diff -ruw linux-5.4.60/arch/arm64/boot/dts/amlogic/Makefile linux-5.4.60-fbx/arch/arm64/boot/dts/amlogic/Makefile
--- linux-5.4.60/arch/arm64/boot/dts/amlogic/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/amlogic/Makefile	2021-03-04 13:20:57.000838854 +0100
@@ -1,4 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
+DTC_FLAGS += -@
+dtb-$(CONFIG_ARCH_MESON) += fbxwmr.dtb fbxwmr-r1.dtb fbxwmr-r2.dtb
 dtb-$(CONFIG_ARCH_MESON) += meson-axg-s400.dtb
 dtb-$(CONFIG_ARCH_MESON) += meson-g12a-sei510.dtb
 dtb-$(CONFIG_ARCH_MESON) += meson-g12a-u200.dtb
diff -ruw linux-5.4.60/arch/arm64/boot/dts/broadcom/Makefile linux-5.4.60-fbx/arch/arm64/boot/dts/broadcom/Makefile
--- linux-5.4.60/arch/arm64/boot/dts/broadcom/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/broadcom/Makefile	2021-03-04 13:20:57.004172187 +0100
@@ -6,3 +6,4 @@
 
 subdir-y	+= northstar2
 subdir-y	+= stingray
+subdir-y	+= bcm63xx
diff -ruw linux-5.4.60/arch/arm64/boot/dts/marvell/armada-ap806.dtsi linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
--- linux-5.4.60/arch/arm64/boot/dts/marvell/armada-ap806.dtsi	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/armada-ap806.dtsi	2021-03-04 13:20:57.010838855 +0100
@@ -274,6 +274,11 @@
 				};
 			};
 
+			ap_hwmon: ap806-hwmon@6f8084 {
+				compatible = "marvell,ap806-hwmon";
+				reg = <0x6f8084 0xc>;
+			};
+
 			ap_syscon1: system-controller@6f8000 {
 				compatible = "syscon", "simple-mfd";
 				reg = <0x6f8000 0x1000>;
diff -ruw linux-5.4.60/arch/arm64/boot/dts/marvell/armada-cp110.dtsi linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/armada-cp110.dtsi
--- linux-5.4.60/arch/arm64/boot/dts/marvell/armada-cp110.dtsi	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/armada-cp110.dtsi	2021-03-04 13:20:57.010838855 +0100
@@ -134,10 +134,13 @@
 			reg = <0x120000 0x6000>;
 			marvell,system-controller = <&CP110_LABEL(syscon0)>;
 			clocks = <&CP110_LABEL(clk) 1 5>, <&CP110_LABEL(clk) 1 6>,
-				 <&CP110_LABEL(clk) 1 18>;
-			clock-names = "mg_clk", "mg_core_clk", "axi_clk";
+				 <&CP110_LABEL(clk) 1 18>, <&CP110_LABEL(clk) 1 9>;
+			clock-names = "mg_clk", "mg_core_clk", "axi_clk", "gop_clk";
 			#address-cells = <1>;
 			#size-cells = <0>;
+			marvell,cp_mgmt = <&CP110_LABEL(syscon1)>;
+			/* always use Master CP S@R */
+			marvell,sar = <&cp0_syscon1>;
 
 			CP110_LABEL(comphy0): phy@0 {
 				reg = <0>;
@@ -322,6 +325,14 @@
 			};
 		};
 
+		CP110_LABEL(utmi): utmi@580000 {
+			compatible = "marvell,cp110-utmi-phy";
+			#phy-cells = <1>;
+			reg = <0x580000 0x2000>;
+			reg-names = "utmi-unit";
+			marvell,system-controller = <&CP110_LABEL(syscon0)>;
+		};
+
 		CP110_LABEL(xor0): xor@6a0000 {
 			compatible = "marvell,armada-7k-xor", "marvell,xor-v2";
 			reg = <0x6a0000 0x1000>, <0x6b0000 0x1000>;
@@ -364,6 +375,11 @@
 			status = "disabled";
 		};
 
+		CP110_LABEL(hwmon): cp110-hwmon@0x400070 {
+			compatible = "marvell,cp110-hwmon";
+			reg = <0x400070 0xc>;
+		};
+
 		CP110_LABEL(i2c0): i2c@701000 {
 			compatible = "marvell,mv78230-i2c";
 			reg = <0x701000 0x20>;
@@ -388,6 +404,16 @@
 			status = "disabled";
 		};
 
+		CP110_LABEL(mss_i2c): i2c@211000 {
+			compatible = "marvell,mv64xxx-i2c";
+			reg = <0x211000 0x20>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts = <0 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&CP110_LABEL(clk) 1 21>;
+			status = "disabled";
+		};
+
 		CP110_LABEL(uart0): serial@702000 {
 			compatible = "snps,dw-apb-uart";
 			reg = <0x702000 0x100>;
@@ -457,8 +483,8 @@
 
 		CP110_LABEL(trng): trng@760000 {
 			compatible = "marvell,armada-8k-rng",
-			"inside-secure,safexcel-eip76";
-			reg = <0x760000 0x7d>;
+				"inside-secure,safexcel-eip150";
+			reg = <0x760000 0x10000>;
 			interrupts = <95 IRQ_TYPE_LEVEL_HIGH>;
 			clock-names = "core", "reg";
 			clocks = <&CP110_LABEL(clk) 1 25>,
@@ -492,6 +518,19 @@
 				 <&CP110_LABEL(clk) 1 17>;
 			dma-coherent;
 		};
+
+		CP110_LABEL(tdm0): tdmmc@7a0000 {
+			compatible = "marvell,armada-a8k-tdm";
+			reg = <0x7a0000 0x20000>,
+				<0x440400 0x20>;
+			reg-names = "tdm_regs", "pll_regs";
+			interrupts = <111 IRQ_TYPE_LEVEL_HIGH>,
+				<112 IRQ_TYPE_LEVEL_HIGH>,
+				<113 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&CP110_LABEL(clk) 1 1>;
+			clock-names = "gateclk";
+			status = "disabled";
+		};
 	};
 
 	CP110_LABEL(pcie0): pcie@CP110_PCIE0_BASE {
diff -ruw linux-5.4.60/arch/arm64/boot/dts/marvell/Makefile linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/Makefile
--- linux-5.4.60/arch/arm64/boot/dts/marvell/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/Makefile	2021-03-04 13:20:57.010838855 +0100
@@ -10,3 +10,17 @@
 dtb-$(CONFIG_ARCH_MVEBU) += armada-8040-mcbin.dtb
 dtb-$(CONFIG_ARCH_MVEBU) += armada-8040-mcbin-singleshot.dtb
 dtb-$(CONFIG_ARCH_MVEBU) += armada-8080-db.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r_exp1_dsl_lte.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r_exp1_ftth_p2p.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r_exp2_ftth_p2p.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r_exp2_ftth_pon.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r_exp1_test_module.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r_exp2_test_module.dtb
+
+dtb-$(CONFIG_ARCH_MVEBU) += jbxgw7r.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += jbxgw7r_exp1_ftth_p2p.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += jbxgw7r_exp2_ftth_p2p.dtb
+
+# export symbols in DTBs file to allow overlay usage
+DTC_FLAGS	+= -@
diff -ruw linux-5.4.60/arch/arm64/include/asm/cputype.h linux-5.4.60-fbx/arch/arm64/include/asm/cputype.h
--- linux-5.4.60/arch/arm64/include/asm/cputype.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/arch/arm64/include/asm/cputype.h	2021-03-04 13:20:57.027505522 +0100
@@ -94,6 +94,7 @@
 #define HISI_CPU_PART_TSV110		0xD01
 
 #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53)
+#define MIDR_CORTEX_B53 MIDR_CPU_MODEL(ARM_CPU_IMP_BRCM, ARM_CPU_PART_CORTEX_A53)
 #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57)
 #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72)
 #define MIDR_CORTEX_A73 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A73)
diff -ruw linux-5.4.60/arch/arm64/include/asm/memory.h linux-5.4.60-fbx/arch/arm64/include/asm/memory.h
--- linux-5.4.60/arch/arm64/include/asm/memory.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/arch/arm64/include/asm/memory.h	2021-03-04 13:20:57.030838855 +0100
@@ -84,7 +84,7 @@
 #define KASAN_SHADOW_OFFSET	_AC(CONFIG_KASAN_SHADOW_OFFSET, UL)
 #define KASAN_SHADOW_END	((UL(1) << (64 - KASAN_SHADOW_SCALE_SHIFT)) \
 					+ KASAN_SHADOW_OFFSET)
-#define KASAN_THREAD_SHIFT	1
+#define KASAN_THREAD_SHIFT	2
 #else
 #define KASAN_THREAD_SHIFT	0
 #define KASAN_SHADOW_END	(_PAGE_END(VA_BITS_MIN))
diff -ruw linux-5.4.60/arch/arm64/include/asm/pgtable-hwdef.h linux-5.4.60-fbx/arch/arm64/include/asm/pgtable-hwdef.h
--- linux-5.4.60/arch/arm64/include/asm/pgtable-hwdef.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/arch/arm64/include/asm/pgtable-hwdef.h	2021-03-04 13:20:57.030838855 +0100
@@ -147,7 +147,11 @@
 #define PTE_TABLE_BIT		(_AT(pteval_t, 1) << 1)
 #define PTE_USER		(_AT(pteval_t, 1) << 6)		/* AP[1] */
 #define PTE_RDONLY		(_AT(pteval_t, 1) << 7)		/* AP[2] */
+#ifdef CONFIG_ARCH_BCM63XX_SHARED_OSH
+#define PTE_SHARED		(_AT(pteval_t, 2) << 8)		/* SH[1:0], outer shareable */
+#else
 #define PTE_SHARED		(_AT(pteval_t, 3) << 8)		/* SH[1:0], inner shareable */
+#endif
 #define PTE_AF			(_AT(pteval_t, 1) << 10)	/* Access Flag */
 #define PTE_NG			(_AT(pteval_t, 1) << 11)	/* nG */
 #define PTE_DBM			(_AT(pteval_t, 1) << 51)	/* Dirty Bit Management */
@@ -263,12 +267,19 @@
 
 #define TCR_SH0_SHIFT		12
 #define TCR_SH0_MASK		(UL(3) << TCR_SH0_SHIFT)
+#define TCR_SH0_OUTER		(UL(2) << TCR_SH0_SHIFT)
 #define TCR_SH0_INNER		(UL(3) << TCR_SH0_SHIFT)
 
 #define TCR_SH1_SHIFT		28
 #define TCR_SH1_MASK		(UL(3) << TCR_SH1_SHIFT)
+#define TCR_SH1_OUTER		(UL(2) << TCR_SH1_SHIFT)
 #define TCR_SH1_INNER		(UL(3) << TCR_SH1_SHIFT)
+
+#ifdef CONFIG_ARCH_BCM63XX_SHARED_OSH
+#define TCR_SHARED		(TCR_SH0_OUTER | TCR_SH1_OUTER)
+#else
 #define TCR_SHARED		(TCR_SH0_INNER | TCR_SH1_INNER)
+#endif
 
 #define TCR_TG0_SHIFT		14
 #define TCR_TG0_MASK		(UL(3) << TCR_TG0_SHIFT)
diff -ruw linux-5.4.60/arch/arm64/Kconfig.platforms linux-5.4.60-fbx/arch/arm64/Kconfig.platforms
--- linux-5.4.60/arch/arm64/Kconfig.platforms	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/arch/arm64/Kconfig.platforms	2021-03-04 13:20:57.000838854 +0100
@@ -51,6 +51,22 @@
 	help
 	  This enables support for Broadcom iProc based SoCs
 
+config ARCH_BCM63XX
+	bool "Broadcom BCM63XX family"
+	select PINCTRL
+	select GPIOLIB
+	select PINCTRL_BCM63138
+	help
+	  This enables support for Broadcom BCM63XX Family
+
+config ARCH_BCM63XX_SHARED_OSH
+	bool "Make shared pages and translation table walks outer shareable"
+	depends on ARCH_BCM63XX
+	default y
+	help
+	  This is required for HW coherency on bcm63158. Say Y here if
+	  you are compiling a kernel for a bcm63158 board.
+
 config ARCH_BERLIN
 	bool "Marvell Berlin SoC Family"
 	select DW_APB_ICTL
diff -ruw linux-5.4.60/block/blk-core.c linux-5.4.60-fbx/block/blk-core.c
--- linux-5.4.60/block/blk-core.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/block/blk-core.c	2021-03-04 13:20:57.497505542 +0100
@@ -1319,7 +1319,7 @@
 	}
 }
 
-void blk_account_io_done(struct request *req, u64 now)
+void blk_account_io_done(struct request *req, u64 now, blk_status_t error)
 {
 	/*
 	 * Account IO completion.  flush_rq isn't accounted as a
@@ -1333,6 +1333,10 @@
 		part_stat_lock();
 		part = req->part;
 
+		if (error) {
+			int rw = rq_data_dir(req);
+			part_stat_inc(part, io_errors[rw]);
+		}
 		update_io_ticks(part, jiffies);
 		part_stat_inc(part, ios[sgrp]);
 		part_stat_add(part, nsecs[sgrp], now - req->start_time_ns);
diff -ruw linux-5.4.60/block/blk-flush.c linux-5.4.60-fbx/block/blk-flush.c
--- linux-5.4.60/block/blk-flush.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/block/blk-flush.c	2021-03-04 13:20:57.497505542 +0100
@@ -165,10 +165,21 @@
 	rq->flush.seq |= seq;
 	cmd_flags = rq->cmd_flags;
 
-	if (likely(!error))
+	if (likely(!error)) {
 		seq = blk_flush_cur_seq(rq);
-	else
+	} else {
 		seq = REQ_FSEQ_DONE;
+		printk_once(KERN_ERR "%s: flush failed: data integrity problem\n",
+				   rq->rq_disk ? rq->rq_disk->disk_name : "?");
+		/*
+		 * returning an error to the FS is wrong: the data is all
+		 * there, it just might not be written out in the expected
+		 * order and thus have a window where the integrity is suspect
+		 * in a crash.  Given the small likelihood of actually
+		 * crashing, we should just log a warning here.
+		 */
+		error = 0;
+	}
 
 	switch (seq) {
 	case REQ_FSEQ_PREFLUSH:
diff -ruw linux-5.4.60/block/blk.h linux-5.4.60-fbx/block/blk.h
--- linux-5.4.60/block/blk.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/block/blk.h	2021-03-04 13:20:57.500838876 +0100
@@ -187,7 +187,7 @@
 
 void blk_account_io_start(struct request *req, bool new_io);
 void blk_account_io_completion(struct request *req, unsigned int bytes);
-void blk_account_io_done(struct request *req, u64 now);
+void blk_account_io_done(struct request *req, u64 now, blk_status_t error);
 
 /*
  * Internal elevator interface
diff -ruw linux-5.4.60/block/blk-mq.c linux-5.4.60-fbx/block/blk-mq.c
--- linux-5.4.60/block/blk-mq.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/block/blk-mq.c	2021-03-04 13:20:57.497505542 +0100
@@ -552,7 +552,7 @@
 	if (rq->internal_tag != -1)
 		blk_mq_sched_completed_request(rq, now);
 
-	blk_account_io_done(rq, now);
+	blk_account_io_done(rq, now, error);
 
 	if (rq->end_io) {
 		rq_qos_done(rq->q, rq);
diff -ruw linux-5.4.60/block/partition-generic.c linux-5.4.60-fbx/block/partition-generic.c
--- linux-5.4.60/block/partition-generic.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/block/partition-generic.c	2021-03-04 13:20:57.500838876 +0100
@@ -128,6 +128,7 @@
 		"%8lu %8lu %8llu %8u "
 		"%8u %8u %8u "
 		"%8lu %8lu %8llu %8u"
+		"%8lu %lu"
 		"\n",
 		part_stat_read(p, ios[STAT_READ]),
 		part_stat_read(p, merges[STAT_READ]),
@@ -143,7 +144,9 @@
 		part_stat_read(p, ios[STAT_DISCARD]),
 		part_stat_read(p, merges[STAT_DISCARD]),
 		(unsigned long long)part_stat_read(p, sectors[STAT_DISCARD]),
-		(unsigned int)part_stat_read_msecs(p, STAT_DISCARD));
+		(unsigned int)part_stat_read_msecs(p, STAT_DISCARD),
+		part_stat_read(p, io_errors[READ]),
+		part_stat_read(p, io_errors[WRITE]));
 }
 
 ssize_t part_inflight_show(struct device *dev, struct device_attribute *attr,
@@ -345,7 +348,7 @@
 		queue_limit_discard_alignment(&disk->queue->limits, start);
 	p->nr_sects = len;
 	p->partno = partno;
-	p->policy = get_disk_ro(disk);
+	p->policy = get_disk_ro(disk) || (flags & ADDPART_FLAG_RO);
 
 	if (info) {
 		struct partition_meta_info *pinfo = alloc_part_info(disk);
diff -ruw linux-5.4.60/block/partitions/check.c linux-5.4.60-fbx/block/partitions/check.c
--- linux-5.4.60/block/partitions/check.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/block/partitions/check.c	2021-03-04 13:20:57.500838876 +0100
@@ -24,6 +24,7 @@
 #include "acorn.h"
 #include "amiga.h"
 #include "atari.h"
+#include "dt.h"
 #include "ldm.h"
 #include "mac.h"
 #include "msdos.h"
@@ -40,6 +41,10 @@
 int warn_no_part = 1; /*This is ugly: should make genhd removable media aware*/
 
 static int (*check_part[])(struct parsed_partitions *) = {
+#ifdef CONFIG_OF_PARTITION
+	dt_partition,
+#endif
+
 	/*
 	 * Probe partition formats with tables at disk address 0
 	 * that also have an ADFS boot block at 0xdc0.
diff -ruw linux-5.4.60/block/partitions/Kconfig linux-5.4.60-fbx/block/partitions/Kconfig
--- linux-5.4.60/block/partitions/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/block/partitions/Kconfig	2021-03-04 13:20:57.500838876 +0100
@@ -268,3 +268,11 @@
 	help
 	  Say Y here if you want to read the partition table from bootargs.
 	  The format for the command line is just like mtdparts.
+
+config OF_PARTITION
+	bool "Device tree partition support" if PARTITION_ADVANCED
+	depends on OF
+
+config OF_PARTITION_IGNORE_RO
+	bool "ignore read-only flag"
+	depends on OF_PARTITION
diff -ruw linux-5.4.60/block/partitions/Makefile linux-5.4.60-fbx/block/partitions/Makefile
--- linux-5.4.60/block/partitions/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/block/partitions/Makefile	2021-03-04 13:20:57.500838876 +0100
@@ -21,3 +21,4 @@
 obj-$(CONFIG_EFI_PARTITION) += efi.o
 obj-$(CONFIG_KARMA_PARTITION) += karma.o
 obj-$(CONFIG_SYSV68_PARTITION) += sysv68.o
+obj-$(CONFIG_OF_PARTITION) += dt.o
diff -ruw linux-5.4.60/drivers/ata/ahci.h linux-5.4.60-fbx/drivers/ata/ahci.h
--- linux-5.4.60/drivers/ata/ahci.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/ata/ahci.h	2021-03-04 13:20:57.567505546 +0100
@@ -368,6 +368,9 @@
 	/* only required for per-port MSI(-X) support */
 	int			(*get_irq_vector)(struct ata_host *host,
 						  int port);
+
+	u32			comreset_u;
+	u32			comwake;
 };
 
 extern int ahci_ignore_sss;
diff -ruw linux-5.4.60/drivers/ata/ahci_mvebu.c linux-5.4.60-fbx/drivers/ata/ahci_mvebu.c
--- linux-5.4.60/drivers/ata/ahci_mvebu.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/ata/ahci_mvebu.c	2021-03-04 13:20:57.567505546 +0100
@@ -17,6 +17,7 @@
 #include <linux/module.h>
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
+
 #include "ahci.h"
 
 #define DRV_NAME "ahci-mvebu"
@@ -67,6 +68,41 @@
 	writel(0x80, hpriv->mmio + AHCI_VENDOR_SPECIFIC_0_DATA);
 }
 
+#define PORT_INDIRECT_PHY_ADDR(__p)	((__p) * 0x80 + 0x178)
+#define PORT_INDIRECT_PHY_DATA(__p)	((__p) * 0x80 + 0x17c)
+
+#define INDIRECT_PHY_CONTROL	0x0a
+#define INDIRECT_PHY_CTRL_NEG_RX_CLK	(1 << 13)
+#define INDIRECT_PHY_CTRL_NEG_TX_CLK	(1 << 12)
+
+static inline void indirect_phy_write(void __iomem *mmio, int port,
+				     u32 value, u32 phy_off)
+{
+	writel(phy_off, mmio + PORT_INDIRECT_PHY_ADDR(port));
+	writel(value, mmio + PORT_INDIRECT_PHY_DATA(port));
+}
+
+static inline u32 indirect_phy_read(void __iomem *mmio, int port, u32 phy_off)
+{
+	writel(phy_off, mmio + PORT_INDIRECT_PHY_ADDR(port));
+	return readl(mmio + PORT_INDIRECT_PHY_DATA(port));
+}
+
+static void ahci_mvebu_tune_clk_edge(struct ahci_host_priv *hpriv)
+{
+	int i;
+
+	for (i = 0; i < hpriv->nports; ++i) {
+		u32 v;
+
+		pr_debug("inverting RX/TX clk on port %d\n", i);
+		v = indirect_phy_read(hpriv->mmio, i, INDIRECT_PHY_CONTROL);
+		v &= ~INDIRECT_PHY_CTRL_NEG_TX_CLK;
+		v &= ~INDIRECT_PHY_CTRL_NEG_RX_CLK;
+		indirect_phy_write(hpriv->mmio, i, v, INDIRECT_PHY_CONTROL);
+	}
+}
+
 static int ahci_mvebu_armada_380_config(struct ahci_host_priv *hpriv)
 {
 	const struct mbus_dram_target_info *dram;
@@ -96,6 +132,13 @@
 	return 0;
 }
 
+static int ahci_mvebu_armada_8k_config(struct ahci_host_priv *hpriv)
+{
+	ahci_mvebu_regret_option(hpriv);
+	ahci_mvebu_tune_clk_edge(hpriv);
+	return 0;
+}
+
 /**
  * ahci_mvebu_stop_engine
  *
@@ -209,6 +252,18 @@
 	if (rc)
 		goto disable_resources;
 
+	/*
+	 * comreset and comwake parameters, later configured in
+	 * ahci_port_init().
+	 */
+	if (of_property_read_u32(pdev->dev.of_node, "comwake",
+				 &hpriv->comwake))
+		hpriv->comwake = 0;
+
+	if (of_property_read_u32(pdev->dev.of_node, "comreset_u",
+				 &hpriv->comreset_u))
+		hpriv->comreset_u = 0;
+
 	rc = ahci_platform_init_host(pdev, hpriv, &ahci_mvebu_port_info,
 				     &ahci_platform_sht);
 	if (rc)
@@ -230,6 +285,11 @@
 	.flags = AHCI_HFLAG_SUSPEND_PHYS,
 };
 
+static const struct ahci_mvebu_plat_data ahci_mvebu_armada_8k_plat_data = {
+	.plat_config = ahci_mvebu_armada_8k_config,
+	.flags = 0,
+};
+
 static const struct of_device_id ahci_mvebu_of_match[] = {
 	{
 		.compatible = "marvell,armada-380-ahci",
@@ -239,6 +299,10 @@
 		.compatible = "marvell,armada-3700-ahci",
 		.data = &ahci_mvebu_armada_3700_plat_data,
 	},
+	{
+		.compatible = "marvell,armada-8k-ahci",
+		.data = &ahci_mvebu_armada_8k_plat_data,
+	},
 	{ },
 };
 MODULE_DEVICE_TABLE(of, ahci_mvebu_of_match);
diff -ruw linux-5.4.60/drivers/ata/libahci.c linux-5.4.60-fbx/drivers/ata/libahci.c
--- linux-5.4.60/drivers/ata/libahci.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/ata/libahci.c	2021-03-04 13:20:57.567505546 +0100
@@ -1194,6 +1194,47 @@
 	return sprintf(buf, "%d\n", emp->blink_policy);
 }
 
+#define PORT_OOB_INDIRECT_ADDR	0x78
+#define PORT_OOB_INDIRECT_DATA	0x7c
+
+#define COM_PARAM_REG	0x48
+#define COMWAKE_MASK	0xf
+#define COMRST_MASK	0x3f
+#define COMWAKE_VAL(x)		(((x) & 0xf) << 12)
+#define COMRST_VAL(x)		(((x) & 0x3f) << 0)
+
+static void write_phy_indirect(void __iomem *pmmio, u32 v, u32 reg)
+{
+	writel(reg, pmmio + PORT_OOB_INDIRECT_ADDR);
+	writel(v, pmmio + PORT_OOB_INDIRECT_DATA);
+}
+
+static u32 read_phy_indirect(void __iomem *pmmio, u32 reg)
+{
+	writel(reg, pmmio + PORT_OOB_INDIRECT_ADDR);
+	return readl(pmmio + PORT_OOB_INDIRECT_DATA);
+}
+
+static void comwake_comrst_config(void __iomem *pmmio, u32 comwake, u32 comrst)
+{
+	u32 v;
+
+	v = read_phy_indirect(pmmio, COM_PARAM_REG);
+
+	if (comwake) {
+		v &= ~COMWAKE_VAL(COMWAKE_MASK);
+		v |= COMWAKE_VAL(comwake);
+	}
+
+	if (comrst) {
+		v &= ~COMRST_VAL(COMRST_MASK);
+		v |= COMRST_VAL(comrst);
+	}
+
+	write_phy_indirect(pmmio, v, COM_PARAM_REG);
+}
+
+
 static void ahci_port_init(struct device *dev, struct ata_port *ap,
 			   int port_no, void __iomem *mmio,
 			   void __iomem *port_mmio)
@@ -1208,6 +1249,8 @@
 	if (rc)
 		dev_warn(dev, "%s (%d)\n", emsg, rc);
 
+	comwake_comrst_config(port_mmio, hpriv->comwake, hpriv->comreset_u);
+
 	/* clear SError */
 	tmp = readl(port_mmio + PORT_SCR_ERR);
 	VPRINTK("PORT_SCR_ERR 0x%x\n", tmp);
diff -ruw linux-5.4.60/drivers/ata/libata-core.c linux-5.4.60-fbx/drivers/ata/libata-core.c
--- linux-5.4.60/drivers/ata/libata-core.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/ata/libata-core.c	2021-03-04 13:20:57.567505546 +0100
@@ -4478,6 +4478,8 @@
 	   SD7SN6S256G and SD8SN8U256G */
 	{ "SanDisk SD[78]SN*G",	NULL,		ATA_HORKAGE_NONCQ, },
 
+	{ "Boot ROM", 		NULL,		ATA_HORKAGE_NODMA  },
+
 	/* devices which puke on READ_NATIVE_MAX */
 	{ "HDS724040KLSA80",	"KFAOA20N",	ATA_HORKAGE_BROKEN_HPA, },
 	{ "WDC WD3200JD-00KLB0", "WD-WCAMR1130137", ATA_HORKAGE_BROKEN_HPA },
diff -ruw linux-5.4.60/drivers/ata/libata-scsi.c linux-5.4.60-fbx/drivers/ata/libata-scsi.c
--- linux-5.4.60/drivers/ata/libata-scsi.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/ata/libata-scsi.c	2021-03-04 13:20:57.570838879 +0100
@@ -4556,7 +4556,8 @@
 		 */
 		shost->max_host_blocked = 1;
 
-		rc = scsi_add_host_with_dma(shost, &ap->tdev, ap->host->dev);
+		rc = scsi_add_host_with_dma(shost,
+					    host->dev, host->dev);
 		if (rc)
 			goto err_alloc;
 	}
diff -ruw linux-5.4.60/drivers/base/property.c linux-5.4.60-fbx/drivers/base/property.c
--- linux-5.4.60/drivers/base/property.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/base/property.c	2021-03-04 13:20:57.590838880 +0100
@@ -17,6 +17,7 @@
 #include <linux/property.h>
 #include <linux/etherdevice.h>
 #include <linux/phy.h>
+#include <linux/fbxserial.h>
 
 struct fwnode_handle *dev_fwnode(struct device *dev)
 {
@@ -838,6 +839,21 @@
 {
 	char *res;
 
+#ifdef CONFIG_FBXSERIAL
+	u32 index;
+	int ret;
+
+	ret = fwnode_property_read_u32(fwnode, "fbxserial-mac-address",
+				       &index);
+	if (ret == 0) {
+		res = (void *)fbxserialinfo_get_mac_addr(index);
+		if (res) {
+			memcpy(addr, res, alen);
+			return res;
+		}
+	}
+#endif
+
 	res = fwnode_get_mac_addr(fwnode, "mac-address", addr, alen);
 	if (res)
 		return res;
diff -ruw linux-5.4.60/drivers/base/regmap/internal.h linux-5.4.60-fbx/drivers/base/regmap/internal.h
--- linux-5.4.60/drivers/base/regmap/internal.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/base/regmap/internal.h	2021-03-04 13:20:57.590838880 +0100
@@ -294,4 +294,6 @@
 	return reg >> map->reg_stride_order;
 }
 
+void *regmap_mmio_ctx_get_base(const void *priv);
+
 #endif
diff -ruw linux-5.4.60/drivers/base/regmap/regmap.c linux-5.4.60-fbx/drivers/base/regmap/regmap.c
--- linux-5.4.60/drivers/base/regmap/regmap.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/base/regmap/regmap.c	2021-03-04 13:20:57.590838880 +0100
@@ -3110,6 +3110,15 @@
 }
 EXPORT_SYMBOL_GPL(regmap_parse_val);
 
+#ifdef CONFIG_REGMAP_MMIO
+void *regmap_get_mmio_base_address(struct regmap *map)
+{
+	return regmap_mmio_ctx_get_base(map->bus_context);
+}
+
+EXPORT_SYMBOL_GPL(regmap_get_mmio_base_address);
+#endif
+
 static int __init regmap_initcall(void)
 {
 	regmap_debugfs_initcall();
diff -ruw linux-5.4.60/drivers/base/regmap/regmap-mmio.c linux-5.4.60-fbx/drivers/base/regmap/regmap-mmio.c
--- linux-5.4.60/drivers/base/regmap/regmap-mmio.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/base/regmap/regmap-mmio.c	2021-03-04 13:20:57.590838880 +0100
@@ -376,4 +376,10 @@
 }
 EXPORT_SYMBOL_GPL(regmap_mmio_detach_clk);
 
+void *regmap_mmio_ctx_get_base(const void *priv)
+{
+	struct regmap_mmio_context *ctx = (struct regmap_mmio_context *)priv;
+	return ctx->regs;
+}
+
 MODULE_LICENSE("GPL v2");
diff -ruw linux-5.4.60/drivers/bluetooth/Kconfig linux-5.4.60-fbx/drivers/bluetooth/Kconfig
--- linux-5.4.60/drivers/bluetooth/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/bluetooth/Kconfig	2021-03-04 13:20:57.607505547 +0100
@@ -211,7 +211,6 @@
 	depends on BT_HCIUART
 	depends on BT_HCIUART_SERDEV
 	depends on GPIOLIB
-	depends on ACPI
 	select BT_HCIUART_3WIRE
 	select BT_RTL
 	help
diff -ruw linux-5.4.60/drivers/char/hw_random/Kconfig linux-5.4.60-fbx/drivers/char/hw_random/Kconfig
--- linux-5.4.60/drivers/char/hw_random/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/char/hw_random/Kconfig	2021-03-04 13:20:57.620838881 +0100
@@ -88,6 +88,11 @@
 
 	  If unsure, say Y.
 
+config HW_RANDOM_BCM63XX
+	tristate "Broadcom BCM63xx Random Number Generator support"
+	depends on ARCH_BCM_63XX || BCM63XX
+	default HW_RANDOM
+
 config HW_RANDOM_IPROC_RNG200
 	tristate "Broadcom iProc/STB RNG200 support"
 	depends on ARCH_BCM_IPROC || ARCH_BRCMSTB
diff -ruw linux-5.4.60/drivers/char/hw_random/Makefile linux-5.4.60-fbx/drivers/char/hw_random/Makefile
--- linux-5.4.60/drivers/char/hw_random/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/char/hw_random/Makefile	2021-03-04 13:20:57.620838881 +0100
@@ -28,6 +28,7 @@
 obj-$(CONFIG_HW_RANDOM_POWERNV) += powernv-rng.o
 obj-$(CONFIG_HW_RANDOM_HISI)	+= hisi-rng.o
 obj-$(CONFIG_HW_RANDOM_BCM2835) += bcm2835-rng.o
+obj-$(CONFIG_HW_RANDOM_BCM63XX) += bcm63xx-rng.o
 obj-$(CONFIG_HW_RANDOM_IPROC_RNG200) += iproc-rng200.o
 obj-$(CONFIG_HW_RANDOM_ST) += st-rng.o
 obj-$(CONFIG_HW_RANDOM_XGENE) += xgene-rng.o
diff -ruw linux-5.4.60/drivers/char/hw_random/omap-rng.c linux-5.4.60-fbx/drivers/char/hw_random/omap-rng.c
--- linux-5.4.60/drivers/char/hw_random/omap-rng.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/char/hw_random/omap-rng.c	2021-03-04 13:20:57.620838881 +0100
@@ -67,6 +67,22 @@
 #define EIP76_RNG_OUTPUT_SIZE			0x10
 
 /*
+ * EIP-150 interrupt management registers:
+ *
+ * EIP-150 has an EIP-76 (TRNG) and EIP-28 (PKA) in the same block,
+ * and a couple of registers aggretating interrupt sources from both
+ * TRNG and PKA.
+ *
+ * This doesn't make any attempt at implementing any support for the
+ * PKA block. This would require another driver and proper interrupt
+ * sharing between the two.
+ *
+ */
+#define EIP150_IRQ_MASK				0x8008
+#define EIP150_IRQ_ACK				0x8010
+#define  EIP150_TRNG_MASK			(1 << 3)
+
+/*
  * EIP76 RNG takes approx. 700us to produce 16 bytes of output data
  * as per testing results. And to account for the lack of udelay()'s
  * reliability, we keep the timeout as 1000us.
@@ -149,6 +165,7 @@
 	u32	(*data_present)(struct omap_rng_dev *priv);
 	int	(*init)(struct omap_rng_dev *priv);
 	void	(*cleanup)(struct omap_rng_dev *priv);
+	bool	hw_is_eip150;
 };
 
 struct omap_rng_dev {
@@ -274,8 +291,21 @@
 	omap_rng_write(priv, RNG_FRODETUNE_REG, 0x0);
 	omap_rng_write(priv, RNG_FROENABLE_REG, RNG_REG_FROENABLE_MASK);
 
-	/* Enable TRNG */
-	val = RNG_CONTROL_ENABLE_TRNG_MASK;
+	/* Setup alarm/shutdown threshold */
+	val = RNG_ALARM_THRESHOLD << RNG_ALARMCNT_ALARM_TH_SHIFT;
+	val |= RNG_SHUTDOWN_THRESHOLD << RNG_ALARMCNT_SHUTDOWN_TH_SHIFT;
+	omap_rng_write(priv, RNG_ALARMCNT_REG, val);
+
+	/*
+	 * Enable TRNG, we potentially need to preserve
+	 * RNG_SHUTDOWN_OFLO_MASK
+	 */
+	if (priv->pdata->regs[RNG_INTMASK_REG])
+		val = 0;
+	else
+		val = omap_rng_read(priv, RNG_CONTROL_REG) &
+			RNG_SHUTDOWN_OFLO_MASK;
+	val |= RNG_CONTROL_ENABLE_TRNG_MASK;
 	omap_rng_write(priv, RNG_CONTROL_REG, val);
 
 	return 0;
@@ -339,6 +369,12 @@
 
 	omap_rng_write(priv, RNG_INTACK_REG, RNG_REG_INTACK_SHUTDOWN_OFLO_MASK);
 
+	/*
+	 * ack irq at the EIP-150 level
+	 */
+	if (priv->pdata->hw_is_eip150)
+		writel(EIP150_TRNG_MASK, priv->base + EIP150_IRQ_ACK);
+
 	return IRQ_HANDLED;
 }
 
@@ -358,6 +394,15 @@
 	.cleanup	= omap4_rng_cleanup,
 };
 
+static struct omap_rng_pdata eip150_rng_pdata = {
+	.regs		= (u16 *)reg_map_eip76,
+	.data_size	= EIP76_RNG_OUTPUT_SIZE,
+	.data_present	= omap4_rng_data_present,
+	.init		= eip76_rng_init,
+	.cleanup	= omap4_rng_cleanup,
+	.hw_is_eip150	= true,
+};
+
 static const struct of_device_id omap_rng_of_match[] = {
 		{
 			.compatible	= "ti,omap2-rng",
@@ -371,6 +416,10 @@
 			.compatible	= "inside-secure,safexcel-eip76",
 			.data		= &eip76_rng_pdata,
 		},
+		{
+			.compatible	= "inside-secure,safexcel-eip150",
+			.data		= &eip150_rng_pdata,
+		},
 		{},
 };
 MODULE_DEVICE_TABLE(of, omap_rng_of_match);
@@ -390,7 +439,8 @@
 	priv->pdata = match->data;
 
 	if (of_device_is_compatible(dev->of_node, "ti,omap4-rng") ||
-	    of_device_is_compatible(dev->of_node, "inside-secure,safexcel-eip76")) {
+	    of_device_is_compatible(dev->of_node, "inside-secure,safexcel-eip76") ||
+	    of_device_is_compatible(dev->of_node, "inside-secure,safexcel-eip150")) {
 		irq = platform_get_irq(pdev, 0);
 		if (irq < 0) {
 			dev_err(dev, "%s: error getting IRQ resource - %d\n",
@@ -418,6 +468,12 @@
 		else
 			omap_rng_write(priv, RNG_CONTROL_REG,
 				       RNG_SHUTDOWN_OFLO_MASK);
+
+		/*
+		 * unmask IRQ at EIP-150 level
+		 */
+		if (priv->pdata->hw_is_eip150)
+			writel(EIP150_TRNG_MASK, priv->base + EIP150_IRQ_MASK);
 	}
 	return 0;
 }
diff -ruw linux-5.4.60/drivers/char/Kconfig linux-5.4.60-fbx/drivers/char/Kconfig
--- linux-5.4.60/drivers/char/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/char/Kconfig	2021-03-04 13:20:57.617505548 +0100
@@ -26,6 +26,15 @@
 	  kind of kernel debugging operations.
 	  When in doubt, say "N".
 
+config DEVPHYSMEM
+	bool "/dev/physmem virtual device support"
+	default n
+	help
+	  Say Y here if you want to support the /dev/physmem device. The
+	  /dev/physmem device allows unprivileged access to physical memory
+	  unused by the kernel.
+	  When in doubt, say "N".
+
 source "drivers/tty/serial/Kconfig"
 source "drivers/tty/serdev/Kconfig"
 
diff -ruw linux-5.4.60/drivers/char/mem.c linux-5.4.60-fbx/drivers/char/mem.c
--- linux-5.4.60/drivers/char/mem.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/char/mem.c	2021-03-04 13:20:57.624172215 +0100
@@ -29,6 +29,8 @@
 #include <linux/export.h>
 #include <linux/io.h>
 #include <linux/uio.h>
+#include <linux/memblock.h>
+
 #include <linux/uaccess.h>
 #include <linux/security.h>
 #include <linux/pseudo_fs.h>
@@ -434,6 +436,14 @@
 	return mmap_mem(file, vma);
 }
 
+static int mmap_physmem(struct file * file, struct vm_area_struct * vma)
+{
+	if (vma->vm_pgoff < max_pfn && !capable(CAP_SYS_RAWIO))
+		return -EPERM;
+
+	return mmap_mem(file, vma);
+}
+
 /*
  * This function reads the *virtual* memory as seen by the kernel.
  */
@@ -870,6 +880,11 @@
 	return 0;
 }
 
+static int open_physmem(struct inode * inode, struct file * filp)
+{
+	return 0;
+}
+
 #define zero_lseek	null_lseek
 #define full_lseek      null_lseek
 #define write_zero	write_null
@@ -935,6 +950,14 @@
 	.write		= write_full,
 };
 
+static const struct file_operations __maybe_unused physmem_fops = {
+	.mmap		= mmap_physmem,
+	.open		= open_physmem,
+#ifndef CONFIG_MMU
+	.get_unmapped_area = get_unmapped_area_mem,
+#endif
+};
+
 static const struct memdev {
 	const char *name;
 	umode_t mode;
@@ -958,6 +981,9 @@
 #ifdef CONFIG_PRINTK
 	[11] = { "kmsg", 0644, &kmsg_fops, 0 },
 #endif
+#ifdef CONFIG_DEVPHYSMEM
+	[16] = { "physmem", 0, &physmem_fops, FMODE_UNSIGNED_OFFSET },
+#endif
 };
 
 static int memory_open(struct inode *inode, struct file *filp)
diff -ruw linux-5.4.60/drivers/clk/mvebu/cp110-system-controller.c linux-5.4.60-fbx/drivers/clk/mvebu/cp110-system-controller.c
--- linux-5.4.60/drivers/clk/mvebu/cp110-system-controller.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/clk/mvebu/cp110-system-controller.c	2021-03-04 13:20:57.654172217 +0100
@@ -225,6 +225,10 @@
 	u32 nand_clk_ctrl;
 	int i, ret;
 	char *gate_name[ARRAY_SIZE(gate_base_names)];
+	bool ignore_eip150;
+
+	ignore_eip150 = of_property_read_bool(pdev->dev.of_node,
+					      "fbx,ignore-eip150");
 
 	regmap = syscon_node_to_regmap(syscon_node);
 	if (IS_ERR(regmap))
@@ -323,6 +327,11 @@
 		if (gate_name[i] == NULL)
 			continue;
 
+		if (ignore_eip150 && i == CP110_GATE_EIP150) {
+			dev_info(&pdev->dev, "ignoring EIP150 gate clock.\n");
+			continue;
+		}
+
 		switch (i) {
 		case CP110_GATE_NAND:
 			parent = nand_name;
diff -ruw linux-5.4.60/drivers/cpufreq/Kconfig linux-5.4.60-fbx/drivers/cpufreq/Kconfig
--- linux-5.4.60/drivers/cpufreq/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/cpufreq/Kconfig	2021-03-04 13:20:57.690838885 +0100
@@ -327,5 +327,10 @@
 	  This adds the CPUFreq driver support for Freescale QorIQ SoCs
 	  which are capable of changing the CPU's frequency dynamically.
 
+config BCM63158_CPUFREQ
+	tristate "CPU frequency scaling driver for BCM63158 SoC"
+	depends on ARCH_BCM63XX
+
 endif
+
 endmenu
diff -ruw linux-5.4.60/drivers/cpufreq/Makefile linux-5.4.60-fbx/drivers/cpufreq/Makefile
--- linux-5.4.60/drivers/cpufreq/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/cpufreq/Makefile	2021-03-04 13:20:57.690838885 +0100
@@ -111,3 +111,5 @@
 obj-$(CONFIG_SPARC_US2E_CPUFREQ)	+= sparc-us2e-cpufreq.o
 obj-$(CONFIG_SPARC_US3_CPUFREQ)		+= sparc-us3-cpufreq.o
 obj-$(CONFIG_UNICORE32)			+= unicore2-cpufreq.o
+
+obj-$(CONFIG_BCM63158_CPUFREQ)		+= bcm63158-cpufreq.o
diff -ruw linux-5.4.60/drivers/gpio/gpio-mvebu.c linux-5.4.60-fbx/drivers/gpio/gpio-mvebu.c
--- linux-5.4.60/drivers/gpio/gpio-mvebu.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/gpio/gpio-mvebu.c	2021-03-04 13:20:57.777505555 +0100
@@ -66,6 +66,11 @@
 #define GPIO_LEVEL_MASK_OFF		0x001c
 #define GPIO_BLINK_CNT_SELECT_OFF	0x0020
 
+#define GPIO_CONTROL_SET_OFF		0x0028
+#define GPIO_CONTROL_CLR_OFF		0x002c
+#define GPIO_DATAOUT_SET_OFF		0x0030
+#define GPIO_DATAOUT_CLR_OFF		0x0034
+
 /*
  * PWM register offsets.
  */
@@ -110,11 +115,13 @@
 struct mvebu_gpio_chip {
 	struct gpio_chip   chip;
 	struct regmap     *regs;
+	void __iomem      *base;
 	u32		   offset;
 	struct regmap     *percpu_regs;
 	int		   irqbase;
 	struct irq_domain *domain;
 	int		   soc_variant;
+	int		   broken_mpp33_dir_wa;
 
 	/* Used for PWM support */
 	struct clk	  *clk;
@@ -300,6 +307,18 @@
 {
 	struct mvebu_gpio_chip *mvchip = gpiochip_get_data(chip);
 
+	if (mvchip->soc_variant == MVEBU_GPIO_SOC_VARIANT_A8K) {
+		unsigned int off;
+
+		if (value)
+			off = GPIO_DATAOUT_SET_OFF;
+		else
+			off = GPIO_DATAOUT_CLR_OFF;
+
+		writel(BIT(pin), mvchip->base + off + mvchip->offset);
+		return;
+	}
+
 	regmap_update_bits(mvchip->regs, GPIO_OUT_OFF + mvchip->offset,
 			   BIT(pin), value ? BIT(pin) : 0);
 }
@@ -338,7 +357,7 @@
 static int mvebu_gpio_direction_input(struct gpio_chip *chip, unsigned int pin)
 {
 	struct mvebu_gpio_chip *mvchip = gpiochip_get_data(chip);
-	int ret;
+	int offset, ret;
 
 	/*
 	 * Check with the pinctrl driver whether this pin is usable as
@@ -348,7 +367,16 @@
 	if (ret)
 		return ret;
 
-	regmap_update_bits(mvchip->regs, GPIO_IO_CONF_OFF + mvchip->offset,
+	offset = 0;
+	if (pin == 1 && mvchip->broken_mpp33_dir_wa) {
+		/*
+		 * See comment in mvebu_gpio_direction_output().
+		 */
+		offset = -0x40;
+	}
+
+	regmap_update_bits(mvchip->regs,
+			   GPIO_IO_CONF_OFF + mvchip->offset + offset,
 			   BIT(pin), BIT(pin));
 
 	return 0;
@@ -358,7 +386,7 @@
 				       int value)
 {
 	struct mvebu_gpio_chip *mvchip = gpiochip_get_data(chip);
-	int ret;
+	int offset, ret;
 
 	/*
 	 * Check with the pinctrl driver whether this pin is usable as
@@ -371,7 +399,17 @@
 	mvebu_gpio_blink(chip, pin, 0);
 	mvebu_gpio_set(chip, pin, value);
 
-	regmap_update_bits(mvchip->regs, GPIO_IO_CONF_OFF + mvchip->offset,
+	offset = 0;
+	if (pin == 1 && mvchip->broken_mpp33_dir_wa) {
+		/*
+		 * gpio33 direction bit is not controlled from the
+		 * gpio block 0, but from gpio block 1 instead
+		 */
+		offset = -0x40;
+	}
+
+	regmap_update_bits(mvchip->regs,
+			   GPIO_IO_CONF_OFF + mvchip->offset + offset,
 			   BIT(pin), 0);
 
 	return 0;
@@ -380,9 +418,18 @@
 static int mvebu_gpio_get_direction(struct gpio_chip *chip, unsigned int pin)
 {
 	struct mvebu_gpio_chip *mvchip = gpiochip_get_data(chip);
+	int offset;
 	u32 u;
 
-	regmap_read(mvchip->regs, GPIO_IO_CONF_OFF + mvchip->offset, &u);
+	offset = 0;
+	if (pin == 1 && mvchip->broken_mpp33_dir_wa) {
+		/*
+		 * See comment in mvebu_gpio_direction_output().
+		 */
+		offset = -0x40;
+	}
+
+	regmap_read(mvchip->regs, GPIO_IO_CONF_OFF + mvchip->offset + offset, &u);
 
 	return !!(u & BIT(pin));
 }
@@ -1046,6 +1093,8 @@
 	if (IS_ERR(mvchip->regs))
 		return PTR_ERR(mvchip->regs);
 
+	mvchip->base = base;
+
 	/*
 	 * For the legacy SoCs, the regmap directly maps to the GPIO
 	 * registers, so no offset is needed.
@@ -1078,6 +1127,8 @@
 	if (IS_ERR(mvchip->regs))
 		return PTR_ERR(mvchip->regs);
 
+	mvchip->base = regmap_get_mmio_base_address(mvchip->regs);
+
 	if (of_property_read_u32(pdev->dev.of_node, "offset", &mvchip->offset))
 		return -EINVAL;
 
@@ -1095,6 +1146,7 @@
 	bool have_irqs;
 	int soc_variant;
 	int i, cpu, id;
+	uint32_t broken_mpp33_dir = 0;
 	int err;
 
 	match = of_match_device(mvebu_gpio_of_match, &pdev->dev);
@@ -1118,6 +1170,12 @@
 		return -ENODEV;
 	}
 
+	of_property_read_u32(pdev->dev.of_node, "marvell,broken-mpp33-dir",
+			     &broken_mpp33_dir);
+	if (broken_mpp33_dir)
+		dev_notice(&pdev->dev, "using direction set work around for "
+			   "MPP 33.\n");
+
 	id = of_alias_get_id(pdev->dev.of_node, "gpio");
 	if (id < 0) {
 		dev_err(&pdev->dev, "Couldn't get OF id\n");
@@ -1129,6 +1187,7 @@
 	if (!IS_ERR(mvchip->clk))
 		clk_prepare_enable(mvchip->clk);
 
+	mvchip->broken_mpp33_dir_wa = broken_mpp33_dir;
 	mvchip->soc_variant = soc_variant;
 	mvchip->chip.label = dev_name(&pdev->dev);
 	mvchip->chip.parent = &pdev->dev;
diff -ruw linux-5.4.60/drivers/hid/hid-quirks.c linux-5.4.60-fbx/drivers/hid/hid-quirks.c
--- linux-5.4.60/drivers/hid/hid-quirks.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/hid/hid-quirks.c	2021-03-04 13:20:58.437505585 +0100
@@ -684,6 +684,7 @@
 #if IS_ENABLED(CONFIG_HID_ZYDACRON)
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ZYDACRON, USB_DEVICE_ID_ZYDACRON_REMOTE_CONTROL) },
 #endif
+	{ HID_BLUETOOTH_DEVICE(0x10eb, 0x0023) },
 	{ }
 };
 
diff -ruw linux-5.4.60/drivers/hid/Kconfig linux-5.4.60-fbx/drivers/hid/Kconfig
--- linux-5.4.60/drivers/hid/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/hid/Kconfig	2021-03-04 13:20:58.430838917 +0100
@@ -439,6 +439,11 @@
 	help
 	  Support for ViewSonic/Signotec PD1011 signature pad.
 
+config HID_FBX_REMOTE_AUDIO
+	tristate "Freebox BLE remote audio driver"
+	depends on HID && SND
+	select SND_PCM
+
 config HID_GYRATION
 	tristate "Gyration remote control"
 	depends on HID
diff -ruw linux-5.4.60/drivers/hid/Makefile linux-5.4.60-fbx/drivers/hid/Makefile
--- linux-5.4.60/drivers/hid/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/hid/Makefile	2021-03-04 13:20:58.430838917 +0100
@@ -50,6 +50,7 @@
 obj-$(CONFIG_HID_GFRM)		+= hid-gfrm.o
 obj-$(CONFIG_HID_GOOGLE_HAMMER)	+= hid-google-hammer.o
 obj-$(CONFIG_HID_GT683R)	+= hid-gt683r.o
+obj-$(CONFIG_HID_FBX_REMOTE_AUDIO)	+= hid-fbx-remote-audio.o
 obj-$(CONFIG_HID_GYRATION)	+= hid-gyration.o
 obj-$(CONFIG_HID_HOLTEK)	+= hid-holtek-kbd.o
 obj-$(CONFIG_HID_HOLTEK)	+= hid-holtek-mouse.o
diff -ruw linux-5.4.60/drivers/hwmon/adt7475.c linux-5.4.60-fbx/drivers/hwmon/adt7475.c
--- linux-5.4.60/drivers/hwmon/adt7475.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/hwmon/adt7475.c	2021-03-04 13:20:58.450838918 +0100
@@ -128,7 +128,19 @@
 
 /* Macro to read the registers */
 
-#define adt7475_read(reg) i2c_smbus_read_byte_data(client, (reg))
+static inline s32 __adt7475_read(const struct i2c_client *client, u8 cmd)
+{
+	s32 ret;
+
+	ret = i2c_smbus_read_byte_data(client, cmd);
+	if (ret < 0) {
+		printk("__adt7475_read error: %d\n", ret);
+		return 0;
+	}
+	return ret;
+}
+
+#define adt7475_read(reg) __adt7475_read(client, (reg))
 
 /* Macros to easily index the registers */
 
diff -ruw linux-5.4.60/drivers/hwmon/Kconfig linux-5.4.60-fbx/drivers/hwmon/Kconfig
--- linux-5.4.60/drivers/hwmon/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/hwmon/Kconfig	2021-03-04 13:20:58.447505585 +0100
@@ -1922,6 +1922,17 @@
 	  If you say yes here you get support for the temperature
 	  and power sensors for APM X-Gene SoC.
 
+config SENSORS_KIRKWOOD_CORETEMP
+	tristate "Kirkwood core temperature censor"
+	depends on MACH_KIRKWOOD
+
+config SENSORS_LD6710_FBX
+	tristate "LD6710 hardware monitoring driver (as seen on Freebox hardware)"
+	depends on I2C
+
+config SENSORS_AP806
+	tristate "Marvell AP806/CP110 hardware monitoring driver"
+
 if ACPI
 
 comment "ACPI drivers"
diff -ruw linux-5.4.60/drivers/hwmon/Makefile linux-5.4.60-fbx/drivers/hwmon/Makefile
--- linux-5.4.60/drivers/hwmon/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/hwmon/Makefile	2021-03-04 13:20:58.447505585 +0100
@@ -87,6 +87,7 @@
 obj-$(CONFIG_SENSORS_JC42)	+= jc42.o
 obj-$(CONFIG_SENSORS_K8TEMP)	+= k8temp.o
 obj-$(CONFIG_SENSORS_K10TEMP)	+= k10temp.o
+obj-$(CONFIG_SENSORS_LD6710_FBX) += ld6710-fbx.o
 obj-$(CONFIG_SENSORS_LINEAGE)	+= lineage-pem.o
 obj-$(CONFIG_SENSORS_LOCHNAGAR)	+= lochnagar-hwmon.o
 obj-$(CONFIG_SENSORS_LM63)	+= lm63.o
@@ -177,6 +178,8 @@
 obj-$(CONFIG_SENSORS_WM831X)	+= wm831x-hwmon.o
 obj-$(CONFIG_SENSORS_WM8350)	+= wm8350-hwmon.o
 obj-$(CONFIG_SENSORS_XGENE)	+= xgene-hwmon.o
+obj-$(CONFIG_SENSORS_KIRKWOOD_CORETEMP)+= kirkwood-coretemp.o
+obj-$(CONFIG_SENSORS_AP806)	+= ap806-hwmon.o
 
 obj-$(CONFIG_SENSORS_OCC)	+= occ/
 obj-$(CONFIG_PMBUS)		+= pmbus/
diff -ruw linux-5.4.60/drivers/i2c/busses/i2c-mv64xxx.c linux-5.4.60-fbx/drivers/i2c/busses/i2c-mv64xxx.c
--- linux-5.4.60/drivers/i2c/busses/i2c-mv64xxx.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/i2c/busses/i2c-mv64xxx.c	2021-03-04 13:20:58.480838920 +0100
@@ -22,6 +22,8 @@
 #include <linux/of.h>
 #include <linux/of_device.h>
 #include <linux/of_irq.h>
+#include <linux/of_gpio.h>
+#include <linux/pinctrl/consumer.h>
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/delay.h>
@@ -147,6 +149,10 @@
 	bool			irq_clear_inverted;
 	/* Clk div is 2 to the power n, not 2 to the power n + 1 */
 	bool			clk_n_base_0;
+	struct i2c_bus_recovery_info rinfo;
+	struct pinctrl		*pinctrl;
+	struct pinctrl_state	*pinctrl_pins_default;
+	struct pinctrl_state	*pinctrl_pins_gpio;
 };
 
 static struct mv64xxx_i2c_regs mv64xxx_i2c_regs_mv64xxx = {
@@ -312,6 +318,11 @@
 	case MV64XXX_I2C_STATUS_MAST_WR_NO_ACK: /* 30 */
 	case MV64XXX_I2C_STATUS_MAST_RD_ADDR_NO_ACK: /* 48 */
 		/* Doesn't seem to be a device at other end */
+		dev_dbg(&drv_data->adapter.dev,
+			"mv64xxx_i2c_fsm: got no ack -- state: 0x%x, "
+			"status: 0x%x, addr: 0x%x, flags: 0x%x\n",
+			 drv_data->state, status, drv_data->msg->addr,
+			 drv_data->msg->flags);
 		drv_data->action = MV64XXX_I2C_ACTION_SEND_STOP;
 		drv_data->state = MV64XXX_I2C_STATE_IDLE;
 		drv_data->rc = -ENXIO;
@@ -562,6 +573,8 @@
 				"mv64xxx: I2C bus locked, block: %d, "
 				"time_left: %d\n", drv_data->block,
 				(int)time_left);
+			if (drv_data->adapter.bus_recovery_info)
+				i2c_recover_bus(&drv_data->adapter);
 			mv64xxx_i2c_hw_init(drv_data);
 		}
 	} else
@@ -573,6 +586,34 @@
 				int is_last)
 {
 	unsigned long	flags;
+	int limit;
+
+	/*
+	 * wait for (re)start/stop condition to clear from last
+	 * transfer if any
+	 */
+	limit = 1000;
+	do {
+		u32 val;
+
+		val = readl(drv_data->reg_base + drv_data->reg_offsets.control);
+		if (!(val & (MV64XXX_I2C_REG_CONTROL_STOP |
+			     MV64XXX_I2C_REG_CONTROL_STOP)))
+			break;
+
+		udelay(1);
+	} while (limit-- > 0);
+
+	if (limit < 0) {
+		dev_err(&drv_data->adapter.dev,
+			"mv64xxx: start/stop bit won't clear\n");
+	}
+
+	/* according to datasheet, controller is buggy when you do
+	 * register polling and it says to always wait for an IRQ
+	 * (clock domain related), since we busywait for START/STOP
+	 * clear, add a small delay */
+	udelay(5);
 
 	spin_lock_irqsave(&drv_data->lock, flags);
 
@@ -580,6 +621,7 @@
 
 	drv_data->send_stop = is_last;
 	drv_data->block = 1;
+
 	mv64xxx_i2c_send_start(drv_data);
 	spin_unlock_irqrestore(&drv_data->lock, flags);
 
@@ -863,6 +905,61 @@
 out:
 	return rc;
 }
+
+static void mv64xxx_prepare_recovery(struct i2c_adapter *adap)
+{
+	struct mv64xxx_i2c_data *drv_data = i2c_get_adapdata(adap);
+	pinctrl_select_state(drv_data->pinctrl, drv_data->pinctrl_pins_gpio);
+}
+
+static void mv64xxx_unprepare_recovery(struct i2c_adapter *adap)
+{
+	struct mv64xxx_i2c_data *drv_data = i2c_get_adapdata(adap);
+	pinctrl_select_state(drv_data->pinctrl, drv_data->pinctrl_pins_default);
+}
+
+static int mv64xxx_init_recovery_info(struct mv64xxx_i2c_data *drv_data,
+				      struct platform_device *pdev)
+{
+	struct i2c_bus_recovery_info *rinfo = &drv_data->rinfo;
+
+	drv_data->pinctrl = devm_pinctrl_get(&pdev->dev);
+	if (!drv_data->pinctrl || IS_ERR(drv_data->pinctrl)) {
+		if (PTR_ERR(drv_data->pinctrl) == -EPROBE_DEFER)
+			return -EPROBE_DEFER;
+		dev_info(&pdev->dev, "can't get pinctrl, bus recovery not supported\n");
+		return 0;
+	}
+
+	drv_data->pinctrl_pins_default = pinctrl_lookup_state(drv_data->pinctrl,
+			PINCTRL_STATE_DEFAULT);
+	drv_data->pinctrl_pins_gpio = pinctrl_lookup_state(drv_data->pinctrl,
+			"gpio");
+
+	rinfo->sda_gpiod = devm_gpiod_get(&pdev->dev, "sda",
+					  GPIOD_IN);
+	rinfo->scl_gpiod = devm_gpiod_get(&pdev->dev, "scl",
+					  GPIOD_OUT_HIGH_OPEN_DRAIN);
+
+	if (PTR_ERR(rinfo->sda_gpiod) == -EPROBE_DEFER ||
+	    PTR_ERR(rinfo->scl_gpiod) == -EPROBE_DEFER) {
+		return -EPROBE_DEFER;
+	} else if (IS_ERR(rinfo->sda_gpiod) ||
+		   IS_ERR(rinfo->scl_gpiod) ||
+		   IS_ERR(drv_data->pinctrl_pins_default) ||
+		   IS_ERR(drv_data->pinctrl_pins_gpio)) {
+		dev_info(&pdev->dev, "recovery information incomplete\n");
+		return 0;
+	}
+
+	rinfo->prepare_recovery = mv64xxx_prepare_recovery;
+	rinfo->unprepare_recovery = mv64xxx_unprepare_recovery;
+	rinfo->recover_bus = i2c_generic_scl_recovery;
+	drv_data->adapter.bus_recovery_info = rinfo;
+
+	return 0;
+}
+
 #else /* CONFIG_OF */
 static int
 mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
@@ -870,8 +967,15 @@
 {
 	return -ENODEV;
 }
+
+static int mv64xxx_init_recovery_info(struct mv64xxx_i2c_data *drv_data,
+				      struct platform_device *pdev)
+{
+	return 0;
+}
 #endif /* CONFIG_OF */
 
+
 static int
 mv64xxx_i2c_probe(struct platform_device *pd)
 {
@@ -899,6 +1003,10 @@
 	init_waitqueue_head(&drv_data->waitq);
 	spin_lock_init(&drv_data->lock);
 
+	rc = mv64xxx_init_recovery_info(drv_data, pd);
+	if (rc)
+		return rc;
+
 	/* Not all platforms have clocks */
 	drv_data->clk = devm_clk_get(&pd->dev, NULL);
 	if (IS_ERR(drv_data->clk) && PTR_ERR(drv_data->clk) == -EPROBE_DEFER)
@@ -934,7 +1042,7 @@
 	drv_data->adapter.dev.parent = &pd->dev;
 	drv_data->adapter.algo = &mv64xxx_i2c_algo;
 	drv_data->adapter.owner = THIS_MODULE;
-	drv_data->adapter.class = I2C_CLASS_DEPRECATED;
+	drv_data->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
 	drv_data->adapter.nr = pd->id;
 	drv_data->adapter.dev.of_node = pd->dev.of_node;
 	platform_set_drvdata(pd, drv_data);
diff -ruw linux-5.4.60/drivers/i2c/busses/Kconfig linux-5.4.60-fbx/drivers/i2c/busses/Kconfig
--- linux-5.4.60/drivers/i2c/busses/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/i2c/busses/Kconfig	2021-03-04 13:20:58.474172253 +0100
@@ -473,7 +473,7 @@
 config I2C_BRCMSTB
 	tristate "BRCM Settop/DSL I2C controller"
 	depends on ARCH_BRCMSTB || BMIPS_GENERIC || ARCH_BCM_63XX || \
-		   COMPILE_TEST
+		   ARCH_BCM63XX || COMPILE_TEST
 	default y
 	help
 	  If you say yes to this option, support will be included for the
@@ -1376,6 +1376,10 @@
 	  to SLIMpro (On chip coprocessor) mailbox mechanism.
 	  If unsure, say N.
 
+config I2C_WP3
+	tristate "Wintegra WP3 I2C controll"
+	depends on WINTEGRA_WINPATH3
+
 config SCx200_ACB
 	tristate "Geode ACCESS.bus support"
 	depends on X86_32 && PCI
diff -ruw linux-5.4.60/drivers/i2c/busses/Makefile linux-5.4.60-fbx/drivers/i2c/busses/Makefile
--- linux-5.4.60/drivers/i2c/busses/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/i2c/busses/Makefile	2021-03-04 13:20:58.474172253 +0100
@@ -123,6 +123,7 @@
 obj-$(CONFIG_I2C_XLP9XX)	+= i2c-xlp9xx.o
 obj-$(CONFIG_I2C_RCAR)		+= i2c-rcar.o
 obj-$(CONFIG_I2C_ZX2967)	+= i2c-zx2967.o
+obj-$(CONFIG_I2C_WP3)		+= i2c-wp3.o
 
 # External I2C/SMBus adapter drivers
 obj-$(CONFIG_I2C_DIOLAN_U2C)	+= i2c-diolan-u2c.o
diff -ruw linux-5.4.60/drivers/i2c/i2c-core-base.c linux-5.4.60-fbx/drivers/i2c/i2c-core-base.c
--- linux-5.4.60/drivers/i2c/i2c-core-base.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/i2c/i2c-core-base.c	2021-03-04 13:20:58.487505587 +0100
@@ -223,12 +223,14 @@
 			bri->set_sda(adap, scl);
 		ndelay(RECOVERY_NDELAY / 2);
 
+		if (0) {
 		if (scl) {
 			ret = i2c_generic_bus_free(adap);
 			if (ret == 0)
 				break;
 		}
 	}
+	}
 
 	/* If we can't check bus status, assume recovery worked */
 	if (ret == -EOPNOTSUPP)
diff -ruw linux-5.4.60/drivers/input/misc/Kconfig linux-5.4.60-fbx/drivers/input/misc/Kconfig
--- linux-5.4.60/drivers/input/misc/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/input/misc/Kconfig	2021-03-04 13:20:58.604172259 +0100
@@ -894,4 +894,9 @@
 	  To compile this driver as a module, choose M here: the
 	  module will be called stpmic1_onkey.
 
+config INPUT_SMSC_CAP1066
+	tristate "SMSC CAP1066 capacitive sensor driver"
+	select I2C
+	select INPUT_POLLDEV
+
 endif
diff -ruw linux-5.4.60/drivers/input/misc/Makefile linux-5.4.60-fbx/drivers/input/misc/Makefile
--- linux-5.4.60/drivers/input/misc/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/input/misc/Makefile	2021-03-04 13:20:58.604172259 +0100
@@ -85,4 +85,4 @@
 obj-$(CONFIG_INPUT_XEN_KBDDEV_FRONTEND)	+= xen-kbdfront.o
 obj-$(CONFIG_INPUT_YEALINK)		+= yealink.o
 obj-$(CONFIG_INPUT_IDEAPAD_SLIDEBAR)	+= ideapad_slidebar.o
-
+obj-$(CONFIG_INPUT_SMSC_CAP1066)	+= smsc_cap1066.o
diff -ruw linux-5.4.60/drivers/Kconfig linux-5.4.60-fbx/drivers/Kconfig
--- linux-5.4.60/drivers/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/Kconfig	2021-03-04 13:20:57.530838878 +0100
@@ -18,6 +18,8 @@
 
 source "drivers/gnss/Kconfig"
 
+source "drivers/fbxprocfs/Kconfig"
+
 source "drivers/mtd/Kconfig"
 
 source "drivers/of/Kconfig"
@@ -78,6 +80,10 @@
 
 source "drivers/gpio/Kconfig"
 
+source "drivers/fbxgpio/Kconfig"
+
+source "drivers/fbxjtag/Kconfig"
+
 source "drivers/w1/Kconfig"
 
 source "drivers/power/Kconfig"
@@ -86,6 +92,8 @@
 
 source "drivers/thermal/Kconfig"
 
+source "drivers/fbxwatchdog/Kconfig"
+
 source "drivers/watchdog/Kconfig"
 
 source "drivers/ssb/Kconfig"
diff -ruw linux-5.4.60/drivers/leds/Kconfig linux-5.4.60-fbx/drivers/leds/Kconfig
--- linux-5.4.60/drivers/leds/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/leds/Kconfig	2021-03-04 13:20:58.647505594 +0100
@@ -823,6 +823,16 @@
 	  Say Y to enable the LM36274 LED driver for TI LMU devices.
 	  This supports the LED device LM36274.
 
+config LEDS_LED1202
+	tristate "LED support for STMicroElectronics LED1202"
+	depends on LEDS_CLASS && I2C && OF
+	help
+	  This option enables support for the LED1202 12-channel
+	  LED driver.
+
+	  To compile this driver as a module, choose M here: the module
+	  will be called leds-led1202.
+
 comment "LED Triggers"
 source "drivers/leds/trigger/Kconfig"
 
diff -ruw linux-5.4.60/drivers/leds/Makefile linux-5.4.60-fbx/drivers/leds/Makefile
--- linux-5.4.60/drivers/leds/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/leds/Makefile	2021-03-04 13:20:58.647505594 +0100
@@ -85,6 +85,7 @@
 obj-$(CONFIG_LEDS_TI_LMU_COMMON)	+= leds-ti-lmu-common.o
 obj-$(CONFIG_LEDS_LM3697)		+= leds-lm3697.o
 obj-$(CONFIG_LEDS_LM36274)		+= leds-lm36274.o
+obj-$(CONFIG_LEDS_LED1202)		+= leds-led1202.o
 
 # LED SPI Drivers
 obj-$(CONFIG_LEDS_CR0014114)		+= leds-cr0014114.o
diff -ruw linux-5.4.60/drivers/Makefile linux-5.4.60-fbx/drivers/Makefile
--- linux-5.4.60/drivers/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/Makefile	2021-03-04 13:20:57.530838878 +0100
@@ -16,7 +16,9 @@
 obj-$(CONFIG_GPIOLIB)		+= gpio/
 obj-y				+= pwm/
 
+obj-$(CONFIG_FREEBOX_GPIO)	+= fbxgpio/
 obj-y				+= pci/
+obj-$(CONFIG_FREEBOX_JTAG)	+= fbxjtag/
 
 obj-$(CONFIG_PARISC)		+= parisc/
 obj-$(CONFIG_RAPIDIO)		+= rapidio/
@@ -117,6 +119,7 @@
 obj-y				+= power/
 obj-$(CONFIG_HWMON)		+= hwmon/
 obj-$(CONFIG_THERMAL)		+= thermal/
+obj-$(CONFIG_FREEBOX_WATCHDOG)	+= fbxwatchdog/
 obj-$(CONFIG_WATCHDOG)		+= watchdog/
 obj-$(CONFIG_MD)		+= md/
 obj-$(CONFIG_BT)		+= bluetooth/
@@ -186,3 +189,5 @@
 obj-$(CONFIG_GNSS)		+= gnss/
 obj-$(CONFIG_INTERCONNECT)	+= interconnect/
 obj-$(CONFIG_COUNTER)		+= counter/
+
+obj-$(CONFIG_FREEBOX_PROCFS)	+= fbxprocfs/
diff -ruw linux-5.4.60/drivers/media/dvb-core/dvb_frontend.c linux-5.4.60-fbx/drivers/media/dvb-core/dvb_frontend.c
--- linux-5.4.60/drivers/media/dvb-core/dvb_frontend.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/media/dvb-core/dvb_frontend.c	2021-03-04 13:20:58.687505596 +0100
@@ -807,6 +807,7 @@
 	if (fe->exit != DVB_FE_DEVICE_REMOVED)
 		fe->exit = DVB_FE_NORMAL_EXIT;
 	mb();
+	wake_up_all(&fepriv->events.wait_queue);
 
 	if (!fepriv->thread)
 		return;
@@ -2715,6 +2716,9 @@
 
 	poll_wait(file, &fepriv->events.wait_queue, wait);
 
+	if (fe->exit)
+		return POLLERR | POLLHUP;
+
 	if (fepriv->events.eventw != fepriv->events.eventr)
 		return (EPOLLIN | EPOLLRDNORM | EPOLLPRI);
 
diff -ruw linux-5.4.60/drivers/media/rc/keymaps/Makefile linux-5.4.60-fbx/drivers/media/rc/keymaps/Makefile
--- linux-5.4.60/drivers/media/rc/keymaps/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/media/rc/keymaps/Makefile	2021-03-04 13:20:58.817505601 +0100
@@ -91,6 +91,7 @@
 			rc-pv951.o \
 			rc-hauppauge.o \
 			rc-rc6-mce.o \
+			rc-rc6-freebox.o \
 			rc-real-audio-220-32-keys.o \
 			rc-reddo.o \
 			rc-snapstream-firefly.o \
diff -ruw linux-5.4.60/drivers/media/usb/dvb-usb/dib0700_devices.c linux-5.4.60-fbx/drivers/media/usb/dvb-usb/dib0700_devices.c
--- linux-5.4.60/drivers/media/usb/dvb-usb/dib0700_devices.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/media/usb/dvb-usb/dib0700_devices.c	2021-03-04 13:20:58.840838936 +0100
@@ -3912,6 +3912,7 @@
 	{ USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK8096PVR) },
 /* 85 */{ USB_DEVICE(USB_VID_HAMA,	USB_PID_HAMA_DVBT_HYBRID) },
 	{ USB_DEVICE(USB_VID_MICROSOFT,	USB_PID_XBOX_ONE_TUNER) },
+	{ USB_DEVICE(USB_VID_DIBCOM,	USB_PID_DIBCOM_HOOK_DEFAULT_STK7770P) },
 	{ 0 }		/* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, dib0700_usb_id_table);
@@ -5154,6 +5155,30 @@
 				{ NULL },
 			},
 		},
+	}, { DIB0700_DEFAULT_DEVICE_PROPERTIES,
+		.num_adapters = 1,
+		.adapter = {
+			{
+			DIB0700_NUM_FRONTENDS(1),
+			.fe = {{
+				.caps = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter       = stk70x0p_pid_filter,
+				.pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
+				.frontend_attach  = stk7770p_frontend_attach,
+				.tuner_attach     = dib7770p_tuner_attach,
+
+				DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
+			}},
+			},
+		},
+		.num_device_descs = 1,
+		.devices = {
+			{   "DiBcom STK7770P reference design no IR",
+				{ &dib0700_usb_id_table[87], NULL },
+				{ NULL },
+			},
+		},
 	},
 };
 
diff -ruw linux-5.4.60/drivers/mfd/Kconfig linux-5.4.60-fbx/drivers/mfd/Kconfig
--- linux-5.4.60/drivers/mfd/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mfd/Kconfig	2021-03-04 13:20:58.880838938 +0100
@@ -1967,6 +1967,16 @@
 	  This driver provides common support for accessing the device,
 	  additional drivers must be enabled in order to use the functionality
 	  of the device.
+config MFD_FBXGW7R_PANEL
+	tristate "Freebox fbxgw7r panel support"
+	depends on FB
+	depends on SPI_MASTER
+	depends on OF
+	select FB_SYS_FOPS
+	select FB_SYS_FILLRECT
+	select FB_SYS_COPYAREA
+	select FB_SYS_IMAGEBLIT
+	select FB_DEFERRED_IO
 
 menu "Multimedia Capabilities Port drivers"
 	depends on ARCH_SA1100
diff -ruw linux-5.4.60/drivers/mfd/Makefile linux-5.4.60-fbx/drivers/mfd/Makefile
--- linux-5.4.60/drivers/mfd/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mfd/Makefile	2021-03-04 13:20:58.880838938 +0100
@@ -255,4 +255,5 @@
 obj-$(CONFIG_MFD_ROHM_BD70528)	+= rohm-bd70528.o
 obj-$(CONFIG_MFD_ROHM_BD718XX)	+= rohm-bd718x7.o
 obj-$(CONFIG_MFD_STMFX) 	+= stmfx.o
+obj-$(CONFIG_MFD_FBXGW7R_PANEL)	+= fbxgw7r-panel.o
 
diff -ruw linux-5.4.60/drivers/misc/eeprom/at24.c linux-5.4.60-fbx/drivers/misc/eeprom/at24.c
--- linux-5.4.60/drivers/misc/eeprom/at24.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/misc/eeprom/at24.c	2021-03-04 13:20:58.904172272 +0100
@@ -566,7 +566,6 @@
 	struct at24_data *at24;
 	struct regmap *regmap;
 	bool writable;
-	u8 test_byte;
 	int err;
 
 	i2c_fn_i2c = i2c_check_functionality(client->adapter, I2C_FUNC_I2C);
@@ -587,8 +586,10 @@
 		page_size = 1;
 
 	flags = cdata->flags;
+#ifndef CONFIG_NVMEM_IGNORE_RO
 	if (device_property_present(dev, "read-only"))
 		flags |= AT24_FLAG_READONLY;
+#endif
 	if (device_property_present(dev, "no-read-rollover"))
 		flags |= AT24_FLAG_NO_RDROL;
 
@@ -705,17 +706,6 @@
 	pm_runtime_set_active(dev);
 	pm_runtime_enable(dev);
 
-	/*
-	 * Perform a one-byte test read to verify that the
-	 * chip is functional.
-	 */
-	err = at24_read(at24, 0, &test_byte, 1);
-	pm_runtime_idle(dev);
-	if (err) {
-		pm_runtime_disable(dev);
-		return -ENODEV;
-	}
-
 	dev_info(dev, "%u byte %s EEPROM, %s, %u bytes/write\n",
 		 byte_len, client->name,
 		 writable ? "writable" : "read-only", at24->write_max);
diff -ruw linux-5.4.60/drivers/misc/eeprom/Kconfig linux-5.4.60-fbx/drivers/misc/eeprom/Kconfig
--- linux-5.4.60/drivers/misc/eeprom/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/misc/eeprom/Kconfig	2021-03-04 13:20:58.904172272 +0100
@@ -129,4 +129,8 @@
 	  This driver can also be built as a module.  If so, the module
 	  will be called ee1004.
 
+config EEPROM_EE1004_RAW
+	tristate "SPD EEPROMs on DDR4 memory modules (non smbus)"
+	depends on I2C && SYSFS
+
 endmenu
diff -ruw linux-5.4.60/drivers/misc/eeprom/Makefile linux-5.4.60-fbx/drivers/misc/eeprom/Makefile
--- linux-5.4.60/drivers/misc/eeprom/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/misc/eeprom/Makefile	2021-03-04 13:20:58.904172272 +0100
@@ -8,3 +8,4 @@
 obj-$(CONFIG_EEPROM_DIGSY_MTC_CFG) += digsy_mtc_eeprom.o
 obj-$(CONFIG_EEPROM_IDT_89HPESX) += idt_89hpesx.o
 obj-$(CONFIG_EEPROM_EE1004)	+= ee1004.o
+obj-$(CONFIG_EEPROM_EE1004_RAW)	+= ee1004_raw.o
diff -ruw linux-5.4.60/drivers/misc/Kconfig linux-5.4.60-fbx/drivers/misc/Kconfig
--- linux-5.4.60/drivers/misc/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/misc/Kconfig	2021-03-04 13:20:58.900838939 +0100
@@ -5,6 +5,9 @@
 
 menu "Misc devices"
 
+config WINTEGRA_MMAP
+	bool "wintegra mmap driver"
+
 config SENSORS_LIS3LV02D
 	tristate
 	depends on INPUT
@@ -379,6 +382,18 @@
 	  To compile this driver as a module, choose M here: the
 	  module will be called vmw_balloon.
 
+config INTELCE_PIC16PMU
+	tristate "PIC16 PMU, LED, hwmon support"
+	select INPUT_POLLDEV
+	select NEW_LEDS
+	select I2C
+	select HWMON
+	select ARCH_REQUIRE_GPIOLIB
+	---help---
+	  Freebox v6 HD PIC16 PMU interface support, enables
+	  control of the on-board LEDs and reports the power status,
+	  reset status and button status.
+
 config PCH_PHUB
 	tristate "Intel EG20T PCH/LAPIS Semicon IOH(ML7213/ML7223/ML7831) PHUB"
 	select GENERIC_NET_UTILS
@@ -400,6 +415,15 @@
 	  To compile this driver as a module, choose M here: the module will
 	  be called pch_phub.
 
+config FBXSERIAL_OF
+	bool "read fbxserial through DT chosen node"
+	depends on OF
+	select ARCH_HAS_FBXSERIAL
+
+config RANDOM_OF
+	bool "get Linux PRNG random through dt chosen node."
+	depends on OF
+
 config LATTICE_ECP3_CONFIG
 	tristate "Lattice ECP3 FPGA bitstream configuration via SPI"
 	depends on SPI && SYSFS
@@ -481,4 +505,6 @@
 source "drivers/misc/ocxl/Kconfig"
 source "drivers/misc/cardreader/Kconfig"
 source "drivers/misc/habanalabs/Kconfig"
+source "drivers/misc/remoti/Kconfig"
+source "drivers/misc/hdmi-cec/Kconfig"
 endmenu
diff -ruw linux-5.4.60/drivers/misc/Makefile linux-5.4.60-fbx/drivers/misc/Makefile
--- linux-5.4.60/drivers/misc/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/misc/Makefile	2021-03-04 13:20:58.900838939 +0100
@@ -3,6 +3,7 @@
 # Makefile for misc devices that really don't fit anywhere else.
 #
 
+obj-$(CONFIG_WINTEGRA_MMAP)	+= wintegra_mmap.o
 obj-$(CONFIG_IBM_ASM)		+= ibmasm/
 obj-$(CONFIG_IBMVMC)		+= ibmvmc.o
 obj-$(CONFIG_AD525X_DPOT)	+= ad525x_dpot.o
@@ -23,7 +24,10 @@
 obj-$(CONFIG_SENSORS_APDS990X)	+= apds990x.o
 obj-$(CONFIG_ENCLOSURE_SERVICES) += enclosure.o
 obj-$(CONFIG_KGDB_TESTS)	+= kgdbts.o
+obj-$(CONFIG_FBXSERIAL_OF)	+= fbxserial_of.o
+obj-$(CONFIG_RANDOM_OF)		+= random_of.o
 obj-$(CONFIG_SGI_XP)		+= sgi-xp/
+obj-$(CONFIG_INTELCE_PIC16PMU)	+= pic16-pmu.o
 obj-$(CONFIG_SGI_GRU)		+= sgi-gru/
 obj-$(CONFIG_CS5535_MFGPT)	+= cs5535-mfgpt.o
 obj-$(CONFIG_HP_ILO)		+= hpilo.o
@@ -38,6 +42,7 @@
 obj-y				+= cb710/
 obj-$(CONFIG_VMWARE_BALLOON)	+= vmw_balloon.o
 obj-$(CONFIG_PCH_PHUB)		+= pch_phub.o
+obj-y				+= hdmi-cec/
 obj-y				+= ti-st/
 obj-y				+= lis3lv02d/
 obj-$(CONFIG_ALTERA_STAPL)	+=altera-stapl/
@@ -57,3 +62,4 @@
 obj-$(CONFIG_PVPANIC)   	+= pvpanic.o
 obj-$(CONFIG_HABANA_AI)		+= habanalabs/
 obj-$(CONFIG_XILINX_SDFEC)	+= xilinx_sdfec.o
+obj-y				+= remoti/
diff -ruw linux-5.4.60/drivers/mmc/core/block.c linux-5.4.60-fbx/drivers/mmc/core/block.c
--- linux-5.4.60/drivers/mmc/core/block.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mmc/core/block.c	2021-03-04 13:20:58.930838940 +0100
@@ -2319,7 +2319,7 @@
 	md->parent = parent;
 	set_disk_ro(md->disk, md->read_only || default_ro);
 	md->disk->flags = GENHD_FL_EXT_DEVT;
-	if (area_type & (MMC_BLK_DATA_AREA_RPMB | MMC_BLK_DATA_AREA_BOOT))
+	if (area_type & (MMC_BLK_DATA_AREA_RPMB))
 		md->disk->flags |= GENHD_FL_NO_PART_SCAN
 				   | GENHD_FL_SUPPRESS_PARTITION_INFO;
 
diff -ruw linux-5.4.60/drivers/mmc/host/Kconfig linux-5.4.60-fbx/drivers/mmc/host/Kconfig
--- linux-5.4.60/drivers/mmc/host/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mmc/host/Kconfig	2021-03-04 13:20:58.934172273 +0100
@@ -976,7 +976,7 @@
 
 config MMC_SDHCI_BRCMSTB
 	tristate "Broadcom SDIO/SD/MMC support"
-	depends on ARCH_BRCMSTB || BMIPS_GENERIC
+	depends on ARCH_BRCMSTB || BMIPS_GENERIC || ARCH_BCM63XX
 	depends on MMC_SDHCI_PLTFM
 	default y
 	help
diff -ruw linux-5.4.60/drivers/mtd/Kconfig linux-5.4.60-fbx/drivers/mtd/Kconfig
--- linux-5.4.60/drivers/mtd/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mtd/Kconfig	2021-03-04 13:20:58.947505608 +0100
@@ -23,6 +23,9 @@
 	  WARNING: some of the tests will ERASE entire MTD device which they
 	  test. Do not use these tests unless you really know what you do.
 
+config MTD_ERASE_PRINTK
+	bool "write to kernel log when a block is erased"
+
 menu "Partition parsers"
 source "drivers/mtd/parsers/Kconfig"
 endmenu
diff -ruw linux-5.4.60/drivers/mtd/mtdchar.c linux-5.4.60-fbx/drivers/mtd/mtdchar.c
--- linux-5.4.60/drivers/mtd/mtdchar.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mtd/mtdchar.c	2021-03-04 13:20:58.954172274 +0100
@@ -176,6 +176,7 @@
 		{
 			struct mtd_oob_ops ops;
 
+			memset(&ops, 0, sizeof (ops));
 			ops.mode = MTD_OPS_RAW;
 			ops.datbuf = kbuf;
 			ops.oobbuf = NULL;
@@ -270,6 +271,7 @@
 		{
 			struct mtd_oob_ops ops;
 
+			memset(&ops, 0, sizeof (ops));
 			ops.mode = MTD_OPS_RAW;
 			ops.datbuf = kbuf;
 			ops.oobbuf = NULL;
@@ -753,6 +755,11 @@
 				erase->len = einfo32.length;
 			}
 
+#ifdef CONFIG_MTD_ERASE_PRINTK
+			printk(KERN_DEBUG "mtd: %s: ERASE offset=@%08llx\n",
+			       mtd->name, erase->addr);
+#endif
+
 			ret = mtd_erase(mtd, erase);
 			kfree(erase);
 		}
diff -ruw linux-5.4.60/drivers/mtd/mtdcore.c linux-5.4.60-fbx/drivers/mtd/mtdcore.c
--- linux-5.4.60/drivers/mtd/mtdcore.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mtd/mtdcore.c	2021-03-04 13:20:58.954172274 +0100
@@ -307,6 +307,43 @@
 }
 static DEVICE_ATTR(bbt_blocks, S_IRUGO, mtd_bbtblocks_show, NULL);
 
+static ssize_t mtd_nand_type_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct mtd_info *mtd = dev_get_drvdata(dev);
+
+	return snprintf(buf, PAGE_SIZE, "%s\n", mtd->nand_type);
+}
+static DEVICE_ATTR(nand_type, S_IRUGO, mtd_nand_type_show, NULL);
+
+static ssize_t mtd_nand_manufacturer_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct mtd_info *mtd = dev_get_drvdata(dev);
+
+	return snprintf(buf, PAGE_SIZE, "%s\n", mtd->nand_manufacturer);
+}
+static DEVICE_ATTR(nand_manufacturer, S_IRUGO, mtd_nand_manufacturer_show, NULL);
+
+static ssize_t mtd_nand_onfi_ecc_bits_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct mtd_info *mtd = dev_get_drvdata(dev);
+
+	return snprintf(buf, PAGE_SIZE, "%d\n", mtd->onfi_ecc_bits);
+}
+static DEVICE_ATTR(onfi_ecc_bits, S_IRUGO, mtd_nand_onfi_ecc_bits_show, NULL);
+
+static ssize_t mtd_nand_onfi_model_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct mtd_info *mtd = dev_get_drvdata(dev);
+
+	return snprintf(buf, PAGE_SIZE, "%s\n",
+			mtd->onfi_model ? mtd->onfi_model : "unknown");
+}
+static DEVICE_ATTR(onfi_model, S_IRUGO, mtd_nand_onfi_model_show, NULL);
+
 static struct attribute *mtd_attrs[] = {
 	&dev_attr_type.attr,
 	&dev_attr_flags.attr,
@@ -325,6 +362,10 @@
 	&dev_attr_bad_blocks.attr,
 	&dev_attr_bbt_blocks.attr,
 	&dev_attr_bitflip_threshold.attr,
+	&dev_attr_nand_type.attr,
+	&dev_attr_nand_manufacturer.attr,
+	&dev_attr_onfi_ecc_bits.attr,
+	&dev_attr_onfi_model.attr,
 	NULL,
 };
 ATTRIBUTE_GROUPS(mtd);
diff -ruw linux-5.4.60/drivers/mtd/mtdpart.c linux-5.4.60-fbx/drivers/mtd/mtdpart.c
--- linux-5.4.60/drivers/mtd/mtdpart.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mtd/mtdpart.c	2021-03-04 13:20:58.954172274 +0100
@@ -350,6 +350,10 @@
 	slave->mtd.oobavail = parent->oobavail;
 	slave->mtd.subpage_sft = parent->subpage_sft;
 	slave->mtd.pairing = parent->pairing;
+	slave->mtd.nand_type = parent->nand_type;
+	slave->mtd.nand_manufacturer = parent->nand_manufacturer;
+	slave->mtd.onfi_ecc_bits = parent->onfi_ecc_bits;
+	slave->mtd.onfi_model = parent->onfi_model;
 
 	slave->mtd.name = name;
 	slave->mtd.owner = parent->owner;
diff -ruw linux-5.4.60/drivers/mtd/nand/raw/Kconfig linux-5.4.60-fbx/drivers/mtd/nand/raw/Kconfig
--- linux-5.4.60/drivers/mtd/nand/raw/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mtd/nand/raw/Kconfig	2021-03-04 13:20:58.957505608 +0100
@@ -34,6 +34,14 @@
 
 comment "Raw/parallel NAND flash controllers"
 
+config MTD_FORCE_BAD_BLOCK_ERASE
+	bool "Force erase on bad blocks (useful for bootloader parts)"
+	default n
+	help
+	  Enable this option only when you need to force an erase on
+	  blocks being marked as "bad" by Linux (i.e: other ECC/bad block
+	  marker layout).
+
 config MTD_NAND_DENALI
 	tristate
 
@@ -53,6 +61,10 @@
 	  Enable the driver for NAND flash on platforms using a Denali NAND
 	  controller as a DT device.
 
+config MTD_NAND_DENALI_FBX
+	tristate "NAND Denali controller support"
+	depends on PCI
+
 config MTD_NAND_AMS_DELTA
 	tristate "Amstrad E3 NAND controller"
 	depends on MACH_AMS_DELTA || COMPILE_TEST
diff -ruw linux-5.4.60/drivers/mtd/nand/raw/Makefile linux-5.4.60-fbx/drivers/mtd/nand/raw/Makefile
--- linux-5.4.60/drivers/mtd/nand/raw/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mtd/nand/raw/Makefile	2021-03-04 13:20:58.957505608 +0100
@@ -10,6 +10,7 @@
 obj-$(CONFIG_MTD_NAND_DENALI)		+= denali.o
 obj-$(CONFIG_MTD_NAND_DENALI_PCI)	+= denali_pci.o
 obj-$(CONFIG_MTD_NAND_DENALI_DT)	+= denali_dt.o
+obj-$(CONFIG_MTD_NAND_DENALI_FBX)	+= denali_nand.o
 obj-$(CONFIG_MTD_NAND_AU1550)		+= au1550nd.o
 obj-$(CONFIG_MTD_NAND_S3C2410)		+= s3c2410.o
 obj-$(CONFIG_MTD_NAND_TANGO)		+= tango_nand.o
diff -ruw linux-5.4.60/drivers/mtd/parsers/Kconfig linux-5.4.60-fbx/drivers/mtd/parsers/Kconfig
--- linux-5.4.60/drivers/mtd/parsers/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mtd/parsers/Kconfig	2021-03-04 13:20:58.967505609 +0100
@@ -67,6 +67,10 @@
 	  flash memory node, as described in
 	  Documentation/devicetree/bindings/mtd/partition.txt.
 
+config MTD_OF_PARTS_IGNORE_RO
+	bool "ignore read-only flag"
+	depends on MTD_OF_PARTS
+
 config MTD_PARSER_IMAGETAG
 	tristate "Parser for BCM963XX Image Tag format partitions"
 	depends on BCM63XX || BMIPS_GENERIC || COMPILE_TEST
@@ -160,3 +164,14 @@
 	  'FIS directory' images, enable this option.
 
 endif # MTD_REDBOOT_PARTS
+
+config MTD_FBX6HD_PARTS
+	tristate "Freebox V6 HD partitioning support"
+	help
+	  Freebox V6 HD partitioning support
+
+config MTD_FBX6HD_PARTS_WRITE_ALL
+	bool "make all partitions writeable"
+	depends on MTD_FBX6HD_PARTS
+	help
+	  Freebox V6 HD partitions support
diff -ruw linux-5.4.60/drivers/mtd/parsers/Makefile linux-5.4.60-fbx/drivers/mtd/parsers/Makefile
--- linux-5.4.60/drivers/mtd/parsers/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mtd/parsers/Makefile	2021-03-04 13:20:58.967505609 +0100
@@ -9,3 +9,4 @@
 obj-$(CONFIG_MTD_PARSER_TRX)		+= parser_trx.o
 obj-$(CONFIG_MTD_SHARPSL_PARTS)		+= sharpslpart.o
 obj-$(CONFIG_MTD_REDBOOT_PARTS)		+= redboot.o
+obj-$(CONFIG_MTD_FBX6HD_PARTS)	+= fbx6hd-mtdparts.o
diff -ruw linux-5.4.60/drivers/mtd/parsers/ofpart.c linux-5.4.60-fbx/drivers/mtd/parsers/ofpart.c
--- linux-5.4.60/drivers/mtd/parsers/ofpart.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mtd/parsers/ofpart.c	2021-03-04 13:20:58.967505609 +0100
@@ -111,8 +111,10 @@
 			partname = of_get_property(pp, "name", &len);
 		parts[i].name = partname;
 
+#ifndef CONFIG_MTD_OF_PARTS_IGNORE_RO
 		if (of_get_property(pp, "read-only", &len))
 			parts[i].mask_flags |= MTD_WRITEABLE;
+#endif
 
 		if (of_get_property(pp, "lock", &len))
 			parts[i].mask_flags |= MTD_POWERUP_LOCK;
diff -ruw linux-5.4.60/drivers/mtd/spi-nor/spi-nor.c linux-5.4.60-fbx/drivers/mtd/spi-nor/spi-nor.c
--- linux-5.4.60/drivers/mtd/spi-nor/spi-nor.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/mtd/spi-nor/spi-nor.c	2021-03-04 13:20:58.970838942 +0100
@@ -178,6 +178,7 @@
 
 struct flash_info {
 	char		*name;
+	uint32_t	ext_id;
 
 	/*
 	 * This array stores the ID bytes.
@@ -196,7 +197,8 @@
 	u16		page_size;
 	u16		addr_width;
 
-	u16		flags;
+	u32		flags;
+
 #define SECT_4K			BIT(0)	/* SPINOR_OP_BE_4K works uniformly */
 #define SPI_NOR_NO_ERASE	BIT(1)	/* No erase command needed */
 #define SST_WRITE		BIT(2)	/* use SST byte programming */
@@ -234,6 +236,9 @@
 #define USE_CLSR		BIT(14)	/* use CLSR command */
 #define SPI_NOR_OCTAL_READ	BIT(15)	/* Flash supports Octal Read */
 
+#define ALT_PROBE		BIT(16)	/* only match during alt_probe */
+#define ALT_PROBE_ATMEL		BIT(17)	/* only match during alt_probe_atmel */
+
 	/* Part specific fixup hooks. */
 	const struct spi_nor_fixups *fixups;
 };
@@ -2033,6 +2038,7 @@
 
 /* Used when the "_ext_id" is two bytes at most */
 #define INFO(_jedec_id, _ext_id, _sector_size, _n_sectors, _flags)	\
+		.ext_id = (_ext_id),					\
 		.id = {							\
 			((_jedec_id) >> 16) & 0xff,			\
 			((_jedec_id) >> 8) & 0xff,			\
@@ -2047,6 +2053,7 @@
 		.flags = (_flags),
 
 #define INFO6(_jedec_id, _ext_id, _sector_size, _n_sectors, _flags)	\
+		.ext_id = (_ext_id),					\
 		.id = {							\
 			((_jedec_id) >> 16) & 0xff,			\
 			((_jedec_id) >> 8) & 0xff,			\
@@ -2503,6 +2510,22 @@
 	/* XMC (Wuhan Xinxin Semiconductor Manufacturing Corp.) */
 	{ "XM25QH64A", INFO(0x207017, 0, 64 * 1024, 128, SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },
 	{ "XM25QH128A", INFO(0x207018, 0, 64 * 1024, 256, SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) },
+
+	/* Used on Freebox Gateways ... */
+
+	/* Atmel */
+	{ "at25f512b",  INFO(0x1f6500, 0x1f65, 32 * 1024, 2,
+			     ALT_PROBE_ATMEL) },
+	/* Macronix */
+	{ "mx25l512", INFO(0xc20500, 0xc205, 64 * 1024, 1,
+			   ALT_PROBE | SECT_4K) },
+	/* SST */
+	{ "sst25vf512a", INFO(0xbf4800, 0xbf48, 32 * 1024, 2, ALT_PROBE) },
+
+	/* EON */
+	{ "en25f05", INFO(0x1c0500, 0x1c05, 64 * 1024, 1,
+			  ALT_PROBE | SECT_4K) },
+
 	{ },
 };
 
@@ -2541,6 +2564,69 @@
 	return ERR_PTR(-ENODEV);
 }
 
+static const struct flash_info *spi_nor_alt_read_id(struct spi_nor *nor)
+{
+	u8 data[2];
+	u16 id;
+	int err, tmp;
+	const struct flash_info	*info;
+	struct spi_mem_op op =
+		SPI_MEM_OP(SPI_MEM_OP_CMD(SPINOR_OP_RDID_ALT, 1),
+			   SPI_MEM_OP_ADDR(3, 0, 1),
+			   SPI_MEM_OP_NO_DUMMY,
+			   SPI_MEM_OP_DATA_IN(sizeof (data), data, 1));
+
+	BUG_ON(!nor->spimem);
+
+	err = spi_mem_exec_op(nor->spimem, &op);
+	if (err < 0) {
+		dev_err(nor->dev, "error %d reading alt ID\n", err);
+		return ERR_PTR(err);
+	}
+
+	id = (data[1] << 8) | data[0];
+
+	for (tmp = 0; tmp < ARRAY_SIZE(spi_nor_ids) - 1; tmp++) {
+		info = &spi_nor_ids[tmp];
+		if ((info->flags & ALT_PROBE) && (info->ext_id == id))
+			return info;
+	}
+
+	dev_err(nor->dev, "unrecognized ALT id %04x\n", id);
+	return ERR_PTR(-ENODEV);
+}
+
+static const struct flash_info *spi_nor_atmel_id(struct spi_nor *nor)
+{
+	u8 data[2];
+	u16 id;
+	int err, tmp;
+	const struct flash_info	*info;
+	struct spi_mem_op op =
+		SPI_MEM_OP(SPI_MEM_OP_CMD(0x15, 1),
+			   SPI_MEM_OP_NO_ADDR,
+			   SPI_MEM_OP_NO_DUMMY,
+			   SPI_MEM_OP_DATA_IN(sizeof (data), data, 1));
+
+	BUG_ON(!nor->spimem);
+
+	err = spi_mem_exec_op(nor->spimem, &op);
+	if (err < 0) {
+		dev_err(nor->dev, "error %d reading atmel ID\n", err);
+		return ERR_PTR(err);
+	}
+	id = (data[1] << 8) | data[0];
+
+	for (tmp = 0; tmp < ARRAY_SIZE(spi_nor_ids) - 1; tmp++) {
+		info = &spi_nor_ids[tmp];
+		if ((info->flags & ALT_PROBE_ATMEL) && (info->ext_id == id))
+			return info;
+	}
+
+	dev_err(nor->dev, "unrecognized ATMEL id %04x\n", id);
+	return ERR_PTR(-ENODEV);
+}
+
 static int spi_nor_read(struct mtd_info *mtd, loff_t from, size_t len,
 			size_t *retlen, u_char *buf)
 {
@@ -4746,6 +4832,19 @@
 	return NULL;
 }
 
+static void sst_write_enable(struct spi_nor *nor)
+{
+	struct spi_mem_op op =
+		SPI_MEM_OP(SPI_MEM_OP_CMD(SPINOR_OP_EWRSR, 1),
+			   SPI_MEM_OP_NO_ADDR,
+			   SPI_MEM_OP_NO_DUMMY,
+			   SPI_MEM_OP_NO_DATA);
+	write_enable(nor);
+	BUG_ON(!nor->spimem);
+	spi_mem_exec_op(nor->spimem, &op);
+	write_sr(nor, 0);
+}
+
 static int spi_nor_set_addr_width(struct spi_nor *nor)
 {
 	if (nor->addr_width) {
@@ -4803,6 +4902,12 @@
 	if (name && info->id_len) {
 		const struct flash_info *jinfo;
 
+		jinfo = spi_nor_alt_read_id(nor);
+		if (IS_ERR(jinfo))
+			/* try ATMEL */
+			jinfo = spi_nor_atmel_id(nor);
+		if (IS_ERR(jinfo))
+			/* try JEDEC */
 		jinfo = spi_nor_read_id(nor);
 		if (IS_ERR(jinfo)) {
 			return jinfo;
@@ -4891,6 +4996,9 @@
 	/* Init flash parameters based on flash_info struct and SFDP */
 	spi_nor_init_params(nor);
 
+	if (info->ext_id == 0xbf48)
+		sst_write_enable(nor);
+
 	if (!mtd->name)
 		mtd->name = dev_name(dev);
 	mtd->priv = nor;
diff -ruw linux-5.4.60/drivers/net/ethernet/broadcom/Kconfig linux-5.4.60-fbx/drivers/net/ethernet/broadcom/Kconfig
--- linux-5.4.60/drivers/net/ethernet/broadcom/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/ethernet/broadcom/Kconfig	2021-03-04 13:20:59.017505610 +0100
@@ -60,6 +60,45 @@
 	  This driver supports the ethernet MACs in the Broadcom 63xx
 	  MIPS chipset family (BCM63XX).
 
+config BCM63XX_ENET_RUNNER
+	tristate "Broadcom 63xx (63138) runner ethernet support"
+	select MII
+	select FIXED_PHY
+	select PHYLIB
+	select BCM7XXX_PHY
+	select BROADCOM_PHY
+	select SOC_BCM63XX_RDP
+
+config BCM63158_SF2
+	tristate "Broadcom 63158 SF2 support"
+	select MII
+	select PHYLINK
+	select BCM7XXX_PHY
+	select BROADCOM_PHY
+	select NET_DSA
+	select NET_DSA_TAG_BRCM_FBX
+
+config BCM63158_SYSTEMPORT
+	tristate "Broadcom 63158 SYSTEMPORT internal MAC support"
+	depends on OF
+	select MII
+	select PHYLINK
+
+config BCM63158_ENET_RUNNER
+	tristate "Broadcom 63158 runner ethernet support"
+	select MII
+	select PHYLINK
+	select SOC_BCM63XX_XRDP
+
+config BCM63158_ENET_RUNNER_FF
+	bool "fastpath support for freebox boards"
+	depends on BCM63158_ENET_RUNNER
+	select IP_FFN
+	select IPV6_FFN
+	select IPV6_SIT_6RD
+	select BRIDGE
+	select FBXBRIDGE
+
 config BCMGENET
 	tristate "Broadcom GENET internal MAC support"
 	depends on HAS_IOMEM
diff -ruw linux-5.4.60/drivers/net/ethernet/broadcom/Makefile linux-5.4.60-fbx/drivers/net/ethernet/broadcom/Makefile
--- linux-5.4.60/drivers/net/ethernet/broadcom/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/ethernet/broadcom/Makefile	2021-03-04 13:20:59.017505610 +0100
@@ -16,3 +16,5 @@
 obj-$(CONFIG_BGMAC_PLATFORM) += bgmac-platform.o
 obj-$(CONFIG_SYSTEMPORT) += bcmsysport.o
 obj-$(CONFIG_BNXT) += bnxt/
+obj-$(CONFIG_BCM63XX_ENET_RUNNER) += bcm63xx_enet_runner/
+obj-y += bcm63158/
diff -ruw linux-5.4.60/drivers/net/ethernet/Kconfig linux-5.4.60-fbx/drivers/net/ethernet/Kconfig
--- linux-5.4.60/drivers/net/ethernet/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/ethernet/Kconfig	2021-03-04 13:20:58.997505609 +0100
@@ -180,6 +180,7 @@
 source "drivers/net/ethernet/tundra/Kconfig"
 source "drivers/net/ethernet/via/Kconfig"
 source "drivers/net/ethernet/wiznet/Kconfig"
+source "drivers/net/ethernet/wintegra/Kconfig"
 source "drivers/net/ethernet/xilinx/Kconfig"
 source "drivers/net/ethernet/xircom/Kconfig"
 
diff -ruw linux-5.4.60/drivers/net/ethernet/Makefile linux-5.4.60-fbx/drivers/net/ethernet/Makefile
--- linux-5.4.60/drivers/net/ethernet/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/ethernet/Makefile	2021-03-04 13:20:58.997505609 +0100
@@ -92,6 +92,7 @@
 obj-$(CONFIG_NET_VENDOR_TUNDRA) += tundra/
 obj-$(CONFIG_NET_VENDOR_VIA) += via/
 obj-$(CONFIG_NET_VENDOR_WIZNET) += wiznet/
+obj-$(CONFIG_NET_VENDOR_WINTEGRA) += wintegra/
 obj-$(CONFIG_NET_VENDOR_XILINX) += xilinx/
 obj-$(CONFIG_NET_VENDOR_XIRCOM) += xircom/
 obj-$(CONFIG_NET_VENDOR_SYNOPSYS) += synopsys/
diff -ruw linux-5.4.60/drivers/net/ethernet/marvell/Kconfig linux-5.4.60-fbx/drivers/net/ethernet/marvell/Kconfig
--- linux-5.4.60/drivers/net/ethernet/marvell/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/ethernet/marvell/Kconfig	2021-03-04 13:20:59.164172284 +0100
@@ -23,6 +23,7 @@
 	depends on INET
 	select PHYLIB
 	select MVMDIO
+	select MII
 	---help---
 	  This driver supports the gigabit ethernet MACs in the
 	  Marvell Discovery PPC/MIPS chipset family (MV643XX) and
@@ -31,6 +32,15 @@
 	  Some boards that use the Discovery chipset are the Momenco
 	  Ocelot C and Jaguar ATX and Pegasos II.
 
+config MV643XX_ETH_FBX_FF
+	bool "fastpath support for freebox boards"
+	depends on MV643XX_ETH
+	select IP_FFN
+	select IPV6_FFN
+	select IPV6_SIT_6RD
+	select BRIDGE
+	select FBXBRIDGE
+
 config MVMDIO
 	tristate "Marvell MDIO interface support"
 	depends on HAS_IOMEM
@@ -86,10 +96,20 @@
 	depends on ARCH_MVEBU || COMPILE_TEST
 	select MVMDIO
 	select PHYLINK
+	select MII
 	---help---
 	  This driver supports the network interface units in the
 	  Marvell ARMADA 375, 7K and 8K SoCs.
 
+config MVPP2_FBX_FF
+	bool "fastpath support for freebox boards"
+	depends on MVPP2
+	select IP_FFN
+	select IPV6_FFN
+	select IPV6_SIT_6RD
+	select BRIDGE
+	select FBXBRIDGE
+
 config PXA168_ETH
 	tristate "Marvell pxa168 ethernet support"
 	depends on HAS_IOMEM
diff -ruw linux-5.4.60/drivers/net/ethernet/marvell/mvpp2/mvpp2.h linux-5.4.60-fbx/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
--- linux-5.4.60/drivers/net/ethernet/marvell/mvpp2/mvpp2.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/ethernet/marvell/mvpp2/mvpp2.h	2021-04-21 09:44:50.971838485 +0200
@@ -264,7 +264,13 @@
 #define MVPP2_ISR_RX_TX_CAUSE_REG(port)		(0x5480 + 4 * (port))
 #define     MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK(version) \
 					((version) == MVPP21 ? 0xffff : 0xff)
+
+#ifdef CONFIG_MVPP2_FBX_FF
+#define     MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_MASK	0x7f0000
+#else
 #define     MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_MASK	0xff0000
+#endif
+
 #define     MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_OFFSET	16
 #define     MVPP2_CAUSE_RX_FIFO_OVERRUN_MASK	BIT(24)
 #define     MVPP2_CAUSE_FCS_ERR_MASK		BIT(25)
@@ -349,6 +355,7 @@
 #define MVPP2_RX_PKTS_FULL_QUEUE_DROP_CTR	0x7220
 #define MVPP2_RX_PKTS_EARLY_DROP_CTR		0x7224
 #define MVPP2_RX_PKTS_BM_DROP_CTR		0x7228
+#define MVPP2_BM_DROP_CTR(pool)			(0x7300 + (pool * 4))
 #define MVPP2_CLS_DEC_TBL_HIT_CTR		0x7700
 #define MVPP2_CLS_FLOW_TBL_HIT_CTR		0x7704
 
@@ -376,6 +383,7 @@
 #define     MVPP2_TXQ_TOKEN_SIZE_MAX		0x7fffffff
 #define MVPP2_TXQ_SCHED_TOKEN_CNTR_REG(q)	(0x8080 + ((q) << 2))
 #define     MVPP2_TXQ_TOKEN_CNTR_MAX		0xffffffff
+#define MVPP2_TXQ_SCHED_BCOUNT_CFG_REG(q)	(0x80A0 + ((q) << 2))
 
 /* TX general registers */
 #define MVPP2_TX_SNOOP_REG			0x8800
@@ -432,6 +440,7 @@
 #define     MVPP2_GMAC_STATUS0_RX_PAUSE		BIT(4)
 #define     MVPP2_GMAC_STATUS0_TX_PAUSE		BIT(5)
 #define     MVPP2_GMAC_STATUS0_AN_COMPLETE	BIT(11)
+#define     MVPP2_GMAC_STATUS0_SYNC_OK		BIT(14)
 #define MVPP2_GMAC_PORT_FIFO_CFG_1_REG		0x1c
 #define     MVPP2_GMAC_TX_FIFO_MIN_TH_OFFS	6
 #define     MVPP2_GMAC_TX_FIFO_MIN_TH_ALL_MASK	0x1fc0
@@ -506,6 +515,8 @@
 #define     MAC_CLK_RESET_MAC			BIT(2)
 #define     MVPP22_MPCS_CLK_RESET_DIV_RATIO(n)	((n) << 4)
 #define     MVPP22_MPCS_CLK_RESET_DIV_SET	BIT(11)
+#define MVPP22_MPCS_GEARBOX_STATUS		0xd0
+#define     MVPP22_MPCS_GEARBOX_STATUS_LANELOCK	BIT(0)
 
 /* XPCS registers. PPv2.2 only */
 #define MVPP22_XPCS_BASE(port)			(0x7400 + (port) * 0x1000)
@@ -584,11 +595,11 @@
 
 /* Max number of Rx descriptors */
 #define MVPP2_MAX_RXD_MAX		1024
-#define MVPP2_MAX_RXD_DFLT		128
+#define MVPP2_MAX_RXD_DFLT		1024
 
 /* Max number of Tx descriptors */
 #define MVPP2_MAX_TXD_MAX		2048
-#define MVPP2_MAX_TXD_DFLT		1024
+#define MVPP2_MAX_TXD_DFLT		2048
 
 /* Amount of Tx descriptors that can be reserved at once by CPU */
 #define MVPP2_CPU_DESC_CHUNK		64
@@ -753,6 +764,10 @@
 
 /* Shared Packet Processor resources */
 struct mvpp2 {
+#ifdef CONFIG_MVPP2_FBX_FF
+	int id;
+#endif
+
 	/* Shared registers' base addresses */
 	void __iomem *lms_base;
 	void __iomem *iface_base;
@@ -812,6 +827,10 @@
 	char queue_name[30];
 	struct workqueue_struct *stats_queue;
 
+	/* Workqueue to delay phylink state being set to down */
+	char phylink_queue_name[30];
+	struct workqueue_struct *phylink_down_queue;
+
 	/* Debugfs root entry */
 	struct dentry *dbgfs_dir;
 
@@ -848,6 +867,8 @@
 	u32 pending_cause_rx;
 	struct mvpp2_port *port;
 	struct cpumask *mask;
+	char irq_name[32];
+	char request_name[64];
 };
 
 /* Internal represention of a Flow Steering rule */
@@ -881,15 +902,51 @@
 	struct ethtool_rxnfc rxnfc;
 };
 
+/*
+ * ethtool private flags layout (stopgap measure until phylink is
+ * operational on mvpp2).
+ */
+
+/*
+ * set to 1 only, cannot be cleared, enable 10G/1G media change logic.
+ */
+#define FBX_101G_SWITCH_EN_BIT	0
+
+/*
+ * *_EN_BITS are write only, and must be only set one at a
+ * time. writing one to either of those effectively changes the mode
+ * of the interface to 1G (1000Base-X) or 10G (10000Base-KR).
+ *
+ * they are always 0 on read.
+ */
+#define FBX_10G_EN_BIT		1
+#define FBX_1G_EN_BIT		2
+#define FBX_ALL_EN_MASK		((1 << FBX_10G_EN_BIT) | (1 << FBX_1G_EN_BIT))
+
+/*
+ * *_ST_BITS reflect the current state of 10G/1G media selection.
+ */
+#define FBX_10G_ST_BIT		3
+#define FBX_1G_ST_BIT		4
+#define FBX_SYNC_OK_BIT		5
+#define FBX_CLEAR_MIB_BIT	6
+#define FBX_EN_10G_LINKDOWN_WA	7
+#define FBX_LINKDOWN_DEBOUNCE	8
+
 struct mvpp2_port {
 	u8 id;
+	unsigned int index;
 
 	/* Index of the port from the "group of ports" complex point
 	 * of view. This is specific to PPv2.2.
 	 */
 	int gop_id;
+	bool pending_10g_reset;
+	bool linkdown_10g_wa_enable;
+	unsigned long last_link_int_jiffies;
 
 	int link_irq;
+	char link_irq_request_name[64];
 
 	struct mvpp2 *priv;
 
@@ -932,6 +989,9 @@
 	struct mutex gather_stats_lock;
 	struct delayed_work stats_work;
 
+	struct delayed_work phylink_down_work;
+	bool linkdown_debounce;
+
 	struct device_node *of_node;
 
 	phy_interface_t phy_interface;
@@ -959,6 +1019,17 @@
 	 * them from 0
 	 */
 	int rss_ctx[MVPP22_N_RSS_TABLES];
+
+	/* MII bus for MII bus access ioctls from userspace */
+	struct mii_bus *mii_bus;
+
+	/* FBX ratures */
+	bool en_fbx_10g1g_switch;
+
+#ifdef CONFIG_MVPP2_FBX_FF
+	struct mvpp2_tx_queue *ff_txq;
+	struct notifier_block ff_notifier;
+#endif
 };
 
 /* The mvpp2_tx_desc and mvpp2_rx_desc structures describe the
@@ -1035,7 +1106,7 @@
 /* HW RX descriptor for PPv2.2 */
 struct mvpp22_rx_desc {
 	__le32 status;
-	__le16 reserved1;
+	__le16 parser_info;
 	__le16 data_size;
 	__le32 reserved2;
 	__le32 reserved3;
@@ -1064,6 +1135,13 @@
 	/* Transmitted SKB */
 	struct sk_buff *skb;
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	bool is_rx_buf;
+	int pool;
+	phys_addr_t bm_dma;
+	phys_addr_t bm_phys;
+#endif
+
 	/* Physical address of transmitted buffer */
 	dma_addr_t dma;
 
@@ -1083,6 +1161,10 @@
 	 */
 	int count;
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	int release_pending;
+#endif
+
 	int wake_threshold;
 	int stop_threshold;
 
diff -ruw linux-5.4.60/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c linux-5.4.60-fbx/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
--- linux-5.4.60/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c	2021-04-21 09:44:50.971838485 +0200
@@ -37,10 +37,26 @@
 #include <net/ipv6.h>
 #include <net/tso.h>
 
+#ifdef CONFIG_MVPP2_FBX_FF
+#include <net/arp.h>
+#include <net/ip_ffn.h>
+#include <net/ip_tunnels.h>
+#include <net/ip6_ffn.h>
+#include <net/ip6_route.h>
+#include <net/ip6_tunnel.h>
+
+#include "../../../net/bridge/br_private.h"
+#include "../../../net/fbxbridge/fbxbr_private.h"
+#endif
+
 #include "mvpp2.h"
 #include "mvpp2_prs.h"
 #include "mvpp2_cls.h"
 
+#ifdef CONFIG_MVPP2_FBX_FF
+static struct mvpp2_port *ports_by_idx[4];
+#endif
+
 enum mvpp2_bm_pool_log_num {
 	MVPP2_BM_SHORT,
 	MVPP2_BM_LONG,
@@ -65,11 +81,24 @@
 #define MVPP2_QDIST_SINGLE_MODE	0
 #define MVPP2_QDIST_MULTI_MODE	1
 
+#ifdef CONFIG_MVPP2_FBX_FF
+static int queue_mode = MVPP2_QDIST_SINGLE_MODE;
+#else
 static int queue_mode = MVPP2_QDIST_MULTI_MODE;
+#endif
 
 module_param(queue_mode, int, 0444);
 MODULE_PARM_DESC(queue_mode, "Set queue_mode (single=0, multi=1)");
 
+#ifdef CONFIG_MVPP2_FBX_FF
+#define MVPP2_FF_TXQ_ID			7
+#define MVPP2_USABLE_TX_QUEUES		7
+#else
+#define MVPP2_USABLE_TX_QUEUES		8
+#endif
+
+#define MVPP2_TX_FIXED_PRIO_QUEUES	(1 << (MVPP2_USABLE_TX_QUEUES - 1))
+
 /* Utility/helper methods */
 
 void mvpp2_write(struct mvpp2 *priv, u32 offset, u32 data)
@@ -283,6 +312,9 @@
 {
 	struct mvpp2_txq_pcpu_buf *tx_buf =
 		txq_pcpu->buffs + txq_pcpu->txq_put_index;
+#ifdef CONFIG_MVPP2_FBX_FF
+	tx_buf->is_rx_buf = false;
+#endif
 	tx_buf->skb = skb;
 	tx_buf->size = mvpp2_txdesc_size_get(port, tx_desc);
 	tx_buf->dma = mvpp2_txdesc_dma_addr_get(port, tx_desc) +
@@ -324,6 +356,2198 @@
 	return (MVPP2_MAX_TCONT + port) * MVPP2_MAX_TXQ + txq;
 }
 
+
+#ifdef CONFIG_MVPP2_FBX_FF
+
+static u16 mvpp2_rxdesc_parser_info_get(struct mvpp2_port *port,
+					struct mvpp2_rx_desc *rx_desc)
+{
+	if (port->priv->hw_version == MVPP21)
+		return 0;
+	else
+		return rx_desc->pp22.parser_info;
+}
+
+static int mvpp2_aggr_desc_num_check(struct mvpp2_port *port,
+				     struct mvpp2_tx_queue *aggr_txq, int num);
+
+static void mvpp2_aggr_txq_pend_desc_add(struct mvpp2_port *port, int pending);
+
+static inline void mvpp2_bm_pool_put(struct mvpp2_port *port, int pool,
+				     dma_addr_t buf_dma_addr,
+				     phys_addr_t buf_phys_addr);
+
+static int mvpp2_rx_refill(struct mvpp2_port *port,
+			   struct mvpp2_bm_pool *bm_pool, int pool);
+
+static int mvpp2_txq_reserved_desc_num_proc(struct mvpp2_port *port,
+					    struct mvpp2_tx_queue *txq,
+					    struct mvpp2_txq_pcpu *txq_pcpu,
+					    int num);
+
+static struct mvpp2_tx_desc *
+mvpp2_txq_next_desc_get(struct mvpp2_tx_queue *txq);
+
+static inline int mvpp2_txq_sent_desc_proc(struct mvpp2_port *port,
+					   struct mvpp2_tx_queue *txq);
+
+static void mvpp2_txq_inc_put_ff(struct mvpp2_port *port,
+				 dma_addr_t buf_dma,
+				 phys_addr_t buf_phys,
+				 int pool,
+				 struct mvpp2_txq_pcpu *txq_pcpu,
+				 struct mvpp2_tx_desc *tx_desc)
+{
+	struct mvpp2_txq_pcpu_buf *tx_buf =
+		txq_pcpu->buffs + txq_pcpu->txq_put_index;
+
+	tx_buf->is_rx_buf = true;
+	tx_buf->pool = pool;
+	tx_buf->bm_dma = buf_dma;
+	tx_buf->bm_phys = buf_phys;
+
+	txq_pcpu->txq_put_index++;
+	if (txq_pcpu->txq_put_index == txq_pcpu->size)
+		txq_pcpu->txq_put_index = 0;
+}
+
+static bool ff_enabled;
+
+static DEFINE_SPINLOCK(ff_lock);
+
+static inline bool pkt_is_ipv4(u32 rx_status)
+{
+	u32 val;
+
+	val = (rx_status >> 28) & 0x7;
+	if (val == 1 || val == 2 || val == 3)
+		return true;
+
+	return false;
+}
+
+static inline bool pkt_is_ipv6(u32 rx_status)
+{
+	u32 val;
+
+	val = (rx_status >> 28) & 0x7;
+	if (val == 4 || val == 5)
+		return true;
+
+	return false;
+}
+
+static inline bool pkt_is_ipvx(u32 rx_status)
+{
+	return pkt_is_ipv4(rx_status) || pkt_is_ipv6(rx_status);
+}
+
+static inline bool pkt_is_vlan(u16 parser_info)
+{
+	if (parser_info & (0x3 << 14))
+		return true;
+	return false;
+}
+
+
+#define FF_MAX_WAN_DEV		4
+
+#define FF_DEV_SWLAN_ID		0
+#define FF_DEV_SWLAN_PORT_INDEX	1
+
+#define FF_DEV_WAN_ID		0
+#define FF_DEV_WAN_PORT_INDEX	0
+
+#define FF_DEV_SFPLAN_ID	1
+#define FF_DEV_SFPLAN_PORT_INDEX	0
+
+static struct {
+	struct net_device	*wan_devs[FF_MAX_WAN_DEV];
+	int			wan_vlan_ids[FF_MAX_WAN_DEV];
+	int			wan_active_dev;
+	struct net_device	*lan_dev_sfp;
+	struct net_device	*lan_dev_sw;
+
+	u32			jiffies;
+
+	struct net_device	*tun_dev;
+	u8			tun_ready:1;
+	u16			tun_mtu;
+
+	/* sit parameters */
+	union ff_tun_params {
+		struct {
+			u32		src;
+			u32		s6rd_prefix;
+			u32		s6rd_pmask;
+			u8		s6rd_plen;
+		} sit;
+
+		struct {
+			/* map parameters */
+			u32		ipv4_prefix;
+			u32		ipv4_pmask;
+			u8		ipv4_plen;
+			u8		ipv6_plen;
+			struct in6_addr	src;
+			struct in6_addr	br;
+
+			u64		ipv6_prefix;
+			u32		ea_addr_mask;
+			u16		ea_port_mask;
+			u8		psid_len;
+			u8		ea_lshift;
+		} map;
+	} u;
+
+	char			tun_dev_name[IFNAMSIZ];
+	char			wan_dev_name[IFNAMSIZ];
+} ff;
+
+static LIST_HEAD(ff_devs);
+
+struct ff_dev {
+	const char		*desc;
+	int			id;
+	int			port_index;
+	bool			bridge_member;
+	bool			is_wan;
+	unsigned int		vlan;
+	struct net_device	**pvirt_dev;
+	int			*pvlan_id;
+
+	char			bridge_hwaddr[6];
+
+	bool			active;
+	struct net_bridge_port	*br_port;
+	struct fbxbr_port	*fbxbr_port;
+	bool			dev_up;
+	struct list_head	next;
+};
+
+static struct ff_dev swlan;
+static struct ff_dev sfplan;
+static struct ff_dev wan;
+
+static inline bool is_bridge_dev(struct net_device *dev)
+{
+        return dev->priv_flags & IFF_EBRIDGE;
+}
+
+static inline bool is_fbxbridge_port(struct net_device *dev)
+{
+        return dev->priv_flags & IFF_FBXBRIDGE_PORT;
+}
+
+static u32 gen_netmask(u8 len)
+{
+	return htonl(~((1 << (32 - len)) - 1));
+}
+
+static void __ff_tun_set_params(bool ready,
+				unsigned int mtu,
+				const union ff_tun_params *tp)
+{
+	if (!ready) {
+		if (!ff.tun_ready)
+			return;
+
+		printk(KERN_DEBUG "ff: tunnel now NOT ready\n");
+		ff.tun_ready = 0;
+		return;
+	}
+
+	if (ff.tun_ready) {
+		if (ff.tun_mtu == mtu && !memcmp(tp, &ff.u, sizeof (*tp)))
+			return;
+	}
+
+	ff.tun_mtu = mtu;
+	memcpy(&ff.u, tp, sizeof (*tp));
+
+	if (!ff.tun_ready)
+		printk(KERN_DEBUG "ff: tunnel now ready\n");
+	else
+		printk(KERN_DEBUG "ff: tunnel params updated\n");
+
+	ff.tun_ready = true;
+}
+
+static void __ff_tun_read_params(void)
+{
+	union ff_tun_params tp;
+	struct net_device *wan_dev;
+
+	if (!ff.tun_dev)
+		return;
+
+	if (ff.wan_active_dev == -1) {
+		__ff_tun_set_params(false, 0, NULL);
+		return;
+	}
+
+	wan_dev = ff.wan_devs[ff.wan_active_dev];
+	memset(&tp, 0, sizeof (tp));
+
+	if (ff.tun_dev->type == ARPHRD_SIT) {
+		const struct ip_tunnel *tun = netdev_priv(ff.tun_dev);
+		const struct ip_tunnel_6rd_parm *ip6rd = &tun->ip6rd;
+
+		if (!ip6rd->prefixlen || ip6rd->prefixlen > 32) {
+			printk(KERN_DEBUG "ff: unsupported 6rd plen\n");
+			__ff_tun_set_params(false, 0, NULL);
+			return;
+		}
+
+		if (ff.tun_dev->mtu + sizeof (struct iphdr) >
+		    wan_dev->mtu) {
+			printk(KERN_DEBUG "ff: WAN mtu too "
+			       "small for tunnel (%u => %u)\n",
+			       ff.tun_dev->mtu, wan_dev->mtu);
+			__ff_tun_set_params(false, 0, NULL);
+			return;
+		}
+
+		tp.sit.src = tun->parms.iph.saddr;
+		tp.sit.s6rd_prefix = ip6rd->prefix.s6_addr32[0];
+		tp.sit.s6rd_pmask = gen_netmask(ip6rd->prefixlen);
+		tp.sit.s6rd_plen = ip6rd->prefixlen;
+		__ff_tun_set_params(true, ff.tun_dev->mtu, &tp);
+		return;
+	}
+
+	if (ff.tun_dev->type == ARPHRD_TUNNEL6) {
+		const struct ip6_tnl *t = netdev_priv(ff.tun_dev);
+		const struct __ip6_tnl_parm *prm = &t->parms;
+		const struct __ip6_tnl_fmr *fmr;
+
+		if (ff.tun_dev->mtu + sizeof (struct ipv6hdr) >
+		    wan_dev->mtu) {
+			printk(KERN_DEBUG "ff: WAN mtu too "
+			       "small for tunnel (%u => %u)\n",
+			       ff.tun_dev->mtu, wan_dev->mtu);
+			__ff_tun_set_params(false, 0, NULL);
+			return;
+		}
+
+		tp.map.src = prm->laddr;
+		tp.map.br = prm->raddr;
+
+		fmr = prm->fmrs;
+		if (!fmr) {
+			tp.map.ipv4_prefix = 0;
+			__ff_tun_set_params(true, ff.tun_dev->mtu, &tp);
+			return;
+		}
+
+		if (fmr->ip6_prefix_len < 32 ||
+		    (fmr->ip6_prefix_len + 32 - fmr->ip4_prefix_len > 64)) {
+			printk(KERN_DEBUG "ff: unsupp MAP-E: eabits "
+			       "span 32 bits\n");
+			__ff_tun_set_params(false, 0, NULL);
+			return;
+		}
+
+		if (fmr->offset) {
+			printk(KERN_DEBUG "ff: unsupp MAP-E: non zero "
+			       "PSID offset\n");
+			__ff_tun_set_params(false, 0, NULL);
+			return;
+		}
+
+		tp.map.ipv4_prefix = fmr->ip4_prefix.s_addr;
+		tp.map.ipv4_pmask = gen_netmask(fmr->ip4_prefix_len);
+		tp.map.ipv4_plen = fmr->ip4_prefix_len;
+		tp.map.ipv6_plen = fmr->ip6_prefix_len;
+		memcpy(&tp.map.ipv6_prefix, &fmr->ip6_prefix, 8);
+
+		tp.map.ea_addr_mask = ~gen_netmask(fmr->ip4_prefix_len);
+		if (fmr->ea_len <= 32 - fmr->ip4_prefix_len) {
+			/* v4 prefix or full IP */
+			u32 addr_bits;
+
+			addr_bits = fmr->ip4_prefix_len + fmr->ea_len;
+			if (addr_bits != 32)
+				tp.map.ea_addr_mask &= gen_netmask(addr_bits);
+			tp.map.psid_len = 0;
+		} else {
+			u8 psid_len;
+
+			psid_len = fmr->ea_len - (32 - fmr->ip4_prefix_len);
+			tp.map.psid_len = psid_len;
+			tp.map.ea_port_mask = gen_netmask(psid_len);
+		}
+
+		tp.map.ea_lshift = 32 - (fmr->ip6_prefix_len - 32) -
+			fmr->ea_len;
+
+		__ff_tun_set_params(true, ff.tun_dev->mtu, &tp);
+		return;
+	}
+}
+
+static void __ff_tun_capture(void)
+{
+	struct net_device *dev;
+
+	if (ff.tun_dev) {
+		printk(KERN_ERR "ff: error: tun already registered\n");
+		return;
+	}
+
+	dev = dev_get_by_name(&init_net, ff.tun_dev_name);
+	if (!dev) {
+		return;
+	}
+
+	if (dev->type != ARPHRD_SIT && dev->type != ARPHRD_TUNNEL6) {
+		return;
+	}
+
+	if (!(dev->flags & IFF_UP)) {
+		dev_put(ff.tun_dev);
+		return;
+	}
+
+	ff.tun_dev = dev;
+	__ff_tun_read_params();
+	printk(KERN_INFO "ff: tun dev grabbed\n");
+}
+
+static void __ff_tun_release(void)
+{
+	int was_on = 0;
+
+	if (ff.tun_dev) {
+		dev_put(ff.tun_dev);
+		ff.tun_dev = NULL;
+		was_on = 1;
+	}
+	if (was_on)
+		printk(KERN_INFO "ff: tun dev released\n");
+}
+
+static void __ff_wan_find_active(void)
+{
+	int i, matching;
+
+	matching = -1;
+	for (i = 0; i < ARRAY_SIZE(ff.wan_devs); i++) {
+		if (ff.wan_devs[i] &&
+		    !strcmp(ff.wan_devs[i]->name, ff.wan_dev_name)) {
+			matching = i;
+			break;
+		}
+	}
+
+	if (ff.wan_active_dev != -1) {
+		if (matching == -1) {
+			printk("ff: no more selected wan\n");
+			ff.wan_active_dev = -1;
+			__ff_tun_read_params();
+		} else if (matching != ff.wan_active_dev) {
+			printk("ff: selected wan changed\n");
+			ff.wan_active_dev = matching;
+			__ff_tun_read_params();
+		}
+
+	} else if (matching != -1) {
+		printk("ff: selected wan now %s\n", ff.wan_dev_name);
+		ff.wan_active_dev = matching;
+		__ff_tun_read_params();
+	}
+}
+
+static int ff_device_event(struct notifier_block *this,
+			   unsigned long event, void *ptr)
+{
+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+	struct mvpp2_port *port;
+	struct ff_dev *ff_dev;
+
+	if (!net_eq(dev_net(dev), &init_net))
+		return 0;
+
+	if (!strcmp(dev->name, ff.tun_dev_name)) {
+		spin_lock_bh(&ff_lock);
+
+		switch (event) {
+		case NETDEV_UP:
+			if (!ff.tun_dev)
+				__ff_tun_capture();
+			break;
+
+		case NETDEV_CHANGE:
+		case NETDEV_CHANGEMTU:
+			if (ff.tun_dev == dev)
+				__ff_tun_read_params();
+			break;
+
+		case NETDEV_GOING_DOWN:
+		case NETDEV_DOWN:
+		case NETDEV_UNREGISTER:
+			if (ff.tun_dev == dev)
+				__ff_tun_release();
+			break;
+		}
+
+		spin_unlock_bh(&ff_lock);
+		return 0;
+	}
+
+	port = container_of(this, typeof(*port), ff_notifier);
+	list_for_each_entry(ff_dev, &ff_devs, next) {
+		if (port->priv->id != ff_dev->id)
+			continue;
+		if (port->index != ff_dev->port_index)
+			continue;
+
+		if (ff_dev->vlan) {
+			if (!is_vlan_dev(dev))
+				continue;
+
+			switch (event) {
+			case NETDEV_UP:
+				if (vlan_dev_upper_dev(dev) != port->dev ||
+				    vlan_dev_vlan_id(dev) != ff_dev->vlan)
+					continue;
+
+				if (ff_dev->active)
+					continue;
+
+				dev_hold(dev);
+
+				spin_lock_bh(&ff_lock);
+				*(ff_dev->pvirt_dev) = dev;
+				if (ff_dev->pvlan_id)
+					*ff_dev->pvlan_id = ff_dev->vlan;
+
+				if (ff_dev->is_wan)
+					__ff_wan_find_active();
+
+				spin_unlock_bh(&ff_lock);
+
+				ff_dev->active = true;
+				printk(KERN_INFO "ff: ff_dev %s: active "
+				       "for %s\n", ff_dev->desc,
+				       dev->name);
+				break;
+
+			case NETDEV_GOING_DOWN:
+			case NETDEV_DOWN:
+			case NETDEV_UNREGISTER:
+				if (!ff_dev->active)
+					continue;
+
+				if (vlan_dev_upper_dev(dev) != port->dev ||
+				    vlan_dev_vlan_id(dev) != ff_dev->vlan)
+					continue;
+
+				spin_lock_bh(&ff_lock);
+				*(ff_dev->pvirt_dev) = NULL;
+
+				if (ff_dev->is_wan)
+					__ff_wan_find_active();
+
+				spin_unlock_bh(&ff_lock);
+				dev_put(dev);
+				ff_dev->active = false;
+
+				printk(KERN_INFO "ff: ff_dev %s: now "
+				       "inactive\n", ff_dev->desc);
+				break;
+
+			default:
+				break;
+			}
+		}
+
+		if (ff_dev->bridge_member) {
+			struct net_bridge *br;
+			struct fbxbr *fbxbr;
+			bool ok;
+
+			switch (event) {
+			case NETDEV_UP:
+				if (dev == port->dev)
+					ff_dev->dev_up = true;
+				break;
+
+			case NETDEV_GOING_DOWN:
+			case NETDEV_DOWN:
+			case NETDEV_UNREGISTER:
+				if (dev == port->dev)
+					ff_dev->dev_up = false;
+				break;
+
+			case NETDEV_CHANGEUPPER:
+				if (dev == port->dev) {
+					rcu_read_lock();
+					if ((dev->priv_flags &
+					     IFF_BRIDGE_PORT) &&
+					    netdev_master_upper_dev_get(dev))
+						ff_dev->br_port = br_port_get_rcu(dev);
+					else
+						ff_dev->br_port = NULL;
+
+					if ((dev->priv_flags &
+					     IFF_FBXBRIDGE_PORT) &&
+					    netdev_master_upper_dev_get(dev))
+						ff_dev->fbxbr_port = fbxbr_port_get_rcu(dev);
+					else
+						ff_dev->fbxbr_port = NULL;
+					rcu_read_unlock();
+				}
+				break;
+
+			default:
+				break;
+			}
+
+			ok = false;
+			br = NULL;
+			fbxbr = NULL;
+			if (ff_dev->dev_up && ff_dev->br_port) {
+				br = ff_dev->br_port->br;
+				if (br->dev->flags & IFF_UP)
+					ok = true;
+			}
+
+			if (ff_dev->dev_up && ff_dev->fbxbr_port) {
+				fbxbr = ff_dev->fbxbr_port->br;
+				if (fbxbr->dev->flags & IFF_UP)
+					ok = true;
+			}
+
+			if (!(ok ^ ff_dev->active))
+				continue;
+
+			if (ok) {
+				struct net_device *true_dev;
+
+				if (br) {
+					true_dev = br->dev;
+				} else {
+					true_dev = port->dev;
+				}
+
+				dev_hold(true_dev);
+				spin_lock_bh(&ff_lock);
+				*(ff_dev->pvirt_dev) = true_dev;
+				spin_unlock_bh(&ff_lock);
+
+				if (br)
+					memcpy(ff_dev->bridge_hwaddr,
+					       br->dev->dev_addr, 6);
+				ff_dev->active = true;
+
+				printk(KERN_INFO "ff: ff_dev %s: active "
+				       "for %s\n", ff_dev->desc,
+				       true_dev->name);
+
+
+			} else {
+				dev = *(ff_dev->pvirt_dev);
+				spin_lock_bh(&ff_lock);
+				*(ff_dev->pvirt_dev) = NULL;
+				spin_unlock_bh(&ff_lock);
+				dev_put(dev);
+				ff_dev->active = false;
+				memset(ff_dev->bridge_hwaddr, 0, 6);
+				printk(KERN_INFO "ff: ff_dev %s: "
+				       "now inactive\n", ff_dev->desc);
+			}
+		}
+	}
+
+	return 0;
+}
+
+enum ff_xmit_mode {
+	FF_XMIT_IPV4,
+	FF_XMIT_IPV6,
+	FF_XMIT_IPV6_IN_IPV4,
+	FF_XMIT_IPV4_IN_IPV6,
+};
+
+static void mvpp2_frag_free(const struct mvpp2_bm_pool *pool, void *data);
+static void mvpp2_bm_bufs_get_addrs(struct device *dev, struct mvpp2 *priv,
+				    struct mvpp2_bm_pool *bm_pool,
+				    dma_addr_t *dma_addr,
+				    phys_addr_t *phys_addr);
+
+/*
+ *
+ */
+static bool ff_force_reclaim(unsigned int thread,
+			     struct mvpp2_port *port,
+			     struct mvpp2_bm_pool *bm_pool,
+			     unsigned int count)
+{
+	struct mvpp2_tx_queue *txq;
+	struct mvpp2_txq_pcpu *txq_pcpu;
+	struct device *device;
+	bool done;
+
+	txq = port->ff_txq;
+	txq_pcpu = per_cpu_ptr(txq->pcpu, thread);
+
+	txq_pcpu->release_pending += mvpp2_txq_sent_desc_proc(port, txq);
+	device = port->dev->dev.parent;
+
+	done = false;
+	while (txq_pcpu->count > count && txq_pcpu->release_pending) {
+		struct mvpp2_txq_pcpu_buf *tx_buf;
+		void *data;
+
+		tx_buf = txq_pcpu->buffs + txq_pcpu->txq_get_index;
+		if (WARN_ON(!tx_buf->is_rx_buf))
+			continue;
+
+		dma_unmap_single(device,
+				 tx_buf->bm_dma,
+				 MVPP2_RX_BUF_SIZE(bm_pool->pkt_size),
+				 DMA_FROM_DEVICE);
+
+		data = (void *)phys_to_virt(tx_buf->bm_dma);
+		mvpp2_frag_free(bm_pool, data);
+		txq_pcpu->release_pending--;
+		txq_pcpu->count--;
+		mvpp2_txq_inc_get(txq_pcpu);
+		done = true;
+	}
+	return done;
+}
+
+/*
+ *
+ */
+static bool ff_can_send(unsigned int thread,
+			struct mvpp2_port *port,
+			struct mvpp2_bm_pool *bm_pool)
+{
+	struct mvpp2_tx_queue *txq;
+	struct mvpp2_txq_pcpu *txq_pcpu;
+
+	txq = port->ff_txq;
+	txq_pcpu = per_cpu_ptr(txq->pcpu, thread);
+
+	/* make sure tx queue is not full */
+	if (txq_pcpu->count == txq_pcpu->size) {
+		txq_pcpu->release_pending +=
+			mvpp2_txq_sent_desc_proc(port, txq);
+		if (!txq_pcpu->release_pending) {
+			/* if (net_ratelimit()) */
+			/* 	printk("ff: %s: txq_pcpu is full (%u)\n", */
+			/* 	       port->dev->name, */
+			/* 	       txq_pcpu->count); */
+			return false;
+		}
+	}
+
+	if (txq_pcpu->count < (txq_pcpu->size / 2))
+		return true;
+
+	ff_force_reclaim(thread, port, bm_pool, txq_pcpu->size / 2);
+	return true;
+}
+
+/*
+ *
+ */
+static bool ff_ensure_tx_desc(unsigned int thread,
+			      struct mvpp2_port *port,
+			      struct mvpp2_bm_pool *bm_pool)
+{
+	struct mvpp2_tx_queue *txq, *aggr_txq;
+	struct mvpp2_txq_pcpu *txq_pcpu;
+
+	txq = port->ff_txq;
+	txq_pcpu = per_cpu_ptr(txq->pcpu, thread);
+
+	/* make sure there is space in the aggregated tx queue */
+	aggr_txq = &port->priv->aggr_txqs[thread];
+	if (mvpp2_aggr_desc_num_check(port, aggr_txq, 1)) {
+		if (net_ratelimit())
+			printk("ff: %s: failed to get 1 desc in aggr tx queue\n",
+				port->dev->name);
+		return false;
+	}
+
+	/* make sure we have space reserved in the ff txq */
+	if (!mvpp2_txq_reserved_desc_num_proc(port, txq, txq_pcpu, 1))
+		return true;
+
+	ff_force_reclaim(thread, port, bm_pool, txq_pcpu->size / 2);
+
+	if (!mvpp2_txq_reserved_desc_num_proc(port, txq, txq_pcpu, 1))
+		return true;
+
+	return false;
+}
+
+/*
+ *
+ */
+static void ff_send(unsigned int thread,
+		    struct mvpp2_port *port,
+		    dma_addr_t dma_buf_addr,
+		    phys_addr_t dma_buf_phys,
+		    unsigned int dma_buf_offset,
+		    int dma_buf_pool,
+		    unsigned int send_len,
+		    bool is_ipv4,
+		    bool is_tcp_or_udp,
+		    bool is_tcp,
+		    bool is_vlan)
+{
+	struct mvpp2_tx_queue *txq, *aggr_txq;
+	struct mvpp2_txq_pcpu *txq_pcpu;
+	struct mvpp2_tx_desc *tx_desc;
+	u32 tx_cmd;
+
+	aggr_txq = &port->priv->aggr_txqs[thread];
+	txq = port->ff_txq;
+	txq_pcpu = per_cpu_ptr(txq->pcpu, thread);
+
+	/* Get a descriptor for packet */
+	tx_desc = mvpp2_txq_next_desc_get(aggr_txq);
+	memset(tx_desc, 0, sizeof (*tx_desc));
+	mvpp2_txdesc_txq_set(port, tx_desc, txq->id);
+	mvpp2_txdesc_size_set(port, tx_desc, send_len);
+	mvpp2_txdesc_dma_addr_set(port, tx_desc,
+				  dma_buf_addr + dma_buf_offset);
+
+	if (is_vlan)
+		tx_cmd = (VLAN_ETH_HLEN << MVPP2_TXD_L3_OFF_SHIFT);
+	else
+		tx_cmd = (ETH_HLEN << MVPP2_TXD_L3_OFF_SHIFT);
+
+	if (is_ipv4) {
+		/* 20 is sizeof (ipv4) */
+		tx_cmd |= ((20 >> 2) << MVPP2_TXD_IP_HLEN_SHIFT);
+	} else {
+		/* 40 is sizeof (ip6hdr) */
+		tx_cmd |= ((40 >> 2) << MVPP2_TXD_IP_HLEN_SHIFT);
+		tx_cmd |= MVPP2_TXD_IP_CSUM_DISABLE;
+		tx_cmd |= MVPP2_TXD_L3_IP6;
+	}
+
+	if (is_tcp_or_udp) {
+		if (!is_tcp)
+			tx_cmd |= MVPP2_TXD_L4_UDP;
+	} else {
+		tx_cmd |= MVPP2_TXD_L4_CSUM_NOT;
+	}
+
+	/* First and Last descriptor */
+	tx_cmd |= MVPP2_TXD_F_DESC | MVPP2_TXD_L_DESC;
+	mvpp2_txdesc_cmd_set(port, tx_desc, tx_cmd);
+	mvpp2_txq_inc_put_ff(port,
+			     dma_buf_addr,
+			     dma_buf_phys,
+			     dma_buf_pool,
+			     txq_pcpu, tx_desc);
+
+	txq_pcpu->reserved_num--;
+	txq_pcpu->count++;
+	aggr_txq->count++;
+
+	/* Enable transmit */
+	wmb();
+	mvpp2_aggr_txq_pend_desc_add(port, 1);
+}
+
+/*
+ * ipv4 forward cache private data
+ */
+struct ff_priv {
+	struct in6_addr		tun_dest_ip6;
+	struct dst_entry	*tun_dst;
+};
+
+static void ff_priv_release(const struct ff_priv *priv)
+{
+	dst_release(priv->tun_dst);
+}
+
+static void ff_priv_destructor_cb(void *data)
+{
+	const struct ff_priv *priv = (const struct ff_priv *)data;
+	ff_priv_release(priv);
+}
+
+static const struct ff_priv *ffn_get_ro_priv(const struct ffn_lookup_entry *e)
+{
+	if (e->manip.priv_destructor != ff_priv_destructor_cb)
+		return NULL;
+
+	return (const struct ff_priv *)e->manip.ffn_priv_area;
+}
+
+static struct ff_priv *ffn_get_rw_priv(struct ffn_lookup_entry *e)
+{
+	BUILD_BUG_ON(sizeof (e->manip.ffn_priv_area) <
+		     sizeof (struct ff_priv));
+
+	if (e->manip.priv_destructor &&
+	    e->manip.priv_destructor != ff_priv_destructor_cb)
+		return NULL;
+
+	return (struct ff_priv *)e->manip.ffn_priv_area;
+}
+
+static const struct ff_priv *fwc_get_ro_priv(const struct fbxbr_fwcache *fwc)
+{
+	if (fwc->priv_destructor != ff_priv_destructor_cb)
+		return NULL;
+
+	return (const struct ff_priv *)fwc->priv_area;
+}
+
+static struct ff_priv *fwc_get_rw_priv(const struct fbxbr_fwcache *fwc)
+{
+	BUILD_BUG_ON(sizeof (fwc->priv_area) < sizeof (struct ff_priv));
+
+	if (fwc->priv_destructor &&
+	    fwc->priv_destructor != ff_priv_destructor_cb)
+		return NULL;
+
+	return (struct ff_priv *)fwc->priv_area;
+}
+
+/*
+ * ipv6 forward cache private data
+ */
+struct ff6_priv {
+	u32			tun_dest_ip;
+	struct dst_entry	*tun_dst;
+};
+
+static void ff6_priv_release(const struct ff6_priv *priv)
+{
+	dst_release(priv->tun_dst);
+}
+
+static void ff6_priv_destructor_cb(void *data)
+{
+	const struct ff6_priv *priv = (const struct ff6_priv *)data;
+	ff6_priv_release(priv);
+}
+
+static const struct ff6_priv *ffn6_get_ro_priv(const struct ffn6_lookup_entry *e6)
+{
+	if (e6->manip.priv_destructor != ff6_priv_destructor_cb)
+		return NULL;
+
+	return (const struct ff6_priv *)e6->manip.ffn_priv_area;
+}
+
+static struct ff6_priv *ffn6_get_rw_priv(struct ffn6_lookup_entry *e6)
+{
+	BUILD_BUG_ON(sizeof (e6->manip.ffn_priv_area) <
+		     sizeof (struct ff6_priv));
+
+	if (e6->manip.priv_destructor &&
+	    e6->manip.priv_destructor != ff6_priv_destructor_cb)
+		return NULL;
+
+	return (struct ff6_priv *)e6->manip.ffn_priv_area;
+}
+
+/*
+ *
+ */
+static u32 ff_tun_extract_6rd_addr(const struct in6_addr *d)
+{
+	u32 a1, a2;
+
+	a1 = ntohl(d->s6_addr32[0] & ~ff.u.sit.s6rd_pmask);
+	a1 <<= ff.u.sit.s6rd_plen;
+
+	a2 = ntohl(d->s6_addr32[1] & ff.u.sit.s6rd_pmask);
+	a2 >>= (32 - ff.u.sit.s6rd_plen);
+	return htonl(a1 | a2);
+}
+
+/*
+ *
+ */
+static void ff_tun_gen_mape_addr(u32 addr, u16 port, struct in6_addr *dest)
+{
+	u32 eabits;
+	u16 psid;
+
+	eabits = ntohl(addr & ff.u.map.ea_addr_mask) << ff.u.map.psid_len;
+	psid = 0;
+	if (ff.u.map.psid_len) {
+		psid = ntohs(port & ff.u.map.ea_port_mask) >>
+			(16 - ff.u.map.psid_len);
+		eabits |= psid;
+	}
+
+	memcpy(dest, &ff.u.map.ipv6_prefix, 8);
+	dest->s6_addr32[1] |= htonl(eabits << ff.u.map.ea_lshift);
+
+	dest->s6_addr32[2] = htonl(ntohl(addr) >> 16);
+	dest->s6_addr32[3] = htonl((ntohl(addr) << 16) | psid);
+}
+
+/*
+ *
+ */
+static bool ff_forward(unsigned int thread,
+		       struct mvpp2_port *rx_port,
+		       const uint8_t *rx_alt_hwaddr,
+		       int pool,
+		       struct mvpp2_port *tx_port1,
+		       struct mvpp2_port *tx_port2,
+		       const uint8_t *tx_alt_hwaddr,
+		       bool wan_to_lan,
+		       struct net_device *rx_dev,
+		       struct net_device *tx_dev,
+		       unsigned int rx_vlan,
+		       unsigned int tx_vlan,
+		       struct mvpp2_rx_desc *rx_desc,
+		       void *frag,
+		       size_t offset, size_t eth_len)
+{
+	struct mvpp2_bm_pool *bm_pool;
+	struct net_device_stats *rx_hw_stats;
+	struct net_device_stats *tx_hw_stats;
+	struct mvpp2_port *tx_port;
+	struct net_device *last_rx_dev, *next_tx_dev;
+	struct ffn_lookup_entry *e = NULL;
+	struct ffn6_lookup_entry *e6 = NULL;
+	struct nf_conn *ct = NULL;
+	struct ethhdr *eth;
+	enum ff_xmit_mode xmit_mode;
+	u8 dest_hw[6];
+	unsigned int timeout;
+	void *l3_hdr, *l4_hdr;
+	bool l3_is_ipv4, l4_is_tcp;
+	unsigned int l3_plen;
+	u32 tun_v4_dest = 0;
+	const struct in6_addr *tun_v6_pdest = NULL;
+	u32 rx_status;
+	u16 proto, parser_info;
+	dma_addr_t frag_dma_addr;
+	phys_addr_t frag_phys_addr;
+	const uint8_t *src_hwaddr;
+
+	/* make sure we have headroom for the worst case scenario */
+	BUILD_BUG_ON(NET_SKB_PAD <
+		     (sizeof (struct ipv6hdr) + VLAN_HLEN));
+
+	if (!tx_port1 || !rx_port || !tx_dev || !rx_dev)
+		return false;
+
+	eth = (struct ethhdr *)((uint8_t *)frag + offset);
+	rx_status = mvpp2_rxdesc_status_get(rx_port, rx_desc);
+	parser_info = mvpp2_rxdesc_parser_info_get(rx_port, rx_desc);
+
+	/*
+	 * filter only IPv4 & IPv6 packets
+	 */
+	if (rx_vlan) {
+		struct vlan_ethhdr *vhdr;
+
+		if (!pkt_is_vlan(parser_info))
+			return false;
+
+		vhdr = (struct vlan_ethhdr *)eth;
+		if (vhdr->h_vlan_TCI != htons(rx_vlan))
+			return false;
+
+		if (!pkt_is_ipvx(rx_status))
+			return false;
+
+		l3_hdr = vhdr + 1;
+		l3_plen = eth_len - VLAN_ETH_HLEN;
+	} else {
+		if (pkt_is_vlan(parser_info))
+			return false;
+
+		if (!pkt_is_ipvx(rx_status))
+			return false;
+
+		l3_hdr = eth + 1;
+		l3_plen = eth_len - ETH_HLEN;
+	}
+
+	/* make sure packet is for our mac address */
+	if (memcmp(eth->h_dest, rx_port->dev->dev_addr, 6)) {
+		if (!rx_alt_hwaddr || memcmp(eth->h_dest, rx_alt_hwaddr, 6))
+			return false;
+	}
+
+	last_rx_dev = rx_dev;
+	l3_is_ipv4 = pkt_is_ipv4(rx_status);
+
+	if (l3_is_ipv4) {
+		struct iphdr *iph;
+		struct fbxbr_fwcache *fwc;
+		struct fbxbr *fbxbr = NULL;
+		struct fbxbr_port *fbxbr_fwd_port = NULL;
+		u16 sport, dport;
+		u8 ip_proto;
+
+handle_ipv4:
+		iph = (struct iphdr *)l3_hdr;
+
+		/* lookup IP ffn entry */
+		if (iph->ihl > 5 || (iph->frag_off & htons(IP_MF | IP_OFFSET)))
+			return false;
+
+		if (iph->ttl <= 1)
+			return false;
+
+		ip_proto = iph->protocol;
+		if (ip_proto == IPPROTO_TCP) {
+			struct tcphdr *tcph;
+
+			if (l3_plen < sizeof (*iph) + sizeof (*tcph))
+				return false;
+
+			tcph = (struct tcphdr *)((u8 *)iph + 20);
+			if (tcph->fin ||
+			    tcph->syn ||
+			    tcph->rst ||
+			    !tcph->ack) {
+				return false;
+			}
+
+			sport = tcph->source;
+			dport = tcph->dest;
+			l4_hdr = tcph;
+			l4_is_tcp = true;
+
+		} else if (ip_proto == IPPROTO_UDP) {
+			struct udphdr *udph;
+
+			if (l3_plen < sizeof (*iph) + sizeof (*udph))
+				return false;
+
+			udph = (struct udphdr *)((u8 *)iph + 20);
+			sport = udph->source;
+			dport = udph->dest;
+			l4_hdr = udph;
+			l4_is_tcp = false;
+
+		} else if (ip_proto == IPPROTO_IPV6) {
+			struct ipv6hdr *ip6hdr;
+			u32 ip6rd_daddr;
+
+			if (!ff.tun_ready)
+				return false;
+
+			/* must be for us */
+			if (iph->daddr != ff.u.sit.src)
+				return false;
+
+			/* check len */
+			if (l3_plen < sizeof (struct iphdr) +
+			    sizeof (struct ipv6hdr))
+				return false;
+
+			ip6hdr = (struct ipv6hdr *)(iph + 1);
+
+			/* must belong to 6rd prefix */
+			if ((ip6hdr->daddr.s6_addr32[0] &
+			     ff.u.sit.s6rd_pmask) != ff.u.sit.s6rd_prefix)
+				return false;
+
+			/* 6rd address */
+			ip6rd_daddr = ff_tun_extract_6rd_addr(&ip6hdr->daddr);
+			if (ip6rd_daddr != ff.u.sit.src)
+				return false;
+
+			/* TODO: should check for spoofing here */
+			l3_hdr = ip6hdr;
+			l3_plen -= 20;
+			l3_is_ipv4 = false;
+			goto handle_ipv6;
+
+		} else
+			return false;
+
+		if (is_fbxbridge_port(last_rx_dev)) {
+			struct fbxbr_fwcache_key k;
+			struct fbxbr_port *p;
+			u32 hash;
+
+			p = fbxbr_port_get_rcu(last_rx_dev);
+			fbxbr = p->br;
+
+			if (wan_to_lan) {
+				WARN_ON(!p->is_wan);
+				k.wan_ip = iph->saddr;
+				k.lan_ip = iph->daddr;
+				k.wan_port = sport;
+				k.lan_port = dport;
+				fbxbr_fwd_port = fbxbr->lan_port;
+			} else {
+				WARN_ON(p->is_wan);
+				k.lan_ip = iph->saddr;
+				k.wan_ip = iph->daddr;
+				k.lan_port = sport;
+				k.wan_port = dport;
+				fbxbr_fwd_port = fbxbr->wan_port;
+			}
+			k.is_tcp = l4_is_tcp;
+
+			if (!unlikely(fbxbr_fwd_port))
+				return false;
+
+			hash = fbxbr_fwcache_hash(&k);
+			fwc = __fbxbr_fwcache_lookup(p->br, hash, &k);
+			if (!fwc)
+				return false;
+
+			next_tx_dev = fbxbr_fwd_port->dev;
+			e = NULL;
+		} else {
+			e = __ffn_get(iph->saddr, iph->daddr,
+				      sport, dport, l4_is_tcp);
+			if (!e)
+				return false;
+
+			if (e->manip.dst->obsolete > 0)
+				return false;
+
+			ct = e->manip.ct;
+
+			/* only fast forward TCP connections in established state */
+			if (l4_is_tcp &&
+			    ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED)
+				return false;
+
+			next_tx_dev = e->manip.dst->dev;
+			fwc = NULL;
+		}
+
+		/* find out if the packet is to be sent as-is or
+		 * tunneled */
+		if (ff.tun_dev && next_tx_dev == ff.tun_dev) {
+			const struct ff_priv *ff_priv;
+			struct ff_priv *ff_wpriv;
+			struct dst_entry *v6_dst;
+			const struct in6_addr *pdest, *nexthop;
+			struct in6_addr dest;
+			struct rt6_info *rt6;
+			struct neighbour *neigh;
+
+			/* IPv4 tunneled into MAP-E device */
+			if (!ff.tun_ready) {
+				return false;
+			}
+
+			if (l3_plen > ff.tun_mtu)
+				return false;
+
+			/* lookup ipv6 route cache */
+			if (e)
+				ff_priv = ffn_get_ro_priv(e);
+			else
+				ff_priv = fwc_get_ro_priv(fwc);
+
+			if (ff_priv) {
+				if (ff_priv->tun_dst->obsolete < 0) {
+					/* valid route found */
+					v6_dst = ff_priv->tun_dst;
+					pdest = &ff_priv->tun_dest_ip6;
+					goto cached_ipv6_route;
+				}
+
+				ff_priv_release(ff_priv);
+				if (e)
+					e->manip.priv_destructor = NULL;
+				else
+					fwc->priv_destructor = NULL;
+			}
+
+			/* cache miss, compute IPv6 destination */
+			if (ff.u.map.ipv4_prefix &&
+			    (iph->daddr & ff.u.map.ipv4_pmask) ==
+			    ff.u.map.ipv4_prefix) {
+				/* compute dest using FMR */
+				ff_tun_gen_mape_addr(iph->daddr, dport, &dest);
+				pdest = &dest;
+			} else {
+				/* next hop is BR */
+				pdest = &ff.u.map.br;
+			}
+
+			/* v6 route lookup */
+			rt6 = rt6_lookup(&init_net, pdest, NULL, 0, NULL, 0);
+			if (!rt6)
+				return false;
+
+			if (e)
+				ff_wpriv = ffn_get_rw_priv(e);
+			else
+				ff_wpriv = fwc_get_rw_priv(fwc);
+			if (!ff_wpriv)
+				return false;
+
+			/* cache this inside FFN private area */
+			ff_wpriv->tun_dst = (struct dst_entry *)rt6;
+			memcpy(&ff_wpriv->tun_dest_ip6, pdest, 16);
+			if (e)
+				e->manip.priv_destructor = ff_priv_destructor_cb;
+			else
+				fwc->priv_destructor = ff_priv_destructor_cb;
+			ff_priv = ff_wpriv;
+
+			v6_dst = (struct dst_entry *)rt6;
+
+cached_ipv6_route:
+			if (v6_dst->dev != tx_dev) {
+				return false;
+			}
+
+			/* is the neighboor ready ? */
+			rt6 = (struct rt6_info *)v6_dst;
+			nexthop = rt6_nexthop(rt6, (struct in6_addr *)pdest);
+			if (!nexthop) {
+				return false;
+			}
+
+			neigh = __ipv6_neigh_lookup_noref(tx_dev, nexthop);
+			if (!neigh || !(neigh->nud_state & NUD_VALID))
+				return false;
+			memcpy(dest_hw, neigh->ha, 6);
+
+			xmit_mode = FF_XMIT_IPV4_IN_IPV6;
+			tun_v6_pdest = &ff_priv->tun_dest_ip6;
+
+		} else if (next_tx_dev == tx_dev) {
+			struct neighbour *neigh;
+			const struct rtable *rt;
+
+			/* is the neighboor ready ? */
+			if (e) {
+				u32 nexthop;
+
+				rt = (const struct rtable *)e->manip.dst;
+				nexthop = (__force u32)rt_nexthop(rt,
+							   e->manip.new_dip);
+				neigh = __ipv4_neigh_lookup_noref(tx_dev,
+								  nexthop);
+				if (!neigh || !(neigh->nud_state & NUD_VALID))
+					return false;
+
+				memcpy(dest_hw, neigh->ha, 6);
+			} else {
+				if (!fbxbr_fwd_port->is_wan) {
+					if (!fbxbr->have_hw_addr)
+						return false;
+					memcpy(dest_hw, fbxbr->lan_hwaddr, 6);
+				} else {
+					__be32 nh;
+
+					nh = iph->daddr;
+					if ((nh & fbxbr->wan_netmask) !=
+					    (fbxbr->wan_ipaddr &
+					     fbxbr->wan_netmask)) {
+						rt = fbxbr_fwd_port->rt;
+						if (!rt ||
+						    rt->dst.obsolete > 0)
+							return false;
+
+						nh = rt_nexthop(rt, nh);
+					}
+
+					neigh = __ipv4_neigh_lookup_noref(
+						tx_dev, nh);
+					if (!neigh ||
+					    !(neigh->nud_state & NUD_VALID))
+						return false;
+
+					memcpy(dest_hw, neigh->ha, 6);
+				}
+			}
+
+			xmit_mode = FF_XMIT_IPV4;
+		} else
+			return false;
+
+	} else {
+		struct ipv6hdr *ip6hdr;
+		u16 sport, dport;
+		u8 ip_proto;
+
+handle_ipv6:
+		ip6hdr = (struct ipv6hdr *)l3_hdr;
+
+		if (ip6hdr->hop_limit <= 1 || !ip6hdr->payload_len)
+			return false;
+
+		if (ntohs(ip6hdr->payload_len) > l3_plen)
+			return false;
+
+		ip_proto = ip6hdr->nexthdr;
+
+		if (ip_proto == IPPROTO_TCP) {
+			struct tcphdr *tcph;
+
+			if (l3_plen < sizeof (*ip6hdr) + sizeof (*tcph))
+				return false;
+
+			tcph = (struct tcphdr *)((u8 *)ip6hdr +
+						 sizeof (*ip6hdr));
+
+			if (tcph->fin ||
+			    tcph->syn ||
+			    tcph->rst ||
+			    !tcph->ack) {
+				return false;
+			}
+
+			sport = tcph->source;
+			dport = tcph->dest;
+			l4_hdr = tcph;
+			l4_is_tcp = true;
+
+		} else if (ip_proto == IPPROTO_UDP) {
+			struct udphdr *udph;
+
+			if (l3_plen < sizeof (*ip6hdr) + sizeof (*udph))
+				return false;
+
+			udph = (struct udphdr *)((u8 *)ip6hdr +
+						 sizeof (*ip6hdr));
+			sport = udph->source;
+			dport = udph->dest;
+			l4_hdr = udph;
+			l4_is_tcp = false;
+
+		} else if (ip_proto == IPPROTO_IPIP) {
+			struct iphdr *iph;
+
+			if (!ff.tun_ready)
+				return false;
+
+			/* must be for us */
+			if (memcmp(&ip6hdr->daddr, &ff.u.map.src, 16))
+				return false;
+
+			/* check len */
+			if (l3_plen < sizeof (struct iphdr) +
+			    sizeof (struct ipv6hdr))
+				return false;
+
+			iph = (struct iphdr *)(ip6hdr + 1);
+
+			/* does it come from BR ? */
+			if (memcmp(&ip6hdr->saddr, &ff.u.map.br, 16)) {
+				struct in6_addr exp_src_addr;
+
+				/* no, check FMR for spoofing */
+				if (!ff.u.map.ipv4_prefix)
+					return false;
+
+				/* check up to PSID to reduce lookup
+				 * depth */
+				ff_tun_gen_mape_addr(iph->saddr, 0,
+						     &exp_src_addr);
+				if (!ipv6_prefix_equal(&ip6hdr->saddr,
+						       &exp_src_addr,
+						       ff.u.map.ipv6_plen +
+						       ff.u.map.ipv4_plen))
+					return false;
+			}
+
+			last_rx_dev = ff.tun_dev;
+			if (!last_rx_dev)
+				return false;
+
+			l3_hdr = iph;
+			l3_plen -= sizeof (*ip6hdr);
+			l3_is_ipv4 = true;
+			goto handle_ipv4;
+
+		} else
+			return false;
+
+		e6 = __ffn6_get(ip6hdr->saddr.s6_addr32,
+				ip6hdr->daddr.s6_addr32,
+				sport, dport, l4_is_tcp);
+
+		if (!e6) {
+			return false;
+		}
+
+		if (e6->manip.dst->obsolete > 0) {
+			return false;
+		}
+
+		ct = e6->manip.ct;
+
+		/* only fast forward TCP connections in established state */
+		if (l4_is_tcp &&
+		    ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED) {
+			return false;
+		}
+
+		/* find out if the packet is to be sent as-is or
+		 * tunneled */
+		if (ff.tun_dev && e6->manip.dst->dev == ff.tun_dev) {
+			const struct ff6_priv *ff6_priv;
+			struct ff6_priv *ff6_wpriv;
+			struct dst_entry *v4_dst;
+			struct flowi4 fl4;
+			struct rtable *rt;
+			struct neighbour *neigh;
+			u32 dest, nexthop;
+
+			/* IPv6 tunneled into SIT device using 6rd */
+			if (!ff.tun_ready) {
+				return false;
+			}
+
+			if (l3_plen > ff.tun_mtu)
+				return false;
+
+			/* lookup ipv4 route cache */
+			ff6_priv = ffn6_get_ro_priv(e6);
+			if (ff6_priv) {
+				if (!ff6_priv->tun_dst->obsolete) {
+					/* valid route found */
+					v4_dst = ff6_priv->tun_dst;
+					dest = ff6_priv->tun_dest_ip;
+					goto cached_ipv4_route;
+				}
+
+				ff6_priv_release(ff6_priv);
+				e6->manip.priv_destructor = NULL;
+			}
+
+			/* cache miss, compute IPv4 destination */
+			if ((ip6hdr->daddr.s6_addr32[0] &
+			     ff.u.sit.s6rd_pmask) == ff.u.sit.s6rd_prefix) {
+				/* next hop via prefix */
+				dest = ff_tun_extract_6rd_addr(&ip6hdr->daddr);
+			} else {
+				const struct in6_addr *nh6;
+				struct rt6_info *rt6;
+
+				/* next hop via route */
+				rt6 = (struct rt6_info *)e6->manip.dst;
+				nh6 = rt6_nexthop(rt6,
+				      (struct in6_addr *)e6->manip.new_dip);
+				if (!nh6) {
+					return false;
+				}
+
+				/* should be a v4 mapped */
+				if (nh6->s6_addr32[0] != 0 ||
+				    nh6->s6_addr32[1] != 0 ||
+				    nh6->s6_addr32[2] != 0) {
+					return false;
+				}
+
+				dest = nh6->s6_addr32[3];
+			}
+
+			/* v4 route lookup */
+			rt = ip_route_output_ports(&init_net, &fl4, NULL,
+						   dest, ff.u.sit.src,
+						   0, 0,
+						   IPPROTO_IPV6, 0,
+						   0);
+			if (IS_ERR(rt) ||
+			    rt->rt_type != RTN_UNICAST)
+				return false;
+
+			ff6_wpriv = ffn6_get_rw_priv(e6);
+			if (!ff6_wpriv)
+				return false;
+
+			/* cache this inside FFN private area */
+			ff6_wpriv->tun_dst = (struct dst_entry *)rt;
+			ff6_wpriv->tun_dest_ip = dest;
+			e6->manip.priv_destructor = ff6_priv_destructor_cb;
+
+			v4_dst = (struct dst_entry *)rt;
+			ff6_priv = ff6_wpriv;
+
+cached_ipv4_route:
+			if (v4_dst->dev != tx_dev) {
+				return false;
+			}
+
+			/* is the neighboor ready ? */
+			rt = (struct rtable *)v4_dst;
+			nexthop = (__force u32)rt_nexthop(rt, dest);
+			neigh = __ipv4_neigh_lookup_noref(tx_dev, nexthop);
+			if (!neigh || !(neigh->nud_state & NUD_VALID))
+				return false;
+			memcpy(dest_hw, neigh->ha, 6);
+
+			tun_v4_dest = dest;
+			xmit_mode = FF_XMIT_IPV6_IN_IPV4;
+
+		} else if (e6->manip.dst->dev == tx_dev) {
+			const struct in6_addr *nexthop;
+			struct rt6_info *rt6;
+			struct neighbour *neigh;
+
+			/* is the neighboor ready ? */
+			rt6 = (struct rt6_info *)e6->manip.dst;
+
+			nexthop = rt6_nexthop(rt6,
+				      (struct in6_addr *)e6->manip.new_dip);
+			if (!nexthop)
+				return false;
+
+			neigh = __ipv6_neigh_lookup_noref(tx_dev, nexthop);
+			if (!neigh || !(neigh->nud_state & NUD_VALID))
+				return false;
+			memcpy(dest_hw, neigh->ha, 6);
+
+			xmit_mode = FF_XMIT_IPV6;
+		} else
+			return false;
+	}
+
+	/* should only ff long frames */
+	if (WARN_ON(pool != MVPP2_BM_LONG))
+		return false;
+
+	/* is destination on correct tx bridge port ? */
+	if (!is_bridge_dev(tx_dev))
+		tx_port = tx_port1;
+	else {
+		struct net_bridge_port *p1, *p2;
+		struct net_bridge_fdb_entry *fdb;
+
+		p1 = br_port_get_rcu(tx_port1->dev);
+		p2 = NULL;
+		if (tx_port2)
+			p2 = br_port_get_rcu(tx_port2->dev);
+
+		fdb = br_fdb_find_rcu(p1->br, dest_hw, 0);
+		if (!fdb)
+			return false;
+
+		if (fdb->dst == p1)
+			tx_port = tx_port1;
+		else if (fdb->dst == p2)
+			tx_port = tx_port2;
+		else
+			return false;
+	}
+
+	if (is_bridge_dev(rx_dev)) {
+		struct net_bridge *br = netdev_priv(rx_dev);
+		struct net_bridge_port *p;
+		struct pcpu_sw_netstats *stats;
+
+		/* if packet comes from a bridge, make sure we are
+		 * allowed to ingress it */
+		p = br_port_get_rcu(rx_port->dev);
+		if (p->state != BR_STATE_FORWARDING) {
+			return false;
+		}
+
+		/* refresh FDB entry for this source */
+		if (!br_fdb_update_only(br, p, eth->h_source)) {
+			return false;
+		}
+
+		stats = this_cpu_ptr(br->stats);
+		stats->rx_packets++;
+		stats->rx_bytes += eth_len;
+
+	} else if (rx_vlan) {
+		struct vlan_dev_priv *vlan = vlan_dev_priv(rx_dev);
+		struct vlan_pcpu_stats *stats;
+		stats = this_cpu_ptr(vlan->vlan_pcpu_stats);
+		stats->rx_packets++;
+		stats->rx_bytes += eth_len;
+	} else {
+		rx_dev->stats.rx_packets++;
+		rx_dev->stats.rx_bytes += eth_len;
+	}
+
+	rx_hw_stats = &rx_port->dev->stats;
+	rx_hw_stats->rx_bytes += eth_len;
+	rx_hw_stats->rx_packets++;
+
+	frag_dma_addr = mvpp2_rxdesc_dma_addr_get(rx_port, rx_desc);
+	frag_phys_addr = mvpp2_rxdesc_cookie_get(rx_port, rx_desc);
+
+	/* do we have room in the tx queue ? */
+	bm_pool = &rx_port->priv->bm_pools[pool];
+	if (!ff_can_send(thread, tx_port, bm_pool)) {
+		/* just rearm descriptor and fake success */
+		mvpp2_bm_pool_put(rx_port, pool, frag_dma_addr, frag_phys_addr);
+		return true;
+	}
+
+	/* can we allocate a new fragment to replace the descriptor we
+	 * are about to use ? */
+	if (mvpp2_rx_refill(rx_port, bm_pool, pool)) {
+		/* just rearm descriptor and fake success */
+		mvpp2_bm_pool_put(rx_port, pool, frag_dma_addr, frag_phys_addr);
+		return true;
+	}
+
+	/* do we have a free tx desc ? */
+	if (!ff_ensure_tx_desc(thread, tx_port, bm_pool)) {
+		/* just rearm descriptor and fake success */
+		mvpp2_bm_pool_put(rx_port, pool, frag_dma_addr, frag_phys_addr);
+		return true;
+	}
+
+	if (ct && l4_is_tcp) {
+		/* don't try to track window anymore on this
+		 * connection */
+		ct->proto.tcp.no_window_track = 1;
+	}
+
+	/* alter l3 & l4 content if needed (routing only) */
+	if (l3_is_ipv4 && e) {
+		struct iphdr *iph = (struct iphdr *)l3_hdr;
+
+		if (e->manip.alter) {
+			if (l4_is_tcp) {
+				struct tcphdr *tcph = (struct tcphdr *)l4_hdr;
+				tcph->source = e->manip.new_sport;
+				tcph->dest = e->manip.new_dport;
+				tcph->check = csum16_sub(tcph->check,
+						 e->manip.l4_adjustment);
+			} else {
+				struct udphdr *udph = (struct udphdr *)l4_hdr;
+				udph->source = e->manip.new_sport;
+				udph->dest = e->manip.new_dport;
+				if (udph->check) {
+					u16 tcheck;
+
+					tcheck = csum16_sub(udph->check,
+						    e->manip.l4_adjustment);
+					udph->check = tcheck ? tcheck : 0xffff;
+				}
+			}
+
+			iph->saddr = e->manip.new_sip;
+			iph->daddr = e->manip.new_dip;
+		}
+
+		iph->ttl--;
+		iph->check = csum16_sub(iph->check,
+					e->manip.ip_adjustment);
+
+	} else if (!l3_is_ipv4 && e6) {
+		struct ipv6hdr *ip6hdr = (struct ipv6hdr *)l3_hdr;
+
+		if (e6->manip.alter) {
+			if (l4_is_tcp) {
+				struct tcphdr *tcph = (struct tcphdr *)l4_hdr;
+				tcph->source = e6->manip.new_sport;
+				tcph->dest = e6->manip.new_dport;
+				tcph->check = csum16_sub(tcph->check,
+							 e6->manip.adjustment);
+			} else {
+				struct udphdr *udph = (struct udphdr *)l4_hdr;
+				udph->source = e6->manip.new_sport;
+				udph->dest = e6->manip.new_dport;
+
+				if (udph->check) {
+					u16 tcheck;
+
+					tcheck = csum16_sub(udph->check,
+						    e6->manip.adjustment);
+					udph->check = tcheck ? tcheck : 0xffff;
+				}
+			}
+
+			memcpy(ip6hdr->saddr.s6_addr32, e6->manip.new_sip, 16);
+			memcpy(ip6hdr->daddr.s6_addr32, e6->manip.new_dip, 16);
+		}
+
+		ip6hdr->hop_limit--;
+	}
+
+	/* packet is ready to xmit */
+	switch (xmit_mode) {
+	case FF_XMIT_IPV4:
+		proto = ETH_P_IP;
+		break;
+
+	case FF_XMIT_IPV6:
+		proto = ETH_P_IPV6;
+		break;
+
+	case FF_XMIT_IPV6_IN_IPV4:
+	{
+		struct iphdr *tun_hdr;
+		/* prepend IPv4 */
+		tun_hdr = (struct iphdr *)((u8 *)l3_hdr - sizeof (*tun_hdr));
+		tun_hdr->ihl = 5;
+		tun_hdr->version = 4;
+		tun_hdr->tos = 0;
+		tun_hdr->tot_len = htons(l3_plen + sizeof (*tun_hdr));
+		tun_hdr->id = 0;
+		tun_hdr->frag_off = 0;
+		tun_hdr->ttl = 64;
+		tun_hdr->protocol = IPPROTO_IPV6;
+		tun_hdr->saddr = ff.u.sit.src;
+		tun_hdr->daddr = tun_v4_dest;
+
+		l3_hdr = (u8 *)tun_hdr;
+		l3_plen += sizeof (*tun_hdr);
+
+		proto = ETH_P_IP;
+		break;
+	}
+
+	case FF_XMIT_IPV4_IN_IPV6:
+	{
+		struct ipv6hdr *tun_6hdr;
+
+		/* prepend IPv6 */
+		tun_6hdr = (struct ipv6hdr *)((u8 *)l3_hdr - sizeof (*tun_6hdr));
+		tun_6hdr->version = 6;
+		tun_6hdr->priority = 0;
+		memset(tun_6hdr->flow_lbl, 0, sizeof (tun_6hdr->flow_lbl));
+		tun_6hdr->payload_len = htons(l3_plen);
+		tun_6hdr->nexthdr = IPPROTO_IPIP;
+		tun_6hdr->hop_limit = 64;
+		tun_6hdr->saddr = ff.u.map.src;
+		tun_6hdr->daddr = *tun_v6_pdest;
+
+		l3_hdr = (u8 *)tun_6hdr;
+		l3_plen += sizeof (*tun_6hdr);
+
+		proto = ETH_P_IPV6;
+		break;
+	}
+	}
+
+	src_hwaddr = tx_port->dev->dev_addr;
+	if (tx_alt_hwaddr)
+		src_hwaddr = tx_alt_hwaddr;
+
+	/* add ethernet header */
+	if (tx_vlan) {
+		struct vlan_ethhdr *vhdr;
+
+		vhdr = (struct vlan_ethhdr *)((u8 *)l3_hdr - VLAN_ETH_HLEN);
+		memcpy(vhdr->h_dest, dest_hw, 6);
+		memcpy(vhdr->h_source, src_hwaddr, 6);
+		vhdr->h_vlan_proto = htons(ETH_P_8021Q);
+		vhdr->h_vlan_TCI = htons(tx_vlan);
+		vhdr->h_vlan_encapsulated_proto = htons(proto);
+
+		eth = (struct ethhdr *)vhdr;
+		eth_len = l3_plen + VLAN_ETH_HLEN;
+	} else {
+		eth = (struct ethhdr *)((u8 *)l3_hdr - ETH_HLEN);
+		memcpy(eth->h_dest, dest_hw, 6);
+		memcpy(eth->h_source, src_hwaddr, 6);
+		eth->h_proto = htons(proto);
+		eth_len = l3_plen + ETH_HLEN;
+	}
+
+	ff_send(thread,
+		tx_port,
+		frag_dma_addr,
+		frag_phys_addr,
+		(void *)eth - frag,
+		pool,
+		eth_len,
+		(proto == ETH_P_IP),
+		(xmit_mode == FF_XMIT_IPV4),
+		l4_is_tcp,
+		tx_vlan);
+
+	if (is_bridge_dev(tx_dev)) {
+		struct net_bridge *br = netdev_priv(tx_dev);
+		struct pcpu_sw_netstats *stats;
+		stats = this_cpu_ptr(br->stats);
+		stats->tx_packets++;
+		stats->tx_bytes += eth_len;
+	} else if (tx_vlan) {
+		struct vlan_dev_priv *vlan = vlan_dev_priv(tx_dev);
+		struct vlan_pcpu_stats *stats;
+		stats = this_cpu_ptr(vlan->vlan_pcpu_stats);
+		stats->tx_packets++;
+		stats->tx_bytes += eth_len;
+	} else {
+		tx_dev->stats.tx_packets++;
+		tx_dev->stats.tx_bytes += eth_len;
+	}
+
+	tx_hw_stats = &tx_port->dev->stats;
+	tx_hw_stats->tx_bytes += eth_len;
+	tx_hw_stats->tx_packets++;
+
+	/* refresh conntrack */
+	if (ct) {
+		if (l4_is_tcp)
+			timeout = HZ * 3600 * 24 * 5;
+		else
+			timeout = HZ * 180;
+
+		if (ct->timeout - ff.jiffies < timeout - 10 * HZ) {
+			unsigned long newtime = ff.jiffies + timeout;
+			ct->timeout = newtime;
+		}
+	}
+
+	return true;
+}
+
+/*
+ *
+ */
+static bool ff_receive(unsigned int thread,
+		       struct mvpp2_port *port,
+		       int pool,
+		       struct mvpp2_rx_desc *rx_desc,
+		       void *frag,
+		       size_t offset, size_t dlen)
+{
+	int wan_idx = (FF_DEV_WAN_ID << 1) | FF_DEV_WAN_PORT_INDEX;
+	int sfplan_idx = (FF_DEV_SFPLAN_ID << 1) | FF_DEV_SFPLAN_PORT_INDEX;
+	int swlan_idx = (FF_DEV_SWLAN_ID << 1) | FF_DEV_SWLAN_PORT_INDEX;
+	struct net_device *wan_dev;
+	int wan_vlan_id;
+	unsigned int idx;
+
+	if (!ff_enabled)
+		return false;
+
+	if (ff.wan_active_dev == -1)
+		return false;
+
+	wan_dev = ff.wan_devs[ff.wan_active_dev];
+	wan_vlan_id = ff.wan_vlan_ids[ff.wan_active_dev];
+
+	idx = (port->priv->id << 1) | port->index;
+
+	/*
+	 * LAN => WAN
+	 * [sfplan0 (untagged)] => [br0] => IPV4 => [ftth0.<vlan>]
+	 */
+	if (idx == sfplan_idx) {
+		return ff_forward(thread,
+				  port,
+				  sfplan.bridge_hwaddr,
+				  pool,
+				  ports_by_idx[wan_idx],
+				  NULL,
+				  NULL,
+				  false,
+				  ff.lan_dev_sfp,
+				  wan_dev,
+				  0, wan_vlan_id,
+				  rx_desc,
+				  frag, offset, dlen);
+	}
+
+	/*
+	 * LAN => WAN
+	 * [swlan0 (untagged)] => [br0] => IPV4 => [ftth0.<vlan>]
+	 */
+	if (idx == swlan_idx) {
+		return ff_forward(thread,
+				  port,
+				  swlan.bridge_hwaddr,
+				  pool,
+				  ports_by_idx[wan_idx],
+				  NULL,
+				  NULL,
+				  false,
+				  ff.lan_dev_sw,
+				  wan_dev,
+				  0, wan_vlan_id,
+				  rx_desc,
+				  frag, offset, dlen);
+	}
+
+	/*
+	 * WAN => LAN
+	 * [ffth0.<vlan>] => IPV4 => [br0] => [sfplan0/swlan0]
+	 */
+	if (idx == wan_idx) {
+		struct mvpp2_port *tx_ports[2];
+		struct net_device *tx_dev;
+		const uint8_t *tx_alt_hwaddr;
+
+		if (ff.lan_dev_sfp && sfplan.fbxbr_port) {
+			/* fbxbridge mode */
+			tx_ports[0] = ports_by_idx[sfplan_idx];
+			tx_ports[1] = NULL;
+			tx_dev = ff.lan_dev_sfp;
+			tx_alt_hwaddr = NULL;
+
+		} else if (ff.lan_dev_sw && swlan.fbxbr_port) {
+			/* fbxbridge mode */
+			tx_ports[0] = ports_by_idx[swlan_idx];
+			tx_ports[1] = NULL;
+			tx_dev = ff.lan_dev_sw;
+			tx_alt_hwaddr = NULL;
+
+		} else {
+			/* bridge mode */
+			tx_ports[0] = ports_by_idx[sfplan_idx];
+			if (tx_ports[0])
+				tx_ports[1] = ports_by_idx[swlan_idx];
+			else {
+				tx_ports[0] = ports_by_idx[swlan_idx];
+				tx_ports[1] = NULL;
+			}
+
+			tx_dev = ff.lan_dev_sfp;
+			tx_alt_hwaddr = sfplan.bridge_hwaddr;
+			if (!tx_dev) {
+				tx_dev = ff.lan_dev_sw;
+				tx_alt_hwaddr = swlan.bridge_hwaddr;
+			}
+		}
+
+		return ff_forward(thread,
+				  port,
+				  NULL,
+				  pool,
+				  tx_ports[0],
+				  tx_ports[1],
+				  tx_alt_hwaddr,
+				  true,
+				  wan_dev,
+				  tx_dev,
+				  wan_vlan_id, 0,
+				  rx_desc,
+				  frag, offset, dlen);
+	}
+
+	return false;
+}
+
+/*
+ *
+ */
+static unsigned int ff_get_opposite_ports(struct mvpp2_port *in_port,
+					  struct mvpp2_port *out_ports[2])
+{
+	int wan_idx = (FF_DEV_WAN_ID << 1) | FF_DEV_WAN_PORT_INDEX;
+	int sfplan_idx = (FF_DEV_SFPLAN_ID << 1) | FF_DEV_SFPLAN_PORT_INDEX;
+	int swlan_idx = (FF_DEV_SWLAN_ID << 1) | FF_DEV_SWLAN_PORT_INDEX;
+	unsigned int idx, count;
+
+	idx = (in_port->priv->id << 1) | in_port->index;
+	count = 0;
+
+	if (idx == sfplan_idx || idx == swlan_idx) {
+		if (ports_by_idx[wan_idx])
+			out_ports[count++] = ports_by_idx[wan_idx];
+	} else if (idx == wan_idx) {
+		if (ports_by_idx[sfplan_idx])
+			out_ports[count++] = ports_by_idx[sfplan_idx];
+		if (ports_by_idx[swlan_idx])
+			out_ports[count++] = ports_by_idx[swlan_idx];
+	}
+
+	return count;
+}
+
+/*
+ *
+ */
+static ssize_t ff_show_enabled(struct device *dev,
+			       struct device_attribute *attr,
+			       char *buf)
+{
+	return sprintf(buf, "%u\n", ff_enabled);
+}
+
+static ssize_t ff_store_enabled(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t len)
+{
+	unsigned long val;
+
+	if (kstrtoul(buf, 10, &val))
+		return -EINVAL;
+
+	if (ff_enabled == val)
+		return len;
+
+	printk(KERN_NOTICE "ff: fastpath now %s\n",
+	       val ? "enabled" : "disabled");
+	ff_enabled = val;
+	return len;
+}
+
+static struct device_attribute dev_attr_ff = {
+	.attr = { .name = "ff_enabled", .mode = (S_IRUGO | S_IWUSR) },
+	.show = ff_show_enabled,
+	.store = ff_store_enabled,
+};
+
+/*
+ *
+ */
+static ssize_t ff_show_tun_dev(struct device *dev,
+			       struct device_attribute *attr,
+			       char *buf)
+{
+	return sprintf(buf, "%s\n", ff.tun_dev_name);
+}
+
+static ssize_t ff_store_tun_dev(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t len)
+{
+	if (!len || buf[0] == '\n') {
+		ff.tun_dev_name[0] = 0;
+		spin_lock_bh(&ff_lock);
+		__ff_tun_release();
+		spin_unlock_bh(&ff_lock);
+		printk(KERN_NOTICE "ff: tun dev unset\n");
+		return len;
+	}
+
+	spin_lock_bh(&ff_lock);
+	__ff_tun_release();
+	strncpy(ff.tun_dev_name, buf, len);
+	strim(ff.tun_dev_name);
+	printk(KERN_NOTICE "ff: tun dev set to %s\n", ff.tun_dev_name);
+	__ff_tun_capture();
+	spin_unlock_bh(&ff_lock);
+	return len;
+}
+
+static struct device_attribute dev_attr_tun = {
+	.attr = { .name = "ff_tun_dev", .mode = (S_IRUGO | S_IWUSR) },
+	.show = ff_show_tun_dev,
+	.store = ff_store_tun_dev,
+};
+
+/*
+ *
+ */
+static ssize_t ff_show_wan_dev(struct device *dev,
+			       struct device_attribute *attr,
+			       char *buf)
+{
+	return sprintf(buf, "%s\n", ff.wan_dev_name);
+}
+
+static ssize_t ff_store_wan_dev(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t len)
+{
+	if (!len || buf[0] == '\n') {
+		ff.wan_dev_name[0] = 0;
+		spin_lock_bh(&ff_lock);
+		__ff_wan_find_active();
+		spin_unlock_bh(&ff_lock);
+		printk(KERN_NOTICE "ff: requested wan dev unset\n");
+		return len;
+	}
+
+	spin_lock_bh(&ff_lock);
+	ff.wan_dev_name[0] = 0;
+	__ff_wan_find_active();
+	strncpy(ff.wan_dev_name, buf, len);
+	strim(ff.wan_dev_name);
+	printk(KERN_NOTICE "ff: requested wan dev set to %s\n",
+	       ff.wan_dev_name);
+	__ff_wan_find_active();
+	spin_unlock_bh(&ff_lock);
+	return len;
+}
+
+static struct device_attribute dev_attr_wan = {
+	.attr = { .name = "ff_wan_dev", .mode = (S_IRUGO | S_IWUSR) },
+	.show = ff_show_wan_dev,
+	.store = ff_store_wan_dev,
+};
+
+static struct ff_dev swlan = {
+	.desc			= "swlan",
+	.id			= FF_DEV_SWLAN_ID,
+	.port_index		= FF_DEV_SWLAN_PORT_INDEX,
+	.bridge_member		= true,
+	.pvirt_dev		= &ff.lan_dev_sw,
+};
+
+static struct ff_dev sfplan = {
+	.desc			= "sfplan",
+	.id			= FF_DEV_SFPLAN_ID,
+	.port_index		= FF_DEV_SFPLAN_PORT_INDEX,
+	.bridge_member		= true,
+	.pvirt_dev		= &ff.lan_dev_sfp,
+};
+
+static struct ff_dev wan = {
+	.desc			= "wan_836",
+	.id			= FF_DEV_WAN_ID,
+	.port_index		= FF_DEV_WAN_PORT_INDEX,
+	.vlan			= 836,
+	.is_wan			= true,
+	.pvirt_dev		= &ff.wan_devs[0],
+	.pvlan_id		= &ff.wan_vlan_ids[0],
+};
+
+static struct ff_dev wan_301 = {
+	.desc			= "wan_301",
+	.id			= FF_DEV_WAN_ID,
+	.port_index		= FF_DEV_WAN_PORT_INDEX,
+	.vlan			= 301,
+	.is_wan			= true,
+	.pvirt_dev		= &ff.wan_devs[1],
+	.pvlan_id		= &ff.wan_vlan_ids[1],
+};
+
+static struct ff_dev wan_302 = {
+	.desc			= "wan_302",
+	.id			= FF_DEV_WAN_ID,
+	.port_index		= FF_DEV_WAN_PORT_INDEX,
+	.vlan			= 302,
+	.is_wan			= true,
+	.pvirt_dev		= &ff.wan_devs[2],
+	.pvlan_id		= &ff.wan_vlan_ids[2],
+};
+
+static struct ff_dev wan_303 = {
+	.desc			= "wan_303",
+	.id			= FF_DEV_WAN_ID,
+	.port_index		= FF_DEV_WAN_PORT_INDEX,
+	.vlan			= 303,
+	.is_wan			= true,
+	.pvirt_dev		= &ff.wan_devs[3],
+	.pvlan_id		= &ff.wan_vlan_ids[3],
+};
+
+static void ff_init(struct device *dev)
+{
+	static bool done;
+
+	if (done)
+		return;
+
+	ff.wan_active_dev = -1;
+	device_create_file(dev, &dev_attr_ff);
+	device_create_file(dev, &dev_attr_tun);
+	device_create_file(dev, &dev_attr_wan);
+
+	printk(KERN_DEBUG "ff_init\n");
+
+	list_add(&swlan.next, &ff_devs);
+	list_add(&sfplan.next, &ff_devs);
+	list_add(&wan.next, &ff_devs);
+	list_add(&wan_301.next, &ff_devs);
+	list_add(&wan_302.next, &ff_devs);
+	list_add(&wan_303.next, &ff_devs);
+	done = true;
+}
+#endif
+
 static void *mvpp2_frag_alloc(const struct mvpp2_bm_pool *pool)
 {
 	if (likely(pool->frag_size <= PAGE_SIZE))
@@ -859,6 +3083,10 @@
 	enum mvpp2_bm_pool_log_num long_log_pool, short_log_pool;
 	int rxq;
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	long_log_pool = MVPP2_BM_JUMBO;
+	short_log_pool = MVPP2_BM_LONG;
+#else
 	/* If port pkt_size is higher than 1518B:
 	 * HW Long pool - SW Jumbo pool, HW Short pool - SW Long pool
 	 * else: HW Long pool - SW Long pool, HW Short pool - SW Short pool
@@ -870,6 +3098,7 @@
 		long_log_pool = MVPP2_BM_LONG;
 		short_log_pool = MVPP2_BM_SHORT;
 	}
+#endif
 
 	if (!port->pool_long) {
 		port->pool_long =
@@ -1396,7 +3625,7 @@
 static u64 mvpp2_read_count(struct mvpp2_port *port,
 			    const struct mvpp2_ethtool_counter *counter)
 {
-	u64 val;
+	u64 val = 0;
 
 	val = readl(port->stats_base + counter->offset);
 	if (counter->reg_is_64b)
@@ -1479,10 +3708,32 @@
 	{ MVPP2_RX_PKTS_BM_DROP_CTR, "rxq_%d_packets_bm_drops" },
 };
 
+static const struct mvpp2_ethtool_counter mvpp2_ethtool_bm_regs[] = {
+	{ MVPP2_BM_DROP_CTR(0), "bm_%d_drop" },
+};
+
 #define MVPP2_N_ETHTOOL_STATS(ntxqs, nrxqs)	(ARRAY_SIZE(mvpp2_ethtool_mib_regs) + \
 						 ARRAY_SIZE(mvpp2_ethtool_port_regs) + \
 						 (ARRAY_SIZE(mvpp2_ethtool_txq_regs) * (ntxqs)) + \
-						 (ARRAY_SIZE(mvpp2_ethtool_rxq_regs) * (nrxqs)))
+						 (ARRAY_SIZE(mvpp2_ethtool_rxq_regs) * (nrxqs)) + \
+						 (ARRAY_SIZE(mvpp2_ethtool_bm_regs) * (16)))
+
+struct ethtool_priv_flags_strings {
+	const char string[ETH_GSTRING_LEN];
+};
+
+static const struct ethtool_priv_flags_strings mvpp2_priv_flags_strings[] = {
+	{ .string = "en-fbx-10g1g-switch" },
+	{ .string = "en-fbx-10g" },
+	{ .string = "en-fbx-1g" },
+	{ .string = "st-fbx-10g" },
+	{ .string = "st-fbx-1g" },
+	{ .string = "st-sync-ok", },
+	{ .string = "clear-mib", },
+	{ .string = "en-10g-linkdown-wa" },
+	{ .string = "linkdown-debounce" },
+};
+
 
 static void mvpp2_ethtool_get_strings(struct net_device *netdev, u32 sset,
 				      u8 *data)
@@ -1490,6 +3741,12 @@
 	struct mvpp2_port *port = netdev_priv(netdev);
 	int i, q;
 
+	if (sset == ETH_SS_PRIV_FLAGS) {
+		memcpy(data, mvpp2_priv_flags_strings,
+		       sizeof (mvpp2_priv_flags_strings));
+		return;
+	}
+
 	if (sset != ETH_SS_STATS)
 		return;
 
@@ -1521,6 +3778,15 @@
 			data += ETH_GSTRING_LEN;
 		}
 	}
+
+	for (q = 0; q < 16; q++) {
+		for (i = 0; i < ARRAY_SIZE(mvpp2_ethtool_bm_regs); i++) {
+			snprintf(data, ETH_GSTRING_LEN,
+				 mvpp2_ethtool_bm_regs[i].string,
+				 q);
+			data += ETH_GSTRING_LEN;
+		}
+	}
 }
 
 static void mvpp2_read_stats(struct mvpp2_port *port)
@@ -1552,14 +3818,57 @@
 			*pstats++ += mvpp2_read_index(port->priv,
 						      port->first_rxq + q,
 						      mvpp2_ethtool_rxq_regs[i].offset);
+
+	for (q = 0; q < 16; q++)
+		for (i = 0; i < ARRAY_SIZE(mvpp2_ethtool_bm_regs); i++)
+			*pstats++ += mvpp2_read(port->priv,
+						mvpp2_ethtool_bm_regs[i].offset +
+						4 * q);
 }
 
+static void mvpp2_start_dev(struct mvpp2_port *port);
+static void mvpp2_stop_dev(struct mvpp2_port *port);
+
 static void mvpp2_gather_hw_statistics(struct work_struct *work)
 {
 	struct delayed_work *del_work = to_delayed_work(work);
 	struct mvpp2_port *port = container_of(del_work, struct mvpp2_port,
 					       stats_work);
 
+	/*
+	 * work around for ONU module link failing to come backup
+	 * after the link goes down.
+	 */
+	if (!netif_carrier_ok(port->dev)) {
+		/*
+		 * port is down, we may need to reset the port hard to
+		 * get the ONU module to link back up properly.
+		 *
+		 * the mvpp2_link_status_isr() function will set
+		 * pending_10g_reset, and last_link_int_jiffies. The
+		 * later is to make sure we do not attempt to reset
+		 * the port hard during the interrupt storm (and
+		 * associated link flapping) that occurs when the ONU
+		 * drops the link
+		 */
+		if (port->pending_10g_reset &&
+		    time_after(jiffies,
+			       port->last_link_int_jiffies + HZ / 10)) {
+
+			port->pending_10g_reset = false;
+
+			rtnl_lock();
+			mvpp2_stop_dev(port);
+			mvpp2_start_dev(port);
+			rtnl_unlock();
+		}
+	} else
+		/*
+		 * port somehow came back up, clear pending status, if
+		 * it was set.
+		 */
+		port->pending_10g_reset = false;
+
 	mutex_lock(&port->gather_stats_lock);
 
 	mvpp2_read_stats(port);
@@ -1597,6 +3906,9 @@
 	if (sset == ETH_SS_STATS)
 		return MVPP2_N_ETHTOOL_STATS(port->ntxqs, port->nrxqs);
 
+	if (sset == ETH_SS_PRIV_FLAGS)
+		return ARRAY_SIZE(mvpp2_priv_flags_strings);
+
 	return -EOPNOTSUPP;
 }
 
@@ -1710,8 +4022,16 @@
 		    tx_port_num);
 	mvpp2_write(port->priv, MVPP2_TXP_SCHED_CMD_1_REG, 0);
 
-	/* Set TXQ scheduling to Round-Robin */
-	mvpp2_write(port->priv, MVPP2_TXP_SCHED_FIXED_PRIO_REG, 0);
+	/* setup fixed prio queue mask, rest are WRR */
+	mvpp2_write(port->priv, MVPP2_TXP_SCHED_FIXED_PRIO_REG,
+		    MVPP2_TX_FIXED_PRIO_QUEUES);
+
+	/* setup non zero WRR value for all ports (otherwise WRR seems
+	 * biased) */
+	for (queue = 0; queue < MVPP2_MAX_TXQ; queue++)
+		mvpp2_write(port->priv,
+			    MVPP2_TXQ_SCHED_BCOUNT_CFG_REG(queue),
+			    64);
 
 	/* Close bandwidth for all queues */
 	for (queue = 0; queue < MVPP2_MAX_TXQ; queue++)
@@ -1988,18 +4308,30 @@
 		desc_count += txq_pcpu_aux->reserved_num;
 	}
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	if (txq->log_id == MVPP2_FF_TXQ_ID) {
+		if (desc_count >= txq->size)
+			return -ENOMEM;
+
+		req = max(MVPP2_CPU_DESC_CHUNK, num - txq_pcpu->reserved_num);
+		if (req > txq->size - desc_count)
+			req = txq->size - desc_count;
+	} else
+#endif
+	{
 	req = max(MVPP2_CPU_DESC_CHUNK, num - txq_pcpu->reserved_num);
 	desc_count += req;
-
 	if (desc_count >
-	   (txq->size - (MVPP2_MAX_THREADS * MVPP2_CPU_DESC_CHUNK)))
+		    (txq->size - (num_present_cpus() * MVPP2_CPU_DESC_CHUNK)))
 		return -ENOMEM;
+	}
 
 	txq_pcpu->reserved_num += mvpp2_txq_alloc_reserved_desc(port, txq, req);
 
 	/* OK, the descriptor could have been updated: check again. */
 	if (txq_pcpu->reserved_num < num)
 		return -ENOMEM;
+
 	return 0;
 }
 
@@ -2237,6 +4569,16 @@
 		struct mvpp2_txq_pcpu_buf *tx_buf =
 			txq_pcpu->buffs + txq_pcpu->txq_get_index;
 
+#ifdef CONFIG_MVPP2_FBX_FF
+		if (tx_buf->is_rx_buf) {
+			mvpp2_bm_pool_put(port,
+					  tx_buf->pool,
+					  tx_buf->bm_dma,
+					  tx_buf->bm_phys);
+			mvpp2_txq_inc_get(txq_pcpu);
+			continue;
+		}
+#endif
 		if (!IS_TSO_HEADER(txq_pcpu, tx_buf->dma))
 			dma_unmap_single(port->dev->dev.parent, tx_buf->dma,
 					 tx_buf->size, DMA_TO_DEVICE);
@@ -2273,6 +4615,10 @@
 	if (txq_pcpu->thread != mvpp2_cpu_to_thread(port->priv, smp_processor_id()))
 		netdev_err(port->dev, "wrong cpu on the end of Tx processing\n");
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	WARN_ON(txq->log_id == MVPP2_FF_TXQ_ID);
+#endif
+
 	tx_done = mvpp2_txq_sent_desc_proc(port, txq);
 	if (!tx_done)
 		return;
@@ -2727,15 +5073,72 @@
 	return IRQ_HANDLED;
 }
 
+static void mvpp2_schedule_10g_port_reset(struct mvpp2_port *port,
+					 bool was_up)
+{
+	if (!port->linkdown_10g_wa_enable)
+		return ;
+
+	if (was_up &&
+	    port->gop_id == 0 &&
+	    port->phy_interface == PHY_INTERFACE_MODE_10GKR)
+		port->pending_10g_reset = true;
+}
+
+static void mvpp2_phylink_down(struct work_struct *work)
+{
+	struct delayed_work *del_work = to_delayed_work(work);
+	struct mvpp2_port *port = container_of(del_work, struct mvpp2_port,
+					       phylink_down_work);
+	bool was_up = netif_carrier_ok(port->dev);
+
+	phylink_mac_change(port->phylink, false);
+	mvpp2_schedule_10g_port_reset(port, was_up);
+}
+
+/*
+ * Some switches have random link crashing issues; reporting the port being
+ * down and up right away as not much impact except when STP is used (it can
+ * take up to a few ten seconds to be back in forwarding state). In order to
+ * workaround that when link status interrupt happens to notify a down link,
+ * the port is actually reset and the phylink status report is delayed by 50ms
+ * giving the link a chance to be up again in the meantime. This is a kind of
+ * debounce.
+ */
+static void mvpp2_phylink_debounce(struct mvpp2_port *port, bool link,
+				   bool was_up)
+{
+	bool ret;
+
+	if (!port->linkdown_debounce) {
+		phylink_mac_change(port->phylink, link);
+		if (!link)
+			mvpp2_schedule_10g_port_reset(port, was_up);
+	} else if (link) {
+		ret = cancel_delayed_work(&port->phylink_down_work);
+		if (ret) {
+			netdev_warn(port->dev,
+				"A link down event has been debounced\n");
+		}
+		phylink_mac_change(port->phylink, true);
+	} else {
+		queue_delayed_work(port->priv->phylink_down_queue,
+				   &port->phylink_down_work,
+				   msecs_to_jiffies(50));
+	}
+}
+
 /* Per-port interrupt for link status changes */
 static irqreturn_t mvpp2_link_status_isr(int irq, void *dev_id)
 {
 	struct mvpp2_port *port = (struct mvpp2_port *)dev_id;
 	struct net_device *dev = port->dev;
 	bool event = false, link = false;
+	bool was_up = netif_carrier_ok(dev);
 	u32 val;
 
 	mvpp22_gop_mask_irq(port);
+	port->last_link_int_jiffies = jiffies;
 
 	if (port->gop_id == 0 && mvpp2_is_xlg(port->phy_interface)) {
 		val = readl(port->base + MVPP22_XLG_INT_STAT);
@@ -2758,7 +5161,7 @@
 	}
 
 	if (port->phylink) {
-		phylink_mac_change(port->phylink, link);
+		mvpp2_phylink_debounce(port, link, was_up);
 		goto handled;
 	}
 
@@ -2779,6 +5182,8 @@
 		mvpp2_egress_disable(port);
 
 		mvpp2_interrupts_disable(port);
+
+		mvpp2_schedule_10g_port_reset(port, was_up);
 	}
 
 handled:
@@ -2871,6 +5276,61 @@
 	phys_addr_t phys_addr;
 	void *buf;
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	if (ff_enabled && pool == MVPP2_BM_LONG) {
+		struct mvpp2_port *opp_ports[2];
+		unsigned int i, count;
+		unsigned int thread = mvpp2_cpu_to_thread(port->priv,
+							  smp_processor_id());
+
+		/*
+		 * try to reclaim from opposite fast forward dedicated
+		 * tx queues
+		 */
+		count = ff_get_opposite_ports(port, opp_ports);
+		if (!count)
+			goto alloc;
+
+		for (i = 0; i < count; i++) {
+			struct mvpp2_port *opp_port = opp_ports[i];
+			struct mvpp2_tx_queue *txq;
+			struct mvpp2_txq_pcpu *txq_pcpu;
+			struct mvpp2_txq_pcpu_buf *tx_buf;
+
+
+			txq = opp_port->ff_txq;
+			if (WARN_ON(txq->log_id != MVPP2_FF_TXQ_ID))
+				continue;
+
+			txq_pcpu = per_cpu_ptr(txq->pcpu, thread);
+			if (!txq_pcpu->count)
+				continue;
+
+			if (!txq_pcpu->release_pending)
+				txq_pcpu->release_pending =
+					mvpp2_txq_sent_desc_proc(opp_port, txq);
+
+			if (!txq_pcpu->release_pending)
+				continue;
+
+			tx_buf = txq_pcpu->buffs + txq_pcpu->txq_get_index;
+			if (WARN_ON(!tx_buf->is_rx_buf))
+				continue;
+
+			mvpp2_bm_pool_put(port,
+					  tx_buf->pool,
+					  tx_buf->bm_dma,
+					  tx_buf->bm_phys);
+
+			txq_pcpu->release_pending--;
+			txq_pcpu->count--;
+			mvpp2_txq_inc_get(txq_pcpu);
+			return 0;
+		}
+	}
+alloc:
+#endif
+
 	/* No recycle or too many buffers are in use, so allocate a new skb */
 	buf = mvpp2_buf_alloc(port, bm_pool, &dma_addr, &phys_addr,
 			      GFP_ATOMIC);
@@ -2924,6 +5384,11 @@
 	u32 rcvd_pkts = 0;
 	u32 rcvd_bytes = 0;
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	unsigned int thread = mvpp2_cpu_to_thread(port->priv, smp_processor_id());
+	spin_lock(&ff_lock);
+#endif
+
 	/* Get number of received packets and clamp the to-do */
 	rx_received = mvpp2_rxq_received(port, rxq->id);
 	if (rx_todo > rx_received)
@@ -2966,6 +5431,19 @@
 			continue;
 		}
 
+#ifdef CONFIG_MVPP2_FBX_FF
+		if (ff_receive(thread,
+			       port,
+			       pool,
+			       rx_desc,
+			       data,
+			       MVPP2_MH_SIZE + NET_SKB_PAD, rx_bytes)) {
+			rcvd_pkts++;
+			rcvd_bytes += rx_bytes;
+			continue;
+		}
+#endif
+
 		if (bm_pool->frag_size > PAGE_SIZE)
 			frag_size = 0;
 		else
@@ -2997,6 +5475,10 @@
 		napi_gro_receive(napi, skb);
 	}
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	spin_unlock(&ff_lock);
+#endif
+
 	if (rcvd_pkts) {
 		struct mvpp2_pcpu_stats *stats = this_cpu_ptr(port->stats);
 
@@ -3214,6 +5696,10 @@
 
 	txq_id = skb_get_queue_mapping(skb);
 	txq = port->txqs[txq_id];
+#ifdef CONFIG_MVPP2_FBX_FF
+	WARN_ON(txq->log_id == MVPP2_FF_TXQ_ID);
+#endif
+
 	txq_pcpu = per_cpu_ptr(txq->pcpu, thread);
 	aggr_txq = &port->priv->aggr_txqs[thread];
 
@@ -3334,6 +5820,10 @@
 	struct mvpp2_queue_vector *qv;
 	unsigned int thread = mvpp2_cpu_to_thread(port->priv, smp_processor_id());
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	ff.jiffies = nfct_time_stamp;
+#endif
+
 	qv = container_of(napi, struct mvpp2_queue_vector, napi);
 
 	/* Rx/Tx cause register
@@ -3562,7 +6052,13 @@
 			irq_set_status_flags(qv->irq, IRQ_NO_BALANCING);
 		}
 
-		err = request_irq(qv->irq, mvpp2_isr, 0, port->dev->name, qv);
+		scnprintf(qv->request_name,
+			  sizeof (qv->request_name),
+			  "%s%s%s",
+			  port->dev->name,
+			  qv->irq_name[0] ? "-" : "",
+			  qv->irq_name);
+		err = request_irq(qv->irq, mvpp2_isr, 0, qv->request_name, qv);
 		if (err)
 			goto err;
 
@@ -3675,8 +6171,12 @@
 	}
 
 	if (priv->hw_version == MVPP22 && port->link_irq) {
+		scnprintf(port->link_irq_request_name,
+			  sizeof (port->link_irq_request_name),
+			  "%s-link",
+			  port->dev->name);
 		err = request_irq(port->link_irq, mvpp2_link_status_isr, 0,
-				  dev->name, port);
+				  port->link_irq_request_name, port);
 		if (err) {
 			netdev_err(port->dev, "cannot request link IRQ %d\n",
 				   port->link_irq);
@@ -3699,6 +6199,10 @@
 		goto err_free_irq;
 	}
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	port->ff_txq = port->txqs[MVPP2_FF_TXQ_ID];
+#endif
+
 	/* Unmask interrupts on all CPUs */
 	on_each_cpu(mvpp2_interrupts_unmask, port, 1);
 	mvpp2_shared_interrupt_mask_unmask(port, false);
@@ -3709,6 +6213,13 @@
 	queue_delayed_work(priv->stats_queue, &port->stats_work,
 			   MVPP2_MIB_COUNTERS_STATS_DELAY);
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	{
+		int ff_idx = (port->priv->id << 1) | port->index;
+		WARN_ON(ports_by_idx[ff_idx] != NULL);
+		ports_by_idx[ff_idx] = port;
+	}
+#endif
 	return 0;
 
 err_free_irq:
@@ -3726,6 +6237,13 @@
 	struct mvpp2_port_pcpu *port_pcpu;
 	unsigned int thread;
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	{
+		int ff_idx = (port->priv->id << 1) | port->index;
+		ports_by_idx[ff_idx] = NULL;
+	}
+#endif
+
 	mvpp2_stop_dev(port);
 
 	/* Mask interrupts on all threads */
@@ -3750,10 +6268,15 @@
 	mvpp2_cleanup_txqs(port);
 
 	cancel_delayed_work_sync(&port->stats_work);
+	cancel_delayed_work_sync(&port->phylink_down_work);
 
 	mvpp2_mac_reset_assert(port);
 	mvpp22_pcs_reset_assert(port);
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	port->ff_txq = NULL;
+#endif
+
 	return 0;
 }
 
@@ -3772,49 +6295,46 @@
 	return 0;
 }
 
-static void mvpp2_set_rx_promisc(struct mvpp2_port *port, bool enable)
+static void mvpp2_set_vlan_promisc(struct mvpp2_port *port, bool enable)
 {
 	if (!enable && (port->dev->features & NETIF_F_HW_VLAN_CTAG_FILTER))
 		mvpp2_prs_vid_enable_filtering(port);
 	else
 		mvpp2_prs_vid_disable_filtering(port);
-
-	mvpp2_prs_mac_promisc_set(port->priv, port->id,
-				  MVPP2_PRS_L2_UNI_CAST, enable);
-
-	mvpp2_prs_mac_promisc_set(port->priv, port->id,
-				  MVPP2_PRS_L2_MULTI_CAST, enable);
 }
 
 static void mvpp2_set_rx_mode(struct net_device *dev)
 {
 	struct mvpp2_port *port = netdev_priv(dev);
 
+	/* switch to promisc while we clear uc & mc list */
+	mvpp2_prs_mac_promisc_set(port->priv, port->id,
+				  MVPP2_PRS_L2_UNI_CAST, true);
+	mvpp2_prs_mac_promisc_set(port->priv, port->id,
+				  MVPP2_PRS_L2_MULTI_CAST, true);
+
 	/* Clear the whole UC and MC list */
 	mvpp2_prs_mac_del_all(port);
 
 	if (dev->flags & IFF_PROMISC) {
-		mvpp2_set_rx_promisc(port, true);
+		mvpp2_set_vlan_promisc(port, true);
 		return;
 	}
 
-	mvpp2_set_rx_promisc(port, false);
+	mvpp2_set_vlan_promisc(port, false);
 
-	if (netdev_uc_count(dev) > MVPP2_PRS_MAC_UC_FILT_MAX ||
-	    mvpp2_prs_mac_da_accept_list(port, &dev->uc))
+	if (netdev_uc_count(dev) <= MVPP2_PRS_MAC_UC_FILT_MAX &&
+	    !mvpp2_prs_mac_da_accept_list(port, &dev->uc))
 		mvpp2_prs_mac_promisc_set(port->priv, port->id,
-					  MVPP2_PRS_L2_UNI_CAST, true);
+					  MVPP2_PRS_L2_UNI_CAST, false);
 
-	if (dev->flags & IFF_ALLMULTI) {
-		mvpp2_prs_mac_promisc_set(port->priv, port->id,
-					  MVPP2_PRS_L2_MULTI_CAST, true);
+	if (dev->flags & IFF_ALLMULTI)
 		return;
-	}
 
-	if (netdev_mc_count(dev) > MVPP2_PRS_MAC_MC_FILT_MAX ||
-	    mvpp2_prs_mac_da_accept_list(port, &dev->mc))
+	if (netdev_mc_count(dev) <= MVPP2_PRS_MAC_MC_FILT_MAX &&
+	    !mvpp2_prs_mac_da_accept_list(port, &dev->mc))
 		mvpp2_prs_mac_promisc_set(port->priv, port->id,
-					  MVPP2_PRS_L2_MULTI_CAST, true);
+					  MVPP2_PRS_L2_MULTI_CAST, false);
 }
 
 static int mvpp2_set_mac_address(struct net_device *dev, void *p)
@@ -3903,9 +6423,11 @@
 
 		/* No port is using jumbo frames */
 		if (!jumbo) {
+#ifndef CONFIG_MVPP2_FBX_FF
 			dev_info(port->dev->dev.parent,
 				 "all ports have a low MTU, switching to per-cpu buffers");
 			mvpp2_bm_switch_buffers(priv, true);
+#endif
 		}
 	}
 
@@ -3964,10 +6486,40 @@
 	stats->tx_dropped	= dev->stats.tx_dropped;
 }
 
+static int mii_bus_read(struct net_device *dev, int mii_id, int regnum)
+{
+	struct mvpp2_port *port = netdev_priv(dev);
+
+	return port->mii_bus->read(port->mii_bus, mii_id, regnum);
+}
+
+static void mii_bus_write(struct net_device *dev, int mii_id, int regnum,
+			  int value)
+{
+	struct mvpp2_port *port = netdev_priv(dev);
+
+	port->mii_bus->write(port->mii_bus, mii_id, regnum, value);
+}
+
 static int mvpp2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
 	struct mvpp2_port *port = netdev_priv(dev);
 
+	if (cmd == SIOCGMIIREG || cmd == SIOCSMIIREG) {
+		struct mii_if_info mii;
+
+		if (!port->mii_bus)
+			return -ENOTSUPP;
+
+		mii.dev = dev;
+		mii.mdio_read = mii_bus_read;
+		mii.mdio_write = mii_bus_write;
+		mii.phy_id = 0;
+		mii.phy_id_mask = 0x3f;
+		mii.reg_num_mask = 0x1f;
+		return generic_mii_ioctl(&mii, if_mii(ifr), cmd, NULL);
+	}
+
 	if (!port->phylink)
 		return -ENOTSUPP;
 
@@ -4359,6 +6911,171 @@
 
 	return mvpp22_port_rss_ctx_indir_set(port, *rss_context, indir);
 }
+
+/*
+ * changes the phy interface mode of the interface to either
+ * 1000Base-X or 10000Base-X depending on what was requested via the
+ * ethetool private flags interface.
+ */
+static int maybe_switch_mode(struct net_device *dev, u32 flags)
+{
+	struct mvpp2_port *port = netdev_priv(dev);
+	int target_phy_mode;
+
+	/*
+	 * port must be 10G capable (i.e. gop port 0)
+	 */
+	if (port->gop_id != 0)
+		return -EINVAL;
+
+	/*
+	 * can't enable both 1G and 10G at the same time
+	 */
+	if ((flags & FBX_ALL_EN_MASK) == FBX_ALL_EN_MASK)
+		return -EINVAL;
+
+	/*
+	 * select proper target phy mode (or return early if non is
+	 * set yet).
+	 */
+	if (flags & (1 << FBX_10G_EN_BIT))
+		target_phy_mode = PHY_INTERFACE_MODE_10GKR;
+	else if (flags & (1 << FBX_1G_EN_BIT))
+		target_phy_mode = PHY_INTERFACE_MODE_1000BASEX;
+	else
+		return 0;
+
+	if (port->phy_interface == target_phy_mode)
+		return 0;
+
+	netdev_info(dev, "switching PHY interface mode from %s to %s\n", 
+		    phy_modes(port->phy_interface), phy_modes(target_phy_mode));
+
+	if (!netif_running(dev)) {
+		port->phy_interface = target_phy_mode;
+		return 0;
+	}
+
+	mvpp2_stop_dev(port);
+
+	port->phy_interface = target_phy_mode;
+	phylink_set_interface_mode(port->phylink, target_phy_mode);
+
+	if (port->link_irq)
+		/*
+		 * link interrupt configuration depends on port PHY
+		 * interface mode.
+		 */
+		mvpp22_gop_setup_irq(port);
+
+	mvpp2_start_dev(port);
+	mvpp2_egress_enable(port);
+	mvpp2_ingress_enable(port);
+
+	return 0;
+}
+
+static int mvpp2_ethtool_set_priv_flags(struct net_device *dev, u32 flags)
+{
+	struct mvpp2_port *port = netdev_priv(dev);
+
+	if (flags & (1 << FBX_CLEAR_MIB_BIT)) {
+		memset(port->ethtool_stats, 0,
+		       sizeof(u64) * MVPP2_N_ETHTOOL_STATS(port->ntxqs, port->nrxqs));
+		flags &= ~(1 << FBX_CLEAR_MIB_BIT);
+	}
+
+	if (!flags)
+		return 0;
+
+	if (port->gop_id != 0)
+		/*
+		 * only GOP port ID0 supports 10G speeds.
+		 */
+		return -ENOTSUPP;
+
+	port->linkdown_debounce = !!(flags & (1 << FBX_LINKDOWN_DEBOUNCE));
+
+	port->linkdown_10g_wa_enable =
+		!!(flags & (1 << FBX_EN_10G_LINKDOWN_WA));
+
+	if (flags & (1 << FBX_101G_SWITCH_EN_BIT))
+		/* set only */
+		port->en_fbx_10g1g_switch = true;
+
+	if (!port->en_fbx_10g1g_switch)
+		return 0;
+
+	return maybe_switch_mode(dev, flags);
+}
+
+static int mvpp2_get_port_sync_ok(struct net_device *dev)
+{
+	struct mvpp2_port *port = netdev_priv(dev);
+	struct mvpp2 *priv = port->priv;
+	u32 v;
+
+	if (!netif_running(dev))
+		return 0;
+
+
+	if (port->gop_id == 0 &&
+	    port->phy_interface == PHY_INTERFACE_MODE_10GKR) {
+		/*
+		 * on port0 in 10GKR mode, get sync ok from MPCS
+		 * gearbox register, field Lane Locked.
+		 */
+		void __iomem *mpcs = priv->iface_base +
+			MVPP22_MPCS_BASE(port->gop_id);
+
+		v = readl(mpcs + MVPP22_MPCS_GEARBOX_STATUS) &
+			MVPP22_MPCS_GEARBOX_STATUS_LANELOCK;
+	} else
+		/* otherwise default to GMAC SyncOk status.*/
+		v = readl(port->base + MVPP2_GMAC_STATUS0) &
+			MVPP2_GMAC_STATUS0_SYNC_OK;
+	return !!v;
+}
+
+static u32 mvpp2_ethtool_get_priv_flags(struct net_device *dev)
+{
+	struct mvpp2_port *port = netdev_priv(dev);
+	u32 ret = 0;
+
+
+	ret |= (!!port->en_fbx_10g1g_switch << FBX_101G_SWITCH_EN_BIT);
+	if (ret) {
+		switch (port->phy_interface) {
+		case PHY_INTERFACE_MODE_1000BASEX:
+			ret |= (1 << FBX_1G_ST_BIT);
+			break;
+		case PHY_INTERFACE_MODE_10GKR:
+			ret |= (1 << FBX_10G_ST_BIT);
+			break;
+		default:
+			break;
+		}
+	}
+
+	ret |= mvpp2_get_port_sync_ok(dev) << FBX_SYNC_OK_BIT;
+	ret |= (port->linkdown_10g_wa_enable ? 1 : 0) << FBX_EN_10G_LINKDOWN_WA;
+	ret |= (port->linkdown_debounce ? 1 : 0) << FBX_LINKDOWN_DEBOUNCE;
+
+	return ret;
+}
+
+/*
+ * netdevice ->ndo_select_queue() callback
+ */
+static u16 mvpp2_select_queue(struct net_device *dev,
+			      struct sk_buff *skb,
+			      struct net_device *skb_dev)
+{
+	if (skb->priority >= TC_PRIO_INTERACTIVE)
+		return MVPP2_USABLE_TX_QUEUES - 1;
+	return 0;
+}
+
 /* Device ops */
 
 static const struct net_device_ops mvpp2_netdev_ops = {
@@ -4373,6 +7090,7 @@
 	.ndo_vlan_rx_add_vid	= mvpp2_vlan_rx_add_vid,
 	.ndo_vlan_rx_kill_vid	= mvpp2_vlan_rx_kill_vid,
 	.ndo_set_features	= mvpp2_set_features,
+	.ndo_select_queue	= mvpp2_select_queue,
 };
 
 static const struct ethtool_ops mvpp2_eth_tool_ops = {
@@ -4397,6 +7115,8 @@
 	.set_rxfh		= mvpp2_ethtool_set_rxfh,
 	.get_rxfh_context	= mvpp2_ethtool_get_rxfh_context,
 	.set_rxfh_context	= mvpp2_ethtool_set_rxfh_context,
+	.set_priv_flags		= mvpp2_ethtool_set_priv_flags,
+	.get_priv_flags		= mvpp2_ethtool_get_priv_flags,
 };
 
 /* Used for PPv2.1, or PPv2.2 with the old Device Tree binding that
@@ -4413,6 +7133,7 @@
 	v->sw_thread_id = 0;
 	v->sw_thread_mask = *cpumask_bits(cpu_online_mask);
 	v->port = port;
+	v->irq_name[0] = 0;
 	v->irq = irq_of_parse_and_map(port_node, 0);
 	if (v->irq <= 0)
 		return -EINVAL;
@@ -4476,6 +7197,7 @@
 			ret = -EINVAL;
 			goto err;
 		}
+		strlcpy(v->irq_name, irqname, sizeof (v->irq_name));
 
 		netif_napi_add(port->dev, &v->napi, mvpp2_poll,
 			       NAPI_POLL_WEIGHT);
@@ -5192,7 +7914,7 @@
 /* Ports initialization */
 static int mvpp2_port_probe(struct platform_device *pdev,
 			    struct fwnode_handle *port_fwnode,
-			    struct mvpp2 *priv)
+			    struct mvpp2 *priv, int index)
 {
 	struct phy *comphy = NULL;
 	struct mvpp2_port *port;
@@ -5208,6 +7930,7 @@
 	u32 id;
 	int phy_mode;
 	int err, i;
+	struct device_node *mdio_node;
 
 	has_tx_irqs = mvpp2_port_has_irqs(priv, port_node, &flags);
 	if (!has_tx_irqs && queue_mode == MVPP2_QDIST_MULTI_MODE) {
@@ -5262,6 +7985,15 @@
 	port->has_tx_irqs = has_tx_irqs;
 	port->flags = flags;
 
+	mdio_node = of_parse_phandle(port_node, "mdio-bus", 0);
+	if (mdio_node) {
+		port->mii_bus = of_mdio_find_bus(mdio_node);
+		if (!port->mii_bus) {
+			err = -EPROBE_DEFER;
+			goto err_free_netdev;
+		}
+	}
+
 	err = mvpp2_queue_vectors_init(port, port_node);
 	if (err)
 		goto err_free_netdev;
@@ -5333,11 +8065,15 @@
 	mutex_init(&port->gather_stats_lock);
 	INIT_DELAYED_WORK(&port->stats_work, mvpp2_gather_hw_statistics);
 
+	INIT_DELAYED_WORK(&port->phylink_down_work, mvpp2_phylink_down);
+
 	mvpp2_port_copy_mac_addr(dev, priv, port_fwnode, &mac_from);
 
 	port->tx_ring_size = MVPP2_MAX_TXD_DFLT;
 	port->rx_ring_size = MVPP2_MAX_RXD_DFLT;
 	SET_NETDEV_DEV(dev, &pdev->dev);
+	port->index = index;
+	dev->dev_port = index;
 
 	err = mvpp2_port_init(port);
 	if (err < 0) {
@@ -5417,6 +8153,11 @@
 
 	priv->port_list[priv->port_count++] = port;
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	port->ff_notifier.notifier_call = ff_device_event;
+	register_netdevice_notifier(&port->ff_notifier);
+#endif
+
 	return 0;
 
 err_phylink:
@@ -5444,6 +8185,10 @@
 {
 	int i;
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	unregister_netdevice_notifier(&port->ff_notifier);
+#endif
+
 	unregister_netdev(port->dev);
 	if (port->phylink)
 		phylink_destroy(port->phylink);
@@ -5698,6 +8443,10 @@
 	int i, shared;
 	int err;
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	ff_init(&pdev->dev);
+#endif
+
 	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
 		return -ENOMEM;
@@ -5745,6 +8494,19 @@
 			return PTR_ERR(priv->iface_base);
 	}
 
+#ifdef CONFIG_MVPP2_FBX_FF
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (res->start == 0xf2000000) {
+		priv->id = 0;
+	} else if (res->start == 0xf4000000) {
+		priv->id = 1;
+	} else {
+		WARN(1, "unknown mvpp2 unit for fastpath: %llx\n",
+		     res->start);
+	}
+#endif
+
+
 	if (priv->hw_version == MVPP22 && dev_of_node(&pdev->dev)) {
 		priv->sysctrl_base =
 			syscon_regmap_lookup_by_phandle(pdev->dev.of_node,
@@ -5759,8 +8521,11 @@
 	}
 
 	if (priv->hw_version == MVPP22 &&
-	    mvpp2_get_nrxqs(priv) * 2 <= MVPP2_BM_MAX_POOLS)
+	    mvpp2_get_nrxqs(priv) * 2 <= MVPP2_BM_MAX_POOLS) {
+#ifndef CONFIG_MVPP2_FBX_FF
 		priv->percpu_pools = 1;
+#endif
+	}
 
 	mvpp2_setup_bm_pool();
 
@@ -5866,10 +8631,12 @@
 	}
 
 	/* Initialize ports */
+	i = 0;
 	fwnode_for_each_available_child_node(fwnode, port_fwnode) {
-		err = mvpp2_port_probe(pdev, port_fwnode, priv);
+		err = mvpp2_port_probe(pdev, port_fwnode, priv, i);
 		if (err < 0)
 			goto err_port_probe;
+		++i;
 	}
 
 	if (priv->port_count == 0) {
@@ -5893,11 +8660,24 @@
 		goto err_port_probe;
 	}
 
+	snprintf(priv->phylink_queue_name, sizeof(priv->phylink_queue_name),
+		 "phylink-wq-%s%s", netdev_name(priv->port_list[0]->dev),
+		 priv->port_count > 1 ? "+" : "");
+	priv->phylink_down_queue =
+		create_singlethread_workqueue(priv->phylink_queue_name);
+	if (!priv->phylink_down_queue) {
+		err = -ENOMEM;
+		goto err_phylink_wq;
+	}
+
+
 	mvpp2_dbgfs_init(priv, pdev->name);
 
 	platform_set_drvdata(pdev, priv);
 	return 0;
 
+err_phylink_wq:
+	destroy_workqueue(priv->stats_queue);
 err_port_probe:
 	i = 0;
 	fwnode_for_each_available_child_node(fwnode, port_fwnode) {
@@ -5939,6 +8719,7 @@
 	}
 
 	destroy_workqueue(priv->stats_queue);
+	destroy_workqueue(priv->phylink_down_queue);
 
 	if (priv->percpu_pools)
 		poolnum = mvpp2_get_nrxqs(priv) * 2;
diff -ruw linux-5.4.60/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c linux-5.4.60-fbx/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
--- linux-5.4.60/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c	2021-03-04 13:20:59.164172284 +0100
@@ -1283,32 +1283,6 @@
 	struct mvpp2_prs_entry pe;
 	int tid;
 
-	/* Ethertype: PPPoE */
-	tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
-					MVPP2_PE_LAST_FREE_TID);
-	if (tid < 0)
-		return tid;
-
-	memset(&pe, 0, sizeof(pe));
-	mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_L2);
-	pe.index = tid;
-
-	mvpp2_prs_match_etype(&pe, 0, ETH_P_PPP_SES);
-
-	mvpp2_prs_sram_shift_set(&pe, MVPP2_PPPOE_HDR_SIZE,
-				 MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD);
-	mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_PPPOE);
-	mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_PPPOE_MASK,
-				 MVPP2_PRS_RI_PPPOE_MASK);
-
-	/* Update shadow table and hw entry */
-	mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_L2);
-	priv->prs_shadow[pe.index].udf = MVPP2_PRS_UDF_L2_DEF;
-	priv->prs_shadow[pe.index].finish = false;
-	mvpp2_prs_shadow_ri_set(priv, pe.index, MVPP2_PRS_RI_PPPOE_MASK,
-				MVPP2_PRS_RI_PPPOE_MASK);
-	mvpp2_prs_hw_write(priv, &pe);
-
 	/* Ethertype: ARP */
 	tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
 					MVPP2_PE_LAST_FREE_TID);
@@ -1576,117 +1550,6 @@
 	return 0;
 }
 
-/* Set entries for PPPoE ethertype */
-static int mvpp2_prs_pppoe_init(struct mvpp2 *priv)
-{
-	struct mvpp2_prs_entry pe;
-	int tid;
-
-	/* IPv4 over PPPoE with options */
-	tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
-					MVPP2_PE_LAST_FREE_TID);
-	if (tid < 0)
-		return tid;
-
-	memset(&pe, 0, sizeof(pe));
-	mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_PPPOE);
-	pe.index = tid;
-
-	mvpp2_prs_match_etype(&pe, 0, PPP_IP);
-
-	mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP4);
-	mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP4_OPT,
-				 MVPP2_PRS_RI_L3_PROTO_MASK);
-	/* Skip eth_type + 4 bytes of IP header */
-	mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 4,
-				 MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD);
-	/* Set L3 offset */
-	mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3,
-				  MVPP2_ETH_TYPE_LEN,
-				  MVPP2_PRS_SRAM_OP_SEL_UDF_ADD);
-
-	/* Update shadow table and hw entry */
-	mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_PPPOE);
-	mvpp2_prs_hw_write(priv, &pe);
-
-	/* IPv4 over PPPoE without options */
-	tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
-					MVPP2_PE_LAST_FREE_TID);
-	if (tid < 0)
-		return tid;
-
-	pe.index = tid;
-
-	mvpp2_prs_tcam_data_byte_set(&pe, MVPP2_ETH_TYPE_LEN,
-				     MVPP2_PRS_IPV4_HEAD | MVPP2_PRS_IPV4_IHL,
-				     MVPP2_PRS_IPV4_HEAD_MASK |
-				     MVPP2_PRS_IPV4_IHL_MASK);
-
-	/* Clear ri before updating */
-	pe.sram[MVPP2_PRS_SRAM_RI_WORD] = 0x0;
-	pe.sram[MVPP2_PRS_SRAM_RI_CTRL_WORD] = 0x0;
-	mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP4,
-				 MVPP2_PRS_RI_L3_PROTO_MASK);
-
-	/* Update shadow table and hw entry */
-	mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_PPPOE);
-	mvpp2_prs_hw_write(priv, &pe);
-
-	/* IPv6 over PPPoE */
-	tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
-					MVPP2_PE_LAST_FREE_TID);
-	if (tid < 0)
-		return tid;
-
-	memset(&pe, 0, sizeof(pe));
-	mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_PPPOE);
-	pe.index = tid;
-
-	mvpp2_prs_match_etype(&pe, 0, PPP_IPV6);
-
-	mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP6);
-	mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP6,
-				 MVPP2_PRS_RI_L3_PROTO_MASK);
-	/* Skip eth_type + 4 bytes of IPv6 header */
-	mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 4,
-				 MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD);
-	/* Set L3 offset */
-	mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3,
-				  MVPP2_ETH_TYPE_LEN,
-				  MVPP2_PRS_SRAM_OP_SEL_UDF_ADD);
-
-	/* Update shadow table and hw entry */
-	mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_PPPOE);
-	mvpp2_prs_hw_write(priv, &pe);
-
-	/* Non-IP over PPPoE */
-	tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
-					MVPP2_PE_LAST_FREE_TID);
-	if (tid < 0)
-		return tid;
-
-	memset(&pe, 0, sizeof(pe));
-	mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_PPPOE);
-	pe.index = tid;
-
-	mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_UN,
-				 MVPP2_PRS_RI_L3_PROTO_MASK);
-
-	/* Finished: go to flowid generation */
-	mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_FLOWS);
-	mvpp2_prs_sram_bits_set(&pe, MVPP2_PRS_SRAM_LU_GEN_BIT, 1);
-	/* Set L3 offset even if it's unknown L3 */
-	mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3,
-				  MVPP2_ETH_TYPE_LEN,
-				  MVPP2_PRS_SRAM_OP_SEL_UDF_ADD);
-
-	/* Update shadow table and hw entry */
-	mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_PPPOE);
-	mvpp2_prs_hw_write(priv, &pe);
-
-	return 0;
-}
-
 /* Initialize entries for IPv4 */
 static int mvpp2_prs_ip4_init(struct mvpp2 *priv)
 {
@@ -2144,10 +2007,6 @@
 	if (err)
 		return err;
 
-	err = mvpp2_prs_pppoe_init(priv);
-	if (err)
-		return err;
-
 	err = mvpp2_prs_ip6_init(priv);
 	if (err)
 		return err;
diff -ruw linux-5.4.60/drivers/net/phy/mdio_bus.c linux-5.4.60-fbx/drivers/net/phy/mdio_bus.c
--- linux-5.4.60/drivers/net/phy/mdio_bus.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/phy/mdio_bus.c	2021-03-04 13:20:59.290838956 +0100
@@ -404,8 +404,16 @@
 		bus->reset_gpiod = gpiod;
 
 		gpiod_set_value_cansleep(gpiod, 1);
+		if (bus->reset_delay_us < 1000)
 		udelay(bus->reset_delay_us);
+		else
+			mdelay(bus->reset_delay_us / 1000);
+
 		gpiod_set_value_cansleep(gpiod, 0);
+		if (bus->reset_delay_us < 1000)
+			udelay(bus->reset_delay_us);
+		else
+			mdelay(bus->reset_delay_us / 1000);
 	}
 
 	if (bus->reset)
diff -ruw linux-5.4.60/drivers/net/phy/phy.c linux-5.4.60-fbx/drivers/net/phy/phy.c
--- linux-5.4.60/drivers/net/phy/phy.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/phy/phy.c	2021-03-04 13:20:59.290838956 +0100
@@ -29,7 +29,7 @@
 #include <linux/uaccess.h>
 #include <linux/atomic.h>
 
-#define PHY_STATE_TIME	HZ
+#define PHY_STATE_TIME	(HZ / 2)
 
 #define PHY_STATE_STR(_state)			\
 	case PHY_##_state:			\
diff -ruw linux-5.4.60/drivers/net/phy/phy-core.c linux-5.4.60-fbx/drivers/net/phy/phy-core.c
--- linux-5.4.60/drivers/net/phy/phy-core.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/phy/phy-core.c	2021-03-04 13:20:59.290838956 +0100
@@ -8,7 +8,7 @@
 
 const char *phy_speed_to_str(int speed)
 {
-	BUILD_BUG_ON_MSG(__ETHTOOL_LINK_MODE_MASK_NBITS != 69,
+	BUILD_BUG_ON_MSG(__ETHTOOL_LINK_MODE_MASK_NBITS != 75,
 		"Enum ethtool_link_mode_bit_indices and phylib are out of sync. "
 		"If a speed or mode has been added please update phy_speed_to_str "
 		"and the PHY settings array.\n");
@@ -113,6 +113,10 @@
 	PHY_SETTING(  20000, FULL,  20000baseKR2_Full		),
 	PHY_SETTING(  20000, FULL,  20000baseMLD2_Full		),
 	/* 10G */
+	PHY_SETTING(  10000, FULL,  10000_1000basePRX_D_Full	),
+	PHY_SETTING(  10000, FULL,  10000_1000basePRX_U_Full	),
+	PHY_SETTING(  10000, FULL,  10000basePR_D_Full		),
+	PHY_SETTING(  10000, FULL,  10000basePR_U_Full		),
 	PHY_SETTING(  10000, FULL,  10000baseCR_Full		),
 	PHY_SETTING(  10000, FULL,  10000baseER_Full		),
 	PHY_SETTING(  10000, FULL,  10000baseKR_Full		),
@@ -128,6 +132,8 @@
 	PHY_SETTING(   2500, FULL,   2500baseT_Full		),
 	PHY_SETTING(   2500, FULL,   2500baseX_Full		),
 	/* 1G */
+	PHY_SETTING(   1000, FULL,   1000basePX_D_Full		),
+	PHY_SETTING(   1000, FULL,   1000basePX_U_Full		),
 	PHY_SETTING(   1000, FULL,   1000baseKX_Full		),
 	PHY_SETTING(   1000, FULL,   1000baseT_Full		),
 	PHY_SETTING(   1000, HALF,   1000baseT_Half		),
diff -ruw linux-5.4.60/drivers/net/phy/phy_device.c linux-5.4.60-fbx/drivers/net/phy/phy_device.c
--- linux-5.4.60/drivers/net/phy/phy_device.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/phy/phy_device.c	2021-03-04 13:20:59.290838956 +0100
@@ -1767,7 +1767,7 @@
 	 * drops can be detected. Do not double-read the status
 	 * in polling mode to detect such short link drops.
 	 */
-	if (!phy_polling_mode(phydev)) {
+	if (!phy_polling_mode(phydev) || !phydev->link) {
 		status = phy_read(phydev, MII_BMSR);
 		if (status < 0)
 			return status;
diff -ruw linux-5.4.60/drivers/net/phy/phylink.c linux-5.4.60-fbx/drivers/net/phy/phylink.c
--- linux-5.4.60/drivers/net/phy/phylink.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/phy/phylink.c	2021-03-04 13:20:59.290838956 +0100
@@ -311,6 +311,25 @@
 			phylink_set(pl->supported, 10000baseER_Full);
 			break;
 
+		case PHY_INTERFACE_MODE_1000BASEPX_D:
+			phylink_set(pl->supported, 1000basePX_D_Full);
+			break;
+		case PHY_INTERFACE_MODE_1000BASEPX_U:
+			phylink_set(pl->supported, 1000basePX_U_Full);
+			break;
+		case PHY_INTERFACE_MODE_10000BASEPR_D:
+			phylink_set(pl->supported, 10000basePR_D_Full);
+			break;
+		case PHY_INTERFACE_MODE_10000BASEPR_U:
+			phylink_set(pl->supported, 10000basePR_U_Full);
+			break;
+		case PHY_INTERFACE_MODE_10000_1000_BASEPRX_D:
+			phylink_set(pl->supported, 10000_1000basePRX_D_Full);
+			break;
+		case PHY_INTERFACE_MODE_10000_1000_BASEPRX_U:
+			phylink_set(pl->supported, 10000_1000basePRX_U_Full);
+			break;
+
 		default:
 			phylink_err(pl,
 				    "incorrect link mode %s for in-band status\n",
@@ -1853,4 +1872,34 @@
 }
 EXPORT_SYMBOL_GPL(phylink_helper_basex_speed);
 
+int phylink_set_interface_mode(struct phylink *pl, int mode)
+{
+	int err;
+
+	pl->link_config.interface = mode;
+	err = phylink_validate(pl, pl->supported, &pl->link_config);
+	if (err)
+		pr_err("unable to validate phylink new interface mode.\n");
+
+	return err;
+
+}
+EXPORT_SYMBOL_GPL(phylink_set_interface_mode);
+
+void phylink_revalidate(struct phylink *pl)
+{
+	linkmode_zero(pl->supported);
+	phylink_set(pl->supported, MII);
+	phylink_set(pl->supported, Autoneg);
+	phylink_set(pl->supported, Asym_Pause);
+	phylink_set(pl->supported, Pause);
+	pl->link_config.an_enabled = true;
+	pl->link_an_mode = MLO_AN_INBAND;
+	pl->link_interface = PHY_INTERFACE_MODE_NA;
+	linkmode_copy(pl->link_config.advertising, pl->supported);
+	phylink_validate(pl, pl->supported, &pl->link_config);
+
+}
+EXPORT_SYMBOL_GPL(phylink_revalidate);
+
 MODULE_LICENSE("GPL v2");
diff -ruw linux-5.4.60/drivers/net/phy/sfp-bus.c linux-5.4.60-fbx/drivers/net/phy/sfp-bus.c
--- linux-5.4.60/drivers/net/phy/sfp-bus.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/phy/sfp-bus.c	2021-03-04 13:20:59.294172289 +0100
@@ -479,6 +479,15 @@
 }
 EXPORT_SYMBOL_GPL(sfp_get_module_eeprom);
 
+/*
+ * sfp_get_sfp_state
+ */
+int sfp_get_sfp_state(struct sfp_bus *bus, struct ethtool_sfp_state *st)
+{
+	return bus->socket_ops->get_sfp_state(bus->sfp, st);
+}
+EXPORT_SYMBOL_GPL(sfp_get_sfp_state);
+
 /**
  * sfp_upstream_start() - Inform the SFP that the network device is up
  * @bus: a pointer to the &struct sfp_bus structure for the sfp module
diff -ruw linux-5.4.60/drivers/net/phy/sfp.c linux-5.4.60-fbx/drivers/net/phy/sfp.c
--- linux-5.4.60/drivers/net/phy/sfp.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/phy/sfp.c	2021-03-04 13:20:59.294172289 +0100
@@ -26,6 +26,7 @@
 	GPIO_TX_FAULT,
 	GPIO_TX_DISABLE,
 	GPIO_RATE_SELECT,
+	GPIO_POWER_ENABLE,
 	GPIO_MAX,
 
 	SFP_F_PRESENT = BIT(GPIO_MODDEF0),
@@ -33,6 +34,7 @@
 	SFP_F_TX_FAULT = BIT(GPIO_TX_FAULT),
 	SFP_F_TX_DISABLE = BIT(GPIO_TX_DISABLE),
 	SFP_F_RATE_SELECT = BIT(GPIO_RATE_SELECT),
+	SFP_F_POWER_ENABLE = BIT(GPIO_POWER_ENABLE),
 
 	SFP_E_INSERT = 0,
 	SFP_E_REMOVE,
@@ -131,6 +133,7 @@
 	"tx-fault",
 	"tx-disable",
 	"rate-select0",
+	"pwr-enable",
 };
 
 static const enum gpiod_flags gpio_flags[] = {
@@ -139,6 +142,7 @@
 	GPIOD_IN,
 	GPIOD_ASIS,
 	GPIOD_ASIS,
+	GPIOD_ASIS,
 };
 
 #define T_INIT_JIFFIES	msecs_to_jiffies(300)
@@ -178,6 +182,7 @@
 	struct phy_device *mod_phy;
 	const struct sff_data *type;
 	u32 max_power_mW;
+	bool force_1000baset_as_1000basex;
 
 	unsigned int (*get_state)(struct sfp *);
 	void (*set_state)(struct sfp *, unsigned int);
@@ -226,7 +231,7 @@
 
 static const struct sff_data sfp_data = {
 	.gpios = SFP_F_PRESENT | SFP_F_LOS | SFP_F_TX_FAULT |
-		 SFP_F_TX_DISABLE | SFP_F_RATE_SELECT,
+		 SFP_F_TX_DISABLE | SFP_F_RATE_SELECT | SFP_F_POWER_ENABLE,
 	.module_supported = sfp_module_supported,
 };
 
@@ -264,6 +269,8 @@
 {
 	if (state & SFP_F_PRESENT) {
 		/* If the module is present, drive the signals */
+		if (sfp->gpio[GPIO_POWER_ENABLE])
+			gpiod_direction_output(sfp->gpio[GPIO_POWER_ENABLE], 1);
 		if (sfp->gpio[GPIO_TX_DISABLE])
 			gpiod_direction_output(sfp->gpio[GPIO_TX_DISABLE],
 					       state & SFP_F_TX_DISABLE);
@@ -272,6 +279,8 @@
 					       state & SFP_F_RATE_SELECT);
 	} else {
 		/* Otherwise, let them float to the pull-ups */
+		if (sfp->gpio[GPIO_POWER_ENABLE])
+			gpiod_direction_output(sfp->gpio[GPIO_POWER_ENABLE], 0);
 		if (sfp->gpio[GPIO_TX_DISABLE])
 			gpiod_direction_input(sfp->gpio[GPIO_TX_DISABLE]);
 		if (state & SFP_F_RATE_SELECT)
@@ -1495,6 +1504,11 @@
 		}
 	}
 
+	if (sfp->force_1000baset_as_1000basex && id.base.e1000_base_t) {
+		id.base.e1000_base_t = 0;
+		id.base.e1000_base_sx = 1;
+	}
+
 	sfp->id = id;
 
 	dev_info(sfp->dev, "module %.*s %.*s rev %.*s sn %.*s dc %.*s\n",
@@ -1763,6 +1777,47 @@
 	return 0;
 }
 
+static inline u32 to_ethtool_sfp_state(int my_state)
+{
+	switch (my_state) {
+	case SFP_S_DOWN:
+		return ETHTOOL_SFP_S_DOWN;
+	case SFP_S_INIT:
+		return ETHTOOL_SFP_S_INIT;
+	case SFP_S_WAIT_LOS:
+		return ETHTOOL_SFP_S_WAIT_LOS;
+	case SFP_S_LINK_UP:
+		return ETHTOOL_SFP_S_LINK_UP;
+	case SFP_S_TX_FAULT:
+		return ETHTOOL_SFP_S_TX_FAULT;
+	case SFP_S_REINIT:
+		return ETHTOOL_SFP_S_REINIT;
+	case SFP_S_TX_DISABLE:
+		return ETHTOOL_SFP_S_TX_DISABLE;
+	default:
+		return 0xffffffff;
+	}
+}
+
+static int sfp_state(struct sfp *sfp, struct ethtool_sfp_state *st)
+{
+	memset(st, 0, sizeof (*st));
+
+	st->fsm_state = to_ethtool_sfp_state(sfp->sm_state);
+
+	st->i_presence = !(sfp->state & SFP_F_PRESENT);
+	st->i_rxlos = !!(sfp->state & SFP_F_LOS);
+	st->i_txfault = !!(sfp->state & SFP_F_TX_FAULT);
+
+	/*
+	 * pwren is unconditionally driven whenever an SFP is present.
+	 */
+	st->o_pwren = (sfp->state & SFP_F_PRESENT);
+	st->o_txdis = !!(sfp->state & SFP_F_TX_DISABLE);
+
+	return 0;
+}
+
 static const struct sfp_socket_ops sfp_module_ops = {
 	.attach = sfp_attach,
 	.detach = sfp_detach,
@@ -1770,6 +1825,7 @@
 	.stop = sfp_stop,
 	.module_info = sfp_module_info,
 	.module_eeprom = sfp_module_eeprom,
+	.get_sfp_state = sfp_state,
 };
 
 static void sfp_timeout(struct work_struct *work)
@@ -1954,6 +2010,9 @@
 	dev_info(sfp->dev, "Host maximum power %u.%uW\n",
 		 sfp->max_power_mW / 1000, (sfp->max_power_mW / 100) % 10);
 
+	sfp->force_1000baset_as_1000basex =
+		device_property_present(&pdev->dev, "force-1000baset-as-1000basex");
+
 	/* Get the initial state, and always signal TX disable,
 	 * since the network interface will not be up.
 	 */
diff -ruw linux-5.4.60/drivers/net/phy/sfp.h linux-5.4.60-fbx/drivers/net/phy/sfp.h
--- linux-5.4.60/drivers/net/phy/sfp.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/phy/sfp.h	2021-03-04 13:20:59.294172289 +0100
@@ -14,6 +14,7 @@
 	int (*module_info)(struct sfp *sfp, struct ethtool_modinfo *modinfo);
 	int (*module_eeprom)(struct sfp *sfp, struct ethtool_eeprom *ee,
 			     u8 *data);
+	int (*get_sfp_state)(struct sfp *sfp, struct ethtool_sfp_state *st);
 };
 
 int sfp_add_phy(struct sfp_bus *bus, struct phy_device *phydev);
diff -ruw linux-5.4.60/drivers/net/phy/swphy.c linux-5.4.60-fbx/drivers/net/phy/swphy.c
--- linux-5.4.60/drivers/net/phy/swphy.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/phy/swphy.c	2021-03-04 13:20:59.294172289 +0100
@@ -29,6 +29,7 @@
 	SWMII_SPEED_10 = 0,
 	SWMII_SPEED_100,
 	SWMII_SPEED_1000,
+	SWMII_SPEED_2500,
 	SWMII_DUPLEX_HALF = 0,
 	SWMII_DUPLEX_FULL,
 };
@@ -51,6 +52,10 @@
 		.lpagb = LPA_1000FULL | LPA_1000HALF,
 		.estat = ESTATUS_1000_TFULL | ESTATUS_1000_THALF,
 	},
+	[SWMII_SPEED_2500] = {
+		.bmsr  = BMSR_ESTATEN,
+		.lpagb = LPA_1000FULL | LPA_1000HALF,
+	},
 };
 
 static const struct swmii_regs duplex[] = {
@@ -71,6 +76,8 @@
 static int swphy_decode_speed(int speed)
 {
 	switch (speed) {
+	case 2500:
+		return SWMII_SPEED_2500;
 	case 1000:
 		return SWMII_SPEED_1000;
 	case 100:
diff -ruw linux-5.4.60/drivers/net/ppp/ppp_generic.c linux-5.4.60-fbx/drivers/net/ppp/ppp_generic.c
--- linux-5.4.60/drivers/net/ppp/ppp_generic.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/ppp/ppp_generic.c	2021-03-04 13:20:59.294172289 +0100
@@ -174,6 +174,7 @@
 	struct ppp	*ppp;		/* ppp unit we're connected to */
 	struct net	*chan_net;	/* the net channel belongs to */
 	struct list_head clist;		/* link in list of channels per unit */
+	int		stopped;	/* channel is stopped */
 	rwlock_t	upl;		/* protects `ppp' */
 #ifdef CONFIG_PPP_MULTILINK
 	u8		avail;		/* flag used in multilink stuff */
@@ -1409,10 +1410,28 @@
 			ppp_send_frame(ppp, skb);
 		/* If there's no work left to do, tell the core net
 		   code that we can accept some more. */
-		if (!ppp->xmit_pending && !skb_peek(&ppp->file.xq))
+		if (!ppp->xmit_pending && !skb_peek(&ppp->file.xq)) {
+			/* only  enable  net  queue  if at  least  one
+			 * channel is not stopped */
+			struct list_head *list;
+			struct channel *pch;
+			bool need_wake;
+
+			list = &ppp->channels;
+			need_wake = false;
+			while ((list = list->next) != &ppp->channels) {
+				pch = list_entry(list, struct channel, clist);
+				if (!pch->stopped) {
+					need_wake = true;
+					break;
+				}
+			}
+
+			if (need_wake)
 			netif_wake_queue(ppp->dev);
 		else
 			netif_stop_queue(ppp->dev);
+		}
 	} else {
 		kfree_skb(skb);
 	}
@@ -2725,10 +2744,24 @@
 
 	if (!pch)
 		return;
+	pch->stopped = 0;
 	ppp_channel_push(pch);
 }
 
 /*
+ * Callback from a channel when it want to prevent further transmit on it
+ */
+void
+ppp_output_stop(struct ppp_channel *chan)
+{
+	struct channel *pch = chan->ppp;
+
+	if (pch == 0)
+		return;
+	pch->stopped = 1;
+}
+
+/*
  * Compression control.
  */
 
@@ -3325,6 +3358,7 @@
 EXPORT_SYMBOL(ppp_input);
 EXPORT_SYMBOL(ppp_input_error);
 EXPORT_SYMBOL(ppp_output_wakeup);
+EXPORT_SYMBOL(ppp_output_stop);
 EXPORT_SYMBOL(ppp_register_compressor);
 EXPORT_SYMBOL(ppp_unregister_compressor);
 MODULE_LICENSE("GPL");
diff -ruw linux-5.4.60/drivers/net/ppp/pptp.c linux-5.4.60-fbx/drivers/net/ppp/pptp.c
--- linux-5.4.60/drivers/net/ppp/pptp.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/ppp/pptp.c	2021-03-04 13:20:59.294172289 +0100
@@ -358,6 +358,7 @@
 	po = lookup_chan(htons(header->call_id), iph->saddr);
 	if (po) {
 		skb_dst_drop(skb);
+		skb->mark = 0;
 		nf_reset_ct(skb);
 		return sk_receive_skb(sk_pppox(po), skb, 0);
 	}
diff -ruw linux-5.4.60/drivers/net/tun.c linux-5.4.60-fbx/drivers/net/tun.c
--- linux-5.4.60/drivers/net/tun.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/tun.c	2021-03-04 13:20:59.297505623 +0100
@@ -68,6 +68,10 @@
 #include <linux/bpf.h>
 #include <linux/bpf_trace.h>
 #include <linux/mutex.h>
+#include <linux/ip.h>
+#include <linux/udp.h>
+#include <linux/tcp.h>
+#include <net/ip.h>
 
 #include <linux/uaccess.h>
 #include <linux/proc_fs.h>
@@ -194,6 +198,31 @@
 	unsigned long updated ____cacheline_aligned_in_smp;
 };
 
+/*
+ * smalltun definitions
+ */
+#define SMALLTUN_MAGIC			0x6660
+#define SMALLTUN_VERSION		0x1
+
+#define TYPE_MASK			0xf
+#define TYPE_CLT			(1 << 3)
+
+#define TYPE_TRIGGER			0x0
+#define TYPE_CHALLENGE			0x1
+#define TYPE_CLIENT_HELLO		0x2
+#define TYPE_SERVER_HELLO		0x3
+
+#define TYPE_CLT_DATA			(TYPE_CLT | 0x0)
+#define TYPE_CLT_GET_PARAMS		(TYPE_CLT | 0x1)
+#define TYPE_CLT_PARAMS			(TYPE_CLT | 0x2)
+
+struct smalltun_pkt_hdr {
+	u16		magic;
+	u8		version;
+	u8		flag_type;
+	u8		data[0];
+};
+
 #define TUN_NUM_FLOW_ENTRIES 1024
 #define TUN_MASK_FLOW_ENTRIES (TUN_NUM_FLOW_ENTRIES - 1)
 
@@ -213,6 +242,11 @@
 	kuid_t			owner;
 	kgid_t			group;
 
+	struct smalltun_fp	smalltun_fps[4];
+	unsigned int		smalltun_valid_count;
+	unsigned int		smalltun_valid[4];
+	struct rtable		*smalltun_rt_cache[4];
+
 	struct net_device	*dev;
 	netdev_features_t	set_features;
 #define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \
@@ -1027,6 +1061,184 @@
 	return 0;
 }
 
+static int smalltun_is_fastpath(struct tun_struct *tun,
+				struct sk_buff *skb)
+{
+	struct iphdr *iph;
+	const struct smalltun_fp *fp;
+	struct rtable **prt_cache, *rt_cache;
+	struct flowi4 fl;
+	bool match;
+	size_t i;
+
+	if (!tun->smalltun_valid_count)
+		return 0;
+
+	if (skb->protocol != htons(ETH_P_IP))
+		return 0;
+
+	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+		return 0;
+
+	iph = ip_hdr(skb);
+
+	/* lookup smalltun fastpath */
+	fp = NULL;
+	rt_cache = NULL;
+	for (i = 0; i < ARRAY_SIZE(tun->smalltun_fps); i++) {
+		if (!tun->smalltun_valid[i])
+			continue;
+
+		if (iph->daddr == tun->smalltun_fps[i].inner_dst) {
+			fp = &tun->smalltun_fps[i];
+			prt_cache = &tun->smalltun_rt_cache[i];
+			break;
+		}
+	}
+
+	if (!fp)
+		return 0;
+
+	if (fp->af != AF_INET) {
+		/* FIXME: implement IPv6 transport */
+		return 0;
+	}
+
+	if (!pskb_may_pull(skb, iph->ihl * 4))
+		return 0;
+
+	match = false;
+	for (i = 0; i < fp->rule_count; i++) {
+		const struct smalltun_rule *r = &fp->rules[i];
+		unsigned int sport, dport;
+
+		if (iph->protocol != r->proto)
+			continue;
+
+		switch (iph->protocol) {
+		case IPPROTO_UDP:
+		{
+			const struct udphdr *udp;
+			udp = (struct udphdr *)((u8 *)iph + (iph->ihl << 2));
+			sport = ntohs(udp->source);
+	                dport = ntohs(udp->dest);
+			break;
+		}
+		case IPPROTO_TCP:
+		{
+			const struct tcphdr *tcp;
+			tcp = (struct tcphdr *)((u8 *)iph + (iph->ihl << 2));
+			sport = ntohs(tcp->source);
+			dport = ntohs(tcp->dest);
+			break;
+		}
+		default:
+			match = true;
+			break;
+		}
+
+		if (match)
+			break;
+
+		if (r->src_port_start && r->src_port_end) {
+			if (sport < ntohs(r->src_port_start) ||
+			    sport > ntohs(r->src_port_end))
+				continue;
+		}
+
+		if (r->dst_port_start && r->dst_port_end) {
+			if (dport < ntohs(r->dst_port_start) ||
+			    dport > ntohs(r->dst_port_end))
+				continue;
+		}
+		match = true;
+	}
+
+	if (!match)
+		return 0;
+
+	if (fp->af == AF_INET) {
+		struct iphdr *oiph;
+		struct udphdr *oudph;
+		struct smalltun_pkt_hdr *pkt;
+		unsigned int payload_len;
+
+		payload_len = skb->len;
+
+		if (skb_cow_head(skb,
+				 sizeof (struct iphdr) +
+				 sizeof (struct udphdr) +
+				 sizeof (struct smalltun_pkt_hdr)))
+			return 0;
+
+		pkt = skb_push(skb, sizeof (struct smalltun_pkt_hdr));
+		oudph = skb_push(skb, sizeof (struct udphdr));
+		skb_reset_transport_header(skb);
+		oiph = skb_push(skb, sizeof (struct iphdr));
+		skb_reset_network_header(skb);
+
+		/* ip */
+		oiph->version = 4;
+		oiph->tos = 0;
+		oiph->id = 0;
+		oiph->ihl = 5;
+		oiph->frag_off = 0;
+		oiph->ttl = 64;
+		oiph->protocol = IPPROTO_UDP;
+		memcpy(&oiph->saddr, fp->outer_src, 4);
+		memcpy(&oiph->daddr, fp->outer_dst, 4);
+
+		/* udp */
+		oudph->source = fp->outer_src_port;
+		oudph->dest = fp->outer_dst_port;
+		oudph->len = htons(payload_len + sizeof (*oudph) +
+				   sizeof (*pkt));
+		oudph->check = 0;
+
+		/* smalltun */
+		pkt->magic = htons(SMALLTUN_MAGIC);
+		pkt->version = SMALLTUN_VERSION;
+		pkt->flag_type = TYPE_CLT_DATA;
+
+		memset(&fl, 0x00, sizeof (fl));
+		memcpy(&fl.saddr, fp->outer_src, 4);
+		memcpy(&fl.daddr, fp->outer_dst, 4);
+
+		if (*prt_cache && (*prt_cache)->dst.obsolete > 0) {
+			rt_cache = *prt_cache;
+			*prt_cache = NULL;
+			ip_rt_put(rt_cache);
+		}
+
+		rt_cache = *prt_cache;
+		if (!rt_cache) {
+			rt_cache = ip_route_output_key(&init_net, &fl);
+			if (IS_ERR(rt_cache)) {
+				pr_err("ip_route_output_key(%pI4): %li\n",
+				       &fl.daddr, PTR_ERR(rt_cache));
+				return 0;
+			}
+
+			if (!rt_cache->dst.dev) {
+				pr_err("ip_route_output_key(%pI4): no dev\n",
+				       &fl.daddr);
+				return 0;
+			}
+
+			*prt_cache = rt_cache;
+		}
+
+		skb_dst_set(skb, dst_clone(&rt_cache->dst));
+		skb->dev = skb_dst(skb)->dev;
+		ip_local_out(&init_net, NULL, skb);
+		return 1;
+	}
+
+	/* find route */
+
+	return 0;
+}
+
 /* Net device start xmit */
 static void tun_automq_xmit(struct tun_struct *tun, struct sk_buff *skb)
 {
@@ -1104,6 +1316,11 @@
 	 */
 	skb_orphan(skb);
 
+	if (smalltun_is_fastpath(tun, skb)) {
+		rcu_read_unlock();
+		return NETDEV_TX_OK;
+	}
+
 	nf_reset_ct(skb);
 
 	if (ptr_ring_produce(&tfile->tx_ring, skb))
@@ -3347,6 +3564,100 @@
 		ret = open_related_ns(&net->ns, get_net_ns);
 		break;
 
+	case TUNSMALLTUNSETFP:
+	{
+		struct smalltun_fp fp;
+		unsigned int i;
+		int free_idx;
+
+		ret = -EFAULT;
+		if (copy_from_user(&fp, argp, sizeof(fp)))
+			break;
+
+		/* look for duplicate */
+		ret = 0;
+		free_idx = -1;
+		for (i = 0; i < ARRAY_SIZE(tun->smalltun_fps); i++) {
+			if (!tun->smalltun_valid[i]) {
+				if (free_idx == -1)
+					free_idx = i;
+				continue;
+			}
+
+			if (fp.inner_src == tun->smalltun_fps[i].inner_src &&
+			    fp.inner_dst == tun->smalltun_fps[i].inner_dst) {
+				ret = -EEXIST;
+				break;
+			}
+		}
+
+		if (ret)
+			break;
+
+		if (free_idx == -1) {
+			ret = -ENOSPC;
+			break;
+		}
+
+		memcpy(&tun->smalltun_fps[free_idx], &fp, sizeof (fp));
+		tun->smalltun_valid[free_idx] = 1;
+		tun->smalltun_valid_count++;
+		tun_debug(KERN_INFO, tun, "new fp rule for %pI4 <=> %pI4 (%u rules)\n",
+			  &fp.inner_src,
+			  &fp.inner_dst,
+			  fp.rule_count);
+
+		if (fp.af == AF_INET) {
+			tun_debug(KERN_INFO, tun, "outer %pI4:%u <=> %pI4:%u\n",
+				  fp.outer_src,
+				  ntohs(fp.outer_src_port),
+				  fp.outer_dst,
+				  ntohs(fp.outer_dst_port));
+		} else {
+			tun_debug(KERN_INFO, tun, "outer %pI6:%u <=> %pI6:%u\n",
+				  fp.outer_src,
+				  ntohs(fp.outer_src_port),
+				  fp.outer_dst,
+				  ntohs(fp.outer_dst_port));
+		}
+		break;
+	}
+
+	case TUNSMALLTUNDELFP:
+	{
+		struct smalltun_fp fp;
+		unsigned int i;
+
+		ret = -EFAULT;
+		if (copy_from_user(&fp, argp, sizeof(fp)))
+			break;
+
+		/* lookup */
+		ret = -ENOENT;
+		for (i = 0; i < ARRAY_SIZE(tun->smalltun_fps); i++) {
+			if (fp.inner_src == tun->smalltun_fps[i].inner_src &&
+			    fp.inner_dst == tun->smalltun_fps[i].inner_dst) {
+				ret = 0;
+				break;
+			}
+		}
+
+		if (ret)
+			break;
+
+		tun->smalltun_valid[i] = 0;
+		tun->smalltun_valid_count--;
+		if (tun->smalltun_rt_cache[i]) {
+			ip_rt_put(tun->smalltun_rt_cache[i]);
+			tun->smalltun_rt_cache[i] = NULL;
+		}
+
+		tun_debug(KERN_INFO, tun, "removed fp rule for %pI4 <=> %pI4\n",
+			  &fp.inner_src,
+			  &fp.inner_dst);
+		break;
+	}
+
 	default:
 		ret = -EINVAL;
 		break;
diff -ruw linux-5.4.60/drivers/net/wireless/ath/ath10k/core.c linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/core.c
--- linux-5.4.60/drivers/net/wireless/ath/ath10k/core.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/core.c	2021-03-04 13:20:59.314172291 +0100
@@ -88,6 +88,7 @@
 		.rri_on_ddr = false,
 		.hw_filter_reset_required = true,
 		.fw_diag_ce_download = false,
+		.uart_pin_workaround = true,
 		.tx_stats_over_pktlog = true,
 	},
 	{
@@ -1090,6 +1091,7 @@
 static int ath10k_fetch_cal_file(struct ath10k *ar)
 {
 	char filename[100];
+	unsigned int i;
 
 	/* pre-cal-<bus>-<id>.bin */
 	scnprintf(filename, sizeof(filename), "pre-cal-%s-%s.bin",
@@ -1103,6 +1105,11 @@
 	scnprintf(filename, sizeof(filename), "cal-%s-%s.bin",
 		  ath10k_bus_str(ar->hif.bus), dev_name(ar->dev));
 
+	for (i = 0; filename[i]; i++) {
+		if (filename[i] == ':')
+			filename[i] = '_';
+	}
+
 	ar->cal_file = ath10k_fetch_fw_file(ar, ATH10K_FW_DIR, filename);
 	if (IS_ERR(ar->cal_file))
 		/* calibration file is optional, don't print any warnings */
@@ -2221,6 +2228,7 @@
 
 	switch (ar->state) {
 	case ATH10K_STATE_ON:
+	case ATH10K_STATE_PRE_ON:
 		ar->state = ATH10K_STATE_RESTARTING;
 		ath10k_halt(ar);
 		ath10k_scan_finish(ar);
diff -ruw linux-5.4.60/drivers/net/wireless/ath/ath10k/core.h linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/core.h
--- linux-5.4.60/drivers/net/wireless/ath/ath10k/core.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/core.h	2021-03-04 13:20:59.314172291 +0100
@@ -646,10 +646,12 @@
 	void *cal_data;
 	u32 enable_extd_tx_stats;
 	u8 fw_dbglog_mode;
+	u32 burst_dur[4];
 };
 
 enum ath10k_state {
 	ATH10K_STATE_OFF = 0,
+	ATH10K_STATE_PRE_ON,
 	ATH10K_STATE_ON,
 
 	/* When doing firmware recovery the device is first powered down.
@@ -946,6 +948,7 @@
 	struct ieee80211_ops *ops;
 	struct device *dev;
 	u8 mac_addr[ETH_ALEN];
+	const char *fem_name;
 
 	enum ath10k_hw_rev hw_rev;
 	u16 dev_id;
@@ -1120,6 +1123,8 @@
 
 	struct work_struct register_work;
 	struct work_struct restart_work;
+	struct work_struct powerup_work;
+	bool powerup_pending;
 
 	/* cycle count is reported twice for each visited channel during scan.
 	 * access protected by data_lock
diff -ruw linux-5.4.60/drivers/net/wireless/ath/ath10k/debug.c linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/debug.c
--- linux-5.4.60/drivers/net/wireless/ath/ath10k/debug.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/debug.c	2021-03-04 13:20:59.314172291 +0100
@@ -2510,6 +2510,79 @@
 	.llseek = default_llseek,
 };
 
+static ssize_t ath10k_write_burst_dur(struct file *file, const char __user *user_buf,
+				      size_t count, loff_t *ppos)
+{
+
+        struct ath10k *ar = file->private_data;
+        u32 dur[4];
+        int ret;
+	int ac;
+	char buf[128];
+
+	simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
+
+	/* make sure that buf is null terminated */
+	buf[sizeof(buf) - 1] = 0;
+
+	ret = sscanf(buf, "%u %u %u %u", &dur[0], &dur[1], &dur[2], &dur[3]);
+
+	if (!ret)
+		return -EINVAL;
+
+	mutex_lock(&ar->conf_mutex);
+
+	if (ar->state != ATH10K_STATE_ON &&
+	    ar->state != ATH10K_STATE_RESTARTED) {
+		ret = -ENETDOWN;
+		goto exit;
+	}
+
+	for (ac = 0; ac < 4; ac++) {
+		if (dur[ac] < MIN_BURST_DUR || dur[ac] > MAX_BURST_DUR) {
+			ret = -EINVAL;
+			goto exit;
+		}
+
+		ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->aggr_burst,
+						(SM(ac, ATH10K_AGGR_BURST_AC) |
+						SM(dur[ac], ATH10K_AGGR_BURST_DUR)));
+		if (ret) {
+			ath10k_warn(ar, "failed to set aggr burst duration for ac %d: %d\n", ac, ret);
+			goto exit;
+		}
+		ar->debug.burst_dur[ac] = dur[ac];
+	}
+
+        ret = count;
+
+exit:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static ssize_t ath10k_read_burst_dur(struct file *file, char __user *user_buf,
+				     size_t count, loff_t *ppos)
+{
+	struct ath10k *ar = file->private_data;
+	int len = 0;
+	char buf[128];
+
+	len = scnprintf(buf, sizeof(buf) - len, "%u %u %u %u\n",
+			ar->debug.burst_dur[0], ar->debug.burst_dur[1],
+			ar->debug.burst_dur[2], ar->debug.burst_dur[3]);
+
+	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_burst_dur = {
+        .read = ath10k_read_burst_dur,
+        .write = ath10k_write_burst_dur,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 int ath10k_debug_create(struct ath10k *ar)
 {
 	ar->debug.cal_data = vzalloc(ATH10K_DEBUG_CAL_DATA_LEN);
@@ -2596,6 +2669,9 @@
 	debugfs_create_file("ani_enable", 0600, ar->debug.debugfs_phy, ar,
 			    &fops_ani_enable);
 
+	debugfs_create_file("burst_dur", S_IRUSR | S_IWUSR,
+			    ar->debug.debugfs_phy, ar, &fops_burst_dur);
+
 	if (IS_ENABLED(CONFIG_ATH10K_DFS_CERTIFIED)) {
 		debugfs_create_file("dfs_simulate_radar", 0200, ar->debug.debugfs_phy,
 				    ar, &fops_simulate_radar);
diff -ruw linux-5.4.60/drivers/net/wireless/ath/ath10k/debug.h linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/debug.h
--- linux-5.4.60/drivers/net/wireless/ath/ath10k/debug.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/debug.h	2021-03-04 13:20:59.314172291 +0100
@@ -80,6 +80,15 @@
 __printf(2, 3) void ath10k_err(struct ath10k *ar, const char *fmt, ...);
 __printf(2, 3) void ath10k_warn(struct ath10k *ar, const char *fmt, ...);
 
+#define ATH10K_AGGR_BURST_AC_MASK  0xff000000
+#define ATH10K_AGGR_BURST_AC_LSB   24
+#define ATH10K_AGGR_BURST_DUR_MASK 0x00ffffff
+#define ATH10K_AGGR_BURST_DUR_LSB  0
+
+/* burst duration in usec */
+#define MIN_BURST_DUR 0
+#define MAX_BURST_DUR 8000
+
 void ath10k_debug_print_hwfw_info(struct ath10k *ar);
 void ath10k_debug_print_board_info(struct ath10k *ar);
 void ath10k_debug_print_boot_info(struct ath10k *ar);
diff -ruw linux-5.4.60/drivers/net/wireless/ath/ath10k/htt.h linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/htt.h
--- linux-5.4.60/drivers/net/wireless/ath/ath10k/htt.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/htt.h	2021-03-04 13:20:59.314172291 +0100
@@ -2225,7 +2225,7 @@
  * Should be: sizeof(struct htt_host_rx_desc) + max rx MSDU size,
  * rounded up to a cache line size.
  */
-#define HTT_RX_BUF_SIZE 1920
+#define HTT_RX_BUF_SIZE 2048
 #define HTT_RX_MSDU_SIZE (HTT_RX_BUF_SIZE - (int)sizeof(struct htt_rx_desc))
 
 /* Refill a bunch of RX buffers for each refill round so that FW/HW can handle
diff -ruw linux-5.4.60/drivers/net/wireless/ath/ath10k/mac.c linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/mac.c
--- linux-5.4.60/drivers/net/wireless/ath/ath10k/mac.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/mac.c	2021-03-04 13:20:59.317505624 +0100
@@ -2515,7 +2515,7 @@
 	const u16 *vht_mcs_mask;
 	u8 ampdu_factor;
 	u8 max_nss, vht_mcs;
-	int i;
+	int i, nss160;
 
 	if (WARN_ON(ath10k_mac_vif_chan(vif, &def)))
 		return;
@@ -2575,23 +2575,45 @@
 		__le16_to_cpu(vht_cap->vht_mcs.tx_highest);
 	arg->peer_vht_rates.tx_mcs_set = ath10k_peer_assoc_h_vht_limit(
 		__le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map), vht_mcs_mask);
+	arg->peer_bw_rxnss_override = 0;
+	nss160 = 1; /* 1x1 default config for VHT160 */
+
+	/* only local 4x4 configuration do support 2x2 for VHT160,
+	 * everything else must use 1x1 
+	 */
+
+	if (ar->cfg_rx_chainmask == 15)
+		nss160 = arg->peer_num_spatial_streams < 2 ? 1 : 2;
+
+	/* if peer provides 1x1 nss160 information using max rate
+	 * vht information, we reduce local nss160 to 1x1.
+	 * consider that it has been observed that some client
+	 * devices provide zero here, no matter which transmission
+	 * rate is possible. in that case the local nss configuration 
+	 * will be used at maxmimum configuration possible. (see above)
+	 */
 
-	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vht peer %pM max_mpdu %d flags 0x%x\n",
-		   sta->addr, arg->peer_max_mpdu, arg->peer_flags);
+	if (arg->peer_vht_rates.rx_max_rate == 780)
+		nss160 = 1;
 
-	if (arg->peer_vht_rates.rx_max_rate &&
-	    (sta->vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK)) {
-		switch (arg->peer_vht_rates.rx_max_rate) {
-		case 1560:
-			/* Must be 2x2 at 160Mhz is all it can do. */
-			arg->peer_bw_rxnss_override = 2;
-			break;
-		case 780:
-			/* Can only do 1x1 at 160Mhz (Long Guard Interval) */
-			arg->peer_bw_rxnss_override = 1;
+	/* in case if peer is connected with vht160 or vht80+80,
+         * we need to properly adjust rxnss parameters otherwise 
+	 * firmware will raise a assert 
+	 */
+	switch (arg->peer_phymode) {
+	case MODE_11AC_VHT80_80:
+		arg->peer_bw_rxnss_override = BW_NSS_FWCONF_80_80(nss160);
+	/* fall through */
+	case MODE_11AC_VHT160:
+		arg->peer_bw_rxnss_override |= BW_NSS_FWCONF_160(nss160);
+		break;
+	default:
 			break;
 		}
-	}
+
+	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vht peer %pM max_mpdu %d flags 0x%x peer_bw_rxnss_override 0x%x\n",
+		   sta->addr, arg->peer_max_mpdu, arg->peer_flags, 
+		   arg->peer_bw_rxnss_override);
 }
 
 static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
@@ -2743,9 +2765,9 @@
 	ath10k_peer_assoc_h_crypto(ar, vif, sta, arg);
 	ath10k_peer_assoc_h_rates(ar, vif, sta, arg);
 	ath10k_peer_assoc_h_ht(ar, vif, sta, arg);
+	ath10k_peer_assoc_h_phymode(ar, vif, sta, arg);
 	ath10k_peer_assoc_h_vht(ar, vif, sta, arg);
 	ath10k_peer_assoc_h_qos(ar, vif, sta, arg);
-	ath10k_peer_assoc_h_phymode(ar, vif, sta, arg);
 
 	return 0;
 }
@@ -4556,13 +4578,6 @@
 		vht_cap.cap |= val;
 	}
 
-	/* Currently the firmware seems to be buggy, don't enable 80+80
-	 * mode until that's resolved.
-	 */
-	if ((ar->vht_cap_info & IEEE80211_VHT_CAP_SHORT_GI_160) &&
-	    (ar->vht_cap_info & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) == 0)
-		vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
-
 	mcs_map = 0;
 	for (i = 0; i < 8; i++) {
 		if ((i < ar->num_rf_chains) && (ar->cfg_tx_chainmask & BIT(i)))
@@ -4734,13 +4749,18 @@
 	const char *fem_name;
 	int ret;
 
+	if (ar->fem_name)
+		fem_name = ar->fem_name;
+	else {
 	node = ar->dev->of_node;
 	if (!node)
 		return -ENOENT;
 
-	ret = of_property_read_string_index(node, "ext-fem-name", 0, &fem_name);
+		ret = of_property_read_string_index(node, "ext-fem-name",
+						    0, &fem_name);
 	if (ret)
 		return -ENOENT;
+	}
 
 	/*
 	 * If external Front End module used in hardware, then default base band timing
@@ -4759,12 +4779,83 @@
 	return 0;
 }
 
+static int ath10k_get_powered(struct ieee80211_hw *hw, bool *up, bool *busy)
+{
+	struct ath10k *ar = hw->priv;
+	*up = (ar->state == ATH10K_STATE_ON ||
+	       ar->state == ATH10K_STATE_PRE_ON);
+	*busy = ar->powerup_pending;
+	return 0;
+}
+
+static int ath10k_set_powered(struct ieee80211_hw *hw)
+{
+	struct ath10k *ar = hw->priv;
+
+	switch (ar->state) {
+	case ATH10K_STATE_OFF:
+	case ATH10K_STATE_PRE_ON:
+		break;
+	default:
+		return 0;
+	}
+
+	if (ar->powerup_pending)
+		return 0;
+
+	queue_work(ar->workqueue, &ar->powerup_work);
+	ar->powerup_pending = true;
+	return 0;
+}
+
+static void ath10k_powerup_work(struct work_struct *work)
+{
+	struct ath10k *ar = container_of(work, struct ath10k, powerup_work);
+	int ret;
+
+	mutex_lock(&ar->conf_mutex);
+
+	if (ar->state != ATH10K_STATE_OFF) {
+		mutex_unlock(&ar->conf_mutex);
+		return;
+	}
+
+	ret = ath10k_hif_power_up(ar, ATH10K_FIRMWARE_MODE_NORMAL);
+	if (ret) {
+		ath10k_err(ar, "Could not init hif: %d\n", ret);
+		goto err_off;
+	}
+
+	ret = ath10k_core_start(ar, ATH10K_FIRMWARE_MODE_NORMAL,
+				&ar->normal_mode_fw);
+	if (ret) {
+		ath10k_err(ar, "Could not init core: %d\n", ret);
+		goto err_power_down;
+	}
+
+	ar->state = ATH10K_STATE_PRE_ON;
+	ar->powerup_pending = false;
+	mutex_unlock(&ar->conf_mutex);
+	return;
+
+err_power_down:
+	ath10k_hif_power_down(ar);
+
+err_off:
+	ar->state = ATH10K_STATE_OFF;
+
+	ar->powerup_pending = false;
+	mutex_unlock(&ar->conf_mutex);
+	return;
+}
+
 static int ath10k_start(struct ieee80211_hw *hw)
 {
 	struct ath10k *ar = hw->priv;
 	u32 param;
 	int ret = 0;
 	struct wmi_bb_timing_cfg_arg bb_timing = {0};
+	bool skip_core_start = false;
 
 	/*
 	 * This makes sense only when restarting hw. It is harmless to call
@@ -4779,6 +4870,10 @@
 	case ATH10K_STATE_OFF:
 		ar->state = ATH10K_STATE_ON;
 		break;
+	case ATH10K_STATE_PRE_ON:
+		skip_core_start = true;
+		ar->state = ATH10K_STATE_ON;
+		break;
 	case ATH10K_STATE_RESTARTING:
 		ar->state = ATH10K_STATE_RESTARTED;
 		break;
@@ -4793,6 +4888,7 @@
 		goto err;
 	}
 
+	if (!skip_core_start) {
 	ret = ath10k_hif_power_up(ar, ATH10K_FIRMWARE_MODE_NORMAL);
 	if (ret) {
 		ath10k_err(ar, "Could not init hif: %d\n", ret);
@@ -4805,6 +4901,7 @@
 		ath10k_err(ar, "Could not init core: %d\n", ret);
 		goto err_power_down;
 	}
+	}
 
 	param = ar->wmi.pdev_param->pmf_qos;
 	ret = ath10k_wmi_pdev_set_param(ar, param, 1);
@@ -4963,6 +5060,9 @@
 
 	ath10k_drain_tx(ar);
 
+	cancel_work_sync(&ar->powerup_work);
+	ar->powerup_pending = false;
+
 	mutex_lock(&ar->conf_mutex);
 	if (ar->state != ATH10K_STATE_OFF) {
 		ath10k_halt(ar);
@@ -7131,7 +7231,7 @@
 				  struct ieee80211_channel *channel)
 {
 	int ret;
-	enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ_CLEAR;
+	enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ;
 
 	lockdep_assert_held(&ar->conf_mutex);
 
@@ -8187,6 +8287,8 @@
 static const struct ieee80211_ops ath10k_ops = {
 	.tx				= ath10k_mac_op_tx,
 	.wake_tx_queue			= ath10k_mac_op_wake_tx_queue,
+	.get_powered			= ath10k_get_powered,
+	.set_powered			= ath10k_set_powered,
 	.start				= ath10k_start,
 	.stop				= ath10k_stop,
 	.config				= ath10k_config,
@@ -8397,6 +8499,7 @@
 		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
 					BIT(NL80211_CHAN_WIDTH_20) |
 					BIT(NL80211_CHAN_WIDTH_40) |
+					BIT(NL80211_CHAN_WIDTH_160) |
 					BIT(NL80211_CHAN_WIDTH_80),
 #endif
 	},
@@ -8521,6 +8624,7 @@
 		.radar_detect_widths =	BIT(NL80211_CHAN_WIDTH_20_NOHT) |
 					BIT(NL80211_CHAN_WIDTH_20) |
 					BIT(NL80211_CHAN_WIDTH_40) |
+					BIT(NL80211_CHAN_WIDTH_160) |
 					BIT(NL80211_CHAN_WIDTH_80),
 #endif
 	},
@@ -8539,6 +8643,7 @@
 		.radar_detect_widths =  BIT(NL80211_CHAN_WIDTH_20_NOHT) |
 					BIT(NL80211_CHAN_WIDTH_20) |
 					BIT(NL80211_CHAN_WIDTH_40) |
+					BIT(NL80211_CHAN_WIDTH_160) |
 					BIT(NL80211_CHAN_WIDTH_80),
 #endif
 	},
@@ -8578,6 +8683,8 @@
 #define WRD_METHOD "WRDD"
 #define WRDD_WIFI  (0x07)
 
+#define ATH10K_DFS_PULSE_VALID_DIFF_TS 100
+
 static u32 ath10k_mac_wrdd_get_mcc(struct ath10k *ar, union acpi_object *wrdd)
 {
 	union acpi_object *mcc_pkg;
@@ -8791,6 +8898,7 @@
 	ieee80211_hw_set(ar->hw, SUPPORT_FAST_XMIT);
 	ieee80211_hw_set(ar->hw, CONNECTION_MONITOR);
 	ieee80211_hw_set(ar->hw, SUPPORTS_PER_STA_GTK);
+	ieee80211_hw_set(ar->hw, APVLAN_NEED_MCAST_TO_UCAST);
 	ieee80211_hw_set(ar->hw, WANT_MONITOR_VIF);
 	ieee80211_hw_set(ar->hw, CHANCTX_STA_CSA);
 	ieee80211_hw_set(ar->hw, QUEUE_CONTROL);
@@ -8955,6 +9063,8 @@
 	if (IS_ENABLED(CONFIG_ATH10K_DFS_CERTIFIED)) {
 		/* Init ath dfs pattern detector */
 		ar->ath_common.debug_mask = ATH_DBG_DFS;
+		ar->ath_common.dfs_pulse_valid_diff_ts =
+					ATH10K_DFS_PULSE_VALID_DIFF_TS;
 		ar->dfs_detector = dfs_pattern_detector_init(&ar->ath_common,
 							     NL80211_DFS_UNSET);
 
@@ -8972,6 +9082,15 @@
 	if (!ar->hw_params.hw_ops->set_coverage_class)
 		ar->ops->set_coverage_class = NULL;
 
+	/* Current wake_tx_queue implementation imposes a significant
+	 * performance penalty in some setups. The tx scheduling code needs
+	 * more work anyway so disable the wake_tx_queue unless firmware
+	 * supports the pull-push mechanism.
+	 */
+	if (!test_bit(ATH10K_FW_FEATURE_PEER_FLOW_CONTROL,
+		      ar->running_fw->fw_file.fw_features))
+		ar->ops->wake_tx_queue = NULL;
+
 	ret = ath_regd_init(&ar->ath_common.regulatory, ar->hw->wiphy,
 			    ath10k_reg_notifier);
 	if (ret) {
@@ -9002,6 +9121,9 @@
 
 	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
 
+	INIT_WORK(&ar->powerup_work, ath10k_powerup_work);
+	ar->powerup_pending = false;
+
 	ret = ieee80211_register_hw(ar->hw);
 	if (ret) {
 		ath10k_err(ar, "failed to register ieee80211: %d\n", ret);
@@ -9013,16 +9135,20 @@
 		ar->hw->wiphy->software_iftypes |= BIT(NL80211_IFTYPE_AP_VLAN);
 	}
 
+#ifndef CONFIG_ATH_REG_IGNORE
 	if (!ath_is_world_regd(&ar->ath_common.regulatory)) {
 		ret = regulatory_hint(ar->hw->wiphy,
 				      ar->ath_common.regulatory.alpha2);
 		if (ret)
 			goto err_unregister;
 	}
+#endif
 
 	return 0;
 
+#ifndef CONFIG_ATH_REG_IGNORE
 err_unregister:
+#endif
 	ieee80211_unregister_hw(ar->hw);
 
 err_dfs_detector_exit:
@@ -9040,6 +9166,7 @@
 void ath10k_mac_unregister(struct ath10k *ar)
 {
 	ieee80211_unregister_hw(ar->hw);
+	cancel_work_sync(&ar->powerup_work);
 
 	if (IS_ENABLED(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector)
 		ar->dfs_detector->exit(ar->dfs_detector);
diff -ruw linux-5.4.60/drivers/net/wireless/ath/ath10k/pci.c linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/pci.c
--- linux-5.4.60/drivers/net/wireless/ath/ath10k/pci.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/pci.c	2021-03-04 13:20:59.317505624 +0100
@@ -9,6 +9,7 @@
 #include <linux/interrupt.h>
 #include <linux/spinlock.h>
 #include <linux/bitops.h>
+#include <linux/delay.h>
 
 #include "core.h"
 #include "debug.h"
@@ -30,6 +31,7 @@
 
 static unsigned int ath10k_pci_irq_mode = ATH10K_PCI_IRQ_AUTO;
 static unsigned int ath10k_pci_reset_mode = ATH10K_PCI_RESET_AUTO;
+static char *fem_name;
 
 module_param_named(irq_mode, ath10k_pci_irq_mode, uint, 0644);
 MODULE_PARM_DESC(irq_mode, "0: auto, 1: legacy, 2: msi (default: 0)");
@@ -37,6 +39,9 @@
 module_param_named(reset_mode, ath10k_pci_reset_mode, uint, 0644);
 MODULE_PARM_DESC(reset_mode, "0: auto, 1: warm only (default: 0)");
 
+module_param(fem_name, charp, 0660);
+MODULE_PARM_DESC(fem_name, "force FEM type");
+
 /* how long wait to wait for target to initialise, in ms */
 #define ATH10K_PCI_TARGET_WAIT 3000
 #define ATH10K_PCI_NUM_WARM_RESET_ATTEMPTS 3
@@ -714,7 +719,8 @@
 	/* Check if the shared legacy irq is for us */
 	cause = ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS +
 				  PCIE_INTR_CAUSE_ADDRESS);
-	if (cause & (PCIE_INTR_FIRMWARE_MASK | PCIE_INTR_CE_MASK_ALL))
+	if (cause & (PCIE_INTR_FIRMWARE_MASK | PCIE_INTR_CE_MASK_ALL) &&
+	    cause != 0xdeadbeef)
 		return true;
 
 	return false;
@@ -2652,12 +2658,6 @@
 	return 0;
 }
 
-static int ath10k_pci_qca99x0_soft_chip_reset(struct ath10k *ar)
-{
-	ath10k_pci_irq_disable(ar);
-	return ath10k_pci_qca99x0_chip_reset(ar);
-}
-
 static int ath10k_pci_safe_chip_reset(struct ath10k *ar)
 {
 	struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
@@ -3498,7 +3498,7 @@
 	.get_num_banks	= ath10k_pci_get_num_banks,
 };
 
-static int ath10k_pci_probe(struct pci_dev *pdev,
+static int __ath10k_pci_probe(struct pci_dev *pdev,
 			    const struct pci_device_id *pci_dev)
 {
 	int ret = 0;
@@ -3539,21 +3539,21 @@
 	case QCA99X0_2_0_DEVICE_ID:
 		hw_rev = ATH10K_HW_QCA99X0;
 		pci_ps = false;
-		pci_soft_reset = ath10k_pci_qca99x0_soft_chip_reset;
+		pci_soft_reset = NULL;;
 		pci_hard_reset = ath10k_pci_qca99x0_chip_reset;
 		targ_cpu_to_ce_addr = ath10k_pci_qca99x0_targ_cpu_to_ce_addr;
 		break;
 	case QCA9984_1_0_DEVICE_ID:
 		hw_rev = ATH10K_HW_QCA9984;
 		pci_ps = false;
-		pci_soft_reset = ath10k_pci_qca99x0_soft_chip_reset;
+		pci_soft_reset = NULL;;
 		pci_hard_reset = ath10k_pci_qca99x0_chip_reset;
 		targ_cpu_to_ce_addr = ath10k_pci_qca99x0_targ_cpu_to_ce_addr;
 		break;
 	case QCA9888_2_0_DEVICE_ID:
 		hw_rev = ATH10K_HW_QCA9888;
 		pci_ps = false;
-		pci_soft_reset = ath10k_pci_qca99x0_soft_chip_reset;
+		pci_soft_reset = NULL;;
 		pci_hard_reset = ath10k_pci_qca99x0_chip_reset;
 		targ_cpu_to_ce_addr = ath10k_pci_qca99x0_targ_cpu_to_ce_addr;
 		break;
@@ -3592,6 +3592,7 @@
 	ar_pci->targ_cpu_to_ce_addr = targ_cpu_to_ce_addr;
 	ar->ce_priv = &ar_pci->ce;
 
+	ar->fem_name = fem_name;
 	ar->id.vendor = pdev->vendor;
 	ar->id.device = pdev->device;
 	ar->id.subsystem_vendor = pdev->subsystem_vendor;
@@ -3751,6 +3752,23 @@
 			 ath10k_pci_pm_suspend,
 			 ath10k_pci_pm_resume);
 
+static int ath10k_pci_probe(struct pci_dev *pdev,
+			    const struct pci_device_id *pci_dev)
+{
+	int cnt = 0;
+	int rv;
+	do {
+		rv = __ath10k_pci_probe(pdev, pci_dev);
+		if (rv == 0)
+			return rv;
+
+		pr_err("ath10k: failed to probe PCI : %d, retry-count: %d\n", rv, cnt);
+		mdelay(10); /* let the ath10k firmware gerbil take a small break */
+	} while (cnt++ < 3);
+
+	return rv;
+}
+
 static struct pci_driver ath10k_pci_driver = {
 	.name = "ath10k_pci",
 	.id_table = ath10k_pci_id_table,
diff -ruw linux-5.4.60/drivers/net/wireless/ath/ath10k/thermal.c linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/thermal.c
--- linux-5.4.60/drivers/net/wireless/ath/ath10k/thermal.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/thermal.c	2021-03-04 13:20:59.320838957 +0100
@@ -160,7 +160,9 @@
 	if (!test_bit(WMI_SERVICE_THERM_THROT, ar->wmi.svc_map))
 		return 0;
 
-	cdev = thermal_cooling_device_register("ath10k_thermal", ar,
+	cdev = thermal_cooling_device_register_with_parent(ar->dev,
+							   "ath10k_thermal",
+							   ar,
 					       &ath10k_thermal_ops);
 
 	if (IS_ERR(cdev)) {
diff -ruw linux-5.4.60/drivers/net/wireless/ath/ath10k/wmi.c linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/wmi.c
--- linux-5.4.60/drivers/net/wireless/ath/ath10k/wmi.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/wmi.c	2021-03-04 13:20:59.320838957 +0100
@@ -1681,10 +1681,11 @@
 	.bw160 = WMI_10_2_PEER_160MHZ,
 };
 
-void ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
+void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
 				const struct wmi_channel_arg *arg)
 {
 	u32 flags = 0;
+	struct ieee80211_channel *chan = NULL;
 
 	memset(ch, 0, sizeof(*ch));
 
@@ -1700,13 +1701,35 @@
 		flags |= WMI_CHAN_FLAG_HT40_PLUS;
 	if (arg->chan_radar)
 		flags |= WMI_CHAN_FLAG_DFS;
-
+	ch->band_center_freq2 = 0;
 	ch->mhz = __cpu_to_le32(arg->freq);
 	ch->band_center_freq1 = __cpu_to_le32(arg->band_center_freq1);
-	if (arg->mode == MODE_11AC_VHT80_80)
+	if (arg->mode == MODE_11AC_VHT80_80) {
 		ch->band_center_freq2 = __cpu_to_le32(arg->band_center_freq2);
-	else
-		ch->band_center_freq2 = 0;
+		chan = ieee80211_get_channel(ar->hw->wiphy,
+						arg->band_center_freq2 - 10);
+	}
+	if (arg->mode == MODE_11AC_VHT160)  {
+		if (arg->freq > arg->band_center_freq1) {
+			ch->band_center_freq1 =
+				__cpu_to_le32(arg->band_center_freq1 + 40);
+			/* Minus 40 to get secondary segment's center frequency
+			 * And minus 10 to get a defined 5G channel frequency.
+			 */
+			chan = ieee80211_get_channel(ar->hw->wiphy,
+					arg->band_center_freq1 - 40 - 10);
+		} else {
+			ch->band_center_freq1 =
+				__cpu_to_le32(arg->band_center_freq1 - 40);
+			chan = ieee80211_get_channel(ar->hw->wiphy,
+					arg->band_center_freq1 + 40 - 10);
+		}
+		ch->band_center_freq2 = __cpu_to_le32(arg->band_center_freq1);
+	}
+
+	if (chan && chan->flags & IEEE80211_CHAN_RADAR)
+		flags |= WMI_CHAN_FLAG_DFS_CFREQ2;
+
 	ch->min_power = arg->min_power;
 	ch->max_power = arg->max_power;
 	ch->reg_power = arg->max_reg_power;
@@ -7089,7 +7112,7 @@
 		memcpy(cmd->ssid.ssid, arg->ssid, arg->ssid_len);
 	}
 
-	ath10k_wmi_put_wmi_channel(&cmd->chan, &arg->channel);
+	ath10k_wmi_put_wmi_channel(ar, &cmd->chan, &arg->channel);
 
 	ath10k_dbg(ar, ATH10K_DBG_WMI,
 		   "wmi vdev %s id 0x%x flags: 0x%0X, freq %d, mode %d, ch_flags: 0x%0X, max_power: %d\n",
@@ -7461,7 +7484,7 @@
 		ch = &arg->channels[i];
 		ci = &cmd->chan_info[i];
 
-		ath10k_wmi_put_wmi_channel(ci, ch);
+		ath10k_wmi_put_wmi_channel(ar, ci, ch);
 	}
 
 	return skb;
@@ -7552,12 +7575,7 @@
 	struct wmi_10_4_peer_assoc_complete_cmd *cmd = buf;
 
 	ath10k_wmi_peer_assoc_fill_10_2(ar, buf, arg);
-	if (arg->peer_bw_rxnss_override)
-		cmd->peer_bw_rxnss_override =
-			__cpu_to_le32((arg->peer_bw_rxnss_override - 1) |
-				      BIT(PEER_BW_RXNSS_OVERRIDE_OFFSET));
-	else
-		cmd->peer_bw_rxnss_override = 0;
+	cmd->peer_bw_rxnss_override = __cpu_to_le32(arg->peer_bw_rxnss_override);
 }
 
 static int
@@ -8869,7 +8887,7 @@
 
 	for (i = 0; i < cap->peer_chan_len; i++) {
 		chan = (struct wmi_channel *)&peer_cap->peer_chan_list[i];
-		ath10k_wmi_put_wmi_channel(chan, &chan_arg[i]);
+		ath10k_wmi_put_wmi_channel(ar, chan, &chan_arg[i]);
 	}
 
 	ath10k_dbg(ar, ATH10K_DBG_WMI,
diff -ruw linux-5.4.60/drivers/net/wireless/ath/ath10k/wmi.h linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/wmi.h
--- linux-5.4.60/drivers/net/wireless/ath/ath10k/wmi.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/wmi.h	2021-03-04 13:20:59.320838957 +0100
@@ -2085,6 +2085,8 @@
 
 /* Indicate reason for channel switch */
 #define WMI_CHANNEL_CHANGE_CAUSE_CSA (1 << 13)
+/* DFS required on channel for 2nd segment of VHT160 and VHT80+80*/
+#define WMI_CHAN_FLAG_DFS_CFREQ2  (1 << 15)
 
 #define WMI_MAX_SPATIAL_STREAM        3 /* default max ss */
 
@@ -6478,7 +6480,19 @@
 	__le32 info0; /* WMI_PEER_ASSOC_INFO0_ */
 } __packed;
 
-#define PEER_BW_RXNSS_OVERRIDE_OFFSET  31
+#define BW_NSS_FWCONF_MAP_ENABLE	BIT(31)
+#define BW_NSS_FWCONF_MAP_160MHZ_LSB	(0)
+#define BW_NSS_FWCONF_MAP_160MHZ_MASK	(0x00000007)
+#define BW_NSS_FWCONF_MAP_80_80MHZ_LSB	(3)
+#define BW_NSS_FWCONF_MAP_80_80MHZ_MASK (0x00000038)
+#define BW_NSS_FWCONF_MAP_MASK		(0x0000003F)
+
+#define GET_BW_NSS_FWCONF_160(x)	(MS(x, BW_NSS_FWCONF_MAP_160MHZ) + 1)
+#define GET_BW_NSS_FWCONF_80_80(x)	(MS(x, BW_NSS_FWCONF_MAP_80_80MHZ) + 1)
+
+/* Values defined to set 160 MHz Bandwidth NSS Mapping into FW*/
+#define BW_NSS_FWCONF_160(x)		(BW_NSS_FWCONF_MAP_ENABLE | SM(x - 1, BW_NSS_FWCONF_MAP_160MHZ))
+#define BW_NSS_FWCONF_80_80(x)		(BW_NSS_FWCONF_MAP_ENABLE | SM(x - 1, BW_NSS_FWCONF_MAP_80_80MHZ))
 
 struct wmi_10_4_peer_assoc_complete_cmd {
 	struct wmi_10_2_peer_assoc_complete_cmd cmd;
@@ -7312,7 +7326,7 @@
 				      const struct wmi_start_scan_arg *arg);
 void ath10k_wmi_set_wmm_param(struct wmi_wmm_params *params,
 			      const struct wmi_wmm_params_arg *arg);
-void ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
+void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
 				const struct wmi_channel_arg *arg);
 int ath10k_wmi_start_scan_verify(const struct wmi_start_scan_arg *arg);
 
diff -ruw linux-5.4.60/drivers/net/wireless/ath/ath10k/wmi-tlv.c linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/wmi-tlv.c
--- linux-5.4.60/drivers/net/wireless/ath/ath10k/wmi-tlv.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/ath10k/wmi-tlv.c	2021-03-04 13:20:59.320838957 +0100
@@ -2063,7 +2063,7 @@
 	tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_CHANNEL);
 	tlv->len = __cpu_to_le16(sizeof(*ch));
 	ch = (void *)tlv->value;
-	ath10k_wmi_put_wmi_channel(ch, &arg->channel);
+	ath10k_wmi_put_wmi_channel(ar, ch, &arg->channel);
 
 	ptr += sizeof(*tlv);
 	ptr += sizeof(*ch);
@@ -2703,7 +2703,7 @@
 		tlv->len = __cpu_to_le16(sizeof(*ci));
 		ci = (void *)tlv->value;
 
-		ath10k_wmi_put_wmi_channel(ci, ch);
+		ath10k_wmi_put_wmi_channel(ar, ci, ch);
 
 		chans += sizeof(*tlv);
 		chans += sizeof(*ci);
@@ -3404,7 +3404,7 @@
 		tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_CHANNEL);
 		tlv->len = __cpu_to_le16(sizeof(*chan));
 		chan = (void *)tlv->value;
-		ath10k_wmi_put_wmi_channel(chan, &chan_arg[i]);
+		ath10k_wmi_put_wmi_channel(ar, chan, &chan_arg[i]);
 
 		ptr += sizeof(*tlv);
 		ptr += sizeof(*chan);
diff -ruw linux-5.4.60/drivers/net/wireless/ath/ath.h linux-5.4.60-fbx/drivers/net/wireless/ath/ath.h
--- linux-5.4.60/drivers/net/wireless/ath/ath.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/ath.h	2021-03-04 13:20:59.314172291 +0100
@@ -184,6 +184,8 @@
 
 	int last_rssi;
 	struct ieee80211_supported_band sbands[NUM_NL80211_BANDS];
+
+	int dfs_pulse_valid_diff_ts;
 };
 
 static inline const struct ath_ps_ops *ath_ps_ops(struct ath_common *common)
diff -ruw linux-5.4.60/drivers/net/wireless/ath/dfs_pattern_detector.c linux-5.4.60-fbx/drivers/net/wireless/ath/dfs_pattern_detector.c
--- linux-5.4.60/drivers/net/wireless/ath/dfs_pattern_detector.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/dfs_pattern_detector.c	2021-03-04 13:20:59.344172292 +0100
@@ -273,6 +273,7 @@
 {
 	u32 i;
 	struct channel_detector *cd;
+	int diff_ts;
 
 	/*
 	 * pulses received for a non-supported or un-initialized
@@ -285,8 +286,9 @@
 	if (cd == NULL)
 		return false;
 
+	diff_ts = event->ts - dpd->last_pulse_ts;
 	/* reset detector on time stamp wraparound, caused by TSF reset */
-	if (event->ts < dpd->last_pulse_ts)
+	if (diff_ts < dpd->common->dfs_pulse_valid_diff_ts)
 		dpd_reset(dpd);
 	dpd->last_pulse_ts = event->ts;
 
diff -ruw linux-5.4.60/drivers/net/wireless/ath/dfs_pattern_detector.h linux-5.4.60-fbx/drivers/net/wireless/ath/dfs_pattern_detector.h
--- linux-5.4.60/drivers/net/wireless/ath/dfs_pattern_detector.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/dfs_pattern_detector.h	2021-03-04 13:20:59.344172292 +0100
@@ -24,7 +24,7 @@
 /* tolerated deviation of radar time stamp in usecs on both sides
  * TODO: this might need to be HW-dependent
  */
-#define PRI_TOLERANCE	16
+#define PRI_TOLERANCE	6
 
 /**
  * struct ath_dfs_pool_stats - DFS Statistics for global pools
diff -ruw linux-5.4.60/drivers/net/wireless/ath/Kconfig linux-5.4.60-fbx/drivers/net/wireless/ath/Kconfig
--- linux-5.4.60/drivers/net/wireless/ath/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/Kconfig	2021-03-04 13:20:59.310838957 +0100
@@ -37,6 +37,9 @@
 	 This option enables tracepoints for atheros wireless drivers.
 	 Currently, ath9k makes use of this facility.
 
+config ATH_REG_IGNORE
+	bool "ignore all eeprom regulation"
+
 config ATH_REG_DYNAMIC_USER_REG_HINTS
 	bool "Atheros dynamic user regulatory hints"
 	depends on CFG80211_CERTIFICATION_ONUS
diff -ruw linux-5.4.60/drivers/net/wireless/ath/key.c linux-5.4.60-fbx/drivers/net/wireless/ath/key.c
--- linux-5.4.60/drivers/net/wireless/ath/key.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/key.c	2021-03-04 13:20:59.344172292 +0100
@@ -524,7 +524,7 @@
 			idx = ath_reserve_key_cache_slot(common, key->cipher);
 			break;
 		default:
-			idx = key->keyidx;
+			idx = ath_reserve_key_cache_slot(common, key->cipher);
 			break;
 		}
 	} else if (key->keyidx) {
diff -ruw linux-5.4.60/drivers/net/wireless/ath/regd.c linux-5.4.60-fbx/drivers/net/wireless/ath/regd.c
--- linux-5.4.60/drivers/net/wireless/ath/regd.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/ath/regd.c	2021-03-04 13:20:59.344172292 +0100
@@ -345,6 +345,10 @@
 	struct ieee80211_channel *ch;
 	unsigned int i;
 
+#ifdef CONFIG_ATH_REG_IGNORE
+	return;
+#endif
+
 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
 		if (!wiphy->bands[band])
 			continue;
@@ -378,6 +382,10 @@
 {
 	struct ieee80211_supported_band *sband;
 
+#ifdef CONFIG_ATH_REG_IGNORE
+	return;
+#endif
+
 	sband = wiphy->bands[NL80211_BAND_2GHZ];
 	if (!sband)
 		return;
@@ -407,6 +415,9 @@
 	struct ieee80211_channel *ch;
 	unsigned int i;
 
+#ifdef CONFIG_ATH_REG_IGNORE
+	return;
+#endif
 	if (!wiphy->bands[NL80211_BAND_5GHZ])
 		return;
 
@@ -639,6 +650,11 @@
 	const struct ieee80211_regdomain *regd;
 
 	wiphy->reg_notifier = reg_notifier;
+
+#ifdef CONFIG_ATH_REG_IGNORE
+	return 0;
+#endif
+
 	wiphy->regulatory_flags |= REGULATORY_STRICT_REG |
 				   REGULATORY_CUSTOM_REG;
 
@@ -703,7 +719,7 @@
 	    regdmn == CTRY_DEFAULT) {
 		printk(KERN_DEBUG "ath: EEPROM indicates default "
 		       "country code should be used\n");
-		reg->country_code = CTRY_UNITED_STATES;
+		reg->country_code = CTRY_FRANCE;
 	}
 
 	if (reg->country_code == CTRY_DEFAULT) {
diff -ruw linux-5.4.60/drivers/net/wireless/marvell/Kconfig linux-5.4.60-fbx/drivers/net/wireless/marvell/Kconfig
--- linux-5.4.60/drivers/net/wireless/marvell/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/Kconfig	2021-03-04 13:20:59.414172295 +0100
@@ -25,4 +25,8 @@
 	  To compile this driver as a module, choose M here: the module
 	  will be called mwl8k.  If unsure, say N.
 
+config MWL8K_NEW
+	tristate "Marvell 88W8xxx PCI/PCIe NEW"
+	depends on MAC80211 && PCI
+
 endif # WLAN_VENDOR_MARVELL
diff -ruw linux-5.4.60/drivers/net/wireless/marvell/Makefile linux-5.4.60-fbx/drivers/net/wireless/marvell/Makefile
--- linux-5.4.60/drivers/net/wireless/marvell/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/Makefile	2021-03-04 13:20:59.414172295 +0100
@@ -5,3 +5,4 @@
 obj-$(CONFIG_MWIFIEX)	+= mwifiex/
 
 obj-$(CONFIG_MWL8K)	+= mwl8k.o
+obj-$(CONFIG_MWL8K_NEW)	+= mwl8k_new/
diff -ruw linux-5.4.60/drivers/nvmem/core.c linux-5.4.60-fbx/drivers/nvmem/core.c
--- linux-5.4.60/drivers/nvmem/core.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/nvmem/core.c	2021-03-04 13:20:59.504172299 +0100
@@ -396,8 +396,10 @@
 			     config->name ? config->id : nvmem->id);
 	}
 
+#ifndef CONFIG_NVMEM_IGNORE_RO
 	nvmem->read_only = device_property_present(config->dev, "read-only") ||
 			   config->read_only || !nvmem->reg_write;
+#endif
 
 	nvmem->dev.groups = nvmem_sysfs_get_groups(nvmem, config);
 
diff -ruw linux-5.4.60/drivers/nvmem/Kconfig linux-5.4.60-fbx/drivers/nvmem/Kconfig
--- linux-5.4.60/drivers/nvmem/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/nvmem/Kconfig	2021-03-04 13:20:59.504172299 +0100
@@ -24,6 +24,9 @@
 	 This interface is mostly used by userspace applications to
 	 read/write directly into nvmem.
 
+config NVMEM_IGNORE_RO
+	bool "ignore read-only flags"
+
 config NVMEM_IMX_IIM
 	tristate "i.MX IC Identification Module support"
 	depends on ARCH_MXC || COMPILE_TEST
diff -ruw linux-5.4.60/drivers/of/fdt.c linux-5.4.60-fbx/drivers/of/fdt.c
--- linux-5.4.60/drivers/of/fdt.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/of/fdt.c	2021-03-04 13:20:59.507505632 +0100
@@ -28,6 +28,7 @@
 
 #include <asm/setup.h>  /* for COMMAND_LINE_SIZE */
 #include <asm/page.h>
+#include <asm-generic/vmlinux.lds.h>
 
 #include "of_private.h"
 
@@ -745,6 +746,39 @@
 	return 0;
 }
 
+/*
+ * iterate list of built-in dtb to find a compatible match
+ */
+const void __init *of_fdt_find_compatible_dtb(const char *name)
+{
+	struct fdt_header {
+		__be32 magic;
+		__be32 totalsize;
+	};
+	const struct fdt_header *blob, *best;
+	unsigned int best_score = ~0;
+
+	best = NULL;
+	blob = (const struct fdt_header *)__dtb_start;
+	while ((void *)blob < (void *)__dtb_end &&
+	       (be32_to_cpu(blob->magic) == OF_DT_HEADER)) {
+		unsigned int score;
+		u32 size;
+
+		score = of_fdt_is_compatible(blob, 0, name);
+		if (score > 0 && score < best_score) {
+			best = blob;
+			best_score = score;
+		}
+
+		size = be32_to_cpu(blob->totalsize);
+		blob = (const struct fdt_header *)
+			PTR_ALIGN((void *)blob + size, STRUCT_ALIGNMENT);
+	}
+
+	return best;
+}
+
 /**
  * of_flat_dt_is_compatible - Return true if given node has compat in compatible list
  * @node: node to test
@@ -1040,6 +1074,40 @@
 	return 0;
 }
 
+#ifdef CONFIG_RANDOM_OF
+/*
+ * get random seed area from device tree, and reserve it early enough
+ * so that it remains untouched until we can properly add it to the
+ * entropy pool.
+ */
+extern u64 random_seed_start;
+extern u64 random_seed_size;
+
+static void __init early_init_dt_handle_random_seed(unsigned long node)
+{
+	const __be32 *prop;
+	int len;
+
+	prop = of_get_flat_dt_prop(node, "fbx,random-seed", &len);
+	if (!prop)
+		return;
+
+	if (len != 16) {
+		pr_err("bad fbx,random-seed size %d vs %d!\n", 16, len);
+		return ;
+	}
+
+	random_seed_start = dt_mem_next_cell(2, &prop);
+	random_seed_size = dt_mem_next_cell(2, &prop);
+
+	memblock_reserve(random_seed_start, random_seed_size);
+}
+#else
+static inline void early_init_dt_handle_random_seed(unsigned long node)
+{
+}
+#endif
+
 int __init early_init_dt_scan_chosen(unsigned long node, const char *uname,
 				     int depth, void *data)
 {
@@ -1092,6 +1160,8 @@
 				fdt_totalsize(initial_boot_params));
 	}
 
+	early_init_dt_handle_random_seed(node);
+
 	/* break now */
 	return 1;
 }
diff -ruw linux-5.4.60/drivers/of/Kconfig linux-5.4.60-fbx/drivers/of/Kconfig
--- linux-5.4.60/drivers/of/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/of/Kconfig	2021-03-04 13:20:59.504172299 +0100
@@ -35,6 +35,11 @@
 
 	  If unsure, say N here, but this option is safe to enable.
 
+config OF_DTB_BUILTIN_LIST
+	string "Link given list of DTB files into kernel"
+	help
+	  Specify filename without .dtb extension
+
 config OF_FLATTREE
 	bool
 	select DTC
@@ -103,6 +108,13 @@
 config OF_NUMA
 	bool
 
+config OF_CONFIGFS
+	bool "Device Tree Overlay ConfigFS interface"
+	select CONFIGFS_FS
+	select OF_OVERLAY
+	help
+	  Enable a simple user-space driven DT overlay interface.
+
 config OF_DMA_DEFAULT_COHERENT
 	# arches should select this if DMA is coherent by default for OF devices
 	bool
diff -ruw linux-5.4.60/drivers/of/Makefile linux-5.4.60-fbx/drivers/of/Makefile
--- linux-5.4.60/drivers/of/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/of/Makefile	2021-03-04 13:20:59.504172299 +0100
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-y = base.o device.o platform.o property.o
 obj-$(CONFIG_OF_KOBJ) += kobj.o
+obj-$(CONFIG_OF_CONFIGFS) += configfs.o
 obj-$(CONFIG_OF_DYNAMIC) += dynamic.o
 obj-$(CONFIG_OF_FLATTREE) += fdt.o
 obj-$(CONFIG_OF_EARLY_FLATTREE) += fdt_address.o
diff -ruw linux-5.4.60/drivers/of/of_net.c linux-5.4.60-fbx/drivers/of/of_net.c
--- linux-5.4.60/drivers/of/of_net.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/of/of_net.c	2021-03-04 13:20:59.507505632 +0100
@@ -11,6 +11,7 @@
 #include <linux/phy.h>
 #include <linux/export.h>
 #include <linux/device.h>
+#include <linux/fbxserial.h>
 
 /**
  * of_get_phy_mode - Get phy mode for given device_node
@@ -97,6 +98,13 @@
 const void *of_get_mac_address(struct device_node *np)
 {
 	const void *addr;
+#ifdef CONFIG_FBXSERIAL
+	struct property *pp;
+
+	pp = of_find_property(np, "fbxserial-mac-address", NULL);
+	if (pp && pp->length == 4)
+		return fbxserialinfo_get_mac_addr(be32_to_cpu(*(u32*)pp->value));
+#endif
 
 	addr = of_get_mac_addr(np, "mac-address");
 	if (addr)
diff -ruw linux-5.4.60/drivers/of/overlay.c linux-5.4.60-fbx/drivers/of/overlay.c
--- linux-5.4.60/drivers/of/overlay.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/of/overlay.c	2021-03-04 13:20:59.507505632 +0100
@@ -362,7 +362,7 @@
 	}
 
 	if (!of_node_check_flag(target->np, OF_OVERLAY))
-		pr_err("WARNING: memory leak will occur if overlay removed, property: %pOF/%s\n",
+		pr_debug("WARNING: memory leak will occur if overlay removed, property: %pOF/%s\n",
 		       target->np, new_prop->name);
 
 	if (ret) {
diff -ruw linux-5.4.60/drivers/pci/controller/dwc/pcie-armada8k.c linux-5.4.60-fbx/drivers/pci/controller/dwc/pcie-armada8k.c
--- linux-5.4.60/drivers/pci/controller/dwc/pcie-armada8k.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/pci/controller/dwc/pcie-armada8k.c	2021-03-04 13:20:59.514172300 +0100
@@ -22,9 +22,12 @@
 #include <linux/resource.h>
 #include <linux/of_pci.h>
 #include <linux/of_irq.h>
+#include <linux/gpio.h>
 
 #include "pcie-designware.h"
 
+#include "../../pci.h"
+
 #define ARMADA8K_PCIE_MAX_LANES PCIE_LNK_X4
 
 struct armada8k_pcie {
@@ -33,6 +36,7 @@
 	struct clk *clk_reg;
 	struct phy *phy[ARMADA8K_PCIE_MAX_LANES];
 	unsigned int phy_count;
+	struct gpio_descs *reset_gpios;
 };
 
 #define PCIE_VENDOR_REGS_OFFSET		0x8000
@@ -154,6 +158,57 @@
 	return 0;
 }
 
+static void armada8k_pcie_reset_port(struct pcie_port *pp)
+{
+	struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
+	struct armada8k_pcie *pcie = to_armada8k_pcie(pci);
+
+	/*
+	 * Power up a PCIe port.  PCIe requires the refclk to be
+	 * stable for 100µs
+	 *
+	 * prior to releasing PERST.  See table 2-4 in section 2.6.2
+	 * AC Specifications
+	 *
+	 * of the PCI Express Card Electromechanical Specification, 1.1.
+	 */
+	if (pcie->reset_gpios) {
+		struct gpio_descs *reset_gpios = pcie->reset_gpios;
+		u32 reset_udelay = PCI_PM_D3COLD_WAIT * 1000;
+		int i;
+		unsigned long values;
+
+		dev_info(pci->dev, "using %u gpio(s) to reset bus",
+			 reset_gpios->ndescs);
+
+		/*
+		 * explicitely assert reset.
+		 */
+		for (i = 0; i < reset_gpios->ndescs; i++)
+			__clear_bit(i, &values);
+
+		gpiod_set_array_value_cansleep(reset_gpios->ndescs,
+					       reset_gpios->desc,
+					       NULL,
+					       &values);
+
+		udelay(150);
+
+		/*
+		 * deassert reset.
+		 */
+		for (i = 0; i < reset_gpios->ndescs; i++)
+			__set_bit(i, &values);
+
+		gpiod_set_array_value_cansleep(reset_gpios->ndescs,
+					       reset_gpios->desc,
+					       NULL,
+					       &values);
+
+		msleep(reset_udelay / 1000);
+	}
+}
+
 static void armada8k_pcie_establish_link(struct armada8k_pcie *pcie)
 {
 	struct dw_pcie *pci = pcie->pci;
@@ -201,8 +256,13 @@
 	}
 
 	/* Wait until the link becomes active again */
+	if (dw_pcie_wait_for_link(pci)) {
+		dev_err(pci->dev, "Link not up after reconfiguration. "
+			"trying port  reset\n");
+		armada8k_pcie_reset_port(&pci->pp);
 	if (dw_pcie_wait_for_link(pci))
-		dev_err(pci->dev, "Link not up after reconfiguration\n");
+			dev_err(pci->dev, "Link not up after reset.\n");
+	}
 }
 
 static int armada8k_pcie_host_init(struct pcie_port *pp)
@@ -211,6 +271,7 @@
 	struct armada8k_pcie *pcie = to_armada8k_pcie(pci);
 
 	dw_pcie_setup_rc(pp);
+	armada8k_pcie_reset_port(pp);
 	armada8k_pcie_establish_link(pcie);
 
 	return 0;
@@ -294,6 +355,23 @@
 
 	pcie->pci = pci;
 
+	/* get reset gpios */
+	pcie->reset_gpios = devm_gpiod_get_array_optional(dev,
+							  "reset",
+							  GPIOD_OUT_LOW);
+	if (IS_ERR(pcie->reset_gpios)) {
+		ret = PTR_ERR(pcie->reset_gpios);
+		dev_err(dev, "failed to parse reset-gpios property: %d\n", ret);
+		return ret;
+	}
+
+	if (pcie->reset_gpios->ndescs > BITS_PER_LONG) {
+		dev_err(dev, "too may reset GPIOs given (%d), max %d is "
+			"supported.\n", pcie->reset_gpios->ndescs,
+			BITS_PER_LONG);
+		return -EINVAL;
+	}
+
 	pcie->clk = devm_clk_get(dev, NULL);
 	if (IS_ERR(pcie->clk))
 		return PTR_ERR(pcie->clk);
diff -ruw linux-5.4.60/drivers/pci/controller/dwc/pcie-designware-host.c linux-5.4.60-fbx/drivers/pci/controller/dwc/pcie-designware-host.c
--- linux-5.4.60/drivers/pci/controller/dwc/pcie-designware-host.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/pci/controller/dwc/pcie-designware-host.c	2021-03-04 13:20:59.514172300 +0100
@@ -79,7 +79,7 @@
 {
 	int i, pos, irq;
 	unsigned long val;
-	u32 status, num_ctrls;
+	u32 num_ctrls;
 	irqreturn_t ret = IRQ_NONE;
 
 	num_ctrls = pp->num_vectors / MAX_MSI_IRQS_PER_CTRL;
@@ -87,14 +87,14 @@
 	for (i = 0; i < num_ctrls; i++) {
 		dw_pcie_rd_own_conf(pp, PCIE_MSI_INTR0_STATUS +
 					(i * MSI_REG_CTRL_BLOCK_SIZE),
-				    4, &status);
-		if (!status)
+				    4, (unsigned int *)&val);
+		if (!val)
 			continue;
 
 		ret = IRQ_HANDLED;
-		val = status;
 		pos = 0;
-		while ((pos = find_next_bit(&val, MAX_MSI_IRQS_PER_CTRL,
+		while ((pos = find_next_bit(&val,
+					    MAX_MSI_IRQS_PER_CTRL,
 					    pos)) != MAX_MSI_IRQS_PER_CTRL) {
 			irq = irq_find_mapping(pp->irq_domain,
 					       (i * MAX_MSI_IRQS_PER_CTRL) +
diff -ruw linux-5.4.60/drivers/pci/controller/Kconfig linux-5.4.60-fbx/drivers/pci/controller/Kconfig
--- linux-5.4.60/drivers/pci/controller/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/pci/controller/Kconfig	2021-03-04 13:20:59.514172300 +0100
@@ -265,6 +265,11 @@
 	  This can lead to data corruption if drivers perform concurrent
 	  config and MMIO accesses.
 
+config PCIE_BCM63XX
+	tristate "BCM63XX SoCs PCIe endpoint driver."
+	depends on ARCH_BCM63XX || COMPILE_TEST
+	depends on OF
+
 config VMD
 	depends on PCI_MSI && X86_64 && SRCU
 	select X86_DEV_DMA_OPS
diff -ruw linux-5.4.60/drivers/pci/controller/Makefile linux-5.4.60-fbx/drivers/pci/controller/Makefile
--- linux-5.4.60/drivers/pci/controller/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/pci/controller/Makefile	2021-03-04 13:20:59.514172300 +0100
@@ -29,6 +29,7 @@
 obj-$(CONFIG_PCIE_MEDIATEK) += pcie-mediatek.o
 obj-$(CONFIG_PCIE_MOBIVEIL) += pcie-mobiveil.o
 obj-$(CONFIG_PCIE_TANGO_SMP8759) += pcie-tango.o
+obj-$(CONFIG_PCIE_BCM63XX) += pcie-bcm63xx.o
 obj-$(CONFIG_VMD) += vmd.o
 # pcie-hisi.o quirks are needed even without CONFIG_PCIE_DW
 obj-y				+= dwc/
diff -ruw linux-5.4.60/drivers/pci/quirks.c linux-5.4.60-fbx/drivers/pci/quirks.c
--- linux-5.4.60/drivers/pci/quirks.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/pci/quirks.c	2021-03-04 13:20:59.527505633 +0100
@@ -3083,6 +3083,8 @@
 	dev->is_hotplug_bridge = 1;
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_HINT, 0x0020, quirk_hotplug_bridge);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_PERICOM, PCI_DEVICE_ID_PI7C9X20303SL,
+			 quirk_hotplug_bridge);
 
 /*
  * This is a quirk for the Ricoh MMC controller found as a part of some
diff -ruw linux-5.4.60/drivers/phy/broadcom/Kconfig linux-5.4.60-fbx/drivers/phy/broadcom/Kconfig
--- linux-5.4.60/drivers/phy/broadcom/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/phy/broadcom/Kconfig	2021-03-04 13:20:59.537505634 +0100
@@ -29,6 +29,11 @@
 	help
 	  Enable this to support the Broadcom Kona USB 2.0 PHY.
 
