Fixes for 5.17

Signed-off-by: Sasha Levin <sashal@kernel.org>
diff --git a/queue-5.17/alsa-hda-fix-unused-realtek-function-when-pm-is-not-.patch b/queue-5.17/alsa-hda-fix-unused-realtek-function-when-pm-is-not-.patch
new file mode 100644
index 0000000..ca4aa32
--- /dev/null
+++ b/queue-5.17/alsa-hda-fix-unused-realtek-function-when-pm-is-not-.patch
@@ -0,0 +1,63 @@
+From 09b6cafa627c6f3a7351fc8e9878aac0ee18c39d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Apr 2022 12:33:18 -0700
+Subject: ALSA: hda - fix unused Realtek function when PM is not enabled
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit c3d9ca93f1e3bd3d1adfc4479a12c82fed424c87 ]
+
+When CONFIG_PM is not enabled, alc_shutup() is not needed,
+so move it inside the #ifdef CONFIG_PM guard.
+Also drop some contiguous #endif / #ifdef CONFIG_PM for simplicity.
+
+Fixes this build warning:
+sound/pci/hda/patch_realtek.c:886:20: warning: unused function 'alc_shutup'
+
+Fixes: 08c189f2c552 ("ALSA: hda - Use generic parser codes for Realtek driver")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/r/20220430193318.29024-1-rdunlap@infradead.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 779205bf5862..e38acdbe1a3b 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -937,6 +937,9 @@ static int alc_init(struct hda_codec *codec)
+ 	return 0;
+ }
+ 
++#define alc_free	snd_hda_gen_free
++
++#ifdef CONFIG_PM
+ static inline void alc_shutup(struct hda_codec *codec)
+ {
+ 	struct alc_spec *spec = codec->spec;
+@@ -950,9 +953,6 @@ static inline void alc_shutup(struct hda_codec *codec)
+ 		alc_shutup_pins(codec);
+ }
+ 
+-#define alc_free	snd_hda_gen_free
+-
+-#ifdef CONFIG_PM
+ static void alc_power_eapd(struct hda_codec *codec)
+ {
+ 	alc_auto_setup_eapd(codec, false);
+@@ -966,9 +966,7 @@ static int alc_suspend(struct hda_codec *codec)
+ 		spec->power_hook(codec);
+ 	return 0;
+ }
+-#endif
+ 
+-#ifdef CONFIG_PM
+ static int alc_resume(struct hda_codec *codec)
+ {
+ 	struct alc_spec *spec = codec->spec;
+-- 
+2.35.1
+
diff --git a/queue-5.17/arm-9196-1-spectre-bhb-enable-for-cortex-a15.patch b/queue-5.17/arm-9196-1-spectre-bhb-enable-for-cortex-a15.patch
new file mode 100644
index 0000000..cc5e027
--- /dev/null
+++ b/queue-5.17/arm-9196-1-spectre-bhb-enable-for-cortex-a15.patch
@@ -0,0 +1,36 @@
+From 0c4b9326d8fede6f2a89fec9da11a17a4bc2f64b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Apr 2022 09:44:51 +0100
+Subject: ARM: 9196/1: spectre-bhb: enable for Cortex-A15
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 0dc14aa94ccd8ba35eb17a0f9b123d1566efd39e ]
+
+The Spectre-BHB mitigations were inadvertently left disabled for
+Cortex-A15, due to the fact that cpu_v7_bugs_init() is not called in
+that case. So fix that.
+
+Fixes: b9baf5c8c5c3 ("ARM: Spectre-BHB workaround")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/proc-v7-bugs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c
+index 06dbfb968182..fb9f3eb6bf48 100644
+--- a/arch/arm/mm/proc-v7-bugs.c
++++ b/arch/arm/mm/proc-v7-bugs.c
+@@ -288,6 +288,7 @@ void cpu_v7_ca15_ibe(void)
+ {
+ 	if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0)))
+ 		cpu_v7_spectre_v2_init();
++	cpu_v7_spectre_bhb_init();
+ }
+ 
+ void cpu_v7_bugs_init(void)
+-- 
+2.35.1
+
diff --git a/queue-5.17/arm-9197-1-spectre-bhb-fix-loop8-sequence-for-thumb2.patch b/queue-5.17/arm-9197-1-spectre-bhb-fix-loop8-sequence-for-thumb2.patch
new file mode 100644
index 0000000..0ab9bf6
--- /dev/null
+++ b/queue-5.17/arm-9197-1-spectre-bhb-fix-loop8-sequence-for-thumb2.patch
@@ -0,0 +1,37 @@
+From 89fab676e9afd9efcf241c0e26026dba8f927eff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Apr 2022 09:46:17 +0100
+Subject: ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 3cfb3019979666bdf33a1010147363cf05e0f17b ]
+
+In Thumb2, 'b . + 4' produces a branch instruction that uses a narrow
+encoding, and so it does not jump to the following instruction as
+expected. So use W(b) instead.
+
+Fixes: 6c7cb60bff7a ("ARM: fix Thumb2 regression with Spectre BHB")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/entry-armv.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index ee3f7a599181..4bbd92d41031 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -1040,7 +1040,7 @@ vector_bhb_loop8_\name:
+ 
+ 	@ bhb workaround
+ 	mov	r0, #8
+-3:	b	. + 4
++3:	W(b)	. + 4
+ 	subs	r0, r0, #1
+ 	bne	3b
+ 	dsb
+-- 
+2.35.1
+
diff --git a/queue-5.17/arm-dts-aspeed-add-video-engine-to-g6.patch b/queue-5.17/arm-dts-aspeed-add-video-engine-to-g6.patch
new file mode 100644
index 0000000..f477641
--- /dev/null
+++ b/queue-5.17/arm-dts-aspeed-add-video-engine-to-g6.patch
@@ -0,0 +1,45 @@
+From 5f897874defd302ca0f4df4ba4a4336e12c791a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Mar 2022 03:23:51 +0000
+Subject: ARM: dts: aspeed: Add video engine to g6
+
+From: Howard Chiu <howard_chiu@aspeedtech.com>
+
+[ Upstream commit 32e62d1beab70d485980013312e747a25c4e13f7 ]
+
+This node was accidentally removed by commit 645afe73f951 ("ARM: dts:
+aspeed: ast2600: Update XDMA engine node").
+
+Fixes: 645afe73f951 ("ARM: dts: aspeed: ast2600: Update XDMA engine node")
+Signed-off-by: Howard Chiu <howard_chiu@aspeedtech.com>
+Link: https://lore.kernel.org/r/SG2PR06MB2315C57600A0132FEF40F21EE61E9@SG2PR06MB2315.apcprd06.prod.outlook.com
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/aspeed-g6.dtsi | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/arm/boot/dts/aspeed-g6.dtsi b/arch/arm/boot/dts/aspeed-g6.dtsi
+index c32e87fad4dc..aac55b3aeded 100644
+--- a/arch/arm/boot/dts/aspeed-g6.dtsi
++++ b/arch/arm/boot/dts/aspeed-g6.dtsi
+@@ -389,6 +389,16 @@ sbc: secure-boot-controller@1e6f2000 {
+ 				reg = <0x1e6f2000 0x1000>;
+ 			};
+ 
++			video: video@1e700000 {
++				compatible = "aspeed,ast2600-video-engine";
++				reg = <0x1e700000 0x1000>;
++				clocks = <&syscon ASPEED_CLK_GATE_VCLK>,
++					 <&syscon ASPEED_CLK_GATE_ECLK>;
++				clock-names = "vclk", "eclk";
++				interrupts = <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>;
++				status = "disabled";
++			};
++
+ 			gpio0: gpio@1e780000 {
+ 				#gpio-cells = <2>;
+ 				gpio-controller;
+-- 
+2.35.1
+
diff --git a/queue-5.17/arm-dts-aspeed-g6-fix-spi1-spi2-quad-pin-group.patch b/queue-5.17/arm-dts-aspeed-g6-fix-spi1-spi2-quad-pin-group.patch
new file mode 100644
index 0000000..6caeef8
--- /dev/null
+++ b/queue-5.17/arm-dts-aspeed-g6-fix-spi1-spi2-quad-pin-group.patch
@@ -0,0 +1,45 @@
+From 0a924260a7731f361d86da6d33b237c9f9cdd849 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Mar 2022 10:39:32 -0700
+Subject: ARM: dts: aspeed-g6: fix SPI1/SPI2 quad pin group
+
+From: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
+
+[ Upstream commit 890362d41b244536ab63591f813393f5fdf59ed7 ]
+
+Fix incorrect function mappings in pinctrl_qspi1_default and
+pinctrl_qspi2_default since their function should be SPI1 and
+SPI2 respectively.
+
+Fixes: f510f04c8c83 ("ARM: dts: aspeed: Add AST2600 pinmux nodes")
+Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
+Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+Link: https://lore.kernel.org/r/20220329173932.2588289-8-quic_jaehyoo@quicinc.com
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi
+index 06d60a8540e9..ac07c240419a 100644
+--- a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi
++++ b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi
+@@ -648,12 +648,12 @@ pinctrl_pwm9g1_default: pwm9g1_default {
+ 	};
+ 
+ 	pinctrl_qspi1_default: qspi1_default {
+-		function = "QSPI1";
++		function = "SPI1";
+ 		groups = "QSPI1";
+ 	};
+ 
+ 	pinctrl_qspi2_default: qspi2_default {
+-		function = "QSPI2";
++		function = "SPI2";
+ 		groups = "QSPI2";
+ 	};
+ 
+-- 
+2.35.1
+
diff --git a/queue-5.17/arm-dts-aspeed-g6-remove-fwqspid-group-in-pinctrl-dt.patch b/queue-5.17/arm-dts-aspeed-g6-remove-fwqspid-group-in-pinctrl-dt.patch
new file mode 100644
index 0000000..1a5309f
--- /dev/null
+++ b/queue-5.17/arm-dts-aspeed-g6-remove-fwqspid-group-in-pinctrl-dt.patch
@@ -0,0 +1,43 @@
+From 98d1e0ad2ed5bcdaa1d2f9d9665bb7e0edbec959 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Mar 2022 10:39:26 -0700
+Subject: ARM: dts: aspeed-g6: remove FWQSPID group in pinctrl dtsi
+
+From: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
+
+[ Upstream commit efddaa397cceefb61476e383c26fafd1f8ab6356 ]
+
+FWSPIDQ2 and FWSPIDQ3 are not part of FWSPI18 interface so remove
+FWQSPID group in pinctrl dtsi. These pins must be used with the
+FWSPI pins that are dedicated for boot SPI interface which provides
+same 3.3v logic level.
+
+Fixes: 2f6edb6bcb2f ("ARM: dts: aspeed: Fix AST2600 quad spi group")
+Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
+Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+Link: https://lore.kernel.org/r/20220329173932.2588289-2-quic_jaehyoo@quicinc.com
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi
+index e4775bbceecc..06d60a8540e9 100644
+--- a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi
++++ b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi
+@@ -117,11 +117,6 @@ pinctrl_fwspid_default: fwspid_default {
+ 		groups = "FWSPID";
+ 	};
+ 
+-	pinctrl_fwqspid_default: fwqspid_default {
+-		function = "FWSPID";
+-		groups = "FWQSPID";
+-	};
+-
+ 	pinctrl_fwspiwp_default: fwspiwp_default {
+ 		function = "FWSPIWP";
+ 		groups = "FWSPIWP";
+-- 
+2.35.1
+
diff --git a/queue-5.17/arm64-dts-qcom-sm8250-don-t-enable-rx-tx-macro-by-de.patch b/queue-5.17/arm64-dts-qcom-sm8250-don-t-enable-rx-tx-macro-by-de.patch
new file mode 100644
index 0000000..e6fe68b
--- /dev/null
+++ b/queue-5.17/arm64-dts-qcom-sm8250-don-t-enable-rx-tx-macro-by-de.patch
@@ -0,0 +1,108 @@
+From 0f2e00e1e9d5f925467f1580fdd103e4c0bddf18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Apr 2022 21:58:14 +0300
+Subject: arm64: dts: qcom: sm8250: don't enable rx/tx macro by default
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 18019eb62efb68c9b365acca9c4fcb2e0d459487 ]
+
+Enabling rxmacro and txmacro nodes by defaults makes Qualcomm RB5 to
+crash and reboot while probing audio devices. Disable these device tree
+nodes by default and enabled them only when necessary (for the
+SM8250-MTP board).
+
+Fixes: 24f52ef0c4bf ("arm64: dts: qcom: sm8250: Add nodes for tx and rx macros with soundwire masters")
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220401185814.519653-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250-mtp.dts | 12 ++++++++++++
+ arch/arm64/boot/dts/qcom/sm8250.dtsi    |  4 ++++
+ 2 files changed, 16 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250-mtp.dts b/arch/arm64/boot/dts/qcom/sm8250-mtp.dts
+index fb99cc2827c7..7ab3627cc347 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250-mtp.dts
++++ b/arch/arm64/boot/dts/qcom/sm8250-mtp.dts
+@@ -622,6 +622,10 @@ &qupv3_id_2 {
+ 	status = "okay";
+ };
+ 
++&rxmacro {
++	status = "okay";
++};
++
+ &slpi {
+ 	status = "okay";
+ 	firmware-name = "qcom/sm8250/slpi.mbn";
+@@ -773,6 +777,8 @@ right_spkr: wsa8810-left@0,4{
+ };
+ 
+ &swr1 {
++	status = "okay";
++
+ 	wcd_rx: wcd9380-rx@0,4 {
+ 		compatible = "sdw20217010d00";
+ 		reg = <0 4>;
+@@ -781,6 +787,8 @@ wcd_rx: wcd9380-rx@0,4 {
+ };
+ 
+ &swr2 {
++	status = "okay";
++
+ 	wcd_tx: wcd9380-tx@0,3 {
+ 		compatible = "sdw20217010d00";
+ 		reg = <0 3>;
+@@ -819,6 +827,10 @@ config {
+ 	};
+ };
+ 
++&txmacro {
++	status = "okay";
++};
++
+ &uart12 {
+ 	status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index a92230bec1dd..bd212f6c351f 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -2150,6 +2150,7 @@ rxmacro: rxmacro@3200000 {
+ 			pinctrl-0 = <&rx_swr_active>;
+ 			compatible = "qcom,sm8250-lpass-rx-macro";
+ 			reg = <0 0x3200000 0 0x1000>;
++			status = "disabled";
+ 
+ 			clocks = <&q6afecc LPASS_CLK_ID_TX_CORE_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+ 				<&q6afecc LPASS_CLK_ID_TX_CORE_NPL_MCLK  LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+@@ -2168,6 +2169,7 @@ rxmacro: rxmacro@3200000 {
+ 		swr1: soundwire-controller@3210000 {
+ 			reg = <0 0x3210000 0 0x2000>;
+ 			compatible = "qcom,soundwire-v1.5.1";
++			status = "disabled";
+ 			interrupts = <GIC_SPI 298 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&rxmacro>;
+ 			clock-names = "iface";
+@@ -2195,6 +2197,7 @@ txmacro: txmacro@3220000 {
+ 			pinctrl-0 = <&tx_swr_active>;
+ 			compatible = "qcom,sm8250-lpass-tx-macro";
+ 			reg = <0 0x3220000 0 0x1000>;
++			status = "disabled";
+ 
+ 			clocks = <&q6afecc LPASS_CLK_ID_TX_CORE_MCLK LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+ 				 <&q6afecc LPASS_CLK_ID_TX_CORE_NPL_MCLK  LPASS_CLK_ATTRIBUTE_COUPLE_NO>,
+@@ -2218,6 +2221,7 @@ swr2: soundwire-controller@3230000 {
+ 			compatible = "qcom,soundwire-v1.5.1";
+ 			interrupts-extended = <&intc GIC_SPI 297 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "core";
++			status = "disabled";
+ 
+ 			clocks = <&txmacro>;
+ 			clock-names = "iface";
+-- 
+2.35.1
+
diff --git a/queue-5.17/arm64-enable-repeat-tlbi-workaround-on-kryo4xx-gold-.patch b/queue-5.17/arm64-enable-repeat-tlbi-workaround-on-kryo4xx-gold-.patch
new file mode 100644
index 0000000..2eb7098
--- /dev/null
+++ b/queue-5.17/arm64-enable-repeat-tlbi-workaround-on-kryo4xx-gold-.patch
@@ -0,0 +1,57 @@
+From faddba1d5fd4ef8af3740fa1cac74fdd3296af36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 May 2022 16:31:34 +0530
+Subject: arm64: Enable repeat tlbi workaround on KRYO4XX gold CPUs
+
+From: Shreyas K K <quic_shrekk@quicinc.com>
+
+[ Upstream commit 51f559d66527e238f9a5f82027bff499784d4eac ]
+
+Add KRYO4XX gold/big cores to the list of CPUs that need the
+repeat TLBI workaround. Apply this to the affected
+KRYO4XX cores (rcpe to rfpe).
+
+The variant and revision bits are implementation defined and are
+different from the their Cortex CPU counterparts on which they are
+based on, i.e., (r0p0 to r3p0) is equivalent to (rcpe to rfpe).
+
+Signed-off-by: Shreyas K K <quic_shrekk@quicinc.com>
+Reviewed-by: Sai Prakash Ranjan <quic_saipraka@quicinc.com>
+Link: https://lore.kernel.org/r/20220512110134.12179-1-quic_shrekk@quicinc.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/arm64/silicon-errata.rst | 3 +++
+ arch/arm64/kernel/cpu_errata.c         | 2 ++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst
+index ea281dd75517..29b136849d30 100644
+--- a/Documentation/arm64/silicon-errata.rst
++++ b/Documentation/arm64/silicon-errata.rst
+@@ -189,6 +189,9 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | Qualcomm Tech. | Kryo4xx Silver  | N/A             | ARM64_ERRATUM_1024718       |
+ +----------------+-----------------+-----------------+-----------------------------+
++| Qualcomm Tech. | Kryo4xx Gold    | N/A             | ARM64_ERRATUM_1286807       |
+++----------------+-----------------+-----------------+-----------------------------+
++
+ +----------------+-----------------+-----------------+-----------------------------+
+ | Fujitsu        | A64FX           | E#010001        | FUJITSU_ERRATUM_010001      |
+ +----------------+-----------------+-----------------+-----------------------------+
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index 146fa2e76834..10c865e311a0 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -208,6 +208,8 @@ static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = {
+ #ifdef CONFIG_ARM64_ERRATUM_1286807
+ 	{
+ 		ERRATA_MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 0),
++		/* Kryo4xx Gold (rcpe to rfpe) => (r0p0 to r3p0) */
++		ERRATA_MIDR_RANGE(MIDR_QCOM_KRYO_4XX_GOLD, 0xc, 0xe, 0xf, 0xe),
+ 	},
+ #endif
+ 	{},
+-- 
+2.35.1
+
diff --git a/queue-5.17/arm64-kexec-load-from-kimage-prior-to-clobbering.patch b/queue-5.17/arm64-kexec-load-from-kimage-prior-to-clobbering.patch
new file mode 100644
index 0000000..142360f
--- /dev/null
+++ b/queue-5.17/arm64-kexec-load-from-kimage-prior-to-clobbering.patch
@@ -0,0 +1,90 @@
+From 94f293dc2cfe4939d3588589de8bf15441c778d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 May 2022 17:07:35 +0100
+Subject: arm64: kexec: load from kimage prior to clobbering
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit eb3d8ea3e1f03f4b0b72d8f5ed9eb7c3165862e8 ]
+
+In arm64_relocate_new_kernel() we load some fields out of the kimage
+structure after relocation has occurred. As the kimage structure isn't
+allocated to be relocation-safe, it may be clobbered during relocation,
+and we may load junk values out of the structure.
+
+Due to this, kexec may fail when the kimage allocation happens to fall
+within a PA range that an object will be relocated to. This has been
+observed to occur for regular kexec on a QEMU TCG 'virt' machine with
+2GiB of RAM, where the PA range of the new kernel image overlaps the
+kimage structure.
+
+Avoid this by ensuring we load all values from the kimage structure
+prior to relocation.
+
+I've tested this atop v5.16 and v5.18-rc6.
+
+Fixes: 878fdbd70486 ("arm64: kexec: pass kimage as the only argument to relocation function")
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: James Morse <james.morse@arm.com>
+Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
+Cc: Will Deacon <will@kernel.org>
+Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
+Link: https://lore.kernel.org/r/20220516160735.731404-1-mark.rutland@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/relocate_kernel.S | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm64/kernel/relocate_kernel.S b/arch/arm64/kernel/relocate_kernel.S
+index f0a3df9e18a3..413f899e4ac6 100644
+--- a/arch/arm64/kernel/relocate_kernel.S
++++ b/arch/arm64/kernel/relocate_kernel.S
+@@ -37,6 +37,15 @@
+  * safe memory that has been set up to be preserved during the copy operation.
+  */
+ SYM_CODE_START(arm64_relocate_new_kernel)
++	/*
++	 * The kimage structure isn't allocated specially and may be clobbered
++	 * during relocation. We must load any values we need from it prior to
++	 * any relocation occurring.
++	 */
++	ldr	x28, [x0, #KIMAGE_START]
++	ldr	x27, [x0, #KIMAGE_ARCH_EL2_VECTORS]
++	ldr	x26, [x0, #KIMAGE_ARCH_DTB_MEM]
++
+ 	/* Setup the list loop variables. */
+ 	ldr	x18, [x0, #KIMAGE_ARCH_ZERO_PAGE] /* x18 = zero page for BBM */
+ 	ldr	x17, [x0, #KIMAGE_ARCH_TTBR1]	/* x17 = linear map copy */
+@@ -72,21 +81,20 @@ SYM_CODE_START(arm64_relocate_new_kernel)
+ 	ic	iallu
+ 	dsb	nsh
+ 	isb
+-	ldr	x4, [x0, #KIMAGE_START]			/* relocation start */
+-	ldr	x1, [x0, #KIMAGE_ARCH_EL2_VECTORS]	/* relocation start */
+-	ldr	x0, [x0, #KIMAGE_ARCH_DTB_MEM]		/* dtb address */
+ 	turn_off_mmu x12, x13
+ 
+ 	/* Start new image. */
+-	cbz	x1, .Lel1
+-	mov	x1, x4				/* relocation start */
+-	mov	x2, x0				/* dtb address */
++	cbz	x27, .Lel1
++	mov	x1, x28				/* kernel entry point */
++	mov	x2, x26				/* dtb address */
+ 	mov	x3, xzr
+ 	mov	x4, xzr
+ 	mov     x0, #HVC_SOFT_RESTART
+ 	hvc	#0				/* Jumps from el2 */
+ .Lel1:
++	mov	x0, x26				/* dtb address */
++	mov	x1, xzr
+ 	mov	x2, xzr
+ 	mov	x3, xzr
+-	br	x4				/* Jumps from el1 */
++	br	x28				/* Jumps from el1 */
+ SYM_CODE_END(arm64_relocate_new_kernel)
+-- 
+2.35.1
+
diff --git a/queue-5.17/block-mq-deadline-set-the-fifo_time-member-also-if-i.patch b/queue-5.17/block-mq-deadline-set-the-fifo_time-member-also-if-i.patch
new file mode 100644
index 0000000..2c55944
--- /dev/null
+++ b/queue-5.17/block-mq-deadline-set-the-fifo_time-member-also-if-i.patch
@@ -0,0 +1,41 @@
+From fad78d1779995d356f0d4e575e3964e75d7aac68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 May 2022 10:13:07 -0700
+Subject: block/mq-deadline: Set the fifo_time member also if inserting at head
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 725f22a1477c9c15aa67ad3af96fe28ec4fe72d2 ]
+
+Before commit 322cff70d46c the fifo_time member of requests on a dispatch
+list was not used. Commit 322cff70d46c introduces code that reads the
+fifo_time member of requests on dispatch lists. Hence this patch that sets
+the fifo_time member when adding a request to a dispatch list.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Ming Lei <ming.lei@redhat.com>
+Cc: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Fixes: 322cff70d46c ("block/mq-deadline: Prioritize high-priority requests")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20220513171307.32564-1-bvanassche@acm.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/mq-deadline.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/block/mq-deadline.c b/block/mq-deadline.c
+index 3ed5eaf3446a..6ed602b2f80a 100644
+--- a/block/mq-deadline.c
++++ b/block/mq-deadline.c
+@@ -742,6 +742,7 @@ static void dd_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
+ 
+ 	if (at_head) {
+ 		list_add(&rq->queuelist, &per_prio->dispatch);
++		rq->fifo_time = jiffies;
+ 	} else {
+ 		deadline_add_rq_rb(per_prio, rq);
+ 
+-- 
+2.35.1
+
diff --git a/queue-5.17/cfg80211-retrieve-s1g-operating-channel-number.patch b/queue-5.17/cfg80211-retrieve-s1g-operating-channel-number.patch
new file mode 100644
index 0000000..7c4591a
--- /dev/null
+++ b/queue-5.17/cfg80211-retrieve-s1g-operating-channel-number.patch
@@ -0,0 +1,40 @@
+From 32c1dcaab7e48463f712a3059df18df419ea4b7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Apr 2022 04:13:20 +0000
+Subject: cfg80211: retrieve S1G operating channel number
+
+From: Kieran Frewen <kieran.frewen@morsemicro.com>
+
+[ Upstream commit e847ffe2d146cfd52980ca688d84358e024a6e70 ]
+
+When retrieving the S1G channel number from IEs, we should retrieve
+the operating channel instead of the primary channel. The S1G operation
+element specifies the main channel of operation as the oper channel,
+unlike for HT and HE which specify their main channel of operation as
+the primary channel.
+
+Signed-off-by: Kieran Frewen <kieran.frewen@morsemicro.com>
+Signed-off-by: Bassem Dawood <bassem@morsemicro.com>
+Link: https://lore.kernel.org/r/20220420041321.3788789-1-kieran.frewen@morsemicro.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index 4a6d86432910..6d82bd9eaf8c 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -1829,7 +1829,7 @@ int cfg80211_get_ies_channel_number(const u8 *ie, size_t ielen,
+ 		if (tmp && tmp->datalen >= sizeof(struct ieee80211_s1g_oper_ie)) {
+ 			struct ieee80211_s1g_oper_ie *s1gop = (void *)tmp->data;
+ 
+-			return s1gop->primary_ch;
++			return s1gop->oper_ch;
+ 		}
+ 	} else {
+ 		tmp = cfg80211_find_elem(WLAN_EID_DS_PARAMS, ie, ielen);
+-- 
+2.35.1
+
diff --git a/queue-5.17/clk-at91-generated-consider-range-when-calculating-b.patch b/queue-5.17/clk-at91-generated-consider-range-when-calculating-b.patch
new file mode 100644
index 0000000..208c301
--- /dev/null
+++ b/queue-5.17/clk-at91-generated-consider-range-when-calculating-b.patch
@@ -0,0 +1,42 @@
+From 4e636dfbae904babd95d26eae073c6a6d26f15d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Apr 2022 10:13:18 +0300
+Subject: clk: at91: generated: consider range when calculating best rate
+
+From: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+
+[ Upstream commit d0031e6fbed955ff8d5f5bbc8fe7382482559cec ]
+
+clk_generated_best_diff() helps in finding the parent and the divisor to
+compute a rate closest to the required one. However, it doesn't take into
+account the request's range for the new rate. Make sure the new rate
+is within the required range.
+
+Fixes: 8a8f4bf0c480 ("clk: at91: clk-generated: create function to find best_diff")
+Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Link: https://lore.kernel.org/r/20220413071318.244912-1-codrin.ciubotariu@microchip.com
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-generated.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c
+index 23cc8297ec4c..d429ba52a719 100644
+--- a/drivers/clk/at91/clk-generated.c
++++ b/drivers/clk/at91/clk-generated.c
+@@ -117,6 +117,10 @@ static void clk_generated_best_diff(struct clk_rate_request *req,
+ 		tmp_rate = parent_rate;
+ 	else
+ 		tmp_rate = parent_rate / div;
++
++	if (tmp_rate < req->min_rate || tmp_rate > req->max_rate)
++		return;
++
+ 	tmp_diff = abs(req->rate - tmp_rate);
+ 
+ 	if (*best_diff < 0 || *best_diff >= tmp_diff) {
+-- 
+2.35.1
+
diff --git a/queue-5.17/drm-amd-display-undo-clearing-of-z10-related-functio.patch b/queue-5.17/drm-amd-display-undo-clearing-of-z10-related-functio.patch
new file mode 100644
index 0000000..8df9cfa
--- /dev/null
+++ b/queue-5.17/drm-amd-display-undo-clearing-of-z10-related-functio.patch
@@ -0,0 +1,42 @@
+From 030fc735932ad571a12a691fae8e821fd3e0300b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Mar 2022 16:34:24 -0400
+Subject: drm/amd/display: undo clearing of z10 related function pointers
+
+From: Eric Yang <Eric.Yang2@amd.com>
+
+[ Upstream commit 9b9bd3f640640f94272a461b2dfe558f91b322c5 ]
+
+[Why]
+Z10 and S0i3 have some shared path. Previous code clean up ,
+incorrectly removed these pointers, which breaks s0i3 restore
+
+[How]
+Do not clear the function pointers based on Z10 disable.
+
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Pavle Kotarac <Pavle.Kotarac@amd.com>
+Signed-off-by: Eric Yang <Eric.Yang2@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c
+index d7559e5a99ce..e708f07fe75a 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c
+@@ -153,9 +153,4 @@ void dcn31_hw_sequencer_construct(struct dc *dc)
+ 		dc->hwss.init_hw = dcn20_fpga_init_hw;
+ 		dc->hwseq->funcs.init_pipes = NULL;
+ 	}
+-	if (dc->debug.disable_z10) {
+-		/*hw not support z10 or sw disable it*/
+-		dc->hwss.z10_restore = NULL;
+-		dc->hwss.z10_save_init = NULL;
+-	}
+ }
+-- 
+2.35.1
+
diff --git a/queue-5.17/ethernet-tulip-fix-missing-pci_disable_device-on-err.patch b/queue-5.17/ethernet-tulip-fix-missing-pci_disable_device-on-err.patch
new file mode 100644
index 0000000..a7d1225
--- /dev/null
+++ b/queue-5.17/ethernet-tulip-fix-missing-pci_disable_device-on-err.patch
@@ -0,0 +1,49 @@
+From 9bb00bb90329f88284d7041e413605ca532b2801 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 May 2022 17:42:50 +0800
+Subject: ethernet: tulip: fix missing pci_disable_device() on error in
+ tulip_init_one()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 51ca86b4c9c7c75f5630fa0dbe5f8f0bd98e3c3e ]
+
+Fix the missing pci_disable_device() before return
+from tulip_init_one() in the error handling case.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20220506094250.3630615-1-yangyingliang@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dec/tulip/tulip_core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c
+index 79df5a72877b..0040dcaab945 100644
+--- a/drivers/net/ethernet/dec/tulip/tulip_core.c
++++ b/drivers/net/ethernet/dec/tulip/tulip_core.c
+@@ -1399,8 +1399,10 @@ static int tulip_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 
+ 	/* alloc_etherdev ensures aligned and zeroed private structures */
+ 	dev = alloc_etherdev (sizeof (*tp));
+-	if (!dev)
++	if (!dev) {
++		pci_disable_device(pdev);
+ 		return -ENOMEM;
++	}
+ 
+ 	SET_NETDEV_DEV(dev, &pdev->dev);
+ 	if (pci_resource_len (pdev, 0) < tulip_tbl[chip_idx].io_size) {
+@@ -1785,6 +1787,7 @@ static int tulip_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 
+ err_out_free_netdev:
+ 	free_netdev (dev);
++	pci_disable_device(pdev);
+ 	return -ENODEV;
+ }
+ 
+-- 
+2.35.1
+
diff --git a/queue-5.17/fbdev-prevent-possible-use-after-free-in-fb_release.patch b/queue-5.17/fbdev-prevent-possible-use-after-free-in-fb_release.patch
new file mode 100644
index 0000000..52dfd73
--- /dev/null
+++ b/queue-5.17/fbdev-prevent-possible-use-after-free-in-fb_release.patch
@@ -0,0 +1,47 @@
+From 389b61343bbcd31b27e73ba7ef7e189c996166e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 May 2022 00:04:13 +0200
+Subject: fbdev: Prevent possible use-after-free in fb_release()
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+[ Upstream commit 89bfd4017e58faaf70411555e7f508495114e90b ]
+
+Most fbdev drivers have issues with the fb_info lifetime, because call to
+framebuffer_release() from their driver's .remove callback, rather than
+doing from fbops.fb_destroy callback.
+
+Doing that will destroy the fb_info too early, while references to it may
+still exist, leading to a use-after-free error.
+
+To prevent this, check the fb_info reference counter when attempting to
+kfree the data structure in framebuffer_release(). That will leak it but
+at least will prevent the mentioned error.
+
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220505220413.365977-1-javierm@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/fbsysfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/video/fbdev/core/fbsysfs.c b/drivers/video/fbdev/core/fbsysfs.c
+index 26892940c213..82e31a2d845e 100644
+--- a/drivers/video/fbdev/core/fbsysfs.c
++++ b/drivers/video/fbdev/core/fbsysfs.c
+@@ -80,6 +80,10 @@ void framebuffer_release(struct fb_info *info)
+ {
+ 	if (!info)
+ 		return;
++
++	if (WARN_ON(refcount_read(&info->count)))
++		return;
++
+ 	kfree(info->apertures);
+ 	kfree(info);
+ }
+-- 
+2.35.1
+
diff --git a/queue-5.17/gpio-gpio-vf610-do-not-touch-other-bits-when-set-the.patch b/queue-5.17/gpio-gpio-vf610-do-not-touch-other-bits-when-set-the.patch
new file mode 100644
index 0000000..734e9c6
--- /dev/null
+++ b/queue-5.17/gpio-gpio-vf610-do-not-touch-other-bits-when-set-the.patch
@@ -0,0 +1,45 @@
+From 331f68136039f44c2b9a8eef5f7497c563cc80b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 May 2022 10:15:04 +0800
+Subject: gpio: gpio-vf610: do not touch other bits when set the target bit
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+[ Upstream commit 9bf3ac466faa83d51a8fe9212131701e58fdef74 ]
+
+For gpio controller contain register PDDR, when set one target bit,
+current logic will clear all other bits, this is wrong. Use operator
+'|=' to fix it.
+
+Fixes: 659d8a62311f ("gpio: vf610: add imx7ulp support")
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-vf610.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
+index 20780c35da1b..23cddb265a0d 100644
+--- a/drivers/gpio/gpio-vf610.c
++++ b/drivers/gpio/gpio-vf610.c
+@@ -125,9 +125,13 @@ static int vf610_gpio_direction_output(struct gpio_chip *chip, unsigned gpio,
+ {
+ 	struct vf610_gpio_port *port = gpiochip_get_data(chip);
+ 	unsigned long mask = BIT(gpio);
++	u32 val;
+ 
+-	if (port->sdata && port->sdata->have_paddr)
+-		vf610_gpio_writel(mask, port->gpio_base + GPIO_PDDR);
++	if (port->sdata && port->sdata->have_paddr) {
++		val = vf610_gpio_readl(port->gpio_base + GPIO_PDDR);
++		val |= mask;
++		vf610_gpio_writel(val, port->gpio_base + GPIO_PDDR);
++	}
+ 
+ 	vf610_gpio_set(chip, gpio, value);
+ 
+-- 
+2.35.1
+
diff --git a/queue-5.17/gpio-mvebu-pwm-refuse-requests-with-inverted-polarit.patch b/queue-5.17/gpio-mvebu-pwm-refuse-requests-with-inverted-polarit.patch
new file mode 100644
index 0000000..0d63fce
--- /dev/null
+++ b/queue-5.17/gpio-mvebu-pwm-refuse-requests-with-inverted-polarit.patch
@@ -0,0 +1,40 @@
+From 606c7db2662668a209ce8501276e9d6379dcebea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 May 2022 09:58:56 +0200
+Subject: gpio: mvebu/pwm: Refuse requests with inverted polarity
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 3ecb10175b1f776f076553c24e2689e42953fef5 ]
+
+The driver doesn't take struct pwm_state::polarity into account when
+configuring the hardware, so refuse requests for inverted polarity.
+
+Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-mvebu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
+index a2c8dd329b31..2db19cd640a4 100644
+--- a/drivers/gpio/gpio-mvebu.c
++++ b/drivers/gpio/gpio-mvebu.c
+@@ -707,6 +707,9 @@ static int mvebu_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ 	unsigned long flags;
+ 	unsigned int on, off;
+ 
++	if (state->polarity != PWM_POLARITY_NORMAL)
++		return -EINVAL;
++
+ 	val = (unsigned long long) mvpwm->clk_rate * state->duty_cycle;
+ 	do_div(val, NSEC_PER_SEC);
+ 	if (val > UINT_MAX + 1ULL)
+-- 
+2.35.1
+
diff --git a/queue-5.17/i915-guc-reset-make-__guc_reset_context-aware-of-gui.patch b/queue-5.17/i915-guc-reset-make-__guc_reset_context-aware-of-gui.patch
new file mode 100644
index 0000000..b1b0e3e
--- /dev/null
+++ b/queue-5.17/i915-guc-reset-make-__guc_reset_context-aware-of-gui.patch
@@ -0,0 +1,155 @@
+From 2c7e9b10dba4d2a708a5210a820432e4a8b66bd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Apr 2022 17:30:45 -0700
+Subject: i915/guc/reset: Make __guc_reset_context aware of guilty engines
+
+From: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+
+[ Upstream commit 89e96d822bd51f7afe2d3e95a34099480b5c3d55 ]
+
+There are 2 ways an engine can get reset in i915 and the method of reset
+affects how KMD labels a context as guilty/innocent.
+
+(1) GuC initiated engine-reset: GuC resets a hung engine and notifies
+KMD. The context that hung on the engine is marked guilty and all other
+contexts are innocent. The innocent contexts are resubmitted.
+
+(2) GT based reset: When an engine heartbeat fails to tick, KMD
+initiates a gt/chip reset. All active contexts are marked as guilty and
+discarded.
+
+In order to correctly mark the contexts as guilty/innocent, pass a mask
+of engines that were reset to __guc_reset_context.
