MASK(core_mask)) &&
++ !(val & HDA_DSP_ADSPCS_CSTALL_MASK(core_mask));
++
++#undef MASK_IS_EQUAL
+
+ dev_dbg(sdev->dev, "DSP core(s) enabled? %d : core_mask %x\n",
+ is_enable, core_mask);
+--
+2.30.2
+
--- /dev/null
+From 09a467e0cfd5192d9814e21834c66c461785d2f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 17:18:43 +0200
+Subject: ASoC: sunxi: sun4i-codec: fill ASoC card owner
+
+From: Bastian Germann <bage@linutronix.de>
+
+[ Upstream commit 7c0d6e482062eb5c06ecccfab340abc523bdca00 ]
+
+card->owner is a required property and since commit 81033c6b584b ("ALSA:
+core: Warn on empty module") a warning is issued if it is empty. Add it.
+This fixes following warning observed on Lamobo R1:
+
+WARNING: CPU: 1 PID: 190 at sound/core/init.c:207 snd_card_new+0x430/0x480 [snd]
+Modules linked in: sun4i_codec(E+) sun4i_backend(E+) snd_soc_core(E) ...
+CPU: 1 PID: 190 Comm: systemd-udevd Tainted: G C E 5.10.0-1-armmp #1 Debian 5.10.4-1
+Hardware name: Allwinner sun7i (A20) Family
+Call trace:
+ (snd_card_new [snd])
+ (snd_soc_bind_card [snd_soc_core])
+ (snd_soc_register_card [snd_soc_core])
+ (sun4i_codec_probe [sun4i_codec])
+
+Fixes: 45fb6b6f2aa3 ("ASoC: sunxi: add support for the on-chip codec on early Allwinner SoCs")
+Related: commit 3c27ea23ffb4 ("ASoC: qcom: Set card->owner to avoid warnings")
+Related: commit ec653df2a0cb ("drm/vc4/vc4_hdmi: fill ASoC card owner")
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: alsa-devel@alsa-project.org
+Signed-off-by: Bastian Germann <bage@linutronix.de>
+Link: https://lore.kernel.org/r/20210331151843.30583-1-bage@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun4i-codec.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/soc/sunxi/sun4i-codec.c b/sound/soc/sunxi/sun4i-codec.c
+index 6c13cc84b3fb..2173991c13db 100644
+--- a/sound/soc/sunxi/sun4i-codec.c
++++ b/sound/soc/sunxi/sun4i-codec.c
+@@ -1364,6 +1364,7 @@ static struct snd_soc_card *sun4i_codec_create_card(struct device *dev)
+ return ERR_PTR(-ENOMEM);
+
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+ card->name = "sun4i-codec";
+ card->dapm_widgets = sun4i_codec_card_dapm_widgets;
+ card->num_dapm_widgets = ARRAY_SIZE(sun4i_codec_card_dapm_widgets);
+@@ -1396,6 +1397,7 @@ static struct snd_soc_card *sun6i_codec_create_card(struct device *dev)
+ return ERR_PTR(-ENOMEM);
+
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+ card->name = "A31 Audio Codec";
+ card->dapm_widgets = sun6i_codec_card_dapm_widgets;
+ card->num_dapm_widgets = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
+@@ -1449,6 +1451,7 @@ static struct snd_soc_card *sun8i_a23_codec_create_card(struct device *dev)
+ return ERR_PTR(-ENOMEM);
+
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+ card->name = "A23 Audio Codec";
+ card->dapm_widgets = sun6i_codec_card_dapm_widgets;
+ card->num_dapm_widgets = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
+@@ -1487,6 +1490,7 @@ static struct snd_soc_card *sun8i_h3_codec_create_card(struct device *dev)
+ return ERR_PTR(-ENOMEM);
+
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+ card->name = "H3 Audio Codec";
+ card->dapm_widgets = sun6i_codec_card_dapm_widgets;
+ card->num_dapm_widgets = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
+@@ -1525,6 +1529,7 @@ static struct snd_soc_card *sun8i_v3s_codec_create_card(struct device *dev)
+ return ERR_PTR(-ENOMEM);
+
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+ card->name = "V3s Audio Codec";
+ card->dapm_widgets = sun6i_codec_card_dapm_widgets;
+ card->num_dapm_widgets = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
+--
+2.30.2
+
--- /dev/null
+From 199141a7dcf7552af76ef678d64ea144eec4e3b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 18:48:46 +0800
+Subject: ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some
+ chips
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 16b82e75c15a7dbd564ea3654f3feb61df9e1e6f ]
+
+The input MCLK is 12.288MHz, the desired output sysclk is 11.2896MHz
+and sample rate is 44100Hz, with the configuration pllprescale=2,
+postscale=sysclkdiv=1, some chip may have wrong bclk
+and lrclk output with pll enabled in master mode, but with the
+configuration pllprescale=1, postscale=2, the output clock is correct.
+
+>From Datasheet, the PLL performs best when f2 is between
+90MHz and 100MHz when the desired sysclk output is 11.2896MHz
+or 12.288MHz, so sysclkdiv = 2 (f2/8) is the best choice.
+
+So search available sysclk_divs from 2 to 1 other than from 1 to 2.
+
+Fixes: 84fdc00d519f ("ASoC: codec: wm9860: Refactor PLL out freq search")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/1616150926-22892-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8960.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 660ec46eecf2..ceaf3bbb18e6 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -707,7 +707,13 @@ int wm8960_configure_pll(struct snd_soc_component *component, int freq_in,
+ best_freq_out = -EINVAL;
+ *sysclk_idx = *dac_idx = *bclk_idx = -1;
+
+- for (i = 0; i < ARRAY_SIZE(sysclk_divs); ++i) {
++ /*
++ * From Datasheet, the PLL performs best when f2 is between
++ * 90MHz and 100MHz, the desired sysclk output is 11.2896MHz
++ * or 12.288MHz, then sysclkdiv = 2 is the best choice.
++ * So search sysclk_divs from 2 to 1 other than from 1 to 2.
++ */
++ for (i = ARRAY_SIZE(sysclk_divs) - 1; i >= 0; --i) {
+ if (sysclk_divs[i] == -1)
+ continue;
+ for (j = 0; j < ARRAY_SIZE(dac_divs); ++j) {
+--
+2.30.2
+
--- /dev/null
+From c2bf6d85c008c01b9fe82988aedfe67e21ee6fbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 13:58:48 +0100
+Subject: can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+[ Upstream commit 9e9714742fb70467464359693a73b911a630226f ]
+
+Since commit f5223e9eee65 ("can: extend sockaddr_can to include j1939
+members") the sockaddr_can has been extended in size and a new
+CAN_REQUIRED_SIZE macro has been introduced to calculate the protocol
+specific needed size.
+
+The ABI for the msg_name and msg_namelen has not been adapted to the
+new CAN_REQUIRED_SIZE macro for the other CAN protocols which leads to
+a problem when an existing binary reads the (increased) struct
+sockaddr_can in msg_name.
+
+Fixes: f5223e9eee65 ("can: extend sockaddr_can to include j1939 members")
+Reported-by: Richard Weinberger <richard@nod.at>
+Tested-by: Richard Weinberger <richard@nod.at>
+Acked-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
+Link: https://lore.kernel.org/linux-can/1135648123.112255.1616613706554.JavaMail.zimbra@nod.at/T/#t
+Link: https://lore.kernel.org/r/20210325125850.1620-1-socketcan@hartkopp.net
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/bcm.c | 10 ++++++----
+ net/can/raw.c | 14 ++++++++------
+ 2 files changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 0e5c37be4a2b..909b9e684e04 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -86,6 +86,8 @@ MODULE_LICENSE("Dual BSD/GPL");
+ MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>");
+ MODULE_ALIAS("can-proto-2");
+
++#define BCM_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex)
++
+ /*
+ * easy access to the first 64 bit of can(fd)_frame payload. cp->data is
+ * 64 bit aligned so the offset has to be multiples of 8 which is ensured
+@@ -1292,7 +1294,7 @@ static int bcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+ /* no bound device as default => check msg_name */
+ DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name);
+
+- if (msg->msg_namelen < CAN_REQUIRED_SIZE(*addr, can_ifindex))
++ if (msg->msg_namelen < BCM_MIN_NAMELEN)
+ return -EINVAL;
+
+ if (addr->can_family != AF_CAN)
+@@ -1534,7 +1536,7 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
+ struct net *net = sock_net(sk);
+ int ret = 0;
+
+- if (len < CAN_REQUIRED_SIZE(*addr, can_ifindex))
++ if (len < BCM_MIN_NAMELEN)
+ return -EINVAL;
+
+ lock_sock(sk);
+@@ -1616,8 +1618,8 @@ static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ sock_recv_ts_and_drops(msg, sk, skb);
+
+ if (msg->msg_name) {
+- __sockaddr_check_size(sizeof(struct sockaddr_can));
+- msg->msg_namelen = sizeof(struct sockaddr_can);
++ __sockaddr_check_size(BCM_MIN_NAMELEN);
++ msg->msg_namelen = BCM_MIN_NAMELEN;
+ memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
+ }
+
+diff --git a/net/can/raw.c b/net/can/raw.c
+index 6ec8aa1d0da4..95113b0898b2 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -60,6 +60,8 @@ MODULE_LICENSE("Dual BSD/GPL");
+ MODULE_AUTHOR("Urs Thuermann <urs.thuermann@volkswagen.de>");
+ MODULE_ALIAS("can-proto-1");
+
++#define RAW_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex)
++
+ #define MASK_ALL 0
+
+ /* A raw socket has a list of can_filters attached to it, each receiving
+@@ -394,7 +396,7 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len)
+ int err = 0;
+ int notify_enetdown = 0;
+
+- if (len < CAN_REQUIRED_SIZE(*addr, can_ifindex))
++ if (len < RAW_MIN_NAMELEN)
+ return -EINVAL;
+ if (addr->can_family != AF_CAN)
+ return -EINVAL;
+@@ -475,11 +477,11 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
+ if (peer)
+ return -EOPNOTSUPP;
+
+- memset(addr, 0, sizeof(*addr));
++ memset(addr, 0, RAW_MIN_NAMELEN);
+ addr->can_family = AF_CAN;
+ addr->can_ifindex = ro->ifindex;
+
+- return sizeof(*addr);
++ return RAW_MIN_NAMELEN;
+ }
+
+ static int raw_setsockopt(struct socket *sock, int level, int optname,
+@@ -731,7 +733,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+ if (msg->msg_name) {
+ DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name);
+
+- if (msg->msg_namelen < CAN_REQUIRED_SIZE(*addr, can_ifindex))
++ if (msg->msg_namelen < RAW_MIN_NAMELEN)
+ return -EINVAL;
+
+ if (addr->can_family != AF_CAN)
+@@ -824,8 +826,8 @@ static int raw_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ sock_recv_ts_and_drops(msg, sk, skb);
+
+ if (msg->msg_name) {
+- __sockaddr_check_size(sizeof(struct sockaddr_can));
+- msg->msg_namelen = sizeof(struct sockaddr_can);
++ __sockaddr_check_size(RAW_MIN_NAMELEN);
++ msg->msg_namelen = RAW_MIN_NAMELEN;
+ memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From d4e5e0a608f294d6290af25f88b34dddab69d4d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 13:58:49 +0100
+Subject: can: isotp: fix msg_namelen values depending on CAN_REQUIRED_SIZE
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+[ Upstream commit f522d9559b07854c231cf8f0b8cb5a3578f8b44e ]
+
+Since commit f5223e9eee65 ("can: extend sockaddr_can to include j1939
+members") the sockaddr_can has been extended in size and a new
+CAN_REQUIRED_SIZE macro has been introduced to calculate the protocol
+specific needed size.
+
+The ABI for the msg_name and msg_namelen has not been adapted to the
+new CAN_REQUIRED_SIZE macro for the other CAN protocols which leads to
+a problem when an existing binary reads the (increased) struct
+sockaddr_can in msg_name.
+
+Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
+Reported-by: Richard Weinberger <richard@nod.at>
+Acked-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
+Link: https://lore.kernel.org/linux-can/1135648123.112255.1616613706554.JavaMail.zimbra@nod.at/T/#t
+Link: https://lore.kernel.org/r/20210325125850.1620-2-socketcan@hartkopp.net
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/isotp.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/net/can/isotp.c b/net/can/isotp.c
+index 15ea1234d457..9f94ad3caee9 100644
+--- a/net/can/isotp.c
++++ b/net/can/isotp.c
+@@ -77,6 +77,8 @@ MODULE_LICENSE("Dual BSD/GPL");
+ MODULE_AUTHOR("Oliver Hartkopp <socketcan@hartkopp.net>");
+ MODULE_ALIAS("can-proto-6");
+
++#define ISOTP_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_addr.tp)
++
+ #define SINGLE_MASK(id) (((id) & CAN_EFF_FLAG) ? \
+ (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \
+ (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG))
+@@ -986,7 +988,8 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ sock_recv_timestamp(msg, sk, skb);
+
+ if (msg->msg_name) {
+- msg->msg_namelen = sizeof(struct sockaddr_can);
++ __sockaddr_check_size(ISOTP_MIN_NAMELEN);
++ msg->msg_namelen = ISOTP_MIN_NAMELEN;
+ memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
+ }
+
+@@ -1056,7 +1059,7 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
+ int notify_enetdown = 0;
+ int do_rx_reg = 1;
+
+- if (len < CAN_REQUIRED_SIZE(struct sockaddr_can, can_addr.tp))
++ if (len < ISOTP_MIN_NAMELEN)
+ return -EINVAL;
+
+ /* do not register frame reception for functional addressing */
+@@ -1152,13 +1155,13 @@ static int isotp_getname(struct socket *sock, struct sockaddr *uaddr, int peer)
+ if (peer)
+ return -EOPNOTSUPP;
+
+- memset(addr, 0, sizeof(*addr));
++ memset(addr, 0, ISOTP_MIN_NAMELEN);
+ addr->can_family = AF_CAN;
+ addr->can_ifindex = so->ifindex;
+ addr->can_addr.tp.rx_id = so->rxid;
+ addr->can_addr.tp.tx_id = so->txid;
+
+- return sizeof(*addr);
++ return ISOTP_MIN_NAMELEN;
+ }
+
+ static int isotp_setsockopt(struct socket *sock, int level, int optname,
+--
+2.30.2
+
--- /dev/null
+From 24f5188dc0178cd4c405855250707465c6c784ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 11:46:07 +0200
+Subject: can: mcp251x: fix support for half duplex SPI host controllers
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 617085fca6375e2c1667d1fbfc6adc4034c85f04 ]
+
+Some SPI host controllers do not support full-duplex SPI transfers.
+
+The function mcp251x_spi_trans() does a full duplex transfer. It is
+used in several places in the driver, where a TX half duplex transfer
+is sufficient.
+
+To fix support for half duplex SPI host controllers, this patch
+introduces a new function mcp251x_spi_write() and changes all callers
+that do a TX half duplex transfer to use mcp251x_spi_write().
+
+Fixes: e0e25001d088 ("can: mcp251x: add support for half duplex controllers")
+Link: https://lore.kernel.org/r/20210330100246.1074375-1-mkl@pengutronix.de
+Cc: Tim Harvey <tharvey@gateworks.com>
+Tested-By: Tim Harvey <tharvey@gateworks.com>
+Reported-by: Gerhard Bertelsmann <info@gerhard-bertelsmann.de>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/spi/mcp251x.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
+index 25859d16d06f..e7be36dc2159 100644
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -314,6 +314,18 @@ static int mcp251x_spi_trans(struct spi_device *spi, int len)
+ return ret;
+ }
+
++static int mcp251x_spi_write(struct spi_device *spi, int len)
++{
++ struct mcp251x_priv *priv = spi_get_drvdata(spi);
++ int ret;
++
++ ret = spi_write(spi, priv->spi_tx_buf, len);
++ if (ret)
++ dev_err(&spi->dev, "spi write failed: ret = %d\n", ret);
++
++ return ret;
++}
++
+ static u8 mcp251x_read_reg(struct spi_device *spi, u8 reg)
+ {
+ struct mcp251x_priv *priv = spi_get_drvdata(spi);
+@@ -361,7 +373,7 @@ static void mcp251x_write_reg(struct spi_device *spi, u8 reg, u8 val)
+ priv->spi_tx_buf[1] = reg;
+ priv->spi_tx_buf[2] = val;
+
+- mcp251x_spi_trans(spi, 3);
++ mcp251x_spi_write(spi, 3);
+ }
+
+ static void mcp251x_write_2regs(struct spi_device *spi, u8 reg, u8 v1, u8 v2)
+@@ -373,7 +385,7 @@ static void mcp251x_write_2regs(struct spi_device *spi, u8 reg, u8 v1, u8 v2)
+ priv->spi_tx_buf[2] = v1;
+ priv->spi_tx_buf[3] = v2;
+
+- mcp251x_spi_trans(spi, 4);
++ mcp251x_spi_write(spi, 4);
+ }
+
+ static void mcp251x_write_bits(struct spi_device *spi, u8 reg,
+@@ -386,7 +398,7 @@ static void mcp251x_write_bits(struct spi_device *spi, u8 reg,
+ priv->spi_tx_buf[2] = mask;
+ priv->spi_tx_buf[3] = val;
+
+- mcp251x_spi_trans(spi, 4);
++ mcp251x_spi_write(spi, 4);
+ }
+
+ static u8 mcp251x_read_stat(struct spi_device *spi)
+@@ -618,7 +630,7 @@ static void mcp251x_hw_tx_frame(struct spi_device *spi, u8 *buf,
+ buf[i]);
+ } else {
+ memcpy(priv->spi_tx_buf, buf, TXBDAT_OFF + len);
+- mcp251x_spi_trans(spi, TXBDAT_OFF + len);
++ mcp251x_spi_write(spi, TXBDAT_OFF + len);
+ }
+ }
+
+@@ -650,7 +662,7 @@ static void mcp251x_hw_tx(struct spi_device *spi, struct can_frame *frame,
+
+ /* use INSTRUCTION_RTS, to avoid "repeated frame problem" */
+ priv->spi_tx_buf[0] = INSTRUCTION_RTS(1 << tx_buf_idx);
+- mcp251x_spi_trans(priv->spi, 1);
++ mcp251x_spi_write(priv->spi, 1);
+ }
+
+ static void mcp251x_hw_rx_frame(struct spi_device *spi, u8 *buf,
+@@ -888,7 +900,7 @@ static int mcp251x_hw_reset(struct spi_device *spi)
+ mdelay(MCP251X_OST_DELAY_MS);
+
+ priv->spi_tx_buf[0] = INSTRUCTION_RESET;
+- ret = mcp251x_spi_trans(spi, 1);
++ ret = mcp251x_spi_write(spi, 1);
+ if (ret)
+ return ret;
+
+--
+2.30.2
+
--- /dev/null
+From 0084115277906a63aa1a04266be996b4fcd78c91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Mar 2021 10:44:54 +0100
+Subject: can: uapi: can.h: mark union inside struct can_frame packed
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit f5076c6ba02e8e24c61c40bbf48078929bc0fc79 ]
+
+In commit ea7800565a12 ("can: add optional DLC element to Classical
+CAN frame structure") the struct can_frame::can_dlc was put into an
+anonymous union with another u8 variable.
+
+For various reasons some members in struct can_frame and canfd_frame
+including the first 8 byes of data are expected to have the same
+memory layout. This is enforced by a BUILD_BUG_ON check in af_can.c.
+
+Since the above mentioned commit this check fails on ARM kernels
+compiled with the ARM OABI (which means CONFIG_AEABI not set). In this
+case -mabi=apcs-gnu is passed to the compiler, which leads to a
+structure size boundary of 32, instead of 8 compared to CONFIG_AEABI
+enabled. This means the the union in struct can_frame takes 4 bytes
+instead of the expected 1.
+
+Rong Chen illustrates the problem with pahole in the ARM OABI case:
+
+| struct can_frame {
+| canid_t can_id; /* 0 4 */
+| union {
+| __u8 len; /* 4 1 */
+| __u8 can_dlc; /* 4 1 */
+| }; /* 4 4 */
+| __u8 __pad; /* 8 1 */
+| __u8 __res0; /* 9 1 */
+| __u8 len8_dlc; /* 10 1 */
+|
+| /* XXX 5 bytes hole, try to pack */
+|
+| __u8 data[8]
+| __attribute__((__aligned__(8))); /* 16 8 */
+|
+| /* size: 24, cachelines: 1, members: 6 */
+| /* sum members: 19, holes: 1, sum holes: 5 */
+| /* forced alignments: 1, forced holes: 1, sum forced holes: 5 */
+| /* last cacheline: 24 bytes */
+| } __attribute__((__aligned__(8)));
+
+Marking the anonymous union as __attribute__((packed)) fixes the
+BUILD_BUG_ON problem on these compilers.
+
+Fixes: ea7800565a12 ("can: add optional DLC element to Classical CAN frame structure")
+Reported-by: kernel test robot <lkp@intel.com>
+Suggested-by: Rong Chen <rong.a.chen@intel.com>
+Link: https://lore.kernel.org/linux-can/2c82ec23-3551-61b5-1bd8-178c3407ee83@hartkopp.net/
+Link: https://lore.kernel.org/r/20210325125850.1620-3-socketcan@hartkopp.net
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/can.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/can.h b/include/uapi/linux/can.h
+index f75238ac6dce..c7535352fef6 100644
+--- a/include/uapi/linux/can.h
++++ b/include/uapi/linux/can.h
+@@ -113,7 +113,7 @@ struct can_frame {
+ */
+ __u8 len;
+ __u8 can_dlc; /* deprecated */
+- };
++ } __attribute__((packed)); /* disable padding added in some ABIs */
+ __u8 __pad; /* padding */
+ __u8 __res0; /* reserved / padding */
+ __u8 len8_dlc; /* optional DLC for 8 byte payload length (9 .. 15) */
+--
+2.30.2
+
--- /dev/null
+From e28d2b4ca3f7faf34486543590f068f57afbc097 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 00:51:48 +0200
+Subject: clk: fix invalid usage of list cursor in register
+
+From: Lukasz Bartosik <lb@semihalf.com>
+
+[ Upstream commit 8d3c0c01cb2e36b2bf3c06a82b18b228d0c8f5d0 ]
+
+Fix invalid usage of a list_for_each_entry cursor in
+clk_notifier_register(). When list is empty or if the list
+is completely traversed (without breaking from the loop on one
+of the entries) then the list cursor does not point to a valid
+entry and therefore should not be used.
+
+The issue was dicovered when running 5.12-rc1 kernel on x86_64
+with KASAN enabled:
+BUG: KASAN: global-out-of-bounds in clk_notifier_register+0xab/0x230
+Read of size 8 at addr ffffffffa0d10588 by task swapper/0/1
+
+CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1 #1
+Hardware name: Google Caroline/Caroline,
+BIOS Google_Caroline.7820.430.0 07/20/2018
+Call Trace:
+ dump_stack+0xee/0x15c
+ print_address_description+0x1e/0x2dc
+ kasan_report+0x188/0x1ce
+ ? clk_notifier_register+0xab/0x230
+ ? clk_prepare_lock+0x15/0x7b
+ ? clk_notifier_register+0xab/0x230
+ clk_notifier_register+0xab/0x230
+ dw8250_probe+0xc01/0x10d4
+...
+Memory state around the buggy address:
+ ffffffffa0d10480: 00 00 00 00 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00
+ ffffffffa0d10500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9
+>ffffffffa0d10580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
+ ^
+ ffffffffa0d10600: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
+ ffffffffa0d10680: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
+ ==================================================================
+
+Fixes: b2476490ef11 ("clk: introduce the common clock framework")
+Reported-by: Lukasz Majczak <lma@semihalf.com>
+Signed-off-by: Lukasz Bartosik <lb@semihalf.com>
+Link: https://lore.kernel.org/r/20210401225149.18826-1-lb@semihalf.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 8c1d04db990d..e08274020944 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -4336,20 +4336,19 @@ int clk_notifier_register(struct clk *clk, struct notifier_block *nb)
+ /* search the list of notifiers for this clk */
+ list_for_each_entry(cn, &clk_notifier_list, node)
+ if (cn->clk == clk)
+- break;
++ goto found;
+
+ /* if clk wasn't in the notifier list, allocate new clk_notifier */
+- if (cn->clk != clk) {
+- cn = kzalloc(sizeof(*cn), GFP_KERNEL);
+- if (!cn)
+- goto out;
++ cn = kzalloc(sizeof(*cn), GFP_KERNEL);
++ if (!cn)
++ goto out;
+
+- cn->clk = clk;
+- srcu_init_notifier_head(&cn->notifier_head);
++ cn->clk = clk;
++ srcu_init_notifier_head(&cn->notifier_head);
+
+- list_add(&cn->node, &clk_notifier_list);
+- }
++ list_add(&cn->node, &clk_notifier_list);
+
++found:
+ ret = srcu_notifier_chain_register(&cn->notifier_head, nb);
+
+ clk->core->notifier_count++;
+--
+2.30.2
+
--- /dev/null
+From f304eee90304efad6579d7648d106d7b5b77e90c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 00:51:49 +0200
+Subject: clk: fix invalid usage of list cursor in unregister
+
+From: Lukasz Bartosik <lb@semihalf.com>
+
+[ Upstream commit 7045465500e465b09f09d6e5bdc260a9f1aab97b ]
+
+Fix invalid usage of a list_for_each_entry cursor in
+clk_notifier_unregister(). When list is empty or if the list
+is completely traversed (without breaking from the loop on one
+of the entries) then the list cursor does not point to a valid
+entry and therefore should not be used. The patch fixes a logical
+bug that hasn't been seen in pratice however it is analogus
+to the bug fixed in clk_notifier_register().
+
+The issue was dicovered when running 5.12-rc1 kernel on x86_64
+with KASAN enabled:
+BUG: KASAN: global-out-of-bounds in clk_notifier_register+0xab/0x230
+Read of size 8 at addr ffffffffa0d10588 by task swapper/0/1
+
+CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1 #1
+Hardware name: Google Caroline/Caroline,
+BIOS Google_Caroline.7820.430.0 07/20/2018
+Call Trace:
+ dump_stack+0xee/0x15c
+ print_address_description+0x1e/0x2dc
+ kasan_report+0x188/0x1ce
+ ? clk_notifier_register+0xab/0x230
+ ? clk_prepare_lock+0x15/0x7b
+ ? clk_notifier_register+0xab/0x230
+ clk_notifier_register+0xab/0x230
+ dw8250_probe+0xc01/0x10d4
+ ...