+config PHY_BRCM_USB_63138
+	tristate "Broadcom 63138 USB 2.0/3.0 PHY Driver"
+	depends on ARCH_BCM_63XX || COMPILE_TEST
+	select GENERIC_PHY
+
 config PHY_BCM_NS_USB2
 	tristate "Broadcom Northstar USB 2.0 PHY Driver"
 	depends on ARCH_BCM_IPROC || COMPILE_TEST
diff -ruw linux-5.4.60/drivers/phy/broadcom/Makefile linux-5.4.60-fbx/drivers/phy/broadcom/Makefile
--- linux-5.4.60/drivers/phy/broadcom/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/phy/broadcom/Makefile	2021-03-04 13:20:59.537505634 +0100
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_PHY_CYGNUS_PCIE)		+= phy-bcm-cygnus-pcie.o
+obj-$(CONFIG_PHY_BRCM_USB_63138)	+= phy-brcm-usb-63138.o
 obj-$(CONFIG_BCM_KONA_USB2_PHY)		+= phy-bcm-kona-usb2.o
 obj-$(CONFIG_PHY_BCM_NS_USB2)		+= phy-bcm-ns-usb2.o
 obj-$(CONFIG_PHY_BCM_NS_USB3)		+= phy-bcm-ns-usb3.o
diff -ruw linux-5.4.60/drivers/phy/Kconfig linux-5.4.60-fbx/drivers/phy/Kconfig
--- linux-5.4.60/drivers/phy/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/phy/Kconfig	2021-03-04 13:20:59.537505634 +0100
@@ -49,6 +49,10 @@
 	help
 	  This option enables support for APM X-Gene SoC multi-purpose PHY.
 
+config XDSL_PHY_API
+	tristate "xDSL PHY API"
+	select GENERIC_PHY
+
 source "drivers/phy/allwinner/Kconfig"
 source "drivers/phy/amlogic/Kconfig"
 source "drivers/phy/broadcom/Kconfig"
diff -ruw linux-5.4.60/drivers/phy/Makefile linux-5.4.60-fbx/drivers/phy/Makefile
--- linux-5.4.60/drivers/phy/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/phy/Makefile	2021-03-04 13:20:59.537505634 +0100
@@ -8,6 +8,8 @@
 obj-$(CONFIG_PHY_LPC18XX_USB_OTG)	+= phy-lpc18xx-usb-otg.o
 obj-$(CONFIG_PHY_XGENE)			+= phy-xgene.o
 obj-$(CONFIG_PHY_PISTACHIO_USB)		+= phy-pistachio-usb.o
+obj-$(CONFIG_XDSL_PHY_API)		+= xdsl_phy_api.o
+
 obj-$(CONFIG_ARCH_SUNXI)		+= allwinner/
 obj-$(CONFIG_ARCH_MESON)		+= amlogic/
 obj-$(CONFIG_ARCH_MEDIATEK)		+= mediatek/
diff -ruw linux-5.4.60/drivers/phy/marvell/Kconfig linux-5.4.60-fbx/drivers/phy/marvell/Kconfig
--- linux-5.4.60/drivers/phy/marvell/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/phy/marvell/Kconfig	2021-03-04 13:20:59.540838967 +0100
@@ -103,3 +103,11 @@
 	  The PHY driver will be used by Marvell udc/ehci/otg driver.
 
 	  To compile this driver as a module, choose M here.
+
+config PHY_UTMI_CP110
+	bool "Marvell CP110 UTMI PHY Driver"
+	depends on ARCH_MVEBU
+	depends on OF
+	help
+	  Enable this to support Marvell USB2.0 PHY driver for Marvell
+	  CP110-based SoCs (A7K and A8K).
diff -ruw linux-5.4.60/drivers/phy/marvell/Makefile linux-5.4.60-fbx/drivers/phy/marvell/Makefile
--- linux-5.4.60/drivers/phy/marvell/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/phy/marvell/Makefile	2021-03-04 13:20:59.540838967 +0100
@@ -10,3 +10,4 @@
 obj-$(CONFIG_PHY_PXA_28NM_HSIC)		+= phy-pxa-28nm-hsic.o
 obj-$(CONFIG_PHY_PXA_28NM_USB2)		+= phy-pxa-28nm-usb2.o
 obj-$(CONFIG_PHY_PXA_USB)		+= phy-pxa-usb.o
+obj-$(CONFIG_PHY_UTMI_CP110)		+= phy-utmi-cp110.o
diff -ruw linux-5.4.60/drivers/phy/marvell/phy-mvebu-cp110-comphy.c linux-5.4.60-fbx/drivers/phy/marvell/phy-mvebu-cp110-comphy.c
--- linux-5.4.60/drivers/phy/marvell/phy-mvebu-cp110-comphy.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/phy/marvell/phy-mvebu-cp110-comphy.c	2021-03-30 15:48:29.471719189 +0200
@@ -32,6 +32,7 @@
 #define     MVEBU_COMPHY_SERDES_CFG1_RF_RESET	BIT(6)
 #define MVEBU_COMPHY_SERDES_CFG2(n)		(0x8 + (n) * 0x1000)
 #define     MVEBU_COMPHY_SERDES_CFG2_DFE_EN	BIT(4)
+#define     MVEBU_COMPHY_SERDES_CFG2_SSC_EN	BIT(7)
 #define MVEBU_COMPHY_SERDES_STATUS0(n)		(0x18 + (n) * 0x1000)
 #define     MVEBU_COMPHY_SERDES_STATUS0_TX_PLL_RDY	BIT(2)
 #define     MVEBU_COMPHY_SERDES_STATUS0_RX_PLL_RDY	BIT(3)
@@ -49,7 +50,9 @@
 #define     MVEBU_COMPHY_COEF_DFE_CTRL		BIT(15)
 #define MVEBU_COMPHY_GEN1_S0(n)			(0x834 + (n) * 0x1000)
 #define     MVEBU_COMPHY_GEN1_S0_TX_AMP(n)	((n) << 1)
+#define     MVEBU_COMPHY_GEN1_S0_TX_AMP_ADJ	BIT(6)
 #define     MVEBU_COMPHY_GEN1_S0_TX_EMPH(n)	((n) << 7)
+#define     MVEBU_COMPHY_GEN1_S0_TX_EMPH_EN	BIT(11)
 #define MVEBU_COMPHY_GEN1_S1(n)			(0x838 + (n) * 0x1000)
 #define     MVEBU_COMPHY_GEN1_S1_RX_MUL_PI(n)	((n) << 0)
 #define     MVEBU_COMPHY_GEN1_S1_RX_MUL_PF(n)	((n) << 3)
@@ -57,21 +60,66 @@
 #define     MVEBU_COMPHY_GEN1_S1_RX_MUL_FF(n)	((n) << 8)
 #define     MVEBU_COMPHY_GEN1_S1_RX_DFE_EN	BIT(10)
 #define     MVEBU_COMPHY_GEN1_S1_RX_DIV(n)	((n) << 11)
+#define MVEBU_COMPHY_GEN2_S0(n)			(0x83c + (n) * 0x1000)
+#define     MVEBU_COMPHY_GEN2_S0_TX_AMP(n)	((n) << 1)
+#define     MVEBU_COMPHY_GEN2_S0_TX_AMP_ADJ	BIT(6)
+#define     MVEBU_COMPHY_GEN2_S0_TX_EMPH(n)	((n) << 7)
+#define     MVEBU_COMPHY_GEN2_S0_TX_EMPH_EN	BIT(11)
+#define MVEBU_COMPHY_GEN2_S1(n)			(0x840 + (n) * 0x1000)
+#define     MVEBU_COMPHY_GEN2_S1_RX_MUL_PI(n)	((n) << 0)
+#define     MVEBU_COMPHY_GEN2_S1_RX_MUL_PF(n)	((n) << 3)
+#define     MVEBU_COMPHY_GEN2_S1_RX_MUL_FI(n)	((n) << 6)
+#define     MVEBU_COMPHY_GEN2_S1_RX_MUL_FF(n)	((n) << 8)
+#define     MVEBU_COMPHY_GEN2_S1_RX_DFE_EN	BIT(10)
+#define     MVEBU_COMPHY_GEN2_S1_RX_DIV(n)	((n) << 11)
+#define MVEBU_COMPHY_GEN3_S0(n)			(0x844 + (n) * 0x1000)
+#define     MVEBU_COMPHY_GEN3_S0_TX_AMP(n)		((n) << 1)
+#define     MVEBU_COMPHY_GEN3_S0_TX_AMP_ADJ		BIT(6)
+#define     MVEBU_COMPHY_GEN3_S0_TX_EMPH(n)		((n) << 7)
+#define     MVEBU_COMPHY_GEN3_S0_TX_EMPH_EN		BIT(11)
+#define     MVEBU_COMPHY_GEN3_S0_TX_SLEW_RATE_SEL(n)	((n) << 12)
+#define     MVEBU_COMPHY_GEN3_S0_TX_SLEW_CTRL_EN	BIT(15)
+#define MVEBU_COMPHY_GEN3_S1(n)			(0x848 + (n) * 0x1000)
+#define     MVEBU_COMPHY_GEN3_S1_RX_MUL_PI(n)	((n) << 0)
+#define     MVEBU_COMPHY_GEN3_S1_RX_MUL_PF(n)	((n) << 3)
+#define     MVEBU_COMPHY_GEN3_S1_RX_MUL_FI(n)	((n) << 6)
+#define     MVEBU_COMPHY_GEN3_S1_RX_MUL_FF(n)	((n) << 8)
+#define     MVEBU_COMPHY_GEN3_S1_RX_DFE_EN	BIT(10)
+#define     MVEBU_COMPHY_GEN3_S1_RX_DIV(n)	((n) << 11)
+#define     MVEBU_COMPHY_GEN3_S1_SMPL_INPX2_EN	BIT(13)
 #define MVEBU_COMPHY_GEN1_S2(n)			(0x8f4 + (n) * 0x1000)
 #define     MVEBU_COMPHY_GEN1_S2_TX_EMPH(n)	((n) << 0)
 #define     MVEBU_COMPHY_GEN1_S2_TX_EMPH_EN	BIT(4)
 #define MVEBU_COMPHY_LOOPBACK(n)		(0x88c + (n) * 0x1000)
 #define     MVEBU_COMPHY_LOOPBACK_DBUS_WIDTH(n)	((n) << 1)
+#define MVEBU_COMPHY_SYNC_PATTERN(n)		(0x890 + (n) * 0x1000)
+#define     MVEBU_COMPHY_SYNC_PATTERN_RXD_INV	BIT(11)
+#define     MVEBU_COMPHY_SYNC_PATTERN_TXD_INV	BIT(10)
+#define MVEBU_COMPHY_INTERFACE(n)		(0x894 + (n) * 0x1000)
+#define	    MVEBU_COMPHY_INTERFACE_GEN_MAX(n)	((n) << 10)
+#define     MVEBU_COMPHY_INTERFACE_DET_BYPASS	BIT(12)
+#define     MVEBU_COMPHY_INTERFACE_LINK_TRAIN	BIT(14)
 #define MVEBU_COMPHY_VDD_CAL0(n)		(0x908 + (n) * 0x1000)
 #define     MVEBU_COMPHY_VDD_CAL0_CONT_MODE	BIT(15)
 #define MVEBU_COMPHY_EXT_SELV(n)		(0x914 + (n) * 0x1000)
 #define     MVEBU_COMPHY_EXT_SELV_RX_SAMPL(n)	((n) << 5)
+#define MVEBU_COMPHY_PCIE_REG0(n)		(0x920 + (n) * 0x1000)
+#define     MVEBU_COMPHY_PCIE_REG0_IDLE_SYNC	BIT(12)
+#define     MVEBU_COMPHY_PCIE_REG0_SEL_BITS(n)	((n) << 13)
+#define MVEBU_COMPHY_LANE_ALIGN(n)		(0x924 + (n) * 0x1000)
+#define     MVEBU_COMPHY_LANE_ALIGN_BIT		BIT(12)
 #define MVEBU_COMPHY_MISC_CTRL0(n)		(0x93c + (n) * 0x1000)
+#define     MVEBU_COMPHY_MISC_CTRL0_CLK100M_125M	BIT(4)
 #define     MVEBU_COMPHY_MISC_CTRL0_ICP_FORCE	BIT(5)
+#define     MVEBU_COMPHY_MISC_CTRL0_TXDCLK_2X		BIT(6)
+#define     MVEBU_COMPHY_MISC_CTRL0_CLK500M_EN		BIT(7)
 #define     MVEBU_COMPHY_MISC_CTRL0_REFCLK_SEL	BIT(10)
 #define MVEBU_COMPHY_RX_CTRL1(n)		(0x940 + (n) * 0x1000)
 #define     MVEBU_COMPHY_RX_CTRL1_RXCLK2X_SEL	BIT(11)
 #define     MVEBU_COMPHY_RX_CTRL1_CLK8T_EN	BIT(12)
+#define MVEBU_COMPHY_PWR_CTR(n)			(0x948 + (n) * 0x1000)
+#define     MVEBU_COMPHY_PWR_CTR_RST_DFE	BIT(0)
+#define     MVEBU_COMPHY_PWR_CTR_SOFT_RST	BIT(10)
 #define MVEBU_COMPHY_SPEED_DIV(n)		(0x954 + (n) * 0x1000)
 #define     MVEBU_COMPHY_SPEED_DIV_TX_FORCE	BIT(7)
 #define MVEBU_SP_CALIB(n)			(0x96c + (n) * 0x1000)
@@ -81,7 +129,21 @@
 #define     MVEBU_COMPHY_TX_SLEW_RATE_EMPH(n)	((n) << 5)
 #define     MVEBU_COMPHY_TX_SLEW_RATE_SLC(n)	((n) << 10)
 #define MVEBU_COMPHY_DTL_CTRL(n)		(0x984 + (n) * 0x1000)
+#define     MVEBU_COMPHY_DTL_CTRL_DTL_DET_EN		BIT(0)
+#define     MVEBU_COMPHY_DTL_CTRL_DTL_PLOOP_EN		BIT(1)
 #define     MVEBU_COMPHY_DTL_CTRL_DTL_FLOOP_EN	BIT(2)
+#define     MVEBU_COMPHY_DTL_CTRL_DTL_CLAMP_SEL(n)	((n) << 4)
+#define     MVEBU_COMPHY_DTL_CTRL_DTL_INPCLK_DIV_FORCE	BIT(10)
+#define     MVEBU_COMPHY_DTL_CTRL_DTL_CLK_MODE(n)	((n) << 12)
+#define     MVEBU_COMPHY_DTL_CTRL_DTL_CLK_MODE_FORCE	BIT(14)
+#define MVEBU_COMPHY_PHASE_CTRL(n)		(0x988 + (n) * 0x1000)
+#define     MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF(n)	((n) << 0)
+#define     MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF_FORCE	BIT(7)
+#define     MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF_VALID	BIT(8)
+#define MVEBU_COMPHY_TX_TRAIN_CTRL(n)		(0xa6c + (n) * 0x1000)
+#define     MVEBU_COMPHY_TX_TRAIN_CTRL_G1	BIT(0)
+#define     MVEBU_COMPHY_TX_TRAIN_CTRL_GN1	BIT(1)
+#define     MVEBU_COMPHY_TX_TRAIN_CTRL_G0	BIT(2)
 #define MVEBU_COMPHY_FRAME_DETECT0(n)		(0xa14 + (n) * 0x1000)
 #define     MVEBU_COMPHY_FRAME_DETECT0_PATN(n)	((n) << 7)
 #define MVEBU_COMPHY_FRAME_DETECT3(n)		(0xa20 + (n) * 0x1000)
@@ -90,24 +152,100 @@
 #define     MVEBU_COMPHY_DME_ETH_MODE		BIT(7)
 #define MVEBU_COMPHY_TRAINING0(n)		(0xa68 + (n) * 0x1000)
 #define     MVEBU_COMPHY_TRAINING0_P2P_HOLD	BIT(15)
+#define MVEBU_COMPHY_TRAINING4(n)		(0xa78 + (n) * 0x1000)
+#define     MVEBU_COMPHY_TRAINING4_TIMER(n)	((n) << 0)
 #define MVEBU_COMPHY_TRAINING5(n)		(0xaa4 + (n) * 0x1000)
 #define	    MVEBU_COMPHY_TRAINING5_RX_TIMER(n)	((n) << 0)
+#define     MVEBU_COMPHY_TRAINING5_START_SQ_EN	BIT(11)
+#define     MVEBU_COMPHY_TRAINING5_FRM_DET_EN	BIT(12)
+#define     MVEBU_COMPHY_TRAINING5_FRM_LOCK_EN	BIT(13)
+#define     MVEBU_COMPHY_TRAINING5_WAIT_TIME_EN	BIT(14)
 #define MVEBU_COMPHY_TX_TRAIN_PRESET(n)		(0xb1c + (n) * 0x1000)
+#define     MVEBU_COMPHY_TX_TRAIN_CHK_INIT		BIT(4)
+#define     MVEBU_COMPHY_TX_TRAIN_COEF_FM_PIN_PCIE3	BIT(7)
 #define     MVEBU_COMPHY_TX_TRAIN_PRESET_16B_AUTO_EN	BIT(8)
 #define     MVEBU_COMPHY_TX_TRAIN_PRESET_PRBS11		BIT(9)
+#define MVEBU_COMPHY_CDR_CONTROL(n)			(0xc18 + (n) * 0x1000)
+#define     MVEBU_COMPHY_CDR_CONTROL_RX_MAX_DFE_ADAPT_1(n)	((n) << 12)
+#define     MVEBU_COMPHY_CDR_CONTROL_MAX_DFE_ADAPT_0(n)		((n) << 9)
+#define     MVEBU_COMPHY_CDR_CONTROL_MAX_DFE_ADAPT_1(n)		((n) << 6)
+#define MVEBU_COMPHY_TX_TRAINING11(n)	(0xc38 + (n) * 0x1000)
+#define     MVEBU_COMPHY_TX_TRAINING11_CHECK_MODE	BIT(6)
+#define     MVEBU_COMPHY_TX_TRAINING11_PRESET_NUM(n)	((n) << 10)
+#define     MVEBU_COMPHY_TX_TRAINING11_PRESET_EN	BIT(15)
 #define MVEBU_COMPHY_GEN1_S3(n)			(0xc40 + (n) * 0x1000)
+#define     MVEBU_COMPHY_GEN1_S3_FFE_CAP_SEL(n)		((n) << 0)
+#define     MVEBU_COMPHY_GEN1_S3_FFE_RES_SEL(n)		((n) << 4)
+#define     MVEBU_COMPHY_GEN1_S3_SETTING_FORCE		BIT(7)
 #define     MVEBU_COMPHY_GEN1_S3_FBCK_SEL	BIT(9)
+#define     MVEBU_COMPHY_GEN1_S3_FFE_DEG_RES_LVL(n)	((n) << 12)
+#define     MVEBU_COMPHY_GEN1_S3_FFE_LOAD_RES_LVL(n)	((n) << 14)
 #define MVEBU_COMPHY_GEN1_S4(n)			(0xc44 + (n) * 0x1000)
 #define	    MVEBU_COMPHY_GEN1_S4_DFE_RES(n)	((n) << 8)
+#define MVEBU_COMPHY_GEN2_S4(n)			(0xc4c + (n) * 0x1000)
+#define	    MVEBU_COMPHY_GEN2_S4_DFE_RES(n)	((n) << 8)
+#define MVEBU_COMPHY_GEN3_S3(n)			(0xc50 + (n) * 0x1000)
+#define     MVEBU_COMPHY_GEN3_S3_FFE_CAP_SEL(n)		((n) << 0)
+#define     MVEBU_COMPHY_GEN3_S3_FFE_RES_SEL(n)		((n) << 4)
+#define     MVEBU_COMPHY_GEN3_S3_SETTING_FORCE		BIT(7)
+#define     MVEBU_COMPHY_GEN3_S3_FBCK_SEL		BIT(9)
+#define     MVEBU_COMPHY_GEN3_S3_FFE_DEG_RES_LVL(n)	((n) << 12)
+#define     MVEBU_COMPHY_GEN3_S3_FFE_LOAD_RES_LVL(n)	((n) << 14)
+#define MVEBU_COMPHY_GEN3_S4(n)			(0xc54 + (n) * 0x1000)
+#define     MVEBU_COMPHY_GEN3_S4_DFE_RES(n)	((n) << 8)
 #define MVEBU_COMPHY_TX_PRESET(n)		(0xc68 + (n) * 0x1000)
 #define     MVEBU_COMPHY_TX_PRESET_INDEX(n)	((n) << 0)
+#define MVEBU_COMPHY_DFE_CTRL(n)		(0xc70 + (n) * 0x1000)
+#define     MVEBU_COMPHY_DFE_CTRL_TX_MAX_DFE_ADAPT(n)	((n) << 14)
+#define MVEBU_COMPHY_DFE_CTRL_28(n)		(0xc9c + (n) * 0x1000)
+#define     MVEBU_COMPHY_DFE_CTRL_28_PIPE4	BIT(7)
 #define MVEBU_COMPHY_GEN1_S5(n)			(0xd38 + (n) * 0x1000)
 #define     MVEBU_COMPHY_GEN1_S5_ICP(n)		((n) << 0)
+#define MVEBU_COMPHY_GEN3_S5(n)			(0xd48 + (n) * 0x1000)
+#define     MVEBU_COMPHY_GEN3_S5_ICP(n)		((n) << 0)
+#define MVEBU_COMPHY_LANE_CFG0(n)		(0xe00 + (n) * 0x1000)
+#define      MVEBU_COMPHY_LANE_CFG0_PRD_TXEEMPH0	BIT(0)
+#define MVEBU_COMPHY_LANE_STATUS0(n)		(0xe0c + (n) * 0x1000)
+#define      MVEBU_COMPHY_LANE_STATUS0_PCLK_EN	BIT(0)
+#define MVEBU_COMPHY_LANE_CFG4(n)		(0xe20 + (n) * 0x1000)
+#define      MVEBU_COMPHY_LANE_CFG4_DFE_CTRL(n)	((n) << 0)
+#define      MVEBU_COMPHY_LANE_CFG4_DFE_EN_SEL	BIT(3)
+#define      MVEBU_COMPHY_LANE_CFG4_DFE_OVER	BIT(6)
+#define      MVEBU_COMPHY_LANE_CFG4_DFE_SSC	BIT(7)
+#define MVEBU_COMPHY_EQ_CONFIG0(n)		(0xe9c + (n) * 0x1000)
+#define      MVEBU_COMPHY_EQ_CONFIG0_RC_MODE	BIT(12)
+#define MVEBU_COMPHY_LANE_EQ_CFG1(n)		(0xea0 + (n) * 0x1000)
+#define      MVEBU_COMPHY_LANE_EQ_CFG1_UPDATE_POLARITY	BIT(12)
+#define MVEBU_COMPHY_LANE_EQ_REMOTE_CFG(n)	(0xef8 + (n) * 0x1000)
+#define      MVEBU_COMPHY_LANE_EQ_REMOTE_CFG_DIRN_OVERRIDE	BIT(0)
+#define      MVEBU_COMPHY_LANE_EQ_REMOTE_CFG_ONLY_MODE		BIT(1)
+#define      MVEBU_COMPHY_LANE_EQ_REMOTE_CFG_PRESET_VECTOR(n)	((n) << 2)
+#define MVEBU_COMPHY_PIPE_RST_CLK_CTRL(n)	(0xf04 + (n) * 0x1000)
+#define     MVEBU_COMPHY_PIPE_RST_CLK_CTRL_RST		BIT(0)
+#define     MVEBU_COMPHY_PIPE_RST_CLK_CTRL_FIXED_PCLK	BIT(2)
+#define     MVEBU_COMPHY_PIPE_RST_CLK_CTRL_PIPE_WIDTH	BIT(3)
+#define     MVEBU_COMPHY_PIPE_RST_CLK_CTRL_FREQ_SEL	BIT(9)
+#define MVEBU_COMPHY_MODE_CTRL(n)		(0xf08 + (n) * 0x1000)
+#define     MVEBU_COMPHY_MODE_CTRL_MODE_MARGIN	BIT(2)
+#define MVEBU_COMPHY_PIPE_CLK_SRC_LO(n)		(0xf0c + (n) * 0x1000)
+#define     MVEBU_COMPHY_PIPE_CLK_SRC_LO_PERIOD_SEL		BIT(1)
+#define     MVEBU_COMPHY_PIPE_CLK_SRC_LO_PERIOD_SCALE(n)	((n) << 2)
+#define     MVEBU_COMPHY_PIPE_CLK_SRC_LO_PLL_RDY_DL(n)	((n) << 5)
+#define MVEBU_COMPHY_PIPE_CLK_SRC_HI(n)		(0xf10 + (n) * 0x1000)
+#define     MVEBU_COMPHY_PIPE_CLK_SRC_HI_LANE_START	BIT(0)
+#define     MVEBU_COMPHY_PIPE_CLK_SRC_HI_LANE_BREAK	BIT(1)
+#define     MVEBU_COMPHY_PIPE_CLK_SRC_HI_LANE_MASTER	BIT(2)
+#define     MVEBU_COMPHY_PIPE_CLK_SRC_HI_MODE_PIPE	BIT(7)
+#define MVEBU_COMPHY_PIPE_PM_CTRL(n)		(0xf40 + (n) * 0x1000)
+#define     MVEBU_COMPHY_PIPE_PM_CTRL_RDLOZ_WAIT(n)	((n) << 0)
 
 /* Relative to priv->regmap */
 #define MVEBU_COMPHY_CONF1(n)			(0x1000 + (n) * 0x28)
 #define     MVEBU_COMPHY_CONF1_PWRUP		BIT(1)
 #define     MVEBU_COMPHY_CONF1_USB_PCIE		BIT(2)	/* 0: Ethernet/SATA */
+#define     MVEBU_COMPHY_CONF1_POR		BIT(14)
+#define     MVEBU_COMPHY_CONF1_CORE_RESET	BIT(13)
+#define     MVEBU_COMPHY_CONF1_PHY_MODE_USB	BIT(15) /* 1: USB */
 #define MVEBU_COMPHY_CONF6(n)			(0x1014 + (n) * 0x28)
 #define     MVEBU_COMPHY_CONF6_40B		BIT(18)
 #define MVEBU_COMPHY_SELECTOR			0x1140
@@ -117,6 +255,20 @@
 #define MVEBU_COMPHY_SD1_CTRL1			0x1148
 #define     MVEBU_COMPHY_SD1_CTRL1_RXAUI1_EN	BIT(26)
 #define     MVEBU_COMPHY_SD1_CTRL1_RXAUI0_EN	BIT(27)
+#define     MVEBU_COMPHY_SD1_CTRL1_PCIE_X2_EN	BIT(25)
+#define     MVEBU_COMPHY_SD1_CTRL1_PCIE_X4_EN	BIT(24)
+#define     MVEBU_COMPHY_SD1_CTRL1_PHY0_3_MASK	0xffff
+#define     MVEBU_COMPHY_SD1_CTRL1_PHY0_1_MASK	0x00ff
+
+/* Relative to priv->cp_mgmt_regmap */
+#define DEVICE_SAR0				0x200
+#define     DEV_SAR0_PCIE1_CLK_CP0		BIT(3)
+#define     DEV_SAR0_PCIE0_CLK_CP0		BIT(2)
+#define     DEV_SAR0_PCIE1_CLK_CP1		BIT(1)
+#define     DEV_SAR0_PCIE0_CLK_CP1		BIT(0)
+#define DEVICE_SAR1				0x204
+#define DFX_DEV_GEN_CTRL12			0x280
+#define     DFX_DEV_GEN_CTRL12_CLK_SRC(n)	((n) << 7)
 
 #define MVEBU_COMPHY_LANES	6
 #define MVEBU_COMPHY_PORTS	3
@@ -194,27 +346,69 @@
 		.fw_mode = _fw,				\
 	}
 
-#define GEN_CONF(_lane, _port, _mode, _fw)		\
+#define GEN_CONF(_lane, _port, _mode, _mux, _fw)	\
 	{						\
 		.lane = _lane,				\
 		.port = _port,				\
 		.mode = _mode,				\
 		.submode = PHY_INTERFACE_MODE_NA,	\
-		.mux = -1,				\
+		.mux = _mux,				\
 		.fw_mode = _fw,				\
 	}
 
+#define MVEBU_COMPHY_PIPE_CONF(_lane, _port, _mode, _mux)	\
+	{							\
+		.lane = _lane,					\
+		.port = _port,					\
+		.mode = _mode,					\
+		.submode = 0,					\
+		.mux = _mux,					\
+	}
+
+/*
+ * default values for 10GKR comphys amplitudes/emphasises. Those work
+ * on the A8K DB board, but most likely won't be suitable for other
+ * boards.
+ *
+ * The Marvell A8K DB board has a fairly long trace length from the
+ * CPU to the SFP cage, and a connector in between, therefore it needs
+ * fairly bosted up amplitude and emphasis settings in order to get a
+ * descent eye diagram.
+ *
+ * On other designs with shorter traces lengths this will most likely
+ * result in a fairly large overshoot of the signal and bad signal
+ * integrity.
+ */
+#define DEFAULT_GEN1_S0_AMP	0x1c
+#define DEFAULT_GEN1_S0_EMPH	0xe
+#define DEFAULT_GEN1_S2_EMPH	0x0
+
+#define KR_DEFAULT_FFE_CAP_SEL	0xe
+#define KR_DEFAULT_FFE_RES_SEL	0x4
+#define KR_DEFAULT_DFE_RES	0x1
+#define KR_DEFAULT_PHASE_OFFSET	0x60
+
+/*
+ * default values for SATA comphys amplitudes/emphasises and DFE
+ * resolutions. Those work on the A8K DB board, but most likely won't
+ * be suitable for other boards.
+ */
+#define SATA_DEFAULT_GEN3_S0_AMP	0x1e
+#define SATA_DEFAULT_GEN3_S0_EMPH	0x06
+#define SATA_DEFAULT_GEN3_S4_DFE_RES	0x2
+#define SATA_DEFAULT_PHASE_OFFSET	0x61
+
 static const struct mvebu_comphy_conf mvebu_comphy_cp110_modes[] = {
 	/* lane 0 */
-	GEN_CONF(0, 0, PHY_MODE_PCIE, COMPHY_FW_MODE_PCIE),
+	GEN_CONF(0, 0, PHY_MODE_PCIE, 0x4, COMPHY_FW_MODE_PCIE),
 	ETH_CONF(0, 1, PHY_INTERFACE_MODE_SGMII, 0x1, COMPHY_FW_MODE_SGMII),
 	ETH_CONF(0, 1, PHY_INTERFACE_MODE_2500BASEX, 0x1, COMPHY_FW_MODE_HS_SGMII),
-	GEN_CONF(0, 1, PHY_MODE_SATA, COMPHY_FW_MODE_SATA),
+	GEN_CONF(0, 1, PHY_MODE_SATA, 0x4, COMPHY_FW_MODE_SATA),
 	/* lane 1 */
-	GEN_CONF(1, 0, PHY_MODE_USB_HOST_SS, COMPHY_FW_MODE_USB3H),
-	GEN_CONF(1, 0, PHY_MODE_USB_DEVICE_SS, COMPHY_FW_MODE_USB3D),
-	GEN_CONF(1, 0, PHY_MODE_SATA, COMPHY_FW_MODE_SATA),
-	GEN_CONF(1, 0, PHY_MODE_PCIE, COMPHY_FW_MODE_PCIE),
+	GEN_CONF(1, 0, PHY_MODE_USB_HOST_SS, 0x1, COMPHY_FW_MODE_USB3H),
+	GEN_CONF(1, 0, PHY_MODE_USB_DEVICE_SS, 0x2, COMPHY_FW_MODE_USB3D),
+	GEN_CONF(1, 0, PHY_MODE_SATA, 0x4, COMPHY_FW_MODE_SATA),
+	GEN_CONF(1, 0, PHY_MODE_PCIE, 0x4, COMPHY_FW_MODE_PCIE),
 	ETH_CONF(1, 2, PHY_INTERFACE_MODE_SGMII, 0x1, COMPHY_FW_MODE_SGMII),
 	ETH_CONF(1, 2, PHY_INTERFACE_MODE_2500BASEX, 0x1, COMPHY_FW_MODE_HS_SGMII),
 	/* lane 2 */
@@ -222,43 +416,73 @@
 	ETH_CONF(2, 0, PHY_INTERFACE_MODE_2500BASEX, 0x1, COMPHY_FW_MODE_HS_SGMII),
 	ETH_CONF(2, 0, PHY_INTERFACE_MODE_RXAUI, 0x1, COMPHY_FW_MODE_RXAUI),
 	ETH_CONF(2, 0, PHY_INTERFACE_MODE_10GKR, 0x1, COMPHY_FW_MODE_XFI),
-	GEN_CONF(2, 0, PHY_MODE_USB_HOST_SS, COMPHY_FW_MODE_USB3H),
-	GEN_CONF(2, 0, PHY_MODE_SATA, COMPHY_FW_MODE_SATA),
-	GEN_CONF(2, 0, PHY_MODE_PCIE, COMPHY_FW_MODE_PCIE),
+	GEN_CONF(2, 0, PHY_MODE_USB_HOST_SS, 0x1, COMPHY_FW_MODE_USB3H),
+	GEN_CONF(2, 0, PHY_MODE_SATA, 0x4, COMPHY_FW_MODE_SATA),
+	GEN_CONF(2, 0, PHY_MODE_PCIE, 0x4, COMPHY_FW_MODE_PCIE),
 	/* lane 3 */
-	GEN_CONF(3, 0, PHY_MODE_PCIE, COMPHY_FW_MODE_PCIE),
+	GEN_CONF(3, 0, PHY_MODE_PCIE, 0x4, COMPHY_FW_MODE_PCIE),
 	ETH_CONF(3, 1, PHY_INTERFACE_MODE_SGMII, 0x2, COMPHY_FW_MODE_SGMII),
 	ETH_CONF(3, 1, PHY_INTERFACE_MODE_2500BASEX, 0x2, COMPHY_FW_MODE_HS_SGMII),
 	ETH_CONF(3, 1, PHY_INTERFACE_MODE_RXAUI, 0x1, COMPHY_FW_MODE_RXAUI),
-	GEN_CONF(3, 1, PHY_MODE_USB_HOST_SS, COMPHY_FW_MODE_USB3H),
-	GEN_CONF(3, 1, PHY_MODE_SATA, COMPHY_FW_MODE_SATA),
+	GEN_CONF(3, 1, PHY_MODE_USB_HOST_SS, 0x1, COMPHY_FW_MODE_USB3H),
+	GEN_CONF(3, 1, PHY_MODE_SATA, 0x4, COMPHY_FW_MODE_SATA),
 	/* lane 4 */
 	ETH_CONF(4, 0, PHY_INTERFACE_MODE_SGMII, 0x2, COMPHY_FW_MODE_SGMII),
 	ETH_CONF(4, 0, PHY_INTERFACE_MODE_2500BASEX, 0x2, COMPHY_FW_MODE_HS_SGMII),
 	ETH_CONF(4, 0, PHY_INTERFACE_MODE_10GKR, 0x2, COMPHY_FW_MODE_XFI),
 	ETH_CONF(4, 0, PHY_INTERFACE_MODE_RXAUI, 0x2, COMPHY_FW_MODE_RXAUI),
-	GEN_CONF(4, 0, PHY_MODE_USB_DEVICE_SS, COMPHY_FW_MODE_USB3D),
-	GEN_CONF(4, 1, PHY_MODE_USB_HOST_SS, COMPHY_FW_MODE_USB3H),
-	GEN_CONF(4, 1, PHY_MODE_PCIE, COMPHY_FW_MODE_PCIE),
+	GEN_CONF(4, 0, PHY_MODE_USB_DEVICE_SS, 0x2, COMPHY_FW_MODE_USB3D),
+	GEN_CONF(4, 1, PHY_MODE_USB_HOST_SS, 0x1, COMPHY_FW_MODE_USB3H),
+	GEN_CONF(4, 1, PHY_MODE_PCIE, 0x4, COMPHY_FW_MODE_PCIE),
 	ETH_CONF(4, 1, PHY_INTERFACE_MODE_SGMII, 0x1, COMPHY_FW_MODE_SGMII),
 	ETH_CONF(4, 1, PHY_INTERFACE_MODE_2500BASEX, -1, COMPHY_FW_MODE_HS_SGMII),
 	ETH_CONF(4, 1, PHY_INTERFACE_MODE_10GKR, -1, COMPHY_FW_MODE_XFI),
 	/* lane 5 */
 	ETH_CONF(5, 1, PHY_INTERFACE_MODE_RXAUI, 0x2, COMPHY_FW_MODE_RXAUI),
-	GEN_CONF(5, 1, PHY_MODE_SATA, COMPHY_FW_MODE_SATA),
+	GEN_CONF(5, 1, PHY_MODE_SATA, 0x4, COMPHY_FW_MODE_SATA),
 	ETH_CONF(5, 2, PHY_INTERFACE_MODE_SGMII, 0x1, COMPHY_FW_MODE_SGMII),
 	ETH_CONF(5, 2, PHY_INTERFACE_MODE_2500BASEX, 0x1, COMPHY_FW_MODE_HS_SGMII),
-	GEN_CONF(5, 2, PHY_MODE_PCIE, COMPHY_FW_MODE_PCIE),
+	GEN_CONF(5, 2, PHY_MODE_PCIE, 0x4, COMPHY_FW_MODE_PCIE),
+};
+
+static const struct mvebu_comphy_conf mvebu_comphy_cp110_pipe_modes[] = {
+	/* lane 0 */
+	MVEBU_COMPHY_PIPE_CONF(0, 0, PHY_MODE_PCIE, 0x4),
+
+	/* lane 1 */
+	MVEBU_COMPHY_PIPE_CONF(1, 0, PHY_MODE_USB_HOST, 0x1),
+	MVEBU_COMPHY_PIPE_CONF(1, 0, PHY_MODE_USB_DEVICE, 0x2),
+	MVEBU_COMPHY_PIPE_CONF(1, 0, PHY_MODE_PCIE, 0x4),
+
+	/* lane 2 */
+	MVEBU_COMPHY_PIPE_CONF(2, 0, PHY_MODE_USB_HOST, 0x1),
+	MVEBU_COMPHY_PIPE_CONF(2, 0, PHY_MODE_PCIE, 0x4),
+
+	/* lane 3 */
+	MVEBU_COMPHY_PIPE_CONF(3, 1, PHY_MODE_USB_HOST, 0x1),
+	MVEBU_COMPHY_PIPE_CONF(3, 0, PHY_MODE_PCIE, 0x4),
+
+	/* lane 4 */
+	MVEBU_COMPHY_PIPE_CONF(4, 1, PHY_MODE_USB_HOST, 0x1),
+	MVEBU_COMPHY_PIPE_CONF(4, 0, PHY_MODE_USB_DEVICE, 0x2),
+	MVEBU_COMPHY_PIPE_CONF(4, 1, PHY_MODE_PCIE, 0x4),
+
+	/* lane 5 */
+	MVEBU_COMPHY_PIPE_CONF(5, 2, PHY_MODE_PCIE, 0x4),
 };
 
 struct mvebu_comphy_priv {
 	void __iomem *base;
 	struct regmap *regmap;
+	struct regmap *sar_regmap;
+	struct regmap *cp_mgmt_regmap;
 	struct device *dev;
 	struct clk *mg_domain_clk;
 	struct clk *mg_core_clk;
 	struct clk *axi_clk;
+	struct clk *gop_clk;
 	unsigned long cp_phys;
+	int modes[MVEBU_COMPHY_LANES];
 };
 
 struct mvebu_comphy_lane {
@@ -267,6 +491,23 @@
 	enum phy_mode mode;
 	int submode;
 	int port;
+
+	u32 kr_gen1_s0_amplitude;
+	u32 kr_gen1_s0_emphasis;
+	u32 kr_gen1_s2_emphasis;
+
+	u32 kr_ffe_cap_sel;
+	u32 kr_ffe_res_sel;
+	u32 kr_dfe_res;
+	u32 kr_phase_offset;
+
+	bool rx_swap_polarity;
+	bool tx_swap_polarity;
+
+	u32 sata_gen3_s0_amplitude;
+	u32 sata_gen3_s0_emphasis;
+	u32 sata_gen3_s4_dfe_res;
+	u32 sata_phase_offset;
 };
 
 static int mvebu_comphy_smc(unsigned long function, unsigned long phys,
@@ -437,6 +678,138 @@
 	return 0;
 }
 
+static void mvebu_comphy_sata_init_reset(struct mvebu_comphy_lane *lane)
+{
+	struct mvebu_comphy_priv *priv = lane->priv;
+	u32 val;
+
+	/* RFU configurations - hard reset comphy */
+	regmap_read(priv->regmap, MVEBU_COMPHY_CONF1(lane->id), &val);
+	val &= ~MVEBU_COMPHY_CONF1_USB_PCIE;
+	val &= ~MVEBU_COMPHY_CONF1_POR;
+	val &= ~MVEBU_COMPHY_CONF1_CORE_RESET;
+	val |= MVEBU_COMPHY_CONF1_PWRUP;
+	regmap_write(priv->regmap, MVEBU_COMPHY_CONF1(lane->id), val);
+
+	/* Set data width 40Bit - SATA mode only */
+	regmap_read(priv->regmap, MVEBU_COMPHY_CONF6(lane->id), &val);
+	val |= MVEBU_COMPHY_CONF6_40B;
+	regmap_write(priv->regmap, MVEBU_COMPHY_CONF6(lane->id), val);
+
+	/* reset */
+	val = readl(priv->base + MVEBU_COMPHY_SERDES_CFG1(lane->id));
+	val &= ~(MVEBU_COMPHY_SERDES_CFG1_RESET |
+		 MVEBU_COMPHY_SERDES_CFG1_CORE_RESET |
+		 MVEBU_COMPHY_SERDES_CFG1_RF_RESET);
+	writel(val, priv->base + MVEBU_COMPHY_SERDES_CFG1(lane->id));
+
+	/* de-assert reset */
+	val = readl(priv->base + MVEBU_COMPHY_SERDES_CFG1(lane->id));
+	val |= MVEBU_COMPHY_SERDES_CFG1_RESET |
+	       MVEBU_COMPHY_SERDES_CFG1_CORE_RESET;
+	writel(val, priv->base + MVEBU_COMPHY_SERDES_CFG1(lane->id));
+
+	/* wait until clocks are ready */
+	mdelay(1);
+
+	/* Set reference clock to comes from group 1 - chose 25Mhz */
+	val = readl(priv->base + MVEBU_COMPHY_MISC_CTRL0(lane->id));
+	val &= ~MVEBU_COMPHY_MISC_CTRL0_REFCLK_SEL;
+	writel(val,priv->base + MVEBU_COMPHY_MISC_CTRL0(lane->id));
+
+	/* power and pll selection */
+	val = readl(priv->base + MVEBU_COMPHY_PWRPLL_CTRL(lane->id));
+	val &= ~(MVEBU_COMPHY_PWRPLL_CTRL_RFREQ(0x1f) |
+		 MVEBU_COMPHY_PWRPLL_PHY_MODE(0x7));
+	/* Reference frequency select set 1 (for SATA = 25Mhz) */
+	/* PHY mode select (set SATA = 0x0 */
+	val |= MVEBU_COMPHY_PWRPLL_CTRL_RFREQ(0x1) |
+	       MVEBU_COMPHY_PWRPLL_PHY_MODE(0x0);
+	writel(val, priv->base + MVEBU_COMPHY_PWRPLL_CTRL(lane->id));
+
+	/* Set max PHY generation setting - 6Gbps */
+	val = readl(priv->base + MVEBU_COMPHY_INTERFACE(lane->id));
+	val &= ~MVEBU_COMPHY_INTERFACE_GEN_MAX(0x3);
+	val |= MVEBU_COMPHY_INTERFACE_GEN_MAX(0x2);
+	writel(val, priv->base + MVEBU_COMPHY_INTERFACE(lane->id));
+
+	/* Set select data  width 40Bit (SEL_BITS[2:0]) */
+	val = readl(priv->base + MVEBU_COMPHY_LOOPBACK(lane->id));
+	val &= ~MVEBU_COMPHY_LOOPBACK_DBUS_WIDTH(0x7);
+	val |= MVEBU_COMPHY_LOOPBACK_DBUS_WIDTH(0x2);
+	writel(val, priv->base + MVEBU_COMPHY_LOOPBACK(lane->id));
+}
+
+static void mvebu_comphy_usb3_init_reset(struct mvebu_comphy_lane *lane)
+{
+	struct mvebu_comphy_priv *priv = lane->priv;
+	u32 val;
+
+	/* RFU configurations - hard reset comphy */
+	regmap_read(priv->regmap, MVEBU_COMPHY_CONF1(lane->id), &val);
+	val &= ~MVEBU_COMPHY_CONF1_POR;
+	val &= ~MVEBU_COMPHY_CONF1_CORE_RESET;
+	val |= MVEBU_COMPHY_CONF1_PWRUP;
+	val |= MVEBU_COMPHY_CONF1_PHY_MODE_USB;
+	val |= MVEBU_COMPHY_CONF1_USB_PCIE;
+	regmap_write(priv->regmap, MVEBU_COMPHY_CONF1(lane->id), val);
+
+	/* release from hard reset */
+	regmap_read(priv->regmap, MVEBU_COMPHY_CONF1(lane->id), &val);
+	val |= MVEBU_COMPHY_CONF1_POR;
+	val |= MVEBU_COMPHY_CONF1_CORE_RESET;
+	regmap_write(priv->regmap, MVEBU_COMPHY_CONF1(lane->id), val);
+
+	/* wait until clocks are ready */
+	mdelay(1);
+
+	/* Set PIPE soft reset */
+	val = readl(priv->base + MVEBU_COMPHY_PIPE_RST_CLK_CTRL(lane->id));
+	val |= MVEBU_COMPHY_PIPE_RST_CLK_CTRL_RST;
+	val &= ~MVEBU_COMPHY_PIPE_RST_CLK_CTRL_FIXED_PCLK;
+	val &= ~MVEBU_COMPHY_PIPE_RST_CLK_CTRL_PIPE_WIDTH;
+	val &= ~MVEBU_COMPHY_PIPE_RST_CLK_CTRL_FREQ_SEL;
+	writel(val, priv->base + MVEBU_COMPHY_PIPE_RST_CLK_CTRL(lane->id));
+
+	/* Set PLL ready delay for 0x2 */
+	val = readl(priv->base + MVEBU_COMPHY_PIPE_CLK_SRC_LO(lane->id));
+	val &= ~MVEBU_COMPHY_PIPE_CLK_SRC_LO_PLL_RDY_DL(0x7);
+	val |= MVEBU_COMPHY_PIPE_CLK_SRC_LO_PLL_RDY_DL(0x2);
+	writel(val, priv->base + MVEBU_COMPHY_PIPE_CLK_SRC_LO(lane->id));
+
+	/* Set reference clock to come from group 1 - 25Mhz */
+	val = readl(priv->base + MVEBU_COMPHY_MISC_CTRL0(lane->id));
+	val &= ~MVEBU_COMPHY_MISC_CTRL0_REFCLK_SEL;
+	writel(val, priv->base + MVEBU_COMPHY_MISC_CTRL0(lane->id));
+
+	/* power and pll selection */
+	val = readl(priv->base + MVEBU_COMPHY_PWRPLL_CTRL(lane->id));
+	val &= ~(MVEBU_COMPHY_PWRPLL_CTRL_RFREQ(0x1f) |
+		 MVEBU_COMPHY_PWRPLL_PHY_MODE(0x7));
+	val |= MVEBU_COMPHY_PWRPLL_CTRL_RFREQ(0x2) |
+		MVEBU_COMPHY_PWRPLL_PHY_MODE(0x5);
+	writel(val, priv->base + MVEBU_COMPHY_PWRPLL_CTRL(lane->id));
+
+
+	/* Set the amount of time spent in the LoZ state - set for 0x7 */
+	val = readl(priv->base + MVEBU_COMPHY_PIPE_PM_CTRL(lane->id));
+	val &= ~MVEBU_COMPHY_PIPE_PM_CTRL_RDLOZ_WAIT(0xff);
+	val |= MVEBU_COMPHY_PIPE_PM_CTRL_RDLOZ_WAIT(0x7);
+	writel(val, priv->base + MVEBU_COMPHY_PIPE_PM_CTRL(lane->id));
+
+	/* Set max PHY generation setting - 5Gbps */
+	val = readl(priv->base + MVEBU_COMPHY_INTERFACE(lane->id));
+	val &= ~MVEBU_COMPHY_INTERFACE_GEN_MAX(0x3);
+	val |= MVEBU_COMPHY_INTERFACE_GEN_MAX(0x1);
+	writel(val, priv->base + MVEBU_COMPHY_INTERFACE(lane->id));
+
+	/* Set select data width 20Bit (SEL_BITS[2:0]) */
+	val = readl(priv->base + MVEBU_COMPHY_LOOPBACK(lane->id));
+	val &= ~MVEBU_COMPHY_LOOPBACK_DBUS_WIDTH(0x7);
+	val |= MVEBU_COMPHY_LOOPBACK_DBUS_WIDTH(0x1);
+	writel(val, priv->base + MVEBU_COMPHY_LOOPBACK(lane->id));
+}
+
 static int mvebu_comphy_init_plls(struct mvebu_comphy_lane *lane)
 {
 	struct mvebu_comphy_priv *priv = lane->priv;
@@ -478,6 +851,125 @@
 	return 0;
 }
 
+static void mvebu_comphy_pcie_init_reset(struct mvebu_comphy_lane *lane,
+					 int pcie_clk_config, int pcie_width)
+{
+	struct mvebu_comphy_priv *priv = lane->priv;
+	u32 val;
+
+	/* RFU configurations - hard reset comphy */
+	regmap_read(priv->regmap, MVEBU_COMPHY_CONF1(lane->id), &val);
+	val &= ~MVEBU_COMPHY_CONF1_POR;
+	val &= ~MVEBU_COMPHY_CONF1_CORE_RESET;
+	val &= ~MVEBU_COMPHY_CONF1_PHY_MODE_USB;
+	val |= MVEBU_COMPHY_CONF1_PWRUP;
+	val |= MVEBU_COMPHY_CONF1_USB_PCIE;
+	regmap_write(priv->regmap, MVEBU_COMPHY_CONF1(lane->id), val);
+
+	/* release from hard reset */
+	regmap_read(priv->regmap, MVEBU_COMPHY_CONF1(lane->id), &val);
+	val |= MVEBU_COMPHY_CONF1_POR;
+	val |= MVEBU_COMPHY_CONF1_CORE_RESET;
+	regmap_write(priv->regmap, MVEBU_COMPHY_CONF1(lane->id), val);
+
+	/* wait until clocks are ready */
+	mdelay(1);
+
+	/* Start comphy Configuration */
+	val = readl(priv->base + MVEBU_COMPHY_PIPE_RST_CLK_CTRL(lane->id));
+	val |= MVEBU_COMPHY_PIPE_RST_CLK_CTRL_RST;
+	val |= MVEBU_COMPHY_PIPE_RST_CLK_CTRL_FIXED_PCLK;
+	val &= ~MVEBU_COMPHY_PIPE_RST_CLK_CTRL_PIPE_WIDTH;
+	val &= ~MVEBU_COMPHY_PIPE_RST_CLK_CTRL_FREQ_SEL;
+	writel(val, priv->base + MVEBU_COMPHY_PIPE_RST_CLK_CTRL(lane->id));
+
+	/* Set PLL ready delay for 0x2 */
+	val = readl(priv->base + MVEBU_COMPHY_PIPE_CLK_SRC_LO(lane->id));
+	val &= ~MVEBU_COMPHY_PIPE_CLK_SRC_LO_PLL_RDY_DL(0x7);
+	val |= MVEBU_COMPHY_PIPE_CLK_SRC_LO_PLL_RDY_DL(0x2);
+	if (pcie_width > 1) {
+		val |= MVEBU_COMPHY_PIPE_CLK_SRC_LO_PERIOD_SEL;
+		val &= ~MVEBU_COMPHY_PIPE_CLK_SRC_LO_PERIOD_SCALE(0x3);
+		val |= MVEBU_COMPHY_PIPE_CLK_SRC_LO_PERIOD_SCALE(0x1);
+	}
+	writel(val, priv->base + MVEBU_COMPHY_PIPE_CLK_SRC_LO(lane->id));
+
+	/* Set PIPE mode interface to PCIe3 - 0x1  & set lane order */
+	val = readl(priv->base + MVEBU_COMPHY_PIPE_CLK_SRC_HI(lane->id));
+	val |= MVEBU_COMPHY_PIPE_CLK_SRC_HI_MODE_PIPE;
+	if (pcie_width > 1) {
+		if (lane->id == 0) {
+			val |= MVEBU_COMPHY_PIPE_CLK_SRC_HI_LANE_START;
+			val |= MVEBU_COMPHY_PIPE_CLK_SRC_HI_LANE_MASTER;
+		} else {
+			val &= ~MVEBU_COMPHY_PIPE_CLK_SRC_HI_LANE_START;
+			val &= ~MVEBU_COMPHY_PIPE_CLK_SRC_HI_LANE_MASTER;
+		}
+		if (lane->id == pcie_width - 1)
+			val |= MVEBU_COMPHY_PIPE_CLK_SRC_HI_LANE_BREAK;
+		else
+			val &= ~MVEBU_COMPHY_PIPE_CLK_SRC_HI_LANE_BREAK;
+	}
+	writel(val, priv->base + MVEBU_COMPHY_PIPE_CLK_SRC_HI(lane->id));
+
+	/* Config update polarity equalization */
+	val = readl(priv->base + MVEBU_COMPHY_LANE_EQ_CFG1(lane->id));
+	val |= MVEBU_COMPHY_LANE_EQ_CFG1_UPDATE_POLARITY;
+	writel(val, priv->base + MVEBU_COMPHY_LANE_EQ_CFG1(lane->id));
+
+	/* Set PIPE version 4 to mode enable */
+	val = readl(priv->base + MVEBU_COMPHY_DFE_CTRL_28(lane->id));
+	val |= MVEBU_COMPHY_DFE_CTRL_28_PIPE4;
+	writel(val, priv->base + MVEBU_COMPHY_DFE_CTRL_28(lane->id));
+
+	val = readl(priv->base + MVEBU_COMPHY_MISC_CTRL0(lane->id));
+	val &= ~MVEBU_COMPHY_MISC_CTRL0_TXDCLK_2X;
+	val |= MVEBU_COMPHY_MISC_CTRL0_CLK500M_EN;
+	val |= MVEBU_COMPHY_MISC_CTRL0_ICP_FORCE;
+	if (pcie_clk_config) {
+		val &= ~MVEBU_COMPHY_MISC_CTRL0_REFCLK_SEL;
+		val |= MVEBU_COMPHY_MISC_CTRL0_CLK100M_125M;
+	} else {
+		val |= MVEBU_COMPHY_MISC_CTRL0_REFCLK_SEL;
+	}
+	writel(val, priv->base + MVEBU_COMPHY_MISC_CTRL0(lane->id));
+
+	val = readl(priv->base + MVEBU_COMPHY_PWRPLL_CTRL(lane->id));
+	val &= ~MVEBU_COMPHY_PWRPLL_CTRL_RFREQ(0x1f);
+	val &= ~MVEBU_COMPHY_PWRPLL_PHY_MODE(0x7);
+	if (pcie_clk_config)
+		val |= MVEBU_COMPHY_PWRPLL_CTRL_RFREQ(0x2);
+	else
+		val |= MVEBU_COMPHY_PWRPLL_CTRL_RFREQ(0x0);
+	val |= MVEBU_COMPHY_PWRPLL_PHY_MODE(0x3);
+	writel(val, priv->base + MVEBU_COMPHY_PWRPLL_CTRL(lane->id));
+
+	if (pcie_width > 1) {
+		/* reference clock alignment */
+		val = readl(priv->base + MVEBU_COMPHY_LANE_ALIGN(lane->id));
+		val &= ~MVEBU_COMPHY_LANE_ALIGN_BIT;
+		writel(val, priv->base + MVEBU_COMPHY_LANE_ALIGN(lane->id));
+	}
+
+	/*
+	 * Set the amount of time spent in the LoZ state - set for 0x7
+	 * only if the PCIe clock is output
+	 */
+	if (pcie_clk_config) {
+		val = readl(priv->base + MVEBU_COMPHY_PIPE_PM_CTRL(lane->id));
+		val &= ~MVEBU_COMPHY_PIPE_PM_CTRL_RDLOZ_WAIT(0xff);
+		val |= MVEBU_COMPHY_PIPE_PM_CTRL_RDLOZ_WAIT(0x7);
+		writel(val, priv->base + MVEBU_COMPHY_PIPE_PM_CTRL(lane->id));
+	}
+
+	val = readl(priv->base + MVEBU_COMPHY_INTERFACE(lane->id));
+	val &= ~MVEBU_COMPHY_INTERFACE_GEN_MAX(0x3);
+	val |= MVEBU_COMPHY_INTERFACE_GEN_MAX(0x2);
+	val |= MVEBU_COMPHY_INTERFACE_DET_BYPASS;
+	val |= MVEBU_COMPHY_INTERFACE_LINK_TRAIN;
+	writel(val, priv->base + MVEBU_COMPHY_INTERFACE(lane->id));
+}
+
 static int mvebu_comphy_set_mode_sgmii(struct phy *phy)
 {
 	struct mvebu_comphy_lane *lane = phy_get_drvdata(phy);
@@ -506,6 +998,9 @@
 	val = readl(priv->base + MVEBU_COMPHY_GEN1_S0(lane->id));
 	val &= ~MVEBU_COMPHY_GEN1_S0_TX_EMPH(0xf);
 	val |= MVEBU_COMPHY_GEN1_S0_TX_EMPH(0x1);
+	/* set it back to hardware default value to fix unstable bcm
+	 * link on fbx proto */
+	val |= MVEBU_COMPHY_GEN1_S0_TX_EMPH(0x9);
 	writel(val, priv->base + MVEBU_COMPHY_GEN1_S0(lane->id));
 
 	return mvebu_comphy_init_plls(lane);
@@ -584,6 +1079,17 @@
 	val |= MVEBU_COMPHY_DTL_CTRL_DTL_FLOOP_EN;
 	writel(val, priv->base + MVEBU_COMPHY_DTL_CTRL(lane->id));
 
+	printk("10gkr rx settings: 0x%x 0x%x 0x%x 0x%x\n",
+	       lane->kr_ffe_cap_sel, lane->kr_ffe_res_sel,
+	       lane->kr_dfe_res, lane->kr_phase_offset);
+	val = readl(priv->base + MVEBU_COMPHY_GEN1_S3(lane->id));
+	val |= MVEBU_COMPHY_GEN1_S3_SETTING_FORCE;
+	val &= ~MVEBU_COMPHY_GEN1_S3_FFE_CAP_SEL(0xf);
+	val &= ~MVEBU_COMPHY_GEN1_S3_FFE_RES_SEL(0x7);
+	val |= MVEBU_COMPHY_GEN1_S3_FFE_CAP_SEL(lane->kr_ffe_cap_sel);
+	val |= MVEBU_COMPHY_GEN1_S3_FFE_RES_SEL(lane->kr_ffe_res_sel);
+	writel(val, priv->base + MVEBU_COMPHY_GEN1_S3(lane->id));
+
 	/* Speed divider */
 	val = readl(priv->base + MVEBU_COMPHY_SPEED_DIV(lane->id));
 	val |= MVEBU_COMPHY_SPEED_DIV_TX_FORCE;
@@ -601,12 +1107,13 @@
 	val = readl(priv->base + MVEBU_COMPHY_GEN1_S0(lane->id));
 	val &= ~(MVEBU_COMPHY_GEN1_S0_TX_AMP(0x1f) |
 		 MVEBU_COMPHY_GEN1_S0_TX_EMPH(0xf));
-	val |= MVEBU_COMPHY_GEN1_S0_TX_AMP(0x1c) |
-	       MVEBU_COMPHY_GEN1_S0_TX_EMPH(0xe);
+	val |= MVEBU_COMPHY_GEN1_S0_TX_AMP(lane->kr_gen1_s0_amplitude) |
+	       MVEBU_COMPHY_GEN1_S0_TX_EMPH(lane->kr_gen1_s0_emphasis);
 	writel(val, priv->base + MVEBU_COMPHY_GEN1_S0(lane->id));
 
 	val = readl(priv->base + MVEBU_COMPHY_GEN1_S2(lane->id));
 	val &= ~MVEBU_COMPHY_GEN1_S2_TX_EMPH(0xf);
+	val |= MVEBU_COMPHY_GEN1_S2_TX_EMPH(lane->kr_gen1_s2_emphasis);
 	val |= MVEBU_COMPHY_GEN1_S2_TX_EMPH_EN;
 	writel(val, priv->base + MVEBU_COMPHY_GEN1_S2(lane->id));
 
@@ -615,6 +1122,25 @@
 	       MVEBU_COMPHY_TX_SLEW_RATE_SLC(0x3f);
 	writel(val, priv->base + MVEBU_COMPHY_TX_SLEW_RATE(lane->id));
 
+	/* phase offset */
+	val = readl(priv->base + MVEBU_COMPHY_PHASE_CTRL(lane->id));
+	val &= ~MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF(0x7f);
+	val |= MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF(lane->kr_phase_offset);
+	val |= MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF_FORCE;
+	val &= ~MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF_VALID;
+	writel(val, priv->base + MVEBU_COMPHY_PHASE_CTRL(lane->id));
+
+	/*
+	 * phase offset sampled on rising edge of OS_PH_OFF_VALID.
+	 */
+	val = readl(priv->base + MVEBU_COMPHY_PHASE_CTRL(lane->id));
+	val |= MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF_VALID;
+	writel(val, priv->base + MVEBU_COMPHY_PHASE_CTRL(lane->id));
+
+	val = readl(priv->base + MVEBU_COMPHY_PHASE_CTRL(lane->id));
+	val &= ~MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF_VALID;
+	writel(val, priv->base + MVEBU_COMPHY_PHASE_CTRL(lane->id));
+
 	/* Impedance calibration */
 	val = readl(priv->base + MVEBU_COMPHY_IMP_CAL(lane->id));
 	val &= ~MVEBU_COMPHY_IMP_CAL_TX_EXT(0x1f);
@@ -644,7 +1170,7 @@
 
 	val = readl(priv->base + MVEBU_COMPHY_GEN1_S4(lane->id));
 	val &= ~MVEBU_COMPHY_GEN1_S4_DFE_RES(0x3);
-	val |= MVEBU_COMPHY_GEN1_S4_DFE_RES(0x1);
+	val |= MVEBU_COMPHY_GEN1_S4_DFE_RES(lane->kr_dfe_res);
 	writel(val, priv->base + MVEBU_COMPHY_GEN1_S4(lane->id));
 
 	val = readl(priv->base + MVEBU_COMPHY_GEN1_S3(lane->id));
@@ -706,20 +1232,603 @@
 	return mvebu_comphy_init_plls(lane);
 }
 
+static inline bool phy_mode_is_pipe_mode(int mode)
+{
+	switch (mode) {
+	case PHY_MODE_USB_HOST_SS:
+	case PHY_MODE_USB_DEVICE_SS:
+	case PHY_MODE_PCIE:
+		return true;
+	default:
+		return false;
+	}
+}
+
+static int mvebu_comphy_set_mode_sata(struct phy *phy)
+{
+	struct mvebu_comphy_lane *lane = phy_get_drvdata(phy);
+	struct mvebu_comphy_priv *priv = lane->priv;
+	u32 val;
+
+	mvebu_comphy_sata_init_reset(lane);
+
+	/* G1 Settings */
+	val = readl(priv->base + MVEBU_COMPHY_GEN1_S1(lane->id));
+	val &= ~(MVEBU_COMPHY_GEN1_S1_RX_MUL_PI(0x7) |
+		 MVEBU_COMPHY_GEN1_S1_RX_MUL_PF(0x7) |
+		 MVEBU_COMPHY_GEN1_S1_RX_MUL_FI(0x3) |
+		 MVEBU_COMPHY_GEN1_S1_RX_MUL_FF(0x3) |
+		 MVEBU_COMPHY_GEN1_S1_RX_DIV(0x3));
+	val |= MVEBU_COMPHY_GEN1_S1_RX_MUL_PI(0x0) |
+	       MVEBU_COMPHY_GEN1_S1_RX_MUL_PF(0x1) |
+	       MVEBU_COMPHY_GEN1_S1_RX_MUL_FI(0x0) |
+	       MVEBU_COMPHY_GEN1_S1_RX_MUL_FF(0x3) |
+	       MVEBU_COMPHY_GEN1_S1_RX_DIV(0x1);
+	writel(val, priv->base + MVEBU_COMPHY_GEN1_S1(lane->id));
+
+	val = readl(priv->base + MVEBU_COMPHY_GEN1_S3(lane->id));
+	val &= ~(MVEBU_COMPHY_GEN1_S3_FFE_CAP_SEL(0xf) |
+		 MVEBU_COMPHY_GEN1_S3_FFE_RES_SEL(0x7) |
+		 MVEBU_COMPHY_GEN1_S3_FFE_DEG_RES_LVL(0x3) |
+		 MVEBU_COMPHY_GEN1_S3_FFE_LOAD_RES_LVL(0x3));
+	val |= MVEBU_COMPHY_GEN1_S3_SETTING_FORCE |
+		MVEBU_COMPHY_GEN1_S3_FFE_CAP_SEL(0xf) |
+		MVEBU_COMPHY_GEN1_S3_FFE_RES_SEL(0x2) |
+		MVEBU_COMPHY_GEN1_S3_FFE_DEG_RES_LVL(0x1) |
+		MVEBU_COMPHY_GEN1_S3_FFE_LOAD_RES_LVL(0x1);
+	writel(val, priv->base + MVEBU_COMPHY_GEN1_S3(lane->id));
+
+	/* G2 Settings */
+	val = readl(priv->base + MVEBU_COMPHY_GEN2_S1(lane->id));
+	val &= ~(MVEBU_COMPHY_GEN2_S1_RX_MUL_PI(0x7) |
+		 MVEBU_COMPHY_GEN2_S1_RX_MUL_PF(0x7) |
+		 MVEBU_COMPHY_GEN2_S1_RX_MUL_FI(0x3) |
+		 MVEBU_COMPHY_GEN2_S1_RX_MUL_FF(0x3) |
+		 MVEBU_COMPHY_GEN2_S1_RX_DIV(0x3));
+	val |= MVEBU_COMPHY_GEN2_S1_RX_MUL_PI(0x0) |
+		MVEBU_COMPHY_GEN2_S1_RX_MUL_PF(0x1) |
+		MVEBU_COMPHY_GEN2_S1_RX_MUL_FI(0x0) |
+		MVEBU_COMPHY_GEN2_S1_RX_MUL_FF(0x3) |
+		MVEBU_COMPHY_GEN2_S1_RX_DIV(0x1);
+	writel(val, priv->base + MVEBU_COMPHY_GEN2_S1(lane->id));
+
+	/* G3 Settings */
+	val = readl(priv->base + MVEBU_COMPHY_GEN3_S1(lane->id));
+	val &= ~(MVEBU_COMPHY_GEN3_S1_RX_MUL_PI(0x7) |
+		 MVEBU_COMPHY_GEN3_S1_RX_MUL_PF(0x7) |
+		 MVEBU_COMPHY_GEN3_S1_RX_MUL_FI(0x3) |
+		 MVEBU_COMPHY_GEN3_S1_RX_MUL_FF(0x3) |
+		 MVEBU_COMPHY_GEN2_S1_RX_DIV(0x3) |
+		 MVEBU_COMPHY_GEN3_S1_SMPL_INPX2_EN);
+	val |= MVEBU_COMPHY_GEN3_S1_RX_MUL_PI(0x2) |
+		MVEBU_COMPHY_GEN3_S1_RX_MUL_PF(0x2) |
+		MVEBU_COMPHY_GEN3_S1_RX_MUL_FI(0x3) |
+		MVEBU_COMPHY_GEN3_S1_RX_MUL_FF(0x3) |
+		MVEBU_COMPHY_GEN3_S1_RX_DIV(0x2) |
+		MVEBU_COMPHY_GEN3_S1_RX_DFE_EN;
+	writel(val, priv->base + MVEBU_COMPHY_GEN3_S1(lane->id));
+
+	/* DTL Control */
+	val = readl(priv->base + MVEBU_COMPHY_DTL_CTRL(lane->id));
+	val &= ~(MVEBU_COMPHY_DTL_CTRL_DTL_CLAMP_SEL(0x7) |
+		 MVEBU_COMPHY_DTL_CTRL_DTL_CLK_MODE(0x3));
+	val |= MVEBU_COMPHY_DTL_CTRL_DTL_DET_EN |
+		MVEBU_COMPHY_DTL_CTRL_DTL_PLOOP_EN |
+		MVEBU_COMPHY_DTL_CTRL_DTL_FLOOP_EN |
+		MVEBU_COMPHY_DTL_CTRL_DTL_CLAMP_SEL(0x1) |
+		MVEBU_COMPHY_DTL_CTRL_DTL_INPCLK_DIV_FORCE |
+		MVEBU_COMPHY_DTL_CTRL_DTL_CLK_MODE(0x1) |
+		MVEBU_COMPHY_DTL_CTRL_DTL_CLK_MODE_FORCE;
+	writel(val, priv->base + MVEBU_COMPHY_DTL_CTRL(lane->id));
+
+	/* Trigger sampler enable pulses */
+	val = readl(priv->base + MVEBU_SP_CALIB(lane->id));
+	val |= MVEBU_SP_CALIB_SAMPLER_EN;
+	writel(val, priv->base + MVEBU_SP_CALIB(lane->id));
+	val = readl(priv->base + MVEBU_SP_CALIB(lane->id));
+	val &= ~MVEBU_SP_CALIB_SAMPLER_EN;
+	writel(val, priv->base + MVEBU_SP_CALIB(lane->id));
+
+	/* VDD Calibration Control 3 */
+	val = readl(priv->base + MVEBU_COMPHY_EXT_SELV(lane->id));
+	val &= ~MVEBU_COMPHY_EXT_SELV_RX_SAMPL(0x1f);
+	val |= MVEBU_COMPHY_EXT_SELV_RX_SAMPL(0x10);
+	writel(val, priv->base + MVEBU_COMPHY_EXT_SELV(lane->id));
+
+	/* DFE Resolution Control */
+	val = readl(priv->base + MVEBU_COMPHY_DFE_RES(lane->id));
+	val |= MVEBU_COMPHY_DFE_RES_FORCE_GEN_TBL;
+	writel(val, priv->base + MVEBU_COMPHY_DFE_RES(lane->id));
+
+	/* DFE F3-F5 Coefficient Control */
+	val = readl(priv->base + MVEBU_COMPHY_COEF(lane->id));
+	val &= ~(MVEBU_COMPHY_COEF_DFE_EN | MVEBU_COMPHY_COEF_DFE_CTRL);
+	writel(val, priv->base + MVEBU_COMPHY_COEF(lane->id));
+
+	/* G3 Setting 3 */
+	val = readl(priv->base + MVEBU_COMPHY_GEN3_S3(lane->id));
+	val &= ~(MVEBU_COMPHY_GEN3_S3_FFE_CAP_SEL(0xf) |
+		 MVEBU_COMPHY_GEN3_S3_FFE_RES_SEL(0x7) |
+		 MVEBU_COMPHY_GEN3_S3_FFE_DEG_RES_LVL(0x3) |
+		 MVEBU_COMPHY_GEN3_S3_FFE_LOAD_RES_LVL(0x3));
+	val |= MVEBU_COMPHY_GEN3_S3_SETTING_FORCE |
+		MVEBU_COMPHY_GEN3_S3_FFE_CAP_SEL(0xf) |
+		MVEBU_COMPHY_GEN3_S3_FFE_RES_SEL(0x4) |
+		MVEBU_COMPHY_GEN3_S3_FFE_DEG_RES_LVL(0x1) |
+		MVEBU_COMPHY_GEN3_S3_FFE_LOAD_RES_LVL(0x3);
+	writel(val, priv->base + MVEBU_COMPHY_GEN3_S3(lane->id));
+
+	/* G3 Setting 4 */
+	val = readl(priv->base + MVEBU_COMPHY_GEN3_S4(lane->id));
+	val &= ~MVEBU_COMPHY_GEN3_S4_DFE_RES(0x3);
+	val |= MVEBU_COMPHY_GEN3_S4_DFE_RES(lane->sata_gen3_s4_dfe_res);
+	writel(val, priv->base + MVEBU_COMPHY_GEN3_S4(lane->id));
+
+	/* Offset Phase Control */
+	val = readl(priv->base + MVEBU_COMPHY_PHASE_CTRL(lane->id));
+	val &= ~MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF(0x7f);
+	val |= MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF(lane->sata_phase_offset);
+	val |= MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF_FORCE;
+	val &= ~MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF_VALID;
+	writel(val, priv->base + MVEBU_COMPHY_PHASE_CTRL(lane->id));
+
+	val = readl(priv->base + MVEBU_COMPHY_PHASE_CTRL(lane->id));
+	val |= MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF_VALID;
+	writel(val, priv->base + MVEBU_COMPHY_PHASE_CTRL(lane->id));
+
+	val = readl(priv->base + MVEBU_COMPHY_PHASE_CTRL(lane->id));
+	val &= ~MVEBU_COMPHY_PHASE_CTRL_OS_PH_OFF_VALID;
+	writel(val, priv->base + MVEBU_COMPHY_PHASE_CTRL(lane->id));
+
+	/* Set G1 TX amplitude and TX post emphasis value */
+	val = readl(priv->base + MVEBU_COMPHY_GEN1_S0(lane->id));
+	val &= ~(MVEBU_COMPHY_GEN1_S0_TX_AMP(0x1f) |
+		 MVEBU_COMPHY_GEN1_S0_TX_EMPH(0xf));
+	val |= MVEBU_COMPHY_GEN1_S0_TX_AMP(0x8) |
+		MVEBU_COMPHY_GEN1_S0_TX_EMPH(0x1) |
+		MVEBU_COMPHY_GEN1_S0_TX_AMP_ADJ |
+		MVEBU_COMPHY_GEN1_S0_TX_EMPH_EN;
+	writel(val, priv->base + MVEBU_COMPHY_GEN1_S0(lane->id));
+
+	/* Set G2 TX amplitude and TX post emphasis value */
+	val = readl(priv->base + MVEBU_COMPHY_GEN2_S0(lane->id));
+	val &= ~(MVEBU_COMPHY_GEN2_S0_TX_AMP(0x1f) |
+		 MVEBU_COMPHY_GEN2_S0_TX_EMPH(0xf));
+	val |= MVEBU_COMPHY_GEN2_S0_TX_AMP(0xa) |
+		MVEBU_COMPHY_GEN2_S0_TX_EMPH(0x2) |
+		MVEBU_COMPHY_GEN2_S0_TX_AMP_ADJ |
+		MVEBU_COMPHY_GEN2_S0_TX_EMPH_EN;
+	writel(val, priv->base + MVEBU_COMPHY_GEN2_S0(lane->id));
+
+	/* Set G3 TX amplitude and TX post emphasis value */
+	val = readl(priv->base + MVEBU_COMPHY_GEN3_S0(lane->id));
+	val &= ~(MVEBU_COMPHY_GEN3_S0_TX_AMP(0x1f) |
+		 MVEBU_COMPHY_GEN3_S0_TX_EMPH(0xf) |
+		 MVEBU_COMPHY_GEN3_S0_TX_SLEW_RATE_SEL(0x7) |
+		 MVEBU_COMPHY_GEN3_S0_TX_SLEW_CTRL_EN);
+	val |= MVEBU_COMPHY_GEN3_S0_TX_AMP(lane->sata_gen3_s0_amplitude) |
+		MVEBU_COMPHY_GEN3_S0_TX_EMPH(lane->sata_gen3_s0_emphasis) |
+		MVEBU_COMPHY_GEN3_S0_TX_SLEW_RATE_SEL(0x4) |
+		MVEBU_COMPHY_GEN3_S0_TX_AMP_ADJ |
+		MVEBU_COMPHY_GEN3_S0_TX_EMPH_EN;
+	writel(val, priv->base + MVEBU_COMPHY_GEN3_S0(lane->id));
+
+	/* SERDES External Configuration 2 register */
+	val = readl(priv->base + MVEBU_COMPHY_SERDES_CFG2(lane->id));
+	val |= MVEBU_COMPHY_SERDES_CFG2_SSC_EN;
+	writel(val, priv->base + MVEBU_COMPHY_SERDES_CFG2(lane->id));
+
+	/* DFE reset sequence */
+	val = readl(priv->base + MVEBU_COMPHY_PWR_CTR(lane->id));
+	val |= MVEBU_COMPHY_PWR_CTR_RST_DFE;
+	writel(val, priv->base + MVEBU_COMPHY_PWR_CTR(lane->id));
+	val = readl(priv->base + MVEBU_COMPHY_PWR_CTR(lane->id));
+	val &= ~MVEBU_COMPHY_PWR_CTR_RST_DFE;
+	writel(val, priv->base + MVEBU_COMPHY_PWR_CTR(lane->id));
+
+	/* SW reset for interrupt logic */
+	val = readl(priv->base + MVEBU_COMPHY_PWR_CTR(lane->id));
+	val |= MVEBU_COMPHY_PWR_CTR_SOFT_RST;
+	writel(val, priv->base + MVEBU_COMPHY_PWR_CTR(lane->id));
+	val = readl(priv->base + MVEBU_COMPHY_PWR_CTR(lane->id));
+	val &= ~MVEBU_COMPHY_PWR_CTR_SOFT_RST;
+	writel(val, priv->base + MVEBU_COMPHY_PWR_CTR(lane->id));
+
+	/* wait for PLL ready */
+	readl_poll_timeout(priv->base + MVEBU_COMPHY_SERDES_STATUS0(lane->id),
+			   val,
+			   val & (MVEBU_COMPHY_SERDES_STATUS0_RX_PLL_RDY |
+				  MVEBU_COMPHY_SERDES_STATUS0_TX_PLL_RDY),
+			   1000, 150000);
+	if (!(val & (MVEBU_COMPHY_SERDES_STATUS0_RX_PLL_RDY |
+		     MVEBU_COMPHY_SERDES_STATUS0_TX_PLL_RDY)))
+		return -ETIMEDOUT;
+
+	return 0;
+}
+
+static int mvebu_comphy_set_mode_usb3(struct phy *phy)
+{
+	struct mvebu_comphy_lane *lane = phy_get_drvdata(phy);
+	struct mvebu_comphy_priv *priv = lane->priv;
+	u32 val;
+
+	mvebu_comphy_usb3_init_reset(lane);
+
+	/* select de-emphasize 3.5db */
+	val = readl(priv->base + MVEBU_COMPHY_LANE_CFG0(lane->id));
+	val |= MVEBU_COMPHY_LANE_CFG0_PRD_TXEEMPH0;
+	writel(val, priv->base + MVEBU_COMPHY_LANE_CFG0(lane->id));
+
+	/* override tx margining from the MAC */
+	val = readl(priv->base + MVEBU_COMPHY_MODE_CTRL(lane->id));
+	val |= MVEBU_COMPHY_MODE_CTRL_MODE_MARGIN;
+	writel(val, priv->base + MVEBU_COMPHY_MODE_CTRL(lane->id));
+
+	/* Start analog paramters from ETP(HW) */
+	val = readl(priv->base + MVEBU_COMPHY_LANE_CFG4(lane->id));
+	val &= ~MVEBU_COMPHY_LANE_CFG4_DFE_CTRL(0x7);
+	val |= MVEBU_COMPHY_LANE_CFG4_DFE_CTRL(0x1);
+	val |= MVEBU_COMPHY_LANE_CFG4_DFE_OVER;
+	val |= MVEBU_COMPHY_LANE_CFG4_DFE_SSC;
+	writel(val, priv->base + MVEBU_COMPHY_LANE_CFG4(lane->id));
+
+	/* Release from PIPE soft reset */
+	val = readl(priv->base + MVEBU_COMPHY_PIPE_RST_CLK_CTRL(lane->id));
+	val &= ~MVEBU_COMPHY_PIPE_RST_CLK_CTRL_RST;
+	writel(val, priv->base + MVEBU_COMPHY_PIPE_RST_CLK_CTRL(lane->id));
+
+	/* wait for PLL ready */
+	readl_poll_timeout(priv->base + MVEBU_COMPHY_LANE_STATUS0(lane->id),
+			   val,
+			   val & MVEBU_COMPHY_LANE_STATUS0_PCLK_EN,
+			   1000, 150000);
+	if (!(val & MVEBU_COMPHY_LANE_STATUS0_PCLK_EN))
+		return -ETIMEDOUT;
+
+	return 0;
+}
+
+static int mvebu_comphy_pcie_get_width(struct mvebu_comphy_lane *lane)
+{
+	int i;
+	struct mvebu_comphy_priv *priv = lane->priv;
+	int ret;
+
+	if (lane->id == 4 || lane->id == 5) {
+		return 1;
+	}
+
+	for (ret = 0, i = 0; i < 4; ++i) {
+		if (priv->modes[i] == PHY_MODE_PCIE)
+			++ret;
+		else
+			break;
+	}
+
+	if (ret == 0 || ret == 3)
+		/*
+		 * filter out invalid configurations.
+		 */
+		return -EINVAL;
+
+	return ret;
+}
+
+static int mvebu_comphy_set_mode_pcie(struct phy *phy)
+{
+	struct mvebu_comphy_lane *lane = phy_get_drvdata(phy);
+	struct mvebu_comphy_priv *priv = lane->priv;
+	int pcie_clk_config;
+	int pcie_width;
+	u32 val;
+	int start_lane;
+	int end_lane;
+	int i;
+
+	/*
+	 * first get PCIe clk configuration from sample at reset
+	 * register.
+	 * values for pcie_clk_config:
+	 * - 0: external PCIe clock generation
+	 * - 1: internal PCIe clock generation
+	 *
+	 * NOTE: on A8K, only the master CP holds the proper pcie
+	 * clock configuration. the PCIE1 bit control the clock
+	 * configuration for both lane 4 and lane 5.
+	 *
+	 * FIXME: we should use the CP1 configuration values when
+	 * initialising the CP1 PCIe interfaces.
+	 */
+	regmap_read(priv->sar_regmap, DEVICE_SAR0, &val);
+	if (lane->id == 4 || lane->id == 5) {
+		pcie_clk_config = !!(val & DEV_SAR0_PCIE1_CLK_CP0);
+	} else {
+		pcie_clk_config = !!(val & DEV_SAR0_PCIE0_CLK_CP0);
+	}
+
+	pcie_width = mvebu_comphy_pcie_get_width(lane);
+	if (pcie_width < 0)
+		return pcie_width;
+
+	/*
+	 * PCIe width configuration on lane 0
+	 */
+	if (lane->id == 0) {
+		regmap_read(priv->regmap, MVEBU_COMPHY_SD1_CTRL1, &val);
+		switch (pcie_width) {
+		case 1:
+			val &= ~MVEBU_COMPHY_SD1_CTRL1_PCIE_X2_EN;
+			val &= ~MVEBU_COMPHY_SD1_CTRL1_PCIE_X4_EN;
+			break;
+		case 2:
+			val |= MVEBU_COMPHY_SD1_CTRL1_PCIE_X2_EN;
+			val &= ~MVEBU_COMPHY_SD1_CTRL1_PCIE_X4_EN;
+			break;
+		case 4:
+			val &= ~MVEBU_COMPHY_SD1_CTRL1_PCIE_X2_EN;
+			val |= MVEBU_COMPHY_SD1_CTRL1_PCIE_X4_EN;
+			break;
+		}
+		regmap_write(priv->regmap, MVEBU_COMPHY_SD1_CTRL1, val);
+	}
+
+	/*
+	 * if PCIe clock is output and clock source from SerDes lane
+	 * 5, need to configure the clock-source MUX. By default, the
+	 * clock source is from lane 4
+	 */
+	if (pcie_clk_config && lane->id == 5) {
+		regmap_read(priv->cp_mgmt_regmap, DFX_DEV_GEN_CTRL12, &val);
+		val &= ~DFX_DEV_GEN_CTRL12_CLK_SRC(0x7);
+		val |= DFX_DEV_GEN_CTRL12_CLK_SRC(0x3);
+		regmap_write(priv->cp_mgmt_regmap, DFX_DEV_GEN_CTRL12, val);
+	}
+
+	mvebu_comphy_pcie_init_reset(lane, pcie_clk_config, pcie_width);
+
+	val = readl(priv->base + MVEBU_COMPHY_PCIE_REG0(lane->id));
+	val |= MVEBU_COMPHY_PCIE_REG0_IDLE_SYNC;
+	val &= ~MVEBU_COMPHY_PCIE_REG0_SEL_BITS(0x3);
+	val |= MVEBU_COMPHY_PCIE_REG0_SEL_BITS(0x2);
+	writel(val, priv->base + MVEBU_COMPHY_PCIE_REG0(lane->id));
+
+
+	val = readl(priv->base + MVEBU_COMPHY_TX_TRAIN_CTRL(lane->id));
+	val |= MVEBU_COMPHY_TX_TRAIN_CTRL_G1;
+	val |= MVEBU_COMPHY_TX_TRAIN_CTRL_GN1;
+	val &= ~MVEBU_COMPHY_TX_TRAIN_CTRL_G0;
+	writel(val, priv->base + MVEBU_COMPHY_TX_TRAIN_CTRL(lane->id));
+
+	val = readl(priv->base + MVEBU_COMPHY_TX_TRAIN_PRESET(lane->id));
+	val &= ~MVEBU_COMPHY_TX_TRAIN_CHK_INIT;
+	val |= MVEBU_COMPHY_TX_TRAIN_COEF_FM_PIN_PCIE3;
+	writel(val, priv->base + MVEBU_COMPHY_TX_TRAIN_PRESET(lane->id));
+
+	/* Set Preset sweep configurations  */
+	val = readl(priv->base + MVEBU_COMPHY_TX_TRAINING11(lane->id));
+	val |= MVEBU_COMPHY_TX_TRAINING11_CHECK_MODE;
+	val |= MVEBU_COMPHY_TX_TRAINING11_PRESET_NUM(0x7);
+	val |= MVEBU_COMPHY_TX_TRAINING11_PRESET_EN;
+	writel(val, priv->base + MVEBU_COMPHY_TX_TRAINING11(lane->id));
+
+	/* Tx train start configuration */
+	val = readl(priv->base + MVEBU_COMPHY_TRAINING5(lane->id));
+	val |= MVEBU_COMPHY_TRAINING5_START_SQ_EN;
+	val &= ~MVEBU_COMPHY_TRAINING5_FRM_DET_EN;
+	val &= ~MVEBU_COMPHY_TRAINING5_FRM_LOCK_EN;
+	val |= MVEBU_COMPHY_TRAINING5_WAIT_TIME_EN;
+	writel(val, priv->base + MVEBU_COMPHY_TRAINING5(lane->id));
+
+	/* Enable Tx train P2P */
+	val = readl(priv->base + MVEBU_COMPHY_TRAINING0(lane->id));
+	val |= MVEBU_COMPHY_TRAINING0_P2P_HOLD;
+	writel(val, priv->base + MVEBU_COMPHY_TRAINING0(lane->id));
+
+
+	/* Configure Tx train timeout */
+	val = readl(priv->base + MVEBU_COMPHY_TRAINING4(lane->id));
+	val &= ~MVEBU_COMPHY_TRAINING4_TIMER(0x3ff);
+	val |= MVEBU_COMPHY_TRAINING4_TIMER(0x17);
+	writel(val, priv->base + MVEBU_COMPHY_TRAINING4(lane->id));
+
+	/* Disable G0/G1/GN1 adaptation */
+	val = readl(priv->base + MVEBU_COMPHY_TX_TRAIN_CTRL(lane->id));
+	val &= ~MVEBU_COMPHY_TX_TRAIN_CTRL_G1;
+	val &= ~MVEBU_COMPHY_TX_TRAIN_CTRL_GN1;
+	val &= ~MVEBU_COMPHY_TX_TRAIN_CTRL_G0;
+	writel(val, priv->base + MVEBU_COMPHY_TX_TRAIN_CTRL(lane->id));
+
+	/* Disable DTL frequency loop */
+	val = readl(priv->base + MVEBU_COMPHY_DTL_CTRL(lane->id));
+	val &= ~MVEBU_COMPHY_DTL_CTRL_DTL_FLOOP_EN;
+	writel(val, priv->base + MVEBU_COMPHY_DTL_CTRL(lane->id));
+
+	/* Configure G3 DFE */
+	val = readl(priv->base + MVEBU_COMPHY_GEN3_S4(lane->id));
+	val &= ~MVEBU_COMPHY_GEN3_S4_DFE_RES(0x3);
+	val |= MVEBU_COMPHY_GEN3_S4_DFE_RES(0x3);
+	writel(val, priv->base + MVEBU_COMPHY_GEN3_S4(lane->id));
+
+	/* Use TX/RX training result for DFE */
+	val = readl(priv->base + MVEBU_COMPHY_DFE_RES(lane->id));
+	val &= ~MVEBU_COMPHY_DFE_RES_FORCE_GEN_TBL;
+	writel(val, priv->base + MVEBU_COMPHY_DFE_RES(lane->id));
+
+	/* Configure initial and final coefficient value for receiver */
+	val = readl(priv->base + MVEBU_COMPHY_GEN3_S1(lane->id));
+	val &= ~(MVEBU_COMPHY_GEN3_S1_RX_MUL_PI(0x7) |
+		 MVEBU_COMPHY_GEN3_S1_RX_MUL_PF(0x7) |
+		 MVEBU_COMPHY_GEN3_S1_SMPL_INPX2_EN);
+	val |= MVEBU_COMPHY_GEN3_S1_RX_MUL_PI(0x1) |
+		MVEBU_COMPHY_GEN3_S1_RX_MUL_PF(0x1);
+	writel(val, priv->base + MVEBU_COMPHY_GEN3_S1(lane->id));
+
+	/* Trigger sampler enable pulse */
+	val = readl(priv->base + MVEBU_SP_CALIB(lane->id));
+	val |= MVEBU_SP_CALIB_SAMPLER_EN;
+	writel(val, priv->base + MVEBU_SP_CALIB(lane->id));
+	udelay(5);
+	val = readl(priv->base + MVEBU_SP_CALIB(lane->id));
+	val &= ~MVEBU_SP_CALIB_SAMPLER_EN;
+	writel(val, priv->base + MVEBU_SP_CALIB(lane->id));
+
+	/* FFE resistor tuning for different bandwidth  */
+	/* G3 Setting 3 */
+	val = readl(priv->base + MVEBU_COMPHY_GEN3_S3(lane->id));
+	val &= ~(MVEBU_COMPHY_GEN3_S3_FFE_DEG_RES_LVL(0x3) |
+		 MVEBU_COMPHY_GEN3_S3_FFE_LOAD_RES_LVL(0x3));
+	val |= MVEBU_COMPHY_GEN3_S3_FFE_DEG_RES_LVL(0x1) |
+		MVEBU_COMPHY_GEN3_S3_FFE_LOAD_RES_LVL(0x3);
+	writel(val, priv->base + MVEBU_COMPHY_GEN3_S3(lane->id));
+
+	/* Pattern lock lost timeout disable */
+	val = readl(priv->base + MVEBU_COMPHY_FRAME_DETECT3(lane->id));
+	val &= ~MVEBU_COMPHY_FRAME_DETECT3_LOST_TIMEOUT_EN;
+	writel(val, priv->base + MVEBU_COMPHY_FRAME_DETECT3(lane->id));
+
+	/* Configure DFE adaptations */
+	val = readl(priv->base + MVEBU_COMPHY_CDR_CONTROL(lane->id));
+	val &= ~MVEBU_COMPHY_CDR_CONTROL_RX_MAX_DFE_ADAPT_1(0x3);
+	val &= ~MVEBU_COMPHY_CDR_CONTROL_MAX_DFE_ADAPT_1(0x7);
+	val &= ~MVEBU_COMPHY_CDR_CONTROL_MAX_DFE_ADAPT_0(0x7);
+	val |= MVEBU_COMPHY_CDR_CONTROL_RX_MAX_DFE_ADAPT_1(0x0);
+	val |= MVEBU_COMPHY_CDR_CONTROL_MAX_DFE_ADAPT_1(0x1);
+	val |= MVEBU_COMPHY_CDR_CONTROL_MAX_DFE_ADAPT_0(0x0);
+	writel(val, priv->base + MVEBU_COMPHY_CDR_CONTROL(lane->id));
+
+	val = readl(priv->base + MVEBU_COMPHY_DFE_CTRL(lane->id));
+	val &= ~MVEBU_COMPHY_DFE_CTRL_TX_MAX_DFE_ADAPT(0x3);
+	writel(val, priv->base + MVEBU_COMPHY_DFE_CTRL(lane->id));
+
+	/* Generation 2 setting 1*/
+	val = readl(priv->base + MVEBU_COMPHY_GEN2_S1(lane->id));
+	val &= ~MVEBU_COMPHY_GEN2_S1_RX_MUL_PI(0x7);
+	val &= ~MVEBU_COMPHY_GEN2_S1_RX_MUL_PF(0x7);
+	val &= ~MVEBU_COMPHY_GEN2_S1_RX_MUL_FI(0x3);
+	val |= MVEBU_COMPHY_GEN2_S1_RX_MUL_PI(0x0);
+	val |= MVEBU_COMPHY_GEN2_S1_RX_MUL_PF(0x1);
+	val |= MVEBU_COMPHY_GEN2_S1_RX_MUL_FI(0x0);
+	writel(val, priv->base + MVEBU_COMPHY_GEN2_S1(lane->id));
+
+	/* DFE enable */
+	val = readl(priv->base + MVEBU_COMPHY_GEN2_S4(lane->id));
+	val &= ~MVEBU_COMPHY_GEN2_S4_DFE_RES(0x3);
+	val |= MVEBU_COMPHY_GEN2_S4_DFE_RES(0x3);
+	writel(val, priv->base + MVEBU_COMPHY_GEN2_S4(lane->id));
+
+	/* Configure DFE Resolution */
+	val = readl(priv->base + MVEBU_COMPHY_LANE_CFG4(lane->id));
+	val |= MVEBU_COMPHY_LANE_CFG4_DFE_EN_SEL;
+	writel(val, priv->base + MVEBU_COMPHY_LANE_CFG4(lane->id));
+
+	/* VDD calibration control */
+	val = readl(priv->base + MVEBU_COMPHY_EXT_SELV(lane->id));
+	val &= ~MVEBU_COMPHY_EXT_SELV_RX_SAMPL(0x1f);
+	val |= MVEBU_COMPHY_EXT_SELV_RX_SAMPL(0x16);
+	writel(val, priv->base + MVEBU_COMPHY_EXT_SELV(lane->id));
+
+	/* Set PLL Charge-pump Current Control */
+	val = readl(priv->base + MVEBU_COMPHY_GEN3_S5(lane->id));
+	val &= ~MVEBU_COMPHY_GEN3_S5_ICP(0xf);
+	val |= MVEBU_COMPHY_GEN3_S5_ICP(0x4);
+	writel(val, priv->base + MVEBU_COMPHY_GEN3_S5(lane->id));
+
+	/* Set lane equalization remote setting */
+	val = readl(priv->base + MVEBU_COMPHY_LANE_EQ_REMOTE_CFG(lane->id));
+	val |= MVEBU_COMPHY_LANE_EQ_REMOTE_CFG_DIRN_OVERRIDE;
+	val |= MVEBU_COMPHY_LANE_EQ_REMOTE_CFG_ONLY_MODE;
+	val &= ~MVEBU_COMPHY_LANE_EQ_REMOTE_CFG_PRESET_VECTOR(0xf);
+	val |= MVEBU_COMPHY_LANE_EQ_REMOTE_CFG_PRESET_VECTOR(0x2);
+	writel(val, priv->base + MVEBU_COMPHY_LANE_EQ_REMOTE_CFG(lane->id));
+
+	/* Set phy in root complex mode */
+	val = readl(priv->base + MVEBU_COMPHY_EQ_CONFIG0(lane->id));
+	val |= MVEBU_COMPHY_EQ_CONFIG0_RC_MODE;
+	writel(val, priv->base + MVEBU_COMPHY_EQ_CONFIG0(lane->id));
+
+	/* we're done for now if we are not in the last lane. */
+	if (pcie_width > 1 && lane->id != (pcie_width - 1))
+		return 0;
+
+	if (pcie_width > 1) {
+		/*
+		 * for x2 or x4: we need to release the pipe reset in
+		 * one single write on all comphys.
+		 */
+		regmap_read(priv->regmap, MVEBU_COMPHY_SD1_CTRL1, &val);
+		if (pcie_width == 2)
+			val &= ~MVEBU_COMPHY_SD1_CTRL1_PHY0_1_MASK;
+		else
+			val &= ~MVEBU_COMPHY_SD1_CTRL1_PHY0_3_MASK;
+		regmap_write(priv->regmap, MVEBU_COMPHY_SD1_CTRL1, val);
+
+		/*
+		 * now all writes to comphy register block 0 will hit
+		 * all PCIe PHYs.
+		 */
+		val = readl(priv->base + MVEBU_COMPHY_PIPE_RST_CLK_CTRL(0));
+		val &= ~MVEBU_COMPHY_PIPE_RST_CLK_CTRL_RST;
+		writel(val, priv->base + MVEBU_COMPHY_PIPE_RST_CLK_CTRL(0));
+
+		/*
+		 * restore writes to all individual phys.
+		 */
+		regmap_read(priv->regmap, MVEBU_COMPHY_SD1_CTRL1, &val);
+		if (pcie_width == 2)
+			val |= 0x0010;
+		else
+			val |= 0x3210;
+		regmap_write(priv->regmap, MVEBU_COMPHY_SD1_CTRL1, val);
+
+		start_lane = 0;
+		end_lane = pcie_width - 1;
+	} else {
+		/* release pipe soft reset */
+		val = readl(priv->base +
+			      MVEBU_COMPHY_PIPE_RST_CLK_CTRL(lane->id));
+		val &= ~MVEBU_COMPHY_PIPE_RST_CLK_CTRL_RST;
+		writel(val, priv->base +
+			 MVEBU_COMPHY_PIPE_RST_CLK_CTRL(lane->id));
+		start_lane = end_lane = lane->id;
+	}
+
+	for (i = start_lane; i <= end_lane; ++i) {
+		readl_poll_timeout(priv->base + MVEBU_COMPHY_LANE_STATUS0(i),
+				   val,
+				   val & MVEBU_COMPHY_LANE_STATUS0_PCLK_EN,
+				   1000, 150000);
+		if (!(val & MVEBU_COMPHY_LANE_STATUS0_PCLK_EN)) {
+			printk("timedout waiting for lane pclk on lane %d\n",
+			       lane->id);
+			return -ETIMEDOUT;
+		}
+	}
+
+	return 0;
+}
+
 static int mvebu_comphy_power_on_legacy(struct phy *phy)
 {
 	struct mvebu_comphy_lane *lane = phy_get_drvdata(phy);
 	struct mvebu_comphy_priv *priv = lane->priv;
-	int ret, mux;
+	int ret, mux = 0, pipe_mux = 0, mux_val;
 	u32 val;
 
-	mux = mvebu_comphy_get_mux(lane->id, lane->port,
+	mux_val = mvebu_comphy_get_mux(lane->id, lane->port,
 				   lane->mode, lane->submode);
+
 	if (mux < 0)
 		return -ENOTSUPP;
 
+	if (phy_mode_is_pipe_mode(lane->mode))
+		pipe_mux = mux_val;
+	else
+		mux = mux_val;
+
 	regmap_read(priv->regmap, MVEBU_COMPHY_PIPE_SELECTOR, &val);
 	val &= ~(0xf << MVEBU_COMPHY_PIPE_SELECTOR_PIPE(lane->id));
+	val |= pipe_mux << MVEBU_COMPHY_PIPE_SELECTOR_PIPE(lane->id);
 	regmap_write(priv->regmap, MVEBU_COMPHY_PIPE_SELECTOR, val);
 
 	regmap_read(priv->regmap, MVEBU_COMPHY_SELECTOR, &val);
@@ -727,6 +1836,8 @@
 	val |= mux << MVEBU_COMPHY_SELECTOR_PHY(lane->id);
 	regmap_write(priv->regmap, MVEBU_COMPHY_SELECTOR, val);
 
+	switch (lane->mode) {
+	case PHY_MODE_ETHERNET:
 	switch (lane->submode) {
 	case PHY_INTERFACE_MODE_SGMII:
 	case PHY_INTERFACE_MODE_2500BASEX:
@@ -738,6 +1849,18 @@
 	case PHY_INTERFACE_MODE_10GKR:
 		ret = mvebu_comphy_set_mode_10gkr(phy);
 		break;
+		}
+		break;
+	case PHY_MODE_SATA:
+		ret = mvebu_comphy_set_mode_sata(phy);
+		break;
+	case PHY_MODE_USB_HOST_SS:
+	case PHY_MODE_USB_DEVICE_SS:
+		ret = mvebu_comphy_set_mode_usb3(phy);
+		break;
+	case PHY_MODE_PCIE:
+		ret = mvebu_comphy_set_mode_pcie(phy);
+		break;
 	default:
 		return -ENOTSUPP;
 	}
@@ -747,6 +1870,20 @@
 	val |= MVEBU_COMPHY_SERDES_CFG1_RF_RESET;
 	writel(val, priv->base + MVEBU_COMPHY_SERDES_CFG1(lane->id));
 
+	/*
+	 * swap rx/tx N/P polarities if needed.
+	 */
+	val = readl(priv->base + MVEBU_COMPHY_SYNC_PATTERN(lane->id));
+	if (lane->rx_swap_polarity)
+		val |= MVEBU_COMPHY_SYNC_PATTERN_RXD_INV;
+	else
+		val &= ~MVEBU_COMPHY_SYNC_PATTERN_RXD_INV;
+	if (lane->tx_swap_polarity)
+		val |= MVEBU_COMPHY_SYNC_PATTERN_TXD_INV;
+	else
+		val &= ~MVEBU_COMPHY_SYNC_PATTERN_TXD_INV;
+	writel(val, priv->base + MVEBU_COMPHY_SYNC_PATTERN(lane->id));
+
 	return ret;
 }
 
@@ -820,10 +1957,10 @@
 		return ret;
 
 	if (ret == COMPHY_FW_NOT_SUPPORTED)
-		dev_err(priv->dev,
+		dev_dbg(priv->dev,
 			"unsupported SMC call, try updating your firmware\n");
 
-	dev_warn(priv->dev,
+	dev_dbg(priv->dev,
 		 "Firmware could not configure PHY %d with mode %d (ret: %d), trying legacy method\n",
 		 lane->id, lane->mode, ret);
 
@@ -843,6 +1980,7 @@
 	if (mvebu_comphy_get_fw_mode(lane->id, lane->port, mode, submode) < 0)
 		return -EINVAL;
 
+	lane->priv->modes[lane->id] = mode;
 	lane->mode = mode;
 	lane->submode = submode;
 
@@ -865,6 +2003,11 @@
 		 MVEBU_COMPHY_SERDES_CFG1_RF_RESET);
 	writel(val, priv->base + MVEBU_COMPHY_SERDES_CFG1(lane->id));
 
+	regmap_read(priv->regmap, MVEBU_COMPHY_CONF1(lane->id), &val);
+	val &= ~MVEBU_COMPHY_CONF1_POR;
+	val &= ~MVEBU_COMPHY_CONF1_CORE_RESET;
+	regmap_write(priv->regmap, MVEBU_COMPHY_CONF1(lane->id), val);
+
 	regmap_read(priv->regmap, MVEBU_COMPHY_SELECTOR, &val);
 	val &= ~(0xf << MVEBU_COMPHY_SELECTOR_PHY(lane->id));
 	regmap_write(priv->regmap, MVEBU_COMPHY_SELECTOR, val);
@@ -949,8 +2092,21 @@
 	if (ret < 0)
 		goto dis_mg_core_clk;
 
+	priv->gop_clk = devm_clk_get(priv->dev, "gop_clk");
+	if (IS_ERR(priv->gop_clk)) {
+		ret = PTR_ERR(priv->gop_clk);
+		goto dis_axi_clk;
+	}
+
+	ret = clk_prepare_enable(priv->gop_clk);
+	if (ret < 0)
+		goto dis_axi_clk;
+
 	return 0;
 
+dis_axi_clk:
+	clk_disable_unprepare(priv->axi_clk);
+
 dis_mg_core_clk:
 	clk_disable_unprepare(priv->mg_core_clk);
 
@@ -966,6 +2122,9 @@
 
 static void mvebu_comphy_disable_unprepare_clks(struct mvebu_comphy_priv *priv)
 {
+	if (priv->mg_core_clk)
+		clk_disable_unprepare(priv->gop_clk);
+
 	if (priv->axi_clk)
 		clk_disable_unprepare(priv->axi_clk);
 
@@ -994,6 +2153,19 @@
 						"marvell,system-controller");
 	if (IS_ERR(priv->regmap))
 		return PTR_ERR(priv->regmap);
+
+	priv->sar_regmap =
+		syscon_regmap_lookup_by_phandle(pdev->dev.of_node,
+						"marvell,sar");
+	if (IS_ERR(priv->sar_regmap))
+		return PTR_ERR(priv->sar_regmap);
+
+	priv->cp_mgmt_regmap =
+		syscon_regmap_lookup_by_phandle(pdev->dev.of_node,
+						"marvell,cp_mgmt");
+	if (IS_ERR(priv->cp_mgmt_regmap))
+		return PTR_ERR(priv->cp_mgmt_regmap);
+
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	priv->base = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(priv->base))
@@ -1054,13 +2226,61 @@
 		lane->port = -1;
 		phy_set_drvdata(phy, lane);
 
+		lane->kr_gen1_s0_amplitude = DEFAULT_GEN1_S0_AMP;
+		lane->kr_gen1_s0_emphasis = DEFAULT_GEN1_S0_EMPH;
+		lane->kr_gen1_s2_emphasis = DEFAULT_GEN1_S2_EMPH;
+		lane->kr_ffe_cap_sel = KR_DEFAULT_FFE_CAP_SEL;
+		lane->kr_ffe_res_sel = KR_DEFAULT_FFE_RES_SEL;
+		lane->kr_phase_offset = KR_DEFAULT_PHASE_OFFSET;
+		lane->kr_dfe_res = KR_DEFAULT_DFE_RES;
+
+		/*
+		 * fetch optional 10GKR amplitude and emphasis
+		 * parameters from device tree for this comphy.
+		 */
+		of_property_read_u32(child, "kr-gen1-s0-amplitude",
+				     &lane->kr_gen1_s0_amplitude);
+		of_property_read_u32(child, "kr-gen1-s0-emphasis",
+				     &lane->kr_gen1_s0_emphasis);
+		of_property_read_u32(child, "kr-gen1-s2-emphasis",
+				     &lane->kr_gen1_s2_emphasis);
+		of_property_read_u32(child, "kr-ffe-cap-sel",
+				     &lane->kr_ffe_cap_sel);
+		of_property_read_u32(child, "kr-ffe-res-sel",
+				     &lane->kr_ffe_res_sel);
+		of_property_read_u32(child, "kr-dfe-res",
+				     &lane->kr_dfe_res);
+		of_property_read_u32(child, "kr-phase-offset",
+				     &lane->kr_phase_offset);
+
+		lane->sata_gen3_s0_amplitude = SATA_DEFAULT_GEN3_S0_AMP;
+		lane->sata_gen3_s0_emphasis = SATA_DEFAULT_GEN3_S0_EMPH;
+		lane->sata_gen3_s4_dfe_res = SATA_DEFAULT_GEN3_S4_DFE_RES;
+		lane->sata_phase_offset = SATA_DEFAULT_PHASE_OFFSET;
+		/*
+		 * fetch optional SATA amplitude and emphasis
+		 * parameter from device tree, for this comphy.
+		 */
+		of_property_read_u32(child, "sata-gen3-s0-amplitude",
+				     &lane->sata_gen3_s0_amplitude);
+		of_property_read_u32(child, "sata-gen3-s0-emphasis",
+				     &lane->sata_gen3_s0_emphasis);
+		of_property_read_u32(child, "sata-gen3-s4-dfe-res",
+				     &lane->sata_gen3_s4_dfe_res);
+		of_property_read_u32(child, "sata-phase-offset",
+				     &lane->sata_phase_offset);
+
+		lane->rx_swap_polarity = of_property_read_bool(child,
+						       "rx-swap-polarity");
+		lane->tx_swap_polarity = of_property_read_bool(child,
+						       "tx-swap-polarity");
+
 		/*
-		 * All modes are supported in this driver so we could call
-		 * mvebu_comphy_power_off(phy) here to avoid relying on the
-		 * bootloader/firmware configuration, but for compatibility
-		 * reasons we cannot de-configure the COMPHY without being sure
-		 * that the firmware is up-to-date and fully-featured.
+		 * All modes are now supported in this driver so call
+		 * mvebu_comphy_power_off(phy) here to avoid relying
+		 * on the bootloader/firmware configuration.
 		 */
+		mvebu_comphy_power_off(phy);
 	}
 
 	dev_set_drvdata(&pdev->dev, priv);
diff -ruw linux-5.4.60/drivers/pinctrl/bcm/Kconfig linux-5.4.60-fbx/drivers/pinctrl/bcm/Kconfig
--- linux-5.4.60/drivers/pinctrl/bcm/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/pinctrl/bcm/Kconfig	2021-03-04 13:20:59.547505634 +0100
@@ -28,6 +28,15 @@
 	help
 	   Say Y here to enable the Broadcom BCM2835 GPIO driver.
 
+config PINCTRL_BCM63138
+	bool "Broadcom 63138 pinmux driver"
+	depends on OF && (ARCH_BCM_63XX || ARCH_BCM63XX || COMPILE_TEST)
+	default ARCH_BCM_63XX
+	select PINMUX
+	select PINCONF
+	select GENERIC_PINCONF
+	select GPIOLIB
+
 config PINCTRL_IPROC_GPIO
 	bool "Broadcom iProc GPIO (with PINCONF) driver"
 	depends on OF_GPIO && (ARCH_BCM_IPROC || COMPILE_TEST)
diff -ruw linux-5.4.60/drivers/pinctrl/bcm/Makefile linux-5.4.60-fbx/drivers/pinctrl/bcm/Makefile
--- linux-5.4.60/drivers/pinctrl/bcm/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/pinctrl/bcm/Makefile	2021-03-04 13:20:59.547505634 +0100
@@ -3,6 +3,7 @@
 
 obj-$(CONFIG_PINCTRL_BCM281XX)		+= pinctrl-bcm281xx.o
 obj-$(CONFIG_PINCTRL_BCM2835)		+= pinctrl-bcm2835.o
+obj-$(CONFIG_PINCTRL_BCM63138)		+= pinctrl-bcm63138.o
 obj-$(CONFIG_PINCTRL_IPROC_GPIO)	+= pinctrl-iproc-gpio.o
 obj-$(CONFIG_PINCTRL_CYGNUS_MUX)	+= pinctrl-cygnus-mux.o
 obj-$(CONFIG_PINCTRL_NS)		+= pinctrl-ns.o
diff -ruw linux-5.4.60/drivers/platform/Kconfig linux-5.4.60-fbx/drivers/platform/Kconfig
--- linux-5.4.60/drivers/platform/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/platform/Kconfig	2021-03-04 13:20:59.597505636 +0100
@@ -13,3 +13,9 @@
 source "drivers/platform/mellanox/Kconfig"
 
 source "drivers/platform/olpc/Kconfig"
+
+if X86_INTEL_CE
+source "drivers/platform/intelce/Kconfig"
+endif
+
+source "drivers/platform/fbxgw7r/Kconfig"
diff -ruw linux-5.4.60/drivers/platform/Makefile linux-5.4.60-fbx/drivers/platform/Makefile
--- linux-5.4.60/drivers/platform/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/platform/Makefile	2021-03-04 13:20:59.597505636 +0100
@@ -9,3 +9,5 @@
 obj-$(CONFIG_OLPC_EC)		+= olpc/
 obj-$(CONFIG_GOLDFISH)		+= goldfish/
 obj-$(CONFIG_CHROME_PLATFORMS)	+= chrome/
+obj-$(CONFIG_X86_INTEL_CE)	+= intelce/
+obj-$(CONFIG_FBXGW7R_PLATFORM)	+= fbxgw7r/
diff -ruw linux-5.4.60/drivers/soc/bcm/Kconfig linux-5.4.60-fbx/drivers/soc/bcm/Kconfig
--- linux-5.4.60/drivers/soc/bcm/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/soc/bcm/Kconfig	2021-03-04 13:20:59.834172314 +0100
@@ -34,5 +34,6 @@
 	  If unsure, say N.
 
 source "drivers/soc/bcm/brcmstb/Kconfig"
+source "drivers/soc/bcm/bcm63xx/Kconfig"
 
 endmenu
diff -ruw linux-5.4.60/drivers/soc/bcm/Makefile linux-5.4.60-fbx/drivers/soc/bcm/Makefile
--- linux-5.4.60/drivers/soc/bcm/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/soc/bcm/Makefile	2021-03-04 13:20:59.834172314 +0100
@@ -2,3 +2,4 @@
 obj-$(CONFIG_BCM2835_POWER)	+= bcm2835-power.o
 obj-$(CONFIG_RASPBERRYPI_POWER)	+= raspberrypi-power.o
 obj-$(CONFIG_SOC_BRCMSTB)	+= brcmstb/
+obj-$(CONFIG_SOC_BCM63XX)	+= bcm63xx/
diff -ruw linux-5.4.60/drivers/spi/Kconfig linux-5.4.60-fbx/drivers/spi/Kconfig
--- linux-5.4.60/drivers/spi/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/spi/Kconfig	2021-03-04 13:20:59.847505647 +0100
@@ -147,7 +147,7 @@
 
 config SPI_BCM63XX_HSSPI
 	tristate "Broadcom BCM63XX HS SPI controller driver"
-	depends on BCM63XX || ARCH_BCM_63XX || COMPILE_TEST
+	depends on BCM63XX || ARCH_BCM63XX || ARCH_BCM_63XX || COMPILE_TEST
 	help
 	  This enables support for the High Speed SPI controller present on
 	  newer Broadcom BCM63XX SoCs.
@@ -539,6 +539,12 @@
 	help
 	  This selects a driver for the PPC4xx SPI Controller.
 
+config SPI_TDM_ORION
+	tristate "Orion TDM SPI master"
+	depends on PLAT_ORION
+	help
+	  This enables using the TDM SPI master controller on the Orion chips.
+
 config SPI_PXA2XX
 	tristate "PXA2xx SSP SPI master"
 	depends on (ARCH_PXA || ARCH_MMP || PCI || ACPI)
diff -ruw linux-5.4.60/drivers/spi/Makefile linux-5.4.60-fbx/drivers/spi/Makefile
--- linux-5.4.60/drivers/spi/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/spi/Makefile	2021-03-04 13:20:59.847505647 +0100
@@ -76,6 +76,7 @@
 obj-$(CONFIG_SPI_ORION)			+= spi-orion.o
 obj-$(CONFIG_SPI_PIC32)			+= spi-pic32.o
 obj-$(CONFIG_SPI_PIC32_SQI)		+= spi-pic32-sqi.o
+obj-$(CONFIG_SPI_TDM_ORION)		+= orion_tdm_spi.o
 obj-$(CONFIG_SPI_PL022)			+= spi-pl022.o
 obj-$(CONFIG_SPI_PPC4xx)		+= spi-ppc4xx.o
 spi-pxa2xx-platform-objs		:= spi-pxa2xx.o spi-pxa2xx-dma.o
diff -ruw linux-5.4.60/drivers/spi/spi-orion.c linux-5.4.60-fbx/drivers/spi/spi-orion.c
--- linux-5.4.60/drivers/spi/spi-orion.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/spi/spi-orion.c	2021-03-04 13:20:59.854172315 +0100
@@ -48,6 +48,9 @@
 /* Register for the "Direct Mode" */
 #define SPI_DIRECT_WRITE_CONFIG_REG	0x20
 
+/* per-CS register parameters */
+#define SPI_CSN_TIMING_PARM_REGS(n)	(0x30 + 4 * (n))
+
 #define ORION_SPI_TMISO_SAMPLE_MASK	(0x3 << 6)
 #define ORION_SPI_TMISO_SAMPLE_1	(1 << 6)
 #define ORION_SPI_TMISO_SAMPLE_2	(2 << 6)
@@ -683,6 +686,25 @@
 		goto out_rel_axi_clk;
 	}
 
+	/*
+	 * on A8K (using a380 compatible) and A380, there are per-CS
+	 * timing parameters registers, which may be used and left
+	 * active by the bootloader.
+	 *
+	 * This drivers uses the global timing parameter register(s)
+	 * and interface configuration register, and could silently
+	 * fallback to previously configured per-CS timing parameters,
+	 * unless those registers are cleared beforehand.
+	 */
+	if (of_device_is_compatible(pdev->dev.of_node, 
+				    "marvell,armada-380-spi")) {
+		int cs;
+
+		for (cs = 0; cs < 8; ++cs)
+			writel(0x0, spi->base + SPI_CSN_TIMING_PARM_REGS(cs));
+
+	}
+
 	for_each_available_child_of_node(pdev->dev.of_node, np) {
 		struct orion_direct_acc *dir_acc;
 		u32 cs;
diff -ruw linux-5.4.60/drivers/thermal/thermal_core.c linux-5.4.60-fbx/drivers/thermal/thermal_core.c
--- linux-5.4.60/drivers/thermal/thermal_core.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/thermal/thermal_core.c	2021-03-04 13:21:00.014172322 +0100
@@ -931,6 +931,7 @@
 
 /**
  * __thermal_cooling_device_register() - register a new thermal cooling device
+ * @dev:	parent device
  * @np:		a pointer to a device tree node.
  * @type:	the thermal cooling device type.
  * @devdata:	device private data.
@@ -946,7 +947,7 @@
  * ERR_PTR. Caller must check return value with IS_ERR*() helpers.
  */
 static struct thermal_cooling_device *
-__thermal_cooling_device_register(struct device_node *np,
+__thermal_cooling_device_register(struct device *pdev, struct device_node *np,
 				  const char *type, void *devdata,
 				  const struct thermal_cooling_device_ops *ops)
 {
@@ -982,6 +983,7 @@
 	cdev->devdata = devdata;
 	thermal_cooling_device_setup_sysfs(cdev);
 	dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
+	cdev->device.parent = pdev;
 	result = device_register(&cdev->device);
 	if (result) {
 		ida_simple_remove(&thermal_cdev_ida, cdev->id);
@@ -1024,11 +1026,30 @@
 thermal_cooling_device_register(const char *type, void *devdata,
 				const struct thermal_cooling_device_ops *ops)
 {
-	return __thermal_cooling_device_register(NULL, type, devdata, ops);
+	return __thermal_cooling_device_register(NULL, NULL, type, devdata, ops);
 }
 EXPORT_SYMBOL_GPL(thermal_cooling_device_register);
 
 /**
+ * thermal_cooling_device_register_with_parent() - register a new thermal cooling device
+ * @pdev:	parent device
+ * @type:	the thermal cooling device type.
+ * @devdata:	device private data.
+ * @ops:		standard thermal cooling devices callbacks.
+ *
+ * Same as thermal_cooling_device_register but take also the parent device.
+ * Then, hwpath will include the parent device to uniquely identify this device
+ */
+struct thermal_cooling_device *
+thermal_cooling_device_register_with_parent(struct device *pdev,
+				const char *type, void *devdata,
+				const struct thermal_cooling_device_ops *ops)
+{
+	return __thermal_cooling_device_register(pdev, NULL, type, devdata, ops);
+}
+EXPORT_SYMBOL_GPL(thermal_cooling_device_register_with_parent);
+
+/**
  * thermal_of_cooling_device_register() - register an OF thermal cooling device
  * @np:		a pointer to a device tree node.
  * @type:	the thermal cooling device type.
@@ -1048,7 +1069,7 @@
 				   const char *type, void *devdata,
 				   const struct thermal_cooling_device_ops *ops)
 {
-	return __thermal_cooling_device_register(np, type, devdata, ops);
+	return __thermal_cooling_device_register(NULL, np, type, devdata, ops);
 }
 EXPORT_SYMBOL_GPL(thermal_of_cooling_device_register);
 
@@ -1088,7 +1109,7 @@
 	if (!ptr)
 		return ERR_PTR(-ENOMEM);
 
-	tcd = __thermal_cooling_device_register(np, type, devdata, ops);
+	tcd = __thermal_cooling_device_register(NULL, np, type, devdata, ops);
 	if (IS_ERR(tcd)) {
 		devres_free(ptr);
 		return tcd;
diff -ruw linux-5.4.60/drivers/tty/serial/Kconfig linux-5.4.60-fbx/drivers/tty/serial/Kconfig
--- linux-5.4.60/drivers/tty/serial/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/tty/serial/Kconfig	2021-03-04 13:21:00.027505655 +0100
@@ -1134,6 +1134,11 @@
 	    BCM68xx (PON)
 	    BCM7xxx (STB) - DOCSIS console
 
+config SERIAL_BCM63XX_HS
+	tristate "Broadcom BCM63xx HS UART support"
+	select SERIAL_CORE
+	depends on ARCH_BCM63XX || COMPILE_TEST
+
 config SERIAL_BCM63XX_CONSOLE
 	bool "Console on BCM63xx serial port"
 	depends on SERIAL_BCM63XX=y
diff -ruw linux-5.4.60/drivers/tty/serial/Makefile linux-5.4.60-fbx/drivers/tty/serial/Makefile
--- linux-5.4.60/drivers/tty/serial/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/tty/serial/Makefile	2021-03-04 13:21:00.027505655 +0100
@@ -30,6 +30,7 @@
 obj-$(CONFIG_SERIAL_PNX8XXX) += pnx8xxx_uart.o
 obj-$(CONFIG_SERIAL_SA1100) += sa1100.o
 obj-$(CONFIG_SERIAL_BCM63XX) += bcm63xx_uart.o
+obj-$(CONFIG_SERIAL_BCM63XX_HS) += bcm63xx-hs-uart.o
 obj-$(CONFIG_SERIAL_SAMSUNG) += samsung.o
 obj-$(CONFIG_SERIAL_MAX3100) += max3100.o
 obj-$(CONFIG_SERIAL_MAX310X) += max310x.o
diff -ruw linux-5.4.60/drivers/usb/host/Kconfig linux-5.4.60-fbx/drivers/usb/host/Kconfig
--- linux-5.4.60/drivers/usb/host/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/usb/host/Kconfig	2021-03-04 13:21:00.080838992 +0100
@@ -70,13 +70,13 @@
 	  If unsure, say N.
 
 config USB_XHCI_MVEBU
-	tristate "xHCI support for Marvell Armada 375/38x/37xx"
+	tristate "xHCI support for Marvell Armada 375/38x/37xx/70x0/80x0"
 	select USB_XHCI_PLATFORM
 	depends on HAS_IOMEM
 	depends on ARCH_MVEBU || COMPILE_TEST
 	---help---
 	  Say 'Y' to enable the support for the xHCI host controller
-	  found in Marvell Armada 375/38x/37xx ARM SOCs.
+	  found in Marvell Armada 375/38x/37xx/70x0/80x0 ARM SOCs.
 
 config USB_XHCI_RCAR
 	tristate "xHCI support for Renesas R-Car SoCs"
@@ -734,6 +734,10 @@
 
 	  If unsure, say N.
 
+config USB_BCM63158
+	tristate "Broadcom BCM63158 SoC USB host driver"
+	depends on ARCH_BCM63XX || COMPILE_TEST
+
 config USB_HCD_SSB
 	tristate "SSB usb host driver"
 	depends on SSB
diff -ruw linux-5.4.60/drivers/usb/host/Makefile linux-5.4.60-fbx/drivers/usb/host/Makefile
--- linux-5.4.60/drivers/usb/host/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/usb/host/Makefile	2021-03-04 13:21:00.080838992 +0100
@@ -88,3 +88,4 @@
 obj-$(CONFIG_USB_HCD_SSB)	+= ssb-hcd.o
 obj-$(CONFIG_USB_FOTG210_HCD)	+= fotg210-hcd.o
 obj-$(CONFIG_USB_MAX3421_HCD)	+= max3421-hcd.o
+obj-$(CONFIG_USB_BCM63158)	+= usb-bcm63158.o
diff -ruw linux-5.4.60/drivers/usb/host/xhci-plat.c linux-5.4.60-fbx/drivers/usb/host/xhci-plat.c
--- linux-5.4.60/drivers/usb/host/xhci-plat.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/usb/host/xhci-plat.c	2021-03-04 13:21:00.090838992 +0100
@@ -127,6 +127,8 @@
 		.compatible = "marvell,armada3700-xhci",
 		.data = &xhci_plat_marvell_armada3700,
 	}, {
+		.compatible = "marvell,armada-8k-xhci",
+	}, {
 		.compatible = "renesas,xhci-r8a7790",
 		.data = &xhci_plat_renesas_rcar_gen2,
 	}, {
diff -ruw linux-5.4.60/drivers/usb/storage/usb.c linux-5.4.60-fbx/drivers/usb/storage/usb.c
--- linux-5.4.60/drivers/usb/storage/usb.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/usb/storage/usb.c	2021-03-04 13:21:00.120838993 +0100
@@ -67,7 +67,7 @@
 MODULE_DESCRIPTION("USB Mass Storage driver for Linux");
 MODULE_LICENSE("GPL");
 
-static unsigned int delay_use = 1;
+static unsigned int delay_use = 5;
 module_param(delay_use, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(delay_use, "seconds to delay before using a new device");
 
diff -ruw linux-5.4.60/drivers/video/fbdev/Kconfig linux-5.4.60-fbx/drivers/video/fbdev/Kconfig
--- linux-5.4.60/drivers/video/fbdev/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/video/fbdev/Kconfig	2021-03-04 13:21:00.130838993 +0100
@@ -2263,6 +2263,24 @@
 	  called sm712fb. If you want to compile it as a module, say M
 	  here and read <file:Documentation/kbuild/modules.rst>.
 
+config FB_SSD1320
+	tristate "SSD1320 OLED driver"
+	depends on FB && SPI
+	select FB_SYS_FILLRECT
+	select FB_SYS_COPYAREA
+	select FB_SYS_IMAGEBLIT
+	select FB_SYS_FOPS
+	select FB_BACKLIGHT
+
+config FB_SSD1327
+	tristate "SSD1327 OLED driver"
+	depends on FB && SPI
+	select FB_SYS_FILLRECT
+	select FB_SYS_COPYAREA
+	select FB_SYS_IMAGEBLIT
+	select FB_SYS_FOPS
+	select FB_BACKLIGHT
+
 source "drivers/video/fbdev/omap/Kconfig"
 source "drivers/video/fbdev/omap2/Kconfig"
 source "drivers/video/fbdev/mmp/Kconfig"
diff -ruw linux-5.4.60/drivers/video/fbdev/Makefile linux-5.4.60-fbx/drivers/video/fbdev/Makefile
--- linux-5.4.60/drivers/video/fbdev/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/video/fbdev/Makefile	2021-03-04 13:21:00.130838993 +0100
@@ -131,6 +131,8 @@
 obj-$(CONFIG_FB_DA8XX)		  += da8xx-fb.o
 obj-$(CONFIG_FB_SSD1307)	  += ssd1307fb.o
 obj-$(CONFIG_FB_SIMPLE)           += simplefb.o
+obj-$(CONFIG_FB_SSD1327)          += ssd1327.o
+obj-$(CONFIG_FB_SSD1320)          += ssd1320.o
 
 # the test framebuffer is last
 obj-$(CONFIG_FB_VIRTUAL)          += vfb.o
diff -ruw linux-5.4.60/drivers/video/Kconfig linux-5.4.60-fbx/drivers/video/Kconfig
--- linux-5.4.60/drivers/video/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/drivers/video/Kconfig	2021-03-04 13:21:00.127505660 +0100
@@ -46,5 +46,4 @@
 
 endif
 
-
 endmenu
diff -ruw linux-5.4.60/fs/exec.c linux-5.4.60-fbx/fs/exec.c
--- linux-5.4.60/fs/exec.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/fs/exec.c	2021-03-04 13:21:00.760839022 +0100
@@ -1729,6 +1729,23 @@
 		return PTR_ERR(filename);
 
 	/*
+	 * handle current->exec_mode:
+	 * - if unlimited, then nothing to do.
+	 * - if once, then set it to denied and continue (next execve
+	 *   after this one will fail).
+	 * - if denied, then effectively fail the execve call with EPERM.
+	 */
+	switch (current->exec_mode) {
+	case EXEC_MODE_UNLIMITED:
+		break;
+	case EXEC_MODE_ONCE:
+		current->exec_mode = EXEC_MODE_DENIED;
+		break;
+	case EXEC_MODE_DENIED:
+		return -EPERM;
+	}
+
+	/*
 	 * We move the actual failure in case of RLIMIT_NPROC excess from
 	 * set*uid() to execve() because too many poorly written programs
 	 * don't check setuid() return code.  Here we additionally recheck
diff -ruw linux-5.4.60/fs/Kconfig linux-5.4.60-fbx/fs/Kconfig
--- linux-5.4.60/fs/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/fs/Kconfig	2021-03-30 15:48:29.595052528 +0200
@@ -143,6 +143,7 @@
 
 source "fs/fat/Kconfig"
 source "fs/ntfs/Kconfig"
+source "fs/exfat/Kconfig"
 
 endmenu
 endif # BLOCK
@@ -286,6 +287,8 @@
 source "fs/nfs/Kconfig"
 source "fs/nfsd/Kconfig"
 
+source "fs/cifsd/Kconfig"
+
 config GRACE_PERIOD
 	tristate
 
diff -ruw linux-5.4.60/fs/Makefile linux-5.4.60-fbx/fs/Makefile
--- linux-5.4.60/fs/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/fs/Makefile	2021-03-30 15:48:29.595052528 +0200
@@ -91,6 +91,7 @@
 obj-$(CONFIG_NFS_FS)		+= nfs/
 obj-$(CONFIG_EXPORTFS)		+= exportfs/
 obj-$(CONFIG_NFSD)		+= nfsd/
+obj-$(CONFIG_SMB_SERVER)	+= cifsd/
 obj-$(CONFIG_LOCKD)		+= lockd/
 obj-$(CONFIG_NLS)		+= nls/
 obj-$(CONFIG_UNICODE)		+= unicode/
@@ -132,3 +133,4 @@
 obj-$(CONFIG_PSTORE)		+= pstore/
 obj-$(CONFIG_EFIVAR_FS)		+= efivarfs/
 obj-$(CONFIG_EROFS_FS)		+= erofs/
+obj-$(CONFIG_EXFAT_FS_FBX)	+= exfat/
diff -ruw linux-5.4.60/fs/proc/array.c linux-5.4.60-fbx/fs/proc/array.c
--- linux-5.4.60/fs/proc/array.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/fs/proc/array.c	2021-03-04 13:21:00.864172360 +0100
@@ -149,6 +149,21 @@
 	return task_state_array[task_state_index(tsk)];
 }
 
+static const char *const task_exec_mode_array[] = {
+	"0 (Denied)",
+	"1 (Once)",
+	"2 (Unlimited)",
+};
+
+static inline const char *get_task_exec_mode(struct task_struct *tsk)
+{
+	unsigned int exec_mode = tsk->exec_mode;
+
+	if (exec_mode > EXEC_MODE_UNLIMITED)
+		return "? (Invalid)";
+	return task_exec_mode_array[exec_mode];
+}
+
 static inline void task_state(struct seq_file *m, struct pid_namespace *ns,
 				struct pid *pid, struct task_struct *p)
 {
@@ -378,6 +393,12 @@
 	seq_putc(m, '\n');
 }
 
+static inline void task_exec_mode(struct seq_file *m,
+				  struct task_struct *p)
+{
+	seq_printf(m, "Exec mode: %s\n", get_task_exec_mode(p));
+}
+
 static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
 {
 	seq_printf(m, "Cpus_allowed:\t%*pb\n",
@@ -424,6 +445,7 @@
 	task_cpus_allowed(m, task);
 	cpuset_task_status_allowed(m, task);
 	task_context_switch_counts(m, task);
+	task_exec_mode(m, task);
 	return 0;
 }
 
diff -ruw linux-5.4.60/fs/pstore/inode.c linux-5.4.60-fbx/fs/pstore/inode.c
--- linux-5.4.60/fs/pstore/inode.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/fs/pstore/inode.c	2021-03-30 15:48:29.605052529 +0200
@@ -321,9 +321,10 @@
 		goto fail;
 	inode->i_mode = S_IFREG | 0444;
 	inode->i_fop = &pstore_file_operations;
-	scnprintf(name, sizeof(name), "%s-%s-%llu%s",
+	scnprintf(name, sizeof(name), "%s-%s-%s%llu%s",
 			pstore_type_to_name(record->type),
-			record->psi->name, record->id,
+		        record->psi->name, record->old ? "old-" : "",
+		        record->id,
 			record->compressed ? ".enc.z" : "");
 
 	private = kzalloc(sizeof(*private), GFP_KERNEL);
diff -ruw linux-5.4.60/fs/pstore/ram.c linux-5.4.60-fbx/fs/pstore/ram.c
--- linux-5.4.60/fs/pstore/ram.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/fs/pstore/ram.c	2021-03-30 15:48:29.605052529 +0200
@@ -131,6 +131,7 @@
 
 	record->type = prz->type;
 	record->id = id;
+	record->old = prz->old_zone;
 
 	return prz;
 }
@@ -516,7 +517,7 @@
 static int ramoops_init_przs(const char *name,
 			     struct device *dev, struct ramoops_context *cxt,
 			     struct persistent_ram_zone ***przs,
-			     phys_addr_t *paddr, size_t mem_sz,
+			     phys_addr_t *paddr, void *vaddr, size_t mem_sz,
 			     ssize_t record_size,
 			     unsigned int *cnt, u32 sig, u32 flags)
 {
@@ -580,7 +581,7 @@
 		else
 			label = kasprintf(GFP_KERNEL, "ramoops:%s(%d/%d)",
 					  name, i, *cnt - 1);
-		prz_ar[i] = persistent_ram_new(*paddr, zone_sz, sig,
+		prz_ar[i] = persistent_ram_new(*paddr, vaddr, zone_sz, sig,
 					       &cxt->ecc_info,
 					       cxt->memtype, flags, label);
 		kfree(label);
@@ -612,7 +613,7 @@
 static int ramoops_init_prz(const char *name,
 			    struct device *dev, struct ramoops_context *cxt,
 			    struct persistent_ram_zone **prz,
-			    phys_addr_t *paddr, size_t sz, u32 sig)
+			    phys_addr_t *paddr, void *vaddr, size_t sz, u32 sig)
 {
 	char *label;
 
@@ -627,7 +628,7 @@
 	}
 
 	label = kasprintf(GFP_KERNEL, "ramoops:%s", name);
-	*prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info,
+	*prz = persistent_ram_new(*paddr, vaddr, sz, sig, &cxt->ecc_info,
 				  cxt->memtype, PRZ_FLAG_ZAP_OLD, label);
 	kfree(label);
 	if (IS_ERR(*prz)) {
@@ -794,12 +795,14 @@
 	dump_mem_sz = cxt->size - cxt->console_size - cxt->ftrace_size
 			- cxt->pmsg_size;
 	err = ramoops_init_przs("dmesg", dev, cxt, &cxt->dprzs, &paddr,
+				pdata->mem_ptr,
 				dump_mem_sz, cxt->record_size,
 				&cxt->max_dump_cnt, 0, 0);
 	if (err)
 		goto fail_out;
 
 	err = ramoops_init_prz("console", dev, cxt, &cxt->cprz, &paddr,
+			       pdata->mem_ptr,
 			       cxt->console_size, 0);
 	if (err)
 		goto fail_init_cprz;
@@ -808,6 +811,7 @@
 				? nr_cpu_ids
 				: 1;
 	err = ramoops_init_przs("ftrace", dev, cxt, &cxt->fprzs, &paddr,
+				pdata->mem_ptr,
 				cxt->ftrace_size, -1,
 				&cxt->max_ftrace_cnt, LINUX_VERSION_CODE,
 				(cxt->flags & RAMOOPS_FLAG_FTRACE_PER_CPU)
@@ -816,6 +820,7 @@
 		goto fail_init_fprz;
 
 	err = ramoops_init_prz("pmsg", dev, cxt, &cxt->mprz, &paddr,
+			       pdata->mem_ptr,
 				cxt->pmsg_size, 0);
 	if (err)
 		goto fail_init_mprz;
diff -ruw linux-5.4.60/fs/pstore/ram_core.c linux-5.4.60-fbx/fs/pstore/ram_core.c
--- linux-5.4.60/fs/pstore/ram_core.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/fs/pstore/ram_core.c	2021-03-30 15:48:29.605052529 +0200
@@ -34,6 +34,7 @@
 	uint32_t    sig;
 	atomic_t    start;
 	atomic_t    size;
+	atomic_t    flags;
 	uint8_t     data[0];
 };
 
@@ -395,6 +396,7 @@
 {
 	atomic_set(&prz->buffer->start, 0);
 	atomic_set(&prz->buffer->size, 0);
+	atomic_set(&prz->buffer->flags, 0);
 	persistent_ram_update_header_ecc(prz);
 }
 
@@ -463,13 +465,16 @@
 	return va;
 }
 
-static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size,
+static int persistent_ram_buffer_map(phys_addr_t start, void *vaddr,
+				     phys_addr_t size,
 		struct persistent_ram_zone *prz, int memtype)
 {
 	prz->paddr = start;
 	prz->size = size;
 
-	if (pfn_valid(start >> PAGE_SHIFT))
+	if (vaddr)
+		prz->vaddr = vaddr;
+	else if (pfn_valid(start >> PAGE_SHIFT))
 		prz->vaddr = persistent_ram_vmap(start, size, memtype);
 	else
 		prz->vaddr = persistent_ram_iomap(start, size, memtype,
@@ -516,6 +521,15 @@
 			pr_debug("found existing buffer, size %zu, start %zu\n",
 				 buffer_size(prz), buffer_start(prz));
 			persistent_ram_save_old(prz);
+
+			if (atomic_read(&prz->buffer->flags) > 0) {
+				pr_info("old ramoops!\n");
+				prz->old_zone = true;
+			} else {
+				pr_info("fresh ramoops!\n");
+				atomic_set(&prz->buffer->flags, 1);
+			}
+			persistent_ram_update_header_ecc(prz);
 		}
 	} else {
 		pr_debug("no valid data in buffer (sig = 0x%08x)\n",
@@ -558,7 +572,8 @@
 	kfree(prz);
 }
 
-struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
+struct persistent_ram_zone *persistent_ram_new(phys_addr_t start,
+					       void *vaddr, size_t size,
 			u32 sig, struct persistent_ram_ecc_info *ecc_info,
 			unsigned int memtype, u32 flags, char *label)
 {
@@ -576,7 +591,7 @@
 	prz->flags = flags;
 	prz->label = kstrdup(label, GFP_KERNEL);
 
-	ret = persistent_ram_buffer_map(start, size, prz, memtype);
+	ret = persistent_ram_buffer_map(start, vaddr, size, prz, memtype);
 	if (ret)
 		goto err;
 
diff -ruw linux-5.4.60/include/asm-generic/vmlinux.lds.h linux-5.4.60-fbx/include/asm-generic/vmlinux.lds.h
--- linux-5.4.60/include/asm-generic/vmlinux.lds.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/asm-generic/vmlinux.lds.h	2021-03-04 13:21:00.920839029 +0100
@@ -264,7 +264,7 @@
 #define KERNEL_DTB()							\
 	STRUCT_ALIGN();							\
 	__dtb_start = .;						\
-	KEEP(*(.dtb.init.rodata))					\
+	KEEP(*(.dtb.rodata))						\
 	__dtb_end = .;
 
 /*
@@ -354,6 +354,7 @@
 	. = ALIGN((align));						\
 	.rodata           : AT(ADDR(.rodata) - LOAD_OFFSET) {		\
 		__start_rodata = .;					\
+		KERNEL_DTB()						\
 		*(.rodata) *(.rodata.*)					\
 		RO_AFTER_INIT_DATA	/* Read only after init */	\
 		. = ALIGN(8);						\
@@ -644,7 +645,6 @@
 	TIMER_OF_TABLES()						\
 	CPU_METHOD_OF_TABLES()						\
 	CPUIDLE_METHOD_OF_TABLES()					\
-	KERNEL_DTB()							\
 	IRQCHIP_OF_MATCH_TABLE()					\
 	ACPI_PROBE_TABLE(irqchip)					\
 	ACPI_PROBE_TABLE(timer)						\
diff -ruw linux-5.4.60/include/linux/ethtool.h linux-5.4.60-fbx/include/linux/ethtool.h
--- linux-5.4.60/include/linux/ethtool.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/ethtool.h	2021-03-04 13:21:00.967505698 +0100
@@ -404,6 +404,14 @@
 				      struct ethtool_fecparam *);
 	void	(*get_ethtool_phy_stats)(struct net_device *,
 					 struct ethtool_stats *, u64 *);
+	int	(*get_epon_param)(struct net_device *,
+				  struct ethtool_epon_param *);
+	int	(*set_epon_param)(struct net_device *,
+				  const struct ethtool_epon_param *);
+	int	(*set_shaper_param)(struct net_device *,
+				    const struct ethtool_shaper_params *);
+	int	(*get_shaper_param)(struct net_device *,
+				    struct ethtool_shaper_params *);
 };
 
 struct ethtool_rx_flow_rule {
diff -ruw linux-5.4.60/include/linux/genhd.h linux-5.4.60-fbx/include/linux/genhd.h
--- linux-5.4.60/include/linux/genhd.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/genhd.h	2021-03-04 13:21:00.970839031 +0100
@@ -91,6 +91,7 @@
 	unsigned long io_ticks;
 	unsigned long time_in_queue;
 	local_t in_flight[2];
+	unsigned long io_errors[2];
 };
 
 #define PARTITION_META_INFO_VOLNAMELTH	64
@@ -614,6 +615,7 @@
 #define ADDPART_FLAG_NONE	0
 #define ADDPART_FLAG_RAID	1
 #define ADDPART_FLAG_WHOLEDISK	2
+#define ADDPART_FLAG_RO		4
 
 extern int blk_alloc_devt(struct hd_struct *part, dev_t *devt);
 extern void blk_free_devt(dev_t devt);
diff -ruw linux-5.4.60/include/linux/if_vlan.h linux-5.4.60-fbx/include/linux/if_vlan.h
--- linux-5.4.60/include/linux/if_vlan.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/if_vlan.h	2021-03-04 13:21:00.977505698 +0100
@@ -12,6 +12,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/bug.h>
 #include <uapi/linux/if_vlan.h>
+#include <uapi/linux/pkt_sched.h>
 
 #define VLAN_HLEN	4		/* The additional bytes required by VLAN
 					 * (in addition to the Ethernet header)
@@ -134,6 +135,7 @@
 			 int (*action)(struct net_device *dev, int vid,
 				       void *arg), void *arg);
 extern struct net_device *vlan_dev_real_dev(const struct net_device *dev);
+extern struct net_device *vlan_dev_upper_dev(const struct net_device *dev);
 extern u16 vlan_dev_vlan_id(const struct net_device *dev);
 extern __be16 vlan_dev_vlan_proto(const struct net_device *dev);
 
@@ -200,7 +202,7 @@
 
 	mp = vlan_dev_priv(dev)->egress_priority_map[(skprio & 0xF)];
 	while (mp) {
-		if (mp->priority == skprio) {
+		if (mp->priority == (skprio & TC_H_MIN_MASK)) {
 			return mp->vlan_qos; /* This should already be shifted
 					      * to mask correctly with the
 					      * VLAN's TCI */
@@ -242,6 +244,12 @@
 {
 	BUG();
 	return NULL;
+}
+
+static inline struct net_device *vlan_dev_upper_dev(const struct net_device *dev)
+{
+	BUG();
+	return NULL;
 }
 
 static inline u16 vlan_dev_vlan_id(const struct net_device *dev)
diff -ruw linux-5.4.60/include/linux/in.h linux-5.4.60-fbx/include/linux/in.h
--- linux-5.4.60/include/linux/in.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/in.h	2021-03-04 13:21:00.980839031 +0100
@@ -30,6 +30,9 @@
 		return 0;
 	case IPPROTO_AH:	/* SPI */
 		return 4;
+	case IPPROTO_IPV6:
+		/* third byte of ipv6 destination address */
+		return 36;
 	default:
 		return -EINVAL;
 	}
diff -ruw linux-5.4.60/include/linux/miscdevice.h linux-5.4.60-fbx/include/linux/miscdevice.h
--- linux-5.4.60/include/linux/miscdevice.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/miscdevice.h	2021-03-04 13:21:01.004172366 +0100
@@ -21,6 +21,7 @@
 #define APOLLO_MOUSE_MINOR	7	/* unused */
 #define PC110PAD_MINOR		9	/* unused */
 /*#define ADB_MOUSE_MINOR	10	FIXME OBSOLETE */
+#define TALDEV_MINOR		74	/* Marvell TAL device */
 #define WATCHDOG_MINOR		130	/* Watchdog timer     */
 #define TEMP_MINOR		131	/* Temperature Sensor */
 #define APM_MINOR_DEV		134
diff -ruw linux-5.4.60/include/linux/mtd/mtd.h linux-5.4.60-fbx/include/linux/mtd/mtd.h
--- linux-5.4.60/include/linux/mtd/mtd.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/mtd/mtd.h	2021-03-04 13:21:01.010839033 +0100
@@ -247,6 +247,12 @@
 	 */
 	unsigned int bitflip_threshold;
 
+	/* NAND related attributes */
+	const char *nand_type;
+	const char *nand_manufacturer;
+	const char *onfi_model;
+	uint8_t onfi_ecc_bits;
+
 	/* Kernel-only stuff starts here. */
 	const char *name;
 	int index;
diff -ruw linux-5.4.60/include/linux/mtd/spi-nor.h linux-5.4.60-fbx/include/linux/mtd/spi-nor.h
--- linux-5.4.60/include/linux/mtd/spi-nor.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/mtd/spi-nor.h	2021-03-04 13:21:01.010839033 +0100
@@ -56,9 +56,11 @@
 #define SPINOR_OP_PP_1_8_8	0xc2	/* Octal page program */
 #define SPINOR_OP_BE_4K		0x20	/* Erase 4KiB block */
 #define SPINOR_OP_BE_4K_PMC	0xd7	/* Erase 4KiB block on PMC chips */
+#define SPINOR_OP_EWRSR		0x50	/* SST: Enable write to status reg */
 #define SPINOR_OP_BE_32K	0x52	/* Erase 32KiB block */
 #define SPINOR_OP_CHIP_ERASE	0xc7	/* Erase whole flash chip */
 #define SPINOR_OP_SE		0xd8	/* Sector erase (usually 64KiB) */
+#define	SPINOR_OP_RDID_ALT	0x90	/* Read ID (alt) */
 #define SPINOR_OP_RDID		0x9f	/* Read JEDEC ID */
 #define SPINOR_OP_RDSFDP	0x5a	/* Read SFDP */
 #define SPINOR_OP_RDCR		0x35	/* Read configuration register */
@@ -598,6 +600,8 @@
 	ssize_t (*write)(struct spi_nor *nor, loff_t to,
 			size_t len, const u_char *write_buf);
 	int (*erase)(struct spi_nor *nor, loff_t offs);
+	int (*read_alt_id)(struct spi_nor *nor, u8 cmd, u8 *val, int len);
+	int (*read_atmel_id)(struct spi_nor *nor, u8 cmd, u8 *val, int len);
 
 	int (*clear_sr_bp)(struct spi_nor *nor);
 	struct spi_nor_flash_parameter params;
diff -ruw linux-5.4.60/include/linux/netdevice.h linux-5.4.60-fbx/include/linux/netdevice.h
--- linux-5.4.60/include/linux/netdevice.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/netdevice.h	2021-03-04 13:21:01.014172366 +0100
@@ -65,6 +65,20 @@
 struct bpf_prog;
 struct xdp_buff;
 
+#ifdef CONFIG_NETRXTHREAD
+
+#define RXTHREAD_MAX_PKTS       512
+struct krxd {
+	struct sk_buff_head	pkt_queue;
+	unsigned int		stats_pkts;
+	unsigned int		stats_dropped;
+	wait_queue_head_t	wq;
+	struct task_struct	*task;
+};
+
+extern struct krxd gkrxd[CONFIG_NETRXTHREAD_RX_QUEUE];
+#endif
+
 void netdev_set_default_ethtool_ops(struct net_device *dev,
 				    const struct ethtool_ops *ops);
 
@@ -1522,6 +1536,8 @@
 	IFF_FAILOVER_SLAVE		= 1<<28,
 	IFF_L3MDEV_RX_HANDLER		= 1<<29,
 	IFF_LIVE_RENAME_OK		= 1<<30,
+	IFF_FBXBRIDGE			= 1ULL<<31,
+	IFF_FBXBRIDGE_PORT		= 1ULL<<32,
 };
 
 #define IFF_802_1Q_VLAN			IFF_802_1Q_VLAN
@@ -1554,6 +1570,8 @@
 #define IFF_FAILOVER_SLAVE		IFF_FAILOVER_SLAVE
 #define IFF_L3MDEV_RX_HANDLER		IFF_L3MDEV_RX_HANDLER
 #define IFF_LIVE_RENAME_OK		IFF_LIVE_RENAME_OK
+#define IFF_FBXBRIDGE			IFF_FBXBRIDGE
+#define IFF_FBXBRIDGE_PORT		IFF_FBXBRIDGE_PORT
 
 /**
  *	struct net_device - The DEVICE structure.
@@ -1858,7 +1876,7 @@
 	const struct header_ops *header_ops;
 
 	unsigned int		flags;
-	unsigned int		priv_flags;
+	u64			priv_flags;
 
 	unsigned short		gflags;
 	unsigned short		padded;
@@ -4616,6 +4634,16 @@
 	return dev->priv_flags & IFF_BRIDGE_PORT;
 }
 
+static inline bool netif_is_fbxbridge_master(const struct net_device *dev)
+{
+	return dev->priv_flags & IFF_FBXBRIDGE;
+}
+
+static inline bool netif_is_fbxbridge_port(const struct net_device *dev)
+{
+	return dev->priv_flags & IFF_FBXBRIDGE_PORT;
+}
+
 static inline bool netif_is_ovs_master(const struct net_device *dev)
 {
 	return dev->priv_flags & IFF_OPENVSWITCH;
diff -ruw linux-5.4.60/include/linux/netfilter/nf_conntrack_ftp.h linux-5.4.60-fbx/include/linux/netfilter/nf_conntrack_ftp.h
--- linux-5.4.60/include/linux/netfilter/nf_conntrack_ftp.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/netfilter/nf_conntrack_ftp.h	2021-03-04 13:21:01.014172366 +0100
@@ -22,6 +22,11 @@
 	u_int16_t seq_aft_nl_num[IP_CT_DIR_MAX];
 	/* pickup sequence tracking, useful for conntrackd */
 	u_int16_t flags[IP_CT_DIR_MAX];
+#if defined(CONFIG_FREEBOX_BRIDGE) || defined(CONFIG_FREEBOX_BRIDGE_MODULE)
+	unsigned int is_fbxbridge;
+	unsigned long fbxbridge_remote;
+	unsigned long fbxbridge_wan;
+#endif
 };
 
 /* For NAT to hook in when we find a packet which describes what other
diff -ruw linux-5.4.60/include/linux/netfilter/nf_conntrack_sip.h linux-5.4.60-fbx/include/linux/netfilter/nf_conntrack_sip.h
--- linux-5.4.60/include/linux/netfilter/nf_conntrack_sip.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/netfilter/nf_conntrack_sip.h	2021-03-04 13:21:01.014172366 +0100
@@ -5,6 +5,7 @@
 #include <linux/skbuff.h>
 #include <linux/types.h>
 #include <net/netfilter/nf_conntrack_expect.h>
+#include <crypto/sha.h>
 
 #define SIP_PORT	5060
 #define SIP_TIMEOUT	3600
@@ -30,6 +31,10 @@
 	enum sip_expectation_classes	class;
 };
 
+struct nf_ct_sip_expect {
+	u8				cid_hash[SHA256_DIGEST_SIZE];
+};
+
 #define SDP_MEDIA_TYPE(__name, __class)					\
 {									\
 	.name	= (__name),						\
diff -ruw linux-5.4.60/include/linux/netfilter/nf_conntrack_tcp.h linux-5.4.60-fbx/include/linux/netfilter/nf_conntrack_tcp.h
--- linux-5.4.60/include/linux/netfilter/nf_conntrack_tcp.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/netfilter/nf_conntrack_tcp.h	2021-03-04 13:21:01.014172366 +0100
@@ -28,6 +28,7 @@
 	/* For SYN packets while we may be out-of-sync */
 	u_int8_t	last_wscale;	/* Last window scaling factor seen */
 	u_int8_t	last_flags;	/* Last flags set */
+	u_int32_t	no_window_track;
 };
 
 #endif /* _NF_CONNTRACK_TCP_H */
diff -ruw linux-5.4.60/include/linux/of_fdt.h linux-5.4.60-fbx/include/linux/of_fdt.h
--- linux-5.4.60/include/linux/of_fdt.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/of_fdt.h	2021-03-04 13:21:01.017505700 +0100
@@ -89,6 +89,7 @@
 extern void unflatten_and_copy_device_tree(void);
 extern void early_init_devtree(void *);
 extern void early_get_first_memblock_info(void *, phys_addr_t *);
+const void *of_fdt_find_compatible_dtb(const char *name);
 #else /* CONFIG_OF_EARLY_FLATTREE */
 static inline int early_init_dt_scan_chosen_stdout(void) { return -ENODEV; }
 static inline void early_init_fdt_scan_reserved_mem(void) {}
diff -ruw linux-5.4.60/include/linux/pci_ids.h linux-5.4.60-fbx/include/linux/pci_ids.h
--- linux-5.4.60/include/linux/pci_ids.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/pci_ids.h	2021-03-04 13:21:01.020839033 +0100
@@ -1838,6 +1838,7 @@
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7952	0x7952
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7954	0x7954
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7958	0x7958
+#define PCI_DEVICE_ID_PI7C9X20303SL	0xa303
 
 #define PCI_SUBVENDOR_ID_CHASE_PCIFAST		0x12E0
 #define PCI_SUBDEVICE_ID_CHASE_PCIFAST4		0x0031
diff -ruw linux-5.4.60/include/linux/phy.h linux-5.4.60-fbx/include/linux/phy.h
--- linux-5.4.60/include/linux/phy.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/phy.h	2021-03-04 13:21:01.020839033 +0100
@@ -102,6 +102,14 @@
 	/* 10GBASE-KR, XFI, SFI - single lane 10G Serdes */
 	PHY_INTERFACE_MODE_10GKR,
 	PHY_INTERFACE_MODE_USXGMII,
+
+	PHY_INTERFACE_MODE_1000BASEPX_D,
+	PHY_INTERFACE_MODE_1000BASEPX_U,
+	PHY_INTERFACE_MODE_10000BASEPR_D,
+	PHY_INTERFACE_MODE_10000BASEPR_U,
+	PHY_INTERFACE_MODE_10000_1000_BASEPRX_D,
+	PHY_INTERFACE_MODE_10000_1000_BASEPRX_U,
+
 	PHY_INTERFACE_MODE_MAX,
 } phy_interface_t;
 
@@ -179,6 +187,18 @@
 		return "10gbase-kr";
 	case PHY_INTERFACE_MODE_USXGMII:
 		return "usxgmii";
+	case PHY_INTERFACE_MODE_1000BASEPX_D:
+		return "1000base-px-d";
+	case PHY_INTERFACE_MODE_1000BASEPX_U:
+		return "1000base-px-u";
+	case PHY_INTERFACE_MODE_10000BASEPR_D:
+		return "10000base-pr-d";
+	case PHY_INTERFACE_MODE_10000BASEPR_U:
+		return "10000base-pr-u";
+	case PHY_INTERFACE_MODE_10000_1000_BASEPRX_D:
+		return "10000_1000base-prx-d";
+	case PHY_INTERFACE_MODE_10000_1000_BASEPRX_U:
+		return "10000_1000base-prx-u";
 	default:
 		return "unknown";
 	}
diff -ruw linux-5.4.60/include/linux/phylink.h linux-5.4.60-fbx/include/linux/phylink.h
--- linux-5.4.60/include/linux/phylink.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/phylink.h	2021-03-04 13:21:01.020839033 +0100
@@ -279,4 +279,7 @@
 void phylink_set_port_modes(unsigned long *bits);
 void phylink_helper_basex_speed(struct phylink_link_state *state);
 
+int phylink_set_interface_mode(struct phylink *pl, int mode);
+void phylink_revalidate(struct phylink *pl);
+
 #endif
diff -ruw linux-5.4.60/include/linux/ppp_channel.h linux-5.4.60-fbx/include/linux/ppp_channel.h
--- linux-5.4.60/include/linux/ppp_channel.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/ppp_channel.h	2021-03-04 13:21:01.030839034 +0100
@@ -45,6 +45,9 @@
 /* Called by the channel when it can send some more data. */
 extern void ppp_output_wakeup(struct ppp_channel *);
 
+/* Called by the channel when it want to prevent further transmit on it */
+extern void ppp_output_stop(struct ppp_channel *);
+
 /* Called by the channel to process a received PPP packet.
    The packet should have just the 2-byte PPP protocol header. */
 extern void ppp_input(struct ppp_channel *, struct sk_buff *);
diff -ruw linux-5.4.60/include/linux/pstore.h linux-5.4.60-fbx/include/linux/pstore.h
--- linux-5.4.60/include/linux/pstore.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/pstore.h	2021-03-30 15:48:29.605052529 +0200
@@ -64,6 +64,7 @@
  * @reason:	kdump reason for notification
  * @part:	position in a multipart record
  * @compressed:	whether the buffer is compressed
+ * @old:        reflects underlying prz old_zone.
  *
  */
 struct pstore_record {
@@ -79,6 +80,7 @@
 	enum kmsg_dump_reason	reason;
 	unsigned int		part;
 	bool			compressed;
+	bool			old;
 };
 
 /**
diff -ruw linux-5.4.60/include/linux/pstore_ram.h linux-5.4.60-fbx/include/linux/pstore_ram.h
--- linux-5.4.60/include/linux/pstore_ram.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/pstore_ram.h	2021-03-30 15:48:29.605052529 +0200
@@ -75,6 +75,10 @@
  * @old_log_size:
  *	bytes contained in @old_log
  *
+ * @old_zone:
+ *      tells whether the zone has just been freshly created, and has
+ *      been read for the first time, this boot, or if it is old, and
+ *      has been created many boots ago.
  */
 struct persistent_ram_zone {
 	phys_addr_t paddr;
@@ -97,9 +101,12 @@
 
 	char *old_log;
 	size_t old_log_size;
+
+	bool old_zone;
 };
 
-struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
+struct persistent_ram_zone *persistent_ram_new(phys_addr_t start,
+					       void *addr, size_t size,
 			u32 sig, struct persistent_ram_ecc_info *ecc_info,
 			unsigned int memtype, u32 flags, char *label);
 void persistent_ram_free(struct persistent_ram_zone *prz);
@@ -128,6 +135,7 @@
 struct ramoops_platform_data {
 	unsigned long	mem_size;
 	phys_addr_t	mem_address;
+	void		*mem_ptr;
 	unsigned int	mem_type;
 	unsigned long	record_size;
 	unsigned long	console_size;
diff -ruw linux-5.4.60/include/linux/regmap.h linux-5.4.60-fbx/include/linux/regmap.h
--- linux-5.4.60/include/linux/regmap.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/regmap.h	2021-03-04 13:21:01.037505700 +0100
@@ -1278,6 +1278,7 @@
 int regmap_irq_get_virq(struct regmap_irq_chip_data *data, int irq);
 struct irq_domain *regmap_irq_get_domain(struct regmap_irq_chip_data *data);
 
+void __iomem *regmap_get_mmio_base_address(struct regmap *map);
 #else
 
 /*
diff -ruw linux-5.4.60/include/linux/sched.h linux-5.4.60-fbx/include/linux/sched.h
--- linux-5.4.60/include/linux/sched.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/sched.h	2021-03-04 13:21:01.040839034 +0100
@@ -621,6 +621,12 @@
 	struct wake_q_node *next;
 };
 
+enum task_exec_mode {
+	EXEC_MODE_DENIED,
+	EXEC_MODE_ONCE,
+	EXEC_MODE_UNLIMITED,
+};
+
 struct task_struct {
 #ifdef CONFIG_THREAD_INFO_IN_TASK
 	/*
@@ -643,6 +649,7 @@
 	/* Per task flags (PF_*), defined further below: */
 	unsigned int			flags;
 	unsigned int			ptrace;
+	enum task_exec_mode		exec_mode;
 
 #ifdef CONFIG_SMP
 	struct llist_node		wake_entry;
diff -ruw linux-5.4.60/include/linux/sfp.h linux-5.4.60-fbx/include/linux/sfp.h
--- linux-5.4.60/include/linux/sfp.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/sfp.h	2021-03-04 13:21:01.044172368 +0100
@@ -506,6 +506,7 @@
 int sfp_get_module_info(struct sfp_bus *bus, struct ethtool_modinfo *modinfo);
 int sfp_get_module_eeprom(struct sfp_bus *bus, struct ethtool_eeprom *ee,
 			  u8 *data);
+int sfp_get_sfp_state(struct sfp_bus *bus, struct ethtool_sfp_state *st);
 void sfp_upstream_start(struct sfp_bus *bus);
 void sfp_upstream_stop(struct sfp_bus *bus);
 struct sfp_bus *sfp_register_upstream(struct fwnode_handle *fwnode,
@@ -544,6 +545,12 @@
 {
 	return -EOPNOTSUPP;
 }
+
+static inline int sfp_get_sfp_state(struct sfp_bus *the_bus,
+				    struct ethtool_sfp_state *st)
+{
+	return -EOPNOTSUPP;
+}
 
 static inline void sfp_upstream_start(struct sfp_bus *bus)
 {
diff -ruw linux-5.4.60/include/linux/skbuff.h linux-5.4.60-fbx/include/linux/skbuff.h
--- linux-5.4.60/include/linux/skbuff.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/skbuff.h	2021-03-04 13:21:01.047505701 +0100
@@ -604,6 +604,13 @@
 typedef unsigned char *sk_buff_data_t;
 #endif
 
+enum {
+	FFN_STATE_INIT = 0,
+	FFN_STATE_FORWARDABLE,
+	FFN_STATE_FAST_FORWARDED,
+	FFN_STATE_INCOMPATIBLE,
+};
+
 /**
  *	struct sk_buff - socket buffer
  *	@next: Next buffer in list
@@ -730,11 +737,20 @@
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 	unsigned long		 _nfct;
 #endif
+
+#if defined(CONFIG_IP_FFN) || defined(CONFIG_IPV6_FFN)
+	int			ffn_state;
+	int			ffn_orig_tos;
+#endif
 	unsigned int		len,
 				data_len;
 	__u16			mac_len,
 				hdr_len;
 
+#ifdef CONFIG_NETRXTHREAD
+	int			rxthread_prio;
+#endif
+
 	/* Following fields are _not_ copied in __copy_skb_header()
 	 * Note that queue_mapping is here mostly to fill a hole.
 	 */
@@ -2632,6 +2648,10 @@
  * get_rps_cpus() for example only access one 64 bytes aligned block :
  * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
  */
+#ifdef CONFIG_NETSKBPAD
+#define NET_SKB_PAD	CONFIG_NETSKBPAD
+#endif
+
 #ifndef NET_SKB_PAD
 #define NET_SKB_PAD	max(32, L1_CACHE_BYTES)
 #endif
diff -ruw linux-5.4.60/include/linux/tcp.h linux-5.4.60-fbx/include/linux/tcp.h
--- linux-5.4.60/include/linux/tcp.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/tcp.h	2021-03-04 13:21:01.054172368 +0100
@@ -225,7 +225,8 @@
 		fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */
 		fastopen_no_cookie:1, /* Allow send/recv SYN+data without a cookie */
 		is_sack_reneg:1,    /* in recovery from loss with SACK reneg? */
-		unused:2;
+		linear_rto  : 1,
+		unused:1;
 	u8	nonagle     : 4,/* Disable Nagle algorithm?             */
 		thin_lto    : 1,/* Use linear timeouts for thin streams */
 		recvmsg_inq : 1,/* Indicate # of bytes in queue upon recvmsg */
diff -ruw linux-5.4.60/include/linux/thermal.h linux-5.4.60-fbx/include/linux/thermal.h
--- linux-5.4.60/include/linux/thermal.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/linux/thermal.h	2021-03-04 13:21:01.054172368 +0100
@@ -444,6 +444,9 @@
 
 struct thermal_cooling_device *thermal_cooling_device_register(const char *,
 		void *, const struct thermal_cooling_device_ops *);
+struct thermal_cooling_device *thermal_cooling_device_register_with_parent(
+		struct device *pdev, const char *, void *,
+		const struct thermal_cooling_device_ops *);
 struct thermal_cooling_device *
 thermal_of_cooling_device_register(struct device_node *np, const char *, void *,
 				   const struct thermal_cooling_device_ops *);
diff -ruw linux-5.4.60/include/media/dvb-usb-ids.h linux-5.4.60-fbx/include/media/dvb-usb-ids.h
--- linux-5.4.60/include/media/dvb-usb-ids.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/media/dvb-usb-ids.h	2021-03-04 13:21:01.067505702 +0100
@@ -117,6 +117,7 @@
 #define USB_PID_DELOCK_USB2_DVBT			0xb803
 #define USB_PID_DIBCOM_HOOK_DEFAULT			0x0064
 #define USB_PID_DIBCOM_HOOK_DEFAULT_REENUM		0x0065
+#define USB_PID_DIBCOM_HOOK_DEFAULT_STK7770P		0x0066
 #define USB_PID_DIBCOM_MOD3000_COLD			0x0bb8
 #define USB_PID_DIBCOM_MOD3000_WARM			0x0bb9
 #define USB_PID_DIBCOM_MOD3001_COLD			0x0bc6
diff -ruw linux-5.4.60/include/net/cfg80211.h linux-5.4.60-fbx/include/net/cfg80211.h
--- linux-5.4.60/include/net/cfg80211.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/net/cfg80211.h	2021-03-04 13:21:01.077505702 +0100
@@ -117,6 +117,7 @@
 	(IEEE80211_CHAN_NO_HT40PLUS | IEEE80211_CHAN_NO_HT40MINUS)
 
 #define IEEE80211_DFS_MIN_CAC_TIME_MS		60000
+#define IEEE80211_DFS_WEATHER_MIN_CAC_TIME_MS	600000
 #define IEEE80211_DFS_MIN_NOP_TIME_MS		(30 * 60 * 1000)
 
 /**
@@ -1823,6 +1824,17 @@
 };
 
 /**
+ * struct mesh_setup - 802.11s mesh setup configuration
+ * @ie: vendor information elements
+ * @ie_len: length of vendor information elements
+ * These parameters are updated peroidically after mesh creation.
+ */
+struct mesh_vendor_ie {
+	const u8 *ie;
+	u8 ie_len;
+};
+
+/**
  * struct ocb_setup - 802.11p OCB mode setup configuration
  * @chandef: defines the channel to use
  *
@@ -3684,6 +3696,10 @@
 
 	int	(*add_mpath)(struct wiphy *wiphy, struct net_device *dev,
 			       const u8 *dst, const u8 *next_hop);
+	int	(*update_mpp)(struct wiphy *wiphy, struct net_device *dev,
+			       const u8 *dst, const u8 *next_hop);
+	int	(*delete_mpp)(struct wiphy *wiphy, struct net_device *dev,
+			      const u8 *dst);
 	int	(*del_mpath)(struct wiphy *wiphy, struct net_device *dev,
 			       const u8 *dst);
 	int	(*change_mpath)(struct wiphy *wiphy, struct net_device *dev,
@@ -3708,6 +3724,12 @@
 			     const struct mesh_config *conf,
 			     const struct mesh_setup *setup);
 	int	(*leave_mesh)(struct wiphy *wiphy, struct net_device *dev);
+	int	(*update_mesh_vendor_node_metrics_ie)(struct wiphy *wiphy,
+					 struct net_device *dev,
+					 const struct mesh_vendor_ie *vendor_ie);
+	int	(*update_mesh_vendor_path_metrics_ie)(struct wiphy *wiphy,
+						      struct net_device *dev,
+						      const struct mesh_vendor_ie *vendor_ie);
 
 	int	(*join_ocb)(struct wiphy *wiphy, struct net_device *dev,
 			    struct ocb_setup *setup);
@@ -7449,7 +7471,40 @@
  */
 bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
 			     bool is_4addr, u8 check_swif);
-
+/**
+ * cfg80211_notify_mesh_peer_node_metrics - notify cfg80211 of new mesh peer node metrics
+ *
+ * @dev: network device
+ * @macaddr: the MAC address of the new candidate
+ * @stype: Management frame sub type
+ * @signal: Frame received signal strength
+ * @beacon_int: Beacon interval advertised in received beacon frame
+ * @ie: vendor specific information elements advertised by the peer candidate
+ * @ie_len: lenght of the vendor specific information elements buffer
+ * @gfp: allocation flags
+ *
+ * This function notifies cfg80211 that the mesh peer management frame has been
+ * detected, most likely via a beacon or, less likely, via a probe response, probe request.
+ * cfg80211 then sends a notification to userspace.
+ */
+void cfg80211_notify_mesh_peer_node_metrics(struct net_device *dev,
+					    const u8 *macaddr, u16 stype, s8 signal,
+					    u32 beacon_int, const u8 *ie, u8 ie_len, gfp_t gfp);
+/**
+ * cfg80211_notify_mesh_peer_path_metrics - notify cfg80211 of mesh peer path metrics recieved
+ *
+ * @dev: network device
+ * @macaddr: the MAC address of the new candidate
+ * @ie: information elements advertised by the peer candidate
+ * @ie_len: lenght of the information elements buffer
+ * @gfp: allocation flags
+ *
+ * This function notifies cfg80211 that the mesh path metrics has been
+ * recieved, most likely via a beacon or, less likely, via a probe response.
+ * cfg80211 then sends a notification to userspace.
+ */
+void cfg80211_notify_mesh_peer_path_metrics(struct net_device *dev, const u8 *macaddr,
+					    const u8 *ie, u8 ie_len, gfp_t gfp);
 
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
diff -ruw linux-5.4.60/include/net/dsa.h linux-5.4.60-fbx/include/net/dsa.h
--- linux-5.4.60/include/net/dsa.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/net/dsa.h	2021-03-04 13:21:01.080839036 +0100
@@ -42,6 +42,7 @@
 #define DSA_TAG_PROTO_8021Q_VALUE		12
 #define DSA_TAG_PROTO_SJA1105_VALUE		13
 #define DSA_TAG_PROTO_KSZ8795_VALUE		14
+#define DSA_TAG_PROTO_BRCM_FBX_VALUE		15
 
 enum dsa_tag_protocol {
 	DSA_TAG_PROTO_NONE		= DSA_TAG_PROTO_NONE_VALUE,
@@ -59,6 +60,7 @@
 	DSA_TAG_PROTO_8021Q		= DSA_TAG_PROTO_8021Q_VALUE,
 	DSA_TAG_PROTO_SJA1105		= DSA_TAG_PROTO_SJA1105_VALUE,
 	DSA_TAG_PROTO_KSZ8795		= DSA_TAG_PROTO_KSZ8795_VALUE,
+	DSA_TAG_PROTO_BRCM_FBX		= DSA_TAG_PROTO_BRCM_FBX_VALUE,
 };
 
 struct packet_type;
@@ -123,11 +125,6 @@
 	struct dsa_platform_data	*pd;
 
 	/*
-	 * The switch port to which the CPU is attached.
-	 */
-	struct dsa_port		*cpu_dp;
-
-	/*
 	 * Data for the individual switch chips.
 	 */
 	struct dsa_switch	*ds[DSA_MAX_SWITCHES];
@@ -179,6 +176,8 @@
 		DSA_PORT_TYPE_DSA,
 		DSA_PORT_TYPE_USER,
 	} type;
+	bool			is_def_cpu_port;
+	struct device_node	*force_cpu_dn;
 
 	struct dsa_switch	*ds;
 	unsigned int		index;
@@ -601,6 +600,7 @@
 	struct net_device *master;
 	unsigned int port_number;
 	unsigned int switch_number;
+	unsigned int cpu_port_number;
 };
 
 static inline struct net_device *
diff -ruw linux-5.4.60/include/net/ip6_tunnel.h linux-5.4.60-fbx/include/net/ip6_tunnel.h
--- linux-5.4.60/include/net/ip6_tunnel.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/net/ip6_tunnel.h	2021-03-04 13:21:01.080839036 +0100
@@ -18,6 +18,18 @@
 /* determine capability on a per-packet basis */
 #define IP6_TNL_F_CAP_PER_PACKET 0x40000
 
+/* IPv6 tunnel FMR */
+struct __ip6_tnl_fmr {
+	struct __ip6_tnl_fmr *next; /* next fmr in list */
+	struct in6_addr ip6_prefix;
+	struct in_addr ip4_prefix;
+
+	__u8 ip6_prefix_len;
+	__u8 ip4_prefix_len;
+	__u8 ea_len;
+	__u8 offset;
+};
+
 struct __ip6_tnl_parm {
 	char name[IFNAMSIZ];	/* name of tunnel device */
 	int link;		/* ifindex of underlying L2 interface */
@@ -29,6 +41,7 @@
 	__u32 flags;		/* tunnel flags */
 	struct in6_addr laddr;	/* local tunnel end-point address */
 	struct in6_addr raddr;	/* remote tunnel end-point address */
+	struct __ip6_tnl_fmr *fmrs;	/* FMRs */
 
 	__be16			i_flags;
 	__be16			o_flags;
diff -ruw linux-5.4.60/include/net/ip.h linux-5.4.60-fbx/include/net/ip.h
--- linux-5.4.60/include/net/ip.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/net/ip.h	2021-03-04 13:21:01.080839036 +0100
@@ -685,6 +685,20 @@
 #endif
 
 /*
+ *     Functions provided by ip_ffn.c
+ */
+
+enum {
+	IP_FFN_FINISH_OUT,
+	IP_FFN_LOCAL_IN,
+};
+
+extern void ip_ffn_init(void);
+extern int ip_ffn_process(struct sk_buff *skb);
+extern void ip_ffn_add(struct sk_buff *skb, int when);
+extern void ip_ffn_flush_all(void);
+
+/*
  *	Functions provided by ip_forward.c
  */
 
diff -ruw linux-5.4.60/include/net/ipv6.h linux-5.4.60-fbx/include/net/ipv6.h
--- linux-5.4.60/include/net/ipv6.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/net/ipv6.h	2021-03-04 13:21:01.080839036 +0100
@@ -1032,6 +1032,7 @@
 int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb);
 int ip6_forward(struct sk_buff *skb);
 int ip6_input(struct sk_buff *skb);
+int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
 int ip6_mc_input(struct sk_buff *skb);
 void ip6_protocol_deliver_rcu(struct net *net, struct sk_buff *skb, int nexthdr,
 			      bool have_final);
@@ -1161,4 +1162,19 @@
 			  const struct in6_addr *addr, unsigned int mode);
 int ipv6_sock_mc_drop(struct sock *sk, int ifindex,
 		      const struct in6_addr *addr);
+
+/*
+ *     Functions provided by ipv6_ffn.c
+ */
+
+enum {
+	IPV6_FFN_FINISH_OUT,
+	IPV6_FFN_LOCAL_IN,
+};
+
+extern void ipv6_ffn_init(void);
+extern int ipv6_ffn_process(struct sk_buff *skb);
+extern void ipv6_ffn_add(struct sk_buff *skb, int when);
+extern void ipv6_ffn_flush_all(void);
+
 #endif /* _NET_IPV6_H */
diff -ruw linux-5.4.60/include/net/mac80211.h linux-5.4.60-fbx/include/net/mac80211.h
--- linux-5.4.60/include/net/mac80211.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/net/mac80211.h	2021-03-04 13:21:01.084172370 +0100
@@ -2337,6 +2337,8 @@
 	IEEE80211_HW_SUPPORTS_ONLY_HE_MULTI_BSSID,
 	IEEE80211_HW_AMPDU_KEYBORDER_SUPPORT,
 
+	IEEE80211_HW_APVLAN_NEED_MCAST_TO_UCAST,
+
 	/* keep last, obviously */
 	NUM_IEEE80211_HW_FLAGS
 };
@@ -3759,6 +3761,8 @@
 		   struct sk_buff *skb);
 	int (*start)(struct ieee80211_hw *hw);
 	void (*stop)(struct ieee80211_hw *hw);
+	int (*set_powered)(struct ieee80211_hw *hw);
+	int (*get_powered)(struct ieee80211_hw *hw, bool *up, bool *busy);
 #ifdef CONFIG_PM
 	int (*suspend)(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan);
 	int (*resume)(struct ieee80211_hw *hw);
@@ -5816,6 +5820,13 @@
 void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn);
 
 /**
+ * same as ieee80211_send_bar but for given STA, allow sending to a
+ * STA on AP_VLAN and get a valid control->sta in the driver
+ */
+void ieee80211_send_bar_sta(struct ieee80211_sta *pubsta,
+			    u16 tid, u16 ssn);
+
+/**
  * ieee80211_manage_rx_ba_offl - helper to queue an RX BA work
  * @vif: &struct ieee80211_vif pointer from the add_interface callback
  * @addr: station mac address
@@ -6417,4 +6428,10 @@
 			      struct cfg80211_nan_match_params *match,
 			      gfp_t gfp);
 
+/**
+ * force dtim count value on given VIF
+ */
+void ieee80211_force_dtim(struct ieee80211_vif *vif,
+			  unsigned int dtim_count);
+
 #endif /* MAC80211_H */
diff -ruw linux-5.4.60/include/net/netfilter/nf_conntrack_expect.h linux-5.4.60-fbx/include/net/netfilter/nf_conntrack_expect.h
--- linux-5.4.60/include/net/netfilter/nf_conntrack_expect.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/net/netfilter/nf_conntrack_expect.h	2021-03-04 13:21:01.084172370 +0100
@@ -58,13 +58,24 @@
 #endif
 
 	struct rcu_head rcu;
+
+	/* private expect information. */
+	char data[32] __aligned(8);
 };
 
+#define NF_CT_EXPECT_BUILD_BUG_ON(structsize)				\
+	BUILD_BUG_ON((structsize) > FIELD_SIZEOF(struct nf_conntrack_expect, data))
+
 static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
 {
 	return nf_ct_net(exp->master);
 }
 
+static inline void *nf_ct_exp_data(struct nf_conntrack_expect *exp)
+{
+	return (void *)exp->data;
+}
+
 #define NF_CT_EXP_POLICY_NAME_LEN	16
 
 struct nf_conntrack_expect_policy {
diff -ruw linux-5.4.60/include/net/netfilter/nf_conntrack.h linux-5.4.60-fbx/include/net/netfilter/nf_conntrack.h
--- linux-5.4.60/include/net/netfilter/nf_conntrack.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/net/netfilter/nf_conntrack.h	2021-03-04 13:21:01.084172370 +0100
@@ -100,6 +100,9 @@
 	u_int32_t secmark;
 #endif
 
+	union nf_conntrack_man_proto	nat_src_proto_min;
+	union nf_conntrack_man_proto	nat_src_proto_max;
+
 	/* Extensions */
 	struct nf_ct_ext *ext;
 
diff -ruw linux-5.4.60/include/net/sock.h linux-5.4.60-fbx/include/net/sock.h
--- linux-5.4.60/include/net/sock.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/net/sock.h	2021-03-04 13:21:01.090839037 +0100
@@ -174,6 +174,7 @@
 	unsigned char		skc_reuseport:1;
 	unsigned char		skc_ipv6only:1;
 	unsigned char		skc_net_refcnt:1;
+	unsigned char		skc_reuse_conflict;
 	int			skc_bound_dev_if;
 	union {
 		struct hlist_node	skc_bind_node;
@@ -350,6 +351,7 @@
 #define sk_reuseport		__sk_common.skc_reuseport
 #define sk_ipv6only		__sk_common.skc_ipv6only
 #define sk_net_refcnt		__sk_common.skc_net_refcnt
+#define sk_reuse_conflict	__sk_common.skc_reuse_conflict
 #define sk_bound_dev_if		__sk_common.skc_bound_dev_if
 #define sk_bind_node		__sk_common.skc_bind_node
 #define sk_prot			__sk_common.skc_prot
@@ -819,6 +821,7 @@
 	SOCK_TXTIME,
 	SOCK_XDP, /* XDP is attached */
 	SOCK_TSTAMP_NEW, /* Indicates 64 bit timestamps always */
+	SOCK_UDP_DUP_UNICAST,
 };
 
 #define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE))
diff -ruw linux-5.4.60/include/uapi/asm-generic/socket.h linux-5.4.60-fbx/include/uapi/asm-generic/socket.h
--- linux-5.4.60/include/uapi/asm-generic/socket.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/uapi/asm-generic/socket.h	2021-03-04 13:21:01.114172371 +0100
@@ -30,9 +30,10 @@
 #define SO_PEERCRED	17
 #define SO_RCVLOWAT	18
 #define SO_SNDLOWAT	19
+#endif
+
 #define SO_RCVTIMEO_OLD	20
 #define SO_SNDTIMEO_OLD	21
-#endif
 
 /* Security levels - as per NRL IPv6 - don't actually do anything */
 #define SO_SECURITY_AUTHENTICATION		22
@@ -119,6 +120,8 @@
 
 #define SO_DETACH_REUSEPORT_BPF 68
 
+#define SO_UDP_DUP_UNICAST	100
+
 #if !defined(__KERNEL__)
 
 #if __BITS_PER_LONG == 64 || (defined(__x86_64__) && defined(__ILP32__))
diff -ruw linux-5.4.60/include/uapi/linux/ethtool.h linux-5.4.60-fbx/include/uapi/linux/ethtool.h
--- linux-5.4.60/include/uapi/linux/ethtool.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/ethtool.h	2021-03-04 13:21:01.124172371 +0100
@@ -221,6 +221,8 @@
 	ETHTOOL_RX_COPYBREAK,
 	ETHTOOL_TX_COPYBREAK,
 	ETHTOOL_PFC_PREVENTION_TOUT, /* timeout in msecs */
+	ETHTOOL_MAC_MODE,
+
 	/*
 	 * Add your fresh new tunable attribute above and remember to update
 	 * tunable_strings[] in net/core/ethtool.c
@@ -1329,6 +1331,69 @@
 #define ETHTOOL_FEC_RS			(1 << ETHTOOL_FEC_RS_BIT)
 #define ETHTOOL_FEC_BASER		(1 << ETHTOOL_FEC_BASER_BIT)
 
+/**
+ * struct ethtool_epon_param
+ * @cmd: Command number = %ETHTOOL_GEPON_PARAM or %ETHTOOL_SEPON_*
+ */
+struct ethtool_epon_param {
+	__u32   cmd;
+	__u8	discovery_rx;
+	__u8	registered;
+	__u16	llid;
+	__u32	burst_cap;
+	__u32	change_count;
+	__u32	keys_update_id;
+	__u8	key_sci[8];
+	__u8	down_key0[16];
+	__u8	down_key1[16];
+	__u32	down_encrypt;
+	__u32	down_last_rx_encrypted;
+	__u32	down_last_rx_key_id;
+	__u16	mcast_llid;
+	__u16	pad;
+};
+
+/*
+ * currently a 1:1 mapping for SFP SM in drivers/net/phy/sfp.c
+ */
+enum {
+	ETHTOOL_SFP_S_DOWN = 0,
+	ETHTOOL_SFP_S_INIT,
+	ETHTOOL_SFP_S_WAIT_LOS,
+	ETHTOOL_SFP_S_LINK_UP,
+	ETHTOOL_SFP_S_TX_FAULT,
+	ETHTOOL_SFP_S_REINIT,
+	ETHTOOL_SFP_S_TX_DISABLE,
+};
+
+/**
+ * struct ethtool_sfp_state
+ * @cmd: Command number = %ETHTOOL_GSFP_STATE
+ */
+struct ethtool_sfp_state {
+	__u32 cmd;
+
+	__u32 fsm_state;
+
+	__u8 o_pwren;
+	__u8 o_txdis;
+	__u8 i_presence;
+	__u8 i_rxlos;
+	__u8 i_txfault;
+};
+
+/**
+ * struct ethtool_shaper_params
+ * @cmd: %ETHTOOL_GSHAPER_PARAMS / %ETHTOOL_SSHAPER_PARAMS
+ */
+struct ethtool_shaper_params {
+	__u32 cmd;
+
+	__u64 rate;
+	__u32 burst;
+	__u32 mtu;
+};
+
 /* CMDs currently supported */
 #define ETHTOOL_GSET		0x00000001 /* DEPRECATED, Get settings.
 					    * Please use ETHTOOL_GLINKSETTINGS
@@ -1424,6 +1489,20 @@
 #define ETHTOOL_GFECPARAM	0x00000050 /* Get FEC settings */
 #define ETHTOOL_SFECPARAM	0x00000051 /* Set FEC settings */
 
+#define ETHTOOL_GEPON_PARAM	0x00000052 /* Get EPON params */
+#define ETHTOOL_SEPON_KEYS	0x00000053 /* Set EPON encryption keys */
+#define ETHTOOL_SEPON_ENCRYPT	0x00000054 /* Set EPON encryption keys */
+#define ETHTOOL_SEPON_RESTART	0x00000055 /* restart epon link */
+#define ETHTOOL_SEPON_BURST	0x00000056 /* update burst value */
+#define ETHTOOL_SEPON_ADD_MCLLID	0x00000057 /* add epon llid */
+#define ETHTOOL_SEPON_DEL_MCLLID	0x00000058 /* remove epon llid */
+#define ETHTOOL_SEPON_CLR_MCLLID	0x00000059 /* remove all epon llid */
+
+#define ETHTOOL_GSFP_STATE	0x00000060 /* get SFP state (IOs/FSM) */
+
+#define ETHTOOL_SSHAPER_PARAMS	0x00000061 /* set HW TX shaper params */
+#define ETHTOOL_GSHAPER_PARAMS	0x00000062 /* get HW TX shaper params */
+
 /* compatibility with older code */
 #define SPARC_ETH_GSET		ETHTOOL_GSET
 #define SPARC_ETH_SSET		ETHTOOL_SSET
@@ -1508,6 +1587,13 @@
 	ETHTOOL_LINK_MODE_100baseT1_Full_BIT		 = 67,
 	ETHTOOL_LINK_MODE_1000baseT1_Full_BIT		 = 68,
 
+	ETHTOOL_LINK_MODE_1000basePX_D_Full_BIT		 = 69,
+	ETHTOOL_LINK_MODE_1000basePX_U_Full_BIT		 = 70,
+	ETHTOOL_LINK_MODE_10000basePR_D_Full_BIT	 = 71,
+	ETHTOOL_LINK_MODE_10000basePR_U_Full_BIT	 = 72,
+	ETHTOOL_LINK_MODE_10000_1000basePRX_D_Full_BIT	 = 73,
+	ETHTOOL_LINK_MODE_10000_1000basePRX_U_Full_BIT	 = 74,
+
 	/* must be last entry */
 	__ETHTOOL_LINK_MODE_MASK_NBITS
 };
diff -ruw linux-5.4.60/include/uapi/linux/if_ether.h linux-5.4.60-fbx/include/uapi/linux/if_ether.h
--- linux-5.4.60/include/uapi/linux/if_ether.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/if_ether.h	2021-03-04 13:21:01.127505705 +0100
@@ -116,6 +116,7 @@
 
 #define ETH_P_802_3_MIN	0x0600		/* If the value in the ethernet type is less than this value
 					 * then the frame is Ethernet II. Else it is 802.3 */
+#define ETH_P_NMESH_MBH 0xFFFE		/* NMESHD beacon eth protocol */
 
 /*
  *	Non DIX types. Won't clash for 1500 types.
diff -ruw linux-5.4.60/include/uapi/linux/if_tun.h linux-5.4.60-fbx/include/uapi/linux/if_tun.h
--- linux-5.4.60/include/uapi/linux/if_tun.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/if_tun.h	2021-03-04 13:21:01.127505705 +0100
@@ -62,6 +62,32 @@
 #define TUNSETCARRIER _IOW('T', 226, int)
 #define TUNGETDEVNETNS _IO('T', 227)
 
+
+struct smalltun_rule {
+	__u8	proto;
+	__be16	src_port_start;
+	__be16	src_port_end;
+	__be16	dst_port_start;
+	__be16	dst_port_end;
+};
+
+struct smalltun_fp {
+	__be32	inner_src;
+	__be32	inner_dst;
+
+	__u32	af;
+	__u8	outer_src[16];
+	__u8	outer_dst[16];
+	__be16	outer_src_port;
+	__be16	outer_dst_port;
+
+	struct smalltun_rule rules[8];
+	__u32	rule_count;
+};
+
+#define TUNSMALLTUNSETFP _IOW('T', 228, struct smalltun_fp)
+#define TUNSMALLTUNDELFP _IOW('T', 229, struct smalltun_fp)
+
 /* TUNSETIFF ifr flags */
 #define IFF_TUN		0x0001
 #define IFF_TAP		0x0002
diff -ruw linux-5.4.60/include/uapi/linux/if_tunnel.h linux-5.4.60-fbx/include/uapi/linux/if_tunnel.h
--- linux-5.4.60/include/uapi/linux/if_tunnel.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/if_tunnel.h	2021-03-04 13:21:01.127505705 +0100
@@ -77,10 +77,23 @@
 	IFLA_IPTUN_ENCAP_DPORT,
 	IFLA_IPTUN_COLLECT_METADATA,
 	IFLA_IPTUN_FWMARK,
+	IFLA_IPTUN_FMRS,
 	__IFLA_IPTUN_MAX,
 };
 #define IFLA_IPTUN_MAX	(__IFLA_IPTUN_MAX - 1)
 
+enum {
+	IFLA_IPTUN_FMR_UNSPEC,
+	IFLA_IPTUN_FMR_IP6_PREFIX,
+	IFLA_IPTUN_FMR_IP4_PREFIX,
+	IFLA_IPTUN_FMR_IP6_PREFIX_LEN,
+	IFLA_IPTUN_FMR_IP4_PREFIX_LEN,
+	IFLA_IPTUN_FMR_EA_LEN,
+	IFLA_IPTUN_FMR_OFFSET,
+	__IFLA_IPTUN_FMR_MAX,
+};
+#define IFLA_IPTUN_FMR_MAX (__IFLA_IPTUN_FMR_MAX - 1)
+
 enum tunnel_encap_types {
 	TUNNEL_ENCAP_NONE,
 	TUNNEL_ENCAP_FOU,
diff -ruw linux-5.4.60/include/uapi/linux/libc-compat.h linux-5.4.60-fbx/include/uapi/linux/libc-compat.h
--- linux-5.4.60/include/uapi/linux/libc-compat.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/libc-compat.h	2021-03-04 13:21:01.130839039 +0100
@@ -49,11 +49,11 @@
 #ifndef _UAPI_LIBC_COMPAT_H
 #define _UAPI_LIBC_COMPAT_H
 
-/* We have included glibc headers... */
-#if defined(__GLIBC__)
+/* We have included libc headers... */
+#if !defined(__KERNEL__)
 
-/* Coordinate with glibc net/if.h header. */
-#if defined(_NET_IF_H) && defined(__USE_MISC)
+/* Coordinate with libc net/if.h header. */
+#if defined(_NET_IF_H) && (!defined(__GLIBC__) || defined(__USE_MISC))
 
 /* GLIBC headers included first so don't define anything
  * that would already be defined. */
@@ -65,9 +65,11 @@
 /* Everything up to IFF_DYNAMIC, matches net/if.h until glibc 2.23 */
 #define __UAPI_DEF_IF_NET_DEVICE_FLAGS 0
 /* For the future if glibc adds IFF_LOWER_UP, IFF_DORMANT and IFF_ECHO */
+#ifndef IFF_ECHO
 #ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO
 #define __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO 1
 #endif /* __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO */
+#endif /* IFF_ECHO */
 
 #else /* _NET_IF_H */
 
@@ -170,7 +172,7 @@
  * or we are being included in the kernel, then define everything
  * that we need. Check for previous __UAPI_* definitions to give
  * unsupported C libraries a way to opt out of any kernel definition. */
-#else /* !defined(__GLIBC__) */
+#else /* !defined(__KERNEL__) */
 
 /* Definitions for if.h */
 #ifndef __UAPI_DEF_IF_IFCONF
@@ -262,6 +264,6 @@
 #define __UAPI_DEF_XATTR		1
 #endif
 
-#endif /* __GLIBC__ */
+#endif /* __KERNEL__ */
 
 #endif /* _UAPI_LIBC_COMPAT_H */
diff -ruw linux-5.4.60/include/uapi/linux/nl80211.h linux-5.4.60-fbx/include/uapi/linux/nl80211.h
--- linux-5.4.60/include/uapi/linux/nl80211.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/nl80211.h	2021-03-04 13:21:01.137505705 +0100
@@ -1324,6 +1324,10 @@
 	NL80211_CMD_UPDATE_OWE_INFO,
 
 	NL80211_CMD_PROBE_MESH_LINK,
+	NL80211_CMD_MESH_PEER_NODE_METRICS,
+	NL80211_CMD_MESH_PEER_PATH_METRICS,
+	NL80211_CMD_SET_MPP,
+	NL80211_CMD_DEL_MPP,
 
 	/* add new commands above here */
 
@@ -2834,6 +2838,7 @@
 
 	NL80211_ATTR_WIPHY_EDMG_CHANNELS,
 	NL80211_ATTR_WIPHY_EDMG_BW_CONFIG,
+	NL80211_ATTR_SIGNAL_STRENGTH,
 
 	/* add attributes here, update the policy in nl80211.c */
 
@@ -2842,6 +2847,8 @@
 	NL80211_ATTR_MAX = __NL80211_ATTR_AFTER_LAST - 1
 };
 
+# define NL80211_QBC_UPDATE_NODE_METRICS_IE 1
+# define NL80211_QBC_UPDATE_PATH_METRICS_IE 2
 /* source-level API compatibility */
 #define NL80211_ATTR_SCAN_GENERATION NL80211_ATTR_GENERATION
 #define	NL80211_ATTR_MESH_PARAMS NL80211_ATTR_MESH_CONFIG
diff -ruw linux-5.4.60/include/uapi/linux/serial_core.h linux-5.4.60-fbx/include/uapi/linux/serial_core.h
--- linux-5.4.60/include/uapi/linux/serial_core.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/serial_core.h	2021-03-04 13:21:01.140839039 +0100
@@ -293,4 +293,7 @@
 /* Freescale Linflex UART */
 #define PORT_LINFLEXUART	122
 
+/* BCM63xx HS */
+#define PORT_BCM63XX_HS	123
+
 #endif /* _UAPILINUX_SERIAL_CORE_H */
diff -ruw linux-5.4.60/include/uapi/linux/sockios.h linux-5.4.60-fbx/include/uapi/linux/sockios.h
--- linux-5.4.60/include/uapi/linux/sockios.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/sockios.h	2021-03-04 13:21:01.140839039 +0100
@@ -153,6 +153,14 @@
 #define SIOCSHWTSTAMP	0x89b0		/* set and get config		*/
 #define SIOCGHWTSTAMP	0x89b1		/* get config			*/
 
+/* fbxbridge call */
+#define SIOCGFBXBRIDGE	0x89c0		/* fbxbridge support          */
+#define SIOCSFBXBRIDGE	0x89c1		/* Set fbxbridge options      */
+
+/* fbxdiverter call */
+#define SIOCGFBXDIVERT  0x89d0		/* fbxdiverter support          */
+#define SIOCSFBXDIVERT  0x89d1		/* Set fbxdiverter options      */
+
 /* Device private ioctl calls */
 
 /*
diff -ruw linux-5.4.60/include/uapi/linux/swab.h linux-5.4.60-fbx/include/uapi/linux/swab.h
--- linux-5.4.60/include/uapi/linux/swab.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/swab.h	2021-03-04 13:21:01.140839039 +0100
@@ -3,7 +3,7 @@
 #define _UAPI_LINUX_SWAB_H
 
 #include <linux/types.h>
-#include <linux/compiler.h>
+#include <linux/stddef.h>
 #include <asm/bitsperlong.h>
 #include <asm/swab.h>
 
diff -ruw linux-5.4.60/include/uapi/linux/tcp.h linux-5.4.60-fbx/include/uapi/linux/tcp.h
--- linux-5.4.60/include/uapi/linux/tcp.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/tcp.h	2021-03-04 13:21:01.144172372 +0100
@@ -134,6 +134,8 @@
 #define TCP_REPAIR_OFF		0
 #define TCP_REPAIR_OFF_NO_WP	-1	/* Turn off without window probes */
 
+#define TCP_LINEAR_RTO		128	/* force use of linear timeouts */
+
 struct tcp_repair_opt {
 	__u32	opt_code;
 	__u32	opt_val;
diff -ruw linux-5.4.60/include/uapi/linux/tty.h linux-5.4.60-fbx/include/uapi/linux/tty.h
--- linux-5.4.60/include/uapi/linux/tty.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/tty.h	2021-03-04 13:21:01.144172372 +0100
@@ -38,5 +38,6 @@
 #define N_NCI		25	/* NFC NCI UART */
 #define N_SPEAKUP	26	/* Speakup communication with synths */
 #define N_NULL		27	/* Null ldisc used for error handling */
+#define N_REMOTI	28	/* RemoTI over UART */
 
 #endif /* _UAPI_LINUX_TTY_H */
diff -ruw linux-5.4.60/init/initramfs.c linux-5.4.60-fbx/init/initramfs.c
--- linux-5.4.60/init/initramfs.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/init/initramfs.c	2021-03-04 13:21:01.157505706 +0100
@@ -10,6 +10,7 @@
 #include <linux/syscalls.h>
 #include <linux/utime.h>
 #include <linux/file.h>
+#include <linux/printk.h>
 
 static ssize_t __init xwrite(int fd, const char *p, size_t count)
 {
@@ -621,6 +622,10 @@
 {
 	ssize_t written;
 	int fd;
+#ifdef CONFIG_FBX_DECRYPT_INITRD
+	int ret;
+	extern int fbx_decrypt_initrd(char *start, u32 size);
+#endif
 
 	unpack_to_rootfs(__initramfs_start, __initramfs_size);
 
@@ -630,6 +635,15 @@
 	if (fd < 0)
 		return;
 
+#ifdef CONFIG_FBX_DECRYPT_INITRD
+	ret = fbx_decrypt_initrd((char*)initrd_start,
+				 initrd_end - initrd_start);
+	if (ret) {
+		printk(KERN_ERR "Decrypt failed: %i\n", ret);
+		return;
+	}
+#endif
+
 	written = xwrite(fd, (char *)initrd_start, initrd_end - initrd_start);
 	if (written != initrd_end - initrd_start)
 		pr_err("/initrd.image: incomplete write (%zd != %ld)\n",
diff -ruw linux-5.4.60/init/init_task.c linux-5.4.60-fbx/init/init_task.c
--- linux-5.4.60/init/init_task.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/init/init_task.c	2021-03-04 13:21:01.157505706 +0100
@@ -66,6 +66,7 @@
 	.stack		= init_stack,
 	.usage		= REFCOUNT_INIT(2),
 	.flags		= PF_KTHREAD,
+	.exec_mode	= EXEC_MODE_UNLIMITED,
 	.prio		= MAX_PRIO - 20,
 	.static_prio	= MAX_PRIO - 20,
 	.normal_prio	= MAX_PRIO - 20,
diff -ruw linux-5.4.60/init/Kconfig linux-5.4.60-fbx/init/Kconfig
--- linux-5.4.60/init/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/init/Kconfig	2021-03-04 13:21:01.157505706 +0100
@@ -74,6 +74,15 @@
 	  Maximum of each of the number of arguments and environment
 	  variables passed to init from the kernel command line.
 
+
+config CROSS_COMPILE
+	string "Cross-compiler tool prefix"
+	help
+	  Same as running 'make CROSS_COMPILE=prefix-' but stored for
+	  default make runs in this kernel build directory.  You don't
+	  need to set this unless you want the configured kernel build
+	  directory to select the cross-compiler automatically.
+
 config COMPILE_TEST
 	bool "Compile also drivers which will not load"
 	depends on !UML
@@ -671,6 +680,15 @@
 		     13 =>   8 KB for each CPU
 		     12 =>   4 KB for each CPU
 
+config FBX_DECRYPT_INITRD
+	bool "Decrypt initrd at boot"
+	depends on BLK_DEV_RAM
+	default n
+
+config FBX_DECRYPT_INITRD_KEY
+	string "Decryption key"
+	depends on FBX_DECRYPT_INITRD
+
 #
 # Architectures with an unreliable sched_clock() should select this:
 #
diff -ruw linux-5.4.60/init/Makefile linux-5.4.60-fbx/init/Makefile
--- linux-5.4.60/init/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/init/Makefile	2021-03-04 13:21:01.157505706 +0100
@@ -15,6 +15,8 @@
 
 obj-y                          += init_task.o
 
+obj-$(CONFIG_FBX_DECRYPT_INITRD)+= fbx_decrypt_initrd.o rc4.o
+
 mounts-y			:= do_mounts.o
 mounts-$(CONFIG_BLK_DEV_RAM)	+= do_mounts_rd.o
 mounts-$(CONFIG_BLK_DEV_INITRD)	+= do_mounts_initrd.o
diff -ruw linux-5.4.60/kernel/fork.c linux-5.4.60-fbx/kernel/fork.c
--- linux-5.4.60/kernel/fork.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/kernel/fork.c	2021-03-04 13:21:01.280839045 +0100
@@ -944,6 +944,12 @@
 #ifdef CONFIG_MEMCG
 	tsk->active_memcg = NULL;
 #endif
+
+	/*
+	 * inherit parent exec_mode.
+	 */
+	tsk->exec_mode = orig->exec_mode;
+
 	return tsk;
 
 free_stack:
diff -ruw linux-5.4.60/kernel/sys.c linux-5.4.60-fbx/kernel/sys.c
--- linux-5.4.60/kernel/sys.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/kernel/sys.c	2021-03-04 13:21:01.304172379 +0100
@@ -11,6 +11,7 @@
 #include <linux/mman.h>
 #include <linux/reboot.h>
 #include <linux/prctl.h>
+#include <linux/prctl-private.h>
 #include <linux/highuid.h>
 #include <linux/fs.h>
 #include <linux/kmod.h>
@@ -2486,6 +2487,18 @@
 			return -EINVAL;
 		error = GET_TAGGED_ADDR_CTRL();
 		break;
+	case PR_SET_EXEC_MODE:
+		if (arg2 != EXEC_MODE_UNLIMITED &&
+		    arg2 != EXEC_MODE_ONCE &&
+		    arg2 != EXEC_MODE_DENIED)
+			return -EINVAL;
+
+		if (arg2 > current->exec_mode)
+			return -EPERM;
+		current->exec_mode = arg2;
+		return 0;
+	case PR_GET_EXEC_MODE:
+		return current->exec_mode;
 	default:
 		error = -EINVAL;
 		break;
diff -ruw linux-5.4.60/lib/Kconfig linux-5.4.60-fbx/lib/Kconfig
--- linux-5.4.60/lib/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/lib/Kconfig	2021-03-04 13:21:01.320839047 +0100
@@ -635,6 +635,13 @@
 config STRING_SELFTEST
 	tristate "Test string functions"
 
+config ARCH_HAS_FBXSERIAL
+	bool
+
+config FBXSERIAL
+	bool "fbxserial"
+	select CRC32
+
 endmenu
 
 config GENERIC_LIB_ASHLDI3
diff -ruw linux-5.4.60/lib/Makefile linux-5.4.60-fbx/lib/Makefile
--- linux-5.4.60/lib/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/lib/Makefile	2021-03-04 13:21:01.320839047 +0100
@@ -290,3 +290,5 @@
 obj-$(CONFIG_GENERIC_LIB_CMPDI2) += cmpdi2.o
 obj-$(CONFIG_GENERIC_LIB_UCMPDI2) += ucmpdi2.o
 obj-$(CONFIG_OBJAGG) += objagg.o
+
+obj-$(CONFIG_FBXSERIAL) += fbxserial.o
diff -ruw linux-5.4.60/Makefile linux-5.4.60-fbx/Makefile
--- linux-5.4.60/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/Makefile	2021-04-21 11:45:17.841888886 +0200
@@ -355,6 +355,8 @@
 # CROSS_COMPILE can be set on the command line
 # make CROSS_COMPILE=ia64-linux-
 # Alternatively CROSS_COMPILE can be set in the environment.
+# A third alternative is to store a setting in .config so that plain
+# "make" in the configured kernel build directory always uses that.
 # Default value for CROSS_COMPILE is not to prefix executables
 # Note: Some architectures assign CROSS_COMPILE in their arch/*/Makefile
 ARCH		?= $(SUBARCH)
@@ -387,6 +389,9 @@
 KCONFIG_CONFIG	?= .config
 export KCONFIG_CONFIG
 
+CONFIG_CROSS_COMPILE := $(shell grep ^CONFIG_CROSS_COMPILE= $(KCONFIG_CONFIG) | cut -f 2 -d = | tr -d '"')
+CROSS_COMPILE	?= $(CONFIG_CROSS_COMPILE:"%"=%)
+
 # SHELL used by kbuild
 CONFIG_SHELL := sh
 
@@ -1181,7 +1186,7 @@
 quiet_cmd_headers_install = INSTALL $(INSTALL_HDR_PATH)/include
       cmd_headers_install = \
 	mkdir -p $(INSTALL_HDR_PATH); \
-	rsync -mrl --include='*/' --include='*\.h' --exclude='*' \
+	rsync -cmrl --include='*/' --include='*\.h' --exclude='*' \
 	usr/include $(INSTALL_HDR_PATH)
 
 PHONY += headers_install
diff -ruw linux-5.4.60/net/8021q/vlan.c linux-5.4.60-fbx/net/8021q/vlan.c
--- linux-5.4.60/net/8021q/vlan.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/8021q/vlan.c	2021-03-04 13:21:01.367505716 +0100
@@ -210,7 +210,7 @@
 /*  Attach a VLAN device to a mac address (ie Ethernet Card).
  *  Returns 0 if the device was created or a negative error code otherwise.
  */
-static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
+int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
 {
 	struct net_device *new_dev;
 	struct vlan_dev_priv *vlan;
diff -ruw linux-5.4.60/net/8021q/vlan_core.c linux-5.4.60-fbx/net/8021q/vlan_core.c
--- linux-5.4.60/net/8021q/vlan_core.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/8021q/vlan_core.c	2021-03-04 13:21:01.367505716 +0100
@@ -98,6 +98,12 @@
 }
 EXPORT_SYMBOL(__vlan_find_dev_deep_rcu);
 
+struct net_device *vlan_dev_upper_dev(const struct net_device *dev)
+{
+	return vlan_dev_priv(dev)->real_dev;
+}
+EXPORT_SYMBOL(vlan_dev_upper_dev);
+
 struct net_device *vlan_dev_real_dev(const struct net_device *dev)
 {
 	struct net_device *ret = vlan_dev_priv(dev)->real_dev;
diff -ruw linux-5.4.60/net/8021q/vlanproc.c linux-5.4.60-fbx/net/8021q/vlanproc.c
--- linux-5.4.60/net/8021q/vlanproc.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/8021q/vlanproc.c	2021-03-04 13:21:01.370839049 +0100
@@ -252,7 +252,7 @@
 
 	stats = dev_get_stats(vlandev, &temp);
 	seq_printf(seq,
-		   "%s  VID: %d	 REORDER_HDR: %i  dev->priv_flags: %hx\n",
+		   "%s  VID: %d	 REORDER_HDR: %i  dev->priv_flags: %llx\n",
 		   vlandev->name, vlan->vlan_id,
 		   (int)(vlan->flags & 1), vlandev->priv_flags);
 
diff -ruw linux-5.4.60/net/bridge/br_device.c linux-5.4.60-fbx/net/bridge/br_device.c
--- linux-5.4.60/net/bridge/br_device.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/bridge/br_device.c	2021-03-04 13:21:01.387505716 +0100
@@ -225,6 +225,7 @@
 	struct net_bridge *br = netdev_priv(dev);
 
 	dev->mtu = new_mtu;
+	br->forced_mtu = new_mtu;
 
 	/* this flag will be cleared if the MTU was automatically adjusted */
 	br_opt_toggle(br, BROPT_MTU_SET_BY_USER, true);
diff -ruw linux-5.4.60/net/bridge/br_fdb.c linux-5.4.60-fbx/net/bridge/br_fdb.c
--- linux-5.4.60/net/bridge/br_fdb.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/bridge/br_fdb.c	2021-03-04 13:21:01.387505716 +0100
@@ -554,28 +554,48 @@
 	return ret;
 }
 
-void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
+bool br_fdb_update_only(struct net_bridge *br,
+			struct net_bridge_port *source,
+			const unsigned char *addr)
+{
+	struct net_bridge_fdb_entry *fdb;
+
+	fdb = br_fdb_find_rcu(br, addr, 0);
+	if (!fdb)
+		return false;
+
+	fdb->updated = jiffies;
+	return true;
+}
+
+int br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
 		   const unsigned char *addr, u16 vid, bool added_by_user)
 {
 	struct net_bridge_fdb_entry *fdb;
 	bool fdb_modified = false;
+	int ret = 0;
 
 	/* some users want to always flood. */
 	if (hold_time(br) == 0)
-		return;
+		return ret;
 
 	/* ignore packets unless we are using this port */
 	if (!(source->state == BR_STATE_LEARNING ||
 	      source->state == BR_STATE_FORWARDING))
-		return;
+		return ret;
 
 	fdb = fdb_find_rcu(&br->fdb_hash_tbl, addr, vid);
 	if (likely(fdb)) {
+
+		if (likely(fdb->added_by_user))
+			return ret;
+
 		/* attempt to update an entry for a local interface */
 		if (unlikely(fdb->is_local)) {
 			if (net_ratelimit())
 				br_warn(br, "received packet on %s with own address as source address (addr:%pM, vlan:%u)\n",
 					source->dev->name, addr, vid);
+			ret = -ELOOP;
 		} else {
 			unsigned long now = jiffies;
 
@@ -611,6 +631,7 @@
 		 */
 		spin_unlock(&br->hash_lock);
 	}
+	return ret;
 }
 
 static int fdb_to_nud(const struct net_bridge *br,
diff -ruw linux-5.4.60/net/bridge/br_forward.c linux-5.4.60-fbx/net/bridge/br_forward.c
--- linux-5.4.60/net/bridge/br_forward.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/bridge/br_forward.c	2021-03-04 13:21:01.387505716 +0100
@@ -22,12 +22,28 @@
 				 const struct sk_buff *skb)
 {
 	struct net_bridge_vlan_group *vg;
+	const unsigned char *dest;
+	struct net_bridge_fdb_entry *fdb_dst = NULL;
+	u16 vid = 0;
+	int ret = 0;
+
+	dest = skb_mac_header(skb);
+
+	rcu_read_lock();
+	if (is_unicast_ether_addr(dest)) {
+		if (br_vlan_enabled(p->dev))
+			br_vlan_get_tag(skb, &vid);
+		fdb_dst = br_fdb_find_rcu(p->br, dest, vid);
+	}
 
 	vg = nbp_vlan_group_rcu(p);
-	return ((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) &&
-		br_allowed_egress(vg, skb) && p->state == BR_STATE_FORWARDING &&
+	ret = ((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) &&
+		br_allowed_egress(vg, skb) && ((p->state == BR_STATE_FORWARDING) ||
+		((p->state == BR_STATE_BLOCKING) && fdb_dst && fdb_dst->added_by_user)) &&
 		nbp_switchdev_allowed_egress(p, skb) &&
 		!br_skb_isolated(p, skb);
+	rcu_read_unlock();
+	return ret;
 }
 
 int br_dev_queue_push_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
diff -ruw linux-5.4.60/net/bridge/br_if.c linux-5.4.60-fbx/net/bridge/br_if.c
--- linux-5.4.60/net/bridge/br_if.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/bridge/br_if.c	2021-03-04 13:21:01.387505716 +0100
@@ -490,13 +490,13 @@
 static int br_mtu_min(const struct net_bridge *br)
 {
 	const struct net_bridge_port *p;
-	int ret_mtu = 0;
+	int ret_mtu = min_t(unsigned int, br->forced_mtu, ETH_DATA_LEN);
 
 	list_for_each_entry(p, &br->port_list, list)
 		if (!ret_mtu || ret_mtu > p->dev->mtu)
 			ret_mtu = p->dev->mtu;
 
-	return ret_mtu ? ret_mtu : ETH_DATA_LEN;
+	return ret_mtu;
 }
 
 void br_mtu_auto_adjust(struct net_bridge *br)
diff -ruw linux-5.4.60/net/bridge/br_input.c linux-5.4.60-fbx/net/bridge/br_input.c
--- linux-5.4.60/net/bridge/br_input.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/bridge/br_input.c	2021-03-04 13:21:01.387505716 +0100
@@ -87,8 +87,10 @@
 
 	/* insert into forwarding database after filtering to avoid spoofing */
 	br = p->br;
-	if (p->flags & BR_LEARNING)
-		br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, false);
+	if (p->flags & BR_LEARNING &&
+	    br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, false)) {
+		goto drop;
+	}
 
 	local_rcv = !!(br->dev->flags & IFF_PROMISC);
 	if (is_multicast_ether_addr(eth_hdr(skb)->h_dest)) {
@@ -151,7 +153,7 @@
 	if (dst) {
 		unsigned long now = jiffies;
 
-		if (dst->is_local)
+		if (dst->is_local && !dst->added_by_user)
 			return br_pass_frame_up(skb);
 
 		if (now != dst->used)
@@ -249,6 +251,34 @@
 	return RX_HANDLER_CONSUMED;
 }
 
+/* Don't forward packets to originating port or forwarding disabled */
+static inline int br_drop_input_pkt(const struct net_bridge_port *p,
+				    const struct sk_buff *skb)
+{
+	const unsigned char *dest;
+	struct net_bridge_fdb_entry *fdb_dst = NULL;
+	u16 vid = 0;
+	int ret = 1;
+
+	dest = skb_mac_header(skb);
+
+	if (!is_unicast_ether_addr(dest))
+		goto out;
+
+	rcu_read_lock();
+	if (br_vlan_enabled(p->dev))
+		br_vlan_get_tag(skb, &vid);
+
+	fdb_dst = br_fdb_find_rcu(p->br, dest, vid);
+	if (fdb_dst)
+		ret = 0;
+
+	rcu_read_unlock();
+
+out:
+	return ret;
+}
+
 /*
  * Return NULL if skb is handled
  * note: already called with rcu_read_lock
@@ -340,6 +370,10 @@
 
 forward:
 	switch (p->state) {
+	case BR_STATE_BLOCKING:
+		if (br_drop_input_pkt(p, skb))
+			goto drop;
+		/* fall through */
 	case BR_STATE_FORWARDING:
 	case BR_STATE_LEARNING:
 		if (ether_addr_equal(p->br->dev->dev_addr, dest))
diff -ruw linux-5.4.60/net/bridge/br_private.h linux-5.4.60-fbx/net/bridge/br_private.h
--- linux-5.4.60/net/bridge/br_private.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/bridge/br_private.h	2021-03-04 13:21:01.387505716 +0100
@@ -417,6 +417,7 @@
 	int offload_fwd_mark;
 #endif
 	struct hlist_head		fdb_list;
+	unsigned int			forced_mtu;
 };
 
 struct br_input_skb_cb {
@@ -565,7 +566,10 @@
 		   unsigned long off);
 int br_fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
 		  const unsigned char *addr, u16 vid);
-void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
+bool br_fdb_update_only(struct net_bridge *br,
+			struct net_bridge_port *source,
+			const unsigned char *addr);
+int br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
 		   const unsigned char *addr, u16 vid, bool added_by_user);
 
 int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
diff -ruw linux-5.4.60/net/bridge/br_private_stp.h linux-5.4.60-fbx/net/bridge/br_private_stp.h
--- linux-5.4.60/net/bridge/br_private_stp.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/bridge/br_private_stp.h	2021-03-04 13:21:01.387505716 +0100
@@ -23,7 +23,7 @@
 #define BR_MAX_MAX_AGE		(40*HZ)
 
 #define BR_MIN_PATH_COST	1
-#define BR_MAX_PATH_COST	65535
+#define BR_MAX_PATH_COST	5000000
 
 struct br_config_bpdu {
 	unsigned int	topology_change:1;
diff -ruw linux-5.4.60/net/core/dev.c linux-5.4.60-fbx/net/core/dev.c
--- linux-5.4.60/net/core/dev.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/core/dev.c	2021-03-04 13:21:01.397505717 +0100
@@ -143,6 +143,7 @@
 #include <linux/net_namespace.h>
 #include <linux/indirect_call_wrapper.h>
 #include <net/devlink.h>
+#include <linux/kthread.h>
 
 #include "net-sysfs.h"
 
@@ -151,6 +152,9 @@
 /* This should be increased if a protocol with a bigger head is added. */
 #define GRO_MAX_HEAD (MAX_HEADER + 128)
 
+int (*nmesh_mbh_bridge_rx)(struct sk_buff *skb) __rcu __read_mostly;
+EXPORT_SYMBOL_GPL(nmesh_mbh_bridge_rx);
+
 static DEFINE_SPINLOCK(ptype_lock);
 static DEFINE_SPINLOCK(offload_lock);
 struct list_head ptype_base[PTYPE_HASH_SIZE] __read_mostly;
@@ -165,6 +169,10 @@
 					   struct netlink_ext_ack *extack);
 static struct napi_struct *napi_by_id(unsigned int napi_id);
 
+#ifdef CONFIG_NETRXTHREAD
+struct krxd gkrxd[CONFIG_NETRXTHREAD_RX_QUEUE];
+#endif
+
 /*
  * The @dev_base_head list is protected by @dev_base_lock and the rtnl
  * semaphore.
@@ -1095,22 +1103,6 @@
 
 	net = dev_net(dev);
 
-	/* Some auto-enslaved devices e.g. failover slaves are
-	 * special, as userspace might rename the device after
-	 * the interface had been brought up and running since
-	 * the point kernel initiated auto-enslavement. Allow
-	 * live name change even when these slave devices are
-	 * up and running.
-	 *
-	 * Typically, users of these auto-enslaving devices
-	 * don't actually care about slave name change, as
-	 * they are supposed to operate on master interface
-	 * directly.
-	 */
-	if (dev->flags & IFF_UP &&
-	    likely(!(dev->priv_flags & IFF_LIVE_RENAME_OK)))
-		return -EBUSY;
-
 	down_write(&devnet_rename_sem);
 
 	if (strncmp(newname, dev->name, IFNAMSIZ) == 0) {
@@ -4429,6 +4421,23 @@
 	return ret;
 }
 
+/* Start Freebox added code */
+#if defined(CONFIG_FREEBOX_DIVERTER) || defined(CONFIG_FREEBOX_DIVERTER_MODULE)
+int (*fbxdiverter_hook)(struct sk_buff *);
+
+static int handle_fbxdiverter(struct sk_buff *skb)
+{
+	/* try_module_get is missing here, so there is a race on
+	 * fbxdiverter module deletion */
+	if (!fbxdiverter_hook)
+		return 0;
+	return fbxdiverter_hook(skb);
+}
+
+EXPORT_SYMBOL(fbxdiverter_hook);
+#endif
+
+
 /**
  *	netif_rx	-	post buffer to the network code
  *	@skb: buffer to post
@@ -4711,28 +4720,117 @@
 	return 0;
 }
 
+static int __netif_receive_skb_core_end(struct sk_buff **pskb, bool pfmemalloc,
+					struct packet_type **ppt_prev);
+
 static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc,
 				    struct packet_type **ppt_prev)
 {
-	struct packet_type *ptype, *pt_prev;
-	rx_handler_func_t *rx_handler;
+#ifdef CONFIG_NETRXTHREAD
+	unsigned int len;
+	struct krxd *krxd;
+#endif
 	struct sk_buff *skb = *pskb;
-	struct net_device *orig_dev;
-	bool deliver_exact = false;
-	int ret = NET_RX_DROP;
-	__be16 type;
 
 	net_timestamp_check(!netdev_tstamp_prequeue, skb);
 
 	trace_netif_receive_skb(skb);
 
-	orig_dev = skb->dev;
-
 	skb_reset_network_header(skb);
 	if (!skb_transport_header_was_set(skb))
 		skb_reset_transport_header(skb);
 	skb_reset_mac_len(skb);
 
+#if defined(CONFIG_FREEBOX_DIVERTER) || defined(CONFIG_FREEBOX_DIVERTER_MODULE)
+	if (handle_fbxdiverter(skb))
+		return NET_RX_SUCCESS;
+#endif
+
+#ifndef CONFIG_NETRXTHREAD
+	return __netif_receive_skb_core_end(pskb, pfmemalloc, ppt_prev);
+#else
+	if (pfmemalloc)
+		return __netif_receive_skb_core_end(pskb, pfmemalloc, ppt_prev);
+
+	BUILD_BUG_ON(ARRAY_SIZE(gkrxd) < 2);
+	krxd = &gkrxd[skb->rxthread_prio & 1];
+
+        /* queue the packet to the rx thread */
+	local_bh_disable();
+	len = skb_queue_len(&krxd->pkt_queue);
+	if (len < RXTHREAD_MAX_PKTS) {
+		__skb_queue_tail(&krxd->pkt_queue, skb);
+		krxd->stats_pkts++;
+		if (!len)
+			wake_up(&krxd->wq);
+	} else {
+		krxd->stats_dropped++;
+		dev_kfree_skb(skb);
+        }
+	local_bh_enable();
+	return NET_RX_SUCCESS;
+#endif
+}
+
+#ifdef CONFIG_NETRXTHREAD
+static int krxd_action(void *data)
+{
+	struct krxd *krxd = (struct krxd *)data;
+	unsigned int queue = krxd - gkrxd;
+	struct sk_buff *skb;
+
+	set_user_nice(current, queue > 0 ? -10 : -5);
+	current->flags |= PF_NOFREEZE;
+	__set_current_state(TASK_RUNNING);
+
+	local_bh_disable();
+	while (1) {
+		struct packet_type *pt_prev = NULL;
+		struct net_device *orig_dev;
+
+		skb = skb_dequeue(&krxd->pkt_queue);
+		if (!skb) {
+			local_bh_enable();
+			wait_event_interruptible(krxd->wq,
+						 skb_queue_len(&krxd->pkt_queue));
+			set_current_state(TASK_RUNNING);
+			local_bh_disable();
+			continue;
+		}
+
+		rcu_read_lock();
+		orig_dev = skb->dev;
+		__netif_receive_skb_core_end(&skb, false, &pt_prev);
+		if (pt_prev)
+			INDIRECT_CALL_INET(pt_prev->func,
+					   ipv6_rcv, ip_rcv, skb,
+					   skb->dev, pt_prev, orig_dev);
+		rcu_read_unlock();
+
+		/* only schedule when working on lowest prio queue */
+		if (queue == 0 && need_resched()) {
+			local_bh_enable();
+			schedule();
+			local_bh_disable();
+		}
+	}
+	return 0;
+}
+#endif
+
+static int __netif_receive_skb_core_end(struct sk_buff **pskb, bool pfmemalloc,
+					struct packet_type **ppt_prev)
+{
+	struct sk_buff *skb = *pskb;
+	struct packet_type *ptype, *pt_prev;
+	rx_handler_func_t *rx_handler;
+	struct net_device *orig_dev;
+	bool deliver_exact = false;
+	int ret = NET_RX_DROP;
+	__be16 type;
+	int (*nmesh_mbh_rx)(struct sk_buff *skb);
+
+	orig_dev = skb->dev;
 	pt_prev = NULL;
 
 another_round:
@@ -4761,6 +4859,13 @@
 			goto out;
 	}
 
+	if ((skb->protocol == cpu_to_be16(ETH_P_NMESH_MBH)) ||
+	    unlikely(is_multicast_ether_addr(eth_hdr(skb)->h_dest))) {
+		nmesh_mbh_rx = rcu_dereference(nmesh_mbh_bridge_rx);
+		if (nmesh_mbh_rx && nmesh_mbh_rx(skb))
+			goto out;
+	}
+
 	if (skb_skip_tc_classify(skb))
 		goto skip_classify;
 
@@ -4885,7 +4990,9 @@
 	if (pt_prev) {
 		if (unlikely(skb_orphan_frags_rx(skb, GFP_ATOMIC)))
 			goto drop;
-		*ppt_prev = pt_prev;
+		else
+			ret = INDIRECT_CALL_INET(pt_prev->func, ipv6_rcv, ip_rcv, skb,
+						 skb->dev, pt_prev, orig_dev);
 	} else {
 drop:
 		if (!deliver_exact)
@@ -4916,10 +5023,16 @@
 	struct packet_type *pt_prev = NULL;
 	int ret;
 
+#ifdef CONFIG_NETRXTHREAD
+	(void)orig_dev;
+	ret = __netif_receive_skb_core(&skb, pfmemalloc, &pt_prev);
+#else
 	ret = __netif_receive_skb_core(&skb, pfmemalloc, &pt_prev);
 	if (pt_prev)
 		ret = INDIRECT_CALL_INET(pt_prev->func, ipv6_rcv, ip_rcv, skb,
 					 skb->dev, pt_prev, orig_dev);
+#endif
+
 	return ret;
 }
 
@@ -10236,6 +10349,24 @@
 	open_softirq(NET_TX_SOFTIRQ, net_tx_action);
 	open_softirq(NET_RX_SOFTIRQ, net_rx_action);
 
+#ifdef CONFIG_NETRXTHREAD
+        for (i = 0; i < CONFIG_NETRXTHREAD_RX_QUEUE; i++) {
+		struct krxd *krxd = &gkrxd[i];
+		struct task_struct *task;
+
+		skb_queue_head_init(&krxd->pkt_queue);
+		init_waitqueue_head(&krxd->wq);
+		task = kthread_create(krxd_action, krxd, "krxthread_%u", i);
+		if (IS_ERR(task)) {
+			printk(KERN_ERR "unable to create krxd\n");
+			return -ENOMEM;
+		}
+		krxd->task = task;
+		wake_up_process(task);
+	}
+#endif
+
+
 	rc = cpuhp_setup_state_nocalls(CPUHP_NET_DEV_DEAD, "net/dev:dead",
 				       NULL, dev_cpu_dead);
 	WARN_ON(rc < 0);
diff -ruw linux-5.4.60/net/core/ethtool.c linux-5.4.60-fbx/net/core/ethtool.c
--- linux-5.4.60/net/core/ethtool.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/core/ethtool.c	2021-03-04 13:21:01.400839050 +0100
@@ -126,6 +126,7 @@
 	[ETHTOOL_RX_COPYBREAK]	= "rx-copybreak",
 	[ETHTOOL_TX_COPYBREAK]	= "tx-copybreak",
 	[ETHTOOL_PFC_PREVENTION_TOUT] = "pfc-prevention-tout",
+	[ETHTOOL_MAC_MODE] = "mac-mode",
 };
 
 static const char
@@ -2274,6 +2275,11 @@
 		    tuna->type_id != ETHTOOL_TUNABLE_U16)
 			return -EINVAL;
 		break;
+	case ETHTOOL_MAC_MODE:
+		if (tuna->len != sizeof(u32) ||
+		    tuna->type_id != ETHTOOL_TUNABLE_U32)
+			return -EINVAL;
+		break;
 	default:
 		return -EINVAL;
 	}
@@ -2556,6 +2562,87 @@
 	return dev->ethtool_ops->set_fecparam(dev, &fecparam);
 }
 
+static int ethtool_get_eponparam(struct net_device *dev, void __user *useraddr)
+{
+	struct ethtool_epon_param eponparam = { .cmd = ETHTOOL_GEPON_PARAM };
+	int rc;
+
+	if (!dev->ethtool_ops->get_epon_param)
+		return -EOPNOTSUPP;
+
+	rc = dev->ethtool_ops->get_epon_param(dev, &eponparam);
+	if (rc)
+		return rc;
+
+	if (copy_to_user(useraddr, &eponparam, sizeof(eponparam)))
+		return -EFAULT;
+	return 0;
+}
+
+static int ethtool_set_eponparam(struct net_device *dev, void __user *useraddr)
+{
+	struct ethtool_epon_param eponparam;
+
+	if (!dev->ethtool_ops->set_epon_param)
+		return -EOPNOTSUPP;
+
+	if (copy_from_user(&eponparam, useraddr, sizeof(eponparam)))
+		return -EFAULT;
+
+	return dev->ethtool_ops->set_epon_param(dev, &eponparam);
+}
+
+static int ethtool_get_sfp_state(struct net_device *dev, void __user *useraddr)
+{
+	struct ethtool_sfp_state sfp_state;
+	int rc;
+
+	if (!dev->sfp_bus) {
+		printk("no SFP bus ya twat.\n");
+		return -ENODEV;
+	}
+
+	rc = sfp_get_sfp_state(dev->sfp_bus, &sfp_state);
+	if (rc)
+		return rc;
+
+	if (copy_to_user(useraddr, &sfp_state, sizeof (sfp_state)))
+		return -EFAULT;
+	return 0;
+}
+
+static int ethtool_get_shaper_params(struct net_device *dev, void __user *uaddr)
+{
+	struct ethtool_shaper_params sp;
+	int rc;
+
+	if (!dev->ethtool_ops->get_shaper_param)
+		return -EOPNOTSUPP;
+
+	memset(&sp, 0, sizeof (sp));
+	rc = dev->ethtool_ops->get_shaper_param(dev, &sp);
+	if (rc)
+		return rc;
+
+	if (copy_to_user(uaddr, &sp, sizeof (sp)))
+		return -EFAULT;
+
+	return 0;
+}
+
+static int ethtool_set_shaper_params(struct net_device *dev, void __user *uaddr)
+{
+	struct ethtool_shaper_params sp;
+
+	if (!dev->ethtool_ops->set_shaper_param)
+		return -EOPNOTSUPP;
+
+	if (copy_from_user(&sp, uaddr, sizeof (sp)))
+		return -EFAULT;
+
+	return dev->ethtool_ops->set_shaper_param(dev, &sp);
+}
+
 /* The main entry point in this file.  Called from net/core/dev_ioctl.c */
 
 int dev_ethtool(struct net *net, struct ifreq *ifr)
@@ -2831,6 +2918,27 @@
 	case ETHTOOL_SFECPARAM:
 		rc = ethtool_set_fecparam(dev, useraddr);
 		break;
+	case ETHTOOL_GEPON_PARAM:
+		rc = ethtool_get_eponparam(dev, useraddr);
+		break;
+	case ETHTOOL_SEPON_KEYS:
+	case ETHTOOL_SEPON_ENCRYPT:
+	case ETHTOOL_SEPON_RESTART:
+	case ETHTOOL_SEPON_BURST:
+	case ETHTOOL_SEPON_ADD_MCLLID:
+	case ETHTOOL_SEPON_DEL_MCLLID:
+	case ETHTOOL_SEPON_CLR_MCLLID:
+		rc = ethtool_set_eponparam(dev, useraddr);
+		break;
+	case ETHTOOL_GSFP_STATE:
+		rc = ethtool_get_sfp_state(dev, useraddr);
+		break;
+	case ETHTOOL_SSHAPER_PARAMS:
+		rc = ethtool_set_shaper_params(dev, useraddr);
+		break;
+	case ETHTOOL_GSHAPER_PARAMS:
+		rc = ethtool_get_shaper_params(dev, useraddr);
+		break;
 	default:
 		rc = -EOPNOTSUPP;
 	}
diff -ruw linux-5.4.60/net/core/net-procfs.c linux-5.4.60-fbx/net/core/net-procfs.c
--- linux-5.4.60/net/core/net-procfs.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/core/net-procfs.c	2021-03-04 13:21:01.400839050 +0100
@@ -272,6 +272,84 @@
 	.show  = ptype_seq_show,
 };
 
+#ifdef CONFIG_NETRXTHREAD
+/*
+ *	This is invoked by the /proc filesystem handler to display a device
+ *	in detail.
+ */
+static void *krxthread_seq_start(struct seq_file *seq, loff_t *pos)
+{
+	int *queue;
+
+	if (*pos > CONFIG_NETRXTHREAD_RX_QUEUE)
+		return NULL;
+
+	queue = kmalloc(sizeof(*queue), GFP_KERNEL);
+	if (!queue)
+		return NULL;
+	*queue = ((int)*pos - 1);
+
+	return queue;
+}
+
+static void *krxthread_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+	int *queue = v;
+
+	if (*pos == CONFIG_NETRXTHREAD_RX_QUEUE)
+		return NULL;
+
+	++*queue;
+	*pos = *queue + 1;
+	return queue;
+}
+
+static void krxthread_seq_stop(struct seq_file *seq, void *v)
+{
+	kfree(v);
+}
+
+static void krxthread_seq_printf_stats(struct seq_file *seq, int queue)
+{
+	seq_printf(seq, "%8u %12u %12u\n",
+		   queue,
+		   gkrxd[queue].stats_pkts,
+		   gkrxd[queue].stats_dropped);
+}
+
+static int krxthread_seq_show(struct seq_file *seq, void *v)
+{
+	int *queue = v;
+
+	if (*queue == -1)
+		seq_printf(seq, "%8s %12s %12s\n",
+			   "queue", "packets", "drops");
+	else
+		krxthread_seq_printf_stats(seq, *queue);
+	return 0;
+}
+
+static const struct seq_operations krxthread_seq_ops = {
+	.start = krxthread_seq_start,
+	.next  = krxthread_seq_next,
+	.stop  = krxthread_seq_stop,
+	.show  = krxthread_seq_show,
+};
+
+static int krxthread_seq_open(struct inode *inode, struct file *file)
+{
+	return seq_open(file, &krxthread_seq_ops);
+}
+
+static const struct file_operations krxthread_seq_fops = {
+	.owner	 = THIS_MODULE,
+	.open    = krxthread_seq_open,
+	.read    = seq_read,
+	.llseek  = seq_lseek,
+	.release = seq_release,
+};
+#endif /* KRXTHREAD */
+
 static int __net_init dev_proc_net_init(struct net *net)
 {
 	int rc = -ENOMEM;
@@ -288,6 +366,11 @@
 
 	if (wext_proc_init(net))
 		goto out_ptype;
+#ifdef CONFIG_NETRXTHREAD
+	if (!proc_create("krxthread", S_IRUGO, net->proc_net,
+			 &krxthread_seq_fops))
+		goto out_ptype;
+#endif
 	rc = 0;
 out:
 	return rc;
diff -ruw linux-5.4.60/net/core/net-sysfs.c linux-5.4.60-fbx/net/core/net-sysfs.c
--- linux-5.4.60/net/core/net-sysfs.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/core/net-sysfs.c	2021-03-04 13:21:01.400839050 +0100
@@ -14,6 +14,7 @@
 #include <linux/nsproxy.h>
 #include <net/sock.h>
 #include <net/net_namespace.h>
+#include <net/cfg80211.h>
 #include <linux/rtnetlink.h>
 #include <linux/vmalloc.h>
 #include <linux/export.h>
@@ -633,7 +634,24 @@
 };
 
 #if IS_ENABLED(CONFIG_WIRELESS_EXT) || IS_ENABLED(CONFIG_CFG80211)
+static ssize_t show_nl80211_iftype(struct device *dev,
+				   struct device_attribute *attr, char *buf)
+{
+	const struct net_device *netdev = to_net_dev(dev);
+	ssize_t ret = 0;
+
+	if (!rtnl_trylock())
+		return restart_syscall();
+	if (netdev->ieee80211_ptr)
+		ret = sprintf(buf, "%d\n", netdev->ieee80211_ptr->iftype);
+	rtnl_unlock();
+
+	return ret;
+}
+static DEVICE_ATTR(nl80211_iftype, S_IRUGO, show_nl80211_iftype, NULL);
+
 static struct attribute *wireless_attrs[] = {
+	&dev_attr_nl80211_iftype.attr,
 	NULL
 };
 
diff -ruw linux-5.4.60/net/core/skbuff.c linux-5.4.60-fbx/net/core/skbuff.c
--- linux-5.4.60/net/core/skbuff.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/core/skbuff.c	2021-03-04 13:21:01.404172384 +0100
@@ -944,6 +944,10 @@
 	memcpy(&new->headers_start, &old->headers_start,
 	       offsetof(struct sk_buff, headers_end) -
 	       offsetof(struct sk_buff, headers_start));
+
+#ifdef CONFIG_IP_FFN
+	new->ffn_state		= FFN_STATE_INIT;
+#endif
 	CHECK_SKB_FIELD(protocol);
 	CHECK_SKB_FIELD(csum);
 	CHECK_SKB_FIELD(hash);
@@ -5128,11 +5132,12 @@
 	skb->offload_l3_fwd_mark = 0;
 #endif
 
+	skb->mark = 0;
+
 	if (!xnet)
 		return;
 
 	ipvs_reset(skb);
-	skb->mark = 0;
 	skb->tstamp = 0;
 }
 EXPORT_SYMBOL_GPL(skb_scrub_packet);
diff -ruw linux-5.4.60/net/core/sock.c linux-5.4.60-fbx/net/core/sock.c
--- linux-5.4.60/net/core/sock.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/core/sock.c	2021-03-04 13:21:01.404172384 +0100
@@ -1177,6 +1177,10 @@
 		ret = sock_setbindtodevice_locked(sk, val);
 		break;
 
+	case SO_UDP_DUP_UNICAST:
+		sock_valbool_flag(sk, SOCK_UDP_DUP_UNICAST, valbool);
+		break;
+
 	default:
 		ret = -ENOPROTOOPT;
 		break;
@@ -1510,6 +1514,10 @@
 		v.val64 = sock_gen_cookie(sk);
 		break;
 
+	case SO_UDP_DUP_UNICAST:
+		v.val = sock_flag(sk, SOCK_UDP_DUP_UNICAST);
+		break;
+
 	case SO_ZEROCOPY:
 		v.val = sock_flag(sk, SOCK_ZEROCOPY);
 		break;
diff -ruw linux-5.4.60/net/dsa/Kconfig linux-5.4.60-fbx/net/dsa/Kconfig
--- linux-5.4.60/net/dsa/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/dsa/Kconfig	2021-03-04 13:21:01.410839051 +0100
@@ -49,6 +49,10 @@
 	  Broadcom switches which places the tag before the Ethernet header
 	  (prepended).
 
+config NET_DSA_TAG_BRCM_FBX
+	tristate "Tag driver for Broadcom switches using in-frame headers"
+	select NET_DSA_TAG_BRCM_COMMON
+
 config NET_DSA_TAG_GSWIP
 	tristate "Tag driver for Lantiq / Intel GSWIP switches"
 	help
diff -ruw linux-5.4.60/net/ipv4/ipconfig.c linux-5.4.60-fbx/net/ipv4/ipconfig.c
--- linux-5.4.60/net/ipv4/ipconfig.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv4/ipconfig.c	2021-03-04 13:21:01.424172385 +0100
@@ -198,16 +198,62 @@
 static struct ic_device *ic_first_dev __initdata;	/* List of open device */
 static struct ic_device *ic_dev __initdata;		/* Selected device */
 
-static bool __init ic_is_init_dev(struct net_device *dev)
+static bool __init ic_is_init_dev(struct net_device *dev, bool partial)
 {
+	char *p = NULL;
+	bool ret;
+
 	if (dev->flags & IFF_LOOPBACK)
 		return false;
-	return user_dev_name[0] ? !strcmp(dev->name, user_dev_name) :
+
+	if (partial) {
+		p = strchr(user_dev_name, '.');
+		if (p)
+			*p = 0;
+	}
+
+	ret = false;
+	if (user_dev_name[0] ? !strcmp(dev->name, user_dev_name) :
 	    (!(dev->flags & IFF_LOOPBACK) &&
 	     (dev->flags & (IFF_POINTOPOINT|IFF_BROADCAST)) &&
-	     strncmp(dev->name, "dummy", 5));
+	     strncmp(dev->name, "dummy", 5)))
+		ret = true;
+	if (p)
+		*p = '.';
+	return ret;
 }
 
+#ifdef CONFIG_VLAN_8021Q
+int register_vlan_device(struct net_device *real_dev, u16 vlan_id);
+
+static void __init prepare_vlan(void)
+{
+	unsigned short oflags;
+	struct net_device *dev;
+	char *p;
+	u16 vid;
+
+	if (!strchr(user_dev_name, '.'))
+		return;
+
+	p = strchr(user_dev_name, '.');
+	*p = 0;
+	vid = simple_strtoul(p + 1, NULL, 10);
+	dev = __dev_get_by_name(&init_net, user_dev_name);
+	if (!dev)
+		goto fail;
+
+	oflags = dev->flags;
+	if (dev_change_flags(dev, oflags | IFF_UP, NULL) < 0)
+		goto fail;
+
+	register_vlan_device(dev, vid);
+
+fail:
+	*p = '.';
+}
+#endif
+
 static int __init ic_open_devs(void)
 {
 	struct ic_device *d, **last;
@@ -226,8 +272,13 @@
 			pr_err("IP-Config: Failed to open %s\n", dev->name);
 	}
 
+#ifdef CONFIG_VLAN_8021Q
+	/* register vlan device if needed */
+	prepare_vlan();
+#endif
+
 	for_each_netdev(&init_net, dev) {
-		if (ic_is_init_dev(dev)) {
+		if (ic_is_init_dev(dev, false)) {
 			int able = 0;
 			if (dev->mtu >= 364)
 				able |= IC_BOOTP;
@@ -276,10 +327,12 @@
 		int wait, elapsed;
 
 		for_each_netdev(&init_net, dev)
-			if (ic_is_init_dev(dev) && netif_carrier_ok(dev))
+			if (ic_is_init_dev(dev, false) && netif_carrier_ok(dev))
 				goto have_carrier;
 
+		rtnl_unlock();
 		msleep(1);
+		rtnl_lock();
 
 		if (time_before(jiffies, next_msg))
 			continue;
@@ -705,8 +758,10 @@
 			e += len;
 		}
 		if (*vendor_class_identifier) {
+#ifdef IPCONFIG_DEBUG
 			pr_info("DHCP: sending class identifier \"%s\"\n",
 				vendor_class_identifier);
+#endif
 			*e++ = 60;	/* Class-identifier */
 			len = strlen(vendor_class_identifier);
 			*e++ = len;
@@ -1414,7 +1469,7 @@
 
 		rtnl_lock();
 		for_each_netdev(&init_net, dev) {
-			if (ic_is_init_dev(dev)) {
+			if (ic_is_init_dev(dev, true)) {
 				found = 1;
 				break;
 			}
diff -ruw linux-5.4.60/net/ipv4/ip_input.c linux-5.4.60-fbx/net/ipv4/ip_input.c
--- linux-5.4.60/net/ipv4/ip_input.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv4/ip_input.c	2021-03-04 13:21:01.420839051 +0100
@@ -223,8 +223,12 @@
 	}
 }
 
-static int ip_local_deliver_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+int ip_local_deliver_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
+#ifdef CONFIG_IP_FFN
+	if (skb->ffn_state == FFN_STATE_FORWARDABLE)
+		ip_ffn_add(skb, IP_FFN_LOCAL_IN);
+#endif
 	__skb_pull(skb, skb_network_header_len(skb));
 
 	rcu_read_lock();
@@ -520,6 +524,11 @@
 	if (skb == NULL)
 		return NET_RX_DROP;
 
+#ifdef CONFIG_IP_FFN
+	if (!ip_ffn_process(skb))
+		return NET_RX_SUCCESS;
+#endif
+
 	return NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING,
 		       net, NULL, skb, dev, NULL,
 		       ip_rcv_finish);
diff -ruw linux-5.4.60/net/ipv4/ip_output.c linux-5.4.60-fbx/net/ipv4/ip_output.c
--- linux-5.4.60/net/ipv4/ip_output.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv4/ip_output.c	2021-03-04 13:21:01.420839051 +0100
@@ -218,6 +218,11 @@
 			return res;
 	}
 
+#ifdef CONFIG_IP_FFN
+	if (skb->ffn_state == FFN_STATE_FORWARDABLE)
+		ip_ffn_add(skb, IP_FFN_FINISH_OUT);
+#endif
+
 	rcu_read_lock_bh();
 	neigh = ip_neigh_for_gw(rt, skb, &is_v6gw);
 	if (!IS_ERR(neigh)) {
@@ -429,6 +434,11 @@
 	skb->dev = dev;
 	skb->protocol = htons(ETH_P_IP);
 
+#ifdef CONFIG_IP_FFN
+	if (skb->ffn_state == FFN_STATE_FAST_FORWARDED)
+		return ip_finish_output(net, sk, skb);
+#endif
+
 	return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
 			    net, sk, skb, NULL, dev,
 			    ip_finish_output,
@@ -1733,4 +1743,7 @@
 #if defined(CONFIG_IP_MULTICAST)
 	igmp_mc_init();
 #endif
+#ifdef CONFIG_IP_FFN
+	ip_ffn_init();
+#endif
 }
diff -ruw linux-5.4.60/net/ipv4/ip_tunnel_core.c linux-5.4.60-fbx/net/ipv4/ip_tunnel_core.c
--- linux-5.4.60/net/ipv4/ip_tunnel_core.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv4/ip_tunnel_core.c	2021-03-04 13:21:01.420839051 +0100
@@ -34,6 +34,9 @@
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
 #include <net/dst_metadata.h>
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#include <net/netfilter/nf_conntrack.h>
+#endif
 
 const struct ip_tunnel_encap_ops __rcu *
 		iptun_encaps[MAX_IPTUN_ENCAP_OPS] __read_mostly;
@@ -56,6 +59,11 @@
 	skb_scrub_packet(skb, xnet);
 
 	skb_clear_hash_if_not_l4(skb);
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+	if (proto == IPPROTO_IPV6)
+		nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
+#endif
+
 	skb_dst_set(skb, &rt->dst);
 	memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 
diff -ruw linux-5.4.60/net/ipv4/Makefile linux-5.4.60-fbx/net/ipv4/Makefile
--- linux-5.4.60/net/ipv4/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv4/Makefile	2021-03-04 13:21:01.417505717 +0100
@@ -20,6 +20,8 @@
 
 obj-$(CONFIG_NET_IP_TUNNEL) += ip_tunnel.o
 obj-$(CONFIG_SYSCTL) += sysctl_net_ipv4.o
+
+obj-$(CONFIG_IP_FFN) += ip_ffn.o
 obj-$(CONFIG_PROC_FS) += proc.o
 obj-$(CONFIG_IP_MULTIPLE_TABLES) += fib_rules.o
 obj-$(CONFIG_IP_MROUTE) += ipmr.o
diff -ruw linux-5.4.60/net/ipv4/netfilter/ip_tables.c linux-5.4.60-fbx/net/ipv4/netfilter/ip_tables.c
--- linux-5.4.60/net/ipv4/netfilter/ip_tables.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv4/netfilter/ip_tables.c	2021-03-04 13:21:01.424172385 +0100
@@ -1102,6 +1102,8 @@
 	return ret;
 }
 
+extern void fbxbr_flush_cache(void);
+
 static int
 do_replace(struct net *net, const void __user *user, unsigned int len)
 {
@@ -1141,6 +1143,15 @@
 			   tmp.num_counters, tmp.counters);
 	if (ret)
 		goto free_newinfo_untrans;
+
+#ifdef CONFIG_IP_FFN
+	ip_ffn_flush_all();
+#endif
+
+#ifdef CONFIG_FBXBRIDGE
+	fbxbr_flush_cache();
+#endif
+
 	return 0;
 
  free_newinfo_untrans:
diff -ruw linux-5.4.60/net/ipv4/netfilter/Kconfig linux-5.4.60-fbx/net/ipv4/netfilter/Kconfig
--- linux-5.4.60/net/ipv4/netfilter/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv4/netfilter/Kconfig	2021-03-04 13:21:01.424172385 +0100
@@ -6,6 +6,13 @@
 menu "IP: Netfilter Configuration"
 	depends on INET && NETFILTER
 
+config IP_FFN
+	bool "IP: Fast forwarding and NAT"
+
+config IP_FFN_PROCFS
+	bool "IP: Fast forwarding and NAT /proc/net entries"
+	depends on IP_FFN
+
 config NF_DEFRAG_IPV4
 	tristate
 	default n
diff -ruw linux-5.4.60/net/ipv4/tcp.c linux-5.4.60-fbx/net/ipv4/tcp.c
--- linux-5.4.60/net/ipv4/tcp.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv4/tcp.c	2021-03-04 13:21:01.427505718 +0100
@@ -2924,6 +2924,13 @@
 			err = -EINVAL;
 		break;
 
+	case TCP_LINEAR_RTO:
+		if (val < 0 || val > 1)
+			err = -EINVAL;
+		else
+			tp->linear_rto = val;
+		break;
+
 	case TCP_REPAIR:
 		if (!tcp_can_repair_sock(sk))
 			err = -EPERM;
@@ -3549,6 +3556,9 @@
 	case TCP_THIN_DUPACK:
 		val = 0;
 		break;
+	case TCP_LINEAR_RTO:
+		val = tp->linear_rto;
+		break;
 
 	case TCP_REPAIR:
 		val = tp->repair;
diff -ruw linux-5.4.60/net/ipv4/tcp_timer.c linux-5.4.60-fbx/net/ipv4/tcp_timer.c
--- linux-5.4.60/net/ipv4/tcp_timer.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv4/tcp_timer.c	2021-03-04 13:21:01.430839052 +0100
@@ -556,6 +556,10 @@
 	    icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) {
 		icsk->icsk_backoff = 0;
 		icsk->icsk_rto = min(__tcp_set_rto(tp), TCP_RTO_MAX);
+
+	} else if (sk->sk_state == TCP_ESTABLISHED && tp->linear_rto) {
+		icsk->icsk_backoff = 0;
+		icsk->icsk_rto = min(__tcp_set_rto(tp), TCP_RTO_MAX);
 	} else {
 		/* Use normal (exponential) backoff */
 		icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
diff -ruw linux-5.4.60/net/ipv4/udp.c linux-5.4.60-fbx/net/ipv4/udp.c
--- linux-5.4.60/net/ipv4/udp.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv4/udp.c	2021-03-04 13:21:01.430839052 +0100
@@ -304,6 +304,49 @@
 	inet_sk(sk)->inet_num = snum;
 	udp_sk(sk)->udp_port_hash = snum;
 	udp_sk(sk)->udp_portaddr_hash ^= snum;
+
+	/* resolve udp reuse conflict */
+	if (sk->sk_reuse) {
+		struct sock *sk2;
+		bool found;
+
+		found = false;
+		sk_for_each(sk2, &hslot->head) {
+			if (!net_eq(sock_net(sk2), net) ||
+			    sk2 == sk ||
+			    (udp_sk(sk2)->udp_port_hash != snum))
+				continue;
+
+			if (sk2->sk_bound_dev_if &&
+			    sk->sk_bound_dev_if &&
+			    sk2->sk_bound_dev_if != sk->sk_bound_dev_if)
+				continue;
+
+			if (!inet_rcv_saddr_equal(sk, sk2, true))
+				continue;
+
+			found = true;
+			break;
+		}
+
+		sk_for_each(sk2, &hslot->head) {
+			if (!net_eq(sock_net(sk2), net) ||
+			    sk2 == sk ||
+			    (udp_sk(sk2)->udp_port_hash != snum))
+				continue;
+
+			if (sk2->sk_bound_dev_if &&
+			    sk->sk_bound_dev_if &&
+			    sk2->sk_bound_dev_if != sk->sk_bound_dev_if)
+				continue;
+
+			if (!inet_rcv_saddr_equal(sk, sk2, true))
+				continue;
+
+			sk->sk_reuse_conflict = found;
+		}
+	}
+
 	if (sk_unhashed(sk)) {
 		if (sk->sk_reuseport &&
 		    udp_reuseport_add_sock(sk, hslot)) {
@@ -2208,6 +2251,90 @@
 	return 0;
 }
 
+/*
+ *	Unicast goes to one listener and all sockets with dup flag
+ *
+ *	Note: called only from the BH handler context.
+ *
+ *	Note2: it is okay to use the udp_table.hash table only here
+ *	and not udp_table.hash2 table as the sock is always hashed in
+ *	both udp_table.hash and udp_table.hash2. This might impact
+ *	performance if the sock hash bucket hosts more than 10 socks
+ *	but has the benefit of keeping the code simplier.
+ *
+ *	Note3: __udp_is_mcast_sock() does not have really anything to
+ *	do with multicast, it used there to deliver the packet only to
+ *	the sockets that are bound to the ip:port/interface the skbuff
+ *	is targeted to.
+ */
+static int __udp4_lib_uc_conflict_deliver(struct net *net, struct sk_buff *skb,
+					  struct udphdr  *uh,
+					  __be32 saddr, __be32 daddr,
+					  struct udp_table *udptable,
+					  int proto)
+{
+	struct sock *sk, *first = NULL;
+	unsigned short hnum = ntohs(uh->dest);
+	struct udp_hslot *hslot = udp_hashslot(udptable, net, hnum);
+	int dif = skb->dev->ifindex;
+	unsigned int offset = offsetof(typeof(*sk), sk_node);
+	struct hlist_node *node;
+	struct sk_buff *nskb;
+	int sdif = inet_sdif(skb);
+	bool found_non_dup;
+
+	found_non_dup = false;
+	sk_for_each_entry_offset_rcu(sk, node, &hslot->head, offset) {
+		bool need_deliver;
+
+		if (!__udp_is_mcast_sock(net, sk, uh->dest, daddr,
+					 uh->source, saddr, dif, sdif, hnum))
+			continue;
+
+		if (sock_flag(sk, SOCK_UDP_DUP_UNICAST))
+			need_deliver = true;
+		else {
+			if (!found_non_dup)
+				need_deliver = true;
+			else
+				need_deliver = false;
+			found_non_dup = true;
+		}
+
+		if (!need_deliver)
+			continue;
+
+		if (!first) {
+			first = sk;
+			continue;
+		}
+		nskb = skb_clone(skb, GFP_ATOMIC);
+
+		if (unlikely(!nskb)) {
+			atomic_inc(&sk->sk_drops);
+			__UDP_INC_STATS(net, UDP_MIB_RCVBUFERRORS,
+					IS_UDPLITE(sk));
+			__UDP_INC_STATS(net, UDP_MIB_INERRORS,
+					IS_UDPLITE(sk));
+			continue;
+		}
+
+		if (udp_queue_rcv_skb(sk, nskb) > 0)
+			consume_skb(nskb);
+	}
+
+	if (first) {
+		if (udp_queue_rcv_skb(first, skb) > 0)
+			consume_skb(skb);
+	} else {
+		kfree_skb(skb);
+		__UDP_INC_STATS(net, UDP_MIB_IGNOREDMULTI,
+				proto == IPPROTO_UDPLITE);
+	}
+
+	return 0;
+}
+
 /* Initialize UDP checksum. If exited with zero value (success),
  * CHECKSUM_UNNECESSARY means, that no more checks are required.
  * Otherwise, csum completion requires checksumming packet body,
@@ -2332,9 +2459,15 @@
 						saddr, daddr, udptable, proto);
 
 	sk = __udp4_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
-	if (sk)
-		return udp_unicast_rcv_skb(sk, skb, uh);
+	if (sk) {
+		if (sk->sk_reuse_conflict)
+			return __udp4_lib_uc_conflict_deliver(net,
+							      skb, uh,
+							      saddr, daddr,
+							      udptable, proto);
 
+		return udp_unicast_rcv_skb(sk, skb, uh);
+	}
 	if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
 		goto drop;
 	nf_reset_ct(skb);
diff -ruw linux-5.4.60/net/ipv6/addrconf.c linux-5.4.60-fbx/net/ipv6/addrconf.c
--- linux-5.4.60/net/ipv6/addrconf.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv6/addrconf.c	2021-03-04 13:21:01.434172386 +0100
@@ -2281,12 +2281,27 @@
 	return 0;
 }
 
+static int addrconf_ifid_ppp(u8 *eui, struct net_device *dev)
+{
+	if (is_zero_ether_addr(dev->perm_addr))
+		return -1;
+
+	memcpy(eui, dev->perm_addr, 3);
+	memcpy(eui + 5, dev->perm_addr + 3, 3);
+	eui[3] = 0xFF;
+	eui[4] = 0xFE;
+	eui[0] ^= 2;
+	return 0;
+}
+
 static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
 {
 	switch (dev->type) {
 	case ARPHRD_ETHER:
 	case ARPHRD_FDDI:
 		return addrconf_ifid_eui48(eui, dev);
+	case ARPHRD_PPP:
+		return addrconf_ifid_ppp(eui, dev);
 	case ARPHRD_ARCNET:
 		return addrconf_ifid_arcnet(eui, dev);
 	case ARPHRD_INFINIBAND:
@@ -3340,6 +3355,7 @@
 
 	if ((dev->type != ARPHRD_ETHER) &&
 	    (dev->type != ARPHRD_FDDI) &&
+	    (dev->type != ARPHRD_PPP) &&
 	    (dev->type != ARPHRD_ARCNET) &&
 	    (dev->type != ARPHRD_INFINIBAND) &&
 	    (dev->type != ARPHRD_IEEE1394) &&
diff -ruw linux-5.4.60/net/ipv6/af_inet6.c linux-5.4.60-fbx/net/ipv6/af_inet6.c
--- linux-5.4.60/net/ipv6/af_inet6.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv6/af_inet6.c	2021-03-04 13:21:01.434172386 +0100
@@ -1086,6 +1086,10 @@
 	if (err)
 		goto udpv6_fail;
 
+#ifdef CONFIG_IPV6_FFN
+	ipv6_ffn_init();
+#endif
+
 	err = udplitev6_init();
 	if (err)
 		goto udplitev6_fail;
diff -ruw linux-5.4.60/net/ipv6/ip6_input.c linux-5.4.60-fbx/net/ipv6/ip6_input.c
--- linux-5.4.60/net/ipv6/ip6_input.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv6/ip6_input.c	2021-03-04 13:21:01.437505718 +0100
@@ -281,6 +281,12 @@
 	skb = ip6_rcv_core(skb, dev, net);
 	if (skb == NULL)
 		return NET_RX_DROP;
+
+#ifdef CONFIG_IPV6_FFN
+	if (!ipv6_ffn_process(skb))
+		return NET_RX_SUCCESS;
+#endif
+
 	return NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
 		       net, NULL, skb, dev, NULL,
 		       ip6_rcv_finish);
@@ -444,8 +450,13 @@
 	kfree_skb(skb);
 }
 
-static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
+#ifdef CONFIG_IPV6_FFN
+	if (skb->ffn_state == FFN_STATE_FORWARDABLE)
+		ipv6_ffn_add(skb, IPV6_FFN_LOCAL_IN);
+#endif
+
 	rcu_read_lock();
 	ip6_protocol_deliver_rcu(net, skb, 0, false);
 	rcu_read_unlock();
diff -ruw linux-5.4.60/net/ipv6/ip6_output.c linux-5.4.60-fbx/net/ipv6/ip6_output.c
--- linux-5.4.60/net/ipv6/ip6_output.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv6/ip6_output.c	2021-03-04 13:21:01.437505718 +0100
@@ -51,6 +51,7 @@
 #include <net/icmp.h>
 #include <net/xfrm.h>
 #include <net/checksum.h>
+#include <net/dsfield.h>
 #include <linux/mroute6.h>
 #include <net/l3mdev.h>
 #include <net/lwtunnel.h>
@@ -106,6 +107,11 @@
 			return res;
 	}
 
+#ifdef CONFIG_IPV6_FFN
+	if (skb->ffn_state == FFN_STATE_FORWARDABLE)
+		ipv6_ffn_add(skb, IPV6_FFN_FINISH_OUT);
+#endif
+
 	rcu_read_lock_bh();
 	nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
 	neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
@@ -172,6 +178,11 @@
 		return 0;
 	}
 
+#ifdef CONFIG_IP_FFN
+	if (skb->ffn_state == FFN_STATE_FAST_FORWARDED)
+		return ip6_finish_output(net, sk, skb);
+#endif
+
 	return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
 			    net, sk, skb, NULL, dev,
 			    ip6_finish_output,
@@ -565,6 +576,8 @@
 
 	hdr->hop_limit--;
 
+	skb->priority = rt_tos2priority(ipv6_get_dsfield(hdr));
+
 	return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD,
 		       net, NULL, skb, skb->dev, dst->dev,
 		       ip6_forward_finish);
diff -ruw linux-5.4.60/net/ipv6/ip6_tunnel.c linux-5.4.60-fbx/net/ipv6/ip6_tunnel.c
--- linux-5.4.60/net/ipv6/ip6_tunnel.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv6/ip6_tunnel.c	2021-03-04 13:21:01.437505718 +0100
@@ -67,9 +67,9 @@
 module_param(log_ecn_error, bool, 0644);
 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
 
-static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2)
+static u32 HASH(const struct in6_addr *addr)
 {
-	u32 hash = ipv6_addr_hash(addr1) ^ ipv6_addr_hash(addr2);
+	u32 hash = ipv6_addr_hash(addr);
 
 	return hash_32(hash, IP6_TUNNEL_HASH_SIZE_SHIFT);
 }
@@ -136,20 +136,29 @@
 static struct ip6_tnl *
 ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_addr *local)
 {
-	unsigned int hash = HASH(remote, local);
+	unsigned int hash = HASH(local);
 	struct ip6_tnl *t;
 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 	struct in6_addr any;
+	struct __ip6_tnl_fmr *fmr;
 
 	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
-		if (ipv6_addr_equal(local, &t->parms.laddr) &&
-		    ipv6_addr_equal(remote, &t->parms.raddr) &&
-		    (t->dev->flags & IFF_UP))
+		if (!ipv6_addr_equal(local, &t->parms.laddr) ||
+				!(t->dev->flags & IFF_UP))
+			continue;
+
+		if (ipv6_addr_equal(remote, &t->parms.raddr))
+			return t;
+
+		for (fmr = t->parms.fmrs; fmr; fmr = fmr->next) {
+			if (ipv6_prefix_equal(remote, &fmr->ip6_prefix,
+					fmr->ip6_prefix_len))
 			return t;
 	}
+	}
 
 	memset(&any, 0, sizeof(any));
-	hash = HASH(&any, local);
+	hash = HASH(local);
 	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
 		if (ipv6_addr_equal(local, &t->parms.laddr) &&
 		    ipv6_addr_any(&t->parms.raddr) &&
@@ -157,7 +166,7 @@
 			return t;
 	}
 
-	hash = HASH(remote, &any);
+	hash = HASH(&any);
 	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
 		if (ipv6_addr_equal(remote, &t->parms.raddr) &&
 		    ipv6_addr_any(&t->parms.laddr) &&
@@ -197,7 +206,7 @@
 
 	if (!ipv6_addr_any(remote) || !ipv6_addr_any(local)) {
 		prio = 1;
-		h = HASH(remote, local);
+		h = HASH(local);
 	}
 	return &ip6n->tnls[prio][h];
 }
@@ -378,6 +387,12 @@
 	struct net *net = t->net;
 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
+	while (t->parms.fmrs) {
+		struct __ip6_tnl_fmr *next = t->parms.fmrs->next;
+		kfree(t->parms.fmrs);
+		t->parms.fmrs = next;
+	}
+
 	if (dev == ip6n->fb_tnl_dev)
 		RCU_INIT_POINTER(ip6n->tnls_wc[0], NULL);
 	else
@@ -767,6 +782,107 @@
 }
 EXPORT_SYMBOL_GPL(ip6_tnl_rcv_ctl);
 
+/**
+ * ip4ip6_fmr_calc - calculate target / source IPv6-address based on FMR
+ *   @dest: destination IPv6 address buffer
+ *   @skb: received socket buffer
+ *   @fmr: MAP FMR
+ *   @xmit: Calculate for xmit or rcv
+ **/
+static void ip4ip6_fmr_calc(struct in6_addr *dest,
+		const struct iphdr *iph, const uint8_t *end,
+		const struct __ip6_tnl_fmr *fmr, bool xmit)
+{
+	int psidlen = fmr->ea_len - (32 - fmr->ip4_prefix_len);
+	u8 *portp = NULL;
+	bool use_dest_addr;
+	const struct iphdr *dsth = iph;
+
+	if ((u8*)dsth >= end)
+		return;
+
+	/* find significant IP header */
+	if (iph->protocol == IPPROTO_ICMP) {
+		struct icmphdr *ih = (struct icmphdr*)(((u8*)dsth) + dsth->ihl * 4);
+		if (ih && ((u8*)&ih[1]) <= end && (
+			ih->type == ICMP_DEST_UNREACH ||
+			ih->type == ICMP_SOURCE_QUENCH ||
+			ih->type == ICMP_TIME_EXCEEDED ||
+			ih->type == ICMP_PARAMETERPROB ||
+			ih->type == ICMP_REDIRECT))
+				dsth = (const struct iphdr*)&ih[1];
+	}
+
+	/* in xmit-path use dest port by default and source port only if
+		this is an ICMP reply to something else; vice versa in rcv-path */
+	use_dest_addr = (xmit && dsth == iph) || (!xmit && dsth != iph);
+
+	/* get dst port */
+	if (((u8*)&dsth[1]) <= end && (
+		dsth->protocol == IPPROTO_UDP ||
+		dsth->protocol == IPPROTO_TCP ||
+		dsth->protocol == IPPROTO_SCTP ||
+		dsth->protocol == IPPROTO_DCCP)) {
+			/* for UDP, TCP, SCTP and DCCP source and dest port
+			follow IPv4 header directly */
+			portp = ((u8*)dsth) + dsth->ihl * 4;
+
+			if (use_dest_addr)
+				portp += sizeof(u16);
+	} else if (iph->protocol == IPPROTO_ICMP) {
+		struct icmphdr *ih = (struct icmphdr*)(((u8*)dsth) + dsth->ihl * 4);
+
+		/* use icmp identifier as port */
+		if (((u8*)&ih) <= end && (
+		    (use_dest_addr && (
+		    ih->type == ICMP_ECHOREPLY ||
+			ih->type == ICMP_TIMESTAMPREPLY ||
+			ih->type == ICMP_INFO_REPLY ||
+			ih->type == ICMP_ADDRESSREPLY)) ||
+			(!use_dest_addr && (
+			ih->type == ICMP_ECHO ||
+			ih->type == ICMP_TIMESTAMP ||
+			ih->type == ICMP_INFO_REQUEST ||
+			ih->type == ICMP_ADDRESS)
+			)))
+				portp = (u8*)&ih->un.echo.id;
+	}
+
+	if ((portp && &portp[2] <= end) || psidlen == 0) {
+		int frombyte = fmr->ip6_prefix_len / 8;
+		int fromrem = fmr->ip6_prefix_len % 8;
+		int bytes = sizeof(struct in6_addr) - frombyte;
+		const u32 *addr = (use_dest_addr) ? &iph->daddr : &iph->saddr;
+		u64 eabits = ((u64)ntohl(*addr)) << (32 + fmr->ip4_prefix_len);
+		u64 t = 0;
+
+		/* extract PSID from port and add it to eabits */
+		u16 psidbits = 0;
+		if (psidlen > 0) {
+			psidbits = ((u16)portp[0]) << 8 | ((u16)portp[1]);
+			psidbits >>= 16 - psidlen - fmr->offset;
+			psidbits = (u16)(psidbits << (16 - psidlen));
+			eabits |= ((u64)psidbits) << (48 - (fmr->ea_len - psidlen));
+		}
+
+		/* rewrite destination address */
+		*dest = fmr->ip6_prefix;
+		memcpy(&dest->s6_addr[10], addr, sizeof(*addr));
+		dest->s6_addr16[7] = htons(psidbits >> (16 - psidlen));
+
+		if (bytes > sizeof(u64))
+			bytes = sizeof(u64);
+
+		/* insert eabits */
+		memcpy(&t, &dest->s6_addr[frombyte], bytes);
+		t = be64_to_cpu(t) & ~(((((u64)1) << fmr->ea_len) - 1)
+			<< (64 - fmr->ea_len - fromrem));
+		t = cpu_to_be64(t | (eabits >> fromrem));
+		memcpy(&dest->s6_addr[frombyte], &t, bytes);
+	}
+}
+
+
 static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb,
 			 const struct tnl_ptk_info *tpi,
 			 struct metadata_dst *tun_dst,
@@ -819,6 +935,27 @@
 	skb_reset_network_header(skb);
 	memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
 
+	if (tpi->proto == htons(ETH_P_IP) &&
+		!ipv6_addr_equal(&ipv6h->saddr, &tunnel->parms.raddr)) {
+			/* Packet didn't come from BR, so lookup FMR */
+			struct __ip6_tnl_fmr *fmr;
+			struct in6_addr expected = tunnel->parms.raddr;
+			for (fmr = tunnel->parms.fmrs; fmr; fmr = fmr->next)
+				if (ipv6_prefix_equal(&ipv6h->saddr,
+					&fmr->ip6_prefix, fmr->ip6_prefix_len))
+						break;
+
+			/* Check that IPv6 matches IPv4 source to prevent spoofing */
+			if (fmr)
+				ip4ip6_fmr_calc(&expected, ip_hdr(skb),
+						skb_tail_pointer(skb), fmr, false);
+
+			if (!ipv6_addr_equal(&ipv6h->saddr, &expected)) {
+				rcu_read_unlock();
+				goto drop;
+			}
+	}
+
 	__skb_tunnel_rx(skb, tunnel->dev, tunnel->net);
 
 	err = dscp_ecn_decapsulate(tunnel, ipv6h, skb);
@@ -951,6 +1088,7 @@
 	opt->ops.opt_nflen = 8;
 }
 
+
 /**
  * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
  *   @t: the outgoing tunnel device
@@ -1232,6 +1370,7 @@
 	struct ip6_tnl *t = netdev_priv(dev);
 	const struct iphdr  *iph;
 	int encap_limit = -1;
+	struct __ip6_tnl_fmr *fmr;
 	struct flowi6 fl6;
 	__u8 dsfield;
 	__u32 mtu;
@@ -1280,6 +1419,18 @@
 	fl6.flowi6_uid = sock_net_uid(dev_net(dev), NULL);
 	dsfield = INET_ECN_encapsulate(dsfield, ipv4_get_dsfield(iph));
 
+	/* try to find matching FMR */
+	for (fmr = t->parms.fmrs; fmr; fmr = fmr->next) {
+		unsigned mshift = 32 - fmr->ip4_prefix_len;
+		if (ntohl(fmr->ip4_prefix.s_addr) >> mshift ==
+				ntohl(ip_hdr(skb)->daddr) >> mshift)
+			break;
+	}
+
+	/* change dstaddr according to FMR */
+	if (fmr)
+		ip4ip6_fmr_calc(&fl6.daddr, ip_hdr(skb), skb_tail_pointer(skb), fmr, true);
+
 	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
 		return -1;
 
@@ -1497,6 +1648,14 @@
 	t->parms.link = p->link;
 	t->parms.proto = p->proto;
 	t->parms.fwmark = p->fwmark;
+
+	while (t->parms.fmrs) {
+		struct __ip6_tnl_fmr *next = t->parms.fmrs->next;
+		kfree(t->parms.fmrs);
+		t->parms.fmrs = next;
+	}
+	t->parms.fmrs = p->fmrs;
+
 	dst_cache_reset(&t->dst_cache);
 	ip6_tnl_link_config(t);
 	return 0;
@@ -1535,6 +1694,7 @@
 	p->flowinfo = u->flowinfo;
 	p->link = u->link;
 	p->proto = u->proto;
+	p->fmrs = NULL;
 	memcpy(p->name, u->name, sizeof(u->name));
 }
 
@@ -1919,13 +2079,22 @@
 	return 0;
 }
 
-static void ip6_tnl_netlink_parms(struct nlattr *data[],
+static const struct nla_policy ip6_tnl_fmr_policy[IFLA_IPTUN_FMR_MAX + 1] = {
+	[IFLA_IPTUN_FMR_IP6_PREFIX] = { .len = sizeof(struct in6_addr) },
+	[IFLA_IPTUN_FMR_IP4_PREFIX] = { .len = sizeof(struct in_addr) },
+	[IFLA_IPTUN_FMR_IP6_PREFIX_LEN] = { .type = NLA_U8 },
+	[IFLA_IPTUN_FMR_IP4_PREFIX_LEN] = { .type = NLA_U8 },
+	[IFLA_IPTUN_FMR_EA_LEN] = { .type = NLA_U8 },
+	[IFLA_IPTUN_FMR_OFFSET] = { .type = NLA_U8 }
+};
+
+static int ip6_tnl_netlink_parms(struct nlattr *data[],
 				  struct __ip6_tnl_parm *parms)
 {
 	memset(parms, 0, sizeof(*parms));
 
 	if (!data)
-		return;
+		return 0;
 
 	if (data[IFLA_IPTUN_LINK])
 		parms->link = nla_get_u32(data[IFLA_IPTUN_LINK]);
@@ -1956,6 +2125,52 @@
 
 	if (data[IFLA_IPTUN_FWMARK])
 		parms->fwmark = nla_get_u32(data[IFLA_IPTUN_FWMARK]);
+
+	if (data[IFLA_IPTUN_FMRS]) {
+		unsigned rem;
+		struct nlattr *fmr;
+
+		nla_for_each_nested(fmr, data[IFLA_IPTUN_FMRS], rem) {
+			struct nlattr *fmrd[IFLA_IPTUN_FMR_MAX + 1], *c;
+			struct __ip6_tnl_fmr *nfmr;
+			int err;
+
+			err = nla_parse_nested_deprecated(fmrd, IFLA_IPTUN_FMR_MAX,
+					       fmr, ip6_tnl_fmr_policy, NULL);
+			if (err)
+				return err;
+
+			if (!(nfmr = kzalloc(sizeof(*nfmr), GFP_KERNEL)))
+				return -ENOMEM;
+
+			nfmr->offset = 6;
+
+			if ((c = fmrd[IFLA_IPTUN_FMR_IP6_PREFIX]))
+				nla_memcpy(&nfmr->ip6_prefix, fmrd[IFLA_IPTUN_FMR_IP6_PREFIX],
+					sizeof(nfmr->ip6_prefix));
+
+			if ((c = fmrd[IFLA_IPTUN_FMR_IP4_PREFIX]))
+				nla_memcpy(&nfmr->ip4_prefix, fmrd[IFLA_IPTUN_FMR_IP4_PREFIX],
+					sizeof(nfmr->ip4_prefix));
+
+			if ((c = fmrd[IFLA_IPTUN_FMR_IP6_PREFIX_LEN]))
+				nfmr->ip6_prefix_len = nla_get_u8(c);
+
+			if ((c = fmrd[IFLA_IPTUN_FMR_IP4_PREFIX_LEN]))
+				nfmr->ip4_prefix_len = nla_get_u8(c);
+
+			if ((c = fmrd[IFLA_IPTUN_FMR_EA_LEN]))
+				nfmr->ea_len = nla_get_u8(c);
+
+			if ((c = fmrd[IFLA_IPTUN_FMR_OFFSET]))
+				nfmr->offset = nla_get_u8(c);
+
+			nfmr->next = parms->fmrs;
+			parms->fmrs = nfmr;
+		}
+	}
+
+	return 0;
 }
 
 static bool ip6_tnl_netlink_encap_parms(struct nlattr *data[],
@@ -2009,7 +2224,9 @@
 			return err;
 	}
 
-	ip6_tnl_netlink_parms(data, &nt->parms);
+	err = ip6_tnl_netlink_parms(data, &nt->parms);
+	if (err)
+		return err;
 
 	if (nt->parms.collect_md) {
 		if (rtnl_dereference(ip6n->collect_md_tun))
@@ -2036,6 +2253,7 @@
 	struct net *net = t->net;
 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 	struct ip_tunnel_encap ipencap;
+	int err;
 
 	if (dev == ip6n->fb_tnl_dev)
 		return -EINVAL;
@@ -2046,7 +2264,10 @@
 		if (err < 0)
 			return err;
 	}
-	ip6_tnl_netlink_parms(data, &p);
+	err = ip6_tnl_netlink_parms(data, &p);
+	if (err)
+		return err;
+
 	if (p.collect_md)
 		return -EINVAL;
 
@@ -2071,6 +2292,12 @@
 
 static size_t ip6_tnl_get_size(const struct net_device *dev)
 {
+	const struct ip6_tnl *t = netdev_priv(dev);
+	struct __ip6_tnl_fmr *c;
+	int fmrs = 0;
+	for (c = t->parms.fmrs; c; c = c->next)
+		++fmrs;
+
 	return
 		/* IFLA_IPTUN_LINK */
 		nla_total_size(4) +
@@ -2100,6 +2327,24 @@
 		nla_total_size(0) +
 		/* IFLA_IPTUN_FWMARK */
 		nla_total_size(4) +
+		/* IFLA_IPTUN_FMRS */
+		nla_total_size(0) +
+		(
+			/* nest */
+			nla_total_size(0) +
+			/* IFLA_IPTUN_FMR_IP6_PREFIX */
+			nla_total_size(sizeof(struct in6_addr)) +
+			/* IFLA_IPTUN_FMR_IP4_PREFIX */
+			nla_total_size(sizeof(struct in_addr)) +
+			/* IFLA_IPTUN_FMR_EA_LEN */
+			nla_total_size(1) +
+			/* IFLA_IPTUN_FMR_IP6_PREFIX_LEN */
+			nla_total_size(1) +
+			/* IFLA_IPTUN_FMR_IP4_PREFIX_LEN */
+			nla_total_size(1) +
+			/* IFLA_IPTUN_FMR_OFFSET */
+			nla_total_size(1)
+		) * fmrs +
 		0;
 }
 
@@ -2107,6 +2352,9 @@
 {
 	struct ip6_tnl *tunnel = netdev_priv(dev);
 	struct __ip6_tnl_parm *parm = &tunnel->parms;
+	struct __ip6_tnl_fmr *c;
+	int fmrcnt = 0;
+	struct nlattr *fmrs;
 
 	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
 	    nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
@@ -2116,9 +2364,27 @@
 	    nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
 	    nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
 	    nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->proto) ||
-	    nla_put_u32(skb, IFLA_IPTUN_FWMARK, parm->fwmark))
+	    nla_put_u32(skb, IFLA_IPTUN_FWMARK, parm->fwmark) ||
+	    !(fmrs = nla_nest_start_noflag(skb, IFLA_IPTUN_FMRS)))
 		goto nla_put_failure;
 
+	for (c = parm->fmrs; c; c = c->next) {
+		struct nlattr *fmr = nla_nest_start_noflag(skb, ++fmrcnt);
+		if (!fmr ||
+			nla_put(skb, IFLA_IPTUN_FMR_IP6_PREFIX,
+				sizeof(c->ip6_prefix), &c->ip6_prefix) ||
+			nla_put(skb, IFLA_IPTUN_FMR_IP4_PREFIX,
+				sizeof(c->ip4_prefix), &c->ip4_prefix) ||
+			nla_put_u8(skb, IFLA_IPTUN_FMR_IP6_PREFIX_LEN, c->ip6_prefix_len) ||
+			nla_put_u8(skb, IFLA_IPTUN_FMR_IP4_PREFIX_LEN, c->ip4_prefix_len) ||
+			nla_put_u8(skb, IFLA_IPTUN_FMR_EA_LEN, c->ea_len) ||
+			nla_put_u8(skb, IFLA_IPTUN_FMR_OFFSET, c->offset))
+				goto nla_put_failure;
+
+		nla_nest_end(skb, fmr);
+	}
+	nla_nest_end(skb, fmrs);
+
 	if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE, tunnel->encap.type) ||
 	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT, tunnel->encap.sport) ||
 	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT, tunnel->encap.dport) ||
@@ -2158,6 +2424,7 @@
 	[IFLA_IPTUN_ENCAP_DPORT]	= { .type = NLA_U16 },
 	[IFLA_IPTUN_COLLECT_METADATA]	= { .type = NLA_FLAG },
 	[IFLA_IPTUN_FWMARK]		= { .type = NLA_U32 },
+	[IFLA_IPTUN_FMRS]		= { .type = NLA_NESTED },
 };
 
 static struct rtnl_link_ops ip6_link_ops __read_mostly = {
diff -ruw linux-5.4.60/net/ipv6/Makefile linux-5.4.60-fbx/net/ipv6/Makefile
--- linux-5.4.60/net/ipv6/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv6/Makefile	2021-03-04 13:21:01.434172386 +0100
@@ -15,6 +15,7 @@
 ipv6-offload :=	ip6_offload.o tcpv6_offload.o exthdrs_offload.o
 
 ipv6-$(CONFIG_SYSCTL) = sysctl_net_ipv6.o
+ipv6-$(CONFIG_IPV6_FFN) += ip6_ffn.o
 ipv6-$(CONFIG_IPV6_MROUTE) += ip6mr.o
 
 ipv6-$(CONFIG_XFRM) += xfrm6_policy.o xfrm6_state.o xfrm6_input.o \
diff -ruw linux-5.4.60/net/ipv6/netfilter/ip6_tables.c linux-5.4.60-fbx/net/ipv6/netfilter/ip6_tables.c
--- linux-5.4.60/net/ipv6/netfilter/ip6_tables.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv6/netfilter/ip6_tables.c	2021-03-04 13:21:01.440839052 +0100
@@ -1158,6 +1158,10 @@
 			   tmp.num_counters, tmp.counters);
 	if (ret)
 		goto free_newinfo_untrans;
+
+#ifdef CONFIG_IPV6_FFN
+	ipv6_ffn_flush_all();
+#endif
 	return 0;
 
  free_newinfo_untrans:
diff -ruw linux-5.4.60/net/ipv6/netfilter/Kconfig linux-5.4.60-fbx/net/ipv6/netfilter/Kconfig
--- linux-5.4.60/net/ipv6/netfilter/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv6/netfilter/Kconfig	2021-03-04 13:21:01.440839052 +0100
@@ -6,6 +6,13 @@
 menu "IPv6: Netfilter Configuration"
 	depends on INET && IPV6 && NETFILTER
 
+config IPV6_FFN
+	bool "IPv6: Fast forwarding and NAT"
+
+config IPV6_FFN_PROCFS
+	bool "IPv6: Fast forwarding and NAT /proc/net entries"
+	depends on IPV6_FFN
+
 config NF_SOCKET_IPV6
 	tristate "IPv6 socket lookup support"
 	help
diff -ruw linux-5.4.60/net/ipv6/udp.c linux-5.4.60-fbx/net/ipv6/udp.c
--- linux-5.4.60/net/ipv6/udp.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/ipv6/udp.c	2021-03-04 13:21:01.444172385 +0100
@@ -743,6 +743,82 @@
  * Note: called only from the BH handler context,
  * so we don't need to lock the hashes.
  */
+static int __udp6_lib_uc_conflict_deliver(struct net *net, struct sk_buff *skb,
+		const struct in6_addr *saddr, const struct in6_addr *daddr,
+		struct udp_table *udptable, int proto)
+{
+	struct sock *sk, *first = NULL;
+	const struct udphdr *uh = udp_hdr(skb);
+	unsigned short hnum = ntohs(uh->dest);
+	struct udp_hslot *hslot = udp_hashslot(udptable, net, hnum);
+	unsigned int offset = offsetof(typeof(*sk), sk_node);
+	int dif = inet6_iif(skb);
+	int sdif = inet6_sdif(skb);
+	struct hlist_node *node;
+	struct sk_buff *nskb;
+	bool found_non_dup;
+
+	found_non_dup = false;
+	sk_for_each_entry_offset_rcu(sk, node, &hslot->head, offset) {
+		bool need_deliver;
+
+		if (!__udp_v6_is_mcast_sock(net, sk, uh->dest, daddr,
+					    uh->source, saddr, dif, sdif, hnum))
+
+			continue;
+
+		/* If zero checksum and no_check is not on for
+		 * the socket then skip it.
+		 */
+		if (!uh->check && !udp_sk(sk)->no_check6_rx)
+			continue;
+
+		if (sock_flag(sk, SOCK_UDP_DUP_UNICAST))
+			need_deliver = true;
+		else {
+			if (!found_non_dup)
+				need_deliver = true;
+			else
+				need_deliver = false;
+			found_non_dup = true;
+		}
+
+		if (!need_deliver)
+			continue;
+
+		if (!first) {
+			first = sk;
+			continue;
+		}
+		nskb = skb_clone(skb, GFP_ATOMIC);
+		if (unlikely(!nskb)) {
+			atomic_inc(&sk->sk_drops);
+			__UDP6_INC_STATS(net, UDP_MIB_RCVBUFERRORS,
+					 IS_UDPLITE(sk));
+			__UDP6_INC_STATS(net, UDP_MIB_INERRORS,
+					 IS_UDPLITE(sk));
+			continue;
+		}
+
+		if (udpv6_queue_rcv_skb(sk, nskb) > 0)
+			consume_skb(nskb);
+	}
+
+	if (first) {
+		if (udpv6_queue_rcv_skb(first, skb) > 0)
+			consume_skb(skb);
+	} else {
+		kfree_skb(skb);
+		__UDP6_INC_STATS(net, UDP_MIB_IGNOREDMULTI,
+				 proto == IPPROTO_UDPLITE);
+	}
+	return 0;
+}
+
+/*
+ * Note: called only from the BH handler context,
+ * so we don't need to lock the hashes.
+ */
 static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
 		const struct in6_addr *saddr, const struct in6_addr *daddr,
 		struct udp_table *udptable, int proto)
@@ -913,6 +989,12 @@
 	if (sk) {
 		if (!uh->check && !udp_sk(sk)->no_check6_rx)
 			goto report_csum_error;
+
+		if (sk->sk_reuse_conflict)
+			return __udp6_lib_uc_conflict_deliver(net, skb,
+						      saddr, daddr,
+						      udptable, proto);
+
 		return udp6_unicast_rcv_skb(sk, skb, uh);
 	}
 
diff -ruw linux-5.4.60/net/Kconfig linux-5.4.60-fbx/net/Kconfig
--- linux-5.4.60/net/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/Kconfig	2021-03-04 13:21:01.370839049 +0100
@@ -60,6 +60,20 @@
 
 menu "Networking options"
 
+config NETSKBPAD
+	int "Size reserved by dev_alloc_skb"
+	default 32
+
+config NETRXTHREAD
+	bool "Do rx network processing in kernel thread"
+	depends on BROKEN_ON_SMP
+
+config NETRXTHREAD_RX_QUEUE
+	int "Number of rx queues"
+	default 1
+	depends on NETRXTHREAD
+
+source "net/nmesh-mbh/Kconfig"
 source "net/packet/Kconfig"
 source "net/unix/Kconfig"
 source "net/tls/Kconfig"
@@ -216,6 +230,8 @@
 source "net/tipc/Kconfig"
 source "net/atm/Kconfig"
 source "net/l2tp/Kconfig"
+source "net/fbxatm/Kconfig"
+source "net/fbxbridge/Kconfig"
 source "net/802/Kconfig"
 source "net/bridge/Kconfig"
 source "net/dsa/Kconfig"
diff -ruw linux-5.4.60/net/mac80211/agg-tx.c linux-5.4.60-fbx/net/mac80211/agg-tx.c
--- linux-5.4.60/net/mac80211/agg-tx.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/agg-tx.c	2021-03-04 13:21:01.447505719 +0100
@@ -139,6 +139,14 @@
 }
 EXPORT_SYMBOL(ieee80211_send_bar);
 
+void ieee80211_send_bar_sta(struct ieee80211_sta *pubsta,
+			    u16 tid, u16 ssn)
+{
+	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
+	ieee80211_send_bar(&sta->sdata->vif, pubsta->addr, tid, ssn);
+}
+EXPORT_SYMBOL(ieee80211_send_bar_sta);
+
 void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
 			     struct tid_ampdu_tx *tid_tx)
 {
@@ -290,7 +298,6 @@
 	ieee80211_assign_tid_tx(sta, tid, NULL);
 
 	ieee80211_agg_splice_finish(sta->sdata, tid);
-	ieee80211_agg_start_txq(sta, tid, false);
 
 	kfree_rcu(tid_tx, rcu_head);
 }
@@ -860,6 +867,7 @@
 {
 	struct ieee80211_sub_if_data *sdata = sta->sdata;
 	bool send_delba = false;
+	bool stop_txq = false;
 
 	ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n",
 	       sta->sta.addr, tid);
@@ -877,9 +885,12 @@
 		send_delba = true;
 
 	ieee80211_remove_tid_tx(sta, tid);
+	stop_txq = true;
 
  unlock_sta:
 	spin_unlock_bh(&sta->lock);
+	if (stop_txq)
+		ieee80211_agg_start_txq(sta, tid, false);
 
 	if (send_delba)
 		ieee80211_send_delba(sdata, sta->sta.addr, tid,
diff -ruw linux-5.4.60/net/mac80211/cfg.c linux-5.4.60-fbx/net/mac80211/cfg.c
--- linux-5.4.60/net/mac80211/cfg.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/cfg.c	2021-03-04 13:21:01.450839053 +0100
@@ -1926,6 +1926,59 @@
 	return 0;
 }
 
+static int ieee80211_update_mpp(struct wiphy *wiphy, struct net_device *dev,
+			       const u8 *dst, const u8 *next_hop)
+{
+	struct ieee80211_sub_if_data *sdata;
+	int ret = 0;
+	struct mesh_path *mppath;
+
+	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+	rcu_read_lock();
+
+	mppath = mpp_path_lookup(sdata, dst);
+	if (!mppath) {
+		ret = mpp_path_add(sdata, dst, next_hop);
+		if (!ret) {
+			mppath = mpp_path_lookup(sdata, dst);
+			spin_lock_bh(&mppath->state_lock);
+			mppath->flags |= MESH_PATH_FIXED;
+			spin_unlock_bh(&mppath->state_lock);
+		}
+	} else {
+		spin_lock_bh(&mppath->state_lock);
+		if (!ether_addr_equal(mppath->mpp, next_hop))
+			memcpy(mppath->mpp, next_hop, ETH_ALEN);
+		mppath->exp_time = jiffies;
+		mppath->flags |= MESH_PATH_FIXED;
+		spin_unlock_bh(&mppath->state_lock);
+	}
+	rcu_read_unlock();
+	return ret;
+}
+
+static int ieee80211_delete_mpp(struct wiphy *wiphy, struct net_device *dev,
+			       const u8 *dst)
+{
+	struct ieee80211_sub_if_data *sdata;
+	int ret = 0;
+	struct mesh_path *mppath;
+
+	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+	rcu_read_lock();
+	mppath = mpp_path_lookup(sdata, dst);
+	if (mppath) {
+		spin_lock_bh(&mppath->state_lock);
+		mppath->flags &= ~MESH_PATH_FIXED;
+		spin_unlock_bh(&mppath->state_lock);
+	} else {
+		ret = -ENOENT;
+	}
+	rcu_read_unlock();
+	return ret;
+}
+
 static int ieee80211_get_mesh_config(struct wiphy *wiphy,
 				struct net_device *dev,
 				struct mesh_config *conf)
@@ -2104,6 +2157,36 @@
 	return 0;
 }
 
+static int ieee80211_update_mesh_vendor_node_metrics_ie(struct wiphy *wiphy,
+							struct net_device *dev,
+							const struct mesh_vendor_ie *vendor_ie)
+{
+	struct ieee80211_sub_if_data *sdata;
+	struct ieee80211_if_mesh *ifmsh;
+
+	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+	ifmsh = &sdata->u.mesh;
+	memcpy(ifmsh->node_vendor_ie, vendor_ie->ie, vendor_ie->ie_len);
+	ifmsh->node_vendor_ie_len = vendor_ie->ie_len;
+	ieee80211_mbss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+	return 0;
+}
+
+static int ieee80211_update_mesh_vendor_path_metrics_ie(struct wiphy *wiphy,
+							struct net_device *dev,
+							const struct mesh_vendor_ie *vendor_ie)
+{
+	struct ieee80211_sub_if_data *sdata;
+	struct ieee80211_if_mesh *ifmsh;
+
+	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+	ifmsh = &sdata->u.mesh;
+	memcpy(ifmsh->mpm_vendor_ie, vendor_ie->ie, vendor_ie->ie_len);
+	ifmsh->mpm_vendor_ie_len = vendor_ie->ie_len;
+	ieee80211_mbss_info_change_notify(sdata, BSS_CHANGED_BEACON);
+	return 0;
+}
+
 static int ieee80211_join_mesh(struct wiphy *wiphy, struct net_device *dev,
 			       const struct mesh_config *conf,
 			       const struct mesh_setup *setup)
@@ -2127,8 +2210,10 @@
 	err = ieee80211_vif_use_channel(sdata, &setup->chandef,
 					IEEE80211_CHANCTX_SHARED);
 	mutex_unlock(&sdata->local->mtx);
-	if (err)
+	if (err) {
+		kfree(ifmsh->ie);
 		return err;
+	}
 
 	return ieee80211_start_mesh(sdata);
 }
@@ -3993,10 +4078,14 @@
 	.dump_mpath = ieee80211_dump_mpath,
 	.get_mpp = ieee80211_get_mpp,
 	.dump_mpp = ieee80211_dump_mpp,
+	.update_mpp = ieee80211_update_mpp,
+	.delete_mpp = ieee80211_delete_mpp,
 	.update_mesh_config = ieee80211_update_mesh_config,
 	.get_mesh_config = ieee80211_get_mesh_config,
 	.join_mesh = ieee80211_join_mesh,
 	.leave_mesh = ieee80211_leave_mesh,
+	.update_mesh_vendor_node_metrics_ie = ieee80211_update_mesh_vendor_node_metrics_ie,
+	.update_mesh_vendor_path_metrics_ie = ieee80211_update_mesh_vendor_path_metrics_ie,
 #endif
 	.join_ocb = ieee80211_join_ocb,
 	.leave_ocb = ieee80211_leave_ocb,
diff -ruw linux-5.4.60/net/mac80211/driver-ops.c linux-5.4.60-fbx/net/mac80211/driver-ops.c
--- linux-5.4.60/net/mac80211/driver-ops.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/driver-ops.c	2021-03-04 13:21:01.450839053 +0100
@@ -49,6 +49,30 @@
 	local->started = false;
 }
 
+int drv_get_powered(struct ieee80211_local *local, bool *up, bool *busy)
+{
+	int ret = -EOPNOTSUPP;
+
+	might_sleep();
+
+	if (local->ops->get_powered)
+		ret = local->ops->get_powered(&local->hw, up, busy);
+
+	return ret;
+}
+
+int drv_set_powered(struct ieee80211_local *local)
+{
+	int ret = -EOPNOTSUPP;
+
+	might_sleep();
+
+	if (local->ops->set_powered)
+		ret = local->ops->set_powered(&local->hw);
+
+	return ret;
+}
+
 int drv_add_interface(struct ieee80211_local *local,
 		      struct ieee80211_sub_if_data *sdata)
 {
diff -ruw linux-5.4.60/net/mac80211/driver-ops.h linux-5.4.60-fbx/net/mac80211/driver-ops.h
--- linux-5.4.60/net/mac80211/driver-ops.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/driver-ops.h	2021-03-04 13:21:01.450839053 +0100
@@ -85,6 +85,8 @@
 
 int drv_start(struct ieee80211_local *local);
 void drv_stop(struct ieee80211_local *local);
+int drv_get_powered(struct ieee80211_local *local, bool *up, bool *busy);
+int drv_set_powered(struct ieee80211_local *local);
 
 #ifdef CONFIG_PM
 static inline int drv_suspend(struct ieee80211_local *local,
diff -ruw linux-5.4.60/net/mac80211/ethtool.c linux-5.4.60-fbx/net/mac80211/ethtool.c
--- linux-5.4.60/net/mac80211/ethtool.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/ethtool.c	2021-03-04 13:21:01.450839053 +0100
@@ -46,6 +46,22 @@
 };
 #define STA_STATS_LEN	ARRAY_SIZE(ieee80211_gstrings_sta_stats)
 
+struct ethtool_priv_flags_strings {
+	const char string[ETH_GSTRING_LEN];
+};
+
+enum {
+	POWERED_SUPPORTED	= (1 << 0),
+	POWERED_STATUS		= (1 << 1),
+	POWERED_CHANGE_BUSY	= (1 << 2),
+};
+
+static const struct ethtool_priv_flags_strings ieee80211_pflags_strings[] = {
+	{ .string = "powered-supported" },
+	{ .string = "powered-status" },
+	{ .string = "powered-change-busy", },
+};
+
 static int ieee80211_get_sset_count(struct net_device *dev, int sset)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -56,6 +72,9 @@
 
 	rv += drv_get_et_sset_count(sdata, sset);
 
+	if (sset == ETH_SS_PRIV_FLAGS)
+		rv += ARRAY_SIZE(ieee80211_pflags_strings);
+
 	if (rv == 0)
 		return -EOPNOTSUPP;
 	return rv;
@@ -212,6 +231,9 @@
 		memcpy(data, ieee80211_gstrings_sta_stats, sz_sta_stats);
 	}
 	drv_get_et_strings(sdata, sset, &(data[sz_sta_stats]));
+	if (sset == ETH_SS_PRIV_FLAGS)
+		memcpy(data, ieee80211_pflags_strings,
+		       sizeof (ieee80211_pflags_strings));
 }
 
 static int ieee80211_get_regs_len(struct net_device *dev)
@@ -229,6 +251,35 @@
 	regs->len = 0;
 }
 
+static u32 ieee80211_get_priv_flags(struct net_device *dev)
+{
+	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+	struct ieee80211_local *local = sdata->local;
+	bool powered, powered_busy;
+	u32 ret;
+
+	ret = 0;
+	if (!drv_get_powered(local, &powered, &powered_busy)) {
+		ret |= POWERED_SUPPORTED;
+		if (powered)
+			ret |= POWERED_STATUS;
+		if (powered_busy)
+			ret |= POWERED_CHANGE_BUSY;
+	}
+	return ret;
+}
+
+static int ieee80211_set_priv_flags(struct net_device *dev, u32 flags)
+{
+	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+	struct ieee80211_local *local = sdata->local;
+
+	if (flags & (POWERED_STATUS))
+		return drv_set_powered(local);
+
+	return 0;
+}
+
 const struct ethtool_ops ieee80211_ethtool_ops = {
 	.get_drvinfo = cfg80211_get_drvinfo,
 	.get_regs_len = ieee80211_get_regs_len,
@@ -239,4 +290,6 @@
 	.get_strings = ieee80211_get_strings,
 	.get_ethtool_stats = ieee80211_get_stats,
 	.get_sset_count = ieee80211_get_sset_count,
+	.set_priv_flags	= ieee80211_set_priv_flags,
+	.get_priv_flags	= ieee80211_get_priv_flags,
 };
diff -ruw linux-5.4.60/net/mac80211/ieee80211_i.h linux-5.4.60-fbx/net/mac80211/ieee80211_i.h
--- linux-5.4.60/net/mac80211/ieee80211_i.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/ieee80211_i.h	2021-03-04 13:21:01.450839053 +0100
@@ -721,6 +721,13 @@
 	struct mesh_table *mpp_paths; /* Store paths for MPP&MAP */
 	int mesh_paths_generation;
 	int mpp_paths_generation;
+
+	/* Store Vendor specific node metrics IE */
+	u8 node_vendor_ie[260];
+	u8 node_vendor_ie_len;
+	/* Store Vendor specific mesh path metrics IE */
+	u8 mpm_vendor_ie[260];
+	u8 mpm_vendor_ie_len;
 };
 
 #ifdef CONFIG_MAC80211_MESH
@@ -1532,6 +1539,13 @@
 	bool parse_error;
 };
 
+struct ieee802_11_mesh_vendor_specific_elems {
+	const u8 *ie_start;
+	u8 ie_len;
+	/* whether a parse error occurred while retrieving these elements */
+	bool parse_error;
+};
+
 static inline struct ieee80211_local *hw_to_local(
 	struct ieee80211_hw *hw)
 {
@@ -1983,6 +1997,9 @@
 			       struct ieee802_11_elems *elems,
 			       u64 filter, u32 crc, u8 *transmitter_bssid,
 			       u8 *bss_bssid);
+u32 ieee802_11_parse_mesh_vendor_elems(const u8 *start, size_t len, bool action,
+				       struct ieee802_11_mesh_vendor_specific_elems *elems,
+				       u64 filter, u32 crc, u8 type);
 static inline void ieee802_11_parse_elems(const u8 *start, size_t len,
 					  bool action,
 					  struct ieee802_11_elems *elems,
diff -ruw linux-5.4.60/net/mac80211/key.c linux-5.4.60-fbx/net/mac80211/key.c
--- linux-5.4.60/net/mac80211/key.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/key.c	2021-03-04 13:21:01.450839053 +0100
@@ -172,6 +172,12 @@
 		 * Hence, don't send GTKs for VLAN interfaces to the driver.
 		 */
 		if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+			if (ieee80211_hw_check(&key->local->hw,
+					       APVLAN_NEED_MCAST_TO_UCAST)) {
+				/* no need to fail, this key will
+				 * never be used */
+				return 0;
+			}
 			ret = 1;
 			goto out_unsupported;
 		}
diff -ruw linux-5.4.60/net/mac80211/mesh.c linux-5.4.60-fbx/net/mac80211/mesh.c
--- linux-5.4.60/net/mac80211/mesh.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/mesh.c	2021-03-30 15:48:29.608385862 +0200
@@ -338,20 +338,31 @@
 	u8 offset, len;
 	const u8 *data;
 
-	if (!ifmsh->ie || !ifmsh->ie_len)
-		return 0;
 
 	/* fast-forward to vendor IEs */
-	offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0);
+	if (ifmsh->node_vendor_ie_len) {
+		offset = ieee80211_ie_split_vendor(ifmsh->node_vendor_ie, ifmsh->node_vendor_ie_len, 0);
 
-	if (offset < ifmsh->ie_len) {
-		len = ifmsh->ie_len - offset;
-		data = ifmsh->ie + offset;
+		if (offset < ifmsh->node_vendor_ie_len) {
+			len = ifmsh->node_vendor_ie_len - offset;
+			data = ifmsh->node_vendor_ie + offset;
 		if (skb_tailroom(skb) < len)
 			return -ENOMEM;
 		skb_put_data(skb, data, len);
 	}
+	}
 
+	if (ifmsh->mpm_vendor_ie_len) {
+		offset = ieee80211_ie_split_vendor(ifmsh->mpm_vendor_ie, ifmsh->mpm_vendor_ie_len, 0);
+
+		if (offset < ifmsh->mpm_vendor_ie_len) {
+			len = ifmsh->mpm_vendor_ie_len - offset;
+			data = ifmsh->mpm_vendor_ie + offset;
+			if (skb_tailroom(skb) < len)
+				return -ENOMEM;
+			skb_put_data(skb, data, len);
+		}
+	}
 	return 0;
 }
 
@@ -766,7 +777,9 @@
 		   2 + sizeof(struct ieee80211_vht_operation) +
 		   ie_len_he_cap +
 		   2 + 1 + sizeof(struct ieee80211_he_operation) +
-		   ifmsh->ie_len;
+		   ifmsh->ie_len +
+		   ifmsh->node_vendor_ie_len +
+		   ifmsh->mpm_vendor_ie_len;
 
 	bcn = kzalloc(sizeof(*bcn) + head_len + tail_len, GFP_KERNEL);
 	/* need an skb for IE builders to operate on */
@@ -1220,12 +1233,18 @@
 	size_t baselen;
 	int freq;
 	enum nl80211_band band = rx_status->band;
+	struct ieee802_11_mesh_vendor_specific_elems velems;
+	u32 beacon_int;
+	bool is_neigh_conn_estab;
 
 	/* ignore ProbeResp to foreign address */
 	if (stype == IEEE80211_STYPE_PROBE_RESP &&
 	    !ether_addr_equal(mgmt->da, sdata->vif.addr))
 		return;
 
+	if (stype == IEEE80211_STYPE_BEACON)
+		beacon_int = mgmt->u.beacon.beacon_int;
+
 	baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
 	if (baselen > len)
 		return;
@@ -1252,6 +1271,37 @@
 	if (mesh_matches_local(sdata, &elems)) {
 		mpl_dbg(sdata, "rssi_threshold=%d,rx_status->signal=%d\n",
 			sdata->u.mesh.mshcfg.rssi_threshold, rx_status->signal);
+		is_neigh_conn_estab = mesh_neighbour_connection_established(sdata, mgmt->sa, rx_status);
+		ieee802_11_parse_mesh_vendor_elems(mgmt->u.probe_resp.variable,
+						   len - baselen,
+						   false, &velems, 0, 0,
+						   NL80211_QBC_UPDATE_NODE_METRICS_IE);
+
+		if (velems.parse_error	== false) {
+			if (is_neigh_conn_estab)
+				cfg80211_notify_mesh_peer_node_metrics(sdata->dev, mgmt->sa, stype,
+								       rx_status->signal,
+								       beacon_int,
+								       velems.ie_start,
+								       velems.ie_len,
+								       GFP_KERNEL);
+		elems.total_len -= (velems.ie_len + 2);
+	}
+
+	ieee802_11_parse_mesh_vendor_elems(mgmt->u.probe_resp.variable,
+					   len - baselen,
+					   false, &velems, 0, 0,
+					   NL80211_QBC_UPDATE_PATH_METRICS_IE);
+		if (velems.parse_error	== false) {
+			if (is_neigh_conn_estab)
+				cfg80211_notify_mesh_peer_path_metrics(sdata->dev, mgmt->sa,
+								       velems.ie_start,
+								       velems.ie_len,
+								       GFP_KERNEL);
+
+			elems.total_len -= (velems.ie_len + 2);
+		}
+
 		if (!sdata->u.mesh.user_mpm ||
 		    sdata->u.mesh.mshcfg.rssi_threshold == 0 ||
 		    sdata->u.mesh.mshcfg.rssi_threshold < rx_status->signal)
@@ -1362,11 +1412,20 @@
 	bool fwd_csa = true;
 	size_t baselen;
 	u8 *pos;
+	struct sta_info *sta = NULL;
 
 	if (mgmt->u.action.u.measurement.action_code !=
 	    WLAN_ACTION_SPCT_CHL_SWITCH)
 		return;
 
+	/* Process action frames received from connected mesh nodes */
+	rcu_read_lock();
+	sta = sta_info_get(sdata, mgmt->bssid);
+	if (!sta) {
+		rcu_read_unlock();
+		return;
+	}
+	rcu_read_unlock();
 	pos = mgmt->u.action.u.chan_switch.variable;
 	baselen = offsetof(struct ieee80211_mgmt,
 			   u.action.u.chan_switch.variable);
diff -ruw linux-5.4.60/net/mac80211/mesh.h linux-5.4.60-fbx/net/mac80211/mesh.h
--- linux-5.4.60/net/mac80211/mesh.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/mesh.h	2021-03-30 15:48:29.608385862 +0200
@@ -297,7 +297,9 @@
 			 struct ieee80211_mgmt *mgmt, size_t len,
 			 struct ieee80211_rx_status *rx_status);
 void mesh_sta_cleanup(struct sta_info *sta);
-
+bool mesh_neighbour_connection_established(struct ieee80211_sub_if_data *sdata,
+					   u8 *hw_addr,
+					   struct ieee80211_rx_status *rx_status);
 /* Private interfaces */
 /* Mesh paths */
 int mesh_path_error_tx(struct ieee80211_sub_if_data *sdata,
diff -ruw linux-5.4.60/net/mac80211/mesh_plink.c linux-5.4.60-fbx/net/mac80211/mesh_plink.c
--- linux-5.4.60/net/mac80211/mesh_plink.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/mesh_plink.c	2021-03-30 15:48:29.608385862 +0200
@@ -1226,3 +1226,32 @@
 			       mgmt->bssid, NULL);
 	mesh_process_plink_frame(sdata, mgmt, &elems, rx_status);
 }
+
+/*
+ * mesh_neighbour_connection_established - return if connection has been established with  neighbor.
+ *
+ * @sdata: local meshif
+ * @addr: peer's address
+ * @elems: IEs from beacon or mesh peering frame
+ *
+ *
+ */
+bool mesh_neighbour_connection_established(struct ieee80211_sub_if_data *sdata,
+					   u8 *hw_addr,
+					   struct ieee80211_rx_status *rx_status)
+{
+	struct sta_info *sta;
+	bool ret = false;
+
+	rcu_read_lock();
+	sta = sta_info_get(sdata, hw_addr);
+	if (!sta)
+		goto out;
+
+	if (sta->mesh->plink_state == NL80211_PLINK_ESTAB)
+		ret = true;
+
+out:
+	rcu_read_unlock();
+	return ret;
+}
diff -ruw linux-5.4.60/net/mac80211/rx.c linux-5.4.60-fbx/net/mac80211/rx.c
--- linux-5.4.60/net/mac80211/rx.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/rx.c	2021-03-04 13:21:01.454172386 +0100
@@ -2756,9 +2756,11 @@
 			mpp_path_add(sdata, proxied_addr, mpp_addr);
 		} else {
 			spin_lock_bh(&mppath->state_lock);
-			if (!ether_addr_equal(mppath->mpp, mpp_addr))
+			if (!ether_addr_equal(mppath->mpp, mpp_addr) &&
+			    !(mppath->flags & MESH_PATH_FIXED)) {
 				memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
 			mppath->exp_time = jiffies;
+			}
 			spin_unlock_bh(&mppath->state_lock);
 		}
 		rcu_read_unlock();
@@ -2823,6 +2825,7 @@
 	}
 
 	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
+	fwd_skb->dev = sdata->dev;
 	ieee80211_add_pending_skb(local, fwd_skb);
  out:
 	if (is_multicast_ether_addr(hdr->addr1))
@@ -4577,7 +4580,7 @@
 	 * The same happens when we're not even started,
 	 * but that's worth a warning.
 	 */
-	if (WARN_ON(!local->started))
+	if (!local->started)
 		goto drop;
 
 	if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
diff -ruw linux-5.4.60/net/mac80211/sta_info.c linux-5.4.60-fbx/net/mac80211/sta_info.c
--- linux-5.4.60/net/mac80211/sta_info.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/sta_info.c	2021-03-04 13:21:01.454172386 +0100
@@ -277,9 +277,10 @@
 		return;
 
 	local_bh_disable();
-	if (!test_sta_flag(sta, WLAN_STA_PS_STA))
+	if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
+		if (test_sta_flag(sta, WLAN_STA_PS_DELIVER))
 		ieee80211_sta_ps_deliver_wakeup(sta);
-	else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL))
+	} else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL))
 		ieee80211_sta_ps_deliver_poll_response(sta);
 	else if (test_and_clear_sta_flag(sta, WLAN_STA_UAPSD))
 		ieee80211_sta_ps_deliver_uapsd(sta);
diff -ruw linux-5.4.60/net/mac80211/status.c linux-5.4.60-fbx/net/mac80211/status.c
--- linux-5.4.60/net/mac80211/status.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/status.c	2021-03-04 13:21:01.457505719 +0100
@@ -876,13 +876,15 @@
 	struct ieee80211_bar *bar;
 	int shift = 0;
 	int tid = IEEE80211_NUM_TIDS;
+	bool ack_requested;
 
 	rates_idx = ieee80211_tx_get_rates(hw, info, &retry_count);
 
+	ack_requested = !(info->flags & IEEE80211_TX_CTL_NO_ACK);
 	sband = local->hw.wiphy->bands[info->band];
 	fc = hdr->frame_control;
 
-	if (status->sta) {
+	if (status->sta && ack_requested) {
 		sta = container_of(status->sta, struct sta_info, sta);
 		shift = ieee80211_vif_get_shift(&sta->sdata->vif);
 
@@ -1101,6 +1103,7 @@
 	struct ieee80211_supported_band *sband;
 	int retry_count;
 	bool acked, noack_success;
+	bool ack_requested;
 
 	if (status->skb)
 		return __ieee80211_tx_status(hw, status);
@@ -1112,10 +1115,11 @@
 
 	sband = hw->wiphy->bands[info->band];
 
+	ack_requested = !(info->flags & IEEE80211_TX_CTL_NO_ACK);
 	acked = !!(info->flags & IEEE80211_TX_STAT_ACK);
 	noack_success = !!(info->flags & IEEE80211_TX_STAT_NOACK_TRANSMITTED);
 
-	if (pubsta) {
+	if (pubsta && ack_requested) {
 		struct sta_info *sta;
 
 		sta = container_of(pubsta, struct sta_info, sta);
diff -ruw linux-5.4.60/net/mac80211/tx.c linux-5.4.60-fbx/net/mac80211/tx.c
--- linux-5.4.60/net/mac80211/tx.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/tx.c	2021-03-04 13:21:01.457505719 +0100
@@ -1256,6 +1256,9 @@
 	    (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE))
 		return NULL;
 
+	if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
+		return NULL;
+
 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) {
 		if ((!ieee80211_is_mgmt(hdr->frame_control) ||
 		     ieee80211_is_bufferable_mmpdu(hdr->frame_control) ||
@@ -3961,6 +3964,9 @@
 			return false;
 		if (sdata->wdev.use_4addr)
 			return false;
+		if (ieee80211_hw_check(&sdata->local->hw,
+				       APVLAN_NEED_MCAST_TO_UCAST))
+			break;
 		/* fall through */
 	case NL80211_IFTYPE_AP:
 		/* check runtime toggle for this bss */
diff -ruw linux-5.4.60/net/mac80211/util.c linux-5.4.60-fbx/net/mac80211/util.c
--- linux-5.4.60/net/mac80211/util.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/mac80211/util.c	2021-03-04 13:21:01.457505719 +0100
@@ -250,7 +250,8 @@
 	local_bh_disable();
 	spin_lock(&fq->lock);
 
-	if (sdata->vif.type == NL80211_IFTYPE_AP)
+	if ((sdata->vif.type == NL80211_IFTYPE_AP) &&
+	    ieee80211_sdata_running(sdata))
 		ps = &sdata->bss->ps;
 
 	sdata->vif.txqs_stopped[ac] = false;
@@ -891,6 +892,63 @@
 }
 EXPORT_SYMBOL(ieee80211_queue_delayed_work);
 
+u32 ieee802_11_parse_mesh_vendor_elems(const u8 *start, size_t len, bool action,
+			       struct ieee802_11_mesh_vendor_specific_elems *elems,
+			       u64 filter, u32 crc, u8 type)
+{
+	size_t left = len;
+	const u8 *pos = start;
+	bool calc_crc = filter != 0;
+
+	memset(elems, 0, sizeof(*elems));
+	elems->parse_error = true;
+
+	while (left >= 2) {
+		u8 id, elen;
+
+		id = *pos++;
+		elen = *pos++;
+		left -= 2;
+
+		if (elen > left) {
+			break;
+		}
+
+		if (calc_crc && id < 64 && (filter & (1ULL << id)))
+			crc = crc32_be(crc, pos - 2, elen + 2);
+
+
+		switch (id) {
+		case WLAN_EID_VENDOR_SPECIFIC:
+			if (elen >= 4 && pos[0] == 0xC0 && pos[1] == 0xFF &&
+			    pos[2] == 0xEE && pos[3] == type) {
+				/* Qubercomm OUI (C0:FF:EE) */
+
+				if (calc_crc)
+					crc = crc32_be(crc, pos - 2, elen + 2);
+
+				elems->ie_start = pos;
+				elems->ie_len = elen;
+				elems->parse_error = false;
+
+			}
+			break;
+		default:
+			break;
+		}
+
+		if (elems->parse_error == false)
+			break;
+
+		left -= elen;
+		pos += elen;
+	}
+
+	return crc;
+
+}
+EXPORT_SYMBOL(ieee802_11_parse_mesh_vendor_elems);
+
 static u32
 _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
 			    struct ieee802_11_elems *elems,
@@ -3808,6 +3866,32 @@
 	ps->dtim_count = dtim_count;
 }
 
+void ieee80211_force_dtim(struct ieee80211_vif *vif,
+			  unsigned int dtim_count)
+{
+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+	u8 dtim_period = sdata->vif.bss_conf.dtim_period;
+	struct ps_data *ps;
+
+	if (sdata->vif.type == NL80211_IFTYPE_AP ||
+	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+		if (!sdata->bss)
+			return;
+
+		ps = &sdata->bss->ps;
+	} else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+		ps = &sdata->u.mesh.ps;
+	} else {
+		return;
+	}
+
+	if (WARN_ON_ONCE(dtim_count >= dtim_period))
+		return;
+
+	ps->dtim_count = dtim_count;
+}
+EXPORT_SYMBOL(ieee80211_force_dtim);
+
 static u8 ieee80211_chanctx_radar_detect(struct ieee80211_local *local,
 					 struct ieee80211_chanctx *ctx)
 {
diff -ruw linux-5.4.60/net/Makefile linux-5.4.60-fbx/net/Makefile
--- linux-5.4.60/net/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/Makefile	2021-03-04 13:21:01.370839049 +0100
@@ -39,6 +39,12 @@
 obj-$(CONFIG_STREAM_PARSER)	+= strparser/
 obj-$(CONFIG_ATM)		+= atm/
 obj-$(CONFIG_L2TP)		+= l2tp/
+ifneq ($(CONFIG_FBXATM),)
+obj-y				+= fbxatm/
+endif
+ifneq ($(CONFIG_FBXBRIDGE),)
+obj-y				+= fbxbridge/
+endif
 obj-$(CONFIG_DECNET)		+= decnet/
 obj-$(CONFIG_PHONET)		+= phonet/
 ifneq ($(CONFIG_VLAN_8021Q),)
@@ -87,3 +93,4 @@
 obj-$(CONFIG_QRTR)		+= qrtr/
 obj-$(CONFIG_NET_NCSI)		+= ncsi/
 obj-$(CONFIG_XDP_SOCKETS)	+= xdp/
+obj-$(CONFIG_NET_NMESH_MBH)	+= nmesh-mbh/
diff -ruw linux-5.4.60/net/netfilter/Kconfig linux-5.4.60-fbx/net/netfilter/Kconfig
--- linux-5.4.60/net/netfilter/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/netfilter/Kconfig	2021-03-04 13:21:01.460839053 +0100
@@ -333,6 +333,7 @@
 config NF_CONNTRACK_SIP
 	tristate "SIP protocol support"
 	default m if NETFILTER_ADVANCED=n
+	select CRYPTO_LIB_SHA256
 	help
 	  SIP is an application-layer control protocol that can establish,
 	  modify, and terminate multimedia sessions (conferences) such as
diff -ruw linux-5.4.60/net/netfilter/nf_conntrack_core.c linux-5.4.60-fbx/net/netfilter/nf_conntrack_core.c
--- linux-5.4.60/net/netfilter/nf_conntrack_core.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/netfilter/nf_conntrack_core.c	2021-03-04 13:21:01.467505720 +0100
@@ -592,6 +592,14 @@
 #endif
 }
 
+#ifdef CONFIG_IP_FFN
+extern void ip_ffn_ct_destroy(struct nf_conn *ct);
+#endif
+
+#ifdef CONFIG_IPV6_FFN
+extern void ipv6_ffn_ct_destroy(struct nf_conn *ct);
+#endif
+
 static void
 destroy_conntrack(struct nf_conntrack *nfct)
 {
@@ -600,6 +608,15 @@
 	pr_debug("destroy_conntrack(%p)\n", ct);
 	WARN_ON(atomic_read(&nfct->use) != 0);
 
+#ifdef CONFIG_IP_FFN
+	if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num == AF_INET)
+		ip_ffn_ct_destroy(ct);
+#endif
+#ifdef CONFIG_IPV6_FFN
+	if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num == AF_INET6)
+		ipv6_ffn_ct_destroy(ct);
+#endif
+
 	if (unlikely(nf_ct_is_template(ct))) {
 		nf_ct_tmpl_free(ct);
 		return;
diff -ruw linux-5.4.60/net/netfilter/nf_conntrack_ftp.c linux-5.4.60-fbx/net/netfilter/nf_conntrack_ftp.c
--- linux-5.4.60/net/netfilter/nf_conntrack_ftp.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/netfilter/nf_conntrack_ftp.c	2021-03-04 13:21:01.467505720 +0100
@@ -27,6 +27,10 @@
 #include <linux/netfilter/nf_conntrack_ftp.h>
 
 #define HELPER_NAME "ftp"
+#if defined(CONFIG_FREEBOX_BRIDGE) || defined(CONFIG_FREEBOX_BRIDGE_MODULE)
+#include <net/netfilter/nf_nat_helper.h>
+#include <net/fbxbridge.h>
+#endif
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
@@ -398,6 +402,17 @@
 		return NF_ACCEPT;
 	}
 
+#if defined(CONFIG_FREEBOX_BRIDGE) || defined(CONFIG_FREEBOX_BRIDGE_MODULE)
+	if (!ct_ftp_info->is_fbxbridge && skb->dev->fbx_bridge) {
+		struct fbxbridge *fbxbr;
+
+		fbxbr = skb->dev->fbx_bridge;
+		ct_ftp_info->is_fbxbridge = 1;
+		ct_ftp_info->fbxbridge_remote = ntohl(fbxbr->br_remote_ipaddr);
+		ct_ftp_info->fbxbridge_wan = fbxbr->wan_ipaddr;
+	}
+#endif
+
 	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
 	if (th == NULL)
 		return NF_ACCEPT;
@@ -484,6 +499,50 @@
 	 * Doesn't matter unless NAT is happening.  */
 	daddr = &ct->tuplehash[!dir].tuple.dst.u3;
 
+#if defined(CONFIG_FREEBOX_BRIDGE) || defined(CONFIG_FREEBOX_BRIDGE_MODULE)
+	if (ct_ftp_info->is_fbxbridge &&
+	    search[dir][i].ftptype == NF_CT_FTP_PORT) {
+		unsigned long orig_ip_addr;
+		unsigned short orig_port;
+		char buffer[sizeof("nnn,nnn,nnn,nnn,nnn,nnn")];
+		unsigned int len;
+		__be32 addr;
+
+		/* kludge: if  we are here,  then this is a  local pkt
+		 * that has  gone through internal  fbxbridge snat.
+		 *
+		 * If we see a port  command, then we mangle packet to
+		 * change  ip  address  given  to  the  remote  bridge
+		 * address */
+
+		/* check  address  is  packet  is  the  one  fbxbridge
+		 * changed */
+		orig_ip_addr = cmd.u3.ip;
+		if (orig_ip_addr != ct_ftp_info->fbxbridge_wan)
+			goto donttouch;
+
+		/* now mangle the remote address */
+		orig_port = cmd.u.tcp.port;
+		addr = ct_ftp_info->fbxbridge_remote;
+		len = sprintf(buffer, "%u,%u,%u,%u,%u,%u",
+			      ((unsigned char *)&addr)[0],
+			      ((unsigned char *)&addr)[1],
+			      ((unsigned char *)&addr)[2],
+			      ((unsigned char *)&addr)[3],
+			      orig_port >> 8 , orig_port & 0xFF);
+
+		nf_nat_mangle_tcp_packet(skb, ct, ctinfo, matchoff,
+					 matchlen, buffer, len);
+
+		/* then adjust as if nothing happened */
+		matchlen = len;
+		cmd.u3.ip = ct_ftp_info->fbxbridge_remote;
+	}
+donttouch:
+
+#endif
+
+
 	/* Update the ftp info */
 	if ((cmd.l3num == nf_ct_l3num(ct)) &&
 	    memcmp(&cmd.u3.all, &ct->tuplehash[dir].tuple.src.u3.all,
diff -ruw linux-5.4.60/net/netfilter/nf_conntrack_helper.c linux-5.4.60-fbx/net/netfilter/nf_conntrack_helper.c
--- linux-5.4.60/net/netfilter/nf_conntrack_helper.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/netfilter/nf_conntrack_helper.c	2021-03-04 13:21:01.467505720 +0100
@@ -35,7 +35,7 @@
 EXPORT_SYMBOL_GPL(nf_ct_helper_hsize);
 static unsigned int nf_ct_helper_count __read_mostly;
 
-static bool nf_ct_auto_assign_helper __read_mostly = false;
+static bool nf_ct_auto_assign_helper __read_mostly = true;
 module_param_named(nf_conntrack_helper, nf_ct_auto_assign_helper, bool, 0644);
 MODULE_PARM_DESC(nf_conntrack_helper,
 		 "Enable automatic conntrack helper assignment (default 0)");
diff -ruw linux-5.4.60/net/netfilter/nf_conntrack_proto_tcp.c linux-5.4.60-fbx/net/netfilter/nf_conntrack_proto_tcp.c
--- linux-5.4.60/net/netfilter/nf_conntrack_proto_tcp.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/netfilter/nf_conntrack_proto_tcp.c	2021-03-04 13:21:01.467505720 +0100
@@ -1088,7 +1088,8 @@
 		break;
 	}
 
-	if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
+	if (!ct->proto.tcp.no_window_track &&
+	    !tcp_in_window(ct, &ct->proto.tcp, dir, index,
 			   skb, dataoff, th)) {
 		spin_unlock_bh(&ct->lock);
 		return -NF_ACCEPT;
@@ -1163,6 +1164,38 @@
 	return NF_ACCEPT;
 }
 
+#ifdef CONFIG_IP_FFN
+int external_tcpv4_packet(struct nf_conn *ct,
+			  struct sk_buff *skb,
+			  unsigned int dataoff,
+			  enum ip_conntrack_info ctinfo)
+{
+	/* fixme: is is always PRE_ROUTING ?*/
+	struct nf_hook_state state = {
+		.hook = NF_INET_PRE_ROUTING,
+		.pf = AF_INET,
+		.net = nf_ct_net(ct),
+	};
+	return nf_conntrack_tcp_packet(ct, skb, dataoff, ctinfo, &state);
+}
+#endif
+
+#ifdef CONFIG_IPV6_FFN
+int external_tcpv6_packet(struct nf_conn *ct,
+			  struct sk_buff *skb,
+			  unsigned int dataoff,
+			  enum ip_conntrack_info ctinfo)
+{
+	/* fixme: is is always PRE_ROUTING ?*/
+	struct nf_hook_state state = {
+		.hook = NF_INET_PRE_ROUTING,
+		.pf = AF_INET6,
+		.net = nf_ct_net(ct),
+	};
+	return nf_conntrack_tcp_packet(ct, skb, dataoff, ctinfo, &state);
+}
+#endif
+
 static bool tcp_can_early_drop(const struct nf_conn *ct)
 {
 	switch (ct->proto.tcp.state) {
diff -ruw linux-5.4.60/net/netfilter/nf_conntrack_proto_udp.c linux-5.4.60-fbx/net/netfilter/nf_conntrack_proto_udp.c
--- linux-5.4.60/net/netfilter/nf_conntrack_proto_udp.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/netfilter/nf_conntrack_proto_udp.c	2021-03-04 13:21:01.467505720 +0100
@@ -122,6 +122,38 @@
 	return NF_ACCEPT;
 }
 
+#ifdef CONFIG_IP_FFN
+int external_udpv4_packet(struct nf_conn *ct,
+			  struct sk_buff *skb,
+			  unsigned int dataoff,
+			  enum ip_conntrack_info ctinfo)
+{
+	/* fixme: is is always PRE_ROUTING ?*/
+	struct nf_hook_state state = {
+		.hook = NF_INET_PRE_ROUTING,
+		.pf = AF_INET,
+		.net = nf_ct_net(ct),
+	};
+	return nf_conntrack_udp_packet(ct, skb, dataoff, ctinfo, &state);
+}
+#endif
+
+#ifdef CONFIG_IPV6_FFN
+int external_udpv6_packet(struct nf_conn *ct,
+			  struct sk_buff *skb,
+			  unsigned int dataoff,
+			  enum ip_conntrack_info ctinfo)
+{
+	/* fixme: is is always PRE_ROUTING ?*/
+	struct nf_hook_state state = {
+		.hook = NF_INET_PRE_ROUTING,
+		.pf = AF_INET6,
+		.net = nf_ct_net(ct),
+	};
+	return nf_conntrack_udp_packet(ct, skb, dataoff, ctinfo, &state);
+}
+#endif
+
 #ifdef CONFIG_NF_CT_PROTO_UDPLITE
 static void udplite_error_log(const struct sk_buff *skb,
 			      const struct nf_hook_state *state,
diff -ruw linux-5.4.60/net/netfilter/nf_conntrack_sip.c linux-5.4.60-fbx/net/netfilter/nf_conntrack_sip.c
--- linux-5.4.60/net/netfilter/nf_conntrack_sip.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/netfilter/nf_conntrack_sip.c	2021-03-04 13:21:01.467505720 +0100
@@ -35,6 +35,8 @@
 MODULE_ALIAS("ip_conntrack_sip");
 MODULE_ALIAS_NFCT_HELPER(HELPER_NAME);
 
+#define MAX_CALLS	8
+
 #define MAX_PORTS	8
 static unsigned short ports[MAX_PORTS];
 static unsigned int ports_c;
@@ -825,7 +827,8 @@
 	return found;
 }
 
-static void flush_expectations(struct nf_conn *ct, bool media)
+static void __flush_expectations(struct nf_conn *ct, bool media,
+				 const u8 *cid_hash)
 {
 	struct nf_conn_help *help = nfct_help(ct);
 	struct nf_conntrack_expect *exp;
@@ -835,6 +838,15 @@
 	hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
 		if ((exp->class != SIP_EXPECT_SIGNALLING) ^ media)
 			continue;
+		if (media && cid_hash) {
+			const struct nf_ct_sip_expect *exp_sip_info;
+			exp_sip_info = nf_ct_exp_data(exp);
+
+			if (memcmp(exp_sip_info->cid_hash, cid_hash,
+				   sizeof (exp_sip_info->cid_hash)))
+				continue;
+		}
+
 		if (!nf_ct_remove_expect(exp))
 			continue;
 		if (!media)
@@ -843,12 +855,36 @@
 	spin_unlock_bh(&nf_conntrack_expect_lock);
 }
 
+static void flush_sig_expectations(struct nf_conn *ct)
+{
+	return __flush_expectations(ct, false, NULL);
+}
+
+static void flush_media_expectations(struct nf_conn *ct,
+				     const char *msg_data,
+				     unsigned int msg_len)
+{
+	unsigned int matchoff, matchlen;
+	u8 cid_hash[SHA256_DIGEST_SIZE];
+	struct sha256_state s;
+
+	sha256_init(&s);
+	if (ct_sip_get_header(ct, msg_data, 0, msg_len,
+			      SIP_HDR_CALL_ID,
+			      &matchoff, &matchlen) > 0)
+		sha256_update(&s, msg_data + matchoff, matchlen);
+	sha256_final(&s, cid_hash);
+
+	__flush_expectations(ct, true, cid_hash);
+}
+
 static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,
 				 unsigned int dataoff,
 				 const char **dptr, unsigned int *datalen,
 				 union nf_inet_addr *daddr, __be16 port,
 				 enum sip_expectation_classes class,
-				 unsigned int mediaoff, unsigned int medialen)
+				 unsigned int mediaoff, unsigned int medialen,
+				 const u8 *cid_hash)
 {
 	struct nf_conntrack_expect *exp, *rtp_exp, *rtcp_exp;
 	enum ip_conntrack_info ctinfo;
@@ -861,6 +897,7 @@
 	u_int16_t base_port;
 	__be16 rtp_port, rtcp_port;
 	const struct nf_nat_sip_hooks *hooks;
+	struct nf_ct_sip_expect *exp_sip_info;
 
 	saddr = NULL;
 	if (sip_direct_media) {
@@ -953,18 +990,29 @@
 			goto err1;
 	}
 
-	if (skip_expect)
+	if (skip_expect) {
+		exp_sip_info = nf_ct_exp_data(exp);
+		memcpy(exp_sip_info->cid_hash, cid_hash,
+		       sizeof (exp_sip_info->cid_hash));
 		return NF_ACCEPT;
+	}
 
 	rtp_exp = nf_ct_expect_alloc(ct);
 	if (rtp_exp == NULL)
 		goto err1;
+	exp_sip_info = nf_ct_exp_data(rtp_exp);
+	memcpy(exp_sip_info->cid_hash, cid_hash,
+	       sizeof (exp_sip_info->cid_hash));
 	nf_ct_expect_init(rtp_exp, class, nf_ct_l3num(ct), saddr, daddr,
 			  IPPROTO_UDP, NULL, &rtp_port);
 
+
 	rtcp_exp = nf_ct_expect_alloc(ct);
 	if (rtcp_exp == NULL)
 		goto err2;
+	exp_sip_info = nf_ct_exp_data(rtcp_exp);
+	memcpy(exp_sip_info->cid_hash, cid_hash,
+	       sizeof (exp_sip_info->cid_hash));
 	nf_ct_expect_init(rtcp_exp, class, nf_ct_l3num(ct), saddr, daddr,
 			  IPPROTO_UDP, NULL, &rtcp_port);
 
@@ -1039,10 +1087,20 @@
 	const struct nf_nat_sip_hooks *hooks;
 	unsigned int port;
 	const struct sdp_media_type *t;
+	struct sha256_state s;
+	u8 cid_hash[SHA256_DIGEST_SIZE];
 	int ret = NF_ACCEPT;
 
 	hooks = rcu_dereference(nf_nat_sip_hooks);
 
+	/* extract caller id if any */
+	sha256_init(&s);
+	if (ct_sip_get_header(ct, *dptr, 0, *datalen,
+			      SIP_HDR_CALL_ID,
+			      &matchoff, &matchlen) > 0)
+		sha256_update(&s, *dptr + matchoff, matchlen);
+	sha256_final(&s, cid_hash);
+
 	/* Find beginning of session description */
 	if (ct_sip_get_sdp_header(ct, *dptr, 0, *datalen,
 				  SDP_HDR_VERSION, SDP_HDR_UNSPEC,
@@ -1101,7 +1159,7 @@
 		ret = set_expected_rtp_rtcp(skb, protoff, dataoff,
 					    dptr, datalen,
 					    &rtp_addr, htons(port), t->class,
-					    mediaoff, medialen);
+					    mediaoff, medialen, cid_hash);
 		if (ret != NF_ACCEPT) {
 			nf_ct_helper_log(skb, ct,
 					 "cannot add expectation for voice");
@@ -1145,7 +1203,7 @@
 	    (code >= 200 && code <= 299))
 		return process_sdp(skb, protoff, dataoff, dptr, datalen, cseq);
 	else if (ct_sip_info->invite_cseq == cseq)
-		flush_expectations(ct, true);
+		flush_media_expectations(ct, *dptr, *datalen);
 	return NF_ACCEPT;
 }
 
@@ -1162,7 +1220,7 @@
 	    (code >= 200 && code <= 299))
 		return process_sdp(skb, protoff, dataoff, dptr, datalen, cseq);
 	else if (ct_sip_info->invite_cseq == cseq)
-		flush_expectations(ct, true);
+		flush_media_expectations(ct, *dptr, *datalen);
 	return NF_ACCEPT;
 }
 
@@ -1179,7 +1237,7 @@
 	    (code >= 200 && code <= 299))
 		return process_sdp(skb, protoff, dataoff, dptr, datalen, cseq);
 	else if (ct_sip_info->invite_cseq == cseq)
-		flush_expectations(ct, true);
+		flush_media_expectations(ct, *dptr, *datalen);
 	return NF_ACCEPT;
 }
 
@@ -1193,7 +1251,7 @@
 	struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
 	unsigned int ret;
 
-	flush_expectations(ct, true);
+	flush_media_expectations(ct, *dptr, *datalen);
 	ret = process_sdp(skb, protoff, dataoff, dptr, datalen, cseq);
 	if (ret == NF_ACCEPT)
 		ct_sip_info->invite_cseq = cseq;
@@ -1208,7 +1266,7 @@
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 
-	flush_expectations(ct, true);
+	flush_media_expectations(ct, *dptr, *datalen);
 	return NF_ACCEPT;
 }
 
@@ -1387,7 +1445,7 @@
 	}
 
 flush:
-	flush_expectations(ct, false);
+	flush_sig_expectations(ct);
 	return NF_ACCEPT;
 }
 
@@ -1642,17 +1700,17 @@
 	},
 	[SIP_EXPECT_AUDIO] = {
 		.name		= "audio",
-		.max_expected	= 2 * IP_CT_DIR_MAX,
+		.max_expected	= MAX_CALLS * 2 * IP_CT_DIR_MAX,
 		.timeout	= 3 * 60,
 	},
 	[SIP_EXPECT_VIDEO] = {
 		.name		= "video",
-		.max_expected	= 2 * IP_CT_DIR_MAX,
+		.max_expected	= MAX_CALLS * 2 * IP_CT_DIR_MAX,
 		.timeout	= 3 * 60,
 	},
 	[SIP_EXPECT_IMAGE] = {
 		.name		= "image",
-		.max_expected	= IP_CT_DIR_MAX,
+		.max_expected	= MAX_CALLS * IP_CT_DIR_MAX,
 		.timeout	= 3 * 60,
 	},
 };
@@ -1667,6 +1725,7 @@
 	int i, ret;
 
 	NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nf_ct_sip_master));
+	NF_CT_EXPECT_BUILD_BUG_ON(sizeof(struct nf_ct_sip_expect));
 
 	if (ports_c == 0)
 		ports[ports_c++] = SIP_PORT;
diff -ruw linux-5.4.60/net/netfilter/nf_nat_core.c linux-5.4.60-fbx/net/netfilter/nf_nat_core.c
--- linux-5.4.60/net/netfilter/nf_nat_core.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/netfilter/nf_nat_core.c	2021-03-04 13:21:01.470839054 +0100
@@ -661,6 +661,11 @@
 	else
 		ct->status |= IPS_SRC_NAT_DONE;
 
+	if (maniptype == NF_NAT_MANIP_SRC) {
+		ct->nat_src_proto_min = range->min_proto;
+		ct->nat_src_proto_max = range->max_proto;
+	}
+
 	return NF_ACCEPT;
 }
 EXPORT_SYMBOL(nf_nat_setup_info);
diff -ruw linux-5.4.60/net/netfilter/nf_nat_ftp.c linux-5.4.60-fbx/net/netfilter/nf_nat_ftp.c
--- linux-5.4.60/net/netfilter/nf_nat_ftp.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/netfilter/nf_nat_ftp.c	2021-03-04 13:21:01.470839054 +0100
@@ -69,7 +69,8 @@
 			       struct nf_conntrack_expect *exp)
 {
 	union nf_inet_addr newaddr;
-	u_int16_t port;
+	u_int16_t port, sport, eport;
+	unsigned int i;
 	int dir = CTINFO2DIR(ctinfo);
 	struct nf_conn *ct = exp->master;
 	char buffer[sizeof("|1||65535|") + INET6_ADDRSTRLEN];
@@ -86,8 +87,26 @@
 	 * this one. */
 	exp->expectfn = nf_nat_follow_master;
 
+	if (dir == IP_CT_DIR_ORIGINAL &&
+	    (ct->status & IPS_SRC_NAT) &&
+	    ct->nat_src_proto_min.all &&
+	    ct->nat_src_proto_max.all) {
+		sport = ntohs(ct->nat_src_proto_min.all);
+		eport = ntohs(ct->nat_src_proto_max.all);
+	} else {
+		sport = 1024;
+		eport = 65535;
+	}
+
+	port = ntohs(exp->saved_proto.tcp.port);
+	if (port < sport || port > eport) {
+		get_random_bytes(&port, sizeof (port));
+		port %= eport - sport;
+		port += sport;
+	}
+
 	/* Try to get same port: if not, try to change it. */
-	for (port = ntohs(exp->saved_proto.tcp.port); port != 0; port++) {
+	for (i = 0; i < eport - sport + 1; i++) {
 		int ret;
 
 		exp->tuple.dst.u.tcp.port = htons(port);
@@ -98,6 +117,10 @@
 			port = 0;
 			break;
 		}
+
+		port++;
+		if (port > eport)
+			port = sport;
 	}
 
 	if (port == 0) {
diff -ruw linux-5.4.60/net/netfilter/nf_nat_helper.c linux-5.4.60-fbx/net/netfilter/nf_nat_helper.c
--- linux-5.4.60/net/netfilter/nf_nat_helper.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/netfilter/nf_nat_helper.c	2021-03-04 13:21:01.470839054 +0100
@@ -188,6 +188,14 @@
 	range.flags = NF_NAT_RANGE_MAP_IPS;
 	range.min_addr = range.max_addr
 		= ct->master->tuplehash[!exp->dir].tuple.dst.u3;
+
+	if (ct->master->nat_src_proto_min.all &&
+	    ct->master->nat_src_proto_max.all) {
+		range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
+		range.min_proto = ct->master->nat_src_proto_min;
+		range.max_proto = ct->master->nat_src_proto_max;
+	}
+
 	nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
 
 	/* For DST manip, map port here to where it's expected. */
diff -ruw linux-5.4.60/net/netfilter/nf_nat_proto.c linux-5.4.60-fbx/net/netfilter/nf_nat_proto.c
--- linux-5.4.60/net/netfilter/nf_nat_proto.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/netfilter/nf_nat_proto.c	2021-03-04 13:21:01.470839054 +0100
@@ -385,6 +385,8 @@
 {
 #if IS_ENABLED(CONFIG_IPV6)
 	struct ipv6hdr *ipv6h;
+	const __be32 *to;
+	__be32 *from;
 	__be16 frag_off;
 	int hdroff;
 	u8 nexthdr;
@@ -407,10 +409,24 @@
 	ipv6h = (void *)skb->data + iphdroff;
 
 manip_addr:
-	if (maniptype == NF_NAT_MANIP_SRC)
-		ipv6h->saddr = target->src.u3.in6;
-	else
-		ipv6h->daddr = target->dst.u3.in6;
+	if (maniptype == NF_NAT_MANIP_SRC) {
+		from = ipv6h->saddr.s6_addr32;
+		to = target->src.u3.in6.s6_addr32;
+	} else {
+		from = ipv6h->daddr.s6_addr32;
+		to = target->dst.u3.in6.s6_addr32;
+	}
+
+	if (skb->ip_summed == CHECKSUM_COMPLETE) {
+		__be32 diff[] = {
+			~from[0], ~from[1], ~from[2], ~from[3],
+			to[0], to[1], to[2], to[3],
+		};
+
+		skb->csum = ~csum_partial(diff, sizeof(diff), ~skb->csum);
+	}
+
+	memcpy(from, to, sizeof (struct in6_addr));
 
 #endif
 	return true;
diff -ruw linux-5.4.60/net/netfilter/nf_nat_sip.c linux-5.4.60-fbx/net/netfilter/nf_nat_sip.c
--- linux-5.4.60/net/netfilter/nf_nat_sip.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/netfilter/nf_nat_sip.c	2021-03-04 13:21:01.470839054 +0100
@@ -365,6 +365,15 @@
 		range_set_for_snat = 1;
 	}
 
+	if (range_set_for_snat) {
+		if (ct->master->nat_src_proto_min.all &&
+		    ct->master->nat_src_proto_max.all) {
+			range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
+			range.min_proto = ct->master->nat_src_proto_min;
+			range.max_proto = ct->master->nat_src_proto_max;
+		}
+	}
+
 	/* Perform SRC manip. */
 	if (range_set_for_snat)
 		nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
@@ -382,10 +391,11 @@
 	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 	struct nf_ct_sip_master *ct_sip_info = nfct_help_data(ct);
 	union nf_inet_addr newaddr;
-	u_int16_t port;
+	u_int16_t port, sport, eport;
 	__be16 srcport;
 	char buffer[INET6_ADDRSTRLEN + sizeof("[]:nnnnn")];
 	unsigned int buflen;
+	unsigned int i;
 
 	/* Connection will come from reply */
 	if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
@@ -410,7 +420,24 @@
 	exp->dir = !dir;
 	exp->expectfn = nf_nat_sip_expected;
 
-	for (; port != 0; port++) {
+	if (dir == IP_CT_DIR_ORIGINAL &&
+	    (ct->status & IPS_SRC_NAT) &&
+	    ct->nat_src_proto_min.all &&
+	    ct->nat_src_proto_max.all) {
+		sport = ntohs(ct->nat_src_proto_min.all);
+		eport = ntohs(ct->nat_src_proto_max.all);
+	} else {
+		sport = 1024;
+		eport = 65535;
+	}
+
+	if (port < sport || port > eport) {
+		get_random_bytes(&port, sizeof (port));
+		port %= eport - sport;
+		port += sport;
+	}
+
+	for (i = 0; i < eport - sport + 1; i++) {
 		int ret;
 
 		exp->tuple.dst.u.udp.port = htons(port);
@@ -421,6 +448,10 @@
 			port = 0;
 			break;
 		}
+
+		port++;
+		if (port > eport)
+			port = sport;
 	}
 
 	if (port == 0) {
@@ -580,7 +611,8 @@
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
 	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-	u_int16_t port;
+	u_int16_t port, sport, eport;
+	unsigned int i;
 
 	/* Connection will come from reply */
 	if (nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
@@ -601,17 +633,37 @@
 	rtcp_exp->dir = !dir;
 	rtcp_exp->expectfn = nf_nat_sip_expected;
 
+	if (dir == IP_CT_DIR_ORIGINAL &&
+	    (ct->status & IPS_SRC_NAT) &&
+	    ct->nat_src_proto_min.all &&
+	    ct->nat_src_proto_max.all) {
+		sport = ntohs(ct->nat_src_proto_min.all);
+		eport = ntohs(ct->nat_src_proto_max.all);
+	} else {
+		sport = 1024;
+		eport = 65535;
+	}
+
+	port = ntohs(rtp_exp->tuple.dst.u.udp.port);
+	if (port < sport || port > eport - 1) {
+		get_random_bytes(&port, sizeof (port));
+		port %= eport - sport;
+		port += sport;
+	}
+
 	/* Try to get same pair of ports: if not, try to change them. */
-	for (port = ntohs(rtp_exp->tuple.dst.u.udp.port);
-	     port != 0; port += 2) {
+	for (i = 0; i < eport - sport + 1; i += 2) {
 		int ret;
 
 		rtp_exp->tuple.dst.u.udp.port = htons(port);
 		ret = nf_ct_expect_related(rtp_exp,
 					   NF_CT_EXP_F_SKIP_MASTER);
-		if (ret == -EBUSY)
+		if (ret == -EBUSY) {
+			port += 2;
+			if (port > eport)
+				port = sport;
 			continue;
-		else if (ret < 0) {
+		} else if (ret < 0) {
 			port = 0;
 			break;
 		}
@@ -622,12 +674,19 @@
 			break;
 		else if (ret == -EBUSY) {
 			nf_ct_unexpect_related(rtp_exp);
+			port += 2;
+			if (port > eport)
+				port = sport;
 			continue;
 		} else if (ret < 0) {
 			nf_ct_unexpect_related(rtp_exp);
 			port = 0;
 			break;
 		}
+
+		port += 2;
+		if (port > eport)
+			port = sport;
 	}
 
 	if (port == 0) {
diff -ruw linux-5.4.60/net/sched/sch_drr.c linux-5.4.60-fbx/net/sched/sch_drr.c
--- linux-5.4.60/net/sched/sch_drr.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/sched/sch_drr.c	2021-03-04 13:21:01.500839054 +0100
@@ -334,7 +334,9 @@
 			cl = drr_find_class(sch, res.classid);
 		return cl;
 	}
-	return NULL;
+
+	/* default to first minor if it exists, or drop */
+	return drr_find_class(sch, TC_H_MAKE(TC_H_MAJ(sch->handle), 1));
 }
 
 static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch,
diff -ruw linux-5.4.60/net/socket.c linux-5.4.60-fbx/net/socket.c
--- linux-5.4.60/net/socket.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/socket.c	2021-03-04 13:21:01.514172389 +0100
@@ -1066,6 +1066,29 @@
 	return err;
 }
 
+static DEFINE_MUTEX(fbxbridge_ioctl_mutex);
+static int (*fbxbridge_ioctl_hook)(struct net *, unsigned int cmd, void __user *arg) = NULL;
+
+void fbxbridge_set(int (*hook)(struct net *, unsigned int, void __user *))
+{
+	mutex_lock(&fbxbridge_ioctl_mutex);
+	fbxbridge_ioctl_hook = hook;
+	mutex_unlock(&fbxbridge_ioctl_mutex);
+}
+
+static DEFINE_MUTEX(fbxdiverter_ioctl_mutex);
+static int (*fbxdiverter_ioctl_hook) (struct net *, unsigned int cmd, void __user *arg) = NULL;
+
+void fbxdiverter_ioctl_set(int (*hook) (struct net *, unsigned int,
+					void __user *))
+{
+	mutex_lock(&fbxdiverter_ioctl_mutex);
+	fbxdiverter_ioctl_hook = hook;
+	mutex_unlock(&fbxdiverter_ioctl_mutex);
+}
+
+EXPORT_SYMBOL(fbxdiverter_ioctl_set);
+
 /*
  *	With an ioctl, arg may well be a user mode pointer, but we don't know
  *	what to do with it - that's up to the protocol still.
@@ -1165,6 +1188,17 @@
 
 			err = open_related_ns(&net->ns, get_net_ns);
 			break;
+		case SIOCGFBXDIVERT:
+		case SIOCSFBXDIVERT:
+			err = -ENOPKG;
+			if (!fbxdiverter_ioctl_hook)
+				request_module("fbxdiverter");
+
+			mutex_lock(&fbxdiverter_ioctl_mutex);
+			if (fbxdiverter_ioctl_hook)
+				err = fbxdiverter_ioctl_hook(net, cmd, argp);
+			mutex_unlock(&fbxdiverter_ioctl_mutex);
+			break;
 		case SIOCGSTAMP_OLD:
 		case SIOCGSTAMPNS_OLD:
 			if (!sock->ops->gettstamp) {
@@ -1185,6 +1219,17 @@
 						   cmd == SIOCGSTAMP_NEW,
 						   false);
 			break;
+		case SIOCGFBXBRIDGE:
+		case SIOCSFBXBRIDGE:
+			err = -ENOPKG;
+			if (!fbxbridge_ioctl_hook)
+				request_module("fbxbridge");
+
+			mutex_lock(&fbxbridge_ioctl_mutex);
+			if (fbxbridge_ioctl_hook)
+				err = fbxbridge_ioctl_hook(net, cmd, argp);
+			mutex_unlock(&fbxbridge_ioctl_mutex);
+			break;
 		default:
 			err = sock_do_ioctl(net, sock, cmd, arg);
 			break;
diff -ruw linux-5.4.60/net/unix/af_unix.c linux-5.4.60-fbx/net/unix/af_unix.c
--- linux-5.4.60/net/unix/af_unix.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/unix/af_unix.c	2021-03-04 13:21:01.524172389 +0100
@@ -279,8 +279,10 @@
 	sk_for_each(s, &unix_socket_table[hash ^ type]) {
 		struct unix_sock *u = unix_sk(s);
 
+#ifdef UNIX_ABSTRACT_IGNORE_NETNS
 		if (!net_eq(sock_net(s), net))
 			continue;
+#endif
 
 		if (u->addr->len == len &&
 		    !memcmp(u->addr->name, sunname, len))
diff -ruw linux-5.4.60/net/unix/Kconfig linux-5.4.60-fbx/net/unix/Kconfig
--- linux-5.4.60/net/unix/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/unix/Kconfig	2021-03-04 13:21:01.524172389 +0100
@@ -25,6 +25,9 @@
 	depends on UNIX
 	default y
 
+config UNIX_ABSTRACT_IGNORE_NETNS
+	bool "make abstract namespace global to all network namespaces"
+
 config UNIX_DIAG
 	tristate "UNIX: socket monitoring interface"
 	depends on UNIX
diff -ruw linux-5.4.60/net/wireless/core.h linux-5.4.60-fbx/net/wireless/core.h
--- linux-5.4.60/net/wireless/core.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/wireless/core.h	2021-03-04 13:21:01.527505723 +0100
@@ -331,6 +331,12 @@
 			 struct net_device *dev,
 			 struct mesh_setup *setup,
 			 const struct mesh_config *conf);
+int cfg80211_update_mesh_vendor_node_metrics_ie(struct cfg80211_registered_device *rdev,
+						struct net_device *dev,
+						struct mesh_vendor_ie *vendor_ie);
+int cfg80211_update_mesh_vendor_path_metrics_ie(struct cfg80211_registered_device *rdev,
+                                   struct net_device *dev,
+                                   struct mesh_vendor_ie *vendor_ie);
 int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
 			  struct net_device *dev);
 int cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
diff -ruw linux-5.4.60/net/wireless/mesh.c linux-5.4.60-fbx/net/wireless/mesh.c
--- linux-5.4.60/net/wireless/mesh.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/wireless/mesh.c	2021-03-04 13:21:01.527505723 +0100
@@ -217,6 +217,34 @@
 	return err;
 }
 
+int cfg80211_update_mesh_vendor_node_metrics_ie(struct cfg80211_registered_device *rdev,
+				   struct net_device *dev,
+				   struct mesh_vendor_ie *vendor_ie)
+{
+	struct wireless_dev *wdev = dev->ieee80211_ptr;
+	int err;
+
+	wdev_lock(wdev);
+	err = rdev_update_mesh_vendor_node_metrics_ie(rdev, dev, vendor_ie);
+	wdev_unlock(wdev);
+
+	return err;
+}
+
+int cfg80211_update_mesh_vendor_path_metrics_ie(struct cfg80211_registered_device *rdev,
+						struct net_device *dev,
+						struct mesh_vendor_ie *vendor_ie)
+{
+	struct wireless_dev *wdev = dev->ieee80211_ptr;
+	int err;
+
+	wdev_lock(wdev);
+	err = rdev_update_mesh_vendor_path_metrics_ie(rdev, dev, vendor_ie);
+	wdev_unlock(wdev);
+
+	return err;
+}
+
 int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev,
 			      struct wireless_dev *wdev,
 			      struct cfg80211_chan_def *chandef)
diff -ruw linux-5.4.60/net/wireless/nl80211.c linux-5.4.60-fbx/net/wireless/nl80211.c
--- linux-5.4.60/net/wireless/nl80211.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/wireless/nl80211.c	2021-03-04 13:21:01.530839056 +0100
@@ -6407,6 +6407,51 @@
 	return err;
 }
 
+static int nl80211_set_mpp(struct sk_buff *skb, struct genl_info *info)
+{
+	struct cfg80211_registered_device *rdev = info->user_ptr[0];
+	struct net_device *dev = info->user_ptr[1];
+	u8 *dst = NULL;
+	u8 *next_hop = NULL;
+
+	if (!info->attrs[NL80211_ATTR_MAC])
+		return -EINVAL;
+
+	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
+		return -EINVAL;
+
+	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
+	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
+
+	if (!rdev->ops->update_mpp)
+		return -EOPNOTSUPP;
+
+	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
+		return -EOPNOTSUPP;
+
+	return rdev_update_mpp(rdev, dev, dst, next_hop);
+}
+
+static int nl80211_del_mpp(struct sk_buff *skb, struct genl_info *info)
+{
+	struct cfg80211_registered_device *rdev = info->user_ptr[0];
+	struct net_device *dev = info->user_ptr[1];
+	u8 *dst;
+
+	if (!info->attrs[NL80211_ATTR_MAC])
+		return -EINVAL;
+
+	if (!rdev->ops->delete_mpp)
+		return -EOPNOTSUPP;
+
+	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
+		return -EOPNOTSUPP;
+
+	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
+
+	return rdev_delete_mpp(rdev, dev, dst);
+}
+
 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -12906,8 +12951,30 @@
 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 	struct wireless_dev *wdev =
 		__cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
-	int i, err;
+	int i, err = 0;
 	u32 vid, subcmd;
+	struct net_device *dev = wdev->netdev;
+	struct mesh_vendor_ie mv_ie;
+	struct nlattr *ieattr;
+	u8 type;
+
+
+	if (wdev->iftype == NL80211_IFTYPE_MESH_POINT) {
+		if (info->attrs[NL80211_ATTR_VENDOR_DATA] &&
+			info->attrs[NL80211_ATTR_VENDOR_SUBCMD]) {
+			if (!info->attrs[NL80211_ATTR_VENDOR_DATA])
+				return -EINVAL;
+			ieattr = info->attrs[NL80211_ATTR_VENDOR_DATA];
+			mv_ie.ie = nla_data(ieattr);
+			mv_ie.ie_len = nla_len(ieattr);
+			type = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
+			if (type == NL80211_QBC_UPDATE_NODE_METRICS_IE)
+				err = cfg80211_update_mesh_vendor_node_metrics_ie(rdev, dev, &mv_ie);
+			else if (type == NL80211_QBC_UPDATE_PATH_METRICS_IE)
+				err = cfg80211_update_mesh_vendor_path_metrics_ie(rdev, dev, &mv_ie);
+			return err;
+		}
+	}
 
 	if (!rdev->wiphy.vendor_commands)
 		return -EOPNOTSUPP;
@@ -14085,6 +14152,20 @@
 				  NL80211_FLAG_NEED_RTNL,
 	},
 	{
+		.cmd = NL80211_CMD_SET_MPP,
+		.doit = nl80211_set_mpp,
+		.flags = GENL_UNS_ADMIN_PERM,
+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+				  NL80211_FLAG_NEED_RTNL,
+	},
+	{
+		.cmd = NL80211_CMD_DEL_MPP,
+		.doit = nl80211_del_mpp,
+		.flags = GENL_UNS_ADMIN_PERM,
+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+				  NL80211_FLAG_NEED_RTNL,
+	},
+	{
 		.cmd = NL80211_CMD_SET_BSS,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 		.doit = nl80211_set_bss,
@@ -15473,6 +15554,94 @@
 }
 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
 
+void cfg80211_notify_mesh_peer_path_metrics(struct net_device *dev, const u8 *macaddr,
+				       const u8 *ie, u8 ie_len, gfp_t gfp)
+{
+	struct wireless_dev *wdev = dev->ieee80211_ptr;
+	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
+	struct sk_buff *msg;
+	void *hdr;
+
+	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
+		return;
+
+	msg = nlmsg_new(100 + ie_len, gfp);
+	if (!msg)
+		return;
+
+	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MESH_PEER_PATH_METRICS);
+	if (!hdr) {
+		nlmsg_free(msg);
+		return;
+	}
+
+	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+	    nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name) ||
+	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
+	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
+	    (ie_len && ie &&
+	     nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
+		goto nla_put_failure;
+
+	genlmsg_end(msg, hdr);
+
+	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+				NL80211_MCGRP_MLME, gfp);
+	return;
+
+ nla_put_failure:
+	genlmsg_cancel(msg, hdr);
+	nlmsg_free(msg);
+}
+EXPORT_SYMBOL(cfg80211_notify_mesh_peer_path_metrics);
+
+
+void cfg80211_notify_mesh_peer_node_metrics(struct net_device *dev,
+                                      const u8 *macaddr, u16 stype, s8 signal,
+                                      u32 beacon_int, const u8 *ie, u8 ie_len, gfp_t gfp)
+{
+	struct wireless_dev *wdev = dev->ieee80211_ptr;
+	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
+	struct sk_buff *msg;
+	void *hdr;
+
+	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
+		return;
+
+	msg = nlmsg_new(100 + ie_len, gfp);
+	if (!msg)
+		return;
+
+	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MESH_PEER_NODE_METRICS);
+	if (!hdr) {
+		nlmsg_free(msg);
+		return;
+	}
+
+	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+	    nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name) ||
+	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
+	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
+	    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, stype) ||
+	    nla_put_s8(msg, NL80211_ATTR_SIGNAL_STRENGTH, signal) ||
+	    nla_put_u32(msg, NL80211_ATTR_BEACON_INTERVAL, beacon_int) ||
+	    (ie_len && ie &&
+	     nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
+		goto nla_put_failure;
+
+	genlmsg_end(msg, hdr);
+
+	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+				NL80211_MCGRP_MLME, gfp);
+	return;
+
+ nla_put_failure:
+	genlmsg_cancel(msg, hdr);
+	nlmsg_free(msg);
+}
+EXPORT_SYMBOL(cfg80211_notify_mesh_peer_node_metrics);
+
+
 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
 				 struct net_device *netdev, const u8 *addr,
 				 enum nl80211_key_type key_type, int key_id,
diff -ruw linux-5.4.60/net/wireless/rdev-ops.h linux-5.4.60-fbx/net/wireless/rdev-ops.h
--- linux-5.4.60/net/wireless/rdev-ops.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/wireless/rdev-ops.h	2021-03-04 13:21:01.530839056 +0100
@@ -278,6 +278,28 @@
 	return ret;
 }
 
+static inline int rdev_update_mpp(struct cfg80211_registered_device *rdev,
+				 struct net_device *dev, u8 *dst, u8 *next_hop)
+{
+	int ret;
+
+	trace_rdev_update_mpp(&rdev->wiphy, dev, dst, next_hop);
+	ret = rdev->ops->update_mpp(&rdev->wiphy, dev, dst, next_hop);
+	trace_rdev_return_int(&rdev->wiphy, ret);
+	return ret;
+}
+
+static inline int rdev_delete_mpp(struct cfg80211_registered_device *rdev,
+				 struct net_device *dev, u8 *dst)
+{
+	int ret;
+
+	trace_rdev_delete_mpp(&rdev->wiphy, dev, dst);
+	ret = rdev->ops->delete_mpp(&rdev->wiphy, dev, dst);
+	trace_rdev_return_int(&rdev->wiphy, ret);
+	return ret;
+}
+
 static inline int rdev_dump_mpath(struct cfg80211_registered_device *rdev,
 				  struct net_device *dev, int idx, u8 *dst,
 				  u8 *next_hop, struct mpath_info *pinfo)
@@ -339,6 +361,23 @@
 	return ret;
 }
 
+static inline int rdev_update_mesh_vendor_node_metrics_ie(struct cfg80211_registered_device *rdev,
+							  struct net_device *dev,
+							  struct mesh_vendor_ie *ie)
+{
+	int ret;
+	ret = rdev->ops->update_mesh_vendor_node_metrics_ie(&rdev->wiphy, dev, ie);
+	return ret;
+}
+
+static inline int rdev_update_mesh_vendor_path_metrics_ie(struct cfg80211_registered_device *rdev,
+							  struct net_device *dev,
+							  struct mesh_vendor_ie *ie)
+{
+	int ret;
+	ret = rdev->ops->update_mesh_vendor_path_metrics_ie(&rdev->wiphy, dev, ie);
+	return ret;
+}
 
 static inline int rdev_leave_mesh(struct cfg80211_registered_device *rdev,
 				  struct net_device *dev)
diff -ruw linux-5.4.60/net/wireless/reg.c linux-5.4.60-fbx/net/wireless/reg.c
--- linux-5.4.60/net/wireless/reg.c	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/wireless/reg.c	2021-03-04 13:21:01.530839056 +0100
@@ -1761,6 +1761,9 @@
 
 		if (chan->flags & IEEE80211_CHAN_RADAR) {
 			chan->dfs_cac_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+			if (chan->center_freq >= 5600 &&
+			    chan->center_freq <= 5650)
+				chan->dfs_cac_ms = IEEE80211_DFS_WEATHER_MIN_CAC_TIME_MS;
 			if (reg_rule->dfs_cac_ms)
 				chan->dfs_cac_ms = reg_rule->dfs_cac_ms;
 		}
@@ -1781,9 +1784,14 @@
 	if (chan->flags & IEEE80211_CHAN_RADAR) {
 		if (reg_rule->dfs_cac_ms)
 			chan->dfs_cac_ms = reg_rule->dfs_cac_ms;
+		else {
+			if (chan->center_freq >= 5600 &&
+			    chan->center_freq <= 5650)
+				chan->dfs_cac_ms = IEEE80211_DFS_WEATHER_MIN_CAC_TIME_MS;
 		else
 			chan->dfs_cac_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
 	}
+	}
 
 	if (chan->orig_mpwr) {
 		/*
diff -ruw linux-5.4.60/net/wireless/trace.h linux-5.4.60-fbx/net/wireless/trace.h
--- linux-5.4.60/net/wireless/trace.h	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/net/wireless/trace.h	2021-03-04 13:21:01.534172390 +0100
@@ -813,6 +813,11 @@
 	TP_ARGS(wiphy, netdev, mac)
 );
 
+DEFINE_EVENT(wiphy_netdev_mac_evt, rdev_delete_mpp,
+	TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, const u8 *mac),
+	TP_ARGS(wiphy, netdev, mac)
+);
+
 TRACE_EVENT(rdev_dump_station,
 	TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, int _idx,
 		 u8 *mac),
@@ -888,6 +893,12 @@
 	TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, u8 *dst,
 		 u8 *next_hop),
 	TP_ARGS(wiphy, netdev, dst, next_hop)
+);
+
+DEFINE_EVENT(mpath_evt, rdev_update_mpp,
+	TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, u8 *dst,
+		 u8 *next_hop),
+	TP_ARGS(wiphy, netdev, dst, next_hop)
 );
 
 TRACE_EVENT(rdev_dump_mpath,
diff -ruw linux-5.4.60/scripts/dtc/include-prefixes/arm64/amlogic/Makefile linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/amlogic/Makefile
--- linux-5.4.60/scripts/dtc/include-prefixes/arm64/amlogic/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/amlogic/Makefile	2021-03-04 13:20:57.000838854 +0100
@@ -1,4 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
+DTC_FLAGS += -@
+dtb-$(CONFIG_ARCH_MESON) += fbxwmr.dtb fbxwmr-r1.dtb fbxwmr-r2.dtb
 dtb-$(CONFIG_ARCH_MESON) += meson-axg-s400.dtb
 dtb-$(CONFIG_ARCH_MESON) += meson-g12a-sei510.dtb
 dtb-$(CONFIG_ARCH_MESON) += meson-g12a-u200.dtb
diff -ruw linux-5.4.60/scripts/dtc/include-prefixes/arm64/broadcom/Makefile linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/broadcom/Makefile
--- linux-5.4.60/scripts/dtc/include-prefixes/arm64/broadcom/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/broadcom/Makefile	2021-03-04 13:20:57.004172187 +0100
@@ -6,3 +6,4 @@
 
 subdir-y	+= northstar2
 subdir-y	+= stingray
+subdir-y	+= bcm63xx
diff -ruw linux-5.4.60/scripts/dtc/include-prefixes/arm64/marvell/armada-ap806.dtsi linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/armada-ap806.dtsi
--- linux-5.4.60/scripts/dtc/include-prefixes/arm64/marvell/armada-ap806.dtsi	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/armada-ap806.dtsi	2021-03-04 13:20:57.010838855 +0100
@@ -274,6 +274,11 @@
 				};
 			};
 
+			ap_hwmon: ap806-hwmon@6f8084 {
+				compatible = "marvell,ap806-hwmon";
+				reg = <0x6f8084 0xc>;
+			};
+
 			ap_syscon1: system-controller@6f8000 {
 				compatible = "syscon", "simple-mfd";
 				reg = <0x6f8000 0x1000>;
diff -ruw linux-5.4.60/scripts/dtc/include-prefixes/arm64/marvell/armada-cp110.dtsi linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/armada-cp110.dtsi
--- linux-5.4.60/scripts/dtc/include-prefixes/arm64/marvell/armada-cp110.dtsi	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/armada-cp110.dtsi	2021-03-04 13:20:57.010838855 +0100
@@ -134,10 +134,13 @@
 			reg = <0x120000 0x6000>;
 			marvell,system-controller = <&CP110_LABEL(syscon0)>;
 			clocks = <&CP110_LABEL(clk) 1 5>, <&CP110_LABEL(clk) 1 6>,
-				 <&CP110_LABEL(clk) 1 18>;
-			clock-names = "mg_clk", "mg_core_clk", "axi_clk";
+				 <&CP110_LABEL(clk) 1 18>, <&CP110_LABEL(clk) 1 9>;
+			clock-names = "mg_clk", "mg_core_clk", "axi_clk", "gop_clk";
 			#address-cells = <1>;
 			#size-cells = <0>;
+			marvell,cp_mgmt = <&CP110_LABEL(syscon1)>;
+			/* always use Master CP S@R */
+			marvell,sar = <&cp0_syscon1>;
 
 			CP110_LABEL(comphy0): phy@0 {
 				reg = <0>;
@@ -322,6 +325,14 @@
 			};
 		};
 
+		CP110_LABEL(utmi): utmi@580000 {
+			compatible = "marvell,cp110-utmi-phy";
+			#phy-cells = <1>;
+			reg = <0x580000 0x2000>;
+			reg-names = "utmi-unit";
+			marvell,system-controller = <&CP110_LABEL(syscon0)>;
+		};
+
 		CP110_LABEL(xor0): xor@6a0000 {
 			compatible = "marvell,armada-7k-xor", "marvell,xor-v2";
 			reg = <0x6a0000 0x1000>, <0x6b0000 0x1000>;
@@ -364,6 +375,11 @@
 			status = "disabled";
 		};
 
+		CP110_LABEL(hwmon): cp110-hwmon@0x400070 {
+			compatible = "marvell,cp110-hwmon";
+			reg = <0x400070 0xc>;
+		};
+
 		CP110_LABEL(i2c0): i2c@701000 {
 			compatible = "marvell,mv78230-i2c";
 			reg = <0x701000 0x20>;
@@ -388,6 +404,16 @@
 			status = "disabled";
 		};
 
+		CP110_LABEL(mss_i2c): i2c@211000 {
+			compatible = "marvell,mv64xxx-i2c";
+			reg = <0x211000 0x20>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts = <0 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&CP110_LABEL(clk) 1 21>;
+			status = "disabled";
+		};
+
 		CP110_LABEL(uart0): serial@702000 {
 			compatible = "snps,dw-apb-uart";
 			reg = <0x702000 0x100>;
@@ -457,8 +483,8 @@
 
 		CP110_LABEL(trng): trng@760000 {
 			compatible = "marvell,armada-8k-rng",
-			"inside-secure,safexcel-eip76";
-			reg = <0x760000 0x7d>;
+				"inside-secure,safexcel-eip150";
+			reg = <0x760000 0x10000>;
 			interrupts = <95 IRQ_TYPE_LEVEL_HIGH>;
 			clock-names = "core", "reg";
 			clocks = <&CP110_LABEL(clk) 1 25>,
@@ -492,6 +518,19 @@
 				 <&CP110_LABEL(clk) 1 17>;
 			dma-coherent;
 		};
+
+		CP110_LABEL(tdm0): tdmmc@7a0000 {
+			compatible = "marvell,armada-a8k-tdm";
+			reg = <0x7a0000 0x20000>,
+				<0x440400 0x20>;
+			reg-names = "tdm_regs", "pll_regs";
+			interrupts = <111 IRQ_TYPE_LEVEL_HIGH>,
+				<112 IRQ_TYPE_LEVEL_HIGH>,
+				<113 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&CP110_LABEL(clk) 1 1>;
+			clock-names = "gateclk";
+			status = "disabled";
+		};
 	};
 
 	CP110_LABEL(pcie0): pcie@CP110_PCIE0_BASE {
diff -ruw linux-5.4.60/scripts/dtc/include-prefixes/arm64/marvell/Makefile linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/Makefile
--- linux-5.4.60/scripts/dtc/include-prefixes/arm64/marvell/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/Makefile	2021-03-04 13:20:57.010838855 +0100
@@ -10,3 +10,17 @@
 dtb-$(CONFIG_ARCH_MVEBU) += armada-8040-mcbin.dtb
 dtb-$(CONFIG_ARCH_MVEBU) += armada-8040-mcbin-singleshot.dtb
 dtb-$(CONFIG_ARCH_MVEBU) += armada-8080-db.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r_exp1_dsl_lte.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r_exp1_ftth_p2p.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r_exp2_ftth_p2p.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r_exp2_ftth_pon.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r_exp1_test_module.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += fbxgw7r_exp2_test_module.dtb
+
+dtb-$(CONFIG_ARCH_MVEBU) += jbxgw7r.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += jbxgw7r_exp1_ftth_p2p.dtb
+dtb-$(CONFIG_ARCH_MVEBU) += jbxgw7r_exp2_ftth_p2p.dtb
+
+# export symbols in DTBs file to allow overlay usage
+DTC_FLAGS	+= -@
diff -ruw linux-5.4.60/scripts/Makefile.build linux-5.4.60-fbx/scripts/Makefile.build
--- linux-5.4.60/scripts/Makefile.build	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/scripts/Makefile.build	2021-03-04 13:21:01.547505724 +0100
@@ -431,7 +431,7 @@
 # module is turned into a multi object module, $^ will contain header file
 # dependencies recorded in the .*.cmd file.
 quiet_cmd_link_multi-m = LD [M]  $@
-      cmd_link_multi-m = $(LD) $(ld_flags) -r -o $@ $(filter %.o,$^)
+      cmd_link_multi-m = $(LD) $(ld_flags) -r -o $@ $(filter %.o %.a,$^)
 
 $(multi-used-m): FORCE
 	$(call if_changed,link_multi-m)
diff -ruw linux-5.4.60/scripts/Makefile.lib linux-5.4.60-fbx/scripts/Makefile.lib
--- linux-5.4.60/scripts/Makefile.lib	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/scripts/Makefile.lib	2021-03-04 13:21:01.547505724 +0100
@@ -256,11 +256,11 @@
 DTC_FLAGS += $(DTC_FLAGS_$(basetarget))
 
 # Generate an assembly file to wrap the output of the device tree compiler
-quiet_cmd_dt_S_dtb= DTB     $@
+quiet_cmd_dt_S_dtb= DTB_bin $@
 cmd_dt_S_dtb=						\
 {							\
 	echo '\#include <asm-generic/vmlinux.lds.h>'; 	\
-	echo '.section .dtb.init.rodata,"a"';		\
+	echo '.section .dtb.rodata,"a"';		\
 	echo '.balign STRUCT_ALIGNMENT';		\
 	echo '.global __dtb_$(subst -,_,$(*F))_begin';	\
 	echo '__dtb_$(subst -,_,$(*F))_begin:';		\
@@ -273,6 +273,8 @@
 $(obj)/%.dtb.S: $(obj)/%.dtb FORCE
 	$(call if_changed,dt_S_dtb)
 
+.PRECIOUS: $(src)/%.dtb.S
+
 quiet_cmd_dtc = DTC     $@
 cmd_dtc = mkdir -p $(dir ${dtc-tmp}) ; \
 	$(HOSTCC) -E $(dtc_cpp_flags) -x assembler-with-cpp -o $(dtc-tmp) $< ; \
diff -ruw linux-5.4.60/sound/soc/kirkwood/Kconfig linux-5.4.60-fbx/sound/soc/kirkwood/Kconfig
--- linux-5.4.60/sound/soc/kirkwood/Kconfig	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/sound/soc/kirkwood/Kconfig	2021-03-04 13:21:01.724172398 +0100
@@ -16,3 +16,8 @@
 	  Say Y if you want to add support for SoC audio on
 	  the Armada 370 Development Board.
 