+
+Fixes: eb5e7da736f3 ("drm/i915/guc: Reset implementation for new GuC interface")
+Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Reviewed-by: Alan Previn <alan.previn.teres.alexis@intel.com>
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220426003045.3929439-1-umesh.nerlige.ramappa@intel.com
+(cherry picked from commit 303760aa914b7f5ac9602dbb4b471a2ad52eeb3e)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_reset.c            |  2 +-
+ drivers/gpu/drm/i915/gt/uc/intel_guc.h           |  2 +-
+ .../gpu/drm/i915/gt/uc/intel_guc_submission.c    | 16 ++++++++--------
+ drivers/gpu/drm/i915/gt/uc/intel_uc.c            |  2 +-
+ drivers/gpu/drm/i915/gt/uc/intel_uc.h            |  2 +-
+ 5 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_reset.c b/drivers/gpu/drm/i915/gt/intel_reset.c
+index 7be0002d9d70..f577582ddd9f 100644
+--- a/drivers/gpu/drm/i915/gt/intel_reset.c
++++ b/drivers/gpu/drm/i915/gt/intel_reset.c
+@@ -791,7 +791,7 @@ static int gt_reset(struct intel_gt *gt, intel_engine_mask_t stalled_mask)
+ 		__intel_engine_reset(engine, stalled_mask & engine->mask);
+ 	local_bh_enable();
+ 
+-	intel_uc_reset(&gt->uc, true);
++	intel_uc_reset(&gt->uc, ALL_ENGINES);
+ 
+ 	intel_ggtt_restore_fences(gt->ggtt);
+ 
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc.h b/drivers/gpu/drm/i915/gt/uc/intel_guc.h
+index 3aabe164c329..e1fb8e1da128 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc.h
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc.h
+@@ -417,7 +417,7 @@ int intel_guc_global_policies_update(struct intel_guc *guc);
+ void intel_guc_context_ban(struct intel_context *ce, struct i915_request *rq);
+ 
+ void intel_guc_submission_reset_prepare(struct intel_guc *guc);
+-void intel_guc_submission_reset(struct intel_guc *guc, bool stalled);
++void intel_guc_submission_reset(struct intel_guc *guc, intel_engine_mask_t stalled);
+ void intel_guc_submission_reset_finish(struct intel_guc *guc);
+ void intel_guc_submission_cancel_requests(struct intel_guc *guc);
+ 
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+index 154ad726e266..1e51a365833b 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+@@ -1603,9 +1603,9 @@ __unwind_incomplete_requests(struct intel_context *ce)
+ 	spin_unlock_irqrestore(&sched_engine->lock, flags);
+ }
+ 
+-static void __guc_reset_context(struct intel_context *ce, bool stalled)
++static void __guc_reset_context(struct intel_context *ce, intel_engine_mask_t stalled)
+ {
+-	bool local_stalled;
++	bool guilty;
+ 	struct i915_request *rq;
+ 	unsigned long flags;
+ 	u32 head;
+@@ -1647,7 +1647,7 @@ static void __guc_reset_context(struct intel_context *ce, bool stalled)
+ 		if (!intel_context_is_pinned(ce))
+ 			goto next_context;
+ 
+-		local_stalled = false;
++		guilty = false;
+ 		rq = intel_context_find_active_request(ce);
+ 		if (!rq) {
+ 			head = ce->ring->tail;
+@@ -1655,14 +1655,14 @@ static void __guc_reset_context(struct intel_context *ce, bool stalled)
+ 		}
+ 
+ 		if (i915_request_started(rq))
+-			local_stalled = true;
++			guilty = stalled & ce->engine->mask;
+ 
+ 		GEM_BUG_ON(i915_active_is_idle(&ce->active));
+ 		head = intel_ring_wrap(ce->ring, rq->head);
+ 
+-		__i915_request_reset(rq, local_stalled && stalled);
++		__i915_request_reset(rq, guilty);
+ out_replay:
+-		guc_reset_state(ce, head, local_stalled && stalled);
++		guc_reset_state(ce, head, guilty);
+ next_context:
+ 		if (i != number_children)
+ 			ce = list_next_entry(ce, parallel.child_link);
+@@ -1673,7 +1673,7 @@ static void __guc_reset_context(struct intel_context *ce, bool stalled)
+ 	intel_context_put(parent);
+ }
+ 
+-void intel_guc_submission_reset(struct intel_guc *guc, bool stalled)
++void intel_guc_submission_reset(struct intel_guc *guc, intel_engine_mask_t stalled)
+ {
+ 	struct intel_context *ce;
+ 	unsigned long index;
+@@ -4042,7 +4042,7 @@ static void guc_context_replay(struct intel_context *ce)
+ {
+ 	struct i915_sched_engine *sched_engine = ce->engine->sched_engine;
+ 
+-	__guc_reset_context(ce, true);
++	__guc_reset_context(ce, ce->engine->mask);
+ 	tasklet_hi_schedule(&sched_engine->tasklet);
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc.c b/drivers/gpu/drm/i915/gt/uc/intel_uc.c
+index 09ed29df67bc..cbfb5a01cc1d 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_uc.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_uc.c
+@@ -592,7 +592,7 @@ void intel_uc_reset_prepare(struct intel_uc *uc)
+ 	__uc_sanitize(uc);
+ }
+ 
+-void intel_uc_reset(struct intel_uc *uc, bool stalled)
++void intel_uc_reset(struct intel_uc *uc, intel_engine_mask_t stalled)
+ {
+ 	struct intel_guc *guc = &uc->guc;
+ 
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc.h b/drivers/gpu/drm/i915/gt/uc/intel_uc.h
+index 866b462821c0..a8f38c2c60e2 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_uc.h
++++ b/drivers/gpu/drm/i915/gt/uc/intel_uc.h
+@@ -42,7 +42,7 @@ void intel_uc_driver_late_release(struct intel_uc *uc);
+ void intel_uc_driver_remove(struct intel_uc *uc);
+ void intel_uc_init_mmio(struct intel_uc *uc);
+ void intel_uc_reset_prepare(struct intel_uc *uc);
+-void intel_uc_reset(struct intel_uc *uc, bool stalled);
++void intel_uc_reset(struct intel_uc *uc, intel_engine_mask_t stalled);
+ void intel_uc_reset_finish(struct intel_uc *uc);
+ void intel_uc_cancel_requests(struct intel_uc *uc);
+ void intel_uc_suspend(struct intel_uc *uc);
+-- 
+2.35.1
+
diff --git a/queue-5.17/ice-fix-crash-when-writing-timestamp-on-rx-rings.patch b/queue-5.17/ice-fix-crash-when-writing-timestamp-on-rx-rings.patch
new file mode 100644
index 0000000..425ddb2
--- /dev/null
+++ b/queue-5.17/ice-fix-crash-when-writing-timestamp-on-rx-rings.patch
@@ -0,0 +1,107 @@
+From b29e9579672c22ae69594d64cd944f47978b4358 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Apr 2022 10:33:50 +0200
+Subject: ice: fix crash when writing timestamp on RX rings
+
+From: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+
+[ Upstream commit 4503cc7fdf9a84cd631b0cb8ecb3c9b1bdbf3594 ]
+
+Do not allow to write timestamps on RX rings if PF is being configured.
+When PF is being configured RX rings can be freed or rebuilt. If at the
+same time timestamps are updated, the kernel will crash by dereferencing
+null RX ring pointer.
+
+PID: 1449   TASK: ff187d28ed658040  CPU: 34  COMMAND: "ice-ptp-0000:51"
+ #0 [ff1966a94a713bb0] machine_kexec at ffffffff9d05a0be
+ #1 [ff1966a94a713c08] __crash_kexec at ffffffff9d192e9d
+ #2 [ff1966a94a713cd0] crash_kexec at ffffffff9d1941bd
+ #3 [ff1966a94a713ce8] oops_end at ffffffff9d01bd54
+ #4 [ff1966a94a713d08] no_context at ffffffff9d06bda4
+ #5 [ff1966a94a713d60] __bad_area_nosemaphore at ffffffff9d06c10c
+ #6 [ff1966a94a713da8] do_page_fault at ffffffff9d06cae4
+ #7 [ff1966a94a713de0] page_fault at ffffffff9da0107e
+    [exception RIP: ice_ptp_update_cached_phctime+91]
+    RIP: ffffffffc076db8b  RSP: ff1966a94a713e98  RFLAGS: 00010246
+    RAX: 16e3db9c6b7ccae4  RBX: ff187d269dd3c180  RCX: ff187d269cd4d018
+    RDX: 0000000000000000  RSI: 0000000000000000  RDI: 0000000000000000
+    RBP: ff187d269cfcc644   R8: ff187d339b9641b0   R9: 0000000000000000
+    R10: 0000000000000002  R11: 0000000000000000  R12: ff187d269cfcc648
+    R13: ffffffff9f128784  R14: ffffffff9d101b70  R15: ff187d269cfcc640
+    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
+ #8 [ff1966a94a713ea0] ice_ptp_periodic_work at ffffffffc076dbef [ice]
+ #9 [ff1966a94a713ee0] kthread_worker_fn at ffffffff9d101c1b
+ #10 [ff1966a94a713f10] kthread at ffffffff9d101b4d
+ #11 [ff1966a94a713f50] ret_from_fork at ffffffff9da0023f
+
+Fixes: 77a781155a65 ("ice: enable receive hardware timestamping")
+Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+Reviewed-by: Michal Schmidt <mschmidt@redhat.com>
+Tested-by: Dave Cain <dcain@redhat.com>
+Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_ptp.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
+index 45ae97b8b97d..836c67f1aa46 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
+@@ -499,12 +499,19 @@ ice_ptp_read_src_clk_reg(struct ice_pf *pf, struct ptp_system_timestamp *sts)
+  * This function must be called periodically to ensure that the cached value
+  * is never more than 2 seconds old. It must also be called whenever the PHC
+  * time has been changed.
++ *
++ * Return:
++ * * 0 - OK, successfully updated
++ * * -EAGAIN - PF was busy, need to reschedule the update
+  */
+-static void ice_ptp_update_cached_phctime(struct ice_pf *pf)
++static int ice_ptp_update_cached_phctime(struct ice_pf *pf)
+ {
+ 	u64 systime;
+ 	int i;
+ 
++	if (test_and_set_bit(ICE_CFG_BUSY, pf->state))
++		return -EAGAIN;
++
+ 	/* Read the current PHC time */
+ 	systime = ice_ptp_read_src_clk_reg(pf, NULL);
+ 
+@@ -527,6 +534,9 @@ static void ice_ptp_update_cached_phctime(struct ice_pf *pf)
+ 			WRITE_ONCE(vsi->rx_rings[j]->cached_phctime, systime);
+ 		}
+ 	}
++	clear_bit(ICE_CFG_BUSY, pf->state);
++
++	return 0;
+ }
+ 
+ /**
+@@ -2322,17 +2332,18 @@ static void ice_ptp_periodic_work(struct kthread_work *work)
+ {
+ 	struct ice_ptp *ptp = container_of(work, struct ice_ptp, work.work);
+ 	struct ice_pf *pf = container_of(ptp, struct ice_pf, ptp);
++	int err;
+ 
+ 	if (!test_bit(ICE_FLAG_PTP, pf->flags))
+ 		return;
+ 
+-	ice_ptp_update_cached_phctime(pf);
++	err = ice_ptp_update_cached_phctime(pf);
+ 
+ 	ice_ptp_tx_tstamp_cleanup(&pf->hw, &pf->ptp.port.tx);
+ 
+-	/* Run twice a second */
++	/* Run twice a second or reschedule if phc update failed */
+ 	kthread_queue_delayed_work(ptp->kworker, &ptp->work,
+-				   msecs_to_jiffies(500));
++				   msecs_to_jiffies(err ? 10 : 500));
+ }
+ 
+ /**
+-- 
+2.35.1
+
diff --git a/queue-5.17/ice-fix-interrupt-moderation-settings-getting-cleare.patch b/queue-5.17/ice-fix-interrupt-moderation-settings-getting-cleare.patch
new file mode 100644
index 0000000..097f0c9
--- /dev/null
+++ b/queue-5.17/ice-fix-interrupt-moderation-settings-getting-cleare.patch
@@ -0,0 +1,116 @@
+From 95f90d95c3fe55e3b9c8d6627aae482166398563 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 May 2022 19:33:48 -0400
+Subject: ice: Fix interrupt moderation settings getting cleared
+
+From: Michal Wilczynski <michal.wilczynski@intel.com>
+
+[ Upstream commit bf13502ed5f941b0777b3fd1e24dac5d93f3886c ]
+
+Adaptive-rx and Adaptive-tx are interrupt moderation settings
+that can be enabled/disabled using ethtool:
+ethtool -C ethX adaptive-rx on/off adaptive-tx on/off
+
+Unfortunately those settings are getting cleared after
+changing number of queues, or in ethtool world 'channels':
+ethtool -L ethX rx 1 tx 1
+
+Clearing was happening due to introduction of bit fields
+in ice_ring_container struct. This way only itr_setting
+bits were rebuilt during ice_vsi_rebuild_set_coalesce().
+
+Introduce an anonymous struct of bitfields and create a
+union to refer to them as a single variable.
+This way variable can be easily saved and restored.
+
+Fixes: 61dc79ced7aa ("ice: Restore interrupt throttle settings after VSI rebuild")
+Signed-off-by: Michal Wilczynski <michal.wilczynski@intel.com>
+Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_lib.c  | 16 ++++++++--------
+ drivers/net/ethernet/intel/ice/ice_txrx.h | 11 ++++++++---
+ 2 files changed, 16 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
+index 15bb6f001a04..5f86cc1cfd09 100644
+--- a/drivers/net/ethernet/intel/ice/ice_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_lib.c
+@@ -3207,8 +3207,8 @@ ice_vsi_rebuild_get_coalesce(struct ice_vsi *vsi,
+ 	ice_for_each_q_vector(vsi, i) {
+ 		struct ice_q_vector *q_vector = vsi->q_vectors[i];
+ 
+-		coalesce[i].itr_tx = q_vector->tx.itr_setting;
+-		coalesce[i].itr_rx = q_vector->rx.itr_setting;
++		coalesce[i].itr_tx = q_vector->tx.itr_settings;
++		coalesce[i].itr_rx = q_vector->rx.itr_settings;
+ 		coalesce[i].intrl = q_vector->intrl;
+ 
+ 		if (i < vsi->num_txq)
+@@ -3264,21 +3264,21 @@ ice_vsi_rebuild_set_coalesce(struct ice_vsi *vsi,
+ 		 */
+ 		if (i < vsi->alloc_rxq && coalesce[i].rx_valid) {
+ 			rc = &vsi->q_vectors[i]->rx;
+-			rc->itr_setting = coalesce[i].itr_rx;
++			rc->itr_settings = coalesce[i].itr_rx;
+ 			ice_write_itr(rc, rc->itr_setting);
+ 		} else if (i < vsi->alloc_rxq) {
+ 			rc = &vsi->q_vectors[i]->rx;
+-			rc->itr_setting = coalesce[0].itr_rx;
++			rc->itr_settings = coalesce[0].itr_rx;
+ 			ice_write_itr(rc, rc->itr_setting);
+ 		}
+ 
+ 		if (i < vsi->alloc_txq && coalesce[i].tx_valid) {
+ 			rc = &vsi->q_vectors[i]->tx;
+-			rc->itr_setting = coalesce[i].itr_tx;
++			rc->itr_settings = coalesce[i].itr_tx;
+ 			ice_write_itr(rc, rc->itr_setting);
+ 		} else if (i < vsi->alloc_txq) {
+ 			rc = &vsi->q_vectors[i]->tx;
+-			rc->itr_setting = coalesce[0].itr_tx;
++			rc->itr_settings = coalesce[0].itr_tx;
+ 			ice_write_itr(rc, rc->itr_setting);
+ 		}
+ 
+@@ -3292,12 +3292,12 @@ ice_vsi_rebuild_set_coalesce(struct ice_vsi *vsi,
+ 	for (; i < vsi->num_q_vectors; i++) {
+ 		/* transmit */
+ 		rc = &vsi->q_vectors[i]->tx;
+-		rc->itr_setting = coalesce[0].itr_tx;
++		rc->itr_settings = coalesce[0].itr_tx;
+ 		ice_write_itr(rc, rc->itr_setting);
+ 
+ 		/* receive */
+ 		rc = &vsi->q_vectors[i]->rx;
+-		rc->itr_setting = coalesce[0].itr_rx;
++		rc->itr_settings = coalesce[0].itr_rx;
+ 		ice_write_itr(rc, rc->itr_setting);
+ 
+ 		vsi->q_vectors[i]->intrl = coalesce[0].intrl;
+diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.h b/drivers/net/ethernet/intel/ice/ice_txrx.h
+index b7b3bd4816f0..ec4733272034 100644
+--- a/drivers/net/ethernet/intel/ice/ice_txrx.h
++++ b/drivers/net/ethernet/intel/ice/ice_txrx.h
+@@ -379,9 +379,14 @@ struct ice_ring_container {
+ 	/* this matches the maximum number of ITR bits, but in usec
+ 	 * values, so it is shifted left one bit (bit zero is ignored)
+ 	 */
+-	u16 itr_setting:13;
+-	u16 itr_reserved:2;
+-	u16 itr_mode:1;
++	union {
++		struct {
++			u16 itr_setting:13;
++			u16 itr_reserved:2;
++			u16 itr_mode:1;
++		};
++		u16 itr_settings;
++	};
+ 	enum ice_container_type type;
+ };
+ 
+-- 
+2.35.1
+
diff --git a/queue-5.17/ice-fix-possible-under-reporting-of-ethtool-tx-and-r.patch b/queue-5.17/ice-fix-possible-under-reporting-of-ethtool-tx-and-r.patch
new file mode 100644
index 0000000..6fa43d4
--- /dev/null
+++ b/queue-5.17/ice-fix-possible-under-reporting-of-ethtool-tx-and-r.patch
@@ -0,0 +1,51 @@
+From c6696a222e424f910946ad65a927c21eee514137 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Apr 2022 14:11:42 -0700
+Subject: ice: fix possible under reporting of ethtool Tx and Rx statistics
+
+From: Paul Greenwalt <paul.greenwalt@intel.com>
+
+[ Upstream commit 31b6298fd8e29effe9ed6b77351ac5969be56ce0 ]
+
+The hardware statistics counters are not cleared during resets so the
+drivers first access is to initialize the baseline and then subsequent
+reads are for reporting the counters. The statistics counters are read
+during the watchdog subtask when the interface is up. If the baseline
+is not initialized before the interface is up, then there can be a brief
+window in which some traffic can be transmitted/received before the
+initial baseline reading takes place.
+
+Directly initialize ethtool statistics in driver open so the baseline will
+be initialized when the interface is up, and any dropped packets
+incremented before the interface is up won't be reported.
+
+Fixes: 28dc1b86f8ea9 ("ice: ignore dropped packets during init")
+Signed-off-by: Paul Greenwalt <paul.greenwalt@intel.com>
+Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 7f6715eb862f..30f055e1a92a 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -5907,9 +5907,10 @@ static int ice_up_complete(struct ice_vsi *vsi)
+ 			ice_ptp_link_change(pf, pf->hw.pf_id, true);
+ 	}
+ 
+-	/* clear this now, and the first stats read will be used as baseline */
+-	vsi->stat_offsets_loaded = false;
+-
++	/* Perform an initial read of the statistics registers now to
++	 * set the baseline so counters are ready when interface is up
++	 */
++	ice_update_eth_stats(vsi);
+ 	ice_service_task_schedule(pf);
+ 
+ 	return 0;
+-- 
+2.35.1
+
diff --git a/queue-5.17/igb-skip-phy-status-check-where-unavailable.patch b/queue-5.17/igb-skip-phy-status-check-where-unavailable.patch
new file mode 100644
index 0000000..93fcead
--- /dev/null
+++ b/queue-5.17/igb-skip-phy-status-check-where-unavailable.patch
@@ -0,0 +1,46 @@
+From b361eb5f8ebd93bb3cbff1791411a89be8baee05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 May 2022 11:01:05 -0700
+Subject: igb: skip phy status check where unavailable
+
+From: Kevin Mitchell <kevmitch@arista.com>
+
+[ Upstream commit 942d2ad5d2e0df758a645ddfadffde2795322728 ]
+
+igb_read_phy_reg() will silently return, leaving phy_data untouched, if
+hw->ops.read_reg isn't set. Depending on the uninitialized value of
+phy_data, this led to the phy status check either succeeding immediately
+or looping continuously for 2 seconds before emitting a noisy err-level
+timeout. This message went out to the console even though there was no
+actual problem.
+
+Instead, first check if there is read_reg function pointer. If not,
+proceed without trying to check the phy status register.
+
+Fixes: b72f3f72005d ("igb: When GbE link up, wait for Remote receiver status condition")
+Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
+Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igb/igb_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index c1e4ad65b02d..4e0abfe68cfd 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -5512,7 +5512,8 @@ static void igb_watchdog_task(struct work_struct *work)
+ 				break;
+ 			}
+ 
+-			if (adapter->link_speed != SPEED_1000)
++			if (adapter->link_speed != SPEED_1000 ||
++			    !hw->phy.ops.read_reg)
+ 				goto no_wait;
+ 
+ 			/* wait for Remote receiver status OK */
+-- 
+2.35.1
+
diff --git a/queue-5.17/kvm-x86-pmu-fix-the-compare-function-used-by-the-pmu.patch b/queue-5.17/kvm-x86-pmu-fix-the-compare-function-used-by-the-pmu.patch
new file mode 100644
index 0000000..e706e05
--- /dev/null
+++ b/queue-5.17/kvm-x86-pmu-fix-the-compare-function-used-by-the-pmu.patch
@@ -0,0 +1,49 @@
+From 60a912e144bc006f5ab66c298f5457a25c909eff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 May 2022 05:12:36 +0000
+Subject: kvm: x86/pmu: Fix the compare function used by the pmu event filter
+
+From: Aaron Lewis <aaronlewis@google.com>
+
+[ Upstream commit 4ac19ead0dfbabd8e0bfc731f507cfb0b95d6c99 ]
+
+When returning from the compare function the u64 is truncated to an
+int.  This results in a loss of the high nybble[1] in the event select
+and its sign if that nybble is in use.  Switch from using a result that
+can end up being truncated to a result that can only be: 1, 0, -1.
+
+[1] bits 35:32 in the event select register and bits 11:8 in the event
+    select.
+
+Fixes: 7ff775aca48ad ("KVM: x86/pmu: Use binary search to check filtered events")
+Signed-off-by: Aaron Lewis <aaronlewis@google.com>
+Reviewed-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20220517051238.2566934-1-aaronlewis@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/pmu.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
+index eca39f56c231..0604bc29f0b8 100644
+--- a/arch/x86/kvm/pmu.c
++++ b/arch/x86/kvm/pmu.c
+@@ -171,9 +171,12 @@ static bool pmc_resume_counter(struct kvm_pmc *pmc)
+ 	return true;
+ }
+ 
+-static int cmp_u64(const void *a, const void *b)
++static int cmp_u64(const void *pa, const void *pb)
+ {
+-	return *(__u64 *)a - *(__u64 *)b;
++	u64 a = *(u64 *)pa;
++	u64 b = *(u64 *)pb;
++
++	return (a > b) - (a < b);
+ }
+ 
+ void reprogram_gp_counter(struct kvm_pmc *pmc, u64 eventsel)
+-- 
+2.35.1
+
diff --git a/queue-5.17/mac80211-fix-rx-reordering-with-non-explicit-psmp-ac.patch b/queue-5.17/mac80211-fix-rx-reordering-with-non-explicit-psmp-ac.patch
new file mode 100644
index 0000000..b201b3e
--- /dev/null
+++ b/queue-5.17/mac80211-fix-rx-reordering-with-non-explicit-psmp-ac.patch
@@ -0,0 +1,38 @@
+From 779fc8a271f3339a89823a1b06c10ec25b35bfe4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Apr 2022 12:50:38 +0200
+Subject: mac80211: fix rx reordering with non explicit / psmp ack policy
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 5e469ed9764d4722c59562da13120bd2dc6834c5 ]
+
+When the QoS ack policy was set to non explicit / psmp ack, frames are treated
+as not being part of a BA session, which causes extra latency on reordering.
+Fix this by only bypassing reordering for packets with no-ack policy
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20220420105038.36443-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 48d9553dafe3..7e2404fd85b6 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1405,8 +1405,7 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
+ 		goto dont_reorder;
+ 
+ 	/* not part of a BA session */
+-	if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
+-	    ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
++	if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
+ 		goto dont_reorder;
+ 
+ 	/* new, potentially un-ordered, ampdu frame - process it */
+-- 
+2.35.1
+
diff --git a/queue-5.17/mptcp-do-tcp-fallback-on-early-dss-checksum-failure.patch b/queue-5.17/mptcp-do-tcp-fallback-on-early-dss-checksum-failure.patch
new file mode 100644
index 0000000..ed2e7a2
--- /dev/null
+++ b/queue-5.17/mptcp-do-tcp-fallback-on-early-dss-checksum-failure.patch
@@ -0,0 +1,105 @@
+From eefba3dc384cddc4489efcd6b32d9e05f38d00d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 May 2022 11:02:12 -0700
+Subject: mptcp: Do TCP fallback on early DSS checksum failure
+
+From: Mat Martineau <mathew.j.martineau@linux.intel.com>
+
+[ Upstream commit ae66fb2ba6c3dcaf8b9612b65aa949a1a4bed150 ]
+
+RFC 8684 section 3.7 describes several opportunities for a MPTCP
+connection to "fall back" to regular TCP early in the connection
+process, before it has been confirmed that MPTCP options can be
+successfully propagated on all SYN, SYN/ACK, and data packets. If a peer
+acknowledges the first received data packet with a regular TCP header
+(no MPTCP options), fallback is allowed.
+
+If the recipient of that first data packet finds a MPTCP DSS checksum
+error, this provides an opportunity to fail gracefully with a TCP
+fallback rather than resetting the connection (as might happen if a
+checksum failure were detected later).
+
+This commit modifies the checksum failure code to attempt fallback on
+the initial subflow of a MPTCP connection, only if it's a failure in the
+first data mapping. In cases where the peer initiates the connection,
+requests checksums, is the first to send data, and the peer is sending
+incorrect checksums (see
+https://github.com/multipath-tcp/mptcp_net-next/issues/275), this allows
+the connection to proceed as TCP rather than reset.
+
+Fixes: dd8bcd1768ff ("mptcp: validate the data checksum")
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/protocol.h |  3 ++-
+ net/mptcp/subflow.c  | 21 ++++++++++++++++++---
+ 2 files changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
+index e4413b3e50c2..8015389859d9 100644
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -443,7 +443,8 @@ struct mptcp_subflow_context {
+ 		can_ack : 1,        /* only after processing the remote a key */
+ 		disposable : 1,	    /* ctx can be free at ulp release time */
+ 		stale : 1,	    /* unable to snd/rcv data, do not use for xmit */
+-		local_id_valid : 1; /* local_id is correctly initialized */
++		local_id_valid : 1, /* local_id is correctly initialized */
++		valid_csum_seen : 1;        /* at least one csum validated */
+ 	enum mptcp_data_avail data_avail;
+ 	u32	remote_nonce;
+ 	u64	thmac;
+diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
+index e27574e9f969..7a3a70067c80 100644
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -958,11 +958,14 @@ static enum mapping_status validate_data_csum(struct sock *ssk, struct sk_buff *
+ 				 subflow->map_data_csum);
+ 	if (unlikely(csum)) {
+ 		MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DATACSUMERR);
+-		subflow->send_mp_fail = 1;
+-		MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_MPFAILTX);
++		if (subflow->mp_join || subflow->valid_csum_seen) {
++			subflow->send_mp_fail = 1;
++			MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_MPFAILTX);
++		}
+ 		return subflow->mp_join ? MAPPING_INVALID : MAPPING_DUMMY;
+ 	}
+ 
++	subflow->valid_csum_seen = 1;
+ 	return MAPPING_OK;
+ }
+ 
+@@ -1144,6 +1147,18 @@ static void subflow_sched_work_if_closed(struct mptcp_sock *msk, struct sock *ss
+ 	}
+ }
+ 
++static bool subflow_can_fallback(struct mptcp_subflow_context *subflow)
++{
++	struct mptcp_sock *msk = mptcp_sk(subflow->conn);
++
++	if (subflow->mp_join)
++		return false;
++	else if (READ_ONCE(msk->csum_enabled))
++		return !subflow->valid_csum_seen;
++	else
++		return !subflow->fully_established;
++}
++
+ static bool subflow_check_data_avail(struct sock *ssk)
+ {
+ 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
+@@ -1221,7 +1236,7 @@ static bool subflow_check_data_avail(struct sock *ssk)
+ 		return true;
+ 	}
+ 
+-	if (subflow->mp_join || subflow->fully_established) {
++	if (!subflow_can_fallback(subflow)) {
+ 		/* fatal protocol error, close the socket.
+ 		 * subflow_error_report() will introduce the appropriate barriers
+ 		 */
+-- 
+2.35.1
+
diff --git a/queue-5.17/mptcp-fix-checksum-byte-order.patch b/queue-5.17/mptcp-fix-checksum-byte-order.patch
new file mode 100644
index 0000000..3ff6abf
--- /dev/null
+++ b/queue-5.17/mptcp-fix-checksum-byte-order.patch
@@ -0,0 +1,153 @@
+From 89427fa0094e7fdd9425733a3f6f38853874085b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 May 2022 11:02:11 -0700
+Subject: mptcp: fix checksum byte order
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit ba2c89e0ea74a904d5231643245753d77422e7f5 ]
+
+The MPTCP code typecasts the checksum value to u16 and
+then converts it to big endian while storing the value into
+the MPTCP option.
+
+As a result, the wire encoding for little endian host is
+wrong, and that causes interoperabilty interoperability
+issues with other implementation or host with different endianness.
+
+Address the issue writing in the packet the unmodified __sum16 value.
+
+MPTCP checksum is disabled by default, interoperating with systems
+with bad mptcp-level csum encoding should cause fallback to TCP.
+
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/275
+Fixes: c5b39e26d003 ("mptcp: send out checksum for DSS")
+Fixes: 390b95a5fb84 ("mptcp: receive checksum for DSS")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/options.c  | 36 ++++++++++++++++++++++++------------
+ net/mptcp/protocol.h |  2 +-
+ net/mptcp/subflow.c  |  2 +-
+ 3 files changed, 26 insertions(+), 14 deletions(-)
+
+diff --git a/net/mptcp/options.c b/net/mptcp/options.c
+index 645dd984fef0..9ac75689a99d 100644
+--- a/net/mptcp/options.c
++++ b/net/mptcp/options.c
+@@ -107,7 +107,7 @@ static void mptcp_parse_option(const struct sk_buff *skb,
+ 			ptr += 2;
+ 		}
+ 		if (opsize == TCPOLEN_MPTCP_MPC_ACK_DATA_CSUM) {
+-			mp_opt->csum = (__force __sum16)get_unaligned_be16(ptr);
++			mp_opt->csum = get_unaligned((__force __sum16 *)ptr);
+ 			mp_opt->suboptions |= OPTION_MPTCP_CSUMREQD;
+ 			ptr += 2;
+ 		}
+@@ -221,7 +221,7 @@ static void mptcp_parse_option(const struct sk_buff *skb,
+ 
+ 			if (opsize == expected_opsize + TCPOLEN_MPTCP_DSS_CHECKSUM) {
+ 				mp_opt->suboptions |= OPTION_MPTCP_CSUMREQD;
+-				mp_opt->csum = (__force __sum16)get_unaligned_be16(ptr);
++				mp_opt->csum = get_unaligned((__force __sum16 *)ptr);
+ 				ptr += 2;
+ 			}
+ 
+@@ -1236,7 +1236,7 @@ static void mptcp_set_rwin(const struct tcp_sock *tp)
+ 		WRITE_ONCE(msk->rcv_wnd_sent, ack_seq);
+ }
+ 
+-u16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum)
++__sum16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum)
+ {
+ 	struct csum_pseudo_header header;
+ 	__wsum csum;
+@@ -1252,15 +1252,25 @@ u16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum)
+ 	header.csum = 0;
+ 
+ 	csum = csum_partial(&header, sizeof(header), sum);
+-	return (__force u16)csum_fold(csum);
++	return csum_fold(csum);
+ }
+ 
+-static u16 mptcp_make_csum(const struct mptcp_ext *mpext)
++static __sum16 mptcp_make_csum(const struct mptcp_ext *mpext)
+ {
+ 	return __mptcp_make_csum(mpext->data_seq, mpext->subflow_seq, mpext->data_len,
+ 				 ~csum_unfold(mpext->csum));
+ }
+ 
++static void put_len_csum(u16 len, __sum16 csum, void *data)
++{
++	__sum16 *sumptr = data + 2;
++	__be16 *ptr = data;
++
++	put_unaligned_be16(len, ptr);
++
++	put_unaligned(csum, sumptr);
++}
++
+ void mptcp_write_options(__be32 *ptr, const struct tcp_sock *tp,
+ 			 struct mptcp_out_options *opts)
+ {
+@@ -1328,8 +1338,9 @@ void mptcp_write_options(__be32 *ptr, const struct tcp_sock *tp,
+ 			put_unaligned_be32(mpext->subflow_seq, ptr);
+ 			ptr += 1;
+ 			if (opts->csum_reqd) {
+-				put_unaligned_be32(mpext->data_len << 16 |
+-						   mptcp_make_csum(mpext), ptr);
++				put_len_csum(mpext->data_len,
++					     mptcp_make_csum(mpext),
++					     ptr);
+ 			} else {
+ 				put_unaligned_be32(mpext->data_len << 16 |
+ 						   TCPOPT_NOP << 8 | TCPOPT_NOP, ptr);
+@@ -1376,11 +1387,12 @@ void mptcp_write_options(__be32 *ptr, const struct tcp_sock *tp,
+ 			goto mp_capable_done;
+ 
+ 		if (opts->csum_reqd) {
+-			put_unaligned_be32(opts->data_len << 16 |
+-					   __mptcp_make_csum(opts->data_seq,
+-							     opts->subflow_seq,
+-							     opts->data_len,
+-							     ~csum_unfold(opts->csum)), ptr);
++			put_len_csum(opts->data_len,
++				     __mptcp_make_csum(opts->data_seq,
++						       opts->subflow_seq,
++						       opts->data_len,
++						       ~csum_unfold(opts->csum)),
++				     ptr);
+ 		} else {
+ 			put_unaligned_be32(opts->data_len << 16 |
+ 					   TCPOPT_NOP << 8 | TCPOPT_NOP, ptr);
+diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
+index a1c845eb47bd..aec767ee047a 100644
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -725,7 +725,7 @@ void mptcp_token_destroy(struct mptcp_sock *msk);
+ void mptcp_crypto_key_sha(u64 key, u32 *token, u64 *idsn);
+ 
+ void mptcp_crypto_hmac_sha(u64 key1, u64 key2, u8 *msg, int len, void *hmac);
+-u16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum);
++__sum16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum);
+ 
+ void __init mptcp_pm_init(void);
+ void mptcp_pm_data_init(struct mptcp_sock *msk);
+diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
+index 1d4d84efe8f5..651f01d13191 100644
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -846,7 +846,7 @@ static enum mapping_status validate_data_csum(struct sock *ssk, struct sk_buff *
+ {
+ 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
+ 	u32 offset, seq, delta;
+-	u16 csum;
++	__sum16 csum;
+ 	int len;
+ 
+ 	if (!csum_reqd)
+-- 
+2.35.1
+
diff --git a/queue-5.17/mptcp-fix-subflow-accounting-on-close.patch b/queue-5.17/mptcp-fix-subflow-accounting-on-close.patch
new file mode 100644
index 0000000..3077658
--- /dev/null
+++ b/queue-5.17/mptcp-fix-subflow-accounting-on-close.patch
@@ -0,0 +1,117 @@
+From 45cb208a5cd6f0e32e06789c20f0349c3aa5fc8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 May 2022 16:26:41 -0700
+Subject: mptcp: fix subflow accounting on close
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 95d686517884a403412b000361cee2b08b2ed1e6 ]
+
+If the PM closes a fully established MPJ subflow or the subflow
+creation errors out in it's early stage the subflows counter is
+not bumped accordingly.
+
+This change adds the missing accounting, additionally taking care
+of updating accordingly the 'accept_subflow' flag.
+
+Fixes: a88c9e496937 ("mptcp: do not block subflows creation on errors")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/pm.c       |  5 ++---
+ net/mptcp/protocol.h | 14 ++++++++++++++
+ net/mptcp/subflow.c  | 12 +++++++++---
+ 3 files changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c
+index 7bea318ac5f2..1eb83cbe8aae 100644
+--- a/net/mptcp/pm.c
++++ b/net/mptcp/pm.c
+@@ -178,14 +178,13 @@ void mptcp_pm_subflow_check_next(struct mptcp_sock *msk, const struct sock *ssk,
+ 	struct mptcp_pm_data *pm = &msk->pm;
+ 	bool update_subflows;
+ 
+-	update_subflows = (ssk->sk_state == TCP_CLOSE) &&
+-			  (subflow->request_join || subflow->mp_join);
++	update_subflows = subflow->request_join || subflow->mp_join;
+ 	if (!READ_ONCE(pm->work_pending) && !update_subflows)
+ 		return;
+ 
+ 	spin_lock_bh(&pm->lock);
+ 	if (update_subflows)
+-		pm->subflows--;
++		__mptcp_pm_close_subflow(msk);
+ 
+ 	/* Even if this subflow is not really established, tell the PM to try
+ 	 * to pick the next ones, if possible.
+diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
+index 85317ce38e3f..a1c845eb47bd 100644
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -835,6 +835,20 @@ unsigned int mptcp_pm_get_add_addr_accept_max(struct mptcp_sock *msk);
+ unsigned int mptcp_pm_get_subflows_max(struct mptcp_sock *msk);
+ unsigned int mptcp_pm_get_local_addr_max(struct mptcp_sock *msk);
+ 
++/* called under PM lock */
++static inline void __mptcp_pm_close_subflow(struct mptcp_sock *msk)
++{
++	if (--msk->pm.subflows < mptcp_pm_get_subflows_max(msk))
++		WRITE_ONCE(msk->pm.accept_subflow, true);
++}
++
++static inline void mptcp_pm_close_subflow(struct mptcp_sock *msk)
++{
++	spin_lock_bh(&msk->pm.lock);
++	__mptcp_pm_close_subflow(msk);
++	spin_unlock_bh(&msk->pm.lock);
++}
++
+ void mptcp_sockopt_sync(struct mptcp_sock *msk, struct sock *ssk);
+ void mptcp_sockopt_sync_locked(struct mptcp_sock *msk, struct sock *ssk);
+ 
+diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
+index bea47a1180dc..1d4d84efe8f5 100644
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -1380,20 +1380,20 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc,
+ 	struct sockaddr_storage addr;
+ 	int remote_id = remote->id;
+ 	int local_id = loc->id;
++	int err = -ENOTCONN;
+ 	struct socket *sf;
+ 	struct sock *ssk;
+ 	u32 remote_token;
+ 	int addrlen;
+ 	int ifindex;
+ 	u8 flags;
+-	int err;
+ 
+ 	if (!mptcp_is_fully_established(sk))
+-		return -ENOTCONN;
++		goto err_out;
+ 
+ 	err = mptcp_subflow_create_socket(sk, &sf);
+ 	if (err)
+-		return err;
++		goto err_out;
+ 
+ 	ssk = sf->sk;
+ 	subflow = mptcp_subflow_ctx(ssk);
+@@ -1456,6 +1456,12 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc,
+ failed:
+ 	subflow->disposable = 1;
+ 	sock_release(sf);
++
++err_out:
++	/* we account subflows before the creation, and this failures will not
++	 * be caught by sk_state_change()
++	 */
++	mptcp_pm_close_subflow(msk);
+ 	return err;
+ }
+ 
+-- 
+2.35.1
+
diff --git a/queue-5.17/mptcp-strict-local-address-id-selection.patch b/queue-5.17/mptcp-strict-local-address-id-selection.patch
new file mode 100644
index 0000000..12d3ada
--- /dev/null
+++ b/queue-5.17/mptcp-strict-local-address-id-selection.patch
@@ -0,0 +1,224 @@
+From dd874ab95a2df6fce00831bf16a06ed827639f6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Mar 2022 12:44:37 -0800
+Subject: mptcp: strict local address ID selection
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 4cf86ae84c718333928fd2d43168a1e359a28329 ]
+
+The address ID selection for MPJ subflows created in response
+to incoming ADD_ADDR option is currently unreliable: it happens
+at MPJ socket creation time, when the local address could be
+unknown.
+
+Additionally, if the no local endpoint is available for the local
+address, a new dummy endpoint is created, confusing the user-land.
+
+This change refactor the code to move the address ID selection inside
+the rebuild_header() helper, when the local address eventually
+selected by the route lookup is finally known. If the address used
+is not mapped by any endpoint - and thus can't be advertised/removed
+pick the id 0 instead of allocate a new endpoint.