+ Memory state around the buggy address:
+ ffffffffa0d10480: 00 00 00 00 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00
+ ffffffffa0d10500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9
+ >ffffffffa0d10580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
+ ^
+ ffffffffa0d10600: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
+ ffffffffa0d10680: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
+ ==================================================================
+
+Fixes: b2476490ef11 ("clk: introduce the common clock framework")
+Reported-by: Lukasz Majczak <lma@semihalf.com>
+Signed-off-by: Lukasz Bartosik <lb@semihalf.com>
+Link: https://lore.kernel.org/r/20210401225149.18826-2-lb@semihalf.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 30 +++++++++++++-----------------
+ 1 file changed, 13 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index e08274020944..571ae066e548 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -4373,32 +4373,28 @@ EXPORT_SYMBOL_GPL(clk_notifier_register);
+ */
+ int clk_notifier_unregister(struct clk *clk, struct notifier_block *nb)
+ {
+- struct clk_notifier *cn = NULL;
+- int ret = -EINVAL;
++ struct clk_notifier *cn;
++ int ret = -ENOENT;
+
+ if (!clk || !nb)
+ return -EINVAL;
+
+ clk_prepare_lock();
+
+- list_for_each_entry(cn, &clk_notifier_list, node)
+- if (cn->clk == clk)
+- break;
+-
+- if (cn->clk == clk) {
+- ret = srcu_notifier_chain_unregister(&cn->notifier_head, nb);
++ list_for_each_entry(cn, &clk_notifier_list, node) {
++ if (cn->clk == clk) {
++ ret = srcu_notifier_chain_unregister(&cn->notifier_head, nb);
+
+- clk->core->notifier_count--;
++ clk->core->notifier_count--;
+
+- /* XXX the notifier code should handle this better */
+- if (!cn->notifier_head.head) {
+- srcu_cleanup_notifier_head(&cn->notifier_head);
+- list_del(&cn->node);
+- kfree(cn);
++ /* XXX the notifier code should handle this better */
++ if (!cn->notifier_head.head) {
++ srcu_cleanup_notifier_head(&cn->notifier_head);
++ list_del(&cn->node);
++ kfree(cn);
++ }
++ break;
+ }
+-
+- } else {
+- ret = -ENOENT;
+ }
+
+ clk_prepare_unlock();
+--
+2.30.2
+
--- /dev/null
+From af956ee3de38ad2898b0d35fe3f67b79264beb53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Mar 2021 07:11:05 +0530
+Subject: clk: qcom: camcc: Update the clock ops for the SC7180
+
+From: Taniya Das <tdas@codeaurora.org>
+
+[ Upstream commit e5c359f70e4b5e7b6c2bf4b0ca2d2686d543a37b ]
+
+Some of the RCGs could be always ON from the XO source and could be used
+as the clock on signal for the GDSC to be operational. In the cases where
+the GDSCs are parked at different source with the source clock disabled,
+it could lead to the GDSC to be stuck at ON/OFF during gdsc disable/enable.
+Thus park the RCGs at XO during clock disable and update the rcg_ops to
+use the shared_ops.
+
+Fixes: 15d09e830bbc ("clk: qcom: camcc: Add camera clock controller driver for SC7180")
+Signed-off-by: Taniya Das <tdas@codeaurora.org>
+Link: https://lore.kernel.org/r/1616809265-11912-1-git-send-email-tdas@codeaurora.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/camcc-sc7180.c | 50 ++++++++++++++++-----------------
+ 1 file changed, 25 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/clk/qcom/camcc-sc7180.c b/drivers/clk/qcom/camcc-sc7180.c
+index dbac5651ab85..9bcf2f8ed4de 100644
+--- a/drivers/clk/qcom/camcc-sc7180.c
++++ b/drivers/clk/qcom/camcc-sc7180.c
+@@ -304,7 +304,7 @@ static struct clk_rcg2 cam_cc_bps_clk_src = {
+ .name = "cam_cc_bps_clk_src",
+ .parent_data = cam_cc_parent_data_2,
+ .num_parents = 5,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -325,7 +325,7 @@ static struct clk_rcg2 cam_cc_cci_0_clk_src = {
+ .name = "cam_cc_cci_0_clk_src",
+ .parent_data = cam_cc_parent_data_5,
+ .num_parents = 3,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -339,7 +339,7 @@ static struct clk_rcg2 cam_cc_cci_1_clk_src = {
+ .name = "cam_cc_cci_1_clk_src",
+ .parent_data = cam_cc_parent_data_5,
+ .num_parents = 3,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -360,7 +360,7 @@ static struct clk_rcg2 cam_cc_cphy_rx_clk_src = {
+ .name = "cam_cc_cphy_rx_clk_src",
+ .parent_data = cam_cc_parent_data_3,
+ .num_parents = 6,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -379,7 +379,7 @@ static struct clk_rcg2 cam_cc_csi0phytimer_clk_src = {
+ .name = "cam_cc_csi0phytimer_clk_src",
+ .parent_data = cam_cc_parent_data_0,
+ .num_parents = 4,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -393,7 +393,7 @@ static struct clk_rcg2 cam_cc_csi1phytimer_clk_src = {
+ .name = "cam_cc_csi1phytimer_clk_src",
+ .parent_data = cam_cc_parent_data_0,
+ .num_parents = 4,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -407,7 +407,7 @@ static struct clk_rcg2 cam_cc_csi2phytimer_clk_src = {
+ .name = "cam_cc_csi2phytimer_clk_src",
+ .parent_data = cam_cc_parent_data_0,
+ .num_parents = 4,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -421,7 +421,7 @@ static struct clk_rcg2 cam_cc_csi3phytimer_clk_src = {
+ .name = "cam_cc_csi3phytimer_clk_src",
+ .parent_data = cam_cc_parent_data_0,
+ .num_parents = 4,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -443,7 +443,7 @@ static struct clk_rcg2 cam_cc_fast_ahb_clk_src = {
+ .name = "cam_cc_fast_ahb_clk_src",
+ .parent_data = cam_cc_parent_data_0,
+ .num_parents = 4,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -466,7 +466,7 @@ static struct clk_rcg2 cam_cc_icp_clk_src = {
+ .name = "cam_cc_icp_clk_src",
+ .parent_data = cam_cc_parent_data_2,
+ .num_parents = 5,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -488,7 +488,7 @@ static struct clk_rcg2 cam_cc_ife_0_clk_src = {
+ .name = "cam_cc_ife_0_clk_src",
+ .parent_data = cam_cc_parent_data_4,
+ .num_parents = 4,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -510,7 +510,7 @@ static struct clk_rcg2 cam_cc_ife_0_csid_clk_src = {
+ .name = "cam_cc_ife_0_csid_clk_src",
+ .parent_data = cam_cc_parent_data_3,
+ .num_parents = 6,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -524,7 +524,7 @@ static struct clk_rcg2 cam_cc_ife_1_clk_src = {
+ .name = "cam_cc_ife_1_clk_src",
+ .parent_data = cam_cc_parent_data_4,
+ .num_parents = 4,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -538,7 +538,7 @@ static struct clk_rcg2 cam_cc_ife_1_csid_clk_src = {
+ .name = "cam_cc_ife_1_csid_clk_src",
+ .parent_data = cam_cc_parent_data_3,
+ .num_parents = 6,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -553,7 +553,7 @@ static struct clk_rcg2 cam_cc_ife_lite_clk_src = {
+ .parent_data = cam_cc_parent_data_4,
+ .num_parents = 4,
+ .flags = CLK_SET_RATE_PARENT,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -567,7 +567,7 @@ static struct clk_rcg2 cam_cc_ife_lite_csid_clk_src = {
+ .name = "cam_cc_ife_lite_csid_clk_src",
+ .parent_data = cam_cc_parent_data_3,
+ .num_parents = 6,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -590,7 +590,7 @@ static struct clk_rcg2 cam_cc_ipe_0_clk_src = {
+ .name = "cam_cc_ipe_0_clk_src",
+ .parent_data = cam_cc_parent_data_2,
+ .num_parents = 5,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -613,7 +613,7 @@ static struct clk_rcg2 cam_cc_jpeg_clk_src = {
+ .name = "cam_cc_jpeg_clk_src",
+ .parent_data = cam_cc_parent_data_2,
+ .num_parents = 5,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -635,7 +635,7 @@ static struct clk_rcg2 cam_cc_lrme_clk_src = {
+ .name = "cam_cc_lrme_clk_src",
+ .parent_data = cam_cc_parent_data_6,
+ .num_parents = 5,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -656,7 +656,7 @@ static struct clk_rcg2 cam_cc_mclk0_clk_src = {
+ .name = "cam_cc_mclk0_clk_src",
+ .parent_data = cam_cc_parent_data_1,
+ .num_parents = 3,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -670,7 +670,7 @@ static struct clk_rcg2 cam_cc_mclk1_clk_src = {
+ .name = "cam_cc_mclk1_clk_src",
+ .parent_data = cam_cc_parent_data_1,
+ .num_parents = 3,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -684,7 +684,7 @@ static struct clk_rcg2 cam_cc_mclk2_clk_src = {
+ .name = "cam_cc_mclk2_clk_src",
+ .parent_data = cam_cc_parent_data_1,
+ .num_parents = 3,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -698,7 +698,7 @@ static struct clk_rcg2 cam_cc_mclk3_clk_src = {
+ .name = "cam_cc_mclk3_clk_src",
+ .parent_data = cam_cc_parent_data_1,
+ .num_parents = 3,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -712,7 +712,7 @@ static struct clk_rcg2 cam_cc_mclk4_clk_src = {
+ .name = "cam_cc_mclk4_clk_src",
+ .parent_data = cam_cc_parent_data_1,
+ .num_parents = 3,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+@@ -732,7 +732,7 @@ static struct clk_rcg2 cam_cc_slow_ahb_clk_src = {
+ .parent_data = cam_cc_parent_data_0,
+ .num_parents = 4,
+ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_shared_ops,
+ },
+ };
+
+--
+2.30.2
+
--- /dev/null
+From d26622ee8b34b63649de9d2059b7c68b610b29b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Mar 2021 23:49:08 +0530
+Subject: cxgb4: avoid collecting SGE_QBASE regs during traffic
+
+From: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+
+[ Upstream commit 1bfb3dea965ff9f6226fd1709338f227363b6061 ]
+
+Accessing SGE_QBASE_MAP[0-3] and SGE_QBASE_INDEX registers can lead
+to SGE missing doorbells under heavy traffic. So, only collect them
+when adapter is idle. Also update the regdump range to skip collecting
+these registers.
+
+Fixes: 80a95a80d358 ("cxgb4: collect SGE PF/VF queue map")
+Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/chelsio/cxgb4/cudbg_lib.c | 23 +++++++++++++++----
+ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 3 ++-
+ 2 files changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+index 75474f810249..c5b0e725b238 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+@@ -1794,11 +1794,25 @@ int cudbg_collect_sge_indirect(struct cudbg_init *pdbg_init,
+ struct cudbg_buffer temp_buff = { 0 };
+ struct sge_qbase_reg_field *sge_qbase;
+ struct ireg_buf *ch_sge_dbg;
++ u8 padap_running = 0;
+ int i, rc;
++ u32 size;
+
+- rc = cudbg_get_buff(pdbg_init, dbg_buff,
+- sizeof(*ch_sge_dbg) * 2 + sizeof(*sge_qbase),
+- &temp_buff);
++ /* Accessing SGE_QBASE_MAP[0-3] and SGE_QBASE_INDEX regs can
++ * lead to SGE missing doorbells under heavy traffic. So, only
++ * collect them when adapter is idle.
++ */
++ for_each_port(padap, i) {
++ padap_running = netif_running(padap->port[i]);
++ if (padap_running)
++ break;
++ }
++
++ size = sizeof(*ch_sge_dbg) * 2;
++ if (!padap_running)
++ size += sizeof(*sge_qbase);
++
++ rc = cudbg_get_buff(pdbg_init, dbg_buff, size, &temp_buff);
+ if (rc)
+ return rc;
+
+@@ -1820,7 +1834,8 @@ int cudbg_collect_sge_indirect(struct cudbg_init *pdbg_init,
+ ch_sge_dbg++;
+ }
+
+- if (CHELSIO_CHIP_VERSION(padap->params.chip) > CHELSIO_T5) {
++ if (CHELSIO_CHIP_VERSION(padap->params.chip) > CHELSIO_T5 &&
++ !padap_running) {
+ sge_qbase = (struct sge_qbase_reg_field *)ch_sge_dbg;
+ /* 1 addr reg SGE_QBASE_INDEX and 4 data reg
+ * SGE_QBASE_MAP[0-3]
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index 98d01a7497ec..581670dced6e 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -2090,7 +2090,8 @@ void t4_get_regs(struct adapter *adap, void *buf, size_t buf_size)
+ 0x1190, 0x1194,
+ 0x11a0, 0x11a4,
+ 0x11b0, 0x11b4,
+- 0x11fc, 0x1274,
++ 0x11fc, 0x123c,
++ 0x1254, 0x1274,
+ 0x1280, 0x133c,
+ 0x1800, 0x18fc,
+ 0x3000, 0x302c,
+--
+2.30.2
+
--- /dev/null
+From 9c07417b0cebd5d049805d6bb86b5624ffff82b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Mar 2021 00:50:08 -0700
+Subject: drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 1b479fb801602b22512f53c19b1f93a4fc5d5d9d ]
+
+In pvc_xmit, if __skb_pad(skb, pad, false) failed, it will free
+the skb in the first time and goto drop. But the same skb is freed
+by kfree_skb(skb) in the second time in drop.
+
+Maintaining the original function unchanged, my patch adds a new
+label out to avoid the double free if __skb_pad() failed.
+
+Fixes: f5083d0cee08a ("drivers/net/wan/hdlc_fr: Improvements to the code of pvc_xmit")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/hdlc_fr.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
+index 0720f5f92caa..4d9dc7d15908 100644
+--- a/drivers/net/wan/hdlc_fr.c
++++ b/drivers/net/wan/hdlc_fr.c
+@@ -415,7 +415,7 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ if (pad > 0) { /* Pad the frame with zeros */
+ if (__skb_pad(skb, pad, false))
+- goto drop;
++ goto out;
+ skb_put(skb, pad);
+ }
+ }
+@@ -448,8 +448,9 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev)
+ return NETDEV_TX_OK;
+
+ drop:
+- dev->stats.tx_dropped++;
+ kfree_skb(skb);
++out:
++ dev->stats.tx_dropped++;
+ return NETDEV_TX_OK;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 8c2f6b0d1cc24ee9cc732a1672a3f063dca7ba5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 17:02:23 +0300
+Subject: drm/msm: a6xx: fix version check for the A650 SQE microcode
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 6ddbfa1f5adbd5dea14ff66778ca58257f09f17d ]
+
+I suppose the microcode version check for a650 is incorrect. It checks
+for the version 1.95, while the firmware released have major version of 0:
+0.91 (vulnerable), 0.99 (fixing the issue).
+
+Lower version requirements to accept firmware 0.99.
+
+Fixes: 8490f02a3ca4 ("drm/msm: a6xx: Make sure the SQE microcode is safe")
+Cc: Akhil P Oommen <akhilpo@codeaurora.org>
+Cc: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Acked-by: Jordan Crouse <jordan@cosmicpenguin.net>
+Message-Id: <20210331140223.3771449-1-dmitry.baryshkov@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index e7a8442b59af..a676811ef69d 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -566,17 +566,17 @@ static bool a6xx_ucode_check_version(struct a6xx_gpu *a6xx_gpu,
+ } else {
+ /*
+ * a650 tier targets don't need whereami but still need to be
+- * equal to or newer than 1.95 for other security fixes
++ * equal to or newer than 0.95 for other security fixes
+ */
+ if (adreno_is_a650(adreno_gpu)) {
+- if ((buf[0] & 0xfff) >= 0x195) {
++ if ((buf[0] & 0xfff) >= 0x095) {
+ ret = true;
+ goto out;
+ }
+
+ DRM_DEV_ERROR(&gpu->pdev->dev,
+ "a650 SQE ucode is too old. Have version %x need at least %x\n",
+- buf[0] & 0xfff, 0x195);
++ buf[0] & 0xfff, 0x095);
+ }
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From efcf3fcacda2f511aad30ad1c80df1a40e22e464 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 04:54:53 -0700
+Subject: drm/msm/disp/dpu1: program 3d_merge only if block is attached
+
+From: Kalyan Thota <kalyan_t@codeaurora.org>
+
+[ Upstream commit 12aca1ce9ee33af3751aec5e55a5900747cbdd4b ]
+
+Update the 3d merge as active in the data path only if
+the hw block is selected in the configuration.
+
+Reported-by: Stephen Boyd <swboyd@chromium.org>
+Fixes: 73bfb790ac78 ("msm:disp:dpu1: setup display datapath for SC7180 target")
+Signed-off-by: Kalyan Thota <kalyan_t@codeaurora.org>
+Message-Id: <1617364493-13518-1-git-send-email-kalyan_t@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+index 8981cfa9dbc3..92e6f1b94738 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+@@ -496,7 +496,9 @@ static void dpu_hw_ctl_intf_cfg_v1(struct dpu_hw_ctl *ctx,
+
+ DPU_REG_WRITE(c, CTL_TOP, mode_sel);
+ DPU_REG_WRITE(c, CTL_INTF_ACTIVE, intf_active);
+- DPU_REG_WRITE(c, CTL_MERGE_3D_ACTIVE, BIT(cfg->merge_3d - MERGE_3D_0));
++ if (cfg->merge_3d)
++ DPU_REG_WRITE(c, CTL_MERGE_3D_ACTIVE,
++ BIT(cfg->merge_3d - MERGE_3D_0));
+ }
+
+ static void dpu_hw_ctl_intf_cfg(struct dpu_hw_ctl *ctx,
+--
+2.30.2
+
--- /dev/null
+From 81378ed8a4f6a7bc66be5e193587cc52a38b09b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 14:28:22 -0700
+Subject: drm/msm: Set drvdata to NULL when msm_drm_init() fails
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 5620b135aea49a8f41c86aaecfcb1598a7774121 ]
+
+We should set the platform device's driver data to NULL here so that
+code doesn't assume the struct drm_device pointer is valid when it could
+have been destroyed. The lifetime of this pointer is managed by a kref
+but when msm_drm_init() fails we call drm_dev_put() on the pointer which
+will free the pointer's memory. This driver uses the component model, so
+there's sort of two "probes" in this file, one for the platform device
+i.e. msm_pdev_probe() and one for the component i.e. msm_drm_bind(). The
+msm_drm_bind() code is using the platform device's driver data to store
+struct drm_device so the two functions are intertwined.
+
+This relationship becomes a problem for msm_pdev_shutdown() when it
+tests the NULL-ness of the pointer to see if it should call
+drm_atomic_helper_shutdown(). The NULL test is a proxy check for if the
+pointer has been freed by kref_put(). If the drm_device has been
+destroyed, then we shouldn't call the shutdown helper, and we know that
+is the case if msm_drm_init() failed, therefore set the driver data to
+NULL so that this pointer liveness is tracked properly.
+
+Fixes: 9d5cbf5fe46e ("drm/msm: add shutdown support for display platform_driver")
+Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: Krishna Manikandan <mkrishn@codeaurora.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Message-Id: <20210325212822.3663144-1-swboyd@chromium.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index a5c6b8c23336..196907689c82 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -570,6 +570,7 @@ err_free_priv:
+ kfree(priv);
+ err_put_drm_dev:
+ drm_dev_put(ddev);
++ platform_set_drvdata(pdev, NULL);
+ return ret;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From e195c7478a7900c576e922ce5475215649f89177 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Mar 2021 17:13:28 +0100
+Subject: drm/vc4: crtc: Reduce PV fifo threshold on hvs4
+
+From: Dom Cobley <popcornmix@gmail.com>
+
+[ Upstream commit eb9dfdd1ed40357b99a4201c8534c58c562e48c9 ]
+
+Experimentally have found PV on hvs4 reports fifo full
+error with expected settings and does not with one less
+
+This appears as:
+[drm:drm_atomic_helper_wait_for_flip_done] *ERROR* [CRTC:82:crtc-3] flip_done timed out
+
+with bit 10 of PV_STAT set "HVS driving pixels when the PV FIFO is full"
+
+Fixes: c8b75bca92cb ("drm/vc4: Add KMS support for Raspberry Pi.")
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210318161328.1471556-3-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
+index ea710beb8e00..351c601f0ddb 100644
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -210,6 +210,7 @@ static u32 vc4_get_fifo_full_level(struct vc4_crtc *vc4_crtc, u32 format)
+ {
+ const struct vc4_crtc_data *crtc_data = vc4_crtc_to_vc4_crtc_data(vc4_crtc);
+ const struct vc4_pv_data *pv_data = vc4_crtc_to_vc4_pv_data(vc4_crtc);
++ struct vc4_dev *vc4 = to_vc4_dev(vc4_crtc->base.dev);
+ u32 fifo_len_bytes = pv_data->fifo_depth;
+
+ /*
+@@ -238,6 +239,22 @@ static u32 vc4_get_fifo_full_level(struct vc4_crtc *vc4_crtc, u32 format)
+ if (crtc_data->hvs_output == 5)
+ return 32;
+
++ /*
++ * It looks like in some situations, we will overflow
++ * the PixelValve FIFO (with the bit 10 of PV stat being
++ * set) and stall the HVS / PV, eventually resulting in
++ * a page flip timeout.
++ *
++ * Displaying the video overlay during a playback with
++ * Kodi on an RPi3 seems to be a great solution with a
++ * failure rate around 50%.
++ *
++ * Removing 1 from the FIFO full level however
++ * seems to completely remove that issue.
++ */
++ if (!vc4->hvs->hvs5)
++ return fifo_len_bytes - 3 * HVS_FIFO_LATENCY_PIX - 1;
++
+ return fifo_len_bytes - 3 * HVS_FIFO_LATENCY_PIX;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From 163b87199abd07b5cfcd8f47fe4669f4e47f5b44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 15:35:07 +0800
+Subject: esp: delete NETIF_F_SCTP_CRC bit from features for esp offload
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 154deab6a3ba47792936edf77f2f13a1cbc4351d ]
+
+Now in esp4/6_gso_segment(), before calling inner proto .gso_segment,
+NETIF_F_CSUM_MASK bits are deleted, as HW won't be able to do the
+csum for inner proto due to the packet encrypted already.
+
+So the UDP/TCP packet has to do the checksum on its own .gso_segment.
+But SCTP is using CRC checksum, and for that NETIF_F_SCTP_CRC should
+be deleted to make SCTP do the csum in own .gso_segment as well.
+
+In Xiumei's testing with SCTP over IPsec/veth, the packets are kept
+dropping due to the wrong CRC checksum.
+
+Reported-by: Xiumei Mu <xmu@redhat.com>
+Fixes: 7862b4058b9f ("esp: Add gso handlers for esp4 and esp6")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/esp4_offload.c | 6 ++++--
+ net/ipv6/esp6_offload.c | 6 ++++--
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
+index 5bda5aeda579..d5c0f5a2a551 100644
+--- a/net/ipv4/esp4_offload.c
++++ b/net/ipv4/esp4_offload.c
+@@ -217,10 +217,12 @@ static struct sk_buff *esp4_gso_segment(struct sk_buff *skb,
+
+ if ((!(skb->dev->gso_partial_features & NETIF_F_HW_ESP) &&
+ !(features & NETIF_F_HW_ESP)) || x->xso.dev != skb->dev)
+- esp_features = features & ~(NETIF_F_SG | NETIF_F_CSUM_MASK);
++ esp_features = features & ~(NETIF_F_SG | NETIF_F_CSUM_MASK |
++ NETIF_F_SCTP_CRC);
+ else if (!(features & NETIF_F_HW_ESP_TX_CSUM) &&
+ !(skb->dev->gso_partial_features & NETIF_F_HW_ESP_TX_CSUM))
+- esp_features = features & ~NETIF_F_CSUM_MASK;
++ esp_features = features & ~(NETIF_F_CSUM_MASK |
++ NETIF_F_SCTP_CRC);
+
+ xo->flags |= XFRM_GSO_SEGMENT;
+
+diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
+index 1ca516fb30e1..f35203ab39f5 100644
+--- a/net/ipv6/esp6_offload.c
++++ b/net/ipv6/esp6_offload.c
+@@ -254,9 +254,11 @@ static struct sk_buff *esp6_gso_segment(struct sk_buff *skb,
+ skb->encap_hdr_csum = 1;
+
+ if (!(features & NETIF_F_HW_ESP) || x->xso.dev != skb->dev)
+- esp_features = features & ~(NETIF_F_SG | NETIF_F_CSUM_MASK);
++ esp_features = features & ~(NETIF_F_SG | NETIF_F_CSUM_MASK |
++ NETIF_F_SCTP_CRC);
+ else if (!(features & NETIF_F_HW_ESP_TX_CSUM))
+- esp_features = features & ~NETIF_F_CSUM_MASK;
++ esp_features = features & ~(NETIF_F_CSUM_MASK |
++ NETIF_F_SCTP_CRC);
+
+ xo->flags |= XFRM_GSO_SEGMENT;
+
+--
+2.30.2
+
--- /dev/null
+From 03862dd9073032c294b922587baad8c9ad555efe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 05:36:48 -0700
+Subject: ethernet: myri10ge: Fix a use after free in myri10ge_sw_tso
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 63415767a2446136372e777cde5bb351f21ec21d ]
+
+In myri10ge_sw_tso, the skb_list_walk_safe macro will set
+(curr) = (segs) and (next) = (curr)->next. If status!=0 is true,
+the memory pointed by curr and segs will be free by dev_kfree_skb_any(curr).
+But later, the segs is used by segs = segs->next and causes a uaf.
+
+As (next) = (curr)->next, my patch replaces seg->next to next.
+
+Fixes: 536577f36ff7a ("net: myri10ge: use skb_list_walk_safe helper for gso segments")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+index 1634ca6d4a8f..c84c8bf2bc20 100644
+--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+@@ -2897,7 +2897,7 @@ static netdev_tx_t myri10ge_sw_tso(struct sk_buff *skb,
+ dev_kfree_skb_any(curr);
+ if (segs != NULL) {
+ curr = segs;
+- segs = segs->next;
++ segs = next;
+ curr->next = NULL;
+ dev_kfree_skb_any(segs);
+ }
+--
+2.30.2
+
--- /dev/null
+From 2ee370f382190bc45efadbce93fbf1358ab38264 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 16:35:33 +0100
+Subject: geneve: do not modify the shared tunnel info when PMTU triggers an
+ ICMP reply
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit 68c1a943ef37bafde5ea2383e8ca224c7169ee31 ]
+
+When the interface is part of a bridge or an Open vSwitch port and a
+packet exceed a PMTU estimate, an ICMP reply is sent to the sender. When
+using the external mode (collect metadata) the source and destination
+addresses are reversed, so that Open vSwitch can match the packet
+against an existing (reverse) flow.
+
+But inverting the source and destination addresses in the shared
+ip_tunnel_info will make following packets of the flow to use a wrong
+destination address (packets will be tunnelled to itself), if the flow
+isn't updated. Which happens with Open vSwitch, until the flow times
+out.
+
+Fixes this by uncloning the skb's ip_tunnel_info before inverting its
+source and destination addresses, so that the modification will only be
+made for the PTMU packet, not the following ones.