+config SND_KIRKWOOD_SOC_FBXGW2R
+	tristate "Soc Audio support for fbxgw2r"
+	depends on SND_KIRKWOOD_SOC && MACH_FBXGW2R && I2C
+	select SND_KIRKWOOD_SOC_I2S
+	select SND_SOC_CS42L52
diff -ruw linux-5.4.60/sound/soc/kirkwood/Makefile linux-5.4.60-fbx/sound/soc/kirkwood/Makefile
--- linux-5.4.60/sound/soc/kirkwood/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/sound/soc/kirkwood/Makefile	2021-03-04 13:21:01.724172398 +0100
@@ -6,3 +6,6 @@
 snd-soc-armada-370-db-objs := armada-370-db.o
 
 obj-$(CONFIG_SND_KIRKWOOD_SOC_ARMADA370_DB) += snd-soc-armada-370-db.o
+
+snd-soc-fbxgw2r-objs := kirkwood-fbxgw2r.o
+obj-$(CONFIG_SND_KIRKWOOD_SOC_FBXGW2R) += snd-soc-fbxgw2r.o
diff -ruw linux-5.4.60/usr/Makefile linux-5.4.60-fbx/usr/Makefile
--- linux-5.4.60/usr/Makefile	2020-08-21 13:05:39.000000000 +0200
+++ linux-5.4.60-fbx/usr/Makefile	2021-03-04 13:21:01.924172407 +0100
@@ -27,7 +27,7 @@
 # Generate the initramfs cpio archive
 