+
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/pm_netlink.c | 13 --------
+ net/mptcp/protocol.c   |  3 ++
+ net/mptcp/protocol.h   |  3 +-
+ net/mptcp/subflow.c    | 67 ++++++++++++++++++++++++++++++++++++------
+ 4 files changed, 63 insertions(+), 23 deletions(-)
+
+diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
+index 4b5d795383cd..ec73bd4be0a8 100644
+--- a/net/mptcp/pm_netlink.c
++++ b/net/mptcp/pm_netlink.c
+@@ -83,16 +83,6 @@ static bool addresses_equal(const struct mptcp_addr_info *a,
+ 	return a->port == b->port;
+ }
+ 
+-static bool address_zero(const struct mptcp_addr_info *addr)
+-{
+-	struct mptcp_addr_info zero;
+-
+-	memset(&zero, 0, sizeof(zero));
+-	zero.family = addr->family;
+-
+-	return addresses_equal(addr, &zero, true);
+-}
+-
+ static void local_address(const struct sock_common *skc,
+ 			  struct mptcp_addr_info *addr)
+ {
+@@ -1011,9 +1001,6 @@ int mptcp_pm_nl_get_local_id(struct mptcp_sock *msk, struct sock_common *skc)
+ 	if (addresses_equal(&msk_local, &skc_local, false))
+ 		return 0;
+ 
+-	if (address_zero(&skc_local))
+-		return 0;
+-
+ 	pernet = net_generic(sock_net((struct sock *)msk), pm_nl_pernet_id);
+ 
+ 	rcu_read_lock();
+diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
+index 014c9d88f947..cb90941840b1 100644
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -117,6 +117,9 @@ static int __mptcp_socket_create(struct mptcp_sock *msk)
+ 	list_add(&subflow->node, &msk->conn_list);
+ 	sock_hold(ssock->sk);
+ 	subflow->request_mptcp = 1;
++
++	/* This is the first subflow, always with id 0 */
++	subflow->local_id_valid = 1;
+ 	mptcp_sock_graft(msk->first, sk->sk_socket);
+ 
+ 	return 0;
+diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
+index aec767ee047a..e4413b3e50c2 100644
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -442,7 +442,8 @@ struct mptcp_subflow_context {
+ 		rx_eof : 1,
+ 		can_ack : 1,        /* only after processing the remote a key */
+ 		disposable : 1,	    /* ctx can be free at ulp release time */
+-		stale : 1;	    /* unable to snd/rcv data, do not use for xmit */
++		stale : 1,	    /* unable to snd/rcv data, do not use for xmit */
++		local_id_valid : 1; /* local_id is correctly initialized */
+ 	enum mptcp_data_avail data_avail;
+ 	u32	remote_nonce;
+ 	u64	thmac;
+diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
+index 651f01d13191..e27574e9f969 100644
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -483,6 +483,51 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb)
+ 	mptcp_subflow_reset(sk);
+ }
+ 
++static void subflow_set_local_id(struct mptcp_subflow_context *subflow, int local_id)
++{
++	subflow->local_id = local_id;
++	subflow->local_id_valid = 1;
++}
++
++static int subflow_chk_local_id(struct sock *sk)
++{
++	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
++	struct mptcp_sock *msk = mptcp_sk(subflow->conn);
++	int err;
++
++	if (likely(subflow->local_id_valid))
++		return 0;
++
++	err = mptcp_pm_get_local_id(msk, (struct sock_common *)sk);
++	if (err < 0)
++		return err;
++
++	subflow_set_local_id(subflow, err);
++	return 0;
++}
++
++static int subflow_rebuild_header(struct sock *sk)
++{
++	int err = subflow_chk_local_id(sk);
++
++	if (unlikely(err < 0))
++		return err;
++
++	return inet_sk_rebuild_header(sk);
++}
++
++#if IS_ENABLED(CONFIG_MPTCP_IPV6)
++static int subflow_v6_rebuild_header(struct sock *sk)
++{
++	int err = subflow_chk_local_id(sk);
++
++	if (unlikely(err < 0))
++		return err;
++
++	return inet6_sk_rebuild_header(sk);
++}
++#endif
++
+ struct request_sock_ops mptcp_subflow_request_sock_ops;
+ EXPORT_SYMBOL_GPL(mptcp_subflow_request_sock_ops);
+ static struct tcp_request_sock_ops subflow_request_sock_ipv4_ops;
+@@ -1401,13 +1446,8 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc,
+ 		get_random_bytes(&subflow->local_nonce, sizeof(u32));
+ 	} while (!subflow->local_nonce);
+ 
+-	if (!local_id) {
+-		err = mptcp_pm_get_local_id(msk, (struct sock_common *)ssk);
+-		if (err < 0)
+-			goto failed;
+-
+-		local_id = err;
+-	}
++	if (local_id)
++		subflow_set_local_id(subflow, local_id);
+ 
+ 	mptcp_pm_get_flags_and_ifindex_by_id(sock_net(sk), local_id,
+ 					     &flags, &ifindex);
+@@ -1432,7 +1472,6 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc,
+ 	pr_debug("msk=%p remote_token=%u local_id=%d remote_id=%d", msk,
+ 		 remote_token, local_id, remote_id);
+ 	subflow->remote_token = remote_token;
+-	subflow->local_id = local_id;
+ 	subflow->remote_id = remote_id;
+ 	subflow->request_join = 1;
+ 	subflow->request_bkup = !!(flags & MPTCP_PM_ADDR_FLAG_BACKUP);
+@@ -1737,15 +1776,22 @@ static void subflow_ulp_clone(const struct request_sock *req,
+ 		new_ctx->token = subflow_req->token;
+ 		new_ctx->ssn_offset = subflow_req->ssn_offset;
+ 		new_ctx->idsn = subflow_req->idsn;
++
++		/* this is the first subflow, id is always 0 */
++		new_ctx->local_id_valid = 1;
+ 	} else if (subflow_req->mp_join) {
+ 		new_ctx->ssn_offset = subflow_req->ssn_offset;
+ 		new_ctx->mp_join = 1;
+ 		new_ctx->fully_established = 1;
+ 		new_ctx->backup = subflow_req->backup;
+-		new_ctx->local_id = subflow_req->local_id;
+ 		new_ctx->remote_id = subflow_req->remote_id;
+ 		new_ctx->token = subflow_req->token;
+ 		new_ctx->thmac = subflow_req->thmac;
++
++		/* the subflow req id is valid, fetched via subflow_check_req()
++		 * and subflow_token_join_request()
++		 */
++		subflow_set_local_id(new_ctx, subflow_req->local_id);
+ 	}
+ }
+ 
+@@ -1798,6 +1844,7 @@ void __init mptcp_subflow_init(void)
+ 	subflow_specific.conn_request = subflow_v4_conn_request;
+ 	subflow_specific.syn_recv_sock = subflow_syn_recv_sock;
+ 	subflow_specific.sk_rx_dst_set = subflow_finish_connect;
++	subflow_specific.rebuild_header = subflow_rebuild_header;
+ 
+ 	tcp_prot_override = tcp_prot;
+ 	tcp_prot_override.release_cb = tcp_release_cb_override;
+@@ -1810,6 +1857,7 @@ void __init mptcp_subflow_init(void)
+ 	subflow_v6_specific.conn_request = subflow_v6_conn_request;
+ 	subflow_v6_specific.syn_recv_sock = subflow_syn_recv_sock;
+ 	subflow_v6_specific.sk_rx_dst_set = subflow_finish_connect;
++	subflow_v6_specific.rebuild_header = subflow_v6_rebuild_header;
+ 
+ 	subflow_v6m_specific = subflow_v6_specific;
+ 	subflow_v6m_specific.queue_xmit = ipv4_specific.queue_xmit;
+@@ -1817,6 +1865,7 @@ void __init mptcp_subflow_init(void)
+ 	subflow_v6m_specific.net_header_len = ipv4_specific.net_header_len;
+ 	subflow_v6m_specific.mtu_reduced = ipv4_specific.mtu_reduced;
+ 	subflow_v6m_specific.net_frag_header_len = 0;
++	subflow_v6m_specific.rebuild_header = subflow_rebuild_header;
+ 
+ 	tcpv6_prot_override = tcpv6_prot;
+ 	tcpv6_prot_override.release_cb = tcp_release_cb_override;
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-af_key-add-check-for-pfkey_broadcast-in-function.patch b/queue-5.17/net-af_key-add-check-for-pfkey_broadcast-in-function.patch
new file mode 100644
index 0000000..7c92f7c
--- /dev/null
+++ b/queue-5.17/net-af_key-add-check-for-pfkey_broadcast-in-function.patch
@@ -0,0 +1,42 @@
+From 4bb9576383ad1ee46094b25f016c58ddf735f223 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 May 2022 17:42:31 +0800
+Subject: net: af_key: add check for pfkey_broadcast in function pfkey_process
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 4dc2a5a8f6754492180741facf2a8787f2c415d7 ]
+
+If skb_clone() returns null pointer, pfkey_broadcast() will
+return error.
+Therefore, it should be better to check the return value of
+pfkey_broadcast() and return error if fails.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/key/af_key.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index fd51db3be91c..92e9d75dba2f 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2826,8 +2826,10 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
+ 	void *ext_hdrs[SADB_EXT_MAX];
+ 	int err;
+ 
+-	pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
+-			BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
++	err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
++			      BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
++	if (err)
++		return err;
+ 
+ 	memset(ext_hdrs, 0, sizeof(ext_hdrs));
+ 	err = parse_exthdrs(skb, hdr, ext_hdrs);
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-atlantic-add-check-for-max_skb_frags.patch b/queue-5.17/net-atlantic-add-check-for-max_skb_frags.patch
new file mode 100644
index 0000000..bb88fe1
--- /dev/null
+++ b/queue-5.17/net-atlantic-add-check-for-max_skb_frags.patch
@@ -0,0 +1,55 @@
+From f8253e9358afd00b506c956882d073a007c949ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 May 2022 19:28:25 -0700
+Subject: net: atlantic: add check for MAX_SKB_FRAGS
+
+From: Grant Grundler <grundler@chromium.org>
+
+[ Upstream commit 6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f ]
+
+Enforce that the CPU can not get stuck in an infinite loop.
+
+Reported-by: Aashay Shringarpure <aashay@google.com>
+Reported-by: Yi Chou <yich@google.com>
+Reported-by: Shervin Oloumi <enlightened@google.com>
+Signed-off-by: Grant Grundler <grundler@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+index bc1952131799..8201ce7adb77 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -363,6 +363,7 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 			continue;
+ 
+ 		if (!buff->is_eop) {
++			unsigned int frag_cnt = 0U;
+ 			buff_ = buff;
+ 			do {
+ 				bool is_rsc_completed = true;
+@@ -371,6 +372,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 					err = -EIO;
+ 					goto err_exit;
+ 				}
++
++				frag_cnt++;
+ 				next_ = buff_->next,
+ 				buff_ = &self->buff_ring[next_];
+ 				is_rsc_completed =
+@@ -378,7 +381,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 							    next_,
+ 							    self->hw_head);
+ 
+-				if (unlikely(!is_rsc_completed)) {
++				if (unlikely(!is_rsc_completed) ||
++						frag_cnt > MAX_SKB_FRAGS) {
+ 					err = 0;
+ 					goto err_exit;
+ 				}
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-atlantic-fix-frag-0-not-initialized.patch b/queue-5.17/net-atlantic-fix-frag-0-not-initialized.patch
new file mode 100644
index 0000000..36f390d
--- /dev/null
+++ b/queue-5.17/net-atlantic-fix-frag-0-not-initialized.patch
@@ -0,0 +1,53 @@
+From b0475af0b123b7aec80cc671cb12cdedeec15b02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 May 2022 19:28:23 -0700
+Subject: net: atlantic: fix "frag[0] not initialized"
+
+From: Grant Grundler <grundler@chromium.org>
+
+[ Upstream commit 62e0ae0f4020250f961cf8d0103a4621be74e077 ]
+
+In aq_ring_rx_clean(), if buff->is_eop is not set AND
+buff->len < AQ_CFG_RX_HDR_SIZE, then hdr_len remains equal to
+buff->len and skb_add_rx_frag(xxx, *0*, ...) is not called.
+
+The loop following this code starts calling skb_add_rx_frag() starting
+with i=1 and thus frag[0] is never initialized. Since i is initialized
+to zero at the top of the primary loop, we can just reference and
+post-increment i instead of hardcoding the 0 when calling
+skb_add_rx_frag() the first time.
+
+Reported-by: Aashay Shringarpure <aashay@google.com>
+Reported-by: Yi Chou <yich@google.com>
+Reported-by: Shervin Oloumi <enlightened@google.com>
+Signed-off-by: Grant Grundler <grundler@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+index 77e76c9efd32..440423b0e8ea 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -446,7 +446,7 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 		       ALIGN(hdr_len, sizeof(long)));
+ 
+ 		if (buff->len - hdr_len > 0) {
+-			skb_add_rx_frag(skb, 0, buff->rxdata.page,
++			skb_add_rx_frag(skb, i++, buff->rxdata.page,
+ 					buff->rxdata.pg_off + hdr_len,
+ 					buff->len - hdr_len,
+ 					AQ_CFG_RX_FRAME_MAX);
+@@ -455,7 +455,6 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 
+ 		if (!buff->is_eop) {
+ 			buff_ = buff;
+-			i = 1U;
+ 			do {
+ 				next_ = buff_->next;
+ 				buff_ = &self->buff_ring[next_];
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-atlantic-reduce-scope-of-is_rsc_complete.patch b/queue-5.17/net-atlantic-reduce-scope-of-is_rsc_complete.patch
new file mode 100644
index 0000000..49a0a38
--- /dev/null
+++ b/queue-5.17/net-atlantic-reduce-scope-of-is_rsc_complete.patch
@@ -0,0 +1,68 @@
+From 26c2988c1a8aa774ffed68964aa189d093dafdb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 May 2022 19:28:24 -0700
+Subject: net: atlantic: reduce scope of is_rsc_complete
+
+From: Grant Grundler <grundler@chromium.org>
+
+[ Upstream commit 79784d77ebbd3ec516b7a5ce555d979fb7946202 ]
+
+Don't defer handling the err case outside the loop. That's pointless.
+
+And since is_rsc_complete is only used inside this loop, declare
+it inside the loop to reduce it's scope.
+
+Signed-off-by: Grant Grundler <grundler@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+index 440423b0e8ea..bc1952131799 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -346,7 +346,6 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 		     int budget)
+ {
+ 	struct net_device *ndev = aq_nic_get_ndev(self->aq_nic);
+-	bool is_rsc_completed = true;
+ 	int err = 0;
+ 
+ 	for (; (self->sw_head != self->hw_head) && budget;
+@@ -366,6 +365,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 		if (!buff->is_eop) {
+ 			buff_ = buff;
+ 			do {
++				bool is_rsc_completed = true;
++
+ 				if (buff_->next >= self->size) {
+ 					err = -EIO;
+ 					goto err_exit;
+@@ -377,18 +378,16 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 							    next_,
+ 							    self->hw_head);
+ 
+-				if (unlikely(!is_rsc_completed))
+-					break;
++				if (unlikely(!is_rsc_completed)) {
++					err = 0;
++					goto err_exit;
++				}
+ 
+ 				buff->is_error |= buff_->is_error;
+ 				buff->is_cso_err |= buff_->is_cso_err;
+ 
+ 			} while (!buff_->is_eop);
+ 
+-			if (!is_rsc_completed) {
+-				err = 0;
+-				goto err_exit;
+-			}
+ 			if (buff->is_error ||
+ 			    (buff->is_lro && buff->is_cso_err)) {
+ 				buff_ = buff;
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-atlantic-verify-hw_head_-lies-within-tx-buffer-r.patch b/queue-5.17/net-atlantic-verify-hw_head_-lies-within-tx-buffer-r.patch
new file mode 100644
index 0000000..339e6dc
--- /dev/null
+++ b/queue-5.17/net-atlantic-verify-hw_head_-lies-within-tx-buffer-r.patch
@@ -0,0 +1,43 @@
+From b20077c1b4ac38dcd05896fc988b980c73225e1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 May 2022 19:28:26 -0700
+Subject: net: atlantic: verify hw_head_ lies within TX buffer ring
+
+From: Grant Grundler <grundler@chromium.org>
+
+[ Upstream commit 2120b7f4d128433ad8c5f503a9584deba0684901 ]
+
+Bounds check hw_head index provided by NIC to verify it lies
+within the TX buffer ring.
+
+Reported-by: Aashay Shringarpure <aashay@google.com>
+Reported-by: Yi Chou <yich@google.com>
+Reported-by: Shervin Oloumi <enlightened@google.com>
+Signed-off-by: Grant Grundler <grundler@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index d875ce3ec759..15ede7285fb5 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -889,6 +889,13 @@ int hw_atl_b0_hw_ring_tx_head_update(struct aq_hw_s *self,
+ 		err = -ENXIO;
+ 		goto err_exit;
+ 	}
++
++	/* Validate that the new hw_head_ is reasonable. */
++	if (hw_head_ >= ring->size) {
++		err = -ENXIO;
++		goto err_exit;
++	}
++
+ 	ring->hw_head = hw_head_;
+ 	err = aq_hw_err_from_flags(self);
+ 
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-bridge-clear-offload_fwd_mark-when-passing-frame.patch b/queue-5.17/net-bridge-clear-offload_fwd_mark-when-passing-frame.patch
new file mode 100644
index 0000000..26f64ef
--- /dev/null
+++ b/queue-5.17/net-bridge-clear-offload_fwd_mark-when-passing-frame.patch
@@ -0,0 +1,72 @@
+From b7612f970fa2ea34e1537c0e375e207f40cfdef6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 May 2022 02:58:40 +0200
+Subject: net: bridge: Clear offload_fwd_mark when passing frame up bridge
+ interface.
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+[ Upstream commit fbb3abdf2223cd0dfc07de85fe5a43ba7f435bdf ]
+
+It is possible to stack bridges on top of each other. Consider the
+following which makes use of an Ethernet switch:
+
+       br1
+     /    \
+    /      \
+   /        \
+ br0.11    wlan0
+   |
+   br0
+ /  |  \
+p1  p2  p3
+
+br0 is offloaded to the switch. Above br0 is a vlan interface, for
+vlan 11. This vlan interface is then a slave of br1. br1 also has a
+wireless interface as a slave. This setup trunks wireless lan traffic
+over the copper network inside a VLAN.
+
+A frame received on p1 which is passed up to the bridge has the
+skb->offload_fwd_mark flag set to true, indicating that the switch has
+dealt with forwarding the frame out ports p2 and p3 as needed. This
+flag instructs the software bridge it does not need to pass the frame
+back down again. However, the flag is not getting reset when the frame
+is passed upwards. As a result br1 sees the flag, wrongly interprets
+it, and fails to forward the frame to wlan0.
+
+When passing a frame upwards, clear the flag. This is the Rx
+equivalent of br_switchdev_frame_unmark() in br_dev_xmit().
+
+Fixes: f1c2eddf4cb6 ("bridge: switchdev: Use an helper to clear forward mark")
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Tested-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://lore.kernel.org/r/20220518005840.771575-1-andrew@lunn.ch
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_input.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
+index b50382f957c1..6743c8a0fe8e 100644
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -39,6 +39,13 @@ static int br_pass_frame_up(struct sk_buff *skb)
+ 	dev_sw_netstats_rx_add(brdev, skb->len);
+ 
+ 	vg = br_vlan_group_rcu(br);
++
++	/* Reset the offload_fwd_mark because there could be a stacked
++	 * bridge above, and it should not think this bridge it doing
++	 * that bridge's work forwarding out its ports.
++	 */
++	br_switchdev_frame_unmark(skb);
++
+ 	/* Bridge is just like any other port.  Make sure the
+ 	 * packet is allowed except in promisc mode when someone
+ 	 * may be running packet capture.
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-fix-dev_fill_forward_path-with-pppoe-bridge.patch b/queue-5.17/net-fix-dev_fill_forward_path-with-pppoe-bridge.patch
new file mode 100644
index 0000000..9b47690
--- /dev/null
+++ b/queue-5.17/net-fix-dev_fill_forward_path-with-pppoe-bridge.patch
@@ -0,0 +1,69 @@
+From 74418e577755a8e710b5609b49222cfd6f31da4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 May 2022 14:26:15 +0200
+Subject: net: fix dev_fill_forward_path with pppoe + bridge
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit cf2df74e202d81b09f09d84c2d8903e0e87e9274 ]
+
+When calling dev_fill_forward_path on a pppoe device, the provided destination
+address is invalid. In order for the bridge fdb lookup to succeed, the pppoe
+code needs to update ctx->daddr to the correct value.
+Fix this by storing the address inside struct net_device_path_ctx
+
+Fixes: f6efc675c9dd ("net: ppp: resolve forwarding path for bridge pppoe devices")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ppp/pppoe.c   | 1 +
+ include/linux/netdevice.h | 2 +-
+ net/core/dev.c            | 2 +-
+ 3 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index 3619520340b7..e172743948ed 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -988,6 +988,7 @@ static int pppoe_fill_forward_path(struct net_device_path_ctx *ctx,
+ 	path->encap.proto = htons(ETH_P_PPP_SES);
+ 	path->encap.id = be16_to_cpu(po->num);
+ 	memcpy(path->encap.h_dest, po->pppoe_pa.remote, ETH_ALEN);
++	memcpy(ctx->daddr, po->pppoe_pa.remote, ETH_ALEN);
+ 	path->dev = ctx->dev;
+ 	ctx->dev = dev;
+ 
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index f53ea7038441..dadd4d2f6d8a 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -891,7 +891,7 @@ struct net_device_path_stack {
+ 
+ struct net_device_path_ctx {
+ 	const struct net_device *dev;
+-	const u8		*daddr;
++	u8			daddr[ETH_ALEN];
+ 
+ 	int			num_vlans;
+ 	struct {
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 91cf709c98b3..5f1ac4812277 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -663,11 +663,11 @@ int dev_fill_forward_path(const struct net_device *dev, const u8 *daddr,
+ 	const struct net_device *last_dev;
+ 	struct net_device_path_ctx ctx = {
+ 		.dev	= dev,
+-		.daddr	= daddr,
+ 	};
+ 	struct net_device_path *path;
+ 	int ret = 0;
+ 
++	memcpy(ctx.daddr, daddr, sizeof(ctx.daddr));
+ 	stack->num_paths = 0;
+ 	while (ctx.dev && ctx.dev->netdev_ops->ndo_fill_forward_path) {
+ 		last_dev = ctx.dev;
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-fix-wrong-network-header-length.patch b/queue-5.17/net-fix-wrong-network-header-length.patch
new file mode 100644
index 0000000..89b4bcd
--- /dev/null
+++ b/queue-5.17/net-fix-wrong-network-header-length.patch
@@ -0,0 +1,71 @@
+From f054b20cd89fcc8876a786b8567f6e21078070d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 May 2022 13:48:49 +0800
+Subject: net: fix wrong network header length
+
+From: Lina Wang <lina.wang@mediatek.com>
+
+[ Upstream commit cf3ab8d4a797960b4be20565abb3bcd227b18a68 ]
+
+When clatd starts with ebpf offloaing, and NETIF_F_GRO_FRAGLIST is enable,
+several skbs are gathered in skb_shinfo(skb)->frag_list. The first skb's
+ipv6 header will be changed to ipv4 after bpf_skb_proto_6_to_4,
+network_header\transport_header\mac_header have been updated as ipv4 acts,
+but other skbs in frag_list didnot update anything, just ipv6 packets.
+
+udp_queue_rcv_skb will call skb_segment_list to traverse other skbs in
+frag_list and make sure right udp payload is delivered to user space.
+Unfortunately, other skbs in frag_list who are still ipv6 packets are
+updated like the first skb and will have wrong transport header length.
+
+e.g.before bpf_skb_proto_6_to_4,the first skb and other skbs in frag_list
+has the same network_header(24)& transport_header(64), after
+bpf_skb_proto_6_to_4, ipv6 protocol has been changed to ipv4, the first
+skb's network_header is 44,transport_header is 64, other skbs in frag_list
+didnot change.After skb_segment_list, the other skbs in frag_list has
+different network_header(24) and transport_header(44), so there will be 20
+bytes different from original,that is difference between ipv6 header and
+ipv4 header. Just change transport_header to be the same with original.
+
+Actually, there are two solutions to fix it, one is traversing all skbs
+and changing every skb header in bpf_skb_proto_6_to_4, the other is
+modifying frag_list skb's header in skb_segment_list. Considering
+efficiency, adopt the second one--- when the first skb and other skbs in
+frag_list has different network_header length, restore them to make sure
+right udp payload is delivered to user space.
+
+Signed-off-by: Lina Wang <lina.wang@mediatek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skbuff.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 180fa6a26ad4..708cc9b1b176 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3896,7 +3896,7 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ 	unsigned int delta_len = 0;
+ 	struct sk_buff *tail = NULL;
+ 	struct sk_buff *nskb, *tmp;
+-	int err;
++	int len_diff, err;
+ 
+ 	skb_push(skb, -skb_network_offset(skb) + offset);
+ 
+@@ -3936,9 +3936,11 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ 		skb_push(nskb, -skb_network_offset(nskb) + offset);
+ 
+ 		skb_release_head_state(nskb);
++		len_diff = skb_network_header_len(nskb) - skb_network_header_len(skb);
+ 		__copy_skb_header(nskb, skb);
+ 
+ 		skb_headers_offset_update(nskb, skb_headroom(nskb) - skb_headroom(skb));
++		nskb->transport_header += len_diff;
+ 		skb_copy_from_linear_data_offset(skb, -tnl_hlen,
+ 						 nskb->data - tnl_hlen,
+ 						 offset + tnl_hlen);
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-ipa-certain-dropped-packets-aren-t-accounted-for.patch b/queue-5.17/net-ipa-certain-dropped-packets-aren-t-accounted-for.patch
new file mode 100644
index 0000000..49752fc
--- /dev/null
+++ b/queue-5.17/net-ipa-certain-dropped-packets-aren-t-accounted-for.patch
@@ -0,0 +1,56 @@
+From 7feaa42b0b802e9f0b50eb77ae0bab95559a2b57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 May 2022 10:10:31 -0500
+Subject: net: ipa: certain dropped packets aren't accounted for
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 30b338ff7998b6ed7a90815870cd5db725f87168 ]
+
+If an RX endpoint receives packets containing status headers, and a
+packet in the buffer is not dropped, ipa_endpoint_skb_copy() is
+responsible for wrapping the packet data in an SKB and forwarding it
+to ipa_modem_skb_rx() for further processing.
+
+If ipa_endpoint_skb_copy() gets a null pointer from build_skb(), it
+just returns early.  But in the process it doesn't record that as a
+dropped packet in the network device statistics.
+
+Instead, call ipa_modem_skb_rx() whether or not the SKB pointer is
+NULL; that function ensures the statistics are properly updated.
+
+Fixes: 1b65bbcc9a710 ("net: ipa: skip SKB copy if no netdev")
+Signed-off-by: Alex Elder <elder@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipa/ipa_endpoint.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ipa/ipa_endpoint.c b/drivers/net/ipa/ipa_endpoint.c
+index 68291a3efd04..2ecfc17544a6 100644
+--- a/drivers/net/ipa/ipa_endpoint.c
++++ b/drivers/net/ipa/ipa_endpoint.c
+@@ -1169,13 +1169,12 @@ static void ipa_endpoint_skb_copy(struct ipa_endpoint *endpoint,
+ 		return;
+ 
+ 	skb = __dev_alloc_skb(len, GFP_ATOMIC);
+-	if (!skb)
+-		return;
+-
+-	/* Copy the data into the socket buffer and receive it */
+-	skb_put(skb, len);
+-	memcpy(skb->data, data, len);
+-	skb->truesize += extra;
++	if (skb) {
++		/* Copy the data into the socket buffer and receive it */
++		skb_put(skb, len);
++		memcpy(skb->data, data, len);
++		skb->truesize += extra;
++	}
+ 
+ 	ipa_modem_skb_rx(endpoint->netdev, skb);
+ }
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-ipa-record-proper-rx-transaction-count.patch b/queue-5.17/net-ipa-record-proper-rx-transaction-count.patch
new file mode 100644
index 0000000..1faa6a5
--- /dev/null
+++ b/queue-5.17/net-ipa-record-proper-rx-transaction-count.patch
@@ -0,0 +1,61 @@
+From c8235b53fc4275203fed3fd21879d904f70650bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 May 2022 10:10:32 -0500
+Subject: net: ipa: record proper RX transaction count
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit d8290cbe1111105f92f0c8ab455bec8bf98d0630 ]
+
+Each time we are notified that some number of transactions on an RX
+channel has completed, we record the number of bytes that have been
+transferred since the previous notification.  We also track the
+number of transactions completed, but that is not currently being
+calculated correctly; we're currently counting the number of such
+notifications, but each notification can represent many transaction
+completions.  Fix this.
+
+Fixes: 650d1603825d8 ("soc: qcom: ipa: the generic software interface")
+Signed-off-by: Alex Elder <elder@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipa/gsi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ipa/gsi.c b/drivers/net/ipa/gsi.c
+index bc981043cc80..a701178a1d13 100644
+--- a/drivers/net/ipa/gsi.c
++++ b/drivers/net/ipa/gsi.c
+@@ -1367,9 +1367,10 @@ static void gsi_evt_ring_rx_update(struct gsi_evt_ring *evt_ring, u32 index)
+ 	struct gsi_event *event_done;
+ 	struct gsi_event *event;
+ 	struct gsi_trans *trans;
++	u32 trans_count = 0;
+ 	u32 byte_count = 0;
+-	u32 old_index;
+ 	u32 event_avail;
++	u32 old_index;
+ 
+ 	trans_info = &channel->trans_info;
+ 
+@@ -1390,6 +1391,7 @@ static void gsi_evt_ring_rx_update(struct gsi_evt_ring *evt_ring, u32 index)
+ 	do {
+ 		trans->len = __le16_to_cpu(event->len);
+ 		byte_count += trans->len;
++		trans_count++;
+ 
+ 		/* Move on to the next event and transaction */
+ 		if (--event_avail)
+@@ -1401,7 +1403,7 @@ static void gsi_evt_ring_rx_update(struct gsi_evt_ring *evt_ring, u32 index)
+ 
+ 	/* We record RX bytes when they are received */
+ 	channel->byte_count += byte_count;
+-	channel->trans_count++;
++	channel->trans_count += trans_count;
+ }
+ 
+ /* Initialize a ring, including allocating DMA memory for its entries */
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-lan966x-fix-assignment-of-the-mac-address.patch b/queue-5.17/net-lan966x-fix-assignment-of-the-mac-address.patch
new file mode 100644
index 0000000..4a5073c
--- /dev/null
+++ b/queue-5.17/net-lan966x-fix-assignment-of-the-mac-address.patch
@@ -0,0 +1,90 @@
+From 23ddbd55c2bd2ea8e4dce92db9f6ad661debf92a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 May 2022 20:00:30 +0200
+Subject: net: lan966x: Fix assignment of the MAC address
+
+From: Horatiu Vultur <horatiu.vultur@microchip.com>
+
+[ Upstream commit af8ca6eaa9b24a90484218e356f959a94bff22fa ]
+
+The following two scenarios were failing for lan966x.
+1. If the port had the address X and then trying to assign the same
+   address, then the HW was just removing this address because first it
+   tries to learn new address and then delete the old one. As they are
+   the same the HW remove it.
+2. If the port eth0 was assigned the same address as one of the other
+   ports eth1 then when assigning back the address to eth0 then the HW
+   was deleting the address of eth1.
+
+The case 1. is fixed by checking if the port has already the same
+address while case 2. is fixed by checking if the address is used by any
+other port.
+
+Fixes: e18aba8941b40b ("net: lan966x: add mactable support")
+Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
+Link: https://lore.kernel.org/r/20220513180030.3076793-1-horatiu.vultur@microchip.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/microchip/lan966x/lan966x_main.c | 28 +++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c
+index 1f60fd125a1d..fee148bbf13e 100644
+--- a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c
++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c
+@@ -100,6 +100,24 @@ static int lan966x_create_targets(struct platform_device *pdev,
+ 	return 0;
+ }
+ 
++static bool lan966x_port_unique_address(struct net_device *dev)
++{
++	struct lan966x_port *port = netdev_priv(dev);
++	struct lan966x *lan966x = port->lan966x;
++	int p;
++
++	for (p = 0; p < lan966x->num_phys_ports; ++p) {
++		port = lan966x->ports[p];
++		if (!port || port->dev == dev)
++			continue;
++
++		if (ether_addr_equal(dev->dev_addr, port->dev->dev_addr))
++			return false;
++	}
++
++	return true;
++}
++
+ static int lan966x_port_set_mac_address(struct net_device *dev, void *p)
+ {
+ 	struct lan966x_port *port = netdev_priv(dev);
+@@ -107,16 +125,26 @@ static int lan966x_port_set_mac_address(struct net_device *dev, void *p)
+ 	const struct sockaddr *addr = p;
+ 	int ret;
+ 
++	if (ether_addr_equal(addr->sa_data, dev->dev_addr))
++		return 0;
++
+ 	/* Learn the new net device MAC address in the mac table. */
+ 	ret = lan966x_mac_cpu_learn(lan966x, addr->sa_data, HOST_PVID);
+ 	if (ret)
+ 		return ret;
+ 
++	/* If there is another port with the same address as the dev, then don't
++	 * delete it from the MAC table
++	 */
++	if (!lan966x_port_unique_address(dev))
++		goto out;
++
+ 	/* Then forget the previous one. */
+ 	ret = lan966x_mac_cpu_forget(lan966x, dev->dev_addr, HOST_PVID);
+ 	if (ret)
+ 		return ret;
+ 
++out:
+ 	eth_hw_addr_set(dev, addr->sa_data);
+ 	return ret;
+ }
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-macb-increment-rx-bd-head-after-allocating-skb-a.patch b/queue-5.17/net-macb-increment-rx-bd-head-after-allocating-skb-a.patch
new file mode 100644
index 0000000..7bf2fb2
--- /dev/null
+++ b/queue-5.17/net-macb-increment-rx-bd-head-after-allocating-skb-a.patch
@@ -0,0 +1,53 @@
+From 5d75c47d7a8d39457c7a9046ed17eaefb8b676c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 May 2022 22:49:00 +0530
+Subject: net: macb: Increment rx bd head after allocating skb and buffer
+
+From: Harini Katakam <harini.katakam@xilinx.com>
+
+[ Upstream commit 9500acc631dbb8b73166e25700e656b11f6007b6 ]
+
+In gem_rx_refill rx_prepared_head is incremented at the beginning of
+the while loop preparing the skb and data buffers. If the skb or data
+buffer allocation fails, this BD will be unusable BDs until the head
+loops back to the same BD (and obviously buffer allocation succeeds).
+In the unlikely event that there's a string of allocation failures,
+there will be an equal number of unusable BDs and an inconsistent RX
+BD chain. Hence increment the head at the end of the while loop to be
+clean.
+
+Fixes: 4df95131ea80 ("net/macb: change RX path for GEM")
+Signed-off-by: Harini Katakam <harini.katakam@xilinx.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20220512171900.32593-1-harini.katakam@xilinx.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index c4f4b13ac469..c1100af5666b 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -1217,7 +1217,6 @@ static void gem_rx_refill(struct macb_queue *queue)
+ 		/* Make hw descriptor updates visible to CPU */
+ 		rmb();
+ 
+-		queue->rx_prepared_head++;
+ 		desc = macb_rx_desc(queue, entry);
+ 
+ 		if (!queue->rx_skbuff[entry]) {
+@@ -1256,6 +1255,7 @@ static void gem_rx_refill(struct macb_queue *queue)
+ 			dma_wmb();
+ 			desc->addr &= ~MACB_BIT(RX_USED);
+ 		}
++		queue->rx_prepared_head++;
+ 	}
+ 
+ 	/* Make descriptor updates visible to hardware */
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-mlx5-dr-fix-missing-flow_source-when-creating-mu.patch b/queue-5.17/net-mlx5-dr-fix-missing-flow_source-when-creating-mu.patch
new file mode 100644
index 0000000..75603b3
--- /dev/null
+++ b/queue-5.17/net-mlx5-dr-fix-missing-flow_source-when-creating-mu.patch
@@ -0,0 +1,130 @@
+From 5a73835859bf34f79392b7753dd4e5d9f328e3fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Mar 2022 10:07:44 +0200
+Subject: net/mlx5: DR, Fix missing flow_source when creating multi-destination
+ FW table
+
+From: Maor Dickman <maord@nvidia.com>
+
+[ Upstream commit 2c5fc6cd269ad3476da99dad02521d2af4a8e906 ]
+
+In order to support multiple destination FTEs with SW steering
+FW table is created with single FTE with multiple actions and
+SW steering rule forward to it. When creating this table, flow
+source isn't set according to the original FTE.
+
+Fix this by passing the original FTE flow source to the created
+FW table.
+
+Fixes: 34583beea4b7 ("net/mlx5: DR, Create multi-destination table for SW-steering use")
+Signed-off-by: Maor Dickman <maord@nvidia.com>
+Reviewed-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/steering/dr_action.c    | 6 ++++--
+ drivers/net/ethernet/mellanox/mlx5/core/steering/dr_fw.c    | 4 +++-
+ drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h | 3 ++-
+ drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c    | 4 +++-
+ drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h   | 3 ++-
+ 5 files changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c
+index c61a5e83c78c..5d1caf97a8fc 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c
+@@ -847,7 +847,8 @@ struct mlx5dr_action *
+ mlx5dr_action_create_mult_dest_tbl(struct mlx5dr_domain *dmn,
+ 				   struct mlx5dr_action_dest *dests,
+ 				   u32 num_of_dests,
+-				   bool ignore_flow_level)
++				   bool ignore_flow_level,
++				   u32 flow_source)
+ {
+ 	struct mlx5dr_cmd_flow_destination_hw_info *hw_dests;
+ 	struct mlx5dr_action **ref_actions;
+@@ -919,7 +920,8 @@ mlx5dr_action_create_mult_dest_tbl(struct mlx5dr_domain *dmn,
+ 				      reformat_req,
+ 				      &action->dest_tbl->fw_tbl.id,
+ 				      &action->dest_tbl->fw_tbl.group_id,
+-				      ignore_flow_level);
++				      ignore_flow_level,
++				      flow_source);
+ 	if (ret)
+ 		goto free_action;
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_fw.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_fw.c
+index 68a4c32d5f34..f05ef0cd54ba 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_fw.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_fw.c
+@@ -104,7 +104,8 @@ int mlx5dr_fw_create_md_tbl(struct mlx5dr_domain *dmn,
+ 			    bool reformat_req,
+ 			    u32 *tbl_id,
+ 			    u32 *group_id,
+-			    bool ignore_flow_level)
++			    bool ignore_flow_level,
++			    u32 flow_source)
+ {
+ 	struct mlx5dr_cmd_create_flow_table_attr ft_attr = {};
+ 	struct mlx5dr_cmd_fte_info fte_info = {};
+@@ -139,6 +140,7 @@ int mlx5dr_fw_create_md_tbl(struct mlx5dr_domain *dmn,
+ 	fte_info.val = val;
+ 	fte_info.dest_arr = dest;
+ 	fte_info.ignore_flow_level = ignore_flow_level;
++	fte_info.flow_context.flow_source = flow_source;
+ 
+ 	ret = mlx5dr_cmd_set_fte(dmn->mdev, 0, 0, &ft_info, *group_id, &fte_info);
+ 	if (ret) {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h
+index 55fcb751e24a..64f41e7938e1 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h
+@@ -1463,7 +1463,8 @@ int mlx5dr_fw_create_md_tbl(struct mlx5dr_domain *dmn,
+ 			    bool reformat_req,
+ 			    u32 *tbl_id,
+ 			    u32 *group_id,
+-			    bool ignore_flow_level);
++			    bool ignore_flow_level,
++			    u32 flow_source);
+ void mlx5dr_fw_destroy_md_tbl(struct mlx5dr_domain *dmn, u32 tbl_id,
+ 			      u32 group_id);
+ #endif  /* _DR_TYPES_H_ */
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c
+index 3f311462bedf..05393fe11132 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c
+@@ -520,6 +520,7 @@ static int mlx5_cmd_dr_create_fte(struct mlx5_flow_root_namespace *ns,
+ 	} else if (num_term_actions > 1) {
+ 		bool ignore_flow_level =
+ 			!!(fte->action.flags & FLOW_ACT_IGNORE_FLOW_LEVEL);
++		u32 flow_source = fte->flow_context.flow_source;
+ 
+ 		if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX ||
+ 		    fs_dr_num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) {
+@@ -529,7 +530,8 @@ static int mlx5_cmd_dr_create_fte(struct mlx5_flow_root_namespace *ns,
+ 		tmp_action = mlx5dr_action_create_mult_dest_tbl(domain,
+ 								term_actions,
+ 								num_term_actions,
+-								ignore_flow_level);
++								ignore_flow_level,
++								flow_source);
+ 		if (!tmp_action) {
+ 			err = -EOPNOTSUPP;
+ 			goto free_actions;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h
+index dfa223415fe2..74a7a2f4d50d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/mlx5dr.h
+@@ -96,7 +96,8 @@ struct mlx5dr_action *
+ mlx5dr_action_create_mult_dest_tbl(struct mlx5dr_domain *dmn,
+ 				   struct mlx5dr_action_dest *dests,
+ 				   u32 num_of_dests,
+-				   bool ignore_flow_level);
++				   bool ignore_flow_level,
++				   u32 flow_source);
+ 
+ struct mlx5dr_action *mlx5dr_action_create_drop(void);
+ 
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-mlx5-dr-ignore-modify-ttl-on-rx-if-device-doesn-.patch b/queue-5.17/net-mlx5-dr-ignore-modify-ttl-on-rx-if-device-doesn-.patch
new file mode 100644
index 0000000..47ea6b4
--- /dev/null
+++ b/queue-5.17/net-mlx5-dr-ignore-modify-ttl-on-rx-if-device-doesn-.patch
@@ -0,0 +1,176 @@
+From 7d98679d33534ae54f697dbc34901f04c04108db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Apr 2022 23:18:10 +0300
+Subject: net/mlx5: DR, Ignore modify TTL on RX if device doesn't support it
+
+From: Yevgeny Kliteynik <kliteyn@nvidia.com>
+
+[ Upstream commit 785d7ed295513bd3374095304b7034fd65c123b0 ]
+
+When modifying TTL, packet's csum has to be recalculated.