+
+Fixes: c1a800e88dbf ("geneve: Support for PMTU discovery on directly bridged links")
+Tested-by: Eelco Chaudron <echaudro@redhat.com>
+Reviewed-by: Eelco Chaudron <echaudro@redhat.com>
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/geneve.c | 24 ++++++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 5523f069b9a5..f35b0b83fe85 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -908,8 +908,16 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+
+ info = skb_tunnel_info(skb);
+ if (info) {
+- info->key.u.ipv4.dst = fl4.saddr;
+- info->key.u.ipv4.src = fl4.daddr;
++ struct ip_tunnel_info *unclone;
++
++ unclone = skb_tunnel_info_unclone(skb);
++ if (unlikely(!unclone)) {
++ dst_release(&rt->dst);
++ return -ENOMEM;
++ }
++
++ unclone->key.u.ipv4.dst = fl4.saddr;
++ unclone->key.u.ipv4.src = fl4.daddr;
+ }
+
+ if (!pskb_may_pull(skb, ETH_HLEN)) {
+@@ -993,8 +1001,16 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ struct ip_tunnel_info *info = skb_tunnel_info(skb);
+
+ if (info) {
+- info->key.u.ipv6.dst = fl6.saddr;
+- info->key.u.ipv6.src = fl6.daddr;
++ struct ip_tunnel_info *unclone;
++
++ unclone = skb_tunnel_info_unclone(skb);
++ if (unlikely(!unclone)) {
++ dst_release(dst);
++ return -ENOMEM;
++ }
++
++ unclone->key.u.ipv6.dst = fl6.saddr;
++ unclone->key.u.ipv6.src = fl6.daddr;
+ }
+
+ if (!pskb_may_pull(skb, ETH_HLEN)) {
+--
+2.30.2
+
--- /dev/null
+From a2cacc29a26552d6a06cb16a40c9f611fadf3011 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 17:08:47 +0300
+Subject: gianfar: Handle error code at MAC address change
+
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+
+[ Upstream commit bff5b62585123823842833ab20b1c0a7fa437f8c ]
+
+Handle return error code of eth_mac_addr();
+
+Fixes: 3d23a05c75c7 ("gianfar: Enable changing mac addr when if up")
+Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/gianfar.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index 4fab2ee5bbf5..e4d9c4c640e5 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -364,7 +364,11 @@ static void gfar_set_mac_for_addr(struct net_device *dev, int num,
+
+ static int gfar_set_mac_addr(struct net_device *dev, void *p)
+ {
+- eth_mac_addr(dev, p);
++ int ret;
++
++ ret = eth_mac_addr(dev, p);
++ if (ret)
++ return ret;
+
+ gfar_set_mac_for_addr(dev, 0, dev->dev_addr);
+
+--
+2.30.2
+
--- /dev/null
+From 65a846cd40983bf72d5b93fe43ce3010a0fd53d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 14:12:34 -0400
+Subject: hostfs: fix memory handling in follow_link()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 7f6c411c9b50cfab41cc798e003eff27608c7016 ]
+
+1) argument should not be freed in any case - the caller already has
+it as ->s_fs_info (and uses it a lot afterwards)
+2) allocate readlink buffer with kmalloc() - the caller has no way
+to tell if it's got that (on absolute symlink) or a result of
+kasprintf(). Sure, for SLAB and SLUB kfree() works on results of
+kmem_cache_alloc(), but that's not documented anywhere, might change
+in the future *and* is already not true for SLOB.
+
+Fixes: 52b209f7b848 ("get rid of hostfs_read_inode()")
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hostfs/hostfs_kern.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
+index aea35459d390..07467ca0f71d 100644
+--- a/fs/hostfs/hostfs_kern.c
++++ b/fs/hostfs/hostfs_kern.c
+@@ -142,7 +142,7 @@ static char *follow_link(char *link)
+ char *name, *resolved, *end;
+ int n;
+
+- name = __getname();
++ name = kmalloc(PATH_MAX, GFP_KERNEL);
+ if (!name) {
+ n = -ENOMEM;
+ goto out_free;
+@@ -171,12 +171,11 @@ static char *follow_link(char *link)
+ goto out_free;
+ }
+
+- __putname(name);
+- kfree(link);
++ kfree(name);
+ return resolved;
+
+ out_free:
+- __putname(name);
++ kfree(name);
+ return ERR_PTR(n);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From a4766970073004ce215c0bd484c18a4483717c5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 14:05:10 +0300
+Subject: i2c: designware: Adjust bus_freq_hz when refuse high speed mode set
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 5e729bc54bda705f64941008b018b4e41a4322bf ]
+
+When hardware doesn't support High Speed Mode, we forget bus_freq_hz
+timing adjustment. This makes the timings and real registers being
+unsynchronized. Adjust bus_freq_hz when refuse high speed mode set.
+
+Fixes: b6e67145f149 ("i2c: designware: Enable high speed mode")
+Reported-by: "Song Bao Hua (Barry Song)" <song.bao.hua@hisilicon.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Barry Song <song.bao.hua@hisilicon.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-master.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
+index d6425ad6e6a3..2871cf2ee8b4 100644
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -129,6 +129,7 @@ static int i2c_dw_set_timings_master(struct dw_i2c_dev *dev)
+ if ((comp_param1 & DW_IC_COMP_PARAM_1_SPEED_MODE_MASK)
+ != DW_IC_COMP_PARAM_1_SPEED_MODE_HIGH) {
+ dev_err(dev->dev, "High Speed not supported!\n");
++ t->bus_freq_hz = I2C_MAX_FAST_MODE_FREQ;
+ dev->master_cfg &= ~DW_IC_CON_SPEED_MASK;
+ dev->master_cfg |= DW_IC_CON_SPEED_FAST;
+ dev->hs_hcnt = 0;
+--
+2.30.2
+
--- /dev/null
+From 401bcb376bf25258a7445fd4eeb1c4396054138a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 18:12:13 +0800
+Subject: I2C: JZ4780: Fix bug for Ingenic X1000.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
+
+[ Upstream commit 942bfbecc0281c75db84f744b9b77b0f2396f484 ]
+
+Only send "X1000_I2C_DC_STOP" when last byte, or it will cause
+error when I2C write operation which should look like this:
+
+device_addr + w, reg_addr, data;
+
+But without this patch, it looks like this:
+
+device_addr + w, reg_addr, device_addr + w, data;
+
+Fixes: 21575a7a8d4c ("I2C: JZ4780: Add support for the X1000.")
+Reported-by: 杨文龙 (Yang Wenlong) <ywltyut@sina.cn>
+Tested-by: 杨文龙 (Yang Wenlong) <ywltyut@sina.cn>
+Signed-off-by: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-jz4780.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c
+index cb4a25ebb890..2a946c207928 100644
+--- a/drivers/i2c/busses/i2c-jz4780.c
++++ b/drivers/i2c/busses/i2c-jz4780.c
+@@ -526,8 +526,8 @@ static irqreturn_t jz4780_i2c_irq(int irqno, void *dev_id)
+ i2c_sta = jz4780_i2c_readw(i2c, JZ4780_I2C_STA);
+ data = *i2c->wbuf;
+ data &= ~JZ4780_I2C_DC_READ;
+- if ((!i2c->stop_hold) && (i2c->cdata->version >=
+- ID_X1000))
++ if ((i2c->wt_len == 1) && (!i2c->stop_hold) &&
++ (i2c->cdata->version >= ID_X1000))
+ data |= X1000_I2C_DC_STOP;
+ jz4780_i2c_writew(i2c, JZ4780_I2C_DC, data);
+ i2c->wbuf++;
+--
+2.30.2
+
--- /dev/null
+From 4cd70cd0cfac15e814718729683886bc9f4cf99a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 15:00:02 +0000
+Subject: i40e: Added Asym_Pause to supported link modes
+
+From: Mateusz Palczewski <mateusz.palczewski@intel.com>
+
+[ Upstream commit 90449e98c265296329446c7abcd2aae3b20c0bc9 ]
+
+Add Asym_Pause to supported link modes (it is supported by HW).
+Lack of Asym_Pause in supported modes can cause several problems,
+i.e. it won't be possible to turn the autonegotiation on
+with asymmetric pause settings (i.e. Tx on, Rx off).
+
+Fixes: 4e91bcd5d47a ("i40e: Finish implementation of ethtool get settings")
+Signed-off-by: Dawid Lukwinski <dawid.lukwinski@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index 9e81f85ee2d8..a92fac6f1389 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -1101,6 +1101,7 @@ static int i40e_get_link_ksettings(struct net_device *netdev,
+
+ /* Set flow control settings */
+ ethtool_link_ksettings_add_link_mode(ks, supported, Pause);
++ ethtool_link_ksettings_add_link_mode(ks, supported, Asym_Pause);
+
+ switch (hw->fc.requested_mode) {
+ case I40E_FC_FULL:
+--
+2.30.2
+
--- /dev/null
+From 053fed77e39f6bc217de46b990ce497b4b6a6a2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 08:46:27 +0100
+Subject: i40e: Fix display statistics for veb_tc
+
+From: Eryk Rybak <eryk.roch.rybak@intel.com>
+
+[ Upstream commit c3214de929dbf1b7374add8bbed30ce82b197bbb ]
+
+If veb-stats was enabled, the ethtool stats triggered a warning
+due to invalid size: 'unexpected stat size for veb.tc_%u_tx_packets'.
+This was due to an incorrect structure definition for the statistics.
+Structures and functions have been improved in line with requirements
+for the presentation of statistics, in particular for the functions:
+'i40e_add_ethtool_stats' and 'i40e_add_stat_strings'.
+
+Fixes: 1510ae0be2a4 ("i40e: convert VEB TC stats to use an i40e_stats array")
+Signed-off-by: Eryk Rybak <eryk.roch.rybak@intel.com>
+Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Dave Switzer <david.switzer@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/intel/i40e/i40e_ethtool.c | 52 ++++++++++++++++---
+ 1 file changed, 46 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index a92fac6f1389..849e38be69ff 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -232,6 +232,8 @@ static void __i40e_add_stat_strings(u8 **p, const struct i40e_stats stats[],
+ I40E_STAT(struct i40e_vsi, _name, _stat)
+ #define I40E_VEB_STAT(_name, _stat) \
+ I40E_STAT(struct i40e_veb, _name, _stat)
++#define I40E_VEB_TC_STAT(_name, _stat) \
++ I40E_STAT(struct i40e_cp_veb_tc_stats, _name, _stat)
+ #define I40E_PFC_STAT(_name, _stat) \
+ I40E_STAT(struct i40e_pfc_stats, _name, _stat)
+ #define I40E_QUEUE_STAT(_name, _stat) \
+@@ -266,11 +268,18 @@ static const struct i40e_stats i40e_gstrings_veb_stats[] = {
+ I40E_VEB_STAT("veb.rx_unknown_protocol", stats.rx_unknown_protocol),
+ };
+
++struct i40e_cp_veb_tc_stats {
++ u64 tc_rx_packets;
++ u64 tc_rx_bytes;
++ u64 tc_tx_packets;
++ u64 tc_tx_bytes;
++};
++
+ static const struct i40e_stats i40e_gstrings_veb_tc_stats[] = {
+- I40E_VEB_STAT("veb.tc_%u_tx_packets", tc_stats.tc_tx_packets),
+- I40E_VEB_STAT("veb.tc_%u_tx_bytes", tc_stats.tc_tx_bytes),
+- I40E_VEB_STAT("veb.tc_%u_rx_packets", tc_stats.tc_rx_packets),
+- I40E_VEB_STAT("veb.tc_%u_rx_bytes", tc_stats.tc_rx_bytes),
++ I40E_VEB_TC_STAT("veb.tc_%u_tx_packets", tc_tx_packets),
++ I40E_VEB_TC_STAT("veb.tc_%u_tx_bytes", tc_tx_bytes),
++ I40E_VEB_TC_STAT("veb.tc_%u_rx_packets", tc_rx_packets),
++ I40E_VEB_TC_STAT("veb.tc_%u_rx_bytes", tc_rx_bytes),
+ };
+
+ static const struct i40e_stats i40e_gstrings_misc_stats[] = {
+@@ -2217,6 +2226,29 @@ static int i40e_get_sset_count(struct net_device *netdev, int sset)
+ }
+ }
+
++/**
++ * i40e_get_veb_tc_stats - copy VEB TC statistics to formatted structure
++ * @tc: the TC statistics in VEB structure (veb->tc_stats)
++ * @i: the index of traffic class in (veb->tc_stats) structure to copy
++ *
++ * Copy VEB TC statistics from structure of arrays (veb->tc_stats) to
++ * one dimensional structure i40e_cp_veb_tc_stats.
++ * Produce formatted i40e_cp_veb_tc_stats structure of the VEB TC
++ * statistics for the given TC.
++ **/
++static struct i40e_cp_veb_tc_stats
++i40e_get_veb_tc_stats(struct i40e_veb_tc_stats *tc, unsigned int i)
++{
++ struct i40e_cp_veb_tc_stats veb_tc = {
++ .tc_rx_packets = tc->tc_rx_packets[i],
++ .tc_rx_bytes = tc->tc_rx_bytes[i],
++ .tc_tx_packets = tc->tc_tx_packets[i],
++ .tc_tx_bytes = tc->tc_tx_bytes[i],
++ };
++
++ return veb_tc;
++}
++
+ /**
+ * i40e_get_pfc_stats - copy HW PFC statistics to formatted structure
+ * @pf: the PF device structure
+@@ -2301,8 +2333,16 @@ static void i40e_get_ethtool_stats(struct net_device *netdev,
+ i40e_gstrings_veb_stats);
+
+ for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++)
+- i40e_add_ethtool_stats(&data, veb_stats ? veb : NULL,
+- i40e_gstrings_veb_tc_stats);
++ if (veb_stats) {
++ struct i40e_cp_veb_tc_stats veb_tc =
++ i40e_get_veb_tc_stats(&veb->tc_stats, i);
++
++ i40e_add_ethtool_stats(&data, &veb_tc,
++ i40e_gstrings_veb_tc_stats);
++ } else {
++ i40e_add_ethtool_stats(&data, NULL,
++ i40e_gstrings_veb_tc_stats);
++ }
+
+ i40e_add_ethtool_stats(&data, pf, i40e_gstrings_stats);
+
+--
+2.30.2
+
--- /dev/null
+From 4746c86df55808bcabb53a5231a9181ac0941dd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Feb 2021 11:15:26 +0000
+Subject: i40e: Fix kernel oops when i40e driver removes VF's
+
+From: Eryk Rybak <eryk.roch.rybak@intel.com>
+
+[ Upstream commit 347b5650cd158d1d953487cc2bec567af5c5bf96 ]
+
+Fix the reason of kernel oops when i40e driver removed VFs.
+Added new __I40E_VFS_RELEASING state to signalize releasing
+process by PF, that it makes possible to exit of reset VF procedure.
+Without this patch, it is possible to suspend the VFs reset by
+releasing VFs resources procedure. Retrying the reset after the
+timeout works on the freed VF memory causing a kernel oops.
+
+Fixes: d43d60e5eb95 ("i40e: ensure reset occurs when disabling VF")
+Signed-off-by: Eryk Rybak <eryk.roch.rybak@intel.com>
+Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e.h | 1 +
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 9 +++++++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
+index 118473dfdcbd..fe1258778cbc 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -142,6 +142,7 @@ enum i40e_state_t {
+ __I40E_VIRTCHNL_OP_PENDING,
+ __I40E_RECOVERY_MODE,
+ __I40E_VF_RESETS_DISABLED, /* disable resets during i40e_remove */
++ __I40E_VFS_RELEASING,
+ /* This must be last as it determines the size of the BITMAP */
+ __I40E_STATE_SIZE__,
+ };
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 1b6ec9be155a..5d301a466f5c 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -137,6 +137,7 @@ void i40e_vc_notify_vf_reset(struct i40e_vf *vf)
+ **/
+ static inline void i40e_vc_disable_vf(struct i40e_vf *vf)
+ {
++ struct i40e_pf *pf = vf->pf;
+ int i;
+
+ i40e_vc_notify_vf_reset(vf);
+@@ -147,6 +148,11 @@ static inline void i40e_vc_disable_vf(struct i40e_vf *vf)
+ * ensure a reset.
+ */
+ for (i = 0; i < 20; i++) {
++ /* If PF is in VFs releasing state reset VF is impossible,
++ * so leave it.
++ */
++ if (test_bit(__I40E_VFS_RELEASING, pf->state))
++ return;
+ if (i40e_reset_vf(vf, false))
+ return;
+ usleep_range(10000, 20000);
+@@ -1574,6 +1580,8 @@ void i40e_free_vfs(struct i40e_pf *pf)
+
+ if (!pf->vf)
+ return;
++
++ set_bit(__I40E_VFS_RELEASING, pf->state);
+ while (test_and_set_bit(__I40E_VF_DISABLE, pf->state))
+ usleep_range(1000, 2000);
+
+@@ -1631,6 +1639,7 @@ void i40e_free_vfs(struct i40e_pf *pf)
+ }
+ }
+ clear_bit(__I40E_VF_DISABLE, pf->state);
++ clear_bit(__I40E_VFS_RELEASING, pf->state);
+ }
+
+ #ifdef CONFIG_PCI_IOV
+--
+2.30.2
+
--- /dev/null
+From cada40dcc3167fd465aa9b1b4ced15046a8d2df0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 09:58:27 +0100
+Subject: i40e: Fix parameters in aq_get_phy_register()
+
+From: Grzegorz Siwik <grzegorz.siwik@intel.com>
+
+[ Upstream commit b2d0efc4be7ed320e33eaa9b6dd6f3f6011ffb8e ]
+
+Change parameters order in aq_get_phy_register() due to wrong
+statistics in PHY reported by ethtool. Previously all PHY statistics were
+exactly the same for all interfaces
+Now statistics are reported correctly - different for different interfaces
+
+Fixes: 0514db37dd78 ("i40e: Extend PHY access with page change flag")
+Signed-off-by: Grzegorz Siwik <grzegorz.siwik@intel.com>
+Tested-by: Dave Switzer <david.switzer@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index 849e38be69ff..31d48a85cfaf 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -5285,7 +5285,7 @@ static int i40e_get_module_eeprom(struct net_device *netdev,
+
+ status = i40e_aq_get_phy_register(hw,
+ I40E_AQ_PHY_REG_ACCESS_EXTERNAL_MODULE,
+- true, addr, offset, &value, NULL);
++ addr, true, offset, &value, NULL);
+ if (status)
+ return -EIO;
+ data[i] = value;
+--
+2.30.2
+
--- /dev/null
+From 3566e37f5fa092c4e26aa25bdcf6e5bd9080e86b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 10:44:10 +0100
+Subject: i40e: fix receiving of single packets in xsk zero-copy mode
+
+From: Magnus Karlsson <magnus.karlsson@intel.com>
+
+[ Upstream commit 528060ef3e1105c5c3eba66ffbfc80e0825e2cce ]
+
+Fix so that single packets are received immediately instead of in
+batches of 8. If you sent 1 pps to a system, you received 8 packets
+every 8 seconds instead of 1 packet every second. The problem behind
+this was that the work_done reporting from the Tx part of the driver
+was broken. The work_done reporting in i40e controls not only the
+reporting back to the napi logic but also the setting of the interrupt
+throttling logic. When Tx or Rx reports that it has more to do,
+interrupts are throttled or coalesced and when they both report that
+they are done, interrupts are armed right away. If the wrong work_done
+value is returned, the logic will start to throttle interrupts in a
+situation where it should have just enabled them. This leads to the
+undesired batching behavior seen in user-space.
+
+Fix this by returning the correct boolean value from the Tx xsk
+zero-copy path. Return true if there is nothing to do or if we got
+fewer packets to process than we asked for. Return false if we got as
+many packets as the budget since there might be more packets we can
+process.
+
+Fixes: 3106c580fb7c ("i40e: Use batched xsk Tx interfaces to increase performance")
+Reported-by: Sreedevi Joshi <sreedevi.joshi@intel.com>
+Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Tested-by: Kiran Bhandare <kiranx.bhandare@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_xsk.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+index 37a21fb99922..7949f6b79f92 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+@@ -462,7 +462,7 @@ static bool i40e_xmit_zc(struct i40e_ring *xdp_ring, unsigned int budget)
+
+ nb_pkts = xsk_tx_peek_release_desc_batch(xdp_ring->xsk_pool, descs, budget);
+ if (!nb_pkts)
+- return false;
++ return true;
+
+ if (xdp_ring->next_to_use + nb_pkts >= xdp_ring->count) {
+ nb_processed = xdp_ring->count - xdp_ring->next_to_use;
+@@ -479,7 +479,7 @@ static bool i40e_xmit_zc(struct i40e_ring *xdp_ring, unsigned int budget)
+
+ i40e_update_tx_stats(xdp_ring, nb_pkts, total_bytes);
+
+- return true;
++ return nb_pkts < budget;
+ }
+
+ /**
+--
+2.30.2
+
--- /dev/null
+From 495821d58556697012250846b1f48b8b1d1ff07d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Mar 2021 12:57:17 +0200
+Subject: iwlwifi: fix 11ax disabled bit in the regulatory capability flags
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit 07cc40fec9a85e669ea12e161a438d2cbd76f1ed ]
+
+When version 2 of the regulatory capability flags API was implemented,
+the flag to disable 11ax was defined as bit 13, but this was later
+changed and the bit remained as bit 10, like in version 1. This was
+never changed in the driver, so we were checking for the wrong bit in
+newer devices. Fix it.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Fixes: e27c506a985c ("iwlwifi: regulatory: regulatory capabilities api change")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20210326125611.6d28516b59cd.Id0248d5e4662695254f49ce37b0268834ed52918@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+index 720193d16539..7da193a12871 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+@@ -232,7 +232,7 @@ enum iwl_reg_capa_flags_v2 {
+ REG_CAPA_V2_MCS_9_ALLOWED = BIT(6),
+ REG_CAPA_V2_WEATHER_DISABLED = BIT(7),
+ REG_CAPA_V2_40MHZ_ALLOWED = BIT(8),
+- REG_CAPA_V2_11AX_DISABLED = BIT(13),
++ REG_CAPA_V2_11AX_DISABLED = BIT(10),
+ };
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From 3a1416ae2e1e3ab17505e1fc898a9bd439a2b733 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 11:29:23 +0300
+Subject: mlxsw: spectrum: Fix ECN marking in tunnel decapsulation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 66167c310deb4ac1725f81004fb4b504676ad0bf ]
+
+Cited commit changed the behavior of the software data path with regards
+to the ECN marking of decapsulated packets. However, the commit did not
+change other callers of __INET_ECN_decapsulate(), namely mlxsw. The
+driver is using the function in order to ensure that the hardware and
+software data paths act the same with regards to the ECN marking of
+decapsulated packets.
+
+The discrepancy was uncovered by commit 5aa3c334a449 ("selftests:
+forwarding: vxlan_bridge_1d: Fix vxlan ecn decapsulate value") that
+aligned the selftest to the new behavior. Without this patch the
+selftest passes when used with veth pairs, but fails when used with
+mlxsw netdevs.
+
+Fix this by instructing the device to propagate the ECT(1) mark from the
+outer header to the inner header when the inner header is ECT(0), for
+both NVE and IP-in-IP tunnels.
+
+A helper is added in order not to duplicate the code between both tunnel
+types.
+
+Fixes: b723748750ec ("tunnel: Propagate ECT(1) when decapsulating as recommended by RFC6040")
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 15 +++++++++++++++
+ .../net/ethernet/mellanox/mlxsw/spectrum_ipip.c | 7 +++----
+ .../net/ethernet/mellanox/mlxsw/spectrum_nve.c | 7 +++----
+ 3 files changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+index a6956cfc9cb1..4399c9a4999d 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+@@ -21,6 +21,7 @@
+ #include <net/red.h>
+ #include <net/vxlan.h>
+ #include <net/flow_offload.h>
++#include <net/inet_ecn.h>
+
+ #include "port.h"
+ #include "core.h"
+@@ -346,6 +347,20 @@ struct mlxsw_sp_port_type_speed_ops {
+ u32 (*ptys_proto_cap_masked_get)(u32 eth_proto_cap);
+ };
+
++static inline u8 mlxsw_sp_tunnel_ecn_decap(u8 outer_ecn, u8 inner_ecn,
++ bool *trap_en)
++{
++ bool set_ce = false;
++
++ *trap_en = !!__INET_ECN_decapsulate(outer_ecn, inner_ecn, &set_ce);
++ if (set_ce)
++ return INET_ECN_CE;
++ else if (outer_ecn == INET_ECN_ECT_1 && inner_ecn == INET_ECN_ECT_0)
++ return INET_ECN_ECT_1;
++ else
++ return inner_ecn;
++}
++
+ static inline struct net_device *
+ mlxsw_sp_bridge_vxlan_dev_find(struct net_device *br_dev)
+ {
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c
+index 6ccca39bae84..64a8f838eb53 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c
+@@ -335,12 +335,11 @@ static int mlxsw_sp_ipip_ecn_decap_init_one(struct mlxsw_sp *mlxsw_sp,
+ u8 inner_ecn, u8 outer_ecn)
+ {
+ char tidem_pl[MLXSW_REG_TIDEM_LEN];
+- bool trap_en, set_ce = false;
+ u8 new_inner_ecn;
++ bool trap_en;
+
+- trap_en = __INET_ECN_decapsulate(outer_ecn, inner_ecn, &set_ce);
+- new_inner_ecn = set_ce ? INET_ECN_CE : inner_ecn;
+-
++ new_inner_ecn = mlxsw_sp_tunnel_ecn_decap(outer_ecn, inner_ecn,
++ &trap_en);
+ mlxsw_reg_tidem_pack(tidem_pl, outer_ecn, inner_ecn, new_inner_ecn,
+ trap_en, trap_en ? MLXSW_TRAP_ID_DECAP_ECN0 : 0);
+ return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(tidem), tidem_pl);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c
+index e5ec595593f4..9eba8fa684ae 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c
+@@ -909,12 +909,11 @@ static int __mlxsw_sp_nve_ecn_decap_init(struct mlxsw_sp *mlxsw_sp,
+ u8 inner_ecn, u8 outer_ecn)
+ {
+ char tndem_pl[MLXSW_REG_TNDEM_LEN];
+- bool trap_en, set_ce = false;
+ u8 new_inner_ecn;
++ bool trap_en;
+
+- trap_en = !!__INET_ECN_decapsulate(outer_ecn, inner_ecn, &set_ce);
+- new_inner_ecn = set_ce ? INET_ECN_CE : inner_ecn;
+-
++ new_inner_ecn = mlxsw_sp_tunnel_ecn_decap(outer_ecn, inner_ecn,
++ &trap_en);
+ mlxsw_reg_tndem_pack(tndem_pl, outer_ecn, inner_ecn, new_inner_ecn,
+ trap_en, trap_en ? MLXSW_TRAP_ID_DECAP_ECN0 : 0);
+ return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(tndem), tndem_pl);
+--
+2.30.2
+
--- /dev/null
+From 12b4493ab6ac94f4e1a10d683352cbc7cb2baa38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Apr 2021 18:57:44 +0200
+Subject: mptcp: forbit mcast-related sockopt on MPTCP sockets
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 86581852d7710990d8af9dadfe9a661f0abf2114 ]
+
+Unrolling mcast state at msk dismantel time is bug prone, as
+syzkaller reported:
+
+======================================================
+WARNING: possible circular locking dependency detected
+5.11.0-syzkaller #0 Not tainted
+------------------------------------------------------
+syz-executor905/8822 is trying to acquire lock:
+ffffffff8d678fe8 (rtnl_mutex){+.+.}-{3:3}, at: ipv6_sock_mc_close+0xd7/0x110 net/ipv6/mcast.c:323
+
+but task is already holding lock:
+ffff888024390120 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1600 [inline]
+ffff888024390120 (sk_lock-AF_INET6){+.+.}-{0:0}, at: mptcp6_release+0x57/0x130 net/mptcp/protocol.c:3507
+
+which lock already depends on the new lock.