 hostprogs-y := gen_init_cpio
-initramfs   := $(CONFIG_SHELL) $(srctree)/$(src)/gen_initramfs_list.sh
+initramfs   := $(BASH) $(srctree)/$(src)/gen_initramfs_list.sh
 ramfs-input := $(if $(filter-out "",$(CONFIG_INITRAMFS_SOURCE)), \
 			$(shell echo $(CONFIG_INITRAMFS_SOURCE)),-d)
 ramfs-args  := \
diff -Nruw linux-5.4.60-fbx/arch/arm64/boot/dts/broadcom/bcm63xx./Makefile linux-5.4.60-fbx/arch/arm64/boot/dts/broadcom/bcm63xx/Makefile
--- linux-5.4.60-fbx/arch/arm64/boot/dts/broadcom/bcm63xx./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/broadcom/bcm63xx/Makefile	2021-03-04 13:20:57.004172187 +0100
@@ -0,0 +1,5 @@
+dtb-$(CONFIG_ARCH_BCM63XX) += bcm963158ref1d.dtb fbxgw8r.dtb
+
+always		:= $(dtb-y)
+subdir-y	:= $(dts-dirs)
+clean-files	:= *.dtb
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/fbxgw7r-common.dtsi	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,925 @@
+/ {
+	chosen {
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		ramoops@3fff8000 {
+			compatible = "ramoops";
+			/* RAM top - 32k */
+			reg = <0x0 0x3fff8000 0x0 (32 * 1024)>;
+			record-size = <(32 * 1024)>;
+			ecc-size = <16>;
+			no-dump-oops;
+		};
+        };
+
+	memory@00000000 {
+		device_type = "memory";
+		// hopefully patched by ATF.
+		reg = <0x0 0x0 0x0 0x0>;
+	};
+
+	firmware {
+		optee {
+			compatible = "linaro,optee-tz";
+			method = "smc";
+		};
+	};
+
+	fbx7r-fbxgpio {
+		compatible = "fbx,fbxgpio";
+
+		lan-sfp-txdis {
+			gpio = <&cp0_gpio2 22 0>;
+			output-high;
+#ifdef USE_PHYLINK_SFP
+			no-claim;
+#endif
+		};
+		lan-sfp-txfault {
+			gpio = <&cp0_gpio2 21 0>;
+			input;
+#ifdef USE_PHYLINK_SFP
+			no-claim;
+#endif
+		};
+		lan-sfp-pwren {
+			gpio = <&io_expander1 7 0>;
+			output-low;
+#ifdef USE_PHYLINK_SFP
+			no-claim;
+#endif
+		};
+		lan-sfp-presence {
+			gpio = <&cp1_gpio1 27 0>;
+			input;
+#ifdef USE_PHYLINK_SFP
+			no-claim;
+#endif
+		};
+		lan-sfp-pwrgood {
+			gpio = <&cp1_gpio1 10 0>;
+			input;
+#ifdef USE_PHYLINK_SFP
+			no-claim;
+#endif
+		};
+		lan-sfp-rxlos {
+			gpio = <&cp1_gpio1 28 0>;
+			input;
+#ifdef USE_PHYLINK_SFP
+			no-claim;
+#endif
+		};
+
+		sata0-pwren {
+			gpio = <&io_expander0 13 0>;
+			output-low;
+		};
+		sata1-pwren {
+			gpio = <&io_expander0 14 0>;
+			output-low;
+		};
+		sata0-pwrfault {
+			gpio = <&io_expander0 11 0>;
+			input;
+		};
+		sata1-pwrfault {
+			gpio = <&io_expander0 12 0>;
+			input;
+		};
+
+		sata2-pwren {
+			gpio = <&io_expander1 11 0>;
+			output-low;
+		};
+		sata3-pwren {
+			gpio = <&io_expander1 10 0>;
+			output-low;
+		};
+		sata2-pwrfault {
+			gpio = <&io_expander1 5 0>;
+			input;
+		};
+		sata3-pwrfault {
+			gpio = <&io_expander1 4 0>;
+			input;
+		};
+
+		usbhub2-rst {
+			gpio = <&io_expander0 15 0>;
+			output-low;
+		};
+		usbhub3-rst {
+			gpio = <&io_expander1 6 0>;
+			output-low;
+		};
+
+		mpcie0-rst {
+			/* WiFi 5.0Ghz */
+			gpio = <&io_expander0 8 0>;
+			output-low;
+			no-claim;
+		};
+		mpcie1-rst {
+			/* WiFI 2.4 Ghz */
+			gpio = <&io_expander1 15 0>;
+			output-low;
+			no-claim;
+		};
+		mpcie2-rst {
+			/* WiFi Listen */
+			gpio = <&io_expander1 9 0>;
+			output-low;
+			no-claim;
+		};
+
+		ha-rst {
+			gpio = <&cp1_gpio1 25 0 >;
+			output-low;
+		};
+
+		sw-int {
+			gpio = <&cp0_gpio2 1 0>;
+			input;
+		};
+		sw-reset {
+			gpio = <&io_expander0 0 0>;
+			output-high;
+			no-claim;
+		};
+		phy-int {
+			gpio = <&cp0_gpio2 20 0>;
+			input;
+		};
+		phy-reset {
+			gpio = <&io_expander0 1 0>;
+			output-high;
+		};
+
+		dect_jtag_tck: dect-jtag-tck {
+			gpio = <&cp1_gpio1 20 0>;
+			output-low;
+		};
+		dect_jtag_tdi: dect-jtag-tdi {
+			gpio = <&cp1_gpio1 17 0>;
+			output-low;
+		};
+		dect_jtag_tdo: dect-jtag-tdo {
+			gpio = <&cp1_gpio1 18 0>;
+			input;
+		};
+		dect_jtag_tms: dect-jtag-tms {
+			gpio = <&cp1_gpio1 26 0>;
+			output-low;
+		};
+		dect-reset {
+			gpio = <&cp1_gpio1 4 0>;
+			output-low;
+		};
+
+		exp1-rst0 {
+			gpio = <&io_expander0 2 0>;
+			output-low;
+		};
+		exp1-rst1 {
+			gpio = <&io_expander0 3 0>;
+			output-high;
+		};
+		exp1-3v3-en {
+			gpio = <&io_expander0 6 0>;
+			output-low;
+		};
+		exp1-20v-pwren {
+			gpio = <&io_expander0 5 0>;
+			output-low;
+		};
+
+		exp2-rst0 {
+			gpio = <&io_expander1 3 0>;
+			output-low;
+		};
+		exp2-rst1 {
+			gpio = <&io_expander1 1 0>;
+			output-high;
+		};
+		exp2-3v3-en {
+			gpio = <&io_expander1 2 0>;
+			output-low;
+		};
+		exp2-20v-pwren {
+			gpio = <&io_expander1 8 0>;
+			output-low;
+		};
+
+
+		boot-eth {
+			gpio = <&cp0_gpio2 29 0>;
+			input;
+		};
+	};
+
+	/*
+	 * I2C mux isolating LAN SFP, both expansion boards
+	 * Expansion boards branches from each other.
+	 */
+	i2c_bigmux {
+		compatible = "i2c-mux-gpio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		mux-gpios = <&cp1_gpio1 24 0>, /* lan-sfp-i2c-en */
+			<&io_expander1 12 0>, /* exp2-i2c-en */
+			<&io_expander1 13 0>; /* exp1-i2c-en */
+		idle-state = <0x0>;
+		i2c-parent = <&misc_i2c>;
+
+		lan_sfp_i2c: i2c@1 {
+			reg = <0x1>;
+		};
+
+		exp2_ext_i2c: i2c@2 {
+			reg = <0x2>;
+		};
+
+		exp1_ext_i2c: i2c@4 {
+			reg = <0x4>;
+		};
+	};
+
+	jtag_dect {
+		compatible = "fbx,fbxjtag";
+
+		clock-delay = <500>;
+		wait-tms = <0>;
+		data-read-size = <128>;
+		inst-read-size = <128>;
+
+		fbxgpio-tck = <&dect_jtag_tck>;
+		fbxgpio-tdo = <&dect_jtag_tdo>;
+		fbxgpio-tdi = <&dect_jtag_tdi>;
+		fbxgpio-tms = <&dect_jtag_tms>;
+	};
+
+	cp0_i2c1_gpio: cp0_i2c1_gpio {
+		/* aka I2C #1, A8K I2C bus CP0_I2C1 */
+		compatible = "i2c-gpio";
+		gpios = <&cp0_gpio2 3 0 /* sda */
+			 &cp0_gpio2 4 0 /* scl */
+			>;
+		i2c-gpio,delay-us = <2>;	/* ~100 kHz */
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		spd@0x53 {
+			/* SPD eeprom */
+			compatible = "at24,ee1004";
+			reg = <0x53>;
+		};
+	};
+
+	misc_i2c: cp1_mss_i2c {
+		/* aka I2C #2, A8K I2C bus CP1_MSS_I2C */
+		compatible = "i2c-gpio";
+		gpios = <&cp1_gpio1 29 0 /* sda */
+			 &cp1_gpio1 30 0 /* scl */
+			>;
+		i2c-gpio,delay-us = <2>;	/* ~100 kHz */
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+#ifdef USE_PHYLINK_SFP
+	sfp_lan: sfp-lan {
+		compatible = "sff,sfp";
+		i2c-bus = <&lan_sfp_i2c>;
+		maximum-power-milliwatt = <3000>;
+		los-gpios = <&cp1_gpio1 28 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpios = <&cp1_gpio1 27 GPIO_ACTIVE_LOW>;
+		tx-disable-gpios = <&cp0_gpio2 22 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpios = <&cp0_gpio2 21 GPIO_ACTIVE_HIGH>;
+		pwr-enable-gpios = <&io_expander1 7 GPIO_ACTIVE_HIGH>;
+	};
+#endif
+
+	exp1_sfp: exp1-sfp {
+		status = "disabled";
+	};
+
+	exp2_sfp: exp2-sfp {
+		status = "disabled";
+	};
+
+	aliases {
+		/* console */
+		serial0 = &uart0;
+		/* DECT */
+		serial1 = &cp0_uart0;
+		/* EXP2 */
+		serial2 = &cp0_uart1;
+		/* EXP1 */
+		serial3 = &cp0_uart2;
+		/* BT */
+		serial4 = &cp1_uart0;
+		/* HA */
+		serial5 = &cp1_uart2;
+
+		i2c0 = &cp0_i2c0;
+		i2c1 = &cp0_i2c1_gpio;
+		i2c2 = &misc_i2c;
+		i2c3 = &lan_sfp_i2c;
+		i2c4 = &exp2_ext_i2c;
+		i2c5 = &exp1_ext_i2c;
+		i2c6 = &cp0_mss_i2c;
+	};
+};
+
+&cp1_gpio1 {
+	gpio-line-names = "", /* 0 */
+			  "", /* 1 */
+			  "", /* 2 */
+			  "", /* 3 */
+			  "tdm-rst", /* 4 */
+			  "", /* 5 */
+			  "", /* 6 */
+			  "", /* 7 */
+			  "", /* 8 */
+			  "nfc-int", /* 9 */
+			  "lan-sfp-pwrfault", /* 10 */
+			  "", /* 11 */
+			  "", /* 12 */
+			  "", /* 13 */
+			  "", /* 14 */
+			  "", /* 15 */
+			  "", /* 16 */
+			  "dect-jtag-tdi", /* 17 */
+			  "dect-jtag-tdo", /* 18 */
+			  "ha-swd", /* 19 */
+			  "dect-jtag-tck", /* 20 */
+			  "display-swc", /* 21 */
+			  "", /* 22 */
+			  "display-swd", /* 23 */
+			  "lan-sfp-i2c-en", /* 24 */
+			  "ha-reset", /* 25 */
+			  "dect-jtag-tms", /* 26 */
+			  "lan-sfp-presence", /* 27 */
+			  "lan-sfp-rxlos", /* 28 */
+			  "", /* 29 */
+			  "", /* 30 */
+			  "exp1-3v3-pwrfault"; /* 31 */
+};
+
+&cp0_gpio2 {
+	/* starts at offset 32 in cp110-master */
+
+	gpio-line-names = "exp2-3v3-pwrfault", /* 0 */
+			  "sw-int", /* 1 */
+			  "keypad-int", /* 2 */
+			  "", /* 3 */
+			  "", /* 4 */
+			  "", /* 5 */
+			  "", /* 6 */
+			  "", /* 7 */
+			  "", /* 8 */
+			  "", /* 9 */
+			  "", /* 10 */
+			  "", /* 11 */
+			  "ha-swc", /* 12 */
+			  "", /* 13 */
+			  "keypad-rst", /* 14 */
+			  "", /* 15 */
+			  "io-expander-reset", /* 16 */
+			  "", /* 17 */
+			  "", /* 18 */
+			  "", /* 19 */
+			  "phy-int", /* 20 */
+			  "lan-sfp-txfault", /* 21 */
+			  "lan-sfp-txdisable", /* 22 */
+			  "sdr-event", /* 23 */
+			  "fan-alert-int", /* 24 */
+			  "", /* 25 */
+			  "", /* 26 */
+			  "", /* 27 */
+			  "", /* 28 */
+			  "boot-eth", /* 29 */
+			  ""; /* 30 */
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&ap_sdhci0 {
+	status = "okay";
+	bus-width = <8>;
+	non-removable;
+
+	partitions-main {
+		compatible = "fixed-partitions";
+		#address-cells = <2>;
+		#size-cells = <2>;
+		disk-name = "mmcblk%d";
+
+		bank0@0 {
+			label = "bank0";
+			reg = /bits/64 <0 (32 * 1024 * 1024)>;
+			read-only;
+		};
+
+		bank1@0 {
+			label = "bank1";
+			reg = /bits/64 <(-1) (256 * 1024 * 1024)>;
+		};
+
+		nvram@0 {
+			label = "nvram";
+			reg = /bits/64 <(-1) (4 * 1024 * 1024)>;
+		};
+
+		config@0 {
+			label = "config";
+			reg = /bits/64 <(-1) (32 * 1024 * 1024)>;
+		};
+
+		new-bank0@0 {
+			label = "new_bank0";
+			reg = /bits/64 <(-1) (32 * 1024 * 1024)>;
+		};
+
+		fbxmbr@0 {
+			label = "fbxmbr";
+			reg = /bits/64 <(-1) (4096)>;
+		};
+
+		fortknox@0 {
+			label = "fortknox";
+			reg = /bits/64 <(-1) (128 * 1024 * 1024)>;
+		};
+
+		userdata@0 {
+			label = "userdata";
+			reg = /bits/64 <(-1) (-1)>;
+		};
+	};
+
+	partitions-boot {
+		compatible = "fixed-partitions";
+		#address-cells = <2>;
+		#size-cells = <2>;
+		disk-name = "mmcblk%dboot0";
+
+		ipl@0 {
+			label = "ipl";
+			reg = /bits/64 <0 (1 * 1024 * 1024)>;
+			read-only;
+		};
+
+		serial@0 {
+			label = "fbxserial";
+			reg = /bits/64 <(-1) (8 * 1024)>;
+			read-only;
+		};
+
+		randomdata@0 {
+			label = "randomdata";
+			reg = /bits/64 <(-1) (8 * 1024)>;
+			read-only;
+		};
+
+		calibration@0 {
+			label = "calibration";
+			reg = /bits/64 <(-1) (64 * 1024)>;
+			read-only;
+		};
+
+		field-calibration@0 {
+			label = "field_calibration";
+			reg = /bits/64 <(-1) (64 * 1024)>;
+		};
+	};
+
+	partitions-boot1 {
+		compatible = "fixed-partitions";
+		#address-cells = <2>;
+		#size-cells = <2>;
+		disk-name = "mmcblk%dboot1";
+
+		backup-ipl@0 {
+			label = "backup-ipl";
+			reg = /bits/64 <0 (1 * 1024 * 1024)>;
+			read-only;
+		};
+	};
+};
+
+&ap_hwmon {
+	status = "okay";
+	fbx,requires-smc;
+};
+
+&cp0_hwmon {
+	status = "okay";
+};
+
+&cp1_hwmon {
+	status = "okay";
+	fbx,requires-smc;
+};
+
+&cp0_i2c0 {
+	status = "okay";
+	pinctrl-names = "default";
+
+	adt7475@2e {
+		compatible = "adi,adt7475";
+		reg = <0x2e>;
+	};
+
+	io_expander0: exp0@74 {
+		compatible = "nxp,pca9539";
+		reg = <0x74>;
+		gpio-controller;
+		ngpios = <16>;
+		#gpio-cells = <2>;
+		gpio-line-names = "sw-rst", /* 0 */
+				  "phy-rst", /* 1 */
+				  "exp1-rst1", /* 2 */
+				  "exp1-rst2", /* 3 */
+				  "exp1-presence", /* 4 */
+				  "exp1-20v-pwren", /* 5 */
+				  "exp1-3v3-pwren", /* 6 */
+				  "", /* 7 */
+				  "pcie0-rst", /* 8 */
+				  "nfc-en", /* 9 */
+				  "type-c-i2c-en", /* 10 */
+				  "sata0-pwrfault", /* 11 */
+				  "sata1-pwrfault", /* 12 */
+				  "sata0-pwren", /* 13 */
+				  "sata1-pwren", /* 14 */
+				  "usbhub2-rst"; /* 15 */
+	};
+
+	io_expander1: exp1@75 {
+		compatible = "nxp,pca9539";
+		reg = <0x75>;
+		gpio-controller;
+		gpiobase = <300>;
+		ngpios = <16>;
+		#gpio-cells = <2>;
+		gpio-line-names = "exp2-presence", /* 0 */
+				  "exp2-rst1", /* 1 */
+				  "exp2-3v3-en", /* 2 */
+				  "exp2-rst0", /* 3 */
+				  "sata3-pwrfault", /* 4 */
+				  "sata2-pwrfault", /* 5 */
+				  "usbhub3-rst", /* 6 */
+				  "lan-sfp-pwren", /* 7 */
+				  "exp2-20v-pwren", /* 8 */
+				  "pcie2-rst", /* 9 */
+				  "sata3-pwren", /* 10 */
+				  "sata2-pwren", /* 11 */
+				  "exp2-i2c-en", /* 12 */
+				  "exp1-i2c-en", /* 13 */
+				  "pcie1-bt-rst", /* 14 */
+				  "pcie1-rst"; /* 15 */
+	};
+};
+
+&cp0_mss_i2c {
+	status = "okay";
+	pinctrl-0 = <&cp0_mss_i2c_pins>;
+	pinctrl-names = "default";
+
+	ld6710-fbx@68 {
+		compatible = "leadtrend,ld6710-fbx";
+		reg = <0x68>;
+	};
+};
+
+&cp0_ethernet {
+	status = "okay";
+};
+
+&cp0_mdio {
+	status = "okay";
+
+	mv6141: mv6141@16 {
+		compatible = "freebox,fbxgw7r-mv6141";
+		reg = <0>;
+		gpio-reset = <&io_expander0 0 0>;
+	};
+};
+
+
+/*
+ * Internal port to midplane for "EXP2" expansion connector. Can
+ * operate in 10GBase-KR.
+ */
+&cp0_comphy2 {
+	kr-gen1-s0-amplitude = <0x12>;
+	kr-gen1-s0-emphasis = <0x8>;
+	kr-gen1-s2-emphasis = <0x2>;
+
+	kr-ffe-cap-sel = <0xe>;
+	kr-ffe-res-sel = <0x6>;
+	kr-ffe-dfe-res = <0x1>;
+	kr-phase-offset = <0x60>;
+};
+&cp0_eth0 {
+	managed = "in-band-status";
+	status = "okay";
+	phys = <&cp0_comphy2 0>;
+	phy-mode = "1000base-x";
+	mac-address = [00 07 cb 00 00 fd];
+	sfp = <&exp2_sfp>;
+};
+
+/*
+ * Switch uplink port in 2500Base-X.
+ */
+&cp0_eth2 {
+	managed = "in-band-status";
+	status = "okay";
+	phy-mode = "1000base-x";
+	phys = <&cp0_comphy5 2>;
+	fbxserial-mac-address = <0>;
+	mdio-bus = <&cp0_mdio>;
+};
+
+&cp1_ethernet {
+	status = "okay";
+};
+
+/*
+ * 10G Lan port (SFP)
+ */
+&cp1_comphy4 {
+	kr-gen1-s0-amplitude = <0x12>;
+	kr-gen1-s0-emphasis = <0x4>;
+	kr-gen1-s2-emphasis = <0x0>;
+};
+
+&cp1_eth0 {
+	managed = "in-band-status";
+	status = "okay";
+	phys = <&cp1_comphy4 0>;
+	phy-mode = "10gbase-kr";
+	fbxserial-mac-address = <1>;
+#ifdef USE_PHYLINK_SFP
+	sfp = <&sfp_lan>;
+#endif
+};
+
+/*
+ * Internal port to midplane for "EXP1" expansion connector. 1000BaseX
+ * only, not 10G capapable
+ */
+&cp1_eth2 {
+	managed = "in-band-status";
+	status = "okay";
+	phys = <&cp1_comphy5 2>;
+	phy-mode = "1000base-x";
+	mac-address = [00 07 cb 00 00 fd];
+	sfp = <&exp1_sfp>;
+};
+
+&cp0_comphy1 {
+	sata-gen3-s0-amplitude = <0x15>;
+	sata-gen3-s0-emphasis = <0x7>;
+	sata-gen3-s4-dfe-res = <0x1>;
+	sata-phase-offset = <0x61>;
+};
+
+&cp0_comphy3 {
+	sata-gen3-s0-amplitude = <0x15>;
+	sata-gen3-s0-emphasis = <0x5>;
+	sata-gen3-s4-dfe-res = <0x1>;
+	sata-phase-offset = <0x61>;
+};
+
+&cp0_sata0 {
+	status = "okay";
+	comreset_u = <0x17>;
+	comwake = <0x6>;
+
+	sata-port@0 {
+		status = "okay";
+		reg = <0>;
+		phys = <&cp0_comphy1 0>;
+	};
+	sata-port@1 {
+		status = "okay";
+		reg = <1>;
+		phys = <&cp0_comphy3 1>;
+	};
+};
+
+&cp1_comphy2 {
+	sata-gen3-s0-amplitude = <0x14>;
+	sata-gen3-s0-emphasis = <0x5>;
+	sata-gen3-s4-dfe-res = <0x1>;
+	sata-phase-offset = <0x61>;
+};
+
+&cp1_comphy3 {
+	sata-gen3-s0-amplitude = <0x14>;
+	sata-gen3-s0-emphasis = <0x5>;
+	sata-gen3-s4-dfe-res = <0x1>;
+	sata-phase-offset = <0x61>;
+};
+
+&cp1_sata0 {
+	status = "okay";
+	comreset_u = <0x17>;
+	comwake = <0x6>;
+
+	sata-port@1 {
+		status = "okay";
+		reg = <1>;
+		phys = <&cp1_comphy3 1>;
+	};
+	sata-port@0 {
+		status = "okay";
+		reg = <0>;
+		phys = <&cp1_comphy2 0>;
+	};
+};
+
+&cp0_usb3_1 {
+	status = "okay";
+
+	phys = <&cp0_utmi 0>;
+	phy-names = "usb2";
+};
+
+&cp1_usb3_0 {
+	status = "okay";
+
+	phys = <&cp1_comphy1 0>,
+		<&cp1_utmi 0>;
+	phy-names = "usb3", "usb2";
+};
+
+&cp0_pcie0 {
+	/*
+	 * WiFi 5.0Ghz
+	 */
+	status = "okay";
+	num-lanes = <1>;
+
+	phys = <&cp0_comphy0 0>;
+	phy-names = "lane0";
+
+	reset-gpios = <&io_expander0 8 0>;
+};
+
+&cp0_pcie1 {
+	/*
+	 * WiFi Listen
+	 */
+	status = "okay";
+	num-lanes = <1>;
+
+	phys = <&cp0_comphy4 1>;
+	phy-names = "lane0";
+
+	reset-gpio = <&io_expander1 9 0>;
+};
+
+&cp1_pcie0 {
+	/*
+	 * WiFi 2.4 Ghz
+	 */
+	status = "okay";
+	num-lanes = <1>;
+
+	phys = <&cp1_comphy0 0>;
+	phy-names = "lane0";
+	reset-gpio = <&io_expander1 15 0>, <&io_expander1 14 0>;
+};
+
+&cp0_spi0 {
+	status = "okay";
+	pinctrl-0 = <&cp0_spi0_pins>;
+	pinctrl-names = "default";
+
+	spi-slac@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "microsemi,le9641";
+		reg = <0>;
+		spi-max-frequency = <5000000>;
+	};
+};
+
+&cp1_spi1 {
+	status = "okay";
+	pinctrl-0 = <&cp1_spi1_pins>;
+	pinctrl-names = "default";
+};
+
+&cp0_pinctrl {
+	/* DECT */
+	cp0_uart0_pins: uart0-pins-0 {
+		marvell,pins = "mpp45", "mpp62";
+		marvell,function = "uart0";
+	};
+	/* EXP2 */
+	cp0_uart1_pins: uart1-pins-0 {
+		marvell,pins = "mpp59", "mpp60";
+		marvell,function = "uart1";
+	};
+	/* EXP1 */
+	cp0_uart2_pins: uart2-pins-0 {
+		marvell,pins = "mpp50", "mpp51";
+		marvell,function = "uart2";
+	};
+	/* SPI SLAC */
+	cp0_spi0_pins: spi0-pins-0 {
+		marvell,pins = "mpp39", "mpp40", "mpp41", "mpp42", "mpp43";
+		marvell,function = "spi0";
+	};
+	cp0_mss_i2c_pins: mss-i2c-pins-0 {
+		marvell,pins = "mpp57", "mpp58";
+		marvell,function = "mss_i2c";
+	};
+};
+
+&cp1_pinctrl {
+	cp1_mss_i2c_pins: mss-i2c-pins-0 {
+		marvell,pins = "mpp29", "mpp30";
+		marvell,function = "mss_i2c";
+	};
+	cp1_spi1_pins: spi1-pins-0 {
+		marvell,pins = "mpp12", "mpp13", "mpp14", "mpp15", "mpp16";
+		marvell,function = "spi1";
+	};
+	cp1_tdm0_pins: tdm0-pins-0 {
+		marvell,pins = "mpp0", "mpp1", "mpp2", "mpp3", "mpp5";
+		marvell,function = "tdm";
+	};
+	/* BT */
+	cp1_uart0_pins: uart0-pins-0 {
+		marvell,pins = "mpp6", "mpp7";
+		marvell,function = "uart0";
+	};
+	/* HA */
+	cp1_uart2_pins: uart2-pins-0 {
+		marvell,pins = "mpp8", "mpp11";
+		marvell,function = "uart2";
+	};
+};
+
+/* DECT */
+&cp0_uart0 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_uart0_pins>;
+};
+
+/* EXP2 */
+&cp0_uart1 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_uart1_pins>;
+};
+
+/* EXP1 */
+&cp0_uart2 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_uart2_pins>;
+};
+
+&cp1_tdm0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp1_tdm0_pins>;
+	status = "okay";
+	pclk-freq-mhz = <2>;
+};
+
+/* BT */
+&cp1_uart0 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp1_uart0_pins>;
+};
+
+/* HA */
+&cp1_uart2 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp1_uart2_pins>;
+};
+
+&cp1_trng {
+	/* secure TRNG on fbxgw7r */
+	status = "foutu";
+};
+
+&cp1_clk {
+	fbx,ignore-eip150;
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/fbxgw7r.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,23 @@
+#include <dt-bindings/input/linux-event-codes.h>
+#include <dt-bindings/gpio/gpio.h>
+
+#include "armada-8040.dtsi"
+
+#include "fbxgw7r-common.dtsi"
+
+/ {
+	model = "Freebox V7R Board";
+	compatible = "freebox,fbxgw7r", "marvell,armada8040",
+		     "marvell,armada-ap806-quad", "marvell,armada-ap806";
+};
+
+&cp0_spi0 {
+	spi-panel@1 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "freebox,fbxgw7r-panel";
+		reg = <1>;
+		spi-max-frequency = <(750 * 1000)>;
+		irq-gpio = <&cp0_gpio2 2 0>;
+	};
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/fbxgw7r_exp1_dsl_lte.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,33 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "freebox,fbxgw7r";
+
+    fragment@0 {
+	target-path="/";
+        __overlay__ {
+		fbxatm-remote@0 {
+			compatible = "freebox,fbxatm-remote";
+			mac-address = [00 07 cb 00 00 fe];
+			netdev-name = "bcmfbxatm0";
+			remote-name = "bcm63xx_fbxxtm0";
+		};
+        };
+    };
+
+    fragment@1 {
+	target = <&cp1_spi1>;
+        __overlay__ {
+		#address-cells = <0x1>;
+		#size-cells = <0x0>;
+
+		exp1-flash@1 {
+			compatible = "m25p80";
+			reg = <1>;
+			spi-max-frequency = <(1 * 1000 * 1000)>;
+			label = "exp1-spi-flash";
+		};
+	};
+    };
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/fbxgw7r_exp1_ftth_p2p.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,4 @@
+#undef USE_PHYLINK_SFP
+
+#define EXP_SLOT		exp1
+#include "fbxgw7r_expX_ftth_p2p.dts"
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/fbxgw7r_exp1_test_module.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,4 @@
+#define EXP_SLOT		exp1
+#define EXP_SPI_FLASH_LABEL	"exp1-spi-flash"
+#define EXP_SPI_FLASH_CS	1
+#include "fbxgw7r_expX_test_module.dts"
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/fbxgw7r_exp2_ftth_p2p.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,4 @@
+#undef USE_PHYLINK_SFP
+
+#define EXP_SLOT	exp2
+#include "fbxgw7r_expX_ftth_p2p.dts"
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/fbxgw7r_exp2_ftth_pon.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,13 @@
+#include <dt-bindings/gpio/gpio.h>
+
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "freebox,fbxgw7r";
+    fragment@0 {
+	target-path="/";
+        __overlay__ {
+	};
+    };	
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/fbxgw7r_exp2_test_module.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,4 @@
+#define EXP_SLOT		exp2
+#define EXP_SPI_FLASH_LABEL	"exp2-spi-flash"
+#define EXP_SPI_FLASH_CS	0
+#include "fbxgw7r_expX_test_module.dts"
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/fbxgw7r_exp_common.dtsi	2021-03-04 13:20:57.014172187 +0100
@@ -0,0 +1,5 @@
+#define PASTER(x, y) x ## y
+#define EVALUATOR(x, y) PASTER(x, y)
+#define EXP_LABEL(name) EVALUATOR(EXP_SLOT, EVALUATOR(_, name))
+#define EXP_NODE_NAME(name) EVALUATOR(EXP_SLOT, EVALUATOR(-, name))
+#define ADDRESSIFY(addr) EVALUATOR(0x, addr)
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/fbxgw7r_expX_ftth_p2p.dts	2021-03-04 13:20:57.014172187 +0100
@@ -0,0 +1,156 @@
+#include <dt-bindings/gpio/gpio.h>
+
+#include "fbxgw7r_exp_common.dtsi"
+
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "freebox,fbxgw7r";
+
+    fragment@0 {
+	target = <&EXP_LABEL(ext_i2c)>;
+        __overlay__ {
+		#address-cells = <0x1>;
+		#size-cells = <0x0>;
+
+		// IO expander found only on P2P Fiber
+		// expansion board.
+		EXP_LABEL(gpio_extender): EXP_NODE_NAME(gpio_extender)@74 {
+			compatible = "nxp,pca9539";
+			reg = <0x74>;
+			gpio-controller;
+			ngpios = <16>;
+			#gpio-cells = <2>;
+			gpio-line-names = "wan-sfp-pwren", /* 0 */
+				"wan-sfp-pwrgood", /* 1 */
+				"wan-sfp-txfault", /* 2 */
+				"wan-sfp-txdisable", /* 3 */
+				"wan-sfp-presence", /* 4 */
+				"wan-sfp-rxlos", /* 5 */
+				"wan-sfp-led", /* 6 */
+				"wan-sfp-i2cen", /* 7 */
+				"redriver-eqb", /* 8 */
+				"redriver-fgb", /* 9 */
+				"redriver-swb", /* 10 */
+				"redriver-eqa", /* 11 */
+				"redriver-fga", /* 12 */
+				"redriver-swa", /* 13 */
+				"redriver-mode", /* 14 */
+				"redriver-enable"; /* 15 */
+		};
+        };
+    };
+
+     fragment@1 {
+	target-path="/";
+        __overlay__ {
+		EXP_NODE_NAME(ftth-p2p-fbxgpio) {
+			compatible = "fbx,fbxgpio";
+			EXP_NODE_NAME(ftth-p2p-sfp-pwren) {
+				gpio = <&EXP_LABEL(gpio_extender) 0 0>;
+				output-low;
+#ifdef USE_PHYLINK_SFP
+				no-claim;
+#endif
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-pwrgood) {
+				gpio = <&EXP_LABEL(gpio_extender) 1 0>;
+				input;
+#ifdef USE_PHYLINK_SFP
+				no-claim;
+#endif
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-txfault) {
+				gpio = <&EXP_LABEL(gpio_extender) 2 0>;
+				input;
+#ifdef USE_PHYLINK_SFP
+				no-claim;
+#endif
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-txdis) {
+				gpio = <&EXP_LABEL(gpio_extender) 3 0>;
+				output-high;
+#ifdef USE_PHYLINK_SFP
+				no-claim;
+#endif
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-presence) {
+				gpio = <&EXP_LABEL(gpio_extender) 4 0>;
+				input;
+#ifdef USE_PHYLINK_SFP
+				no-claim;
+#endif
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-rxlos) {
+				gpio = <&EXP_LABEL(gpio_extender) 5 0>;
+				input;
+#ifdef USE_PHYLINK_SFP
+				no-claim;
+#endif
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-link-led) {
+				gpio = <&EXP_LABEL(gpio_extender) 6 GPIO_ACTIVE_LOW>;
+				output-low;
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-i2cen) {
+				gpio = <&EXP_LABEL(gpio_extender) 7 0>;
+				/* enable it by default, revisit later */
+				output-high;
+			};
+
+			EXP_NODE_NAME(ftth-p2p-redriver-eqb) {
+				gpio = <&EXP_LABEL(gpio_extender) 8 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-fgb) {
+				gpio = <&EXP_LABEL(gpio_extender) 9 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-swb) {
+				gpio = <&EXP_LABEL(gpio_extender) 10 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-eqa) {
+				gpio = <&EXP_LABEL(gpio_extender) 11 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-fga) {
+				gpio = <&EXP_LABEL(gpio_extender) 12 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-swa) {
+				gpio = <&EXP_LABEL(gpio_extender) 13 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-mode) {
+				gpio = <&EXP_LABEL(gpio_extender) 14 0>;
+				output-low;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-en) {
+				gpio = <&EXP_LABEL(gpio_extender) 15 0>;
+				output-low;
+			};
+		};
+        };
+    };
+
+#ifdef USE_PHYLINK_SFP
+    fragment@2 {
+	target = <&EXP_LABEL(sfp)>;
+	__overlay__ {
+		status = "okay";
+		compatible = "sff,sfp";
+		i2c-bus = <&EXP_LABEL(ext_i2c)>;
+		maximum-power-milliwatt = <3000>;
+		los-gpios = <&EXP_LABEL(gpio_extender) 5 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpios = <&EXP_LABEL(gpio_extender) 4 GPIO_ACTIVE_LOW>;
+		tx-disable-gpios = <&EXP_LABEL(gpio_extender) 3 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpios = <&EXP_LABEL(gpio_extender) 2 GPIO_ACTIVE_HIGH>;
+		pwr-enable-gpios = <&EXP_LABEL(gpio_extender) 0 GPIO_ACTIVE_HIGH>;
+	};
+    };
+#endif
+
+
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/fbxgw7r_expX_test_module.dts	2021-03-04 13:20:57.014172187 +0100
@@ -0,0 +1,99 @@
+#include <dt-bindings/gpio/gpio.h>
+
+#include "fbxgw7r_exp_common.dtsi"
+
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "freebox,fbxgw7r";
+
+    fragment@0 {
+	target = <&EXP_LABEL(ext_i2c)>;
+        __overlay__ {
+		#address-cells = <0x1>;
+		#size-cells = <0x0>;
+
+		EXP_LABEL(gpio_extender): exp1@74 {
+			compatible = "nxp,pca9539";
+			reg = <0x74>;
+			gpio-controller;
+			ngpios = <16>;
+			#gpio-cells = <2>;
+			gpio-line-names = "sfp-pwren", /* 0 */
+				"sfp-pwrgood", /* 1 */
+				"sfp-txfault", /* 2 */
+				"sfp-txdisable", /* 3 */
+				"sfp-presence", /* 4 */
+				"sfp-rxlos", /* 5 */
+				"sfp-led", /* 6 */
+				"sfp-i2cen", /* 7 */
+				"", /* 8 */
+				"", /* 9 */
+				"", /* 10 */
+				"", /* 11 */
+				"", /* 12 */
+				"", /* 13 */
+				"", /* 14 */
+				""; /* 15 */
+		};
+        };
+    };
+
+     fragment@1 {
+	target-path="/";
+        __overlay__ {
+		EXP_NODE_NAME(test-module-fbxgpio) {
+			compatible = "fbx,fbxgpio";
+			EXP_NODE_NAME(test-module-sfp-pwren) {
+				gpio = <&EXP_LABEL(gpio_extender) 0 0>;
+				output-low;
+			};
+			EXP_NODE_NAME(test-module-sfp-pwrgood) {
+				gpio = <&EXP_LABEL(gpio_extender) 1 0>;
+				input;
+			};
+			EXP_NODE_NAME(test-module-sfp-txfault) {
+				gpio = <&EXP_LABEL(gpio_extender) 2 0>;
+				input;
+			};
+			EXP_NODE_NAME(test-module-sfp-txdis) {
+				gpio = <&EXP_LABEL(gpio_extender) 3 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(test-module-sfp-presence) {
+				gpio = <&EXP_LABEL(gpio_extender) 4 0>;
+				input;
+			};
+			EXP_NODE_NAME(test-module-sfp-rxlos) {
+				gpio = <&EXP_LABEL(gpio_extender) 5 0>;
+				input;
+			};
+			EXP_NODE_NAME(test-module-sfp-link-led) {
+				gpio = <&EXP_LABEL(gpio_extender) 6 GPIO_ACTIVE_LOW>;
+				output-low;
+			};
+			EXP_NODE_NAME(test-module-sfp-i2cen) {
+				gpio = <&EXP_LABEL(gpio_extender) 7 0>;
+				/* enable it by default, revisit later */
+				output-high;
+			};
+		};
+        };
+    };
+
+    fragment@2 {
+	target = <&cp1_spi1>;
+        __overlay__ {
+		#address-cells = <0x1>;
+		#size-cells = <0x0>;
+
+		EXP_NODE_NAME(flash)@1 {
+			compatible = "m25p80";
+			reg = <EXP_SPI_FLASH_CS>;
+			spi-max-frequency = <(1 * 1000 * 1000)>;
+			label = EXP_SPI_FLASH_LABEL;
+		};
+	};
+    };
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/jbxgw7r.dts	2021-03-04 13:20:57.014172187 +0100
@@ -0,0 +1,114 @@
+#include <dt-bindings/input/linux-event-codes.h>
+#include <dt-bindings/gpio/gpio.h>
+
+#include "armada-8040.dtsi"
+
+#define USE_PHYLINK_SFP
+
+#include "fbxgw7r-common.dtsi"
+
+/ {
+	model = "Freebox JaguarBox V7R Board";
+	compatible = "freebox,jbxgw7r", "marvell,armada8040",
+		     "marvell,armada-ap806-quad", "marvell,armada-ap806";
+
+	fbx7r-fbxgpio {
+		pos-sense {
+			gpio = <&io_expander0 7 0>;
+			input;
+		};
+	};
+};
+
+
+&cp0_spi0 {
+	ssd1327@1 {
+		compatible = "solomon,ssd1327";
+		status = "okay";
+		reg = <1>;
+		spi-max-frequency = <(5 * 1000 * 1000)>;
+		ssd1327,width = <128>;
+		ssd1327,height = <128>;
+		ssd1327,rotate = <270>;
+		ssd1327,watchdog = <300>;
+
+		ssd1327,data-select-gpio = <&cp1_gpio1 23 GPIO_ACTIVE_HIGH>;
+		ssd1327,vcc-gpio = <&cp0_gpio2 14 GPIO_ACTIVE_HIGH>;
+		ssd1327,reset-gpio = <&cp1_gpio1 21 0>;
+		ssd1327,init-sequence = "p32202";
+	};
+};
+
+
+&cp0_i2c0 {
+        cap1066@28 {
+		/* SMSC cap1066 */
+		compatible = "smsc,smsc_cap1066";
+		reg = <0x28>;
+		keymap = <KEY_DOWN
+			  KEY_LEFT
+			  KEY_UP
+			  0
+			  KEY_ENTER
+			  KEY_RIGHT>;
+	};
+
+	led1202@58 {
+		compatible = "st,led1202";
+		reg = <0x58>;
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		blue@0 {
+			label = "front-d67-blue";
+			reg = <0>;
+		};
+		green@1 {
+			label = "front-d67-green";
+			reg = <1>;
+		};
+		red@2 {
+			label = "front-d67-red";
+			reg = <2>;
+		};
+	};
+
+	led1202@59 {
+		compatible = "st,led1202";
+		reg = <0x59>;
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		blue@0 {
+			label = "rear-d1-red";
+			reg = <0>;
+		};
+		green@1 {
+			label = "rear-d1-green";
+			reg = <1>;
+		};
+		red@2 {
+			label = "rear-d1-blue";
+			reg = <2>;
+		};
+	};
+};
+
+/*
+ * for routing comfort on the midplane, rx & tx lanes polarity is swapped
+ * on jbxgw7r's expansion 1 backplane serdes.
+ */
+&cp1_comphy5 {
+	rx-swap-polarity;
+	tx-swap-polarity;
+};
+
+
+/*
+ * CP1 sata is completely unused on jbxgw7r.
+ */
+&cp1_sata0 {
+	status = "disabled";
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/jbxgw7r_exp1_ftth_p2p.dts	2021-03-04 13:20:57.014172187 +0100
@@ -0,0 +1,4 @@
+#define USE_PHYLINK_SFP
+
+#define EXP_SLOT		exp1
+#include "fbxgw7r_expX_ftth_p2p.dts"
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/arch/arm64/boot/dts/marvell/jbxgw7r_exp2_ftth_p2p.dts	2021-03-04 13:20:57.014172187 +0100
@@ -0,0 +1,4 @@
+#define USE_PHYLINK_SFP
+
+#define EXP_SLOT		exp2
+#include "fbxgw7r_expX_ftth_p2p.dts"
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/block/partitions/dt.c	2021-03-04 13:20:57.500838876 +0100
@@ -0,0 +1,205 @@
+#define PREFIX "dtparts"
+
+#include <linux/kernel.h>
+#include <linux/of.h>
+#include <linux/ctype.h>
+#include "check.h"
+#include "dt.h"
+
+/**
+ * match_one: - Determines if a string matches a simple pattern
+ * @s: the string to examine for presence of the pattern
+ * @p: the string containing the pattern
+ */
+static int match_one(char *s, const char *p)
+{
+	char *meta, *from, *to;
+
+	while (1) {
+		int len = -1;
+
+		meta = strchr(p, '%');
+		if (!meta)
+			return strcmp(p, s) == 0;
+
+		if (strncmp(p, s, meta-p))
+			return 0;
+
+		s += meta - p;
+		p = meta + 1;
+
+		if (isdigit(*p))
+			len = simple_strtoul(p, (char **) &p, 10);
+		else if (*p == '%') {
+			if (*s++ != '%')
+				return 0;
+			p++;
+			continue;
+		}
+
+		from = s;
+		switch (*p++) {
+		case 's': {
+			size_t str_len = strlen(s);
+
+			if (str_len == 0)
+				return 0;
+			if (len == -1 || len > str_len)
+				len = str_len;
+			to = s + len;
+			break;
+		}
+		case 'd':
+			simple_strtol(s, &to, 0);
+			goto num;
+		case 'u':
+			simple_strtoul(s, &to, 0);
+			goto num;
+		case 'o':
+			simple_strtoul(s, &to, 8);
+			goto num;
+		case 'x':
+			simple_strtoul(s, &to, 16);
+
+		num:
+			if (to == from)
+				return 0;
+			break;
+		default:
+			return 0;
+		}
+		s = to;
+	}
+}
+
+/*
+ *
+ */
+static struct device_node *find_first_parent_node(const struct device *ddev)
+{
+	while (ddev && !ddev->of_node)
+		ddev = ddev->parent;
+
+	if (!ddev)
+		return NULL;
+	return ddev->of_node;
+}
+
+/*
+ *
+ */
+int dt_partition(struct parsed_partitions *state)
+{
+	struct device *ddev = disk_to_dev(state->bdev->bd_disk);
+	struct device_node *np, *part_node, *pp;
+	u64 disk_size, last_end;
+	int nr_parts, i;
+
+	/* find first parent device with a non null device tree
+	 * node */
+	np = find_first_parent_node(ddev);
+	if (!np)
+		return -1;
+
+	part_node = NULL;
+	for_each_child_of_node(np, pp) {
+		char diskname[BDEVNAME_SIZE];
+		const char *pattern;
+
+		if (!of_device_is_compatible(pp, "fixed-partitions"))
+			continue;
+
+		/* check device name match pattern */
+		bdevname(state->bdev, diskname);
+
+		if (of_property_read_string(pp, "disk-name", &pattern)) {
+			part_node = pp;
+			break;
+		}
+
+		if (match_one(diskname, pattern)) {
+			part_node = pp;
+			break;
+		}
+	}
+
+	if (!part_node)
+		return -1;
+
+	/* First count the subnodes */
+	nr_parts = 0;
+	for_each_child_of_node(part_node,  pp)
+		nr_parts++;
+
+	if (nr_parts == 0)
+		return 0;
+
+	disk_size = get_capacity(state->bdev->bd_disk) << 9;
+
+	last_end = 0;
+	i = 1;
+	for_each_child_of_node(part_node,  pp) {
+		struct partition_meta_info *info;
+		char tmp[sizeof (info->volname) + 4];
+		const __be32 *reg;
+		const char *partname;
+		int a_cells, s_cells;
+		u64 size, offset;
+		int len;
+
+		reg = of_get_property(pp, "reg", &len);
+		if (!reg) {
+			pr_err("part %pOF (%pOF) missing reg property.\n",
+			       pp, np);
+			return -1;
+		}
+
+		a_cells = of_n_addr_cells(pp);
+		s_cells = of_n_size_cells(pp);
+		if (len / 4 != a_cells + s_cells) {
+			pr_err("ofpart partition %pOF (%pOF) "
+			       "error parsing reg property.\n",
+			       pp, np);
+			return -1;
+		}
+
+		partname = of_get_property(pp, "label", &len);
+		if (!partname)
+			partname = of_get_property(pp, "name", &len);
+
+		if (i >= state->limit) {
+			pr_err("too many partitions\n");
+			return -1;
+		}
+
+		offset = of_read_number(reg, a_cells);
+		if (offset == (u64)-1) {
+			offset = last_end;
+		}
+
+		size = of_read_number(reg + a_cells, s_cells);
+		if (size == (u64)-1)
+			size = disk_size - offset;
+
+		last_end = offset + size;
+		put_partition(state, i, offset >> 9, size >> 9);
+
+		info = &state->parts[i].info;
+		strlcpy(info->volname, partname, sizeof (info->volname));
+		state->parts[i].has_info = true;
+
+		if (!IS_ENABLED(CONFIG_OF_PARTITION_IGNORE_RO) &&
+		    of_get_property(pp, "read-only", &len))
+			state->parts[i].flags |= ADDPART_FLAG_RO;
+
+		snprintf(tmp, sizeof(tmp), "(%s/%s)",
+			 info->volname,
+			 state->parts[i].flags ? "ro" : "rw");
+		strlcat(state->pp_buf, tmp, PAGE_SIZE);
+
+		i++;
+	}
+
+	strlcat(state->pp_buf, "\n", PAGE_SIZE);
+	return 1;
+}
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/block/partitions/dt.h	2021-03-04 13:20:57.500838876 +0100
@@ -0,0 +1 @@
+int dt_partition(struct parsed_partitions *);
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/config	2021-04-21 11:47:47.761889932 +0200
@@ -0,0 +1,4380 @@
+#
+# Automatically generated file; DO NOT EDIT.
+# Linux/arm64 5.4.60 Kernel Configuration
+#
+
+#
+# Compiler: aarch64-linux-musl-gcc (freebox) 10.2.0
+#
+CONFIG_CC_IS_GCC=y
+CONFIG_GCC_VERSION=100200
+CONFIG_CLANG_VERSION=0
+CONFIG_CC_CAN_LINK=y
+CONFIG_CC_HAS_ASM_GOTO=y
+CONFIG_CC_HAS_ASM_INLINE=y
+CONFIG_CONSTRUCTORS=y
+CONFIG_IRQ_WORK=y
+CONFIG_BUILDTIME_EXTABLE_SORT=y
+CONFIG_THREAD_INFO_IN_TASK=y
+
+#
+# General setup
+#
+CONFIG_INIT_ENV_ARG_LIMIT=32
+CONFIG_CROSS_COMPILE="/opt/toolchains/aarch64-musl-1.2.2-gcc-10.2.0-binutils-2.36-gdb-7.12.1-2/bin/aarch64-linux-musl-"
+# CONFIG_COMPILE_TEST is not set
+CONFIG_LOCALVERSION=""
+CONFIG_LOCALVERSION_AUTO=y
+CONFIG_BUILD_SALT=""
+CONFIG_DEFAULT_HOSTNAME="(none)"
+# CONFIG_SWAP is not set
+CONFIG_SYSVIPC=y
+CONFIG_SYSVIPC_SYSCTL=y
+# CONFIG_POSIX_MQUEUE is not set
+# CONFIG_CROSS_MEMORY_ATTACH is not set
+# CONFIG_USELIB is not set
+CONFIG_AUDIT=y
+CONFIG_HAVE_ARCH_AUDITSYSCALL=y
+CONFIG_AUDITSYSCALL=y
+
+#
+# IRQ subsystem
+#
+CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_GENERIC_MSI_IRQ=y
+CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_SPARSE_IRQ=y
+# CONFIG_GENERIC_IRQ_DEBUGFS is not set
+# end of IRQ subsystem
+
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_ARCH_CLOCKSOURCE_DATA=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_ARCH_HAS_TICK_BROADCAST=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+
+#
+# Timers subsystem
+#
+CONFIG_TICK_ONESHOT=y
+CONFIG_HZ_PERIODIC=y
+# CONFIG_NO_HZ_IDLE is not set
+# CONFIG_NO_HZ_FULL is not set
+# CONFIG_NO_HZ is not set
+CONFIG_HIGH_RES_TIMERS=y
+# end of Timers subsystem
+
+CONFIG_PREEMPT_NONE=y
+# CONFIG_PREEMPT_VOLUNTARY is not set
+# CONFIG_PREEMPT is not set
+CONFIG_PREEMPT_COUNT=y
+
+#
+# CPU/Task time and stats accounting
+#
+CONFIG_TICK_CPU_ACCOUNTING=y
+# CONFIG_VIRT_CPU_ACCOUNTING_GEN is not set
+CONFIG_IRQ_TIME_ACCOUNTING=y
+CONFIG_HAVE_SCHED_AVG_IRQ=y
+# CONFIG_BSD_PROCESS_ACCT is not set
+# CONFIG_TASKSTATS is not set
+# CONFIG_PSI is not set
+# end of CPU/Task time and stats accounting
+
+# CONFIG_CPU_ISOLATION is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_TREE_RCU=y
+# CONFIG_RCU_EXPERT is not set
+CONFIG_SRCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_RCU_STALL_COMMON=y
+CONFIG_RCU_NEED_SEGCBLIST=y
+# end of RCU Subsystem
+
+CONFIG_IKCONFIG=y
+# CONFIG_IKCONFIG_PROC is not set
+# CONFIG_IKHEADERS is not set
+CONFIG_LOG_BUF_SHIFT=18
+CONFIG_LOG_CPU_MAX_BUF_SHIFT=12
+CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT=13
+# CONFIG_FBX_DECRYPT_INITRD is not set
+CONFIG_GENERIC_SCHED_CLOCK=y
+
+#
+# Scheduler features
+#
+# end of Scheduler features
+
+CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y
+CONFIG_ARCH_SUPPORTS_INT128=y
+CONFIG_CGROUPS=y
+# CONFIG_MEMCG is not set
+# CONFIG_BLK_CGROUP is not set
+# CONFIG_CGROUP_SCHED is not set
+# CONFIG_CGROUP_PIDS is not set
+# CONFIG_CGROUP_RDMA is not set
+# CONFIG_CGROUP_FREEZER is not set
+# CONFIG_CPUSETS is not set
+# CONFIG_CGROUP_DEVICE is not set
+# CONFIG_CGROUP_CPUACCT is not set
+# CONFIG_CGROUP_PERF is not set
+# CONFIG_CGROUP_DEBUG is not set
+CONFIG_NAMESPACES=y
+CONFIG_UTS_NS=y
+CONFIG_IPC_NS=y
+# CONFIG_USER_NS is not set
+# CONFIG_PID_NS is not set
+CONFIG_NET_NS=y
+# CONFIG_CHECKPOINT_RESTORE is not set
+# CONFIG_SCHED_AUTOGROUP is not set
+# CONFIG_SYSFS_DEPRECATED is not set
+CONFIG_RELAY=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_INITRAMFS_SOURCE=""
+# CONFIG_INITRAMFS_FORCE is not set
+# CONFIG_RD_GZIP is not set
+# CONFIG_RD_BZIP2 is not set
+# CONFIG_RD_LZMA is not set
+# CONFIG_RD_XZ is not set
+# CONFIG_RD_LZO is not set
+# CONFIG_RD_LZ4 is not set
+CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
+# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+CONFIG_SYSCTL=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_BPF=y
+CONFIG_EXPERT=y
+CONFIG_MULTIUSER=y
+# CONFIG_SGETMASK_SYSCALL is not set
+# CONFIG_SYSFS_SYSCALL is not set
+# CONFIG_SYSCTL_SYSCALL is not set
+# CONFIG_FHANDLE is not set
+CONFIG_POSIX_TIMERS=y
+CONFIG_PRINTK=y
+CONFIG_PRINTK_NMI=y
+CONFIG_BUG=y
+CONFIG_ELF_CORE=y
+CONFIG_BASE_FULL=y
+CONFIG_FUTEX=y
+CONFIG_FUTEX_PI=y
+CONFIG_EPOLL=y
+CONFIG_SIGNALFD=y
+CONFIG_TIMERFD=y
+CONFIG_EVENTFD=y
+CONFIG_SHMEM=y
+CONFIG_AIO=y
+# CONFIG_IO_URING is not set
+CONFIG_ADVISE_SYSCALLS=y
+CONFIG_MEMBARRIER=y
+CONFIG_KALLSYMS=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_KALLSYMS_BASE_RELATIVE=y
+# CONFIG_BPF_SYSCALL is not set
+# CONFIG_USERFAULTFD is not set
+CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y
+# CONFIG_RSEQ is not set
+CONFIG_EMBEDDED=y
+CONFIG_HAVE_PERF_EVENTS=y
+# CONFIG_PC104 is not set
+
+#
+# Kernel Performance Events And Counters
+#
+CONFIG_PERF_EVENTS=y
+# CONFIG_DEBUG_PERF_USE_VMALLOC is not set
+# end of Kernel Performance Events And Counters
+
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_SLUB_DEBUG=y
+CONFIG_COMPAT_BRK=y
+# CONFIG_SLAB is not set
+CONFIG_SLUB=y
+# CONFIG_SLOB is not set
+CONFIG_SLAB_MERGE_DEFAULT=y
+# CONFIG_SLAB_FREELIST_RANDOM is not set
+# CONFIG_SLAB_FREELIST_HARDENED is not set
+# CONFIG_SHUFFLE_PAGE_ALLOCATOR is not set
+CONFIG_SLUB_CPU_PARTIAL=y
+# CONFIG_PROFILING is not set
+# end of General setup
+
+CONFIG_ARM64=y
+CONFIG_64BIT=y
+CONFIG_MMU=y
+CONFIG_ARM64_PAGE_SHIFT=12
+CONFIG_ARM64_CONT_SHIFT=4
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=24
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_LOCKDEP_SUPPORT=y
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_HWEIGHT=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_ZONE_DMA32=y
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
+CONFIG_SMP=y
+CONFIG_KERNEL_MODE_NEON=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_ARCH_SUPPORTS_UPROBES=y
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_KASAN_SHADOW_OFFSET=0xdfffffd000000000
+
+#
+# Platform selection
+#
+# CONFIG_ARCH_ACTIONS is not set
+# CONFIG_ARCH_AGILEX is not set
+# CONFIG_ARCH_SUNXI is not set
+# CONFIG_ARCH_ALPINE is not set
+# CONFIG_ARCH_BCM2835 is not set
+# CONFIG_ARCH_BCM_IPROC is not set
+# CONFIG_ARCH_BCM63XX is not set
+# CONFIG_ARCH_BERLIN is not set
+# CONFIG_ARCH_BITMAIN is not set
+# CONFIG_ARCH_BRCMSTB is not set
+# CONFIG_ARCH_EXYNOS is not set
+# CONFIG_ARCH_K3 is not set
+# CONFIG_ARCH_LAYERSCAPE is not set
+# CONFIG_ARCH_LG1K is not set
+# CONFIG_ARCH_HISI is not set
+# CONFIG_ARCH_MEDIATEK is not set
+# CONFIG_ARCH_MESON is not set
+CONFIG_ARCH_MVEBU=y
+# CONFIG_ARCH_MXC is not set
+# CONFIG_ARCH_QCOM is not set
+# CONFIG_ARCH_REALTEK is not set
+# CONFIG_ARCH_RENESAS is not set
+# CONFIG_ARCH_ROCKCHIP is not set
+# CONFIG_ARCH_SEATTLE is not set
+# CONFIG_ARCH_STRATIX10 is not set
+# CONFIG_ARCH_SYNQUACER is not set
+# CONFIG_ARCH_TEGRA is not set
+# CONFIG_ARCH_SPRD is not set
+# CONFIG_ARCH_THUNDER is not set
+# CONFIG_ARCH_THUNDER2 is not set
+# CONFIG_ARCH_UNIPHIER is not set
+# CONFIG_ARCH_VEXPRESS is not set
+# CONFIG_ARCH_XGENE is not set
+# CONFIG_ARCH_ZX is not set
+# CONFIG_ARCH_ZYNQMP is not set
+# end of Platform selection
+
+#
+# Kernel Features
+#
+
+#
+# ARM errata workarounds via the alternatives framework
+#
+# CONFIG_ARM64_ERRATUM_826319 is not set
+# CONFIG_ARM64_ERRATUM_827319 is not set
+# CONFIG_ARM64_ERRATUM_824069 is not set
+# CONFIG_ARM64_ERRATUM_819472 is not set
+# CONFIG_ARM64_ERRATUM_832075 is not set
+CONFIG_ARM64_ERRATUM_834220=y
+# CONFIG_ARM64_ERRATUM_843419 is not set
+CONFIG_ARM64_ERRATUM_1024718=y
+# CONFIG_ARM64_ERRATUM_1165522 is not set
+# CONFIG_ARM64_ERRATUM_1286807 is not set
+# CONFIG_ARM64_ERRATUM_1463225 is not set
+# CONFIG_ARM64_ERRATUM_1542419 is not set
+# CONFIG_CAVIUM_ERRATUM_22375 is not set
+# CONFIG_CAVIUM_ERRATUM_23154 is not set
+# CONFIG_CAVIUM_ERRATUM_27456 is not set
+# CONFIG_CAVIUM_ERRATUM_30115 is not set
+# CONFIG_CAVIUM_TX2_ERRATUM_219 is not set
+# CONFIG_QCOM_FALKOR_ERRATUM_1003 is not set
+# CONFIG_QCOM_FALKOR_ERRATUM_1009 is not set
+# CONFIG_QCOM_QDF2400_ERRATUM_0065 is not set
+# CONFIG_SOCIONEXT_SYNQUACER_PREITS is not set
+# CONFIG_HISILICON_ERRATUM_161600802 is not set
+# CONFIG_QCOM_FALKOR_ERRATUM_E1041 is not set
+# CONFIG_FUJITSU_ERRATUM_010001 is not set
+# end of ARM errata workarounds via the alternatives framework
+
+CONFIG_ARM64_4K_PAGES=y
+# CONFIG_ARM64_16K_PAGES is not set
+# CONFIG_ARM64_64K_PAGES is not set
+CONFIG_ARM64_VA_BITS_39=y
+# CONFIG_ARM64_VA_BITS_48 is not set
+CONFIG_ARM64_VA_BITS=39
+CONFIG_ARM64_PA_BITS_48=y
+CONFIG_ARM64_PA_BITS=48
+# CONFIG_CPU_BIG_ENDIAN is not set
+# CONFIG_SCHED_MC is not set
+# CONFIG_SCHED_SMT is not set
+CONFIG_NR_CPUS=4
+# CONFIG_HOTPLUG_CPU is not set
+# CONFIG_NUMA is not set
+CONFIG_HOLES_IN_ZONE=y
+CONFIG_HZ_100=y
+# CONFIG_HZ_250 is not set
+# CONFIG_HZ_300 is not set
+# CONFIG_HZ_1000 is not set
+CONFIG_HZ=100
+CONFIG_SCHED_HRTICK=y
+CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SPARSEMEM_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_FLATMEM_ENABLE=y
+CONFIG_HAVE_ARCH_PFN_VALID=y
+CONFIG_HW_PERF_EVENTS=y
+CONFIG_SYS_SUPPORTS_HUGETLBFS=y
+CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y
+CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
+CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y
+CONFIG_SECCOMP=y
+# CONFIG_PARAVIRT is not set
+# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set
+# CONFIG_KEXEC_FILE is not set
+# CONFIG_CRASH_DUMP is not set
+# CONFIG_XEN is not set
+CONFIG_FORCE_MAX_ZONEORDER=11
+# CONFIG_UNMAP_KERNEL_AT_EL0 is not set
+# CONFIG_HARDEN_BRANCH_PREDICTOR is not set
+# CONFIG_HARDEN_EL2_VECTORS is not set
+# CONFIG_ARM64_SSBD is not set
+# CONFIG_RODATA_FULL_DEFAULT_ENABLED is not set
+# CONFIG_ARM64_SW_TTBR0_PAN is not set
+# CONFIG_ARM64_TAGGED_ADDR_ABI is not set
+# CONFIG_COMPAT is not set
+
+#
+# ARMv8.1 architectural features
+#
+CONFIG_ARM64_HW_AFDBM=y
+CONFIG_ARM64_PAN=y
+# CONFIG_ARM64_VHE is not set
+# end of ARMv8.1 architectural features
+
+#
+# ARMv8.2 architectural features
+#
+CONFIG_ARM64_UAO=y
+# CONFIG_ARM64_PMEM is not set
+# CONFIG_ARM64_RAS_EXTN is not set
+# CONFIG_ARM64_CNP is not set
+# end of ARMv8.2 architectural features
+
+#
+# ARMv8.3 architectural features
+#
+# end of ARMv8.3 architectural features
+
+# CONFIG_ARM64_MODULE_PLTS is not set
+# CONFIG_ARM64_PSEUDO_NMI is not set
+# CONFIG_RANDOMIZE_BASE is not set
+CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+# end of Kernel Features
+
+#
+# Boot options
+#
+CONFIG_CMDLINE="console=ttyS0,115200 earlycon=uart8250,mmio32,0xf0512000 maxcpus=4 root=/dev/nfs ip=:::::eth1.41:dhcp memtest=0 dhcpclass=linux-fbxgw7r"
+CONFIG_CMDLINE_FORCE=y
+# CONFIG_EFI is not set
+# end of Boot options
+
+#
+# Power management options
+#
+# CONFIG_SUSPEND is not set
+# CONFIG_PM is not set
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+# end of Power management options
+
+#
+# CPU Power Management
+#
+
+#
+# CPU Idle
+#
+# CONFIG_CPU_IDLE is not set
+# end of CPU Idle
+
+#
+# CPU Frequency scaling
+#
+# CONFIG_CPU_FREQ is not set
+# end of CPU Frequency scaling
+# end of CPU Power Management
+
+#
+# Firmware Drivers
+#
+# CONFIG_ARM_SDE_INTERFACE is not set
+# CONFIG_FIRMWARE_MEMMAP is not set
+# CONFIG_FW_CFG_SYSFS is not set
+CONFIG_HAVE_ARM_SMCCC=y
+CONFIG_ARM_PSCI_FW=y
+# CONFIG_GOOGLE_FIRMWARE is not set
+CONFIG_EFI_EARLYCON=y
+
+#
+# Tegra firmware driver
+#
+# end of Tegra firmware driver
+# end of Firmware Drivers
+
+CONFIG_HAVE_KVM_IRQCHIP=y
+CONFIG_HAVE_KVM_IRQFD=y
+CONFIG_HAVE_KVM_IRQ_ROUTING=y
+CONFIG_HAVE_KVM_EVENTFD=y
+CONFIG_KVM_MMIO=y
+CONFIG_HAVE_KVM_MSI=y
+CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT=y
+CONFIG_KVM_VFIO=y
+CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL=y
+CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT=y
+CONFIG_HAVE_KVM_IRQ_BYPASS=y
+CONFIG_HAVE_KVM_VCPU_RUN_PID_CHANGE=y
+CONFIG_IRQ_BYPASS_MANAGER=y
+CONFIG_VIRTUALIZATION=y
+CONFIG_KVM=y
+CONFIG_KVM_ARM_HOST=y
+CONFIG_KVM_ARM_PMU=y
+CONFIG_VHOST_NET=y
+CONFIG_VHOST_VSOCK=y
+CONFIG_VHOST=y
+# CONFIG_VHOST_CROSS_ENDIAN_LEGACY is not set
+# CONFIG_ARM64_CRYPTO is not set
+
+#
+# General architecture-dependent options
+#
+# CONFIG_KPROBES is not set
+# CONFIG_JUMP_LABEL is not set
+CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
+CONFIG_HAVE_KPROBES=y
+CONFIG_HAVE_KRETPROBES=y
+CONFIG_HAVE_FUNCTION_ERROR_INJECTION=y
+CONFIG_HAVE_NMI=y
+CONFIG_HAVE_ARCH_TRACEHOOK=y
+CONFIG_HAVE_DMA_CONTIGUOUS=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_ARCH_HAS_FORTIFY_SOURCE=y
+CONFIG_ARCH_HAS_KEEPINITRD=y
+CONFIG_ARCH_HAS_SET_MEMORY=y
+CONFIG_ARCH_HAS_SET_DIRECT_MAP=y
+CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y
+CONFIG_HAVE_ASM_MODVERSIONS=y
+CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
+CONFIG_HAVE_RSEQ=y
+CONFIG_HAVE_FUNCTION_ARG_ACCESS_API=y
+CONFIG_HAVE_CLK=y
+CONFIG_HAVE_HW_BREAKPOINT=y
+CONFIG_HAVE_PERF_REGS=y
+CONFIG_HAVE_PERF_USER_STACK_DUMP=y
+CONFIG_HAVE_ARCH_JUMP_LABEL=y
+CONFIG_HAVE_ARCH_JUMP_LABEL_RELATIVE=y
+CONFIG_HAVE_RCU_TABLE_FREE=y
+CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y
+CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y
+CONFIG_HAVE_CMPXCHG_LOCAL=y
+CONFIG_HAVE_CMPXCHG_DOUBLE=y
+CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
+CONFIG_SECCOMP_FILTER=y
+CONFIG_HAVE_ARCH_STACKLEAK=y
+CONFIG_HAVE_STACKPROTECTOR=y
+CONFIG_CC_HAS_STACKPROTECTOR_NONE=y
+# CONFIG_STACKPROTECTOR is not set
+CONFIG_HAVE_CONTEXT_TRACKING=y
+CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
+CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y
+CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y
+CONFIG_HAVE_ARCH_HUGE_VMAP=y
+CONFIG_MODULES_USE_ELF_RELA=y
+CONFIG_ARCH_HAS_ELF_RANDOMIZE=y
+CONFIG_HAVE_ARCH_MMAP_RND_BITS=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT=y
+CONFIG_HAVE_COPY_THREAD_TLS=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_64BIT_TIME=y
+CONFIG_HAVE_ARCH_VMAP_STACK=y
+CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y
+CONFIG_STRICT_KERNEL_RWX=y
+CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y
+CONFIG_STRICT_MODULE_RWX=y
+CONFIG_REFCOUNT_FULL=y
+CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y
+CONFIG_ARCH_USE_MEMREMAP_PROT=y
+# CONFIG_LOCK_EVENT_COUNTS is not set
+
+#
+# GCOV-based kernel profiling
+#
+# CONFIG_GCOV_KERNEL is not set
+CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y
+# end of GCOV-based kernel profiling
+
+CONFIG_PLUGIN_HOSTCC="g++"
+CONFIG_HAVE_GCC_PLUGINS=y
+CONFIG_GCC_PLUGINS=y
+# CONFIG_GCC_PLUGIN_CYC_COMPLEXITY is not set
+# CONFIG_GCC_PLUGIN_LATENT_ENTROPY is not set
+# CONFIG_GCC_PLUGIN_RANDSTRUCT is not set
+# end of General architecture-dependent options
+
+CONFIG_RT_MUTEXES=y
+CONFIG_BASE_SMALL=0
+CONFIG_MODULES=y
+# CONFIG_MODULE_FORCE_LOAD is not set
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_MODULE_FORCE_UNLOAD is not set
+# CONFIG_MODVERSIONS is not set
+# CONFIG_MODULE_SRCVERSION_ALL is not set
+# CONFIG_MODULE_SIG is not set
+# CONFIG_MODULE_COMPRESS is not set
+# CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set
+# CONFIG_UNUSED_SYMBOLS is not set
+# CONFIG_TRIM_UNUSED_KSYMS is not set
+CONFIG_MODULES_TREE_LOOKUP=y
+CONFIG_BLOCK=y
+CONFIG_BLK_SCSI_REQUEST=y
+# CONFIG_BLK_DEV_BSG is not set
+# CONFIG_BLK_DEV_BSGLIB is not set
+# CONFIG_BLK_DEV_INTEGRITY is not set
+# CONFIG_BLK_DEV_ZONED is not set
+# CONFIG_BLK_CMDLINE_PARSER is not set
+# CONFIG_BLK_WBT is not set
+CONFIG_BLK_DEBUG_FS=y
+# CONFIG_BLK_SED_OPAL is not set
+
+#
+# Partition Types
+#
+CONFIG_PARTITION_ADVANCED=y
+# CONFIG_ACORN_PARTITION is not set
+# CONFIG_AIX_PARTITION is not set
+# CONFIG_OSF_PARTITION is not set
+# CONFIG_AMIGA_PARTITION is not set
+# CONFIG_ATARI_PARTITION is not set
+# CONFIG_MAC_PARTITION is not set
+CONFIG_MSDOS_PARTITION=y
+# CONFIG_BSD_DISKLABEL is not set
+# CONFIG_MINIX_SUBPARTITION is not set
+# CONFIG_SOLARIS_X86_PARTITION is not set
+# CONFIG_UNIXWARE_DISKLABEL is not set
+# CONFIG_LDM_PARTITION is not set
+# CONFIG_SGI_PARTITION is not set
+# CONFIG_ULTRIX_PARTITION is not set
+# CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
+CONFIG_EFI_PARTITION=y
+# CONFIG_SYSV68_PARTITION is not set
+# CONFIG_CMDLINE_PARTITION is not set
+CONFIG_OF_PARTITION=y
+CONFIG_OF_PARTITION_IGNORE_RO=y
+# end of Partition Types
+
+CONFIG_BLK_MQ_PCI=y
+
+#
+# IO Schedulers
+#
+CONFIG_MQ_IOSCHED_DEADLINE=y
+CONFIG_MQ_IOSCHED_KYBER=y
+# CONFIG_IOSCHED_BFQ is not set
+# end of IO Schedulers
+
+CONFIG_PREEMPT_NOTIFIERS=y
+CONFIG_ARCH_INLINE_SPIN_TRYLOCK=y
+CONFIG_ARCH_INLINE_SPIN_TRYLOCK_BH=y
+CONFIG_ARCH_INLINE_SPIN_LOCK=y
+CONFIG_ARCH_INLINE_SPIN_LOCK_BH=y
+CONFIG_ARCH_INLINE_SPIN_LOCK_IRQ=y
+CONFIG_ARCH_INLINE_SPIN_LOCK_IRQSAVE=y
+CONFIG_ARCH_INLINE_SPIN_UNLOCK=y
+CONFIG_ARCH_INLINE_SPIN_UNLOCK_BH=y
+CONFIG_ARCH_INLINE_SPIN_UNLOCK_IRQ=y
+CONFIG_ARCH_INLINE_SPIN_UNLOCK_IRQRESTORE=y
+CONFIG_ARCH_INLINE_READ_LOCK=y
+CONFIG_ARCH_INLINE_READ_LOCK_BH=y
+CONFIG_ARCH_INLINE_READ_LOCK_IRQ=y
+CONFIG_ARCH_INLINE_READ_LOCK_IRQSAVE=y
+CONFIG_ARCH_INLINE_READ_UNLOCK=y
+CONFIG_ARCH_INLINE_READ_UNLOCK_BH=y
+CONFIG_ARCH_INLINE_READ_UNLOCK_IRQ=y
+CONFIG_ARCH_INLINE_READ_UNLOCK_IRQRESTORE=y
+CONFIG_ARCH_INLINE_WRITE_LOCK=y
+CONFIG_ARCH_INLINE_WRITE_LOCK_BH=y
+CONFIG_ARCH_INLINE_WRITE_LOCK_IRQ=y
+CONFIG_ARCH_INLINE_WRITE_LOCK_IRQSAVE=y
+CONFIG_ARCH_INLINE_WRITE_UNLOCK=y
+CONFIG_ARCH_INLINE_WRITE_UNLOCK_BH=y
+CONFIG_ARCH_INLINE_WRITE_UNLOCK_IRQ=y
+CONFIG_ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE=y
+CONFIG_UNINLINE_SPIN_UNLOCK=y
+CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_ARCH_USE_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y
+
+#
+# Executable file formats
+#
+CONFIG_BINFMT_ELF=y
+CONFIG_ELFCORE=y
+CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
+CONFIG_BINFMT_SCRIPT=y
+# CONFIG_BINFMT_MISC is not set
+CONFIG_COREDUMP=y
+# end of Executable file formats
+
+#
+# Memory Management options
+#
+CONFIG_SELECT_MEMORY_MODEL=y
+# CONFIG_FLATMEM_MANUAL is not set
+CONFIG_SPARSEMEM_MANUAL=y
+CONFIG_SPARSEMEM=y
+CONFIG_HAVE_MEMORY_PRESENT=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_HAVE_FAST_GUP=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+# CONFIG_MEMORY_HOTPLUG is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_COMPACTION=y
+CONFIG_MIGRATION=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_MMU_NOTIFIER=y
+# CONFIG_KSM is not set
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
+CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y
+# CONFIG_MEMORY_FAILURE is not set
+CONFIG_TRANSPARENT_HUGEPAGE=y
+# CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS is not set
+CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y
+CONFIG_TRANSPARENT_HUGE_PAGECACHE=y
+# CONFIG_CLEANCACHE is not set
+# CONFIG_CMA is not set
+# CONFIG_ZPOOL is not set
+# CONFIG_ZBUD is not set
+# CONFIG_ZSMALLOC is not set
+CONFIG_GENERIC_EARLY_IOREMAP=y
+# CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set
+# CONFIG_IDLE_PAGE_TRACKING is not set
+CONFIG_ARCH_HAS_PTE_DEVMAP=y
+# CONFIG_PERCPU_STATS is not set
+# CONFIG_GUP_BENCHMARK is not set
+# CONFIG_READ_ONLY_THP_FOR_FS is not set
+CONFIG_ARCH_HAS_PTE_SPECIAL=y
+# end of Memory Management options
+
+CONFIG_NET=y
+CONFIG_NET_INGRESS=y
+CONFIG_NET_EGRESS=y
+CONFIG_SKB_EXTENSIONS=y
+
+#
+# Networking options
+#
+CONFIG_NETSKBPAD=64
+CONFIG_NET_NMESH_MBH=y
+CONFIG_PACKET=y
+# CONFIG_PACKET_DIAG is not set
+CONFIG_UNIX=y
+CONFIG_UNIX_SCM=y
+CONFIG_UNIX_ABSTRACT_IGNORE_NETNS=y
+# CONFIG_UNIX_DIAG is not set
+# CONFIG_TLS is not set
+CONFIG_XFRM=y
+CONFIG_XFRM_OFFLOAD=y
+CONFIG_XFRM_ALGO=y
+CONFIG_XFRM_USER=y
+CONFIG_XFRM_INTERFACE=y
+# CONFIG_XFRM_SUB_POLICY is not set
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
+CONFIG_NET_KEY=y
+# CONFIG_NET_KEY_MIGRATE is not set
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+# CONFIG_IP_FIB_TRIE_STATS is not set
+CONFIG_IP_MULTIPLE_TABLES=y
+# CONFIG_IP_ROUTE_MULTIPATH is not set
+# CONFIG_IP_ROUTE_VERBOSE is not set
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+# CONFIG_IP_PNP_RARP is not set
+# CONFIG_NET_IPIP is not set
+CONFIG_NET_IPGRE_DEMUX=y
+CONFIG_NET_IP_TUNNEL=y
+# CONFIG_NET_IPGRE is not set
+# CONFIG_IP_MROUTE is not set
+# CONFIG_SYN_COOKIES is not set
+# CONFIG_NET_IPVTI is not set
+# CONFIG_NET_FOU is not set
+# CONFIG_NET_FOU_IP_TUNNELS is not set
+CONFIG_INET_AH=y
+CONFIG_INET_ESP=y
+# CONFIG_INET_ESP_OFFLOAD is not set
+# CONFIG_INET_IPCOMP is not set
+CONFIG_INET_TUNNEL=y
+CONFIG_INET_DIAG=y
+CONFIG_INET_TCP_DIAG=y
+# CONFIG_INET_UDP_DIAG is not set
+# CONFIG_INET_RAW_DIAG is not set
+# CONFIG_INET_DIAG_DESTROY is not set
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_TCP_MD5SIG is not set
+CONFIG_IPV6=y
+# CONFIG_IPV6_ROUTER_PREF is not set
+# CONFIG_IPV6_OPTIMISTIC_DAD is not set
+CONFIG_INET6_AH=y
+CONFIG_INET6_ESP=y
+CONFIG_INET6_ESP_OFFLOAD=y
+# CONFIG_INET6_IPCOMP is not set
+# CONFIG_IPV6_MIP6 is not set
+# CONFIG_IPV6_ILA is not set
+CONFIG_INET6_TUNNEL=y
+# CONFIG_IPV6_VTI is not set
+CONFIG_IPV6_SIT=y
+CONFIG_IPV6_SIT_6RD=y
+CONFIG_IPV6_NDISC_NODETYPE=y
+CONFIG_IPV6_TUNNEL=y
+# CONFIG_IPV6_GRE is not set
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+# CONFIG_IPV6_MROUTE is not set
+# CONFIG_IPV6_SEG6_LWTUNNEL is not set
+# CONFIG_IPV6_SEG6_HMAC is not set
+# CONFIG_NETWORK_SECMARK is not set
+# CONFIG_NETWORK_PHY_TIMESTAMPING is not set
+CONFIG_NETFILTER=y
+CONFIG_NETFILTER_ADVANCED=y
+# CONFIG_BRIDGE_NETFILTER is not set
+
+#
+# Core Netfilter Configuration
+#
+# CONFIG_NETFILTER_INGRESS is not set
+# CONFIG_NETFILTER_NETLINK_ACCT is not set
+# CONFIG_NETFILTER_NETLINK_QUEUE is not set
+# CONFIG_NETFILTER_NETLINK_LOG is not set
+# CONFIG_NETFILTER_NETLINK_OSF is not set
+CONFIG_NF_CONNTRACK=y
+# CONFIG_NF_LOG_NETDEV is not set
+CONFIG_NF_CONNTRACK_MARK=y
+# CONFIG_NF_CONNTRACK_ZONES is not set
+CONFIG_NF_CONNTRACK_PROCFS=y
+# CONFIG_NF_CONNTRACK_EVENTS is not set
+# CONFIG_NF_CONNTRACK_TIMEOUT is not set
+# CONFIG_NF_CONNTRACK_TIMESTAMP is not set
+# CONFIG_NF_CONNTRACK_LABELS is not set
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_GRE=y
+CONFIG_NF_CT_PROTO_SCTP=y
+# CONFIG_NF_CT_PROTO_UDPLITE is not set
+# CONFIG_NF_CONNTRACK_AMANDA is not set
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IRC=m
+# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set
+# CONFIG_NF_CONNTRACK_SNMP is not set
+CONFIG_NF_CONNTRACK_PPTP=m
+# CONFIG_NF_CONNTRACK_SANE is not set
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=y
+# CONFIG_NF_CT_NETLINK is not set
+CONFIG_NF_NAT=y
+CONFIG_NF_NAT_FTP=y
+CONFIG_NF_NAT_IRC=m
+CONFIG_NF_NAT_SIP=m
+CONFIG_NF_NAT_TFTP=y
+CONFIG_NF_NAT_REDIRECT=y
+CONFIG_NF_NAT_MASQUERADE=y
+# CONFIG_NF_TABLES is not set
+CONFIG_NETFILTER_XTABLES=y
+
+#
+# Xtables combined modules
+#
+CONFIG_NETFILTER_XT_MARK=y
+CONFIG_NETFILTER_XT_CONNMARK=y
+
+#
+# Xtables targets
+#
+# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set
+# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
+CONFIG_NETFILTER_XT_TARGET_DSCP=y
+# CONFIG_NETFILTER_XT_TARGET_HL is not set
+# CONFIG_NETFILTER_XT_TARGET_HMARK is not set
+# CONFIG_NETFILTER_XT_TARGET_IDLETIMER is not set
+# CONFIG_NETFILTER_XT_TARGET_LED is not set
+# CONFIG_NETFILTER_XT_TARGET_LOG is not set
+CONFIG_NETFILTER_XT_TARGET_MARK=y
+CONFIG_NETFILTER_XT_NAT=y
+# CONFIG_NETFILTER_XT_TARGET_NETMAP is not set
+# CONFIG_NETFILTER_XT_TARGET_NFLOG is not set
+# CONFIG_NETFILTER_XT_TARGET_NFQUEUE is not set
+# CONFIG_NETFILTER_XT_TARGET_RATEEST is not set
+CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
+CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
+# CONFIG_NETFILTER_XT_TARGET_TEE is not set
+CONFIG_NETFILTER_XT_TARGET_TPROXY=y
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
+# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
+
+#
+# Xtables matches
+#
+# CONFIG_NETFILTER_XT_MATCH_ADDRTYPE is not set
+# CONFIG_NETFILTER_XT_MATCH_BPF is not set
+# CONFIG_NETFILTER_XT_MATCH_CGROUP is not set
+# CONFIG_NETFILTER_XT_MATCH_CLUSTER is not set
+# CONFIG_NETFILTER_XT_MATCH_COMMENT is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNBYTES is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNLABEL is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNLIMIT is not set
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
+# CONFIG_NETFILTER_XT_MATCH_CPU is not set
+CONFIG_NETFILTER_XT_MATCH_DCCP=y
+# CONFIG_NETFILTER_XT_MATCH_DEVGROUP is not set
+CONFIG_NETFILTER_XT_MATCH_DSCP=y
+# CONFIG_NETFILTER_XT_MATCH_ECN is not set
+# CONFIG_NETFILTER_XT_MATCH_ESP is not set
+# CONFIG_NETFILTER_XT_MATCH_HASHLIMIT is not set
+# CONFIG_NETFILTER_XT_MATCH_HELPER is not set
+# CONFIG_NETFILTER_XT_MATCH_HL is not set
+# CONFIG_NETFILTER_XT_MATCH_IPCOMP is not set
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=y
+# CONFIG_NETFILTER_XT_MATCH_L2TP is not set
+# CONFIG_NETFILTER_XT_MATCH_LENGTH is not set
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
+CONFIG_NETFILTER_XT_MATCH_MAC=y
+CONFIG_NETFILTER_XT_MATCH_MARK=y
+# CONFIG_NETFILTER_XT_MATCH_MULTIPORT is not set
+# CONFIG_NETFILTER_XT_MATCH_NFACCT is not set
+# CONFIG_NETFILTER_XT_MATCH_OSF is not set
+CONFIG_NETFILTER_XT_MATCH_OWNER=y
+# CONFIG_NETFILTER_XT_MATCH_POLICY is not set
+# CONFIG_NETFILTER_XT_MATCH_PKTTYPE is not set
+# CONFIG_NETFILTER_XT_MATCH_QUOTA is not set
+# CONFIG_NETFILTER_XT_MATCH_RATEEST is not set
+# CONFIG_NETFILTER_XT_MATCH_REALM is not set
+# CONFIG_NETFILTER_XT_MATCH_RECENT is not set
+CONFIG_NETFILTER_XT_MATCH_SCTP=y
+# CONFIG_NETFILTER_XT_MATCH_SOCKET is not set
+CONFIG_NETFILTER_XT_MATCH_STATE=y
+# CONFIG_NETFILTER_XT_MATCH_STATISTIC is not set
+# CONFIG_NETFILTER_XT_MATCH_STRING is not set
+# CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set
+# CONFIG_NETFILTER_XT_MATCH_TIME is not set
+# CONFIG_NETFILTER_XT_MATCH_U32 is not set
+# end of Core Netfilter Configuration
+
+# CONFIG_IP_SET is not set
+# CONFIG_IP_VS is not set
+
+#
+# IP: Netfilter Configuration
+#
+CONFIG_IP_FFN=y
+CONFIG_IP_FFN_PROCFS=y
+CONFIG_NF_DEFRAG_IPV4=y
+# CONFIG_NF_SOCKET_IPV4 is not set
+CONFIG_NF_TPROXY_IPV4=y
+# CONFIG_NF_DUP_IPV4 is not set
+# CONFIG_NF_LOG_ARP is not set
+# CONFIG_NF_LOG_IPV4 is not set
+CONFIG_NF_REJECT_IPV4=y
+CONFIG_NF_NAT_PPTP=m
+CONFIG_NF_NAT_H323=m
+CONFIG_IP_NF_IPTABLES=y
+# CONFIG_IP_NF_MATCH_AH is not set
+# CONFIG_IP_NF_MATCH_ECN is not set
+# CONFIG_IP_NF_MATCH_RPFILTER is not set
+# CONFIG_IP_NF_MATCH_TTL is not set
+CONFIG_IP_NF_FILTER=y
+CONFIG_IP_NF_TARGET_REJECT=y
+# CONFIG_IP_NF_TARGET_SYNPROXY is not set
+CONFIG_IP_NF_NAT=y
+CONFIG_IP_NF_TARGET_MASQUERADE=y
+# CONFIG_IP_NF_TARGET_NETMAP is not set
+CONFIG_IP_NF_TARGET_REDIRECT=y
+CONFIG_IP_NF_MANGLE=y
+# CONFIG_IP_NF_TARGET_CLUSTERIP is not set
+# CONFIG_IP_NF_TARGET_ECN is not set
+# CONFIG_IP_NF_TARGET_TTL is not set
+# CONFIG_IP_NF_RAW is not set
+# CONFIG_IP_NF_ARPTABLES is not set
+# end of IP: Netfilter Configuration
+
+#
+# IPv6: Netfilter Configuration
+#
+CONFIG_IPV6_FFN=y
+CONFIG_IPV6_FFN_PROCFS=y
+# CONFIG_NF_SOCKET_IPV6 is not set
+CONFIG_NF_TPROXY_IPV6=y
+# CONFIG_NF_DUP_IPV6 is not set
+CONFIG_NF_REJECT_IPV6=y
+# CONFIG_NF_LOG_IPV6 is not set
+CONFIG_IP6_NF_IPTABLES=y
+# CONFIG_IP6_NF_MATCH_AH is not set
+# CONFIG_IP6_NF_MATCH_EUI64 is not set
+# CONFIG_IP6_NF_MATCH_FRAG is not set
+# CONFIG_IP6_NF_MATCH_OPTS is not set
+# CONFIG_IP6_NF_MATCH_HL is not set
+# CONFIG_IP6_NF_MATCH_IPV6HEADER is not set
+# CONFIG_IP6_NF_MATCH_MH is not set
+# CONFIG_IP6_NF_MATCH_RPFILTER is not set
+# CONFIG_IP6_NF_MATCH_RT is not set
+# CONFIG_IP6_NF_MATCH_SRH is not set
+# CONFIG_IP6_NF_TARGET_HL is not set
+CONFIG_IP6_NF_FILTER=y
+CONFIG_IP6_NF_TARGET_REJECT=y
+# CONFIG_IP6_NF_TARGET_SYNPROXY is not set
+CONFIG_IP6_NF_MANGLE=y
+# CONFIG_IP6_NF_RAW is not set
+CONFIG_IP6_NF_NAT=y
+CONFIG_IP6_NF_TARGET_MASQUERADE=y
+# CONFIG_IP6_NF_TARGET_NPT is not set
+# end of IPv6: Netfilter Configuration
+
+CONFIG_NF_DEFRAG_IPV6=y
+# CONFIG_NF_CONNTRACK_BRIDGE is not set
+# CONFIG_BRIDGE_NF_EBTABLES is not set
+# CONFIG_BPFILTER is not set
+# CONFIG_IP_DCCP is not set
+# CONFIG_IP_SCTP is not set
+# CONFIG_RDS is not set
+# CONFIG_TIPC is not set
+# CONFIG_ATM is not set
+# CONFIG_L2TP is not set
+CONFIG_FBXATM=y
+CONFIG_FBXATM_REMOTE=y
+CONFIG_FBXATM_STACK=y
+# CONFIG_FBXATM_REMOTE_STUB is not set
+CONFIG_FBXATM_REMOTE_DRIVER=y
+CONFIG_FBXBRIDGE=y
+CONFIG_STP=y
+CONFIG_BRIDGE=y
+# CONFIG_BRIDGE_IGMP_SNOOPING is not set
+# CONFIG_BRIDGE_VLAN_FILTERING is not set
+CONFIG_HAVE_NET_DSA=y
+# CONFIG_NET_DSA is not set
+CONFIG_VLAN_8021Q=y
+# CONFIG_VLAN_8021Q_GVRP is not set
+# CONFIG_VLAN_8021Q_MVRP is not set
+# CONFIG_DECNET is not set
+CONFIG_LLC=y
+# CONFIG_LLC2 is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_PHONET is not set
+# CONFIG_6LOWPAN is not set
+# CONFIG_IEEE802154 is not set
+CONFIG_NET_SCHED=y
+
+#
+# Queueing/Scheduling
+#
+# CONFIG_NET_SCH_CBQ is not set
+# CONFIG_NET_SCH_HTB is not set
+# CONFIG_NET_SCH_HFSC is not set
+CONFIG_NET_SCH_PRIO=y
+CONFIG_NET_SCH_MULTIQ=y
+# CONFIG_NET_SCH_RED is not set
+# CONFIG_NET_SCH_SFB is not set
+CONFIG_NET_SCH_SFQ=y
+# CONFIG_NET_SCH_TEQL is not set
+# CONFIG_NET_SCH_TBF is not set
+# CONFIG_NET_SCH_CBS is not set
+# CONFIG_NET_SCH_ETF is not set
+# CONFIG_NET_SCH_TAPRIO is not set
+# CONFIG_NET_SCH_GRED is not set
+# CONFIG_NET_SCH_DSMARK is not set
+# CONFIG_NET_SCH_NETEM is not set
+CONFIG_NET_SCH_DRR=y
+# CONFIG_NET_SCH_MQPRIO is not set
+# CONFIG_NET_SCH_SKBPRIO is not set
+# CONFIG_NET_SCH_CHOKE is not set
+# CONFIG_NET_SCH_QFQ is not set
+# CONFIG_NET_SCH_CODEL is not set
+CONFIG_NET_SCH_FQ_CODEL=y
+# CONFIG_NET_SCH_CAKE is not set
+# CONFIG_NET_SCH_FQ is not set
+# CONFIG_NET_SCH_HHF is not set
+# CONFIG_NET_SCH_PIE is not set
+CONFIG_NET_SCH_INGRESS=y
+# CONFIG_NET_SCH_PLUG is not set
+# CONFIG_NET_SCH_DEFAULT is not set
+
+#
+# Classification
+#
+CONFIG_NET_CLS=y
+# CONFIG_NET_CLS_BASIC is not set
+# CONFIG_NET_CLS_TCINDEX is not set
+# CONFIG_NET_CLS_ROUTE4 is not set
+# CONFIG_NET_CLS_FW is not set
+CONFIG_NET_CLS_U32=y
+# CONFIG_CLS_U32_PERF is not set
+CONFIG_CLS_U32_MARK=y
+# CONFIG_NET_CLS_RSVP is not set
+# CONFIG_NET_CLS_RSVP6 is not set
+# CONFIG_NET_CLS_FLOW is not set
+# CONFIG_NET_CLS_CGROUP is not set
+# CONFIG_NET_CLS_BPF is not set
+# CONFIG_NET_CLS_FLOWER is not set
+# CONFIG_NET_CLS_MATCHALL is not set
+# CONFIG_NET_EMATCH is not set
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_POLICE=y
+# CONFIG_NET_ACT_GACT is not set
+# CONFIG_NET_ACT_MIRRED is not set
+# CONFIG_NET_ACT_SAMPLE is not set
+# CONFIG_NET_ACT_IPT is not set
+# CONFIG_NET_ACT_NAT is not set
+# CONFIG_NET_ACT_PEDIT is not set
+# CONFIG_NET_ACT_SIMP is not set
+CONFIG_NET_ACT_SKBEDIT=y
+# CONFIG_NET_ACT_CSUM is not set
+# CONFIG_NET_ACT_MPLS is not set
+# CONFIG_NET_ACT_VLAN is not set
+# CONFIG_NET_ACT_BPF is not set
+# CONFIG_NET_ACT_CONNMARK is not set
+# CONFIG_NET_ACT_CTINFO is not set
+# CONFIG_NET_ACT_SKBMOD is not set
+# CONFIG_NET_ACT_IFE is not set
+# CONFIG_NET_ACT_TUNNEL_KEY is not set
+# CONFIG_NET_ACT_CT is not set
+# CONFIG_NET_TC_SKB_EXT is not set
+CONFIG_NET_SCH_FIFO=y
+# CONFIG_DCB is not set
+# CONFIG_BATMAN_ADV is not set
+# CONFIG_OPENVSWITCH is not set
+CONFIG_VSOCKETS=y
+# CONFIG_VSOCKETS_DIAG is not set
+CONFIG_VIRTIO_VSOCKETS_COMMON=y
+# CONFIG_NETLINK_DIAG is not set
+# CONFIG_MPLS is not set
+# CONFIG_NET_NSH is not set
+# CONFIG_HSR is not set
+# CONFIG_NET_SWITCHDEV is not set
+# CONFIG_NET_L3_MASTER_DEV is not set
+# CONFIG_NET_NCSI is not set
+CONFIG_RPS=y
+CONFIG_RFS_ACCEL=y
+CONFIG_XPS=y
+# CONFIG_CGROUP_NET_PRIO is not set
+# CONFIG_CGROUP_NET_CLASSID is not set
+CONFIG_NET_RX_BUSY_POLL=y
+CONFIG_BQL=y
+CONFIG_BPF_JIT=y
+CONFIG_NET_FLOW_LIMIT=y
+
+#
+# Network testing
+#
+CONFIG_NET_PKTGEN=y
+# end of Network testing
+# end of Networking options
+
+# CONFIG_HAMRADIO is not set
+# CONFIG_CAN is not set
+# CONFIG_BT is not set
+# CONFIG_AF_RXRPC is not set
+# CONFIG_AF_KCM is not set
+CONFIG_FIB_RULES=y
+CONFIG_WIRELESS=y
+CONFIG_CFG80211=y
+CONFIG_NL80211_TESTMODE=y
+# CONFIG_CFG80211_DEVELOPER_WARNINGS is not set
+CONFIG_CFG80211_CERTIFICATION_ONUS=y
+# CONFIG_CFG80211_REQUIRE_SIGNED_REGDB is not set
+# CONFIG_CFG80211_REG_CELLULAR_HINTS is not set
+# CONFIG_CFG80211_REG_RELAX_NO_IR is not set
+CONFIG_CFG80211_DEFAULT_PS=y
+# CONFIG_CFG80211_DEBUGFS is not set
+CONFIG_CFG80211_CRDA_SUPPORT=y
+# CONFIG_CFG80211_WEXT is not set
+CONFIG_MAC80211=y
+CONFIG_MAC80211_HAS_RC=y
+CONFIG_MAC80211_RC_MINSTREL=y
+CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y
+CONFIG_MAC80211_RC_DEFAULT="minstrel_ht"
+CONFIG_MAC80211_MESH=y
+CONFIG_MAC80211_LEDS=y
+# CONFIG_MAC80211_DEBUGFS is not set
+# CONFIG_MAC80211_MESSAGE_TRACING is not set
+# CONFIG_MAC80211_DEBUG_MENU is not set
+CONFIG_MAC80211_STA_HASH_MAX_SIZE=0
+# CONFIG_WIMAX is not set
+# CONFIG_RFKILL is not set
+# CONFIG_NET_9P is not set
+# CONFIG_CAIF is not set
+# CONFIG_CEPH_LIB is not set
+# CONFIG_NFC is not set
+# CONFIG_PSAMPLE is not set
+# CONFIG_NET_IFE is not set
+# CONFIG_LWTUNNEL is not set
+CONFIG_DST_CACHE=y
+CONFIG_GRO_CELLS=y
+# CONFIG_FAILOVER is not set
+CONFIG_HAVE_EBPF_JIT=y
+
+#
+# Device Drivers
+#
+CONFIG_ARM_AMBA=y
+CONFIG_HAVE_PCI=y
+CONFIG_PCI=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DOMAINS_GENERIC=y
+CONFIG_PCI_SYSCALL=y
+CONFIG_PCIEPORTBUS=y
+# CONFIG_PCIEAER is not set
+# CONFIG_PCIEASPM is not set
+# CONFIG_PCIE_PTM is not set
+# CONFIG_PCIE_BW is not set
+CONFIG_PCI_MSI=y
+CONFIG_PCI_MSI_IRQ_DOMAIN=y
+CONFIG_PCI_QUIRKS=y
+# CONFIG_PCI_DEBUG is not set
+# CONFIG_PCI_STUB is not set
+# CONFIG_PCI_IOV is not set
+# CONFIG_PCI_PRI is not set
+# CONFIG_PCI_PASID is not set
+# CONFIG_HOTPLUG_PCI is not set
+
+#
+# PCI controller drivers
+#
+# CONFIG_PCI_AARDVARK is not set
+
+#
+# Cadence PCIe controllers support
+#
+# CONFIG_PCIE_CADENCE_HOST is not set
+# end of Cadence PCIe controllers support
+
+# CONFIG_PCI_FTPCI100 is not set
+# CONFIG_PCI_HOST_GENERIC is not set
+# CONFIG_PCIE_XILINX is not set
+# CONFIG_PCI_XGENE is not set
+# CONFIG_PCIE_ALTERA is not set
+# CONFIG_PCI_HOST_THUNDER_PEM is not set
+# CONFIG_PCI_HOST_THUNDER_ECAM is not set
+
+#
+# DesignWare PCI Core Support
+#
+CONFIG_PCIE_DW=y
+CONFIG_PCIE_DW_HOST=y
+# CONFIG_PCIE_DW_PLAT_HOST is not set
+# CONFIG_PCI_HISI is not set
+CONFIG_PCIE_ARMADA_8K=y
+# CONFIG_PCIE_KIRIN is not set
+# CONFIG_PCI_MESON is not set
+# CONFIG_PCIE_AL is not set
+# end of DesignWare PCI Core Support
+# end of PCI controller drivers
+
+#
+# PCI Endpoint
+#
+# CONFIG_PCI_ENDPOINT is not set
+# end of PCI Endpoint
+
+#
+# PCI switch controller drivers
+#
+# CONFIG_PCI_SW_SWITCHTEC is not set
+# end of PCI switch controller drivers
+
+# CONFIG_PCCARD is not set
+# CONFIG_RAPIDIO is not set
+
+#
+# Generic Driver Options
+#
+# CONFIG_UEVENT_HELPER is not set
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_STANDALONE=y
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+
+#
+# Firmware loader
+#
+CONFIG_FW_LOADER=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_EXTRA_FIRMWARE=""
+CONFIG_FW_LOADER_USER_HELPER=y
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y
+# CONFIG_FW_LOADER_COMPRESS is not set
+# end of Firmware loader
+
+CONFIG_WANT_DEV_COREDUMP=y
+# CONFIG_ALLOW_DEV_COREDUMP is not set
+# CONFIG_DEBUG_DRIVER is not set
+# CONFIG_DEBUG_DEVRES is not set
+# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set
+# CONFIG_TEST_ASYNC_DRIVER_PROBE is not set
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_DMA_SHARED_BUFFER=y
+# CONFIG_DMA_FENCE_TRACE is not set
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+# end of Generic Driver Options
+
+#
+# Bus devices
+#
+# CONFIG_BRCMSTB_GISB_ARB is not set
+# CONFIG_MOXTET is not set
+# CONFIG_VEXPRESS_CONFIG is not set
+# end of Bus devices
+
+# CONFIG_CONNECTOR is not set
+# CONFIG_GNSS is not set
+CONFIG_FREEBOX_PROCFS=y
+CONFIG_MTD=y
+# CONFIG_MTD_TESTS is not set
+CONFIG_MTD_ERASE_PRINTK=y
+
+#
+# Partition parsers
+#
+# CONFIG_MTD_AR7_PARTS is not set
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_OF_PARTS=y
+# CONFIG_MTD_OF_PARTS_IGNORE_RO is not set
+# CONFIG_MTD_AFS_PARTS is not set
+# CONFIG_MTD_REDBOOT_PARTS is not set
+# CONFIG_MTD_FBX6HD_PARTS is not set
+# end of Partition parsers
+
+#
+# User Modules And Translation Layers
+#
+CONFIG_MTD_BLKDEVS=y
+CONFIG_MTD_BLOCK=y
+# CONFIG_FTL is not set
+# CONFIG_NFTL is not set
+# CONFIG_INFTL is not set
+# CONFIG_RFD_FTL is not set
+# CONFIG_SSFDC is not set
+# CONFIG_SM_FTL is not set
+# CONFIG_MTD_OOPS is not set
+# CONFIG_MTD_PARTITIONED_MASTER is not set
+
+#
+# RAM/ROM/Flash chip drivers
+#
+# CONFIG_MTD_CFI is not set
+# CONFIG_MTD_JEDECPROBE is not set
+CONFIG_MTD_MAP_BANK_WIDTH_1=y
+CONFIG_MTD_MAP_BANK_WIDTH_2=y
+CONFIG_MTD_MAP_BANK_WIDTH_4=y
+CONFIG_MTD_CFI_I1=y
+CONFIG_MTD_CFI_I2=y
+# CONFIG_MTD_RAM is not set
+# CONFIG_MTD_ROM is not set
+# CONFIG_MTD_ABSENT is not set
+# end of RAM/ROM/Flash chip drivers
+
+#
+# Mapping drivers for chip access
+#
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+# CONFIG_MTD_INTEL_VR_NOR is not set
+# CONFIG_MTD_PLATRAM is not set
+# end of Mapping drivers for chip access
+
+#
+# Self-contained MTD device drivers
+#
+# CONFIG_MTD_PMC551 is not set
+# CONFIG_MTD_DATAFLASH is not set
+# CONFIG_MTD_MCHP23K256 is not set
+# CONFIG_MTD_SST25L is not set
+# CONFIG_MTD_SLRAM is not set
+# CONFIG_MTD_PHRAM is not set
+# CONFIG_MTD_MTDRAM is not set
+# CONFIG_MTD_BLOCK2MTD is not set
+
+#
+# Disk-On-Chip Device Drivers
+#
+# CONFIG_MTD_DOCG3 is not set
+# end of Self-contained MTD device drivers
+
+# CONFIG_MTD_ONENAND is not set
+# CONFIG_MTD_RAW_NAND is not set
+# CONFIG_MTD_SPI_NAND is not set
+
+#
+# LPDDR & LPDDR2 PCM memory drivers
+#
+# CONFIG_MTD_LPDDR is not set
+# end of LPDDR & LPDDR2 PCM memory drivers
+
+CONFIG_MTD_SPI_NOR=y
+# CONFIG_MTD_SPI_NOR_USE_4K_SECTORS is not set
+# CONFIG_SPI_CADENCE_QUADSPI is not set
+# CONFIG_SPI_MTK_QUADSPI is not set
+# CONFIG_MTD_UBI is not set
+# CONFIG_MTD_HYPERBUS is not set
+CONFIG_DTC=y
+CONFIG_OF=y
+# CONFIG_OF_UNITTEST is not set
+CONFIG_OF_DTB_BUILTIN_LIST=""
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_NET=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_RESERVED_MEM=y
+CONFIG_OF_RESOLVE=y
+CONFIG_OF_OVERLAY=y
+CONFIG_OF_CONFIGFS=y
+# CONFIG_PARPORT is not set
+CONFIG_BLK_DEV=y
+# CONFIG_BLK_DEV_NULL_BLK is not set
+# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set
+# CONFIG_BLK_DEV_UMEM is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_LOOP_MIN_COUNT=8
+# CONFIG_BLK_DEV_CRYPTOLOOP is not set
+# CONFIG_BLK_DEV_DRBD is not set
+# CONFIG_BLK_DEV_NBD is not set
+# CONFIG_BLK_DEV_SKD is not set
+# CONFIG_BLK_DEV_SX8 is not set
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=1
+CONFIG_BLK_DEV_RAM_SIZE=65536
+# CONFIG_CDROM_PKTCDVD is not set
+# CONFIG_ATA_OVER_ETH is not set
+# CONFIG_BLK_DEV_RBD is not set
+# CONFIG_BLK_DEV_RSXX is not set
+
+#
+# NVME Support
+#
+# CONFIG_BLK_DEV_NVME is not set
+# CONFIG_NVME_FC is not set
+# CONFIG_NVME_TARGET is not set
+# end of NVME Support
+
+#
+# Misc devices
+#
+# CONFIG_WINTEGRA_MMAP is not set
+# CONFIG_AD525X_DPOT is not set
+# CONFIG_DUMMY_IRQ is not set
+# CONFIG_PHANTOM is not set
+# CONFIG_TIFM_CORE is not set
+# CONFIG_ICS932S401 is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+# CONFIG_HP_ILO is not set
+# CONFIG_APDS9802ALS is not set
+# CONFIG_ISL29003 is not set
+# CONFIG_ISL29020 is not set
+# CONFIG_SENSORS_TSL2550 is not set
+# CONFIG_SENSORS_BH1770 is not set
+# CONFIG_SENSORS_APDS990X is not set
+# CONFIG_HMC6352 is not set
+# CONFIG_DS1682 is not set
+# CONFIG_INTELCE_PIC16PMU is not set
+CONFIG_FBXSERIAL_OF=y
+# CONFIG_RANDOM_OF is not set
+# CONFIG_LATTICE_ECP3_CONFIG is not set
+# CONFIG_SRAM is not set
+# CONFIG_PCI_ENDPOINT_TEST is not set
+# CONFIG_XILINX_SDFEC is not set
+# CONFIG_PVPANIC is not set
+# CONFIG_C2PORT is not set
+
+#
+# EEPROM support
+#
+CONFIG_EEPROM_AT24=m
+# CONFIG_EEPROM_AT25 is not set
+# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_MAX6875 is not set
+# CONFIG_EEPROM_93CX6 is not set
+# CONFIG_EEPROM_93XX46 is not set
+# CONFIG_EEPROM_IDT_89HPESX is not set
+# CONFIG_EEPROM_EE1004 is not set
+CONFIG_EEPROM_EE1004_RAW=y
+# end of EEPROM support
+
+# CONFIG_CB710_CORE is not set
+
+#
+# Texas Instruments shared transport line discipline
+#
+# CONFIG_TI_ST is not set
+# end of Texas Instruments shared transport line discipline
+
+# CONFIG_SENSORS_LIS3_SPI is not set
+# CONFIG_SENSORS_LIS3_I2C is not set
+# CONFIG_ALTERA_STAPL is not set
+
+#
+# Intel MIC & related support
+#
+
+#
+# Intel MIC Bus Driver
+#
+
+#
+# SCIF Bus Driver
+#
+
+#
+# VOP Bus Driver
+#
+# CONFIG_VOP_BUS is not set
+
+#
+# Intel MIC Host Driver
+#
+
+#
+# Intel MIC Card Driver
+#
+
+#
+# SCIF Driver
+#
+
+#
+# Intel MIC Coprocessor State Management (COSM) Drivers
+#
+
+#
+# VOP Driver
+#
+# end of Intel MIC & related support
+
+# CONFIG_GENWQE is not set
+# CONFIG_ECHO is not set
+# CONFIG_MISC_ALCOR_PCI is not set
+# CONFIG_MISC_RTSX_PCI is not set
+# CONFIG_MISC_RTSX_USB is not set
+# CONFIG_HABANA_AI is not set
+
+#
+# RemoTI support
+#
+# end of RemoTI support
+
+#
+# HDMI CEC support
+#
+# CONFIG_HDMI_CEC is not set
+# end of HDMI CEC support
+# end of Misc devices
+
+#
+# SCSI device support
+#
+CONFIG_SCSI_MOD=y
+# CONFIG_RAID_ATTRS is not set
+CONFIG_SCSI=y
+CONFIG_SCSI_DMA=y
+# CONFIG_SCSI_PROC_FS is not set
+
+#
+# SCSI support type (disk, tape, CD-ROM)
+#
+CONFIG_BLK_DEV_SD=y
+# CONFIG_CHR_DEV_ST is not set
+# CONFIG_BLK_DEV_SR is not set
+CONFIG_CHR_DEV_SG=y
+# CONFIG_CHR_DEV_SCH is not set
+# CONFIG_SCSI_CONSTANTS is not set
+# CONFIG_SCSI_LOGGING is not set
+CONFIG_SCSI_SCAN_ASYNC=y
+
+#
+# SCSI Transports
+#
+# CONFIG_SCSI_SPI_ATTRS is not set
+# CONFIG_SCSI_FC_ATTRS is not set
+# CONFIG_SCSI_ISCSI_ATTRS is not set
+# CONFIG_SCSI_SAS_ATTRS is not set
+# CONFIG_SCSI_SAS_LIBSAS is not set
+# CONFIG_SCSI_SRP_ATTRS is not set
+# end of SCSI Transports
+
+# CONFIG_SCSI_LOWLEVEL is not set
+# CONFIG_SCSI_DH is not set
+# end of SCSI device support
+
+CONFIG_HAVE_PATA_PLATFORM=y
+CONFIG_ATA=y
+CONFIG_ATA_VERBOSE_ERROR=y
+CONFIG_SATA_PMP=y
+
+#
+# Controllers with non-SFF native interface
+#
+# CONFIG_SATA_AHCI is not set
+# CONFIG_SATA_AHCI_PLATFORM is not set
+# CONFIG_AHCI_CEVA is not set
+CONFIG_AHCI_MVEBU=m
+# CONFIG_AHCI_QORIQ is not set
+# CONFIG_SATA_INIC162X is not set
+# CONFIG_SATA_ACARD_AHCI is not set
+# CONFIG_SATA_SIL24 is not set
+# CONFIG_ATA_SFF is not set
+CONFIG_MD=y
+CONFIG_BLK_DEV_MD=y
+# CONFIG_MD_AUTODETECT is not set
+# CONFIG_MD_LINEAR is not set
+CONFIG_MD_RAID0=y
+CONFIG_MD_RAID1=y
+CONFIG_MD_RAID10=y
+CONFIG_MD_RAID456=y
+# CONFIG_MD_MULTIPATH is not set
+# CONFIG_MD_FAULTY is not set
+# CONFIG_BCACHE is not set
+CONFIG_BLK_DEV_DM_BUILTIN=y
+CONFIG_BLK_DEV_DM=y
+# CONFIG_DM_DEBUG is not set
+# CONFIG_DM_UNSTRIPED is not set
+CONFIG_DM_CRYPT=y
+# CONFIG_DM_SNAPSHOT is not set
+# CONFIG_DM_THIN_PROVISIONING is not set
+# CONFIG_DM_CACHE is not set
+# CONFIG_DM_WRITECACHE is not set
+# CONFIG_DM_ERA is not set
+# CONFIG_DM_CLONE is not set
+# CONFIG_DM_MIRROR is not set
+# CONFIG_DM_RAID is not set
+# CONFIG_DM_ZERO is not set
+# CONFIG_DM_MULTIPATH is not set
+# CONFIG_DM_DELAY is not set
+# CONFIG_DM_DUST is not set
+# CONFIG_DM_INIT is not set
+# CONFIG_DM_UEVENT is not set
+# CONFIG_DM_FLAKEY is not set
+# CONFIG_DM_VERITY is not set
+# CONFIG_DM_SWITCH is not set
+# CONFIG_DM_LOG_WRITES is not set
+# CONFIG_DM_INTEGRITY is not set
+# CONFIG_TARGET_CORE is not set
+# CONFIG_FUSION is not set
+
+#
+# IEEE 1394 (FireWire) support
+#
+# CONFIG_FIREWIRE is not set
+# CONFIG_FIREWIRE_NOSY is not set
+# end of IEEE 1394 (FireWire) support
+
+CONFIG_NETDEVICES=y
+CONFIG_MII=y
+CONFIG_NET_CORE=y
+# CONFIG_BONDING is not set
+CONFIG_DUMMY=y
+# CONFIG_EQUALIZER is not set
+# CONFIG_NET_FC is not set
+# CONFIG_IFB is not set
+# CONFIG_NET_TEAM is not set
+# CONFIG_MACVLAN is not set
+# CONFIG_IPVLAN is not set
+# CONFIG_VXLAN is not set
+# CONFIG_GENEVE is not set
+# CONFIG_GTP is not set
+# CONFIG_MACSEC is not set
+# CONFIG_NETCONSOLE is not set
+CONFIG_TUN=y
+# CONFIG_TUN_VNET_CROSS_LE is not set
+CONFIG_VETH=y
+# CONFIG_NLMON is not set
+# CONFIG_VSOCKMON is not set
+# CONFIG_ARCNET is not set
+
+#
+# CAIF transport drivers
+#
+
+#
+# Distributed Switch Architecture drivers
+#
+# end of Distributed Switch Architecture drivers
+
+CONFIG_ETHERNET=y
+# CONFIG_NET_VENDOR_3COM is not set
+# CONFIG_NET_VENDOR_ADAPTEC is not set
+# CONFIG_NET_VENDOR_AGERE is not set
+# CONFIG_NET_VENDOR_ALACRITECH is not set
+# CONFIG_NET_VENDOR_ALTEON is not set
+# CONFIG_ALTERA_TSE is not set
+# CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AMD is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
+# CONFIG_NET_VENDOR_ARC is not set
+# CONFIG_NET_VENDOR_ATHEROS is not set
+# CONFIG_NET_VENDOR_AURORA is not set
+# CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_VENDOR_BROCADE is not set
+# CONFIG_NET_VENDOR_CADENCE is not set
+# CONFIG_NET_VENDOR_CAVIUM is not set
+# CONFIG_NET_VENDOR_CHELSIO is not set
+# CONFIG_NET_VENDOR_CISCO is not set
+# CONFIG_NET_VENDOR_CORTINA is not set
+# CONFIG_DNET is not set
+# CONFIG_NET_VENDOR_DEC is not set
+# CONFIG_NET_VENDOR_DLINK is not set
+# CONFIG_NET_VENDOR_EMULEX is not set
+# CONFIG_NET_VENDOR_EZCHIP is not set
+# CONFIG_NET_VENDOR_GOOGLE is not set
+# CONFIG_NET_VENDOR_HISILICON is not set
+# CONFIG_NET_VENDOR_HP is not set
+# CONFIG_NET_VENDOR_HUAWEI is not set
+# CONFIG_NET_VENDOR_INTEL is not set
+# CONFIG_JME is not set
+CONFIG_NET_VENDOR_MARVELL=y
+CONFIG_MVMDIO=y
+# CONFIG_MVNETA is not set
+CONFIG_MVPP2=y
+CONFIG_MVPP2_FBX_FF=y
+# CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
+# CONFIG_OCTEONTX2_AF is not set
+# CONFIG_NET_VENDOR_MELLANOX is not set
+# CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROCHIP is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
+# CONFIG_NET_VENDOR_MYRI is not set
+# CONFIG_FEALNX is not set
+# CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_NETERION is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
+# CONFIG_NET_VENDOR_NI is not set
+# CONFIG_NET_VENDOR_NVIDIA is not set
+# CONFIG_NET_VENDOR_OKI is not set
+# CONFIG_ETHOC is not set
+# CONFIG_NET_VENDOR_PACKET_ENGINES is not set
+# CONFIG_NET_VENDOR_PENSANDO is not set
+# CONFIG_NET_VENDOR_QLOGIC is not set
+# CONFIG_NET_VENDOR_QUALCOMM is not set
+# CONFIG_NET_VENDOR_RDC is not set
+# CONFIG_NET_VENDOR_REALTEK is not set
+# CONFIG_NET_VENDOR_RENESAS is not set
+# CONFIG_NET_VENDOR_ROCKER is not set
+# CONFIG_NET_VENDOR_SAMSUNG is not set
+# CONFIG_NET_VENDOR_SEEQ is not set
+# CONFIG_NET_VENDOR_SOLARFLARE is not set
+# CONFIG_NET_VENDOR_SILAN is not set
+# CONFIG_NET_VENDOR_SIS is not set
+# CONFIG_NET_VENDOR_SMSC is not set
+# CONFIG_NET_VENDOR_SOCIONEXT is not set
+# CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_SUN is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
+# CONFIG_NET_VENDOR_TEHUTI is not set
+# CONFIG_NET_VENDOR_TI is not set
+# CONFIG_NET_VENDOR_VIA is not set
+# CONFIG_NET_VENDOR_WIZNET is not set
+# CONFIG_FDDI is not set
+# CONFIG_HIPPI is not set
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_BUS=y
+# CONFIG_MDIO_BCM_UNIMAC is not set
+# CONFIG_MDIO_BITBANG is not set
+# CONFIG_MDIO_BUS_MUX_GPIO is not set
+# CONFIG_MDIO_BUS_MUX_MMIOREG is not set
+# CONFIG_MDIO_BUS_MUX_MULTIPLEXER is not set
+# CONFIG_MDIO_HISI_FEMAC is not set
+CONFIG_MDIO_I2C=y
+# CONFIG_MDIO_MSCC_MIIM is not set
+# CONFIG_MDIO_OCTEON is not set
+# CONFIG_MDIO_THUNDER is not set
+CONFIG_PHYLINK=y
+CONFIG_PHYLIB=y
+CONFIG_SWPHY=y
+# CONFIG_LED_TRIGGER_PHY is not set
+
+#
+# MII PHY device drivers
+#
+CONFIG_SFP=y
+# CONFIG_ADIN_PHY is not set
+# CONFIG_AMD_PHY is not set
+# CONFIG_AQUANTIA_PHY is not set
+# CONFIG_AX88796B_PHY is not set
+# CONFIG_AT803X_PHY is not set
+# CONFIG_BCM7XXX_PHY is not set
+# CONFIG_BCM87XX_PHY is not set
+# CONFIG_BROADCOM_PHY is not set
+# CONFIG_CICADA_PHY is not set
+# CONFIG_CORTINA_PHY is not set
+# CONFIG_DAVICOM_PHY is not set
+# CONFIG_DP83822_PHY is not set
+# CONFIG_DP83TC811_PHY is not set
+# CONFIG_DP83848_PHY is not set
+# CONFIG_DP83867_PHY is not set
+CONFIG_FIXED_PHY=y
+# CONFIG_ICPLUS_PHY is not set
+# CONFIG_INTEL_XWAY_PHY is not set
+# CONFIG_LSI_ET1011C_PHY is not set
+# CONFIG_LXT_PHY is not set
+# CONFIG_MARVELL_PHY is not set
+# CONFIG_MARVELL_10G_PHY is not set
+# CONFIG_MICREL_PHY is not set
+# CONFIG_MICROCHIP_PHY is not set
+# CONFIG_MICROCHIP_T1_PHY is not set
+# CONFIG_MICROSEMI_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_NXP_TJA11XX_PHY is not set
+# CONFIG_QSEMI_PHY is not set
+# CONFIG_REALTEK_PHY is not set
+# CONFIG_RENESAS_PHY is not set
+# CONFIG_ROCKCHIP_PHY is not set
+# CONFIG_SMSC_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_TERANETICS_PHY is not set
+# CONFIG_VITESSE_PHY is not set
+# CONFIG_XILINX_GMII2RGMII is not set
+# CONFIG_MICREL_KS8995MA is not set
+CONFIG_PPP=y
+# CONFIG_PPP_BSDCOMP is not set
+# CONFIG_PPP_DEFLATE is not set
+# CONFIG_PPP_FILTER is not set
+CONFIG_PPP_MPPE=y
+# CONFIG_PPP_MULTILINK is not set
+CONFIG_PPPOE=y
+CONFIG_PPTP=y
+# CONFIG_PPP_ASYNC is not set
+# CONFIG_PPP_SYNC_TTY is not set
+# CONFIG_SLIP is not set
+CONFIG_SLHC=y
+CONFIG_USB_NET_DRIVERS=y
+# CONFIG_USB_CATC is not set
+# CONFIG_USB_KAWETH is not set
+# CONFIG_USB_PEGASUS is not set
+# CONFIG_USB_RTL8150 is not set
+# CONFIG_USB_RTL8152 is not set
+# CONFIG_USB_LAN78XX is not set
+CONFIG_USB_USBNET=y
+# CONFIG_USB_NET_AX8817X is not set
+# CONFIG_USB_NET_AX88179_178A is not set
+CONFIG_USB_NET_CDCETHER=y
+# CONFIG_USB_NET_CDC_EEM is not set
+# CONFIG_USB_NET_CDC_NCM is not set
+# CONFIG_USB_NET_HUAWEI_CDC_NCM is not set
+# CONFIG_USB_NET_CDC_MBIM is not set
+# CONFIG_USB_NET_DM9601 is not set
+# CONFIG_USB_NET_SR9700 is not set
+# CONFIG_USB_NET_SR9800 is not set
+# CONFIG_USB_NET_SMSC75XX is not set
+# CONFIG_USB_NET_SMSC95XX is not set
+# CONFIG_USB_NET_GL620A is not set
+# CONFIG_USB_NET_NET1080 is not set
+# CONFIG_USB_NET_PLUSB is not set
+# CONFIG_USB_NET_MCS7830 is not set
+# CONFIG_USB_NET_RNDIS_HOST is not set
+# CONFIG_USB_NET_CDC_SUBSET is not set
+# CONFIG_USB_NET_ZAURUS is not set
+# CONFIG_USB_NET_CX82310_ETH is not set
+# CONFIG_USB_NET_KALMIA is not set
+# CONFIG_USB_NET_QMI_WWAN is not set
+# CONFIG_USB_NET_INT51X1 is not set
+# CONFIG_USB_IPHETH is not set
+# CONFIG_USB_SIERRA_NET is not set
+# CONFIG_USB_VL600 is not set
+# CONFIG_USB_NET_CH9200 is not set
+# CONFIG_USB_NET_AQC111 is not set
+CONFIG_WLAN=y
+# CONFIG_WIRELESS_WDS is not set
+# CONFIG_WLAN_VENDOR_ADMTEK is not set
+CONFIG_ATH_COMMON=y
+CONFIG_WLAN_VENDOR_ATH=y
+# CONFIG_ATH_DEBUG is not set
+CONFIG_ATH_REG_IGNORE=y
+# CONFIG_ATH_REG_DYNAMIC_USER_REG_HINTS is not set
+# CONFIG_ATH5K is not set
+# CONFIG_ATH5K_PCI is not set
+# CONFIG_ATH9K is not set
+# CONFIG_ATH9K_HTC is not set
+# CONFIG_CARL9170 is not set
+# CONFIG_ATH6KL is not set
+# CONFIG_AR5523 is not set
+# CONFIG_WIL6210 is not set
+CONFIG_ATH10K=y
+CONFIG_ATH10K_CE=y
+CONFIG_ATH10K_PCI=m
+# CONFIG_ATH10K_AHB is not set
+# CONFIG_ATH10K_SDIO is not set
+# CONFIG_ATH10K_USB is not set
+CONFIG_ATH10K_DEBUG=y
+CONFIG_ATH10K_DEBUGFS=y
+# CONFIG_ATH10K_SPECTRAL is not set
+CONFIG_ATH10K_DFS_CERTIFIED=y
+# CONFIG_WCN36XX is not set
+# CONFIG_WLAN_VENDOR_ATMEL is not set
+# CONFIG_WLAN_VENDOR_BROADCOM is not set
+# CONFIG_WLAN_VENDOR_CISCO is not set
+# CONFIG_WLAN_VENDOR_INTEL is not set
+# CONFIG_WLAN_VENDOR_INTERSIL is not set
+CONFIG_WLAN_VENDOR_MARVELL=y
+# CONFIG_LIBERTAS is not set
+# CONFIG_LIBERTAS_THINFIRM is not set
+# CONFIG_MWIFIEX is not set
+# CONFIG_MWL8K is not set
+CONFIG_MWL8K_NEW=m
+# CONFIG_WLAN_VENDOR_MEDIATEK is not set
+# CONFIG_WLAN_VENDOR_RALINK is not set
+# CONFIG_WLAN_VENDOR_REALTEK is not set
+# CONFIG_WLAN_VENDOR_RSI is not set
+# CONFIG_WLAN_VENDOR_ST is not set
+# CONFIG_WLAN_VENDOR_TI is not set
+# CONFIG_WLAN_VENDOR_ZYDAS is not set
+CONFIG_WLAN_VENDOR_QUANTENNA=y
+# CONFIG_QTNFMAC_PCIE is not set
+# CONFIG_MAC80211_HWSIM is not set
+# CONFIG_USB_NET_RNDIS_WLAN is not set
+# CONFIG_VIRT_WIFI is not set
+
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
+# CONFIG_WAN is not set
+# CONFIG_VMXNET3 is not set
+# CONFIG_NETDEVSIM is not set
+# CONFIG_NET_FAILOVER is not set
+# CONFIG_ISDN is not set
+# CONFIG_NVM is not set
+
+#
+# Input device support
+#
+CONFIG_INPUT=y
+# CONFIG_INPUT_LEDS is not set
+# CONFIG_INPUT_FF_MEMLESS is not set
+CONFIG_INPUT_POLLDEV=y
+# CONFIG_INPUT_SPARSEKMAP is not set
+# CONFIG_INPUT_MATRIXKMAP is not set
+
+#
+# Userland interfaces
+#
+# CONFIG_INPUT_MOUSEDEV is not set
+# CONFIG_INPUT_JOYDEV is not set
+CONFIG_INPUT_EVDEV=y
+# CONFIG_INPUT_EVBUG is not set
+
+#
+# Input Device Drivers
+#
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_TABLET is not set
+# CONFIG_INPUT_TOUCHSCREEN is not set
+CONFIG_INPUT_MISC=y
+# CONFIG_INPUT_AD714X is not set
+# CONFIG_INPUT_ATMEL_CAPTOUCH is not set
+# CONFIG_INPUT_BMA150 is not set
+# CONFIG_INPUT_E3X0_BUTTON is not set
+# CONFIG_INPUT_MSM_VIBRATOR is not set
+# CONFIG_INPUT_MMA8450 is not set
+# CONFIG_INPUT_GP2A is not set
+# CONFIG_INPUT_GPIO_BEEPER is not set
+# CONFIG_INPUT_GPIO_DECODER is not set
+# CONFIG_INPUT_GPIO_VIBRA is not set
+# CONFIG_INPUT_ATI_REMOTE2 is not set
+# CONFIG_INPUT_KEYSPAN_REMOTE is not set
+# CONFIG_INPUT_KXTJ9 is not set
+# CONFIG_INPUT_POWERMATE is not set
+# CONFIG_INPUT_YEALINK is not set
+# CONFIG_INPUT_CM109 is not set
+# CONFIG_INPUT_UINPUT is not set
+# CONFIG_INPUT_PCF8574 is not set
+# CONFIG_INPUT_GPIO_ROTARY_ENCODER is not set
+# CONFIG_INPUT_ADXL34X is not set
+# CONFIG_INPUT_IMS_PCU is not set
+# CONFIG_INPUT_CMA3000 is not set
+# CONFIG_INPUT_DRV260X_HAPTICS is not set
+# CONFIG_INPUT_DRV2665_HAPTICS is not set
+# CONFIG_INPUT_DRV2667_HAPTICS is not set
+CONFIG_INPUT_SMSC_CAP1066=y
+# CONFIG_RMI4_CORE is not set
+
+#
+# Hardware I/O ports
+#
+# CONFIG_SERIO is not set
+# CONFIG_GAMEPORT is not set
+# end of Hardware I/O ports
+# end of Input device support
+
+#
+# Character devices
+#
+CONFIG_TTY=y
+CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_VT_CONSOLE=y
+CONFIG_HW_CONSOLE=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_UNIX98_PTYS=y
+CONFIG_LEGACY_PTYS=y
+CONFIG_LEGACY_PTY_COUNT=16
+# CONFIG_SERIAL_NONSTANDARD is not set
+# CONFIG_NOZOMI is not set
+# CONFIG_N_GSM is not set
+# CONFIG_TRACE_SINK is not set
+# CONFIG_NULL_TTY is not set
+CONFIG_LDISC_AUTOLOAD=y
+CONFIG_DEVMEM=y
+# CONFIG_DEVPHYSMEM is not set
+
+#
+# Serial drivers
+#
+CONFIG_SERIAL_EARLYCON=y
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y
+# CONFIG_SERIAL_8250_FINTEK is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+# CONFIG_SERIAL_8250_PCI is not set
+CONFIG_SERIAL_8250_NR_UARTS=6
+CONFIG_SERIAL_8250_RUNTIME_UARTS=6
+# CONFIG_SERIAL_8250_EXTENDED is not set
+# CONFIG_SERIAL_8250_ASPEED_VUART is not set
+CONFIG_SERIAL_8250_DWLIB=y
+CONFIG_SERIAL_8250_FSL=y
+CONFIG_SERIAL_8250_DW=y
+# CONFIG_SERIAL_8250_RT288X is not set
+CONFIG_SERIAL_OF_PLATFORM=y
+
+#
+# Non-8250 serial port support
+#
+# CONFIG_SERIAL_AMBA_PL010 is not set
+# CONFIG_SERIAL_AMBA_PL011 is not set
+# CONFIG_SERIAL_EARLYCON_ARM_SEMIHOST is not set
+# CONFIG_SERIAL_MAX3100 is not set
+# CONFIG_SERIAL_MAX310X is not set
+# CONFIG_SERIAL_UARTLITE is not set
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_JSM is not set
+# CONFIG_SERIAL_SIFIVE is not set
+# CONFIG_SERIAL_SCCNXP is not set
+# CONFIG_SERIAL_SC16IS7XX is not set
+# CONFIG_SERIAL_ALTERA_JTAGUART is not set
+# CONFIG_SERIAL_ALTERA_UART is not set
+# CONFIG_SERIAL_IFX6X60 is not set
+# CONFIG_SERIAL_XILINX_PS_UART is not set
+# CONFIG_SERIAL_ARC is not set
+# CONFIG_SERIAL_RP2 is not set
+# CONFIG_SERIAL_FSL_LPUART is not set
+# CONFIG_SERIAL_FSL_LINFLEXUART is not set
+# CONFIG_SERIAL_CONEXANT_DIGICOLOR is not set
+# CONFIG_SERIAL_MVEBU_UART is not set
+# end of Serial drivers
+
+CONFIG_SERIAL_MCTRL_GPIO=y
+# CONFIG_SERIAL_DEV_BUS is not set
+# CONFIG_TTY_PRINTK is not set
+# CONFIG_HVC_DCC is not set
+# CONFIG_IPMI_HANDLER is not set
+CONFIG_HW_RANDOM=y
+# CONFIG_HW_RANDOM_TIMERIOMEM is not set
+CONFIG_HW_RANDOM_OMAP=y
+# CONFIG_HW_RANDOM_CAVIUM is not set
+# CONFIG_HW_RANDOM_OPTEE is not set
+# CONFIG_APPLICOM is not set
+# CONFIG_RAW_DRIVER is not set
+# CONFIG_TCG_TPM is not set
+# CONFIG_DEVPORT is not set
+# CONFIG_XILLYBUS is not set
+# end of Character devices
+
+# CONFIG_RANDOM_TRUST_BOOTLOADER is not set
+
+#
+# I2C support
+#
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_MUX=y
+
+#
+# Multiplexer I2C Chip support
+#
+# CONFIG_I2C_ARB_GPIO_CHALLENGE is not set
+CONFIG_I2C_MUX_GPIO=y
+# CONFIG_I2C_MUX_GPMUX is not set
+# CONFIG_I2C_MUX_LTC4306 is not set
+# CONFIG_I2C_MUX_PCA9541 is not set
+# CONFIG_I2C_MUX_PCA954x is not set
+# CONFIG_I2C_MUX_PINCTRL is not set
+# CONFIG_I2C_MUX_REG is not set
+# CONFIG_I2C_DEMUX_PINCTRL is not set
+# CONFIG_I2C_MUX_MLXCPLD is not set
+# end of Multiplexer I2C Chip support
+
+CONFIG_I2C_HELPER_AUTO=y
+CONFIG_I2C_ALGOBIT=y
+
+#
+# I2C Hardware Bus support
+#
+
+#
+# PC SMBus host controller drivers
+#
+# CONFIG_I2C_ALI1535 is not set
+# CONFIG_I2C_ALI1563 is not set
+# CONFIG_I2C_ALI15X3 is not set
+# CONFIG_I2C_AMD756 is not set
+# CONFIG_I2C_AMD8111 is not set
+# CONFIG_I2C_I801 is not set
+# CONFIG_I2C_ISCH is not set
+# CONFIG_I2C_PIIX4 is not set
+# CONFIG_I2C_NFORCE2 is not set
+# CONFIG_I2C_NVIDIA_GPU is not set
+# CONFIG_I2C_SIS5595 is not set
+# CONFIG_I2C_SIS630 is not set
+# CONFIG_I2C_SIS96X is not set
+# CONFIG_I2C_VIA is not set
+# CONFIG_I2C_VIAPRO is not set
+
+#
+# I2C system bus drivers (mostly embedded / system-on-chip)
+#
+# CONFIG_I2C_CADENCE is not set
+# CONFIG_I2C_CBUS_GPIO is not set
+# CONFIG_I2C_DESIGNWARE_PLATFORM is not set
+# CONFIG_I2C_DESIGNWARE_PCI is not set
+# CONFIG_I2C_EMEV2 is not set
+CONFIG_I2C_GPIO=y
+# CONFIG_I2C_GPIO_FAULT_INJECTOR is not set
+CONFIG_I2C_MV64XXX=y
+# CONFIG_I2C_NOMADIK is not set
+# CONFIG_I2C_OCORES is not set
+# CONFIG_I2C_PCA_PLATFORM is not set
+# CONFIG_I2C_PXA is not set
+# CONFIG_I2C_RK3X is not set
+# CONFIG_I2C_SIMTEC is not set
+# CONFIG_I2C_THUNDERX is not set
+# CONFIG_I2C_XILINX is not set
+
+#
+# External I2C/SMBus adapter drivers
+#
+# CONFIG_I2C_DIOLAN_U2C is not set
+# CONFIG_I2C_PARPORT_LIGHT is not set
+# CONFIG_I2C_ROBOTFUZZ_OSIF is not set
+# CONFIG_I2C_TAOS_EVM is not set
+# CONFIG_I2C_TINY_USB is not set
+
+#
+# Other I2C/SMBus bus drivers
+#
+# end of I2C Hardware Bus support
+
+# CONFIG_I2C_STUB is not set
+# CONFIG_I2C_SLAVE is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# end of I2C support
+
+# CONFIG_I3C is not set
+CONFIG_SPI=y
+# CONFIG_SPI_DEBUG is not set
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_MEM=y
+
+#
+# SPI Master Controller Drivers
+#
+# CONFIG_SPI_ALTERA is not set
+# CONFIG_SPI_ARMADA_3700 is not set
+# CONFIG_SPI_AXI_SPI_ENGINE is not set
+# CONFIG_SPI_BITBANG is not set
+# CONFIG_SPI_CADENCE is not set
+# CONFIG_SPI_DESIGNWARE is not set
+# CONFIG_SPI_NXP_FLEXSPI is not set
+# CONFIG_SPI_GPIO is not set
+# CONFIG_SPI_FSL_SPI is not set
+# CONFIG_SPI_OC_TINY is not set
+CONFIG_SPI_ORION=y
+# CONFIG_SPI_PL022 is not set
+# CONFIG_SPI_PXA2XX is not set
+# CONFIG_SPI_ROCKCHIP is not set
+# CONFIG_SPI_SC18IS602 is not set
+# CONFIG_SPI_SIFIVE is not set
+# CONFIG_SPI_MXIC is not set
+# CONFIG_SPI_THUNDERX is not set
+# CONFIG_SPI_XCOMM is not set
+# CONFIG_SPI_XILINX is not set
+# CONFIG_SPI_ZYNQMP_GQSPI is not set
+
+#
+# SPI Protocol Masters
+#
+# CONFIG_SPI_SPIDEV is not set
+# CONFIG_SPI_LOOPBACK_TEST is not set
+# CONFIG_SPI_TLE62X0 is not set
+# CONFIG_SPI_SLAVE is not set
+# CONFIG_SPMI is not set
+# CONFIG_HSI is not set
+# CONFIG_PPS is not set
+
+#
+# PTP clock support
+#
+# CONFIG_PTP_1588_CLOCK is not set
+
+#
+# Enable PHYLIB and NETWORK_PHY_TIMESTAMPING to see the additional clocks.
+#
+# end of PTP clock support
+
+CONFIG_PINCTRL=y
+CONFIG_PINMUX=y
+CONFIG_PINCONF=y
+CONFIG_GENERIC_PINCONF=y
+# CONFIG_DEBUG_PINCTRL is not set
+# CONFIG_PINCTRL_AMD is not set
+# CONFIG_PINCTRL_MCP23S08 is not set
+# CONFIG_PINCTRL_SINGLE is not set
+# CONFIG_PINCTRL_SX150X is not set
+# CONFIG_PINCTRL_STMFX is not set
+# CONFIG_PINCTRL_OCELOT is not set
+CONFIG_PINCTRL_MVEBU=y
+CONFIG_PINCTRL_ARMADA_AP806=y
+CONFIG_PINCTRL_ARMADA_CP110=y
+CONFIG_PINCTRL_ARMADA_37XX=y
+CONFIG_GPIOLIB=y
+CONFIG_GPIOLIB_FASTPATH_LIMIT=512
+CONFIG_OF_GPIO=y
+CONFIG_GPIOLIB_IRQCHIP=y
+# CONFIG_DEBUG_GPIO is not set
+CONFIG_GPIO_SYSFS=y
+
+#
+# Memory mapped GPIO drivers
+#
+# CONFIG_GPIO_74XX_MMIO is not set
+# CONFIG_GPIO_ALTERA is not set
+# CONFIG_GPIO_CADENCE is not set
+# CONFIG_GPIO_DWAPB is not set
+# CONFIG_GPIO_FTGPIO010 is not set
+# CONFIG_GPIO_GENERIC_PLATFORM is not set
+# CONFIG_GPIO_GRGPIO is not set
+# CONFIG_GPIO_HLWD is not set
+# CONFIG_GPIO_MB86S7X is not set
+CONFIG_GPIO_MVEBU=y
+# CONFIG_GPIO_PL061 is not set
+# CONFIG_GPIO_SAMA5D2_PIOBU is not set
+# CONFIG_GPIO_SYSCON is not set
+# CONFIG_GPIO_XGENE is not set
+# CONFIG_GPIO_XILINX is not set
+# CONFIG_GPIO_AMD_FCH is not set
+# end of Memory mapped GPIO drivers
+
+#
+# I2C GPIO expanders
+#
+# CONFIG_GPIO_ADP5588 is not set
+# CONFIG_GPIO_ADNP is not set
+# CONFIG_GPIO_GW_PLD is not set
+# CONFIG_GPIO_MAX7300 is not set
+# CONFIG_GPIO_MAX732X is not set
+CONFIG_GPIO_PCA953X=y
+# CONFIG_GPIO_PCA953X_IRQ is not set
+# CONFIG_GPIO_PCF857X is not set
+# CONFIG_GPIO_TPIC2810 is not set
+# end of I2C GPIO expanders
+
+#
+# MFD GPIO expanders
+#
+# end of MFD GPIO expanders
+
+#
+# PCI GPIO expanders
+#
+# CONFIG_GPIO_BT8XX is not set
+# CONFIG_GPIO_PCI_IDIO_16 is not set
+# CONFIG_GPIO_PCIE_IDIO_24 is not set
+# CONFIG_GPIO_RDC321X is not set
+# end of PCI GPIO expanders
+
+#
+# SPI GPIO expanders
+#
+# CONFIG_GPIO_74X164 is not set
+# CONFIG_GPIO_MAX3191X is not set
+# CONFIG_GPIO_MAX7301 is not set
+# CONFIG_GPIO_MC33880 is not set
+# CONFIG_GPIO_PISOSR is not set
+# CONFIG_GPIO_XRA1403 is not set
+# end of SPI GPIO expanders
+
+#
+# USB GPIO expanders
+#
+# end of USB GPIO expanders
+
+# CONFIG_GPIO_MOCKUP is not set
+CONFIG_FREEBOX_GPIO=y
+CONFIG_FREEBOX_GPIO_DT=y
+CONFIG_FREEBOX_JTAG=m
+# CONFIG_W1 is not set
+# CONFIG_POWER_AVS is not set
+CONFIG_POWER_RESET=y
+# CONFIG_POWER_RESET_BRCMSTB is not set
+# CONFIG_POWER_RESET_GPIO is not set
+# CONFIG_POWER_RESET_GPIO_RESTART is not set
+# CONFIG_POWER_RESET_LTC2952 is not set
+# CONFIG_POWER_RESET_RESTART is not set
+# CONFIG_POWER_RESET_XGENE is not set
+# CONFIG_POWER_RESET_SYSCON is not set
+# CONFIG_POWER_RESET_SYSCON_POWEROFF is not set
+# CONFIG_SYSCON_REBOOT_MODE is not set
+# CONFIG_NVMEM_REBOOT_MODE is not set
+CONFIG_POWER_SUPPLY=y
+# CONFIG_POWER_SUPPLY_DEBUG is not set
+# CONFIG_POWER_SUPPLY_HWMON is not set
+# CONFIG_PDA_POWER is not set
+# CONFIG_TEST_POWER is not set
+# CONFIG_CHARGER_ADP5061 is not set
+# CONFIG_BATTERY_DS2780 is not set
+# CONFIG_BATTERY_DS2781 is not set
+# CONFIG_BATTERY_DS2782 is not set
+# CONFIG_BATTERY_SBS is not set
+# CONFIG_CHARGER_SBS is not set
+# CONFIG_MANAGER_SBS is not set
+# CONFIG_BATTERY_BQ27XXX is not set
+# CONFIG_BATTERY_MAX17040 is not set
+# CONFIG_BATTERY_MAX17042 is not set
+# CONFIG_CHARGER_MAX8903 is not set
+# CONFIG_CHARGER_LP8727 is not set
+# CONFIG_CHARGER_GPIO is not set
+# CONFIG_CHARGER_LT3651 is not set
+# CONFIG_CHARGER_DETECTOR_MAX14656 is not set
+# CONFIG_CHARGER_BQ2415X is not set
+# CONFIG_CHARGER_BQ24257 is not set
+# CONFIG_CHARGER_BQ24735 is not set
+# CONFIG_CHARGER_BQ25890 is not set
+# CONFIG_CHARGER_SMB347 is not set
+# CONFIG_BATTERY_GAUGE_LTC2941 is not set
+# CONFIG_CHARGER_RT9455 is not set
+CONFIG_HWMON=y
+CONFIG_HWMON_VID=y
+# CONFIG_HWMON_DEBUG_CHIP is not set
+
+#
+# Native drivers
+#
+# CONFIG_SENSORS_AD7314 is not set
+# CONFIG_SENSORS_AD7414 is not set
+# CONFIG_SENSORS_AD7418 is not set
+# CONFIG_SENSORS_ADM1021 is not set
+# CONFIG_SENSORS_ADM1025 is not set
+# CONFIG_SENSORS_ADM1026 is not set
+# CONFIG_SENSORS_ADM1029 is not set
+# CONFIG_SENSORS_ADM1031 is not set
+# CONFIG_SENSORS_ADM9240 is not set
+# CONFIG_SENSORS_ADT7310 is not set
+# CONFIG_SENSORS_ADT7410 is not set
+# CONFIG_SENSORS_ADT7411 is not set
+# CONFIG_SENSORS_ADT7462 is not set
+# CONFIG_SENSORS_ADT7470 is not set
+CONFIG_SENSORS_ADT7475=y
+# CONFIG_SENSORS_AS370 is not set
+# CONFIG_SENSORS_ASC7621 is not set
+# CONFIG_SENSORS_ASPEED is not set
+# CONFIG_SENSORS_ATXP1 is not set
+# CONFIG_SENSORS_DS620 is not set
+# CONFIG_SENSORS_DS1621 is not set
+# CONFIG_SENSORS_I5K_AMB is not set
+# CONFIG_SENSORS_F71805F is not set
+# CONFIG_SENSORS_F71882FG is not set
+# CONFIG_SENSORS_F75375S is not set
+# CONFIG_SENSORS_FTSTEUTATES is not set
+# CONFIG_SENSORS_GL518SM is not set
+# CONFIG_SENSORS_GL520SM is not set
+# CONFIG_SENSORS_G760A is not set
+# CONFIG_SENSORS_G762 is not set
+# CONFIG_SENSORS_GPIO_FAN is not set
+# CONFIG_SENSORS_HIH6130 is not set
+# CONFIG_SENSORS_IT87 is not set
+# CONFIG_SENSORS_JC42 is not set
+# CONFIG_SENSORS_POWR1220 is not set
+# CONFIG_SENSORS_LINEAGE is not set
+# CONFIG_SENSORS_LTC2945 is not set
+# CONFIG_SENSORS_LTC2990 is not set
+# CONFIG_SENSORS_LTC4151 is not set
+# CONFIG_SENSORS_LTC4215 is not set
+# CONFIG_SENSORS_LTC4222 is not set
+# CONFIG_SENSORS_LTC4245 is not set
+# CONFIG_SENSORS_LTC4260 is not set
+# CONFIG_SENSORS_LTC4261 is not set
+# CONFIG_SENSORS_MAX1111 is not set
+# CONFIG_SENSORS_MAX16065 is not set
+# CONFIG_SENSORS_MAX1619 is not set
+# CONFIG_SENSORS_MAX1668 is not set
+# CONFIG_SENSORS_MAX197 is not set
+# CONFIG_SENSORS_MAX31722 is not set
+# CONFIG_SENSORS_MAX6621 is not set
+# CONFIG_SENSORS_MAX6639 is not set
+# CONFIG_SENSORS_MAX6642 is not set
+# CONFIG_SENSORS_MAX6650 is not set
+# CONFIG_SENSORS_MAX6697 is not set
+# CONFIG_SENSORS_MAX31790 is not set
+# CONFIG_SENSORS_MCP3021 is not set
+# CONFIG_SENSORS_TC654 is not set
+# CONFIG_SENSORS_ADCXX is not set
+# CONFIG_SENSORS_LM63 is not set
+# CONFIG_SENSORS_LM70 is not set
+# CONFIG_SENSORS_LM73 is not set
+# CONFIG_SENSORS_LM75 is not set
+# CONFIG_SENSORS_LM77 is not set
+# CONFIG_SENSORS_LM78 is not set
+# CONFIG_SENSORS_LM80 is not set
+# CONFIG_SENSORS_LM83 is not set
+# CONFIG_SENSORS_LM85 is not set
+# CONFIG_SENSORS_LM87 is not set
+# CONFIG_SENSORS_LM90 is not set
+# CONFIG_SENSORS_LM92 is not set
+# CONFIG_SENSORS_LM93 is not set
+# CONFIG_SENSORS_LM95234 is not set
+# CONFIG_SENSORS_LM95241 is not set
+# CONFIG_SENSORS_LM95245 is not set
+# CONFIG_SENSORS_PC87360 is not set
+# CONFIG_SENSORS_PC87427 is not set
+# CONFIG_SENSORS_NTC_THERMISTOR is not set
+# CONFIG_SENSORS_NCT6683 is not set
+# CONFIG_SENSORS_NCT6775 is not set
+# CONFIG_SENSORS_NCT7802 is not set
+# CONFIG_SENSORS_NCT7904 is not set
+# CONFIG_SENSORS_NPCM7XX is not set
+# CONFIG_SENSORS_OCC_P8_I2C is not set
+# CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_PMBUS is not set
+# CONFIG_SENSORS_SHT15 is not set
+# CONFIG_SENSORS_SHT21 is not set
+# CONFIG_SENSORS_SHT3x is not set
+# CONFIG_SENSORS_SHTC1 is not set
+# CONFIG_SENSORS_SIS5595 is not set
+# CONFIG_SENSORS_DME1737 is not set
+# CONFIG_SENSORS_EMC1403 is not set
+# CONFIG_SENSORS_EMC2103 is not set
+# CONFIG_SENSORS_EMC6W201 is not set
+# CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47M192 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
+# CONFIG_SENSORS_SCH5627 is not set
+# CONFIG_SENSORS_SCH5636 is not set
+# CONFIG_SENSORS_STTS751 is not set
+# CONFIG_SENSORS_SMM665 is not set
+# CONFIG_SENSORS_ADC128D818 is not set
+# CONFIG_SENSORS_ADS7828 is not set
+# CONFIG_SENSORS_ADS7871 is not set
+# CONFIG_SENSORS_AMC6821 is not set
+# CONFIG_SENSORS_INA209 is not set
+# CONFIG_SENSORS_INA2XX is not set
+# CONFIG_SENSORS_INA3221 is not set
+# CONFIG_SENSORS_TC74 is not set
+# CONFIG_SENSORS_THMC50 is not set
+# CONFIG_SENSORS_TMP102 is not set
+# CONFIG_SENSORS_TMP103 is not set
+# CONFIG_SENSORS_TMP108 is not set
+# CONFIG_SENSORS_TMP401 is not set
+# CONFIG_SENSORS_TMP421 is not set
+# CONFIG_SENSORS_VIA686A is not set
+# CONFIG_SENSORS_VT1211 is not set
+# CONFIG_SENSORS_VT8231 is not set
+# CONFIG_SENSORS_W83773G is not set
+# CONFIG_SENSORS_W83781D is not set
+# CONFIG_SENSORS_W83791D is not set
+# CONFIG_SENSORS_W83792D is not set
+# CONFIG_SENSORS_W83793 is not set
+# CONFIG_SENSORS_W83795 is not set
+# CONFIG_SENSORS_W83L785TS is not set
+# CONFIG_SENSORS_W83L786NG is not set
+# CONFIG_SENSORS_W83627HF is not set
+# CONFIG_SENSORS_W83627EHF is not set
+CONFIG_SENSORS_LD6710_FBX=m
+CONFIG_SENSORS_AP806=y
+CONFIG_THERMAL=y
+# CONFIG_THERMAL_STATISTICS is not set
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+# CONFIG_THERMAL_HWMON is not set
+# CONFIG_THERMAL_OF is not set
+# CONFIG_THERMAL_WRITABLE_TRIPS is not set
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+# CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set
+# CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set
+# CONFIG_THERMAL_DEFAULT_GOV_POWER_ALLOCATOR is not set
+# CONFIG_THERMAL_GOV_FAIR_SHARE is not set
+CONFIG_THERMAL_GOV_STEP_WISE=y
+# CONFIG_THERMAL_GOV_BANG_BANG is not set
+# CONFIG_THERMAL_GOV_USER_SPACE is not set
+# CONFIG_THERMAL_GOV_POWER_ALLOCATOR is not set
+# CONFIG_THERMAL_EMULATION is not set
+# CONFIG_THERMAL_MMIO is not set
+# CONFIG_ARMADA_THERMAL is not set
+# CONFIG_FREEBOX_WATCHDOG is not set
+CONFIG_WATCHDOG=y
+CONFIG_WATCHDOG_CORE=y
+# CONFIG_WATCHDOG_NOWAYOUT is not set
+CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=y
+CONFIG_WATCHDOG_OPEN_TIMEOUT=0
+CONFIG_WATCHDOG_SYSFS=y
+
+#
+# Watchdog Pretimeout Governors
+#
+# CONFIG_WATCHDOG_PRETIMEOUT_GOV is not set
+
+#
+# Watchdog Device Drivers
+#
+# CONFIG_SOFT_WATCHDOG is not set
+# CONFIG_GPIO_WATCHDOG is not set
+# CONFIG_XILINX_WATCHDOG is not set
+# CONFIG_ZIIRAVE_WATCHDOG is not set
+# CONFIG_ARM_SP805_WATCHDOG is not set
+CONFIG_ARM_SBSA_WATCHDOG=m
+# CONFIG_ARMADA_37XX_WATCHDOG is not set
+# CONFIG_CADENCE_WATCHDOG is not set
+# CONFIG_DW_WATCHDOG is not set
+# CONFIG_MAX63XX_WATCHDOG is not set
+# CONFIG_ALIM7101_WDT is not set
+# CONFIG_I6300ESB_WDT is not set
+# CONFIG_MEN_A21_WDT is not set
+
+#
+# PCI-based Watchdog Cards
+#
+# CONFIG_PCIPCWATCHDOG is not set
+# CONFIG_WDTPCI is not set
+
+#
+# USB-based Watchdog Cards
+#
+# CONFIG_USBPCWATCHDOG is not set
+CONFIG_SSB_POSSIBLE=y
+# CONFIG_SSB is not set
+CONFIG_BCMA_POSSIBLE=y
+# CONFIG_BCMA is not set
+
+#
+# Multifunction device drivers
+#
+# CONFIG_MFD_ACT8945A is not set
+# CONFIG_MFD_AS3711 is not set
+# CONFIG_MFD_AS3722 is not set
+# CONFIG_PMIC_ADP5520 is not set
+# CONFIG_MFD_AAT2870_CORE is not set
+# CONFIG_MFD_ATMEL_FLEXCOM is not set
+# CONFIG_MFD_ATMEL_HLCDC is not set
+# CONFIG_MFD_BCM590XX is not set
+# CONFIG_MFD_BD9571MWV is not set
+# CONFIG_MFD_AXP20X_I2C is not set
+# CONFIG_MFD_MADERA is not set
+# CONFIG_PMIC_DA903X is not set
+# CONFIG_MFD_DA9052_SPI is not set
+# CONFIG_MFD_DA9052_I2C is not set
+# CONFIG_MFD_DA9055 is not set
+# CONFIG_MFD_DA9062 is not set
+# CONFIG_MFD_DA9063 is not set
+# CONFIG_MFD_DA9150 is not set
+# CONFIG_MFD_DLN2 is not set
+# CONFIG_MFD_MC13XXX_SPI is not set
+# CONFIG_MFD_MC13XXX_I2C is not set
+# CONFIG_MFD_HI6421_PMIC is not set
+# CONFIG_HTC_PASIC3 is not set
+# CONFIG_HTC_I2CPLD is not set
+# CONFIG_LPC_ICH is not set
+# CONFIG_LPC_SCH is not set
+# CONFIG_MFD_JANZ_CMODIO is not set
+# CONFIG_MFD_KEMPLD is not set
+# CONFIG_MFD_88PM800 is not set
+# CONFIG_MFD_88PM805 is not set
+# CONFIG_MFD_88PM860X is not set
+# CONFIG_MFD_MAX14577 is not set
+# CONFIG_MFD_MAX77620 is not set
+# CONFIG_MFD_MAX77650 is not set
+# CONFIG_MFD_MAX77686 is not set
+# CONFIG_MFD_MAX77693 is not set
+# CONFIG_MFD_MAX77843 is not set
+# CONFIG_MFD_MAX8907 is not set
+# CONFIG_MFD_MAX8925 is not set
+# CONFIG_MFD_MAX8997 is not set
+# CONFIG_MFD_MAX8998 is not set
+# CONFIG_MFD_MT6397 is not set
+# CONFIG_MFD_MENF21BMC is not set
+# CONFIG_EZX_PCAP is not set
+# CONFIG_MFD_CPCAP is not set
+# CONFIG_MFD_VIPERBOARD is not set
+# CONFIG_MFD_RETU is not set
+# CONFIG_MFD_PCF50633 is not set
+# CONFIG_MFD_RDC321X is not set
+# CONFIG_MFD_RT5033 is not set
+# CONFIG_MFD_RC5T583 is not set
+# CONFIG_MFD_RK808 is not set
+# CONFIG_MFD_RN5T618 is not set
+# CONFIG_MFD_SEC_CORE is not set
+# CONFIG_MFD_SI476X_CORE is not set
+# CONFIG_MFD_SM501 is not set
+# CONFIG_MFD_SKY81452 is not set
+# CONFIG_MFD_SMSC is not set
+# CONFIG_ABX500_CORE is not set
+# CONFIG_MFD_STMPE is not set
+CONFIG_MFD_SYSCON=y
+# CONFIG_MFD_TI_AM335X_TSCADC is not set
+# CONFIG_MFD_LP3943 is not set
+# CONFIG_MFD_LP8788 is not set
+# CONFIG_MFD_TI_LMU is not set
+# CONFIG_MFD_PALMAS is not set
+# CONFIG_TPS6105X is not set
+# CONFIG_TPS65010 is not set
+# CONFIG_TPS6507X is not set
+# CONFIG_MFD_TPS65086 is not set
+# CONFIG_MFD_TPS65090 is not set
+# CONFIG_MFD_TPS65217 is not set
+# CONFIG_MFD_TI_LP873X is not set
+# CONFIG_MFD_TI_LP87565 is not set
+# CONFIG_MFD_TPS65218 is not set
+# CONFIG_MFD_TPS6586X is not set
+# CONFIG_MFD_TPS65910 is not set
+# CONFIG_MFD_TPS65912_I2C is not set
+# CONFIG_MFD_TPS65912_SPI is not set
+# CONFIG_MFD_TPS80031 is not set
+# CONFIG_TWL4030_CORE is not set
+# CONFIG_TWL6040_CORE is not set
+# CONFIG_MFD_WL1273_CORE is not set
+# CONFIG_MFD_LM3533 is not set
+# CONFIG_MFD_TC3589X is not set
+# CONFIG_MFD_TQMX86 is not set
+# CONFIG_MFD_VX855 is not set
+# CONFIG_MFD_LOCHNAGAR is not set
+# CONFIG_MFD_ARIZONA_I2C is not set
+# CONFIG_MFD_ARIZONA_SPI is not set
+# CONFIG_MFD_WM8400 is not set
+# CONFIG_MFD_WM831X_I2C is not set
+# CONFIG_MFD_WM831X_SPI is not set
+# CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_WM8994 is not set
+# CONFIG_MFD_ROHM_BD718XX is not set
+# CONFIG_MFD_ROHM_BD70528 is not set
+# CONFIG_MFD_STPMIC1 is not set
+# CONFIG_MFD_STMFX is not set
+CONFIG_MFD_FBXGW7R_PANEL=y
+# end of Multifunction device drivers
+
+# CONFIG_REGULATOR is not set
+CONFIG_RC_CORE=y
+# CONFIG_RC_MAP is not set
+# CONFIG_LIRC is not set
+# CONFIG_RC_DECODERS is not set
+# CONFIG_RC_DEVICES is not set
+CONFIG_MEDIA_SUPPORT=y
+
+#
+# Multimedia core support
+#
+# CONFIG_MEDIA_CAMERA_SUPPORT is not set
+# CONFIG_MEDIA_ANALOG_TV_SUPPORT is not set
+CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
+# CONFIG_MEDIA_RADIO_SUPPORT is not set
+# CONFIG_MEDIA_SDR_SUPPORT is not set
+# CONFIG_MEDIA_CEC_SUPPORT is not set
+# CONFIG_MEDIA_CONTROLLER is not set
+# CONFIG_VIDEO_ADV_DEBUG is not set
+# CONFIG_VIDEO_FIXED_MINOR_RANGES is not set
+CONFIG_DVB_CORE=y
+# CONFIG_DVB_NET is not set
+CONFIG_DVB_MAX_ADAPTERS=8
+# CONFIG_DVB_DYNAMIC_MINORS is not set
+# CONFIG_DVB_DEMUX_SECTION_LOSS_LOG is not set
+# CONFIG_DVB_ULE_DEBUG is not set
+
+#
+# Media drivers
+#
+CONFIG_MEDIA_USB_SUPPORT=y
+
+#
+# Analog/digital TV USB devices
+#
+
+#
+# Digital TV USB devices
+#
+CONFIG_DVB_USB=y
+# CONFIG_DVB_USB_DEBUG is not set
+# CONFIG_DVB_USB_A800 is not set
+# CONFIG_DVB_USB_DIBUSB_MB is not set
+# CONFIG_DVB_USB_DIBUSB_MC is not set
+CONFIG_DVB_USB_DIB0700=m
+# CONFIG_DVB_USB_UMT_010 is not set
+# CONFIG_DVB_USB_CXUSB is not set
+# CONFIG_DVB_USB_M920X is not set
+# CONFIG_DVB_USB_DIGITV is not set
+# CONFIG_DVB_USB_VP7045 is not set
+# CONFIG_DVB_USB_VP702X is not set
+# CONFIG_DVB_USB_GP8PSK is not set
+# CONFIG_DVB_USB_NOVA_T_USB2 is not set
+# CONFIG_DVB_USB_TTUSB2 is not set
+# CONFIG_DVB_USB_DTT200U is not set
+# CONFIG_DVB_USB_OPERA1 is not set
+# CONFIG_DVB_USB_AF9005 is not set
+# CONFIG_DVB_USB_PCTV452E is not set
+# CONFIG_DVB_USB_DW2102 is not set
+# CONFIG_DVB_USB_CINERGY_T2 is not set
+# CONFIG_DVB_USB_DTV5100 is not set
+# CONFIG_DVB_USB_AZ6027 is not set
+# CONFIG_DVB_USB_TECHNISAT_USB2 is not set
+CONFIG_DVB_USB_V2=y
+# CONFIG_DVB_USB_AF9015 is not set
+CONFIG_DVB_USB_AF9035=m
+# CONFIG_DVB_USB_ANYSEE is not set
+# CONFIG_DVB_USB_AU6610 is not set
+# CONFIG_DVB_USB_AZ6007 is not set
+# CONFIG_DVB_USB_CE6230 is not set
+# CONFIG_DVB_USB_EC168 is not set
+# CONFIG_DVB_USB_GL861 is not set
+# CONFIG_DVB_USB_LME2510 is not set
+# CONFIG_DVB_USB_MXL111SF is not set
+# CONFIG_DVB_USB_RTL28XXU is not set
+# CONFIG_DVB_USB_DVBSKY is not set
+# CONFIG_DVB_USB_ZD1301 is not set
+# CONFIG_DVB_TTUSB_BUDGET is not set
+# CONFIG_DVB_TTUSB_DEC is not set
+# CONFIG_SMS_USB_DRV is not set
+# CONFIG_DVB_B2C2_FLEXCOP_USB is not set
+# CONFIG_DVB_AS102 is not set
+
+#
+# Webcam, TV (analog/digital) USB devices
+#
+# CONFIG_MEDIA_PCI_SUPPORT is not set
+# CONFIG_DVB_PLATFORM_DRIVERS is not set
+
+#
+# Supported MMC/SDIO adapters
+#
+# CONFIG_SMS_SDIO_DRV is not set
+# CONFIG_CYPRESS_FIRMWARE is not set
+
+#
+# Media ancillary drivers (tuners, sensors, i2c, spi, frontends)
+#
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+CONFIG_MEDIA_ATTACH=y
+
+#
+# Media SPI Adapters
+#
+# CONFIG_CXD2880_SPI_DRV is not set
+# end of Media SPI Adapters
+
+CONFIG_MEDIA_TUNER=y
+
+#
+# Customize TV tuners
+#
+# CONFIG_MEDIA_TUNER_SIMPLE is not set
+# CONFIG_MEDIA_TUNER_TDA18250 is not set
+# CONFIG_MEDIA_TUNER_TDA8290 is not set
+# CONFIG_MEDIA_TUNER_TDA827X is not set
+# CONFIG_MEDIA_TUNER_TDA18271 is not set
+# CONFIG_MEDIA_TUNER_TDA9887 is not set
+# CONFIG_MEDIA_TUNER_TEA5761 is not set
+# CONFIG_MEDIA_TUNER_TEA5767 is not set
+# CONFIG_MEDIA_TUNER_MT20XX is not set
+# CONFIG_MEDIA_TUNER_MT2060 is not set
+# CONFIG_MEDIA_TUNER_MT2063 is not set
+# CONFIG_MEDIA_TUNER_MT2266 is not set
+# CONFIG_MEDIA_TUNER_MT2131 is not set
+# CONFIG_MEDIA_TUNER_QT1010 is not set
+# CONFIG_MEDIA_TUNER_XC2028 is not set
+# CONFIG_MEDIA_TUNER_XC5000 is not set
+# CONFIG_MEDIA_TUNER_XC4000 is not set
+# CONFIG_MEDIA_TUNER_MXL5005S is not set
+# CONFIG_MEDIA_TUNER_MXL5007T is not set
+# CONFIG_MEDIA_TUNER_MC44S803 is not set
+# CONFIG_MEDIA_TUNER_MAX2165 is not set
+# CONFIG_MEDIA_TUNER_TDA18218 is not set
+# CONFIG_MEDIA_TUNER_FC0011 is not set
+# CONFIG_MEDIA_TUNER_FC0012 is not set
+# CONFIG_MEDIA_TUNER_FC0013 is not set
+# CONFIG_MEDIA_TUNER_TDA18212 is not set
+# CONFIG_MEDIA_TUNER_E4000 is not set
+# CONFIG_MEDIA_TUNER_FC2580 is not set
+# CONFIG_MEDIA_TUNER_M88RS6000T is not set
+# CONFIG_MEDIA_TUNER_TUA9001 is not set
+# CONFIG_MEDIA_TUNER_SI2157 is not set
+CONFIG_MEDIA_TUNER_IT913X=m
+# CONFIG_MEDIA_TUNER_R820T is not set
+# CONFIG_MEDIA_TUNER_MXL301RF is not set
+# CONFIG_MEDIA_TUNER_QM1D1C0042 is not set
+# CONFIG_MEDIA_TUNER_QM1D1B0004 is not set
+# end of Customize TV tuners
+
+#
+# Customise DVB Frontends
+#
+
+#
+# Multistandard (satellite) frontends
+#
+# CONFIG_DVB_STB0899 is not set
+# CONFIG_DVB_STB6100 is not set
+# CONFIG_DVB_STV090x is not set
+# CONFIG_DVB_STV0910 is not set
+# CONFIG_DVB_STV6110x is not set
+# CONFIG_DVB_STV6111 is not set
+# CONFIG_DVB_MXL5XX is not set
+# CONFIG_DVB_M88DS3103 is not set
+
+#
+# Multistandard (cable + terrestrial) frontends
+#
+# CONFIG_DVB_DRXK is not set
+# CONFIG_DVB_TDA18271C2DD is not set
+# CONFIG_DVB_SI2165 is not set
+# CONFIG_DVB_MN88472 is not set
+# CONFIG_DVB_MN88473 is not set
+
+#
+# DVB-S (satellite) frontends
+#
+# CONFIG_DVB_CX24110 is not set
+# CONFIG_DVB_CX24123 is not set
+# CONFIG_DVB_MT312 is not set
+# CONFIG_DVB_ZL10036 is not set
+# CONFIG_DVB_ZL10039 is not set
+# CONFIG_DVB_S5H1420 is not set
+# CONFIG_DVB_STV0288 is not set
+# CONFIG_DVB_STB6000 is not set
+# CONFIG_DVB_STV0299 is not set
+# CONFIG_DVB_STV6110 is not set
+# CONFIG_DVB_STV0900 is not set
+# CONFIG_DVB_TDA8083 is not set
+# CONFIG_DVB_TDA10086 is not set
+# CONFIG_DVB_TDA8261 is not set
+# CONFIG_DVB_VES1X93 is not set
+# CONFIG_DVB_TUNER_ITD1000 is not set
+# CONFIG_DVB_TUNER_CX24113 is not set
+# CONFIG_DVB_TDA826X is not set
+# CONFIG_DVB_TUA6100 is not set
+# CONFIG_DVB_CX24116 is not set
+# CONFIG_DVB_CX24117 is not set
+# CONFIG_DVB_CX24120 is not set
+# CONFIG_DVB_SI21XX is not set
+# CONFIG_DVB_TS2020 is not set
+# CONFIG_DVB_DS3000 is not set
+# CONFIG_DVB_MB86A16 is not set
+# CONFIG_DVB_TDA10071 is not set
+
+#
+# DVB-T (terrestrial) frontends
+#
+# CONFIG_DVB_SP8870 is not set
+# CONFIG_DVB_SP887X is not set
+# CONFIG_DVB_CX22700 is not set
+# CONFIG_DVB_CX22702 is not set
+# CONFIG_DVB_S5H1432 is not set
+# CONFIG_DVB_DRXD is not set
+# CONFIG_DVB_L64781 is not set
+# CONFIG_DVB_TDA1004X is not set
+# CONFIG_DVB_NXT6000 is not set
+# CONFIG_DVB_MT352 is not set
+# CONFIG_DVB_ZL10353 is not set
+# CONFIG_DVB_DIB3000MB is not set
+# CONFIG_DVB_DIB3000MC is not set
+CONFIG_DVB_DIB7000M=m
+CONFIG_DVB_DIB7000P=m
+# CONFIG_DVB_DIB9000 is not set
+# CONFIG_DVB_TDA10048 is not set
+# CONFIG_DVB_AF9013 is not set
+# CONFIG_DVB_EC100 is not set
+# CONFIG_DVB_STV0367 is not set
+# CONFIG_DVB_CXD2820R is not set
+# CONFIG_DVB_CXD2841ER is not set
+# CONFIG_DVB_RTL2830 is not set
+# CONFIG_DVB_RTL2832 is not set
+# CONFIG_DVB_SI2168 is not set
+# CONFIG_DVB_ZD1301_DEMOD is not set
+# CONFIG_DVB_CXD2880 is not set
+
+#
+# DVB-C (cable) frontends
+#
+# CONFIG_DVB_VES1820 is not set
+# CONFIG_DVB_TDA10021 is not set
+# CONFIG_DVB_TDA10023 is not set
+# CONFIG_DVB_STV0297 is not set
+
+#
+# ATSC (North American/Korean Terrestrial/Cable DTV) frontends
+#
+# CONFIG_DVB_NXT200X is not set
+# CONFIG_DVB_OR51211 is not set
+# CONFIG_DVB_OR51132 is not set
+# CONFIG_DVB_BCM3510 is not set
+# CONFIG_DVB_LGDT330X is not set
+# CONFIG_DVB_LGDT3305 is not set
+# CONFIG_DVB_LGDT3306A is not set
+# CONFIG_DVB_LG2160 is not set
+# CONFIG_DVB_S5H1409 is not set
+# CONFIG_DVB_AU8522_DTV is not set
+# CONFIG_DVB_S5H1411 is not set
+
+#
+# ISDB-T (terrestrial) frontends
+#
+# CONFIG_DVB_S921 is not set
+# CONFIG_DVB_DIB8000 is not set
+# CONFIG_DVB_MB86A20S is not set
+
+#
+# ISDB-S (satellite) & ISDB-T (terrestrial) frontends
+#
+# CONFIG_DVB_TC90522 is not set
+# CONFIG_DVB_MN88443X is not set
+
+#
+# Digital terrestrial only tuners/PLL
+#
+# CONFIG_DVB_PLL is not set
+CONFIG_DVB_TUNER_DIB0070=m
+# CONFIG_DVB_TUNER_DIB0090 is not set
+
+#
+# SEC control devices for DVB-S
+#
+# CONFIG_DVB_DRX39XYJ is not set
+# CONFIG_DVB_LNBH25 is not set
+# CONFIG_DVB_LNBH29 is not set
+# CONFIG_DVB_LNBP21 is not set
+# CONFIG_DVB_LNBP22 is not set
+# CONFIG_DVB_ISL6405 is not set
+# CONFIG_DVB_ISL6421 is not set
+# CONFIG_DVB_ISL6423 is not set
+# CONFIG_DVB_A8293 is not set
+# CONFIG_DVB_LGS8GL5 is not set
+# CONFIG_DVB_LGS8GXX is not set
+# CONFIG_DVB_ATBM8830 is not set
+# CONFIG_DVB_TDA665x is not set
+# CONFIG_DVB_IX2505V is not set
+# CONFIG_DVB_M88RS2000 is not set
+CONFIG_DVB_AF9033=m
+# CONFIG_DVB_HORUS3A is not set
+# CONFIG_DVB_ASCOT2E is not set
+# CONFIG_DVB_HELENE is not set
+
+#
+# Common Interface (EN50221) controller drivers
+#
+# CONFIG_DVB_CXD2099 is not set
+# CONFIG_DVB_SP2 is not set
+
+#
+# Tools to develop new frontends
+#
+# CONFIG_DVB_DUMMY_FE is not set
+# end of Customise DVB Frontends
+
+#
+# Graphics support
+#
+# CONFIG_VGA_ARB is not set
+# CONFIG_DRM is not set
+# CONFIG_DRM_DP_CEC is not set
+
+#
+# ARM devices
+#
+# end of ARM devices
+
+#
+# ACP (Audio CoProcessor) Configuration
+#
+# end of ACP (Audio CoProcessor) Configuration
+
+CONFIG_DRM_RCAR_WRITEBACK=y
+
+#
+# Frame buffer Devices
+#
+CONFIG_FB_CMDLINE=y
+CONFIG_FB_NOTIFY=y
+CONFIG_FB=y
+# CONFIG_FIRMWARE_EDID is not set
+CONFIG_FB_SYS_FILLRECT=y
+CONFIG_FB_SYS_COPYAREA=y
+CONFIG_FB_SYS_IMAGEBLIT=y
+# CONFIG_FB_FOREIGN_ENDIAN is not set
+CONFIG_FB_SYS_FOPS=y
+CONFIG_FB_DEFERRED_IO=y
+CONFIG_FB_BACKLIGHT=y
+# CONFIG_FB_MODE_HELPERS is not set
+# CONFIG_FB_TILEBLITTING is not set
+
+#
+# Frame buffer hardware drivers
+#
+# CONFIG_FB_CIRRUS is not set
+# CONFIG_FB_PM2 is not set
+# CONFIG_FB_ARMCLCD is not set
+# CONFIG_FB_CYBER2000 is not set
+# CONFIG_FB_ASILIANT is not set
+# CONFIG_FB_IMSTT is not set
+# CONFIG_FB_OPENCORES is not set
+# CONFIG_FB_S1D13XXX is not set
+# CONFIG_FB_NVIDIA is not set
+# CONFIG_FB_RIVA is not set
+# CONFIG_FB_I740 is not set
+# CONFIG_FB_MATROX is not set
+# CONFIG_FB_RADEON is not set
+# CONFIG_FB_ATY128 is not set
+# CONFIG_FB_ATY is not set
+# CONFIG_FB_S3 is not set
+# CONFIG_FB_SAVAGE is not set
+# CONFIG_FB_SIS is not set
+# CONFIG_FB_NEOMAGIC is not set
+# CONFIG_FB_KYRO is not set
+# CONFIG_FB_3DFX is not set
+# CONFIG_FB_VOODOO1 is not set
+# CONFIG_FB_VT8623 is not set
+# CONFIG_FB_TRIDENT is not set
+# CONFIG_FB_ARK is not set
+# CONFIG_FB_PM3 is not set
+# CONFIG_FB_CARMINE is not set
+# CONFIG_FB_SMSCUFX is not set
+# CONFIG_FB_UDL is not set
+# CONFIG_FB_IBM_GXT4500 is not set
+# CONFIG_FB_VIRTUAL is not set
+# CONFIG_FB_METRONOME is not set
+# CONFIG_FB_MB862XX is not set
+# CONFIG_FB_SIMPLE is not set
+# CONFIG_FB_SSD1307 is not set
+# CONFIG_FB_SM712 is not set
+# CONFIG_FB_SSD1320 is not set
+CONFIG_FB_SSD1327=y
+# end of Frame buffer Devices
+
+#
+# Backlight & LCD device support
+#
+# CONFIG_LCD_CLASS_DEVICE is not set
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+# CONFIG_BACKLIGHT_GENERIC is not set
+# CONFIG_BACKLIGHT_PM8941_WLED is not set
+# CONFIG_BACKLIGHT_ADP8860 is not set
+# CONFIG_BACKLIGHT_ADP8870 is not set
+# CONFIG_BACKLIGHT_LM3639 is not set
+# CONFIG_BACKLIGHT_GPIO is not set
+# CONFIG_BACKLIGHT_LV5207LP is not set
+# CONFIG_BACKLIGHT_BD6107 is not set
+# CONFIG_BACKLIGHT_ARCXCNN is not set
+# end of Backlight & LCD device support
+
+#
+# Console display driver support
+#
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_DUMMY_CONSOLE_COLUMNS=80
+CONFIG_DUMMY_CONSOLE_ROWS=25
+# CONFIG_FRAMEBUFFER_CONSOLE is not set
+# end of Console display driver support
+
+# CONFIG_LOGO is not set
+# end of Graphics support
+
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_TIMER=y
+CONFIG_SND_PCM=y
+CONFIG_SND_HWDEP=y
+CONFIG_SND_RAWMIDI=y
+# CONFIG_SND_OSSEMUL is not set
+CONFIG_SND_PCM_TIMER=y
+# CONFIG_SND_HRTIMER is not set
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
+CONFIG_SND_PROC_FS=y
+CONFIG_SND_VERBOSE_PROCFS=y
+# CONFIG_SND_VERBOSE_PRINTK is not set
+# CONFIG_SND_DEBUG is not set
+# CONFIG_SND_SEQUENCER is not set
+CONFIG_SND_DRIVERS=y
+# CONFIG_SND_DUMMY is not set
+# CONFIG_SND_ALOOP is not set
+# CONFIG_SND_MTPAV is not set
+# CONFIG_SND_SERIAL_U16550 is not set
+# CONFIG_SND_MPU401 is not set
+# CONFIG_SND_PCI is not set
+
+#
+# HD-Audio
+#
+# end of HD-Audio
+
+CONFIG_SND_HDA_PREALLOC_SIZE=64
+# CONFIG_SND_SPI is not set
+CONFIG_SND_USB=y
+CONFIG_SND_USB_AUDIO=y
+# CONFIG_SND_USB_UA101 is not set
+# CONFIG_SND_USB_CAIAQ is not set
+# CONFIG_SND_USB_6FIRE is not set
+# CONFIG_SND_USB_HIFACE is not set
+# CONFIG_SND_BCD2000 is not set
+# CONFIG_SND_USB_POD is not set
+# CONFIG_SND_USB_PODHD is not set
+# CONFIG_SND_USB_TONEPORT is not set
+# CONFIG_SND_USB_VARIAX is not set
+# CONFIG_SND_SOC is not set
+
+#
+# HID support
+#
+CONFIG_HID=y
+# CONFIG_HID_BATTERY_STRENGTH is not set
+# CONFIG_HIDRAW is not set
+# CONFIG_UHID is not set
+# CONFIG_HID_GENERIC is not set
+
+#
+# Special HID drivers
+#
+# CONFIG_HID_A4TECH is not set
+# CONFIG_HID_ACRUX is not set
+# CONFIG_HID_APPLE is not set
+# CONFIG_HID_ASUS is not set
+# CONFIG_HID_AUREAL is not set
+# CONFIG_HID_BELKIN is not set
+# CONFIG_HID_CHERRY is not set
+# CONFIG_HID_CHICONY is not set
+# CONFIG_HID_CORSAIR is not set
+# CONFIG_HID_COUGAR is not set
+# CONFIG_HID_MACALLY is not set
+# CONFIG_HID_PRODIKEYS is not set
+# CONFIG_HID_CMEDIA is not set
+# CONFIG_HID_CYPRESS is not set
+# CONFIG_HID_DRAGONRISE is not set
+# CONFIG_HID_EMS_FF is not set
+# CONFIG_HID_ELECOM is not set
+# CONFIG_HID_EZKEY is not set
+# CONFIG_HID_GEMBIRD is not set
+# CONFIG_HID_GFRM is not set
+# CONFIG_HID_KEYTOUCH is not set
+# CONFIG_HID_KYE is not set
+# CONFIG_HID_WALTOP is not set
+# CONFIG_HID_VIEWSONIC is not set
+# CONFIG_HID_FBX_REMOTE_AUDIO is not set
+# CONFIG_HID_GYRATION is not set
+# CONFIG_HID_ICADE is not set
+# CONFIG_HID_ITE is not set
+# CONFIG_HID_JABRA is not set
+# CONFIG_HID_TWINHAN is not set
+# CONFIG_HID_KENSINGTON is not set
+# CONFIG_HID_LCPOWER is not set
+# CONFIG_HID_LED is not set
+# CONFIG_HID_LENOVO is not set
+# CONFIG_HID_LOGITECH is not set
+# CONFIG_HID_MAGICMOUSE is not set
+# CONFIG_HID_MALTRON is not set
+# CONFIG_HID_MAYFLASH is not set
+# CONFIG_HID_REDRAGON is not set
+# CONFIG_HID_MICROSOFT is not set
+# CONFIG_HID_MONTEREY is not set
+# CONFIG_HID_MULTITOUCH is not set
+# CONFIG_HID_NTI is not set
+# CONFIG_HID_ORTEK is not set
+# CONFIG_HID_PANTHERLORD is not set
+# CONFIG_HID_PETALYNX is not set
+# CONFIG_HID_PICOLCD is not set
+# CONFIG_HID_PLANTRONICS is not set
+# CONFIG_HID_PRIMAX is not set
+# CONFIG_HID_SAITEK is not set
+# CONFIG_HID_SAMSUNG is not set
+# CONFIG_HID_SPEEDLINK is not set
+# CONFIG_HID_STEAM is not set
+# CONFIG_HID_STEELSERIES is not set
+# CONFIG_HID_SUNPLUS is not set
+# CONFIG_HID_RMI is not set
+# CONFIG_HID_GREENASIA is not set
+# CONFIG_HID_SMARTJOYPLUS is not set
+# CONFIG_HID_TIVO is not set
+# CONFIG_HID_TOPSEED is not set
+# CONFIG_HID_THINGM is not set
+# CONFIG_HID_THRUSTMASTER is not set
+# CONFIG_HID_UDRAW_PS3 is not set
+# CONFIG_HID_WIIMOTE is not set
+# CONFIG_HID_XINMO is not set
+# CONFIG_HID_ZEROPLUS is not set
+# CONFIG_HID_ZYDACRON is not set
+# CONFIG_HID_SENSOR_HUB is not set
+# CONFIG_HID_ALPS is not set
+# end of Special HID drivers
+
+#
+# USB HID support
+#
+# CONFIG_USB_HID is not set
+# CONFIG_HID_PID is not set
+
+#
+# USB HID Boot Protocol drivers
+#
+# CONFIG_USB_KBD is not set
+# CONFIG_USB_MOUSE is not set
+# end of USB HID Boot Protocol drivers
+# end of USB HID support
+
+#
+# I2C HID support
+#
+# CONFIG_I2C_HID is not set
+# end of I2C HID support
+# end of HID support
+
+CONFIG_USB_OHCI_LITTLE_ENDIAN=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_COMMON=y
+# CONFIG_USB_LED_TRIG is not set
+# CONFIG_USB_ULPI_BUS is not set
+# CONFIG_USB_CONN_GPIO is not set
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB=y
+# CONFIG_USB_PCI is not set
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+
+#
+# Miscellaneous USB options
+#
+CONFIG_USB_DEFAULT_PERSIST=y
+# CONFIG_USB_DYNAMIC_MINORS is not set
+# CONFIG_USB_OTG_WHITELIST is not set
+# CONFIG_USB_OTG_BLACKLIST_HUB is not set
+# CONFIG_USB_LEDS_TRIGGER_USBPORT is not set
+CONFIG_USB_AUTOSUSPEND_DELAY=2
+# CONFIG_USB_MON is not set
+
+#
+# USB Host Controller Drivers
+#
+# CONFIG_USB_C67X00_HCD is not set
+CONFIG_USB_XHCI_HCD=m
+# CONFIG_USB_XHCI_DBGCAP is not set
+CONFIG_USB_XHCI_PLATFORM=m
+CONFIG_USB_XHCI_MVEBU=m
+# CONFIG_USB_EHCI_HCD is not set
+# CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_ISP116X_HCD is not set
+# CONFIG_USB_FOTG210_HCD is not set
+# CONFIG_USB_MAX3421_HCD is not set
+# CONFIG_USB_OHCI_HCD is not set
+# CONFIG_USB_SL811_HCD is not set
+# CONFIG_USB_R8A66597_HCD is not set
+# CONFIG_USB_HCD_TEST_MODE is not set
+
+#
+# USB Device Class drivers
+#
+CONFIG_USB_ACM=y
+CONFIG_USB_PRINTER=y
+# CONFIG_USB_WDM is not set
+# CONFIG_USB_TMC is not set
+
+#
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may
+#
+
+#
+# also be needed; see USB_STORAGE Help for more info
+#
+CONFIG_USB_STORAGE=y
+# CONFIG_USB_STORAGE_DEBUG is not set
+# CONFIG_USB_STORAGE_REALTEK is not set
+# CONFIG_USB_STORAGE_DATAFAB is not set
+# CONFIG_USB_STORAGE_FREECOM is not set
+# CONFIG_USB_STORAGE_ISD200 is not set
+# CONFIG_USB_STORAGE_USBAT is not set
+# CONFIG_USB_STORAGE_SDDR09 is not set
+# CONFIG_USB_STORAGE_SDDR55 is not set
+# CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
+# CONFIG_USB_STORAGE_ENE_UB6250 is not set
+# CONFIG_USB_UAS is not set
+
+#
+# USB Imaging devices
+#
+# CONFIG_USB_MDC800 is not set
+# CONFIG_USB_MICROTEK is not set
+# CONFIG_USBIP_CORE is not set
+# CONFIG_USB_CDNS3 is not set
+# CONFIG_USB_MUSB_HDRC is not set
+# CONFIG_USB_DWC3 is not set
+# CONFIG_USB_DWC2 is not set
+# CONFIG_USB_ISP1760 is not set
+
+#
+# USB port drivers
+#
+# CONFIG_USB_SERIAL is not set
+
+#
+# USB Miscellaneous drivers
+#
+# CONFIG_USB_EMI62 is not set
+# CONFIG_USB_EMI26 is not set
+# CONFIG_USB_ADUTUX is not set
+# CONFIG_USB_SEVSEG is not set
+# CONFIG_USB_LEGOTOWER is not set
+# CONFIG_USB_LCD is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
+# CONFIG_USB_CYTHERM is not set
+# CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_FTDI_ELAN is not set
+# CONFIG_USB_APPLEDISPLAY is not set
+# CONFIG_USB_LD is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
+# CONFIG_USB_IOWARRIOR is not set
+# CONFIG_USB_TEST is not set
+# CONFIG_USB_EHSET_TEST_FIXTURE is not set
+# CONFIG_USB_ISIGHTFW is not set
+# CONFIG_USB_YUREX is not set
+# CONFIG_USB_EZUSB_FX2 is not set
+# CONFIG_USB_HUB_USB251XB is not set
+# CONFIG_USB_HSIC_USB3503 is not set
+# CONFIG_USB_HSIC_USB4604 is not set
+# CONFIG_USB_LINK_LAYER_TEST is not set
+# CONFIG_USB_CHAOSKEY is not set
+
+#
+# USB Physical Layer drivers
+#
+# CONFIG_NOP_USB_XCEIV is not set
+# CONFIG_USB_GPIO_VBUS is not set
+# CONFIG_USB_ISP1301 is not set
+# CONFIG_USB_ULPI is not set
+# end of USB Physical Layer drivers
+
+# CONFIG_USB_GADGET is not set
+# CONFIG_TYPEC is not set
+# CONFIG_USB_ROLE_SWITCH is not set
+CONFIG_MMC=y
+# CONFIG_PWRSEQ_EMMC is not set
+# CONFIG_PWRSEQ_SIMPLE is not set
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=8
+# CONFIG_SDIO_UART is not set
+# CONFIG_MMC_TEST is not set
+
+#
+# MMC/SD/SDIO Host Controller Drivers
+#
+# CONFIG_MMC_DEBUG is not set
+# CONFIG_MMC_ARMMMCI is not set
+CONFIG_MMC_SDHCI=y
+# CONFIG_MMC_SDHCI_PCI is not set
+CONFIG_MMC_SDHCI_PLTFM=y
+# CONFIG_MMC_SDHCI_OF_ARASAN is not set
+# CONFIG_MMC_SDHCI_OF_ASPEED is not set
+# CONFIG_MMC_SDHCI_OF_AT91 is not set
+# CONFIG_MMC_SDHCI_OF_DWCMSHC is not set
+# CONFIG_MMC_SDHCI_CADENCE is not set
+# CONFIG_MMC_SDHCI_PXAV3 is not set
+# CONFIG_MMC_SDHCI_F_SDH30 is not set
+# CONFIG_MMC_TIFM_SD is not set
+# CONFIG_MMC_SPI is not set
+# CONFIG_MMC_CB710 is not set
+# CONFIG_MMC_VIA_SDMMC is not set
+# CONFIG_MMC_DW is not set
+# CONFIG_MMC_VUB300 is not set
+# CONFIG_MMC_USHC is not set
+# CONFIG_MMC_USDHI6ROL0 is not set
+# CONFIG_MMC_CQHCI is not set
+# CONFIG_MMC_TOSHIBA_PCI is not set
+# CONFIG_MMC_MTK is not set
+CONFIG_MMC_SDHCI_XENON=y
+# CONFIG_MMC_SDHCI_OMAP is not set
+# CONFIG_MMC_SDHCI_AM654 is not set
+# CONFIG_MEMSTICK is not set
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+# CONFIG_LEDS_CLASS_FLASH is not set
+# CONFIG_LEDS_BRIGHTNESS_HW_CHANGED is not set
+
+#
+# LED drivers
+#
+# CONFIG_LEDS_AN30259A is not set
+# CONFIG_LEDS_BCM6328 is not set
+# CONFIG_LEDS_BCM6358 is not set
+# CONFIG_LEDS_CR0014114 is not set
+# CONFIG_LEDS_LM3530 is not set
+# CONFIG_LEDS_LM3532 is not set
+# CONFIG_LEDS_LM3642 is not set
+# CONFIG_LEDS_LM3692X is not set
+# CONFIG_LEDS_PCA9532 is not set
+# CONFIG_LEDS_GPIO is not set
+# CONFIG_LEDS_LP3944 is not set
+# CONFIG_LEDS_LP3952 is not set
+# CONFIG_LEDS_LP5521 is not set
+# CONFIG_LEDS_LP5523 is not set
+# CONFIG_LEDS_LP5562 is not set
+# CONFIG_LEDS_LP8501 is not set
+# CONFIG_LEDS_LP8860 is not set
+# CONFIG_LEDS_PCA955X is not set
+# CONFIG_LEDS_PCA963X is not set
+# CONFIG_LEDS_DAC124S085 is not set
+# CONFIG_LEDS_BD2802 is not set
+# CONFIG_LEDS_LT3593 is not set
+# CONFIG_LEDS_TCA6507 is not set
+# CONFIG_LEDS_TLC591XX is not set
+# CONFIG_LEDS_LM355x is not set
+# CONFIG_LEDS_IS31FL319X is not set
+# CONFIG_LEDS_IS31FL32XX is not set
+
+#
+# LED driver for blink(1) USB RGB LED is under Special HID drivers (HID_THINGM)
+#
+# CONFIG_LEDS_BLINKM is not set
+# CONFIG_LEDS_SYSCON is not set
+# CONFIG_LEDS_MLXREG is not set
+# CONFIG_LEDS_USER is not set
+# CONFIG_LEDS_SPI_BYTE is not set
+# CONFIG_LEDS_TI_LMU_COMMON is not set
+CONFIG_LEDS_LED1202=y
+
+#
+# LED Triggers
+#
+CONFIG_LEDS_TRIGGERS=y
+# CONFIG_LEDS_TRIGGER_TIMER is not set
+# CONFIG_LEDS_TRIGGER_ONESHOT is not set
+# CONFIG_LEDS_TRIGGER_DISK is not set
+# CONFIG_LEDS_TRIGGER_MTD is not set
+# CONFIG_LEDS_TRIGGER_HEARTBEAT is not set
+# CONFIG_LEDS_TRIGGER_BACKLIGHT is not set
+# CONFIG_LEDS_TRIGGER_CPU is not set
+# CONFIG_LEDS_TRIGGER_ACTIVITY is not set
+# CONFIG_LEDS_TRIGGER_GPIO is not set
+# CONFIG_LEDS_TRIGGER_DEFAULT_ON is not set
+
+#
+# iptables trigger is under Netfilter config (LED target)
+#
+# CONFIG_LEDS_TRIGGER_TRANSIENT is not set
+# CONFIG_LEDS_TRIGGER_CAMERA is not set
+# CONFIG_LEDS_TRIGGER_PANIC is not set
+# CONFIG_LEDS_TRIGGER_NETDEV is not set
+# CONFIG_LEDS_TRIGGER_PATTERN is not set
+# CONFIG_LEDS_TRIGGER_AUDIO is not set
+# CONFIG_ACCESSIBILITY is not set
+# CONFIG_INFINIBAND is not set
+CONFIG_EDAC_SUPPORT=y
+CONFIG_EDAC=y
+CONFIG_EDAC_LEGACY_SYSFS=y
+# CONFIG_EDAC_DEBUG is not set
+# CONFIG_EDAC_THUNDERX is not set
+# CONFIG_EDAC_XGENE is not set
+# CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
+
+#
+# DMABUF options
+#
+# CONFIG_SYNC_FILE is not set
+# CONFIG_UDMABUF is not set
+# CONFIG_DMABUF_SELFTESTS is not set
+# end of DMABUF options
+
+# CONFIG_AUXDISPLAY is not set
+# CONFIG_UIO is not set
+# CONFIG_VIRT_DRIVERS is not set
+# CONFIG_VIRTIO_MENU is not set
+
+#
+# Microsoft Hyper-V guest support
+#
+# end of Microsoft Hyper-V guest support
+
+# CONFIG_GREYBUS is not set
+# CONFIG_STAGING is not set
+# CONFIG_GOLDFISH is not set
+# CONFIG_MFD_CROS_EC is not set
+# CONFIG_CHROME_PLATFORMS is not set
+# CONFIG_MELLANOX_PLATFORM is not set
+CONFIG_FBXGW7R_PLATFORM=y
+CONFIG_FBXGW7R_SWITCH=y
+CONFIG_CLKDEV_LOOKUP=y
+CONFIG_HAVE_CLK_PREPARE=y
+CONFIG_COMMON_CLK=y
+
+#
+# Common Clock Framework
+#
+# CONFIG_COMMON_CLK_VERSATILE is not set
+# CONFIG_CLK_HSDK is not set
+# CONFIG_COMMON_CLK_MAX9485 is not set
+# CONFIG_COMMON_CLK_SI5341 is not set
+# CONFIG_COMMON_CLK_SI5351 is not set
+# CONFIG_COMMON_CLK_SI514 is not set
+# CONFIG_COMMON_CLK_SI544 is not set
+# CONFIG_COMMON_CLK_SI570 is not set
+# CONFIG_COMMON_CLK_CDCE706 is not set
+# CONFIG_COMMON_CLK_CDCE925 is not set
+# CONFIG_COMMON_CLK_CS2000_CP is not set
+# CONFIG_CLK_QORIQ is not set
+CONFIG_COMMON_CLK_XGENE=y
+# CONFIG_COMMON_CLK_VC5 is not set
+# CONFIG_COMMON_CLK_FIXED_MMIO is not set
+CONFIG_ARMADA_AP_CP_HELPER=y
+CONFIG_ARMADA_37XX_CLK=y
+CONFIG_ARMADA_AP806_SYSCON=y
+CONFIG_ARMADA_CP110_SYSCON=y
+# end of Common Clock Framework
+
+# CONFIG_HWSPINLOCK is not set
+
+#
+# Clock Source drivers
+#
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y
+CONFIG_FSL_ERRATUM_A008585=y
+CONFIG_HISILICON_ERRATUM_161010101=y
+CONFIG_ARM64_ERRATUM_858921=y
+# end of Clock Source drivers
+
+# CONFIG_MAILBOX is not set
+# CONFIG_IOMMU_SUPPORT is not set
+
+#
+# Remoteproc drivers
+#
+# CONFIG_REMOTEPROC is not set
+# end of Remoteproc drivers
+
+#
+# Rpmsg drivers
+#
+# CONFIG_RPMSG_VIRTIO is not set
+# end of Rpmsg drivers
+
+# CONFIG_SOUNDWIRE is not set
+
+#
+# SOC (System On Chip) specific Drivers
+#
+
+#
+# Amlogic SoC drivers
+#
+# end of Amlogic SoC drivers
+
+#
+# Aspeed SoC drivers
+#
+# end of Aspeed SoC drivers
+
+#
+# Broadcom SoC drivers
+#
+# CONFIG_SOC_BRCMSTB is not set
+# CONFIG_SOC_BCM63XX is not set
+# end of Broadcom SoC drivers
+
+#
+# NXP/Freescale QorIQ SoC drivers
+#
+# end of NXP/Freescale QorIQ SoC drivers
+
+#
+# i.MX SoC drivers
+#
+# end of i.MX SoC drivers
+
+#
+# Qualcomm SoC drivers
+#
+# end of Qualcomm SoC drivers
+
+# CONFIG_SOC_TI is not set
+
+#
+# Xilinx SoC drivers
+#
+# CONFIG_XILINX_VCU is not set
+# end of Xilinx SoC drivers
+# end of SOC (System On Chip) specific Drivers
+
+# CONFIG_PM_DEVFREQ is not set
+# CONFIG_EXTCON is not set
+# CONFIG_MEMORY is not set
+# CONFIG_IIO is not set
+# CONFIG_NTB is not set
+# CONFIG_VME_BUS is not set
+# CONFIG_PWM is not set
+
+#
+# IRQ chip support
+#
+CONFIG_IRQCHIP=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GIC_MAX_NR=1
+CONFIG_ARM_GIC_V2M=y
+CONFIG_ARM_GIC_V3=y
+CONFIG_ARM_GIC_V3_ITS=y
+CONFIG_ARM_GIC_V3_ITS_PCI=y
+# CONFIG_AL_FIC is not set
+CONFIG_MVEBU_GICP=y
+CONFIG_MVEBU_ICU=y
+CONFIG_MVEBU_ODMI=y
+CONFIG_MVEBU_PIC=y
+CONFIG_MVEBU_SEI=y
+CONFIG_PARTITION_PERCPU=y
+# end of IRQ chip support
+
+# CONFIG_IPACK_BUS is not set
+CONFIG_RESET_CONTROLLER=y
+# CONFIG_RESET_TI_SYSCON is not set
+
+#
+# PHY Subsystem
+#
+CONFIG_GENERIC_PHY=y
+# CONFIG_PHY_XGENE is not set
+# CONFIG_XDSL_PHY_API is not set
+# CONFIG_BCM_KONA_USB2_PHY is not set
+# CONFIG_PHY_CADENCE_DP is not set
+# CONFIG_PHY_CADENCE_DPHY is not set
+# CONFIG_PHY_CADENCE_SIERRA is not set
+# CONFIG_PHY_FSL_IMX8MQ_USB is not set
+# CONFIG_PHY_MIXEL_MIPI_DPHY is not set
+# CONFIG_PHY_MVEBU_A3700_COMPHY is not set
+# CONFIG_PHY_MVEBU_A3700_UTMI is not set
+# CONFIG_PHY_MVEBU_A38X_COMPHY is not set
+CONFIG_PHY_MVEBU_CP110_COMPHY=y
+# CONFIG_PHY_PXA_28NM_HSIC is not set
+# CONFIG_PHY_PXA_28NM_USB2 is not set
+CONFIG_PHY_UTMI_CP110=y
+# CONFIG_PHY_MAPPHONE_MDM6600 is not set
+# CONFIG_PHY_OCELOT_SERDES is not set
+# end of PHY Subsystem
+
+# CONFIG_POWERCAP is not set
+# CONFIG_MCB is not set
+
+#
+# Performance monitor support
+#
+# CONFIG_ARM_CCI_PMU is not set
+# CONFIG_ARM_CCN is not set
+CONFIG_ARM_PMU=y
+# CONFIG_ARM_DSU_PMU is not set
+# CONFIG_ARM_SPE_PMU is not set
+# end of Performance monitor support
+
+CONFIG_RAS=y
+
+#
+# Android
+#
+# CONFIG_ANDROID is not set
+# end of Android
+
+# CONFIG_LIBNVDIMM is not set
+CONFIG_DAX=y
+# CONFIG_DEV_DAX is not set
+CONFIG_NVMEM=y
+CONFIG_NVMEM_SYSFS=y
+# CONFIG_NVMEM_IGNORE_RO is not set
+
+#
+# HW tracing support
+#
+# CONFIG_STM is not set
+# CONFIG_INTEL_TH is not set
+# end of HW tracing support
+
+# CONFIG_FPGA is not set
+# CONFIG_FSI is not set
+CONFIG_TEE=y
+
+#
+# TEE drivers
+#
+CONFIG_OPTEE=y
+CONFIG_OPTEE_SHM_NUM_PRIV_PAGES=1
+# end of TEE drivers
+
+# CONFIG_SIOX is not set
+# CONFIG_SLIMBUS is not set
+# CONFIG_INTERCONNECT is not set
+# CONFIG_COUNTER is not set
+# end of Device Drivers
+
+#
+# File systems
+#
+CONFIG_DCACHE_WORD_ACCESS=y
+# CONFIG_VALIDATE_FS_PARSER is not set
+CONFIG_FS_IOMAP=y
+CONFIG_EXT2_FS=y
+# CONFIG_EXT2_FS_XATTR is not set
+CONFIG_EXT3_FS=y
+# CONFIG_EXT3_FS_POSIX_ACL is not set
+# CONFIG_EXT3_FS_SECURITY is not set
+CONFIG_EXT4_FS=y
+# CONFIG_EXT4_FS_POSIX_ACL is not set
+# CONFIG_EXT4_FS_SECURITY is not set
+# CONFIG_EXT4_DEBUG is not set
+CONFIG_JBD2=y
+# CONFIG_JBD2_DEBUG is not set
+CONFIG_FS_MBCACHE=y
+# CONFIG_REISERFS_FS is not set
+# CONFIG_JFS_FS is not set
+CONFIG_XFS_FS=y
+# CONFIG_XFS_QUOTA is not set
+# CONFIG_XFS_POSIX_ACL is not set
+# CONFIG_XFS_RT is not set
+# CONFIG_XFS_ONLINE_SCRUB is not set
+# CONFIG_XFS_WARN is not set
+# CONFIG_XFS_DEBUG is not set
+# CONFIG_GFS2_FS is not set
+# CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
+# CONFIG_NILFS2_FS is not set
+# CONFIG_F2FS_FS is not set
+# CONFIG_FS_DAX is not set
+CONFIG_FS_POSIX_ACL=y
+CONFIG_EXPORTFS=y
+# CONFIG_EXPORTFS_BLOCK_OPS is not set
+CONFIG_FILE_LOCKING=y
+CONFIG_MANDATORY_FILE_LOCKING=y
+# CONFIG_FS_ENCRYPTION is not set
+# CONFIG_FS_VERITY is not set
+CONFIG_FSNOTIFY=y
+CONFIG_DNOTIFY=y
+CONFIG_INOTIFY_USER=y
+CONFIG_FANOTIFY=y
+# CONFIG_QUOTA is not set
+# CONFIG_AUTOFS4_FS is not set
+# CONFIG_AUTOFS_FS is not set
+CONFIG_FUSE_FS=y
+# CONFIG_CUSE is not set
+# CONFIG_VIRTIO_FS is not set
+# CONFIG_OVERLAY_FS is not set
+
+#
+# Caches
+#
+# CONFIG_FSCACHE is not set
+# end of Caches
+
+#
+# CD-ROM/DVD Filesystems
+#
+# CONFIG_ISO9660_FS is not set
+# CONFIG_UDF_FS is not set
+# end of CD-ROM/DVD Filesystems
+
+#
+# DOS/FAT/NT Filesystems
+#
+CONFIG_FAT_FS=y
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_CODEPAGE=850
+CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
+# CONFIG_FAT_DEFAULT_UTF8 is not set
+CONFIG_NTFS_FS=y
+# CONFIG_NTFS_DEBUG is not set
+# CONFIG_NTFS_RW is not set
+CONFIG_EXFAT_FS_FBX=y
+# end of DOS/FAT/NT Filesystems
+
+#
+# Pseudo filesystems
+#
+CONFIG_PROC_FS=y
+# CONFIG_PROC_KCORE is not set
+CONFIG_PROC_SYSCTL=y
+CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_PROC_CHILDREN is not set
+CONFIG_KERNFS=y
+CONFIG_SYSFS=y
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_TMPFS_XATTR is not set
+# CONFIG_HUGETLBFS is not set
+CONFIG_MEMFD_CREATE=y
+CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
+CONFIG_CONFIGFS_FS=y
+# end of Pseudo filesystems
+
+CONFIG_MISC_FILESYSTEMS=y
+# CONFIG_ORANGEFS_FS is not set
+# CONFIG_ADFS_FS is not set
+# CONFIG_AFFS_FS is not set
+CONFIG_HFS_FS=y
+CONFIG_HFSPLUS_FS=y
+# CONFIG_BEFS_FS is not set
+# CONFIG_BFS_FS is not set
+# CONFIG_EFS_FS is not set
+# CONFIG_JFFS2_FS is not set
+CONFIG_CRAMFS=y
+CONFIG_CRAMFS_BLOCKDEV=y
+# CONFIG_CRAMFS_MTD is not set
+CONFIG_SQUASHFS=y
+# CONFIG_SQUASHFS_FILE_CACHE is not set
+CONFIG_SQUASHFS_FILE_DIRECT=y
+CONFIG_SQUASHFS_DECOMP_SINGLE=y
+# CONFIG_SQUASHFS_DECOMP_MULTI is not set
+# CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU is not set
+# CONFIG_SQUASHFS_XATTR is not set
+# CONFIG_SQUASHFS_ZLIB is not set
+# CONFIG_SQUASHFS_LZ4 is not set
+# CONFIG_SQUASHFS_LZO is not set
+CONFIG_SQUASHFS_XZ=y
+# CONFIG_SQUASHFS_ZSTD is not set
+# CONFIG_SQUASHFS_4K_DEVBLK_SIZE is not set
+# CONFIG_SQUASHFS_EMBEDDED is not set
+CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3
+# CONFIG_VXFS_FS is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_OMFS_FS is not set
+# CONFIG_HPFS_FS is not set
+# CONFIG_QNX4FS_FS is not set
+# CONFIG_QNX6FS_FS is not set
+# CONFIG_ROMFS_FS is not set
+CONFIG_PSTORE=y
+CONFIG_PSTORE_DEFLATE_COMPRESS=y
+# CONFIG_PSTORE_LZO_COMPRESS is not set
+# CONFIG_PSTORE_LZ4_COMPRESS is not set
+# CONFIG_PSTORE_LZ4HC_COMPRESS is not set
+# CONFIG_PSTORE_842_COMPRESS is not set
+# CONFIG_PSTORE_ZSTD_COMPRESS is not set
+CONFIG_PSTORE_COMPRESS=y
+CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT=y
+CONFIG_PSTORE_COMPRESS_DEFAULT="deflate"
+# CONFIG_PSTORE_CONSOLE is not set
+# CONFIG_PSTORE_PMSG is not set
+CONFIG_PSTORE_RAM=y
+# CONFIG_SYSV_FS is not set
+# CONFIG_UFS_FS is not set
+# CONFIG_EROFS_FS is not set
+CONFIG_NETWORK_FILESYSTEMS=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V2=y
+CONFIG_NFS_V3=y
+# CONFIG_NFS_V3_ACL is not set
+# CONFIG_NFS_V4 is not set
+CONFIG_ROOT_NFS=y
+CONFIG_NFSD=y
+CONFIG_NFSD_V3=y
+# CONFIG_NFSD_V3_ACL is not set
+CONFIG_NFSD_V4=y
+# CONFIG_NFSD_BLOCKLAYOUT is not set
+# CONFIG_NFSD_SCSILAYOUT is not set
+# CONFIG_NFSD_FLEXFILELAYOUT is not set
+CONFIG_SMB_SERVER=y
+CONFIG_SMB_INSECURE_SERVER=y
+CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN=y
+# CONFIG_SMB_SERVER_KERBEROS5 is not set
+CONFIG_GRACE_PERIOD=y
+CONFIG_LOCKD=y
+CONFIG_LOCKD_V4=y
+CONFIG_NFS_COMMON=y
+CONFIG_SUNRPC=y
+CONFIG_SUNRPC_GSS=y
+# CONFIG_SUNRPC_DEBUG is not set
+# CONFIG_CEPH_FS is not set
+# CONFIG_CIFS is not set
+# CONFIG_CODA_FS is not set
+# CONFIG_AFS_FS is not set
+CONFIG_NLS=y
+CONFIG_NLS_DEFAULT="iso8859-1"
+CONFIG_NLS_CODEPAGE_437=y
+# CONFIG_NLS_CODEPAGE_737 is not set
+# CONFIG_NLS_CODEPAGE_775 is not set
+CONFIG_NLS_CODEPAGE_850=y
+# CONFIG_NLS_CODEPAGE_852 is not set
+# CONFIG_NLS_CODEPAGE_855 is not set
+# CONFIG_NLS_CODEPAGE_857 is not set
+# CONFIG_NLS_CODEPAGE_860 is not set
+# CONFIG_NLS_CODEPAGE_861 is not set
+# CONFIG_NLS_CODEPAGE_862 is not set
+# CONFIG_NLS_CODEPAGE_863 is not set
+# CONFIG_NLS_CODEPAGE_864 is not set
+# CONFIG_NLS_CODEPAGE_865 is not set
+# CONFIG_NLS_CODEPAGE_866 is not set
+# CONFIG_NLS_CODEPAGE_869 is not set
+# CONFIG_NLS_CODEPAGE_936 is not set
+# CONFIG_NLS_CODEPAGE_950 is not set
+# CONFIG_NLS_CODEPAGE_932 is not set
+# CONFIG_NLS_CODEPAGE_949 is not set
+# CONFIG_NLS_CODEPAGE_874 is not set
+# CONFIG_NLS_ISO8859_8 is not set
+# CONFIG_NLS_CODEPAGE_1250 is not set
+# CONFIG_NLS_CODEPAGE_1251 is not set
+# CONFIG_NLS_ASCII is not set
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_2=y
+# CONFIG_NLS_ISO8859_3 is not set
+# CONFIG_NLS_ISO8859_4 is not set
+# CONFIG_NLS_ISO8859_5 is not set
+# CONFIG_NLS_ISO8859_6 is not set
+# CONFIG_NLS_ISO8859_7 is not set
+# CONFIG_NLS_ISO8859_9 is not set
+# CONFIG_NLS_ISO8859_13 is not set
+# CONFIG_NLS_ISO8859_14 is not set
+# CONFIG_NLS_ISO8859_15 is not set
+# CONFIG_NLS_KOI8_R is not set
+# CONFIG_NLS_KOI8_U is not set
+# CONFIG_NLS_MAC_ROMAN is not set
+# CONFIG_NLS_MAC_CELTIC is not set
+# CONFIG_NLS_MAC_CENTEURO is not set
+# CONFIG_NLS_MAC_CROATIAN is not set
+# CONFIG_NLS_MAC_CYRILLIC is not set
+# CONFIG_NLS_MAC_GAELIC is not set
+# CONFIG_NLS_MAC_GREEK is not set
+# CONFIG_NLS_MAC_ICELAND is not set
+# CONFIG_NLS_MAC_INUIT is not set
+# CONFIG_NLS_MAC_ROMANIAN is not set
+# CONFIG_NLS_MAC_TURKISH is not set
+CONFIG_NLS_UTF8=y
+# CONFIG_DLM is not set
+# CONFIG_UNICODE is not set
+# end of File systems
+
+#
+# Security options
+#
+# CONFIG_KEYS is not set
+# CONFIG_SECURITY_DMESG_RESTRICT is not set
+# CONFIG_SECURITY is not set
+# CONFIG_SECURITYFS is not set
+CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y
+# CONFIG_HARDENED_USERCOPY is not set
+# CONFIG_FORTIFY_SOURCE is not set
+# CONFIG_STATIC_USERMODEHELPER is not set
+CONFIG_DEFAULT_SECURITY_DAC=y
+CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity"
+
+#
+# Kernel hardening options
+#
+
+#
+# Memory initialization
+#
+CONFIG_INIT_STACK_NONE=y
+# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set
+# CONFIG_GCC_PLUGIN_STACKLEAK is not set
+# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
+# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
+# end of Memory initialization
+# end of Kernel hardening options
+# end of Security options
+
+CONFIG_XOR_BLOCKS=y
+CONFIG_ASYNC_CORE=y
+CONFIG_ASYNC_MEMCPY=y
+CONFIG_ASYNC_XOR=y
+CONFIG_ASYNC_PQ=y
+CONFIG_ASYNC_RAID6_RECOV=y
+CONFIG_CRYPTO=y
+
+#
+# Crypto core or helper
+#
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_AEAD2=y
+CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_BLKCIPHER2=y
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_AKCIPHER2=y
+CONFIG_CRYPTO_KPP2=y
+CONFIG_CRYPTO_KPP=y
+CONFIG_CRYPTO_ACOMP2=y
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
+# CONFIG_CRYPTO_USER is not set
+CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y
+CONFIG_CRYPTO_GF128MUL=y
+CONFIG_CRYPTO_NULL=y
+CONFIG_CRYPTO_NULL2=y
+# CONFIG_CRYPTO_PCRYPT is not set
+# CONFIG_CRYPTO_CRYPTD is not set
+CONFIG_CRYPTO_AUTHENC=y
+# CONFIG_CRYPTO_TEST is not set
+
+#
+# Public-key cryptography
+#
+# CONFIG_CRYPTO_RSA is not set
+# CONFIG_CRYPTO_DH is not set
+CONFIG_CRYPTO_ECC=y
+CONFIG_CRYPTO_ECDH=y
+# CONFIG_CRYPTO_ECRDSA is not set
+
+#
+# Authenticated Encryption with Associated Data
+#
+CONFIG_CRYPTO_CCM=y
+CONFIG_CRYPTO_GCM=y
+CONFIG_CRYPTO_CHACHA20POLY1305=y
+# CONFIG_CRYPTO_AEGIS128 is not set
+CONFIG_CRYPTO_SEQIV=y
+CONFIG_CRYPTO_ECHAINIV=y
+
+#
+# Block modes
+#
+CONFIG_CRYPTO_CBC=y
+# CONFIG_CRYPTO_CFB is not set
+CONFIG_CRYPTO_CTR=y
+# CONFIG_CRYPTO_CTS is not set
+CONFIG_CRYPTO_ECB=y
+# CONFIG_CRYPTO_LRW is not set
+# CONFIG_CRYPTO_OFB is not set
+# CONFIG_CRYPTO_PCBC is not set
+# CONFIG_CRYPTO_XTS is not set
+# CONFIG_CRYPTO_KEYWRAP is not set
+# CONFIG_CRYPTO_ADIANTUM is not set
+CONFIG_CRYPTO_ESSIV=y
+
+#
+# Hash modes
+#
+CONFIG_CRYPTO_CMAC=y
+CONFIG_CRYPTO_HMAC=y
+# CONFIG_CRYPTO_XCBC is not set
+# CONFIG_CRYPTO_VMAC is not set
+
+#
+# Digest
+#
+CONFIG_CRYPTO_CRC32C=y
+# CONFIG_CRYPTO_CRC32 is not set
+# CONFIG_CRYPTO_XXHASH is not set
+# CONFIG_CRYPTO_CRCT10DIF is not set
+CONFIG_CRYPTO_GHASH=y
+CONFIG_CRYPTO_POLY1305=y
+CONFIG_CRYPTO_MD4=y
+CONFIG_CRYPTO_MD5=y
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_RMD128 is not set
+# CONFIG_CRYPTO_RMD160 is not set
+# CONFIG_CRYPTO_RMD256 is not set
+# CONFIG_CRYPTO_RMD320 is not set
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_SHA3=y
+# CONFIG_CRYPTO_SM3 is not set
+# CONFIG_CRYPTO_STREEBOG is not set
+# CONFIG_CRYPTO_TGR192 is not set
+# CONFIG_CRYPTO_WP512 is not set
+
+#
+# Ciphers
+#
+CONFIG_CRYPTO_LIB_AES=y
+CONFIG_CRYPTO_AES=y
+# CONFIG_CRYPTO_AES_TI is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+CONFIG_CRYPTO_LIB_ARC4=y
+CONFIG_CRYPTO_ARC4=y
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+CONFIG_CRYPTO_LIB_DES=y
+CONFIG_CRYPTO_DES=y
+# CONFIG_CRYPTO_FCRYPT is not set
+# CONFIG_CRYPTO_KHAZAD is not set
+# CONFIG_CRYPTO_SALSA20 is not set
+CONFIG_CRYPTO_CHACHA20=y
+# CONFIG_CRYPTO_SEED is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_SM4 is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+
+#
+# Compression
+#
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_LZO=y
+# CONFIG_CRYPTO_842 is not set
+# CONFIG_CRYPTO_LZ4 is not set
+# CONFIG_CRYPTO_LZ4HC is not set
+# CONFIG_CRYPTO_ZSTD is not set
+
+#
+# Random Number Generation
+#
+# CONFIG_CRYPTO_ANSI_CPRNG is not set
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+# CONFIG_CRYPTO_DRBG_HASH is not set
+# CONFIG_CRYPTO_DRBG_CTR is not set
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+# CONFIG_CRYPTO_USER_API_HASH is not set
+# CONFIG_CRYPTO_USER_API_SKCIPHER is not set
+# CONFIG_CRYPTO_USER_API_RNG is not set
+# CONFIG_CRYPTO_USER_API_AEAD is not set
+# CONFIG_CRYPTO_HW is not set
+
+#
+# Certificates for signature checking
+#
+# end of Certificates for signature checking
+
+#
+# Library routines
+#
+CONFIG_RAID6_PQ=y
+# CONFIG_RAID6_PQ_BENCHMARK is not set
+# CONFIG_PACKING is not set
+CONFIG_BITREVERSE=y
+CONFIG_HAVE_ARCH_BITREVERSE=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_NET_UTILS=y
+# CONFIG_CORDIC is not set
+CONFIG_RATIONAL=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y
+CONFIG_ARCH_HAS_FAST_MULTIPLIER=y
+# CONFIG_INDIRECT_PIO is not set
+# CONFIG_CRC_CCITT is not set
+CONFIG_CRC16=y
+# CONFIG_CRC_T10DIF is not set
+# CONFIG_CRC_ITU_T is not set
+CONFIG_CRC32=y
+# CONFIG_CRC32_SELFTEST is not set
+CONFIG_CRC32_SLICEBY8=y
+# CONFIG_CRC32_SLICEBY4 is not set
+# CONFIG_CRC32_SARWATE is not set
+# CONFIG_CRC32_BIT is not set
+# CONFIG_CRC64 is not set
+# CONFIG_CRC4 is not set
+# CONFIG_CRC7 is not set
+CONFIG_LIBCRC32C=y
+# CONFIG_CRC8 is not set
+CONFIG_AUDIT_GENERIC=y
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
+# CONFIG_RANDOM32_SELFTEST is not set
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_XZ_DEC=y
+# CONFIG_XZ_DEC_X86 is not set
+# CONFIG_XZ_DEC_POWERPC is not set
+# CONFIG_XZ_DEC_IA64 is not set
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_ARMTHUMB=y
+# CONFIG_XZ_DEC_SPARC is not set
+CONFIG_XZ_DEC_BCJ=y
+# CONFIG_XZ_DEC_TEST is not set
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_REED_SOLOMON=y
+CONFIG_REED_SOLOMON_ENC8=y
+CONFIG_REED_SOLOMON_DEC8=y
+CONFIG_XARRAY_MULTI=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HAS_DMA=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_DMA_DECLARE_COHERENT=y
+CONFIG_ARCH_HAS_SETUP_DMA_OPS=y
+CONFIG_ARCH_HAS_SYNC_DMA_FOR_DEVICE=y
+CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU=y
+CONFIG_ARCH_HAS_DMA_PREP_COHERENT=y
+CONFIG_ARCH_HAS_DMA_COHERENT_TO_PFN=y
+CONFIG_SWIOTLB=y
+CONFIG_DMA_REMAP=y
+CONFIG_DMA_DIRECT_REMAP=y
+# CONFIG_DMA_API_DEBUG is not set
+CONFIG_SGL_ALLOC=y
+CONFIG_CPU_RMAP=y
+CONFIG_DQL=y
+CONFIG_GLOB=y
+# CONFIG_GLOB_SELFTEST is not set
+CONFIG_NLATTR=y
+# CONFIG_IRQ_POLL is not set
+CONFIG_LIBFDT=y
+CONFIG_OID_REGISTRY=y
+CONFIG_HAVE_GENERIC_VDSO=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_FONT_SUPPORT=y
+CONFIG_FONT_8x16=y
+CONFIG_FONT_AUTOSELECT=y
+CONFIG_SG_POOL=y
+CONFIG_STACKDEPOT=y
+CONFIG_SBITMAP=y
+# CONFIG_STRING_SELFTEST is not set
+CONFIG_ARCH_HAS_FBXSERIAL=y
+CONFIG_FBXSERIAL=y
+# end of Library routines
+
+#
+# Kernel hacking
+#
+
+#
+# printk and dmesg options
+#
+CONFIG_PRINTK_TIME=y
+# CONFIG_PRINTK_CALLER is not set
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7
+CONFIG_CONSOLE_LOGLEVEL_QUIET=4
+CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4
+# CONFIG_BOOT_PRINTK_DELAY is not set
+# CONFIG_DYNAMIC_DEBUG is not set
+# end of printk and dmesg options
+
+#
+# Compile-time checks and compiler options
+#
+# CONFIG_DEBUG_INFO is not set
+CONFIG_ENABLE_MUST_CHECK=y
+CONFIG_FRAME_WARN=2048
+# CONFIG_STRIP_ASM_SYMS is not set
+# CONFIG_READABLE_ASM is not set
+CONFIG_DEBUG_FS=y
+# CONFIG_HEADERS_INSTALL is not set
+CONFIG_OPTIMIZE_INLINING=y
+# CONFIG_DEBUG_SECTION_MISMATCH is not set
+CONFIG_SECTION_MISMATCH_WARN_ONLY=y
+CONFIG_ARCH_WANT_FRAME_POINTERS=y
+CONFIG_FRAME_POINTER=y
+# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
+# end of Compile-time checks and compiler options
+
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1
+CONFIG_MAGIC_SYSRQ_SERIAL=y
+CONFIG_DEBUG_KERNEL=y
+# CONFIG_DEBUG_MISC is not set
+
+#
+# Memory Debugging
+#
+CONFIG_PAGE_EXTENSION=y
+CONFIG_DEBUG_PAGEALLOC=y
+CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT=y
+# CONFIG_PAGE_OWNER is not set
+CONFIG_PAGE_POISONING=y
+CONFIG_PAGE_POISONING_NO_SANITY=y
+# CONFIG_PAGE_POISONING_ZERO is not set
+# CONFIG_DEBUG_RODATA_TEST is not set
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_DEBUG_OBJECTS_SELFTEST=y
+CONFIG_DEBUG_OBJECTS_FREE=y
+CONFIG_DEBUG_OBJECTS_TIMERS=y
+CONFIG_DEBUG_OBJECTS_WORK=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
+CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER=y
+CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
+# CONFIG_SLUB_DEBUG_ON is not set
+# CONFIG_SLUB_STATS is not set
+CONFIG_HAVE_DEBUG_KMEMLEAK=y
+CONFIG_DEBUG_KMEMLEAK=y
+CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE=16000
+# CONFIG_DEBUG_KMEMLEAK_TEST is not set
+# CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF is not set
+# CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN is not set
+# CONFIG_DEBUG_STACK_USAGE is not set
+CONFIG_DEBUG_VM=y
+# CONFIG_DEBUG_VM_VMACACHE is not set
+CONFIG_DEBUG_VM_RB=y
+CONFIG_DEBUG_VM_PGFLAGS=y
+CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y
+# CONFIG_DEBUG_VIRTUAL is not set
+CONFIG_DEBUG_MEMORY_INIT=y
+# CONFIG_DEBUG_PER_CPU_MAPS is not set
+CONFIG_HAVE_ARCH_KASAN=y
+CONFIG_HAVE_ARCH_KASAN_SW_TAGS=y
+CONFIG_CC_HAS_KASAN_GENERIC=y
+CONFIG_KASAN=y
+CONFIG_KASAN_GENERIC=y
+CONFIG_KASAN_OUTLINE=y
+# CONFIG_KASAN_INLINE is not set
+CONFIG_KASAN_STACK=1
+# CONFIG_TEST_KASAN is not set
+# end of Memory Debugging
+
+CONFIG_ARCH_HAS_KCOV=y
+CONFIG_CC_HAS_SANCOV_TRACE_PC=y
+# CONFIG_KCOV is not set
+CONFIG_DEBUG_SHIRQ=y
+
+#
+# Debug Lockups and Hangs
+#
+# CONFIG_SOFTLOCKUP_DETECTOR is not set
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=1
+# CONFIG_WQ_WATCHDOG is not set
+# end of Debug Lockups and Hangs
+
+# CONFIG_PANIC_ON_OOPS is not set
+CONFIG_PANIC_ON_OOPS_VALUE=0
+CONFIG_PANIC_TIMEOUT=10
+# CONFIG_SCHED_DEBUG is not set
+# CONFIG_SCHEDSTATS is not set
+# CONFIG_SCHED_STACK_END_CHECK is not set
+CONFIG_DEBUG_TIMEKEEPING=y
+
+#
+# Lock Debugging (spinlocks, mutexes, etc...)
+#
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_LOCK_STAT is not set
+CONFIG_DEBUG_RT_MUTEXES=y
+CONFIG_DEBUG_SPINLOCK=y
+CONFIG_DEBUG_MUTEXES=y
+# CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set
+# CONFIG_DEBUG_RWSEMS is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+CONFIG_DEBUG_ATOMIC_SLEEP=y
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
+# CONFIG_LOCK_TORTURE_TEST is not set
+# CONFIG_WW_MUTEX_SELFTEST is not set
+# end of Lock Debugging (spinlocks, mutexes, etc...)
+
+CONFIG_STACKTRACE=y
+# CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set
+# CONFIG_DEBUG_KOBJECT is not set
+# CONFIG_DEBUG_KOBJECT_RELEASE is not set
+CONFIG_HAVE_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_LIST=y
+# CONFIG_DEBUG_PLIST is not set
+CONFIG_DEBUG_SG=y
+CONFIG_DEBUG_NOTIFIERS=y
+# CONFIG_DEBUG_CREDENTIALS is not set
+
+#
+# RCU Debugging
+#
+# CONFIG_RCU_PERF_TEST is not set
+# CONFIG_RCU_TORTURE_TEST is not set
+CONFIG_RCU_CPU_STALL_TIMEOUT=21
+# CONFIG_RCU_TRACE is not set
+# CONFIG_RCU_EQS_DEBUG is not set
+# end of RCU Debugging
+
+# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set
+# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
+# CONFIG_NOTIFIER_ERROR_INJECTION is not set
+# CONFIG_FAULT_INJECTION is not set
+# CONFIG_LATENCYTOP is not set
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+CONFIG_HAVE_C_RECORDMCOUNT=y
+CONFIG_TRACING_SUPPORT=y
+# CONFIG_FTRACE is not set
+# CONFIG_RUNTIME_TESTING_MENU is not set
+CONFIG_MEMTEST=y
+# CONFIG_BUG_ON_DATA_CORRUPTION is not set
+# CONFIG_SAMPLES is not set
+CONFIG_HAVE_ARCH_KGDB=y
+# CONFIG_KGDB is not set
+CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
+# CONFIG_UBSAN is not set
+CONFIG_UBSAN_ALIGNMENT=y
+CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y
+# CONFIG_STRICT_DEVMEM is not set
+# CONFIG_ARM64_PTDUMP_DEBUGFS is not set
+# CONFIG_PID_IN_CONTEXTIDR is not set
+# CONFIG_ARM64_RANDOMIZE_TEXT_OFFSET is not set
+# CONFIG_DEBUG_WX is not set
+# CONFIG_DEBUG_ALIGN_RODATA is not set
+# CONFIG_ARM64_RELOC_TEST is not set
+# CONFIG_CORESIGHT is not set
+# end of Kernel hacking
diff -Nruw linux-5.4.60-fbx/drivers/fbxgpio./fbxgpio_core.c linux-5.4.60-fbx/drivers/fbxgpio/fbxgpio_core.c
--- linux-5.4.60-fbx/drivers/fbxgpio./fbxgpio_core.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/fbxgpio/fbxgpio_core.c	2021-03-04 13:20:57.760838887 +0100
@@ -0,0 +1,361 @@
+#include <linux/string.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/fbxgpio_core.h>
+#include <linux/of.h>
+
+#define PFX	"fbxgpio_core: "
+
+/* #define DEBUG */
+#ifdef DEBUG
+#define dprint(Fmt, Arg...)	printk(PFX Fmt, Arg)
+#else
+#define dprint(Fmt, Arg...)	do { } while (0)
+#endif
+
+static struct class *fbxgpio_class;
+
+/*
+ * retrieval of a struct fbxgpio_pin from a phandle in the device
+ * tree.
+ */
+struct fbxgpio_of_mach_data {
+	struct fbxgpio_pin *match;
+	struct device_node *np;
+};
+
+static int match_fbxgpio_of_node(struct device *dev, void *data)
+{
+	struct fbxgpio_of_mach_data *md = data;
+	struct fbxgpio_pin *pin = dev_get_drvdata(dev);
+
+	if (pin->of_node == md->np) {
+		md->match = pin;
+		return 1;
+	}
+	return 0;
+}
+
+struct fbxgpio_pin *fbxgpio_of_get(struct device_node *np, const char *propname,
+				   int index)
+{
+	struct fbxgpio_of_mach_data md;
+
+	/*
+	 * get the pin device_node.
+	 */
+	md.match = NULL;
+	md.np = of_parse_phandle(np, propname, index);
+	if (!md.np)
+		return ERR_PTR(-ENOENT);
+
+	/*
+	 * find the struct fbxgpio_pin behind that device_node.
+	 */
+	class_for_each_device(fbxgpio_class, NULL, &md,
+			      match_fbxgpio_of_node);
+
+	return md.match ? md.match : ERR_PTR(-ENOENT);
+}
+EXPORT_SYMBOL(fbxgpio_of_get);
+
+/*
+ * show direction in for gpio associated with class_device dev.
+ */
+static ssize_t show_direction(struct device *dev,
+			      struct device_attribute *attr, char *buf)
+{
+	struct fbxgpio_pin *p;
+	int dir, ret = 0;
+
+	p = dev_get_drvdata(dev);
+
+	if (p->ops->get_direction)
+		dir = p->ops->get_direction(p->pin_num);
+	else
+		dir = p->direction;
+
+	switch (dir) {
+	case GPIO_DIR_IN:
+		ret += sprintf(buf, "input\n");
+		break;
+	case GPIO_DIR_OUT:
+		ret += sprintf(buf, "output\n");
+		break;
+	default:
+		ret += sprintf(buf, "unknown\n");
+		break;
+	}
+	return ret;
+}
+
+/*
+ * store direction. return -EINVAL if direction string is bad. return
+ * -EPERM if flag FBXGPIO_PIN_DIR_RW is set in flags.
+ */
+static ssize_t store_direction(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t size)
+{
+	int dir;
+	struct fbxgpio_pin *p;
+	int match_len = 0;
+	int i, ret;
+	static const char *word_match[] = {
+		[GPIO_DIR_IN] = "input",
+		[GPIO_DIR_OUT] = "output",
+	};
+
+	if (*buf == ' ' || *buf == '\t' || *buf == '\r' || *buf == '\n')
+		/* silently eat any spaces/tab/linefeed/carriagereturn */
+		return 1;
+
+	p = dev_get_drvdata(dev);
+	if (!(p->flags & FBXGPIO_PIN_DIR_RW)) {
+		dprint("pin %s direction is read only.\n", p->pin_name);
+		return -EPERM;
+	}
+	dir = 0;
+	for (i = 0; i < 2; ++i) {
+		if (size >= strlen(word_match[i]) &&
+		    !strncmp(buf, word_match[i], strlen(word_match[i]))) {
+			dir = i;
+			match_len = strlen(word_match[i]);
+			break ;
+		}
+	}
+	if (i == 2)
+		return -EINVAL;
+
+	ret = p->ops->set_direction(p->pin_num, dir);
+	if (ret)
+		return ret;
+	p->direction = dir;
+
+	return match_len;
+}
+
+/*
+ * show input data for input gpio pins.
+ */
+static ssize_t show_datain(struct device *dev,
+			   struct device_attribute *attr, char *buf)
+{
+	int val;
+	struct fbxgpio_pin *p;
+
+	p = dev_get_drvdata(dev);
+	if (p->direction == GPIO_DIR_OUT)
+		return -EINVAL;
+	val = p->ops->get_datain(p->pin_num);
+
+	if (p->flags & FBXGPIO_PIN_REVERSE_POL)
+		val = 1 - val;
+	return sprintf(buf, "%i\n", val);
+}
+
+/*
+ * show output data for output gpio pins.
+ */
+static ssize_t show_dataout(struct device *dev,
+			    struct device_attribute *attr, char *buf)
+{
+	int val;
+	struct fbxgpio_pin *p;
+
+	p = dev_get_drvdata(dev);
+	if (p->direction == GPIO_DIR_IN)
+		return -EINVAL;
+	if (p->ops->get_dataout)
+		val = p->ops->get_dataout(p->pin_num);
+	else
+		val = p->cur_dataout;
+
+	if (p->flags & FBXGPIO_PIN_REVERSE_POL)
+		val = 1 - val;
+	return sprintf(buf, "%i\n", val);
+}
+
+/*
+ * store new dataout value for output gpio pins.
+ */
+static ssize_t store_dataout(struct device *dev,
+	    struct device_attribute *attr, const char *buf, size_t size)
+{
+	int val;
+	struct fbxgpio_pin *p;
+
+	if (*buf == ' ' || *buf == '\t' || *buf == '\r' || *buf == '\n')
+		/* silently eat any spaces/tab/linefeed/carriagereturn */
+		return 1;
+
+	p = dev_get_drvdata(dev);
+
+	if (p->direction != GPIO_DIR_OUT)
+		return -EINVAL;
+
+	switch (*buf) {
+	case '0':
+		val = 0;
+		break ;
+	case '1':
+		val = 1;
+		break ;
+	default:
+		return -EINVAL;
+	}
+
+	p->cur_dataout = val;
+
+	if (p->flags & FBXGPIO_PIN_REVERSE_POL)
+		val = 1 - val;
+	p->ops->set_dataout(p->pin_num, val);
+	return 1;
+}
+
+/*
+ * show pin number associated with gpio pin.
+ */
+static ssize_t show_pinnum(struct device *dev,
+			   struct device_attribute *attr, char *buf)
+{
+	struct fbxgpio_pin *p;
+
+	p = dev_get_drvdata(dev);
+	return sprintf(buf, "%i\n", p->pin_num);
+}
+
+/*
+ * attribute list associated with each class device.
+ */
+static struct device_attribute gpio_attributes[] = {
+	__ATTR(direction, 0600, show_direction, store_direction),
+	__ATTR(data_in,   0400, show_datain, NULL),
+	__ATTR(data_out,  0600, show_dataout, store_dataout),
+	__ATTR(pin_num,   0400, show_pinnum, NULL),
+};
+
+static int fbxgpio_register_pin(struct platform_device *ppdev,
+				struct fbxgpio_pin *pin)
+{
+	struct device *dev;
+	int i, ret;
+
+	dprint("registering pin %s\n", pin->pin_name);
+
+	/* ensure ops is valid */
+	if (!pin->ops) {
+		printk(KERN_ERR PFX "no operation set for pin %s\n",
+		       pin->pin_name);
+		return -EINVAL;
+	}
+
+	dev = device_create(fbxgpio_class, &ppdev->dev, 0, pin,
+			    "%s", pin->pin_name);
+	if (IS_ERR(dev))
+		return PTR_ERR(dev);
+
+	for (i = 0; i < ARRAY_SIZE(gpio_attributes); i++) {
+		ret = device_create_file(dev, &gpio_attributes[i]);
+		if (ret)
+			goto err_out;
+	}
+
+	/* ensure pin direction matches hardware state */
+	if (pin->ops->get_direction &&
+	    pin->direction != pin->ops->get_direction(pin->pin_num)) {
+		printk(KERN_WARNING PFX "pin %s default direction does not "
+		       "match current hardware state, fixing.\n",
+		       pin->pin_name);
+		pin->ops->set_direction(pin->pin_num, pin->direction);
+	}
+	pin->dev = dev;
+	return 0;
+
+err_out:
+	for (; i >= 0; i--)
+		device_remove_file(dev, &gpio_attributes[i]);
+	device_unregister(dev);
+	return ret;
+}
+
+static void fbxgpio_unregister_pin(struct fbxgpio_pin *pin)
+{
+	struct device *dev;
+	int i;
+
+	dprint("unregistering pin %s\n", pin->pin_name);
+	dev = pin->dev;
+	pin->dev = NULL;
+
+	for (i = 0; i < ARRAY_SIZE(gpio_attributes); i++)
+		device_remove_file(dev, &gpio_attributes[i]);
+	device_unregister(dev);
+}
+
+static int fbxgpio_platform_probe(struct platform_device *pdev)
+{
+	struct fbxgpio_pin *p;
+	int err = 0;
+
+	p = pdev->dev.platform_data;
+	while (p->pin_name) {
+		err = fbxgpio_register_pin(pdev, p);
+		if (err)
+			return err;
+		++p;
+	}
+	return 0;
+}
+
+static int fbxgpio_platform_remove(struct platform_device *pdev)
+{
+	struct fbxgpio_pin *p;
+
+	p = pdev->dev.platform_data;
+	while (p->pin_name) {
+		fbxgpio_unregister_pin(p);
+		++p;
+	}
+	return 0;
+}
+
+static struct platform_driver fbxgpio_platform_driver =
+{
+	.probe	= fbxgpio_platform_probe,
+	.remove	= fbxgpio_platform_remove,
+	.driver	= {
+		.name	= "fbxgpio",
+	}
+};
+
+static int __init fbxgpio_init(void)
+{
+	int ret;
+
+	fbxgpio_class = class_create(THIS_MODULE, "fbxgpio");
+	if (IS_ERR(fbxgpio_class))
+		return PTR_ERR(fbxgpio_class);
+
+	ret = platform_driver_register(&fbxgpio_platform_driver);
+	if (ret) {
+		printk(KERN_ERR PFX "unable to register fbxgpio driver.\n");
+		class_destroy(fbxgpio_class);
+		return ret;
+	}
+	return 0;
+}
+
+static void __exit fbxgpio_exit(void)
+{
+	platform_driver_unregister(&fbxgpio_platform_driver);
+	class_destroy(fbxgpio_class);
+}
+
+subsys_initcall(fbxgpio_init);
+module_exit(fbxgpio_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Nicolas Schichan <nicolas.schichan@freebox.fr>");
diff -Nruw linux-5.4.60-fbx/drivers/fbxgpio./fbxgpio_dt.c linux-5.4.60-fbx/drivers/fbxgpio/fbxgpio_dt.c
--- linux-5.4.60-fbx/drivers/fbxgpio./fbxgpio_dt.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/fbxgpio/fbxgpio_dt.c	2021-03-04 13:20:57.760838887 +0100
@@ -0,0 +1,264 @@
+/*
+ * fbxgpio_dt.c for fbxgpio
+ * Created by <nschichan@freebox.fr> on Tue Aug  1 14:01:01 2017
+ */
+
+#include <linux/kernel.h>
+#include <linux/gpio.h>
+#include <linux/of_gpio.h>
+#include <linux/platform_device.h>
+#include <linux/fbxgpio_core.h>
+#include <linux/module.h>
+#include <linux/gpio.h>
+#include <linux/gpio/consumer.h>
+#include <linux/of_gpio.h>
+
+static atomic_t last_id = ATOMIC_INIT(0);
+
+/*
+ * fbxgpio driver fetching gpios names and configuration from
+ * device-tree.
+ */
+
+struct fbxgpio_dt_priv {
+	struct fbxgpio_pin *pins;
+	unsigned int npins;
+
+	/* dynamically created platform_device for fbxgpio_core */
+	struct platform_device *top_pdev;
+};
+
+
+/*
+ * small shim layer for gpiolib <-> fbxgpio_operations.
+ *
+ * gpio direction change is unsupported, does userspace really need
+ * it?
+ */
+static int fbxgpio_dt_get_data(int gpio)
+{
+	return gpio_get_value_cansleep(gpio);
+}
+
+static void fbxgpio_dt_set_dataout(int gpio, int value)
+{
+	gpio_set_value_cansleep(gpio, value);
+}
+
+static int fbxgpio_dt_set_direction(int gpio, int dir)
+{
+	if (dir == GPIO_DIR_OUT)
+		return gpio_direction_output(gpio, 0);
+	else
+		return gpio_direction_input(gpio);
+}
+
+static const struct fbxgpio_operations fbxgpio_dt_ops = {
+	.get_datain = fbxgpio_dt_get_data,
+	.get_dataout = fbxgpio_dt_get_data,
+	.set_dataout = fbxgpio_dt_set_dataout,
+	.set_direction = fbxgpio_dt_set_direction,
+};
+
+/*
+ * fill an fbxgpio_pin with the configuration found in a device tree
+ * node.
+ *
+ * required properties are:
+ * - gpio: a phandle to a standard linux gpio.
+ *
+ * - the name of the node: the name of the gpio as it will appear under
+ *   /sys/class/fbxgpio/
+ *
+ * - <input>/<output-high>/<output-low>: how to declare gpio and
+ *   actually setup it unless no-claim is given
+ *
+ * - <no-claim>: just declare gpio, but don't request & setup it
+ */
+static int fbxgpio_dt_fill_gpio(struct platform_device *pdev,
+				struct device_node *np,
+				struct fbxgpio_pin *pin)
+{
+	enum of_gpio_flags flags;
+	int error;
+
+	error = of_property_read_string(np, "name", &pin->pin_name);
+	if (error) {
+		dev_err(&pdev->dev, "gpio has no name.\n");
+		return error;
+	}
+
+	pin->pin_num = of_get_named_gpio_flags(np, "gpio", 0, &flags);
+	if (pin->pin_num < 0) {
+		if (pin->pin_num != -EPROBE_DEFER)
+			dev_err(&pdev->dev,
+				"unable to get gpio desc for %s: %d.\n",
+				pin->pin_name, pin->pin_num);
+		return pin->pin_num;
+	}
+
+	if (of_property_read_bool(np, "input")) {
+		pin->direction = GPIO_DIR_IN;
+	} else if (of_property_read_bool(np, "output-low")) {
+		pin->direction = GPIO_DIR_OUT;
+		pin->cur_dataout = 0;
+	} else if (of_property_read_bool(np, "output-high")) {
+		pin->direction = GPIO_DIR_OUT;
+		pin->cur_dataout = 1;
+	} else {
+		dev_err(&pdev->dev,
+			"no state specified for %s\n",
+			pin->pin_name);
+		return -EINVAL;
+	}
+
+	if (flags & OF_GPIO_ACTIVE_LOW) {
+		pin->flags |= FBXGPIO_PIN_REVERSE_POL;
+		if (pin->direction == GPIO_DIR_OUT)
+			pin->cur_dataout = 1 - pin->cur_dataout;
+	}
+
+	if (!of_property_read_bool(np, "no-claim")) {
+		error = gpio_request(pin->pin_num, "fbxgpio-dt");
+		if (error) {
+			dev_err(&pdev->dev, "unable to request gpio%d (%s): %d\n",
+				pin->pin_num, pin->pin_name, error);
+			return error;
+		}
+		pin->claimed = true;
+
+		if (pin->direction == GPIO_DIR_OUT)
+			gpio_direction_output(pin->pin_num, pin->cur_dataout);
+		else
+			gpio_direction_input(pin->pin_num);
+	}
+
+	if (of_property_read_bool(np, "bidir"))
+		pin->flags = FBXGPIO_PIN_DIR_RW;
+
+	pin->of_node = np;
+	pin->ops = &fbxgpio_dt_ops;
+	return 0;
+}
+
+static int fbxgpio_dt_probe(struct platform_device *pdev)
+{
+	struct fbxgpio_dt_priv *priv;
+	struct device_node *fbxgpio_node;
+	u32 cur_gpio;
+	int error = 0;
+	size_t priv_alloc_size;
+	int i;
+
+	priv = devm_kzalloc(&pdev->dev, sizeof (*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	dev_set_drvdata(&pdev->dev, priv);
+
+	/*
+	 * first pass to get the number of struct fbxgpio_pin to
+	 * allocate.
+	 */
+	for_each_available_child_of_node(pdev->dev.of_node, fbxgpio_node) {
+		++priv->npins;
+	}
+
+	/*
+	 * allocate pins: use npins + 1 for zeroed end sentinel.
+	 */
+	priv_alloc_size = (priv->npins + 1) * sizeof (struct fbxgpio_pin);
+	priv->pins = devm_kzalloc(&pdev->dev, priv_alloc_size, GFP_KERNEL);
+	if (!priv->pins)
+		return -ENOMEM;
+
+	/*
+	 * second pass to fill the priv->pins array.
+	 */
+	cur_gpio = 0;
+	for_each_available_child_of_node(pdev->dev.of_node, fbxgpio_node) {
+		error = fbxgpio_dt_fill_gpio(pdev, fbxgpio_node,
+					     &priv->pins[cur_gpio]);
+		if (error)
+			goto out_free_gpios;
+		++cur_gpio;
+	}
+
+	dev_info(&pdev->dev, "%u gpios.\n", priv->npins);
+
+	/*
+	 * create and register a platform device for fbxgpio_core.
+	 */
+	priv->top_pdev = platform_device_register_data(&pdev->dev,
+						       "fbxgpio",
+						       atomic_inc_return(&last_id),
+						       priv->pins,
+						       priv_alloc_size);
+
+	if (IS_ERR(priv->top_pdev)) {
+		dev_err(&pdev->dev, "unable to register fbxgpio platform "
+			"device: %ld\n", PTR_ERR(priv->top_pdev));
+		return PTR_ERR(priv->top_pdev);
+	}
+
+	for (i = 0; i < priv->npins; i++) {
+		struct fbxgpio_pin *pin = &priv->pins[i];
+
+		if (pin->direction == GPIO_DIR_OUT)
+			dev_dbg(&pdev->dev,
+				"%sgpio %d (%s) is output, default %d\n",
+				pin->claimed ? "unclaimed " : "",
+				pin->pin_num, pin->pin_name, pin->cur_dataout);
+		else
+			dev_dbg(&pdev->dev,
+				"%sgpio %d (%s) is input\n",
+				pin->claimed ? "unclaimed " : "",
+				pin->pin_num, pin->pin_name);
+	}
+
+	return 0;
+
+out_free_gpios:
+	while (cur_gpio) {
+		--cur_gpio;
+		if (priv->pins[cur_gpio].claimed)
+			gpio_free(priv->pins[cur_gpio].pin_num);
+	}
+	return error;
+}
+
+static int fbxgpio_dt_remove(struct platform_device *pdev)
+{
+	struct fbxgpio_dt_priv *priv = dev_get_drvdata(&pdev->dev);
+	unsigned int i;
+
+	platform_device_unregister(priv->top_pdev);
+
+	for (i = 0; i < priv->npins; ++i) {
+		if (priv->pins[i].claimed)
+			gpio_free(priv->pins[i].pin_num);
+	}
+
+	return 0;
+}
+
+static const struct of_device_id fbxgpio_dt_of_match_table[] = {
+	{ .compatible = "fbx,fbxgpio" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, fbxgpio_dt_of_match_table);
+
+static struct platform_driver fbxgpio_dt_platform_driver = {
+	.probe		= fbxgpio_dt_probe,
+	.remove		= fbxgpio_dt_remove,
+	.driver		= {
+		.name		= "fbxgpio-dt",
+		.of_match_table	= fbxgpio_dt_of_match_table,
+	},
+};
+
+module_platform_driver(fbxgpio_dt_platform_driver);
+
+MODULE_AUTHOR("Nicolas Schichan <nschichan@freebox.fr>");
+MODULE_DESCRIPTION("DT Freebox GPIO Driver");
+MODULE_LICENSE("GPL v2");
diff -Nruw linux-5.4.60-fbx/drivers/fbxgpio./Kconfig linux-5.4.60-fbx/drivers/fbxgpio/Kconfig
--- linux-5.4.60-fbx/drivers/fbxgpio./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/fbxgpio/Kconfig	2021-03-04 13:20:57.760838887 +0100
@@ -0,0 +1,7 @@
+config FREEBOX_GPIO
+	tristate "Freebox GPIO control interface"
+	default n
+
+config FREEBOX_GPIO_DT
+	tristate "Freebox GPIO DT binding."
+	default n
diff -Nruw linux-5.4.60-fbx/drivers/fbxgpio./Makefile linux-5.4.60-fbx/drivers/fbxgpio/Makefile
--- linux-5.4.60-fbx/drivers/fbxgpio./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/fbxgpio/Makefile	2021-03-04 13:20:57.760838887 +0100
@@ -0,0 +1,2 @@
+obj-$(CONFIG_FREEBOX_GPIO)	+= fbxgpio_core.o
+obj-$(CONFIG_FREEBOX_GPIO_DT)	+= fbxgpio_dt.o
diff -Nruw linux-5.4.60-fbx/drivers/fbxjtag./fbxjtag.c linux-5.4.60-fbx/drivers/fbxjtag/fbxjtag.c
--- linux-5.4.60-fbx/drivers/fbxjtag./fbxjtag.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/fbxjtag/fbxjtag.c	2021-03-04 13:20:57.760838887 +0100
@@ -0,0 +1,1115 @@
+#include <linux/kernel.h>
+#include <linux/err.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/fbxgpio_core.h>
+#include <linux/fbxjtag.h>
+#include <linux/of.h>
+
+#define PFX	"fbxjtag: "
+
+static struct class *fbxjtag_class;
+
+static enum jtag_state jtag_transitions[][2] = {
+	[JTAG_STATE_UNDEF] = { JTAG_STATE_UNDEF , JTAG_STATE_UNDEF },
+	[JTAG_STATE_TEST_LOGIC_RESET] = { JTAG_STATE_RUN_TEST_IDLE , JTAG_STATE_TEST_LOGIC_RESET },
+	[JTAG_STATE_RUN_TEST_IDLE] = { JTAG_STATE_RUN_TEST_IDLE , JTAG_STATE_SELECT_DR },
+
+	[JTAG_STATE_SELECT_DR] = { JTAG_STATE_CAPTURE_DR , JTAG_STATE_SELECT_IR },
+	[JTAG_STATE_CAPTURE_DR] = { JTAG_STATE_SHIFT_DR , JTAG_STATE_EXIT1_DR },
+	[JTAG_STATE_SHIFT_DR] = { JTAG_STATE_SHIFT_DR , JTAG_STATE_EXIT1_DR },
+	[JTAG_STATE_EXIT1_DR] = { JTAG_STATE_PAUSE_DR , JTAG_STATE_UPDATE_DR },
+	[JTAG_STATE_PAUSE_DR] = { JTAG_STATE_PAUSE_DR , JTAG_STATE_EXIT2_DR },
+	[JTAG_STATE_EXIT2_DR] = { JTAG_STATE_SHIFT_DR , JTAG_STATE_UPDATE_DR },
+	[JTAG_STATE_UPDATE_DR] = { JTAG_STATE_RUN_TEST_IDLE , JTAG_STATE_SELECT_DR },
+
+	[JTAG_STATE_SELECT_IR] = { JTAG_STATE_CAPTURE_IR , JTAG_STATE_TEST_LOGIC_RESET },
+	[JTAG_STATE_CAPTURE_IR] = { JTAG_STATE_SHIFT_IR , JTAG_STATE_EXIT1_IR },
+	[JTAG_STATE_SHIFT_IR] = { JTAG_STATE_SHIFT_IR , JTAG_STATE_EXIT1_IR },
+	[JTAG_STATE_EXIT1_IR] = { JTAG_STATE_PAUSE_IR , JTAG_STATE_UPDATE_IR },
+	[JTAG_STATE_PAUSE_IR] = { JTAG_STATE_PAUSE_IR , JTAG_STATE_EXIT2_IR },
+	[JTAG_STATE_EXIT2_IR] = { JTAG_STATE_SHIFT_IR , JTAG_STATE_UPDATE_IR },
+	[JTAG_STATE_UPDATE_IR] = { JTAG_STATE_RUN_TEST_IDLE , JTAG_STATE_SELECT_DR },
+};
+
+
+static char *debug_state_str[] = {
+	[JTAG_STATE_UNDEF] = "undef",
+	[JTAG_STATE_TEST_LOGIC_RESET] = "Test logic reset",
+	[JTAG_STATE_RUN_TEST_IDLE] = "Run test idle",
+	[JTAG_STATE_SELECT_DR] = "Select DR",
+	[JTAG_STATE_CAPTURE_DR] = "Capture DR",
+	[JTAG_STATE_SHIFT_DR] = "Shift DR",
+	[JTAG_STATE_EXIT1_DR] = "Exit 1 DR",
+	[JTAG_STATE_PAUSE_DR] = "Pause DR",
+	[JTAG_STATE_EXIT2_DR] = "Exit 2 DR",
+	[JTAG_STATE_UPDATE_DR] = "Update DR",
+	[JTAG_STATE_SELECT_IR] = "Select IR",
+	[JTAG_STATE_CAPTURE_IR] = "Capture IR",
+	[JTAG_STATE_SHIFT_IR] = "Shift IR",
+	[JTAG_STATE_EXIT1_IR] = "Exit 1 IR",
+	[JTAG_STATE_PAUSE_IR] = "Pause IR",
+	[JTAG_STATE_EXIT2_IR] = "Exit 2 IR",
+	[JTAG_STATE_UPDATE_IR] = "Update IR",
+};
+
+static char *jtag_state_str(enum jtag_state state) {
+	if (state < JTAG_STATE_UNDEF || state >= JTAG_STATE_MAX)
+		return "invalid";
+
+	return debug_state_str[state];
+}
+
+#define DEBUG_STATE(jtag) printk(KERN_INFO PFX "new state: %s\n", jtag_state_str((jtag)->state))
+
+static void set_tms(struct fbxjtag_data *jtag, int val)
+{
+	struct fbxgpio_pin *tms;
+
+	tms = jtag->gpios.tms;
+	tms->ops->set_dataout(tms->pin_num, val);
+	jtag->last_tms_dataout = val;
+}
+
+static void set_tdi(struct fbxjtag_data *jtag, int val)
+{
+	struct fbxgpio_pin *tdi;
+
+	tdi = jtag->gpios.tdi;
+	tdi->ops->set_dataout(tdi->pin_num, val);
+}
+
+static int get_tdo(struct fbxjtag_data *jtag)
+{
+	struct fbxgpio_pin *tdo;
+
+	tdo = jtag->gpios.tdo;
+	return tdo->ops->get_datain(tdo->pin_num);
+}
+
+static void tck_pulse(struct fbxjtag_data *jtag)
+{
+	struct fbxgpio_pin *tck;
+	struct fbxgpio_pin *tms;
+	int tms_val, tdo_val;
+
+	tms = jtag->gpios.tms;
+	tck = jtag->gpios.tck;
+
+
+	// rising edge
+	tck->ops->set_dataout(tck->pin_num, 1);
+	ndelay(jtag->clock_delay);
+
+	// update state
+	tms_val = jtag->last_tms_dataout;
+
+	// read tdo
+	if (jtag->state == JTAG_STATE_SHIFT_DR) {
+		tdo_val = get_tdo(jtag);
+		jtag->dr_buf[jtag->dr_w] = tdo_val + '0';
+		jtag->dr_w = (jtag->dr_w + 1) % JTAG_BUF_SIZE;
+	}
+
+	if (jtag->state == JTAG_STATE_UNDEF) {
+		if (tms_val == 1) {
+			jtag->nb_reset++;
+			if (jtag->nb_reset >= 5) {
+				jtag->state = JTAG_STATE_TEST_LOGIC_RESET;
+			}
+		} else {
+			jtag->nb_reset = 0;
+		}
+	} else {
+		jtag->state = jtag_transitions[jtag->state][tms_val];
+	}
+
+	// falling edge
+	tck->ops->set_dataout(tck->pin_num, 0);
+	ndelay(jtag->clock_delay);
+}
+
+static void set_tms_pulse(struct fbxjtag_data *jtag, int tms)
+{
+	set_tms(jtag, tms);
+	tck_pulse(jtag);
+}
+
+static void set_tms_tdi_pulse(struct fbxjtag_data *jtag, int tms, int tdi)
+{
+	set_tms(jtag, tms);
+	set_tdi(jtag, tdi);
+	tck_pulse(jtag);
+}
+
+static void reset_state(struct fbxjtag_data *jtag)
+{
+	int i;
+
+	for (i = 0; i < JTAG_RESET_STEPS; ++i)
+		set_tms_pulse(jtag, 1);
+	jtag->state = JTAG_STATE_TEST_LOGIC_RESET;
+}
+
+static void goto_sub_state(struct fbxjtag_data *jtag,
+		enum jtag_state new_state) {
+
+	enum jtag_sub_state cur_sub = jtag->state & JTAG_SUB_STATE_MASK;
+	enum jtag_sub_state new_sub = new_state & JTAG_SUB_STATE_MASK;
+
+	switch(cur_sub) {
+	case JTAG_SUB_STATE_SELECT:
+		switch(new_sub) {
+		case JTAG_SUB_STATE_CAPTURE:
+			set_tms_pulse(jtag, 0);
+			// now in CAPTURE
+			break;
+		case JTAG_SUB_STATE_SHIFT:
+			set_tms_pulse(jtag, 0);
+			// now in CAPTURE
+			set_tms_pulse(jtag, 0);
+			// now in SHIFT
+			break;
+		case JTAG_SUB_STATE_EXIT1:
+			set_tms_pulse(jtag, 0);
+			// now in CAPTURE
+			set_tms_pulse(jtag, 1);
+			// now in EXIT1
+			break;
+		case JTAG_SUB_STATE_PAUSE:
+			set_tms_pulse(jtag, 0);
+			// now in CAPTURE
+			set_tms_pulse(jtag, 1);
+			// now in EXIT1
+			set_tms_pulse(jtag, 0);
+			// now in PAUSE
+			break;
+		case JTAG_SUB_STATE_EXIT2:
+			set_tms_pulse(jtag, 0);
+			// now in CAPTURE
+			set_tms_pulse(jtag, 1);
+			// now in EXIT1
+			set_tms_pulse(jtag, 0);
+			// now in PAUSE
+			set_tms_pulse(jtag, 1);
+			// now in EXIT2
+			break;
+		case JTAG_SUB_STATE_UPDATE:
+			set_tms_pulse(jtag, 0);
+			// now in CAPTURE
+			set_tms_pulse(jtag, 1);
+			// now in EXIT1
+			set_tms_pulse(jtag, 1);
+			// now in UPDATE
+			break;
+		case JTAG_SUB_STATE_SELECT:
+		default:
+			// stay in SELECT
+			break;
+		}
+		break;
+
+	case JTAG_SUB_STATE_CAPTURE:
+	case JTAG_SUB_STATE_SHIFT:
+		switch(new_sub) {
+		case JTAG_SUB_STATE_SELECT:
+			set_tms_pulse(jtag, 1);
+			// now in EXIT1
+			set_tms_pulse(jtag, 1);
+			// now in UPDATE
+			set_tms_pulse(jtag, 1);
+			// now in SELECT-DR
+			if (JTAG_STATE_IN_IR(new_state)) {
+				// on more 1 to go to select IR
+				set_tms_pulse(jtag, 1);
+				// now in SELECT-IR
+			}
+			break;
+		case JTAG_SUB_STATE_SHIFT:
+			set_tms_pulse(jtag, 0);
+			// now in SHIFT
+			break;
+		case JTAG_SUB_STATE_EXIT1:
+			set_tms_pulse(jtag, 1);
+			// now in EXIT1
+			break;
+		case JTAG_SUB_STATE_PAUSE:
+			set_tms_pulse(jtag, 1);
+			// now in EXIT1
+			set_tms_pulse(jtag, 0);
+			// now in PAUSE
+			break;
+		case JTAG_SUB_STATE_EXIT2:
+			set_tms_pulse(jtag, 1);
+			// now in EXIT1
+			set_tms_pulse(jtag, 0);
+			// now in PAUSE
+			set_tms_pulse(jtag, 1);
+			// now in EXIT2
+			break;
+		case JTAG_SUB_STATE_UPDATE:
+			set_tms_pulse(jtag, 1);
+			// now in EXIT1
+			set_tms_pulse(jtag, 1);
+			// now in UPDATE
+			break;
+		case JTAG_SUB_STATE_CAPTURE:
+			if (cur_sub == JTAG_SUB_STATE_SHIFT) {
+				goto_sub_state(jtag,
+					(new_state & JTAG_STATE_MASK) | JTAG_SUB_STATE_SELECT);
+				goto_sub_state(jtag, new_state);
+			}
+			break;
+		default:
+			// stay in current state
+			break;
+		}
+		break;
+
+	case JTAG_SUB_STATE_EXIT1:
+		switch(new_sub) {
+		case JTAG_SUB_STATE_SELECT:
+			set_tms_pulse(jtag, 1);
+			// now in UPDATE
+			set_tms_pulse(jtag, 1);
+			// now in SELECT-DR
+			if (JTAG_STATE_IN_IR(new_state)) {
+				// on more 1 to go to select IR
+				set_tms_pulse(jtag, 1);
+				// now in SELECT-IR
+			}
+			break;
+		case JTAG_SUB_STATE_SHIFT:
+			set_tms_pulse(jtag, 0);
+			// now in PAUSE
+			set_tms_pulse(jtag, 1);
+			// now in EXIT2
+			set_tms_pulse(jtag, 0);
+			// now in SHIFT
+			break;
+		case JTAG_SUB_STATE_PAUSE:
+			set_tms_pulse(jtag, 0);
+			// now in PAUSE
+			break;
+		case JTAG_SUB_STATE_EXIT2:
+			set_tms_pulse(jtag, 0);
+			// now in PAUSE
+			set_tms_pulse(jtag, 1);
+			// now in EXIT2
+			break;
+		case JTAG_SUB_STATE_UPDATE:
+			set_tms_pulse(jtag, 1);
+			// now in UPDATE
+			break;
+		case JTAG_SUB_STATE_CAPTURE:
+			goto_sub_state(jtag,
+				(new_state & JTAG_STATE_MASK) | JTAG_SUB_STATE_SELECT);
+			goto_sub_state(jtag, new_state);
+			break;
+		default:
+			// stay in current state
+			break;
+		}
+		break;
+
+	case JTAG_SUB_STATE_PAUSE:
+		switch(new_sub) {
+		case JTAG_SUB_STATE_SELECT:
+			set_tms_pulse(jtag, 1);
+			// now in EXIT2
+			set_tms_pulse(jtag, 1);
+			// now in UPDATE
+			set_tms_pulse(jtag, 1);
+			// now in SELECT-DR
+			if (JTAG_STATE_IN_IR(new_state)) {
+				// on more 1 to go to select IR
+				set_tms_pulse(jtag, 1);
+				// now in SELECT-IR
+			}
+			break;
+		case JTAG_SUB_STATE_SHIFT:
+			set_tms_pulse(jtag, 1);
+			// now in EXIT2
+			set_tms_pulse(jtag, 0);
+			// now in SHIFT
+			break;
+		case JTAG_SUB_STATE_PAUSE:
+			set_tms_pulse(jtag, 0);
+			// now in PAUSE
+			break;
+		case JTAG_SUB_STATE_EXIT2:
+			set_tms_pulse(jtag, 1);
+			// now in EXIT2
+			break;
+		case JTAG_SUB_STATE_UPDATE:
+			set_tms_pulse(jtag, 1);
+			// now in EXIT2
+			set_tms_pulse(jtag, 1);
+			// now in UPDATE
+			break;
+		case JTAG_SUB_STATE_CAPTURE:
+			goto_sub_state(jtag,
+				(new_state & JTAG_STATE_MASK) | JTAG_SUB_STATE_SELECT);
+			goto_sub_state(jtag, new_state);
+			break;
+		default:
+			// stay in current state
+			break;
+		}
+		break;
+
+	case JTAG_SUB_STATE_EXIT2:
+		switch(new_sub) {
+		case JTAG_SUB_STATE_SELECT:
+			set_tms_pulse(jtag, 1);
+			// now in UPDATE
+			set_tms_pulse(jtag, 1);
+			// now in SELECT-DR
+			if (JTAG_STATE_IN_IR(new_state)) {
+				// on more 1 to go to select IR
+				set_tms_pulse(jtag, 1);
+				// now in SELECT-IR
+			}
+			break;
+		case JTAG_SUB_STATE_SHIFT:
+			set_tms_pulse(jtag, 0);
+			// now in SHIFT
+			break;
+		case JTAG_SUB_STATE_PAUSE:
+			set_tms_pulse(jtag, 0);
+			// now in SHIFT
+			set_tms_pulse(jtag, 1);
+			// now in EXIT 1
+			set_tms_pulse(jtag, 0);
+			// now in PAUSE
+			break;
+		case JTAG_SUB_STATE_UPDATE:
+			set_tms_pulse(jtag, 1);
+			// now in UPDATE
+			break;
+		case JTAG_SUB_STATE_CAPTURE:
+			goto_sub_state(jtag,
+				(new_state & JTAG_STATE_MASK) | JTAG_SUB_STATE_SELECT);
+			goto_sub_state(jtag, new_state);
+			break;
+		default:
+			// stay in current state
+			break;
+		}
+		break;
+
+	case JTAG_SUB_STATE_UPDATE:
+		switch(new_sub) {
+		case JTAG_SUB_STATE_SELECT:
+			set_tms_pulse(jtag, 1);
+			// now in SELECT-DR
+			if (JTAG_STATE_IN_IR(new_state)) {
+				// on more 1 to go to select IR
+				set_tms_pulse(jtag, 1);
+				// now in SELECT-IR
+			}
+			break;
+		case JTAG_SUB_STATE_UPDATE:
+			// stay in current state
+			break;
+		default:
+			goto_sub_state(jtag,
+				(new_state & JTAG_STATE_MASK) | JTAG_SUB_STATE_SELECT);
+			goto_sub_state(jtag, new_state);
+			break;
+		}
+		break;
+
+	default:
+		BUG();
+		break;
+	}
+}
+
+static void goto_state(struct fbxjtag_data *jtag, enum jtag_state new_state) {
+
+	enum jtag_main_state main_state, cur_main_state;
+
+	if (jtag->state == JTAG_STATE_UNDEF) {
+		reset_state(jtag);
+	}
+
+	main_state = new_state & JTAG_STATE_MASK;
+	cur_main_state = jtag->state & JTAG_STATE_MASK;
+
+	if (main_state != cur_main_state) {
+		switch(cur_main_state) {
+		case JTAG_STATE_DR_MASK:
+		case JTAG_STATE_IR_MASK:
+			goto_state(jtag, (jtag->state & JTAG_STATE_MASK) | JTAG_SUB_STATE_UPDATE);
+			// now in UPDATE_DR or UPDATE_IR
+
+			switch(main_state) {
+			case JTAG_STATE_TEST_MASK:
+				set_tms_pulse(jtag, 1);
+				// now in SELECT_DR
+				set_tms_pulse(jtag, 1);
+				// now in SELECT_IR
+				set_tms_pulse(jtag, 1);
+				// now in TEST_LOGIC_RESET
+				break;
+
+			case JTAG_STATE_RUN_MASK:
+				set_tms_pulse(jtag, 0);
+				// now in RUN_TEST_IDLE
+				break;
+
+			case JTAG_STATE_IR_MASK:
+				set_tms_pulse(jtag, 1);
+				// now in SELECT_DR
+				set_tms_pulse(jtag, 1);
+				// now in SELECT_IR
+				break;
+
+			case JTAG_STATE_DR_MASK:
+				set_tms_pulse(jtag, 1);
+				// now in SELECT_DR
+				break;
+			}
+			break;
+
+		case JTAG_STATE_TEST_MASK:
+			switch(main_state) {
+			case JTAG_STATE_RUN_MASK:
+				set_tms_pulse(jtag, 0);
+				// now in RUN_TEST_IDLE
+				break;
+
+			case JTAG_STATE_DR_MASK:
+				set_tms_pulse(jtag, 0);
+				// now in RUN_TEST_IDLE
+				set_tms_pulse(jtag, 1);
+				// now in SELECT_DR
+				break;
+
+			case JTAG_STATE_IR_MASK:
+				set_tms_pulse(jtag, 0);
+				// now in RUN_TEST_IDLE
+				set_tms_pulse(jtag, 1);
+				// now in SELECT_DR
+				set_tms_pulse(jtag, 1);
+				// now in SELECT_IR
+				break;
+			default:
+				BUG();
+				break;
+			}
+			break;
+
+		case JTAG_STATE_RUN_MASK:
+			switch(main_state) {
+			case JTAG_STATE_DR_MASK:
+				set_tms_pulse(jtag, 1);
+				// now in SELECT_DR
+				break;
+
+			case JTAG_STATE_IR_MASK:
+				set_tms_pulse(jtag, 1);
+				// now in SELECT_DR
+				set_tms_pulse(jtag, 1);
+				// now in SELECT_IR
+				break;
+
+			case JTAG_STATE_TEST_MASK:
+				set_tms_pulse(jtag, 1);
+				// now in SELECT_DR
+				set_tms_pulse(jtag, 1);
+				// now in SELECT_IR
+				set_tms_pulse(jtag, 1);
+				// now in TEST_LOGIC_RESET
+				break;
+			default:
+				printk(KERN_ERR PFX "JTAG TRANSITION ERROR :'( %s:%d", __FILE__, __LINE__);
+				BUG();
+				break;
+			}
+			break;
+
+		default:
+			printk(KERN_ERR PFX "JTAG TRANSITION ERROR :'( %s:%d",  __FILE__, __LINE__);
+			BUG();
+			break;
+		}
+
+		if ((jtag->state & JTAG_STATE_MASK) != main_state) {
+			printk(KERN_ERR PFX "JTAG error : state %x != %x",
+					(jtag->state & JTAG_STATE_MASK),
+					main_state);
+		}
+		BUG_ON((jtag->state & JTAG_STATE_MASK) != main_state);
+
+		if (new_state == JTAG_STATE_TEST_LOGIC_RESET
+				|| new_state == JTAG_STATE_RUN_TEST_IDLE)
+			return; // we're done
+	}
+
+	// now main_state == cur_main_state
+
+	switch(new_state) {
+	case JTAG_STATE_TEST_LOGIC_RESET:
+		// stay in TEST_LOGIC_RESET
+		set_tms_pulse(jtag, 1);
+		return;
+	case JTAG_STATE_RUN_TEST_IDLE:
+		// stay in JTAG_STATE_RUN_TEST_IDLE
+		set_tms_pulse(jtag, 0);
+		return;
+	default:
+		break;
+	}
+
+	// move inside IR or DR
+	goto_sub_state(jtag, new_state);
+	if (jtag->state != new_state) {
+		printk(KERN_ERR PFX "JTAG Error: state is %s instead of %s",
+				jtag_state_str(jtag->state),
+				jtag_state_str(new_state));
+	}
+	BUG_ON(jtag->state != new_state);
+}
+
+static ssize_t show_state(struct device *dev, struct device_attribute *attr,
+				char *buf)
+{
+	struct fbxjtag_data *jtag;
+	jtag = dev_get_drvdata(dev);
+	return sprintf(buf, "%s\n", jtag_state_str(jtag->state));
+}
+
+static ssize_t write_state(struct device *dev, struct device_attribute *attr,
+				 const char *buf, size_t size)
+{
+	struct fbxjtag_data *jtag;
+	unsigned long new_state = simple_strtoul(buf, NULL, 10);
+	jtag = dev_get_drvdata(dev);
+
+	switch(new_state) {
+	case JTAG_STATE_TEST_LOGIC_RESET:
+	case JTAG_STATE_RUN_TEST_IDLE:
+	case JTAG_STATE_SELECT_DR:
+	case JTAG_STATE_CAPTURE_DR:
+	case JTAG_STATE_SHIFT_DR:
+	case JTAG_STATE_EXIT1_DR:
+	case JTAG_STATE_PAUSE_DR:
+	case JTAG_STATE_EXIT2_DR:
+	case JTAG_STATE_UPDATE_DR:
+	case JTAG_STATE_SELECT_IR:
+	case JTAG_STATE_CAPTURE_IR:
+	case JTAG_STATE_SHIFT_IR:
+	case JTAG_STATE_EXIT1_IR:
+	case JTAG_STATE_PAUSE_IR:
+	case JTAG_STATE_EXIT2_IR:
+	case JTAG_STATE_UPDATE_IR:
+		goto_state(jtag, new_state);
+		return size;
+
+	default:
+		printk(KERN_ERR PFX "Trying to set an invalid state: %lx\n", new_state);
+		return -EINVAL;
+	}
+}
+
+
+static ssize_t show_tck(struct device *dev, struct device_attribute *attr,
+			char *buf)
+{
+	struct fbxjtag_data *jtag;
+
+	jtag = dev_get_drvdata(dev);
+	return sprintf(buf, "%i\n", jtag->gpios.tck->pin_num);
+}
+
+static ssize_t show_tms(struct device *dev, struct device_attribute *attr,
+			char *buf)
+{
+	struct fbxjtag_data *jtag;
+
+	jtag = dev_get_drvdata(dev);
+	return sprintf(buf, "%i\n", jtag->gpios.tms->pin_num);
+}
+
+static ssize_t show_tdi(struct device *dev, struct device_attribute *attr,
+			char *buf)
+{
+	struct fbxjtag_data *jtag;
+
+	jtag = dev_get_drvdata(dev);
+	return sprintf(buf, "%i\n", jtag->gpios.tdi->pin_num);
+}
+
+static ssize_t show_tdo(struct device *dev, struct device_attribute *attr,
+			char *buf)
+{
+	struct fbxjtag_data *jtag;
+
+	jtag = dev_get_drvdata(dev);
+	return sprintf(buf, "%i\n", jtag->gpios.tdo->pin_num);
+}
+
+static ssize_t write_reset(struct device *dev, struct device_attribute *attr,
+			   const char *buf, size_t size)
+{
+	struct fbxjtag_data *jtag;
+
+	jtag = dev_get_drvdata(dev);
+	reset_state(jtag);
+
+	return size;
+}
+
+static ssize_t read_data(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct fbxjtag_data *jtag;
+	size_t len;
+
+	jtag = dev_get_drvdata(dev);
+	len = jtag->dr_w - jtag->dr_r;
+	if (len < 0)
+		len += JTAG_BUF_SIZE;
+
+	memcpy(buf, jtag->dr_buf, len);
+	buf[len] = '\0';
+	return len + 1;
+}
+
+static ssize_t write_data(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf, size_t size)
+{
+	struct fbxjtag_data *jtag;
+	size_t real_size = 0;
+	int i;
+
+	if (!size)
+		return size;
+
+	for (i = 0; i < size; ++i)
+		if ((buf[i] == '0') || (buf[i] == '1'))
+			real_size++;
+
+	if (!real_size)
+		return size;
+
+	jtag = dev_get_drvdata(dev);
+
+	// reset read buffer
+	jtag->dr_r = 0;
+	jtag->dr_w = 0;
+	goto_state(jtag, JTAG_STATE_SHIFT_DR);
+	for (i = 0; real_size > 0; ++i) {
+		if ((buf[i] == '0') || (buf[i] == '1')) {
+			if (real_size-- > 1)
+				/* stay in shift */
+				set_tms_tdi_pulse(jtag, 0, buf[i] - '0');
+			else
+				/* exit */
+				set_tms_tdi_pulse(jtag, 1, buf[i] - '0');
+		}
+	}
+	BUG_ON(jtag->state != JTAG_STATE_EXIT1_DR);
+	goto_state(jtag, JTAG_STATE_UPDATE_DR);
+
+	return size;
+}
+
+static ssize_t read_instruction(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct fbxjtag_data *jtag;
+	size_t len;
+
+	jtag = dev_get_drvdata(dev);
+	len = jtag->ir_w - jtag->ir_r;
+	if (len < 0)
+		len += JTAG_BUF_SIZE;
+
+	memcpy(buf, jtag->ir_buf, len);
+	buf[len] = '\0';
+	return len + 1;
+}
+
+static ssize_t write_instruction(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf, size_t size)
+{
+	struct fbxjtag_data *jtag;
+	size_t real_size = 0;
+	int i;
+
+	if (!size)
+		return size;
+
+	for (i = 0; i < size; ++i)
+		if ((buf[i] == '0') || (buf[i] == '1'))
+			real_size++;
+
+	if (!real_size)
+		return size;
+
+	jtag = dev_get_drvdata(dev);
+
+	// reset read buffer
+	jtag->ir_r = 0;
+	jtag->ir_w = 0;
+	goto_state(jtag, JTAG_STATE_SHIFT_IR);
+	for (i = 0; real_size > 0; ++i) {
+		if ((buf[i] == '0') || (buf[i] == '1')) {
+			if (real_size-- > 1)
+				/* stay in shift */
+				set_tms_tdi_pulse(jtag, 0, buf[i] - '0');
+			else
+				/* exit */
+				set_tms_tdi_pulse(jtag, 1, buf[i] - '0');
+		}
+	}
+	BUG_ON(jtag->state != JTAG_STATE_EXIT1_IR);
+	goto_state(jtag, JTAG_STATE_UPDATE_IR);
+
+	return size;
+}
+
+static ssize_t show_clock_delay(struct device *dev, struct device_attribute *attr,
+				char *buf)
+{
+	struct fbxjtag_data *jtag;
+
+	jtag = dev_get_drvdata(dev);
+
+	return sprintf(buf, "%u\n", jtag->clock_delay);
+}
+
+static ssize_t write_clock_delay(struct device *dev, struct device_attribute *attr,
+				 const char *buf, size_t size)
+{
+	struct fbxjtag_data *jtag;
+
+	jtag = dev_get_drvdata(dev);
+
+	jtag->clock_delay = simple_strtoul(buf, NULL, 10);
+
+	return size;
+}
+
+static ssize_t show_wait_tms(struct device *dev, struct device_attribute *attr,
+			     char *buf)
+{
+	struct fbxjtag_data *jtag;
+
+	jtag = dev_get_drvdata(dev);
+
+	return sprintf(buf, "%u\n", jtag->wait_tms);
+}
+
+static ssize_t write_wait_tms(struct device *dev, struct device_attribute *attr,
+			      const char *buf, size_t size)
+{
+	struct fbxjtag_data *jtag;
+
+	if (!size)
+		return size;
+
+	jtag = dev_get_drvdata(dev);
+
+	switch (*buf) {
+	case '0':
+		jtag->wait_tms = 0;
+		break ;
+	case '1':
+		jtag->wait_tms = 1;
+		break ;
+	default:
+		return -EINVAL;
+	}
+
+	return size;
+}
+
+static ssize_t write_wait_time(struct device *dev, struct device_attribute *attr,
+			       const char *buf, size_t size)
+{
+	struct fbxjtag_data *jtag;
+	int i;
+	unsigned long val;
+
+	val = simple_strtoul(buf, NULL, 10);
+
+	if (!val)
+		return -EINVAL;
+
+	jtag = dev_get_drvdata(dev);
+
+	for (i = 0; i < val; ++i) {
+		set_tms_pulse(jtag, jtag->wait_tms);
+	}
+
+	return size;
+}
+
+static ssize_t show_data_read_size(struct device *dev,
+				   struct device_attribute *attr, char *buf)
+{
+	struct fbxjtag_data *jtag;
+
+	jtag = dev_get_drvdata(dev);
+
+	return sprintf(buf, "%u\n", jtag->data_read_size);
+}
+
+static ssize_t write_data_read_size(struct device *dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t size)
+{
+	struct fbxjtag_data *jtag;
+	unsigned long val;
+
+	val = simple_strtoul(buf, NULL, 10);
+
+	if (!val)
+		return -EINVAL;
+
+	jtag = dev_get_drvdata(dev);
+	jtag->data_read_size = val;
+
+	return size;
+}
+
+static ssize_t show_instruction_read_size(struct device *dev,
+					  struct device_attribute *attr,
+					  char *buf)
+{
+	struct fbxjtag_data *jtag;
+
+	jtag = dev_get_drvdata(dev);
+
+	return sprintf(buf, "%u\n", jtag->instruction_read_size);
+}
+
+static ssize_t write_instruction_read_size(struct device *dev,
+					   struct device_attribute *attr,
+					   const char *buf, size_t size)
+{
+	struct fbxjtag_data *jtag;
+	unsigned long val;
+
+	val = simple_strtoul(buf, NULL, 10);
+
+	if (!val)
+		return -EINVAL;
+
+	jtag = dev_get_drvdata(dev);
+	jtag->instruction_read_size = val;
+
+	return size;
+}
+
+static struct device_attribute jtag_attributes[] = {
+	__ATTR(tck, 0400, show_tck, NULL),
+	__ATTR(tms, 0400, show_tms, NULL),
+	__ATTR(tdi, 0400, show_tdi, NULL),
+	__ATTR(tdo, 0400, show_tdo, NULL),
+	__ATTR(clock_delay, 0600, show_clock_delay, write_clock_delay),
+	__ATTR(wait_tms, 0600, show_wait_tms, write_wait_tms),
+	__ATTR(wait_time, 0200, NULL, write_wait_time),
+	__ATTR(data_read_size, 0600, show_data_read_size, write_data_read_size),
+	__ATTR(instruction_read_size, 0600, show_instruction_read_size,
+	       write_instruction_read_size),
+	__ATTR(data, 0600, read_data, write_data),
+	__ATTR(instruction, 0600, read_instruction, write_instruction),
+	__ATTR(reset, 0200, NULL, write_reset),
+	__ATTR(state, 0600, show_state, write_state),
+};
+
+static int fbxjtag_register_jtag(struct platform_device *ppdev,
+				 struct fbxjtag_data *jtag)
+{
+	struct device *dev;
+	int i, ret;
+
+	printk(KERN_INFO PFX "registering jtag %s\n", jtag->name);
+
+	if (!jtag->gpios.tck || !jtag->gpios.tms ||
+	    !jtag->gpios.tdi || !jtag->gpios.tdo) {
+		printk(KERN_ERR PFX "a gpio is not set\n");
+		return -ENODEV;
+	}
+
+	dev = device_create(fbxjtag_class, &ppdev->dev, 0, jtag,
+			    "%s", jtag->name);
+
+	if (IS_ERR(dev))
+		return PTR_ERR(dev);
+
+	for (i = 0; i < ARRAY_SIZE(jtag_attributes); ++i) {
+		ret = device_create_file(dev, &jtag_attributes[i]);
+		if (ret)
+			goto err_out;
+	}
+
+	jtag->dev = dev;
+	jtag->nb_reset = 0;
+	jtag->state = JTAG_STATE_UNDEF;
+	jtag->dr_r = 0;
+	jtag->dr_w = 0;
+	jtag->ir_r = 0;
+	jtag->ir_w = 0;
+	return 0;
+
+err_out:
+	for (; i >= 0; --i)
+		device_remove_file(dev, &jtag_attributes[i]);
+	device_unregister(dev);
+	return ret;
+}
+
+static void fbxjtag_unregister_jtag(struct fbxjtag_data *jtag)
+{
+	struct device *dev;
+	int i;
+
+	printk(KERN_INFO PFX "unregistering jtag %s\n", jtag->name);
+	dev = jtag->dev;
+	jtag->dev = NULL;
+
+	for (i = 0; i < ARRAY_SIZE(jtag_attributes); ++i)
+		device_remove_file(dev, &jtag_attributes[i]);
+	device_unregister(dev);
+}
+
+static int fbxjtag_from_of(struct fbxjtag_data *jtag,
+			    struct platform_device *pdev)
+{
+	int error;
+
+	error = of_property_read_string(pdev->dev.of_node, "name",
+					&jtag->name);
+	if (error)
+		return error;
+
+	error = of_property_read_u32(pdev->dev.of_node, "clock-delay",
+				     &jtag->clock_delay);
+	if (error)
+		return error;
+
+	error = of_property_read_u32(pdev->dev.of_node, "wait-tms",
+				     &jtag->wait_tms);
+	if (error)
+		return error;
+
+	error = of_property_read_u32(pdev->dev.of_node, "data-read-size",
+				     &jtag->data_read_size);
+	if (error)
+		return error;
+
+	error = of_property_read_u32(pdev->dev.of_node, "inst-read-size",
+				     &jtag->instruction_read_size);
+	if (error)
+		return error;
+
+	jtag->gpios.tck = fbxgpio_of_get(pdev->dev.of_node, "fbxgpio-tck", 0);
+	if (IS_ERR(jtag->gpios.tck))
+		return PTR_ERR(jtag->gpios.tck);
+
+	jtag->gpios.tdi = fbxgpio_of_get(pdev->dev.of_node, "fbxgpio-tdi", 0);
+	if (IS_ERR(jtag->gpios.tdi))
+		return PTR_ERR(jtag->gpios.tdi);
+
+	jtag->gpios.tdo = fbxgpio_of_get(pdev->dev.of_node, "fbxgpio-tdo", 0);
+	if (IS_ERR(jtag->gpios.tdo))
+		return PTR_ERR(jtag->gpios.tdo);
+
+	jtag->gpios.tms = fbxgpio_of_get(pdev->dev.of_node, "fbxgpio-tms", 0);
+	if (IS_ERR(jtag->gpios.tms))
+		return PTR_ERR(jtag->gpios.tms);
+
+	return 0;
+}
+
+static int fbxjtag_platform_probe(struct platform_device *pdev)
+{
+	struct fbxjtag_data *jtag;
+
+	jtag = pdev->dev.platform_data;
+	if (!jtag) {
+		int error;
+		jtag = devm_kzalloc(&pdev->dev, sizeof (*jtag), GFP_KERNEL);
+		if (!jtag)
+			return -ENOMEM;
+		error = fbxjtag_from_of(jtag, pdev);
+		if (error)
+			return error;
+
+		dev_set_drvdata(&pdev->dev, jtag);
+	}
+	if (jtag && jtag->name)
+		return fbxjtag_register_jtag(pdev, jtag);
+
+	return -EINVAL;
+}
+
+static int fbxjtag_platform_remove(struct platform_device *pdev)
+{
+	struct fbxjtag_data *jtag;
+
+	jtag = pdev->dev.platform_data;
+	if (!jtag)
+		jtag = dev_get_drvdata(&pdev->dev);
+	if (jtag->name)
+		fbxjtag_unregister_jtag(jtag);
+
+	return 0;
+}
+
+static const struct of_device_id fbxjtag_of_match_table[] = {
+	{ .compatible = "fbx,fbxjtag" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, fbxjtag_of_match_table);
+
+static struct platform_driver fbxjtag_platform_driver =
+{
+	.probe	= fbxjtag_platform_probe,
+	.remove	= fbxjtag_platform_remove,
+	.driver = {
+		.name	= "fbxjtag",
+		.of_match_table = fbxjtag_of_match_table,
+	},
+};
+
+static int __init fbxjtag_init(void)
+{
+	int ret;
+
+	fbxjtag_class = class_create(THIS_MODULE, "fbxjtag");
+	if (IS_ERR(fbxjtag_class))
+		return PTR_ERR(fbxjtag_class);
+
+	ret = platform_driver_register(&fbxjtag_platform_driver);
+	if (ret) {
+		printk(KERN_ERR PFX "unable to register fbxjtag driver.\n");
+		class_destroy(fbxjtag_class);
+	}
+
+	return ret;
+}
+
+static void __exit fbxjtag_exit(void)
+{
+	printk(KERN_DEBUG PFX "exit fbxjtag\n");
+	platform_driver_unregister(&fbxjtag_platform_driver);
+	class_destroy(fbxjtag_class);
+}
+
+module_init(fbxjtag_init);
+module_exit(fbxjtag_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Arnaud de Turckheim <adeturckheim@freebox.fr");
+
diff -Nruw linux-5.4.60-fbx/drivers/fbxjtag./Kconfig linux-5.4.60-fbx/drivers/fbxjtag/Kconfig
--- linux-5.4.60-fbx/drivers/fbxjtag./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/fbxjtag/Kconfig	2021-03-04 13:20:57.760838887 +0100
@@ -0,0 +1,3 @@
+config FREEBOX_JTAG
+	tristate "Freebox JTAG control interface"
+	default n
diff -Nruw linux-5.4.60-fbx/drivers/fbxjtag./Makefile linux-5.4.60-fbx/drivers/fbxjtag/Makefile
--- linux-5.4.60-fbx/drivers/fbxjtag./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/fbxjtag/Makefile	2021-03-04 13:20:57.760838887 +0100
@@ -0,0 +1 @@
+obj-$(CONFIG_FREEBOX_JTAG)	+= fbxjtag.o
diff -Nruw linux-5.4.60-fbx/drivers/fbxprocfs./fbxprocfs.c linux-5.4.60-fbx/drivers/fbxprocfs/fbxprocfs.c
--- linux-5.4.60-fbx/drivers/fbxprocfs./fbxprocfs.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/fbxprocfs/fbxprocfs.c	2021-03-04 13:20:57.760838887 +0100
@@ -0,0 +1,299 @@
+/*
+ * Freebox ProcFs interface
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/proc_fs.h>
+#include <linux/list.h>
+#include <linux/slab.h>
+#include <linux/seq_file.h>
+#include <linux/uaccess.h>
+#include <linux/sizes.h>
+
+#include <linux/fbxprocfs.h>
+
+#define PFX	"fbxprocfs: "
+
+
+static struct list_head clients;
+static struct mutex clients_mutex;
+
+static struct proc_dir_entry *root;
+
+/*
+ * register  a  fbxprocfs client  with  given  dirname, caller  should
+ * consider returned struct opaque
+ */
+struct fbxprocfs_client *fbxprocfs_add_client(const char *dirname,
+					      struct module *owner)
+{
+	struct fbxprocfs_client *ret, *p;
+
+	ret = NULL;
+	mutex_lock(&clients_mutex);
+
+	/* check for duplicate */
+	list_for_each_entry(p, &clients, list) {
+		if (!strcmp(dirname, p->dirname))
+			goto out;
+	}
+
+	if (!(ret = kmalloc(sizeof (*ret), GFP_KERNEL))) {
+		printk(KERN_ERR PFX "kmalloc failed\n");
+		goto out;
+	}
+
+	/* try to create client directory */
+	if (!(ret->dir = proc_mkdir(dirname, root))) {
+		printk(KERN_ERR PFX "can't create %s dir\n", dirname);
+		kfree(ret);
+		ret = NULL;
+		goto out;
+	}
+
+	atomic_set(&ret->refcount, 1);
+	ret->dirname = dirname;
+	list_add(&ret->list, &clients);
+
+out:
+	mutex_unlock(&clients_mutex);
+	return ret;
+}
+
+/*
+ * unregister  a  fbxprocfs client, make sure usage count is zero
+ */
+int fbxprocfs_remove_client(struct fbxprocfs_client *client)
+{
+	int ret;
+
+	mutex_lock(&clients_mutex);
+
+	ret = 0;
+	if (atomic_read(&client->refcount) > 1) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	remove_proc_entry(client->dirname, root);
+	list_del(&client->list);
+	kfree(client);
+
+out:
+	mutex_unlock(&clients_mutex);
+	return ret;
+}
+
+/*
+ * remove given entries from client directory
+ */
+static int
+__remove_entries(struct fbxprocfs_client *client,
+		 const struct fbxprocfs_desc *ro_desc,
+		 const struct fbxprocfs_desc *rw_desc)
+{
+	int i;
+
+	for (i = 0; ro_desc && ro_desc[i].name; i++) {
+		remove_proc_entry(ro_desc[i].name, client->dir);
+		atomic_dec(&client->refcount);
+	}
+
+	for (i = 0; rw_desc && rw_desc[i].name; i++) {
+		remove_proc_entry(rw_desc[i].name, client->dir);
+		atomic_dec(&client->refcount);
+	}
+
+	return 0;
+}
+
+/*
+ * replacement for NULL rfunc.
+ */
+static int bad_rfunc(struct seq_file *m, void *ptr)
+{
+	return -EACCES;
+}
+
+/*
+ * fbxprocfs write path is now handled by seq_file code. this
+ * simplifies client code greatly.
+ */
+static int fbxprocfs_open(struct inode *inode, struct file *file)
+{
+	const struct fbxprocfs_desc *desc = PDE_DATA(inode);
+
+	return single_open(file, desc->rfunc ? desc->rfunc : bad_rfunc,
+			   (void*)desc->id);
+}
+
+/*
+ * no particular help from kernel in the write path, fetch user buffer
+ * in a kernel buffer and call write func.
+ */
+static ssize_t fbxprocfs_write(struct file *file, const char __user *ubuf,
+			       size_t len, loff_t *off)
+{
+	/*
+	 * get fbxprocfs desc via the proc_dir_entry in file inode
+	 */
+	struct fbxprocfs_desc *d = PDE_DATA(file_inode(file));
+	char *kbuf;
+	int ret;
+
+	/*
+	 * must have a wfunc callback.
+	 */
+	if (!d->wfunc)
+		return -EACCES;
+
+	/*
+	 * allow up to SZ_4K bytes to be written.
+	 */
+	if (len > SZ_4K)
+		return -EOVERFLOW;
+
+	/*
+	 * alloc and fetch kernel buffer containing user data.
+	 */
+	kbuf = kmalloc(SZ_4K, GFP_KERNEL);
+	if (!kbuf)
+		return -ENOMEM;
+
+	ret = -EFAULT;
+	if (copy_from_user(kbuf, ubuf, len))
+		goto kfree;
+
+	ret = d->wfunc(file, kbuf, len, (void*)d->id);
+
+kfree:
+	kfree(kbuf);
+	return ret;
+}
+
+/*
+ * fbxprocfs file operations, read stuff is handled by seq_file code.
+ */
+static const struct file_operations fbxprocfs_fops = {
+	.open		= fbxprocfs_open,
+	.llseek		= seq_lseek,
+	.read		= seq_read,
+	.release	= single_release,
+	.write		= fbxprocfs_write,
+};
+
+/*
+ * replaces create_proc_read_entry removed in latest kernels.
+ */
+static struct proc_dir_entry *__create_proc_read_entry(
+				       const struct fbxprocfs_desc *desc,
+				       struct proc_dir_entry *base)
+{
+	return proc_create_data(desc->name, 0, base, &fbxprocfs_fops,
+				(void*)desc);
+}
+
+/*
+ * replaces create_proc_entry removed in latest kernels.
+ */
+static struct proc_dir_entry *__create_proc_entry(
+					const struct fbxprocfs_desc *desc,
+					struct proc_dir_entry *base)
+{
+	return proc_create_data(desc->name, S_IFREG | S_IWUSR | S_IRUGO,
+				base, &fbxprocfs_fops, (void*)desc);
+}
+
+/*
+ * create given entries in client directory
+ */
+static int
+__create_entries(struct fbxprocfs_client *client,
+		 const struct fbxprocfs_desc *ro_desc,
+		 const struct fbxprocfs_desc *rw_desc)
+{
+	struct proc_dir_entry	*proc;
+	int			i;
+
+	for (i = 0; ro_desc && ro_desc[i].name; i++) {
+		if (!(proc = __create_proc_read_entry(&ro_desc[i],
+						      client->dir))) {
+			printk(KERN_ERR PFX "can't create %s/%s entry\n",
+			       client->dirname, ro_desc[i].name);
+			goto err;
+		}
+		atomic_inc(&client->refcount);
+	}
+
+	for (i = 0; rw_desc && rw_desc[i].name; i++) {
+		if (!(proc = __create_proc_entry(&rw_desc[i], client->dir))) {
+			printk(KERN_ERR PFX "can't create %s/%s entry\n",
+			       client->dirname, ro_desc[i].name);
+			goto err;
+		}
+		atomic_inc(&client->refcount);
+	}
+
+	return 0;
+
+err:
+	__remove_entries(client, ro_desc, rw_desc);
+	return -1;
+}
+
+int
+fbxprocfs_create_entries(struct fbxprocfs_client *client,
+			 const struct fbxprocfs_desc *ro_desc,
+			 const struct fbxprocfs_desc *rw_desc)
+{
+	int	ret;
+
+	ret = __create_entries(client, ro_desc, rw_desc);
+	return ret;
+}
+
+int
+fbxprocfs_remove_entries(struct fbxprocfs_client *client,
+			 const struct fbxprocfs_desc *ro_desc,
+			 const struct fbxprocfs_desc *rw_desc)
+{
+	int	ret;
+
+	ret = __remove_entries(client, ro_desc, rw_desc);
+	return ret;
+}
+
+
+static int __init
+fbxprocfs_init(void)
+{
+	INIT_LIST_HEAD(&clients);
+	mutex_init(&clients_mutex);
+
+	/* create freebox directory */
+	if (!(root = proc_mkdir("freebox", NULL))) {
+		printk(KERN_ERR PFX "can't create freebox/ dir\n");
+		return -EIO;
+	}
+	return 0;
+}
+
+static void __exit
+fbxprocfs_exit(void)
+{
+	remove_proc_entry("freebox", NULL);
+}
+
+module_init(fbxprocfs_init);
+module_exit(fbxprocfs_exit);
+
+EXPORT_SYMBOL(fbxprocfs_create_entries);
+EXPORT_SYMBOL(fbxprocfs_remove_entries);
+EXPORT_SYMBOL(fbxprocfs_add_client);
+EXPORT_SYMBOL(fbxprocfs_remove_client);
+
+MODULE_LICENSE("GPL");
+MODULE_VERSION("1.0");
+MODULE_AUTHOR("Maxime Bizon <mbizon@freebox.fr>");
+
diff -Nruw linux-5.4.60-fbx/drivers/fbxprocfs./Kconfig linux-5.4.60-fbx/drivers/fbxprocfs/Kconfig
--- linux-5.4.60-fbx/drivers/fbxprocfs./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/fbxprocfs/Kconfig	2021-03-04 13:20:57.760838887 +0100
@@ -0,0 +1,2 @@
+config FREEBOX_PROCFS
+	tristate "Freebox procfs interface"
diff -Nruw linux-5.4.60-fbx/drivers/fbxprocfs./Makefile linux-5.4.60-fbx/drivers/fbxprocfs/Makefile
--- linux-5.4.60-fbx/drivers/fbxprocfs./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/fbxprocfs/Makefile	2021-03-04 13:20:57.760838887 +0100
@@ -0,0 +1 @@
+obj-$(CONFIG_FREEBOX_PROCFS) += fbxprocfs.o
diff -Nruw linux-5.4.60-fbx/drivers/fbxwatchdog./Kconfig linux-5.4.60-fbx/drivers/fbxwatchdog/Kconfig
--- linux-5.4.60-fbx/drivers/fbxwatchdog./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/fbxwatchdog/Kconfig	2021-03-04 13:20:57.760838887 +0100
@@ -0,0 +1,24 @@
+menuconfig FREEBOX_WATCHDOG
+	tristate "Freebox Watchdog"
+	default n
+
+if FREEBOX_WATCHDOG
+
+config FREEBOX_WATCHDOG_CHAR
+	bool "Freebox Watchdog char device interface."
+	default n
+
+config FREEBOX_WATCHDOG_ORION
+	tristate "Marvell Orion support"
+	depends on PLAT_ORION
+
+config FREEBOX_WATCHDOG_BCM63XX
+	tristate "Broadcom 63xx Freebox Watchdog support"
+	depends on BCM63XX
+	default n
+
+config FREEBOX_WATCHDOG_BCM63XX_OF
+	tristate "Broadcom 63xx Freebox Watchdog support (generic)"
+	depends on OF && !FREEBOX_WATCHDOG_BCM63XX
+
+endif
diff -Nruw linux-5.4.60-fbx/drivers/fbxwatchdog./Makefile linux-5.4.60-fbx/drivers/fbxwatchdog/Makefile
--- linux-5.4.60-fbx/drivers/fbxwatchdog./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/fbxwatchdog/Makefile	2021-03-04 13:20:57.760838887 +0100
@@ -0,0 +1,10 @@
+obj-$(CONFIG_FREEBOX_WATCHDOG) += fbxwatchdog.o
+
+fbxwatchdog-objs = fbxwatchdog_core.o
+ifeq ($(CONFIG_FREEBOX_WATCHDOG_CHAR),y)
+fbxwatchdog-objs += fbxwatchdog_char.o
+endif
+
+obj-$(CONFIG_FREEBOX_WATCHDOG_ORION)	+= fbxwatchdog_orion.o
+obj-$(CONFIG_FREEBOX_WATCHDOG_BCM63XX)	+= fbxwatchdog_bcm63xx.o
+obj-$(CONFIG_FREEBOX_WATCHDOG_BCM63XX_OF)	+= fbxwatchdog_bcm63xx_of.o
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/drivers/hwmon/ap806-hwmon.c	2021-03-04 13:20:58.450838918 +0100
@@ -0,0 +1,284 @@
+/*
+ * ap806.c for ap806-hwmon
+ * Created by <nschichan@freebox.fr> on Tue Oct  3 15:43:07 2017
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/io.h>
+#include <linux/platform_device.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/delay.h>
+#include <linux/of_device.h>
+
+#include <linux/arm-smccc.h>
+
+#define AP806_SENSOR_CTRL			0x0
+# define AP806_SENSOR_CTRL_START		BIT(0)
+# define AP806_SENSOR_CTRL_RESET		BIT(1)
+# define AP806_SENSOR_CTRL_ENABLE		BIT(2)
+
+#define CP110_TSEN_CONTROL			0x4
+# define CP110_TSEN_CONTROL_HW_RESET		BIT(8)
+
+#define AP806_SENSOR_STATUS			0x8
+# define AP806_SENSOR_STATUS_READOUT_MASK	(0x3ff)
+
+#define CP110_SENSOR_VALID_BIT	10
+#define AP806_SENSOR_VALID_BIT	16
+
+#define SENSOR_READ_SMC		ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
+						   ARM_SMCCC_SMC_64,	\
+						   ARM_SMCCC_OWNER_OEM, 0)
+
+#define SENSOR_WRITE_SMC	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
+						   ARM_SMCCC_SMC_64,	\
+						   ARM_SMCCC_OWNER_OEM, 1)
+
+struct ap806_hwmon_priv {
+	void __iomem *regs;
+	struct device *hwmon_dev;
+	const struct sensor_data *data;
+
+	bool requires_smc;
+	unsigned long io_phys_base;
+	struct device *dev;
+
+};
+
+struct sensor_data {
+	u32 readout_valid_bit;
+	bool two_complement;
+	unsigned long coef_b;
+	unsigned long coef_m;
+	unsigned long coef_div;
+	int (*init_sensor)(struct ap806_hwmon_priv *priv);
+};
+
+/*
+ * SMC/IO accessors for sensors. on A8K, sensors registers lie in the
+ * DFX space which may have to be configured to reject non secure
+ * accesses (fuses block are on the DFX space).
+ *
+ * Freebox ATF implements IO accessors for sensor registers via SMC
+ * call to the secure monitor.
+ *
+ * Ideally we should put these details in a regmap but this will do
+ * for now.
+ */
+static int sensor_read(u32 *v, struct ap806_hwmon_priv *priv, u32 reg_off)
+{
+	if (!priv->requires_smc) {
+		*v = readl(priv->regs + reg_off);
+		return 0;
+	} else {
+		struct arm_smccc_res smc_res;
+
+		arm_smccc_smc(SENSOR_READ_SMC, priv->io_phys_base + reg_off,
+			      0, 0, 0, 0, 0, 0, &smc_res);
+		if (smc_res.a0) {
+			dev_err(priv->dev, "read SMC failed.\n");
+			return -ENXIO;
+		} else {
+			*v =  smc_res.a1;
+			return 0;
+		}
+	}
+}
+
+static int sensor_write(u32 value, struct ap806_hwmon_priv *priv, u32 reg_off)
+{
+	if (!priv->requires_smc) {
+		writel(value, priv->regs + reg_off);
+		return 0;
+	} else {
+		struct arm_smccc_res smc_res;
+
+		arm_smccc_smc(SENSOR_WRITE_SMC, value,
+			      priv->io_phys_base + reg_off,
+			      0, 0, 0, 0, 0, &smc_res);
+
+		if (smc_res.a0) {
+			dev_err(priv->dev, "write SMC failed.\n");
+			return -ENXIO;
+		}
+		return 0;
+	}
+}
+
+static int ap806_init_sensor(struct ap806_hwmon_priv *priv)
+{
+	u32 reg;
+	int error;
+
+	/*
+	 * dereset and start sensor.
+	 */
+	error = sensor_read(&reg, priv, AP806_SENSOR_CTRL);
+	if (error)
+		return error;
+
+	reg &= ~AP806_SENSOR_CTRL_RESET;
+	reg |= AP806_SENSOR_CTRL_ENABLE;
+	reg |= AP806_SENSOR_CTRL_START;
+
+	return sensor_write(reg, priv, AP806_SENSOR_CTRL);
+}
+
+static int cp110_init_sensor(struct ap806_hwmon_priv *priv)
+{
+	u32 reg;
+	int error;
+	/*
+	 * dereset sensor.
+	 */
+	error = sensor_read(&reg, priv, CP110_TSEN_CONTROL);
+	if (error)
+		return error;
+
+	reg |= CP110_TSEN_CONTROL_HW_RESET;
+
+	return sensor_write(reg, priv, CP110_TSEN_CONTROL);
+}
+
+static const struct sensor_data ap806_sensor_data = {
+	.readout_valid_bit = AP806_SENSOR_VALID_BIT,
+	.coef_b = 153400,
+	.coef_m = 425,
+	.coef_div = 1,
+	.two_complement = true,
+	.init_sensor = ap806_init_sensor,
+};
+
+static const struct sensor_data cp110_sensor_data = {
+	.readout_valid_bit = CP110_SENSOR_VALID_BIT,
+	.coef_b = -2791000UL,
+	.coef_m = 4761UL,
+	.coef_div = 10,
+	.two_complement = false,
+	.init_sensor = cp110_init_sensor,
+};
+
+static ssize_t ap806_show_temp(struct device *dev,
+			       struct device_attribute *attr,
+			       char *buf)
+{
+	struct ap806_hwmon_priv *priv = dev_get_drvdata(dev);
+	const struct sensor_data *data = priv->data;
+	u32 reg;
+	int value;
+	int error;
+
+	error = sensor_read(&reg, priv, AP806_SENSOR_STATUS);
+	if (error)
+		return -ENXIO;
+
+	if ((reg & (1 << data->readout_valid_bit)) == 0)
+		return -EIO;
+
+	reg &= AP806_SENSOR_STATUS_READOUT_MASK;
+
+	if (data->two_complement && reg >= 512)
+		reg = reg - 1024;
+
+	value = (data->coef_m * (long)reg + data->coef_b) /
+		data->coef_div;
+	return sprintf(buf, "%d\n", value);
+}
+
+static SENSOR_DEVICE_ATTR_2(temp0_input, S_IRUGO, ap806_show_temp, NULL, 0, 0);
+
+static struct attribute *temp_attrs[] = {
+	&sensor_dev_attr_temp0_input.dev_attr.attr,
+	NULL
+};
+
+static const struct attribute_group ap806_temperature_attr_group = {
+	.attrs = temp_attrs,
+};
+
+static const struct of_device_id ap806_hwmon_of_match[] = {
+	{ .compatible = "marvell,ap806-hwmon", .data = &ap806_sensor_data },
+	{ .compatible = "marvell,cp110-hwmon", .data = &cp110_sensor_data },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, ap806_hwmon_of_match);
+
+static int ap806_hwmon_probe(struct platform_device *pdev)
+{
+	struct ap806_hwmon_priv *priv;
+	struct resource *reg_resource;
+	int error;
+	const struct of_device_id *match;
+
+	match = of_match_device(ap806_hwmon_of_match, &pdev->dev);
+	if (!match)
+		return -ENODEV;
+
+	priv = devm_kzalloc(&pdev->dev, sizeof (*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+	dev_set_drvdata(&pdev->dev, priv);
+	priv->dev = &pdev->dev;
+
+	reg_resource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!reg_resource)
+		return -EINVAL;
+
+	if (of_property_read_bool(pdev->dev.of_node, "fbx,requires-smc")) {
+		dev_info(&pdev->dev, "using SMC to access registers.\n");
+		priv->requires_smc = true;
+		priv->io_phys_base = reg_resource->start;
+	} else {
+		priv->regs = devm_ioremap_resource(&pdev->dev, reg_resource);
+		if (!priv->regs)
+			return -ENOMEM;
+	}
+
+	priv->data = match->data;
+
+	error = priv->data->init_sensor(priv);
+	if (error)
+		return error;
+
+	error = sysfs_create_group(&pdev->dev.kobj, &ap806_temperature_attr_group);
+	if (error)
+		return error;
+
+	priv->hwmon_dev = hwmon_device_register(&pdev->dev);
+	if (IS_ERR(priv->hwmon_dev)) {
+		error = PTR_ERR(priv->hwmon_dev);
+		goto sysfs_remove_group;
+	}
+
+	return 0;
+
+sysfs_remove_group:
+	sysfs_remove_group(&pdev->dev.kobj, &ap806_temperature_attr_group);
+	return error;
+}
+
+static int ap806_hwmon_remove(struct platform_device *pdev)
+{
+	struct ap806_hwmon_priv *priv = dev_get_drvdata(&pdev->dev);
+
+	hwmon_device_unregister(priv->hwmon_dev);
+	sysfs_remove_group(&pdev->dev.kobj, &ap806_temperature_attr_group);
+	return 0;
+}
+
+struct platform_driver ap806_hwmon_driver = {
+	.probe	= ap806_hwmon_probe,
+	.remove	= ap806_hwmon_remove,
+	.driver	= {
+		.name		= "ap806-hwmon",
+		.owner		= THIS_MODULE,
+		.of_match_table	= ap806_hwmon_of_match,
+	},
+};
+
+module_platform_driver(ap806_hwmon_driver);
+
+MODULE_AUTHOR("Nicolas Schichan <nschichan@freebox.fr>");
+MODULE_LICENSE("GPL");
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/drivers/hwmon/ld6710-fbx.c	2021-03-04 13:20:58.457505585 +0100
@@ -0,0 +1,343 @@
+/*
+ * ld6710-fbx.c for ld6710-fbx
+ * Created by <nschichan@freebox.fr> on Wed Sep 25 15:01:56 2019
+ */
+
+/*
+ * Driver for LD6710 power deliverance with freebox specific
+ * firmware. The power supply temperature report on the I2C register
+ * space is a feature of the ROMed firmware on the chip, which depends
+ * on the OEM.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/i2c.h>
+#include <linux/of.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/hwmon.h>
+
+#define LD6710_CHIPVER	0x00
+#define LD6710_FWVER	0x01
+
+#define LD6710_SINK_CURRENT		0x10
+#define LD6710_SINK_CURRENT_MAX		0x11
+
+#define LD6710_SINK_TEMP		0x20
+#define LD6710_SINK_TEMP_TURNOFF	0x21
+#define LD6710_SINK_TEMP_TURNON		0x22
+
+#define LD6710_SINK_STATUS		0x30
+#define  SINK_STATUS_OTP		(1 << 0)
+#define  SINK_STATUS_OCP		(1 << 1)
+#define  SINK_STATUS_OVP		(1 << 2)
+
+struct ld6710_priv {
+	struct device *hwmon_dev;
+	struct i2c_client *client;
+	struct mutex mutex;
+};
+
+static int ld6710_read(struct ld6710_priv *priv, u8 addr)
+{
+	int ret;
+
+	ret = i2c_smbus_read_byte_data(priv->client, addr);
+	if (ret < 0) {
+		dev_err(&priv->client->dev, "i2c read error at address %02x\n",
+			addr);
+		return 0xff;
+	}
+	return ret;
+}
+
+static void ld6710_write(struct ld6710_priv *priv, u8 addr, u8 value)
+{
+	i2c_smbus_write_byte_data(priv->client, addr, value);
+}
+
+static struct ld6710_priv *to_ld6710_priv(struct device *dev)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	return i2c_get_clientdata(client);
+}
+
+/*
+ * chip / fw
+ */
+static ssize_t version_show(struct device *dev,
+			    struct device_attribute *attr, char *buf)
+{
+	struct ld6710_priv *priv = to_ld6710_priv(dev);
+	struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+	u32 v;
+
+	mutex_lock(&priv->mutex);
+	v = ld6710_read(priv, sattr->nr);
+	mutex_unlock(&priv->mutex);
+
+	return sprintf(buf, "0x%02x\n", v);
+}
+
+static SENSOR_DEVICE_ATTR_2_RO(chipver, version, LD6710_CHIPVER, 0);
+static SENSOR_DEVICE_ATTR_2_RO(fwver, version, LD6710_FWVER, 0);
+
+static struct attribute *ld6710_ver_attrs[] = {
+	&sensor_dev_attr_chipver.dev_attr.attr,
+	&sensor_dev_attr_fwver.dev_attr.attr,
+	NULL,
+};
+
+static const struct attribute_group ld6710_ver_group = {
+	.attrs = ld6710_ver_attrs,
+};
+
+/*
+ * sink current (mA)
+ */
+static ssize_t current_show(struct device *dev,
+			    struct device_attribute *attr, char *buf)
+{
+	struct ld6710_priv *priv = to_ld6710_priv(dev);
+	struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+	u32 v;
+
+	mutex_lock(&priv->mutex);
+	v = ld6710_read(priv, sattr->nr) * 100;
+	mutex_unlock(&priv->mutex);
+
+	return sprintf(buf, "%d\n", v);
+}
+
+static ssize_t current_store(struct device *dev,
+			     struct device_attribute *attr,
+			     const char *buf, size_t count)
+{
+	struct ld6710_priv *priv = to_ld6710_priv(dev);
+	struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+	unsigned long val;
+
+	if (kstrtoul(buf, 10, &val))
+		return -EINVAL;
+
+	val /= 100;
+	if (val > 255)
+		return -EINVAL;
+
+	mutex_lock(&priv->mutex);
+	ld6710_write(priv, sattr->nr, val);
+	mutex_unlock(&priv->mutex);
+
+	return count;
+}
+
+static SENSOR_DEVICE_ATTR_2_RO(sink_current, current, LD6710_SINK_CURRENT, 0);
+static SENSOR_DEVICE_ATTR_2_RO(in1_input, current, LD6710_SINK_CURRENT, 0);
+static SENSOR_DEVICE_ATTR_2_RW(sink_current_max, current,
+			       LD6710_SINK_CURRENT_MAX, 0);
+
+static struct attribute *ld6710_sink_current_attrs[] = {
+	&sensor_dev_attr_in1_input.dev_attr.attr,
+	&sensor_dev_attr_sink_current.dev_attr.attr,
+	&sensor_dev_attr_sink_current_max.dev_attr.attr,
+	NULL,
+};
+
+static const struct attribute_group ld6710_sink_current_group = {
+	.attrs = ld6710_sink_current_attrs,
+};
+
+/*
+ * sink temperature (1/1000th degree)
+ */
+static ssize_t temperature_show(struct device *dev,
+				struct device_attribute *attr,
+				char *buf)
+{
+	struct ld6710_priv *priv = to_ld6710_priv(dev);
+	struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+	u32 v;
+
+	mutex_lock(&priv->mutex);
+	v = ld6710_read(priv, sattr->nr) * 1000;
+	mutex_unlock(&priv->mutex);
+
+	return sprintf(buf, "%d\n", v);
+}
+
+static ssize_t temperature_store(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf, size_t count)
+{
+	struct ld6710_priv *priv = to_ld6710_priv(dev);
+	struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+	unsigned long val;
+
+	if (kstrtoul(buf, 10, &val))
+		return -EINVAL;
+
+	val /= 1000;
+	if (val > 255)
+		return -EINVAL;
+
+	mutex_lock(&priv->mutex);
+	ld6710_write(priv, sattr->nr, val);
+	mutex_unlock(&priv->mutex);
+
+	return count;
+}
+
+static SENSOR_DEVICE_ATTR_2_RO(temp1_input, temperature, LD6710_SINK_TEMP, 0);
+static SENSOR_DEVICE_ATTR_2_RW(temp1_turnoff, temperature,
+			       LD6710_SINK_TEMP_TURNOFF, 0);
+static SENSOR_DEVICE_ATTR_2_RW(temp1_turnon, temperature,
+			       LD6710_SINK_TEMP_TURNON, 0);
+
+
+static struct attribute *ld6710_sink_temp_attrs[] = {
+	&sensor_dev_attr_temp1_input.dev_attr.attr,
+	&sensor_dev_attr_temp1_turnoff.dev_attr.attr,
+	&sensor_dev_attr_temp1_turnon.dev_attr.attr,
+	NULL,
+};
+
+static const struct attribute_group ld6710_sink_temp_group = {
+	.attrs = ld6710_sink_temp_attrs,
+};
+
+/*
+ * status
+ */
+static ssize_t status_show(struct device *dev, struct device_attribute *attr,
+			   char *buf)
+{
+	return version_show(dev, attr, buf);
+}
+
+static SENSOR_DEVICE_ATTR_2_RO(status, status, LD6710_SINK_STATUS, 0);
+
+static struct attribute *ld6710_status_attrs[] = {
+	&sensor_dev_attr_status.dev_attr.attr,
+	NULL,
+};
+
+static const struct attribute_group ld6710_status_group = {
+	.attrs = ld6710_status_attrs,
+};
+
+
+static void ld6710_fbx_remove_files(struct i2c_client *client)
+{
+	sysfs_remove_group(&client->dev.kobj, &ld6710_ver_group);
+	sysfs_remove_group(&client->dev.kobj, &ld6710_sink_current_group);
+	sysfs_remove_group(&client->dev.kobj, &ld6710_sink_temp_group);
+	sysfs_remove_group(&client->dev.kobj, &ld6710_status_group);
+}
+
+static int ld6710_fbx_probe(struct i2c_client *client,
+			    const struct i2c_device_id *id)
+{
+	struct ld6710_priv *priv;
+	u8 chipver, fwver;
+	int error;
+
+	dev_info(&client->dev, "probe\n");
+
+	priv = devm_kzalloc(&client->dev, sizeof (*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->client = client;
+	mutex_init(&priv->mutex);
+	i2c_set_clientdata(client, priv);
+
+	/*
+	 * read chipver and fwver and check that they look sane.
+	 */
+	chipver = ld6710_read(priv, LD6710_CHIPVER);
+	fwver = ld6710_read(priv, LD6710_FWVER);
+	if (chipver == 0xff || fwver == 0xff) {
+		dev_err(&client->dev, "invalid chip version of firmware "
+			"version.\n");
+		return -ENXIO;
+	}
+
+	dev_info(&client->dev, "LD6710 chip %02x, fw %02x\n",
+		 chipver, fwver);
+
+	/*
+	 * create attributes
+	 */
+	error = sysfs_create_group(&client->dev.kobj, &ld6710_ver_group);
+	if (error)
+		goto remove_files;
+
+	error = sysfs_create_group(&client->dev.kobj,
+				   &ld6710_sink_current_group);
+	if (error)
+		goto remove_files;
+
+	error = sysfs_create_group(&client->dev.kobj, &ld6710_sink_temp_group);
+	if (error)
+		goto remove_files;
+
+	error = sysfs_create_group(&client->dev.kobj, &ld6710_status_group);
+	if (error)
+		goto remove_files;
+
+	/*
+	 * register hwmon device.
+	 */
+	priv->hwmon_dev = hwmon_device_register(&client->dev);
+	if (IS_ERR(priv->hwmon_dev)) {
+		dev_err(&client->dev, "unable to register hwmon device.\n");
+		error = PTR_ERR(priv->hwmon_dev);
+		goto remove_files;
+	}
+
+	return 0;
+
+remove_files:
+	ld6710_fbx_remove_files(client);
+	return error;
+}
+
+static int ld6710_fbx_remove(struct i2c_client *client)
+{
+	struct ld6710_priv *priv = i2c_get_clientdata(client);
+
+	dev_info(&client->dev, "remove\n");
+
+	hwmon_device_unregister(priv->hwmon_dev);
+	ld6710_fbx_remove_files(priv->client);
+
+	return 0;
+}
+
+static const struct of_device_id ld6710_fbx_of_match[] = {
+	{ .compatible	= "leadtrend,ld6710-fbx" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, ld6710_fbx_of_match);
+
+
+static const unsigned short ld6710_addrs[] = { 0x68, /* maybe some others ? */
+					       I2C_CLIENT_END };
+
+static struct i2c_driver ld6710_fbx_driver = {
+	.class		= I2C_CLASS_HWMON,
+	.driver = {
+		.name	= "ld6710_fbx",
+		.of_match_table = of_match_ptr(ld6710_fbx_of_match),
+	},
+	.probe		= ld6710_fbx_probe,
+	.remove		= ld6710_fbx_remove,
+	.address_list	= ld6710_addrs,
+};
+
+module_i2c_driver(ld6710_fbx_driver);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Nicolas Schichan <nschichan@freebox.fr>");
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/drivers/input/misc/smsc_cap1066.c	2021-03-04 13:20:58.607505592 +0100
@@ -0,0 +1,1117 @@
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/input-polldev.h>
+#include <linux/smsc_cap1066.h>
+#include <linux/slab.h>
+#include <linux/gpio/consumer.h>
+#include <linux/of_gpio.h>
+#include <linux/reset.h>
+
+#define PFX		"cap1066: "
+
+/*
+ * list of registers
+ */
+#define SMSC_REG_MAIN_CTRL		0x00
+#define SMSC_REG_BTN_STATUS1		0x03
+#define SMSC_REG_DATA_SENSITIVITY	0x1f
+#define SMSC_REG_CFG			0x20
+#define SMSC_REG_SENS_CFG		0x22
+#define SMSC_REG_MTOUCH_CFG_REG		0x2a
+#define SMSC_REG_CFG2			0x44
+#define SMSC_REG_LED_OUT_TYPE		0x71
+#define SMSC_REG_LED_LINK		0x72
+#define SMSC_REG_LED_OUTPUT_CTL		0x74
+#define SMSC_REG_LED_BEHAVIOUR1		0x81
+#define SMSC_REG_LED_BEHAVIOUR2		0x82
+#define SMSC_REG_LED_DIRECT_DCYCLE	0x93
+#define SMSC_REG_LED_DIRECT_RAMP_RATE	0x94
+#define SMSC_REG_LED_OFF_DELAY		0x95
+#define SMSC_REG_DID			0xfd
+#define SMSC_REG_VID			0xfe
+
+/*
+ * used in cap1066_init_hw and during priv initialization.
+ */
+#define DEFAULT_DUTY_CYCLE_MIN		0x4
+#define DEFAULT_DUTY_CYCLE_MAX		0xf
+#define DEFAULT_RAMP_TIME_FALL		0x1
+#define DEFAULT_RAMP_TIME_RISE		0x2
+
+/*
+ * vendor id / device id
+ */
+#define SMSC_CAP1066_VID	0x5d
+#define SMSC_CAP1066_DID	0x41
+#define SMSC_CAP1166_DID	0x51
+
+static const unsigned short normal_i2c[] = { 0x28, I2C_CLIENT_END };
+
+static const struct i2c_device_id cap1066_id[] = {
+	{ "cap1066", 0 },
+	{ }
+};
+
+/*
+ * private context
+ */
+static u32 default_map[CAP1066_MAX_BTNS] = {
+	BTN_0,
+	BTN_1,
+	BTN_2,
+	BTN_3,
+	BTN_4,
+	BTN_5,
+};
+
+struct led_btn_name
+{
+	int code;
+	const char *name;
+};
+
+/*
+ * whenever possible symlinks will be created from led_btn_X to
+ * led_key_y, depending on user provided keymap. add entries here as
+ * you see fit.
+ */
+static const struct led_btn_name led_btn_names[] = {
+	{ KEY_UP, "led_key_up", },
+	{ KEY_DOWN, "led_key_down", },
+	{ KEY_LEFT, "led_key_left", },
+	{ KEY_RIGHT, "led_key_right", },
+	{ KEY_ENTER, "led_key_enter", },
+};
+
+enum {
+	E_SMSC_CAP1066_LED_MODE_AUTO,
+	E_SMSC_CAP1066_LED_MODE_ON,
+	E_SMSC_CAP1066_LED_MODE_OFF,
+};
+
+struct cap1066_led_dev
+{
+	struct cap1066_priv	*parent_priv;
+	struct device		dev;
+	int			led_mode;
+	int			led_index;
+	const char		*btn_link;
+};
+
+struct cap1066_priv {
+	struct input_polled_dev *poll_dev;
+	struct i2c_client	*client;
+	u32			keymap[CAP1066_MAX_BTNS];
+	struct cap1066_led_dev	*led_devices[CAP1066_MAX_BTNS];
+
+	u8			duty_cycle_min;
+	u8			duty_cycle_max;
+	u8			raw_ramp_time_fall;
+	u8			raw_ramp_time_rise;
+
+	struct gpio_desc	*irq_gpio;
+};
+
+static const char *get_keycode_btn_name(int key_code)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(led_btn_names); ++i) {
+		if (key_code == led_btn_names[i].code)
+			return led_btn_names[i].name;
+	}
+	return NULL;
+}
+
+/*
+ * single register read
+ */
+static int cap1066_read_reg(struct i2c_client *client, u8 reg, u8 *val)
+{
+	int ret;
+
+	ret = i2c_smbus_read_byte_data(client, reg);
+	if (ret < 0) {
+		printk(KERN_ERR PFX "read failed: %d\n", ret);
+		return ret;
+	}
+
+	*val = (u8)ret;
+	return 0;
+}
+
+/*
+ * single register write
+ */
+static int cap1066_write_reg(struct i2c_client *client, u8 reg, u8 val)
+{
+	int ret;
+
+	ret = i2c_smbus_write_byte_data(client, reg, val);
+	if (ret < 0) {
+		printk(KERN_ERR PFX "write failed: %d\n", ret);
+		return ret;
+	}
+	return 0;
+}
+
+/*
+ * called when an smbus device is detected, make sure it's a cap1066
+ */
+static int cap1066_detect(struct i2c_client *client,
+			  struct i2c_board_info *info)
+
+{
+	int ret;
+	u8 vid, did;
+	const char *name = NULL;
+
+	ret = cap1066_read_reg(client, SMSC_REG_VID, &vid);
+	if (ret)
+		return ret;
+
+	ret = cap1066_read_reg(client, SMSC_REG_DID, &did);
+	if (ret)
+		return ret;
+
+	if (vid != SMSC_CAP1066_VID)
+		goto no_dev;
+
+	switch (did) {
+	case SMSC_CAP1066_DID:
+		name = "cap1066";
+		break;
+	case SMSC_CAP1166_DID:
+		name = "cap1166";
+		break;
+	default:
+		goto no_dev;
+	}
+
+	printk(KERN_INFO PFX "detected SMSC %s chip\n", name);
+	if (info)
+		strlcpy(info->type, name, I2C_NAME_SIZE);
+	return 0;
+
+no_dev:
+	printk(KERN_ERR PFX "bad vid/did: 0x%04x/0x%04x\n", vid, did);
+	return -ENODEV;
+}
+
+/*
+ * reset registers value
+ */
+static int cap1066_init_hw(struct i2c_client *client)
+{
+	unsigned int i;
+	u8 did;
+	int ret;
+
+	static const u8 init_regs[] = {
+		/* power on */
+		SMSC_REG_MAIN_CTRL, 0x0,
+
+		/* default sensitivity */
+		SMSC_REG_DATA_SENSITIVITY, 0x2f,
+
+		/* max duration */
+		SMSC_REG_SENS_CFG, 0xf4,
+
+		/* default configuration */
+		SMSC_REG_CFG, 0x38,
+
+		/* open drain output on all gpios */
+		SMSC_REG_LED_OUT_TYPE, 0x00,
+
+		/* link leds with sensors */
+		SMSC_REG_LED_LINK, 0x3f,
+
+		/* setup direct mode */
+		SMSC_REG_LED_BEHAVIOUR1, 0x00,
+		SMSC_REG_LED_BEHAVIOUR2, 0x00,
+
+		/* set led duty cycle min/max to 10% => 100% */
+		SMSC_REG_LED_DIRECT_DCYCLE,
+			(DEFAULT_DUTY_CYCLE_MAX << 4) |
+			(DEFAULT_DUTY_CYCLE_MIN),
+
+		/* set ramp rate time to 500ms/250ms */
+		SMSC_REG_LED_DIRECT_RAMP_RATE,
+			(DEFAULT_RAMP_TIME_RISE << 3) |
+			(DEFAULT_RAMP_TIME_FALL),
+	};
+
+	static const u8 init_cap11_regs[] = {
+		/* default configuration2 */
+		SMSC_REG_CFG2, 0x44,
+	};
+
+	for (i = 0; i < ARRAY_SIZE(init_regs); i += 2) {
+		int ret;
+
+		ret = cap1066_write_reg(client,
+					init_regs[i], init_regs[i + 1]);
+		if (ret)
+			return ret;
+	}
+
+	ret = cap1066_read_reg(client, SMSC_REG_DID, &did);
+	if (ret)
+		return ret;
+
+	if (did != SMSC_CAP1166_DID)
+		return 0;
+
+	for (i = 0; i < ARRAY_SIZE(init_cap11_regs); i += 2) {
+		int ret;
+
+		ret = cap1066_write_reg(client,
+					init_cap11_regs[i],
+					init_cap11_regs[i + 1]);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+/*
+ * input core poll callback
+ */
+static void cap1066_input_poll(struct input_polled_dev *dev)
+{
+	struct cap1066_priv *priv = dev->private;
+	struct input_dev *input = dev->input;
+	unsigned int i;
+	int ret;
+	u8 stat;
+
+	if (priv->irq_gpio && gpiod_get_value(priv->irq_gpio))
+		return;
+
+	/* clear interrupt flag */
+	cap1066_write_reg(priv->client, SMSC_REG_MAIN_CTRL, 0);
+
+	ret = cap1066_read_reg(priv->client, SMSC_REG_BTN_STATUS1, &stat);
+	if (ret) {
+		printk(KERN_ERR PFX "unable to read status\n");
+		return;
+	}
+
+	for (i = 0; i < CAP1066_MAX_BTNS; i++)
+		input_report_key(input, priv->keymap[i],
+				 (stat & (1 << i)) ? 1 : 0);
+	input_sync(input);
+}
+
+#define to_cap1066_led_dev(Dev)	container_of(Dev, struct cap1066_led_dev, dev)
+
+/*
+ * called when all sysfs references to the cap1066_led_dev are gone.
+ */
+static void cap1066_led_dev_release(struct device *dev)
+{
+	struct cap1066_led_dev *led_dev;
+
+	led_dev = to_cap1066_led_dev(dev);
+	kfree(led_dev);
+}
+
+static int is_white(int c)
+{
+	return c == '\0' || c == ' ' || c == '\t' || c == '\n' || c == '\r';
+}
+
+/*
+ * store a new control value for a given cap1066_led_dev:
+ * - auto means that the led is linked to the capacitive keys
+ * - on means that the led is always on
+ * - off means that the led is always off
+ */
+static ssize_t store_control(struct device *dev,
+			     struct device_attribute *attr,
+			     const char *buf, size_t count)
+{
+	struct cap1066_led_dev *led_dev;
+	int new_mode;
+	int read_len = 0;
+	const char *end;
+	int key;
+	u8 reg;
+	struct i2c_client *client;
+	static const char *valid_keys[] = {
+		[E_SMSC_CAP1066_LED_MODE_AUTO] = "auto",
+		[E_SMSC_CAP1066_LED_MODE_ON] = "on",
+		[E_SMSC_CAP1066_LED_MODE_OFF] = "off",
+	};
+
+
+	led_dev = to_cap1066_led_dev(dev);
+	client = led_dev->parent_priv->client;
+
+	if (is_white(*buf))
+		/*
+		 * eat white spaces silently, upper layer will call us
+		 * again.
+		 */
+		return 1;
+
+	for (key = 0; key < ARRAY_SIZE(valid_keys); ++key) {
+		if (count < strlen(valid_keys[key]))
+			continue ;
+		if (!strncmp(buf, valid_keys[key], strlen(valid_keys[key]))) {
+			break;
+		}
+	}
+
+	if (key == ARRAY_SIZE(valid_keys)) {
+		/*
+		 * end of valid_keys array reached and nothing valid
+		 * was recognized.
+		 */
+		printk(KERN_ERR PFX "invalid control value.\n");
+		return -EINVAL;
+	}
+	new_mode = key;
+	read_len = strlen(valid_keys[key]);
+
+	/*
+	 * check that no garbage is present at end of input.
+	 */
+	end = buf + read_len;
+	if (end < buf + count && !is_white(*end)) {
+		/*
+		 * garbage at end of input.
+		 */
+		printk(KERN_ERR PFX "garbage at end of value for led "
+		       "control.\n");
+		return -EINVAL;
+	}
+
+	if (new_mode == led_dev->led_mode)
+		return read_len;
+
+	if (new_mode == E_SMSC_CAP1066_LED_MODE_AUTO) {
+		cap1066_read_reg(client, SMSC_REG_LED_LINK, &reg);
+		reg |= (1 << led_dev->led_index);
+		cap1066_write_reg(client, SMSC_REG_LED_LINK, reg);
+	} else {
+		cap1066_read_reg(client, SMSC_REG_LED_LINK, &reg);
+		reg &= ~(1 << led_dev->led_index);
+		cap1066_write_reg(client, SMSC_REG_LED_LINK, reg);
+
+		cap1066_read_reg(client, SMSC_REG_LED_OUTPUT_CTL, &reg);
+		if (new_mode == E_SMSC_CAP1066_LED_MODE_ON)
+			reg |= (1 << led_dev->led_index);
+		else
+			reg &= ~(1 << led_dev->led_index);
+		cap1066_write_reg(client, SMSC_REG_LED_OUTPUT_CTL, reg);
+	}
+	led_dev->led_mode = new_mode;
+
+	return read_len;
+}
+
+static ssize_t show_control(struct device *dev,
+			    struct device_attribute *attr, char *buf)
+{
+	struct cap1066_led_dev *led_dev;
+	const char *str;
+
+	led_dev = to_cap1066_led_dev(dev);
+	switch (led_dev->led_mode) {
+	case E_SMSC_CAP1066_LED_MODE_AUTO:
+		str = "auto";
+		break;
+
+	case E_SMSC_CAP1066_LED_MODE_ON:
+		str = "on";
+		break;
+
+	case E_SMSC_CAP1066_LED_MODE_OFF:
+		str = "off";
+		break;
+
+	default:
+		str = "invalid";
+		break;
+	}
+
+	return sprintf(buf, "%s\n", str);
+}
+
+static DEVICE_ATTR(control, S_IWUSR | S_IRUSR, show_control, store_control);
+
+static struct device_attribute *cap1066_led_dev_attrs[] = {
+	&dev_attr_control,
+};
+
+/*
+ * helper used to create all attributes given in the attr array.
+ *
+ * if something goes wrong during creation, remove attributes that
+ * have already been created.
+ */
+static int create_sysfs_files(struct device *dev,
+			      struct device_attribute **attrs,
+			      size_t count)
+{
+	int created;
+	int error = 0;
+
+	for (created = 0; created < count; ++created) {
+		error = device_create_file(dev, attrs[created]);
+		if (error)
+			break;
+	}
+
+	if (!error)
+		/*
+		 * no errors, can return.
+		 */
+		return 0;
+
+	/*
+	 * errors during creation, remove already created
+	 * files.
+	 */
+	while (--created >= 0)
+		device_remove_file(dev, attrs[created]);
+
+	return error;
+}
+
+/*
+ * create a led device. This will create a new directory in the sysfs
+ * base of the parent. a symlink will be created if a button name is
+ * found via get_keycode_btn_name().
+ */
+static struct cap1066_led_dev *cap1066_create_led_dev(struct device *parent,
+						      struct cap1066_priv *priv,
+						      int index, int key_code)
+{
+	struct cap1066_led_dev *dev;
+	int error = 0;
+
+	dev = kzalloc(sizeof (*dev), GFP_KERNEL);
+	if (!dev)
+		return NULL;
+
+	dev->led_index = index;
+	dev->parent_priv = priv;
+	dev_set_name(&dev->dev, "led_btn_%i", index);
+	dev->dev.release = cap1066_led_dev_release;
+	dev->dev.parent = parent;
+	if (device_register(&dev->dev) < 0) {
+		kfree(dev);
+		return NULL;
+	}
+
+	/*
+	 * create sysfs attributes.
+	 */
+	error = create_sysfs_files(&dev->dev, cap1066_led_dev_attrs,
+				   ARRAY_SIZE(cap1066_led_dev_attrs));
+	if (error) {
+		device_unregister(&dev->dev);
+		return NULL;
+	}
+
+	/*
+	 * create sysfs symlinks to friendly names, wherever possible.
+	 */
+	dev->btn_link = get_keycode_btn_name(key_code);
+	if (dev->btn_link) {
+		error = sysfs_create_link(&parent->kobj, &dev->dev.kobj,
+					  dev->btn_link);
+		if (error)
+			dev->btn_link = NULL;
+	}
+	return dev;
+}
+
+static void cap1066_remove_led_dev(struct cap1066_led_dev *dev)
+{
+	int i;
+
+	if (dev->btn_link)
+		sysfs_remove_link(&dev->dev.parent->kobj, dev->btn_link);
+
+	for (i = 0; i < ARRAY_SIZE(cap1066_led_dev_attrs); ++i)
+		device_remove_file(&dev->dev, cap1066_led_dev_attrs[i]);
+	device_unregister(&dev->dev);
+
+	/*
+	 * dev->release() kfree the cap1066_led_dev struct
+	 */
+}
+
+/*
+ * helper to exctract an unsigned long from the buffer given in
+ * parameter.
+ *
+ * first store buf in a zero terminated string and strtoul() it.
+ */
+static int get_ulong(const char *buf, size_t count, unsigned long *ret)
+{
+	char local_buf[32];
+	unsigned long val;
+	const char *end;
+
+	strncpy(local_buf, buf, min(count , sizeof (local_buf)));
+	local_buf[min(count, sizeof (local_buf) - 1)] = 0;
+
+	val = simple_strtoul(local_buf, (char**)&end, 0);
+	if (!is_white(*end))
+		/*
+		 * garbage after end of input.
+		 */
+		return -EINVAL;
+
+	*ret = val;
+
+	return 0;
+}
+
+/*
+ * duty cycle sysfs callbacks: things may not work as expected if
+ * duty_cycle_min is >= duty_cycle_max.
+ *
+ * values that can be written in duty_cycle_max/duty_cycle_min
+ * attributes can be on the range [0, 16 [.
+ *
+ * 0 means the lowest possible pwm duty cycle.
+ * 1 means the highest possible pwm duty cycle.
+ */
+
+static ssize_t store_duty_cycle_min(struct device *dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t count)
+{
+	unsigned long val;
+	struct i2c_client *client;
+	struct cap1066_priv *priv;
+	int error;
+	u8 reg;
+
+	client = to_i2c_client(dev);
+	priv = i2c_get_clientdata(client);
+
+	if (is_white(*buf))
+		return 1;
+
+	error = get_ulong(buf, count, &val);
+	if (error)
+		return error;
+
+	if (val > 0xf)
+		return -ERANGE;
+
+	cap1066_read_reg(client, SMSC_REG_LED_DIRECT_DCYCLE, &reg);
+	reg &= ~0xf;
+	reg |= val;
+	cap1066_write_reg(client, SMSC_REG_LED_DIRECT_DCYCLE, reg);
+
+	priv->duty_cycle_min = val;
+
+	pr_debug(PFX "store_duty_cycle_min: reg = 0x%02x\n", reg);
+	return count;
+}
+
+static ssize_t show_duty_cycle_min(struct device *dev,
+				   struct device_attribute *attr,
+				   char *buf)
+{
+	struct i2c_client *client;
+	struct cap1066_priv *priv;
+
+	client = to_i2c_client(dev);
+	priv = i2c_get_clientdata(client);
+
+	return sprintf(buf, "%u\n", priv->duty_cycle_min);
+}
+
+static ssize_t store_duty_cycle_max(struct device *dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t count)
+{
+	unsigned long val;
+	struct i2c_client *client;
+	struct cap1066_priv *priv;
+	int error;
+	u8 reg;
+
+	client = to_i2c_client(dev);
+	priv = i2c_get_clientdata(client);
+
+	if (is_white(*buf))
+		return 1;
+
+	error = get_ulong(buf, count, &val);
+	if (error)
+		return error;
+
+	if (val > 0xf)
+		return -ERANGE;
+
+	cap1066_read_reg(client, SMSC_REG_LED_DIRECT_DCYCLE, &reg);
+	reg &= ~0xf0;
+	reg |= val << 4;
+	cap1066_write_reg(client, SMSC_REG_LED_DIRECT_DCYCLE, reg);
+
+	priv->duty_cycle_max = val;
+
+	pr_debug(PFX "store_duty_cycle_max: reg = 0x%02x\n", reg);
+	return count;
+}
+
+static ssize_t show_duty_cycle_max(struct device *dev,
+				   struct device_attribute *attr,
+				   char *buf)
+{
+	struct i2c_client *client;
+	struct cap1066_priv *priv;
+
+	client = to_i2c_client(dev);
+	priv = i2c_get_clientdata(client);
+
+	return sprintf(buf, "%u\n", priv->duty_cycle_max);
+}
+
+/*
+ * convert millisecond value to a "raw" value ready to be written to
+ * the register.
+ */
+static u8 msec_to_raw_ramp_time(unsigned long msec)
+{
+	u8 ret;
+
+	if (msec <= 1500)
+		/*
+		 * register handles 250 msec increments if below 1500
+		 * msec.
+		 */
+		ret = msec / 250;
+	else
+		/*
+		 * there is no 1750 msec step, and 2000 msec is
+		 * encoded as 0x7.
+		 */
+		ret = 0x7;
+
+	return ret;
+}
+
+/*
+ * convert raw register value to a millisecond value.
+ */
+static unsigned long raw_ramp_time_to_msec(u8 raw)
+{
+	unsigned long ret;
+
+	if (raw < 7)
+		ret = 250 * raw;
+	else
+		ret = 2000;
+
+	return ret;
+}
+
+/*
+ * ramp time sysfs callbacks. delays are not reliable if programmed
+ * want time is higher than 1000 msec.
+ *
+ * values that can be written are on the range [0, 2000] and are given
+ * in milliseconds. Values higher than 2000 are clamped to 2000. shown
+ * values are rounded up to the next value supported by the hardware.
+ */
+
+static ssize_t store_ramp_time_rise(struct device *dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t count)
+{
+	unsigned long val;
+	u8 raw_val;
+	struct i2c_client *client;
+	struct cap1066_priv *priv;
+	int error;
+	u8 reg;
+
+	client = to_i2c_client(dev);
+	priv = i2c_get_clientdata(client);
+
+	if (is_white(*buf))
+		return 1;
+
+	error = get_ulong(buf, count, &val);
+	if (error)
+		return error;
+
+	raw_val = msec_to_raw_ramp_time(val);
+
+	cap1066_read_reg(client, SMSC_REG_LED_DIRECT_RAMP_RATE, &reg);
+	reg &= ~(0x7 << 3);
+	reg |= raw_val << 3;
+	cap1066_write_reg(client, SMSC_REG_LED_DIRECT_RAMP_RATE, reg);
+
+	priv->raw_ramp_time_rise = raw_val;
+
+	pr_debug(PFX "store_ramp_time_rise: reg = %02x\n", reg);
+	return count;
+}
+
+static ssize_t show_ramp_time_rise(struct device *dev,
+				   struct device_attribute *attr,
+				   char *buf)
+{
+	struct i2c_client *client;
+	struct cap1066_priv *priv;
+	unsigned long msec;
+
+	client = to_i2c_client(dev);
+	priv = i2c_get_clientdata(client);
+
+	msec = raw_ramp_time_to_msec(priv->raw_ramp_time_rise);
+
+	return sprintf(buf, "%lu\n", msec);
+}
+
+static ssize_t store_ramp_time_fall(struct device *dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t count)
+{
+	unsigned long val;
+	u8 raw_val;
+	struct i2c_client *client;
+	struct cap1066_priv *priv;
+	int error;
+	u8 reg;
+
+	client = to_i2c_client(dev);
+	priv = i2c_get_clientdata(client);
+
+	if (is_white(*buf))
+		return 1;
+
+	error = get_ulong(buf, count, &val);
+	if (error)
+		return error;
+
+	raw_val = msec_to_raw_ramp_time(val);
+
+	cap1066_read_reg(client, SMSC_REG_LED_DIRECT_RAMP_RATE, &reg);
+	reg &= ~0x7;
+	reg |= raw_val;
+	cap1066_write_reg(client, SMSC_REG_LED_DIRECT_RAMP_RATE, reg);
+
+	priv->raw_ramp_time_fall = raw_val;
+
+	pr_debug(PFX "store_ramp_time_rise: reg = %02x\n", reg);
+	return count;
+}
+
+static ssize_t show_ramp_time_fall(struct device *dev,
+				   struct device_attribute *attr,
+				   char *buf)
+{
+	struct i2c_client *client;
+	struct cap1066_priv *priv;
+	unsigned long msec;
+
+	client = to_i2c_client(dev);
+	priv = i2c_get_clientdata(client);
+
+	msec = raw_ramp_time_to_msec(priv->raw_ramp_time_fall);
+
+	return sprintf(buf, "%lu\n", msec);
+}
+
+#define MTOUCH_ENABLE		(1 << 7)
+#define MTOUCH_COUNT_MASK	(3 << 2)
+#define MTOUCH_COUNT_SHIFT	(2)
+
+/*
+ * touch limit handling: the hardware can report at most 1 to 4 key
+ * press event or no limit at all.
+ *
+ * Accepted values in touch_limit attribte:
+ * 0 -> no limit
+ * [1, 4] -> limit to the indicated count
+ * [4, +inf [ -> invalid
+ */
+static ssize_t store_touch_limit(struct device *dev,
+				 struct device_attribute *attr, const char *buf,
+				 size_t count)
+{
+	struct i2c_client *client;
+	unsigned long limit;
+	int err;
+	u8 mtouch_reg;
+
+	client = to_i2c_client(dev);
+
+	if (is_white(*buf))
+		return 1;
+
+	err = get_ulong(buf, count, &limit);
+	if (err)
+		return err;
+
+	if (limit > 4)
+		return -EINVAL;
+
+	if (limit == 0) {
+		mtouch_reg = 0;
+	} else {
+		mtouch_reg = MTOUCH_ENABLE |
+			((limit - 1) << MTOUCH_COUNT_SHIFT);
+	}
+	cap1066_write_reg(client, SMSC_REG_MTOUCH_CFG_REG, mtouch_reg);
+
+	return count;
+}
+
+static ssize_t show_touch_limit(struct device *dev,
+				struct device_attribute *attr,
+				char *buf)
+{
+	struct i2c_client *client;
+	u8 mtouch_reg;
+
+	client = to_i2c_client(dev);
+
+	cap1066_read_reg(client, SMSC_REG_MTOUCH_CFG_REG, &mtouch_reg);
+
+	if (mtouch_reg & MTOUCH_ENABLE) {
+		u8 count = (mtouch_reg & MTOUCH_COUNT_MASK) >>
+			MTOUCH_COUNT_SHIFT;
+		return sprintf(buf, "%d\n", count + 1);
+	} else {
+		return sprintf(buf, "0\n");
+	}
+}
+
+static DEVICE_ATTR(duty_cycle_min, S_IRUSR | S_IWUSR, show_duty_cycle_min,
+		   store_duty_cycle_min);
+
+static DEVICE_ATTR(duty_cycle_max, S_IRUSR | S_IWUSR, show_duty_cycle_max,
+		   store_duty_cycle_max);
+
+static DEVICE_ATTR(ramp_time_rise, S_IRUSR | S_IWUSR, show_ramp_time_rise,
+		   store_ramp_time_rise);
+
+static DEVICE_ATTR(ramp_time_fall, S_IRUSR | S_IWUSR, show_ramp_time_fall,
+		   store_ramp_time_fall);
+
+static DEVICE_ATTR(touch_limit, S_IWUSR | S_IRUSR, show_touch_limit,
+		   store_touch_limit);
+
+static struct device_attribute *cap1066_base_attributes[] = {
+	&dev_attr_duty_cycle_min,
+	&dev_attr_duty_cycle_max,
+	&dev_attr_ramp_time_rise,
+	&dev_attr_ramp_time_fall,
+	&dev_attr_touch_limit,
+};
+
+/*
+ * i2c core probe callback, called after sucessful detect
+ */
+static int cap1066_probe(struct i2c_client *client,
+			 const struct i2c_device_id *id)
+{
+	struct device_node *np = client->dev.of_node;
+	struct input_polled_dev *poll_dev;
+	struct input_dev *input;
+	struct cap1066_priv *priv;
+	struct reset_control *reset;
+	int ret, i;
+
+	priv = devm_kzalloc(&client->dev, sizeof (*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->irq_gpio = devm_gpiod_get_optional(&client->dev,
+						 "irq",
+						 GPIOD_IN);
+	if (IS_ERR(priv->irq_gpio)) {
+		ret = PTR_ERR(priv->irq_gpio);
+		if (ret != -EPROBE_DEFER)
+			dev_err(&client->dev,
+				"failed to get irq gpio :%d", ret);
+		return ret;
+	}
+
+	if (np) {
+		ret = of_property_read_u32_array(np,
+						 "keymap",
+						 priv->keymap,
+						 ARRAY_SIZE(priv->keymap));
+		if (ret < 0) {
+			dev_err(&client->dev,
+				"bad/missing keymap property: %d", ret);
+			return ret;
+		}
+	} else
+		memcpy(priv->keymap, default_map, sizeof (priv->keymap));
+
+	/* un-reset if needed */
+	reset = devm_reset_control_get_shared_by_index(&client->dev, 0);
+	if (IS_ERR(reset)) {
+		ret = PTR_ERR(reset);
+		if (ret == -ENOENT)
+			reset = NULL;
+		else if (ret != -EPROBE_DEFER){
+			dev_err(&client->dev, "failed to get reset: %d\n",
+				ret);
+			return ret;
+		}
+	}
+
+	if (reset && reset_control_status(reset)) {
+		reset_control_deassert(reset);
+		msleep(10);
+	}
+
+	ret = cap1066_detect(client, NULL);
+	if (ret) {
+		if (ret != -ENODEV)
+			return ret;
+
+		dev_warn(&client->dev, "unknown cap1x66 device, try anyway.\n");
+	}
+
+	/* initialize controller */
+	ret = cap1066_init_hw(client);
+	if (ret)
+		return ret;
+
+	/* allocate context */
+	poll_dev = input_allocate_polled_device();
+	if (!priv || !poll_dev) {
+		ret = -ENOMEM;
+		goto out_fail;
+	}
+
+	/*
+	 * must match what has been setup in cap1066_init_hw().
+	 */
+	priv->duty_cycle_min = DEFAULT_DUTY_CYCLE_MIN;
+	priv->duty_cycle_max = DEFAULT_DUTY_CYCLE_MAX;
+	priv->raw_ramp_time_rise = DEFAULT_RAMP_TIME_RISE;
+	priv->raw_ramp_time_fall = DEFAULT_RAMP_TIME_FALL;
+
+	priv->poll_dev = poll_dev;
+	priv->client = client;
+
+	poll_dev->private = priv;
+	poll_dev->poll = cap1066_input_poll;
+	poll_dev->poll_interval = 50 /* ms */;
+
+	input = poll_dev->input;
+	input->name = "smsc_cap1066";
+	input->phys = "smsc_cap1066/input0";
+	input->id.bustype = BUS_I2C;
+	input->dev.parent = &client->dev;
+
+	input->keycode = priv->keymap;
+	input->keycodemax = ARRAY_SIZE(priv->keymap);
+	input->keycodesize = sizeof (unsigned short);
+
+	set_bit(EV_REP, input->evbit);
+	set_bit(EV_KEY, input->evbit);
+	for (i = 0; i < ARRAY_SIZE(priv->keymap); i++)
+		set_bit(priv->keymap[i], input->keybit);
+
+	i2c_set_clientdata(client, priv);
+
+	ret = input_register_polled_device(poll_dev);
+	if (ret)
+		goto out_fail;
+
+	for (i = 0; i < ARRAY_SIZE(priv->keymap); ++i) {
+		if (!priv->keymap[i])
+			continue;
+		priv->led_devices[i] =
+			cap1066_create_led_dev(&client->dev,
+					       priv, i, priv->keymap[i]);
+	}
+
+	if (create_sysfs_files(&client->dev, cap1066_base_attributes,
+			       ARRAY_SIZE(cap1066_base_attributes)) < 0)
+		goto out_free_led_devs;
+
+	return 0;
+
+out_free_led_devs:
+	for (i = 0; i < ARRAY_SIZE(priv->keymap); ++i)
+		if (priv->led_devices[i])
+			cap1066_remove_led_dev(priv->led_devices[i]);
+out_fail:
+	input_free_polled_device(poll_dev);
+	i2c_set_clientdata(client, NULL);
+	return ret;
+}
+
+/*
+ * i2c core remove callback
+ */
+static int cap1066_remove(struct i2c_client *client)
+{
+	int i;
+	struct cap1066_priv *priv = i2c_get_clientdata(client);
+
+	for (i = 0; i < ARRAY_SIZE(cap1066_base_attributes); ++i)
+		device_remove_file(&client->dev, cap1066_base_attributes[i]);
+
+	for (i = 0; i < ARRAY_SIZE(priv->keymap); ++i) {
+		if (priv->led_devices[i])
+			cap1066_remove_led_dev(priv->led_devices[i]);
+	}
+
+	input_unregister_polled_device(priv->poll_dev);
+	input_free_polled_device(priv->poll_dev);
+
+	return 0;
+}
+
+static const struct of_device_id cap1066_of_table[] = {
+	{ .compatible = "smsc,smsc_cap1066" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, cap1066_of_table);
+
+static struct i2c_driver cap1066_driver = {
+	.driver = {
+		.name	= "cap1066",
+		.of_match_table	= of_match_ptr(cap1066_of_table),
+	},
+	.probe		= cap1066_probe,
+	.remove		= cap1066_remove,
+	.id_table	= cap1066_id,
+
+	.detect		= cap1066_detect,
+	.class		= I2C_CLASS_HWMON,
+	.address_list	= normal_i2c,
+};
+
+static int __init cap1066_init(void)
+{
+	return i2c_add_driver(&cap1066_driver);
+}
+
+static void __exit cap1066_exit(void)
+{
+	i2c_del_driver(&cap1066_driver);
+}
+
+
+MODULE_AUTHOR("Maxime Bizon <mbizon@freebox.fr>");
+MODULE_DESCRIPTION("SMSC CAP1066 driver");
+MODULE_LICENSE("GPL");
+
+module_init(cap1066_init);
+module_exit(cap1066_exit);
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/drivers/leds/leds-led1202.c	2021-03-04 13:20:58.650838927 +0100
@@ -0,0 +1,909 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * LED driver : leds-led1202.c
+ *
+ * Copyright (C) 2019 Freebox SAS
+ * Henri Buyse <hbuyse@freebox.com>
+ */
+
+#include <linux/i2c.h>
+#include <linux/input.h>
+#include <linux/kernel.h>
+#include <linux/leds.h>
+#include <linux/module.h>
+#include <linux/of_device.h>
+#include <linux/of_irq.h>
+#include <linux/interrupt.h>
+#include <linux/regmap.h>
+
+/**
+ * @brief Maximal number of LEDs that can be driven by the LED1202
+ *
+ */
+#define LED1202_MAX_LEDS 12
+#define LED1202_FORM_DEVICE_ID(prod_id, rev_id)                                \
+	((unsigned int)(((prod_id) << 4) | (rev_id)))
+
+/**
+ * @brief Register addresses
+ */
+#define LED1202_REG_DEVICE_ID 0x00
+#define LED1202_REG_DEVICE_ENABLE 0x01
+#define LED1202_REG_DEVICE_ENABLE_ENABLE_MASK 1
+#define LED1202_REG_DEVICE_ENABLE_RESET_MASK (1 << 7)
+#define LED1202_REG_CHANNEL_ENABLE_LOW 0x02
+#define LED1202_REG_CHANNEL_ENABLE_HIGH 0x03
+#define LED1202_REG_CONFIGURATION 0x04
+#define LED1202_REG_CONFIGURATION_PATSR_MASK (1 << 6)
+#define LED1202_REG_CONFIGURATION_PATS_MASK (1 << 7)
+#define LED1202_REG_FAULT_STATUS_MASK 0x05
+#define LED1202_REG_FAULT_STATUS_INTERRUPT 0x06
+#define LED1202_REG_OPEN_LED_LOW 0x07
+#define LED1202_REG_OPEN_LED_HIGH 0x08
+#define LED1202_REG_CSX_LED_CURRENT(led_no) (0x09 + (led_no)) // 0x09 -> 0x14
+#define LED1202_REG_PATTERN_SEQUENCE_REPETITION 0x15
+#define LED1202_REG_PATTERN_Y_DURATION_TIME(pattern)                           \
+	(0x16 + (pattern)) // 0x16 -> 0x1d
+// 0x1e -> 0xdd
+#define LED1202_REG_PATTERN_Y_CSX_PWM_LOW(led_no, pattern)                     \
+	(0x1e + (2 * (led_no)) +                                               \
+	 (0x18 * (pattern))) // See table 22 in led1202 datasheet
+#define LED1202_REG_PATTERN_Y_CSX_PWM_HIGH(led_no, pattern)                    \
+	(0x1e + 0x01 + (2 * (led_no)) +                                        \
+	 (0x18 * (pattern))) // See table 23 in led1202 datasheet
+// 0xde ?
+// 0xdf ?
+#define LED1202_REG_CLOCK_CONFIGURATION 0xe0
+
+#define LED1202_MAX_PATTERNS 8
+#define LED1202_DELTA_T_MIN 23 // 22.2ms
+#define LED1202_DELTA_T_MAX 5660 // 255 * 22.2
+#define LED1202_MAX_INTERRUPTS_NB                                              \
+	15 // Overtemperature + all open led (12) + pattern finished + start of pwm frame
+
+#define LED1202_INTERRUPT_CHIP_OVER_TEMPERATURE 0x000001
+#define LED1202_INTERRUPT_OPEN_LED_DETECTION 0x000002
+#define LED1202_INTERRUPT_PATTERN_SEQUENCE_FINISHED 0x000004
+#define LED1202_INTERRUPT_START_OF_PWM_FRAME 0x000008
+
+#define LED1202_INTERRUPT_OPEN_LED_CS0 0x00010000
+#define LED1202_INTERRUPT_OPEN_LED_CS1 0x00020000
+#define LED1202_INTERRUPT_OPEN_LED_CS2 0x00040000
+#define LED1202_INTERRUPT_OPEN_LED_CS3 0x00080000
+#define LED1202_INTERRUPT_OPEN_LED_CS4 0x00100000
+#define LED1202_INTERRUPT_OPEN_LED_CS5 0x00200000
+#define LED1202_INTERRUPT_OPEN_LED_CS6 0x00400000
+#define LED1202_INTERRUPT_OPEN_LED_CS7 0x00800000
+#define LED1202_INTERRUPT_OPEN_LED_CS8 0x01000000
+#define LED1202_INTERRUPT_OPEN_LED_CS9 0x02000000
+#define LED1202_INTERRUPT_OPEN_LED_CS10 0x04000000
+#define LED1202_INTERRUPT_OPEN_LED_CS11 0x08000000
+
+#define ldev_to_led(class) container_of(class, struct led1202_led, ldev)
+
+struct led1202_led {
+	// bool active;
+	bool enable;
+	unsigned int led_no;
+	unsigned int reg;
+	struct led_classdev ldev;
+	struct led1202_priv *priv;
+};
+
+struct led1202_priv {
+	struct i2c_client *client;
+	struct regmap *regmap;
+	struct input_dev *idev;
+
+	const struct led1202_hw_model *model;
+
+	struct led1202_led *leds;
+	unsigned int num_leds;
+};
+
+struct led1202_hw_model {
+	unsigned int max_leds;
+	unsigned int product_id;
+	unsigned int revision_id;
+};
+
+static const struct led1202_hw_model led1202_models[] = {
+	{ .max_leds = 12, .product_id = 0x01, .revision_id = 0x02 },
+};
+
+static const struct regmap_config led1202_regmap_config = {
+	.reg_bits = 8, // Number of bits in a register address, mandatory.
+	.val_bits = 8, // Number of bits in a register value, mandatory.
+	.max_register =
+		LED1202_REG_CLOCK_CONFIGURATION, // Maximal register addr: Clock configuration register
+	.can_multi_write = true, // to write multiple values in one row
+};
+
+/**
+ * @brief Enable / disable the LED1202 device.
+ *
+ * @param priv LED1202 structure handling the regmap.
+ *
+ * @return A value of zero will be returned on success, a negative errno will
+ * be returned in error cases.
+ */
+static int led1202_activate_device(struct led1202_priv *priv, bool activation)
+{
+	int err = -1;
+	struct device *dev = &priv->client->dev;
+
+	// activate/deactivate device
+	err = regmap_update_bits(priv->regmap, LED1202_REG_DEVICE_ENABLE, 
+				 LED1202_REG_DEVICE_ENABLE_ENABLE_MASK,
+				 (activation) ? 
+				 LED1202_REG_DEVICE_ENABLE_ENABLE_MASK : 
+				 0);
+
+	if (err < 0)
+		dev_err(dev, "can't %s the device (reg: 0x%02x)\n",
+			(activation) ? "enable" : "disable",
+			LED1202_REG_DEVICE_ENABLE);
+	else
+		dev_dbg(dev, "device %s\n", (activation) ? "enabled" : "disabled");
+
+	return err;
+}
+
+/**
+ * @brief Reset the LED1202 device.
+ *
+ * @param priv LED1202 structure handling the regmap.
+ *
+ * @return A value of zero will be returned on success, a negative errno will
+ * be returned in error cases.
+ */
+static int led1202_reset_device(struct led1202_priv *priv)
+{
+	int err = -1;
+	struct device *dev = &priv->client->dev;
+
+	// reset the device
+	err = regmap_update_bits(priv->regmap, LED1202_REG_DEVICE_ENABLE, 
+				 LED1202_REG_DEVICE_ENABLE_RESET_MASK,
+				 LED1202_REG_DEVICE_ENABLE_RESET_MASK);
+
+	if (err < 0)
+		dev_err(dev, "can't reset the device (reg: 0x%02x)\n",
+			LED1202_REG_DEVICE_ENABLE);
+	else
+		dev_dbg(dev, "device resetted\n");
+
+	return err;
+}
+
+/**
+ * @brief Enable a LED.
+ *
+ * @param led Structure handling a led
+ *
+ * @return On success, returns 0. On error, returns -1.
+ */
+static int led1202_channel_enable(struct led1202_led *led, bool state)
+{
+	int ret = -1;
+	struct led1202_priv *priv = led->priv;
+	struct device *dev = &priv->client->dev;
+	const char *led_name = led->ldev.name;
+	unsigned int led_no = led->led_no;
+	unsigned int reg = led->reg;
+	unsigned int addr = 0;
+	unsigned int mask = 0;
+	unsigned int val = 0;
+
+	if (led_no >= priv->num_leds) {
+		return -EINVAL; // Invalid argument
+	}
+
+	// Check if the LED is already enable/disabled
+	if (led->enable == state) {
+		dev_dbg(dev, "led %s is already %s\n", led->ldev.name, (state) ? "enabled":"disabled");
+		return 0;
+	}
+
+	addr = (reg < 8) ? LED1202_REG_CHANNEL_ENABLE_LOW :
+			   LED1202_REG_CHANNEL_ENABLE_HIGH;
+	mask = (reg < 8) ? (1 << reg) : (1 << (reg - 8));
+	val = (reg < 8) ? (state << reg) : (state << (reg - 8));
+
+	if ((ret = regmap_update_bits(led->priv->regmap, addr, mask, val)) < 0) {
+		dev_err(dev,
+			"can't enable %s led (#%d, reg: 0x%02x, mask: 0x%02x)\n",
+			led_name, reg, addr, mask);
+	} else {
+		led->enable = state;
+		dev_dbg(dev, "channel %s %s\n", led_name, (state) ? "enabled":"disabled");
+	}
+
+	return ret;
+}
+
+/**
+ * @brief Callback that set the brightness of a led.
+ * @details To modify the brightness of a led, we have to pass throught the
+ *          /sys/class/leds/<label>/brightness file (where <label> is the one
+ *          given in the devicetree)
+ * 	    led1202 chipset has two main methods for dimming LED light: changing 
+ * 	    the output DC current value (analog dimming) or modifying the output 
+ * 	    current duty-cycle (digital dimming).
+ * 	    We chose to use only the digital dimming, analog dimming is set to
+ * 	    maximum during setup
+ *
+ * @param led_cdev Pointer to the class of led
+ * @param brightness The brightness
+ *
+ * @return On succes, returns 0. On error, return negative value.
+ */
+static int led1202_brightness_set(struct led_classdev *led_cdev,
+				  enum led_brightness brightness)
+{
+	int err, pattern_i;
+	struct led1202_led *led = ldev_to_led(led_cdev);
+	struct led1202_priv *priv = led->priv;
+	struct device *dev = &priv->client->dev;
+	u16 pwm_value = brightness << 4; // PWM range is 0-4095
+	
+	if (led->led_no >= priv->num_leds) {
+		dev_err(dev, "unknown led number: %d\n", led->led_no);
+		return -EINVAL;
+	}
+
+	// set pwm values for all pattern
+	for (pattern_i = 0; pattern_i < LED1202_MAX_PATTERNS; pattern_i++) {
+		err = regmap_write(priv->regmap,
+				   LED1202_REG_PATTERN_Y_CSX_PWM_LOW(led->reg, 
+								     pattern_i),
+				   (u8)pwm_value);
+
+		err = regmap_write(priv->regmap,
+				   LED1202_REG_PATTERN_Y_CSX_PWM_HIGH(led->reg, 
+								      pattern_i),
+				   (u8)(pwm_value >> 8));
+
+		if (err < 0)
+			dev_err(dev, "can't set %s's brightness to %d: %d\n", 
+				led->ldev.name,
+				brightness,
+				err);
+	}
+
+	if (err == 0) {
+		dev_dbg(dev, "%s brightness set to %d\n", led->ldev.name, 
+			brightness);
+
+		// enable or disable LED if necessary
+		if (brightness == LED_OFF)
+			err = led1202_channel_enable(led, false);
+		else
+			err = led1202_channel_enable(led, true);
+	}
+
+	return err;
+}
+
+/**
+ * @brief Clear pattern for led
+ * @note To clear a led pattern with led1202 we wrote its brigthness value
+ * 	 in all step of the current pattern. Thus, even if any other led is 
+ * 	 using a pattern, this led's brightness will keep the correct value
+ *
+ * @param led_cdev
+ * @return On success, return 0. On error, return -1.
+ */
+static int led1202_pattern_clear(struct led_classdev *led_cdev)
+{
+	struct led1202_led *led = ldev_to_led(led_cdev);
+	struct led1202_priv *priv = led->priv;
+	struct device *dev = &priv->client->dev;
+	unsigned char brightness = led_cdev->brightness;
+	int pattern_i, err;
+	u16 pwm_value = brightness << 4; // PWM range is 0-4095
+
+	// reset all pattern PWM values to brigthness value
+	for (pattern_i = 0; pattern_i < LED1202_MAX_PATTERNS; pattern_i++) {
+		err = regmap_write(priv->regmap,
+				   LED1202_REG_PATTERN_Y_CSX_PWM_LOW(led->reg, pattern_i),
+				   (u8)pwm_value);
+
+		err = regmap_write(priv->regmap,
+				   LED1202_REG_PATTERN_Y_CSX_PWM_HIGH(led->reg, pattern_i),
+				   (u8)(pwm_value >> 8));
+		
+		if (err)
+			dev_err(dev, "can't set %s's pwm to %d for pattern %d\n",
+				led->ldev.name, brightness, pattern_i);
+	}
+
+	if (err == 0)
+		dev_dbg(dev, "all %s's patterns set to %d\n", led->ldev.name, 
+			brightness);
+
+	return err;
+}
+
+static int led1202_pattern_sequence_enable(struct led1202_priv *priv, bool enable)
+{
+	struct device *dev = &priv->client->dev;
+	int err = -1;
+	unsigned int mask = LED1202_REG_CONFIGURATION_PATS_MASK | 
+			    LED1202_REG_CONFIGURATION_PATSR_MASK;
+
+	// First make sure sequence are enabled
+	err = regmap_update_bits(priv->regmap, LED1202_REG_CONFIGURATION, mask, 
+							 (enable) ? mask : 0);
+	
+	if (err < 0)
+		dev_err(dev, "cannot set PATSR and PATS bit\n");
+	else
+		dev_dbg(dev, "pattern sequence %s\n", (enable) ? "enabled" : 
+								 "disabled");
+
+	return err;
+}
+
+/**
+ * @brief Set the number of repetition for the patterns.
+ * @details We set the number of repetitions for our patterns.
+ *          One repetition is when we pass through all the patterns.
+ *
+ * @param regmap The register map
+ * @param repeat The number of patterns repetitions
+ *
+ * @return On success, returns 0. Negative errno on error.
+ */
+static int led1202_pattern_set_repetition(struct led1202_priv *priv, int repeat)
+{
+	struct device *dev = &priv->client->dev;
+	int err = -1;
+
+	// valid values are 0-255 and -1
+	// -1 and 255 means infinite
+	if (repeat < -1 || repeat == 0 || repeat > 255) {
+		dev_dbg(dev, "can't set pattern repetitions to %d\n", repeat);
+		return -EINVAL;
+	}
+	
+	if (repeat == -1)
+		repeat = 255;
+
+	err = regmap_write(priv->regmap, LED1202_REG_PATTERN_SEQUENCE_REPETITION, 
+			   repeat);
+	
+	if (err < 0)
+		dev_err(dev, "can't set pattern repetition to %d (reg: 0x%02x)\n",
+			repeat, LED1202_REG_PATTERN_SEQUENCE_REPETITION);
+	else
+		dev_dbg(dev, "patterns repetition set to %d\n", repeat);
+
+	return err;
+}
+
+static int led1202_check_pattern_duration_min_max(struct led_pattern *pattern,
+						  u32 len)
+{
+	int i = 0;
+
+	for (i = 0; i < len; i++) {
+		if (pattern[i].delta_t < LED1202_DELTA_T_MIN ||
+		    pattern[i].delta_t > LED1202_DELTA_T_MAX) {
+			printk(KERN_ERR
+			       "The deltas has to be between 23 and 5660 ms.\n");
+			return -1;
+		}
+	}
+	return 0;
+}
+
+/**
+ * @brief Set a pattern for a LED.
+ *
+ * @param led_cdev The class led
+ * @param pattern Array of patterns
+ * @param len Size of the array
+ * @param repeat Number of repetitions
+ *
+ * @return On success, returns 0. Negative errno on error.
+ */
+static int led1202_pattern_set(struct led_classdev *led_cdev,
+			       struct led_pattern *pattern, u32 len, int repeat)
+{
+	int i = 0, err;
+	struct led1202_led *led = ldev_to_led(led_cdev);
+	struct led1202_priv *priv = led->priv;
+	struct device *dev = &priv->client->dev;
+
+	if (led->led_no >= priv->num_leds) {
+		dev_err(dev, "Unknown led number: %d\n", led->led_no);
+		return -EINVAL;
+	}
+
+	if (len > LED1202_MAX_PATTERNS) {
+		dev_err(dev, "Cannot set more than 8 patterns for led %s\n",
+			led->ldev.name);
+		return -EINVAL;
+	}
+
+	if (led1202_check_pattern_duration_min_max(pattern, len) == -1) {
+		return -EINVAL;
+	}
+
+	// fill reg values for pwm_values
+	for (i = 0; i < len; i++) {
+		// brightness range is 0-255, pwm_value range is 0-4095
+		u16 pwm_value = pattern[i].brightness << 4;
+		//pwm_value = cpu_to_be16(pwm_value);
+
+		err = regmap_write(priv->regmap,
+				   LED1202_REG_PATTERN_Y_CSX_PWM_LOW(led->reg, i),
+				   (u8)pwm_value);
+
+		err = regmap_write(priv->regmap,
+				   LED1202_REG_PATTERN_Y_CSX_PWM_HIGH(led->reg, i),
+				   (pwm_value >> 8));
+
+		if (err)
+			dev_err(dev, "can't set led %s's pattern: %d\n", 
+				led->ldev.name, err);
+	}
+
+	// fill reg values for durations
+	for (i = 0; i < len; i++) {
+		u8 delta = (u8)(pattern[i].delta_t / LED1202_DELTA_T_MIN);
+
+		err = regmap_write(priv->regmap,
+				   LED1202_REG_PATTERN_Y_DURATION_TIME(i), 
+				   delta);
+
+		if (err)
+			dev_err(dev, "can't set led %s's duration: %d\n", 
+				led->ldev.name, err);
+	}
+
+	if (err == 0)
+		dev_dbg(dev, "led %s's pattern set\n", led->ldev.name);
+
+	led1202_channel_enable(led, true);
+	led1202_pattern_set_repetition(priv, repeat);
+
+	// disable then reenable sequence to update it
+	led1202_pattern_sequence_enable(priv, false);
+	led1202_pattern_sequence_enable(priv, true);
+
+	return err;
+}
+
+/**
+ * @brief Remove the driver for the device LED1202
+ * @details Remove the leds devices from the /sys/class/leds/...
+ *
+ * @param priv Private data for the LED1202 device
+ * @param j The number of leds to unregister
+ */
+static void led1202_destroy_devices(struct led1202_priv *priv)
+{
+	int i = priv->num_leds;
+
+	while (--i >= 0) {
+		// remove trigger + stop software blinking + set brightness to 0
+		led_classdev_unregister(&priv->leds[i].ldev);
+	}
+}
+
+static int led1202_leds_setup(struct device *dev, struct led1202_priv *priv,
+			      int max_leds)
+{
+	struct device_node *node = dev->of_node, *child;
+	struct led1202_led *led;
+	unsigned int led_en_reg;
+	int cnt = of_get_child_count(node);
+	int err;
+
+	if (!max_leds || !cnt)
+		return 0;
+
+	if (cnt > max_leds)
+		return -EINVAL;
+
+	led = devm_kcalloc(dev, cnt, sizeof(struct led1202_led), GFP_KERNEL);
+	if (!led)
+		return -ENOMEM;
+
+	priv->leds = led;
+
+	// get enable register to reproduce state in ldev struct
+	regmap_read(priv->regmap, LED1202_REG_CHANNEL_ENABLE_HIGH, &led_en_reg);
+	led_en_reg = led_en_reg << 8;
+	regmap_read(priv->regmap, LED1202_REG_CHANNEL_ENABLE_LOW, &led_en_reg);
+
+	for_each_child_of_node (node, child) {
+		u32 reg;
+		unsigned int pwm_value;
+
+		led->ldev.name =
+			of_get_property(child, "label", NULL) ?: child->name;
+		led->ldev.flags = 0;
+		led->ldev.brightness_set_blocking = led1202_brightness_set;
+		led->ldev.max_brightness = LED_FULL;
+		led->ldev.default_trigger =
+			of_get_property(child, "linux,default-trigger", NULL);
+		led->ldev.pattern_set = led1202_pattern_set;
+		led->ldev.pattern_clear = led1202_pattern_clear;
+
+		err = of_property_read_u32(child, "reg", &reg);
+		if (err != 0 || reg >= max_leds) {
+			of_node_put(child);
+			return -EINVAL;
+		}
+
+		led->reg = reg;
+		led->led_no = priv->num_leds;
+		led->priv = priv;
+		led->enable = ((1 << reg) & led_en_reg) ? true : false;
+
+		// get current brigthness (pattern 0 value)
+		regmap_read(priv->regmap, 
+			    LED1202_REG_PATTERN_Y_CSX_PWM_HIGH(reg, 0), &pwm_value);
+		pwm_value = pwm_value << 8;
+		regmap_read(priv->regmap, 
+			    LED1202_REG_PATTERN_Y_CSX_PWM_LOW(reg, 0), &pwm_value);
+
+		// brightness range is 0-255 whereas pwm_value's is 0-4095
+		led->ldev.brightness = pwm_value >> 4;
+
+		// settings analog dimming to maximum by default
+		// more details in led1202_brightness_set
+		if ((err = regmap_write(priv->regmap,
+				LED1202_REG_CSX_LED_CURRENT(led->reg),
+				led->ldev.max_brightness)) == -1) {
+			dev_err(dev,
+				"can't set %s's current (0x%02x, %d)\n",
+				led->ldev.name, 
+				LED1202_REG_CSX_LED_CURRENT(led->reg),
+				led->ldev.max_brightness);
+		}
+
+		// register this led to kernel
+		err = led_classdev_register(dev, &led->ldev);
+		if (err) {
+			of_node_put(child);
+			dev_err(dev, "can't register LED %s\n", led->ldev.name);
+			led1202_destroy_devices(priv);
+			return err;
+		}
+
+		// Increment before disabling otherwise it would not turn off the current led.
+		priv->num_leds++;
+
+		// Move pointer
+		led++;
+	}
+
+	return 0;
+}
+
+static irqreturn_t led1202_on_interrupt_handler(int irq_num, void *data)
+{
+	struct led1202_priv *priv = data;
+	struct device *dev = &priv->client->dev;
+	unsigned int val = 0;
+	int input_val = 0;
+	int err = -1;
+
+	err = regmap_read(priv->regmap, LED1202_REG_FAULT_STATUS_INTERRUPT, &val);
+	if (err) {
+		dev_err(dev,
+			"can't read fault and status interrupt register 0x%02x\n",
+			LED1202_REG_FAULT_STATUS_INTERRUPT);
+		goto out;
+	}
+
+	dev_dbg(dev, "interrupt catched, interrupt reg: 0x%02x\n", val);
+
+	// check overtemperature
+	if ((val >> 0) & 1) {
+		dev_err(dev, "chip overtemperature protection reached\n");
+		input_val |= LED1202_INTERRUPT_CHIP_OVER_TEMPERATURE;
+	}
+
+	// check open LED
+	if ((val >> 1) & 1) {
+		unsigned int i;
+		unsigned int read_val;
+
+		input_val |= LED1202_INTERRUPT_OPEN_LED_DETECTION;
+
+		// read the open led low register
+		err = regmap_read(priv->regmap, LED1202_REG_OPEN_LED_LOW, &read_val);
+		if (err) {
+			dev_err(dev,
+				"can't read open led detection register 0x%02x\n",
+				LED1202_REG_OPEN_LED_LOW);
+			goto out;
+		}
+
+		for (i = 0; i < 8; i++) {
+			if ((read_val >> i) & 1) {
+				input_val |= 1 << (16 + i);
+			}
+		}
+
+		// read the open led high register
+		err = regmap_read(priv->regmap, LED1202_REG_OPEN_LED_HIGH, &read_val);
+		if (err) {
+			dev_err(dev,
+				"can't read open led detection register 0x%02x\n",
+				LED1202_REG_OPEN_LED_HIGH);
+			goto out;
+		}
+
+		for (i = 0; i < 8; i++) {
+			if ((read_val >> i) & 1) {
+				input_val |= 1 << (24 + i);
+			}
+		}
+	}
+
+	// Check pattern sequence finished
+	if ((val >> 2) & 1) {
+		dev_dbg(dev, "pattern sequence finished\n");
+		input_val |= LED1202_INTERRUPT_PATTERN_SEQUENCE_FINISHED;
+
+		// disable pattern to avoid led1202 keeping all output OFF
+		led1202_pattern_sequence_enable(priv, false);
+	}
+
+	// Check start of PWM frame
+	if ((val >> 3) & 1) {
+		dev_dbg(dev, "start of PWM frame\n");
+		input_val |= LED1202_INTERRUPT_START_OF_PWM_FRAME;
+	}
+
+	input_event(priv->idev, EV_MSC, MSC_RAW, input_val);
+	input_sync(priv->idev);
+
+out:
+	return IRQ_HANDLED;
+}
+
+/**
+ * @brief Setup the interrupt register based on the device tree.
+ *
+ * @param priv private data
+ *
+ * @return On success, returns 0. Negative errno on error.
+ */
+static int led1202_irq_setup(struct led1202_priv *priv)
+{
+	struct device *dev = &priv->client->dev;
+	struct device_node *np = dev->of_node;
+	int irq, error;
+	unsigned int val = 0;
+
+	if (!of_property_read_bool(np, "st,overtemperature-protection")) {
+		dev_dbg(dev,
+			"Interrupt masked on over temperature protection\n");
+		val |= 1 << 0;
+	}
+
+	if (!of_property_read_bool(np, "st,open-led-detection")) {
+		dev_dbg(dev, "Interrupt masked on open led detection\n");
+		val |= 1 << 1;
+	}
+
+	if (!of_property_read_bool(np, "st,on-pattern-sequence-interrupt")) {
+		dev_dbg(dev, "Interrupt masked on pattern sequence finished\n");
+		val |= 1 << 2;
+	}
+
+	if (!of_property_read_bool(np, "st,start-pwm-frame-interrupt")) {
+		dev_dbg(dev, "Interrupt masked on start on pwm frame\n");
+		val |= 1 << 3;
+	}
+
+	error = regmap_write(priv->regmap, LED1202_REG_FAULT_STATUS_MASK, val);
+	if (error) {
+		dev_err(dev,
+			"Could not write value 0x%02x to the register 0x%02x\n",
+			val, LED1202_REG_FAULT_STATUS_MASK);
+		return error;
+	}
+
+	if (val != 0x0f) {
+		irq = irq_of_parse_and_map(np, 0);
+		if (!irq) {
+			dev_err(dev, "Unable to parse or map IRQ\n");
+			return -ENXIO;
+		}
+
+		error = devm_request_threaded_irq(dev, irq, NULL,
+						  led1202_on_interrupt_handler,
+						  IRQF_ONESHOT, dev_name(dev),
+						  priv);
+		if (error) {
+			dev_err(dev, "Error with devm_request_threaded_irq\n");
+			return error;
+		}
+
+		dev_dbg(dev, "led1202_on_interrupt_handler started\n");
+	}
+
+	return 0;
+}
+
+/**
+ * @brief Setup the input character device.
+ *
+ * @param priv private data
+ *
+ * @return On success, returns 0. Negative errno on error.
+ */
+static int led1202_input_setup(struct led1202_priv *priv)
+{
+	struct device *dev = &priv->client->dev;
+	int error;
+
+	priv->idev = devm_input_allocate_device(dev);
+	if (!priv->idev)
+		return -ENOMEM;
+
+	priv->idev->name = "STMicroElectonics LED1202 Interruptions";
+	priv->idev->id.bustype = BUS_I2C;
+	priv->idev->evbit[0] = BIT_MASK(EV_MSC);
+
+	// We will use the same input event code but with different values.
+	// Those values will be a mask of value representing the differents interruptions
+	// and the open leds
+	__set_bit(MSC_RAW, priv->idev->mscbit);
+
+	priv->idev->id.vendor = I2C_DEVICE_ID_STMICROELECTRONICS;
+	priv->idev->id.product = priv->model->product_id;
+	priv->idev->id.version = priv->model->revision_id;
+
+	input_set_drvdata(priv->idev, priv);
+
+	error = input_register_device(priv->idev);
+	if (error)
+		return error;
+
+	return 0;
+}
+
+static const struct of_device_id led1202_of_table[] = {
+	{ .compatible = "st,led1202", .data = &led1202_models[0] },
+	{},
+};
+MODULE_DEVICE_TABLE(of, led1202_of_table);
+
+/**
+ * @brief Insert the module inside the kernel
+ *
+ * @param client The I2C client
+ * @param id The I2C device ID name
+ *
+ * @return
+ */
+static int led1202_probe(struct i2c_client *client)
+{
+	struct device_node *np = client->dev.of_node;
+	struct device *dev = &client->dev;
+	const struct of_device_id *match;
+	const struct led1202_hw_model *model;
+	struct led1202_priv *priv;
+	int err, count;
+	unsigned int val;
+
+	if (!np)
+		return -ENODEV;
+
+	match = of_match_device(led1202_of_table, dev);
+	if (!match)
+		return -ENODEV;
+
+	model = match->data;
+	count = of_get_child_count(np);
+	if ((!count) || (count > model->max_leds))
+		return -EINVAL;
+
+	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	// Keep the model pointer inside the private data.
+	priv->num_leds = 0;
+	priv->client = client;
+	priv->model = model;
+
+	// Initialise managed register map
+	priv->regmap = devm_regmap_init_i2c(client, &led1202_regmap_config);
+	if (IS_ERR(priv->regmap)) {
+		err = PTR_ERR(priv->regmap);
+		dev_err(dev, "Failed to allocate register map: %d\n", err);
+		return err;
+	}
+
+	// Read the device ID register and compare it to the one store in the model
+	// to be sure that we communicate with the correct device.
+	err = regmap_read(priv->regmap, LED1202_REG_DEVICE_ID, &val);
+	if (err) {
+		dev_err(dev, "Could not read the device id register.\n");
+		return err;
+	}
+
+	if (val !=
+	    LED1202_FORM_DEVICE_ID(model->product_id, model->revision_id)) {
+		dev_err(dev, "Device ID: Got 0x%x, expected 0x%x\n", val,
+			LED1202_FORM_DEVICE_ID(model->product_id,
+					       model->revision_id));
+		return -ENXIO;
+	}
+
+	dev_dbg(dev, "ST component with device_id 0x%02x connected\n",
+		LED1202_FORM_DEVICE_ID(model->product_id, model->revision_id));
+
+	i2c_set_clientdata(client, priv);
+
+	// Create the led nodes
+	if ((err = led1202_leds_setup(dev, priv, model->max_leds))) {
+		return err;
+	}
+
+	if ((err = led1202_irq_setup(priv))) {
+		return err;
+	}
+
+	if ((err = led1202_input_setup(priv))) {
+		dev_err(dev, "Error while setting the input\n");
+		return err;
+	}
+
+	// Activate the device
+	led1202_activate_device(priv, true);
+
+	return 0;
+}
+
+/**
+ * @brief Remove the module from the kernel
+ *
+ * @param client The I2C client
+ *
+ * @return int
+ */
+static int led1202_remove(struct i2c_client *client)
+{
+	struct led1202_priv *priv = i2c_get_clientdata(client);
+	struct device *dev = &client->dev;
+
+	// Unregister all leds
+	led1202_destroy_devices(priv);
+
+	// Deactivate the device
+	led1202_activate_device(priv, false);
+
+	// Reset the device
+	led1202_reset_device(priv);
+
+	// Print that the module has been removed
+	dev_dbg(dev, "Remove driver LED1202\n");
+
+	return 0;
+}
+
+static struct i2c_driver led1202_driver = {
+  .driver = {
+    .name = "led1202",
+    .of_match_table = of_match_ptr(led1202_of_table),
+  },
+  .probe_new = led1202_probe,
+  .remove = led1202_remove,
+};
+
+module_i2c_driver(led1202_driver);
+
+MODULE_AUTHOR("Henri Buyse <hbuyse@freebox.com>");
+MODULE_DESCRIPTION("STMicroElectronics LED1202 LED driver");
+MODULE_LICENSE("GPL");
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/drivers/mfd/fbxgw7r-panel.c	2021-03-04 13:20:58.887505605 +0100
@@ -0,0 +1,980 @@
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/sched.h>
+#include <linux/spi/spi.h>
+#include <linux/workqueue.h>
+#include <linux/uaccess.h>
+#include <linux/input-polldev.h>
+#include <linux/gpio.h>
+#include <linux/fb.h>
+#include <linux/platform_device.h>
+#include <linux/vmalloc.h>
+#include <linux/of_device.h>
+#include <linux/reset.h>
+
+/*
+ * uc registers & commands
+ */
+#define UC_CMD_WRITE			0x1
+#define UC_CMD_READ			0x2
+
+#define UC_REG_LEDx_MATRIX(x)		(0x0 + (x))
+#define UC_REG_LED_MATRIX_BRIGHTNESS	0x20
+#define UC_REG_LED_MATRIX_REFRESH	0x21
+#define UC_REG_KEY_STATUS		0x30
+#define UC_REG_PROXIMITY_STATUS		0x31
+#define UC_REG_PROXIMITY_THRESH		0x32
+#define UC_REG_PROXIMITY_HYSTERESIS	0x33
+#define UC_REG_IRQ_STAT			0x40
+#define UC_IRQ_KEYPAD_MASK		(1 << 0)
+#define UC_IRQ_PROXIMITY_MASK		(1 << 1)
+#define UC_REG_IRQ_MASK			0x41
+#define UC_REG_LEDx_MODE(x)		(0x50 + (x) * 0x10)
+#define UC_REG_LEDx_MIN_BRIGHT(x)	(0x51 + (x) * 0x10)
+#define UC_REG_LEDx_MAX_BRIGHT(x)	(0x52 + (x) * 0x10)
+#define UC_REG_LEDx_BLINK_RATE(x)	(0x53 + (x) * 0x10)
+#define UC_REG_LEDx_TRANS_RATE(x)	(0x54 + (x) * 0x10)
+#define UC_REG_VERSION			0x90
+#define UC_REG_LED_MATRIX_TEST_TYPE	0xa0
+#define UC_REG_LED_MATRIX_TEST_CTRL	0xa1
+#define UC_REG_LEDx_MATRIX_TEST_RES(x)	(0xa8 + (x))
+#define UC_REG_LED_MATRIX_THERM_ERR	0xbe
+#define UC_REG_LIFETIME			0xC0
+
+#define PANEL_COLS		24
+#define PANEL_ROWS		7
+#define PANEL_RAM_SIZE		(PANEL_COLS * PANEL_ROWS / 8)
+#define PANEL_KEY_COUNT		4
+
+/*
+ * private context
+ */
+struct fbx_panel {
+	struct spi_device		*spi;
+	unsigned long			spi_last_xfer_jiffies;
+	struct timespec64		spi_last_xfer_ts;
+	struct gpio_desc		*irq_gpio;
+
+	/*
+	 * input related
+	 */
+	struct input_polled_dev		*poll_dev;
+	u32				keymap[PANEL_KEY_COUNT];
+	bool				key_was_pressed;
+
+	/*
+	 * frame buffer related
+	 */
+
+	/* data ram, 8 bits per pixel */
+	u8				*vmem;
+	unsigned int			vmem_size;
+
+	struct fb_info			*fb;
+};
+
+/*
+ * fbinfo
+ */
+static struct fb_fix_screeninfo fbx_panel_fb_fix = {
+	.id		= "fbxgw7r-panel",
+	.type		= FB_TYPE_PACKED_PIXELS,
+	.visual		= FB_VISUAL_STATIC_PSEUDOCOLOR,
+	.xpanstep	= 0,
+	.ypanstep	= 1,
+	.ywrapstep	= 0,
+	.accel		= FB_ACCEL_NONE,
+};
+
+static struct fb_var_screeninfo fbx_panel_fb_var = {
+	.bits_per_pixel	= 8,
+	.grayscale	= 1,
+	.nonstd		= 1,
+	.red.length	= 8,
+	.green.length	= 8,
+	.blue.length	= 8,
+};
+
+/*
+ * ensure proper spacing of SPI command
+ * uc needs at least 150us between them
+ */
+static void uc_spi_pre_delay(struct fbx_panel *priv)
+{
+	struct timespec64 ts, delta;
+	unsigned int sleep;
+
+	/* rough measurement first */
+	if (jiffies - priv->spi_last_xfer_jiffies >= 2)
+		return;
+
+	ktime_get_ts64(&ts);
+	delta = timespec64_sub(ts, priv->spi_last_xfer_ts);
+
+	if (delta.tv_sec)
+		return;
+
+	if (delta.tv_nsec > 150 * 1000)
+		return;
+
+	sleep = DIV_ROUND_UP((150 * 1000 - delta.tv_nsec), 1000);
+	udelay(sleep);
+}
+
+static void uc_spi_post_delay(struct fbx_panel *priv)
+{
+	priv->spi_last_xfer_jiffies = jiffies;
+	ktime_get_ts64(&priv->spi_last_xfer_ts);
+}
+
+/*
+ * issue read command to device
+ */
+static int uc_read(struct fbx_panel *priv, u8 reg, u8 size, u8 *buf)
+{
+	u8 cmd[3] = { UC_CMD_READ, reg, size };
+	int ret;
+	uc_spi_pre_delay(priv);
+	ret = spi_write_then_read(priv->spi,
+				  cmd, ARRAY_SIZE(cmd),
+				  buf, size);
+	uc_spi_post_delay(priv);
+	return ret;
+}
+
+static int uc_read8(struct fbx_panel *priv, u8 reg, u8 *val)
+{
+	return uc_read(priv, reg, 1, val);
+}
+
+static int uc_read32(struct fbx_panel *priv, u8 reg, u32 *val)
+{
+	return uc_read(priv, reg, 4, (u8 *)val);
+}
+
+/*
+ * issue write command to device
+ */
+static int uc_write8(struct fbx_panel *priv, u8 reg, u8 val)
+{
+	u8 cmd[4] = { UC_CMD_WRITE, reg, 1, val };
+	int ret;
+	uc_spi_pre_delay(priv);
+	ret = spi_write(priv->spi, cmd, ARRAY_SIZE(cmd));
+	uc_spi_post_delay(priv);
+	return ret;
+}
+
+/*
+ * update area
+ */
+static int fbx_panel_fb_update(struct fbx_panel *priv)
+{
+	u8 cmd[3 + (PANEL_COLS * PANEL_ROWS / 8)];
+	unsigned int i;
+	u8 *vmem;
+
+	vmem = priv->vmem + PANEL_COLS * priv->fb->var.yoffset;
+	memset(cmd, 0, sizeof (cmd));
+	cmd[0] = UC_CMD_WRITE;
+	cmd[1] = 0;
+	cmd[2] = (PANEL_COLS * PANEL_ROWS) / 8;
+
+	for (i = 0; i < 24 * 7; i++) {
+		cmd[3 + (i / 8)] |= (!!vmem[i] << (i % 8));
+	}
+
+	uc_spi_pre_delay(priv);
+	spi_write(priv->spi, cmd, ARRAY_SIZE(cmd));
+	uc_spi_post_delay(priv);
+
+	return 0;
+}
+
+/*
+ * frame buffer fill rect callback
+ */
+static void fbx_panel_fb_fillrect(struct fb_info *info,
+				  const struct fb_fillrect *rect)
+{
+	struct fbx_panel *priv = info->par;
+	sys_fillrect(info, rect);
+	fbx_panel_fb_update(priv);
+}
+
+/*
+ * frame buffer copy area callback
+ */
+static void fbx_panel_fb_copyarea(struct fb_info *info,
+				const struct fb_copyarea *area)
+{
+	struct fbx_panel *priv = info->par;
+	sys_copyarea(info, area);
+	fbx_panel_fb_update(priv);
+}
+
+/*
+ * frame buffer image blit
+ */
+static void fbx_panel_fb_imageblit(struct fb_info *info,
+				 const struct fb_image *image)
+{
+	struct fbx_panel *priv = info->par;
+	sys_imageblit(info, image);
+	fbx_panel_fb_update(priv);
+}
+
+/*
+ * frame buffer pan callback
+ */
+static int fbx_panel_fb_pan(struct fb_var_screeninfo *var, struct fb_info *info)
+{
+	struct fbx_panel *priv = info->par;
+	priv->fb->var.xoffset = var->xoffset;
+	priv->fb->var.yoffset = var->yoffset;
+	fbx_panel_fb_update(priv);
+	return 0;
+}
+
+/*
+ * fram buffer set_par callback, set videomode
+ */
+static int fbx_panel_fb_set_par(struct fb_info *info)
+{
+	struct fbx_panel *priv = info->par;
+	fbx_panel_fb_update(priv);
+	return 0;
+}
+
+static int fbx_panel_fb_check_var(struct fb_var_screeninfo *var,
+				struct fb_info *info)
+{
+	unsigned int rotate;
+
+	rotate = var->rotate;
+	if (rotate != 0 && rotate != 90 && rotate != 180 && rotate != 270)
+		rotate = 0;
+	*var = info->var;
+	var->rotate = rotate;
+	return 0;
+}
+
+/*
+ * frame buffer blank callback
+ */
+static int fbx_panel_fb_blank(int blank, struct fb_info *info)
+{
+	return 0;
+}
+
+/*
+ * frame buffer write from userspace
+ */
+static ssize_t fbx_panel_fb_write(struct fb_info *info, const char __user *buf,
+				size_t count, loff_t *ppos)
+{
+	struct fbx_panel *priv = info->par;
+	unsigned long p = *ppos;
+	void *dst;
+	int err = 0;
+	unsigned long total_size;
+
+	if (info->state != FBINFO_STATE_RUNNING)
+		return -EPERM;
+
+	total_size = info->fix.smem_len;
+
+	if (p > total_size)
+		return -EFBIG;
+
+	if (count > total_size) {
+		err = -EFBIG;
+		count = total_size;
+	}
+
+	if (count + p > total_size) {
+		if (!err)
+			err = -ENOSPC;
+
+		count = total_size - p;
+	}
+
+	dst = (void __force *)(info->screen_base + p);
+
+	if (copy_from_user(dst, buf, count))
+		err = -EFAULT;
+
+	if  (!err)
+		*ppos += count;
+
+	fbx_panel_fb_update(priv);
+
+	return (err) ? err : count;
+}
+
+static struct fb_ops fbx_panel_fb_ops = {
+	.owner		= THIS_MODULE,
+	.fb_write	= fbx_panel_fb_write,
+	.fb_fillrect	= fbx_panel_fb_fillrect,
+	.fb_copyarea	= fbx_panel_fb_copyarea,
+	.fb_imageblit	= fbx_panel_fb_imageblit,
+	.fb_pan_display	= fbx_panel_fb_pan,
+	.fb_blank	= fbx_panel_fb_blank,
+	.fb_check_var	= fbx_panel_fb_check_var,
+	.fb_set_par	= fbx_panel_fb_set_par,
+};
+
+/*
+ * input core poll callback
+ */
+static void fbx_panel_input_poll(struct input_polled_dev *dev)
+{
+	struct fbx_panel *priv = dev->private;
+	struct input_dev *input = dev->input;
+	unsigned int i;
+	int ret;
+	u8 val;
+
+	if (priv->irq_gpio) {
+		if (gpiod_get_value(priv->irq_gpio)) {
+			/* no IRQ pending, if any key was previously
+			 * pressed, we need to poll to maintain key
+			 * repeat */
+			if (!priv->key_was_pressed)
+				return;
+		}
+
+		/* clear interrupt */
+		uc_write8(priv, UC_REG_IRQ_STAT, 3);
+	}
+
+	ret = uc_read8(priv, UC_REG_KEY_STATUS, &val);
+	if (ret) {
+		dev_err(&priv->spi->dev, "unable to read keypad status\n");
+		return;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(priv->keymap); i++)
+		input_report_key(input, priv->keymap[i],
+				 val & (1 << i));
+
+	input_sync(input);
+	priv->key_was_pressed = val;
+}
+
+static ssize_t panel_gen_reg_show(struct device *dev, u8 reg, char *buf)
+{
+	struct fbx_panel *priv = dev_get_drvdata(dev);
+	u8 val;
+	int ret;
+
+	ret = uc_read8(priv, reg, &val);
+	if (ret)
+		return ret;
+	return sprintf(buf, "%u\n", val);
+}
+
+static ssize_t panel_gen_reg32_show(struct device *dev, u8 reg, char *buf)
+{
+	struct fbx_panel *priv = dev_get_drvdata(dev);
+	u32 val;
+	int ret;
+
+	ret = uc_read32(priv, reg, &val);
+	if (ret)
+		return ret;
+	return sprintf(buf, "%u\n", val);
+}
+
+static ssize_t panel_gen_reg_store(struct device *dev, u8 reg,
+				   const char *buf, size_t len)
+{
+	struct fbx_panel *priv = dev_get_drvdata(dev);
+	unsigned long value;
+	int ret;
+
+	ret = kstrtoul(buf, 0, &value);
+	if (ret)
+		return ret;
+
+	if (value > 255)
+		return -EINVAL;
+
+	ret = uc_write8(priv, reg, value);
+	if (ret)
+		return ret;
+
+	return len;
+}
+
+static ssize_t panel_matrix_brightness_show(struct device *dev,
+					    struct device_attribute *attr,
+					    char *buf)
+{
+	return panel_gen_reg_show(dev, UC_REG_LED_MATRIX_BRIGHTNESS, buf);
+}
+
+static ssize_t panel_matrix_brightness_store(struct device *dev,
+					     struct device_attribute *attr,
+					     const char *buf, size_t len)
+{
+	return panel_gen_reg_store(dev, UC_REG_LED_MATRIX_BRIGHTNESS,
+				   buf, len);
+}
+
+static ssize_t panel_matrix_refresh_show(struct device *dev,
+					 struct device_attribute *attr,
+					 char *buf)
+{
+	return panel_gen_reg_show(dev, UC_REG_LED_MATRIX_REFRESH, buf);
+}
+
+static ssize_t panel_matrix_refresh_store(struct device *dev,
+					  struct device_attribute *attr,
+					  const char *buf, size_t len)
+{
+	return panel_gen_reg_store(dev, UC_REG_LED_MATRIX_REFRESH,
+				   buf, len);
+}
+
+static ssize_t panel_proximity_status_show(struct device *dev,
+					   struct device_attribute *attr,
+					   char *buf)
+{
+	return panel_gen_reg_show(dev, UC_REG_PROXIMITY_STATUS, buf);
+}
+
+static ssize_t panel_proximity_thresh_show(struct device *dev,
+					   struct device_attribute *attr,
+					   char *buf)
+{
+	return panel_gen_reg_show(dev, UC_REG_PROXIMITY_THRESH, buf);
+}
+
+static ssize_t panel_proximity_thresh_store(struct device *dev,
+					  struct device_attribute *attr,
+					  const char *buf, size_t len)
+{
+	return panel_gen_reg_store(dev, UC_REG_PROXIMITY_THRESH,
+				   buf, len);
+}
+
+static ssize_t panel_proximity_hysteresis_show(struct device *dev,
+					   struct device_attribute *attr,
+					   char *buf)
+{
+	return panel_gen_reg_show(dev, UC_REG_PROXIMITY_HYSTERESIS, buf);
+}
+
+static ssize_t panel_proximity_hysteresis_store(struct device *dev,
+						struct device_attribute *attr,
+						const char *buf, size_t len)
+{
+	return panel_gen_reg_store(dev, UC_REG_PROXIMITY_HYSTERESIS,