+Due to HW issue in ConnectX-5, csum recalculation for modify
+TTL on RX is supported through a work-around that is specifically
+enabled by configuration.
+If the work-around isn't enabled, rather than adding an unsupported
+action the modify TTL action on RX should be ignored.
+Ignoring modify TTL action might result in zero actions, so in such
+cases we will not convert the match STE to modify STE, as it is done
+by FW in DMFS.
+
+This patch fixes an issue where modify TTL action was ignored both
+on RX and TX instead of only on RX.
+
+Fixes: 4ff725e1d4ad ("net/mlx5: DR, Ignore modify TTL if device doesn't support it")
+Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
+Reviewed-by: Alex Vesker <valex@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/steering/dr_action.c   | 65 +++++++++++++------
+ .../mellanox/mlx5/core/steering/dr_ste_v0.c   |  4 +-
+ 2 files changed, 48 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c
+index 5d1caf97a8fc..8622af6d6bf8 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c
+@@ -530,6 +530,37 @@ static int dr_action_handle_cs_recalc(struct mlx5dr_domain *dmn,
+ 	return 0;
+ }
+ 
++static void dr_action_modify_ttl_adjust(struct mlx5dr_domain *dmn,
++					struct mlx5dr_ste_actions_attr *attr,
++					bool rx_rule,
++					bool *recalc_cs_required)
++{
++	*recalc_cs_required = false;
++
++	/* if device supports csum recalculation - no adjustment needed */
++	if (mlx5dr_ste_supp_ttl_cs_recalc(&dmn->info.caps))
++		return;
++
++	/* no adjustment needed on TX rules */
++	if (!rx_rule)
++		return;
++
++	if (!MLX5_CAP_ESW_FLOWTABLE(dmn->mdev, fdb_ipv4_ttl_modify)) {
++		/* Ignore the modify TTL action.
++		 * It is always kept as last HW action.
++		 */
++		attr->modify_actions--;
++		return;
++	}
++
++	if (dmn->type == MLX5DR_DOMAIN_TYPE_FDB)
++		/* Due to a HW bug on some devices, modifying TTL on RX flows
++		 * will cause an incorrect checksum calculation. In such cases
++		 * we will use a FW table to recalculate the checksum.
++		 */
++		*recalc_cs_required = true;
++}
++
+ static void dr_action_print_sequence(struct mlx5dr_domain *dmn,
+ 				     struct mlx5dr_action *actions[],
+ 				     int last_idx)
+@@ -649,8 +680,9 @@ int mlx5dr_actions_build_ste_arr(struct mlx5dr_matcher *matcher,
+ 		case DR_ACTION_TYP_MODIFY_HDR:
+ 			attr.modify_index = action->rewrite->index;
+ 			attr.modify_actions = action->rewrite->num_of_actions;
+-			recalc_cs_required = action->rewrite->modify_ttl &&
+-					     !mlx5dr_ste_supp_ttl_cs_recalc(&dmn->info.caps);
++			if (action->rewrite->modify_ttl)
++				dr_action_modify_ttl_adjust(dmn, &attr, rx_rule,
++							    &recalc_cs_required);
+ 			break;
+ 		case DR_ACTION_TYP_L2_TO_TNL_L2:
+ 		case DR_ACTION_TYP_L2_TO_TNL_L3:
+@@ -737,12 +769,7 @@ int mlx5dr_actions_build_ste_arr(struct mlx5dr_matcher *matcher,
+ 	*new_hw_ste_arr_sz = nic_matcher->num_of_builders;
+ 	last_ste = ste_arr + DR_STE_SIZE * (nic_matcher->num_of_builders - 1);
+ 
+-	/* Due to a HW bug in some devices, modifying TTL on RX flows will
+-	 * cause an incorrect checksum calculation. In this case we will
+-	 * use a FW table to recalculate.
+-	 */
+-	if (dmn->type == MLX5DR_DOMAIN_TYPE_FDB &&
+-	    rx_rule && recalc_cs_required && dest_action) {
++	if (recalc_cs_required && dest_action) {
+ 		ret = dr_action_handle_cs_recalc(dmn, dest_action, &attr.final_icm_addr);
+ 		if (ret) {
+ 			mlx5dr_err(dmn,
+@@ -1562,12 +1589,6 @@ dr_action_modify_check_is_ttl_modify(const void *sw_action)
+ 	return sw_field == MLX5_ACTION_IN_FIELD_OUT_IP_TTL;
+ }
+ 
+-static bool dr_action_modify_ttl_ignore(struct mlx5dr_domain *dmn)
+-{
+-	return !mlx5dr_ste_supp_ttl_cs_recalc(&dmn->info.caps) &&
+-	       !MLX5_CAP_ESW_FLOWTABLE(dmn->mdev, fdb_ipv4_ttl_modify);
+-}
+-
+ static int dr_actions_convert_modify_header(struct mlx5dr_action *action,
+ 					    u32 max_hw_actions,
+ 					    u32 num_sw_actions,
+@@ -1579,6 +1600,7 @@ static int dr_actions_convert_modify_header(struct mlx5dr_action *action,
+ 	const struct mlx5dr_ste_action_modify_field *hw_dst_action_info;
+ 	const struct mlx5dr_ste_action_modify_field *hw_src_action_info;
+ 	struct mlx5dr_domain *dmn = action->rewrite->dmn;
++	__be64 *modify_ttl_sw_action = NULL;
+ 	int ret, i, hw_idx = 0;
+ 	__be64 *sw_action;
+ 	__be64 hw_action;
+@@ -1591,8 +1613,14 @@ static int dr_actions_convert_modify_header(struct mlx5dr_action *action,
+ 	action->rewrite->allow_rx = 1;
+ 	action->rewrite->allow_tx = 1;
+ 
+-	for (i = 0; i < num_sw_actions; i++) {
+-		sw_action = &sw_actions[i];
++	for (i = 0; i < num_sw_actions || modify_ttl_sw_action; i++) {
++		/* modify TTL is handled separately, as a last action */
++		if (i == num_sw_actions) {
++			sw_action = modify_ttl_sw_action;
++			modify_ttl_sw_action = NULL;
++		} else {
++			sw_action = &sw_actions[i];
++		}
+ 
+ 		ret = dr_action_modify_check_field_limitation(action,
+ 							      sw_action);
+@@ -1601,10 +1629,9 @@ static int dr_actions_convert_modify_header(struct mlx5dr_action *action,
+ 
+ 		if (!(*modify_ttl) &&
+ 		    dr_action_modify_check_is_ttl_modify(sw_action)) {
+-			if (dr_action_modify_ttl_ignore(dmn))
+-				continue;
+-
++			modify_ttl_sw_action = sw_action;
+ 			*modify_ttl = true;
++			continue;
+ 		}
+ 
+ 		/* Convert SW action to HW action */
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste_v0.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste_v0.c
+index 2d62950f7a29..134c8484c901 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste_v0.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_ste_v0.c
+@@ -419,7 +419,7 @@ dr_ste_v0_set_actions_tx(struct mlx5dr_domain *dmn,
+ 	 * encapsulation. The reason for that is that we support
+ 	 * modify headers for outer headers only
+ 	 */
+-	if (action_type_set[DR_ACTION_TYP_MODIFY_HDR]) {
++	if (action_type_set[DR_ACTION_TYP_MODIFY_HDR] && attr->modify_actions) {
+ 		dr_ste_v0_set_entry_type(last_ste, DR_STE_TYPE_MODIFY_PKT);
+ 		dr_ste_v0_set_rewrite_actions(last_ste,
+ 					      attr->modify_actions,
+@@ -511,7 +511,7 @@ dr_ste_v0_set_actions_rx(struct mlx5dr_domain *dmn,
+ 		}
+ 	}
+ 
+-	if (action_type_set[DR_ACTION_TYP_MODIFY_HDR]) {
++	if (action_type_set[DR_ACTION_TYP_MODIFY_HDR] && attr->modify_actions) {
+ 		if (dr_ste_v0_get_entry_type(last_ste) == DR_STE_TYPE_MODIFY_PKT)
+ 			dr_ste_v0_arr_init_next(&last_ste,
+ 						added_stes,
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-mlx5-drain-fw_reset-when-removing-device.patch b/queue-5.17/net-mlx5-drain-fw_reset-when-removing-device.patch
new file mode 100644
index 0000000..9d903c4
--- /dev/null
+++ b/queue-5.17/net-mlx5-drain-fw_reset-when-removing-device.patch
@@ -0,0 +1,128 @@
+From 599bfae0c914e96ca4099df361d8342b9c7987b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Apr 2022 10:47:36 +0300
+Subject: net/mlx5: Drain fw_reset when removing device
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 16d42d313350946f4b9a8b74a13c99f0461a6572 ]
+
+In case fw sync reset is called in parallel to device removal, device
+might stuck in the following deadlock:
+         CPU 0                        CPU 1
+         -----                        -----
+                                  remove_one
+                                   uninit_one (locks intf_state_mutex)
+mlx5_sync_reset_now_event()
+work in fw_reset->wq.
+ mlx5_enter_error_state()
+  mutex_lock (intf_state_mutex)
+                                   cleanup_once
+                                    fw_reset_cleanup()
+                                     destroy_workqueue(fw_reset->wq)
+
+Drain the fw_reset WQ, and make sure no new work is being queued, before
+entering uninit_one().
+The Drain is done before devlink_unregister() since fw_reset, in some
+flows, is using devlink API devlink_remote_reload_actions_performed().
+
+Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/fw_reset.c    | 25 ++++++++++++++++---
+ .../ethernet/mellanox/mlx5/core/fw_reset.h    |  1 +
+ .../net/ethernet/mellanox/mlx5/core/main.c    |  4 +++
+ 3 files changed, 27 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+index 862f5b7cb210..1c771287bee5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+@@ -8,7 +8,8 @@
+ enum {
+ 	MLX5_FW_RESET_FLAGS_RESET_REQUESTED,
+ 	MLX5_FW_RESET_FLAGS_NACK_RESET_REQUEST,
+-	MLX5_FW_RESET_FLAGS_PENDING_COMP
++	MLX5_FW_RESET_FLAGS_PENDING_COMP,
++	MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS
+ };
+ 
+ struct mlx5_fw_reset {
+@@ -165,7 +166,10 @@ static void poll_sync_reset(struct timer_list *t)
+ 
+ 	if (fatal_error) {
+ 		mlx5_core_warn(dev, "Got Device Reset\n");
+-		queue_work(fw_reset->wq, &fw_reset->reset_reload_work);
++		if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, &fw_reset->reset_flags))
++			queue_work(fw_reset->wq, &fw_reset->reset_reload_work);
++		else
++			mlx5_core_err(dev, "Device is being removed, Drop new reset work\n");
+ 		return;
+ 	}
+ 
+@@ -390,9 +394,12 @@ static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long acti
+ 	struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb);
+ 	struct mlx5_eqe *eqe = data;
+ 
++	if (test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, &fw_reset->reset_flags))
++		return NOTIFY_DONE;
++
+ 	switch (eqe->sub_type) {
+ 	case MLX5_GENERAL_SUBTYPE_FW_LIVE_PATCH_EVENT:
+-			queue_work(fw_reset->wq, &fw_reset->fw_live_patch_work);
++		queue_work(fw_reset->wq, &fw_reset->fw_live_patch_work);
+ 		break;
+ 	case MLX5_GENERAL_SUBTYPE_PCI_SYNC_FOR_FW_UPDATE_EVENT:
+ 		mlx5_sync_reset_events_handle(fw_reset, eqe);
+@@ -436,6 +443,18 @@ void mlx5_fw_reset_events_stop(struct mlx5_core_dev *dev)
+ 	mlx5_eq_notifier_unregister(dev, &dev->priv.fw_reset->nb);
+ }
+ 
++void mlx5_drain_fw_reset(struct mlx5_core_dev *dev)
++{
++	struct mlx5_fw_reset *fw_reset = dev->priv.fw_reset;
++
++	set_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, &fw_reset->reset_flags);
++	cancel_work_sync(&fw_reset->fw_live_patch_work);
++	cancel_work_sync(&fw_reset->reset_request_work);
++	cancel_work_sync(&fw_reset->reset_reload_work);
++	cancel_work_sync(&fw_reset->reset_now_work);
++	cancel_work_sync(&fw_reset->reset_abort_work);
++}
++
+ int mlx5_fw_reset_init(struct mlx5_core_dev *dev)
+ {
+ 	struct mlx5_fw_reset *fw_reset = kzalloc(sizeof(*fw_reset), GFP_KERNEL);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h
+index 7761ee5fc7d0..372046e173e7 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h
+@@ -15,6 +15,7 @@ int mlx5_fw_reset_set_live_patch(struct mlx5_core_dev *dev);
+ int mlx5_fw_reset_wait_reset_done(struct mlx5_core_dev *dev);
+ void mlx5_fw_reset_events_start(struct mlx5_core_dev *dev);
+ void mlx5_fw_reset_events_stop(struct mlx5_core_dev *dev);
++void mlx5_drain_fw_reset(struct mlx5_core_dev *dev);
+ int mlx5_fw_reset_init(struct mlx5_core_dev *dev);
+ void mlx5_fw_reset_cleanup(struct mlx5_core_dev *dev);
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index f1437b6d4418..4e49dca94bc3 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -1628,6 +1628,10 @@ static void remove_one(struct pci_dev *pdev)
+ 	struct mlx5_core_dev *dev  = pci_get_drvdata(pdev);
+ 	struct devlink *devlink = priv_to_devlink(dev);
+ 
++	/* mlx5_drain_fw_reset() is using devlink APIs. Hence, we must drain
++	 * fw_reset before unregistering the devlink.
++	 */
++	mlx5_drain_fw_reset(dev);
+ 	devlink_unregister(devlink);
+ 	mlx5_crdump_disable(dev);
+ 	mlx5_drain_health_wq(dev);
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-mlx5-initialize-flow-steering-during-driver-prob.patch b/queue-5.17/net-mlx5-initialize-flow-steering-during-driver-prob.patch
new file mode 100644
index 0000000..14c05af
--- /dev/null
+++ b/queue-5.17/net-mlx5-initialize-flow-steering-during-driver-prob.patch
@@ -0,0 +1,397 @@
+From a63eef70b4ed8584c74752ee6d38451d1982a731 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Mar 2022 14:45:58 +0200
+Subject: net/mlx5: Initialize flow steering during driver probe
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit b33886971dbc4a86d1ec5369a2aaefc60a7cd72d ]
+
+Currently, software objects of flow steering are created and destroyed
+during reload flow. In case a device is unloaded, the following error
+is printed during grace period:
+
+ mlx5_core 0000:00:0b.0: mlx5_fw_fatal_reporter_err_work:690:(pid 95):
+    Driver is in error state. Unloading
+
+As a solution to fix use-after-free bugs, where we try to access
+these objects, when reading the value of flow_steering_mode devlink
+param[1], let's split flow steering creation and destruction into two
+routines:
+    * init and cleanup: memory, cache, and pools allocation/free.
+    * create and destroy: namespaces initialization and cleanup.
+
+While at it, re-order the cleanup function to mirror the init function.
+
+[1]
+Kasan trace:
+
+[  385.119849 ] BUG: KASAN: use-after-free in mlx5_devlink_fs_mode_get+0x3b/0xa0
+[  385.119849 ] Read of size 4 at addr ffff888104b79308 by task bash/291
+[  385.119849 ]
+[  385.119849 ] CPU: 1 PID: 291 Comm: bash Not tainted 5.17.0-rc1+ #2
+[  385.119849 ] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-2.fc32 04/01/2014
+[  385.119849 ] Call Trace:
+[  385.119849 ]  <TASK>
+[  385.119849 ]  dump_stack_lvl+0x6e/0x91
+[  385.119849 ]  print_address_description.constprop.0+0x1f/0x160
+[  385.119849 ]  ? mlx5_devlink_fs_mode_get+0x3b/0xa0
+[  385.119849 ]  ? mlx5_devlink_fs_mode_get+0x3b/0xa0
+[  385.119849 ]  kasan_report.cold+0x83/0xdf
+[  385.119849 ]  ? devlink_param_notify+0x20/0x190
+[  385.119849 ]  ? mlx5_devlink_fs_mode_get+0x3b/0xa0
+[  385.119849 ]  mlx5_devlink_fs_mode_get+0x3b/0xa0
+[  385.119849 ]  devlink_nl_param_fill+0x18a/0xa50
+[  385.119849 ]  ? _raw_spin_lock_irqsave+0x8d/0xe0
+[  385.119849 ]  ? devlink_flash_update_timeout_notify+0xf0/0xf0
+[  385.119849 ]  ? __wake_up_common+0x4b/0x1e0
+[  385.119849 ]  ? preempt_count_sub+0x14/0xc0
+[  385.119849 ]  ? _raw_spin_unlock_irqrestore+0x28/0x40
+[  385.119849 ]  ? __wake_up_common_lock+0xe3/0x140
+[  385.119849 ]  ? __wake_up_common+0x1e0/0x1e0
+[  385.119849 ]  ? __sanitizer_cov_trace_const_cmp8+0x27/0x80
+[  385.119849 ]  ? __rcu_read_unlock+0x48/0x70
+[  385.119849 ]  ? kasan_unpoison+0x23/0x50
+[  385.119849 ]  ? __kasan_slab_alloc+0x2c/0x80
+[  385.119849 ]  ? memset+0x20/0x40
+[  385.119849 ]  ? __sanitizer_cov_trace_const_cmp4+0x25/0x80
+[  385.119849 ]  devlink_param_notify+0xce/0x190
+[  385.119849 ]  devlink_unregister+0x92/0x2b0
+[  385.119849 ]  remove_one+0x41/0x140
+[  385.119849 ]  pci_device_remove+0x68/0x140
+[  385.119849 ]  ? pcibios_free_irq+0x10/0x10
+[  385.119849 ]  __device_release_driver+0x294/0x3f0
+[  385.119849 ]  device_driver_detach+0x82/0x130
+[  385.119849 ]  unbind_store+0x193/0x1b0
+[  385.119849 ]  ? subsys_interface_unregister+0x270/0x270
+[  385.119849 ]  drv_attr_store+0x4e/0x70
+[  385.119849 ]  ? drv_attr_show+0x60/0x60
+[  385.119849 ]  sysfs_kf_write+0xa7/0xc0
+[  385.119849 ]  kernfs_fop_write_iter+0x23a/0x2f0
+[  385.119849 ]  ? sysfs_kf_bin_read+0x160/0x160
+[  385.119849 ]  new_sync_write+0x311/0x430
+[  385.119849 ]  ? new_sync_read+0x480/0x480
+[  385.119849 ]  ? _raw_spin_lock+0x87/0xe0
+[  385.119849 ]  ? __sanitizer_cov_trace_cmp4+0x25/0x80
+[  385.119849 ]  ? security_file_permission+0x94/0xa0
+[  385.119849 ]  vfs_write+0x4c7/0x590
+[  385.119849 ]  ksys_write+0xf6/0x1e0
+[  385.119849 ]  ? __x64_sys_read+0x50/0x50
+[  385.119849 ]  ? fpregs_assert_state_consistent+0x99/0xa0
+[  385.119849 ]  do_syscall_64+0x3d/0x90
+[  385.119849 ]  entry_SYSCALL_64_after_hwframe+0x44/0xae
+[  385.119849 ] RIP: 0033:0x7fc36ef38504
+[  385.119849 ] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f
+80 00 00 00 00 48 8d 05 f9 61 0d 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f
+05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 49 89 d4 55 48 89 f5 53
+[  385.119849 ] RSP: 002b:00007ffde0ff3d08 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
+[  385.119849 ] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007fc36ef38504
+[  385.119849 ] RDX: 000000000000000c RSI: 00007fc370521040 RDI: 0000000000000001
+[  385.119849 ] RBP: 00007fc370521040 R08: 00007fc36f00b8c0 R09: 00007fc36ee4b740
+[  385.119849 ] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc36f00a760
+[  385.119849 ] R13: 000000000000000c R14: 00007fc36f005760 R15: 000000000000000c
+[  385.119849 ]  </TASK>
+[  385.119849 ]
+[  385.119849 ] Allocated by task 65:
+[  385.119849 ]  kasan_save_stack+0x1e/0x40
+[  385.119849 ]  __kasan_kmalloc+0x81/0xa0
+[  385.119849 ]  mlx5_init_fs+0x11b/0x1160
+[  385.119849 ]  mlx5_load+0x13c/0x220
+[  385.119849 ]  mlx5_load_one+0xda/0x160
+[  385.119849 ]  mlx5_recover_device+0xb8/0x100
+[  385.119849 ]  mlx5_health_try_recover+0x2f9/0x3a1
+[  385.119849 ]  devlink_health_reporter_recover+0x75/0x100
+[  385.119849 ]  devlink_health_report+0x26c/0x4b0
+[  385.275909 ]  mlx5_fw_fatal_reporter_err_work+0x11e/0x1b0
+[  385.275909 ]  process_one_work+0x520/0x970
+[  385.275909 ]  worker_thread+0x378/0x950
+[  385.275909 ]  kthread+0x1bb/0x200
+[  385.275909 ]  ret_from_fork+0x1f/0x30
+[  385.275909 ]
+[  385.275909 ] Freed by task 65:
+[  385.275909 ]  kasan_save_stack+0x1e/0x40
+[  385.275909 ]  kasan_set_track+0x21/0x30
+[  385.275909 ]  kasan_set_free_info+0x20/0x30
+[  385.275909 ]  __kasan_slab_free+0xfc/0x140
+[  385.275909 ]  kfree+0xa5/0x3b0
+[  385.275909 ]  mlx5_unload+0x2e/0xb0
+[  385.275909 ]  mlx5_unload_one+0x86/0xb0
+[  385.275909 ]  mlx5_fw_fatal_reporter_err_work.cold+0xca/0xcf
+[  385.275909 ]  process_one_work+0x520/0x970
+[  385.275909 ]  worker_thread+0x378/0x950
+[  385.275909 ]  kthread+0x1bb/0x200
+[  385.275909 ]  ret_from_fork+0x1f/0x30
+[  385.275909 ]
+[  385.275909 ] The buggy address belongs to the object at ffff888104b79300
+[  385.275909 ]  which belongs to the cache kmalloc-128 of size 128
+[  385.275909 ] The buggy address is located 8 bytes inside of
+[  385.275909 ]  128-byte region [ffff888104b79300, ffff888104b79380)
+[  385.275909 ] The buggy address belongs to the page:
+[  385.275909 ] page:00000000de44dd39 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104b78
+[  385.275909 ] head:00000000de44dd39 order:1 compound_mapcount:0
+[  385.275909 ] flags: 0x8000000000010200(slab|head|zone=2)
+[  385.275909 ] raw: 8000000000010200 0000000000000000 dead000000000122 ffff8881000428c0
+[  385.275909 ] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
+[  385.275909 ] page dumped because: kasan: bad access detected
+[  385.275909 ]
+[  385.275909 ] Memory state around the buggy address:
+[  385.275909 ]  ffff888104b79200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc
+[  385.275909 ]  ffff888104b79280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[  385.275909 ] >ffff888104b79300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[  385.275909 ]                       ^
+[  385.275909 ]  ffff888104b79380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[  385.275909 ]  ffff888104b79400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[  385.275909 ]]
+
+Fixes: e890acd5ff18 ("net/mlx5: Add devlink flow_steering_mode parameter")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/fs_core.c | 131 ++++++++++--------
+ .../net/ethernet/mellanox/mlx5/core/fs_core.h |   6 +-
+ .../net/ethernet/mellanox/mlx5/core/main.c    |  15 +-
+ 3 files changed, 91 insertions(+), 61 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index 537c82b9aa53..b6f58d16d145 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -2656,28 +2656,6 @@ static void cleanup_root_ns(struct mlx5_flow_root_namespace *root_ns)
+ 	clean_tree(&root_ns->ns.node);
+ }
+ 
+-void mlx5_cleanup_fs(struct mlx5_core_dev *dev)
+-{
+-	struct mlx5_flow_steering *steering = dev->priv.steering;
+-
+-	cleanup_root_ns(steering->root_ns);
+-	cleanup_root_ns(steering->fdb_root_ns);
+-	steering->fdb_root_ns = NULL;
+-	kfree(steering->fdb_sub_ns);
+-	steering->fdb_sub_ns = NULL;
+-	cleanup_root_ns(steering->port_sel_root_ns);
+-	cleanup_root_ns(steering->sniffer_rx_root_ns);
+-	cleanup_root_ns(steering->sniffer_tx_root_ns);
+-	cleanup_root_ns(steering->rdma_rx_root_ns);
+-	cleanup_root_ns(steering->rdma_tx_root_ns);
+-	cleanup_root_ns(steering->egress_root_ns);
+-	mlx5_cleanup_fc_stats(dev);
+-	kmem_cache_destroy(steering->ftes_cache);
+-	kmem_cache_destroy(steering->fgs_cache);
+-	mlx5_ft_pool_destroy(dev);
+-	kfree(steering);
+-}
+-
+ static int init_sniffer_tx_root_ns(struct mlx5_flow_steering *steering)
+ {
+ 	struct fs_prio *prio;
+@@ -3063,42 +3041,27 @@ static int init_egress_root_ns(struct mlx5_flow_steering *steering)
+ 	return err;
+ }
+ 
+-int mlx5_init_fs(struct mlx5_core_dev *dev)
++void mlx5_fs_core_cleanup(struct mlx5_core_dev *dev)
+ {
+-	struct mlx5_flow_steering *steering;
+-	int err = 0;
+-
+-	err = mlx5_init_fc_stats(dev);
+-	if (err)
+-		return err;
+-
+-	err = mlx5_ft_pool_init(dev);
+-	if (err)
+-		return err;
+-
+-	steering = kzalloc(sizeof(*steering), GFP_KERNEL);
+-	if (!steering) {
+-		err = -ENOMEM;
+-		goto err;
+-	}
+-
+-	steering->dev = dev;
+-	dev->priv.steering = steering;
++	struct mlx5_flow_steering *steering = dev->priv.steering;
+ 
+-	if (mlx5_fs_dr_is_supported(dev))
+-		steering->mode = MLX5_FLOW_STEERING_MODE_SMFS;
+-	else
+-		steering->mode = MLX5_FLOW_STEERING_MODE_DMFS;
++	cleanup_root_ns(steering->root_ns);
++	cleanup_root_ns(steering->fdb_root_ns);
++	steering->fdb_root_ns = NULL;
++	kfree(steering->fdb_sub_ns);
++	steering->fdb_sub_ns = NULL;
++	cleanup_root_ns(steering->port_sel_root_ns);
++	cleanup_root_ns(steering->sniffer_rx_root_ns);
++	cleanup_root_ns(steering->sniffer_tx_root_ns);
++	cleanup_root_ns(steering->rdma_rx_root_ns);
++	cleanup_root_ns(steering->rdma_tx_root_ns);
++	cleanup_root_ns(steering->egress_root_ns);
++}
+ 
+-	steering->fgs_cache = kmem_cache_create("mlx5_fs_fgs",
+-						sizeof(struct mlx5_flow_group), 0,
+-						0, NULL);
+-	steering->ftes_cache = kmem_cache_create("mlx5_fs_ftes", sizeof(struct fs_fte), 0,
+-						 0, NULL);
+-	if (!steering->ftes_cache || !steering->fgs_cache) {
+-		err = -ENOMEM;
+-		goto err;
+-	}
++int mlx5_fs_core_init(struct mlx5_core_dev *dev)
++{
++	struct mlx5_flow_steering *steering = dev->priv.steering;
++	int err = 0;
+ 
+ 	if ((((MLX5_CAP_GEN(dev, port_type) == MLX5_CAP_PORT_TYPE_ETH) &&
+ 	      (MLX5_CAP_GEN(dev, nic_flow_table))) ||
+@@ -3157,8 +3120,64 @@ int mlx5_init_fs(struct mlx5_core_dev *dev)
+ 	}
+ 
+ 	return 0;
++
++err:
++	mlx5_fs_core_cleanup(dev);
++	return err;
++}
++
++void mlx5_fs_core_free(struct mlx5_core_dev *dev)
++{
++	struct mlx5_flow_steering *steering = dev->priv.steering;
++
++	kmem_cache_destroy(steering->ftes_cache);
++	kmem_cache_destroy(steering->fgs_cache);
++	kfree(steering);
++	mlx5_ft_pool_destroy(dev);
++	mlx5_cleanup_fc_stats(dev);
++}
++
++int mlx5_fs_core_alloc(struct mlx5_core_dev *dev)
++{
++	struct mlx5_flow_steering *steering;
++	int err = 0;
++
++	err = mlx5_init_fc_stats(dev);
++	if (err)
++		return err;
++
++	err = mlx5_ft_pool_init(dev);
++	if (err)
++		goto err;
++
++	steering = kzalloc(sizeof(*steering), GFP_KERNEL);
++	if (!steering) {
++		err = -ENOMEM;
++		goto err;
++	}
++
++	steering->dev = dev;
++	dev->priv.steering = steering;
++
++	if (mlx5_fs_dr_is_supported(dev))
++		steering->mode = MLX5_FLOW_STEERING_MODE_SMFS;
++	else
++		steering->mode = MLX5_FLOW_STEERING_MODE_DMFS;
++
++	steering->fgs_cache = kmem_cache_create("mlx5_fs_fgs",
++						sizeof(struct mlx5_flow_group), 0,
++						0, NULL);
++	steering->ftes_cache = kmem_cache_create("mlx5_fs_ftes", sizeof(struct fs_fte), 0,
++						 0, NULL);
++	if (!steering->ftes_cache || !steering->fgs_cache) {
++		err = -ENOMEM;
++		goto err;
++	}
++
++	return 0;
++
+ err:
+-	mlx5_cleanup_fs(dev);
++	mlx5_fs_core_free(dev);
+ 	return err;
+ }
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+index 5469b08d635f..6366bf50a564 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+@@ -293,8 +293,10 @@ int mlx5_flow_namespace_set_peer(struct mlx5_flow_root_namespace *ns,
+ int mlx5_flow_namespace_set_mode(struct mlx5_flow_namespace *ns,
+ 				 enum mlx5_flow_steering_mode mode);
+ 
+-int mlx5_init_fs(struct mlx5_core_dev *dev);
+-void mlx5_cleanup_fs(struct mlx5_core_dev *dev);
++int mlx5_fs_core_alloc(struct mlx5_core_dev *dev);
++void mlx5_fs_core_free(struct mlx5_core_dev *dev);
++int mlx5_fs_core_init(struct mlx5_core_dev *dev);
++void mlx5_fs_core_cleanup(struct mlx5_core_dev *dev);
+ 
+ int mlx5_fs_egress_acls_init(struct mlx5_core_dev *dev, int total_vports);
+ void mlx5_fs_egress_acls_cleanup(struct mlx5_core_dev *dev);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index bba72b220cc3..f1437b6d4418 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -939,6 +939,12 @@ static int mlx5_init_once(struct mlx5_core_dev *dev)
+ 		goto err_sf_table_cleanup;
+ 	}
+ 
++	err = mlx5_fs_core_alloc(dev);
++	if (err) {
++		mlx5_core_err(dev, "Failed to alloc flow steering\n");
++		goto err_fs;
++	}
++
+ 	dev->dm = mlx5_dm_create(dev);
+ 	if (IS_ERR(dev->dm))
+ 		mlx5_core_warn(dev, "Failed to init device memory%d\n", err);
+@@ -949,6 +955,8 @@ static int mlx5_init_once(struct mlx5_core_dev *dev)
+ 
+ 	return 0;
+ 
++err_fs:
++	mlx5_sf_table_cleanup(dev);
+ err_sf_table_cleanup:
+ 	mlx5_sf_hw_table_cleanup(dev);
+ err_sf_hw_table_cleanup:
+@@ -986,6 +994,7 @@ static void mlx5_cleanup_once(struct mlx5_core_dev *dev)
+ 	mlx5_hv_vhca_destroy(dev->hv_vhca);
+ 	mlx5_fw_tracer_destroy(dev->tracer);
+ 	mlx5_dm_cleanup(dev);
++	mlx5_fs_core_free(dev);
+ 	mlx5_sf_table_cleanup(dev);
+ 	mlx5_sf_hw_table_cleanup(dev);
+ 	mlx5_vhca_event_cleanup(dev);
+@@ -1192,7 +1201,7 @@ static int mlx5_load(struct mlx5_core_dev *dev)
+ 		goto err_tls_start;
+ 	}
+ 
+-	err = mlx5_init_fs(dev);
++	err = mlx5_fs_core_init(dev);
+ 	if (err) {
+ 		mlx5_core_err(dev, "Failed to init flow steering\n");
+ 		goto err_fs;
+@@ -1237,7 +1246,7 @@ static int mlx5_load(struct mlx5_core_dev *dev)
+ err_vhca:
+ 	mlx5_vhca_event_stop(dev);
+ err_set_hca:
+-	mlx5_cleanup_fs(dev);
++	mlx5_fs_core_cleanup(dev);
+ err_fs:
+ 	mlx5_accel_tls_cleanup(dev);
+ err_tls_start:
+@@ -1266,7 +1275,7 @@ static void mlx5_unload(struct mlx5_core_dev *dev)
+ 	mlx5_ec_cleanup(dev);
+ 	mlx5_sf_hw_table_destroy(dev);
+ 	mlx5_vhca_event_stop(dev);
+-	mlx5_cleanup_fs(dev);
++	mlx5_fs_core_cleanup(dev);
+ 	mlx5_accel_ipsec_cleanup(dev);
+ 	mlx5_accel_tls_cleanup(dev);
+ 	mlx5_fpga_device_stop(dev);
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-mlx5e-block-rx-gro-hw-feature-in-switchdev-mode.patch b/queue-5.17/net-mlx5e-block-rx-gro-hw-feature-in-switchdev-mode.patch
new file mode 100644
index 0000000..84d5d38
--- /dev/null
+++ b/queue-5.17/net-mlx5e-block-rx-gro-hw-feature-in-switchdev-mode.patch
@@ -0,0 +1,41 @@
+From 597bbccebfc6be8c463a77e0f5fe6d39dfe36d2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Apr 2022 17:29:08 +0300
+Subject: net/mlx5e: Block rx-gro-hw feature in switchdev mode
+
+From: Aya Levin <ayal@nvidia.com>
+
+[ Upstream commit 15a5078cab30d7aa02ad14bfadebf247d95fc239 ]
+
+When the driver is in switchdev mode and rx-gro-hw is set, the RQ needs
+special CQE handling. Till then, block setting of rx-gro-hw feature in
+switchdev mode, to avoid failure while setting the feature due to
+failure while opening the RQ.
+
+Fixes: f97d5c2a453e ("net/mlx5e: Add handle SHAMPO cqe support")
+Signed-off-by: Aya Levin <ayal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 169e3524bb1c..d468daa7dc20 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3829,6 +3829,10 @@ static netdev_features_t mlx5e_fix_uplink_rep_features(struct net_device *netdev
+ 	if (netdev->features & NETIF_F_NTUPLE)
+ 		netdev_warn(netdev, "Disabling ntuple, not supported in switchdev mode\n");
+ 
++	features &= ~NETIF_F_GRO_HW;
++	if (netdev->features & NETIF_F_GRO_HW)
++		netdev_warn(netdev, "Disabling HW_GRO, not supported in switchdev mode\n");
++
+ 	return features;
+ }
+ 
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-mlx5e-properly-block-hw-gro-when-xdp-is-enabled.patch b/queue-5.17/net-mlx5e-properly-block-hw-gro-when-xdp-is-enabled.patch
new file mode 100644
index 0000000..e61e029
--- /dev/null
+++ b/queue-5.17/net-mlx5e-properly-block-hw-gro-when-xdp-is-enabled.patch
@@ -0,0 +1,52 @@
+From 583ffb01346f07604fe03b6fb417bd466d872c24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Apr 2022 18:54:26 +0300
+Subject: net/mlx5e: Properly block HW GRO when XDP is enabled
+
+From: Maxim Mikityanskiy <maximmi@nvidia.com>
+
+[ Upstream commit b0617e7b35001c92c8fa777e1a095d3e693813df ]
+
+HW GRO is incompatible and mutually exclusive with XDP and XSK. However,
+the needed checks are only made when enabling XDP. If HW GRO is enabled
+when XDP is already active, the command will succeed, and XDP will be
+skipped in the data path, although still enabled.
+
+This commit fixes the bug by checking the XDP and XSK status in
+mlx5e_fix_features and disabling HW GRO if XDP is enabled.
+
+Fixes: 83439f3c37aa ("net/mlx5e: Add HW-GRO offload")
+Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 1f8fc8d77bc3..4b83dd05afcd 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3870,6 +3870,18 @@ static netdev_features_t mlx5e_fix_features(struct net_device *netdev,
+ 			netdev_warn(netdev, "LRO is incompatible with XDP\n");
+ 			features &= ~NETIF_F_LRO;
+ 		}
++		if (features & NETIF_F_GRO_HW) {
++			netdev_warn(netdev, "HW GRO is incompatible with XDP\n");
++			features &= ~NETIF_F_GRO_HW;
++		}
++	}
++
++	if (priv->xsk.refcnt) {
++		if (features & NETIF_F_GRO_HW) {
++			netdev_warn(netdev, "HW GRO is incompatible with AF_XDP (%u XSKs are active)\n",
++				    priv->xsk.refcnt);
++			features &= ~NETIF_F_GRO_HW;
++		}
+ 	}
+ 
+ 	if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS)) {
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-mlx5e-properly-block-lro-when-xdp-is-enabled.patch b/queue-5.17/net-mlx5e-properly-block-lro-when-xdp-is-enabled.patch
new file mode 100644
index 0000000..e5a91af
--- /dev/null
+++ b/queue-5.17/net-mlx5e-properly-block-lro-when-xdp-is-enabled.patch
@@ -0,0 +1,47 @@
+From f20ddffd8d0a355eef3c43fbbf2c46125b135ae5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Apr 2022 18:37:03 +0300
+Subject: net/mlx5e: Properly block LRO when XDP is enabled
+
+From: Maxim Mikityanskiy <maximmi@nvidia.com>
+
+[ Upstream commit cf6e34c8c22fba66bd21244b95ea47e235f68974 ]
+
+LRO is incompatible and mutually exclusive with XDP. However, the needed
+checks are only made when enabling XDP. If LRO is enabled when XDP is
+already active, the command will succeed, and XDP will be skipped in the
+data path, although still enabled.
+
+This commit fixes the bug by checking the XDP status in
+mlx5e_fix_features and disabling LRO if XDP is enabled.