+
+Instead we can simply forbit any mcast-related setsockopt
+
+Fixes: 717e79c867ca5 ("mptcp: Add setsockopt()/getsockopt() socket operations")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/protocol.c | 45 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+
+diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
+index 5932b0ebecc3..de9f2509acbe 100644
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -2863,6 +2863,48 @@ static int mptcp_setsockopt_v6(struct mptcp_sock *msk, int optname,
+ return ret;
+ }
+
++static bool mptcp_unsupported(int level, int optname)
++{
++ if (level == SOL_IP) {
++ switch (optname) {
++ case IP_ADD_MEMBERSHIP:
++ case IP_ADD_SOURCE_MEMBERSHIP:
++ case IP_DROP_MEMBERSHIP:
++ case IP_DROP_SOURCE_MEMBERSHIP:
++ case IP_BLOCK_SOURCE:
++ case IP_UNBLOCK_SOURCE:
++ case MCAST_JOIN_GROUP:
++ case MCAST_LEAVE_GROUP:
++ case MCAST_JOIN_SOURCE_GROUP:
++ case MCAST_LEAVE_SOURCE_GROUP:
++ case MCAST_BLOCK_SOURCE:
++ case MCAST_UNBLOCK_SOURCE:
++ case MCAST_MSFILTER:
++ return true;
++ }
++ return false;
++ }
++ if (level == SOL_IPV6) {
++ switch (optname) {
++ case IPV6_ADDRFORM:
++ case IPV6_ADD_MEMBERSHIP:
++ case IPV6_DROP_MEMBERSHIP:
++ case IPV6_JOIN_ANYCAST:
++ case IPV6_LEAVE_ANYCAST:
++ case MCAST_JOIN_GROUP:
++ case MCAST_LEAVE_GROUP:
++ case MCAST_JOIN_SOURCE_GROUP:
++ case MCAST_LEAVE_SOURCE_GROUP:
++ case MCAST_BLOCK_SOURCE:
++ case MCAST_UNBLOCK_SOURCE:
++ case MCAST_MSFILTER:
++ return true;
++ }
++ return false;
++ }
++ return false;
++}
++
+ static int mptcp_setsockopt(struct sock *sk, int level, int optname,
+ sockptr_t optval, unsigned int optlen)
+ {
+@@ -2871,6 +2913,9 @@ static int mptcp_setsockopt(struct sock *sk, int level, int optname,
+
+ pr_debug("msk=%p", msk);
+
++ if (mptcp_unsupported(level, optname))
++ return -ENOPROTOOPT;
++
+ if (level == SOL_SOCKET)
+ return mptcp_setsockopt_sol_socket(msk, optname, optval, optlen);
+
+--
+2.30.2
+
--- /dev/null
+From 76956661dc8e9bff9b82a10094c1ba2c2b8f5629 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Apr 2021 18:57:45 +0200
+Subject: mptcp: revert "mptcp: provide subflow aware release function"
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 0a3cc57978d1d1448312f8973bd84dca4a71433a ]
+
+This change reverts commit ad98dd37051e ("mptcp: provide subflow aware
+release function"). The latter introduced a deadlock spotted by
+syzkaller and is not needed anymore after the previous commit.
+
+Fixes: ad98dd37051e ("mptcp: provide subflow aware release function")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/protocol.c | 55 ++------------------------------------------
+ 1 file changed, 2 insertions(+), 53 deletions(-)
+
+diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
+index de9f2509acbe..e337b35a368f 100644
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -11,7 +11,6 @@
+ #include <linux/netdevice.h>
+ #include <linux/sched/signal.h>
+ #include <linux/atomic.h>
+-#include <linux/igmp.h>
+ #include <net/sock.h>
+ #include <net/inet_common.h>
+ #include <net/inet_hashtables.h>
+@@ -20,7 +19,6 @@
+ #include <net/tcp_states.h>
+ #if IS_ENABLED(CONFIG_MPTCP_IPV6)
+ #include <net/transp_v6.h>
+-#include <net/addrconf.h>
+ #endif
+ #include <net/mptcp.h>
+ #include <net/xfrm.h>
+@@ -3424,34 +3422,10 @@ static __poll_t mptcp_poll(struct file *file, struct socket *sock,
+ return mask;
+ }
+
+-static int mptcp_release(struct socket *sock)
+-{
+- struct mptcp_subflow_context *subflow;
+- struct sock *sk = sock->sk;
+- struct mptcp_sock *msk;
+-
+- if (!sk)
+- return 0;
+-
+- lock_sock(sk);
+-
+- msk = mptcp_sk(sk);
+-
+- mptcp_for_each_subflow(msk, subflow) {
+- struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
+-
+- ip_mc_drop_socket(ssk);
+- }
+-
+- release_sock(sk);
+-
+- return inet_release(sock);
+-}
+-
+ static const struct proto_ops mptcp_stream_ops = {
+ .family = PF_INET,
+ .owner = THIS_MODULE,
+- .release = mptcp_release,
++ .release = inet_release,
+ .bind = mptcp_bind,
+ .connect = mptcp_stream_connect,
+ .socketpair = sock_no_socketpair,
+@@ -3498,35 +3472,10 @@ void __init mptcp_proto_init(void)
+ }
+
+ #if IS_ENABLED(CONFIG_MPTCP_IPV6)
+-static int mptcp6_release(struct socket *sock)
+-{
+- struct mptcp_subflow_context *subflow;
+- struct mptcp_sock *msk;
+- struct sock *sk = sock->sk;
+-
+- if (!sk)
+- return 0;
+-
+- lock_sock(sk);
+-
+- msk = mptcp_sk(sk);
+-
+- mptcp_for_each_subflow(msk, subflow) {
+- struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
+-
+- ip_mc_drop_socket(ssk);
+- ipv6_sock_mc_close(ssk);
+- ipv6_sock_ac_close(ssk);
+- }
+-
+- release_sock(sk);
+- return inet6_release(sock);
+-}
+-
+ static const struct proto_ops mptcp_v6_stream_ops = {
+ .family = PF_INET6,
+ .owner = THIS_MODULE,
+- .release = mptcp6_release,
++ .release = inet6_release,
+ .bind = mptcp_bind,
+ .connect = mptcp_stream_connect,
+ .socketpair = sock_no_socketpair,
+--
+2.30.2
+
--- /dev/null
+From 6905f0e6d46c5df0b2358d01f6ac79d85a32dc0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Apr 2021 12:52:48 +0800
+Subject: net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb
+
+From: Yunjian Wang <wangyunjian@huawei.com>
+
+[ Upstream commit 990b03b05b2fba79de2a1ee9dc359fc552d95ba6 ]
+
+The 'unlocked_driver_cb' struct field in 'bo' is not being initialized
+in tcf_block_offload_init(). The uninitialized 'unlocked_driver_cb'
+will be used when calling unlocked_driver_cb(). So initialize 'bo' to
+zero to avoid the issue.
+
+Addresses-Coverity: ("Uninitialized scalar variable")
+Fixes: 0fdcf78d5973 ("net: use flow_indr_dev_setup_offload()")
+Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/cls_api.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 87cac07da7c3..b3a2cba130a1 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -646,7 +646,7 @@ static void tc_block_indr_cleanup(struct flow_block_cb *block_cb)
+ struct net_device *dev = block_cb->indr.dev;
+ struct Qdisc *sch = block_cb->indr.sch;
+ struct netlink_ext_ack extack = {};
+- struct flow_block_offload bo;
++ struct flow_block_offload bo = {};
+
+ tcf_block_offload_init(&bo, dev, sch, FLOW_BLOCK_UNBIND,
+ block_cb->indr.binder_type,
+--
+2.30.2
+
--- /dev/null
+From 86d5b8dbb8364ea9da48fcba27dcf671d129c191 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 18:30:16 +0300
+Subject: net: dsa: Fix type was not set for devlink port
+
+From: Maxim Kochetkov <fido_max@inbox.ru>
+
+[ Upstream commit fb6ec87f7229b92baa81b35cbc76f2626d5bfadb ]
+
+If PHY is not available on DSA port (described at devicetree but absent or
+failed to detect) then kernel prints warning after 3700 secs:
+
+[ 3707.948771] ------------[ cut here ]------------
+[ 3707.948784] Type was not set for devlink port.
+[ 3707.948894] WARNING: CPU: 1 PID: 17 at net/core/devlink.c:8097 0xc083f9d8
+
+We should unregister the devlink port as a user port and
+re-register it as an unused port before executing "continue" in case of
+dsa_port_setup error.
+
+Fixes: 86f8b1c01a0a ("net: dsa: Do not make user port errors fatal")
+Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/dsa2.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
+index a04fd637b4cd..3ada338d7e08 100644
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -533,8 +533,14 @@ static int dsa_tree_setup_switches(struct dsa_switch_tree *dst)
+
+ list_for_each_entry(dp, &dst->ports, list) {
+ err = dsa_port_setup(dp);
+- if (err)
++ if (err) {
++ dsa_port_devlink_teardown(dp);
++ dp->type = DSA_PORT_TYPE_UNUSED;
++ err = dsa_port_devlink_setup(dp);
++ if (err)
++ goto teardown;
+ continue;
++ }
+ }
+
+ return 0;
+--
+2.30.2
+
--- /dev/null
+From a7eb33d7553ff58671bb65debb22fe78758932e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 21:10:43 +0800
+Subject: net: hns3: clear VF down state bit before request link status
+
+From: Guangbin Huang <huangguangbin2@huawei.com>
+
+[ Upstream commit ed7bedd2c3ca040f1e8ea02c6590a93116b1ec78 ]
+
+Currently, the VF down state bit is cleared after VF sending
+link status request command. There is problem that when VF gets
+link status replied from PF, the down state bit may still set
+as 1. In this case, the link status replied from PF will be
+ignored and always set VF link status to down.
+
+To fix this problem, clear VF down state bit before VF requests
+link status.
+
+Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
+Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 674b3a22e91f..3bd7bc794677 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -2575,14 +2575,14 @@ static int hclgevf_ae_start(struct hnae3_handle *handle)
+ {
+ struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle);
+
++ clear_bit(HCLGEVF_STATE_DOWN, &hdev->state);
++
+ hclgevf_reset_tqp_stats(handle);
+
+ hclgevf_request_link_info(hdev);
+
+ hclgevf_update_link_mode(hdev);
+
+- clear_bit(HCLGEVF_STATE_DOWN, &hdev->state);
+-
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 77f9be407c53f49637f469898ff643f4e5bd487d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 15:42:53 +0300
+Subject: net: macb: restore cmp registers on resume path
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit a14d273ba15968495896a38b7b3399dba66d0270 ]
+
+Restore CMP screener registers on resume path.
+
+Fixes: c1e85c6ce57ef ("net: macb: save/restore the remaining registers and features")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 07cdb38e7d11..fbedbceef2d1 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -3235,6 +3235,9 @@ static void gem_prog_cmp_regs(struct macb *bp, struct ethtool_rx_flow_spec *fs)
+ bool cmp_b = false;
+ bool cmp_c = false;
+
++ if (!macb_is_gem(bp))
++ return;
++
+ tp4sp_v = &(fs->h_u.tcp_ip4_spec);
+ tp4sp_m = &(fs->m_u.tcp_ip4_spec);
+
+@@ -3603,6 +3606,7 @@ static void macb_restore_features(struct macb *bp)
+ {
+ struct net_device *netdev = bp->dev;
+ netdev_features_t features = netdev->features;
++ struct ethtool_rx_fs_item *item;
+
+ /* TX checksum offload */
+ macb_set_txcsum_feature(bp, features);
+@@ -3611,6 +3615,9 @@ static void macb_restore_features(struct macb *bp)
+ macb_set_rxcsum_feature(bp, features);
+
+ /* RX Flow Filters */
++ list_for_each_entry(item, &bp->rx_fs_list.list, list)
++ gem_prog_cmp_regs(bp, &item->fs);
++
+ macb_set_rxflow_feature(bp, features);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 4be9c151e751fb6070b09cf9df0197fc794a050c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Mar 2021 17:22:03 +0200
+Subject: net/mlx5: Delete auxiliary bus driver eth-rep first
+
+From: Maor Dickman <maord@nvidia.com>
+
+[ Upstream commit 1f90aedfb496ccccf862c7b7c0889af20c2fc61a ]
+
+Delete auxiliary bus drivers flow deletes the eth driver
+first and then the eth-reps driver but eth-reps devices resources
+are depend on eth device.
+
+Fixed by changing the delete order of auxiliary bus drivers to delete
+the eth-rep driver first and after it the eth driver.
+
+Fixes: 601c10c89cbb ("net/mlx5: Delete custom device management logic")
+Signed-off-by: Maor Dickman <maord@nvidia.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/dev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+index b051417ede67..9153c9bda96f 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+@@ -191,12 +191,12 @@ static bool is_ib_supported(struct mlx5_core_dev *dev)
+ }
+
+ enum {
+- MLX5_INTERFACE_PROTOCOL_ETH_REP,
+ MLX5_INTERFACE_PROTOCOL_ETH,
++ MLX5_INTERFACE_PROTOCOL_ETH_REP,
+
++ MLX5_INTERFACE_PROTOCOL_IB,
+ MLX5_INTERFACE_PROTOCOL_IB_REP,
+ MLX5_INTERFACE_PROTOCOL_MPIB,
+- MLX5_INTERFACE_PROTOCOL_IB,
+
+ MLX5_INTERFACE_PROTOCOL_VNET,
+ };
+--
+2.30.2
+
--- /dev/null
+From d26a2cd0463c4cc170e28cfffb8958d4815db436 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 16:58:10 -0600
+Subject: net/mlx5: Don't request more than supported EQs
+
+From: Daniel Jurgens <danielj@mellanox.com>
+
+[ Upstream commit a7b76002ae78cd230ee652ccdfedf21aa94fcecc ]
+
+Calculating the number of compeltion EQs based on the number of
+available IRQ vectors doesn't work now that all async EQs share one IRQ.
+Thus the max number of EQs can be exceeded on systems with more than
+approximately 256 CPUs. Take this into account when calculating the
+number of available completion EQs.
+
+Fixes: 81bfa206032a ("net/mlx5: Use a single IRQ for all async EQs")
+Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
+Reviewed-by: Parav Pandit <parav@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eq.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+index fc0afa03d407..b5f48efebd71 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+@@ -928,13 +928,24 @@ void mlx5_core_eq_free_irqs(struct mlx5_core_dev *dev)
+ mutex_unlock(&table->lock);
+ }
+
++#ifdef CONFIG_INFINIBAND_ON_DEMAND_PAGING
++#define MLX5_MAX_ASYNC_EQS 4
++#else
++#define MLX5_MAX_ASYNC_EQS 3
++#endif
++
+ int mlx5_eq_table_create(struct mlx5_core_dev *dev)
+ {
+ struct mlx5_eq_table *eq_table = dev->priv.eq_table;
++ int num_eqs = MLX5_CAP_GEN(dev, max_num_eqs) ?
++ MLX5_CAP_GEN(dev, max_num_eqs) :
++ 1 << MLX5_CAP_GEN(dev, log_max_eq);
+ int err;
+
+ eq_table->num_comp_eqs =
+- mlx5_irq_get_num_comp(eq_table->irq_table);
++ min_t(int,
++ mlx5_irq_get_num_comp(eq_table->irq_table),
++ num_eqs - MLX5_MAX_ASYNC_EQS);
+
+ err = create_async_eqs(dev);
+ if (err) {
+--
+2.30.2
+
--- /dev/null
+From 9a30d5cbd84951be40869d2f6ad49521a0e6ef63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 09:46:09 +0200
+Subject: net/mlx5: Fix HW spec violation configuring uplink
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit 1a73704c82ed4ee95532ac04645d02075bd1ce3d ]
+
+Make sure to modify uplink port to follow only if the uplink_follow
+capability is set as required by the HW spec. Failure to do so causes
+traffic to the uplink representor net device to cease after switching to
+switchdev mode.
+
+Fixes: 7d0314b11cdd ("net/mlx5e: Modify uplink state on interface up/down")
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+index f0ceae65f6cf..8afbb485197e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+@@ -1103,8 +1103,9 @@ static void mlx5e_uplink_rep_enable(struct mlx5e_priv *priv)
+
+ mlx5e_rep_tc_enable(priv);
+
+- mlx5_modify_vport_admin_state(mdev, MLX5_VPORT_STATE_OP_MOD_UPLINK,
+- 0, 0, MLX5_VPORT_ADMIN_STATE_AUTO);
++ if (MLX5_CAP_GEN(mdev, uplink_follow))
++ mlx5_modify_vport_admin_state(mdev, MLX5_VPORT_STATE_OP_MOD_UPLINK,
++ 0, 0, MLX5_VPORT_ADMIN_STATE_AUTO);
+ mlx5_lag_add(mdev, netdev);
+ priv->events_nb.notifier_call = uplink_rep_async_event;
+ mlx5_notifier_register(mdev, &priv->events_nb);
+--
+2.30.2
+
--- /dev/null
+From c30e55f0357af897f6027cd1aeca0b4338db2ec8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Apr 2021 12:55:00 +0300
+Subject: net/mlx5: Fix PBMC register mapping
+
+From: Aya Levin <ayal@nvidia.com>
+
+[ Upstream commit 534b1204ca4694db1093b15cf3e79a99fcb6a6da ]
+
+Add reserved mapping to cover all the register in order to avoid setting
+arbitrary values to newer FW which implements the reserved fields.
+
+Fixes: 50b4a3c23646 ("net/mlx5: PPTB and PBMC register firmware command support")
+Signed-off-by: Aya Levin <ayal@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mlx5/mlx5_ifc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index 443dda54d851..6370ba10f1fd 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -10108,7 +10108,7 @@ struct mlx5_ifc_pbmc_reg_bits {
+
+ struct mlx5_ifc_bufferx_reg_bits buffer[10];
+
+- u8 reserved_at_2e0[0x40];
++ u8 reserved_at_2e0[0x80];
+ };
+
+ struct mlx5_ifc_qtct_reg_bits {
+--
+2.30.2
+
--- /dev/null
+From 9ab5f8d759fb938e645d27ca6d5c468d773b1ea5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 16:01:37 +0200
+Subject: net/mlx5: Fix placement of log_max_flow_counter
+
+From: Raed Salem <raeds@nvidia.com>
+
+[ Upstream commit a14587dfc5ad2312dabdd42a610d80ecd0dc8bea ]
+
+The cited commit wrongly placed log_max_flow_counter field of
+mlx5_ifc_flow_table_prop_layout_bits, align it to the HW spec intended
+placement.
+
+Fixes: 16f1c5bb3ed7 ("net/mlx5: Check device capability for maximum flow counters")
+Signed-off-by: Raed Salem <raeds@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mlx5/mlx5_ifc.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index 442c0160caab..def58d333357 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -437,11 +437,11 @@ struct mlx5_ifc_flow_table_prop_layout_bits {
+ u8 reserved_at_60[0x18];
+ u8 log_max_ft_num[0x8];
+
+- u8 reserved_at_80[0x18];
++ u8 reserved_at_80[0x10];
++ u8 log_max_flow_counter[0x8];
+ u8 log_max_destination[0x8];
+
+- u8 log_max_flow_counter[0x8];
+- u8 reserved_at_a8[0x10];
++ u8 reserved_at_a0[0x18];
+ u8 log_max_flow[0x8];
+
+ u8 reserved_at_c0[0x40];
+--
+2.30.2
+
--- /dev/null
+From 1fc9b71b9fd902e2c060b03c917bb6a6eca35934 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Apr 2021 10:50:50 +0300
+Subject: net/mlx5: Fix PPLM register mapping
+
+From: Aya Levin <ayal@nvidia.com>
+
+[ Upstream commit ce28f0fd670ddffcd564ce7119bdefbaf08f02d3 ]
+
+Add reserved mapping to cover all the register in order to avoid
+setting arbitrary values to newer FW which implements the reserved
+fields.
+
+Fixes: a58837f52d43 ("net/mlx5e: Expose FEC feilds and related capability bit")
+Signed-off-by: Aya Levin <ayal@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mlx5/mlx5_ifc.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index def58d333357..443dda54d851 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -8769,6 +8769,8 @@ struct mlx5_ifc_pplm_reg_bits {
+
+ u8 fec_override_admin_100g_2x[0x10];
+ u8 fec_override_admin_50g_1x[0x10];
++
++ u8 reserved_at_140[0x140];
+ };
+
+ struct mlx5_ifc_ppcnt_reg_bits {
+--
+2.30.2
+
--- /dev/null
+From 95fa49afaddc6a700aeda18fc37eadf71208539e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 12:25:06 +0200
+Subject: net/mlx5e: Fix ethtool indication of connector type
+
+From: Aya Levin <ayal@nvidia.com>
+
+[ Upstream commit 3211434dfe7a66fcf55e43961ea524b78336c04c ]
+
+Use connector_type read from PTYS register when it's valid, based on
+corresponding capability bit.
+
+Fixes: 5b4793f81745 ("net/mlx5e: Add support for reading connector type from PTYS")
+Signed-off-by: Aya Levin <ayal@nvidia.com>
+Reviewed-by: Eran Ben Elisha <eranbe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/en_ethtool.c | 22 +++++++++----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index c9d01e705ab2..d3d532fdf04e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -747,11 +747,11 @@ static int get_fec_supported_advertised(struct mlx5_core_dev *dev,
+ return 0;
+ }
+
+-static void ptys2ethtool_supported_advertised_port(struct ethtool_link_ksettings *link_ksettings,
+- u32 eth_proto_cap,
+- u8 connector_type, bool ext)
++static void ptys2ethtool_supported_advertised_port(struct mlx5_core_dev *mdev,
++ struct ethtool_link_ksettings *link_ksettings,
++ u32 eth_proto_cap, u8 connector_type)
+ {
+- if ((!connector_type && !ext) || connector_type >= MLX5E_CONNECTOR_TYPE_NUMBER) {
++ if (!MLX5_CAP_PCAM_FEATURE(mdev, ptys_connector_type)) {
+ if (eth_proto_cap & (MLX5E_PROT_MASK(MLX5E_10GBASE_CR)
+ | MLX5E_PROT_MASK(MLX5E_10GBASE_SR)
+ | MLX5E_PROT_MASK(MLX5E_40GBASE_CR4)
+@@ -887,9 +887,9 @@ static int ptys2connector_type[MLX5E_CONNECTOR_TYPE_NUMBER] = {
+ [MLX5E_PORT_OTHER] = PORT_OTHER,
+ };
+
+-static u8 get_connector_port(u32 eth_proto, u8 connector_type, bool ext)
++static u8 get_connector_port(struct mlx5_core_dev *mdev, u32 eth_proto, u8 connector_type)
+ {
+- if ((connector_type || ext) && connector_type < MLX5E_CONNECTOR_TYPE_NUMBER)
++ if (MLX5_CAP_PCAM_FEATURE(mdev, ptys_connector_type))
+ return ptys2connector_type[connector_type];
+
+ if (eth_proto &
+@@ -990,11 +990,11 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
+ data_rate_oper, link_ksettings);
+
+ eth_proto_oper = eth_proto_oper ? eth_proto_oper : eth_proto_cap;
+-
+- link_ksettings->base.port = get_connector_port(eth_proto_oper,
+- connector_type, ext);
+- ptys2ethtool_supported_advertised_port(link_ksettings, eth_proto_admin,
+- connector_type, ext);
++ connector_type = connector_type < MLX5E_CONNECTOR_TYPE_NUMBER ?
++ connector_type : MLX5E_PORT_UNKNOWN;
++ link_ksettings->base.port = get_connector_port(mdev, eth_proto_oper, connector_type);
++ ptys2ethtool_supported_advertised_port(mdev, link_ksettings, eth_proto_admin,
++ connector_type);
+ get_lp_advertising(mdev, eth_proto_lp, link_ksettings);
+
+ if (an_status == MLX5_AN_COMPLETE)
+--
+2.30.2
+
--- /dev/null
+From f9fb82f19c848d6e14dc42058ebffca5ad64ec81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Mar 2021 01:29:01 +0200
+Subject: net/mlx5e: Fix mapping of ct_label zero
+
+From: Ariel Levkovich <lariel@nvidia.com>
+
+[ Upstream commit d24f847e54214049814b9515771622eaab3f42ab ]
+
+ct_label 0 is a default label each flow has and therefore
+there can be rules that match on ct_label=0 without a prior
+rule that set the ct_label to this value.
+
+The ct_label value is not used directly in the HW rules and
+instead it is mapped to some id within a defined range and this
+id is used to set and match the metadata register which carries
+the ct_label.
+
+If we have a rule that matches on ct_label=0, the hw rule will
+perform matching on a value that is != 0 because of the mapping
+from label to id. Since the metadata register default value is
+0 and it was never set before to anything else by an action that
+sets the ct_label, there will always be a mismatch between that
+register and the value in the rule.
+
+To support such rule, a forced mapping of ct_label 0 to id=0
+is done so that it will match the metadata register default
+value of 0.
+
+Fixes: 54b154ecfb8c ("net/mlx5e: CT: Map 128 bits labels to 32 bit map ID")
+Signed-off-by: Ariel Levkovich <lariel@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/en/tc_ct.c | 36 +++++++++++++++----
+ 1 file changed, 29 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+index b42396df3111..0469f53dfb99 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+@@ -184,6 +184,28 @@ mlx5_tc_ct_entry_has_nat(struct mlx5_ct_entry *entry)
+ return !!(entry->tuple_nat_node.next);
+ }
+
++static int
++mlx5_get_label_mapping(struct mlx5_tc_ct_priv *ct_priv,
++ u32 *labels, u32 *id)
++{
++ if (!memchr_inv(labels, 0, sizeof(u32) * 4)) {
++ *id = 0;
++ return 0;
++ }
++
++ if (mapping_add(ct_priv->labels_mapping, labels, id))
++ return -EOPNOTSUPP;
++
++ return 0;
++}
++
++static void
++mlx5_put_label_mapping(struct mlx5_tc_ct_priv *ct_priv, u32 id)
++{
++ if (id)
++ mapping_remove(ct_priv->labels_mapping, id);
++}
++
+ static int
+ mlx5_tc_ct_rule_to_tuple(struct mlx5_ct_tuple *tuple, struct flow_rule *rule)
+ {
+@@ -435,7 +457,7 @@ mlx5_tc_ct_entry_del_rule(struct mlx5_tc_ct_priv *ct_priv,
+ mlx5_tc_rule_delete(netdev_priv(ct_priv->netdev), zone_rule->rule, attr);
+ mlx5e_mod_hdr_detach(ct_priv->dev,
+ ct_priv->mod_hdr_tbl, zone_rule->mh);
+- mapping_remove(ct_priv->labels_mapping, attr->ct_attr.ct_labels_id);
++ mlx5_put_label_mapping(ct_priv, attr->ct_attr.ct_labels_id);
+ kfree(attr);
+ }
+
+@@ -638,8 +660,8 @@ mlx5_tc_ct_entry_create_mod_hdr(struct mlx5_tc_ct_priv *ct_priv,
+ if (!meta)
+ return -EOPNOTSUPP;
+
+- err = mapping_add(ct_priv->labels_mapping, meta->ct_metadata.labels,
+- &attr->ct_attr.ct_labels_id);
++ err = mlx5_get_label_mapping(ct_priv, meta->ct_metadata.labels,
++ &attr->ct_attr.ct_labels_id);
+ if (err)
+ return -EOPNOTSUPP;
+ if (nat) {
+@@ -675,7 +697,7 @@ mlx5_tc_ct_entry_create_mod_hdr(struct mlx5_tc_ct_priv *ct_priv,
+
+ err_mapping:
+ dealloc_mod_hdr_actions(&mod_acts);
+- mapping_remove(ct_priv->labels_mapping, attr->ct_attr.ct_labels_id);
++ mlx5_put_label_mapping(ct_priv, attr->ct_attr.ct_labels_id);
+ return err;
+ }
+
+@@ -743,7 +765,7 @@ mlx5_tc_ct_entry_add_rule(struct mlx5_tc_ct_priv *ct_priv,
+ err_rule:
+ mlx5e_mod_hdr_detach(ct_priv->dev,
+ ct_priv->mod_hdr_tbl, zone_rule->mh);
+- mapping_remove(ct_priv->labels_mapping, attr->ct_attr.ct_labels_id);
++ mlx5_put_label_mapping(ct_priv, attr->ct_attr.ct_labels_id);
+ err_mod_hdr:
+ kfree(attr);
+ err_attr:
+@@ -1198,7 +1220,7 @@ void mlx5_tc_ct_match_del(struct mlx5_tc_ct_priv *priv, struct mlx5_ct_attr *ct_
+ if (!priv || !ct_attr->ct_labels_id)
+ return;
+
+- mapping_remove(priv->labels_mapping, ct_attr->ct_labels_id);
++ mlx5_put_label_mapping(priv, ct_attr->ct_labels_id);
+ }
+
+ int
+@@ -1276,7 +1298,7 @@ mlx5_tc_ct_match_add(struct mlx5_tc_ct_priv *priv,
+ ct_labels[1] = key->ct_labels[1] & mask->ct_labels[1];
+ ct_labels[2] = key->ct_labels[2] & mask->ct_labels[2];
+ ct_labels[3] = key->ct_labels[3] & mask->ct_labels[3];
+- if (mapping_add(priv->labels_mapping, ct_labels, &ct_attr->ct_labels_id))
++ if (mlx5_get_label_mapping(priv, ct_labels, &ct_attr->ct_labels_id))
+ return -EOPNOTSUPP;
+ mlx5e_tc_match_to_reg_match(spec, LABELS_TO_REG, ct_attr->ct_labels_id,
+ MLX5_CT_LABELS_MASK);
+--
+2.30.2
+
--- /dev/null
+From a62c5ce9c13cc524930a7c7adf32556ac95a3f38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 14:58:01 +0200
+Subject: net/mlx5e: Guarantee room for XSK wakeup NOP on async ICOSQ
+
+From: Tariq Toukan <tariqt@nvidia.com>
+
+[ Upstream commit 3ff3874fa0b261ef74f2bfb008a82ab1601c11eb ]
+
+XSK wakeup flow triggers an IRQ by posting a NOP WQE and hitting
+the doorbell on the async ICOSQ.