+				   buf, len);
+}
+
+static ssize_t panel_version_show(struct device *dev,
+				  struct device_attribute *attr,
+				  char *buf)
+{
+	return panel_gen_reg_show(dev, UC_REG_VERSION, buf);
+}
+
+static ssize_t panel_lifetime_show(struct device *dev,
+				  struct device_attribute *attr,
+				   char *buf)
+{
+	return panel_gen_reg32_show(dev, UC_REG_LIFETIME, buf);
+}
+
+static ssize_t panel_matrix_test_type_show(struct device *dev,
+					   struct device_attribute *attr,
+					   char *buf)
+{
+	return panel_gen_reg_show(dev, UC_REG_LED_MATRIX_TEST_TYPE, buf);
+}
+
+static ssize_t panel_matrix_test_type_store(struct device *dev,
+					    struct device_attribute *attr,
+					    const char *buf, size_t len)
+{
+	return panel_gen_reg_store(dev, UC_REG_LED_MATRIX_TEST_TYPE,
+				   buf, len);
+}
+
+static ssize_t panel_matrix_test_control_show(struct device *dev,
+					      struct device_attribute *attr,
+					      char *buf)
+{
+	return panel_gen_reg_show(dev, UC_REG_LED_MATRIX_TEST_CTRL, buf);
+}
+
+static ssize_t panel_matrix_test_control_store(struct device *dev,
+					       struct device_attribute *attr,
+					       const char *buf, size_t len)
+{
+	return panel_gen_reg_store(dev, UC_REG_LED_MATRIX_TEST_CTRL,
+				   buf, len);
+}
+
+static ssize_t panel_matrix_test_results_show(struct device *dev,
+					      struct device_attribute *attr,
+					      char *buf)
+{
+	struct fbx_panel *priv = dev_get_drvdata(dev);
+	u8 results[(PANEL_COLS * PANEL_ROWS) / 8];
+	size_t i, len;
+	int ret;
+
+	ret = uc_read(priv, UC_REG_LEDx_MATRIX_TEST_RES(0),
+		      sizeof (results), results);
+	if (ret)
+		return ret;
+
+	len = 0;
+	for (i = 0; i < sizeof (results); i++)
+		len += sprintf(buf + len, "%02x", results[i]);
+	len += sprintf(buf + len, "\n");
+	return len;
+}
+
+static ssize_t panel_matrix_test_thermal_err_show(struct device *dev,
+						  struct device_attribute *attr,
+						  char *buf)
+{
+	return panel_gen_reg_show(dev, UC_REG_LED_MATRIX_THERM_ERR, buf);
+}
+
+static ssize_t panel_key_status_show(struct device *dev,
+				     struct device_attribute *attr,
+				     char *buf)
+{
+	return panel_gen_reg_show(dev, UC_REG_KEY_STATUS, buf);
+}
+
+static DEVICE_ATTR_RW(panel_matrix_brightness);
+static DEVICE_ATTR_RW(panel_matrix_refresh);
+static DEVICE_ATTR_RW(panel_matrix_test_type);
+static DEVICE_ATTR_RW(panel_matrix_test_control);
+static DEVICE_ATTR_RO(panel_matrix_test_results);
+static DEVICE_ATTR_RO(panel_matrix_test_thermal_err);
+static DEVICE_ATTR_RO(panel_key_status);
+
+static DEVICE_ATTR_RO(panel_proximity_status);
+static DEVICE_ATTR_RW(panel_proximity_thresh);
+static DEVICE_ATTR_RW(panel_proximity_hysteresis);
+static DEVICE_ATTR_RO(panel_version);
+static DEVICE_ATTR_RO(panel_lifetime);
+
+static ssize_t panel_led_gen_reg_show(struct device *dev,
+				      struct device_attribute *attr,
+				      char *buf)
+{
+	struct dev_ext_attribute *eattr;
+	unsigned int reg;
+	eattr = container_of(attr, struct dev_ext_attribute, attr);
+	reg = (unsigned long)eattr->var;
+	return panel_gen_reg_show(dev, reg, buf);
+}
+
+static ssize_t panel_led_gen_reg_store(struct device *dev,
+				       struct device_attribute *attr,
+				       const char *buf, size_t len)
+{
+	struct dev_ext_attribute *eattr;
+	unsigned int reg;
+	eattr = container_of(attr, struct dev_ext_attribute, attr);
+	reg = (unsigned long)eattr->var;
+	return panel_gen_reg_store(dev, reg, buf, len);
+}
+
+static struct {
+	u8 val;
+	const char *mode;
+} led_modes[] = {
+	{ 0, "off" },
+	{ 1, "min" },
+	{ 2, "max" },
+	{ 3, "blink" },
+	{ 4, "auto" },
+};
+
+static ssize_t panel_led_mode_show(struct device *dev,
+				   struct device_attribute *attr,
+				   char *buf)
+{
+	struct fbx_panel *priv = dev_get_drvdata(dev);
+	struct dev_ext_attribute *eattr;
+	unsigned int led;
+	const char *str;
+	size_t i;
+	int ret;
+	u8 val;
+
+	eattr = container_of(attr, struct dev_ext_attribute, attr);
+	led = (unsigned long)eattr->var;
+	ret = uc_read8(priv, UC_REG_LEDx_MODE(led), &val);
+	if (ret)
+		return ret;
+
+	str = NULL;
+	for (i = 0; i < ARRAY_SIZE(led_modes); i++) {
+		if (led_modes[i].val == val) {
+			str = led_modes[i].mode;
+			break;
+		}
+	}
+
+	if (!str)
+		str = "unknown";
+
+	return sprintf(buf, "%s\n", str);
+}
+
+
+static int is_white(int c)
+{
+	return c == '\0' || c == ' ' || c == '\t' || c == '\n' || c == '\r';
+}
+
+static ssize_t panel_led_mode_store(struct device *dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t len)
+{
+	struct fbx_panel *priv = dev_get_drvdata(dev);
+	struct dev_ext_attribute *eattr;
+	unsigned int led;
+	size_t i, read_len;
+	int ret;
+	u8 val;
+
+	/* ignore leading whitespaces */
+	if (is_white(*buf))
+		return 1;
+
+	eattr = container_of(attr, struct dev_ext_attribute, attr);
+	led = (unsigned long)eattr->var;
+
+	read_len = 0;
+	for (i = 0; i < ARRAY_SIZE(led_modes); i++) {
+		size_t mode_len = strlen(led_modes[i].mode);
+
+		if (len < mode_len)
+			continue;
+
+		if (!strncmp(buf, led_modes[i].mode, mode_len) &&
+		    is_white(buf[mode_len])) {
+			read_len = mode_len;
+			break;
+		}
+	}
+
+	if (!read_len) {
+		dev_err(dev, "invalid led mode value");
+		return -EINVAL;
+	}
+
+	ret = uc_read8(priv, UC_REG_LEDx_MODE(led), &val);
+	if (ret)
+		return ret;
+
+	if (val == led_modes[i].val)
+		return read_len;
+
+	ret = uc_write8(priv, UC_REG_LEDx_MODE(led), led_modes[i].val);
+	if (ret)
+		return ret;
+
+	return read_len;
+}
+
+#define PANEL_LED_ATTR(_name, _func, _led)				\
+	struct dev_ext_attribute					\
+	dev_attr_panel_led_ ## _name ## _ ## _func = {			\
+		.attr = __ATTR(panel_led_ ## _name ## _ ## _func,	\
+			       S_IRUGO | S_IWUSR,			\
+			       panel_led_ ## _func ## _show,		\
+			       panel_led_ ## _func ## _store		\
+			),						\
+		.var = (void *) _led,					\
+	}
+
+#define PANEL_LED_REG_ATTR(_name, _func, _ledreg)			\
+	struct dev_ext_attribute					\
+	dev_attr_panel_led_ ## _name ## _ ## _func = {			\
+		.attr = __ATTR(panel_led_ ## _name ## _ ## _func,	\
+			       S_IRUGO | S_IWUSR,			\
+			       panel_led_gen_reg_show,			\
+			       panel_led_gen_reg_store			\
+			),						\
+		.var = (void *) _ledreg,				\
+	}
+
+static PANEL_LED_REG_ATTR(up, min_brightness, UC_REG_LEDx_MIN_BRIGHT(1));
+static PANEL_LED_REG_ATTR(up, max_brightness, UC_REG_LEDx_MAX_BRIGHT(1));
+static PANEL_LED_REG_ATTR(up, blink_rate, UC_REG_LEDx_BLINK_RATE(1));
+static PANEL_LED_REG_ATTR(up, trans_rate, UC_REG_LEDx_TRANS_RATE(1));
+static PANEL_LED_ATTR(up, mode, 1);
+
+static PANEL_LED_REG_ATTR(down, min_brightness, UC_REG_LEDx_MIN_BRIGHT(3));
+static PANEL_LED_REG_ATTR(down, max_brightness, UC_REG_LEDx_MAX_BRIGHT(3));
+static PANEL_LED_REG_ATTR(down, blink_rate, UC_REG_LEDx_BLINK_RATE(3));
+static PANEL_LED_REG_ATTR(down, trans_rate, UC_REG_LEDx_TRANS_RATE(3));
+static PANEL_LED_ATTR(down, mode, 3);
+
+static PANEL_LED_REG_ATTR(cancel, min_brightness, UC_REG_LEDx_MIN_BRIGHT(2));
+static PANEL_LED_REG_ATTR(cancel, max_brightness, UC_REG_LEDx_MAX_BRIGHT(2));
+static PANEL_LED_REG_ATTR(cancel, blink_rate, UC_REG_LEDx_BLINK_RATE(2));
+static PANEL_LED_REG_ATTR(cancel, trans_rate, UC_REG_LEDx_TRANS_RATE(2));
+static PANEL_LED_ATTR(cancel, mode, 2);
+
+static PANEL_LED_REG_ATTR(ok, min_brightness, UC_REG_LEDx_MIN_BRIGHT(0));
+static PANEL_LED_REG_ATTR(ok, max_brightness, UC_REG_LEDx_MAX_BRIGHT(0));
+static PANEL_LED_REG_ATTR(ok, blink_rate, UC_REG_LEDx_BLINK_RATE(0));
+static PANEL_LED_REG_ATTR(ok, trans_rate, UC_REG_LEDx_TRANS_RATE(0));
+static PANEL_LED_ATTR(ok, mode, 0);
+
+
+static struct attribute *sysfs_attrs_ctrl[] = {
+	&dev_attr_panel_matrix_brightness.attr,
+	&dev_attr_panel_matrix_refresh.attr,
+	&dev_attr_panel_matrix_test_type.attr,
+	&dev_attr_panel_matrix_test_control.attr,
+	&dev_attr_panel_matrix_test_results.attr,
+	&dev_attr_panel_matrix_test_thermal_err.attr,
+
+	&dev_attr_panel_key_status.attr,
+
+	&dev_attr_panel_proximity_status.attr,
+	&dev_attr_panel_proximity_thresh.attr,
+	&dev_attr_panel_proximity_hysteresis.attr,
+	&dev_attr_panel_version.attr,
+	&dev_attr_panel_lifetime.attr,
+
+	&dev_attr_panel_led_up_min_brightness.attr.attr,
+	&dev_attr_panel_led_up_max_brightness.attr.attr,
+	&dev_attr_panel_led_up_blink_rate.attr.attr,
+	&dev_attr_panel_led_up_trans_rate.attr.attr,
+	&dev_attr_panel_led_up_mode.attr.attr,
+
+	&dev_attr_panel_led_down_min_brightness.attr.attr,
+	&dev_attr_panel_led_down_max_brightness.attr.attr,
+	&dev_attr_panel_led_down_blink_rate.attr.attr,
+	&dev_attr_panel_led_down_trans_rate.attr.attr,
+	&dev_attr_panel_led_down_mode.attr.attr,
+
+	&dev_attr_panel_led_cancel_min_brightness.attr.attr,
+	&dev_attr_panel_led_cancel_max_brightness.attr.attr,
+	&dev_attr_panel_led_cancel_blink_rate.attr.attr,
+	&dev_attr_panel_led_cancel_trans_rate.attr.attr,
+	&dev_attr_panel_led_cancel_mode.attr.attr,
+
+	&dev_attr_panel_led_ok_min_brightness.attr.attr,
+	&dev_attr_panel_led_ok_max_brightness.attr.attr,
+	&dev_attr_panel_led_ok_blink_rate.attr.attr,
+	&dev_attr_panel_led_ok_trans_rate.attr.attr,
+	&dev_attr_panel_led_ok_mode.attr.attr,
+	NULL
+};
+
+static const struct attribute_group panel_attribute_group[] = {
+	{.attrs = sysfs_attrs_ctrl },
+};
+
+/*
+ * SPI device probe callback
+ */
+static int fbxgw7r_panel_spi_probe(struct spi_device *spi)
+{
+	struct input_dev *input;
+	struct fbx_panel *priv;
+	struct fb_info *fb = NULL;
+	unsigned int i;
+	u8 version;
+	int ret;
+
+	priv = devm_kzalloc(&spi->dev, sizeof (*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->spi = spi;
+
+	priv->irq_gpio = devm_gpiod_get_optional(&spi->dev, "irq", GPIOD_IN);
+	if (IS_ERR(priv->irq_gpio)) {
+		ret = PTR_ERR(priv->irq_gpio);
+		if (ret != -EPROBE_DEFER)
+			dev_err(&spi->dev,
+				"failed to get irq gpio :%d", ret);
+		return ret;
+	}
+
+	ret = sysfs_create_group(&spi->dev.kobj,
+				 panel_attribute_group);
+	if (ret < 0) {
+		dev_err(&spi->dev, "Sysfs registration failed\n");
+		goto fail;
+	}
+
+	/*
+	 * setup input
+	 */
+	priv->keymap[0] = KEY_OK;
+	priv->keymap[1] = KEY_UP;
+	priv->keymap[2] = KEY_CANCEL;
+	priv->keymap[3] = KEY_DOWN;
+
+	priv->poll_dev = devm_input_allocate_polled_device(&spi->dev);
+	if (!priv->poll_dev) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	priv->poll_dev->private = priv;
+	priv->poll_dev->poll = fbx_panel_input_poll;
+	priv->poll_dev->poll_interval = 100 /* ms */;
+
+	input = priv->poll_dev->input;
+	input->name = "fbxgw7r_panel";
+	input->phys = "fbxgw7r_panel/input0";
+	input->id.bustype = BUS_SPI;
+	input->dev.parent = &spi->dev;
+
+	input->keycode = priv->keymap;
+	input->keycodemax = ARRAY_SIZE(priv->keymap);
+	input->keycodesize = sizeof (unsigned short);
+
+	set_bit(EV_REP, input->evbit);
+	set_bit(EV_KEY, input->evbit);
+	for (i = 0; i < ARRAY_SIZE(priv->keymap); i++)
+		set_bit(priv->keymap[i], input->keybit);
+
+	ret = input_register_polled_device(priv->poll_dev);
+	if (ret)
+		goto fail;
+
+	/*
+	 * setup framebuffer
+	 */
+	fb = framebuffer_alloc(0, &spi->dev);
+	if (!fb) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	priv->fb = fb;
+	fb->par = priv;
+
+	/* setup framebuffer */
+	fb->fbops = &fbx_panel_fb_ops;
+	fb->flags = FBINFO_FLAG_DEFAULT | FBINFO_HWACCEL_YPAN;
+	fb->var = fbx_panel_fb_var;
+	fb->fix = fbx_panel_fb_fix;
+
+	fb->var.xres = PANEL_COLS;
+	fb->var.yres = PANEL_ROWS;
+	fb->var.xres_virtual = PANEL_COLS;
+	fb->var.yres_virtual = PANEL_ROWS * 2;
+
+	/* twice lcd size so we can pan in one direction */
+	fb->fix.smem_len = (PANEL_COLS * PANEL_ROWS) * 2;
+	fb->fix.line_length = PANEL_COLS;
+	fb->var.rotate = 0;
+
+	/* allocate video memory */
+	priv->vmem_size = PAGE_ALIGN(fb->fix.smem_len);
+	priv->vmem = vmalloc(priv->vmem_size);
+	if (!priv->vmem) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+	memset(priv->vmem, 0, priv->vmem_size);
+	fb->screen_base = (char __iomem *)priv->vmem;
+
+	/* register frame buffer */
+	ret = register_framebuffer(fb);
+	if (ret < 0)
+		goto fail;
+
+	ret = uc_read8(priv, UC_REG_VERSION, &version);
+	if (ret < 0) {
+		dev_err(&spi->dev, "spi read error: %d", ret);
+		goto fail;
+	}
+
+	dev_info(&spi->dev,
+		 "fb%d: Freebox v7 panel device, version 0x%02x\n",
+		 fb->node, version);
+
+	/* unmask irq */
+	if (priv->irq_gpio)
+		uc_write8(priv, UC_REG_IRQ_MASK, UC_IRQ_KEYPAD_MASK);
+
+	dev_set_drvdata(&spi->dev, priv);
+	return 0;
+
+fail:
+	sysfs_remove_group(&spi->dev.kobj, panel_attribute_group);
+	if (priv->vmem)
+		vfree(priv->vmem);
+	if (fb)
+		framebuffer_release(fb);
+	return ret;
+}
+
+/*
+ * spi device remove callback
+ */
+static int fbxgw7r_panel_spi_remove(struct spi_device *spi)
+{
+	struct fbx_panel *priv;
+
+	priv = dev_get_drvdata(&spi->dev);
+	sysfs_remove_group(&spi->dev.kobj, panel_attribute_group);
+	unregister_framebuffer(priv->fb);
+	vfree(priv->vmem);
+	framebuffer_release(priv->fb);
+	return 0;
+}
+
+const struct of_device_id fbxgw7r_panel_match[] = {
+	{ .compatible = "freebox,fbxgw7r-panel" },
+	{ },
+};
+
+static struct spi_driver fbxgw7r_panel_spi_driver = {
+	.driver = {
+		.name	= "fbxgw7r_panel",
+		.of_match_table = of_match_ptr(fbxgw7r_panel_match),
+	},
+
+	.probe		= fbxgw7r_panel_spi_probe,
+	.remove		= fbxgw7r_panel_spi_remove,
+};
+
+static int __init fbxgw7r_panel_spi_init(void)
+{
+	int ret;
+
+	ret = spi_register_driver(&fbxgw7r_panel_spi_driver);
+	if (ret != 0)
+		pr_err("Failed to register WM831x SPI driver: %d\n", ret);
+
+	return 0;
+}
+
+static void __exit fbxgw7r_panel_spi_exit(void)
+{
+	spi_unregister_driver(&fbxgw7r_panel_spi_driver);
+}
+
+module_init(fbxgw7r_panel_spi_init);
+module_exit(fbxgw7r_panel_spi_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Maxime Bizon");
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/drivers/misc/eeprom/ee1004_raw.c	2021-03-04 13:20:58.904172272 +0100
@@ -0,0 +1,351 @@
+/*
+ * ee1004 - driver for DDR4 SPD EEPROMs, without smbus
+ */
+
+#include <linux/i2c.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+
+#define EE1004_ADDR_SET_PAGE		0x36
+#define EE1004_EEPROM_SIZE		512
+#define EE1004_PAGE_SIZE		256
+#define EE1004_PAGE_SHIFT		8
+
+/*
+ * Mutex protects ee1004_set_page and ee1004_dev_count, and must be held
+ * from page selection to end of read.
+ */
+static DEFINE_MUTEX(ee1004_bus_lock);
+static struct i2c_client *ee1004_set_page[2];
+static unsigned int ee1004_dev_count;
+static int ee1004_current_page;
+
+static unsigned write_timeout = 25;
+module_param(write_timeout, uint, 0);
+MODULE_PARM_DESC(write_timeout, "Time (in ms) to try writes (default 25)");
+
+static const struct i2c_device_id ee1004_ids[] = {
+	{ "ee1004", 0 },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, ee1004_ids);
+
+#define loop_until_timeout(tout, op_time)				\
+	for (tout = jiffies + msecs_to_jiffies(write_timeout), op_time = 0; \
+	     op_time ? time_before(op_time, tout) : true;		\
+	     usleep_range(1000, 1500), op_time = jiffies)
+
+/*-------------------------------------------------------------------------*/
+
+static ssize_t ee1004_eeprom_read(struct i2c_client *client, char *buf,
+				  unsigned int offset, size_t count)
+{
+	int status;
+
+	if (count > I2C_SMBUS_BLOCK_MAX)
+		count = I2C_SMBUS_BLOCK_MAX;
+	/* Can't cross page boundaries */
+	if (unlikely(offset + count > EE1004_PAGE_SIZE))
+		count = EE1004_PAGE_SIZE - offset;
+
+	status = i2c_smbus_read_i2c_block_data_or_emulated(client, offset,
+							   count, buf);
+	dev_dbg(&client->dev, "read %zu@%d --> %d\n", count, offset, status);
+
+	return status;
+}
+
+static ssize_t ee1004_read(struct file *filp, struct kobject *kobj,
+			   struct bin_attribute *bin_attr,
+			   char *buf, loff_t off, size_t count)
+{
+	struct device *dev = kobj_to_dev(kobj);
+	struct i2c_client *client = to_i2c_client(dev);
+	size_t requested = count;
+	int page;
+
+	if (unlikely(!count))
+		return count;
+
+	page = off >> EE1004_PAGE_SHIFT;
+	if (unlikely(page > 1))
+		return 0;
+	off &= (1 << EE1004_PAGE_SHIFT) - 1;
+
+	/*
+	 * Read data from chip, protecting against concurrent access to
+	 * other EE1004 SPD EEPROMs on the same adapter.
+	 */
+	mutex_lock(&ee1004_bus_lock);
+
+	while (count) {
+		int status;
+
+		/* Select page */
+		if (page != ee1004_current_page) {
+			struct i2c_msg msg;
+			char buf[2];
+
+			memset(&msg, 0, sizeof (msg));
+			msg.addr = ee1004_set_page[page]->addr;
+			msg.flags = I2C_M_IGNORE_NAK;
+			msg.len = 2;
+			msg.buf = buf;
+
+			status = i2c_transfer(client->adapter, &msg, 1);
+			if (status < 0) {
+				dev_err(dev, "Failed to select page %d (%d)\n",
+					page, status);
+				mutex_unlock(&ee1004_bus_lock);
+				return status;
+			}
+			dev_dbg(dev, "Selected page %d\n", page);
+			ee1004_current_page = page;
+		}
+
+		status = ee1004_eeprom_read(client, buf, off, count);
+		if (status < 0) {
+			mutex_unlock(&ee1004_bus_lock);
+			return status;
+		}
+		buf += status;
+		off += status;
+		count -= status;
+
+		if (off == EE1004_PAGE_SIZE) {
+			page++;
+			off = 0;
+		}
+	}
+
+	mutex_unlock(&ee1004_bus_lock);
+
+	return requested;
+}
+
+static ssize_t ee1004_eeprom_write(struct i2c_client *client, char *buf,
+				   unsigned int offset, size_t count)
+{
+	unsigned long timeout, write_time;
+	int status;
+
+	/* Can't cross page boundaries */
+	if (unlikely(offset + count > EE1004_PAGE_SIZE))
+		count = EE1004_PAGE_SIZE - offset;
+
+	loop_until_timeout(timeout, write_time) {
+		status = i2c_smbus_write_byte_data(client, offset, buf[0]);
+		if (status == 0)
+			status = 1;
+
+		dev_dbg(&client->dev, "write %zu@%d --> %d\n", count, offset, status);
+		if (status == 1)
+			return 1;
+	}
+
+	return -ETIMEDOUT;
+}
+
+static ssize_t ee1004_write(struct file *filp, struct kobject *kobj,
+			    struct bin_attribute *bin_attr,
+			    char *buf, loff_t off, size_t count)
+{
+	struct device *dev = kobj_to_dev(kobj);
+	struct i2c_client *client = to_i2c_client(dev);
+	size_t requested = count;
+	int page;
+
+	if (unlikely(!count))
+		return count;
+
+	page = off >> EE1004_PAGE_SHIFT;
+	if (unlikely(page > 1))
+		return 0;
+	off &= (1 << EE1004_PAGE_SHIFT) - 1;
+
+	mutex_lock(&ee1004_bus_lock);
+
+	while (count) {
+		int status;
+
+		/* Select page */
+		if (page != ee1004_current_page) {
+			struct i2c_msg msg;
+			char buf[2];
+
+			memset(&msg, 0, sizeof (msg));
+			msg.addr = ee1004_set_page[page]->addr;
+			msg.flags = I2C_M_IGNORE_NAK;
+			msg.len = 2;
+			msg.buf = buf;
+
+			status = i2c_transfer(client->adapter, &msg, 1);
+			if (status < 0) {
+				dev_err(dev, "Failed to select page %d (%d)\n",
+					page, status);
+				mutex_unlock(&ee1004_bus_lock);
+				return status;
+			}
+			dev_dbg(dev, "Selected page %d\n", page);
+			ee1004_current_page = page;
+		}
+
+		status = ee1004_eeprom_write(client, buf, off, count);
+		if (status < 0) {
+			mutex_unlock(&ee1004_bus_lock);
+			return status;
+		}
+		buf += status;
+		off += status;
+		count -= status;
+
+		if (off == EE1004_PAGE_SIZE) {
+			page++;
+			off = 0;
+		}
+	}
+
+	mutex_unlock(&ee1004_bus_lock);
+
+	return requested;
+}
+
+static const struct bin_attribute eeprom_attr = {
+	.attr = {
+		.name = "eeprom",
+		.mode = 0600,
+	},
+	.size = EE1004_EEPROM_SIZE,
+	.read = ee1004_read,
+	.write = ee1004_write,
+};
+
+static int ee1004_probe(struct i2c_client *client,
+			const struct i2c_device_id *id)
+{
+	int err, cnr = 0;
+	unsigned char buf[4];
+	struct i2c_msg msg;
+
+	if (!i2c_check_functionality(client->adapter,
+				     I2C_FUNC_PROTOCOL_MANGLING))
+		return -EPFNOSUPPORT;
+
+	/* Use 2 dummy devices for page select command */
+	mutex_lock(&ee1004_bus_lock);
+	if (++ee1004_dev_count == 1) {
+		for (cnr = 0; cnr < 2; cnr++) {
+			ee1004_set_page[cnr] = i2c_new_dummy(client->adapter,
+						EE1004_ADDR_SET_PAGE + cnr);
+			if (!ee1004_set_page[cnr]) {
+				dev_err(&client->dev,
+					"address 0x%02x unavailable\n",
+					EE1004_ADDR_SET_PAGE + cnr);
+				err = -EADDRINUSE;
+				goto err_clients;
+			}
+		}
+	} else if (i2c_adapter_id(client->adapter) !=
+		   i2c_adapter_id(ee1004_set_page[0]->adapter)) {
+		dev_err(&client->dev,
+			"Driver only supports devices on a single I2C bus\n");
+		err = -EOPNOTSUPP;
+		goto err_clients;
+	}
+
+	memset(&msg, 0, sizeof (msg));
+	msg.addr = ee1004_set_page[0]->addr;
+	msg.flags = I2C_M_RD | I2C_M_NO_RD_ACK;
+	msg.len = 1;
+	msg.buf = buf;
+
+	/* Remember current page to avoid unneeded page select */
+	err = i2c_transfer(client->adapter, &msg, 1);
+	if (err == -ENXIO) {
+		/* Nack means page 1 is selected */
+		ee1004_current_page = 1;
+	} else if (err < 0) {
+		/* Anything else is a real error, bail out */
+		goto err_clients;
+	} else {
+		/* Ack means page 0 is selected, returned value meaningless */
+		ee1004_current_page = 0;
+	}
+	dev_dbg(&client->dev, "Currently selected page: %d\n",
+		ee1004_current_page);
+	mutex_unlock(&ee1004_bus_lock);
+
+	/* Create the sysfs eeprom file */
+	err = sysfs_create_bin_file(&client->dev.kobj, &eeprom_attr);
+	if (err)
+		goto err_clients_lock;
+
+	dev_info(&client->dev,
+		 "%u byte EE1004-compliant SPD EEPROM, read-only\n",
+		 EE1004_EEPROM_SIZE);
+
+	return 0;
+
+ err_clients_lock:
+	mutex_lock(&ee1004_bus_lock);
+ err_clients:
+	if (--ee1004_dev_count == 0) {
+		for (cnr--; cnr >= 0; cnr--) {
+			i2c_unregister_device(ee1004_set_page[cnr]);
+			ee1004_set_page[cnr] = NULL;
+		}
+	}
+	mutex_unlock(&ee1004_bus_lock);
+
+	return err;
+}
+
+static int ee1004_remove(struct i2c_client *client)
+{
+	int i;
+
+	sysfs_remove_bin_file(&client->dev.kobj, &eeprom_attr);
+
+	/* Remove page select clients if this is the last device */
+	mutex_lock(&ee1004_bus_lock);
+	if (--ee1004_dev_count == 0) {
+		for (i = 0; i < 2; i++) {
+			i2c_unregister_device(ee1004_set_page[i]);
+			ee1004_set_page[i] = NULL;
+		}
+	}
+	mutex_unlock(&ee1004_bus_lock);
+
+	return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static struct i2c_driver ee1004_raw_driver = {
+	.driver = {
+		.name = "ee1004_raw",
+	},
+	.probe = ee1004_probe,
+	.remove = ee1004_remove,
+	.id_table = ee1004_ids,
+};
+
+static int __init ee1004_raw_init(void)
+{
+	return i2c_add_driver(&ee1004_raw_driver);
+}
+module_init(ee1004_raw_init);
+
+static void __exit ee1004_raw_exit(void)
+{
+	i2c_del_driver(&ee1004_raw_driver);
+}
+module_exit(ee1004_raw_exit);
+
+MODULE_DESCRIPTION("Driver for EE1004-compliant DDR4 SPD EEPROMs raw mode");
+MODULE_AUTHOR("Maxime Bizon");
+MODULE_LICENSE("GPL");
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/drivers/misc/fbxserial_of.c	2021-03-04 13:20:58.907505606 +0100
@@ -0,0 +1,38 @@
+#include <linux/kernel.h>
+#include <linux/of.h>
+#include <linux/fbxserial.h>
+#include <linux/random.h>
+
+static struct fbx_serial serial_info;
+
+const struct fbx_serial *arch_get_fbxserial(void)
+{
+	return &serial_info;
+}
+
+EXPORT_SYMBOL(arch_get_fbxserial);
+
+/*
+ *
+ */
+static __init int fbxserial_of_read(void)
+{
+	struct device_node *np;
+	const void *fbxserial_data;
+	int len;
+
+	np = of_find_node_by_path("/chosen");
+	if (!np)
+		return 0;
+
+	fbxserial_data = of_get_property(np, "fbx,serialinfo", &len);
+	if (!fbxserial_data)
+		return 0;
+
+	fbxserialinfo_read(fbxserial_data, &serial_info);
+	add_device_randomness(&serial_info, sizeof (serial_info));
+
+	return 0;
+}
+
+arch_initcall(fbxserial_of_read);
diff -Nruw linux-5.4.60-fbx/drivers/misc/hdmi-cec./Kconfig linux-5.4.60-fbx/drivers/misc/hdmi-cec/Kconfig
--- linux-5.4.60-fbx/drivers/misc/hdmi-cec./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/misc/hdmi-cec/Kconfig	2021-03-04 13:20:58.914172272 +0100
@@ -0,0 +1,15 @@
+menu "HDMI CEC support"
+
+config HDMI_CEC
+	tristate "HDMI CEC (Consumer Electronics Control) support"
+	---help---
+	   HDMI Consumer Electronics Control support.
+
+config HDMI_CEC_REMOTI
+	tristate "RemoTI CEC driver"
+	depends on HDMI_CEC
+	select REMOTI
+	---help---
+	   HDMI CEC driver using RemoTI IPCs.
+
+endmenu
diff -Nruw linux-5.4.60-fbx/drivers/misc/hdmi-cec./Makefile linux-5.4.60-fbx/drivers/misc/hdmi-cec/Makefile
--- linux-5.4.60-fbx/drivers/misc/hdmi-cec./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/misc/hdmi-cec/Makefile	2021-03-04 13:20:58.914172272 +0100
@@ -0,0 +1,6 @@
+obj-$(CONFIG_HDMI_CEC)		+= hdmi-cec.o
+hdmi-cec-objs			+= core.o dev.o
+
+# drivers
+obj-$(CONFIG_HDMI_CEC_REMOTI)	+= remoti-cec.o
+remoti-cec-objs			:= remoti.o
diff -Nruw linux-5.4.60-fbx/drivers/misc/remoti./Kconfig linux-5.4.60-fbx/drivers/misc/remoti/Kconfig
--- linux-5.4.60-fbx/drivers/misc/remoti./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/misc/remoti/Kconfig	2021-03-04 13:20:58.924172273 +0100
@@ -0,0 +1,26 @@
+menu "RemoTI support"
+
+config REMOTI
+	tristate "RemoTI support"
+	depends on FBX6HD
+	---help---
+	  Texas Instruments RemoTI stack.
+
+config REMOTI_LEDS
+	tristate "RemoTI LEDS support"
+	depends on REMOTI
+	depends on LEDS_CLASS
+	---help---
+	  RemoTI LEDS class driver support.
+
+config REMOTI_GPIO
+	tristate "RemoTI gpio support"
+	depends on REMOTI
+	---help---
+	  gpiochip driver for the RemoTI RNP
+
+config REMOTI_USER
+	tristate "RemoTI userspace access"
+	depends on REMOTI
+
+endmenu
diff -Nruw linux-5.4.60-fbx/drivers/misc/remoti./Makefile linux-5.4.60-fbx/drivers/misc/remoti/Makefile
--- linux-5.4.60-fbx/drivers/misc/remoti./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/misc/remoti/Makefile	2021-03-04 13:20:58.924172273 +0100
@@ -0,0 +1,9 @@
+obj-$(CONFIG_REMOTI)		+= remoti.o
+obj-$(CONFIG_REMOTI_GPIO)	+= remoti-gpio.o
+obj-$(CONFIG_REMOTI_LEDS)	+= remoti-leds.o
+obj-$(CONFIG_REMOTI_USER)	+= remoti-user.o
+
+remoti-objs			:= core.o core-sysfs.o
+remoti-gpio-objs		:= gpio.o
+remoti-leds-objs		:= leds.o
+remoti-user-objs		:= user.o
diff -Nruw linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63158./enet/Makefile linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63158/enet/Makefile
--- linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63158./enet/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63158/enet/Makefile	2021-03-04 13:20:59.017505610 +0100
@@ -0,0 +1,11 @@
+obj-$(CONFIG_BCM63158_ENET_RUNNER) 	+= bcm63158_enet_runner.o
+
+bcm63158_enet_runner-y	:= \
+	ethtool.o \
+	main.o \
+	port_unimac.o \
+	port_xport.o \
+	port_xport_serdes.o \
+	port_xport_epon.o \
+	port_xport_epon_dbg.o \
+	port_xport_xlmac.o
diff -Nruw linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63158./Makefile linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63158/Makefile
--- linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63158./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63158/Makefile	2021-03-04 13:20:59.017505610 +0100
@@ -0,0 +1,3 @@
+obj-$(CONFIG_BCM63158_SYSTEMPORT) 	+= bcmsysport_63158.o
+obj-$(CONFIG_BCM63158_ENET_RUNNER) 	+= enet/
+obj-$(CONFIG_BCM63158_SF2) 		+= sf2/
diff -Nruw linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63158./sf2/Makefile linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63158/sf2/Makefile
--- linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63158./sf2/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63158/sf2/Makefile	2021-03-04 13:20:59.020838944 +0100
@@ -0,0 +1,4 @@
+obj-$(CONFIG_BCM63158_SF2) 		+= bcm63158_sf2.o
+
+bcm63158_sf2-y 				+= sf2_main.o sf2_fdb.o
+bcm63158_sf2-$(CONFIG_DEBUG_FS) 	+= sf2_debug.o
diff -Nruw linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63xx_enet_runner./Makefile linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63xx_enet_runner/Makefile
--- linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63xx_enet_runner./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/ethernet/broadcom/bcm63xx_enet_runner/Makefile	2021-03-04 13:20:59.020838944 +0100
@@ -0,0 +1,5 @@
+obj-$(CONFIG_BCM63XX_ENET_RUNNER) 	+= bcm63xx_enet_runner_mod.o
+obj-$(CONFIG_BCM63XX_ENET_RUNNER) 	+= bcm63xx_sf2.o
+
+bcm63xx_enet_runner_mod-y 			+= bcm63xx_enet_runner.o
+bcm63xx_enet_runner_mod-$(CONFIG_DEBUG_FS) 	+= bcm63xx_enet_runner_debug.o
diff -Nruw linux-5.4.60-fbx/drivers/net/ethernet/wintegra./Kconfig linux-5.4.60-fbx/drivers/net/ethernet/wintegra/Kconfig
--- linux-5.4.60-fbx/drivers/net/ethernet/wintegra./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/ethernet/wintegra/Kconfig	2021-03-04 13:20:59.274172288 +0100
@@ -0,0 +1,10 @@
+config NET_VENDOR_WINTEGRA
+	bool
+
+config WINTEGRA_WINPATH3_ETH
+	tristate "Wintegra Winpath3 internal mac support"
+	depends on WINTEGRA_WINPATH3
+	select NET_VENDOR_WINTEGRA
+	select NET_CORE
+	select MII
+	select PHYLIB
diff -Nruw linux-5.4.60-fbx/drivers/net/ethernet/wintegra./Makefile linux-5.4.60-fbx/drivers/net/ethernet/wintegra/Makefile
--- linux-5.4.60-fbx/drivers/net/ethernet/wintegra./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/ethernet/wintegra/Makefile	2021-03-04 13:20:59.274172288 +0100
@@ -0,0 +1 @@
+obj-$(CONFIG_WINTEGRA_WINPATH3_ETH) += wp3_eth.o
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./d11_defs.h linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/d11_defs.h
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./d11_defs.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/d11_defs.h	2021-03-04 13:20:59.424172295 +0100
@@ -0,0 +1,59 @@
+#ifndef D11_DEFS_H_
+#define D11_DEFS_H_
+
+/*
+ *
+ */
+static const u16 bits_per_symbol[][2] = {
+	/* 20MHz 40MHz */
+	{    26,   54 },     /*  0: BPSK */
+	{    52,  108 },     /*  1: QPSK 1/2 */
+	{    78,  162 },     /*  2: QPSK 3/4 */
+	{   104,  216 },     /*  3: 16-QAM 1/2 */
+	{   156,  324 },     /*  4: 16-QAM 3/4 */
+	{   208,  432 },     /*  5: 64-QAM 2/3 */
+	{   234,  486 },     /*  6: 64-QAM 3/4 */
+	{   260,  540 },     /*  7: 64-QAM 5/6 */
+};
+
+#define IEEE80211_SEQ_SEQ_SHIFT    4
+#define IEEE80211_SEQ_MAX          4096
+
+#define IEEE80211_AGGR_MAX_MPDU    64
+
+#define AMPDU_DELIM_SZ          4
+#define BITS_PER_BYTE           8
+#define OFDM_PLCP_BITS          22
+#define HT_RC_2_STREAMS(_rc)    ((((_rc) & 0x78) >> 3) + 1)
+#define L_STF                   8
+#define L_LTF                   8
+#define L_SIG                   4
+#define HT_SIG                  8
+#define HT_STF                  4
+#define HT_LTF(_ns)             (4 * (_ns))
+#define SYMBOL_TIME(_ns)        ((_ns) << 2) /* ns * 4 us */
+#define SYMBOL_TIME_HALFGI(_ns) (((_ns) * 18 + 4) / 5)  /* ns * 3.6 us */
+#define TIME_SYMBOLS(t)         ((t) >> 2)
+#define TIME_SYMBOLS_HALFGI(t)  (((t) * 5 - 4) / 18)
+#define NUM_SYMBOLS_PER_USEC(_usec) (_usec >> 2)
+#define NUM_SYMBOLS_PER_USEC_HALFGI(_usec) (((_usec*5)-4)/18)
+
+#define TID_TO_WME_AC(_tid)				\
+	((((_tid) == 0) || ((_tid) == 3)) ? IEEE80211_AC_BE :	\
+	 (((_tid) == 1) || ((_tid) == 2)) ? IEEE80211_AC_BK :	\
+	 (((_tid) == 4) || ((_tid) == 5)) ? IEEE80211_AC_VI :	\
+	 IEEE80211_AC_VO)
+
+
+/* compressed blockack bitmap size (in bits) */
+#define D11_BA_BMP_SIZE			64
+
+/* return block-ack bitmap index given sequence and starting sequence */
+#define D11_BA_INDEX(_st, _seq) (((_seq) - (_st)) & (IEEE80211_SEQ_MAX - 1))
+
+/* return whether a bit at index _n in bitmap _bm is set
+ * _sz is the size of the bitmap  */
+#define D11_BA_ISSET(_bm, _n)  (((_n) < (D11_BA_BMP_SIZE)) &&		\
+				((_bm)[(_n) >> 3] & (1 << ((_n) & 7))))
+
+#endif /* !D11_DEFS_H_ */
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./debugfs.c linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/debugfs.c
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./debugfs.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/debugfs.c	2021-03-04 13:20:59.424172295 +0100
@@ -0,0 +1,81 @@
+#include "mwl8k_priv.h"
+
+static struct dentry *dbg_dir;
+
+/*
+ *
+ */
+static int mwl8k_debugfs_show_test(void *data, u64 *val)
+{
+	struct mwl8k_priv *priv = data;
+	size_t i;
+
+	printk("test\n");
+	for (i = 0; i < 1000 * 1000; i++) {
+		(void)ioread32(priv->sram);
+		(void)iowrite32(0x0, priv->sram);
+		if (i % 10000 == 0)
+			msleep(1);
+		if (signal_pending(current))
+			break;
+	}
+
+	*val = 0;
+	return 0;
+}
+
+DEFINE_DEBUGFS_ATTRIBUTE(mwl8k_debugfs_test, mwl8k_debugfs_show_test,
+			 NULL, "%lld\n");
+
+/*
+ * This function creates the debug FS directory structure and the files.
+ */
+void mwl8k_debugfs_dev_init(struct mwl8k_priv *priv)
+{
+	if (!dbg_dir)
+		return;
+
+	/* export regs */
+	priv->blob_regs.data = priv->regs;
+	priv->blob_regs.size = 64 * 1024;
+	priv->blob_sram.data = priv->sram;
+	priv->blob_sram.size = 64 * 1024;
+
+	priv->dbg_regs = debugfs_create_blob("regs", 0644, dbg_dir,
+					     &priv->blob_regs);
+	priv->dbg_sram = debugfs_create_blob("sram", 0644, dbg_dir,
+					     &priv->blob_sram);
+	priv->dbg_test = debugfs_create_file("test", 0644, dbg_dir,
+					     priv, &mwl8k_debugfs_test);
+}
+
+/*
+ * This function removes the debug FS directory structure and the files.
+ */
+void mwl8k_debugfs_dev_remove(struct mwl8k_priv *priv)
+{
+	if (priv->dbg_regs)
+		debugfs_remove(priv->dbg_regs);
+	if (priv->dbg_sram)
+		debugfs_remove(priv->dbg_sram);
+	if (priv->dbg_test)
+		debugfs_remove(priv->dbg_test);
+}
+
+/*
+ * This function creates the top level proc directory.
+ */
+void mwl8k_debugfs_init(void)
+{
+	dbg_dir = debugfs_create_dir("mwl8k_new", NULL);
+	if (!dbg_dir)
+		printk(KERN_ERR "failed to create debugfs dir\n");
+}
+
+/*
+ * This function removes the top level proc directory.
+ */
+void mwl8k_debugfs_remove(void)
+{
+	debugfs_remove(dbg_dir);
+}
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./fw.c linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/fw.c
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./fw.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/fw.c	2021-03-04 13:20:59.424172295 +0100
@@ -0,0 +1,290 @@
+#include "mwl8k_priv.h"
+
+/*
+ * LEGACY INTERFACE, used to exchange with helper
+ */
+struct mwl8k_cmd_pkt {
+	__le16	code;
+	__le16	length;
+	__u8	seq_num;
+	__u8	macid;
+	__le16	result;
+	char	payload[0];
+} __packed;
+
+#define MWL8K_HIU_GEN_PTR			0x00000c10
+#define MWL8K_HIU_INT_CODE			0x00000c14
+#define  MWL8K_INT_CODE_CMD_FINISHED		 0x00000005
+#define MWL8K_HIU_H2A_INTERRUPT_STATUS		0x00000c1c
+#define MWL8K_HIU_SCRATCH			0x00000c40
+
+#define  MWL8K_H2A_INT_DUMMY			 (1 << 20)
+#define  MWL8K_H2A_INT_RESET			 (1 << 15)
+#define  MWL8K_H2A_INT_DOORBELL			 (1 << 1)
+
+#define MWL8K_CMD_CODE_DNLD		0x0001
+
+/*
+ * end LEGACY INTERFACE
+ */
+
+
+/*
+ *
+ */
+static int mwl8k_send_fw_load_cmd(struct mwl8k_priv *priv, void *data, int length)
+{
+	void __iomem *regs = priv->regs;
+	dma_addr_t dma_addr;
+	int loops;
+
+	dma_addr = pci_map_single(priv->pdev, data, length, PCI_DMA_TODEVICE);
+	if (pci_dma_mapping_error(priv->pdev, dma_addr))
+		return -ENOMEM;
+
+	iowrite32(dma_addr, regs + MWL8K_HIU_GEN_PTR);
+	iowrite32(0, regs + MWL8K_HIU_INT_CODE);
+	iowrite32(MWL8K_H2A_INT_DOORBELL,
+		regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
+	iowrite32(MWL8K_H2A_INT_DUMMY,
+		regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
+
+	loops = 10000;
+	do {
+		if (priv->info->helper_image) {
+			u32 int_code = ioread32(regs + MWL8K_HIU_INT_CODE);
+			//printk("int code: %08x\n", int_code);
+			if (int_code == MWL8K_INT_CODE_CMD_FINISHED) {
+				iowrite32(0, regs + MWL8K_HIU_INT_CODE);
+				break;
+			}
+		} else {
+			u32 int_code;
+
+			int_code = ioread32(regs +
+					    MWL8K_HIU_H2A_INTERRUPT_STATUS);
+			//printk("int code: %08x\n", int_code);
+			if (int_code == 0)
+				break;
+		}
+
+		cond_resched();
+		udelay(1);
+	} while (--loops);
+
+	pci_unmap_single(priv->pdev, dma_addr, length, PCI_DMA_TODEVICE);
+
+	if (!loops) {
+		dev_dbg(&priv->pdev->dev,
+			"mwl8k_send_fw_load_cmd %u timeout\n",
+			length);
+	}
+
+	return loops ? 0 : -ETIMEDOUT;
+}
+
+/*
+ * firmware loading for 8366, bootrom interface
+ */
+static int mwl8k_load_fw_image(struct mwl8k_priv *priv,
+				const u8 *data, size_t length)
+{
+	struct mwl8k_cmd_pkt *cmd;
+	int done;
+	int rc = 0;
+
+	//printk("mwl8k_load_fw_image len:%u\n", length);
+
+	cmd = kmalloc(sizeof(*cmd) + 256, GFP_KERNEL);
+	if (cmd == NULL)
+		return -ENOMEM;
+
+	cmd->code = cpu_to_le16(MWL8K_CMD_CODE_DNLD);
+	cmd->seq_num = 0;
+	cmd->macid = 0;
+	cmd->result = 0;
+
+	done = 0;
+	while (length) {
+		int block_size = length > 256 ? 256 : length;
+
+		memcpy(cmd->payload, data + done, block_size);
+		cmd->length = cpu_to_le16(block_size);
+
+		//printk("load size: %u\n", block_size);
+		rc = mwl8k_send_fw_load_cmd(priv, cmd,
+						sizeof(*cmd) + block_size);
+		if (rc)
+			break;
+
+		done += block_size;
+		length -= block_size;
+
+		msleep(1);
+	}
+
+	if (!rc) {
+		//printk("final block\n");
+		cmd->length = 0;
+		rc = mwl8k_send_fw_load_cmd(priv, cmd, sizeof(*cmd));
+	}
+
+	kfree(cmd);
+
+	return rc;
+}
+
+/*
+ * firmware loading for 8366 helper & 8764 bootrom
+ */
+static int mwl8k_feed_fw_image(struct mwl8k_priv *priv,
+				const u8 *data, size_t length)
+{
+	unsigned char *buffer;
+	int may_continue, rc = 0;
+	u32 done, prev_block_size;
+
+	//printk("mwl8k_feed_fw_image: len:%u\n", length);
+
+	buffer = kmalloc(1024, GFP_KERNEL);
+	if (buffer == NULL) {
+		return -ENOMEM;
+	}
+
+	done = 0;
+	prev_block_size = 0;
+	may_continue = 1000;
+	while (may_continue > 0) {
+		u32 block_size;
+
+		block_size = ioread32(priv->regs + MWL8K_HIU_SCRATCH);
+		if (block_size & 1) {
+			//printk("BLOCK SIZE : %x\n", block_size);
+			rc = -EREMOTEIO;
+			break;
+		} else {
+			done += prev_block_size;
+			length -= prev_block_size;
+			//printk("total done: %u\n", done);
+		}
+
+		if (block_size > 1024 || block_size > length) {
+			rc = -EOVERFLOW;
+			//printk("OVERFLOW\n");
+			break;
+		}
+
+		if (length == 0) {
+			//printk("length finished\n");
+			rc = 0;
+			break;
+		}
+
+		if (block_size == 0) {
+			//printk("block_size == 0\n");
+			rc = -EPROTO;
+			may_continue--;
+			udelay(1);
+			continue;
+		}
+
+		//printk("block_size == %d\n", block_size);
+		prev_block_size = block_size;
+		memcpy(buffer, data + done, block_size);
+
+		rc = mwl8k_send_fw_load_cmd(priv, buffer, block_size);
+		if (rc) {
+			printk("send_fw_load_cmd failed\n");
+			break;
+		}
+	}
+
+	if (!rc && length != 0) {
+		rc = -EREMOTEIO;
+	}
+
+	kfree(buffer);
+
+	return rc;
+}
+
+/*
+ *
+ */
+int mwl8k_fw_upload(struct mwl8k_priv *priv)
+{
+	const struct firmware *fw = priv->fw_ucode;
+	const struct firmware *helper = priv->fw_helper;
+	int rc;
+
+	if (helper) {
+		rc = mwl8k_load_fw_image(priv, helper->data, helper->size);
+		if (rc) {
+			dev_err(&priv->pdev->dev,
+				"unable to load firmware helper image\n");
+			return rc;
+		}
+
+		/* give time for helper to load */
+		msleep(10);
+	}
+
+	rc = mwl8k_feed_fw_image(priv, fw->data, fw->size);
+	if (rc) {
+		dev_err(&priv->pdev->dev,
+			"unable to load firmware image\n");
+		return rc;
+	}
+
+	return 0;
+}
+
+/*
+ *
+ */
+int mwl8k_fw_request(struct mwl8k_priv *priv)
+{
+	int ret;
+
+	if (priv->info->helper_image) {
+		ret = request_firmware(&priv->fw_helper,
+				       priv->info->helper_image,
+				       &priv->pdev->dev);
+		if (ret) {
+			dev_err(&priv->pdev->dev,
+				"error requesting helper fw\n");
+			return ret;
+		}
+	}
+
+	ret = request_firmware(&priv->fw_ucode,
+			       priv->info->fw_image,
+			       &priv->pdev->dev);
+	if (ret) {
+		dev_err(&priv->pdev->dev,
+			"error requesting fw image\n");
+		return ret;
+	}
+
+	return 0;
+}
+
+/*
+ *
+ */
+static void fw_free(const struct firmware **fw)
+{
+	if (*fw == NULL)
+		return;
+	release_firmware(*fw);
+	*fw = NULL;
+}
+
+/*
+ *
+ */
+void mwl8k_fw_release(struct mwl8k_priv *priv)
+{
+	fw_free(&priv->fw_ucode);
+	fw_free(&priv->fw_helper);
+}
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./hostif_dmatest.h linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/hostif_dmatest.h
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./hostif_dmatest.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/hostif_dmatest.h	2021-03-04 13:20:59.424172295 +0100
@@ -0,0 +1,32 @@
+#ifndef HOSTIF_DMATEST_H_
+#define HOSTIF_DMATEST_H_
+
+#ifndef __KERNEL__
+/*
+ * map to linux kernel types for easier sharing
+ */
+#include <arch/mv8xxx/linux_types.h>
+#endif
+
+#ifndef __packed
+#define __packed __attribute__((packed))
+#endif
+
+/*
+ * DMA test service
+ */
+#define SVC_DMATEST_UUID	0x3bdb253c
+
+struct ixzone_svc_dma_test {
+
+	struct {
+		/*
+		 * single area used by firmware for doing read/write
+		 * test transfers to host RAM
+		 */
+		__le32		fw_req_size;
+		__le32		host_dma_address;
+	} test;
+} __packed;
+
+#endif /* HOSTIF_DMATEST_H_ */
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./hostif.h linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/hostif.h
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./hostif.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/hostif.h	2021-03-04 13:20:59.424172295 +0100
@@ -0,0 +1,83 @@
+#ifndef HOSTIF_H_
+#define HOSTIF_H_
+
+#ifndef __KERNEL__
+/*
+ * map to linux kernel types for easier sharing
+ */
+#include <arch/mv8xxx/linux_types.h>
+#endif
+
+#ifndef __packed
+#define __packed __attribute__((packed))
+#endif
+
+/*
+ * generic exchange ring buffer
+ */
+struct ixzone_ring_buf {
+	__le32			buf_offset;
+	__le32			buf_size;
+
+	/*
+	 * 'producer' & 'consumer' are relative (0 < val < buf_size)
+	 *
+	 * (consumer == producer) => buffer is empty
+	 * (producer == consumer - 1) => buffer is full
+	 */
+	__le32			producer;
+	__le32			consumer;
+} __packed;
+
+/*
+ * CONSOLE service
+ */
+#define SVC_CONSOLE_UUID	0x00010001
+
+struct ixzone_svc_console {
+	/*
+	 * producer == FW
+	 * consumer == HOST
+	 */
+	struct ixzone_ring_buf	rb;
+	__le32			irq_mask;
+} __packed;
+
+/*
+ * TTY service
+ */
+#define SVC_TTY_UUID		0x00010002
+
+struct ixzone_svc_tty {
+	/* producer is FW */
+	struct ixzone_ring_buf	f2h_rb;
+	__le32			f2h_irq_mask;
+
+	/* producer is host */
+	struct ixzone_ring_buf	h2f_rb;
+	__le32			h2f_irq_mask;
+} __packed;
+
+/*
+ * BOOT_AREA headers
+ */
+#define BOOTAREA_MAGIC		0x2cc4189b
+
+struct bootarea_root {
+	__le32			magic;
+	__u8			early_svc_count;
+	__u8			boot_done;
+	__le16			svc_count;
+} __packed;
+
+#define BOOTAREA_SVC_FLAG_SYNCH	(1 << 0)
+
+struct bootarea_svc {
+	__le32			svc_uuid;
+	__le32			svc_flags;
+
+	/* relative to root */
+	__le32			off;
+} __packed;
+
+#endif
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./hostif_wifi.h linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/hostif_wifi.h
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./hostif_wifi.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/hostif_wifi.h	2021-03-04 13:20:59.424172295 +0100
@@ -0,0 +1,612 @@
+#ifndef HOSTIF_WIFI_H_
+#define HOSTIF_WIFI_H_
+
+#ifndef __KERNEL__
+/*
+ * map to linux kernel types for easier sharing
+ */
+#include <arch/mv8xxx/linux_types.h>
+#endif
+
+#ifndef __packed
+#define __packed __attribute__((packed))
+#endif
+
+/*
+ * wifi service
+ */
+#define SVC_WIFI_UUID		0x43b2cab9
+
+#define WIFI_API_VERSION	1
+#define WIFI_MAX_TX_QUEUES	16
+
+enum wifi_cmd_id {
+	/* global commands */
+	WIFI_CMD_ADD_VIF,
+	WIFI_CMD_API_VERSION,
+	WIFI_CMD_DRAIN_QUEUE_SCHED,
+	WIFI_CMD_FW_VERSION,
+	WIFI_CMD_GET_MAC_ADDRESS,
+	WIFI_CMD_RADIO_CONTROL,
+	WIFI_CMD_GET_CHAN_SURVEY,
+	WIFI_CMD_RELEASE_VIF,
+	WIFI_CMD_SET_RX_FILTER,
+	WIFI_CMD_START,
+	WIFI_CMD_STOP,
+
+	/*  PER VIF commands */
+	WIFI_CMD_VIF_ADD_STA,
+	WIFI_CMD_VIF_DEL_STA,
+	WIFI_CMD_VIF_ADD_KEY,
+	WIFI_CMD_VIF_DEL_KEY,
+	WIFI_CMD_VIF_ENABLE_BEACON,
+	WIFI_CMD_VIF_GET_DTIM_COUNT,
+	WIFI_CMD_VIF_SET_BEACON_PARAMS,
+	WIFI_CMD_VIF_SET_BSS_PARAMS,
+	WIFI_CMD_VIF_SET_EDCA_PARAMS,
+	WIFI_CMD_VIF_SET_SHORT_SLOT,
+	WIFI_CMD_VIF_START,
+	WIFI_CMD_VIF_STOP,
+	WIFI_CMD_VIF_UPDATE_BEACON,
+
+	WIFI_CMD_LAST,
+};
+
+enum wifi_chan_bw {
+	WIFI_CHAN_BW_10MHZ,
+	WIFI_CHAN_BW_20MHZ,
+	WIFI_CHAN_BW_40MHZ_ABOVE,
+	WIFI_CHAN_BW_40MHZ_BELOW,
+	WIFI_CHAN_BW_5MHZ,
+};
+
+enum wifi_vif_type {
+	WIFI_VIF_TYPE_STA,
+	WIFI_VIF_TYPE_AP,
+};
+
+struct wifi_cmd_radio_control_req {
+	__u8		channel;
+	__u8		bw; /* enum wifi_chan_bw */
+} __packed;
+
+struct wifi_cmd_start_req {
+	struct {
+		__le32		dma_addr;
+		__le32		len;
+	} rx;
+
+	struct {
+		/* set len to 0 when not used */
+		__le32		dma_addr;
+		__le32		len;
+	} tx[WIFI_MAX_TX_QUEUES];
+
+} __packed;
+
+enum {
+	/* disable FCS fail filter */
+	WIFI_FILTER_FCS_FAIL		= (1 << 0),
+
+	/* disable all filters (include ftype filters) */
+	WIFI_FILTER_PROMISC		= (1 << 1),
+
+	/* disable multicast filter */
+	WIFI_FILTER_ALL_MULTI		= (1 << 2),
+
+	/* disable BSSID filter */
+	WIFI_FILTER_ALL_BSSID		= (1 << 3),
+
+	/* various per-ftype filter */
+	WIFI_FILTER_FTYPE_CONTROL	= (1 << 4),
+	WIFI_FILTER_FTYPE_PS_POLL	= (1 << 5),
+	WIFI_FILTER_FTYPE_PROBE_REQ	= (1 << 6),
+};
+
+enum wifi_ac {
+	WIFI_AC_BK = 0,
+	WIFI_AC_BE,
+	WIFI_AC_VI,
+	WIFI_AC_VO,
+};
+
+#define WIFI_AC_COUNT	4
+
+enum {
+	WIFI_CMD_CHAN_ASYNC,
+	WIFI_CMD_CHAN_ATOMIC,
+
+	WIFI_CMD_CHAN_LAST,
+};
+
+enum wifi_cmd_result {
+	WIFI_RESULT_OK,
+	WIFI_RESULT_INVAL,
+	WIFI_RESULT_UNKNOWN_CMD,
+	WIFI_RESULT_IO_ERROR,
+	WIFI_RESULT_NOSPC,
+	WIFI_RESULT_NOENT,
+	WIFI_RESULT_BUSY,
+	WIFI_RESULT_EAGAIN,
+	WIFI_RESULT_EXISTS,
+};
+
+#define WIFI_INVALID_VIF_HWID	0xffff
+#define WIFI_INVALID_STA_HWID	0xffff
+#define WIFI_INVALID_KEY_HWID	0xff
+#define WIFI_INVALID_TBTT_IDX	0xff
+
+struct wifi_cmd_set_rx_filter_req {
+	__le32		filter;
+} __packed;
+
+struct wifi_cmd_add_vif_req {
+	__u8			type; /* enum wifi_vif_type */
+	__u8			mac_addr[6];
+} __packed;
+
+struct wifi_cmd_get_chan_survey_resp {
+	__s8		avg_nf;
+	__u64		chan_time;
+	__u64		chan_busy;
+	__u64		chan_rx;
+	__u64		chan_tx;
+} __packed;
+
+struct wifi_cmd_add_vif_resp {
+	__le16		vif_hwid;
+	__u8		tbtt_idx;
+	__u8		ac_to_qid[WIFI_AC_COUNT];
+	__u8		cab_qid;
+} __packed;
+
+struct wifi_cmd_release_vif_req {
+	__le16		vif_hwid;
+} __packed;
+
+struct wifi_cmd_vif_start_req {
+	__le16		vif_hwid;
+} __packed;
+
+struct wifi_cmd_vif_stop_req {
+	__le16		vif_hwid;
+} __packed;
+
+struct wifi_cmd_vif_set_bss_params_req {
+	__le16		vif_hwid;
+	__u8		bssid[6];
+} __packed;
+
+struct wifi_cmd_vif_add_sta_req {
+	__le16		vif_hwid;
+	__u8		mac[6];
+} __packed;
+
+struct wifi_cmd_vif_add_sta_resp {
+	__le16		sta_hwid;
+} __packed;
+
+struct wifi_cmd_vif_del_sta_req {
+	__le16		vif_hwid;
+	__le16		sta_hwid;
+} __packed;
+
+struct wifi_cmd_vif_add_key_req {
+	__le16		vif_hwid;
+	__le16		sta_hwid;
+	__u8		key[16];
+	__u8		key_idx;
+} __packed;
+
+struct wifi_cmd_vif_add_key_resp {
+	__u8		key_hwid;
+} __packed;
+
+struct wifi_cmd_vif_del_key_req {
+	__le16		vif_hwid;
+	__le16		sta_hwid;
+	__u8		key_hwid;
+} __packed;
+
+struct wifi_cmd_vif_set_edca_params_req {
+	__le16		vif_hwid;
+	__u8		txq_idx;
+	__le16		aifsn;
+	__le16		cw_min;
+	__le16		cw_max;
+	__le16		txop;
+} __packed;
+
+struct wifi_cmd_vif_set_beacon_params_req {
+	__le16		vif_hwid;
+
+	/*
+	 * those parameters cannot be changed while beaconing is
+	 * enabled
+	 */
+	__u8		rate_idx;
+	__le16		beacon_interval;
+	__u8		dtim_period;
+
+} __packed;
+
+struct wifi_cmd_vif_enable_beacon_req {
+	__le16		vif_hwid;
+	__u8		enabled;
+} __packed;
+
+struct wifi_cmd_vif_set_short_slot_req {
+	__le16		vif_hwid;
+	__u8		is_short;
+} __packed;
+
+struct wifi_cmd_drain_queue_sched_req {
+	__u8		qid;
+} __packed;
+
+struct wifi_cmd_vif_get_dtim_count_req {
+	__le16		vif_hwid;
+} __packed;
+
+struct wifi_cmd_vif_update_beacon_req {
+	__le16		vif_hwid;
+	__le32		bcn_host_addr;
+	__le16		bcn_size;
+} __packed;
+
+
+struct wifi_cmd_api_version_resp {
+	__le32		version;
+} __packed;
+
+struct wifi_cmd_fw_version_resp {
+	__le16		major;
+	__le16		minor;
+} __packed;
+
+struct wifi_cmd_get_mac_address_resp {
+	__u8		mac_addr[6];
+	__le16		mac_addr_count;
+} __packed;
+
+struct wifi_cmd_vif_get_dtim_count_resp {
+	__u8		dtim_count;
+};
+
+struct wifi_cmd_hdr {
+	__le32		id;
+	__le32		size;
+} __packed;
+
+struct wifi_cmd_req {
+	union {
+		/* async command */
+		struct wifi_cmd_radio_control_req	radio_control;
+		struct wifi_cmd_start_req		start;
+		struct wifi_cmd_set_rx_filter_req	set_rx_filter;
+		struct wifi_cmd_add_vif_req		add_vif;
+		struct wifi_cmd_release_vif_req		release_vif;
+
+		struct wifi_cmd_vif_start_req		vif_start;
+		struct wifi_cmd_vif_stop_req		vif_stop;
+		struct wifi_cmd_vif_set_bss_params_req	vif_set_bss_params;
+		struct wifi_cmd_vif_set_short_slot_req	vif_set_short_slot;
+		struct wifi_cmd_vif_set_beacon_params_req	vif_set_beacon_params;
+		struct wifi_cmd_vif_enable_beacon_req	vif_enable_beacon;
+		struct wifi_cmd_vif_set_edca_params_req	vif_set_edca_params;
+		struct wifi_cmd_vif_add_sta_req		vif_add_sta;
+		struct wifi_cmd_vif_del_sta_req		vif_del_sta;
+		struct wifi_cmd_vif_add_key_req		vif_add_key;
+		struct wifi_cmd_vif_del_key_req		vif_del_key;
+
+		/* atomic commands */
+		struct wifi_cmd_drain_queue_sched_req	drain_queue_sched;
+		struct wifi_cmd_vif_get_dtim_count_req	vif_get_dtim_count;
+		struct wifi_cmd_vif_update_beacon_req	vif_update_beacon;
+	};
+} __packed;
+
+struct wifi_cmd_resp {
+	__le32		result;
+	union {
+		/* async commands */
+		struct wifi_cmd_api_version_resp	api_version;
+		struct wifi_cmd_fw_version_resp		fw_version;
+		struct wifi_cmd_get_mac_address_resp	get_mac_address;
+		struct wifi_cmd_get_chan_survey_resp	get_chan_survey;
+		struct wifi_cmd_add_vif_resp		add_vif;
+		struct wifi_cmd_vif_add_sta_resp	vif_add_sta;
+		struct wifi_cmd_vif_add_key_resp	vif_add_key;
+
+		/* atomic command */
+		struct wifi_cmd_vif_get_dtim_count_resp	vif_get_dtim_count;
+	};
+} __packed;
+
+#define WIFI_HDR_SIZE		(sizeof (struct wifi_cmd_hdr))
+#define WIFI_MAX_REQ_SIZE	(sizeof (struct wifi_cmd_req))
+#define WIFI_MAX_REPLY_SIZE	(sizeof (struct wifi_cmd_resp))
+#define WIFI_MAX_CMD_SIZE				\
+	(WIFI_HDR_SIZE +				\
+	((WIFI_MAX_REQ_SIZE > WIFI_MAX_REPLY_SIZE) ?	\
+	 WIFI_MAX_REQ_SIZE : WIFI_MAX_REPLY_SIZE))
+
+
+/*
+ * rx descriptors
+ */
+enum {
+	/* set if FCS is valid */
+	RXD_F_FCS_VALID		= (1 << 0),
+
+	/* set if frame was received with cck modulation */
+	RXD_F_CCK		= (1 << 1),
+
+	/* set if frame was received with short preamble */
+	RXD_F_SHORT_PREAMBLE	= (1 << 2),
+
+	/* set if frame was received using short GI */
+	RXD_F_SHORT_GI		= (1 << 3),
+
+	/* set if frame was received using HT */
+	RXD_F_HT		= (1 << 4),
+
+	/* set if frame was received inside AMPDU */
+	RXD_F_AMPDU		= (1 << 5),
+
+	/* set if frame was received using 40Mhz mod */
+	RXD_F_40MHZ		= (1 << 6),
+
+	/* set if frame was decrypted by hardware */
+	RXD_F_DECRYPTED		= (1 << 7),
+
+	/* set if firmware owns the buffer */
+	RXD_F_FW_OWNED		= (1 << 15),
+};
+
+struct wifi_rxd {
+	/* keep status at the beginning */
+	__le16		status;
+	__u8		pad[2];
+
+	__le32		buf_addr;
+
+	/* rssi per chain */
+	__s8		rssi_per_chain[4];
+
+	/* received rate, either MCS or hw index depending on HT flag
+	 * (status) */
+	__u8		rate;
+
+	/* global rssi */
+	__s8		rssi;
+
+	/* noise floor */
+	__s8		noise_floor;
+
+	/* received channel */
+	__s8		channel;
+
+	/* TSF value at rx */
+	__le32		tsf;
+
+	/* buf size must be > 128, updated by hardware */
+	__le16		buf_size;
+
+	__u8		pad2[10];
+};
+
+#ifndef __KERNEL__
+STATIC_ASSERT(sz_rxd, sizeof (struct wifi_rxd) == 32);
+#endif
+
+/*
+ * tx descriptors
+ */
+enum {
+	TXD_RF_SHORT_PRE	= (1 << 0),
+	TXD_RF_RTS_CTS		= (1 << 1),
+	TXD_RF_CTS_PROTECT	= (1 << 2),
+	TXD_RF_HT		= (1 << 3),
+	TXD_RF_SHORT_GI		= (1 << 4),
+	TXD_RF_40MHZ		= (1 << 5),
+	TXD_RF_VALID		= (1 << 7),
+};
+
+/*
+ * rate information, hardware has 4 fallback rates
+ *
+ * only first rate is used on A-MPDU
+ */
+struct wifi_txd_rinfo {
+	__u8		flags;
+	__u8		rate;
+	__u8		count:4;
+	__u8		antenna_mask:4;
+};
+
+/*
+ * status field
+ */
+enum {
+	/*
+	 * host to fw
+	 */
+
+	/* no-ack policy */
+	TXD_F_TX_NO_ACK		= (1 << 0),
+
+	/* clear STA PS filter for this frame */
+	TXD_F_TX_CLEAR_PS	= (1 << 1),
+
+	/* bypass STA PS filter for this frame */
+	TXD_F_TX_BYPASS_PS	= (1 << 2),
+
+	/* only 1 supported at MCS <= 7 (Nsts=2 && Nss=1) */
+	TXD_F_TX_STBC		= (1 << 3),
+
+	/* this is the first MPDU of an A-MPDU aggregate, all further
+	 * MPDUs to include in this aggregate must have AMPDU_MORE or
+	 * AMPDU_LAST flag, status reporting (BlockACK) will be done
+	 * only in last MPDU */
+	TXD_F_TX_AMPDU_START	= (1 << 4),
+
+	/* set on all MPDUs to include in current AMPDU besides
+	 * first & last */
+	TXD_F_TX_AMPDU_MORE	= (1 << 5),
+
+	/* set on last MPDUs to include in current AMPDU */
+	TXD_F_TX_AMPDU_LAST	= (1 << 6),
+
+	/* has to set on BAR to ensure fw will report BlockAck status,
+	 * tid field and sta are also mandatory */
+	TXD_F_TX_BAR		= (1 << 7),
+
+
+	/*
+	 * fw to host
+	 */
+
+	/* set by firmware if frame was sent successfully (unless
+	 * NO_ACK, this means that ACK or BlockACK was received) */
+	TXD_F_TX_SUCCESS	= (1 << 8),
+
+	/* set by firmware if frame was filtered because of STA ps
+	 * status, tx_success will not be set */
+	TXD_F_TX_PS_FILTERED	= (1 << 9),
+
+	/* set by firmware if frame was too big, tx success will not
+	 * be set */
+	TXD_F_TX_TOO_BIG	= (1 << 10),
+
+	/* set if firmware owns the buffer */
+	TXD_F_FW_OWNED		= (1 << 15),
+};
+
+#define WIFI_TXD_MAX_RATES	4
+
+struct wifi_txd {
+	/* keep status at beginning */
+	__le16			status;
+	__u8			pad[2];
+
+	__le32			buf_addr;
+
+	union {
+		/* filled by SW before transmit */
+		struct wifi_txd_rinfo	rinfo[WIFI_TXD_MAX_RATES];
+
+		/* filled by FW when tx is done, on last AMPDU
+		 * frame or BAR frames */
+		struct {
+			__u8		bitmap[8];
+			/* start sn only has the seqno part (12 bits) */
+			__le16		start_seq;
+		} ba;
+	};
+
+	/* filled by FW, number of total tries the hardware did */
+	__u8			tries_done:4;
+
+	/* can be 2, 3 or 4, implies corresponding header len without
+	 * QOS control field (16, 24, 30) */
+	__u8			addr_count:4;
+
+	/* offset in buf_addr where data starts (after header and qos
+	 * control if present) */
+	__u8			data_offset:7;
+	__u8			has_qos_control:1;
+
+	/* qos control field value if frame has one */
+	__le16			qos_control;
+
+	/* MSDU size (data size excluding header len) */
+	__le16			data_size;
+
+	/* index from 0 to 7 (from HT spec), only valid for first
+	 * packet of AMPDU */
+	__le16			ampdu_density:4;
+
+	/* host side current BA window start, needs to be filled when
+	 * sending an AMPDU, for the first packet */
+	__le16			ampdu_baw_ssn:12;
+
+	/*
+	 * VIF and STA (can be WIFI_INVALID_STA/VIF_HWID for none)
+	 *
+	 * needed by firmware to apply correct powersave policy for
+	 * the station, no PS update will be done if not set
+	 *
+	 * set neither of them for raw frame injection
+	 * set only vif_hwid for broadcast/multicast frames
+	 */
+	__le16			vif_hwid;
+	__le16			sta_hwid;
+
+	/*
+	 * CCMP PN, only used if key hwid if valid
+	 */
+	__u8			ccmp_pn[8];
+
+	/*
+	 * Key hwid (or WIFI_INVALID_KEY_HWID)
+	 *
+	 * if sta_hwid is set, this is a sta key index, otherwise it's
+	 * a vif key index (so vif_hwid has to bet set)
+	 */
+	__u8			key_hwid;
+
+	/*
+	 * TID must be set on last packet of AMDPU and on BAR frames
+	 * (in addition to the TXD_F_BAR)
+	 */
+	__u8			tid;
+
+	__u8			pad2[22];
+};
+
+#ifndef __KERNEL__
+STATIC_ASSERT(sz_txd, sizeof (struct wifi_txd) == 64);
+#endif
+
+struct ixzone_svc_wifi_cmd_chan {
+	__le32		buf_offset;
+	__le32		buf_size;
+	__le32		host_ctr;
+	__le32		fw_ctr;
+	__le32		h2f_irq_mask;
+	__le32		f2h_irq_mask;
+} __packed;
+
+struct ixzone_svc_wifi {
+	struct ixzone_svc_wifi_cmd_chan cmd_chans[WIFI_CMD_CHAN_LAST];
+
+	struct {
+		__le32	chain_count;
+	} radio;
+
+	struct {
+		__le32	f2h_irq_mask;
+	} rx;
+
+	struct {
+		__le32	f2h_irq_mask;
+		__le32	h2f_irq_mask;
+		__le16	txq_count;
+		__le16	max_ampdu_chain;
+	} tx;
+
+	struct {
+		__u8	max_sta_vif;
+		__u8	max_ap_vif;
+		__le16	bcn_interval_gcd;
+		__le32	tbtt_f2h_irq_mask;
+	} vif;
+
+} __packed;
+
+#ifndef __KERNEL__
+STATIC_ASSERT(sz_wifi, (sizeof (struct ixzone_svc_wifi) % 4) == 0);
+#endif
+
+#endif /* HOSTIF_WIFI_H_ */
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./main.c linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/main.c
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./main.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/main.c	2021-03-04 13:20:59.424172295 +0100
@@ -0,0 +1,648 @@
+#include <linux/init.h>
+#include <linux/kernel.h>
+
+#include "mwl8k_priv.h"
+
+static const struct dbg_svc_ops *dbg_services_ops[8];
+static size_t dbg_services_ops_count;
+
+/*
+ *
+ */
+static u32 dbg_services_process(struct mwl8k_priv *priv,
+				bool sync,
+				u32 mask)
+{
+	struct dbg_svc_priv *dsp;
+	struct list_head *head;
+	u32 remain = 0;
+
+	head = sync ? &priv->dbg_sync_services : &priv->dbg_services;
+	list_for_each_entry(dsp, head, next) {
+		u32 svc_mask;
+
+		if (unlikely(!dsp->ops->svc_process))
+			continue;
+
+		svc_mask = dsp->poll_mask & mask;
+		if (svc_mask)
+			remain |= dsp->ops->svc_process(dsp->svc_priv,
+							svc_mask);
+	}
+	return remain;
+}
+
+/*
+ *
+ */
+static u32 dbg_services_process_synch(struct mwl8k_priv *priv, u32 mask)
+{
+	return dbg_services_process(priv, true, mask);
+}
+
+/*
+ *
+ */
+static u32 dbg_services_process_normal(struct mwl8k_priv *priv,
+					 u32 mask)
+{
+	return dbg_services_process(priv, false, mask);
+}
+
+/*
+ *
+ */
+static void dbg_services_exit(struct list_head *head)
+{
+	struct dbg_svc_priv *dsp, *tmp;
+
+	list_for_each_entry_safe(dsp, tmp, head, next) {
+		if (!dsp->ops->svc_exit)
+			continue;
+		dsp->ops->svc_exit(dsp->svc_priv);
+	}
+}
+
+/*
+ *
+ */
+static void dbg_services_exit_all(struct mwl8k_priv *priv)
+{
+	dbg_services_exit(&priv->dbg_services);
+	dbg_services_exit(&priv->dbg_sync_services);
+}
+
+/*
+ *
+ */
+static void dbg_services_free(struct list_head *head)
+{
+	struct dbg_svc_priv *dsp, *tmp;
+
+	list_for_each_entry_safe(dsp, tmp, head, next) {
+		dsp->ops->svc_free(dsp->svc_priv);
+		kfree(dsp);
+	}
+}
+
+/*
+ *
+ */
+static void dbg_services_free_all(struct mwl8k_priv *priv)
+{
+	dbg_services_free(&priv->dbg_services);
+	dbg_services_free(&priv->dbg_sync_services);
+}
+
+/*
+ *
+ */
+static int dbg_services_add(struct mwl8k_priv *priv,
+			    u32 uuid,
+			    u16 flags,
+			    u32 poll_mask,
+			    const struct dbg_svc_ops *ops,
+			    void *svc_priv)
+{
+	struct dbg_svc_priv *dsp;
+	struct list_head *head;
+
+	dsp = kzalloc(sizeof (*dsp), GFP_KERNEL);
+	if (!dsp)
+		return -ENOMEM;
+
+	if (flags & BOOTAREA_SVC_FLAG_SYNCH) {
+		head = &priv->dbg_sync_services;
+		priv->dbg_sync_services_poll_mask |= poll_mask;
+	} else {
+		head = &priv->dbg_services;
+		priv->dbg_services_poll_mask |= poll_mask;
+	}
+
+	dsp->ops = ops;
+	dsp->poll_mask = poll_mask;
+	dsp->svc_uuid = uuid;
+	dsp->svc_priv = svc_priv;
+	list_add_tail(&dsp->next, head);
+	return 0;
+}
+
+/*
+ * Host work handling
+ */
+static void mwl8k_poll(unsigned long data)
+{
+	struct mwl8k_priv *priv = (struct mwl8k_priv *)data;
+	unsigned long flags;
+	u32 status, normal_status, sync_status, remain = 0;
+
+	/* don't rearm tasklet if we are stopping */
+	if (priv->poll_stop)
+		return;
+
+	/*
+	 * "dequeue" work to todo
+	 */
+	spin_lock_irqsave(&priv->poll_lock, flags);
+	normal_status = priv->poll_todo;
+	priv->poll_todo = 0;
+	spin_unlock_irqrestore(&priv->poll_lock, flags);
+
+	if (normal_status)
+		remain = dbg_services_process_normal(priv, normal_status);
+
+	/*
+	 * check for additionnal work
+	 */
+	spin_lock_irqsave(&priv->poll_lock, flags);
+	status = ioread32(priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
+
+	/* because of read side effect, if we dequeue some sync
+	 * services interrupt, we have to process them and make sure
+	 * they are unmasked */
+	sync_status = status & priv->dbg_sync_services_poll_mask;
+	if (unlikely(sync_status)) {
+		spin_lock(&priv->dbg_sync_services_lock);
+		dbg_services_process_synch(priv, sync_status);
+		spin_unlock(&priv->dbg_sync_services_lock);
+		iowrite32(~sync_status, priv->regs +
+			  MWL8K_HIU_A2H_INTERRUPT_STATUS);
+	}
+
+	normal_status = status & priv->dbg_services_poll_mask;
+	priv->poll_todo |= normal_status | remain;
+
+	if (priv->poll_todo) {
+		/* printk(KERN_DEBUG "poll: todo: %08x\n", priv->poll_todo); */
+		tasklet_schedule(&priv->poll_task);
+	} else {
+		/* ack all possible interrupts, will reset the hidden
+		 * internal IRQ mask */
+		/* printk(KERN_DEBUG "poll: no-todo\n"); */
+		iowrite32(~priv->poll_mask, priv->regs +
+			  MWL8K_HIU_A2H_INTERRUPT_STATUS);
+		/* printk(KERN_DEBUG "poll: out\n"); */
+
+		/* unmask all IRQ */
+		iowrite32(priv->poll_mask,
+			  priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
+	}
+	spin_unlock_irqrestore(&priv->poll_lock, flags);
+}
+
+/*
+ * Interrupt handling.
+ */
+static irqreturn_t mwl8k_interrupt(int irq, void *dev_id)
+{
+	struct mwl8k_priv *priv = dev_id;
+	u32 status, normal_status, sync_status;
+
+	status = ioread32(priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
+	if (!status)
+		return IRQ_NONE;
+
+	status &= priv->poll_mask;
+	if (!status)
+		return IRQ_HANDLED;
+
+	sync_status = status & priv->dbg_sync_services_poll_mask;
+	if (unlikely(sync_status)) {
+		spin_lock(&priv->dbg_sync_services_lock);
+		dbg_services_process_synch(priv, sync_status);
+		spin_unlock(&priv->dbg_sync_services_lock);
+
+		/* ack interrupt for sync services otherwise they are
+		 * internaly masked */
+		iowrite32(~sync_status, priv->regs +
+			  MWL8K_HIU_A2H_INTERRUPT_STATUS);
+	}
+
+	normal_status = status & priv->dbg_services_poll_mask;
+	if (likely(normal_status)) {
+		spin_lock(&priv->poll_lock);
+		priv->poll_todo |= normal_status;
+		spin_unlock(&priv->poll_lock);
+		tasklet_schedule(&priv->poll_task);
+
+		/* mask any further host interrupts for non sync
+		 * services */
+		iowrite32(priv->dbg_sync_services_poll_mask,
+			  priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
+
+		/* this write seems posted and we can re-enter IRQ
+		 * even after clearing mask, so make sure it's
+		 * actually disabled */
+		(void)ioread32(priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
+	}
+
+	return IRQ_HANDLED;
+}
+
+/*
+ *
+ */
+static int init_svc(struct mwl8k_priv *priv,
+		    struct __iomem bootarea_svc *svc)
+{
+	const struct dbg_svc_ops *ops;
+	u32 uuid = le32_to_cpu(svc->svc_uuid);
+	u32 flags = le32_to_cpu(svc->svc_flags);
+	u32 off = le32_to_cpu(svc->off);
+	u32 poll_mask;
+	void __iomem *vdesc;
+	void *data;
+	int ret;
+	size_t i;
+
+	ops = NULL;
+	for (i = 0; i < dbg_services_ops_count; i++) {
+		const struct dbg_svc_ops *tops = dbg_services_ops[i];
+
+		if (tops->uuid == uuid) {
+			ops = tops;
+			break;
+		}
+	}
+
+	if (!ops) {
+		dev_dbg(&priv->pdev->dev,
+			"unsupported service uuid %x\n", uuid);
+		return 0;
+	}
+
+	if (check_bound(SRAM_SIZE, off, ops->desc_size)) {
+		dev_err(&priv->pdev->dev,
+			"dbg node %s has bad offsets: %x\n",
+			ops->name, off);
+		return 0;
+	}
+
+	vdesc = priv->sram + off;
+	data = ops->svc_alloc(priv, vdesc, &poll_mask);
+	if (!data)
+		return -ENOMEM;
+
+	ret = dbg_services_add(priv, uuid, flags, poll_mask, ops, data);
+	if (ret) {
+		ops->svc_free(data);
+		return ret;
+	}
+
+	priv->poll_mask |= poll_mask;
+	dev_info(&priv->pdev->dev, "%s service detected\n", ops->name);
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int mwl8k_init(struct mwl8k_priv *priv)
+{
+	struct __iomem bootarea_root *root;
+	struct __iomem bootarea_svc *svc;
+	unsigned long timeout;
+	u32 i, early_svc_count, svc_count;
+	bool booted;
+	int ret;
+
+	/*
+	 * wait for magic data to appear in sram
+	 */
+	msleep(1);
+
+	booted = false;
+	root = (struct __iomem bootarea_root *)priv->sram;
+	for (i = 0; i < 100; i++) {
+		u32 magic = le32_to_cpu(ioread32(&root->magic));
+
+		if (magic == BOOTAREA_MAGIC) {
+			booted = true;
+			break;
+		}
+
+		msleep(1);
+	}
+
+	if (!booted) {
+		dev_err(&priv->pdev->dev,
+			"firmware did not boot\n");
+		return -EIO;
+	}
+
+	/*
+	 * parse bootarea, register early debug services
+	 */
+	early_svc_count = root->early_svc_count;
+	for (i = 0; i < early_svc_count; i++) {
+		svc = (struct __iomem bootarea_svc *)(root + 1) + i;
+
+		ret = init_svc(priv, svc);
+		if (ret)
+			return ret;
+	}
+
+	/* wait for boot to finish */
+	timeout = jiffies + HZ * 5;
+	booted = false;
+
+	while (jiffies < timeout) {
+		if (ioread8(&root->boot_done)) {
+			booted = true;
+			break;
+		}
+
+		/* process synchronous services in case firmware spins
+		 * on it */
+		dbg_services_process_synch(priv, ~0);
+		cpu_relax();
+
+		if (need_resched())
+			yield();
+	}
+
+	if (!booted) {
+		dev_err(&priv->pdev->dev,
+			"firmware did not complete boot\n");
+		return -EIO;
+	}
+
+	svc_count = le32_to_cpu(root->svc_count);
+	for (i = early_svc_count; i < early_svc_count + svc_count; i++) {
+		svc = (struct __iomem bootarea_svc *)(root + 1) + i;
+
+		ret = init_svc(priv, svc);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int mwl8k_init_post(struct mwl8k_priv *priv)
+{
+	struct dbg_svc_priv *dsp;
+	int ret = 0;
+
+	list_for_each_entry(dsp, &priv->dbg_sync_services, next) {
+		if (!dsp->ops->svc_init)
+			continue;
+
+		ret = dsp->ops->svc_init(dsp->svc_priv);
+		if (ret)
+			break;
+	}
+
+	list_for_each_entry(dsp, &priv->dbg_services, next) {
+		if (!dsp->ops->svc_init)
+			continue;
+
+		ret = dsp->ops->svc_init(dsp->svc_priv);
+		if (ret)
+			break;
+	}
+
+	return ret;
+}
+
+/*
+ *
+ */
+static void mwl8k_release(struct mwl8k_priv *priv)
+{
+	dbg_services_free_all(priv);
+	mwl8k_fw_release(priv);
+	mwl8k_debugfs_dev_remove(priv);
+}
+
+enum {
+	MWL8366 = 0,
+	MWL8764,
+};
+
+static const struct mwl8k_device_info mwl8k_info_tbl[] = {
+	[MWL8366] = {
+		.part_name	= "88w8366",
+		.helper_image	= "mwl8k_new/helper_8366.fw",
+		.fw_image	= "mwl8k_new/8366.fw",
+		.dma_mask	= DMA_BIT_MASK(31),
+	},
+	[MWL8764] = {
+		.part_name	= "88w8764",
+		.fw_image	= "mwl8k_new/8764.fw",
+		.dma_mask	= DMA_BIT_MASK(32),
+	},
+};
+
+/*
+ * PCI probe function
+ */
+static int mwl8k_probe(struct pci_dev *pdev,
+		       const struct pci_device_id *id)
+{
+	struct mwl8k_priv *priv;
+	int rc;
+
+	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	INIT_LIST_HEAD(&priv->dbg_services);
+	INIT_LIST_HEAD(&priv->dbg_sync_services);
+	spin_lock_init(&priv->dbg_sync_services_lock);
+	tasklet_init(&priv->poll_task, mwl8k_poll, (unsigned long)priv);
+	spin_lock_init(&priv->poll_lock);
+
+	rc = pcim_enable_device(pdev);
+	if (rc) {
+		dev_err(&pdev->dev,
+			"Cannot enable new PCI device\n");
+		return rc;
+	}
+
+	rc = pcim_iomap_regions(pdev, 0x5, MWL8K_NAME);
+	if (rc) {
+		dev_err(&pdev->dev,
+			"cannot obtain PCI resources\n");
+		return rc;
+	}
+
+	pci_set_master(pdev);
+	pci_set_drvdata(pdev, priv);
+	priv->pdev = pdev;
+	priv->info = &mwl8k_info_tbl[id->driver_data];
+	priv->sram = pcim_iomap_table(pdev)[0];
+	priv->regs = pcim_iomap_table(pdev)[2];
+
+	rc = pci_set_consistent_dma_mask(pdev, priv->info->dma_mask);
+	if (rc) {
+		dev_err(&pdev->dev, "failed to set consistent dma mask\n");
+		return rc;
+	}
+
+	rc = pci_set_dma_mask(pdev, priv->info->dma_mask);
+	if (rc) {
+		dev_err(&pdev->dev, "failed to set dma mask\n");
+		return rc;
+	}
+
+	rc = mwl8k_fw_request(priv);
+	if (rc)
+		return rc;
+
+	/* switch interrupt mode to clear on read */
+	iowrite32(0xffffffff, priv->regs + MWL8K_HIU_A2H_INTERRUPT_CLEAR_SEL);
+	/* clear all interrupts & reset internal mask */
+	(void)ioread32(priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
+	iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS);
+
+	/* don't use interrupt event mask, make it passthrough */
+	iowrite32(0xffffffff,
+		  priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
+
+	/* mask all IRQ for now */
+	iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
+
+	/* Load firmware into hardware */
+	rc = mwl8k_fw_upload(priv);
+	if (rc)
+		goto err_release;
+
+	rc = mwl8k_init(priv);
+	if (rc) {
+		dev_err(&pdev->dev,
+			"failed to init chip\n");
+		goto err_release;
+	}
+
+	rc = request_irq(priv->pdev->irq, mwl8k_interrupt,
+			 IRQF_SHARED, MWL8K_NAME, priv);
+	if (rc) {
+		dev_err(&pdev->dev,
+			"failed to register IRQ handler\n");
+		goto err_release;
+	}
+
+	/* unmask IRQ */
+	iowrite32(priv->poll_mask, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
+
+	rc = mwl8k_init_post(priv);
+	if (rc) {
+		dev_err(&pdev->dev, "post init failed\n");
+		goto err_irq;
+	}
+
+#ifdef CONFIG_DEBUG_FS
+	mwl8k_debugfs_dev_init(priv);
+#endif
+	return 0;
+
+err_irq:
+	dbg_services_exit_all(priv);
+	free_irq(pdev->irq, priv);
+
+err_release:
+	mwl8k_release(priv);
+
+	return rc;
+}
+
+static void mwl8k_remove(struct pci_dev *pdev)
+{
+	struct mwl8k_priv *priv = pci_get_drvdata(pdev);
+
+#ifdef CONFIG_DEBUG_FS
+	mwl8k_debugfs_dev_remove(priv);
+#endif
+
+	dbg_services_exit_all(priv);
+
+	/* disable IRQ & kill tasklet */
+	iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
+	priv->poll_stop = 1;
+	tasklet_kill(&priv->poll_task);
+
+	mwl8k_release(priv);
+	free_irq(pdev->irq, priv);
+}
+
+MODULE_FIRMWARE("mwl8k/helper_8366.fw");
+MODULE_FIRMWARE("mwl8k/8366.fw");
+MODULE_FIRMWARE("mwl8k/8764.fw");
+
+static const struct pci_device_id mwl8k_pci_id_table[] = {
+	{ PCI_VDEVICE(MARVELL, 0x2a40), .driver_data = MWL8366, },
+	{ PCI_VDEVICE(MARVELL, 0x2a41), .driver_data = MWL8366, },
+	{ PCI_VDEVICE(MARVELL, 0x2a42), .driver_data = MWL8366, },
+	{ PCI_VDEVICE(MARVELL, 0x2a43), .driver_data = MWL8366, },
+	{ PCI_VDEVICE(MARVELL, 0x2b36), .driver_data = MWL8764, },
+	{ },
+};
+
+MODULE_DEVICE_TABLE(pci, mwl8k_pci_id_table);
+
+static struct pci_driver mwl8k_new_driver = {
+	.name		= MWL8K_NAME,
+	.id_table	= mwl8k_pci_id_table,
+	.probe		= mwl8k_probe,
+	.remove		= mwl8k_remove,
+};
+
+/*
+ *
+ */
+static void __init register_dbg_service_ops(const struct dbg_svc_ops *ops)
+{
+	if (WARN_ON(dbg_services_ops_count >= ARRAY_SIZE(dbg_services_ops)))
+		return;
+	dbg_services_ops[dbg_services_ops_count] = ops;
+	dbg_services_ops_count++;
+	if (ops->init)
+		ops->init();
+}
+
+/*
+ *
+ */
+static int __init mwl8k_new_init(void)
+{
+#ifdef CONFIG_DEBUG_FS
+	mwl8k_debugfs_init();
+#endif
+	register_dbg_service_ops(&console_dbg_svc_ops);
+	register_dbg_service_ops(&vtty_dbg_svc_ops);
+	register_dbg_service_ops(&dma_test_dbg_svc_ops);
+	register_dbg_service_ops(&wifi_svc_ops);
+
+	return pci_register_driver(&mwl8k_new_driver);
+}
+
+/*
+ *
+ */
+static void __exit mwl8k_new_exit(void)
+{
+	size_t i;
+
+	pci_unregister_driver(&mwl8k_new_driver);
+#ifdef CONFIG_DEBUG_FS
+	mwl8k_debugfs_remove();
+#endif
+	for (i = 0; i < dbg_services_ops_count; i++) {
+		const struct dbg_svc_ops *ops = dbg_services_ops[i];
+		if (ops->exit)
+			ops->exit();
+	}
+}
+
+module_init(mwl8k_new_init);
+module_exit(mwl8k_new_exit);
+
+MODULE_AUTHOR("Maxime Bizon <mbizon@freebox.fr>");
+MODULE_DESCRIPTION("Marvel mwl8k new driver");
+MODULE_VERSION("1.0");
+MODULE_LICENSE("GPL");
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./Makefile linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/Makefile
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/Makefile	2021-03-04 13:20:59.424172295 +0100
@@ -0,0 +1,12 @@
+mwl8k_new-$(CONFIG_DEBUG_FS) += debugfs.o
+mwl8k_new-y += fw.o
+mwl8k_new-y += main.o
+mwl8k_new-y += utils.o
+
+mwl8k_new-y += svc_console.o
+mwl8k_new-y += svc_dma_test.o
+mwl8k_new-y += svc_vtty.o
+
+mwl8k_new-y += wifi_core.o
+
+obj-$(CONFIG_MWL8K_NEW)	+= mwl8k_new.o
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./mwl8k_priv.h linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/mwl8k_priv.h
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./mwl8k_priv.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/mwl8k_priv.h	2021-03-04 13:20:59.424172295 +0100
@@ -0,0 +1,199 @@
+#ifndef MWL8K_PRIV_H_
+#define MWL8K_PRIV_H_
+
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/spinlock.h>
+#include <linux/list.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include <linux/completion.h>
+#include <linux/etherdevice.h>
+#include <linux/slab.h>
+#include <net/mac80211.h>
+#include <linux/moduleparam.h>
+#include <linux/firmware.h>
+#include <linux/workqueue.h>
+#include <linux/crc32.h>
+
+#include "hostif.h"
+
+#define MWL8K_NAME	"mwl8k_new"
+#define MWL8K_PFX	MWL8K_NAME ": "
+
+/*
+ * registers
+ */
+
+/* Host->device communications */
+#define MWL8K_HIU_H2A_INTERRUPT_EVENTS		0x00000c18
+#define MWL8K_HIU_H2A_INTERRUPT_STATUS		0x00000c1c
+#define MWL8K_HIU_H2A_INTERRUPT_MASK		0x00000c20
+#define MWL8K_HIU_H2A_INTERRUPT_CLEAR_SEL	0x00000c24
+#define MWL8K_HIU_H2A_INTERRUPT_STATUS_MASK	0x00000c28
+
+/* Device->host communications */
+#define MWL8K_HIU_A2H_INTERRUPT_EVENTS		0x00000c2c
+#define MWL8K_HIU_A2H_INTERRUPT_STATUS		0x00000c30
+#define MWL8K_HIU_A2H_INTERRUPT_MASK		0x00000c34
+#define MWL8K_HIU_A2H_INTERRUPT_CLEAR_SEL	0x00000c38
+#define MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK	0x00000c3c
+
+#define SRAM_SIZE			(64 * 1024)
+
+/*
+ *
+ */
+struct mwl8k_ring_buf {
+	u8 __iomem		*start;
+	u32			size;
+	u32 __iomem		*fw_ptr;
+	u32 __iomem		*host_ptr;
+	u32			host_off;
+};
+
+/*
+ *
+ */
+struct mwl8k_priv;
+
+struct dbg_svc_ops {
+	const char	*name;
+	u32		uuid;
+	size_t		desc_size;
+	void		*(*svc_alloc)(struct mwl8k_priv *priv,
+				      void __iomem *vdesc,
+				      u32 *poll_mask);
+	int		(*svc_init)(void *data);
+	u32		(*svc_process)(void *data, u32 irq_status);
+	void		(*svc_exit)(void *data);
+	void		(*svc_free)(void *data);
+
+	void		(*init)(void);
+	void		(*exit)(void);
+};
+
+/*
+ *
+ */
+struct dbg_svc_priv {
+	u32			svc_uuid;
+	void			*svc_priv;
+	u32			poll_mask;
+	const struct dbg_svc_ops	*ops;
+	struct list_head	next;
+};
+
+/*
+ *
+ */
+struct mwl8k_device_info {
+	const char *part_name;
+	const char *helper_image;
+	const char *fw_image;
+	u64 dma_mask;
+};
+
+/*
+ * main per-device private data
+ */
+struct mwl8k_priv {
+	struct ieee80211_hw	*hw;
+	struct pci_dev		*pdev;
+
+	void __iomem		*sram;
+	void __iomem		*regs;
+
+	const struct mwl8k_device_info *info;
+	const struct firmware	*fw_helper;
+	const struct firmware	*fw_ucode;
+
+	spinlock_t		poll_lock;
+	bool			poll_stop;
+	u32			poll_todo;
+	u32			poll_mask;
+	struct tasklet_struct	poll_task;
+
+	spinlock_t		dbg_sync_services_lock;
+	u32			dbg_sync_services_poll_mask;
+	u32			dbg_services_poll_mask;
+	struct list_head	dbg_sync_services;
+	struct list_head	dbg_services;
+
+	unsigned int		vtty_count;
+
+#ifdef CONFIG_DEBUG_FS
+	struct dentry		*dbg_regs;
+	struct dentry		*dbg_sram;
+	struct dentry		*dbg_test;
+	struct debugfs_blob_wrapper blob_regs, blob_sram;
+#endif
+};
+
+/*
+ *
+ */
+static inline int check_bound(u32 bsize, u32 off, u32 size)
+{
+	if (off >= bsize)
+		return 1;
+
+	if (off + size < off)
+		return 1;
+
+	if (off + size >= bsize)
+		return 1;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static inline void mwl8k_raise_fw_irq(struct mwl8k_priv *priv, u32 mask)
+{
+	iowrite32(mask, priv->regs + MWL8K_HIU_H2A_INTERRUPT_EVENTS);
+}
+
+/*
+ * debugfs.c
+ */
+void mwl8k_debugfs_dev_init(struct mwl8k_priv *priv);
+void mwl8k_debugfs_dev_remove(struct mwl8k_priv *priv);
+void mwl8k_debugfs_init(void);
+void mwl8k_debugfs_remove(void);
+
+/*
+ * fw.c
+ */
+int mwl8k_fw_upload(struct mwl8k_priv *priv);
+int mwl8k_fw_request(struct mwl8k_priv *priv);
+void mwl8k_fw_release(struct mwl8k_priv *priv);
+
+/*
+ * utils.c
+ */
+void memcpy_fromio_iovec(u8 *kdata, struct iovec *iov, int len);
+
+size_t rb_gen_iov(struct mwl8k_ring_buf *rb,
+		  struct iovec iov[2],
+		  u32 fw_off,
+		  u32 max_size);
+
+int rb_init(const char *name,
+	    unsigned int off,
+	    struct  __iomem ixzone_ring_buf *rb_io,
+	    struct mwl8k_ring_buf *rb,
+	    bool host_is_consumer);
+
+/*
+ * debug services
+ */
+extern const struct dbg_svc_ops console_dbg_svc_ops;
+extern const struct dbg_svc_ops vtty_dbg_svc_ops;
+extern const struct dbg_svc_ops dma_test_dbg_svc_ops;
+extern const struct dbg_svc_ops wifi_svc_ops;
+
+#endif
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./svc_console.c linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/svc_console.c
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./svc_console.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/svc_console.c	2021-03-04 13:20:59.424172295 +0100
@@ -0,0 +1,151 @@
+#include "mwl8k_priv.h"
+#include "hostif.h"
+
+struct mwl8k_console_priv {
+	char			line_buf[256];
+	size_t			char_count;
+	struct mwl8k_ring_buf	rb;
+	u32			irq_mask;
+	bool			enabled;
+	struct mwl8k_priv	*priv;
+};
+
+/*
+ *
+ */
+static void console_print_lines(struct mwl8k_console_priv *cp)
+{
+	size_t i, start;
+
+	for (start = i = 0; i < cp->char_count; i++) {
+		if (cp->line_buf[i] != '\n')
+			continue;
+
+		/* end of line */
+		if (i - start) {
+			dev_info(&cp->priv->pdev->dev,
+				 "fw: %.*s\n",
+				 (int)(i - start),
+				 cp->line_buf + start);
+		}
+
+		start = i + 1;
+	}
+
+	if (start < cp->char_count)
+		memmove(cp->line_buf,
+			cp->line_buf + start,
+			cp->char_count - start);
+
+	cp->char_count -= start;
+}
+
+/*
+ *
+ */
+static void console_read_data(struct mwl8k_console_priv *cp)
+{
+	struct mwl8k_ring_buf *rb = &cp->rb;
+	u32 fw_off;
+
+	if (!cp->enabled)
+		return;
+
+	fw_off = le32_to_cpu(ioread32(rb->fw_ptr));
+	if (fw_off >= rb->size) {
+		dev_err(&cp->priv->pdev->dev,
+			"console fw off OOB: %08x\n", fw_off);
+		/* hard firmware crash, panic to get log */
+//		panic("mwl8k firmware crashed");
+		cp->enabled = false;
+		return;
+	}
+
+	do {
+		struct iovec iov[2];
+		size_t local_remain;
+		size_t len;
+
+		local_remain = sizeof (cp->line_buf) - cp->char_count;
+		if (!local_remain) {
+			cp->char_count = 0;
+			local_remain = sizeof (cp->line_buf);
+		}
+
+		len = rb_gen_iov(rb, iov, fw_off, local_remain);
+		if (!len)
+			break;
+
+		memcpy_fromio_iovec(cp->line_buf + cp->char_count, iov, len);
+		cp->char_count += len;
+
+		rb->host_off += len;
+		if (rb->host_off >= rb->size)
+			rb->host_off -= rb->size;
+
+		console_print_lines(cp);
+
+	} while (rb->host_off != fw_off);
+
+	iowrite32(rb->host_off, rb->host_ptr);
+}
+
+/*
+ *
+ */
+static u32 console_process(void *data, u32 irq_status)
+{
+	struct mwl8k_console_priv *cp = (struct mwl8k_console_priv *)data;
+	console_read_data(cp);
+	return 0;
+}
+
+/*
+ *
+ */
+static void *console_alloc(struct mwl8k_priv *priv, void __iomem *vdesc,
+			   u32 *poll_mask)
+{
+	struct __iomem ixzone_svc_console *desc = vdesc;
+	struct mwl8k_console_priv *cp;
+	unsigned int off;
+
+	if (!desc->irq_mask) {
+		dev_err(&priv->pdev->dev,
+			"console has no irq mask\n");
+		return NULL;
+	}
+
+	cp = kzalloc(sizeof (*cp), GFP_KERNEL);
+	if (!cp)
+		return NULL;
+
+	off = (void *)&desc->rb - (void *)priv->sram;
+	if (rb_init("console", off, &desc->rb, &cp->rb, true)) {
+		kfree(cp);
+		return NULL;
+	}
+
+	*poll_mask = le32_to_cpu(desc->irq_mask);
+	cp->priv = priv;
+	cp->enabled = true;
+	return cp;
+}
+
+/*
+ *
+ */
+static void console_free(void *data)
+{
+	struct mwl8k_console_priv *cp = (struct mwl8k_console_priv *)data;
+	kfree(cp);
+}
+
+const struct dbg_svc_ops console_dbg_svc_ops = {
+	.name		= "console",
+	.uuid		= SVC_CONSOLE_UUID,
+	.desc_size	= sizeof (struct ixzone_svc_console),
+	.svc_alloc	= console_alloc,
+	.svc_process	= console_process,
+	.svc_free	= console_free,
+};
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./svc_dma_test.c linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/svc_dma_test.c
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./svc_dma_test.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/svc_dma_test.c	2021-03-04 13:20:59.424172295 +0100
@@ -0,0 +1,72 @@
+#include "mwl8k_priv.h"
+#include "hostif_dmatest.h"
+
+struct dma_test_priv {
+	uint8_t			*area;
+	unsigned int		area_size;
+	dma_addr_t		area_dma;
+	struct mwl8k_priv	*priv;
+};
+
+/*
+ *
+ */
+static u32 dma_test_process(void *data, u32 irq_status)
+{
+	return 0;
+}
+
+/*
+ *
+ */
+static void *
+dma_test_alloc(struct mwl8k_priv *priv, void __iomem *vdesc,
+	       u32 *poll_mask)
+{
+	struct __iomem ixzone_svc_dma_test *desc = vdesc;
+	struct dma_test_priv *ds;
+	unsigned int i;
+
+	ds = kzalloc(sizeof (*ds), GFP_KERNEL);
+	if (!ds)
+		return NULL;
+
+	ds->area_size = le32_to_cpu(ioread32(&desc->test.fw_req_size));
+	ds->area = pci_alloc_consistent(priv->pdev, ds->area_size,
+					&ds->area_dma);
+	if (!ds->area) {
+		dev_err(&priv->pdev->dev,
+			"failed to alloc DMA server %u bytes\n",
+			ds->area_size);
+		kfree(ds);
+		return NULL;
+	}
+
+	for (i = 0; i < ds->area_size; i++)
+		ds->area[i] = i;
+
+	ds->priv = priv;
+	iowrite32(cpu_to_le32(ds->area_dma), &desc->test.host_dma_address);
+
+	return ds;
+}
+
+/*
+ *
+ */
+static void dma_test_free(void *data)
+{
+	struct dma_test_priv *ds = (struct dma_test_priv *)data;
+	pci_free_consistent(ds->priv->pdev, ds->area_size,
+			    ds->area, ds->area_dma);
+	kfree(ds);
+}
+
+const struct dbg_svc_ops dma_test_dbg_svc_ops = {
+	.name		= "dma_test",
+	.uuid		= SVC_DMATEST_UUID,
+	.desc_size	= sizeof (struct ixzone_svc_dma_test),
+	.svc_alloc	= dma_test_alloc,
+	.svc_process	= dma_test_process,
+	.svc_free	= dma_test_free,
+};
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./svc_vtty.c linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/svc_vtty.c
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./svc_vtty.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/svc_vtty.c	2021-03-04 13:20:59.424172295 +0100
@@ -0,0 +1,496 @@
+#include <linux/serial.h>
+#include <linux/serial_core.h>
+#include <linux/tty.h>
+#include <linux/tty_flip.h>
+
+#include "mwl8k_priv.h"
+#include "hostif.h"
+
+struct mwl8k_vtty_priv {
+	/* rx from firmware */
+	struct mwl8k_ring_buf	f2h_rb;
+	u32			f2h_irq_mask;
+
+	/* tx to firmware */
+	struct mwl8k_ring_buf	h2f_rb;
+	u32			h2f_irq_mask;
+
+	/* uart emulation */
+	struct uart_port	port;
+	bool			uart_started;
+	struct tasklet_struct	tx_task;
+
+	bool			enabled;
+	struct mwl8k_priv	*priv;
+};
+
+/*
+ *
+ */
+static struct uart_driver mwl8k_vtty_driver = {
+	.owner		= THIS_MODULE,
+	.driver_name	= "mwl8k_vtty",
+	.dev_name	= "mwl8k_vtty",
+	/* experimental major number */
+	.major		= 240,
+	.minor		= 0,
+	.nr		= 4,
+};
+
+/*
+ *
+ */
+static inline struct mwl8k_vtty_priv *to_vtty(struct uart_port *port)
+{
+	return container_of(port, struct mwl8k_vtty_priv, port);
+}
+
+/*
+ * serial core request to check if uart tx fifo is empty
+ */
+static unsigned int vtty_uart_tx_empty(struct uart_port *port)
+{
+	struct mwl8k_vtty_priv *vp = to_vtty(port);
+	struct mwl8k_ring_buf *rb = &vp->h2f_rb;
+	u32 fw_off;
+
+	printk("%s\n", __FUNCTION__);
+	fw_off = le32_to_cpu(ioread32(rb->fw_ptr));
+	if (fw_off == rb->host_off)
+		return 1;
+	return 0;
+}
+
+/*
+ * serial core request to return RI, CTS, DCD and DSR pin state
+ */
+static unsigned int vtty_uart_get_mctrl(struct uart_port *port)
+{
+	/* printk("%s\n", __FUNCTION__); */
+	return TIOCM_CTS | TIOCM_CD;
+}
+
+/*
+ * serial core request to set RTS and DTR pin state and loopback mode
+ */
+static void vtty_uart_set_mctrl(struct uart_port *port, unsigned int mctrl)
+{
+	/* struct mwl8k_vtty_priv *vp = to_vtty(port); */
+	/* printk("%s\n", __FUNCTION__); */
+}
+
+/*
+ * serial core request to start tx ASAP (used for flow control)
+ */
+static void vtty_uart_stop_tx(struct uart_port *port)
+{
+	/* printk("%s\n", __FUNCTION__); */
+}
+
+/*
+ * serial core request to (re)enable tx
+ */
+static void vtty_uart_start_tx(struct uart_port *port)
+{
+	struct mwl8k_vtty_priv *vp = to_vtty(port);
+	/* printk("%s\n", __FUNCTION__); */
+	tasklet_schedule(&vp->tx_task);
+}
+
+/*
+ * serial core request to stop rx, called before port shutdown
+ */
+static void vtty_uart_stop_rx(struct uart_port *port)
+{
+	struct mwl8k_vtty_priv *vp = to_vtty(port);
+
+	/* printk("%s\n", __FUNCTION__); */
+	/* irq are disabled */
+	vp->uart_started = false;
+}
+
+/*
+ * serial core request to enable modem status interrupt reporting
+ */
+static void vtty_uart_enable_ms(struct uart_port *port)
+{
+	/* printk("%s\n", __FUNCTION__); */
+}
+
+/*
+ * serial core request to start/stop emitting break char
+ */
+static void vtty_uart_break_ctl(struct uart_port *port, int ctl)
+{
+	/* printk("%s\n", __FUNCTION__); */
+}
+
+/*
+ * return port type in string format
+ */
+static const char *vtty_uart_type(struct uart_port *port)
+{
+	return "mwl8k_vtty";
+}
+
+/*
+ * serial core request to initialize uart and start rx operation
+ */
+static int vtty_uart_startup(struct uart_port *port)
+{
+	struct mwl8k_vtty_priv *vp = to_vtty(port);
+	unsigned long flags;
+
+	/* printk("%s\n", __FUNCTION__); */
+	spin_lock_irqsave(&port->lock, flags);
+	vp->uart_started = true;
+	spin_unlock_irqrestore(&port->lock, flags);
+	dev_info(&vp->priv->pdev->dev, "vtty line %d enabled\n", port->line);
+	return 0;
+}
+
+/*
+ * serial core request to flush & disable uart
+ */
+static void vtty_uart_shutdown(struct uart_port *port)
+{
+	struct mwl8k_vtty_priv *vp = to_vtty(port);
+	/* printk("%s\n", __FUNCTION__); */
+	dev_info(&vp->priv->pdev->dev, "vtty line %d disabled\n", port->line);
+}
+
+/*
+ * serial core request to change current uart setting
+ */
+static void vtty_uart_set_termios(struct uart_port *port,
+				  struct ktermios *new,
+				  struct ktermios *old)
+{
+	/* printk("%s\n", __FUNCTION__); */
+}
+
+/*
+ * serial core request to claim uart iomem
+ */
+static int vtty_uart_request_port(struct uart_port *port)
+{
+	/* printk("%s\n", __FUNCTION__); */
+	return 0;
+}
+
+/*
+ * serial core request to release uart iomem
+ */
+static void vtty_uart_release_port(struct uart_port *port)
+{
+	/* printk("%s\n", __FUNCTION__); */
+}
+
+/*
+ * serial core request to do any port required autoconfiguration
+ */
+static void vtty_uart_config_port(struct uart_port *port, int flags)
+{
+	/* printk("%s\n", __FUNCTION__); */
+	port->type = 1;
+}
+
+/*
+ * serial core request to check that port information in serinfo are
+ * suitable
+ */
+static int vtty_uart_verify_port(struct uart_port *port,
+				struct serial_struct *serinfo)
+{
+	printk("%s\n", __FUNCTION__);
+	/* if (port->type != PORT_BCM63XX) */
+	/* 	return -EINVAL; */
+	return 0;
+}
+
+/*
+ * serial core callbacks
+ */
+static const struct uart_ops vtty_uart_ops = {
+	.tx_empty	= vtty_uart_tx_empty,
+	.get_mctrl	= vtty_uart_get_mctrl,
+	.set_mctrl	= vtty_uart_set_mctrl,
+	.start_tx	= vtty_uart_start_tx,
+	.stop_tx	= vtty_uart_stop_tx,
+	.stop_rx	= vtty_uart_stop_rx,
+	.enable_ms	= vtty_uart_enable_ms,
+	.break_ctl	= vtty_uart_break_ctl,
+	.type		= vtty_uart_type,
+	.startup	= vtty_uart_startup,
+	.shutdown	= vtty_uart_shutdown,
+	.set_termios	= vtty_uart_set_termios,
+	.release_port	= vtty_uart_release_port,
+	.request_port	= vtty_uart_request_port,
+	.config_port	= vtty_uart_config_port,
+	.verify_port	= vtty_uart_verify_port,
+};
+
+/*
+ *
+ */
+static void vtty_read_data(struct mwl8k_vtty_priv *vp)
+{
+	struct mwl8k_ring_buf *rb = &vp->f2h_rb;
+	struct uart_port *port = &vp->port;
+	unsigned long flags;
+	unsigned int count;
+	u32 fw_off;
+
+	if (!vp->enabled)
+		return;
+
+	fw_off = le32_to_cpu(ioread32(rb->fw_ptr));
+	if (fw_off >= rb->size) {
+		dev_err(&vp->priv->pdev->dev,
+			"vtty f2h fw off OOB: %08x\n", fw_off);
+		vp->enabled = false;
+		return;
+	}
+
+	count = 0;
+	do {
+		u8 c;
+
+		if (rb->host_off == fw_off)
+			break;
+
+		c = ioread8(rb->start + rb->host_off);
+
+		spin_lock_irqsave(&port->lock, flags);
+		if (vp->uart_started) {
+			vp->port.icount.rx++;
+			uart_insert_char(&vp->port, 0, 0, c, TTY_NORMAL);
+		}
+		spin_unlock_irqrestore(&port->lock, flags);
+
+		count++;
+		rb->host_off++;
+		if (rb->host_off >= rb->size)
+			rb->host_off -= rb->size;
+
+	} while (rb->host_off != fw_off);
+
+	if (count) {
+		iowrite32(rb->host_off, rb->host_ptr);
+		mwl8k_raise_fw_irq(vp->priv, vp->h2f_irq_mask);
+	}
+
+	spin_lock_irqsave(&port->lock, flags);
+	if (vp->uart_started)
+		tty_flip_buffer_push(&vp->port.state->port);
+	spin_unlock_irqrestore(&port->lock, flags);
+}
+
+/*
+ *
+ */
+static void vtty_write_task(unsigned long data)
+{
+	struct mwl8k_vtty_priv *vp = (struct mwl8k_vtty_priv *)data;
+	struct mwl8k_ring_buf *rb = &vp->h2f_rb;
+	struct uart_port *port = &vp->port;
+	struct circ_buf *xmit;
+	unsigned long flags;
+	u32 fw_off, xmit_done;
+
+	if (!vp->enabled)
+		return;
+
+	spin_lock_irqsave(&port->lock, flags);
+
+	if (!vp->uart_started || uart_tx_stopped(port))
+		goto out_unlock;
+
+	fw_off = le32_to_cpu(ioread32(rb->fw_ptr));
+	if (fw_off >= rb->size) {
+		dev_err(&vp->priv->pdev->dev,
+			"vtty h2f fw off OOB: %08x\n", fw_off);
+		vp->enabled = false;
+		goto out_unlock;
+	}
+
+	xmit = &port->state->xmit;
+	xmit_done = 0;
+	while (1) {
+		u32 next;
+		u8 c;
+
+		/* do we have data to send ? */
+		if (uart_circ_empty(xmit))
+			break;
+
+		next = rb->host_off + 1;
+		if (next >= rb->size)
+			next -= rb->size;
+
+		/* is tx fifo full ? */
+		if (next == fw_off) {
+			dev_warn(&vp->priv->pdev->dev, "vtty tx fifo full\n");
+			break;
+		}
+
+		/* queue this char */
+		c = xmit->buf[xmit->tail];
+		iowrite8(c, rb->start + rb->host_off);
+		rb->host_off = next;
+		xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
+		port->icount.tx++;
+		xmit_done++;
+	}
+
+	if (xmit_done) {
+		iowrite32(rb->host_off, rb->host_ptr);
+		mwl8k_raise_fw_irq(vp->priv, vp->h2f_irq_mask);
+	}
+
+	if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+		uart_write_wakeup(port);
+
+out_unlock:
+	spin_unlock_irqrestore(&port->lock, flags);
+}
+
+
+/*
+ *
+ */
+static u32 vtty_process(void *data, u32 irq_status)
+{
+	struct mwl8k_vtty_priv *vp = (struct mwl8k_vtty_priv *)data;
+	vtty_read_data(vp);
+	tasklet_schedule(&vp->tx_task);
+	return 0;
+}
+
+/*
+ *
+ */
+static bool uart_driver_registered;
+
+static int vtty_register_uart_driver(struct mwl8k_priv *priv)
+{
+	int ret;
+
+	if (uart_driver_registered)
+		return 0;
+
+	ret = uart_register_driver(&mwl8k_vtty_driver);
+	if (ret) {
+		dev_err(&priv->pdev->dev,
+			"failed to register uart driver: %d\n", ret);
+		return ret;
+	}
+
+	uart_driver_registered = true;
+	return 0;
+}
+
+/*
+ *
+ */
+static void vtty_unregister_uart_driver(void)
+{
+	if (uart_driver_registered) {
+		uart_unregister_driver(&mwl8k_vtty_driver);
+		uart_driver_registered = false;
+	}
+}
+
+/*
+ *
+ */
+static void *vtty_alloc(struct mwl8k_priv *priv, void __iomem *vdesc,
+			u32 *poll_mask)
+{
+	struct __iomem ixzone_svc_tty *desc = vdesc;
+	struct mwl8k_vtty_priv *vp;
+	struct uart_port *port;
+	unsigned int off;
+	int ret;
+
+	if (vtty_register_uart_driver(priv))
+		return NULL;
+
+	if (!desc->f2h_irq_mask || !desc->h2f_irq_mask) {
+		dev_err(&priv->pdev->dev,
+			"vtty has no irq mask\n");
+		return NULL;
+	}
+
+	vp = kzalloc(sizeof (*vp), GFP_KERNEL);
+	if (!vp)
+		return NULL;
+
+	off = (void *)&desc->f2h_rb - (void *)priv->sram;
+	if (rb_init("vtty_f2h", off, &desc->f2h_rb, &vp->f2h_rb, true)) {
+		kfree(vp);
+		return NULL;
+	}
+
+	off = (void *)&desc->h2f_rb - (void *)priv->sram;
+	if (rb_init("vtty_h2f", off, &desc->h2f_rb, &vp->h2f_rb, false)) {
+		kfree(vp);
+		return NULL;
+	}
+
+	tasklet_init(&vp->tx_task, vtty_write_task, (unsigned long)vp);
+	port = &vp->port;
+	port->ops = &vtty_uart_ops;
+	port->dev = &priv->pdev->dev;
+	port->line = priv->vtty_count;
+	port->membase = (void *)vp->f2h_rb.host_ptr;
+	port->iotype = SERIAL_IO_MEM;
+	port->flags = UPF_BOOT_AUTOCONF;
+	port->type = 1;
+
+	ret = uart_add_one_port(&mwl8k_vtty_driver, port);
+	if (ret) {
+		dev_err(&priv->pdev->dev,
+			"failed to add uart port: %d\n", ret);
+		kfree(vp);
+		return NULL;
+	}
+
+	vp->f2h_irq_mask = le32_to_cpu(desc->f2h_irq_mask);
+	*poll_mask = vp->f2h_irq_mask;
+	vp->h2f_irq_mask = le32_to_cpu(desc->h2f_irq_mask);
+	vp->priv = priv;
+	vp->enabled = true;
+	priv->vtty_count++;
+	return vp;
+}
+
+/*
+ *
+ */
+static void vtty_free(void *data)
+{
+	struct mwl8k_vtty_priv *vp = (struct mwl8k_vtty_priv *)data;
+	uart_remove_one_port(&mwl8k_vtty_driver, &vp->port);
+	vp->enabled = false;
+	tasklet_kill(&vp->tx_task);
+	kfree(vp);
+}
+
+/*
+ *
+ */
+static void __exit vtty_exit(void)
+{
+	vtty_unregister_uart_driver();
+}
+
+const struct dbg_svc_ops vtty_dbg_svc_ops = {
+	.name		= "vtty",
+	.uuid		= SVC_TTY_UUID,
+	.desc_size	= sizeof (struct ixzone_svc_tty),
+	.svc_alloc	= vtty_alloc,
+	.svc_process	= vtty_process,
+	.svc_free	= vtty_free,
+	.exit		= vtty_exit,
+};
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./utils.c linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/utils.c
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./utils.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/utils.c	2021-03-04 13:20:59.424172295 +0100
@@ -0,0 +1,113 @@
+#include "mwl8k_priv.h"
+
+/*
+ *
+ */
+void memcpy_fromio_iovec(u8 *kdata, struct iovec *iov, int len)
+{
+	while (len > 0) {
+		if (iov->iov_len) {
+			int copy = min_t(unsigned int, len, iov->iov_len);
+			memcpy_fromio(kdata, iov->iov_base, copy);
+			len -= copy;
+			kdata += copy;
+			iov->iov_base += copy;
+			iov->iov_len -= copy;
+		}
+		iov++;
+	}
+}
+
+/*
+ * Reduce an iovec's length in-place.  Return the resulting number of segments
+ */
+static unsigned long iov_shorten(struct iovec *iov,
+				 unsigned long nr_segs, size_t to)
+{
+	unsigned long seg = 0;
+	size_t len = 0;
+
+	while (seg < nr_segs) {
+		seg++;
+		if (len + iov->iov_len >= to) {
+			iov->iov_len = to - len;
+			break;
+		}
+		len += iov->iov_len;
+		iov++;
+	}
+	return seg;
+}
+
+/*
+ *
+ */
+size_t rb_gen_iov(struct mwl8k_ring_buf *rb,
+		  struct iovec iov[2],
+		  u32 fw_off,
+		  u32 max_size)
+{
+	size_t iov_count;
+
+	if (fw_off >= rb->host_off) {
+		iov[0].iov_base = rb->start +  rb->host_off;
+		iov[0].iov_len = fw_off - rb->host_off;
+		iov[1].iov_base = NULL;
+		iov[1].iov_len = 0;
+	} else {
+		iov[0].iov_base = rb->start + rb->host_off;
+		iov[0].iov_len = rb->size - rb->host_off;
+		iov[1].iov_base = rb->start;
+		iov[1].iov_len = fw_off;
+	}
+
+	if (max_size)
+		iov_count = iov_shorten(iov, 2, max_size);
+	else
+		iov_count = 2;
+
+	return iov_length(iov, iov_count);
+}
+
+/*
+ *
+ */
+int rb_init(const char *name,
+	    unsigned int off,
+	    struct  __iomem ixzone_ring_buf *rb_io,
+	    struct mwl8k_ring_buf *rb,
+	    bool host_is_consumer)
+{
+	u32 boff, bsize;
+
+	boff = le32_to_cpu(rb_io->buf_offset);
+	bsize = le32_to_cpu(rb_io->buf_size);
+
+	if (check_bound(SRAM_SIZE, off + boff, bsize)) {
+		printk(KERN_ERR MWL8K_PFX
+		       "%s ring buf has bad buf offsets\n", name);
+		return 1;
+	}
+
+	rb->start = (void *)rb_io + boff;
+	rb->size = bsize;
+
+	if (host_is_consumer) {
+		rb->fw_ptr = &rb_io->producer;
+		rb->host_ptr = &rb_io->consumer;
+		rb->host_off = le32_to_cpu(rb_io->consumer);
+	} else {
+		rb->fw_ptr = &rb_io->consumer;
+		rb->host_ptr = &rb_io->producer;
+		rb->host_off = le32_to_cpu(rb_io->producer);
+	}
+
+	if (rb->host_off >= rb->size) {
+		printk(KERN_ERR MWL8K_PFX
+		       "%s ring buf has bad idx offsets\n", name);
+		return 1;
+	}
+
+	return 0;
+}
+
diff -Nruw linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./wifi_core.c linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/wifi_core.c
--- linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new./wifi_core.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/net/wireless/marvell/mwl8k_new/wifi_core.c	2021-03-04 13:20:59.427505629 +0100
@@ -0,0 +1,6034 @@
+#include <linux/mutex.h>
+#include <net/mac80211.h>
+
+#include "mwl8k_priv.h"
+#include "hostif_wifi.h"
+#include "d11_defs.h"
+
+static u8 base_mac_addr[18] = "00:00:00:00:00:00";
+module_param_string(base_mac_addr, base_mac_addr, 18, 0);
+MODULE_PARM_DESC(base_mac_addr,
+		  "Override EEPROM defined base mac address in AP mode");
+
+static int mac_addr_count = -1;
+module_param(mac_addr_count, int, 0);
+MODULE_PARM_DESC(mac_addr_count,
+		  "Override EEPROM defined mac address count");
+
+#undef TX_DBG_PRINT
+
+#ifdef TX_DBG_PRINT
+#define txdbg(...)	printk(__VA_ARGS__)
+#define psdbg(...)	printk(__VA_ARGS__)
+#define badbg(...)	printk(__VA_ARGS__)
+#define aggdbg(...)	printk(__VA_ARGS__)
+#else
+#define txdbg(...)
+#define psdbg(...)
+#define badbg(...)
+#define aggdbg(...)
+#endif
+
+#define RND_DROP_PPK	0
+
+#define WIFI_MAX_AP_VIFS	8
+#define WIFI_STA_MAGIC		0x12345678
+
+/*
+ * number of rx descriptors
+ */
+#define WIFI_RX_DESCS		256
+
+/*
+ * maximum number of descriptors we are allowed to use from the
+ * .wake_tx_queue interface
+ *
+ * we will be pushing at best two full aggregates (could be for two
+ * different TID), and/or 8 non aggregates.
+ *
+ * if not using aggregation, even the fastest packet takes no less
+ * than 100us to transmit (including ACK), so with about 8 of those,
+ * we can push 1ms of data into FIFO and make sure we don't starve
+ */
+#define WIFI_TX_MAX_AGGR	2
+#define WIFI_TX_MAX_NON_AGGR	8
+
+#define WIFI_TX_DESCS_WAKE	(WIFI_TX_MAX_AGGR * IEEE80211_AGGR_MAX_MPDU + \
+				 WIFI_TX_MAX_NON_AGGR)
+
+/*
+ * number of tx descriptors to allocate, we reserve some for drv_tx()
+ * callback which can only push control frames or ps response frames
+ */
+#define WIFI_TX_DESCS		(WIFI_TX_DESCS_WAKE + 8)
+
+
+/*
+ * rx buffer size, big enough to receive the minimum size AMSDU,
+ * mandatory for 802.11n
+ */
+#define WIFI_RX_BUF_SIZE	3839
+
+/*
+ * maximum number of time we will software retry a single mpdu from
+ * aggregate
+ */
+#define WIFI_MAX_SW_TRIES	20
+
+/* since hardware does not do multi rate retry on AMPDU, if we cannot
+ * build a large chain, better send them as individual packets, this
+ * is the minimum number of packets to send as AMPDU */
+#define WIFI_MIN_AGGR_COUNT	4
+
+/*
+ * rx queue (interface between host & firmware)
+ */
+struct wifi_rxq {
+	u32		count;
+	u32		refill_off;
+	u32		fw_off;
+
+	struct wifi_rxd	*descs;
+	dma_addr_t	descs_dma;
+
+	struct {
+		struct sk_buff *skb;
+		DEFINE_DMA_UNMAP_ADDR(dma);
+	} *bufs;
+};
+
+/*
+ * we will be doing some internal queing inside the driver to handle
+ * aggregation and software retransmit, the skb->cb leftover after
+ * mac80211 took its share is not big enough to contain all the extra
+ * data we need, so for each skb we track in tx path, there is an
+ * associated wifi_tx_skb struct
+ */
+enum wifi_tx_skb_type {
+	WIFI_TXSKB_QOS_DATA,
+	WIFI_TXSKB_BAR,
+	WIFI_TXSKB_OTHER,
+};
+
+struct wifi_tx_skb {
+	/* frame to transmit */
+	struct sk_buff		*skb;
+	DEFINE_DMA_UNMAP_ADDR(skb_dma);
+	DEFINE_DMA_UNMAP_LEN(skb_len);
+
+	/* txq it belongs to */
+	struct wifi_txq		*txq;
+
+	/* for packets aggregated, we will be doing software retries
+	 * of single failed mpdu, this is the total try count */
+	u8			sw_tries_done;
+
+	/*
+	 * whether the frame was sent has a valid tid field, it means
+	 * it got transmitted to a known STA, and that the frame will
+	 * be accounted in wifi_tid tx_pending
+	 */
+	bool			has_tid:1;
+
+	/* type of frame (valid if has_tid == true) */
+	enum wifi_tx_skb_type	type:2;
+
+	/*
+	 * if the frame has a known TID, this is the corresponding STA
+	 * version when it's created
+	 */
+	u32			sta_version;
+
+	/* tid of frame, used after tx completion to find back the
+	 * correct wifi_tid, only valid when has_tid is true */
+	u8			tid;
+
+	/*
+	 * when type is WIFI_TXSKB_BAR, this is the tid for which the
+	 * BAR request was sent (not the TID the frame was sent on)
+	 */
+	u8			bar_tid;
+
+	/* true size of frame that will be transmitted in the air,
+	 * including encryption and FCS, filled when we create this
+	 * wrapper */
+	u16			frame_len;
+
+	/* sequence number of frame, only valid for QOS data frames
+	 * (type == WIFI_TXSKB_QOS_DATA), extracted from header when
+	 * we create the wrapper */
+	u16			seq_no;
+
+	/* most invariant fields of tx descriptor are pre-computed
+	 * here, others like ampdu flags are updated just before
+	 * queuing to hardware */
+	struct wifi_txd		txdesc;
+
+	/* used when queing frame into hardware, aggr_member will be
+	 * true if frame is part of AMPDU, aggr_list will be non empty
+	 * for the last MPDU of the aggregate */
+	bool			aggr_member;
+	struct list_head	aggr_list;
+
+	struct list_head	next;
+};
+
+/*
+ * tx queue (interface between host & firmware)
+ */
+struct wifi_txq {
+	spinlock_t		lock;
+	u16			idx;
+	u16			ac;
+
+	/* DMA queue offsets */
+	u32			head_off;
+	u32			reclaim_off;
+
+	/* count of total descriptors we pushed in queue  */
+	u32			count;
+
+	/* count of aggregates & non-aggregate packets we pushed via
+	 * the wake_tx_queue interface */
+	u32			aggr_count;
+	u32			non_aggr_count;
+
+	/* pre-allocated list of wifi_tx_skb, same size as total
+	 * number of descriptors */
+	struct list_head	wifi_tx_skbs_pool;
+
+	/* tx hardware descriptors queue */
+	struct wifi_txd		*descs;
+	dma_addr_t		descs_dma;
+
+	/* pending packets */
+	struct wifi_tx_skb	**pending_wskb;
+
+	/* pre-computed aggregate maximum size for each; chan-width,
+	 * per-guard-interval, per mcs */
+	u16			max_aggr_framelen[2][2][32];
+};
+
+enum wifi_ps_action {
+	WIFI_PS_ACTION_NONE,
+	WIFI_PS_ACTION_SLEEP,
+	WIFI_PS_ACTION_TXDONE,
+	WIFI_PS_ACTION_WAKEUP,
+};
+
+enum wifi_ps_state {
+	WIFI_PS_AWAKE,
+	WIFI_PS_ENTER_SLEEP,
+	WIFI_PS_SLEEP,
+};
+
+struct wifi_sta {
+	/*
+	 * there is a race in mac80211, .sta_notify callback can be
+	 * called before .sta_add has completed, which result in a
+	 * crash because struct wifi_sta is initialized in .sta_add
+	 *
+	 * workaround this with a magic init done marker value
+	 */
+	u32			magic;
+
+	/*
+	 * STA is looked up on tx completion by its mac address, but
+	 * since we don't wait for tx queue to drain when removing a
+	 * STA, it's possible for the STA to deauth and re-auth while
+	 * packet are still pending in tx queue, which will mess up
+	 * with the BAW tracking
+	 *
+	 * fix this by having an additional "version" counter
+	 */
+	u32			version;
+
+	/*
+	 * hardware id allocated by the firmware
+	 */
+	__le16			hw_id;
+
+
+	/* this makes tid invisible to tx done handler, used to
+	 * prevent TID rescheduling when flushing aggregation state
+	 * (see ampdu_action) */
+	bool			dead;
+
+	/*
+	 * reflect current PS state of station, updated via notify
+	 * callback from mac80211, this goes like this
+	 *
+	 * 1) STA is initially in PS_AWAKE state.
+	 *
+	 * 2) If/when stack receives a packet with the PS bit set, it
+	 * will call our .sta_notify callback
+	 *
+	 * 3) if there is no packet pending (in TX DMA queue) for this
+	 * STA, we will switch to SLEEP state (see 5)
+
+	 * 4) Otherwise, we get into ENTER_SLEEP state, and call
+	 * ieee80211_sta_block_awake() so that mac80211 will leave the
+	 * STA internal state to sleep if it wakes up.f Each time we
+	 * get tx completion for a packet, we decrement the pending
+	 * counter for the associated STA. When it reaches 0, we will
+	 * unblock mac80211 and switch to SLEEP state.
+	 *
+	 * 5) when entering SLEEP state, we tell mac80211 whether of
+	 * not we have buffered packets in the driver for each STA/TID
+	 * using ieee80211_sta_set_buffered(). This is re-evaluated
+	 * each time we dequeue a packet from the TID retry queue and
+	 * the retry queue becomes empty. Note that there is an
+	 * additional sub state in each TID, ps_sleep_has_buf tracks
+	 * whether we have reported that we still have buffered data
+	 * or not for this TID
+	 *
+	 * when PS state is AWAKE, packets for a tid should flow only
+	 * from the itxq (tid_schedule)
+	 *
+	 * when PS state is ENTER_SLEEP, there should be no tx at all.
+	 *
+	 * when PS state is SLEEP && ps_sleep_has_buf == true for any
+	 * TID, data packets should be sent only as a respond to
+	 * PS-Poll (service period), and done only through
+	 * .release_buffered_frames interface
+	 *
+	 * when PS state is SLEEP && ps_sleep_has_buf == false for all
+	 * TIDs, same as previously, but we will also get packets
+	 * buffered inside mac80211 through drv_tx() interface
+	 */
+	enum wifi_ps_state	ps_state;
+
+	/* number of packets currently sitting in hw queue waiting for
+	 * tx completion for this STA, only packets sent on a valid
+	 * tid are accounted */
+	unsigned int		tx_pending;
+
+	/*
+	 * this lock protect the PS state
+	 */
+	spinlock_t		lock;
+
+	/*
+	 * HW has a persistent filter for STA in powersave, and will
+	 * return all frames as filtered until it's cleared.
+	 *
+	 * usually that's racy because STA PS status gets updated by
+	 * rx path, while we get filtered frame by tx completion.
+	 *
+	 * since we use ieee80211_sta_block_awake() in the driver,
+	 * there can not be any sleep => awake => sleep STA transition
+	 * without the STA pending traffic being drained. The
+	 * clear_ps_filter flag will be set only after we leave the
+	 * SLEEP state, all packets sent during service period are
+	 * flags to bypass that filter.
+	 */
+	atomic_t		clear_ps_filter;
+};
+
+#define WIFI_STA(_sta) ((struct wifi_sta *)&((_sta)->drv_priv))
+
+
+/*
+ * private per mac80211 intermediate txq info (called it a TID to
+ * avoid confusion with other txq)
+ */
+enum wifi_aggr_state {
+	WIFI_AGGR_STOPPED,
+	WIFI_AGGR_ACTIVE,
+	WIFI_AGGR_STOPPING,
+};
+
+enum wifi_bar_state {
+	WIFI_BAR_NONE,
+	WIFI_BAR_NEEDED,
+	WIFI_BAR_SENT,
+	WIFI_BAR_WAIT_RETRY,
+};
+
+enum wifi_tid_type {
+	/* for itxq associated to VIF, used for multicast traffic, no
+	 * associated STA */
+	WIFI_TID_MCAST,
+
+	/* for special itxq with id 16 (IEEE80211_NUM_TIDS), we get
+	 * bufferable management frames on it */
+	WIFI_TID_STA_MMPDU,
+
+	/* for itxq with TID 0 and non WME STA, we get data frame only
+	 * on those, but the sequence number will not be monotonic */
+	WIFI_TID_STA_DATA,
+
+	/* for itxq with TID 0 to 15 and WME STA, we only get QOS data
+	 * on those */
+	WIFI_TID_STA_QOS_DATA,
+
+};
+
+struct wifi_tid {
+	/* see enum definition */
+	enum wifi_tid_type	type;
+
+	/*
+	 * see explanation regarding ps_state in wifi_sta
+	 */
+	bool			ps_sleep_has_buf;
+
+	/*
+	 * internal list of packets that needs to be retried, this is
+	 * used only if tid type is WIFI_TID_STA_QOS_DATA, whether
+	 * aggregation is active or not.
+	 *
+	 * filtered frames (STA is in powersave) for are requeued here
+	 * and not given back to mac80211
+	 *
+	 * when aggregation is active, frames that we dequeued from
+	 * mac80211 itxq and were not sent (max aggregate len reached)
+	 * or sent but got no ACK are sitting here, waiting to be
+	 * (re)transmitted.
+	 *
+	 * order of packets inside does not matter, the rule is that
+	 * whatever sits here should be part of current BAW.
+	 */
+	struct list_head	retry_q;
+
+	/* current block ack session state for this tid */
+	enum wifi_aggr_state	aggr_state;
+
+	/* maximum total number of bytes allowed by remote STA in an
+	 * ampdu, updated when aggregation is started */
+	u16			ampdu_max_bytes;
+
+	/* minimum ampdu density requested by remote STA, index from 0
+	 * to 7 */
+	u8			ampdu_density;
+
+	/*
+	 * This is the BlockAck window (BAW) maximum size (number of
+	 * packets), defaults to hardware max, updated to remote STA
+	 * maximum supported value (if lower) when aggr session state
+	 * switches to operational.
+	 *
+	 * It's used even when aggregation is disabled. All PS
+	 * filtered frames will be retried by the driver itself, so
+	 * until a frame is ACKed, it's considered as inflight. When
+	 * aggregation wants to start, we have to return a starting
+	 * SSN, which must include those inflight packets (otherwise
+	 * if we could send packets with a SSN lower than what we
+	 * returned in AddBA). Instead of an alternative inflight
+	 * counters, we re-use the BAW to implement this, baw_size is
+	 * set to an artificial limit.
+	 */
+	u16			baw_max_size;
+
+	/*
+	 * After AddBA exchange, chosen BAW size may be lower than
+	 * what remote is using, because mac80211 send a fixed 64
+	 * value to remote, which may be higher than what our hardware
+	 * support, we remember the remote BAW size, and use it for
+	 * BAR scheduling
+	 */
+	u16			remote_baw_max_size;
+
+	/*
+	 * this is the sequence number that correspond the the start
+	 * of our BAW (BlockAck window)
+	 */
+	u16			seq_start;
+
+	/*
+	 * scoreboard tracks the blockack window state.
+	 *
+	 * (scb == scoreboard)
+	 *
+	 * scb_inflight bitmap tracks whether given frames is in-flight
+	 * (not yet acked, not yet failed), scb_acked is bitmap of
+	 * positively acknowledged frames
+	 *
+	 * scb_inflight_count is the number of frames in scb_inflight
+	 * bitmap
+	 *
+	 * scb_head is the bit index inside scoreboard corresponding
+	 * to the status of packet with <seq_start>
+	 *
+	 * scb_tail is the bit index inside scoreboard corresponding
+	 * to the next available space in the scoreboard. (scb_tail -
+	 * scb_head) is the number of in-flight packets (from the
+	 * received POV)
+	 *
+	 * bitmap range validity is  [ <scb_head>, <scb_tail> - 1 ]
+	 *
+	 * NB: scoreboards size needs to be 1 element more because of
+	 * ring buffer structure (scb_head == scb_tail is empty,
+	 * scb_head + 1 == scb_tail is full)
+	 */
+#define WIFI_SCB_MAX		(IEEE80211_AGGR_MAX_MPDU + 1)
+
+	unsigned long		scb_acked[BITS_TO_LONGS(WIFI_SCB_MAX)];
+	unsigned long		scb_inflight[BITS_TO_LONGS(WIFI_SCB_MAX)];
+	unsigned int		scb_inflight_count;
+	unsigned int		scb_head;
+	unsigned int		scb_tail;
+
+	/*
+	 * After a failed MPDU (too many retransmits), there is a
+	 * "hole" in the BAW. If failed MPDU has seq_no N, and
+	 * receiver has successfuly received MPDUs N+1 and N+2, those
+	 * won't be delivered to the higher level until a very large
+	 * timeout.
+	 *
+	 * To make the receiver aware we won't retry the failed MPDU,
+	 * we can send a "BlocAck Request" (BAR) frame, with a field
+	 * Starting Sequence Number (SSN) equal to N+3, which will
+	 * cause it to "flush" all MPDU stored with seq_no < N+3
+	 *
+	 * Note that it's not mandatory, the receiver side BAW will
+	 * still advance when receiving packets outside the BAW range
+	 * (as long as sequence lies withing 2^11 of current one), so
+	 * if we keep sending MPDU and reach seq_no N+64, then MPDU N
+	 * will be flushed anyway.
+	 *
+	 * So we use a timer, each time we know that a BAR has to be
+	 * sent, we arm the timer and remember the SSN, if after the
+	 * timer the hole is not past SSN+64 we will send the BAR.
+	 *
+	 * Only one BAR will be sent at a time, and we won't send a
+	 * new one unless the previous one has been sent (tx
+	 * completion).
+	 *
+	 * mac80211 has a logic to retry failed BAR, but that causes
+	 * re-entering the tx path from tx completion path
+	 * (ieee80211_tx_status_ext() => drv_tx()), which requires
+	 * careful locking, to avoid this complexity we don't report
+	 * BAR tx failure to mac80211 and schedule bar retry ourselves
+	 *
+	 * BAR can also be sent immediately from the tx path if it's
+	 * pending and we dequeued everything on the TID.
+	 *
+	 * When BAR state is set to BAR_NEEDED, timer will be armed,
+	 * bar_req_limit tracks the maximum SN inside BAW for which
+	 * the BAR is useful, if BAW head goes past this value, then
+	 * BAR is canceled.
+	 *
+	 * When BAR tx fails, state switch to BAR_WAIT_RETRY, timer is not
+	 * armed. In that state, if any MPDU is acked, timer will be
+	 * armed to minimum value.
+	 */
+	spinlock_t		bar_lock;
+	enum wifi_bar_state	bar_state;
+	bool			bar_inflight;
+	int			bar_retry_count;
+	struct timer_list	bar_timer;
+	int			bar_req_limit;
+
+	/* associated hardware tx queue */
+	struct wifi_txq		*txq;
+};
+
+#define WIFI_TID(_txqi) ((struct wifi_tid *)&((_txqi)->drv_priv))
+
+#define TID2ITXQ(_tid)	container_of((void *)wifi_tid,		\
+				     struct ieee80211_txq,	\
+				     drv_priv)
+
+/*
+ * private per-vif info
+ */
+struct wifi_vif {
+	__le16			hw_id;
+	unsigned int		tbtt_idx;
+};
+
+#define WIFI_VIF(_vif) ((struct wifi_vif *)&((_vif)->drv_priv))
+
+/*
+ * command channel
+ */
+struct wifi_cmd_chan {
+	u8 __iomem		*buf_start;
+	u32			buf_size;
+	u32			f2h_irq_mask;
+	u32			h2f_irq_mask;
+	u32 __iomem		*fw_count_ptr;
+	u32 __iomem		*host_count_ptr;
+	u32 __iomem		host_count;
+	struct mutex		lock;
+	spinlock_t		complete_lock;
+	struct completion	completion;
+	bool			pending;
+};
+
+/*
+ *
+ */
+struct wifi_priv {
+	/*
+	 * cmd offset
+	 */
+	struct wifi_cmd_chan	cmd_chans[WIFI_CMD_CHAN_LAST];
+
+	/*
+	 * rx related
+	 */
+	u32			rx_f2h_irq_mask;
+	struct wifi_rxq		rxq;
+
+	/*
+	 * tx related
+	 */
+	struct wifi_txq		*txqs;
+	size_t			txq_count;
+	u32			tx_f2h_irq_mask;
+	u32			tx_f2h_irq_shift;
+	u32			tx_h2f_irq_mask;
+	u32			tx_h2f_irq_shift;
+
+	/*
+	 * vif related
+	 */
+	u32			tbtt_f2h_irq_mask;
+	u32			tbtt_f2h_irq_shift;
+
+	/*
+	 * misc
+	 */
+	u16			fw_major;
+	u16			fw_minor;
+	struct mac_address	addresses[8];
+	size_t			addresses_count;
+
+	/*
+	 * hardware limits
+	 */
+	int			hw_max_ampdu_chain;
+	int			hw_max_ap_vif;
+	int			hw_max_sta_vif;
+	int			hw_radio_chains;
+	int			hw_bcn_interval_gcd;
+
+	struct ieee80211_supported_band gband;
+	struct ieee80211_iface_limit if_limits[2];
+	struct ieee80211_iface_combination if_comb;
+
+	u32			sta_next_version;
+	struct survey_info	survey[13];
+	int			cur_chan_idx;
+
+	spinlock_t		vifs_by_tbtt_lock;
+	struct ieee80211_vif	*vifs_by_tbtt_idx[WIFI_MAX_AP_VIFS];
+
+	struct ieee80211_hw	*hw;
+	bool			hw_registered;
+	struct pci_dev		*pdev;
+	struct device		*dev;
+	struct mwl8k_priv	*priv;
+};
+
+/*
+ * supported band
+ */
+#define CHAN2G(_idx, _freq)  {	   \
+	.band = NL80211_BAND_2GHZ, \
+	.center_freq = (_freq), \
+	.hw_value = (_idx), \
+	.max_power = 20, \
+}
+
+static struct ieee80211_channel gchannels[] = {
+	CHAN2G(1, 2412),
+	CHAN2G(2, 2417),
+	CHAN2G(3, 2422),
+	CHAN2G(4, 2427),
+	CHAN2G(5, 2432),
+	CHAN2G(6, 2437),
+	CHAN2G(7, 2442),
+	CHAN2G(8, 2447),
+	CHAN2G(9, 2452),
+	CHAN2G(10, 2457),
+	CHAN2G(11, 2462),
+	CHAN2G(12, 2467),
+	CHAN2G(13, 2472),
+};
+
+static struct ieee80211_rate mwl8k_rates[] = {
+	{
+		.bitrate = 10,
+		.hw_value = 0,
+	},
+	{
+		.bitrate = 20,
+		.flags = IEEE80211_RATE_SHORT_PREAMBLE,
+		.hw_value = 1,
+	},
+	{
+		.bitrate = 55,
+		.flags = IEEE80211_RATE_SHORT_PREAMBLE,
+		.hw_value = 2,
+	},
+	{
+		.bitrate = 110,
+		.flags = IEEE80211_RATE_SHORT_PREAMBLE,
+		.hw_value = 3,
+	},
+	{
+		.bitrate = 60,
+		.hw_value = 5,
+	},
+	{
+		.bitrate = 90,
+		.hw_value = 6,
+	},
+	{
+		.bitrate = 120,
+		.hw_value = 7,
+	},
+	{
+		.bitrate = 180,
+		.hw_value = 8,
+	},
+	{
+		.bitrate = 240,
+		.hw_value = 9,
+	},
+	{
+		.bitrate = 360,
+		.hw_value = 10,
+	},
+	{
+		.bitrate = 480,
+		.hw_value = 11,
+	},
+	{
+		.bitrate = 540,
+		.hw_value = 12,
+	}
+};
+
+
+static int wifi_rxd_rate_to_rate(uint8_t val, bool is_cck)
+{
+	switch (val) {
+	case 8: return 10;
+	case 9: return 8;
+	case 10: return is_cck ? 0 : 6;
+	case 11: return 4;
+	case 12: return 11;
+	case 13: return 9;
+	case 14: return 7;
+	case 15: return 5;
+	case 20: return 1;
+	case 55: return 2;
+	case 110: return 3;
+	default: return 0;
+	}
+}
+
+/*
+ *
+ */
+static const char * const wifi_cmd_errors[] = {
+	[WIFI_RESULT_OK]		= "OK",
+	[WIFI_RESULT_INVAL]		= "INVAL",
+	[WIFI_RESULT_UNKNOWN_CMD]	= "UNKNOWN_CMD",
+	[WIFI_RESULT_IO_ERROR]		= "IO_ERROR",
+	[WIFI_RESULT_NOSPC]		= "NOSPC",
+	[WIFI_RESULT_NOENT]		= "NOENT",
+	[WIFI_RESULT_BUSY]		= "BUSY",
+	[WIFI_RESULT_EAGAIN]		= "EAGAIN",
+	[WIFI_RESULT_EXISTS]		= "EXISTS",
+};
+
+static const char *wifi_cmd_strerror(int ret)
+{
+	if (ret < 0 || ret >= ARRAY_SIZE(wifi_cmd_errors))
+		return "UNKNOWN";
+	return wifi_cmd_errors[ret];
+}
+
+/*
+ *
+ */
+static int __cmd_submit(struct wifi_priv *wp,
+			u32 chan_id,
+			u32 cmd_id,
+			const void *req_buf,
+			size_t req_buf_size,
+			u32 *presult,
+			void *resp_buf,
+			size_t *resp_buf_size,
+			bool strict_resp_size)
+{
+	struct wifi_cmd_chan *chan = &wp->cmd_chans[chan_id];
+	struct wifi_cmd_hdr __iomem *hdr_io;
+	struct wifi_cmd_resp __iomem *resp_io;
+	bool is_atomic = (chan_id == WIFI_CMD_CHAN_ATOMIC);
+	size_t len;
+	u32 fw_count, fw_resp_size, result;
+	int ret;
+
+	len = req_buf_size + WIFI_HDR_SIZE;
+	if (len > chan->buf_size) {
+		dev_err(wp->dev, "total cmd size too big for buf\n");
+		return -EINVAL;
+	}
+
+	if (!is_atomic)
+		mutex_lock(&chan->lock);
+
+	/* extra sanity check */
+	fw_count = le32_to_cpu(ioread32(chan->fw_count_ptr));
+	if (fw_count != chan->host_count) {
+		dev_err(wp->dev, "unexpected fw cmd ptr:%x host:%x\n",
+			fw_count, chan->host_count);
+		ret = -EIO;
+		goto fail;
+	}
+
+	/* write command header */
+	hdr_io = (struct wifi_cmd_hdr *)chan->buf_start;
+	iowrite32(cpu_to_le32(cmd_id), &hdr_io->id);
+	iowrite32(cpu_to_le32(req_buf_size), &hdr_io->size);
+
+	/* write request data */
+	memcpy_toio(hdr_io + 1, req_buf, req_buf_size);
+
+	/* increment queue pointer */
+	if (!is_atomic)
+		init_completion(&chan->completion);
+
+	spin_lock_bh(&chan->complete_lock);
+	chan->host_count++;
+	chan->pending = true;
+	iowrite32(cpu_to_le32(chan->host_count), chan->host_count_ptr);
+	spin_unlock_bh(&chan->complete_lock);
+
+	mwl8k_raise_fw_irq(wp->priv, chan->h2f_irq_mask);
+
+	ret = 0;
+	if (!is_atomic) {
+		/* wait for irq */
+		if (!wait_for_completion_timeout(&chan->completion, 10 * HZ))
+			ret = 1;
+	} else {
+		size_t i;
+
+		for (i = 0; i < 100000; i++) {
+			u32 fw_off = le32_to_cpu(ioread32(chan->fw_count_ptr));
+
+			if (fw_off == chan->host_count)
+				break;
+
+			udelay(5);
+		}
+
+		if (i > 10000) {
+			printk("long atomic command: %zu\n", i);
+		}
+
+		if (i == 100000)
+			ret = 1;
+	}
+
+	if (ret) {
+		dev_err(wp->dev, "%scommand %u timeout, host:%x fw:%x\n",
+			is_atomic ? "atomic " : "",
+			cmd_id,
+			ioread32(chan->fw_count_ptr),
+			ioread32(chan->host_count_ptr));
+		ret = -ETIMEDOUT;
+		goto fail;
+	}
+
+	/* extract result */
+	fw_resp_size = cpu_to_le32(ioread32(&hdr_io->size));
+	if (fw_resp_size < sizeof (resp_io->result)) {
+		dev_err(wp->dev, "command %u resp too small: %u\n",
+			cmd_id,
+			fw_resp_size);
+		ret = -EIO;
+		goto fail;
+	}
+
+	resp_io = (struct wifi_cmd_resp *)(hdr_io + 1);
+	result = le32_to_cpu(ioread32(&resp_io->result));
+	if (presult)
+		*presult = result;
+	fw_resp_size -= sizeof (resp_io->result);
+
+	if (resp_buf && fw_resp_size > *resp_buf_size) {
+		dev_err(wp->dev, "command %u resp too big: %u (buf %zu)\n",
+			cmd_id,
+			fw_resp_size, *resp_buf_size);
+		ret = -EIO;
+		goto fail;
+	}
+
+	if (result) {
+		dev_err(wp->dev, "command %u resp failed with "
+			"result %u (%s)\n",
+			cmd_id, result, wifi_cmd_strerror(result));
+		ret = -EIO;
+		goto fail;
+	}
+
+	if (resp_buf_size && strict_resp_size &&
+	    fw_resp_size != *resp_buf_size) {
+		dev_err(wp->dev, "command %u resp size invalid:%u exp:%zu\n",
+			cmd_id,
+			fw_resp_size,
+			*resp_buf_size);
+		ret = -EIO;
+		goto fail;
+	}
+
+	ret = 0;
+	if (resp_buf)
+		memcpy_fromio(resp_buf,
+			      (void *)&resp_io->result + 4,
+			      fw_resp_size);
+
+fail:
+	if (!is_atomic)
+		mutex_unlock(&chan->lock);
+	return ret;
+}
+
+/*
+ *
+ */
+static int cmd_submit_check(struct wifi_priv *wp,
+			    u32 chan_id,
+			    u32 cmd_id,
+			    const void *req_buf,
+			    size_t req_buf_size,
+			    void *resp_buf,
+			    size_t *resp_buf_size)
+{
+	return __cmd_submit(wp, chan_id, cmd_id, req_buf, req_buf_size,
+			    NULL, resp_buf, resp_buf_size, true);
+}
+
+/*
+ *
+ */
+static int cmd_submit_check_no_req(struct wifi_priv *wp,
+				   u32 chan_id,
+				   u32 cmd_id,
+				   void *resp_buf,
+				   size_t *resp_buf_size)
+{
+	return __cmd_submit(wp, chan_id, cmd_id, NULL, 0,
+			    NULL, resp_buf, resp_buf_size, true);
+}
+
+/*
+ *
+ */
+static int cmd_submit_check_no_resp(struct wifi_priv *wp,
+				    u32 chan_id,
+				    u32 cmd_id,
+				    const void *req_buf,
+				    size_t req_buf_size)
+{
+	return __cmd_submit(wp, chan_id, cmd_id, req_buf, req_buf_size,
+			    NULL, NULL, 0, false);
+}
+
+
+/*
+ *
+ */
+static int cmd_submit_check_no_req_no_resp(struct wifi_priv *wp,
+					   u32 chan_id,
+					   u32 cmd_id)
+{
+	return __cmd_submit(wp, chan_id, cmd_id, NULL, 0,
+			    NULL, NULL, 0, true);
+}
+
+/*
+ *
+ */
+static void cmd_chan_async_handle_irq(struct wifi_priv *wp)
+{
+	struct wifi_cmd_chan *chan = &wp->cmd_chans[WIFI_CMD_CHAN_ASYNC];
+
+	spin_lock(&chan->complete_lock);
+	if (chan->pending) {
+		__le32 fw_count = ioread32(chan->fw_count_ptr);
+		if (le32_to_cpu(fw_count) == chan->host_count)
+			complete(&chan->completion);
+	}
+	spin_unlock(&chan->complete_lock);
+}
+
+/*
+ *
+ */
+static int cmd_get_api_version(struct wifi_priv *wp,
+			       u32 *api_version)
+{
+	struct wifi_cmd_api_version_resp resp;
+	size_t resp_size = sizeof (resp);
+	int ret;
+
+	ret = cmd_submit_check_no_req(wp,
+				      WIFI_CMD_CHAN_ASYNC,
+				      WIFI_CMD_API_VERSION,
+				      &resp, &resp_size);
+	if (ret)
+		return ret;
+
+	*api_version = le32_to_cpu(resp.version);
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_get_fw_version(struct wifi_priv *wp,
+			      u16 *major,
+			      u16 *minor)
+{
+	struct wifi_cmd_fw_version_resp resp;
+	size_t resp_size = sizeof (resp);
+	int ret;
+
+	ret = cmd_submit_check_no_req(wp, WIFI_CMD_CHAN_ASYNC,
+				      WIFI_CMD_FW_VERSION,
+				      &resp, &resp_size);
+	if (ret)
+		return ret;
+
+	*major = le16_to_cpu(resp.major);
+	*minor = le16_to_cpu(resp.minor);
+	return 0;
+}
+
+/*
+ *
+ */
+static void inc_mac(u8 *base, unsigned int count)
+{
+        unsigned int i;
+
+        for (i = 0; i < count; i++) {
+                int j;
+
+                for (j = 5; j >= 0; j--) {
+                        if (++base[j] != 0)
+                                break;
+                }
+        }
+}
+
+/*
+ *
+ */
+static int cmd_get_mac_address(struct wifi_priv *wp,
+			       struct mac_address *addresses, size_t *count)
+{
+	struct wifi_cmd_get_mac_address_resp resp;
+	size_t resp_size = sizeof (resp);
+	size_t i, hw_count;
+	int ret;
+
+	if (!*count)
+		return -EINVAL;
+
+	ret = cmd_submit_check_no_req(wp, WIFI_CMD_CHAN_ASYNC,
+				      WIFI_CMD_GET_MAC_ADDRESS,
+				      &resp, &resp_size);
+	if (ret)
+		return ret;
+
+	hw_count = le16_to_cpu(resp.mac_addr_count);
+	for (i = 0; i < *count && i < hw_count; i++) {
+		memcpy(addresses[i].addr, resp.mac_addr, 6);
+		inc_mac(addresses[i].addr, i);
+	}
+
+	*count = i;
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_get_chan_survey(struct wifi_priv *wp,
+			       s8 *nf,
+			       u64 *chan_time,
+			       u64 *chan_busy,
+			       u64 *chan_rx,
+			       u64 *chan_tx)
+{
+	struct wifi_cmd_get_chan_survey_resp resp;
+	size_t resp_size = sizeof (resp);
+	int ret;
+
+	ret = cmd_submit_check_no_req(wp, WIFI_CMD_CHAN_ASYNC,
+				      WIFI_CMD_GET_CHAN_SURVEY,
+				      &resp, &resp_size);
+	if (ret)
+		return ret;
+
+	*nf = resp.avg_nf;
+	*chan_time = div_u64(le64_to_cpu(resp.chan_time), 1000);
+	*chan_busy = div_u64(le64_to_cpu(resp.chan_busy), 1000);
+	*chan_rx = div_u64(le64_to_cpu(resp.chan_rx), 1000);
+	*chan_tx = div_u64(le64_to_cpu(resp.chan_tx), 1000);
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_start(struct wifi_priv *wp)
+{
+	struct wifi_cmd_start_req req;
+	size_t i;
+	int ret;
+
+	memset(&req, 0, sizeof (req));
+	req.rx.dma_addr = cpu_to_le32(wp->rxq.descs_dma);
+	req.rx.len = cpu_to_le32(WIFI_RX_DESCS);
+
+	for (i = 0; i < wp->txq_count; i++) {
+		req.tx[i].dma_addr = cpu_to_le32(wp->txqs[i].descs_dma);
+		req.tx[i].len = cpu_to_le32(WIFI_TX_DESCS);
+	}
+
+	ret = cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+				       WIFI_CMD_START,
+				       &req, sizeof (req));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_stop(struct wifi_priv *wp)
+{
+	int ret;
+
+	ret = cmd_submit_check_no_req_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+					      WIFI_CMD_STOP);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_set_rx_filter(struct wifi_priv *wp, u32 filter)
+{
+	struct wifi_cmd_set_rx_filter_req req = {
+		.filter = le32_to_cpu(filter),
+	};
+	int ret;
+
+	ret = cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+				       WIFI_CMD_SET_RX_FILTER,
+				       &req, sizeof (req));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_add_vif(struct wifi_priv *wp,
+		       enum wifi_vif_type type,
+		       const u8 *mac_addr,
+		       __le16 *vif_hwid,
+		       unsigned int *tbtt_idx,
+		       unsigned int ac_mapping[IEEE80211_NUM_ACS],
+		       unsigned int *cab_qid)
+{
+	struct wifi_cmd_add_vif_req req;
+	struct wifi_cmd_add_vif_resp resp;
+	size_t resp_size = sizeof (resp);
+	int ret;
+
+	req.type = type;
+	memcpy(req.mac_addr, mac_addr, sizeof (req.mac_addr));
+
+	ret = cmd_submit_check(wp, WIFI_CMD_CHAN_ASYNC,
+			       WIFI_CMD_ADD_VIF,
+			       &req, sizeof (req),
+			       &resp, &resp_size);
+	if (ret)
+		return ret;
+
+	*vif_hwid = resp.vif_hwid;
+	*tbtt_idx = resp.tbtt_idx;
+	ac_mapping[IEEE80211_AC_BK] = resp.ac_to_qid[WIFI_AC_BK];
+	ac_mapping[IEEE80211_AC_BE] = resp.ac_to_qid[WIFI_AC_BE];
+	ac_mapping[IEEE80211_AC_VO] = resp.ac_to_qid[WIFI_AC_VO];
+	ac_mapping[IEEE80211_AC_VI] = resp.ac_to_qid[WIFI_AC_VI];
+	*cab_qid = resp.cab_qid;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_release_vif(struct wifi_priv *wp,
+			   __le16 vif_hwid)
+{
+	struct wifi_cmd_release_vif_req req = {
+		.vif_hwid = vif_hwid,
+	};
+	int ret;
+
+	ret = cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+				       WIFI_CMD_RELEASE_VIF,
+				       &req, sizeof (req));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_vif_start(struct wifi_priv *wp,
+			 __le16 vif_hwid)
+{
+	struct wifi_cmd_vif_start_req req = {
+		.vif_hwid = vif_hwid,
+	};
+	int ret;
+
+	ret = cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+				       WIFI_CMD_VIF_START,
+				       &req, sizeof (req));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_vif_stop(struct wifi_priv *wp,
+			__le16 vif_hwid)
+{
+	struct wifi_cmd_vif_stop_req req = {
+		.vif_hwid = vif_hwid,
+	};
+	int ret;
+
+	ret = cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+				       WIFI_CMD_VIF_STOP,
+				       &req, sizeof (req));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_vif_set_bss_params(struct wifi_priv *wp,
+				  __le16 vif_hwid,
+				  const uint8_t *bssid)
+{
+	struct wifi_cmd_vif_set_bss_params_req req;
+	int ret;
+
+	req.vif_hwid = vif_hwid;
+	memcpy(req.bssid, bssid, sizeof (req.bssid));
+
+	ret = cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+				       WIFI_CMD_VIF_SET_BSS_PARAMS,
+				       &req, sizeof (req));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_vif_set_short_slot(struct wifi_priv *wp,
+				  __le16 vif_hwid,
+				  bool is_short)
+{
+	struct wifi_cmd_vif_set_short_slot_req req;
+	int ret;
+
+	req.vif_hwid = vif_hwid;
+	req.is_short = is_short;
+
+	ret = cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+				       WIFI_CMD_VIF_SET_SHORT_SLOT,
+				       &req, sizeof (req));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_vif_set_edca_params(struct wifi_priv *wp,
+				   __le16 vif_hwid,
+				   unsigned int txq_idx,
+				   unsigned int cw_min,
+				   unsigned int cw_max,
+				   unsigned int aifsn,
+				   unsigned int txop)
+{
+	struct wifi_cmd_vif_set_edca_params_req req;
+	int ret;
+
+	req.vif_hwid = vif_hwid;
+	req.txq_idx = txq_idx;
+	req.cw_min = le16_to_cpu(cw_min);
+	req.cw_max = le16_to_cpu(cw_max);
+	req.aifsn = le16_to_cpu(aifsn);
+	req.txop = le16_to_cpu(txop);
+
+	ret = cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+				       WIFI_CMD_VIF_SET_EDCA_PARAMS,
+				       &req, sizeof (req));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_vif_set_beacon_params(struct wifi_priv *wp,
+				     __le16 vif_hwid,
+				     unsigned int rate_idx,
+				     unsigned int beacon_int,
+				     unsigned int dtim_period)
+{
+	struct wifi_cmd_vif_set_beacon_params_req req;
+	int ret;
+
+	req.vif_hwid = vif_hwid;
+	req.rate_idx = rate_idx;
+	req.beacon_interval = le16_to_cpu(beacon_int);
+	req.dtim_period = dtim_period;
+
+	ret = cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+				       WIFI_CMD_VIF_SET_BEACON_PARAMS,
+				       &req, sizeof (req));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_vif_enable_beacon(struct wifi_priv *wp,
+				 __le16 vif_hwid,
+				 bool enabled)
+{
+	struct wifi_cmd_vif_enable_beacon_req req;
+	int ret;
+
+	req.vif_hwid = vif_hwid;
+	req.enabled = enabled;
+
+	ret = cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+				       WIFI_CMD_VIF_ENABLE_BEACON,
+				       &req, sizeof (req));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_vif_add_sta(struct wifi_priv *wp,
+			   __le16 vif_hwid,
+			   const u8 *addr,
+			   __le16 *hw_id)
+{
+	struct wifi_cmd_vif_add_sta_req req;
+	struct wifi_cmd_vif_add_sta_resp resp;
+	size_t resp_size = sizeof (resp);
+	int ret;
+
+	req.vif_hwid = vif_hwid;
+	memcpy(req.mac, addr, ETH_ALEN);
+
+	ret = cmd_submit_check(wp, WIFI_CMD_CHAN_ASYNC,
+			       WIFI_CMD_VIF_ADD_STA,
+			       &req, sizeof (req),
+			       &resp, &resp_size);
+	if (ret)
+		return ret;
+
+	*hw_id = resp.sta_hwid;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_vif_del_sta(struct wifi_priv *wp,
+			   __le16 vif_hwid,
+			   unsigned int sta_idx)
+{
+	struct wifi_cmd_vif_del_sta_req req;
+	int ret;
+
+	req.vif_hwid = vif_hwid;
+	req.sta_hwid = cpu_to_le16(sta_idx);
+
+	ret = cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+				       WIFI_CMD_VIF_DEL_STA,
+				       &req, sizeof (req));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_vif_get_dtim_count_atomic(struct wifi_priv *wp,
+					 __le16 vif_hwid,
+					 unsigned int *dtim_count)
+{
+	struct wifi_cmd_vif_get_dtim_count_req req;
+	struct wifi_cmd_vif_get_dtim_count_resp resp;
+	size_t resp_size = sizeof (resp);
+	int ret;
+
+	req.vif_hwid = vif_hwid;
+
+	ret = cmd_submit_check(wp, WIFI_CMD_CHAN_ATOMIC,
+			       WIFI_CMD_VIF_GET_DTIM_COUNT,
+			       &req, sizeof (req),
+			       &resp, &resp_size);
+	if (ret)
+		return ret;
+
+	*dtim_count = resp.dtim_count;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_vif_update_beacon_atomic(struct wifi_priv *wp,
+					__le16 vif_hwid,
+					unsigned int bcn_dma_addr,
+					unsigned int bcn_size)
+{
+	struct wifi_cmd_vif_update_beacon_req req;
+
+	req.vif_hwid = vif_hwid;
+	req.bcn_host_addr = cpu_to_le32(bcn_dma_addr);
+	req.bcn_size = cpu_to_le16(bcn_size);
+
+	return cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ATOMIC,
+					WIFI_CMD_VIF_UPDATE_BEACON,
+					&req, sizeof (req));
+}
+
+/*
+ *
+ */
+static int cmd_vif_add_key(struct wifi_priv *wp,
+			   __le16 vif_hwid,
+			   __le16 sta_hwid,
+			   unsigned int key_idx,
+			   const u8 *key,
+			   u8 *hw_id)
+{
+	struct wifi_cmd_vif_add_key_req req;
+	struct wifi_cmd_vif_add_key_resp resp;
+	size_t resp_size = sizeof (resp);
+	int ret;
+
+	req.vif_hwid = vif_hwid;
+	req.sta_hwid = sta_hwid;
+	req.key_idx = key_idx;
+	memcpy(req.key, key, sizeof (req.key));
+
+	ret = cmd_submit_check(wp, WIFI_CMD_CHAN_ASYNC,
+			       WIFI_CMD_VIF_ADD_KEY,
+			       &req, sizeof (req),
+			       &resp, &resp_size);
+	if (ret)
+		return ret;
+
+	*hw_id = resp.key_hwid;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int cmd_vif_del_key(struct wifi_priv *wp,
+			   __le16 vif_hwid,
+			   __le16 sta_hwid,
+			   u8 hw_id)
+{
+	struct wifi_cmd_vif_del_key_req req;
+	int ret;
+
+	req.vif_hwid = vif_hwid;
+	req.sta_hwid = sta_hwid;
+	req.key_hwid = hw_id;
+
+	ret = cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+				       WIFI_CMD_VIF_DEL_KEY,
+				       &req, sizeof (req));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ *
+ */
+static int freq_to_idx(struct ieee80211_hw *hw, int freq)
+{
+	struct ieee80211_supported_band *sband;
+	int band, ch, idx = 0;
+
+	for (band = NL80211_BAND_2GHZ; band < NUM_NL80211_BANDS; band++) {
+		sband = hw->wiphy->bands[band];
+		if (!sband)
+			continue;
+
+		for (ch = 0; ch < sband->n_channels; ch++, idx++)
+			if (sband->channels[ch].center_freq == freq)
+				goto exit;
+	}
+
+exit:
+	return idx;
+}
+
+/*
+ *
+ */
+static int wifi_set_channel(struct wifi_priv *wp)
+{
+	struct ieee80211_hw *hw = wp->hw;
+	const struct cfg80211_chan_def *chandef = &hw->conf.chandef;
+	const struct ieee80211_channel *channel = chandef->chan;
+        enum nl80211_chan_width width = chandef->width;
+	struct wifi_cmd_radio_control_req req;
+	int ret;
+
+	req.channel = channel->hw_value;
+
+	switch (width) {
+	case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+		req.bw = WIFI_CHAN_BW_20MHZ;
+		break;
+        case NL80211_CHAN_WIDTH_40:
+		req.bw = 40;
+		if (channel->center_freq > chandef->center_freq1)
+			req.bw = WIFI_CHAN_BW_40MHZ_BELOW;
+		else
+			req.bw = WIFI_CHAN_BW_40MHZ_ABOVE;
+		break;
+	default:
+		return -ENOTSUPP;
+	}
+
+	ret = cmd_submit_check_no_resp(wp, WIFI_CMD_CHAN_ASYNC,
+				       WIFI_CMD_RADIO_CONTROL,
+				       &req, sizeof (req));
+	if (ret)
+		return ret;
+
+	wp->cur_chan_idx = freq_to_idx(hw, channel->center_freq);
+	return 0;
+}
+
+/*
+ *
+ */
+static int wifi_rxq_refill(struct wifi_priv *wp, int limit)
+{
+	struct wifi_rxq *rxq = &wp->rxq;
+	int refilled;
+
+	refilled = 0;
+	while (rxq->count < WIFI_RX_DESCS && limit--) {
+		struct sk_buff *skb;
+		struct wifi_rxd *rxd;
+		dma_addr_t addr;
+		u32 cur;
+
+		skb = dev_alloc_skb(WIFI_RX_BUF_SIZE);
+		if (skb == NULL)
+			break;
+
+		addr = pci_map_single(wp->pdev, skb->data,
+				      WIFI_RX_BUF_SIZE, DMA_FROM_DEVICE);
+
+		if (pci_dma_mapping_error(wp->pdev, addr)) {
+			dev_kfree_skb(skb);
+			break;
+		}
+
+		cur = rxq->refill_off;
+
+		rxq->bufs[cur].skb = skb;
+		dma_unmap_addr_set(&rxq->bufs[cur], dma, addr);
+
+		rxd = &rxq->descs[cur];
+		rxd->buf_addr = cpu_to_le32(addr);
+		rxd->buf_size = cpu_to_le16(WIFI_RX_BUF_SIZE);
+		wmb();
+		rxd->status = cpu_to_le16(RXD_F_FW_OWNED);
+
+		rxq->refill_off++;
+		if (rxq->refill_off == WIFI_RX_DESCS)
+			rxq->refill_off = 0;
+
+		rxq->count++;
+		refilled++;
+	}
+
+	return refilled;
+}
+
+/*
+ *
+ */
+static int wifi_process_rx(struct wifi_priv *wp, int limit)
+{
+	struct wifi_rxq *rxq = &wp->rxq;
+	int processed;
+
+	processed = 0;
+	while (rxq->count && limit--) {
+		struct sk_buff *skb;
+		struct wifi_rxd *rxd;
+		struct ieee80211_rx_status *rx_stat;
+		unsigned int len;
+		u16 rxd_status;
+		u32 cur;
+
+		cur = rxq->fw_off;
+		rxd = &rxq->descs[cur];
+		rmb();
+
+		rxd_status = le16_to_cpu(rxd->status);
+		if (rxd_status & RXD_F_FW_OWNED)
+			break;
+
+		pci_unmap_single(wp->pdev,
+				 dma_unmap_addr(&rxq->bufs[cur], dma),
+				 WIFI_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
+		dma_unmap_addr_set(&rxq->bufs[cur], dma, 0);
+
+		skb = rxq->bufs[cur].skb;
+		BUG_ON(!skb);
+		rxq->bufs[cur].skb = NULL;
+
+		len = le16_to_cpu(rxd->buf_size);
+		if (!len || len > WIFI_RX_BUF_SIZE) {
+			dev_err(wp->dev, "bad desc RX len: %u\n", len);
+			dev_kfree_skb(skb);
+			goto skip;
+		}
+
+		skb_put(skb, len);
+
+		/* fill rx status */
+		rx_stat = IEEE80211_SKB_RXCB(skb);
+		if (rxd_status & RXD_F_HT) {
+			rx_stat->rate_idx = rxd->rate;
+			rx_stat->encoding = RX_ENC_HT;
+		} else {
+			bool is_cck = rxd_status & RXD_F_CCK;
+			rx_stat->rate_idx = wifi_rxd_rate_to_rate(rxd->rate,
+								  is_cck);
+			rx_stat->encoding = RX_ENC_LEGACY;
+		}
+
+		if (!(rxd_status & RXD_F_FCS_VALID))
+			rx_stat->flag |= RX_FLAG_FAILED_FCS_CRC;
+
+		if (rxd_status & RXD_F_SHORT_PREAMBLE)
+			rx_stat->enc_flags |= RX_ENC_FLAG_SHORTPRE;
+
+		if (rxd_status & RXD_F_SHORT_GI)
+			rx_stat->enc_flags |= RX_ENC_FLAG_SHORT_GI;
+
+		if (rxd_status & RXD_F_DECRYPTED)
+			rx_stat->flag |= RX_FLAG_DECRYPTED;
+
+		rx_stat->band = 0;
+		rx_stat->freq =
+			ieee80211_channel_to_frequency(rxd->channel,
+						       NL80211_BAND_2GHZ);
+		rx_stat->signal = rxd->rssi;
+		rx_stat->chains = (1 << wp->hw_radio_chains) - 1;
+		BUILD_BUG_ON(sizeof (rx_stat->chain_signal) !=
+			     sizeof (rxd->rssi_per_chain));
+		memcpy(rx_stat->chain_signal, rxd->rssi_per_chain,
+		       sizeof (rx_stat->chain_signal));
+
+		ieee80211_rx(wp->hw, skb);
+
+	skip:
+		processed++;
+		rxq->count--;
+		rxq->fw_off++;
+		if (rxq->fw_off == WIFI_RX_DESCS)
+			rxq->fw_off = 0;
+	}
+
+	return processed;
+}
+
+/*
+ * release wifi_skb wrapper fields (not the wrapper itself) and return
+ * it to the pool
+ */
+static void __wifi_tx_skb_release(struct wifi_priv *wp,
+				  struct wifi_tx_skb *wskb,
+				  bool tx_failed,
+				  bool skip_skb_free)
+{
+	txdbg("wifi_tx_skb_release wskb:%ps seq:%u failed:%d skip_free:%d\n",
+	      wskb, wskb->seq_no, tx_failed, skip_skb_free);
+
+	pci_unmap_single(wp->pdev,
+			 dma_unmap_addr(wskb, skb_dma),
+			 dma_unmap_len(wskb, skb_len),
+			 PCI_DMA_TODEVICE);
+	dma_unmap_addr_set(wskb, skb_dma, 0);
+	list_add(&wskb->next, &wskb->txq->wifi_tx_skbs_pool);
+	if (!skip_skb_free) {
+		if (tx_failed)
+			ieee80211_free_txskb(wp->hw, wskb->skb);
+		else
+			dev_kfree_skb(wskb->skb);
+	}
+}
+
+static void wifi_tx_skb_release_txfail(struct wifi_priv *wp,
+				       struct wifi_tx_skb *wskb)
+{
+	__wifi_tx_skb_release(wp, wskb, true, false);
+}
+
+static void wifi_tx_skb_release_keep_skb(struct wifi_priv *wp,
+					 struct wifi_tx_skb *wskb)
+{
+	__wifi_tx_skb_release(wp, wskb, true, true);
+}
+
+/*
+ *
+ */
+static int fill_hw_offsets(const struct ieee80211_hdr *d11, struct wifi_txd *txd)
+{
+	__le16 fc = d11->frame_control;
+
+	if (ieee80211_is_data(fc)) {
+		unsigned int hdr_size;
+
+		bool has_qos = ieee80211_is_data_qos(fc);
+
+		if (ieee80211_has_a4(fc)) {
+			hdr_size = 30;
+			txd->addr_count = 4;
+		} else {
+			hdr_size = 24;
+			txd->addr_count = 3;
+		}
+
+		txd->has_qos_control = has_qos;
+		if (has_qos)
+			memcpy(&txd->qos_control, (u8 *)d11 + hdr_size,
+			       IEEE80211_QOS_CTL_LEN);
+
+		txd->data_offset = !has_qos ? hdr_size : hdr_size +
+			IEEE80211_QOS_CTL_LEN;
+		return 0;
+	}
+
+	if (ieee80211_is_mgmt(fc)) {
+		txd->addr_count = 3;
+		txd->data_offset = 24;
+		txd->has_qos_control = 0;
+		return 0;
+	}
+
+	if (ieee80211_is_ctl(fc)) {
+		if ((fc & cpu_to_le16(0x00E0)) == cpu_to_le16(0x00C0)) {
+			/* cannot send one address type */
+			return 1;
+		}
+
+		txd->addr_count = 2;
+		txd->data_offset = 16;
+		txd->has_qos_control = 0;
+		return 0;
+	}
+
+	return 1;
+}
+
+/*
+ * allocate (from fixed pool) and fill skb wrapper we use inside tx
+ * path
+ */
+static struct wifi_tx_skb *wifi_tx_skb_wrap(struct wifi_priv *wp,
+					    struct wifi_txq *txq,
+					    struct sk_buff *skb,
+					    struct ieee80211_sta *sta,
+					    int tid)
+{
+	const struct ieee80211_hdr *d11;
+	struct wifi_tx_skb *wskb;
+	struct ieee80211_tx_info *info;
+	struct ieee80211_key_conf *hw_key;
+	struct wifi_vif *wifi_vif;
+	struct wifi_sta *wifi_sta;
+	struct wifi_txd *txdesc;
+	dma_addr_t dma;
+	u16 frame_len;
+
+	txdbg("wifi_tx_skb_wrap: skb:%pS len:%u sta:%pM\n",
+	      skb, skb->len, sta ? sta->addr : NULL);
+
+	/* we should always have something in the pool, it is pre
+	 * allocated with the same size as txq, and we make sure to
+	 * stop sending before queue becomes full */
+	if (WARN_ON(list_empty(&txq->wifi_tx_skbs_pool)))
+		return NULL;
+
+	info = IEEE80211_SKB_CB(skb);
+	hw_key = info->control.hw_key;
+
+	wskb = list_first_entry(&txq->wifi_tx_skbs_pool,
+				struct wifi_tx_skb,
+				next);
+	wskb->sw_tries_done = 0;
+	wskb->txq = txq;
+
+	frame_len = skb->len + FCS_LEN;
+	if (hw_key)
+		frame_len += hw_key->icv_len;
+	wskb->frame_len = frame_len;
+
+	/* lookup sta & vif, we need to write their hw id inside descriptor */
+	wifi_sta = NULL;
+	if (sta) {
+		wifi_sta = WIFI_STA(sta);
+		wskb->sta_version = wifi_sta->version;
+	}
+
+	wifi_vif = NULL;
+	if (info->control.vif)
+		wifi_vif = WIFI_VIF(info->control.vif);
+
+	/*
+	 * precompute invariant tx descriptor fields
+	 */
+	d11 = (const struct ieee80211_hdr *)skb->data;
+	txdesc = &wskb->txdesc;
+
+	if (fill_hw_offsets(d11, txdesc)) {
+		/* should not happen unless raw frame injection */
+		wiphy_err(wp->hw->wiphy, "hardware cannot send such frame\n");
+		return NULL;
+	}
+
+	if (WARN_ON(skb->len < txdesc->data_offset)) {
+		/* catch strange packets */
+		return NULL;
+	}
+
+	txdesc->data_size = cpu_to_le16(skb->len - txdesc->data_offset);
+	txdesc->sta_hwid = wifi_sta ? wifi_sta->hw_id : WIFI_INVALID_STA_HWID;
+	txdesc->vif_hwid = wifi_vif ? wifi_vif->hw_id : WIFI_INVALID_VIF_HWID;
+	txdesc->key_hwid = hw_key ? hw_key->hw_key_idx : WIFI_INVALID_KEY_HWID;
+
+	if (hw_key) {
+		u64 pn64 = atomic64_inc_return(&hw_key->tx_pn);
+		memcpy(&txdesc->ccmp_pn, &pn64, 8);
+	}
+
+	txdesc->status = TXD_F_FW_OWNED;
+
+	if (is_multicast_ether_addr(d11->addr1) ||
+	    (info->flags & IEEE80211_TX_CTL_NO_ACK))
+		txdesc->status |= TXD_F_TX_NO_ACK;
+
+	if (info->flags & IEEE80211_TX_CTL_STBC)
+		txdesc->status |= TXD_F_TX_STBC;
+
+	/* tid is used to find back wifi_tid at tx completion and do
+	 * proper STA tx accounting */
+	if (tid == -1) {
+		wskb->has_tid = false;
+		wskb->tid = 0;
+	} else {
+		if (WARN_ON(!sta))
+			return NULL;
+
+		wskb->has_tid = true;
+		wskb->tid = tid;
+
+		/* is_data_present is needed to exclude null func
+		 * frames, which have no valid sequence number and are
+		 * sent on another TID */
+		if (ieee80211_is_data_present(d11->frame_control) &&
+		    ieee80211_is_data_qos(d11->frame_control)) {
+
+			if (info->flags & IEEE80211_TX_INTFL_RETRANSMISSION) {
+				WARN(1, "QOS data frame restranmisted by stack\n");
+				return NULL;
+			}
+
+
+			wskb->type = WIFI_TXSKB_QOS_DATA;
+			wskb->seq_no =
+				(le16_to_cpu(d11->seq_ctrl) &
+				 IEEE80211_SCTL_SEQ) >>
+				IEEE80211_SEQ_SEQ_SHIFT;
+			txdesc->tid = wskb->tid;
+			WARN_ON(tid == IEEE80211_NUM_TIDS);
+
+		} else if (ieee80211_is_back_req(d11->frame_control)) {
+			const struct ieee80211_bar *bar;
+			u16 bar_tid;
+
+			/* BAR frames must be tagged */
+			bar = (const struct ieee80211_bar *)skb->data;
+			bar_tid = le16_to_cpu(bar->control) >>
+				IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
+			wskb->type = WIFI_TXSKB_BAR;
+			wskb->bar_tid = bar_tid;
+
+			txdesc->status |= TXD_F_TX_BAR;
+			txdesc->tid = wskb->bar_tid;
+		} else
+			wskb->type = WIFI_TXSKB_OTHER;
+	}
+
+	/* map skb */
+	dma = pci_map_single(wp->pdev, skb->data, skb->len, PCI_DMA_TODEVICE);
+	if (pci_dma_mapping_error(wp->pdev, dma)) {
+		wiphy_err(wp->hw->wiphy, "failed to dma map skb\n");
+		return NULL;
+	}
+
+	wskb->skb = skb;
+	dma_unmap_addr_set(wskb, skb_dma, dma);
+	dma_unmap_len_set(wskb, skb_len, skb->len);
+	txdesc->buf_addr = cpu_to_le32(dma);
+
+	/* remove from pool list */
+	list_del(&wskb->next);
+	txdbg("wifi_tx_skb_wrap: returned %ps, has_tid:%d tid:%d type:%u seq:%u\n",
+	      wskb, wskb->has_tid, wskb->tid, wskb->type, wskb->seq_no);
+	return wskb;
+}
+
+/*
+ *
+ */
+static void wifi_tx_skb_inc_sw_tries(struct wifi_priv *wp,
+				     struct wifi_tx_skb *wskb)
+{
+	struct ieee80211_hdr *hdr;
+
+	++wskb->sw_tries_done;
+	if (wskb->sw_tries_done == 1 || wskb->sw_tries_done > 2)
+		return;
+
+	/* set the retry bit and header, update cache */
+	hdr = (struct ieee80211_hdr *)wskb->skb->data;
+	hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_RETRY);
+	pci_dma_sync_single_for_device(wp->pdev,
+				       dma_unmap_addr(wskb, skb_dma),
+				       sizeof (*hdr), DMA_TO_DEVICE);
+}
+
+/*
+ *
+ */
+static void wifi_tx_skb_set_more_data(struct wifi_priv *wp,
+				      struct wifi_tx_skb *wskb,
+				      bool more_data)
+{
+	struct ieee80211_hdr *hdr;
+
+	hdr = (struct ieee80211_hdr *)wskb->skb->data;
+	hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+	pci_dma_sync_single_for_device(wp->pdev,
+				       dma_unmap_addr(wskb, skb_dma),
+				       sizeof (*hdr), DMA_TO_DEVICE);
+}
+
+/*
+ *
+ */
+static void wifi_tx_skb_fill_rates(struct wifi_tx_skb *wskb,
+				   struct ieee80211_vif *vif,
+				   struct ieee80211_sta *sta)
+{
+	struct ieee80211_tx_info *info;
+	struct wifi_txd *txdesc;
+	size_t i;
+
+	txdbg("wifi_tx_skb_fill_rates: wskp:%ps sta:%ps\n", wskb, sta);
+	/* we use tx_info to store rates */
+	info = IEEE80211_SKB_CB(wskb->skb);
+	ieee80211_get_tx_rates(vif,
+			       sta,
+			       wskb->skb,
+			       info->control.rates,
+			       ARRAY_SIZE(info->control.rates));
+
+	WARN_ON_ONCE(info->control.rates[0].idx < 0);
+
+	txdesc = &wskb->txdesc;
+	for (i = 0; i < WIFI_TXD_MAX_RATES; i++) {
+		const struct ieee80211_tx_rate *r = &info->control.rates[i];
+		struct wifi_txd_rinfo *txr = &txdesc->rinfo[i];
+
+		if (r->idx == -1) {
+			/* make sure to clear to mark end of list,
+			 * since this can be called multiple times on
+			 * same wskb */
+			txr->flags = 0;
+			break;
+		}
+
+		txdbg("fill rate[%zu]: idx:%u ht:%d count:%d\n",
+		       i,
+		       r->idx, !!(r->flags & IEEE80211_TX_RC_MCS), r->count);
+
+		txr->flags = TXD_RF_VALID;
+
+		if (r->flags & IEEE80211_TX_RC_USE_RTS_CTS)
+			txr->flags |= TXD_RF_RTS_CTS;
+		else if (r->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
+			txr->flags |= TXD_RF_CTS_PROTECT;
+
+		if ((r->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
+			txr->flags |= TXD_RF_SHORT_PRE;
+
+		if (!(r->flags & IEEE80211_TX_RC_MCS))
+			txr->rate = mwl8k_rates[r->idx].hw_value;
+		else {
+			txr->rate = r->idx;
+			txr->flags |= TXD_RF_HT;
+			if ((r->flags & IEEE80211_TX_RC_SHORT_GI))
+				txr->flags |= TXD_RF_SHORT_GI;
+			if ((r->flags & IEEE80211_TX_RC_40_MHZ_WIDTH))
+				txr->flags |= TXD_RF_40MHZ;
+		}
+
+		txr->count = r->count;
+		txr->antenna_mask = 0;
+	}
+}
+
+/*
+ * queue a chain of packets into the hardware tx queue, chain is not
+ * valid after call if packets have been successfully queued
+ *
+ * for A-MPDU, first tx desc must have the following fields:
+ *   - ampdu_density
+ *   - ampdu_baw_ssn
+ *
+ * caller must hold the txq lock and sta lock
+ */
+static int wifi_tx_send_chain(struct wifi_priv *wp,
+			      struct list_head *chain,
+			      size_t chain_count,
+			      bool form_aggr,
+			      struct ieee80211_sta *sta,
+			      bool bypass_ps)
+{
+	struct wifi_tx_skb *wskb;
+	struct wifi_txq *wifi_txq;
+	struct wifi_txd *first_txdesc;
+	__le32 first_desc_status;
+	bool clear_ps;
+	/* int tid = -1; */
+
+	/* if (chain_count > 1) { */
+	/* 	printk("SEND CHAIN count:%d\n", chain_count); */
+
+	/* 	list_for_each_entry(wskb, chain, next) { */
+	/* 		printk(" - member: frame_len:%u " */
+	/* 		       "addr_count:%u data_size:%u data_offset:%u has_qos:%d\n", */
+	/* 		       wskb->skb->len, */
+	/* 		       wskb->txdesc.addr_count, */
+	/* 		       wskb->txdesc.data_size, */
+	/* 		       wskb->txdesc.data_offset, */
+	/* 		       wskb->txdesc.has_qos_control); */
+	/* 	} */
+	/* } */
+
+	if (WARN_ON(!chain_count))
+		return 1;
+
+	wskb = list_first_entry(chain, struct wifi_tx_skb, next);
+
+	wifi_txq = wskb->txq;
+	WARN_ON(wifi_txq->idx == 6);
+	lockdep_assert_held(&wifi_txq->lock);
+
+	txdbg("wifi_tx_send_chain: chain_count:%zu aggr:%d sta:%pM "
+	      "bypass_ps:%d txq_count:%d\n",
+	      chain_count, form_aggr, sta ? sta->addr : NULL, bypass_ps,
+	      wifi_txq->count);
+
+	if (WARN_ON(wifi_txq->count + chain_count > WIFI_TX_DESCS))
+		return 1;
+
+	/*
+	 * if traffic if for a STA, and is not sent during the service
+	 * period, we will clear the hardware PS filter if needed
+	 */
+	clear_ps = false;
+	if (sta && !bypass_ps)
+		clear_ps = atomic_dec_and_test(&WIFI_STA(sta)->clear_ps_filter);
+
+	if (clear_ps) {
+		/* printk("wifi_tx_send_chain: sta %pM will clear ps\n", */
+		/*       sta->addr); */
+	}
+
+	/*
+	 * tx pending accounting for this tid
+	 */
+	if (sta && wskb->has_tid) {
+		struct wifi_sta *wifi_sta = WIFI_STA(sta);
+
+		lockdep_assert_held(&wifi_sta->lock);
+
+		wifi_sta->tx_pending += chain_count;
+		txdbg("wifi_tx_send_chain: sta %pM tx pending now %d\n",
+		      sta->addr, wifi_sta->tx_pending);
+		/* tid = wskb->tid; */
+	}
+
+	first_txdesc = NULL;
+	list_for_each_entry(wskb, chain, next) {
+		struct wifi_txd *txdesc;
+		u32 cur_off;
+
+		txdbg("wifi_tx_send_chain: wskb:%ps has_tid:%d tid:%d type:%d seq:%u\n",
+		      wskb, wskb->has_tid, wskb->tid, wskb->type, wskb->seq_no);
+
+		/* raise number of total tries for this skb, it will
+		 * update the retry bit in 802.11 header if needed */
+		wifi_tx_skb_inc_sw_tries(wp, wskb);
+
+		/*
+		 * most tx desc fields have been pre-computed, clear
+		 * any previous transient flags in case we resend that
+		 * frame
+		*/
+		wskb->txdesc.status &= ~(TXD_F_TX_AMPDU_START |
+					 TXD_F_TX_AMPDU_MORE |
+					 TXD_F_TX_AMPDU_LAST |
+					 TXD_F_TX_CLEAR_PS |
+					 TXD_F_TX_BYPASS_PS);
+
+		/*
+		 * setup powersave & AMPDU flags in tx desc
+		 */
+		if (clear_ps) {
+			wskb->txdesc.status |= TXD_F_TX_CLEAR_PS;
+			clear_ps = false;
+		}
+
+		if (bypass_ps)
+			wskb->txdesc.status |= TXD_F_TX_BYPASS_PS;
+
+		if (form_aggr) {
+			u32 ampdu_flags = 0;
+
+			if (list_is_first(&wskb->next, chain)) {
+				ampdu_flags |= TXD_F_TX_AMPDU_START;
+				wifi_txq->aggr_count++;
+			}
+			if (list_is_last(&wskb->next, chain)) {
+				ampdu_flags |= TXD_F_TX_AMPDU_LAST;
+			}
+			if (!ampdu_flags)
+				ampdu_flags |= TXD_F_TX_AMPDU_MORE;
+
+			wskb->txdesc.status |= ampdu_flags;
+			wskb->aggr_member = true;
+			INIT_LIST_HEAD(&wskb->aggr_list);
+		} else {
+			wskb->aggr_member = false;
+			wifi_txq->non_aggr_count++;
+		}
+
+		/* update memory-mapped descriptor */
+		cur_off = wifi_txq->head_off;
+		txdesc = &wifi_txq->descs[cur_off];
+
+		if (!first_txdesc) {
+			/* first descriptor of list, memcpy all but
+			 * status field status field so transmission
+			 * does not start now */
+			BUILD_BUG_ON(offsetof(struct wifi_txd, status));
+			memcpy((void *)txdesc + sizeof (txdesc->status),
+			       (void *)&wskb->txdesc + sizeof (txdesc->status),
+			       sizeof (*txdesc) - sizeof (txdesc->status));
+
+			/* remember status */
+			first_txdesc = txdesc;
+			first_desc_status = wskb->txdesc.status;
+			BUG_ON(first_txdesc->status & TXD_F_FW_OWNED);
+		} else
+			memcpy(txdesc, &wskb->txdesc, sizeof (*txdesc));
+
+		wifi_txq->pending_wskb[cur_off] = wskb;
+		cur_off++;
+		if (cur_off >= WIFI_TX_DESCS)
+			cur_off = 0;
+
+		wifi_txq->head_off = cur_off;
+		wifi_txq->count++;
+	}
+
+	if (form_aggr) {
+		struct wifi_tx_skb *last_wskb;
+
+		/* transfer whole chain in last entry */
+		last_wskb = list_last_entry(chain, struct wifi_tx_skb, next);
+		list_splice(chain, &last_wskb->aggr_list);
+	}
+
+	/* if (sta && tid != -1) { */
+	/* 	struct wifi_tid *wifi_tid = WIFI_TID(sta->txq[tid]); */
+
+	/* 	printk("tx: agg:%u cnt:%d (pnd now aggr:%d nagg:%d) seq:%d\n", */
+	/* 	       form_aggr, chain_count, */
+	/* 	       wifi_txq->aggr_count, */
+	/* 	       wifi_txq->non_aggr_count, */
+	/* 	       wifi_tid->seq_start); */
+	/* } */
+
+	/* all set, start tx */
+	wmb();
+	first_txdesc->status = first_desc_status;
+	mwl8k_raise_fw_irq(wp->priv, 1 << (wifi_txq->idx + wp->tx_h2f_irq_shift));
+
+	return 0;
+}
+
+/*
+ * return actually used size in BAW, ie number of in-flight packets
+ * seen from the receiver
+ */
+static inline size_t
+wifi_tid_baw_tracked_size(const struct wifi_tid *wifi_tid)
+{
+	if (wifi_tid->scb_tail >= wifi_tid->scb_head)
+		return wifi_tid->scb_tail - wifi_tid->scb_head;
+
+	return WIFI_SCB_MAX - wifi_tid->scb_head + wifi_tid->scb_tail;
+}
+
+/*
+ * return available space BAW
+ */
+static inline size_t
+wifi_tid_baw_space(const struct wifi_tid *wifi_tid)
+{
+	size_t tracked;
+
+	tracked = wifi_tid_baw_tracked_size(wifi_tid);
+	if (tracked > wifi_tid->baw_max_size) {
+		/* this is allowed if the BAW max size is shrinked,
+		 * can happen when enabling aggregation */
+		return 0;
+	}
+
+	return wifi_tid->baw_max_size - tracked;
+}
+
+/*
+ * check if sequence is being tracked by block ack window
+ */
+static inline bool
+wifi_tid_baw_tracks_seqno(const struct wifi_tid *wifi_tid,
+			  unsigned int seq_no)
+{
+	unsigned int delta;
+
+	delta = (seq_no - wifi_tid->seq_start) & 0xfff;
+	return delta < wifi_tid_baw_tracked_size(wifi_tid);
+}
+
+/*
+ * return next sequence number just after last one being tracked by
+ * block ack window
+ */
+static inline u16
+wifi_tid_baw_next_seqno(const struct wifi_tid *wifi_tid)
+{
+	size_t count = wifi_tid_baw_tracked_size(wifi_tid);
+	u16 last;
+
+	last = wifi_tid->seq_start + count;
+	last &= 0xfff;
+	return last;
+}
+
+/*
+ * return true if there are packet being tracked by BAW currently
+ * being transmitted
+ */
+static inline bool
+wifi_tid_baw_has_inflight_packets(const struct wifi_tid *wifi_tid)
+{
+	return (wifi_tid->scb_inflight_count > 0);
+}
+
+/*
+ * called after any change that could affect "global" ps state
+ *
+ * must be called holding STA lock
+ */
+static void wifi_sta_ps_transition(struct ieee80211_hw *hw,
+				   struct ieee80211_sta *sta,
+				   enum wifi_ps_action action)
+{
+	struct wifi_sta *wifi_sta;
+	struct wifi_tid *wifi_tid;
+	size_t tidno;
+
+	wifi_sta = WIFI_STA(sta);
+	lockdep_assert_held(&wifi_sta->lock);
+
+	psdbg("wifi_sta_ps_transition: %pM cur_state:%d action:%d\n",
+	      sta->addr, wifi_sta->ps_state, action);
+
+again:
+	switch (wifi_sta->ps_state) {
+	case WIFI_PS_AWAKE:
+		if (WARN_ON(action && action != WIFI_PS_ACTION_SLEEP))
+			break;
+
+		wifi_sta->ps_state = WIFI_PS_ENTER_SLEEP;
+		action = WIFI_PS_ACTION_NONE;
+		ieee80211_sta_block_awake(hw, sta, true);
+		goto again;
+
+	case WIFI_PS_ENTER_SLEEP:
+		if (WARN_ON(action &&
+			    (action != WIFI_PS_ACTION_TXDONE &&
+			     action != WIFI_PS_ACTION_SLEEP))) {
+			psdbg("wifi_sta_ps_transition: wtf, "
+			      "state is enter sleep, action is :%d\n",
+			      action);
+			break;
+		}
+
+		/* wait until all TID has no more data packets in
+		 * flight */
+		if (wifi_sta->tx_pending) {
+			psdbg("wifi_sta_ps_transition: tx "
+			      "still pending (%u packets)\n",
+			      wifi_sta->tx_pending);
+			break;
+		}
+
+		if (action == WIFI_PS_ACTION_SLEEP)
+			break;
+
+		for (tidno = 0; tidno < IEEE80211_NUM_TIDS + 1; tidno++) {
+			wifi_tid = WIFI_TID(sta->txq[tidno]);
+			if (wifi_tid_baw_has_inflight_packets(wifi_tid)) {
+				ieee80211_sta_set_buffered(sta, tidno, true);
+				psdbg("entering ps with has_buf (%d)\n",
+				      wifi_tid->scb_inflight_count);
+				wifi_tid->ps_sleep_has_buf = true;
+			} else
+				wifi_tid->ps_sleep_has_buf = false;
+		}
+
+		/* done */
+		wifi_sta->ps_state = WIFI_PS_SLEEP;
+		psdbg("=> now asleep\n");
+		ieee80211_sta_block_awake(hw, sta, false);
+		break;
+
+	case WIFI_PS_SLEEP:
+		if (action == WIFI_PS_ACTION_SLEEP) {
+			/*
+			 * this can happen:
+			 *
+			 * sta_ps_start()
+			 * sta_notify(SLEEP)
+			 * driver calls ieee80211_sta_block_awake(true)
+			 * sta_ps_end()
+			 * WLAN_STA_PS_DRIVER is set, just clear PS_STA
+			 * driver calls ieee80211_sta_block_awake(false)
+			 * schedule deliver work queue
+			 * sta_ps_start()
+			 * sta_notify(SLEEP) again
+			 */
+			break;
+		}
+
+		if (WARN_ON(action && action != WIFI_PS_ACTION_WAKEUP))
+			break;
+
+		/* make sure mac80211 will resched all STA itxq */
+		atomic_set(&wifi_sta->clear_ps_filter, 1);
+		for (tidno = 0; tidno < IEEE80211_NUM_TIDS + 1; tidno++) {
+			wifi_tid = WIFI_TID(sta->txq[tidno]);
+			if (wifi_tid_baw_has_inflight_packets(wifi_tid))
+				ieee80211_schedule_txq(hw, TID2ITXQ(wifi_tid));
+		}
+
+		wifi_sta->ps_state = WIFI_PS_AWAKE;
+		psdbg("=> now awake\n");
+		break;
+	}
+
+	/* printk("wifi_sta_ps_transition: new_state:%d\n", wifi_sta->ps_state); */
+}
+
+/*
+ * called when TID has no more inflight packet
+ */
+static void wifi_tid_ps_has_no_more_buffer(struct wifi_tid *wifi_tid)
+{
+	struct ieee80211_txq *itxq = TID2ITXQ(wifi_tid);
+	struct wifi_sta *wifi_sta = WIFI_STA(itxq->sta);
+
+	if (!wifi_tid->ps_sleep_has_buf)
+		return;
+
+	if (wifi_sta->ps_state != WIFI_PS_SLEEP)
+		return;
+
+	psdbg("wifi_tid_ps_recheck: sta:%pM no more bufferd\n",
+	      itxq->sta->addr);
+	ieee80211_sta_set_buffered(itxq->sta, itxq->tid, false);
+	wifi_tid->ps_sleep_has_buf = false;
+}
+
+/*
+ * dump BAW (debug)
+ */
+static void wifi_tid_baw_print(struct wifi_tid *wifi_tid)
+{
+	u32 end = wifi_tid->seq_start + wifi_tid_baw_tracked_size(wifi_tid);
+	end &= 0xfff;
+
+	badbg("baw: max_size:%u tracked:%zu seq_start:%u => %u head:%u tail:%u inflight:%u\n",
+	      wifi_tid->baw_max_size,
+	      wifi_tid_baw_tracked_size(wifi_tid),
+	      wifi_tid->seq_start,
+	      end,
+	      wifi_tid->scb_head,
+	      wifi_tid->scb_tail,
+	      wifi_tid->scb_inflight_count);
+}
+
+static void wifi_tid_baw_print_nodebug(struct wifi_tid *wifi_tid)
+{
+	u32 end = wifi_tid->seq_start + wifi_tid_baw_tracked_size(wifi_tid);
+	end &= 0xfff;
+
+	printk("baw: max_size:%u tracked:%zu seq_start:%u => %u head:%u tail:%u inflight:%u\n",
+	       wifi_tid->baw_max_size,
+	       wifi_tid_baw_tracked_size(wifi_tid),
+	       wifi_tid->seq_start,
+	       end,
+	       wifi_tid->scb_head,
+	       wifi_tid->scb_tail,
+	       wifi_tid->scb_inflight_count);
+}
+
+/*
+ * actually send the BAR
+ */
+static void wifi_tid_send_bar(struct wifi_tid *wifi_tid, int seq_no)
+{
+	struct ieee80211_txq *itxq = TID2ITXQ(wifi_tid);
+
+	badbg("wifi_tid_send_bar: seq_no:%d\n", seq_no);
+
+	/* NB: this re-enter driver via drv_tx_queue() */
+	ieee80211_send_bar_sta(itxq->sta,
+			       itxq->tid,
+			       seq_no << IEEE80211_SEQ_SEQ_SHIFT);
+}
+
+/*
+ * schedule or reschedule BAR timer
+ */
+static void __wifi_tid_baw_bar_resched_timer(struct wifi_tid *wifi_tid)
+{
+	badbg("__wifi_tid_baw_bar_resched_timer\n");
+	mod_timer(&wifi_tid->bar_timer, jiffies + HZ / 100);
+}
+
+static void __wifi_tid_baw_bar_trigger_timer(struct wifi_tid *wifi_tid)
+{
+	badbg("__wifi_tid_baw_bar_trigger_timer\n");
+	mod_timer(&wifi_tid->bar_timer,  jiffies);
+}
+
+static void __wifi_tid_baw_bar_may_trigger_timer(struct wifi_tid *wifi_tid)
+{
+	if (timer_pending(&wifi_tid->bar_timer))
+		return;
+	__wifi_tid_baw_bar_trigger_timer(wifi_tid);
+}
+
+/*
+ * BAR timer callback, send BAR unless request was canceled
+ */
+static void wifi_tid_baw_bar_timer(struct timer_list *t)
+{
+	struct wifi_tid *wifi_tid = from_timer(wifi_tid, t, bar_timer);
+	bool send_bar;
+
+	spin_lock(&wifi_tid->bar_lock);
+
+	badbg("wifi_tid_baw_bar_timer: bar_state:%d bar_req_limit:%d seq_start:%d inflight:%d\n",
+	      wifi_tid->bar_state,
+	      wifi_tid->bar_req_limit,
+	      wifi_tid->seq_start,
+	      wifi_tid->bar_inflight);
+
+	send_bar = false;
+	switch (wifi_tid->bar_state) {
+	case WIFI_BAR_NONE:
+	case WIFI_BAR_SENT:
+	case WIFI_BAR_WAIT_RETRY:
+		/* request canceled, we don't use del_timer() so it
+		 * might happen */
+		break;
+
+	case WIFI_BAR_NEEDED:
+		if (wifi_tid->bar_inflight) {
+			/* previous BAR still being transmited, txdone
+			 * will update state */
+			break;
+		}
+
+		wifi_tid->bar_state = WIFI_BAR_SENT;
+		wifi_tid->bar_inflight = true;
+		send_bar = true;
+		break;
+	}
+	spin_unlock(&wifi_tid->bar_lock);
+
+	if (send_bar)
+		wifi_tid_send_bar(wifi_tid, wifi_tid->seq_start);
+}
+
+/*
+ * if BAR send request is pending, reset timer so it's sent ASAP
+ */
+static void wifi_tid_baw_bar_flush_any(struct wifi_tid *wifi_tid)
+{
+	spin_lock(&wifi_tid->bar_lock);
+
+	switch (wifi_tid->bar_state) {
+	case WIFI_BAR_NONE:
+	case WIFI_BAR_SENT:
+	case WIFI_BAR_WAIT_RETRY:
+		break;
+
+	case WIFI_BAR_NEEDED:
+		__wifi_tid_baw_bar_trigger_timer(wifi_tid);
+		break;
+	}
+
+	spin_unlock(&wifi_tid->bar_lock);
+}
+
+/*
+ * schedule a BAR for given seq_no, arm a timer to do it later
+ */
+static void __wifi_tid_baw_bar_schedule(struct wifi_tid *wifi_tid,
+					unsigned int seq_no)
+{
+	switch (wifi_tid->bar_state) {
+	case WIFI_BAR_NEEDED:
+	case WIFI_BAR_WAIT_RETRY:
+		/* BAR request already pending, update bar range */
+		wifi_tid->bar_req_limit =
+			(seq_no + wifi_tid->remote_baw_max_size) & 0xfff;
+		badbg("wifi_tid_baw_bar_schedule: <pending>, new seq_no:%d "
+		      "=> extend limit_sn: %d\n",
+		      seq_no,
+		      wifi_tid->bar_req_limit);
+		break;
+
+	case WIFI_BAR_NONE:
+	case WIFI_BAR_SENT:
+		wifi_tid->bar_state = WIFI_BAR_NEEDED;
+		wifi_tid->bar_req_limit =
+			(seq_no + wifi_tid->remote_baw_max_size) & 0xfff;
+
+		badbg("wifi_tid_baw_bar_schedule: <none>, seq_no:%d "
+		      "=> limit_sn:%d\n",
+		      seq_no,
+		      wifi_tid->bar_req_limit);
+		__wifi_tid_baw_bar_resched_timer(wifi_tid);
+		break;
+	}
+}
+
+/*
+ * this is called after any MPDU on this TID is positively
+ * acknowledged, it will schedule BAR retransmit if BAR was pending
+ */
+static void wifi_tid_baw_bar_may_retry(struct wifi_tid *wifi_tid)
+{
+	spin_lock(&wifi_tid->bar_lock);
+
+	switch (wifi_tid->bar_state) {
+	case WIFI_BAR_NONE:
+	case WIFI_BAR_SENT:
+	case WIFI_BAR_NEEDED:
+		break;
+	case WIFI_BAR_WAIT_RETRY:
+		if (wifi_tid->bar_retry_count >= 10) {
+			wifi_tid->bar_state = WIFI_BAR_NONE;
+			break;
+		}
+
+		++wifi_tid->bar_retry_count;
+		badbg("wifi_tid_baw_bar_may_retry => will retry ASAP\n");
+		wifi_tid->bar_state = WIFI_BAR_NEEDED;
+		__wifi_tid_baw_bar_trigger_timer(wifi_tid);
+		break;
+	}
+	spin_unlock(&wifi_tid->bar_lock);
+}
+
+/*
+ * this is called after BAR transmit completion
+ */
+static void wifi_tid_baw_bar_handle_txdone(struct wifi_tid *wifi_tid,
+					   bool txok)
+{
+	spin_lock(&wifi_tid->bar_lock);
+	badbg("wifi_tid_baw_bar_handle_txdone: BAR txdone (txok:%d)\n",
+	      txok);
+
+	WARN_ON(!wifi_tid->bar_inflight);
+	wifi_tid->bar_inflight = false;
+
+	switch (wifi_tid->bar_state) {
+	case WIFI_BAR_NONE:
+		break;
+	case WIFI_BAR_SENT:
+		if (!txok) {
+			/* retry previous request */
+			wifi_tid->bar_state = WIFI_BAR_WAIT_RETRY;
+			wifi_tid->bar_retry_count = 0;
+		}
+		break;
+	case WIFI_BAR_NEEDED:
+		/* more recent BAR request present, so we don't care
+		 * if previous BAR could be sent or not, make sure
+		 * timer is running (in case timer has already expired) */
+		__wifi_tid_baw_bar_may_trigger_timer(wifi_tid);
+		break;
+	case WIFI_BAR_WAIT_RETRY:
+		WARN(1, "bad BAR state");
+		break;
+	}
+
+	spin_unlock(&wifi_tid->bar_lock);
+}
+
+/*
+ * update BAW after packet transmit success of failure, this will move
+ * BAW head forward when possible and update the BAR pending state
+ *
+ * return true if baw head has moved
+ */
+static bool
+wifi_tid_baw_update(struct wifi_tid *wifi_tid,
+		    struct wifi_tx_skb *wskb,
+		    bool txok)
+{
+	unsigned int seq_scb_idx;
+	int bar_seqno;
+
+	txdbg("wifi_tid_baw_update: seq_no:%u txok:%u\n", wskb->seq_no, txok);
+	if (WARN_ON(!wifi_tid_baw_tracks_seqno(wifi_tid, wskb->seq_no))) {
+		/* we are not supposed to reduce the BAW while packets
+		 * tracked inside it are in-flight */
+		printk("wifi_tid_baw_update: seq_no:%u txok:%u\n", wskb->seq_no, txok);
+		wifi_tid_baw_print_nodebug(wifi_tid);
+		return false;
+	}
+
+	/* compute index in scoreboard for this seqno */
+	seq_scb_idx = wifi_tid->scb_head;
+	seq_scb_idx += (wskb->seq_no - wifi_tid->seq_start) & 0xfff;
+	if (seq_scb_idx >= WIFI_SCB_MAX)
+		seq_scb_idx -= WIFI_SCB_MAX;
+
+	/* additional sanity check */
+	if (WARN_ON(!test_bit(seq_scb_idx, wifi_tid->scb_inflight)))
+		return false;
+
+	/* record positive acknowledgement and tx failure */
+	if (txok)
+		__set_bit(seq_scb_idx, wifi_tid->scb_acked);
+
+	__clear_bit(seq_scb_idx, wifi_tid->scb_inflight);
+	wifi_tid->scb_inflight_count--;
+
+	/* if number of packets in flight reaches 0 and the STA was
+	 * marked as sleeping, we can tell stack that we have no more
+	 * packets buffered for this TID */
+	if (!wifi_tid->scb_inflight_count)
+		wifi_tid_ps_has_no_more_buffer(wifi_tid);
+
+	/* if this packet was not at head of window, head cannot move */
+	if (wskb->seq_no != wifi_tid->seq_start) {
+		txdbg("wifi_tid_baw_update: not head (seq_start:%d)\n",
+		      wifi_tid->seq_start);
+		wifi_tid_baw_print(wifi_tid);
+		return false;
+	}
+
+	/*
+	 * seqno was at the head of the window, we can now move it
+	 * forward
+	 *
+	 * if we find any failed frame, then a BAR will be needed
+	 */
+	bar_seqno = -1;
+
+	spin_lock(&wifi_tid->bar_lock);
+	do {
+		if (!test_bit(wifi_tid->scb_head, wifi_tid->scb_acked))
+			bar_seqno = wifi_tid->seq_start;
+
+		/* move head */
+		wifi_tid->seq_start++;
+		wifi_tid->seq_start &= 0xfff;
+
+		/* we have moved head, cancel existing bar request if
+		 * we step over its SN validity limit */
+		switch (wifi_tid->bar_state) {
+		case WIFI_BAR_NONE:
+		case WIFI_BAR_SENT:
+			break;
+		case WIFI_BAR_NEEDED:
+		case WIFI_BAR_WAIT_RETRY:
+			if (wifi_tid->seq_start == wifi_tid->bar_req_limit) {
+				badbg("wifi_tid_baw_update "
+				       "=> cancel bar_seqno:%d head_seq_no:%d\n",
+				       wifi_tid->bar_req_limit,
+				       wifi_tid->seq_start);
+				wifi_tid->bar_state = WIFI_BAR_NONE;
+			}
+			break;
+		}
+
+		wifi_tid->scb_head++;
+		if (wifi_tid->scb_head >= WIFI_SCB_MAX)
+			wifi_tid->scb_head -= WIFI_SCB_MAX;
+
+		badbg("wifi_tid_baw_update: moved head to seq_no %u\n",
+		      wifi_tid->seq_start);
+
+		/* stop when we reach an in-flight frame */
+		if (test_bit(wifi_tid->scb_head, wifi_tid->scb_inflight))
+			break;
+
+	} while (wifi_tid->scb_head != wifi_tid->scb_tail);
+
+	/* schedule or unschedule BAR */
+	switch (wifi_tid->aggr_state) {
+	case WIFI_AGGR_STOPPED:
+		break;
+	case WIFI_AGGR_ACTIVE:
+	case WIFI_AGGR_STOPPING:
+		if (bar_seqno != -1)
+			__wifi_tid_baw_bar_schedule(wifi_tid, bar_seqno);
+		break;
+	}
+
+	spin_unlock(&wifi_tid->bar_lock);
+
+	wifi_tid_baw_print(wifi_tid);
+	return true;
+}
+
+/*
+ * mark packet as tracked by BAW
+ *
+ * this will enforce its seq_no to be the next seqno after BAW end
+ */
+static void
+wifi_tid_baw_addto(struct wifi_tid *wifi_tid, struct wifi_tx_skb *wskb)
+{
+	unsigned int seq_scb_idx;
+
+	WARN_ON(wskb->type != WIFI_TXSKB_QOS_DATA);
+	if (WARN_ON(wifi_tid_baw_tracked_size(wifi_tid) >=
+		    wifi_tid->baw_max_size))
+		return;
+
+	badbg("wifi_tid_baw_addto: seq_no:%u\n", wskb->seq_no);
+
+	if (WARN_ON(wifi_tid_baw_next_seqno(wifi_tid) != wskb->seq_no)) {
+		printk("wifi_tid_baw_addto: NEXT SEQ SHOULD BE:%u, but is %u\n",
+		       wifi_tid_baw_next_seqno(wifi_tid),
+		       wskb->seq_no);
+		return;
+	}
+
+	wifi_tid->scb_tail++;
+	if (wifi_tid->scb_tail >= WIFI_SCB_MAX)
+		wifi_tid->scb_tail -= WIFI_SCB_MAX;
+
+	/* compute index in scoreboard for this seqno */
+	seq_scb_idx = wifi_tid->scb_head;
+	seq_scb_idx += (wskb->seq_no - wifi_tid->seq_start) & 0xfff;
+	if (seq_scb_idx >= WIFI_SCB_MAX)
+		seq_scb_idx -= WIFI_SCB_MAX;
+
+	__clear_bit(seq_scb_idx, wifi_tid->scb_acked);
+	__set_bit(seq_scb_idx, wifi_tid->scb_inflight);
+	wifi_tid->scb_inflight_count++;
+
+	badbg("wifi_tid_baw_addto: inflight count now: %u\n",
+	      wifi_tid->scb_inflight_count);
+	wifi_tid_baw_print(wifi_tid);
+}
+
+/*
+ *
+ */
+static void wifi_tid_init(struct wifi_tid *wifi_tid,
+			  struct wifi_txq *wifi_txq,
+			  enum wifi_tid_type type)
+{
+	memset(wifi_tid, 0, sizeof (*wifi_tid));
+	INIT_LIST_HEAD(&wifi_tid->retry_q);
+	spin_lock_init(&wifi_tid->bar_lock);
+	timer_setup(&wifi_tid->bar_timer, wifi_tid_baw_bar_timer, 0);
+	wifi_tid->txq = wifi_txq;
+	wifi_tid->baw_max_size = WIFI_TX_MAX_NON_AGGR;
+	wifi_tid->type = type;
+}
+
+/*
+ *
+ */
+static void wifi_tid_drain(struct wifi_priv *wp,
+			   struct wifi_tid *wifi_tid)
+{
+	struct wifi_tx_skb *wskb, *tmp;
+
+	list_for_each_entry_safe(wskb, tmp, &wifi_tid->retry_q, next)
+		wifi_tx_skb_release_txfail(wp, wskb);
+	INIT_LIST_HEAD(&wifi_tid->retry_q);
+}
+
+/*
+ *
+ */
+static void wifi_tid_release(struct wifi_priv *wp,
+			     struct wifi_tid *wifi_tid)
+{
+	/* ampdu action callback should have stopped any tx ba
+	 * session before removing STA */
+	WARN_ON(wifi_tid->aggr_state != WIFI_AGGR_STOPPED);
+
+	/* tx completion for tx filtered frame can queue frames to
+	 * retry as long as STA struct is visible, we have to drain
+	 * here */
+	wifi_tid_drain(wp, wifi_tid);
+
+	del_timer_sync(&wifi_tid->bar_timer);
+}
+
+/*
+ *
+ */
+static void wifi_tid_requeue(struct wifi_tid *wifi_tid,
+			     struct wifi_tx_skb *wskb)
+{
+	txdbg("wifi_tid_requeue: requeing wskb:%ps seq:%u\n",
+	       wskb, wskb->seq_no);
+	list_add(&wskb->next, &wifi_tid->retry_q);
+}
+
+/*
+ *
+ */
+static void wifi_tid_requeue_chain(struct wifi_tid *wifi_tid,
+				   struct list_head *chain,
+				   size_t max_count)
+{
+	struct wifi_tx_skb *wskb, *tmp;
+
+	list_for_each_entry_safe_reverse(wskb, tmp, chain, next){
+		if (!max_count)
+			break;
+		wifi_tid_requeue(wifi_tid, wskb);
+		max_count--;
+	}
+}
+
+/*
+ *
+ */
+static struct wifi_tx_skb *
+wifi_tid_dequeue(struct wifi_priv *wp, struct ieee80211_txq *itxq,
+		 bool do_retry, bool do_mac80211, bool *is_retry)
+{
+	struct wifi_tid *wifi_tid = WIFI_TID(itxq);
+	struct wifi_tx_skb *wskb;
+	struct sk_buff *skb;
+	int tid;
+
+	/* dequeue from retry queue first, it's guaranted to
+	 * be already in BAW */
+	if (do_retry && !list_empty(&wifi_tid->retry_q)) {
+		wskb = list_first_entry(&wifi_tid->retry_q,
+					struct wifi_tx_skb, next);
+		list_del(&wskb->next);
+		txdbg("wifi_tid_dequeue wskb:%ps seq:%u (from retry %u)\n",
+		      wskb, wskb->seq_no, wskb->sw_tries_done);
+		if (is_retry)
+			*is_retry = true;
+		return wskb;
+	}
+
+	if (!do_mac80211)
+		return NULL;
+
+	skb = ieee80211_tx_dequeue(wp->hw, itxq);
+	if (!skb)
+		return NULL;
+
+	switch (wifi_tid->type) {
+	case WIFI_TID_MCAST:
+		tid = -1;
+		break;
+	default:
+		tid = itxq->tid;
+		break;
+	}
+
+	wskb = wifi_tx_skb_wrap(wp, wifi_tid->txq, skb, itxq->sta, tid);
+	if (!wskb) {
+		ieee80211_free_txskb(wp->hw, skb);
+		return NULL;
+	}
+
+	txdbg("wifi_tid_dequeue wskb:%ps has_tid:%d tid:%d seq:%u\n",
+	      wskb, wskb->has_tid, wskb->tid, wskb->seq_no);
+	if (is_retry)
+		*is_retry = false;
+	return wskb;
+}
+
+static struct wifi_tx_skb *
+wifi_tid_dequeue_any(struct wifi_priv *wp, struct ieee80211_txq *itxq,
+		     bool *is_retry)
+{
+	txdbg("wifi_tid_dequeue_any\n");
+	return wifi_tid_dequeue(wp, itxq, true, true, is_retry);
+}
+
+static struct wifi_tx_skb *
+wifi_tid_dequeue_only_mac80211(struct wifi_priv *wp, struct ieee80211_txq *itxq)
+{
+	txdbg("wifi_tid_dequeue_mac80211\n");
+	return wifi_tid_dequeue(wp, itxq, false, true, NULL);
+}
+
+static struct wifi_tx_skb *
+wifi_tid_dequeue_only_retry(struct wifi_priv *wp, struct ieee80211_txq *itxq)
+{
+	txdbg("wifi_tid_dequeue_only_retry\n");
+	return wifi_tid_dequeue(wp, itxq, true, false, NULL);
+}
+
+/*
+ * dequeue from retry queue first, then mac80211 if BAW allows it, add
+ * frame to BAW
+ */
+static struct wifi_tx_skb *
+wifi_tid_dequeue_within_baw_limit(struct wifi_priv *wp,
+				  struct ieee80211_txq *itxq)
+{
+	struct wifi_tid *wifi_tid = WIFI_TID(itxq);
+	struct wifi_tx_skb *wskb;
+	size_t space;
+
+	space = wifi_tid_baw_space(wifi_tid);
+
+	txdbg("wifi_tid_dequeue_within_space: baw space:%zu\n", space);
+	if (space > 0) {
+		bool from_retry;
+
+		wskb = wifi_tid_dequeue_any(wp, itxq, &from_retry);
+		if (wskb && !from_retry)
+			wifi_tid_baw_addto(wifi_tid, wskb);
+	} else
+		wskb = wifi_tid_dequeue_only_retry(wp, itxq);
+
+	return wskb;
+}
+
+/*
+ *
+ */
+static u16 compute_max_ampdu_bytes(const struct wifi_txq *wifi_txq,
+				   const struct ieee80211_tx_rate *rates)
+{
+	u32 max_frmlen;
+	u16 aggr_limit;
+	bool legacy;
+	size_t i;
+
+	legacy = false;
+	max_frmlen = 0;
+
+	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+		const struct ieee80211_tx_rate *r = &rates[i];
+		int short_gi, bw_40;
+
+		if (r->idx < 0)
+			break;
+
+		if (!r->count)
+			continue;
+
+		if (!(r->flags & IEEE80211_TX_RC_MCS)) {
+			legacy = true;
+			break;
+		}
+
+		bw_40 = !!(rates[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH);
+		short_gi = !!(rates[i].flags & IEEE80211_TX_RC_SHORT_GI);
+		max_frmlen = wifi_txq->max_aggr_framelen[bw_40][short_gi][r->idx];
+		break;
+	}
+
+	if (legacy)
+		return 0;
+
+	aggr_limit = min(max_frmlen, (u32)(64 * 1024 - 1));
+	return aggr_limit;
+}
+
+/*
+ *
+ */
+static bool has_legacy_rate(const struct ieee80211_tx_rate *rates)
+{
+	bool legacy;
+	size_t i;
+
+	legacy = false;
+	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+		const struct ieee80211_tx_rate *r = &rates[i];
+
+		if (r->idx < 0)
+			break;
+
+		if (!r->count)
+			continue;
+
+		if (!(r->flags & IEEE80211_TX_RC_MCS))
+			return true;
+	}
+	return false;
+}
+
+/*
+ * Returns the size in bytes of delimiters that need to added to meet
+ * the minimum required mpdudensity.
+ */
+static int compute_delims_size(const struct ieee80211_tx_rate *r,
+			       u16 frmlen, u8 density_idx)
+{
+	unsigned int width, streams, density_us;
+	u32 nsymbits, nsymbols;
+	u16 minlen;
+	u8 mcs;
+	bool half_gi;
+	bool bw_40;
+
+	switch (density_idx) {
+	case 0:
+	default:
+		return 0;
+	case 1:
+	case 2:
+	case 3:
+		density_us = 1;
+		break;
+	case 4:
+		density_us = 2;
+		break;
+	case 5:
+		density_us = 4;
+		break;
+	case 6:
+		density_us = 8;
+		break;
+	case 7:
+		density_us = 16;
+		break;
+	}
+
+	mcs = r->idx;
+	bw_40 = !!(r->flags & IEEE80211_TX_RC_40_MHZ_WIDTH);
+	half_gi = !!(r->flags & IEEE80211_TX_RC_SHORT_GI);
+
+	if (half_gi)
+		nsymbols = NUM_SYMBOLS_PER_USEC_HALFGI(density_us);
+	else
+		nsymbols = NUM_SYMBOLS_PER_USEC(density_us);
+
+	if (nsymbols == 0)
+		nsymbols = 1;
+
+	streams = mcs / 8 + 1;
+	nsymbits = bits_per_symbol[mcs % 8][width] * streams;
+	minlen = (nsymbols * nsymbits) / BITS_PER_BYTE;
+
+	if (frmlen >= minlen)
+		return 0;
+
+	return ALIGN(minlen - frmlen, AMPDU_DELIM_SZ);
+}
+
+/*
+ * build a chain of packets to send as an aggregate, return chain size
+ */
+static size_t wifi_tid_build_aggr(struct wifi_priv *wp,
+				  struct ieee80211_txq *itxq,
+				  struct list_head *chain,
+				  bool *aggr)
+{
+	struct wifi_tid *wifi_tid = WIFI_TID(itxq);
+	struct wifi_tx_skb *first_wskb;
+	struct ieee80211_tx_info *tx_info;
+	u16 max_aggr_bytes, mpdu_bytes, aggr_bytes;
+	ssize_t count;
+
+	/*
+	 * check how many "fresh" packets (from mac80211) we can send
+	 * until being limited by the BAW, if BAW is full only try to
+	 * dequeue from retry queue
+	 */
+	first_wskb = wifi_tid_dequeue_within_baw_limit(wp, itxq);
+	if (!first_wskb)
+		return 0;
+
+	INIT_LIST_HEAD(chain);
+	list_add(&first_wskb->next, chain);
+	count = 1;
+
+	/* fill rates for the first packet */
+	tx_info = IEEE80211_SKB_CB(first_wskb->skb);
+	wifi_tx_skb_fill_rates(first_wskb, itxq->vif, itxq->sta);
+
+	/* if rate is a probe rate or if packet is not supposed to be
+	 * aggregated, stop here */
+	if ((tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) ||
+	    !(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
+		txdbg("wifi_build_aggr: first has probe rate / non ampdu\n");
+		/* printk("bd probe 1\n"); */
+		*aggr = false;
+		return count;
+	}
+
+	/* find out the maximum allowed aggregate len at this rate
+	 * without going over the 4 milliseconds limit */
+	max_aggr_bytes = compute_max_ampdu_bytes(wifi_tid->txq,
+						 tx_info->control.rates);
+	/* cap to maximum value supported by remote STA */
+	if (wifi_tid->ampdu_max_bytes)
+		max_aggr_bytes = min(max_aggr_bytes,
+				     wifi_tid->ampdu_max_bytes);
+
+	if (!max_aggr_bytes) {
+		/* packet has legacy rate, don't aggregate */
+		*aggr = false;
+		/* printk("bd leg 1\n"); */
+		return count;
+	}
+
+	/* will build an aggregate, fill mandatory txdesc info */
+	first_wskb->txdesc.ampdu_density = wifi_tid->ampdu_density;
+	first_wskb->txdesc.ampdu_baw_ssn = wifi_tid->seq_start;
+
+	/* dequeue as many frames as we can */
+	mpdu_bytes = first_wskb->frame_len;
+	mpdu_bytes += compute_delims_size(tx_info->control.rates, mpdu_bytes,
+					  wifi_tid->ampdu_density);
+	mpdu_bytes += AMPDU_DELIM_SZ;
+	mpdu_bytes = ALIGN(mpdu_bytes, 4);
+	aggr_bytes = mpdu_bytes;
+
+	while (1) {
+		struct wifi_tx_skb *wskb;
+
+		/* send at most half the maximum baw size per ampdu,
+		 * in best cast we will have two ampdu inflight with
+		 * full window */
+		if (count >= wifi_tid->baw_max_size / 2) {
+			txdbg("wifi_build_aggr: reached baw size\n");
+			/* printk("bd baw 1\n"); */
+			break;
+		}
+
+		wskb = wifi_tid_dequeue_within_baw_limit(wp, itxq);
+		if (!wskb) {
+			txdbg("wifi_build_aggr: nothing more to dequeue\n");
+			/* printk("bd deq spc:%u\n", */
+			/*        wifi_tid_baw_space(wifi_tid)); */
+			break;
+		}
+
+		/* stop if next skb is a probe rate, or not supposed
+		 * to be aggregated */
+		tx_info = IEEE80211_SKB_CB(wskb->skb);
+		if ((tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) ||
+		    !(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
+			txdbg("wifi_build_aggr: next probe or !ampdu\n");
+			wifi_tid_requeue(wifi_tid, wskb);
+			/* printk("bd probe 2\n"); */
+			break;
+		}
+
+		if (has_legacy_rate(tx_info->control.rates)) {
+			txdbg("wifi_build_aggr: next has legacy rate\n");
+			wifi_tid_requeue(wifi_tid, wskb);
+			/* printk("bd leg 2\n"); */
+			break;
+		}
+
+		/* compute aggregrated frame len of this packet, and
+		 * check we don't go past limit */
+		mpdu_bytes = wskb->frame_len;
+		mpdu_bytes += compute_delims_size(tx_info->control.rates,
+						  mpdu_bytes,
+						  wifi_tid->ampdu_density);
+		mpdu_bytes += AMPDU_DELIM_SZ;
+		mpdu_bytes = ALIGN(mpdu_bytes, 4);
+
+		if (aggr_bytes + mpdu_bytes > max_aggr_bytes) {
+			txdbg("wifi_build_aggr: too many bytes add %u > %u\n",
+			      aggr_bytes + mpdu_bytes, max_aggr_bytes);
+			wifi_tid_requeue(wifi_tid, wskb);
+			/* printk("bd maxb %u\n", max_aggr_bytes); */
+			break;
+		}
+
+		aggr_bytes += mpdu_bytes;
+		list_add_tail(&wskb->next, chain);
+		count++;
+	}
+
+	txdbg("final aggr size is %u / %u\n", aggr_bytes, max_aggr_bytes);
+	*aggr = true;
+	return count;
+}
+
+/*
+ *
+ */
+static void wifi_tid_schedule_aggr_active(struct ieee80211_hw *hw,
+					  struct ieee80211_txq *itxq)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct wifi_tid *wifi_tid = WIFI_TID(itxq);
+	struct list_head chain;
+	bool do_aggr;
+	size_t count;
+
+	WARN_ON(wifi_tid->type != WIFI_TID_STA_QOS_DATA);
+
+	/*
+	 * try to build a chain of packet to aggregate, it may end up
+	 * being a single packet that we have to send without
+	 * aggregation
+	 */
+	count = wifi_tid_build_aggr(wp, itxq, &chain, &do_aggr);
+	if (count)
+		txdbg("wifi_tid_schedule_aggr_active: built an %saggregate of count:%zu\n",
+		      do_aggr ? "" : "NOT ", count);
+	else
+		txdbg("wifi_tid_schedule_aggr_active: nothing to send\n");
+
+	if (!count) {
+		if (!wifi_tid_baw_has_inflight_packets(wifi_tid)) {
+			/* no new packet to send, nothing in flight,
+			 * if the BAR delay timer is running, we can
+			 * send the BAR immediately instead of
+			 * waiting */
+			wifi_tid_baw_bar_flush_any(wifi_tid);
+		}
+		return;
+	}
+
+	if (count < WIFI_MIN_AGGR_COUNT) {
+		struct wifi_tx_skb *wskb;
+
+		/* since hardware does not do multi rate retry on
+		 * AMPDU, if we cannot build a large chain, better
+		 * send them as individual packets */
+		wskb = list_first_entry(&chain, struct wifi_tx_skb, next);
+		wifi_tid_requeue_chain(wifi_tid, &chain, count - 1);
+		INIT_LIST_HEAD(&chain);
+		list_add(&wskb->next, &chain);
+		count = 1;
+		do_aggr = false;
+	}
+
+	/* if we end up finally sending it as non aggregated, clear
+	 * the AMPDU tx info flag, otherwise rate control won't be
+	 * updated at tx done */
+	if (!do_aggr) {
+		struct wifi_tx_skb *wskb;
+		struct ieee80211_tx_info *tx_info;
+		wskb = list_first_entry(&chain, struct wifi_tx_skb, next);
+		tx_info = IEEE80211_SKB_CB(wskb->skb);
+		tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+	}
+
+	/* { */
+	/* 	struct wifi_tx_skb *wskb; */
+	/* 	wskb = list_first_entry(&chain, struct wifi_tx_skb, next); */
+	/* 	txdbg("send chain count:%u (BAW:%d), seq:%d\n", count, */
+	/* 	      wifi_tid_baw_tracked_size(wifi_tid), */
+	/* 	      wskb->seq_no); */
+	/* } */
+
+	/* cannot fail since caller made sure not to push too much*/
+	WARN_ON(wifi_tx_send_chain(wp, &chain, count, do_aggr,
+				   itxq->sta, false));
+}
+
+/*
+ *
+ */
+static void wifi_tid_schedule_aggr_stopping(struct ieee80211_hw *hw,
+					    struct ieee80211_txq *itxq)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct ieee80211_tx_info *tx_info;
+	struct list_head chain;
+	struct wifi_tx_skb *wskb;
+	struct wifi_tid *wifi_tid = WIFI_TID(itxq);
+
+	WARN_ON(wifi_tid->type != WIFI_TID_STA_QOS_DATA);
+
+	wskb = wifi_tid_dequeue_only_retry(wp, itxq);
+	if (!wskb)
+		return;
+
+	txdbg("wifi_tid_schedule_aggr_stopping: will *NOT* aggr starting from "
+	      "wskb:%ps seq:%u\n", wskb, wskb->seq_no);
+
+	wifi_tx_skb_fill_rates(wskb, itxq->vif, itxq->sta);
+
+	/* when aggregation state is stopping, frames will still be
+	 * marked as to be aggregated, make sure to clear this */
+	tx_info = IEEE80211_SKB_CB(wskb->skb);
+	tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+
+	INIT_LIST_HEAD(&chain);
+	list_add(&wskb->next, &chain);
+
+	/* cannot fail since caller made sure not to push too much*/
+	WARN_ON(wifi_tx_send_chain(wp, &chain, 1, false, itxq->sta, false));
+}
+
+/*
+ *
+ */
+static void wifi_tid_schedule_non_aggr(struct ieee80211_hw *hw,
+				       struct ieee80211_txq *itxq)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct ieee80211_tx_info *tx_info;
+	struct list_head chain;
+	struct wifi_tx_skb *wskb;
+	struct wifi_tid *wifi_tid = WIFI_TID(itxq);
+
+	wskb = NULL;
+	switch (wifi_tid->type) {
+	case WIFI_TID_MCAST:
+	case WIFI_TID_STA_MMPDU:
+	case WIFI_TID_STA_DATA:
+		wskb = wifi_tid_dequeue_only_mac80211(wp, itxq);
+		break;
+	case WIFI_TID_STA_QOS_DATA:
+		wskb = wifi_tid_dequeue_within_baw_limit(wp, itxq);
+		break;
+	}
+
+	if (!wskb)
+		return;
+
+	txdbg("wifi_tid_schedule_non_aggr: will *NOT* aggr starting from "
+	      "wskb:%ps seq:%u\n", wskb, wskb->seq_no);
+
+	wifi_tx_skb_fill_rates(wskb, itxq->vif, itxq->sta);
+
+	tx_info = IEEE80211_SKB_CB(wskb->skb);
+	WARN_ON(tx_info->flags & IEEE80211_TX_CTL_AMPDU);
+
+	INIT_LIST_HEAD(&chain);
+	list_add(&wskb->next, &chain);
+
+	/* cannot fail since caller made sure not to push too much*/
+	WARN_ON(wifi_tx_send_chain(wp, &chain, 1, false, itxq->sta, false));
+}
+
+/*
+ * schedule some packets from this tid
+ *
+ * return false if we don't want to be rescheduled (tx completion will
+ * do this), otherwise we want to be called again to schedule more
+ * packets that we buffer internally
+ */
+static bool wifi_tid_schedule(struct ieee80211_hw *hw,
+			      struct ieee80211_txq *itxq)
+{
+	struct wifi_tid *wifi_tid = WIFI_TID(itxq);
+	struct wifi_sta *wifi_sta;
+	bool ret;
+
+	wifi_sta = NULL;
+	if (itxq->sta) {
+		wifi_sta = WIFI_STA(itxq->sta);
+		spin_lock(&wifi_sta->lock);
+
+		if (wifi_sta->ps_state != WIFI_PS_AWAKE) {
+			/*
+			 * we take care to stop scheduling a tid when STA is
+			 * sleeping, but this can happen:
+			 * - ieee80211_tx_stop_ba_cb_irqsafe
+			 * - ieee80211_ba_session_work
+			 * - ieee80211_agg_start_txq
+			 * - wifi_tid_schedule
+			 */
+			spin_unlock(&wifi_sta->lock);
+			return false;
+		}
+	}
+
+	switch (wifi_tid->aggr_state) {
+	case WIFI_AGGR_STOPPED:
+		txdbg("wifi_tid_schedule: enter aggr stopped (ac:%d/tid:%d)\n",
+		      itxq->ac, itxq->tid);
+
+		wifi_tid_schedule_non_aggr(hw, itxq);
+		break;
+
+	case WIFI_AGGR_STOPPING:
+		txdbg("wifi_tid_schedule: enter aggr stopping (ac:%d/tid:%d)\n",
+		      itxq->ac, itxq->tid);
+
+		wifi_tid_schedule_aggr_stopping(hw, itxq);
+
+		/* switch to stopped state when we have completed
+		 * everything that was inflight in BAW */
+		if (!wifi_tid_baw_has_inflight_packets(wifi_tid)) {
+			WARN_ON(!list_empty(&wifi_tid->retry_q));
+			wifi_tid->aggr_state = WIFI_AGGR_STOPPED;
+			ieee80211_stop_tx_ba_cb_irqsafe(itxq->vif,
+							itxq->sta->addr,
+							itxq->tid);
+		}
+		break;
+
+	case WIFI_AGGR_ACTIVE:
+		txdbg("wifi_tid_schedule: enter aggr active (ac:%d/tid:%d)\n",
+		      itxq->ac, itxq->tid);
+		wifi_tid_schedule_aggr_active(hw, itxq);
+		break;
+	}
+
+	/* force resched if we have more packets in the retry queue
+	 * ready to be sent */
+	if (list_empty(&wifi_tid->retry_q))
+		txdbg("wifi_tid_schedule: => don't force resched\n");
+	else
+		txdbg("wifi_tid_schedule: => force resched\n");
+
+	ret = list_empty(&wifi_tid->retry_q) ? false : true;
+	if (wifi_sta)
+		spin_unlock(&wifi_sta->lock);
+	return ret;
+}
+
+/*
+ *
+ */
+static bool wifi_txq_has_enough_buffered_data(struct wifi_txq *wifi_txq)
+{
+	if (wifi_txq->count >= WIFI_TX_DESCS_WAKE)
+		return true;
+	if (wifi_txq->aggr_count >= WIFI_TX_MAX_AGGR)
+		return true;
+	if (wifi_txq->non_aggr_count >= WIFI_TX_MAX_NON_AGGR)
+		return true;
+	return false;
+}
+
+/*
+ * must be called with txq lock held
+ */
+static void wifi_txq_schedule(struct ieee80211_hw *hw,
+			      struct wifi_txq *wifi_txq)
+{
+	struct ieee80211_txq *itxq;
+
+	WARN_ON(!in_atomic());
+	txdbg("wifi_txq_schedule: txq:%ps ac:%d\n",
+	       wifi_txq, wifi_txq->ac);
+
+	/* don't push too much data */
+	if (wifi_txq_has_enough_buffered_data(wifi_txq)) {
+		txdbg("wifi_txq_schedule: enough data\n");
+		return;
+	}
+
+	/* iterate over STA/TID to schedule */
+	ieee80211_txq_schedule_start(hw, wifi_txq->ac);
+
+	rcu_read_lock();
+	while ((itxq = ieee80211_next_txq(hw, wifi_txq->ac))) {
+		bool force_resched = wifi_tid_schedule(hw, itxq);
+		ieee80211_return_txq(hw, itxq, force_resched);
+
+		/* if txq is "full", we can stop scheduling here */
+		if (wifi_txq_has_enough_buffered_data(wifi_txq))
+			break;
+	}
+	rcu_read_unlock();
+	ieee80211_txq_schedule_end(hw, wifi_txq->ac);
+	txdbg("wifi_txq_schedule: schedule end\n");
+}
+
+/*
+ * note: hardware only fills tx status for the last descriptor, which
+ * is the one passed
+ */
+static void tx_done_process_aggr_chain(struct wifi_priv *wp,
+				       struct list_head *chain,
+				       const struct wifi_txd *txdesc,
+				       struct ieee80211_sta *sta,
+				       struct wifi_tid *wifi_tid)
+{
+	struct list_head retry_chain, report_chain;
+	struct wifi_tx_skb *wskb, *wtmp, *wskb_first, *wskb_report;
+	struct wifi_sta *wifi_sta;
+	bool wskb_report_txok;
+	struct ieee80211_tx_info static_info;
+	struct ieee80211_tx_status tx_status;
+	u32 desc_status;
+	bool ba_received, filtered;
+	size_t i, count, count_bad, tries_done;
+	u8 bitmap[8];
+	u16 ssn;
+
+	if (sta)
+		wifi_sta = WIFI_STA(sta);
+
+	if (wifi_tid)
+		WARN_ON(wifi_tid->type != WIFI_TID_STA_QOS_DATA);
+
+	/*
+	 * For aggregated frames and rate control update, reporting tx
+	 * status to mac80211 is not done on a frame-by-frame
+	 * basis. Instead, a single report is done with a field
+	 * containing the total number of frames that were aggregated,
+	 * and the total number of frames from this aggregate that
+	 * were acknowledged. Other frames transmitted in this mpdu
+	 * must still be reported, but without the AMPDU_STAT flags.
+	 *
+	 * All unacknowledged frames will be software retried (unless
+	 * they reach a maximum retry count), we build a chain of
+	 * those
+	 */
+	wskb_first = list_first_entry(chain, struct wifi_tx_skb, next);
+	txdbg("process_aggr_chain_done "
+	       "wifi_tid:%ps wskb_first:%ps first_seq:%u\n",
+	       wifi_tid, wskb_first, wskb_first->seq_no);
+	desc_status = le32_to_cpu(txdesc->status);
+	ba_received = !!(desc_status & TXD_F_TX_SUCCESS);
+	filtered = !!(desc_status & TXD_F_TX_PS_FILTERED);
+
+	if (ba_received) {
+		memcpy(bitmap, txdesc->ba.bitmap, sizeof (bitmap));
+		ssn = le16_to_cpu(txdesc->ba.start_seq);
+	}
+
+	/*
+	 * RANDOM DROP for testing
+	 */
+#if RND_DROP_PPK > 0
+	{
+		static unsigned int total = 1000 / RND_DROP_PPK;
+		size_t to_drop = 0, skip;
+
+		count = 0;
+		list_for_each_entry(wskb, chain, next)
+			count++;
+
+		if (!total--) {
+			total = 1000 / RND_DROP_PPK;
+			to_drop = count / 3;
+		}
+
+		skip = 2;
+		list_for_each_entry(wskb, chain, next) {
+			if (ba_received) {
+				unsigned int ba_index;
+				ba_index = D11_BA_INDEX(ssn, wskb->seq_no);
+				if (ba_index < D11_BA_BMP_SIZE &&
+				    D11_BA_ISSET(bitmap, ba_index)) {
+					if (!to_drop)
+						continue;
+
+					if (skip--)
+						continue;
+
+					bitmap[ba_index / 8] &= ~(1 << (ba_index % 8));
+					to_drop--;
+					printk("rnd drop seq:%d\n", wskb->seq_no);
+					skip = 2;
+				}
+			}
+		}
+	}
+#endif
+
+	INIT_LIST_HEAD(&retry_chain);
+	INIT_LIST_HEAD(&report_chain);
+	wskb_report = NULL;
+	count_bad = count = 0;
+
+	list_for_each_entry_safe(wskb, wtmp, chain, next) {
+		struct ieee80211_tx_info *info;
+		unsigned int ba_index;
+		bool acked;
+
+		acked = false;
+		if (ba_received) {
+			/* compute the bitmap index for this frame
+			 * sequence number according to the sequence
+			 * start of the bitmap */
+			ba_index = D11_BA_INDEX(ssn, wskb->seq_no);
+			if (ba_index < D11_BA_BMP_SIZE &&
+			    D11_BA_ISSET(bitmap, ba_index))
+				acked = true;
+		}
+
+		if (wifi_tid &&
+		    (filtered ||
+		     (!acked && wifi_sta->ps_state != WIFI_PS_AWAKE))) {
+			/* filtered frames, or frame that failed while
+			 * sta was asleep are requeued for software
+			 * retransmit */
+			wskb->sw_tries_done--;
+			txdbg("process_ampdu_mpdu_done: filtered, "
+			      "will requeue\n");
+			list_add_tail(&wskb->next, &retry_chain);
+			continue;
+		}
+
+		/* actual tx was attempted for this frame */
+		count++;
+
+		if (!wifi_tid) {
+			/* STA went away */
+			info = IEEE80211_SKB_CB(wskb->skb);
+			ieee80211_tx_info_clear_status(info);
+			list_add_tail(&wskb->next, &report_chain);
+			continue;
+		}
+
+		txdbg("process_aggr_chain_done: "
+		       "wskb:%ps seq:%u ba_received:%d ba_ssn:%u acked:%u\n",
+		       wskb, wskb->seq_no, ba_received, ssn, acked);
+
+		if (acked) {
+			wifi_tid_baw_update(wifi_tid, wskb, true);
+
+			if (!wskb_report) {
+				/* use this skb for mac80211 report */
+				wskb_report = wskb;
+				wskb_report_txok = true;
+				continue;
+			}
+
+			/* we don't need this frame anymore, update tx
+			 * info to reflect transmit success */
+			info = IEEE80211_SKB_CB(wskb->skb);
+			ieee80211_tx_info_clear_status(info);
+			info->flags |= IEEE80211_TX_STAT_ACK;
+			list_add_tail(&wskb->next, &report_chain);
+			continue;
+		}
+
+		/* !acked */
+		count_bad++;
+
+		/* are we going to retry this frame ? */
+		if (wskb->sw_tries_done < WIFI_MAX_SW_TRIES) {
+			txdbg("process_aggr_chain_done: "
+			      "will retry wskb:%ps seq:%u (try %u / %u)\n",
+			      wskb,
+			      wskb->seq_no,
+			      wskb->sw_tries_done, WIFI_MAX_SW_TRIES);
+			list_add_tail(&wskb->next, &retry_chain);
+			continue;
+		}
+
+		wifi_tid_baw_update(wifi_tid, wskb, false);
+		txdbg("process_aggr_chain_done: "
+		       "too many retries for wskb:%ps seq:%u\n",
+		       wskb, wskb->seq_no);
+
+		/* we don't need this frame anymore, update tx info to
+		 * reflect transmit failure */
+		if (!wskb_report) {
+			/* use this skb for mac80211 report */
+			wskb_report = wskb;
+			wskb_report_txok = false;
+			continue;
+		}
+
+		info = IEEE80211_SKB_CB(wskb->skb);
+		ieee80211_tx_info_clear_status(info);
+		list_add_tail(&wskb->next, &report_chain);
+	}
+
+	/*
+	 * any frames to retry goes into the retry chain, if those
+	 * frames have no associated tid (STA removed), just release
+	 * them
+	 */
+	if (wifi_tid) {
+		wifi_tid_requeue_chain(wifi_tid, &retry_chain, ~0);
+
+		/* if we got at least one positive ACK, we may retry
+		 * to send BAR */
+		if (count && count != count_bad)
+			wifi_tid_baw_bar_may_retry(wifi_tid);
+
+		/*
+		 * since we are may be pushing back frames in retry
+		 * queue, make sure itxq is scheduled
+		 *
+		 * also, some aggr state management and BAR flush
+		 * decision is done as schedule time, so we always
+		 * reschedule tid
+		 */
+		if (wifi_sta->ps_state == WIFI_PS_AWAKE)
+			ieee80211_schedule_txq(wp->hw, TID2ITXQ(wifi_tid));
+	} else
+		list_splice_tail(&retry_chain, &report_chain);
+
+	/*
+	 * if no transmit was even attempted (everything filtered),
+	 * stop here
+	 */
+	if (!count)
+		return;
+
+	/*
+	 * report status to mac80211 of the AMPDU, either with or
+	 * without an associated skb so that rate table is always
+	 * updated
+	 */
+	tx_status.sta = sta;
+	tx_status.rate = NULL;
+
+	txdbg("process_aggr_chain_done: wskb_report:%ps\n",
+	       wskb_report);
+	if (wskb_report) {
+		struct ieee80211_tx_info *info_report;
+
+		info_report = IEEE80211_SKB_CB(wskb_report->skb);
+
+		/* whatever AMPDU we choose to report was transmitted
+		 * using rate from the *first* MPDU of the chain, make
+		 * sure to report the correct one */
+		if (wskb_report != wskb_first) {
+			struct ieee80211_tx_info *info_first;
+
+			info_first = IEEE80211_SKB_CB(wskb_report->skb);
+			memcpy(info_report->status.rates,
+			       info_first->status.rates,
+			       sizeof (info_report->status.rates));
+		}
+
+		tx_status.info = info_report;
+		tx_status.skb = wskb_report->skb;
+	} else {
+		tx_status.skb = NULL;
+		tx_status.info = &static_info;
+		memcpy(&static_info,
+		       IEEE80211_SKB_CB(wskb_first->skb),
+		       sizeof (static_info));
+	}
+
+	/* update rate table, hardware only did 1 try, update rate
+	 * table to reflect this */
+	ieee80211_tx_info_clear_status(tx_status.info);
+	tries_done = 1;
+
+	for (i = 0; i < WIFI_TXD_MAX_RATES; i++) {
+		struct ieee80211_tx_rate *r = &tx_status.info->status.rates[i];
+
+		if (r->idx == -1)
+			break;
+
+		if (tries_done) {
+			r->count = tries_done;
+			tries_done = 0;
+		} else
+			r->idx = -1;
+	}
+
+	txdbg("process_aggr_chain_done: will report rate:%u count:%zu ack_len:%zu\n",
+	       tx_status.info->status.rates[0].idx,
+	       count, count - count_bad);
+
+	tx_status.info->flags = IEEE80211_TX_STAT_AMPDU;
+	if (wskb_report_txok)
+		tx_status.info->flags |= IEEE80211_TX_STAT_ACK;
+	tx_status.info->status.ampdu_len = count;
+	tx_status.info->status.ampdu_ack_len = count - count_bad;
+
+	if (wskb_report) {
+		/* note: this consumes the skb if any */
+		ieee80211_tx_status_ext(wp->hw, &tx_status);
+		wifi_tx_skb_release_keep_skb(wp, wskb_report);
+	} else if (sta) {
+		/* we only want to update rate control here with the
+		 * failed try, don't use ieee80211_tx_status_ext()
+		 * otherwise it will consider it a failed frame */
+		ieee80211_tx_rate_update(wp->hw, sta, tx_status.info);
+	}
+
+	/* now report all other frames to mac80211 as usual, rate
+	 * control will ignore them since they don't have the
+	 * TX_STAT_AMPDU flag */
+	list_for_each_entry_safe(wskb, wtmp, &report_chain, next) {
+		tx_status.sta = sta;
+		tx_status.rate = NULL;
+		tx_status.info = IEEE80211_SKB_CB(wskb->skb);
+		tx_status.skb = wskb->skb;
+
+		txdbg("process_aggr_chain_done: tx complete rem wskb:%p\n",
+			wskb);
+
+		ieee80211_tx_status_ext(wp->hw, &tx_status);
+		wifi_tx_skb_release_keep_skb(wp, wskb);
+	}
+
+	txdbg("process_aggr_chain_done out\n");
+}
+
+/*
+ *
+ */
+static void tx_done_process_single_mpdu(struct wifi_priv *wp,
+					struct wifi_tx_skb *wskb,
+					const struct wifi_txd *txdesc,
+					struct ieee80211_sta *sta,
+					struct wifi_tid *wifi_tid)
+{
+	struct ieee80211_tx_info *info;
+	struct ieee80211_tx_status tx_status;
+	u8 rcounts[IEEE80211_TX_MAX_RATES], tries_done;
+	u32 desc_status;
+	bool txok, filtered, ps_resp;
+	size_t i;
+
+	txdbg("process_single_mpdu_done: wskb:%pS has_tid:%d tid:%d type:%d seqno:%u\n",
+	      wskb, wskb->has_tid, wskb->tid, wskb->type, wskb->seq_no);
+
+	desc_status = le32_to_cpu(txdesc->status);
+	info = IEEE80211_SKB_CB(wskb->skb);
+
+	/* prepare tx status reporting */
+	tx_status.skb = wskb->skb;
+	tx_status.info = info;
+	tx_status.sta = sta;
+	tx_status.rate = NULL;
+
+	txok = !!(desc_status & TXD_F_TX_SUCCESS);
+	filtered = !!(desc_status & TXD_F_TX_PS_FILTERED);
+	ps_resp = (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER);
+
+	if (!sta || !wifi_tid) {
+		txdbg("process_single_mpdu_done: no STA/TID found\n");
+		goto report;
+	}
+
+	txdbg("process_single_mpdu_done: STA found %pM, tid:%d\n",
+	      sta->addr, wskb->tid);
+
+	if (wskb->type == WIFI_TXSKB_QOS_DATA) {
+		struct wifi_sta *wifi_sta = WIFI_STA(sta);
+
+		WARN_ON(wifi_tid->type != WIFI_TID_STA_QOS_DATA);
+
+		/* filtered data frames and failed frames while STA is
+		 * in PS mode are requeued for software retransmit */
+		if (filtered ||
+		    (!txok && !ps_resp &&
+		     wifi_sta->ps_state != WIFI_PS_AWAKE)) {
+			wskb->sw_tries_done--;
+			txdbg("process_single_mpdu_done: filtered, "
+			      "will requeue\n");
+			wifi_tid_requeue(wifi_tid, wskb);
+			return;
+		}
+
+		wifi_tid_baw_update(wifi_tid, wskb, txok);
+
+		/* if we got at least one positive ACK, we may retry
+		 * to send BAR */
+		if (txok)
+			wifi_tid_baw_bar_may_retry(wifi_tid);
+
+		/*
+		 * since we are may be pushing back frames in retry
+		 * queue, make sure itxq is scheduled
+		 *
+		 * also, some aggr state management and BAR flush
+		 * decision is done as schedule time, so we always
+		 * reschedule tid
+		 */
+		if (wifi_sta->ps_state == WIFI_PS_AWAKE)
+			ieee80211_schedule_txq(wp->hw, TID2ITXQ(wifi_tid));
+	}
+
+	/* continue trying to retransmit any pending BAR whatever aggr
+	 * state is */
+	if (wskb->type == WIFI_TXSKB_BAR) {
+		struct wifi_tid *bar_tid;
+
+		/* lookup bar tid, STA is the same, but tid is not */
+		bar_tid = WIFI_TID(sta->txq[wskb->bar_tid]);
+		WARN_ON(bar_tid->type != WIFI_TID_STA_QOS_DATA);
+
+		wifi_tid_baw_bar_handle_txdone(bar_tid, txok);
+
+		if (!txok) {
+			/* XXX: a bit of a kludge, don't report BAR tx
+			 * failure to mac80211 to avoid any BAR
+			 * retransmit coming from the stack */
+			wifi_tx_skb_release_txfail(wp, wskb);
+			return;
+		}
+	}
+
+report:
+	/* keep a copy of rate counts before calling clear_status(),
+	 * the hardware reports a total number of tries, so we need to
+	 * know the original try count per rate */
+	for (i = 0; i < ARRAY_SIZE(info->control.rates); i++) {
+		const struct ieee80211_tx_rate *r = &info->control.rates[i];
+		rcounts[i] = r->count;
+	}
+
+	ieee80211_tx_info_clear_status(info);
+
+	if (txok) {
+		if (info->flags & IEEE80211_TX_CTL_NO_ACK)
+			info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
+		else
+			info->flags |= IEEE80211_TX_STAT_ACK;
+	}
+
+	if (filtered)
+		info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
+
+	tries_done = txdesc->tries_done;
+	for (i = 0; i < WIFI_TXD_MAX_RATES; i++) {
+		struct ieee80211_tx_rate *r;
+		unsigned int todo;
+
+		r = &info->control.rates[i];
+		if (r->idx == -1)
+			break;
+
+		todo = rcounts[i];
+		if (!tries_done) {
+			r->idx = -1;
+
+		} else if (tries_done > todo) {
+			tries_done -= todo;
+			r->count = todo;
+		} else {
+			r->count = tries_done;
+			tries_done = 0;
+		}
+	}
+
+#ifdef TX_DBG_PRINT
+	for (i = 0; i < 4; i++) {
+		struct ieee80211_tx_rate *r = &info->status.rates[i];
+		txdbg("process_single_mpdu_done: rate:%u tried %u times\n",
+		       r->idx, r->count);
+	}
+#endif
+
+	/* NOTE: this will consumes skb */
+	ieee80211_tx_status_ext(wp->hw, &tx_status);
+	wifi_tx_skb_release_keep_skb(wp, wskb);
+}
+
+/*
+ *
+ */
+static int wifi_process_tx_done(struct wifi_priv *wp, unsigned int qid)
+{
+	struct wifi_txq *txq;
+	u32 reclaim_off;
+	bool need_wake;
+	struct ieee80211_sta *sta;
+
+	txdbg("===== wifi_process_tx_done\n");
+
+	txq = &wp->txqs[qid];
+	spin_lock(&txq->lock);
+
+	need_wake = false;
+
+	reclaim_off = txq->reclaim_off;
+	if (txq->count == WIFI_TX_DESCS) {
+		need_wake = true;
+		/* WARN_ON(!ieee80211_queue_stopped(wp->hw, txq->idx)); */
+	}
+
+	sta = NULL;
+	while (txq->count) {
+		struct wifi_tx_skb *wskb;
+		struct wifi_txd *txdesc;
+		struct wifi_tid *wifi_tid;
+		struct wifi_sta *wifi_sta;
+		const struct ieee80211_hdr *d11;
+		bool report;
+
+		rmb();
+
+		txdesc = &txq->descs[reclaim_off];
+		if (le32_to_cpu(txdesc->status) & TXD_F_FW_OWNED)
+			break;
+
+		/* printk("tx done: desc:%p status:%08x buf:%08x\n", */
+		/*        txdesc, txdesc->status, txdesc->buf_addr); */
+		wskb = txq->pending_wskb[reclaim_off];
+		txq->pending_wskb[reclaim_off] = NULL;
+		txdbg("wifi_process_tx_done: tx done on "
+		      "wskb:%ps has_tid:%d tid:%d type:%d seq:%u\n",
+		      wskb, wskb->has_tid, wskb->tid, wskb->type, wskb->seq_no);
+
+		reclaim_off++;
+		if (reclaim_off >= WIFI_TX_DESCS)
+			reclaim_off = 0;
+
+		txq->reclaim_off = reclaim_off;
+		txq->count--;
+
+		/*
+		 * lookup STA & TID, rcu lock is held by caller, since
+		 * all AMPDU members have the same STA, optimize to do
+		 * a single lookup
+		 */
+		if (!wskb->has_tid) {
+			sta = NULL;
+		} else if (!sta) {
+			d11 = (const struct ieee80211_hdr *)wskb->skb->data;
+			sta = ieee80211_find_sta_by_ifaddr(wp->hw,
+							   d11->addr1,
+							   d11->addr2);
+		}
+
+		wifi_tid = NULL;
+		wifi_sta = NULL;
+		if (sta && wskb->has_tid) {
+			wifi_sta = WIFI_STA(sta);
+			if (wifi_sta->magic != WIFI_STA_MAGIC ||
+			    wifi_sta->version != wskb->sta_version)
+				wifi_sta = NULL;
+			else {
+				spin_lock(&wifi_sta->lock);
+				if (wifi_sta->dead) {
+					spin_unlock(&wifi_sta->lock);
+					wifi_sta = NULL;
+				} else
+					wifi_tid = WIFI_TID(sta->txq[wskb->tid]);
+			}
+		}
+
+		txdbg("wifi_process_tx_done:  sta:%pM tid:%pS\n",
+		      sta ? sta->addr : NULL, wifi_tid);
+
+		/*
+		 * we will only report single mpdu or last mpdu of
+		 * aggreagate
+		 */
+		report = !wskb->aggr_member || !list_empty(&wskb->aggr_list);
+
+		if (report) {
+			if (!wskb->aggr_member) {
+				tx_done_process_single_mpdu(wp, wskb, txdesc,
+							    sta, wifi_tid);
+				txq->non_aggr_count--;
+			} else {
+				tx_done_process_aggr_chain(wp,
+							   &wskb->aggr_list,
+							   txdesc,
+							   sta, wifi_tid);
+				txq->aggr_count--;
+			}
+		}
+
+		/*
+		 * tx pending accounting for this tid
+		 */
+		if (wifi_sta) {
+			wifi_sta->tx_pending--;
+
+			/* printk("tx pending minus alt now %d\n", */
+			/*        wifi_sta->tx_pending); */
+			if (!wifi_sta->tx_pending &&
+			    wifi_sta->ps_state == WIFI_PS_ENTER_SLEEP) {
+				txdbg("tx pending alt %d reached 0\n",
+				      wifi_sta->tx_pending);
+				wifi_sta_ps_transition(wp->hw, sta,
+						       WIFI_PS_ACTION_TXDONE);
+			}
+
+			txdbg("wifi_process_tx_done: sta %pM "
+			      "tx pending now %d\n",
+			      sta->addr,
+			      wifi_sta->tx_pending);
+
+			spin_unlock(&wifi_sta->lock);
+		}
+
+		/* lookup STA again next loop if frame was single mpdu
+		 * or last ampdu member */
+		if (report)
+			sta = NULL;
+	}
+
+	if (txq->count != WIFI_TX_DESCS && need_wake) {
+		/* printk("tx_status: ieee80211_awake %d\n", txq->idx); */
+		ieee80211_wake_queue(wp->hw, txq->idx);
+	}
+
+	if (txq->count < WIFI_TX_DESCS_WAKE)
+		wifi_txq_schedule(wp->hw, txq);
+
+	spin_unlock(&txq->lock);
+	return 0;
+}
+
+/*
+ * @tx: Handler that 802.11 module calls for each transmitted frame.
+ *	skb contains the buffer starting from the IEEE 802.11 header.
+ *	The low-level driver should send the frame out based on
+ *	configuration in the TX control data. This handler should,
+ *	preferably, never fail and stop queues appropriately.
+ *	Must be atomic.
+ *
+ */
+static void wifi_ops_tx(struct ieee80211_hw *hw,
+			struct ieee80211_tx_control *control,
+			struct sk_buff *skb)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct wifi_txq *wifi_txq;
+	const struct ieee80211_hdr *hdr;
+	struct ieee80211_tx_info *tx_info;
+	struct ieee80211_vif *vif;
+	struct wifi_tx_skb *wskb;
+	struct wifi_sta *wifi_sta;
+	struct list_head chain;
+	bool bypass_ps;
+	int tid;
+
+	WARN_ON(!in_atomic());
+
+	tx_info = IEEE80211_SKB_CB(skb);
+	/* keep VIF before we overwrite it */
+	vif = tx_info->control.vif;
+
+	if (WARN_ON(tx_info->hw_queue >= wp->txq_count))
+		return;
+
+	/* sanity check on space, should not happen since we stop que
+	 * queue when it becomes full */
+	wifi_txq = &wp->txqs[tx_info->hw_queue];
+	spin_lock(&wifi_txq->lock);
+
+	txdbg("===== wifi_ops_tx, queue:%d txq:%ps\n",
+	      tx_info->hw_queue, wifi_txq);
+
+	if (WARN_ON(wifi_txq->count == WIFI_TX_DESCS)) {
+		ieee80211_free_txskb(hw, skb);
+		spin_unlock(&wifi_txq->lock);
+		return;
+	}
+
+	/*
+	 * this is part is a bit kludgy, during powersave service
+	 * period (pspoll), mac80211 will send frames that it would
+	 * normally send through itxq via drv_tx(), thus we lose the
+	 * tid information.
+	 *
+	 * it's important to find back the correct tid to maintain the
+	 * proper tx_pending counter
+	 *
+	 * so we apply the same logic as ieee80211_get_txq() to find
+	 * which tid the frame would have been assigned
+	 */
+	tid = -1;
+	hdr = (const struct ieee80211_hdr *)skb->data;
+	if (ieee80211_is_ctl(hdr->frame_control)) {
+		WARN_ON(!ieee80211_is_back_req(hdr->frame_control));
+		tid = IEEE80211_NUM_TIDS;
+	} else if (!ieee80211_is_data_present(hdr->frame_control)) {
+		if ((!ieee80211_is_mgmt(hdr->frame_control) ||
+		     ieee80211_is_bufferable_mmpdu(hdr->frame_control) ||
+		     vif->type == NL80211_IFTYPE_STATION) &&
+		    control->sta) {
+			tid = IEEE80211_NUM_TIDS;
+		}
+	} else if (control->sta)
+		tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
+
+	wskb = wifi_tx_skb_wrap(wp, wifi_txq, skb, control->sta, tid);
+	if (!wskb) {
+		ieee80211_free_txskb(hw, skb);
+		spin_unlock(&wifi_txq->lock);
+		return;
+	}
+
+	bypass_ps = (tx_info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER);
+
+	/* data packet for an existing TID should be only sent from
+	 * drv_tx() during PS-poll, so retryq should be empty */
+	wifi_sta = NULL;
+	if (wskb->has_tid) {
+		txdbg("wifi_ops_tx is for existing TID %d (seq:%u)\n",
+		      wskb->tid, wskb->seq_no);
+
+		wifi_sta = WIFI_STA(control->sta);
+		spin_lock(&wifi_sta->lock);
+
+		if (!ieee80211_is_back_req(hdr->frame_control)) {
+			WARN_ON(!bypass_ps);
+			WARN_ON(wifi_sta->ps_state != WIFI_PS_SLEEP);
+		}
+
+		if (wskb->type == WIFI_TXSKB_QOS_DATA) {
+			struct wifi_tid *wifi_tid;
+
+			/* hopefully mac80211 won't bust the BAW
+			 * window, we are not announcing UAPSD
+			 * support, so it's only frame by frame with
+			 * PS-POLL */
+			wifi_tid = WIFI_TID(control->sta->txq[wskb->tid]);
+			WARN_ON(wifi_tid->ps_sleep_has_buf);
+			wifi_tid_baw_addto(wifi_tid, wskb);
+		}
+	}
+
+	wifi_tx_skb_fill_rates(wskb, vif, control->sta);
+	INIT_LIST_HEAD(&chain);
+	list_add(&wskb->next, &chain);
+
+	/* cannot fail since we checked for available size before */
+	WARN_ON(wifi_tx_send_chain(wp, &chain, 1, false,
+				   control->sta, bypass_ps));
+
+	if (wifi_txq->count == WIFI_TX_DESCS) {
+		/* printk("ops_tx: stop queu %d\n", wifi_txq->idx); */
+		ieee80211_stop_queue(hw, wifi_txq->idx);
+	}
+
+	if (wifi_sta)
+		spin_unlock(&wifi_sta->lock);
+
+	spin_unlock(&wifi_txq->lock);
+}
+
+/*
+ * @wake_tx_queue: Called when new packets have been added to the queue.
+ */
+static void wifi_ops_wake_tx_queue(struct ieee80211_hw *hw,
+				   struct ieee80211_txq *itxq)
+{
+	struct wifi_tid *wifi_tid = WIFI_TID(itxq);
+	struct wifi_txq *wifi_txq = wifi_tid->txq;
+
+	txdbg("===== wifi_ops_wake_tx_queue: vif:%pS sta:%pS\n",
+	       itxq->vif, itxq->sta);
+	WARN_ON(!in_atomic());
+
+	spin_lock(&wifi_txq->lock);
+	wifi_txq_schedule(hw, wifi_txq);
+	spin_unlock(&wifi_txq->lock);
+}
+
+/*
+ * @release_buffered_frames: Release buffered frames according to the given
+ *	parameters. In the case where the driver buffers some frames for
+ *	sleeping stations mac80211 will use this callback to tell the driver
+ *	to release some frames, either for PS-poll or uAPSD.
+ *	Note that if the @more_data parameter is %false the driver must check
+ *	if there are more frames on the given TIDs, and if there are more than
+ *	the frames being released then it must still set the more-data bit in
+ *	the frame. If the @more_data parameter is %true, then of course the
+ *	more-data bit must always be set.
+ *	The @tids parameter tells the driver which TIDs to release frames
+ *	from, for PS-poll it will always have only a single bit set.
+ *	In the case this is used for a PS-poll initiated release, the
+ *	@num_frames parameter will always be 1 so code can be shared. In
+ *	this case the driver must also set %IEEE80211_TX_STATUS_EOSP flag
+ *	on the TX status (and must report TX status) so that the PS-poll
+ *	period is properly ended. This is used to avoid sending multiple
+ *	responses for a retried PS-poll frame.
+ *	In the case this is used for uAPSD, the @num_frames parameter may be
+ *	bigger than one, but the driver may send fewer frames (it must send
+ *	at least one, however). In this case it is also responsible for
+ *	setting the EOSP flag in the QoS header of the frames. Also, when the
+ *	service period ends, the driver must set %IEEE80211_TX_STATUS_EOSP
+ *	on the last frame in the SP. Alternatively, it may call the function
+ *	ieee80211_sta_eosp() to inform mac80211 of the end of the SP.
+ *	This callback must be atomic.
+ */
+static void
+wifi_ops_release_buffered_frames(struct ieee80211_hw *hw,
+				 struct ieee80211_sta *sta,
+				 u16 tids, int num_frames,
+				 enum ieee80211_frame_release_type reason,
+				 bool more_data)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct wifi_sta *wifi_sta = WIFI_STA(sta);
+
+	WARN_ON(!in_atomic());
+	psdbg("wifi_ops_release_buffered_frames, sta:%pM tids:%x num_frame:%d\n",
+	      sta->addr, tids, num_frames);
+
+	/* we don't claim support for UAPSD so we will only get one
+	 * frame at a time */
+	WARN_ON(num_frames > 1 ||
+		reason != IEEE80211_FRAME_RELEASE_PSPOLL);
+
+	while (tids && num_frames) {
+		struct wifi_tid *wifi_tid;
+		struct ieee80211_txq *itxq;
+		u16 tidno = ffs(tids) - 1;
+
+		tids &= ~(1 << tidno);
+		wifi_tid = WIFI_TID(sta->txq[tidno]);
+		itxq = TID2ITXQ(wifi_tid);
+
+		spin_lock(&wifi_tid->txq->lock);
+		spin_lock(&wifi_sta->lock);
+		WARN_ON(wifi_sta->ps_state != WIFI_PS_SLEEP);
+
+		while (num_frames) {
+			struct wifi_tx_skb *wskb;
+			struct list_head chain;
+			struct ieee80211_tx_info *info;
+
+			switch (wifi_tid->type) {
+			case WIFI_TID_MCAST:
+			case WIFI_TID_STA_MMPDU:
+			case WIFI_TID_STA_DATA:
+				wskb = wifi_tid_dequeue_only_mac80211(wp,
+								      itxq);
+				break;
+			case WIFI_TID_STA_QOS_DATA:
+				wskb = wifi_tid_dequeue_within_baw_limit(wp,
+									 itxq);
+				break;
+			}
+
+			if (!wskb) {
+				/* we would not be called if there was
+				 * no frame to dequeue, but with codel
+				 * on txqueue it's actually possible
+				 * that packets sit in itxq for too
+				 * long and are dropped at dequeue
+				 * time, so we get called for
+				 * nothing
+				 *
+				 * this should be fixed to return an
+				 * error to the caller which could
+				 * then send a NULL frame
+				 */
+				break;
+			}
+
+			if (!more_data) {
+				/* this seems wrong because we don't
+				 * know if itxq became empty */
+				more_data = !list_empty(&wifi_tid->retry_q);
+			}
+
+			wifi_tx_skb_set_more_data(wp, wskb, more_data);
+
+			psdbg("wifi_ops_release_buffered_frames: "
+			      "wskb:%pS more_data:%d\n",
+			      wskb, more_data);
+
+			INIT_LIST_HEAD(&chain);
+			list_add(&wskb->next, &chain);
+
+			/* mark it so that tx complete path won't
+			 * retry it */
+			info = IEEE80211_SKB_CB(wskb->skb);
+			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
+			num_frames--;
+
+			/* mark it so that tx complete path will
+			 * report EOSP to mac80211 */
+			if (!num_frames)
+				info->flags |= IEEE80211_TX_STATUS_EOSP |
+					IEEE80211_TX_CTL_REQ_TX_STATUS;
+
+			WARN_ON(wifi_tx_send_chain(wp, &chain, 1, false,
+						   sta, true));
+		}
+
+		spin_unlock(&wifi_sta->lock);
+		spin_unlock(&wifi_tid->txq->lock);
+	}
+}
+
+/*
+ * @sta_notify: Notifies low level driver about power state transition of an
+ *	associated station, AP,  IBSS/WDS/mesh peer etc. For a VIF operating
+ *	in AP mode, this callback will not be called when the flag
+ *	%IEEE80211_HW_AP_LINK_PS is set. Must be atomic.
+ */
+static void wifi_ops_sta_notify(struct ieee80211_hw *hw,
+				struct ieee80211_vif *vif,
+				enum sta_notify_cmd cmd,
+				struct ieee80211_sta *sta)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct wifi_sta *wifi_sta = WIFI_STA(sta);
+	size_t tidno;
+
+	WARN_ON(!in_atomic());
+
+	if (wifi_sta->magic != WIFI_STA_MAGIC)
+		return;
+
+	psdbg("wifi_ops_sta_notify: sta->addr:%pM sleeping:%d\n",
+	      sta->addr, (cmd == STA_NOTIFY_SLEEP));
+
+	spin_lock(&wifi_sta->lock);
+	wifi_sta_ps_transition(hw, sta,
+			       (cmd == STA_NOTIFY_SLEEP) ?
+			       WIFI_PS_ACTION_SLEEP :
+			       WIFI_PS_ACTION_WAKEUP);
+	spin_unlock(&wifi_sta->lock);
+
+	/* when waking up, reschedule all txq used by this STA */
+	if (cmd == STA_NOTIFY_AWAKE) {
+		size_t qid, to_sched;
+
+		to_sched = 0;
+		for (tidno = 0; tidno < IEEE80211_NUM_TIDS + 1; tidno++) {
+			struct wifi_tid *wifi_tid = WIFI_TID(sta->txq[tidno]);
+			to_sched |= (1 << wifi_tid->txq->idx);
+		}
+
+		while (to_sched) {
+			struct wifi_txq *wifi_txq;
+
+			qid = ffs(to_sched) - 1;
+			to_sched &= ~(1 << qid);
+			wifi_txq = &wp->txqs[qid];
+
+			spin_lock(&wifi_txq->lock);
+			wifi_txq_schedule(wp->hw, wifi_txq);
+			spin_unlock(&wifi_txq->lock);
+		}
+	}
+}
+
+
+/*
+ *
+ */
+static void wifi_vif_update_beacon(struct ieee80211_hw *hw,
+				   struct ieee80211_vif *vif)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct wifi_vif *wifi_vif = WIFI_VIF(vif);
+	dma_addr_t dma;
+	struct sk_buff *skb;
+
+	skb = ieee80211_beacon_get(hw, vif);
+	if (!skb) {
+		wiphy_err(hw->wiphy, "failed to get beacon skb\n");
+		return;
+	}
+
+	dma = pci_map_single(wp->pdev, skb->data, skb->len,
+			     PCI_DMA_TODEVICE);
+	if (pci_dma_mapping_error(wp->pdev, dma)) {
+		wiphy_err(hw->wiphy,
+			  "failed to dma map beacon\n");
+		dev_kfree_skb(skb);
+		return;
+	}
+
+	cmd_vif_update_beacon_atomic(wp, wifi_vif->hw_id, dma, skb->len);
+	pci_unmap_single(wp->pdev, dma, skb->len, PCI_DMA_TODEVICE);
+	dev_kfree_skb(skb);
+}
+
+/*
+² *
+ */
+static void wifi_handle_tbtt(struct wifi_priv *wp, u32 tbtt_idx)
+{
+	struct ieee80211_vif *vif;
+	unsigned int dtim_count;
+	struct wifi_txq *cab_txq;
+	struct wifi_vif *wifi_vif;
+
+	if (WARN_ON(tbtt_idx >= ARRAY_SIZE(wp->vifs_by_tbtt_idx)))
+		return;
+
+	spin_lock(&wp->vifs_by_tbtt_lock);
+	vif = wp->vifs_by_tbtt_idx[tbtt_idx];
+	if (!vif) {
+		spin_unlock(&wp->vifs_by_tbtt_lock);
+		if (net_ratelimit())
+			dev_err(wp->dev, "tbtt interrupt on unknown vif %u",
+				tbtt_idx);
+		return;
+	}
+
+	/* get current DTIM count */
+	wifi_vif = WIFI_VIF(vif);
+	if (cmd_vif_get_dtim_count_atomic(wp, wifi_vif->hw_id, &dtim_count)) {
+		spin_unlock(&wp->vifs_by_tbtt_lock);
+		return;
+	}
+
+	/* resync with hardware, we get this interrupt early before
+	 * next TBTT, dtim count we read here will change at next TBTT
+	 * interrupt */
+	ieee80211_force_dtim(vif, dtim_count);
+
+	/* this will call get_beacon, which will decrement dtim
+	 * count */
+	wifi_vif_update_beacon(wp->hw, vif);
+
+	cab_txq = &wp->txqs[vif->cab_queue];
+	spin_lock(&cab_txq->lock);
+
+	/* FIXME: limit number of packet we push here */
+	while (cab_txq->count < WIFI_TX_DESCS) {
+		struct sk_buff *skb;
+		struct wifi_tx_skb *wskb;
+		struct list_head chain;
+
+		skb = ieee80211_get_buffered_bc(wp->hw, vif);
+		if (!skb)
+			break;
+
+		wskb = wifi_tx_skb_wrap(wp, cab_txq, skb, NULL, -1);
+		if (!wskb)
+			dev_kfree_skb(skb);
+
+		wifi_tx_skb_fill_rates(wskb, vif, NULL);
+		INIT_LIST_HEAD(&chain);
+		list_add(&wskb->next, &chain);
+
+		if (wifi_tx_send_chain(wp, &chain, 1, false, NULL, false))
+			wifi_tx_skb_release_txfail(wp, wskb);
+	}
+	spin_unlock(&cab_txq->lock);
+	spin_unlock(&wp->vifs_by_tbtt_lock);
+}
+
+/*
+ *
+ */
+static u32 wifi_process(void *data, u32 irq_status)
+{
+	struct wifi_priv *wp = (struct wifi_priv *)data;
+	u32 remain = 0;
+
+	/* check for async command completion */
+	if (irq_status & wp->cmd_chans[WIFI_CMD_CHAN_ASYNC].f2h_irq_mask)
+		cmd_chan_async_handle_irq(wp);
+
+	/* check for TBTT */
+	if (irq_status & wp->tbtt_f2h_irq_mask) {
+		u32 tbtt_mask;
+
+		tbtt_mask = (irq_status & wp->tbtt_f2h_irq_mask) >>
+			wp->tbtt_f2h_irq_shift;
+		while (tbtt_mask) {
+			u32 tbtt_idx = ffs(tbtt_mask) - 1;
+			wifi_handle_tbtt(wp, tbtt_idx);
+			tbtt_mask &= ~(1 << tbtt_idx);
+		}
+	}
+
+	/* check for rx */
+	if (irq_status & wp->rx_f2h_irq_mask) {
+		int done;
+
+		done = wifi_process_rx(wp, 128);
+		wifi_rxq_refill(wp, 128);
+		if (done >= 128)
+			remain |= wp->rx_f2h_irq_mask;
+	}
+
+	/* check for tx done */
+	if (irq_status & wp->tx_f2h_irq_mask) {
+		u32 queue_mask;
+
+		queue_mask = (irq_status & wp->tx_f2h_irq_mask)	>>
+			wp->tx_f2h_irq_shift;
+
+		/* tx completion will usually lookup STA which needs
+		 * to be done under RCU lock */
+		rcu_read_lock();
+		while (queue_mask) {
+			u32 qid = ffs(queue_mask) - 1;
+			wifi_process_tx_done(wp, qid);
+			queue_mask &= ~(1 << qid);
+		}
+		rcu_read_unlock();
+	}
+
+	return remain;
+}
+
+/**
+ * @get_stats: Return low-level statistics.
+ * 	Returns zero if statistics are available.
+ *	The callback can sleep.
+ */
+static int wifi_ops_get_stats(struct ieee80211_hw *hw,
+			      struct ieee80211_low_level_stats *stats)
+{
+	printk("ops get stats\n");
+
+	/* struct wifi_priv *wp = hw->priv; */
+	/* struct wifi_txq *wifi_txq; */
+	/* wifi_txq = &wp->txqs[0]; */
+
+	return 0;
+}
+
+/**
+ * @ampdu_action:
+ * Perform a certain A-MPDU action.
+ * The RA/TID combination determines the destination and TID we want
+ * the ampdu action to be performed for. The action is defined through
+ * ieee80211_ampdu_mlme_action.
+ * When the action is set to %IEEE80211_AMPDU_TX_OPERATIONAL the driver
+ * may neither send aggregates containing more subframes than @buf_size
+ * nor send aggregates in a way that lost frames would exceed the
+ * buffer size. If just limiting the aggregate size, this would be
+ * possible with a buf_size of 8:
+ *
+ * - ``TX: 1.....7``
+ * - ``RX:  2....7`` (lost frame #1)
+ * - ``TX:        8..1...``
+ *
+ * which is invalid since #1 was now re-transmitted well past the
+ * buffer size of 8. Correct ways to retransmit #1 would be:
+ *
+ * - ``TX:        1   or``
+ * - ``TX:        18  or``
+ * - ``TX:        81``
+ *
+ * Even ``189`` would be wrong since 1 could be lost again.
+ *
+ * Returns a negative error code on failure.
+ * The callback can sleep.
+ */
+static int
+wifi_ops_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+		      struct ieee80211_ampdu_params *params)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct ieee80211_sta *sta = params->sta;
+	struct wifi_sta *wifi_sta = WIFI_STA(sta);
+	int ret;
+
+	spin_lock_bh(&wifi_sta->lock);
+
+	switch (params->action) {
+	case IEEE80211_AMPDU_RX_START:
+		aggdbg("%pM ampdu action rx start called\n", sta->addr);
+		ret = 0;
+		break;
+
+	case IEEE80211_AMPDU_RX_STOP:
+		aggdbg("%pM ampdu action rx stop called\n", sta->addr);
+		ret = 0;
+		break;
+
+	case IEEE80211_AMPDU_TX_START:
+	{
+		struct wifi_tid *wifi_tid = WIFI_TID(sta->txq[params->tid]);
+
+		WARN_ON(wifi_tid->aggr_state != WIFI_AGGR_STOPPED);
+		wifi_tid->ampdu_max_bytes =
+			(1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
+			       sta->ht_cap.ampdu_factor)) - 1;
+		wifi_tid->ampdu_density = sta->ht_cap.ampdu_density;
+		wifi_tid->aggr_state = WIFI_AGGR_ACTIVE;
+		/* start with minimal BAW size, until it's updated
+		 * when going into operational */
+		wifi_tid->baw_max_size = 1;
+		wifi_tid->remote_baw_max_size = 1;
+		/* update BA SSN with current BAW sequence start */
+		params->ssn = wifi_tid->seq_start;
+		aggdbg("%pM ampdu action tx start called, "
+		       "tid:%u ssn:%u max:%u dens:%u\n",
+		       sta->addr,
+		       params->tid,
+		       params->ssn,
+		       wifi_tid->ampdu_max_bytes,
+		       wifi_tid->ampdu_density);
+		ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, params->tid);
+		break;
+	}
+
+	case IEEE80211_AMPDU_TX_OPERATIONAL:
+	{
+		struct wifi_tid *wifi_tid = WIFI_TID(sta->txq[params->tid]);
+
+		/* don't go larger than what both our hardware and
+		 * remote can support */
+		WARN_ON(params->buf_size < 1);
+		wifi_tid->remote_baw_max_size = params->buf_size;
+		wifi_tid->baw_max_size = min(wp->hw_max_ampdu_chain,
+					 (int)wifi_tid->remote_baw_max_size);
+
+		aggdbg("%pM ampdu action tx operational called, "
+		       "tid:%u baw_max_size:%u\n",
+		       sta->addr,
+		       params->tid,
+		       wifi_tid->baw_max_size);
+		break;
+	}
+
+	case IEEE80211_AMPDU_TX_STOP_CONT:
+	{
+		struct wifi_tid *wifi_tid = WIFI_TID(sta->txq[params->tid]);
+
+		aggdbg("%pM ampdu action tx stop called\n",
+		       sta->addr);
+
+		/*
+		 * note: we could stop aggregation from here instead
+		 * of letting it drain while
+		 */
+		if (!wifi_tid_baw_has_inflight_packets(wifi_tid)) {
+			wifi_tid->aggr_state = WIFI_AGGR_STOPPED;
+			ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr,
+							params->tid);
+			aggdbg("%pM stopped aggr!\n", sta->addr);
+		} else {
+			wifi_tid->aggr_state = WIFI_AGGR_STOPPING;
+			aggdbg("%pM mark aggr as stopping...\n",
+			       sta->addr);
+		}
+		break;
+	}
+
+	case IEEE80211_AMPDU_TX_STOP_FLUSH:
+	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+	{
+		struct wifi_tid *wifi_tid = WIFI_TID(sta->txq[params->tid]);
+
+		aggdbg("%pM ampdu action tx stop FLUSH called\n",
+		       sta->addr);
+
+		/* this is called before STA removal, but the STA/TID
+		 * is still be visible to tx done handler, which can
+		 * requeue packets to retry_q and reschedule the
+		 * TID, this flag prevents this */
+		wifi_sta->dead = true;
+		wifi_tid_drain(wp, wifi_tid);
+		wifi_tid->aggr_state = WIFI_AGGR_STOPPED;
+		break;
+	}
+
+	default:
+		/* should not be called */
+		break;
+	}
+
+	spin_unlock_bh(&wifi_sta->lock);
+	return ret;
+}
+
+/*
+ * @can_aggregate_in_amsdu: Called in order to determine if HW supports
+ *	aggregating two specific frames in the same A-MSDU. The relation
+ *	between the skbs should be symmetric and transitive. Note that while
+ *	skb is always a real frame, head may or may not be an A-MSDU.
+ */
+static bool wifi_ops_can_aggregate_in_amsdu(struct ieee80211_hw *hw,
+					    struct sk_buff *head,
+					    struct sk_buff *skb)
+{
+	/* should be ok to do this, but requires testing, rtw88 dev
+	 * says it does not bring anything in performance for 2.4G
+	 * band, and confuses some AP */
+	return false;
+}
+
+/*
+ * @sta_add: Notifies low level driver about addition of an associated
+ *     station, AP, IBSS/WDS/mesh peer etc. This callback can sleep.
+ */
+static int wifi_ops_set_key(struct ieee80211_hw *hw,
+			    enum set_key_cmd cmd_param,
+			    struct ieee80211_vif *vif,
+			    struct ieee80211_sta *sta,
+			    struct ieee80211_key_conf *key)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct wifi_vif *wifi_vif = WIFI_VIF(vif);
+	struct wifi_sta *wifi_sta;
+	int ret;
+	__le16 sta_hwid;
+
+	switch (key->cipher) {
+	case WLAN_CIPHER_SUITE_CCMP:
+		if (vif->type == NL80211_IFTYPE_MESH_POINT &&
+		    !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+			/* IBSS RSN group keys */
+			return -EOPNOTSUPP;
+		}
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	sta_hwid = WIFI_INVALID_STA_HWID;
+	if (sta) {
+		if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+			return -EOPNOTSUPP;
+		wifi_sta = WIFI_STA(sta);
+		sta_hwid = wifi_sta->hw_id;
+	}
+
+	switch (cmd_param) {
+	case SET_KEY:
+		ret = cmd_vif_add_key(wp,
+				      wifi_vif->hw_id,
+				      sta_hwid,
+				      key->keyidx,
+				      key->key,
+				      &key->hw_key_idx);
+		break;
+
+	case DISABLE_KEY:
+		ret = cmd_vif_del_key(wp,
+				      wifi_vif->hw_id,
+				      sta_hwid,
+				      key->hw_key_idx);
+		break;
+
+	default:
+		ret = -EOPNOTSUPP;
+		break;
+	}
+
+	return ret;
+}
+
+/*
+ * @sta_add: Notifies low level driver about addition of an associated
+ *     station, AP, IBSS/WDS/mesh peer etc. This callback can sleep.
+ */
+static int
+wifi_ops_sta_add(struct ieee80211_hw *hw,
+		 struct ieee80211_vif *vif,
+		 struct ieee80211_sta *sta)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct wifi_vif *wifi_vif = WIFI_VIF(vif);
+	struct wifi_sta *wifi_sta = WIFI_STA(sta);
+	size_t tidno;
+	int ret;
+
+	ret = cmd_vif_add_sta(wp, wifi_vif->hw_id,
+			      sta->addr, &wifi_sta->hw_id);
+	if (ret < 0)
+		return 0;
+
+	spin_lock_init(&wifi_sta->lock);
+	wifi_sta->version = ++wp->sta_next_version;
+	wifi_sta->tx_pending = 0;
+	wifi_sta->ps_state = WIFI_PS_AWAKE;
+
+	/* initialize all itxq private data */
+	for (tidno = 0; tidno < IEEE80211_NUM_TIDS + 1; tidno++) {
+		struct wifi_tid *wifi_tid = WIFI_TID(sta->txq[tidno]);
+		unsigned int acno = TID_TO_WME_AC(tidno);
+		unsigned int qid = vif->hw_queue[acno];
+		enum wifi_tid_type type;
+
+		if (tidno == IEEE80211_NUM_TIDS)
+			type = WIFI_TID_STA_MMPDU;
+		else if (sta->wme)
+			type = WIFI_TID_STA_QOS_DATA;
+		else
+			type = WIFI_TID_STA_DATA;
+
+		wifi_tid_init(wifi_tid, &wp->txqs[qid], type);
+	}
+
+	wmb();
+	wifi_sta->magic = WIFI_STA_MAGIC;
+
+	return 0;
+}
+
+/*
+ * @sta_remove: Notifies low level driver about removal of an associated
+ *	station, AP, IBSS/WDS/mesh peer etc. Note that after the callback
+ *	returns it isn't safe to use the pointer, not even RCU protected;
+ *	no RCU grace period is guaranteed between returning here and freeing
+ *	the station. See @sta_pre_rcu_remove if needed.
+ *	This callback can sleep.
+ */
+static int wifi_ops_sta_remove(struct ieee80211_hw *hw,
+			       struct ieee80211_vif *vif,
+			       struct ieee80211_sta *sta)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct wifi_vif *wifi_vif = WIFI_VIF(vif);
+	struct wifi_sta *wifi_sta = WIFI_STA(sta);
+	size_t tidno;
+	int ret;
+
+	for (tidno = 0; tidno < IEEE80211_NUM_TIDS + 1; tidno++) {
+		struct wifi_tid *wifi_tid = WIFI_TID(sta->txq[tidno]);
+		wifi_tid_release(wp, wifi_tid);
+	}
+
+	ret = cmd_vif_del_sta(wp, wifi_vif->hw_id,
+			      wifi_sta->hw_id);
+	if (ret < 0)
+		return 0;
+
+	return 0;
+}
+
+
+/*
+ * @bss_info_changed: Handler for configuration requests related to BSS
+ *	parameters that may vary during BSS's lifespan, and may affect low
+ *	level driver (e.g. assoc/disassoc status, erp parameters).
+ *	This function should not be used if no BSS has been set, unless
+ *	for association indication. The @changed parameter indicates which
+ *	of the bss parameters has changed when a call is made. The callback
+ *	can sleep.
+ */
+static void
+wifi_ops_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+			  struct ieee80211_bss_conf *info, u32 changed)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct wifi_vif *wifi_vif = WIFI_VIF(vif);
+
+	/* printk("wifi_ops_bss_info_changed: changed:0x%08x\n", changed); */
+	if (changed & BSS_CHANGED_ERP_CTS_PROT) {
+		/* nothing to do, rate control will flag packets with
+		 * RTS/CTS as needed */
+	}
+
+	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+		/* nothing to do, rate control will flag packets with
+		 * short/long preamble as needed */
+	}
+
+	if (changed & BSS_CHANGED_ERP_SLOT)
+		cmd_vif_set_short_slot(wp, wifi_vif->hw_id,
+				       info->use_short_slot);
+
+	if (changed & BSS_CHANGED_BSSID)
+		cmd_vif_set_bss_params(wp, wifi_vif->hw_id, info->bssid);
+
+	if (changed & BSS_CHANGED_BEACON_ENABLED) {
+		if (info->enable_beacon) {
+			struct ieee80211_rate *bcn_rate;
+			struct sk_buff *skb;
+			struct ieee80211_tx_info *tx_info;
+
+			skb = ieee80211_beacon_get_template(hw, vif, NULL);
+			if (!skb)
+				return;
+
+			tx_info = IEEE80211_SKB_CB(skb);
+			bcn_rate = ieee80211_get_tx_rate(hw, tx_info);
+			cmd_vif_set_beacon_params(wp, wifi_vif->hw_id,
+						  bcn_rate->hw_value,
+						  info->beacon_int,
+						  info->dtim_period);
+			dev_kfree_skb(skb);
+		}
+
+		cmd_vif_enable_beacon(wp, wifi_vif->hw_id,
+				      info->enable_beacon);
+	}
+
+	if (changed & BSS_CHANGED_HT) {
+	}
+}
+
+/*
+ * compute number of bytes for a frames of usecs duration at given
+ * rate
+ */
+static int usec_to_framelen(int usecs, int mcs, bool ht40, bool sgi)
+{
+	int streams = (mcs / 8) + 1;
+	int symbols, bits;
+	int bytes = 0;
+
+	usecs -= L_STF + L_LTF + L_SIG + HT_SIG + HT_STF + HT_LTF(streams);
+	symbols = sgi ? TIME_SYMBOLS_HALFGI(usecs) : TIME_SYMBOLS(usecs);
+	bits = symbols * bits_per_symbol[mcs % 8][ht40] * streams;
+	bits -= OFDM_PLCP_BITS;
+	bytes = bits / 8;
+
+	/* if (mcs == 15) */
+	/* 	printk("mcs:%d ht40:%u sgi:%u => %u usecs == %u bytes\n", */
+	/* 	       mcs, ht40, sgi, usecs, bytes); */
+	if (bytes > 65532)
+		bytes = 65532;
+
+	return bytes;
+}
+
+/**
+ * @conf_tx: Configure TX queue parameters (EDCF (aifs, cw_min, cw_max),
+ *	bursting) for a hardware TX queue.
+ *	Returns a negative error code on failure.
+ *	The callback can sleep.
+ */
+static int wifi_ops_conf_tx(struct ieee80211_hw *hw,
+			    struct ieee80211_vif *vif, u16 ac,
+			    const struct ieee80211_tx_queue_params *params)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct wifi_vif *wifi_vif = WIFI_VIF(vif);
+	struct wifi_txq *wifi_txq;
+	u16 *cur_ht20, *cur_ht20_sgi, *cur_ht40, *cur_ht40_sgi;
+	int mcs;
+	u32 txop;
+
+	/* printk("conf tx called, ac:%d cw:%d/%d aifsn:%d txop:%d\n", */
+	/*        ac, */
+	/*        params->cw_min, */
+	/*        params->cw_max, */
+	/*        params->aifs, */
+	/*        params->txop); */
+
+	if (cmd_vif_set_edca_params(wp,
+				    wifi_vif->hw_id,
+				    vif->hw_queue[ac],
+				    params->cw_min,
+				    params->cw_max,
+				    params->aifs,
+				    params->txop))
+		return 1;
+
+	/* compute aggregate max len for this queue */
+	wifi_txq = &wp->txqs[vif->hw_queue[ac]];
+
+	/* 4ms is the default (and maximum) duration */
+	txop = params->txop;
+	if (!txop || txop > 4096)
+		txop = 4096;
+
+	cur_ht20 = wifi_txq->max_aggr_framelen[0][0];
+	cur_ht20_sgi = wifi_txq->max_aggr_framelen[0][1];
+	cur_ht40 = wifi_txq->max_aggr_framelen[1][0];
+	cur_ht40_sgi = wifi_txq->max_aggr_framelen[1][1];
+
+	for (mcs = 0; mcs < 32; mcs++) {
+		cur_ht20[mcs] = usec_to_framelen(txop, mcs, false, false);
+		cur_ht20_sgi[mcs] = usec_to_framelen(txop, mcs, false, true);
+		cur_ht40[mcs] = usec_to_framelen(txop, mcs, true, false);
+		cur_ht40_sgi[mcs] = usec_to_framelen(txop, mcs, true, true);
+	}
+
+	return 0;
+}
+
+
+/*
+ * @add_interface: Called when a netdevice attached to the hardware is
+ *	enabled. Because it is not called for monitor mode devices, @start
+ *	and @stop must be implemented.
+ *	The driver should perform any initialization it needs before
+ *	the device can be enabled. The initial configuration for the
+ *	interface is given in the conf parameter.
+ *	The callback may refuse to add an interface by returning a
+ *	negative error code (which will be seen in userspace.)
+ *	Must be implemented and can sleep.
+ */
+static int wifi_ops_add_interface(struct ieee80211_hw *hw,
+				  struct ieee80211_vif *vif)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct wifi_vif *wifi_vif = WIFI_VIF(vif);
+	struct wifi_tid *wifi_tid_mc = WIFI_TID(vif->txq);
+	enum wifi_vif_type vif_type;
+	unsigned int ac_mapping[IEEE80211_NUM_ACS], cab_qid;
+	size_t i;
+	int ret;
+
+	/* printk("wifi_ops_add_interface\n"); */
+
+	switch (vif->type) {
+	case NL80211_IFTYPE_STATION:
+		vif_type = WIFI_VIF_TYPE_STA;
+		break;
+	case NL80211_IFTYPE_AP:
+	case NL80211_IFTYPE_MESH_POINT:
+		vif_type = WIFI_VIF_TYPE_AP;
+		break;
+	default:
+		return -ENOTSUPP;
+	}
+
+	ret = cmd_add_vif(wp, vif_type, vif->addr,
+			  &wifi_vif->hw_id,
+			  &wifi_vif->tbtt_idx,
+			  ac_mapping, &cab_qid);
+	if (ret)
+		return ret;
+
+	if (wifi_vif->tbtt_idx != WIFI_INVALID_TBTT_IDX) {
+		if (wifi_vif->tbtt_idx >= ARRAY_SIZE(wp->vifs_by_tbtt_idx) ||
+		    wp->vifs_by_tbtt_idx[wifi_vif->tbtt_idx]) {
+			dev_err(wp->dev, "invalid VIF tbtt idx %x\n",
+				wifi_vif->tbtt_idx);
+			cmd_release_vif(wp, wifi_vif->hw_id);
+			return -EIO;
+		}
+	}
+
+	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+		vif->hw_queue[i] = ac_mapping[i];
+		/* FIXME: mac80211 limitation here */
+		wp->txqs[vif->hw_queue[i]].ac = i;
+		BUG_ON(vif->hw_queue[i] >= wp->txq_count);
+	}
+	vif->cab_queue = cab_qid;
+
+	ret = cmd_vif_start(wp, wifi_vif->hw_id);
+	if (ret) {
+		cmd_release_vif(wp, wifi_vif->hw_id);
+		return ret;
+	}
+
+	/* init the itxq used to send multicast, we will mix mcast
+	 * with BE traffic, cabq will be used instead when at least
+	 * one STA is in powersave */
+	wifi_tid_init(wifi_tid_mc,
+		      &wp->txqs[ac_mapping[IEEE80211_AC_BE]],
+		      WIFI_TID_MCAST);
+
+	if (wifi_vif->tbtt_idx != WIFI_INVALID_TBTT_IDX) {
+		spin_lock_bh(&wp->vifs_by_tbtt_lock);
+		wp->vifs_by_tbtt_idx[wifi_vif->tbtt_idx] = vif;
+		spin_unlock_bh(&wp->vifs_by_tbtt_lock);
+	}
+
+	return 0;
+}
+
+/*
+ * @remove_interface: Notifies a driver that an interface is going down.
+ *	The @stop callback is called after this if it is the last interface
+ *	and no monitor interfaces are present.
+ *	When all interfaces are removed, the MAC address in the hardware
+ *	must be cleared so the device no longer acknowledges packets,
+ *	the mac_addr member of the conf structure is, however, set to the
+ *	MAC address of the device going away.
+ *	Hence, this callback must be implemented. It can sleep.
+ */
+static void wifi_ops_remove_interface(struct ieee80211_hw *hw,
+				      struct ieee80211_vif *vif)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct wifi_vif *wifi_vif = WIFI_VIF(vif);
+	struct wifi_tid *wifi_tid_mc = WIFI_TID(vif->txq);
+	int ret;
+
+	/* printk("wifi_ops_remove_interface\n"); */
+
+	/* hide it from interrupt handler */
+	if (wifi_vif->tbtt_idx != WIFI_INVALID_TBTT_IDX) {
+		spin_lock_bh(&wp->vifs_by_tbtt_lock);
+		wp->vifs_by_tbtt_idx[wifi_vif->tbtt_idx] = NULL;
+		spin_unlock_bh(&wp->vifs_by_tbtt_lock);
+	}
+
+	wifi_tid_release(wp, wifi_tid_mc);
+
+	ret = cmd_vif_stop(wp, wifi_vif->hw_id);
+	if (ret) {
+		dev_err(wp->dev, "failed to stop wifi vif\n");
+		return;
+	}
+	cmd_release_vif(wp, wifi_vif->hw_id);
+}
+
+/*
+ *
+ */
+static int wifi_rxq_init(struct wifi_priv *wp)
+{
+	struct wifi_rxq *rxq = &wp->rxq;
+	size_t size;
+
+	rxq->count = 0;
+	rxq->refill_off = 0;
+	rxq->fw_off = 0;
+
+	size = WIFI_RX_DESCS * sizeof (*rxq->descs);
+
+	rxq->descs = pci_zalloc_consistent(wp->pdev, size, &rxq->descs_dma);
+	if (rxq->descs == NULL) {
+		dev_err(wp->dev, "failed to alloc rx descs\n");
+		return -ENOMEM;
+	}
+
+	rxq->bufs = kcalloc(WIFI_RX_DESCS, sizeof(*rxq->bufs), GFP_KERNEL);
+	if (rxq->bufs == NULL) {
+		pci_free_consistent(wp->pdev, size,
+				    rxq->descs, rxq->descs_dma);
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+/*
+ *
+ */
+static void wifi_rxq_release(struct wifi_priv *wp)
+{
+	struct wifi_rxq *rxq = &wp->rxq;
+	int i;
+
+	if (rxq->descs == NULL)
+		return;
+
+	for (i = 0; i < WIFI_RX_DESCS; i++) {
+		if (!rxq->bufs[i].skb)
+			continue;
+
+		pci_unmap_single(wp->pdev,
+				 dma_unmap_addr(&rxq->bufs[i], dma),
+				 WIFI_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
+		dma_unmap_addr_set(&rxq->bufs[i], dma, 0);
+		kfree_skb(rxq->bufs[i].skb);
+		rxq->bufs[i].skb = NULL;
+	}
+
+	kfree(rxq->bufs);
+	rxq->bufs = NULL;
+	pci_free_consistent(wp->pdev,
+			    WIFI_RX_DESCS * sizeof (*rxq->descs),
+			    rxq->descs, rxq->descs_dma);
+	rxq->descs = NULL;
+}
+
+
+/*
+ *
+ */
+static void wifi_txq_release(struct wifi_priv *wp, struct wifi_txq *txq)
+{
+	struct wifi_tx_skb *wskb, *tmp;
+	int i;
+
+	for (i = 0; i < WIFI_TX_DESCS; i++) {
+		struct wifi_tx_skb *wskb = txq->pending_wskb[i];
+		if (wskb) {
+			wifi_tx_skb_release_txfail(wp, wskb);
+			txq->pending_wskb[i] = NULL;
+		}
+	}
+
+	list_for_each_entry_safe(wskb, tmp, &txq->wifi_tx_skbs_pool, next)
+		kfree(wskb);
+
+	kfree(txq->pending_wskb);
+	pci_free_consistent(wp->pdev,
+			    WIFI_TX_DESCS * sizeof (*txq->descs),
+			    txq->descs, txq->descs_dma);
+}
+
+/*
+ *
+ */
+static int wifi_txq_init(struct wifi_priv *wp, unsigned int idx)
+{
+	struct wifi_txq *txq = &wp->txqs[idx];
+	size_t i, size;
+
+	spin_lock_init(&txq->lock);
+	txq->idx = idx;
+	txq->head_off = 0;
+	txq->reclaim_off = 0;
+	INIT_LIST_HEAD(&txq->wifi_tx_skbs_pool);
+
+	size = WIFI_TX_DESCS * sizeof (*txq->descs);
+
+	txq->descs = pci_zalloc_consistent(wp->pdev, size, &txq->descs_dma);
+	if (txq->descs == NULL) {
+		dev_err(wp->dev, "failed to alloc tx descs\n");
+		goto free;
+	}
+
+	txq->pending_wskb = kcalloc(WIFI_TX_DESCS,
+				    sizeof(*txq->pending_wskb), GFP_KERNEL);
+	if (txq->pending_wskb == NULL)
+		goto free;
+
+	/*
+	 * prefill the wifi_tx_skb pool
+	 *
+	 * When doing tx completion for aggregate, the actual release
+	 * happen when the last packet of the aggregate is marked as
+	 * done by the hardware. So even the tx queue seems to be
+	 * almost empty, some wifi_tx_skb are not yet released. This
+	 * can be at most the maximum size of an aggregate, so we
+	 * alloc a bit more.
+	 */
+	for (i = 0; i < WIFI_TX_DESCS + IEEE80211_AGGR_MAX_MPDU; i++) {
+		struct wifi_tx_skb *wskb;
+
+		wskb = kzalloc(sizeof(*wskb), GFP_KERNEL);
+		if (!wskb)
+			goto free;
+
+		list_add_tail(&wskb->next, &txq->wifi_tx_skbs_pool);
+	}
+
+	return 0;
+
+free:
+	wifi_txq_release(wp, txq);
+	return -ENOMEM;
+}
+
+/*
+ * @start: Called before the first netdevice attached to the hardware
+ *	is enabled. This should turn on the hardware and must turn on
+ *	frame reception (for possibly enabled monitor interfaces.)
+ *	Returns negative error codes, these may be seen in userspace,
+ *	or zero.
+ *	When the device is started it should not have a MAC address
+ *	to avoid acknowledging frames before a non-monitor device
+ *	is added.
+ *	Must be implemented and can sleep.
+ */
+static int wifi_ops_start(struct ieee80211_hw *hw)
+{
+	struct wifi_priv *wp = hw->priv;
+	size_t i;
+	int ret;
+
+	/* printk("wifi_ops_start\n"); */
+
+	ret = wifi_rxq_init(wp);
+	if (ret)
+		goto fail;
+
+	if (wifi_rxq_refill(wp, INT_MAX) != WIFI_RX_DESCS) {
+		dev_err(wp->dev, "failed to refill rxq\n");
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	wp->txqs = kcalloc(wp->txq_count, sizeof (*wp->txqs), GFP_KERNEL);
+	if (!wp->txqs) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	for (i = 0; i < wp->txq_count; i++) {
+		ret = wifi_txq_init(wp, i);
+		if (ret)
+			goto fail;
+	}
+
+	if (cmd_start(wp)) {
+		dev_err(wp->dev, "failed to start device\n");
+		ret = -EIO;
+		goto fail;
+	}
+
+	return 0;
+
+fail:
+	if (wp->txqs) {
+		size_t i;
+		for (i = 0; i < wp->txq_count; i++)
+			wifi_txq_release(wp, &wp->txqs[i]);
+		kfree(wp->txqs);
+		wp->txqs = NULL;
+	}
+	wifi_rxq_release(wp);
+	return ret;
+}
+
+/*
+ * @stop: Called after last netdevice attached to the hardware
+ *	is disabled. This should turn off the hardware (at least
+ *	it must turn off frame reception.)
+ *	May be called right after add_interface if that rejects
+ *	an interface. If you added any work onto the mac80211 workqueue
+ *	you should ensure to cancel it on this callback.
+ *	Must be implemented and can sleep.
+ */
+static void wifi_ops_stop(struct ieee80211_hw *hw)
+{
+	struct wifi_priv *wp = hw->priv;
+	size_t i;
+
+	/* printk("wifi_ops_stop\n"); */
+
+	if (cmd_stop(wp))
+		dev_err(wp->dev, "failed to stop device\n");
+
+	for (i = 0; i < wp->txq_count; i++) {
+		wifi_txq_release(wp, &wp->txqs[i]);
+	}
+
+	kfree(wp->txqs);
+	wifi_rxq_release(wp);
+}
+
+/*
+ *
+ */
+static int update_survey(struct ieee80211_hw *hw,
+			 unsigned int chan_idx)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct survey_info *survey = &wp->survey[chan_idx];
+	int ret;
+
+	ret = cmd_get_chan_survey(wp,
+				  &survey->noise,
+				  &survey->time,
+				  &survey->time_busy,
+				  &survey->time_rx,
+				  &survey->time_tx);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ * @get_survey: Return per-channel survey information
+ */
+static int wifi_ops_get_survey(struct ieee80211_hw *hw, int idx,
+			       struct survey_info *survey)
+{
+	struct wifi_priv *wp = hw->priv;
+	struct ieee80211_supported_band *sband;
+
+	if (idx >= ARRAY_SIZE(wp->survey))
+		return -ENOENT;
+
+	if (idx == wp->cur_chan_idx) {
+		int ret = update_survey(hw, idx);
+		if (ret)
+			return ret;
+	}
+
+	memcpy(survey, &wp->survey[idx], sizeof (*survey));
+
+	sband = hw->wiphy->bands[NL80211_BAND_2GHZ];
+	survey->channel = &sband->channels[idx];
+
+	survey->filled =
+		SURVEY_INFO_NOISE_DBM |
+		SURVEY_INFO_TIME |
+		SURVEY_INFO_TIME_BUSY |
+		SURVEY_INFO_TIME_RX |
+		SURVEY_INFO_TIME_TX;
+
+	if (idx == wp->cur_chan_idx)
+		survey->filled |= SURVEY_INFO_IN_USE;
+
+	return 0;
+}
+
+/*
+ * @config: Handler for configuration requests. IEEE 802.11 code calls this
+ *	function to change hardware configuration, e.g., channel.
+ *	This function should never fail but returns a negative error code
+ *	if it does. The callback can sleep.
+ */
+static int wifi_ops_config(struct ieee80211_hw *hw, u32 changed)
+{
+	struct wifi_priv *wp = hw->priv;
+	int ret;
+
+	/* printk("wifi_ops_config: changed:%08x\n", changed); */
+
+	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+		if (wp->cur_chan_idx != -1)
+			update_survey(hw, wp->cur_chan_idx);
+
+		ret = wifi_set_channel(wp);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+/*
+ * @prepare_multicast: Prepare for multicast filter configuration.
+ *	This callback is optional, and its return value is passed
+ *	to configure_filter(). This callback must be atomic.
+ */
+static u64 wifi_ops_prepare_multicast(struct ieee80211_hw *hw,
+				      struct netdev_hw_addr_list *mc_list)
+{
+	/* don't try to filter multicast for now */
+	return WIFI_FILTER_ALL_MULTI;
+}
+
+/*
+ * @configure_filter: Configure the device's RX filter.
+ *	See the section "Frame filtering" for more information.
+ *	This callback must be implemented and can sleep.
+ */
+static void wifi_ops_configure_filter(struct ieee80211_hw *hw,
+				      unsigned int changed_flags,
+				      unsigned int *total_flags,
+				      u64 multicast)
+{
+	struct wifi_priv *wp = hw->priv;
+	u32 f;
+
+	/* keep only what we support */
+	*total_flags &=
+		FIF_ALLMULTI |
+		FIF_FCSFAIL |
+		FIF_BCN_PRBRESP_PROMISC |
+		FIF_CONTROL |
+		FIF_OTHER_BSS |
+		FIF_PSPOLL |
+		FIF_PROBE_REQ;
+
+	/* printk("wifi_ops_configure_filter: total_flags:%08x\n", */
+	/*        *total_flags); */
+
+	f = 0;
+	if (*total_flags & FIF_ALLMULTI)
+		f |= WIFI_FILTER_ALL_MULTI;
+	else
+		f |= multicast;
+	if (*total_flags & FIF_FCSFAIL)
+		f |= WIFI_FILTER_FCS_FAIL;
+	if (*total_flags & FIF_OTHER_BSS)
+		f |= WIFI_FILTER_PROMISC;
+	if (*total_flags & FIF_BCN_PRBRESP_PROMISC)
+		f |= WIFI_FILTER_ALL_BSSID;
+	if (*total_flags & FIF_CONTROL)
+		f |= WIFI_FILTER_FTYPE_CONTROL;
+	if (*total_flags & FIF_PSPOLL)
+		f |= WIFI_FILTER_FTYPE_PS_POLL;
+	if (*total_flags & FIF_PROBE_REQ)
+		f |= WIFI_FILTER_FTYPE_PROBE_REQ;
+
+	cmd_set_rx_filter(wp, f);
+}
+
+/*
+ * mac80211 device ops
+ */
+static const struct ieee80211_ops wifi_mac80211_ops = {
+	.tx			= wifi_ops_tx,
+	.wake_tx_queue		= wifi_ops_wake_tx_queue,
+	.release_buffered_frames= wifi_ops_release_buffered_frames,
+	.start			= wifi_ops_start,
+	.stop			= wifi_ops_stop,
+	.add_interface		= wifi_ops_add_interface,
+	.remove_interface	= wifi_ops_remove_interface,
+	.bss_info_changed	= wifi_ops_bss_info_changed,
+	.get_survey		= wifi_ops_get_survey,
+	.config			= wifi_ops_config,
+	.configure_filter	= wifi_ops_configure_filter,
+	.sta_add		= wifi_ops_sta_add,
+	.sta_remove		= wifi_ops_sta_remove,
+	.sta_notify		= wifi_ops_sta_notify,
+	.set_key                = wifi_ops_set_key,
+	.conf_tx		= wifi_ops_conf_tx,
+	.prepare_multicast	= wifi_ops_prepare_multicast,
+	.ampdu_action		= wifi_ops_ampdu_action,
+	.can_aggregate_in_amsdu	= wifi_ops_can_aggregate_in_amsdu,
+	.get_stats		= wifi_ops_get_stats,
+};
+
+/*
+ *
+ */
+static void setup_24hz_band(struct wifi_priv *wp,
+			    struct ieee80211_supported_band *b)
+{
+	struct ieee80211_sta_ht_cap *ht = &b->ht_cap;
+	size_t i;
+
+	b->band = NL80211_BAND_2GHZ;
+	b->channels = gchannels;
+	b->n_channels = ARRAY_SIZE(gchannels);
+	b->bitrates = mwl8k_rates;
+	b->n_bitrates = ARRAY_SIZE(mwl8k_rates);
+
+	ht->ht_supported = true;
+	ht->cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+		IEEE80211_HT_CAP_SGI_20 |
+		IEEE80211_HT_CAP_SGI_40 |
+		IEEE80211_HT_CAP_TX_STBC |
+		IEEE80211_HT_CAP_RX_STBC;
+
+	ht->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+	ht->ampdu_density = IEEE80211_HT_MPDU_DENSITY_NONE;
+
+	for (i = 0; i < wp->hw_radio_chains; i++)
+		ht->mcs.rx_mask[i] = 0xff;
+	/* MCS32 */
+	ht->mcs.rx_mask[4] = 0x1;
+
+	ht->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+}
+
+/*
+ *
+ */
+static int wifi_ieee80211_register(struct wifi_priv *wp)
+{
+	struct ieee80211_hw *hw = wp->hw;
+	size_t count;
+	int ret;
+
+	/* setup wiphy */
+	SET_IEEE80211_PERM_ADDR(hw, wp->addresses[0].addr);
+	hw->wiphy->addresses = wp->addresses;
+	hw->wiphy->n_addresses = wp->addresses_count;
+	count = wp->addresses_count;
+	if (count > 256)
+		count = 256;
+
+	hw->wiphy->interface_modes =
+		BIT(NL80211_IFTYPE_MONITOR) |
+		BIT(NL80211_IFTYPE_AP) |
+		BIT(NL80211_IFTYPE_MESH_POINT) |
+		BIT(NL80211_IFTYPE_STATION);
+
+	wp->if_limits[0].types = BIT(NL80211_IFTYPE_STATION);
+	wp->if_limits[0].max = wp->hw_max_sta_vif;
+
+	wp->if_limits[1].types = BIT(NL80211_IFTYPE_AP);
+#ifdef CONFIG_MAC80211_MESH
+	wp->if_limits[1].types |= BIT(NL80211_IFTYPE_MESH_POINT);
+#endif
+	wp->if_limits[1].max = wp->hw_max_ap_vif;
+
+	wp->if_comb.limits = wp->if_limits;
+	wp->if_comb.n_limits = ARRAY_SIZE(wp->if_limits);
+	wp->if_comb.max_interfaces = wp->hw_max_sta_vif + wp->hw_max_ap_vif;
+	wp->if_comb.num_different_channels = 1;
+	wp->if_comb.beacon_int_min_gcd = wp->hw_bcn_interval_gcd;
+
+	hw->wiphy->iface_combinations = &wp->if_comb;
+	hw->wiphy->n_iface_combinations = 1;
+
+	setup_24hz_band(wp, &wp->gband);
+	hw->wiphy->bands[0] = &wp->gband;
+
+	scnprintf(hw->wiphy->fw_version, sizeof (hw->wiphy->fw_version),
+		  "%u.%u", wp->fw_major, wp->fw_minor);
+
+	hw->wiphy->available_antennas_rx = (1 << wp->hw_radio_chains) - 1;
+	hw->wiphy->available_antennas_tx = (1 << wp->hw_radio_chains) - 1;
+
+	/* disabled until release_buffered_frames is fixed */
+	/* hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD; */
+	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
+
+	/* setup remaining hw fields */
+	ieee80211_hw_set(hw, SIGNAL_DBM);
+	ieee80211_hw_set(hw, PS_NULLFUNC_STACK);
+	ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
+	ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
+	ieee80211_hw_set(hw, REPORTS_TX_ACK_STATUS);
+	ieee80211_hw_set(hw, NO_AUTO_VIF);
+	ieee80211_hw_set(hw, QUEUE_CONTROL);
+	ieee80211_hw_set(hw, SUPPORTS_AMSDU_IN_AMPDU);
+	ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
+	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
+	ieee80211_hw_set(hw, AMPDU_AGGREGATION);
+	ieee80211_hw_set(hw, BUFF_MMPDU_TXQ);
+	ieee80211_hw_set(hw, STA_MMPDU_TXQ);
+	ieee80211_hw_set(hw, MFP_CAPABLE);
+
+	hw->vif_data_size = sizeof (struct wifi_vif);
+	hw->sta_data_size = sizeof (struct wifi_sta);
+	hw->txq_data_size = sizeof (struct wifi_tid);
+	hw->queues = wp->txq_count;
+	hw->max_rates = WIFI_TXD_MAX_RATES;
+	hw->max_report_rates = WIFI_TXD_MAX_RATES;
+	hw->max_rate_tries = 15;
+	hw->offchannel_tx_hw_queue = 6;
+
+	ret = ieee80211_register_hw(hw);
+	if (ret) {
+		wiphy_err(hw->wiphy, "cannot register device: %d\n", ret);
+		return ret;
+	}
+
+	wp->hw_registered = true;
+	return 0;
+}
+
+/*
+ *
+ */
+static void wifi_release(struct wifi_priv *wp)
+{
+}
+
+/*
+ *
+ */
+static int wifi_init(void *data)
+{
+	struct wifi_priv *wp = (struct wifi_priv *)data;
+	u8 force_mac[ETH_ALEN];
+	u32 api_version;
+	int ret;
+
+	if (cmd_get_api_version(wp, &api_version)) {
+		dev_err(wp->dev, "failed to get api_version\n");
+		return -EIO;
+	}
+
+	if (api_version != WIFI_API_VERSION) {
+		dev_err(wp->dev, "API version mismatch %u\n", api_version);
+		return -EIO;
+	}
+
+	if (cmd_get_fw_version(wp, &wp->fw_major, &wp->fw_minor)) {
+		dev_err(wp->dev, "failed to get fw version\n");
+		return -EIO;
+	}
+
+	dev_info(wp->dev, "wifi firmware version [%u.%u]\n",
+		 wp->fw_major,
+		 wp->fw_minor);
+
+	if (mac_pton(base_mac_addr, force_mac) &&
+	    !is_zero_ether_addr(force_mac) &&
+	    mac_addr_count > 0) {
+		unsigned int i;
+
+		dev_info(wp->dev, "using mac address from module params\n");
+
+		for (i = 0; i < mac_addr_count &&
+			     i < ARRAY_SIZE(wp->addresses); i++) {
+			memcpy(&wp->addresses[i], force_mac, 6);
+			inc_mac(wp->addresses[i].addr, i);
+		}
+
+		wp->addresses_count = mac_addr_count;
+
+	} else {
+		wp->addresses_count = ARRAY_SIZE(wp->addresses);
+		if (cmd_get_mac_address(wp, wp->addresses,
+					&wp->addresses_count)) {
+			dev_err(wp->dev, "failed to get mac address\n");
+			return -EIO;
+		}
+	}
+
+	ret = wifi_ieee80211_register(wp);
+	if (ret)
+		goto fail;
+
+	return 0;
+
+fail:
+	wifi_release(wp);
+	return ret;
+}
+
+/*
+ *
+ */
+static void wifi_exit(void *data)
+{
+	struct wifi_priv *wp = (struct wifi_priv *)data;
+
+	if (!wp->hw_registered)
+		return;
+
+	/* stop processing irq, FIXME: need spinlock for SMP  */
+	wp->rx_f2h_irq_mask = 0;
+	wp->tx_f2h_irq_mask = 0;
+	wp->tbtt_f2h_irq_mask = 0;
+
+	ieee80211_unregister_hw(wp->hw);
+	wifi_release(wp);
+}
+
+/*
+ *
+ */
+static void *
+wifi_alloc(struct mwl8k_priv *priv, void __iomem *vdesc, u32 *poll_mask)
+{
+	struct __iomem ixzone_svc_wifi *desc = vdesc;
+	struct ieee80211_hw *hw;
+	struct wifi_priv *wp;
+	size_t i;
+	u32 off;
+
+	if (!desc->radio.chain_count ||
+	    desc->radio.chain_count > 4) {
+		dev_err(&priv->pdev->dev,
+			"wifi service has invalid radio chains\n");
+		return NULL;
+	}
+
+	if (!desc->tx.max_ampdu_chain) {
+		dev_err(&priv->pdev->dev,
+			"wifi service has invalid max_ampdu_chain\n");
+		return NULL;
+	}
+
+	if (!desc->rx.f2h_irq_mask) {
+		dev_err(&priv->pdev->dev, "wifi service has no rx irq mask\n");
+		return NULL;
+	}
+
+	if (!desc->tx.f2h_irq_mask || !desc->tx.h2f_irq_mask) {
+		dev_err(&priv->pdev->dev, "wifi service has no tx irq mask\n");
+		return NULL;
+	}
+
+	if (desc->vif.max_ap_vif) {
+		if (!desc->vif.bcn_interval_gcd) {
+			dev_err(&priv->pdev->dev,
+				"wifi service has no beacon interval gcd\n");
+			return NULL;
+		}
+
+		if (!desc->vif.tbtt_f2h_irq_mask) {
+			dev_err(&priv->pdev->dev,
+				"wifi service has no tbtt irq mask\n");
+			return NULL;
+		}
+	}
+
+	off = (void *)desc - (void *)priv->sram;
+
+	for (i = 0; i < ARRAY_SIZE(desc->cmd_chans); i++) {
+		const __iomem struct ixzone_svc_wifi_cmd_chan *cdesc;
+		u32 boff, bsize;
+
+		cdesc = &desc->cmd_chans[i];
+
+		if (!cdesc->f2h_irq_mask || !cdesc->h2f_irq_mask) {
+			dev_err(&priv->pdev->dev,
+				"wifi cmd chan %zu has no irq mask\n", i);
+			return NULL;
+		}
+
+		if (cdesc->buf_offset % 4) {
+			dev_err(&priv->pdev->dev,
+				"wifi cmd chan %zu buf not aligned\n", i);
+			return NULL;
+		}
+
+		boff = le32_to_cpu(cdesc->buf_offset);
+		bsize = le32_to_cpu(cdesc->buf_size);
+
+		if (check_bound(SRAM_SIZE, off + boff, bsize)) {
+			dev_err(&priv->pdev->dev,
+				"wifi cmd chan %zu buf has bad offsets\n", i);
+			return NULL;
+		}
+	}
+
+	hw = ieee80211_alloc_hw(sizeof (*wp), &wifi_mac80211_ops);
+	if (!hw) {
+		dev_err(wp->dev, "ieee80211 alloc failed\n");
+		return NULL;
+	}
+
+	wp = hw->priv;
+	wp->hw = hw;
+	wp->priv = priv;
+	wp->cur_chan_idx = -1;
+	spin_lock_init(&wp->vifs_by_tbtt_lock);
+
+	*poll_mask = 0;
+
+	for (i = 0; i < ARRAY_SIZE(desc->cmd_chans); i++) {
+		struct __iomem ixzone_svc_wifi_cmd_chan *cdesc;
+		struct wifi_cmd_chan *chan;
+		u32 boff, bsize;
+
+		cdesc = &desc->cmd_chans[i];
+		boff = le32_to_cpu(cdesc->buf_offset);
+		bsize = le32_to_cpu(cdesc->buf_size);
+
+		chan = &wp->cmd_chans[i];
+		chan->buf_start = priv->sram + off + boff;
+		chan->buf_size = bsize;
+		chan->f2h_irq_mask = le32_to_cpu(cdesc->f2h_irq_mask);
+		chan->h2f_irq_mask = le32_to_cpu(cdesc->h2f_irq_mask);
+		chan->host_count_ptr = &cdesc->host_ctr;
+		chan->fw_count_ptr = &cdesc->fw_ctr;
+
+		mutex_init(&chan->lock);
+		spin_lock_init(&chan->complete_lock);
+
+		/* only watch irq done for async channel, we will
+		 * busy wait for completion on atomic channel */
+		if (i == WIFI_CMD_CHAN_ASYNC)
+			*poll_mask |= chan->f2h_irq_mask;
+	}
+
+	wp->rx_f2h_irq_mask = desc->rx.f2h_irq_mask;
+
+	wp->txq_count = le16_to_cpu(desc->tx.txq_count);
+	wp->hw_max_ampdu_chain = le16_to_cpu(desc->tx.max_ampdu_chain);
+	wp->tx_f2h_irq_mask = le32_to_cpu(desc->tx.f2h_irq_mask);
+	wp->tx_f2h_irq_shift = ffs(wp->tx_f2h_irq_mask) - 1;
+	wp->tx_h2f_irq_mask = le32_to_cpu(desc->tx.h2f_irq_mask);
+	wp->tx_h2f_irq_shift = ffs(wp->tx_h2f_irq_mask) - 1;
+
+	wp->tbtt_f2h_irq_mask = le32_to_cpu(desc->vif.tbtt_f2h_irq_mask);
+	wp->tbtt_f2h_irq_shift = ffs(wp->tbtt_f2h_irq_mask) - 1;
+
+	wp->hw_max_sta_vif = desc->vif.max_sta_vif;
+	wp->hw_max_ap_vif = desc->vif.max_ap_vif;
+	wp->hw_bcn_interval_gcd = desc->vif.bcn_interval_gcd;
+	if (wp->hw_max_ap_vif > WIFI_MAX_AP_VIFS)
+		wp->hw_max_ap_vif = WIFI_MAX_AP_VIFS;
+	wp->hw_radio_chains = le32_to_cpu(desc->radio.chain_count);
+
+	wp->dev = &priv->pdev->dev;
+	wp->pdev = priv->pdev;
+
+	SET_IEEE80211_DEV(hw, &priv->pdev->dev);
+
+	*poll_mask |= wp->rx_f2h_irq_mask |
+		wp->tx_f2h_irq_mask |
+		wp->tbtt_f2h_irq_mask;
+
+	return wp;
+}
+
+/*
+ *
+ */
+static void wifi_free(void *data)
+{
+	struct wifi_priv *wp = (struct wifi_priv *)data;
+	ieee80211_free_hw(wp->hw);
+}
+
+const struct dbg_svc_ops wifi_svc_ops = {
+	.name		= "wifi",
+	.uuid		= SVC_WIFI_UUID,
+	.desc_size	= sizeof (struct ixzone_svc_wifi),
+	.svc_alloc	= wifi_alloc,
+	.svc_init	= wifi_init,
+	.svc_process	= wifi_process,
+	.svc_exit	= wifi_exit,
+	.svc_free	= wifi_free,
+};
+
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/drivers/of/configfs.c	2021-03-04 13:20:59.507505632 +0100
@@ -0,0 +1,279 @@
+/*
+ * Configfs entries for device-tree
+ *
+ * Copyright (C) 2013 - Pantelis Antoniou <panto@antoniou-consulting.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+#include <linux/ctype.h>
+#include <linux/cpu.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_fdt.h>
+#include <linux/spinlock.h>
+#include <linux/slab.h>
+#include <linux/proc_fs.h>
+#include <linux/configfs.h>
+#include <linux/types.h>
+#include <linux/stat.h>
+#include <linux/limits.h>
+#include <linux/file.h>
+#include <linux/vmalloc.h>
+#include <linux/firmware.h>
+#include <linux/sizes.h>
+
+#include "of_private.h"
+
+struct cfs_overlay_item {
+	struct config_item	item;
+
+	char			path[PATH_MAX];
+
+	const struct firmware	*fw;
+	struct device_node	*overlay;
+	int			ov_id;
+
+	void			*dtbo;
+	int			dtbo_size;
+};
+
+static inline struct cfs_overlay_item *to_cfs_overlay_item(
+		struct config_item *item)
+{
+	return item ? container_of(item, struct cfs_overlay_item, item) : NULL;
+}
+
+static ssize_t cfs_overlay_item_path_show(struct config_item *item,
+		char *page)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+	return sprintf(page, "%s\n", overlay->path);
+}
+
+static ssize_t cfs_overlay_item_path_store(struct config_item *item,
+		const char *page, size_t count)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+	const char *p = page;
+	char *s;
+	int err;
+
+	/* if it's set do not allow changes */
+	if (overlay->path[0] != '\0' || overlay->dtbo_size > 0)
+		return -EPERM;
+
+	/* copy to path buffer (and make sure it's always zero terminated */
+	count = snprintf(overlay->path, sizeof(overlay->path) - 1, "%s", p);
+	overlay->path[sizeof(overlay->path) - 1] = '\0';
+
+	/* strip trailing newlines */
+	s = overlay->path + strlen(overlay->path);
+	while (s > overlay->path && *--s == '\n')
+		*s = '\0';
+
+	pr_debug("%s: path is '%s'\n", __func__, overlay->path);
+
+	err = request_firmware(&overlay->fw, overlay->path, NULL);
+	if (err != 0)
+		goto out_err;
+
+	err = of_overlay_fdt_apply((void *)overlay->fw->data,
+				   overlay->fw->size,
+				   &overlay->ov_id);
+	if (err != 0)
+		goto out_err;
+
+	return count;
+
+out_err:
+
+	release_firmware(overlay->fw);
+	overlay->fw = NULL;
+
+	overlay->path[0] = '\0';
+	return err;
+}
+
+static ssize_t cfs_overlay_item_status_show(struct config_item *item,
+		char *page)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+
+	return sprintf(page, "%s\n",
+			overlay->ov_id >= 0 ? "applied" : "unapplied");
+}
+
+CONFIGFS_ATTR(cfs_overlay_item_, path);
+CONFIGFS_ATTR_RO(cfs_overlay_item_, status);
+
+static struct configfs_attribute *cfs_overlay_attrs[] = {
+	&cfs_overlay_item_attr_path,
+	&cfs_overlay_item_attr_status,
+	NULL,
+};
+
+ssize_t cfs_overlay_item_dtbo_read(struct config_item *item,
+		void *buf, size_t max_count)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+
+	pr_debug("%s: buf=%p max_count=%zu\n", __func__,
+			buf, max_count);
+
+	if (overlay->dtbo == NULL)
+		return 0;
+
+	/* copy if buffer provided */
+	if (buf != NULL) {
+		/* the buffer must be large enough */
+		if (overlay->dtbo_size > max_count)
+			return -ENOSPC;
+
+		memcpy(buf, overlay->dtbo, overlay->dtbo_size);
+	}
+
+	return overlay->dtbo_size;
+}
+
+ssize_t cfs_overlay_item_dtbo_write(struct config_item *item,
+		const void *buf, size_t count)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+	int err;
+
+	/* if it's set do not allow changes */
+	if (overlay->path[0] != '\0' || overlay->dtbo_size > 0)
+		return -EPERM;
+
+	/* copy the contents */
+	overlay->dtbo = kmemdup(buf, count, GFP_KERNEL);
+	if (overlay->dtbo == NULL)
+		return -ENOMEM;
+
+	overlay->dtbo_size = count;
+
+	err = of_overlay_fdt_apply((void *)overlay->fw->data,
+				   overlay->dtbo_size,
+				   &overlay->ov_id);
+	if (err != 0)
+		goto out_err;
+
+	return count;
+
+out_err:
+	kfree(overlay->dtbo);
+	overlay->dtbo = NULL;
+	overlay->dtbo_size = 0;
+
+	return err;
+}
+
+CONFIGFS_BIN_ATTR(cfs_overlay_item_, dtbo, NULL, SZ_1M);
+
+static struct configfs_bin_attribute *cfs_overlay_bin_attrs[] = {
+	&cfs_overlay_item_attr_dtbo,
+	NULL,
+};
+
+static void cfs_overlay_release(struct config_item *item)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+
+	if (overlay->ov_id >= 0)
+		of_overlay_remove(&overlay->ov_id);
+	if (overlay->fw)
+		release_firmware(overlay->fw);
+	/* kfree with NULL is safe */
+	kfree(overlay->dtbo);
+	kfree(overlay);
+}
+
+static struct configfs_item_operations cfs_overlay_item_ops = {
+	.release	= cfs_overlay_release,
+};
+
+static struct config_item_type cfs_overlay_type = {
+	.ct_item_ops	= &cfs_overlay_item_ops,
+	.ct_attrs	= cfs_overlay_attrs,
+	.ct_bin_attrs	= cfs_overlay_bin_attrs,
+	.ct_owner	= THIS_MODULE,
+};
+
+static struct config_item *cfs_overlay_group_make_item(
+		struct config_group *group, const char *name)
+{
+	struct cfs_overlay_item *overlay;
+
+	overlay = kzalloc(sizeof(*overlay), GFP_KERNEL);
+	if (!overlay)
+		return ERR_PTR(-ENOMEM);
+	overlay->ov_id = -1;
+
+	config_item_init_type_name(&overlay->item, name, &cfs_overlay_type);
+	return &overlay->item;
+}
+
+static void cfs_overlay_group_drop_item(struct config_group *group,
+		struct config_item *item)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+
+	config_item_put(&overlay->item);
+}
+
+static struct configfs_group_operations overlays_ops = {
+	.make_item	= cfs_overlay_group_make_item,
+	.drop_item	= cfs_overlay_group_drop_item,
+};
+
+static struct config_item_type overlays_type = {
+	.ct_group_ops   = &overlays_ops,
+	.ct_owner       = THIS_MODULE,
+};
+
+static struct configfs_group_operations of_cfs_ops = {
+	/* empty - we don't allow anything to be created */
+};
+
+static struct config_item_type of_cfs_type = {
+	.ct_group_ops   = &of_cfs_ops,
+	.ct_owner       = THIS_MODULE,
+};
+
+struct config_group of_cfs_overlay_group;
+
+static struct configfs_subsystem of_cfs_subsys = {
+	.su_group = {
+		.cg_item = {
+			.ci_namebuf = "device-tree",
+			.ci_type = &of_cfs_type,
+		},
+	},
+	.su_mutex = __MUTEX_INITIALIZER(of_cfs_subsys.su_mutex),
+};
+
+static int __init of_cfs_init(void)
+{
+	int ret;
+
+	pr_info("%s\n", __func__);
+
+	config_group_init(&of_cfs_subsys.su_group);
+	config_group_init_type_name(&of_cfs_overlay_group, "overlays",
+			&overlays_type);
+	configfs_add_default_group(&of_cfs_overlay_group,
+			&of_cfs_subsys.su_group);
+
+	ret = configfs_register_subsystem(&of_cfs_subsys);
+	if (ret != 0) {
+		pr_err("%s: failed to register subsys\n", __func__);
+		goto out;
+	}
+	pr_info("%s: OK\n", __func__);
+out:
+	return ret;
+}
+late_initcall(of_cfs_init);
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/drivers/phy/marvell/phy-utmi-cp110.c	2021-03-04 13:20:59.540838967 +0100
@@ -0,0 +1,420 @@
+/*
+ * phy-utmi-cp110.c for cp110-utmi
+ * Created by <nschichan@freebox.fr> on Mon Jul 24 18:09:45 2017
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/phy/phy.h>
+#include <linux/io.h>
+#include <linux/delay.h>
+#include <linux/mfd/syscon.h>
+#include <linux/regmap.h>
+
+#include "phy-utmi-cp110.h"
+
+enum utmi_cp110_mode {
+	UTMI_PHY_USB2_HOST,
+	UTMI_PHY_USB2_DEVICE,
+
+	UTMI_PHY_MAX,
+};
+
+#define UTMI_PHY_COUNT	2
+
+struct utmi_cp110_priv;
+
+struct utmi_cp110_phy {
+	struct phy *phy;
+	struct utmi_cp110_priv *priv;
+	u32 mux;
+	int index;
+};
+
+struct utmi_cp110_priv {
+	void __iomem *utmi_unit_regs;
+	struct regmap *regmap;
+
+	struct device *dev;
+	struct utmi_cp110_phy phys[2];
+};
+
+static const struct of_device_id mvebu_comphy_of_match[] = {
+	{ .compatible = "marvell,cp110-utmi-phy", },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, mvebu_comphy_of_match);
+
+static void __iomem *map_resource(struct platform_device *pdev,
+				const char *resource_name)
+{
+	struct resource *res;
+	void *ret;
+
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, resource_name);
+	if (!res) {
+		dev_err(&pdev->dev, "unable to get resource %s\n",
+			resource_name);
+		return NULL;
+	}
+
+	ret = devm_ioremap_resource(&pdev->dev, res);
+	if (!ret) {
+		dev_err(&pdev->dev, "unable to remap resource %pR: (%s)\n",
+			res, resource_name);
+	}
+	dev_dbg(&pdev->dev, "ioremaped resource %pR: (%s)\n",
+		res, resource_name);
+	return ret;
+}
+
+/*
+ * relative to priv->regmap register space.
+ */
+#define UPHY_CFG_REG_OFF(n)		(0x440 + (n) * 4)
+#define USB_CONFIG_REG			(0x420)
+
+/*
+ * read/write from/to utmi configuration registers.
+ */
+static u32 uphy_config_read(struct utmi_cp110_phy *uphy)
+{
+	u32 ret;
+
+	regmap_read(uphy->priv->regmap, UPHY_CFG_REG_OFF(uphy->index), &ret);
+	return ret;
+}
+
+static void uphy_config_write(u32 value, struct utmi_cp110_phy *uphy)
+{
+	regmap_write(uphy->priv->regmap, UPHY_CFG_REG_OFF(uphy->index), value);
+}
+
+/*
+ * read/write from/to usb configuration register
+ */
+static u32 usb_config_read(struct utmi_cp110_priv *priv)
+{
+	u32 ret;
+
+	regmap_read(priv->regmap, USB_CONFIG_REG, &ret);
+	return ret;
+}
+
+static void usb_config_write(u32 value, struct utmi_cp110_priv *priv)
+{
+	regmap_write(priv->regmap, USB_CONFIG_REG, value);
+}
+
+/*
+ * read/write from/to utmi PHY unit registers.
+ */
+static u32 uphy_unit_read(struct utmi_cp110_phy *uphy, u32 off)
+{
+	u32 ret = readl(uphy->priv->utmi_unit_regs + off +
+			0x1000 * uphy->index);
+
+	return ret;
+}
+
+static void uphy_unit_write(u32 value, struct utmi_cp110_phy *uphy, u32 off)
+{
+	writel(value, uphy->priv->utmi_unit_regs + off + 0x1000 * uphy->index);
+}
+
+static void utmi_power_down(struct utmi_cp110_phy *uphy)
+{
+	u32 reg;
+
+	reg = uphy_config_read(uphy);
+	reg &= ~UTMI_PHY_CFG_PU_MASK;
+	uphy_config_write(reg, uphy);
+
+	reg = usb_config_read(uphy->priv);
+	if (uphy->mux == UTMI_PHY_USB2_DEVICE) {
+		/*
+		 * if in USB device mode, configure mux while the phy
+		 * is powered down.
+		 */
+		reg |= UTMI_USB_CFG_DEVICE_EN_MASK;
+		reg &= ~UTMI_USB_CFG_DEVICE_MUX_MASK;
+		reg |= (uphy->index << UTMI_USB_CFG_DEVICE_MUX_OFFSET);
+	} else {
+		/*
+		 * otherwise disable USB3 device mode.
+		 */
+		reg &= ~UTMI_USB_CFG_DEVICE_EN_MASK;
+	}
+	usb_config_write(reg, uphy->priv);
+
+	/*
+	 * set suspend mode and test_sel
+	 */
+	reg = uphy_unit_read(uphy, UTMI_CTRL_STATUS0_REG);
+	reg |= UTMI_CTRL_STATUS0_SUSPENDM_MASK;
+	reg |= UTMI_CTRL_STATUS0_TEST_SEL_MASK;
+	uphy_unit_write(reg, uphy, UTMI_CTRL_STATUS0_REG);
+
+	mdelay(2);
+}
+
+static void utmi_pll_power_off(struct utmi_cp110_phy *uphy)
+{
+	u32 reg;
+
+	/*
+	 * FIXME: this is a global bit for both UTMI phys, is it safe
+	 * to power it down when the other phy is powered on ?
+	 */
+	reg = usb_config_read(uphy->priv);
+	reg &= ~UTMI_USB_CFG_PLL_MASK;
+	usb_config_write(reg, uphy->priv);
+}
+
+static void utmi_pll_power_on(struct utmi_cp110_phy *uphy)
+{
+	u32 reg;
+
+	/*
+	 * FIXME: see above.
+	 */
+	reg = usb_config_read(uphy->priv);
+	reg |= UTMI_USB_CFG_PLL_MASK;
+	usb_config_write(reg, uphy->priv);
+}
+
+static void utmi_phy_configure(struct utmi_cp110_phy *uphy)
+{
+	u32 reg;
+
+	reg = uphy_unit_read(uphy, UTMI_PLL_CTRL_REG);
+	/* Reference Clock Divider Select */
+	reg &= ~UTMI_PLL_CTRL_REFDIV_MASK;
+	reg |= 0x5 << UTMI_PLL_CTRL_REFDIV_OFFSET;
+	/* Feedback Clock Divider Select - 90 for 25Mhz*/
+	reg &= ~UTMI_PLL_CTRL_FBDIV_MASK;
+	reg |= 0x60 << UTMI_PLL_CTRL_FBDIV_OFFSET;
+	/* Select LPFR - 0x0 for 25Mhz/5=5Mhz*/
+	reg &= ~UTMI_PLL_CTRL_SEL_LPFR_MASK;
+	reg |= 0x0 << UTMI_PLL_CTRL_SEL_LPFR_OFFSET;
+	uphy_unit_write(reg, uphy, UTMI_PLL_CTRL_REG);
+
+	/* Impedance Calibration Threshold Setting */
+	reg = uphy_unit_read(uphy, UTMI_CALIB_CTRL_REG);
+	reg &= ~UTMI_CALIB_CTRL_IMPCAL_VTH_MASK;
+	reg |= 0x6 << UTMI_CALIB_CTRL_IMPCAL_VTH_OFFSET;
+	uphy_unit_write(reg, uphy, UTMI_CALIB_CTRL_REG);
+
+	reg = uphy_unit_read(uphy, UTMI_TX_CH_CTRL_REG);
+	/* Set LS TX driver strength coarse control */
+	reg &= ~UTMI_TX_CH_CTRL_DRV_EN_LS_MASK;
+	reg |= 0x3 << UTMI_TX_CH_CTRL_DRV_EN_LS_OFFSET;
+	/* Set LS TX driver fine adjustment */
+	reg &= ~UTMI_TX_CH_CTRL_IMP_SEL_LS_MASK;
+	reg |= 0x3 << UTMI_TX_CH_CTRL_IMP_SEL_LS_OFFSET;
+	uphy_unit_write(reg, uphy, UTMI_TX_CH_CTRL_REG);
+
+	reg = uphy_unit_read(uphy, UTMI_RX_CH_CTRL0_REG);
+	/* Enable SQ */
+	reg &= ~UTMI_RX_CH_CTRL0_SQ_DET_MASK;
+	reg |= 0x0 << UTMI_RX_CH_CTRL0_SQ_DET_OFFSET;
+	/* Enable analog squelch detect */
+	reg &= ~UTMI_RX_CH_CTRL0_SQ_ANA_DTC_MASK;
+	reg |= 0x1 << UTMI_RX_CH_CTRL0_SQ_ANA_DTC_OFFSET;
+	uphy_unit_write(reg, uphy, UTMI_RX_CH_CTRL0_REG);
+
+	/* Set External squelch calibration number */
+	reg = uphy_unit_read(uphy, UTMI_RX_CH_CTRL1_REG);
+	reg &= ~UTMI_RX_CH_CTRL1_SQ_AMP_CAL_MASK;
+	reg |= 0x1 << UTMI_RX_CH_CTRL1_SQ_AMP_CAL_OFFSET;
+	/* Enable the External squelch calibration */
+	reg &= ~UTMI_RX_CH_CTRL1_SQ_AMP_CAL_EN_MASK;
+	reg |= 0x1 << UTMI_RX_CH_CTRL1_SQ_AMP_CAL_EN_OFFSET;
+	uphy_unit_write(reg, uphy, UTMI_RX_CH_CTRL1_REG);
+
+	/* Set Control VDAT Reference Voltage - 0.325V */
+	reg = uphy_unit_read(uphy, UTMI_CHGDTC_CTRL_REG);
+	reg &= ~UTMI_CHGDTC_CTRL_VDAT_MASK;
+	reg |= 0x1 << UTMI_CHGDTC_CTRL_VDAT_OFFSET;
+	/* Set Control VSRC Reference Voltage - 0.6V */
+	reg &= ~UTMI_CHGDTC_CTRL_VSRC_MASK;
+	reg |= 0x1 << UTMI_CHGDTC_CTRL_VSRC_OFFSET;
+	uphy_unit_write(reg, uphy, UTMI_CHGDTC_CTRL_REG);
+}
+
+static int utmi_power_up(struct utmi_cp110_phy *uphy)
+{
+	u32 reg;
+	u32 tries;
+
+	/*
+	 * set PU bit
+	 */
+	reg = uphy_config_read(uphy);
+	reg |= UTMI_PHY_CFG_PU_MASK;
+	uphy_config_write(reg, uphy);
+
+	/*
+	 * clear  test_sel
+	 */
+	reg = uphy_unit_read(uphy, UTMI_CTRL_STATUS0_REG);
+	reg &= ~UTMI_CTRL_STATUS0_TEST_SEL_MASK;
+	uphy_unit_write(reg, uphy, UTMI_CTRL_STATUS0_REG);
+
+	/*
+	 * wait for impedance calibration
+	 */
+	tries = 100;
+	while (tries) {
+		u32 reg = uphy_unit_read(uphy, UTMI_CALIB_CTRL_REG);
+
+		if ((reg & (UTMI_CALIB_CTRL_IMPCAL_DONE_MASK |
+			   UTMI_CALIB_CTRL_PLLCAL_DONE_MASK)) ==
+		    (UTMI_CALIB_CTRL_IMPCAL_DONE_MASK |
+		     UTMI_CALIB_CTRL_PLLCAL_DONE_MASK))
+			break;
+		mdelay(2);
+		--tries;
+	}
+	if (!tries)
+		return -ETIMEDOUT;
+
+	/*
+	 * wait for PLL ready.
+	 */
+	tries = 100;
+	while (tries) {
+		u32 reg = uphy_unit_read(uphy, UTMI_PLL_CTRL_REG);
+
+		if (reg & UTMI_PLL_CTRL_PLL_RDY_MASK)
+			break;
+		mdelay(2);
+		--tries;
+	}
+	if (!tries)
+		return -ETIMEDOUT;
+
+	return 0;
+}
+
+static int utmi_cp110_power_off(struct phy *phy)
+{
+	struct utmi_cp110_phy *uphy = phy_get_drvdata(phy);
+
+	utmi_power_down(uphy);
+	return 0;
+}
+
+static int utmi_cp110_power_on(struct phy *phy)
+{
+	struct utmi_cp110_phy *uphy = phy_get_drvdata(phy);
+	int err;
+
+	utmi_power_down(uphy);
+	utmi_pll_power_off(uphy);
+	utmi_phy_configure(uphy);
+	err = utmi_power_up(uphy);
+	utmi_pll_power_on(uphy);
+
+	return err;
+}
+
+/*
+ * NOTE: we're configuring a USB2 phy, but the generic hcd code will
+ * pass PHY_MODE_USB_HOST_SS ...
+ */
+static int utmi_cp110_set_mode(struct phy *phy, enum phy_mode mode, int submode)
+{
+	struct utmi_cp110_phy *uphy = phy_get_drvdata(phy);
+
+	switch (mode) {
+	case PHY_MODE_USB_HOST_SS:
+	case PHY_MODE_USB_HOST:
+		uphy->mux = UTMI_PHY_USB2_HOST;
+		break;
+	case PHY_MODE_USB_DEVICE_SS:
+	case PHY_MODE_USB_DEVICE:
+		uphy->mux = UTMI_PHY_USB2_DEVICE;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static const struct phy_ops utmi_cp110_phy_ops = {
+	.power_on = utmi_cp110_power_on,
+	.power_off = utmi_cp110_power_off,
+	.set_mode = utmi_cp110_set_mode,
+	.owner = THIS_MODULE,
+};
+
+static struct phy *utmi_cp110_phy_of_xlate(struct device *dev,
+					 struct of_phandle_args *args)
+{
+	struct utmi_cp110_priv *priv = dev_get_drvdata(dev);
+	u32 index = args->args[0];
+	struct utmi_cp110_phy *uphy;
+
+	if (index >= UTMI_PHY_COUNT)
+		return NULL;
+
+	uphy = &priv->phys[index];
+
+	return uphy->phy;
+}
+
+static int utmi_cp110_probe(struct platform_device *pdev)
+{
+	struct utmi_cp110_priv *priv;
+	struct phy_provider *provider;
+	int i;
+
+	priv = devm_kzalloc(&pdev->dev, sizeof (*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->dev = &pdev->dev;
+	priv->regmap =
+		syscon_regmap_lookup_by_phandle(pdev->dev.of_node,
+						"marvell,system-controller");
+	if (IS_ERR(priv->regmap))
+		return PTR_ERR(priv->regmap);
+
+	priv->utmi_unit_regs = map_resource(pdev, "utmi-unit");
+	if (!priv->utmi_unit_regs)
+		return -ENOMEM;
+
+	for (i = 0; i < UTMI_PHY_COUNT; ++i) {
+		dev_dbg(&pdev->dev, "creating phy %d\n", i);
+		priv->phys[i].phy = devm_phy_create(&pdev->dev, NULL,
+						    &utmi_cp110_phy_ops);
+		if (IS_ERR(priv->phys[i].phy)) {
+			int err = PTR_ERR(priv->phys[i].phy);
+			dev_err(&pdev->dev, "devm_phy_create: failed with %d\n", err);
+			return err;
+		}
+		priv->phys[i].priv = priv;
+		priv->phys[i].index = i;
+		phy_set_drvdata(priv->phys[i].phy, &priv->phys[i]);
+	}
+	platform_set_drvdata(pdev, priv);
+
+	provider = devm_of_phy_provider_register(&pdev->dev,
+						 utmi_cp110_phy_of_xlate);
+	if (!provider)
+		dev_err(&pdev->dev, "failed to register OF phy provider.\n");
+	return PTR_ERR_OR_ZERO(provider);
+}
+
+static struct platform_driver utmi_cp110_driver = {
+	.probe	= utmi_cp110_probe,
+	.driver	= {
+		.name		= "phy-utmi-cp110",
+		.owner		= THIS_MODULE,
+		.of_match_table	= mvebu_comphy_of_match,
+	 },
+};
+module_platform_driver(utmi_cp110_driver);
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/drivers/phy/marvell/phy-utmi-cp110.h	2021-03-04 13:20:59.540838967 +0100
@@ -0,0 +1,81 @@
+/*
+ * ***************************************************************************
+ * Copyright (C) 2015 Marvell International Ltd.
+ * ***************************************************************************
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 2 of the License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ * ***************************************************************************
+ */
+
+#ifndef __PHY_UTMI_CP110_H
+# define __PHY_UTMI_CP110_H
+
+#define UTMI_USB_CFG_DEVICE_EN_OFFSET		0
+#define UTMI_USB_CFG_DEVICE_EN_MASK		(0x1 << UTMI_USB_CFG_DEVICE_EN_OFFSET)
+#define UTMI_USB_CFG_DEVICE_MUX_OFFSET		1
+#define UTMI_USB_CFG_DEVICE_MUX_MASK		(0x1 << UTMI_USB_CFG_DEVICE_MUX_OFFSET)
+#define UTMI_USB_CFG_PLL_OFFSET			25
+#define UTMI_USB_CFG_PLL_MASK			(0x1 << UTMI_USB_CFG_PLL_OFFSET)
+
+#define UTMI_PHY_CFG_PU_OFFSET			5
+#define UTMI_PHY_CFG_PU_MASK			(0x1 << UTMI_PHY_CFG_PU_OFFSET)
+
+#define UTMI_PLL_CTRL_REG			0x0
+#define UTMI_PLL_CTRL_REFDIV_OFFSET		0
+#define UTMI_PLL_CTRL_REFDIV_MASK		(0x7f << UTMI_PLL_CTRL_REFDIV_OFFSET)
+#define UTMI_PLL_CTRL_FBDIV_OFFSET		16
+#define UTMI_PLL_CTRL_FBDIV_MASK		(0x1FF << UTMI_PLL_CTRL_FBDIV_OFFSET)
+#define UTMI_PLL_CTRL_SEL_LPFR_OFFSET		28
+#define UTMI_PLL_CTRL_SEL_LPFR_MASK		(0x3 << UTMI_PLL_CTRL_SEL_LPFR_OFFSET)
+#define UTMI_PLL_CTRL_PLL_RDY_OFFSET		31
+#define UTMI_PLL_CTRL_PLL_RDY_MASK		(0x1 << UTMI_PLL_CTRL_PLL_RDY_OFFSET)
+
+#define UTMI_CALIB_CTRL_REG			0x8
+#define UTMI_CALIB_CTRL_IMPCAL_VTH_OFFSET	8
+#define UTMI_CALIB_CTRL_IMPCAL_VTH_MASK		(0x7 << UTMI_CALIB_CTRL_IMPCAL_VTH_OFFSET)
+#define UTMI_CALIB_CTRL_IMPCAL_DONE_OFFSET	23
+#define UTMI_CALIB_CTRL_IMPCAL_DONE_MASK	(0x1 << UTMI_CALIB_CTRL_IMPCAL_DONE_OFFSET)
+#define UTMI_CALIB_CTRL_PLLCAL_DONE_OFFSET	31
+#define UTMI_CALIB_CTRL_PLLCAL_DONE_MASK	(0x1 << UTMI_CALIB_CTRL_PLLCAL_DONE_OFFSET)
+
+#define UTMI_TX_CH_CTRL_REG			0xC
+#define UTMI_TX_CH_CTRL_DRV_EN_LS_OFFSET	12
+#define UTMI_TX_CH_CTRL_DRV_EN_LS_MASK		(0xf << UTMI_TX_CH_CTRL_DRV_EN_LS_OFFSET)
+#define UTMI_TX_CH_CTRL_IMP_SEL_LS_OFFSET	16
+#define UTMI_TX_CH_CTRL_IMP_SEL_LS_MASK		(0xf << UTMI_TX_CH_CTRL_IMP_SEL_LS_OFFSET)
+
+#define UTMI_RX_CH_CTRL0_REG			0x14
+#define UTMI_RX_CH_CTRL0_SQ_DET_OFFSET		15
+#define UTMI_RX_CH_CTRL0_SQ_DET_MASK		(0x1 << UTMI_RX_CH_CTRL0_SQ_DET_OFFSET)
+#define UTMI_RX_CH_CTRL0_SQ_ANA_DTC_OFFSET	28
+#define UTMI_RX_CH_CTRL0_SQ_ANA_DTC_MASK	(0x1 << UTMI_RX_CH_CTRL0_SQ_ANA_DTC_OFFSET)
+
+#define UTMI_RX_CH_CTRL1_REG			0x18
+#define UTMI_RX_CH_CTRL1_SQ_AMP_CAL_OFFSET	0
+#define UTMI_RX_CH_CTRL1_SQ_AMP_CAL_MASK	(0x3 << UTMI_RX_CH_CTRL1_SQ_AMP_CAL_OFFSET)
+#define UTMI_RX_CH_CTRL1_SQ_AMP_CAL_EN_OFFSET	3
+#define UTMI_RX_CH_CTRL1_SQ_AMP_CAL_EN_MASK	(0x1 << UTMI_RX_CH_CTRL1_SQ_AMP_CAL_EN_OFFSET)
+
+#define UTMI_CTRL_STATUS0_REG			0x24
+#define UTMI_CTRL_STATUS0_SUSPENDM_OFFSET	22
+#define UTMI_CTRL_STATUS0_SUSPENDM_MASK		(0x1 << UTMI_CTRL_STATUS0_SUSPENDM_OFFSET)
+#define UTMI_CTRL_STATUS0_TEST_SEL_OFFSET	25
+#define UTMI_CTRL_STATUS0_TEST_SEL_MASK		(0x1 << UTMI_CTRL_STATUS0_TEST_SEL_OFFSET)
+
+#define UTMI_CHGDTC_CTRL_REG			0x38
+#define UTMI_CHGDTC_CTRL_VDAT_OFFSET		8
+#define UTMI_CHGDTC_CTRL_VDAT_MASK		(0x3 << UTMI_CHGDTC_CTRL_VDAT_OFFSET)
+#define UTMI_CHGDTC_CTRL_VSRC_OFFSET		10
+#define UTMI_CHGDTC_CTRL_VSRC_MASK		(0x3 << UTMI_CHGDTC_CTRL_VSRC_OFFSET)
+
+#endif /* __PHY_UTMI_CP110_H */
+
diff -Nruw linux-5.4.60-fbx/drivers/platform/fbxgw7r./fbxgw7r-switch.c linux-5.4.60-fbx/drivers/platform/fbxgw7r/fbxgw7r-switch.c
--- linux-5.4.60-fbx/drivers/platform/fbxgw7r./fbxgw7r-switch.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/platform/fbxgw7r/fbxgw7r-switch.c	2021-03-04 13:20:59.600838970 +0100
@@ -0,0 +1,520 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/delay.h>
+#include <linux/errno.h>
+#include <linux/mdio.h>
+#include <linux/gpio.h>
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <linux/of_device.h>
+
+#define PFX "fbxgw7r-switch: "
+
+#define PORTREG_SWITCH_IDENTIFIER	0x3
+#define PRODUCT_NUM(x)			(((x) >> 4) & 0xfff)
+
+#define PDATA_MEMBER_UNMODIFIED		0
+#define PDATA_MEMBER_UNTAGGED		1
+#define PDATA_MEMBER_TAGGED		2
+#define PDATA_NOT_MEMBER		3
+
+#define NFS_VLAN_ID			41
+
+#define SWPORT(X)			((X) + 0x10)
+#define PHYPORT(X)			((X) + 0x10)
+#define MARVELL_PHYPORT0		0x00
+#define MARVELL_SWPORT0			0x10
+#define MARVELL_SWPORT4			0x14
+#define MARVELL_SWPORT5			0x15
+
+#define PORTREG_PCS			0x1
+
+#define PCS_RGMII_RX_DELAY		(1 << 15)
+#define PCS_RGMII_TX_DELAY		(1 << 14)
+#define PCS_FORCELINK_UP		(1 << 5)
+#define PCS_FORCELINK			(1 << 4)
+#define PCS_FORCEDUPLEX_FULL		(1 << 3)
+#define PCS_FORCEDUPLEX			(1 << 2)
+#define PCS_FORCESPEED_10		0x0
+#define PCS_FORCESPEED_100		0x1
+#define PCS_FORCESPEED_1000		0x2
+#define PCS_FORCESPEED_AUTO		0x3
+
+#define PORTREG_PCR			0x4
+#define PCR_PORTSTATE_DISABLED		0x0
+#define PCR_PORTSTATE_FORWARDING	0x3
+
+#define PORTREG_VLANID			0x7
+
+#define PORTREG_PCR2			0x8
+#define PCR2_MODE_SHIFT			10
+#define PCR2_MODE_SECURE		3
+
+#define MARVELL_GLOBAL1			0x1b
+#define MARVELL_GLOBAL2			0x1c
+
+#define GLOBREG_VTUFID			0x2
+#define GLOBREG_VTUSID			0x3
+
+#define GLOBREG_GCR			0x4
+#define GCR_PPUEN			(1 << 14)
+
+#define GLOBREG_VTUOP			0x5
+#define VTUOP_BUSY			(1 << 15)
+#define VTUOP_OP_LOAD			(0x3 << 12)
+#define VTUOP_OP_STU_LOAD		(0x5 << 12)
+#define VTUOP_OP_GETNEXT		(0x4 << 12)
+
+#define GLOBREG_VTUVID			0x6
+#define VTUVID_VALID			(1 << 12)
+
+#define GLOBREG_VTU_P03_DATA		0x7
+#define GLOBREG_VTU_P46_DATA		0x8
+
+#define GLOBREG_VTU_DATA		0x9
+
+#define GLOBREG_SMI_CMD			0x18
+# define SMI_CMD_BUSY			(1 << 15)
+# define SMI_CLAUSE_22			(1 << 12)
+# define SMI_CMD_READ			(2 << 10)
+# define SMI_CMD_WRITE			(1 << 10)
+# define SMI_CMD_C45_SETADDR		(0 << 10)
+# define SMI_CMD_C45_WRITE		(1 << 10)
+# define SMI_CMD_C45_READ		(3 << 10)
+# define SMI_DEVADDR(DevAddr)	(DevAddr << 5)
+# define SMI_REGADDR(RegAddr)	(RegAddr)
+#define GLOBREG_SMI_DATA		0x19
+
+#define GLOBAL1_GSR			0x0
+# define GSR_PPU_POLLING_BIT		(15)
+# define GSR_INITREADY_BIT		(11)
+
+/*
+ *
+ */
+struct sw_priv {
+	int			dev_id;
+	struct mdio_device	*mdiodev;
+};
+
+static int __sw_read(struct sw_priv *priv, int addr, u32 regnum)
+{
+	return mdiobus_read(priv->mdiodev->bus, addr, regnum);
+}
+
+static int __sw_write(struct sw_priv *priv, int addr, u32 regnum, u16 val)
+{
+	return mdiobus_write(priv->mdiodev->bus, addr, regnum, val);
+}
+
+static int __sw_indirect_wait(struct sw_priv *priv, int tries)
+{
+	while (tries) {
+		u16 val = __sw_read(priv, MARVELL_GLOBAL2, GLOBREG_SMI_CMD);
+		if ((val & SMI_CMD_BUSY) == 0)
+			return 0;
+		udelay(1000);
+		--tries;
+	}
+	return -ETIMEDOUT;
+}
+
+/*
+ * Ye Olde Clause 22 read / write helpers. Use this on copper phy
+ * ports 1-4.
+ */
+static int sw_c22_read(struct sw_priv *priv, int phy_id, int reg)
+{
+	u16 smi_cmd = SMI_CMD_BUSY | SMI_CLAUSE_22 | SMI_CMD_READ |
+		SMI_DEVADDR(phy_id) | SMI_REGADDR(reg);
+
+	__sw_write(priv, MARVELL_GLOBAL2, GLOBREG_SMI_CMD, smi_cmd);
+	if (__sw_indirect_wait(priv, 1000) < 0) {
+		printk(KERN_WARNING PFX "indirect phy read did not "
+		       "complete.\n");
+		return 0xffff;
+	}
+	return __sw_read(priv, MARVELL_GLOBAL2, GLOBREG_SMI_DATA);
+}
+
+static void sw_c22_write(struct sw_priv *priv, int phy_id, int reg,
+				int val)
+{
+	u16 smi_cmd = SMI_CMD_BUSY | SMI_CLAUSE_22 | SMI_CMD_WRITE |
+		SMI_DEVADDR(phy_id) | SMI_REGADDR(reg);
+
+	__sw_write(priv, MARVELL_GLOBAL2, GLOBREG_SMI_DATA, val);
+	__sw_write(priv, MARVELL_GLOBAL2, GLOBREG_SMI_CMD, smi_cmd);
+	if (__sw_indirect_wait(priv, 1000) < 0) {
+		printk(KERN_WARNING PFX "indirect phy write did not "
+		       "complete.\n");
+	}
+}
+
+#define PORT_CMODE_MASK                 (0xf)
+
+static void change_p5_cmode(struct sw_priv *priv, u8 new_cmode)
+{
+        u16 psr = __sw_read(priv, 0x15, 0);
+
+        if ((psr & PORT_CMODE_MASK) == new_cmode) {
+                printk("change_p5_cmode: mode is already %02x\n", new_cmode);
+                return ;
+        }
+
+        /* Make CMODE writeable */
+        __sw_write(priv, 0x15, 0x1a, 0x8100);
+	__sw_write(priv, 0x14, 0x1a, 0xdea0);
+
+        /* write new CMODE*/
+        __sw_write(priv, 0x15, 0x0, new_cmode);
+
+        psr = __sw_read(priv, 0x15, 0);
+        if ((psr & PORT_CMODE_MASK) != new_cmode)
+                printk("change_p5_cmode: unable to change mode to %02x\n",
+                       new_cmode);
+}
+
+/*
+ * Ye Newe Clause 45 register accesses. an address cycle must be sent
+ * before sending a read or a write command. register address space is
+ * now 16bit wide.
+ *
+ * Valid on port 5 phy, when in SerDes mode.
+ */
+static u16 sw_c45_read(struct sw_priv *priv, u8 phy_addr, u8 devtype,
+		       u16 reg)
+{
+	u16 smi_command = SMI_DEVADDR(phy_addr) | SMI_REGADDR(devtype) |
+		SMI_CMD_BUSY | SMI_CMD_C45_SETADDR;
+
+	__sw_write(priv, MARVELL_GLOBAL2, 0x19, reg);
+	__sw_write(priv, MARVELL_GLOBAL2, 0x18, smi_command);
+	__sw_indirect_wait(priv, 1000);
+
+	smi_command = SMI_DEVADDR(phy_addr) | SMI_REGADDR(devtype) |
+		SMI_CMD_BUSY | SMI_CMD_C45_READ;
+	__sw_write(priv, MARVELL_GLOBAL2, 0x18, smi_command);
+	__sw_indirect_wait(priv, 1000);
+	return __sw_read(priv, MARVELL_GLOBAL2, 0x19);
+}
+
+static void sw_c45_write(struct sw_priv *priv, u8 phy_addr, u8 devtype,
+			 u16 reg, u16 data)
+{
+	u16 smi_command = SMI_DEVADDR(phy_addr) | SMI_REGADDR(devtype) |
+		SMI_CMD_BUSY | SMI_CMD_C45_SETADDR;
+
+	__sw_write(priv, MARVELL_GLOBAL2, 0x19, reg);
+	__sw_write(priv, MARVELL_GLOBAL2, 0x18, smi_command);
+	__sw_indirect_wait(priv, 1000);
+
+	smi_command = SMI_DEVADDR(phy_addr) | SMI_REGADDR(devtype) |
+		SMI_CMD_BUSY | SMI_CMD_C45_WRITE;
+	__sw_write(priv, MARVELL_GLOBAL2, 0x19, data);
+	__sw_write(priv, MARVELL_GLOBAL2, 0x18, smi_command);
+	__sw_indirect_wait(priv, 1000);
+}
+
+
+static void __vtu_wait(struct sw_priv *priv)
+{
+	for (;;) {
+		u16 val = __sw_read(priv, MARVELL_GLOBAL1, GLOBREG_VTUOP);
+		if ((val & (1 << 15)) == 0)
+			break;
+		msleep(10);
+	}
+}
+
+static void fbxgw7r_sw_vtu_stu_init(struct sw_priv *priv, int port_state,
+				  size_t nr_ports)
+{
+	u16 vtu_op = VTUOP_OP_STU_LOAD;
+	u16 regs[2] = { 0 , 0 };
+	int i;
+
+	__sw_write(priv, MARVELL_GLOBAL1, GLOBREG_VTUOP, vtu_op);
+
+	__sw_write(priv, MARVELL_GLOBAL1, GLOBREG_VTUSID, 0);
+	__sw_write(priv, MARVELL_GLOBAL1, GLOBREG_VTUVID, VTUVID_VALID);
+
+
+	for (i = 0; i < nr_ports; ++i) {
+		int off;
+		int shift;
+
+		off = i / 4;
+		shift = 4 * (i % 4) +  2;
+
+		regs[off] |= port_state << shift;
+	}
+
+	__sw_write(priv, MARVELL_GLOBAL1, GLOBREG_VTU_P03_DATA, regs[0]);
+	__sw_write(priv, MARVELL_GLOBAL1, GLOBREG_VTU_P46_DATA, regs[1]);
+
+	vtu_op |= VTUOP_BUSY;
+	__sw_write(priv, MARVELL_GLOBAL1, GLOBREG_VTUOP, vtu_op);
+	__vtu_wait(priv);
+}
+
+static void fbxgw7r_sw_vtu_load(struct sw_priv *priv, u16 vid, const u8 *ports,
+			      size_t nr_ports)
+{
+	u16 vtu_op;
+	u16 regs[2] = { 0, 0 };
+	int i;
+
+	vtu_op = VTUOP_OP_LOAD;
+	__sw_write(priv, MARVELL_GLOBAL1, GLOBREG_VTUOP, vtu_op);
+
+	__sw_write(priv, MARVELL_GLOBAL1, GLOBREG_VTUFID, 1);
+	__sw_write(priv, MARVELL_GLOBAL1, GLOBREG_VTUSID, 0);
+
+	__sw_write(priv, MARVELL_GLOBAL1, GLOBREG_VTUVID,
+		   vid | VTUVID_VALID);
+
+	for (i = 0; i < nr_ports; ++i) {
+		int off;
+		int shift;
+
+		off = (i / 4);
+		shift = (i % 4) * 4;
+
+		regs[off] |= ports[i] << shift;
+	}
+
+	__sw_write(priv, MARVELL_GLOBAL1, GLOBREG_VTU_P03_DATA, regs[0]);
+	__sw_write(priv, MARVELL_GLOBAL1, GLOBREG_VTU_P46_DATA, regs[1]);
+
+	vtu_op |= VTUOP_BUSY;
+	__sw_write(priv, MARVELL_GLOBAL1, GLOBREG_VTUOP, vtu_op);
+
+	__vtu_wait(priv);
+}
+
+static void fbxgw7r_sw_config_phy_port(struct sw_priv *priv, int phy_port)
+{
+	u16 val;
+
+	/* power up phy for eth port 0 */
+	val = sw_c22_read(priv, phy_port, 0x00);
+	val &= ~0x0800;
+	sw_c22_write(priv, phy_port, 0x00, val);
+
+
+	/* restart autoneg */
+	val = sw_c22_read(priv, phy_port, 0x00);
+	val |= 0x0200;
+	sw_c22_write(priv, phy_port, 0x00, val);
+
+	sw_c22_write(priv, phy_port, 20, 0);
+}
+
+/*
+ * Serdes PHY must be accessed using clause 45 access. phy address is
+ * 0x15 (same as it would be for normal clause 22 addresses). function
+ * must be 0x4.
+ *
+ * standard phy registers are at offset 0x2000, in function 4.
+ *
+ * similar to the clause 22 copper phys, the only required stuff is to
+ * clear the power down bit and restart the autoneg.
+ */
+#define C45_BMCR	0x2000
+#define C45_ADVERTISE	0x2004
+
+static void fbxgw7r_sw_config_serdes_port(struct sw_priv *priv, int phy_port)
+{
+	u16 reg;
+
+	/* 1000BASE-X + autoneg */
+	change_p5_cmode(priv, 0x9);
+
+	reg = sw_c45_read(priv, phy_port, 0x4, C45_ADVERTISE);
+	reg |= ADVERTISE_1000XFULL | ADVERTISE_1000XHALF;
+	sw_c45_write(priv, phy_port, 0x4, C45_ADVERTISE, reg);
+	reg = sw_c45_read(priv, phy_port, 0x4, C45_ADVERTISE);
+
+	reg = sw_c45_read(priv, phy_port, 0x4, C45_BMCR);
+	reg &= ~BMCR_PDOWN;
+	sw_c45_write(priv, phy_port, 0x4, C45_BMCR, reg);
+
+	reg |= BMCR_ANRESTART | BMCR_ANENABLE;
+	sw_c45_write(priv, phy_port, 0x4, C45_BMCR, reg);
+}
+
+static void fbxgw7r_sw_port_default_vid(struct sw_priv *priv,
+				      int swport, u16 vid)
+{
+	u16 val;
+
+	val = __sw_read(priv, swport, PORTREG_VLANID);
+	val &= ~0xfff;
+	val |= vid;
+	__sw_write(priv, swport, PORTREG_VLANID, val);
+}
+
+static void fbxgw7r_sw_port_dot1q_secure(struct sw_priv *priv, int swport)
+{
+	u16 val;
+
+	val = __sw_read(priv, swport, PORTREG_PCR2);
+	val &= ~(3 << PCR2_MODE_SHIFT);
+	val |= (PCR2_MODE_SECURE << PCR2_MODE_SHIFT);
+	__sw_write(priv, swport, PORTREG_PCR2, val);
+}
+
+static void fbxgw7r_sw_port_forward_enable(struct sw_priv *priv, int swport)
+{
+	u16 val;
+
+	/* enable forwarding */
+	val = __sw_read(priv, swport, PORTREG_PCR);
+	val |= PCR_PORTSTATE_FORWARDING;
+	__sw_write(priv, swport, PORTREG_PCR, val);
+}
+
+
+static int sw_wait_on_gsr_bit(struct sw_priv *priv, int bit)
+{
+	u16 mask = (1 << bit);
+	u16 reg;
+	int tries = 100;
+
+	do {
+		reg = __sw_read(priv, MARVELL_GLOBAL1, GLOBAL1_GSR);
+		if ((reg & mask))
+			break;
+		msleep(10);
+	} while (--tries);
+
+	if (!tries)
+		return -ETIMEDOUT;
+
+	return 0;
+}
+
+static int wait_sw_ready(struct sw_priv *priv)
+{
+	int error;
+
+	error = sw_wait_on_gsr_bit(priv, GSR_INITREADY_BIT);
+	if (error) {
+		pr_err("timed out waiting for switch ready bit.\n");
+		return error;
+	}
+	error = sw_wait_on_gsr_bit(priv, GSR_PPU_POLLING_BIT);
+	if (error) {
+		pr_err("timed out waiting for switch ready bit.\n");
+		return error;
+	}
+	return error;
+}
+
+static int mv6141_config(struct sw_priv *priv)
+{
+	struct device *dev = &priv->mdiodev->dev;
+	int error;
+	u16 val;
+	const u8 config[7] = {
+		PDATA_NOT_MEMBER,
+		PDATA_MEMBER_UNTAGGED,
+		PDATA_NOT_MEMBER,
+		PDATA_NOT_MEMBER,
+		PDATA_NOT_MEMBER,
+		PDATA_MEMBER_TAGGED,
+		PDATA_NOT_MEMBER,
+	};
+
+	/* probe */
+	val = __sw_read(priv, SWPORT(0), PORTREG_SWITCH_IDENTIFIER);
+	if (PRODUCT_NUM(val) != 0x340) {
+		printk(KERN_ERR PFX "unknown switch id: 0x%03x\n",
+		       PRODUCT_NUM(val));
+		return -ENXIO;
+	}
+
+	error = wait_sw_ready(priv);
+	if (error)
+		return error;
+
+	priv->dev_id = 0x6141;
+
+	fbxgw7r_sw_config_phy_port(priv, PHYPORT(1));
+	fbxgw7r_sw_config_serdes_port(priv, PHYPORT(5));
+
+
+	fbxgw7r_sw_vtu_stu_init(priv, PCR_PORTSTATE_FORWARDING,
+				sizeof (config));
+	fbxgw7r_sw_vtu_load(priv, NFS_VLAN_ID, config, sizeof (config));
+
+	fbxgw7r_sw_port_default_vid(priv, SWPORT(1), NFS_VLAN_ID);
+	fbxgw7r_sw_port_default_vid(priv, SWPORT(5), NFS_VLAN_ID);
+	fbxgw7r_sw_port_dot1q_secure(priv, SWPORT(1));
+	fbxgw7r_sw_port_dot1q_secure(priv, SWPORT(5));
+
+	fbxgw7r_sw_port_forward_enable(priv, SWPORT(5));
+	fbxgw7r_sw_port_forward_enable(priv, SWPORT(1));
+
+	dev_info(dev, "marvell 6141 initialized\n");
+	return 0;
+}
+
+static int fbxgw7r_mv61xx_probe(struct mdio_device *mdiodev)
+{
+	struct device *dev = &mdiodev->dev;
+	struct sw_priv *priv;
+	int reset_gpio;
+	unsigned int flags;
+	u32 id;
+
+	reset_gpio = of_get_named_gpio_flags(dev->of_node,