+
+Fixes: 86994156c736 ("net/mlx5e: XDP fast RX drop bpf programs support")
+Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index d468daa7dc20..1f8fc8d77bc3 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3865,6 +3865,13 @@ static netdev_features_t mlx5e_fix_features(struct net_device *netdev,
+ 		}
+ 	}
+ 
++	if (params->xdp_prog) {
++		if (features & NETIF_F_LRO) {
++			netdev_warn(netdev, "LRO is incompatible with XDP\n");
++			features &= ~NETIF_F_LRO;
++		}
++	}
++
+ 	if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS)) {
+ 		features &= ~NETIF_F_RXHASH;
+ 		if (netdev->features & NETIF_F_RXHASH)
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-mlx5e-remove-hw-gro-from-reported-features.patch b/queue-5.17/net-mlx5e-remove-hw-gro-from-reported-features.patch
new file mode 100644
index 0000000..52743f9
--- /dev/null
+++ b/queue-5.17/net-mlx5e-remove-hw-gro-from-reported-features.patch
@@ -0,0 +1,39 @@
+From b0a858df9ac13ae4c22a1f85eeefd1b72fa84ee9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Apr 2022 15:50:42 +0300
+Subject: net/mlx5e: Remove HW-GRO from reported features
+
+From: Gal Pressman <gal@nvidia.com>
+
+[ Upstream commit 6bbd723035badafe4a8eb17ccdecd96eae7a96d5 ]
+
+We got reports of certain HW-GRO flows causing kernel call traces, which
+might be related to firmware. To be on the safe side, disable the
+feature for now and re-enable it once a driver/firmware fix is found.
+
+Fixes: 83439f3c37aa ("net/mlx5e: Add HW-GRO offload")
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 4b83dd05afcd..3500faf08671 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -4828,10 +4828,6 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
+ 	netdev->hw_features      |= NETIF_F_HW_VLAN_CTAG_FILTER;
+ 	netdev->hw_features      |= NETIF_F_HW_VLAN_STAG_TX;
+ 
+-	if (!!MLX5_CAP_GEN(mdev, shampo) &&
+-	    mlx5e_check_fragmented_striding_rq_cap(mdev))
+-		netdev->hw_features    |= NETIF_F_GRO_HW;
+-
+ 	if (mlx5e_tunnel_any_tx_proto_supported(mdev)) {
+ 		netdev->hw_enc_features |= NETIF_F_HW_CSUM;
+ 		netdev->hw_enc_features |= NETIF_F_TSO;
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-qla3xxx-fix-a-test-in-ql_reset_work.patch b/queue-5.17/net-qla3xxx-fix-a-test-in-ql_reset_work.patch
new file mode 100644
index 0000000..f6f8800
--- /dev/null
+++ b/queue-5.17/net-qla3xxx-fix-a-test-in-ql_reset_work.patch
@@ -0,0 +1,48 @@
+From 39b6f8ba9533de8205e9a3f4151b0abafdca365b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 May 2022 20:07:02 +0200
+Subject: net/qla3xxx: Fix a test in ql_reset_work()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 5361448e45fac6fb96738df748229432a62d78b6 ]
+
+test_bit() tests if one bit is set or not.
+Here the logic seems to check of bit QL_RESET_PER_SCSI (i.e. 4) OR bit
+QL_RESET_START (i.e. 3) is set.
+
+In fact, it checks if bit 7 (4 | 3 = 7) is set, that is to say
+QL_ADAPTER_UP.
+
+This looks harmless, because this bit is likely be set, and when the
+ql_reset_work() delayed work is scheduled in ql3xxx_isr() (the only place
+that schedule this work), QL_RESET_START or QL_RESET_PER_SCSI is set.
+
+This has been spotted by smatch.
+
+Fixes: 5a4faa873782 ("[PATCH] qla3xxx NIC driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/80e73e33f390001d9c0140ffa9baddf6466a41a2.1652637337.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qla3xxx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
+index b30589a135c2..06f4d9a9e938 100644
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -3614,7 +3614,8 @@ static void ql_reset_work(struct work_struct *work)
+ 		qdev->mem_map_registers;
+ 	unsigned long hw_flags;
+ 
+-	if (test_bit((QL_RESET_PER_SCSI | QL_RESET_START), &qdev->flags)) {
++	if (test_bit(QL_RESET_PER_SCSI, &qdev->flags) ||
++	    test_bit(QL_RESET_START, &qdev->flags)) {
+ 		clear_bit(QL_LINK_MASTER, &qdev->flags);
+ 
+ 		/*
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-sched-act_pedit-sanitize-shift-argument-before-u.patch b/queue-5.17/net-sched-act_pedit-sanitize-shift-argument-before-u.patch
new file mode 100644
index 0000000..f3ece2a
--- /dev/null
+++ b/queue-5.17/net-sched-act_pedit-sanitize-shift-argument-before-u.patch
@@ -0,0 +1,84 @@
+From 253dcaab7f8f8f2ea29e8a0948f4b4b912bd2dc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 May 2022 11:27:06 +0200
+Subject: net/sched: act_pedit: sanitize shift argument before usage
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 4d42d54a7d6aa6d29221d3fd4f2ae9503e94f011 ]
+
+syzbot was able to trigger an Out-of-Bound on the pedit action:
+
+UBSAN: shift-out-of-bounds in net/sched/act_pedit.c:238:43
+shift exponent 1400735974 is too large for 32-bit type 'unsigned int'
+CPU: 0 PID: 3606 Comm: syz-executor151 Not tainted 5.18.0-rc5-syzkaller-00165-g810c2f0a3f86 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
+ ubsan_epilogue+0xb/0x50 lib/ubsan.c:151
+ __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x187 lib/ubsan.c:322
+ tcf_pedit_init.cold+0x1a/0x1f net/sched/act_pedit.c:238
+ tcf_action_init_1+0x414/0x690 net/sched/act_api.c:1367
+ tcf_action_init+0x530/0x8d0 net/sched/act_api.c:1432
+ tcf_action_add+0xf9/0x480 net/sched/act_api.c:1956
+ tc_ctl_action+0x346/0x470 net/sched/act_api.c:2015
+ rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5993
+ netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
+ netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
+ netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
+ netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1921
+ sock_sendmsg_nosec net/socket.c:705 [inline]
+ sock_sendmsg+0xcf/0x120 net/socket.c:725
+ ____sys_sendmsg+0x6e2/0x800 net/socket.c:2413
+ ___sys_sendmsg+0xf3/0x170 net/socket.c:2467
+ __sys_sendmsg+0xe5/0x1b0 net/socket.c:2496
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+RIP: 0033:0x7fe36e9e1b59
+Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007ffef796fe88 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe36e9e1b59
+RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003
+RBP: 00007fe36e9a5d00 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe36e9a5d90
+R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+ </TASK>
+
+The 'shift' field is not validated, and any value above 31 will
+trigger out-of-bounds. The issue predates the git history, but
+syzbot was able to trigger it only after the commit mentioned in
+the fixes tag, and this change only applies on top of such commit.
+
+Address the issue bounding the 'shift' value to the maximum allowed
+by the relevant operator.
+
+Reported-and-tested-by: syzbot+8ed8fc4c57e9dcf23ca6@syzkaller.appspotmail.com
+Fixes: 8b796475fd78 ("net/sched: act_pedit: really ensure the skb is writable")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_pedit.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index 0eaaf1f45de1..211c757bfc3c 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -232,6 +232,10 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
+ 	for (i = 0; i < p->tcfp_nkeys; ++i) {
+ 		u32 cur = p->tcfp_keys[i].off;
+ 
++		/* sanitize the shift value for any later use */
++		p->tcfp_keys[i].shift = min_t(size_t, BITS_PER_TYPE(int) - 1,
++					      p->tcfp_keys[i].shift);
++
+ 		/* The AT option can read a single byte, we can bound the actual
+ 		 * value with uchar max.
+ 		 */
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-stmmac-fix-missing-pci_disable_device-on-error-i.patch b/queue-5.17/net-stmmac-fix-missing-pci_disable_device-on-error-i.patch
new file mode 100644
index 0000000..3cecd0e
--- /dev/null
+++ b/queue-5.17/net-stmmac-fix-missing-pci_disable_device-on-error-i.patch
@@ -0,0 +1,46 @@
+From a1c583ea666642665252fe37010edfacf3b1d6e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 May 2022 11:13:16 +0800
+Subject: net: stmmac: fix missing pci_disable_device() on error in
+ stmmac_pci_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 0807ce0b010418a191e0e4009803b2d74c3245d5 ]
+
+Switch to using pcim_enable_device() to avoid missing pci_disable_device().
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20220510031316.1780409-1-yangyingliang@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+index fcf17d8a0494..644bb54f5f02 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+@@ -181,7 +181,7 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
+ 		return -ENOMEM;
+ 
+ 	/* Enable pci device */
+-	ret = pci_enable_device(pdev);
++	ret = pcim_enable_device(pdev);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n",
+ 			__func__);
+@@ -241,8 +241,6 @@ static void stmmac_pci_remove(struct pci_dev *pdev)
+ 		pcim_iounmap_regions(pdev, BIT(i));
+ 		break;
+ 	}
+-
+-	pci_disable_device(pdev);
+ }
+ 
+ static int __maybe_unused stmmac_pci_suspend(struct device *dev)
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-systemport-fix-an-error-handling-path-in-bcm_sys.patch b/queue-5.17/net-systemport-fix-an-error-handling-path-in-bcm_sys.patch
new file mode 100644
index 0000000..446321d
--- /dev/null
+++ b/queue-5.17/net-systemport-fix-an-error-handling-path-in-bcm_sys.patch
@@ -0,0 +1,44 @@
+From ac5391cbdaf4b40666786587997e752785515f97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 May 2022 19:01:56 +0200
+Subject: net: systemport: Fix an error handling path in bcm_sysport_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ef6b1cd11962aec21c58d137006ab122dbc8d6fd ]
+
+if devm_clk_get_optional() fails, we still need to go through the error
+handling path.
+
+Add the missing goto.
+
+Fixes: 6328a126896ea ("net: systemport: Manage Wake-on-LAN clock")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/99d70634a81c229885ae9e4ee69b2035749f7edc.1652634040.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 60dde29974bf..df51be3cbe06 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2585,8 +2585,10 @@ static int bcm_sysport_probe(struct platform_device *pdev)
+ 		device_set_wakeup_capable(&pdev->dev, 1);
+ 
+ 	priv->wol_clk = devm_clk_get_optional(&pdev->dev, "sw_sysportwol");
+-	if (IS_ERR(priv->wol_clk))
+-		return PTR_ERR(priv->wol_clk);
++	if (IS_ERR(priv->wol_clk)) {
++		ret = PTR_ERR(priv->wol_clk);
++		goto err_deregister_fixed_link;
++	}
+ 
+ 	/* Set the needed headroom once and for all */
+ 	BUILD_BUG_ON(sizeof(struct bcm_tsb) != 8);
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-vmxnet3-fix-possible-null-pointer-dereference-in.patch b/queue-5.17/net-vmxnet3-fix-possible-null-pointer-dereference-in.patch
new file mode 100644
index 0000000..c85445a
--- /dev/null
+++ b/queue-5.17/net-vmxnet3-fix-possible-null-pointer-dereference-in.patch
@@ -0,0 +1,68 @@
+From 93fe6d07b5c67364675191b0fe6bdc54c567258e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 May 2022 13:07:11 +0800
+Subject: net: vmxnet3: fix possible NULL pointer dereference in
+ vmxnet3_rq_cleanup()
+
+From: Zixuan Fu <r33s3n6@gmail.com>
+
+[ Upstream commit edf410cb74dc612fd47ef5be319c5a0bcd6e6ccd ]
+
+In vmxnet3_rq_create(), when dma_alloc_coherent() fails,
+vmxnet3_rq_destroy() is called. It sets rq->rx_ring[i].base to NULL. Then
+vmxnet3_rq_create() returns an error to its callers mxnet3_rq_create_all()
+-> vmxnet3_change_mtu(). Then vmxnet3_change_mtu() calls
+vmxnet3_force_close() -> dev_close() in error handling code. And the driver
+calls vmxnet3_close() -> vmxnet3_quiesce_dev() -> vmxnet3_rq_cleanup_all()
+-> vmxnet3_rq_cleanup(). In vmxnet3_rq_cleanup(),
+rq->rx_ring[ring_idx].base is accessed, but this variable is NULL, causing
+a NULL pointer dereference.
+
+To fix this possible bug, an if statement is added to check whether
+rq->rx_ring[0].base is NULL in vmxnet3_rq_cleanup() and exit early if so.
+
+The error log in our fault-injection testing is shown as follows:
+
+[   65.220135] BUG: kernel NULL pointer dereference, address: 0000000000000008
+...
+[   65.222633] RIP: 0010:vmxnet3_rq_cleanup_all+0x396/0x4e0 [vmxnet3]
+...
+[   65.227977] Call Trace:
+...
+[   65.228262]  vmxnet3_quiesce_dev+0x80f/0x8a0 [vmxnet3]
+[   65.228580]  vmxnet3_close+0x2c4/0x3f0 [vmxnet3]
+[   65.228866]  __dev_close_many+0x288/0x350
+[   65.229607]  dev_close_many+0xa4/0x480
+[   65.231124]  dev_close+0x138/0x230
+[   65.231933]  vmxnet3_force_close+0x1f0/0x240 [vmxnet3]
+[   65.232248]  vmxnet3_change_mtu+0x75d/0x920 [vmxnet3]
+...
+
+Fixes: d1a890fa37f27 ("net: VMware virtual Ethernet NIC driver: vmxnet3")
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Zixuan Fu <r33s3n6@gmail.com>
+Link: https://lore.kernel.org/r/20220514050711.2636709-1-r33s3n6@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vmxnet3/vmxnet3_drv.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
+index 1154f1884212..93e8d119d45f 100644
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -1668,6 +1668,10 @@ vmxnet3_rq_cleanup(struct vmxnet3_rx_queue *rq,
+ 	u32 i, ring_idx;
+ 	struct Vmxnet3_RxDesc *rxd;
+ 
++	/* ring has already been cleaned up */
++	if (!rq->rx_ring[0].base)
++		return;
++
+ 	for (ring_idx = 0; ring_idx < 2; ring_idx++) {
+ 		for (i = 0; i < rq->rx_ring[ring_idx].size; i++) {
+ #ifdef __BIG_ENDIAN_BITFIELD
+-- 
+2.35.1
+
diff --git a/queue-5.17/net-vmxnet3-fix-possible-use-after-free-bugs-in-vmxn.patch b/queue-5.17/net-vmxnet3-fix-possible-use-after-free-bugs-in-vmxn.patch
new file mode 100644
index 0000000..7a96925
--- /dev/null
+++ b/queue-5.17/net-vmxnet3-fix-possible-use-after-free-bugs-in-vmxn.patch
@@ -0,0 +1,94 @@
+From bce0cc1981c0da5bcc087c346bc40e4487ca5406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 May 2022 13:06:56 +0800
+Subject: net: vmxnet3: fix possible use-after-free bugs in
+ vmxnet3_rq_alloc_rx_buf()
+
+From: Zixuan Fu <r33s3n6@gmail.com>
+
+[ Upstream commit 9e7fef9521e73ca8afd7da9e58c14654b02dfad8 ]
+
+In vmxnet3_rq_alloc_rx_buf(), when dma_map_single() fails, rbi->skb is
+freed immediately. Similarly, in another branch, when dma_map_page() fails,
+rbi->page is also freed. In the two cases, vmxnet3_rq_alloc_rx_buf()
+returns an error to its callers vmxnet3_rq_init() -> vmxnet3_rq_init_all()
+-> vmxnet3_activate_dev(). Then vmxnet3_activate_dev() calls
+vmxnet3_rq_cleanup_all() in error handling code, and rbi->skb or rbi->page
+are freed again in vmxnet3_rq_cleanup_all(), causing use-after-free bugs.
+
+To fix these possible bugs, rbi->skb and rbi->page should be cleared after
+they are freed.
+
+The error log in our fault-injection testing is shown as follows:
+
+[   14.319016] BUG: KASAN: use-after-free in consume_skb+0x2f/0x150
+...
+[   14.321586] Call Trace:
+...
+[   14.325357]  consume_skb+0x2f/0x150
+[   14.325671]  vmxnet3_rq_cleanup_all+0x33a/0x4e0 [vmxnet3]
+[   14.326150]  vmxnet3_activate_dev+0xb9d/0x2ca0 [vmxnet3]
+[   14.326616]  vmxnet3_open+0x387/0x470 [vmxnet3]
+...
+[   14.361675] Allocated by task 351:
+...
+[   14.362688]  __netdev_alloc_skb+0x1b3/0x6f0
+[   14.362960]  vmxnet3_rq_alloc_rx_buf+0x1b0/0x8d0 [vmxnet3]
+[   14.363317]  vmxnet3_activate_dev+0x3e3/0x2ca0 [vmxnet3]
+[   14.363661]  vmxnet3_open+0x387/0x470 [vmxnet3]
+...
+[   14.367309]
+[   14.367412] Freed by task 351:
+...
+[   14.368932]  __dev_kfree_skb_any+0xd2/0xe0
+[   14.369193]  vmxnet3_rq_alloc_rx_buf+0x71e/0x8d0 [vmxnet3]
+[   14.369544]  vmxnet3_activate_dev+0x3e3/0x2ca0 [vmxnet3]
+[   14.369883]  vmxnet3_open+0x387/0x470 [vmxnet3]
+[   14.370174]  __dev_open+0x28a/0x420
+[   14.370399]  __dev_change_flags+0x192/0x590
+[   14.370667]  dev_change_flags+0x7a/0x180
+[   14.370919]  do_setlink+0xb28/0x3570
+[   14.371150]  rtnl_newlink+0x1160/0x1740
+[   14.371399]  rtnetlink_rcv_msg+0x5bf/0xa50
+[   14.371661]  netlink_rcv_skb+0x1cd/0x3e0
+[   14.371913]  netlink_unicast+0x5dc/0x840
+[   14.372169]  netlink_sendmsg+0x856/0xc40
+[   14.372420]  ____sys_sendmsg+0x8a7/0x8d0
+[   14.372673]  __sys_sendmsg+0x1c2/0x270
+[   14.372914]  do_syscall_64+0x41/0x90
+[   14.373145]  entry_SYSCALL_64_after_hwframe+0x44/0xae
+...
+
+Fixes: 5738a09d58d5a ("vmxnet3: fix checks for dma mapping errors")
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Zixuan Fu <r33s3n6@gmail.com>
+Link: https://lore.kernel.org/r/20220514050656.2636588-1-r33s3n6@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vmxnet3/vmxnet3_drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
+index d9d90baac72a..1154f1884212 100644
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -589,6 +589,7 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx,
+ 				if (dma_mapping_error(&adapter->pdev->dev,
+ 						      rbi->dma_addr)) {
+ 					dev_kfree_skb_any(rbi->skb);
++					rbi->skb = NULL;
+ 					rq->stats.rx_buf_alloc_failure++;
+ 					break;
+ 				}
+@@ -613,6 +614,7 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx,
+ 				if (dma_mapping_error(&adapter->pdev->dev,
+ 						      rbi->dma_addr)) {
+ 					put_page(rbi->page);
++					rbi->page = NULL;
+ 					rq->stats.rx_buf_alloc_failure++;
+ 					break;
+ 				}
+-- 
+2.35.1
+
diff --git a/queue-5.17/netfilter-flowtable-fix-excessive-hw-offload-attempt.patch b/queue-5.17/netfilter-flowtable-fix-excessive-hw-offload-attempt.patch
new file mode 100644
index 0000000..b7792ca
--- /dev/null
+++ b/queue-5.17/netfilter-flowtable-fix-excessive-hw-offload-attempt.patch
@@ -0,0 +1,41 @@
+From 79a6349a75068045678bc4a482e19dc70c458db1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 May 2022 14:26:13 +0200
+Subject: netfilter: flowtable: fix excessive hw offload attempts after failure
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 396ef64113a8ba01c46315d67a99db8dde3eef51 ]
+
+If a flow cannot be offloaded, the code currently repeatedly tries again as
+quickly as possible, which can significantly increase system load.
+Fix this by limiting flow timeout update and hardware offload retry to once
+per second.
+
+Fixes: c07531c01d82 ("netfilter: flowtable: Remove redundant hw refresh bit")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_flow_table_core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index b90eca7a2f22..52e7f94d2450 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -329,8 +329,10 @@ void flow_offload_refresh(struct nf_flowtable *flow_table,
+ 	u32 timeout;
+ 
+ 	timeout = nf_flowtable_time_stamp + flow_offload_get_timeout(flow);
+-	if (READ_ONCE(flow->timeout) != timeout)
++	if (timeout - READ_ONCE(flow->timeout) > HZ)
+ 		WRITE_ONCE(flow->timeout, timeout);
++	else
++		return;
+ 
+ 	if (likely(!nf_flowtable_hw_offload(flow_table)))
+ 		return;
+-- 
+2.35.1
+
diff --git a/queue-5.17/netfilter-flowtable-fix-tcp-flow-teardown.patch b/queue-5.17/netfilter-flowtable-fix-tcp-flow-teardown.patch
new file mode 100644
index 0000000..62d4576e
--- /dev/null
+++ b/queue-5.17/netfilter-flowtable-fix-tcp-flow-teardown.patch
@@ -0,0 +1,162 @@
+From b27a108487a65557916c53708728ad3aa8d2dbe6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 May 2022 10:44:14 +0200
+Subject: netfilter: flowtable: fix TCP flow teardown
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit e5eaac2beb54f0a16ff851125082d9faeb475572 ]
+
+This patch addresses three possible problems:
+
+1. ct gc may race to undo the timeout adjustment of the packet path, leaving
+   the conntrack entry in place with the internal offload timeout (one day).
+
+2. ct gc removes the ct because the IPS_OFFLOAD_BIT is not set and the CLOSE
+   timeout is reached before the flow offload del.
+
+3. tcp ct is always set to ESTABLISHED with a very long timeout
+   in flow offload teardown/delete even though the state might be already
+   CLOSED. Also as a remark we cannot assume that the FIN or RST packet
+   is hitting flow table teardown as the packet might get bumped to the
+   slow path in nftables.
+
+This patch resets IPS_OFFLOAD_BIT from flow_offload_teardown(), so
+conntrack handles the tcp rst/fin packet which triggers the CLOSE/FIN
+state transition.
+
+Moreover, teturn the connection's ownership to conntrack upon teardown
+by clearing the offload flag and fixing the established timeout value.
+The flow table GC thread will asynchonrnously free the flow table and
+hardware offload entries.
+
+Before this patch, the IPS_OFFLOAD_BIT remained set for expired flows on
+which is also misleading since the flow is back to classic conntrack
+path.
+
+If nf_ct_delete() removes the entry from the conntrack table, then it
+calls nf_ct_put() which decrements the refcnt. This is not a problem
+because the flowtable holds a reference to the conntrack object from
+flow_offload_alloc() path which is released via flow_offload_free().
+
+This patch also updates nft_flow_offload to skip packets in SYN_RECV
+state. Since we might miss or bump packets to slow path, we do not know
+what will happen there while we are still in SYN_RECV, this patch
+postpones offload up to the next packet which also aligns to the
+existing behaviour in tc-ct.
+
+flow_offload_teardown() does not reset the existing tcp state from
+flow_offload_fixup_tcp() to ESTABLISHED anymore, packets bump to slow
+path might have already update the state to CLOSE/FIN.
+
+Joint work with Oz and Sven.
+
+Fixes: 1e5b2471bcc4 ("netfilter: nf_flow_table: teardown flow timeout race")
+Signed-off-by: Oz Shlomo <ozsh@nvidia.com>
+Signed-off-by: Sven Auhagen <sven.auhagen@voleatech.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_flow_table_core.c | 33 +++++++-----------------------
+ net/netfilter/nft_flow_offload.c   |  3 ++-
+ 2 files changed, 9 insertions(+), 27 deletions(-)
+
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index 52e7f94d2450..58f3f77b3eb2 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -173,12 +173,11 @@ EXPORT_SYMBOL_GPL(flow_offload_route_init);
+ 
+ static void flow_offload_fixup_tcp(struct ip_ct_tcp *tcp)
+ {
+-	tcp->state = TCP_CONNTRACK_ESTABLISHED;
+ 	tcp->seen[0].td_maxwin = 0;
+ 	tcp->seen[1].td_maxwin = 0;
+ }
+ 
+-static void flow_offload_fixup_ct_timeout(struct nf_conn *ct)
++static void flow_offload_fixup_ct(struct nf_conn *ct)
+ {
+ 	struct net *net = nf_ct_net(ct);
+ 	int l4num = nf_ct_protonum(ct);
+@@ -187,7 +186,9 @@ static void flow_offload_fixup_ct_timeout(struct nf_conn *ct)
+ 	if (l4num == IPPROTO_TCP) {
+ 		struct nf_tcp_net *tn = nf_tcp_pernet(net);
+ 
+-		timeout = tn->timeouts[TCP_CONNTRACK_ESTABLISHED];
++		flow_offload_fixup_tcp(&ct->proto.tcp);
++
++		timeout = tn->timeouts[ct->proto.tcp.state];
+ 		timeout -= tn->offload_timeout;
+ 	} else if (l4num == IPPROTO_UDP) {
+ 		struct nf_udp_net *tn = nf_udp_pernet(net);
+@@ -205,18 +206,6 @@ static void flow_offload_fixup_ct_timeout(struct nf_conn *ct)
+ 		WRITE_ONCE(ct->timeout, nfct_time_stamp + timeout);
+ }
+ 
+-static void flow_offload_fixup_ct_state(struct nf_conn *ct)
+-{
+-	if (nf_ct_protonum(ct) == IPPROTO_TCP)
+-		flow_offload_fixup_tcp(&ct->proto.tcp);
+-}
+-
+-static void flow_offload_fixup_ct(struct nf_conn *ct)
+-{
+-	flow_offload_fixup_ct_state(ct);
+-	flow_offload_fixup_ct_timeout(ct);
+-}
+-
+ static void flow_offload_route_release(struct flow_offload *flow)
+ {
+ 	nft_flow_dst_release(flow, FLOW_OFFLOAD_DIR_ORIGINAL);
+@@ -355,22 +344,14 @@ static void flow_offload_del(struct nf_flowtable *flow_table,
+ 	rhashtable_remove_fast(&flow_table->rhashtable,
+ 			       &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
+ 			       nf_flow_offload_rhash_params);
+-
+-	clear_bit(IPS_OFFLOAD_BIT, &flow->ct->status);
+-
+-	if (nf_flow_has_expired(flow))
+-		flow_offload_fixup_ct(flow->ct);
+-	else
+-		flow_offload_fixup_ct_timeout(flow->ct);
+-
+ 	flow_offload_free(flow);
+ }
+ 
+ void flow_offload_teardown(struct flow_offload *flow)
+ {
++	clear_bit(IPS_OFFLOAD_BIT, &flow->ct->status);
+ 	set_bit(NF_FLOW_TEARDOWN, &flow->flags);
+-
+-	flow_offload_fixup_ct_state(flow->ct);
++	flow_offload_fixup_ct(flow->ct);
+ }
+ EXPORT_SYMBOL_GPL(flow_offload_teardown);
+ 
+@@ -460,7 +441,7 @@ static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data)
+ 	if (nf_flow_has_expired(flow) ||
+ 	    nf_ct_is_dying(flow->ct) ||
+ 	    nf_flow_has_stale_dst(flow))
+-		set_bit(NF_FLOW_TEARDOWN, &flow->flags);
++		flow_offload_teardown(flow);
+ 
+ 	if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
+ 		if (test_bit(NF_FLOW_HW, &flow->flags)) {
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 12145a80ef03..aac6db8680d4 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -298,7 +298,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ 	case IPPROTO_TCP:
+ 		tcph = skb_header_pointer(pkt->skb, nft_thoff(pkt),
+ 					  sizeof(_tcph), &_tcph);
+-		if (unlikely(!tcph || tcph->fin || tcph->rst))
++		if (unlikely(!tcph || tcph->fin || tcph->rst ||
++			     !nf_conntrack_tcp_established(ct)))
+ 			goto out;
+ 		break;
+ 	case IPPROTO_UDP:
+-- 
+2.35.1
+
diff --git a/queue-5.17/netfilter-flowtable-move-dst_check-to-packet-path.patch b/queue-5.17/netfilter-flowtable-move-dst_check-to-packet-path.patch
new file mode 100644
index 0000000..0fa2645
--- /dev/null
+++ b/queue-5.17/netfilter-flowtable-move-dst_check-to-packet-path.patch
@@ -0,0 +1,110 @@
+From 222bf14fd42ef0d6de2f4da0ae33cf59a8f84b89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 May 2022 12:55:30 +0200
+Subject: netfilter: flowtable: move dst_check to packet path
+
+From: Ritaro Takenaka <ritarot634@gmail.com>
+
+[ Upstream commit 2738d9d963bd1f06d5114c2b4fa5771a95703991 ]
+
+Fixes sporadic IPv6 packet loss when flow offloading is enabled.
+
+IPv6 route GC and flowtable GC are not synchronized.
+When dst_cache becomes stale and a packet passes through the flow before
+the flowtable GC teardowns it, the packet can be dropped.
+So, it is necessary to check dst every time in packet path.
+
+Fixes: 227e1e4d0d6c ("netfilter: nf_flowtable: skip device lookup from interface index")
+Signed-off-by: Ritaro Takenaka <ritarot634@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_flow_table_core.c | 23 +----------------------
+ net/netfilter/nf_flow_table_ip.c   | 19 +++++++++++++++++++
+ 2 files changed, 20 insertions(+), 22 deletions(-)
+
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index de783c9094d7..9fb407084c50 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -415,32 +415,11 @@ nf_flow_table_iterate(struct nf_flowtable *flow_table,
+ 	return err;
+ }
+ 
+-static bool flow_offload_stale_dst(struct flow_offload_tuple *tuple)
+-{
+-	struct dst_entry *dst;
+-
+-	if (tuple->xmit_type == FLOW_OFFLOAD_XMIT_NEIGH ||
+-	    tuple->xmit_type == FLOW_OFFLOAD_XMIT_XFRM) {
+-		dst = tuple->dst_cache;
+-		if (!dst_check(dst, tuple->dst_cookie))
+-			return true;
+-	}
+-
+-	return false;
+-}
+-
+-static bool nf_flow_has_stale_dst(struct flow_offload *flow)
+-{
+-	return flow_offload_stale_dst(&flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple) ||
+-	       flow_offload_stale_dst(&flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple);
+-}
+-
+ static void nf_flow_offload_gc_step(struct nf_flowtable *flow_table,
+ 				    struct flow_offload *flow, void *data)
+ {
+ 	if (nf_flow_has_expired(flow) ||
+-	    nf_ct_is_dying(flow->ct) ||
+-	    nf_flow_has_stale_dst(flow))
++	    nf_ct_is_dying(flow->ct))
+ 		flow_offload_teardown(flow);
+ 
+ 	if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
+diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
+index 6257d87c3a56..28026467b54c 100644
+--- a/net/netfilter/nf_flow_table_ip.c
++++ b/net/netfilter/nf_flow_table_ip.c
+@@ -227,6 +227,15 @@ static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
+ 	return true;
+ }
+ 
++static inline bool nf_flow_dst_check(struct flow_offload_tuple *tuple)
++{
++	if (tuple->xmit_type != FLOW_OFFLOAD_XMIT_NEIGH &&
++	    tuple->xmit_type != FLOW_OFFLOAD_XMIT_XFRM)
++		return true;
++
++	return dst_check(tuple->dst_cache, tuple->dst_cookie);
++}
++
+ static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,
+ 				      const struct nf_hook_state *state,
+ 				      struct dst_entry *dst)
+@@ -346,6 +355,11 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
+ 	if (nf_flow_state_check(flow, iph->protocol, skb, thoff))
+ 		return NF_ACCEPT;
+ 
++	if (!nf_flow_dst_check(&tuplehash->tuple)) {
++		flow_offload_teardown(flow);
++		return NF_ACCEPT;
++	}
++
+ 	if (skb_try_make_writable(skb, thoff + hdrsize))
+ 		return NF_DROP;
+ 
+@@ -582,6 +596,11 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
+ 	if (nf_flow_state_check(flow, ip6h->nexthdr, skb, thoff))
+ 		return NF_ACCEPT;
+ 
++	if (!nf_flow_dst_check(&tuplehash->tuple)) {
++		flow_offload_teardown(flow);
++		return NF_ACCEPT;
++	}
++
+ 	if (skb_try_make_writable(skb, thoff + hdrsize))
+ 		return NF_DROP;
+ 
+-- 
+2.35.1
+
diff --git a/queue-5.17/netfilter-flowtable-pass-flowtable-to-nf_flow_table_.patch b/queue-5.17/netfilter-flowtable-pass-flowtable-to-nf_flow_table_.patch
new file mode 100644
index 0000000..99f27eb
--- /dev/null
+++ b/queue-5.17/netfilter-flowtable-pass-flowtable-to-nf_flow_table_.patch
@@ -0,0 +1,90 @@
+From 240f631beee3dc1c8f3fddab6e048a8c85018c40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Mar 2022 13:11:24 +0100
+Subject: netfilter: flowtable: pass flowtable to nf_flow_table_iterate()
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 217cff36e885627c41a14e803fc44f9cbc945767 ]
+
+The flowtable object is already passed as argument to
+nf_flow_table_iterate(), do use not data pointer to pass flowtable.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_flow_table_core.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index 58f3f77b3eb2..de783c9094d7 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -382,7 +382,8 @@ EXPORT_SYMBOL_GPL(flow_offload_lookup);
+ 
+ static int
+ nf_flow_table_iterate(struct nf_flowtable *flow_table,
+-		      void (*iter)(struct flow_offload *flow, void *data),
++		      void (*iter)(struct nf_flowtable *flowtable,
++				   struct flow_offload *flow, void *data),
+ 		      void *data)
+ {
+ 	struct flow_offload_tuple_rhash *tuplehash;
+@@ -406,7 +407,7 @@ nf_flow_table_iterate(struct nf_flowtable *flow_table,
+ 
+ 		flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
+ 
+-		iter(flow, data);
++		iter(flow_table, flow, data);
+ 	}
+ 	rhashtable_walk_stop(&hti);
+ 	rhashtable_walk_exit(&hti);
+@@ -434,10 +435,9 @@ static bool nf_flow_has_stale_dst(struct flow_offload *flow)
+ 	       flow_offload_stale_dst(&flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple);
+ }
+ 
+-static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data)
++static void nf_flow_offload_gc_step(struct nf_flowtable *flow_table,
++				    struct flow_offload *flow, void *data)
+ {
+-	struct nf_flowtable *flow_table = data;
+-
+ 	if (nf_flow_has_expired(flow) ||
+ 	    nf_ct_is_dying(flow->ct) ||
+ 	    nf_flow_has_stale_dst(flow))
+@@ -462,7 +462,7 @@ static void nf_flow_offload_work_gc(struct work_struct *work)
+ 	struct nf_flowtable *flow_table;
+ 
+ 	flow_table = container_of(work, struct nf_flowtable, gc_work.work);
+-	nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, flow_table);
++	nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, NULL);
+ 	queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ);
+ }
+ 
+@@ -578,7 +578,8 @@ int nf_flow_table_init(struct nf_flowtable *flowtable)
+ }
+ EXPORT_SYMBOL_GPL(nf_flow_table_init);
+ 
+-static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data)
++static void nf_flow_table_do_cleanup(struct nf_flowtable *flow_table,
++				     struct flow_offload *flow, void *data)
+ {
+ 	struct net_device *dev = data;
+ 
+@@ -620,11 +621,10 @@ void nf_flow_table_free(struct nf_flowtable *flow_table)
+ 
+ 	cancel_delayed_work_sync(&flow_table->gc_work);
+ 	nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL);
+-	nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, flow_table);
++	nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, NULL);
+ 	nf_flow_table_offload_flush(flow_table);
+ 	if (nf_flowtable_hw_offload(flow_table))
+-		nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step,
+-				      flow_table);
++		nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, NULL);
+ 	rhashtable_destroy(&flow_table->rhashtable);
+ }
+ EXPORT_SYMBOL_GPL(nf_flow_table_free);
+-- 
+2.35.1
+
diff --git a/queue-5.17/netfilter-nft_flow_offload-fix-offload-with-pppoe-vl.patch b/queue-5.17/netfilter-nft_flow_offload-fix-offload-with-pppoe-vl.patch
new file mode 100644
index 0000000..f7bbc23
--- /dev/null
+++ b/queue-5.17/netfilter-nft_flow_offload-fix-offload-with-pppoe-vl.patch
@@ -0,0 +1,38 @@
+From 83ae80890b58a2ea0ed64d2c49749d100adb7830 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 May 2022 14:26:16 +0200
+Subject: netfilter: nft_flow_offload: fix offload with pppoe + vlan
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 2456074935003b66c40f78df6adfc722435d43ea ]
+
+When running a combination of PPPoE on top of a VLAN, we need to set
+info->outdev to the PPPoE device, otherwise PPPoE encap is skipped
+during software offload.
+
+Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_flow_offload.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index dd824193c920..12145a80ef03 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -123,7 +123,8 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack,
+ 				info->indev = NULL;
+ 				break;
+ 			}
+-			info->outdev = path->dev;
++			if (!info->outdev)
++				info->outdev = path->dev;
+ 			info->encap[info->num_encaps].id = path->encap.id;
+ 			info->encap[info->num_encaps].proto = path->encap.proto;
+ 			info->num_encaps++;
+-- 
+2.35.1
+
diff --git a/queue-5.17/netfilter-nft_flow_offload-skip-dst-neigh-lookup-for.patch b/queue-5.17/netfilter-nft_flow_offload-skip-dst-neigh-lookup-for.patch
new file mode 100644
index 0000000..738d083
--- /dev/null
+++ b/queue-5.17/netfilter-nft_flow_offload-skip-dst-neigh-lookup-for.patch
@@ -0,0 +1,78 @@
+From 029bf5f7fed2d19250a34a8e9ddbaa20871e267c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 May 2022 14:26:14 +0200
+Subject: netfilter: nft_flow_offload: skip dst neigh lookup for ppp devices
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 45ca3e61999e9a30ca2b7cfbf9da8a9f8d13be31 ]
+
+The dst entry does not contain a valid hardware address, so skip the lookup
+in order to avoid running into errors here.
+The proper hardware address is filled in from nft_dev_path_info
+
+Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_flow_offload.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 0af34ad41479..dd824193c920 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -36,6 +36,15 @@ static void nft_default_forward_path(struct nf_flow_route *route,
+ 	route->tuple[dir].xmit_type	= nft_xmit_type(dst_cache);
+ }
+ 
++static bool nft_is_valid_ether_device(const struct net_device *dev)
++{
++	if (!dev || (dev->flags & IFF_LOOPBACK) || dev->type != ARPHRD_ETHER ||
++	    dev->addr_len != ETH_ALEN || !is_valid_ether_addr(dev->dev_addr))
++		return false;
++
++	return true;
++}
++
+ static int nft_dev_fill_forward_path(const struct nf_flow_route *route,
+ 				     const struct dst_entry *dst_cache,
+ 				     const struct nf_conn *ct,
+@@ -47,6 +56,9 @@ static int nft_dev_fill_forward_path(const struct nf_flow_route *route,
+ 	struct neighbour *n;
+ 	u8 nud_state;
+ 
++	if (!nft_is_valid_ether_device(dev))
++		goto out;
++
+ 	n = dst_neigh_lookup(dst_cache, daddr);
+ 	if (!n)
+ 		return -1;
+@@ -60,6 +72,7 @@ static int nft_dev_fill_forward_path(const struct nf_flow_route *route,
+ 	if (!(nud_state & NUD_VALID))
+ 		return -1;
+ 
++out:
+ 	return dev_fill_forward_path(dev, ha, stack);
+ }
+ 
+@@ -78,15 +91,6 @@ struct nft_forward_info {
+ 	enum flow_offload_xmit_type xmit_type;
+ };
+ 
+-static bool nft_is_valid_ether_device(const struct net_device *dev)
+-{
+-	if (!dev || (dev->flags & IFF_LOOPBACK) || dev->type != ARPHRD_ETHER ||
+-	    dev->addr_len != ETH_ALEN || !is_valid_ether_addr(dev->dev_addr))
+-		return false;
+-
+-	return true;
+-}
+-
+ static void nft_dev_path_info(const struct net_device_path_stack *stack,
+ 			      struct nft_forward_info *info,
+ 			      unsigned char *ha, struct nf_flowtable *flowtable)
+-- 
+2.35.1
+
diff --git a/queue-5.17/nfc-nci-fix-sleep-in-atomic-context-bugs-caused-by-n.patch b/queue-5.17/nfc-nci-fix-sleep-in-atomic-context-bugs-caused-by-n.patch
new file mode 100644
index 0000000..11d7453
--- /dev/null
+++ b/queue-5.17/nfc-nci-fix-sleep-in-atomic-context-bugs-caused-by-n.patch
@@ -0,0 +1,81 @@
+From bb20d4ba7e65492e8b1df076f3d2ecd30c4d6ffe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 May 2022 09:25:30 +0800
+Subject: NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 23dd4581350d4ffa23d58976ec46408f8f4c1e16 ]
+
+There are sleep in atomic context bugs when the request to secure
+element of st-nci is timeout. The root cause is that nci_skb_alloc
+with GFP_KERNEL parameter is called in st_nci_se_wt_timeout which is
+a timer handler. The call paths that could trigger bugs are shown below:
+
+    (interrupt context 1)
+st_nci_se_wt_timeout
+  nci_hci_send_event
+    nci_hci_send_data
+      nci_skb_alloc(..., GFP_KERNEL) //may sleep
+
+   (interrupt context 2)
+st_nci_se_wt_timeout
+  nci_hci_send_event
+    nci_hci_send_data
+      nci_send_data
+        nci_queue_tx_data_frags
+          nci_skb_alloc(..., GFP_KERNEL) //may sleep
+
+This patch changes allocation mode of nci_skb_alloc from GFP_KERNEL to
+GFP_ATOMIC in order to prevent atomic context sleeping. The GFP_ATOMIC
+flag makes memory allocation operation could be used in atomic context.