+It maintains its state so that it doesn't issue another NOP WQE
+if it has an outstanding one already.
+
+For this flow to work properly, the NOP post must not fail.
+Make sure to reserve room for the NOP WQE in all WQE posts to the
+async ICOSQ.
+
+Fixes: 8d94b590f1e4 ("net/mlx5e: Turn XSK ICOSQ into a general asynchronous one")
+Fixes: 1182f3659357 ("net/mlx5e: kTLS, Add kTLS RX HW offload support")
+Fixes: 0419d8c9d8f8 ("net/mlx5e: kTLS, Add kTLS RX resync support")
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Reviewed-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 +
+ .../net/ethernet/mellanox/mlx5/core/en/txrx.h | 6 ++++++
+ .../mellanox/mlx5/core/en_accel/ktls_rx.c | 18 +++++++---------
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 21 ++++++++++++++++++-
+ 4 files changed, 34 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+index f258f2f9b8cf..9061a30a93bc 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+@@ -510,6 +510,7 @@ struct mlx5e_icosq {
+ struct mlx5_wq_cyc wq;
+ void __iomem *uar_map;
+ u32 sqn;
++ u16 reserved_room;
+ unsigned long state;
+
+ /* control path */
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
+index 4880f2179273..05d673e5289d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
+@@ -434,4 +434,10 @@ static inline u16 mlx5e_stop_room_for_wqe(u16 wqe_size)
+ return wqe_size * 2 - 1;
+ }
+
++static inline bool mlx5e_icosq_can_post_wqe(struct mlx5e_icosq *sq, u16 wqe_size)
++{
++ u16 room = sq->reserved_room + mlx5e_stop_room_for_wqe(wqe_size);
++
++ return mlx5e_wqc_has_room_for(&sq->wq, sq->cc, sq->pc, room);
++}
+ #endif
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
+index d06532d0baa4..c0bd4e55ed8c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
+@@ -137,11 +137,10 @@ post_static_params(struct mlx5e_icosq *sq,
+ {
+ struct mlx5e_set_tls_static_params_wqe *wqe;
+ struct mlx5e_icosq_wqe_info wi;
+- u16 pi, num_wqebbs, room;
++ u16 pi, num_wqebbs;
+
+ num_wqebbs = MLX5E_TLS_SET_STATIC_PARAMS_WQEBBS;
+- room = mlx5e_stop_room_for_wqe(num_wqebbs);
+- if (unlikely(!mlx5e_wqc_has_room_for(&sq->wq, sq->cc, sq->pc, room)))
++ if (unlikely(!mlx5e_icosq_can_post_wqe(sq, num_wqebbs)))
+ return ERR_PTR(-ENOSPC);
+
+ pi = mlx5e_icosq_get_next_pi(sq, num_wqebbs);
+@@ -168,11 +167,10 @@ post_progress_params(struct mlx5e_icosq *sq,
+ {
+ struct mlx5e_set_tls_progress_params_wqe *wqe;
+ struct mlx5e_icosq_wqe_info wi;
+- u16 pi, num_wqebbs, room;
++ u16 pi, num_wqebbs;
+
+ num_wqebbs = MLX5E_TLS_SET_PROGRESS_PARAMS_WQEBBS;
+- room = mlx5e_stop_room_for_wqe(num_wqebbs);
+- if (unlikely(!mlx5e_wqc_has_room_for(&sq->wq, sq->cc, sq->pc, room)))
++ if (unlikely(!mlx5e_icosq_can_post_wqe(sq, num_wqebbs)))
+ return ERR_PTR(-ENOSPC);
+
+ pi = mlx5e_icosq_get_next_pi(sq, num_wqebbs);
+@@ -277,17 +275,15 @@ resync_post_get_progress_params(struct mlx5e_icosq *sq,
+
+ buf->priv_rx = priv_rx;
+
+- BUILD_BUG_ON(MLX5E_KTLS_GET_PROGRESS_WQEBBS != 1);
+-
+ spin_lock_bh(&sq->channel->async_icosq_lock);
+
+- if (unlikely(!mlx5e_wqc_has_room_for(&sq->wq, sq->cc, sq->pc, 1))) {
++ if (unlikely(!mlx5e_icosq_can_post_wqe(sq, MLX5E_KTLS_GET_PROGRESS_WQEBBS))) {
+ spin_unlock_bh(&sq->channel->async_icosq_lock);
+ err = -ENOSPC;
+ goto err_dma_unmap;
+ }
+
+- pi = mlx5e_icosq_get_next_pi(sq, 1);
++ pi = mlx5e_icosq_get_next_pi(sq, MLX5E_KTLS_GET_PROGRESS_WQEBBS);
+ wqe = MLX5E_TLS_FETCH_GET_PROGRESS_PARAMS_WQE(sq, pi);
+
+ #define GET_PSV_DS_CNT (DIV_ROUND_UP(sizeof(*wqe), MLX5_SEND_WQE_DS))
+@@ -307,7 +303,7 @@ resync_post_get_progress_params(struct mlx5e_icosq *sq,
+
+ wi = (struct mlx5e_icosq_wqe_info) {
+ .wqe_type = MLX5E_ICOSQ_WQE_GET_PSV_TLS,
+- .num_wqebbs = 1,
++ .num_wqebbs = MLX5E_KTLS_GET_PROGRESS_WQEBBS,
+ .tls_get_params.buf = buf,
+ };
+ icosq_fill_wi(sq, pi, &wi);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index b6324d11a008..7bb189e65628 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -1058,6 +1058,7 @@ static int mlx5e_alloc_icosq(struct mlx5e_channel *c,
+
+ sq->channel = c;
+ sq->uar_map = mdev->mlx5e_res.bfreg.map;
++ sq->reserved_room = param->stop_room;
+
+ param->wq.db_numa_node = cpu_to_node(c->cpu);
+ err = mlx5_wq_cyc_create(mdev, ¶m->wq, sqc_wq, wq, &sq->wq_ctrl);
+@@ -2299,6 +2300,24 @@ void mlx5e_build_icosq_param(struct mlx5e_priv *priv,
+ mlx5e_build_ico_cq_param(priv, log_wq_size, ¶m->cqp);
+ }
+
++static void mlx5e_build_async_icosq_param(struct mlx5e_priv *priv,
++ struct mlx5e_params *params,
++ u8 log_wq_size,
++ struct mlx5e_sq_param *param)
++{
++ void *sqc = param->sqc;
++ void *wq = MLX5_ADDR_OF(sqc, sqc, wq);
++
++ mlx5e_build_sq_param_common(priv, param);
++
++ /* async_icosq is used by XSK only if xdp_prog is active */
++ if (params->xdp_prog)
++ param->stop_room = mlx5e_stop_room_for_wqe(1); /* for XSK NOP */
++ MLX5_SET(sqc, sqc, reg_umr, MLX5_CAP_ETH(priv->mdev, reg_umr_sq));
++ MLX5_SET(wq, wq, log_wq_sz, log_wq_size);
++ mlx5e_build_ico_cq_param(priv, log_wq_size, ¶m->cqp);
++}
++
+ void mlx5e_build_xdpsq_param(struct mlx5e_priv *priv,
+ struct mlx5e_params *params,
+ struct mlx5e_sq_param *param)
+@@ -2347,7 +2366,7 @@ static void mlx5e_build_channel_param(struct mlx5e_priv *priv,
+ mlx5e_build_sq_param(priv, params, &cparam->txq_sq);
+ mlx5e_build_xdpsq_param(priv, params, &cparam->xdp_sq);
+ mlx5e_build_icosq_param(priv, icosq_log_wq_sz, &cparam->icosq);
+- mlx5e_build_icosq_param(priv, async_icosq_log_wq_sz, &cparam->async_icosq);
++ mlx5e_build_async_icosq_param(priv, params, async_icosq_log_wq_sz, &cparam->async_icosq);
+ }
+
+ int mlx5e_open_channels(struct mlx5e_priv *priv,
+--
+2.30.2
+
--- /dev/null
+From 275003f70ce53886d51130abd58f6b6bae0b9d4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 10:20:39 -0500
+Subject: net/ncsi: Avoid channel_monitor hrtimer deadlock
+
+From: Milton Miller <miltonm@us.ibm.com>
+
+[ Upstream commit 03cb4d05b4ea9a3491674ca40952adb708d549fa ]
+
+Calling ncsi_stop_channel_monitor from channel_monitor is a guaranteed
+deadlock on SMP because stop calls del_timer_sync on the timer that
+invoked channel_monitor as its timer function.
+
+Recognise the inherent race of marking the monitor disabled before
+deleting the timer by just returning if enable was cleared. After
+a timeout (the default case -- reset to START when response received)
+just mark the monitor.enabled false.
+
+If the channel has an entry on the channel_queue list, or if the
+state is not ACTIVE or INACTIVE, then warn and mark the timer stopped
+and don't restart, as the locking is broken somehow.
+
+Fixes: 0795fb2021f0 ("net/ncsi: Stop monitor if channel times out or is inactive")
+Signed-off-by: Milton Miller <miltonm@us.ibm.com>
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ncsi/ncsi-manage.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
+index a9cb355324d1..ffff8da707b8 100644
+--- a/net/ncsi/ncsi-manage.c
++++ b/net/ncsi/ncsi-manage.c
+@@ -105,13 +105,20 @@ static void ncsi_channel_monitor(struct timer_list *t)
+ monitor_state = nc->monitor.state;
+ spin_unlock_irqrestore(&nc->lock, flags);
+
+- if (!enabled || chained) {
+- ncsi_stop_channel_monitor(nc);
+- return;
+- }
++ if (!enabled)
++ return; /* expected race disabling timer */
++ if (WARN_ON_ONCE(chained))
++ goto bad_state;
++
+ if (state != NCSI_CHANNEL_INACTIVE &&
+ state != NCSI_CHANNEL_ACTIVE) {
+- ncsi_stop_channel_monitor(nc);
++bad_state:
++ netdev_warn(ndp->ndev.dev,
++ "Bad NCSI monitor state channel %d 0x%x %s queue\n",
++ nc->id, state, chained ? "on" : "off");
++ spin_lock_irqsave(&nc->lock, flags);
++ nc->monitor.enabled = false;
++ spin_unlock_irqrestore(&nc->lock, flags);
+ return;
+ }
+
+@@ -136,10 +143,9 @@ static void ncsi_channel_monitor(struct timer_list *t)
+ ncsi_report_link(ndp, true);
+ ndp->flags |= NCSI_DEV_RESHUFFLE;
+
+- ncsi_stop_channel_monitor(nc);
+-
+ ncm = &nc->modes[NCSI_MODE_LINK];
+ spin_lock_irqsave(&nc->lock, flags);
++ nc->monitor.enabled = false;
+ nc->state = NCSI_CHANNEL_INVISIBLE;
+ ncm->data[2] &= ~0x1;
+ spin_unlock_irqrestore(&nc->lock, flags);
+--
+2.30.2
+
--- /dev/null
+From 8cfc9198d2c5f7ac5158235f86a1cc88cc94857d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 15:00:24 -0700
+Subject: net: phy: broadcom: Only advertise EEE for supported modes
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit c056d480b40a68f2520ccc156c7fae672d69d57d ]
+
+We should not be advertising EEE for modes that we do not support,
+correct that oversight by looking at the PHY device supported linkmodes.
+
+Fixes: 99cec8a4dda2 ("net: phy: broadcom: Allow enabling or disabling of EEE")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/bcm-phy-lib.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/phy/bcm-phy-lib.c b/drivers/net/phy/bcm-phy-lib.c
+index 53282a6d5928..287cccf8f7f4 100644
+--- a/drivers/net/phy/bcm-phy-lib.c
++++ b/drivers/net/phy/bcm-phy-lib.c
+@@ -369,7 +369,7 @@ EXPORT_SYMBOL_GPL(bcm_phy_enable_apd);
+
+ int bcm_phy_set_eee(struct phy_device *phydev, bool enable)
+ {
+- int val;
++ int val, mask = 0;
+
+ /* Enable EEE at PHY level */
+ val = phy_read_mmd(phydev, MDIO_MMD_AN, BRCM_CL45VEN_EEE_CONTROL);
+@@ -388,10 +388,17 @@ int bcm_phy_set_eee(struct phy_device *phydev, bool enable)
+ if (val < 0)
+ return val;
+
++ if (linkmode_test_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
++ phydev->supported))
++ mask |= MDIO_EEE_1000T;
++ if (linkmode_test_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT,
++ phydev->supported))
++ mask |= MDIO_EEE_100TX;
++
+ if (enable)
+- val |= (MDIO_EEE_100TX | MDIO_EEE_1000T);
++ val |= mask;
+ else
+- val &= ~(MDIO_EEE_100TX | MDIO_EEE_1000T);
++ val &= ~mask;
+
+ phy_write_mmd(phydev, MDIO_MMD_AN, BCM_CL45VEN_EEE_ADV, (u32)val);
+
+--
+2.30.2
+
--- /dev/null
+From 4464105121fcde000d7a8b5bfe9c9361f4dd8ccf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 16:11:08 +0200
+Subject: net: qrtr: Fix memory leak on qrtr_tx_wait failure
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit 8a03dd925786bdc3834d56ccc980bb70668efa35 ]
+
+qrtr_tx_wait does not check for radix_tree_insert failure, causing
+the 'flow' object to be unreferenced after qrtr_tx_wait return. Fix
+that by releasing flow on radix_tree_insert failure.
+
+Fixes: 5fdeb0d372ab ("net: qrtr: Implement outgoing flow control")
+Reported-by: syzbot+739016799a89c530b32a@syzkaller.appspotmail.com
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/qrtr/qrtr.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index dfc820ee553a..1e4fb568fa84 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -271,7 +271,10 @@ static int qrtr_tx_wait(struct qrtr_node *node, int dest_node, int dest_port,
+ flow = kzalloc(sizeof(*flow), GFP_KERNEL);
+ if (flow) {
+ init_waitqueue_head(&flow->resume_tx);
+- radix_tree_insert(&node->qrtr_tx_flow, key, flow);
++ if (radix_tree_insert(&node->qrtr_tx_flow, key, flow)) {
++ kfree(flow);
++ flow = NULL;
++ }
+ }
+ }
+ mutex_unlock(&node->qrtr_tx_lock);
+--
+2.30.2
+
--- /dev/null
+From 0cb794ff289213197c98fdb2edf916be9d8f92f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 18:59:59 -0700
+Subject: net/rds: Fix a use after free in rds_message_map_pages
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit bdc2ab5c61a5c07388f4820ff21e787b4dfd1ced ]
+
+In rds_message_map_pages, the rm is freed by rds_message_put(rm).
+But rm is still used by rm->data.op_sg in return value.
+
+My patch assigns ERR_CAST(rm->data.op_sg) to err before the rm is
+freed to avoid the uaf.
+
+Fixes: 7dba92037baf3 ("net/rds: Use ERR_PTR for rds_message_alloc_sgs()")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/message.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/rds/message.c b/net/rds/message.c
+index 071a261fdaab..799034e0f513 100644
+--- a/net/rds/message.c
++++ b/net/rds/message.c
+@@ -347,8 +347,9 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in
+ rm->data.op_nents = DIV_ROUND_UP(total_len, PAGE_SIZE);
+ rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs);
+ if (IS_ERR(rm->data.op_sg)) {
++ void *err = ERR_CAST(rm->data.op_sg);
+ rds_message_put(rm);
+- return ERR_CAST(rm->data.op_sg);
++ return err;
+ }
+
+ for (i = 0; i < rm->data.op_nents; ++i) {
+--
+2.30.2
+
--- /dev/null
+From ad0b57b16f883dfebf8679446581a61020f58799 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Mar 2021 00:30:29 -0700
+Subject: net:tipc: Fix a double free in tipc_sk_mcast_rcv
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 6bf24dc0cc0cc43b29ba344b66d78590e687e046 ]
+
+In the if(skb_peek(arrvq) == skb) branch, it calls __skb_dequeue(arrvq) to get
+the skb by skb = skb_peek(arrvq). Then __skb_dequeue() unlinks the skb from arrvq
+and returns the skb which equals to skb_peek(arrvq). After __skb_dequeue(arrvq)
+finished, the skb is freed by kfree_skb(__skb_dequeue(arrvq)) in the first time.
+
+Unfortunately, the same skb is freed in the second time by kfree_skb(skb) after
+the branch completed.
+
+My patch removes kfree_skb() in the if(skb_peek(arrvq) == skb) branch, because
+this skb will be freed by kfree_skb(skb) finally.
+
+Fixes: cb1b728096f54 ("tipc: eliminate race condition at multicast reception")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/socket.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index cebcc104dc70..022999e0202d 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -1265,7 +1265,7 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
+ spin_lock_bh(&inputq->lock);
+ if (skb_peek(arrvq) == skb) {
+ skb_queue_splice_tail_init(&tmpq, inputq);
+- kfree_skb(__skb_dequeue(arrvq));
++ __skb_dequeue(arrvq);
+ }
+ spin_unlock_bh(&inputq->lock);
+ __skb_queue_purge(&tmpq);
+--
+2.30.2
+
--- /dev/null
+From 45306bcd4a749ff4aaae9356db943f513c9b2829 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Apr 2021 08:59:17 +0200
+Subject: net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...);
+
+From: Norman Maurer <norman_maurer@apple.com>
+
+[ Upstream commit 98184612aca0a9ee42b8eb0262a49900ee9eef0d ]
+
+Support for UDP_GRO was added in the past but the implementation for
+getsockopt was missed which did lead to an error when we tried to
+retrieve the setting for UDP_GRO. This patch adds the missing switch
+case for UDP_GRO
+
+Fixes: e20cf8d3f1f7 ("udp: implement GRO for plain UDP sockets.")
+Signed-off-by: Norman Maurer <norman_maurer@apple.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 69ea76578abb..9d2a1a247cec 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2749,6 +2749,10 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
+ val = up->gso_size;
+ break;
+
++ case UDP_GRO:
++ val = up->gro_enabled;
++ break;
++
+ /* The following two cannot be changed on UDP sockets, the return is
+ * always 0 (which corresponds to the full checksum coverage of UDP). */
+ case UDPLITE_SEND_CSCOV:
+--
+2.30.2
+
--- /dev/null
+From 1bf81d8ffbf66eab45171820194adb69c0e1bcb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Mar 2021 11:56:29 +0100
+Subject: net: xfrm: Localize sequence counter per network namespace
+
+From: Ahmed S. Darwish <a.darwish@linutronix.de>
+
+[ Upstream commit e88add19f68191448427a6e4eb059664650a837f ]
+
+A sequence counter write section must be serialized or its internal
+state can get corrupted. The "xfrm_state_hash_generation" seqcount is
+global, but its write serialization lock (net->xfrm.xfrm_state_lock) is
+instantiated per network namespace. The write protection is thus
+insufficient.
+
+To provide full protection, localize the sequence counter per network
+namespace instead. This should be safe as both the seqcount read and
+write sections access data exclusively within the network namespace. It
+also lays the foundation for transforming "xfrm_state_hash_generation"
+data type from seqcount_t to seqcount_LOCKNAME_t in further commits.
+
+Fixes: b65e3d7be06f ("xfrm: state: add sequence count to detect hash resizes")
+Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netns/xfrm.h | 4 +++-
+ net/xfrm/xfrm_state.c | 10 +++++-----
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h
+index 59f45b1e9dac..b59d73d529ba 100644
+--- a/include/net/netns/xfrm.h
++++ b/include/net/netns/xfrm.h
+@@ -72,7 +72,9 @@ struct netns_xfrm {
+ #if IS_ENABLED(CONFIG_IPV6)
+ struct dst_ops xfrm6_dst_ops;
+ #endif
+- spinlock_t xfrm_state_lock;
++ spinlock_t xfrm_state_lock;
++ seqcount_t xfrm_state_hash_generation;
++
+ spinlock_t xfrm_policy_lock;
+ struct mutex xfrm_cfg_mutex;
+ };
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index d01ca1a18418..ffd315cff984 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -44,7 +44,6 @@ static void xfrm_state_gc_task(struct work_struct *work);
+ */
+
+ static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
+-static __read_mostly seqcount_t xfrm_state_hash_generation = SEQCNT_ZERO(xfrm_state_hash_generation);
+ static struct kmem_cache *xfrm_state_cache __ro_after_init;
+
+ static DECLARE_WORK(xfrm_state_gc_work, xfrm_state_gc_task);
+@@ -140,7 +139,7 @@ static void xfrm_hash_resize(struct work_struct *work)
+ }
+
+ spin_lock_bh(&net->xfrm.xfrm_state_lock);
+- write_seqcount_begin(&xfrm_state_hash_generation);
++ write_seqcount_begin(&net->xfrm.xfrm_state_hash_generation);
+
+ nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
+ odst = xfrm_state_deref_prot(net->xfrm.state_bydst, net);
+@@ -156,7 +155,7 @@ static void xfrm_hash_resize(struct work_struct *work)
+ rcu_assign_pointer(net->xfrm.state_byspi, nspi);
+ net->xfrm.state_hmask = nhashmask;
+
+- write_seqcount_end(&xfrm_state_hash_generation);
++ write_seqcount_end(&net->xfrm.xfrm_state_hash_generation);
+ spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+
+ osize = (ohashmask + 1) * sizeof(struct hlist_head);
+@@ -1063,7 +1062,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
+
+ to_put = NULL;
+
+- sequence = read_seqcount_begin(&xfrm_state_hash_generation);
++ sequence = read_seqcount_begin(&net->xfrm.xfrm_state_hash_generation);
+
+ rcu_read_lock();
+ h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
+@@ -1176,7 +1175,7 @@ out:
+ if (to_put)
+ xfrm_state_put(to_put);
+
+- if (read_seqcount_retry(&xfrm_state_hash_generation, sequence)) {
++ if (read_seqcount_retry(&net->xfrm.xfrm_state_hash_generation, sequence)) {
+ *err = -EAGAIN;
+ if (x) {
+ xfrm_state_put(x);
+@@ -2666,6 +2665,7 @@ int __net_init xfrm_state_init(struct net *net)
+ net->xfrm.state_num = 0;
+ INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
+ spin_lock_init(&net->xfrm.xfrm_state_lock);
++ seqcount_init(&net->xfrm.xfrm_state_hash_generation);
+ return 0;
+
+ out_byspi:
+--
+2.30.2
+
--- /dev/null
+From 3a3146baeb9cff3f0de72b2926a94fcdf6d15faa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 10:30:23 +0200
+Subject: nfp: flower: ignore duplicate merge hints from FW
+
+From: Yinjun Zhang <yinjun.zhang@corigine.com>
+
+[ Upstream commit 2ea538dbee1c79f6f6c24a6f2f82986e4b7ccb78 ]
+
+A merge hint message needs some time to process before the merged
+flow actually reaches the firmware, during which we may get duplicate
+merge hints if there're more than one packet that hit the pre-merged
+flow. And processing duplicate merge hints will cost extra host_ctx's
+which are a limited resource.
+
+Avoid the duplicate merge by using hash table to store the sub_flows
+to be merged.