+					     "gpio-reset", 0, &flags);
+        if (reset_gpio < 0)
+                return reset_gpio;
+
+	priv = devm_kzalloc(dev, sizeof (*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->mdiodev = mdiodev;
+	dev_info(dev, "resetting switch\n");
+
+	gpio_direction_output(reset_gpio, 0);
+	msleep(1);
+	gpiod_set_value_cansleep(gpio_to_desc(reset_gpio), 1);
+	msleep(500);
+
+	id = (unsigned long)of_device_get_match_data(dev);
+	switch (id) {
+	case 0x6141:
+		return mv6141_config(priv);
+
+	default:
+		dev_err(dev, "unsupported model\n");
+		return -ENODEV;
+	}
+
+	mdiodev->flags = MDIO_DEVICE_FLAG_PHY;
+	return 0;
+}
+
+static const struct of_device_id fbxgw7r_mv61xx_of_match[] = {
+        {
+                .compatible = "freebox,fbxgw7r-mv6141",
+                .data = (void *)0x6141,
+        },
+        { /* sentinel */ },
+};
+
+static struct mdio_driver fbxgw7r_mv61xx_driver = {
+	.probe  = fbxgw7r_mv61xx_probe,
+        .mdiodrv.driver = {
+                .name = "fbxgw7r-mv61xx",
+                .of_match_table = of_match_ptr(fbxgw7r_mv61xx_of_match),
+        },
+};
+
+mdio_module_driver(fbxgw7r_mv61xx_driver);
diff -Nruw linux-5.4.60-fbx/drivers/platform/fbxgw7r./Kconfig linux-5.4.60-fbx/drivers/platform/fbxgw7r/Kconfig
--- linux-5.4.60-fbx/drivers/platform/fbxgw7r./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/platform/fbxgw7r/Kconfig	2021-03-04 13:20:59.600838970 +0100
@@ -0,0 +1,6 @@
+config FBXGW7R_PLATFORM
+	bool "Freebox Gateway V7 specific drivers"
+
+config FBXGW7R_SWITCH
+	bool "Freebox Gateway V7 in kernel switch init code."
+	depends on FBXGW7R_PLATFORM
diff -Nruw linux-5.4.60-fbx/drivers/platform/fbxgw7r./Makefile linux-5.4.60-fbx/drivers/platform/fbxgw7r/Makefile
--- linux-5.4.60-fbx/drivers/platform/fbxgw7r./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/platform/fbxgw7r/Makefile	2021-03-04 13:20:59.600838970 +0100
@@ -0,0 +1 @@
+obj-$(CONFIG_FBXGW7R_SWITCH)	+= fbxgw7r-switch.o
diff -Nruw linux-5.4.60-fbx/drivers/platform/intelce./Kconfig linux-5.4.60-fbx/drivers/platform/intelce/Kconfig
--- linux-5.4.60-fbx/drivers/platform/intelce./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/platform/intelce/Kconfig	2021-03-04 13:20:59.600838970 +0100
@@ -0,0 +1,18 @@
+#
+# IntelCE devices configuration
+#
+
+menu "IntelCE devices"
+
+config INTELCE_GPIO
+	tristate "GPIO support"
+	select ARCH_REQUIRE_GPIOLIB
+	---help---
+	  IntelCE 3100/4100 GPIO support.
+
+config INTELCE_DFX
+	tristate "DFX reporting support"
+	---help---
+	  IntelCE 3100/4100 DFX fuse reporting support.
+
+endmenu
diff -Nruw linux-5.4.60-fbx/drivers/platform/intelce./Makefile linux-5.4.60-fbx/drivers/platform/intelce/Makefile
--- linux-5.4.60-fbx/drivers/platform/intelce./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/platform/intelce/Makefile	2021-03-04 13:20:59.600838970 +0100
@@ -0,0 +1,2 @@
+obj-$(CONFIG_INTELCE_GPIO)	+= gpio-intelce.o
+obj-$(CONFIG_INTELCE_DFX)	+= dfx.o
diff -Nruw linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx./Kconfig linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx/Kconfig
--- linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx/Kconfig	2021-03-04 13:20:59.834172314 +0100
@@ -0,0 +1,35 @@
+config SOC_BCM63XX
+	bool "Broadcom 63xx SoC drivers"
+	depends on ARCH_BCM_63XX || ARM64 || COMPILE_TEST
+	select RESET_CONTROLLER
+	help
+	  Enables drivers for the Broadcom 63XX series of chips.
+	  This option alone enables only some support code, while the drivers
+	  can be enabled individually within this menu.
+
+	  If unsure, say N.
+
+config UBUS4_BCM63158
+	bool "Broadcom 63158 UBUS4 driver"
+	depends on SOC_BCM63XX || COMPILE_TEST
+
+config PROCMON_BCM63158
+	bool "Broadcom 63158 PROCMON driver"
+	depends on SOC_BCM63XX || COMPILE_TEST
+
+config SOC_BCM63XX_RDP
+	bool "rdp subsystem"
+	depends on SOC_BCM63XX || COMPILE_TEST
+
+config SOC_BCM63XX_XRDP
+	bool "xrdp subsystem"
+	depends on SOC_BCM63XX || COMPILE_TEST
+	select UBUS4_BCM63158
+
+config SOC_BCM63XX_XRDP_IOCTL
+	bool "ioctl interface"
+	depends on SOC_BCM63XX_XRDP
+
+config SOC_MEMC_BCM63158
+	tristate "Broadcom 63158 MEMC driver"
+	depends on SOC_BCM63XX || COMPILE_TEST
diff -Nruw linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx./Makefile linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx/Makefile
--- linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx/Makefile	2021-03-04 13:20:59.834172314 +0100
@@ -0,0 +1,6 @@
+obj-y += pmc.o
+obj-$(CONFIG_SOC_BCM63XX_RDP) += rdp/
+obj-$(CONFIG_SOC_BCM63XX_XRDP) += xrdp/
+obj-$(CONFIG_UBUS4_BCM63158)	+= ubus4-bcm63158.o
+obj-$(CONFIG_PROCMON_BCM63158)	+= procmon-bcm63158.o
+obj-$(CONFIG_SOC_MEMC_BCM63158)	+= memc-bcm63158.o
diff -Nruw linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx./rdp/Makefile linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx/rdp/Makefile
--- linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx./rdp/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx/rdp/Makefile	2021-03-04 13:20:59.834172314 +0100
@@ -0,0 +1,9 @@
+obj-y += rdp_drv.o
+
+rdp_drv-y += \
+	rdp.o \
+	rdp_api.o \
+	rdp_io.o \
+	rdp_ioctl.o
+
+rdp_drv-$(CONFIG_DEBUG_FS) += rdp_debug.o
diff -Nruw linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx./xrdp/Makefile linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx/xrdp/Makefile
--- linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx./xrdp/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/drivers/soc/bcm/bcm63xx/xrdp/Makefile	2021-03-04 13:20:59.834172314 +0100
@@ -0,0 +1,8 @@
+obj-y += xrdp_drv.o
+
+xrdp_drv-y += \
+	xrdp.o \
+	xrdp_api.o
+
+xrdp_drv-$(CONFIG_SOC_BCM63XX_XRDP_IOCTL) += xrdp_ioctl.o
+xrdp_drv-$(CONFIG_DEBUG_FS) += xrdp_debug.o
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/drivers/video/fbdev/ssd1327.c	2021-03-04 13:21:00.167505662 +0100
@@ -0,0 +1,873 @@
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/sched.h>
+#include <linux/spi/spi.h>
+#include <linux/workqueue.h>
+#include <linux/gpio.h>
+#include <linux/fb.h>
+#include <linux/platform_device.h>
+#include <linux/uaccess.h>
+#include <linux/vmalloc.h>
+#include <linux/backlight.h>
+#include <linux/of_device.h>
+#include <linux/of_gpio.h>
+#include <linux/reset.h>
+
+
+/*
+ * commands
+ */
+#define OPCODE_CONTRAST		0x81
+
+#define OPCODE_SET_COLUMN	0x15
+#define OPCODE_SET_ROW		0x75
+#define OPCODE_SET_REMAP	0xa0
+#define OPCODE_DISPLAY_NORMAL	0xa4
+#define OPCODE_DISPLAY_ALL_ON	0xa5
+#define OPCODE_DISPLAY_ALL_OFF	0xa6
+
+#define OPCODE_SET_MULTIPLEX_RATIO	0xa8
+#define OPCODE_SET_FUNC_A		0xab
+
+#define OPCODE_DISPLAY_OFF	0xae
+#define OPCODE_DISPLAY_ON	0xaf
+
+#define OPCODE_SET_PHASE_LENGTH		0xb1
+#define OPCODE_SET_FRONT_CLOCK_DIV	0xb3
+#define OPCODE_UNKNOWN			0xb4 // for brightness enhancement?
+#define OPCODE_SET_2ND_PRECHARGE	0xb6
+#define OPCODE_SET_GRAYSCALE_TBL	0xb8
+#define OPCODE_DEF_GRAY			0xb9
+
+#define OPCODE_SET_PRECHARGE_VOLTAGE	0xbc
+#define OPCODE_SET_VCOMM_VOLTAGE	0xbe
+
+#define OPCODE_SET_FUNC_B		0xd5
+
+#define SSD1327_MAX_BRIGHTNESS		0x81
+#define SSD1327_NOMINAL_BRIGHTNESS	0x64
+
+/*
+ * fbinfo
+ */
+static struct fb_fix_screeninfo ssd1327_fb_fix = {
+	.id		= "ssd1327",
+	.type		= FB_TYPE_PACKED_PIXELS,
+	.visual		= FB_VISUAL_STATIC_PSEUDOCOLOR,
+	.xpanstep	= 0,
+	.ypanstep	= 1,
+	.ywrapstep	= 0,
+	.accel		= FB_ACCEL_NONE,
+};
+
+static struct fb_var_screeninfo ssd1327_fb_var = {
+	.bits_per_pixel	= 8,
+	.grayscale	= 1,
+	.nonstd		= 1,
+	.red.length	= 8,
+	.green.length	= 8,
+	.blue.length	= 8,
+};
+
+/*
+ * private data
+ */
+#define SSD1327_COLS		64
+#define SSD1327_ROWS		128
+#define GDDRAM_SIZE		SSD1327_COLS * SSD1327_ROWS
+
+struct ssd1327 {
+	struct mutex			mutex;
+
+	/* configuration from device tree */
+	u32				width;
+	u32				height;
+	u32				rotate;
+	u32				watchdog;
+
+	/* image of display ram */
+	u8				gddram[GDDRAM_SIZE];
+	u8				old_gddram[GDDRAM_SIZE];
+
+	/* data ram, 8 bits per pixel */
+	u8				*vmem;
+	unsigned int			vmem_size;
+
+
+	struct fb_info			*fb;
+	struct gpio_desc		*vcc_gpio;
+	struct reset_control		*reset;
+	struct gpio_desc		*reset_gpio;
+	struct gpio_desc		*data_gpio;
+	struct spi_device		*spi;
+
+	struct backlight_device		*backlight;
+	unsigned int			brightness;
+
+	/* watchog timer */
+	struct delayed_work		wtd_work;
+	atomic_t			wtd_count;
+
+	const char			*init_seq;
+};
+
+/*
+ * send command to device
+ */
+static int send_cmd(struct ssd1327 *priv, u8 cmd)
+{
+	int ret;
+
+	mutex_lock(&priv->mutex);
+	gpiod_set_value(priv->data_gpio, 0);
+	ret = spi_write_then_read(priv->spi, &cmd, 1, NULL, 0);
+	mutex_unlock(&priv->mutex);
+	return ret;
+}
+
+/*
+ * send command list to device
+ */
+static int send_cmds(struct ssd1327 *priv, const u8 *cmd, unsigned int len)
+{
+	unsigned int i;
+	int ret;
+
+	for (i = 0; i < len; i++) {
+		ret = send_cmd(priv, cmd[i]);
+		if (ret < 0)
+			return ret;
+	}
+	return 0;
+}
+
+/*
+ * write given data into device gddram
+ */
+static int write_data(struct ssd1327 *priv, u8 *tx, unsigned int size)
+{
+	int ret;
+
+	mutex_lock(&priv->mutex);
+	gpiod_set_value(priv->data_gpio, 1);
+	ret = spi_write(priv->spi, tx, size);
+	mutex_unlock(&priv->mutex);
+	return ret;
+}
+
+static inline bool ssd1327_reset_needed(struct ssd1327 *priv)
+{
+	return priv->reset_gpio ||
+		(priv->reset && reset_control_status(priv->reset));
+}
+
+static inline void ssd1327_reset_assert(struct ssd1327 *priv)
+{
+	if (priv->reset)
+		reset_control_assert(priv->reset);
+	if (priv->reset_gpio)
+		gpiod_direction_output(priv->reset_gpio, 0);
+}
+
+static inline void ssd1327_reset_deassert(struct ssd1327 *priv)
+{
+	if (priv->reset)
+		reset_control_deassert(priv->reset);
+	if (priv->reset_gpio)
+		gpiod_direction_output(priv->reset_gpio, 1);
+}
+
+/*
+ * soft reset & initialize ssd1327
+ */
+static int ssd1327_init(struct ssd1327 *priv)
+{
+	/*
+	 * init sequence used in fbxgw1r/fbxgw2r (incl. FreeboxOne,
+	 * even if it should use the p32202 init sequence).
+	 */
+	const u8 init_cmds_other[] = { OPCODE_DISPLAY_ON,
+
+				 /* set even/odd splitting */
+				 OPCODE_SET_REMAP, (1 << 6),
+				 OPCODE_CONTRAST, SSD1327_NOMINAL_BRIGHTNESS,
+				 OPCODE_DEF_GRAY,
+				 OPCODE_DISPLAY_NORMAL,
+	};
+	/*
+	 * init sequence for p32202 screen, found on jbxgw7r
+	 */
+	const u8 init_cmds_p32202[] = {
+		OPCODE_DISPLAY_OFF,
+		/* set even/odd splitting */
+		OPCODE_SET_REMAP, (1 << 6),
+		OPCODE_DISPLAY_NORMAL,
+
+		OPCODE_SET_MULTIPLEX_RATIO, 0x7f,
+		OPCODE_SET_FUNC_A, 0x01,
+		OPCODE_CONTRAST, 0xa5,
+		OPCODE_SET_PHASE_LENGTH, 0x31,
+		OPCODE_SET_FRONT_CLOCK_DIV, 0xc1,
+		OPCODE_UNKNOWN, 0xb5,
+		OPCODE_SET_2ND_PRECHARGE, 0x0d,
+		OPCODE_SET_PRECHARGE_VOLTAGE, 0x04,
+		OPCODE_SET_VCOMM_VOLTAGE, 0x07,
+		OPCODE_SET_FUNC_B, 0x60,
+
+		OPCODE_DISPLAY_ON,
+	};
+	const u8 *init_cmds;
+	size_t init_cmds_size;
+	int ret;
+
+	/* check if we need to powerup */
+	if (ssd1327_reset_needed(priv)) {
+		dev_info(&priv->spi->dev, "reset held, powerup needed");
+
+		ssd1327_reset_assert(priv);
+		msleep(500);
+
+		gpiod_direction_output(priv->vcc_gpio, 0);
+		ssd1327_reset_deassert(priv);
+		msleep(10);
+		gpiod_direction_output(priv->vcc_gpio, 1);
+		msleep(100);
+	}
+
+	/* zero ram */
+	ret = write_data(priv, priv->gddram, GDDRAM_SIZE);
+	if (ret)
+		return ret;
+
+	/*
+	 * select init command depending on device tree property, use
+	 * init_cmds_other by default.
+	 */
+	if (priv->init_seq && !strcmp(priv->init_seq, "p32202")) {
+		dev_dbg(&priv->spi->dev,  "using init sequence for "
+			 "p32202 part.\n");
+		init_cmds = init_cmds_p32202;
+		init_cmds_size = sizeof (init_cmds_p32202);
+	} else {
+		init_cmds = init_cmds_other;
+		init_cmds_size = sizeof (init_cmds_other);
+	}
+
+	return send_cmds(priv, init_cmds, init_cmds_size);
+}
+
+/*
+ * update area
+ */
+static int ssd1327_fb_update(struct ssd1327 *priv)
+{
+	unsigned int col, row, w, h, i, count;
+	unsigned char *vmem;
+	u8 *start;
+	u8 ccmds[3] = { OPCODE_SET_COLUMN, 0, 0x3f };
+	u8 rcmds[3] = { OPCODE_SET_ROW, 0, 0x7f };
+	int toggle, last_toggle_pos, moved;
+
+	w = priv->width;
+	h = priv->height;
+
+	/* backup previous gddram */
+	memcpy(priv->old_gddram, priv->gddram, GDDRAM_SIZE);
+
+	vmem = priv->vmem + w * priv->fb->var.yoffset;
+
+	for (row = 0; row < SSD1327_ROWS; row++) {
+
+		if (row >= h)
+			break;
+
+		for (col = 0; col < SSD1327_COLS; col++) {
+			unsigned int nibble;
+			u8 val;
+
+			val = 0;
+			for (nibble = 0; nibble < 2; nibble++) {
+				unsigned int off, x;
+				u8 vval;
+
+				x = col * 2 + nibble;
+				if (x >= w)
+					break;
+
+				switch (priv->fb->var.rotate) {
+				case 0:
+				default:
+					off = row * w + x;
+					break;
+
+				case 180:
+					off = w * h - (row * w + x) - 1;
+					break;
+
+				case 90:
+					off = (w - x - 1) * w + row;
+					break;
+
+				case 270:
+					off = x * w + (h - row - 1);
+					break;
+				}
+
+				vval = vmem[off] >> 4;
+				val |= vval << (nibble * 4);
+			}
+
+			priv->gddram[row * SSD1327_COLS + col] = val;
+		}
+	}
+
+	/* count consecutive toggled bytes, each column/row address
+	 * change adds 6 bytes to send  */
+	moved = toggle = 0;
+	last_toggle_pos = -INT_MAX;
+	count = 0;
+	for (i = 0; i < GDDRAM_SIZE; i++) {
+		if (priv->gddram[i] ^ priv->old_gddram[i]) {
+			/* if crossing column boundary and first
+			 * address is not 0, we must send column
+			 * command */
+			if (moved && ((i % SSD1327_COLS) == 0)) {
+				count += 3;
+				moved = 0;
+			}
+
+			if (!toggle) {
+				if (i - last_toggle_pos < 6) {
+					unsigned int j;
+
+					/* fake last columns as dirty,
+					 * cheaper than repositionning
+					 * cursor */
+					for (j = last_toggle_pos; j < i; j++)
+						priv->old_gddram[j] =
+							~priv->gddram[j];
+
+					count += i - last_toggle_pos - 1;
+				} else {
+					/* send command to change
+					 * address & column */
+					count += 6;
+
+					/* if we changed first column address
+					 * to non 0, remember it */
+					if ((i % SSD1327_COLS))
+						moved = 1;
+					else
+						moved = 0;
+				}
+			}
+
+			toggle = 1;
+			count++;
+
+		} else {
+			if (toggle)
+				last_toggle_pos = i - 1;
+			toggle = 0;
+		}
+	}
+
+	/* force full gddram update if we would send more bytes
+	 * using clever update */
+	if (count > GDDRAM_SIZE)
+		return write_data(priv, priv->gddram, GDDRAM_SIZE);
+
+	moved = toggle = 0;
+	count = 0;
+	start = NULL;
+	for (i = 0; i < GDDRAM_SIZE; i++) {
+
+		if (priv->gddram[i] ^ priv->old_gddram[i]) {
+			/* if crossed column boundary and first
+			 * address is not 0, we must send command to
+			 * reset column*/
+			if (moved && ((i % SSD1327_COLS) == 0)) {
+				write_data(priv, start, count);
+				start += count;
+				count = 0;
+				ccmds[1] = 0;
+				send_cmds(priv, ccmds, 3);
+				moved = 0;
+			}
+
+			if (!toggle) {
+				ccmds[1] = i % SSD1327_COLS;
+				rcmds[1] = i / SSD1327_COLS;
+				send_cmds(priv, ccmds, 3);
+				send_cmds(priv, rcmds, 3);
+
+				/* if we changed first column address
+				 * to non 0, remember it */
+				if ((i % SSD1327_COLS))
+					moved = 1;
+				else
+					moved = 0;
+				start = &priv->gddram[i];
+			}
+
+			count++;
+			toggle = 1;
+
+		} else {
+			if (count) {
+				write_data(priv, start, count);
+				count = 0;
+			}
+			toggle = 0;
+		}
+	}
+
+	if (count)
+		write_data(priv, start, count);
+
+	/* reset position */
+	ccmds[1] = 0;
+	send_cmds(priv, ccmds, 3);
+	rcmds[1] = 0;
+	send_cmds(priv, rcmds, 3);
+	return 0;
+}
+
+/*
+ * frame buffer fill rect callback
+ */
+static void ssd1327_fb_fillrect(struct fb_info *info,
+				const struct fb_fillrect *rect)
+{
+	struct ssd1327 *priv = info->par;
+	sys_fillrect(info, rect);
+	atomic_set(&priv->wtd_count, priv->watchdog);
+	ssd1327_fb_update(priv);
+}
+
+/*
+ * frame buffer copy area callback
+ */
+static void ssd1327_fb_copyarea(struct fb_info *info,
+				const struct fb_copyarea *area)
+{
+	struct ssd1327 *priv = info->par;
+	sys_copyarea(info, area);
+	atomic_set(&priv->wtd_count, priv->watchdog);
+	ssd1327_fb_update(priv);
+}
+
+/*
+ * frame buffer image blit
+ */
+static void ssd1327_fb_imageblit(struct fb_info *info,
+				 const struct fb_image *image)
+{
+	struct ssd1327 *priv = info->par;
+	sys_imageblit(info, image);
+	atomic_set(&priv->wtd_count, priv->watchdog);
+	ssd1327_fb_update(priv);
+}
+
+/*
+ * frame buffer pan callback
+ */
+static int ssd1327_fb_pan(struct fb_var_screeninfo *var, struct fb_info *info)
+{
+	struct ssd1327 *priv = info->par;
+	priv->fb->var.xoffset = var->xoffset;
+	priv->fb->var.yoffset = var->yoffset;
+	atomic_set(&priv->wtd_count, priv->watchdog);
+	ssd1327_fb_update(priv);
+	return 0;
+}
+
+/*
+ * fram buffer set_par callback, set videomode
+ */
+static int ssd1327_fb_set_par(struct fb_info *info)
+{
+	struct ssd1327 *priv = info->par;
+	/* called after rotate update */
+	atomic_set(&priv->wtd_count, priv->watchdog);
+	ssd1327_fb_update(priv);
+	return 0;
+}
+
+static int ssd1327_fb_check_var(struct fb_var_screeninfo *var,
+				struct fb_info *info)
+{
+	unsigned int rotate;
+
+	rotate = var->rotate;
+	if (rotate != 0 && rotate != 90 && rotate != 180 && rotate != 270)
+		rotate = 0;
+	*var = info->var;
+	var->rotate = rotate;
+	return 0;
+}
+
+/*
+ * frame buffer blank callback
+ */
+static int ssd1327_fb_blank(int blank, struct fb_info *info)
+{
+	return 0;
+}
+
+/*
+ * frame buffer write from userspace
+ */
+static ssize_t ssd1327_fb_write(struct fb_info *info, const char __user *buf,
+				size_t count, loff_t *ppos)
+{
+	struct ssd1327 *priv = info->par;
+	unsigned long p = *ppos;
+	void *dst;
+	int err = 0;
+	unsigned long total_size;
+
+	if (info->state != FBINFO_STATE_RUNNING)
+		return -EPERM;
+
+	total_size = info->fix.smem_len;
+
+	if (p > total_size)
+		return -EFBIG;
+
+	if (count > total_size) {
+		err = -EFBIG;
+		count = total_size;
+	}
+
+	if (count + p > total_size) {
+		if (!err)
+			err = -ENOSPC;
+
+		count = total_size - p;
+	}
+
+	dst = (void __force *)(info->screen_base + p);
+
+	if (copy_from_user(dst, buf, count))
+		err = -EFAULT;
+
+	if  (!err)
+		*ppos += count;
+
+	atomic_set(&priv->wtd_count, priv->watchdog);
+	ssd1327_fb_update(priv);
+
+	return (err) ? err : count;
+}
+
+static struct fb_ops ssd1327_fb_ops = {
+	.owner		= THIS_MODULE,
+	.fb_write	= ssd1327_fb_write,
+	.fb_fillrect	= ssd1327_fb_fillrect,
+	.fb_copyarea	= ssd1327_fb_copyarea,
+	.fb_imageblit	= ssd1327_fb_imageblit,
+	.fb_pan_display	= ssd1327_fb_pan,
+	.fb_blank	= ssd1327_fb_blank,
+	.fb_check_var	= ssd1327_fb_check_var,
+	.fb_set_par	= ssd1327_fb_set_par,
+};
+
+/*
+ * watchdog timer
+ */
+static void wtd_work_cb(struct work_struct *t)
+{
+	struct ssd1327 *priv;
+	struct delayed_work *dwork;
+
+	dwork = container_of(t, struct delayed_work, work);
+	priv = container_of(dwork, struct ssd1327, wtd_work);
+
+	if (atomic_dec_and_test(&priv->wtd_count)) {
+		dev_err(&priv->spi->dev, "watchdog triggered\n");
+		memset(priv->vmem, 0, priv->vmem_size);
+		ssd1327_fb_update(priv);
+	}
+
+	schedule_delayed_work(&priv->wtd_work, HZ);
+}
+
+/*
+ * backlight control
+ */
+static int ssd1327_bl_update_status(struct backlight_device *bl)
+{
+	struct ssd1327 *priv;
+	u8 bl_cmds[2];
+	int ret;
+
+	priv = bl_get_data(bl);
+
+	bl_cmds[0] = OPCODE_CONTRAST;
+	bl_cmds[1] = bl->props.brightness;
+
+	ret = send_cmds(priv, bl_cmds, sizeof (bl_cmds));
+	if (ret < 0)
+		return ret;
+	priv->brightness = bl->props.brightness;
+	return 0;
+}
+
+static int ssd1327_bl_get_brightness(struct backlight_device *bl)
+{
+	struct ssd1327 *priv;
+	priv = bl_get_data(bl);
+	return priv->brightness;
+}
+
+static struct backlight_ops ssd1327_bl_ops = {
+	.update_status		= ssd1327_bl_update_status,
+	.get_brightness		= ssd1327_bl_get_brightness,
+};
+
+static const struct backlight_properties ssd1327_bl_props = {
+	.power		= FB_BLANK_UNBLANK,
+	.fb_blank	= FB_BLANK_UNBLANK,
+	.max_brightness	= SSD1327_MAX_BRIGHTNESS,
+	.type		= BACKLIGHT_RAW,
+};
+
+static int init_backlight(struct ssd1327 *priv)
+{
+	struct backlight_device *bl;
+
+	bl = backlight_device_register("ssd1327", &priv->spi->dev,
+				       priv, &ssd1327_bl_ops,
+				       &ssd1327_bl_props);
+	if (IS_ERR(bl)) {
+		dev_err(&priv->spi->dev, "error %ld on backlight register\n",
+			PTR_ERR(bl));
+		return PTR_ERR(bl);
+	}
+	priv->backlight = bl;
+	bl->props.brightness = priv->brightness;
+	return 0;
+}
+
+/*
+ * platform device probe callback
+ */
+static int ssd1327_probe(struct spi_device *spi)
+{
+	struct device_node *node = spi->dev.of_node;
+	struct ssd1327 *priv;
+	struct fb_info *fb;
+	int ret;
+
+	if (!node) {
+		dev_err(&spi->dev, "No device tree data found!\n");
+		return -EINVAL;
+	}
+
+	fb = framebuffer_alloc(sizeof (*priv), &spi->dev);
+	if (!fb)
+		return -ENOMEM;
+
+	priv = fb->par;
+	mutex_init(&priv->mutex);
+	priv->spi = spi;
+	priv->fb = fb;
+	priv->brightness = SSD1327_NOMINAL_BRIGHTNESS;
+
+	priv->reset = devm_reset_control_get_shared_by_index(&spi->dev, 0);
+	if (IS_ERR(priv->reset)) {
+		ret = PTR_ERR(priv->reset);
+		if (ret == -ENOENT)
+			priv->reset = NULL;
+		else {
+			if (ret != -EPROBE_DEFER)
+				dev_err(&spi->dev, "failed to get reset: %d\n",
+					ret);
+			goto fail;
+		}
+	}
+
+	priv->reset_gpio = devm_gpiod_get(&spi->dev, "ssd1327,reset",
+					  GPIOD_ASIS);
+	if (IS_ERR(priv->reset_gpio)) {
+		ret = PTR_ERR(priv->reset_gpio);
+		if (ret == -ENOENT)
+			priv->reset_gpio = NULL;
+		else {
+			if (ret != -EPROBE_DEFER)
+				dev_err(&spi->dev, "failed to get reset gpio: "
+					"%d\n", ret);
+			goto fail;
+		}
+	}
+
+	priv->vcc_gpio = NULL;
+	if (priv->reset_gpio || priv->reset) {
+		priv->vcc_gpio = devm_gpiod_get(&spi->dev, "ssd1327,vcc",
+						GPIOD_ASIS);
+		if (IS_ERR(priv->vcc_gpio)) {
+			ret = PTR_ERR(priv->vcc_gpio);
+			if (ret != -EPROBE_DEFER)
+				dev_err(&spi->dev,
+					"failed to get vcc gpio: %d\n", ret);
+			goto fail;
+		}
+	}
+
+	priv->data_gpio = devm_gpiod_get(&spi->dev,
+					 "ssd1327,data-select",
+					 GPIOD_OUT_LOW);
+	if (IS_ERR(priv->data_gpio)) {
+		ret = PTR_ERR(priv->data_gpio);
+		if (ret != -EPROBE_DEFER)
+			dev_err(&spi->dev, "failed to get data gpio: %d\n",
+				ret);
+		goto fail;
+	}
+
+	ret = of_property_read_u32(node, "ssd1327,width", &priv->width);
+	if (ret) {
+		dev_err(&spi->dev, "failed to get width\n");
+		goto fail;
+	}
+
+	ret = of_property_read_u32(node, "ssd1327,height", &priv->height);
+	if (ret) {
+		dev_err(&spi->dev, "failed to get height\n");
+		goto fail;
+	}
+
+	/* sanity check on screen size */
+	if (priv->width > SSD1327_COLS * 2 ||
+	    priv->height > SSD1327_ROWS) {
+		dev_err(&spi->dev, "unsupported screen dimension\n");
+		goto fail;
+	}
+
+	ret = of_property_read_u32(node, "ssd1327,rotate", &priv->rotate);
+	if (ret) {
+		dev_err(&spi->dev, "failed to get rotate\n");
+		goto fail;
+	}
+
+	ret = of_property_read_u32(node, "ssd1327,watchdog", &priv->watchdog);
+	if (ret) {
+		dev_err(&spi->dev, "failed to get watchdog\n");
+		goto fail;
+	}
+
+	priv->init_seq = NULL;
+	of_property_read_string(node, "ssd1327,init-sequence", &priv->init_seq);
+
+	/* setup framebuffer */
+	fb->fbops = &ssd1327_fb_ops;
+	fb->flags = FBINFO_FLAG_DEFAULT | FBINFO_HWACCEL_YPAN;
+	fb->var = ssd1327_fb_var;
+	fb->fix = ssd1327_fb_fix;
+
+	fb->var.xres = priv->width;
+	fb->var.yres = priv->height;
+	fb->var.xres_virtual = priv->width;
+	fb->var.yres_virtual = priv->height * 2;
+
+	/* twice lcd size so we can pan in one direction */
+	fb->fix.smem_len = (priv->width * priv->height) * 2;
+	fb->fix.line_length = priv->width;
+	fb->var.rotate = priv->rotate;
+
+	/* allocate video memory */
+	priv->vmem_size = PAGE_ALIGN(fb->fix.smem_len);
+	priv->vmem = vmalloc(priv->vmem_size);
+	if (!priv->vmem) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+	memset(priv->vmem, 0, priv->vmem_size);
+	fb->screen_base = (char __iomem *)priv->vmem;
+
+	ret = ssd1327_init(priv);
+	if (ret)
+		goto fail;
+
+	if (init_backlight(priv))
+		goto fail;
+
+	/* register frame buffer */
+	ret = register_framebuffer(fb);
+	if (ret < 0)
+		goto fail;
+
+	INIT_DELAYED_WORK(&priv->wtd_work, wtd_work_cb);
+
+	if (priv->watchdog) {
+		atomic_set(&priv->wtd_count, priv->watchdog);
+		schedule_delayed_work(&priv->wtd_work, HZ);
+	}
+
+	dev_info(&spi->dev,
+		 "fb%d: SSD1327 frame buffer device (%ux%u screen)\n",
+		 fb->node, priv->width, priv->height);
+
+	dev_set_drvdata(&spi->dev, priv);
+	return 0;
+
+fail:
+	if (priv->vmem)
+		vfree(priv->vmem);
+	if (priv->backlight)
+		backlight_device_unregister(priv->backlight);
+	framebuffer_release(fb);
+	return ret;
+}
+
+/*
+ * platform device remove callback
+ */
+static int ssd1327_remove(struct spi_device *spi)
+{
+	struct ssd1327 *priv;
+	unsigned int i;
+
+	priv = dev_get_drvdata(&spi->dev);
+	cancel_delayed_work_sync(&priv->wtd_work);
+	unregister_framebuffer(priv->fb);
+	for (i = 0; i < priv->vmem_size; i += PAGE_SIZE) {
+		struct page *page;
+		page = vmalloc_to_page(priv->vmem + i);
+		page->mapping = NULL;
+	}
+	vfree(priv->vmem);
+	backlight_device_unregister(priv->backlight);
+	framebuffer_release(priv->fb);
+	return 0;
+}
+
+
+static const struct of_device_id ssd1327_of_match[] = {
+	{
+		.compatible = "solomon,ssd1327",
+	},
+	{},
+};
+MODULE_DEVICE_TABLE(of, ssd1327_of_match);
+
+static struct spi_driver ssd1327_driver = {
+	.driver = {
+		.name		= "ssd1327",
+		.of_match_table	= ssd1327_of_match,
+	},
+	.probe		= ssd1327_probe,
+	.remove		= ssd1327_remove,
+};
+
+module_spi_driver(ssd1327_driver);
+
+MODULE_DESCRIPTION("SSD1327 driver");
+MODULE_AUTHOR("Maxime Bizon <mbizon@freebox.fr>");
+MODULE_LICENSE("GPL");
diff -Nruw linux-5.4.60-fbx/fs/cifsd./asn1.c linux-5.4.60-fbx/fs/cifsd/asn1.c
--- linux-5.4.60-fbx/fs/cifsd./asn1.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/asn1.c	2021-04-21 10:06:25.185180826 +0200
@@ -0,0 +1,702 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * The ASB.1/BER parsing code is derived from ip_nat_snmp_basic.c which was in
+ * turn derived from the gxsnmp package by Gregory McLean & Jochen Friedrich
+ *
+ * Copyright (c) 2000 RP Internet (www.rpi.net.au).
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+
+#include "glob.h"
+
+#include "asn1.h"
+#include "connection.h"
+#include "auth.h"
+
+/*****************************************************************************
+ *
+ * Basic ASN.1 decoding routines (gxsnmp author Dirk Wisse)
+ *
+ *****************************************************************************/
+
+/* Class */
+#define ASN1_UNI	0	/* Universal */
+#define ASN1_APL	1	/* Application */
+#define ASN1_CTX	2	/* Context */
+#define ASN1_PRV	3	/* Private */
+
+/* Tag */
+#define ASN1_EOC	0	/* End Of Contents or N/A */
+#define ASN1_BOL	1	/* Boolean */
+#define ASN1_INT	2	/* Integer */
+#define ASN1_BTS	3	/* Bit String */
+#define ASN1_OTS	4	/* Octet String */
+#define ASN1_NUL	5	/* Null */
+#define ASN1_OJI	6	/* Object Identifier  */
+#define ASN1_OJD	7	/* Object Description */
+#define ASN1_EXT	8	/* External */
+#define ASN1_ENUM	10	/* Enumerated */
+#define ASN1_SEQ	16	/* Sequence */
+#define ASN1_SET	17	/* Set */
+#define ASN1_NUMSTR	18	/* Numerical String */
+#define ASN1_PRNSTR	19	/* Printable String */
+#define ASN1_TEXSTR	20	/* Teletext String */
+#define ASN1_VIDSTR	21	/* Video String */
+#define ASN1_IA5STR	22	/* IA5 String */
+#define ASN1_UNITIM	23	/* Universal Time */
+#define ASN1_GENTIM	24	/* General Time */
+#define ASN1_GRASTR	25	/* Graphical String */
+#define ASN1_VISSTR	26	/* Visible String */
+#define ASN1_GENSTR	27	/* General String */
+
+/* Primitive / Constructed methods*/
+#define ASN1_PRI	0	/* Primitive */
+#define ASN1_CON	1	/* Constructed */
+
+/*
+ * Error codes.
+ */
+#define ASN1_ERR_NOERROR		0
+#define ASN1_ERR_DEC_EMPTY		2
+#define ASN1_ERR_DEC_EOC_MISMATCH	3
+#define ASN1_ERR_DEC_LENGTH_MISMATCH	4
+#define ASN1_ERR_DEC_BADVALUE		5
+
+#define SPNEGO_OID_LEN 7
+#define NTLMSSP_OID_LEN  10
+#define KRB5_OID_LEN  7
+#define KRB5U2U_OID_LEN  8
+#define MSKRB5_OID_LEN  7
+static unsigned long SPNEGO_OID[7] = { 1, 3, 6, 1, 5, 5, 2 };
+static unsigned long NTLMSSP_OID[10] = { 1, 3, 6, 1, 4, 1, 311, 2, 2, 10 };
+static unsigned long KRB5_OID[7] = { 1, 2, 840, 113554, 1, 2, 2 };
+static unsigned long KRB5U2U_OID[8] = { 1, 2, 840, 113554, 1, 2, 2, 3 };
+static unsigned long MSKRB5_OID[7] = { 1, 2, 840, 48018, 1, 2, 2 };
+
+static char NTLMSSP_OID_STR[NTLMSSP_OID_LEN] = { 0x2b, 0x06, 0x01, 0x04, 0x01,
+	0x82, 0x37, 0x02, 0x02, 0x0a };
+
+/*
+ * ASN.1 context.
+ */
+struct asn1_ctx {
+	int error;		/* Error condition */
+	unsigned char *pointer;	/* Octet just to be decoded */
+	unsigned char *begin;	/* First octet */
+	unsigned char *end;	/* Octet after last octet */
+};
+
+/*
+ * Octet string (not null terminated)
+ */
+struct asn1_octstr {
+	unsigned char *data;
+	unsigned int len;
+};
+
+static void
+asn1_open(struct asn1_ctx *ctx, unsigned char *buf, unsigned int len)
+{
+	ctx->begin = buf;
+	ctx->end = buf + len;
+	ctx->pointer = buf;
+	ctx->error = ASN1_ERR_NOERROR;
+}
+
+static unsigned char
+asn1_octet_decode(struct asn1_ctx *ctx, unsigned char *ch)
+{
+	if (ctx->pointer >= ctx->end) {
+		ctx->error = ASN1_ERR_DEC_EMPTY;
+		return 0;
+	}
+	*ch = *(ctx->pointer)++;
+	return 1;
+}
+
+static unsigned char
+asn1_tag_decode(struct asn1_ctx *ctx, unsigned int *tag)
+{
+	unsigned char ch;
+
+	*tag = 0;
+
+	do {
+		if (!asn1_octet_decode(ctx, &ch))
+			return 0;
+		*tag <<= 7;
+		*tag |= ch & 0x7F;
+	} while ((ch & 0x80) == 0x80);
+	return 1;
+}
+
+static unsigned char
+asn1_id_decode(struct asn1_ctx *ctx,
+	       unsigned int *cls, unsigned int *con, unsigned int *tag)
+{
+	unsigned char ch;
+
+	if (!asn1_octet_decode(ctx, &ch))
+		return 0;
+
+	*cls = (ch & 0xC0) >> 6;
+	*con = (ch & 0x20) >> 5;
+	*tag = (ch & 0x1F);
+
+	if (*tag == 0x1F) {
+		if (!asn1_tag_decode(ctx, tag))
+			return 0;
+	}
+	return 1;
+}
+
+static unsigned char
+asn1_length_decode(struct asn1_ctx *ctx, unsigned int *def, unsigned int *len)
+{
+	unsigned char ch, cnt;
+
+	if (!asn1_octet_decode(ctx, &ch))
+		return 0;
+
+	if (ch == 0x80)
+		*def = 0;
+	else {
+		*def = 1;
+
+		if (ch < 0x80)
+			*len = ch;
+		else {
+			cnt = (unsigned char) (ch & 0x7F);
+			*len = 0;
+
+			while (cnt > 0) {
+				if (!asn1_octet_decode(ctx, &ch))
+					return 0;
+				*len <<= 8;
+				*len |= ch;
+				cnt--;
+			}
+		}
+	}
+
+	/* don't trust len bigger than ctx buffer */
+	if (*len > ctx->end - ctx->pointer)
+		return 0;
+
+	return 1;
+}
+
+static unsigned char
+asn1_header_decode(struct asn1_ctx *ctx,
+		   unsigned char **eoc,
+		   unsigned int *cls, unsigned int *con, unsigned int *tag)
+{
+	unsigned int def = 0;
+	unsigned int len = 0;
+
+	if (!asn1_id_decode(ctx, cls, con, tag))
+		return 0;
+
+	if (!asn1_length_decode(ctx, &def, &len))
+		return 0;
+
+	/* primitive shall be definite, indefinite shall be constructed */
+	if (*con == ASN1_PRI && !def)
+		return 0;
+
+	if (def)
+		*eoc = ctx->pointer + len;
+	else
+		*eoc = NULL;
+	return 1;
+}
+
+static unsigned char
+asn1_eoc_decode(struct asn1_ctx *ctx, unsigned char *eoc)
+{
+	unsigned char ch;
+
+	if (!eoc) {
+		if (!asn1_octet_decode(ctx, &ch))
+			return 0;
+
+		if (ch != 0x00) {
+			ctx->error = ASN1_ERR_DEC_EOC_MISMATCH;
+			return 0;
+		}
+
+		if (!asn1_octet_decode(ctx, &ch))
+			return 0;
+
+		if (ch != 0x00) {
+			ctx->error = ASN1_ERR_DEC_EOC_MISMATCH;
+			return 0;
+		}
+	} else {
+		if (ctx->pointer != eoc) {
+			ctx->error = ASN1_ERR_DEC_LENGTH_MISMATCH;
+			return 0;
+		}
+	}
+	return 1;
+}
+
+static unsigned char
+asn1_subid_decode(struct asn1_ctx *ctx, unsigned long *subid)
+{
+	unsigned char ch;
+
+	*subid = 0;
+
+	do {
+		if (!asn1_octet_decode(ctx, &ch))
+			return 0;
+
+		*subid <<= 7;
+		*subid |= ch & 0x7F;
+	} while ((ch & 0x80) == 0x80);
+	return 1;
+}
+
+static int
+asn1_oid_decode(struct asn1_ctx *ctx,
+		unsigned char *eoc, unsigned long **oid, unsigned int *len)
+{
+	unsigned long subid;
+	unsigned int size;
+	unsigned long *optr;
+
+	size = eoc - ctx->pointer + 1;
+
+	/* first subid actually encodes first two subids */
+	if (size < 2 || size > UINT_MAX/sizeof(unsigned long))
+		return 0;
+
+	*oid = kmalloc(size * sizeof(unsigned long), GFP_KERNEL);
+	if (!*oid)
+		return 0;
+
+	optr = *oid;
+
+	if (!asn1_subid_decode(ctx, &subid)) {
+		kfree(*oid);
+		*oid = NULL;
+		return 0;
+	}
+
+	if (subid < 40) {
+		optr[0] = 0;
+		optr[1] = subid;
+	} else if (subid < 80) {
+		optr[0] = 1;
+		optr[1] = subid - 40;
+	} else {
+		optr[0] = 2;
+		optr[1] = subid - 80;
+	}
+
+	*len = 2;
+	optr += 2;
+
+	while (ctx->pointer < eoc) {
+		if (++(*len) > size) {
+			ctx->error = ASN1_ERR_DEC_BADVALUE;
+			kfree(*oid);
+			*oid = NULL;
+			return 0;
+		}
+
+		if (!asn1_subid_decode(ctx, optr++)) {
+			kfree(*oid);
+			*oid = NULL;
+			return 0;
+		}
+	}
+	return 1;
+}
+
+static int
+compare_oid(unsigned long *oid1, unsigned int oid1len,
+	    unsigned long *oid2, unsigned int oid2len)
+{
+	unsigned int i;
+
+	if (oid1len != oid2len)
+		return 0;
+
+	for (i = 0; i < oid1len; i++) {
+		if (oid1[i] != oid2[i])
+			return 0;
+	}
+	return 1;
+}
+
+/* BB check for endian conversion issues here */
+
+int
+ksmbd_decode_negTokenInit(unsigned char *security_blob, int length,
+		    struct ksmbd_conn *conn)
+{
+	struct asn1_ctx ctx;
+	unsigned char *end;
+	unsigned char *sequence_end;
+	unsigned long *oid = NULL;
+	unsigned int cls, con, tag, oidlen, rc, mechTokenlen;
+	unsigned int mech_type;
+
+	ksmbd_debug(AUTH, "Received SecBlob: length %d\n", length);
+
+	asn1_open(&ctx, security_blob, length);
+
+	/* GSSAPI header */
+	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+		ksmbd_debug(AUTH, "Error decoding negTokenInit header\n");
+		return 0;
+	} else if ((cls != ASN1_APL) || (con != ASN1_CON)
+		   || (tag != ASN1_EOC)) {
+		ksmbd_debug(AUTH, "cls = %d con = %d tag = %d\n", cls, con,
+			tag);
+		return 0;
+	}
+
+	/* Check for SPNEGO OID -- remember to free obj->oid */
+	rc = asn1_header_decode(&ctx, &end, &cls, &con, &tag);
+	if (rc) {
+		if ((tag == ASN1_OJI) && (con == ASN1_PRI) &&
+		    (cls == ASN1_UNI)) {
+			rc = asn1_oid_decode(&ctx, end, &oid, &oidlen);
+			if (rc) {
+				rc = compare_oid(oid, oidlen, SPNEGO_OID,
+						 SPNEGO_OID_LEN);
+				kfree(oid);
+			}
+		} else
+			rc = 0;
+	}
+
+	/* SPNEGO OID not present or garbled -- bail out */
+	if (!rc) {
+		ksmbd_debug(AUTH, "Error decoding negTokenInit header\n");
+		return 0;
+	}
+
+	/* SPNEGO */
+	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+		ksmbd_debug(AUTH, "Error decoding negTokenInit\n");
+		return 0;
+	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)
+		   || (tag != ASN1_EOC)) {
+		ksmbd_debug(AUTH,
+			"cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
+			cls, con, tag, end, *end);
+		return 0;
+	}
+
+	/* negTokenInit */
+	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+		ksmbd_debug(AUTH, "Error decoding negTokenInit\n");
+		return 0;
+	} else if ((cls != ASN1_UNI) || (con != ASN1_CON)
+		   || (tag != ASN1_SEQ)) {
+		ksmbd_debug(AUTH,
+			"cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
+			cls, con, tag, end, *end);
+		return 0;
+	}
+
+	/* sequence */
+	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+		ksmbd_debug(AUTH, "Error decoding 2nd part of negTokenInit\n");
+		return 0;
+	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)
+		   || (tag != ASN1_EOC)) {
+		ksmbd_debug(AUTH,
+			"cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
+			cls, con, tag, end, *end);
+		return 0;
+	}
+
+	/* sequence of */
+	if (asn1_header_decode
+	    (&ctx, &sequence_end, &cls, &con, &tag) == 0) {
+		ksmbd_debug(AUTH, "Error decoding 2nd part of negTokenInit\n");
+		return 0;
+	} else if ((cls != ASN1_UNI) || (con != ASN1_CON)
+		   || (tag != ASN1_SEQ)) {
+		ksmbd_debug(AUTH,
+			"cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
+			cls, con, tag, end, *end);
+		return 0;
+	}
+
+	/* list of security mechanisms */
+	while (!asn1_eoc_decode(&ctx, sequence_end)) {
+		rc = asn1_header_decode(&ctx, &end, &cls, &con, &tag);
+		if (!rc) {
+			ksmbd_debug(AUTH,
+				"Error decoding negTokenInit hdr exit2\n");
+			return 0;
+		}
+		if ((tag == ASN1_OJI) && (con == ASN1_PRI)) {
+			if (asn1_oid_decode(&ctx, end, &oid, &oidlen)) {
+				if (compare_oid(oid, oidlen, MSKRB5_OID,
+						MSKRB5_OID_LEN))
+					mech_type = KSMBD_AUTH_MSKRB5;
+				else if (compare_oid(oid, oidlen, KRB5U2U_OID,
+						     KRB5U2U_OID_LEN))
+					mech_type = KSMBD_AUTH_KRB5U2U;
+				else if (compare_oid(oid, oidlen, KRB5_OID,
+						     KRB5_OID_LEN))
+					mech_type = KSMBD_AUTH_KRB5;
+				else if (compare_oid(oid, oidlen, NTLMSSP_OID,
+						     NTLMSSP_OID_LEN))
+					mech_type = KSMBD_AUTH_NTLMSSP;
+				else {
+					kfree(oid);
+					continue;
+				}
+
+				conn->auth_mechs |= mech_type;
+				if (conn->preferred_auth_mech == 0)
+					conn->preferred_auth_mech = mech_type;
+				kfree(oid);
+			}
+		} else {
+			ksmbd_debug(AUTH,
+				"Should be an oid what is going on?\n");
+		}
+	}
+
+	/* sequence */
+	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+		ksmbd_debug(AUTH, "Error decoding 2nd part of negTokenInit\n");
+		return 0;
+	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)
+		   || (tag != ASN1_INT)) {
+		ksmbd_debug(AUTH,
+			"cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
+			cls, con, tag, end, *end);
+		return 0;
+	}
+
+	/* sequence of */
+	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+		ksmbd_debug(AUTH, "Error decoding 2nd part of negTokenInit\n");
+		return 0;
+	} else if ((cls != ASN1_UNI) || (con != ASN1_PRI)
+		   || (tag != ASN1_OTS)) {
+		ksmbd_debug(AUTH,
+			"cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
+			cls, con, tag, end, *end);
+		return 0;
+	}
+
+	mechTokenlen = ctx.end - ctx.pointer;
+	conn->mechToken = kmalloc(mechTokenlen + 1, GFP_KERNEL);
+	if (!conn->mechToken) {
+		ksmbd_err("memory allocation error\n");
+		return 0;
+	}
+
+	memcpy(conn->mechToken, ctx.pointer, mechTokenlen);
+	conn->mechToken[mechTokenlen] = '\0';
+
+	return 1;
+}
+
+int
+ksmbd_decode_negTokenTarg(unsigned char *security_blob, int length,
+		    struct ksmbd_conn *conn)
+{
+	struct asn1_ctx ctx;
+	unsigned char *end;
+	unsigned int cls, con, tag, mechTokenlen;
+
+	ksmbd_debug(AUTH, "Received Auth SecBlob: length %d\n", length);
+
+	asn1_open(&ctx, security_blob, length);
+
+	/* GSSAPI header */
+	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+		ksmbd_debug(AUTH, "Error decoding negTokenInit header\n");
+		return 0;
+	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)
+		   || (tag != ASN1_BOL)) {
+		ksmbd_debug(AUTH, "cls = %d con = %d tag = %d\n", cls, con,
+			tag);
+		return 0;
+	}
+
+	/* SPNEGO */
+	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+		ksmbd_debug(AUTH, "Error decoding negTokenInit\n");
+		return 0;
+	} else if ((cls != ASN1_UNI) || (con != ASN1_CON)
+		   || (tag != ASN1_SEQ)) {
+		ksmbd_debug(AUTH,
+			"cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
+			cls, con, tag, end, *end);
+		return 0;
+	}
+
+	/* negTokenTarg */
+	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+		ksmbd_debug(AUTH, "Error decoding negTokenInit\n");
+		return 0;
+	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)
+		   || (tag != ASN1_INT)) {
+		ksmbd_debug(AUTH,
+			"cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
+			cls, con, tag, end, *end);
+		return 0;
+	}
+
+	/* negTokenTarg */
+	if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+		ksmbd_debug(AUTH, "Error decoding negTokenInit\n");
+		return 0;
+	} else if ((cls != ASN1_UNI) || (con != ASN1_PRI)
+		   || (tag != ASN1_OTS)) {
+		ksmbd_debug(AUTH,
+			"cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
+			cls, con, tag, end, *end);
+		return 0;
+	}
+
+	mechTokenlen = ctx.end - ctx.pointer;
+	conn->mechToken = kmalloc(mechTokenlen + 1, GFP_KERNEL);
+	if (!conn->mechToken) {
+		ksmbd_err("memory allocation error\n");
+		return 0;
+	}
+
+	memcpy(conn->mechToken, ctx.pointer, mechTokenlen);
+	conn->mechToken[mechTokenlen] = '\0';
+
+	return 1;
+}
+
+static int compute_asn_hdr_len_bytes(int len)
+{
+	if (len > 0xFFFFFF)
+		return 4;
+	else if (len > 0xFFFF)
+		return 3;
+	else if (len > 0xFF)
+		return 2;
+	else if (len > 0x7F)
+		return 1;
+	else
+		return 0;
+}
+
+static void encode_asn_tag(char *buf,
+			   unsigned int *ofs,
+			   char tag,
+			   char seq,
+			   int length)
+{
+	int i;
+	int index = *ofs;
+	char hdr_len = compute_asn_hdr_len_bytes(length);
+	int len = length + 2 + hdr_len;
+
+	/* insert tag */
+	buf[index++] = tag;
+
+	if (!hdr_len)
+		buf[index++] = len;
+	else {
+		buf[index++] = 0x80 | hdr_len;
+		for (i = hdr_len - 1; i >= 0; i--)
+			buf[index++] = (len >> (i * 8)) & 0xFF;
+	}
+
+	/* insert seq */
+	len = len - (index - *ofs);
+	buf[index++] = seq;
+
+	if (!hdr_len)
+		buf[index++] = len;
+	else {
+		buf[index++] = 0x80 | hdr_len;
+		for (i = hdr_len - 1; i >= 0; i--)
+			buf[index++] = (len >> (i * 8)) & 0xFF;
+	}
+
+	*ofs += (index - *ofs);
+}
+
+int build_spnego_ntlmssp_neg_blob(unsigned char **pbuffer, u16 *buflen,
+		char *ntlm_blob, int ntlm_blob_len)
+{
+	char *buf;
+	unsigned int ofs = 0;
+	int neg_result_len = 4 + compute_asn_hdr_len_bytes(1) * 2 + 1;
+	int oid_len = 4 + compute_asn_hdr_len_bytes(NTLMSSP_OID_LEN) * 2 +
+		NTLMSSP_OID_LEN;
+	int ntlmssp_len = 4 + compute_asn_hdr_len_bytes(ntlm_blob_len) * 2 +
+		ntlm_blob_len;
+	int total_len = 4 + compute_asn_hdr_len_bytes(neg_result_len +
+			oid_len + ntlmssp_len) * 2 +
+			neg_result_len + oid_len + ntlmssp_len;
+
+	buf = kmalloc(total_len, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	/* insert main gss header */
+	encode_asn_tag(buf, &ofs, 0xa1, 0x30, neg_result_len + oid_len +
+			ntlmssp_len);
+
+	/* insert neg result */
+	encode_asn_tag(buf, &ofs, 0xa0, 0x0a, 1);
+	buf[ofs++] = 1;
+
+	/* insert oid */
+	encode_asn_tag(buf, &ofs, 0xa1, 0x06, NTLMSSP_OID_LEN);
+	memcpy(buf + ofs, NTLMSSP_OID_STR, NTLMSSP_OID_LEN);
+	ofs += NTLMSSP_OID_LEN;
+
+	/* insert response token - ntlmssp blob */
+	encode_asn_tag(buf, &ofs, 0xa2, 0x04, ntlm_blob_len);
+	memcpy(buf + ofs, ntlm_blob, ntlm_blob_len);
+	ofs += ntlm_blob_len;
+
+	*pbuffer = buf;
+	*buflen = total_len;
+	return 0;
+}
+
+int build_spnego_ntlmssp_auth_blob(unsigned char **pbuffer, u16 *buflen,
+		int neg_result)
+{
+	char *buf;
+	unsigned int ofs = 0;
+	int neg_result_len = 4 + compute_asn_hdr_len_bytes(1) * 2 + 1;
+	int total_len = 4 + compute_asn_hdr_len_bytes(neg_result_len) * 2 +
+		neg_result_len;
+
+	buf = kmalloc(total_len, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	/* insert main gss header */
+	encode_asn_tag(buf, &ofs, 0xa1, 0x30, neg_result_len);
+
+	/* insert neg result */
+	encode_asn_tag(buf, &ofs, 0xa0, 0x0a, 1);
+	if (neg_result)
+		buf[ofs++] = 2;
+	else
+		buf[ofs++] = 0;
+
+	*pbuffer = buf;
+	*buflen = total_len;
+	return 0;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./asn1.h linux-5.4.60-fbx/fs/cifsd/asn1.h
--- linux-5.4.60-fbx/fs/cifsd./asn1.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/asn1.h	2021-03-30 15:48:29.598385862 +0200
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * The ASB.1/BER parsing code is derived from ip_nat_snmp_basic.c which was in
+ * turn derived from the gxsnmp package by Gregory McLean & Jochen Friedrich
+ *
+ * Copyright (c) 2000 RP Internet (www.rpi.net.au).
+ * Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __ASN1_H__
+#define __ASN1_H__
+
+int ksmbd_decode_negTokenInit(unsigned char *security_blob,
+			      int length,
+			      struct ksmbd_conn *conn);
+
+int ksmbd_decode_negTokenTarg(unsigned char *security_blob,
+			      int length,
+			      struct ksmbd_conn *conn);
+
+int build_spnego_ntlmssp_neg_blob(unsigned char **pbuffer,
+				  u16 *buflen,
+				  char *ntlm_blob,
+				  int ntlm_blob_len);
+
+int build_spnego_ntlmssp_auth_blob(unsigned char **pbuffer,
+				   u16 *buflen,
+				   int neg_result);
+#endif /* __ASN1_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./auth.c linux-5.4.60-fbx/fs/cifsd/auth.c
--- linux-5.4.60-fbx/fs/cifsd./auth.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/auth.c	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,1377 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/kernel.h>
+#include <linux/fs.h>
+#include <linux/uaccess.h>
+#include <linux/backing-dev.h>
+#include <linux/writeback.h>
+#include <linux/uio.h>
+#include <linux/xattr.h>
+#include <crypto/hash.h>
+#include <crypto/aead.h>
+#include <linux/random.h>
+#include <linux/scatterlist.h>
+
+#include "auth.h"
+#include "glob.h"
+
+#include <linux/fips.h>
+#include <crypto/des.h>
+
+#include "server.h"
+#include "smb_common.h"
+#include "connection.h"
+#include "mgmt/user_session.h"
+#include "mgmt/user_config.h"
+#include "crypto_ctx.h"
+#include "transport_ipc.h"
+#include "buffer_pool.h"
+
+/*
+ * Fixed format data defining GSS header and fixed string
+ * "not_defined_in_RFC4178@please_ignore".
+ * So sec blob data in neg phase could be generated statically.
+ */
+static char NEGOTIATE_GSS_HEADER[AUTH_GSS_LENGTH] = {
+#ifdef CONFIG_SMB_SERVER_KERBEROS5
+	0x60, 0x5e, 0x06, 0x06, 0x2b, 0x06, 0x01, 0x05,
+	0x05, 0x02, 0xa0, 0x54, 0x30, 0x52, 0xa0, 0x24,
+	0x30, 0x22, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
+	0xf7, 0x12, 0x01, 0x02, 0x02, 0x06, 0x09, 0x2a,
+	0x86, 0x48, 0x82, 0xf7, 0x12, 0x01, 0x02, 0x02,
+	0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82,
+	0x37, 0x02, 0x02, 0x0a, 0xa3, 0x2a, 0x30, 0x28,
+	0xa0, 0x26, 0x1b, 0x24, 0x6e, 0x6f, 0x74, 0x5f,
+	0x64, 0x65, 0x66, 0x69, 0x6e, 0x65, 0x64, 0x5f,
+	0x69, 0x6e, 0x5f, 0x52, 0x46, 0x43, 0x34, 0x31,
+	0x37, 0x38, 0x40, 0x70, 0x6c, 0x65, 0x61, 0x73,
+	0x65, 0x5f, 0x69, 0x67, 0x6e, 0x6f, 0x72, 0x65
+#else
+	0x60, 0x48, 0x06, 0x06, 0x2b, 0x06, 0x01, 0x05,
+	0x05, 0x02, 0xa0, 0x3e, 0x30, 0x3c, 0xa0, 0x0e,
+	0x30, 0x0c, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04,
+	0x01, 0x82, 0x37, 0x02, 0x02, 0x0a, 0xa3, 0x2a,
+	0x30, 0x28, 0xa0, 0x26, 0x1b, 0x24, 0x6e, 0x6f,
+	0x74, 0x5f, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x65,
+	0x64, 0x5f, 0x69, 0x6e, 0x5f, 0x52, 0x46, 0x43,
+	0x34, 0x31, 0x37, 0x38, 0x40, 0x70, 0x6c, 0x65,
+	0x61, 0x73, 0x65, 0x5f, 0x69, 0x67, 0x6e, 0x6f,
+	0x72, 0x65
+#endif
+};
+
+void ksmbd_copy_gss_neg_header(void *buf)
+{
+	memcpy(buf, NEGOTIATE_GSS_HEADER, AUTH_GSS_LENGTH);
+}
+
+static void
+str_to_key(unsigned char *str, unsigned char *key)
+{
+	int i;
+
+	key[0] = str[0] >> 1;
+	key[1] = ((str[0] & 0x01) << 6) | (str[1] >> 2);
+	key[2] = ((str[1] & 0x03) << 5) | (str[2] >> 3);
+	key[3] = ((str[2] & 0x07) << 4) | (str[3] >> 4);
+	key[4] = ((str[3] & 0x0F) << 3) | (str[4] >> 5);
+	key[5] = ((str[4] & 0x1F) << 2) | (str[5] >> 6);
+	key[6] = ((str[5] & 0x3F) << 1) | (str[6] >> 7);
+	key[7] = str[6] & 0x7F;
+	for (i = 0; i < 8; i++)
+		key[i] = (key[i] << 1);
+}
+
+static int
+smbhash(unsigned char *out, const unsigned char *in, unsigned char *key)
+{
+	unsigned char key2[8];
+	struct des_ctx ctx;
+
+	str_to_key(key, key2);
+
+	if (fips_enabled) {
+		ksmbd_debug(AUTH,
+			"FIPS compliance enabled: DES not permitted\n");
+		return -ENOENT;
+	}
+
+	des_expand_key(&ctx, key2, DES_KEY_SIZE);
+	des_encrypt(&ctx, out, in);
+	memzero_explicit(&ctx, sizeof(ctx));
+	return 0;
+}
+
+static int ksmbd_enc_p24(unsigned char *p21, const unsigned char *c8, unsigned char *p24)
+{
+	int rc;
+
+	rc = smbhash(p24, c8, p21);
+	if (rc)
+		return rc;
+	rc = smbhash(p24 + 8, c8, p21 + 7);
+	if (rc)
+		return rc;
+	rc = smbhash(p24 + 16, c8, p21 + 14);
+	return rc;
+}
+
+/* produce a md4 message digest from data of length n bytes */
+static int ksmbd_enc_md4(unsigned char *md4_hash, unsigned char *link_str,
+		int link_len)
+{
+	int rc;
+	struct ksmbd_crypto_ctx *ctx;
+
+	ctx = ksmbd_crypto_ctx_find_md4();
+	if (!ctx) {
+		ksmbd_debug(AUTH, "Crypto md4 allocation error\n");
+		return -EINVAL;
+	}
+
+	rc = crypto_shash_init(CRYPTO_MD4(ctx));
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not init md4 shash\n");
+		goto out;
+	}
+
+	rc = crypto_shash_update(CRYPTO_MD4(ctx), link_str, link_len);
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not update with link_str\n");
+		goto out;
+	}
+
+	rc = crypto_shash_final(CRYPTO_MD4(ctx), md4_hash);
+	if (rc)
+		ksmbd_debug(AUTH, "Could not generate md4 hash\n");
+out:
+	ksmbd_release_crypto_ctx(ctx);
+	return rc;
+}
+
+static int ksmbd_enc_update_sess_key(unsigned char *md5_hash, char *nonce,
+		char *server_challenge, int len)
+{
+	int rc;
+	struct ksmbd_crypto_ctx *ctx;
+
+	ctx = ksmbd_crypto_ctx_find_md5();
+	if (!ctx) {
+		ksmbd_debug(AUTH, "Crypto md5 allocation error\n");
+		return -EINVAL;
+	}
+
+	rc = crypto_shash_init(CRYPTO_MD5(ctx));
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not init md5 shash\n");
+		goto out;
+	}
+
+	rc = crypto_shash_update(CRYPTO_MD5(ctx), server_challenge, len);
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not update with challenge\n");
+		goto out;
+	}
+
+	rc = crypto_shash_update(CRYPTO_MD5(ctx), nonce, len);
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not update with nonce\n");
+		goto out;
+	}
+
+	rc = crypto_shash_final(CRYPTO_MD5(ctx), md5_hash);
+	if (rc)
+		ksmbd_debug(AUTH, "Could not generate md5 hash\n");
+out:
+	ksmbd_release_crypto_ctx(ctx);
+	return rc;
+}
+
+/**
+ * ksmbd_gen_sess_key() - function to generate session key
+ * @sess:	session of connection
+ * @hash:	source hash value to be used for find session key
+ * @hmac:	source hmac value to be used for finding session key
+ *
+ */
+static int ksmbd_gen_sess_key(struct ksmbd_session *sess, char *hash,
+		char *hmac)
+{
+	struct ksmbd_crypto_ctx *ctx;
+	int rc = -EINVAL;
+
+	ctx = ksmbd_crypto_ctx_find_hmacmd5();
+	if (!ctx)
+		goto out;
+
+	rc = crypto_shash_setkey(CRYPTO_HMACMD5_TFM(ctx),
+				 hash,
+				 CIFS_HMAC_MD5_HASH_SIZE);
+	if (rc) {
+		ksmbd_debug(AUTH, "hmacmd5 set key fail error %d\n", rc);
+		goto out;
+	}
+
+	rc = crypto_shash_init(CRYPTO_HMACMD5(ctx));
+	if (rc) {
+		ksmbd_debug(AUTH, "could not init hmacmd5 error %d\n", rc);
+		goto out;
+	}
+
+	rc = crypto_shash_update(CRYPTO_HMACMD5(ctx),
+				 hmac,
+				 SMB2_NTLMV2_SESSKEY_SIZE);
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not update with response error %d\n",
+			rc);
+		goto out;
+	}
+
+	rc = crypto_shash_final(CRYPTO_HMACMD5(ctx), sess->sess_key);
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not generate hmacmd5 hash error %d\n",
+			rc);
+		goto out;
+	}
+
+out:
+	ksmbd_release_crypto_ctx(ctx);
+	return rc;
+}
+
+static int calc_ntlmv2_hash(struct ksmbd_session *sess, char *ntlmv2_hash,
+		char *dname)
+{
+	int ret = -EINVAL, len;
+	wchar_t *domain = NULL;
+	__le16 *uniname = NULL;
+	struct ksmbd_crypto_ctx *ctx;
+
+	ctx = ksmbd_crypto_ctx_find_hmacmd5();
+	if (!ctx) {
+		ksmbd_debug(AUTH, "can't generate ntlmv2 hash\n");
+		goto out;
+	}
+
+	ret = crypto_shash_setkey(CRYPTO_HMACMD5_TFM(ctx),
+				  user_passkey(sess->user),
+				  CIFS_ENCPWD_SIZE);
+	if (ret) {
+		ksmbd_debug(AUTH, "Could not set NT Hash as a key\n");
+		goto out;
+	}
+
+	ret = crypto_shash_init(CRYPTO_HMACMD5(ctx));
+	if (ret) {
+		ksmbd_debug(AUTH, "could not init hmacmd5\n");
+		goto out;
+	}
+
+	/* convert user_name to unicode */
+	len = strlen(user_name(sess->user));
+	uniname = kzalloc(2 + UNICODE_LEN(len), GFP_KERNEL);
+	if (!uniname) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	if (len) {
+		len = smb_strtoUTF16(uniname, user_name(sess->user), len,
+			sess->conn->local_nls);
+		UniStrupr(uniname);
+	}
+
+	ret = crypto_shash_update(CRYPTO_HMACMD5(ctx),
+				  (char *)uniname,
+				  UNICODE_LEN(len));
+	if (ret) {
+		ksmbd_debug(AUTH, "Could not update with user\n");
+		goto out;
+	}
+
+	/* Convert domain name or conn name to unicode and uppercase */
+	len = strlen(dname);
+	domain = kzalloc(2 + UNICODE_LEN(len), GFP_KERNEL);
+	if (!domain) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	len = smb_strtoUTF16((__le16 *)domain, dname, len,
+			     sess->conn->local_nls);
+
+	ret = crypto_shash_update(CRYPTO_HMACMD5(ctx),
+				  (char *)domain,
+				  UNICODE_LEN(len));
+	if (ret) {
+		ksmbd_debug(AUTH, "Could not update with domain\n");
+		goto out;
+	}
+
+	ret = crypto_shash_final(CRYPTO_HMACMD5(ctx), ntlmv2_hash);
+out:
+	if (ret)
+		ksmbd_debug(AUTH, "Could not generate md5 hash\n");
+	kfree(uniname);
+	kfree(domain);
+	ksmbd_release_crypto_ctx(ctx);
+	return ret;
+}
+
+/**
+ * ksmbd_auth_ntlm() - NTLM authentication handler
+ * @sess:	session of connection
+ * @pw_buf:	NTLM challenge response
+ * @passkey:	user password
+ *
+ * Return:	0 on success, error number on error
+ */
+int ksmbd_auth_ntlm(struct ksmbd_session *sess, char *pw_buf)
+{
+	int rc;
+	unsigned char p21[21];
+	char key[CIFS_AUTH_RESP_SIZE];
+
+	memset(p21, '\0', 21);
+	memcpy(p21, user_passkey(sess->user), CIFS_NTHASH_SIZE);
+	rc = ksmbd_enc_p24(p21, sess->ntlmssp.cryptkey, key);
+	if (rc) {
+		ksmbd_err("password processing failed\n");
+		return rc;
+	}
+
+	ksmbd_enc_md4(sess->sess_key,
+			user_passkey(sess->user),
+			CIFS_SMB1_SESSKEY_SIZE);
+	memcpy(sess->sess_key + CIFS_SMB1_SESSKEY_SIZE, key,
+		CIFS_AUTH_RESP_SIZE);
+	sess->sequence_number = 1;
+
+	if (strncmp(pw_buf, key, CIFS_AUTH_RESP_SIZE) != 0) {
+		ksmbd_debug(AUTH, "ntlmv1 authentication failed\n");
+		rc = -EINVAL;
+	} else {
+		ksmbd_debug(AUTH, "ntlmv1 authentication pass\n");
+	}
+
+	return rc;
+}
+
+/**
+ * ksmbd_auth_ntlmv2() - NTLMv2 authentication handler
+ * @sess:	session of connection
+ * @ntlmv2:		NTLMv2 challenge response
+ * @blen:		NTLMv2 blob length
+ * @domain_name:	domain name
+ *
+ * Return:	0 on success, error number on error
+ */
+int ksmbd_auth_ntlmv2(struct ksmbd_session *sess, struct ntlmv2_resp *ntlmv2,
+		int blen, char *domain_name)
+{
+	char ntlmv2_hash[CIFS_ENCPWD_SIZE];
+	char ntlmv2_rsp[CIFS_HMAC_MD5_HASH_SIZE];
+	struct ksmbd_crypto_ctx *ctx;
+	char *construct = NULL;
+	int rc = -EINVAL, len;
+
+	ctx = ksmbd_crypto_ctx_find_hmacmd5();
+	if (!ctx) {
+		ksmbd_debug(AUTH, "could not crypto alloc hmacmd5 rc %d\n", rc);
+		goto out;
+	}
+
+	rc = calc_ntlmv2_hash(sess, ntlmv2_hash, domain_name);
+	if (rc) {
+		ksmbd_debug(AUTH, "could not get v2 hash rc %d\n", rc);
+		goto out;
+	}
+
+	rc = crypto_shash_setkey(CRYPTO_HMACMD5_TFM(ctx),
+				 ntlmv2_hash,
+				 CIFS_HMAC_MD5_HASH_SIZE);
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not set NTLMV2 Hash as a key\n");
+		goto out;
+	}
+
+	rc = crypto_shash_init(CRYPTO_HMACMD5(ctx));
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not init hmacmd5\n");
+		goto out;
+	}
+
+	len = CIFS_CRYPTO_KEY_SIZE + blen;
+	construct = kzalloc(len, GFP_KERNEL);
+	if (!construct) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	memcpy(construct, sess->ntlmssp.cryptkey, CIFS_CRYPTO_KEY_SIZE);
+	memcpy(construct + CIFS_CRYPTO_KEY_SIZE,
+		(char *)(&ntlmv2->blob_signature), blen);
+
+	rc = crypto_shash_update(CRYPTO_HMACMD5(ctx), construct, len);
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not update with response\n");
+		goto out;
+	}
+
+	rc = crypto_shash_final(CRYPTO_HMACMD5(ctx), ntlmv2_rsp);
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not generate md5 hash\n");
+		goto out;
+	}
+
+	rc = ksmbd_gen_sess_key(sess, ntlmv2_hash, ntlmv2_rsp);
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not generate sess key\n");
+		goto out;
+	}
+
+	rc = memcmp(ntlmv2->ntlmv2_hash, ntlmv2_rsp, CIFS_HMAC_MD5_HASH_SIZE);
+out:
+	ksmbd_release_crypto_ctx(ctx);
+	kfree(construct);
+	return rc;
+}
+
+/**
+ * __ksmbd_auth_ntlmv2() - NTLM2(extended security) authentication handler
+ * @sess:	session of connection
+ * @client_nonce:	client nonce from LM response.
+ * @ntlm_resp:		ntlm response data from client.
+ *
+ * Return:	0 on success, error number on error
+ */
+static int __ksmbd_auth_ntlmv2(struct ksmbd_session *sess, char *client_nonce,
+		char *ntlm_resp)
+{
+	char sess_key[CIFS_SMB1_SESSKEY_SIZE] = {0};
+	int rc;
+	unsigned char p21[21];
+	char key[CIFS_AUTH_RESP_SIZE];
+
+	rc = ksmbd_enc_update_sess_key(sess_key,
+				       client_nonce,
+				       (char *)sess->ntlmssp.cryptkey, 8);
+	if (rc) {
+		ksmbd_err("password processing failed\n");
+		goto out;
+	}
+
+	memset(p21, '\0', 21);
+	memcpy(p21, user_passkey(sess->user), CIFS_NTHASH_SIZE);
+	rc = ksmbd_enc_p24(p21, sess_key, key);
+	if (rc) {
+		ksmbd_err("password processing failed\n");
+		goto out;
+	}
+
+	rc = memcmp(ntlm_resp, key, CIFS_AUTH_RESP_SIZE);
+out:
+	return rc;
+}
+
+/**
+ * ksmbd_decode_ntlmssp_auth_blob() - helper function to construct
+ * authenticate blob
+ * @authblob:	authenticate blob source pointer
+ * @usr:	user details
+ * @sess:	session of connection
+ *
+ * Return:	0 on success, error number on error
+ */
+int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob,
+		int blob_len, struct ksmbd_session *sess)
+{
+	char *domain_name;
+	unsigned int lm_off, nt_off;
+	unsigned short nt_len;
+	int ret;
+
+	if (blob_len < sizeof(struct authenticate_message)) {
+		ksmbd_debug(AUTH, "negotiate blob len %d too small\n",
+			blob_len);
+		return -EINVAL;
+	}
+
+	if (memcmp(authblob->Signature, "NTLMSSP", 8)) {
+		ksmbd_debug(AUTH, "blob signature incorrect %s\n",
+				authblob->Signature);
+		return -EINVAL;
+	}
+
+	lm_off = le32_to_cpu(authblob->LmChallengeResponse.BufferOffset);
+	nt_off = le32_to_cpu(authblob->NtChallengeResponse.BufferOffset);
+	nt_len = le16_to_cpu(authblob->NtChallengeResponse.Length);
+
+	/* process NTLM authentication */
+	if (nt_len == CIFS_AUTH_RESP_SIZE) {
+		if (le32_to_cpu(authblob->NegotiateFlags) &
+		    NTLMSSP_NEGOTIATE_EXTENDED_SEC)
+			return __ksmbd_auth_ntlmv2(sess, (char *)authblob +
+				lm_off, (char *)authblob + nt_off);
+		else
+			return ksmbd_auth_ntlm(sess, (char *)authblob +
+				nt_off);
+	}
+
+	/* TODO : use domain name that imported from configuration file */
+	domain_name = smb_strndup_from_utf16((const char *)authblob +
+			le32_to_cpu(authblob->DomainName.BufferOffset),
+			le16_to_cpu(authblob->DomainName.Length), true,
+			sess->conn->local_nls);
+	if (IS_ERR(domain_name))
+		return PTR_ERR(domain_name);
+
+	/* process NTLMv2 authentication */
+	ksmbd_debug(AUTH, "decode_ntlmssp_authenticate_blob dname%s\n",
+			domain_name);
+	ret = ksmbd_auth_ntlmv2(sess,
+			(struct ntlmv2_resp *)((char *)authblob + nt_off),
+			nt_len - CIFS_ENCPWD_SIZE,
+			domain_name);
+	kfree(domain_name);
+	return ret;
+}
+
+/**
+ * ksmbd_decode_ntlmssp_neg_blob() - helper function to construct
+ * negotiate blob
+ * @negblob: negotiate blob source pointer
+ * @rsp:     response header pointer to be updated
+ * @sess:    session of connection
+ *
+ */
+int ksmbd_decode_ntlmssp_neg_blob(struct negotiate_message *negblob,
+		int blob_len, struct ksmbd_session *sess)
+{
+	if (blob_len < sizeof(struct negotiate_message)) {
+		ksmbd_debug(AUTH, "negotiate blob len %d too small\n",
+			blob_len);
+		return -EINVAL;
+	}
+
+	if (memcmp(negblob->Signature, "NTLMSSP", 8)) {
+		ksmbd_debug(AUTH, "blob signature incorrect %s\n",
+				negblob->Signature);
+		return -EINVAL;
+	}
+
+	sess->ntlmssp.client_flags = le32_to_cpu(negblob->NegotiateFlags);
+	return 0;
+}
+
+/**
+ * ksmbd_build_ntlmssp_challenge_blob() - helper function to construct
+ * challenge blob
+ * @chgblob: challenge blob source pointer to initialize
+ * @rsp:     response header pointer to be updated
+ * @sess:    session of connection
+ *
+ */
+unsigned int
+ksmbd_build_ntlmssp_challenge_blob(struct challenge_message *chgblob,
+		struct ksmbd_session *sess)
+{
+	struct target_info *tinfo;
+	wchar_t *name;
+	__u8 *target_name;
+	unsigned int len, flags, blob_off, blob_len, type, target_info_len = 0;
+	int cflags = sess->ntlmssp.client_flags;
+
+	memcpy(chgblob->Signature, NTLMSSP_SIGNATURE, 8);
+	chgblob->MessageType = NtLmChallenge;
+
+	flags = NTLMSSP_NEGOTIATE_UNICODE |
+		NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_TARGET_TYPE_SERVER |
+		NTLMSSP_NEGOTIATE_TARGET_INFO;
+
+	if (cflags & NTLMSSP_NEGOTIATE_SIGN) {
+		flags |= NTLMSSP_NEGOTIATE_SIGN;
+		flags |= cflags & (NTLMSSP_NEGOTIATE_128 |
+			NTLMSSP_NEGOTIATE_56);
+	}
+
+	if (cflags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)
+		flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
+
+	if (cflags & NTLMSSP_REQUEST_TARGET)
+		flags |= NTLMSSP_REQUEST_TARGET;
+
+	if (sess->conn->use_spnego &&
+	    (cflags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
+		flags |= NTLMSSP_NEGOTIATE_EXTENDED_SEC;
+
+	chgblob->NegotiateFlags = cpu_to_le32(flags);
+	len = strlen(ksmbd_netbios_name());
+	name = kmalloc(2 + (len * 2), GFP_KERNEL);
+	if (!name)
+		return -ENOMEM;
+
+	len = smb_strtoUTF16((__le16 *)name, ksmbd_netbios_name(), len,
+			sess->conn->local_nls);
+	len = UNICODE_LEN(len);
+
+	blob_off = sizeof(struct challenge_message);
+	blob_len = blob_off + len;
+
+	chgblob->TargetName.Length = cpu_to_le16(len);
+	chgblob->TargetName.MaximumLength = cpu_to_le16(len);
+	chgblob->TargetName.BufferOffset = cpu_to_le32(blob_off);
+
+	/* Initialize random conn challenge */
+	get_random_bytes(sess->ntlmssp.cryptkey, sizeof(__u64));
+	memcpy(chgblob->Challenge, sess->ntlmssp.cryptkey,
+		CIFS_CRYPTO_KEY_SIZE);
+
+	/* Add Target Information to security buffer */
+	chgblob->TargetInfoArray.BufferOffset = cpu_to_le32(blob_len);
+
+	target_name = (__u8 *)chgblob + blob_off;
+	memcpy(target_name, name, len);
+	tinfo = (struct target_info *)(target_name + len);
+
+	chgblob->TargetInfoArray.Length = 0;
+	/* Add target info list for NetBIOS/DNS settings */
+	for (type = NTLMSSP_AV_NB_COMPUTER_NAME;
+		type <= NTLMSSP_AV_DNS_DOMAIN_NAME; type++) {
+		tinfo->Type = cpu_to_le16(type);
+		tinfo->Length = cpu_to_le16(len);
+		memcpy(tinfo->Content, name, len);
+		tinfo = (struct target_info *)((char *)tinfo + 4 + len);
+		target_info_len += 4 + len;
+	}
+
+	/* Add terminator subblock */
+	tinfo->Type = 0;
+	tinfo->Length = 0;
+	target_info_len += 4;
+
+	chgblob->TargetInfoArray.Length = cpu_to_le16(target_info_len);
+	chgblob->TargetInfoArray.MaximumLength = cpu_to_le16(target_info_len);
+	blob_len += target_info_len;
+	kfree(name);
+	ksmbd_debug(AUTH, "NTLMSSP SecurityBufferLength %d\n", blob_len);
+	return blob_len;
+}
+
+#ifdef CONFIG_SMB_SERVER_KERBEROS5
+int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob,
+		int in_len, char *out_blob, int *out_len)
+{
+	struct ksmbd_spnego_authen_response *resp;
+	struct ksmbd_user *user = NULL;
+	int retval;
+
+	resp = ksmbd_ipc_spnego_authen_request(in_blob, in_len);
+	if (!resp) {
+		ksmbd_debug(AUTH, "SPNEGO_AUTHEN_REQUEST failure\n");
+		return -EINVAL;
+	}
+
+	if (!(resp->login_response.status & KSMBD_USER_FLAG_OK)) {
+		ksmbd_debug(AUTH, "krb5 authentication failure\n");
+		retval = -EPERM;
+		goto out;
+	}
+
+	if (*out_len <= resp->spnego_blob_len) {
+		ksmbd_debug(AUTH, "buf len %d, but blob len %d\n",
+				*out_len, resp->spnego_blob_len);
+		retval = -EINVAL;
+		goto out;
+	}
+
+	if (resp->session_key_len > sizeof(sess->sess_key)) {
+		ksmbd_debug(AUTH, "session key is too long\n");
+		retval = -EINVAL;
+		goto out;
+	}
+
+	user = ksmbd_alloc_user(&resp->login_response);
+	if (!user) {
+		ksmbd_debug(AUTH, "login failure\n");
+		retval = -ENOMEM;
+		goto out;
+	}
+	sess->user = user;
+
+	memcpy(sess->sess_key, resp->payload, resp->session_key_len);
+	memcpy(out_blob, resp->payload + resp->session_key_len,
+			resp->spnego_blob_len);
+	*out_len = resp->spnego_blob_len;
+	retval = 0;
+out:
+	kvfree(resp);
+	return retval;
+}
+#else
+int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob,
+		int in_len, char *out_blob, int *out_len)
+{
+	return -EOPNOTSUPP;
+}
+#endif
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+/**
+ * ksmbd_sign_smb1_pdu() - function to generate SMB1 packet signing
+ * @sess:	session of connection
+ * @iov:        buffer iov array
+ * @n_vec:	number of iovecs
+ * @sig:        signature value generated for client request packet
+ *
+ */
+int ksmbd_sign_smb1_pdu(struct ksmbd_session *sess, struct kvec *iov, int n_vec,
+		char *sig)
+{
+	struct ksmbd_crypto_ctx *ctx;
+	int rc = -EINVAL;
+	int i;
+
+	ctx = ksmbd_crypto_ctx_find_md5();
+	if (!ctx) {
+		ksmbd_debug(AUTH, "could not crypto alloc md5 rc %d\n", rc);
+		goto out;
+	}
+
+	rc = crypto_shash_init(CRYPTO_MD5(ctx));
+	if (rc) {
+		ksmbd_debug(AUTH, "md5 init error %d\n", rc);
+		goto out;
+	}
+
+	rc = crypto_shash_update(CRYPTO_MD5(ctx), sess->sess_key, 40);
+	if (rc) {
+		ksmbd_debug(AUTH, "md5 update error %d\n", rc);
+		goto out;
+	}
+
+	for (i = 0; i < n_vec; i++) {
+		rc = crypto_shash_update(CRYPTO_MD5(ctx),
+					 iov[i].iov_base,
+					 iov[i].iov_len);
+		if (rc) {
+			ksmbd_debug(AUTH, "md5 update error %d\n", rc);
+			goto out;
+		}
+	}
+
+	rc = crypto_shash_final(CRYPTO_MD5(ctx), sig);
+	if (rc)
+		ksmbd_debug(AUTH, "md5 generation error %d\n", rc);
+
+out:
+	ksmbd_release_crypto_ctx(ctx);
+	return rc;
+}
+#endif
+
+/**
+ * ksmbd_sign_smb2_pdu() - function to generate packet signing
+ * @conn:	connection
+ * @key:	signing key
+ * @iov:        buffer iov array
+ * @n_vec:	number of iovecs
+ * @sig:	signature value generated for client request packet
+ *
+ */
+int ksmbd_sign_smb2_pdu(struct ksmbd_conn *conn, char *key, struct kvec *iov,
+		int n_vec, char *sig)
+{
+	struct ksmbd_crypto_ctx *ctx;
+	int rc = -EINVAL;
+	int i;
+
+	ctx = ksmbd_crypto_ctx_find_hmacsha256();
+	if (!ctx) {
+		ksmbd_debug(AUTH, "could not crypto alloc hmacmd5 rc %d\n", rc);
+		goto out;
+	}
+
+	rc = crypto_shash_setkey(CRYPTO_HMACSHA256_TFM(ctx),
+				 key,
+				 SMB2_NTLMV2_SESSKEY_SIZE);
+	if (rc)
+		goto out;
+
+	rc = crypto_shash_init(CRYPTO_HMACSHA256(ctx));
+	if (rc) {
+		ksmbd_debug(AUTH, "hmacsha256 init error %d\n", rc);
+		goto out;
+	}
+
+	for (i = 0; i < n_vec; i++) {
+		rc = crypto_shash_update(CRYPTO_HMACSHA256(ctx),
+					 iov[i].iov_base,
+					 iov[i].iov_len);
+		if (rc) {
+			ksmbd_debug(AUTH, "hmacsha256 update error %d\n", rc);
+			goto out;
+		}
+	}
+
+	rc = crypto_shash_final(CRYPTO_HMACSHA256(ctx), sig);
+	if (rc)
+		ksmbd_debug(AUTH, "hmacsha256 generation error %d\n", rc);
+out:
+	ksmbd_release_crypto_ctx(ctx);
+	return rc;
+}
+
+/**
+ * ksmbd_sign_smb3_pdu() - function to generate packet signing
+ * @conn:	connection
+ * @key:	signing key
+ * @iov:        buffer iov array
+ * @n_vec:	number of iovecs
+ * @sig:	signature value generated for client request packet
+ *
+ */
+int ksmbd_sign_smb3_pdu(struct ksmbd_conn *conn, char *key, struct kvec *iov,
+		int n_vec, char *sig)
+{
+	struct ksmbd_crypto_ctx *ctx;
+	int rc = -EINVAL;
+	int i;
+
+	ctx = ksmbd_crypto_ctx_find_cmacaes();
+	if (!ctx) {
+		ksmbd_debug(AUTH, "could not crypto alloc cmac rc %d\n", rc);
+		goto out;
+	}
+
+	rc = crypto_shash_setkey(CRYPTO_CMACAES_TFM(ctx),
+				 key,
+				 SMB2_CMACAES_SIZE);
+	if (rc)
+		goto out;
+
+	rc = crypto_shash_init(CRYPTO_CMACAES(ctx));
+	if (rc) {
+		ksmbd_debug(AUTH, "cmaces init error %d\n", rc);
+		goto out;
+	}
+
+	for (i = 0; i < n_vec; i++) {
+		rc = crypto_shash_update(CRYPTO_CMACAES(ctx),
+					 iov[i].iov_base,
+					 iov[i].iov_len);
+		if (rc) {
+			ksmbd_debug(AUTH, "cmaces update error %d\n", rc);
+			goto out;
+		}
+	}
+
+	rc = crypto_shash_final(CRYPTO_CMACAES(ctx), sig);
+	if (rc)
+		ksmbd_debug(AUTH, "cmaces generation error %d\n", rc);
+out:
+	ksmbd_release_crypto_ctx(ctx);
+	return rc;
+}
+
+struct derivation {
+	struct kvec label;
+	struct kvec context;
+	bool binding;
+};
+
+static int generate_key(struct ksmbd_session *sess, struct kvec label,
+		struct kvec context, __u8 *key, unsigned int key_size)
+{
+	unsigned char zero = 0x0;
+	__u8 i[4] = {0, 0, 0, 1};
+	__u8 L[4] = {0, 0, 0, 128};
+	int rc = -EINVAL;
+	unsigned char prfhash[SMB2_HMACSHA256_SIZE];
+	unsigned char *hashptr = prfhash;
+	struct ksmbd_crypto_ctx *ctx;
+
+	memset(prfhash, 0x0, SMB2_HMACSHA256_SIZE);
+	memset(key, 0x0, key_size);
+
+	ctx = ksmbd_crypto_ctx_find_hmacsha256();
+	if (!ctx) {
+		ksmbd_debug(AUTH, "could not crypto alloc hmacmd5 rc %d\n", rc);
+		goto smb3signkey_ret;
+	}
+
+	rc = crypto_shash_setkey(CRYPTO_HMACSHA256_TFM(ctx),
+				 sess->sess_key,
+				 SMB2_NTLMV2_SESSKEY_SIZE);
+	if (rc)
+		goto smb3signkey_ret;
+
+	rc = crypto_shash_init(CRYPTO_HMACSHA256(ctx));
+	if (rc) {
+		ksmbd_debug(AUTH, "hmacsha256 init error %d\n", rc);
+		goto smb3signkey_ret;
+	}
+
+	rc = crypto_shash_update(CRYPTO_HMACSHA256(ctx), i, 4);
+	if (rc) {
+		ksmbd_debug(AUTH, "could not update with n\n");
+		goto smb3signkey_ret;
+	}
+
+	rc = crypto_shash_update(CRYPTO_HMACSHA256(ctx),
+				 label.iov_base,
+				 label.iov_len);
+	if (rc) {
+		ksmbd_debug(AUTH, "could not update with label\n");
+		goto smb3signkey_ret;
+	}
+
+	rc = crypto_shash_update(CRYPTO_HMACSHA256(ctx), &zero, 1);
+	if (rc) {
+		ksmbd_debug(AUTH, "could not update with zero\n");
+		goto smb3signkey_ret;
+	}
+
+	rc = crypto_shash_update(CRYPTO_HMACSHA256(ctx),
+				 context.iov_base,
+				 context.iov_len);
+	if (rc) {
+		ksmbd_debug(AUTH, "could not update with context\n");
+		goto smb3signkey_ret;
+	}
+
+	rc = crypto_shash_update(CRYPTO_HMACSHA256(ctx), L, 4);
+	if (rc) {
+		ksmbd_debug(AUTH, "could not update with L\n");
+		goto smb3signkey_ret;
+	}
+
+	rc = crypto_shash_final(CRYPTO_HMACSHA256(ctx), hashptr);
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not generate hmacmd5 hash error %d\n",
+			rc);
+		goto smb3signkey_ret;
+	}
+
+	memcpy(key, hashptr, key_size);
+
+smb3signkey_ret:
+	ksmbd_release_crypto_ctx(ctx);
+	return rc;
+}
+
+static int generate_smb3signingkey(struct ksmbd_session *sess,
+		const struct derivation *signing)
+{
+	int rc;
+	struct channel *chann;
+	char *key;
+
+	chann = lookup_chann_list(sess);
+	if (!chann)
+		return 0;
+
+	if (sess->conn->dialect >= SMB30_PROT_ID && signing->binding)
+		key = chann->smb3signingkey;
+	else
+		key = sess->smb3signingkey;
+
+	rc = generate_key(sess, signing->label, signing->context, key,
+		SMB3_SIGN_KEY_SIZE);
+	if (rc)
+		return rc;
+
+	if (!(sess->conn->dialect >= SMB30_PROT_ID && signing->binding))
+		memcpy(chann->smb3signingkey, key, SMB3_SIGN_KEY_SIZE);
+
+	ksmbd_debug(AUTH, "dumping generated AES signing keys\n");
+	ksmbd_debug(AUTH, "Session Id    %llu\n", sess->id);
+	ksmbd_debug(AUTH, "Session Key   %*ph\n",
+			SMB2_NTLMV2_SESSKEY_SIZE, sess->sess_key);
+	ksmbd_debug(AUTH, "Signing Key   %*ph\n",
+			SMB3_SIGN_KEY_SIZE, key);
+	return rc;
+}
+
+int ksmbd_gen_smb30_signingkey(struct ksmbd_session *sess)
+{
+	struct derivation d;
+
+	d.label.iov_base = "SMB2AESCMAC";
+	d.label.iov_len = 12;
+	d.context.iov_base = "SmbSign";
+	d.context.iov_len = 8;
+	d.binding = false;
+
+	return generate_smb3signingkey(sess, &d);
+}
+
+int ksmbd_gen_smb311_signingkey(struct ksmbd_session *sess)
+{
+	struct derivation d;
+
+	d.label.iov_base = "SMBSigningKey";
+	d.label.iov_len = 14;
+	d.context.iov_base = sess->Preauth_HashValue;
+	d.context.iov_len = 64;
+	d.binding = false;
+
+	return generate_smb3signingkey(sess, &d);
+}
+
+struct derivation_twin {
+	struct derivation encryption;
+	struct derivation decryption;
+};
+
+static int generate_smb3encryptionkey(struct ksmbd_session *sess,
+		const struct derivation_twin *ptwin)
+{
+	int rc;
+
+	rc = generate_key(sess, ptwin->encryption.label,
+			ptwin->encryption.context, sess->smb3encryptionkey,
+			SMB3_SIGN_KEY_SIZE);
+	if (rc)
+		return rc;
+
+	rc = generate_key(sess, ptwin->decryption.label,
+			ptwin->decryption.context,
+			sess->smb3decryptionkey, SMB3_SIGN_KEY_SIZE);
+	if (rc)
+		return rc;
+
+	ksmbd_debug(AUTH, "dumping generated AES encryption keys\n");
+	ksmbd_debug(AUTH, "Session Id    %llu\n", sess->id);
+	ksmbd_debug(AUTH, "Session Key   %*ph\n",
+			SMB2_NTLMV2_SESSKEY_SIZE, sess->sess_key);
+	ksmbd_debug(AUTH, "ServerIn Key  %*ph\n",
+			SMB3_SIGN_KEY_SIZE, sess->smb3encryptionkey);
+	ksmbd_debug(AUTH, "ServerOut Key %*ph\n",
+			SMB3_SIGN_KEY_SIZE, sess->smb3decryptionkey);
+	return rc;
+}
+
+int ksmbd_gen_smb30_encryptionkey(struct ksmbd_session *sess)
+{
+	struct derivation_twin twin;
+	struct derivation *d;
+
+	d = &twin.encryption;
+	d->label.iov_base = "SMB2AESCCM";
+	d->label.iov_len = 11;
+	d->context.iov_base = "ServerOut";
+	d->context.iov_len = 10;
+
+	d = &twin.decryption;
+	d->label.iov_base = "SMB2AESCCM";
+	d->label.iov_len = 11;
+	d->context.iov_base = "ServerIn ";
+	d->context.iov_len = 10;
+
+	return generate_smb3encryptionkey(sess, &twin);
+}
+
+int ksmbd_gen_smb311_encryptionkey(struct ksmbd_session *sess)
+{
+	struct derivation_twin twin;
+	struct derivation *d;
+
+	d = &twin.encryption;
+	d->label.iov_base = "SMBS2CCipherKey";
+	d->label.iov_len = 16;
+	d->context.iov_base = sess->Preauth_HashValue;
+	d->context.iov_len = 64;
+
+	d = &twin.decryption;
+	d->label.iov_base = "SMBC2SCipherKey";
+	d->label.iov_len = 16;
+	d->context.iov_base = sess->Preauth_HashValue;
+	d->context.iov_len = 64;
+
+	return generate_smb3encryptionkey(sess, &twin);
+}
+
+int ksmbd_gen_preauth_integrity_hash(struct ksmbd_conn *conn, char *buf,
+		__u8 *pi_hash)
+{
+	int rc = -1;
+	struct smb2_hdr *rcv_hdr = (struct smb2_hdr *)buf;
+	char *all_bytes_msg = (char *)&rcv_hdr->ProtocolId;
+	int msg_size = be32_to_cpu(rcv_hdr->smb2_buf_length);
+	struct ksmbd_crypto_ctx *ctx = NULL;
+
+	if (conn->preauth_info->Preauth_HashId ==
+	    SMB2_PREAUTH_INTEGRITY_SHA512) {
+		ctx = ksmbd_crypto_ctx_find_sha512();
+		if (!ctx) {
+			ksmbd_debug(AUTH, "could not alloc sha512 rc %d\n", rc);
+			goto out;
+		}
+	} else {
+		goto out;
+	}
+
+	rc = crypto_shash_init(CRYPTO_SHA512(ctx));
+	if (rc) {
+		ksmbd_debug(AUTH, "could not init shashn");
+		goto out;
+	}
+
+	rc = crypto_shash_update(CRYPTO_SHA512(ctx), pi_hash, 64);
+	if (rc) {
+		ksmbd_debug(AUTH, "could not update with n\n");
+		goto out;
+	}
+
+	rc = crypto_shash_update(CRYPTO_SHA512(ctx), all_bytes_msg, msg_size);
+	if (rc) {
+		ksmbd_debug(AUTH, "could not update with n\n");
+		goto out;
+	}
+
+	rc = crypto_shash_final(CRYPTO_SHA512(ctx), pi_hash);
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not generate hash err : %d\n", rc);
+		goto out;
+	}
+out:
+	ksmbd_release_crypto_ctx(ctx);
+	return rc;
+}
+
+int ksmbd_gen_sd_hash(struct ksmbd_conn *conn, char *sd_buf, int len,
+		__u8 *pi_hash)
+{
+	int rc = -1;
+	struct ksmbd_crypto_ctx *ctx = NULL;
+
+	ctx = ksmbd_crypto_ctx_find_sha256();
+	if (!ctx) {
+		ksmbd_debug(AUTH, "could not alloc sha256 rc %d\n", rc);
+		goto out;
+	}
+
+	rc = crypto_shash_init(CRYPTO_SHA256(ctx));
+	if (rc) {
+		ksmbd_debug(AUTH, "could not init shashn");
+		goto out;
+	}
+
+	rc = crypto_shash_update(CRYPTO_SHA256(ctx), sd_buf, len);
+	if (rc) {
+		ksmbd_debug(AUTH, "could not update with n\n");
+		goto out;
+	}
+
+	rc = crypto_shash_final(CRYPTO_SHA256(ctx), pi_hash);
+	if (rc) {
+		ksmbd_debug(AUTH, "Could not generate hash err : %d\n", rc);
+		goto out;
+	}
+out:
+	ksmbd_release_crypto_ctx(ctx);
+	return rc;
+}
+
+static int ksmbd_get_encryption_key(struct ksmbd_conn *conn, __u64 ses_id,
+		int enc, u8 *key)
+{
+	struct ksmbd_session *sess;
+	u8 *ses_enc_key;
+
+	sess = ksmbd_session_lookup(conn, ses_id);
+	if (!sess)
+		return 1;
+
+	ses_enc_key = enc ? sess->smb3encryptionkey :
+		sess->smb3decryptionkey;
+	memcpy(key, ses_enc_key, SMB3_SIGN_KEY_SIZE);
+
+	return 0;
+}
+
+static inline void smb2_sg_set_buf(struct scatterlist *sg, const void *buf,
+		unsigned int buflen)
+{
+	void *addr;
+
+	if (is_vmalloc_addr(buf))
+		addr = vmalloc_to_page(buf);
+	else
+		addr = virt_to_page(buf);
+	sg_set_page(sg, addr, buflen, offset_in_page(buf));
+}
+
+static struct scatterlist *ksmbd_init_sg(struct kvec *iov, unsigned int nvec,
+		u8 *sign)
+{
+	struct scatterlist *sg;
+	unsigned int assoc_data_len = sizeof(struct smb2_transform_hdr) - 24;
+	int i, nr_entries[3] = {0}, total_entries = 0, sg_idx = 0;
+
+	for (i = 0; i < nvec - 1; i++) {
+		unsigned long kaddr = (unsigned long)iov[i + 1].iov_base;
+
+		if (is_vmalloc_addr(iov[i + 1].iov_base)) {
+			nr_entries[i] = ((kaddr + iov[i + 1].iov_len +
+					PAGE_SIZE - 1) >> PAGE_SHIFT) -
+				(kaddr >> PAGE_SHIFT);
+		} else {
+			nr_entries[i]++;
+		}
+		total_entries += nr_entries[i];
+	}
+
+	/* Add two entries for transform header and signature */
+	total_entries += 2;
+
+	sg = kmalloc_array(total_entries, sizeof(struct scatterlist), GFP_KERNEL);
+	if (!sg)
+		return NULL;
+
+	sg_init_table(sg, total_entries);
+	smb2_sg_set_buf(&sg[sg_idx++], iov[0].iov_base + 24, assoc_data_len);
+	for (i = 0; i < nvec - 1; i++) {
+		void *data = iov[i + 1].iov_base;
+		int len = iov[i + 1].iov_len;
+
+		if (is_vmalloc_addr(data)) {
+			int j, offset = offset_in_page(data);
+
+			for (j = 0; j < nr_entries[i]; j++) {
+				unsigned int bytes = PAGE_SIZE - offset;
+
+				if (len <= 0)
+					break;
+
+				if (bytes > len)
+					bytes = len;
+
+				sg_set_page(&sg[sg_idx++],
+					    vmalloc_to_page(data), bytes,
+					    offset_in_page(data));
+
+				data += bytes;
+				len -= bytes;
+				offset = 0;
+			}
+		} else {
+			sg_set_page(&sg[sg_idx++], virt_to_page(data), len,
+				    offset_in_page(data));
+		}
+	}
+	smb2_sg_set_buf(&sg[sg_idx], sign, SMB2_SIGNATURE_SIZE);
+	return sg;
+}
+
+int ksmbd_crypt_message(struct ksmbd_conn *conn, struct kvec *iov,
+		unsigned int nvec, int enc)
+{
+	struct smb2_transform_hdr *tr_hdr =
+		(struct smb2_transform_hdr *)iov[0].iov_base;
+	unsigned int assoc_data_len = sizeof(struct smb2_transform_hdr) - 24;
+	int rc = 0;
+	struct scatterlist *sg;
+	u8 sign[SMB2_SIGNATURE_SIZE] = {};
+	u8 key[SMB3_SIGN_KEY_SIZE];
+	struct aead_request *req;
+	char *iv;
+	unsigned int iv_len;
+	struct crypto_aead *tfm;
+	unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
+	struct ksmbd_crypto_ctx *ctx;
+
+	rc = ksmbd_get_encryption_key(conn,
+				      le64_to_cpu(tr_hdr->SessionId),
+				      enc,
+				      key);
+	if (rc) {
+		ksmbd_err("Could not get %scryption key\n", enc ? "en" : "de");
+		return 0;
+	}
+
+	if (conn->cipher_type == SMB2_ENCRYPTION_AES128_GCM)
+		ctx = ksmbd_crypto_ctx_find_gcm();
+	else
+		ctx = ksmbd_crypto_ctx_find_ccm();
+	if (!ctx) {
+		ksmbd_err("crypto alloc failed\n");
+		return -EINVAL;
+	}
+
+	if (conn->cipher_type == SMB2_ENCRYPTION_AES128_GCM)
+		tfm = CRYPTO_GCM(ctx);
+	else
+		tfm = CRYPTO_CCM(ctx);
+
+	rc = crypto_aead_setkey(tfm, key, SMB3_SIGN_KEY_SIZE);
+	if (rc) {
+		ksmbd_err("Failed to set aead key %d\n", rc);
+		goto free_ctx;
+	}
+
+	rc = crypto_aead_setauthsize(tfm, SMB2_SIGNATURE_SIZE);
+	if (rc) {
+		ksmbd_err("Failed to set authsize %d\n", rc);
+		goto free_ctx;
+	}
+
+	req = aead_request_alloc(tfm, GFP_KERNEL);
+	if (!req) {
+		ksmbd_err("Failed to alloc aead request\n");
+		rc = -ENOMEM;
+		goto free_ctx;
+	}
+
+	if (!enc) {
+		memcpy(sign, &tr_hdr->Signature, SMB2_SIGNATURE_SIZE);
+		crypt_len += SMB2_SIGNATURE_SIZE;
+	}
+
+	sg = ksmbd_init_sg(iov, nvec, sign);
+	if (!sg) {
+		ksmbd_err("Failed to init sg\n");
+		rc = -ENOMEM;
+		goto free_req;
+	}
+
+	iv_len = crypto_aead_ivsize(tfm);
+	iv = kzalloc(iv_len, GFP_KERNEL);
+	if (!iv) {
+		ksmbd_err("Failed to alloc IV\n");
+		rc = -ENOMEM;
+		goto free_sg;
+	}
+
+	if (conn->cipher_type == SMB2_ENCRYPTION_AES128_GCM) {
+		memcpy(iv, (char *)tr_hdr->Nonce, SMB3_AES128GCM_NONCE);
+	} else {
+		iv[0] = 3;
+		memcpy(iv + 1, (char *)tr_hdr->Nonce, SMB3_AES128CCM_NONCE);
+	}
+
+	aead_request_set_crypt(req, sg, sg, crypt_len, iv);
+	aead_request_set_ad(req, assoc_data_len);
+	aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
+
+	if (enc)
+		rc = crypto_aead_encrypt(req);
+	else
+		rc = crypto_aead_decrypt(req);
+	if (!rc && enc)
+		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
+
+	kfree(iv);
+free_sg:
+	kfree(sg);
+free_req:
+	kfree(req);
+free_ctx:
+	ksmbd_release_crypto_ctx(ctx);
+	return rc;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./auth.h linux-5.4.60-fbx/fs/cifsd/auth.h
--- linux-5.4.60-fbx/fs/cifsd./auth.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/auth.h	2021-03-30 15:48:29.598385862 +0200
@@ -0,0 +1,96 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __AUTH_H__
+#define __AUTH_H__
+
+#include "ntlmssp.h"
+
+#ifdef CONFIG_SMB_SERVER_KERBEROS5
+#define AUTH_GSS_LENGTH		96
+#define AUTH_GSS_PADDING	0
+#else
+#define AUTH_GSS_LENGTH		74
+#define AUTH_GSS_PADDING	6
+#endif
+
+#define CIFS_HMAC_MD5_HASH_SIZE	(16)
+#define CIFS_NTHASH_SIZE	(16)
+
+/*
+ * Size of the ntlm client response
+ */
+#define CIFS_AUTH_RESP_SIZE		24
+#define CIFS_SMB1_SIGNATURE_SIZE	8
+#define CIFS_SMB1_SESSKEY_SIZE		16
+
+#define KSMBD_AUTH_NTLMSSP	0x0001
+#define KSMBD_AUTH_KRB5		0x0002
+#define KSMBD_AUTH_MSKRB5	0x0004
+#define KSMBD_AUTH_KRB5U2U	0x0008
+
+struct ksmbd_session;
+struct ksmbd_conn;
+struct kvec;
+
+int ksmbd_crypt_message(struct ksmbd_conn *conn,
+			struct kvec *iov,
+			unsigned int nvec,
+			int enc);
+
+void ksmbd_copy_gss_neg_header(void *buf);
+
+int ksmbd_auth_ntlm(struct ksmbd_session *sess,
+		    char *pw_buf);
+
+int ksmbd_auth_ntlmv2(struct ksmbd_session *sess,
+		      struct ntlmv2_resp *ntlmv2,
+		      int blen,
+		      char *domain_name);
+
+int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob,
+				   int blob_len,
+				   struct ksmbd_session *sess);
+
+int ksmbd_decode_ntlmssp_neg_blob(struct negotiate_message *negblob,
+				  int blob_len,
+				  struct ksmbd_session *sess);
+
+unsigned int
+ksmbd_build_ntlmssp_challenge_blob(struct challenge_message *chgblob,
+		struct ksmbd_session *sess);
+
+int ksmbd_krb5_authenticate(struct ksmbd_session *sess,
+			char *in_blob, int in_len,
+			char *out_blob, int *out_len);
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+int ksmbd_sign_smb1_pdu(struct ksmbd_session *sess,
+			struct kvec *iov,
+			int n_vec,
+			char *sig);
+#endif
+int ksmbd_sign_smb2_pdu(struct ksmbd_conn *conn,
+			char *key,
+			struct kvec *iov,
+			int n_vec,
+			char *sig);
+int ksmbd_sign_smb3_pdu(struct ksmbd_conn *conn,
+			char *key,
+			struct kvec *iov,
+			int n_vec,
+			char *sig);
+
+int ksmbd_gen_smb30_signingkey(struct ksmbd_session *sess);
+int ksmbd_gen_smb311_signingkey(struct ksmbd_session *sess);
+int ksmbd_gen_smb30_encryptionkey(struct ksmbd_session *sess);
+int ksmbd_gen_smb311_encryptionkey(struct ksmbd_session *sess);
+
+int ksmbd_gen_preauth_integrity_hash(struct ksmbd_conn *conn,
+				     char *buf,
+				     __u8 *pi_hash);
+int ksmbd_gen_sd_hash(struct ksmbd_conn *conn, char *sd_buf, int len,
+		__u8 *pi_hash);
+#endif
diff -Nruw linux-5.4.60-fbx/fs/cifsd./buffer_pool.c linux-5.4.60-fbx/fs/cifsd/buffer_pool.c
--- linux-5.4.60-fbx/fs/cifsd./buffer_pool.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/buffer_pool.c	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,264 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/kernel.h>
+#include <linux/wait.h>
+#include <linux/sched.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/rwlock.h>
+
+#include "glob.h"
+#include "buffer_pool.h"
+#include "connection.h"
+#include "mgmt/ksmbd_ida.h"
+
+static struct kmem_cache *filp_cache;
+
+struct wm {
+	struct list_head	list;
+	unsigned int		sz;
+	char			buffer[0];
+};
+
+struct wm_list {
+	struct list_head	list;
+	unsigned int		sz;
+
+	spinlock_t		wm_lock;
+	int			avail_wm;
+	struct list_head	idle_wm;
+	wait_queue_head_t	wm_wait;
+};
+
+static LIST_HEAD(wm_lists);
+static DEFINE_RWLOCK(wm_lists_lock);
+
+static struct wm *wm_alloc(size_t sz, gfp_t flags)
+{
+	struct wm *wm;
+	size_t alloc_sz = sz + sizeof(struct wm);
+
+	if (sz > SIZE_MAX - sizeof(struct wm))
+		return NULL;
+
+	wm = kvmalloc(alloc_sz, flags);
+	if (!wm)
+		return NULL;
+	wm->sz = sz;
+	return wm;
+}
+
+static int register_wm_size_class(size_t sz)
+{
+	struct wm_list *l, *nl;
+
+	nl = kmalloc(sizeof(struct wm_list), GFP_KERNEL);
+	if (!nl)
+		return -ENOMEM;
+
+	nl->sz = sz;
+	spin_lock_init(&nl->wm_lock);
+	INIT_LIST_HEAD(&nl->idle_wm);
+	INIT_LIST_HEAD(&nl->list);
+	init_waitqueue_head(&nl->wm_wait);
+	nl->avail_wm = 0;
+
+	write_lock(&wm_lists_lock);
+	list_for_each_entry(l, &wm_lists, list) {
+		if (l->sz == sz) {
+			write_unlock(&wm_lists_lock);
+			kfree(nl);
+			return 0;
+		}
+	}
+
+	list_add(&nl->list, &wm_lists);
+	write_unlock(&wm_lists_lock);
+	return 0;
+}
+
+static struct wm_list *match_wm_list(size_t size)
+{
+	struct wm_list *l, *rl = NULL;
+
+	read_lock(&wm_lists_lock);
+	list_for_each_entry(l, &wm_lists, list) {
+		if (l->sz == size) {
+			rl = l;
+			break;
+		}
+	}
+	read_unlock(&wm_lists_lock);
+	return rl;
+}
+
+static struct wm *find_wm(size_t size)
+{
+	struct wm_list *wm_list;
+	struct wm *wm;
+
+	wm_list = match_wm_list(size);
+	if (!wm_list) {
+		if (register_wm_size_class(size))
+			return NULL;
+		wm_list = match_wm_list(size);
+	}
+
+	if (!wm_list)
+		return NULL;
+
+	while (1) {
+		spin_lock(&wm_list->wm_lock);
+		if (!list_empty(&wm_list->idle_wm)) {
+			wm = list_entry(wm_list->idle_wm.next,
+					struct wm,
+					list);
+			list_del(&wm->list);
+			spin_unlock(&wm_list->wm_lock);
+			return wm;
+		}
+
+		if (wm_list->avail_wm > num_online_cpus()) {
+			spin_unlock(&wm_list->wm_lock);
+			wait_event(wm_list->wm_wait,
+				   !list_empty(&wm_list->idle_wm));
+			continue;
+		}
+
+		wm_list->avail_wm++;
+		spin_unlock(&wm_list->wm_lock);
+
+		wm = wm_alloc(size, GFP_KERNEL);
+		if (!wm) {
+			spin_lock(&wm_list->wm_lock);
+			wm_list->avail_wm--;
+			spin_unlock(&wm_list->wm_lock);
+			wait_event(wm_list->wm_wait,
+				   !list_empty(&wm_list->idle_wm));
+			continue;
+		}
+		break;
+	}
+
+	return wm;
+}
+
+static void release_wm(struct wm *wm, struct wm_list *wm_list)
+{
+	if (!wm)
+		return;
+
+	spin_lock(&wm_list->wm_lock);
+	if (wm_list->avail_wm <= num_online_cpus()) {
+		list_add(&wm->list, &wm_list->idle_wm);
+		spin_unlock(&wm_list->wm_lock);
+		wake_up(&wm_list->wm_wait);
+		return;
+	}
+
+	wm_list->avail_wm--;
+	spin_unlock(&wm_list->wm_lock);
+	kvfree(wm);
+}
+
+static void wm_list_free(struct wm_list *l)
+{
+	struct wm *wm;
+
+	while (!list_empty(&l->idle_wm)) {
+		wm = list_entry(l->idle_wm.next, struct wm, list);
+		list_del(&wm->list);
+		kvfree(wm);
+	}
+	kfree(l);
+}
+
+static void wm_lists_destroy(void)
+{
+	struct wm_list *l;
+
+	while (!list_empty(&wm_lists)) {
+		l = list_entry(wm_lists.next, struct wm_list, list);
+		list_del(&l->list);
+		wm_list_free(l);
+	}
+}
+
+void *ksmbd_find_buffer(size_t size)
+{
+	struct wm *wm;
+
+	wm = find_wm(size);
+
+	WARN_ON(!wm);
+	if (wm)
+		return wm->buffer;
+	return NULL;
+}
+
+void ksmbd_release_buffer(void *buffer)
+{
+	struct wm_list *wm_list;
+	struct wm *wm;
+
+	if (!buffer)
+		return;
+
+	wm = container_of(buffer, struct wm, buffer);
+	wm_list = match_wm_list(wm->sz);
+	WARN_ON(!wm_list);
+	if (wm_list)
+		release_wm(wm, wm_list);
+}
+
+void *ksmbd_realloc_response(void *ptr, size_t old_sz, size_t new_sz)
+{
+	size_t sz = min(old_sz, new_sz);
+	void *nptr;
+
+	nptr = kvmalloc(new_sz, GFP_KERNEL | __GFP_ZERO);
+	if (!nptr)
+		return ptr;
+	memcpy(nptr, ptr, sz);
+	kvfree(ptr);
+	return nptr;
+}
+
+void ksmbd_free_file_struct(void *filp)
+{
+	kmem_cache_free(filp_cache, filp);
+}
+
+void *ksmbd_alloc_file_struct(void)
+{
+	return kmem_cache_zalloc(filp_cache, GFP_KERNEL);
+}
+
+void ksmbd_destroy_buffer_pools(void)
+{
+	wm_lists_destroy();
+	ksmbd_work_pool_destroy();
+	kmem_cache_destroy(filp_cache);
+}
+
+int ksmbd_init_buffer_pools(void)
+{
+	if (ksmbd_work_pool_init())
+		goto out;
+
+	filp_cache = kmem_cache_create("ksmbd_file_cache",
+			sizeof(struct ksmbd_file), 0, SLAB_HWCACHE_ALIGN, NULL);
+	if (!filp_cache)
+		goto out;
+
+	return 0;
+
+out:
+	ksmbd_err("failed to allocate memory\n");
+	ksmbd_destroy_buffer_pools();
+	return -ENOMEM;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./buffer_pool.h linux-5.4.60-fbx/fs/cifsd/buffer_pool.h
--- linux-5.4.60-fbx/fs/cifsd./buffer_pool.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/buffer_pool.h	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __KSMBD_BUFFER_POOL_H__
+#define __KSMBD_BUFFER_POOL_H__
+
+void *ksmbd_find_buffer(size_t size);
+void ksmbd_release_buffer(void *buffer);
+
+void *ksmbd_realloc_response(void *ptr, size_t old_sz, size_t new_sz);
+
+void ksmbd_free_file_struct(void *filp);
+void *ksmbd_alloc_file_struct(void);
+
+void ksmbd_destroy_buffer_pools(void);
+int ksmbd_init_buffer_pools(void);
+
+#endif /* __KSMBD_BUFFER_POOL_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./connection.c linux-5.4.60-fbx/fs/cifsd/connection.c
--- linux-5.4.60-fbx/fs/cifsd./connection.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/connection.c	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,427 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2016 Namjae Jeon <namjae.jeon@protocolfreedom.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/mutex.h>
+#include <linux/freezer.h>
+#include <linux/module.h>
+
+#include "server.h"
+#include "buffer_pool.h"
+#include "smb_common.h"
+#ifdef CONFIG_SMB_INSECURE_SERVER
+#include "smb1pdu.h"
+#endif
+#include "mgmt/ksmbd_ida.h"
+#include "connection.h"
+#include "transport_tcp.h"
+#include "transport_rdma.h"
+
+static DEFINE_MUTEX(init_lock);
+
+static struct ksmbd_conn_ops default_conn_ops;
+
+static LIST_HEAD(conn_list);
+static DEFINE_RWLOCK(conn_list_lock);
+
+/**
+ * ksmbd_conn_free() - free resources of the connection instance
+ *
+ * @conn:	connection instance to be cleand up
+ *
+ * During the thread termination, the corresponding conn instance
+ * resources(sock/memory) are released and finally the conn object is freed.
+ */
+void ksmbd_conn_free(struct ksmbd_conn *conn)
+{
+	write_lock(&conn_list_lock);
+	list_del(&conn->conns_list);
+	write_unlock(&conn_list_lock);
+
+	kvfree(conn->request_buf);
+	kfree(conn->preauth_info);
+	kfree(conn);
+}
+
+/**
+ * ksmbd_conn_alloc() - initialize a new connection instance
+ *
+ * Return:	ksmbd_conn struct on success, otherwise NULL
+ */
+struct ksmbd_conn *ksmbd_conn_alloc(void)
+{
+	struct ksmbd_conn *conn;
+
+	conn = kzalloc(sizeof(struct ksmbd_conn), GFP_KERNEL);
+	if (!conn)
+		return NULL;
+
+	conn->need_neg = true;
+	conn->status = KSMBD_SESS_NEW;
+	conn->local_nls = load_nls("utf8");
+	if (!conn->local_nls)
+		conn->local_nls = load_nls_default();
+	atomic_set(&conn->req_running, 0);
+	atomic_set(&conn->r_count, 0);
+	init_waitqueue_head(&conn->req_running_q);
+	INIT_LIST_HEAD(&conn->conns_list);
+	INIT_LIST_HEAD(&conn->sessions);
+	INIT_LIST_HEAD(&conn->requests);
+	INIT_LIST_HEAD(&conn->async_requests);
+	spin_lock_init(&conn->request_lock);
+	spin_lock_init(&conn->credits_lock);
+	ida_init(&conn->async_ida);
+
+	write_lock(&conn_list_lock);
+	list_add(&conn->conns_list, &conn_list);
+	write_unlock(&conn_list_lock);
+	return conn;
+}
+
+bool ksmbd_conn_lookup_dialect(struct ksmbd_conn *c)
+{
+	struct ksmbd_conn *t;
+	bool ret = false;
+
+	read_lock(&conn_list_lock);
+	list_for_each_entry(t, &conn_list, conns_list) {
+		if (memcmp(t->ClientGUID, c->ClientGUID, SMB2_CLIENT_GUID_SIZE))
+			continue;
+
+		ret = true;
+		break;
+	}
+	read_unlock(&conn_list_lock);
+	return ret;
+}
+
+void ksmbd_conn_enqueue_request(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct list_head *requests_queue = NULL;
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	struct smb2_hdr *hdr = work->request_buf;
+
+	if (hdr->ProtocolId == SMB2_PROTO_NUMBER) {
+		if (conn->ops->get_cmd_val(work) != SMB2_CANCEL_HE) {
+			requests_queue = &conn->requests;
+			work->syncronous = true;
+		}
+	} else {
+		if (conn->ops->get_cmd_val(work) != SMB_COM_NT_CANCEL)
+			requests_queue = &conn->requests;
+	}
+#else
+	if (conn->ops->get_cmd_val(work) != SMB2_CANCEL_HE) {
+		requests_queue = &conn->requests;
+		work->syncronous = true;
+	}
+#endif
+
+	if (requests_queue) {
+		atomic_inc(&conn->req_running);
+		spin_lock(&conn->request_lock);
+		list_add_tail(&work->request_entry, requests_queue);
+		spin_unlock(&conn->request_lock);
+	}
+}
+
+int ksmbd_conn_try_dequeue_request(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	int ret = 1;
+
+	if (list_empty(&work->request_entry) &&
+	    list_empty(&work->async_request_entry))
+		return 0;
+
+	atomic_dec(&conn->req_running);
+	spin_lock(&conn->request_lock);
+	if (!work->multiRsp) {
+		list_del_init(&work->request_entry);
+		if (work->syncronous == false)
+			list_del_init(&work->async_request_entry);
+		ret = 0;
+	}
+	spin_unlock(&conn->request_lock);
+
+	wake_up_all(&conn->req_running_q);
+	return ret;
+}
+
+static void ksmbd_conn_lock(struct ksmbd_conn *conn)
+{
+	mutex_lock(&conn->srv_mutex);
+}
+
+static void ksmbd_conn_unlock(struct ksmbd_conn *conn)
+{
+	mutex_unlock(&conn->srv_mutex);
+}
+
+void ksmbd_conn_wait_idle(struct ksmbd_conn *conn)
+{
+	wait_event(conn->req_running_q, atomic_read(&conn->req_running) < 2);
+}
+
+int ksmbd_conn_write(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb_hdr *rsp_hdr = work->response_buf;
+	size_t len = 0;
+	int sent;
+	struct kvec iov[3];
+	int iov_idx = 0;
+
+	ksmbd_conn_try_dequeue_request(work);
+	if (!rsp_hdr) {
+		ksmbd_err("NULL response header\n");
+		return -EINVAL;
+	}
+
+	if (work->tr_buf) {
+		iov[iov_idx] = (struct kvec) { work->tr_buf,
+				sizeof(struct smb2_transform_hdr) };
+		len += iov[iov_idx++].iov_len;
+	}
+
+	if (work->aux_payload_sz) {
+		iov[iov_idx] = (struct kvec) { rsp_hdr, work->resp_hdr_sz };
+		len += iov[iov_idx++].iov_len;
+		iov[iov_idx] = (struct kvec) { work->aux_payload_buf, work->aux_payload_sz };
+		len += iov[iov_idx++].iov_len;
+	} else {
+		if (work->tr_buf)
+			iov[iov_idx].iov_len = work->resp_hdr_sz;
+		else
+			iov[iov_idx].iov_len = get_rfc1002_len(rsp_hdr) + 4;
+		iov[iov_idx].iov_base = rsp_hdr;
+		len += iov[iov_idx++].iov_len;
+	}
+
+	ksmbd_conn_lock(conn);
+	sent = conn->transport->ops->writev(conn->transport, &iov[0],
+					iov_idx, len,
+					work->need_invalidate_rkey,
+					work->remote_key);
+	ksmbd_conn_unlock(conn);
+
+	if (sent < 0) {
+		ksmbd_err("Failed to send message: %d\n", sent);
+		return sent;
+	}
+
+	return 0;
+}
+
+int ksmbd_conn_rdma_read(struct ksmbd_conn *conn, void *buf,
+		unsigned int buflen, u32 remote_key, u64 remote_offset,
+		u32 remote_len)
+{
+	int ret = -EINVAL;
+
+	if (conn->transport->ops->rdma_read)
+		ret = conn->transport->ops->rdma_read(conn->transport,
+						buf, buflen,
+						remote_key, remote_offset,
+						remote_len);
+	return ret;
+}
+
+int ksmbd_conn_rdma_write(struct ksmbd_conn *conn, void *buf,
+		unsigned int buflen, u32 remote_key, u64 remote_offset,
+		u32 remote_len)
+{
+	int ret = -EINVAL;
+
+	if (conn->transport->ops->rdma_write)
+		ret = conn->transport->ops->rdma_write(conn->transport,
+						buf, buflen,
+						remote_key, remote_offset,
+						remote_len);
+	return ret;
+}
+
+bool ksmbd_conn_alive(struct ksmbd_conn *conn)
+{
+	if (!ksmbd_server_running())
+		return false;
+
+	if (conn->status == KSMBD_SESS_EXITING)
+		return false;
+
+	if (kthread_should_stop())
+		return false;
+
+	if (atomic_read(&conn->stats.open_files_count) > 0)
+		return true;
+
+	/*
+	 * Stop current session if the time that get last request from client
+	 * is bigger than deadtime user configured and openning file count is
+	 * zero.
+	 */
+	if (server_conf.deadtime > 0 &&
+	    time_after(jiffies, conn->last_active + server_conf.deadtime)) {
+		ksmbd_debug(CONN, "No response from client in %lu minutes\n",
+			server_conf.deadtime / SMB_ECHO_INTERVAL);
+		return false;
+	}
+	return true;
+}
+
+/**
+ * ksmbd_conn_handler_loop() - session thread to listen on new smb requests
+ * @p:		connection instance
+ *
+ * One thread each per connection
+ *
+ * Return:	0 on success
+ */
+int ksmbd_conn_handler_loop(void *p)
+{
+	struct ksmbd_conn *conn = (struct ksmbd_conn *)p;
+	struct ksmbd_transport *t = conn->transport;
+	unsigned int pdu_size;
+	char hdr_buf[4] = {0,};
+	int size;
+
+	mutex_init(&conn->srv_mutex);
+	__module_get(THIS_MODULE);
+
+	if (t->ops->prepare && t->ops->prepare(t))
+		goto out;
+
+	conn->last_active = jiffies;
+	while (ksmbd_conn_alive(conn)) {
+		if (try_to_freeze())
+			continue;
+
+		kvfree(conn->request_buf);
+		conn->request_buf = NULL;
+
+		size = t->ops->read(t, hdr_buf, sizeof(hdr_buf));
+		if (size != sizeof(hdr_buf))
+			break;
+
+		pdu_size = get_rfc1002_len(hdr_buf);
+		ksmbd_debug(CONN, "RFC1002 header %u bytes\n", pdu_size);
+
+		/* make sure we have enough to get to SMB header end */
+		if (!ksmbd_pdu_size_has_room(pdu_size)) {
+			ksmbd_debug(CONN, "SMB request too short (%u bytes)\n",
+				    pdu_size);
+			continue;
+		}
+
+		/* 4 for rfc1002 length field */
+		size = pdu_size + 4;
+		conn->request_buf = kvmalloc(size, GFP_KERNEL);
+		if (!conn->request_buf)
+			continue;
+
+		memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));
+		if (!ksmbd_smb_request(conn))
+			break;
+
+		/*
+		 * We already read 4 bytes to find out PDU size, now
+		 * read in PDU
+		 */
+		size = t->ops->read(t, conn->request_buf + 4, pdu_size);
+		if (size < 0) {
+			ksmbd_err("sock_read failed: %d\n", size);
+			break;
+		}
+
+		if (size != pdu_size) {
+			ksmbd_err("PDU error. Read: %d, Expected: %d\n",
+				  size,
+				  pdu_size);
+			continue;
+		}
+
+		if (!default_conn_ops.process_fn) {
+			ksmbd_err("No connection request callback\n");
+			break;
+		}
+
+		if (default_conn_ops.process_fn(conn)) {
+			ksmbd_err("Cannot handle request\n");
+			break;
+		}
+	}
+
+out:
+	/* Wait till all reference dropped to the Server object*/
+	while (atomic_read(&conn->r_count) > 0)
+		schedule_timeout(HZ);
+
+	unload_nls(conn->local_nls);
+	if (default_conn_ops.terminate_fn)
+		default_conn_ops.terminate_fn(conn);
+	t->ops->disconnect(t);
+	module_put(THIS_MODULE);
+	return 0;
+}
+
+void ksmbd_conn_init_server_callbacks(struct ksmbd_conn_ops *ops)
+{
+	default_conn_ops.process_fn = ops->process_fn;
+	default_conn_ops.terminate_fn = ops->terminate_fn;
+}
+
+int ksmbd_conn_transport_init(void)
+{
+	int ret;
+
+	mutex_lock(&init_lock);
+	ret = ksmbd_tcp_init();
+	if (ret) {
+		pr_err("Failed to init TCP subsystem: %d\n", ret);
+		goto out;
+	}
+
+	ret = ksmbd_rdma_init();
+	if (ret) {
+		pr_err("Failed to init KSMBD subsystem: %d\n", ret);
+		goto out;
+	}
+out:
+	mutex_unlock(&init_lock);
+	return ret;
+}
+
+static void stop_sessions(void)
+{
+	struct ksmbd_conn *conn;
+
+again:
+	read_lock(&conn_list_lock);
+	list_for_each_entry(conn, &conn_list, conns_list) {
+		struct task_struct *task;
+
+		task = conn->transport->handler;
+		if (task)
+			ksmbd_debug(CONN, "Stop session handler %s/%d\n",
+				  task->comm, task_pid_nr(task));
+		conn->status = KSMBD_SESS_EXITING;
+	}
+	read_unlock(&conn_list_lock);
+
+	if (!list_empty(&conn_list)) {
+		schedule_timeout_interruptible(HZ / 10); /* 100ms */
+		goto again;
+	}
+}
+
+void ksmbd_conn_transport_destroy(void)
+{
+	mutex_lock(&init_lock);
+	ksmbd_tcp_destroy();
+	ksmbd_rdma_destroy();
+	stop_sessions();
+	mutex_unlock(&init_lock);
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./connection.h linux-5.4.60-fbx/fs/cifsd/connection.h
--- linux-5.4.60-fbx/fs/cifsd./connection.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/connection.h	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,208 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __KSMBD_CONNECTION_H__
+#define __KSMBD_CONNECTION_H__
+
+#include <linux/list.h>
+#include <linux/ip.h>
+#include <net/sock.h>
+#include <net/tcp.h>
+#include <net/inet_connection_sock.h>
+#include <net/request_sock.h>
+#include <linux/kthread.h>
+#include <linux/nls.h>
+
+#include "smb_common.h"
+#include "ksmbd_work.h"
+
+#define KSMBD_SOCKET_BACKLOG		16
+
+/*
+ * WARNING
+ *
+ * This is nothing but a HACK. Session status should move to channel
+ * or to session. As of now we have 1 tcp_conn : 1 ksmbd_session, but
+ * we need to change it to 1 tcp_conn : N ksmbd_sessions.
+ */
+enum {
+	KSMBD_SESS_NEW = 0,
+	KSMBD_SESS_GOOD,
+	KSMBD_SESS_EXITING,
+	KSMBD_SESS_NEED_RECONNECT,
+	KSMBD_SESS_NEED_NEGOTIATE
+};
+
+struct ksmbd_stats {
+	atomic_t			open_files_count;
+	atomic64_t			request_served;
+};
+
+struct ksmbd_transport;
+
+struct ksmbd_conn {
+	struct smb_version_values	*vals;
+	struct smb_version_ops		*ops;
+	struct smb_version_cmds		*cmds;
+	unsigned int			max_cmds;
+	struct mutex			srv_mutex;
+	int				status;
+	unsigned int			cli_cap;
+	char				*request_buf;
+	struct ksmbd_transport		*transport;
+	struct nls_table		*local_nls;
+	struct list_head		conns_list;
+	/* smb session 1 per user */
+	struct list_head		sessions;
+	unsigned long			last_active;
+	/* How many request are running currently */
+	atomic_t			req_running;
+	/* References which are made for this Server object*/
+	atomic_t			r_count;
+	unsigned short			total_credits;
+	unsigned short			max_credits;
+	spinlock_t			credits_lock;
+	wait_queue_head_t		req_running_q;
+	/* Lock to protect requests list*/
+	spinlock_t			request_lock;
+	struct list_head		requests;
+	struct list_head		async_requests;
+	int				connection_type;
+	struct ksmbd_stats		stats;
+	char				ClientGUID[SMB2_CLIENT_GUID_SIZE];
+	union {
+		/* pending trans request table */
+		struct trans_state	*recent_trans;
+		/* Used by ntlmssp */
+		char			*ntlmssp_cryptkey;
+	};
+
+	struct preauth_integrity_info	*preauth_info;
+
+	bool				need_neg;
+	unsigned int			auth_mechs;
+	unsigned int			preferred_auth_mech;
+	bool				sign;
+	bool				use_spnego:1;
+	__u16				cli_sec_mode;
+	__u16				srv_sec_mode;
+	/* dialect index that server chose */
+	__u16				dialect;
+
+	char				*mechToken;
+
+	struct ksmbd_conn_ops	*conn_ops;
+
+	/* Preauth Session Table */
+	struct list_head		preauth_sess_table;
+
+	struct sockaddr_storage		peer_addr;
+
+	/* Identifier for async message */
+	struct ida			async_ida;
+
+	__le16				cipher_type;
+	__le16				compress_algorithm;
+	bool				posix_ext_supported;
+};
+
+struct ksmbd_conn_ops {
+	int	(*process_fn)(struct ksmbd_conn *conn);
+	int	(*terminate_fn)(struct ksmbd_conn *conn);
+};
+
+struct ksmbd_transport_ops {
+	int (*prepare)(struct ksmbd_transport *t);
+	void (*disconnect)(struct ksmbd_transport *t);
+	int (*read)(struct ksmbd_transport *t, char *buf, unsigned int size);
+	int (*writev)(struct ksmbd_transport *t, struct kvec *iovs, int niov,
+			int size, bool need_invalidate_rkey,
+			unsigned int remote_key);
+	int (*rdma_read)(struct ksmbd_transport *t, void *buf, unsigned int len,
+			u32 remote_key, u64 remote_offset, u32 remote_len);
+	int (*rdma_write)(struct ksmbd_transport *t, void *buf,
+			unsigned int len, u32 remote_key, u64 remote_offset,
+			u32 remote_len);
+};
+
+struct ksmbd_transport {
+	struct ksmbd_conn		*conn;
+	struct ksmbd_transport_ops	*ops;
+	struct task_struct		*handler;
+};
+
+#define KSMBD_TCP_RECV_TIMEOUT	(7 * HZ)
+#define KSMBD_TCP_SEND_TIMEOUT	(5 * HZ)
+#define KSMBD_TCP_PEER_SOCKADDR(c)	((struct sockaddr *)&((c)->peer_addr))
+
+bool ksmbd_conn_alive(struct ksmbd_conn *conn);
+void ksmbd_conn_wait_idle(struct ksmbd_conn *conn);
+
+struct ksmbd_conn *ksmbd_conn_alloc(void);
+void ksmbd_conn_free(struct ksmbd_conn *conn);
+bool ksmbd_conn_lookup_dialect(struct ksmbd_conn *c);
+int ksmbd_conn_write(struct ksmbd_work *work);
+int ksmbd_conn_rdma_read(struct ksmbd_conn *conn, void *buf,
+		unsigned int buflen, u32 remote_key, u64 remote_offset,
+		u32 remote_len);
+int ksmbd_conn_rdma_write(struct ksmbd_conn *conn, void *buf,
+		unsigned int buflen, u32 remote_key, u64 remote_offset,
+		u32 remote_len);
+
+void ksmbd_conn_enqueue_request(struct ksmbd_work *work);
+int ksmbd_conn_try_dequeue_request(struct ksmbd_work *work);
+void ksmbd_conn_init_server_callbacks(struct ksmbd_conn_ops *ops);
+
+int ksmbd_conn_handler_loop(void *p);
+
+int ksmbd_conn_transport_init(void);
+void ksmbd_conn_transport_destroy(void);
+
+/*
+ * WARNING
+ *
+ * This is a hack. We will move status to a proper place once we land
+ * a multi-sessions support.
+ */
+static inline bool ksmbd_conn_good(struct ksmbd_work *work)
+{
+	return work->conn->status == KSMBD_SESS_GOOD;
+}
+
+static inline bool ksmbd_conn_need_negotiate(struct ksmbd_work *work)
+{
+	return work->conn->status == KSMBD_SESS_NEED_NEGOTIATE;
+}
+
+static inline bool ksmbd_conn_need_reconnect(struct ksmbd_work *work)
+{
+	return work->conn->status == KSMBD_SESS_NEED_RECONNECT;
+}
+
+static inline bool ksmbd_conn_exiting(struct ksmbd_work *work)
+{
+	return work->conn->status == KSMBD_SESS_EXITING;
+}
+
+static inline void ksmbd_conn_set_good(struct ksmbd_work *work)
+{
+	work->conn->status = KSMBD_SESS_GOOD;
+}
+
+static inline void ksmbd_conn_set_need_negotiate(struct ksmbd_work *work)
+{
+	work->conn->status = KSMBD_SESS_NEED_NEGOTIATE;
+}
+
+static inline void ksmbd_conn_set_need_reconnect(struct ksmbd_work *work)
+{
+	work->conn->status = KSMBD_SESS_NEED_RECONNECT;
+}
+
+static inline void ksmbd_conn_set_exiting(struct ksmbd_work *work)
+{
+	work->conn->status = KSMBD_SESS_EXITING;
+}
+#endif /* __CONNECTION_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./crypto_ctx.c linux-5.4.60-fbx/fs/cifsd/crypto_ctx.c
--- linux-5.4.60-fbx/fs/cifsd./crypto_ctx.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/crypto_ctx.c	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,287 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2019 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/err.h>
+#include <linux/slab.h>
+#include <linux/wait.h>
+#include <linux/sched.h>
+#include <linux/version.h>
+
+#include "glob.h"
+#include "crypto_ctx.h"
+#include "buffer_pool.h"
+
+struct crypto_ctx_list {
+	spinlock_t		ctx_lock;
+	int			avail_ctx;
+	struct list_head	idle_ctx;
+	wait_queue_head_t	ctx_wait;
+};
+
+static struct crypto_ctx_list ctx_list;
+
+static inline void free_aead(struct crypto_aead *aead)
+{
+	if (aead)
+		crypto_free_aead(aead);
+}
+
+static void free_shash(struct shash_desc *shash)
+{
+	if (shash) {
+		crypto_free_shash(shash->tfm);
+		kfree(shash);
+	}
+}
+
+static struct crypto_aead *alloc_aead(int id)
+{
+	struct crypto_aead *tfm = NULL;
+
+	switch (id) {
+	case CRYPTO_AEAD_AES128_GCM:
+		tfm = crypto_alloc_aead("gcm(aes)", 0, 0);
+		break;
+	case CRYPTO_AEAD_AES128_CCM:
+		tfm = crypto_alloc_aead("ccm(aes)", 0, 0);
+		break;
+	default:
+		ksmbd_err("Does not support encrypt ahead(id : %d)\n", id);
+		return NULL;
+	}
+
+	if (IS_ERR(tfm)) {
+		ksmbd_err("Failed to alloc encrypt aead : %ld\n", PTR_ERR(tfm));
+		return NULL;
+	}
+
+	return tfm;
+}
+
+static struct shash_desc *alloc_shash_desc(int id)
+{
+	struct crypto_shash *tfm = NULL;
+	struct shash_desc *shash;
+
+	switch (id) {
+	case CRYPTO_SHASH_HMACMD5:
+		tfm = crypto_alloc_shash("hmac(md5)", 0, 0);
+		break;
+	case CRYPTO_SHASH_HMACSHA256:
+		tfm = crypto_alloc_shash("hmac(sha256)", 0, 0);
+		break;
+	case CRYPTO_SHASH_CMACAES:
+		tfm = crypto_alloc_shash("cmac(aes)", 0, 0);
+		break;
+	case CRYPTO_SHASH_SHA256:
+		tfm = crypto_alloc_shash("sha256", 0, 0);
+		break;
+	case CRYPTO_SHASH_SHA512:
+		tfm = crypto_alloc_shash("sha512", 0, 0);
+		break;
+	case CRYPTO_SHASH_MD4:
+		tfm = crypto_alloc_shash("md4", 0, 0);
+		break;
+	case CRYPTO_SHASH_MD5:
+		tfm = crypto_alloc_shash("md5", 0, 0);
+		break;
+	}
+
+	if (IS_ERR(tfm))
+		return NULL;
+
+	shash = kzalloc(sizeof(*shash) + crypto_shash_descsize(tfm),
+			GFP_KERNEL);
+	if (!shash)
+		crypto_free_shash(tfm);
+	else
+		shash->tfm = tfm;
+	return shash;
+}
+
+static struct ksmbd_crypto_ctx *ctx_alloc(void)
+{
+	return kzalloc(sizeof(struct ksmbd_crypto_ctx), GFP_KERNEL);
+}
+
+static void ctx_free(struct ksmbd_crypto_ctx *ctx)
+{
+	int i;
+
+	for (i = 0; i < CRYPTO_SHASH_MAX; i++)
+		free_shash(ctx->desc[i]);
+	for (i = 0; i < CRYPTO_AEAD_MAX; i++)
+		free_aead(ctx->ccmaes[i]);
+	kfree(ctx);
+}
+
+static struct ksmbd_crypto_ctx *ksmbd_find_crypto_ctx(void)
+{
+	struct ksmbd_crypto_ctx *ctx;
+
+	while (1) {
+		spin_lock(&ctx_list.ctx_lock);
+		if (!list_empty(&ctx_list.idle_ctx)) {
+			ctx = list_entry(ctx_list.idle_ctx.next,
+					  struct ksmbd_crypto_ctx,
+					  list);
+			list_del(&ctx->list);
+			spin_unlock(&ctx_list.ctx_lock);
+			return ctx;
+		}
+
+		if (ctx_list.avail_ctx > num_online_cpus()) {
+			spin_unlock(&ctx_list.ctx_lock);
+			wait_event(ctx_list.ctx_wait,
+				   !list_empty(&ctx_list.idle_ctx));
+			continue;
+		}
+
+		ctx_list.avail_ctx++;
+		spin_unlock(&ctx_list.ctx_lock);
+
+		ctx = ctx_alloc();
+		if (!ctx) {
+			spin_lock(&ctx_list.ctx_lock);
+			ctx_list.avail_ctx--;
+			spin_unlock(&ctx_list.ctx_lock);
+			wait_event(ctx_list.ctx_wait,
+				   !list_empty(&ctx_list.idle_ctx));
+			continue;
+		}
+		break;
+	}
+	return ctx;
+}
+
+void ksmbd_release_crypto_ctx(struct ksmbd_crypto_ctx *ctx)
+{
+	if (!ctx)
+		return;
+
+	spin_lock(&ctx_list.ctx_lock);
+	if (ctx_list.avail_ctx <= num_online_cpus()) {
+		list_add(&ctx->list, &ctx_list.idle_ctx);
+		spin_unlock(&ctx_list.ctx_lock);
+		wake_up(&ctx_list.ctx_wait);
+		return;
+	}
+
+	ctx_list.avail_ctx--;
+	spin_unlock(&ctx_list.ctx_lock);
+	ctx_free(ctx);
+}
+
+static struct ksmbd_crypto_ctx *____crypto_shash_ctx_find(int id)
+{
+	struct ksmbd_crypto_ctx *ctx;
+
+	if (id >= CRYPTO_SHASH_MAX)
+		return NULL;
+
+	ctx = ksmbd_find_crypto_ctx();
+	if (ctx->desc[id])
+		return ctx;
+
+	ctx->desc[id] = alloc_shash_desc(id);
+	if (ctx->desc[id])
+		return ctx;
+	ksmbd_release_crypto_ctx(ctx);
+	return NULL;
+}
+
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_hmacmd5(void)
+{
+	return ____crypto_shash_ctx_find(CRYPTO_SHASH_HMACMD5);
+}
+
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_hmacsha256(void)
+{
+	return ____crypto_shash_ctx_find(CRYPTO_SHASH_HMACSHA256);
+}
+
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_cmacaes(void)
+{
+	return ____crypto_shash_ctx_find(CRYPTO_SHASH_CMACAES);
+}
+
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_sha256(void)
+{
+	return ____crypto_shash_ctx_find(CRYPTO_SHASH_SHA256);
+}
+
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_sha512(void)
+{
+	return ____crypto_shash_ctx_find(CRYPTO_SHASH_SHA512);
+}
+
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_md4(void)
+{
+	return ____crypto_shash_ctx_find(CRYPTO_SHASH_MD4);
+}
+
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_md5(void)
+{
+	return ____crypto_shash_ctx_find(CRYPTO_SHASH_MD5);
+}
+
+static struct ksmbd_crypto_ctx *____crypto_aead_ctx_find(int id)
+{
+	struct ksmbd_crypto_ctx *ctx;
+
+	if (id >= CRYPTO_AEAD_MAX)
+		return NULL;
+
+	ctx = ksmbd_find_crypto_ctx();
+	if (ctx->ccmaes[id])
+		return ctx;
+
+	ctx->ccmaes[id] = alloc_aead(id);
+	if (ctx->ccmaes[id])
+		return ctx;
+	ksmbd_release_crypto_ctx(ctx);
+	return NULL;
+}
+
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_gcm(void)
+{
+	return ____crypto_aead_ctx_find(CRYPTO_AEAD_AES128_GCM);
+}
+
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_ccm(void)
+{
+	return ____crypto_aead_ctx_find(CRYPTO_AEAD_AES128_CCM);
+}
+
+void ksmbd_crypto_destroy(void)
+{
+	struct ksmbd_crypto_ctx *ctx;
+
+	while (!list_empty(&ctx_list.idle_ctx)) {
+		ctx = list_entry(ctx_list.idle_ctx.next,
+				 struct ksmbd_crypto_ctx,
+				 list);
+		list_del(&ctx->list);
+		ctx_free(ctx);
+	}
+}
+
+int ksmbd_crypto_create(void)
+{
+	struct ksmbd_crypto_ctx *ctx;
+
+	spin_lock_init(&ctx_list.ctx_lock);
+	INIT_LIST_HEAD(&ctx_list.idle_ctx);
+	init_waitqueue_head(&ctx_list.ctx_wait);
+	ctx_list.avail_ctx = 1;
+
+	ctx = ctx_alloc();
+	if (!ctx)
+		return -ENOMEM;
+	list_add(&ctx->list, &ctx_list.idle_ctx);
+	return 0;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./crypto_ctx.h linux-5.4.60-fbx/fs/cifsd/crypto_ctx.h
--- linux-5.4.60-fbx/fs/cifsd./crypto_ctx.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/crypto_ctx.h	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,77 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2019 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __CRYPTO_CTX_H__
+#define __CRYPTO_CTX_H__
+
+#include <crypto/hash.h>
+#include <crypto/aead.h>
+
+enum {
+	CRYPTO_SHASH_HMACMD5	= 0,
+	CRYPTO_SHASH_HMACSHA256,
+	CRYPTO_SHASH_CMACAES,
+	CRYPTO_SHASH_SHA256,
+	CRYPTO_SHASH_SHA512,
+	CRYPTO_SHASH_MD4,
+	CRYPTO_SHASH_MD5,
+	CRYPTO_SHASH_MAX,
+};
+
+enum {
+	CRYPTO_AEAD_AES128_GCM = 16,
+	CRYPTO_AEAD_AES128_CCM,
+	CRYPTO_AEAD_MAX,
+};
+
+enum {
+	CRYPTO_BLK_ECBDES	= 32,
+	CRYPTO_BLK_MAX,
+};
+
+struct ksmbd_crypto_ctx {
+	struct list_head		list;
+
+	struct shash_desc		*desc[CRYPTO_SHASH_MAX];
+	struct crypto_aead		*ccmaes[CRYPTO_AEAD_MAX];
+};
+
+#define CRYPTO_HMACMD5(c)	((c)->desc[CRYPTO_SHASH_HMACMD5])
+#define CRYPTO_HMACSHA256(c)	((c)->desc[CRYPTO_SHASH_HMACSHA256])
+#define CRYPTO_CMACAES(c)	((c)->desc[CRYPTO_SHASH_CMACAES])
+#define CRYPTO_SHA256(c)	((c)->desc[CRYPTO_SHASH_SHA256])
+#define CRYPTO_SHA512(c)	((c)->desc[CRYPTO_SHASH_SHA512])
+#define CRYPTO_MD4(c)		((c)->desc[CRYPTO_SHASH_MD4])
+#define CRYPTO_MD5(c)		((c)->desc[CRYPTO_SHASH_MD5])
+
+#define CRYPTO_HMACMD5_TFM(c)	((c)->desc[CRYPTO_SHASH_HMACMD5]->tfm)
+#define CRYPTO_HMACSHA256_TFM(c)\
+				((c)->desc[CRYPTO_SHASH_HMACSHA256]->tfm)
+#define CRYPTO_CMACAES_TFM(c)	((c)->desc[CRYPTO_SHASH_CMACAES]->tfm)
+#define CRYPTO_SHA256_TFM(c)	((c)->desc[CRYPTO_SHASH_SHA256]->tfm)
+#define CRYPTO_SHA512_TFM(c)	((c)->desc[CRYPTO_SHASH_SHA512]->tfm)
+#define CRYPTO_MD4_TFM(c)	((c)->desc[CRYPTO_SHASH_MD4]->tfm)
+#define CRYPTO_MD5_TFM(c)	((c)->desc[CRYPTO_SHASH_MD5]->tfm)
+
+#define CRYPTO_GCM(c)		((c)->ccmaes[CRYPTO_AEAD_AES128_GCM])
+#define CRYPTO_CCM(c)		((c)->ccmaes[CRYPTO_AEAD_AES128_CCM])
+
+void ksmbd_release_crypto_ctx(struct ksmbd_crypto_ctx *ctx);
+
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_hmacmd5(void);
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_hmacsha256(void);
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_cmacaes(void);
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_sha512(void);
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_sha256(void);
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_md4(void);
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_md5(void);
+
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_gcm(void);
+struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_ccm(void);
+
+void ksmbd_crypto_destroy(void);
+int ksmbd_crypto_create(void);
+
+#endif /* __CRYPTO_CTX_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./glob.h linux-5.4.60-fbx/fs/cifsd/glob.h
--- linux-5.4.60-fbx/fs/cifsd./glob.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/glob.h	2021-04-21 10:06:25.185180826 +0200
@@ -0,0 +1,69 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __KSMBD_GLOB_H
+#define __KSMBD_GLOB_H
+
+#include <linux/ctype.h>
+#include <linux/version.h>
+
+#include "unicode.h"
+#include "vfs_cache.h"
+
+#define KSMBD_VERSION	"3.3.8"
+
+/* @FIXME clean up this code */
+
+extern int ksmbd_debug_types;
+
+#define DATA_STREAM	1
+#define DIR_STREAM	2
+
+#define KSMBD_DEBUG_SMB		BIT(0)
+#define KSMBD_DEBUG_AUTH	BIT(1)
+#define KSMBD_DEBUG_VFS		BIT(2)
+#define KSMBD_DEBUG_OPLOCK      BIT(3)
+#define KSMBD_DEBUG_IPC         BIT(4)
+#define KSMBD_DEBUG_CONN        BIT(5)
+#define KSMBD_DEBUG_RDMA        BIT(6)
+#define KSMBD_DEBUG_ALL         (KSMBD_DEBUG_SMB | KSMBD_DEBUG_AUTH |	\
+				KSMBD_DEBUG_VFS | KSMBD_DEBUG_OPLOCK |	\
+				KSMBD_DEBUG_IPC | KSMBD_DEBUG_CONN |	\
+				KSMBD_DEBUG_RDMA)
+
+#ifndef ksmbd_pr_fmt
+#ifdef SUBMOD_NAME
+#define ksmbd_pr_fmt(fmt)	"ksmbd: " SUBMOD_NAME ": " fmt
+#else
+#define ksmbd_pr_fmt(fmt)	"ksmbd: " fmt
+#endif
+#endif
+
+#define ksmbd_debug(type, fmt, ...)				\
+	do {							\
+		if (ksmbd_debug_types & KSMBD_DEBUG_##type)	\
+			pr_info(ksmbd_pr_fmt("%s:%d: " fmt),	\
+				__func__,			\
+				__LINE__,			\
+				##__VA_ARGS__);			\
+	} while (0)
+
+#define ksmbd_info(fmt, ...)					\
+			pr_info(ksmbd_pr_fmt(fmt), ##__VA_ARGS__)
+
+#define ksmbd_err(fmt, ...)					\
+			pr_err(ksmbd_pr_fmt("%s:%d: " fmt),	\
+				__func__,			\
+				__LINE__,			\
+				##__VA_ARGS__)
+
+#define UNICODE_LEN(x)		((x) * 2)
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+/* ksmbd misc functions */
+extern void ntstatus_to_dos(__le32 ntstatus, __u8 *eclass, __le16 *ecode);
+#endif
+#endif /* __KSMBD_GLOB_H */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./Kconfig linux-5.4.60-fbx/fs/cifsd/Kconfig
--- linux-5.4.60-fbx/fs/cifsd./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/Kconfig	2021-04-21 10:06:25.185180826 +0200
@@ -0,0 +1,76 @@
+config SMB_SERVER
+	tristate "SMB server support (EXPERIMENTAL)"
+	depends on INET
+	depends on MULTIUSER
+	depends on FILE_LOCKING
+	select NLS
+	select NLS_UTF8
+	select CRYPTO
+	select CRYPTO_MD4
+	select CRYPTO_MD5
+	select CRYPTO_HMAC
+	select CRYPTO_ECB
+	select CRYPTO_LIB_DES
+	select CRYPTO_SHA256
+	select CRYPTO_CMAC
+	select CRYPTO_SHA512
+	select CRYPTO_AEAD2
+	select CRYPTO_CCM
+	select CRYPTO_GCM
+	default n
+	help
+	  Choose Y here if you want to allow SMB3 compliant clients
+	  to access files residing on this system using SMB3 protocol.
+	  To compile the SMB3 server support as a module,
+	  choose M here: the module will be called ksmbd.
+
+	  You may choose to use a samba server instead, in which
+	  case you can choose N here.
+
+	  You also need to install user space programs which can be found
+	  in cifsd-tools, available from
+	  https://github.com/cifsd-team/cifsd-tools.
+	  More detail about how to run the cifsd kernel server is
+	  available via README file
+	  (https://github.com/cifsd-team/cifsd-tools/blob/master/README).
+
+	  cifsd kernel server includes support for auto-negotiation,
+	  Secure negotiate, Pre-authentication integrity, oplock/lease,
+	  compound requests, multi-credit, packet signing, RDMA(smbdirect),
+	  smb3 encryption, copy-offload, secure per-user session
+	  establishment via NTLM or NTLMv2.
+
+config SMB_INSECURE_SERVER
+        bool "Support for insecure SMB1/CIFS and SMB2.0 protocols"
+        depends on SMB_SERVER && INET
+        select NLS
+	default n
+
+        help
+	  This enables deprecated insecure protocols dialects: SMB1/CIFS
+	  and SMB2.0
+
+config SMB_SERVER_SMBDIRECT
+	bool "Support for SMB Direct protocol"
+	depends on SMB_SERVER=m && INFINIBAND && INFINIBAND_ADDR_TRANS || SMB_SERVER=y && INFINIBAND=y && INFINIBAND_ADDR_TRANS=y
+	select SG_POOL
+	default n
+
+	help
+	  Enables SMB Direct support for SMB 3.0, 3.02 and 3.1.1.
+
+	  SMB Direct allows transferring SMB packets over RDMA. If unsure,
+	  say N.
+
+config SMB_SERVER_CHECK_CAP_NET_ADMIN
+	bool "Enable check network administration capability"
+	depends on SMB_SERVER
+	default y
+
+	help
+	  Prevent unprivileged processes to start the cifsd kernel server.
+
+config SMB_SERVER_KERBEROS5
+	bool "Support for Kerberos 5"
+	depends on SMB_SERVER
+	default n
diff -Nruw linux-5.4.60-fbx/fs/cifsd./ksmbd_server.h linux-5.4.60-fbx/fs/cifsd/ksmbd_server.h
--- linux-5.4.60-fbx/fs/cifsd./ksmbd_server.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/ksmbd_server.h	2021-04-21 10:06:25.185180826 +0200
@@ -0,0 +1,284 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ *
+ *   linux-ksmbd-devel@lists.sourceforge.net
+ */
+
+#ifndef _LINUX_KSMBD_SERVER_H
+#define _LINUX_KSMBD_SERVER_H
+
+#include <linux/types.h>
+
+#define KSMBD_GENL_NAME		"SMBD_GENL"
+#define KSMBD_GENL_VERSION		0x01
+
+#ifndef ____ksmbd_align
+#define ____ksmbd_align		__aligned(4)
+#endif
+
+#define KSMBD_REQ_MAX_ACCOUNT_NAME_SZ	48
+#define KSMBD_REQ_MAX_HASH_SZ		18
+#define KSMBD_REQ_MAX_SHARE_NAME	64
+
+struct ksmbd_heartbeat {
+	__u32	handle;
+};
+
+/*
+ * Global config flags.
+ */
+#define KSMBD_GLOBAL_FLAG_INVALID		(0)
+#define KSMBD_GLOBAL_FLAG_SMB2_LEASES		BIT(0)
+#define KSMBD_GLOBAL_FLAG_CACHE_TBUF		BIT(1)
+#define KSMBD_GLOBAL_FLAG_CACHE_RBUF		BIT(2)
+#define KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION	BIT(3)
+#define KSMBD_GLOBAL_FLAG_DURABLE_HANDLE	BIT(4)
+
+struct ksmbd_startup_request {
+	__u32	flags;
+	__s32	signing;
+	__s8	min_prot[16];
+	__s8	max_prot[16];
+	__s8	netbios_name[16];
+	__s8	work_group[64];
+	__s8	server_string[64];
+	__u16	tcp_port;
+	__u16	ipc_timeout;
+	__u32	deadtime;
+	__u32	file_max;
+	__u32	smb2_max_write;
+	__u32	smb2_max_read;
+	__u32	smb2_max_trans;
+	__u32	share_fake_fscaps;
+	__u32	sub_auth[3];
+	__u32	ifc_list_sz;
+	__s8	____payload[0];
+} ____ksmbd_align;
+
+#define KSMBD_STARTUP_CONFIG_INTERFACES(s)	((s)->____payload)
+
+struct ksmbd_shutdown_request {
+	__s32	reserved;
+} ____ksmbd_align;
+
+struct ksmbd_login_request {
+	__u32	handle;
+	__s8	account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ];
+} ____ksmbd_align;
+
+struct ksmbd_login_response {
+	__u32	handle;
+	__u32	gid;
+	__u32	uid;
+	__s8	account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ];
+	__u16	status;
+	__u16	hash_sz;
+	__s8	hash[KSMBD_REQ_MAX_HASH_SZ];
+} ____ksmbd_align;
+
+struct ksmbd_share_config_request {
+	__u32	handle;
+	__s8	share_name[KSMBD_REQ_MAX_SHARE_NAME];
+} ____ksmbd_align;
+
+struct ksmbd_share_config_response {
+	__u32	handle;
+	__u32	flags;
+	__u16	create_mask;
+	__u16	directory_mask;
+	__u16	force_create_mode;
+	__u16	force_directory_mode;
+	__u16	force_uid;
+	__u16	force_gid;
+	__u32	veto_list_sz;
+	__s8	____payload[0];
+} ____ksmbd_align;
+
+#define KSMBD_SHARE_CONFIG_VETO_LIST(s)	((s)->____payload)
+#define KSMBD_SHARE_CONFIG_PATH(s)				\
+	({							\
+		char *p = (s)->____payload;			\
+		if ((s)->veto_list_sz)				\
+			p += (s)->veto_list_sz + 1;		\
+		p;						\
+	 })
+
+struct ksmbd_tree_connect_request {
+	__u32	handle;
+	__u16	account_flags;
+	__u16	flags;
+	__u64	session_id;
+	__u64	connect_id;
+	__s8	account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ];
+	__s8	share[KSMBD_REQ_MAX_SHARE_NAME];
+	__s8	peer_addr[64];
+} ____ksmbd_align;
+
+struct ksmbd_tree_connect_response {
+	__u32	handle;
+	__u16	status;
+	__u16	connection_flags;
+} ____ksmbd_align;
+
+struct ksmbd_tree_disconnect_request {
+	__u64	session_id;
+	__u64	connect_id;
+} ____ksmbd_align;
+
+struct ksmbd_logout_request {
+	__s8	account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ];
+} ____ksmbd_align;
+
+struct ksmbd_rpc_command {
+	__u32	handle;
+	__u32	flags;
+	__u32	payload_sz;
+	__u8	payload[0];
+} ____ksmbd_align;
+
+struct ksmbd_spnego_authen_request {
+	__u32	handle;
+	__u16	spnego_blob_len;
+	__u8	spnego_blob[0];
+} ____ksmbd_align;
+
+struct ksmbd_spnego_authen_response {
+	__u32	handle;
+	struct ksmbd_login_response	login_response;
+	__u16	session_key_len;
+	__u16	spnego_blob_len;
+	__u8	payload[0];		/* session key + AP_REP */
+} ____ksmbd_align;
+
+/*
+ * This also used as NETLINK attribute type value.
+ *
+ * NOTE:
+ * Response message type value should be equal to
+ * request message type value + 1.
+ */
+enum ksmbd_event {
+	KSMBD_EVENT_UNSPEC			= 0,
+	KSMBD_EVENT_HEARTBEAT_REQUEST,
+
+	KSMBD_EVENT_STARTING_UP,
+	KSMBD_EVENT_SHUTTING_DOWN,
+
+	KSMBD_EVENT_LOGIN_REQUEST,
+	KSMBD_EVENT_LOGIN_RESPONSE		= 5,
+
+	KSMBD_EVENT_SHARE_CONFIG_REQUEST,
+	KSMBD_EVENT_SHARE_CONFIG_RESPONSE,
+
+	KSMBD_EVENT_TREE_CONNECT_REQUEST,
+	KSMBD_EVENT_TREE_CONNECT_RESPONSE,
+
+	KSMBD_EVENT_TREE_DISCONNECT_REQUEST	= 10,
+
+	KSMBD_EVENT_LOGOUT_REQUEST,
+
+	KSMBD_EVENT_RPC_REQUEST,
+	KSMBD_EVENT_RPC_RESPONSE,
+
+	KSMBD_EVENT_SPNEGO_AUTHEN_REQUEST,
+	KSMBD_EVENT_SPNEGO_AUTHEN_RESPONSE	= 15,
+
+	KSMBD_EVENT_MAX
+};
+
+enum KSMBD_TREE_CONN_STATUS {
+	KSMBD_TREE_CONN_STATUS_OK		= 0,
+	KSMBD_TREE_CONN_STATUS_NOMEM,
+	KSMBD_TREE_CONN_STATUS_NO_SHARE,
+	KSMBD_TREE_CONN_STATUS_NO_USER,
+	KSMBD_TREE_CONN_STATUS_INVALID_USER,
+	KSMBD_TREE_CONN_STATUS_HOST_DENIED	= 5,
+	KSMBD_TREE_CONN_STATUS_CONN_EXIST,
+	KSMBD_TREE_CONN_STATUS_TOO_MANY_CONNS,
+	KSMBD_TREE_CONN_STATUS_TOO_MANY_SESSIONS,
+	KSMBD_TREE_CONN_STATUS_ERROR,
+};
+
+/*
+ * User config flags.
+ */
+#define KSMBD_USER_FLAG_INVALID		(0)
+#define KSMBD_USER_FLAG_OK		BIT(0)
+#define KSMBD_USER_FLAG_BAD_PASSWORD	BIT(1)
+#define KSMBD_USER_FLAG_BAD_UID		BIT(2)
+#define KSMBD_USER_FLAG_BAD_USER	BIT(3)
+#define KSMBD_USER_FLAG_GUEST_ACCOUNT	BIT(4)
+
+/*
+ * Share config flags.
+ */
+#define KSMBD_SHARE_FLAG_INVALID		(0)
+#define KSMBD_SHARE_FLAG_AVAILABLE		BIT(0)
+#define KSMBD_SHARE_FLAG_BROWSEABLE		BIT(1)
+#define KSMBD_SHARE_FLAG_WRITEABLE		BIT(2)
+#define KSMBD_SHARE_FLAG_READONLY		BIT(3)
+#define KSMBD_SHARE_FLAG_GUEST_OK		BIT(4)
+#define KSMBD_SHARE_FLAG_GUEST_ONLY		BIT(5)
+#define KSMBD_SHARE_FLAG_STORE_DOS_ATTRS	BIT(6)
+#define KSMBD_SHARE_FLAG_OPLOCKS		BIT(7)
+#define KSMBD_SHARE_FLAG_PIPE			BIT(8)
+#define KSMBD_SHARE_FLAG_HIDE_DOT_FILES		BIT(9)
+#define KSMBD_SHARE_FLAG_INHERIT_OWNER		BIT(10)
+#define KSMBD_SHARE_FLAG_STREAMS		BIT(11)
+#define KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS	BIT(12)
+#define KSMBD_SHARE_FLAG_ACL_XATTR		BIT(13)
+
+/*
+ * Tree connect request flags.
+ */
+#define KSMBD_TREE_CONN_FLAG_REQUEST_SMB1	(0)
+#define KSMBD_TREE_CONN_FLAG_REQUEST_IPV6	BIT(0)
+#define KSMBD_TREE_CONN_FLAG_REQUEST_SMB2	BIT(1)
+
+/*
+ * Tree connect flags.
+ */
+#define KSMBD_TREE_CONN_FLAG_GUEST_ACCOUNT	BIT(0)
+#define KSMBD_TREE_CONN_FLAG_READ_ONLY		BIT(1)
+#define KSMBD_TREE_CONN_FLAG_WRITABLE		BIT(2)
+#define KSMBD_TREE_CONN_FLAG_ADMIN_ACCOUNT	BIT(3)
+
+/*
+ * RPC over IPC.
+ */
+#define KSMBD_RPC_METHOD_RETURN		BIT(0)
+#define KSMBD_RPC_SRVSVC_METHOD_INVOKE	BIT(1)
+#define KSMBD_RPC_SRVSVC_METHOD_RETURN	(KSMBD_RPC_SRVSVC_METHOD_INVOKE | KSMBD_RPC_METHOD_RETURN)
+#define KSMBD_RPC_WKSSVC_METHOD_INVOKE	BIT(2)
+#define KSMBD_RPC_WKSSVC_METHOD_RETURN	(KSMBD_RPC_WKSSVC_METHOD_INVOKE | KSMBD_RPC_METHOD_RETURN)
+#define KSMBD_RPC_IOCTL_METHOD		(BIT(3) | KSMBD_RPC_METHOD_RETURN)
+#define KSMBD_RPC_OPEN_METHOD		BIT(4)
+#define KSMBD_RPC_WRITE_METHOD		BIT(5)
+#define KSMBD_RPC_READ_METHOD		(BIT(6) | KSMBD_RPC_METHOD_RETURN)
+#define KSMBD_RPC_CLOSE_METHOD		BIT(7)
+#define KSMBD_RPC_RAP_METHOD		(BIT(8) | KSMBD_RPC_METHOD_RETURN)
+#define KSMBD_RPC_RESTRICTED_CONTEXT	BIT(9)
+#define KSMBD_RPC_SAMR_METHOD_INVOKE	BIT(10)
+#define KSMBD_RPC_SAMR_METHOD_RETURN	(KSMBD_RPC_SAMR_METHOD_INVOKE | KSMBD_RPC_METHOD_RETURN)
+#define KSMBD_RPC_LSARPC_METHOD_INVOKE	BIT(11)
+#define KSMBD_RPC_LSARPC_METHOD_RETURN	(KSMBD_RPC_LSARPC_METHOD_INVOKE | KSMBD_RPC_METHOD_RETURN)
+
+#define KSMBD_RPC_OK			0
+#define KSMBD_RPC_EBAD_FUNC		0x00000001
+#define KSMBD_RPC_EACCESS_DENIED	0x00000005
+#define KSMBD_RPC_EBAD_FID		0x00000006
+#define KSMBD_RPC_ENOMEM		0x00000008
+#define KSMBD_RPC_EBAD_DATA		0x0000000D
+#define KSMBD_RPC_ENOTIMPLEMENTED	0x00000040
+#define KSMBD_RPC_EINVALID_PARAMETER	0x00000057
+#define KSMBD_RPC_EMORE_DATA		0x000000EA
+#define KSMBD_RPC_EINVALID_LEVEL	0x0000007C
+#define KSMBD_RPC_SOME_NOT_MAPPED	0x00000107
+
+#define KSMBD_CONFIG_OPT_DISABLED	0
+#define KSMBD_CONFIG_OPT_ENABLED	1
+#define KSMBD_CONFIG_OPT_AUTO		2
+#define KSMBD_CONFIG_OPT_MANDATORY	3
+
+#endif /* _LINUX_KSMBD_SERVER_H */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./ksmbd_work.c linux-5.4.60-fbx/fs/cifsd/ksmbd_work.c
--- linux-5.4.60-fbx/fs/cifsd./ksmbd_work.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/ksmbd_work.c	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2019 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/workqueue.h>
+
+#include "server.h"
+#include "connection.h"
+#include "ksmbd_work.h"
+#include "buffer_pool.h"
+#include "mgmt/ksmbd_ida.h"
+
+/* @FIXME */
+#include "ksmbd_server.h"
+
+static struct kmem_cache *work_cache;
+static struct workqueue_struct *ksmbd_wq;
+
+struct ksmbd_work *ksmbd_alloc_work_struct(void)
+{
+	struct ksmbd_work *work = kmem_cache_zalloc(work_cache, GFP_KERNEL);
+
+	if (work) {
+		work->compound_fid = KSMBD_NO_FID;
+		work->compound_pfid = KSMBD_NO_FID;
+		INIT_LIST_HEAD(&work->request_entry);
+		INIT_LIST_HEAD(&work->async_request_entry);
+		INIT_LIST_HEAD(&work->fp_entry);
+		INIT_LIST_HEAD(&work->interim_entry);
+	}
+	return work;
+}
+
+void ksmbd_free_work_struct(struct ksmbd_work *work)
+{
+	WARN_ON(work->saved_cred != NULL);
+	if (server_conf.flags & KSMBD_GLOBAL_FLAG_CACHE_TBUF &&
+			work->set_trans_buf)
+		ksmbd_release_buffer(work->response_buf);
+	else
+		kvfree(work->response_buf);
+
+	if (server_conf.flags & KSMBD_GLOBAL_FLAG_CACHE_RBUF &&
+			work->set_read_buf)
+		ksmbd_release_buffer(work->aux_payload_buf);
+	else
+		kvfree(work->aux_payload_buf);
+
+	kfree(work->tr_buf);
+	kvfree(work->request_buf);
+	if (work->async_id)
+		ksmbd_release_id(&work->conn->async_ida, work->async_id);
+	kmem_cache_free(work_cache, work);
+}
+
+void ksmbd_work_pool_destroy(void)
+{
+	kmem_cache_destroy(work_cache);
+}
+
+int ksmbd_work_pool_init(void)
+{
+	work_cache = kmem_cache_create("ksmbd_work_cache",
+					sizeof(struct ksmbd_work), 0,
+					SLAB_HWCACHE_ALIGN, NULL);
+	if (!work_cache)
+		return -ENOMEM;
+	return 0;
+}
+
+int ksmbd_workqueue_init(void)
+{
+	ksmbd_wq = alloc_workqueue("ksmbd-io", 0, 0);
+	if (!ksmbd_wq)
+		return -ENOMEM;
+	return 0;
+}
+
+void ksmbd_workqueue_destroy(void)
+{
+	flush_workqueue(ksmbd_wq);
+	destroy_workqueue(ksmbd_wq);
+	ksmbd_wq = NULL;
+}
+
+bool ksmbd_queue_work(struct ksmbd_work *work)
+{
+	return queue_work(ksmbd_wq, &work->work);
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./ksmbd_work.h linux-5.4.60-fbx/fs/cifsd/ksmbd_work.h
--- linux-5.4.60-fbx/fs/cifsd./ksmbd_work.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/ksmbd_work.h	2021-03-30 16:07:01.585102883 +0200
@@ -0,0 +1,110 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2019 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __KSMBD_WORK_H__
+#define __KSMBD_WORK_H__
+
+#include <linux/ctype.h>
+#include <linux/workqueue.h>
+
+struct ksmbd_conn;
+struct ksmbd_session;
+struct ksmbd_tree_connect;
+
+enum {
+	KSMBD_WORK_ACTIVE = 0,
+	KSMBD_WORK_CANCELLED,
+	KSMBD_WORK_CLOSED,
+};
+
+/* one of these for every pending CIFS request at the connection */
+struct ksmbd_work {
+	/* Server corresponding to this mid */
+	struct ksmbd_conn               *conn;
+	struct ksmbd_session            *sess;
+	struct ksmbd_tree_connect       *tcon;
+
+	/* Pointer to received SMB header */
+	void                            *request_buf;
+	/* Response buffer */
+	void                            *response_buf;
+
+	/* Read data buffer */
+	void                            *aux_payload_buf;
+
+	/* Next cmd hdr in compound req buf*/
+	int                             next_smb2_rcv_hdr_off;
+	/* Next cmd hdr in compound rsp buf*/
+	int                             next_smb2_rsp_hdr_off;
+
+	/*
+	 * Current Local FID assigned compound response if SMB2 CREATE
+	 * command is present in compound request
+	 */
+	unsigned int                    compound_fid;
+	unsigned int                    compound_pfid;
+	unsigned int                    compound_sid;
+
+	const struct cred		*saved_cred;
+
+	/* Number of granted credits */
+	unsigned int			credits_granted;
+
+	/* response smb header size */
+	unsigned int                    resp_hdr_sz;
+	unsigned int                    response_sz;
+	/* Read data count */
+	unsigned int                    aux_payload_sz;
+
+	void				*tr_buf;
+
+	unsigned char			state;
+	/* Multiple responses for one request e.g. SMB ECHO */
+	bool                            multiRsp:1;
+	/* No response for cancelled request */
+	bool                            send_no_response:1;
+	/* Request is encrypted */
+	bool                            encrypted:1;
+	/* Is this SYNC or ASYNC ksmbd_work */
+	bool                            syncronous:1;
+	bool                            need_invalidate_rkey:1;
+	bool                            set_trans_buf:1;
+	bool                            set_read_buf:1;
+
+	unsigned int                    remote_key;
+	/* cancel works */
+	int                             async_id;
+	void                            **cancel_argv;
+	void                            (*cancel_fn)(void **argv);
+
+	struct work_struct              work;
+	/* List head at conn->requests */
+	struct list_head                request_entry;
+	/* List head at conn->async_requests */
+	struct list_head                async_request_entry;
+	struct list_head                fp_entry;
+	struct list_head                interim_entry;
+};
+
+#define WORK_CANCELLED(w)	((w)->state == KSMBD_WORK_CANCELLED)
+#define WORK_CLOSED(w)		((w)->state == KSMBD_WORK_CLOSED)
+#define WORK_ACTIVE(w)		((w)->state == KSMBD_WORK_ACTIVE)
+
+#define RESPONSE_BUF_NEXT(w)	\
+	(((w)->response_buf + (w)->next_smb2_rsp_hdr_off))
+#define REQUEST_BUF_NEXT(w)	\
+	(((w)->request_buf + (w)->next_smb2_rcv_hdr_off))
+
+struct ksmbd_work *ksmbd_alloc_work_struct(void);
+void ksmbd_free_work_struct(struct ksmbd_work *work);
+
+void ksmbd_work_pool_destroy(void);
+int ksmbd_work_pool_init(void);
+
+int ksmbd_workqueue_init(void);
+void ksmbd_workqueue_destroy(void);
+bool ksmbd_queue_work(struct ksmbd_work *work);
+
+#endif /* __KSMBD_WORK_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./Makefile linux-5.4.60-fbx/fs/cifsd/Makefile
--- linux-5.4.60-fbx/fs/cifsd./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/Makefile	2021-04-21 10:06:25.185180826 +0200
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Makefile for Linux SMB3 kernel server
+#
+
+obj-$(CONFIG_SMB_SERVER) += ksmbd.o
+
+ksmbd-y :=	unicode.o auth.o vfs.o vfs_cache.o connection.o crypto_ctx.o \
+		server.o misc.o oplock.o ksmbd_work.o smbacl.o ndr.o\
+		mgmt/ksmbd_ida.o mgmt/user_config.o mgmt/share_config.o \
+		mgmt/tree_connect.o mgmt/user_session.o smb_common.o \
+		buffer_pool.o transport_tcp.o transport_ipc.o
+
+ksmbd-y +=	smb2pdu.o smb2ops.o smb2misc.o asn1.o
+ksmbd-$(CONFIG_SMB_INSECURE_SERVER) += smb1pdu.o smb1ops.o smb1misc.o netmisc.o
+ksmbd-$(CONFIG_SMB_SERVER_SMBDIRECT) += transport_rdma.o
diff -Nruw linux-5.4.60-fbx/fs/cifsd./mgmt/ksmbd_ida.c linux-5.4.60-fbx/fs/cifsd/mgmt/ksmbd_ida.c
--- linux-5.4.60-fbx/fs/cifsd./mgmt/ksmbd_ida.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/mgmt/ksmbd_ida.c	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include "ksmbd_ida.h"
+
+static inline int __acquire_id(struct ida *ida, int from, int to)
+{
+	return ida_simple_get(ida, from, to, GFP_KERNEL);
+}
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+int ksmbd_acquire_smb1_tid(struct ida *ida)
+{
+	return __acquire_id(ida, 0, 0xFFFF);
+}
+#endif
+
+int ksmbd_acquire_smb2_tid(struct ida *ida)
+{
+	int id;
+
+	id = __acquire_id(ida, 0, 0);
+	if (id == 0xFFFF)
+		id = __acquire_id(ida, 0, 0);
+
+	return id;
+}
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+int ksmbd_acquire_smb1_uid(struct ida *ida)
+{
+	return __acquire_id(ida, 1, 0xFFFE);
+}
+#endif
+
+int ksmbd_acquire_smb2_uid(struct ida *ida)
+{
+	int id;
+
+	id = __acquire_id(ida, 1, 0);
+	if (id == 0xFFFE)
+		id = __acquire_id(ida, 1, 0);
+
+	return id;
+}
+
+int ksmbd_acquire_async_msg_id(struct ida *ida)
+{
+	return __acquire_id(ida, 1, 0);
+}
+
+int ksmbd_acquire_id(struct ida *ida)
+{
+	return __acquire_id(ida, 0, 0);
+}
+
+void ksmbd_release_id(struct ida *ida, int id)
+{
+	ida_simple_remove(ida, id);
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./mgmt/ksmbd_ida.h linux-5.4.60-fbx/fs/cifsd/mgmt/ksmbd_ida.h
--- linux-5.4.60-fbx/fs/cifsd./mgmt/ksmbd_ida.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/mgmt/ksmbd_ida.h	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,40 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __KSMBD_IDA_MANAGEMENT_H__
+#define __KSMBD_IDA_MANAGEMENT_H__
+
+#include <linux/slab.h>
+#include <linux/idr.h>
+
+/*
+ * 2.2.1.6.7 TID Generation
+ *    The value 0xFFFF MUST NOT be used as a valid TID. All other
+ *    possible values for TID, including zero (0x0000), are valid.
+ *    The value 0xFFFF is used to specify all TIDs or no TID,
+ *    depending upon the context in which it is used.
+ */
+#ifdef CONFIG_SMB_INSECURE_SERVER
+int ksmbd_acquire_smb1_tid(struct ida *ida);
+#endif
+int ksmbd_acquire_smb2_tid(struct ida *ida);
+
+/*
+ * 2.2.1.6.8 UID Generation
+ *    The value 0xFFFE was declared reserved in the LAN Manager 1.0
+ *    documentation, so a value of 0xFFFE SHOULD NOT be used as a
+ *    valid UID.<21> All other possible values for a UID, excluding
+ *    zero (0x0000), are valid.
+ */
+#ifdef CONFIG_SMB_INSECURE_SERVER
+int ksmbd_acquire_smb1_uid(struct ida *ida);
+#endif
+int ksmbd_acquire_smb2_uid(struct ida *ida);
+int ksmbd_acquire_async_msg_id(struct ida *ida);
+
+int ksmbd_acquire_id(struct ida *ida);
+
+void ksmbd_release_id(struct ida *ida, int id);
+#endif /* __KSMBD_IDA_MANAGEMENT_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./mgmt/share_config.c linux-5.4.60-fbx/fs/cifsd/mgmt/share_config.c
--- linux-5.4.60-fbx/fs/cifsd./mgmt/share_config.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/mgmt/share_config.c	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,239 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/list.h>
+#include <linux/jhash.h>
+#include <linux/slab.h>
+#include <linux/rwsem.h>
+#include <linux/parser.h>
+#include <linux/namei.h>
+#include <linux/sched.h>
+#include <linux/mm.h>
+
+#include "share_config.h"
+#include "user_config.h"
+#include "user_session.h"
+#include "../buffer_pool.h"
+#include "../transport_ipc.h"
+
+#define SHARE_HASH_BITS		3
+static DEFINE_HASHTABLE(shares_table, SHARE_HASH_BITS);
+static DECLARE_RWSEM(shares_table_lock);
+
+struct ksmbd_veto_pattern {
+	char			*pattern;
+	struct list_head	list;
+};
+
+static unsigned int share_name_hash(char *name)
+{
+	return jhash(name, strlen(name), 0);
+}
+
+static void kill_share(struct ksmbd_share_config *share)
+{
+	while (!list_empty(&share->veto_list)) {
+		struct ksmbd_veto_pattern *p;
+
+		p = list_entry(share->veto_list.next,
+			       struct ksmbd_veto_pattern,
+			       list);
+		list_del(&p->list);
+		kfree(p->pattern);
+		kfree(p);
+	}
+
+	if (share->path)
+		path_put(&share->vfs_path);
+	kfree(share->name);
+	kfree(share->path);
+	kfree(share);
+}
+
+void __ksmbd_share_config_put(struct ksmbd_share_config *share)
+{
+	down_write(&shares_table_lock);
+	hash_del(&share->hlist);
+	up_write(&shares_table_lock);
+
+	kill_share(share);
+}
+
+static struct ksmbd_share_config *
+__get_share_config(struct ksmbd_share_config *share)
+{
+	if (!atomic_inc_not_zero(&share->refcount))
+		return NULL;
+	return share;
+}
+
+static struct ksmbd_share_config *__share_lookup(char *name)
+{
+	struct ksmbd_share_config *share;
+	unsigned int key = share_name_hash(name);
+
+	hash_for_each_possible(shares_table, share, hlist, key) {
+		if (!strcmp(name, share->name))
+			return share;
+	}
+	return NULL;
+}
+
+static int parse_veto_list(struct ksmbd_share_config *share,
+			   char *veto_list,
+			   int veto_list_sz)
+{
+	int sz = 0;
+
+	if (!veto_list_sz)
+		return 0;
+
+	while (veto_list_sz > 0) {
+		struct ksmbd_veto_pattern *p;
+
+		sz = strlen(veto_list);
+		if (!sz)
+			break;
+
+		p = kzalloc(sizeof(struct ksmbd_veto_pattern), GFP_KERNEL);
+		if (!p)
+			return -ENOMEM;
+
+		p->pattern = kstrdup(veto_list, GFP_KERNEL);
+		if (!p->pattern) {
+			kfree(p);
+			return -ENOMEM;
+		}
+
+		list_add(&p->list, &share->veto_list);
+
+		veto_list += sz + 1;
+		veto_list_sz -= (sz + 1);
+	}
+
+	return 0;
+}
+
+static struct ksmbd_share_config *share_config_request(char *name)
+{
+	struct ksmbd_share_config_response *resp;
+	struct ksmbd_share_config *share = NULL;
+	struct ksmbd_share_config *lookup;
+	int ret;
+
+	resp = ksmbd_ipc_share_config_request(name);
+	if (!resp)
+		return NULL;
+
+	if (resp->flags == KSMBD_SHARE_FLAG_INVALID)
+		goto out;
+
+	share = kzalloc(sizeof(struct ksmbd_share_config), GFP_KERNEL);
+	if (!share)
+		goto out;
+
+	share->flags = resp->flags;
+	atomic_set(&share->refcount, 1);
+	INIT_LIST_HEAD(&share->veto_list);
+	share->name = kstrdup(name, GFP_KERNEL);
+
+	if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) {
+		share->path = kstrdup(KSMBD_SHARE_CONFIG_PATH(resp),
+				      GFP_KERNEL);
+		if (share->path)
+			share->path_sz = strlen(share->path);
+		share->create_mask = resp->create_mask;
+		share->directory_mask = resp->directory_mask;
+		share->force_create_mode = resp->force_create_mode;
+		share->force_directory_mode = resp->force_directory_mode;
+		share->force_uid = resp->force_uid;
+		share->force_gid = resp->force_gid;
+		ret = parse_veto_list(share,
+				      KSMBD_SHARE_CONFIG_VETO_LIST(resp),
+				      resp->veto_list_sz);
+		if (!ret && share->path) {
+			ret = kern_path(share->path, 0, &share->vfs_path);
+			if (ret) {
+				ksmbd_debug(SMB, "failed to access '%s'\n",
+					share->path);
+				/* Avoid put_path() */
+				kfree(share->path);
+				share->path = NULL;
+			}
+		}
+		if (ret || !share->name) {
+			kill_share(share);
+			share = NULL;
+			goto out;
+		}
+	}
+
+	down_write(&shares_table_lock);
+	lookup = __share_lookup(name);
+	if (lookup)
+		lookup = __get_share_config(lookup);
+	if (!lookup) {
+		hash_add(shares_table, &share->hlist, share_name_hash(name));
+	} else {
+		kill_share(share);
+		share = lookup;
+	}
+	up_write(&shares_table_lock);
+
+out:
+	kvfree(resp);
+	return share;
+}
+
+static void strtolower(char *share_name)
+{
+	while (*share_name) {
+		*share_name = tolower(*share_name);
+		share_name++;
+	}
+}
+
+struct ksmbd_share_config *ksmbd_share_config_get(char *name)
+{
+	struct ksmbd_share_config *share;
+
+	strtolower(name);
+
+	down_read(&shares_table_lock);
+	share = __share_lookup(name);
+	if (share)
+		share = __get_share_config(share);
+	up_read(&shares_table_lock);
+
+	if (share)
+		return share;
+	return share_config_request(name);
+}
+
+bool ksmbd_share_veto_filename(struct ksmbd_share_config *share,
+			       const char *filename)
+{
+	struct ksmbd_veto_pattern *p;
+
+	list_for_each_entry(p, &share->veto_list, list) {
+		if (match_wildcard(p->pattern, filename))
+			return true;
+	}
+	return false;
+}
+
+void ksmbd_share_configs_cleanup(void)
+{
+	struct ksmbd_share_config *share;
+	struct hlist_node *tmp;
+	int i;
+
+	down_write(&shares_table_lock);
+	hash_for_each_safe(shares_table, i, tmp, share, hlist) {
+		hash_del(&share->hlist);
+		kill_share(share);
+	}
+	up_write(&shares_table_lock);
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./mgmt/share_config.h linux-5.4.60-fbx/fs/cifsd/mgmt/share_config.h
--- linux-5.4.60-fbx/fs/cifsd./mgmt/share_config.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/mgmt/share_config.h	2021-03-30 16:07:01.585102883 +0200
@@ -0,0 +1,81 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __SHARE_CONFIG_MANAGEMENT_H__
+#define __SHARE_CONFIG_MANAGEMENT_H__
+
+#include <linux/workqueue.h>
+#include <linux/hashtable.h>
+#include <linux/path.h>
+
+struct ksmbd_share_config {
+	char			*name;
+	char			*path;
+
+	unsigned int		path_sz;
+	unsigned int		flags;
+	struct list_head	veto_list;
+
+	struct path		vfs_path;
+
+	atomic_t		refcount;
+	struct hlist_node	hlist;
+	unsigned short		create_mask;
+	unsigned short		directory_mask;
+	unsigned short		force_create_mode;
+	unsigned short		force_directory_mode;
+	unsigned short		force_uid;
+	unsigned short		force_gid;
+};
+
+#define KSMBD_SHARE_INVALID_UID	((__u16)-1)
+#define KSMBD_SHARE_INVALID_GID	((__u16)-1)
+
+static inline int share_config_create_mode(struct ksmbd_share_config *share,
+	umode_t posix_mode)
+{
+	if (!share->force_create_mode) {
+		if (!posix_mode)
+			return share->create_mask;
+		else
+			return posix_mode & share->create_mask;
+	}
+	return share->force_create_mode & share->create_mask;
+}
+
+static inline int share_config_directory_mode(struct ksmbd_share_config *share,
+	umode_t posix_mode)
+{
+	if (!share->force_directory_mode) {
+		if (!posix_mode)
+			return share->directory_mask;
+		else
+			return posix_mode & share->directory_mask;
+	}
+
+	return share->force_directory_mode & share->directory_mask;
+}
+
+static inline int test_share_config_flag(struct ksmbd_share_config *share,
+					 int flag)
+{
+	return share->flags & flag;
+}
+
+extern void __ksmbd_share_config_put(struct ksmbd_share_config *share);
+
+static inline void ksmbd_share_config_put(struct ksmbd_share_config *share)
+{
+	if (!atomic_dec_and_test(&share->refcount))
+		return;
+	__ksmbd_share_config_put(share);
+}
+
+struct ksmbd_share_config *ksmbd_share_config_get(char *name);
+bool ksmbd_share_veto_filename(struct ksmbd_share_config *share,
+			       const char *filename);
+void ksmbd_share_configs_cleanup(void);
+
+#endif /* __SHARE_CONFIG_MANAGEMENT_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./mgmt/tree_connect.c linux-5.4.60-fbx/fs/cifsd/mgmt/tree_connect.c
--- linux-5.4.60-fbx/fs/cifsd./mgmt/tree_connect.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/mgmt/tree_connect.c	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,127 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/list.h>
+#include <linux/slab.h>
+#include <linux/version.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 19, 0)
+#include <linux/xarray.h>
+#endif
+
+#include "../buffer_pool.h"
+#include "../transport_ipc.h"
+#include "../connection.h"
+
+#include "tree_connect.h"
+#include "user_config.h"
+#include "share_config.h"
+#include "user_session.h"
+
+struct ksmbd_tree_conn_status
+ksmbd_tree_conn_connect(struct ksmbd_session *sess, char *share_name)
+{
+	struct ksmbd_tree_conn_status status = {-EINVAL, NULL};
+	struct ksmbd_tree_connect_response *resp = NULL;
+	struct ksmbd_share_config *sc;
+	struct ksmbd_tree_connect *tree_conn = NULL;
+	struct sockaddr *peer_addr;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 19, 0)
+	int ret;
+#endif
+
+	sc = ksmbd_share_config_get(share_name);
+	if (!sc)
+		return status;
+
+	tree_conn = kzalloc(sizeof(struct ksmbd_tree_connect), GFP_KERNEL);
+	if (!tree_conn) {
+		status.ret = -ENOMEM;
+		goto out_error;
+	}
+
+	tree_conn->id = ksmbd_acquire_tree_conn_id(sess);
+	if (tree_conn->id < 0) {
+		status.ret = -EINVAL;
+		goto out_error;
+	}
+
+	peer_addr = KSMBD_TCP_PEER_SOCKADDR(sess->conn);
+	resp = ksmbd_ipc_tree_connect_request(sess,
+					      sc,
+					      tree_conn,
+					      peer_addr);
+	if (!resp) {
+		status.ret = -EINVAL;
+		goto out_error;
+	}
+
+	status.ret = resp->status;
+	if (status.ret != KSMBD_TREE_CONN_STATUS_OK)
+		goto out_error;
+
+	tree_conn->flags = resp->connection_flags;
+	tree_conn->user = sess->user;
+	tree_conn->share_conf = sc;
+	status.tree_conn = tree_conn;
+
+	ret = xa_err(xa_store(&sess->tree_conns, tree_conn->id, tree_conn,
+			GFP_KERNEL));
+	if (ret) {
+		status.ret = -ENOMEM;
+		goto out_error;
+	}
+	kvfree(resp);
+	return status;
+
+out_error:
+	if (tree_conn)
+		ksmbd_release_tree_conn_id(sess, tree_conn->id);
+	ksmbd_share_config_put(sc);
+	kfree(tree_conn);
+	kvfree(resp);
+	return status;
+}
+
+int ksmbd_tree_conn_disconnect(struct ksmbd_session *sess,
+			       struct ksmbd_tree_connect *tree_conn)
+{
+	int ret;
+
+	ret = ksmbd_ipc_tree_disconnect_request(sess->id, tree_conn->id);
+	ksmbd_release_tree_conn_id(sess, tree_conn->id);
+	xa_erase(&sess->tree_conns, tree_conn->id);
+	ksmbd_share_config_put(tree_conn->share_conf);
+	kfree(tree_conn);
+	return ret;
+}
+
+struct ksmbd_tree_connect *ksmbd_tree_conn_lookup(struct ksmbd_session *sess,
+						  unsigned int id)
+{
+	return xa_load(&sess->tree_conns, id);
+}
+
+struct ksmbd_share_config *ksmbd_tree_conn_share(struct ksmbd_session *sess,
+						 unsigned int id)
+{
+	struct ksmbd_tree_connect *tc;
+
+	tc = ksmbd_tree_conn_lookup(sess, id);
+	if (tc)
+		return tc->share_conf;
+	return NULL;
+}
+
+int ksmbd_tree_conn_session_logoff(struct ksmbd_session *sess)
+{
+	int ret = 0;
+	struct ksmbd_tree_connect *tc;
+	unsigned long id;
+
+	xa_for_each(&sess->tree_conns, id, tc)
+		ret |= ksmbd_tree_conn_disconnect(sess, tc);
+	xa_destroy(&sess->tree_conns);
+	return ret;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./mgmt/tree_connect.h linux-5.4.60-fbx/fs/cifsd/mgmt/tree_connect.h
--- linux-5.4.60-fbx/fs/cifsd./mgmt/tree_connect.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/mgmt/tree_connect.h	2021-03-30 16:07:01.585102883 +0200
@@ -0,0 +1,56 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __TREE_CONNECT_MANAGEMENT_H__
+#define __TREE_CONNECT_MANAGEMENT_H__
+
+#include <linux/hashtable.h>
+
+#include "../ksmbd_server.h"
+
+struct ksmbd_share_config;
+struct ksmbd_user;
+
+struct ksmbd_tree_connect {
+	int				id;
+
+	unsigned int			flags;
+	struct ksmbd_share_config	*share_conf;
+	struct ksmbd_user		*user;
+
+	struct list_head		list;
+
+	int				maximal_access;
+	bool				posix_extensions;
+};
+
+struct ksmbd_tree_conn_status {
+	unsigned int			ret;
+	struct ksmbd_tree_connect	*tree_conn;
+};
+
+static inline int test_tree_conn_flag(struct ksmbd_tree_connect *tree_conn,
+				      int flag)
+{
+	return tree_conn->flags & flag;
+}
+
+struct ksmbd_session;
+
+struct ksmbd_tree_conn_status
+ksmbd_tree_conn_connect(struct ksmbd_session *sess, char *share_name);
+
+int ksmbd_tree_conn_disconnect(struct ksmbd_session *sess,
+			       struct ksmbd_tree_connect *tree_conn);
+
+struct ksmbd_tree_connect *ksmbd_tree_conn_lookup(struct ksmbd_session *sess,
+						  unsigned int id);
+
+struct ksmbd_share_config *ksmbd_tree_conn_share(struct ksmbd_session *sess,
+						 unsigned int id);
+
+int ksmbd_tree_conn_session_logoff(struct ksmbd_session *sess);
+
+#endif /* __TREE_CONNECT_MANAGEMENT_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./mgmt/user_config.c linux-5.4.60-fbx/fs/cifsd/mgmt/user_config.c
--- linux-5.4.60-fbx/fs/cifsd./mgmt/user_config.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/mgmt/user_config.c	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/slab.h>
+#include <linux/mm.h>
+
+#include "user_config.h"
+#include "../buffer_pool.h"
+#include "../transport_ipc.h"
+
+struct ksmbd_user *ksmbd_login_user(const char *account)
+{
+	struct ksmbd_login_response *resp;
+	struct ksmbd_user *user = NULL;
+
+	resp = ksmbd_ipc_login_request(account);
+	if (!resp)
+		return NULL;
+
+	if (!(resp->status & KSMBD_USER_FLAG_OK))
+		goto out;
+
+	user = ksmbd_alloc_user(resp);
+out:
+	kvfree(resp);
+	return user;
+}
+
+struct ksmbd_user *ksmbd_alloc_user(struct ksmbd_login_response *resp)
+{
+	struct ksmbd_user *user = NULL;
+
+	user = kmalloc(sizeof(struct ksmbd_user), GFP_KERNEL);
+	if (!user)
+		return NULL;
+
+	user->name = kstrdup(resp->account, GFP_KERNEL);
+	user->flags = resp->status;
+	user->gid = resp->gid;
+	user->uid = resp->uid;
+	user->passkey_sz = resp->hash_sz;
+	user->passkey = kmalloc(resp->hash_sz, GFP_KERNEL);
+	if (user->passkey)
+		memcpy(user->passkey, resp->hash, resp->hash_sz);
+
+	if (!user->name || !user->passkey) {
+		kfree(user->name);
+		kfree(user->passkey);
+		kfree(user);
+		user = NULL;
+	}
+	return user;
+}
+
+void ksmbd_free_user(struct ksmbd_user *user)
+{
+	ksmbd_ipc_logout_request(user->name);
+	kfree(user->name);
+	kfree(user->passkey);
+	kfree(user);
+}
+
+int ksmbd_anonymous_user(struct ksmbd_user *user)
+{
+	if (user->name[0] == '\0')
+		return 1;
+	return 0;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./mgmt/user_config.h linux-5.4.60-fbx/fs/cifsd/mgmt/user_config.h
--- linux-5.4.60-fbx/fs/cifsd./mgmt/user_config.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/mgmt/user_config.h	2021-03-30 16:07:01.588436216 +0200
@@ -0,0 +1,66 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __USER_CONFIG_MANAGEMENT_H__
+#define __USER_CONFIG_MANAGEMENT_H__
+
+#include "../glob.h"
+
+struct ksmbd_user {
+	unsigned short		flags;
+
+	unsigned int		uid;
+	unsigned int		gid;
+
+	char			*name;
+
+	size_t			passkey_sz;
+	char			*passkey;
+};
+
+static inline bool user_guest(struct ksmbd_user *user)
+{
+	return user->flags & KSMBD_USER_FLAG_GUEST_ACCOUNT;
+}
+
+static inline void set_user_flag(struct ksmbd_user *user, int flag)
+{
+	user->flags |= flag;
+}
+
+static inline int test_user_flag(struct ksmbd_user *user, int flag)
+{
+	return user->flags & flag;
+}
+
+static inline void set_user_guest(struct ksmbd_user *user)
+{
+}
+
+static inline char *user_passkey(struct ksmbd_user *user)
+{
+	return user->passkey;
+}
+
+static inline char *user_name(struct ksmbd_user *user)
+{
+	return user->name;
+}
+
+static inline unsigned int user_uid(struct ksmbd_user *user)
+{
+	return user->uid;
+}
+
+static inline unsigned int user_gid(struct ksmbd_user *user)
+{
+	return user->gid;
+}
+
+struct ksmbd_user *ksmbd_login_user(const char *account);
+struct ksmbd_user *ksmbd_alloc_user(struct ksmbd_login_response *resp);
+void ksmbd_free_user(struct ksmbd_user *user);
+int ksmbd_anonymous_user(struct ksmbd_user *user);
+#endif /* __USER_CONFIG_MANAGEMENT_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./mgmt/user_session.c linux-5.4.60-fbx/fs/cifsd/mgmt/user_session.c
--- linux-5.4.60-fbx/fs/cifsd./mgmt/user_session.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/mgmt/user_session.c	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,357 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/list.h>
+#include <linux/slab.h>
+#include <linux/rwsem.h>
+#include <linux/version.h>
+#include <linux/xarray.h>
+
+#include "ksmbd_ida.h"
+#include "user_session.h"
+#include "user_config.h"
+#include "tree_connect.h"
+#include "../transport_ipc.h"
+#include "../connection.h"
+#include "../buffer_pool.h"
+#include "../vfs_cache.h"
+
+static DEFINE_IDA(session_ida);
+
+#define SESSION_HASH_BITS		3
+static DEFINE_HASHTABLE(sessions_table, SESSION_HASH_BITS);
+static DECLARE_RWSEM(sessions_table_lock);
+
+struct ksmbd_session_rpc {
+	int			id;
+	unsigned int		method;
+	struct list_head	list;
+};
+
+static void free_channel_list(struct ksmbd_session *sess)
+{
+	struct channel *chann;
+	struct list_head *tmp, *t;
+
+	list_for_each_safe(tmp, t, &sess->ksmbd_chann_list) {
+		chann = list_entry(tmp, struct channel, chann_list);
+		if (chann) {
+			list_del(&chann->chann_list);
+			kfree(chann);
+		}
+	}
+}
+
+static void __session_rpc_close(struct ksmbd_session *sess,
+				struct ksmbd_session_rpc *entry)
+{
+	struct ksmbd_rpc_command *resp;
+
+	resp = ksmbd_rpc_close(sess, entry->id);
+	if (!resp)
+		pr_err("Unable to close RPC pipe %d\n", entry->id);
+
+	kvfree(resp);
+	ksmbd_rpc_id_free(entry->id);
+	kfree(entry);
+}
+
+static void ksmbd_session_rpc_clear_list(struct ksmbd_session *sess)
+{
+	struct ksmbd_session_rpc *entry;
+
+	while (!list_empty(&sess->rpc_handle_list)) {
+		entry = list_entry(sess->rpc_handle_list.next,
+				   struct ksmbd_session_rpc,
+				   list);
+
+		list_del(&entry->list);
+		__session_rpc_close(sess, entry);
+	}
+}
+
+static int __rpc_method(char *rpc_name)
+{
+	if (!strcmp(rpc_name, "\\srvsvc") || !strcmp(rpc_name, "srvsvc"))
+		return KSMBD_RPC_SRVSVC_METHOD_INVOKE;
+
+	if (!strcmp(rpc_name, "\\wkssvc") || !strcmp(rpc_name, "wkssvc"))
+		return KSMBD_RPC_WKSSVC_METHOD_INVOKE;
+
+	if (!strcmp(rpc_name, "LANMAN") || !strcmp(rpc_name, "lanman"))
+		return KSMBD_RPC_RAP_METHOD;
+
+	if (!strcmp(rpc_name, "\\samr") || !strcmp(rpc_name, "samr"))
+		return KSMBD_RPC_SAMR_METHOD_INVOKE;
+
+	if (!strcmp(rpc_name, "\\lsarpc") || !strcmp(rpc_name, "lsarpc"))
+		return KSMBD_RPC_LSARPC_METHOD_INVOKE;
+
+	ksmbd_err("Unsupported RPC: %s\n", rpc_name);
+	return 0;
+}
+
+int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name)
+{
+	struct ksmbd_session_rpc *entry;
+	struct ksmbd_rpc_command *resp;
+	int method;
+
+	method = __rpc_method(rpc_name);
+	if (!method)
+		return -EINVAL;
+
+	entry = kzalloc(sizeof(struct ksmbd_session_rpc), GFP_KERNEL);
+	if (!entry)
+		return -EINVAL;
+
+	list_add(&entry->list, &sess->rpc_handle_list);
+	entry->method = method;
+	entry->id = ksmbd_ipc_id_alloc();
+	if (entry->id < 0)
+		goto error;
+
+	resp = ksmbd_rpc_open(sess, entry->id);
+	if (!resp)
+		goto error;
+
+	kvfree(resp);
+	return entry->id;
+error:
+	list_del(&entry->list);
+	kfree(entry);
+	return -EINVAL;
+}
+
+void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id)
+{
+	struct ksmbd_session_rpc *entry;
+
+	list_for_each_entry(entry, &sess->rpc_handle_list, list) {
+		if (entry->id == id) {
+			list_del(&entry->list);
+			__session_rpc_close(sess, entry);
+			break;
+		}
+	}
+}
+
+int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id)
+{
+	struct ksmbd_session_rpc *entry;
+
+	list_for_each_entry(entry, &sess->rpc_handle_list, list) {
+		if (entry->id == id)
+			return entry->method;
+	}
+	return 0;
+}
+
+void ksmbd_session_destroy(struct ksmbd_session *sess)
+{
+	if (!sess)
+		return;
+
+	if (!atomic_dec_and_test(&sess->refcnt))
+		return;
+
+	list_del(&sess->sessions_entry);
+
+	if (IS_SMB2(sess->conn)) {
+		down_write(&sessions_table_lock);
+		hash_del(&sess->hlist);
+		up_write(&sessions_table_lock);
+	}
+
+	if (sess->user)
+		ksmbd_free_user(sess->user);
+
+	ksmbd_tree_conn_session_logoff(sess);
+	ksmbd_destroy_file_table(&sess->file_table);
+	ksmbd_session_rpc_clear_list(sess);
+	free_channel_list(sess);
+	kfree(sess->Preauth_HashValue);
+	ksmbd_release_id(&session_ida, sess->id);
+	kfree(sess);
+}
+
+static struct ksmbd_session *__session_lookup(unsigned long long id)
+{
+	struct ksmbd_session *sess;
+
+	hash_for_each_possible(sessions_table, sess, hlist, id) {
+		if (id == sess->id)
+			return sess;
+	}
+	return NULL;
+}
+
+void ksmbd_session_register(struct ksmbd_conn *conn,
+			    struct ksmbd_session *sess)
+{
+	sess->conn = conn;
+	list_add(&sess->sessions_entry, &conn->sessions);
+}
+
+void ksmbd_sessions_deregister(struct ksmbd_conn *conn)
+{
+	struct ksmbd_session *sess;
+
+	while (!list_empty(&conn->sessions)) {
+		sess = list_entry(conn->sessions.next,
+				  struct ksmbd_session,
+				  sessions_entry);
+
+		ksmbd_session_destroy(sess);
+	}
+}
+
+bool ksmbd_session_id_match(struct ksmbd_session *sess, unsigned long long id)
+{
+	return sess->id == id;
+}
+
+struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn,
+					   unsigned long long id)
+{
+	struct ksmbd_session *sess = NULL;
+
+	list_for_each_entry(sess, &conn->sessions, sessions_entry) {
+		if (ksmbd_session_id_match(sess, id))
+			return sess;
+	}
+	return NULL;
+}
+
+int get_session(struct ksmbd_session *sess)
+{
+	return atomic_inc_not_zero(&sess->refcnt);
+}
+
+void put_session(struct ksmbd_session *sess)
+{
+	if (atomic_dec_and_test(&sess->refcnt))
+		ksmbd_err("get/%s seems to be mismatched.", __func__);
+}
+
+struct ksmbd_session *ksmbd_session_lookup_slowpath(unsigned long long id)
+{
+	struct ksmbd_session *sess;
+
+	down_read(&sessions_table_lock);
+	sess = __session_lookup(id);
+	if (sess) {
+		if (!get_session(sess))
+			sess = NULL;
+	}
+	up_read(&sessions_table_lock);
+
+	return sess;
+}
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+static int __init_smb1_session(struct ksmbd_session *sess)
+{
+	int id = ksmbd_acquire_smb1_uid(&session_ida);
+
+	if (id < 0)
+		return -EINVAL;
+	sess->id = id;
+	return 0;
+}
+#endif
+
+static int __init_smb2_session(struct ksmbd_session *sess)
+{
+	int id = ksmbd_acquire_smb2_uid(&session_ida);
+
+	if (id < 0)
+		return -EINVAL;
+	sess->id = id;
+	return 0;
+}
+
+static struct ksmbd_session *__session_create(int protocol)
+{
+	struct ksmbd_session *sess;
+	int ret;
+
+	sess = kzalloc(sizeof(struct ksmbd_session), GFP_KERNEL);
+	if (!sess)
+		return NULL;
+
+	if (ksmbd_init_file_table(&sess->file_table))
+		goto error;
+
+	set_session_flag(sess, protocol);
+	INIT_LIST_HEAD(&sess->sessions_entry);
+	xa_init(&sess->tree_conns);
+	INIT_LIST_HEAD(&sess->ksmbd_chann_list);
+	INIT_LIST_HEAD(&sess->rpc_handle_list);
+	sess->sequence_number = 1;
+	atomic_set(&sess->refcnt, 1);
+
+	switch (protocol) {
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	case CIFDS_SESSION_FLAG_SMB1:
+		ret = __init_smb1_session(sess);
+		break;
+#endif
+	case CIFDS_SESSION_FLAG_SMB2:
+		ret = __init_smb2_session(sess);
+		break;
+	default:
+		ret = -EINVAL;
+		break;
+	}
+
+	if (ret)
+		goto error;
+
+	ida_init(&sess->tree_conn_ida);
+
+	if (protocol == CIFDS_SESSION_FLAG_SMB2) {
+		down_write(&sessions_table_lock);
+		hash_add(sessions_table, &sess->hlist, sess->id);
+		up_write(&sessions_table_lock);
+	}
+	return sess;
+
+error:
+	ksmbd_session_destroy(sess);
+	return NULL;
+}
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+struct ksmbd_session *ksmbd_smb1_session_create(void)
+{
+	return __session_create(CIFDS_SESSION_FLAG_SMB1);
+}
+#endif
+
+struct ksmbd_session *ksmbd_smb2_session_create(void)
+{
+	return __session_create(CIFDS_SESSION_FLAG_SMB2);
+}
+
+int ksmbd_acquire_tree_conn_id(struct ksmbd_session *sess)
+{
+	int id = -EINVAL;
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	if (test_session_flag(sess, CIFDS_SESSION_FLAG_SMB1))
+		id = ksmbd_acquire_smb1_tid(&sess->tree_conn_ida);
+#endif
+	if (test_session_flag(sess, CIFDS_SESSION_FLAG_SMB2))
+		id = ksmbd_acquire_smb2_tid(&sess->tree_conn_ida);
+
+	return id;
+}
+
+void ksmbd_release_tree_conn_id(struct ksmbd_session *sess, int id)
+{
+	if (id >= 0)
+		ksmbd_release_id(&sess->tree_conn_ida, id);
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./mgmt/user_session.h linux-5.4.60-fbx/fs/cifsd/mgmt/user_session.h
--- linux-5.4.60-fbx/fs/cifsd./mgmt/user_session.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/mgmt/user_session.h	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,110 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __USER_SESSION_MANAGEMENT_H__
+#define __USER_SESSION_MANAGEMENT_H__
+
+#include <linux/hashtable.h>
+#include <linux/version.h>
+#include <linux/xarray.h>
+
+#include "../smb_common.h"
+#include "../ntlmssp.h"
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+#define CIFDS_SESSION_FLAG_SMB1		(1 << 0)
+#endif
+#define CIFDS_SESSION_FLAG_SMB2		(1 << 1)
+
+#define PREAUTH_HASHVALUE_SIZE		64
+
+struct ksmbd_file_table;
+
+struct channel {
+	__u8			smb3signingkey[SMB3_SIGN_KEY_SIZE];
+	struct ksmbd_conn	*conn;
+	struct list_head	chann_list;
+};
+
+struct preauth_session {
+	__u8			Preauth_HashValue[PREAUTH_HASHVALUE_SIZE];
+	u64			sess_id;
+	struct list_head	list_entry;
+};
+
+struct ksmbd_session {
+	u64				id;
+
+	struct ksmbd_user		*user;
+	struct ksmbd_conn		*conn;
+	unsigned int			sequence_number;
+	unsigned int			flags;
+
+	bool				sign;
+	bool				enc;
+	bool				is_anonymous;
+
+	int				state;
+	__u8				*Preauth_HashValue;
+
+	struct ntlmssp_auth		ntlmssp;
+	char				sess_key[CIFS_KEY_SIZE];
+
+	struct hlist_node		hlist;
+	struct list_head		ksmbd_chann_list;
+	struct xarray			tree_conns;
+	struct ida			tree_conn_ida;
+	struct list_head		rpc_handle_list;
+
+
+
+	__u8				smb3encryptionkey[SMB3_SIGN_KEY_SIZE];
+	__u8				smb3decryptionkey[SMB3_SIGN_KEY_SIZE];
+	__u8				smb3signingkey[SMB3_SIGN_KEY_SIZE];
+
+	struct list_head		sessions_entry;
+	struct ksmbd_file_table		file_table;
+	atomic_t			refcnt;
+};
+
+static inline int test_session_flag(struct ksmbd_session *sess, int bit)
+{
+	return sess->flags & bit;
+}
+
+static inline void set_session_flag(struct ksmbd_session *sess, int bit)
+{
+	sess->flags |= bit;
+}
+
+static inline void clear_session_flag(struct ksmbd_session *sess, int bit)
+{
+	sess->flags &= ~bit;
+}
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+struct ksmbd_session *ksmbd_smb1_session_create(void);
+#endif
+struct ksmbd_session *ksmbd_smb2_session_create(void);
+
+void ksmbd_session_destroy(struct ksmbd_session *sess);
+
+bool ksmbd_session_id_match(struct ksmbd_session *sess, unsigned long long id);
+struct ksmbd_session *ksmbd_session_lookup_slowpath(unsigned long long id);
+struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn,
+					   unsigned long long id);
+void ksmbd_session_register(struct ksmbd_conn *conn,
+			    struct ksmbd_session *sess);
+void ksmbd_sessions_deregister(struct ksmbd_conn *conn);
+
+int ksmbd_acquire_tree_conn_id(struct ksmbd_session *sess);
+void ksmbd_release_tree_conn_id(struct ksmbd_session *sess, int id);
+
+int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name);
+void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id);
+int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id);
+int get_session(struct ksmbd_session *sess);
+void put_session(struct ksmbd_session *sess);
+#endif /* __USER_SESSION_MANAGEMENT_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./misc.c linux-5.4.60-fbx/fs/cifsd/misc.c
--- linux-5.4.60-fbx/fs/cifsd./misc.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/misc.c	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,341 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/kernel.h>
+#include <linux/version.h>
+#include <linux/xattr.h>
+#include <linux/fs.h>
+
+#include "misc.h"
+#include "smb_common.h"
+#include "connection.h"
+#include "vfs.h"
+
+#include "mgmt/share_config.h"
+
+/**
+ * match_pattern() - compare a string with a pattern which might include
+ * wildcard '*' and '?'
+ * TODO : implement consideration about DOS_DOT, DOS_QM and DOS_STAR
+ *
+ * @string:	string to compare with a pattern
+ * @len:	string length
+ * @pattern:	pattern string which might include wildcard '*' and '?'
+ *
+ * Return:	0 if pattern matched with the string, otherwise non zero value
+ */
+int match_pattern(const char *str, size_t len, const char *pattern)
+{
+	const char *s = str;
+	const char *p = pattern;
+	bool star = false;
+
+	while (*s && len) {
+		switch (*p) {
+		case '?':
+			s++;
+			len--;
+			p++;
+			break;
+		case '*':
+			star = true;
+			str = s;
+			if (!*++p)
+				return true;
+			pattern = p;
+			break;
+		default:
+			if (tolower(*s) == tolower(*p)) {
+				s++;
+				len--;
+				p++;
+			} else {
+				if (!star)
+					return false;
+				str++;
+				s = str;
+				p = pattern;
+			}
+			break;
+		}
+	}
+
+	if (*p == '*')
+		++p;
+	return !*p;
+}
+
+/*
+ * is_char_allowed() - check for valid character
+ * @ch:		input character to be checked
+ *
+ * Return:	1 if char is allowed, otherwise 0
+ */
+static inline int is_char_allowed(char ch)
+{
+	/* check for control chars, wildcards etc. */
+	if (!(ch & 0x80) &&
+	    (ch <= 0x1f ||
+	     ch == '?' || ch == '"' || ch == '<' ||
+	     ch == '>' || ch == '|' || ch == '*'))
+		return 0;
+
+	return 1;
+}
+
+int ksmbd_validate_filename(char *filename)
+{
+	while (*filename) {
+		char c = *filename;
+
+		filename++;
+		if (!is_char_allowed(c)) {
+			ksmbd_debug(VFS, "File name validation failed: 0x%x\n", c);
+			return -ENOENT;
+		}
+	}
+
+	return 0;
+}
+
+static int ksmbd_validate_stream_name(char *stream_name)
+{
+	while (*stream_name) {
+		char c = *stream_name;
+
+		stream_name++;
+		if (c == '/' || c == ':' || c == '\\') {
+			ksmbd_err("Stream name validation failed: %c\n", c);
+			return -ENOENT;
+		}
+	}
+
+	return 0;
+}
+
+int parse_stream_name(char *filename, char **stream_name, int *s_type)
+{
+	char *stream_type;
+	char *s_name;
+	int rc = 0;
+
+	s_name = filename;
+	filename = strsep(&s_name, ":");
+	ksmbd_debug(SMB, "filename : %s, streams : %s\n", filename, s_name);
+	if (strchr(s_name, ':')) {
+		stream_type = s_name;
+		s_name = strsep(&stream_type, ":");
+
+		rc = ksmbd_validate_stream_name(s_name);
+		if (rc < 0) {
+			rc = -ENOENT;
+			goto out;
+		}
+
+		ksmbd_debug(SMB, "stream name : %s, stream type : %s\n", s_name,
+				stream_type);
+		if (!strncasecmp("$data", stream_type, 5))
+			*s_type = DATA_STREAM;
+		else if (!strncasecmp("$index_allocation", stream_type, 17))
+			*s_type = DIR_STREAM;
+		else
+			rc = -ENOENT;
+	}
+
+	*stream_name = s_name;
+out:
+	return rc;
+}
+
+/**
+ * convert_to_nt_pathname() - extract and return windows path string
+ *      whose share directory prefix was removed from file path
+ * @filename : unix filename
+ * @sharepath: share path string
+ *
+ * Return : windows path string or error
+ */
+
+char *convert_to_nt_pathname(char *filename, char *sharepath)
+{
+	char *ab_pathname;
+	int len, name_len;
+
+	name_len = strlen(filename);
+	ab_pathname = kmalloc(name_len, GFP_KERNEL);
+	if (!ab_pathname)
+		return NULL;
+
+	ab_pathname[0] = '\\';
+	ab_pathname[1] = '\0';
+
+	len = strlen(sharepath);
+	if (!strncmp(filename, sharepath, len) && name_len != len) {
+		strscpy(ab_pathname, &filename[len], name_len);
+		ksmbd_conv_path_to_windows(ab_pathname);
+	}
+
+	return ab_pathname;
+}
+
+int get_nlink(struct kstat *st)
+{
+	int nlink;
+
+	nlink = st->nlink;
+	if (S_ISDIR(st->mode))
+		nlink--;
+
+	return nlink;
+}
+
+void ksmbd_conv_path_to_unix(char *path)
+{
+	strreplace(path, '\\', '/');
+}
+
+void ksmbd_strip_last_slash(char *path)
+{
+	int len = strlen(path);
+
+	while (len && path[len - 1] == '/') {
+		path[len - 1] = '\0';
+		len--;
+	}
+}
+
+void ksmbd_conv_path_to_windows(char *path)
+{
+	strreplace(path, '/', '\\');
+}
+
+/**
+ * ksmbd_extract_sharename() - get share name from tree connect request
+ * @treename:	buffer containing tree name and share name
+ *
+ * Return:      share name on success, otherwise error
+ */
+char *ksmbd_extract_sharename(char *treename)
+{
+	char *name = treename;
+	char *dst;
+	char *pos = strrchr(name, '\\');
+
+	if (pos)
+		name = (pos + 1);
+
+	/* caller has to free the memory */
+	dst = kstrdup(name, GFP_KERNEL);
+	if (!dst)
+		return ERR_PTR(-ENOMEM);
+	return dst;
+}
+
+/**
+ * convert_to_unix_name() - convert windows name to unix format
+ * @path:	name to be converted
+ * @tid:	tree id of mathing share
+ *
+ * Return:	converted name on success, otherwise NULL
+ */
+char *convert_to_unix_name(struct ksmbd_share_config *share, char *name)
+{
+	int no_slash = 0, name_len, path_len;
+	char *new_name;
+
+	if (name[0] == '/')
+		name++;
+
+	path_len = share->path_sz;
+	name_len = strlen(name);
+	new_name = kmalloc(path_len + name_len + 2, GFP_KERNEL);
+	if (!new_name)
+		return new_name;
+
+	memcpy(new_name, share->path, path_len);
+	if (new_name[path_len - 1] != '/') {
+		new_name[path_len] = '/';
+		no_slash = 1;
+	}
+
+	memcpy(new_name + path_len + no_slash, name, name_len);
+	path_len += name_len + no_slash;
+	new_name[path_len] = 0x00;
+	return new_name;
+}
+
+char *ksmbd_convert_dir_info_name(struct ksmbd_dir_info *d_info,
+		const struct nls_table *local_nls, int *conv_len)
+{
+	char *conv;
+	int  sz = min(4 * d_info->name_len, PATH_MAX);
+
+	if (!sz)
+		return NULL;
+
+	conv = kmalloc(sz, GFP_KERNEL);
+	if (!conv)
+		return NULL;
+
+	/* XXX */
+	*conv_len = smbConvertToUTF16((__le16 *)conv,
+					d_info->name,
+					d_info->name_len,
+					local_nls,
+					0);
+	*conv_len *= 2;
+
+	/* We allocate buffer twice bigger than needed. */
+	conv[*conv_len] = 0x00;
+	conv[*conv_len + 1] = 0x00;
+	return conv;
+}
+
+/*
+ * Convert the NT UTC (based 1601-01-01, in hundred nanosecond units)
+ * into Unix UTC (based 1970-01-01, in seconds).
+ */
+struct timespec64 ksmbd_NTtimeToUnix(__le64 ntutc)
+{
+	struct timespec64 ts;
+
+	/* Subtract the NTFS time offset, then convert to 1s intervals. */
+	s64 t = le64_to_cpu(ntutc) - NTFS_TIME_OFFSET;
+	u64 abs_t;
+
+	/*
+	 * Unfortunately can not use normal 64 bit division on 32 bit arch, but
+	 * the alternative, do_div, does not work with negative numbers so have
+	 * to special case them
+	 */
+	if (t < 0) {
+		abs_t = -t;
+		ts.tv_nsec = do_div(abs_t, 10000000) * 100;
+		ts.tv_nsec = -ts.tv_nsec;
+		ts.tv_sec = -abs_t;
+	} else {
+		abs_t = t;
+		ts.tv_nsec = do_div(abs_t, 10000000) * 100;
+		ts.tv_sec = abs_t;
+	}
+
+	return ts;
+}
+
+/* Convert the Unix UTC into NT UTC. */
+u64 ksmbd_UnixTimeToNT(struct timespec64 t)
+{
+	/* Convert to 100ns intervals and then add the NTFS time offset. */
+	return (u64)t.tv_sec * 10000000 + t.tv_nsec / 100 + NTFS_TIME_OFFSET;
+}
+
+long long ksmbd_systime(void)
+{
+	struct timespec64	ts;
+
+	ktime_get_real_ts64(&ts);
+	return ksmbd_UnixTimeToNT(ts);
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./misc.h linux-5.4.60-fbx/fs/cifsd/misc.h
--- linux-5.4.60-fbx/fs/cifsd./misc.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/misc.h	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __KSMBD_MISC_H__
+#define __KSMBD_MISC_H__
+
+struct ksmbd_share_config;
+struct nls_table;
+struct kstat;
+struct ksmbd_file;
+
+int match_pattern(const char *str, size_t len, const char *pattern);
+
+int ksmbd_validate_filename(char *filename);
+
+int parse_stream_name(char *filename, char **stream_name, int *s_type);
+
+char *convert_to_nt_pathname(char *filename, char *sharepath);
+
+int get_nlink(struct kstat *st);
+
+void ksmbd_conv_path_to_unix(char *path);
+void ksmbd_strip_last_slash(char *path);
+void ksmbd_conv_path_to_windows(char *path);
+
+char *ksmbd_extract_sharename(char *treename);
+
+char *convert_to_unix_name(struct ksmbd_share_config *share, char *name);
+
+#define KSMBD_DIR_INFO_ALIGNMENT	8
+
+struct ksmbd_dir_info;
+char *ksmbd_convert_dir_info_name(struct ksmbd_dir_info *d_info,
+				  const struct nls_table *local_nls,
+				  int *conv_len);
+
+#define NTFS_TIME_OFFSET	((u64)(369 * 365 + 89) * 24 * 3600 * 10000000)
+
+struct timespec64 ksmbd_NTtimeToUnix(__le64 ntutc);
+u64 ksmbd_UnixTimeToNT(struct timespec64 t);
+long long ksmbd_systime(void);
+#endif /* __KSMBD_MISC_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./ndr.c linux-5.4.60-fbx/fs/cifsd/ndr.c
--- linux-5.4.60-fbx/fs/cifsd./ndr.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/ndr.c	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,347 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2021 Samsung Electronics Co., Ltd.
+ *   Author(s): Namjae Jeon <linkinjeon@kernel.org>
+ */
+
+#include <linux/fs.h>
+
+#include "glob.h"
+#include "ndr.h"
+
+#define PAYLOAD_HEAD(d) ((d)->data + (d)->offset)
+
+#define KSMBD_ALIGN_MASK(x, mask) (((x) + (mask)) & ~(mask))
+
+#define KSMBD_ALIGN(x, a)							\
+	({									\
+		typeof(x) ret = (x);						\
+		if (((x) & ((typeof(x))(a) - 1)) != 0)				\
+			ret = KSMBD_ALIGN_MASK(x, (typeof(x))(a) - 1);		\
+		ret;								\
+	})
+
+static void align_offset(struct ndr *ndr, int n)
+{
+	ndr->offset = KSMBD_ALIGN(ndr->offset, n);
+}
+
+static int try_to_realloc_ndr_blob(struct ndr *n, size_t sz)
+{
+	char *data;
+
+	data = krealloc(n->data, n->offset + sz + 1024, GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	n->data = data;
+	n->length += 1024;
+	memset(n->data + n->offset, 0, 1024);
+	return 0;
+}
+
+static void ndr_write_int16(struct ndr *n, __u16 value)
+{
+	if (n->length <= n->offset + sizeof(value))
+		try_to_realloc_ndr_blob(n, sizeof(value));
+
+	*(__le16 *)PAYLOAD_HEAD(n) = cpu_to_le16(value);
+	n->offset += sizeof(value);
+}
+
+static void ndr_write_int32(struct ndr *n, __u32 value)
+{
+	if (n->length <= n->offset + sizeof(value))
+		try_to_realloc_ndr_blob(n, sizeof(value));
+
+	*(__le32 *)PAYLOAD_HEAD(n) = cpu_to_le32(value);
+	n->offset += sizeof(value);
+}
+
+static void ndr_write_int64(struct ndr *n, __u64 value)
+{
+	if (n->length <= n->offset + sizeof(value))
+		try_to_realloc_ndr_blob(n, sizeof(value));
+
+	*(__le64 *)PAYLOAD_HEAD(n) = cpu_to_le64(value);
+	n->offset += sizeof(value);
+}
+
+static int ndr_write_bytes(struct ndr *n, void *value, size_t sz)
+{
+	if (n->length <= n->offset + sz)
+		try_to_realloc_ndr_blob(n, sz);
+
+	memcpy(PAYLOAD_HEAD(n), value, sz);
+	n->offset += sz;
+	return 0;
+}
+
+static int ndr_write_string(struct ndr *n, void *value, size_t sz)
+{
+	if (n->length <= n->offset + sz)
+		try_to_realloc_ndr_blob(n, sz);
+
+	strncpy(PAYLOAD_HEAD(n), value, sz);
+	sz++;
+	n->offset += sz;
+	align_offset(n, 2);
+	return 0;
+}
+
+static int ndr_read_string(struct ndr *n, void *value, size_t sz)
+{
+	int len = strnlen(PAYLOAD_HEAD(n), sz);
+
+	memcpy(value, PAYLOAD_HEAD(n), len);
+	len++;
+	n->offset += len;
+	align_offset(n, 2);
+	return 0;
+}
+
+static int ndr_read_bytes(struct ndr *n, void *value, size_t sz)
+{
+	memcpy(value, PAYLOAD_HEAD(n), sz);
+	n->offset += sz;
+	return 0;
+}
+
+static __u16 ndr_read_int16(struct ndr *n)
+{
+	__u16 ret;
+
+	ret = le16_to_cpu(*(__le16 *)PAYLOAD_HEAD(n));
+	n->offset += sizeof(__u16);
+	return ret;
+}
+
+static __u32 ndr_read_int32(struct ndr *n)
+{
+	__u32 ret;
+
+	ret = le32_to_cpu(*(__le32 *)PAYLOAD_HEAD(n));
+	n->offset += sizeof(__u32);
+	return ret;
+}
+
+static __u64 ndr_read_int64(struct ndr *n)
+{
+	__u64 ret;
+
+	ret = le64_to_cpu(*(__le64 *)PAYLOAD_HEAD(n));
+	n->offset += sizeof(__u64);
+	return ret;
+}
+
+int ndr_encode_dos_attr(struct ndr *n, struct xattr_dos_attrib *da)
+{
+	char hex_attr[12] = {0};
+
+	n->offset = 0;
+	n->length = 1024;
+	n->data = kzalloc(n->length, GFP_KERNEL);
+	if (!n->data)
+		return -ENOMEM;
+
+	if (da->version == 3) {
+		snprintf(hex_attr, 10, "0x%x", da->attr);
+		ndr_write_string(n, hex_attr, strlen(hex_attr));
+	} else {
+		ndr_write_string(n, "", strlen(""));
+	}
+	ndr_write_int16(n, da->version);
+	ndr_write_int32(n, da->version);
+
+	ndr_write_int32(n, da->flags);
+	ndr_write_int32(n, da->attr);
+	if (da->version == 3) {
+		ndr_write_int32(n, da->ea_size);
+		ndr_write_int64(n, da->size);
+		ndr_write_int64(n, da->alloc_size);
+	} else {
+		ndr_write_int64(n, da->itime);
+	}
+	ndr_write_int64(n, da->create_time);
+	if (da->version == 3)
+		ndr_write_int64(n, da->change_time);
+	return 0;
+}
+
+int ndr_decode_dos_attr(struct ndr *n, struct xattr_dos_attrib *da)
+{
+	char hex_attr[12] = {0};
+	int version2;
+
+	n->offset = 0;
+	ndr_read_string(n, hex_attr, n->length - n->offset);
+	da->version = ndr_read_int16(n);
+
+	if (da->version != 3 && da->version != 4) {
+		ksmbd_err("v%d version is not supported\n", da->version);
+		return -EINVAL;
+	}
+
+	version2 = ndr_read_int32(n);
+	if (da->version != version2) {
+		ksmbd_err("ndr version mismatched(version: %d, version2: %d)\n",
+				da->version, version2);
+		return -EINVAL;
+	}
+
+	ndr_read_int32(n);
+	da->attr = ndr_read_int32(n);
+	if (da->version == 4) {
+		da->itime = ndr_read_int64(n);
+		da->create_time = ndr_read_int64(n);
+	} else {
+		ndr_read_int32(n);
+		ndr_read_int64(n);
+		ndr_read_int64(n);
+		da->create_time = ndr_read_int64(n);
+		ndr_read_int64(n);
+	}
+
+	return 0;
+}
+
+static int ndr_encode_posix_acl_entry(struct ndr *n, struct xattr_smb_acl *acl)
+{
+	int i;
+
+	ndr_write_int32(n, acl->count);
+	align_offset(n, 8);
+	ndr_write_int32(n, acl->count);
+	ndr_write_int32(n, 0);
+
+	for (i = 0; i < acl->count; i++) {
+		align_offset(n, 8);
+		ndr_write_int16(n, acl->entries[i].type);
+		ndr_write_int16(n, acl->entries[i].type);
+
+		if (acl->entries[i].type == SMB_ACL_USER) {
+			align_offset(n, 8);
+			ndr_write_int64(n, acl->entries[i].uid);
+		} else if (acl->entries[i].type == SMB_ACL_GROUP) {
+			align_offset(n, 8);
+			ndr_write_int64(n, acl->entries[i].gid);
+		}
+
+		/* push permission */
+		ndr_write_int32(n, acl->entries[i].perm);
+	}
+
+	return 0;
+}
+
+int ndr_encode_posix_acl(struct ndr *n, struct inode *inode,
+		struct xattr_smb_acl *acl, struct xattr_smb_acl *def_acl)
+{
+	int ref_id = 0x00020000;
+
+	n->offset = 0;
+	n->length = 1024;
+	n->data = kzalloc(n->length, GFP_KERNEL);
+	if (!n->data)
+		return -ENOMEM;
+
+	if (acl) {
+		/* ACL ACCESS */
+		ndr_write_int32(n, ref_id);
+		ref_id += 4;
+	} else {
+		ndr_write_int32(n, 0);
+	}
+
+	if (def_acl) {
+		/* DEFAULT ACL ACCESS */
+		ndr_write_int32(n, ref_id);
+		ref_id += 4;
+	} else {
+		ndr_write_int32(n, 0);
+	}
+
+	ndr_write_int64(n, from_kuid(&init_user_ns, inode->i_uid));
+	ndr_write_int64(n, from_kgid(&init_user_ns, inode->i_gid));
+	ndr_write_int32(n, inode->i_mode);
+
+	if (acl) {
+		ndr_encode_posix_acl_entry(n, acl);
+		if (def_acl)
+			ndr_encode_posix_acl_entry(n, def_acl);
+	}
+	return 0;
+}
+
+int ndr_encode_v4_ntacl(struct ndr *n, struct xattr_ntacl *acl)
+{
+	int ref_id = 0x00020004;
+
+	n->offset = 0;
+	n->length = 2048;
+	n->data = kzalloc(n->length, GFP_KERNEL);
+	if (!n->data)
+		return -ENOMEM;
+
+	ndr_write_int16(n, acl->version);
+	ndr_write_int32(n, acl->version);
+	ndr_write_int16(n, 2);
+	ndr_write_int32(n, ref_id);
+
+	/* push hash type and hash 64bytes */
+	ndr_write_int16(n, acl->hash_type);
+	ndr_write_bytes(n, acl->hash, XATTR_SD_HASH_SIZE);
+	ndr_write_bytes(n, acl->desc, acl->desc_len);
+	ndr_write_int64(n, acl->current_time);
+	ndr_write_bytes(n, acl->posix_acl_hash, XATTR_SD_HASH_SIZE);
+
+	/* push ndr for security descriptor */
+	ndr_write_bytes(n, acl->sd_buf, acl->sd_size);
+
+	return 0;
+}
+
+int ndr_decode_v4_ntacl(struct ndr *n, struct xattr_ntacl *acl)
+{
+	int version2;
+
+	n->offset = 0;
+	acl->version = ndr_read_int16(n);
+	if (acl->version != 4) {
+		ksmbd_err("v%d version is not supported\n", acl->version);
+		return -EINVAL;
+	}
+
+	version2 = ndr_read_int32(n);
+	if (acl->version != version2) {
+		ksmbd_err("ndr version mismatched(version: %d, version2: %d)\n",
+				acl->version, version2);
+		return -EINVAL;
+	}
+
+	/* Read Level */
+	ndr_read_int16(n);
+	/* Read Ref Id */
+	ndr_read_int32(n);
+	acl->hash_type = ndr_read_int16(n);
+	ndr_read_bytes(n, acl->hash, XATTR_SD_HASH_SIZE);
+
+	ndr_read_bytes(n, acl->desc, 10);
+	if (strncmp(acl->desc, "posix_acl", 9)) {
+		ksmbd_err("Invalid acl description : %s\n", acl->desc);
+		return -EINVAL;
+	}
+
+	/* Read Time */
+	ndr_read_int64(n);
+	/* Read Posix ACL hash */
+	ndr_read_bytes(n, acl->posix_acl_hash, XATTR_SD_HASH_SIZE);
+	acl->sd_size = n->length - n->offset;
+	acl->sd_buf = kzalloc(acl->sd_size, GFP_KERNEL);
+	if (!acl->sd_buf)
+		return -ENOMEM;
+
+	ndr_read_bytes(n, acl->sd_buf, acl->sd_size);
+
+	return 0;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./ndr.h linux-5.4.60-fbx/fs/cifsd/ndr.h
--- linux-5.4.60-fbx/fs/cifsd./ndr.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/ndr.h	2021-03-30 15:48:29.598385862 +0200
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2020 Samsung Electronics Co., Ltd.
+ *   Author(s): Namjae Jeon <linkinjeon@kernel.org>
+ */
+
+struct ndr {
+	char	*data;
+	int	offset;
+	int	length;
+};
+
+#define NDR_NTSD_OFFSETOF	0xA0
+
+int ndr_encode_dos_attr(struct ndr *n, struct xattr_dos_attrib *da);
+int ndr_decode_dos_attr(struct ndr *n, struct xattr_dos_attrib *da);
+int ndr_encode_posix_acl(struct ndr *n, struct inode *inode,
+		struct xattr_smb_acl *acl, struct xattr_smb_acl *def_acl);
+int ndr_encode_v4_ntacl(struct ndr *n, struct xattr_ntacl *acl);
+int ndr_encode_v3_ntacl(struct ndr *n, struct xattr_ntacl *acl);
+int ndr_decode_v4_ntacl(struct ndr *n, struct xattr_ntacl *acl);
diff -Nruw linux-5.4.60-fbx/fs/cifsd./netmisc.c linux-5.4.60-fbx/fs/cifsd/netmisc.c
--- linux-5.4.60-fbx/fs/cifsd./netmisc.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/netmisc.c	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,606 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (c) International Business Machines  Corp., 2002,2008
+ *   Author(s): Steve French (sfrench@us.ibm.com)
+ *
+ *   Error mapping routines from Samba libsmb/errormap.c
+ *   Copyright (C) Andrew Tridgell 2001
+ */
+
+#include "glob.h"
+#include "smberr.h"
+#include "nterr.h"
+#include "smb_common.h"
+
+/*****************************************************************************
+ * convert a NT status code to a dos class/code
+ *****************************************************************************/
+/* NT status -> dos error map */
+static const struct {
+	__u8 dos_class;
+	__u16 dos_code;
+	__u32 ntstatus;
+} ntstatus_to_dos_map[] = {
+	{
+	ERRDOS, ERRgeneral, NT_STATUS_UNSUCCESSFUL}, {
+	ERRDOS, ERRbadfunc, NT_STATUS_NOT_IMPLEMENTED}, {
+	ERRDOS, ERRinvlevel, NT_STATUS_INVALID_INFO_CLASS}, {
+	ERRDOS, 24, NT_STATUS_INFO_LENGTH_MISMATCH}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ACCESS_VIOLATION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_IN_PAGE_ERROR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PAGEFILE_QUOTA}, {
+	ERRDOS, ERRbadfid, NT_STATUS_INVALID_HANDLE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_BAD_INITIAL_STACK}, {
+	ERRDOS, 193, NT_STATUS_BAD_INITIAL_PC}, {
+	ERRDOS, 87, NT_STATUS_INVALID_CID}, {
+	ERRHRD, ERRgeneral, NT_STATUS_TIMER_NOT_CANCELED}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER}, {
+	ERRDOS, ERRbadfile, NT_STATUS_NO_SUCH_DEVICE}, {
+	ERRDOS, ERRbadfile, NT_STATUS_NO_SUCH_FILE}, {
+	ERRDOS, ERRbadfunc, NT_STATUS_INVALID_DEVICE_REQUEST}, {
+	ERRDOS, 38, NT_STATUS_END_OF_FILE}, {
+	ERRDOS, 34, NT_STATUS_WRONG_VOLUME}, {
+	ERRDOS, 21, NT_STATUS_NO_MEDIA_IN_DEVICE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNRECOGNIZED_MEDIA}, {
+	ERRDOS, 27, NT_STATUS_NONEXISTENT_SECTOR},
+/*	{ This NT error code was 'sqashed'
+ *	 from NT_STATUS_MORE_PROCESSING_REQUIRED to NT_STATUS_OK
+ *	 during the session setup }
+ */
+	{
+	ERRDOS, ERRnomem, NT_STATUS_NO_MEMORY}, {
+	ERRDOS, 487, NT_STATUS_CONFLICTING_ADDRESSES}, {
+	ERRDOS, 487, NT_STATUS_NOT_MAPPED_VIEW}, {
+	ERRDOS, 87, NT_STATUS_UNABLE_TO_FREE_VM}, {
+	ERRDOS, 87, NT_STATUS_UNABLE_TO_DELETE_SECTION}, {
+	ERRDOS, 2142, NT_STATUS_INVALID_SYSTEM_SERVICE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ILLEGAL_INSTRUCTION}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_INVALID_LOCK_SEQUENCE}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_INVALID_VIEW_SIZE}, {
+	ERRDOS, 193, NT_STATUS_INVALID_FILE_FOR_SECTION}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_ALREADY_COMMITTED},
+/*	{ This NT error code was 'sqashed'
+ *	 from NT_STATUS_ACCESS_DENIED to NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE
+ *	 during the session setup }
+ */
+	{
+	ERRDOS, ERRnoaccess, NT_STATUS_ACCESS_DENIED}, {
+	ERRDOS, 111, NT_STATUS_BUFFER_TOO_SMALL}, {
+	ERRDOS, ERRbadfid, NT_STATUS_OBJECT_TYPE_MISMATCH}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NONCONTINUABLE_EXCEPTION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_DISPOSITION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNWIND}, {
+	ERRHRD, ERRgeneral, NT_STATUS_BAD_STACK}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_UNWIND_TARGET}, {
+	ERRDOS, 158, NT_STATUS_NOT_LOCKED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PARITY_ERROR}, {
+	ERRDOS, 487, NT_STATUS_UNABLE_TO_DECOMMIT_VM}, {
+	ERRDOS, 487, NT_STATUS_NOT_COMMITTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_PORT_ATTRIBUTES}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PORT_MESSAGE_TOO_LONG}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_MIX}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_QUOTA_LOWER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DISK_CORRUPT_ERROR}, {
+	/* mapping changed since shell does lookup on * expects FileNotFound */
+	ERRDOS, ERRbadfile, NT_STATUS_OBJECT_NAME_INVALID}, {
+	ERRDOS, ERRbadfile, NT_STATUS_OBJECT_NAME_NOT_FOUND}, {
+	ERRDOS, ERRalreadyexists, NT_STATUS_OBJECT_NAME_COLLISION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_HANDLE_NOT_WAITABLE}, {
+	ERRDOS, ERRbadfid, NT_STATUS_PORT_DISCONNECTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DEVICE_ALREADY_ATTACHED}, {
+	ERRDOS, 161, NT_STATUS_OBJECT_PATH_INVALID}, {
+	ERRDOS, ERRbadpath, NT_STATUS_OBJECT_PATH_NOT_FOUND}, {
+	ERRDOS, 161, NT_STATUS_OBJECT_PATH_SYNTAX_BAD}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DATA_OVERRUN}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DATA_LATE_ERROR}, {
+	ERRDOS, 23, NT_STATUS_DATA_ERROR}, {
+	ERRDOS, 23, NT_STATUS_CRC_ERROR}, {
+	ERRDOS, ERRnomem, NT_STATUS_SECTION_TOO_BIG}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_PORT_CONNECTION_REFUSED}, {
+	ERRDOS, ERRbadfid, NT_STATUS_INVALID_PORT_HANDLE}, {
+	ERRDOS, ERRbadshare, NT_STATUS_SHARING_VIOLATION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_QUOTA_EXCEEDED}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PAGE_PROTECTION}, {
+	ERRDOS, 288, NT_STATUS_MUTANT_NOT_OWNED}, {
+	ERRDOS, 298, NT_STATUS_SEMAPHORE_LIMIT_EXCEEDED}, {
+	ERRDOS, 87, NT_STATUS_PORT_ALREADY_SET}, {
+	ERRDOS, 87, NT_STATUS_SECTION_NOT_IMAGE}, {
+	ERRDOS, 156, NT_STATUS_SUSPEND_COUNT_EXCEEDED}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_THREAD_IS_TERMINATING}, {
+	ERRDOS, 87, NT_STATUS_BAD_WORKING_SET_LIMIT}, {
+	ERRDOS, 87, NT_STATUS_INCOMPATIBLE_FILE_MAP}, {
+	ERRDOS, 87, NT_STATUS_SECTION_PROTECTION}, {
+	ERRDOS, ERReasnotsupported, NT_STATUS_EAS_NOT_SUPPORTED}, {
+	ERRDOS, 255, NT_STATUS_EA_TOO_LARGE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NONEXISTENT_EA_ENTRY}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_EAS_ON_FILE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_EA_CORRUPT_ERROR}, {
+	ERRDOS, ERRlock, NT_STATUS_FILE_LOCK_CONFLICT}, {
+	ERRDOS, ERRlock, NT_STATUS_LOCK_NOT_GRANTED}, {
+	ERRDOS, ERRbadfile, NT_STATUS_DELETE_PENDING}, {
+	ERRDOS, ERRunsup, NT_STATUS_CTL_FILE_NOT_SUPPORTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNKNOWN_REVISION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_REVISION_MISMATCH}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_OWNER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_PRIMARY_GROUP}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_IMPERSONATION_TOKEN}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CANT_DISABLE_MANDATORY}, {
+	ERRDOS, 2215, NT_STATUS_NO_LOGON_SERVERS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_LOGON_SESSION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_PRIVILEGE}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_PRIVILEGE_NOT_HELD}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_ACCOUNT_NAME}, {
+	ERRHRD, ERRgeneral, NT_STATUS_USER_EXISTS},
+/*	{ This NT error code was 'sqashed'
+ *	 from NT_STATUS_NO_SUCH_USER to NT_STATUS_LOGON_FAILURE
+ *	 during the session setup }
+ */
+	{
+	ERRDOS, ERRnoaccess, NT_STATUS_NO_SUCH_USER}, { /* could map to 2238 */
+	ERRHRD, ERRgeneral, NT_STATUS_GROUP_EXISTS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_GROUP}, {
+	ERRHRD, ERRgeneral, NT_STATUS_MEMBER_IN_GROUP}, {
+	ERRHRD, ERRgeneral, NT_STATUS_MEMBER_NOT_IN_GROUP}, {
+	ERRHRD, ERRgeneral, NT_STATUS_LAST_ADMIN},
+/*	{ This NT error code was 'sqashed'
+ *	 from NT_STATUS_WRONG_PASSWORD to NT_STATUS_LOGON_FAILURE
+ *	 during the session setup }
+ */
+	{
+	ERRSRV, ERRbadpw, NT_STATUS_WRONG_PASSWORD}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ILL_FORMED_PASSWORD}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PASSWORD_RESTRICTION}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_LOGON_FAILURE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ACCOUNT_RESTRICTION}, {
+	ERRSRV, ERRbadLogonTime, NT_STATUS_INVALID_LOGON_HOURS}, {
+	ERRSRV, ERRbadclient, NT_STATUS_INVALID_WORKSTATION}, {
+	ERRSRV, ERRpasswordExpired, NT_STATUS_PASSWORD_EXPIRED}, {
+	ERRSRV, ERRaccountexpired, NT_STATUS_ACCOUNT_DISABLED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NONE_MAPPED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_TOO_MANY_LUIDS_REQUESTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_LUIDS_EXHAUSTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_SUB_AUTHORITY}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_ACL}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_SID}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_SECURITY_DESCR}, {
+	ERRDOS, 127, NT_STATUS_PROCEDURE_NOT_FOUND}, {
+	ERRDOS, 193, NT_STATUS_INVALID_IMAGE_FORMAT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_TOKEN}, {
+	ERRHRD, ERRgeneral, NT_STATUS_BAD_INHERITANCE_ACL}, {
+	ERRDOS, 158, NT_STATUS_RANGE_NOT_LOCKED}, {
+	ERRDOS, 112, NT_STATUS_DISK_FULL}, {
+	ERRHRD, ERRgeneral, NT_STATUS_SERVER_DISABLED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_SERVER_NOT_DISABLED}, {
+	ERRDOS, 68, NT_STATUS_TOO_MANY_GUIDS_REQUESTED}, {
+	ERRDOS, 259, NT_STATUS_GUIDS_EXHAUSTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_ID_AUTHORITY}, {
+	ERRDOS, 259, NT_STATUS_AGENTS_EXHAUSTED}, {
+	ERRDOS, 154, NT_STATUS_INVALID_VOLUME_LABEL}, {
+	ERRDOS, 14, NT_STATUS_SECTION_NOT_EXTENDED}, {
+	ERRDOS, 487, NT_STATUS_NOT_MAPPED_DATA}, {
+	ERRHRD, ERRgeneral, NT_STATUS_RESOURCE_DATA_NOT_FOUND}, {
+	ERRHRD, ERRgeneral, NT_STATUS_RESOURCE_TYPE_NOT_FOUND}, {
+	ERRHRD, ERRgeneral, NT_STATUS_RESOURCE_NAME_NOT_FOUND}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ARRAY_BOUNDS_EXCEEDED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FLOAT_DENORMAL_OPERAND}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FLOAT_DIVIDE_BY_ZERO}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FLOAT_INEXACT_RESULT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FLOAT_INVALID_OPERATION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FLOAT_OVERFLOW}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FLOAT_STACK_CHECK}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FLOAT_UNDERFLOW}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INTEGER_DIVIDE_BY_ZERO}, {
+	ERRDOS, 534, NT_STATUS_INTEGER_OVERFLOW}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PRIVILEGED_INSTRUCTION}, {
+	ERRDOS, ERRnomem, NT_STATUS_TOO_MANY_PAGING_FILES}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FILE_INVALID}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ALLOTTED_SPACE_EXCEEDED},
+/*	{ This NT error code was 'sqashed'
+ *	 from NT_STATUS_INSUFFICIENT_RESOURCES to
+ *	 NT_STATUS_INSUFF_SERVER_RESOURCES during the session setup }
+ */
+	{
+	ERRDOS, ERRnoresource, NT_STATUS_INSUFFICIENT_RESOURCES}, {
+	ERRDOS, ERRbadpath, NT_STATUS_DFS_EXIT_PATH_FOUND}, {
+	ERRDOS, 23, NT_STATUS_DEVICE_DATA_ERROR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DEVICE_NOT_CONNECTED}, {
+	ERRDOS, 21, NT_STATUS_DEVICE_POWER_FAILURE}, {
+	ERRDOS, 487, NT_STATUS_FREE_VM_NOT_AT_BASE}, {
+	ERRDOS, 487, NT_STATUS_MEMORY_NOT_ALLOCATED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_WORKING_SET_QUOTA}, {
+	ERRDOS, 19, NT_STATUS_MEDIA_WRITE_PROTECTED}, {
+	ERRDOS, 21, NT_STATUS_DEVICE_NOT_READY}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_GROUP_ATTRIBUTES}, {
+	ERRHRD, ERRgeneral, NT_STATUS_BAD_IMPERSONATION_LEVEL}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CANT_OPEN_ANONYMOUS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_BAD_VALIDATION_CLASS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_BAD_TOKEN_TYPE}, {
+	ERRDOS, 87, NT_STATUS_BAD_MASTER_BOOT_RECORD}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INSTRUCTION_MISALIGNMENT}, {
+	ERRDOS, ERRpipebusy, NT_STATUS_INSTANCE_NOT_AVAILABLE}, {
+	ERRDOS, ERRpipebusy, NT_STATUS_PIPE_NOT_AVAILABLE}, {
+	ERRDOS, ERRbadpipe, NT_STATUS_INVALID_PIPE_STATE}, {
+	ERRDOS, ERRpipebusy, NT_STATUS_PIPE_BUSY}, {
+	ERRDOS, ERRbadfunc, NT_STATUS_ILLEGAL_FUNCTION}, {
+	ERRDOS, ERRnotconnected, NT_STATUS_PIPE_DISCONNECTED}, {
+	ERRDOS, ERRpipeclosing, NT_STATUS_PIPE_CLOSING}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PIPE_CONNECTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PIPE_LISTENING}, {
+	ERRDOS, ERRbadpipe, NT_STATUS_INVALID_READ_MODE}, {
+	ERRDOS, 121, NT_STATUS_IO_TIMEOUT}, {
+	ERRDOS, 38, NT_STATUS_FILE_FORCED_CLOSED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PROFILING_NOT_STARTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PROFILING_NOT_STOPPED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_COULD_NOT_INTERPRET}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_FILE_IS_A_DIRECTORY}, {
+	ERRDOS, ERRunsup, NT_STATUS_NOT_SUPPORTED}, {
+	ERRDOS, 51, NT_STATUS_REMOTE_NOT_LISTENING}, {
+	ERRDOS, 52, NT_STATUS_DUPLICATE_NAME}, {
+	ERRDOS, 53, NT_STATUS_BAD_NETWORK_PATH}, {
+	ERRDOS, 54, NT_STATUS_NETWORK_BUSY}, {
+	ERRDOS, 55, NT_STATUS_DEVICE_DOES_NOT_EXIST}, {
+	ERRDOS, 56, NT_STATUS_TOO_MANY_COMMANDS}, {
+	ERRDOS, 57, NT_STATUS_ADAPTER_HARDWARE_ERROR}, {
+	ERRDOS, 58, NT_STATUS_INVALID_NETWORK_RESPONSE}, {
+	ERRDOS, 59, NT_STATUS_UNEXPECTED_NETWORK_ERROR}, {
+	ERRDOS, 60, NT_STATUS_BAD_REMOTE_ADAPTER}, {
+	ERRDOS, 61, NT_STATUS_PRINT_QUEUE_FULL}, {
+	ERRDOS, 62, NT_STATUS_NO_SPOOL_SPACE}, {
+	ERRDOS, 63, NT_STATUS_PRINT_CANCELLED}, {
+	ERRDOS, 64, NT_STATUS_NETWORK_NAME_DELETED}, {
+	ERRDOS, 65, NT_STATUS_NETWORK_ACCESS_DENIED}, {
+	ERRDOS, 66, NT_STATUS_BAD_DEVICE_TYPE}, {
+	ERRDOS, ERRnosuchshare, NT_STATUS_BAD_NETWORK_NAME}, {
+	ERRDOS, 68, NT_STATUS_TOO_MANY_NAMES}, {
+	ERRDOS, 69, NT_STATUS_TOO_MANY_SESSIONS}, {
+	ERRDOS, 70, NT_STATUS_SHARING_PAUSED}, {
+	ERRDOS, 71, NT_STATUS_REQUEST_NOT_ACCEPTED}, {
+	ERRDOS, 72, NT_STATUS_REDIRECTOR_PAUSED}, {
+	ERRDOS, 88, NT_STATUS_NET_WRITE_FAULT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PROFILING_AT_LIMIT}, {
+	ERRDOS, ERRdiffdevice, NT_STATUS_NOT_SAME_DEVICE}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_FILE_RENAMED}, {
+	ERRDOS, 240, NT_STATUS_VIRTUAL_CIRCUIT_CLOSED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_SECURITY_ON_OBJECT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CANT_WAIT}, {
+	ERRDOS, ERRpipeclosing, NT_STATUS_PIPE_EMPTY}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CANT_ACCESS_DOMAIN_INFO}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CANT_TERMINATE_SELF}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_SERVER_STATE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_DOMAIN_STATE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_DOMAIN_ROLE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_DOMAIN}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DOMAIN_EXISTS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DOMAIN_LIMIT_EXCEEDED}, {
+	ERRDOS, 300, NT_STATUS_OPLOCK_NOT_GRANTED}, {
+	ERRDOS, 301, NT_STATUS_INVALID_OPLOCK_PROTOCOL}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INTERNAL_DB_CORRUPTION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INTERNAL_ERROR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_GENERIC_NOT_MAPPED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_BAD_DESCRIPTOR_FORMAT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_USER_BUFFER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNEXPECTED_IO_ERROR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNEXPECTED_MM_CREATE_ERR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNEXPECTED_MM_MAP_ERROR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNEXPECTED_MM_EXTEND_ERR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NOT_LOGON_PROCESS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_LOGON_SESSION_EXISTS}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_1}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_2}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_3}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_4}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_5}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_6}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_7}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_8}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_9}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_10}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_11}, {
+	ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_12}, {
+	ERRDOS, ERRbadpath, NT_STATUS_REDIRECTOR_NOT_STARTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_REDIRECTOR_STARTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_STACK_OVERFLOW}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_PACKAGE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_BAD_FUNCTION_TABLE}, {
+	ERRDOS, 203, 0xc0000100}, {
+	ERRDOS, 145, NT_STATUS_DIRECTORY_NOT_EMPTY}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FILE_CORRUPT_ERROR}, {
+	ERRDOS, 267, NT_STATUS_NOT_A_DIRECTORY}, {
+	ERRHRD, ERRgeneral, NT_STATUS_BAD_LOGON_SESSION_STATE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_LOGON_SESSION_COLLISION}, {
+	ERRDOS, 206, NT_STATUS_NAME_TOO_LONG}, {
+	ERRDOS, 2401, NT_STATUS_FILES_OPEN}, {
+	ERRDOS, 2404, NT_STATUS_CONNECTION_IN_USE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_MESSAGE_NOT_FOUND}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_PROCESS_IS_TERMINATING}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_LOGON_TYPE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_GUID_TRANSLATION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CANNOT_IMPERSONATE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_IMAGE_ALREADY_LOADED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ABIOS_NOT_PRESENT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ABIOS_LID_NOT_EXIST}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ABIOS_LID_ALREADY_OWNED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ABIOS_NOT_LID_OWNER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ABIOS_INVALID_COMMAND}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ABIOS_INVALID_LID}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ABIOS_SELECTOR_NOT_AVAILABLE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ABIOS_INVALID_SELECTOR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_LDT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_LDT_SIZE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_LDT_OFFSET}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_LDT_DESCRIPTOR}, {
+	ERRDOS, 193, NT_STATUS_INVALID_IMAGE_NE_FORMAT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_RXACT_INVALID_STATE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_RXACT_COMMIT_FAILURE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_MAPPED_FILE_SIZE_ZERO}, {
+	ERRDOS, ERRnofids, NT_STATUS_TOO_MANY_OPENED_FILES}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CANCELLED}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_CANNOT_DELETE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_COMPUTER_NAME}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_FILE_DELETED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_SPECIAL_ACCOUNT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_SPECIAL_GROUP}, {
+	ERRHRD, ERRgeneral, NT_STATUS_SPECIAL_USER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_MEMBERS_PRIMARY_GROUP}, {
+	ERRDOS, ERRbadfid, NT_STATUS_FILE_CLOSED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_TOO_MANY_THREADS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_THREAD_NOT_IN_PROCESS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_TOKEN_ALREADY_IN_USE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PAGEFILE_QUOTA_EXCEEDED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_COMMITMENT_LIMIT}, {
+	ERRDOS, 193, NT_STATUS_INVALID_IMAGE_LE_FORMAT}, {
+	ERRDOS, 193, NT_STATUS_INVALID_IMAGE_NOT_MZ}, {
+	ERRDOS, 193, NT_STATUS_INVALID_IMAGE_PROTECT}, {
+	ERRDOS, 193, NT_STATUS_INVALID_IMAGE_WIN_16}, {
+	ERRHRD, ERRgeneral, NT_STATUS_LOGON_SERVER_CONFLICT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_TIME_DIFFERENCE_AT_DC}, {
+	ERRHRD, ERRgeneral, NT_STATUS_SYNCHRONIZATION_REQUIRED}, {
+	ERRDOS, 126, NT_STATUS_DLL_NOT_FOUND}, {
+	ERRHRD, ERRgeneral, NT_STATUS_OPEN_FAILED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_IO_PRIVILEGE_FAILED}, {
+	ERRDOS, 182, NT_STATUS_ORDINAL_NOT_FOUND}, {
+	ERRDOS, 127, NT_STATUS_ENTRYPOINT_NOT_FOUND}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CONTROL_C_EXIT}, {
+	ERRDOS, 64, NT_STATUS_LOCAL_DISCONNECT}, {
+	ERRDOS, 64, NT_STATUS_REMOTE_DISCONNECT}, {
+	ERRDOS, 51, NT_STATUS_REMOTE_RESOURCES}, {
+	ERRDOS, 59, NT_STATUS_LINK_FAILED}, {
+	ERRDOS, 59, NT_STATUS_LINK_TIMEOUT}, {
+	ERRDOS, 59, NT_STATUS_INVALID_CONNECTION}, {
+	ERRDOS, 59, NT_STATUS_INVALID_ADDRESS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DLL_INIT_FAILED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_MISSING_SYSTEMFILE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNHANDLED_EXCEPTION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_APP_INIT_FAILURE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PAGEFILE_CREATE_FAILED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_PAGEFILE}, {
+	ERRDOS, 124, NT_STATUS_INVALID_LEVEL}, {
+	ERRDOS, 86, NT_STATUS_WRONG_PASSWORD_CORE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ILLEGAL_FLOAT_CONTEXT}, {
+	ERRDOS, 109, NT_STATUS_PIPE_BROKEN}, {
+	ERRHRD, ERRgeneral, NT_STATUS_REGISTRY_CORRUPT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_REGISTRY_IO_FAILED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_EVENT_PAIR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNRECOGNIZED_VOLUME}, {
+	ERRHRD, ERRgeneral, NT_STATUS_SERIAL_NO_DEVICE_INITED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_ALIAS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_MEMBER_NOT_IN_ALIAS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_MEMBER_IN_ALIAS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ALIAS_EXISTS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_LOGON_NOT_GRANTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_TOO_MANY_SECRETS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_SECRET_TOO_LONG}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INTERNAL_DB_ERROR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FULLSCREEN_MODE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_TOO_MANY_CONTEXT_IDS}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_LOGON_TYPE_NOT_GRANTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NOT_REGISTRY_FILE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NT_CROSS_ENCRYPTION_REQUIRED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DOMAIN_CTRLR_CONFIG_ERROR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FT_MISSING_MEMBER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ILL_FORMED_SERVICE_ENTRY}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ILLEGAL_CHARACTER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNMAPPABLE_CHARACTER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNDEFINED_CHARACTER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FLOPPY_VOLUME}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FLOPPY_ID_MARK_NOT_FOUND}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FLOPPY_WRONG_CYLINDER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FLOPPY_UNKNOWN_ERROR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FLOPPY_BAD_REGISTERS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DISK_RECALIBRATE_FAILED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DISK_OPERATION_FAILED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DISK_RESET_FAILED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_SHARED_IRQ_BUSY}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FT_ORPHANING}, {
+	ERRHRD, ERRgeneral, 0xc000016e}, {
+	ERRHRD, ERRgeneral, 0xc000016f}, {
+	ERRHRD, ERRgeneral, 0xc0000170}, {
+	ERRHRD, ERRgeneral, 0xc0000171}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PARTITION_FAILURE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_BLOCK_LENGTH}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DEVICE_NOT_PARTITIONED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNABLE_TO_LOCK_MEDIA}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNABLE_TO_UNLOAD_MEDIA}, {
+	ERRHRD, ERRgeneral, NT_STATUS_EOM_OVERFLOW}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_MEDIA}, {
+	ERRHRD, ERRgeneral, 0xc0000179}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_MEMBER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_MEMBER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_KEY_DELETED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_LOG_SPACE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_TOO_MANY_SIDS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_LM_CROSS_ENCRYPTION_REQUIRED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_KEY_HAS_CHILDREN}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CHILD_MUST_BE_VOLATILE}, {
+	ERRDOS, 87, NT_STATUS_DEVICE_CONFIGURATION_ERROR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DRIVER_INTERNAL_ERROR}, {
+	ERRDOS, 22, NT_STATUS_INVALID_DEVICE_STATE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_IO_DEVICE_ERROR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DEVICE_PROTOCOL_ERROR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_BACKUP_CONTROLLER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_LOG_FILE_FULL}, {
+	ERRDOS, 19, NT_STATUS_TOO_LATE}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_NO_TRUST_LSA_SECRET},
+/*	{ This NT error code was 'sqashed'
+ *	 from NT_STATUS_NO_TRUST_SAM_ACCOUNT to
+ *	 NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE during the session setup }
+ */
+	{
+	ERRDOS, ERRnoaccess, NT_STATUS_NO_TRUST_SAM_ACCOUNT}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_TRUSTED_DOMAIN_FAILURE}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_EVENTLOG_FILE_CORRUPT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_EVENTLOG_CANT_START}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_TRUST_FAILURE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_MUTANT_LIMIT_EXCEEDED}, {
+	ERRDOS, ERRnetlogonNotStarted, NT_STATUS_NETLOGON_NOT_STARTED}, {
+	ERRSRV, ERRaccountexpired, NT_STATUS_ACCOUNT_EXPIRED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_POSSIBLE_DEADLOCK}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NETWORK_CREDENTIAL_CONFLICT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_REMOTE_SESSION_LIMIT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_EVENTLOG_FILE_CHANGED}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT},
+/*	{ This NT error code was 'sqashed'
+ *	 from NT_STATUS_DOMAIN_TRUST_INCONSISTENT to NT_STATUS_LOGON_FAILURE
+ *	 during the session setup }
+ */
+	{
+	ERRDOS, ERRnoaccess, NT_STATUS_DOMAIN_TRUST_INCONSISTENT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FS_DRIVER_REQUIRED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_USER_SESSION_KEY}, {
+	ERRDOS, 59, NT_STATUS_USER_SESSION_DELETED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_RESOURCE_LANG_NOT_FOUND}, {
+	ERRDOS, ERRnoresource, NT_STATUS_INSUFF_SERVER_RESOURCES}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_BUFFER_SIZE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_ADDRESS_COMPONENT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_ADDRESS_WILDCARD}, {
+	ERRDOS, 68, NT_STATUS_TOO_MANY_ADDRESSES}, {
+	ERRDOS, 52, NT_STATUS_ADDRESS_ALREADY_EXISTS}, {
+	ERRDOS, 64, NT_STATUS_ADDRESS_CLOSED}, {
+	ERRDOS, 64, NT_STATUS_CONNECTION_DISCONNECTED}, {
+	ERRDOS, 64, NT_STATUS_CONNECTION_RESET}, {
+	ERRDOS, 68, NT_STATUS_TOO_MANY_NODES}, {
+	ERRDOS, 59, NT_STATUS_TRANSACTION_ABORTED}, {
+	ERRDOS, 59, NT_STATUS_TRANSACTION_TIMED_OUT}, {
+	ERRDOS, 59, NT_STATUS_TRANSACTION_NO_RELEASE}, {
+	ERRDOS, 59, NT_STATUS_TRANSACTION_NO_MATCH}, {
+	ERRDOS, 59, NT_STATUS_TRANSACTION_RESPONDED}, {
+	ERRDOS, 59, NT_STATUS_TRANSACTION_INVALID_ID}, {
+	ERRDOS, 59, NT_STATUS_TRANSACTION_INVALID_TYPE}, {
+	ERRDOS, ERRunsup, NT_STATUS_NOT_SERVER_SESSION}, {
+	ERRDOS, ERRunsup, NT_STATUS_NOT_CLIENT_SESSION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CANNOT_LOAD_REGISTRY_FILE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DEBUG_ATTACH_FAILED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_SYSTEM_PROCESS_TERMINATED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DATA_NOT_ACCEPTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_BROWSER_SERVERS_FOUND}, {
+	ERRHRD, ERRgeneral, NT_STATUS_VDM_HARD_ERROR}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DRIVER_CANCEL_TIMEOUT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_REPLY_MESSAGE_MISMATCH}, {
+	ERRHRD, ERRgeneral, NT_STATUS_MAPPED_ALIGNMENT}, {
+	ERRDOS, 193, NT_STATUS_IMAGE_CHECKSUM_MISMATCH}, {
+	ERRHRD, ERRgeneral, NT_STATUS_LOST_WRITEBEHIND_DATA}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CLIENT_SERVER_PARAMETERS_INVALID}, {
+	ERRSRV, ERRpasswordExpired, NT_STATUS_PASSWORD_MUST_CHANGE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NOT_FOUND}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NOT_TINY_STREAM}, {
+	ERRHRD, ERRgeneral, NT_STATUS_RECOVERY_FAILURE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_STACK_OVERFLOW_READ}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FAIL_CHECK}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DUPLICATE_OBJECTID}, {
+	ERRHRD, ERRgeneral, NT_STATUS_OBJECTID_EXISTS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CONVERT_TO_LARGE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_RETRY}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FOUND_OUT_OF_SCOPE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ALLOCATE_BUCKET}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PROPSET_NOT_FOUND}, {
+	ERRHRD, ERRgeneral, NT_STATUS_MARSHALL_OVERFLOW}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_VARIANT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND}, {
+	ERRDOS, ERRnoaccess, NT_STATUS_ACCOUNT_LOCKED_OUT}, {
+	ERRDOS, ERRbadfid, NT_STATUS_HANDLE_NOT_CLOSABLE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CONNECTION_REFUSED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_GRACEFUL_DISCONNECT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ADDRESS_ALREADY_ASSOCIATED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_ADDRESS_NOT_ASSOCIATED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CONNECTION_INVALID}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CONNECTION_ACTIVE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NETWORK_UNREACHABLE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_HOST_UNREACHABLE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PROTOCOL_UNREACHABLE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PORT_UNREACHABLE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_REQUEST_ABORTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CONNECTION_ABORTED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_BAD_COMPRESSION_BUFFER}, {
+	ERRHRD, ERRgeneral, NT_STATUS_USER_MAPPED_FILE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_AUDIT_FAILED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_TIMER_RESOLUTION_NOT_SET}, {
+	ERRHRD, ERRgeneral, NT_STATUS_CONNECTION_COUNT_LIMIT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_LOGIN_TIME_RESTRICTION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_LOGIN_WKSTA_RESTRICTION}, {
+	ERRDOS, 193, NT_STATUS_IMAGE_MP_UP_MISMATCH}, {
+	ERRHRD, ERRgeneral, 0xc000024a}, {
+	ERRHRD, ERRgeneral, 0xc000024b}, {
+	ERRHRD, ERRgeneral, 0xc000024c}, {
+	ERRHRD, ERRgeneral, 0xc000024d}, {
+	ERRHRD, ERRgeneral, 0xc000024e}, {
+	ERRHRD, ERRgeneral, 0xc000024f}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INSUFFICIENT_LOGON_INFO}, {
+	ERRHRD, ERRgeneral, NT_STATUS_BAD_DLL_ENTRYPOINT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_BAD_SERVICE_ENTRYPOINT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_LPC_REPLY_LOST}, {
+	ERRHRD, ERRgeneral, NT_STATUS_IP_ADDRESS_CONFLICT1}, {
+	ERRHRD, ERRgeneral, NT_STATUS_IP_ADDRESS_CONFLICT2}, {
+	ERRHRD, ERRgeneral, NT_STATUS_REGISTRY_QUOTA_LIMIT}, {
+	ERRSRV, 3, NT_STATUS_PATH_NOT_COVERED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_NO_CALLBACK_ACTIVE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_LICENSE_QUOTA_EXCEEDED}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PWD_TOO_SHORT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PWD_TOO_RECENT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PWD_HISTORY_CONFLICT}, {
+	ERRHRD, ERRgeneral, 0xc000025d}, {
+	ERRHRD, ERRgeneral, NT_STATUS_PLUGPLAY_NO_DEVICE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_UNSUPPORTED_COMPRESSION}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_HW_PROFILE}, {
+	ERRHRD, ERRgeneral, NT_STATUS_INVALID_PLUGPLAY_DEVICE_PATH}, {
+	ERRDOS, 182, NT_STATUS_DRIVER_ORDINAL_NOT_FOUND}, {
+	ERRDOS, 127, NT_STATUS_DRIVER_ENTRYPOINT_NOT_FOUND}, {
+	ERRDOS, 288, NT_STATUS_RESOURCE_NOT_OWNED}, {
+	ERRDOS, ErrTooManyLinks, NT_STATUS_TOO_MANY_LINKS}, {
+	ERRHRD, ERRgeneral, NT_STATUS_QUOTA_LIST_INCONSISTENT}, {
+	ERRHRD, ERRgeneral, NT_STATUS_FILE_IS_OFFLINE}, {
+	ERRDOS, 21, 0xc000026e}, {
+	ERRDOS, 161, 0xc0000281}, {
+	ERRDOS, ERRnoaccess, 0xc000028a}, {
+	ERRDOS, ERRnoaccess, 0xc000028b}, {
+	ERRHRD, ERRgeneral, 0xc000028c}, {
+	ERRDOS, ERRnoaccess, 0xc000028d}, {
+	ERRDOS, ERRnoaccess, 0xc000028e}, {
+	ERRDOS, ERRnoaccess, 0xc000028f}, {
+	ERRDOS, ERRnoaccess, 0xc0000290}, {
+	ERRDOS, ERRbadfunc, 0xc000029c}, {
+	ERRDOS, ERRsymlink, NT_STATUS_STOPPED_ON_SYMLINK}, {
+	ERRDOS, ERRinvlevel, 0x007c0001}, };
+
+void
+ntstatus_to_dos(__le32 ntstatus, __u8 *eclass, __le16 *ecode)
+{
+	int i;
+
+	if (ntstatus == 0) {
+		*eclass = 0;
+		*ecode = 0;
+		return;
+	}
+	for (i = 0; ntstatus_to_dos_map[i].ntstatus; i++) {
+		if (le32_to_cpu(ntstatus) == ntstatus_to_dos_map[i].ntstatus) {
+			*eclass = ntstatus_to_dos_map[i].dos_class;
+			*ecode = cpu_to_le16(ntstatus_to_dos_map[i].dos_code);
+			return;
+		}
+	}
+	*eclass = ERRHRD;
+	*ecode = cpu_to_le16(ERRgeneral);
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./nterr.h linux-5.4.60-fbx/fs/cifsd/nterr.h
--- linux-5.4.60-fbx/fs/cifsd./nterr.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/nterr.h	2021-04-21 09:44:50.975171818 +0200
@@ -0,0 +1,545 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Unix SMB/Netbios implementation.
+ * Version 1.9.
+ * NT error code constants
+ * Copyright (C) Andrew Tridgell              1992-2000
+ * Copyright (C) John H Terpstra              1996-2000
+ * Copyright (C) Luke Kenneth Casson Leighton 1996-2000
+ * Copyright (C) Paul Ashton                  1998-2000
+ */
+
+
+
+#ifndef _NTERR_H
+#define _NTERR_H
+
+/* Win32 Status codes. */
+#define NT_STATUS_MORE_ENTRIES         0x0105
+#define NT_ERROR_INVALID_PARAMETER     0x0057
+#define NT_ERROR_INSUFFICIENT_BUFFER   0x007a
+#define NT_STATUS_1804                 0x070c
+#define NT_STATUS_NOTIFY_ENUM_DIR      0x010c
+#define NT_STATUS_INVALID_LOCK_RANGE   (0xC0000000 | 0x01a1)
+/*
+ * Win32 Error codes extracted using a loop in smbclient then printing a netmon
+ * sniff to a file.
+ */
+
+#define NT_STATUS_OK                   0x0000
+#define NT_STATUS_SOME_UNMAPPED        0x0107
+#define NT_STATUS_BUFFER_OVERFLOW  0x80000005
+#define NT_STATUS_NO_MORE_ENTRIES  0x8000001a
+#define NT_STATUS_MEDIA_CHANGED    0x8000001c
+#define NT_STATUS_END_OF_MEDIA     0x8000001e
+#define NT_STATUS_MEDIA_CHECK      0x80000020
+#define NT_STATUS_NO_DATA_DETECTED 0x8000001c
+#define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d
+#define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288
+#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000288
+#define NT_STATUS_UNSUCCESSFUL (0xC0000000 | 0x0001)
+#define NT_STATUS_NOT_IMPLEMENTED (0xC0000000 | 0x0002)
+#define NT_STATUS_INVALID_INFO_CLASS (0xC0000000 | 0x0003)
+#define NT_STATUS_INFO_LENGTH_MISMATCH (0xC0000000 | 0x0004)
+#define NT_STATUS_ACCESS_VIOLATION (0xC0000000 | 0x0005)
+#define NT_STATUS_IN_PAGE_ERROR (0xC0000000 | 0x0006)
+#define NT_STATUS_PAGEFILE_QUOTA (0xC0000000 | 0x0007)
+#define NT_STATUS_INVALID_HANDLE (0xC0000000 | 0x0008)
+#define NT_STATUS_BAD_INITIAL_STACK (0xC0000000 | 0x0009)
+#define NT_STATUS_BAD_INITIAL_PC (0xC0000000 | 0x000a)
+#define NT_STATUS_INVALID_CID (0xC0000000 | 0x000b)
+#define NT_STATUS_TIMER_NOT_CANCELED (0xC0000000 | 0x000c)
+#define NT_STATUS_INVALID_PARAMETER (0xC0000000 | 0x000d)
+#define NT_STATUS_NO_SUCH_DEVICE (0xC0000000 | 0x000e)
+#define NT_STATUS_NO_SUCH_FILE (0xC0000000 | 0x000f)
+#define NT_STATUS_INVALID_DEVICE_REQUEST (0xC0000000 | 0x0010)
+#define NT_STATUS_END_OF_FILE (0xC0000000 | 0x0011)
+#define NT_STATUS_WRONG_VOLUME (0xC0000000 | 0x0012)
+#define NT_STATUS_NO_MEDIA_IN_DEVICE (0xC0000000 | 0x0013)
+#define NT_STATUS_UNRECOGNIZED_MEDIA (0xC0000000 | 0x0014)
+#define NT_STATUS_NONEXISTENT_SECTOR (0xC0000000 | 0x0015)
+#define NT_STATUS_MORE_PROCESSING_REQUIRED (0xC0000000 | 0x0016)
+#define NT_STATUS_NO_MEMORY (0xC0000000 | 0x0017)
+#define NT_STATUS_CONFLICTING_ADDRESSES (0xC0000000 | 0x0018)
+#define NT_STATUS_NOT_MAPPED_VIEW (0xC0000000 | 0x0019)
+#define NT_STATUS_UNABLE_TO_FREE_VM (0x80000000 | 0x001a)
+#define NT_STATUS_UNABLE_TO_DELETE_SECTION (0xC0000000 | 0x001b)
+#define NT_STATUS_INVALID_SYSTEM_SERVICE (0xC0000000 | 0x001c)
+#define NT_STATUS_ILLEGAL_INSTRUCTION (0xC0000000 | 0x001d)
+#define NT_STATUS_INVALID_LOCK_SEQUENCE (0xC0000000 | 0x001e)
+#define NT_STATUS_INVALID_VIEW_SIZE (0xC0000000 | 0x001f)
+#define NT_STATUS_INVALID_FILE_FOR_SECTION (0xC0000000 | 0x0020)
+#define NT_STATUS_ALREADY_COMMITTED (0xC0000000 | 0x0021)
+#define NT_STATUS_ACCESS_DENIED (0xC0000000 | 0x0022)
+#define NT_STATUS_BUFFER_TOO_SMALL (0xC0000000 | 0x0023)
+#define NT_STATUS_OBJECT_TYPE_MISMATCH (0xC0000000 | 0x0024)
+#define NT_STATUS_NONCONTINUABLE_EXCEPTION (0xC0000000 | 0x0025)
+#define NT_STATUS_INVALID_DISPOSITION (0xC0000000 | 0x0026)
+#define NT_STATUS_UNWIND (0xC0000000 | 0x0027)
+#define NT_STATUS_BAD_STACK (0xC0000000 | 0x0028)
+#define NT_STATUS_INVALID_UNWIND_TARGET (0xC0000000 | 0x0029)
+#define NT_STATUS_NOT_LOCKED (0xC0000000 | 0x002a)
+#define NT_STATUS_PARITY_ERROR (0xC0000000 | 0x002b)
+#define NT_STATUS_UNABLE_TO_DECOMMIT_VM (0xC0000000 | 0x002c)
+#define NT_STATUS_NOT_COMMITTED (0xC0000000 | 0x002d)
+#define NT_STATUS_INVALID_PORT_ATTRIBUTES (0xC0000000 | 0x002e)
+#define NT_STATUS_PORT_MESSAGE_TOO_LONG (0xC0000000 | 0x002f)
+#define NT_STATUS_INVALID_PARAMETER_MIX (0xC0000000 | 0x0030)
+#define NT_STATUS_INVALID_QUOTA_LOWER (0xC0000000 | 0x0031)
+#define NT_STATUS_DISK_CORRUPT_ERROR (0xC0000000 | 0x0032)
+#define NT_STATUS_OBJECT_NAME_INVALID (0xC0000000 | 0x0033)
+#define NT_STATUS_OBJECT_NAME_NOT_FOUND (0xC0000000 | 0x0034)
+#define NT_STATUS_OBJECT_NAME_COLLISION (0xC0000000 | 0x0035)
+#define NT_STATUS_HANDLE_NOT_WAITABLE (0xC0000000 | 0x0036)
+#define NT_STATUS_PORT_DISCONNECTED (0xC0000000 | 0x0037)
+#define NT_STATUS_DEVICE_ALREADY_ATTACHED (0xC0000000 | 0x0038)
+#define NT_STATUS_OBJECT_PATH_INVALID (0xC0000000 | 0x0039)
+#define NT_STATUS_OBJECT_PATH_NOT_FOUND (0xC0000000 | 0x003a)
+#define NT_STATUS_OBJECT_PATH_SYNTAX_BAD (0xC0000000 | 0x003b)
+#define NT_STATUS_DATA_OVERRUN (0xC0000000 | 0x003c)
+#define NT_STATUS_DATA_LATE_ERROR (0xC0000000 | 0x003d)
+#define NT_STATUS_DATA_ERROR (0xC0000000 | 0x003e)
+#define NT_STATUS_CRC_ERROR (0xC0000000 | 0x003f)
+#define NT_STATUS_SECTION_TOO_BIG (0xC0000000 | 0x0040)
+#define NT_STATUS_PORT_CONNECTION_REFUSED (0xC0000000 | 0x0041)
+#define NT_STATUS_INVALID_PORT_HANDLE (0xC0000000 | 0x0042)
+#define NT_STATUS_SHARING_VIOLATION (0xC0000000 | 0x0043)
+#define NT_STATUS_QUOTA_EXCEEDED (0xC0000000 | 0x0044)
+#define NT_STATUS_INVALID_PAGE_PROTECTION (0xC0000000 | 0x0045)
+#define NT_STATUS_MUTANT_NOT_OWNED (0xC0000000 | 0x0046)
+#define NT_STATUS_SEMAPHORE_LIMIT_EXCEEDED (0xC0000000 | 0x0047)
+#define NT_STATUS_PORT_ALREADY_SET (0xC0000000 | 0x0048)
+#define NT_STATUS_SECTION_NOT_IMAGE (0xC0000000 | 0x0049)
+#define NT_STATUS_SUSPEND_COUNT_EXCEEDED (0xC0000000 | 0x004a)
+#define NT_STATUS_THREAD_IS_TERMINATING (0xC0000000 | 0x004b)
+#define NT_STATUS_BAD_WORKING_SET_LIMIT (0xC0000000 | 0x004c)
+#define NT_STATUS_INCOMPATIBLE_FILE_MAP (0xC0000000 | 0x004d)
+#define NT_STATUS_SECTION_PROTECTION (0xC0000000 | 0x004e)
+#define NT_STATUS_EAS_NOT_SUPPORTED (0xC0000000 | 0x004f)
+#define NT_STATUS_EA_TOO_LARGE (0xC0000000 | 0x0050)
+#define NT_STATUS_NONEXISTENT_EA_ENTRY (0xC0000000 | 0x0051)
+#define NT_STATUS_NO_EAS_ON_FILE (0xC0000000 | 0x0052)
+#define NT_STATUS_EA_CORRUPT_ERROR (0xC0000000 | 0x0053)
+#define NT_STATUS_FILE_LOCK_CONFLICT (0xC0000000 | 0x0054)
+#define NT_STATUS_LOCK_NOT_GRANTED (0xC0000000 | 0x0055)
+#define NT_STATUS_DELETE_PENDING (0xC0000000 | 0x0056)
+#define NT_STATUS_CTL_FILE_NOT_SUPPORTED (0xC0000000 | 0x0057)
+#define NT_STATUS_UNKNOWN_REVISION (0xC0000000 | 0x0058)
+#define NT_STATUS_REVISION_MISMATCH (0xC0000000 | 0x0059)
+#define NT_STATUS_INVALID_OWNER (0xC0000000 | 0x005a)
+#define NT_STATUS_INVALID_PRIMARY_GROUP (0xC0000000 | 0x005b)
+#define NT_STATUS_NO_IMPERSONATION_TOKEN (0xC0000000 | 0x005c)
+#define NT_STATUS_CANT_DISABLE_MANDATORY (0xC0000000 | 0x005d)
+#define NT_STATUS_NO_LOGON_SERVERS (0xC0000000 | 0x005e)
+#define NT_STATUS_NO_SUCH_LOGON_SESSION (0xC0000000 | 0x005f)
+#define NT_STATUS_NO_SUCH_PRIVILEGE (0xC0000000 | 0x0060)
+#define NT_STATUS_PRIVILEGE_NOT_HELD (0xC0000000 | 0x0061)
+#define NT_STATUS_INVALID_ACCOUNT_NAME (0xC0000000 | 0x0062)
+#define NT_STATUS_USER_EXISTS (0xC0000000 | 0x0063)
+#define NT_STATUS_NO_SUCH_USER (0xC0000000 | 0x0064)
+#define NT_STATUS_GROUP_EXISTS (0xC0000000 | 0x0065)
+#define NT_STATUS_NO_SUCH_GROUP (0xC0000000 | 0x0066)
+#define NT_STATUS_MEMBER_IN_GROUP (0xC0000000 | 0x0067)
+#define NT_STATUS_MEMBER_NOT_IN_GROUP (0xC0000000 | 0x0068)
+#define NT_STATUS_LAST_ADMIN (0xC0000000 | 0x0069)
+#define NT_STATUS_WRONG_PASSWORD (0xC0000000 | 0x006a)
+#define NT_STATUS_ILL_FORMED_PASSWORD (0xC0000000 | 0x006b)
+#define NT_STATUS_PASSWORD_RESTRICTION (0xC0000000 | 0x006c)
+#define NT_STATUS_LOGON_FAILURE (0xC0000000 | 0x006d)
+#define NT_STATUS_ACCOUNT_RESTRICTION (0xC0000000 | 0x006e)
+#define NT_STATUS_INVALID_LOGON_HOURS (0xC0000000 | 0x006f)
+#define NT_STATUS_INVALID_WORKSTATION (0xC0000000 | 0x0070)
+#define NT_STATUS_PASSWORD_EXPIRED (0xC0000000 | 0x0071)
+#define NT_STATUS_ACCOUNT_DISABLED (0xC0000000 | 0x0072)
+#define NT_STATUS_NONE_MAPPED (0xC0000000 | 0x0073)
+#define NT_STATUS_TOO_MANY_LUIDS_REQUESTED (0xC0000000 | 0x0074)
+#define NT_STATUS_LUIDS_EXHAUSTED (0xC0000000 | 0x0075)
+#define NT_STATUS_INVALID_SUB_AUTHORITY (0xC0000000 | 0x0076)
+#define NT_STATUS_INVALID_ACL (0xC0000000 | 0x0077)
+#define NT_STATUS_INVALID_SID (0xC0000000 | 0x0078)
+#define NT_STATUS_INVALID_SECURITY_DESCR (0xC0000000 | 0x0079)
+#define NT_STATUS_PROCEDURE_NOT_FOUND (0xC0000000 | 0x007a)
+#define NT_STATUS_INVALID_IMAGE_FORMAT (0xC0000000 | 0x007b)
+#define NT_STATUS_NO_TOKEN (0xC0000000 | 0x007c)
+#define NT_STATUS_BAD_INHERITANCE_ACL (0xC0000000 | 0x007d)
+#define NT_STATUS_RANGE_NOT_LOCKED (0xC0000000 | 0x007e)
+#define NT_STATUS_DISK_FULL (0xC0000000 | 0x007f)
+#define NT_STATUS_SERVER_DISABLED (0xC0000000 | 0x0080)
+#define NT_STATUS_SERVER_NOT_DISABLED (0xC0000000 | 0x0081)
+#define NT_STATUS_TOO_MANY_GUIDS_REQUESTED (0xC0000000 | 0x0082)
+#define NT_STATUS_GUIDS_EXHAUSTED (0xC0000000 | 0x0083)
+#define NT_STATUS_INVALID_ID_AUTHORITY (0xC0000000 | 0x0084)
+#define NT_STATUS_AGENTS_EXHAUSTED (0xC0000000 | 0x0085)
+#define NT_STATUS_INVALID_VOLUME_LABEL (0xC0000000 | 0x0086)
+#define NT_STATUS_SECTION_NOT_EXTENDED (0xC0000000 | 0x0087)
+#define NT_STATUS_NOT_MAPPED_DATA (0xC0000000 | 0x0088)
+#define NT_STATUS_RESOURCE_DATA_NOT_FOUND (0xC0000000 | 0x0089)
+#define NT_STATUS_RESOURCE_TYPE_NOT_FOUND (0xC0000000 | 0x008a)
+#define NT_STATUS_RESOURCE_NAME_NOT_FOUND (0xC0000000 | 0x008b)
+#define NT_STATUS_ARRAY_BOUNDS_EXCEEDED (0xC0000000 | 0x008c)
+#define NT_STATUS_FLOAT_DENORMAL_OPERAND (0xC0000000 | 0x008d)
+#define NT_STATUS_FLOAT_DIVIDE_BY_ZERO (0xC0000000 | 0x008e)
+#define NT_STATUS_FLOAT_INEXACT_RESULT (0xC0000000 | 0x008f)
+#define NT_STATUS_FLOAT_INVALID_OPERATION (0xC0000000 | 0x0090)
+#define NT_STATUS_FLOAT_OVERFLOW (0xC0000000 | 0x0091)
+#define NT_STATUS_FLOAT_STACK_CHECK (0xC0000000 | 0x0092)
+#define NT_STATUS_FLOAT_UNDERFLOW (0xC0000000 | 0x0093)
+#define NT_STATUS_INTEGER_DIVIDE_BY_ZERO (0xC0000000 | 0x0094)
+#define NT_STATUS_INTEGER_OVERFLOW (0xC0000000 | 0x0095)
+#define NT_STATUS_PRIVILEGED_INSTRUCTION (0xC0000000 | 0x0096)
+#define NT_STATUS_TOO_MANY_PAGING_FILES (0xC0000000 | 0x0097)
+#define NT_STATUS_FILE_INVALID (0xC0000000 | 0x0098)
+#define NT_STATUS_ALLOTTED_SPACE_EXCEEDED (0xC0000000 | 0x0099)
+#define NT_STATUS_INSUFFICIENT_RESOURCES (0xC0000000 | 0x009a)
+#define NT_STATUS_DFS_EXIT_PATH_FOUND (0xC0000000 | 0x009b)
+#define NT_STATUS_DEVICE_DATA_ERROR (0xC0000000 | 0x009c)
+#define NT_STATUS_DEVICE_NOT_CONNECTED (0xC0000000 | 0x009d)
+#define NT_STATUS_DEVICE_POWER_FAILURE (0xC0000000 | 0x009e)
+#define NT_STATUS_FREE_VM_NOT_AT_BASE (0xC0000000 | 0x009f)
+#define NT_STATUS_MEMORY_NOT_ALLOCATED (0xC0000000 | 0x00a0)
+#define NT_STATUS_WORKING_SET_QUOTA (0xC0000000 | 0x00a1)
+#define NT_STATUS_MEDIA_WRITE_PROTECTED (0xC0000000 | 0x00a2)
+#define NT_STATUS_DEVICE_NOT_READY (0xC0000000 | 0x00a3)
+#define NT_STATUS_INVALID_GROUP_ATTRIBUTES (0xC0000000 | 0x00a4)
+#define NT_STATUS_BAD_IMPERSONATION_LEVEL (0xC0000000 | 0x00a5)
+#define NT_STATUS_CANT_OPEN_ANONYMOUS (0xC0000000 | 0x00a6)
+#define NT_STATUS_BAD_VALIDATION_CLASS (0xC0000000 | 0x00a7)
+#define NT_STATUS_BAD_TOKEN_TYPE (0xC0000000 | 0x00a8)
+#define NT_STATUS_BAD_MASTER_BOOT_RECORD (0xC0000000 | 0x00a9)
+#define NT_STATUS_INSTRUCTION_MISALIGNMENT (0xC0000000 | 0x00aa)
+#define NT_STATUS_INSTANCE_NOT_AVAILABLE (0xC0000000 | 0x00ab)
+#define NT_STATUS_PIPE_NOT_AVAILABLE (0xC0000000 | 0x00ac)
+#define NT_STATUS_INVALID_PIPE_STATE (0xC0000000 | 0x00ad)
+#define NT_STATUS_PIPE_BUSY (0xC0000000 | 0x00ae)
+#define NT_STATUS_ILLEGAL_FUNCTION (0xC0000000 | 0x00af)
+#define NT_STATUS_PIPE_DISCONNECTED (0xC0000000 | 0x00b0)
+#define NT_STATUS_PIPE_CLOSING (0xC0000000 | 0x00b1)
+#define NT_STATUS_PIPE_CONNECTED (0xC0000000 | 0x00b2)
+#define NT_STATUS_PIPE_LISTENING (0xC0000000 | 0x00b3)
+#define NT_STATUS_INVALID_READ_MODE (0xC0000000 | 0x00b4)
+#define NT_STATUS_IO_TIMEOUT (0xC0000000 | 0x00b5)
+#define NT_STATUS_FILE_FORCED_CLOSED (0xC0000000 | 0x00b6)
+#define NT_STATUS_PROFILING_NOT_STARTED (0xC0000000 | 0x00b7)
+#define NT_STATUS_PROFILING_NOT_STOPPED (0xC0000000 | 0x00b8)
+#define NT_STATUS_COULD_NOT_INTERPRET (0xC0000000 | 0x00b9)
+#define NT_STATUS_FILE_IS_A_DIRECTORY (0xC0000000 | 0x00ba)
+#define NT_STATUS_NOT_SUPPORTED (0xC0000000 | 0x00bb)
+#define NT_STATUS_REMOTE_NOT_LISTENING (0xC0000000 | 0x00bc)
+#define NT_STATUS_DUPLICATE_NAME (0xC0000000 | 0x00bd)
+#define NT_STATUS_BAD_NETWORK_PATH (0xC0000000 | 0x00be)
+#define NT_STATUS_NETWORK_BUSY (0xC0000000 | 0x00bf)
+#define NT_STATUS_DEVICE_DOES_NOT_EXIST (0xC0000000 | 0x00c0)
+#define NT_STATUS_TOO_MANY_COMMANDS (0xC0000000 | 0x00c1)
+#define NT_STATUS_ADAPTER_HARDWARE_ERROR (0xC0000000 | 0x00c2)
+#define NT_STATUS_INVALID_NETWORK_RESPONSE (0xC0000000 | 0x00c3)
+#define NT_STATUS_UNEXPECTED_NETWORK_ERROR (0xC0000000 | 0x00c4)
+#define NT_STATUS_BAD_REMOTE_ADAPTER (0xC0000000 | 0x00c5)
+#define NT_STATUS_PRINT_QUEUE_FULL (0xC0000000 | 0x00c6)
+#define NT_STATUS_NO_SPOOL_SPACE (0xC0000000 | 0x00c7)
+#define NT_STATUS_PRINT_CANCELLED (0xC0000000 | 0x00c8)
+#define NT_STATUS_NETWORK_NAME_DELETED (0xC0000000 | 0x00c9)
+#define NT_STATUS_NETWORK_ACCESS_DENIED (0xC0000000 | 0x00ca)
+#define NT_STATUS_BAD_DEVICE_TYPE (0xC0000000 | 0x00cb)
+#define NT_STATUS_BAD_NETWORK_NAME (0xC0000000 | 0x00cc)
+#define NT_STATUS_TOO_MANY_NAMES (0xC0000000 | 0x00cd)
+#define NT_STATUS_TOO_MANY_SESSIONS (0xC0000000 | 0x00ce)
+#define NT_STATUS_SHARING_PAUSED (0xC0000000 | 0x00cf)
+#define NT_STATUS_REQUEST_NOT_ACCEPTED (0xC0000000 | 0x00d0)
+#define NT_STATUS_REDIRECTOR_PAUSED (0xC0000000 | 0x00d1)
+#define NT_STATUS_NET_WRITE_FAULT (0xC0000000 | 0x00d2)
+#define NT_STATUS_PROFILING_AT_LIMIT (0xC0000000 | 0x00d3)
+#define NT_STATUS_NOT_SAME_DEVICE (0xC0000000 | 0x00d4)
+#define NT_STATUS_FILE_RENAMED (0xC0000000 | 0x00d5)
+#define NT_STATUS_VIRTUAL_CIRCUIT_CLOSED (0xC0000000 | 0x00d6)
+#define NT_STATUS_NO_SECURITY_ON_OBJECT (0xC0000000 | 0x00d7)
+#define NT_STATUS_CANT_WAIT (0xC0000000 | 0x00d8)
+#define NT_STATUS_PIPE_EMPTY (0xC0000000 | 0x00d9)
+#define NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xC0000000 | 0x00da)
+#define NT_STATUS_CANT_TERMINATE_SELF (0xC0000000 | 0x00db)
+#define NT_STATUS_INVALID_SERVER_STATE (0xC0000000 | 0x00dc)
+#define NT_STATUS_INVALID_DOMAIN_STATE (0xC0000000 | 0x00dd)
+#define NT_STATUS_INVALID_DOMAIN_ROLE (0xC0000000 | 0x00de)
+#define NT_STATUS_NO_SUCH_DOMAIN (0xC0000000 | 0x00df)
+#define NT_STATUS_DOMAIN_EXISTS (0xC0000000 | 0x00e0)
+#define NT_STATUS_DOMAIN_LIMIT_EXCEEDED (0xC0000000 | 0x00e1)
+#define NT_STATUS_OPLOCK_NOT_GRANTED (0xC0000000 | 0x00e2)
+#define NT_STATUS_INVALID_OPLOCK_PROTOCOL (0xC0000000 | 0x00e3)
+#define NT_STATUS_INTERNAL_DB_CORRUPTION (0xC0000000 | 0x00e4)
+#define NT_STATUS_INTERNAL_ERROR (0xC0000000 | 0x00e5)
+#define NT_STATUS_GENERIC_NOT_MAPPED (0xC0000000 | 0x00e6)
+#define NT_STATUS_BAD_DESCRIPTOR_FORMAT (0xC0000000 | 0x00e7)
+#define NT_STATUS_INVALID_USER_BUFFER (0xC0000000 | 0x00e8)
+#define NT_STATUS_UNEXPECTED_IO_ERROR (0xC0000000 | 0x00e9)
+#define NT_STATUS_UNEXPECTED_MM_CREATE_ERR (0xC0000000 | 0x00ea)
+#define NT_STATUS_UNEXPECTED_MM_MAP_ERROR (0xC0000000 | 0x00eb)
+#define NT_STATUS_UNEXPECTED_MM_EXTEND_ERR (0xC0000000 | 0x00ec)
+#define NT_STATUS_NOT_LOGON_PROCESS (0xC0000000 | 0x00ed)
+#define NT_STATUS_LOGON_SESSION_EXISTS (0xC0000000 | 0x00ee)
+#define NT_STATUS_INVALID_PARAMETER_1 (0xC0000000 | 0x00ef)
+#define NT_STATUS_INVALID_PARAMETER_2 (0xC0000000 | 0x00f0)
+#define NT_STATUS_INVALID_PARAMETER_3 (0xC0000000 | 0x00f1)
+#define NT_STATUS_INVALID_PARAMETER_4 (0xC0000000 | 0x00f2)
+#define NT_STATUS_INVALID_PARAMETER_5 (0xC0000000 | 0x00f3)
+#define NT_STATUS_INVALID_PARAMETER_6 (0xC0000000 | 0x00f4)
+#define NT_STATUS_INVALID_PARAMETER_7 (0xC0000000 | 0x00f5)
+#define NT_STATUS_INVALID_PARAMETER_8 (0xC0000000 | 0x00f6)
+#define NT_STATUS_INVALID_PARAMETER_9 (0xC0000000 | 0x00f7)
+#define NT_STATUS_INVALID_PARAMETER_10 (0xC0000000 | 0x00f8)
+#define NT_STATUS_INVALID_PARAMETER_11 (0xC0000000 | 0x00f9)
+#define NT_STATUS_INVALID_PARAMETER_12 (0xC0000000 | 0x00fa)
+#define NT_STATUS_REDIRECTOR_NOT_STARTED (0xC0000000 | 0x00fb)
+#define NT_STATUS_REDIRECTOR_STARTED (0xC0000000 | 0x00fc)
+#define NT_STATUS_STACK_OVERFLOW (0xC0000000 | 0x00fd)
+#define NT_STATUS_NO_SUCH_PACKAGE (0xC0000000 | 0x00fe)
+#define NT_STATUS_BAD_FUNCTION_TABLE (0xC0000000 | 0x00ff)
+#define NT_STATUS_DIRECTORY_NOT_EMPTY (0xC0000000 | 0x0101)
+#define NT_STATUS_FILE_CORRUPT_ERROR (0xC0000000 | 0x0102)
+#define NT_STATUS_NOT_A_DIRECTORY (0xC0000000 | 0x0103)
+#define NT_STATUS_BAD_LOGON_SESSION_STATE (0xC0000000 | 0x0104)
+#define NT_STATUS_LOGON_SESSION_COLLISION (0xC0000000 | 0x0105)
+#define NT_STATUS_NAME_TOO_LONG (0xC0000000 | 0x0106)
+#define NT_STATUS_FILES_OPEN (0xC0000000 | 0x0107)
+#define NT_STATUS_CONNECTION_IN_USE (0xC0000000 | 0x0108)
+#define NT_STATUS_MESSAGE_NOT_FOUND (0xC0000000 | 0x0109)
+#define NT_STATUS_PROCESS_IS_TERMINATING (0xC0000000 | 0x010a)
+#define NT_STATUS_INVALID_LOGON_TYPE (0xC0000000 | 0x010b)
+#define NT_STATUS_NO_GUID_TRANSLATION (0xC0000000 | 0x010c)
+#define NT_STATUS_CANNOT_IMPERSONATE (0xC0000000 | 0x010d)
+#define NT_STATUS_IMAGE_ALREADY_LOADED (0xC0000000 | 0x010e)
+#define NT_STATUS_ABIOS_NOT_PRESENT (0xC0000000 | 0x010f)
+#define NT_STATUS_ABIOS_LID_NOT_EXIST (0xC0000000 | 0x0110)
+#define NT_STATUS_ABIOS_LID_ALREADY_OWNED (0xC0000000 | 0x0111)
+#define NT_STATUS_ABIOS_NOT_LID_OWNER (0xC0000000 | 0x0112)
+#define NT_STATUS_ABIOS_INVALID_COMMAND (0xC0000000 | 0x0113)
+#define NT_STATUS_ABIOS_INVALID_LID (0xC0000000 | 0x0114)
+#define NT_STATUS_ABIOS_SELECTOR_NOT_AVAILABLE (0xC0000000 | 0x0115)
+#define NT_STATUS_ABIOS_INVALID_SELECTOR (0xC0000000 | 0x0116)
+#define NT_STATUS_NO_LDT (0xC0000000 | 0x0117)
+#define NT_STATUS_INVALID_LDT_SIZE (0xC0000000 | 0x0118)
+#define NT_STATUS_INVALID_LDT_OFFSET (0xC0000000 | 0x0119)
+#define NT_STATUS_INVALID_LDT_DESCRIPTOR (0xC0000000 | 0x011a)
+#define NT_STATUS_INVALID_IMAGE_NE_FORMAT (0xC0000000 | 0x011b)
+#define NT_STATUS_RXACT_INVALID_STATE (0xC0000000 | 0x011c)
+#define NT_STATUS_RXACT_COMMIT_FAILURE (0xC0000000 | 0x011d)
+#define NT_STATUS_MAPPED_FILE_SIZE_ZERO (0xC0000000 | 0x011e)
+#define NT_STATUS_TOO_MANY_OPENED_FILES (0xC0000000 | 0x011f)
+#define NT_STATUS_CANCELLED (0xC0000000 | 0x0120)
+#define NT_STATUS_CANNOT_DELETE (0xC0000000 | 0x0121)
+#define NT_STATUS_INVALID_COMPUTER_NAME (0xC0000000 | 0x0122)
+#define NT_STATUS_FILE_DELETED (0xC0000000 | 0x0123)
+#define NT_STATUS_SPECIAL_ACCOUNT (0xC0000000 | 0x0124)
+#define NT_STATUS_SPECIAL_GROUP (0xC0000000 | 0x0125)
+#define NT_STATUS_SPECIAL_USER (0xC0000000 | 0x0126)
+#define NT_STATUS_MEMBERS_PRIMARY_GROUP (0xC0000000 | 0x0127)
+#define NT_STATUS_FILE_CLOSED (0xC0000000 | 0x0128)
+#define NT_STATUS_TOO_MANY_THREADS (0xC0000000 | 0x0129)
+#define NT_STATUS_THREAD_NOT_IN_PROCESS (0xC0000000 | 0x012a)
+#define NT_STATUS_TOKEN_ALREADY_IN_USE (0xC0000000 | 0x012b)
+#define NT_STATUS_PAGEFILE_QUOTA_EXCEEDED (0xC0000000 | 0x012c)
+#define NT_STATUS_COMMITMENT_LIMIT (0xC0000000 | 0x012d)
+#define NT_STATUS_INVALID_IMAGE_LE_FORMAT (0xC0000000 | 0x012e)
+#define NT_STATUS_INVALID_IMAGE_NOT_MZ (0xC0000000 | 0x012f)
+#define NT_STATUS_INVALID_IMAGE_PROTECT (0xC0000000 | 0x0130)
+#define NT_STATUS_INVALID_IMAGE_WIN_16 (0xC0000000 | 0x0131)
+#define NT_STATUS_LOGON_SERVER_CONFLICT (0xC0000000 | 0x0132)
+#define NT_STATUS_TIME_DIFFERENCE_AT_DC (0xC0000000 | 0x0133)
+#define NT_STATUS_SYNCHRONIZATION_REQUIRED (0xC0000000 | 0x0134)
+#define NT_STATUS_DLL_NOT_FOUND (0xC0000000 | 0x0135)
+#define NT_STATUS_OPEN_FAILED (0xC0000000 | 0x0136)
+#define NT_STATUS_IO_PRIVILEGE_FAILED (0xC0000000 | 0x0137)
+#define NT_STATUS_ORDINAL_NOT_FOUND (0xC0000000 | 0x0138)
+#define NT_STATUS_ENTRYPOINT_NOT_FOUND (0xC0000000 | 0x0139)
+#define NT_STATUS_CONTROL_C_EXIT (0xC0000000 | 0x013a)
+#define NT_STATUS_LOCAL_DISCONNECT (0xC0000000 | 0x013b)
+#define NT_STATUS_REMOTE_DISCONNECT (0xC0000000 | 0x013c)
+#define NT_STATUS_REMOTE_RESOURCES (0xC0000000 | 0x013d)
+#define NT_STATUS_LINK_FAILED (0xC0000000 | 0x013e)
+#define NT_STATUS_LINK_TIMEOUT (0xC0000000 | 0x013f)
+#define NT_STATUS_INVALID_CONNECTION (0xC0000000 | 0x0140)
+#define NT_STATUS_INVALID_ADDRESS (0xC0000000 | 0x0141)
+#define NT_STATUS_DLL_INIT_FAILED (0xC0000000 | 0x0142)
+#define NT_STATUS_MISSING_SYSTEMFILE (0xC0000000 | 0x0143)
+#define NT_STATUS_UNHANDLED_EXCEPTION (0xC0000000 | 0x0144)
+#define NT_STATUS_APP_INIT_FAILURE (0xC0000000 | 0x0145)
+#define NT_STATUS_PAGEFILE_CREATE_FAILED (0xC0000000 | 0x0146)
+#define NT_STATUS_NO_PAGEFILE (0xC0000000 | 0x0147)
+#define NT_STATUS_INVALID_LEVEL (0xC0000000 | 0x0148)
+#define NT_STATUS_WRONG_PASSWORD_CORE (0xC0000000 | 0x0149)
+#define NT_STATUS_ILLEGAL_FLOAT_CONTEXT (0xC0000000 | 0x014a)
+#define NT_STATUS_PIPE_BROKEN (0xC0000000 | 0x014b)
+#define NT_STATUS_REGISTRY_CORRUPT (0xC0000000 | 0x014c)
+#define NT_STATUS_REGISTRY_IO_FAILED (0xC0000000 | 0x014d)
+#define NT_STATUS_NO_EVENT_PAIR (0xC0000000 | 0x014e)
+#define NT_STATUS_UNRECOGNIZED_VOLUME (0xC0000000 | 0x014f)
+#define NT_STATUS_SERIAL_NO_DEVICE_INITED (0xC0000000 | 0x0150)
+#define NT_STATUS_NO_SUCH_ALIAS (0xC0000000 | 0x0151)
+#define NT_STATUS_MEMBER_NOT_IN_ALIAS (0xC0000000 | 0x0152)
+#define NT_STATUS_MEMBER_IN_ALIAS (0xC0000000 | 0x0153)
+#define NT_STATUS_ALIAS_EXISTS (0xC0000000 | 0x0154)
+#define NT_STATUS_LOGON_NOT_GRANTED (0xC0000000 | 0x0155)
+#define NT_STATUS_TOO_MANY_SECRETS (0xC0000000 | 0x0156)
+#define NT_STATUS_SECRET_TOO_LONG (0xC0000000 | 0x0157)
+#define NT_STATUS_INTERNAL_DB_ERROR (0xC0000000 | 0x0158)
+#define NT_STATUS_FULLSCREEN_MODE (0xC0000000 | 0x0159)
+#define NT_STATUS_TOO_MANY_CONTEXT_IDS (0xC0000000 | 0x015a)
+#define NT_STATUS_LOGON_TYPE_NOT_GRANTED (0xC0000000 | 0x015b)
+#define NT_STATUS_NOT_REGISTRY_FILE (0xC0000000 | 0x015c)
+#define NT_STATUS_NT_CROSS_ENCRYPTION_REQUIRED (0xC0000000 | 0x015d)
+#define NT_STATUS_DOMAIN_CTRLR_CONFIG_ERROR (0xC0000000 | 0x015e)
+#define NT_STATUS_FT_MISSING_MEMBER (0xC0000000 | 0x015f)
+#define NT_STATUS_ILL_FORMED_SERVICE_ENTRY (0xC0000000 | 0x0160)
+#define NT_STATUS_ILLEGAL_CHARACTER (0xC0000000 | 0x0161)
+#define NT_STATUS_UNMAPPABLE_CHARACTER (0xC0000000 | 0x0162)
+#define NT_STATUS_UNDEFINED_CHARACTER (0xC0000000 | 0x0163)
+#define NT_STATUS_FLOPPY_VOLUME (0xC0000000 | 0x0164)
+#define NT_STATUS_FLOPPY_ID_MARK_NOT_FOUND (0xC0000000 | 0x0165)
+#define NT_STATUS_FLOPPY_WRONG_CYLINDER (0xC0000000 | 0x0166)
+#define NT_STATUS_FLOPPY_UNKNOWN_ERROR (0xC0000000 | 0x0167)
+#define NT_STATUS_FLOPPY_BAD_REGISTERS (0xC0000000 | 0x0168)
+#define NT_STATUS_DISK_RECALIBRATE_FAILED (0xC0000000 | 0x0169)
+#define NT_STATUS_DISK_OPERATION_FAILED (0xC0000000 | 0x016a)
+#define NT_STATUS_DISK_RESET_FAILED (0xC0000000 | 0x016b)
+#define NT_STATUS_SHARED_IRQ_BUSY (0xC0000000 | 0x016c)
+#define NT_STATUS_FT_ORPHANING (0xC0000000 | 0x016d)
+#define NT_STATUS_PARTITION_FAILURE (0xC0000000 | 0x0172)
+#define NT_STATUS_INVALID_BLOCK_LENGTH (0xC0000000 | 0x0173)
+#define NT_STATUS_DEVICE_NOT_PARTITIONED (0xC0000000 | 0x0174)
+#define NT_STATUS_UNABLE_TO_LOCK_MEDIA (0xC0000000 | 0x0175)
+#define NT_STATUS_UNABLE_TO_UNLOAD_MEDIA (0xC0000000 | 0x0176)
+#define NT_STATUS_EOM_OVERFLOW (0xC0000000 | 0x0177)
+#define NT_STATUS_NO_MEDIA (0xC0000000 | 0x0178)
+#define NT_STATUS_NO_SUCH_MEMBER (0xC0000000 | 0x017a)
+#define NT_STATUS_INVALID_MEMBER (0xC0000000 | 0x017b)
+#define NT_STATUS_KEY_DELETED (0xC0000000 | 0x017c)
+#define NT_STATUS_NO_LOG_SPACE (0xC0000000 | 0x017d)
+#define NT_STATUS_TOO_MANY_SIDS (0xC0000000 | 0x017e)
+#define NT_STATUS_LM_CROSS_ENCRYPTION_REQUIRED (0xC0000000 | 0x017f)
+#define NT_STATUS_KEY_HAS_CHILDREN (0xC0000000 | 0x0180)
+#define NT_STATUS_CHILD_MUST_BE_VOLATILE (0xC0000000 | 0x0181)
+#define NT_STATUS_DEVICE_CONFIGURATION_ERROR (0xC0000000 | 0x0182)
+#define NT_STATUS_DRIVER_INTERNAL_ERROR (0xC0000000 | 0x0183)
+#define NT_STATUS_INVALID_DEVICE_STATE (0xC0000000 | 0x0184)
+#define NT_STATUS_IO_DEVICE_ERROR (0xC0000000 | 0x0185)
+#define NT_STATUS_DEVICE_PROTOCOL_ERROR (0xC0000000 | 0x0186)
+#define NT_STATUS_BACKUP_CONTROLLER (0xC0000000 | 0x0187)
+#define NT_STATUS_LOG_FILE_FULL (0xC0000000 | 0x0188)
+#define NT_STATUS_TOO_LATE (0xC0000000 | 0x0189)
+#define NT_STATUS_NO_TRUST_LSA_SECRET (0xC0000000 | 0x018a)
+#define NT_STATUS_NO_TRUST_SAM_ACCOUNT (0xC0000000 | 0x018b)
+#define NT_STATUS_TRUSTED_DOMAIN_FAILURE (0xC0000000 | 0x018c)
+#define NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE (0xC0000000 | 0x018d)
+#define NT_STATUS_EVENTLOG_FILE_CORRUPT (0xC0000000 | 0x018e)
+#define NT_STATUS_EVENTLOG_CANT_START (0xC0000000 | 0x018f)
+#define NT_STATUS_TRUST_FAILURE (0xC0000000 | 0x0190)
+#define NT_STATUS_MUTANT_LIMIT_EXCEEDED (0xC0000000 | 0x0191)
+#define NT_STATUS_NETLOGON_NOT_STARTED (0xC0000000 | 0x0192)
+#define NT_STATUS_ACCOUNT_EXPIRED (0xC0000000 | 0x0193)
+#define NT_STATUS_POSSIBLE_DEADLOCK (0xC0000000 | 0x0194)
+#define NT_STATUS_NETWORK_CREDENTIAL_CONFLICT (0xC0000000 | 0x0195)
+#define NT_STATUS_REMOTE_SESSION_LIMIT (0xC0000000 | 0x0196)
+#define NT_STATUS_EVENTLOG_FILE_CHANGED (0xC0000000 | 0x0197)
+#define NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT (0xC0000000 | 0x0198)
+#define NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT (0xC0000000 | 0x0199)
+#define NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT (0xC0000000 | 0x019a)
+#define NT_STATUS_DOMAIN_TRUST_INCONSISTENT (0xC0000000 | 0x019b)
+#define NT_STATUS_FS_DRIVER_REQUIRED (0xC0000000 | 0x019c)
+#define NT_STATUS_NO_USER_SESSION_KEY (0xC0000000 | 0x0202)
+#define NT_STATUS_USER_SESSION_DELETED (0xC0000000 | 0x0203)
+#define NT_STATUS_RESOURCE_LANG_NOT_FOUND (0xC0000000 | 0x0204)
+#define NT_STATUS_INSUFF_SERVER_RESOURCES (0xC0000000 | 0x0205)
+#define NT_STATUS_INVALID_BUFFER_SIZE (0xC0000000 | 0x0206)
+#define NT_STATUS_INVALID_ADDRESS_COMPONENT (0xC0000000 | 0x0207)
+#define NT_STATUS_INVALID_ADDRESS_WILDCARD (0xC0000000 | 0x0208)
+#define NT_STATUS_TOO_MANY_ADDRESSES (0xC0000000 | 0x0209)
+#define NT_STATUS_ADDRESS_ALREADY_EXISTS (0xC0000000 | 0x020a)
+#define NT_STATUS_ADDRESS_CLOSED (0xC0000000 | 0x020b)
+#define NT_STATUS_CONNECTION_DISCONNECTED (0xC0000000 | 0x020c)
+#define NT_STATUS_CONNECTION_RESET (0xC0000000 | 0x020d)
+#define NT_STATUS_TOO_MANY_NODES (0xC0000000 | 0x020e)
+#define NT_STATUS_TRANSACTION_ABORTED (0xC0000000 | 0x020f)
+#define NT_STATUS_TRANSACTION_TIMED_OUT (0xC0000000 | 0x0210)
+#define NT_STATUS_TRANSACTION_NO_RELEASE (0xC0000000 | 0x0211)
+#define NT_STATUS_TRANSACTION_NO_MATCH (0xC0000000 | 0x0212)
+#define NT_STATUS_TRANSACTION_RESPONDED (0xC0000000 | 0x0213)
+#define NT_STATUS_TRANSACTION_INVALID_ID (0xC0000000 | 0x0214)
+#define NT_STATUS_TRANSACTION_INVALID_TYPE (0xC0000000 | 0x0215)
+#define NT_STATUS_NOT_SERVER_SESSION (0xC0000000 | 0x0216)
+#define NT_STATUS_NOT_CLIENT_SESSION (0xC0000000 | 0x0217)
+#define NT_STATUS_CANNOT_LOAD_REGISTRY_FILE (0xC0000000 | 0x0218)
+#define NT_STATUS_DEBUG_ATTACH_FAILED (0xC0000000 | 0x0219)
+#define NT_STATUS_SYSTEM_PROCESS_TERMINATED (0xC0000000 | 0x021a)
+#define NT_STATUS_DATA_NOT_ACCEPTED (0xC0000000 | 0x021b)
+#define NT_STATUS_NO_BROWSER_SERVERS_FOUND (0xC0000000 | 0x021c)
+#define NT_STATUS_VDM_HARD_ERROR (0xC0000000 | 0x021d)
+#define NT_STATUS_DRIVER_CANCEL_TIMEOUT (0xC0000000 | 0x021e)
+#define NT_STATUS_REPLY_MESSAGE_MISMATCH (0xC0000000 | 0x021f)
+#define NT_STATUS_MAPPED_ALIGNMENT (0xC0000000 | 0x0220)
+#define NT_STATUS_IMAGE_CHECKSUM_MISMATCH (0xC0000000 | 0x0221)
+#define NT_STATUS_LOST_WRITEBEHIND_DATA (0xC0000000 | 0x0222)
+#define NT_STATUS_CLIENT_SERVER_PARAMETERS_INVALID (0xC0000000 | 0x0223)
+#define NT_STATUS_PASSWORD_MUST_CHANGE (0xC0000000 | 0x0224)
+#define NT_STATUS_NOT_FOUND (0xC0000000 | 0x0225)
+#define NT_STATUS_NOT_TINY_STREAM (0xC0000000 | 0x0226)
+#define NT_STATUS_RECOVERY_FAILURE (0xC0000000 | 0x0227)
+#define NT_STATUS_STACK_OVERFLOW_READ (0xC0000000 | 0x0228)
+#define NT_STATUS_FAIL_CHECK (0xC0000000 | 0x0229)
+#define NT_STATUS_DUPLICATE_OBJECTID (0xC0000000 | 0x022a)
+#define NT_STATUS_OBJECTID_EXISTS (0xC0000000 | 0x022b)
+#define NT_STATUS_CONVERT_TO_LARGE (0xC0000000 | 0x022c)
+#define NT_STATUS_RETRY (0xC0000000 | 0x022d)
+#define NT_STATUS_FOUND_OUT_OF_SCOPE (0xC0000000 | 0x022e)
+#define NT_STATUS_ALLOCATE_BUCKET (0xC0000000 | 0x022f)
+#define NT_STATUS_PROPSET_NOT_FOUND (0xC0000000 | 0x0230)
+#define NT_STATUS_MARSHALL_OVERFLOW (0xC0000000 | 0x0231)
+#define NT_STATUS_INVALID_VARIANT (0xC0000000 | 0x0232)
+#define NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND (0xC0000000 | 0x0233)
+#define NT_STATUS_ACCOUNT_LOCKED_OUT (0xC0000000 | 0x0234)
+#define NT_STATUS_HANDLE_NOT_CLOSABLE (0xC0000000 | 0x0235)
+#define NT_STATUS_CONNECTION_REFUSED (0xC0000000 | 0x0236)
+#define NT_STATUS_GRACEFUL_DISCONNECT (0xC0000000 | 0x0237)
+#define NT_STATUS_ADDRESS_ALREADY_ASSOCIATED (0xC0000000 | 0x0238)
+#define NT_STATUS_ADDRESS_NOT_ASSOCIATED (0xC0000000 | 0x0239)
+#define NT_STATUS_CONNECTION_INVALID (0xC0000000 | 0x023a)
+#define NT_STATUS_CONNECTION_ACTIVE (0xC0000000 | 0x023b)
+#define NT_STATUS_NETWORK_UNREACHABLE (0xC0000000 | 0x023c)
+#define NT_STATUS_HOST_UNREACHABLE (0xC0000000 | 0x023d)
+#define NT_STATUS_PROTOCOL_UNREACHABLE (0xC0000000 | 0x023e)
+#define NT_STATUS_PORT_UNREACHABLE (0xC0000000 | 0x023f)
+#define NT_STATUS_REQUEST_ABORTED (0xC0000000 | 0x0240)
+#define NT_STATUS_CONNECTION_ABORTED (0xC0000000 | 0x0241)
+#define NT_STATUS_BAD_COMPRESSION_BUFFER (0xC0000000 | 0x0242)
+#define NT_STATUS_USER_MAPPED_FILE (0xC0000000 | 0x0243)
+#define NT_STATUS_AUDIT_FAILED (0xC0000000 | 0x0244)
+#define NT_STATUS_TIMER_RESOLUTION_NOT_SET (0xC0000000 | 0x0245)
+#define NT_STATUS_CONNECTION_COUNT_LIMIT (0xC0000000 | 0x0246)
+#define NT_STATUS_LOGIN_TIME_RESTRICTION (0xC0000000 | 0x0247)
+#define NT_STATUS_LOGIN_WKSTA_RESTRICTION (0xC0000000 | 0x0248)
+#define NT_STATUS_IMAGE_MP_UP_MISMATCH (0xC0000000 | 0x0249)
+#define NT_STATUS_INSUFFICIENT_LOGON_INFO (0xC0000000 | 0x0250)
+#define NT_STATUS_BAD_DLL_ENTRYPOINT (0xC0000000 | 0x0251)
+#define NT_STATUS_BAD_SERVICE_ENTRYPOINT (0xC0000000 | 0x0252)
+#define NT_STATUS_LPC_REPLY_LOST (0xC0000000 | 0x0253)
+#define NT_STATUS_IP_ADDRESS_CONFLICT1 (0xC0000000 | 0x0254)
+#define NT_STATUS_IP_ADDRESS_CONFLICT2 (0xC0000000 | 0x0255)
+#define NT_STATUS_REGISTRY_QUOTA_LIMIT (0xC0000000 | 0x0256)
+#define NT_STATUS_PATH_NOT_COVERED (0xC0000000 | 0x0257)
+#define NT_STATUS_NO_CALLBACK_ACTIVE (0xC0000000 | 0x0258)
+#define NT_STATUS_LICENSE_QUOTA_EXCEEDED (0xC0000000 | 0x0259)
+#define NT_STATUS_PWD_TOO_SHORT (0xC0000000 | 0x025a)
+#define NT_STATUS_PWD_TOO_RECENT (0xC0000000 | 0x025b)
+#define NT_STATUS_PWD_HISTORY_CONFLICT (0xC0000000 | 0x025c)
+#define NT_STATUS_PLUGPLAY_NO_DEVICE (0xC0000000 | 0x025e)
+#define NT_STATUS_UNSUPPORTED_COMPRESSION (0xC0000000 | 0x025f)
+#define NT_STATUS_INVALID_HW_PROFILE (0xC0000000 | 0x0260)
+#define NT_STATUS_INVALID_PLUGPLAY_DEVICE_PATH (0xC0000000 | 0x0261)
+#define NT_STATUS_DRIVER_ORDINAL_NOT_FOUND (0xC0000000 | 0x0262)
+#define NT_STATUS_DRIVER_ENTRYPOINT_NOT_FOUND (0xC0000000 | 0x0263)
+#define NT_STATUS_RESOURCE_NOT_OWNED (0xC0000000 | 0x0264)
+#define NT_STATUS_TOO_MANY_LINKS (0xC0000000 | 0x0265)
+#define NT_STATUS_QUOTA_LIST_INCONSISTENT (0xC0000000 | 0x0266)
+#define NT_STATUS_FILE_IS_OFFLINE (0xC0000000 | 0x0267)
+#define NT_STATUS_NETWORK_SESSION_EXPIRED  (0xC0000000 | 0x035c)
+#define NT_STATUS_NO_SUCH_JOB (0xC0000000 | 0xEDE)     /* scheduler */
+#define NT_STATUS_NO_PREAUTH_INTEGRITY_HASH_OVERLAP (0xC0000000 | 0x5D0000)
+#define NT_STATUS_PENDING 0x00000103
+#endif				/* _NTERR_H */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./ntlmssp.h linux-5.4.60-fbx/fs/cifsd/ntlmssp.h
--- linux-5.4.60-fbx/fs/cifsd./ntlmssp.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/ntlmssp.h	2021-03-30 15:48:29.598385862 +0200
@@ -0,0 +1,169 @@
+/* SPDX-License-Identifier: LGPL-2.1+ */
+/*
+ *   Copyright (c) International Business Machines  Corp., 2002,2007
+ *   Author(s): Steve French (sfrench@us.ibm.com)
+ */
+
+#ifndef __KSMBD_NTLMSSP_H
+#define __KSMBD_NTLMSSP_H
+
+#define NTLMSSP_SIGNATURE "NTLMSSP"
+
+/* Security blob target info data */
+#define TGT_Name        "KSMBD"
+
+/*
+ * Size of the crypto key returned on the negotiate SMB in bytes
+ */
+#define CIFS_CRYPTO_KEY_SIZE	(8)
+#define CIFS_KEY_SIZE	(40)
+
+/*
+ * Size of encrypted user password in bytes
+ */
+#define CIFS_ENCPWD_SIZE	(16)
+#define CIFS_CPHTXT_SIZE	(16)
+
+/* Message Types */
+#define NtLmNegotiate     cpu_to_le32(1)
+#define NtLmChallenge     cpu_to_le32(2)
+#define NtLmAuthenticate  cpu_to_le32(3)
+#define UnknownMessage    cpu_to_le32(8)
+
+/* Negotiate Flags */
+#define NTLMSSP_NEGOTIATE_UNICODE         0x01 /* Text strings are unicode */
+#define NTLMSSP_NEGOTIATE_OEM             0x02 /* Text strings are in OEM */
+#define NTLMSSP_REQUEST_TARGET            0x04 /* Srv returns its auth realm */
+/* define reserved9                       0x08 */
+#define NTLMSSP_NEGOTIATE_SIGN          0x0010 /* Request signing capability */
+#define NTLMSSP_NEGOTIATE_SEAL          0x0020 /* Request confidentiality */
+#define NTLMSSP_NEGOTIATE_DGRAM         0x0040
+#define NTLMSSP_NEGOTIATE_LM_KEY        0x0080 /* Use LM session key */
+/* defined reserved 8                   0x0100 */
+#define NTLMSSP_NEGOTIATE_NTLM          0x0200 /* NTLM authentication */
+#define NTLMSSP_NEGOTIATE_NT_ONLY       0x0400 /* Lanman not allowed */
+#define NTLMSSP_ANONYMOUS               0x0800
+#define NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED 0x1000 /* reserved6 */
+#define NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED 0x2000
+#define NTLMSSP_NEGOTIATE_LOCAL_CALL    0x4000 /* client/server same machine */
+#define NTLMSSP_NEGOTIATE_ALWAYS_SIGN   0x8000 /* Sign. All security levels  */
+#define NTLMSSP_TARGET_TYPE_DOMAIN     0x10000
+#define NTLMSSP_TARGET_TYPE_SERVER     0x20000
+#define NTLMSSP_TARGET_TYPE_SHARE      0x40000
+#define NTLMSSP_NEGOTIATE_EXTENDED_SEC 0x80000 /* NB:not related to NTLMv2 pwd*/
+/* #define NTLMSSP_REQUEST_INIT_RESP     0x100000 */
+#define NTLMSSP_NEGOTIATE_IDENTIFY    0x100000
+#define NTLMSSP_REQUEST_ACCEPT_RESP   0x200000 /* reserved5 */
+#define NTLMSSP_REQUEST_NON_NT_KEY    0x400000
+#define NTLMSSP_NEGOTIATE_TARGET_INFO 0x800000
+/* #define reserved4                 0x1000000 */
+#define NTLMSSP_NEGOTIATE_VERSION    0x2000000 /* we do not set */
+/* #define reserved3                 0x4000000 */
+/* #define reserved2                 0x8000000 */
+/* #define reserved1                0x10000000 */
+#define NTLMSSP_NEGOTIATE_128       0x20000000
+#define NTLMSSP_NEGOTIATE_KEY_XCH   0x40000000
+#define NTLMSSP_NEGOTIATE_56        0x80000000
+
+/* Define AV Pair Field IDs */
+enum av_field_type {
+	NTLMSSP_AV_EOL = 0,
+	NTLMSSP_AV_NB_COMPUTER_NAME,
+	NTLMSSP_AV_NB_DOMAIN_NAME,
+	NTLMSSP_AV_DNS_COMPUTER_NAME,
+	NTLMSSP_AV_DNS_DOMAIN_NAME,
+	NTLMSSP_AV_DNS_TREE_NAME,
+	NTLMSSP_AV_FLAGS,
+	NTLMSSP_AV_TIMESTAMP,
+	NTLMSSP_AV_RESTRICTION,
+	NTLMSSP_AV_TARGET_NAME,
+	NTLMSSP_AV_CHANNEL_BINDINGS
+};
+
+/* Although typedefs are not commonly used for structure definitions */
+/* in the Linux kernel, in this particular case they are useful      */
+/* to more closely match the standards document for NTLMSSP from     */
+/* OpenGroup and to make the code more closely match the standard in */
+/* appearance */
+
+struct security_buffer {
+	__le16 Length;
+	__le16 MaximumLength;
+	__le32 BufferOffset;	/* offset to buffer */
+} __packed;
+
+struct target_info {
+	__le16 Type;
+	__le16 Length;
+	__u8 Content[0];
+} __packed;
+
+struct negotiate_message {
+	__u8 Signature[sizeof(NTLMSSP_SIGNATURE)];
+	__le32 MessageType;     /* NtLmNegotiate = 1 */
+	__le32 NegotiateFlags;
+	struct security_buffer DomainName;	/* RFC 1001 style and ASCII */
+	struct security_buffer WorkstationName;	/* RFC 1001 and ASCII */
+	/*
+	 * struct security_buffer for version info not present since we
+	 * do not set the version is present flag
+	 */
+	char DomainString[0];
+	/* followed by WorkstationString */
+} __packed;
+
+struct challenge_message {
+	__u8 Signature[sizeof(NTLMSSP_SIGNATURE)];
+	__le32 MessageType;   /* NtLmChallenge = 2 */
+	struct security_buffer TargetName;
+	__le32 NegotiateFlags;
+	__u8 Challenge[CIFS_CRYPTO_KEY_SIZE];
+	__u8 Reserved[8];
+	struct security_buffer TargetInfoArray;
+	/*
+	 * struct security_buffer for version info not present since we
+	 * do not set the version is present flag
+	 */
+} __packed;
+
+struct authenticate_message {
+	__u8 Signature[sizeof(NTLMSSP_SIGNATURE)];
+	__le32 MessageType;  /* NtLmsAuthenticate = 3 */
+	struct security_buffer LmChallengeResponse;
+	struct security_buffer NtChallengeResponse;
+	struct security_buffer DomainName;
+	struct security_buffer UserName;
+	struct security_buffer WorkstationName;
+	struct security_buffer SessionKey;
+	__le32 NegotiateFlags;
+	/*
+	 * struct security_buffer for version info not present since we
+	 * do not set the version is present flag
+	 */
+	char UserString[0];
+} __packed;
+
+struct ntlmv2_resp {
+	char ntlmv2_hash[CIFS_ENCPWD_SIZE];
+	__le32 blob_signature;
+	__u32  reserved;
+	__le64  time;
+	__u64  client_chal; /* random */
+	__u32  reserved2;
+	/* array of name entries could follow ending in minimum 4 byte struct */
+} __packed;
+
+/* per smb session structure/fields */
+struct ntlmssp_auth {
+	/* whether session key is per smb session */
+	bool		sesskey_per_smbsess;
+	/* sent by client in type 1 ntlmsssp exchange */
+	__u32		client_flags;
+	/* sent by server in type 2 ntlmssp exchange */
+	__u32		conn_flags;
+	/* sent to server */
+	unsigned char	ciphertext[CIFS_CPHTXT_SIZE];
+	/* used by ntlmssp */
+	char		cryptkey[CIFS_CRYPTO_KEY_SIZE];
+};
+#endif /* __KSMBD_NTLMSSP_H */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./oplock.c linux-5.4.60-fbx/fs/cifsd/oplock.c
--- linux-5.4.60-fbx/fs/cifsd./oplock.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/oplock.c	2021-04-21 10:06:25.185180826 +0200
@@ -0,0 +1,1919 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/moduleparam.h>
+
+#include "glob.h"
+#include "oplock.h"
+
+#include "smb_common.h"
+#ifdef CONFIG_SMB_INSECURE_SERVER
+#include "smb1pdu.h"
+#endif
+#include "smbstatus.h"
+#include "buffer_pool.h"
+#include "connection.h"
+#include "mgmt/user_session.h"
+#include "mgmt/share_config.h"
+#include "mgmt/tree_connect.h"
+
+static LIST_HEAD(lease_table_list);
+static DEFINE_RWLOCK(lease_list_lock);
+
+/**
+ * alloc_opinfo() - allocate a new opinfo object for oplock info
+ * @work:	smb work
+ * @id:		fid of open file
+ * @Tid:	tree id of connection
+ *
+ * Return:      allocated opinfo object on success, otherwise NULL
+ */
+static struct oplock_info *alloc_opinfo(struct ksmbd_work *work,
+		u64 id, __u16 Tid)
+{
+	struct ksmbd_session *sess = work->sess;
+	struct oplock_info *opinfo;
+
+	opinfo = kzalloc(sizeof(struct oplock_info), GFP_KERNEL);
+	if (!opinfo)
+		return NULL;
+
+	opinfo->sess = sess;
+	opinfo->conn = sess->conn;
+	opinfo->level = OPLOCK_NONE;
+	opinfo->op_state = OPLOCK_STATE_NONE;
+	opinfo->pending_break = 0;
+	opinfo->fid = id;
+	opinfo->Tid = Tid;
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	opinfo->is_smb2 = IS_SMB2(sess->conn);
+#endif
+	INIT_LIST_HEAD(&opinfo->op_entry);
+	INIT_LIST_HEAD(&opinfo->interim_list);
+	init_waitqueue_head(&opinfo->oplock_q);
+	init_waitqueue_head(&opinfo->oplock_brk);
+	atomic_set(&opinfo->refcount, 1);
+	atomic_set(&opinfo->breaking_cnt, 0);
+
+	return opinfo;
+}
+
+static void lease_add_list(struct oplock_info *opinfo)
+{
+	struct lease_table *lb = opinfo->o_lease->l_lb;
+
+	spin_lock(&lb->lb_lock);
+	list_add_rcu(&opinfo->lease_entry, &lb->lease_list);
+	spin_unlock(&lb->lb_lock);
+}
+
+static void lease_del_list(struct oplock_info *opinfo)
+{
+	struct lease_table *lb = opinfo->o_lease->l_lb;
+
+	if (!lb)
+		return;
+
+	spin_lock(&lb->lb_lock);
+	if (list_empty(&opinfo->lease_entry)) {
+		spin_unlock(&lb->lb_lock);
+		return;
+	}
+
+	list_del_init(&opinfo->lease_entry);
+	opinfo->o_lease->l_lb = NULL;
+	spin_unlock(&lb->lb_lock);
+}
+
+static void lb_add(struct lease_table *lb)
+{
+	write_lock(&lease_list_lock);
+	list_add(&lb->l_entry, &lease_table_list);
+	write_unlock(&lease_list_lock);
+}
+
+static int alloc_lease(struct oplock_info *opinfo, struct lease_ctx_info *lctx)
+{
+	struct lease *lease;
+
+	lease = kmalloc(sizeof(struct lease), GFP_KERNEL);
+	if (!lease)
+		return -ENOMEM;
+
+	memcpy(lease->lease_key, lctx->lease_key, SMB2_LEASE_KEY_SIZE);
+	lease->state = lctx->req_state;
+	lease->new_state = 0;
+	lease->flags = lctx->flags;
+	lease->duration = lctx->duration;
+	INIT_LIST_HEAD(&opinfo->lease_entry);
+	opinfo->o_lease = lease;
+
+	return 0;
+}
+
+static void free_lease(struct oplock_info *opinfo)
+{
+	struct lease *lease;
+
+	lease = opinfo->o_lease;
+	kfree(lease);
+}
+
+static void free_opinfo(struct oplock_info *opinfo)
+{
+	if (opinfo->is_lease)
+		free_lease(opinfo);
+	kfree(opinfo);
+}
+
+static inline void opinfo_free_rcu(struct rcu_head *rcu_head)
+{
+	struct oplock_info *opinfo;
+
+	opinfo = container_of(rcu_head, struct oplock_info, rcu_head);
+	free_opinfo(opinfo);
+}
+
+struct oplock_info *opinfo_get(struct ksmbd_file *fp)
+{
+	struct oplock_info *opinfo;
+
+	rcu_read_lock();
+	opinfo = rcu_dereference(fp->f_opinfo);
+	if (opinfo && !atomic_inc_not_zero(&opinfo->refcount))
+		opinfo = NULL;
+	rcu_read_unlock();
+
+	return opinfo;
+}
+
+static struct oplock_info *opinfo_get_list(struct ksmbd_inode *ci)
+{
+	struct oplock_info *opinfo;
+
+	if (list_empty(&ci->m_op_list))
+		return NULL;
+
+	rcu_read_lock();
+	opinfo = list_first_or_null_rcu(&ci->m_op_list, struct oplock_info,
+		op_entry);
+	if (opinfo && !atomic_inc_not_zero(&opinfo->refcount))
+		opinfo = NULL;
+	rcu_read_unlock();
+
+	return opinfo;
+}
+
+void opinfo_put(struct oplock_info *opinfo)
+{
+	if (!atomic_dec_and_test(&opinfo->refcount))
+		return;
+
+	call_rcu(&opinfo->rcu_head, opinfo_free_rcu);
+}
+
+static void opinfo_add(struct oplock_info *opinfo)
+{
+	struct ksmbd_inode *ci = opinfo->o_fp->f_ci;
+
+	write_lock(&ci->m_lock);
+	list_add_rcu(&opinfo->op_entry, &ci->m_op_list);
+	write_unlock(&ci->m_lock);
+}
+
+static void opinfo_del(struct oplock_info *opinfo)
+{
+	struct ksmbd_inode *ci = opinfo->o_fp->f_ci;
+
+	if (opinfo->is_lease) {
+		write_lock(&lease_list_lock);
+		lease_del_list(opinfo);
+		write_unlock(&lease_list_lock);
+	}
+	write_lock(&ci->m_lock);
+	list_del_rcu(&opinfo->op_entry);
+	write_unlock(&ci->m_lock);
+}
+
+static unsigned long opinfo_count(struct ksmbd_file *fp)
+{
+	if (ksmbd_stream_fd(fp))
+		return atomic_read(&fp->f_ci->sop_count);
+	else
+		return atomic_read(&fp->f_ci->op_count);
+}
+
+static void opinfo_count_inc(struct ksmbd_file *fp)
+{
+	if (ksmbd_stream_fd(fp))
+		return atomic_inc(&fp->f_ci->sop_count);
+	else
+		return atomic_inc(&fp->f_ci->op_count);
+}
+
+static void opinfo_count_dec(struct ksmbd_file *fp)
+{
+	if (ksmbd_stream_fd(fp))
+		return atomic_dec(&fp->f_ci->sop_count);
+	else
+		return atomic_dec(&fp->f_ci->op_count);
+}
+
+/**
+ * opinfo_write_to_read() - convert a write oplock to read oplock
+ * @opinfo:		current oplock info
+ *
+ * Return:      0 on success, otherwise -EINVAL
+ */
+int opinfo_write_to_read(struct oplock_info *opinfo)
+{
+	struct lease *lease = opinfo->o_lease;
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	if (opinfo->is_smb2) {
+		if (!(opinfo->level == SMB2_OPLOCK_LEVEL_BATCH ||
+		      opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE)) {
+			ksmbd_err("bad oplock(0x%x)\n", opinfo->level);
+			if (opinfo->is_lease)
+				ksmbd_err("lease state(0x%x)\n", lease->state);
+			return -EINVAL;
+		}
+		opinfo->level = SMB2_OPLOCK_LEVEL_II;
+
+		if (opinfo->is_lease)
+			lease->state = lease->new_state;
+	} else {
+		if (!(opinfo->level == OPLOCK_EXCLUSIVE ||
+		      opinfo->level == OPLOCK_BATCH)) {
+			ksmbd_err("bad oplock(0x%x)\n", opinfo->level);
+			return -EINVAL;
+		}
+		opinfo->level = OPLOCK_READ;
+	}
+#else
+	if (!(opinfo->level == SMB2_OPLOCK_LEVEL_BATCH ||
+	      opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE)) {
+		ksmbd_err("bad oplock(0x%x)\n", opinfo->level);
+		if (opinfo->is_lease)
+			ksmbd_err("lease state(0x%x)\n", lease->state);
+		return -EINVAL;
+	}
+	opinfo->level = SMB2_OPLOCK_LEVEL_II;
+
+	if (opinfo->is_lease)
+		lease->state = lease->new_state;
+#endif
+	return 0;
+}
+
+/**
+ * opinfo_read_handle_to_read() - convert a read/handle oplock to read oplock
+ * @opinfo:		current oplock info
+ *
+ * Return:      0 on success, otherwise -EINVAL
+ */
+int opinfo_read_handle_to_read(struct oplock_info *opinfo)
+{
+	struct lease *lease = opinfo->o_lease;
+
+	lease->state = lease->new_state;
+	opinfo->level = SMB2_OPLOCK_LEVEL_II;
+	return 0;
+}
+
+/**
+ * opinfo_write_to_none() - convert a write oplock to none
+ * @opinfo:	current oplock info
+ *
+ * Return:      0 on success, otherwise -EINVAL
+ */
+int opinfo_write_to_none(struct oplock_info *opinfo)
+{
+	struct lease *lease = opinfo->o_lease;
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	if (opinfo->is_smb2) {
+		if (!(opinfo->level == SMB2_OPLOCK_LEVEL_BATCH ||
+		      opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE)) {
+			ksmbd_err("bad oplock(0x%x)\n", opinfo->level);
+			if (opinfo->is_lease)
+				ksmbd_err("lease state(0x%x)\n",
+						lease->state);
+			return -EINVAL;
+		}
+		opinfo->level = SMB2_OPLOCK_LEVEL_NONE;
+		if (opinfo->is_lease)
+			lease->state = lease->new_state;
+	} else {
+		if (!(opinfo->level == OPLOCK_EXCLUSIVE ||
+		      opinfo->level == OPLOCK_BATCH)) {
+			ksmbd_err("bad oplock(0x%x)\n", opinfo->level);
+			return -EINVAL;
+		}
+		opinfo->level = OPLOCK_NONE;
+	}
+#else
+	if (!(opinfo->level == SMB2_OPLOCK_LEVEL_BATCH ||
+	      opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE)) {
+		ksmbd_err("bad oplock(0x%x)\n", opinfo->level);
+		if (opinfo->is_lease)
+			ksmbd_err("lease state(0x%x)\n",
+					lease->state);
+		return -EINVAL;
+	}
+	opinfo->level = SMB2_OPLOCK_LEVEL_NONE;
+	if (opinfo->is_lease)
+		lease->state = lease->new_state;
+#endif
+	return 0;
+}
+
+/**
+ * opinfo_read_to_none() - convert a write read to none
+ * @opinfo:	current oplock info
+ *
+ * Return:      0 on success, otherwise -EINVAL
+ */
+int opinfo_read_to_none(struct oplock_info *opinfo)
+{
+	struct lease *lease = opinfo->o_lease;
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	if (opinfo->is_smb2) {
+		if (opinfo->level != SMB2_OPLOCK_LEVEL_II) {
+			ksmbd_err("bad oplock(0x%x)\n", opinfo->level);
+			if (opinfo->is_lease)
+				ksmbd_err("lease state(0x%x)\n", lease->state);
+			return -EINVAL;
+		}
+		opinfo->level = SMB2_OPLOCK_LEVEL_NONE;
+		if (opinfo->is_lease)
+			lease->state = lease->new_state;
+	} else {
+		if (opinfo->level != OPLOCK_READ) {
+			ksmbd_err("bad oplock(0x%x)\n", opinfo->level);
+			return -EINVAL;
+		}
+		opinfo->level = OPLOCK_NONE;
+	}
+#else
+	if (opinfo->level != SMB2_OPLOCK_LEVEL_II) {
+		ksmbd_err("bad oplock(0x%x)\n", opinfo->level);
+		if (opinfo->is_lease)
+			ksmbd_err("lease state(0x%x)\n", lease->state);
+		return -EINVAL;
+	}
+	opinfo->level = SMB2_OPLOCK_LEVEL_NONE;
+	if (opinfo->is_lease)
+		lease->state = lease->new_state;
+#endif
+	return 0;
+}
+
+/**
+ * lease_read_to_write() - upgrade lease state from read to write
+ * @opinfo:	current lease info
+ *
+ * Return:      0 on success, otherwise -EINVAL
+ */
+int lease_read_to_write(struct oplock_info *opinfo)
+{
+	struct lease *lease = opinfo->o_lease;
+
+	if (!(lease->state & SMB2_LEASE_READ_CACHING_LE)) {
+		ksmbd_debug(OPLOCK, "bad lease state(0x%x)\n",
+				lease->state);
+		return -EINVAL;
+	}
+
+	lease->new_state = SMB2_LEASE_NONE_LE;
+	lease->state |= SMB2_LEASE_WRITE_CACHING_LE;
+	if (lease->state & SMB2_LEASE_HANDLE_CACHING_LE)
+		opinfo->level = SMB2_OPLOCK_LEVEL_BATCH;
+	else
+		opinfo->level = SMB2_OPLOCK_LEVEL_EXCLUSIVE;
+	return 0;
+}
+
+/**
+ * lease_none_upgrade() - upgrade lease state from none
+ * @opinfo:	current lease info
+ * @new_state:	new lease state
+ *
+ * Return:	0 on success, otherwise -EINVAL
+ */
+static int lease_none_upgrade(struct oplock_info *opinfo, __le32 new_state)
+{
+	struct lease *lease = opinfo->o_lease;
+
+	if (!(lease->state == SMB2_LEASE_NONE_LE)) {
+		ksmbd_debug(OPLOCK, "bad lease state(0x%x)\n",
+				lease->state);
+		return -EINVAL;
+	}
+
+	lease->new_state = SMB2_LEASE_NONE_LE;
+	lease->state = new_state;
+	if (lease->state & SMB2_LEASE_HANDLE_CACHING_LE)
+		if (lease->state & SMB2_LEASE_WRITE_CACHING_LE)
+			opinfo->level = SMB2_OPLOCK_LEVEL_BATCH;
+		else
+			opinfo->level = SMB2_OPLOCK_LEVEL_II;
+	else if (lease->state & SMB2_LEASE_WRITE_CACHING_LE)
+		opinfo->level = SMB2_OPLOCK_LEVEL_EXCLUSIVE;
+	else if (lease->state & SMB2_LEASE_READ_CACHING_LE)
+		opinfo->level = SMB2_OPLOCK_LEVEL_II;
+
+	return 0;
+}
+
+/**
+ * close_id_del_oplock() - release oplock object at file close time
+ * @fp:		ksmbd file pointer
+ */
+void close_id_del_oplock(struct ksmbd_file *fp)
+{
+	struct oplock_info *opinfo;
+
+	if (S_ISDIR(file_inode(fp->filp)->i_mode))
+		return;
+
+	opinfo = opinfo_get(fp);
+	if (!opinfo)
+		return;
+
+	opinfo_del(opinfo);
+
+	rcu_assign_pointer(fp->f_opinfo, NULL);
+	if (opinfo->op_state == OPLOCK_ACK_WAIT) {
+		opinfo->op_state = OPLOCK_CLOSING;
+		wake_up_interruptible_all(&opinfo->oplock_q);
+		if (opinfo->is_lease) {
+			atomic_set(&opinfo->breaking_cnt, 0);
+			wake_up_interruptible_all(&opinfo->oplock_brk);
+		}
+	}
+
+	opinfo_count_dec(fp);
+	atomic_dec(&opinfo->refcount);
+	opinfo_put(opinfo);
+}
+
+/**
+ * grant_write_oplock() - grant exclusive/batch oplock or write lease
+ * @opinfo_new:	new oplock info object
+ * @req_oplock: request oplock
+ * @lctx:	lease context information
+ *
+ * Return:      0
+ */
+static void grant_write_oplock(struct oplock_info *opinfo_new, int req_oplock,
+		struct lease_ctx_info *lctx)
+{
+	struct lease *lease = opinfo_new->o_lease;
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	if (opinfo_new->is_smb2) {
+		if (req_oplock == SMB2_OPLOCK_LEVEL_BATCH)
+			opinfo_new->level = SMB2_OPLOCK_LEVEL_BATCH;
+		else
+			opinfo_new->level = SMB2_OPLOCK_LEVEL_EXCLUSIVE;
+	} else {
+		if (req_oplock == REQ_BATCHOPLOCK)
+			opinfo_new->level = OPLOCK_BATCH;
+		else
+			opinfo_new->level = OPLOCK_EXCLUSIVE;
+	}
+#else
+	if (req_oplock == SMB2_OPLOCK_LEVEL_BATCH)
+		opinfo_new->level = SMB2_OPLOCK_LEVEL_BATCH;
+	else
+		opinfo_new->level = SMB2_OPLOCK_LEVEL_EXCLUSIVE;
+#endif
+
+	if (lctx) {
+		lease->state = lctx->req_state;
+		memcpy(lease->lease_key, lctx->lease_key,
+				SMB2_LEASE_KEY_SIZE);
+	}
+}
+
+/**
+ * grant_read_oplock() - grant level2 oplock or read lease
+ * @opinfo_new:	new oplock info object
+ * @lctx:	lease context information
+ *
+ * Return:      0
+ */
+static void grant_read_oplock(struct oplock_info *opinfo_new,
+		struct lease_ctx_info *lctx)
+{
+	struct lease *lease = opinfo_new->o_lease;
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	if (opinfo_new->is_smb2)
+		opinfo_new->level = SMB2_OPLOCK_LEVEL_II;
+	else
+		opinfo_new->level = OPLOCK_READ;
+#else
+	opinfo_new->level = SMB2_OPLOCK_LEVEL_II;
+#endif
+
+	if (lctx) {
+		lease->state = SMB2_LEASE_READ_CACHING_LE;
+		if (lctx->req_state & SMB2_LEASE_HANDLE_CACHING_LE)
+			lease->state |= SMB2_LEASE_HANDLE_CACHING_LE;
+		memcpy(lease->lease_key, lctx->lease_key,
+				SMB2_LEASE_KEY_SIZE);
+	}
+}
+
+/**
+ * grant_none_oplock() - grant none oplock or none lease
+ * @opinfo_new:	new oplock info object
+ * @lctx:	lease context information
+ *
+ * Return:      0
+ */
+static void grant_none_oplock(struct oplock_info *opinfo_new,
+		struct lease_ctx_info *lctx)
+{
+	struct lease *lease = opinfo_new->o_lease;
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	if (opinfo_new->is_smb2)
+		opinfo_new->level = SMB2_OPLOCK_LEVEL_NONE;
+	else
+		opinfo_new->level = OPLOCK_NONE;
+#else
+	opinfo_new->level = SMB2_OPLOCK_LEVEL_NONE;
+#endif
+
+	if (lctx) {
+		lease->state = 0;
+		memcpy(lease->lease_key, lctx->lease_key,
+			SMB2_LEASE_KEY_SIZE);
+	}
+}
+
+static inline int compare_guid_key(struct oplock_info *opinfo,
+		const char *guid1, const char *key1)
+{
+	const char *guid2, *key2;
+
+	guid2 = opinfo->conn->ClientGUID;
+	key2 = opinfo->o_lease->lease_key;
+	if (!memcmp(guid1, guid2, SMB2_CLIENT_GUID_SIZE) &&
+	    !memcmp(key1, key2, SMB2_LEASE_KEY_SIZE))
+		return 1;
+
+	return 0;
+}
+
+/**
+ * same_client_has_lease() - check whether current lease request is
+ *		from lease owner of file
+ * @ci:		master file pointer
+ * @client_guid:	Client GUID
+ * @lctx:		lease context information
+ *
+ * Return:      oplock(lease) object on success, otherwise NULL
+ */
+static struct oplock_info *same_client_has_lease(struct ksmbd_inode *ci,
+		char *client_guid, struct lease_ctx_info *lctx)
+{
+	int ret;
+	struct lease *lease;
+	struct oplock_info *opinfo;
+	struct oplock_info *m_opinfo = NULL;
+
+	if (!lctx)
+		return NULL;
+
+	/*
+	 * Compare lease key and client_guid to know request from same owner
+	 * of same client
+	 */
+	read_lock(&ci->m_lock);
+	list_for_each_entry(opinfo, &ci->m_op_list, op_entry) {
+		if (!opinfo->is_lease)
+			continue;
+		read_unlock(&ci->m_lock);
+		lease = opinfo->o_lease;
+
+		ret = compare_guid_key(opinfo, client_guid, lctx->lease_key);
+		if (ret) {
+			m_opinfo = opinfo;
+			/* skip upgrading lease about breaking lease */
+			if (atomic_read(&opinfo->breaking_cnt)) {
+				read_lock(&ci->m_lock);
+				continue;
+			}
+
+			/* upgrading lease */
+			if ((atomic_read(&ci->op_count) +
+			     atomic_read(&ci->sop_count)) == 1) {
+				if (lease->state ==
+					(lctx->req_state & lease->state)) {
+					lease->state |= lctx->req_state;
+					if (lctx->req_state &
+						SMB2_LEASE_WRITE_CACHING_LE)
+						lease_read_to_write(opinfo);
+				}
+			} else if ((atomic_read(&ci->op_count) +
+				    atomic_read(&ci->sop_count)) > 1) {
+				if (lctx->req_state ==
+					(SMB2_LEASE_READ_CACHING_LE |
+					 SMB2_LEASE_HANDLE_CACHING_LE))
+					lease->state = lctx->req_state;
+			}
+
+			if (lctx->req_state && lease->state ==
+					SMB2_LEASE_NONE_LE)
+				lease_none_upgrade(opinfo, lctx->req_state);
+		}
+		read_lock(&ci->m_lock);
+	}
+	read_unlock(&ci->m_lock);
+
+	return m_opinfo;
+}
+
+static void wait_for_break_ack(struct oplock_info *opinfo)
+{
+	int rc = 0;
+
+	rc = wait_event_interruptible_timeout(opinfo->oplock_q,
+		opinfo->op_state == OPLOCK_STATE_NONE ||
+		opinfo->op_state == OPLOCK_CLOSING,
+		OPLOCK_WAIT_TIME);
+
+	/* is this a timeout ? */
+	if (!rc) {
+		if (opinfo->is_lease)
+			opinfo->o_lease->state = SMB2_LEASE_NONE_LE;
+		opinfo->level = SMB2_OPLOCK_LEVEL_NONE;
+		opinfo->op_state = OPLOCK_STATE_NONE;
+	}
+}
+
+static void wake_up_oplock_break(struct oplock_info *opinfo)
+{
+	clear_bit_unlock(0, &opinfo->pending_break);
+	/* memory barrier is needed for wake_up_bit() */
+	smp_mb__after_atomic();
+	wake_up_bit(&opinfo->pending_break, 0);
+}
+
+static int oplock_break_pending(struct oplock_info *opinfo, int req_op_level)
+{
+	while  (test_and_set_bit(0, &opinfo->pending_break)) {
+		wait_on_bit(&opinfo->pending_break, 0, TASK_UNINTERRUPTIBLE);
+
+		/* Not immediately break to none. */
+		opinfo->open_trunc = 0;
+
+		if (opinfo->op_state == OPLOCK_CLOSING)
+			return -ENOENT;
+		else if (!opinfo->is_lease && opinfo->level <= req_op_level)
+			return 1;
+	}
+
+	if (!opinfo->is_lease && opinfo->level <= req_op_level) {
+		wake_up_oplock_break(opinfo);
+		return 1;
+	}
+	return 0;
+}
+
+static inline int allocate_oplock_break_buf(struct ksmbd_work *work)
+{
+	work->response_buf = kzalloc(MAX_CIFS_SMALL_BUFFER_SIZE, GFP_KERNEL);
+	if (!work->response_buf)
+		return -ENOMEM;
+	work->response_sz = MAX_CIFS_SMALL_BUFFER_SIZE;
+	return 0;
+}
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+/**
+ * smb1_oplock_break_noti() - send smb1 oplock break cmd from conn
+ * to client
+ * @work:     smb work object
+ *
+ * There are two ways this function can be called. 1- while file open we break
+ * from exclusive/batch lock to levelII oplock and 2- while file write/truncate
+ * we break from levelII oplock no oplock.
+ * work->request_buf contains oplock_info.
+ */
+static void __smb1_oplock_break_noti(struct work_struct *wk)
+{
+	struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work);
+	struct ksmbd_conn *conn = work->conn;
+	struct smb_hdr *rsp_hdr;
+	struct smb_com_lock_req *req;
+	struct oplock_info *opinfo = work->request_buf;
+
+	if (allocate_oplock_break_buf(work)) {
+		ksmbd_err("smb_allocate_rsp_buf failed! ");
+		ksmbd_free_work_struct(work);
+		return;
+	}
+
+	/* Init response header */
+	rsp_hdr = work->response_buf;
+	/* wct is 8 for locking andx(18) */
+	memset(rsp_hdr, 0, sizeof(struct smb_hdr) + 18);
+	rsp_hdr->smb_buf_length = cpu_to_be32(HEADER_SIZE_NO_BUF_LEN(conn)
+		+ 18);
+	rsp_hdr->Protocol[0] = 0xFF;
+	rsp_hdr->Protocol[1] = 'S';
+	rsp_hdr->Protocol[2] = 'M';
+	rsp_hdr->Protocol[3] = 'B';
+
+	rsp_hdr->Command = SMB_COM_LOCKING_ANDX;
+	/* we know unicode, long file name and use nt error codes */
+	rsp_hdr->Flags2 = SMBFLG2_UNICODE | SMBFLG2_KNOWS_LONG_NAMES |
+		SMBFLG2_ERR_STATUS;
+	rsp_hdr->Uid = cpu_to_le16(work->sess->id);
+	rsp_hdr->Pid = cpu_to_le16(0xFFFF);
+	rsp_hdr->Mid = cpu_to_le16(0xFFFF);
+	rsp_hdr->Tid = cpu_to_le16(opinfo->Tid);
+	rsp_hdr->WordCount = 8;
+
+	/* Init locking request */
+	req = work->response_buf;
+
+	req->AndXCommand = 0xFF;
+	req->AndXReserved = 0;
+	req->AndXOffset = 0;
+	req->Fid = opinfo->fid;
+	req->LockType = LOCKING_ANDX_OPLOCK_RELEASE;
+	if (!opinfo->open_trunc &&
+	    (opinfo->level == OPLOCK_BATCH ||
+	     opinfo->level == OPLOCK_EXCLUSIVE))
+		req->OplockLevel = 1;
+	else
+		req->OplockLevel = 0;
+	req->Timeout = 0;
+	req->NumberOfUnlocks = 0;
+	req->ByteCount = 0;
+	ksmbd_debug(OPLOCK, "sending oplock break for fid %d lock level = %d\n",
+			req->Fid, req->OplockLevel);
+
+	ksmbd_conn_write(work);
+	ksmbd_free_work_struct(work);
+	atomic_dec(&conn->r_count);
+}
+
+/**
+ * smb1_oplock_break() - send smb1 exclusive/batch to level2 oplock
+ *		break command from server to client
+ * @opinfo:		oplock info object
+ * @ack_required	if requiring ack
+ *
+ * Return:      0 on success, otherwise error
+ */
+static int smb1_oplock_break_noti(struct oplock_info *opinfo)
+{
+	struct ksmbd_conn *conn = opinfo->conn;
+	struct ksmbd_work *work = ksmbd_alloc_work_struct();
+
+	if (!work)
+		return -ENOMEM;
+
+	work->request_buf = (char *)opinfo;
+	work->conn = conn;
+
+	atomic_inc(&conn->r_count);
+	if (opinfo->op_state == OPLOCK_ACK_WAIT) {
+		INIT_WORK(&work->work, __smb1_oplock_break_noti);
+		ksmbd_queue_work(work);
+
+		wait_for_break_ack(opinfo);
+	} else {
+		__smb1_oplock_break_noti(&work->work);
+		if (opinfo->level == OPLOCK_READ)
+			opinfo->level = OPLOCK_NONE;
+	}
+	return 0;
+}
+#endif
+
+/**
+ * __smb2_oplock_break_noti() - send smb2 oplock break cmd from conn
+ * to client
+ * @wk:     smb work object
+ *
+ * There are two ways this function can be called. 1- while file open we break
+ * from exclusive/batch lock to levelII oplock and 2- while file write/truncate
+ * we break from levelII oplock no oplock.
+ * work->request_buf contains oplock_info.
+ */
+static void __smb2_oplock_break_noti(struct work_struct *wk)
+{
+	struct smb2_oplock_break *rsp = NULL;
+	struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work);
+	struct ksmbd_conn *conn = work->conn;
+	struct oplock_break_info *br_info = work->request_buf;
+	struct smb2_hdr *rsp_hdr;
+	struct ksmbd_file *fp;
+
+	fp = ksmbd_lookup_durable_fd(br_info->fid);
+	if (!fp) {
+		atomic_dec(&conn->r_count);
+		ksmbd_free_work_struct(work);
+		return;
+	}
+
+	if (allocate_oplock_break_buf(work)) {
+		ksmbd_err("smb2_allocate_rsp_buf failed! ");
+		atomic_dec(&conn->r_count);
+		ksmbd_fd_put(work, fp);
+		ksmbd_free_work_struct(work);
+		return;
+	}
+
+	rsp_hdr = work->response_buf;
+	memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);
+	rsp_hdr->smb2_buf_length = cpu_to_be32(HEADER_SIZE_NO_BUF_LEN(conn));
+	rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER;
+	rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE;
+	rsp_hdr->CreditRequest = cpu_to_le16(0);
+	rsp_hdr->Command = SMB2_OPLOCK_BREAK;
+	rsp_hdr->Flags = (SMB2_FLAGS_SERVER_TO_REDIR);
+	rsp_hdr->NextCommand = 0;
+	rsp_hdr->MessageId = cpu_to_le64(-1);
+	rsp_hdr->Id.SyncId.ProcessId = 0;
+	rsp_hdr->Id.SyncId.TreeId = 0;
+	rsp_hdr->SessionId = 0;
+	memset(rsp_hdr->Signature, 0, 16);
+
+	rsp = work->response_buf;
+
+	rsp->StructureSize = cpu_to_le16(24);
+	if (!br_info->open_trunc &&
+	    (br_info->level == SMB2_OPLOCK_LEVEL_BATCH ||
+	     br_info->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE))
+		rsp->OplockLevel = SMB2_OPLOCK_LEVEL_II;
+	else
+		rsp->OplockLevel = SMB2_OPLOCK_LEVEL_NONE;
+	rsp->Reserved = 0;
+	rsp->Reserved2 = 0;
+	rsp->PersistentFid = cpu_to_le64(fp->persistent_id);
+	rsp->VolatileFid = cpu_to_le64(fp->volatile_id);
+
+	inc_rfc1001_len(rsp, 24);
+
+	ksmbd_debug(OPLOCK,
+		"sending oplock break v_id %llu p_id = %llu lock level = %d\n",
+		rsp->VolatileFid, rsp->PersistentFid, rsp->OplockLevel);
+
+	ksmbd_fd_put(work, fp);
+	ksmbd_conn_write(work);
+	ksmbd_free_work_struct(work);
+	atomic_dec(&conn->r_count);
+}
+
+/**
+ * smb2_oplock_break_noti() - send smb2 exclusive/batch to level2 oplock
+ *		break command from server to client
+ * @opinfo:		oplock info object
+ *
+ * Return:      0 on success, otherwise error
+ */
+static int smb2_oplock_break_noti(struct oplock_info *opinfo)
+{
+	struct ksmbd_conn *conn = opinfo->conn;
+	struct oplock_break_info *br_info;
+	int ret = 0;
+	struct ksmbd_work *work = ksmbd_alloc_work_struct();
+
+	if (!work)
+		return -ENOMEM;
+
+	br_info = kmalloc(sizeof(struct oplock_break_info), GFP_KERNEL);
+	if (!br_info) {
+		ksmbd_free_work_struct(work);
+		return -ENOMEM;
+	}
+
+	br_info->level = opinfo->level;
+	br_info->fid = opinfo->fid;
+	br_info->open_trunc = opinfo->open_trunc;
+
+	work->request_buf = (char *)br_info;
+	work->conn = conn;
+	work->sess = opinfo->sess;
+
+	atomic_inc(&conn->r_count);
+	if (opinfo->op_state == OPLOCK_ACK_WAIT) {
+		INIT_WORK(&work->work, __smb2_oplock_break_noti);
+		ksmbd_queue_work(work);
+
+		wait_for_break_ack(opinfo);
+	} else {
+		__smb2_oplock_break_noti(&work->work);
+		if (opinfo->level == SMB2_OPLOCK_LEVEL_II)
+			opinfo->level = SMB2_OPLOCK_LEVEL_NONE;
+	}
+	return ret;
+}
+
+/**
+ * __smb2_lease_break_noti() - send lease break command from server
+ * to client
+ * @wk:     smb work object
+ */
+static void __smb2_lease_break_noti(struct work_struct *wk)
+{
+	struct smb2_lease_break *rsp = NULL;
+	struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work);
+	struct lease_break_info *br_info = work->request_buf;
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_hdr *rsp_hdr;
+
+	if (allocate_oplock_break_buf(work)) {
+		ksmbd_debug(OPLOCK, "smb2_allocate_rsp_buf failed! ");
+		ksmbd_free_work_struct(work);
+		atomic_dec(&conn->r_count);
+		return;
+	}
+
+	rsp_hdr = work->response_buf;
+	memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);
+	rsp_hdr->smb2_buf_length = cpu_to_be32(HEADER_SIZE_NO_BUF_LEN(conn));
+	rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER;
+	rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE;
+	rsp_hdr->CreditRequest = cpu_to_le16(0);
+	rsp_hdr->Command = SMB2_OPLOCK_BREAK;
+	rsp_hdr->Flags = (SMB2_FLAGS_SERVER_TO_REDIR);
+	rsp_hdr->NextCommand = 0;
+	rsp_hdr->MessageId = cpu_to_le64(-1);
+	rsp_hdr->Id.SyncId.ProcessId = 0;
+	rsp_hdr->Id.SyncId.TreeId = 0;
+	rsp_hdr->SessionId = 0;
+	memset(rsp_hdr->Signature, 0, 16);
+
+	rsp = work->response_buf;
+	rsp->StructureSize = cpu_to_le16(44);
+	rsp->Reserved = 0;
+	rsp->Flags = 0;
+
+	if (br_info->curr_state & (SMB2_LEASE_WRITE_CACHING_LE |
+			SMB2_LEASE_HANDLE_CACHING_LE))
+		rsp->Flags = SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED;
+
+	memcpy(rsp->LeaseKey, br_info->lease_key, SMB2_LEASE_KEY_SIZE);
+	rsp->CurrentLeaseState = br_info->curr_state;
+	rsp->NewLeaseState = br_info->new_state;
+	rsp->BreakReason = 0;
+	rsp->AccessMaskHint = 0;
+	rsp->ShareMaskHint = 0;
+
+	inc_rfc1001_len(rsp, 44);
+
+	ksmbd_conn_write(work);
+	ksmbd_free_work_struct(work);
+	atomic_dec(&conn->r_count);
+}
+
+/**
+ * smb2_lease_break_noti() - break lease when a new client request
+ *			write lease
+ * @opinfo:		conains lease state information
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb2_lease_break_noti(struct oplock_info *opinfo)
+{
+	struct ksmbd_conn *conn = opinfo->conn;
+	struct list_head *tmp, *t;
+	struct ksmbd_work *work;
+	struct lease_break_info *br_info;
+	struct lease *lease = opinfo->o_lease;
+
+	work = ksmbd_alloc_work_struct();
+	if (!work)
+		return -ENOMEM;
+
+	br_info = kmalloc(sizeof(struct lease_break_info), GFP_KERNEL);
+	if (!br_info) {
+		ksmbd_free_work_struct(work);
+		return -ENOMEM;
+	}
+
+	br_info->curr_state = lease->state;
+	br_info->new_state = lease->new_state;
+	memcpy(br_info->lease_key, lease->lease_key, SMB2_LEASE_KEY_SIZE);
+
+	work->request_buf = (char *)br_info;
+	work->conn = conn;
+	work->sess = opinfo->sess;
+
+	atomic_inc(&conn->r_count);
+	if (opinfo->op_state == OPLOCK_ACK_WAIT) {
+		list_for_each_safe(tmp, t, &opinfo->interim_list) {
+			struct ksmbd_work *in_work;
+
+			in_work = list_entry(tmp, struct ksmbd_work,
+				interim_entry);
+			setup_async_work(in_work, NULL, NULL);
+			smb2_send_interim_resp(in_work, STATUS_PENDING);
+			list_del(&in_work->interim_entry);
+		}
+		INIT_WORK(&work->work, __smb2_lease_break_noti);
+		ksmbd_queue_work(work);
+		wait_for_break_ack(opinfo);
+	} else {
+		__smb2_lease_break_noti(&work->work);
+		if (opinfo->o_lease->new_state == SMB2_LEASE_NONE_LE) {
+			opinfo->level = SMB2_OPLOCK_LEVEL_NONE;
+			opinfo->o_lease->state = SMB2_LEASE_NONE_LE;
+		}
+	}
+	return 0;
+}
+
+static void wait_lease_breaking(struct oplock_info *opinfo)
+{
+	if (!opinfo->is_lease)
+		return;
+
+	wake_up_interruptible_all(&opinfo->oplock_brk);
+	if (atomic_read(&opinfo->breaking_cnt)) {
+		int ret = 0;
+
+		ret = wait_event_interruptible_timeout(opinfo->oplock_brk,
+			atomic_read(&opinfo->breaking_cnt) == 0, HZ);
+		if (!ret)
+			atomic_set(&opinfo->breaking_cnt, 0);
+	}
+}
+
+static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level)
+{
+	int err = 0;
+
+	/* Need to break exclusive/batch oplock, write lease or overwrite_if */
+	ksmbd_debug(OPLOCK,
+		"request to send oplock(level : 0x%x) break notification\n",
+		brk_opinfo->level);
+
+	if (brk_opinfo->is_lease) {
+		struct lease *lease = brk_opinfo->o_lease;
+
+		atomic_inc(&brk_opinfo->breaking_cnt);
+
+		err = oplock_break_pending(brk_opinfo, req_op_level);
+		if (err)
+			return err < 0 ? err : 0;
+
+		if (brk_opinfo->open_trunc) {
+			/*
+			 * Create overwrite break trigger the lease break to
+			 * none.
+			 */
+			lease->new_state = SMB2_LEASE_NONE_LE;
+		} else {
+			if (lease->state & SMB2_LEASE_WRITE_CACHING_LE) {
+				if (lease->state & SMB2_LEASE_HANDLE_CACHING_LE)
+					lease->new_state =
+						SMB2_LEASE_READ_CACHING_LE |
+						SMB2_LEASE_HANDLE_CACHING_LE;
+				else
+					lease->new_state =
+						SMB2_LEASE_READ_CACHING_LE;
+			} else {
+				if (lease->state & SMB2_LEASE_HANDLE_CACHING_LE)
+					lease->new_state =
+						SMB2_LEASE_READ_CACHING_LE;
+				else
+					lease->new_state = SMB2_LEASE_NONE_LE;
+			}
+		}
+
+		if (lease->state & (SMB2_LEASE_WRITE_CACHING_LE |
+				SMB2_LEASE_HANDLE_CACHING_LE))
+			brk_opinfo->op_state = OPLOCK_ACK_WAIT;
+		else
+			atomic_dec(&brk_opinfo->breaking_cnt);
+	} else {
+		err = oplock_break_pending(brk_opinfo, req_op_level);
+		if (err)
+			return err < 0 ? err : 0;
+
+		if (brk_opinfo->level == SMB2_OPLOCK_LEVEL_BATCH ||
+		    brk_opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE)
+			brk_opinfo->op_state = OPLOCK_ACK_WAIT;
+	}
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	if (brk_opinfo->is_smb2)
+		if (brk_opinfo->is_lease)
+			err = smb2_lease_break_noti(brk_opinfo);
+		else
+			err = smb2_oplock_break_noti(brk_opinfo);
+	else
+		err = smb1_oplock_break_noti(brk_opinfo);
+#else
+	if (brk_opinfo->is_lease)
+		err = smb2_lease_break_noti(brk_opinfo);
+	else
+		err = smb2_oplock_break_noti(brk_opinfo);
+#endif
+
+	ksmbd_debug(OPLOCK, "oplock granted = %d\n", brk_opinfo->level);
+	if (brk_opinfo->op_state == OPLOCK_CLOSING)
+		err = -ENOENT;
+	wake_up_oplock_break(brk_opinfo);
+
+	wait_lease_breaking(brk_opinfo);
+
+	return err;
+}
+
+void destroy_lease_table(struct ksmbd_conn *conn)
+{
+	struct lease_table *lb, *lbtmp;
+	struct oplock_info *opinfo;
+
+	write_lock(&lease_list_lock);
+	if (list_empty(&lease_table_list)) {
+		write_unlock(&lease_list_lock);
+		return;
+	}
+
+	list_for_each_entry_safe(lb, lbtmp, &lease_table_list, l_entry) {
+		if (conn && memcmp(lb->client_guid, conn->ClientGUID,
+				   SMB2_CLIENT_GUID_SIZE))
+			continue;
+again:
+		rcu_read_lock();
+		list_for_each_entry_rcu(opinfo, &lb->lease_list,
+				lease_entry) {
+			rcu_read_unlock();
+			lease_del_list(opinfo);
+			goto again;
+		}
+		rcu_read_unlock();
+		list_del(&lb->l_entry);
+		kfree(lb);
+	}
+	write_unlock(&lease_list_lock);
+}
+
+int find_same_lease_key(struct ksmbd_session *sess, struct ksmbd_inode *ci,
+		struct lease_ctx_info *lctx)
+{
+	struct oplock_info *opinfo;
+	int err = 0;
+	struct lease_table *lb;
+
+	if (!lctx)
+		return err;
+
+	read_lock(&lease_list_lock);
+	if (list_empty(&lease_table_list)) {
+		read_unlock(&lease_list_lock);
+		return 0;
+	}
+
+	list_for_each_entry(lb, &lease_table_list, l_entry) {
+		if (!memcmp(lb->client_guid, sess->conn->ClientGUID,
+			    SMB2_CLIENT_GUID_SIZE))
+			goto found;
+	}
+	read_unlock(&lease_list_lock);
+
+	return 0;
+
+found:
+	rcu_read_lock();
+	list_for_each_entry_rcu(opinfo, &lb->lease_list,
+			lease_entry) {