+
+Fixes: ed06aeefdac3 ("nfc: st-nci: Rename st21nfcb to st-nci")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20220517012530.75714-1-duoming@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/nfc/nci/data.c | 2 +-
+ net/nfc/nci/hci.c  | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c
+index 6055dc9a82aa..aa5e712adf07 100644
+--- a/net/nfc/nci/data.c
++++ b/net/nfc/nci/data.c
+@@ -118,7 +118,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev,
+ 
+ 		skb_frag = nci_skb_alloc(ndev,
+ 					 (NCI_DATA_HDR_SIZE + frag_len),
+-					 GFP_KERNEL);
++					 GFP_ATOMIC);
+ 		if (skb_frag == NULL) {
+ 			rc = -ENOMEM;
+ 			goto free_exit;
+diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c
+index 19703a649b5a..78c4b6addf15 100644
+--- a/net/nfc/nci/hci.c
++++ b/net/nfc/nci/hci.c
+@@ -153,7 +153,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe,
+ 
+ 	i = 0;
+ 	skb = nci_skb_alloc(ndev, conn_info->max_pkt_payload_len +
+-			    NCI_DATA_HDR_SIZE, GFP_KERNEL);
++			    NCI_DATA_HDR_SIZE, GFP_ATOMIC);
+ 	if (!skb)
+ 		return -ENOMEM;
+ 
+@@ -184,7 +184,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe,
+ 		if (i < data_len) {
+ 			skb = nci_skb_alloc(ndev,
+ 					    conn_info->max_pkt_payload_len +
+-					    NCI_DATA_HDR_SIZE, GFP_KERNEL);
++					    NCI_DATA_HDR_SIZE, GFP_ATOMIC);
+ 			if (!skb)
+ 				return -ENOMEM;
+ 
+-- 
+2.35.1
+
diff --git a/queue-5.17/nl80211-fix-locking-in-nl80211_set_tx_bitrate_mask.patch b/queue-5.17/nl80211-fix-locking-in-nl80211_set_tx_bitrate_mask.patch
new file mode 100644
index 0000000..7f4a457
--- /dev/null
+++ b/queue-5.17/nl80211-fix-locking-in-nl80211_set_tx_bitrate_mask.patch
@@ -0,0 +1,53 @@
+From b1a0e7dff325444744e3c2290991a7012803c407 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 May 2022 10:21:38 +0200
+Subject: nl80211: fix locking in nl80211_set_tx_bitrate_mask()
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit f971e1887fdb3ab500c9bebf4b98f62d49a20655 ]
+
+This accesses the wdev's chandef etc., so cannot safely
+be used without holding the lock.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://lore.kernel.org/r/20220506102136.06b7205419e6.I2a87c05fbd8bc5e565e84d190d4cfd2e92695a90@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/nl80211.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 06a35f1bec23..0c20df052db3 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -11573,18 +11573,23 @@ static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
+ 	struct cfg80211_bitrate_mask mask;
+ 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
+ 	struct net_device *dev = info->user_ptr[1];
++	struct wireless_dev *wdev = dev->ieee80211_ptr;
+ 	int err;
+ 
+ 	if (!rdev->ops->set_bitrate_mask)
+ 		return -EOPNOTSUPP;
+ 
++	wdev_lock(wdev);
+ 	err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
+ 					    NL80211_ATTR_TX_RATES, &mask,
+ 					    dev, true);
+ 	if (err)
+-		return err;
++		goto out;
+ 
+-	return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
++	err = rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
++out:
++	wdev_unlock(wdev);
++	return err;
+ }
+ 
+ static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
+-- 
+2.35.1
+
diff --git a/queue-5.17/nl80211-validate-s1g-channel-width.patch b/queue-5.17/nl80211-validate-s1g-channel-width.patch
new file mode 100644
index 0000000..d67f21d
--- /dev/null
+++ b/queue-5.17/nl80211-validate-s1g-channel-width.patch
@@ -0,0 +1,44 @@
+From e64d735f33e05d8f5d080d6e8582d5405eb3f1e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Apr 2022 04:13:21 +0000
+Subject: nl80211: validate S1G channel width
+
+From: Kieran Frewen <kieran.frewen@morsemicro.com>
+
+[ Upstream commit 5d087aa759eb82b8208411913f6c2158bd85abc0 ]
+
+Validate the S1G channel width input by user to ensure it matches
+that of the requested channel
+
+Signed-off-by: Kieran Frewen <kieran.frewen@morsemicro.com>
+Signed-off-by: Bassem Dawood <bassem@morsemicro.com>
+Link: https://lore.kernel.org/r/20220420041321.3788789-2-kieran.frewen@morsemicro.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/nl80211.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index dc171ca0d1b1..06a35f1bec23 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3128,6 +3128,15 @@ int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
+ 	} else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
+ 		chandef->width =
+ 			nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
++		if (chandef->chan->band == NL80211_BAND_S1GHZ) {
++			/* User input error for channel width doesn't match channel  */
++			if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
++				NL_SET_ERR_MSG_ATTR(extack,
++						    attrs[NL80211_ATTR_CHANNEL_WIDTH],
++						    "bad channel width");
++				return -EINVAL;
++			}
++		}
+ 		if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
+ 			chandef->center_freq1 =
+ 				nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
+-- 
+2.35.1
+
diff --git a/queue-5.17/perf-bench-numa-address-compiler-error-on-s390.patch b/queue-5.17/perf-bench-numa-address-compiler-error-on-s390.patch
new file mode 100644
index 0000000..ae0b19c
--- /dev/null
+++ b/queue-5.17/perf-bench-numa-address-compiler-error-on-s390.patch
@@ -0,0 +1,67 @@
+From 859f6624f033d62feaec818a9d6212dd14703236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 May 2022 10:11:58 +0200
+Subject: perf bench numa: Address compiler error on s390
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit f8ac1c478424a9a14669b8cef7389b1e14e5229d ]
+
+The compilation on s390 results in this error:
+
+  # make DEBUG=y bench/numa.o
+  ...
+  bench/numa.c: In function ‘__bench_numa’:
+  bench/numa.c:1749:81: error: ‘%d’ directive output may be truncated
+              writing between 1 and 11 bytes into a region of size between
+              10 and 20 [-Werror=format-truncation=]
+  1749 |        snprintf(tname, sizeof(tname), "process%d:thread%d", p, t);
+                                                               ^~
+  ...
+  bench/numa.c:1749:64: note: directive argument in the range
+                 [-2147483647, 2147483646]
+  ...
+  #
+
+The maximum length of the %d replacement is 11 characters because of the
+negative sign.  Therefore extend the array by two more characters.
+
+Output after:
+
+  # make  DEBUG=y bench/numa.o > /dev/null 2>&1; ll bench/numa.o
+  -rw-r--r-- 1 root root 418320 May 19 09:11 bench/numa.o
+  #
+
+Fixes: 3aff8ba0a4c9c919 ("perf bench numa: Avoid possible truncation when using snprintf()")
+Suggested-by: Namhyung Kim <namhyung@gmail.com>
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Sven Schnelle <svens@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Link: https://lore.kernel.org/r/20220520081158.2990006-1-tmricht@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/bench/numa.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
+index f2640179ada9..c2c81567afa5 100644
+--- a/tools/perf/bench/numa.c
++++ b/tools/perf/bench/numa.c
+@@ -1672,7 +1672,7 @@ static int __bench_numa(const char *name)
+ 		"GB/sec,", "total-speed",	"GB/sec total speed");
+ 
+ 	if (g->p.show_details >= 2) {
+-		char tname[14 + 2 * 10 + 1];
++		char tname[14 + 2 * 11 + 1];
+ 		struct thread_data *td;
+ 		for (p = 0; p < g->p.nr_proc; p++) {
+ 			for (t = 0; t < g->p.nr_threads; t++) {
+-- 
+2.35.1
+
diff --git a/queue-5.17/perf-build-fix-check-for-btf__load_from_kernel_by_id.patch b/queue-5.17/perf-build-fix-check-for-btf__load_from_kernel_by_id.patch
new file mode 100644
index 0000000..ce94b1f
--- /dev/null
+++ b/queue-5.17/perf-build-fix-check-for-btf__load_from_kernel_by_id.patch
@@ -0,0 +1,186 @@
+From 785d8d20e567a9e0137c49ab187fa998cb0082df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 May 2022 21:25:12 -0300
+Subject: perf build: Fix check for btf__load_from_kernel_by_id() in libbpf
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 0ae065a5d265bc5ada13e350015458e0c5e5c351 ]
+
+Avi Kivity reported a problem where the __weak
+btf__load_from_kernel_by_id() in tools/perf/util/bpf-event.c was being
+used and it called btf__get_from_id() in tools/lib/bpf/btf.c that in
+turn called back to btf__load_from_kernel_by_id(), resulting in an
+endless loop.
+
+Fix this by adding a feature test to check if
+btf__load_from_kernel_by_id() is available when building perf with
+LIBBPF_DYNAMIC=1, and if not then provide the fallback to the old
+btf__get_from_id(), that doesn't call back to btf__load_from_kernel_by_id()
+since at that time it didn't exist at all.
+
+Tested on Fedora 35 where we have libbpf-devel 0.4.0 with LIBBPF_DYNAMIC
+where we don't have btf__load_from_kernel_by_id() and thus its feature
+test fail, not defining HAVE_LIBBPF_BTF__LOAD_FROM_KERNEL_BY_ID:
+
+  $ cat /tmp/build/perf-urgent/feature/test-libbpf-btf__load_from_kernel_by_id.make.output
+  test-libbpf-btf__load_from_kernel_by_id.c: In function ‘main’:
+  test-libbpf-btf__load_from_kernel_by_id.c:6:16: error: implicit declaration of function ‘btf__load_from_kernel_by_id’ [-Werror=implicit-function-declaration]
+      6 |         return btf__load_from_kernel_by_id(20151128, NULL);
+        |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~
+  cc1: all warnings being treated as errors
+  $
+
+  $ nm /tmp/build/perf-urgent/perf | grep btf__load_from_kernel_by_id
+  00000000005ba180 T btf__load_from_kernel_by_id
+  $
+
+  $ objdump --disassemble=btf__load_from_kernel_by_id -S /tmp/build/perf-urgent/perf
+
+  /tmp/build/perf-urgent/perf:     file format elf64-x86-64
+  <SNIP>
+  00000000005ba180 <btf__load_from_kernel_by_id>:
+  #include "record.h"
+  #include "util/synthetic-events.h"
+
+  #ifndef HAVE_LIBBPF_BTF__LOAD_FROM_KERNEL_BY_ID
+  struct btf *btf__load_from_kernel_by_id(__u32 id)
+  {
+    5ba180:	55                   	push   %rbp
+    5ba181:	48 89 e5             	mov    %rsp,%rbp
+    5ba184:	48 83 ec 10          	sub    $0x10,%rsp
+    5ba188:	64 48 8b 04 25 28 00 	mov    %fs:0x28,%rax
+    5ba18f:	00 00
+    5ba191:	48 89 45 f8          	mov    %rax,-0x8(%rbp)
+    5ba195:	31 c0                	xor    %eax,%eax
+         struct btf *btf;
+  #pragma GCC diagnostic push
+  #pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+         int err = btf__get_from_id(id, &btf);
+    5ba197:	48 8d 75 f0          	lea    -0x10(%rbp),%rsi
+    5ba19b:	e8 a0 57 e5 ff       	call   40f940 <btf__get_from_id@plt>
+    5ba1a0:	89 c2                	mov    %eax,%edx
+  #pragma GCC diagnostic pop
+
+         return err ? ERR_PTR(err) : btf;
+    5ba1a2:	48 98                	cltq
+    5ba1a4:	85 d2                	test   %edx,%edx
+    5ba1a6:	48 0f 44 45 f0       	cmove  -0x10(%rbp),%rax
+  }
+  <SNIP>
+
+Fixes: 218e7b775d368f38 ("perf bpf: Provide a weak btf__load_from_kernel_by_id() for older libbpf versions")
+Reported-by: Avi Kivity <avi@scylladb.com>
+Link: https://lore.kernel.org/linux-perf-users/f0add43b-3de5-20c5-22c4-70aff4af959f@scylladb.com
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/linux-perf-users/YobjjFOblY4Xvwo7@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/Makefile.feature                               | 1 +
+ tools/build/feature/Makefile                               | 4 ++++
+ .../feature/test-libbpf-btf__load_from_kernel_by_id.c      | 7 +++++++
+ tools/perf/Makefile.config                                 | 7 +++++++
+ tools/perf/util/bpf-event.c                                | 4 +++-
+ 5 files changed, 22 insertions(+), 1 deletion(-)
+ create mode 100644 tools/build/feature/test-libbpf-btf__load_from_kernel_by_id.c
+
+diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
+index ae61f464043a..c6a48d0ef9ff 100644
+--- a/tools/build/Makefile.feature
++++ b/tools/build/Makefile.feature
+@@ -98,6 +98,7 @@ FEATURE_TESTS_EXTRA :=                  \
+          llvm-version                   \
+          clang                          \
+          libbpf                         \
++         libbpf-btf__load_from_kernel_by_id \
+          libpfm4                        \
+          libdebuginfod			\
+          clang-bpf-co-re
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index de66e1cc0734..cb4a2a4fa2e4 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -57,6 +57,7 @@ FILES=                                          \
+          test-lzma.bin                          \
+          test-bpf.bin                           \
+          test-libbpf.bin                        \
++         test-libbpf-btf__load_from_kernel_by_id.bin	\
+          test-get_cpuid.bin                     \
+          test-sdt.bin                           \
+          test-cxx.bin                           \
+@@ -287,6 +288,9 @@ $(OUTPUT)test-bpf.bin:
+ $(OUTPUT)test-libbpf.bin:
+ 	$(BUILD) -lbpf
+ 
++$(OUTPUT)test-libbpf-btf__load_from_kernel_by_id.bin:
++	$(BUILD) -lbpf
++
+ $(OUTPUT)test-sdt.bin:
+ 	$(BUILD)
+ 
+diff --git a/tools/build/feature/test-libbpf-btf__load_from_kernel_by_id.c b/tools/build/feature/test-libbpf-btf__load_from_kernel_by_id.c
+new file mode 100644
+index 000000000000..f7c084428735
+--- /dev/null
++++ b/tools/build/feature/test-libbpf-btf__load_from_kernel_by_id.c
+@@ -0,0 +1,7 @@
++// SPDX-License-Identifier: GPL-2.0
++#include <bpf/libbpf.h>
++
++int main(void)
++{
++	return btf__load_from_kernel_by_id(20151128, NULL);
++}
+diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
+index f3bf9297bcc0..1bd64e7404b9 100644
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -553,9 +553,16 @@ ifndef NO_LIBELF
+         ifeq ($(feature-libbpf), 1)
+           EXTLIBS += -lbpf
+           $(call detected,CONFIG_LIBBPF_DYNAMIC)
++
++          $(call feature_check,libbpf-btf__load_from_kernel_by_id)
++          ifeq ($(feature-libbpf-btf__load_from_kernel_by_id), 1)
++            CFLAGS += -DHAVE_LIBBPF_BTF__LOAD_FROM_KERNEL_BY_ID
++          endif
+         else
+           dummy := $(error Error: No libbpf devel library found, please install libbpf-devel);
+         endif
++      else
++	CFLAGS += -DHAVE_LIBBPF_BTF__LOAD_FROM_KERNEL_BY_ID
+       endif
+     endif
+ 
+diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
+index a517eaa51eb3..65dfd2c70246 100644
+--- a/tools/perf/util/bpf-event.c
++++ b/tools/perf/util/bpf-event.c
+@@ -22,7 +22,8 @@
+ #include "record.h"
+ #include "util/synthetic-events.h"
+ 
+-struct btf * __weak btf__load_from_kernel_by_id(__u32 id)
++#ifndef HAVE_LIBBPF_BTF__LOAD_FROM_KERNEL_BY_ID
++struct btf *btf__load_from_kernel_by_id(__u32 id)
+ {
+        struct btf *btf;
+ #pragma GCC diagnostic push
+@@ -32,6 +33,7 @@ struct btf * __weak btf__load_from_kernel_by_id(__u32 id)
+ 
+        return err ? ERR_PTR(err) : btf;
+ }
++#endif
+ 
+ struct bpf_program * __weak
+ bpf_object__next_program(const struct bpf_object *obj, struct bpf_program *prev)
+-- 
+2.35.1
+
diff --git a/queue-5.17/perf-regs-x86-fix-arch__intr_reg_mask-for-the-hybrid.patch b/queue-5.17/perf-regs-x86-fix-arch__intr_reg_mask-for-the-hybrid.patch
new file mode 100644
index 0000000..366fee8
--- /dev/null
+++ b/queue-5.17/perf-regs-x86-fix-arch__intr_reg_mask-for-the-hybrid.patch
@@ -0,0 +1,90 @@
+From 2bcd703c4666a75d9186d11e8317b2aa41e3fa72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 May 2022 07:51:25 -0700
+Subject: perf regs x86: Fix arch__intr_reg_mask() for the hybrid platform
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+[ Upstream commit 01b28e4a58152e8906eeb5f1b55a0c404c48c7c8 ]
+
+The X86 specific arch__intr_reg_mask() is to check whether the kernel
+and hardware can collect XMM registers. But it doesn't work on some
+hybrid platform.
+
+Without the patch on ADL-N:
+
+  $ perf record -I?
+  available registers: AX BX CX DX SI DI BP SP IP FLAGS CS SS R8 R9 R10
+  R11 R12 R13 R14 R15
+
+The config of the test event doesn't contain the PMU information. The
+kernel may fail to initialize it on the correct hybrid PMU and return
+the wrong non-supported information.
+
+Add the PMU information into the config for the hybrid platform. The
+same register set is supported among different hybrid PMUs. Checking
+the first available one is good enough.
+
+With the patch on ADL-N:
+
+  $ perf record -I?
+  available registers: AX BX CX DX SI DI BP SP IP FLAGS CS SS R8 R9 R10
+  R11 R12 R13 R14 R15 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 XMM9
+  XMM10 XMM11 XMM12 XMM13 XMM14 XMM15
+
+Fixes: 6466ec14aaf44ff1 ("perf regs x86: Add X86 specific arch__intr_reg_mask()")
+Reported-by: Ammy Yi <ammy.yi@intel.com>
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Xing Zhengjun <zhengjun.xing@linux.intel.com>
+Link: https://lore.kernel.org/r/20220518145125.1494156-1-kan.liang@linux.intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/arch/x86/util/perf_regs.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/tools/perf/arch/x86/util/perf_regs.c b/tools/perf/arch/x86/util/perf_regs.c
+index 207c56805c55..0ed177991ad0 100644
+--- a/tools/perf/arch/x86/util/perf_regs.c
++++ b/tools/perf/arch/x86/util/perf_regs.c
+@@ -9,6 +9,8 @@
+ #include "../../../util/perf_regs.h"
+ #include "../../../util/debug.h"
+ #include "../../../util/event.h"
++#include "../../../util/pmu.h"
++#include "../../../util/pmu-hybrid.h"
+ 
+ const struct sample_reg sample_reg_masks[] = {
+ 	SMPL_REG(AX, PERF_REG_X86_AX),
+@@ -284,12 +286,22 @@ uint64_t arch__intr_reg_mask(void)
+ 		.disabled 		= 1,
+ 		.exclude_kernel		= 1,
+ 	};
++	struct perf_pmu *pmu;
+ 	int fd;
+ 	/*
+ 	 * In an unnamed union, init it here to build on older gcc versions
+ 	 */
+ 	attr.sample_period = 1;
+ 
++	if (perf_pmu__has_hybrid()) {
++		/*
++		 * The same register set is supported among different hybrid PMUs.
++		 * Only check the first available one.
++		 */
++		pmu = list_first_entry(&perf_pmu__hybrid_pmus, typeof(*pmu), hybrid_list);
++		attr.config |= (__u64)pmu->type << PERF_PMU_TYPE_SHIFT;
++	}
++
+ 	event_attr_init(&attr);
+ 
+ 	fd = sys_perf_event_open(&attr, 0, -1, -1, 0);
+-- 
+2.35.1
+
diff --git a/queue-5.17/perf-stat-fix-and-validate-cpu-map-inputs-in-synthet.patch b/queue-5.17/perf-stat-fix-and-validate-cpu-map-inputs-in-synthet.patch
new file mode 100644
index 0000000..854688a
--- /dev/null
+++ b/queue-5.17/perf-stat-fix-and-validate-cpu-map-inputs-in-synthet.patch
@@ -0,0 +1,93 @@
+From f473626d9825cb552ac80d519489a96c1040d552 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 May 2022 20:20:01 -0700
+Subject: perf stat: Fix and validate CPU map inputs in synthetic
+ PERF_RECORD_STAT events
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 92d579ea3279aa87392b862df5810f0a7e30fcc6 ]
+
+Stat events can come from disk and so need a degree of validation. They
+contain a CPU which needs looking up via CPU map to access a counter.
+
+Add the CPU to index translation, alongside validity checking.
+
+Discussion thread:
+
+  https://lore.kernel.org/linux-perf-users/CAP-5=fWQR=sCuiSMktvUtcbOLidEpUJLCybVF6=BRvORcDOq+g@mail.gmail.com/
+
+Fixes: 7ac0089d138f80dc ("perf evsel: Pass cpu not cpu map index to synthesize")
+Reported-by: Michael Petlan <mpetlan@redhat.com>
+Suggested-by: Michael Petlan <mpetlan@redhat.com>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Andrii Nakryiko <andrii@kernel.org>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Dave Marchevsky <davemarchevsky@fb.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Fastabend <john.fastabend@gmail.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: KP Singh <kpsingh@kernel.org>
+Cc: Lv Ruyi <lv.ruyi@zte.com.cn>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Michael Petlan <mpetlan@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: netdev@vger.kernel.org
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Quentin Monnet <quentin@isovalent.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Xing Zhengjun <zhengjun.xing@linux.intel.com>
+Cc: Yonghong Song <yhs@fb.com>
+Link: http://lore.kernel.org/lkml/20220519032005.1273691-2-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/stat.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c
+index ee6f03481215..9c230b908b76 100644
+--- a/tools/perf/util/stat.c
++++ b/tools/perf/util/stat.c
+@@ -471,9 +471,10 @@ int perf_stat_process_counter(struct perf_stat_config *config,
+ int perf_event__process_stat_event(struct perf_session *session,
+ 				   union perf_event *event)
+ {
+-	struct perf_counts_values count;
++	struct perf_counts_values count, *ptr;
+ 	struct perf_record_stat *st = &event->stat;
+ 	struct evsel *counter;
++	int cpu_map_idx;
+ 
+ 	count.val = st->val;
+ 	count.ena = st->ena;
+@@ -484,8 +485,18 @@ int perf_event__process_stat_event(struct perf_session *session,
+ 		pr_err("Failed to resolve counter for stat event.\n");
+ 		return -EINVAL;
+ 	}
+-
+-	*perf_counts(counter->counts, st->cpu, st->thread) = count;
++	cpu_map_idx = perf_cpu_map__idx(evsel__cpus(counter), (struct perf_cpu){.cpu = st->cpu});
++	if (cpu_map_idx == -1) {
++		pr_err("Invalid CPU %d for event %s.\n", st->cpu, evsel__name(counter));
++		return -EINVAL;
++	}
++	ptr = perf_counts(counter->counts, cpu_map_idx, st->thread);
++	if (ptr == NULL) {
++		pr_err("Failed to find perf count for CPU %d thread %d on event %s.\n",
++			st->cpu, st->thread, evsel__name(counter));
++		return -EINVAL;
++	}
++	*ptr = count;
+ 	counter->supported = true;
+ 	return 0;
+ }
+-- 
+2.35.1
+
diff --git a/queue-5.17/perf-test-bpf-skip-test-if-clang-is-not-present.patch b/queue-5.17/perf-test-bpf-skip-test-if-clang-is-not-present.patch
new file mode 100644
index 0000000..b3992a8
--- /dev/null
+++ b/queue-5.17/perf-test-bpf-skip-test-if-clang-is-not-present.patch
@@ -0,0 +1,127 @@
+From 4edaac11d7cc4bb9243e80bb13c7ff50eb7e1c2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 May 2022 17:24:38 +0530
+Subject: perf test bpf: Skip test if clang is not present
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit 8994e97be3eb3c3a7b59d6223018ffab8c272e2d ]
+
+Perf BPF filter test fails in environment where "clang" is not
+installed.
+
+Test failure logs:
+
+<<>>
+ 42: BPF filter                    :
+ 42.1: Basic BPF filtering         : Skip
+ 42.2: BPF pinning                 : FAILED!
+ 42.3: BPF prologue generation     : FAILED!
+<<>>
+
+Enabling verbose option provided debug logs which says clang/llvm needs
+to be installed. Snippet of verbose logs:
+
+<<>>
+ 42.2: BPF pinning                  :
+ --- start ---
+test child forked, pid 61423
+ERROR:	unable to find clang.
+Hint:	Try to install latest clang/llvm to support BPF.
+        Check your $PATH
+
+<<logs_here>>
+
+Failed to compile test case: 'Basic BPF llvm compile'
+Unable to get BPF object, fix kbuild first
+test child finished with -1
+ ---- end ----
+BPF filter subtest 2: FAILED!
+<<>>
+
+Here subtests, "BPF pinning" and "BPF prologue generation" failed and
+logs shows clang/llvm is needed. After installing clang, testcase
+passes.
+
+Reason on why subtest failure happens though logs has proper debug
+information:
+
+Main function __test__bpf calls test_llvm__fetch_bpf_obj by
+passing 4th argument as true ( 4th arguments maps to parameter
+"force" in test_llvm__fetch_bpf_obj ). But this will cause
+test_llvm__fetch_bpf_obj to skip the check for clang/llvm.
+
+Snippet of code part which checks for clang based on
+parameter "force" in test_llvm__fetch_bpf_obj:
+
+<<>>
+if (!force && (!llvm_param.user_set_param &&
+<<>>
+
+Since force is set to "false", test won't get skipped and fails to
+compile test case. The BPF code compilation needs clang, So pass the
+fourth argument as "false" and also skip the test if reason for return
+is "TEST_SKIP"
+
+After the patch:
+
+<<>>
+ 42: BPF filter                    :
+ 42.1: Basic BPF filtering         : Skip
+ 42.2: BPF pinning                 : Skip
+ 42.3: BPF prologue generation     : Skip
+<<>>
+
+Fixes: ba1fae431e74bb42 ("perf test: Add 'perf test BPF'")
+Reviewed-by: Kajol Jain <kjain@linux.ibm.com>
+Signed-off-by: Athira Jajeev <atrajeev@linux.vnet.ibm.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Disha Goel <disgoel@linux.vnet.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: linuxppc-dev@lists.ozlabs.org
+Cc: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Nageswara R Sastry <rnsastry@linux.ibm.com>
+Cc: Wang Nan <wangnan0@huawei.com>
+Link: https://lore.kernel.org/r/20220511115438.84032-1-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/bpf.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/tests/bpf.c b/tools/perf/tests/bpf.c
+index 573490530194..592ab02d5ba3 100644
+--- a/tools/perf/tests/bpf.c
++++ b/tools/perf/tests/bpf.c
+@@ -222,11 +222,11 @@ static int __test__bpf(int idx)
+ 
+ 	ret = test_llvm__fetch_bpf_obj(&obj_buf, &obj_buf_sz,
+ 				       bpf_testcase_table[idx].prog_id,
+-				       true, NULL);
++				       false, NULL);
+ 	if (ret != TEST_OK || !obj_buf || !obj_buf_sz) {
+ 		pr_debug("Unable to get BPF object, %s\n",
+ 			 bpf_testcase_table[idx].msg_compile_fail);
+-		if (idx == 0)
++		if ((idx == 0) || (ret == TEST_SKIP))
+ 			return TEST_SKIP;
+ 		else
+ 			return TEST_FAIL;
+@@ -370,9 +370,11 @@ static int test__bpf_prologue_test(struct test_suite *test __maybe_unused,
+ static struct test_case bpf_tests[] = {
+ #ifdef HAVE_LIBBPF_SUPPORT
+ 	TEST_CASE("Basic BPF filtering", basic_bpf_test),
+-	TEST_CASE("BPF pinning", bpf_pinning),
++	TEST_CASE_REASON("BPF pinning", bpf_pinning,
++			"clang isn't installed or environment missing BPF support"),
+ #ifdef HAVE_BPF_PROLOGUE
+-	TEST_CASE("BPF prologue generation", bpf_prologue_test),
++	TEST_CASE_REASON("BPF prologue generation", bpf_prologue_test,
++			"clang isn't installed or environment missing BPF support"),
+ #else
+ 	TEST_CASE_REASON("BPF prologue generation", bpf_prologue_test, "not compiled in"),
+ #endif
+-- 
+2.35.1
+
diff --git a/queue-5.17/perf-test-fix-all-pmu-test-to-skip-hv_24x7-hv_gpci-t.patch b/queue-5.17/perf-test-fix-all-pmu-test-to-skip-hv_24x7-hv_gpci-t.patch
new file mode 100644
index 0000000..ed78127
--- /dev/null
+++ b/queue-5.17/perf-test-fix-all-pmu-test-to-skip-hv_24x7-hv_gpci-t.patch
@@ -0,0 +1,66 @@
+From 773a7de040f954ab5165d8aca89d8a7047b00410 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 May 2022 15:42:36 +0530
+Subject: perf test: Fix "all PMU test" to skip hv_24x7/hv_gpci tests on
+ powerpc
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit 451ed8058c69a3fee29fa9e2967a4e22a221fe75 ]
+
+"perf all PMU test" picks the input events from "perf list --raw-dump
+pmu" list and runs "perf stat -e" for each of the event in the list. In
+case of powerpc, the PowerVM environment supports events from hv_24x7
+and hv_gpci PMU which is of example format like below:
+
+- hv_24x7/CPM_ADJUNCT_INST,domain=?,core=?/
+- hv_gpci/event,partition_id=?/
+
+The value for "?" needs to be filled in depending on system and
+respective event. CPM_ADJUNCT_INST needs have core value and domain
+value. hv_gpci event needs partition_id.  Similarly, there are other
+events for hv_24x7 and hv_gpci having "?" in event format. Hence skip
+these events on powerpc platform since values like partition_id, domain
+is specific to system and event.
+
+Fixes: 3d5ac9effcc640d5 ("perf test: Workload test of all PMUs")
+Signed-off-by: Athira Jajeev <atrajeev@linux.vnet.ibm.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Disha Goel <disgoel@linux.vnet.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kajol Jain <kjain@linux.ibm.com>
+Cc: linuxppc-dev@lists.ozlabs.org
+Cc: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Nageswara R Sastry <rnsastry@linux.ibm.com>
+Link: https://lore.kernel.org/r/20220520101236.17249-1-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/stat_all_pmu.sh | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/tools/perf/tests/shell/stat_all_pmu.sh b/tools/perf/tests/shell/stat_all_pmu.sh
+index b30dba455f36..9c9ef33e0b3c 100755
+--- a/tools/perf/tests/shell/stat_all_pmu.sh
++++ b/tools/perf/tests/shell/stat_all_pmu.sh
+@@ -5,6 +5,16 @@
+ set -e
+ 
+ for p in $(perf list --raw-dump pmu); do
++  # In powerpc, skip the events for hv_24x7 and hv_gpci.
++  # These events needs input values to be filled in for
++  # core, chip, partition id based on system.
++  # Example: hv_24x7/CPM_ADJUNCT_INST,domain=?,core=?/
++  # hv_gpci/event,partition_id=?/
++  # Hence skip these events for ppc.
++  if echo "$p" |grep -Eq 'hv_24x7|hv_gpci' ; then
++    echo "Skipping: Event '$p' in powerpc"
++    continue
++  fi
+   echo "Testing $p"
+   result=$(perf stat -e "$p" true 2>&1)
+   if ! echo "$result" | grep -q "$p" && ! echo "$result" | grep -q "<not supported>" ; then
+-- 
+2.35.1
+
diff --git a/queue-5.17/pinctrl-mediatek-mt8365-fix-ies-control-pins.patch b/queue-5.17/pinctrl-mediatek-mt8365-fix-ies-control-pins.patch
new file mode 100644
index 0000000..66b85be
--- /dev/null
+++ b/queue-5.17/pinctrl-mediatek-mt8365-fix-ies-control-pins.patch
@@ -0,0 +1,45 @@
+From 859bc822a1eda18be1231b757e4973fa3f80a575 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Apr 2022 14:57:14 +0200
+Subject: pinctrl: mediatek: mt8365: fix IES control pins
+
+From: Mattijs Korpershoek <mkorpershoek@baylibre.com>
+
+[ Upstream commit f680058f406863b55ac226d1c157701939c63db4 ]
+
+IES26 (BIT 16 of IES1_CFG_ADDR) controls the following pads:
+
+- PAD_I2S_DATA_IN (GPIO114)
+- PAD_I2S_LRCK (GPIO115)
+- PAD_I2S_BCK (GPIO116)
+
+The pinctrl table is wrong since it lists pins 114 to 112.
+
+Update the table with the correct values.
+
+Fixes: e94d8b6fb83a ("pinctrl: mediatek: add support for mt8365 SoC")
+Reported-by: Youngmin Han <Youngmin.Han@geappliances.com>
+Signed-off-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
+Link: https://lore.kernel.org/r/20220426125714.298907-1-mkorpershoek@baylibre.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-mt8365.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mt8365.c b/drivers/pinctrl/mediatek/pinctrl-mt8365.c
+index 79b1fee5a1eb..ddee0db72d26 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8365.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8365.c
+@@ -259,7 +259,7 @@ static const struct mtk_pin_ies_smt_set mt8365_ies_set[] = {
+ 	MTK_PIN_IES_SMT_SPEC(104, 104, 0x420, 13),
+ 	MTK_PIN_IES_SMT_SPEC(105, 109, 0x420, 14),
+ 	MTK_PIN_IES_SMT_SPEC(110, 113, 0x420, 15),
+-	MTK_PIN_IES_SMT_SPEC(114, 112, 0x420, 16),
++	MTK_PIN_IES_SMT_SPEC(114, 116, 0x420, 16),
+ 	MTK_PIN_IES_SMT_SPEC(117, 119, 0x420, 17),
+ 	MTK_PIN_IES_SMT_SPEC(120, 122, 0x420, 18),
+ 	MTK_PIN_IES_SMT_SPEC(123, 125, 0x420, 19),
+-- 
+2.35.1
+
diff --git a/queue-5.17/pinctrl-ocelot-fix-for-lan966x-alt-mode.patch b/queue-5.17/pinctrl-ocelot-fix-for-lan966x-alt-mode.patch
new file mode 100644
index 0000000..9d53778
--- /dev/null
+++ b/queue-5.17/pinctrl-ocelot-fix-for-lan966x-alt-mode.patch
@@ -0,0 +1,54 @@
+From 44b1774037c39c63dafae730fb688482f3d9885f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Apr 2022 21:29:18 +0200
+Subject: pinctrl: ocelot: Fix for lan966x alt mode
+
+From: Horatiu Vultur <horatiu.vultur@microchip.com>
+
+[ Upstream commit d3683eeb9d2b4aa5256f830721655ef2ee97e324 ]
+
+For lan966x, the GPIO 35 has the wrong function for alternate mode 2.
+The mode is not none but is PTP sync.
+
+Fixes: 531d6ab36571c2 ("pinctrl: ocelot: Extend support for lan966x")
+Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
+Reviewed-by: Kavyasree Kotagiri <kavyasree.kotagiri@microchip.com>
+Link: https://lore.kernel.org/r/20220413192918.3777234-1-horatiu.vultur@microchip.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-ocelot.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-ocelot.c b/drivers/pinctrl/pinctrl-ocelot.c
+index 370459243007..61e3844cddbf 100644
+--- a/drivers/pinctrl/pinctrl-ocelot.c
++++ b/drivers/pinctrl/pinctrl-ocelot.c
+@@ -129,6 +129,7 @@ enum {
+ 	FUNC_PTP1,
+ 	FUNC_PTP2,
+ 	FUNC_PTP3,
++	FUNC_PTPSYNC_0,
+ 	FUNC_PTPSYNC_1,
+ 	FUNC_PTPSYNC_2,
+ 	FUNC_PTPSYNC_3,
+@@ -252,6 +253,7 @@ static const char *const ocelot_function_names[] = {
+ 	[FUNC_PTP1]		= "ptp1",
+ 	[FUNC_PTP2]		= "ptp2",
+ 	[FUNC_PTP3]		= "ptp3",
++	[FUNC_PTPSYNC_0]	= "ptpsync_0",
+ 	[FUNC_PTPSYNC_1]	= "ptpsync_1",
+ 	[FUNC_PTPSYNC_2]	= "ptpsync_2",
+ 	[FUNC_PTPSYNC_3]	= "ptpsync_3",
+@@ -891,7 +893,7 @@ LAN966X_P(31,   GPIO,   FC3_c,     CAN1,      NONE,   OB_TRG,   RECO_b,      NON
+ LAN966X_P(32,   GPIO,   FC3_c,     NONE,   SGPIO_a,     NONE,  MIIM_Sa,      NONE,        R);
+ LAN966X_P(33,   GPIO,   FC1_b,     NONE,   SGPIO_a,     NONE,  MIIM_Sa,    MIIM_b,        R);
+ LAN966X_P(34,   GPIO,   FC1_b,     NONE,   SGPIO_a,     NONE,  MIIM_Sa,    MIIM_b,        R);
+-LAN966X_P(35,   GPIO,   FC1_b,     NONE,   SGPIO_a,   CAN0_b,     NONE,      NONE,        R);
++LAN966X_P(35,   GPIO,   FC1_b,  PTPSYNC_0, SGPIO_a,   CAN0_b,     NONE,      NONE,        R);
+ LAN966X_P(36,   GPIO,    NONE,  PTPSYNC_1,    NONE,   CAN0_b,     NONE,      NONE,        R);
+ LAN966X_P(37,   GPIO, FC_SHRD0, PTPSYNC_2, TWI_SLC_GATE_AD, NONE, NONE,      NONE,        R);
+ LAN966X_P(38,   GPIO,    NONE,  PTPSYNC_3,    NONE,     NONE,     NONE,      NONE,        R);
+-- 
+2.35.1
+
diff --git a/queue-5.17/pinctrl-pinctrl-aspeed-g6-remove-fwqspid-group-in-pi.patch b/queue-5.17/pinctrl-pinctrl-aspeed-g6-remove-fwqspid-group-in-pi.patch
new file mode 100644
index 0000000..f7466d6
--- /dev/null
+++ b/queue-5.17/pinctrl-pinctrl-aspeed-g6-remove-fwqspid-group-in-pi.patch
@@ -0,0 +1,71 @@
+From 8fb23352e0542d28b0b5799f154e488b80ae2400 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Mar 2022 10:39:27 -0700
+Subject: pinctrl: pinctrl-aspeed-g6: remove FWQSPID group in pinctrl
+
+From: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
+
+[ Upstream commit 3eef2f48ba0933ba995529f522554ad5c276c39b ]
+
+FWSPIDQ2 and FWSPIDQ3 are not part of FWSPI18 interface so remove
+FWQSPID group in pinctrl. These pins must be used with the FWSPI
+pins that are dedicated for boot SPI interface which provides
+same 3.3v logic level.