+
+Fixes: 8af56f40e53b ("nfp: flower: offload merge flows")
+Signed-off-by: Yinjun Zhang <yinjun.zhang@corigine.com>
+Signed-off-by: Louis Peens <louis.peens@corigine.com>
+Signed-off-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/netronome/nfp/flower/main.h | 8 ++++
+ .../ethernet/netronome/nfp/flower/metadata.c | 16 ++++++-
+ .../ethernet/netronome/nfp/flower/offload.c | 48 ++++++++++++++++++-
+ 3 files changed, 69 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.h b/drivers/net/ethernet/netronome/nfp/flower/main.h
+index caf12eec9945..56833a41f3d2 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/main.h
++++ b/drivers/net/ethernet/netronome/nfp/flower/main.h
+@@ -190,6 +190,7 @@ struct nfp_fl_internal_ports {
+ * @qos_rate_limiters: Current active qos rate limiters
+ * @qos_stats_lock: Lock on qos stats updates
+ * @pre_tun_rule_cnt: Number of pre-tunnel rules offloaded
++ * @merge_table: Hash table to store merged flows
+ */
+ struct nfp_flower_priv {
+ struct nfp_app *app;
+@@ -223,6 +224,7 @@ struct nfp_flower_priv {
+ unsigned int qos_rate_limiters;
+ spinlock_t qos_stats_lock; /* Protect the qos stats */
+ int pre_tun_rule_cnt;
++ struct rhashtable merge_table;
+ };
+
+ /**
+@@ -350,6 +352,12 @@ struct nfp_fl_payload_link {
+ };
+
+ extern const struct rhashtable_params nfp_flower_table_params;
++extern const struct rhashtable_params merge_table_params;
++
++struct nfp_merge_info {
++ u64 parent_ctx;
++ struct rhash_head ht_node;
++};
+
+ struct nfp_fl_stats_frame {
+ __be32 stats_con_id;
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
+index aa06fcb38f8b..327bb56b3ef5 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
+@@ -490,6 +490,12 @@ const struct rhashtable_params nfp_flower_table_params = {
+ .automatic_shrinking = true,
+ };
+
++const struct rhashtable_params merge_table_params = {
++ .key_offset = offsetof(struct nfp_merge_info, parent_ctx),
++ .head_offset = offsetof(struct nfp_merge_info, ht_node),
++ .key_len = sizeof(u64),
++};
++
+ int nfp_flower_metadata_init(struct nfp_app *app, u64 host_ctx_count,
+ unsigned int host_num_mems)
+ {
+@@ -506,6 +512,10 @@ int nfp_flower_metadata_init(struct nfp_app *app, u64 host_ctx_count,
+ if (err)
+ goto err_free_flow_table;
+
++ err = rhashtable_init(&priv->merge_table, &merge_table_params);
++ if (err)
++ goto err_free_stats_ctx_table;
++
+ get_random_bytes(&priv->mask_id_seed, sizeof(priv->mask_id_seed));
+
+ /* Init ring buffer and unallocated mask_ids. */
+@@ -513,7 +523,7 @@ int nfp_flower_metadata_init(struct nfp_app *app, u64 host_ctx_count,
+ kmalloc_array(NFP_FLOWER_MASK_ENTRY_RS,
+ NFP_FLOWER_MASK_ELEMENT_RS, GFP_KERNEL);
+ if (!priv->mask_ids.mask_id_free_list.buf)
+- goto err_free_stats_ctx_table;
++ goto err_free_merge_table;
+
+ priv->mask_ids.init_unallocated = NFP_FLOWER_MASK_ENTRY_RS - 1;
+
+@@ -550,6 +560,8 @@ err_free_last_used:
+ kfree(priv->mask_ids.last_used);
+ err_free_mask_id:
+ kfree(priv->mask_ids.mask_id_free_list.buf);
++err_free_merge_table:
++ rhashtable_destroy(&priv->merge_table);
+ err_free_stats_ctx_table:
+ rhashtable_destroy(&priv->stats_ctx_table);
+ err_free_flow_table:
+@@ -568,6 +580,8 @@ void nfp_flower_metadata_cleanup(struct nfp_app *app)
+ nfp_check_rhashtable_empty, NULL);
+ rhashtable_free_and_destroy(&priv->stats_ctx_table,
+ nfp_check_rhashtable_empty, NULL);
++ rhashtable_free_and_destroy(&priv->merge_table,
++ nfp_check_rhashtable_empty, NULL);
+ kvfree(priv->stats);
+ kfree(priv->mask_ids.mask_id_free_list.buf);
+ kfree(priv->mask_ids.last_used);
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
+index d72225d64a75..e95969c462e4 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
+@@ -1009,6 +1009,8 @@ int nfp_flower_merge_offloaded_flows(struct nfp_app *app,
+ struct netlink_ext_ack *extack = NULL;
+ struct nfp_fl_payload *merge_flow;
+ struct nfp_fl_key_ls merge_key_ls;
++ struct nfp_merge_info *merge_info;
++ u64 parent_ctx = 0;
+ int err;
+
+ ASSERT_RTNL();
+@@ -1019,6 +1021,15 @@ int nfp_flower_merge_offloaded_flows(struct nfp_app *app,
+ nfp_flower_is_merge_flow(sub_flow2))
+ return -EINVAL;
+
++ /* check if the two flows are already merged */
++ parent_ctx = (u64)(be32_to_cpu(sub_flow1->meta.host_ctx_id)) << 32;
++ parent_ctx |= (u64)(be32_to_cpu(sub_flow2->meta.host_ctx_id));
++ if (rhashtable_lookup_fast(&priv->merge_table,
++ &parent_ctx, merge_table_params)) {
++ nfp_flower_cmsg_warn(app, "The two flows are already merged.\n");
++ return 0;
++ }
++
+ err = nfp_flower_can_merge(sub_flow1, sub_flow2);
+ if (err)
+ return err;
+@@ -1060,16 +1071,33 @@ int nfp_flower_merge_offloaded_flows(struct nfp_app *app,
+ if (err)
+ goto err_release_metadata;
+
++ merge_info = kmalloc(sizeof(*merge_info), GFP_KERNEL);
++ if (!merge_info) {
++ err = -ENOMEM;
++ goto err_remove_rhash;
++ }
++ merge_info->parent_ctx = parent_ctx;
++ err = rhashtable_insert_fast(&priv->merge_table, &merge_info->ht_node,
++ merge_table_params);
++ if (err)
++ goto err_destroy_merge_info;
++
+ err = nfp_flower_xmit_flow(app, merge_flow,
+ NFP_FLOWER_CMSG_TYPE_FLOW_MOD);
+ if (err)
+- goto err_remove_rhash;
++ goto err_remove_merge_info;
+
+ merge_flow->in_hw = true;
+ sub_flow1->in_hw = false;
+
+ return 0;
+
++err_remove_merge_info:
++ WARN_ON_ONCE(rhashtable_remove_fast(&priv->merge_table,
++ &merge_info->ht_node,
++ merge_table_params));
++err_destroy_merge_info:
++ kfree(merge_info);
+ err_remove_rhash:
+ WARN_ON_ONCE(rhashtable_remove_fast(&priv->flow_table,
+ &merge_flow->fl_node,
+@@ -1359,7 +1387,9 @@ nfp_flower_remove_merge_flow(struct nfp_app *app,
+ {
+ struct nfp_flower_priv *priv = app->priv;
+ struct nfp_fl_payload_link *link, *temp;
++ struct nfp_merge_info *merge_info;
+ struct nfp_fl_payload *origin;
++ u64 parent_ctx = 0;
+ bool mod = false;
+ int err;
+
+@@ -1396,8 +1426,22 @@ nfp_flower_remove_merge_flow(struct nfp_app *app,
+ err_free_links:
+ /* Clean any links connected with the merged flow. */
+ list_for_each_entry_safe(link, temp, &merge_flow->linked_flows,
+- merge_flow.list)
++ merge_flow.list) {
++ u32 ctx_id = be32_to_cpu(link->sub_flow.flow->meta.host_ctx_id);
++
++ parent_ctx = (parent_ctx << 32) | (u64)(ctx_id);
+ nfp_flower_unlink_flow(link);
++ }
++
++ merge_info = rhashtable_lookup_fast(&priv->merge_table,
++ &parent_ctx,
++ merge_table_params);
++ if (merge_info) {
++ WARN_ON_ONCE(rhashtable_remove_fast(&priv->merge_table,
++ &merge_info->ht_node,
++ merge_table_params));
++ kfree(merge_info);
++ }
+
+ kfree(merge_flow->action_data);
+ kfree(merge_flow->mask_data);
+--
+2.30.2
+
--- /dev/null
+From 10d59f4857ab8abdab867d981efa254952b6fa50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Apr 2021 19:50:31 +0200
+Subject: openvswitch: fix send of uninitialized stack memory in ct limit reply
+
+From: Ilya Maximets <i.maximets@ovn.org>
+
+[ Upstream commit 4d51419d49930be2701c2633ae271b350397c3ca ]
+
+'struct ovs_zone_limit' has more members than initialized in
+ovs_ct_limit_get_default_limit(). The rest of the memory is a random
+kernel stack content that ends up being sent to userspace.
+
+Fix that by using designated initializer that will clear all
+non-specified fields.
+
+Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
+Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
+Acked-by: Tonghao Zhang <xiangxia.m.yue@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/conntrack.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 5eddfe7bd391..2316efd6ace8 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -2032,10 +2032,10 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
+ static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info,
+ struct sk_buff *reply)
+ {
+- struct ovs_zone_limit zone_limit;
+-
+- zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE;
+- zone_limit.limit = info->default_limit;
++ struct ovs_zone_limit zone_limit = {
++ .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE,
++ .limit = info->default_limit,
++ };
+
+ return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
+ }
+--
+2.30.2
+
--- /dev/null
+From 79b27a75150715169a057e6ff8c4adf3fe77e0e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Apr 2021 13:36:05 +0300
+Subject: perf inject: Fix repipe usage
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 026334a3bb6a3919b42aba9fc11843db2b77fd41 ]
+
+Since commit 14d3d54052539a1e ("perf session: Try to read pipe data from
+file") 'perf inject' has started printing "PERFILE2h" when not processing
+pipes.
+
+The commit exposed perf to the possiblity that the input is not a pipe
+but the 'repipe' parameter gets used. That causes the printing because
+perf inject sets 'repipe' to true always.
+
+The 'repipe' parameter of perf_session__new() is used by 2 functions:
+
+ - perf_file_header__read_pipe()
+ - trace_report()
+
+In both cases, the functions copy data to STDOUT_FILENO when 'repipe' is
+true.
+
+Fix by setting 'repipe' to true only if the output is a pipe.
+
+Fixes: e558a5bd8b74aff4 ("perf inject: Work with files")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Cc: Andrew Vagin <avagin@openvz.org>
+Link: http://lore.kernel.org/lkml/20210401103605.9000-1-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-inject.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c
+index 43937f4b399a..c0be51b95713 100644
+--- a/tools/perf/builtin-inject.c
++++ b/tools/perf/builtin-inject.c
+@@ -906,7 +906,7 @@ int cmd_inject(int argc, const char **argv)
+ }
+
+ data.path = inject.input_name;
+- inject.session = perf_session__new(&data, true, &inject.tool);
++ inject.session = perf_session__new(&data, inject.output.is_pipe, &inject.tool);
+ if (IS_ERR(inject.session))
+ return PTR_ERR(inject.session);
+
+--
+2.30.2
+
--- /dev/null
+From 0a67444ae40c5c2fac347304c69b49a56b60f6de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 10:44:52 +0800
+Subject: perf report: Fix wrong LBR block sorting
+
+From: Jin Yao <yao.jin@linux.intel.com>
+
+[ Upstream commit f2013278ae40b89cc27916366c407ce5261815ef ]
+
+When '--total-cycles' is specified, it supports sorting for all blocks
+by 'Sampled Cycles%'. This is useful to concentrate on the globally
+hottest blocks.
+
+'Sampled Cycles%' - block sampled cycles aggregation / total sampled cycles
+
+But in current code, it doesn't use the cycles aggregation. Part of
+'cycles' counting is possibly dropped for some overlap jumps. But for
+identifying the hot block, we always need the full cycles.
+
+ # perf record -b ./triad_loop
+ # perf report --total-cycles --stdio
+
+Before:
+
+ #
+ # Sampled Cycles% Sampled Cycles Avg Cycles% Avg Cycles [Program Block Range] Shared Object
+ # ............... .............. ........... .......... ............................................................. .................
+ #
+ 0.81% 793 4.32% 793 [setup-vdso.h:34 -> setup-vdso.h:40] ld-2.27.so
+ 0.49% 480 0.87% 160 [native_write_msr+0 -> native_write_msr+16] [kernel.kallsyms]
+ 0.48% 476 0.52% 95 [native_read_msr+0 -> native_read_msr+29] [kernel.kallsyms]
+ 0.31% 303 1.65% 303 [nmi_restore+0 -> nmi_restore+37] [kernel.kallsyms]
+ 0.26% 255 1.39% 255 [nohz_balance_exit_idle+75 -> nohz_balance_exit_idle+162] [kernel.kallsyms]
+ 0.24% 234 1.28% 234 [end_repeat_nmi+67 -> end_repeat_nmi+83] [kernel.kallsyms]
+ 0.23% 227 1.24% 227 [__irqentry_text_end+96 -> __irqentry_text_end+126] [kernel.kallsyms]
+ 0.20% 194 1.06% 194 [native_set_debugreg+52 -> native_set_debugreg+56] [kernel.kallsyms]
+ 0.11% 106 0.14% 26 [native_sched_clock+0 -> native_sched_clock+98] [kernel.kallsyms]
+ 0.10% 97 0.53% 97 [trigger_load_balance+0 -> trigger_load_balance+67] [kernel.kallsyms]
+ 0.09% 85 0.46% 85 [get-dynamic-info.h:102 -> get-dynamic-info.h:111] ld-2.27.so
+ ...
+ 0.00% 92.7K 0.02% 4 [triad_loop.c:64 -> triad_loop.c:65] triad_loop
+
+The hottest block '[triad_loop.c:64 -> triad_loop.c:65]' is not at
+the top of output.
+
+After:
+
+ # Sampled Cycles% Sampled Cycles Avg Cycles% Avg Cycles [Program Block Range] Shared Object
+ # ............... .............. ........... .......... .............................................................. .................
+ #
+ 94.35% 92.7K 0.02% 4 [triad_loop.c:64 -> triad_loop.c:65] triad_loop
+ 0.81% 793 4.32% 793 [setup-vdso.h:34 -> setup-vdso.h:40] ld-2.27.so
+ 0.49% 480 0.87% 160 [native_write_msr+0 -> native_write_msr+16] [kernel.kallsyms]
+ 0.48% 476 0.52% 95 [native_read_msr+0 -> native_read_msr+29] [kernel.kallsyms]
+ 0.31% 303 1.65% 303 [nmi_restore+0 -> nmi_restore+37] [kernel.kallsyms]
+ 0.26% 255 1.39% 255 [nohz_balance_exit_idle+75 -> nohz_balance_exit_idle+162] [kernel.kallsyms]
+ 0.24% 234 1.28% 234 [end_repeat_nmi+67 -> end_repeat_nmi+83] [kernel.kallsyms]
+ 0.23% 227 1.24% 227 [__irqentry_text_end+96 -> __irqentry_text_end+126] [kernel.kallsyms]
+ 0.20% 194 1.06% 194 [native_set_debugreg+52 -> native_set_debugreg+56] [kernel.kallsyms]
+ 0.11% 106 0.14% 26 [native_sched_clock+0 -> native_sched_clock+98] [kernel.kallsyms]
+ 0.10% 97 0.53% 97 [trigger_load_balance+0 -> trigger_load_balance+67] [kernel.kallsyms]
+ 0.09% 85 0.46% 85 [get-dynamic-info.h:102 -> get-dynamic-info.h:111] ld-2.27.so
+ 0.08% 82 0.06% 11 [intel_pmu_drain_pebs_nhm+580 -> intel_pmu_drain_pebs_nhm+627] [kernel.kallsyms]
+ 0.08% 77 0.42% 77 [lru_add_drain_cpu+0 -> lru_add_drain_cpu+133] [kernel.kallsyms]
+ 0.08% 74 0.10% 18 [handle_pmi_common+271 -> handle_pmi_common+310] [kernel.kallsyms]
+ 0.08% 74 0.40% 74 [get-dynamic-info.h:131 -> get-dynamic-info.h:157] ld-2.27.so
+ 0.07% 69 0.09% 17 [intel_pmu_drain_pebs_nhm+432 -> intel_pmu_drain_pebs_nhm+468] [kernel.kallsyms]
+
+Now the hottest block is reported at the top of output.
+
+Fixes: b65a7d372b1a55db ("perf hist: Support block formats with compare/sort/display")
+Signed-off-by: Jin Yao <yao.jin@linux.intel.com>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jin Yao <yao.jin@intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/20210407024452.29988-1-yao.jin@linux.intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/block-info.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/util/block-info.c b/tools/perf/util/block-info.c
+index 423ec69bda6c..5ecd4f401f32 100644
+--- a/tools/perf/util/block-info.c
++++ b/tools/perf/util/block-info.c
+@@ -201,7 +201,7 @@ static int block_total_cycles_pct_entry(struct perf_hpp_fmt *fmt,
+ double ratio = 0.0;
+
+ if (block_fmt->total_cycles)
+- ratio = (double)bi->cycles / (double)block_fmt->total_cycles;
++ ratio = (double)bi->cycles_aggr / (double)block_fmt->total_cycles;
+
+ return color_pct(hpp, block_fmt->width, 100.0 * ratio);
+ }
+@@ -216,9 +216,9 @@ static int64_t block_total_cycles_pct_sort(struct perf_hpp_fmt *fmt,
+ double l, r;
+
+ if (block_fmt->total_cycles) {
+- l = ((double)bi_l->cycles /
++ l = ((double)bi_l->cycles_aggr /
+ (double)block_fmt->total_cycles) * 100000.0;
+- r = ((double)bi_r->cycles /
++ r = ((double)bi_r->cycles_aggr /
+ (double)block_fmt->total_cycles) * 100000.0;
+ return (int64_t)l - (int64_t)r;
+ }
+--
+2.30.2
+
--- /dev/null
+From a9822131a707ae064994dab7e3fc4b450440fc5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Apr 2021 16:38:31 +0200
+Subject: platform/x86: intel-hid: Fix spurious wakeups caused by tablet-mode
+ events during suspend
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit a3790a8a94fc0234c5d38013b48e74ef221ec84c ]
+
+Some devices send (duplicate) tablet-mode events when moved around even
+though the mode has not changed; and they do this even when suspended.
+
+Change the tablet-mode event handling when priv->wakeup_mode is set to
+update the switch state in case it changed and then return immediately
+(without calling pm_wakeup_hard_event()) to avoid spurious wakeups.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=212537
+Fixes: 537b0dd4729e ("platform/x86: intel-hid: Add support for SW_TABLET_MODE")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Elia Devito <eliadevito@gmail.com>
+Link: https://lore.kernel.org/r/20210404143831.25173-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel-hid.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
+index 57cc92891a57..078648a9201b 100644
+--- a/drivers/platform/x86/intel-hid.c
++++ b/drivers/platform/x86/intel-hid.c
+@@ -483,11 +483,16 @@ static void notify_handler(acpi_handle handle, u32 event, void *context)
+ goto wakeup;
+
+ /*
+- * Switch events will wake the device and report the new switch
+- * position to the input subsystem.
++ * Some devices send (duplicate) tablet-mode events when moved
++ * around even though the mode has not changed; and they do this
++ * even when suspended.
++ * Update the switch state in case it changed and then return
++ * without waking up to avoid spurious wakeups.
+ */
+- if (priv->switches && (event == 0xcc || event == 0xcd))
+- goto wakeup;
++ if (event == 0xcc || event == 0xcd) {
++ report_tablet_mode_event(priv->switches, event);
++ return;
++ }
+
+ /* Wake up on 5-button array events only. */
+ if (event == 0xc0 || !priv->array)
+@@ -501,9 +506,6 @@ static void notify_handler(acpi_handle handle, u32 event, void *context)
+ wakeup:
+ pm_wakeup_hard_event(&device->dev);
+
+- if (report_tablet_mode_event(priv->switches, event))
+- return;
+-
+ return;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 7fdba956709b479186be4a479fe5e06e1c45da74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Apr 2021 10:44:34 +0300
+Subject: RDMA/addr: Be strict with gid size
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit d1c803a9ccd7bd3aff5e989ccfb39ed3b799b975 ]
+
+The nla_len() is less than or equal to 16. If it's less than 16 then end
+of the "gid" buffer is uninitialized.
+
+Fixes: ae43f8286730 ("IB/core: Add IP to GID netlink offload")
+Link: https://lore.kernel.org/r/20210405074434.264221-1-leon@kernel.org
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/addr.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index 0abce004a959..65e3e7df8a4b 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -76,7 +76,9 @@ static struct workqueue_struct *addr_wq;
+
+ static const struct nla_policy ib_nl_addr_policy[LS_NLA_TYPE_MAX] = {
+ [LS_NLA_TYPE_DGID] = {.type = NLA_BINARY,
+- .len = sizeof(struct rdma_nla_ls_gid)},
++ .len = sizeof(struct rdma_nla_ls_gid),
++ .validation_type = NLA_VALIDATE_MIN,
++ .min = sizeof(struct rdma_nla_ls_gid)},
+ };
+
+ static inline bool ib_nl_is_good_ip_resp(const struct nlmsghdr *nlh)
+--
+2.30.2
+
--- /dev/null
+From 2e95f8e1c043dcd468b7d04721a8644602e64293 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 19:27:15 +0530
+Subject: RDMA/cxgb4: check for ipv6 address properly while destroying listener
+
+From: Potnuri Bharat Teja <bharat@chelsio.com>
+
+[ Upstream commit 603c4690b01aaffe3a6c3605a429f6dac39852ae ]
+
+ipv6 bit is wrongly set by the below which causes fatal adapter lookup
+engine errors for ipv4 connections while destroying a listener. Fix it to
+properly check the local address for ipv6.
+
+Fixes: 3408be145a5d ("RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server")
+Link: https://lore.kernel.org/r/20210331135715.30072-1-bharat@chelsio.com
+Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 81903749d241..e42c812e74c3 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -3616,7 +3616,8 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id)
+ c4iw_init_wr_wait(ep->com.wr_waitp);
+ err = cxgb4_remove_server(
+ ep->com.dev->rdev.lldi.ports[0], ep->stid,
+- ep->com.dev->rdev.lldi.rxq_ids[0], true);
++ ep->com.dev->rdev.lldi.rxq_ids[0],
++ ep->com.local_addr.ss_family == AF_INET6);
+ if (err)
+ goto done;
+ err = c4iw_wait_for_reply(&ep->com.dev->rdev, ep->com.wr_waitp,
+--
+2.30.2
+
--- /dev/null
+From 07b8361a3c3adedf5ad87639f8928036f61adf13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Apr 2021 15:55:01 +0300
+Subject: RDMA/qedr: Fix kernel panic when trying to access recv_cq
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit e1ad897b9c738d5550be6762bf3a6ef1672259a4 ]
+
+As INI QP does not require a recv_cq, avoid the following null pointer
+dereference by checking if the qp_type is not INI before trying to extract
+the recv_cq.
+
+BUG: kernel NULL pointer dereference, address: 00000000000000e0
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 0 P4D 0
+ Oops: 0000 [#1] SMP PTI
+ CPU: 0 PID: 54250 Comm: mpitests-IMB-MP Not tainted 5.12.0-rc5 #1
+ Hardware name: Dell Inc. PowerEdge R320/0KM5PX, BIOS 2.7.0 08/19/2019
+ RIP: 0010:qedr_create_qp+0x378/0x820 [qedr]
+ Code: 02 00 00 50 e8 29 d4 a9 d1 48 83 c4 18 e9 65 fe ff ff 48 8b 53 10 48 8b 43 18 44 8b 82 e0 00 00 00 45 85 c0 0f 84 10 74 00 00 <8b> b8 e0 00 00 00 85 ff 0f 85 50 fd ff ff e9 fd 73 00 00 48 8d bd
+ RSP: 0018:ffff9c8f056f7a70 EFLAGS: 00010202
+ RAX: 0000000000000000 RBX: ffff9c8f056f7b58 RCX: 0000000000000009
+ RDX: ffff8c41a9744c00 RSI: ffff9c8f056f7b58 RDI: ffff8c41c0dfa280
+ RBP: ffff8c41c0dfa280 R08: 0000000000000002 R09: 0000000000000001
+ R10: 0000000000000000 R11: ffff8c41e06fc608 R12: ffff8c4194052000
+ R13: 0000000000000000 R14: ffff8c4191546070 R15: ffff8c41c0dfa280
+ FS: 00007f78b2787b80(0000) GS:ffff8c43a3200000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00000000000000e0 CR3: 00000001011d6002 CR4: 00000000001706f0
+ Call Trace:
+ ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x4e4/0xb90 [ib_uverbs]
+ ? ib_uverbs_cq_event_handler+0x30/0x30 [ib_uverbs]
+ ib_uverbs_run_method+0x6f6/0x7a0 [ib_uverbs]
+ ? ib_uverbs_handler_UVERBS_METHOD_QP_DESTROY+0x70/0x70 [ib_uverbs]
+ ? __cond_resched+0x15/0x30
+ ? __kmalloc+0x5a/0x440
+ ib_uverbs_cmd_verbs+0x195/0x360 [ib_uverbs]
+ ? xa_load+0x6e/0x90
+ ? cred_has_capability+0x7c/0x130
+ ? avc_has_extended_perms+0x17f/0x440
+ ? vma_link+0xae/0xb0
+ ? vma_set_page_prot+0x2a/0x60
+ ? mmap_region+0x298/0x6c0
+ ? do_mmap+0x373/0x520
+ ? selinux_file_ioctl+0x17f/0x220
+ ib_uverbs_ioctl+0xa7/0x110 [ib_uverbs]
+ __x64_sys_ioctl+0x84/0xc0
+ do_syscall_64+0x33/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+ RIP: 0033:0x7f78b120262b
+
+Fixes: 06e8d1df46ed ("RDMA/qedr: Add support for user mode XRC-SRQ's")
+Link: https://lore.kernel.org/r/20210404125501.154789-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/verbs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index 0eb6a7a618e0..9ea542270ed4 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -1244,7 +1244,8 @@ static int qedr_check_qp_attrs(struct ib_pd *ibpd, struct qedr_dev *dev,
+ * TGT QP isn't associated with RQ/SQ
+ */
+ if ((attrs->qp_type != IB_QPT_GSI) && (dev->gsi_qp_created) &&
+- (attrs->qp_type != IB_QPT_XRC_TGT)) {
++ (attrs->qp_type != IB_QPT_XRC_TGT) &&
++ (attrs->qp_type != IB_QPT_XRC_INI)) {
+ struct qedr_cq *send_cq = get_qedr_cq(attrs->send_cq);
+ struct qedr_cq *recv_cq = get_qedr_cq(attrs->recv_cq);
+
+--
+2.30.2
+
--- /dev/null
+From 3f3db609d9379740761cbea35af58ade80b6e373 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 16:32:57 +0100
+Subject: RDMA/rtrs-clt: Close rtrs client conn before destroying rtrs clt
+ session files
+
+From: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+
+[ Upstream commit 7582207b1059129e59eb92026fca2cfc088a74fc ]
+
+KASAN detected the following BUG:
+
+ BUG: KASAN: use-after-free in rtrs_clt_update_wc_stats+0x41/0x100 [rtrs_client]
+ Read of size 8 at addr ffff88bf2fb4adc0 by task swapper/0/0
+
+ CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 5.4.84-pserver #5.4.84-1+feature+linux+5.4.y+dbg+20201216.1319+b6b887b~deb10
+ Hardware name: Supermicro H8QG6/H8QG6, BIOS 3.00 09/04/2012
+ Call Trace:
+ <IRQ>
+ dump_stack+0x96/0xe0
+ print_address_description.constprop.4+0x1f/0x300
+ ? irq_work_claim+0x2e/0x50
+ __kasan_report.cold.8+0x78/0x92
+ ? rtrs_clt_update_wc_stats+0x41/0x100 [rtrs_client]
+ kasan_report+0x10/0x20
+ rtrs_clt_update_wc_stats+0x41/0x100 [rtrs_client]
+ rtrs_clt_rdma_done+0xb1/0x760 [rtrs_client]
+ ? lockdep_hardirqs_on+0x1a8/0x290
+ ? process_io_rsp+0xb0/0xb0 [rtrs_client]
+ ? mlx4_ib_destroy_cq+0x100/0x100 [mlx4_ib]
+ ? add_interrupt_randomness+0x1a2/0x340
+ __ib_process_cq+0x97/0x100 [ib_core]
+ ib_poll_handler+0x41/0xb0 [ib_core]
+ irq_poll_softirq+0xe0/0x260
+ __do_softirq+0x127/0x672
+ irq_exit+0xd1/0xe0
+ do_IRQ+0xa3/0x1d0
+ common_interrupt+0xf/0xf
+ </IRQ>
+ RIP: 0010:cpuidle_enter_state+0xea/0x780
+ Code: 31 ff e8 99 48 47 ff 80 7c 24 08 00 74 12 9c 58 f6 c4 02 0f 85 53 05 00 00 31 ff e8 b0 6f 53 ff e8 ab 4f 5e ff fb 8b 44 24 04 <85> c0 0f 89 f3 01 00 00 48 8d 7b 14 e8 65 1e 77 ff c7 43 14 00 00
+ RSP: 0018:ffffffffab007d58 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffca
+ RAX: 0000000000000002 RBX: ffff88b803d69800 RCX: ffffffffa91a8298
+ RDX: 0000000000000007 RSI: dffffc0000000000 RDI: ffffffffab021414
+ RBP: ffffffffab6329e0 R08: 0000000000000002 R09: 0000000000000000
+ R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002
+ R13: 000000bf39d82466 R14: ffffffffab632aa0 R15: ffffffffab632ae0
+ ? lockdep_hardirqs_on+0x1a8/0x290
+ ? cpuidle_enter_state+0xe5/0x780
+ cpuidle_enter+0x3c/0x60
+ do_idle+0x2fb/0x390
+ ? arch_cpu_idle_exit+0x40/0x40
+ ? schedule+0x94/0x120
+ cpu_startup_entry+0x19/0x1b
+ start_kernel+0x5da/0x61b
+ ? thread_stack_cache_init+0x6/0x6
+ ? load_ucode_amd_bsp+0x6f/0xc4
+ ? init_amd_microcode+0xa6/0xa6
+ ? x86_family+0x5/0x20
+ ? load_ucode_bsp+0x182/0x1fd
+ secondary_startup_64+0xa4/0xb0
+
+ Allocated by task 5730:
+ save_stack+0x19/0x80
+ __kasan_kmalloc.constprop.9+0xc1/0xd0
+ kmem_cache_alloc_trace+0x15b/0x350
+ alloc_sess+0xf4/0x570 [rtrs_client]
+ rtrs_clt_open+0x3b4/0x780 [rtrs_client]
+ find_and_get_or_create_sess+0x649/0x9d0 [rnbd_client]
+ rnbd_clt_map_device+0xd7/0xf50 [rnbd_client]
+ rnbd_clt_map_device_store+0x4ee/0x970 [rnbd_client]
+ kernfs_fop_write+0x141/0x240
+ vfs_write+0xf3/0x280
+ ksys_write+0xba/0x150
+ do_syscall_64+0x68/0x270
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+ Freed by task 5822:
+ save_stack+0x19/0x80
+ __kasan_slab_free+0x125/0x170
+ kfree+0xe7/0x3f0
+ kobject_put+0xd3/0x240
+ rtrs_clt_destroy_sess_files+0x3f/0x60 [rtrs_client]
+ rtrs_clt_close+0x3c/0x80 [rtrs_client]
+ close_rtrs+0x45/0x80 [rnbd_client]
+ rnbd_client_exit+0x10f/0x2bd [rnbd_client]
+ __x64_sys_delete_module+0x27b/0x340
+ do_syscall_64+0x68/0x270
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+When rtrs_clt_close is triggered, it iterates over all the present
+rtrs_clt_sess and triggers close on them. However, the call to
+rtrs_clt_destroy_sess_files is done before the rtrs_clt_close_conns. This
+is incorrect since during the initialization phase we allocate
+rtrs_clt_sess first, and then we go ahead and create rtrs_clt_con for it.