+		if (!atomic_inc_not_zero(&opinfo->refcount))
+			continue;
+		rcu_read_unlock();
+		if (opinfo->o_fp->f_ci == ci)
+			goto op_next;
+		err = compare_guid_key(opinfo,
+				sess->conn->ClientGUID,
+				lctx->lease_key);
+		if (err) {
+			err = -EINVAL;
+			ksmbd_debug(OPLOCK,
+				"found same lease key is already used in other files\n");
+			opinfo_put(opinfo);
+			goto out;
+		}
+op_next:
+		opinfo_put(opinfo);
+		rcu_read_lock();
+	}
+	rcu_read_unlock();
+
+out:
+	read_unlock(&lease_list_lock);
+	return err;
+}
+
+static void copy_lease(struct oplock_info *op1, struct oplock_info *op2)
+{
+	struct lease *lease1 = op1->o_lease;
+	struct lease *lease2 = op2->o_lease;
+
+	op2->level = op1->level;
+	lease2->state = lease1->state;
+	memcpy(lease2->lease_key, lease1->lease_key,
+		SMB2_LEASE_KEY_SIZE);
+	lease2->duration = lease1->duration;
+	lease2->flags = lease1->flags;
+}
+
+static int add_lease_global_list(struct oplock_info *opinfo)
+{
+	struct lease_table *lb;
+
+	read_lock(&lease_list_lock);
+	list_for_each_entry(lb, &lease_table_list, l_entry) {
+		if (!memcmp(lb->client_guid, opinfo->conn->ClientGUID,
+			    SMB2_CLIENT_GUID_SIZE)) {
+			opinfo->o_lease->l_lb = lb;
+			lease_add_list(opinfo);
+			read_unlock(&lease_list_lock);
+			return 0;
+		}
+	}
+	read_unlock(&lease_list_lock);
+
+	lb = kmalloc(sizeof(struct lease_table), GFP_KERNEL);
+	if (!lb)
+		return -ENOMEM;
+
+	memcpy(lb->client_guid, opinfo->conn->ClientGUID,
+			SMB2_CLIENT_GUID_SIZE);
+	INIT_LIST_HEAD(&lb->lease_list);
+	spin_lock_init(&lb->lb_lock);
+	opinfo->o_lease->l_lb = lb;
+	lease_add_list(opinfo);
+	lb_add(lb);
+	return 0;
+}
+
+static void set_oplock_level(struct oplock_info *opinfo, int level,
+		struct lease_ctx_info *lctx)
+{
+	switch (level) {
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	case REQ_OPLOCK:
+	case REQ_BATCHOPLOCK:
+#endif
+	case SMB2_OPLOCK_LEVEL_BATCH:
+	case SMB2_OPLOCK_LEVEL_EXCLUSIVE:
+		grant_write_oplock(opinfo, level, lctx);
+		break;
+	case SMB2_OPLOCK_LEVEL_II:
+		grant_read_oplock(opinfo, lctx);
+		break;
+	default:
+		grant_none_oplock(opinfo, lctx);
+		break;
+	}
+}
+
+/**
+ * smb_grant_oplock() - handle oplock/lease request on file open
+ * @work:		smb work
+ * @req_op_level:	oplock level
+ * @pid:		id of open file
+ * @fp:			ksmbd file pointer
+ * @tid:		Tree id of connection
+ * @lctx:		lease context information on file open
+ * @share_ret:		share mode
+ *
+ * Return:      0 on success, otherwise error
+ */
+int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid,
+		struct ksmbd_file *fp, __u16 tid, struct lease_ctx_info *lctx,
+		int share_ret)
+{
+	struct ksmbd_session *sess = work->sess;
+	int err = 0;
+	struct oplock_info *opinfo = NULL, *prev_opinfo = NULL;
+	struct ksmbd_inode *ci = fp->f_ci;
+	bool prev_op_has_lease;
+	__le32 prev_op_state = 0;
+
+	/* not support directory lease */
+	if (S_ISDIR(file_inode(fp->filp)->i_mode)) {
+		if (lctx)
+			lctx->dlease = 1;
+		return 0;
+	}
+
+	opinfo = alloc_opinfo(work, pid, tid);
+	if (!opinfo)
+		return -ENOMEM;
+
+	if (lctx) {
+		err = alloc_lease(opinfo, lctx);
+		if (err)
+			goto err_out;
+		opinfo->is_lease = 1;
+	}
+
+	/* ci does not have any oplock */
+	if (!opinfo_count(fp))
+		goto set_lev;
+
+	/* grant none-oplock if second open is trunc */
+	if (ATTR_FP(fp)) {
+		req_op_level = SMB2_OPLOCK_LEVEL_NONE;
+		goto set_lev;
+	}
+
+	if (lctx) {
+		struct oplock_info *m_opinfo;
+
+		/* is lease already granted ? */
+		m_opinfo = same_client_has_lease(ci, sess->conn->ClientGUID,
+			lctx);
+		if (m_opinfo) {
+			copy_lease(m_opinfo, opinfo);
+			if (atomic_read(&m_opinfo->breaking_cnt))
+				opinfo->o_lease->flags =
+					SMB2_LEASE_FLAG_BREAK_IN_PROGRESS_LE;
+			goto out;
+		}
+	}
+	prev_opinfo = opinfo_get_list(ci);
+	if (!prev_opinfo ||
+	    (prev_opinfo->level == SMB2_OPLOCK_LEVEL_NONE && lctx))
+		goto set_lev;
+	prev_op_has_lease = prev_opinfo->is_lease;
+	if (prev_op_has_lease)
+		prev_op_state = prev_opinfo->o_lease->state;
+
+	if (share_ret < 0 &&
+	    prev_opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE) {
+		err = share_ret;
+		opinfo_put(prev_opinfo);
+		goto err_out;
+	}
+
+	if (prev_opinfo->level != SMB2_OPLOCK_LEVEL_BATCH &&
+	    prev_opinfo->level != SMB2_OPLOCK_LEVEL_EXCLUSIVE) {
+		opinfo_put(prev_opinfo);
+		goto op_break_not_needed;
+	}
+
+	list_add(&work->interim_entry, &prev_opinfo->interim_list);
+	err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II);
+	opinfo_put(prev_opinfo);
+	if (err == -ENOENT)
+		goto set_lev;
+	/* Check all oplock was freed by close */
+	else if (err < 0)
+		goto err_out;
+
+op_break_not_needed:
+	if (share_ret < 0) {
+		err = share_ret;
+		goto err_out;
+	}
+
+	if (req_op_level != SMB2_OPLOCK_LEVEL_NONE)
+		req_op_level = SMB2_OPLOCK_LEVEL_II;
+
+	/* grant fixed oplock on stacked locking between lease and oplock */
+	if (prev_op_has_lease && !lctx)
+		if (prev_op_state & SMB2_LEASE_HANDLE_CACHING_LE)
+			req_op_level = SMB2_OPLOCK_LEVEL_NONE;
+
+	if (!prev_op_has_lease && lctx) {
+		req_op_level = SMB2_OPLOCK_LEVEL_II;
+		lctx->req_state = SMB2_LEASE_READ_CACHING_LE;
+	}
+
+set_lev:
+	set_oplock_level(opinfo, req_op_level, lctx);
+
+out:
+	rcu_assign_pointer(fp->f_opinfo, opinfo);
+	opinfo->o_fp = fp;
+
+	opinfo_count_inc(fp);
+	opinfo_add(opinfo);
+	if (opinfo->is_lease) {
+		err = add_lease_global_list(opinfo);
+		if (err)
+			goto err_out;
+	}
+
+	return 0;
+err_out:
+	free_opinfo(opinfo);
+	return err;
+}
+
+/**
+ * smb_break_all_write_oplock() - break batch/exclusive oplock to level2
+ * @work:	smb work
+ * @fp:		ksmbd file pointer
+ * @is_trunc:	truncate on open
+ */
+static void smb_break_all_write_oplock(struct ksmbd_work *work,
+		struct ksmbd_file *fp, int is_trunc)
+{
+	struct oplock_info *brk_opinfo;
+
+	brk_opinfo = opinfo_get_list(fp->f_ci);
+	if (!brk_opinfo)
+		return;
+	if (brk_opinfo->level != SMB2_OPLOCK_LEVEL_BATCH &&
+	    brk_opinfo->level != SMB2_OPLOCK_LEVEL_EXCLUSIVE) {
+		opinfo_put(brk_opinfo);
+		return;
+	}
+
+	brk_opinfo->open_trunc = is_trunc;
+	list_add(&work->interim_entry, &brk_opinfo->interim_list);
+	oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II);
+	opinfo_put(brk_opinfo);
+}
+
+/**
+ * smb_break_all_levII_oplock() - send level2 oplock or read lease break command
+ *	from server to client
+ * @work:	smb work
+ * @fp:		ksmbd file pointer
+ * @is_trunc:	truncate on open
+ */
+void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp,
+		int is_trunc)
+{
+	struct oplock_info *op, *brk_op;
+	struct ksmbd_inode *ci;
+	struct ksmbd_conn *conn = work->sess->conn;
+
+	if (!test_share_config_flag(work->tcon->share_conf,
+				    KSMBD_SHARE_FLAG_OPLOCKS))
+		return;
+
+	ci = fp->f_ci;
+	op = opinfo_get(fp);
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(brk_op, &ci->m_op_list, op_entry) {
+		if (!atomic_inc_not_zero(&brk_op->refcount))
+			continue;
+		rcu_read_unlock();
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+		if (brk_op->is_smb2) {
+			if (brk_op->is_lease && (brk_op->o_lease->state &
+					(~(SMB2_LEASE_READ_CACHING_LE |
+					   SMB2_LEASE_HANDLE_CACHING_LE)))) {
+				ksmbd_debug(OPLOCK,
+					"unexpected lease state(0x%x)\n",
+						brk_op->o_lease->state);
+				goto next;
+			} else if (brk_op->level !=
+					SMB2_OPLOCK_LEVEL_II) {
+				ksmbd_debug(OPLOCK, "unexpected oplock(0x%x)\n",
+						brk_op->level);
+				goto next;
+			}
+
+			/* Skip oplock being break to none */
+			if (brk_op->is_lease && (brk_op->o_lease->new_state ==
+					SMB2_LEASE_NONE_LE) &&
+				atomic_read(&brk_op->breaking_cnt))
+				goto next;
+		} else {
+			if (brk_op->level != OPLOCK_READ) {
+				ksmbd_debug(OPLOCK, "unexpected oplock(0x%x)\n",
+					brk_op->level);
+				goto next;
+			}
+		}
+#else
+		if (brk_op->is_lease && (brk_op->o_lease->state &
+		    (~(SMB2_LEASE_READ_CACHING_LE |
+				SMB2_LEASE_HANDLE_CACHING_LE)))) {
+			ksmbd_debug(OPLOCK, "unexpected lease state(0x%x)\n",
+					brk_op->o_lease->state);
+			goto next;
+		} else if (brk_op->level !=
+				SMB2_OPLOCK_LEVEL_II) {
+			ksmbd_debug(OPLOCK, "unexpected oplock(0x%x)\n",
+					brk_op->level);
+			goto next;
+		}
+
+		/* Skip oplock being break to none */
+		if (brk_op->is_lease && (brk_op->o_lease->new_state ==
+				SMB2_LEASE_NONE_LE) &&
+		    atomic_read(&brk_op->breaking_cnt))
+			goto next;
+#endif
+
+		if (op && op->is_lease && brk_op->is_lease &&
+		    !memcmp(conn->ClientGUID, brk_op->conn->ClientGUID,
+			    SMB2_CLIENT_GUID_SIZE) &&
+		    !memcmp(op->o_lease->lease_key, brk_op->o_lease->lease_key,
+			    SMB2_LEASE_KEY_SIZE))
+			goto next;
+		brk_op->open_trunc = is_trunc;
+		oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE);
+next:
+		opinfo_put(brk_op);
+		rcu_read_lock();
+	}
+	rcu_read_unlock();
+
+	if (op)
+		opinfo_put(op);
+}
+
+/**
+ * smb_break_all_oplock() - break both batch/exclusive and level2 oplock
+ * @work:	smb work
+ * @fp:		ksmbd file pointer
+ */
+void smb_break_all_oplock(struct ksmbd_work *work, struct ksmbd_file *fp)
+{
+	if (!test_share_config_flag(work->tcon->share_conf,
+				    KSMBD_SHARE_FLAG_OPLOCKS))
+		return;
+
+	smb_break_all_write_oplock(work, fp, 1);
+	smb_break_all_levII_oplock(work, fp, 1);
+}
+
+/**
+ * smb2_map_lease_to_oplock() - map lease state to corresponding oplock type
+ * @lease_state:     lease type
+ *
+ * Return:      0 if no mapping, otherwise corresponding oplock type
+ */
+__u8 smb2_map_lease_to_oplock(__le32 lease_state)
+{
+	if (lease_state == (SMB2_LEASE_HANDLE_CACHING_LE |
+			    SMB2_LEASE_READ_CACHING_LE |
+			    SMB2_LEASE_WRITE_CACHING_LE)) {
+		return SMB2_OPLOCK_LEVEL_BATCH;
+	} else if (lease_state != SMB2_LEASE_WRITE_CACHING_LE &&
+		 lease_state & SMB2_LEASE_WRITE_CACHING_LE) {
+		if (!(lease_state & SMB2_LEASE_HANDLE_CACHING_LE))
+			return SMB2_OPLOCK_LEVEL_EXCLUSIVE;
+	} else if (lease_state & SMB2_LEASE_READ_CACHING_LE) {
+		return SMB2_OPLOCK_LEVEL_II;
+	}
+	return 0;
+}
+
+/**
+ * create_lease_buf() - create lease context for open cmd response
+ * @rbuf:	buffer to create lease context response
+ * @lease:	buffer to stored parsed lease state information
+ */
+void create_lease_buf(u8 *rbuf, struct lease *lease)
+{
+	struct create_lease *buf = (struct create_lease *)rbuf;
+	char *LeaseKey = (char *)&lease->lease_key;
+
+	memset(buf, 0, sizeof(struct create_lease));
+	buf->lcontext.LeaseKeyLow = *((__le64 *)LeaseKey);
+	buf->lcontext.LeaseKeyHigh = *((__le64 *)(LeaseKey + 8));
+	buf->lcontext.LeaseFlags = lease->flags;
+	buf->lcontext.LeaseState = lease->state;
+	buf->ccontext.DataOffset = cpu_to_le16(offsetof
+					(struct create_lease, lcontext));
+	buf->ccontext.DataLength = cpu_to_le32(sizeof(struct lease_context));
+	buf->ccontext.NameOffset = cpu_to_le16(offsetof
+				(struct create_lease, Name));
+	buf->ccontext.NameLength = cpu_to_le16(4);
+	buf->Name[0] = 'R';
+	buf->Name[1] = 'q';
+	buf->Name[2] = 'L';
+	buf->Name[3] = 's';
+}
+
+/**
+ * parse_lease_state() - parse lease context containted in file open request
+ * @open_req:	buffer containing smb2 file open(create) request
+ *
+ * Return:  oplock state, -ENOENT if create lease context not found
+ */
+struct lease_ctx_info *parse_lease_state(void *open_req)
+{
+	char *data_offset;
+	struct create_context *cc;
+	unsigned int next = 0;
+	char *name;
+	bool found = false;
+	struct smb2_create_req *req = (struct smb2_create_req *)open_req;
+	struct lease_ctx_info *lreq = kzalloc(sizeof(struct lease_ctx_info),
+		GFP_KERNEL);
+	if (!lreq)
+		return NULL;
+
+	data_offset = (char *)req + 4 + le32_to_cpu(req->CreateContextsOffset);
+	cc = (struct create_context *)data_offset;
+	do {
+		cc = (struct create_context *)((char *)cc + next);
+		name = le16_to_cpu(cc->NameOffset) + (char *)cc;
+		if (le16_to_cpu(cc->NameLength) != 4 ||
+		    strncmp(name, SMB2_CREATE_REQUEST_LEASE, 4)) {
+			next = le32_to_cpu(cc->Next);
+			continue;
+		}
+		found = true;
+		break;
+	} while (next != 0);
+
+	if (found) {
+		struct create_lease *lc = (struct create_lease *)cc;
+		*((__le64 *)lreq->lease_key) = lc->lcontext.LeaseKeyLow;
+		*((__le64 *)(lreq->lease_key + 8)) = lc->lcontext.LeaseKeyHigh;
+		lreq->req_state = lc->lcontext.LeaseState;
+		lreq->flags = lc->lcontext.LeaseFlags;
+		lreq->duration = lc->lcontext.LeaseDuration;
+		return lreq;
+	}
+
+	kfree(lreq);
+	return NULL;
+}
+
+/**
+ * smb2_find_context_vals() - find a particular context info in open request
+ * @open_req:	buffer containing smb2 file open(create) request
+ * @tag:	context name to search for
+ *
+ * Return:      pointer to requested context, NULL if @str context not found
+ */
+struct create_context *smb2_find_context_vals(void *open_req, const char *tag)
+{
+	char *data_offset;
+	struct create_context *cc;
+	unsigned int next = 0;
+	char *name;
+	struct smb2_create_req *req = (struct smb2_create_req *)open_req;
+
+	data_offset = (char *)req + 4 + le32_to_cpu(req->CreateContextsOffset);
+	cc = (struct create_context *)data_offset;
+	do {
+		int val;
+
+		cc = (struct create_context *)((char *)cc + next);
+		name = le16_to_cpu(cc->NameOffset) + (char *)cc;
+		val = le16_to_cpu(cc->NameLength);
+		if (val < 4)
+			return ERR_PTR(-EINVAL);
+
+		if (memcmp(name, tag, val) == 0)
+			return cc;
+		next = le32_to_cpu(cc->Next);
+	} while (next != 0);
+
+	return ERR_PTR(-ENOENT);
+}
+
+/**
+ * create_durable_rsp_buf() - create durable handle context
+ * @cc:	buffer to create durable context response
+ */
+void create_durable_rsp_buf(char *cc)
+{
+	struct create_durable_rsp *buf;
+
+	buf = (struct create_durable_rsp *)cc;
+	memset(buf, 0, sizeof(struct create_durable_rsp));
+	buf->ccontext.DataOffset = cpu_to_le16(offsetof
+			(struct create_durable_rsp, Data));
+	buf->ccontext.DataLength = cpu_to_le32(8);
+	buf->ccontext.NameOffset = cpu_to_le16(offsetof
+			(struct create_durable_rsp, Name));
+	buf->ccontext.NameLength = cpu_to_le16(4);
+	/* SMB2_CREATE_DURABLE_HANDLE_RESPONSE is "DHnQ" */
+	buf->Name[0] = 'D';
+	buf->Name[1] = 'H';
+	buf->Name[2] = 'n';
+	buf->Name[3] = 'Q';
+}
+
+/**
+ * create_durable_v2_rsp_buf() - create durable handle v2 context
+ * @cc:	buffer to create durable context response
+ * @fp: ksmbd file pointer
+ */
+void create_durable_v2_rsp_buf(char *cc, struct ksmbd_file *fp)
+{
+	struct create_durable_v2_rsp *buf;
+
+	buf = (struct create_durable_v2_rsp *)cc;
+	memset(buf, 0, sizeof(struct create_durable_rsp));
+	buf->ccontext.DataOffset = cpu_to_le16(offsetof
+			(struct create_durable_rsp, Data));
+	buf->ccontext.DataLength = cpu_to_le32(8);
+	buf->ccontext.NameOffset = cpu_to_le16(offsetof
+			(struct create_durable_rsp, Name));
+	buf->ccontext.NameLength = cpu_to_le16(4);
+	/* SMB2_CREATE_DURABLE_HANDLE_RESPONSE_V2 is "DH2Q" */
+	buf->Name[0] = 'D';
+	buf->Name[1] = 'H';
+	buf->Name[2] = '2';
+	buf->Name[3] = 'Q';
+
+	buf->Timeout = cpu_to_le32(fp->durable_timeout);
+	if (fp->is_persistent)
+		buf->Flags = SMB2_FLAGS_REPLAY_OPERATIONS;
+}
+
+/**
+ * create_mxac_rsp_buf() - create query maximal access context
+ * @cc:			buffer to create maximal access context response
+ * @maximal_access:	maximal access
+ */
+void create_mxac_rsp_buf(char *cc, int maximal_access)
+{
+	struct create_mxac_rsp *buf;
+
+	buf = (struct create_mxac_rsp *)cc;
+	memset(buf, 0, sizeof(struct create_mxac_rsp));
+	buf->ccontext.DataOffset = cpu_to_le16(offsetof
+			(struct create_mxac_rsp, QueryStatus));
+	buf->ccontext.DataLength = cpu_to_le32(8);
+	buf->ccontext.NameOffset = cpu_to_le16(offsetof
+			(struct create_mxac_rsp, Name));
+	buf->ccontext.NameLength = cpu_to_le16(4);
+	/* SMB2_CREATE_QUERY_MAXIMAL_ACCESS_RESPONSE is "MxAc" */
+	buf->Name[0] = 'M';
+	buf->Name[1] = 'x';
+	buf->Name[2] = 'A';
+	buf->Name[3] = 'c';
+
+	buf->QueryStatus = STATUS_SUCCESS;
+	buf->MaximalAccess = cpu_to_le32(maximal_access);
+}
+
+void create_disk_id_rsp_buf(char *cc, __u64 file_id, __u64 vol_id)
+{
+	struct create_disk_id_rsp *buf;
+
+	buf = (struct create_disk_id_rsp *)cc;
+	memset(buf, 0, sizeof(struct create_disk_id_rsp));
+	buf->ccontext.DataOffset = cpu_to_le16(offsetof
+			(struct create_disk_id_rsp, DiskFileId));
+	buf->ccontext.DataLength = cpu_to_le32(32);
+	buf->ccontext.NameOffset = cpu_to_le16(offsetof
+			(struct create_mxac_rsp, Name));
+	buf->ccontext.NameLength = cpu_to_le16(4);
+	/* SMB2_CREATE_QUERY_ON_DISK_ID_RESPONSE is "QFid" */
+	buf->Name[0] = 'Q';
+	buf->Name[1] = 'F';
+	buf->Name[2] = 'i';
+	buf->Name[3] = 'd';
+
+	buf->DiskFileId = cpu_to_le64(file_id);
+	buf->VolumeId = cpu_to_le64(vol_id);
+}
+
+/**
+ * create_posix_rsp_buf() - create posix extension context
+ * @cc:	buffer to create posix on posix response
+ * @fp: ksmbd file pointer
+ */
+void create_posix_rsp_buf(char *cc, struct ksmbd_file *fp)
+{
+	struct create_posix_rsp *buf;
+	struct inode *inode = FP_INODE(fp);
+
+	buf = (struct create_posix_rsp *)cc;
+	memset(buf, 0, sizeof(struct create_posix_rsp));
+	buf->ccontext.DataOffset = cpu_to_le16(offsetof
+			(struct create_posix_rsp, nlink));
+	buf->ccontext.DataLength = cpu_to_le32(52);
+	buf->ccontext.NameOffset = cpu_to_le16(offsetof
+			(struct create_posix_rsp, Name));
+	buf->ccontext.NameLength = cpu_to_le16(POSIX_CTXT_DATA_LEN);
+	/* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */
+	buf->Name[0] = 0x93;
+	buf->Name[1] = 0xAD;
+	buf->Name[2] = 0x25;
+	buf->Name[3] = 0x50;
+	buf->Name[4] = 0x9C;
+	buf->Name[5] = 0xB4;
+	buf->Name[6] = 0x11;
+	buf->Name[7] = 0xE7;
+	buf->Name[8] = 0xB4;
+	buf->Name[9] = 0x23;
+	buf->Name[10] = 0x83;
+	buf->Name[11] = 0xDE;
+	buf->Name[12] = 0x96;
+	buf->Name[13] = 0x8B;
+	buf->Name[14] = 0xCD;
+	buf->Name[15] = 0x7C;
+
+	buf->nlink = cpu_to_le32(inode->i_nlink);
+	buf->reparse_tag = cpu_to_le32(fp->volatile_id);
+	buf->mode = cpu_to_le32(inode->i_mode);
+	id_to_sid(from_kuid(&init_user_ns, inode->i_uid),
+		SIDNFS_USER, (struct smb_sid *)&buf->SidBuffer[0]);
+	id_to_sid(from_kgid(&init_user_ns, inode->i_gid),
+		SIDNFS_GROUP, (struct smb_sid *)&buf->SidBuffer[20]);
+}
+
+/*
+ * Find lease object(opinfo) for given lease key/fid from lease
+ * break/file close path.
+ */
+/**
+ * lookup_lease_in_table() - find a matching lease info object
+ * @conn:	connection instance
+ * @lease_key:	lease key to be searched for
+ *
+ * Return:      opinfo if found matching opinfo, otherwise NULL
+ */
+struct oplock_info *lookup_lease_in_table(struct ksmbd_conn *conn,
+		char *lease_key)
+{
+	struct oplock_info *opinfo = NULL, *ret_op = NULL;
+	struct lease_table *lt;
+	int ret;
+
+	read_lock(&lease_list_lock);
+	list_for_each_entry(lt, &lease_table_list, l_entry) {
+		if (!memcmp(lt->client_guid, conn->ClientGUID,
+			    SMB2_CLIENT_GUID_SIZE))
+			goto found;
+	}
+
+	read_unlock(&lease_list_lock);
+	return NULL;
+
+found:
+	rcu_read_lock();
+	list_for_each_entry_rcu(opinfo, &lt->lease_list, lease_entry) {
+		if (!atomic_inc_not_zero(&opinfo->refcount))
+			continue;
+		rcu_read_unlock();
+		if (!opinfo->op_state || opinfo->op_state == OPLOCK_CLOSING)
+			goto op_next;
+		if (!(opinfo->o_lease->state &
+		      (SMB2_LEASE_HANDLE_CACHING_LE |
+		       SMB2_LEASE_WRITE_CACHING_LE)))
+			goto op_next;
+		ret = compare_guid_key(opinfo, conn->ClientGUID,
+			lease_key);
+		if (ret) {
+			ksmbd_debug(OPLOCK, "found opinfo\n");
+			ret_op = opinfo;
+			goto out;
+		}
+op_next:
+		opinfo_put(opinfo);
+		rcu_read_lock();
+	}
+	rcu_read_unlock();
+
+out:
+	read_unlock(&lease_list_lock);
+	return ret_op;
+}
+
+int smb2_check_durable_oplock(struct ksmbd_file *fp,
+		struct lease_ctx_info *lctx, char *name)
+{
+	struct oplock_info *opinfo = opinfo_get(fp);
+	int ret = 0;
+
+	if (opinfo && opinfo->is_lease) {
+		if (!lctx) {
+			ksmbd_err("open does not include lease\n");
+			ret = -EBADF;
+			goto out;
+		}
+		if (memcmp(opinfo->o_lease->lease_key, lctx->lease_key,
+			   SMB2_LEASE_KEY_SIZE)) {
+			ksmbd_err("invalid lease key\n");
+			ret = -EBADF;
+			goto out;
+		}
+		if (name && strcmp(fp->filename, name)) {
+			ksmbd_err("invalid name reconnect %s\n", name);
+			ret = -EINVAL;
+			goto out;
+		}
+	}
+out:
+	if (opinfo)
+		opinfo_put(opinfo);
+	return ret;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./oplock.h linux-5.4.60-fbx/fs/cifsd/oplock.h
--- linux-5.4.60-fbx/fs/cifsd./oplock.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/oplock.h	2021-04-21 09:44:50.978505152 +0200
@@ -0,0 +1,136 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __KSMBD_OPLOCK_H
+#define __KSMBD_OPLOCK_H
+
+#include "smb_common.h"
+
+#define OPLOCK_WAIT_TIME	(35 * HZ)
+
+/* SMB Oplock levels */
+#define OPLOCK_NONE      0
+#define OPLOCK_EXCLUSIVE 1
+#define OPLOCK_BATCH     2
+#define OPLOCK_READ      3  /* level 2 oplock */
+
+/* SMB2 Oplock levels */
+#define SMB2_OPLOCK_LEVEL_NONE          0x00
+#define SMB2_OPLOCK_LEVEL_II            0x01
+#define SMB2_OPLOCK_LEVEL_EXCLUSIVE     0x08
+#define SMB2_OPLOCK_LEVEL_BATCH         0x09
+#define SMB2_OPLOCK_LEVEL_LEASE         0xFF
+
+/* Oplock states */
+#define OPLOCK_STATE_NONE	0x00
+#define OPLOCK_ACK_WAIT		0x01
+#define OPLOCK_CLOSING		0x02
+
+#define OPLOCK_WRITE_TO_READ		0x01
+#define OPLOCK_READ_HANDLE_TO_READ	0x02
+#define OPLOCK_WRITE_TO_NONE		0x04
+#define OPLOCK_READ_TO_NONE		0x08
+
+#define SMB2_LEASE_KEY_SIZE		16
+
+struct lease_ctx_info {
+	__u8	lease_key[SMB2_LEASE_KEY_SIZE];
+	__le32	req_state;
+	__le32	flags;
+	__le64	duration;
+	int dlease;
+};
+
+struct lease_table {
+	char			client_guid[SMB2_CLIENT_GUID_SIZE];
+	struct list_head	lease_list;
+	struct list_head	l_entry;
+	spinlock_t		lb_lock;
+};
+
+struct lease {
+	__u8			lease_key[SMB2_LEASE_KEY_SIZE];
+	__le32			state;
+	__le32			new_state;
+	__le32			flags;
+	__le64			duration;
+	struct lease_table	*l_lb;
+};
+
+struct oplock_info {
+	struct ksmbd_conn	*conn;
+	struct ksmbd_session	*sess;
+	struct ksmbd_work	*work;
+	struct ksmbd_file	*o_fp;
+	int                     level;
+	int                     op_state;
+	unsigned long		pending_break;
+	u64			fid;
+	atomic_t		breaking_cnt;
+	atomic_t		refcount;
+	__u16                   Tid;
+	bool			is_lease;
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	bool			is_smb2;
+#endif
+	bool			open_trunc;	/* truncate on open */
+	struct lease		*o_lease;
+	struct list_head        interim_list;
+	struct list_head        op_entry;
+	struct list_head        lease_entry;
+	wait_queue_head_t oplock_q; /* Other server threads */
+	wait_queue_head_t oplock_brk; /* oplock breaking wait */
+	struct rcu_head		rcu_head;
+};
+
+struct lease_break_info {
+	__le32			curr_state;
+	__le32			new_state;
+	char			lease_key[SMB2_LEASE_KEY_SIZE];
+};
+
+struct oplock_break_info {
+	int level;
+	int open_trunc;
+	int fid;
+};
+
+int smb_grant_oplock(struct ksmbd_work *work, int req_op_level,
+		u64 pid, struct ksmbd_file *fp, __u16 tid,
+		struct lease_ctx_info *lctx, int share_ret);
+void smb_break_all_levII_oplock(struct ksmbd_work *work,
+		struct ksmbd_file *fp, int is_trunc);
+
+int opinfo_write_to_read(struct oplock_info *opinfo);
+int opinfo_read_handle_to_read(struct oplock_info *opinfo);
+int opinfo_write_to_none(struct oplock_info *opinfo);
+int opinfo_read_to_none(struct oplock_info *opinfo);
+void close_id_del_oplock(struct ksmbd_file *fp);
+void smb_break_all_oplock(struct ksmbd_work *work, struct ksmbd_file *fp);
+struct oplock_info *opinfo_get(struct ksmbd_file *fp);
+void opinfo_put(struct oplock_info *opinfo);
+
+/* Lease related functions */
+void create_lease_buf(u8 *rbuf, struct lease *lease);
+struct lease_ctx_info *parse_lease_state(void *open_req);
+__u8 smb2_map_lease_to_oplock(__le32 lease_state);
+int lease_read_to_write(struct oplock_info *opinfo);
+
+/* Durable related functions */
+void create_durable_rsp_buf(char *cc);
+void create_durable_v2_rsp_buf(char *cc, struct ksmbd_file *fp);
+void create_mxac_rsp_buf(char *cc, int maximal_access);
+void create_disk_id_rsp_buf(char *cc, __u64 file_id, __u64 vol_id);
+void create_posix_rsp_buf(char *cc, struct ksmbd_file *fp);
+struct create_context *smb2_find_context_vals(void *open_req, const char *str);
+struct oplock_info *lookup_lease_in_table(struct ksmbd_conn *conn,
+		char *lease_key);
+int find_same_lease_key(struct ksmbd_session *sess, struct ksmbd_inode *ci,
+		struct lease_ctx_info *lctx);
+void destroy_lease_table(struct ksmbd_conn *conn);
+int smb2_check_durable_oplock(struct ksmbd_file *fp,
+		struct lease_ctx_info *lctx, char *name);
+#endif /* __KSMBD_OPLOCK_H */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./server.c linux-5.4.60-fbx/fs/cifsd/server.c
--- linux-5.4.60-fbx/fs/cifsd./server.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/server.c	2021-04-21 09:44:50.978505152 +0200
@@ -0,0 +1,631 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include "glob.h"
+#include "oplock.h"
+#include "misc.h"
+#include <linux/sched/signal.h>
+#include <linux/workqueue.h>
+#include <linux/sysfs.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+
+#include "server.h"
+#include "smb_common.h"
+#include "smbstatus.h"
+#include "buffer_pool.h"
+#include "connection.h"
+#include "transport_ipc.h"
+#include "mgmt/user_session.h"
+#include "crypto_ctx.h"
+#include "auth.h"
+
+int ksmbd_debug_types;
+
+struct ksmbd_server_config server_conf;
+
+enum SERVER_CTRL_TYPE {
+	SERVER_CTRL_TYPE_INIT,
+	SERVER_CTRL_TYPE_RESET,
+};
+
+struct server_ctrl_struct {
+	int			type;
+	struct work_struct	ctrl_work;
+};
+
+static DEFINE_MUTEX(ctrl_lock);
+
+static int ___server_conf_set(int idx, char *val)
+{
+	if (idx >= ARRAY_SIZE(server_conf.conf))
+		return -EINVAL;
+
+	if (!val || val[0] == 0x00)
+		return -EINVAL;
+
+	kfree(server_conf.conf[idx]);
+	server_conf.conf[idx] = kstrdup(val, GFP_KERNEL);
+	if (!server_conf.conf[idx])
+		return -ENOMEM;
+	return 0;
+}
+
+int ksmbd_set_netbios_name(char *v)
+{
+	return ___server_conf_set(SERVER_CONF_NETBIOS_NAME, v);
+}
+
+int ksmbd_set_server_string(char *v)
+{
+	return ___server_conf_set(SERVER_CONF_SERVER_STRING, v);
+}
+
+int ksmbd_set_work_group(char *v)
+{
+	return ___server_conf_set(SERVER_CONF_WORK_GROUP, v);
+}
+
+char *ksmbd_netbios_name(void)
+{
+	return server_conf.conf[SERVER_CONF_NETBIOS_NAME];
+}
+
+char *ksmbd_server_string(void)
+{
+	return server_conf.conf[SERVER_CONF_SERVER_STRING];
+}
+
+char *ksmbd_work_group(void)
+{
+	return server_conf.conf[SERVER_CONF_WORK_GROUP];
+}
+
+/**
+ * check_conn_state() - check state of server thread connection
+ * @work:     smb work containing server thread information
+ *
+ * Return:	0 on valid connection, otherwise 1 to reconnect
+ */
+static inline int check_conn_state(struct ksmbd_work *work)
+{
+	struct smb_hdr *rsp_hdr;
+
+	if (ksmbd_conn_exiting(work) || ksmbd_conn_need_reconnect(work)) {
+		rsp_hdr = work->response_buf;
+		rsp_hdr->Status.CifsError = STATUS_CONNECTION_DISCONNECTED;
+		return 1;
+	}
+	return 0;
+}
+
+#define TCP_HANDLER_CONTINUE	0
+#define TCP_HANDLER_ABORT	1
+
+static int __process_request(struct ksmbd_work *work, struct ksmbd_conn *conn,
+		uint16_t *cmd)
+{
+	struct smb_version_cmds *cmds;
+	uint16_t command;
+	int ret;
+
+	if (check_conn_state(work))
+		return TCP_HANDLER_CONTINUE;
+
+	if (ksmbd_verify_smb_message(work))
+		return TCP_HANDLER_ABORT;
+
+	command = conn->ops->get_cmd_val(work);
+	*cmd = command;
+
+andx_again:
+	if (command >= conn->max_cmds) {
+		conn->ops->set_rsp_status(work, STATUS_INVALID_PARAMETER);
+		return TCP_HANDLER_CONTINUE;
+	}
+
+	cmds = &conn->cmds[command];
+	if (!cmds->proc) {
+		ksmbd_debug(SMB, "*** not implemented yet cmd = %x\n", command);
+		conn->ops->set_rsp_status(work, STATUS_NOT_IMPLEMENTED);
+		return TCP_HANDLER_CONTINUE;
+	}
+
+	if (work->sess && conn->ops->is_sign_req(work, command)) {
+		ret = conn->ops->check_sign_req(work);
+		if (!ret) {
+			conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED);
+			return TCP_HANDLER_CONTINUE;
+		}
+	}
+
+	ret = cmds->proc(work);
+
+	if (ret < 0)
+		ksmbd_debug(CONN, "Failed to process %u [%d]\n", command, ret);
+	/* AndX commands - chained request can return positive values */
+	else if (ret > 0) {
+		command = ret;
+		*cmd = command;
+		goto andx_again;
+	}
+
+	if (work->send_no_response)
+		return TCP_HANDLER_ABORT;
+	return TCP_HANDLER_CONTINUE;
+}
+
+static void __handle_ksmbd_work(struct ksmbd_work *work,
+		struct ksmbd_conn *conn)
+{
+	u16 command = 0;
+	int rc;
+
+	if (conn->ops->allocate_rsp_buf(work))
+		return;
+
+	if (conn->ops->is_transform_hdr &&
+	    conn->ops->is_transform_hdr(work->request_buf)) {
+		rc = conn->ops->decrypt_req(work);
+		if (rc < 0) {
+			conn->ops->set_rsp_status(work, STATUS_DATA_ERROR);
+			goto send;
+		}
+
+		work->encrypted = true;
+	}
+
+	rc = conn->ops->init_rsp_hdr(work);
+	if (rc) {
+		/* either uid or tid is not correct */
+		conn->ops->set_rsp_status(work, STATUS_INVALID_HANDLE);
+		goto send;
+	}
+
+	if (conn->ops->check_user_session) {
+		rc = conn->ops->check_user_session(work);
+		if (rc < 0) {
+			command = conn->ops->get_cmd_val(work);
+			conn->ops->set_rsp_status(work,
+					STATUS_USER_SESSION_DELETED);
+			goto send;
+		} else if (rc > 0) {
+			rc = conn->ops->get_ksmbd_tcon(work);
+			if (rc < 0) {
+				conn->ops->set_rsp_status(work,
+					STATUS_NETWORK_NAME_DELETED);
+				goto send;
+			}
+		}
+	}
+
+	do {
+		rc = __process_request(work, conn, &command);
+		if (rc == TCP_HANDLER_ABORT)
+			break;
+
+		/*
+		 * Call smb2_set_rsp_credits() function to set number of credits
+		 * granted in hdr of smb2 response.
+		 */
+		if (conn->ops->set_rsp_credits) {
+			spin_lock(&conn->credits_lock);
+			rc = conn->ops->set_rsp_credits(work);
+			spin_unlock(&conn->credits_lock);
+			if (rc < 0) {
+				conn->ops->set_rsp_status(work,
+					STATUS_INVALID_PARAMETER);
+				goto send;
+			}
+		}
+
+		if (work->sess && (work->sess->sign ||
+		    smb3_11_final_sess_setup_resp(work) ||
+		     conn->ops->is_sign_req(work, command)))
+			conn->ops->set_sign_rsp(work);
+	} while (is_chained_smb2_message(work));
+
+	if (work->send_no_response)
+		return;
+
+send:
+	smb3_preauth_hash_rsp(work);
+	if (work->sess && work->sess->enc && work->encrypted &&
+	    conn->ops->encrypt_resp) {
+		rc = conn->ops->encrypt_resp(work);
+		if (rc < 0) {
+			conn->ops->set_rsp_status(work, STATUS_DATA_ERROR);
+			goto send;
+		}
+	}
+
+	ksmbd_conn_write(work);
+}
+
+/**
+ * handle_ksmbd_work() - process pending smb work requests
+ * @wk:	smb work containing request command buffer
+ *
+ * called by kworker threads to processing remaining smb work requests
+ */
+static void handle_ksmbd_work(struct work_struct *wk)
+{
+	struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work);
+	struct ksmbd_conn *conn = work->conn;
+
+	atomic64_inc(&conn->stats.request_served);
+
+	__handle_ksmbd_work(work, conn);
+
+	ksmbd_conn_try_dequeue_request(work);
+	ksmbd_free_work_struct(work);
+	atomic_dec(&conn->r_count);
+}
+
+/**
+ * queue_ksmbd_work() - queue a smb request to worker thread queue
+ *		for proccessing smb command and sending response
+ * @conn:	connection instance
+ *
+ * read remaining data from socket create and submit work.
+ */
+static int queue_ksmbd_work(struct ksmbd_conn *conn)
+{
+	struct ksmbd_work *work;
+
+	work = ksmbd_alloc_work_struct();
+	if (!work) {
+		ksmbd_err("allocation for work failed\n");
+		return -ENOMEM;
+	}
+
+	work->conn = conn;
+	work->request_buf = conn->request_buf;
+	conn->request_buf = NULL;
+
+	if (ksmbd_init_smb_server(work)) {
+		ksmbd_free_work_struct(work);
+		return -EINVAL;
+	}
+
+	ksmbd_conn_enqueue_request(work);
+	atomic_inc(&conn->r_count);
+	/* update activity on connection */
+	conn->last_active = jiffies;
+	INIT_WORK(&work->work, handle_ksmbd_work);
+	ksmbd_queue_work(work);
+	return 0;
+}
+
+static int ksmbd_server_process_request(struct ksmbd_conn *conn)
+{
+	return queue_ksmbd_work(conn);
+}
+
+static int ksmbd_server_terminate_conn(struct ksmbd_conn *conn)
+{
+	ksmbd_sessions_deregister(conn);
+	destroy_lease_table(conn);
+	return 0;
+}
+
+static void ksmbd_server_tcp_callbacks_init(void)
+{
+	struct ksmbd_conn_ops ops;
+
+	ops.process_fn = ksmbd_server_process_request;
+	ops.terminate_fn = ksmbd_server_terminate_conn;
+
+	ksmbd_conn_init_server_callbacks(&ops);
+}
+
+static void server_conf_free(void)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(server_conf.conf); i++) {
+		kfree(server_conf.conf[i]);
+		server_conf.conf[i] = NULL;
+	}
+}
+
+static int server_conf_init(void)
+{
+	WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP);
+	server_conf.enforced_signing = 0;
+	server_conf.min_protocol = ksmbd_min_protocol();
+	server_conf.max_protocol = ksmbd_max_protocol();
+	server_conf.auth_mechs = KSMBD_AUTH_NTLMSSP;
+#ifdef CONFIG_SMB_SERVER_KERBEROS5
+	server_conf.auth_mechs |= KSMBD_AUTH_KRB5 |
+				KSMBD_AUTH_MSKRB5;
+#endif
+	return 0;
+}
+
+static void server_ctrl_handle_init(struct server_ctrl_struct *ctrl)
+{
+	int ret;
+
+	ret = ksmbd_conn_transport_init();
+	if (ret) {
+		server_queue_ctrl_reset_work();
+		return;
+	}
+
+	WRITE_ONCE(server_conf.state, SERVER_STATE_RUNNING);
+}
+
+static void server_ctrl_handle_reset(struct server_ctrl_struct *ctrl)
+{
+	ksmbd_ipc_soft_reset();
+	ksmbd_conn_transport_destroy();
+	server_conf_free();
+	server_conf_init();
+	WRITE_ONCE(server_conf.state, SERVER_STATE_STARTING_UP);
+}
+
+static void server_ctrl_handle_work(struct work_struct *work)
+{
+	struct server_ctrl_struct *ctrl;
+
+	ctrl = container_of(work, struct server_ctrl_struct, ctrl_work);
+
+	mutex_lock(&ctrl_lock);
+	switch (ctrl->type) {
+	case SERVER_CTRL_TYPE_INIT:
+		server_ctrl_handle_init(ctrl);
+		break;
+	case SERVER_CTRL_TYPE_RESET:
+		server_ctrl_handle_reset(ctrl);
+		break;
+	default:
+		pr_err("Unknown server work type: %d\n", ctrl->type);
+	}
+	mutex_unlock(&ctrl_lock);
+	kfree(ctrl);
+	module_put(THIS_MODULE);
+}
+
+static int __queue_ctrl_work(int type)
+{
+	struct server_ctrl_struct *ctrl;
+
+	ctrl = kmalloc(sizeof(struct server_ctrl_struct), GFP_KERNEL);
+	if (!ctrl)
+		return -ENOMEM;
+
+	__module_get(THIS_MODULE);
+	ctrl->type = type;
+	INIT_WORK(&ctrl->ctrl_work, server_ctrl_handle_work);
+	queue_work(system_long_wq, &ctrl->ctrl_work);
+	return 0;
+}
+
+int server_queue_ctrl_init_work(void)
+{
+	return __queue_ctrl_work(SERVER_CTRL_TYPE_INIT);
+}
+
+int server_queue_ctrl_reset_work(void)
+{
+	return __queue_ctrl_work(SERVER_CTRL_TYPE_RESET);
+}
+
+static ssize_t stats_show(struct class *class, struct class_attribute *attr,
+		char *buf)
+{
+	/*
+	 * Inc this each time you change stats output format,
+	 * so user space will know what to do.
+	 */
+	static int stats_version = 2;
+	static const char * const state[] = {
+		"startup",
+		"running",
+		"reset",
+		"shutdown"
+	};
+
+	ssize_t sz = scnprintf(buf,
+				PAGE_SIZE,
+				"%d %s %d %lu\n",
+				stats_version,
+				state[server_conf.state],
+				server_conf.tcp_port,
+				server_conf.ipc_last_active / HZ);
+	return sz;
+}
+
+static ssize_t kill_server_store(struct class *class,
+		struct class_attribute *attr, const char *buf,
+		size_t len)
+{
+	if (!sysfs_streq(buf, "hard"))
+		return len;
+
+	ksmbd_info("kill command received\n");
+	mutex_lock(&ctrl_lock);
+	WRITE_ONCE(server_conf.state, SERVER_STATE_RESETTING);
+	__module_get(THIS_MODULE);
+	server_ctrl_handle_reset(NULL);
+	module_put(THIS_MODULE);
+	mutex_unlock(&ctrl_lock);
+	return len;
+}
+
+static const char * const debug_type_strings[] = {"smb", "auth", "vfs",
+						"oplock", "ipc", "conn",
+						"rdma"};
+
+static ssize_t debug_show(struct class *class, struct class_attribute *attr,
+		char *buf)
+{
+	ssize_t sz = 0;
+	int i, pos = 0;
+
+	for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) {
+		if ((ksmbd_debug_types >> i) & 1) {
+			pos = scnprintf(buf + sz,
+					PAGE_SIZE - sz,
+					"[%s] ",
+					debug_type_strings[i]);
+		} else {
+			pos = scnprintf(buf + sz,
+					PAGE_SIZE - sz,
+					"%s ",
+					debug_type_strings[i]);
+		}
+		sz += pos;
+	}
+	sz += scnprintf(buf + sz, PAGE_SIZE - sz, "\n");
+	return sz;
+}
+
+static ssize_t debug_store(struct class *class, struct class_attribute *attr,
+		const char *buf, size_t len)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(debug_type_strings); i++) {
+		if (sysfs_streq(buf, "all")) {
+			if (ksmbd_debug_types == KSMBD_DEBUG_ALL)
+				ksmbd_debug_types = 0;
+			else
+				ksmbd_debug_types = KSMBD_DEBUG_ALL;
+			break;
+		}
+
+		if (sysfs_streq(buf, debug_type_strings[i])) {
+			if (ksmbd_debug_types & (1 << i))
+				ksmbd_debug_types &= ~(1 << i);
+			else
+				ksmbd_debug_types |= (1 << i);
+			break;
+		}
+	}
+
+	return len;
+}
+
+static CLASS_ATTR_RO(stats);
+static CLASS_ATTR_WO(kill_server);
+static CLASS_ATTR_RW(debug);
+
+static struct attribute *ksmbd_control_class_attrs[] = {
+	&class_attr_stats.attr,
+	&class_attr_kill_server.attr,
+	&class_attr_debug.attr,
+	NULL,
+};
+ATTRIBUTE_GROUPS(ksmbd_control_class);
+
+static struct class ksmbd_control_class = {
+	.name		= "ksmbd-control",
+	.owner		= THIS_MODULE,
+	.class_groups	= ksmbd_control_class_groups,
+};
+
+static int ksmbd_server_shutdown(void)
+{
+	WRITE_ONCE(server_conf.state, SERVER_STATE_SHUTTING_DOWN);
+
+	class_unregister(&ksmbd_control_class);
+	ksmbd_workqueue_destroy();
+	ksmbd_ipc_release();
+	ksmbd_conn_transport_destroy();
+	ksmbd_crypto_destroy();
+	ksmbd_free_global_file_table();
+	destroy_lease_table(NULL);
+	ksmbd_destroy_buffer_pools();
+	server_conf_free();
+	return 0;
+}
+
+static int __init ksmbd_server_init(void)
+{
+	int ret;
+
+	ret = class_register(&ksmbd_control_class);
+	if (ret) {
+		ksmbd_err("Unable to register ksmbd-control class\n");
+		return ret;
+	}
+
+	ksmbd_server_tcp_callbacks_init();
+
+	ret = server_conf_init();
+	if (ret)
+		goto err_unregister;
+
+	ret = ksmbd_init_buffer_pools();
+	if (ret)
+		goto err_unregister;
+
+	ret = ksmbd_ipc_init();
+	if (ret)
+		goto err_free_session_table;
+
+	ret = ksmbd_init_global_file_table();
+	if (ret)
+		goto err_ipc_release;
+
+	ret = ksmbd_inode_hash_init();
+	if (ret)
+		goto err_destroy_file_table;
+
+	ret = ksmbd_crypto_create();
+	if (ret)
+		goto err_release_inode_hash;
+
+	ret = ksmbd_workqueue_init();
+	if (ret)
+		goto err_crypto_destroy;
+	return 0;
+
+err_crypto_destroy:
+	ksmbd_crypto_destroy();
+err_release_inode_hash:
+	ksmbd_release_inode_hash();
+err_destroy_file_table:
+	ksmbd_free_global_file_table();
+err_ipc_release:
+	ksmbd_ipc_release();
+err_free_session_table:
+	ksmbd_destroy_buffer_pools();
+err_unregister:
+	class_unregister(&ksmbd_control_class);
+
+	return ret;
+}
+
+/**
+ * ksmbd_server_exit() - shutdown forker thread and free memory at module exit
+ */
+static void __exit ksmbd_server_exit(void)
+{
+	ksmbd_server_shutdown();
+	ksmbd_release_inode_hash();
+}
+
+MODULE_AUTHOR("Namjae Jeon <linkinjeon@kernel.org>");
+MODULE_VERSION(KSMBD_VERSION);
+MODULE_DESCRIPTION("Linux kernel CIFS/SMB SERVER");
+MODULE_LICENSE("GPL");
+MODULE_SOFTDEP("pre: ecb");
+MODULE_SOFTDEP("pre: hmac");
+MODULE_SOFTDEP("pre: md4");
+MODULE_SOFTDEP("pre: md5");
+MODULE_SOFTDEP("pre: nls");
+MODULE_SOFTDEP("pre: aes");
+MODULE_SOFTDEP("pre: cmac");
+MODULE_SOFTDEP("pre: sha256");
+MODULE_SOFTDEP("pre: sha512");
+MODULE_SOFTDEP("pre: aead2");
+MODULE_SOFTDEP("pre: ccm");
+MODULE_SOFTDEP("pre: gcm");
+module_init(ksmbd_server_init)
+module_exit(ksmbd_server_exit)
diff -Nruw linux-5.4.60-fbx/fs/cifsd./server.h linux-5.4.60-fbx/fs/cifsd/server.h
--- linux-5.4.60-fbx/fs/cifsd./server.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/server.h	2021-04-21 09:44:50.978505152 +0200
@@ -0,0 +1,60 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __SERVER_H__
+#define __SERVER_H__
+
+#include "smbacl.h"
+
+#define SERVER_STATE_STARTING_UP	0
+#define SERVER_STATE_RUNNING		1
+#define SERVER_STATE_RESETTING		2
+#define SERVER_STATE_SHUTTING_DOWN	3
+
+#define SERVER_CONF_NETBIOS_NAME	0
+#define SERVER_CONF_SERVER_STRING	1
+#define SERVER_CONF_WORK_GROUP		2
+
+struct ksmbd_server_config {
+	unsigned int		flags;
+	unsigned int		state;
+	short			signing;
+	short			enforced_signing;
+	short			min_protocol;
+	short			max_protocol;
+	unsigned short		tcp_port;
+	unsigned short		ipc_timeout;
+	unsigned long		ipc_last_active;
+	unsigned long		deadtime;
+	unsigned int		share_fake_fscaps;
+	struct smb_sid		domain_sid;
+	unsigned int		auth_mechs;
+
+	char			*conf[SERVER_CONF_WORK_GROUP + 1];
+};
+
+extern struct ksmbd_server_config server_conf;
+
+int ksmbd_set_netbios_name(char *v);
+int ksmbd_set_server_string(char *v);
+int ksmbd_set_work_group(char *v);
+
+char *ksmbd_netbios_name(void);
+char *ksmbd_server_string(void);
+char *ksmbd_work_group(void);
+
+static inline int ksmbd_server_running(void)
+{
+	return READ_ONCE(server_conf.state) == SERVER_STATE_RUNNING;
+}
+
+static inline int ksmbd_server_configurable(void)
+{
+	return READ_ONCE(server_conf.state) < SERVER_STATE_RESETTING;
+}
+
+int server_queue_ctrl_init_work(void);
+int server_queue_ctrl_reset_work(void);
+#endif /* __SERVER_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smb1misc.c linux-5.4.60-fbx/fs/cifsd/smb1misc.c
--- linux-5.4.60-fbx/fs/cifsd./smb1misc.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smb1misc.c	2021-03-30 16:07:01.588436216 +0200
@@ -0,0 +1,297 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include "glob.h"
+#include "asn1.h"
+#include "nterr.h"
+#include "ksmbd_work.h"
+#include "smb_common.h"
+#include "smb1pdu.h"
+#include "mgmt/user_session.h"
+
+/**
+ * check_smb_hdr() - check for valid smb request header
+ * @smb:        smb header to be checked
+ *
+ * check for valid smb signature and packet direction(request/response)
+ * TODO: properly check client authetication and tree authentication
+ *
+ * Return:      0 on success, otherwise 1
+ */
+static int check_smb1_hdr(struct smb_hdr *smb)
+{
+	/* does it have the right SMB "signature" ? */
+	if (*(__le32 *) smb->Protocol != SMB1_PROTO_NUMBER) {
+		ksmbd_debug(SMB, "Bad protocol string signature header 0x%x\n",
+				*(unsigned int *)smb->Protocol);
+		return 1;
+	}
+	ksmbd_debug(SMB, "got SMB\n");
+
+	/* if it's not a response then accept */
+	/* TODO : check for oplock break */
+	if (!(smb->Flags & SMBFLG_RESPONSE))
+		return 0;
+
+	ksmbd_debug(SMB, "Server sent request, not response\n");
+	return 1;
+}
+
+
+static int smb1_req_struct_size(struct smb_hdr *hdr)
+{
+	int wc = hdr->WordCount;
+
+	switch (hdr->Command) {
+	case SMB_COM_CREATE_DIRECTORY:
+	case SMB_COM_DELETE_DIRECTORY:
+	case SMB_COM_QUERY_INFORMATION:
+	case SMB_COM_TREE_DISCONNECT:
+	case SMB_COM_NEGOTIATE:
+	case SMB_COM_NT_CANCEL:
+	case SMB_COM_CHECK_DIRECTORY:
+	case SMB_COM_PROCESS_EXIT:
+		if (wc != 0x0)
+			return -EINVAL;
+		break;
+	case SMB_COM_FLUSH:
+	case SMB_COM_DELETE:
+	case SMB_COM_RENAME:
+	case SMB_COM_ECHO:
+	case SMB_COM_FIND_CLOSE2:
+		if (wc != 0x1)
+			return -EINVAL;
+		break;
+	case SMB_COM_LOGOFF_ANDX:
+		if (wc != 0x2)
+			return -EINVAL;
+		break;
+	case SMB_COM_CLOSE:
+		if (wc != 0x3)
+			return -EINVAL;
+		break;
+	case SMB_COM_TREE_CONNECT_ANDX:
+	case SMB_COM_NT_RENAME:
+		if (wc != 0x4)
+			return -EINVAL;
+		break;
+	case SMB_COM_WRITE:
+		if (wc != 0x5)
+			return -EINVAL;
+		break;
+	case SMB_COM_SETATTR:
+	case SMB_COM_LOCKING_ANDX:
+		if (wc != 0x8)
+			return -EINVAL;
+		break;
+	case SMB_COM_TRANSACTION:
+		if (wc < 0xe)
+			return -EINVAL;
+		break;
+	case SMB_COM_SESSION_SETUP_ANDX:
+		if (wc != 0xc && wc != 0xd)
+			return -EINVAL;
+		break;
+	case SMB_COM_OPEN_ANDX:
+	case SMB_COM_TRANSACTION2:
+		if (wc != 0xf)
+			return -EINVAL;
+		break;
+	case SMB_COM_NT_CREATE_ANDX:
+		if (wc != 0x18)
+			return -EINVAL;
+		break;
+	case SMB_COM_READ_ANDX:
+		if (wc != 0xa && wc != 0xc)
+			return -EINVAL;
+		break;
+	case SMB_COM_WRITE_ANDX:
+		if (wc != 0xc && wc != 0xe)
+			return -EINVAL;
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	return wc;
+}
+
+static int smb1_get_byte_count(struct smb_hdr *hdr)
+{
+	int bc;
+
+	bc = le16_to_cpu(*(__le16 *)((char *)hdr +
+		sizeof(struct smb_hdr) + hdr->WordCount * 2));
+
+	switch (hdr->Command) {
+	case SMB_COM_CLOSE:
+	case SMB_COM_FLUSH:
+	case SMB_COM_READ_ANDX:
+	case SMB_COM_TREE_DISCONNECT:
+	case SMB_COM_LOGOFF_ANDX:
+	case SMB_COM_NT_CANCEL:
+	case SMB_COM_PROCESS_EXIT:
+	case SMB_COM_FIND_CLOSE2:
+		if (bc != 0x0)
+			return -EINVAL;
+		break;
+	case SMB_COM_LOCKING_ANDX:
+	case SMB_COM_TRANSACTION:
+	case SMB_COM_TRANSACTION2:
+	case SMB_COM_ECHO:
+	case SMB_COM_SESSION_SETUP_ANDX:
+		if (bc < 0x0)
+			return -EINVAL;
+		break;
+	case SMB_COM_WRITE_ANDX:
+		if (bc < 0x1)
+			return -EINVAL;
+		break;
+	case SMB_COM_CREATE_DIRECTORY:
+	case SMB_COM_DELETE_DIRECTORY:
+	case SMB_COM_DELETE:
+	case SMB_COM_RENAME:
+	case SMB_COM_QUERY_INFORMATION:
+	case SMB_COM_SETATTR:
+	case SMB_COM_OPEN_ANDX:
+	case SMB_COM_NEGOTIATE:
+	case SMB_COM_CHECK_DIRECTORY:
+		if (bc < 0x2)
+			return -EINVAL;
+		break;
+	case SMB_COM_TREE_CONNECT_ANDX:
+	case SMB_COM_WRITE:
+		if (bc < 0x3)
+			return -EINVAL;
+		break;
+	case SMB_COM_NT_RENAME:
+		if (bc < 0x4)
+			return -EINVAL;
+		break;
+	case SMB_COM_NT_CREATE_ANDX:
+		if (hdr->Flags2 & SMBFLG2_UNICODE) {
+			if (bc < 3)
+				return -EINVAL;
+		} else if (bc < 2)
+			return -EINVAL;
+		break;
+	}
+
+	return bc;
+}
+
+static unsigned int smb1_calc_size(struct smb_hdr *hdr)
+{
+	int len = sizeof(struct smb_hdr) - 4 + 2;
+	int bc, struct_size = hdr->WordCount * 2;
+
+	len += struct_size;
+	bc = smb1_get_byte_count(hdr);
+	if (bc < 0)
+		return bc;
+	ksmbd_debug(SMB, "SMB2 byte count %d, struct size : %d\n", bc,
+		struct_size);
+	len += bc;
+
+	ksmbd_debug(SMB, "SMB1 len %d\n", len);
+	return len;
+}
+
+static int smb1_get_data_len(struct smb_hdr *hdr)
+{
+	int data_len = 0;
+
+	/* data offset check */
+	switch (hdr->Command) {
+	case SMB_COM_WRITE_ANDX:
+	{
+		struct smb_com_write_req *req = (struct smb_com_write_req *)hdr;
+
+		data_len = le16_to_cpu(req->DataLengthLow);
+		data_len |= (le16_to_cpu(req->DataLengthHigh) << 16);
+		data_len += le16_to_cpu(req->DataOffset);
+		break;
+	}
+	case SMB_COM_TRANSACTION:
+	{
+		struct smb_com_trans_req *req = (struct smb_com_trans_req *)hdr;
+
+		data_len = le16_to_cpu(req->DataOffset) +
+			le16_to_cpu(req->DataCount);
+		break;
+	}
+	case SMB_COM_TRANSACTION2:
+	{
+		struct smb_com_trans2_req *req =
+				(struct smb_com_trans2_req *)hdr;
+
+		data_len = le16_to_cpu(req->DataOffset) +
+			le16_to_cpu(req->DataCount);
+		break;
+	}
+	}
+
+	return data_len;
+}
+
+int ksmbd_smb1_check_message(struct ksmbd_work *work)
+{
+	struct smb_hdr *hdr = (struct smb_hdr *)work->request_buf;
+	char *buf = work->request_buf;
+	int command = hdr->Command;
+	__u32 clc_len;  /* calculated length */
+	__u32 len = get_rfc1002_len(buf);
+	int wc, data_len;
+
+	if (check_smb1_hdr(hdr))
+		return 1;
+
+	wc = smb1_req_struct_size(hdr);
+	if (wc == -EOPNOTSUPP) {
+		ksmbd_debug(SMB, "Not support cmd %x\n", command);
+		return 1;
+	} else if (hdr->WordCount != wc) {
+		ksmbd_err("Invalid word count, %d not %d. cmd %x\n",
+			hdr->WordCount, wc, command);
+		return 1;
+	}
+
+	data_len = smb1_get_data_len(hdr);
+	if (len < data_len) {
+		ksmbd_err("Invalid data area length %u not %u. cmd : %x\n",
+			len, data_len, command);
+		return 1;
+	}
+
+	clc_len = smb1_calc_size(hdr);
+	if (len != clc_len) {
+		/*
+		 * smbclient may return wrong byte count in smb header.
+		 * But allow it to avoid write failure with smbclient.
+		 */
+		if (command == SMB_COM_WRITE_ANDX)
+			return 0;
+
+		if (len > clc_len) {
+			ksmbd_debug(SMB,
+				"cli req too long, len %d not %d. cmd:%x\n",
+				len, clc_len, command);
+			return 0;
+		}
+
+		ksmbd_err("cli req too short, len %d not %d. cmd:%x\n",
+			len, clc_len, command);
+
+		return 1;
+	}
+
+	return 0;
+}
+
+int smb_negotiate_request(struct ksmbd_work *work)
+{
+	return ksmbd_smb_negotiate_common(work, SMB_COM_NEGOTIATE);
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smb1ops.c linux-5.4.60-fbx/fs/cifsd/smb1ops.c
--- linux-5.4.60-fbx/fs/cifsd./smb1ops.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smb1ops.c	2021-03-30 15:48:29.598385862 +0200
@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/slab.h>
+
+#include "glob.h"
+#include "connection.h"
+#include "smb_common.h"
+#include "smb1pdu.h"
+
+static struct smb_version_values smb1_server_values = {
+	.version_string = SMB1_VERSION_STRING,
+	.protocol_id = SMB10_PROT_ID,
+	.capabilities = SMB1_SERVER_CAPS,
+	.max_read_size = CIFS_DEFAULT_IOSIZE,
+	.max_write_size = CIFS_DEFAULT_IOSIZE,
+	.max_trans_size = CIFS_DEFAULT_IOSIZE,
+	.large_lock_type = LOCKING_ANDX_LARGE_FILES,
+	.exclusive_lock_type = 0,
+	.shared_lock_type = LOCKING_ANDX_SHARED_LOCK,
+	.unlock_lock_type = 0,
+	.header_size = sizeof(struct smb_hdr),
+	.max_header_size = MAX_CIFS_HDR_SIZE,
+	.read_rsp_size = sizeof(struct smb_com_read_rsp),
+	.lock_cmd = cpu_to_le16(SMB_COM_LOCKING_ANDX),
+	.cap_unix = CAP_UNIX,
+	.cap_nt_find = CAP_NT_SMBS | CAP_NT_FIND,
+	.cap_large_files = CAP_LARGE_FILES,
+	.signing_enabled = SECMODE_SIGN_ENABLED,
+	.signing_required = SECMODE_SIGN_REQUIRED,
+};
+
+static struct smb_version_ops smb1_server_ops = {
+	.get_cmd_val = get_smb_cmd_val,
+	.init_rsp_hdr = init_smb_rsp_hdr,
+	.set_rsp_status = set_smb_rsp_status,
+	.allocate_rsp_buf = smb_allocate_rsp_buf,
+	.check_user_session = smb_check_user_session,
+	.is_sign_req = smb1_is_sign_req,
+	.check_sign_req = smb1_check_sign_req,
+	.set_sign_rsp = smb1_set_sign_rsp,
+	.get_ksmbd_tcon = smb_get_ksmbd_tcon,
+};
+
+static struct smb_version_cmds smb1_server_cmds[256] = {
+	[SMB_COM_CREATE_DIRECTORY]	= { .proc = smb_mkdir, },
+	[SMB_COM_DELETE_DIRECTORY]	= { .proc = smb_rmdir, },
+	[SMB_COM_CLOSE]			= { .proc = smb_close, },
+	[SMB_COM_FLUSH]			= { .proc = smb_flush, },
+	[SMB_COM_DELETE]		= { .proc = smb_unlink, },
+	[SMB_COM_RENAME]		= { .proc = smb_rename, },
+	[SMB_COM_QUERY_INFORMATION]	= { .proc = smb_query_info, },
+	[SMB_COM_SETATTR]		= { .proc = smb_setattr, },
+	[SMB_COM_LOCKING_ANDX]		= { .proc = smb_locking_andx, },
+	[SMB_COM_TRANSACTION]		= { .proc = smb_trans, },
+	[SMB_COM_ECHO]			= { .proc = smb_echo, },
+	[SMB_COM_OPEN_ANDX]		= { .proc = smb_open_andx, },
+	[SMB_COM_READ_ANDX]		= { .proc = smb_read_andx, },
+	[SMB_COM_WRITE_ANDX]		= { .proc = smb_write_andx, },
+	[SMB_COM_TRANSACTION2]		= { .proc = smb_trans2, },
+	[SMB_COM_FIND_CLOSE2]		= { .proc = smb_closedir, },
+	[SMB_COM_TREE_DISCONNECT]	= { .proc = smb_tree_disconnect, },
+	[SMB_COM_NEGOTIATE]		= { .proc = smb_negotiate_request, },
+	[SMB_COM_SESSION_SETUP_ANDX]	= { .proc = smb_session_setup_andx, },
+	[SMB_COM_LOGOFF_ANDX]           = { .proc = smb_session_disconnect, },
+	[SMB_COM_TREE_CONNECT_ANDX]	= { .proc = smb_tree_connect_andx, },
+	[SMB_COM_NT_CREATE_ANDX]	= { .proc = smb_nt_create_andx, },
+	[SMB_COM_NT_CANCEL]		= { .proc = smb_nt_cancel, },
+	[SMB_COM_NT_RENAME]		= { .proc = smb_nt_rename, },
+	[SMB_COM_WRITE]			= { .proc = smb_write, },
+	[SMB_COM_CHECK_DIRECTORY]	= { .proc = smb_checkdir, },
+	[SMB_COM_PROCESS_EXIT]		= { .proc = smb_process_exit, },
+};
+
+/**
+ * init_smb1_server() - initialize a smb server connection with smb1
+ *			command dispatcher
+ * @conn:	connection instance
+ */
+int init_smb1_server(struct ksmbd_conn *conn)
+{
+	if (!conn)
+		return -EINVAL;
+
+	conn->vals = &smb1_server_values;
+	conn->ops = &smb1_server_ops;
+	conn->cmds = smb1_server_cmds;
+	conn->max_cmds = ARRAY_SIZE(smb1_server_cmds);
+	return 0;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smb1pdu.c linux-5.4.60-fbx/fs/cifsd/smb1pdu.c
--- linux-5.4.60-fbx/fs/cifsd./smb1pdu.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smb1pdu.c	2021-04-21 10:06:25.185180826 +0200
@@ -0,0 +1,8406 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+#include <linux/math64.h>
+#include <linux/fs.h>
+#include <linux/posix_acl_xattr.h>
+#include <linux/namei.h>
+#include <linux/statfs.h>
+#include <linux/vmalloc.h>
+
+#include "glob.h"
+#include "oplock.h"
+#include "buffer_pool.h"
+#include "connection.h"
+#include "transport_ipc.h"
+#include "vfs.h"
+#include "misc.h"
+
+#include "auth.h"
+#include "asn1.h"
+#include "server.h"
+#include "smb_common.h"
+#include "smb1pdu.h"
+#include "smbstatus.h"
+#include "mgmt/user_config.h"
+#include "mgmt/share_config.h"
+#include "mgmt/tree_connect.h"
+#include "mgmt/user_session.h"
+#include "ndr.h"
+#include "smberr.h"
+
+static int smb1_oplock_enable = false;
+
+/* Default: allocation roundup size = 1048576 */
+static unsigned int alloc_roundup_size = 1048576;
+
+struct ksmbd_dirent {
+	unsigned long long	ino;
+	unsigned long long	offset;
+	unsigned int		namelen;
+	unsigned int		d_type;
+	char			name[];
+};
+
+/**
+ * smb_NTtimeToUnix() - convert NTFS time to unix style time format
+ * @ntutc:	NTFS style time
+ *
+ * Convert the NT UTC (based 1601-01-01, in hundred nanosecond units)
+ * into Unix UTC (based 1970-01-01, in seconds).
+ *
+ * Return:      timespec containing unix style time
+ */
+static struct timespec64 smb_NTtimeToUnix(__le64 ntutc)
+{
+	struct timespec64 ts;
+
+	/* BB what about the timezone? BB */
+
+	/* Subtract the NTFS time offset, then convert to 1s intervals. */
+	/* this has been taken from cifs, ntfs code */
+	u64 t;
+
+	t = le64_to_cpu(ntutc) - NTFS_TIME_OFFSET;
+	ts.tv_nsec = do_div(t, 10000000) * 100;
+	ts.tv_sec = t;
+	return ts;
+}
+
+/**
+ * get_smb_cmd_val() - get smb command value from smb header
+ * @work:	smb work containing smb header
+ *
+ * Return:      smb command value
+ */
+uint16_t get_smb_cmd_val(struct ksmbd_work *work)
+{
+	struct smb_hdr *rcv_hdr = (struct smb_hdr *)work->request_buf;
+
+	return (uint16_t)rcv_hdr->Command;
+}
+
+/**
+ * is_smbreq_unicode() - check if the smb command is request is unicode or not
+ * @hdr:	pointer to smb_hdr in the the request part
+ *
+ * Return: check flags and return true if request is unicode, else false
+ */
+static inline int is_smbreq_unicode(struct smb_hdr *hdr)
+{
+	return hdr->Flags2 & SMBFLG2_UNICODE ? 1 : 0;
+}
+
+/**
+ * set_smb_rsp_status() - set error type in smb response header
+ * @work:	smb work containing smb response header
+ * @err:	error code to set in response
+ */
+void set_smb_rsp_status(struct ksmbd_work *work, __le32 err)
+{
+	struct smb_hdr *rsp_hdr = (struct smb_hdr *) work->response_buf;
+
+	rsp_hdr->Status.CifsError = err;
+}
+
+/**
+ * init_smb_rsp_hdr() - initialize smb response header
+ * @work:	smb work containing smb request
+ *
+ * Return:      0 on success, otherwise -EINVAL
+ */
+int init_smb_rsp_hdr(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb_hdr *rsp_hdr;
+	struct smb_hdr *rcv_hdr = (struct smb_hdr *)work->request_buf;
+
+	rsp_hdr = (struct smb_hdr *) work->response_buf;
+	memset(rsp_hdr, 0, sizeof(struct smb_hdr) + 2);
+
+	/* remove 4 byte direct TCP header, add 1 byte wc and 2 byte bcc */
+	rsp_hdr->smb_buf_length = cpu_to_be32(HEADER_SIZE_NO_BUF_LEN(conn) + 2);
+	memcpy(rsp_hdr->Protocol, rcv_hdr->Protocol, 4);
+	rsp_hdr->Command = rcv_hdr->Command;
+
+	/*
+	 * Message is response. Other bits are obsolete.
+	 */
+	rsp_hdr->Flags = (SMBFLG_RESPONSE);
+
+	/*
+	 * Lets assume error code are NTLM. True for CIFS and windows 7
+	 */
+	rsp_hdr->Flags2 = rcv_hdr->Flags2;
+	rsp_hdr->PidHigh = rcv_hdr->PidHigh;
+	rsp_hdr->Pid = rcv_hdr->Pid;
+	rsp_hdr->Mid = rcv_hdr->Mid;
+	rsp_hdr->WordCount = 0;
+
+	/* We can do the above test because we have set maxVCN as 1 */
+	rsp_hdr->Uid = rcv_hdr->Uid;
+	rsp_hdr->Tid = rcv_hdr->Tid;
+	return 0;
+}
+
+/**
+ * smb_allocate_rsp_buf() - allocate response buffer for a command
+ * @work:	smb work containing smb request
+ *
+ * Return:      0 on success, otherwise -ENOMEM
+ */
+int smb_allocate_rsp_buf(struct ksmbd_work *work)
+{
+	struct smb_hdr *hdr = (struct smb_hdr *)work->request_buf;
+	unsigned char cmd = hdr->Command;
+	size_t large_sz = work->conn->vals->max_read_size + MAX_CIFS_HDR_SIZE;
+	size_t sz = MAX_CIFS_SMALL_BUFFER_SIZE;
+
+	if (cmd == SMB_COM_TRANSACTION2) {
+		struct smb_com_trans2_qpi_req *req = work->request_buf;
+		u16 sub_cmd = le16_to_cpu(req->SubCommand);
+		u16 infolevel = le16_to_cpu(req->InformationLevel);
+
+		if ((sub_cmd == TRANS2_FIND_FIRST) ||
+				(sub_cmd == TRANS2_FIND_NEXT) ||
+				(sub_cmd == TRANS2_QUERY_PATH_INFORMATION &&
+				 (infolevel == SMB_QUERY_FILE_UNIX_LINK ||
+				  infolevel == SMB_QUERY_POSIX_ACL ||
+				  infolevel == SMB_INFO_QUERY_ALL_EAS)))
+			sz = large_sz;
+	}
+
+	if (cmd == SMB_COM_TRANSACTION)
+		sz = large_sz;
+
+	if (cmd == SMB_COM_ECHO) {
+		int resp_size;
+		struct smb_com_echo_req *req = work->request_buf;
+
+		/*
+		 * size of struct smb_com_echo_rsp + Bytecount - Size of Data
+		 * in struct smb_com_echo_rsp
+		 */
+		resp_size = sizeof(struct smb_com_echo_rsp) +
+			le16_to_cpu(req->ByteCount) - 1;
+		if (resp_size > MAX_CIFS_SMALL_BUFFER_SIZE)
+			sz = large_sz;
+	}
+
+	work->response_buf = kvmalloc(sz, GFP_KERNEL | __GFP_ZERO);
+	work->response_sz = sz;
+
+	if (!work->response_buf) {
+		ksmbd_err("Failed to allocate %zu bytes buffer\n", sz);
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+/**
+ * andx_request_buffer() - return pointer to matching andx command
+ * @work:	buffer containing smb request
+ * @command:	match next command with this command
+ *
+ * Return:      pointer to matching command buffer on success, otherwise NULL
+ */
+static char *andx_request_buffer(char *buf, int command)
+{
+	struct andx_block *andx_ptr = (struct andx_block *)(buf +
+					sizeof(struct smb_hdr) - 1);
+	struct andx_block *next;
+
+	while (andx_ptr->AndXCommand != SMB_NO_MORE_ANDX_COMMAND) {
+		next = (struct andx_block *)
+			(buf + 4 + le16_to_cpu(andx_ptr->AndXOffset));
+		if (andx_ptr->AndXCommand == command)
+			return (char *)next;
+		andx_ptr = next;
+	}
+	return NULL;
+}
+
+/**
+ * andx_response_buffer() - return pointer to andx response buffer
+ * @buf:	buffer containing smb request
+ *
+ * Return:      pointer to andx command response on success, otherwise NULL
+ */
+static char *andx_response_buffer(char *buf)
+{
+	int pdu_length = get_rfc1002_len(buf);
+
+	return buf + 4 + pdu_length;
+}
+
+/**
+ * smb_check_user_session() - check for valid session for a user
+ * @work:	smb work containing smb request buffer
+ *
+ * Return:      0 on success, otherwise error
+ */
+int smb_check_user_session(struct ksmbd_work *work)
+{
+	struct smb_hdr *req_hdr = (struct smb_hdr *)work->request_buf;
+	struct ksmbd_conn *conn = work->conn;
+	unsigned int cmd = conn->ops->get_cmd_val(work);
+
+	work->sess = NULL;
+	if (cmd == SMB_COM_NEGOTIATE || cmd == SMB_COM_SESSION_SETUP_ANDX ||
+		cmd == SMB_COM_ECHO)
+		return 0;
+
+	if (!ksmbd_conn_good(work))
+		return -EINVAL;
+
+	if (list_empty(&conn->sessions)) {
+		ksmbd_debug(SMB, "NO sessions registered\n");
+		return 0;
+	}
+
+	work->sess = ksmbd_session_lookup(conn, le16_to_cpu(req_hdr->Uid));
+	if (work->sess)
+		return 1;
+	ksmbd_debug(SMB, "Invalid user session, Uid %u\n",
+			le16_to_cpu(req_hdr->Uid));
+	return -EINVAL;
+}
+
+/**
+ * smb_get_ksmbd_tcon() - get tree connection information for a tree id
+ * @sess:	session containing tree list
+ * @tid:	match tree connection with tree id
+ *
+ * Return:      matching tree connection on success, otherwise error
+ */
+int smb_get_ksmbd_tcon(struct ksmbd_work *work)
+{
+	struct smb_hdr *req_hdr = (struct smb_hdr *)work->request_buf;
+	int tree_id;
+
+	if (xa_empty(&work->sess->tree_conns)) {
+		ksmbd_debug(SMB, "NO tree connected\n");
+		return 0;
+	}
+
+	work->tcon = NULL;
+	if (work->conn->ops->get_cmd_val(work) == SMB_COM_TREE_CONNECT_ANDX) {
+		ksmbd_debug(SMB, "skip to check tree connect request\n");
+		return 0;
+	}
+
+	tree_id = le16_to_cpu(req_hdr->Tid);
+	work->tcon = ksmbd_tree_conn_lookup(work->sess, tree_id);
+	if (!work->tcon) {
+		ksmbd_err("Invalid tid %d\n", tree_id);
+		return -1;
+	}
+
+	return 1;
+}
+
+/**
+ * smb_session_disconnect() - LOGOFF request handler
+ * @work:	smb work containing log off request buffer
+ *
+ * Return:      0 on success, otherwise error
+ */
+int smb_session_disconnect(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_session *sess = work->sess;
+
+	/* Got a valid session, set connection state */
+	WARN_ON(sess->conn != conn);
+
+	/* setting CifsExiting here may race with start_tcp_sess */
+	ksmbd_conn_set_need_reconnect(work);
+
+	ksmbd_free_user(sess->user);
+	sess->user = NULL;
+
+	ksmbd_conn_wait_idle(conn);
+
+	ksmbd_tree_conn_session_logoff(sess);
+	ksmbd_session_destroy(sess);
+	work->sess = NULL;
+
+	/* let start_tcp_sess free conn info now */
+	ksmbd_conn_set_exiting(work);
+	return 0;
+}
+
+/**
+ * smb_session_disconnect() - tree disconnect request handler
+ * @work:	smb work containing tree disconnect request buffer
+ *
+ * Return:      0 on success, otherwise error
+ */
+int smb_tree_disconnect(struct ksmbd_work *work)
+{
+	struct smb_hdr *req_hdr = (struct smb_hdr *)work->request_buf;
+	struct smb_hdr *rsp_hdr = (struct smb_hdr *)work->response_buf;
+	struct ksmbd_tree_connect *tcon = work->tcon;
+	struct ksmbd_session *sess = work->sess;
+
+	if (!tcon) {
+		ksmbd_err("Invalid tid %d\n", req_hdr->Tid);
+		rsp_hdr->Status.CifsError = STATUS_NO_SUCH_USER;
+		return -EINVAL;
+	}
+
+	ksmbd_close_tree_conn_fds(work);
+	ksmbd_tree_conn_disconnect(sess, tcon);
+	return 0;
+}
+
+static void set_service_type(struct ksmbd_conn *conn,
+		struct ksmbd_share_config *share,
+		struct smb_com_tconx_rsp_ext *rsp)
+{
+	int length;
+	char *buf = rsp->Service;
+
+	if (test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) {
+		length = strlen(SERVICE_IPC_SHARE);
+		memcpy(buf, SERVICE_IPC_SHARE, length);
+		rsp->ByteCount = cpu_to_le16(length + 1);
+		buf += length;
+		*buf = '\0';
+	} else {
+		int uni_len = 0;
+
+		length = strlen(SERVICE_DISK_SHARE);
+		memcpy(buf, SERVICE_DISK_SHARE, length);
+		buf[length] = '\0';
+		length += 1;
+		uni_len = smbConvertToUTF16((__le16 *)(buf + length),
+					     NATIVE_FILE_SYSTEM,
+					     PATH_MAX, conn->local_nls, 0);
+		uni_len++;
+		uni_len *= 2;
+		length += uni_len;
+		rsp->ByteCount = cpu_to_le16(length);
+	}
+}
+
+/**
+ * smb_tree_connect_andx() - tree connect request handler
+ * @work:	smb work containing tree connect request buffer
+ *
+ * Return:      0 on success, otherwise error
+ */
+int smb_tree_connect_andx(struct ksmbd_work *work)
+{
+	struct smb_hdr *req_hdr = (struct smb_hdr *)work->request_buf;
+	struct smb_hdr *rsp_hdr = (struct smb_hdr *)work->response_buf;
+	struct ksmbd_conn *conn = work->conn;
+	struct smb_com_tconx_req *req;
+	struct smb_com_tconx_rsp_ext *rsp;
+	int extra_byte = 0;
+	char *treename = NULL, *name = NULL, *dev_type = NULL;
+	struct ksmbd_share_config *share;
+	struct ksmbd_session *sess = work->sess;
+	int dev_flags = 0;
+	struct ksmbd_tree_conn_status status;
+
+	/* Is this an ANDX command ? */
+	if (req_hdr->Command != SMB_COM_TREE_CONNECT_ANDX) {
+		ksmbd_debug(SMB, "SMB_COM_TREE_CONNECT_ANDX is part of ANDX");
+		req = (struct smb_com_tconx_req *)
+			andx_request_buffer(work->request_buf,
+				SMB_COM_TREE_CONNECT_ANDX);
+		rsp = (struct smb_com_tconx_rsp_ext *)
+			andx_response_buffer(work->response_buf);
+		extra_byte = 3;
+		if (!req) {
+			status.ret = -EINVAL;
+			goto out_err;
+		}
+	} else {
+		req = (struct smb_com_tconx_req *)(&req_hdr->WordCount);
+		rsp = (struct smb_com_tconx_rsp_ext *)(&rsp_hdr->WordCount);
+	}
+
+	/* check if valid tree name is present in request or not */
+	if (!req->PasswordLength) {
+		treename = smb_strndup_from_utf16(req->Password + 1,
+				256, true, conn->local_nls);
+		dev_type = smb_strndup_from_utf16(req->Password + 1 +
+			((strlen(treename) + 1) * 2), 256, false,
+			conn->local_nls);
+	} else {
+		treename = smb_strndup_from_utf16(req->Password +
+				le16_to_cpu(req->PasswordLength), 256, true,
+				conn->local_nls);
+		dev_type = smb_strndup_from_utf16(req->Password +
+			le16_to_cpu(req->PasswordLength) +
+				((strlen(treename) + 1) * 2),
+			256, false, conn->local_nls);
+	}
+
+	if (IS_ERR(treename) || IS_ERR(dev_type)) {
+		ksmbd_err("Unable to strdup() treename or devtype uid %d\n",
+				rsp_hdr->Uid);
+		status.ret = KSMBD_TREE_CONN_STATUS_ERROR;
+		goto out_err;
+	}
+	name = ksmbd_extract_sharename(treename);
+	if (IS_ERR(name)) {
+		status.ret = KSMBD_TREE_CONN_STATUS_ERROR;
+		goto out_err;
+	}
+
+	ksmbd_debug(SMB, "tree connect request for tree %s, dev_type : %s\n",
+		name, dev_type);
+
+	if (!strcmp(dev_type, "A:"))
+		dev_flags = 1;
+	else if (!strncmp(dev_type, "LPT", 3))
+		dev_flags = 2;
+	else if (!strcmp(dev_type, "IPC"))
+		dev_flags = 3;
+	else if (!strcmp(dev_type, "COMM"))
+		dev_flags = 4;
+	else if (!strcmp(dev_type, "?????"))
+		dev_flags = 5;
+
+	if (!strncmp("IPC$", name, 4)) {
+		if (dev_flags < 3) {
+			status.ret = -ENODEV;
+			goto out_err;
+		}
+	} else if (!dev_flags || (dev_flags > 1 && dev_flags < 5)) {
+		status.ret = -ENODEV;
+		goto out_err;
+	}
+
+	status = ksmbd_tree_conn_connect(sess, name);
+	if (status.ret == KSMBD_TREE_CONN_STATUS_OK)
+		rsp_hdr->Tid = cpu_to_le16(status.tree_conn->id);
+	else
+		goto out_err;
+
+	status.ret = 0;
+	share = status.tree_conn->share_conf;
+	rsp->WordCount = 7;
+	rsp->OptionalSupport = 0;
+
+	rsp->OptionalSupport = cpu_to_le16((SMB_SUPPORT_SEARCH_BITS |
+				SMB_CSC_NO_CACHING | SMB_UNIQUE_FILE_NAME));
+
+	rsp->MaximalShareAccessRights = cpu_to_le32(FILE_READ_RIGHTS |
+					FILE_EXEC_RIGHTS);
+	if (test_tree_conn_flag(status.tree_conn,
+				KSMBD_TREE_CONN_FLAG_WRITABLE))
+		rsp->MaximalShareAccessRights |= FILE_WRITE_RIGHTS;
+	rsp->GuestMaximalShareAccessRights = 0;
+
+	set_service_type(conn, share, rsp);
+
+	/* For each extra andx response, we have to add 1 byte,
+	 * for wc and 2 bytes for byte count
+	 */
+	inc_rfc1001_len(rsp_hdr,
+		7 * 2 + le16_to_cpu(rsp->ByteCount) + extra_byte);
+
+	/* this is an ANDx command ? */
+	rsp->AndXReserved = 0;
+	rsp->AndXOffset = cpu_to_le16(get_rfc1002_len(rsp_hdr));
+	if (req->AndXCommand != SMB_NO_MORE_ANDX_COMMAND) {
+		/* adjust response */
+		rsp->AndXCommand = req->AndXCommand;
+		/* More processing required */
+		status.ret = rsp->AndXCommand;
+	} else {
+		rsp->AndXCommand = SMB_NO_MORE_ANDX_COMMAND;
+	}
+
+	kfree(treename);
+	kfree(dev_type);
+	kfree(name);
+
+	return status.ret;
+
+out_err:
+	if (!IS_ERR(treename))
+		kfree(treename);
+	if (!IS_ERR(dev_type))
+		kfree(dev_type);
+	if (!IS_ERR(name))
+		kfree(name);
+
+	rsp->WordCount = 7;
+	rsp->AndXCommand = SMB_NO_MORE_ANDX_COMMAND;
+	rsp->AndXReserved = 0;
+	rsp->AndXOffset = cpu_to_le16(get_rfc1002_len(rsp_hdr));
+	rsp->OptionalSupport = 0;
+	rsp->MaximalShareAccessRights = 0;
+	rsp->GuestMaximalShareAccessRights = 0;
+	rsp->ByteCount = 0;
+	ksmbd_debug(SMB, "error while tree connect\n");
+	switch (status.ret) {
+	case KSMBD_TREE_CONN_STATUS_NO_SHARE:
+		rsp_hdr->Status.CifsError = STATUS_BAD_NETWORK_PATH;
+		break;
+	case -ENOMEM:
+	case KSMBD_TREE_CONN_STATUS_NOMEM:
+		rsp_hdr->Status.CifsError = STATUS_NO_MEMORY;
+		break;
+	case KSMBD_TREE_CONN_STATUS_TOO_MANY_CONNS:
+	case KSMBD_TREE_CONN_STATUS_TOO_MANY_SESSIONS:
+		rsp_hdr->Status.CifsError = STATUS_ACCESS_DENIED;
+		break;
+	case -ENODEV:
+		rsp_hdr->Status.CifsError = STATUS_BAD_DEVICE_TYPE;
+		break;
+	case KSMBD_TREE_CONN_STATUS_ERROR:
+		rsp_hdr->Status.CifsError = STATUS_BAD_NETWORK_NAME;
+		break;
+	case -EINVAL:
+		rsp_hdr->Status.CifsError = STATUS_INVALID_PARAMETER;
+		break;
+	default:
+		rsp_hdr->Status.CifsError = STATUS_ACCESS_DENIED;
+	}
+
+	/* Clean session if there is no tree attached */
+	if (!sess || xa_empty(&work->sess->tree_conns))
+		ksmbd_conn_set_exiting(work);
+	inc_rfc1001_len(rsp_hdr, (7 * 2 + le16_to_cpu(rsp->ByteCount) +
+		extra_byte));
+	return -EINVAL;
+}
+
+/**
+ * smb_get_name() - convert filename on smb packet to char string
+ * @src:	source filename, mostly in unicode format
+ * @maxlen:	maxlen of src string to be used for parsing
+ * @work:	smb work containing smb header flag
+ * @converted:	src string already converted to local characterset
+ *
+ * Return:	pointer to filename string on success, otherwise error ptr
+ */
+static char *
+smb_get_name(struct ksmbd_share_config *share, const char *src,
+		const int maxlen, struct ksmbd_work *work, bool converted)
+{
+	struct smb_hdr *req_hdr = (struct smb_hdr *)work->request_buf;
+	struct smb_hdr *rsp_hdr = (struct smb_hdr *)work->response_buf;
+	bool is_unicode = is_smbreq_unicode(req_hdr);
+	char *name, *unixname;
+	char *wild_card_pos;
+
+	if (converted)
+		name = (char *)src;
+	else {
+		name = smb_strndup_from_utf16(src, maxlen, is_unicode,
+				work->conn->local_nls);
+		if (IS_ERR(name)) {
+			ksmbd_debug(SMB, "failed to get name %ld\n",
+				PTR_ERR(name));
+			if (PTR_ERR(name) == -ENOMEM)
+				rsp_hdr->Status.CifsError = STATUS_NO_MEMORY;
+			else
+				rsp_hdr->Status.CifsError =
+					STATUS_OBJECT_NAME_INVALID;
+			return name;
+		}
+	}
+
+	/* change it to absolute unix name */
+	ksmbd_conv_path_to_unix(name);
+	ksmbd_strip_last_slash(name);
+
+	/*Handling of dir path in FIND_FIRST2 having '*' at end of path*/
+	wild_card_pos = strrchr(name, '*');
+
+	if (wild_card_pos != NULL)
+		*wild_card_pos = '\0';
+
+	unixname = convert_to_unix_name(share, name);
+
+	if (!converted)
+		kfree(name);
+	if (!unixname) {
+		ksmbd_err("can not convert absolute name\n");
+		rsp_hdr->Status.CifsError = STATUS_NO_MEMORY;
+		return ERR_PTR(-ENOMEM);
+	}
+
+	if (ksmbd_validate_filename(unixname) < 0) {
+		kfree(unixname);
+		return ERR_PTR(-ENOENT);
+	}
+
+	if (ksmbd_share_veto_filename(share, unixname)) {
+		ksmbd_debug(SMB,
+			"file(%s) open is not allowed by setting as veto file\n",
+				unixname);
+		kfree(unixname);
+		return ERR_PTR(-ENOENT);
+	}
+
+	ksmbd_debug(SMB, "absolute name = %s\n", unixname);
+	return unixname;
+}
+
+/**
+ * smb_get_dir_name() - convert directory name on smb packet to char string
+ * @src:	source dir name, mostly in unicode format
+ * @maxlen:	maxlen of src string to be used for parsing
+ * @work:	smb work containing smb header flag
+ * @srch_ptr:	update search pointer in dir for searching dir entries
+ *
+ * Return:	pointer to dir name string on success, otherwise error ptr
+ */
+static char *smb_get_dir_name(struct ksmbd_share_config *share, const char *src,
+		const int maxlen, struct ksmbd_work *work, char **srch_ptr)
+{
+	struct smb_hdr *req_hdr = (struct smb_hdr *)work->request_buf;
+	struct smb_hdr *rsp_hdr = (struct smb_hdr *)work->response_buf;
+	bool is_unicode = is_smbreq_unicode(req_hdr);
+	char *name, *unixname;
+	char *pattern_pos, *pattern = NULL;
+	int pattern_len;
+
+	name = smb_strndup_from_utf16(src, maxlen, is_unicode,
+			work->conn->local_nls);
+	if (IS_ERR(name)) {
+		ksmbd_err("failed to allocate memory\n");
+		rsp_hdr->Status.CifsError = STATUS_NO_MEMORY;
+		return name;
+	}
+
+	/* change it to absolute unix name */
+	ksmbd_conv_path_to_unix(name);
+	ksmbd_strip_last_slash(name);
+
+	pattern_pos = strrchr(name, '/');
+
+	if (!pattern_pos)
+		pattern_pos = name;
+	else
+		pattern_pos += 1;
+
+	pattern_len = strlen(pattern_pos);
+	if (pattern_len == 0) {
+		rsp_hdr->Status.CifsError = STATUS_INVALID_PARAMETER;
+		kfree(name);
+		return ERR_PTR(-EINVAL);
+	}
+	ksmbd_debug(SMB, "pattern searched = %s pattern_len = %d\n",
+			pattern_pos, pattern_len);
+	pattern = kmalloc(pattern_len + 1, GFP_KERNEL);
+	if (!pattern) {
+		rsp_hdr->Status.CifsError = STATUS_NO_MEMORY;
+		kfree(name);
+		return ERR_PTR(-ENOMEM);
+	}
+	memcpy(pattern, pattern_pos, pattern_len);
+	*(pattern + pattern_len) = '\0';
+	*pattern_pos = '\0';
+	*srch_ptr = pattern;
+
+	unixname = convert_to_unix_name(share, name);
+	kfree(name);
+	if (!unixname) {
+		kfree(pattern);
+		ksmbd_err("can not convert absolute name\n");
+		rsp_hdr->Status.CifsError = STATUS_INVALID_PARAMETER;
+		return ERR_PTR(-EINVAL);
+	}
+
+	if (ksmbd_validate_filename(unixname) < 0) {
+		kfree(unixname);
+		return ERR_PTR(-ENOENT);
+	}
+
+	if (ksmbd_share_veto_filename(share, unixname)) {
+		ksmbd_debug(SMB,
+			"file(%s) open is not allowed by setting as veto file\n",
+				unixname);
+		kfree(unixname);
+		return ERR_PTR(-ENOENT);
+	}
+
+	ksmbd_debug(SMB, "absolute name = %s\n", unixname);
+	return unixname;
+}
+
+/**
+ * smb_rename() - rename request handler
+ * @work:	smb work containing rename request buffer
+ *
+ * Return:      0 on success, otherwise error
+ */
+int smb_rename(struct ksmbd_work *work)
+{
+	struct smb_com_rename_req *req = work->request_buf;
+	struct smb_com_rename_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	bool is_unicode = is_smbreq_unicode(&req->hdr);
+	char *abs_oldname, *abs_newname;
+	int oldname_len;
+	struct path path;
+	bool file_present = true;
+	int rc = 0;
+
+	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+		ksmbd_debug(SMB,
+			"returning as user does not have permission to write\n");
+		rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		return -EACCES;
+	}
+
+	abs_oldname = smb_get_name(share, req->OldFileName, PATH_MAX, work,
+		false);
+	if (IS_ERR(abs_oldname)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(abs_oldname);
+	}
+
+	if (is_unicode)
+		oldname_len = smb1_utf16_name_length((__le16 *)req->OldFileName,
+				PATH_MAX);
+	else {
+		oldname_len = strlen(abs_oldname);
+		oldname_len++;
+	}
+
+	abs_newname = smb_get_name(share, &req->OldFileName[oldname_len + 2],
+			PATH_MAX, work, false);
+	if (IS_ERR(abs_newname)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		rc = PTR_ERR(abs_newname);
+		abs_newname = NULL;
+		goto out;
+	}
+
+	rc = ksmbd_vfs_kern_path(abs_newname, 0, &path, 1);
+	if (rc)
+		file_present = false;
+	else
+		path_put(&path);
+
+	if (file_present &&
+			strncmp(abs_oldname, abs_newname,
+				strlen(abs_oldname))) {
+		rc = -EEXIST;
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_COLLISION;
+		ksmbd_debug(SMB, "cannot rename already existing file\n");
+		goto out;
+	}
+
+	ksmbd_debug(SMB, "rename %s -> %s\n", abs_oldname, abs_newname);
+	rc = ksmbd_vfs_rename_slowpath(work, abs_oldname, abs_newname);
+	if (rc) {
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		goto out;
+	}
+	rsp->hdr.WordCount = 0;
+	rsp->ByteCount = 0;
+out:
+	kfree(abs_oldname);
+	kfree(abs_newname);
+	return rc;
+}
+
+/**
+ * smb_handle_negotiate() - negotiate request handler
+ * @work:	smb work containing negotiate request buffer
+ *
+ * Return:      0 on success, otherwise error
+ */
+int smb_handle_negotiate(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb_negotiate_rsp *neg_rsp = work->response_buf;
+	__u64 time;
+	int rc = 0;
+
+	WARN_ON(ksmbd_conn_good(work));
+
+	if (conn->dialect == BAD_PROT_ID) {
+		neg_rsp->hdr.Status.CifsError = STATUS_INVALID_LOGON_TYPE;
+		rc = -EINVAL;
+		goto err_out;
+	}
+
+	conn->connection_type = 0;
+
+	/* wct 17 for NTLM */
+	neg_rsp->hdr.WordCount = 17;
+	neg_rsp->DialectIndex = cpu_to_le16(conn->dialect);
+
+	neg_rsp->SecurityMode = SMB1_SERVER_SECU;
+	if (server_conf.signing == KSMBD_CONFIG_OPT_AUTO ||
+		server_conf.signing == KSMBD_CONFIG_OPT_MANDATORY) {
+		conn->sign = true;
+		neg_rsp->SecurityMode |= SECMODE_SIGN_ENABLED;
+		if (server_conf.signing == KSMBD_CONFIG_OPT_MANDATORY)
+			neg_rsp->SecurityMode |= SECMODE_SIGN_REQUIRED;
+	}
+	neg_rsp->MaxMpxCount = cpu_to_le16(SMB1_MAX_MPX_COUNT);
+	neg_rsp->MaxNumberVcs = cpu_to_le16(SMB1_MAX_VCS);
+	neg_rsp->MaxBufferSize = cpu_to_le32(conn->vals->max_read_size);
+	neg_rsp->MaxRawSize = cpu_to_le32(SMB1_MAX_RAW_SIZE);
+	neg_rsp->SessionKey = 0;
+	neg_rsp->Capabilities = cpu_to_le32(SMB1_SERVER_CAPS);
+
+	time = ksmbd_systime();
+	neg_rsp->SystemTimeLow = cpu_to_le32(time & 0x00000000FFFFFFFF);
+	neg_rsp->SystemTimeHigh =
+		cpu_to_le32((time & 0xFFFFFFFF00000000) >> 32);
+	neg_rsp->ServerTimeZone = 0;
+
+	if (((struct smb_hdr *)work->request_buf)->Flags2 & SMBFLG2_EXT_SEC)
+		conn->use_spnego = true;
+
+	ksmbd_debug(SMB, "spnego is %s\n", conn->use_spnego ? "on" : "off");
+
+	if (conn->use_spnego == false) {
+		neg_rsp->EncryptionKeyLength = CIFS_CRYPTO_KEY_SIZE;
+		neg_rsp->ByteCount = cpu_to_le16(CIFS_CRYPTO_KEY_SIZE);
+		conn->ntlmssp_cryptkey = kmalloc(CIFS_CRYPTO_KEY_SIZE,
+			GFP_KERNEL);
+		if (!conn->ntlmssp_cryptkey) {
+			rc = -ENOMEM;
+			neg_rsp->hdr.Status.CifsError = STATUS_LOGON_FAILURE;
+			goto err_out;
+		}
+		/* initialize random server challenge */
+		get_random_bytes(conn->ntlmssp_cryptkey, sizeof(__u64));
+		memcpy((neg_rsp->u.EncryptionKey), conn->ntlmssp_cryptkey,
+				CIFS_CRYPTO_KEY_SIZE);
+		/* Adjust pdu length, 17 words and 8 bytes added */
+		inc_rfc1001_len(neg_rsp, (17 * 2 + 8));
+	} else {
+		neg_rsp->EncryptionKeyLength = 0;
+		neg_rsp->ByteCount = cpu_to_le16(SMB1_CLIENT_GUID_SIZE +
+			AUTH_GSS_LENGTH);
+		get_random_bytes(neg_rsp->u.extended_response.GUID,
+			SMB1_CLIENT_GUID_SIZE);
+		ksmbd_copy_gss_neg_header(
+				neg_rsp->u.extended_response.SecurityBlob);
+		inc_rfc1001_len(neg_rsp, (17 * 2 + 16 + AUTH_GSS_LENGTH));
+	}
+
+	/* Null terminated domain name in unicode */
+
+	ksmbd_conn_set_need_negotiate(work);
+	/* Domain name and PC name are ignored by clients, so no need to send.
+	 * We can try sending them later
+	 */
+err_out:
+	return rc;
+}
+
+static int build_sess_rsp_noextsec(struct ksmbd_session *sess,
+		struct smb_com_session_setup_req_no_secext *req,
+		struct smb_com_session_setup_old_resp *rsp)
+{
+	struct ksmbd_conn *conn = sess->conn;
+	int offset, err = 0;
+	char *name;
+
+	/* Build response. We don't use extended security (yet), so wct is 3 */
+	rsp->hdr.WordCount = 3;
+	rsp->Action = 0;
+	/* The names should be unicode */
+	rsp->ByteCount = 0;
+	/* adjust pdu length. data added 6 bytes */
+	inc_rfc1001_len(&rsp->hdr, 6);
+
+	/* check if valid user name is present in request or not */
+	offset = le16_to_cpu(req->CaseInsensitivePasswordLength) +
+		le16_to_cpu(req->CaseSensitivePasswordLength);
+
+	/* 1 byte for padding */
+	name = smb_strndup_from_utf16((req->CaseInsensitivePassword + offset +
+				1), 256, true, conn->local_nls);
+	if (IS_ERR(name)) {
+		ksmbd_err("cannot allocate memory\n");
+		err = PTR_ERR(name);
+		goto out_err;
+	}
+
+	WARN_ON(sess->user);
+
+	ksmbd_debug(SMB, "session setup request for user %s\n", name);
+	sess->user = ksmbd_login_user(name);
+	kfree(name);
+	if (!sess->user) {
+		ksmbd_err("user not present in database\n");
+		err = -EINVAL;
+		goto out_err;
+	}
+
+	if (conn->ntlmssp_cryptkey) {
+		memcpy(sess->ntlmssp.cryptkey, conn->ntlmssp_cryptkey,
+			CIFS_CRYPTO_KEY_SIZE);
+		kfree(conn->ntlmssp_cryptkey);
+		conn->ntlmssp_cryptkey = NULL;
+	} else {
+		ksmbd_err("server challenge is not assigned in negotiate\n");
+		err = -EINVAL;
+		goto out_err;
+	}
+
+	if (user_guest(sess->user)) {
+		rsp->Action = cpu_to_le16(GUEST_LOGIN);
+		goto no_password_check;
+	}
+
+	if (le16_to_cpu(req->CaseSensitivePasswordLength) ==
+			CIFS_AUTH_RESP_SIZE) {
+		err = ksmbd_auth_ntlm(sess, req->CaseInsensitivePassword +
+			le16_to_cpu(req->CaseInsensitivePasswordLength));
+		if (err) {
+			ksmbd_err("ntlm authentication failed for user %s\n",
+					user_name(sess->user));
+			goto out_err;
+		}
+	} else {
+		char *ntdomain;
+
+		offset = le16_to_cpu(req->CaseInsensitivePasswordLength) +
+			le16_to_cpu(req->CaseSensitivePasswordLength) +
+			((strlen(user_name(sess->user)) + 1) * 2);
+
+		ntdomain = smb_strndup_from_utf16(
+				req->CaseInsensitivePassword +
+				offset + 1, 256, true, conn->local_nls);
+		if (IS_ERR(ntdomain)) {
+			ksmbd_err("cannot allocate memory\n");
+			err = PTR_ERR(ntdomain);
+			goto out_err;
+		}
+
+		err = ksmbd_auth_ntlmv2(sess,
+			(struct ntlmv2_resp *) ((char *)
+			req->CaseInsensitivePassword +
+			le16_to_cpu(req->CaseInsensitivePasswordLength)),
+			le16_to_cpu(req->CaseSensitivePasswordLength) -
+				CIFS_ENCPWD_SIZE, ntdomain);
+		kfree(ntdomain);
+		if (err) {
+			ksmbd_err("authentication failed for user %s\n",
+					user_name(sess->user));
+			goto out_err;
+		}
+	}
+
+no_password_check:
+	/* this is an ANDx command ? */
+	rsp->AndXReserved = 0;
+	rsp->AndXOffset = cpu_to_le16(get_rfc1002_len(&rsp->hdr));
+
+	if (req->AndXCommand != SMB_NO_MORE_ANDX_COMMAND) {
+		/* adjust response */
+		rsp->AndXCommand = req->AndXCommand;
+		return rsp->AndXCommand; /* More processing required */
+	}
+	rsp->AndXCommand = SMB_NO_MORE_ANDX_COMMAND;
+
+out_err:
+	return err;
+}
+
+static int build_sess_rsp_extsec(struct ksmbd_session *sess,
+		struct smb_com_session_setup_req *req,
+		struct smb_com_session_setup_resp *rsp)
+{
+	struct ksmbd_conn *conn = sess->conn;
+	struct negotiate_message *negblob;
+	char *neg_blob;
+	int err = 0, neg_blob_len;
+	unsigned char *spnego_blob;
+	u16 spnego_blob_len;
+
+	rsp->hdr.WordCount = 4;
+	rsp->Action = 0;
+
+	/* The names should be unicode */
+	rsp->ByteCount = 0;
+	/* adjust pdu length. data added 6 bytes */
+	inc_rfc1001_len(&rsp->hdr, 8);
+
+	negblob = (struct negotiate_message *)req->SecurityBlob;
+	err = ksmbd_decode_negTokenInit((char *)negblob,
+			le16_to_cpu(req->SecurityBlobLength), conn);
+	if (!err) {
+		ksmbd_debug(SMB, "negTokenInit parse err %d\n", err);
+		/* If failed, it might be negTokenTarg */
+		err = ksmbd_decode_negTokenTarg((char *)negblob,
+				le16_to_cpu(req->SecurityBlobLength),
+				conn);
+		if (!err) {
+			ksmbd_debug(SMB, "negTokenTarg parse err %d\n", err);
+			conn->use_spnego = false;
+		}
+		err = 0;
+	}
+
+	if (conn->mechToken)
+		negblob = (struct negotiate_message *)conn->mechToken;
+
+	if (negblob->MessageType == NtLmNegotiate) {
+		struct challenge_message *chgblob;
+
+		ksmbd_debug(SMB, "negotiate phase\n");
+		err = ksmbd_decode_ntlmssp_neg_blob(negblob,
+				le16_to_cpu(req->SecurityBlobLength),
+				sess);
+		if (err)
+			goto out_err;
+
+		chgblob = (struct challenge_message *)rsp->SecurityBlob;
+		memset(chgblob, 0, sizeof(struct challenge_message));
+
+		if (conn->use_spnego) {
+			int sz;
+
+			sz = sizeof(struct negotiate_message) +
+				(strlen(ksmbd_netbios_name()) * 2 + 1 + 4) * 6;
+			neg_blob = kmalloc(sz, GFP_KERNEL);
+			if (!neg_blob) {
+				err = -ENOMEM;
+				goto out_err;
+			}
+			chgblob = (struct challenge_message *)neg_blob;
+			neg_blob_len = ksmbd_build_ntlmssp_challenge_blob(
+					chgblob,
+					sess);
+			if (neg_blob_len < 0) {
+				kfree(neg_blob);
+				err = -ENOMEM;
+				goto out_err;
+			}
+
+			if (build_spnego_ntlmssp_neg_blob(&spnego_blob,
+						&spnego_blob_len,
+						neg_blob, neg_blob_len)) {
+				kfree(neg_blob);
+				err = -ENOMEM;
+				goto out_err;
+			}
+
+			memcpy((char *)rsp->SecurityBlob, spnego_blob,
+					spnego_blob_len);
+			rsp->SecurityBlobLength =
+				cpu_to_le16(spnego_blob_len);
+			kfree(spnego_blob);
+			kfree(neg_blob);
+		} else {
+			neg_blob_len = ksmbd_build_ntlmssp_challenge_blob(
+					chgblob,
+					sess);
+			if (neg_blob_len < 0) {
+				err = -ENOMEM;
+				goto out_err;
+			}
+
+			rsp->SecurityBlobLength = cpu_to_le16(neg_blob_len);
+		}
+
+		rsp->hdr.Status.CifsError = STATUS_MORE_PROCESSING_REQUIRED;
+		/*
+		 * Note: here total size -1 is done as an adjustment
+		 * for 0 size blob.
+		 */
+		inc_rfc1001_len(rsp, le16_to_cpu(rsp->SecurityBlobLength));
+		rsp->ByteCount = rsp->SecurityBlobLength;
+	} else if (negblob->MessageType == NtLmAuthenticate) {
+		struct authenticate_message *authblob;
+		char *username;
+
+		ksmbd_debug(SMB, "authenticate phase\n");
+		if (conn->use_spnego && conn->mechToken)
+			authblob =
+				(struct authenticate_message *)conn->mechToken;
+		else
+			authblob = (struct authenticate_message *)
+						req->SecurityBlob;
+
+		username = smb_strndup_from_utf16((const char *)authblob +
+				le32_to_cpu(authblob->UserName.BufferOffset),
+				le16_to_cpu(authblob->UserName.Length), true,
+				conn->local_nls);
+
+		if (IS_ERR(username)) {
+			ksmbd_err("cannot allocate memory\n");
+			err = PTR_ERR(username);
+			goto out_err;
+		}
+
+		ksmbd_debug(SMB, "session setup request for user %s\n",
+			username);
+		sess->user = ksmbd_login_user(username);
+		kfree(username);
+
+		if (!sess->user) {
+			ksmbd_debug(SMB, "Unknown user name or an error\n");
+			err = -EINVAL;
+			goto out_err;
+		}
+
+		if (user_guest(sess->user)) {
+			rsp->Action = cpu_to_le16(GUEST_LOGIN);
+			goto no_password_check;
+		}
+
+		err = ksmbd_decode_ntlmssp_auth_blob(authblob,
+				le16_to_cpu(req->SecurityBlobLength),
+				sess);
+		if (err) {
+			ksmbd_debug(SMB, "authentication failed\n");
+			err = -EINVAL;
+			goto out_err;
+		}
+
+no_password_check:
+		if (conn->use_spnego) {
+			if (build_spnego_ntlmssp_auth_blob(&spnego_blob,
+						&spnego_blob_len, 0)) {
+				err = -ENOMEM;
+				goto out_err;
+			}
+
+			memcpy((char *)rsp->SecurityBlob, spnego_blob,
+					spnego_blob_len);
+			rsp->SecurityBlobLength =
+				cpu_to_le16(spnego_blob_len);
+			kfree(spnego_blob);
+			inc_rfc1001_len(rsp, spnego_blob_len);
+			rsp->ByteCount = rsp->SecurityBlobLength;
+		}
+	} else {
+		ksmbd_err("Invalid phase\n");
+		err = -EINVAL;
+	}
+
+	/* this is an ANDx command ? */
+	rsp->AndXReserved = 0;
+	rsp->AndXOffset = cpu_to_le16(get_rfc1002_len(&rsp->hdr));
+
+	if (req->AndXCommand != SMB_NO_MORE_ANDX_COMMAND) {
+		/* adjust response */
+		rsp->AndXCommand = req->AndXCommand;
+		return rsp->AndXCommand; /* More processing required */
+	}
+	rsp->AndXCommand = SMB_NO_MORE_ANDX_COMMAND;
+
+out_err:
+	if (conn->use_spnego && conn->mechToken) {
+		kfree(conn->mechToken);
+		conn->mechToken = NULL;
+	}
+
+	return err;
+}
+
+/**
+ * smb_session_setup_andx() - session setup request handler
+ * @work:   smb work containing session setup request buffer
+ *
+ * Return:      0 on success, otherwise error
+ */
+int smb_session_setup_andx(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_session *sess = NULL;
+	int rc = 0, cap;
+	unsigned short uid;
+
+	union smb_com_session_setup_andx *pSMB = work->request_buf;
+	union smb_com_session_setup_andx *rsp = work->response_buf;
+
+	if (pSMB->req.hdr.WordCount == 12)
+		cap = le32_to_cpu(pSMB->req.Capabilities);
+	else if (pSMB->req.hdr.WordCount == 13)
+		cap = le32_to_cpu(pSMB->req_no_secext.Capabilities);
+	else {
+		ksmbd_err("malformed packet\n");
+		work->send_no_response = 1;
+		return 0;
+	}
+
+	uid = le16_to_cpu(pSMB->req.hdr.Uid);
+	if (uid != 0) {
+		sess = ksmbd_session_lookup(conn, uid);
+		if (!sess) {
+			rc = -ENOENT;
+			goto out_err;
+		}
+		ksmbd_debug(SMB, "Reuse session ID: %llu, Uid: %u\n",
+			    sess->id, uid);
+	} else {
+		sess = ksmbd_smb1_session_create();
+		if (!sess) {
+			rc = -ENOMEM;
+			goto out_err;
+		}
+
+		ksmbd_session_register(conn, sess);
+		rsp->resp.hdr.Uid = cpu_to_le16(sess->id);
+		ksmbd_debug(SMB, "New session ID: %llu, Uid: %u\n", sess->id,
+			uid);
+	}
+
+	if (cap & CAP_EXTENDED_SECURITY) {
+		ksmbd_debug(SMB, "build response with extend_security\n");
+		rc = build_sess_rsp_extsec(sess, &pSMB->req, &rsp->resp);
+
+	} else {
+		ksmbd_debug(SMB, "build response without extend_security\n");
+		rc = build_sess_rsp_noextsec(sess, &pSMB->req_no_secext,
+				&rsp->old_resp);
+	}
+	if (rc < 0)
+		goto out_err;
+
+	work->sess = sess;
+	ksmbd_conn_set_good(work);
+	return 0;
+
+out_err:
+	rsp->resp.hdr.Status.CifsError = STATUS_LOGON_FAILURE;
+	rsp->resp.hdr.WordCount = 0;
+	rsp->resp.ByteCount = 0;
+	if (rc < 0 && sess) {
+		ksmbd_session_destroy(sess);
+		work->sess = NULL;
+	}
+	return rc;
+}
+
+/**
+ * file_create_dispostion_flags() - convert disposition flags to
+ *				file open flags
+ * @dispostion:		file disposition contained in open request
+ * @file_present:	file already present or not
+ *
+ * Return:      file open flags after conversion from disposition
+ */
+static int file_create_dispostion_flags(int dispostion, bool file_present)
+{
+	int disp_flags = 0;
+
+	switch (dispostion) {
+	/*
+	 * If the file already exists, it SHOULD be superseded (overwritten).
+	 * If it does not already exist, then it SHOULD be created.
+	 */
+	case FILE_SUPERSEDE:
+		if (file_present)
+			disp_flags |= O_TRUNC;
+		else
+			disp_flags |= O_CREAT;
+		break;
+	/*
+	 * If the file already exists, it SHOULD be opened rather than created.
+	 * If the file does not already exist, the operation MUST fail.
+	 */
+	case FILE_OPEN:
+		if (!file_present)
+			return -ENOENT;
+		break;
+	/*
+	 * If the file already exists, the operation MUST fail.
+	 * If the file does not already exist, it SHOULD be created.
+	 */
+	case FILE_CREATE:
+		if (file_present)
+			return -EEXIST;
+		disp_flags |= O_CREAT;
+		break;
+	/*
+	 * If the file already exists, it SHOULD be opened. If the file
+	 * does not already exist, then it SHOULD be created.
+	 */
+	case FILE_OPEN_IF:
+		if (!file_present)
+			disp_flags |= O_CREAT;
+		break;
+	/*
+	 * If the file already exists, it SHOULD be opened and truncated.
+	 * If the file does not already exist, the operation MUST fail.
+	 */
+	case FILE_OVERWRITE:
+		if (!file_present)
+			return -ENOENT;
+		disp_flags |= O_TRUNC;
+		break;
+	/*
+	 * If the file already exists, it SHOULD be opened and truncated.
+	 * If the file does not already exist, it SHOULD be created.
+	 */
+	case FILE_OVERWRITE_IF:
+		if (file_present)
+			disp_flags |= O_TRUNC;
+		else
+			disp_flags |= O_CREAT;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return disp_flags;
+}
+
+/**
+ * convert_generic_access_flags() - convert access flags to
+ *				file open flags
+ * @access_flag:	file access flags contained in open request
+ * @open_flag:		file open flags are updated as per access flags
+ * @attrib:		attribute flag indicating posix symantics or not
+ *
+ * Return:		access flags
+ */
+static int
+convert_generic_access_flags(int access_flag, int *open_flags, int attrib)
+{
+	int aflags = access_flag;
+	int oflags = *open_flags;
+
+	if (aflags & GENERIC_READ) {
+		aflags &= ~GENERIC_READ;
+		aflags |= GENERIC_READ_FLAGS;
+	}
+
+	if (aflags & GENERIC_WRITE) {
+		aflags &= ~GENERIC_WRITE;
+		aflags |= GENERIC_WRITE_FLAGS;
+	}
+
+	if (aflags & GENERIC_EXECUTE) {
+		aflags &= ~GENERIC_EXECUTE;
+		aflags |= GENERIC_EXECUTE_FLAGS;
+	}
+
+	if (aflags & GENERIC_ALL) {
+		aflags &= ~GENERIC_ALL;
+		aflags |= GENERIC_ALL_FLAGS;
+	}
+
+	if (oflags & O_TRUNC)
+		aflags |= FILE_WRITE_DATA;
+
+	if (aflags & (FILE_WRITE_DATA | FILE_APPEND_DATA)) {
+		if (aflags & (FILE_READ_ATTRIBUTES | FILE_READ_DATA |
+					FILE_READ_EA | FILE_EXECUTE)) {
+			*open_flags |= O_RDWR;
+
+		} else {
+			*open_flags |= O_WRONLY;
+		}
+	} else {
+		*open_flags |= O_RDONLY;
+	}
+
+	if ((attrib & ATTR_POSIX_SEMANTICS) && (aflags & FILE_APPEND_DATA))
+		*open_flags |= O_APPEND;
+
+	return aflags;
+}
+
+/**
+ * smb_get_dos_attr() - convert unix style stat info to dos attr
+ * @stat:	stat to be converted to dos attr
+ *
+ * Return:	dos style attribute
+ */
+static __u32 smb_get_dos_attr(struct kstat *stat)
+{
+	__u32 attr = 0;
+
+	/* check whether file has attributes ATTR_READONLY, ATTR_HIDDEN,
+	 * ATTR_SYSTEM, ATTR_VOLUME, ATTR_DIRECTORY, ATTR_ARCHIVE,
+	 * ATTR_DEVICE, ATTR_NORMAL, ATTR_TEMPORARY, ATTR_SPARSE,
+	 * ATTR_REPARSE, ATTR_COMPRESSED, ATTR_OFFLINE
+	 */
+
+	if (stat->mode & S_ISVTX)   /* hidden */
+		attr |=  (ATTR_HIDDEN | ATTR_SYSTEM);
+
+	if (!(stat->mode & 0222))  /* read-only */
+		attr |=  ATTR_READONLY;
+
+	if (S_ISDIR(stat->mode))
+		attr |= ATTR_DIRECTORY;
+
+	if (stat->size > (stat->blksize * stat->blocks))
+		attr |= ATTR_SPARSE;
+
+	if (!attr)
+		attr |= ATTR_NORMAL;
+
+	return attr;
+}
+
+static int
+lock_oplock_release(struct ksmbd_file *fp, int type, int oplock_level)
+{
+	struct oplock_info *opinfo;
+	int ret;
+
+	ksmbd_debug(SMB, "got oplock brk for level OplockLevel = %d\n",
+		      oplock_level);
+
+	opinfo = fp->f_opinfo;
+	if (opinfo->op_state == OPLOCK_STATE_NONE) {
+		ksmbd_err("unexpected oplock state 0x%x\n", opinfo->op_state);
+		return -EINVAL;
+	}
+
+	if (oplock_level == OPLOCK_EXCLUSIVE || oplock_level == OPLOCK_BATCH) {
+		if (opinfo_write_to_none(opinfo) < 0) {
+			opinfo->op_state = OPLOCK_STATE_NONE;
+			return -EINVAL;
+		}
+	} else if (((opinfo->level == OPLOCK_EXCLUSIVE) ||
+				(opinfo->level == OPLOCK_BATCH)) &&
+			(oplock_level == OPLOCK_READ)) {
+		ret = opinfo_write_to_read(opinfo);
+		if (ret) {
+			opinfo->op_state = OPLOCK_STATE_NONE;
+			return -EINVAL;
+		}
+	} else if ((opinfo->level == OPLOCK_READ) &&
+			(oplock_level == OPLOCK_NONE)) {
+		ret = opinfo_read_to_none(opinfo);
+		if (ret) {
+			opinfo->op_state = OPLOCK_STATE_NONE;
+			return -EINVAL;
+		}
+	}
+
+	opinfo->op_state = OPLOCK_STATE_NONE;
+	wake_up_interruptible(&opinfo->oplock_q);
+
+	return 0;
+}
+
+static struct ksmbd_lock *smb_lock_init(struct file_lock *flock,
+		unsigned int cmd, int mode, unsigned long long offset,
+		unsigned long long length, struct list_head *lock_list)
+{
+	struct ksmbd_lock *lock;
+
+	lock = kzalloc(sizeof(struct ksmbd_lock), GFP_KERNEL);
+	if (!lock)
+		return NULL;
+
+	lock->cmd = cmd;
+	lock->fl = flock;
+	lock->start = offset;
+	lock->end = offset + length;
+	lock->flags = mode;
+	if (lock->start == lock->end)
+		lock->zero_len = 1;
+	INIT_LIST_HEAD(&lock->llist);
+	INIT_LIST_HEAD(&lock->glist);
+	list_add_tail(&lock->llist, lock_list);
+
+	return lock;
+}
+
+/**
+ * smb_locking_andx() - received oplock break response from client
+ * @work:	smb work containing oplock break command
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_locking_andx(struct ksmbd_work *work)
+{
+	struct smb_com_lock_req *req = work->request_buf;
+	struct smb_com_lock_rsp *rsp = work->response_buf;
+	struct ksmbd_file *fp;
+	int err = 0;
+	struct locking_andx_range32 *lock_ele32 = NULL, *unlock_ele32 = NULL;
+	struct locking_andx_range64 *lock_ele64 = NULL, *unlock_ele64 = NULL;
+	struct file *filp = NULL;
+	struct ksmbd_lock *smb_lock = NULL, *cmp_lock, *tmp;
+	int i, lock_count, unlock_count;
+	unsigned long long offset, length;
+	struct file_lock *flock = NULL;
+	unsigned int cmd = 0;
+	LIST_HEAD(lock_list);
+	LIST_HEAD(rollback_list);
+	int locked, timeout;
+	const unsigned long long loff_max = ~0;
+
+	timeout = le32_to_cpu(req->Timeout);
+	ksmbd_debug(SMB, "got oplock brk for fid %d lock type = 0x%x, timeout : %d\n",
+		      req->Fid, req->LockType, timeout);
+
+	/* find fid */
+	fp = ksmbd_lookup_fd_fast(work, req->Fid);
+	if (!fp) {
+		ksmbd_err("cannot obtain fid for %d\n", req->Fid);
+		return -EINVAL;
+	}
+
+	if (req->LockType & LOCKING_ANDX_OPLOCK_RELEASE) {
+		ksmbd_err("lock type is oplock release\n");
+		err = lock_oplock_release(fp, req->LockType, req->OplockLevel);
+	}
+
+	filp = fp->filp;
+	lock_count = le16_to_cpu(req->NumberOfLocks);
+	unlock_count = le16_to_cpu(req->NumberOfUnlocks);
+
+	ksmbd_debug(SMB, "lock count is %d, unlock_count : %d\n",
+		lock_count, unlock_count);
+
+	if (req->LockType & LOCKING_ANDX_LARGE_FILES)
+		lock_ele64 = (struct locking_andx_range64 *)req->Locks;
+	else
+		lock_ele32 = (struct locking_andx_range32 *)req->Locks;
+
+	if (req->LockType & LOCKING_ANDX_CHANGE_LOCKTYPE) {
+		ksmbd_err("lock type: LOCKING_ANDX_CHANGE_LOCKTYPE\n");
+		rsp->hdr.Status.DosError.ErrorClass = ERRDOS;
+		rsp->hdr.Status.DosError.Error = cpu_to_le16(ERRnoatomiclocks);
+		rsp->hdr.Flags2 &= ~SMBFLG2_ERR_STATUS;
+		goto out;
+	}
+
+	if (req->LockType & LOCKING_ANDX_CANCEL_LOCK)
+		ksmbd_err("lock type: LOCKING_ANDX_CANCEL_LOCK\n");
+
+	for (i = 0; i < lock_count; i++) {
+		flock = smb_flock_init(filp);
+		if (!flock)
+			goto out;
+
+		if (req->LockType & LOCKING_ANDX_SHARED_LOCK) {
+			ksmbd_err("received shared request\n");
+			if (!(filp->f_mode & FMODE_READ)) {
+				rsp->hdr.Status.CifsError =
+					STATUS_ACCESS_DENIED;
+				goto out;
+			}
+			cmd = F_SETLKW;
+			flock->fl_type = F_RDLCK;
+		} else {
+			ksmbd_err("received exclusive request\n");
+			if (!(filp->f_mode & FMODE_WRITE)) {
+				rsp->hdr.Status.CifsError =
+					STATUS_ACCESS_DENIED;
+				goto out;
+			}
+			cmd = F_SETLKW;
+			flock->fl_type = F_WRLCK;
+			flock->fl_flags |= FL_SLEEP;
+		}
+
+		if (req->LockType & LOCKING_ANDX_LARGE_FILES) {
+			offset = (unsigned long long)le32_to_cpu(
+					lock_ele64[i].OffsetLow);
+			length = (unsigned long long)le32_to_cpu(
+					lock_ele64[i].LengthLow);
+			offset |= (unsigned long long)le32_to_cpu(
+					lock_ele64[i].OffsetHigh) << 32;
+			length |= (unsigned long long)le32_to_cpu(
+					lock_ele64[i].LengthHigh) << 32;
+		} else {
+			offset = (unsigned long long)le32_to_cpu(
+				lock_ele32[i].Offset);
+			length = (unsigned long long)le32_to_cpu(
+				lock_ele32[i].Length);
+		}
+
+		if (offset > loff_max) {
+			ksmbd_err("Invalid lock range requested\n");
+			rsp->hdr.Status.CifsError =
+				STATUS_INVALID_LOCK_RANGE;
+			goto out;
+		}
+
+		if (offset > 0 && length > (loff_max - offset) + 1) {
+			ksmbd_err("Invalid lock range requested\n");
+			rsp->hdr.Status.CifsError =
+				STATUS_INVALID_LOCK_RANGE;
+			goto out;
+		}
+
+		ksmbd_debug(SMB, "locking offset : %llx, length : %llu\n",
+			offset, length);
+
+		if (offset > OFFSET_MAX)
+			flock->fl_start = OFFSET_MAX;
+		else
+			flock->fl_start = offset;
+		if (offset + length > OFFSET_MAX)
+			flock->fl_end = OFFSET_MAX;
+		else
+			flock->fl_end = offset + length;
+
+		smb_lock = smb_lock_init(flock, cmd, req->LockType, offset,
+			length, &lock_list);
+		if (!smb_lock)
+			goto out;
+	}
+
+	list_for_each_entry_safe(smb_lock, tmp, &lock_list, llist) {
+		int same_zero_lock = 0;
+
+		list_del(&smb_lock->llist);
+		/* check locks in global list */
+		list_for_each_entry(cmp_lock, &global_lock_list, glist) {
+			if (file_inode(cmp_lock->fl->fl_file) !=
+				file_inode(smb_lock->fl->fl_file))
+				continue;
+
+			if (smb_lock->zero_len &&
+				cmp_lock->start == smb_lock->start &&
+				cmp_lock->end == smb_lock->end) {
+				same_zero_lock = 1;
+				break;
+			}
+
+			/* check zero byte lock range */
+			if (cmp_lock->zero_len && !smb_lock->zero_len &&
+					cmp_lock->start > smb_lock->start &&
+					cmp_lock->start < smb_lock->end) {
+				ksmbd_err("previous lock conflict with zero byte lock range\n");
+				err = -EPERM;
+			} else if (smb_lock->zero_len && !cmp_lock->zero_len &&
+				smb_lock->start > cmp_lock->start &&
+				smb_lock->start < cmp_lock->end) {
+				ksmbd_err("current lock conflict with zero byte lock range\n");
+				err = -EPERM;
+			} else if (((cmp_lock->start <= smb_lock->start &&
+				cmp_lock->end > smb_lock->start) ||
+				(cmp_lock->start < smb_lock->end &&
+				 cmp_lock->end >= smb_lock->end)) &&
+				!cmp_lock->zero_len && !smb_lock->zero_len) {
+				ksmbd_err("Not allow lock operation on exclusive lock range\n");
+				err = -EPERM;
+			}
+
+			if (err) {
+				/* Clean error cache */
+				if ((smb_lock->zero_len &&
+						fp->cflock_cnt > 1) ||
+					(timeout && (fp->llock_fstart ==
+							smb_lock->start))) {
+					ksmbd_debug(SMB, "clean error cache\n");
+					fp->cflock_cnt = 0;
+				}
+
+				if (timeout > 0 ||
+					(fp->cflock_cnt > 0 &&
+					fp->llock_fstart == smb_lock->start) ||
+					((smb_lock->start >> 63) == 0 &&
+					smb_lock->start >= 0xEF000000)) {
+					if (timeout) {
+						ksmbd_debug(SMB, "waiting error response for timeout : %d\n",
+							timeout);
+						msleep(timeout);
+					}
+					rsp->hdr.Status.CifsError =
+						STATUS_FILE_LOCK_CONFLICT;
+				} else
+					rsp->hdr.Status.CifsError =
+						STATUS_LOCK_NOT_GRANTED;
+				fp->cflock_cnt++;
+				fp->llock_fstart = smb_lock->start;
+				goto out;
+			}
+		}
+
+		if (same_zero_lock)
+			continue;
+		if (smb_lock->zero_len) {
+			err = 0;
+			goto skip;
+		}
+
+		flock = smb_lock->fl;
+retry:
+		err = ksmbd_vfs_lock(filp, smb_lock->cmd, flock);
+		if (err == FILE_LOCK_DEFERRED) {
+			ksmbd_err("would have to wait for getting lock\n");
+			list_add_tail(&smb_lock->glist,
+					&global_lock_list);
+			list_add(&smb_lock->llist, &rollback_list);
+wait:
+			err = ksmbd_vfs_posix_lock_wait_timeout(flock,
+							msecs_to_jiffies(10));
+			if (err) {
+				list_del(&smb_lock->llist);
+				list_del(&smb_lock->glist);
+				goto retry;
+			} else
+				goto wait;
+		} else if (!err) {
+skip:
+			list_add_tail(&smb_lock->glist,
+					&global_lock_list);
+			list_add(&smb_lock->llist, &rollback_list);
+			ksmbd_err("successful in taking lock\n");
+		} else if (err < 0) {
+			rsp->hdr.Status.CifsError = STATUS_LOCK_NOT_GRANTED;
+			goto out;
+		}
+	}
+
+	if (req->LockType & LOCKING_ANDX_LARGE_FILES)
+		unlock_ele64 = (struct locking_andx_range64 *)(req->Locks +
+				(sizeof(struct locking_andx_range64) *
+				 lock_count));
+	else
+		unlock_ele32 = (struct locking_andx_range32 *)(req->Locks +
+				(sizeof(struct locking_andx_range32) *
+				 lock_count));
+
+	for (i = 0; i < unlock_count; i++) {
+		flock = smb_flock_init(filp);
+		if (!flock)
+			goto out;
+
+		flock->fl_type = F_UNLCK;
+		cmd = 0;
+
+		if (req->LockType & LOCKING_ANDX_LARGE_FILES) {
+			offset = (unsigned long long)le32_to_cpu(
+					unlock_ele64[i].OffsetLow);
+			length = (unsigned long long)le32_to_cpu(
+					unlock_ele64[i].LengthLow);
+			offset |= (unsigned long long)le32_to_cpu(
+					unlock_ele64[i].OffsetHigh) << 32;
+			length |= (unsigned long long)le32_to_cpu(
+					unlock_ele64[i].LengthHigh) << 32;
+		} else {
+			offset = (unsigned long long)le32_to_cpu(
+				unlock_ele32[i].Offset);
+			length = (unsigned long long)le32_to_cpu(
+				unlock_ele32[i].Length);
+		}
+
+		ksmbd_debug(SMB, "unlock offset : %llx, length : %llu\n",
+			offset, length);
+
+		if (offset > OFFSET_MAX)
+			flock->fl_start = OFFSET_MAX;
+		else
+			flock->fl_start = offset;
+		if (offset + length > OFFSET_MAX)
+			flock->fl_end = OFFSET_MAX;
+		else
+			flock->fl_end = offset + length;
+
+		locked = 0;
+		list_for_each_entry(cmp_lock, &global_lock_list, glist) {
+			if (file_inode(cmp_lock->fl->fl_file) !=
+				file_inode(flock->fl_file))
+				continue;
+
+			if ((cmp_lock->start == offset &&
+				 cmp_lock->end == offset + length)) {
+				locked = 1;
+				break;
+			}
+		}
+
+		if (!locked) {
+			locks_free_lock(flock);
+			rsp->hdr.Status.CifsError = STATUS_RANGE_NOT_LOCKED;
+			goto out;
+		}
+
+		err = ksmbd_vfs_lock(filp, cmd, flock);
+		if (!err) {
+			ksmbd_debug(SMB, "File unlocked\n");
+			list_del(&cmp_lock->glist);
+			locks_free_lock(cmp_lock->fl);
+			kfree(cmp_lock);
+			fp->cflock_cnt = 0;
+		} else if (err == -ENOENT) {
+			rsp->hdr.Status.CifsError = STATUS_RANGE_NOT_LOCKED;
+			goto out;
+		}
+		locks_free_lock(flock);
+	}
+
+	rsp->hdr.WordCount = 2;
+	rsp->ByteCount = 0;
+	inc_rfc1001_len(&rsp->hdr, (rsp->hdr.WordCount * 2));
+
+	/* this is an ANDx command ? */
+	rsp->AndXReserved = 0;
+	rsp->AndXOffset = cpu_to_le16(get_rfc1002_len(&rsp->hdr));
+	if (req->AndXCommand != SMB_NO_MORE_ANDX_COMMAND) {
+		/* adjust response */
+		rsp->AndXCommand = req->AndXCommand;
+		return rsp->AndXCommand; /* More processing required */
+	}
+	rsp->AndXCommand = SMB_NO_MORE_ANDX_COMMAND;
+	ksmbd_fd_put(work, fp);
+	return err;
+
+out:
+	list_for_each_entry_safe(smb_lock, tmp, &lock_list, llist) {
+		locks_free_lock(smb_lock->fl);
+		list_del(&smb_lock->llist);
+		kfree(smb_lock);
+	}
+
+	list_for_each_entry_safe(smb_lock, tmp, &rollback_list, llist) {
+		struct file_lock *rlock = NULL;
+
+		rlock = smb_flock_init(filp);
+		rlock->fl_type = F_UNLCK;
+		rlock->fl_start = smb_lock->start;
+		rlock->fl_end = smb_lock->end;
+
+		err = ksmbd_vfs_lock(filp, 0, rlock);
+		if (err)
+			ksmbd_err("rollback unlock fail : %d\n", err);
+		list_del(&smb_lock->llist);
+		list_del(&smb_lock->glist);
+		locks_free_lock(smb_lock->fl);
+		locks_free_lock(rlock);
+		kfree(smb_lock);
+	}
+
+	ksmbd_fd_put(work, fp);
+	ksmbd_err("failed in taking lock\n");
+	return err;
+}
+
+/**
+ * smb_trans() - trans2 command dispatcher
+ * @work:	smb work containing trans2 command
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_trans(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb_com_trans_req *req = work->request_buf;
+	struct smb_com_trans_rsp *rsp = work->response_buf;
+	struct smb_com_trans_pipe_req *pipe_req = work->request_buf;
+	struct ksmbd_rpc_command *rpc_resp;
+	__u16 subcommand;
+	char *name, *pipe;
+	char *pipedata;
+	int setup_bytes_count = 0;
+	int pipe_name_offset = 0;
+	int str_len_uni;
+	int ret = 0, nbytes = 0;
+	int param_len = 0;
+	int id, buf_len;
+	int padding;
+
+	buf_len = le16_to_cpu(req->MaxDataCount);
+	buf_len = min((int)(KSMBD_IPC_MAX_PAYLOAD -
+				sizeof(struct smb_com_trans_rsp)), buf_len);
+
+	if (req->SetupCount)
+		setup_bytes_count = 2 * req->SetupCount;
+
+	subcommand = le16_to_cpu(req->SubCommand);
+	name = smb_strndup_from_utf16(req->Data + setup_bytes_count, 256, 1,
+			conn->local_nls);
+
+	if (IS_ERR(name)) {
+		ksmbd_err("failed to allocate memory\n");
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		return PTR_ERR(name);
+	}
+
+	ksmbd_debug(SMB, "Obtained string name = %s setupcount = %d\n",
+			name, setup_bytes_count);
+
+	pipe_name_offset = strlen("\\PIPE");
+	if (strncmp("\\PIPE", name, pipe_name_offset) != 0) {
+		ksmbd_debug(SMB, "Not Pipe request\n");
+		rsp->hdr.Status.CifsError = STATUS_NOT_SUPPORTED;
+		kfree(name);
+		return 0;
+	}
+
+	if (name[pipe_name_offset] == '\\')
+		pipe_name_offset++;
+
+	pipe = name + pipe_name_offset;
+
+	if (*pipe != '\0' && strncmp(pipe, "LANMAN", sizeof("LANMAN")) != 0) {
+		ksmbd_debug(SMB, "Pipe %s not supported request\n", pipe);
+		rsp->hdr.Status.CifsError = STATUS_NOT_SUPPORTED;
+		kfree(name);
+		return 0;
+	}
+
+	/* Incoming pipe name unicode len */
+	str_len_uni = 2 * (strlen(name) + 1);
+
+	ksmbd_debug(SMB, "Pipe name unicode len = %d\n", str_len_uni);
+
+	/* Some clients like Windows may have additional padding. */
+	padding = le16_to_cpu(req->ParameterOffset) -
+		offsetof(struct smb_com_trans_req, Data)
+		- str_len_uni;
+	pipedata = req->Data + str_len_uni + setup_bytes_count + padding;
+
+	if (!strncmp(pipe, "LANMAN", sizeof("LANMAN"))) {
+		rpc_resp = ksmbd_rpc_rap(work->sess, pipedata,
+					 le16_to_cpu(req->TotalParameterCount));
+
+		if (rpc_resp) {
+			if (rpc_resp->flags == KSMBD_RPC_ENOTIMPLEMENTED) {
+				rsp->hdr.Status.CifsError =
+					STATUS_NOT_SUPPORTED;
+				kvfree(rpc_resp);
+				goto out;
+			} else if (rpc_resp->flags != KSMBD_RPC_OK) {
+				rsp->hdr.Status.CifsError =
+					STATUS_INVALID_PARAMETER;
+				kvfree(rpc_resp);
+				goto out;
+			}
+
+			nbytes = rpc_resp->payload_sz;
+			memcpy((char *)rsp + sizeof(struct smb_com_trans_rsp),
+				rpc_resp->payload, nbytes);
+
+			kvfree(rpc_resp);
+			ret = 0;
+			goto resp_out;
+		} else {
+			ret = -EINVAL;
+			goto out;
+		}
+	}
+
+	id = pipe_req->fid;
+	switch (subcommand) {
+	case TRANSACT_DCERPCCMD:
+
+		ksmbd_debug(SMB, "GOT TRANSACT_DCERPCCMD\n");
+		ret = -EINVAL;
+		rpc_resp = ksmbd_rpc_ioctl(work->sess, id, pipedata,
+					   le16_to_cpu(req->DataCount));
+		if (rpc_resp) {
+			if (rpc_resp->flags == KSMBD_RPC_ENOTIMPLEMENTED) {
+				rsp->hdr.Status.CifsError =
+					STATUS_NOT_SUPPORTED;
+				kvfree(rpc_resp);
+				goto out;
+			} else if (rpc_resp->flags != KSMBD_RPC_OK) {
+				rsp->hdr.Status.CifsError =
+					STATUS_INVALID_PARAMETER;
+				kvfree(rpc_resp);
+				goto out;
+			}
+
+			nbytes = rpc_resp->payload_sz;
+			memcpy((char *)rsp + sizeof(struct smb_com_trans_rsp),
+				rpc_resp->payload, nbytes);
+			kvfree(rpc_resp);
+			ret = 0;
+		}
+		break;
+
+	default:
+		ksmbd_debug(SMB, "SMB TRANS subcommand not supported %u\n",
+				subcommand);
+		ret = -EOPNOTSUPP;
+		rsp->hdr.Status.CifsError = STATUS_NOT_SUPPORTED;
+		goto out;
+	}
+
+resp_out:
+
+	rsp->hdr.WordCount = 10;
+	rsp->TotalParameterCount = cpu_to_le16(param_len);
+	rsp->TotalDataCount = cpu_to_le16(nbytes);
+	rsp->Reserved = 0;
+	rsp->ParameterCount = cpu_to_le16(param_len);
+	rsp->ParameterOffset = cpu_to_le16(56);
+	rsp->ParameterDisplacement = 0;
+	rsp->DataCount = cpu_to_le16(nbytes);
+	rsp->DataOffset = cpu_to_le16(56 + param_len);
+	rsp->DataDisplacement = 0;
+	rsp->SetupCount = 0;
+	rsp->Reserved1 = 0;
+	/* Adding 1 for Pad */
+	rsp->ByteCount = cpu_to_le16(nbytes + 1 + param_len);
+	rsp->Pad = 0;
+	inc_rfc1001_len(&rsp->hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+
+out:
+	kfree(name);
+	return ret;
+}
+
+/**
+ * create_andx_pipe() - create ipc pipe request handler
+ * @work:	smb work containing create command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int create_andx_pipe(struct ksmbd_work *work)
+{
+	struct smb_com_open_req *req = work->request_buf;
+	struct smb_com_open_ext_rsp *rsp = work->response_buf;
+	char *name;
+	int rc = 0;
+	__u16 fid;
+
+	/* one byte pad before unicode file name start */
+	if (is_smbreq_unicode(&req->hdr))
+		name = smb_strndup_from_utf16(req->fileName + 1, 256, 1,
+				work->conn->local_nls);
+	else
+		name = smb_strndup_from_utf16(req->fileName, 256, 1,
+				work->conn->local_nls);
+
+	if (IS_ERR(name)) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	rc = ksmbd_session_rpc_open(work->sess, name);
+	if (rc < 0)
+		goto out;
+	fid = rc;
+
+	rsp->hdr.WordCount = 42;
+	rsp->AndXCommand = SMB_NO_MORE_ANDX_COMMAND;
+	rsp->AndXReserved = 0;
+	rsp->OplockLevel = 0;
+	rsp->Fid = fid;
+	rsp->CreateAction = cpu_to_le32(1);
+	rsp->CreationTime = 0;
+	rsp->LastAccessTime = 0;
+	rsp->LastWriteTime = 0;
+	rsp->ChangeTime = 0;
+	rsp->FileAttributes = cpu_to_le32(ATTR_NORMAL);
+	rsp->AllocationSize = cpu_to_le64(0);
+	rsp->EndOfFile = 0;
+	rsp->FileType = cpu_to_le16(2);
+	rsp->DeviceState = cpu_to_le16(0x05ff);
+	rsp->DirectoryFlag = 0;
+	rsp->fid = 0;
+	rsp->MaxAccess = cpu_to_le32(FILE_GENERIC_ALL);
+	rsp->GuestAccess = cpu_to_le32(FILE_GENERIC_READ);
+	rsp->ByteCount = 0;
+	inc_rfc1001_len(&rsp->hdr, 100);
+
+out:
+	switch (rc) {
+	case 0:
+		rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+		break;
+	case -EINVAL:
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		break;
+	case -EOVERFLOW:
+		rsp->hdr.Status.CifsError = STATUS_BUFFER_OVERFLOW;
+		break;
+	case -ETIMEDOUT:
+		rsp->hdr.Status.CifsError = STATUS_IO_TIMEOUT;
+		break;
+	case -EOPNOTSUPP:
+		rsp->hdr.Status.CifsError = STATUS_NOT_SUPPORTED;
+		break;
+	case -EMFILE:
+		rsp->hdr.Status.CifsError = STATUS_TOO_MANY_OPENED_FILES;
+		break;
+	default:
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		break;
+	}
+
+	kfree(name);
+	return rc;
+}
+
+/**
+ * smb_nt_create_andx() - file open request handler
+ * @work:	smb work containing nt open command
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_nt_create_andx(struct ksmbd_work *work)
+{
+	struct smb_com_open_req *req = work->request_buf;
+	struct smb_com_open_rsp *rsp = work->response_buf;
+	struct smb_com_open_ext_rsp *ext_rsp = work->response_buf;
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_tree_connect *tcon = work->tcon;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct path path;
+	struct kstat stat;
+	int oplock_flags, file_info, open_flags, access_flags;
+	char *name;
+	char *conv_name;
+	bool file_present = true, extended_reply;
+	__u64 alloc_size = 0, time;
+	umode_t mode = 0;
+	int err;
+	int create_directory = 0;
+	char *src;
+	char *root = NULL;
+	bool is_unicode;
+	bool is_relative_root = false;
+	struct ksmbd_file *fp = NULL;
+	int oplock_rsp = OPLOCK_NONE;
+	int share_ret;
+	unsigned int flags = LOOKUP_FOLLOW;
+
+	rsp->hdr.Status.CifsError = STATUS_UNSUCCESSFUL;
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_PIPE)) {
+		ksmbd_debug(SMB, "create pipe on IPC\n");
+		return create_andx_pipe(work);
+	}
+
+	if (req->CreateOptions & FILE_OPEN_BY_FILE_ID_LE) {
+		ksmbd_debug(SMB, "file open with FID is not supported\n");
+		rsp->hdr.Status.CifsError = STATUS_NOT_SUPPORTED;
+		return -EINVAL;
+	}
+
+	if (req->CreateOptions & FILE_DELETE_ON_CLOSE_LE) {
+		if (req->DesiredAccess &&
+				!(le32_to_cpu(req->DesiredAccess) & DELETE)) {
+			rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+			return -EPERM;
+		}
+
+		if (le32_to_cpu(req->FileAttributes) & ATTR_READONLY) {
+			rsp->hdr.Status.CifsError = STATUS_CANNOT_DELETE;
+			return -EPERM;
+		}
+	}
+
+	if (req->CreateOptions & FILE_DIRECTORY_FILE_LE) {
+		ksmbd_debug(SMB, "GOT Create Directory via CREATE ANDX\n");
+		create_directory = 1;
+	}
+
+	/*
+	 * Filename is relative to this root directory FID, instead of
+	 * tree connect point. Find root dir name from this FID and
+	 * prepend root dir name in filename.
+	 */
+	if (req->RootDirectoryFid) {
+		ksmbd_debug(SMB, "path lookup relative to RootDirectoryFid\n");
+
+		is_relative_root = true;
+		fp = ksmbd_lookup_fd_fast(work, req->RootDirectoryFid);
+		if (fp)
+			root = (char *)fp->filp->f_path.dentry->d_name.name;
+		else {
+			rsp->hdr.Status.CifsError = STATUS_INVALID_HANDLE;
+			memset(&rsp->hdr.WordCount, 0, 3);
+			return -EINVAL;
+		}
+		ksmbd_fd_put(work, fp);
+	}
+
+	/* here allocated +2 (UNI '\0') length for both ASCII & UNI
+	 * to avoid unnecessary if/else check
+	 */
+	src = kzalloc(le16_to_cpu(req->NameLength) + 2, GFP_KERNEL);
+	if (!src) {
+		rsp->hdr.Status.CifsError =
+			STATUS_NO_MEMORY;
+
+		return -ENOMEM;
+	}
+
+	if (is_smbreq_unicode(&req->hdr)) {
+		memcpy(src, req->fileName + 1, le16_to_cpu(req->NameLength));
+		is_unicode = true;
+	} else {
+		memcpy(src, req->fileName, le16_to_cpu(req->NameLength));
+		is_unicode = false;
+	}
+
+	name = smb_strndup_from_utf16(src, PATH_MAX, is_unicode,
+			conn->local_nls);
+	kfree(src);
+
+	if (IS_ERR(name)) {
+		if (PTR_ERR(name) == -ENOMEM) {
+			ksmbd_err("failed to allocate memory\n");
+			rsp->hdr.Status.CifsError =
+				STATUS_NO_MEMORY;
+		} else
+			rsp->hdr.Status.CifsError =
+				STATUS_OBJECT_NAME_INVALID;
+
+		return PTR_ERR(name);
+	}
+
+	if (is_relative_root) {
+		int org_len = strnlen(name, PATH_MAX);
+		int add_len = strnlen(root, PATH_MAX);
+		char *full_name;
+
+		/* +3 for: '\'<root>'\' & '\0' */
+		full_name = kzalloc(org_len + add_len + 3, GFP_KERNEL);
+		if (!full_name) {
+			kfree(name);
+			rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+			return -ENOMEM;
+		}
+
+		snprintf(full_name, add_len + 3, "\\%s\\", root);
+		strncat(full_name, name, org_len);
+		kfree(name);
+		name = full_name;
+	}
+
+	root = strrchr(name, '\\');
+	if (root) {
+		root++;
+		if ((root[0] == '*' || root[0] == '/') && (root[1] == '\0')) {
+			rsp->hdr.Status.CifsError =
+				STATUS_OBJECT_NAME_INVALID;
+			kfree(name);
+			return -EINVAL;
+		}
+	}
+
+	conv_name = smb_get_name(share, name, PATH_MAX, work, true);
+	kfree(name);
+	if (IS_ERR(conv_name)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(conv_name);
+	}
+
+	if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS))
+		flags = 0;
+
+	if (ksmbd_override_fsids(work)) {
+		err = -ENOMEM;
+		goto out1;
+	}
+
+	err = ksmbd_vfs_kern_path(conv_name, flags, &path,
+			(req->hdr.Flags & SMBFLG_CASELESS) &&
+			!create_directory);
+	if (err) {
+		if (err == -EACCES)
+			goto out;
+		file_present = false;
+		ksmbd_debug(SMB, "can not get linux path for %s, err = %d\n",
+				conv_name, err);
+	} else {
+		if (!test_share_config_flag(share,
+			KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS)) {
+			if (d_is_symlink(path.dentry)) {
+				err = -EACCES;
+				goto free_path;
+			}
+		}
+
+		err = vfs_getattr(&path, &stat, STATX_BASIC_STATS,
+			AT_STATX_SYNC_AS_STAT);
+		if (err) {
+			ksmbd_err("can not stat %s, err = %d\n",
+				conv_name, err);
+			goto free_path;
+		}
+	}
+
+	if (file_present && (req->CreateOptions & FILE_NON_DIRECTORY_FILE_LE) &&
+			S_ISDIR(stat.mode)) {
+		ksmbd_debug(SMB, "Can't open dir %s, request is to open file\n",
+			       conv_name);
+		if (!(((struct smb_hdr *)work->request_buf)->Flags2 &
+					SMBFLG2_ERR_STATUS)) {
+			rsp->hdr.Status.DosError.ErrorClass = ERRDOS;
+			rsp->hdr.Status.DosError.Error =
+				cpu_to_le16(ERRfilexists);
+		} else
+			rsp->hdr.Status.CifsError =
+				STATUS_OBJECT_NAME_COLLISION;
+
+		memset(&rsp->hdr.WordCount, 0, 3);
+		kfree(conv_name);
+
+		goto free_path;
+	}
+
+	if (file_present && create_directory && !S_ISDIR(stat.mode)) {
+		ksmbd_debug(SMB, "Can't open file %s, request is to open dir\n",
+				conv_name);
+		if (!(((struct smb_hdr *)work->request_buf)->Flags2 &
+					SMBFLG2_ERR_STATUS)) {
+			ntstatus_to_dos(STATUS_NOT_A_DIRECTORY,
+					&rsp->hdr.Status.DosError.ErrorClass,
+					&rsp->hdr.Status.DosError.Error);
+		} else
+			rsp->hdr.Status.CifsError =
+				STATUS_NOT_A_DIRECTORY;
+
+		memset(&rsp->hdr.WordCount, 0, 3);
+		kfree(conv_name);
+
+		goto free_path;
+	}
+
+	oplock_flags = le32_to_cpu(req->OpenFlags) &
+		(REQ_OPLOCK | REQ_BATCHOPLOCK);
+	extended_reply = le32_to_cpu(req->OpenFlags) & REQ_EXTENDED_INFO;
+	open_flags = file_create_dispostion_flags(
+			le32_to_cpu(req->CreateDisposition), file_present);
+
+	if (open_flags < 0) {
+		ksmbd_debug(SMB, "create_dispostion returned %d\n", open_flags);
+		if (file_present) {
+			if (!(((struct smb_hdr *)work->request_buf)->Flags2 &
+						SMBFLG2_ERR_STATUS)) {
+				rsp->hdr.Status.DosError.ErrorClass = ERRDOS;
+				rsp->hdr.Status.DosError.Error =
+					cpu_to_le16(ERRfilexists);
+			} else if (open_flags == -EINVAL)
+				rsp->hdr.Status.CifsError =
+					STATUS_INVALID_PARAMETER;
+			else
+				rsp->hdr.Status.CifsError =
+					STATUS_OBJECT_NAME_COLLISION;
+			memset(&rsp->hdr.WordCount, 0, 3);
+			kfree(conv_name);
+			goto free_path;
+		} else {
+			err = -ENOENT;
+			goto out;
+		}
+	} else {
+		if (file_present) {
+			err = ksmbd_vfs_inode_permission(path.dentry,
+					open_flags & O_ACCMODE, false);
+			if (err)
+				goto free_path;
+
+			if (S_ISFIFO(stat.mode))
+				open_flags |= O_NONBLOCK;
+		}
+
+		if (req->CreateOptions & FILE_WRITE_THROUGH_LE)
+			open_flags |= O_SYNC;
+	}
+
+	access_flags = convert_generic_access_flags(
+			le32_to_cpu(req->DesiredAccess),
+			&open_flags, le32_to_cpu(req->FileAttributes));
+
+	mode |= 0777;
+	if (le32_to_cpu(req->FileAttributes) & ATTR_READONLY)
+		mode &= ~0222;
+
+	/* TODO:
+	 * - check req->ShareAccess for sharing file among different process
+	 * - check req->FileAttributes for special/readonly file attrib
+	 * - check req->SecurityFlags for client security context tracking
+	 * - check req->ImpersonationLevel
+	 */
+
+	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+		if (open_flags & O_CREAT) {
+			ksmbd_debug(SMB,
+				"returning as user does not have permission to write\n");
+			err = -EACCES;
+			goto out;
+		}
+	}
+
+	ksmbd_debug(SMB, "filename : %s, open_flags = 0x%x\n", conv_name,
+		open_flags);
+	if (!file_present && (open_flags & O_CREAT)) {
+
+		if (!create_directory) {
+			mode |= S_IFREG;
+			err = ksmbd_vfs_create(work, conv_name, mode);
+			if (err)
+				goto out;
+		} else {
+			err = ksmbd_vfs_mkdir(work, conv_name, mode);
+			if (err) {
+				ksmbd_err("Can't create directory %s",
+					conv_name);
+				goto out;
+			}
+		}
+
+		err = ksmbd_vfs_kern_path(conv_name, 0, &path, 0);
+		if (err) {
+			ksmbd_err("cannot get linux path, err = %d\n", err);
+			goto out;
+		}
+	}
+
+	err = ksmbd_query_inode_status(d_inode(path.dentry->d_parent));
+	if (err == KSMBD_INODE_STATUS_PENDING_DELETE) {
+		err = -EBUSY;
+		goto free_path;
+	}
+
+	err = 0;
+	/* open  file and get FID */
+	fp = ksmbd_vfs_dentry_open(work,
+				   &path,
+				   open_flags,
+				   req->CreateOptions,
+				   file_present);
+	if (IS_ERR(fp)) {
+		err = PTR_ERR(fp);
+		fp = NULL;
+		goto free_path;
+	}
+	fp->filename = conv_name;
+	fp->daccess = req->DesiredAccess;
+	fp->saccess = req->ShareAccess;
+	fp->pid = le16_to_cpu(req->hdr.Pid);
+
+	write_lock(&fp->f_ci->m_lock);
+	list_add(&fp->node, &fp->f_ci->m_fp_list);
+	write_unlock(&fp->f_ci->m_lock);
+
+	share_ret = ksmbd_smb_check_shared_mode(fp->filp, fp);
+	if (smb1_oplock_enable &&
+	    test_share_config_flag(work->tcon->share_conf,
+			KSMBD_SHARE_FLAG_OPLOCKS) &&
+		!S_ISDIR(file_inode(fp->filp)->i_mode) && oplock_flags) {
+		/* Client cannot request levelII oplock directly */
+		err = smb_grant_oplock(work, oplock_flags, fp->volatile_id,
+			fp, le16_to_cpu(req->hdr.Tid), NULL, share_ret);
+		if (err)
+			goto free_path;
+	} else {
+		if (ksmbd_inode_pending_delete(fp)) {
+			err = -EBUSY;
+			goto out;
+		}
+
+		if (share_ret < 0) {
+			err = -EPERM;
+			goto free_path;
+		}
+	}
+
+	oplock_rsp = fp->f_opinfo != NULL ? fp->f_opinfo->level : 0;
+
+	if (file_present) {
+		if (!(open_flags & O_TRUNC))
+			file_info = F_OPENED;
+		else
+			file_info = F_OVERWRITTEN;
+	} else
+		file_info = F_CREATED;
+
+	if (le32_to_cpu(req->DesiredAccess) & (DELETE | GENERIC_ALL))
+		fp->is_nt_open = 1;
+	if ((le32_to_cpu(req->DesiredAccess) & DELETE) &&
+			(req->CreateOptions & FILE_DELETE_ON_CLOSE_LE))
+		ksmbd_fd_set_delete_on_close(fp, file_info);
+
+	/* open success, send back response */
+	err = vfs_getattr(&path, &stat, STATX_BASIC_STATS,
+		AT_STATX_SYNC_AS_STAT);
+	if (err) {
+		ksmbd_err("cannot get stat information\n");
+		goto free_path;
+	}
+
+	alloc_size = le64_to_cpu(req->AllocationSize);
+	if (alloc_size && (file_info == F_CREATED ||
+				file_info == F_OVERWRITTEN)) {
+		if (alloc_size > stat.size) {
+			err = ksmbd_vfs_truncate(work, NULL, fp, alloc_size);
+			if (err) {
+				ksmbd_err("failed to expand file, err = %d\n",
+						err);
+				goto free_path;
+			}
+		}
+	}
+
+	/* prepare response buffer */
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+
+	rsp->OplockLevel = oplock_rsp;
+	rsp->Fid = fp->volatile_id;
+
+	if ((le32_to_cpu(req->CreateDisposition) == FILE_SUPERSEDE) &&
+			(file_info == F_OVERWRITTEN))
+		rsp->CreateAction = cpu_to_le32(F_SUPERSEDED);
+	else
+		rsp->CreateAction = cpu_to_le32(file_info);
+
+	if (stat.result_mask & STATX_BTIME)
+		fp->create_time = ksmbd_UnixTimeToNT(stat.btime);
+	else
+		fp->create_time = ksmbd_UnixTimeToNT(stat.ctime);
+	if (file_present) {
+		if (test_share_config_flag(tcon->share_conf,
+					   KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) {
+			struct xattr_dos_attrib da;
+
+			err = ksmbd_vfs_get_dos_attrib_xattr(path.dentry, &da);
+			if (err > 0)
+				fp->create_time = da.create_time;
+			err = 0;
+		}
+	} else {
+		if (test_share_config_flag(tcon->share_conf,
+					   KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) {
+			struct xattr_dos_attrib da = {0};
+
+			da.version = 4;
+			da.attr = smb_get_dos_attr(&stat);
+			da.create_time = fp->create_time;
+
+			err = ksmbd_vfs_set_dos_attrib_xattr(path.dentry, &da);
+			if (err)
+				ksmbd_debug(SMB, "failed to store creation time in xattr\n");
+			err = 0;
+		}
+	}
+
+	rsp->CreationTime = cpu_to_le64(fp->create_time);
+	time = ksmbd_UnixTimeToNT(stat.atime);
+	rsp->LastAccessTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(stat.mtime);
+	rsp->LastWriteTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(stat.ctime);
+	rsp->ChangeTime = cpu_to_le64(time);
+
+	rsp->FileAttributes = cpu_to_le32(smb_get_dos_attr(&stat));
+	rsp->AllocationSize = cpu_to_le64(stat.blocks << 9);
+	rsp->EndOfFile = cpu_to_le64(stat.size);
+	/* TODO: is it normal file, named pipe, printer, modem etc*/
+	rsp->FileType = 0;
+	/* status of named pipe*/
+	rsp->DeviceState = 0;
+	rsp->DirectoryFlag = S_ISDIR(stat.mode) ? 1 : 0;
+	if (extended_reply) {
+		struct inode *inode;
+
+		rsp->hdr.WordCount = 50;
+		memset(&ext_rsp->VolId, 0, 16);
+		if (fp) {
+			inode = file_inode(fp->filp);
+			ext_rsp->fid = inode->i_ino;
+			if (S_ISDIR(inode->i_mode) ||
+			    (fp->filp->f_mode & FMODE_WRITE))
+				ext_rsp->MaxAccess = FILE_GENERIC_ALL_LE;
+			else
+				ext_rsp->MaxAccess = FILE_GENERIC_READ_LE |
+						     FILE_EXECUTE_LE;
+		} else {
+			ext_rsp->MaxAccess = FILE_GENERIC_ALL_LE;
+			ext_rsp->fid = 0;
+		}
+
+		ext_rsp->ByteCount = 0;
+
+	} else {
+		rsp->hdr.WordCount = 34;
+		rsp->ByteCount = 0;
+	}
+	inc_rfc1001_len(&rsp->hdr, (rsp->hdr.WordCount * 2 + 0));
+
+free_path:
+	path_put(&path);
+out:
+	ksmbd_revert_fsids(work);
+out1:
+	switch (err) {
+	case 0:
+		break;
+	case -ENOSPC:
+		rsp->hdr.Status.CifsError = STATUS_DISK_FULL;
+		break;
+	case -EMFILE:
+		rsp->hdr.Status.CifsError =
+			STATUS_TOO_MANY_OPENED_FILES;
+		break;
+	case -EINVAL:
+		rsp->hdr.Status.CifsError = STATUS_NO_SUCH_USER;
+		break;
+	case -EACCES:
+		rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		break;
+	case -EPERM:
+		rsp->hdr.Status.CifsError = STATUS_SHARING_VIOLATION;
+		break;
+	case -ENOENT:
+		rsp->hdr.Status.CifsError = STATUS_OBJECT_NAME_NOT_FOUND;
+		break;
+	case -EBUSY:
+		rsp->hdr.Status.CifsError = STATUS_DELETE_PENDING;
+		break;
+	default:
+		rsp->hdr.Status.CifsError =
+			STATUS_UNEXPECTED_IO_ERROR;
+	}
+
+	if (err) {
+		if (fp)
+			ksmbd_close_fd(work, fp->volatile_id);
+		else
+			kfree(conv_name);
+	}
+
+	if (!rsp->hdr.WordCount)
+		return err;
+
+	/* this is an ANDx command ? */
+	rsp->AndXReserved = 0;
+	rsp->AndXOffset = cpu_to_le16(get_rfc1002_len(&rsp->hdr));
+	if (req->AndXCommand != SMB_NO_MORE_ANDX_COMMAND) {
+		/* adjust response */
+		rsp->AndXCommand = req->AndXCommand;
+		return rsp->AndXCommand; /* More processing required */
+	}
+	rsp->AndXCommand = SMB_NO_MORE_ANDX_COMMAND;
+
+	return err;
+
+}
+
+/**
+ * smb_close_pipe() - ipc pipe close request handler
+ * @work:	smb work containing close command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_close_pipe(struct ksmbd_work *work)
+{
+	struct smb_com_close_req *req = work->request_buf;
+
+	ksmbd_session_rpc_close(work->sess, req->FileID);
+	return 0;
+}
+
+/**
+ * smb_close() - ipc pipe close request handler
+ * @work:	smb work containing close command
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_close(struct ksmbd_work *work)
+{
+	struct smb_com_close_req *req = work->request_buf;
+	struct smb_com_close_rsp *rsp = work->response_buf;
+	int err = 0;
+
+	ksmbd_debug(SMB, "SMB_COM_CLOSE called for fid %u\n", req->FileID);
+
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_PIPE)) {
+		err = smb_close_pipe(work);
+		if (err < 0)
+			goto out;
+		goto IPC_out;
+	}
+
+	/*
+	 * TODO: linux cifs client does not send LastWriteTime,
+	 * need to check if windows client use this field
+	 */
+	if (req->LastWriteTime > 0 &&
+	    le32_to_cpu(req->LastWriteTime) < 0xFFFFFFFF)
+		ksmbd_info("need to set last modified time before close\n");
+
+	err = ksmbd_close_fd(work, req->FileID);
+
+IPC_out:
+	/* file close success, return response to server */
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 0;
+	rsp->ByteCount = 0;
+
+out:
+	if (err)
+		rsp->hdr.Status.CifsError = STATUS_INVALID_HANDLE;
+	return err;
+}
+
+/**
+ * smb_read_andx_pipe() - read from ipc pipe request handler
+ * @work:	smb work containing read command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_read_andx_pipe(struct ksmbd_work *work)
+{
+	struct smb_com_read_req *req = work->request_buf;
+	struct smb_com_read_rsp *rsp = work->response_buf;
+	struct ksmbd_rpc_command *rpc_resp;
+	char *data_buf;
+	int ret = 0, nbytes = 0;
+	unsigned int count;
+	unsigned int rsp_buflen = MAX_CIFS_SMALL_BUFFER_SIZE -
+		sizeof(struct smb_com_read_rsp);
+
+	rsp_buflen = min((unsigned int)(MAX_CIFS_SMALL_BUFFER_SIZE -
+				sizeof(struct smb_com_read_rsp)), rsp_buflen);
+
+	count = min_t(unsigned int, le16_to_cpu(req->MaxCount), rsp_buflen);
+	data_buf = (char *) (&rsp->ByteCount) + sizeof(rsp->ByteCount);
+
+	rpc_resp = ksmbd_rpc_read(work->sess, req->Fid);
+	if (rpc_resp) {
+		if (rpc_resp->flags != KSMBD_RPC_OK ||
+				!rpc_resp->payload_sz) {
+			rsp->hdr.Status.CifsError =
+				STATUS_UNEXPECTED_IO_ERROR;
+			kvfree(rpc_resp);
+			return -EINVAL;
+		}
+
+		nbytes = rpc_resp->payload_sz;
+		memcpy(data_buf, rpc_resp->payload, rpc_resp->payload_sz);
+		kvfree(rpc_resp);
+	} else {
+		ret = -EINVAL;
+	}
+
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 12;
+	rsp->Remaining = 0;
+	rsp->DataCompactionMode = 0;
+	rsp->DataCompactionMode = 0;
+	rsp->Reserved = 0;
+	rsp->DataLength = cpu_to_le16(nbytes & 0xFFFF);
+	rsp->DataOffset = cpu_to_le16(sizeof(struct smb_com_read_rsp) -
+			sizeof(rsp->hdr.smb_buf_length));
+	rsp->DataLengthHigh = cpu_to_le16(nbytes >> 16);
+	rsp->Reserved2 = 0;
+
+	rsp->ByteCount = cpu_to_le16(nbytes);
+	inc_rfc1001_len(&rsp->hdr, (rsp->hdr.WordCount * 2 + nbytes));
+
+	/* this is an ANDx command ? */
+	rsp->AndXReserved = 0;
+	rsp->AndXOffset = cpu_to_le16(get_rfc1002_len(&rsp->hdr));
+	if (req->AndXCommand != SMB_NO_MORE_ANDX_COMMAND) {
+		/* adjust response */
+		rsp->AndXCommand = req->AndXCommand;
+		return rsp->AndXCommand; /* More processing required */
+	}
+	rsp->AndXCommand = SMB_NO_MORE_ANDX_COMMAND;
+
+	return ret;
+}
+
+/**
+ * smb_read_andx() - read request handler
+ * @work:	smb work containing read command
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_read_andx(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb_com_read_req *req = work->request_buf;
+	struct smb_com_read_rsp *rsp = work->response_buf;
+	struct ksmbd_file *fp;
+	loff_t pos;
+	size_t count;
+	ssize_t nbytes;
+	int err = 0;
+
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_PIPE))
+		return smb_read_andx_pipe(work);
+
+	fp = ksmbd_lookup_fd_fast(work, req->Fid);
+	if (!fp) {
+		ksmbd_err("failed to get filp for fid %d\n",
+			req->Fid);
+		rsp->hdr.Status.CifsError = STATUS_FILE_CLOSED;
+		return -ENOENT;
+	}
+
+	pos = le32_to_cpu(req->OffsetLow);
+	if (req->hdr.WordCount == 12)
+		pos |= ((loff_t)le32_to_cpu(req->OffsetHigh) << 32);
+
+	count = le16_to_cpu(req->MaxCount);
+	/*
+	 * It probably seems to be set to 0 or 0xFFFF if MaxCountHigh is
+	 * not supported. If it is 0xFFFF, it is set to a too large value
+	 * and a read fail occurs. If it is 0xFFFF, limit it to not set
+	 * the value.
+	 */
+	if (conn->vals->capabilities & CAP_LARGE_READ_X &&
+		le32_to_cpu(req->MaxCountHigh) < 0xFFFF)
+		count |= le32_to_cpu(req->MaxCountHigh) << 16;
+	else if (count > CIFS_DEFAULT_IOSIZE) {
+		ksmbd_debug(SMB, "read size(%zu) exceeds max size(%u)\n",
+				count, CIFS_DEFAULT_IOSIZE);
+		ksmbd_debug(SMB, "limiting read size to max size(%u)\n",
+				CIFS_DEFAULT_IOSIZE);
+		count = CIFS_DEFAULT_IOSIZE;
+	}
+
+	ksmbd_debug(SMB, "filename %s, offset %lld, count %zu\n",
+		FP_FILENAME(fp), pos, count);
+
+	if (server_conf.flags & KSMBD_GLOBAL_FLAG_CACHE_RBUF) {
+		work->aux_payload_buf = ksmbd_find_buffer(count);
+		work->set_read_buf = true;
+	} else
+		work->aux_payload_buf = kvmalloc(count, GFP_KERNEL | __GFP_ZERO);
+	if (!work->aux_payload_buf) {
+		err = -ENOMEM;
+		goto out;
+	}
+
+	nbytes = ksmbd_vfs_read(work, fp, count, &pos);
+	if (nbytes < 0) {
+		err = nbytes;
+		goto out;
+	}
+
+	/* read success, prepare response */
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 12;
+	rsp->Remaining = 0;
+	rsp->DataCompactionMode = 0;
+	rsp->DataCompactionMode = 0;
+	rsp->Reserved = 0;
+	rsp->DataLength = cpu_to_le16(nbytes & 0xFFFF);
+	rsp->DataOffset = cpu_to_le16(sizeof(struct smb_com_read_rsp) -
+			sizeof(rsp->hdr.smb_buf_length));
+	rsp->DataLengthHigh = cpu_to_le16(nbytes >> 16);
+	rsp->Reserved2 = 0;
+
+	rsp->ByteCount = cpu_to_le16(nbytes);
+	inc_rfc1001_len(&rsp->hdr, (rsp->hdr.WordCount * 2));
+	work->resp_hdr_sz = get_rfc1002_len(rsp) + 4;
+	work->aux_payload_sz = nbytes;
+	inc_rfc1001_len(&rsp->hdr, nbytes);
+
+	/* this is an ANDx command ? */
+	rsp->AndXReserved = 0;
+	rsp->AndXOffset = cpu_to_le16(get_rfc1002_len(&rsp->hdr));
+	if (req->AndXCommand != SMB_NO_MORE_ANDX_COMMAND) {
+		/* adjust response */
+		rsp->AndXCommand = req->AndXCommand;
+		ksmbd_fd_put(work, fp);
+		return rsp->AndXCommand; /* More processing required */
+	}
+	rsp->AndXCommand = SMB_NO_MORE_ANDX_COMMAND;
+
+out:
+	ksmbd_fd_put(work, fp);
+	if (err)
+		rsp->hdr.Status.CifsError = STATUS_INVALID_HANDLE;
+	return err;
+}
+
+/**
+ * smb_write() - write request handler
+ * @work:	smb work containing write command
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_write(struct ksmbd_work *work)
+{
+	struct smb_com_write_req_32bit *req = work->request_buf;
+	struct smb_com_write_rsp_32bit *rsp = work->response_buf;
+	struct ksmbd_file *fp = NULL;
+	loff_t pos;
+	size_t count;
+	char *data_buf;
+	ssize_t nbytes = 0;
+	int err = 0;
+
+	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+		ksmbd_debug(SMB,
+			"returning as user does not have permission to write\n");
+		rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		return -EACCES;
+	}
+
+	fp = ksmbd_lookup_fd_fast(work, req->Fid);
+	if (!fp) {
+		ksmbd_err("failed to get filp for fid %u\n", req->Fid);
+		rsp->hdr.Status.CifsError = STATUS_FILE_CLOSED;
+		return -ENOENT;
+	}
+
+	pos = le32_to_cpu(req->Offset);
+	count = le16_to_cpu(req->Length);
+	data_buf = req->Data;
+
+	ksmbd_debug(SMB, "filename %s, offset %lld, count %zu\n",
+		FP_FILENAME(fp), pos, count);
+	if (!count) {
+		err = ksmbd_vfs_truncate(work, NULL, fp, pos);
+		nbytes = 0;
+	} else
+		err = ksmbd_vfs_write(work, fp, data_buf,
+				      count, &pos, 0, &nbytes);
+
+	rsp->hdr.WordCount = 1;
+	rsp->Written = cpu_to_le16(nbytes & 0xFFFF);
+	rsp->ByteCount = 0;
+	inc_rfc1001_len(&rsp->hdr, (rsp->hdr.WordCount * 2));
+
+	ksmbd_fd_put(work, fp);
+	if (!err) {
+		rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+		return 0;
+	}
+
+	if (err == -ENOSPC || err == -EFBIG)
+		rsp->hdr.Status.CifsError = STATUS_DISK_FULL;
+	else
+		rsp->hdr.Status.CifsError = STATUS_INVALID_HANDLE;
+	return err;
+}
+
+/**
+ * smb_write_andx_pipe() - write on pipe request handler
+ * @work:	smb work containing write command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_write_andx_pipe(struct ksmbd_work *work)
+{
+	struct smb_com_write_req *req = work->request_buf;
+	struct smb_com_write_rsp *rsp = work->response_buf;
+	struct ksmbd_rpc_command *rpc_resp;
+	int ret = 0;
+	size_t count = 0;
+
+	count = le16_to_cpu(req->DataLengthLow);
+	if (work->conn->vals->capabilities & CAP_LARGE_WRITE_X)
+		count |= (le16_to_cpu(req->DataLengthHigh) << 16);
+
+	rpc_resp = ksmbd_rpc_write(work->sess, req->Fid, req->Data, count);
+	if (rpc_resp) {
+		if (rpc_resp->flags == KSMBD_RPC_ENOTIMPLEMENTED) {
+			rsp->hdr.Status.CifsError = STATUS_NOT_SUPPORTED;
+			kvfree(rpc_resp);
+			return -EOPNOTSUPP;
+		}
+		if (rpc_resp->flags != KSMBD_RPC_OK) {
+			rsp->hdr.Status.CifsError = STATUS_INVALID_HANDLE;
+			kvfree(rpc_resp);
+			return -EINVAL;
+		}
+		count = rpc_resp->payload_sz;
+		kvfree(rpc_resp);
+	} else {
+		ret = -EINVAL;
+	}
+
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 6;
+	rsp->Count = cpu_to_le16(count & 0xFFFF);
+	rsp->Remaining = 0;
+	rsp->CountHigh = cpu_to_le16(count >> 16);
+	rsp->Reserved = 0;
+	rsp->ByteCount = 0;
+	inc_rfc1001_len(&rsp->hdr, (rsp->hdr.WordCount * 2));
+
+	/* this is an ANDx command ? */
+	rsp->AndXReserved = 0;
+	rsp->AndXOffset = cpu_to_le16(get_rfc1002_len(&rsp->hdr));
+	if (req->AndXCommand != SMB_NO_MORE_ANDX_COMMAND) {
+		/* adjust response */
+		rsp->AndXCommand = req->AndXCommand;
+		return rsp->AndXCommand; /* More processing required */
+	}
+	rsp->AndXCommand = SMB_NO_MORE_ANDX_COMMAND;
+
+	return ret;
+}
+
+/**
+ * smb_write_andx() - andx write request handler
+ * @work:	smb work containing write command
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_write_andx(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb_com_write_req *req = work->request_buf;
+	struct smb_com_write_rsp *rsp = work->response_buf;
+	struct ksmbd_file *fp;
+	bool writethrough = false;
+	loff_t pos;
+	size_t count;
+	ssize_t nbytes = 0;
+	char *data_buf;
+	int err = 0;
+
+	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+		ksmbd_debug(SMB,
+			"returning as user does not have permission to write\n");
+		rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		return -EACCES;
+	}
+
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_PIPE)) {
+		ksmbd_debug(SMB, "Write ANDX called for IPC$");
+		return smb_write_andx_pipe(work);
+	}
+
+	fp = ksmbd_lookup_fd_fast(work, req->Fid);
+	if (!fp) {
+		ksmbd_err("failed to get filp for fid %u\n", req->Fid);
+		rsp->hdr.Status.CifsError = STATUS_FILE_CLOSED;
+		return -ENOENT;
+	}
+
+	pos = le32_to_cpu(req->OffsetLow);
+	if (req->hdr.WordCount == 14)
+		pos |= ((loff_t)le32_to_cpu(req->OffsetHigh) << 32);
+
+	writethrough = (le16_to_cpu(req->WriteMode) == 1);
+
+	/*
+	 * [MS-SMB] 3.3.5.8:
+	 * If CAP_LARGE_WRITEX is set in Server.Connection.ClientCapabilities,
+	 * then it is possible that the count of bytes to be written is larger
+	 * than the server's MaxBufferSize
+	 */
+	count = le16_to_cpu(req->DataLengthLow);
+	if (conn->vals->capabilities & CAP_LARGE_WRITE_X)
+		count |= (le16_to_cpu(req->DataLengthHigh) << 16);
+	else if (count > CIFS_DEFAULT_IOSIZE) {
+		ksmbd_debug(SMB, "write size(%zu) exceeds max size(%u)\n",
+				count, CIFS_DEFAULT_IOSIZE);
+		ksmbd_debug(SMB, "limiting write size to max size(%u)\n",
+				CIFS_DEFAULT_IOSIZE);
+		count = CIFS_DEFAULT_IOSIZE;
+	}
+
+	if (le16_to_cpu(req->DataOffset) ==
+			(offsetof(struct smb_com_write_req, Data) - 4)) {
+		data_buf = (char *)&req->Data[0];
+	} else {
+		if ((le16_to_cpu(req->DataOffset) > get_rfc1002_len(req)) ||
+				(le16_to_cpu(req->DataOffset) +
+				 count > get_rfc1002_len(req))) {
+			ksmbd_err("invalid write data offset %u, smb_len %u\n",
+					le16_to_cpu(req->DataOffset),
+					get_rfc1002_len(req));
+			err = -EINVAL;
+			goto out;
+		}
+
+		data_buf = (char *)(((char *)&req->hdr.Protocol) +
+				le16_to_cpu(req->DataOffset));
+	}
+
+	ksmbd_debug(SMB, "filname %s, offset %lld, count %zu\n",
+		FP_FILENAME(fp), pos, count);
+	err = ksmbd_vfs_write(work, fp, data_buf, count, &pos,
+			      writethrough, &nbytes);
+	if (err < 0)
+		goto out;
+
+	/* write success, prepare response */
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 6;
+	rsp->Count = cpu_to_le16(nbytes & 0xFFFF);
+	rsp->Remaining = 0;
+	rsp->CountHigh = cpu_to_le16(nbytes >> 16);
+	rsp->Reserved = 0;
+	rsp->ByteCount = 0;
+	inc_rfc1001_len(&rsp->hdr, (rsp->hdr.WordCount * 2));
+
+	ksmbd_fd_put(work, fp);
+	/* this is an ANDx command ? */
+	rsp->AndXReserved = 0;
+	rsp->AndXOffset = cpu_to_le16(get_rfc1002_len(&rsp->hdr));
+	if (req->AndXCommand != SMB_NO_MORE_ANDX_COMMAND) {
+		/* adjust response */
+		rsp->AndXCommand = req->AndXCommand;
+		return rsp->AndXCommand; /* More processing required */
+	}
+	rsp->AndXCommand = SMB_NO_MORE_ANDX_COMMAND;
+
+	return 0;
+
+out:
+	ksmbd_fd_put(work, fp);
+	if (err == -ENOSPC || err == -EFBIG)
+		rsp->hdr.Status.CifsError = STATUS_DISK_FULL;
+	else
+		rsp->hdr.Status.CifsError = STATUS_INVALID_HANDLE;
+	return err;
+}
+
+/**
+ * smb_echo() - echo(ping) request handler
+ * @work:	smb work containing echo command
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_echo(struct ksmbd_work *work)
+{
+	struct smb_com_echo_req *req = work->request_buf;
+	struct smb_com_echo_rsp *rsp = work->response_buf;
+	__u16 data_count;
+	int i;
+
+	ksmbd_debug(SMB, "SMB_COM_ECHO called with echo count %u\n",
+			le16_to_cpu(req->EchoCount));
+
+	if (le16_to_cpu(req->EchoCount) > 1)
+		work->multiRsp = 1;
+
+	data_count = le16_to_cpu(req->ByteCount);
+	/* send echo response to server */
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 1;
+	rsp->ByteCount = cpu_to_le16(data_count);
+
+	memcpy(rsp->Data, req->Data, data_count);
+	inc_rfc1001_len(&rsp->hdr, (rsp->hdr.WordCount * 2) + data_count);
+
+	/* Send req->EchoCount - 1 number of ECHO response now &
+	 * if SMB CANCEL for Echo comes don't send response
+	 */
+	for (i = 1; i < le16_to_cpu(req->EchoCount) &&
+	     !work->send_no_response; i++) {
+		rsp->SequenceNumber = cpu_to_le16(i);
+		ksmbd_conn_write(work);
+	}
+
+	/* Last echo response */
+	rsp->SequenceNumber = cpu_to_le16(i);
+	work->multiRsp = 0;
+
+	return 0;
+}
+
+/**
+ * smb_flush() - file sync - flush request handler
+ * @work:	smb work containing flush command
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_flush(struct ksmbd_work *work)
+{
+	struct smb_com_flush_req *req = work->request_buf;
+	struct smb_com_flush_rsp *rsp = work->response_buf;
+	int err = 0;
+
+	ksmbd_debug(SMB, "SMB_COM_FLUSH called for fid %u\n", req->FileID);
+
+	if (req->FileID == 0xFFFF) {
+		err = ksmbd_file_table_flush(work);
+		if (err)
+			goto out;
+	} else {
+		err = ksmbd_vfs_fsync(work, req->FileID, KSMBD_NO_FID);
+		if (err)
+			goto out;
+	}
+
+	/* file fsync success, return response to server */
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 0;
+	rsp->ByteCount = 0;
+	return err;
+
+out:
+	if (err)
+		rsp->hdr.Status.CifsError = STATUS_INVALID_HANDLE;
+
+	return err;
+}
+
+/*****************************************************************************
+ * TRANS2 command implementation functions
+ *****************************************************************************/
+
+/**
+ * get_filetype() - convert file mode to smb file type
+ * @mode:	file mode to be convertd
+ *
+ * Return:	converted file type
+ */
+static __u32 get_filetype(mode_t mode)
+{
+	if (S_ISREG(mode))
+		return UNIX_FILE;
+	else if (S_ISDIR(mode))
+		return UNIX_DIR;
+	else if (S_ISLNK(mode))
+		return UNIX_SYMLINK;
+	else if (S_ISCHR(mode))
+		return UNIX_CHARDEV;
+	else if (S_ISBLK(mode))
+		return UNIX_BLOCKDEV;
+	else if (S_ISFIFO(mode))
+		return UNIX_FIFO;
+	else if (S_ISSOCK(mode))
+		return UNIX_SOCKET;
+
+	return UNIX_UNKNOWN;
+}
+
+/**
+ * init_unix_info() - convert file stat information to smb file info format
+ * @unix_info:	smb file information format
+ * @stat:	unix file/dir stat information
+ */
+static void init_unix_info(struct file_unix_basic_info *unix_info,
+		struct kstat *stat)
+{
+	u64 time;
+
+	unix_info->EndOfFile = cpu_to_le64(stat->size);
+	unix_info->NumOfBytes = cpu_to_le64(512 * stat->blocks);
+	time = ksmbd_UnixTimeToNT(stat->ctime);
+	unix_info->LastStatusChange = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(stat->atime);
+	unix_info->LastAccessTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(stat->mtime);
+	unix_info->LastModificationTime = cpu_to_le64(time);
+	unix_info->Uid = cpu_to_le64(from_kuid(&init_user_ns, stat->uid));
+	unix_info->Gid = cpu_to_le64(from_kgid(&init_user_ns, stat->gid));
+	unix_info->Type = cpu_to_le32(get_filetype(stat->mode));
+	unix_info->DevMajor = cpu_to_le64(MAJOR(stat->rdev));
+	unix_info->DevMinor = cpu_to_le64(MINOR(stat->rdev));
+	unix_info->UniqueId = cpu_to_le64(stat->ino);
+	unix_info->Permissions = cpu_to_le64(stat->mode);
+	unix_info->Nlinks = cpu_to_le64(stat->nlink);
+}
+
+/**
+ * unix_info_to_attr() - convert smb file info format to unix attr format
+ * @unix_info:	smb file information format
+ * @attrs:	unix file/dir stat information
+ *
+ * Return:	0
+ */
+static int unix_info_to_attr(struct file_unix_basic_info *unix_info,
+		struct iattr *attrs)
+{
+	struct timespec64 ts;
+
+	if (le64_to_cpu(unix_info->EndOfFile) != NO_CHANGE_64) {
+		attrs->ia_size = le64_to_cpu(unix_info->EndOfFile);
+		attrs->ia_valid |= ATTR_SIZE;
+	}
+
+	if (le64_to_cpu(unix_info->LastStatusChange) != NO_CHANGE_64) {
+		ts = smb_NTtimeToUnix(unix_info->LastStatusChange);
+		attrs->ia_ctime = ts;
+		attrs->ia_valid |= ATTR_CTIME;
+	}
+
+	if (le64_to_cpu(unix_info->LastAccessTime) != NO_CHANGE_64) {
+		ts = smb_NTtimeToUnix(unix_info->LastAccessTime);
+		attrs->ia_atime = ts;
+		attrs->ia_valid |= ATTR_ATIME;
+	}
+
+	if (le64_to_cpu(unix_info->LastModificationTime) != NO_CHANGE_64) {
+		ts = smb_NTtimeToUnix(unix_info->LastModificationTime);
+		attrs->ia_mtime = ts;
+		attrs->ia_valid |= ATTR_MTIME;
+	}
+
+	if (le64_to_cpu(unix_info->Uid) != NO_CHANGE_64) {
+		attrs->ia_uid = make_kuid(&init_user_ns,
+				le64_to_cpu(unix_info->Uid));
+		attrs->ia_valid |= ATTR_UID;
+	}
+
+	if (le64_to_cpu(unix_info->Gid) != NO_CHANGE_64) {
+		attrs->ia_gid = make_kgid(&init_user_ns,
+					  le64_to_cpu(unix_info->Gid));
+		attrs->ia_valid |= ATTR_GID;
+	}
+
+	if (le64_to_cpu(unix_info->Permissions) != NO_CHANGE_64) {
+		attrs->ia_mode = le64_to_cpu(unix_info->Permissions);
+		attrs->ia_valid |= ATTR_MODE;
+	}
+
+	switch (le32_to_cpu(unix_info->Type)) {
+	case UNIX_FILE:
+		attrs->ia_mode |= S_IFREG;
+		break;
+	case UNIX_DIR:
+		attrs->ia_mode |= S_IFDIR;
+		break;
+	case UNIX_SYMLINK:
+		attrs->ia_mode |= S_IFLNK;
+		break;
+	case UNIX_CHARDEV:
+		attrs->ia_mode |= S_IFCHR;
+		break;
+	case UNIX_BLOCKDEV:
+		attrs->ia_mode |= S_IFBLK;
+		break;
+	case UNIX_FIFO:
+		attrs->ia_mode |= S_IFIFO;
+		break;
+	case UNIX_SOCKET:
+		attrs->ia_mode |= S_IFSOCK;
+		break;
+	default:
+		ksmbd_err("unknown file type 0x%x\n",
+				le32_to_cpu(unix_info->Type));
+	}
+
+	return 0;
+}
+
+/**
+ * unix_to_dos_time() - convert unix time to dos format
+ * @ts:		unix style time
+ * @time:	store dos style time
+ * @date:	store dos style date
+ */
+static void unix_to_dos_time(struct timespec64 ts, __le16 *time, __le16 *date)
+{
+	struct tm t;
+	__u16 val;
+
+	time64_to_tm(ts.tv_sec, (-sys_tz.tz_minuteswest) * 60, &t);
+	val = (((unsigned int)(t.tm_mon + 1)) >> 3) | ((t.tm_year - 80) << 1);
+	val = ((val & 0xFF) << 8) | (t.tm_mday |
+			(((t.tm_mon + 1) & 0x7) << 5));
+	*date = cpu_to_le16(val);
+
+	val = ((((unsigned int)t.tm_min >> 3) & 0x7) |
+			(((unsigned int)t.tm_hour) << 3));
+	val = ((val & 0xFF) << 8) | ((t.tm_sec/2) | ((t.tm_min & 0x7) << 5));
+	*time = cpu_to_le16(val);
+}
+
+/**
+ * cifs_convert_ace() - helper function for convert an Access Control Entry
+ *		from cifs wire format to local POSIX xattr format
+ * @ace:	local - unix style Access Control Entry format
+ * @cifs_ace:	cifs wire Access Control Entry format
+ */
+static void cifs_convert_ace(struct posix_acl_xattr_entry *ace,
+		struct cifs_posix_ace *cifs_ace)
+{
+	/* u8 cifs fields do not need le conversion */
+	ace->e_perm = cpu_to_le16(cifs_ace->cifs_e_perm);
+	ace->e_tag  = cpu_to_le16(cifs_ace->cifs_e_tag);
+	ace->e_id   = cpu_to_le32(le64_to_cpu(cifs_ace->cifs_uid));
+}
+
+/**
+ * cifs_copy_posix_acl() - Convert ACL from CIFS POSIX wire format to local
+ *		Linux POSIX ACL xattr
+ * @trgt:	target buffer for storing in local ace format
+ * @src:	source buffer in cifs ace format
+ * @buflen:	target buffer length
+ * @acl_type:	ace type
+ * @size_of_data_area:	max buffer size to store ace xattr
+ *
+ * Return:	size of convert ace xattr on success, otherwise error
+ */
+static int cifs_copy_posix_acl(char *trgt, char *src, const int buflen,
+		const int acl_type, const int size_of_data_area)
+{
+	int size =  0;
+	int i;
+	__u16 count;
+	struct cifs_posix_ace *pACE;
+	struct cifs_posix_acl *cifs_acl = (struct cifs_posix_acl *)src;
+	struct posix_acl_xattr_entry *ace;
+	struct posix_acl_xattr_header *local_acl = (void *)trgt;
+
+	if (le16_to_cpu(cifs_acl->version) != CIFS_ACL_VERSION)
+		return -EOPNOTSUPP;
+
+	if (acl_type & ACL_TYPE_ACCESS) {
+		count = le16_to_cpu(cifs_acl->access_entry_count);
+		pACE = &cifs_acl->ace_array[0];
+		size = sizeof(struct cifs_posix_acl);
+		size += sizeof(struct cifs_posix_ace) * count;
+		/* check if we would go beyond end of SMB */
+		if (size_of_data_area < size) {
+			ksmbd_debug(SMB, "bad CIFS POSIX ACL size %d vs. %d\n",
+				 size_of_data_area, size);
+			return -EINVAL;
+		}
+	} else if (acl_type & ACL_TYPE_DEFAULT) {
+		count = le16_to_cpu(cifs_acl->default_entry_count);
+		pACE = &cifs_acl->ace_array[0];
+		size = sizeof(struct cifs_posix_acl);
+		size += sizeof(struct cifs_posix_ace) * count;
+		/* check if we would go beyond end of SMB */
+		if (size_of_data_area < size)
+			return -EINVAL;
+	} else {
+		/* illegal type */
+		return -EINVAL;
+	}
+
+	size = posix_acl_xattr_size(count);
+	if ((buflen != 0) && local_acl && size > buflen)
+		return -ERANGE;
+
+	/* buffer big enough */
+	ace = (void *)(local_acl + 1);
+	local_acl->a_version = cpu_to_le32(POSIX_ACL_XATTR_VERSION);
+	for (i = 0; i < count; i++) {
+		cifs_convert_ace(&ace[i], pACE);
+		pACE++;
+	}
+
+	return size;
+}
+
+/**
+ * convert_ace_to_cifs_ace() - helper function to convert ACL from local
+ * Linux POSIX ACL xattr to CIFS POSIX wire format to local
+ * @cifs_ace:	target buffer for storing in cifs ace format
+ * @local_ace:	source buffer in Linux POSIX ACL xattr format
+ *
+ * Return:	0
+ */
+static __u16 convert_ace_to_cifs_ace(struct cifs_posix_ace *cifs_ace,
+		const struct posix_acl_xattr_entry *local_ace)
+{
+	__u16 rc = 0; /* 0 = ACL converted ok */
+
+	cifs_ace->cifs_e_perm = le16_to_cpu(local_ace->e_perm);
+	cifs_ace->cifs_e_tag =  le16_to_cpu(local_ace->e_tag);
+	/* BB is there a better way to handle the large uid? */
+	if (local_ace->e_id == cpu_to_le32(-1)) {
+		/* Probably no need to le convert -1 on any
+		 * arch but can not hurt
+		 */
+		cifs_ace->cifs_uid = cpu_to_le64(-1);
+	} else
+		cifs_ace->cifs_uid = cpu_to_le64(le32_to_cpu(local_ace->e_id));
+	return rc;
+}
+
+/**
+ * ACL_to_cifs_posix() - ACL from local Linux POSIX xattr to CIFS POSIX ACL
+ *		wire format
+ * @parm_data:	target buffer for storing in cifs ace format
+ * @pACL:	source buffer in cifs ace format
+ * @buflen:	target buffer length
+ * @acl_type:	ace type
+ *
+ * Return:	0 on success, otherwise error
+ */
+static __u16 ACL_to_cifs_posix(char *parm_data, const char *pACL,
+		const int buflen, const int acl_type)
+{
+	__u16 rc = 0;
+	struct cifs_posix_acl *cifs_acl = (struct cifs_posix_acl *)parm_data;
+	struct posix_acl_xattr_header *local_acl = (void *)pACL;
+	struct posix_acl_xattr_entry *ace = (void *)(local_acl + 1);
+	int count;
+	int i, j = 0;
+
+	if ((buflen == 0) || !pACL || !cifs_acl)
+		return 0;
+
+	count = posix_acl_xattr_count((size_t)buflen);
+	ksmbd_debug(SMB, "setting acl with %d entries from buf of length %d and version of %d\n",
+		 count, buflen, le32_to_cpu(local_acl->a_version));
+	if (le32_to_cpu(local_acl->a_version) != 2) {
+		ksmbd_debug(SMB, "unknown POSIX ACL version %d\n",
+			 le32_to_cpu(local_acl->a_version));
+		return 0;
+	}
+	if (acl_type == ACL_TYPE_ACCESS) {
+		cifs_acl->access_entry_count = cpu_to_le16(count);
+		j = 0;
+	} else if (acl_type == ACL_TYPE_DEFAULT) {
+		cifs_acl->default_entry_count = cpu_to_le16(count);
+		if (cifs_acl->access_entry_count)
+			j = le16_to_cpu(cifs_acl->access_entry_count);
+	} else {
+		ksmbd_debug(SMB, "unknown ACL type %d\n", acl_type);
+		return 0;
+	}
+	for (i = 0; i < count; i++, j++) {
+		rc = convert_ace_to_cifs_ace(&cifs_acl->ace_array[i], &ace[i]);
+		if (rc != 0) {
+			/* ACE not converted */
+			break;
+		}
+	}
+	if (rc == 0) {
+		rc = (__u16)(count * sizeof(struct cifs_posix_ace));
+		/* BB add check to make sure ACL does not overflow SMB */
+	}
+	return rc;
+}
+
+/**
+ * smb_get_acl() - handler for query posix acl information
+ * @work:	smb work containing posix acl query command
+ * @path:	path of file/dir to query acl
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_get_acl(struct ksmbd_work *work, struct path *path)
+{
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	char *buf = NULL;
+	int rc = 0, value_len;
+	struct cifs_posix_acl *aclbuf;
+	__u16 rsp_data_cnt = 0;
+
+	aclbuf = (struct cifs_posix_acl *)(work->response_buf +
+			sizeof(struct smb_com_trans2_rsp) + 4);
+
+	aclbuf->version = cpu_to_le16(CIFS_ACL_VERSION);
+	aclbuf->default_entry_count = 0;
+	aclbuf->access_entry_count = 0;
+
+	/* check if POSIX_ACL_XATTR_ACCESS exists */
+	value_len = ksmbd_vfs_getxattr(path->dentry,
+				       XATTR_NAME_POSIX_ACL_ACCESS,
+				       &buf);
+	if (value_len > 0) {
+		rsp_data_cnt += ACL_to_cifs_posix((char *)aclbuf, buf,
+				value_len, ACL_TYPE_ACCESS);
+		kfree(buf);
+		buf = NULL;
+	}
+
+	/* check if POSIX_ACL_XATTR_DEFAULT exists */
+	value_len = ksmbd_vfs_getxattr(path->dentry,
+				       XATTR_NAME_POSIX_ACL_DEFAULT,
+				       &buf);
+	if (value_len > 0) {
+		rsp_data_cnt += ACL_to_cifs_posix((char *)aclbuf, buf,
+				value_len, ACL_TYPE_DEFAULT);
+		kfree(buf);
+		buf = NULL;
+	}
+
+	if (rsp_data_cnt)
+		rsp_data_cnt += sizeof(struct cifs_posix_acl);
+
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = cpu_to_le16(rsp_data_cnt);
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = cpu_to_le16(2);
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = cpu_to_le16(60);
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+	rsp->ByteCount = cpu_to_le16(rsp_data_cnt + 5);
+	inc_rfc1001_len(&rsp->hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+
+	if (buf)
+		kfree(buf);
+	return rc;
+}
+
+/**
+ * smb_set_acl() - handler for setting posix acl information
+ * @work:	smb work containing posix acl set command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_set_acl(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_spi_req *req = work->request_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct cifs_posix_acl *wire_acl_data;
+	char *fname, *buf = NULL;
+	int rc = 0, acl_type = 0, value_len;
+
+	fname = smb_get_name(share, req->FileName, PATH_MAX, work, false);
+	if (IS_ERR(fname)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(fname);
+	}
+
+	buf = vmalloc(XATTR_SIZE_MAX);
+	if (!buf) {
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	wire_acl_data = (struct cifs_posix_acl *)(((char *) &req->hdr.Protocol)
+			+ le16_to_cpu(req->DataOffset));
+	if (le16_to_cpu(wire_acl_data->access_entry_count) > 0 &&
+		le16_to_cpu(wire_acl_data->access_entry_count) < 0xFFFF) {
+		acl_type = ACL_TYPE_ACCESS;
+
+	} else if (le16_to_cpu(wire_acl_data->default_entry_count) > 0 &&
+		le16_to_cpu(wire_acl_data->default_entry_count) < 0xFFFF) {
+		acl_type = ACL_TYPE_DEFAULT;
+	} else {
+		rc = -EINVAL;
+		goto out;
+	}
+
+	rc = cifs_copy_posix_acl(buf,
+			(char *)wire_acl_data,
+			XATTR_SIZE_MAX, acl_type, XATTR_SIZE_MAX);
+	if (rc < 0) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		goto out;
+	}
+
+	value_len = rc;
+	if (acl_type == ACL_TYPE_ACCESS) {
+		rc = ksmbd_vfs_fsetxattr(work,
+					 fname,
+					 XATTR_NAME_POSIX_ACL_ACCESS,
+					 buf, value_len, 0);
+	} else if (acl_type == ACL_TYPE_DEFAULT) {
+		rc = ksmbd_vfs_fsetxattr(work,
+					 fname,
+					 XATTR_NAME_POSIX_ACL_DEFAULT,
+					 buf, value_len, 0);
+	}
+
+	if (rc < 0) {
+		rsp->hdr.Status.CifsError = STATUS_UNEXPECTED_IO_ERROR;
+		goto out;
+	}
+
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = cpu_to_le16(0);
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = cpu_to_le16(2);
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = cpu_to_le16(0);
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+
+	/* 2 for parameter count + 1 pad1*/
+	rsp->ByteCount = cpu_to_le16(3);
+	rsp->Pad = 0;
+	inc_rfc1001_len(&rsp->hdr, rsp->hdr.WordCount * 2 + 3);
+
+out:
+	if (buf)
+		vfree(buf);
+	kfree(fname);
+	return rc;
+}
+
+/**
+ * smb_readlink() - handler for reading symlink source path
+ * @work:	smb work containing query link information
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_readlink(struct ksmbd_work *work, struct path *path)
+{
+	struct smb_com_trans2_qpi_req *req = work->request_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	int err, name_len;
+	char *buf, *ptr;
+
+	buf = kzalloc((CIFS_MF_SYMLINK_LINK_MAXLEN), GFP_KERNEL);
+	if (!buf) {
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		return -ENOMEM;
+	}
+
+	err = ksmbd_vfs_readlink(path, buf, CIFS_MF_SYMLINK_LINK_MAXLEN);
+	if (err < 0) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_HANDLE;
+		goto out;
+	}
+
+	/*
+	 * check if this namelen(unicode) and smb header can fit in small rsp
+	 * buf. If not, switch to large rsp buffer.
+	 */
+	err++;
+	err *= 2;
+	if (err + MAX_HEADER_SIZE(work->conn) > work->response_sz) {
+		void *nptr;
+		size_t nsz = err + MAX_HEADER_SIZE(work->conn);
+
+		nptr = ksmbd_realloc_response(work->response_buf,
+					      work->response_sz,
+					      nsz);
+		if (nptr == work->response_buf) {
+			rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+			err = -ENOMEM;
+			goto out;
+		}
+
+		work->response_buf = nptr;
+		rsp = (struct smb_com_trans2_rsp *)work->response_buf;
+	}
+	err = 0;
+
+	ptr = (char *)&rsp->Buffer[0];
+	memset(ptr, 0, 4);
+	ptr += 4;
+
+	if (is_smbreq_unicode(&req->hdr)) {
+		name_len = smb_strtoUTF16((__le16 *)ptr,
+					  buf,
+					  CIFS_MF_SYMLINK_LINK_MAXLEN,
+					  work->conn->local_nls);
+		name_len++;     /* trailing null */
+		name_len *= 2;
+	} else { /* BB add path length overrun check */
+		name_len = strscpy(ptr, buf, CIFS_MF_SYMLINK_LINK_MAXLEN - 1);
+		name_len++;     /* trailing null */
+	}
+
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = cpu_to_le16(name_len);
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = cpu_to_le16(2);
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = cpu_to_le16(60);
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+	rsp->ByteCount = cpu_to_le16(name_len + 5);
+	inc_rfc1001_len(&rsp->hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+
+out:
+	kfree(buf);
+	return err;
+}
+
+/**
+ * smb_get_ea() - handler for extended attribute query
+ * @work:	smb work containing query xattr command
+ * @path:	path of file/dir to query xattr command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_get_ea(struct ksmbd_work *work, struct path *path)
+{
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	char *name, *ptr, *xattr_list = NULL, *buf;
+	int rc, name_len, value_len, xattr_list_len;
+	struct fealist *eabuf = (struct fealist *)(work->response_buf +
+			sizeof(struct smb_com_trans2_rsp) + 4);
+	struct fea *temp_fea;
+	ssize_t buf_free_len;
+	__u16 rsp_data_cnt = 4;
+
+	eabuf->list_len = cpu_to_le32(rsp_data_cnt);
+	buf_free_len = work->response_sz - (get_rfc1002_len(rsp) + 4) -
+		sizeof(struct smb_com_trans2_rsp);
+	rc = ksmbd_vfs_listxattr(path->dentry, &xattr_list);
+	if (rc < 0) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_HANDLE;
+		goto out;
+	} else if (!rc) { /* there is no EA in the file */
+		eabuf->list_len = cpu_to_le32(rsp_data_cnt);
+		goto done;
+	}
+
+	xattr_list_len = rc;
+	rc = 0;
+
+	ptr = (char *)eabuf->list;
+	temp_fea = (struct fea *)ptr;
+	for (name = xattr_list; name - xattr_list < xattr_list_len;
+			name += strlen(name) + 1) {
+		ksmbd_debug(SMB, "%s, len %zd\n", name, strlen(name));
+		/*
+		 * CIFS does not support EA other name user.* namespace,
+		 * still keep the framework generic, to list other attrs
+		 * in future.
+		 */
+		if (strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
+			continue;
+
+		name_len = strlen(name);
+		if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
+			name_len -= XATTR_USER_PREFIX_LEN;
+
+		ptr = (char *)(&temp_fea->name + name_len + 1);
+		buf_free_len -= (offsetof(struct fea, name) + name_len + 1);
+
+		value_len = ksmbd_vfs_getxattr(path->dentry, name, &buf);
+		if (value_len <= 0) {
+			rc = -ENOENT;
+			rsp->hdr.Status.CifsError = STATUS_INVALID_HANDLE;
+			goto out;
+		}
+
+		memcpy(ptr, buf, value_len);
+		kfree(buf);
+
+		temp_fea->EA_flags = 0;
+		temp_fea->name_len = name_len;
+		if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
+			memcpy(temp_fea->name, &name[XATTR_USER_PREFIX_LEN],
+					name_len);
+		else
+			memcpy(temp_fea->name, name, name_len);
+
+		temp_fea->value_len = cpu_to_le16(value_len);
+		buf_free_len -= value_len;
+		rsp_data_cnt += offsetof(struct fea, name) + name_len + 1 +
+			value_len;
+		eabuf->list_len += cpu_to_le32(offsetof(struct fea, name) +
+				name_len + 1 + value_len);
+		ptr += value_len;
+		temp_fea = (struct fea *)ptr;
+	}
+
+done:
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = cpu_to_le16(rsp_data_cnt);
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = cpu_to_le16(2);
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = cpu_to_le16(60);
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+	rsp->ByteCount = cpu_to_le16(rsp_data_cnt + 5);
+	inc_rfc1001_len(&rsp->hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+out:
+	kvfree(xattr_list);
+	return rc;
+}
+
+/**
+ * query_path_info() - handler for query path info
+ * @work:	smb work containing query path info command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int query_path_info(struct ksmbd_work *work)
+{
+	struct smb_hdr *rsp_hdr = work->response_buf;
+	struct smb_com_trans2_req *req = work->request_buf;
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct trans2_qpi_req_params *req_params;
+	char *name = NULL;
+	struct path path;
+	struct kstat st;
+	int rc;
+	char *ptr;
+	__u64 create_time = 0, time;
+	unsigned int flags = LOOKUP_FOLLOW;
+
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_PIPE)) {
+		rsp_hdr->Status.CifsError = STATUS_UNEXPECTED_IO_ERROR;
+		return 0;
+	}
+
+	req_params = (struct trans2_qpi_req_params *)(work->request_buf +
+		     le16_to_cpu(req->ParameterOffset) + 4);
+	name = smb_get_name(share, req_params->FileName, PATH_MAX, work,
+		false);
+	if (IS_ERR(name)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(name);
+	}
+
+
+	if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS))
+		flags = 0;
+
+	if (ksmbd_override_fsids(work)) {
+		kfree(name);
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		return -ENOMEM;
+	}
+
+	rc = ksmbd_vfs_kern_path(name, flags, &path, 0);
+	if (rc) {
+		if (rc == -EACCES)
+			rsp_hdr->Status.CifsError = STATUS_ACCESS_DENIED;
+		else
+			rsp_hdr->Status.CifsError =
+					STATUS_OBJECT_NAME_NOT_FOUND;
+		ksmbd_debug(SMB, "cannot get linux path for %s, err %d\n",
+				name, rc);
+		goto out;
+	}
+
+	if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS)) {
+		if (d_is_symlink(path.dentry)) {
+			rsp_hdr->Status.CifsError = STATUS_ACCESS_DENIED;
+			goto out;
+		}
+	}
+
+	rc = vfs_getattr(&path, &st, STATX_BASIC_STATS, AT_STATX_SYNC_AS_STAT);
+	if (rc) {
+		ksmbd_err("cannot get stat information\n");
+		goto err_out;
+	}
+
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) {
+		struct xattr_dos_attrib da;
+
+		rc = ksmbd_vfs_get_dos_attrib_xattr(path.dentry, &da);
+		if (rc > 0)
+			create_time = da.create_time;
+		rc = 0;
+	}
+
+	switch (le16_to_cpu(req_params->InformationLevel)) {
+	case SMB_INFO_STANDARD:
+	{
+		struct file_info_standard *infos;
+
+		ksmbd_debug(SMB, "SMB_INFO_STANDARD\n");
+		rc = ksmbd_query_inode_status(d_inode(path.dentry));
+		if (rc == KSMBD_INODE_STATUS_PENDING_DELETE) {
+			rc = -EBUSY;
+			goto err_out;
+		}
+
+		rc = 0;
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		infos = (struct file_info_standard *)(ptr + 4);
+		unix_to_dos_time(ksmbd_NTtimeToUnix(cpu_to_le64(create_time)),
+			&infos->CreationDate, &infos->CreationTime);
+		unix_to_dos_time(st.atime,
+				&infos->LastAccessDate,
+				&infos->LastAccessTime);
+		unix_to_dos_time(st.mtime,
+				&infos->LastWriteDate,
+				&infos->LastWriteTime);
+		infos->DataSize = cpu_to_le32(st.size);
+		infos->AllocationSize = cpu_to_le32(st.blocks << 9);
+		infos->Attributes = cpu_to_le16(S_ISDIR(st.mode) ?
+					ATTR_DIRECTORY : ATTR_ARCHIVE);
+		infos->EASize = 0;
+
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		rsp->t2.TotalDataCount = cpu_to_le16(22);
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount = cpu_to_le16(22);
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		rsp->ByteCount = cpu_to_le16(27);
+		rsp->Pad = 0;
+		inc_rfc1001_len(rsp_hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+		break;
+	}
+	case SMB_QUERY_FILE_STANDARD_INFO:
+	{
+		struct file_standard_info *standard_info;
+		unsigned int del_pending;
+
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_STANDARD_INFO\n");
+		del_pending = ksmbd_query_inode_status(d_inode(path.dentry));
+		if (del_pending == KSMBD_INODE_STATUS_PENDING_DELETE)
+			del_pending = 1;
+		else
+			del_pending = 0;
+
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		rsp->t2.TotalDataCount =
+			cpu_to_le16(sizeof(struct file_standard_info));
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount =
+			cpu_to_le16(sizeof(struct file_standard_info));
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		/*2 for parameter count & 3 pad (1pad1 + 2 pad2)*/
+		rsp->ByteCount =
+			cpu_to_le16(2 + sizeof(struct file_standard_info) + 3);
+		rsp->Pad = 0;
+		/* lets set EA info */
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		standard_info = (struct file_standard_info *)(ptr + 4);
+		standard_info->AllocationSize = cpu_to_le64(st.blocks << 9);
+		standard_info->EndOfFile = cpu_to_le64(st.size);
+		standard_info->NumberOfLinks = cpu_to_le32(get_nlink(&st) -
+			del_pending);
+		standard_info->DeletePending = del_pending;
+		standard_info->Directory = S_ISDIR(st.mode) ? 1 : 0;
+		inc_rfc1001_len(rsp_hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+		break;
+	}
+	case SMB_QUERY_FILE_BASIC_INFO:
+	{
+		struct file_basic_info *basic_info;
+
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_BASIC_INFO\n");
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		rsp->t2.TotalDataCount =
+			cpu_to_le16(sizeof(struct file_basic_info));
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount = cpu_to_le16(sizeof(struct file_basic_info));
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		/*2 for parameter count & 3 pad (1pad1 + 2 pad2)*/
+		rsp->ByteCount =
+			cpu_to_le16(2 + sizeof(struct file_basic_info) + 3);
+		rsp->Pad = 0;
+		/* lets set EA info */
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		basic_info = (struct file_basic_info *)(ptr + 4);
+		basic_info->CreationTime = cpu_to_le64(create_time);
+		time = ksmbd_UnixTimeToNT(st.atime);
+		basic_info->LastAccessTime = cpu_to_le64(time);
+		time = ksmbd_UnixTimeToNT(st.mtime);
+		basic_info->LastWriteTime = cpu_to_le64(time);
+		time = ksmbd_UnixTimeToNT(st.ctime);
+		basic_info->ChangeTime = cpu_to_le64(time);
+		basic_info->Attributes = S_ISDIR(st.mode) ?
+					 ATTR_DIRECTORY_LE : ATTR_ARCHIVE_LE;
+		basic_info->Pad = 0;
+		inc_rfc1001_len(rsp_hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+		break;
+	}
+	case SMB_QUERY_FILE_EA_INFO:
+	{
+		struct file_ea_info *ea_info;
+
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_EA_INFO\n");
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		rsp->t2.TotalDataCount =
+			cpu_to_le16(sizeof(struct file_ea_info));
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount = cpu_to_le16(sizeof(struct file_ea_info));
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		/*2 for parameter count & 3 pad (1pad1 + 2 pad2)*/
+		rsp->ByteCount =
+			cpu_to_le16(2 + sizeof(struct file_ea_info) + 3);
+		rsp->Pad = 0;
+		/* lets set EA info */
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		ea_info = (struct file_ea_info *)(ptr + 4);
+		ea_info->EaSize = 0;
+		inc_rfc1001_len(rsp_hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+		break;
+	}
+	case SMB_QUERY_FILE_NAME_INFO:
+	{
+		struct file_name_info *name_info;
+		int uni_filename_len;
+		char *filename;
+
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_NAME_INFO\n");
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		name_info = (struct file_name_info *)(ptr + 4);
+
+		filename = convert_to_nt_pathname(name,
+				work->tcon->share_conf->path);
+		if (!filename) {
+			rc = -ENOMEM;
+			goto err_out;
+		}
+		uni_filename_len = smbConvertToUTF16(
+				(__le16 *)name_info->FileName,
+				filename, PATH_MAX,
+				conn->local_nls, 0);
+		kfree(filename);
+		uni_filename_len *= 2;
+		name_info->FileNameLength = cpu_to_le32(uni_filename_len);
+
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		rsp->t2.TotalDataCount = cpu_to_le16(uni_filename_len + 4);
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount = cpu_to_le16(uni_filename_len + 4);
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		/*2 for parameter count & 3 pad (1pad1 + 2 pad2)*/
+		rsp->ByteCount = cpu_to_le16(2 + uni_filename_len + 4 + 3);
+		rsp->Pad = 0;
+		inc_rfc1001_len(rsp_hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+		break;
+	}
+	case SMB_QUERY_FILE_ALL_INFO:
+	{
+		struct file_all_info *ainfo;
+		unsigned int del_pending;
+		char *filename;
+		int uni_filename_len, total_count = 72;
+
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_ALL_INFO\n");
+
+		del_pending = ksmbd_query_inode_status(d_inode(path.dentry));
+		if (del_pending == KSMBD_INODE_STATUS_PENDING_DELETE)
+			del_pending = 1;
+		else
+			del_pending = 0;
+
+		filename = convert_to_nt_pathname(name,
+				work->tcon->share_conf->path);
+		if (!filename) {
+			rc = -ENOMEM;
+			goto err_out;
+		}
+
+		/*
+		 * Observation: sizeof smb_hdr is 33 bytes(including word count)
+		 * After that: trans2 response 22 bytes when stepcount 0 and
+		 * including ByteCount storage.
+		 */
+		/* lets set EA info */
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		ainfo = (struct file_all_info *) (ptr + 4);
+
+		ainfo->CreationTime = cpu_to_le64(create_time);
+		time = ksmbd_UnixTimeToNT(st.atime);
+		ainfo->LastAccessTime = cpu_to_le64(time);
+		time = ksmbd_UnixTimeToNT(st.mtime);
+		ainfo->LastWriteTime = cpu_to_le64(time);
+		time = ksmbd_UnixTimeToNT(st.ctime);
+		ainfo->ChangeTime = cpu_to_le64(time);
+		ainfo->Attributes = S_ISDIR(st.mode) ?
+					ATTR_DIRECTORY_LE : ATTR_ARCHIVE_LE;
+		ainfo->Pad1 = 0;
+		ainfo->AllocationSize = cpu_to_le64(st.blocks << 9);
+		ainfo->EndOfFile = cpu_to_le64(st.size);
+		ainfo->NumberOfLinks = cpu_to_le32(get_nlink(&st) -
+			del_pending);
+		ainfo->DeletePending = del_pending;
+		ainfo->Directory = S_ISDIR(st.mode) ? 1 : 0;
+		ainfo->Pad2 = 0;
+		ainfo->EASize = 0;
+		uni_filename_len = smbConvertToUTF16(
+				(__le16 *)ainfo->FileName,
+				filename, PATH_MAX,
+				conn->local_nls, 0);
+		kfree(filename);
+		uni_filename_len *= 2;
+		ainfo->FileNameLength = cpu_to_le32(uni_filename_len);
+		total_count += uni_filename_len;
+
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		/* add unicode name length of name */
+		rsp->t2.TotalDataCount = cpu_to_le16(total_count);
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount = cpu_to_le16(total_count);
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		/* 2 for parameter count + 72 data count +
+		 * filename length + 3 pad (1pad1 + 2 pad2)
+		 */
+		rsp->ByteCount = cpu_to_le16(5 + total_count);
+		rsp->Pad = 0;
+		inc_rfc1001_len(rsp_hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+		break;
+	}
+	case SMB_QUERY_ALT_NAME_INFO:
+	{
+		struct alt_name_info *alt_name_info;
+		char *base;
+		int filename_len;
+
+		ksmbd_debug(SMB, "SMB_QUERY_ALT_NAME_INFO\n");
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		/*2 for parameter count & 3 pad (1pad1 + 2 pad2)*/
+		rsp->ByteCount = cpu_to_le16(25);
+		rsp->Pad = 0;
+		/* lets set EA info */
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		alt_name_info = (struct alt_name_info *)(ptr + 4);
+
+		base = strrchr(name, '/');
+		if (!base)
+			base = name;
+		else
+			base += 1;
+
+		filename_len = ksmbd_extract_shortname(conn, base,
+					alt_name_info->FileName);
+		alt_name_info->FileNameLength = cpu_to_le32(filename_len);
+		rsp->t2.TotalDataCount = cpu_to_le16(4 + filename_len);
+		rsp->t2.DataCount = cpu_to_le16(4 + filename_len);
+
+		inc_rfc1001_len(rsp_hdr, (4 + filename_len + 25));
+		break;
+	}
+	case SMB_QUERY_FILE_UNIX_BASIC:
+	{
+		struct file_unix_basic_info *unix_info;
+
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_UNIX_BASIC\n");
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = 0;
+		rsp->t2.TotalDataCount = cpu_to_le16(100);
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = 0;
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount = cpu_to_le16(100);
+		rsp->t2.DataOffset = cpu_to_le16(56);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		rsp->ByteCount = cpu_to_le16(101); /* 100 data count + 1pad */
+		rsp->Pad = 0;
+		unix_info = (struct file_unix_basic_info *)(&rsp->Pad + 1);
+		init_unix_info(unix_info, &st);
+		inc_rfc1001_len(rsp_hdr, (10 * 2 + 101));
+		break;
+	}
+	case SMB_QUERY_FILE_INTERNAL_INFO:
+	{
+		struct file_internal_info *iinfo;
+
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_INTERNAL_INFO\n");
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		rsp->t2.TotalDataCount = cpu_to_le16(8);
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount = cpu_to_le16(8);
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		rsp->ByteCount = cpu_to_le16(13);
+		rsp->Pad = 0;
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		iinfo = (struct file_internal_info *) (ptr + 4);
+		iinfo->UniqueId = cpu_to_le64(st.ino);
+		inc_rfc1001_len(rsp_hdr, (10 * 2 + 13));
+		break;
+	}
+	case SMB_QUERY_FILE_UNIX_LINK:
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_UNIX_LINK\n");
+		rc = smb_readlink(work, &path);
+		if (rc < 0)
+			goto err_out;
+		break;
+	case SMB_INFO_QUERY_ALL_EAS:
+		ksmbd_debug(SMB, "SMB_INFO_QUERY_ALL_EAS\n");
+		rc = smb_get_ea(work, &path);
+		if (rc < 0)
+			goto err_out;
+		break;
+	case SMB_QUERY_POSIX_ACL:
+		ksmbd_debug(SMB, "SMB_QUERY_POSIX_ACL\n");
+		rc = smb_get_acl(work, &path);
+		if (rc < 0)
+			goto err_out;
+		break;
+	default:
+		ksmbd_err("query path info not implemnted for %x\n",
+				le16_to_cpu(req_params->InformationLevel));
+		rc = -EINVAL;
+		goto err_out;
+	}
+
+err_out:
+	path_put(&path);
+out:
+	ksmbd_revert_fsids(work);
+	kfree(name);
+	return rc;
+}
+
+/**
+ * create_trans2_reply() - create response for trans2 request
+ * @work:	smb work containing smb response buffer
+ * @count:	trans2 response buffer size
+ */
+static void create_trans2_reply(struct ksmbd_work *work, __u16 count)
+{
+	struct smb_hdr *rsp_hdr = work->response_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+
+	rsp_hdr->WordCount = 0x0A;
+	rsp->t2.TotalParameterCount = 0;
+	rsp->t2.TotalDataCount = cpu_to_le16(count);
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = 0;
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = cpu_to_le16(count);
+	rsp->t2.DataOffset = cpu_to_le16(56);
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+
+	rsp->ByteCount = cpu_to_le16(count + 1);
+	rsp->Pad = 0;
+	inc_rfc1001_len(rsp_hdr, 10 * 2 + (count + 1));
+}
+
+/**
+ * set_fs_info() - handler for set fs info commands
+ * @work:	smb work containing set fs info command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int set_fs_info(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_setfsi_req *req = work->request_buf;
+	struct smb_com_trans2_setfsi_rsp *rsp = work->response_buf;
+	int info_level = le16_to_cpu(req->InformationLevel);
+
+	switch (info_level) {
+	u64 client_cap;
+
+	case SMB_SET_CIFS_UNIX_INFO:
+		ksmbd_debug(SMB, "SMB_SET_CIFS_UNIX_INFO\n");
+		if (le16_to_cpu(req->ClientUnixMajor) !=
+			CIFS_UNIX_MAJOR_VERSION) {
+			ksmbd_err("Non compatible unix major info\n");
+			return -EINVAL;
+		}
+
+		if (le16_to_cpu(req->ClientUnixMinor) !=
+			CIFS_UNIX_MINOR_VERSION) {
+			ksmbd_err("Non compatible unix minor info\n");
+			return -EINVAL;
+		}
+
+		client_cap = le64_to_cpu(req->ClientUnixCap);
+		ksmbd_debug(SMB, "clients unix cap = %llx\n", client_cap);
+		/* TODO: process caps */
+		rsp->t2.TotalDataCount = 0;
+		break;
+	default:
+		ksmbd_debug(SMB, "info level %x  not supported\n", info_level);
+		return -EINVAL;
+	}
+
+	create_trans2_reply(work, le16_to_cpu(rsp->t2.TotalDataCount));
+	return 0;
+}
+
+/**
+ * query_fs_info() - handler for query fs info commands
+ * @work:	smb work containing query fs info command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int query_fs_info(struct ksmbd_work *work)
+{
+	struct smb_hdr *req_hdr = work->request_buf;
+	struct smb_com_trans2_req *req = work->request_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct smb_com_trans2_qfsi_req_params *req_params;
+	struct ksmbd_conn *conn = work->conn;
+	struct kstatfs stfs;
+	struct ksmbd_share_config *share;
+	int rc;
+	struct path path;
+	bool incomplete = false;
+	int info_level, len = 0;
+	struct ksmbd_tree_connect *tree_conn;
+
+	req_params = (struct smb_com_trans2_qfsi_req_params *)
+		(work->request_buf + le16_to_cpu(req->ParameterOffset) + 4);
+	/* check if more data is coming */
+	if (le16_to_cpu(req->TotalParameterCount) !=
+		le16_to_cpu(req->ParameterCount)) {
+		ksmbd_debug(SMB, "total param = %d, received = %d\n",
+			le16_to_cpu(req->TotalParameterCount),
+			le16_to_cpu(req->ParameterCount));
+		incomplete = true;
+	}
+
+	if (le16_to_cpu(req->TotalDataCount) != le16_to_cpu(req->DataCount)) {
+		ksmbd_debug(SMB, "total data = %d, received = %d\n",
+			le16_to_cpu(req->TotalDataCount),
+			le16_to_cpu(req->DataCount));
+		incomplete = true;
+	}
+
+	if (incomplete) {
+		/* create 1 trans_state structure
+		 * and add to connection list
+		 */
+	}
+
+	info_level = le16_to_cpu(req_params->InformationLevel);
+
+	tree_conn = ksmbd_tree_conn_lookup(work->sess,
+					   le16_to_cpu(req_hdr->Tid));
+	if (!tree_conn)
+		return -ENOENT;
+	share = tree_conn->share_conf;
+
+	if (test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE))
+		return -ENOENT;
+
+	if (ksmbd_override_fsids(work))
+		return -ENOMEM;
+
+	rc = ksmbd_vfs_kern_path(share->path, LOOKUP_FOLLOW, &path, 0);
+	if (rc) {
+		ksmbd_revert_fsids(work);
+		ksmbd_err("cannot create vfs path\n");
+		return rc;
+	}
+
+	rc = vfs_statfs(&path, &stfs);
+	if (rc) {
+		ksmbd_err("cannot do stat of path %s\n", share->path);
+		goto err_out;
+	}
+
+	switch (info_level) {
+	case SMB_INFO_ALLOCATION:
+	{
+		struct filesystem_alloc_info *ainfo;
+
+		ksmbd_debug(SMB, "GOT SMB_INFO_ALLOCATION\n");
+		rsp->t2.TotalDataCount = cpu_to_le16(18);
+		ainfo = (struct filesystem_alloc_info *)(&rsp->Pad + 1);
+		ainfo->fsid = 0;
+		ainfo->BytesPerSector = cpu_to_le16(512);
+		ainfo->SectorsPerAllocationUnit =
+		cpu_to_le32(stfs.f_bsize/le16_to_cpu(ainfo->BytesPerSector));
+		ainfo->TotalAllocationUnits = cpu_to_le32(stfs.f_blocks);
+		ainfo->FreeAllocationUnits = cpu_to_le32(stfs.f_bfree);
+		break;
+	}
+	case SMB_QUERY_FS_VOLUME_INFO:
+	{
+		struct filesystem_vol_info *vinfo;
+
+		ksmbd_debug(SMB, "GOT SMB_QUERY_FS_VOLUME_INFO\n");
+		vinfo = (struct filesystem_vol_info *)(&rsp->Pad + 1);
+		vinfo->VolumeCreationTime = 0;
+		/* Taking dummy value of serial number*/
+		vinfo->SerialNumber = cpu_to_le32(0xbc3ac512);
+		len = smbConvertToUTF16((__le16 *)vinfo->VolumeLabel,
+			share->name, PATH_MAX, conn->local_nls, 0);
+		vinfo->VolumeLabelSize = cpu_to_le32(len);
+		vinfo->Reserved = 0;
+		rsp->t2.TotalDataCount =
+			cpu_to_le16(sizeof(struct filesystem_vol_info) +
+				    len - 2);
+		break;
+	}
+	case SMB_QUERY_FS_SIZE_INFO:
+	{
+		struct filesystem_info *sinfo;
+
+		ksmbd_debug(SMB, "GOT SMB_QUERY_FS_SIZE_INFO\n");
+		rsp->t2.TotalDataCount = cpu_to_le16(24);
+		sinfo = (struct filesystem_info *)(&rsp->Pad + 1);
+		sinfo->BytesPerSector = cpu_to_le32(512);
+		sinfo->SectorsPerAllocationUnit =
+			cpu_to_le32(stfs.f_bsize/sinfo->BytesPerSector);
+		sinfo->TotalAllocationUnits = cpu_to_le64(stfs.f_blocks);
+		sinfo->FreeAllocationUnits = cpu_to_le64(stfs.f_bfree);
+		break;
+	}
+	case SMB_QUERY_FS_DEVICE_INFO:
+	{
+		struct filesystem_device_info *fdi;
+
+		/* query fs info device info response is 0 word and 8 bytes */
+		ksmbd_debug(SMB, "GOT SMB_QUERY_FS_DEVICE_INFO\n");
+		if (le16_to_cpu(req->MaxDataCount) < 8) {
+			ksmbd_err("Insufficient bytes, cannot response()\n");
+			rc = -EINVAL;
+			goto err_out;
+		}
+
+		rsp->t2.TotalDataCount = cpu_to_le16(18);
+		fdi = (struct filesystem_device_info *)(&rsp->Pad + 1);
+		fdi->DeviceType = cpu_to_le32(FILE_DEVICE_DISK);
+		fdi->DeviceCharacteristics = cpu_to_le32(0x20);
+		break;
+	}
+	case SMB_QUERY_FS_ATTRIBUTE_INFO:
+	{
+		struct filesystem_attribute_info *info;
+
+		ksmbd_debug(SMB, "GOT SMB_QUERY_FS_ATTRIBUTE_INFO\n");
+		/* constant 12 bytes + variable filesystem name */
+		info = (struct filesystem_attribute_info *)(&rsp->Pad + 1);
+
+		if (le16_to_cpu(req->MaxDataCount) < 12) {
+			ksmbd_err("Insufficient bytes, cannot response()\n");
+			rc = -EINVAL;
+			goto err_out;
+		}
+
+		info->Attributes = cpu_to_le32(FILE_CASE_PRESERVED_NAMES |
+				   FILE_CASE_SENSITIVE_SEARCH |
+				   FILE_VOLUME_QUOTAS);
+		info->MaxPathNameComponentLength = cpu_to_le32(stfs.f_namelen);
+		info->FileSystemNameLen = 0;
+		rsp->t2.TotalDataCount = cpu_to_le16(12);
+		break;
+	}
+	case SMB_QUERY_CIFS_UNIX_INFO:
+	{
+		struct filesystem_unix_info *uinfo;
+
+		ksmbd_debug(SMB, "GOT SMB_QUERY_CIFS_UNIX_INFO\n");
+		/* constant 12 bytes + variable filesystem name */
+		uinfo = (struct filesystem_unix_info *)(&rsp->Pad + 1);
+
+		if (le16_to_cpu(req->MaxDataCount) < 12) {
+			ksmbd_err("Insufficient bytes, cannot response()\n");
+			rc = -EINVAL;
+			goto err_out;
+		}
+		uinfo->MajorVersionNumber =
+			cpu_to_le16(CIFS_UNIX_MAJOR_VERSION);
+		uinfo->MinorVersionNumber =
+			cpu_to_le16(CIFS_UNIX_MINOR_VERSION);
+		uinfo->Capability = cpu_to_le64(SMB_UNIX_CAPS);
+		rsp->t2.TotalDataCount = cpu_to_le16(12);
+		break;
+	}
+	case SMB_QUERY_POSIX_FS_INFO:
+	{
+		struct filesystem_posix_info *pinfo;
+
+		ksmbd_debug(SMB, "GOT SMB_QUERY_POSIX_FS_INFO\n");
+		rsp->t2.TotalDataCount = cpu_to_le16(56);
+		pinfo = (struct filesystem_posix_info *)(&rsp->Pad + 1);
+		pinfo->BlockSize = cpu_to_le32(stfs.f_bsize);
+		pinfo->OptimalTransferSize = cpu_to_le32(stfs.f_blocks);
+		pinfo->TotalBlocks = cpu_to_le64(stfs.f_blocks);
+		pinfo->BlocksAvail = cpu_to_le64(stfs.f_bfree);
+		pinfo->UserBlocksAvail = cpu_to_le64(stfs.f_bavail);
+		pinfo->TotalFileNodes = cpu_to_le64(stfs.f_files);
+		pinfo->FreeFileNodes = cpu_to_le64(stfs.f_ffree);
+		pinfo->FileSysIdentifier = 0;
+		break;
+	}
+	default:
+		ksmbd_debug(SMB, "info level %x not implemented\n", info_level);
+		rc = -EINVAL;
+		goto err_out;
+	}
+
+	create_trans2_reply(work, le16_to_cpu(rsp->t2.TotalDataCount));
+
+err_out:
+	path_put(&path);
+	ksmbd_revert_fsids(work);
+	return rc;
+}
+
+/**
+ * smb_posix_convert_flags() - convert smb posix access flags to open flags
+ * @flags:	smb posix access flags
+ *
+ * Return:	file open flags
+ */
+static __u32 smb_posix_convert_flags(__u32 flags)
+{
+	__u32 posix_flags = 0;
+
+	if ((flags & SMB_ACCMODE) == SMB_O_RDONLY)
+		posix_flags = O_RDONLY;
+	else if ((flags & SMB_ACCMODE) == SMB_O_WRONLY)
+		posix_flags = O_WRONLY;
+	else if ((flags & SMB_ACCMODE) == SMB_O_RDWR)
+		posix_flags = O_RDWR;
+
+	if (flags & SMB_O_SYNC)
+		posix_flags |= O_DSYNC;
+	if (flags & SMB_O_DIRECTORY)
+		posix_flags |= O_DIRECTORY;
+	if (flags & SMB_O_NOFOLLOW)
+		posix_flags |= O_NOFOLLOW;
+	if (flags & SMB_O_APPEND)
+		posix_flags |= O_APPEND;
+
+	return posix_flags;
+}
+
+/**
+ * smb_get_disposition() - convert smb disposition flags to open flags
+ * @flags:		smb file disposition flags
+ * @file_present:	file already present or not
+ * @stat:		file stat information
+ * @open_flags:		open flags should be stored here
+ *
+ * Return:		file disposition flags
+ */
+static int smb_get_disposition(unsigned int flags, bool file_present,
+		struct kstat *stat, unsigned int *open_flags)
+{
+	int dispostion, disp_flags;
+
+	if ((flags & (SMB_O_CREAT | SMB_O_EXCL)) == (SMB_O_CREAT | SMB_O_EXCL))
+		dispostion = FILE_CREATE;
+	else if ((flags & (SMB_O_CREAT | SMB_O_TRUNC)) ==
+			(SMB_O_CREAT | SMB_O_TRUNC))
+		dispostion = FILE_OVERWRITE_IF;
+	else if ((flags & SMB_O_CREAT) == SMB_O_CREAT)
+		dispostion = FILE_OPEN_IF;
+	else if ((flags & SMB_O_TRUNC) == SMB_O_TRUNC)
+		dispostion = FILE_OVERWRITE;
+	else if ((flags & (SMB_O_CREAT | SMB_O_EXCL | SMB_O_TRUNC)) == 0)
+		dispostion = FILE_OPEN;
+	else
+		dispostion = FILE_SUPERSEDE;
+
+	disp_flags = file_create_dispostion_flags(dispostion, file_present);
+	if (disp_flags < 0)
+		return disp_flags;
+
+	*open_flags |= disp_flags;
+	return disp_flags;
+}
+
+/**
+ * smb_posix_open() - handler for smb posix open
+ * @work:	smb work containing posix open command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_posix_open(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_spi_req *pSMB_req = work->request_buf;
+	struct smb_com_trans2_spi_rsp *pSMB_rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct open_psx_req *psx_req;
+	struct open_psx_rsp *psx_rsp;
+	struct file_unix_basic_info *unix_info;
+	struct path path;
+	struct kstat stat;
+	__u16 data_offset, rsp_info_level, file_info = 0;
+	__u32 oplock_flags, posix_open_flags;
+	umode_t mode;
+	char *name;
+	bool file_present = true;
+	int err;
+	struct ksmbd_file *fp = NULL;
+	int oplock_rsp = OPLOCK_NONE;
+	unsigned int flags = LOOKUP_FOLLOW;
+
+	name = smb_get_name(share, pSMB_req->FileName, PATH_MAX, work, false);
+	if (IS_ERR(name)) {
+		pSMB_rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(name);
+	}
+
+	if (ksmbd_override_fsids(work)) {
+		pSMB_rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		kfree(name);
+		return -ENOMEM;
+	}
+
+	if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS))
+		flags = 0;
+
+	err = ksmbd_vfs_kern_path(name, flags, &path, 0);
+	if (err) {
+		file_present = false;
+		ksmbd_debug(SMB, "cannot get linux path for %s, err = %d\n",
+				name, err);
+		if (err == -EACCES)
+			goto out;
+	} else {
+		if (!test_share_config_flag(share,
+			KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS)) {
+			if (d_is_symlink(path.dentry)) {
+				err = -EACCES;
+				goto free_path;
+			}
+		}
+		err = vfs_getattr(&path, &stat, STATX_BASIC_STATS,
+			AT_STATX_SYNC_AS_STAT);
+		if (err) {
+			ksmbd_err("can not stat %s, err = %d\n", name, err);
+			goto free_path;
+		}
+	}
+
+	data_offset = le16_to_cpu(pSMB_req->DataOffset);
+	psx_req = (struct open_psx_req *)(((char *)&pSMB_req->hdr.Protocol) +
+			data_offset);
+	oplock_flags = le32_to_cpu(psx_req->OpenFlags);
+
+	posix_open_flags = smb_posix_convert_flags(
+			le32_to_cpu(psx_req->PosixOpenFlags));
+	err = smb_get_disposition(le32_to_cpu(psx_req->PosixOpenFlags),
+			file_present, &stat,
+			&posix_open_flags);
+	if (err < 0) {
+		ksmbd_debug(SMB, "create_dispostion returned %d\n", err);
+		if (file_present)
+			goto free_path;
+		else
+			goto out;
+	}
+
+	ksmbd_debug(SMB, "filename : %s, posix_open_flags : %x\n", name,
+		posix_open_flags);
+	mode = (umode_t) le64_to_cpu(psx_req->Permissions);
+	rsp_info_level = le16_to_cpu(psx_req->Level);
+
+	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+		if (posix_open_flags & O_CREAT) {
+			err = -EACCES;
+			ksmbd_debug(SMB,
+				"returning as user does not have permission to write\n");
+			goto out;
+		}
+	}
+
+	/* posix mkdir command */
+	if (posix_open_flags == (O_DIRECTORY | O_CREAT)) {
+		if (file_present) {
+			err = -EEXIST;
+			goto free_path;
+		}
+
+		err = ksmbd_vfs_mkdir(work, name, mode);
+		if (err)
+			goto out;
+
+		err = ksmbd_vfs_kern_path(name, 0, &path, 0);
+		if (err) {
+			ksmbd_err("cannot get linux path, err = %d\n", err);
+			goto out;
+		}
+		ksmbd_debug(SMB, "mkdir done for %s, inode %lu\n",
+				name, d_inode(path.dentry)->i_ino);
+		goto prepare_rsp;
+	}
+
+	if (!file_present && (posix_open_flags & O_CREAT)) {
+		err = ksmbd_vfs_create(work, name, mode);
+		if (err)
+			goto out;
+
+		err = ksmbd_vfs_kern_path(name, 0, &path, 0);
+		if (err) {
+			ksmbd_err("cannot get linux path, err = %d\n", err);
+			goto out;
+		}
+	} else if (file_present) {
+		err = ksmbd_vfs_inode_permission(path.dentry,
+				posix_open_flags & O_ACCMODE, false);
+		if (err)
+			goto free_path;
+	}
+
+	fp = ksmbd_vfs_dentry_open(work, &path, posix_open_flags,
+			0, file_present);
+	if (IS_ERR(fp)) {
+		err = PTR_ERR(fp);
+		fp = NULL;
+		goto free_path;
+	}
+	fp->filename = name;
+	fp->pid = le16_to_cpu(pSMB_req->hdr.Pid);
+
+	write_lock(&fp->f_ci->m_lock);
+	list_add(&fp->node, &fp->f_ci->m_fp_list);
+	write_unlock(&fp->f_ci->m_lock);
+
+	if (smb1_oplock_enable &&
+	    test_share_config_flag(work->tcon->share_conf,
+			KSMBD_SHARE_FLAG_OPLOCKS) &&
+		!S_ISDIR(file_inode(fp->filp)->i_mode)) {
+		/* Client cannot request levelII oplock directly */
+		err = smb_grant_oplock(work, oplock_flags &
+			(REQ_OPLOCK | REQ_BATCHOPLOCK), fp->volatile_id, fp,
+			le16_to_cpu(pSMB_req->hdr.Tid), NULL, 0);
+		if (err)
+			goto free_path;
+	}
+
+	oplock_rsp = fp->f_opinfo != NULL ? fp->f_opinfo->level : 0;
+
+prepare_rsp:
+	/* open/mkdir success, send back response */
+	data_offset = sizeof(struct smb_com_trans2_spi_rsp) -
+		sizeof(pSMB_rsp->hdr.smb_buf_length) +
+		3 /*alignment*/;
+	psx_rsp = (struct open_psx_rsp *)(((char *)&pSMB_rsp->hdr.Protocol) +
+			data_offset);
+	if (data_offset + sizeof(struct open_psx_rsp) > work->response_sz) {
+		err = -EIO;
+		goto free_path;
+	}
+
+	psx_rsp->OplockFlags = cpu_to_le16(oplock_rsp);
+	psx_rsp->Fid = fp != NULL ? fp->volatile_id : 0;
+
+	if (file_present) {
+		if (!(posix_open_flags & O_TRUNC))
+			file_info = F_OPENED;
+		else
+			file_info = F_OVERWRITTEN;
+	} else
+		file_info = F_CREATED;
+	psx_rsp->CreateAction = cpu_to_le32(file_info);
+
+	if (rsp_info_level != SMB_QUERY_FILE_UNIX_BASIC) {
+		ksmbd_debug(SMB, "returning null information level response");
+		rsp_info_level = SMB_NO_INFO_LEVEL_RESPONSE;
+	}
+	psx_rsp->ReturnedLevel = cpu_to_le16(rsp_info_level);
+
+	err = vfs_getattr(&path, &stat, STATX_BASIC_STATS,
+		AT_STATX_SYNC_AS_STAT);
+	if (err) {
+		ksmbd_err("cannot get stat information\n");
+		goto free_path;
+	}
+
+	pSMB_rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	unix_info = (struct file_unix_basic_info *)((char *)psx_rsp +
+			sizeof(struct open_psx_rsp));
+	init_unix_info(unix_info, &stat);
+
+	pSMB_rsp->hdr.WordCount = 10;
+	pSMB_rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	pSMB_rsp->t2.TotalDataCount = cpu_to_le16(sizeof(struct open_psx_rsp) +
+			sizeof(struct file_unix_basic_info));
+	pSMB_rsp->t2.ParameterCount = pSMB_rsp->t2.TotalParameterCount;
+	pSMB_rsp->t2.Reserved = 0;
+	pSMB_rsp->t2.ParameterCount = cpu_to_le16(2);
+	pSMB_rsp->t2.ParameterOffset = cpu_to_le16(56);
+	pSMB_rsp->t2.ParameterDisplacement = 0;
+	pSMB_rsp->t2.DataCount = pSMB_rsp->t2.TotalDataCount;
+	pSMB_rsp->t2.DataOffset = cpu_to_le16(data_offset);
+	pSMB_rsp->t2.DataDisplacement = 0;
+	pSMB_rsp->t2.SetupCount = 0;
+	pSMB_rsp->t2.Reserved1 = 0;
+
+	/* 2 for parameter count + 112 data count + 3 pad (1 pad1 + 2 pad2)*/
+	pSMB_rsp->ByteCount = cpu_to_le16(117);
+	pSMB_rsp->Reserved2 = 0;
+	inc_rfc1001_len(&pSMB_rsp->hdr,
+			(pSMB_rsp->hdr.WordCount * 2 + 117));
+
+free_path:
+	path_put(&path);
+out:
+	switch (err) {
+	case 0:
+		break;
+	case -ENOSPC:
+		pSMB_rsp->hdr.Status.CifsError = STATUS_DISK_FULL;
+		break;
+	case -EINVAL:
+		pSMB_rsp->hdr.Status.CifsError = STATUS_NO_SUCH_USER;
+		break;
+	case -EACCES:
+		pSMB_rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		break;
+	case -ENOENT:
+		pSMB_rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_NOT_FOUND;
+		break;
+	case -EBUSY:
+		pSMB_rsp->hdr.Status.CifsError = STATUS_DELETE_PENDING;
+		break;
+	default:
+		pSMB_rsp->hdr.Status.CifsError =
+			STATUS_UNEXPECTED_IO_ERROR;
+	}
+
+	if (err) {
+		if (fp)
+			ksmbd_close_fd(work, fp->volatile_id);
+		else
+			kfree(name);
+	}
+	ksmbd_revert_fsids(work);
+	return err;
+}
+
+/**
+ * smb_posix_unlink() - handler for posix file delete
+ * @work:	smb work containing trans2 posix delete command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_posix_unlink(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_spi_req *req = work->request_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct unlink_psx_rsp *psx_rsp = NULL;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	char *name;
+	int rc = 0;
+
+	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+		ksmbd_debug(SMB,
+			"returning as user does not have permission to write\n");
+		rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		return -EACCES;
+	}
+
+	name = smb_get_name(share, req->FileName, PATH_MAX, work, false);
+	if (IS_ERR(name)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(name);
+	}
+
+	rc = ksmbd_vfs_remove_file(work, name);
+	if (rc < 0)
+		goto out;
+
+	psx_rsp = (struct unlink_psx_rsp *)((char *)rsp +
+			sizeof(struct smb_com_trans2_rsp));
+	psx_rsp->EAErrorOffset = cpu_to_le16(0);
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = cpu_to_le16(0);
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = cpu_to_le16(2);
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = cpu_to_le16(0);
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+
+	/* 2 for parameter count + 1 pad1*/
+	rsp->ByteCount = cpu_to_le16(3);
+	rsp->Pad = 0;
+	inc_rfc1001_len(&rsp->hdr, rsp->hdr.WordCount * 2 + 3);
+
+out:
+	if (rc)
+		rsp->hdr.Status.CifsError = STATUS_UNEXPECTED_IO_ERROR;
+
+	kfree(name);
+	return rc;
+}
+
+/**
+ * smb_set_time_pathinfo() - handler for setting time using set path info
+ * @work:	smb work containing set path info command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_set_time_pathinfo(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_spi_req *req = work->request_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct file_basic_info *info;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct iattr attrs;
+	char *name;
+	int err = 0;
+
+	name = smb_get_name(share, req->FileName, PATH_MAX, work, false);
+	if (IS_ERR(name)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(name);
+	}
+
+	info = (struct file_basic_info *)(((char *) &req->hdr.Protocol) +
+			le16_to_cpu(req->DataOffset));
+
+	attrs.ia_valid = 0;
+	if (le64_to_cpu(info->LastAccessTime)) {
+		attrs.ia_atime = smb_NTtimeToUnix(info->LastAccessTime);
+		attrs.ia_valid |= (ATTR_ATIME | ATTR_ATIME_SET);
+	}
+
+	if (le64_to_cpu(info->ChangeTime)) {
+		attrs.ia_ctime = smb_NTtimeToUnix(info->ChangeTime);
+		attrs.ia_valid |= ATTR_CTIME;
+	}
+
+	if (le64_to_cpu(info->LastWriteTime)) {
+		attrs.ia_mtime = smb_NTtimeToUnix(info->LastWriteTime);
+		attrs.ia_valid |= (ATTR_MTIME | ATTR_MTIME_SET);
+	}
+	/* TODO: check dos mode and acl bits if req->Attributes nonzero */
+
+	if (!attrs.ia_valid)
+		goto done;
+
+	err = ksmbd_vfs_setattr(work, name, 0, &attrs);
+	if (err) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		return err;
+	}
+
+done:
+	ksmbd_debug(SMB, "%s setattr done\n", name);
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = 0;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = 0;
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+
+	/* 3 pad (1 pad1 + 2 pad2)*/
+	rsp->ByteCount = cpu_to_le16(3);
+	inc_rfc1001_len(&rsp->hdr, rsp->hdr.WordCount * 2 + 3);
+
+	kfree(name);
+	return 0;
+}
+
+/**
+ * smb_set_unix_pathinfo() - handler for setting unix path info(setattr)
+ * @work:	smb work containing set path info command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_set_unix_pathinfo(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_spi_req *req = work->request_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct file_unix_basic_info *unix_info;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct iattr attrs;
+	char *name;
+	int err = 0;
+
+	name = smb_get_name(share, req->FileName, PATH_MAX, work, false);
+	if (IS_ERR(name)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(name);
+	}
+
+	unix_info =  (struct file_unix_basic_info *)
+		(((char *) &req->hdr.Protocol) + le16_to_cpu(req->DataOffset));
+	attrs.ia_valid = 0;
+	attrs.ia_mode = 0;
+	err = unix_info_to_attr(unix_info, &attrs);
+	if (err)
+		goto out;
+
+	err = ksmbd_vfs_setattr(work, name, 0, &attrs);
+	if (err)
+		goto out;
+	/* setattr success, prepare response */
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = 0;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = 0;
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+
+	/* 3 pad (1 pad1 + 2 pad2)*/
+	rsp->ByteCount = cpu_to_le16(3);
+	inc_rfc1001_len(&rsp->hdr, rsp->hdr.WordCount * 2 + 3);
+
+out:
+	kfree(name);
+	if (err) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		return err;
+	}
+	return 0;
+}
+
+/**
+ * smb_set_ea() - handler for setting extended attributes using set path
+ *		info command
+ * @work:	smb work containing set path info command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_set_ea(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_spi_req *req = work->request_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct fealist *eabuf;
+	struct fea *ea;
+	char *fname, *attr_name = NULL, *value;
+	int rc = 0, list_len, i, next = 0;
+
+	fname = smb_get_name(share, req->FileName, PATH_MAX, work, false);
+	if (IS_ERR(fname)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(fname);
+	}
+
+	eabuf = (struct fealist *)(((char *) &req->hdr.Protocol)
+			+ le16_to_cpu(req->DataOffset));
+
+	list_len = le32_to_cpu(eabuf->list_len) - 4;
+	ea = (struct fea *)eabuf->list;
+
+	for (i = 0; list_len >= 0 && ea->name_len != 0; i++, list_len -= next) {
+		if (ea->name_len > (XATTR_NAME_MAX - XATTR_USER_PREFIX_LEN)) {
+			rc = -EINVAL;
+			goto out;
+		}
+
+		next = ea->name_len + le16_to_cpu(ea->value_len) + 4;
+
+		attr_name = kmalloc(XATTR_NAME_MAX + 1, GFP_KERNEL);
+		if (!attr_name) {
+			rc = -ENOMEM;
+			goto out;
+		}
+
+		memcpy(attr_name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN);
+		memcpy(&attr_name[XATTR_USER_PREFIX_LEN], ea->name,
+				ea->name_len);
+		attr_name[XATTR_USER_PREFIX_LEN + ea->name_len] = '\0';
+		value = (char *)&ea->name + ea->name_len + 1;
+		ksmbd_debug(SMB, "name: <%s>, name_len %u, value_len %u\n",
+			ea->name, ea->name_len, le16_to_cpu(ea->value_len));
+
+		rc = ksmbd_vfs_fsetxattr(work, fname, attr_name, value,
+					le16_to_cpu(ea->value_len),
+					0);
+		if (rc < 0) {
+			kfree(attr_name);
+			rsp->hdr.Status.CifsError =
+				STATUS_UNEXPECTED_IO_ERROR;
+			goto out;
+		}
+		kfree(attr_name);
+		ea += next;
+	}
+
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = cpu_to_le16(0);
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = cpu_to_le16(2);
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = cpu_to_le16(0);
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+
+	/* 2 for parameter count + 1 pad1*/
+	rsp->ByteCount = cpu_to_le16(3);
+	rsp->Pad = 0;
+	inc_rfc1001_len(&rsp->hdr, rsp->hdr.WordCount * 2 + 3);
+
+out:
+	kfree(fname);
+	return rc;
+}
+
+/**
+ * smb_set_file_size_pinfo() - handler for setting eof or truncate using
+ *		trans2 set path info command
+ * @work:	smb work containing set path info command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_set_file_size_pinfo(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_spi_req *req = work->request_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct file_end_of_file_info *eofinfo;
+	char *name = NULL;
+	loff_t newsize;
+	int rc = 0;
+
+	name = smb_get_name(share, req->FileName, PATH_MAX, work, false);
+	if (IS_ERR(name)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(name);
+	}
+
+	eofinfo =  (struct file_end_of_file_info *)
+		(((char *) &req->hdr.Protocol) + le16_to_cpu(req->DataOffset));
+	newsize = le64_to_cpu(eofinfo->FileSize);
+	rc = ksmbd_vfs_truncate(work, name, NULL, newsize);
+	if (rc) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		goto out;
+	}
+	ksmbd_debug(SMB, "%s truncated to newsize %lld\n",
+			name, newsize);
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = 0;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = 0;
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+
+	/* 2 for parameter count + 1 pad1*/
+	rsp->ByteCount = cpu_to_le16(3);
+	inc_rfc1001_len(&rsp->hdr, rsp->hdr.WordCount * 2 + 3);
+
+out:
+	kfree(name);
+	return rc;
+}
+
+/**
+ * smb_creat_hardlink() - handler for creating hardlink
+ * @work:	smb work containing set path info command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_creat_hardlink(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_spi_req *req = work->request_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	char *oldname, *newname, *oldname_offset;
+	int err;
+
+	newname = smb_get_name(share, req->FileName, PATH_MAX, work, false);
+	if (IS_ERR(newname)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(newname);
+	}
+
+	oldname_offset = ((char *)&req->hdr.Protocol) +
+				le16_to_cpu(req->DataOffset);
+	oldname = smb_get_name(share, oldname_offset, PATH_MAX, work, false);
+	if (IS_ERR(oldname)) {
+		err = PTR_ERR(oldname);
+		oldname = NULL;
+		goto out;
+	}
+	ksmbd_debug(SMB, "oldname %s, newname %s\n", oldname, newname);
+
+	err = ksmbd_vfs_link(work, oldname, newname);
+	if (err < 0) {
+		if (err == -EACCES)
+			rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		else
+			rsp->hdr.Status.CifsError = STATUS_NOT_SAME_DEVICE;
+		goto out;
+	}
+
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = 0;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = 0;
+	rsp->t2.DataOffset = 0;
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+	rsp->ByteCount = cpu_to_le16(3);
+	inc_rfc1001_len(&rsp->hdr, rsp->hdr.WordCount * 2 + 3);
+out:
+	kfree(newname);
+	kfree(oldname);
+	return err;
+}
+
+/**
+ * smb_creat_symlink() - handler for creating symlink
+ * @work:	smb work containing set path info command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_creat_symlink(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_spi_req *req = work->request_buf;
+	struct smb_com_trans2_spi_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	char *name, *symname, *name_offset;
+	bool is_unicode = is_smbreq_unicode(&req->hdr);
+	int err;
+
+	symname = smb_get_name(share, req->FileName, PATH_MAX, work, false);
+	if (IS_ERR(symname)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(symname);
+	}
+
+	name_offset = ((char *)&req->hdr.Protocol) +
+		le16_to_cpu(req->DataOffset);
+	name = smb_strndup_from_utf16(name_offset, PATH_MAX, is_unicode,
+			work->conn->local_nls);
+	if (IS_ERR(name)) {
+		kfree(symname);
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		return PTR_ERR(name);
+	}
+	ksmbd_debug(SMB, "name %s, symname %s\n", name, symname);
+
+	err = ksmbd_vfs_symlink(work, name, symname);
+	if (err < 0) {
+		if (err == -ENOSPC)
+			rsp->hdr.Status.CifsError = STATUS_DISK_FULL;
+		else if (err == -EEXIST)
+			rsp->hdr.Status.CifsError =
+				STATUS_OBJECT_NAME_COLLISION;
+		else
+			rsp->hdr.Status.CifsError = STATUS_NOT_SAME_DEVICE;
+	} else
+		rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = 0;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = 0;
+	rsp->t2.DataOffset = 0;
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+	rsp->ByteCount = cpu_to_le16(3);
+	inc_rfc1001_len(&rsp->hdr, rsp->hdr.WordCount * 2 + 3);
+	kfree(name);
+	kfree(symname);
+	return err;
+}
+
+/**
+ * set_path_info() - handler for trans2 set path info sub commands
+ * @work:	smb work containing set path info command
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int set_path_info(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_spi_req *pSMB_req = work->request_buf;
+	struct smb_com_trans2_spi_rsp  *pSMB_rsp = work->response_buf;
+	__u16 info_level, total_param;
+	int err = 0;
+
+	info_level = le16_to_cpu(pSMB_req->InformationLevel);
+	total_param = le16_to_cpu(pSMB_req->TotalParameterCount);
+	if (total_param < 7) {
+		pSMB_rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		ksmbd_err("invalid total parameter for info_level 0x%x\n",
+				total_param);
+		return -EINVAL;
+	}
+
+	switch (info_level) {
+	case SMB_POSIX_OPEN:
+		err = smb_posix_open(work);
+		break;
+	case SMB_POSIX_UNLINK:
+		err = smb_posix_unlink(work);
+		break;
+	case SMB_SET_FILE_UNIX_HLINK:
+		err = smb_creat_hardlink(work);
+		break;
+	case SMB_SET_FILE_UNIX_LINK:
+		err = smb_creat_symlink(work);
+		break;
+	case SMB_SET_FILE_BASIC_INFO:
+		/* fall through */
+	case SMB_SET_FILE_BASIC_INFO2:
+		err = smb_set_time_pathinfo(work);
+		break;
+	case SMB_SET_FILE_UNIX_BASIC:
+		err = smb_set_unix_pathinfo(work);
+		break;
+	case SMB_SET_FILE_EA:
+		err = smb_set_ea(work);
+		break;
+	case SMB_SET_POSIX_ACL:
+		err = smb_set_acl(work);
+		break;
+	case SMB_SET_FILE_END_OF_FILE_INFO2:
+		/* fall through */
+	case SMB_SET_FILE_END_OF_FILE_INFO:
+		err = smb_set_file_size_pinfo(work);
+		break;
+	default:
+		ksmbd_debug(SMB, "info level = %x not implemented yet\n",
+				info_level);
+		pSMB_rsp->hdr.Status.CifsError = STATUS_NOT_IMPLEMENTED;
+		return -EOPNOTSUPP;
+	}
+
+	if (err < 0)
+		ksmbd_debug(SMB, "info_level 0x%x failed, err %d\n",
+				info_level, err);
+	return err;
+}
+static int readdir_info_level_struct_sz(int info_level)
+{
+	switch (info_level) {
+	case SMB_FIND_FILE_INFO_STANDARD:
+		return sizeof(struct find_info_standard);
+	case SMB_FIND_FILE_QUERY_EA_SIZE:
+		return sizeof(struct find_info_query_ea_size);
+	case SMB_FIND_FILE_DIRECTORY_INFO:
+		return sizeof(struct file_directory_info);
+	case SMB_FIND_FILE_FULL_DIRECTORY_INFO:
+		return sizeof(struct file_full_directory_info);
+	case SMB_FIND_FILE_NAMES_INFO:
+		return sizeof(struct file_names_info);
+	case SMB_FIND_FILE_BOTH_DIRECTORY_INFO:
+		return sizeof(struct file_both_directory_info);
+	case SMB_FIND_FILE_ID_FULL_DIR_INFO:
+		return sizeof(struct file_id_full_dir_info);
+	case SMB_FIND_FILE_ID_BOTH_DIR_INFO:
+		return sizeof(struct file_id_both_directory_info);
+	case SMB_FIND_FILE_UNIX:
+		return sizeof(struct file_unix_info);
+	default:
+		return -EOPNOTSUPP;
+	}
+}
+
+/**
+ * smb_populate_readdir_entry() - encode directory entry in smb response buffer
+ * @conn:	connection instance
+ * @info_level:	smb information level
+ * @d_info: structure included variables for query dir
+ * @ksmbd_kstat: ksmbd wrapper of dirent stat information
+ *
+ * if directory has many entries, find first can't read it fully.
+ * find next might be called multiple times to read remaining dir entries
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_populate_readdir_entry(struct ksmbd_conn *conn, int info_level,
+		struct ksmbd_dir_info *d_info, struct ksmbd_kstat *ksmbd_kstat)
+{
+	int next_entry_offset;
+	char *conv_name;
+	int conv_len;
+	int struct_sz;
+
+	struct_sz = readdir_info_level_struct_sz(info_level);
+	if (struct_sz == -EOPNOTSUPP)
+		return -EOPNOTSUPP;
+
+	conv_name = ksmbd_convert_dir_info_name(d_info,
+						conn->local_nls,
+						&conv_len);
+	if (!conv_name)
+		return -ENOMEM;
+
+	next_entry_offset = ALIGN(struct_sz - 1 + conv_len,
+				  KSMBD_DIR_INFO_ALIGNMENT);
+
+	if (next_entry_offset > d_info->out_buf_len) {
+		kfree(conv_name);
+		d_info->out_buf_len = 0;
+		return -ENOSPC;
+	}
+
+	switch (info_level) {
+	case SMB_FIND_FILE_INFO_STANDARD:
+	{
+		struct find_info_standard *fsinfo;
+
+		fsinfo = (struct find_info_standard *)(d_info->wptr);
+		unix_to_dos_time(
+			ksmbd_NTtimeToUnix(
+				cpu_to_le64(ksmbd_kstat->create_time)),
+			&fsinfo->CreationTime,
+			&fsinfo->CreationDate);
+		unix_to_dos_time(ksmbd_kstat->kstat->atime,
+			&fsinfo->LastAccessTime,
+			&fsinfo->LastAccessDate);
+		unix_to_dos_time(ksmbd_kstat->kstat->mtime,
+			&fsinfo->LastWriteTime,
+			&fsinfo->LastWriteDate);
+		fsinfo->DataSize = cpu_to_le32(ksmbd_kstat->kstat->size);
+		fsinfo->AllocationSize =
+			cpu_to_le32(ksmbd_kstat->kstat->blocks << 9);
+		fsinfo->Attributes =
+			cpu_to_le16(S_ISDIR(ksmbd_kstat->kstat->mode) ?
+				ATTR_DIRECTORY : ATTR_ARCHIVE);
+		fsinfo->FileNameLength = cpu_to_le16(conv_len);
+		memcpy(fsinfo->FileName, conv_name, conv_len);
+
+		break;
+	}
+	case SMB_FIND_FILE_QUERY_EA_SIZE:
+	{
+		struct find_info_query_ea_size *fesize;
+
+		fesize = (struct find_info_query_ea_size *)(d_info->wptr);
+		unix_to_dos_time(
+			ksmbd_NTtimeToUnix(
+				cpu_to_le64(ksmbd_kstat->create_time)),
+			&fesize->CreationTime,
+			&fesize->CreationDate);
+		unix_to_dos_time(ksmbd_kstat->kstat->atime,
+			&fesize->LastAccessTime,
+			&fesize->LastAccessDate);
+		unix_to_dos_time(ksmbd_kstat->kstat->mtime,
+			&fesize->LastWriteTime,
+			&fesize->LastWriteDate);
+
+		fesize->DataSize =
+			cpu_to_le32(ksmbd_kstat->kstat->size);
+		fesize->AllocationSize =
+			cpu_to_le32(ksmbd_kstat->kstat->blocks << 9);
+		fesize->Attributes =
+			cpu_to_le16(S_ISDIR(ksmbd_kstat->kstat->mode) ?
+				ATTR_DIRECTORY : ATTR_ARCHIVE);
+		fesize->EASize = 0;
+		fesize->FileNameLength = (__u8)(conv_len);
+		memcpy(fesize->FileName, conv_name, conv_len);
+
+		break;
+	}
+	case SMB_FIND_FILE_DIRECTORY_INFO:
+	{
+		struct file_directory_info *fdinfo = NULL;
+
+		fdinfo = (struct file_directory_info *)
+			ksmbd_vfs_init_kstat(&d_info->wptr, ksmbd_kstat);
+		fdinfo->FileNameLength = cpu_to_le32(conv_len);
+		memcpy(fdinfo->FileName, conv_name, conv_len);
+		fdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		memset((char *)fdinfo + struct_sz - 1 + conv_len,
+			'\0',
+			next_entry_offset - struct_sz - 1 + conv_len);
+		break;
+	}
+	case SMB_FIND_FILE_FULL_DIRECTORY_INFO:
+	{
+		struct file_full_directory_info *ffdinfo = NULL;
+
+		ffdinfo = (struct file_full_directory_info *)
+			ksmbd_vfs_init_kstat(&d_info->wptr, ksmbd_kstat);
+		ffdinfo->FileNameLength = cpu_to_le32(conv_len);
+		ffdinfo->EaSize = 0;
+		memcpy(ffdinfo->FileName, conv_name, conv_len);
+		ffdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		memset((char *)ffdinfo + struct_sz - 1 + conv_len,
+			'\0',
+			next_entry_offset - struct_sz - 1 + conv_len);
+		break;
+	}
+	case SMB_FIND_FILE_NAMES_INFO:
+	{
+		struct file_names_info *fninfo = NULL;
+
+		fninfo = (struct file_names_info *)(d_info->wptr);
+		fninfo->FileNameLength = cpu_to_le32(conv_len);
+		memcpy(fninfo->FileName, conv_name, conv_len);
+		fninfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		memset((char *)fninfo + struct_sz - 1 + conv_len,
+			'\0',
+			next_entry_offset - struct_sz - 1 + conv_len);
+
+		break;
+	}
+	case SMB_FIND_FILE_BOTH_DIRECTORY_INFO:
+	{
+		struct file_both_directory_info *fbdinfo = NULL;
+
+		fbdinfo = (struct file_both_directory_info *)
+			ksmbd_vfs_init_kstat(&d_info->wptr, ksmbd_kstat);
+		fbdinfo->FileNameLength = cpu_to_le32(conv_len);
+		fbdinfo->EaSize = 0;
+		fbdinfo->ShortNameLength = 0;
+		fbdinfo->Reserved = 0;
+		memcpy(fbdinfo->FileName, conv_name, conv_len);
+		fbdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		memset((char *)fbdinfo + struct_sz - 1 + conv_len,
+			'\0',
+			next_entry_offset - struct_sz - 1 + conv_len);
+		break;
+	}
+	case SMB_FIND_FILE_ID_FULL_DIR_INFO:
+	{
+		struct file_id_full_dir_info *dinfo = NULL;
+
+		dinfo = (struct file_id_full_dir_info *)
+			ksmbd_vfs_init_kstat(&d_info->wptr, ksmbd_kstat);
+		dinfo->FileNameLength = cpu_to_le32(conv_len);
+		dinfo->EaSize = 0;
+		dinfo->Reserved = 0;
+		dinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino);
+		memcpy(dinfo->FileName, conv_name, conv_len);
+		dinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		memset((char *)dinfo + struct_sz - 1 + conv_len,
+			'\0',
+			next_entry_offset - struct_sz - 1 + conv_len);
+		break;
+	}
+	case SMB_FIND_FILE_ID_BOTH_DIR_INFO:
+	{
+		struct file_id_both_directory_info *fibdinfo = NULL;
+
+		fibdinfo = (struct file_id_both_directory_info *)
+			ksmbd_vfs_init_kstat(&d_info->wptr, ksmbd_kstat);
+		fibdinfo->FileNameLength = cpu_to_le32(conv_len);
+		fibdinfo->EaSize = 0;
+		fibdinfo->ShortNameLength = 0;
+		fibdinfo->Reserved = 0;
+		fibdinfo->Reserved2 = 0;
+		fibdinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino);
+		memcpy(fibdinfo->FileName, conv_name, conv_len);
+		fibdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		memset((char *)fibdinfo + struct_sz - 1 + conv_len,
+			'\0',
+			next_entry_offset - struct_sz - 1 + conv_len);
+
+		break;
+	}
+	case SMB_FIND_FILE_UNIX:
+	{
+		struct file_unix_info *finfo = NULL;
+		struct file_unix_basic_info *unix_info;
+
+		finfo = (struct file_unix_info *)(d_info->wptr);
+		finfo->ResumeKey = 0;
+		unix_info = (struct file_unix_basic_info *)((char *)finfo + 8);
+		init_unix_info(unix_info, ksmbd_kstat->kstat);
+		/* include null terminator */
+		memcpy(finfo->FileName, conv_name, conv_len + 2);
+		next_entry_offset += 2;
+		finfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		memset((char *)finfo + struct_sz - 1 + conv_len,
+			'\0',
+			next_entry_offset - struct_sz - 1 + conv_len);
+		break;
+	}
+	}
+
+	d_info->num_entry++;
+	d_info->last_entry_offset = d_info->data_count;
+	d_info->data_count += next_entry_offset;
+	d_info->out_buf_len -= next_entry_offset;
+	d_info->wptr = (char *)(d_info->wptr) + next_entry_offset;
+	kfree(conv_name);
+
+	ksmbd_debug(SMB, "info_level : %d, buf_len :%d, next_offset : %d, data_count : %d\n",
+			info_level, d_info->out_buf_len,
+			next_entry_offset, d_info->data_count);
+	return 0;
+}
+
+/**
+ * ksmbd_fill_dirent() - populates a dirent details in readdir
+ * @ctx:	dir_context information
+ * @name:	dirent name
+ * @namelen:	dirent name length
+ * @offset:	dirent offset in directory
+ * @ino:	dirent inode number
+ * @d_type:	dirent type
+ *
+ * Return:	0 on success, otherwise -EINVAL
+ */
+static int ksmbd_fill_dirent(struct dir_context *ctx, const char *name, int namlen,
+		loff_t offset, u64 ino, unsigned int d_type)
+{
+	struct ksmbd_readdir_data *buf =
+		container_of(ctx, struct ksmbd_readdir_data, ctx);
+	struct ksmbd_dirent *de = (void *)(buf->dirent + buf->used);
+	unsigned int reclen;
+
+	reclen = ALIGN(sizeof(struct ksmbd_dirent) + namlen, sizeof(u64));
+	if (buf->used + reclen > PAGE_SIZE)
+		return -EINVAL;
+
+	de->namelen = namlen;
+	de->offset = offset;
+	de->ino = ino;
+	de->d_type = d_type;
+	memcpy(de->name, name, namlen);
+	buf->used += reclen;
+
+	return 0;
+}
+
+/**
+ * find_first() - smb readdir command
+ * @work:	smb work containing find first request params
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int find_first(struct ksmbd_work *work)
+{
+	struct smb_hdr *rsp_hdr = work->response_buf;
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct smb_com_trans2_req *req = work->request_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct smb_com_trans2_ffirst_req_params *req_params;
+	struct smb_com_trans2_ffirst_rsp_parms *params = NULL;
+	struct path path;
+	struct ksmbd_dirent *de;
+	struct ksmbd_file *dir_fp = NULL;
+	struct kstat kstat;
+	struct ksmbd_kstat ksmbd_kstat;
+	struct ksmbd_dir_info d_info;
+	int params_count = sizeof(struct smb_com_trans2_ffirst_rsp_parms);
+	int data_alignment_offset = 0;
+	int rc = 0, reclen = 0;
+	int srch_cnt = 0;
+	char *dirpath = NULL;
+	char *srch_ptr = NULL;
+	int header_size;
+	unsigned int flags = LOOKUP_FOLLOW;
+
+	memset(&d_info, 0, sizeof(struct ksmbd_dir_info));
+
+	if (ksmbd_override_fsids(work)) {
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		return -ENOMEM;
+	}
+
+	req_params = (struct smb_com_trans2_ffirst_req_params *)
+		(work->request_buf + le16_to_cpu(req->ParameterOffset) + 4);
+	dirpath = smb_get_dir_name(share, req_params->FileName, PATH_MAX,
+			work, &srch_ptr);
+	if (IS_ERR(dirpath)) {
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		rc = PTR_ERR(dirpath);
+		goto err_out;
+	}
+
+	if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS))
+		flags = 0;
+
+	ksmbd_debug(SMB, "complete dir path = %s\n",  dirpath);
+	rc = ksmbd_vfs_kern_path(dirpath, flags | LOOKUP_DIRECTORY,
+			&path, 0);
+	if (rc < 0) {
+		if (rc == -EACCES)
+			rsp_hdr->Status.CifsError = STATUS_ACCESS_DENIED;
+		else
+			rsp_hdr->Status.CifsError =
+				STATUS_OBJECT_NAME_NOT_FOUND;
+		ksmbd_debug(SMB, "cannot create vfs root path <%s> %d\n",
+				dirpath, rc);
+		goto err_out;
+	} else {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		if (inode_permission(&init_user_ns, d_inode(path.dentry),
+					MAY_READ | MAY_EXEC)) {
+#else
+		if (inode_permission(d_inode(path.dentry),
+					MAY_READ | MAY_EXEC)) {
+#endif
+			rc = -EACCES;
+			rsp_hdr->Status.CifsError = STATUS_ACCESS_DENIED;
+			goto err_out;
+		}
+	}
+
+	if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS)) {
+		if (d_is_symlink(path.dentry)) {
+			rsp_hdr->Status.CifsError = STATUS_ACCESS_DENIED;
+			goto err_out;
+		}
+	}
+
+	dir_fp = ksmbd_vfs_dentry_open(work, &path, O_RDONLY, 0, 1);
+	if (!dir_fp) {
+		ksmbd_debug(SMB, "dir dentry open failed with rc=%d\n", rc);
+		path_put(&path);
+		rc = -EINVAL;
+		goto err_out;
+	}
+
+	write_lock(&dir_fp->f_ci->m_lock);
+	list_add(&dir_fp->node, &dir_fp->f_ci->m_fp_list);
+	write_unlock(&dir_fp->f_ci->m_lock);
+
+	set_ctx_actor(&dir_fp->readdir_data.ctx, ksmbd_fill_dirent);
+	dir_fp->readdir_data.dirent = (void *)__get_free_page(GFP_KERNEL);
+	if (!dir_fp->readdir_data.dirent) {
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		goto err_out;
+	}
+
+	dir_fp->filename = dirpath;
+	dir_fp->readdir_data.used = 0;
+	dir_fp->dirent_offset = 0;
+	dir_fp->readdir_data.file_attr =
+		le16_to_cpu(req_params->SearchAttributes);
+
+	if (params_count % 4)
+		data_alignment_offset = 4 - params_count % 4;
+
+	d_info.smb1_name = kmalloc(NAME_MAX + 1, GFP_KERNEL);
+	if (!d_info.smb1_name)
+		goto err_out;
+	d_info.wptr = (char *)((char *)rsp + sizeof(struct smb_com_trans2_rsp) +
+			params_count + data_alignment_offset);
+
+	header_size = sizeof(struct smb_com_trans2_rsp) + params_count +
+		data_alignment_offset;
+
+	/* When search count is zero, respond only 1 entry. */
+	srch_cnt = le16_to_cpu(req_params->SearchCount);
+	if (!srch_cnt)
+		d_info.out_buf_len = sizeof(struct file_unix_info) +
+			header_size;
+	else
+		d_info.out_buf_len = min((int)(srch_cnt *
+				sizeof(struct file_unix_info)) + header_size,
+				MAX_CIFS_LOOKUP_BUFFER_SIZE - header_size);
+
+	/* reserve dot and dotdot entries in head of buffer in first response */
+	if (!*srch_ptr || is_asterisk(srch_ptr)) {
+		rc = ksmbd_populate_dot_dotdot_entries(work,
+				le16_to_cpu(req_params->InformationLevel),
+				dir_fp,
+				&d_info,
+				srch_ptr,
+				smb_populate_readdir_entry);
+		if (rc)
+			goto err_out;
+	}
+
+	do {
+		if (dir_fp->dirent_offset >= dir_fp->readdir_data.used) {
+			dir_fp->dirent_offset = 0;
+			dir_fp->readdir_data.used = 0;
+			rc = ksmbd_vfs_readdir(dir_fp->filp,
+					       &dir_fp->readdir_data);
+			if (rc < 0) {
+				ksmbd_debug(SMB, "err : %d\n", rc);
+				goto err_out;
+			}
+
+			if (!dir_fp->readdir_data.used) {
+				free_page((unsigned long)
+						(dir_fp->readdir_data.dirent));
+				dir_fp->readdir_data.dirent = NULL;
+				break;
+			}
+
+			de = (struct ksmbd_dirent *)
+				((char *)dir_fp->readdir_data.dirent);
+		} else {
+			de = (struct ksmbd_dirent *)
+				((char *)dir_fp->readdir_data.dirent +
+				 dir_fp->dirent_offset);
+		}
+
+		reclen = ALIGN(sizeof(struct ksmbd_dirent) + de->namelen,
+				sizeof(__le64));
+		dir_fp->dirent_offset += reclen;
+
+		if (dir_fp->readdir_data.file_attr &
+			SMB_SEARCH_ATTRIBUTE_DIRECTORY && de->d_type != DT_DIR)
+			continue;
+
+		ksmbd_kstat.kstat = &kstat;
+
+		if (de->namelen > NAME_MAX) {
+			ksmbd_err("filename length exceeds 255 bytes.\n");
+			continue;
+		}
+		memcpy(d_info.smb1_name, de->name, de->namelen);
+		d_info.smb1_name[de->namelen] = '\0';
+		d_info.name = (const char *)d_info.smb1_name;
+		d_info.name_len = de->namelen;
+		rc = ksmbd_vfs_readdir_name(work,
+					    &ksmbd_kstat,
+					    de->name,
+					    de->namelen,
+					    dirpath);
+		if (rc) {
+			ksmbd_debug(SMB, "Cannot read dirent: %d\n", rc);
+			continue;
+		}
+
+		if (!strncmp(de->name, ".", de->namelen) ||
+			!strncmp(de->name, "..", de->namelen))
+			continue;
+
+		if (ksmbd_share_veto_filename(share, d_info.name)) {
+			ksmbd_debug(SMB, "Veto filename %s\n", d_info.name);
+			continue;
+		}
+
+		if (match_pattern(d_info.name, d_info.name_len, srch_ptr)) {
+			rc = smb_populate_readdir_entry(conn,
+				le16_to_cpu(req_params->InformationLevel),
+				&d_info,
+				&ksmbd_kstat);
+			if (rc)
+				goto err_out;
+		}
+	} while (d_info.out_buf_len >= 0);
+
+	if (!d_info.data_count && *srch_ptr) {
+		ksmbd_debug(SMB, "There is no entry matched with the search pattern\n");
+		rsp->hdr.Status.CifsError = STATUS_NO_SUCH_FILE;
+		rc = -EINVAL;
+		goto err_out;
+	}
+
+	if (d_info.out_buf_len < 0)
+		dir_fp->dirent_offset -= reclen;
+
+	params = (struct smb_com_trans2_ffirst_rsp_parms *)((char *)rsp +
+			sizeof(struct smb_com_trans2_rsp));
+	params->SearchHandle = dir_fp->volatile_id;
+	params->SearchCount = cpu_to_le16(d_info.num_entry);
+	params->LastNameOffset = cpu_to_le16(d_info.last_entry_offset);
+
+	if (d_info.out_buf_len < 0) {
+		ksmbd_debug(SMB, "continue search\n");
+		params->EndofSearch = cpu_to_le16(0);
+	} else {
+		ksmbd_debug(SMB, "end of search\n");
+		params->EndofSearch = cpu_to_le16(1);
+		path_put(&(dir_fp->filp->f_path));
+		if (le16_to_cpu(req_params->SearchFlags) &
+				CIFS_SEARCH_CLOSE_AT_END)
+			ksmbd_close_fd(work, dir_fp->volatile_id);
+	}
+	params->EAErrorOffset = cpu_to_le16(0);
+
+	rsp_hdr->WordCount = 0x0A;
+	rsp->t2.TotalParameterCount = cpu_to_le16(params_count);
+	rsp->t2.TotalDataCount = cpu_to_le16(d_info.data_count);
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = cpu_to_le16(params_count);
+	rsp->t2.ParameterOffset =
+		cpu_to_le16(sizeof(struct smb_com_trans2_rsp) - 4);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = cpu_to_le16(d_info.data_count);
+	rsp->t2.DataOffset = cpu_to_le16(sizeof(struct smb_com_trans2_rsp) +
+		params_count + data_alignment_offset - 4);
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+	rsp->Pad = 0;
+	rsp->ByteCount = cpu_to_le16(d_info.data_count +
+		params_count + 1 /*pad*/ + data_alignment_offset);
+	memset((char *)rsp + sizeof(struct smb_com_trans2_rsp) + params_count,
+			'\0', 2);
+	inc_rfc1001_len(rsp_hdr, (10 * 2 + d_info.data_count +
+				params_count + 1 + data_alignment_offset));
+	kfree(srch_ptr);
+	kfree(d_info.smb1_name);
+	ksmbd_revert_fsids(work);
+	return 0;
+
+err_out:
+	if (dir_fp) {
+		if (dir_fp->readdir_data.dirent)  {
+			free_page((unsigned long)(dir_fp->readdir_data.dirent));
+			dir_fp->readdir_data.dirent = NULL;
+		}
+		path_put(&(dir_fp->filp->f_path));
+		ksmbd_close_fd(work, dir_fp->volatile_id);
+	}
+
+	if (rsp->hdr.Status.CifsError == 0)
+		rsp->hdr.Status.CifsError = STATUS_UNEXPECTED_IO_ERROR;
+
+	kfree(srch_ptr);
+	kfree(d_info.smb1_name);
+	ksmbd_revert_fsids(work);
+	return 0;
+}
+
+/**
+ * find_next() - smb next readdir command
+ * @work:	smb work containing find next request params
+ *
+ * if directory has many entries, find first can't read it fully.
+ * find next might be called multiple times to read remaining dir entries
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int find_next(struct ksmbd_work *work)
+{
+	struct smb_hdr *rsp_hdr = work->response_buf;
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct smb_com_trans2_req *req = work->request_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct smb_com_trans2_fnext_req_params *req_params;
+	struct smb_com_trans2_fnext_rsp_params *params = NULL;
+	struct ksmbd_dirent *de;
+	struct ksmbd_file *dir_fp;
+	struct kstat kstat;
+	struct ksmbd_kstat ksmbd_kstat;
+	struct ksmbd_dir_info d_info;
+	int params_count = sizeof(struct smb_com_trans2_fnext_rsp_params);
+	int data_alignment_offset = 0;
+	int rc = 0, reclen = 0;
+	__u16 sid;
+	char *dirpath = NULL;
+	char *name = NULL;
+	char *pathname = NULL;
+	int header_size;
+
+	memset(&d_info, 0, sizeof(struct ksmbd_dir_info));
+
+	req_params = (struct smb_com_trans2_fnext_req_params *)
+		(work->request_buf + le16_to_cpu(req->ParameterOffset) + 4);
+	sid = req_params->SearchHandle;
+
+	/*Currently no usage of ResumeFilename*/
+	name = req_params->ResumeFileName;
+	name = smb_strndup_from_utf16(name, NAME_MAX, 1, conn->local_nls);
+	if (IS_ERR(name)) {
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		return PTR_ERR(name);
+	}
+	ksmbd_debug(SMB, "FileName after unicode conversion %s\n", name);
+	kfree(name);
+
+	dir_fp = ksmbd_lookup_fd_fast(work, sid);
+	if (!dir_fp) {
+		ksmbd_debug(SMB, "error invalid sid\n");
+		rc = -EINVAL;
+		goto err_out;
+	}
+
+	set_ctx_actor(&dir_fp->readdir_data.ctx, ksmbd_fill_dirent);
+	pathname = kmalloc(PATH_MAX, GFP_KERNEL);
+	if (!pathname) {
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		rc = -ENOMEM;
+		goto err_out;
+	}
+
+	dirpath = d_path(&(dir_fp->filp->f_path), pathname, PATH_MAX);
+	if (IS_ERR(dirpath)) {
+		rc = PTR_ERR(dirpath);
+		goto err_out;
+	}
+
+	ksmbd_debug(SMB, "dirpath = %s\n", dirpath);
+
+	if (params_count % 4)
+		data_alignment_offset = 4 - params_count % 4;
+
+	d_info.smb1_name = kmalloc(NAME_MAX + 1, GFP_KERNEL);
+	if (!d_info.smb1_name)
+		goto err_out;
+	d_info.wptr = (char *)((char *)rsp + sizeof(struct smb_com_trans2_rsp) +
+			params_count + data_alignment_offset);
+
+	header_size = sizeof(struct smb_com_trans2_rsp) + params_count +
+		data_alignment_offset;
+
+	d_info.out_buf_len = min((int)(le16_to_cpu(req_params->SearchCount) *
+				       sizeof(struct file_unix_info)) +
+				       header_size,
+				 MAX_CIFS_LOOKUP_BUFFER_SIZE - header_size);
+	do {
+		if (dir_fp->dirent_offset >= dir_fp->readdir_data.used) {
+			dir_fp->dirent_offset = 0;
+			dir_fp->readdir_data.used = 0;
+			rc = ksmbd_vfs_readdir(dir_fp->filp,
+					       &dir_fp->readdir_data);
+			if (rc < 0) {
+				ksmbd_debug(SMB, "err : %d\n", rc);
+				goto err_out;
+			}
+
+			if (!dir_fp->readdir_data.used) {
+				free_page((unsigned long)
+						(dir_fp->readdir_data.dirent));
+				dir_fp->readdir_data.dirent = NULL;
+				break;
+			}
+
+			de = (struct ksmbd_dirent *)
+				((char *)dir_fp->readdir_data.dirent);
+		} else {
+			de = (struct ksmbd_dirent *)
+				((char *)dir_fp->readdir_data.dirent +
+				 dir_fp->dirent_offset);
+		}
+
+		reclen = ALIGN(sizeof(struct ksmbd_dirent) + de->namelen,
+				sizeof(__le64));
+		dir_fp->dirent_offset += reclen;
+
+		if (dir_fp->readdir_data.file_attr &
+			SMB_SEARCH_ATTRIBUTE_DIRECTORY && de->d_type != DT_DIR)
+			continue;
+
+		if (dir_fp->readdir_data.file_attr &
+			SMB_SEARCH_ATTRIBUTE_ARCHIVE && (de->d_type == DT_DIR ||
+			(!strcmp(de->name, ".") || !strcmp(de->name, ".."))))
+			continue;
+
+		ksmbd_kstat.kstat = &kstat;
+
+		if (de->namelen > NAME_MAX) {
+			ksmbd_err("filename length exceeds 255 bytes.\n");
+			continue;
+		}
+		memcpy(d_info.smb1_name, de->name, de->namelen);
+		d_info.smb1_name[de->namelen] = '\0';
+		d_info.name = (const char *)d_info.smb1_name;
+		d_info.name_len = de->namelen;
+		rc = ksmbd_vfs_readdir_name(work,
+					    &ksmbd_kstat,
+					    de->name,
+					    de->namelen,
+					    dirpath);
+		if (rc) {
+			ksmbd_debug(SMB, "Err while dirent read rc = %d\n", rc);
+			rc = 0;
+			continue;
+		}
+
+		if (ksmbd_share_veto_filename(share, d_info.name)) {
+			ksmbd_debug(SMB, "file(%s) is invisible by setting as veto file\n",
+				d_info.name);
+			continue;
+		}
+
+		ksmbd_debug(SMB, "filename string = %.*s\n",
+				d_info.name_len, d_info.name);
+		rc = smb_populate_readdir_entry(conn,
+			le16_to_cpu(req_params->InformationLevel), &d_info,
+			&ksmbd_kstat);
+		if (rc)
+			goto err_out;
+
+	} while (d_info.out_buf_len >= 0);
+
+	if (d_info.out_buf_len < 0)
+		dir_fp->dirent_offset -= reclen;
+
+	params = (struct smb_com_trans2_fnext_rsp_params *)
+		((char *)rsp + sizeof(struct smb_com_trans_rsp));
+	params->SearchCount = cpu_to_le16(d_info.num_entry);
+
+	if (d_info.out_buf_len < 0) {
+		ksmbd_debug(SMB, "continue search\n");
+		params->EndofSearch = cpu_to_le16(0);
+		params->LastNameOffset = cpu_to_le16(d_info.last_entry_offset);
+	} else {
+		ksmbd_debug(SMB, "end of search\n");
+		params->EndofSearch = cpu_to_le16(1);
+		params->LastNameOffset = cpu_to_le16(0);
+		path_put(&(dir_fp->filp->f_path));
+		if (le16_to_cpu(req_params->SearchFlags) &
+				CIFS_SEARCH_CLOSE_AT_END)
+			ksmbd_close_fd(work, sid);
+	}
+	params->EAErrorOffset = cpu_to_le16(0);
+
+	rsp_hdr->WordCount = 0x0A;
+	rsp->t2.TotalParameterCount = cpu_to_le16(params_count);
+	rsp->t2.TotalDataCount = cpu_to_le16(d_info.data_count);
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = cpu_to_le16(params_count);
+	rsp->t2.ParameterOffset =
+		cpu_to_le16(sizeof(struct smb_com_trans_rsp) - 4);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = cpu_to_le16(d_info.data_count);
+	rsp->t2.DataOffset = cpu_to_le16(sizeof(struct smb_com_trans_rsp) +
+		params_count + data_alignment_offset - 4);
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+	rsp->Pad = 0;
+	rsp->ByteCount = cpu_to_le16(d_info.data_count + params_count + 1 +
+		data_alignment_offset);
+	memset((char *)rsp + sizeof(struct smb_com_trans_rsp) +
+		params_count, '\0', data_alignment_offset);
+	inc_rfc1001_len(rsp_hdr, (10 * 2 + d_info.data_count +
+		params_count + 1 + data_alignment_offset));
+	kfree(pathname);
+	kfree(d_info.smb1_name);
+	ksmbd_fd_put(work, dir_fp);
+	return 0;
+
+err_out:
+	if (dir_fp) {
+		if (dir_fp->readdir_data.dirent)  {
+			free_page((unsigned long)(dir_fp->readdir_data.dirent));
+			dir_fp->readdir_data.dirent = NULL;
+		}
+		path_put(&(dir_fp->filp->f_path));
+		ksmbd_close_fd(work, sid);
+	}
+
+	if (rsp->hdr.Status.CifsError == 0)
+		rsp->hdr.Status.CifsError =
+			STATUS_UNEXPECTED_IO_ERROR;
+
+	kfree(d_info.smb1_name);
+	kfree(pathname);
+	return 0;
+}
+
+/**
+ * smb_set_alloc_size() - set file truncate method using trans2
+ *		set file info command - file allocation info level
+ * @work:	smb work containing set file info command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_set_alloc_size(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_sfi_req *req;
+	struct smb_com_trans2_sfi_rsp *rsp;
+	struct file_allocation_info *allocinfo;
+	struct kstat stat;
+	struct ksmbd_file *fp = NULL;
+	loff_t newsize;
+	int err = 0;
+
+	req = (struct smb_com_trans2_sfi_req *)work->request_buf;
+	rsp = (struct smb_com_trans2_sfi_rsp *)work->response_buf;
+
+	allocinfo =  (struct file_allocation_info *)
+		(((char *) &req->hdr.Protocol) + le16_to_cpu(req->DataOffset));
+	newsize = le64_to_cpu(allocinfo->AllocationSize);
+
+	fp = ksmbd_lookup_fd_fast(work, req->Fid);
+	if (!fp) {
+		ksmbd_err("failed to get filp for fid %u\n", req->Fid);
+		rsp->hdr.Status.CifsError = STATUS_FILE_CLOSED;
+		return -ENOENT;
+	}
+
+	err = ksmbd_vfs_getattr(&fp->filp->f_path, &stat);
+	if (err) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		return err;
+	}
+
+	if (newsize == stat.size) /* nothing to do */
+		goto out;
+
+	/* Round up size */
+	if (alloc_roundup_size) {
+		newsize = div64_u64(newsize + alloc_roundup_size - 1,
+				alloc_roundup_size);
+		newsize *= alloc_roundup_size;
+	}
+
+	err = ksmbd_vfs_truncate(work, NULL, fp, newsize);
+	if (err) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		ksmbd_fd_put(work, fp);
+		return err;
+	}
+
+out:
+	ksmbd_debug(SMB, "fid %u, truncated to newsize %llu\n",
+			req->Fid, newsize);
+
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = 0;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = 0;
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+
+	/* 3 pad (1 pad1 + 2 pad2)*/
+	rsp->ByteCount = cpu_to_le16(3);
+	rsp->Reserved2 = 0;
+	inc_rfc1001_len(&rsp->hdr, rsp->hdr.WordCount * 2 + 3);
+	ksmbd_fd_put(work, fp);
+
+	return 0;
+}
+
+/**
+ * smb_set_file_size_finfo() - set file truncate method using trans2
+ *		set file info command
+ * @work:	smb work containing set file info command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_set_file_size_finfo(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_sfi_req *req;
+	struct smb_com_trans2_sfi_rsp *rsp;
+	struct file_end_of_file_info *eofinfo;
+	struct ksmbd_file *fp;
+	loff_t newsize;
+	int err = 0;
+
+	req = (struct smb_com_trans2_sfi_req *)work->request_buf;
+	rsp = (struct smb_com_trans2_sfi_rsp *)work->response_buf;
+
+	eofinfo =  (struct file_end_of_file_info *)
+		(((char *) &req->hdr.Protocol) + le16_to_cpu(req->DataOffset));
+
+	fp = ksmbd_lookup_fd_fast(work, req->Fid);
+	if (!fp) {
+		ksmbd_err("failed to get filp for fid %u\n", req->Fid);
+		rsp->hdr.Status.CifsError = STATUS_FILE_CLOSED;
+		return -ENOENT;
+	}
+
+	newsize = le64_to_cpu(eofinfo->FileSize);
+	err = ksmbd_vfs_truncate(work, NULL, fp, newsize);
+	if (err) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		ksmbd_fd_put(work, fp);
+		return err;
+	}
+
+	ksmbd_debug(SMB, "fid %u, truncated to newsize %lld\n", req->Fid,
+		newsize);
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = 0;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = 0;
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+
+	/* 3 pad (1 pad1 + 2 pad2)*/
+	rsp->ByteCount = cpu_to_le16(3);
+	rsp->Reserved2 = 0;
+	inc_rfc1001_len(&rsp->hdr, rsp->hdr.WordCount * 2 + 3);
+	ksmbd_fd_put(work, fp);
+
+	return 0;
+}
+
+/**
+ * query_file_info_pipe() - query file info of IPC pipe
+ *		using query file info command
+ * @work:	smb work containing query file info command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int query_file_info_pipe(struct ksmbd_work *work)
+{
+	struct smb_hdr *rsp_hdr = work->response_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct smb_com_trans2_req *req = work->request_buf;
+	struct smb_trans2_qfi_req_params *req_params;
+	struct file_standard_info *standard_info;
+	char *ptr;
+
+	req_params = (struct smb_trans2_qfi_req_params *)(work->request_buf +
+			le16_to_cpu(req->ParameterOffset) + 4);
+
+	if (le16_to_cpu(req_params->InformationLevel) !=
+	    SMB_QUERY_FILE_STANDARD_INFO) {
+		ksmbd_debug(SMB, "query file info for info %u not supported\n",
+				le16_to_cpu(req_params->InformationLevel));
+		rsp_hdr->Status.CifsError = STATUS_NOT_SUPPORTED;
+		return -EOPNOTSUPP;
+	}
+
+	ksmbd_debug(SMB, "SMB_QUERY_FILE_STANDARD_INFO\n");
+	rsp_hdr->WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = cpu_to_le16(sizeof(struct file_standard_info));
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = cpu_to_le16(2);
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = cpu_to_le16(sizeof(struct file_standard_info));
+	rsp->t2.DataOffset = cpu_to_le16(60);
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+	/*2 for parameter count & 3 pad (1pad1 + 2 pad2)*/
+	rsp->ByteCount = cpu_to_le16(2 + sizeof(struct file_standard_info) + 3);
+	rsp->Pad = 0;
+	/* lets set EA info */
+	ptr = (char *)&rsp->Pad + 1;
+	memset(ptr, 0, 4);
+	standard_info = (struct file_standard_info *)(ptr + 4);
+	standard_info->AllocationSize = cpu_to_le64(4096);
+	standard_info->EndOfFile = 0;
+	standard_info->NumberOfLinks = cpu_to_le32(1);
+	standard_info->DeletePending = 0;
+	standard_info->Directory = 0;
+	standard_info->DeletePending = 1;
+	inc_rfc1001_len(rsp_hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+
+	return 0;
+}
+
+/**
+ * query_file_info() - query file info of file/dir
+ *		using query file info command
+ * @work:	smb work containing query file info command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int query_file_info(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb_hdr *rsp_hdr = work->response_buf;
+	struct smb_com_trans2_req *req = work->request_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct smb_trans2_qfi_req_params *req_params;
+	struct ksmbd_file *fp;
+	struct kstat st;
+	char *ptr;
+	int rc = 0;
+	u64 time;
+
+	req_params = (struct smb_trans2_qfi_req_params *)(work->request_buf +
+			le16_to_cpu(req->ParameterOffset) + 4);
+
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_PIPE)) {
+		ksmbd_debug(SMB, "query file info for IPC srvsvc\n");
+		return query_file_info_pipe(work);
+	}
+
+	fp = ksmbd_lookup_fd_fast(work, req_params->Fid);
+	if (!fp) {
+		ksmbd_err("failed to get filp for fid %u\n", req_params->Fid);
+		rsp_hdr->Status.CifsError = STATUS_UNEXPECTED_IO_ERROR;
+		rc = -EIO;
+		goto err_out;
+	}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	generic_fillattr(&init_user_ns, FP_INODE(fp), &st);
+#else
+	generic_fillattr(FP_INODE(fp), &st);
+#endif
+
+	switch (le16_to_cpu(req_params->InformationLevel)) {
+
+	case SMB_QUERY_FILE_STANDARD_INFO:
+	{
+		struct file_standard_info *standard_info;
+		unsigned int delete_pending;
+
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_STANDARD_INFO\n");
+		delete_pending = ksmbd_inode_pending_delete(fp);
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		rsp->t2.TotalDataCount =
+			cpu_to_le16(sizeof(struct file_standard_info));
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount =
+			cpu_to_le16(sizeof(struct file_standard_info));
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		/*2 for parameter count & 3 pad (1pad1 + 2 pad2)*/
+		rsp->ByteCount =
+			cpu_to_le16(2 + sizeof(struct file_standard_info) + 3);
+		rsp->Pad = 0;
+		/* lets set EA info */
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		standard_info = (struct file_standard_info *)(ptr + 4);
+		standard_info->AllocationSize = cpu_to_le64(st.blocks << 9);
+		standard_info->EndOfFile = cpu_to_le64(st.size);
+		standard_info->NumberOfLinks = cpu_to_le32(get_nlink(&st) -
+			delete_pending);
+		standard_info->DeletePending = delete_pending;
+		standard_info->Directory = S_ISDIR(st.mode) ? 1 : 0;
+		inc_rfc1001_len(rsp_hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+		break;
+	}
+	case SMB_QUERY_FILE_BASIC_INFO:
+	{
+		struct file_basic_info *basic_info;
+
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_BASIC_INFO\n");
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		rsp->t2.TotalDataCount =
+			cpu_to_le16(sizeof(struct file_basic_info));
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount = cpu_to_le16(sizeof(struct file_basic_info));
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		/*2 for parameter count & 3 pad (1pad1 + 2 pad2)*/
+		rsp->ByteCount =
+			cpu_to_le16(2 + sizeof(struct file_basic_info) + 3);
+		rsp->Pad = 0;
+		/* lets set EA info */
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		basic_info = (struct file_basic_info *)(ptr + 4);
+		basic_info->CreationTime =
+			cpu_to_le64(fp->create_time);
+		time = ksmbd_UnixTimeToNT(st.atime);
+		basic_info->LastAccessTime = cpu_to_le64(time);
+		time = ksmbd_UnixTimeToNT(st.mtime);
+		basic_info->LastWriteTime = cpu_to_le64(time);
+		time = ksmbd_UnixTimeToNT(st.ctime);
+		basic_info->ChangeTime = cpu_to_le64(time);
+		basic_info->Attributes = S_ISDIR(st.mode) ?
+			ATTR_DIRECTORY_LE : ATTR_ARCHIVE_LE;
+		basic_info->Pad = 0;
+		inc_rfc1001_len(rsp_hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+		break;
+	}
+	case SMB_QUERY_FILE_EA_INFO:
+	{
+		struct file_ea_info *ea_info;
+
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_EA_INFO\n");
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		rsp->t2.TotalDataCount =
+			cpu_to_le16(sizeof(struct file_ea_info));
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount = cpu_to_le16(sizeof(struct file_ea_info));
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		/*2 for parameter count & 3 pad (1pad1 + 2 pad2)*/
+		rsp->ByteCount =
+			cpu_to_le16(2 + sizeof(struct file_ea_info) + 3);
+		rsp->Pad = 0;
+		/* lets set EA info */
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		ea_info = (struct file_ea_info *)(ptr + 4);
+		ea_info->EaSize = 0;
+		inc_rfc1001_len(rsp_hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+		break;
+	}
+	case SMB_QUERY_FILE_UNIX_BASIC:
+	{
+		struct file_unix_basic_info *uinfo;
+
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_UNIX_BASIC\n");
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		rsp->t2.TotalDataCount =
+			cpu_to_le16(sizeof(struct file_unix_basic_info));
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount =
+			cpu_to_le16(sizeof(struct file_unix_basic_info));
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		/*2 for parameter count & 3 pad (1pad1 + 2 pad2)*/
+		rsp->ByteCount =
+			cpu_to_le16(2 + sizeof(struct file_unix_basic_info)
+				+ 3);
+		rsp->Pad = 0;
+		/* lets set unix info info */
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		uinfo = (struct file_unix_basic_info *)(ptr + 4);
+		init_unix_info(uinfo, &st);
+		inc_rfc1001_len(rsp_hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+		break;
+	}
+	case SMB_QUERY_FILE_NAME_INFO:
+	{
+		struct file_name_info *name_info;
+		int uni_filename_len;
+		char *filename;
+
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_NAME_INFO\n");
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		name_info = (struct file_name_info *)(ptr + 4);
+
+		filename = convert_to_nt_pathname(fp->filename,
+			work->tcon->share_conf->path);
+		if (!filename) {
+			rc = -ENOMEM;
+			goto err_out;
+		}
+		uni_filename_len = smbConvertToUTF16(
+				(__le16 *)name_info->FileName,
+				filename, PATH_MAX,
+				conn->local_nls, 0);
+		kfree(filename);
+		uni_filename_len *= 2;
+		name_info->FileNameLength = cpu_to_le32(uni_filename_len);
+
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		rsp->t2.TotalDataCount = cpu_to_le16(uni_filename_len + 4);
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount = cpu_to_le16(uni_filename_len + 4);
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		/*2 for parameter count & 3 pad (1pad1 + 2 pad2)*/
+		rsp->ByteCount = cpu_to_le16(2 + uni_filename_len + 4 + 3);
+		rsp->Pad = 0;
+		inc_rfc1001_len(rsp_hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+		break;
+	}
+	case SMB_QUERY_FILE_ALL_INFO:
+	{
+		struct file_all_info *ainfo;
+		unsigned int delete_pending;
+
+		ksmbd_debug(SMB, "SMB_QUERY_FILE_UNIX_BASIC\n");
+		delete_pending = ksmbd_inode_pending_delete(fp);
+		rsp_hdr->WordCount = 10;
+		rsp->t2.TotalParameterCount = cpu_to_le16(2);
+		rsp->t2.TotalDataCount =
+			cpu_to_le16(sizeof(struct file_all_info));
+		rsp->t2.Reserved = 0;
+		rsp->t2.ParameterCount = cpu_to_le16(2);
+		rsp->t2.ParameterOffset = cpu_to_le16(56);
+		rsp->t2.ParameterDisplacement = 0;
+		rsp->t2.DataCount = cpu_to_le16(sizeof(struct file_all_info));
+		rsp->t2.DataOffset = cpu_to_le16(60);
+		rsp->t2.DataDisplacement = 0;
+		rsp->t2.SetupCount = 0;
+		rsp->t2.Reserved1 = 0;
+		/*2 for parameter count & 3 pad (1pad1 + 2 pad2)*/
+		rsp->ByteCount =
+			cpu_to_le16(2 + sizeof(struct file_all_info) + 3);
+		rsp->Pad = 0;
+		/* lets set all info info */
+		ptr = (char *)&rsp->Pad + 1;
+		memset(ptr, 0, 4);
+		ainfo = (struct file_all_info *)(ptr + 4);
+		ainfo->CreationTime = cpu_to_le64(fp->create_time);
+		time = ksmbd_UnixTimeToNT(st.atime);
+		ainfo->LastAccessTime = cpu_to_le64(time);
+		time = ksmbd_UnixTimeToNT(st.mtime);
+		ainfo->LastWriteTime = cpu_to_le64(time);
+		time = ksmbd_UnixTimeToNT(st.ctime);
+		ainfo->ChangeTime = cpu_to_le64(time);
+		ainfo->Attributes = cpu_to_le32(S_ISDIR(st.mode) ?
+				ATTR_DIRECTORY : ATTR_ARCHIVE);
+		ainfo->Pad1 = 0;
+		ainfo->AllocationSize = cpu_to_le64(st.blocks << 9);
+		ainfo->EndOfFile = cpu_to_le64(st.size);
+		ainfo->NumberOfLinks = cpu_to_le32(get_nlink(&st) -
+			delete_pending);
+		ainfo->DeletePending = delete_pending;
+		ainfo->Directory = S_ISDIR(st.mode) ? 1 : 0;
+		ainfo->Pad2 = 0;
+		ainfo->EASize = 0;
+		ainfo->FileNameLength = 0;
+		inc_rfc1001_len(rsp_hdr, 10 * 2 + le16_to_cpu(rsp->ByteCount));
+		break;
+	}
+	default:
+		ksmbd_err("query path info not implemnted for %x\n",
+				le16_to_cpu(req_params->InformationLevel));
+		rsp_hdr->Status.CifsError = STATUS_NOT_SUPPORTED;
+		rc = -EINVAL;
+		goto err_out;
+
+	}
+
+err_out:
+	ksmbd_fd_put(work, fp);
+	return rc;
+}
+
+/**
+ * smb_set_unix_fileinfo() - set smb unix file info(setattr)
+ * @work:	smb work containing unix basic info buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_set_unix_fileinfo(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_sfi_req *req = work->request_buf;
+	struct smb_com_trans2_sfi_rsp *rsp = work->response_buf;
+	struct file_unix_basic_info *unix_info;
+	struct iattr attrs;
+	int err = 0;
+
+	unix_info =  (struct file_unix_basic_info *)
+		(((char *) &req->hdr.Protocol) + le16_to_cpu(req->DataOffset));
+
+	attrs.ia_valid = 0;
+	attrs.ia_mode = 0;
+	err = unix_info_to_attr(unix_info, &attrs);
+	if (err)
+		goto out;
+
+	err = ksmbd_vfs_setattr(work, NULL, (u64)req->Fid, &attrs);
+	if (err)
+		goto out;
+
+	/* setattr success, prepare response */
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = 0;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = 0;
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+
+	/* 3 pad (1 pad1 + 2 pad2)*/
+	rsp->ByteCount = cpu_to_le16(3);
+	rsp->Reserved2 = 0;
+	inc_rfc1001_len(&rsp->hdr,
+			rsp->hdr.WordCount * 2 + le16_to_cpu(rsp->ByteCount));
+
+out:
+	if (err) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		return err;
+	}
+	return 0;
+}
+
+/**
+ * smb_set_dispostion() - set file dispostion method using trans2
+ *		using set file info command
+ * @work:	smb work containing set file info command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_set_dispostion(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_sfi_req *req = work->request_buf;
+	struct smb_com_trans2_sfi_rsp *rsp = work->response_buf;
+	char *disp_info;
+	struct ksmbd_file *fp;
+	int ret = 0;
+
+	disp_info =  (char *) (((char *) &req->hdr.Protocol)
+			+ le16_to_cpu(req->DataOffset));
+
+	fp = ksmbd_lookup_fd_fast(work, req->Fid);
+	if (!fp) {
+		ksmbd_debug(SMB, "Invalid id for close: %d\n", req->Fid);
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		return -EINVAL;
+	}
+
+	if (*disp_info) {
+		if (!fp->is_nt_open) {
+			rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+			ret = -EPERM;
+			goto err_out;
+		}
+
+		if (!(FP_INODE(fp)->i_mode & 0222)) {
+			rsp->hdr.Status.CifsError = STATUS_CANNOT_DELETE;
+			ret = -EPERM;
+			goto err_out;
+		}
+
+		if (S_ISDIR(FP_INODE(fp)->i_mode) &&
+				ksmbd_vfs_empty_dir(fp) == -ENOTEMPTY) {
+			rsp->hdr.Status.CifsError = STATUS_DIRECTORY_NOT_EMPTY;
+			ret = -ENOTEMPTY;
+			goto err_out;
+		}
+
+		ksmbd_set_inode_pending_delete(fp);
+	} else {
+		ksmbd_clear_inode_pending_delete(fp);
+	}
+
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = 0;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = 0;
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+
+	/* 3 pad (1 pad1 + 2 pad2)*/
+	rsp->ByteCount = cpu_to_le16(3);
+	rsp->Reserved2 = 0;
+	inc_rfc1001_len(&rsp->hdr,
+			rsp->hdr.WordCount * 2 + 3);
+
+err_out:
+	ksmbd_fd_put(work, fp);
+	return ret;
+}
+
+/**
+ * smb_set_time_fileinfo() - set file time method using trans2
+ *		using set file info command
+ * @work:	smb work containing set file info command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_set_time_fileinfo(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_sfi_req *req;
+	struct smb_com_trans2_sfi_rsp *rsp;
+	struct file_basic_info *info;
+	struct iattr attrs;
+	int err = 0;
+
+	req = (struct smb_com_trans2_sfi_req *)work->request_buf;
+	rsp = (struct smb_com_trans2_sfi_rsp *)work->response_buf;
+
+	info = (struct file_basic_info *)(((char *) &req->hdr.Protocol) +
+			le16_to_cpu(req->DataOffset));
+
+	attrs.ia_valid = 0;
+	if (le64_to_cpu(info->LastAccessTime)) {
+		attrs.ia_atime = smb_NTtimeToUnix(info->LastAccessTime);
+		attrs.ia_valid |= (ATTR_ATIME | ATTR_ATIME_SET);
+	}
+
+	if (le64_to_cpu(info->ChangeTime)) {
+		attrs.ia_ctime = smb_NTtimeToUnix(info->ChangeTime);
+		attrs.ia_valid |= ATTR_CTIME;
+	}
+
+	if (le64_to_cpu(info->LastWriteTime)) {
+		attrs.ia_mtime = smb_NTtimeToUnix(info->LastWriteTime);
+		attrs.ia_valid |= (ATTR_MTIME | ATTR_MTIME_SET);
+	}
+	/* TODO: check dos mode and acl bits if req->Attributes nonzero */
+
+	if (!attrs.ia_valid)
+		goto done;
+
+	err = ksmbd_vfs_setattr(work, NULL, (u64)req->Fid, &attrs);
+	if (err) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		return err;
+	}
+
+done:
+	ksmbd_debug(SMB, "fid %u, setattr done\n", req->Fid);
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = 0;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = 0;
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+
+	/* 3 pad (1 pad1 + 2 pad2)*/
+	rsp->ByteCount = cpu_to_le16(3);
+	rsp->Reserved2 = 0;
+	inc_rfc1001_len(&rsp->hdr,
+			rsp->hdr.WordCount * 2 + 3);
+
+	return 0;
+}
+
+/**
+ * smb_fileinfo_rename() - rename method using trans2 set file info command
+ * @work:	smb work containing set file info command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb_fileinfo_rename(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_sfi_req *req;
+	struct smb_com_trans2_sfi_rsp *rsp;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct set_file_rename *info;
+	struct ksmbd_file *fp;
+	char *newname;
+	int rc = 0;
+
+	req = (struct smb_com_trans2_sfi_req *)work->request_buf;
+	rsp = (struct smb_com_trans2_sfi_rsp *)work->response_buf;
+	info =  (struct set_file_rename *)
+		(((char *) &req->hdr.Protocol) + le16_to_cpu(req->DataOffset));
+
+	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+		ksmbd_debug(SMB,
+			"returning as user does not have permission to write\n");
+		rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		return -EACCES;
+	}
+
+	fp = ksmbd_lookup_fd_fast(work, req->Fid);
+	if (!fp) {
+		ksmbd_err("failed to get filp for fid %u\n", req->Fid);
+		rsp->hdr.Status.CifsError = STATUS_FILE_CLOSED;
+		return -ENOENT;
+	}
+
+	if (info->overwrite) {
+		rc = ksmbd_vfs_truncate(work, NULL, fp, 0);
+		if (rc) {
+			rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+			ksmbd_fd_put(work, fp);
+			return rc;
+		}
+	}
+
+	newname = smb_get_name(share, info->target_name, PATH_MAX, work, 0);
+	if (IS_ERR(newname)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		ksmbd_fd_put(work, fp);
+		return PTR_ERR(newname);
+	}
+
+	ksmbd_debug(SMB, "rename oldname(%s) -> newname(%s)\n", fp->filename,
+		newname);
+	rc = ksmbd_vfs_fp_rename(work, fp, newname);
+	if (rc) {
+		rsp->hdr.Status.CifsError = STATUS_UNEXPECTED_IO_ERROR;
+		goto out;
+	}
+
+	rsp->hdr.WordCount = 10;
+	rsp->t2.TotalParameterCount = cpu_to_le16(2);
+	rsp->t2.TotalDataCount = 0;
+	rsp->t2.Reserved = 0;
+	rsp->t2.ParameterCount = rsp->t2.TotalParameterCount;
+	rsp->t2.ParameterOffset = cpu_to_le16(56);
+	rsp->t2.ParameterDisplacement = 0;
+	rsp->t2.DataCount = rsp->t2.TotalDataCount;
+	rsp->t2.DataOffset = 0;
+	rsp->t2.DataDisplacement = 0;
+	rsp->t2.SetupCount = 0;
+	rsp->t2.Reserved1 = 0;
+
+	/* 3 pad (1 pad1 + 2 pad2)*/
+	rsp->ByteCount = cpu_to_le16(3);
+	rsp->Reserved2 = 0;
+	inc_rfc1001_len(&rsp->hdr, rsp->hdr.WordCount * 2 + 3);
+
+out:
+	ksmbd_fd_put(work, fp);
+	kfree(newname);
+	return rc;
+}
+
+/**
+ * set_file_info() - trans2 set file info command dispatcher
+ * @work:	smb work containing set file info command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int set_file_info(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_sfi_req *req;
+	struct smb_com_trans2_sfi_rsp *rsp;
+	__u16 info_level, total_param;
+	int err = 0;
+
+	req = (struct smb_com_trans2_sfi_req *)work->request_buf;
+	rsp = (struct smb_com_trans2_sfi_rsp *)work->response_buf;
+	info_level = le16_to_cpu(req->InformationLevel);
+	total_param = le16_to_cpu(req->TotalParameterCount);
+	if (total_param < 4) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		ksmbd_err("invalid total parameter for info_level 0x%x\n",
+				total_param);
+		return -EINVAL;
+	}
+
+	switch (info_level) {
+	case SMB_SET_FILE_EA:
+		err = smb_set_ea(work);
+		break;
+	case SMB_SET_FILE_ALLOCATION_INFO2:
+		/* fall through */
+	case SMB_SET_FILE_ALLOCATION_INFO:
+		err = smb_set_alloc_size(work);
+		break;
+	case SMB_SET_FILE_END_OF_FILE_INFO2:
+		/* fall through */
+	case SMB_SET_FILE_END_OF_FILE_INFO:
+		err = smb_set_file_size_finfo(work);
+		break;
+	case SMB_SET_FILE_UNIX_BASIC:
+		err = smb_set_unix_fileinfo(work);
+		break;
+	case SMB_SET_FILE_DISPOSITION_INFO:
+	case SMB_SET_FILE_DISPOSITION_INFORMATION:
+		err = smb_set_dispostion(work);
+		break;
+	case SMB_SET_FILE_BASIC_INFO2:
+		/* fall through */
+	case SMB_SET_FILE_BASIC_INFO:
+		err = smb_set_time_fileinfo(work);
+		break;
+	case SMB_SET_FILE_RENAME_INFORMATION:
+		err = smb_fileinfo_rename(work);
+		break;
+	default:
+		ksmbd_debug(SMB, "info level = %x not implemented yet\n",
+				info_level);
+		rsp->hdr.Status.CifsError = STATUS_NOT_IMPLEMENTED;
+		return -EOPNOTSUPP;
+	}
+
+	if (err < 0)
+		ksmbd_debug(SMB, "info_level 0x%x failed, err %d\n",
+				info_level, err);
+	return err;
+}
+
+/**
+ * create_dir() - trans2 create directory dispatcher
+ * @work:   smb work containing set file info command buffer
+ *
+ * Return:      0 on success, otherwise error
+ */
+static int create_dir(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_req *req = work->request_buf;
+	struct smb_com_trans2_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	mode_t mode = S_IALLUGO;
+	char *name;
+	int err;
+
+	name = smb_get_name(share, work->request_buf +
+			le16_to_cpu(req->ParameterOffset) + 4,
+			PATH_MAX, work, false);
+	if (IS_ERR(name)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(name);
+	}
+
+	if (ksmbd_override_fsids(work)) {
+		kfree(name);
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		return -ENOMEM;
+	}
+
+	err = ksmbd_vfs_mkdir(work, name, mode);
+	if (err) {
+		if (err == -EEXIST) {
+			if (!(((struct smb_hdr *)work->request_buf)->Flags2 &
+						SMBFLG2_ERR_STATUS)) {
+				ntstatus_to_dos(STATUS_OBJECT_NAME_COLLISION,
+					&rsp->hdr.Status.DosError.ErrorClass,
+					&rsp->hdr.Status.DosError.Error);
+			} else
+				rsp->hdr.Status.CifsError =
+					STATUS_OBJECT_NAME_COLLISION;
+		} else
+			rsp->hdr.Status.CifsError = STATUS_DATA_ERROR;
+		goto out;
+	} else
+		rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) {
+		__u64 ctime;
+		struct path path;
+		struct xattr_dos_attrib da = {0};
+
+		err = ksmbd_vfs_kern_path(name, 0, &path, 1);
+		if (!err) {
+			ctime = ksmbd_UnixTimeToNT(current_time(path.dentry->d_inode));
+
+			da.version = 4;
+			da.attr = ATTR_DIRECTORY;
+			da.itime = da.create_time = ctime;
+			da.flags = XATTR_DOSINFO_ATTRIB | XATTR_DOSINFO_CREATE_TIME |
+				XATTR_DOSINFO_ITIME;
+
+			err = ksmbd_vfs_set_dos_attrib_xattr(path.dentry, &da);
+			if (err)
+				ksmbd_debug(SMB, "failed to store creation time in EA\n");
+			path_put(&path);
+		}
+		err = 0;
+	}
+
+out:
+	memset(&rsp->hdr.WordCount, 0, 3);
+	ksmbd_revert_fsids(work);
+	kfree(name);
+	return err;
+}
+
+/**
+ * get_dfs_referral() - handler for smb dfs referral command
+ * @work:	smb work containing get dfs referral command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int get_dfs_referral(struct ksmbd_work *work)
+{
+	struct smb_hdr *rsp_hdr = (struct smb_hdr *)work->response_buf;
+
+	rsp_hdr->Status.CifsError = STATUS_NOT_SUPPORTED;
+	return 0;
+}
+
+/**
+ * smb_trans2() - handler for trans2 commands
+ * @work:	smb work containing trans2 command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_trans2(struct ksmbd_work *work)
+{
+	struct smb_com_trans2_req *req = work->request_buf;
+	struct smb_hdr *rsp_hdr = work->response_buf;
+	int err = 0;
+	u16 sub_command = le16_to_cpu(req->SubCommand);
+
+	/* at least one setup word for TRANS2 command
+	 *		MS-CIFS, SMB COM TRANSACTION
+	 */
+	if (req->SetupCount < 1) {
+		ksmbd_err("Wrong setup count in SMB_TRANS2 - indicates wrong request\n");
+		rsp_hdr->Status.CifsError = STATUS_UNSUCCESSFUL;
+		return -EINVAL;
+	}
+
+	switch (sub_command) {
+	case TRANS2_FIND_FIRST:
+		err = find_first(work);
+		break;
+	case TRANS2_FIND_NEXT:
+		err = find_next(work);
+		break;
+	case TRANS2_QUERY_FS_INFORMATION:
+		err = query_fs_info(work);
+		break;
+	case TRANS2_QUERY_PATH_INFORMATION:
+		err = query_path_info(work);
+		break;
+	case TRANS2_SET_PATH_INFORMATION:
+		err = set_path_info(work);
+		break;
+	case TRANS2_SET_FS_INFORMATION:
+		err = set_fs_info(work);
+		break;
+	case TRANS2_QUERY_FILE_INFORMATION:
+		err = query_file_info(work);
+		break;
+	case TRANS2_SET_FILE_INFORMATION:
+		err = set_file_info(work);
+		break;
+	case TRANS2_CREATE_DIRECTORY:
+		err = create_dir(work);
+		break;
+	case TRANS2_GET_DFS_REFERRAL:
+		err = get_dfs_referral(work);
+		break;
+	default:
+		ksmbd_debug(SMB, "sub command 0x%x not implemented yet\n",
+				sub_command);
+		rsp_hdr->Status.CifsError = STATUS_NOT_SUPPORTED;
+		return -EINVAL;
+	}
+
+	if (err) {
+		ksmbd_debug(SMB, "%s failed with error %d\n", __func__, err);
+		if (err == -EBUSY)
+			rsp_hdr->Status.CifsError = STATUS_DELETE_PENDING;
+		return err;
+	}
+
+	return 0;
+}
+
+/**
+ * smb_mkdir() - handler for smb mkdir
+ * @work:	smb work containing creat directory command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_mkdir(struct ksmbd_work *work)
+{
+	struct smb_com_create_directory_req *req = work->request_buf;
+	struct smb_com_create_directory_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	mode_t mode = S_IALLUGO;
+	char *name;
+	int err;
+
+	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+		ksmbd_debug(SMB,
+			"returning as user does not have permission to write\n");
+		rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		return -EACCES;
+	}
+
+	name = smb_get_name(share, req->DirName, PATH_MAX, work, false);
+	if (IS_ERR(name)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(name);
+	}
+
+	if (ksmbd_override_fsids(work)) {
+		kfree(name);
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		return -ENOMEM;
+	}
+
+	err = ksmbd_vfs_mkdir(work, name, mode);
+	if (err) {
+		if (err == -EEXIST) {
+			if (!(((struct smb_hdr *)work->request_buf)->Flags2 &
+						SMBFLG2_ERR_STATUS)) {
+				rsp->hdr.Status.DosError.ErrorClass = ERRDOS;
+				rsp->hdr.Status.DosError.Error =
+					cpu_to_le16(ERRnoaccess);
+			} else
+				rsp->hdr.Status.CifsError =
+					STATUS_OBJECT_NAME_COLLISION;
+		} else
+			rsp->hdr.Status.CifsError = STATUS_DATA_ERROR;
+		goto out;
+	} else {
+		/* mkdir success, return response to server */
+		rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+		rsp->hdr.WordCount = 0;
+		rsp->ByteCount = 0;
+	}
+
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) {
+		__u64 ctime;
+		struct path path;
+		struct xattr_dos_attrib da = {0};
+
+		err = ksmbd_vfs_kern_path(name, 0, &path, 1);
+		if (!err) {
+			ctime = ksmbd_UnixTimeToNT(current_time(path.dentry->d_inode));
+
+			da.version = 4;
+			da.attr = ATTR_DIRECTORY;
+			da.itime = da.create_time = ctime;
+			da.flags = XATTR_DOSINFO_ATTRIB | XATTR_DOSINFO_CREATE_TIME |
+				XATTR_DOSINFO_ITIME;
+
+			err = ksmbd_vfs_set_dos_attrib_xattr(path.dentry, &da);
+			if (err)
+				ksmbd_debug(SMB, "failed to store creation time in xattr\n");
+			path_put(&path);
+		}
+		err = 0;
+	}
+
+out:
+	ksmbd_revert_fsids(work);
+	kfree(name);
+	return err;
+}
+
+/**
+ * smb_checkdir() - handler to verify whether a specified
+ * path resolves to a valid directory or not
+ *
+ * @work:   smb work containing creat directory command buffer
+ *
+ * Return:      0 on success, otherwise error
+ */
+int smb_checkdir(struct ksmbd_work *work)
+{
+	struct smb_com_check_directory_req *req = work->request_buf;
+	struct smb_com_check_directory_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct path path;
+	struct kstat stat;
+	char *name, *last;
+	int err;
+	bool caseless_lookup = req->hdr.Flags & SMBFLG_CASELESS;
+
+	name = smb_get_name(share, req->DirName, PATH_MAX, work, false);
+	if (IS_ERR(name)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(name);
+	}
+
+	err = ksmbd_vfs_kern_path(name, 0, &path, caseless_lookup);
+	if (err) {
+		if (err == -ENOENT) {
+			/*
+			 * If the parent directory is valid but not the
+			 * last component - then returns
+			 * STATUS_OBJECT_NAME_NOT_FOUND
+			 * for that case and STATUS_OBJECT_PATH_NOT_FOUND
+			 * if the path is invalid.
+			 */
+			last = strrchr(name, '/');
+			if (last && last[1] != '\0') {
+				*last = '\0';
+				last++;
+
+				err = ksmbd_vfs_kern_path(name, LOOKUP_FOLLOW |
+						LOOKUP_DIRECTORY, &path,
+						caseless_lookup);
+			} else {
+				ksmbd_debug(SMB, "can't lookup parent %s\n",
+					name);
+				err = -ENOENT;
+			}
+		}
+		if (err) {
+			ksmbd_debug(SMB, "look up failed err %d\n", err);
+			switch (err) {
+			case -ENOENT:
+				rsp->hdr.Status.CifsError =
+				STATUS_OBJECT_NAME_NOT_FOUND;
+				break;
+			case -ENOMEM:
+				rsp->hdr.Status.CifsError =
+				STATUS_INSUFFICIENT_RESOURCES;
+				break;
+			case -EACCES:
+				rsp->hdr.Status.CifsError =
+				STATUS_ACCESS_DENIED;
+				break;
+			case -EIO:
+				rsp->hdr.Status.CifsError =
+				STATUS_DATA_ERROR;
+				break;
+			default:
+				rsp->hdr.Status.CifsError =
+				STATUS_OBJECT_PATH_SYNTAX_BAD;
+				break;
+			}
+			kfree(name);
+			return err;
+		}
+	}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	generic_fillattr(&init_user_ns, d_inode(path.dentry), &stat);
+#else
+	generic_fillattr(d_inode(path.dentry), &stat);
+#endif
+
+	if (!S_ISDIR(stat.mode)) {
+		rsp->hdr.Status.CifsError = STATUS_NOT_A_DIRECTORY;
+	} else {
+		/* checkdir success, return response to server */
+		rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+		rsp->hdr.WordCount = 0;
+		rsp->ByteCount = 0;
+	}
+
+	path_put(&path);
+	kfree(name);
+	return err;
+}
+
+/**
+ * smb_process_exit() - handler for smb process exit
+ * @work:	smb work containing process exit command buffer
+ *
+ * Return:	0 on success always
+ * This command is obsolete now. Starting with the LAN Manager 1.0 dialect,
+ * FIDs are no longer associated with PIDs.CIFS clients SHOULD NOT send
+ * SMB_COM_PROCESS_EXIT requests. Instead, CIFS clients SHOULD perform all
+ * process cleanup operations, sending individual file close operations
+ * as needed.Here it is implemented very minimally for sake
+ * of passing smbtorture testcases.
+ */
+int smb_process_exit(struct ksmbd_work *work)
+{
+	struct smb_com_process_exit_rsp *rsp = work->response_buf;
+
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 0;
+	rsp->ByteCount = 0;
+	return 0;
+}
+
+/**
+ * smb_rmdir() - handler for smb rmdir
+ * @work:	smb work containing delete directory command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_rmdir(struct ksmbd_work *work)
+{
+	struct smb_com_delete_directory_req *req = work->request_buf;
+	struct smb_com_delete_directory_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	char *name;
+	int err;
+
+	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+		ksmbd_debug(SMB,
+			"returning as user does not have permission to write\n");
+		rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		return -EACCES;
+	}
+
+	name = smb_get_name(share, req->DirName, PATH_MAX, work, false);
+	if (IS_ERR(name)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(name);
+	}
+
+	err = ksmbd_vfs_remove_file(work, name);
+	if (err) {
+		if (err == -ENOTEMPTY)
+			rsp->hdr.Status.CifsError =
+				STATUS_DIRECTORY_NOT_EMPTY;
+		else if (err == -ENOENT)
+			rsp->hdr.Status.CifsError =
+				STATUS_OBJECT_NAME_NOT_FOUND;
+		else
+			rsp->hdr.Status.CifsError = STATUS_DATA_ERROR;
+	} else {
+		/* rmdir success, return response to server */
+		rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+		rsp->hdr.WordCount = 0;
+		rsp->ByteCount = 0;
+	}
+
+	kfree(name);
+	return err;
+}
+
+/**
+ * smb_unlink() - handler for smb delete file
+ * @work:	smb work containing delete file command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_unlink(struct ksmbd_work *work)
+{
+	struct smb_com_delete_file_req *req = work->request_buf;
+	struct smb_com_delete_file_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	char *name;
+	int err;
+	struct ksmbd_file *fp;
+
+	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+		ksmbd_debug(SMB,
+			"returning as user does not have permission to write\n");
+		rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		return -EACCES;
+	}
+
+	name = smb_get_name(share, req->fileName, PATH_MAX, work, false);
+	if (IS_ERR(name)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(name);
+	}
+
+	fp = ksmbd_lookup_fd_filename(work, name);
+	if (fp)
+		err = -ESHARE;
+	else
+		err = ksmbd_vfs_remove_file(work, name);
+
+	if (err) {
+		if (err == -EISDIR)
+			rsp->hdr.Status.CifsError =
+				STATUS_FILE_IS_A_DIRECTORY;
+		else if (err == -ESHARE)
+			rsp->hdr.Status.CifsError = STATUS_SHARING_VIOLATION;
+		else if (err == -EACCES)
+			rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		else
+			rsp->hdr.Status.CifsError =
+				STATUS_OBJECT_NAME_NOT_FOUND;
+	} else {
+		rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+		rsp->hdr.WordCount = 0;
+		rsp->ByteCount = 0;
+	}
+
+	ksmbd_fd_put(work, fp);
+	kfree(name);
+	return err;
+}
+
+/**
+ * smb_nt_cancel() - handler for smb cancel command
+ * @work:	smb work containing cancel command buffer
+ *
+ * Return:	0
+ */
+int smb_nt_cancel(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb_hdr *hdr = (struct smb_hdr *)work->request_buf;
+	struct smb_hdr *work_hdr;
+	struct ksmbd_work *new_work;
+	struct list_head *tmp;
+
+	ksmbd_debug(SMB, "smb cancel called on mid %u\n", hdr->Mid);
+
+	spin_lock(&conn->request_lock);
+	list_for_each(tmp, &conn->requests) {
+		new_work = list_entry(tmp, struct ksmbd_work, request_entry);
+		work_hdr = (struct smb_hdr *)new_work->request_buf;
+		if (work_hdr->Mid == hdr->Mid) {
+			ksmbd_debug(SMB, "smb with mid %u cancelled command = 0x%x\n",
+			       hdr->Mid, work_hdr->Command);
+			new_work->send_no_response = 1;
+			list_del_init(&new_work->request_entry);
+			new_work->sess->sequence_number--;
+			break;
+		}
+	}
+	spin_unlock(&conn->request_lock);
+
+	/* For SMB_COM_NT_CANCEL command itself send no response */
+	work->send_no_response = 1;
+	return 0;
+}
+
+/**
+ * smb_nt_rename() - handler for smb rename command
+ * @work:	smb work containing nt rename command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_nt_rename(struct ksmbd_work *work)
+{
+	struct smb_com_nt_rename_req *req = work->request_buf;
+	struct smb_com_rename_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	char *oldname, *newname;
+	int oldname_len, err;
+
+	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+		ksmbd_debug(SMB,
+			"returning as user does not have permission to write\n");
+		rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		return -EACCES;
+	}
+
+	if (le16_to_cpu(req->Flags) != CREATE_HARD_LINK) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		return -EINVAL;
+	}
+
+	oldname = smb_get_name(share, req->OldFileName, PATH_MAX, work, false);
+	if (IS_ERR(oldname)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(oldname);
+	}
+
+	if (is_smbreq_unicode(&req->hdr))
+		oldname_len = smb1_utf16_name_length((__le16 *)req->OldFileName,
+				PATH_MAX);
+	else {
+		oldname_len = strlen(oldname);
+		oldname_len++;
+	}
+
+	newname = smb_get_name(share, &req->OldFileName[oldname_len + 2],
+			PATH_MAX, work, false);
+	if (IS_ERR(newname)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		kfree(oldname);
+		return PTR_ERR(newname);
+	}
+	ksmbd_debug(SMB, "oldname %s, newname %s, oldname_len %d, unicode %d\n",
+			oldname, newname, oldname_len,
+			is_smbreq_unicode(&req->hdr));
+
+	err = ksmbd_vfs_link(work, oldname, newname);
+	if (err == -EACCES)
+		rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+	else if (err < 0)
+		rsp->hdr.Status.CifsError = STATUS_NOT_SAME_DEVICE;
+
+	kfree(newname);
+	kfree(oldname);
+	return err;
+}
+
+static __le32 smb_query_info_pipe(struct ksmbd_share_config *share,
+		struct kstat *st)
+{
+	st->mode = S_IFDIR;
+	return 0;
+}
+
+static __le32 smb_query_info_path(struct ksmbd_work *work, struct kstat *st)
+{
+	struct smb_com_query_information_req *req = work->request_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct path path;
+	char *name;
+	int err = 0;
+	unsigned int flags = LOOKUP_FOLLOW;
+
+	name = smb_get_name(share, req->FileName, PATH_MAX, work, false);
+	if (IS_ERR(name))
+		return STATUS_OBJECT_NAME_INVALID;
+
+	if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS))
+		flags = 0;
+
+	if (ksmbd_override_fsids(work)) {
+		kfree(name);
+		return STATUS_NO_MEMORY;
+	}
+
+	err = ksmbd_vfs_kern_path(name, flags, &path, 0);
+	if (err) {
+		ksmbd_err("look up failed err %d\n", err);
+
+		if (!test_share_config_flag(share,
+			KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS)) {
+			if (d_is_symlink(path.dentry)) {
+				err = STATUS_ACCESS_DENIED;
+				goto out;
+			}
+		}
+		err = STATUS_OBJECT_NAME_NOT_FOUND;
+		goto out;
+	}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	generic_fillattr(&init_user_ns, d_inode(path.dentry), st);
+#else
+	generic_fillattr(d_inode(path.dentry), st);
+#endif
+out:
+	ksmbd_revert_fsids(work);
+	kfree(name);
+	return err;
+}
+
+/**
+ * smb_query_info() - handler for query information command
+ * @work:	smb work containing query info command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_query_info(struct ksmbd_work *work)
+{
+	struct smb_com_query_information_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct kstat st = {0,};
+	__u16 attr = 0;
+	int i;
+	__le32 err;
+
+	if (!test_share_config_flag(work->tcon->share_conf,
+				    KSMBD_SHARE_FLAG_PIPE))
+		err = smb_query_info_path(work, &st);
+	else
+		err = smb_query_info_pipe(share, &st);
+
+	if (err != 0) {
+		rsp->hdr.Status.CifsError = err;
+		return -EINVAL;
+	}
+
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 10;
+
+	if (st.mode & S_ISVTX)
+		attr |=  (ATTR_HIDDEN | ATTR_SYSTEM);
+	if (!(st.mode & 0222))
+		attr |=  ATTR_READONLY;
+	if (S_ISDIR(st.mode))
+		attr |= ATTR_DIRECTORY;
+
+	rsp->attr = cpu_to_le16(attr);
+	rsp->last_write_time = cpu_to_le32(st.mtime.tv_sec);
+	rsp->size = cpu_to_le32((u32)st.size);
+	for (i = 0; i < 5; i++)
+		rsp->reserved[i] = 0;
+
+	rsp->ByteCount = 0;
+	inc_rfc1001_len(&rsp->hdr, rsp->hdr.WordCount * 2);
+	return 0;
+}
+
+/**
+ * smb_closedir() - handler closing dir handle, opened for readdir
+ * @work:	smb work containing find close command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_closedir(struct ksmbd_work *work)
+{
+	struct smb_com_findclose_req *req = work->request_buf;
+	struct smb_com_close_rsp *rsp = work->response_buf;
+	int err;
+
+	ksmbd_debug(SMB, "SMB_COM_FIND_CLOSE2 called for fid %u\n",
+		req->FileID);
+
+	rsp->hdr.WordCount = 0;
+	rsp->ByteCount = 0;
+
+	err = ksmbd_close_fd(work, req->FileID);
+	if (!err)
+		rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	else
+		rsp->hdr.Status.CifsError = STATUS_INVALID_HANDLE;
+	return err;
+}
+
+/**
+ * convert_open_flags() - convert smb open flags to file open flags
+ * @file_present:	is file already present
+ * @mode:		smp file open mode
+ * @disposition:	smp file disposition information
+ *
+ * Return:	converted file open flags
+ */
+static int convert_open_flags(bool file_present, __u16 mode, __u16 dispostion)
+{
+	int oflags = 0;
+
+	switch (mode & 0x0007) {
+	case SMBOPEN_READ:
+		oflags |= O_RDONLY;
+		break;
+	case SMBOPEN_WRITE:
+		oflags |= O_WRONLY;
+		break;
+	case SMBOPEN_READWRITE:
+		oflags |= O_RDWR;
+		break;
+	default:
+		oflags |= O_RDONLY;
+		break;
+	}
+
+	if (mode & SMBOPEN_WRITE_THROUGH)
+		oflags |= O_SYNC;
+
+	if (file_present) {
+		switch (dispostion & 0x0003) {
+		case SMBOPEN_DISPOSITION_NONE:
+			return -EEXIST;
+		case SMBOPEN_OAPPEND:
+			oflags |= O_APPEND;
+			break;
+		case SMBOPEN_OTRUNC:
+			oflags |= O_TRUNC;
+			break;
+		default:
+			break;
+		}
+	} else {
+		switch (dispostion & 0x0010) {
+		case SMBOPEN_DISPOSITION_NONE:
+			return -EINVAL;
+		case SMBOPEN_OCREATE:
+			oflags |= O_CREAT;
+			break;
+		default:
+			break;
+		}
+	}
+
+	return oflags;
+}
+
+/**
+ * smb_open_andx() - smb andx open method handler
+ * @work:	smb work containing buffer for andx open command buffer
+ *
+ * Return:	error if there is error while processing current command,
+ *		otherwise pointer to next andx command in the chain
+ */
+int smb_open_andx(struct ksmbd_work *work)
+{
+	struct smb_com_openx_req *req = work->request_buf;
+	struct smb_com_openx_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct path path;
+	struct kstat stat;
+	int oplock_flags, file_info, open_flags;
+	char *name;
+	bool file_present = true;
+	umode_t mode = 0;
+	int err;
+	struct ksmbd_file *fp = NULL;
+	int oplock_rsp = OPLOCK_NONE, share_ret;
+	unsigned int flags = LOOKUP_FOLLOW;
+
+	rsp->hdr.Status.CifsError = STATUS_UNSUCCESSFUL;
+
+	/* check for sharing mode flag */
+	if ((le16_to_cpu(req->Mode) & SMBOPEN_SHARING_MODE) >
+			SMBOPEN_DENY_NONE) {
+		rsp->hdr.Status.DosError.ErrorClass = ERRDOS;
+		rsp->hdr.Status.DosError.Error = cpu_to_le16(ERRbadaccess);
+		rsp->hdr.Flags2 &= ~SMBFLG2_ERR_STATUS;
+
+		memset(&rsp->hdr.WordCount, 0, 3);
+		return -EINVAL;
+	}
+
+	if (is_smbreq_unicode(&req->hdr))
+		name = smb_get_name(share, req->fileName + 1, PATH_MAX,
+				work, false);
+	else
+		name = smb_get_name(share, req->fileName, PATH_MAX,
+				work, false);
+
+	if (IS_ERR(name)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(name);
+	}
+
+	if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS))
+		flags = 0;
+
+	if (ksmbd_override_fsids(work)) {
+		kfree(name);
+		rsp->hdr.Status.CifsError = STATUS_NO_MEMORY;
+		return -ENOMEM;
+	}
+
+	err = ksmbd_vfs_kern_path(name, flags, &path,
+			req->hdr.Flags & SMBFLG_CASELESS);
+	if (err) {
+		if (err == -EACCES || !test_share_config_flag(share,
+			KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS)) {
+			err = -EACCES;
+			goto out;
+		}
+		file_present = false;
+	} else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		generic_fillattr(&init_user_ns, d_inode(path.dentry), &stat);
+#else
+		generic_fillattr(d_inode(path.dentry), &stat);
+#endif
+
+	oplock_flags = le16_to_cpu(req->OpenFlags) &
+		(REQ_OPLOCK | REQ_BATCHOPLOCK);
+
+	open_flags = convert_open_flags(file_present, le16_to_cpu(req->Mode),
+			le16_to_cpu(req->OpenFunction));
+	if (open_flags < 0) {
+		ksmbd_debug(SMB, "create_dispostion returned %d\n", open_flags);
+		if (file_present)
+			goto free_path;
+		else {
+			err = -ENOENT;
+			goto out;
+		}
+	}
+
+	if (file_present && !(stat.mode & 0222)) {
+		if ((open_flags & O_ACCMODE) == O_WRONLY ||
+				(open_flags & O_ACCMODE) == O_RDWR) {
+			ksmbd_debug(SMB, "readonly file(%s)\n", name);
+			rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+			memset(&rsp->hdr.WordCount, 0, 3);
+			goto free_path;
+		}
+	}
+
+	if (!file_present && (open_flags & O_CREAT)) {
+		mode |= 0777;
+		if (le16_to_cpu(req->FileAttributes) & ATTR_READONLY)
+			mode &= ~0222;
+
+		mode |= S_IFREG;
+		err = ksmbd_vfs_create(work, name, mode);
+		if (err)
+			goto out;
+
+		err = ksmbd_vfs_kern_path(name, 0, &path, 0);
+		if (err) {
+			ksmbd_err("cannot get linux path, err = %d\n", err);
+			goto out;
+		}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		generic_fillattr(&init_user_ns, d_inode(path.dentry), &stat);
+#else
+		generic_fillattr(d_inode(path.dentry), &stat);
+#endif
+	} else if (file_present) {
+		err = ksmbd_vfs_inode_permission(path.dentry,
+				open_flags & O_ACCMODE, false);
+		if (err)
+			goto free_path;
+	}
+
+	err = ksmbd_query_inode_status(d_inode(path.dentry->d_parent));
+	if (err == KSMBD_INODE_STATUS_PENDING_DELETE) {
+		err = -EBUSY;
+		goto free_path;
+	}
+
+	err = 0;
+	ksmbd_debug(SMB, "(%s) open_flags = 0x%x, oplock_flags 0x%x\n",
+			name, open_flags, oplock_flags);
+	/* open  file and get FID */
+	fp = ksmbd_vfs_dentry_open(work, &path, open_flags,
+			0, file_present);
+	if (!fp)
+		goto free_path;
+	fp->filename = name;
+	fp->pid = le16_to_cpu(req->hdr.Pid);
+
+	write_lock(&fp->f_ci->m_lock);
+	list_add(&fp->node, &fp->f_ci->m_fp_list);
+	write_unlock(&fp->f_ci->m_lock);
+
+	share_ret = ksmbd_smb_check_shared_mode(fp->filp, fp);
+	if (smb1_oplock_enable &&
+	    test_share_config_flag(work->tcon->share_conf,
+			KSMBD_SHARE_FLAG_OPLOCKS) &&
+		!S_ISDIR(file_inode(fp->filp)->i_mode) &&
+		oplock_flags) {
+		/* Client cannot request levelII oplock directly */
+		err = smb_grant_oplock(work, oplock_flags, fp->volatile_id,
+			fp, le16_to_cpu(req->hdr.Tid), NULL, 0);
+		if (err)
+			goto free_path;
+	} else {
+		if (ksmbd_inode_pending_delete(fp)) {
+			err = -EBUSY;
+			goto free_path;
+		}
+
+		if (share_ret < 0) {
+			err = -EPERM;
+			goto free_path;
+		}
+	}
+
+	oplock_rsp = fp->f_opinfo != NULL ? fp->f_opinfo->level : 0;
+
+	/* open success, send back response */
+	if (file_present) {
+		if (!(open_flags & O_TRUNC))
+			file_info = F_OPENED;
+		else
+			file_info = F_OVERWRITTEN;
+	} else
+		file_info = F_CREATED;
+
+	if (oplock_rsp)
+		file_info |= SMBOPEN_LOCK_GRANTED;
+
+	if (stat.result_mask & STATX_BTIME)
+		fp->create_time = ksmbd_UnixTimeToNT(stat.btime);
+	else
+		fp->create_time = ksmbd_UnixTimeToNT(stat.ctime);
+	if (file_present) {
+		if (test_share_config_flag(work->tcon->share_conf,
+					   KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) {
+			struct xattr_dos_attrib da;
+
+			err = ksmbd_vfs_get_dos_attrib_xattr(path.dentry, &da);
+			if (err > 0) {
+				fp->create_time = da.create_time;
+				fp->itime = da.itime;
+			}
+			err = 0;
+		}
+	} else {
+		if (test_share_config_flag(work->tcon->share_conf,
+					KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) {
+			struct xattr_dos_attrib da = {0};
+
+			da.version = 4;
+			da.attr = ATTR_NORMAL;
+			da.itime = da.create_time = fp->create_time;
+			da.flags = XATTR_DOSINFO_ATTRIB | XATTR_DOSINFO_CREATE_TIME |
+				XATTR_DOSINFO_ITIME;
+
+			err = ksmbd_vfs_set_dos_attrib_xattr(path.dentry, &da);
+			if (err)
+				ksmbd_debug(SMB, "failed to store creation time in xattr\n");
+			err = 0;
+		}
+	}
+
+	/* prepare response buffer */
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 0x0F;
+	rsp->Fid = fp->volatile_id;
+	rsp->FileAttributes = cpu_to_le16(ATTR_NORMAL);
+	rsp->LastWriteTime = cpu_to_le32(stat.mtime.tv_sec);
+	rsp->EndOfFile = cpu_to_le32(stat.size);
+	switch (open_flags & O_ACCMODE) {
+	case O_RDONLY:
+		rsp->Access = cpu_to_le16(SMB_DA_ACCESS_READ);
+		break;
+	case O_WRONLY:
+		rsp->Access = cpu_to_le16(SMB_DA_ACCESS_WRITE);
+		break;
+	case O_RDWR:
+		rsp->Access = cpu_to_le16(SMB_DA_ACCESS_READ_WRITE);
+		break;
+	default:
+		rsp->Access = cpu_to_le16(SMB_DA_ACCESS_READ);
+		break;
+	}
+
+	rsp->FileType = 0;
+	rsp->IPCState = 0;
+	rsp->Action = cpu_to_le16(file_info);
+	rsp->Reserved = 0;
+	rsp->ByteCount = 0;
+	inc_rfc1001_len(&rsp->hdr, rsp->hdr.WordCount * 2);
+
+free_path:
+	path_put(&path);
+out:
+	ksmbd_revert_fsids(work);
+	if (err) {
+		if (err == -ENOSPC)
+			rsp->hdr.Status.CifsError = STATUS_DISK_FULL;
+		else if (err == -EMFILE)
+			rsp->hdr.Status.CifsError =
+				STATUS_TOO_MANY_OPENED_FILES;
+		else if (err == -EBUSY)
+			rsp->hdr.Status.CifsError = STATUS_DELETE_PENDING;
+		else if (err == -ENOENT)
+			rsp->hdr.Status.CifsError =
+				STATUS_OBJECT_NAME_NOT_FOUND;
+		else if (err == -EACCES)
+			rsp->hdr.Status.CifsError = STATUS_ACCESS_DENIED;
+		else
+			rsp->hdr.Status.CifsError =
+				STATUS_UNEXPECTED_IO_ERROR;
+	}
+
+	if (err) {
+		if (fp)
+			ksmbd_close_fd(work, fp->volatile_id);
+		else
+			kfree(name);
+	}
+
+	if (!rsp->hdr.WordCount)
+		return err;
+
+	/* this is an ANDx command ? */
+	rsp->AndXReserved = 0;
+	rsp->AndXOffset = cpu_to_le16(get_rfc1002_len(&rsp->hdr));
+	if (req->AndXCommand != SMB_NO_MORE_ANDX_COMMAND) {
+		/* adjust response */
+		rsp->AndXCommand = req->AndXCommand;
+		return rsp->AndXCommand; /* More processing required */
+	}
+	rsp->AndXCommand = SMB_NO_MORE_ANDX_COMMAND;
+
+	return err;
+}
+
+/**
+ * smb_setattr() - set file attributes
+ * @work:	smb work containing setattr command
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb_setattr(struct ksmbd_work *work)
+{
+	struct smb_com_setattr_req *req = work->request_buf;
+	struct smb_com_setattr_rsp *rsp = work->response_buf;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct path path;
+	struct kstat stat;
+	struct iattr attrs;
+	int err = 0;
+	char *name;
+	__u16 dos_attr;
+
+	name = smb_get_name(share, req->fileName, PATH_MAX, work, false);
+	if (IS_ERR(name)) {
+		rsp->hdr.Status.CifsError =
+			STATUS_OBJECT_NAME_INVALID;
+		return PTR_ERR(name);
+	}
+
+	err = ksmbd_vfs_kern_path(name, 0, &path,
+		req->hdr.Flags & SMBFLG_CASELESS);
+	if (err) {
+		ksmbd_debug(SMB, "look up failed err %d\n", err);
+		rsp->hdr.Status.CifsError = STATUS_OBJECT_NAME_NOT_FOUND;
+		err = 0;
+		goto out;
+	}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	generic_fillattr(&init_user_ns, d_inode(path.dentry), &stat);
+#else
+	generic_fillattr(d_inode(path.dentry), &stat);
+#endif
+	path_put(&path);
+	attrs.ia_valid = 0;
+	attrs.ia_mode = 0;
+
+	dos_attr = le16_to_cpu(req->attr);
+	if (!dos_attr)
+		attrs.ia_mode = stat.mode | 0200;
+
+	if (dos_attr & ATTR_READONLY)
+		attrs.ia_mode = stat.mode & ~0222;
+
+	if (attrs.ia_mode)
+		attrs.ia_valid |= ATTR_MODE;
+
+	attrs.ia_mtime.tv_sec = le32_to_cpu(req->LastWriteTime);
+	attrs.ia_valid |= (ATTR_MTIME | ATTR_MTIME_SET);
+
+	err = ksmbd_vfs_setattr(work, name, 0, &attrs);
+	if (err)
+		goto out;
+
+	rsp->hdr.Status.CifsError = STATUS_SUCCESS;
+	rsp->hdr.WordCount = 0;
+	rsp->ByteCount = 0;
+
+out:
+	kfree(name);
+	if (err) {
+		rsp->hdr.Status.CifsError = STATUS_INVALID_PARAMETER;
+		return err;
+	}
+
+	return 0;
+}
+
+/**
+ * smb1_is_sign_req() - handler for checking packet signing status
+ * @work:	smb work containing notify command buffer
+ *
+ * Return:	true if packed is signed, false otherwise
+ */
+bool smb1_is_sign_req(struct ksmbd_work *work, unsigned int command)
+{
+	struct smb_hdr *rcv_hdr1 = (struct smb_hdr *)work->request_buf;
+
+	if ((rcv_hdr1->Flags2 & SMBFLG2_SECURITY_SIGNATURE) &&
+			command != SMB_COM_SESSION_SETUP_ANDX)
+		return true;
+	return false;
+}
+
+/**
+ * smb1_check_sign_req() - handler for req packet sign processing
+ * @work:	smb work containing notify command buffer
+ *
+ * Return:	1 on success, 0 otherwise
+ */
+int smb1_check_sign_req(struct ksmbd_work *work)
+{
+	struct smb_hdr *rcv_hdr1 = (struct smb_hdr *)work->request_buf;
+	char signature_req[CIFS_SMB1_SIGNATURE_SIZE];
+	char signature[20];
+	struct kvec iov[1];
+
+	memcpy(signature_req, rcv_hdr1->Signature.SecuritySignature,
+			CIFS_SMB1_SIGNATURE_SIZE);
+	rcv_hdr1->Signature.Sequence.SequenceNumber =
+		cpu_to_le32(++work->sess->sequence_number);
+	rcv_hdr1->Signature.Sequence.Reserved = 0;
+
+	iov[0].iov_base = rcv_hdr1->Protocol;
+	iov[0].iov_len = be32_to_cpu(rcv_hdr1->smb_buf_length);
+
+	if (ksmbd_sign_smb1_pdu(work->sess, iov, 1, signature))
+		return 0;
+
+	if (memcmp(signature, signature_req, CIFS_SMB1_SIGNATURE_SIZE)) {
+		ksmbd_debug(SMB, "bad smb1 sign\n");
+		return 0;
+	}
+
+	return 1;
+}
+
+/**
+ * smb1_set_sign_rsp() - handler for rsp packet sign processing
+ * @work:	smb work containing notify command buffer
+ *
+ */
+void smb1_set_sign_rsp(struct ksmbd_work *work)
+{
+	struct smb_hdr *rsp_hdr = (struct smb_hdr *)work->response_buf;
+	char signature[20];
+	struct kvec iov[2];
+	int n_vec = 1;
+
+	rsp_hdr->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
+	rsp_hdr->Signature.Sequence.SequenceNumber =
+		cpu_to_le32(++work->sess->sequence_number);
+	rsp_hdr->Signature.Sequence.Reserved = 0;
+
+	iov[0].iov_base = rsp_hdr->Protocol;
+	iov[0].iov_len = be32_to_cpu(rsp_hdr->smb_buf_length);
+
+	if (work->aux_payload_sz) {
+		iov[0].iov_len -= work->aux_payload_sz;
+
+		iov[1].iov_base = work->aux_payload_buf;
+		iov[1].iov_len = work->aux_payload_sz;
+		n_vec++;
+	}
+
+	if (ksmbd_sign_smb1_pdu(work->sess, iov, n_vec, signature))
+		memset(rsp_hdr->Signature.SecuritySignature,
+				0, CIFS_SMB1_SIGNATURE_SIZE);
+	else
+		memcpy(rsp_hdr->Signature.SecuritySignature,
+				signature, CIFS_SMB1_SIGNATURE_SIZE);
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smb1pdu.h linux-5.4.60-fbx/fs/cifsd/smb1pdu.h
--- linux-5.4.60-fbx/fs/cifsd./smb1pdu.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smb1pdu.h	2021-03-30 16:07:01.588436216 +0200
@@ -0,0 +1,1600 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __SMB1PDU_H
+#define __SMB1PDU_H
+
+#define MAX_CIFS_HDR_SIZE 0x58
+
+#define SMB1_CLIENT_GUID_SIZE		(16)
+#define SMB1_MAX_MPX_COUNT		10
+#define SMB1_MAX_VCS			1
+#define SMB1_MAX_RAW_SIZE		65536
+#define MAX_CIFS_LOOKUP_BUFFER_SIZE	(16*1024)
+
+/*
+ * Size of the ntlm client response
+ */
+#define CIFS_AUTH_RESP_SIZE		24
+#define CIFS_SMB1_SIGNATURE_SIZE	8
+#define CIFS_SMB1_SESSKEY_SIZE		16
+
+#define SMB1_SERVER_CAPS					\
+	(CAP_UNICODE | CAP_LARGE_FILES | CAP_EXTENDED_SECURITY |\
+	 CAP_NT_SMBS | CAP_STATUS32 | CAP_LOCK_AND_READ |	\
+	 CAP_NT_FIND | CAP_UNIX | CAP_LARGE_READ_X |		\
+	 CAP_LARGE_WRITE_X | CAP_LEVEL_II_OPLOCKS)
+
+#define SMB1_SERVER_SECU  (SECMODE_USER | SECMODE_PW_ENCRYPT)
+
+/* Service Type of TreeConnect*/
+#define SERVICE_DISK_SHARE	"A:"
+#define SERVICE_IPC_SHARE	"IPC"
+#define SERVICE_PRINTER_SHARE	"LPT1:"
+#define SERVICE_COMM		"COMM"
+
+#define NATIVE_FILE_SYSTEM	"NTFS"
+
+#define SMB_NO_MORE_ANDX_COMMAND 0xFF
+#define SMB1_PROTO_NUMBER cpu_to_le32(0x424d53ff)
+
+/* Transact2 subcommand codes */
+#define TRANS2_OPEN                   0x00
+#define TRANS2_FIND_FIRST             0x01
+#define TRANS2_FIND_NEXT              0x02
+#define TRANS2_QUERY_FS_INFORMATION   0x03
+#define TRANS2_SET_FS_INFORMATION     0x04
+#define TRANS2_QUERY_PATH_INFORMATION 0x05
+#define TRANS2_SET_PATH_INFORMATION   0x06
+#define TRANS2_QUERY_FILE_INFORMATION 0x07
+#define TRANS2_SET_FILE_INFORMATION   0x08
+#define TRANS2_CREATE_DIRECTORY       0x0d
+#define TRANS2_GET_DFS_REFERRAL       0x10
+#define TRANS2_REPORT_DFS_INCOSISTENCY 0x11
+
+/* SMB Transact (Named Pipe) subcommand codes */
+#define TRANS_SET_NMPIPE_STATE      0x0001
+#define TRANS_RAW_READ_NMPIPE       0x0011
+#define TRANS_QUERY_NMPIPE_STATE    0x0021
+#define TRANS_QUERY_NMPIPE_INFO     0x0022
+#define TRANS_PEEK_NMPIPE           0x0023
+#define TRANS_TRANSACT_NMPIPE       0x0026
+#define TRANS_RAW_WRITE_NMPIPE      0x0031
+#define TRANS_READ_NMPIPE           0x0036
+#define TRANS_WRITE_NMPIPE          0x0037
+#define TRANS_WAIT_NMPIPE           0x0053
+#define TRANS_CALL_NMPIPE           0x0054
+
+/* NT Transact subcommand codes */
+#define NT_TRANSACT_CREATE            0x01
+#define NT_TRANSACT_IOCTL             0x02
+#define NT_TRANSACT_SET_SECURITY_DESC 0x03
+#define NT_TRANSACT_NOTIFY_CHANGE     0x04
+#define NT_TRANSACT_RENAME            0x05
+#define NT_TRANSACT_QUERY_SECURITY_DESC 0x06
+#define NT_TRANSACT_GET_USER_QUOTA    0x07
+#define NT_TRANSACT_SET_USER_QUOTA    0x08
+
+/*
+ * SMB flag definitions
+ */
+#define SMBFLG_EXTD_LOCK 0x01   /* server supports lock-read write-unlock smb */
+#define SMBFLG_RCV_POSTED 0x02  /* obsolete */
+#define SMBFLG_RSVD 0x04
+#define SMBFLG_CASELESS 0x08    /*
+				 * all pathnames treated as caseless (off
+				 * implies case sensitive file handling
+				 * request)
+				 */
+#define SMBFLG_CANONICAL_PATH_FORMAT 0x10       /* obsolete */
+#define SMBFLG_OLD_OPLOCK 0x20  /* obsolete */
+#define SMBFLG_OLD_OPLOCK_NOTIFY 0x40   /* obsolete */
+#define SMBFLG_RESPONSE 0x80    /* this PDU is a response from server */
+
+/*
+ * SMB flag2 definitions
+ */
+#define SMBFLG2_KNOWS_LONG_NAMES cpu_to_le16(1) /*
+						 * can send long (non-8.3)
+						 * path names in response
+						 */
+#define SMBFLG2_KNOWS_EAS cpu_to_le16(2)
+#define SMBFLG2_SECURITY_SIGNATURE cpu_to_le16(4)
+#define SMBFLG2_COMPRESSED (8)
+#define SMBFLG2_SECURITY_SIGNATURE_REQUIRED (0x10)
+#define SMBFLG2_IS_LONG_NAME cpu_to_le16(0x40)
+#define SMBFLG2_REPARSE_PATH (0x400)
+#define SMBFLG2_EXT_SEC cpu_to_le16(0x800)
+#define SMBFLG2_DFS cpu_to_le16(0x1000)
+#define SMBFLG2_PAGING_IO cpu_to_le16(0x2000)
+#define SMBFLG2_ERR_STATUS cpu_to_le16(0x4000)
+#define SMBFLG2_UNICODE cpu_to_le16(0x8000)
+
+#define SMB_COM_CREATE_DIRECTORY      0x00 /* trivial response */
+#define SMB_COM_DELETE_DIRECTORY      0x01 /* trivial response */