+
+Fixes: 2eda1cdec49f ("pinctrl: aspeed: Add AST2600 pinmux support")
+Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
+Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+Link: https://lore.kernel.org/r/20220329173932.2588289-3-quic_jaehyoo@quicinc.com
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c b/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c
+index a3fa03bcd9a3..54064714d73f 100644
+--- a/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c
++++ b/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c
+@@ -1236,18 +1236,12 @@ FUNC_GROUP_DECL(SALT8, AA12);
+ FUNC_GROUP_DECL(WDTRST4, AA12);
+ 
+ #define AE12 196
+-SIG_EXPR_LIST_DECL_SEMG(AE12, FWSPIDQ2, FWQSPID, FWSPID,
+-			SIG_DESC_SET(SCU438, 4));
+ SIG_EXPR_LIST_DECL_SESG(AE12, GPIOY4, GPIOY4);
+-PIN_DECL_(AE12, SIG_EXPR_LIST_PTR(AE12, FWSPIDQ2),
+-	  SIG_EXPR_LIST_PTR(AE12, GPIOY4));
++PIN_DECL_(AE12, SIG_EXPR_LIST_PTR(AE12, GPIOY4));
+ 
+ #define AF12 197
+-SIG_EXPR_LIST_DECL_SEMG(AF12, FWSPIDQ3, FWQSPID, FWSPID,
+-			SIG_DESC_SET(SCU438, 5));
+ SIG_EXPR_LIST_DECL_SESG(AF12, GPIOY5, GPIOY5);
+-PIN_DECL_(AF12, SIG_EXPR_LIST_PTR(AF12, FWSPIDQ3),
+-	  SIG_EXPR_LIST_PTR(AF12, GPIOY5));
++PIN_DECL_(AF12, SIG_EXPR_LIST_PTR(AF12, GPIOY5));
+ 
+ #define AC12 198
+ SSSF_PIN_DECL(AC12, GPIOY6, FWSPIABR, SIG_DESC_SET(SCU438, 6));
+@@ -1520,9 +1514,8 @@ SIG_EXPR_LIST_DECL_SEMG(Y4, EMMCDAT7, EMMCG8, EMMC, SIG_DESC_SET(SCU404, 3));
+ PIN_DECL_3(Y4, GPIO18E3, FWSPIDMISO, VBMISO, EMMCDAT7);
+ 
+ GROUP_DECL(FWSPID, Y1, Y2, Y3, Y4);
+-GROUP_DECL(FWQSPID, Y1, Y2, Y3, Y4, AE12, AF12);
+ GROUP_DECL(EMMCG8, AB4, AA4, AC4, AA5, Y5, AB5, AB6, AC5, Y1, Y2, Y3, Y4);
+-FUNC_DECL_2(FWSPID, FWSPID, FWQSPID);
++FUNC_DECL_1(FWSPID, FWSPID);
+ FUNC_GROUP_DECL(VB, Y1, Y2, Y3, Y4);
+ FUNC_DECL_3(EMMC, EMMCG1, EMMCG4, EMMCG8);
+ /*
+@@ -1918,7 +1911,6 @@ static const struct aspeed_pin_group aspeed_g6_groups[] = {
+ 	ASPEED_PINCTRL_GROUP(FSI2),
+ 	ASPEED_PINCTRL_GROUP(FWSPIABR),
+ 	ASPEED_PINCTRL_GROUP(FWSPID),
+-	ASPEED_PINCTRL_GROUP(FWQSPID),
+ 	ASPEED_PINCTRL_GROUP(FWSPIWP),
+ 	ASPEED_PINCTRL_GROUP(GPIT0),
+ 	ASPEED_PINCTRL_GROUP(GPIT1),
+-- 
+2.35.1
+
diff --git a/queue-5.17/platform-surface-gpe-add-support-for-surface-pro-8.patch b/queue-5.17/platform-surface-gpe-add-support-for-surface-pro-8.patch
new file mode 100644
index 0000000..7c251c5
--- /dev/null
+++ b/queue-5.17/platform-surface-gpe-add-support-for-surface-pro-8.patch
@@ -0,0 +1,43 @@
+From 2358a2f8fc09fe6c39c1f95d02abff4556c10f51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Apr 2022 20:00:49 +0200
+Subject: platform/surface: gpe: Add support for Surface Pro 8
+
+From: Maximilian Luz <luzmaximilian@gmail.com>
+
+[ Upstream commit ed13d4ac57474d959c40fd05d8860e2b1607becb ]
+
+The new Surface Pro 8 uses GPEs for lid events as well. Add an entry for
+that so that the lid can be used to wake the device. Note that this is a
+device with a keyboard type-cover, where this acts as the "lid".
+
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20220429180049.1282447-1-luzmaximilian@gmail.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/surface/surface_gpe.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/platform/surface/surface_gpe.c b/drivers/platform/surface/surface_gpe.c
+index c1775db29efb..ec66fde28e75 100644
+--- a/drivers/platform/surface/surface_gpe.c
++++ b/drivers/platform/surface/surface_gpe.c
+@@ -99,6 +99,14 @@ static const struct dmi_system_id dmi_lid_device_table[] = {
+ 		},
+ 		.driver_data = (void *)lid_device_props_l4D,
+ 	},
++	{
++		.ident = "Surface Pro 8",
++		.matches = {
++			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Surface Pro 8"),
++		},
++		.driver_data = (void *)lid_device_props_l4B,
++	},
+ 	{
+ 		.ident = "Surface Book 1",
+ 		.matches = {
+-- 
+2.35.1
+
diff --git a/queue-5.17/platform-x86-intel-fix-rmmod-pmt_telemetry-panic.patch b/queue-5.17/platform-x86-intel-fix-rmmod-pmt_telemetry-panic.patch
new file mode 100644
index 0000000..e6d285c
--- /dev/null
+++ b/queue-5.17/platform-x86-intel-fix-rmmod-pmt_telemetry-panic.patch
@@ -0,0 +1,95 @@
+From de277bd10fd6156d82ee7452b19724b46b694ad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Apr 2022 08:23:22 -0400
+Subject: platform/x86/intel: Fix 'rmmod pmt_telemetry' panic
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+[ Upstream commit 2cdfa0c20d58da3757054797c2974c967035926a ]
+
+'rmmod pmt_telemetry' panics with:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000040
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 0 P4D 0
+ Oops: 0000 [#1] PREEMPT SMP NOPTI
+ CPU: 4 PID: 1697 Comm: rmmod Tainted: G S      W        --------  ---  5.18.0-rc4 #3
+ Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.3056.B00.2201310233 01/31/2022
+ RIP: 0010:device_del+0x1b/0x3d0
+ Code: e8 1a d9 e9 ff e9 58 ff ff ff 48 8b 08 eb dc 0f 1f 44 00 00 41 56 41 55 41 54 55 48 8d af 80 00 00 00 53 48 89 fb 48 83 ec 18 <4c> 8b 67 40 48 89 ef 65 48 8b 04 25 28 00 00 00 48 89 44 24 10 31
+ RSP: 0018:ffffb520415cfd60 EFLAGS: 00010286
+ RAX: 0000000000000070 RBX: 0000000000000000 RCX: 0000000000000000
+ RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000
+ RBP: 0000000000000080 R08: ffffffffffffffff R09: ffffb520415cfd78
+ R10: 0000000000000002 R11: ffffb520415cfd78 R12: 0000000000000000
+ R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+ FS:  00007f7e198e5740(0000) GS:ffff905c9f700000(0000) knlGS:0000000000000000
+ CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000040 CR3: 000000010782a005 CR4: 0000000000770ee0
+ PKRU: 55555554
+ Call Trace:
+  <TASK>
+  ? __xa_erase+0x53/0xb0
+  device_unregister+0x13/0x50
+  intel_pmt_dev_destroy+0x34/0x60 [pmt_class]
+  pmt_telem_remove+0x40/0x50 [pmt_telemetry]
+  auxiliary_bus_remove+0x18/0x30
+  device_release_driver_internal+0xc1/0x150
+  driver_detach+0x44/0x90
+  bus_remove_driver+0x74/0xd0
+  auxiliary_driver_unregister+0x12/0x20
+  pmt_telem_exit+0xc/0xe4a [pmt_telemetry]
+  __x64_sys_delete_module+0x13a/0x250
+  ? syscall_trace_enter.isra.19+0x11e/0x1a0
+  do_syscall_64+0x58/0x80
+  ? syscall_exit_to_user_mode+0x12/0x30
+  ? do_syscall_64+0x67/0x80
+  ? syscall_exit_to_user_mode+0x12/0x30
+  ? do_syscall_64+0x67/0x80
+  ? syscall_exit_to_user_mode+0x12/0x30
+  ? do_syscall_64+0x67/0x80
+  ? exc_page_fault+0x64/0x140
+  entry_SYSCALL_64_after_hwframe+0x44/0xae
+ RIP: 0033:0x7f7e1803a05b
+ Code: 73 01 c3 48 8b 0d 2d 4e 38 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d fd 4d 38 00 f7 d8 64 89 01 48
+
+The probe function, pmt_telem_probe(), adds an entry for devices even if
+they have not been initialized.  This results in the array of initialized
+devices containing both initialized and uninitialized entries.  This
+causes a panic in the remove function, pmt_telem_remove() which expects
+the array to only contain initialized entries.
+
+Only use an entry when a device is initialized.
+
+Cc: "David E. Box" <david.e.box@linux.intel.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Mark Gross <markgross@kernel.org>
+Cc: platform-driver-x86@vger.kernel.org
+Signed-off-by: David Arcari <darcari@redhat.com>
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Reviewed-by: David E. Box <david.e.box@linux.intel.com>
+Link: https://lore.kernel.org/r/20220429122322.2550003-1-prarit@redhat.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/pmt/telemetry.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel/pmt/telemetry.c b/drivers/platform/x86/intel/pmt/telemetry.c
+index 6b6f3e2a617a..f73ecfd4a309 100644
+--- a/drivers/platform/x86/intel/pmt/telemetry.c
++++ b/drivers/platform/x86/intel/pmt/telemetry.c
+@@ -103,7 +103,7 @@ static int pmt_telem_probe(struct auxiliary_device *auxdev, const struct auxilia
+ 	auxiliary_set_drvdata(auxdev, priv);
+ 
+ 	for (i = 0; i < intel_vsec_dev->num_resources; i++) {
+-		struct intel_pmt_entry *entry = &priv->entry[i];
++		struct intel_pmt_entry *entry = &priv->entry[priv->num_entries];
+ 
+ 		ret = intel_pmt_dev_create(entry, &pmt_telem_ns, intel_vsec_dev, i);
+ 		if (ret < 0)
+-- 
+2.35.1
+
diff --git a/queue-5.17/platform-x86-thinkpad_acpi-convert-btusb-dmi-list-to.patch b/queue-5.17/platform-x86-thinkpad_acpi-convert-btusb-dmi-list-to.patch
new file mode 100644
index 0000000..ad95642
--- /dev/null
+++ b/queue-5.17/platform-x86-thinkpad_acpi-convert-btusb-dmi-list-to.patch
@@ -0,0 +1,137 @@
+From acfcca17c46a4e95afaa792d54ee2f71148da2ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Apr 2022 22:05:00 -0500
+Subject: platform/x86: thinkpad_acpi: Convert btusb DMI list to quirks
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit c25d7f32e3e209462cd82e6e93e66b72dbb2308f ]
+
+DMI matching in thinkpad_acpi happens local to a function meaning
+quirks can only match that function.
+
+Future changes to thinkpad_acpi may need to quirk other code, so
+change this to use a quirk infrastructure.
+
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Tested-by: Mark Pearson <markpearson@lenvo.com>
+Link: https://lore.kernel.org/r/20220429030501.1909-2-mario.limonciello@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 26 ++++++++++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 3fb8cda31eb9..c43586f1cb4b 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -309,6 +309,15 @@ struct ibm_init_struct {
+ 	struct ibm_struct *data;
+ };
+ 
++/* DMI Quirks */
++struct quirk_entry {
++	bool btusb_bug;
++};
++
++static struct quirk_entry quirk_btusb_bug = {
++	.btusb_bug = true,
++};
++
+ static struct {
+ 	u32 bluetooth:1;
+ 	u32 hotkey:1;
+@@ -338,6 +347,7 @@ static struct {
+ 	u32 hotkey_poll_active:1;
+ 	u32 has_adaptive_kbd:1;
+ 	u32 kbd_lang:1;
++	struct quirk_entry *quirks;
+ } tp_features;
+ 
+ static struct {
+@@ -4361,9 +4371,10 @@ static void bluetooth_exit(void)
+ 	bluetooth_shutdown();
+ }
+ 
+-static const struct dmi_system_id bt_fwbug_list[] __initconst = {
++static const struct dmi_system_id fwbug_list[] __initconst = {
+ 	{
+ 		.ident = "ThinkPad E485",
++		.driver_data = &quirk_btusb_bug,
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ 			DMI_MATCH(DMI_BOARD_NAME, "20KU"),
+@@ -4371,6 +4382,7 @@ static const struct dmi_system_id bt_fwbug_list[] __initconst = {
+ 	},
+ 	{
+ 		.ident = "ThinkPad E585",
++		.driver_data = &quirk_btusb_bug,
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ 			DMI_MATCH(DMI_BOARD_NAME, "20KV"),
+@@ -4378,6 +4390,7 @@ static const struct dmi_system_id bt_fwbug_list[] __initconst = {
+ 	},
+ 	{
+ 		.ident = "ThinkPad A285 - 20MW",
++		.driver_data = &quirk_btusb_bug,
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ 			DMI_MATCH(DMI_BOARD_NAME, "20MW"),
+@@ -4385,6 +4398,7 @@ static const struct dmi_system_id bt_fwbug_list[] __initconst = {
+ 	},
+ 	{
+ 		.ident = "ThinkPad A285 - 20MX",
++		.driver_data = &quirk_btusb_bug,
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ 			DMI_MATCH(DMI_BOARD_NAME, "20MX"),
+@@ -4392,6 +4406,7 @@ static const struct dmi_system_id bt_fwbug_list[] __initconst = {
+ 	},
+ 	{
+ 		.ident = "ThinkPad A485 - 20MU",
++		.driver_data = &quirk_btusb_bug,
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ 			DMI_MATCH(DMI_BOARD_NAME, "20MU"),
+@@ -4399,6 +4414,7 @@ static const struct dmi_system_id bt_fwbug_list[] __initconst = {
+ 	},
+ 	{
+ 		.ident = "ThinkPad A485 - 20MV",
++		.driver_data = &quirk_btusb_bug,
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ 			DMI_MATCH(DMI_BOARD_NAME, "20MV"),
+@@ -4421,7 +4437,8 @@ static int __init have_bt_fwbug(void)
+ 	 * Some AMD based ThinkPads have a firmware bug that calling
+ 	 * "GBDC" will cause bluetooth on Intel wireless cards blocked
+ 	 */
+-	if (dmi_check_system(bt_fwbug_list) && pci_dev_present(fwbug_cards_ids)) {
++	if (tp_features.quirks && tp_features.quirks->btusb_bug &&
++	    pci_dev_present(fwbug_cards_ids)) {
+ 		vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_RFKILL,
+ 			FW_BUG "disable bluetooth subdriver for Intel cards\n");
+ 		return 1;
+@@ -11438,6 +11455,7 @@ static void thinkpad_acpi_module_exit(void)
+ 
+ static int __init thinkpad_acpi_module_init(void)
+ {
++	const struct dmi_system_id *dmi_id;
+ 	int ret, i;
+ 
+ 	tpacpi_lifecycle = TPACPI_LIFE_INIT;
+@@ -11477,6 +11495,10 @@ static int __init thinkpad_acpi_module_init(void)
+ 		return -ENODEV;
+ 	}
+ 
++	dmi_id = dmi_first_match(fwbug_list);
++	if (dmi_id)
++		tp_features.quirks = dmi_id->driver_data;
++
+ 	/* Device initialization */
+ 	tpacpi_pdev = platform_device_register_simple(TPACPI_DRVR_NAME, -1,
+ 							NULL, 0);
+-- 
+2.35.1
+
diff --git a/queue-5.17/platform-x86-thinkpad_acpi-correct-dual-fan-probe.patch b/queue-5.17/platform-x86-thinkpad_acpi-correct-dual-fan-probe.patch
new file mode 100644
index 0000000..de4fa1c
--- /dev/null
+++ b/queue-5.17/platform-x86-thinkpad_acpi-correct-dual-fan-probe.patch
@@ -0,0 +1,71 @@
+From 2bd1c7e4632733c08cfb2aa43724a21685e7ec8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 May 2022 15:12:00 -0400
+Subject: platform/x86: thinkpad_acpi: Correct dual fan probe
+
+From: Mark Pearson <markpearson@lenovo.com>
+
+[ Upstream commit aa2fef6f40e6ccc22e932b36898f260f0e5a021a ]
+
+There was an issue with the dual fan probe whereby the probe was
+failing as it assuming that second_fan support was not available.
+
+Corrected the logic so the probe works correctly. Cleaned up so
+quirks only used if 2nd fan not detected.
+
+Tested on X1 Carbon 10 (2 fans), X1 Carbon 9 (2 fans) and T490 (1 fan)
+
+Signed-off-by: Mark Pearson <markpearson@lenovo.com>
+Link: https://lore.kernel.org/r/20220502191200.63470-1-markpearson@lenovo.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index c43586f1cb4b..0ea71416d292 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -8766,24 +8766,27 @@ static int __init fan_init(struct ibm_init_struct *iibm)
+ 			fan_status_access_mode = TPACPI_FAN_RD_TPEC;
+ 			if (quirks & TPACPI_FAN_Q1)
+ 				fan_quirk1_setup();
+-			if (quirks & TPACPI_FAN_2FAN) {
+-				tp_features.second_fan = 1;
+-				pr_info("secondary fan support enabled\n");
+-			}
+-			if (quirks & TPACPI_FAN_2CTL) {
+-				tp_features.second_fan = 1;
+-				tp_features.second_fan_ctl = 1;
+-				pr_info("secondary fan control enabled\n");
+-			}
+ 			/* Try and probe the 2nd fan */
++			tp_features.second_fan = 1; /* needed for get_speed to work */
+ 			res = fan2_get_speed(&speed);
+ 			if (res >= 0) {
+ 				/* It responded - so let's assume it's there */
+ 				tp_features.second_fan = 1;
+ 				tp_features.second_fan_ctl = 1;
+ 				pr_info("secondary fan control detected & enabled\n");
++			} else {
++				/* Fan not auto-detected */
++				tp_features.second_fan = 0;
++				if (quirks & TPACPI_FAN_2FAN) {
++					tp_features.second_fan = 1;
++					pr_info("secondary fan support enabled\n");
++				}
++				if (quirks & TPACPI_FAN_2CTL) {
++					tp_features.second_fan = 1;
++					tp_features.second_fan_ctl = 1;
++					pr_info("secondary fan control enabled\n");
++				}
+ 			}
+-
+ 		} else {
+ 			pr_err("ThinkPad ACPI EC access misbehaving, fan status and control unavailable\n");
+ 			return -ENODEV;
+-- 
+2.35.1
+
diff --git a/queue-5.17/ptp-ocp-have-adjtime-handle-negative-delta_ns-correc.patch b/queue-5.17/ptp-ocp-have-adjtime-handle-negative-delta_ns-correc.patch
new file mode 100644
index 0000000..914154e
--- /dev/null
+++ b/queue-5.17/ptp-ocp-have-adjtime-handle-negative-delta_ns-correc.patch
@@ -0,0 +1,50 @@
+From 0ec7ee6ee82f9d3aa4c4234283dea94e77df2867 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 May 2022 15:52:31 -0700
+Subject: ptp: ocp: have adjtime handle negative delta_ns correctly
+
+From: Jonathan Lemon <jonathan.lemon@gmail.com>
+
+[ Upstream commit da2172a9bfec858ceeb0271b9d444378490398c8 ]
+
+delta_ns is a s64, but it was being passed ptp_ocp_adjtime_coarse
+as an u64.  Also, it turns out that timespec64_add_ns() only handles
+positive values, so perform the math with set_normalized_timespec().
+
+Fixes: 90f8f4c0e3ce ("ptp: ocp: Add ptp_ocp_adjtime_coarse for large adjustments")
+Suggested-by: Vadim Fedorenko <vfedorenko@novek.ru>
+Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+Acked-by: Vadim Fedorenko <vfedorenko@novek.ru>
+Link: https://lore.kernel.org/r/20220513225231.1412-1-jonathan.lemon@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_ocp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c
+index 17ad5f0d13b2..6585789ed695 100644
+--- a/drivers/ptp/ptp_ocp.c
++++ b/drivers/ptp/ptp_ocp.c
+@@ -625,7 +625,7 @@ __ptp_ocp_adjtime_locked(struct ptp_ocp *bp, u32 adj_val)
+ }
+ 
+ static void
+-ptp_ocp_adjtime_coarse(struct ptp_ocp *bp, u64 delta_ns)
++ptp_ocp_adjtime_coarse(struct ptp_ocp *bp, s64 delta_ns)
+ {
+ 	struct timespec64 ts;
+ 	unsigned long flags;
+@@ -634,7 +634,8 @@ ptp_ocp_adjtime_coarse(struct ptp_ocp *bp, u64 delta_ns)
+ 	spin_lock_irqsave(&bp->lock, flags);
+ 	err = __ptp_ocp_gettime_locked(bp, &ts, NULL);
+ 	if (likely(!err)) {
+-		timespec64_add_ns(&ts, delta_ns);
++		set_normalized_timespec64(&ts, ts.tv_sec,
++					  ts.tv_nsec + delta_ns);
+ 		__ptp_ocp_settime_locked(bp, &ts);
+ 	}
+ 	spin_unlock_irqrestore(&bp->lock, flags);
+-- 
+2.35.1
+
diff --git a/queue-5.17/revert-fbdev-make-fb_release-return-enodev-if-fbdev-.patch b/queue-5.17/revert-fbdev-make-fb_release-return-enodev-if-fbdev-.patch
new file mode 100644
index 0000000..259a9c5
--- /dev/null
+++ b/queue-5.17/revert-fbdev-make-fb_release-return-enodev-if-fbdev-.patch
@@ -0,0 +1,57 @@
+From 5fa79a6d23839675f1bc1026be450c68b9bc4131 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 May 2022 13:59:17 +0200
+Subject: Revert "fbdev: Make fb_release() return -ENODEV if fbdev was
+ unregistered"
+
+From: Javier Martinez Canillas <javierm@redhat.com>
+
+[ Upstream commit 135332f34ba2662bc1e32b5c612e06a8cc41a053 ]
+
+This reverts commit aafa025c76dcc7d1a8c8f0bdefcbe4eb480b2f6a. That commit
+attempted to fix a NULL pointer dereference, caused by the struct fb_info
+associated with a framebuffer device to not longer be valid when the file
+descriptor was closed.
+
+The issue was exposed by commit 27599aacbaef ("fbdev: Hot-unplug firmware
+fb devices on forced removal"), which added a new path that goes through
+the struct device removal instead of directly unregistering the fb.
+
+Most fbdev drivers have issues with the fb_info lifetime, because call to
+framebuffer_release() from their driver's .remove callback, rather than
+doing from fbops.fb_destroy callback. This meant that due to this switch,
+the fb_info was now destroyed too early, while references still existed,
+while before it was simply leaked.
+
+The patch we're reverting here reinstated that leak, hence "fixed" the
+regression. But the proper solution is to fix the drivers to not release
+the fb_info too soon.
+
+Suggested-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220504115917.758787-1-javierm@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/fbmem.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
+index 10a9369c9dea..00f0f282e7a1 100644
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -1438,10 +1438,7 @@ fb_release(struct inode *inode, struct file *file)
+ __acquires(&info->lock)
+ __releases(&info->lock)
+ {
+-	struct fb_info * const info = file_fb_info(file);
+-
+-	if (!info)
+-		return -ENODEV;
++	struct fb_info * const info = file->private_data;
+ 
+ 	lock_fb_info(info);
+ 	if (info->fbops->fb_release)
+-- 
+2.35.1
+
diff --git a/queue-5.17/revert-pci-aardvark-rewrite-irq-code-to-chained-irq-.patch b/queue-5.17/revert-pci-aardvark-rewrite-irq-code-to-chained-irq-.patch
new file mode 100644
index 0000000..08884a8
--- /dev/null
+++ b/queue-5.17/revert-pci-aardvark-rewrite-irq-code-to-chained-irq-.patch
@@ -0,0 +1,135 @@
+From 1254058fad380e5e123541aa4337c2ca586dffe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 May 2022 14:58:15 +0200
+Subject: Revert "PCI: aardvark: Rewrite IRQ code to chained IRQ handler"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit a3b69dd0ad6265c29c4b6fb381cd76fb3bebdf8c ]
+
+This reverts commit 1571d67dc190e50c6c56e8f88cdc39f7cc53166e.
+
+This commit broke support for setting interrupt affinity. It looks like
+that it is related to the chained IRQ handler. Revert this commit until
+issue with setting interrupt affinity is fixed.
+
+Fixes: 1571d67dc190 ("PCI: aardvark: Rewrite IRQ code to chained IRQ handler")
+Link: https://lore.kernel.org/r/20220515125815.30157-1-pali@kernel.org
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-aardvark.c | 48 ++++++++++++---------------
+ 1 file changed, 22 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
+index 5be382b19d9a..27169c023180 100644
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -272,7 +272,6 @@ struct advk_pcie {
+ 		u32 actions;
+ 	} wins[OB_WIN_COUNT];
+ 	u8 wins_count;
+-	int irq;
+ 	struct irq_domain *rp_irq_domain;
+ 	struct irq_domain *irq_domain;
+ 	struct irq_chip irq_chip;
+@@ -1570,26 +1569,21 @@ static void advk_pcie_handle_int(struct advk_pcie *pcie)
+ 	}
+ }
+ 
+-static void advk_pcie_irq_handler(struct irq_desc *desc)
++static irqreturn_t advk_pcie_irq_handler(int irq, void *arg)
+ {
+-	struct advk_pcie *pcie = irq_desc_get_handler_data(desc);
+-	struct irq_chip *chip = irq_desc_get_chip(desc);
+-	u32 val, mask, status;
++	struct advk_pcie *pcie = arg;
++	u32 status;
+ 
+-	chained_irq_enter(chip, desc);
++	status = advk_readl(pcie, HOST_CTRL_INT_STATUS_REG);
++	if (!(status & PCIE_IRQ_CORE_INT))
++		return IRQ_NONE;
+ 
+-	val = advk_readl(pcie, HOST_CTRL_INT_STATUS_REG);
+-	mask = advk_readl(pcie, HOST_CTRL_INT_MASK_REG);
+-	status = val & ((~mask) & PCIE_IRQ_ALL_MASK);
++	advk_pcie_handle_int(pcie);
+ 
+-	if (status & PCIE_IRQ_CORE_INT) {
+-		advk_pcie_handle_int(pcie);
++	/* Clear interrupt */
++	advk_writel(pcie, PCIE_IRQ_CORE_INT, HOST_CTRL_INT_STATUS_REG);
+ 
+-		/* Clear interrupt */
+-		advk_writel(pcie, PCIE_IRQ_CORE_INT, HOST_CTRL_INT_STATUS_REG);
+-	}
+-
+-	chained_irq_exit(chip, desc);
++	return IRQ_HANDLED;
+ }
+ 
+ static int advk_pcie_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+@@ -1671,7 +1665,7 @@ static int advk_pcie_probe(struct platform_device *pdev)
+ 	struct advk_pcie *pcie;
+ 	struct pci_host_bridge *bridge;
+ 	struct resource_entry *entry;
+-	int ret;
++	int ret, irq;
+ 
+ 	bridge = devm_pci_alloc_host_bridge(dev, sizeof(struct advk_pcie));
+ 	if (!bridge)
+@@ -1757,9 +1751,17 @@ static int advk_pcie_probe(struct platform_device *pdev)
+ 	if (IS_ERR(pcie->base))
+ 		return PTR_ERR(pcie->base);
+ 
+-	pcie->irq = platform_get_irq(pdev, 0);
+-	if (pcie->irq < 0)
+-		return pcie->irq;
++	irq = platform_get_irq(pdev, 0);
++	if (irq < 0)
++		return irq;
++
++	ret = devm_request_irq(dev, irq, advk_pcie_irq_handler,
++			       IRQF_SHARED | IRQF_NO_THREAD, "advk-pcie",
++			       pcie);
++	if (ret) {
++		dev_err(dev, "Failed to register interrupt\n");
++		return ret;
++	}
+ 
+ 	pcie->reset_gpio = devm_gpiod_get_from_of_node(dev, dev->of_node,
+ 						       "reset-gpios", 0,
+@@ -1816,15 +1818,12 @@ static int advk_pcie_probe(struct platform_device *pdev)
+ 		return ret;
+ 	}
+ 
+-	irq_set_chained_handler_and_data(pcie->irq, advk_pcie_irq_handler, pcie);
+-
+ 	bridge->sysdata = pcie;
+ 	bridge->ops = &advk_pcie_ops;
+ 	bridge->map_irq = advk_pcie_map_irq;
+ 
+ 	ret = pci_host_probe(bridge);
+ 	if (ret < 0) {
+-		irq_set_chained_handler_and_data(pcie->irq, NULL, NULL);
+ 		advk_pcie_remove_rp_irq_domain(pcie);
+ 		advk_pcie_remove_msi_irq_domain(pcie);
+ 		advk_pcie_remove_irq_domain(pcie);
+@@ -1873,9 +1872,6 @@ static int advk_pcie_remove(struct platform_device *pdev)
+ 	advk_writel(pcie, PCIE_ISR1_ALL_MASK, PCIE_ISR1_REG);
+ 	advk_writel(pcie, PCIE_IRQ_ALL_MASK, HOST_CTRL_INT_STATUS_REG);
+ 
+-	/* Remove IRQ handler */
+-	irq_set_chained_handler_and_data(pcie->irq, NULL, NULL);
+-
+ 	/* Remove IRQ domains */
+ 	advk_pcie_remove_rp_irq_domain(pcie);
+ 	advk_pcie_remove_msi_irq_domain(pcie);
+-- 
+2.35.1
+
diff --git a/queue-5.17/riscv-dts-sifive-fu540-c000-align-dma-node-name-with.patch b/queue-5.17/riscv-dts-sifive-fu540-c000-align-dma-node-name-with.patch
new file mode 100644
index 0000000..44d2ff2
--- /dev/null
+++ b/queue-5.17/riscv-dts-sifive-fu540-c000-align-dma-node-name-with.patch
@@ -0,0 +1,38 @@
+From e94f819bac2949208deb4851b10b8011a997209c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Apr 2022 21:38:56 +0200
+Subject: riscv: dts: sifive: fu540-c000: align dma node name with dtschema
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit b17410182b6f98191fbf7f42d3b4a78512769d29 ]
+
+Fixes dtbs_check warnings like:
+
+  dma@3000000: $nodename:0: 'dma@3000000' does not match '^dma-controller(@.*)?$'
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/20220407193856.18223-1-krzysztof.kozlowski@linaro.org
+Fixes: c5ab54e9945b ("riscv: dts: add support for PDMA device of HiFive Unleashed Rev A00")
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/boot/dts/sifive/fu540-c000.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
+index 3eef52b1a59b..fd93fdadd28c 100644
+--- a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
++++ b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
+@@ -167,7 +167,7 @@ uart0: serial@10010000 {
+ 			clocks = <&prci PRCI_CLK_TLCLK>;
+ 			status = "disabled";
+ 		};
+-		dma: dma@3000000 {
++		dma: dma-controller@3000000 {
+ 			compatible = "sifive,fu540-c000-pdma";
+ 			reg = <0x0 0x3000000 0x0 0x8000>;
+ 			interrupt-parent = <&plic0>;
+-- 
+2.35.1
+
diff --git a/queue-5.17/scsi-qla2xxx-fix-missed-dma-unmap-for-aborted-comman.patch b/queue-5.17/scsi-qla2xxx-fix-missed-dma-unmap-for-aborted-comman.patch
new file mode 100644
index 0000000..98b2843
--- /dev/null
+++ b/queue-5.17/scsi-qla2xxx-fix-missed-dma-unmap-for-aborted-comman.patch
@@ -0,0 +1,51 @@
+From f29c3587b51d999fbcf0e8039ab67ef35a64212b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Apr 2022 12:42:29 +0000
+Subject: scsi: qla2xxx: Fix missed DMA unmap for aborted commands
+
+From: Gleb Chesnokov <Chesnokov.G@raidix.com>
+
+[ Upstream commit 26f9ce53817a8fd84b69a73473a7de852a24c897 ]
+
+Aborting commands that have already been sent to the firmware can
+cause BUG in qlt_free_cmd(): BUG_ON(cmd->sg_mapped)
+
+For instance:
+
+ - Command passes rdx_to_xfer state, maps sgl, sends to the firmware
+
+ - Reset occurs, qla2xxx performs ISP error recovery, aborts the command
+
+ - Target stack calls qlt_abort_cmd() and then qlt_free_cmd()
+
+ - BUG_ON(cmd->sg_mapped) in qlt_free_cmd() occurs because sgl was not
+   unmapped
+
+Thus, unmap sgl in qlt_abort_cmd() for commands with the aborted flag set.
+
+Link: https://lore.kernel.org/r/AS8PR10MB4952D545F84B6B1DFD39EC1E9DEE9@AS8PR10MB4952.EURPRD10.PROD.OUTLOOK.COM
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Gleb Chesnokov <Chesnokov.G@raidix.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index b109716d44fb..7ab3c9e4d478 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -3837,6 +3837,9 @@ int qlt_abort_cmd(struct qla_tgt_cmd *cmd)
+ 
+ 	spin_lock_irqsave(&cmd->cmd_lock, flags);
+ 	if (cmd->aborted) {
++		if (cmd->sg_mapped)
++			qlt_unmap_sg(vha, cmd);
++
+ 		spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+ 		/*
+ 		 * It's normal to see 2 calls in this path:
+-- 
+2.35.1
+
diff --git a/queue-5.17/scsi-scsi_dh_alua-properly-handle-the-alua-transitio.patch b/queue-5.17/scsi-scsi_dh_alua-properly-handle-the-alua-transitio.patch
new file mode 100644
index 0000000..b9ddb21
--- /dev/null
+++ b/queue-5.17/scsi-scsi_dh_alua-properly-handle-the-alua-transitio.patch
@@ -0,0 +1,59 @@
+From e2425df3796f1ebf7db0321820cb6e68b0a29f6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 May 2022 08:09:17 -0700
+Subject: scsi: scsi_dh_alua: Properly handle the ALUA transitioning state
+
+From: Brian Bunker <brian@purestorage.com>
+
+[ Upstream commit 6056a92ceb2a7705d61df7ec5370548e96aee258 ]
+
+The handling of the ALUA transitioning state is currently broken. When a
+target goes into this state, it is expected that the target is allowed to
+stay in this state for the implicit transition timeout without a path
+failure. The handler has this logic, but it gets skipped currently.
+
+When the target transitions, there is in-flight I/O from the initiator. The
+first of these responses from the target will be a unit attention letting
+the initiator know that the ALUA state has changed.  The remaining
+in-flight I/Os, before the initiator finds out that the portal state has
+changed, will return not ready, ALUA state is transitioning. The portal
+state will change to SCSI_ACCESS_STATE_TRANSITIONING. This will lead to all
+new I/O immediately failing the path unexpectedly. The path failure happens
+in less than a second instead of the expected successes until the
+transition timer is exceeded.
+
+Allow I/Os to continue while the path is in the ALUA transitioning
+state. The handler already takes care of a target that stays in the
+transitioning state for too long by changing the state to ALUA state
+standby once the transition timeout is exceeded at which point the path
+will fail.
+
+Link: https://lore.kernel.org/r/CAHZQxy+4sTPz9+pY3=7VJH+CLUJsDct81KtnR2be8ycN5mhqTg@mail.gmail.com
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Acked-by: Krishna Kant <krishna.kant@purestorage.com>
+Acked-by: Seamus Connor <sconnor@purestorage.com>
+Signed-off-by: Brian Bunker <brian@purestorage.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/device_handler/scsi_dh_alua.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
+index 37d06f993b76..1d9be771f3ee 100644
+--- a/drivers/scsi/device_handler/scsi_dh_alua.c
++++ b/drivers/scsi/device_handler/scsi_dh_alua.c
+@@ -1172,9 +1172,8 @@ static blk_status_t alua_prep_fn(struct scsi_device *sdev, struct request *req)
+ 	case SCSI_ACCESS_STATE_OPTIMAL:
+ 	case SCSI_ACCESS_STATE_ACTIVE:
+ 	case SCSI_ACCESS_STATE_LBA:
+-		return BLK_STS_OK;
+ 	case SCSI_ACCESS_STATE_TRANSITIONING:
+-		return BLK_STS_AGAIN;
++		return BLK_STS_OK;
+ 	default:
+ 		req->rq_flags |= RQF_QUIET;
+ 		return BLK_STS_IOERR;
+-- 
+2.35.1
+
diff --git a/queue-5.17/scsi-ufs-core-fix-referencing-invalid-rsp-field.patch b/queue-5.17/scsi-ufs-core-fix-referencing-invalid-rsp-field.patch
new file mode 100644
index 0000000..aeb27a6
--- /dev/null
+++ b/queue-5.17/scsi-ufs-core-fix-referencing-invalid-rsp-field.patch
@@ -0,0 +1,63 @@
+From 174ceeb3fed5abcc435dfee6ff0e87801dafcfcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 May 2022 15:05:29 +0900
+Subject: scsi: ufs: core: Fix referencing invalid rsp field
+
+From: Daejun Park <daejun7.park@samsung.com>
+
+[ Upstream commit d5d92b64408443e113b9742f8f1c35278910dd4d ]
+
+Fix referencing sense data when it is invalid. When the length of the data
+segment is 0, there is no valid information in the rsp field, so
+ufshpb_rsp_upiu() is returned without additional operation.
+
+Link: https://lore.kernel.org/r/252651381.41652940482659.JavaMail.epsvc@epcpadp4
+Fixes: 4b5f49079c52 ("scsi: ufs: ufshpb: L2P map management for HPB read")
+Acked-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Daejun Park <daejun7.park@samsung.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshpb.c | 19 +++++++------------
+ 1 file changed, 7 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshpb.c b/drivers/scsi/ufs/ufshpb.c
+index b34feba1f53d..8dc818b03939 100644
+--- a/drivers/scsi/ufs/ufshpb.c
++++ b/drivers/scsi/ufs/ufshpb.c
+@@ -1256,6 +1256,13 @@ void ufshpb_rsp_upiu(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
+ 	struct utp_hpb_rsp *rsp_field = &lrbp->ucd_rsp_ptr->hr;
+ 	int data_seg_len;
+ 
++	data_seg_len = be32_to_cpu(lrbp->ucd_rsp_ptr->header.dword_2)
++		& MASK_RSP_UPIU_DATA_SEG_LEN;
++
++	/* If data segment length is zero, rsp_field is not valid */
++	if (!data_seg_len)
++		return;
++
+ 	if (unlikely(lrbp->lun != rsp_field->lun)) {
+ 		struct scsi_device *sdev;
+ 		bool found = false;
+@@ -1290,18 +1297,6 @@ void ufshpb_rsp_upiu(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
+ 		return;
+ 	}
+ 
+-	data_seg_len = be32_to_cpu(lrbp->ucd_rsp_ptr->header.dword_2)
+-		& MASK_RSP_UPIU_DATA_SEG_LEN;
+-
+-	/* To flush remained rsp_list, we queue the map_work task */
+-	if (!data_seg_len) {
+-		if (!ufshpb_is_general_lun(hpb->lun))
+-			return;
+-
+-		ufshpb_kick_map_work(hpb);
+-		return;
+-	}
+-
+ 	BUILD_BUG_ON(sizeof(struct utp_hpb_rsp) != UTP_HPB_RSP_SIZE);
+ 
+ 	if (!ufshpb_is_hpb_rsp_valid(hba, lrbp, rsp_field))
+-- 
+2.35.1
+
diff --git a/queue-5.17/selftests-add-ping-test-with-ping_group_range-tuned.patch b/queue-5.17/selftests-add-ping-test-with-ping_group_range-tuned.patch
new file mode 100644
index 0000000..9ba5370
--- /dev/null
+++ b/queue-5.17/selftests-add-ping-test-with-ping_group_range-tuned.patch
@@ -0,0 +1,67 @@
+From 32779761e91ba0ecc19000e5690a69df55e60135 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 May 2022 11:07:39 +0200
+Subject: selftests: add ping test with ping_group_range tuned
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit e71b7f1f44d3d88c677769c85ef0171caf9fc89f ]
+
+The 'ping' utility is able to manage two kind of sockets (raw or icmp),
+depending on the sysctl ping_group_range. By default, ping_group_range is
+set to '1 0', which forces ping to use an ip raw socket.