+
+If we free the rtrs_clt_sess structure before closing the rtrs_clt_con, it
+may so happen that an inflight IO completion would trigger the function
+rtrs_clt_rdma_done, which would lead to the above UAF case.
+
+Hence close the rtrs_clt_con connections first, and then trigger the
+destruction of session files.
+
+Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
+Link: https://lore.kernel.org/r/20210325153308.1214057-12-gi-oh.kim@ionos.com
+Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Gioh Kim <gi-oh.kim@ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 394c1f6822b9..ee37c5af3a8c 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -2735,8 +2735,8 @@ void rtrs_clt_close(struct rtrs_clt *clt)
+
+ /* Now it is safe to iterate over all paths without locks */
+ list_for_each_entry_safe(sess, tmp, &clt->paths_list, s.entry) {
+- rtrs_clt_destroy_sess_files(sess, NULL);
+ rtrs_clt_close_conns(sess, true);
++ rtrs_clt_destroy_sess_files(sess, NULL);
+ kobject_put(&sess->kobj);
+ }
+ free_clt(clt);
+--
+2.30.2
+
--- /dev/null
+From e4b6672e1ed1223fe5f7517645f944a7249dcf5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 14:02:40 +0100
+Subject: regulator: bd9571mwv: Fix AVS and DVFS voltage range
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 3b6e7088afc919f5b52e4d2de8501ad34d35b09b ]
+
+According to Table 30 ("DVFS_MoniVDAC [6:0] Setting Table") in the
+BD9571MWV-M Datasheet Rev. 002, the valid voltage range is 600..1100 mV
+(settings 0x3c..0x6e). While the lower limit is taken into account (by
+setting regulator_desc.linear_min_sel to 0x3c), the upper limit is not.
+
+Fix this by reducing regulator_desc.n_voltages from 0x80 to 0x6f.
+
+Fixes: e85c5a153fe237f2 ("regulator: Add ROHM BD9571MWV-M PMIC regulator driver")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20210312130242.3390038-2-geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/bd9571mwv-regulator.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/bd9571mwv-regulator.c b/drivers/regulator/bd9571mwv-regulator.c
+index e690c2ce5b3c..25e33028871c 100644
+--- a/drivers/regulator/bd9571mwv-regulator.c
++++ b/drivers/regulator/bd9571mwv-regulator.c
+@@ -124,7 +124,7 @@ static const struct regulator_ops vid_ops = {
+
+ static const struct regulator_desc regulators[] = {
+ BD9571MWV_REG("VD09", "vd09", VD09, avs_ops, 0, 0x7f,
+- 0x80, 600000, 10000, 0x3c),
++ 0x6f, 600000, 10000, 0x3c),
+ BD9571MWV_REG("VD18", "vd18", VD18, vid_ops, BD9571MWV_VD18_VID, 0xf,
+ 16, 1625000, 25000, 0),
+ BD9571MWV_REG("VD25", "vd25", VD25, vid_ops, BD9571MWV_VD25_VID, 0xf,
+@@ -133,7 +133,7 @@ static const struct regulator_desc regulators[] = {
+ 11, 2800000, 100000, 0),
+ BD9571MWV_REG("DVFS", "dvfs", DVFS, reg_ops,
+ BD9571MWV_DVFS_MONIVDAC, 0x7f,
+- 0x80, 600000, 10000, 0x3c),
++ 0x6f, 600000, 10000, 0x3c),
+ };
+
+ #ifdef CONFIG_PM_SLEEP
+--
+2.30.2
+
--- /dev/null
+From e58c8bfe860d027f66b78e3b0f2848c929187bb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Mar 2021 15:58:59 -0500
+Subject: remoteproc: pru: Fix firmware loading crashes on K3 SoCs
+
+From: Suman Anna <s-anna@ti.com>
+
+[ Upstream commit 9afeefcf06fc7b4bdab06a6e2cb06745bded34dd ]
+
+The K3 PRUs are 32-bit processors and in general have some limitations
+in using the standard ARMv8 memcpy function for loading firmware segments,
+so the driver already uses a custom memcpy implementation. This added
+logic however is limited to only IRAMs at the moment, but the loading
+into Data RAMs is not completely ok either and does generate a kernel
+crash for unaligned accesses.
+
+Fix these crashes by removing the existing IRAM logic limitation and
+extending the custom memcpy usage to Data RAMs as well for all K3 SoCs.
+
+Fixes: 1d39f4d19921 ("remoteproc: pru: Add support for various PRU cores on K3 AM65x SoCs")
+Signed-off-by: Suman Anna <s-anna@ti.com>
+Link: https://lore.kernel.org/r/20210315205859.19590-1-s-anna@ti.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/pru_rproc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/pru_rproc.c
+index 2667919d76b3..16979c1cd2f4 100644
+--- a/drivers/remoteproc/pru_rproc.c
++++ b/drivers/remoteproc/pru_rproc.c
+@@ -585,7 +585,7 @@ pru_rproc_load_elf_segments(struct rproc *rproc, const struct firmware *fw)
+ break;
+ }
+
+- if (pru->data->is_k3 && is_iram) {
++ if (pru->data->is_k3) {
+ ret = pru_rproc_memcpy(ptr, elf_data + phdr->p_offset,
+ filesz);
+ if (ret) {
+--
+2.30.2
+
--- /dev/null
+From 6f718d2c95d9719f88469e1215256dec7c953582 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Jan 2021 14:56:12 +0100
+Subject: remoteproc: qcom: pil_info: avoid 64-bit division
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7029e783027706b427bbfbdf8558252c1dac6fa0 ]
+
+On 32-bit machines with 64-bit resource_size_t, the driver causes
+a link failure because of the 64-bit division:
+
+arm-linux-gnueabi-ld: drivers/remoteproc/qcom_pil_info.o: in function `qcom_pil_info_store':
+qcom_pil_info.c:(.text+0x1ec): undefined reference to `__aeabi_uldivmod'
+
+Add a cast to an u32 to avoid this. If the resource exceeds 4GB,
+there are bigger problems.
+
+Fixes: 549b67da660d ("remoteproc: qcom: Introduce helper to store pil info in IMEM")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20210103135628.3702427-1-arnd@kernel.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_pil_info.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/qcom_pil_info.c b/drivers/remoteproc/qcom_pil_info.c
+index 5521c4437ffa..7c007dd7b200 100644
+--- a/drivers/remoteproc/qcom_pil_info.c
++++ b/drivers/remoteproc/qcom_pil_info.c
+@@ -56,7 +56,7 @@ static int qcom_pil_info_init(void)
+ memset_io(base, 0, resource_size(&imem));
+
+ _reloc.base = base;
+- _reloc.num_entries = resource_size(&imem) / PIL_RELOC_ENTRY_SIZE;
++ _reloc.num_entries = (u32)resource_size(&imem) / PIL_RELOC_ENTRY_SIZE;
+
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From 09f46653d3e9e688dd73ce1c106642e33a36cc88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 21:58:26 +0200
+Subject: Revert "arm64: dts: marvell: armada-cp110: Switch to per-port SATA
+ interrupts"
+
+From: Gregory CLEMENT <gregory.clement@bootlin.com>
+
+[ Upstream commit 967ff33eb0efcd48e4df11ab9aee51c41e0f44d0 ]
+
+The driver part of this support was not merged which leads to break
+AHCI on all Marvell Armada 7k8k / CN913x platforms as it was reported
+by Marcin Wojtas.
+
+So for now let's remove it in order to fix the issue waiting for the
+driver part really be merged.
+
+This reverts commit 53e950d597e3578da84238b86424bfcc9e101d87.
+Fixes: 53e950d597e3 ("arm64: dts: marvell: armada-cp110: Switch to per-port SATA interrupts")
+
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/marvell/armada-cp11x.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi b/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi
+index 994a2fce449a..1e37ae181acf 100644
+--- a/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi
+@@ -300,9 +300,11 @@
+ };
+
+ CP11X_LABEL(sata0): sata@540000 {
+- compatible = "marvell,armada-8k-ahci";
++ compatible = "marvell,armada-8k-ahci",
++ "generic-ahci";
+ reg = <0x540000 0x30000>;
+ dma-coherent;
++ interrupts = <107 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&CP11X_LABEL(clk) 1 15>,
+ <&CP11X_LABEL(clk) 1 16>;
+ #address-cells = <1>;
+@@ -310,12 +312,10 @@
+ status = "disabled";
+
+ sata-port@0 {
+- interrupts = <109 IRQ_TYPE_LEVEL_HIGH>;
+ reg = <0>;
+ };
+
+ sata-port@1 {
+- interrupts = <107 IRQ_TYPE_LEVEL_HIGH>;
+ reg = <1>;
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From cffb1b99ddcd35477d7d805837e99428db56e8ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 18:35:07 +0200
+Subject: s390/cpcmd: fix inline assembly register clobbering
+
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+
+[ Upstream commit 7a2f91441b2c1d81b77c1cd816a4659f4abc9cbe ]
+
+Register variables initialized using arithmetic. That leads to
+kasan instrumentaton code corrupting the registers contents.
+Follow GCC guidlines and use temporary variables for assigning
+init values to register variables.
+
+Fixes: 94c12cc7d196 ("[S390] Inline assembly cleanup.")
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Link: https://gcc.gnu.org/onlinedocs/gcc-10.2.0/gcc/Local-Register-Variables.html
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/cpcmd.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/kernel/cpcmd.c b/arch/s390/kernel/cpcmd.c
+index af013b4244d3..2da027359798 100644
+--- a/arch/s390/kernel/cpcmd.c
++++ b/arch/s390/kernel/cpcmd.c
+@@ -37,10 +37,12 @@ static int diag8_noresponse(int cmdlen)
+
+ static int diag8_response(int cmdlen, char *response, int *rlen)
+ {
++ unsigned long _cmdlen = cmdlen | 0x40000000L;
++ unsigned long _rlen = *rlen;
+ register unsigned long reg2 asm ("2") = (addr_t) cpcmd_buf;
+ register unsigned long reg3 asm ("3") = (addr_t) response;
+- register unsigned long reg4 asm ("4") = cmdlen | 0x40000000L;
+- register unsigned long reg5 asm ("5") = *rlen;
++ register unsigned long reg4 asm ("4") = _cmdlen;
++ register unsigned long reg5 asm ("5") = _rlen;
+
+ asm volatile(
+ " diag %2,%0,0x8\n"
+--
+2.30.2
+
--- /dev/null
+From 168b83f197e3e97e58b60781fd6fa371cabc4bf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 11:14:53 -0700
+Subject: sch_red: fix off-by-one checks in red_check_params()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 3a87571f0ffc51ba3bf3ecdb6032861d0154b164 ]
+
+This fixes following syzbot report:
+
+UBSAN: shift-out-of-bounds in ./include/net/red.h:237:23
+shift exponent 32 is too large for 32-bit type 'unsigned int'
+CPU: 1 PID: 8418 Comm: syz-executor170 Not tainted 5.12.0-rc4-next-20210324-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Call Trace:
+ __dump_stack lib/dump_stack.c:79 [inline]
+ dump_stack+0x141/0x1d7 lib/dump_stack.c:120
+ ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
+ __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
+ red_set_parms include/net/red.h:237 [inline]
+ choke_change.cold+0x3c/0xc8 net/sched/sch_choke.c:414
+ qdisc_create+0x475/0x12f0 net/sched/sch_api.c:1247
+ tc_modify_qdisc+0x4c8/0x1a50 net/sched/sch_api.c:1663
+ rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5553
+ netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
+ netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
+ netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
+ netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
+ sock_sendmsg_nosec net/socket.c:654 [inline]
+ sock_sendmsg+0xcf/0x120 net/socket.c:674
+ ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
+ ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
+ __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
+ do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+RIP: 0033:0x43f039
+Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007ffdfa725168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+RAX: ffffffffffffffda RBX: 0000000000400488 RCX: 000000000043f039
+RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
+RBP: 0000000000403020 R08: 0000000000400488 R09: 0000000000400488
+R10: 0000000000400488 R11: 0000000000000246 R12: 00000000004030b0
+R13: 0000000000000000 R14: 00000000004ac018 R15: 0000000000400488
+
+Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/red.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/red.h b/include/net/red.h
+index 9e6647c4ccd1..cc9f6b0d7f1e 100644
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -171,9 +171,9 @@ static inline void red_set_vars(struct red_vars *v)
+ static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog,
+ u8 Scell_log, u8 *stab)
+ {
+- if (fls(qth_min) + Wlog > 32)
++ if (fls(qth_min) + Wlog >= 32)
+ return false;
+- if (fls(qth_max) + Wlog > 32)
++ if (fls(qth_max) + Wlog >= 32)
+ return false;
+ if (Scell_log >= 32)
+ return false;
+--
+2.30.2
+
--- /dev/null
+From 2060e8483b806e73302c35dbcf4b5b62598fc8bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Apr 2021 00:39:08 -0700
+Subject: scsi: ufs: core: Fix task management request completion timeout
+
+From: Can Guo <cang@codeaurora.org>
+
+[ Upstream commit 1235fc569e0bf541ddda0a1224d4c6fa6d914890 ]
+
+ufshcd_tmc_handler() calls blk_mq_tagset_busy_iter(fn = ufshcd_compl_tm()),
+but since blk_mq_tagset_busy_iter() only iterates over all reserved tags
+and requests which are not in IDLE state, ufshcd_compl_tm() never gets a
+chance to run. Thus, TMR always ends up with completion timeout. Fix it by
+calling blk_mq_start_request() in __ufshcd_issue_tm_cmd().
+
+Link: https://lore.kernel.org/r/1617262750-4864-2-git-send-email-cang@codeaurora.org
+Fixes: 69a6c269c097 ("scsi: ufs: Use blk_{get,put}_request() to allocate and free TMFs")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 16e1bd1aa49d..c801f88007dd 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -6381,6 +6381,7 @@ static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba,
+
+ spin_lock_irqsave(host->host_lock, flags);
+ task_tag = hba->nutrs + free_slot;
++ blk_mq_start_request(req);
+
+ treq->req_header.dword_0 |= cpu_to_be32(task_tag);
+
+--
+2.30.2
+
--- /dev/null
+From d60cde62948e50ba792e4171acf5bdd35dda64ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Apr 2021 00:39:09 -0700
+Subject: scsi: ufs: core: Fix wrong Task Tag used in task management request
+ UPIUs
+
+From: Can Guo <cang@codeaurora.org>
+
+[ Upstream commit 4b42d557a8add52b9a9924fb31e40a218aab7801 ]
+
+In __ufshcd_issue_tm_cmd(), it is not correct to use hba->nutrs + req->tag
+as the Task Tag in a TMR UPIU. Directly use req->tag as the Task Tag.
+
+Fixes: e293313262d3 ("scsi: ufs: Fix broken task management command implementation")
+Link: https://lore.kernel.org/r/1617262750-4864-3-git-send-email-cang@codeaurora.org
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 30 +++++++++++++-----------------
+ 1 file changed, 13 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index c801f88007dd..e53a3f89e863 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -6363,38 +6363,34 @@ static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba,
+ DECLARE_COMPLETION_ONSTACK(wait);
+ struct request *req;
+ unsigned long flags;
+- int free_slot, task_tag, err;
++ int task_tag, err;
+
+ /*
+- * Get free slot, sleep if slots are unavailable.
+- * Even though we use wait_event() which sleeps indefinitely,
+- * the maximum wait time is bounded by %TM_CMD_TIMEOUT.
++ * blk_get_request() is used here only to get a free tag.
+ */
+ req = blk_get_request(q, REQ_OP_DRV_OUT, 0);
+ if (IS_ERR(req))
+ return PTR_ERR(req);
+
+ req->end_io_data = &wait;
+- free_slot = req->tag;
+- WARN_ON_ONCE(free_slot < 0 || free_slot >= hba->nutmrs);
+ ufshcd_hold(hba, false);
+
+ spin_lock_irqsave(host->host_lock, flags);
+- task_tag = hba->nutrs + free_slot;
+ blk_mq_start_request(req);
+
++ task_tag = req->tag;
+ treq->req_header.dword_0 |= cpu_to_be32(task_tag);
+
+- memcpy(hba->utmrdl_base_addr + free_slot, treq, sizeof(*treq));
+- ufshcd_vops_setup_task_mgmt(hba, free_slot, tm_function);
++ memcpy(hba->utmrdl_base_addr + task_tag, treq, sizeof(*treq));
++ ufshcd_vops_setup_task_mgmt(hba, task_tag, tm_function);
+
+ /* send command to the controller */
+- __set_bit(free_slot, &hba->outstanding_tasks);
++ __set_bit(task_tag, &hba->outstanding_tasks);
+
+ /* Make sure descriptors are ready before ringing the task doorbell */
+ wmb();
+
+- ufshcd_writel(hba, 1 << free_slot, REG_UTP_TASK_REQ_DOOR_BELL);
++ ufshcd_writel(hba, 1 << task_tag, REG_UTP_TASK_REQ_DOOR_BELL);
+ /* Make sure that doorbell is committed immediately */
+ wmb();
+
+@@ -6414,24 +6410,24 @@ static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba,
+ ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_complete_err");
+ dev_err(hba->dev, "%s: task management cmd 0x%.2x timed-out\n",
+ __func__, tm_function);
+- if (ufshcd_clear_tm_cmd(hba, free_slot))
+- dev_WARN(hba->dev, "%s: unable clear tm cmd (slot %d) after timeout\n",
+- __func__, free_slot);
++ if (ufshcd_clear_tm_cmd(hba, task_tag))
++ dev_WARN(hba->dev, "%s: unable to clear tm cmd (slot %d) after timeout\n",
++ __func__, task_tag);
+ err = -ETIMEDOUT;
+ } else {
+ err = 0;
+- memcpy(treq, hba->utmrdl_base_addr + free_slot, sizeof(*treq));
++ memcpy(treq, hba->utmrdl_base_addr + task_tag, sizeof(*treq));
+
+ ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_complete");
+ }
+
+ spin_lock_irqsave(hba->host->host_lock, flags);
+- __clear_bit(free_slot, &hba->outstanding_tasks);
++ __clear_bit(task_tag, &hba->outstanding_tasks);
+ spin_unlock_irqrestore(hba->host->host_lock, flags);
+
++ ufshcd_release(hba);
+ blk_put_request(req);
+
+- ufshcd_release(hba);
+ return err;
+ }
+
+--
+2.30.2
+
net-sched-fix-err-handler-in-tcf_action_init.patch
ice-refactor-dcb-related-variables-out-of-the-ice_po.patch
ice-recognize-860-as-iscsi-port-in-cee-mode.patch
+xfrm-interface-fix-ipv4-pmtu-check-to-honor-ip-heade.patch
+xfrm-use-actual-socket-sk-instead-of-skb-socket-for-.patch
+remoteproc-qcom-pil_info-avoid-64-bit-division.patch
+regulator-bd9571mwv-fix-avs-and-dvfs-voltage-range.patch
+arm-omap4-fix-pmic-voltage-domains-for-bionic.patch
+arm-omap4-pm-update-rom-return-address-for-oswr-and-.patch
+remoteproc-pru-fix-firmware-loading-crashes-on-k3-so.patch
+net-xfrm-localize-sequence-counter-per-network-names.patch
+esp-delete-netif_f_sctp_crc-bit-from-features-for-es.patch
+asoc-sof-intel-hda-fix-core-status-verification.patch
+asoc-wm8960-fix-wrong-bclk-and-lrclk-with-pll-enable.patch
+xfrm-fix-null-pointer-dereference-on-policy-lookup.patch
+virtchnl-fix-layout-of-rss-structures.patch
+i40e-added-asym_pause-to-supported-link-modes.patch
+i40e-fix-kernel-oops-when-i40e-driver-removes-vf-s.patch
+hostfs-fix-memory-handling-in-follow_link.patch
+amd-xgbe-update-dma-coherency-values.patch
+vxlan-do-not-modify-the-shared-tunnel-info-when-pmtu.patch
+geneve-do-not-modify-the-shared-tunnel-info-when-pmt.patch
+sch_red-fix-off-by-one-checks-in-red_check_params.patch
+drivers-net-wan-hdlc_fr-fix-a-double-free-in-pvc_xmi.patch
+arm64-dts-imx8mm-q-fix-pad-control-of-sd1_data0.patch
+xfrm-provide-private-skb-extensions-for-segmented-an.patch
+can-bcm-raw-fix-msg_namelen-values-depending-on-can_.patch
+can-isotp-fix-msg_namelen-values-depending-on-can_re.patch
+can-uapi-can.h-mark-union-inside-struct-can_frame-pa.patch
+mlxsw-spectrum-fix-ecn-marking-in-tunnel-decapsulati.patch
+ethernet-myri10ge-fix-a-use-after-free-in-myri10ge_s.patch
+gianfar-handle-error-code-at-mac-address-change.patch
+net-dsa-fix-type-was-not-set-for-devlink-port.patch
+clk-qcom-camcc-update-the-clock-ops-for-the-sc7180.patch
+cxgb4-avoid-collecting-sge_qbase-regs-during-traffic.patch
+net-tipc-fix-a-double-free-in-tipc_sk_mcast_rcv.patch
+arm-dts-imx6-pbab01-set-vmmc-supply-for-both-sd-inte.patch
+net-ncsi-avoid-channel_monitor-hrtimer-deadlock.patch
+net-qrtr-fix-memory-leak-on-qrtr_tx_wait-failure.patch
+nfp-flower-ignore-duplicate-merge-hints-from-fw.patch
+net-phy-broadcom-only-advertise-eee-for-supported-mo.patch
+i2c-jz4780-fix-bug-for-ingenic-x1000.patch
+asoc-sunxi-sun4i-codec-fill-asoc-card-owner.patch
+net-mlx5e-fix-mapping-of-ct_label-zero.patch
+net-mlx5-delete-auxiliary-bus-driver-eth-rep-first.patch
+net-mlx5e-fix-ethtool-indication-of-connector-type.patch
+net-mlx5-don-t-request-more-than-supported-eqs.patch
+net-mlx5e-guarantee-room-for-xsk-wakeup-nop-on-async.patch
+net-rds-fix-a-use-after-free-in-rds_message_map_page.patch
+xdp-fix-xdp_return_frame-kernel-bug-throw-for-page_p.patch
+soc-fsl-qbman-fix-conflicting-alignment-attributes.patch
+i40e-fix-receiving-of-single-packets-in-xsk-zero-cop.patch
+i40e-fix-display-statistics-for-veb_tc.patch
+rdma-rtrs-clt-close-rtrs-client-conn-before-destroyi.patch
+drm-msm-set-drvdata-to-null-when-msm_drm_init-fails.patch
+net-udp-add-support-for-getsockopt-.-.-udp_gro.patch
+mptcp-forbit-mcast-related-sockopt-on-mptcp-sockets.patch
+mptcp-revert-mptcp-provide-subflow-aware-release-fun.patch
+scsi-ufs-core-fix-task-management-request-completion.patch
+scsi-ufs-core-fix-wrong-task-tag-used-in-task-manage.patch
+drm-msm-a6xx-fix-version-check-for-the-a650-sqe-micr.patch
+drm-msm-disp-dpu1-program-3d_merge-only-if-block-is-.patch
+revert-arm64-dts-marvell-armada-cp110-switch-to-per-.patch
+arm-dts-turris-omnia-fix-hardware-buffer-management.patch
+net-cls_api-fix-uninitialised-struct-field-bo-unlock.patch
+net-macb-restore-cmp-registers-on-resume-path.patch
+clk-fix-invalid-usage-of-list-cursor-in-register.patch
+clk-fix-invalid-usage-of-list-cursor-in-unregister.patch
+workqueue-move-the-position-of-debug_work_activate-i.patch
+s390-cpcmd-fix-inline-assembly-register-clobbering.patch
+perf-inject-fix-repipe-usage.patch
+openvswitch-fix-send-of-uninitialized-stack-memory-i.patch
+i2c-designware-adjust-bus_freq_hz-when-refuse-high-s.patch
+iwlwifi-fix-11ax-disabled-bit-in-the-regulatory-capa.patch
+can-mcp251x-fix-support-for-half-duplex-spi-host-con.patch
+platform-x86-intel-hid-fix-spurious-wakeups-caused-b.patch
+tipc-increment-the-tmp-aead-refcnt-before-attaching-.patch
+net-hns3-clear-vf-down-state-bit-before-request-link.patch
+net-mlx5-fix-hw-spec-violation-configuring-uplink.patch
+net-mlx5-fix-placement-of-log_max_flow_counter.patch
+net-mlx5-fix-pplm-register-mapping.patch
+net-mlx5-fix-pbmc-register-mapping.patch
+rdma-cxgb4-check-for-ipv6-address-properly-while-des.patch
+perf-report-fix-wrong-lbr-block-sorting.patch
+rdma-qedr-fix-kernel-panic-when-trying-to-access-rec.patch
+drm-vc4-crtc-reduce-pv-fifo-threshold-on-hvs4.patch
+i40e-fix-parameters-in-aq_get_phy_register.patch
+rdma-addr-be-strict-with-gid-size.patch
+vdpa-mlx5-should-exclude-header-length-and-fcs-from-.patch
+vdpa-mlx5-fix-wrong-use-of-bit-numbers.patch
--- /dev/null
+From b63231d3dee7ed9b6940cb53d4a0fbf039723411 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 14:15:23 +0100
+Subject: soc/fsl: qbman: fix conflicting alignment attributes
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 040f31196e8b2609613f399793b9225271b79471 ]
+
+When building with W=1, gcc points out that the __packed attribute
+on struct qm_eqcr_entry conflicts with the 8-byte alignment
+attribute on struct qm_fd inside it:
+
+drivers/soc/fsl/qbman/qman.c:189:1: error: alignment 1 of 'struct qm_eqcr_entry' is less than 8 [-Werror=packed-not-aligned]
+
+I assume that the alignment attribute is the correct one, and
+that qm_eqcr_entry cannot actually be unaligned in memory,
+so add the same alignment on the outer struct.
+
+Fixes: c535e923bb97 ("soc/fsl: Introduce DPAA 1.x QMan device driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20210323131530.2619900-1-arnd@kernel.org'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/qbman/qman.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
+index a1b9be1d105a..fde4edd83c14 100644
+--- a/drivers/soc/fsl/qbman/qman.c
++++ b/drivers/soc/fsl/qbman/qman.c
+@@ -186,7 +186,7 @@ struct qm_eqcr_entry {
+ __be32 tag;
+ struct qm_fd fd;
+ u8 __reserved3[32];
+-} __packed;
++} __packed __aligned(8);
+ #define QM_EQCR_VERB_VBIT 0x80
+ #define QM_EQCR_VERB_CMD_MASK 0x61 /* but only one value; */
+ #define QM_EQCR_VERB_CMD_ENQUEUE 0x01
+--
+2.30.2
+
--- /dev/null
+From 549c289fb413b4fa538903dd53d0b329b2b6f480 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Apr 2021 10:45:23 +0800
+Subject: tipc: increment the tmp aead refcnt before attaching it
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 2a2403ca3add03f542f6b34bef9f74649969b06d ]
+
+Li Shuang found a NULL pointer dereference crash in her testing:
+
+ [] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
+ [] RIP: 0010:tipc_crypto_rcv_complete+0xc8/0x7e0 [tipc]
+ [] Call Trace:
+ [] <IRQ>
+ [] tipc_crypto_rcv+0x2d9/0x8f0 [tipc]
+ [] tipc_rcv+0x2fc/0x1120 [tipc]
+ [] tipc_udp_recv+0xc6/0x1e0 [tipc]
+ [] udpv6_queue_rcv_one_skb+0x16a/0x460
+ [] udp6_unicast_rcv_skb.isra.35+0x41/0xa0
+ [] ip6_protocol_deliver_rcu+0x23b/0x4c0
+ [] ip6_input+0x3d/0xb0
+ [] ipv6_rcv+0x395/0x510
+ [] __netif_receive_skb_core+0x5fc/0xc40
+
+This is caused by NULL returned by tipc_aead_get(), and then crashed when
+dereferencing it later in tipc_crypto_rcv_complete(). This might happen
+when tipc_crypto_rcv_complete() is called by two threads at the same time:
+the tmp attached by tipc_crypto_key_attach() in one thread may be released
+by the one attached by that in the other thread.
+
+This patch is to fix it by incrementing the tmp's refcnt before attaching
+it instead of calling tipc_aead_get() after attaching it.
+
+Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
+Reported-by: Li Shuang <shuali@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/crypto.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c
+index f4fca8f7f63f..97710ce36047 100644
+--- a/net/tipc/crypto.c
++++ b/net/tipc/crypto.c
+@@ -1941,12 +1941,13 @@ static void tipc_crypto_rcv_complete(struct net *net, struct tipc_aead *aead,
+ goto rcv;
+ if (tipc_aead_clone(&tmp, aead) < 0)
+ goto rcv;
++ WARN_ON(!refcount_inc_not_zero(&tmp->refcnt));
+ if (tipc_crypto_key_attach(rx, tmp, ehdr->tx_key, false) < 0) {
+ tipc_aead_free(&tmp->rcu);
+ goto rcv;
+ }
+ tipc_aead_put(aead);
+- aead = tipc_aead_get(tmp);
++ aead = tmp;
+ }
+
+ if (unlikely(err)) {
+--
+2.30.2
+
--- /dev/null
+From d70b6f9d420c2176912b8615bc7a070cb1d56766 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 12:10:46 +0300
+Subject: vdpa/mlx5: Fix wrong use of bit numbers
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit 4b454a82418dd76d8c0590bb3f7a99a63ea57dc5 ]
+
+VIRTIO_F_VERSION_1 is a bit number. Use BIT_ULL() with mask
+conditionals.
+
+Also, in mlx5_vdpa_is_little_endian() use BIT_ULL for consistency with
+the rest of the code.
+
+Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices")
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Link: https://lore.kernel.org/r/20210408091047.4269-5-elic@nvidia.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/mlx5/net/mlx5_vnet.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+index 067c3977ea8e..ac6be2d722bb 100644
+--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+@@ -820,7 +820,7 @@ static int create_virtqueue(struct mlx5_vdpa_net *ndev, struct mlx5_vdpa_virtque
+ MLX5_SET(virtio_q, vq_ctx, event_qpn_or_msix, mvq->fwqp.mqp.qpn);
+ MLX5_SET(virtio_q, vq_ctx, queue_size, mvq->num_ent);
+ MLX5_SET(virtio_q, vq_ctx, virtio_version_1_0,
+- !!(ndev->mvdev.actual_features & VIRTIO_F_VERSION_1));
++ !!(ndev->mvdev.actual_features & BIT_ULL(VIRTIO_F_VERSION_1)));
+ MLX5_SET64(virtio_q, vq_ctx, desc_addr, mvq->desc_addr);
+ MLX5_SET64(virtio_q, vq_ctx, used_addr, mvq->device_addr);
+ MLX5_SET64(virtio_q, vq_ctx, available_addr, mvq->driver_addr);
+@@ -1550,7 +1550,7 @@ static void teardown_virtqueues(struct mlx5_vdpa_net *ndev)
+ static inline bool mlx5_vdpa_is_little_endian(struct mlx5_vdpa_dev *mvdev)
+ {
+ return virtio_legacy_is_little_endian() ||
+- (mvdev->actual_features & (1ULL << VIRTIO_F_VERSION_1));
++ (mvdev->actual_features & BIT_ULL(VIRTIO_F_VERSION_1));
+ }
+
+ static __virtio16 cpu_to_mlx5vdpa16(struct mlx5_vdpa_dev *mvdev, u16 val)
+--
+2.30.2
+
--- /dev/null
+From 7ba4e24f69c1798c93f522ffaad73387a9cb8621 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 12:10:43 +0300
+Subject: vdpa/mlx5: should exclude header length and fcs from mtu
+
+From: Si-Wei Liu <si-wei.liu@oracle.com>
+
+[ Upstream commit d084d996aaf53c0cc583dc75a4fc2a67fe485846 ]
+
+When feature VIRTIO_NET_F_MTU is negotiated on mlx5_vdpa,
+22 extra bytes worth of MTU length is shown in guest.
+This is because the mlx5_query_port_max_mtu API returns
+the "hardware" MTU value, which does not just contain the
+ Ethernet payload, but includes extra lengths starting
+from the Ethernet header up to the FCS altogether.
+
+Fix the MTU so packets won't get dropped silently.
+
+Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices")
+Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Eli Cohen <elic@nvidia.com>
+Link: https://lore.kernel.org/r/20210408091047.4269-2-elic@nvidia.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/mlx5/core/mlx5_vdpa.h | 4 ++++
+ drivers/vdpa/mlx5/net/mlx5_vnet.c | 15 ++++++++++++++-
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/vdpa/mlx5/core/mlx5_vdpa.h b/drivers/vdpa/mlx5/core/mlx5_vdpa.h
+index 08f742fd2409..b6cc53ba980c 100644
+--- a/drivers/vdpa/mlx5/core/mlx5_vdpa.h
++++ b/drivers/vdpa/mlx5/core/mlx5_vdpa.h
+@@ -4,9 +4,13 @@
+ #ifndef __MLX5_VDPA_H__
+ #define __MLX5_VDPA_H__
+
++#include <linux/etherdevice.h>
++#include <linux/if_vlan.h>
+ #include <linux/vdpa.h>
+ #include <linux/mlx5/driver.h>
+
++#define MLX5V_ETH_HARD_MTU (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN)
++
+ struct mlx5_vdpa_direct_mr {
+ u64 start;
+ u64 end;
+diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+index 09158f04fd6e..067c3977ea8e 100644
+--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+@@ -1902,6 +1902,19 @@ static const struct vdpa_config_ops mlx5_vdpa_ops = {
+ .free = mlx5_vdpa_free,
+ };
+
++static int query_mtu(struct mlx5_core_dev *mdev, u16 *mtu)
++{
++ u16 hw_mtu;
++ int err;
++
++ err = mlx5_query_nic_vport_mtu(mdev, &hw_mtu);
++ if (err)
++ return err;
++
++ *mtu = hw_mtu - MLX5V_ETH_HARD_MTU;
++ return 0;
++}
++
+ static int alloc_resources(struct mlx5_vdpa_net *ndev)
+ {
+ struct mlx5_vdpa_net_resources *res = &ndev->res;
+@@ -1987,7 +2000,7 @@ static int mlx5v_probe(struct auxiliary_device *adev,
+ init_mvqs(ndev);
+ mutex_init(&ndev->reslock);
+ config = &ndev->config;
+- err = mlx5_query_nic_vport_mtu(mdev, &ndev->mtu);
++ err = query_mtu(mdev, &ndev->mtu);
+ if (err)
+ goto err_mtu;
+
+--
+2.30.2
+
--- /dev/null
+From f458e2611839010345646af1741a1c66beb22ca2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 10:17:02 -0800
+Subject: virtchnl: Fix layout of RSS structures
+
+From: Norbert Ciosek <norbertx.ciosek@intel.com>
+
+[ Upstream commit 22f8b5df881e9f1302514bbbbbb8649c2051de55 ]
+
+Remove padding from RSS structures. Previous layout
+could lead to unwanted compiler optimizations
+in loops when iterating over key and lut arrays.
+
+Fixes: 65ece6de0114 ("virtchnl: Add missing explicit padding to structures")
+Signed-off-by: Norbert Ciosek <norbertx.ciosek@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/avf/virtchnl.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/include/linux/avf/virtchnl.h b/include/linux/avf/virtchnl.h
+index 40bad71865ea..532bcbfc4716 100644
+--- a/include/linux/avf/virtchnl.h
++++ b/include/linux/avf/virtchnl.h
+@@ -476,7 +476,6 @@ struct virtchnl_rss_key {
+ u16 vsi_id;
+ u16 key_len;
+ u8 key[1]; /* RSS hash key, packed bytes */
+- u8 pad[1];
+ };
+
+ VIRTCHNL_CHECK_STRUCT_LEN(6, virtchnl_rss_key);
+@@ -485,7 +484,6 @@ struct virtchnl_rss_lut {
+ u16 vsi_id;
+ u16 lut_entries;
+ u8 lut[1]; /* RSS lookup table */
+- u8 pad[1];
+ };
+
+ VIRTCHNL_CHECK_STRUCT_LEN(6, virtchnl_rss_lut);
+--
+2.30.2
+
--- /dev/null
+From f90c5aafbcc6145350160c1ed5ba7f83339660cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 16:35:32 +0100
+Subject: vxlan: do not modify the shared tunnel info when PMTU triggers an
+ ICMP reply
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit 30a93d2b7d5a7cbb53ac19c9364a256d1aa6c08a ]
+
+When the interface is part of a bridge or an Open vSwitch port and a
+packet exceed a PMTU estimate, an ICMP reply is sent to the sender. When
+using the external mode (collect metadata) the source and destination
+addresses are reversed, so that Open vSwitch can match the packet
+against an existing (reverse) flow.
+
+But inverting the source and destination addresses in the shared
+ip_tunnel_info will make following packets of the flow to use a wrong
+destination address (packets will be tunnelled to itself), if the flow
+isn't updated. Which happens with Open vSwitch, until the flow times
+out.
+
+Fixes this by uncloning the skb's ip_tunnel_info before inverting its
+source and destination addresses, so that the modification will only be
+made for the PTMU packet, not the following ones.
+
+Fixes: fc68c99577cc ("vxlan: Support for PMTU discovery on directly bridged links")
+Tested-by: Eelco Chaudron <echaudro@redhat.com>
+Reviewed-by: Eelco Chaudron <echaudro@redhat.com>
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 0842371eca3d..4adfa6a01198 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2725,12 +2725,17 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+ goto tx_error;
+ } else if (err) {
+ if (info) {
++ struct ip_tunnel_info *unclone;
+ struct in_addr src, dst;
+
++ unclone = skb_tunnel_info_unclone(skb);
++ if (unlikely(!unclone))
++ goto tx_error;
++
+ src = remote_ip.sin.sin_addr;
+ dst = local_ip.sin.sin_addr;
+- info->key.u.ipv4.src = src.s_addr;
+- info->key.u.ipv4.dst = dst.s_addr;
++ unclone->key.u.ipv4.src = src.s_addr;
++ unclone->key.u.ipv4.dst = dst.s_addr;
+ }
+ vxlan_encap_bypass(skb, vxlan, vxlan, vni, false);
+ dst_release(ndst);
+@@ -2781,12 +2786,17 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+ goto tx_error;
+ } else if (err) {
+ if (info) {
++ struct ip_tunnel_info *unclone;
+ struct in6_addr src, dst;
+
++ unclone = skb_tunnel_info_unclone(skb);
++ if (unlikely(!unclone))
++ goto tx_error;
++
+ src = remote_ip.sin6.sin6_addr;
+ dst = local_ip.sin6.sin6_addr;
+- info->key.u.ipv6.src = src;
+- info->key.u.ipv6.dst = dst;
++ unclone->key.u.ipv6.src = src;
++ unclone->key.u.ipv6.dst = dst;
+ }
+
+ vxlan_encap_bypass(skb, vxlan, vxlan, vni, false);
+--
+2.30.2
+
--- /dev/null
+From 4c3462c3458e16244fa4353ef7871878f95f1b44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Feb 2021 11:16:49 +0800
+Subject: workqueue: Move the position of debug_work_activate() in
+ __queue_work()
+
+From: Zqiang <qiang.zhang@windriver.com>
+
+[ Upstream commit 0687c66b5f666b5ad433f4e94251590d9bc9d10e ]
+
+The debug_work_activate() is called on the premise that
+the work can be inserted, because if wq be in WQ_DRAINING
+status, insert work may be failed.
+
+Fixes: e41e704bc4f4 ("workqueue: improve destroy_workqueue() debuggability")
+Signed-off-by: Zqiang <qiang.zhang@windriver.com>
+Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 894bb885b40b..6326a872510b 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1412,7 +1412,6 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
+ */
+ lockdep_assert_irqs_disabled();
+
+- debug_work_activate(work);
+
+ /* if draining, only works from the same workqueue are allowed */
+ if (unlikely(wq->flags & __WQ_DRAINING) &&
+@@ -1494,6 +1493,7 @@ retry:
+ worklist = &pwq->delayed_works;
+ }
+
++ debug_work_activate(work);
+ insert_work(pwq, work, worklist, work_flags);
+
+ out:
+--
+2.30.2
+
--- /dev/null
+From 3285b223c5f18c2f733945102b5b8bd0158c471a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 21:25:03 +0800
+Subject: xdp: fix xdp_return_frame() kernel BUG throw for page_pool memory
+ model
+
+From: Ong Boon Leong <boon.leong.ong@intel.com>
+
+[ Upstream commit 622d13694b5f048c01caa7ba548498d9880d4cb0 ]
+
+xdp_return_frame() may be called outside of NAPI context to return
+xdpf back to page_pool. xdp_return_frame() calls __xdp_return() with
+napi_direct = false. For page_pool memory model, __xdp_return() calls
+xdp_return_frame_no_direct() unconditionally and below false negative
+kernel BUG throw happened under preempt-rt build:
+
+[ 430.450355] BUG: using smp_processor_id() in preemptible [00000000] code: modprobe/3884
+[ 430.451678] caller is __xdp_return+0x1ff/0x2e0
+[ 430.452111] CPU: 0 PID: 3884 Comm: modprobe Tainted: G U E 5.12.0-rc2+ #45
+
+Changes in v2:
+ - This patch fixes the issue by making xdp_return_frame_no_direct() is
+ only called if napi_direct = true, as recommended for better by
+ Jesper Dangaard Brouer. Thanks!
+
+Fixes: 2539650fadbf ("xdp: Helpers for disabling napi_direct of xdp_return_frame")
+Signed-off-by: Ong Boon Leong <boon.leong.ong@intel.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/xdp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/xdp.c b/net/core/xdp.c
+index 3a8c9ab4ecbe..a86bc3660729 100644
+--- a/net/core/xdp.c
++++ b/net/core/xdp.c
+@@ -350,7 +350,8 @@ static void __xdp_return(void *data, struct xdp_mem_info *mem, bool napi_direct,
+ /* mem->id is valid, checked in xdp_rxq_info_reg_mem_model() */
+ xa = rhashtable_lookup(mem_id_ht, &mem->id, mem_id_rht_params);
+ page = virt_to_head_page(data);
+- napi_direct &= !xdp_return_frame_no_direct();
++ if (napi_direct && xdp_return_frame_no_direct())
++ napi_direct = false;
+ page_pool_put_full_page(xa->page_pool, page, napi_direct);
+ rcu_read_unlock();
+ break;
+--
+2.30.2
+
--- /dev/null
+From 0d732a45102674ee73a65754cc0a339f33264763 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 09:26:44 +0100
+Subject: xfrm: Fix NULL pointer dereference on policy lookup
+
+From: Steffen Klassert <steffen.klassert@secunet.com>
+
+[ Upstream commit b1e3a5607034aa0a481c6f69a6893049406665fb ]
+
+When xfrm interfaces are used in combination with namespaces
+and ESP offload, we get a dst_entry NULL pointer dereference.
+This is because we don't have a dst_entry attached in the ESP
+offloading case and we need to do a policy lookup before the
+namespace transition.
+
+Fix this by expicit checking of skb_dst(skb) before accessing it.
+
+Fixes: f203b76d78092 ("xfrm: Add virtual xfrm interfaces")
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xfrm.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index bfbc7810df94..c58a6d4eb610 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1097,7 +1097,7 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir,
+ return __xfrm_policy_check(sk, ndir, skb, family);
+
+ return (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) ||
+- (skb_dst(skb)->flags & DST_NOPOLICY) ||
++ (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) ||
+ __xfrm_policy_check(sk, ndir, skb, family);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From a8e26bf654d5310e9ae39416d59e9aa9c5723635 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Feb 2021 15:01:15 +0200
+Subject: xfrm: interface: fix ipv4 pmtu check to honor ip header df
+
+From: Eyal Birger <eyal.birger@gmail.com>
+
+[ Upstream commit 8fc0e3b6a8666d656923d214e4dc791e9a17164a ]
+
+Frag needed should only be sent if the header enables DF.
+
+This fix allows packets larger than MTU to pass the xfrm interface
+and be fragmented after encapsulation, aligning behavior with
+non-interface xfrm.
+
+Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
+Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_interface.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 697cdcfbb5e1..3f42c2f15ba4 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -305,6 +305,8 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+
+ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+ } else {
++ if (!(ip_hdr(skb)->frag_off & htons(IP_DF)))
++ goto xmit;
+ icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+ htonl(mtu));
+ }
+@@ -313,6 +315,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ return -EMSGSIZE;
+ }
+
++xmit:
+ xfrmi_scrub_packet(skb, !net_eq(xi->net, dev_net(dev)));
+ skb_dst_set(skb, dst);
+ skb->dev = tdev;
+--
+2.30.2
+
--- /dev/null
+From ac5a9a34dd93e9ec7a65d27688ceaa81a64890d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Mar 2021 09:44:48 +0100
+Subject: xfrm: Provide private skb extensions for segmented and hw offloaded
+ ESP packets
+
+From: Steffen Klassert <steffen.klassert@secunet.com>
+
+[ Upstream commit c7dbf4c08868d9db89b8bfe8f8245ca61b01ed2f ]
+
+Commit 94579ac3f6d0 ("xfrm: Fix double ESP trailer insertion in IPsec
+crypto offload.") added a XFRM_XMIT flag to avoid duplicate ESP trailer
+insertion on HW offload. This flag is set on the secpath that is shared
+amongst segments. This lead to a situation where some segments are
+not transformed correctly when segmentation happens at layer 3.
+
+Fix this by using private skb extensions for segmented and hw offloaded
+ESP packets.
+
+Fixes: 94579ac3f6d0 ("xfrm: Fix double ESP trailer insertion in IPsec crypto offload.")
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/esp4_offload.c | 11 ++++++++++-
+ net/ipv6/esp6_offload.c | 11 ++++++++++-
+ net/xfrm/xfrm_device.c | 2 --
+ 3 files changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
+index d5c0f5a2a551..5aa7344dbec7 100644
+--- a/net/ipv4/esp4_offload.c
++++ b/net/ipv4/esp4_offload.c
+@@ -314,8 +314,17 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_
+ ip_hdr(skb)->tot_len = htons(skb->len);
+ ip_send_check(ip_hdr(skb));
+
+- if (hw_offload)
++ if (hw_offload) {
++ if (!skb_ext_add(skb, SKB_EXT_SEC_PATH))
++ return -ENOMEM;
++
++ xo = xfrm_offload(skb);
++ if (!xo)
++ return -EINVAL;
++
++ xo->flags |= XFRM_XMIT;
+ return 0;
++ }
+
+ err = esp_output_tail(x, skb, &esp);
+ if (err)
+diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
+index f35203ab39f5..4af56affaafd 100644
+--- a/net/ipv6/esp6_offload.c
++++ b/net/ipv6/esp6_offload.c
+@@ -348,8 +348,17 @@ static int esp6_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features
+
+ ipv6_hdr(skb)->payload_len = htons(len);
+
+- if (hw_offload)
++ if (hw_offload) {
++ if (!skb_ext_add(skb, SKB_EXT_SEC_PATH))
++ return -ENOMEM;
++
++ xo = xfrm_offload(skb);
++ if (!xo)
++ return -EINVAL;
++
++ xo->flags |= XFRM_XMIT;
+ return 0;
++ }
+
+ err = esp6_output_tail(x, skb, &esp);
+ if (err)
+diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
+index edf11893dbe8..6d6917b68856 100644
+--- a/net/xfrm/xfrm_device.c
++++ b/net/xfrm/xfrm_device.c
+@@ -134,8 +134,6 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur
+ return skb;
+ }
+
+- xo->flags |= XFRM_XMIT;
+-
+ if (skb_is_gso(skb) && unlikely(x->xso.dev != dev)) {
+ struct sk_buff *segs;
+
+--
+2.30.2
+
--- /dev/null
+From dc0d68728802a936f8758465addd2a0f7a3048b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 08:00:04 +1300
+Subject: xfrm: Use actual socket sk instead of skb socket for
+ xfrm_output_resume
+
+From: Evan Nimmo <evan.nimmo@alliedtelesis.co.nz>
+
+[ Upstream commit 9ab1265d52314fce1b51e8665ea6dbc9ac1a027c ]
+
+A situation can occur where the interface bound to the sk is different
+to the interface bound to the sk attached to the skb. The interface
+bound to the sk is the correct one however this information is lost inside
+xfrm_output2 and instead the sk on the skb is used in xfrm_output_resume
+instead. This assumes that the sk bound interface and the bound interface
+attached to the sk within the skb are the same which can lead to lookup
+failures inside ip_route_me_harder resulting in the packet being dropped.
+
+We have an l2tp v3 tunnel with ipsec protection. The tunnel is in the
+global VRF however we have an encapsulated dot1q tunnel interface that
+is within a different VRF. We also have a mangle rule that marks the
+packets causing them to be processed inside ip_route_me_harder.
+
+Prior to commit 31c70d5956fc ("l2tp: keep original skb ownership") this
+worked fine as the sk attached to the skb was changed from the dot1q
+encapsulated interface to the sk for the tunnel which meant the interface
+bound to the sk and the interface bound to the skb were identical.
+Commit 46d6c5ae953c ("netfilter: use actual socket sk rather than skb sk
+when routing harder") fixed some of these issues however a similar
+problem existed in the xfrm code.
+
+Fixes: 31c70d5956fc ("l2tp: keep original skb ownership")
+Signed-off-by: Evan Nimmo <evan.nimmo@alliedtelesis.co.nz>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xfrm.h | 2 +-
+ net/ipv4/ah4.c | 2 +-
+ net/ipv4/esp4.c | 2 +-
+ net/ipv6/ah6.c | 2 +-
+ net/ipv6/esp6.c | 2 +-
+ net/xfrm/xfrm_output.c | 10 +++++-----
+ 6 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index b2a06f10b62c..bfbc7810df94 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1557,7 +1557,7 @@ int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb,
+ int xfrm_trans_queue(struct sk_buff *skb,
+ int (*finish)(struct net *, struct sock *,
+ struct sk_buff *));
+-int xfrm_output_resume(struct sk_buff *skb, int err);
++int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err);
+ int xfrm_output(struct sock *sk, struct sk_buff *skb);
+
+ #if IS_ENABLED(CONFIG_NET_PKTGEN)
+diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
+index d99e1be94019..36ed85bf2ad5 100644
+--- a/net/ipv4/ah4.c
++++ b/net/ipv4/ah4.c
+@@ -141,7 +141,7 @@ static void ah_output_done(struct crypto_async_request *base, int err)
+ }
+
+ kfree(AH_SKB_CB(skb)->tmp);
+- xfrm_output_resume(skb, err);
++ xfrm_output_resume(skb->sk, skb, err);
+ }
+
+ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
+diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
+index a3271ec3e162..4b834bbf95e0 100644
+--- a/net/ipv4/esp4.c
++++ b/net/ipv4/esp4.c
+@@ -279,7 +279,7 @@ static void esp_output_done(struct crypto_async_request *base, int err)
+ x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
+ esp_output_tail_tcp(x, skb);
+ else
+- xfrm_output_resume(skb, err);
++ xfrm_output_resume(skb->sk, skb, err);
+ }
+ }
+
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index 440080da805b..080ee7f44c64 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -316,7 +316,7 @@ static void ah6_output_done(struct crypto_async_request *base, int err)
+ }
+
+ kfree(AH_SKB_CB(skb)->tmp);
+- xfrm_output_resume(skb, err);
++ xfrm_output_resume(skb->sk, skb, err);
+ }
+
+ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
+index 2b804fcebcc6..4071cb7c7a15 100644
+--- a/net/ipv6/esp6.c
++++ b/net/ipv6/esp6.c
+@@ -314,7 +314,7 @@ static void esp_output_done(struct crypto_async_request *base, int err)
+ x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
+ esp_output_tail_tcp(x, skb);
+ else
+- xfrm_output_resume(skb, err);
++ xfrm_output_resume(skb->sk, skb, err);
+ }
+ }
+
+diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
+index a7ab19353313..b81ca117dac7 100644
+--- a/net/xfrm/xfrm_output.c
++++ b/net/xfrm/xfrm_output.c
+@@ -503,22 +503,22 @@ out:
+ return err;
+ }
+
+-int xfrm_output_resume(struct sk_buff *skb, int err)
++int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err)
+ {
+ struct net *net = xs_net(skb_dst(skb)->xfrm);
+
+ while (likely((err = xfrm_output_one(skb, err)) == 0)) {
+ nf_reset_ct(skb);
+
+- err = skb_dst(skb)->ops->local_out(net, skb->sk, skb);
++ err = skb_dst(skb)->ops->local_out(net, sk, skb);
+ if (unlikely(err != 1))
+ goto out;
+
+ if (!skb_dst(skb)->xfrm)
+- return dst_output(net, skb->sk, skb);
++ return dst_output(net, sk, skb);
+
+ err = nf_hook(skb_dst(skb)->ops->family,
+- NF_INET_POST_ROUTING, net, skb->sk, skb,
++ NF_INET_POST_ROUTING, net, sk, skb,
+ NULL, skb_dst(skb)->dev, xfrm_output2);
+ if (unlikely(err != 1))
+ goto out;
+@@ -534,7 +534,7 @@ EXPORT_SYMBOL_GPL(xfrm_output_resume);
+
+ static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+- return xfrm_output_resume(skb, 1);
++ return xfrm_output_resume(sk, skb, 1);
+ }
+
+ static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb)
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