+
+Let's replay the ping tests by allowing 'ping' to use the ip icmp socket.
+After the previous patch, ipv4 tests results are the same with both kinds
+of socket. For ipv6, there are a lot a new failures (the previous patch
+fixes only two cases).
+
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index 3f4c8cfe7aca..7cd9b31d0307 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -810,10 +810,16 @@ ipv4_ping()
+ 	setup
+ 	set_sysctl net.ipv4.raw_l3mdev_accept=1 2>/dev/null
+ 	ipv4_ping_novrf
++	setup
++	set_sysctl net.ipv4.ping_group_range='0 2147483647' 2>/dev/null
++	ipv4_ping_novrf
+ 
+ 	log_subsection "With VRF"
+ 	setup "yes"
+ 	ipv4_ping_vrf
++	setup "yes"
++	set_sysctl net.ipv4.ping_group_range='0 2147483647' 2>/dev/null
++	ipv4_ping_vrf
+ }
+ 
+ ################################################################################
+@@ -2348,10 +2354,16 @@ ipv6_ping()
+ 	log_subsection "No VRF"
+ 	setup
+ 	ipv6_ping_novrf
++	setup
++	set_sysctl net.ipv4.ping_group_range='0 2147483647' 2>/dev/null
++	ipv6_ping_novrf
+ 
+ 	log_subsection "With VRF"
+ 	setup "yes"
+ 	ipv6_ping_vrf
++	setup "yes"
++	set_sysctl net.ipv4.ping_group_range='0 2147483647' 2>/dev/null
++	ipv6_ping_vrf
+ }
+ 
+ ################################################################################
+-- 
+2.35.1
+
diff --git a/queue-5.17/series b/queue-5.17/series
index d8b041d..b678f2b 100644
--- a/queue-5.17/series
+++ b/queue-5.17/series
@@ -65,3 +65,90 @@
 drm-dp-mst-fix-a-possible-memory-leak-in-fetch_monitor_name.patch
 dma-buf-fix-use-of-dma_buf_set_name_-a-b-in-userspace.patch
 dma-buf-ensure-unique-directory-name-for-dmabuf-stats.patch
+arm64-dts-qcom-sm8250-don-t-enable-rx-tx-macro-by-de.patch
+arm-dts-aspeed-g6-remove-fwqspid-group-in-pinctrl-dt.patch
+pinctrl-pinctrl-aspeed-g6-remove-fwqspid-group-in-pi.patch
+arm-dts-aspeed-g6-fix-spi1-spi2-quad-pin-group.patch
+arm-dts-aspeed-add-video-engine-to-g6.patch
+pinctrl-ocelot-fix-for-lan966x-alt-mode.patch
+pinctrl-mediatek-mt8365-fix-ies-control-pins.patch
+alsa-hda-fix-unused-realtek-function-when-pm-is-not-.patch
+net-ipa-certain-dropped-packets-aren-t-accounted-for.patch
+net-ipa-record-proper-rx-transaction-count.patch
+block-mq-deadline-set-the-fifo_time-member-also-if-i.patch
+mptcp-fix-subflow-accounting-on-close.patch
+net-macb-increment-rx-bd-head-after-allocating-skb-a.patch
+i915-guc-reset-make-__guc_reset_context-aware-of-gui.patch
+xfrm-rework-default-policy-structure.patch
+xfrm-fix-disable_policy-flag-use-when-arriving-from-.patch
+net-sched-act_pedit-sanitize-shift-argument-before-u.patch
+netfilter-flowtable-fix-excessive-hw-offload-attempt.patch
+netfilter-nft_flow_offload-skip-dst-neigh-lookup-for.patch
+net-fix-dev_fill_forward_path-with-pppoe-bridge.patch
+netfilter-nft_flow_offload-fix-offload-with-pppoe-vl.patch
+ptp-ocp-have-adjtime-handle-negative-delta_ns-correc.patch
+revert-pci-aardvark-rewrite-irq-code-to-chained-irq-.patch
+net-lan966x-fix-assignment-of-the-mac-address.patch
+net-systemport-fix-an-error-handling-path-in-bcm_sys.patch
+net-vmxnet3-fix-possible-use-after-free-bugs-in-vmxn.patch
+net-vmxnet3-fix-possible-null-pointer-dereference-in.patch
+arm64-kexec-load-from-kimage-prior-to-clobbering.patch
+ice-fix-crash-when-writing-timestamp-on-rx-rings.patch
+ice-fix-possible-under-reporting-of-ethtool-tx-and-r.patch
+ice-fix-interrupt-moderation-settings-getting-cleare.patch
+clk-at91-generated-consider-range-when-calculating-b.patch
+net-qla3xxx-fix-a-test-in-ql_reset_work.patch
+nfc-nci-fix-sleep-in-atomic-context-bugs-caused-by-n.patch
+net-mlx5-dr-fix-missing-flow_source-when-creating-mu.patch
+net-mlx5-initialize-flow-steering-during-driver-prob.patch
+net-mlx5-dr-ignore-modify-ttl-on-rx-if-device-doesn-.patch
+net-mlx5e-block-rx-gro-hw-feature-in-switchdev-mode.patch
+net-mlx5e-properly-block-lro-when-xdp-is-enabled.patch
+net-mlx5e-properly-block-hw-gro-when-xdp-is-enabled.patch
+net-mlx5e-remove-hw-gro-from-reported-features.patch
+net-mlx5-drain-fw_reset-when-removing-device.patch
+net-af_key-add-check-for-pfkey_broadcast-in-function.patch
+arm-9196-1-spectre-bhb-enable-for-cortex-a15.patch
+arm-9197-1-spectre-bhb-fix-loop8-sequence-for-thumb2.patch
+mptcp-fix-checksum-byte-order.patch
+mptcp-strict-local-address-id-selection.patch
+mptcp-do-tcp-fallback-on-early-dss-checksum-failure.patch
+igb-skip-phy-status-check-where-unavailable.patch
+netfilter-flowtable-fix-tcp-flow-teardown.patch
+netfilter-flowtable-pass-flowtable-to-nf_flow_table_.patch
+netfilter-flowtable-move-dst_check-to-packet-path.patch
+vdpa-mlx5-use-consistent-rqt-size.patch
+net-bridge-clear-offload_fwd_mark-when-passing-frame.patch
+riscv-dts-sifive-fu540-c000-align-dma-node-name-with.patch
+scsi-ufs-core-fix-referencing-invalid-rsp-field.patch
+kvm-x86-pmu-fix-the-compare-function-used-by-the-pmu.patch
+perf-build-fix-check-for-btf__load_from_kernel_by_id.patch
+perf-stat-fix-and-validate-cpu-map-inputs-in-synthet.patch
+gpio-gpio-vf610-do-not-touch-other-bits-when-set-the.patch
+gpio-mvebu-pwm-refuse-requests-with-inverted-polarit.patch
+perf-test-fix-all-pmu-test-to-skip-hv_24x7-hv_gpci-t.patch
+perf-regs-x86-fix-arch__intr_reg_mask-for-the-hybrid.patch
+perf-bench-numa-address-compiler-error-on-s390.patch
+perf-test-bpf-skip-test-if-clang-is-not-present.patch
+scsi-scsi_dh_alua-properly-handle-the-alua-transitio.patch
+scsi-qla2xxx-fix-missed-dma-unmap-for-aborted-comman.patch
+mac80211-fix-rx-reordering-with-non-explicit-psmp-ac.patch
+nl80211-validate-s1g-channel-width.patch
+cfg80211-retrieve-s1g-operating-channel-number.patch
+selftests-add-ping-test-with-ping_group_range-tuned.patch
+revert-fbdev-make-fb_release-return-enodev-if-fbdev-.patch
+fbdev-prevent-possible-use-after-free-in-fb_release.patch
+platform-x86-thinkpad_acpi-convert-btusb-dmi-list-to.patch
+platform-x86-thinkpad_acpi-correct-dual-fan-probe.patch
+platform-x86-intel-fix-rmmod-pmt_telemetry-panic.patch
+platform-surface-gpe-add-support-for-surface-pro-8.patch
+drm-amd-display-undo-clearing-of-z10-related-functio.patch
+net-fix-wrong-network-header-length.patch
+nl80211-fix-locking-in-nl80211_set_tx_bitrate_mask.patch
+ethernet-tulip-fix-missing-pci_disable_device-on-err.patch
+net-stmmac-fix-missing-pci_disable_device-on-error-i.patch
+net-atlantic-fix-frag-0-not-initialized.patch
+net-atlantic-reduce-scope-of-is_rsc_complete.patch
+net-atlantic-add-check-for-max_skb_frags.patch
+net-atlantic-verify-hw_head_-lies-within-tx-buffer-r.patch
+arm64-enable-repeat-tlbi-workaround-on-kryo4xx-gold-.patch
diff --git a/queue-5.17/vdpa-mlx5-use-consistent-rqt-size.patch b/queue-5.17/vdpa-mlx5-use-consistent-rqt-size.patch
new file mode 100644
index 0000000..ec487f7
--- /dev/null
+++ b/queue-5.17/vdpa-mlx5-use-consistent-rqt-size.patch
@@ -0,0 +1,223 @@
+From 89d8069ddaafcc1310ba6d335ccf29f3e13de70a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 May 2022 11:47:35 +0300
+Subject: vdpa/mlx5: Use consistent RQT size
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit acde3929492bcb9ceb0df1270230c422b1013798 ]
+
+The current code evaluates RQT size based on the configured number of
+virtqueues. This can raise an issue in the following scenario:
+
+Assume MQ was negotiated.
+1. mlx5_vdpa_set_map() gets called.
+2. handle_ctrl_mq() is called setting cur_num_vqs to some value, lower
+   than the configured max VQs.
+3. A second set_map gets called, but now a smaller number of VQs is used
+   to evaluate the size of the RQT.
+4. handle_ctrl_mq() is called with a value larger than what the RQT can
+   hold. This will emit errors and the driver state is compromised.
+
+To fix this, we use a new field in struct mlx5_vdpa_net to hold the
+required number of entries in the RQT. This value is evaluated in
+mlx5_vdpa_set_driver_features() where we have the negotiated features
+all set up.
+
+In addition to that, we take into consideration the max capability of RQT
+entries early when the device is added so we don't need to take consider
+it when creating the RQT.
+
+Last, we remove the use of mlx5_vdpa_max_qps() which just returns the
+max_vas / 2 and make the code clearer.
+
+Fixes: 52893733f2c5 ("vdpa/mlx5: Add multiqueue support")
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/mlx5/net/mlx5_vnet.c | 61 +++++++++++--------------------
+ 1 file changed, 21 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+index 1b5de3af1a62..9c45be8ab178 100644
+--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+@@ -161,6 +161,7 @@ struct mlx5_vdpa_net {
+ 	struct mlx5_flow_handle *rx_rule_mcast;
+ 	bool setup;
+ 	u32 cur_num_vqs;
++	u32 rqt_size;
+ 	struct notifier_block nb;
+ 	struct vdpa_callback config_cb;
+ 	struct mlx5_vdpa_wq_ent cvq_ent;
+@@ -204,17 +205,12 @@ static __virtio16 cpu_to_mlx5vdpa16(struct mlx5_vdpa_dev *mvdev, u16 val)
+ 	return __cpu_to_virtio16(mlx5_vdpa_is_little_endian(mvdev), val);
+ }
+ 
+-static inline u32 mlx5_vdpa_max_qps(int max_vqs)
+-{
+-	return max_vqs / 2;
+-}
+-
+ static u16 ctrl_vq_idx(struct mlx5_vdpa_dev *mvdev)
+ {
+ 	if (!(mvdev->actual_features & BIT_ULL(VIRTIO_NET_F_MQ)))
+ 		return 2;
+ 
+-	return 2 * mlx5_vdpa_max_qps(mvdev->max_vqs);
++	return mvdev->max_vqs;
+ }
+ 
+ static bool is_ctrl_vq_idx(struct mlx5_vdpa_dev *mvdev, u16 idx)
+@@ -1236,25 +1232,13 @@ static void teardown_vq(struct mlx5_vdpa_net *ndev, struct mlx5_vdpa_virtqueue *
+ static int create_rqt(struct mlx5_vdpa_net *ndev)
+ {
+ 	__be32 *list;
+-	int max_rqt;
+ 	void *rqtc;
+ 	int inlen;
+ 	void *in;
+ 	int i, j;
+ 	int err;
+-	int num;
+-
+-	if (!(ndev->mvdev.actual_features & BIT_ULL(VIRTIO_NET_F_MQ)))
+-		num = 1;
+-	else
+-		num = ndev->cur_num_vqs / 2;
+ 
+-	max_rqt = min_t(int, roundup_pow_of_two(num),
+-			1 << MLX5_CAP_GEN(ndev->mvdev.mdev, log_max_rqt_size));
+-	if (max_rqt < 1)
+-		return -EOPNOTSUPP;
+-
+-	inlen = MLX5_ST_SZ_BYTES(create_rqt_in) + max_rqt * MLX5_ST_SZ_BYTES(rq_num);
++	inlen = MLX5_ST_SZ_BYTES(create_rqt_in) + ndev->rqt_size * MLX5_ST_SZ_BYTES(rq_num);
+ 	in = kzalloc(inlen, GFP_KERNEL);
+ 	if (!in)
+ 		return -ENOMEM;
+@@ -1263,12 +1247,12 @@ static int create_rqt(struct mlx5_vdpa_net *ndev)
+ 	rqtc = MLX5_ADDR_OF(create_rqt_in, in, rqt_context);
+ 
+ 	MLX5_SET(rqtc, rqtc, list_q_type, MLX5_RQTC_LIST_Q_TYPE_VIRTIO_NET_Q);
+-	MLX5_SET(rqtc, rqtc, rqt_max_size, max_rqt);
++	MLX5_SET(rqtc, rqtc, rqt_max_size, ndev->rqt_size);
+ 	list = MLX5_ADDR_OF(rqtc, rqtc, rq_num[0]);
+-	for (i = 0, j = 0; i < max_rqt; i++, j += 2)
+-		list[i] = cpu_to_be32(ndev->vqs[j % (2 * num)].virtq_id);
++	for (i = 0, j = 0; i < ndev->rqt_size; i++, j += 2)
++		list[i] = cpu_to_be32(ndev->vqs[j % ndev->cur_num_vqs].virtq_id);
+ 
+-	MLX5_SET(rqtc, rqtc, rqt_actual_size, max_rqt);
++	MLX5_SET(rqtc, rqtc, rqt_actual_size, ndev->rqt_size);
+ 	err = mlx5_vdpa_create_rqt(&ndev->mvdev, in, inlen, &ndev->res.rqtn);
+ 	kfree(in);
+ 	if (err)
+@@ -1282,19 +1266,13 @@ static int create_rqt(struct mlx5_vdpa_net *ndev)
+ static int modify_rqt(struct mlx5_vdpa_net *ndev, int num)
+ {
+ 	__be32 *list;
+-	int max_rqt;
+ 	void *rqtc;
+ 	int inlen;
+ 	void *in;
+ 	int i, j;
+ 	int err;
+ 
+-	max_rqt = min_t(int, roundup_pow_of_two(ndev->cur_num_vqs / 2),
+-			1 << MLX5_CAP_GEN(ndev->mvdev.mdev, log_max_rqt_size));
+-	if (max_rqt < 1)
+-		return -EOPNOTSUPP;
+-
+-	inlen = MLX5_ST_SZ_BYTES(modify_rqt_in) + max_rqt * MLX5_ST_SZ_BYTES(rq_num);
++	inlen = MLX5_ST_SZ_BYTES(modify_rqt_in) + ndev->rqt_size * MLX5_ST_SZ_BYTES(rq_num);
+ 	in = kzalloc(inlen, GFP_KERNEL);
+ 	if (!in)
+ 		return -ENOMEM;
+@@ -1305,10 +1283,10 @@ static int modify_rqt(struct mlx5_vdpa_net *ndev, int num)
+ 	MLX5_SET(rqtc, rqtc, list_q_type, MLX5_RQTC_LIST_Q_TYPE_VIRTIO_NET_Q);
+ 
+ 	list = MLX5_ADDR_OF(rqtc, rqtc, rq_num[0]);
+-	for (i = 0, j = 0; i < max_rqt; i++, j += 2)
++	for (i = 0, j = 0; i < ndev->rqt_size; i++, j += 2)
+ 		list[i] = cpu_to_be32(ndev->vqs[j % num].virtq_id);
+ 
+-	MLX5_SET(rqtc, rqtc, rqt_actual_size, max_rqt);
++	MLX5_SET(rqtc, rqtc, rqt_actual_size, ndev->rqt_size);
+ 	err = mlx5_vdpa_modify_rqt(&ndev->mvdev, in, inlen, ndev->res.rqtn);
+ 	kfree(in);
+ 	if (err)
+@@ -1582,7 +1560,7 @@ static virtio_net_ctrl_ack handle_ctrl_mq(struct mlx5_vdpa_dev *mvdev, u8 cmd)
+ 
+ 		newqps = mlx5vdpa16_to_cpu(mvdev, mq.virtqueue_pairs);
+ 		if (newqps < VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MIN ||
+-		    newqps > mlx5_vdpa_max_qps(mvdev->max_vqs))
++		    newqps > ndev->rqt_size)
+ 			break;
+ 
+ 		if (ndev->cur_num_vqs == 2 * newqps) {
+@@ -1937,7 +1915,7 @@ static int setup_virtqueues(struct mlx5_vdpa_dev *mvdev)
+ 	int err;
+ 	int i;
+ 
+-	for (i = 0; i < 2 * mlx5_vdpa_max_qps(mvdev->max_vqs); i++) {
++	for (i = 0; i < mvdev->max_vqs; i++) {
+ 		err = setup_vq(ndev, &ndev->vqs[i]);
+ 		if (err)
+ 			goto err_vq;
+@@ -2008,9 +1986,11 @@ static int mlx5_vdpa_set_driver_features(struct vdpa_device *vdev, u64 features)
+ 
+ 	ndev->mvdev.actual_features = features & ndev->mvdev.mlx_features;
+ 	if (ndev->mvdev.actual_features & BIT_ULL(VIRTIO_NET_F_MQ))
+-		ndev->cur_num_vqs = 2 * mlx5vdpa16_to_cpu(mvdev, ndev->config.max_virtqueue_pairs);
++		ndev->rqt_size = mlx5vdpa16_to_cpu(mvdev, ndev->config.max_virtqueue_pairs);
+ 	else
+-		ndev->cur_num_vqs = 2;
++		ndev->rqt_size = 1;
++
++	ndev->cur_num_vqs = 2 * ndev->rqt_size;
+ 
+ 	update_cvq_info(mvdev);
+ 	return err;
+@@ -2463,7 +2443,7 @@ static void init_mvqs(struct mlx5_vdpa_net *ndev)
+ 	struct mlx5_vdpa_virtqueue *mvq;
+ 	int i;
+ 
+-	for (i = 0; i < 2 * mlx5_vdpa_max_qps(ndev->mvdev.max_vqs); ++i) {
++	for (i = 0; i < ndev->mvdev.max_vqs; ++i) {
+ 		mvq = &ndev->vqs[i];
+ 		memset(mvq, 0, offsetof(struct mlx5_vdpa_virtqueue, ri));
+ 		mvq->index = i;
+@@ -2583,7 +2563,8 @@ static int mlx5_vdpa_dev_add(struct vdpa_mgmt_dev *v_mdev, const char *name,
+ 		return -EOPNOTSUPP;
+ 	}
+ 
+-	max_vqs = MLX5_CAP_DEV_VDPA_EMULATION(mdev, max_num_virtio_queues);
++	max_vqs = min_t(int, MLX5_CAP_DEV_VDPA_EMULATION(mdev, max_num_virtio_queues),
++			1 << MLX5_CAP_GEN(mdev, log_max_rqt_size));
+ 	if (max_vqs < 2) {
+ 		dev_warn(mdev->device,
+ 			 "%d virtqueues are supported. At least 2 are required\n",
+@@ -2647,7 +2628,7 @@ static int mlx5_vdpa_dev_add(struct vdpa_mgmt_dev *v_mdev, const char *name,
+ 		ndev->mvdev.mlx_features |= BIT_ULL(VIRTIO_NET_F_MAC);
+ 	}
+ 
+-	config->max_virtqueue_pairs = cpu_to_mlx5vdpa16(mvdev, mlx5_vdpa_max_qps(max_vqs));
++	config->max_virtqueue_pairs = cpu_to_mlx5vdpa16(mvdev, max_vqs / 2);
+ 	mvdev->vdev.dma_dev = &mdev->pdev->dev;
+ 	err = mlx5_vdpa_alloc_resources(&ndev->mvdev);
+ 	if (err)
+@@ -2674,7 +2655,7 @@ static int mlx5_vdpa_dev_add(struct vdpa_mgmt_dev *v_mdev, const char *name,
+ 	ndev->nb.notifier_call = event_handler;
+ 	mlx5_notifier_register(mdev, &ndev->nb);
+ 	mvdev->vdev.mdev = &mgtdev->mgtdev;
+-	err = _vdpa_register_device(&mvdev->vdev, 2 * mlx5_vdpa_max_qps(max_vqs) + 1);
++	err = _vdpa_register_device(&mvdev->vdev, max_vqs + 1);
+ 	if (err)
+ 		goto err_reg;
+ 
+-- 
+2.35.1
+
diff --git a/queue-5.17/xfrm-fix-disable_policy-flag-use-when-arriving-from-.patch b/queue-5.17/xfrm-fix-disable_policy-flag-use-when-arriving-from-.patch
new file mode 100644
index 0000000..c9bbac4
--- /dev/null
+++ b/queue-5.17/xfrm-fix-disable_policy-flag-use-when-arriving-from-.patch
@@ -0,0 +1,183 @@
+From 306a7682e53557656e82564c04fc458dc4aeb81e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 May 2022 23:34:02 +0300
+Subject: xfrm: fix "disable_policy" flag use when arriving from different
+ devices
+
+From: Eyal Birger <eyal.birger@gmail.com>
+
+[ Upstream commit e6175a2ed1f18bf2f649625bf725e07adcfa6a28 ]
+
+In IPv4 setting the "disable_policy" flag on a device means no policy
+should be enforced for traffic originating from the device. This was
+implemented by seting the DST_NOPOLICY flag in the dst based on the
+originating device.
+
+However, dsts are cached in nexthops regardless of the originating
+devices, in which case, the DST_NOPOLICY flag value may be incorrect.
+
+Consider the following setup:
+
+                     +------------------------------+
+                     | ROUTER                       |
+  +-------------+    | +-----------------+          |
+  | ipsec src   |----|-|ipsec0           |          |
+  +-------------+    | |disable_policy=0 |   +----+ |
+                     | +-----------------+   |eth1|-|-----
+  +-------------+    | +-----------------+   +----+ |
+  | noipsec src |----|-|eth0             |          |
+  +-------------+    | |disable_policy=1 |          |
+                     | +-----------------+          |
+                     +------------------------------+
+
+Where ROUTER has a default route towards eth1.
+
+dst entries for traffic arriving from eth0 would have DST_NOPOLICY
+and would be cached and therefore can be reused by traffic originating
+from ipsec0, skipping policy check.
+
+Fix by setting a IPSKB_NOPOLICY flag in IPCB and observing it instead
+of the DST in IN/FWD IPv4 policy checks.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
+Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip.h   |  1 +
+ include/net/xfrm.h | 14 +++++++++++++-
+ net/ipv4/route.c   | 23 ++++++++++++++++++-----
+ 3 files changed, 32 insertions(+), 6 deletions(-)
+
+diff --git a/include/net/ip.h b/include/net/ip.h
+index b51bae43b0dd..9fba950fdf12 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -56,6 +56,7 @@ struct inet_skb_parm {
+ #define IPSKB_DOREDIRECT	BIT(5)
+ #define IPSKB_FRAG_PMTU		BIT(6)
+ #define IPSKB_L3SLAVE		BIT(7)
++#define IPSKB_NOPOLICY		BIT(8)
+ 
+ 	u16			frag_max_size;
+ };
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index 6fb899ff5afc..d2efddce65d4 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1093,6 +1093,18 @@ static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb,
+ 	return false;
+ }
+ 
++static inline bool __xfrm_check_dev_nopolicy(struct sk_buff *skb,
++					     int dir, unsigned short family)
++{
++	if (dir != XFRM_POLICY_OUT && family == AF_INET) {
++		/* same dst may be used for traffic originating from
++		 * devices with different policy settings.
++		 */
++		return IPCB(skb)->flags & IPSKB_NOPOLICY;
++	}
++	return skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY);
++}
++
+ static inline int __xfrm_policy_check2(struct sock *sk, int dir,
+ 				       struct sk_buff *skb,
+ 				       unsigned int family, int reverse)
+@@ -1104,7 +1116,7 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir,
+ 		return __xfrm_policy_check(sk, ndir, skb, family);
+ 
+ 	return __xfrm_check_nopolicy(net, skb, dir) ||
+-	       (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) ||
++	       __xfrm_check_dev_nopolicy(skb, dir, family) ||
+ 	       __xfrm_policy_check(sk, ndir, skb, family);
+ }
+ 
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index eef07b62b2d8..1cdfac733bd8 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1721,6 +1721,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+ 	struct in_device *in_dev = __in_dev_get_rcu(dev);
+ 	unsigned int flags = RTCF_MULTICAST;
+ 	struct rtable *rth;
++	bool no_policy;
+ 	u32 itag = 0;
+ 	int err;
+ 
+@@ -1731,8 +1732,12 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+ 	if (our)
+ 		flags |= RTCF_LOCAL;
+ 
++	no_policy = IN_DEV_ORCONF(in_dev, NOPOLICY);
++	if (no_policy)
++		IPCB(skb)->flags |= IPSKB_NOPOLICY;
++
+ 	rth = rt_dst_alloc(dev_net(dev)->loopback_dev, flags, RTN_MULTICAST,
+-			   IN_DEV_ORCONF(in_dev, NOPOLICY), false);
++			   no_policy, false);
+ 	if (!rth)
+ 		return -ENOBUFS;
+ 
+@@ -1791,7 +1796,7 @@ static int __mkroute_input(struct sk_buff *skb,
+ 	struct rtable *rth;
+ 	int err;
+ 	struct in_device *out_dev;
+-	bool do_cache;
++	bool do_cache, no_policy;
+ 	u32 itag = 0;
+ 
+ 	/* get a working reference to the output device */
+@@ -1836,6 +1841,10 @@ static int __mkroute_input(struct sk_buff *skb,
+ 		}
+ 	}
+ 
++	no_policy = IN_DEV_ORCONF(in_dev, NOPOLICY);
++	if (no_policy)
++		IPCB(skb)->flags |= IPSKB_NOPOLICY;
++
+ 	fnhe = find_exception(nhc, daddr);
+ 	if (do_cache) {
+ 		if (fnhe)
+@@ -1848,8 +1857,7 @@ static int __mkroute_input(struct sk_buff *skb,
+ 		}
+ 	}
+ 
+-	rth = rt_dst_alloc(out_dev->dev, 0, res->type,
+-			   IN_DEV_ORCONF(in_dev, NOPOLICY),
++	rth = rt_dst_alloc(out_dev->dev, 0, res->type, no_policy,
+ 			   IN_DEV_ORCONF(out_dev, NOXFRM));
+ 	if (!rth) {
+ 		err = -ENOBUFS;
+@@ -2224,6 +2232,7 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+ 	struct rtable	*rth;
+ 	struct flowi4	fl4;
+ 	bool do_cache = true;
++	bool no_policy;
+ 
+ 	/* IP on this device is disabled. */
+ 
+@@ -2341,6 +2350,10 @@ out:	return err;
+ 	RT_CACHE_STAT_INC(in_brd);
+ 
+ local_input:
++	no_policy = IN_DEV_ORCONF(in_dev, NOPOLICY);
++	if (no_policy)
++		IPCB(skb)->flags |= IPSKB_NOPOLICY;
++
+ 	do_cache &= res->fi && !itag;
+ 	if (do_cache) {
+ 		struct fib_nh_common *nhc = FIB_RES_NHC(*res);
+@@ -2355,7 +2368,7 @@ out:	return err;
+ 
+ 	rth = rt_dst_alloc(ip_rt_get_dev(net, res),
+ 			   flags | RTCF_LOCAL, res->type,
+-			   IN_DEV_ORCONF(in_dev, NOPOLICY), false);
++			   no_policy, false);
+ 	if (!rth)
+ 		goto e_nobufs;
+ 
+-- 
+2.35.1
+
diff --git a/queue-5.17/xfrm-rework-default-policy-structure.patch b/queue-5.17/xfrm-rework-default-policy-structure.patch
new file mode 100644
index 0000000..659f1af
--- /dev/null
+++ b/queue-5.17/xfrm-rework-default-policy-structure.patch
@@ -0,0 +1,237 @@
+From 907016b293f6d252ee94fdfb1fad394fa65003f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Mar 2022 11:38:22 +0100
+Subject: xfrm: rework default policy structure
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit b58b1f563ab78955d37e9e43e02790a85c66ac05 ]
+
+This is a follow up of commit f8d858e607b2 ("xfrm: make user policy API
+complete"). The goal is to align userland API to the internal structures.
+
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reviewed-by:  Antony Antony <antony.antony@secunet.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netns/xfrm.h |  6 +----
+ include/net/xfrm.h       | 48 +++++++++++++++-------------------------
+ net/xfrm/xfrm_policy.c   | 10 ++++++---
+ net/xfrm/xfrm_user.c     | 43 +++++++++++++++--------------------
+ 4 files changed, 44 insertions(+), 63 deletions(-)
+
+diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h
+index 947733a639a6..bd7c3be4af5d 100644
+--- a/include/net/netns/xfrm.h
++++ b/include/net/netns/xfrm.h
+@@ -66,11 +66,7 @@ struct netns_xfrm {
+ 	int			sysctl_larval_drop;
+ 	u32			sysctl_acq_expires;
+ 
+-	u8			policy_default;
+-#define XFRM_POL_DEFAULT_IN	1
+-#define XFRM_POL_DEFAULT_OUT	2
+-#define XFRM_POL_DEFAULT_FWD	4
+-#define XFRM_POL_DEFAULT_MASK	7
++	u8			policy_default[XFRM_POLICY_MAX];
+ 
+ #ifdef CONFIG_SYSCTL
+ 	struct ctl_table_header	*sysctl_hdr;
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index 76aa6f11a540..6fb899ff5afc 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1081,25 +1081,18 @@ xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, un
+ }
+ 
+ #ifdef CONFIG_XFRM
+-static inline bool
+-xfrm_default_allow(struct net *net, int dir)
+-{
+-	u8 def = net->xfrm.policy_default;
+-
+-	switch (dir) {
+-	case XFRM_POLICY_IN:
+-		return def & XFRM_POL_DEFAULT_IN ? false : true;
+-	case XFRM_POLICY_OUT:
+-		return def & XFRM_POL_DEFAULT_OUT ? false : true;
+-	case XFRM_POLICY_FWD:
+-		return def & XFRM_POL_DEFAULT_FWD ? false : true;
+-	}
+-	return false;
+-}
+-
+ int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
+ 			unsigned short family);
+ 
++static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb,
++					 int dir)
++{
++	if (!net->xfrm.policy_count[dir] && !secpath_exists(skb))
++		return net->xfrm.policy_default[dir] == XFRM_USERPOLICY_ACCEPT;
++
++	return false;
++}
++
+ static inline int __xfrm_policy_check2(struct sock *sk, int dir,
+ 				       struct sk_buff *skb,
+ 				       unsigned int family, int reverse)
+@@ -1110,13 +1103,9 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir,
+ 	if (sk && sk->sk_policy[XFRM_POLICY_IN])
+ 		return __xfrm_policy_check(sk, ndir, skb, family);
+ 
+-	if (xfrm_default_allow(net, dir))
+-		return (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) ||
+-		       (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) ||
+-		       __xfrm_policy_check(sk, ndir, skb, family);
+-	else
+-		return (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) ||
+-		       __xfrm_policy_check(sk, ndir, skb, family);
++	return __xfrm_check_nopolicy(net, skb, dir) ||
++	       (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) ||
++	       __xfrm_policy_check(sk, ndir, skb, family);
+ }
+ 
+ static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
+@@ -1168,13 +1157,12 @@ static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
+ {
+ 	struct net *net = dev_net(skb->dev);
+ 
+-	if (xfrm_default_allow(net, XFRM_POLICY_OUT))
+-		return !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
+-			(skb_dst(skb)->flags & DST_NOXFRM) ||
+-			__xfrm_route_forward(skb, family);
+-	else
+-		return (skb_dst(skb)->flags & DST_NOXFRM) ||
+-			__xfrm_route_forward(skb, family);
++	if (!net->xfrm.policy_count[XFRM_POLICY_OUT] &&
++	    net->xfrm.policy_default[XFRM_POLICY_OUT] == XFRM_USERPOLICY_ACCEPT)
++		return true;
++
++	return (skb_dst(skb)->flags & DST_NOXFRM) ||
++	       __xfrm_route_forward(skb, family);
+ }
+ 
+ static inline int xfrm4_route_forward(struct sk_buff *skb)
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 882526159d3a..19aa994f5d2c 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -3158,7 +3158,7 @@ struct dst_entry *xfrm_lookup_with_ifid(struct net *net,
+ 
+ nopol:
+ 	if (!(dst_orig->dev->flags & IFF_LOOPBACK) &&
+-	    !xfrm_default_allow(net, dir)) {
++	    net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK) {
+ 		err = -EPERM;
+ 		goto error;
+ 	}
+@@ -3569,7 +3569,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
+ 	}
+ 
+ 	if (!pol) {
+-		if (!xfrm_default_allow(net, dir)) {
++		if (net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK) {
+ 			XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOPOLS);
+ 			return 0;
+ 		}
+@@ -3629,7 +3629,8 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
+ 		}
+ 		xfrm_nr = ti;
+ 
+-		if (!xfrm_default_allow(net, dir) && !xfrm_nr) {
++		if (net->xfrm.policy_default[dir] == XFRM_USERPOLICY_BLOCK &&
++		    !xfrm_nr) {
+ 			XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
+ 			goto reject;
+ 		}
+@@ -4118,6 +4119,9 @@ static int __net_init xfrm_net_init(struct net *net)
+ 	spin_lock_init(&net->xfrm.xfrm_policy_lock);
+ 	seqcount_spinlock_init(&net->xfrm.xfrm_policy_hash_generation, &net->xfrm.xfrm_policy_lock);
+ 	mutex_init(&net->xfrm.xfrm_cfg_mutex);
++	net->xfrm.policy_default[XFRM_POLICY_IN] = XFRM_USERPOLICY_ACCEPT;
++	net->xfrm.policy_default[XFRM_POLICY_FWD] = XFRM_USERPOLICY_ACCEPT;
++	net->xfrm.policy_default[XFRM_POLICY_OUT] = XFRM_USERPOLICY_ACCEPT;
+ 
+ 	rv = xfrm_statistics_init(net);
+ 	if (rv < 0)
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 72b2f173aac8..64fa8fdd6bbd 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1994,12 +1994,9 @@ static int xfrm_notify_userpolicy(struct net *net)
+ 	}
+ 
+ 	up = nlmsg_data(nlh);
+-	up->in = net->xfrm.policy_default & XFRM_POL_DEFAULT_IN ?
+-			XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT;
+-	up->fwd = net->xfrm.policy_default & XFRM_POL_DEFAULT_FWD ?
+-			XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT;
+-	up->out = net->xfrm.policy_default & XFRM_POL_DEFAULT_OUT ?
+-			XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT;
++	up->in = net->xfrm.policy_default[XFRM_POLICY_IN];
++	up->fwd = net->xfrm.policy_default[XFRM_POLICY_FWD];
++	up->out = net->xfrm.policy_default[XFRM_POLICY_OUT];
+ 
+ 	nlmsg_end(skb, nlh);
+ 
+@@ -2010,26 +2007,26 @@ static int xfrm_notify_userpolicy(struct net *net)
+ 	return err;
+ }
+ 
++static bool xfrm_userpolicy_is_valid(__u8 policy)
++{
++	return policy == XFRM_USERPOLICY_BLOCK ||
++	       policy == XFRM_USERPOLICY_ACCEPT;
++}
++
+ static int xfrm_set_default(struct sk_buff *skb, struct nlmsghdr *nlh,
+ 			    struct nlattr **attrs)
+ {
+ 	struct net *net = sock_net(skb->sk);
+ 	struct xfrm_userpolicy_default *up = nlmsg_data(nlh);
+ 
+-	if (up->in == XFRM_USERPOLICY_BLOCK)
+-		net->xfrm.policy_default |= XFRM_POL_DEFAULT_IN;
+-	else if (up->in == XFRM_USERPOLICY_ACCEPT)
+-		net->xfrm.policy_default &= ~XFRM_POL_DEFAULT_IN;
++	if (xfrm_userpolicy_is_valid(up->in))
++		net->xfrm.policy_default[XFRM_POLICY_IN] = up->in;
+ 
+-	if (up->fwd == XFRM_USERPOLICY_BLOCK)
+-		net->xfrm.policy_default |= XFRM_POL_DEFAULT_FWD;
+-	else if (up->fwd == XFRM_USERPOLICY_ACCEPT)
+-		net->xfrm.policy_default &= ~XFRM_POL_DEFAULT_FWD;
++	if (xfrm_userpolicy_is_valid(up->fwd))
++		net->xfrm.policy_default[XFRM_POLICY_FWD] = up->fwd;
+ 
+-	if (up->out == XFRM_USERPOLICY_BLOCK)
+-		net->xfrm.policy_default |= XFRM_POL_DEFAULT_OUT;
+-	else if (up->out == XFRM_USERPOLICY_ACCEPT)
+-		net->xfrm.policy_default &= ~XFRM_POL_DEFAULT_OUT;
++	if (xfrm_userpolicy_is_valid(up->out))
++		net->xfrm.policy_default[XFRM_POLICY_OUT] = up->out;
+ 
+ 	rt_genid_bump_all(net);
+ 
+@@ -2059,13 +2056,9 @@ static int xfrm_get_default(struct sk_buff *skb, struct nlmsghdr *nlh,
+ 	}
+ 
+ 	r_up = nlmsg_data(r_nlh);
+-
+-	r_up->in = net->xfrm.policy_default & XFRM_POL_DEFAULT_IN ?
+-			XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT;
+-	r_up->fwd = net->xfrm.policy_default & XFRM_POL_DEFAULT_FWD ?
+-			XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT;
+-	r_up->out = net->xfrm.policy_default & XFRM_POL_DEFAULT_OUT ?
+-			XFRM_USERPOLICY_BLOCK : XFRM_USERPOLICY_ACCEPT;
++	r_up->in = net->xfrm.policy_default[XFRM_POLICY_IN];
++	r_up->fwd = net->xfrm.policy_default[XFRM_POLICY_FWD];
++	r_up->out = net->xfrm.policy_default[XFRM_POLICY_OUT];
+ 	nlmsg_end(r_skb, r_nlh);
+ 
+ 	return nlmsg_unicast(net->xfrm.nlsk, r_skb, portid);
+-- 
+2.35.1
+