+#define SMB_COM_CLOSE                 0x04 /* triv req/rsp, timestamp ignored */
+#define SMB_COM_FLUSH                 0x05 /* triv req/rsp */
+#define SMB_COM_DELETE                0x06 /* trivial response */
+#define SMB_COM_RENAME                0x07 /* trivial response */
+#define SMB_COM_QUERY_INFORMATION     0x08 /* aka getattr */
+#define SMB_COM_SETATTR               0x09 /* trivial response */
+#define SMB_COM_WRITE                 0x0b
+#define SMB_COM_CHECK_DIRECTORY       0x10 /* trivial response */
+#define SMB_COM_PROCESS_EXIT          0x11 /* trivial response */
+#define SMB_COM_LOCKING_ANDX          0x24 /* trivial response */
+#define SMB_COM_TRANSACTION	      0x25
+#define SMB_COM_COPY                  0x29 /* trivial rsp, fail filename ignrd*/
+#define SMB_COM_ECHO                  0x2B /* echo request */
+#define SMB_COM_OPEN_ANDX             0x2D /* Legacy open for old servers */
+#define SMB_COM_READ_ANDX             0x2E
+#define SMB_COM_WRITE_ANDX            0x2F
+#define SMB_COM_TRANSACTION2          0x32
+#define SMB_COM_TRANSACTION2_SECONDARY 0x33
+#define SMB_COM_FIND_CLOSE2           0x34 /* trivial response */
+#define SMB_COM_TREE_DISCONNECT       0x71 /* trivial response */
+#define SMB_COM_NEGOTIATE             0x72
+#define SMB_COM_SESSION_SETUP_ANDX    0x73
+#define SMB_COM_LOGOFF_ANDX           0x74 /* trivial response */
+#define SMB_COM_TREE_CONNECT_ANDX     0x75
+#define SMB_COM_NT_TRANSACT           0xA0
+#define SMB_COM_NT_TRANSACT_SECONDARY 0xA1
+#define SMB_COM_NT_CREATE_ANDX        0xA2
+#define SMB_COM_NT_CANCEL             0xA4 /* no response */
+#define SMB_COM_NT_RENAME             0xA5 /* trivial response */
+
+/* Negotiate response Capabilities */
+#define CAP_RAW_MODE           0x00000001
+#define CAP_MPX_MODE           0x00000002
+#define CAP_UNICODE            0x00000004
+#define CAP_LARGE_FILES        0x00000008
+#define CAP_NT_SMBS            0x00000010       /* implies CAP_NT_FIND */
+#define CAP_RPC_REMOTE_APIS    0x00000020
+#define CAP_STATUS32           0x00000040
+#define CAP_LEVEL_II_OPLOCKS   0x00000080
+#define CAP_LOCK_AND_READ      0x00000100
+#define CAP_NT_FIND            0x00000200
+#define CAP_DFS                0x00001000
+#define CAP_INFOLEVEL_PASSTHRU 0x00002000
+#define CAP_LARGE_READ_X       0x00004000
+#define CAP_LARGE_WRITE_X      0x00008000
+#define CAP_LWIO               0x00010000 /* support fctl_srv_req_resume_key */
+#define CAP_UNIX               0x00800000
+#define CAP_COMPRESSED_DATA    0x02000000
+#define CAP_DYNAMIC_REAUTH     0x20000000
+#define CAP_PERSISTENT_HANDLES 0x40000000
+#define CAP_EXTENDED_SECURITY  0x80000000
+
+/* RFC 1002 session packet types */
+#define RFC1002_SESSION_MESSAGE 0x00
+#define RFC1002_SESSION_REQUEST  0x81
+#define RFC1002_POSITIVE_SESSION_RESPONSE 0x82
+#define RFC1002_NEGATIVE_SESSION_RESPONSE 0x83
+#define RFC1002_RETARGET_SESSION_RESPONSE 0x84
+#define RFC1002_SESSION_KEEP_ALIVE 0x85
+
+/* Action bits */
+#define GUEST_LOGIN 1
+
+struct smb_com_read_req {
+	struct smb_hdr hdr;     /* wct = 12 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__u16 Fid;
+	__le32 OffsetLow;
+	__le16 MaxCount;
+	__le16 MinCount;                /* obsolete */
+	__le32 MaxCountHigh;
+	__le16 Remaining;
+	__le32 OffsetHigh;
+	__le16 ByteCount;
+} __packed;
+
+struct smb_com_read_rsp {
+	struct smb_hdr hdr;     /* wct = 12 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__le16 Remaining;
+	__le16 DataCompactionMode;
+	__le16 Reserved;
+	__le16 DataLength;
+	__le16 DataOffset;
+	__le16 DataLengthHigh;
+	__u64 Reserved2;
+	__le16 ByteCount;
+	/* read response data immediately follows */
+} __packed;
+
+struct smb_com_write_req {
+	struct smb_hdr hdr;	/* wct = 14 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__u16 Fid;
+	__le32 OffsetLow;
+	__u32 Reserved;
+	__le16 WriteMode;
+	__le16 Remaining;
+	__le16 DataLengthHigh;
+	__le16 DataLengthLow;
+	__le16 DataOffset;
+	__le32 OffsetHigh;
+	__le16 ByteCount;
+	__u8 Pad;		/*
+				 * BB check for whether padded to DWORD
+				 * boundary and optimum performance here
+				 */
+	char Data[0];
+} __packed;
+
+struct smb_com_write_req_32bit {
+	struct smb_hdr hdr;	/* wct = 5 */
+	__u16 Fid;
+	__le16 Length;
+	__le32 Offset;
+	__u16 Estimate;
+	__le16 ByteCount;	/* must be greater than 2 */
+	__u8 BufferFormat;
+	__u16 DataLength;
+	char Data[0];
+} __packed;
+
+struct smb_com_write_rsp_32bit {
+	struct smb_hdr hdr;	/* wct = 1 */
+	__le16 Written;
+	__le16 ByteCount;	/* must be 0 */
+} __packed;
+
+struct smb_com_write_rsp {
+	struct smb_hdr hdr;	/* wct = 6 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__le16 Count;
+	__le16 Remaining;
+	__le16 CountHigh;
+	__u16  Reserved;
+	__le16 ByteCount;
+} __packed;
+
+struct smb_com_rename_req {
+	struct smb_hdr hdr;     /* wct = 1 */
+	__le16 SearchAttributes;        /* target file attributes */
+	__le16 ByteCount;
+	__u8 BufferFormat;      /* 4 = ASCII or Unicode */
+	unsigned char OldFileName[1];
+	/* followed by __u8 BufferFormat2 */
+	/* followed by NewFileName */
+} __packed;
+
+struct smb_com_rename_rsp {
+	struct smb_hdr hdr;     /* wct = 0 */
+	__le16 ByteCount;        /* bct = 0 */
+} __packed;
+
+/* SecurityMode bits */
+#define SECMODE_USER          0x01      /* off indicates share level security */
+#define SECMODE_PW_ENCRYPT    0x02
+#define SECMODE_SIGN_ENABLED  0x04      /* SMB security signatures enabled */
+#define SECMODE_SIGN_REQUIRED 0x08      /* SMB security signatures required */
+
+struct smb_com_session_setup_req {	/* request format */
+	struct smb_hdr hdr;	/* wct = 12 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__le16 MaxBufferSize;
+	__le16 MaxMpxCount;
+	__le16 VcNumber;
+	__u32 SessionKey;
+	__le16 SecurityBlobLength;
+	__u32 Reserved;
+	__le32 Capabilities;	/* see below */
+	__le16 ByteCount;
+	unsigned char SecurityBlob[1];	/* followed by */
+	/* STRING NativeOS */
+	/* STRING NativeLanMan */
+} __packed;	/* NTLM request format (with extended security) */
+
+struct smb_com_session_setup_req_no_secext {	/* request format */
+	struct smb_hdr hdr;	/* we will handle this :: wct = 13 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__le16 MaxBufferSize;
+	__le16 MaxMpxCount;
+	__le16 VcNumber;
+	__u32 SessionKey;
+	__le16 CaseInsensitivePasswordLength;	/* ASCII password len */
+	__le16 CaseSensitivePasswordLength;	/* Unicode password length*/
+	__u32 Reserved;	/* see below */
+	__le32 Capabilities;
+	__le16 ByteCount;
+	unsigned char CaseInsensitivePassword[0];	/* followed by: */
+	/* unsigned char * CaseSensitivePassword; */
+	/* STRING AccountName */
+	/* STRING PrimaryDomain */
+	/* STRING NativeOS */
+	/* STRING NativeLanMan */
+} __packed;	/* NTLM request format (without extended security */
+
+struct smb_com_session_setup_resp {	/* default (NTLM) response format */
+	struct smb_hdr hdr;	/* wct = 4 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__le16 Action;	/* see below */
+	__le16 SecurityBlobLength;
+	__le16 ByteCount;
+	unsigned char SecurityBlob[1];	/* followed by */
+	/*      unsigned char  * NativeOS;      */
+	/*      unsigned char  * NativeLanMan;  */
+	/*      unsigned char  * PrimaryDomain; */
+} __packed;	/* NTLM response (with or without extended sec) */
+
+struct smb_com_session_setup_old_resp { /* default (NTLM) response format */
+	struct smb_hdr hdr;	/* wct = 3 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__le16 Action;	/* see below */
+	__le16 ByteCount;
+	unsigned char NativeOS[1];	/* followed by */
+	/*      unsigned char * NativeLanMan; */
+	/*      unsigned char * PrimaryDomain; */
+} __packed;	/* pre-NTLM (LANMAN2.1) response */
+
+union smb_com_session_setup_andx {
+	struct smb_com_session_setup_req req;
+	struct smb_com_session_setup_req_no_secext req_no_secext;
+	struct smb_com_session_setup_resp resp;
+	struct smb_com_session_setup_old_resp old_resp;
+} __packed;
+
+struct smb_com_tconx_req {
+	__u8 WordCount;  /* wct = 4, it could be ANDX */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__le16 Flags;           /* see below */
+	__le16 PasswordLength;
+	__le16 ByteCount;
+	unsigned char Password[1];      /* followed by */
+	/* STRING Path    *//* \\server\share name */
+	/* STRING Service */
+} __packed;
+
+struct smb_com_tconx_rsp {
+	__u8 WordCount;     /* wct = 3 , not extended response */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__le16 OptionalSupport; /* see below */
+	__le16 ByteCount;
+	unsigned char Service[1];       /* always ASCII, not Unicode */
+	/* STRING NativeFileSystem */
+} __packed;
+
+struct smb_com_tconx_rsp_ext {
+	__u8 WordCount;	/* wct = 7, extended response */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__le16 OptionalSupport; /* see below */
+	__le32 MaximalShareAccessRights;
+	__le32 GuestMaximalShareAccessRights;
+	__le16 ByteCount;
+	unsigned char Service[1];       /* always ASCII, not Unicode */
+	/* STRING NativeFileSystem */
+} __packed;
+
+struct andx_block {
+	__u8 WordCount;
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+} __packed;
+
+struct locking_andx_range64 {
+	__le16 Pid;
+	__le16 Pad;
+	__le32 OffsetHigh;
+	__le32 OffsetLow;
+	__le32 LengthHigh;
+	__le32 LengthLow;
+} __packed;
+
+struct locking_andx_range32 {
+	__le16 Pid;
+	__le32 Offset;
+	__le32 Length;
+} __packed;
+
+#define LOCKING_ANDX_SHARED_LOCK     0x01
+#define LOCKING_ANDX_OPLOCK_RELEASE  0x02
+#define LOCKING_ANDX_CHANGE_LOCKTYPE 0x04
+#define LOCKING_ANDX_CANCEL_LOCK     0x08
+#define LOCKING_ANDX_LARGE_FILES     0x10       /* always on for us */
+
+struct smb_com_lock_req {
+	struct smb_hdr hdr;	/* wct = 8 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__u16 Fid;
+	__u8 LockType;
+	__u8 OplockLevel;
+	__le32 Timeout;
+	__le16 NumberOfUnlocks;
+	__le16 NumberOfLocks;
+	__le16 ByteCount;
+	char *Locks[1];
+} __packed;
+
+struct smb_com_lock_rsp {
+	struct smb_hdr hdr;     /* wct = 2 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__le16 ByteCount;
+} __packed;
+
+/* tree connect Flags */
+#define DISCONNECT_TID          0x0001
+#define TCON_EXTENDED_SIGNATURES 0x0004
+#define TCON_EXTENDED_SECINFO   0x0008
+
+/* OptionalSupport bits */
+#define SMB_SUPPORT_SEARCH_BITS 0x0001  /*
+					 * "must have" directory search bits
+					 * (exclusive searches supported)
+					 */
+#define SMB_SHARE_IS_IN_DFS     0x0002
+#define SMB_CSC_MASK               0x000C
+/* CSC flags defined as follows */
+#define SMB_CSC_CACHE_MANUAL_REINT 0x0000
+#define SMB_CSC_CACHE_AUTO_REINT   0x0004
+#define SMB_CSC_CACHE_VDO          0x0008
+#define SMB_CSC_NO_CACHING         0x000C
+#define SMB_UNIQUE_FILE_NAME    0x0010
+#define SMB_EXTENDED_SIGNATURES 0x0020
+
+/* OpenFlags */
+#define REQ_MORE_INFO      0x00000001  /* legacy (OPEN_AND_X) only */
+#define REQ_OPLOCK         0x00000002
+#define REQ_BATCHOPLOCK    0x00000004
+#define REQ_OPENDIRONLY    0x00000008
+#define REQ_EXTENDED_INFO  0x00000010
+
+/* File type */
+#define DISK_TYPE               0x0000
+#define BYTE_PIPE_TYPE          0x0001
+#define MESSAGE_PIPE_TYPE       0x0002
+#define PRINTER_TYPE            0x0003
+#define COMM_DEV_TYPE           0x0004
+#define UNKNOWN_TYPE            0xFFFF
+
+/* Device Type or File Status Flags */
+#define NO_EAS                  0x0001
+#define NO_SUBSTREAMS           0x0002
+#define NO_REPARSETAG           0x0004
+/* following flags can apply if pipe */
+#define ICOUNT_MASK             0x00FF
+#define PIPE_READ_MODE          0x0100
+#define NAMED_PIPE_TYPE         0x0400
+#define PIPE_END_POINT          0x4000
+#define BLOCKING_NAMED_PIPE     0x8000
+
+/* ShareAccess flags */
+#define FILE_NO_SHARE     0x00000000
+#define FILE_SHARE_READ   0x00000001
+#define FILE_SHARE_WRITE  0x00000002
+#define FILE_SHARE_DELETE 0x00000004
+#define FILE_SHARE_ALL    0x00000007
+
+/* CreateDisposition flags, similar to CreateAction as well */
+#define FILE_SUPERSEDE    0x00000000
+#define FILE_OPEN         0x00000001
+#define FILE_CREATE       0x00000002
+#define FILE_OPEN_IF      0x00000003
+#define FILE_OVERWRITE    0x00000004
+#define FILE_OVERWRITE_IF 0x00000005
+
+/* ImpersonationLevel flags */
+#define SECURITY_ANONYMOUS      0
+#define SECURITY_IDENTIFICATION 1
+#define SECURITY_IMPERSONATION  2
+#define SECURITY_DELEGATION     3
+
+/* SecurityFlags */
+#define SECURITY_CONTEXT_TRACKING 0x01
+#define SECURITY_EFFECTIVE_ONLY   0x02
+
+struct smb_com_open_req {       /* also handles create */
+	struct smb_hdr hdr;     /* wct = 24 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__u8 Reserved;          /* Must Be Zero */
+	__le16 NameLength;
+	__le32 OpenFlags;
+	__u32  RootDirectoryFid;
+	__le32 DesiredAccess;
+	__le64 AllocationSize;
+	__le32 FileAttributes;
+	__le32 ShareAccess;
+	__le32 CreateDisposition;
+	__le32 CreateOptions;
+	__le32 ImpersonationLevel;
+	__u8 SecurityFlags;
+	__le16 ByteCount;
+	char fileName[1];
+} __packed;
+
+/* open response for CreateAction shifted left */
+#define CIFS_CREATE_ACTION 0x20000 /* file created */
+
+/* Basic file attributes */
+#define SMB_FILE_ATTRIBUTE_NORMAL	0x0000
+#define SMB_FILE_ATTRIBUTE_READONLY	0x0001
+#define SMB_FILE_ATTRIBUTE_HIDDEN	0x0002
+#define SMB_FILE_ATTRIBUTE_SYSTEM	0x0004
+#define SMB_FILE_ATTRIBUTE_VOLUME	0x0008
+#define SMB_FILE_ATTRIBUTE_DIRECTORY	0x0010
+#define SMB_FILE_ATTRIBUTE_ARCHIVE	0x0020
+#define SMB_SEARCH_ATTRIBUTE_READONLY	0x0100
+#define SMB_SEARCH_ATTRIBUTE_HIDDEN	0x0200
+#define SMB_SEARCH_ATTRIBUTE_SYSTEM	0x0400
+#define SMB_SEARCH_ATTRIBUTE_DIRECTORY	0x1000
+#define SMB_SEARCH_ATTRIBUTE_ARCHIVE	0x2000
+
+struct smb_com_open_rsp {
+	struct smb_hdr hdr;     /* wct = 34 BB */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__u8 OplockLevel;
+	__u16 Fid;
+	__le32 CreateAction;
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le32 FileAttributes;
+	__le64 AllocationSize;
+	__le64 EndOfFile;
+	__le16 FileType;
+	__le16 DeviceState;
+	__u8 DirectoryFlag;
+	__le16 ByteCount;        /* bct = 0 */
+} __packed;
+
+struct smb_com_open_ext_rsp {
+	struct smb_hdr hdr;     /* wct = 42 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__u8 OplockLevel;
+	__u16 Fid;
+	__le32 CreateAction;
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le32 FileAttributes;
+	__le64 AllocationSize;
+	__le64 EndOfFile;
+	__le16 FileType;
+	__le16 DeviceState;
+	__u8 DirectoryFlag;
+	__u8 VolId[16];
+	__u64 fid;
+	__le32 MaxAccess;
+	__le32 GuestAccess;
+	__le16 ByteCount;        /* bct = 0 */
+} __packed;
+
+struct smb_com_close_req {
+	struct smb_hdr hdr;     /* wct = 3 */
+	__u16 FileID;
+	__le32 LastWriteTime;    /* should be zero or -1 */
+	__le16  ByteCount;        /* 0 */
+} __packed;
+
+struct smb_com_close_rsp {
+	struct smb_hdr hdr;     /* wct = 0 */
+	__le16 ByteCount;        /* bct = 0 */
+} __packed;
+
+struct smb_com_echo_req {
+	struct  smb_hdr hdr;
+	__le16  EchoCount;
+	__le16  ByteCount;
+	char    Data[1];
+} __packed;
+
+struct smb_com_echo_rsp {
+	struct  smb_hdr hdr;
+	__le16  SequenceNumber;
+	__le16  ByteCount;
+	char    Data[1];
+} __packed;
+
+struct smb_com_flush_req {
+	struct smb_hdr hdr;     /* wct = 1 */
+	__u16 FileID;
+	__le16 ByteCount;        /* 0 */
+} __packed;
+
+struct smb_com_flush_rsp {
+	struct smb_hdr hdr;     /* wct = 0 */
+	__le16 ByteCount;        /* bct = 0 */
+} __packed;
+
+/* SMB_COM_TRANSACTION */
+struct smb_com_trans_req {
+	struct smb_hdr hdr;
+	__le16 TotalParameterCount;
+	__le16 TotalDataCount;
+	__le16 MaxParameterCount;
+	__le16 MaxDataCount;
+	__u8 MaxSetupCount;
+	__u8 Reserved;
+	__le16 Flags;
+	__le32 Timeout;
+	__u16 Reserved2;
+	__le16 ParameterCount;
+	__le16 ParameterOffset;
+	__le16 DataCount;
+	__le16 DataOffset;
+	__u8 SetupCount;
+	__u8 Reserved3;
+	__le16 SubCommand;
+	__u8  Pad;
+	__u8 Data[1];
+} __packed;
+
+struct smb_com_trans_pipe_req {
+	struct smb_hdr hdr;
+	__le16 TotalParameterCount;
+	__le16 TotalDataCount;
+	__le16 MaxParameterCount;
+	__le16 MaxDataCount;
+	__u8 MaxSetupCount;
+	__u8 Reserved;
+	__le16 Flags;
+	__le32 Timeout;
+	__u16 Reserved2;
+	__le16 ParameterCount;
+	__le16 ParameterOffset;
+	__le16 DataCount;
+	__le16 DataOffset;
+	__u8 SetupCount;
+	__u8 Reserved3;
+	__u16 SubCommand;
+	__u16 fid;
+	__le16 ByteCount;
+	__u8  Pad;
+	__u8 Data[1];
+} __packed;
+
+struct smb_com_trans_rsp {
+	struct smb_hdr hdr;     /* wct = 10+ */
+	__le16 TotalParameterCount;
+	__le16 TotalDataCount;
+	__u16 Reserved;
+	__le16 ParameterCount;
+	__le16 ParameterOffset;
+	__le16 ParameterDisplacement;
+	__le16 DataCount;
+	__le16 DataOffset;
+	__le16 DataDisplacement;
+	__u8 SetupCount;
+	__u8 Reserved1;
+	__le16 ByteCount;
+	__u8 Pad;
+} __packed;
+
+/* SMB_COM_TRANSACTION subcommands */
+
+#define TRANSACT_DCERPCCMD	0x26
+
+/*****************************************************************************
+ * TRANS2 command implementation functions
+ *****************************************************************************/
+#define NO_CHANGE_64          0xFFFFFFFFFFFFFFFFULL
+
+/* QFSInfo Levels */
+#define SMB_INFO_ALLOCATION         1
+#define SMB_INFO_VOLUME             2
+#define SMB_QUERY_FS_VOLUME_INFO    0x102
+#define SMB_QUERY_FS_SIZE_INFO      0x103
+#define SMB_QUERY_FS_DEVICE_INFO    0x104
+#define SMB_QUERY_FS_ATTRIBUTE_INFO 0x105
+#define SMB_QUERY_CIFS_UNIX_INFO    0x200
+#define SMB_QUERY_POSIX_FS_INFO     0x201
+#define SMB_QUERY_POSIX_WHO_AM_I    0x202
+#define SMB_REQUEST_TRANSPORT_ENCRYPTION 0x203
+#define SMB_QUERY_FS_PROXY          0x204 /*
+					   * WAFS enabled. Returns structure
+					   * FILE_SYSTEM__UNIX_INFO to tell
+					   * whether new NTIOCTL available
+					   * (0xACE) for WAN friendly SMB
+					   * operations to be carried
+					   */
+#define SMB_QUERY_LABEL_INFO        0x3ea
+#define SMB_QUERY_FS_QUOTA_INFO     0x3ee
+#define SMB_QUERY_FS_FULL_SIZE_INFO 0x3ef
+#define SMB_QUERY_OBJECTID_INFO     0x3f0
+
+struct trans2_resp {
+	/* struct smb_hdr hdr precedes. Note wct = 10 + setup count */
+	__le16 TotalParameterCount;
+	__le16 TotalDataCount;
+	__u16 Reserved;
+	__le16 ParameterCount;
+	__le16 ParameterOffset;
+	__le16 ParameterDisplacement;
+	__le16 DataCount;
+	__le16 DataOffset;
+	__le16 DataDisplacement;
+	__u8 SetupCount;
+	__u8 Reserved1;
+	/*
+	 * SetupWords[SetupCount];
+	 * __u16 ByteCount;
+	 * __u16 Reserved2;
+	 */
+	/* data area follows */
+} __packed;
+
+struct smb_com_trans2_req {
+	struct smb_hdr hdr;
+	__le16 TotalParameterCount;
+	__le16 TotalDataCount;
+	__le16 MaxParameterCount;
+	__le16 MaxDataCount;
+	__u8 MaxSetupCount;
+	__u8 Reserved;
+	__le16 Flags;
+	__le32 Timeout;
+	__u16 Reserved2;
+	__le16 ParameterCount;
+	__le16 ParameterOffset;
+	__le16 DataCount;
+	__le16 DataOffset;
+	__u8 SetupCount;
+	__u8 Reserved3;
+	__le16 SubCommand;      /* one setup word */
+} __packed;
+
+struct smb_com_trans2_qfsi_req {
+	struct smb_hdr hdr;     /* wct = 14+ */
+	__le16 TotalParameterCount;
+	__le16 TotalDataCount;
+	__le16 MaxParameterCount;
+	__le16 MaxDataCount;
+	__u8 MaxSetupCount;
+	__u8 Reserved;
+	__le16 Flags;
+	__le32 Timeout;
+	__u16 Reserved2;
+	__le16 ParameterCount;
+	__le16 ParameterOffset;
+	__le16 DataCount;
+	__le16 DataOffset;
+	__u8 SetupCount;
+	__u8 Reserved3;
+	__le16 SubCommand;      /* one setup word */
+	__le16 ByteCount;
+	__u8 Pad;
+	__le16 InformationLevel;
+} __packed;
+
+struct smb_com_trans2_qfsi_req_params {
+	__le16 InformationLevel;
+} __packed;
+
+#define CIFS_SEARCH_CLOSE_ALWAYS	0x0001
+#define CIFS_SEARCH_CLOSE_AT_END	0x0002
+#define CIFS_SEARCH_RETURN_RESUME	0x0004
+#define CIFS_SEARCH_CONTINUE_FROM_LAST	0x0008
+#define CIFS_SEARCH_BACKUP_SEARCH	0x0010
+
+struct smb_com_trans2_ffirst_req_params {
+	__le16 SearchAttributes;
+	__le16 SearchCount;
+	__le16 SearchFlags;
+	__le16 InformationLevel;
+	__le32 SearchStorageType;
+	char FileName[1];
+} __packed;
+
+struct smb_com_trans2_ffirst_rsp_parms {
+	__u16 SearchHandle;
+	__le16 SearchCount;
+	__le16 EndofSearch;
+	__le16 EAErrorOffset;
+	__le16 LastNameOffset;
+} __packed;
+
+struct smb_com_trans2_fnext_req_params {
+	__u16 SearchHandle;
+	__le16 SearchCount;
+	__le16 InformationLevel;
+	__u32 ResumeKey;
+	__le16 SearchFlags;
+	char ResumeFileName[1];
+} __packed;
+
+struct smb_com_trans2_fnext_rsp_params {
+	__le16 SearchCount;
+	__le16 EndofSearch;
+	__le16 EAErrorOffset;
+	__le16 LastNameOffset;
+} __packed;
+
+struct smb_com_trans2_rsp {
+	struct smb_hdr hdr;     /* wct = 10 + SetupCount */
+	struct trans2_resp t2;
+	__le16 ByteCount;
+	__u8 Pad;       /* may be three bytes? *//* followed by data area */
+	__u8 Buffer[0];
+} __packed;
+
+struct file_internal_info {
+	__le64  UniqueId; /* inode number */
+} __packed;      /* level 0x3ee */
+
+/* DeviceType Flags */
+#define FILE_DEVICE_CD_ROM              0x00000002
+#define FILE_DEVICE_CD_ROM_FILE_SYSTEM  0x00000003
+#define FILE_DEVICE_DFS                 0x00000006
+#define FILE_DEVICE_DISK                0x00000007
+#define FILE_DEVICE_DISK_FILE_SYSTEM    0x00000008
+#define FILE_DEVICE_FILE_SYSTEM         0x00000009
+#define FILE_DEVICE_NAMED_PIPE          0x00000011
+#define FILE_DEVICE_NETWORK             0x00000012
+#define FILE_DEVICE_NETWORK_FILE_SYSTEM 0x00000014
+#define FILE_DEVICE_NULL                0x00000015
+#define FILE_DEVICE_PARALLEL_PORT       0x00000016
+#define FILE_DEVICE_PRINTER             0x00000018
+#define FILE_DEVICE_SERIAL_PORT         0x0000001b
+#define FILE_DEVICE_STREAMS             0x0000001e
+#define FILE_DEVICE_TAPE                0x0000001f
+#define FILE_DEVICE_TAPE_FILE_SYSTEM    0x00000020
+#define FILE_DEVICE_VIRTUAL_DISK        0x00000024
+#define FILE_DEVICE_NETWORK_REDIRECTOR  0x00000028
+
+/* Filesystem Attributes. */
+#define FILE_CASE_SENSITIVE_SEARCH      0x00000001
+#define FILE_CASE_PRESERVED_NAMES       0x00000002
+#define FILE_UNICODE_ON_DISK            0x00000004
+/* According to cifs9f, this is 4, not 8 */
+/* Acconding to testing, this actually sets the security attribute! */
+#define FILE_PERSISTENT_ACLS            0x00000008
+#define FILE_FILE_COMPRESSION           0x00000010
+#define FILE_VOLUME_QUOTAS              0x00000020
+#define FILE_SUPPORTS_SPARSE_FILES      0x00000040
+#define FILE_SUPPORTS_REPARSE_POINTS    0x00000080
+#define FILE_SUPPORTS_REMOTE_STORAGE    0x00000100
+#define FS_LFN_APIS                     0x00004000
+#define FILE_VOLUME_IS_COMPRESSED       0x00008000
+#define FILE_SUPPORTS_OBJECT_IDS        0x00010000
+#define FILE_SUPPORTS_ENCRYPTION        0x00020000
+#define FILE_NAMED_STREAMS              0x00040000
+#define FILE_READ_ONLY_VOLUME           0x00080000
+
+/* PathInfo/FileInfo infolevels */
+#define SMB_INFO_STANDARD                   1
+#define SMB_SET_FILE_EA                     2
+#define SMB_QUERY_FILE_EA_SIZE              2
+#define SMB_INFO_QUERY_EAS_FROM_LIST        3
+#define SMB_INFO_QUERY_ALL_EAS              4
+#define SMB_INFO_IS_NAME_VALID              6
+#define SMB_QUERY_FILE_BASIC_INFO       0x101
+#define SMB_QUERY_FILE_STANDARD_INFO    0x102
+#define SMB_QUERY_FILE_EA_INFO          0x103
+#define SMB_QUERY_FILE_NAME_INFO        0x104
+#define SMB_QUERY_FILE_ALLOCATION_INFO  0x105
+#define SMB_QUERY_FILE_END_OF_FILEINFO  0x106
+#define SMB_QUERY_FILE_ALL_INFO         0x107
+#define SMB_QUERY_ALT_NAME_INFO         0x108
+#define SMB_QUERY_FILE_STREAM_INFO      0x109
+#define SMB_QUERY_FILE_COMPRESSION_INFO 0x10B
+#define SMB_QUERY_FILE_UNIX_BASIC       0x200
+#define SMB_QUERY_FILE_UNIX_LINK        0x201
+#define SMB_QUERY_POSIX_ACL             0x204
+#define SMB_QUERY_XATTR                 0x205  /* e.g. system EA name space */
+#define SMB_QUERY_ATTR_FLAGS            0x206  /* append,immutable etc. */
+#define SMB_QUERY_POSIX_PERMISSION      0x207
+#define SMB_QUERY_POSIX_LOCK            0x208
+/* #define SMB_POSIX_OPEN               0x209 */
+/* #define SMB_POSIX_UNLINK             0x20a */
+#define SMB_QUERY_FILE__UNIX_INFO2      0x20b
+#define SMB_QUERY_FILE_INTERNAL_INFO    0x3ee
+#define SMB_QUERY_FILE_ACCESS_INFO      0x3f0
+#define SMB_QUERY_FILE_NAME_INFO2       0x3f1 /* 0x30 bytes */
+#define SMB_QUERY_FILE_POSITION_INFO    0x3f6
+#define SMB_QUERY_FILE_MODE_INFO        0x3f8
+#define SMB_QUERY_FILE_ALGN_INFO        0x3f9
+
+
+#define SMB_SET_FILE_BASIC_INFO         0x101
+#define SMB_SET_FILE_DISPOSITION_INFO   0x102
+#define SMB_SET_FILE_ALLOCATION_INFO    0x103
+#define SMB_SET_FILE_END_OF_FILE_INFO   0x104
+#define SMB_SET_FILE_UNIX_BASIC         0x200
+#define SMB_SET_FILE_UNIX_LINK          0x201
+#define SMB_SET_FILE_UNIX_HLINK         0x203
+#define SMB_SET_POSIX_ACL               0x204
+#define SMB_SET_XATTR                   0x205
+#define SMB_SET_ATTR_FLAGS              0x206  /* append, immutable etc. */
+#define SMB_SET_POSIX_LOCK              0x208
+#define SMB_POSIX_OPEN                  0x209
+#define SMB_POSIX_UNLINK                0x20a
+#define SMB_SET_FILE_UNIX_INFO2         0x20b
+#define SMB_SET_FILE_BASIC_INFO2        0x3ec
+#define SMB_SET_FILE_RENAME_INFORMATION 0x3f2 /* BB check if qpathinfo too */
+#define SMB_SET_FILE_DISPOSITION_INFORMATION   0x3f5   /* alias for 0x102 */
+#define SMB_FILE_ALL_INFO2              0x3fa
+#define SMB_SET_FILE_ALLOCATION_INFO2   0x3fb
+#define SMB_SET_FILE_END_OF_FILE_INFO2  0x3fc
+#define SMB_FILE_MOVE_CLUSTER_INFO      0x407
+#define SMB_FILE_QUOTA_INFO             0x408
+#define SMB_FILE_REPARSEPOINT_INFO      0x409
+#define SMB_FILE_MAXIMUM_INFO           0x40d
+
+/* Find File infolevels */
+#define SMB_FIND_FILE_INFO_STANDARD       0x001
+#define SMB_FIND_FILE_QUERY_EA_SIZE       0x002
+#define SMB_FIND_FILE_QUERY_EAS_FROM_LIST 0x003
+#define SMB_FIND_FILE_DIRECTORY_INFO      0x101
+#define SMB_FIND_FILE_FULL_DIRECTORY_INFO 0x102
+#define SMB_FIND_FILE_NAMES_INFO          0x103
+#define SMB_FIND_FILE_BOTH_DIRECTORY_INFO 0x104
+#define SMB_FIND_FILE_ID_FULL_DIR_INFO    0x105
+#define SMB_FIND_FILE_ID_BOTH_DIR_INFO    0x106
+#define SMB_FIND_FILE_UNIX                0x202
+
+struct smb_com_trans2_qpi_req {
+	struct smb_hdr hdr;     /* wct = 14+ */
+	__le16 TotalParameterCount;
+	__le16 TotalDataCount;
+	__le16 MaxParameterCount;
+	__le16 MaxDataCount;
+	__u8 MaxSetupCount;
+	__u8 Reserved;
+	__le16 Flags;
+	__le32 Timeout;
+	__u16 Reserved2;
+	__le16 ParameterCount;
+	__le16 ParameterOffset;
+	__le16 DataCount;
+	__le16 DataOffset;
+	__u8 SetupCount;
+	__u8 Reserved3;
+	__le16 SubCommand;      /* one setup word */
+	__le16 ByteCount;
+	__u8 Pad;
+	__le16 InformationLevel;
+	__u32 Reserved4;
+	char FileName[1];
+} __packed;
+
+struct trans2_qpi_req_params {
+	__le16 InformationLevel;
+	__u32 Reserved4;
+	char FileName[1];
+} __packed;
+
+/******************************************************************************/
+/* QueryFileInfo/QueryPathinfo (also for SetPath/SetFile) data buffer formats */
+/******************************************************************************/
+struct file_basic_info {
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le32 Attributes;
+	__u32 Pad;
+} __packed;      /* size info, level 0x101 */
+
+struct file_standard_info {
+	__le64 AllocationSize;
+	__le64 EndOfFile;
+	__le32 NumberOfLinks;
+	__u8 DeletePending;
+	__u8 Directory;
+	__le16 Reserved;
+} __packed;
+
+struct file_ea_info {
+	__le32 EaSize;
+} __packed;
+
+struct alt_name_info {
+	__le32 FileNameLength;
+	char FileName[1];
+} __packed;
+
+struct file_name_info {
+	__le32 FileNameLength;
+	char FileName[1];
+} __packed;
+
+/* data block encoding of response to level 263 QPathInfo */
+struct file_all_info {
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le32 Attributes;
+	__u32 Pad1;
+	__le64 AllocationSize;
+	__le64 EndOfFile;       /* size ie offset to first free byte in file */
+	__le32 NumberOfLinks;   /* hard links */
+	__u8 DeletePending;
+	__u8 Directory;
+	__u16 Pad2;
+	__le32 EASize;
+	__le32 FileNameLength;
+	char FileName[1];
+} __packed; /* level 0x107 QPathInfo */
+
+/* set path info/open file */
+/* defines for enumerating possible values of the Unix type field below */
+#define UNIX_FILE      0
+#define UNIX_DIR       1
+#define UNIX_SYMLINK   2
+#define UNIX_CHARDEV   3
+#define UNIX_BLOCKDEV  4
+#define UNIX_FIFO      5
+#define UNIX_SOCKET    6
+#define UNIX_UNKNOWN   0xFFFFFFFF
+
+struct file_unix_basic_info {
+	__le64 EndOfFile;
+	__le64 NumOfBytes;
+	__le64 LastStatusChange; /*SNIA specs DCE time for the 3 time fields */
+	__le64 LastAccessTime;
+	__le64 LastModificationTime;
+	__le64 Uid;
+	__le64 Gid;
+	__le32 Type;
+	__le64 DevMajor;
+	__le64 DevMinor;
+	__le64 UniqueId;
+	__le64 Permissions;
+	__le64 Nlinks;
+} __packed; /* level 0x200 QPathInfo */
+
+struct smb_com_trans2_spi_req {
+	struct smb_hdr hdr;     /* wct = 15 */
+	__le16 TotalParameterCount;
+	__le16 TotalDataCount;
+	__le16 MaxParameterCount;
+	__le16 MaxDataCount;
+	__u8 MaxSetupCount;
+	__u8 Reserved;
+	__le16 Flags;
+	__le32 Timeout;
+	__u16 Reserved2;
+	__le16 ParameterCount;
+	__le16 ParameterOffset;
+	__le16 DataCount;
+	__le16 DataOffset;
+	__u8 SetupCount;
+	__u8 Reserved3;
+	__le16 SubCommand;      /* one setup word */
+	__le16 ByteCount;
+	__u8 Pad;
+	__u16 Pad1;
+	__le16 InformationLevel;
+	__u32 Reserved4;
+	char FileName[1];
+} __packed;
+
+struct smb_com_trans2_spi_rsp {
+	struct smb_hdr hdr;     /* wct = 10 + SetupCount */
+	struct trans2_resp t2;
+	__le16 ByteCount;
+	__u16 Reserved2; /* parameter word is present for infolevels > 100 */
+} __packed;
+
+/* POSIX Open Flags */
+#define SMB_O_RDONLY     0x1
+#define SMB_O_WRONLY    0x2
+#define SMB_O_RDWR      0x4
+#define SMB_O_CREAT     0x10
+#define SMB_O_EXCL      0x20
+#define SMB_O_TRUNC     0x40
+#define SMB_O_APPEND    0x80
+#define SMB_O_SYNC      0x100
+#define SMB_O_DIRECTORY 0x200
+#define SMB_O_NOFOLLOW  0x400
+#define SMB_O_DIRECT    0x800
+#define SMB_ACCMODE	0x7
+
+/* info level response for SMB_POSIX_PATH_OPEN */
+#define SMB_NO_INFO_LEVEL_RESPONSE 0xFFFF
+
+struct open_psx_req {
+	__le32 OpenFlags; /* same as NT CreateX */
+	__le32 PosixOpenFlags;
+	__le64 Permissions;
+	__le16 Level; /* reply level requested (see QPathInfo levels) */
+} __packed; /* level 0x209 SetPathInfo data */
+
+struct open_psx_rsp {
+	__le16 OplockFlags;
+	__u16 Fid;
+	__le32 CreateAction;
+	__le16 ReturnedLevel;
+	__le16 Pad;
+	/* struct following varies based on requested level */
+} __packed; /* level 0x209 SetPathInfo data */
+
+struct unlink_psx_rsp {
+	__le16 EAErrorOffset;
+} __packed; /* level 0x209 SetPathInfo data*/
+
+/* Version numbers for CIFS UNIX major and minor. */
+#define CIFS_UNIX_MAJOR_VERSION 1
+#define CIFS_UNIX_MINOR_VERSION 0
+
+struct filesystem_unix_info {
+	__le16 MajorVersionNumber;
+	__le16 MinorVersionNumber;
+	__le64 Capability;
+} __packed; /* Unix extension level 0x200*/
+
+/* Linux/Unix extensions capability flags */
+#define CIFS_UNIX_FCNTL_CAP             0x00000001 /* support for fcntl locks */
+#define CIFS_UNIX_POSIX_ACL_CAP         0x00000002 /* support getfacl/setfacl */
+#define CIFS_UNIX_XATTR_CAP             0x00000004 /* support new namespace   */
+#define CIFS_UNIX_EXTATTR_CAP           0x00000008 /* support chattr/chflag   */
+#define CIFS_UNIX_POSIX_PATHNAMES_CAP   0x00000010 /* Allow POSIX path chars  */
+#define CIFS_UNIX_POSIX_PATH_OPS_CAP    0x00000020 /*
+						    * Allow new POSIX path based
+						    * calls including posix open
+						    * and posix unlink
+						    */
+#define CIFS_UNIX_LARGE_READ_CAP        0x00000040 /*
+						    * support reads >128K (up
+						    * to 0xFFFF00
+						    */
+#define CIFS_UNIX_LARGE_WRITE_CAP       0x00000080
+#define CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP 0x00000100 /* can do SPNEGO crypt */
+#define CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP  0x00000200 /* must do  */
+#define CIFS_UNIX_PROXY_CAP             0x00000400 /*
+						    * Proxy cap: 0xACE ioctl and
+						    * QFS PROXY call
+						    */
+#ifdef CONFIG_CIFS_POSIX
+/* presumably don't need the 0x20 POSIX_PATH_OPS_CAP since we never send
+ * LockingX instead of posix locking call on unix sess (and we do not expect
+ * LockingX to use different (ie Windows) semantics than posix locking on
+ * the same session (if WINE needs to do this later, we can add this cap
+ * back in later
+ */
+
+/* #define CIFS_UNIX_CAP_MASK              0x000000fb */
+#define CIFS_UNIX_CAP_MASK              0x000003db
+#else
+#define CIFS_UNIX_CAP_MASK              0x00000013
+#endif /* CONFIG_CIFS_POSIX */
+
+
+#define CIFS_POSIX_EXTENSIONS           0x00000010 /* support for new QFSInfo */
+
+/* Our server caps */
+
+#define SMB_UNIX_CAPS	(CIFS_UNIX_FCNTL_CAP | CIFS_UNIX_POSIX_ACL_CAP | \
+		CIFS_UNIX_XATTR_CAP | CIFS_UNIX_POSIX_PATHNAMES_CAP| \
+		CIFS_UNIX_POSIX_PATH_OPS_CAP | CIFS_UNIX_LARGE_READ_CAP | \
+		CIFS_UNIX_LARGE_WRITE_CAP)
+
+#define SMB_SET_CIFS_UNIX_INFO    0x200
+/* Level 0x200 request structure follows */
+struct smb_com_trans2_setfsi_req {
+	struct smb_hdr hdr;     /* wct = 15 */
+	__le16 TotalParameterCount;
+	__le16 TotalDataCount;
+	__le16 MaxParameterCount;
+	__le16 MaxDataCount;
+	__u8 MaxSetupCount;
+	__u8 Reserved;
+	__le16 Flags;
+	__le32 Timeout;
+	__u16 Reserved2;
+	__le16 ParameterCount;  /* 4 */
+	__le16 ParameterOffset;
+	__le16 DataCount;       /* 12 */
+	__le16 DataOffset;
+	__u8 SetupCount;        /* one */
+	__u8 Reserved3;
+	__le16 SubCommand;      /* TRANS2_SET_FS_INFORMATION */
+	__le16 ByteCount;
+	__u8 Pad;
+	__u16 FileNum;          /* Parameters start. */
+	__le16 InformationLevel;/* Parameters end. */
+	__le16 ClientUnixMajor; /* Data start. */
+	__le16 ClientUnixMinor;
+	__le64 ClientUnixCap;   /* Data end */
+} __packed;
+
+/* response for setfsinfo levels 0x200 and 0x203 */
+struct smb_com_trans2_setfsi_rsp {
+	struct smb_hdr hdr;     /* wct = 10 */
+	struct trans2_resp t2;
+	__le16 ByteCount;
+} __packed;
+
+struct smb_trans2_qfi_req_params {
+	__u16   Fid;
+	__le16  InformationLevel;
+} __packed;
+
+/* FIND FIRST2 and FIND NEXT2 INFORMATION Level Codes*/
+
+struct find_info_standard {
+	__le16 CreationDate; /* SMB Date see above */
+	__le16 CreationTime; /* SMB Time */
+	__le16 LastAccessDate;
+	__le16 LastAccessTime;
+	__le16 LastWriteDate;
+	__le16 LastWriteTime;
+	__le32 DataSize; /* File Size (EOF) */
+	__le32 AllocationSize;
+	__le16 Attributes; /* verify not u32 */
+	__le16 FileNameLength;
+	char FileName[1];
+} __packed;
+
+struct find_info_query_ea_size {
+	__le16 CreationDate; /* SMB Date see above */
+	__le16 CreationTime; /* SMB Time */
+	__le16 LastAccessDate;
+	__le16 LastAccessTime;
+	__le16 LastWriteDate;
+	__le16 LastWriteTime;
+	__le32 DataSize; /* File Size (EOF) */
+	__le32 AllocationSize;
+	__le16 Attributes; /* verify not u32 */
+	__le32 EASize;
+	__u8 FileNameLength;
+	char FileName[1];
+} __packed;
+
+struct file_unix_info {
+	__le32 NextEntryOffset;
+	__u32 ResumeKey; /* as with FileIndex - no need to convert */
+	struct file_unix_basic_info basic;
+	char FileName[1];
+} __packed; /* level 0x202 */
+
+struct smb_com_trans2_sfi_req {
+	struct smb_hdr hdr;     /* wct = 15 */
+	__le16 TotalParameterCount;
+	__le16 TotalDataCount;
+	__le16 MaxParameterCount;
+	__le16 MaxDataCount;
+	__u8 MaxSetupCount;
+	__u8 Reserved;
+	__le16 Flags;
+	__le32 Timeout;
+	__u16 Reserved2;
+	__le16 ParameterCount;
+	__le16 ParameterOffset;
+	__le16 DataCount;
+	__le16 DataOffset;
+	__u8 SetupCount;
+	__u8 Reserved3;
+	__le16 SubCommand;      /* one setup word */
+	__le16 ByteCount;
+	__u8 Pad;
+	__u16 Pad1;
+	__u16 Fid;
+	__le16 InformationLevel;
+	__u16 Reserved4;
+} __packed;
+
+struct smb_com_trans2_sfi_rsp {
+	struct smb_hdr hdr;     /* wct = 10 + SetupCount */
+	struct trans2_resp t2;
+	__le16 ByteCount;
+	__u16 Reserved2;        /*
+				 * parameter word reserved -
+				 * present for infolevels > 100
+				 */
+} __packed;
+
+struct file_end_of_file_info {
+	__le64 FileSize;                /* offset to end of file */
+} __packed; /* size info, level 0x104 for set, 0x106 for query */
+
+struct smb_com_create_directory_req {
+	struct smb_hdr hdr;	/* wct = 0 */
+	__le16 ByteCount;
+	__u8 BufferFormat;	/* 4 = ASCII */
+	unsigned char DirName[1];
+} __packed;
+
+struct smb_com_create_directory_rsp {
+	struct smb_hdr hdr;	/* wct = 0 */
+	__le16 ByteCount;	/* bct = 0 */
+} __packed;
+
+struct smb_com_check_directory_req {
+	struct smb_hdr hdr;	/* wct = 0 */
+	__le16 ByteCount;
+	__u8 BufferFormat;	/* 4 = ASCII */
+	unsigned char DirName[1];
+} __packed;
+
+struct smb_com_check_directory_rsp {
+	struct smb_hdr hdr;	/* wct = 0 */
+	__le16 ByteCount;	/* bct = 0 */
+} __packed;
+
+struct smb_com_process_exit_rsp {
+	struct smb_hdr hdr;	/* wct = 0 */
+	__le16 ByteCount;	/* bct = 0 */
+} __packed;
+
+struct smb_com_delete_directory_req {
+	struct smb_hdr hdr;     /* wct = 0 */
+	__le16 ByteCount;
+	__u8 BufferFormat;      /* 4 = ASCII */
+	unsigned char DirName[1];
+} __packed;
+
+struct smb_com_delete_directory_rsp {
+	struct smb_hdr hdr;     /* wct = 0 */
+	__le16 ByteCount;        /* bct = 0 */
+} __packed;
+
+struct smb_com_delete_file_req {
+	struct smb_hdr hdr;     /* wct = 1 */
+	__le16 SearchAttributes;
+	__le16 ByteCount;
+	__u8 BufferFormat;      /* 4 = ASCII */
+	unsigned char fileName[1];
+} __packed;
+
+struct smb_com_delete_file_rsp {
+	struct smb_hdr hdr;     /* wct = 0 */
+	__le16 ByteCount;        /* bct = 0 */
+} __packed;
+
+#define CREATE_HARD_LINK         0x103
+
+struct smb_com_nt_rename_req {  /* A5 - also used for create hardlink */
+	struct smb_hdr hdr;     /* wct = 4 */
+	__le16 SearchAttributes;        /* target file attributes */
+	__le16 Flags;           /* spec says Information Level */
+	__le32 ClusterCount;
+	__le16 ByteCount;
+	__u8 BufferFormat;      /* 4 = ASCII or Unicode */
+	unsigned char OldFileName[1];
+	/* followed by __u8 BufferFormat2 */
+	/* followed by NewFileName */
+} __packed;
+
+struct smb_com_query_information_req {
+	struct smb_hdr hdr;     /* wct = 0 */
+	__le16 ByteCount;       /* 1 + namelen + 1 */
+	__u8 BufferFormat;      /* 4 = ASCII */
+	unsigned char FileName[1];
+} __packed;
+
+struct smb_com_query_information_rsp {
+	struct smb_hdr hdr;     /* wct = 10 */
+	__le16 attr;
+	__le32  last_write_time;
+	__le32 size;
+	__u16  reserved[5];
+	__le16 ByteCount;       /* bcc = 0 */
+} __packed;
+
+struct smb_com_findclose_req {
+	struct smb_hdr hdr; /* wct = 1 */
+	__u16 FileID;
+	__le16 ByteCount;    /* 0 */
+} __packed;
+
+#define SMBOPEN_DISPOSITION_NONE        0
+#define SMBOPEN_LOCK_GRANTED            0x8000
+
+#define SMB_DA_ACCESS_READ              0
+#define SMB_DA_ACCESS_WRITE             0x0001
+#define SMB_DA_ACCESS_READ_WRITE        0x0002
+
+/*
+ * Flags on SMB open
+ */
+#define SMBOPEN_WRITE_THROUGH 0x4000
+#define SMBOPEN_DENY_ALL      0x0010
+#define SMBOPEN_DENY_WRITE    0x0020
+#define SMBOPEN_DENY_READ     0x0030
+#define SMBOPEN_DENY_NONE     0x0040
+#define SMBOPEN_SHARING_MODE  (SMBOPEN_DENY_ALL |	\
+				SMBOPEN_DENY_WRITE |	\
+				SMBOPEN_DENY_READ |	\
+				SMBOPEN_DENY_NONE)
+#define SMBOPEN_READ          0x0000
+#define SMBOPEN_WRITE         0x0001
+#define SMBOPEN_READWRITE     0x0002
+#define SMBOPEN_EXECUTE       0x0003
+
+#define SMBOPEN_OCREATE       0x0010
+#define SMBOPEN_OTRUNC        0x0002
+#define SMBOPEN_OAPPEND       0x0001
+
+/* format of legacy open request */
+struct smb_com_openx_req {
+	struct smb_hdr  hdr;    /* wct = 15 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__le16 OpenFlags;
+	__le16 Mode;
+	__le16 Sattr; /* search attributes */
+	__le16 FileAttributes;  /* dos attrs */
+	__le32 CreateTime; /* os2 format */
+	__le16 OpenFunction;
+	__le32 EndOfFile;
+	__le32 Timeout;
+	__le32 Reserved;
+	__le16  ByteCount;  /* file name follows */
+	char   fileName[1];
+} __packed;
+
+struct smb_com_openx_rsp {
+	struct smb_hdr  hdr;    /* wct = 15 */
+	__u8 AndXCommand;
+	__u8 AndXReserved;
+	__le16 AndXOffset;
+	__u16  Fid;
+	__le16 FileAttributes;
+	__le32 LastWriteTime; /* os2 format */
+	__le32 EndOfFile;
+	__le16 Access;
+	__le16 FileType;
+	__le16 IPCState;
+	__le16 Action;
+	__u32  FileId;
+	__u16  Reserved;
+	__le16 ByteCount;
+} __packed;
+
+struct filesystem_alloc_info {
+	__le32 fsid;
+	__le32 SectorsPerAllocationUnit;
+	__le32 TotalAllocationUnits;
+	__le32 FreeAllocationUnits;
+	__le16  BytesPerSector;
+} __packed;
+
+struct file_allocation_info {
+	__le64 AllocationSize; /* Note old Samba srvr rounds this up too much */
+} __packed;      /* size used on disk: 0x103 for set, 0x105 for query */
+
+struct file_info_standard {
+	__le16 CreationDate; /* SMB Date see above */
+	__le16 CreationTime; /* SMB Time */
+	__le16 LastAccessDate;
+	__le16 LastAccessTime;
+	__le16 LastWriteDate;
+	__le16 LastWriteTime;
+	__le32 DataSize; /* File Size (EOF) */
+	__le32 AllocationSize;
+	__le16 Attributes; /* verify not u32 */
+	__le32 EASize;
+} __packed;  /* level 1 SetPath/FileInfo */
+
+#define CIFS_MF_SYMLINK_LINK_MAXLEN (1024)
+
+struct set_file_rename {
+	__le32 overwrite;   /* 1 = overwrite dest */
+	__u32 root_fid;   /* zero */
+	__le32 target_name_len;
+	char  target_name[0];  /* Must be unicode */
+} __packed;
+
+struct fea {
+	unsigned char EA_flags;
+	__u8 name_len;
+	__le16 value_len;
+	char name[1];
+	/* optionally followed by value */
+} __packed;
+
+struct fealist {
+	__le32 list_len;
+	__u8 list[1];
+} __packed;
+
+/* POSIX ACL set/query path info structures */
+#define CIFS_ACL_VERSION 1
+struct cifs_posix_ace { /* access control entry (ACE) */
+	__u8  cifs_e_tag;
+	__u8  cifs_e_perm;
+	__le64 cifs_uid; /* or gid */
+} __packed;
+
+struct cifs_posix_acl { /* access conrol list  (ACL) */
+	__le16  version;
+	__le16  access_entry_count;  /* access ACL - count of entries */
+	__le16  default_entry_count; /* default ACL - count of entries */
+	struct cifs_posix_ace ace_array[0];
+	/*
+	 * followed by
+	 * struct cifs_posix_ace default_ace_arraay[]
+	 */
+} __packed;  /* level 0x204 */
+
+struct smb_com_setattr_req {
+	struct smb_hdr hdr; /* wct = 8 */
+	__le16 attr;
+	__le32 LastWriteTime;
+	__le16 reserved[5]; /* must be zero */
+	__le16 ByteCount;
+	__u8   BufferFormat; /* 4 = ASCII */
+	unsigned char fileName[1];
+} __packed;
+
+struct smb_com_setattr_rsp {
+	struct smb_hdr hdr;     /* wct = 0 */
+	__le16 ByteCount;        /* bct = 0 */
+} __packed;
+
+extern int init_smb1_server(struct ksmbd_conn *conn);
+
+/* function prototypes */
+extern int init_smb_rsp_hdr(struct ksmbd_work *work);
+extern uint16_t get_smb_cmd_val(struct ksmbd_work *work);
+extern void set_smb_rsp_status(struct ksmbd_work *work, __le32 err);
+extern int smb_allocate_rsp_buf(struct ksmbd_work *work);
+extern bool smb1_is_sign_req(struct ksmbd_work *work, unsigned int command);
+extern int smb1_check_sign_req(struct ksmbd_work *work);
+extern void smb1_set_sign_rsp(struct ksmbd_work *work);
+extern int smb_check_user_session(struct ksmbd_work *work);
+extern int smb_get_ksmbd_tcon(struct ksmbd_work *work);
+extern int ksmbd_smb1_check_message(struct ksmbd_work *work);
+
+/* smb1 command handlers */
+extern int smb_rename(struct ksmbd_work *work);
+extern int smb_negotiate_request(struct ksmbd_work *work);
+extern int smb_handle_negotiate(struct ksmbd_work *work);
+extern int smb_session_setup_andx(struct ksmbd_work *work);
+extern int smb_tree_connect_andx(struct ksmbd_work *work);
+extern int smb_trans2(struct ksmbd_work *work);
+extern int smb_nt_create_andx(struct ksmbd_work *work);
+extern int smb_trans(struct ksmbd_work *work);
+extern int smb_locking_andx(struct ksmbd_work *work);
+extern int smb_close(struct ksmbd_work *work);
+extern int smb_read_andx(struct ksmbd_work *work);
+extern int smb_tree_disconnect(struct ksmbd_work *work);
+extern int smb_session_disconnect(struct ksmbd_work *work);
+extern int smb_write_andx(struct ksmbd_work *work);
+extern int smb_echo(struct ksmbd_work *work);
+extern int smb_flush(struct ksmbd_work *work);
+extern int smb_mkdir(struct ksmbd_work *work);
+extern int smb_rmdir(struct ksmbd_work *work);
+extern int smb_unlink(struct ksmbd_work *work);
+extern int smb_nt_cancel(struct ksmbd_work *work);
+extern int smb_nt_rename(struct ksmbd_work *work);
+extern int smb_query_info(struct ksmbd_work *work);
+extern int smb_closedir(struct ksmbd_work *work);
+extern int smb_open_andx(struct ksmbd_work *work);
+extern int smb_write(struct ksmbd_work *work);
+extern int smb_setattr(struct ksmbd_work *work);
+extern int smb_checkdir(struct ksmbd_work *work);
+extern int smb_process_exit(struct ksmbd_work *work);
+#endif /* __SMB1PDU_H */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smb2misc.c linux-5.4.60-fbx/fs/cifsd/smb2misc.c
--- linux-5.4.60-fbx/fs/cifsd./smb2misc.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smb2misc.c	2021-04-21 09:44:50.978505152 +0200
@@ -0,0 +1,435 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include "glob.h"
+#include "nterr.h"
+#include "smb2pdu.h"
+#include "smb_common.h"
+#include "smbstatus.h"
+#include "mgmt/user_session.h"
+#include "connection.h"
+
+static int check_smb2_hdr(struct smb2_hdr *hdr)
+{
+	/*
+	 * Make sure that this really is an SMB, that it is a response.
+	 */
+	if (hdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR)
+		return 1;
+	return 0;
+}
+
+/*
+ *  The following table defines the expected "StructureSize" of SMB2 requests
+ *  in order by SMB2 command.  This is similar to "wct" in SMB/CIFS requests.
+ *
+ *  Note that commands are defined in smb2pdu.h in le16 but the array below is
+ *  indexed by command in host byte order
+ */
+static const __le16 smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = {
+	/* SMB2_NEGOTIATE */ cpu_to_le16(36),
+	/* SMB2_SESSION_SETUP */ cpu_to_le16(25),
+	/* SMB2_LOGOFF */ cpu_to_le16(4),
+	/* SMB2_TREE_CONNECT */ cpu_to_le16(9),
+	/* SMB2_TREE_DISCONNECT */ cpu_to_le16(4),
+	/* SMB2_CREATE */ cpu_to_le16(57),
+	/* SMB2_CLOSE */ cpu_to_le16(24),
+	/* SMB2_FLUSH */ cpu_to_le16(24),
+	/* SMB2_READ */ cpu_to_le16(49),
+	/* SMB2_WRITE */ cpu_to_le16(49),
+	/* SMB2_LOCK */ cpu_to_le16(48),
+	/* SMB2_IOCTL */ cpu_to_le16(57),
+	/* SMB2_CANCEL */ cpu_to_le16(4),
+	/* SMB2_ECHO */ cpu_to_le16(4),
+	/* SMB2_QUERY_DIRECTORY */ cpu_to_le16(33),
+	/* SMB2_CHANGE_NOTIFY */ cpu_to_le16(32),
+	/* SMB2_QUERY_INFO */ cpu_to_le16(41),
+	/* SMB2_SET_INFO */ cpu_to_le16(33),
+	/* use 44 for lease break */
+	/* SMB2_OPLOCK_BREAK */ cpu_to_le16(36)
+};
+
+/*
+ * The size of the variable area depends on the offset and length fields
+ * located in different fields for various SMB2 requests. SMB2 requests
+ * with no variable length info, show an offset of zero for the offset field.
+ */
+static const bool has_smb2_data_area[NUMBER_OF_SMB2_COMMANDS] = {
+	/* SMB2_NEGOTIATE */ true,
+	/* SMB2_SESSION_SETUP */ true,
+	/* SMB2_LOGOFF */ false,
+	/* SMB2_TREE_CONNECT */	true,
+	/* SMB2_TREE_DISCONNECT */ false,
+	/* SMB2_CREATE */ true,
+	/* SMB2_CLOSE */ false,
+	/* SMB2_FLUSH */ false,
+	/* SMB2_READ */	true,
+	/* SMB2_WRITE */ true,
+	/* SMB2_LOCK */	true,
+	/* SMB2_IOCTL */ true,
+	/* SMB2_CANCEL */ false, /* BB CHECK this not listed in documentation */
+	/* SMB2_ECHO */ false,
+	/* SMB2_QUERY_DIRECTORY */ true,
+	/* SMB2_CHANGE_NOTIFY */ false,
+	/* SMB2_QUERY_INFO */ true,
+	/* SMB2_SET_INFO */ true,
+	/* SMB2_OPLOCK_BREAK */ false
+};
+
+/*
+ * Returns the pointer to the beginning of the data area. Length of the data
+ * area and the offset to it (from the beginning of the smb are also returned.
+ */
+static char *smb2_get_data_area_len(int *off, int *len, struct smb2_hdr *hdr)
+{
+	*off = 0;
+	*len = 0;
+
+	/* error reqeusts do not have data area */
+	if (hdr->Status && hdr->Status != STATUS_MORE_PROCESSING_REQUIRED &&
+	    (((struct smb2_err_rsp *)hdr)->StructureSize) == SMB2_ERROR_STRUCTURE_SIZE2_LE)
+		return NULL;
+
+	/*
+	 * Following commands have data areas so we have to get the location
+	 * of the data buffer offset and data buffer length for the particular
+	 * command.
+	 */
+	switch (hdr->Command) {
+	case SMB2_SESSION_SETUP:
+		*off = le16_to_cpu(((struct smb2_sess_setup_req *)hdr)->SecurityBufferOffset);
+		*len = le16_to_cpu(((struct smb2_sess_setup_req *)hdr)->SecurityBufferLength);
+		break;
+	case SMB2_TREE_CONNECT:
+		*off = le16_to_cpu(((struct smb2_tree_connect_req *)hdr)->PathOffset);
+		*len = le16_to_cpu(((struct smb2_tree_connect_req *)hdr)->PathLength);
+		break;
+	case SMB2_CREATE:
+	{
+		if (((struct smb2_create_req *)hdr)->CreateContextsLength) {
+			*off = le32_to_cpu(((struct smb2_create_req *)
+				hdr)->CreateContextsOffset);
+			*len = le32_to_cpu(((struct smb2_create_req *)
+				hdr)->CreateContextsLength);
+			break;
+		}
+
+		*off = le16_to_cpu(((struct smb2_create_req *)hdr)->NameOffset);
+		*len = le16_to_cpu(((struct smb2_create_req *)hdr)->NameLength);
+		break;
+	}
+	case SMB2_QUERY_INFO:
+		*off = le16_to_cpu(((struct smb2_query_info_req *)hdr)->InputBufferOffset);
+		*len = le32_to_cpu(((struct smb2_query_info_req *)hdr)->InputBufferLength);
+		break;
+	case SMB2_SET_INFO:
+		*off = le16_to_cpu(((struct smb2_set_info_req *)hdr)->BufferOffset);
+		*len = le32_to_cpu(((struct smb2_set_info_req *)hdr)->BufferLength);
+		break;
+	case SMB2_READ:
+		*off = le16_to_cpu(((struct smb2_read_req *)hdr)->ReadChannelInfoOffset);
+		*len = le16_to_cpu(((struct smb2_read_req *)hdr)->ReadChannelInfoLength);
+		break;
+	case SMB2_WRITE:
+		if (((struct smb2_write_req *)hdr)->DataOffset) {
+			*off = le16_to_cpu(((struct smb2_write_req *)hdr)->DataOffset);
+			*len = le32_to_cpu(((struct smb2_write_req *)hdr)->Length);
+			break;
+		}
+
+		*off = le16_to_cpu(((struct smb2_write_req *)hdr)->WriteChannelInfoOffset);
+		*len = le16_to_cpu(((struct smb2_write_req *)hdr)->WriteChannelInfoLength);
+		break;
+	case SMB2_QUERY_DIRECTORY:
+		*off = le16_to_cpu(((struct smb2_query_directory_req *)hdr)->FileNameOffset);
+		*len = le16_to_cpu(((struct smb2_query_directory_req *)hdr)->FileNameLength);
+		break;
+	case SMB2_LOCK:
+	{
+		int lock_count;
+
+		/*
+		 * smb2_lock request size is 48 included single
+		 * smb2_lock_element structure size.
+		 */
+		lock_count = le16_to_cpu(((struct smb2_lock_req *)hdr)->LockCount) - 1;
+		if (lock_count > 0) {
+			*off = __SMB2_HEADER_STRUCTURE_SIZE + 48;
+			*len = sizeof(struct smb2_lock_element) * lock_count;
+		}
+		break;
+	}
+	case SMB2_IOCTL:
+		*off = le32_to_cpu(((struct smb2_ioctl_req *)hdr)->InputOffset);
+		*len = le32_to_cpu(((struct smb2_ioctl_req *)hdr)->InputCount);
+
+		break;
+	default:
+		ksmbd_debug(SMB, "no length check for command\n");
+		break;
+	}
+
+	/*
+	 * Invalid length or offset probably means data area is invalid, but
+	 * we have little choice but to ignore the data area in this case.
+	 */
+	if (*off > 4096) {
+		ksmbd_debug(SMB, "offset %d too large, data area ignored\n",
+			*off);
+		*len = 0;
+		*off = 0;
+	} else if (*off < 0) {
+		ksmbd_debug(SMB,
+			"negative offset %d to data invalid ignore data area\n",
+			*off);
+		*off = 0;
+		*len = 0;
+	} else if (*len < 0) {
+		ksmbd_debug(SMB,
+			"negative data length %d invalid, data area ignored\n",
+			*len);
+		*len = 0;
+	} else if (*len > 128 * 1024) {
+		ksmbd_debug(SMB, "data area larger than 128K: %d\n", *len);
+		*len = 0;
+	}
+
+	/* return pointer to beginning of data area, ie offset from SMB start */
+	if ((*off != 0) && (*len != 0))
+		return (char *)hdr + *off;
+	else
+		return NULL;
+}
+
+/*
+ * Calculate the size of the SMB message based on the fixed header
+ * portion, the number of word parameters and the data portion of the message.
+ */
+static unsigned int smb2_calc_size(void *buf)
+{
+	struct smb2_pdu *pdu = (struct smb2_pdu *)buf;
+	struct smb2_hdr *hdr = &pdu->hdr;
+	int offset; /* the offset from the beginning of SMB to data area */
+	int data_length; /* the length of the variable length data area */
+	/* Structure Size has already been checked to make sure it is 64 */
+	int len = le16_to_cpu(hdr->StructureSize);
+
+	/*
+	 * StructureSize2, ie length of fixed parameter area has already
+	 * been checked to make sure it is the correct length.
+	 */
+	len += le16_to_cpu(pdu->StructureSize2);
+
+	if (has_smb2_data_area[le16_to_cpu(hdr->Command)] == false)
+		goto calc_size_exit;
+
+	smb2_get_data_area_len(&offset, &data_length, hdr);
+	ksmbd_debug(SMB, "SMB2 data length %d offset %d\n", data_length,
+		offset);
+
+	if (data_length > 0) {
+		/*
+		 * Check to make sure that data area begins after fixed area,
+		 * Note that last byte of the fixed area is part of data area
+		 * for some commands, typically those with odd StructureSize,
+		 * so we must add one to the calculation.
+		 */
+		if (offset + 1 < len)
+			ksmbd_debug(SMB,
+				"data area offset %d overlaps SMB2 header %d\n",
+					offset + 1, len);
+		else
+			len = offset + data_length;
+	}
+calc_size_exit:
+	ksmbd_debug(SMB, "SMB2 len %d\n", len);
+	return len;
+}
+
+static inline int smb2_query_info_req_len(struct smb2_query_info_req *h)
+{
+	return le32_to_cpu(h->InputBufferLength) +
+		le32_to_cpu(h->OutputBufferLength);
+}
+
+static inline int smb2_set_info_req_len(struct smb2_set_info_req *h)
+{
+	return le32_to_cpu(h->BufferLength);
+}
+
+static inline int smb2_read_req_len(struct smb2_read_req *h)
+{
+	return le32_to_cpu(h->Length);
+}
+
+static inline int smb2_write_req_len(struct smb2_write_req *h)
+{
+	return le32_to_cpu(h->Length);
+}
+
+static inline int smb2_query_dir_req_len(struct smb2_query_directory_req *h)
+{
+	return le32_to_cpu(h->OutputBufferLength);
+}
+
+static inline int smb2_ioctl_req_len(struct smb2_ioctl_req *h)
+{
+	return le32_to_cpu(h->InputCount) +
+		le32_to_cpu(h->OutputCount);
+}
+
+static inline int smb2_ioctl_resp_len(struct smb2_ioctl_req *h)
+{
+	return le32_to_cpu(h->MaxInputResponse) +
+		le32_to_cpu(h->MaxOutputResponse);
+}
+
+static int smb2_validate_credit_charge(struct smb2_hdr *hdr)
+{
+	int req_len = 0, expect_resp_len = 0, calc_credit_num, max_len;
+	int credit_charge = le16_to_cpu(hdr->CreditCharge);
+	void *__hdr = hdr;
+
+	switch (hdr->Command) {
+	case SMB2_QUERY_INFO:
+		req_len = smb2_query_info_req_len(__hdr);
+		break;
+	case SMB2_SET_INFO:
+		req_len = smb2_set_info_req_len(__hdr);
+		break;
+	case SMB2_READ:
+		req_len = smb2_read_req_len(__hdr);
+		break;
+	case SMB2_WRITE:
+		req_len = smb2_write_req_len(__hdr);
+		break;
+	case SMB2_QUERY_DIRECTORY:
+		req_len = smb2_query_dir_req_len(__hdr);
+		break;
+	case SMB2_IOCTL:
+		req_len = smb2_ioctl_req_len(__hdr);
+		expect_resp_len = smb2_ioctl_resp_len(__hdr);
+		break;
+	default:
+		return 0;
+	}
+
+	max_len = max(req_len, expect_resp_len);
+	calc_credit_num = DIV_ROUND_UP(max_len, SMB2_MAX_BUFFER_SIZE);
+	if (!credit_charge && max_len > SMB2_MAX_BUFFER_SIZE) {
+		ksmbd_err("credit charge is zero and payload size(%d) is bigger than 64K\n",
+			max_len);
+		return 1;
+	} else if (credit_charge < calc_credit_num) {
+		ksmbd_err("credit charge : %d, calc_credit_num : %d\n",
+			credit_charge, calc_credit_num);
+		return 1;
+	}
+
+	return 0;
+}
+
+int ksmbd_smb2_check_message(struct ksmbd_work *work)
+{
+	struct smb2_pdu *pdu = work->request_buf;
+	struct smb2_hdr *hdr = &pdu->hdr;
+	int command;
+	__u32 clc_len;  /* calculated length */
+	__u32 len = get_rfc1002_len(pdu);
+
+	if (work->next_smb2_rcv_hdr_off) {
+		pdu = REQUEST_BUF_NEXT(work);
+		hdr = &pdu->hdr;
+	}
+
+	if (le32_to_cpu(hdr->NextCommand) > 0) {
+		len = le32_to_cpu(hdr->NextCommand);
+	} else if (work->next_smb2_rcv_hdr_off) {
+		len -= work->next_smb2_rcv_hdr_off;
+		len = round_up(len, 8);
+	}
+
+	if (check_smb2_hdr(hdr))
+		return 1;
+
+	if (hdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) {
+		ksmbd_debug(SMB, "Illegal structure size %u\n",
+			le16_to_cpu(hdr->StructureSize));
+		return 1;
+	}
+
+	command = le16_to_cpu(hdr->Command);
+	if (command >= NUMBER_OF_SMB2_COMMANDS) {
+		ksmbd_debug(SMB, "Illegal SMB2 command %d\n", command);
+		return 1;
+	}
+
+	if (smb2_req_struct_sizes[command] != pdu->StructureSize2) {
+		if (command != SMB2_OPLOCK_BREAK_HE &&
+		    (hdr->Status == 0 || pdu->StructureSize2 != SMB2_ERROR_STRUCTURE_SIZE2_LE)) {
+			/* error packets have 9 byte structure size */
+			ksmbd_debug(SMB,
+				"Illegal request size %u for command %d\n",
+				le16_to_cpu(pdu->StructureSize2), command);
+			return 1;
+		} else if (command == SMB2_OPLOCK_BREAK_HE &&
+			   hdr->Status == 0 &&
+			   le16_to_cpu(pdu->StructureSize2) != OP_BREAK_STRUCT_SIZE_20 &&
+			   le16_to_cpu(pdu->StructureSize2) != OP_BREAK_STRUCT_SIZE_21) {
+			/* special case for SMB2.1 lease break message */
+			ksmbd_debug(SMB,
+				"Illegal request size %d for oplock break\n",
+				le16_to_cpu(pdu->StructureSize2));
+			return 1;
+		}
+	}
+
+	clc_len = smb2_calc_size(hdr);
+	if (len != clc_len) {
+		/* server can return one byte more due to implied bcc[0] */
+		if (clc_len == len + 1)
+			return 0;
+
+		/*
+		 * Some windows servers (win2016) will pad also the final
+		 * PDU in a compound to 8 bytes.
+		 */
+		if (ALIGN(clc_len, 8) == len)
+			return 0;
+
+		/*
+		 * windows client also pad up to 8 bytes when compounding.
+		 * If pad is longer than eight bytes, log the server behavior
+		 * (once), since may indicate a problem but allow it and
+		 * continue since the frame is parseable.
+		 */
+		if (clc_len < len) {
+			ksmbd_debug(SMB,
+				"cli req padded more than expected. Length %d not %d for cmd:%d mid:%llu\n",
+					len, clc_len, command,
+					le64_to_cpu(hdr->MessageId));
+			return 0;
+		}
+
+		if (command == SMB2_LOCK_HE && len == 88)
+			return 0;
+
+		ksmbd_debug(SMB,
+			"cli req too short, len %d not %d. cmd:%d mid:%llu\n",
+				len, clc_len, command,
+				le64_to_cpu(hdr->MessageId));
+
+		return 1;
+	}
+
+	return work->conn->vals->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU ?
+		smb2_validate_credit_charge(hdr) : 0;
+}
+
+int smb2_negotiate_request(struct ksmbd_work *work)
+{
+	return ksmbd_smb_negotiate_common(work, SMB2_NEGOTIATE_HE);
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smb2ops.c linux-5.4.60-fbx/fs/cifsd/smb2ops.c
--- linux-5.4.60-fbx/fs/cifsd./smb2ops.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smb2ops.c	2021-04-21 09:44:50.978505152 +0200
@@ -0,0 +1,345 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/slab.h>
+#include "glob.h"
+#include "smb2pdu.h"
+
+#include "auth.h"
+#include "connection.h"
+#include "smb_common.h"
+#include "server.h"
+#include "ksmbd_server.h"
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+static struct smb_version_values smb20_server_values = {
+	.version_string = SMB20_VERSION_STRING,
+	.protocol_id = SMB20_PROT_ID,
+	.capabilities = 0,
+	.max_read_size = CIFS_DEFAULT_IOSIZE,
+	.max_write_size = CIFS_DEFAULT_IOSIZE,
+	.max_trans_size = CIFS_DEFAULT_IOSIZE,
+	.large_lock_type = 0,
+	.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE,
+	.shared_lock_type = SMB2_LOCKFLAG_SHARED,
+	.unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
+	.header_size = sizeof(struct smb2_hdr),
+	.max_header_size = MAX_SMB2_HDR_SIZE,
+	.read_rsp_size = sizeof(struct smb2_read_rsp) - 1,
+	.lock_cmd = SMB2_LOCK,
+	.cap_unix = 0,
+	.cap_nt_find = SMB2_NT_FIND,
+	.cap_large_files = SMB2_LARGE_FILES,
+	.create_lease_size = sizeof(struct create_lease),
+	.create_durable_size = sizeof(struct create_durable_rsp),
+	.create_mxac_size = sizeof(struct create_mxac_rsp),
+	.create_disk_id_size = sizeof(struct create_disk_id_rsp),
+	.create_posix_size = sizeof(struct create_posix_rsp),
+};
+#endif
+
+static struct smb_version_values smb21_server_values = {
+	.version_string = SMB21_VERSION_STRING,
+	.protocol_id = SMB21_PROT_ID,
+	.capabilities = SMB2_GLOBAL_CAP_LARGE_MTU,
+	.max_read_size = SMB21_DEFAULT_IOSIZE,
+	.max_write_size = SMB21_DEFAULT_IOSIZE,
+	.max_trans_size = SMB21_DEFAULT_IOSIZE,
+	.large_lock_type = 0,
+	.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE,
+	.shared_lock_type = SMB2_LOCKFLAG_SHARED,
+	.unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
+	.header_size = sizeof(struct smb2_hdr),
+	.max_header_size = MAX_SMB2_HDR_SIZE,
+	.read_rsp_size = sizeof(struct smb2_read_rsp) - 1,
+	.lock_cmd = SMB2_LOCK,
+	.cap_unix = 0,
+	.cap_nt_find = SMB2_NT_FIND,
+	.cap_large_files = SMB2_LARGE_FILES,
+	.create_lease_size = sizeof(struct create_lease),
+	.create_durable_size = sizeof(struct create_durable_rsp),
+	.create_mxac_size = sizeof(struct create_mxac_rsp),
+	.create_disk_id_size = sizeof(struct create_disk_id_rsp),
+	.create_posix_size = sizeof(struct create_posix_rsp),
+};
+
+static struct smb_version_values smb30_server_values = {
+	.version_string = SMB30_VERSION_STRING,
+	.protocol_id = SMB30_PROT_ID,
+	.capabilities = SMB2_GLOBAL_CAP_LARGE_MTU,
+	.max_read_size = SMB3_DEFAULT_IOSIZE,
+	.max_write_size = SMB3_DEFAULT_IOSIZE,
+	.max_trans_size = SMB3_DEFAULT_TRANS_SIZE,
+	.large_lock_type = 0,
+	.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE,
+	.shared_lock_type = SMB2_LOCKFLAG_SHARED,
+	.unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
+	.header_size = sizeof(struct smb2_hdr),
+	.max_header_size = MAX_SMB2_HDR_SIZE,
+	.read_rsp_size = sizeof(struct smb2_read_rsp) - 1,
+	.lock_cmd = SMB2_LOCK,
+	.cap_unix = 0,
+	.cap_nt_find = SMB2_NT_FIND,
+	.cap_large_files = SMB2_LARGE_FILES,
+	.create_lease_size = sizeof(struct create_lease),
+	.create_durable_size = sizeof(struct create_durable_rsp),
+	.create_durable_v2_size = sizeof(struct create_durable_v2_rsp),
+	.create_mxac_size = sizeof(struct create_mxac_rsp),
+	.create_disk_id_size = sizeof(struct create_disk_id_rsp),
+	.create_posix_size = sizeof(struct create_posix_rsp),
+};
+
+static struct smb_version_values smb302_server_values = {
+	.version_string = SMB302_VERSION_STRING,
+	.protocol_id = SMB302_PROT_ID,
+	.capabilities = SMB2_GLOBAL_CAP_LARGE_MTU,
+	.max_read_size = SMB3_DEFAULT_IOSIZE,
+	.max_write_size = SMB3_DEFAULT_IOSIZE,
+	.max_trans_size = SMB3_DEFAULT_TRANS_SIZE,
+	.large_lock_type = 0,
+	.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE,
+	.shared_lock_type = SMB2_LOCKFLAG_SHARED,
+	.unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
+	.header_size = sizeof(struct smb2_hdr),
+	.max_header_size = MAX_SMB2_HDR_SIZE,
+	.read_rsp_size = sizeof(struct smb2_read_rsp) - 1,
+	.lock_cmd = SMB2_LOCK,
+	.cap_unix = 0,
+	.cap_nt_find = SMB2_NT_FIND,
+	.cap_large_files = SMB2_LARGE_FILES,
+	.create_lease_size = sizeof(struct create_lease),
+	.create_durable_size = sizeof(struct create_durable_rsp),
+	.create_durable_v2_size = sizeof(struct create_durable_v2_rsp),
+	.create_mxac_size = sizeof(struct create_mxac_rsp),
+	.create_disk_id_size = sizeof(struct create_disk_id_rsp),
+	.create_posix_size = sizeof(struct create_posix_rsp),
+};
+
+static struct smb_version_values smb311_server_values = {
+	.version_string = SMB311_VERSION_STRING,
+	.protocol_id = SMB311_PROT_ID,
+	.capabilities = SMB2_GLOBAL_CAP_LARGE_MTU,
+	.max_read_size = SMB3_DEFAULT_IOSIZE,
+	.max_write_size = SMB3_DEFAULT_IOSIZE,
+	.max_trans_size = SMB3_DEFAULT_TRANS_SIZE,
+	.large_lock_type = 0,
+	.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE,
+	.shared_lock_type = SMB2_LOCKFLAG_SHARED,
+	.unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
+	.header_size = sizeof(struct smb2_hdr),
+	.max_header_size = MAX_SMB2_HDR_SIZE,
+	.read_rsp_size = sizeof(struct smb2_read_rsp) - 1,
+	.lock_cmd = SMB2_LOCK,
+	.cap_unix = 0,
+	.cap_nt_find = SMB2_NT_FIND,
+	.cap_large_files = SMB2_LARGE_FILES,
+	.create_lease_size = sizeof(struct create_lease),
+	.create_durable_size = sizeof(struct create_durable_rsp),
+	.create_durable_v2_size = sizeof(struct create_durable_v2_rsp),
+	.create_mxac_size = sizeof(struct create_mxac_rsp),
+	.create_disk_id_size = sizeof(struct create_disk_id_rsp),
+	.create_posix_size = sizeof(struct create_posix_rsp),
+};
+
+static struct smb_version_ops smb2_0_server_ops = {
+	.get_cmd_val		=	get_smb2_cmd_val,
+	.init_rsp_hdr		=	init_smb2_rsp_hdr,
+	.set_rsp_status		=	set_smb2_rsp_status,
+	.allocate_rsp_buf       =       smb2_allocate_rsp_buf,
+	.set_rsp_credits	=	smb2_set_rsp_credits,
+	.check_user_session	=	smb2_check_user_session,
+	.get_ksmbd_tcon		=	smb2_get_ksmbd_tcon,
+	.is_sign_req		=	smb2_is_sign_req,
+	.check_sign_req		=	smb2_check_sign_req,
+	.set_sign_rsp		=	smb2_set_sign_rsp
+};
+
+static struct smb_version_ops smb3_0_server_ops = {
+	.get_cmd_val		=	get_smb2_cmd_val,
+	.init_rsp_hdr		=	init_smb2_rsp_hdr,
+	.set_rsp_status		=	set_smb2_rsp_status,
+	.allocate_rsp_buf       =       smb2_allocate_rsp_buf,
+	.set_rsp_credits	=	smb2_set_rsp_credits,
+	.check_user_session	=	smb2_check_user_session,
+	.get_ksmbd_tcon		=	smb2_get_ksmbd_tcon,
+	.is_sign_req		=	smb2_is_sign_req,
+	.check_sign_req		=	smb3_check_sign_req,
+	.set_sign_rsp		=	smb3_set_sign_rsp,
+	.generate_signingkey	=	ksmbd_gen_smb30_signingkey,
+	.generate_encryptionkey	=	ksmbd_gen_smb30_encryptionkey,
+	.is_transform_hdr	=	smb3_is_transform_hdr,
+	.decrypt_req		=	smb3_decrypt_req,
+	.encrypt_resp		=	smb3_encrypt_resp
+};
+
+static struct smb_version_ops smb3_11_server_ops = {
+	.get_cmd_val		=	get_smb2_cmd_val,
+	.init_rsp_hdr		=	init_smb2_rsp_hdr,
+	.set_rsp_status		=	set_smb2_rsp_status,
+	.allocate_rsp_buf       =       smb2_allocate_rsp_buf,
+	.set_rsp_credits	=	smb2_set_rsp_credits,
+	.check_user_session	=	smb2_check_user_session,
+	.get_ksmbd_tcon		=	smb2_get_ksmbd_tcon,
+	.is_sign_req		=	smb2_is_sign_req,
+	.check_sign_req		=	smb3_check_sign_req,
+	.set_sign_rsp		=	smb3_set_sign_rsp,
+	.generate_signingkey	=	ksmbd_gen_smb311_signingkey,
+	.generate_encryptionkey	=	ksmbd_gen_smb311_encryptionkey,
+	.is_transform_hdr	=	smb3_is_transform_hdr,
+	.decrypt_req		=	smb3_decrypt_req,
+	.encrypt_resp		=	smb3_encrypt_resp
+};
+
+static struct smb_version_cmds smb2_0_server_cmds[NUMBER_OF_SMB2_COMMANDS] = {
+	[SMB2_NEGOTIATE_HE]	=	{ .proc = smb2_negotiate_request, },
+	[SMB2_SESSION_SETUP_HE] =	{ .proc = smb2_sess_setup, },
+	[SMB2_TREE_CONNECT_HE]  =	{ .proc = smb2_tree_connect,},
+	[SMB2_TREE_DISCONNECT_HE]  =	{ .proc = smb2_tree_disconnect,},
+	[SMB2_LOGOFF_HE]	=	{ .proc = smb2_session_logoff,},
+	[SMB2_CREATE_HE]	=	{ .proc = smb2_open},
+	[SMB2_QUERY_INFO_HE]	=	{ .proc = smb2_query_info},
+	[SMB2_QUERY_DIRECTORY_HE] =	{ .proc = smb2_query_dir},
+	[SMB2_CLOSE_HE]		=	{ .proc = smb2_close},
+	[SMB2_ECHO_HE]		=	{ .proc = smb2_echo},
+	[SMB2_SET_INFO_HE]      =       { .proc = smb2_set_info},
+	[SMB2_READ_HE]		=	{ .proc = smb2_read},
+	[SMB2_WRITE_HE]		=	{ .proc = smb2_write},
+	[SMB2_FLUSH_HE]		=	{ .proc = smb2_flush},
+	[SMB2_CANCEL_HE]	=	{ .proc = smb2_cancel},
+	[SMB2_LOCK_HE]		=	{ .proc = smb2_lock},
+	[SMB2_IOCTL_HE]		=	{ .proc = smb2_ioctl},
+	[SMB2_OPLOCK_BREAK_HE]	=	{ .proc = smb2_oplock_break},
+	[SMB2_CHANGE_NOTIFY_HE]	=	{ .proc = smb2_notify},
+};
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+/**
+ * init_smb2_0_server() - initialize a smb server connection with smb2.0
+ *			command dispatcher
+ * @conn:	connection instance
+ */
+int init_smb2_0_server(struct ksmbd_conn *conn)
+{
+	conn->vals = &smb20_server_values;
+	conn->ops = &smb2_0_server_ops;
+	conn->cmds = smb2_0_server_cmds;
+	conn->max_cmds = ARRAY_SIZE(smb2_0_server_cmds);
+	conn->max_credits = SMB2_MAX_CREDITS;
+	conn->total_credits = 0;
+	return 0;
+}
+#else
+int init_smb2_0_server(struct ksmbd_conn *conn)
+{
+	return -EOPNOTSUPP;
+}
+#endif
+
+/**
+ * init_smb2_1_server() - initialize a smb server connection with smb2.1
+ *			command dispatcher
+ * @conn:	connection instance
+ */
+void init_smb2_1_server(struct ksmbd_conn *conn)
+{
+	conn->vals = &smb21_server_values;
+	conn->ops = &smb2_0_server_ops;
+	conn->cmds = smb2_0_server_cmds;
+	conn->max_cmds = ARRAY_SIZE(smb2_0_server_cmds);
+	conn->max_credits = SMB2_MAX_CREDITS;
+
+	if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES)
+		conn->vals->capabilities |= SMB2_GLOBAL_CAP_LEASING;
+}
+
+/**
+ * init_smb3_0_server() - initialize a smb server connection with smb3.0
+ *			command dispatcher
+ * @conn:	connection instance
+ */
+void init_smb3_0_server(struct ksmbd_conn *conn)
+{
+	conn->vals = &smb30_server_values;
+	conn->ops = &smb3_0_server_ops;
+	conn->cmds = smb2_0_server_cmds;
+	conn->max_cmds = ARRAY_SIZE(smb2_0_server_cmds);
+	conn->max_credits = SMB2_MAX_CREDITS;
+
+	if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES)
+		conn->vals->capabilities |= SMB2_GLOBAL_CAP_LEASING;
+
+	if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION &&
+	    conn->cli_cap & SMB2_GLOBAL_CAP_ENCRYPTION)
+		conn->vals->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION;
+}
+
+/**
+ * init_smb3_02_server() - initialize a smb server connection with smb3.02
+ *			command dispatcher
+ * @conn:	connection instance
+ */
+void init_smb3_02_server(struct ksmbd_conn *conn)
+{
+	conn->vals = &smb302_server_values;
+	conn->ops = &smb3_0_server_ops;
+	conn->cmds = smb2_0_server_cmds;
+	conn->max_cmds = ARRAY_SIZE(smb2_0_server_cmds);
+	conn->max_credits = SMB2_MAX_CREDITS;
+
+	if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES)
+		conn->vals->capabilities |= SMB2_GLOBAL_CAP_LEASING;
+
+	if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION &&
+	    conn->cli_cap & SMB2_GLOBAL_CAP_ENCRYPTION)
+		conn->vals->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION;
+}
+
+/**
+ * init_smb3_11_server() - initialize a smb server connection with smb3.11
+ *			command dispatcher
+ * @conn:	connection instance
+ */
+int init_smb3_11_server(struct ksmbd_conn *conn)
+{
+	conn->vals = &smb311_server_values;
+	conn->ops = &smb3_11_server_ops;
+	conn->cmds = smb2_0_server_cmds;
+	conn->max_cmds = ARRAY_SIZE(smb2_0_server_cmds);
+	conn->max_credits = SMB2_MAX_CREDITS;
+
+	if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_LEASES)
+		conn->vals->capabilities |= SMB2_GLOBAL_CAP_LEASING;
+
+	if (conn->cipher_type)
+		conn->vals->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION;
+
+	INIT_LIST_HEAD(&conn->preauth_sess_table);
+	return 0;
+}
+
+void init_smb2_max_read_size(unsigned int sz)
+{
+	smb21_server_values.max_read_size = sz;
+	smb30_server_values.max_read_size = sz;
+	smb302_server_values.max_read_size = sz;
+	smb311_server_values.max_read_size = sz;
+}
+
+void init_smb2_max_write_size(unsigned int sz)
+{
+	smb21_server_values.max_write_size = sz;
+	smb30_server_values.max_write_size = sz;
+	smb302_server_values.max_write_size = sz;
+	smb311_server_values.max_write_size = sz;
+}
+
+void init_smb2_max_trans_size(unsigned int sz)
+{
+	smb21_server_values.max_trans_size = sz;
+	smb30_server_values.max_trans_size = sz;
+	smb302_server_values.max_trans_size = sz;
+	smb311_server_values.max_trans_size = sz;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smb2pdu.c linux-5.4.60-fbx/fs/cifsd/smb2pdu.c
--- linux-5.4.60-fbx/fs/cifsd./smb2pdu.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smb2pdu.c	2021-04-21 10:06:25.188514159 +0200
@@ -0,0 +1,8377 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/inetdevice.h>
+#include <net/addrconf.h>
+#include <linux/syscalls.h>
+#include <linux/namei.h>
+#include <linux/statfs.h>
+#include <linux/ethtool.h>
+
+#include "glob.h"
+#include "smb2pdu.h"
+#include "smbfsctl.h"
+#include "oplock.h"
+#include "smbacl.h"
+
+#include "auth.h"
+#include "asn1.h"
+#include "buffer_pool.h"
+#include "connection.h"
+#include "transport_ipc.h"
+#include "vfs.h"
+#include "vfs_cache.h"
+#include "misc.h"
+
+#include "server.h"
+#include "smb_common.h"
+#include "smbstatus.h"
+#include "ksmbd_work.h"
+#include "mgmt/user_config.h"
+#include "mgmt/share_config.h"
+#include "mgmt/tree_connect.h"
+#include "mgmt/user_session.h"
+#include "mgmt/ksmbd_ida.h"
+#include "ndr.h"
+
+static void __wbuf(struct ksmbd_work *work, void **req, void **rsp)
+{
+	if (work->next_smb2_rcv_hdr_off) {
+		*req = REQUEST_BUF_NEXT(work);
+		*rsp = RESPONSE_BUF_NEXT(work);
+	} else {
+		*req = work->request_buf;
+		*rsp = work->response_buf;
+	}
+}
+
+#define WORK_BUFFERS(w, rq, rs)	__wbuf((w), (void **)&(rq), (void **)&(rs))
+
+/**
+ * check_session_id() - check for valid session id in smb header
+ * @conn:	connection instance
+ * @id:		session id from smb header
+ *
+ * Return:      1 if valid session id, otherwise 0
+ */
+static inline int check_session_id(struct ksmbd_conn *conn, u64 id)
+{
+	struct ksmbd_session *sess;
+
+	if (id == 0 || id == -1)
+		return 0;
+
+	sess = ksmbd_session_lookup(conn, id);
+	if (sess)
+		return 1;
+	ksmbd_err("Invalid user session id: %llu\n", id);
+	return 0;
+}
+
+struct channel *lookup_chann_list(struct ksmbd_session *sess)
+{
+	struct channel *chann;
+	struct list_head *t;
+
+	list_for_each(t, &sess->ksmbd_chann_list) {
+		chann = list_entry(t, struct channel, chann_list);
+		if (chann && chann->conn == sess->conn)
+			return chann;
+	}
+
+	return NULL;
+}
+
+/**
+ * smb2_get_ksmbd_tcon() - get tree connection information for a tree id
+ * @work:	smb work
+ *
+ * Return:      matching tree connection on success, otherwise error
+ */
+int smb2_get_ksmbd_tcon(struct ksmbd_work *work)
+{
+	struct smb2_hdr *req_hdr = work->request_buf;
+	int tree_id;
+
+	work->tcon = NULL;
+	if (work->conn->ops->get_cmd_val(work) == SMB2_TREE_CONNECT_HE ||
+	    work->conn->ops->get_cmd_val(work) ==  SMB2_CANCEL_HE ||
+	    work->conn->ops->get_cmd_val(work) ==  SMB2_LOGOFF_HE) {
+		ksmbd_debug(SMB, "skip to check tree connect request\n");
+		return 0;
+	}
+
+	if (xa_empty(&work->sess->tree_conns)) {
+		ksmbd_debug(SMB, "NO tree connected\n");
+		return -1;
+	}
+
+	tree_id = le32_to_cpu(req_hdr->Id.SyncId.TreeId);
+	work->tcon = ksmbd_tree_conn_lookup(work->sess, tree_id);
+	if (!work->tcon) {
+		ksmbd_err("Invalid tid %d\n", tree_id);
+		return -1;
+	}
+
+	return 1;
+}
+
+/**
+ * smb2_set_err_rsp() - set error response code on smb response
+ * @work:	smb work containing response buffer
+ */
+void smb2_set_err_rsp(struct ksmbd_work *work)
+{
+	struct smb2_err_rsp *err_rsp;
+
+	if (work->next_smb2_rcv_hdr_off)
+		err_rsp = RESPONSE_BUF_NEXT(work);
+	else
+		err_rsp = work->response_buf;
+
+	if (err_rsp->hdr.Status != STATUS_STOPPED_ON_SYMLINK) {
+		err_rsp->StructureSize = SMB2_ERROR_STRUCTURE_SIZE2_LE;
+		err_rsp->ErrorContextCount = 0;
+		err_rsp->Reserved = 0;
+		err_rsp->ByteCount = 0;
+		err_rsp->ErrorData[0] = 0;
+		inc_rfc1001_len(work->response_buf, SMB2_ERROR_STRUCTURE_SIZE2);
+	}
+}
+
+/**
+ * is_smb2_neg_cmd() - is it smb2 negotiation command
+ * @work:	smb work containing smb header
+ *
+ * Return:      1 if smb2 negotiation command, otherwise 0
+ */
+int is_smb2_neg_cmd(struct ksmbd_work *work)
+{
+	struct smb2_hdr *hdr = work->request_buf;
+
+	/* is it SMB2 header ? */
+	if (hdr->ProtocolId != SMB2_PROTO_NUMBER)
+		return 0;
+
+	/* make sure it is request not response message */
+	if (hdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR)
+		return 0;
+
+	if (hdr->Command != SMB2_NEGOTIATE)
+		return 0;
+
+	return 1;
+}
+
+/**
+ * is_smb2_rsp() - is it smb2 response
+ * @work:	smb work containing smb response buffer
+ *
+ * Return:      1 if smb2 response, otherwise 0
+ */
+int is_smb2_rsp(struct ksmbd_work *work)
+{
+	struct smb2_hdr *hdr = work->response_buf;
+
+	/* is it SMB2 header ? */
+	if (hdr->ProtocolId != SMB2_PROTO_NUMBER)
+		return 0;
+
+	/* make sure it is response not request message */
+	if (!(hdr->Flags & SMB2_FLAGS_SERVER_TO_REDIR))
+		return 0;
+
+	return 1;
+}
+
+/**
+ * get_smb2_cmd_val() - get smb command code from smb header
+ * @work:	smb work containing smb request buffer
+ *
+ * Return:      smb2 request command value
+ */
+uint16_t get_smb2_cmd_val(struct ksmbd_work *work)
+{
+	struct smb2_hdr *rcv_hdr;
+
+	if (work->next_smb2_rcv_hdr_off)
+		rcv_hdr = REQUEST_BUF_NEXT(work);
+	else
+		rcv_hdr = work->request_buf;
+	return le16_to_cpu(rcv_hdr->Command);
+}
+
+/**
+ * set_smb2_rsp_status() - set error response code on smb2 header
+ * @work:	smb work containing response buffer
+ * @err:	error response code
+ */
+void set_smb2_rsp_status(struct ksmbd_work *work, __le32 err)
+{
+	struct smb2_hdr *rsp_hdr;
+
+	if (work->next_smb2_rcv_hdr_off)
+		rsp_hdr = RESPONSE_BUF_NEXT(work);
+	else
+		rsp_hdr = work->response_buf;
+	rsp_hdr->Status = err;
+	smb2_set_err_rsp(work);
+}
+
+/**
+ * init_smb2_neg_rsp() - initialize smb2 response for negotiate command
+ * @work:	smb work containing smb request buffer
+ *
+ * smb2 negotiate response is sent in reply of smb1 negotiate command for
+ * dialect auto-negotiation.
+ */
+int init_smb2_neg_rsp(struct ksmbd_work *work)
+{
+	struct smb2_hdr *rsp_hdr;
+	struct smb2_negotiate_rsp *rsp;
+	struct ksmbd_conn *conn = work->conn;
+
+	if (conn->need_neg == false)
+		return -EINVAL;
+	if (!(conn->dialect >= SMB20_PROT_ID &&
+	      conn->dialect <= SMB311_PROT_ID))
+		return -EINVAL;
+
+	rsp_hdr = work->response_buf;
+
+	memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);
+
+	rsp_hdr->smb2_buf_length =
+		cpu_to_be32(HEADER_SIZE_NO_BUF_LEN(conn));
+
+	rsp_hdr->ProtocolId = SMB2_PROTO_NUMBER;
+	rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE;
+	rsp_hdr->CreditRequest = cpu_to_le16(2);
+	rsp_hdr->Command = SMB2_NEGOTIATE;
+	rsp_hdr->Flags = (SMB2_FLAGS_SERVER_TO_REDIR);
+	rsp_hdr->NextCommand = 0;
+	rsp_hdr->MessageId = 0;
+	rsp_hdr->Id.SyncId.ProcessId = 0;
+	rsp_hdr->Id.SyncId.TreeId = 0;
+	rsp_hdr->SessionId = 0;
+	memset(rsp_hdr->Signature, 0, 16);
+
+	rsp = work->response_buf;
+
+	WARN_ON(ksmbd_conn_good(work));
+
+	rsp->StructureSize = cpu_to_le16(65);
+	ksmbd_debug(SMB, "conn->dialect 0x%x\n", conn->dialect);
+	rsp->DialectRevision = cpu_to_le16(conn->dialect);
+	/* Not setting conn guid rsp->ServerGUID, as it
+	 * not used by client for identifying connection
+	 */
+	rsp->Capabilities = cpu_to_le32(conn->vals->capabilities);
+	/* Default Max Message Size till SMB2.0, 64K*/
+	rsp->MaxTransactSize = cpu_to_le32(conn->vals->max_trans_size);
+	rsp->MaxReadSize = cpu_to_le32(conn->vals->max_read_size);
+	rsp->MaxWriteSize = cpu_to_le32(conn->vals->max_write_size);
+
+	rsp->SystemTime = cpu_to_le64(ksmbd_systime());
+	rsp->ServerStartTime = 0;
+
+	rsp->SecurityBufferOffset = cpu_to_le16(128);
+	rsp->SecurityBufferLength = cpu_to_le16(AUTH_GSS_LENGTH);
+	ksmbd_copy_gss_neg_header(((char *)(&rsp->hdr) +
+		sizeof(rsp->hdr.smb2_buf_length)) +
+		le16_to_cpu(rsp->SecurityBufferOffset));
+	inc_rfc1001_len(rsp, sizeof(struct smb2_negotiate_rsp) -
+		sizeof(struct smb2_hdr) - sizeof(rsp->Buffer) +
+		AUTH_GSS_LENGTH);
+	rsp->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED_LE;
+	if (server_conf.signing == KSMBD_CONFIG_OPT_MANDATORY)
+		rsp->SecurityMode |= SMB2_NEGOTIATE_SIGNING_REQUIRED_LE;
+	conn->use_spnego = true;
+
+	ksmbd_conn_set_need_negotiate(work);
+	return 0;
+}
+
+static int smb2_consume_credit_charge(struct ksmbd_work *work,
+		unsigned short credit_charge)
+{
+	struct ksmbd_conn *conn = work->conn;
+	unsigned int rsp_credits = 1;
+
+	if (!conn->total_credits)
+		return 0;
+
+	if (credit_charge > 0)
+		rsp_credits = credit_charge;
+
+	conn->total_credits -= rsp_credits;
+	return rsp_credits;
+}
+
+/**
+ * smb2_set_rsp_credits() - set number of credits in response buffer
+ * @work:	smb work containing smb response buffer
+ */
+int smb2_set_rsp_credits(struct ksmbd_work *work)
+{
+	struct smb2_hdr *req_hdr = REQUEST_BUF_NEXT(work);
+	struct smb2_hdr *hdr = RESPONSE_BUF_NEXT(work);
+	struct ksmbd_conn *conn = work->conn;
+	unsigned short credits_requested = le16_to_cpu(req_hdr->CreditRequest);
+	unsigned short credit_charge = 1, credits_granted = 0;
+	unsigned short aux_max, aux_credits, min_credits;
+	int rsp_credit_charge;
+
+	if (hdr->Command == SMB2_CANCEL)
+		goto out;
+
+	/* get default minimum credits by shifting maximum credits by 4 */
+	min_credits = conn->max_credits >> 4;
+
+	if (conn->total_credits >= conn->max_credits) {
+		ksmbd_err("Total credits overflow: %d\n", conn->total_credits);
+		conn->total_credits = min_credits;
+	}
+
+	rsp_credit_charge = smb2_consume_credit_charge(work,
+		le16_to_cpu(req_hdr->CreditCharge));
+	if (rsp_credit_charge < 0)
+		return -EINVAL;
+
+	hdr->CreditCharge = cpu_to_le16(rsp_credit_charge);
+
+	if (credits_requested > 0) {
+		aux_credits = credits_requested - 1;
+		aux_max = 32;
+		if (hdr->Command == SMB2_NEGOTIATE)
+			aux_max = 0;
+		aux_credits = (aux_credits < aux_max) ? aux_credits : aux_max;
+		credits_granted = aux_credits + credit_charge;
+
+		/* if credits granted per client is getting bigger than default
+		 * minimum credits then we should wrap it up within the limits.
+		 */
+		if ((conn->total_credits + credits_granted) > min_credits)
+			credits_granted = min_credits -	conn->total_credits;
+		/*
+		 * TODO: Need to adjuct CreditRequest value according to
+		 * current cpu load
+		 */
+	} else if (conn->total_credits == 0) {
+		credits_granted = 1;
+	}
+
+	conn->total_credits += credits_granted;
+	work->credits_granted += credits_granted;
+
+	if (!req_hdr->NextCommand) {
+		/* Update CreditRequest in last request */
+		hdr->CreditRequest = cpu_to_le16(work->credits_granted);
+	}
+out:
+	ksmbd_debug(SMB,
+		"credits: requested[%d] granted[%d] total_granted[%d]\n",
+		credits_requested, credits_granted,
+		conn->total_credits);
+	return 0;
+}
+
+/**
+ * init_chained_smb2_rsp() - initialize smb2 chained response
+ * @work:	smb work containing smb response buffer
+ */
+static void init_chained_smb2_rsp(struct ksmbd_work *work)
+{
+	struct smb2_hdr *req = REQUEST_BUF_NEXT(work);
+	struct smb2_hdr *rsp = RESPONSE_BUF_NEXT(work);
+	struct smb2_hdr *rsp_hdr;
+	struct smb2_hdr *rcv_hdr;
+	int next_hdr_offset = 0;
+	int len, new_len;
+
+	/* Len of this response = updated RFC len - offset of previous cmd
+	 * in the compound rsp
+	 */
+
+	/* Storing the current local FID which may be needed by subsequent
+	 * command in the compound request
+	 */
+	if (req->Command == SMB2_CREATE && rsp->Status == STATUS_SUCCESS) {
+		work->compound_fid =
+			le64_to_cpu(((struct smb2_create_rsp *)rsp)->
+				VolatileFileId);
+		work->compound_pfid =
+			le64_to_cpu(((struct smb2_create_rsp *)rsp)->
+				PersistentFileId);
+		work->compound_sid = le64_to_cpu(rsp->SessionId);
+	}
+
+	len = get_rfc1002_len(work->response_buf) - work->next_smb2_rsp_hdr_off;
+	next_hdr_offset = le32_to_cpu(req->NextCommand);
+
+	new_len = ALIGN(len, 8);
+	inc_rfc1001_len(work->response_buf, ((sizeof(struct smb2_hdr) - 4)
+			+ new_len - len));
+	rsp->NextCommand = cpu_to_le32(new_len);
+
+	work->next_smb2_rcv_hdr_off += next_hdr_offset;
+	work->next_smb2_rsp_hdr_off += new_len;
+	ksmbd_debug(SMB,
+		"Compound req new_len = %d rcv off = %d rsp off = %d\n",
+		new_len, work->next_smb2_rcv_hdr_off,
+		work->next_smb2_rsp_hdr_off);
+
+	rsp_hdr = RESPONSE_BUF_NEXT(work);
+	rcv_hdr = REQUEST_BUF_NEXT(work);
+
+	if (!(rcv_hdr->Flags & SMB2_FLAGS_RELATED_OPERATIONS)) {
+		ksmbd_debug(SMB, "related flag should be set\n");
+		work->compound_fid = KSMBD_NO_FID;
+		work->compound_pfid = KSMBD_NO_FID;
+	}
+	memset((char *)rsp_hdr + 4, 0, sizeof(struct smb2_hdr) + 2);
+	rsp_hdr->ProtocolId = rcv_hdr->ProtocolId;
+	rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE;
+	rsp_hdr->Command = rcv_hdr->Command;
+
+	/*
+	 * Message is response. We don't grant oplock yet.
+	 */
+	rsp_hdr->Flags = (SMB2_FLAGS_SERVER_TO_REDIR |
+				SMB2_FLAGS_RELATED_OPERATIONS);
+	rsp_hdr->NextCommand = 0;
+	rsp_hdr->MessageId = rcv_hdr->MessageId;
+	rsp_hdr->Id.SyncId.ProcessId = rcv_hdr->Id.SyncId.ProcessId;
+	rsp_hdr->Id.SyncId.TreeId = rcv_hdr->Id.SyncId.TreeId;
+	rsp_hdr->SessionId = rcv_hdr->SessionId;
+	memcpy(rsp_hdr->Signature, rcv_hdr->Signature, 16);
+}
+
+/**
+ * is_chained_smb2_message() - check for chained command
+ * @work:	smb work containing smb request buffer
+ *
+ * Return:      true if chained request, otherwise false
+ */
+bool is_chained_smb2_message(struct ksmbd_work *work)
+{
+	struct smb2_hdr *hdr = work->request_buf;
+	unsigned int len;
+
+	if (hdr->ProtocolId != SMB2_PROTO_NUMBER)
+		return false;
+
+	hdr = REQUEST_BUF_NEXT(work);
+	if (le32_to_cpu(hdr->NextCommand) > 0) {
+		ksmbd_debug(SMB, "got SMB2 chained command\n");
+		init_chained_smb2_rsp(work);
+		return true;
+	} else if (work->next_smb2_rcv_hdr_off) {
+		/*
+		 * This is last request in chained command,
+		 * align response to 8 byte
+		 */
+		len = ALIGN(get_rfc1002_len(work->response_buf), 8);
+		len = len - get_rfc1002_len(work->response_buf);
+		if (len) {
+			ksmbd_debug(SMB, "padding len %u\n", len);
+			inc_rfc1001_len(work->response_buf, len);
+			if (work->aux_payload_sz)
+				work->aux_payload_sz += len;
+		}
+	}
+	return false;
+}
+
+/**
+ * init_smb2_rsp_hdr() - initialize smb2 response
+ * @work:	smb work containing smb request buffer
+ *
+ * Return:      0
+ */
+int init_smb2_rsp_hdr(struct ksmbd_work *work)
+{
+	struct smb2_hdr *rsp_hdr = work->response_buf;
+	struct smb2_hdr *rcv_hdr = work->request_buf;
+	struct ksmbd_conn *conn = work->conn;
+
+	memset(rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);
+	rsp_hdr->smb2_buf_length = cpu_to_be32(HEADER_SIZE_NO_BUF_LEN(conn));
+	rsp_hdr->ProtocolId = rcv_hdr->ProtocolId;
+	rsp_hdr->StructureSize = SMB2_HEADER_STRUCTURE_SIZE;
+	rsp_hdr->Command = rcv_hdr->Command;
+
+	/*
+	 * Message is response. We don't grant oplock yet.
+	 */
+	rsp_hdr->Flags = (SMB2_FLAGS_SERVER_TO_REDIR);
+	rsp_hdr->NextCommand = 0;
+	rsp_hdr->MessageId = rcv_hdr->MessageId;
+	rsp_hdr->Id.SyncId.ProcessId = rcv_hdr->Id.SyncId.ProcessId;
+	rsp_hdr->Id.SyncId.TreeId = rcv_hdr->Id.SyncId.TreeId;
+	rsp_hdr->SessionId = rcv_hdr->SessionId;
+	memcpy(rsp_hdr->Signature, rcv_hdr->Signature, 16);
+
+	work->syncronous = true;
+	if (work->async_id) {
+		ksmbd_release_id(&conn->async_ida, work->async_id);
+		work->async_id = 0;
+	}
+
+	return 0;
+}
+
+/**
+ * smb2_allocate_rsp_buf() - allocate smb2 response buffer
+ * @work:	smb work containing smb request buffer
+ *
+ * Return:      0 on success, otherwise -ENOMEM
+ */
+int smb2_allocate_rsp_buf(struct ksmbd_work *work)
+{
+	struct smb2_hdr *hdr = work->request_buf;
+	size_t small_sz = MAX_CIFS_SMALL_BUFFER_SIZE;
+	size_t large_sz = work->conn->vals->max_trans_size + MAX_SMB2_HDR_SIZE;
+	size_t sz = small_sz;
+	int cmd = le16_to_cpu(hdr->Command);
+
+	if (cmd == SMB2_IOCTL_HE || cmd == SMB2_QUERY_DIRECTORY_HE) {
+		sz = large_sz;
+		work->set_trans_buf = true;
+	}
+
+	if (cmd == SMB2_QUERY_INFO_HE) {
+		struct smb2_query_info_req *req;
+
+		req = work->request_buf;
+		if (req->InfoType == SMB2_O_INFO_FILE &&
+		    (req->FileInfoClass == FILE_FULL_EA_INFORMATION ||
+		     req->FileInfoClass == FILE_ALL_INFORMATION)) {
+			sz = large_sz;
+			work->set_trans_buf = true;
+		}
+	}
+
+	/* allocate large response buf for chained commands */
+	if (le32_to_cpu(hdr->NextCommand) > 0)
+		sz = large_sz;
+
+	if (server_conf.flags & KSMBD_GLOBAL_FLAG_CACHE_TBUF &&
+			work->set_trans_buf)
+		work->response_buf = ksmbd_find_buffer(sz);
+	else
+		work->response_buf = kvmalloc(sz, GFP_KERNEL | __GFP_ZERO);
+	if (!work->response_buf) {
+		ksmbd_err("Failed to allocate %zu bytes buffer\n", sz);
+		return -ENOMEM;
+	}
+
+	work->response_sz = sz;
+	return 0;
+}
+
+/**
+ * smb2_check_user_session() - check for valid session for a user
+ * @work:	smb work containing smb request buffer
+ *
+ * Return:      0 on success, otherwise error
+ */
+int smb2_check_user_session(struct ksmbd_work *work)
+{
+	struct smb2_hdr *req_hdr = work->request_buf;
+	struct ksmbd_conn *conn = work->conn;
+	unsigned int cmd = conn->ops->get_cmd_val(work);
+	unsigned long long sess_id;
+
+	work->sess = NULL;
+	/*
+	 * SMB2_ECHO, SMB2_NEGOTIATE, SMB2_SESSION_SETUP command do not
+	 * require a session id, so no need to validate user session's for
+	 * these commands.
+	 */
+	if (cmd == SMB2_ECHO_HE || cmd == SMB2_NEGOTIATE_HE ||
+	    cmd == SMB2_SESSION_SETUP_HE)
+		return 0;
+
+	if (!ksmbd_conn_good(work))
+		return -EINVAL;
+
+	sess_id = le64_to_cpu(req_hdr->SessionId);
+	/* Check for validity of user session */
+	work->sess = ksmbd_session_lookup(conn, sess_id);
+	if (work->sess)
+		return 1;
+	ksmbd_debug(SMB, "Invalid user session, Uid %llu\n", sess_id);
+	return -EINVAL;
+}
+
+static void destroy_previous_session(struct ksmbd_user *user, u64 id)
+{
+	struct ksmbd_session *prev_sess = ksmbd_session_lookup_slowpath(id);
+	struct ksmbd_user *prev_user;
+
+	if (!prev_sess)
+		return;
+
+	prev_user = prev_sess->user;
+
+	if (strcmp(user->name, prev_user->name) ||
+	    user->passkey_sz != prev_user->passkey_sz ||
+	    memcmp(user->passkey, prev_user->passkey, user->passkey_sz)) {
+		put_session(prev_sess);
+		return;
+	}
+
+	put_session(prev_sess);
+	ksmbd_session_destroy(prev_sess);
+}
+
+/**
+ * smb2_get_name() - get filename string from on the wire smb format
+ * @share:	ksmbd_share_config pointer
+ * @src:	source buffer
+ * @maxlen:	maxlen of source string
+ * @nls_table:	nls_table pointer
+ *
+ * Return:      matching converted filename on success, otherwise error ptr
+ */
+static char *
+smb2_get_name(struct ksmbd_share_config *share, const char *src,
+		const int maxlen, struct nls_table *local_nls)
+{
+	char *name, *unixname;
+
+	name = smb_strndup_from_utf16(src, maxlen, 1, local_nls);
+	if (IS_ERR(name)) {
+		ksmbd_err("failed to get name %ld\n", PTR_ERR(name));
+		return name;
+	}
+
+	/* change it to absolute unix name */
+	ksmbd_conv_path_to_unix(name);
+	ksmbd_strip_last_slash(name);
+
+	unixname = convert_to_unix_name(share, name);
+	kfree(name);
+	if (!unixname) {
+		ksmbd_err("can not convert absolute name\n");
+		return ERR_PTR(-ENOMEM);
+	}
+
+	ksmbd_debug(SMB, "absolute name = %s\n", unixname);
+	return unixname;
+}
+
+int setup_async_work(struct ksmbd_work *work, void (*fn)(void **), void **arg)
+{
+	struct smb2_hdr *rsp_hdr;
+	struct ksmbd_conn *conn = work->conn;
+	int id;
+
+	rsp_hdr = work->response_buf;
+	rsp_hdr->Flags |= SMB2_FLAGS_ASYNC_COMMAND;
+
+	id = ksmbd_acquire_async_msg_id(&conn->async_ida);
+	if (id < 0) {
+		ksmbd_err("Failed to alloc async message id\n");
+		return id;
+	}
+	work->syncronous = false;
+	work->async_id = id;
+	rsp_hdr->Id.AsyncId = cpu_to_le64(id);
+
+	ksmbd_debug(SMB,
+		"Send interim Response to inform async request id : %d\n",
+		work->async_id);
+
+	work->cancel_fn = fn;
+	work->cancel_argv = arg;
+
+	spin_lock(&conn->request_lock);
+	list_add_tail(&work->async_request_entry, &conn->async_requests);
+	spin_unlock(&conn->request_lock);
+
+	return 0;
+}
+
+void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status)
+{
+	struct smb2_hdr *rsp_hdr;
+
+	rsp_hdr = work->response_buf;
+	smb2_set_err_rsp(work);
+	rsp_hdr->Status = status;
+
+	work->multiRsp = 1;
+	ksmbd_conn_write(work);
+	rsp_hdr->Status = 0;
+	work->multiRsp = 0;
+}
+
+static __le32 smb2_get_reparse_tag_special_file(umode_t mode)
+{
+	if (S_ISDIR(mode) || S_ISREG(mode))
+		return 0;
+
+	if (S_ISLNK(mode))
+		return IO_REPARSE_TAG_LX_SYMLINK_LE;
+	else if (S_ISFIFO(mode))
+		return IO_REPARSE_TAG_LX_FIFO_LE;
+	else if (S_ISSOCK(mode))
+		return IO_REPARSE_TAG_AF_UNIX_LE;
+	else if (S_ISCHR(mode))
+		return IO_REPARSE_TAG_LX_CHR_LE;
+	else if (S_ISBLK(mode))
+		return IO_REPARSE_TAG_LX_BLK_LE;
+
+	return 0;
+}
+
+/**
+ * smb2_get_dos_mode() - get file mode in dos format from unix mode
+ * @stat:	kstat containing file mode
+ * @attribute:	attribute flags
+ *
+ * Return:      converted dos mode
+ */
+static int smb2_get_dos_mode(struct kstat *stat, int attribute)
+{
+	int attr = 0;
+
+	if (S_ISDIR(stat->mode)) {
+		attr = ATTR_DIRECTORY |
+			(attribute & (ATTR_HIDDEN | ATTR_SYSTEM));
+	} else {
+		attr = (attribute & 0x00005137) | ATTR_ARCHIVE;
+		attr &= ~(ATTR_DIRECTORY);
+		if (S_ISREG(stat->mode) && (server_conf.share_fake_fscaps &
+				FILE_SUPPORTS_SPARSE_FILES))
+			attr |= ATTR_SPARSE;
+
+		if (smb2_get_reparse_tag_special_file(stat->mode))
+			attr |= ATTR_REPARSE;
+	}
+
+	return attr;
+}
+
+static void build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt,
+		__le16 hash_id)
+{
+	pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES;
+	pneg_ctxt->DataLength = cpu_to_le16(38);
+	pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1);
+	pneg_ctxt->Reserved = cpu_to_le32(0);
+	pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE);
+	get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE);
+	pneg_ctxt->HashAlgorithms = hash_id;
+}
+
+static void build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt,
+		__le16 cipher_type)
+{
+	pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES;
+	pneg_ctxt->DataLength = cpu_to_le16(4);
+	pneg_ctxt->Reserved = cpu_to_le32(0);
+	pneg_ctxt->CipherCount = cpu_to_le16(1);
+	pneg_ctxt->Ciphers[0] = cipher_type;
+}
+
+static void build_compression_ctxt(struct smb2_compression_ctx *pneg_ctxt,
+		__le16 comp_algo)
+{
+	pneg_ctxt->ContextType = SMB2_COMPRESSION_CAPABILITIES;
+	pneg_ctxt->DataLength =
+		cpu_to_le16(sizeof(struct smb2_compression_ctx)
+			- sizeof(struct smb2_neg_context));
+	pneg_ctxt->Reserved = cpu_to_le32(0);
+	pneg_ctxt->CompressionAlgorithmCount = cpu_to_le16(1);
+	pneg_ctxt->Reserved1 = cpu_to_le32(0);
+	pneg_ctxt->CompressionAlgorithms[0] = comp_algo;
+}
+
+static void build_posix_ctxt(struct smb2_posix_neg_context *pneg_ctxt)
+{
+	pneg_ctxt->ContextType = SMB2_POSIX_EXTENSIONS_AVAILABLE;
+	pneg_ctxt->DataLength = cpu_to_le16(POSIX_CTXT_DATA_LEN);
+	/* SMB2_CREATE_TAG_POSIX is "0x93AD25509CB411E7B42383DE968BCD7C" */
+	pneg_ctxt->Name[0] = 0x93;
+	pneg_ctxt->Name[1] = 0xAD;
+	pneg_ctxt->Name[2] = 0x25;
+	pneg_ctxt->Name[3] = 0x50;
+	pneg_ctxt->Name[4] = 0x9C;
+	pneg_ctxt->Name[5] = 0xB4;
+	pneg_ctxt->Name[6] = 0x11;
+	pneg_ctxt->Name[7] = 0xE7;
+	pneg_ctxt->Name[8] = 0xB4;
+	pneg_ctxt->Name[9] = 0x23;
+	pneg_ctxt->Name[10] = 0x83;
+	pneg_ctxt->Name[11] = 0xDE;
+	pneg_ctxt->Name[12] = 0x96;
+	pneg_ctxt->Name[13] = 0x8B;
+	pneg_ctxt->Name[14] = 0xCD;
+	pneg_ctxt->Name[15] = 0x7C;
+}
+
+static void assemble_neg_contexts(struct ksmbd_conn *conn,
+		struct smb2_negotiate_rsp *rsp)
+{
+	/* +4 is to account for the RFC1001 len field */
+	char *pneg_ctxt = (char *)rsp +
+			le32_to_cpu(rsp->NegotiateContextOffset) + 4;
+	int neg_ctxt_cnt = 1;
+	int ctxt_size;
+
+	ksmbd_debug(SMB,
+		"assemble SMB2_PREAUTH_INTEGRITY_CAPABILITIES context\n");
+	build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt,
+		conn->preauth_info->Preauth_HashId);
+	rsp->NegotiateContextCount = cpu_to_le16(neg_ctxt_cnt);
+	inc_rfc1001_len(rsp, AUTH_GSS_PADDING);
+	ctxt_size = sizeof(struct smb2_preauth_neg_context);
+	/* Round to 8 byte boundary */
+	pneg_ctxt += round_up(sizeof(struct smb2_preauth_neg_context), 8);
+
+	if (conn->cipher_type) {
+		ctxt_size = round_up(ctxt_size, 8);
+		ksmbd_debug(SMB,
+			"assemble SMB2_ENCRYPTION_CAPABILITIES context\n");
+		build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt,
+			conn->cipher_type);
+		rsp->NegotiateContextCount = cpu_to_le16(++neg_ctxt_cnt);
+		ctxt_size += sizeof(struct smb2_encryption_neg_context);
+		/* Round to 8 byte boundary */
+		pneg_ctxt +=
+			round_up(sizeof(struct smb2_encryption_neg_context),
+				 8);
+	}
+
+	if (conn->compress_algorithm) {
+		ctxt_size = round_up(ctxt_size, 8);
+		ksmbd_debug(SMB,
+			"assemble SMB2_COMPRESSION_CAPABILITIES context\n");
+		/* Temporarily set to SMB3_COMPRESS_NONE */
+		build_compression_ctxt((struct smb2_compression_ctx *)pneg_ctxt,
+					conn->compress_algorithm);
+		rsp->NegotiateContextCount = cpu_to_le16(++neg_ctxt_cnt);
+		ctxt_size += sizeof(struct smb2_compression_ctx);
+		/* Round to 8 byte boundary */
+		pneg_ctxt += round_up(sizeof(struct smb2_compression_ctx), 8);
+	}
+
+	if (conn->posix_ext_supported) {
+		ctxt_size = round_up(ctxt_size, 8);
+		ksmbd_debug(SMB,
+			"assemble SMB2_POSIX_EXTENSIONS_AVAILABLE context\n");
+		build_posix_ctxt((struct smb2_posix_neg_context *)pneg_ctxt);
+		rsp->NegotiateContextCount = cpu_to_le16(++neg_ctxt_cnt);
+		ctxt_size += sizeof(struct smb2_posix_neg_context);
+	}
+
+	inc_rfc1001_len(rsp, ctxt_size);
+}
+
+static __le32 decode_preauth_ctxt(struct ksmbd_conn *conn,
+		struct smb2_preauth_neg_context *pneg_ctxt)
+{
+	__le32 err = STATUS_NO_PREAUTH_INTEGRITY_HASH_OVERLAP;
+
+	if (pneg_ctxt->HashAlgorithms ==
+			SMB2_PREAUTH_INTEGRITY_SHA512) {
+		conn->preauth_info->Preauth_HashId =
+			SMB2_PREAUTH_INTEGRITY_SHA512;
+		err = STATUS_SUCCESS;
+	}
+
+	return err;
+}
+
+static int decode_encrypt_ctxt(struct ksmbd_conn *conn,
+		struct smb2_encryption_neg_context *pneg_ctxt)
+{
+	int i;
+	int cph_cnt = le16_to_cpu(pneg_ctxt->CipherCount);
+
+	conn->cipher_type = 0;
+
+	if (!(server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION))
+		goto out;
+
+	for (i = 0; i < cph_cnt; i++) {
+		if (pneg_ctxt->Ciphers[i] == SMB2_ENCRYPTION_AES128_GCM ||
+		    pneg_ctxt->Ciphers[i] == SMB2_ENCRYPTION_AES128_CCM) {
+			ksmbd_debug(SMB, "Cipher ID = 0x%x\n",
+				pneg_ctxt->Ciphers[i]);
+			conn->cipher_type = pneg_ctxt->Ciphers[i];
+			break;
+		}
+	}
+
+out:
+	/*
+	 * Return encrypt context size in request.
+	 * So need to plus extra number of ciphers size.
+	 */
+	return sizeof(struct smb2_encryption_neg_context) +
+		((cph_cnt - 1) * 2);
+}
+
+static int decode_compress_ctxt(struct ksmbd_conn *conn,
+		struct smb2_compression_ctx *pneg_ctxt)
+{
+	int algo_cnt = le16_to_cpu(pneg_ctxt->CompressionAlgorithmCount);
+
+	conn->compress_algorithm = SMB3_COMPRESS_NONE;
+
+	/*
+	 * Return compression context size in request.
+	 * So need to plus extra number of CompressionAlgorithms size.
+	 */
+	return sizeof(struct smb2_encryption_neg_context) +
+		((algo_cnt - 1) * 2);
+}
+
+static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn,
+		struct smb2_negotiate_req *req)
+{
+	int i = 0;
+	__le32 status = 0;
+	/* +4 is to account for the RFC1001 len field */
+	char *pneg_ctxt = (char *)req +
+			le32_to_cpu(req->NegotiateContextOffset) + 4;
+	__le16 *ContextType = (__le16 *)pneg_ctxt;
+	int neg_ctxt_cnt = le16_to_cpu(req->NegotiateContextCount);
+	int ctxt_size;
+
+	ksmbd_debug(SMB, "negotiate context count = %d\n", neg_ctxt_cnt);
+	status = STATUS_INVALID_PARAMETER;
+	while (i++ < neg_ctxt_cnt) {
+		if (*ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES) {
+			ksmbd_debug(SMB,
+				"deassemble SMB2_PREAUTH_INTEGRITY_CAPABILITIES context\n");
+			if (conn->preauth_info->Preauth_HashId)
+				break;
+
+			status = decode_preauth_ctxt(conn,
+				(struct smb2_preauth_neg_context *)pneg_ctxt);
+			pneg_ctxt += DIV_ROUND_UP(sizeof(struct smb2_preauth_neg_context), 8) * 8;
+		} else if (*ContextType == SMB2_ENCRYPTION_CAPABILITIES) {
+			ksmbd_debug(SMB,
+				"deassemble SMB2_ENCRYPTION_CAPABILITIES context\n");
+			if (conn->cipher_type)
+				break;
+
+			ctxt_size = decode_encrypt_ctxt(conn,
+				(struct smb2_encryption_neg_context *)pneg_ctxt);
+			pneg_ctxt += DIV_ROUND_UP(ctxt_size, 8) * 8;
+		} else if (*ContextType == SMB2_COMPRESSION_CAPABILITIES) {
+			ksmbd_debug(SMB,
+				"deassemble SMB2_COMPRESSION_CAPABILITIES context\n");
+			if (conn->compress_algorithm)
+				break;
+
+			ctxt_size = decode_compress_ctxt(conn,
+				(struct smb2_compression_ctx *) pneg_ctxt);
+			pneg_ctxt += DIV_ROUND_UP(ctxt_size, 8) * 8;
+		} else if (*ContextType == SMB2_NETNAME_NEGOTIATE_CONTEXT_ID) {
+			ksmbd_debug(SMB,
+				"deassemble SMB2_NETNAME_NEGOTIATE_CONTEXT_ID context\n");
+			ctxt_size = sizeof(struct smb2_netname_neg_context);
+			ctxt_size += DIV_ROUND_UP(le16_to_cpu(((struct smb2_netname_neg_context *)
+					pneg_ctxt)->DataLength), 8) * 8;
+			pneg_ctxt += ctxt_size;
+		} else if (*ContextType == SMB2_POSIX_EXTENSIONS_AVAILABLE) {
+			ksmbd_debug(SMB,
+				"deassemble SMB2_POSIX_EXTENSIONS_AVAILABLE context\n");
+			conn->posix_ext_supported = true;
+			pneg_ctxt += DIV_ROUND_UP(sizeof(struct smb2_posix_neg_context), 8) * 8;
+		}
+		ContextType = (__le16 *)pneg_ctxt;
+
+		if (status != STATUS_SUCCESS)
+			break;
+	}
+	return status;
+}
+
+/**
+ * smb2_handle_negotiate() - handler for smb2 negotiate command
+ * @work:	smb work containing smb request buffer
+ *
+ * Return:      0
+ */
+int smb2_handle_negotiate(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_negotiate_req *req = work->request_buf;
+	struct smb2_negotiate_rsp *rsp = work->response_buf;
+	int rc = 0;
+	__le32 status;
+
+	ksmbd_debug(SMB, "Received negotiate request\n");
+	conn->need_neg = false;
+	if (ksmbd_conn_good(work)) {
+		ksmbd_err("conn->tcp_status is already in CifsGood State\n");
+		work->send_no_response = 1;
+		return rc;
+	}
+
+	if (req->DialectCount == 0) {
+		ksmbd_err("malformed packet\n");
+		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+		rc = -EINVAL;
+		goto err_out;
+	}
+
+	conn->cli_cap = le32_to_cpu(req->Capabilities);
+	switch (conn->dialect) {
+	case SMB311_PROT_ID:
+		conn->preauth_info =
+			kzalloc(sizeof(struct preauth_integrity_info),
+			GFP_KERNEL);
+		if (!conn->preauth_info) {
+			rc = -ENOMEM;
+			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+			goto err_out;
+		}
+
+		status = deassemble_neg_contexts(conn, req);
+		if (status != STATUS_SUCCESS) {
+			ksmbd_err("deassemble_neg_contexts error(0x%x)\n",
+					status);
+			rsp->hdr.Status = status;
+			rc = -EINVAL;
+			goto err_out;
+		}
+
+		rc = init_smb3_11_server(conn);
+		if (rc < 0) {
+			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+			goto err_out;
+		}
+
+		ksmbd_gen_preauth_integrity_hash(conn,
+				work->request_buf,
+				conn->preauth_info->Preauth_HashValue);
+		rsp->NegotiateContextOffset =
+				cpu_to_le32(OFFSET_OF_NEG_CONTEXT);
+		assemble_neg_contexts(conn, rsp);
+		break;
+	case SMB302_PROT_ID:
+		init_smb3_02_server(conn);
+		break;
+	case SMB30_PROT_ID:
+		init_smb3_0_server(conn);
+		break;
+	case SMB21_PROT_ID:
+		init_smb2_1_server(conn);
+		break;
+	case SMB20_PROT_ID:
+		rc = init_smb2_0_server(conn);
+		if (rc) {
+			rsp->hdr.Status = STATUS_NOT_SUPPORTED;
+			goto err_out;
+		}
+		break;
+	case SMB2X_PROT_ID:
+	case BAD_PROT_ID:
+	default:
+		ksmbd_debug(SMB, "Server dialect :0x%x not supported\n",
+			conn->dialect);
+		rsp->hdr.Status = STATUS_NOT_SUPPORTED;
+		rc = -EINVAL;
+		goto err_out;
+	}
+	rsp->Capabilities = cpu_to_le32(conn->vals->capabilities);
+
+	/* For stats */
+	conn->connection_type = conn->dialect;
+
+	rsp->MaxTransactSize = cpu_to_le32(conn->vals->max_trans_size);
+	rsp->MaxReadSize = cpu_to_le32(conn->vals->max_read_size);
+	rsp->MaxWriteSize = cpu_to_le32(conn->vals->max_write_size);
+
+	if (conn->dialect > SMB20_PROT_ID) {
+		memcpy(conn->ClientGUID, req->ClientGUID,
+				SMB2_CLIENT_GUID_SIZE);
+		conn->cli_sec_mode = le16_to_cpu(req->SecurityMode);
+	}
+
+	rsp->StructureSize = cpu_to_le16(65);
+	rsp->DialectRevision = cpu_to_le16(conn->dialect);
+	/* Not setting conn guid rsp->ServerGUID, as it
+	 * not used by client for identifying server
+	 */
+	memset(rsp->ServerGUID, 0, SMB2_CLIENT_GUID_SIZE);
+
+	rsp->SystemTime = cpu_to_le64(ksmbd_systime());
+	rsp->ServerStartTime = 0;
+	ksmbd_debug(SMB, "negotiate context offset %d, count %d\n",
+		le32_to_cpu(rsp->NegotiateContextOffset),
+		le16_to_cpu(rsp->NegotiateContextCount));
+
+	rsp->SecurityBufferOffset = cpu_to_le16(128);
+	rsp->SecurityBufferLength = cpu_to_le16(AUTH_GSS_LENGTH);
+	ksmbd_copy_gss_neg_header(((char *)(&rsp->hdr) +
+		sizeof(rsp->hdr.smb2_buf_length)) +
+		le16_to_cpu(rsp->SecurityBufferOffset));
+	inc_rfc1001_len(rsp, sizeof(struct smb2_negotiate_rsp) -
+		sizeof(struct smb2_hdr) - sizeof(rsp->Buffer) +
+		AUTH_GSS_LENGTH);
+	rsp->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED_LE;
+	conn->use_spnego = true;
+
+	if ((server_conf.signing == KSMBD_CONFIG_OPT_AUTO ||
+	     server_conf.signing == KSMBD_CONFIG_OPT_DISABLED) &&
+	    req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED_LE)
+		conn->sign = true;
+	else if (server_conf.signing == KSMBD_CONFIG_OPT_MANDATORY) {
+		server_conf.enforced_signing = true;
+		rsp->SecurityMode |= SMB2_NEGOTIATE_SIGNING_REQUIRED_LE;
+		conn->sign = true;
+	}
+
+	conn->srv_sec_mode = le16_to_cpu(rsp->SecurityMode);
+	ksmbd_conn_set_need_negotiate(work);
+
+err_out:
+	if (rc < 0)
+		smb2_set_err_rsp(work);
+
+	return rc;
+}
+
+static int alloc_preauth_hash(struct ksmbd_session *sess,
+		struct ksmbd_conn *conn)
+{
+	if (sess->Preauth_HashValue)
+		return 0;
+
+	sess->Preauth_HashValue = kmemdup(conn->preauth_info->Preauth_HashValue,
+			PREAUTH_HASHVALUE_SIZE, GFP_KERNEL);
+	if (!sess->Preauth_HashValue)
+		return -ENOMEM;
+
+	return 0;
+}
+
+static int generate_preauth_hash(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_session *sess = work->sess;
+
+	if (conn->dialect != SMB311_PROT_ID)
+		return 0;
+
+	if (!sess->Preauth_HashValue) {
+		if (alloc_preauth_hash(sess, conn))
+			return -ENOMEM;
+	}
+
+	ksmbd_gen_preauth_integrity_hash(conn,
+					 work->request_buf,
+					 sess->Preauth_HashValue);
+	return 0;
+}
+
+static int decode_negotiation_token(struct ksmbd_work *work,
+		struct negotiate_message *negblob)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_sess_setup_req *req;
+	int sz;
+
+	if (!conn->use_spnego)
+		return -EINVAL;
+
+	req = work->request_buf;
+	sz = le16_to_cpu(req->SecurityBufferLength);
+
+	if (!ksmbd_decode_negTokenInit((char *)negblob, sz, conn)) {
+		if (!ksmbd_decode_negTokenTarg((char *)negblob, sz, conn)) {
+			conn->auth_mechs |= KSMBD_AUTH_NTLMSSP;
+			conn->preferred_auth_mech = KSMBD_AUTH_NTLMSSP;
+			conn->use_spnego = false;
+		}
+	}
+	return 0;
+}
+
+static int ntlm_negotiate(struct ksmbd_work *work,
+		struct negotiate_message *negblob)
+{
+	struct smb2_sess_setup_req *req = work->request_buf;
+	struct smb2_sess_setup_rsp *rsp = work->response_buf;
+	struct challenge_message *chgblob;
+	unsigned char *spnego_blob = NULL;
+	u16 spnego_blob_len;
+	char *neg_blob;
+	int sz, rc;
+
+	ksmbd_debug(SMB, "negotiate phase\n");
+	sz = le16_to_cpu(req->SecurityBufferLength);
+	rc = ksmbd_decode_ntlmssp_neg_blob(negblob, sz, work->sess);
+	if (rc)
+		return rc;
+
+	sz = le16_to_cpu(rsp->SecurityBufferOffset);
+	chgblob =
+		(struct challenge_message *)((char *)&rsp->hdr.ProtocolId + sz);
+	memset(chgblob, 0, sizeof(struct challenge_message));
+
+	if (!work->conn->use_spnego) {
+		sz = ksmbd_build_ntlmssp_challenge_blob(chgblob, work->sess);
+		if (sz < 0)
+			return -ENOMEM;
+
+		rsp->SecurityBufferLength = cpu_to_le16(sz);
+		return 0;
+	}
+
+	sz = sizeof(struct challenge_message);
+	sz += (strlen(ksmbd_netbios_name()) * 2 + 1 + 4) * 6;
+
+	neg_blob = kzalloc(sz, GFP_KERNEL);
+	if (!neg_blob)
+		return -ENOMEM;
+
+	chgblob = (struct challenge_message *)neg_blob;
+	sz = ksmbd_build_ntlmssp_challenge_blob(chgblob, work->sess);
+	if (sz < 0) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	rc = build_spnego_ntlmssp_neg_blob(&spnego_blob,
+					  &spnego_blob_len,
+					  neg_blob,
+					  sz);
+	if (rc) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	sz = le16_to_cpu(rsp->SecurityBufferOffset);
+	memcpy((char *)&rsp->hdr.ProtocolId + sz, spnego_blob, spnego_blob_len);
+	rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len);
+
+out:
+	kfree(spnego_blob);
+	kfree(neg_blob);
+	return rc;
+}
+
+static struct authenticate_message *user_authblob(struct ksmbd_conn *conn,
+		struct smb2_sess_setup_req *req)
+{
+	int sz;
+
+	if (conn->use_spnego && conn->mechToken)
+		return (struct authenticate_message *)conn->mechToken;
+
+	sz = le16_to_cpu(req->SecurityBufferOffset);
+	return (struct authenticate_message *)((char *)&req->hdr.ProtocolId
+					       + sz);
+}
+
+static struct ksmbd_user *session_user(struct ksmbd_conn *conn,
+		struct smb2_sess_setup_req *req)
+{
+	struct authenticate_message *authblob;
+	struct ksmbd_user *user;
+	char *name;
+	int sz;
+
+	authblob = user_authblob(conn, req);
+	sz = le32_to_cpu(authblob->UserName.BufferOffset);
+	name = smb_strndup_from_utf16((const char *)authblob + sz,
+				      le16_to_cpu(authblob->UserName.Length),
+				      true,
+				      conn->local_nls);
+	if (IS_ERR(name)) {
+		ksmbd_err("cannot allocate memory\n");
+		return NULL;
+	}
+
+	ksmbd_debug(SMB, "session setup request for user %s\n", name);
+	user = ksmbd_login_user(name);
+	kfree(name);
+	return user;
+}
+
+static int ntlm_authenticate(struct ksmbd_work *work)
+{
+	struct smb2_sess_setup_req *req = work->request_buf;
+	struct smb2_sess_setup_rsp *rsp = work->response_buf;
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_session *sess = work->sess;
+	struct channel *chann = NULL;
+	struct ksmbd_user *user;
+	u64 prev_id;
+	int sz, rc;
+
+	ksmbd_debug(SMB, "authenticate phase\n");
+	if (conn->use_spnego) {
+		unsigned char *spnego_blob;
+		u16 spnego_blob_len;
+
+		rc = build_spnego_ntlmssp_auth_blob(&spnego_blob,
+						    &spnego_blob_len,
+						    0);
+		if (rc)
+			return -ENOMEM;
+
+		sz = le16_to_cpu(rsp->SecurityBufferOffset);
+		memcpy((char *)&rsp->hdr.ProtocolId + sz, spnego_blob, spnego_blob_len);
+		rsp->SecurityBufferLength = cpu_to_le16(spnego_blob_len);
+		kfree(spnego_blob);
+		inc_rfc1001_len(rsp, spnego_blob_len - 1);
+	}
+
+	user = session_user(conn, req);
+	if (!user) {
+		ksmbd_debug(SMB, "Unknown user name or an error\n");
+		rsp->hdr.Status = STATUS_LOGON_FAILURE;
+		return -EINVAL;
+	}
+
+	/* Check for previous session */
+	prev_id = le64_to_cpu(req->PreviousSessionId);
+	if (prev_id && prev_id != sess->id)
+		destroy_previous_session(user, prev_id);
+
+	if (sess->state == SMB2_SESSION_VALID) {
+		/*
+		 * Reuse session if anonymous try to connect
+		 * on reauthetication.
+		 */
+		if (ksmbd_anonymous_user(user)) {
+			ksmbd_free_user(user);
+			return 0;
+		}
+		ksmbd_free_user(sess->user);
+	}
+
+	sess->user = user;
+	if (user_guest(sess->user)) {
+		if (conn->sign) {
+			ksmbd_debug(SMB, "Guest login not allowed when signing enabled\n");
+			rsp->hdr.Status = STATUS_LOGON_FAILURE;
+			return -EACCES;
+		}
+
+		rsp->SessionFlags = SMB2_SESSION_FLAG_IS_GUEST_LE;
+	} else {
+		struct authenticate_message *authblob;
+
+		authblob = user_authblob(conn, req);
+		sz = le16_to_cpu(req->SecurityBufferLength);
+		rc = ksmbd_decode_ntlmssp_auth_blob(authblob, sz, sess);
+		if (rc) {
+			set_user_flag(sess->user, KSMBD_USER_FLAG_BAD_PASSWORD);
+			ksmbd_debug(SMB, "authentication failed\n");
+			rsp->hdr.Status = STATUS_LOGON_FAILURE;
+			return -EINVAL;
+		}
+
+		/*
+		 * If session state is SMB2_SESSION_VALID, We can assume
+		 * that it is reauthentication. And the user/password
+		 * has been verified, so return it here.
+		 */
+		if (sess->state == SMB2_SESSION_VALID)
+			return 0;
+
+		if ((conn->sign || server_conf.enforced_signing) ||
+		    (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED))
+			sess->sign = true;
+
+		if (conn->vals->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION &&
+		    conn->ops->generate_encryptionkey) {
+			rc = conn->ops->generate_encryptionkey(sess);
+			if (rc) {
+				ksmbd_debug(SMB,
+					"SMB3 encryption key generation failed\n");
+				rsp->hdr.Status = STATUS_LOGON_FAILURE;
+				return rc;
+			}
+			sess->enc = true;
+			rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE;
+			/*
+			 * signing is disable if encryption is enable
+			 * on this session
+			 */
+			sess->sign = false;
+		}
+	}
+
+	if (conn->dialect >= SMB30_PROT_ID) {
+		chann = lookup_chann_list(sess);
+		if (!chann) {
+			chann = kmalloc(sizeof(struct channel), GFP_KERNEL);
+			if (!chann)
+				return -ENOMEM;
+
+			chann->conn = conn;
+			INIT_LIST_HEAD(&chann->chann_list);
+			list_add(&chann->chann_list, &sess->ksmbd_chann_list);
+		}
+	}
+
+	if (conn->ops->generate_signingkey) {
+		rc = conn->ops->generate_signingkey(sess);
+		if (rc) {
+			ksmbd_debug(SMB, "SMB3 signing key generation failed\n");
+			rsp->hdr.Status = STATUS_LOGON_FAILURE;
+			return rc;
+		}
+	}
+
+	if (conn->dialect > SMB20_PROT_ID) {
+		if (!ksmbd_conn_lookup_dialect(conn)) {
+			ksmbd_err("fail to verify the dialect\n");
+			rsp->hdr.Status = STATUS_USER_SESSION_DELETED;
+			return -EPERM;
+		}
+	}
+	return 0;
+}
+
+#ifdef CONFIG_SMB_SERVER_KERBEROS5
+static int krb5_authenticate(struct ksmbd_work *work)
+{
+	struct smb2_sess_setup_req *req = work->request_buf;
+	struct smb2_sess_setup_rsp *rsp = work->response_buf;
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_session *sess = work->sess;
+	char *in_blob, *out_blob;
+	struct channel *chann = NULL;
+	u64 prev_sess_id;
+	int in_len, out_len;
+	int retval;
+
+	in_blob = (char *)&req->hdr.ProtocolId +
+		le16_to_cpu(req->SecurityBufferOffset);
+	in_len = le16_to_cpu(req->SecurityBufferLength);
+	out_blob = (char *)&rsp->hdr.ProtocolId +
+		le16_to_cpu(rsp->SecurityBufferOffset);
+	out_len = work->response_sz -
+		offsetof(struct smb2_hdr, smb2_buf_length) -
+		le16_to_cpu(rsp->SecurityBufferOffset);
+
+	/* Check previous session */
+	prev_sess_id = le64_to_cpu(req->PreviousSessionId);
+	if (prev_sess_id && prev_sess_id != sess->id)
+		destroy_previous_session(sess->user, prev_sess_id);
+
+	if (sess->state == SMB2_SESSION_VALID)
+		ksmbd_free_user(sess->user);
+
+	retval = ksmbd_krb5_authenticate(sess, in_blob, in_len,
+			out_blob, &out_len);
+	if (retval) {
+		ksmbd_debug(SMB, "krb5 authentication failed\n");
+		rsp->hdr.Status = STATUS_LOGON_FAILURE;
+		return retval;
+	}
+	rsp->SecurityBufferLength = cpu_to_le16(out_len);
+	inc_rfc1001_len(rsp, out_len - 1);
+
+	if ((conn->sign || server_conf.enforced_signing) ||
+	    (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED))
+		sess->sign = true;
+
+	if ((conn->vals->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION) &&
+	    conn->ops->generate_encryptionkey) {
+		retval = conn->ops->generate_encryptionkey(sess);
+		if (retval) {
+			ksmbd_debug(SMB,
+				"SMB3 encryption key generation failed\n");
+			rsp->hdr.Status = STATUS_LOGON_FAILURE;
+			return retval;
+		}
+		sess->enc = true;
+		rsp->SessionFlags = SMB2_SESSION_FLAG_ENCRYPT_DATA_LE;
+		sess->sign = false;
+	}
+
+	if (conn->dialect >= SMB30_PROT_ID) {
+		chann = lookup_chann_list(sess);
+		if (!chann) {
+			chann = kmalloc(sizeof(struct channel), GFP_KERNEL);
+			if (!chann)
+				return -ENOMEM;
+
+			chann->conn = conn;
+			INIT_LIST_HEAD(&chann->chann_list);
+			list_add(&chann->chann_list, &sess->ksmbd_chann_list);
+		}
+	}
+
+	if (conn->ops->generate_signingkey) {
+		retval = conn->ops->generate_signingkey(sess);
+		if (retval) {
+			ksmbd_debug(SMB, "SMB3 signing key generation failed\n");
+			rsp->hdr.Status = STATUS_LOGON_FAILURE;
+			return retval;
+		}
+	}
+
+	if (conn->dialect > SMB20_PROT_ID) {
+		if (!ksmbd_conn_lookup_dialect(conn)) {
+			ksmbd_err("fail to verify the dialect\n");
+			rsp->hdr.Status = STATUS_USER_SESSION_DELETED;
+			return -EPERM;
+		}
+	}
+	return 0;
+}
+#else
+static int krb5_authenticate(struct ksmbd_work *work)
+{
+	return -EOPNOTSUPP;
+}
+#endif
+
+int smb2_sess_setup(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_sess_setup_req *req = work->request_buf;
+	struct smb2_sess_setup_rsp *rsp = work->response_buf;
+	struct ksmbd_session *sess;
+	struct negotiate_message *negblob;
+	int rc = 0;
+
+	ksmbd_debug(SMB, "Received request for session setup\n");
+
+	rsp->StructureSize = cpu_to_le16(9);
+	rsp->SessionFlags = 0;
+	rsp->SecurityBufferOffset = cpu_to_le16(72);
+	rsp->SecurityBufferLength = 0;
+	inc_rfc1001_len(rsp, 9);
+
+	if (!req->hdr.SessionId) {
+		sess = ksmbd_smb2_session_create();
+		if (!sess) {
+			rc = -ENOMEM;
+			goto out_err;
+		}
+		rsp->hdr.SessionId = cpu_to_le64(sess->id);
+		ksmbd_session_register(conn, sess);
+	} else {
+		sess = ksmbd_session_lookup(conn,
+				le64_to_cpu(req->hdr.SessionId));
+		if (!sess) {
+			rc = -ENOENT;
+			rsp->hdr.Status = STATUS_USER_SESSION_DELETED;
+			goto out_err;
+		}
+	}
+	work->sess = sess;
+
+	if (sess->state == SMB2_SESSION_EXPIRED)
+		sess->state = SMB2_SESSION_IN_PROGRESS;
+
+	negblob = (struct negotiate_message *)((char *)&req->hdr.ProtocolId +
+			le16_to_cpu(req->SecurityBufferOffset));
+
+	if (decode_negotiation_token(work, negblob) == 0) {
+		if (conn->mechToken)
+			negblob = (struct negotiate_message *)conn->mechToken;
+	}
+
+	if (server_conf.auth_mechs & conn->auth_mechs) {
+		if (conn->preferred_auth_mech &
+				(KSMBD_AUTH_KRB5 | KSMBD_AUTH_MSKRB5)) {
+			rc = generate_preauth_hash(work);
+			if (rc)
+				goto out_err;
+
+			rc = krb5_authenticate(work);
+			if (rc) {
+				rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+				goto out_err;
+			}
+
+			ksmbd_conn_set_good(work);
+			sess->state = SMB2_SESSION_VALID;
+			kfree(sess->Preauth_HashValue);
+			sess->Preauth_HashValue = NULL;
+		} else if (conn->preferred_auth_mech == KSMBD_AUTH_NTLMSSP) {
+			rc = generate_preauth_hash(work);
+			if (rc)
+				goto out_err;
+
+			if (negblob->MessageType == NtLmNegotiate) {
+				rc = ntlm_negotiate(work, negblob);
+				if (rc)
+					goto out_err;
+				rsp->hdr.Status =
+					STATUS_MORE_PROCESSING_REQUIRED;
+				/*
+				 * Note: here total size -1 is done as an
+				 * adjustment for 0 size blob
+				 */
+				inc_rfc1001_len(rsp, le16_to_cpu(rsp->SecurityBufferLength) - 1);
+
+			} else if (negblob->MessageType == NtLmAuthenticate) {
+				rc = ntlm_authenticate(work);
+				if (rc)
+					goto out_err;
+
+				ksmbd_conn_set_good(work);
+				sess->state = SMB2_SESSION_VALID;
+				kfree(sess->Preauth_HashValue);
+				sess->Preauth_HashValue = NULL;
+			}
+		} else {
+			/* TODO: need one more negotiation */
+			ksmbd_err("Not support the preferred authentication\n");
+			rc = -EINVAL;
+			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+		}
+	} else {
+		ksmbd_err("Not support authentication\n");
+		rc = -EINVAL;
+		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+	}
+
+out_err:
+	if (conn->use_spnego && conn->mechToken) {
+		kfree(conn->mechToken);
+		conn->mechToken = NULL;
+	}
+
+	if (rc < 0 && sess) {
+		ksmbd_session_destroy(sess);
+		work->sess = NULL;
+	}
+
+	return rc;
+}
+
+/**
+ * smb2_tree_connect() - handler for smb2 tree connect command
+ * @work:	smb work containing smb request buffer
+ *
+ * Return:      0 on success, otherwise error
+ */
+int smb2_tree_connect(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_tree_connect_req *req = work->request_buf;
+	struct smb2_tree_connect_rsp *rsp = work->response_buf;
+	struct ksmbd_session *sess = work->sess;
+	char *treename = NULL, *name = NULL;
+	struct ksmbd_tree_conn_status status;
+	struct ksmbd_share_config *share;
+	int rc = -EINVAL;
+
+	treename = smb_strndup_from_utf16(req->Buffer,
+		le16_to_cpu(req->PathLength), true, conn->local_nls);
+	if (IS_ERR(treename)) {
+		ksmbd_err("treename is NULL\n");
+		status.ret = KSMBD_TREE_CONN_STATUS_ERROR;
+		goto out_err1;
+	}
+
+	name = ksmbd_extract_sharename(treename);
+	if (IS_ERR(name)) {
+		status.ret = KSMBD_TREE_CONN_STATUS_ERROR;
+		goto out_err1;
+	}
+
+	ksmbd_debug(SMB, "tree connect request for tree %s treename %s\n",
+		      name, treename);
+
+	status = ksmbd_tree_conn_connect(sess, name);
+	if (status.ret == KSMBD_TREE_CONN_STATUS_OK)
+		rsp->hdr.Id.SyncId.TreeId = cpu_to_le32(status.tree_conn->id);
+	else
+		goto out_err1;
+
+	share = status.tree_conn->share_conf;
+	if (test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) {
+		ksmbd_debug(SMB, "IPC share path request\n");
+		rsp->ShareType = SMB2_SHARE_TYPE_PIPE;
+		rsp->MaximalAccess = FILE_READ_DATA_LE | FILE_READ_EA_LE |
+			FILE_EXECUTE_LE | FILE_READ_ATTRIBUTES_LE |
+			FILE_DELETE_LE | FILE_READ_CONTROL_LE |
+			FILE_WRITE_DAC_LE | FILE_WRITE_OWNER_LE |
+			FILE_SYNCHRONIZE_LE;
+	} else {
+		rsp->ShareType = SMB2_SHARE_TYPE_DISK;
+		rsp->MaximalAccess = FILE_READ_DATA_LE | FILE_READ_EA_LE |
+			FILE_EXECUTE_LE | FILE_READ_ATTRIBUTES_LE;
+		if (test_tree_conn_flag(status.tree_conn,
+					KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+			rsp->MaximalAccess |= FILE_WRITE_DATA_LE |
+				FILE_APPEND_DATA_LE | FILE_WRITE_EA_LE |
+				FILE_DELETE_CHILD_LE | FILE_DELETE_LE |
+				FILE_WRITE_ATTRIBUTES_LE | FILE_DELETE_LE |
+				FILE_READ_CONTROL_LE | FILE_WRITE_DAC_LE |
+				FILE_WRITE_OWNER_LE | FILE_SYNCHRONIZE_LE;
+		}
+	}
+
+	status.tree_conn->maximal_access = le32_to_cpu(rsp->MaximalAccess);
+	if (conn->posix_ext_supported)
+		status.tree_conn->posix_extensions = true;
+
+out_err1:
+	rsp->StructureSize = cpu_to_le16(16);
+	rsp->Capabilities = 0;
+	rsp->Reserved = 0;
+	/* default manual caching */
+	rsp->ShareFlags = SMB2_SHAREFLAG_MANUAL_CACHING;
+	inc_rfc1001_len(rsp, 16);
+
+	if (!IS_ERR(treename))
+		kfree(treename);
+	if (!IS_ERR(name))
+		kfree(name);
+
+	switch (status.ret) {
+	case KSMBD_TREE_CONN_STATUS_OK:
+		rsp->hdr.Status = STATUS_SUCCESS;
+		rc = 0;
+		break;
+	case KSMBD_TREE_CONN_STATUS_NO_SHARE:
+		rsp->hdr.Status = STATUS_BAD_NETWORK_PATH;
+		break;
+	case -ENOMEM:
+	case KSMBD_TREE_CONN_STATUS_NOMEM:
+		rsp->hdr.Status = STATUS_NO_MEMORY;
+		break;
+	case KSMBD_TREE_CONN_STATUS_ERROR:
+	case KSMBD_TREE_CONN_STATUS_TOO_MANY_CONNS:
+	case KSMBD_TREE_CONN_STATUS_TOO_MANY_SESSIONS:
+		rsp->hdr.Status = STATUS_ACCESS_DENIED;
+		break;
+	case -EINVAL:
+		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+		break;
+	default:
+		rsp->hdr.Status = STATUS_ACCESS_DENIED;
+	}
+
+	return rc;
+}
+
+/**
+ * smb2_create_open_flags() - convert smb open flags to unix open flags
+ * @file_present:	is file already present
+ * @access:		file access flags
+ * @disposition:	file disposition flags
+ *
+ * Return:      file open flags
+ */
+static int smb2_create_open_flags(bool file_present, __le32 access,
+		__le32 disposition)
+{
+	int oflags = O_NONBLOCK | O_LARGEFILE;
+
+	if (access & FILE_READ_DESIRED_ACCESS_LE &&
+	    access & FILE_WRITE_DESIRE_ACCESS_LE)
+		oflags |= O_RDWR;
+	else if (access & FILE_WRITE_DESIRE_ACCESS_LE)
+		oflags |= O_WRONLY;
+	else
+		oflags |= O_RDONLY;
+
+	if (access == FILE_READ_ATTRIBUTES_LE)
+		oflags |= O_PATH;
+
+	if (file_present) {
+		switch (disposition & FILE_CREATE_MASK_LE) {
+		case FILE_OPEN_LE:
+		case FILE_CREATE_LE:
+			break;
+		case FILE_SUPERSEDE_LE:
+		case FILE_OVERWRITE_LE:
+		case FILE_OVERWRITE_IF_LE:
+			oflags |= O_TRUNC;
+			break;
+		default:
+			break;
+		}
+	} else {
+		switch (disposition & FILE_CREATE_MASK_LE) {
+		case FILE_SUPERSEDE_LE:
+		case FILE_CREATE_LE:
+		case FILE_OPEN_IF_LE:
+		case FILE_OVERWRITE_IF_LE:
+			oflags |= O_CREAT;
+			break;
+		case FILE_OPEN_LE:
+		case FILE_OVERWRITE_LE:
+			oflags &= ~O_CREAT;
+			break;
+		default:
+			break;
+		}
+	}
+	return oflags;
+}
+
+/**
+ * smb2_tree_disconnect() - handler for smb tree connect request
+ * @work:	smb work containing request buffer
+ *
+ * Return:      0
+ */
+int smb2_tree_disconnect(struct ksmbd_work *work)
+{
+	struct smb2_tree_disconnect_rsp *rsp = work->response_buf;
+	struct ksmbd_session *sess = work->sess;
+	struct ksmbd_tree_connect *tcon = work->tcon;
+
+	rsp->StructureSize = cpu_to_le16(4);
+	inc_rfc1001_len(rsp, 4);
+
+	ksmbd_debug(SMB, "request\n");
+
+	if (!tcon) {
+		struct smb2_tree_disconnect_req *req = work->request_buf;
+
+		ksmbd_debug(SMB, "Invalid tid %d\n", req->hdr.Id.SyncId.TreeId);
+		rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED;
+		smb2_set_err_rsp(work);
+		return 0;
+	}
+
+	ksmbd_close_tree_conn_fds(work);
+	ksmbd_tree_conn_disconnect(sess, tcon);
+	return 0;
+}
+
+/**
+ * smb2_session_logoff() - handler for session log off request
+ * @work:	smb work containing request buffer
+ *
+ * Return:      0
+ */
+int smb2_session_logoff(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_logoff_rsp *rsp = work->response_buf;
+	struct ksmbd_session *sess = work->sess;
+
+	rsp->StructureSize = cpu_to_le16(4);
+	inc_rfc1001_len(rsp, 4);
+
+	ksmbd_debug(SMB, "request\n");
+
+	/* Got a valid session, set connection state */
+	WARN_ON(sess->conn != conn);
+
+	/* setting CifsExiting here may race with start_tcp_sess */
+	ksmbd_conn_set_need_reconnect(work);
+	ksmbd_close_session_fds(work);
+	ksmbd_conn_wait_idle(conn);
+
+	if (ksmbd_tree_conn_session_logoff(sess)) {
+		struct smb2_logoff_req *req = work->request_buf;
+
+		ksmbd_debug(SMB, "Invalid tid %d\n", req->hdr.Id.SyncId.TreeId);
+		rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED;
+		smb2_set_err_rsp(work);
+		return 0;
+	}
+
+	ksmbd_destroy_file_table(&sess->file_table);
+	sess->state = SMB2_SESSION_EXPIRED;
+
+	ksmbd_free_user(sess->user);
+	sess->user = NULL;
+
+	/* let start_tcp_sess free connection info now */
+	ksmbd_conn_set_need_negotiate(work);
+	return 0;
+}
+
+/**
+ * create_smb2_pipe() - create IPC pipe
+ * @work:	smb work containing request buffer
+ *
+ * Return:      0 on success, otherwise error
+ */
+static noinline int create_smb2_pipe(struct ksmbd_work *work)
+{
+	struct smb2_create_rsp *rsp = work->response_buf;
+	struct smb2_create_req *req = work->request_buf;
+	int id;
+	int err;
+	char *name;
+
+	name = smb_strndup_from_utf16(req->Buffer, le16_to_cpu(req->NameLength),
+			1, work->conn->local_nls);
+	if (IS_ERR(name)) {
+		rsp->hdr.Status = STATUS_NO_MEMORY;
+		err = PTR_ERR(name);
+		goto out;
+	}
+
+	id = ksmbd_session_rpc_open(work->sess, name);
+	if (id < 0)
+		ksmbd_err("Unable to open RPC pipe: %d\n", id);
+
+	rsp->StructureSize = cpu_to_le16(89);
+	rsp->OplockLevel = SMB2_OPLOCK_LEVEL_NONE;
+	rsp->Reserved = 0;
+	rsp->CreateAction = cpu_to_le32(FILE_OPENED);
+
+	rsp->CreationTime = cpu_to_le64(0);
+	rsp->LastAccessTime = cpu_to_le64(0);
+	rsp->ChangeTime = cpu_to_le64(0);
+	rsp->AllocationSize = cpu_to_le64(0);
+	rsp->EndofFile = cpu_to_le64(0);
+	rsp->FileAttributes = ATTR_NORMAL_LE;
+	rsp->Reserved2 = 0;
+	rsp->VolatileFileId = cpu_to_le64(id);
+	rsp->PersistentFileId = 0;
+	rsp->CreateContextsOffset = 0;
+	rsp->CreateContextsLength = 0;
+
+	inc_rfc1001_len(rsp, 88); /* StructureSize - 1*/
+	kfree(name);
+	return 0;
+
+out:
+	smb2_set_err_rsp(work);
+	return err;
+}
+
+#define DURABLE_RECONN_V2	1
+#define DURABLE_RECONN		2
+#define DURABLE_REQ_V2		3
+#define DURABLE_REQ		4
+#define APP_INSTANCE_ID		5
+
+struct durable_info {
+	struct ksmbd_file *fp;
+	int type;
+	int reconnected;
+	int persistent;
+	int timeout;
+	char *CreateGuid;
+	char *app_id;
+};
+
+static int parse_durable_handle_context(struct ksmbd_work *work,
+		struct smb2_create_req *req, struct lease_ctx_info *lc,
+		struct durable_info *d_info)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct create_context *context;
+	int i, err = 0;
+	u64 persistent_id = 0;
+	int req_op_level;
+	static const char * const durable_arr[] = {"DH2C", "DHnC", "DH2Q",
+		"DHnQ", SMB2_CREATE_APP_INSTANCE_ID};
+
+	req_op_level = req->RequestedOplockLevel;
+	for (i = 1; i <= 5; i++) {
+		context = smb2_find_context_vals(req, durable_arr[i - 1]);
+		if (IS_ERR(context)) {
+			err = PTR_ERR(context);
+			if (err == -EINVAL) {
+				ksmbd_err("bad name length\n");
+				goto out;
+			}
+			err = 0;
+			continue;
+		}
+
+		switch (i) {
+		case DURABLE_RECONN_V2:
+		{
+			struct create_durable_reconn_v2_req *recon_v2;
+
+			recon_v2 =
+				(struct create_durable_reconn_v2_req *)context;
+			persistent_id = le64_to_cpu(recon_v2->Fid.PersistentFileId);
+			d_info->fp = ksmbd_lookup_durable_fd(persistent_id);
+			if (!d_info->fp) {
+				ksmbd_err("Failed to get Durable handle state\n");
+				err = -EBADF;
+				goto out;
+			}
+
+			if (memcmp(d_info->fp->create_guid, recon_v2->CreateGuid,
+				   SMB2_CREATE_GUID_SIZE)) {
+				err = -EBADF;
+				goto out;
+			}
+			d_info->type = i;
+			d_info->reconnected = 1;
+			ksmbd_debug(SMB,
+				"reconnect v2 Persistent-id from reconnect = %llu\n",
+					persistent_id);
+			break;
+		}
+		case DURABLE_RECONN:
+		{
+			struct create_durable_reconn_req *recon;
+
+			if (d_info->type == DURABLE_RECONN_V2 ||
+			    d_info->type == DURABLE_REQ_V2) {
+				err = -EINVAL;
+				goto out;
+			}
+
+			recon =
+				(struct create_durable_reconn_req *)context;
+			persistent_id = le64_to_cpu(recon->Data.Fid.PersistentFileId);
+			d_info->fp = ksmbd_lookup_durable_fd(persistent_id);
+			if (!d_info->fp) {
+				ksmbd_err("Failed to get Durable handle state\n");
+				err = -EBADF;
+				goto out;
+			}
+			d_info->type = i;
+			d_info->reconnected = 1;
+			ksmbd_debug(SMB,
+				"reconnect Persistent-id from reconnect = %llu\n",
+					persistent_id);
+			break;
+		}
+		case DURABLE_REQ_V2:
+		{
+			struct create_durable_req_v2 *durable_v2_blob;
+
+			if (d_info->type == DURABLE_RECONN ||
+			    d_info->type == DURABLE_RECONN_V2) {
+				err = -EINVAL;
+				goto out;
+			}
+
+			durable_v2_blob =
+				(struct create_durable_req_v2 *)context;
+			ksmbd_debug(SMB, "Request for durable v2 open\n");
+			d_info->fp = ksmbd_lookup_fd_cguid(durable_v2_blob->CreateGuid);
+			if (d_info->fp) {
+				if (!memcmp(conn->ClientGUID, d_info->fp->client_guid,
+					    SMB2_CLIENT_GUID_SIZE)) {
+					if (!(req->hdr.Flags & SMB2_FLAGS_REPLAY_OPERATIONS)) {
+						err = -ENOEXEC;
+						goto out;
+					}
+
+					d_info->fp->conn = conn;
+					d_info->reconnected = 1;
+					goto out;
+				}
+			}
+			if (((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) ||
+			     req_op_level == SMB2_OPLOCK_LEVEL_BATCH)) {
+				d_info->CreateGuid =
+					durable_v2_blob->CreateGuid;
+				d_info->persistent =
+					le32_to_cpu(durable_v2_blob->Flags);
+				d_info->timeout =
+					le32_to_cpu(durable_v2_blob->Timeout);
+				d_info->type = i;
+			}
+			break;
+		}
+		case DURABLE_REQ:
+			if (d_info->type == DURABLE_RECONN)
+				goto out;
+			if (d_info->type == DURABLE_RECONN_V2 ||
+			    d_info->type == DURABLE_REQ_V2) {
+				err = -EINVAL;
+				goto out;
+			}
+
+			if (((lc && (lc->req_state & SMB2_LEASE_HANDLE_CACHING_LE)) ||
+			     req_op_level == SMB2_OPLOCK_LEVEL_BATCH)) {
+				ksmbd_debug(SMB, "Request for durable open\n");
+				d_info->type = i;
+			}
+			break;
+		case APP_INSTANCE_ID:
+		{
+			struct create_app_inst_id *inst_id;
+
+			inst_id = (struct create_app_inst_id *)context;
+			ksmbd_close_fd_app_id(work, inst_id->AppInstanceId);
+			d_info->app_id = inst_id->AppInstanceId;
+			break;
+		}
+		default:
+			break;
+		}
+	}
+
+out:
+
+	return err;
+}
+
+/**
+ * smb2_set_ea() - handler for setting extended attributes using set
+ *		info command
+ * @eabuf:	set info command buffer
+ * @path:	dentry path for get ea
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb2_set_ea(struct smb2_ea_info *eabuf, struct path *path)
+{
+	char *attr_name = NULL, *value;
+	int rc = 0;
+	int next = 0;
+
+	attr_name = kmalloc(XATTR_NAME_MAX + 1, GFP_KERNEL);
+	if (!attr_name)
+		return -ENOMEM;
+
+	do {
+		if (!eabuf->EaNameLength)
+			goto next;
+
+		ksmbd_debug(SMB,
+			"name : <%s>, name_len : %u, value_len : %u, next : %u\n",
+				eabuf->name, eabuf->EaNameLength,
+				le16_to_cpu(eabuf->EaValueLength),
+				le32_to_cpu(eabuf->NextEntryOffset));
+
+		if (eabuf->EaNameLength >
+				(XATTR_NAME_MAX - XATTR_USER_PREFIX_LEN)) {
+			rc = -EINVAL;
+			break;
+		}
+
+		memcpy(attr_name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN);
+		memcpy(&attr_name[XATTR_USER_PREFIX_LEN], eabuf->name,
+				eabuf->EaNameLength);
+		attr_name[XATTR_USER_PREFIX_LEN + eabuf->EaNameLength] = '\0';
+		value = (char *)&eabuf->name + eabuf->EaNameLength + 1;
+
+		if (!eabuf->EaValueLength) {
+			rc = ksmbd_vfs_casexattr_len(path->dentry,
+						     attr_name,
+						     XATTR_USER_PREFIX_LEN +
+						     eabuf->EaNameLength);
+
+			/* delete the EA only when it exits */
+			if (rc > 0) {
+				rc = ksmbd_vfs_remove_xattr(path->dentry,
+							    attr_name);
+
+				if (rc < 0) {
+					ksmbd_debug(SMB,
+						"remove xattr failed(%d)\n",
+						rc);
+					break;
+				}
+			}
+
+			/* if the EA doesn't exist, just do nothing. */
+			rc = 0;
+		} else {
+			rc = ksmbd_vfs_setxattr(path->dentry, attr_name, value,
+					le16_to_cpu(eabuf->EaValueLength), 0);
+			if (rc < 0) {
+				ksmbd_debug(SMB,
+					"ksmbd_vfs_setxattr is failed(%d)\n",
+					rc);
+				break;
+			}
+		}
+
+next:
+		next = le32_to_cpu(eabuf->NextEntryOffset);
+		eabuf = (struct smb2_ea_info *)((char *)eabuf + next);
+	} while (next != 0);
+
+	kfree(attr_name);
+	return rc;
+}
+
+static inline int check_context_err(void *ctx, char *str)
+{
+	int err;
+
+	err = PTR_ERR(ctx);
+	ksmbd_debug(SMB, "find context %s err %d\n", str, err);
+
+	if (err == -EINVAL) {
+		ksmbd_err("bad name length\n");
+		return err;
+	}
+
+	return 0;
+}
+
+static noinline int smb2_set_stream_name_xattr(struct path *path,
+		struct ksmbd_file *fp, char *stream_name, int s_type)
+{
+	size_t xattr_stream_size;
+	char *xattr_stream_name;
+	int rc;
+
+	rc = ksmbd_vfs_xattr_stream_name(stream_name,
+					 &xattr_stream_name,
+					 &xattr_stream_size,
+					 s_type);
+	if (rc)
+		return rc;
+
+	fp->stream.name = xattr_stream_name;
+	fp->stream.size = xattr_stream_size;
+
+	/* Check if there is stream prefix in xattr space */
+	rc = ksmbd_vfs_casexattr_len(path->dentry,
+				     xattr_stream_name,
+				     xattr_stream_size);
+	if (rc >= 0)
+		return 0;
+
+	if (fp->cdoption == FILE_OPEN_LE) {
+		ksmbd_debug(SMB, "XATTR stream name lookup failed: %d\n", rc);
+		return -EBADF;
+	}
+
+	rc = ksmbd_vfs_setxattr(path->dentry, xattr_stream_name, NULL, 0, 0);
+	if (rc < 0)
+		ksmbd_err("Failed to store XATTR stream name :%d\n", rc);
+	return 0;
+}
+
+static int smb2_remove_smb_xattrs(struct dentry *dentry)
+{
+	char *name, *xattr_list = NULL;
+	ssize_t xattr_list_len;
+	int err = 0;
+
+	xattr_list_len = ksmbd_vfs_listxattr(dentry, &xattr_list);
+	if (xattr_list_len < 0) {
+		goto out;
+	} else if (!xattr_list_len) {
+		ksmbd_debug(SMB, "empty xattr in the file\n");
+		goto out;
+	}
+
+	for (name = xattr_list; name - xattr_list < xattr_list_len;
+			name += strlen(name) + 1) {
+		ksmbd_debug(SMB, "%s, len %zd\n", name, strlen(name));
+
+		if (strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) &&
+		    strncmp(&name[XATTR_USER_PREFIX_LEN], DOS_ATTRIBUTE_PREFIX,
+			    DOS_ATTRIBUTE_PREFIX_LEN) &&
+		    strncmp(&name[XATTR_USER_PREFIX_LEN], STREAM_PREFIX, STREAM_PREFIX_LEN))
+			continue;
+
+		err = ksmbd_vfs_remove_xattr(dentry, name);
+		if (err)
+			ksmbd_debug(SMB, "remove xattr failed : %s\n", name);
+	}
+out:
+	kvfree(xattr_list);
+	return err;
+}
+
+static int smb2_create_truncate(struct path *path)
+{
+	int rc = vfs_truncate(path, 0);
+
+	if (rc) {
+		ksmbd_err("vfs_truncate failed, rc %d\n", rc);
+		return rc;
+	}
+
+	rc = smb2_remove_smb_xattrs(path->dentry);
+	if (rc == -EOPNOTSUPP)
+		rc = 0;
+	if (rc)
+		ksmbd_debug(SMB,
+			"ksmbd_truncate_stream_name_xattr failed, rc %d\n",
+				rc);
+	return rc;
+}
+
+static void smb2_new_xattrs(struct ksmbd_tree_connect *tcon, struct path *path,
+		struct ksmbd_file *fp)
+{
+	struct xattr_dos_attrib da = {0};
+	int rc;
+
+	if (!test_share_config_flag(tcon->share_conf,
+				    KSMBD_SHARE_FLAG_STORE_DOS_ATTRS))
+		return;
+
+	da.version = 4;
+	da.attr = le32_to_cpu(fp->f_ci->m_fattr);
+	da.itime = da.create_time = fp->create_time;
+	da.flags = XATTR_DOSINFO_ATTRIB | XATTR_DOSINFO_CREATE_TIME |
+		XATTR_DOSINFO_ITIME;
+
+	rc = ksmbd_vfs_set_dos_attrib_xattr(path->dentry, &da);
+	if (rc)
+		ksmbd_debug(SMB, "failed to store file attribute into xattr\n");
+}
+
+static void smb2_update_xattrs(struct ksmbd_tree_connect *tcon,
+		struct path *path, struct ksmbd_file *fp)
+{
+	struct xattr_dos_attrib da;
+	int rc;
+
+	fp->f_ci->m_fattr &= ~(ATTR_HIDDEN_LE | ATTR_SYSTEM_LE);
+
+	/* get FileAttributes from XATTR_NAME_DOS_ATTRIBUTE */
+	if (!test_share_config_flag(tcon->share_conf,
+				    KSMBD_SHARE_FLAG_STORE_DOS_ATTRS))
+		return;
+
+	rc = ksmbd_vfs_get_dos_attrib_xattr(path->dentry, &da);
+	if (rc > 0) {
+		fp->f_ci->m_fattr = cpu_to_le32(da.attr);
+		fp->create_time = da.create_time;
+		fp->itime = da.itime;
+	}
+}
+
+static int smb2_creat(struct ksmbd_work *work, struct path *path, char *name,
+		int open_flags, umode_t posix_mode, bool is_dir)
+{
+	struct ksmbd_tree_connect *tcon = work->tcon;
+	struct ksmbd_share_config *share = tcon->share_conf;
+	umode_t mode;
+	int rc;
+
+	if (!(open_flags & O_CREAT))
+		return -EBADF;
+
+	ksmbd_debug(SMB, "file does not exist, so creating\n");
+	if (is_dir == true) {
+		ksmbd_debug(SMB, "creating directory\n");
+
+		mode = share_config_directory_mode(share, posix_mode);
+		rc = ksmbd_vfs_mkdir(work, name, mode);
+		if (rc)
+			return rc;
+	} else {
+		ksmbd_debug(SMB, "creating regular file\n");
+
+		mode = share_config_create_mode(share, posix_mode);
+		rc = ksmbd_vfs_create(work, name, mode);
+		if (rc)
+			return rc;
+	}
+
+	rc = ksmbd_vfs_kern_path(name, 0, path, 0);
+	if (rc) {
+		ksmbd_err("cannot get linux path (%s), err = %d\n",
+				name, rc);
+		return rc;
+	}
+	return 0;
+}
+
+static int smb2_create_sd_buffer(struct ksmbd_work *work,
+		struct smb2_create_req *req, struct dentry *dentry)
+{
+	struct create_context *context;
+	int rc = -ENOENT;
+
+	if (!req->CreateContextsOffset)
+		return rc;
+
+	/* Parse SD BUFFER create contexts */
+	context = smb2_find_context_vals(req, SMB2_CREATE_SD_BUFFER);
+	if (context && !IS_ERR(context)) {
+		struct create_sd_buf_req *sd_buf;
+
+		ksmbd_debug(SMB,
+			"Set ACLs using SMB2_CREATE_SD_BUFFER context\n");
+		sd_buf = (struct create_sd_buf_req *)context;
+		rc = set_info_sec(work->conn, work->tcon, dentry, &sd_buf->ntsd,
+			le32_to_cpu(sd_buf->ccontext.DataLength), true);
+	}
+
+	return rc;
+}
+
+/**
+ * smb2_open() - handler for smb file open request
+ * @work:	smb work containing request buffer
+ *
+ * Return:      0 on success, otherwise error
+ */
+int smb2_open(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_session *sess = work->sess;
+	struct ksmbd_tree_connect *tcon = work->tcon;
+	struct smb2_create_req *req;
+	struct smb2_create_rsp *rsp, *rsp_org;
+	struct path path;
+	struct ksmbd_share_config *share = tcon->share_conf;
+	struct ksmbd_file *fp = NULL;
+	struct file *filp = NULL;
+	struct kstat stat;
+	struct create_context *context;
+	struct lease_ctx_info *lc = NULL;
+	struct create_ea_buf_req *ea_buf = NULL;
+	struct oplock_info *opinfo;
+	__le32 *next_ptr = NULL;
+	int req_op_level = 0, open_flags = 0, file_info = 0;
+	int rc = 0, len = 0;
+	int contxt_cnt = 0, query_disk_id = 0;
+	int maximal_access_ctxt = 0, posix_ctxt = 0;
+	int s_type = 0;
+	int next_off = 0;
+	char *name = NULL;
+	char *stream_name = NULL;
+	bool file_present = false, created = false, already_permitted = false;
+	struct durable_info d_info;
+	int share_ret, need_truncate = 0;
+	u64 time;
+	umode_t posix_mode = 0;
+	__le32 daccess, maximal_access = 0;
+
+	rsp_org = work->response_buf;
+	WORK_BUFFERS(work, req, rsp);
+
+	if (req->hdr.NextCommand && !work->next_smb2_rcv_hdr_off &&
+	    (req->hdr.Flags & SMB2_FLAGS_RELATED_OPERATIONS)) {
+		ksmbd_debug(SMB, "invalid flag in chained command\n");
+		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+		smb2_set_err_rsp(work);
+		return -EINVAL;
+	}
+
+	if (test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) {
+		ksmbd_debug(SMB, "IPC pipe create request\n");
+		return create_smb2_pipe(work);
+	}
+
+	if (req->NameLength) {
+		if ((req->CreateOptions & FILE_DIRECTORY_FILE_LE) &&
+		    *(char *)req->Buffer == '\\') {
+			ksmbd_err("not allow directory name included leading slash\n");
+			rc = -EINVAL;
+			goto err_out1;
+		}
+
+		name = smb2_get_name(share,
+				     req->Buffer,
+				     le16_to_cpu(req->NameLength),
+				     work->conn->local_nls);
+		if (IS_ERR(name)) {
+			rc = PTR_ERR(name);
+			if (rc != -ENOMEM)
+				rc = -ENOENT;
+			goto err_out1;
+		}
+
+		ksmbd_debug(SMB, "converted name = %s\n", name);
+		if (strchr(name, ':')) {
+			if (!test_share_config_flag(work->tcon->share_conf,
+						    KSMBD_SHARE_FLAG_STREAMS)) {
+				rc = -EBADF;
+				goto err_out1;
+			}
+			rc = parse_stream_name(name, &stream_name, &s_type);
+			if (rc < 0)
+				goto err_out1;
+		}
+
+		rc = ksmbd_validate_filename(name);
+		if (rc < 0)
+			goto err_out1;
+
+		if (ksmbd_share_veto_filename(share, name)) {
+			rc = -ENOENT;
+			ksmbd_debug(SMB, "Reject open(), vetoed file: %s\n",
+				name);
+			goto err_out1;
+		}
+	} else {
+		len = strlen(share->path);
+		ksmbd_debug(SMB, "share path len %d\n", len);
+		name = kmalloc(len + 1, GFP_KERNEL);
+		if (!name) {
+			rsp->hdr.Status = STATUS_NO_MEMORY;
+			rc = -ENOMEM;
+			goto err_out1;
+		}
+
+		memcpy(name, share->path, len);
+		*(name + len) = '\0';
+	}
+
+	req_op_level = req->RequestedOplockLevel;
+	memset(&d_info, 0, sizeof(struct durable_info));
+	if (server_conf.flags & KSMBD_GLOBAL_FLAG_DURABLE_HANDLE &&
+	    req->CreateContextsOffset) {
+		lc = parse_lease_state(req);
+		rc = parse_durable_handle_context(work, req, lc, &d_info);
+		if (rc) {
+			ksmbd_err("error parsing durable handle context\n");
+			goto err_out1;
+		}
+
+		if (d_info.reconnected) {
+			fp = d_info.fp;
+			rc = smb2_check_durable_oplock(d_info.fp, lc, name);
+			if (rc)
+				goto err_out1;
+			rc = ksmbd_reopen_durable_fd(work, d_info.fp);
+			if (rc)
+				goto err_out1;
+			if (ksmbd_override_fsids(work)) {
+				rc = -ENOMEM;
+				goto err_out1;
+			}
+			file_info = FILE_OPENED;
+			fp = d_info.fp;
+			goto reconnected;
+		}
+	} else {
+		if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE)
+			lc = parse_lease_state(req);
+	}
+
+	if (le32_to_cpu(req->ImpersonationLevel) > le32_to_cpu(IL_DELEGATE_LE)) {
+		ksmbd_err("Invalid impersonationlevel : 0x%x\n",
+			le32_to_cpu(req->ImpersonationLevel));
+		rc = -EIO;
+		rsp->hdr.Status = STATUS_BAD_IMPERSONATION_LEVEL;
+		goto err_out1;
+	}
+
+	if (req->CreateOptions && !(req->CreateOptions & CREATE_OPTIONS_MASK)) {
+		ksmbd_err("Invalid create options : 0x%x\n",
+			le32_to_cpu(req->CreateOptions));
+		rc = -EINVAL;
+		goto err_out1;
+	} else {
+
+		if (req->CreateOptions & FILE_SEQUENTIAL_ONLY_LE &&
+		    req->CreateOptions & FILE_RANDOM_ACCESS_LE)
+			req->CreateOptions = ~(FILE_SEQUENTIAL_ONLY_LE);
+
+		if (req->CreateOptions & (FILE_OPEN_BY_FILE_ID_LE |
+			CREATE_TREE_CONNECTION | FILE_RESERVE_OPFILTER_LE)) {
+			rc = -EOPNOTSUPP;
+			goto err_out1;
+		}
+
+		if (req->CreateOptions & FILE_DIRECTORY_FILE_LE) {
+			if (req->CreateOptions & FILE_NON_DIRECTORY_FILE_LE) {
+				rc = -EINVAL;
+				goto err_out1;
+			} else if (req->CreateOptions & FILE_NO_COMPRESSION_LE) {
+				req->CreateOptions = ~(FILE_NO_COMPRESSION_LE);
+			}
+		}
+	}
+
+	if (le32_to_cpu(req->CreateDisposition) >
+			le32_to_cpu(FILE_OVERWRITE_IF_LE)) {
+		ksmbd_err("Invalid create disposition : 0x%x\n",
+			le32_to_cpu(req->CreateDisposition));
+		rc = -EINVAL;
+		goto err_out1;
+	}
+
+	if (!(req->DesiredAccess & DESIRED_ACCESS_MASK)) {
+		ksmbd_err("Invalid desired access : 0x%x\n",
+			le32_to_cpu(req->DesiredAccess));
+		rc = -EACCES;
+		goto err_out1;
+	}
+
+	if (req->FileAttributes && !(req->FileAttributes & ATTR_MASK_LE)) {
+		ksmbd_err("Invalid file attribute : 0x%x\n",
+			le32_to_cpu(req->FileAttributes));
+		rc = -EINVAL;
+		goto err_out1;
+	}
+
+	if (req->CreateContextsOffset) {
+		/* Parse non-durable handle create contexts */
+		context = smb2_find_context_vals(req, SMB2_CREATE_EA_BUFFER);
+		if (IS_ERR(context)) {
+			rc = check_context_err(context, SMB2_CREATE_EA_BUFFER);
+			if (rc < 0)
+				goto err_out1;
+		} else {
+			ea_buf = (struct create_ea_buf_req *)context;
+			if (req->CreateOptions & FILE_NO_EA_KNOWLEDGE_LE) {
+				rsp->hdr.Status = STATUS_ACCESS_DENIED;
+				rc = -EACCES;
+				goto err_out1;
+			}
+		}
+
+		context = smb2_find_context_vals(req,
+				SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST);
+		if (IS_ERR(context)) {
+			rc = check_context_err(context,
+				SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST);
+			if (rc < 0)
+				goto err_out1;
+		} else {
+			ksmbd_debug(SMB,
+				"get query maximal access context\n");
+			maximal_access_ctxt = 1;
+		}
+
+		context = smb2_find_context_vals(req,
+				SMB2_CREATE_TIMEWARP_REQUEST);
+		if (IS_ERR(context)) {
+			rc = check_context_err(context,
+				SMB2_CREATE_TIMEWARP_REQUEST);
+			if (rc < 0)
+				goto err_out1;
+		} else {
+			ksmbd_debug(SMB, "get timewarp context\n");
+			rc = -EBADF;
+			goto err_out1;
+		}
+
+		if (tcon->posix_extensions) {
+			context = smb2_find_context_vals(req,
+				SMB2_CREATE_TAG_POSIX);
+			if (IS_ERR(context)) {
+				rc = check_context_err(context,
+						SMB2_CREATE_TAG_POSIX);
+				if (rc < 0)
+					goto err_out1;
+			} else {
+				struct create_posix *posix =
+					(struct create_posix *)context;
+				ksmbd_debug(SMB, "get posix context\n");
+
+				posix_mode = le32_to_cpu(posix->Mode);
+				posix_ctxt = 1;
+			}
+		}
+	}
+
+	if (ksmbd_override_fsids(work)) {
+		rc = -ENOMEM;
+		goto err_out1;
+	}
+
+	if (req->CreateOptions & FILE_DELETE_ON_CLOSE_LE) {
+		/*
+		 * On delete request, instead of following up, need to
+		 * look the current entity
+		 */
+		rc = ksmbd_vfs_kern_path(name, 0, &path, 1);
+		if (!rc) {
+			/*
+			 * If file exists with under flags, return access
+			 * denied error.
+			 */
+			if (req->CreateDisposition == FILE_OVERWRITE_IF_LE ||
+			    req->CreateDisposition == FILE_OPEN_IF_LE) {
+				rc = -EACCES;
+				path_put(&path);
+				goto err_out;
+			}
+
+			if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+				ksmbd_debug(SMB,
+					"User does not have write permission\n");
+				rc = -EACCES;
+				path_put(&path);
+				goto err_out;
+			}
+		}
+	} else {
+		if (test_share_config_flag(work->tcon->share_conf,
+					   KSMBD_SHARE_FLAG_FOLLOW_SYMLINKS)) {
+			/*
+			 * Use LOOKUP_FOLLOW to follow the path of
+			 * symlink in path buildup
+			 */
+			rc = ksmbd_vfs_kern_path(name, LOOKUP_FOLLOW, &path, 1);
+			if (rc) { /* Case for broken link ?*/
+				rc = ksmbd_vfs_kern_path(name, 0, &path, 1);
+			}
+		} else {
+			rc = ksmbd_vfs_kern_path(name, 0, &path, 1);
+			if (!rc && d_is_symlink(path.dentry)) {
+				rc = -EACCES;
+				path_put(&path);
+				goto err_out;
+			}
+		}
+	}
+
+	if (rc) {
+		if (rc == -EACCES) {
+			ksmbd_debug(SMB,
+				"User does not have right permission\n");
+			goto err_out;
+		}
+		ksmbd_debug(SMB, "can not get linux path for %s, rc = %d\n",
+				name, rc);
+		rc = 0;
+	} else {
+		file_present = true;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		generic_fillattr(&init_user_ns, d_inode(path.dentry), &stat);
+#else
+		generic_fillattr(d_inode(path.dentry), &stat);
+#endif
+	}
+	if (stream_name) {
+		if (req->CreateOptions & FILE_DIRECTORY_FILE_LE) {
+			if (s_type == DATA_STREAM) {
+				rc = -EIO;
+				rsp->hdr.Status = STATUS_NOT_A_DIRECTORY;
+			}
+		} else {
+			if (S_ISDIR(stat.mode) && s_type == DATA_STREAM) {
+				rc = -EIO;
+				rsp->hdr.Status = STATUS_FILE_IS_A_DIRECTORY;
+			}
+		}
+
+		if (req->CreateOptions & FILE_DIRECTORY_FILE_LE &&
+		    req->FileAttributes & ATTR_NORMAL_LE) {
+			rsp->hdr.Status = STATUS_NOT_A_DIRECTORY;
+			rc = -EIO;
+		}
+
+		if (rc < 0)
+			goto err_out;
+	}
+
+	if (file_present && req->CreateOptions & FILE_NON_DIRECTORY_FILE_LE &&
+	    S_ISDIR(stat.mode) && !(req->CreateOptions & FILE_DELETE_ON_CLOSE_LE)) {
+		ksmbd_debug(SMB, "open() argument is a directory: %s, %x\n",
+			      name, req->CreateOptions);
+		rsp->hdr.Status = STATUS_FILE_IS_A_DIRECTORY;
+		rc = -EIO;
+		goto err_out;
+	}
+
+	if (file_present && (req->CreateOptions & FILE_DIRECTORY_FILE_LE) &&
+	    !(req->CreateDisposition == FILE_CREATE_LE) &&
+	    !S_ISDIR(stat.mode)) {
+		rsp->hdr.Status = STATUS_NOT_A_DIRECTORY;
+		rc = -EIO;
+		goto err_out;
+	}
+
+	if (!stream_name && file_present &&
+	    req->CreateDisposition == FILE_CREATE_LE) {
+		rc = -EEXIST;
+		goto err_out;
+	}
+
+	daccess = smb_map_generic_desired_access(req->DesiredAccess);
+
+	if (file_present && !(req->CreateOptions & FILE_DELETE_ON_CLOSE_LE)) {
+		rc = smb_check_perm_dacl(conn, path.dentry, &daccess,
+				sess->user->uid);
+		if (rc)
+			goto err_out;
+	}
+
+	if (daccess & FILE_MAXIMAL_ACCESS_LE) {
+		if (!file_present) {
+			daccess = cpu_to_le32(GENERIC_ALL_FLAGS);
+		} else {
+			rc = ksmbd_vfs_query_maximal_access(path.dentry,
+							    &daccess);
+			if (rc)
+				goto err_out;
+			already_permitted = true;
+		}
+		maximal_access = daccess;
+	}
+
+	open_flags = smb2_create_open_flags(file_present,
+		daccess, req->CreateDisposition);
+
+	if (!test_tree_conn_flag(tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+		if (open_flags & O_CREAT) {
+			ksmbd_debug(SMB,
+				"User does not have write permission\n");
+			rc = -EACCES;
+			goto err_out;
+		}
+	}
+
+	/*create file if not present */
+	if (!file_present) {
+		rc = smb2_creat(work, &path, name, open_flags, posix_mode,
+			req->CreateOptions & FILE_DIRECTORY_FILE_LE);
+		if (rc)
+			goto err_out;
+
+		created = true;
+		if (ea_buf) {
+			rc = smb2_set_ea(&ea_buf->ea, &path);
+			if (rc == -EOPNOTSUPP)
+				rc = 0;
+			else if (rc)
+				goto err_out;
+		}
+	} else if (!already_permitted) {
+		bool may_delete;
+
+		may_delete = daccess & FILE_DELETE_LE ||
+			req->CreateOptions & FILE_DELETE_ON_CLOSE_LE;
+
+		/* FILE_READ_ATTRIBUTE is allowed without inode_permission,
+		 * because execute(search) permission on a parent directory,
+		 * is already granted.
+		 */
+		if (daccess & ~(FILE_READ_ATTRIBUTES_LE | FILE_READ_CONTROL_LE)) {
+			rc = ksmbd_vfs_inode_permission(path.dentry,
+					open_flags & O_ACCMODE, may_delete);
+			if (rc)
+				goto err_out;
+		}
+	}
+
+	rc = ksmbd_query_inode_status(d_inode(path.dentry->d_parent));
+	if (rc == KSMBD_INODE_STATUS_PENDING_DELETE) {
+		rc = -EBUSY;
+		goto err_out;
+	}
+
+	rc = 0;
+	filp = dentry_open(&path, open_flags, current_cred());
+	if (IS_ERR(filp)) {
+		rc = PTR_ERR(filp);
+		ksmbd_err("dentry open for dir failed, rc %d\n", rc);
+		goto err_out;
+	}
+
+	if (file_present) {
+		if (!(open_flags & O_TRUNC))
+			file_info = FILE_OPENED;
+		else
+			file_info = FILE_OVERWRITTEN;
+
+		if ((req->CreateDisposition & FILE_CREATE_MASK_LE)
+				== FILE_SUPERSEDE_LE)
+			file_info = FILE_SUPERSEDED;
+	} else if (open_flags & O_CREAT) {
+		file_info = FILE_CREATED;
+	}
+
+	ksmbd_vfs_set_fadvise(filp, req->CreateOptions);
+
+	/* Obtain Volatile-ID */
+	fp = ksmbd_open_fd(work, filp);
+	if (IS_ERR(fp)) {
+		fput(filp);
+		rc = PTR_ERR(fp);
+		fp = NULL;
+		goto err_out;
+	}
+
+	/* Get Persistent-ID */
+	ksmbd_open_durable_fd(fp);
+	if (!HAS_FILE_ID(fp->persistent_id)) {
+		rc = -ENOMEM;
+		goto err_out;
+	}
+
+	fp->filename = name;
+	fp->cdoption = req->CreateDisposition;
+	fp->daccess = daccess;
+	fp->saccess = req->ShareAccess;
+	fp->coption = req->CreateOptions;
+
+	/* Set default windows and posix acls if creating new file */
+	if (created) {
+		int posix_acl_rc;
+		struct inode *inode = path.dentry->d_inode;
+
+		posix_acl_rc = ksmbd_vfs_inherit_posix_acl(inode, path.dentry->d_parent->d_inode);
+		if (posix_acl_rc)
+			ksmbd_debug(SMB, "inherit posix acl failed : %d\n", posix_acl_rc);
+
+		if (test_share_config_flag(work->tcon->share_conf,
+					   KSMBD_SHARE_FLAG_ACL_XATTR)) {
+			rc = smb_inherit_dacl(conn, path.dentry, sess->user->uid,
+					sess->user->gid);
+		}
+
+		if (rc) {
+			rc = smb2_create_sd_buffer(work, req, path.dentry);
+			if (rc) {
+				if (posix_acl_rc)
+					ksmbd_vfs_set_init_posix_acl(inode);
+
+				if (test_share_config_flag(work->tcon->share_conf,
+							   KSMBD_SHARE_FLAG_ACL_XATTR)) {
+					struct smb_fattr fattr;
+					struct smb_ntsd *pntsd;
+					int pntsd_size, ace_num;
+
+					fattr.cf_uid = inode->i_uid;
+					fattr.cf_gid = inode->i_gid;
+					fattr.cf_mode = inode->i_mode;
+					fattr.cf_dacls = NULL;
+					ace_num = 0;
+
+					fattr.cf_acls = ksmbd_vfs_get_acl(inode, ACL_TYPE_ACCESS);
+					if (fattr.cf_acls)
+						ace_num = fattr.cf_acls->a_count;
+					if (S_ISDIR(inode->i_mode)) {
+						fattr.cf_dacls =
+							ksmbd_vfs_get_acl(inode, ACL_TYPE_DEFAULT);
+						if (fattr.cf_dacls)
+							ace_num += fattr.cf_dacls->a_count;
+					}
+
+					pntsd = kmalloc(sizeof(struct smb_ntsd) +
+							sizeof(struct smb_sid) * 3 +
+							sizeof(struct smb_acl) +
+							sizeof(struct smb_ace) * ace_num * 2,
+							GFP_KERNEL);
+					if (!pntsd)
+						goto err_out;
+
+					rc = build_sec_desc(pntsd, NULL,
+						OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO,
+						&pntsd_size, &fattr);
+					posix_acl_release(fattr.cf_acls);
+					posix_acl_release(fattr.cf_dacls);
+
+					rc = ksmbd_vfs_set_sd_xattr(conn,
+						path.dentry, pntsd, pntsd_size);
+					if (rc)
+						ksmbd_err("failed to store ntacl in xattr : %d\n",
+								rc);
+				}
+			}
+		}
+		rc = 0;
+	}
+
+	if (stream_name) {
+		rc = smb2_set_stream_name_xattr(&path,
+						fp,
+						stream_name,
+						s_type);
+		if (rc)
+			goto err_out;
+		file_info = FILE_CREATED;
+	}
+
+	fp->attrib_only = !(req->DesiredAccess & ~(FILE_READ_ATTRIBUTES_LE |
+			FILE_WRITE_ATTRIBUTES_LE | FILE_SYNCHRONIZE_LE));
+	if (!S_ISDIR(file_inode(filp)->i_mode) && open_flags & O_TRUNC &&
+	    !fp->attrib_only && !stream_name) {
+		smb_break_all_oplock(work, fp);
+		need_truncate = 1;
+	}
+
+	/* fp should be searchable through ksmbd_inode.m_fp_list
+	 * after daccess, saccess, attrib_only, and stream are
+	 * initialized.
+	 */
+	write_lock(&fp->f_ci->m_lock);
+	list_add(&fp->node, &fp->f_ci->m_fp_list);
+	write_unlock(&fp->f_ci->m_lock);
+
+	rc = ksmbd_vfs_getattr(&path, &stat);
+	if (rc) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		generic_fillattr(&init_user_ns, d_inode(path.dentry), &stat);
+#else
+		generic_fillattr(d_inode(path.dentry), &stat);
+#endif
+		rc = 0;
+	}
+
+	/* Check delete pending among previous fp before oplock break */
+	if (ksmbd_inode_pending_delete(fp)) {
+		rc = -EBUSY;
+		goto err_out;
+	}
+
+	share_ret = ksmbd_smb_check_shared_mode(fp->filp, fp);
+	if (!test_share_config_flag(work->tcon->share_conf, KSMBD_SHARE_FLAG_OPLOCKS) ||
+	    (req_op_level == SMB2_OPLOCK_LEVEL_LEASE &&
+	     !(conn->vals->capabilities & SMB2_GLOBAL_CAP_LEASING))) {
+		if (share_ret < 0 && !S_ISDIR(FP_INODE(fp)->i_mode)) {
+			rc = share_ret;
+			goto err_out;
+		}
+	} else {
+		if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) {
+			req_op_level = smb2_map_lease_to_oplock(lc->req_state);
+			ksmbd_debug(SMB,
+				"lease req for(%s) req oplock state 0x%x, lease state 0x%x\n",
+					name, req_op_level, lc->req_state);
+			rc = find_same_lease_key(sess, fp->f_ci, lc);
+			if (rc)
+				goto err_out;
+		} else if (open_flags == O_RDONLY &&
+			   (req_op_level == SMB2_OPLOCK_LEVEL_BATCH ||
+			    req_op_level == SMB2_OPLOCK_LEVEL_EXCLUSIVE))
+			req_op_level = SMB2_OPLOCK_LEVEL_II;
+
+		rc = smb_grant_oplock(work, req_op_level,
+				      fp->persistent_id, fp,
+				      le32_to_cpu(req->hdr.Id.SyncId.TreeId),
+				      lc, share_ret);
+		if (rc < 0)
+			goto err_out;
+	}
+
+	if (req->CreateOptions & FILE_DELETE_ON_CLOSE_LE)
+		ksmbd_fd_set_delete_on_close(fp, file_info);
+
+	if (need_truncate) {
+		rc = smb2_create_truncate(&path);
+		if (rc)
+			goto err_out;
+	}
+
+	if (req->CreateContextsOffset) {
+		struct create_alloc_size_req *az_req;
+
+		az_req = (struct create_alloc_size_req *)
+				smb2_find_context_vals(req,
+				SMB2_CREATE_ALLOCATION_SIZE);
+		if (IS_ERR(az_req)) {
+			rc = check_context_err(az_req,
+				SMB2_CREATE_ALLOCATION_SIZE);
+			if (rc < 0)
+				goto err_out;
+		} else {
+			loff_t alloc_size = le64_to_cpu(az_req->AllocationSize);
+			int err;
+
+			ksmbd_debug(SMB,
+				"request smb2 create allocate size : %llu\n",
+				alloc_size);
+			err = ksmbd_vfs_alloc_size(work, fp, alloc_size);
+			if (err < 0)
+				ksmbd_debug(SMB,
+					"ksmbd_vfs_alloc_size is failed : %d\n",
+					err);
+		}
+
+		context = smb2_find_context_vals(req, SMB2_CREATE_QUERY_ON_DISK_ID);
+		if (IS_ERR(context)) {
+			rc = check_context_err(context, SMB2_CREATE_QUERY_ON_DISK_ID);
+			if (rc < 0)
+				goto err_out;
+		} else {
+			ksmbd_debug(SMB, "get query on disk id context\n");
+			query_disk_id = 1;
+		}
+	}
+
+	if (stat.result_mask & STATX_BTIME)
+		fp->create_time = ksmbd_UnixTimeToNT(stat.btime);
+	else
+		fp->create_time = ksmbd_UnixTimeToNT(stat.ctime);
+	if (req->FileAttributes || fp->f_ci->m_fattr == 0)
+		fp->f_ci->m_fattr = cpu_to_le32(smb2_get_dos_mode(&stat,
+			le32_to_cpu(req->FileAttributes)));
+
+	if (!created)
+		smb2_update_xattrs(tcon, &path, fp);
+	else
+		smb2_new_xattrs(tcon, &path, fp);
+
+	memcpy(fp->client_guid, conn->ClientGUID, SMB2_CLIENT_GUID_SIZE);
+
+	if (d_info.type) {
+		if (d_info.type == DURABLE_REQ_V2 && d_info.persistent)
+			fp->is_persistent = 1;
+		else
+			fp->is_durable = 1;
+
+		if (d_info.type == DURABLE_REQ_V2) {
+			memcpy(fp->create_guid, d_info.CreateGuid,
+				SMB2_CREATE_GUID_SIZE);
+			if (d_info.timeout)
+				fp->durable_timeout = d_info.timeout;
+			else
+				fp->durable_timeout = 1600;
+			if (d_info.app_id)
+				memcpy(fp->app_instance_id, d_info.app_id, 16);
+		}
+	}
+
+reconnected:
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	generic_fillattr(&init_user_ns, FP_INODE(fp), &stat);
+#else
+	generic_fillattr(FP_INODE(fp), &stat);
+#endif
+
+	rsp->StructureSize = cpu_to_le16(89);
+	rcu_read_lock();
+	opinfo = rcu_dereference(fp->f_opinfo);
+	rsp->OplockLevel = opinfo != NULL ? opinfo->level : 0;
+	rcu_read_unlock();
+	rsp->Reserved = 0;
+	rsp->CreateAction = cpu_to_le32(file_info);
+	rsp->CreationTime = cpu_to_le64(fp->create_time);
+	time = ksmbd_UnixTimeToNT(stat.atime);
+	rsp->LastAccessTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(stat.mtime);
+	rsp->LastWriteTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(stat.ctime);
+	rsp->ChangeTime = cpu_to_le64(time);
+	rsp->AllocationSize = S_ISDIR(stat.mode) ? 0 :
+		cpu_to_le64(stat.blocks << 9);
+	rsp->EndofFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size);
+	rsp->FileAttributes = fp->f_ci->m_fattr;
+
+	rsp->Reserved2 = 0;
+
+	rsp->PersistentFileId = cpu_to_le64(fp->persistent_id);
+	rsp->VolatileFileId = cpu_to_le64(fp->volatile_id);
+
+	rsp->CreateContextsOffset = 0;
+	rsp->CreateContextsLength = 0;
+	inc_rfc1001_len(rsp_org, 88); /* StructureSize - 1*/
+
+	/* If lease is request send lease context response */
+	if (opinfo && opinfo->is_lease) {
+		struct create_context *lease_ccontext;
+
+		ksmbd_debug(SMB, "lease granted on(%s) lease state 0x%x\n",
+				name, opinfo->o_lease->state);
+		rsp->OplockLevel = SMB2_OPLOCK_LEVEL_LEASE;
+
+		lease_ccontext = (struct create_context *)rsp->Buffer;
+		contxt_cnt++;
+		create_lease_buf(rsp->Buffer, opinfo->o_lease);
+		le32_add_cpu(&rsp->CreateContextsLength,
+			     conn->vals->create_lease_size);
+		inc_rfc1001_len(rsp_org, conn->vals->create_lease_size);
+		next_ptr = &lease_ccontext->Next;
+		next_off = conn->vals->create_lease_size;
+	}
+
+	if (d_info.type == DURABLE_REQ || d_info.type == DURABLE_REQ_V2) {
+		struct create_context *durable_ccontext;
+
+		durable_ccontext = (struct create_context *)(rsp->Buffer +
+				le32_to_cpu(rsp->CreateContextsLength));
+		contxt_cnt++;
+		if (d_info.type == DURABLE_REQ) {
+			create_durable_rsp_buf(rsp->Buffer +
+				le32_to_cpu(rsp->CreateContextsLength));
+			le32_add_cpu(&rsp->CreateContextsLength,
+				     conn->vals->create_durable_size);
+			inc_rfc1001_len(rsp_org,
+				conn->vals->create_durable_size);
+		} else {
+			create_durable_v2_rsp_buf(rsp->Buffer +
+					le32_to_cpu(rsp->CreateContextsLength),
+					fp);
+			le32_add_cpu(&rsp->CreateContextsLength,
+				     conn->vals->create_durable_v2_size);
+			inc_rfc1001_len(rsp_org,
+				conn->vals->create_durable_v2_size);
+		}
+
+		if (next_ptr)
+			*next_ptr = cpu_to_le32(next_off);
+		next_ptr = &durable_ccontext->Next;
+		next_off = conn->vals->create_durable_size;
+	}
+
+	if (maximal_access_ctxt) {
+		struct create_context *mxac_ccontext;
+
+		if (maximal_access == 0)
+			ksmbd_vfs_query_maximal_access(path.dentry,
+						       &maximal_access);
+		mxac_ccontext = (struct create_context *)(rsp->Buffer +
+				le32_to_cpu(rsp->CreateContextsLength));
+		contxt_cnt++;
+		create_mxac_rsp_buf(rsp->Buffer +
+				le32_to_cpu(rsp->CreateContextsLength),
+				le32_to_cpu(maximal_access));
+		le32_add_cpu(&rsp->CreateContextsLength,
+			     conn->vals->create_mxac_size);
+		inc_rfc1001_len(rsp_org, conn->vals->create_mxac_size);
+		if (next_ptr)
+			*next_ptr = cpu_to_le32(next_off);
+		next_ptr = &mxac_ccontext->Next;
+		next_off = conn->vals->create_mxac_size;
+	}
+
+	if (query_disk_id) {
+		struct create_context *disk_id_ccontext;
+
+		disk_id_ccontext = (struct create_context *)(rsp->Buffer +
+				le32_to_cpu(rsp->CreateContextsLength));
+		contxt_cnt++;
+		create_disk_id_rsp_buf(rsp->Buffer +
+				le32_to_cpu(rsp->CreateContextsLength),
+				stat.ino, tcon->id);
+		le32_add_cpu(&rsp->CreateContextsLength,
+			     conn->vals->create_disk_id_size);
+		inc_rfc1001_len(rsp_org, conn->vals->create_disk_id_size);
+		if (next_ptr)
+			*next_ptr = cpu_to_le32(next_off);
+		next_ptr = &disk_id_ccontext->Next;
+		next_off = conn->vals->create_disk_id_size;
+	}
+
+	if (posix_ctxt) {
+		contxt_cnt++;
+		create_posix_rsp_buf(rsp->Buffer +
+				le32_to_cpu(rsp->CreateContextsLength),
+				fp);
+		le32_add_cpu(&rsp->CreateContextsLength,
+			     conn->vals->create_posix_size);
+		inc_rfc1001_len(rsp_org, conn->vals->create_posix_size);
+		if (next_ptr)
+			*next_ptr = cpu_to_le32(next_off);
+	}
+
+	if (contxt_cnt > 0) {
+		rsp->CreateContextsOffset =
+			cpu_to_le32(offsetof(struct smb2_create_rsp, Buffer)
+			- 4);
+	}
+
+err_out:
+	if (file_present || created)
+		path_put(&path);
+	ksmbd_revert_fsids(work);
+err_out1:
+	if (rc) {
+		if (rc == -EINVAL)
+			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+		else if (rc == -EOPNOTSUPP)
+			rsp->hdr.Status = STATUS_NOT_SUPPORTED;
+		else if (rc == -EACCES || rc == -ESTALE)
+			rsp->hdr.Status = STATUS_ACCESS_DENIED;
+		else if (rc == -ENOENT)
+			rsp->hdr.Status = STATUS_OBJECT_NAME_INVALID;
+		else if (rc == -EPERM)
+			rsp->hdr.Status = STATUS_SHARING_VIOLATION;
+		else if (rc == -EBUSY)
+			rsp->hdr.Status = STATUS_DELETE_PENDING;
+		else if (rc == -EBADF)
+			rsp->hdr.Status = STATUS_OBJECT_NAME_NOT_FOUND;
+		else if (rc == -ENOEXEC)
+			rsp->hdr.Status = STATUS_DUPLICATE_OBJECTID;
+		else if (rc == -ENXIO)
+			rsp->hdr.Status = STATUS_NO_SUCH_DEVICE;
+		else if (rc == -EEXIST)
+			rsp->hdr.Status = STATUS_OBJECT_NAME_COLLISION;
+		else if (rc == -EMFILE)
+			rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES;
+		if (!rsp->hdr.Status)
+			rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR;
+
+		if (!fp || !fp->filename)
+			kfree(name);
+		if (fp)
+			ksmbd_fd_put(work, fp);
+		smb2_set_err_rsp(work);
+		ksmbd_debug(SMB, "Error response: %x\n", rsp->hdr.Status);
+	}
+
+	kfree(lc);
+
+	return 0;
+}
+
+static int readdir_info_level_struct_sz(int info_level)
+{
+	switch (info_level) {
+	case FILE_FULL_DIRECTORY_INFORMATION:
+		return sizeof(struct file_full_directory_info);
+	case FILE_BOTH_DIRECTORY_INFORMATION:
+		return sizeof(struct file_both_directory_info);
+	case FILE_DIRECTORY_INFORMATION:
+		return sizeof(struct file_directory_info);
+	case FILE_NAMES_INFORMATION:
+		return sizeof(struct file_names_info);
+	case FILEID_FULL_DIRECTORY_INFORMATION:
+		return sizeof(struct file_id_full_dir_info);
+	case FILEID_BOTH_DIRECTORY_INFORMATION:
+		return sizeof(struct file_id_both_directory_info);
+	case SMB_FIND_FILE_POSIX_INFO:
+		return sizeof(struct smb2_posix_info);
+	default:
+		return -EOPNOTSUPP;
+	}
+}
+
+static int dentry_name(struct ksmbd_dir_info *d_info, int info_level)
+{
+	switch (info_level) {
+	case FILE_FULL_DIRECTORY_INFORMATION:
+	{
+		struct file_full_directory_info *ffdinfo;
+
+		ffdinfo = (struct file_full_directory_info *)d_info->rptr;
+		d_info->rptr += le32_to_cpu(ffdinfo->NextEntryOffset);
+		d_info->name = ffdinfo->FileName;
+		d_info->name_len = le32_to_cpu(ffdinfo->FileNameLength);
+		return 0;
+	}
+	case FILE_BOTH_DIRECTORY_INFORMATION:
+	{
+		struct file_both_directory_info *fbdinfo;
+
+		fbdinfo = (struct file_both_directory_info *)d_info->rptr;
+		d_info->rptr += le32_to_cpu(fbdinfo->NextEntryOffset);
+		d_info->name = fbdinfo->FileName;
+		d_info->name_len = le32_to_cpu(fbdinfo->FileNameLength);
+		return 0;
+	}
+	case FILE_DIRECTORY_INFORMATION:
+	{
+		struct file_directory_info *fdinfo;
+
+		fdinfo = (struct file_directory_info *)d_info->rptr;
+		d_info->rptr += le32_to_cpu(fdinfo->NextEntryOffset);
+		d_info->name = fdinfo->FileName;
+		d_info->name_len = le32_to_cpu(fdinfo->FileNameLength);
+		return 0;
+	}
+	case FILE_NAMES_INFORMATION:
+	{
+		struct file_names_info *fninfo;
+
+		fninfo = (struct file_names_info *)d_info->rptr;
+		d_info->rptr += le32_to_cpu(fninfo->NextEntryOffset);
+		d_info->name = fninfo->FileName;
+		d_info->name_len = le32_to_cpu(fninfo->FileNameLength);
+		return 0;
+	}
+	case FILEID_FULL_DIRECTORY_INFORMATION:
+	{
+		struct file_id_full_dir_info *dinfo;
+
+		dinfo = (struct file_id_full_dir_info *)d_info->rptr;
+		d_info->rptr += le32_to_cpu(dinfo->NextEntryOffset);
+		d_info->name = dinfo->FileName;
+		d_info->name_len = le32_to_cpu(dinfo->FileNameLength);
+		return 0;
+	}
+	case FILEID_BOTH_DIRECTORY_INFORMATION:
+	{
+		struct file_id_both_directory_info *fibdinfo;
+
+		fibdinfo = (struct file_id_both_directory_info *)d_info->rptr;
+		d_info->rptr += le32_to_cpu(fibdinfo->NextEntryOffset);
+		d_info->name = fibdinfo->FileName;
+		d_info->name_len = le32_to_cpu(fibdinfo->FileNameLength);
+		return 0;
+	}
+	case SMB_FIND_FILE_POSIX_INFO:
+	{
+		struct smb2_posix_info *posix_info;
+
+		posix_info = (struct smb2_posix_info *)d_info->rptr;
+		d_info->rptr += le32_to_cpu(posix_info->NextEntryOffset);
+		d_info->name = posix_info->name;
+		d_info->name_len = le32_to_cpu(posix_info->name_len);
+		return 0;
+	}
+	default:
+		return -EINVAL;
+	}
+}
+
+/**
+ * smb2_populate_readdir_entry() - encode directory entry in smb2 response
+ * buffer
+ * @conn:	connection instance
+ * @info_level:	smb information level
+ * @d_info:	structure included variables for query dir
+ * @ksmbd_kstat:	ksmbd wrapper of dirent stat information
+ *
+ * if directory has many entries, find first can't read it fully.
+ * find next might be called multiple times to read remaining dir entries
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level,
+		struct ksmbd_dir_info *d_info, struct ksmbd_kstat *ksmbd_kstat)
+{
+	int next_entry_offset = 0;
+	char *conv_name;
+	int conv_len;
+	void *kstat;
+	int struct_sz;
+
+	conv_name = ksmbd_convert_dir_info_name(d_info,
+						conn->local_nls,
+						&conv_len);
+	if (!conv_name)
+		return -ENOMEM;
+
+	/* Somehow the name has only terminating NULL bytes */
+	if (conv_len < 0) {
+		kfree(conv_name);
+		return -EINVAL;
+	}
+
+	struct_sz = readdir_info_level_struct_sz(info_level);
+	next_entry_offset = ALIGN(struct_sz - 1 + conv_len,
+				  KSMBD_DIR_INFO_ALIGNMENT);
+
+	if (next_entry_offset > d_info->out_buf_len) {
+		d_info->out_buf_len = 0;
+		return -ENOSPC;
+	}
+
+	kstat = d_info->wptr;
+	if (info_level != FILE_NAMES_INFORMATION)
+		kstat = ksmbd_vfs_init_kstat(&d_info->wptr, ksmbd_kstat);
+
+	switch (info_level) {
+	case FILE_FULL_DIRECTORY_INFORMATION:
+	{
+		struct file_full_directory_info *ffdinfo;
+
+		ffdinfo = (struct file_full_directory_info *)kstat;
+		ffdinfo->FileNameLength = cpu_to_le32(conv_len);
+		ffdinfo->EaSize =
+			smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode);
+		if (ffdinfo->EaSize)
+			ffdinfo->ExtFileAttributes = ATTR_REPARSE_POINT_LE;
+		if (d_info->hide_dot_file && d_info->name[0] == '.')
+			ffdinfo->ExtFileAttributes |= ATTR_HIDDEN_LE;
+		memcpy(ffdinfo->FileName, conv_name, conv_len);
+		ffdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		break;
+	}
+	case FILE_BOTH_DIRECTORY_INFORMATION:
+	{
+		struct file_both_directory_info *fbdinfo;
+
+		fbdinfo = (struct file_both_directory_info *)kstat;
+		fbdinfo->FileNameLength = cpu_to_le32(conv_len);
+		fbdinfo->EaSize =
+			smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode);
+		if (fbdinfo->EaSize)
+			fbdinfo->ExtFileAttributes = ATTR_REPARSE_POINT_LE;
+		fbdinfo->ShortNameLength = 0;
+		fbdinfo->Reserved = 0;
+		if (d_info->hide_dot_file && d_info->name[0] == '.')
+			fbdinfo->ExtFileAttributes |= ATTR_HIDDEN_LE;
+		memcpy(fbdinfo->FileName, conv_name, conv_len);
+		fbdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		break;
+	}
+	case FILE_DIRECTORY_INFORMATION:
+	{
+		struct file_directory_info *fdinfo;
+
+		fdinfo = (struct file_directory_info *)kstat;
+		fdinfo->FileNameLength = cpu_to_le32(conv_len);
+		if (d_info->hide_dot_file && d_info->name[0] == '.')
+			fdinfo->ExtFileAttributes |= ATTR_HIDDEN_LE;
+		memcpy(fdinfo->FileName, conv_name, conv_len);
+		fdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		break;
+	}
+	case FILE_NAMES_INFORMATION:
+	{
+		struct file_names_info *fninfo;
+
+		fninfo = (struct file_names_info *)kstat;
+		fninfo->FileNameLength = cpu_to_le32(conv_len);
+		memcpy(fninfo->FileName, conv_name, conv_len);
+		fninfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		break;
+	}
+	case FILEID_FULL_DIRECTORY_INFORMATION:
+	{
+		struct file_id_full_dir_info *dinfo;
+
+		dinfo = (struct file_id_full_dir_info *)kstat;
+		dinfo->FileNameLength = cpu_to_le32(conv_len);
+		dinfo->EaSize =
+			smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode);
+		if (dinfo->EaSize)
+			dinfo->ExtFileAttributes = ATTR_REPARSE_POINT_LE;
+		dinfo->Reserved = 0;
+		dinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino);
+		if (d_info->hide_dot_file && d_info->name[0] == '.')
+			dinfo->ExtFileAttributes |= ATTR_HIDDEN_LE;
+		memcpy(dinfo->FileName, conv_name, conv_len);
+		dinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		break;
+	}
+	case FILEID_BOTH_DIRECTORY_INFORMATION:
+	{
+		struct file_id_both_directory_info *fibdinfo;
+
+		fibdinfo = (struct file_id_both_directory_info *)kstat;
+		fibdinfo->FileNameLength = cpu_to_le32(conv_len);
+		fibdinfo->EaSize =
+			smb2_get_reparse_tag_special_file(ksmbd_kstat->kstat->mode);
+		if (fibdinfo->EaSize)
+			fibdinfo->ExtFileAttributes = ATTR_REPARSE_POINT_LE;
+		fibdinfo->UniqueId = cpu_to_le64(ksmbd_kstat->kstat->ino);
+		fibdinfo->ShortNameLength = 0;
+		fibdinfo->Reserved = 0;
+		fibdinfo->Reserved2 = cpu_to_le16(0);
+		if (d_info->hide_dot_file && d_info->name[0] == '.')
+			fibdinfo->ExtFileAttributes |= ATTR_HIDDEN_LE;
+		memcpy(fibdinfo->FileName, conv_name, conv_len);
+		fibdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		break;
+	}
+	case SMB_FIND_FILE_POSIX_INFO:
+	{
+		struct smb2_posix_info *posix_info;
+		u64 time;
+
+		posix_info = (struct smb2_posix_info *)kstat;
+		posix_info->Ignored = 0;
+		posix_info->CreationTime = cpu_to_le64(ksmbd_kstat->create_time);
+		time = ksmbd_UnixTimeToNT(ksmbd_kstat->kstat->ctime);
+		posix_info->ChangeTime = cpu_to_le64(time);
+		time = ksmbd_UnixTimeToNT(ksmbd_kstat->kstat->atime);
+		posix_info->LastAccessTime = cpu_to_le64(time);
+		time = ksmbd_UnixTimeToNT(ksmbd_kstat->kstat->mtime);
+		posix_info->LastWriteTime = cpu_to_le64(time);
+		posix_info->EndOfFile = cpu_to_le64(ksmbd_kstat->kstat->size);
+		posix_info->AllocationSize = cpu_to_le64(ksmbd_kstat->kstat->blocks << 9);
+		posix_info->DeviceId = cpu_to_le32(ksmbd_kstat->kstat->rdev);
+		posix_info->HardLinks = cpu_to_le32(ksmbd_kstat->kstat->nlink);
+		posix_info->Mode = cpu_to_le32(ksmbd_kstat->kstat->mode);
+		posix_info->Inode = cpu_to_le64(ksmbd_kstat->kstat->ino);
+		posix_info->DosAttributes =
+			S_ISDIR(ksmbd_kstat->kstat->mode) ? ATTR_DIRECTORY_LE : ATTR_ARCHIVE_LE;
+		if (d_info->hide_dot_file && d_info->name[0] == '.')
+			posix_info->DosAttributes |= ATTR_HIDDEN_LE;
+		id_to_sid(from_kuid(&init_user_ns, ksmbd_kstat->kstat->uid),
+				SIDNFS_USER, (struct smb_sid *)&posix_info->SidBuffer[0]);
+		id_to_sid(from_kgid(&init_user_ns, ksmbd_kstat->kstat->gid),
+				SIDNFS_GROUP, (struct smb_sid *)&posix_info->SidBuffer[20]);
+		memcpy(posix_info->name, conv_name, conv_len);
+		posix_info->name_len = cpu_to_le32(conv_len);
+		posix_info->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		break;
+	}
+
+	} /* switch (info_level) */
+
+	d_info->last_entry_offset = d_info->data_count;
+	d_info->data_count += next_entry_offset;
+	d_info->wptr += next_entry_offset;
+	kfree(conv_name);
+
+	ksmbd_debug(SMB,
+		"info_level : %d, buf_len :%d, next_offset : %d, data_count : %d\n",
+		info_level, d_info->out_buf_len,
+		next_entry_offset, d_info->data_count);
+
+	return 0;
+}
+
+struct smb2_query_dir_private {
+	struct ksmbd_work	*work;
+	char			*search_pattern;
+	struct ksmbd_file	*dir_fp;
+
+	struct ksmbd_dir_info	*d_info;
+	int			info_level;
+};
+
+static void lock_dir(struct ksmbd_file *dir_fp)
+{
+	struct dentry *dir = dir_fp->filp->f_path.dentry;
+
+	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
+}
+
+static void unlock_dir(struct ksmbd_file *dir_fp)
+{
+	struct dentry *dir = dir_fp->filp->f_path.dentry;
+
+	inode_unlock(d_inode(dir));
+}
+
+static int process_query_dir_entries(struct smb2_query_dir_private *priv)
+{
+	struct kstat		kstat;
+	struct ksmbd_kstat	ksmbd_kstat;
+	int			rc;
+	int			i;
+
+	for (i = 0; i < priv->d_info->num_entry; i++) {
+		struct dentry *dent;
+
+		if (dentry_name(priv->d_info, priv->info_level))
+			return -EINVAL;
+
+		lock_dir(priv->dir_fp);
+		dent = lookup_one_len(priv->d_info->name,
+				      priv->dir_fp->filp->f_path.dentry,
+				      priv->d_info->name_len);
+		unlock_dir(priv->dir_fp);
+
+		if (IS_ERR(dent)) {
+			ksmbd_debug(SMB, "Cannot lookup `%s' [%ld]\n",
+				     priv->d_info->name,
+				     PTR_ERR(dent));
+			continue;
+		}
+		if (unlikely(d_is_negative(dent))) {
+			dput(dent);
+			ksmbd_debug(SMB, "Negative dentry `%s'\n",
+				    priv->d_info->name);
+			continue;
+		}
+
+		ksmbd_kstat.kstat = &kstat;
+		if (priv->info_level != FILE_NAMES_INFORMATION)
+			ksmbd_vfs_fill_dentry_attrs(priv->work,
+						    dent,
+						    &ksmbd_kstat);
+
+		rc = smb2_populate_readdir_entry(priv->work->conn,
+						 priv->info_level,
+						 priv->d_info,
+						 &ksmbd_kstat);
+		dput(dent);
+		if (rc)
+			return rc;
+	}
+	return 0;
+}
+
+static int reserve_populate_dentry(struct ksmbd_dir_info *d_info,
+		int info_level)
+{
+	int struct_sz;
+	int conv_len;
+	int next_entry_offset;
+
+	struct_sz = readdir_info_level_struct_sz(info_level);
+	if (struct_sz == -EOPNOTSUPP)
+		return -EOPNOTSUPP;
+
+	conv_len = (d_info->name_len + 1) * 2;
+	next_entry_offset = ALIGN(struct_sz - 1 + conv_len,
+				  KSMBD_DIR_INFO_ALIGNMENT);
+
+	if (next_entry_offset > d_info->out_buf_len) {
+		d_info->out_buf_len = 0;
+		return -ENOSPC;
+	}
+
+	switch (info_level) {
+	case FILE_FULL_DIRECTORY_INFORMATION:
+	{
+		struct file_full_directory_info *ffdinfo;
+
+		ffdinfo = (struct file_full_directory_info *)d_info->wptr;
+		memcpy(ffdinfo->FileName, d_info->name, d_info->name_len);
+		ffdinfo->FileName[d_info->name_len] = 0x00;
+		ffdinfo->FileNameLength = cpu_to_le32(d_info->name_len);
+		ffdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		break;
+	}
+	case FILE_BOTH_DIRECTORY_INFORMATION:
+	{
+		struct file_both_directory_info *fbdinfo;
+
+		fbdinfo = (struct file_both_directory_info *)d_info->wptr;
+		memcpy(fbdinfo->FileName, d_info->name, d_info->name_len);
+		fbdinfo->FileName[d_info->name_len] = 0x00;
+		fbdinfo->FileNameLength = cpu_to_le32(d_info->name_len);
+		fbdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		break;
+	}
+	case FILE_DIRECTORY_INFORMATION:
+	{
+		struct file_directory_info *fdinfo;
+
+		fdinfo = (struct file_directory_info *)d_info->wptr;
+		memcpy(fdinfo->FileName, d_info->name, d_info->name_len);
+		fdinfo->FileName[d_info->name_len] = 0x00;
+		fdinfo->FileNameLength = cpu_to_le32(d_info->name_len);
+		fdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		break;
+	}
+	case FILE_NAMES_INFORMATION:
+	{
+		struct file_names_info *fninfo;
+
+		fninfo = (struct file_names_info *)d_info->wptr;
+		memcpy(fninfo->FileName, d_info->name, d_info->name_len);
+		fninfo->FileName[d_info->name_len] = 0x00;
+		fninfo->FileNameLength = cpu_to_le32(d_info->name_len);
+		fninfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		break;
+	}
+	case FILEID_FULL_DIRECTORY_INFORMATION:
+	{
+		struct file_id_full_dir_info *dinfo;
+
+		dinfo = (struct file_id_full_dir_info *)d_info->wptr;
+		memcpy(dinfo->FileName, d_info->name, d_info->name_len);
+		dinfo->FileName[d_info->name_len] = 0x00;
+		dinfo->FileNameLength = cpu_to_le32(d_info->name_len);
+		dinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		break;
+	}
+	case FILEID_BOTH_DIRECTORY_INFORMATION:
+	{
+		struct file_id_both_directory_info *fibdinfo;
+
+		fibdinfo = (struct file_id_both_directory_info *)d_info->wptr;
+		memcpy(fibdinfo->FileName, d_info->name, d_info->name_len);
+		fibdinfo->FileName[d_info->name_len] = 0x00;
+		fibdinfo->FileNameLength = cpu_to_le32(d_info->name_len);
+		fibdinfo->NextEntryOffset = cpu_to_le32(next_entry_offset);
+		break;
+	}
+	case SMB_FIND_FILE_POSIX_INFO:
+	{
+		struct smb2_posix_info *posix_info;
+
+		posix_info = (struct smb2_posix_info *)d_info->wptr;
+		memcpy(posix_info->name, d_info->name, d_info->name_len);
+		posix_info->name[d_info->name_len] = 0x00;
+		posix_info->name_len = cpu_to_le32(d_info->name_len);
+		posix_info->NextEntryOffset =
+			cpu_to_le32(next_entry_offset);
+		break;
+	}
+	} /* switch (info_level) */
+
+	d_info->num_entry++;
+	d_info->out_buf_len -= next_entry_offset;
+	d_info->wptr += next_entry_offset;
+	return 0;
+}
+
+static int __query_dir(struct dir_context *ctx, const char *name, int namlen,
+		loff_t offset, u64 ino, unsigned int d_type)
+{
+	struct ksmbd_readdir_data	*buf;
+	struct smb2_query_dir_private	*priv;
+	struct ksmbd_dir_info		*d_info;
+	int				rc;
+
+	buf	= container_of(ctx, struct ksmbd_readdir_data, ctx);
+	priv	= buf->private;
+	d_info	= priv->d_info;
+
+	/* dot and dotdot entries are already reserved */
+	if (!strcmp(".", name) || !strcmp("..", name))
+		return 0;
+	if (ksmbd_share_veto_filename(priv->work->tcon->share_conf, name))
+		return 0;
+	if (!match_pattern(name, namlen, priv->search_pattern))
+		return 0;
+
+	d_info->name		= name;
+	d_info->name_len	= namlen;
+	rc = reserve_populate_dentry(d_info, priv->info_level);
+	if (rc)
+		return rc;
+	if (d_info->flags & SMB2_RETURN_SINGLE_ENTRY) {
+		d_info->out_buf_len = 0;
+		return 0;
+	}
+	return 0;
+}
+
+static void restart_ctx(struct dir_context *ctx)
+{
+	ctx->pos = 0;
+}
+
+static int verify_info_level(int info_level)
+{
+	switch (info_level) {
+	case FILE_FULL_DIRECTORY_INFORMATION:
+	case FILE_BOTH_DIRECTORY_INFORMATION:
+	case FILE_DIRECTORY_INFORMATION:
+	case FILE_NAMES_INFORMATION:
+	case FILEID_FULL_DIRECTORY_INFORMATION:
+	case FILEID_BOTH_DIRECTORY_INFORMATION:
+	case SMB_FIND_FILE_POSIX_INFO:
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	return 0;
+}
+
+int smb2_query_dir(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_query_directory_req *req;
+	struct smb2_query_directory_rsp *rsp, *rsp_org;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct ksmbd_file *dir_fp = NULL;
+	struct ksmbd_dir_info d_info;
+	int rc = 0;
+	char *srch_ptr = NULL;
+	unsigned char srch_flag;
+	int buffer_sz;
+	struct smb2_query_dir_private query_dir_private = {NULL, };
+
+	rsp_org = work->response_buf;
+	WORK_BUFFERS(work, req, rsp);
+
+	if (ksmbd_override_fsids(work)) {
+		rsp->hdr.Status = STATUS_NO_MEMORY;
+		smb2_set_err_rsp(work);
+		return -ENOMEM;
+	}
+
+	rc = verify_info_level(req->FileInformationClass);
+	if (rc) {
+		rc = -EFAULT;
+		goto err_out2;
+	}
+
+	dir_fp = ksmbd_lookup_fd_slow(work,
+			le64_to_cpu(req->VolatileFileId),
+			le64_to_cpu(req->PersistentFileId));
+	if (!dir_fp) {
+		rc = -EBADF;
+		goto err_out2;
+	}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	if (!(dir_fp->daccess & FILE_LIST_DIRECTORY_LE) ||
+	    inode_permission(&init_user_ns, file_inode(dir_fp->filp),
+			MAY_READ | MAY_EXEC)) {
+#else
+	if (!(dir_fp->daccess & FILE_LIST_DIRECTORY_LE) ||
+	    inode_permission(file_inode(dir_fp->filp), MAY_READ | MAY_EXEC)) {
+#endif
+		ksmbd_err("no right to enumerate directory (%s)\n",
+			FP_FILENAME(dir_fp));
+		rc = -EACCES;
+		goto err_out2;
+	}
+
+	if (!S_ISDIR(file_inode(dir_fp->filp)->i_mode)) {
+		ksmbd_err("can't do query dir for a file\n");
+		rc = -EINVAL;
+		goto err_out2;
+	}
+
+	srch_flag = req->Flags;
+	srch_ptr = smb_strndup_from_utf16(req->Buffer,
+			le16_to_cpu(req->FileNameLength), 1,
+			conn->local_nls);
+	if (IS_ERR(srch_ptr)) {
+		ksmbd_debug(SMB, "Search Pattern not found\n");
+		rc = -EINVAL;
+		goto err_out2;
+	} else {
+		ksmbd_debug(SMB, "Search pattern is %s\n", srch_ptr);
+	}
+
+	ksmbd_debug(SMB, "Directory name is %s\n", dir_fp->filename);
+
+	if (srch_flag & SMB2_REOPEN || srch_flag & SMB2_RESTART_SCANS) {
+		ksmbd_debug(SMB, "Restart directory scan\n");
+		generic_file_llseek(dir_fp->filp, 0, SEEK_SET);
+		restart_ctx(&dir_fp->readdir_data.ctx);
+	}
+
+	memset(&d_info, 0, sizeof(struct ksmbd_dir_info));
+	d_info.wptr = (char *)rsp->Buffer;
+	d_info.rptr = (char *)rsp->Buffer;
+	d_info.out_buf_len = (work->response_sz - (get_rfc1002_len(rsp_org) + 4));
+	d_info.out_buf_len = min_t(int, d_info.out_buf_len,
+		le32_to_cpu(req->OutputBufferLength)) - sizeof(struct smb2_query_directory_rsp);
+	d_info.flags = srch_flag;
+
+	/*
+	 * reserve dot and dotdot entries in head of buffer
+	 * in first response
+	 */
+	rc = ksmbd_populate_dot_dotdot_entries(work, req->FileInformationClass,
+		dir_fp,	&d_info, srch_ptr, smb2_populate_readdir_entry);
+	if (rc == -ENOSPC)
+		rc = 0;
+	else if (rc)
+		goto err_out;
+
+	if (test_share_config_flag(share, KSMBD_SHARE_FLAG_HIDE_DOT_FILES))
+		d_info.hide_dot_file = true;
+
+	buffer_sz				= d_info.out_buf_len;
+	d_info.rptr				= d_info.wptr;
+	query_dir_private.work			= work;
+	query_dir_private.search_pattern	= srch_ptr;
+	query_dir_private.dir_fp		= dir_fp;
+	query_dir_private.d_info		= &d_info;
+	query_dir_private.info_level		= req->FileInformationClass;
+	dir_fp->readdir_data.private		= &query_dir_private;
+	set_ctx_actor(&dir_fp->readdir_data.ctx, __query_dir);
+
+	rc = ksmbd_vfs_readdir(dir_fp->filp, &dir_fp->readdir_data);
+	if (rc == 0)
+		restart_ctx(&dir_fp->readdir_data.ctx);
+	if (rc == -ENOSPC)
+		rc = 0;
+	if (rc)
+		goto err_out;
+
+	d_info.wptr = d_info.rptr;
+	d_info.out_buf_len = buffer_sz;
+	rc = process_query_dir_entries(&query_dir_private);
+	if (rc)
+		goto err_out;
+
+	if (!d_info.data_count && d_info.out_buf_len >= 0) {
+		if (srch_flag & SMB2_RETURN_SINGLE_ENTRY && !is_asterisk(srch_ptr)) {
+			rsp->hdr.Status = STATUS_NO_SUCH_FILE;
+		} else {
+			dir_fp->dot_dotdot[0] = dir_fp->dot_dotdot[1] = 0;
+			rsp->hdr.Status = STATUS_NO_MORE_FILES;
+		}
+		rsp->StructureSize = cpu_to_le16(9);
+		rsp->OutputBufferOffset = cpu_to_le16(0);
+		rsp->OutputBufferLength = cpu_to_le32(0);
+		rsp->Buffer[0] = 0;
+		inc_rfc1001_len(rsp_org, 9);
+	} else {
+		((struct file_directory_info *)
+		((char *)rsp->Buffer + d_info.last_entry_offset))
+		->NextEntryOffset = 0;
+
+		rsp->StructureSize = cpu_to_le16(9);
+		rsp->OutputBufferOffset = cpu_to_le16(72);
+		rsp->OutputBufferLength = cpu_to_le32(d_info.data_count);
+		inc_rfc1001_len(rsp_org, 8 + d_info.data_count);
+	}
+
+	kfree(srch_ptr);
+	ksmbd_fd_put(work, dir_fp);
+	ksmbd_revert_fsids(work);
+	return 0;
+
+err_out:
+	ksmbd_err("error while processing smb2 query dir rc = %d\n", rc);
+	kfree(srch_ptr);
+
+err_out2:
+	if (rc == -EINVAL)
+		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+	else if (rc == -EACCES)
+		rsp->hdr.Status = STATUS_ACCESS_DENIED;
+	else if (rc == -ENOENT)
+		rsp->hdr.Status = STATUS_NO_SUCH_FILE;
+	else if (rc == -EBADF)
+		rsp->hdr.Status = STATUS_FILE_CLOSED;
+	else if (rc == -ENOMEM)
+		rsp->hdr.Status = STATUS_NO_MEMORY;
+	else if (rc == -EFAULT)
+		rsp->hdr.Status = STATUS_INVALID_INFO_CLASS;
+	if (!rsp->hdr.Status)
+		rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR;
+
+	smb2_set_err_rsp(work);
+	ksmbd_fd_put(work, dir_fp);
+	ksmbd_revert_fsids(work);
+	return 0;
+}
+
+/**
+ * buffer_check_err() - helper function to check buffer errors
+ * @reqOutputBufferLength:	max buffer length expected in command response
+ * @rsp:		query info response buffer contains output buffer length
+ * @infoclass_size:	query info class response buffer size
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int buffer_check_err(int reqOutputBufferLength,
+		struct smb2_query_info_rsp *rsp, int infoclass_size)
+{
+	if (reqOutputBufferLength < le32_to_cpu(rsp->OutputBufferLength)) {
+		if (reqOutputBufferLength < infoclass_size) {
+			ksmbd_err("Invalid Buffer Size Requested\n");
+			rsp->hdr.Status = STATUS_INFO_LENGTH_MISMATCH;
+			rsp->hdr.smb2_buf_length = cpu_to_be32(sizeof(struct smb2_hdr) - 4);
+			return -EINVAL;
+		}
+
+		ksmbd_debug(SMB, "Buffer Overflow\n");
+		rsp->hdr.Status = STATUS_BUFFER_OVERFLOW;
+		rsp->hdr.smb2_buf_length = cpu_to_be32(sizeof(struct smb2_hdr) - 4 +
+				reqOutputBufferLength);
+		rsp->OutputBufferLength = cpu_to_le32(reqOutputBufferLength);
+	}
+	return 0;
+}
+
+static void get_standard_info_pipe(struct smb2_query_info_rsp *rsp)
+{
+	struct smb2_file_standard_info *sinfo;
+
+	sinfo = (struct smb2_file_standard_info *)rsp->Buffer;
+
+	sinfo->AllocationSize = cpu_to_le64(4096);
+	sinfo->EndOfFile = cpu_to_le64(0);
+	sinfo->NumberOfLinks = cpu_to_le32(1);
+	sinfo->DeletePending = 1;
+	sinfo->Directory = 0;
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_standard_info));
+	inc_rfc1001_len(rsp, sizeof(struct smb2_file_standard_info));
+}
+
+static void get_internal_info_pipe(struct smb2_query_info_rsp *rsp,
+		u64 num)
+{
+	struct smb2_file_internal_info *file_info;
+
+	file_info = (struct smb2_file_internal_info *)rsp->Buffer;
+
+	/* any unique number */
+	file_info->IndexNumber = cpu_to_le64(num | (1ULL << 63));
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_internal_info));
+	inc_rfc1001_len(rsp, sizeof(struct smb2_file_internal_info));
+}
+
+static int smb2_get_info_file_pipe(struct ksmbd_session *sess,
+		struct smb2_query_info_req *req,
+		struct smb2_query_info_rsp *rsp)
+{
+	u64 id;
+	int rc;
+
+	/*
+	 * Windows can sometime send query file info request on
+	 * pipe without opening it, checking error condition here
+	 */
+	id = le64_to_cpu(req->VolatileFileId);
+	if (!ksmbd_session_rpc_method(sess, id))
+		return -ENOENT;
+
+	ksmbd_debug(SMB, "FileInfoClass %u, FileId 0x%llx\n",
+		     req->FileInfoClass, le64_to_cpu(req->VolatileFileId));
+
+	switch (req->FileInfoClass) {
+	case FILE_STANDARD_INFORMATION:
+		get_standard_info_pipe(rsp);
+		rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength),
+			rsp, FILE_STANDARD_INFORMATION_SIZE);
+		break;
+	case FILE_INTERNAL_INFORMATION:
+		get_internal_info_pipe(rsp, id);
+		rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength),
+			rsp, FILE_INTERNAL_INFORMATION_SIZE);
+		break;
+	default:
+		ksmbd_debug(SMB, "smb2_info_file_pipe for %u not supported\n",
+			req->FileInfoClass);
+		rc = -EOPNOTSUPP;
+	}
+	return rc;
+}
+
+/**
+ * smb2_get_ea() - handler for smb2 get extended attribute command
+ * @work:	smb work containing query info command buffer
+ * @fp:		ksmbd_file pointer
+ * @req:	get extended attribute request
+ * @rsp:	response buffer pointer
+ * @rsp_org:	base response buffer pointer in case of chained response
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp,
+		struct smb2_query_info_req *req,
+		struct smb2_query_info_rsp *rsp, void *rsp_org)
+{
+	struct smb2_ea_info *eainfo, *prev_eainfo;
+	char *name, *ptr, *xattr_list = NULL, *buf;
+	int rc, name_len, value_len, xattr_list_len, idx;
+	ssize_t buf_free_len, alignment_bytes, next_offset, rsp_data_cnt = 0;
+	struct smb2_ea_info_req *ea_req = NULL;
+	struct path *path;
+
+	if (!(fp->daccess & FILE_READ_EA_LE)) {
+		ksmbd_err("Not permitted to read ext attr : 0x%x\n",
+			  fp->daccess);
+		return -EACCES;
+	}
+
+	path = &fp->filp->f_path;
+	/* single EA entry is requested with given user.* name */
+	if (req->InputBufferLength) {
+		ea_req = (struct smb2_ea_info_req *)req->Buffer;
+	} else {
+		/* need to send all EAs, if no specific EA is requested*/
+		if (le32_to_cpu(req->Flags) & SL_RETURN_SINGLE_ENTRY)
+			ksmbd_debug(SMB,
+				"All EAs are requested but need to send single EA entry in rsp flags 0x%x\n",
+				le32_to_cpu(req->Flags));
+	}
+
+	buf_free_len = work->response_sz -
+			(get_rfc1002_len(rsp_org) + 4) -
+			sizeof(struct smb2_query_info_rsp);
+
+	if (le32_to_cpu(req->OutputBufferLength) < buf_free_len)
+		buf_free_len = le32_to_cpu(req->OutputBufferLength);
+
+	rc = ksmbd_vfs_listxattr(path->dentry, &xattr_list);
+	if (rc < 0) {
+		rsp->hdr.Status = STATUS_INVALID_HANDLE;
+		goto out;
+	} else if (!rc) { /* there is no EA in the file */
+		ksmbd_debug(SMB, "no ea data in the file\n");
+		goto done;
+	}
+	xattr_list_len = rc;
+
+	ptr = (char *)rsp->Buffer;
+	eainfo = (struct smb2_ea_info *)ptr;
+	prev_eainfo = eainfo;
+	idx = 0;
+
+	while (idx < xattr_list_len) {
+		name = xattr_list + idx;
+		name_len = strlen(name);
+
+		ksmbd_debug(SMB, "%s, len %d\n", name, name_len);
+		idx += name_len + 1;
+
+		/*
+		 * CIFS does not support EA other than user.* namespace,
+		 * still keep the framework generic, to list other attrs
+		 * in future.
+		 */
+		if (strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
+			continue;
+
+		if (!strncmp(&name[XATTR_USER_PREFIX_LEN], STREAM_PREFIX,
+			     STREAM_PREFIX_LEN))
+			continue;
+
+		if (req->InputBufferLength &&
+		    strncmp(&name[XATTR_USER_PREFIX_LEN], ea_req->name,
+			    ea_req->EaNameLength))
+			continue;
+
+		if (!strncmp(&name[XATTR_USER_PREFIX_LEN],
+			     DOS_ATTRIBUTE_PREFIX, DOS_ATTRIBUTE_PREFIX_LEN))
+			continue;
+
+		if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
+			name_len -= XATTR_USER_PREFIX_LEN;
+
+		ptr = (char *)(&eainfo->name + name_len + 1);
+		buf_free_len -= (offsetof(struct smb2_ea_info, name) +
+				name_len + 1);
+		/* bailout if xattr can't fit in buf_free_len */
+		value_len = ksmbd_vfs_getxattr(path->dentry, name, &buf);
+		if (value_len <= 0) {
+			rc = -ENOENT;
+			rsp->hdr.Status = STATUS_INVALID_HANDLE;
+			goto out;
+		}
+
+		buf_free_len -= value_len;
+		if (buf_free_len < 0) {
+			kfree(buf);
+			break;
+		}
+
+		memcpy(ptr, buf, value_len);
+		kfree(buf);
+
+		ptr += value_len;
+		eainfo->Flags = 0;
+		eainfo->EaNameLength = name_len;
+
+		if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
+			memcpy(eainfo->name, &name[XATTR_USER_PREFIX_LEN],
+					name_len);
+		else
+			memcpy(eainfo->name, name, name_len);
+
+		eainfo->name[name_len] = '\0';
+		eainfo->EaValueLength = cpu_to_le16(value_len);
+		next_offset = offsetof(struct smb2_ea_info, name) +
+			name_len + 1 + value_len;
+
+		/* align next xattr entry at 4 byte bundary */
+		alignment_bytes = ((next_offset + 3) & ~3) - next_offset;
+		if (alignment_bytes) {
+			memset(ptr, '\0', alignment_bytes);
+			ptr += alignment_bytes;
+			next_offset += alignment_bytes;
+			buf_free_len -= alignment_bytes;
+		}
+		eainfo->NextEntryOffset = cpu_to_le32(next_offset);
+		prev_eainfo = eainfo;
+		eainfo = (struct smb2_ea_info *)ptr;
+		rsp_data_cnt += next_offset;
+
+		if (req->InputBufferLength) {
+			ksmbd_debug(SMB, "single entry requested\n");
+			break;
+		}
+	}
+
+	/* no more ea entries */
+	prev_eainfo->NextEntryOffset = 0;
+done:
+	rc = 0;
+	if (rsp_data_cnt == 0)
+		rsp->hdr.Status = STATUS_NO_EAS_ON_FILE;
+	rsp->OutputBufferLength = cpu_to_le32(rsp_data_cnt);
+	inc_rfc1001_len(rsp_org, rsp_data_cnt);
+out:
+	kvfree(xattr_list);
+	return rc;
+}
+
+static void get_file_access_info(struct smb2_query_info_rsp *rsp,
+		struct ksmbd_file *fp, void *rsp_org)
+{
+	struct smb2_file_access_info *file_info;
+
+	file_info = (struct smb2_file_access_info *)rsp->Buffer;
+	file_info->AccessFlags = fp->daccess;
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_access_info));
+	inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_access_info));
+}
+
+static int get_file_basic_info(struct smb2_query_info_rsp *rsp,
+		struct ksmbd_file *fp, void *rsp_org)
+{
+	struct smb2_file_all_info *basic_info;
+	struct kstat stat;
+	u64 time;
+
+	if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) {
+		ksmbd_err("no right to read the attributes : 0x%x\n",
+			   fp->daccess);
+		return -EACCES;
+	}
+
+	basic_info = (struct smb2_file_all_info *)rsp->Buffer;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	generic_fillattr(&init_user_ns, FP_INODE(fp), &stat);
+#else
+	generic_fillattr(FP_INODE(fp), &stat);
+#endif
+	basic_info->CreationTime = cpu_to_le64(fp->create_time);
+	time = ksmbd_UnixTimeToNT(stat.atime);
+	basic_info->LastAccessTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(stat.mtime);
+	basic_info->LastWriteTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(stat.ctime);
+	basic_info->ChangeTime = cpu_to_le64(time);
+	basic_info->Attributes = fp->f_ci->m_fattr;
+	basic_info->Pad1 = 0;
+	rsp->OutputBufferLength =
+		cpu_to_le32(offsetof(struct smb2_file_all_info, AllocationSize));
+	inc_rfc1001_len(rsp_org, offsetof(struct smb2_file_all_info,
+					  AllocationSize));
+	return 0;
+}
+
+static unsigned long long get_allocation_size(struct inode *inode,
+		struct kstat *stat)
+{
+	unsigned long long alloc_size = 0;
+
+	if (!S_ISDIR(stat->mode)) {
+		if ((inode->i_blocks << 9) <= stat->size)
+			alloc_size = stat->size;
+		else
+			alloc_size = inode->i_blocks << 9;
+	}
+
+	return alloc_size;
+}
+
+static void get_file_standard_info(struct smb2_query_info_rsp *rsp,
+		struct ksmbd_file *fp, void *rsp_org)
+{
+	struct smb2_file_standard_info *sinfo;
+	unsigned int delete_pending;
+	struct inode *inode;
+	struct kstat stat;
+
+	inode = FP_INODE(fp);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	generic_fillattr(&init_user_ns, inode, &stat);
+#else
+	generic_fillattr(inode, &stat);
+#endif
+
+	sinfo = (struct smb2_file_standard_info *)rsp->Buffer;
+	delete_pending = ksmbd_inode_pending_delete(fp);
+
+	sinfo->AllocationSize = cpu_to_le64(get_allocation_size(inode, &stat));
+	sinfo->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size);
+	sinfo->NumberOfLinks = cpu_to_le32(get_nlink(&stat) - delete_pending);
+	sinfo->DeletePending = delete_pending;
+	sinfo->Directory = S_ISDIR(stat.mode) ? 1 : 0;
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_standard_info));
+	inc_rfc1001_len(rsp_org,
+			sizeof(struct smb2_file_standard_info));
+}
+
+static void get_file_alignment_info(struct smb2_query_info_rsp *rsp,
+		void *rsp_org)
+{
+	struct smb2_file_alignment_info *file_info;
+
+	file_info = (struct smb2_file_alignment_info *)rsp->Buffer;
+	file_info->AlignmentRequirement = 0;
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_alignment_info));
+	inc_rfc1001_len(rsp_org,
+			sizeof(struct smb2_file_alignment_info));
+}
+
+static int get_file_all_info(struct ksmbd_work *work,
+		struct smb2_query_info_rsp *rsp, struct ksmbd_file *fp,
+		void *rsp_org)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_file_all_info *file_info;
+	unsigned int delete_pending;
+	struct inode *inode;
+	struct kstat stat;
+	int conv_len;
+	char *filename;
+	u64 time;
+
+	if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) {
+		ksmbd_debug(SMB, "no right to read the attributes : 0x%x\n",
+				fp->daccess);
+		return -EACCES;
+	}
+
+	filename = convert_to_nt_pathname(fp->filename,
+					  work->tcon->share_conf->path);
+	if (!filename)
+		return -ENOMEM;
+
+	inode = FP_INODE(fp);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	generic_fillattr(&init_user_ns, inode, &stat);
+#else
+	generic_fillattr(inode, &stat);
+#endif
+
+	ksmbd_debug(SMB, "filename = %s\n", filename);
+	delete_pending = ksmbd_inode_pending_delete(fp);
+	file_info = (struct smb2_file_all_info *)rsp->Buffer;
+
+	file_info->CreationTime = cpu_to_le64(fp->create_time);
+	time = ksmbd_UnixTimeToNT(stat.atime);
+	file_info->LastAccessTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(stat.mtime);
+	file_info->LastWriteTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(stat.ctime);
+	file_info->ChangeTime = cpu_to_le64(time);
+	file_info->Attributes = fp->f_ci->m_fattr;
+	file_info->Pad1 = 0;
+	file_info->AllocationSize =
+		cpu_to_le64(get_allocation_size(inode, &stat));
+	file_info->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size);
+	file_info->NumberOfLinks =
+			cpu_to_le32(get_nlink(&stat) - delete_pending);
+	file_info->DeletePending = delete_pending;
+	file_info->Directory = S_ISDIR(stat.mode) ? 1 : 0;
+	file_info->Pad2 = 0;
+	file_info->IndexNumber = cpu_to_le64(stat.ino);
+	file_info->EASize = 0;
+	file_info->AccessFlags = fp->daccess;
+	file_info->CurrentByteOffset = cpu_to_le64(fp->filp->f_pos);
+	file_info->Mode = fp->coption;
+	file_info->AlignmentRequirement = 0;
+	conv_len = smbConvertToUTF16((__le16 *)file_info->FileName,
+					     filename,
+					     PATH_MAX,
+					     conn->local_nls,
+					     0);
+	conv_len *= 2;
+	file_info->FileNameLength = cpu_to_le32(conv_len);
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_all_info) + conv_len - 1);
+	kfree(filename);
+	inc_rfc1001_len(rsp_org, le32_to_cpu(rsp->OutputBufferLength));
+	return 0;
+}
+
+static void get_file_alternate_info(struct ksmbd_work *work,
+		struct smb2_query_info_rsp *rsp, struct ksmbd_file *fp,
+		void *rsp_org)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_file_alt_name_info *file_info;
+	int conv_len;
+	char *filename;
+
+	filename = (char *)FP_FILENAME(fp);
+	file_info = (struct smb2_file_alt_name_info *)rsp->Buffer;
+	conv_len = ksmbd_extract_shortname(conn,
+					   filename,
+					   file_info->FileName);
+	file_info->FileNameLength = cpu_to_le32(conv_len);
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_alt_name_info) + conv_len);
+	inc_rfc1001_len(rsp_org, le32_to_cpu(rsp->OutputBufferLength));
+}
+
+static void get_file_stream_info(struct ksmbd_work *work,
+		struct smb2_query_info_rsp *rsp, struct ksmbd_file *fp,
+		void *rsp_org)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_file_stream_info *file_info;
+	char *stream_name, *xattr_list = NULL, *stream_buf;
+	struct kstat stat;
+	struct path *path = &fp->filp->f_path;
+	ssize_t xattr_list_len;
+	int nbytes = 0, streamlen, stream_name_len, next, idx = 0;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	generic_fillattr(&init_user_ns, FP_INODE(fp), &stat);
+#else
+	generic_fillattr(FP_INODE(fp), &stat);
+#endif
+	file_info = (struct smb2_file_stream_info *)rsp->Buffer;
+
+	xattr_list_len = ksmbd_vfs_listxattr(path->dentry, &xattr_list);
+	if (xattr_list_len < 0) {
+		goto out;
+	} else if (!xattr_list_len) {
+		ksmbd_debug(SMB, "empty xattr in the file\n");
+		goto out;
+	}
+
+	while (idx < xattr_list_len) {
+		stream_name = xattr_list + idx;
+		streamlen = strlen(stream_name);
+		idx += streamlen + 1;
+
+		ksmbd_debug(SMB, "%s, len %d\n", stream_name, streamlen);
+
+		if (strncmp(&stream_name[XATTR_USER_PREFIX_LEN],
+			    STREAM_PREFIX, STREAM_PREFIX_LEN))
+			continue;
+
+		stream_name_len = streamlen - (XATTR_USER_PREFIX_LEN +
+				STREAM_PREFIX_LEN);
+		streamlen = stream_name_len;
+
+		/* plus : size */
+		streamlen += 1;
+		stream_buf = kmalloc(streamlen + 1, GFP_KERNEL);
+		if (!stream_buf)
+			break;
+
+		streamlen = snprintf(stream_buf, streamlen + 1,
+				":%s", &stream_name[XATTR_NAME_STREAM_LEN]);
+
+		file_info = (struct smb2_file_stream_info *)
+			&rsp->Buffer[nbytes];
+		streamlen  = smbConvertToUTF16((__le16 *)file_info->StreamName,
+						stream_buf,
+						streamlen,
+						conn->local_nls,
+						0);
+		streamlen *= 2;
+		kfree(stream_buf);
+		file_info->StreamNameLength = cpu_to_le32(streamlen);
+		file_info->StreamSize = cpu_to_le64(stream_name_len);
+		file_info->StreamAllocationSize = cpu_to_le64(stream_name_len);
+
+		next = sizeof(struct smb2_file_stream_info) + streamlen;
+		nbytes += next;
+		file_info->NextEntryOffset = cpu_to_le32(next);
+	}
+
+	if (nbytes) {
+		file_info = (struct smb2_file_stream_info *)
+			&rsp->Buffer[nbytes];
+		streamlen = smbConvertToUTF16((__le16 *)file_info->StreamName,
+			"::$DATA", 7, conn->local_nls, 0);
+		streamlen *= 2;
+		file_info->StreamNameLength = cpu_to_le32(streamlen);
+		file_info->StreamSize = S_ISDIR(stat.mode) ? 0 :
+			cpu_to_le64(stat.size);
+		file_info->StreamAllocationSize = S_ISDIR(stat.mode) ? 0 :
+			cpu_to_le64(stat.size);
+		nbytes += sizeof(struct smb2_file_stream_info) + streamlen;
+	}
+
+	/* last entry offset should be 0 */
+	file_info->NextEntryOffset = 0;
+out:
+	kvfree(xattr_list);
+
+	rsp->OutputBufferLength = cpu_to_le32(nbytes);
+	inc_rfc1001_len(rsp_org, nbytes);
+}
+
+static void get_file_internal_info(struct smb2_query_info_rsp *rsp,
+		struct ksmbd_file *fp, void *rsp_org)
+{
+	struct smb2_file_internal_info *file_info;
+	struct kstat stat;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	generic_fillattr(&init_user_ns, FP_INODE(fp), &stat);
+#else
+	generic_fillattr(FP_INODE(fp), &stat);
+#endif
+	file_info = (struct smb2_file_internal_info *)rsp->Buffer;
+	file_info->IndexNumber = cpu_to_le64(stat.ino);
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_internal_info));
+	inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_internal_info));
+}
+
+static int get_file_network_open_info(struct smb2_query_info_rsp *rsp,
+		struct ksmbd_file *fp, void *rsp_org)
+{
+	struct smb2_file_ntwrk_info *file_info;
+	struct inode *inode;
+	struct kstat stat;
+	u64 time;
+
+	if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) {
+		ksmbd_err("no right to read the attributes : 0x%x\n",
+			  fp->daccess);
+		return -EACCES;
+	}
+
+	file_info = (struct smb2_file_ntwrk_info *)rsp->Buffer;
+
+	inode = FP_INODE(fp);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	generic_fillattr(&init_user_ns, inode, &stat);
+#else
+	generic_fillattr(inode, &stat);
+#endif
+
+	file_info->CreationTime = cpu_to_le64(fp->create_time);
+	time = ksmbd_UnixTimeToNT(stat.atime);
+	file_info->LastAccessTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(stat.mtime);
+	file_info->LastWriteTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(stat.ctime);
+	file_info->ChangeTime = cpu_to_le64(time);
+	file_info->Attributes = fp->f_ci->m_fattr;
+	file_info->AllocationSize =
+		cpu_to_le64(get_allocation_size(inode, &stat));
+	file_info->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size);
+	file_info->Reserved = cpu_to_le32(0);
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_ntwrk_info));
+	inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_ntwrk_info));
+	return 0;
+}
+
+static void get_file_ea_info(struct smb2_query_info_rsp *rsp, void *rsp_org)
+{
+	struct smb2_file_ea_info *file_info;
+
+	file_info = (struct smb2_file_ea_info *)rsp->Buffer;
+	file_info->EASize = 0;
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_ea_info));
+	inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_ea_info));
+}
+
+static void get_file_position_info(struct smb2_query_info_rsp *rsp,
+		struct ksmbd_file *fp, void *rsp_org)
+{
+	struct smb2_file_pos_info *file_info;
+
+	file_info = (struct smb2_file_pos_info *)rsp->Buffer;
+	file_info->CurrentByteOffset = cpu_to_le64(fp->filp->f_pos);
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_pos_info));
+	inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_pos_info));
+}
+
+static void get_file_mode_info(struct smb2_query_info_rsp *rsp,
+		struct ksmbd_file *fp, void *rsp_org)
+{
+	struct smb2_file_mode_info *file_info;
+
+	file_info = (struct smb2_file_mode_info *)rsp->Buffer;
+	file_info->Mode = fp->coption & FILE_MODE_INFO_MASK;
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_mode_info));
+	inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_mode_info));
+}
+
+static void get_file_compression_info(struct smb2_query_info_rsp *rsp,
+		struct ksmbd_file *fp, void *rsp_org)
+{
+	struct smb2_file_comp_info *file_info;
+	struct kstat stat;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	generic_fillattr(&init_user_ns, FP_INODE(fp), &stat);
+#else
+	generic_fillattr(FP_INODE(fp), &stat);
+#endif
+
+	file_info = (struct smb2_file_comp_info *)rsp->Buffer;
+	file_info->CompressedFileSize = cpu_to_le64(stat.blocks << 9);
+	file_info->CompressionFormat = COMPRESSION_FORMAT_NONE;
+	file_info->CompressionUnitShift = 0;
+	file_info->ChunkShift = 0;
+	file_info->ClusterShift = 0;
+	memset(&file_info->Reserved[0], 0, 3);
+
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_comp_info));
+	inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_comp_info));
+}
+
+static int get_file_attribute_tag_info(struct smb2_query_info_rsp *rsp,
+		struct ksmbd_file *fp, void *rsp_org)
+{
+	struct smb2_file_attr_tag_info *file_info;
+
+	if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) {
+		ksmbd_err("no right to read the attributes : 0x%x\n",
+			  fp->daccess);
+		return -EACCES;
+	}
+
+	file_info = (struct smb2_file_attr_tag_info *)rsp->Buffer;
+	file_info->FileAttributes = fp->f_ci->m_fattr;
+	file_info->ReparseTag = 0;
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb2_file_attr_tag_info));
+	inc_rfc1001_len(rsp_org,
+		sizeof(struct smb2_file_attr_tag_info));
+	return 0;
+}
+
+static int find_file_posix_info(struct smb2_query_info_rsp *rsp,
+		struct ksmbd_file *fp, void *rsp_org)
+{
+	struct smb311_posix_qinfo *file_info;
+	struct inode *inode = FP_INODE(fp);
+	u64 time;
+
+	file_info = (struct smb311_posix_qinfo *)rsp->Buffer;
+	file_info->CreationTime = cpu_to_le64(fp->create_time);
+	time = ksmbd_UnixTimeToNT(inode->i_atime);
+	file_info->LastAccessTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(inode->i_mtime);
+	file_info->LastWriteTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(inode->i_ctime);
+	file_info->ChangeTime = cpu_to_le64(time);
+	file_info->DosAttributes = fp->f_ci->m_fattr;
+	file_info->Inode = cpu_to_le64(inode->i_ino);
+	file_info->EndOfFile = cpu_to_le64(inode->i_size);
+	file_info->AllocationSize = cpu_to_le64(inode->i_blocks << 9);
+	file_info->HardLinks = cpu_to_le32(inode->i_nlink);
+	file_info->Mode = cpu_to_le32(inode->i_mode);
+	file_info->DeviceId = cpu_to_le32(inode->i_rdev);
+	rsp->OutputBufferLength =
+		cpu_to_le32(sizeof(struct smb311_posix_qinfo));
+	inc_rfc1001_len(rsp_org, sizeof(struct smb311_posix_qinfo));
+	return 0;
+}
+
+static int smb2_get_info_file(struct ksmbd_work *work,
+		struct smb2_query_info_req *req,
+		struct smb2_query_info_rsp *rsp, void *rsp_org)
+{
+	struct ksmbd_file *fp;
+	int fileinfoclass = 0;
+	int rc = 0;
+	int file_infoclass_size;
+	unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID;
+
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_PIPE)) {
+		/* smb2 info file called for pipe */
+		return smb2_get_info_file_pipe(work->sess, req, rsp);
+	}
+
+	if (work->next_smb2_rcv_hdr_off) {
+		if (!HAS_FILE_ID(le64_to_cpu(req->VolatileFileId))) {
+			ksmbd_debug(SMB, "Compound request set FID = %u\n",
+					work->compound_fid);
+			id = work->compound_fid;
+			pid = work->compound_pfid;
+		}
+	}
+
+	if (!HAS_FILE_ID(id)) {
+		id = le64_to_cpu(req->VolatileFileId);
+		pid = le64_to_cpu(req->PersistentFileId);
+	}
+
+	fp = ksmbd_lookup_fd_slow(work, id, pid);
+	if (!fp)
+		return -ENOENT;
+
+	fileinfoclass = req->FileInfoClass;
+
+	switch (fileinfoclass) {
+	case FILE_ACCESS_INFORMATION:
+		get_file_access_info(rsp, fp, rsp_org);
+		file_infoclass_size = FILE_ACCESS_INFORMATION_SIZE;
+		break;
+
+	case FILE_BASIC_INFORMATION:
+		rc = get_file_basic_info(rsp, fp, rsp_org);
+		file_infoclass_size = FILE_BASIC_INFORMATION_SIZE;
+		break;
+
+	case FILE_STANDARD_INFORMATION:
+		get_file_standard_info(rsp, fp, rsp_org);
+		file_infoclass_size = FILE_STANDARD_INFORMATION_SIZE;
+		break;
+
+	case FILE_ALIGNMENT_INFORMATION:
+		get_file_alignment_info(rsp, rsp_org);
+		file_infoclass_size = FILE_ALIGNMENT_INFORMATION_SIZE;
+		break;
+
+	case FILE_ALL_INFORMATION:
+		rc = get_file_all_info(work, rsp, fp, rsp_org);
+		file_infoclass_size = FILE_ALL_INFORMATION_SIZE;
+		break;
+
+	case FILE_ALTERNATE_NAME_INFORMATION:
+		get_file_alternate_info(work, rsp, fp, rsp_org);
+		file_infoclass_size = FILE_ALTERNATE_NAME_INFORMATION_SIZE;
+		break;
+
+	case FILE_STREAM_INFORMATION:
+		get_file_stream_info(work, rsp, fp, rsp_org);
+		file_infoclass_size = FILE_STREAM_INFORMATION_SIZE;
+		break;
+
+	case FILE_INTERNAL_INFORMATION:
+		get_file_internal_info(rsp, fp, rsp_org);
+		file_infoclass_size = FILE_INTERNAL_INFORMATION_SIZE;
+		break;
+
+	case FILE_NETWORK_OPEN_INFORMATION:
+		rc = get_file_network_open_info(rsp, fp, rsp_org);
+		file_infoclass_size = FILE_NETWORK_OPEN_INFORMATION_SIZE;
+		break;
+
+	case FILE_EA_INFORMATION:
+		get_file_ea_info(rsp, rsp_org);
+		file_infoclass_size = FILE_EA_INFORMATION_SIZE;
+		break;
+
+	case FILE_FULL_EA_INFORMATION:
+		rc = smb2_get_ea(work, fp, req, rsp, rsp_org);
+		file_infoclass_size = FILE_FULL_EA_INFORMATION_SIZE;
+		break;
+
+	case FILE_POSITION_INFORMATION:
+		get_file_position_info(rsp, fp, rsp_org);
+		file_infoclass_size = FILE_POSITION_INFORMATION_SIZE;
+		break;
+
+	case FILE_MODE_INFORMATION:
+		get_file_mode_info(rsp, fp, rsp_org);
+		file_infoclass_size = FILE_MODE_INFORMATION_SIZE;
+		break;
+
+	case FILE_COMPRESSION_INFORMATION:
+		get_file_compression_info(rsp, fp, rsp_org);
+		file_infoclass_size = FILE_COMPRESSION_INFORMATION_SIZE;
+		break;
+
+	case FILE_ATTRIBUTE_TAG_INFORMATION:
+		rc = get_file_attribute_tag_info(rsp, fp, rsp_org);
+		file_infoclass_size = FILE_ATTRIBUTE_TAG_INFORMATION_SIZE;
+		break;
+	case SMB_FIND_FILE_POSIX_INFO:
+		if (!work->tcon->posix_extensions) {
+			ksmbd_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n");
+			rc = -EOPNOTSUPP;
+		} else {
+			rc = find_file_posix_info(rsp, fp, rsp_org);
+			file_infoclass_size = sizeof(struct smb311_posix_qinfo);
+		}
+		break;
+	default:
+		ksmbd_debug(SMB, "fileinfoclass %d not supported yet\n",
+			    fileinfoclass);
+		rc = -EOPNOTSUPP;
+	}
+	if (!rc)
+		rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength),
+				      rsp,
+				      file_infoclass_size);
+	ksmbd_fd_put(work, fp);
+	return rc;
+}
+
+static int smb2_get_info_filesystem(struct ksmbd_work *work,
+		struct smb2_query_info_req *req,
+		struct smb2_query_info_rsp *rsp, void *rsp_org)
+{
+	struct ksmbd_session *sess = work->sess;
+	struct ksmbd_conn *conn = sess->conn;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	int fsinfoclass = 0;
+	struct kstatfs stfs;
+	struct path path;
+	int rc = 0, len;
+	int fs_infoclass_size = 0;
+
+	rc = ksmbd_vfs_kern_path(share->path, LOOKUP_FOLLOW, &path, 0);
+	if (rc) {
+		ksmbd_err("cannot create vfs path\n");
+		return -EIO;
+	}
+
+	rc = vfs_statfs(&path, &stfs);
+	if (rc) {
+		ksmbd_err("cannot do stat of path %s\n", share->path);
+		path_put(&path);
+		return -EIO;
+	}
+
+	fsinfoclass = req->FileInfoClass;
+
+	switch (fsinfoclass) {
+	case FS_DEVICE_INFORMATION:
+	{
+		struct filesystem_device_info *info;
+
+		info = (struct filesystem_device_info *)rsp->Buffer;
+
+		info->DeviceType = cpu_to_le32(stfs.f_type);
+		info->DeviceCharacteristics = cpu_to_le32(0x00000020);
+		rsp->OutputBufferLength = cpu_to_le32(8);
+		inc_rfc1001_len(rsp_org, 8);
+		fs_infoclass_size = FS_DEVICE_INFORMATION_SIZE;
+		break;
+	}
+	case FS_ATTRIBUTE_INFORMATION:
+	{
+		struct filesystem_attribute_info *info;
+		size_t sz;
+
+		info = (struct filesystem_attribute_info *)rsp->Buffer;
+		info->Attributes = cpu_to_le32(FILE_SUPPORTS_OBJECT_IDS |
+					       FILE_PERSISTENT_ACLS |
+					       FILE_UNICODE_ON_DISK |
+					       FILE_CASE_PRESERVED_NAMES |
+					       FILE_CASE_SENSITIVE_SEARCH);
+
+		info->Attributes |= cpu_to_le32(server_conf.share_fake_fscaps);
+
+		info->MaxPathNameComponentLength = cpu_to_le32(stfs.f_namelen);
+		len = smbConvertToUTF16((__le16 *)info->FileSystemName,
+					"NTFS", PATH_MAX, conn->local_nls, 0);
+		len = len * 2;
+		info->FileSystemNameLen = cpu_to_le32(len);
+		sz = sizeof(struct filesystem_attribute_info) - 2 + len;
+		rsp->OutputBufferLength = cpu_to_le32(sz);
+		inc_rfc1001_len(rsp_org, sz);
+		fs_infoclass_size = FS_ATTRIBUTE_INFORMATION_SIZE;
+		break;
+	}
+	case FS_VOLUME_INFORMATION:
+	{
+		struct filesystem_vol_info *info;
+		size_t sz;
+
+		info = (struct filesystem_vol_info *)(rsp->Buffer);
+		info->VolumeCreationTime = 0;
+		/* Taking dummy value of serial number*/
+		info->SerialNumber = cpu_to_le32(0xbc3ac512);
+		len = smbConvertToUTF16((__le16 *)info->VolumeLabel,
+					share->name, PATH_MAX,
+					conn->local_nls, 0);
+		len = len * 2;
+		info->VolumeLabelSize = cpu_to_le32(len);
+		info->Reserved = 0;
+		sz = sizeof(struct filesystem_vol_info) - 2 + len;
+		rsp->OutputBufferLength = cpu_to_le32(sz);
+		inc_rfc1001_len(rsp_org, sz);
+		fs_infoclass_size = FS_VOLUME_INFORMATION_SIZE;
+		break;
+	}
+	case FS_SIZE_INFORMATION:
+	{
+		struct filesystem_info *info;
+		unsigned short logical_sector_size;
+
+		info = (struct filesystem_info *)(rsp->Buffer);
+		logical_sector_size =
+			ksmbd_vfs_logical_sector_size(d_inode(path.dentry));
+
+		info->TotalAllocationUnits = cpu_to_le64(stfs.f_blocks);
+		info->FreeAllocationUnits = cpu_to_le64(stfs.f_bfree);
+		info->SectorsPerAllocationUnit = cpu_to_le32(stfs.f_bsize >> 9);
+		info->BytesPerSector = cpu_to_le32(logical_sector_size);
+		rsp->OutputBufferLength = cpu_to_le32(24);
+		inc_rfc1001_len(rsp_org, 24);
+		fs_infoclass_size = FS_SIZE_INFORMATION_SIZE;
+		break;
+	}
+	case FS_FULL_SIZE_INFORMATION:
+	{
+		struct smb2_fs_full_size_info *info;
+		unsigned short logical_sector_size;
+
+		info = (struct smb2_fs_full_size_info *)(rsp->Buffer);
+		logical_sector_size =
+			ksmbd_vfs_logical_sector_size(d_inode(path.dentry));
+
+		info->TotalAllocationUnits = cpu_to_le64(stfs.f_blocks);
+		info->CallerAvailableAllocationUnits =
+					cpu_to_le64(stfs.f_bavail);
+		info->ActualAvailableAllocationUnits =
+					cpu_to_le64(stfs.f_bfree);
+		info->SectorsPerAllocationUnit = cpu_to_le32(stfs.f_bsize >> 9);
+		info->BytesPerSector = cpu_to_le32(logical_sector_size);
+		rsp->OutputBufferLength = cpu_to_le32(32);
+		inc_rfc1001_len(rsp_org, 32);
+		fs_infoclass_size = FS_FULL_SIZE_INFORMATION_SIZE;
+		break;
+	}
+	case FS_OBJECT_ID_INFORMATION:
+	{
+		struct object_id_info *info;
+
+		info = (struct object_id_info *)(rsp->Buffer);
+
+		if (!user_guest(sess->user))
+			memcpy(info->objid, user_passkey(sess->user), 16);
+		else
+			memset(info->objid, 0, 16);
+
+		info->extended_info.magic = cpu_to_le32(EXTENDED_INFO_MAGIC);
+		info->extended_info.version = cpu_to_le32(1);
+		info->extended_info.release = cpu_to_le32(1);
+		info->extended_info.rel_date = 0;
+		memcpy(info->extended_info.version_string, "1.1.0", strlen("1.1.0"));
+		rsp->OutputBufferLength = cpu_to_le32(64);
+		inc_rfc1001_len(rsp_org, 64);
+		fs_infoclass_size = FS_OBJECT_ID_INFORMATION_SIZE;
+		break;
+	}
+	case FS_SECTOR_SIZE_INFORMATION:
+	{
+		struct smb3_fs_ss_info *info;
+		struct ksmbd_fs_sector_size fs_ss;
+
+		info = (struct smb3_fs_ss_info *)(rsp->Buffer);
+		ksmbd_vfs_smb2_sector_size(d_inode(path.dentry), &fs_ss);
+
+		info->LogicalBytesPerSector =
+				cpu_to_le32(fs_ss.logical_sector_size);
+		info->PhysicalBytesPerSectorForAtomicity =
+				cpu_to_le32(fs_ss.physical_sector_size);
+		info->PhysicalBytesPerSectorForPerf =
+				cpu_to_le32(fs_ss.optimal_io_size);
+		info->FSEffPhysicalBytesPerSectorForAtomicity =
+				cpu_to_le32(fs_ss.optimal_io_size);
+		info->Flags = cpu_to_le32(SSINFO_FLAGS_ALIGNED_DEVICE |
+				    SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE);
+		info->ByteOffsetForSectorAlignment = 0;
+		info->ByteOffsetForPartitionAlignment = 0;
+		rsp->OutputBufferLength = cpu_to_le32(28);
+		inc_rfc1001_len(rsp_org, 28);
+		fs_infoclass_size = FS_SECTOR_SIZE_INFORMATION_SIZE;
+		break;
+	}
+	case FS_CONTROL_INFORMATION:
+	{
+		/*
+		 * TODO : The current implementation is based on
+		 * test result with win7(NTFS) server. It's need to
+		 * modify this to get valid Quota values
+		 * from Linux kernel
+		 */
+		struct smb2_fs_control_info *info;
+
+		info = (struct smb2_fs_control_info *)(rsp->Buffer);
+		info->FreeSpaceStartFiltering = 0;
+		info->FreeSpaceThreshold = 0;
+		info->FreeSpaceStopFiltering = 0;
+		info->DefaultQuotaThreshold = cpu_to_le64(SMB2_NO_FID);
+		info->DefaultQuotaLimit = cpu_to_le64(SMB2_NO_FID);
+		info->Padding = 0;
+		rsp->OutputBufferLength = cpu_to_le32(48);
+		inc_rfc1001_len(rsp_org, 48);
+		fs_infoclass_size = FS_CONTROL_INFORMATION_SIZE;
+		break;
+	}
+	case FS_POSIX_INFORMATION:
+	{
+		struct filesystem_posix_info *info;
+		unsigned short logical_sector_size;
+
+		if (!work->tcon->posix_extensions) {
+			ksmbd_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n");
+			rc = -EOPNOTSUPP;
+		} else {
+			info = (struct filesystem_posix_info *)(rsp->Buffer);
+			logical_sector_size =
+				ksmbd_vfs_logical_sector_size(d_inode(path.dentry));
+			info->OptimalTransferSize = cpu_to_le32(logical_sector_size);
+			info->BlockSize = cpu_to_le32(stfs.f_bsize);
+			info->TotalBlocks = cpu_to_le64(stfs.f_blocks);
+			info->BlocksAvail = cpu_to_le64(stfs.f_bfree);
+			info->UserBlocksAvail = cpu_to_le64(stfs.f_bavail);
+			info->TotalFileNodes = cpu_to_le64(stfs.f_files);
+			info->FreeFileNodes = cpu_to_le64(stfs.f_ffree);
+			rsp->OutputBufferLength = cpu_to_le32(56);
+			inc_rfc1001_len(rsp_org, 56);
+			fs_infoclass_size = FS_POSIX_INFORMATION_SIZE;
+		}
+		break;
+	}
+	default:
+		path_put(&path);
+		return -EOPNOTSUPP;
+	}
+	rc = buffer_check_err(le32_to_cpu(req->OutputBufferLength),
+			      rsp,
+			      fs_infoclass_size);
+	path_put(&path);
+	return rc;
+}
+
+static int smb2_get_info_sec(struct ksmbd_work *work,
+		struct smb2_query_info_req *req,
+		struct smb2_query_info_rsp *rsp, void *rsp_org)
+{
+	struct ksmbd_file *fp;
+	struct smb_ntsd *pntsd = (struct smb_ntsd *)rsp->Buffer, *ppntsd = NULL;
+	struct smb_fattr fattr = {{0}};
+	struct inode *inode;
+	__u32 secdesclen;
+	unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID;
+	int addition_info = le32_to_cpu(req->AdditionalInformation);
+	int rc;
+
+	if (work->next_smb2_rcv_hdr_off) {
+		if (!HAS_FILE_ID(le64_to_cpu(req->VolatileFileId))) {
+			ksmbd_debug(SMB, "Compound request set FID = %u\n",
+					work->compound_fid);
+			id = work->compound_fid;
+			pid = work->compound_pfid;
+		}
+	}
+
+	if (!HAS_FILE_ID(id)) {
+		id = le64_to_cpu(req->VolatileFileId);
+		pid = le64_to_cpu(req->PersistentFileId);
+	}
+
+	fp = ksmbd_lookup_fd_slow(work, id, pid);
+	if (!fp)
+		return -ENOENT;
+
+	inode = FP_INODE(fp);
+	fattr.cf_uid = inode->i_uid;
+	fattr.cf_gid = inode->i_gid;
+	fattr.cf_mode = inode->i_mode;
+	fattr.cf_dacls = NULL;
+
+	fattr.cf_acls = ksmbd_vfs_get_acl(inode, ACL_TYPE_ACCESS);
+	if (S_ISDIR(inode->i_mode))
+		fattr.cf_dacls = ksmbd_vfs_get_acl(inode, ACL_TYPE_DEFAULT);
+
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_ACL_XATTR))
+		ksmbd_vfs_get_sd_xattr(work->conn, fp->filp->f_path.dentry, &ppntsd);
+
+	rc = build_sec_desc(pntsd, ppntsd, addition_info, &secdesclen, &fattr);
+	posix_acl_release(fattr.cf_acls);
+	posix_acl_release(fattr.cf_dacls);
+	kfree(ppntsd);
+	ksmbd_fd_put(work, fp);
+	if (rc)
+		return rc;
+
+	rsp->OutputBufferLength = cpu_to_le32(secdesclen);
+	inc_rfc1001_len(rsp_org, secdesclen);
+	return 0;
+}
+
+/**
+ * smb2_query_info() - handler for smb2 query info command
+ * @work:	smb work containing query info request buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb2_query_info(struct ksmbd_work *work)
+{
+	struct smb2_query_info_req *req;
+	struct smb2_query_info_rsp *rsp, *rsp_org;
+	int rc = 0;
+
+	rsp_org = work->response_buf;
+	WORK_BUFFERS(work, req, rsp);
+
+	ksmbd_debug(SMB, "GOT query info request\n");
+
+	switch (req->InfoType) {
+	case SMB2_O_INFO_FILE:
+		ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n");
+		rc = smb2_get_info_file(work, req, rsp, (void *)rsp_org);
+		break;
+	case SMB2_O_INFO_FILESYSTEM:
+		ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILESYSTEM\n");
+		rc = smb2_get_info_filesystem(work, req, rsp, (void *)rsp_org);
+		break;
+	case SMB2_O_INFO_SECURITY:
+		ksmbd_debug(SMB, "GOT SMB2_O_INFO_SECURITY\n");
+		rc = smb2_get_info_sec(work, req, rsp, (void *)rsp_org);
+		break;
+	default:
+		ksmbd_debug(SMB, "InfoType %d not supported yet\n",
+			req->InfoType);
+		rc = -EOPNOTSUPP;
+	}
+
+	if (rc < 0) {
+		if (rc == -EACCES)
+			rsp->hdr.Status = STATUS_ACCESS_DENIED;
+		else if (rc == -ENOENT)
+			rsp->hdr.Status = STATUS_FILE_CLOSED;
+		else if (rc == -EIO)
+			rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR;
+		else if (rc == -EOPNOTSUPP || rsp->hdr.Status == 0)
+			rsp->hdr.Status = STATUS_INVALID_INFO_CLASS;
+		smb2_set_err_rsp(work);
+
+		ksmbd_debug(SMB, "error while processing smb2 query rc = %d\n",
+			      rc);
+		return rc;
+	}
+	rsp->StructureSize = cpu_to_le16(9);
+	rsp->OutputBufferOffset = cpu_to_le16(72);
+	inc_rfc1001_len(rsp_org, 8);
+	return 0;
+}
+
+/**
+ * smb2_close_pipe() - handler for closing IPC pipe
+ * @work:	smb work containing close request buffer
+ *
+ * Return:	0
+ */
+static noinline int smb2_close_pipe(struct ksmbd_work *work)
+{
+	u64 id;
+	struct smb2_close_req *req = work->request_buf;
+	struct smb2_close_rsp *rsp = work->response_buf;
+
+	id = le64_to_cpu(req->VolatileFileId);
+	ksmbd_session_rpc_close(work->sess, id);
+
+	rsp->StructureSize = cpu_to_le16(60);
+	rsp->Flags = 0;
+	rsp->Reserved = 0;
+	rsp->CreationTime = 0;
+	rsp->LastAccessTime = 0;
+	rsp->LastWriteTime = 0;
+	rsp->ChangeTime = 0;
+	rsp->AllocationSize = 0;
+	rsp->EndOfFile = 0;
+	rsp->Attributes = 0;
+	inc_rfc1001_len(rsp, 60);
+	return 0;
+}
+
+/**
+ * smb2_close() - handler for smb2 close file command
+ * @work:	smb work containing close request buffer
+ *
+ * Return:	0
+ */
+int smb2_close(struct ksmbd_work *work)
+{
+	unsigned int volatile_id = KSMBD_NO_FID;
+	u64 sess_id;
+	struct smb2_close_req *req;
+	struct smb2_close_rsp *rsp;
+	struct smb2_close_rsp *rsp_org;
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_file *fp;
+	struct inode *inode;
+	u64 time;
+	int err = 0;
+
+	rsp_org = work->response_buf;
+	WORK_BUFFERS(work, req, rsp);
+
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_PIPE)) {
+		ksmbd_debug(SMB, "IPC pipe close request\n");
+		return smb2_close_pipe(work);
+	}
+
+	sess_id = le64_to_cpu(req->hdr.SessionId);
+	if (req->hdr.Flags & SMB2_FLAGS_RELATED_OPERATIONS)
+		sess_id = work->compound_sid;
+
+	work->compound_sid = 0;
+	if (check_session_id(conn, sess_id)) {
+		work->compound_sid = sess_id;
+	} else {
+		rsp->hdr.Status = STATUS_USER_SESSION_DELETED;
+		if (req->hdr.Flags & SMB2_FLAGS_RELATED_OPERATIONS)
+			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+		err = -EBADF;
+		goto out;
+	}
+
+	if (work->next_smb2_rcv_hdr_off &&
+	    !HAS_FILE_ID(le64_to_cpu(req->VolatileFileId))) {
+		if (!HAS_FILE_ID(work->compound_fid)) {
+			/* file already closed, return FILE_CLOSED */
+			ksmbd_debug(SMB, "file already closed\n");
+			rsp->hdr.Status = STATUS_FILE_CLOSED;
+			err = -EBADF;
+			goto out;
+		} else {
+			ksmbd_debug(SMB, "Compound request set FID = %u:%u\n",
+					work->compound_fid,
+					work->compound_pfid);
+			volatile_id = work->compound_fid;
+
+			/* file closed, stored id is not valid anymore */
+			work->compound_fid = KSMBD_NO_FID;
+			work->compound_pfid = KSMBD_NO_FID;
+		}
+	} else {
+		volatile_id = le64_to_cpu(req->VolatileFileId);
+	}
+	ksmbd_debug(SMB, "volatile_id = %u\n", volatile_id);
+
+	rsp->StructureSize = cpu_to_le16(60);
+	rsp->Reserved = 0;
+
+	if (req->Flags == SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB) {
+		fp = ksmbd_lookup_fd_fast(work, volatile_id);
+		if (!fp) {
+			err = -ENOENT;
+			goto out;
+		}
+
+		inode = FP_INODE(fp);
+		rsp->Flags = SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB;
+		rsp->AllocationSize = S_ISDIR(inode->i_mode) ? 0 :
+			cpu_to_le64(inode->i_blocks << 9);
+		rsp->EndOfFile = cpu_to_le64(inode->i_size);
+		rsp->Attributes = fp->f_ci->m_fattr;
+		rsp->CreationTime = cpu_to_le64(fp->create_time);
+		time = ksmbd_UnixTimeToNT(inode->i_atime);
+		rsp->LastAccessTime = cpu_to_le64(time);
+		time = ksmbd_UnixTimeToNT(inode->i_mtime);
+		rsp->LastWriteTime = cpu_to_le64(time);
+		time = ksmbd_UnixTimeToNT(inode->i_ctime);
+		rsp->ChangeTime = cpu_to_le64(time);
+		ksmbd_fd_put(work, fp);
+	} else {
+		rsp->Flags = 0;
+		rsp->AllocationSize = 0;
+		rsp->EndOfFile = 0;
+		rsp->Attributes = 0;
+		rsp->CreationTime = 0;
+		rsp->LastAccessTime = 0;
+		rsp->LastWriteTime = 0;
+		rsp->ChangeTime = 0;
+	}
+
+	err = ksmbd_close_fd(work, volatile_id);
+out:
+	if (err) {
+		if (rsp->hdr.Status == 0)
+			rsp->hdr.Status = STATUS_FILE_CLOSED;
+		smb2_set_err_rsp(work);
+	} else {
+		inc_rfc1001_len(rsp_org, 60);
+	}
+
+	return 0;
+}
+
+/**
+ * smb2_echo() - handler for smb2 echo(ping) command
+ * @work:	smb work containing echo request buffer
+ *
+ * Return:	0
+ */
+int smb2_echo(struct ksmbd_work *work)
+{
+	struct smb2_echo_rsp *rsp = work->response_buf;
+
+	rsp->StructureSize = cpu_to_le16(4);
+	rsp->Reserved = 0;
+	inc_rfc1001_len(rsp, 4);
+	return 0;
+}
+
+static int smb2_rename(struct ksmbd_work *work, struct ksmbd_file *fp,
+		struct smb2_file_rename_info *file_info,
+		struct nls_table *local_nls)
+{
+	struct ksmbd_share_config *share = fp->tcon->share_conf;
+	char *new_name = NULL, *abs_oldname = NULL, *old_name = NULL;
+	char *pathname = NULL;
+	struct path path;
+	bool file_present = true;
+	int rc;
+
+	ksmbd_debug(SMB, "setting FILE_RENAME_INFO\n");
+	pathname = kmalloc(PATH_MAX, GFP_KERNEL);
+	if (!pathname)
+		return -ENOMEM;
+
+	abs_oldname = d_path(&fp->filp->f_path, pathname, PATH_MAX);
+	if (IS_ERR(abs_oldname)) {
+		rc = -EINVAL;
+		goto out;
+	}
+	old_name = strrchr(abs_oldname, '/');
+	if (old_name && old_name[1] != '\0') {
+		old_name++;
+	} else {
+		ksmbd_debug(SMB, "can't get last component in path %s\n",
+				abs_oldname);
+		rc = -ENOENT;
+		goto out;
+	}
+
+	new_name = smb2_get_name(share,
+				 file_info->FileName,
+				 le32_to_cpu(file_info->FileNameLength),
+				 local_nls);
+	if (IS_ERR(new_name)) {
+		rc = PTR_ERR(new_name);
+		goto out;
+	}
+
+	if (strchr(new_name, ':')) {
+		int s_type;
+		char *xattr_stream_name, *stream_name = NULL;
+		size_t xattr_stream_size;
+		int len;
+
+		rc = parse_stream_name(new_name, &stream_name, &s_type);
+		if (rc < 0)
+			goto out;
+
+		len = strlen(new_name);
+		if (new_name[len - 1] != '/') {
+			ksmbd_err("not allow base filename in rename\n");
+			rc = -ESHARE;
+			goto out;
+		}
+
+		rc = ksmbd_vfs_xattr_stream_name(stream_name,
+						 &xattr_stream_name,
+						 &xattr_stream_size,
+						 s_type);
+		if (rc)
+			goto out;
+
+		rc = ksmbd_vfs_setxattr(fp->filp->f_path.dentry,
+					xattr_stream_name,
+					NULL, 0, 0);
+		if (rc < 0) {
+			ksmbd_err("failed to store stream name in xattr: %d\n",
+				   rc);
+			rc = -EINVAL;
+			goto out;
+		}
+
+		goto out;
+	}
+
+	ksmbd_debug(SMB, "new name %s\n", new_name);
+	rc = ksmbd_vfs_kern_path(new_name, 0, &path, 1);
+	if (rc)
+		file_present = false;
+	else
+		path_put(&path);
+
+	if (ksmbd_share_veto_filename(share, new_name)) {
+		rc = -ENOENT;
+		ksmbd_debug(SMB, "Can't rename vetoed file: %s\n", new_name);
+		goto out;
+	}
+
+	if (file_info->ReplaceIfExists) {
+		if (file_present) {
+			rc = ksmbd_vfs_remove_file(work, new_name);
+			if (rc) {
+				if (rc != -ENOTEMPTY)
+					rc = -EINVAL;
+				ksmbd_debug(SMB, "cannot delete %s, rc %d\n",
+						new_name, rc);
+				goto out;
+			}
+		}
+	} else {
+		if (file_present &&
+		    strncmp(old_name, path.dentry->d_name.name, strlen(old_name))) {
+			rc = -EEXIST;
+			ksmbd_debug(SMB,
+				"cannot rename already existing file\n");
+			goto out;
+		}
+	}
+
+	rc = ksmbd_vfs_fp_rename(work, fp, new_name);
+out:
+	kfree(pathname);
+	if (!IS_ERR(new_name))
+		kfree(new_name);
+	return rc;
+}
+
+static int smb2_create_link(struct ksmbd_work *work,
+		struct ksmbd_share_config *share,
+		struct smb2_file_link_info *file_info, struct file *filp,
+		struct nls_table *local_nls)
+{
+	char *link_name = NULL, *target_name = NULL, *pathname = NULL;
+	struct path path;
+	bool file_present = true;
+	int rc;
+
+	ksmbd_debug(SMB, "setting FILE_LINK_INFORMATION\n");
+	pathname = kmalloc(PATH_MAX, GFP_KERNEL);
+	if (!pathname)
+		return -ENOMEM;
+
+	link_name = smb2_get_name(share,
+				  file_info->FileName,
+				  le32_to_cpu(file_info->FileNameLength),
+				  local_nls);
+	if (IS_ERR(link_name) || S_ISDIR(file_inode(filp)->i_mode)) {
+		rc = -EINVAL;
+		goto out;
+	}
+
+	ksmbd_debug(SMB, "link name is %s\n", link_name);
+	target_name = d_path(&filp->f_path, pathname, PATH_MAX);
+	if (IS_ERR(target_name)) {
+		rc = -EINVAL;
+		goto out;
+	}
+
+	ksmbd_debug(SMB, "target name is %s\n", target_name);
+	rc = ksmbd_vfs_kern_path(link_name, 0, &path, 0);
+	if (rc)
+		file_present = false;
+	else
+		path_put(&path);
+
+	if (file_info->ReplaceIfExists) {
+		if (file_present) {
+			rc = ksmbd_vfs_remove_file(work, link_name);
+			if (rc) {
+				rc = -EINVAL;
+				ksmbd_debug(SMB, "cannot delete %s\n",
+					link_name);
+				goto out;
+			}
+		}
+	} else {
+		if (file_present) {
+			rc = -EEXIST;
+			ksmbd_debug(SMB, "link already exists\n");
+			goto out;
+		}
+	}
+
+	rc = ksmbd_vfs_link(work, target_name, link_name);
+	if (rc)
+		rc = -EINVAL;
+out:
+	if (!IS_ERR(link_name))
+		kfree(link_name);
+	kfree(pathname);
+	return rc;
+}
+
+static bool is_attributes_write_allowed(struct ksmbd_file *fp)
+{
+	return fp->daccess & FILE_WRITE_ATTRIBUTES_LE;
+}
+
+static int set_file_basic_info(struct ksmbd_file *fp, char *buf,
+		struct ksmbd_share_config *share)
+{
+	struct smb2_file_all_info *file_info;
+	struct iattr attrs;
+	struct iattr temp_attrs;
+	struct file *filp;
+	struct inode *inode;
+	int rc;
+
+	if (!is_attributes_write_allowed(fp))
+		return -EACCES;
+
+	file_info = (struct smb2_file_all_info *)buf;
+	attrs.ia_valid = 0;
+	filp = fp->filp;
+	inode = file_inode(filp);
+
+	if (file_info->CreationTime)
+		fp->create_time = le64_to_cpu(file_info->CreationTime);
+
+	if (file_info->LastAccessTime) {
+		attrs.ia_atime = ksmbd_NTtimeToUnix(file_info->LastAccessTime);
+		attrs.ia_valid |= (ATTR_ATIME | ATTR_ATIME_SET);
+	}
+
+	if (file_info->ChangeTime) {
+		temp_attrs.ia_ctime = ksmbd_NTtimeToUnix(file_info->ChangeTime);
+		attrs.ia_ctime = temp_attrs.ia_ctime;
+		attrs.ia_valid |= ATTR_CTIME;
+	} else {
+		temp_attrs.ia_ctime = inode->i_ctime;
+	}
+
+	if (file_info->LastWriteTime) {
+		attrs.ia_mtime = ksmbd_NTtimeToUnix(file_info->LastWriteTime);
+		attrs.ia_valid |= (ATTR_MTIME | ATTR_MTIME_SET);
+	}
+
+	if (file_info->Attributes) {
+		if (!S_ISDIR(inode->i_mode) &&
+		    file_info->Attributes & ATTR_DIRECTORY_LE) {
+			ksmbd_err("can't change a file to a directory\n");
+			return -EINVAL;
+		}
+
+		if (!(S_ISDIR(inode->i_mode) && file_info->Attributes == ATTR_NORMAL_LE))
+			fp->f_ci->m_fattr = file_info->Attributes |
+				(fp->f_ci->m_fattr & ATTR_DIRECTORY_LE);
+	}
+
+	if (test_share_config_flag(share, KSMBD_SHARE_FLAG_STORE_DOS_ATTRS) &&
+	    (file_info->CreationTime || file_info->Attributes)) {
+		struct xattr_dos_attrib da = {0};
+
+		da.version = 4;
+		da.itime = fp->itime;
+		da.create_time = fp->create_time;
+		da.attr = le32_to_cpu(fp->f_ci->m_fattr);
+		da.flags = XATTR_DOSINFO_ATTRIB | XATTR_DOSINFO_CREATE_TIME |
+			XATTR_DOSINFO_ITIME;
+
+		rc = ksmbd_vfs_set_dos_attrib_xattr(filp->f_path.dentry, &da);
+		if (rc)
+			ksmbd_debug(SMB,
+				"failed to restore file attribute in EA\n");
+		rc = 0;
+	}
+
+	/*
+	 * HACK : set ctime here to avoid ctime changed
+	 * when file_info->ChangeTime is zero.
+	 */
+	attrs.ia_ctime = temp_attrs.ia_ctime;
+	attrs.ia_valid |= ATTR_CTIME;
+
+	if (attrs.ia_valid) {
+		struct dentry *dentry = filp->f_path.dentry;
+		struct inode *inode = d_inode(dentry);
+
+		if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
+			return -EACCES;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		rc = setattr_prepare(&init_user_ns, dentry, &attrs);
+#else
+		rc = setattr_prepare(dentry, &attrs);
+#endif
+		if (rc)
+			return -EINVAL;
+
+		inode_lock(inode);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		setattr_copy(&init_user_ns, inode, &attrs);
+#else
+		setattr_copy(inode, &attrs);
+#endif
+		attrs.ia_valid &= ~ATTR_CTIME;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		rc = notify_change(&init_user_ns, dentry, &attrs, NULL);
+#else
+		rc = notify_change(dentry, &attrs, NULL);
+#endif
+		inode_unlock(inode);
+		if (rc)
+			return -EINVAL;
+	}
+	return 0;
+}
+
+static int set_file_allocation_info(struct ksmbd_work *work,
+		struct ksmbd_file *fp, char *buf)
+{
+	/*
+	 * TODO : It's working fine only when store dos attributes
+	 * is not yes. need to implement a logic which works
+	 * properly with any smb.conf option
+	 */
+
+	struct smb2_file_alloc_info *file_alloc_info;
+	loff_t alloc_blks;
+	struct inode *inode;
+	int rc;
+
+	if (!is_attributes_write_allowed(fp))
+		return -EACCES;
+
+	file_alloc_info = (struct smb2_file_alloc_info *)buf;
+	alloc_blks = (le64_to_cpu(file_alloc_info->AllocationSize) + 511) >> 9;
+	inode = file_inode(fp->filp);
+
+	if (alloc_blks > inode->i_blocks) {
+		rc = ksmbd_vfs_alloc_size(work, fp, alloc_blks * 512);
+		if (rc && rc != -EOPNOTSUPP) {
+			ksmbd_err("ksmbd_vfs_alloc_size is failed : %d\n", rc);
+			return rc;
+		}
+	} else if (alloc_blks < inode->i_blocks) {
+		loff_t size;
+
+		/*
+		 * Allocation size could be smaller than original one
+		 * which means allocated blocks in file should be
+		 * deallocated. use truncate to cut out it, but inode
+		 * size is also updated with truncate offset.
+		 * inode size is retained by backup inode size.
+		 */
+		size = i_size_read(inode);
+		rc = ksmbd_vfs_truncate(work, NULL, fp, alloc_blks * 512);
+		if (rc) {
+			ksmbd_err("truncate failed! filename : %s, err %d\n",
+				  fp->filename, rc);
+			return rc;
+		}
+		if (size < alloc_blks * 512)
+			i_size_write(inode, size);
+	}
+	return 0;
+}
+
+static int set_end_of_file_info(struct ksmbd_work *work, struct ksmbd_file *fp,
+		char *buf)
+{
+	struct smb2_file_eof_info *file_eof_info;
+	loff_t newsize;
+	struct inode *inode;
+	int rc;
+
+	if (!is_attributes_write_allowed(fp))
+		return -EACCES;
+
+	file_eof_info = (struct smb2_file_eof_info *)buf;
+	newsize = le64_to_cpu(file_eof_info->EndOfFile);
+	inode = file_inode(fp->filp);
+
+	/*
+	 * If FILE_END_OF_FILE_INFORMATION of set_info_file is called
+	 * on FAT32 shared device, truncate execution time is too long
+	 * and network error could cause from windows client. because
+	 * truncate of some filesystem like FAT32 fill zero data in
+	 * truncated range.
+	 */
+	if (inode->i_sb->s_magic != MSDOS_SUPER_MAGIC) {
+		ksmbd_debug(SMB, "filename : %s truncated to newsize %lld\n",
+				fp->filename, newsize);
+		rc = ksmbd_vfs_truncate(work, NULL, fp, newsize);
+		if (rc) {
+			ksmbd_debug(SMB, "truncate failed! filename : %s err %d\n",
+					fp->filename, rc);
+			if (rc != -EAGAIN)
+				rc = -EBADF;
+			return rc;
+		}
+	}
+	return 0;
+}
+
+static int set_rename_info(struct ksmbd_work *work, struct ksmbd_file *fp,
+		char *buf)
+{
+	struct ksmbd_file *parent_fp;
+
+	if (!(fp->daccess & FILE_DELETE_LE)) {
+		ksmbd_err("no right to delete : 0x%x\n", fp->daccess);
+		return -EACCES;
+	}
+
+	if (ksmbd_stream_fd(fp))
+		goto next;
+
+	parent_fp = ksmbd_lookup_fd_inode(PARENT_INODE(fp));
+	if (parent_fp) {
+		if (parent_fp->daccess & FILE_DELETE_LE) {
+			ksmbd_err("parent dir is opened with delete access\n");
+			return -ESHARE;
+		}
+	}
+next:
+	return smb2_rename(work, fp,
+			   (struct smb2_file_rename_info *)buf,
+			   work->sess->conn->local_nls);
+}
+
+static int set_file_disposition_info(struct ksmbd_file *fp, char *buf)
+{
+	struct smb2_file_disposition_info *file_info;
+	struct inode *inode;
+
+	if (!(fp->daccess & FILE_DELETE_LE)) {
+		ksmbd_err("no right to delete : 0x%x\n", fp->daccess);
+		return -EACCES;
+	}
+
+	inode = file_inode(fp->filp);
+	file_info = (struct smb2_file_disposition_info *)buf;
+	if (file_info->DeletePending) {
+		if (S_ISDIR(inode->i_mode) &&
+		    ksmbd_vfs_empty_dir(fp) == -ENOTEMPTY)
+			return -EBUSY;
+		ksmbd_set_inode_pending_delete(fp);
+	} else {
+		ksmbd_clear_inode_pending_delete(fp);
+	}
+	return 0;
+}
+
+static int set_file_position_info(struct ksmbd_file *fp, char *buf)
+{
+	struct smb2_file_pos_info *file_info;
+	loff_t current_byte_offset;
+	unsigned short sector_size;
+	struct inode *inode;
+
+	inode = file_inode(fp->filp);
+	file_info = (struct smb2_file_pos_info *)buf;
+	current_byte_offset = le64_to_cpu(file_info->CurrentByteOffset);
+	sector_size = ksmbd_vfs_logical_sector_size(inode);
+
+	if (current_byte_offset < 0 ||
+	    (fp->coption == FILE_NO_INTERMEDIATE_BUFFERING_LE &&
+	     current_byte_offset & (sector_size - 1))) {
+		ksmbd_err("CurrentByteOffset is not valid : %llu\n",
+			current_byte_offset);
+		return -EINVAL;
+	}
+
+	fp->filp->f_pos = current_byte_offset;
+	return 0;
+}
+
+static int set_file_mode_info(struct ksmbd_file *fp, char *buf)
+{
+	struct smb2_file_mode_info *file_info;
+	__le32 mode;
+
+	file_info = (struct smb2_file_mode_info *)buf;
+	mode = file_info->Mode;
+
+	if ((mode & ~FILE_MODE_INFO_MASK) ||
+	    (mode & FILE_SYNCHRONOUS_IO_ALERT_LE &&
+	     mode & FILE_SYNCHRONOUS_IO_NONALERT_LE)) {
+		ksmbd_err("Mode is not valid : 0x%x\n", le32_to_cpu(mode));
+		return -EINVAL;
+	}
+
+	/*
+	 * TODO : need to implement consideration for
+	 * FILE_SYNCHRONOUS_IO_ALERT and FILE_SYNCHRONOUS_IO_NONALERT
+	 */
+	ksmbd_vfs_set_fadvise(fp->filp, mode);
+	fp->coption = mode;
+	return 0;
+}
+
+/**
+ * smb2_set_info_file() - handler for smb2 set info command
+ * @work:	smb work containing set info command buffer
+ * @fp:		ksmbd_file pointer
+ * @info_class:	smb2 set info class
+ * @share:	ksmbd_share_config pointer
+ *
+ * Return:	0 on success, otherwise error
+ * TODO: need to implement an error handling for STATUS_INFO_LENGTH_MISMATCH
+ */
+static int smb2_set_info_file(struct ksmbd_work *work, struct ksmbd_file *fp,
+		int info_class, char *buf, struct ksmbd_share_config *share)
+{
+	switch (info_class) {
+	case FILE_BASIC_INFORMATION:
+		return set_file_basic_info(fp, buf, share);
+
+	case FILE_ALLOCATION_INFORMATION:
+		return set_file_allocation_info(work, fp, buf);
+
+	case FILE_END_OF_FILE_INFORMATION:
+		return set_end_of_file_info(work, fp, buf);
+
+	case FILE_RENAME_INFORMATION:
+		if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+			ksmbd_debug(SMB,
+				"User does not have write permission\n");
+			return -EACCES;
+		}
+		return set_rename_info(work, fp, buf);
+
+	case FILE_LINK_INFORMATION:
+		return smb2_create_link(work, work->tcon->share_conf,
+			(struct smb2_file_link_info *)buf, fp->filp,
+				work->sess->conn->local_nls);
+
+	case FILE_DISPOSITION_INFORMATION:
+		if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+			ksmbd_debug(SMB,
+				"User does not have write permission\n");
+			return -EACCES;
+		}
+		return set_file_disposition_info(fp, buf);
+
+	case FILE_FULL_EA_INFORMATION:
+	{
+		if (!(fp->daccess & FILE_WRITE_EA_LE)) {
+			ksmbd_err("Not permitted to write ext  attr: 0x%x\n",
+				  fp->daccess);
+			return -EACCES;
+		}
+
+		return smb2_set_ea((struct smb2_ea_info *)buf,
+				   &fp->filp->f_path);
+	}
+
+	case FILE_POSITION_INFORMATION:
+		return set_file_position_info(fp, buf);
+
+	case FILE_MODE_INFORMATION:
+		return set_file_mode_info(fp, buf);
+	}
+
+	ksmbd_err("Unimplemented Fileinfoclass :%d\n", info_class);
+	return -EOPNOTSUPP;
+}
+
+static int smb2_set_info_sec(struct ksmbd_file *fp, int addition_info,
+		char *buffer, int buf_len)
+{
+	struct smb_ntsd *pntsd = (struct smb_ntsd *)buffer;
+
+	fp->saccess |= FILE_SHARE_DELETE_LE;
+
+	return set_info_sec(fp->conn, fp->tcon, fp->filp->f_path.dentry, pntsd,
+			buf_len, false);
+}
+
+/**
+ * smb2_set_info() - handler for smb2 set info command handler
+ * @work:	smb work containing set info request buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb2_set_info(struct ksmbd_work *work)
+{
+	struct smb2_set_info_req *req;
+	struct smb2_set_info_rsp *rsp, *rsp_org;
+	struct ksmbd_file *fp;
+	int rc = 0;
+	unsigned int id = KSMBD_NO_FID, pid = KSMBD_NO_FID;
+
+	ksmbd_debug(SMB, "Received set info request\n");
+
+	rsp_org = work->response_buf;
+	if (work->next_smb2_rcv_hdr_off) {
+		req = REQUEST_BUF_NEXT(work);
+		rsp = RESPONSE_BUF_NEXT(work);
+		if (!HAS_FILE_ID(le64_to_cpu(req->VolatileFileId))) {
+			ksmbd_debug(SMB, "Compound request set FID = %u\n",
+					work->compound_fid);
+			id = work->compound_fid;
+			pid = work->compound_pfid;
+		}
+	} else {
+		req = work->request_buf;
+		rsp = work->response_buf;
+	}
+
+	if (!HAS_FILE_ID(id)) {
+		id = le64_to_cpu(req->VolatileFileId);
+		pid = le64_to_cpu(req->PersistentFileId);
+	}
+
+	fp = ksmbd_lookup_fd_slow(work, id, pid);
+	if (!fp) {
+		ksmbd_debug(SMB, "Invalid id for close: %u\n", id);
+		rc = -ENOENT;
+		goto err_out;
+	}
+
+	switch (req->InfoType) {
+	case SMB2_O_INFO_FILE:
+		ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n");
+		rc = smb2_set_info_file(work, fp, req->FileInfoClass,
+					req->Buffer, work->tcon->share_conf);
+		break;
+	case SMB2_O_INFO_SECURITY:
+		ksmbd_debug(SMB, "GOT SMB2_O_INFO_SECURITY\n");
+		rc = smb2_set_info_sec(fp,
+			le32_to_cpu(req->AdditionalInformation), req->Buffer,
+			le32_to_cpu(req->BufferLength));
+		break;
+	default:
+		rc = -EOPNOTSUPP;
+	}
+
+	if (rc < 0)
+		goto err_out;
+
+	rsp->StructureSize = cpu_to_le16(2);
+	inc_rfc1001_len(rsp_org, 2);
+	ksmbd_fd_put(work, fp);
+	return 0;
+
+err_out:
+	if (rc == -EACCES || rc == -EPERM)
+		rsp->hdr.Status = STATUS_ACCESS_DENIED;
+	else if (rc == -EINVAL)
+		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+	else if (rc == -ESHARE)
+		rsp->hdr.Status = STATUS_SHARING_VIOLATION;
+	else if (rc == -ENOENT)
+		rsp->hdr.Status = STATUS_OBJECT_NAME_INVALID;
+	else if (rc == -EBUSY || rc == -ENOTEMPTY)
+		rsp->hdr.Status = STATUS_DIRECTORY_NOT_EMPTY;
+	else if (rc == -EAGAIN)
+		rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT;
+	else if (rc == -EBADF || rc == -ESTALE)
+		rsp->hdr.Status = STATUS_INVALID_HANDLE;
+	else if (rc == -EEXIST)
+		rsp->hdr.Status = STATUS_OBJECT_NAME_COLLISION;
+	else if (rsp->hdr.Status == 0 || rc == -EOPNOTSUPP)
+		rsp->hdr.Status = STATUS_INVALID_INFO_CLASS;
+	smb2_set_err_rsp(work);
+	ksmbd_fd_put(work, fp);
+	ksmbd_debug(SMB, "error while processing smb2 query rc = %d\n",
+			rc);
+	return rc;
+}
+
+/**
+ * smb2_read_pipe() - handler for smb2 read from IPC pipe
+ * @work:	smb work containing read IPC pipe command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static noinline int smb2_read_pipe(struct ksmbd_work *work)
+{
+	int nbytes = 0, err;
+	u64 id;
+	struct ksmbd_rpc_command *rpc_resp;
+	struct smb2_read_req *req = work->request_buf;
+	struct smb2_read_rsp *rsp = work->response_buf;
+
+	id = le64_to_cpu(req->VolatileFileId);
+
+	inc_rfc1001_len(rsp, 16);
+	rpc_resp = ksmbd_rpc_read(work->sess, id);
+	if (rpc_resp) {
+		if (rpc_resp->flags != KSMBD_RPC_OK) {
+			err = -EINVAL;
+			goto out;
+		}
+
+		work->aux_payload_buf =
+			kvmalloc(rpc_resp->payload_sz, GFP_KERNEL | __GFP_ZERO);
+		if (!work->aux_payload_buf) {
+			err = -ENOMEM;
+			goto out;
+		}
+
+		memcpy(work->aux_payload_buf, rpc_resp->payload,
+			rpc_resp->payload_sz);
+
+		nbytes = rpc_resp->payload_sz;
+		work->resp_hdr_sz = get_rfc1002_len(rsp) + 4;
+		work->aux_payload_sz = nbytes;
+		kvfree(rpc_resp);
+	}
+
+	rsp->StructureSize = cpu_to_le16(17);
+	rsp->DataOffset = 80;
+	rsp->Reserved = 0;
+	rsp->DataLength = cpu_to_le32(nbytes);
+	rsp->DataRemaining = 0;
+	rsp->Reserved2 = 0;
+	inc_rfc1001_len(rsp, nbytes);
+	return 0;
+
+out:
+	rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR;
+	smb2_set_err_rsp(work);
+	kvfree(rpc_resp);
+	return err;
+}
+
+static ssize_t smb2_read_rdma_channel(struct ksmbd_work *work,
+		struct smb2_read_req *req, void *data_buf, size_t length)
+{
+	struct smb2_buffer_desc_v1 *desc =
+		(struct smb2_buffer_desc_v1 *)&req->Buffer[0];
+	int err;
+
+	if (work->conn->dialect == SMB30_PROT_ID &&
+	    req->Channel != SMB2_CHANNEL_RDMA_V1)
+		return -EINVAL;
+
+	if (req->ReadChannelInfoOffset == 0 ||
+	    le16_to_cpu(req->ReadChannelInfoLength) < sizeof(*desc))
+		return -EINVAL;
+
+	work->need_invalidate_rkey =
+		(req->Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE);
+	work->remote_key = le32_to_cpu(desc->token);
+
+	err = ksmbd_conn_rdma_write(work->conn, data_buf, length,
+			le32_to_cpu(desc->token), le64_to_cpu(desc->offset),
+			le32_to_cpu(desc->length));
+	if (err)
+		return err;
+
+	return length;
+}
+
+/**
+ * smb2_read() - handler for smb2 read from file
+ * @work:	smb work containing read command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb2_read(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_read_req *req;
+	struct smb2_read_rsp *rsp, *rsp_org;
+	struct ksmbd_file *fp;
+	loff_t offset;
+	size_t length, mincount;
+	ssize_t nbytes = 0, remain_bytes = 0;
+	int err = 0;
+
+	rsp_org = work->response_buf;
+	WORK_BUFFERS(work, req, rsp);
+
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_PIPE)) {
+		ksmbd_debug(SMB, "IPC pipe read request\n");
+		return smb2_read_pipe(work);
+	}
+
+	fp = ksmbd_lookup_fd_slow(work,
+			le64_to_cpu(req->VolatileFileId),
+			le64_to_cpu(req->PersistentFileId));
+	if (!fp) {
+		rsp->hdr.Status = STATUS_FILE_CLOSED;
+		return -ENOENT;
+	}
+
+	if (!(fp->daccess & (FILE_READ_DATA_LE | FILE_READ_ATTRIBUTES_LE))) {
+		ksmbd_err("Not permitted to read : 0x%x\n", fp->daccess);
+		err = -EACCES;
+		goto out;
+	}
+
+	offset = le64_to_cpu(req->Offset);
+	length = le32_to_cpu(req->Length);
+	mincount = le32_to_cpu(req->MinimumCount);
+
+	if (length > conn->vals->max_read_size) {
+		ksmbd_debug(SMB, "limiting read size to max size(%u)\n",
+			    conn->vals->max_read_size);
+		err = -EINVAL;
+		goto out;
+	}
+
+	ksmbd_debug(SMB, "filename %s, offset %lld, len %zu\n", FP_FILENAME(fp),
+		offset, length);
+
+	if (server_conf.flags & KSMBD_GLOBAL_FLAG_CACHE_RBUF) {
+		work->aux_payload_buf =
+			ksmbd_find_buffer(conn->vals->max_read_size);
+		work->set_read_buf = true;
+	} else {
+		work->aux_payload_buf = kvmalloc(length, GFP_KERNEL | __GFP_ZERO);
+	}
+	if (!work->aux_payload_buf) {
+		err = -ENOMEM;
+		goto out;
+	}
+
+	nbytes = ksmbd_vfs_read(work, fp, length, &offset);
+	if (nbytes < 0) {
+		err = nbytes;
+		goto out;
+	}
+
+	if ((nbytes == 0 && length != 0) || nbytes < mincount) {
+		if (server_conf.flags & KSMBD_GLOBAL_FLAG_CACHE_RBUF)
+			ksmbd_release_buffer(work->aux_payload_buf);
+		else
+			kvfree(work->aux_payload_buf);
+		work->aux_payload_buf = NULL;
+		rsp->hdr.Status = STATUS_END_OF_FILE;
+		smb2_set_err_rsp(work);
+		ksmbd_fd_put(work, fp);
+		return 0;
+	}
+
+	ksmbd_debug(SMB, "nbytes %zu, offset %lld mincount %zu\n",
+						nbytes, offset, mincount);
+
+	if (req->Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE ||
+	    req->Channel == SMB2_CHANNEL_RDMA_V1) {
+		/* write data to the client using rdma channel */
+		remain_bytes = smb2_read_rdma_channel(work, req,
+						work->aux_payload_buf, nbytes);
+		if (server_conf.flags & KSMBD_GLOBAL_FLAG_CACHE_RBUF)
+			ksmbd_release_buffer(work->aux_payload_buf);
+		else
+			kvfree(work->aux_payload_buf);
+		work->aux_payload_buf = NULL;
+
+		nbytes = 0;
+		if (remain_bytes < 0) {
+			err = (int)remain_bytes;
+			goto out;
+		}
+	}
+
+	rsp->StructureSize = cpu_to_le16(17);
+	rsp->DataOffset = 80;
+	rsp->Reserved = 0;
+	rsp->DataLength = cpu_to_le32(nbytes);
+	rsp->DataRemaining = cpu_to_le32(remain_bytes);
+	rsp->Reserved2 = 0;
+	inc_rfc1001_len(rsp_org, 16);
+	work->resp_hdr_sz = get_rfc1002_len(rsp_org) + 4;
+	work->aux_payload_sz = nbytes;
+	inc_rfc1001_len(rsp_org, nbytes);
+	ksmbd_fd_put(work, fp);
+	return 0;
+
+out:
+	if (err) {
+		if (err == -EISDIR)
+			rsp->hdr.Status = STATUS_INVALID_DEVICE_REQUEST;
+		else if (err == -EAGAIN)
+			rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT;
+		else if (err == -ENOENT)
+			rsp->hdr.Status = STATUS_FILE_CLOSED;
+		else if (err == -EACCES)
+			rsp->hdr.Status = STATUS_ACCESS_DENIED;
+		else if (err == -ESHARE)
+			rsp->hdr.Status = STATUS_SHARING_VIOLATION;
+		else if (err == -EINVAL)
+			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+		else
+			rsp->hdr.Status = STATUS_INVALID_HANDLE;
+
+		smb2_set_err_rsp(work);
+	}
+	ksmbd_fd_put(work, fp);
+	return err;
+}
+
+/**
+ * smb2_write_pipe() - handler for smb2 write on IPC pipe
+ * @work:	smb work containing write IPC pipe command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+static noinline int smb2_write_pipe(struct ksmbd_work *work)
+{
+	struct smb2_write_req *req = work->request_buf;
+	struct smb2_write_rsp *rsp = work->response_buf;
+	struct ksmbd_rpc_command *rpc_resp;
+	u64 id = 0;
+	int err = 0, ret = 0;
+	char *data_buf;
+	size_t length;
+
+	length = le32_to_cpu(req->Length);
+	id = le64_to_cpu(req->VolatileFileId);
+
+	if (le16_to_cpu(req->DataOffset) ==
+	    (offsetof(struct smb2_write_req, Buffer) - 4)) {
+		data_buf = (char *)&req->Buffer[0];
+	} else {
+		if ((le16_to_cpu(req->DataOffset) > get_rfc1002_len(req)) ||
+		    (le16_to_cpu(req->DataOffset) + length > get_rfc1002_len(req))) {
+			ksmbd_err("invalid write data offset %u, smb_len %u\n",
+				le16_to_cpu(req->DataOffset), get_rfc1002_len(req));
+			err = -EINVAL;
+			goto out;
+		}
+
+		data_buf = (char *)(((char *)&req->hdr.ProtocolId) +
+				le16_to_cpu(req->DataOffset));
+	}
+
+	rpc_resp = ksmbd_rpc_write(work->sess, id, data_buf, length);
+	if (rpc_resp) {
+		if (rpc_resp->flags == KSMBD_RPC_ENOTIMPLEMENTED) {
+			rsp->hdr.Status = STATUS_NOT_SUPPORTED;
+			kvfree(rpc_resp);
+			smb2_set_err_rsp(work);
+			return -EOPNOTSUPP;
+		}
+		if (rpc_resp->flags != KSMBD_RPC_OK) {
+			rsp->hdr.Status = STATUS_INVALID_HANDLE;
+			smb2_set_err_rsp(work);
+			kvfree(rpc_resp);
+			return ret;
+		}
+		kvfree(rpc_resp);
+	}
+
+	rsp->StructureSize = cpu_to_le16(17);
+	rsp->DataOffset = 0;
+	rsp->Reserved = 0;
+	rsp->DataLength = cpu_to_le32(length);
+	rsp->DataRemaining = 0;
+	rsp->Reserved2 = 0;
+	inc_rfc1001_len(rsp, 16);
+	return 0;
+out:
+	if (err) {
+		rsp->hdr.Status = STATUS_INVALID_HANDLE;
+		smb2_set_err_rsp(work);
+	}
+
+	return err;
+}
+
+static ssize_t smb2_write_rdma_channel(struct ksmbd_work *work,
+		struct smb2_write_req *req, struct ksmbd_file *fp,
+		loff_t offset, size_t length, bool sync)
+{
+	struct smb2_buffer_desc_v1 *desc;
+	char *data_buf;
+	int ret;
+	ssize_t nbytes;
+
+	desc = (struct smb2_buffer_desc_v1 *)&req->Buffer[0];
+
+	if (work->conn->dialect == SMB30_PROT_ID &&
+	    req->Channel != SMB2_CHANNEL_RDMA_V1)
+		return -EINVAL;
+
+	if (req->Length != 0 || req->DataOffset != 0)
+		return -EINVAL;
+
+	if (req->WriteChannelInfoOffset == 0 ||
+	    le16_to_cpu(req->WriteChannelInfoLength) < sizeof(*desc))
+		return -EINVAL;
+
+	work->need_invalidate_rkey =
+		(req->Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE);
+	work->remote_key = le32_to_cpu(desc->token);
+
+	data_buf = kvmalloc(length, GFP_KERNEL | __GFP_ZERO);
+	if (!data_buf)
+		return -ENOMEM;
+
+	ret = ksmbd_conn_rdma_read(work->conn, data_buf, length,
+				le32_to_cpu(desc->token),
+				le64_to_cpu(desc->offset),
+				le32_to_cpu(desc->length));
+	if (ret < 0) {
+		kvfree(data_buf);
+		return ret;
+	}
+
+	ret = ksmbd_vfs_write(work, fp, data_buf, length, &offset, sync, &nbytes);
+	kvfree(data_buf);
+	if (ret < 0)
+		return ret;
+
+	return nbytes;
+}
+
+/**
+ * smb2_write() - handler for smb2 write from file
+ * @work:	smb work containing write command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb2_write(struct ksmbd_work *work)
+{
+	struct smb2_write_req *req;
+	struct smb2_write_rsp *rsp, *rsp_org;
+	struct ksmbd_file *fp = NULL;
+	loff_t offset;
+	size_t length;
+	ssize_t nbytes;
+	char *data_buf;
+	bool writethrough = false;
+	int err = 0;
+
+	rsp_org = work->response_buf;
+	WORK_BUFFERS(work, req, rsp);
+
+	if (test_share_config_flag(work->tcon->share_conf, KSMBD_SHARE_FLAG_PIPE)) {
+		ksmbd_debug(SMB, "IPC pipe write request\n");
+		return smb2_write_pipe(work);
+	}
+
+	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+		ksmbd_debug(SMB, "User does not have write permission\n");
+		err = -EACCES;
+		goto out;
+	}
+
+	fp = ksmbd_lookup_fd_slow(work, le64_to_cpu(req->VolatileFileId),
+		le64_to_cpu(req->PersistentFileId));
+	if (!fp) {
+		rsp->hdr.Status = STATUS_FILE_CLOSED;
+		return -ENOENT;
+	}
+
+	if (!(fp->daccess & (FILE_WRITE_DATA_LE | FILE_READ_ATTRIBUTES_LE))) {
+		ksmbd_err("Not permitted to write : 0x%x\n", fp->daccess);
+		err = -EACCES;
+		goto out;
+	}
+
+	offset = le64_to_cpu(req->Offset);
+	length = le32_to_cpu(req->Length);
+
+	if (length > work->conn->vals->max_write_size) {
+		ksmbd_debug(SMB, "limiting write size to max size(%u)\n",
+			    work->conn->vals->max_write_size);
+		err = -EINVAL;
+		goto out;
+	}
+
+	if (le32_to_cpu(req->Flags) & SMB2_WRITEFLAG_WRITE_THROUGH)
+		writethrough = true;
+
+	if (req->Channel != SMB2_CHANNEL_RDMA_V1 &&
+	    req->Channel != SMB2_CHANNEL_RDMA_V1_INVALIDATE) {
+		if (le16_to_cpu(req->DataOffset) ==
+				(offsetof(struct smb2_write_req, Buffer) - 4)) {
+			data_buf = (char *)&req->Buffer[0];
+		} else {
+			if ((le16_to_cpu(req->DataOffset) > get_rfc1002_len(req)) ||
+			    (le16_to_cpu(req->DataOffset) + length > get_rfc1002_len(req))) {
+				ksmbd_err("invalid write data offset %u, smb_len %u\n",
+						le16_to_cpu(req->DataOffset),
+						get_rfc1002_len(req));
+				err = -EINVAL;
+				goto out;
+			}
+
+			data_buf = (char *)(((char *)&req->hdr.ProtocolId) +
+					le16_to_cpu(req->DataOffset));
+		}
+
+		ksmbd_debug(SMB, "flags %u\n", le32_to_cpu(req->Flags));
+		if (le32_to_cpu(req->Flags) & SMB2_WRITEFLAG_WRITE_THROUGH)
+			writethrough = true;
+
+		ksmbd_debug(SMB, "filename %s, offset %lld, len %zu\n",
+			FP_FILENAME(fp), offset, length);
+		err = ksmbd_vfs_write(work, fp, data_buf, length, &offset,
+				      writethrough, &nbytes);
+		if (err < 0)
+			goto out;
+	} else {
+		/* read data from the client using rdma channel, and
+		 * write the data.
+		 */
+		nbytes = smb2_write_rdma_channel(work, req, fp, offset,
+					le32_to_cpu(req->RemainingBytes),
+					writethrough);
+		if (nbytes < 0) {
+			err = (int)nbytes;
+			goto out;
+		}
+	}
+
+	rsp->StructureSize = cpu_to_le16(17);
+	rsp->DataOffset = 0;
+	rsp->Reserved = 0;
+	rsp->DataLength = cpu_to_le32(nbytes);
+	rsp->DataRemaining = 0;
+	rsp->Reserved2 = 0;
+	inc_rfc1001_len(rsp_org, 16);
+	ksmbd_fd_put(work, fp);
+	return 0;
+
+out:
+	if (err == -EAGAIN)
+		rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT;
+	else if (err == -ENOSPC || err == -EFBIG)
+		rsp->hdr.Status = STATUS_DISK_FULL;
+	else if (err == -ENOENT)
+		rsp->hdr.Status = STATUS_FILE_CLOSED;
+	else if (err == -EACCES)
+		rsp->hdr.Status = STATUS_ACCESS_DENIED;
+	else if (err == -ESHARE)
+		rsp->hdr.Status = STATUS_SHARING_VIOLATION;
+	else if (err == -EINVAL)
+		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+	else
+		rsp->hdr.Status = STATUS_INVALID_HANDLE;
+
+	smb2_set_err_rsp(work);
+	ksmbd_fd_put(work, fp);
+	return err;
+}
+
+/**
+ * smb2_flush() - handler for smb2 flush file - fsync
+ * @work:	smb work containing flush command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb2_flush(struct ksmbd_work *work)
+{
+	struct smb2_flush_req *req;
+	struct smb2_flush_rsp *rsp, *rsp_org;
+	int err;
+
+	rsp_org = work->response_buf;
+	WORK_BUFFERS(work, req, rsp);
+
+	ksmbd_debug(SMB, "SMB2_FLUSH called for fid %llu\n",
+			le64_to_cpu(req->VolatileFileId));
+
+	err = ksmbd_vfs_fsync(work,
+			      le64_to_cpu(req->VolatileFileId),
+			      le64_to_cpu(req->PersistentFileId));
+	if (err)
+		goto out;
+
+	rsp->StructureSize = cpu_to_le16(4);
+	rsp->Reserved = 0;
+	inc_rfc1001_len(rsp_org, 4);
+	return 0;
+
+out:
+	if (err) {
+		rsp->hdr.Status = STATUS_INVALID_HANDLE;
+		smb2_set_err_rsp(work);
+	}
+
+	return err;
+}
+
+/**
+ * smb2_cancel() - handler for smb2 cancel command
+ * @work:	smb work containing cancel command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb2_cancel(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_hdr *hdr = work->request_buf;
+	struct smb2_hdr *chdr;
+	struct ksmbd_work *cancel_work = NULL;
+	struct list_head *tmp;
+	int canceled = 0;
+	struct list_head *command_list;
+
+	ksmbd_debug(SMB, "smb2 cancel called on mid %llu, async flags 0x%x\n",
+		hdr->MessageId, hdr->Flags);
+
+	if (hdr->Flags & SMB2_FLAGS_ASYNC_COMMAND) {
+		command_list = &conn->async_requests;
+
+		spin_lock(&conn->request_lock);
+		list_for_each(tmp, command_list) {
+			cancel_work = list_entry(tmp, struct ksmbd_work,
+					async_request_entry);
+			chdr = cancel_work->request_buf;
+
+			if (cancel_work->async_id !=
+			    le64_to_cpu(hdr->Id.AsyncId))
+				continue;
+
+			ksmbd_debug(SMB,
+				"smb2 with AsyncId %llu cancelled command = 0x%x\n",
+				le64_to_cpu(hdr->Id.AsyncId),
+				le16_to_cpu(chdr->Command));
+			canceled = 1;
+			break;
+		}
+		spin_unlock(&conn->request_lock);
+	} else {
+		command_list = &conn->requests;
+
+		spin_lock(&conn->request_lock);
+		list_for_each(tmp, command_list) {
+			cancel_work = list_entry(tmp, struct ksmbd_work,
+					request_entry);
+			chdr = cancel_work->request_buf;
+
+			if (chdr->MessageId != hdr->MessageId ||
+			    cancel_work == work)
+				continue;
+
+			ksmbd_debug(SMB,
+				"smb2 with mid %llu cancelled command = 0x%x\n",
+				le64_to_cpu(hdr->MessageId),
+				le16_to_cpu(chdr->Command));
+			canceled = 1;
+			break;
+		}
+		spin_unlock(&conn->request_lock);
+	}
+
+	if (canceled) {
+		cancel_work->state = KSMBD_WORK_CANCELLED;
+		if (cancel_work->cancel_fn)
+			cancel_work->cancel_fn(cancel_work->cancel_argv);
+	}
+
+	/* For SMB2_CANCEL command itself send no response*/
+	work->send_no_response = 1;
+	return 0;
+}
+
+struct file_lock *smb_flock_init(struct file *f)
+{
+	struct file_lock *fl;
+
+	fl = locks_alloc_lock();
+	if (!fl)
+		goto out;
+
+	locks_init_lock(fl);
+
+	fl->fl_owner = f;
+	fl->fl_pid = current->tgid;
+	fl->fl_file = f;
+	fl->fl_flags = FL_POSIX;
+	fl->fl_ops = NULL;
+	fl->fl_lmops = NULL;
+
+out:
+	return fl;
+}
+
+static int smb2_set_flock_flags(struct file_lock *flock, int flags)
+{
+	int cmd = -EINVAL;
+
+	/* Checking for wrong flag combination during lock request*/
+	switch (flags) {
+	case SMB2_LOCKFLAG_SHARED:
+		ksmbd_debug(SMB, "received shared request\n");
+		cmd = F_SETLKW;
+		flock->fl_type = F_RDLCK;
+		flock->fl_flags |= FL_SLEEP;
+		break;
+	case SMB2_LOCKFLAG_EXCLUSIVE:
+		ksmbd_debug(SMB, "received exclusive request\n");
+		cmd = F_SETLKW;
+		flock->fl_type = F_WRLCK;
+		flock->fl_flags |= FL_SLEEP;
+		break;
+	case SMB2_LOCKFLAG_SHARED | SMB2_LOCKFLAG_FAIL_IMMEDIATELY:
+		ksmbd_debug(SMB,
+			"received shared & fail immediately request\n");
+		cmd = F_SETLK;
+		flock->fl_type = F_RDLCK;
+		break;
+	case SMB2_LOCKFLAG_EXCLUSIVE | SMB2_LOCKFLAG_FAIL_IMMEDIATELY:
+		ksmbd_debug(SMB,
+			"received exclusive & fail immediately request\n");
+		cmd = F_SETLK;
+		flock->fl_type = F_WRLCK;
+		break;
+	case SMB2_LOCKFLAG_UNLOCK:
+		ksmbd_debug(SMB, "received unlock request\n");
+		flock->fl_type = F_UNLCK;
+		cmd = 0;
+		break;
+	}
+
+	return cmd;
+}
+
+static struct ksmbd_lock *smb2_lock_init(struct file_lock *flock,
+		unsigned int cmd, int flags, struct list_head *lock_list)
+{
+	struct ksmbd_lock *lock;
+
+	lock = kzalloc(sizeof(struct ksmbd_lock), GFP_KERNEL);
+	if (!lock)
+		return NULL;
+
+	lock->cmd = cmd;
+	lock->fl = flock;
+	lock->start = flock->fl_start;
+	lock->end = flock->fl_end;
+	lock->flags = flags;
+	if (lock->start == lock->end)
+		lock->zero_len = 1;
+	INIT_LIST_HEAD(&lock->llist);
+	INIT_LIST_HEAD(&lock->glist);
+	list_add_tail(&lock->llist, lock_list);
+
+	return lock;
+}
+
+static void smb2_remove_blocked_lock(void **argv)
+{
+	struct file_lock *flock = (struct file_lock *)argv[0];
+
+	ksmbd_vfs_posix_lock_unblock(flock);
+	wake_up(&flock->fl_wait);
+}
+
+static inline bool lock_defer_pending(struct file_lock *fl)
+{
+	/* check pending lock waiters */
+	return waitqueue_active(&fl->fl_wait);
+}
+
+/**
+ * smb2_lock() - handler for smb2 file lock command
+ * @work:	smb work containing lock command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb2_lock(struct ksmbd_work *work)
+{
+	struct smb2_lock_req *req = work->request_buf;
+	struct smb2_lock_rsp *rsp = work->response_buf;
+	struct smb2_lock_element *lock_ele;
+	struct ksmbd_file *fp = NULL;
+	struct file_lock *flock = NULL;
+	struct file *filp = NULL;
+	int lock_count;
+	int flags = 0;
+	int cmd = 0;
+	int err = 0, i;
+	u64 lock_length;
+	struct ksmbd_lock *smb_lock = NULL, *cmp_lock, *tmp;
+	int nolock = 0;
+	LIST_HEAD(lock_list);
+	LIST_HEAD(rollback_list);
+	int prior_lock = 0;
+
+	ksmbd_debug(SMB, "Received lock request\n");
+	fp = ksmbd_lookup_fd_slow(work,
+		le64_to_cpu(req->VolatileFileId),
+		le64_to_cpu(req->PersistentFileId));
+	if (!fp) {
+		ksmbd_debug(SMB, "Invalid file id for lock : %llu\n",
+				le64_to_cpu(req->VolatileFileId));
+		rsp->hdr.Status = STATUS_FILE_CLOSED;
+		goto out2;
+	}
+
+	filp = fp->filp;
+	lock_count = le16_to_cpu(req->LockCount);
+	lock_ele = req->locks;
+
+	ksmbd_debug(SMB, "lock count is %d\n", lock_count);
+	if (!lock_count)  {
+		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+		goto out2;
+	}
+
+	for (i = 0; i < lock_count; i++) {
+		flags = le32_to_cpu(lock_ele[i].Flags);
+
+		flock = smb_flock_init(filp);
+		if (!flock) {
+			rsp->hdr.Status = STATUS_LOCK_NOT_GRANTED;
+			goto out;
+		}
+
+		cmd = smb2_set_flock_flags(flock, flags);
+
+		flock->fl_start = le64_to_cpu(lock_ele[i].Offset);
+		if (flock->fl_start > OFFSET_MAX) {
+			ksmbd_err("Invalid lock range requested\n");
+			rsp->hdr.Status = STATUS_INVALID_LOCK_RANGE;
+			goto out;
+		}
+
+		lock_length = le64_to_cpu(lock_ele[i].Length);
+		if (lock_length > 0) {
+			if (lock_length > OFFSET_MAX - flock->fl_start) {
+				ksmbd_debug(SMB,
+					"Invalid lock range requested\n");
+				lock_length = OFFSET_MAX - flock->fl_start;
+				rsp->hdr.Status = STATUS_INVALID_LOCK_RANGE;
+				goto out;
+			}
+		} else {
+			lock_length = 0;
+		}
+
+		flock->fl_end = flock->fl_start + lock_length;
+
+		if (flock->fl_end < flock->fl_start) {
+			ksmbd_debug(SMB,
+				"the end offset(%llx) is smaller than the start offset(%llx)\n",
+				flock->fl_end, flock->fl_start);
+			rsp->hdr.Status = STATUS_INVALID_LOCK_RANGE;
+			goto out;
+		}
+
+		/* Check conflict locks in one request */
+		list_for_each_entry(cmp_lock, &lock_list, llist) {
+			if (cmp_lock->fl->fl_start <= flock->fl_start &&
+			    cmp_lock->fl->fl_end >= flock->fl_end) {
+				if (cmp_lock->fl->fl_type != F_UNLCK &&
+				    flock->fl_type != F_UNLCK) {
+					ksmbd_err("conflict two locks in one request\n");
+					rsp->hdr.Status =
+						STATUS_INVALID_PARAMETER;
+					goto out;
+				}
+			}
+		}
+
+		smb_lock = smb2_lock_init(flock, cmd, flags, &lock_list);
+		if (!smb_lock) {
+			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+			goto out;
+		}
+	}
+
+	list_for_each_entry_safe(smb_lock, tmp, &lock_list, llist) {
+		if (smb_lock->cmd < 0) {
+			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+			goto out;
+		}
+
+		if (!(smb_lock->flags & SMB2_LOCKFLAG_MASK)) {
+			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+			goto out;
+		}
+
+		if ((prior_lock & (SMB2_LOCKFLAG_EXCLUSIVE | SMB2_LOCKFLAG_SHARED) &&
+		     smb_lock->flags & SMB2_LOCKFLAG_UNLOCK) ||
+		    (prior_lock == SMB2_LOCKFLAG_UNLOCK &&
+		     !(smb_lock->flags & SMB2_LOCKFLAG_UNLOCK))) {
+			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+			goto out;
+		}
+
+		prior_lock = smb_lock->flags;
+
+		if (!(smb_lock->flags & SMB2_LOCKFLAG_UNLOCK) &&
+		    !(smb_lock->flags & SMB2_LOCKFLAG_FAIL_IMMEDIATELY))
+			goto no_check_gl;
+
+		nolock = 1;
+		/* check locks in global list */
+		list_for_each_entry(cmp_lock, &global_lock_list, glist) {
+			if (file_inode(cmp_lock->fl->fl_file) !=
+			    file_inode(smb_lock->fl->fl_file))
+				continue;
+
+			if (smb_lock->fl->fl_type == F_UNLCK) {
+				if (cmp_lock->fl->fl_file == smb_lock->fl->fl_file &&
+				    cmp_lock->start == smb_lock->start &&
+				    cmp_lock->end == smb_lock->end &&
+				    !lock_defer_pending(cmp_lock->fl)) {
+					nolock = 0;
+					locks_free_lock(cmp_lock->fl);
+					list_del(&cmp_lock->glist);
+					kfree(cmp_lock);
+					break;
+				}
+				continue;
+			}
+
+			if (cmp_lock->fl->fl_file == smb_lock->fl->fl_file) {
+				if (smb_lock->flags & SMB2_LOCKFLAG_SHARED)
+					continue;
+			} else {
+				if (cmp_lock->flags & SMB2_LOCKFLAG_SHARED)
+					continue;
+			}
+
+			/* check zero byte lock range */
+			if (cmp_lock->zero_len && !smb_lock->zero_len &&
+			    cmp_lock->start > smb_lock->start &&
+			    cmp_lock->start < smb_lock->end) {
+				ksmbd_err("previous lock conflict with zero byte lock range\n");
+				rsp->hdr.Status = STATUS_LOCK_NOT_GRANTED;
+					goto out;
+			}
+
+			if (smb_lock->zero_len && !cmp_lock->zero_len &&
+			    smb_lock->start > cmp_lock->start &&
+			    smb_lock->start < cmp_lock->end) {
+				ksmbd_err("current lock conflict with zero byte lock range\n");
+				rsp->hdr.Status = STATUS_LOCK_NOT_GRANTED;
+					goto out;
+			}
+
+			if (((cmp_lock->start <= smb_lock->start &&
+			      cmp_lock->end > smb_lock->start) ||
+			     (cmp_lock->start < smb_lock->end && cmp_lock->end >= smb_lock->end)) &&
+			    !cmp_lock->zero_len && !smb_lock->zero_len) {
+				ksmbd_err("Not allow lock operation on exclusive lock range\n");
+				rsp->hdr.Status =
+					STATUS_LOCK_NOT_GRANTED;
+				goto out;
+			}
+		}
+
+		if (smb_lock->fl->fl_type == F_UNLCK && nolock) {
+			ksmbd_err("Try to unlock nolocked range\n");
+			rsp->hdr.Status = STATUS_RANGE_NOT_LOCKED;
+			goto out;
+		}
+
+no_check_gl:
+		if (smb_lock->zero_len) {
+			err = 0;
+			goto skip;
+		}
+
+		flock = smb_lock->fl;
+		list_del(&smb_lock->llist);
+retry:
+		err = ksmbd_vfs_lock(filp, smb_lock->cmd, flock);
+skip:
+		if (flags & SMB2_LOCKFLAG_UNLOCK) {
+			if (!err) {
+				ksmbd_debug(SMB, "File unlocked\n");
+			} else if (err == -ENOENT) {
+				rsp->hdr.Status = STATUS_NOT_LOCKED;
+				goto out;
+			}
+			locks_free_lock(flock);
+			kfree(smb_lock);
+		} else {
+			if (err == FILE_LOCK_DEFERRED) {
+				void **argv;
+
+				ksmbd_debug(SMB,
+					"would have to wait for getting lock\n");
+				list_add_tail(&smb_lock->glist,
+					&global_lock_list);
+				list_add(&smb_lock->llist, &rollback_list);
+
+				argv = kmalloc(sizeof(void *), GFP_KERNEL);
+				if (!argv) {
+					err = -ENOMEM;
+					goto out;
+				}
+				argv[0] = flock;
+
+				err = setup_async_work(work,
+					smb2_remove_blocked_lock, argv);
+				if (err) {
+					rsp->hdr.Status =
+					   STATUS_INSUFFICIENT_RESOURCES;
+					goto out;
+				}
+				spin_lock(&fp->f_lock);
+				list_add(&work->fp_entry, &fp->blocked_works);
+				spin_unlock(&fp->f_lock);
+
+				smb2_send_interim_resp(work, STATUS_PENDING);
+
+				err = ksmbd_vfs_posix_lock_wait(flock);
+
+				if (!WORK_ACTIVE(work)) {
+					list_del(&smb_lock->llist);
+					list_del(&smb_lock->glist);
+					locks_free_lock(flock);
+
+					if (WORK_CANCELLED(work)) {
+						spin_lock(&fp->f_lock);
+						list_del(&work->fp_entry);
+						spin_unlock(&fp->f_lock);
+						rsp->hdr.Status =
+							STATUS_CANCELLED;
+						kfree(smb_lock);
+						smb2_send_interim_resp(work,
+							STATUS_CANCELLED);
+						work->send_no_response = 1;
+						goto out;
+					}
+					init_smb2_rsp_hdr(work);
+					smb2_set_err_rsp(work);
+					rsp->hdr.Status =
+						STATUS_RANGE_NOT_LOCKED;
+					kfree(smb_lock);
+					goto out2;
+				}
+
+				list_del(&smb_lock->llist);
+				list_del(&smb_lock->glist);
+				spin_lock(&fp->f_lock);
+				list_del(&work->fp_entry);
+				spin_unlock(&fp->f_lock);
+				goto retry;
+			} else if (!err) {
+				list_add_tail(&smb_lock->glist,
+					&global_lock_list);
+				list_add(&smb_lock->llist, &rollback_list);
+				ksmbd_debug(SMB, "successful in taking lock\n");
+			} else {
+				rsp->hdr.Status = STATUS_LOCK_NOT_GRANTED;
+				goto out;
+			}
+		}
+	}
+
+	if (atomic_read(&fp->f_ci->op_count) > 1)
+		smb_break_all_oplock(work, fp);
+
+	rsp->StructureSize = cpu_to_le16(4);
+	ksmbd_debug(SMB, "successful in taking lock\n");
+	rsp->hdr.Status = STATUS_SUCCESS;
+	rsp->Reserved = 0;
+	inc_rfc1001_len(rsp, 4);
+	ksmbd_fd_put(work, fp);
+	return err;
+
+out:
+	list_for_each_entry_safe(smb_lock, tmp, &lock_list, llist) {
+		locks_free_lock(smb_lock->fl);
+		list_del(&smb_lock->llist);
+		kfree(smb_lock);
+	}
+
+	list_for_each_entry_safe(smb_lock, tmp, &rollback_list, llist) {
+		struct file_lock *rlock = NULL;
+
+		rlock = smb_flock_init(filp);
+		rlock->fl_type = F_UNLCK;
+		rlock->fl_start = smb_lock->start;
+		rlock->fl_end = smb_lock->end;
+
+		err = ksmbd_vfs_lock(filp, 0, rlock);
+		if (err)
+			ksmbd_err("rollback unlock fail : %d\n", err);
+		list_del(&smb_lock->llist);
+		list_del(&smb_lock->glist);
+		locks_free_lock(smb_lock->fl);
+		locks_free_lock(rlock);
+		kfree(smb_lock);
+	}
+out2:
+	ksmbd_debug(SMB, "failed in taking lock(flags : %x)\n", flags);
+	smb2_set_err_rsp(work);
+	ksmbd_fd_put(work, fp);
+	return 0;
+}
+
+static int fsctl_copychunk(struct ksmbd_work *work, struct smb2_ioctl_req *req,
+		struct smb2_ioctl_rsp *rsp)
+{
+	struct copychunk_ioctl_req *ci_req;
+	struct copychunk_ioctl_rsp *ci_rsp;
+	struct ksmbd_file *src_fp = NULL, *dst_fp = NULL;
+	struct srv_copychunk *chunks;
+	unsigned int i, chunk_count, chunk_count_written = 0;
+	unsigned int chunk_size_written = 0;
+	loff_t total_size_written = 0;
+	int ret, cnt_code;
+
+	cnt_code = le32_to_cpu(req->CntCode);
+	ci_req = (struct copychunk_ioctl_req *)&req->Buffer[0];
+	ci_rsp = (struct copychunk_ioctl_rsp *)&rsp->Buffer[0];
+
+	rsp->VolatileFileId = req->VolatileFileId;
+	rsp->PersistentFileId = req->PersistentFileId;
+	ci_rsp->ChunksWritten =
+		cpu_to_le32(ksmbd_server_side_copy_max_chunk_count());
+	ci_rsp->ChunkBytesWritten =
+		cpu_to_le32(ksmbd_server_side_copy_max_chunk_size());
+	ci_rsp->TotalBytesWritten =
+		cpu_to_le32(ksmbd_server_side_copy_max_total_size());
+
+	chunks = (struct srv_copychunk *)&ci_req->Chunks[0];
+	chunk_count = le32_to_cpu(ci_req->ChunkCount);
+	total_size_written = 0;
+
+	/* verify the SRV_COPYCHUNK_COPY packet */
+	if (chunk_count > ksmbd_server_side_copy_max_chunk_count() ||
+	    le32_to_cpu(req->InputCount) <
+	     offsetof(struct copychunk_ioctl_req, Chunks) +
+	     chunk_count * sizeof(struct srv_copychunk)) {
+		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+		return -EINVAL;
+	}
+
+	for (i = 0; i < chunk_count; i++) {
+		if (le32_to_cpu(chunks[i].Length) == 0 ||
+		    le32_to_cpu(chunks[i].Length) > ksmbd_server_side_copy_max_chunk_size())
+			break;
+		total_size_written += le32_to_cpu(chunks[i].Length);
+	}
+
+	if (i < chunk_count ||
+	    total_size_written > ksmbd_server_side_copy_max_total_size()) {
+		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+		return -EINVAL;
+	}
+
+	src_fp = ksmbd_lookup_foreign_fd(work,
+			le64_to_cpu(ci_req->ResumeKey[0]));
+	dst_fp = ksmbd_lookup_fd_slow(work,
+				 le64_to_cpu(req->VolatileFileId),
+				 le64_to_cpu(req->PersistentFileId));
+	ret = -EINVAL;
+	if (!src_fp ||
+	    src_fp->persistent_id != le64_to_cpu(ci_req->ResumeKey[1])) {
+		rsp->hdr.Status = STATUS_OBJECT_NAME_NOT_FOUND;
+		goto out;
+	}
+
+	if (!dst_fp) {
+		rsp->hdr.Status = STATUS_FILE_CLOSED;
+		goto out;
+	}
+
+	/*
+	 * FILE_READ_DATA should only be included in
+	 * the FSCTL_COPYCHUNK case
+	 */
+	if (cnt_code == FSCTL_COPYCHUNK && !(dst_fp->daccess &
+			(FILE_READ_DATA_LE | FILE_GENERIC_READ_LE))) {
+		rsp->hdr.Status = STATUS_ACCESS_DENIED;
+		goto out;
+	}
+
+	ret = ksmbd_vfs_copy_file_ranges(work, src_fp, dst_fp,
+			chunks, chunk_count,
+			&chunk_count_written, &chunk_size_written,
+			&total_size_written);
+	if (ret < 0) {
+		if (ret == -EACCES)
+			rsp->hdr.Status = STATUS_ACCESS_DENIED;
+		if (ret == -EAGAIN)
+			rsp->hdr.Status = STATUS_FILE_LOCK_CONFLICT;
+		else if (ret == -EBADF)
+			rsp->hdr.Status = STATUS_INVALID_HANDLE;
+		else if (ret == -EFBIG || ret == -ENOSPC)
+			rsp->hdr.Status = STATUS_DISK_FULL;
+		else if (ret == -EINVAL)
+			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+		else if (ret == -EISDIR)
+			rsp->hdr.Status = STATUS_FILE_IS_A_DIRECTORY;
+		else if (ret == -E2BIG)
+			rsp->hdr.Status = STATUS_INVALID_VIEW_SIZE;
+		else
+			rsp->hdr.Status = STATUS_UNEXPECTED_IO_ERROR;
+	}
+
+	ci_rsp->ChunksWritten = cpu_to_le32(chunk_count_written);
+	ci_rsp->ChunkBytesWritten = cpu_to_le32(chunk_size_written);
+	ci_rsp->TotalBytesWritten = cpu_to_le32(total_size_written);
+out:
+	ksmbd_fd_put(work, src_fp);
+	ksmbd_fd_put(work, dst_fp);
+	return ret;
+}
+
+static __be32 idev_ipv4_address(struct in_device *idev)
+{
+	__be32 addr = 0;
+
+	struct in_ifaddr *ifa;
+
+	rcu_read_lock();
+	in_dev_for_each_ifa_rcu(ifa, idev) {
+		if (ifa->ifa_flags & IFA_F_SECONDARY)
+			continue;
+
+		addr = ifa->ifa_address;
+		break;
+	}
+	rcu_read_unlock();
+	return addr;
+}
+
+static int fsctl_query_iface_info_ioctl(struct ksmbd_conn *conn,
+		struct smb2_ioctl_req *req, struct smb2_ioctl_rsp *rsp)
+{
+	struct network_interface_info_ioctl_rsp *nii_rsp = NULL;
+	int nbytes = 0;
+	struct net_device *netdev;
+	struct sockaddr_storage_rsp *sockaddr_storage;
+	unsigned int flags;
+	unsigned long long speed;
+
+	rtnl_lock();
+	for_each_netdev(&init_net, netdev) {
+		if (unlikely(!netdev)) {
+			rtnl_unlock();
+			return -EINVAL;
+		}
+
+		if (netdev->type == ARPHRD_LOOPBACK)
+			continue;
+
+		flags = dev_get_flags(netdev);
+		if (!(flags & IFF_RUNNING))
+			continue;
+
+		nii_rsp = (struct network_interface_info_ioctl_rsp *)
+				&rsp->Buffer[nbytes];
+		nii_rsp->IfIndex = cpu_to_le32(netdev->ifindex);
+
+		/* TODO: specify the RDMA capabilities */
+		if (netdev->num_tx_queues > 1)
+			nii_rsp->Capability = cpu_to_le32(RSS_CAPABLE);
+		else
+			nii_rsp->Capability = 0;
+
+		nii_rsp->Next = cpu_to_le32(152);
+		nii_rsp->Reserved = 0;
+
+		if (netdev->ethtool_ops->get_link_ksettings) {
+			struct ethtool_link_ksettings cmd;
+
+			netdev->ethtool_ops->get_link_ksettings(netdev, &cmd);
+			speed = cmd.base.speed;
+		} else {
+			ksmbd_err("%s %s\n", netdev->name,
+				"speed is unknown, defaulting to 1Gb/sec");
+			speed = SPEED_1000;
+		}
+
+		speed *= 1000000;
+		nii_rsp->LinkSpeed = cpu_to_le64(speed);
+
+		sockaddr_storage = (struct sockaddr_storage_rsp *)
+					nii_rsp->SockAddr_Storage;
+		memset(sockaddr_storage, 0, 128);
+
+		if (conn->peer_addr.ss_family == PF_INET) {
+			struct in_device *idev;
+
+			sockaddr_storage->Family = cpu_to_le16(INTERNETWORK);
+			sockaddr_storage->addr4.Port = 0;
+
+			idev = __in_dev_get_rtnl(netdev);
+			if (!idev)
+				continue;
+			sockaddr_storage->addr4.IPv4address =
+						idev_ipv4_address(idev);
+		} else {
+			struct inet6_dev *idev6;
+			struct inet6_ifaddr *ifa;
+			__u8 *ipv6_addr = sockaddr_storage->addr6.IPv6address;
+
+			sockaddr_storage->Family = cpu_to_le16(INTERNETWORKV6);
+			sockaddr_storage->addr6.Port = 0;
+			sockaddr_storage->addr6.FlowInfo = 0;
+
+			idev6 = __in6_dev_get(netdev);
+			if (!idev6)
+				continue;
+
+			list_for_each_entry(ifa, &idev6->addr_list, if_list) {
+				if (ifa->flags & (IFA_F_TENTATIVE |
+							IFA_F_DEPRECATED))
+					continue;
+				memcpy(ipv6_addr, ifa->addr.s6_addr, 16);
+				break;
+			}
+			sockaddr_storage->addr6.ScopeId = 0;
+		}
+
+		nbytes += sizeof(struct network_interface_info_ioctl_rsp);
+	}
+	rtnl_unlock();
+
+	/* zero if this is last one */
+	if (nii_rsp)
+		nii_rsp->Next = 0;
+
+	if (!nbytes) {
+		rsp->hdr.Status = STATUS_BUFFER_TOO_SMALL;
+		return -EINVAL;
+	}
+
+	rsp->PersistentFileId = cpu_to_le64(SMB2_NO_FID);
+	rsp->VolatileFileId = cpu_to_le64(SMB2_NO_FID);
+	return nbytes;
+}
+
+static int fsctl_validate_negotiate_info(struct ksmbd_conn *conn,
+		struct validate_negotiate_info_req *neg_req,
+		struct validate_negotiate_info_rsp *neg_rsp)
+{
+	int ret = 0;
+	int dialect;
+
+	dialect = ksmbd_lookup_dialect_by_id(neg_req->Dialects,
+			neg_req->DialectCount);
+	if (dialect == BAD_PROT_ID || dialect != conn->dialect) {
+		ret = -EINVAL;
+		goto err_out;
+	}
+
+	if (strncmp(neg_req->Guid, conn->ClientGUID, SMB2_CLIENT_GUID_SIZE)) {
+		ret = -EINVAL;
+		goto err_out;
+	}
+
+	if (le16_to_cpu(neg_req->SecurityMode) != conn->cli_sec_mode) {
+		ret = -EINVAL;
+		goto err_out;
+	}
+
+	if (le32_to_cpu(neg_req->Capabilities) != conn->cli_cap) {
+		ret = -EINVAL;
+		goto err_out;
+	}
+
+	neg_rsp->Capabilities = cpu_to_le32(conn->vals->capabilities);
+	memset(neg_rsp->Guid, 0, SMB2_CLIENT_GUID_SIZE);
+	neg_rsp->SecurityMode = cpu_to_le16(conn->srv_sec_mode);
+	neg_rsp->Dialect = cpu_to_le16(conn->dialect);
+err_out:
+	return ret;
+}
+
+static int fsctl_query_allocated_ranges(struct ksmbd_work *work, u64 id,
+		struct file_allocated_range_buffer *qar_req,
+		struct file_allocated_range_buffer *qar_rsp,
+		int in_count, int *out_count)
+{
+	struct ksmbd_file *fp;
+	loff_t start, length;
+	int ret = 0;
+
+	*out_count = 0;
+	if (in_count == 0)
+		return -EINVAL;
+
+	fp = ksmbd_lookup_fd_fast(work, id);
+	if (!fp)
+		return -ENOENT;
+
+	start = le64_to_cpu(qar_req->file_offset);
+	length = le64_to_cpu(qar_req->length);
+
+	ret = ksmbd_vfs_fqar_lseek(fp, start, length,
+			qar_rsp, in_count, out_count);
+	if (ret && ret != -E2BIG)
+		*out_count = 0;
+
+	ksmbd_fd_put(work, fp);
+	return ret;
+}
+
+static int fsctl_pipe_transceive(struct ksmbd_work *work, u64 id,
+		int out_buf_len, struct smb2_ioctl_req *req,
+		struct smb2_ioctl_rsp *rsp)
+{
+	struct ksmbd_rpc_command *rpc_resp;
+	char *data_buf = (char *)&req->Buffer[0];
+	int nbytes = 0;
+
+	rpc_resp = ksmbd_rpc_ioctl(work->sess, id, data_buf,
+			le32_to_cpu(req->InputCount));
+	if (rpc_resp) {
+		if (rpc_resp->flags == KSMBD_RPC_SOME_NOT_MAPPED) {
+			/*
+			 * set STATUS_SOME_NOT_MAPPED response
+			 * for unknown domain sid.
+			 */
+			rsp->hdr.Status = STATUS_SOME_NOT_MAPPED;
+		} else if (rpc_resp->flags == KSMBD_RPC_ENOTIMPLEMENTED) {
+			rsp->hdr.Status = STATUS_NOT_SUPPORTED;
+			goto out;
+		} else if (rpc_resp->flags != KSMBD_RPC_OK) {
+			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+			goto out;
+		}
+
+		nbytes = rpc_resp->payload_sz;
+		if (rpc_resp->payload_sz > out_buf_len) {
+			rsp->hdr.Status = STATUS_BUFFER_OVERFLOW;
+			nbytes = out_buf_len;
+		}
+
+		if (!rpc_resp->payload_sz) {
+			rsp->hdr.Status =
+				STATUS_UNEXPECTED_IO_ERROR;
+			goto out;
+		}
+
+		memcpy((char *)rsp->Buffer, rpc_resp->payload, nbytes);
+	}
+out:
+	kvfree(rpc_resp);
+	return nbytes;
+}
+
+static inline int fsctl_set_sparse(struct ksmbd_work *work, u64 id,
+		struct file_sparse *sparse)
+{
+	struct ksmbd_file *fp;
+	int ret = 0;
+	__le32 old_fattr;
+
+	fp = ksmbd_lookup_fd_fast(work, id);
+	if (!fp)
+		return -ENOENT;
+
+	old_fattr = fp->f_ci->m_fattr;
+	if (sparse->SetSparse)
+		fp->f_ci->m_fattr |= ATTR_SPARSE_FILE_LE;
+	else
+		fp->f_ci->m_fattr &= ~ATTR_SPARSE_FILE_LE;
+
+	if (fp->f_ci->m_fattr != old_fattr &&
+	    test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) {
+		struct xattr_dos_attrib da;
+
+		ret = ksmbd_vfs_get_dos_attrib_xattr(fp->filp->f_path.dentry, &da);
+		if (ret <= 0)
+			goto out;
+
+		da.attr = le32_to_cpu(fp->f_ci->m_fattr);
+		ret = ksmbd_vfs_set_dos_attrib_xattr(fp->filp->f_path.dentry, &da);
+		if (ret)
+			fp->f_ci->m_fattr = old_fattr;
+	}
+
+out:
+	ksmbd_fd_put(work, fp);
+	return ret;
+}
+
+static int fsctl_request_resume_key(struct ksmbd_work *work,
+		struct smb2_ioctl_req *req,
+		struct resume_key_ioctl_rsp *key_rsp)
+{
+	struct ksmbd_file *fp;
+
+	fp = ksmbd_lookup_fd_slow(work,
+			le64_to_cpu(req->VolatileFileId),
+			le64_to_cpu(req->PersistentFileId));
+	if (!fp)
+		return -ENOENT;
+
+	memset(key_rsp, 0, sizeof(*key_rsp));
+	key_rsp->ResumeKey[0] = req->VolatileFileId;
+	key_rsp->ResumeKey[1] = req->PersistentFileId;
+	ksmbd_fd_put(work, fp);
+
+	return 0;
+}
+
+/**
+ * smb2_ioctl() - handler for smb2 ioctl command
+ * @work:	smb work containing ioctl command buffer
+ *
+ * Return:	0 on success, otherwise error
+ */
+int smb2_ioctl(struct ksmbd_work *work)
+{
+	struct smb2_ioctl_req *req;
+	struct smb2_ioctl_rsp *rsp, *rsp_org;
+	int cnt_code, nbytes = 0;
+	int out_buf_len;
+	u64 id = KSMBD_NO_FID;
+	struct ksmbd_conn *conn = work->conn;
+	int ret = 0;
+
+	rsp_org = work->response_buf;
+	if (work->next_smb2_rcv_hdr_off) {
+		req = REQUEST_BUF_NEXT(work);
+		rsp = RESPONSE_BUF_NEXT(work);
+		if (!HAS_FILE_ID(le64_to_cpu(req->VolatileFileId))) {
+			ksmbd_debug(SMB, "Compound request set FID = %u\n",
+					work->compound_fid);
+			id = work->compound_fid;
+		}
+	} else {
+		req = work->request_buf;
+		rsp = work->response_buf;
+	}
+
+	if (!HAS_FILE_ID(id))
+		id = le64_to_cpu(req->VolatileFileId);
+
+	if (req->Flags != cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL)) {
+		rsp->hdr.Status = STATUS_NOT_SUPPORTED;
+		goto out;
+	}
+
+	cnt_code = le32_to_cpu(req->CntCode);
+	out_buf_len = le32_to_cpu(req->MaxOutputResponse);
+	out_buf_len = min(KSMBD_IPC_MAX_PAYLOAD, out_buf_len);
+
+	switch (cnt_code) {
+	case FSCTL_DFS_GET_REFERRALS:
+	case FSCTL_DFS_GET_REFERRALS_EX:
+		/* Not support DFS yet */
+		rsp->hdr.Status = STATUS_FS_DRIVER_REQUIRED;
+		goto out;
+	case FSCTL_CREATE_OR_GET_OBJECT_ID:
+	{
+		struct file_object_buf_type1_ioctl_rsp *obj_buf;
+
+		nbytes = sizeof(struct file_object_buf_type1_ioctl_rsp);
+		obj_buf = (struct file_object_buf_type1_ioctl_rsp *)
+			&rsp->Buffer[0];
+
+		/*
+		 * TODO: This is dummy implementation to pass smbtorture
+		 * Need to check correct response later
+		 */
+		memset(obj_buf->ObjectId, 0x0, 16);
+		memset(obj_buf->BirthVolumeId, 0x0, 16);
+		memset(obj_buf->BirthObjectId, 0x0, 16);
+		memset(obj_buf->DomainId, 0x0, 16);
+
+		break;
+	}
+	case FSCTL_PIPE_TRANSCEIVE:
+		nbytes = fsctl_pipe_transceive(work, id, out_buf_len, req, rsp);
+		break;
+	case FSCTL_VALIDATE_NEGOTIATE_INFO:
+		if (conn->dialect < SMB30_PROT_ID) {
+			ret = -EOPNOTSUPP;
+			goto out;
+		}
+
+		ret = fsctl_validate_negotiate_info(conn,
+			(struct validate_negotiate_info_req *)&req->Buffer[0],
+			(struct validate_negotiate_info_rsp *)&rsp->Buffer[0]);
+		if (ret < 0)
+			goto out;
+
+		nbytes = sizeof(struct validate_negotiate_info_rsp);
+		rsp->PersistentFileId = cpu_to_le64(SMB2_NO_FID);
+		rsp->VolatileFileId = cpu_to_le64(SMB2_NO_FID);
+		break;
+	case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
+		nbytes = fsctl_query_iface_info_ioctl(conn, req, rsp);
+		if (nbytes < 0)
+			goto out;
+		break;
+	case FSCTL_REQUEST_RESUME_KEY:
+		if (out_buf_len < sizeof(struct resume_key_ioctl_rsp)) {
+			ret = -EINVAL;
+			goto out;
+		}
+
+		ret = fsctl_request_resume_key(work, req,
+			(struct resume_key_ioctl_rsp *)&rsp->Buffer[0]);
+		if (ret < 0)
+			goto out;
+		rsp->PersistentFileId = req->PersistentFileId;
+		rsp->VolatileFileId = req->VolatileFileId;
+		nbytes = sizeof(struct resume_key_ioctl_rsp);
+		break;
+	case FSCTL_COPYCHUNK:
+	case FSCTL_COPYCHUNK_WRITE:
+		if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+			ksmbd_debug(SMB,
+				"User does not have write permission\n");
+			ret = -EACCES;
+			goto out;
+		}
+
+		if (out_buf_len < sizeof(struct copychunk_ioctl_rsp)) {
+			ret = -EINVAL;
+			goto out;
+		}
+
+		nbytes = sizeof(struct copychunk_ioctl_rsp);
+		fsctl_copychunk(work, req, rsp);
+		break;
+	case FSCTL_SET_SPARSE:
+		ret = fsctl_set_sparse(work, id,
+			(struct file_sparse *)&req->Buffer[0]);
+		if (ret < 0)
+			goto out;
+		break;
+	case FSCTL_SET_ZERO_DATA:
+	{
+		struct file_zero_data_information *zero_data;
+		struct ksmbd_file *fp;
+		loff_t off, len;
+
+		if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
+			ksmbd_debug(SMB,
+				"User does not have write permission\n");
+			ret = -EACCES;
+			goto out;
+		}
+
+		zero_data =
+			(struct file_zero_data_information *)&req->Buffer[0];
+
+		fp = ksmbd_lookup_fd_fast(work, id);
+		if (!fp) {
+			ret = -ENOENT;
+			goto out;
+		}
+
+		off = le64_to_cpu(zero_data->FileOffset);
+		len = le64_to_cpu(zero_data->BeyondFinalZero) - off;
+
+		ret = ksmbd_vfs_zero_data(work, fp, off, len);
+		ksmbd_fd_put(work, fp);
+		if (ret < 0)
+			goto out;
+		break;
+	}
+	case FSCTL_QUERY_ALLOCATED_RANGES:
+		ret = fsctl_query_allocated_ranges(work, id,
+			(struct file_allocated_range_buffer *)&req->Buffer[0],
+			(struct file_allocated_range_buffer *)&rsp->Buffer[0],
+			out_buf_len /
+			sizeof(struct file_allocated_range_buffer), &nbytes);
+		if (ret == -E2BIG) {
+			rsp->hdr.Status = STATUS_BUFFER_OVERFLOW;
+		} else if (ret < 0) {
+			nbytes = 0;
+			goto out;
+		}
+
+		nbytes *= sizeof(struct file_allocated_range_buffer);
+		break;
+	case FSCTL_GET_REPARSE_POINT:
+	{
+		struct reparse_data_buffer *reparse_ptr;
+		struct ksmbd_file *fp;
+
+		reparse_ptr = (struct reparse_data_buffer *)&rsp->Buffer[0];
+		fp = ksmbd_lookup_fd_fast(work, id);
+		if (!fp) {
+			ksmbd_err("not found fp!!\n");
+			ret = -ENOENT;
+			goto out;
+		}
+
+		reparse_ptr->ReparseTag =
+			smb2_get_reparse_tag_special_file(FP_INODE(fp)->i_mode);
+		reparse_ptr->ReparseDataLength = 0;
+		ksmbd_fd_put(work, fp);
+		nbytes = sizeof(struct reparse_data_buffer);
+		break;
+	}
+	default:
+		ksmbd_debug(SMB, "not implemented yet ioctl command 0x%x\n",
+				cnt_code);
+		ret = -EOPNOTSUPP;
+		goto out;
+	}
+
+	rsp->CntCode = cpu_to_le32(cnt_code);
+	rsp->InputCount = cpu_to_le32(0);
+	rsp->InputOffset = cpu_to_le32(112);
+	rsp->OutputOffset = cpu_to_le32(112);
+	rsp->OutputCount = cpu_to_le32(nbytes);
+	rsp->StructureSize = cpu_to_le16(49);
+	rsp->Reserved = cpu_to_le16(0);
+	rsp->Flags = cpu_to_le32(0);
+	rsp->Reserved2 = cpu_to_le32(0);
+	inc_rfc1001_len(rsp_org, 48 + nbytes);
+
+	return 0;
+
+out:
+	if (ret == -EACCES)
+		rsp->hdr.Status = STATUS_ACCESS_DENIED;
+	else if (ret == -ENOENT)
+		rsp->hdr.Status = STATUS_OBJECT_NAME_NOT_FOUND;
+	else if (ret == -EOPNOTSUPP)
+		rsp->hdr.Status = STATUS_NOT_SUPPORTED;
+	else if (ret < 0 || rsp->hdr.Status == 0)
+		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+	smb2_set_err_rsp(work);
+	return 0;
+}
+
+/**
+ * smb20_oplock_break_ack() - handler for smb2.0 oplock break command
+ * @work:	smb work containing oplock break command buffer
+ *
+ * Return:	0
+ */
+static void smb20_oplock_break_ack(struct ksmbd_work *work)
+{
+	struct smb2_oplock_break *req = work->request_buf;
+	struct smb2_oplock_break *rsp = work->response_buf;
+	struct ksmbd_file *fp;
+	struct oplock_info *opinfo = NULL;
+	__le32 err = 0;
+	int ret = 0;
+	u64 volatile_id, persistent_id;
+	char req_oplevel = 0, rsp_oplevel = 0;
+	unsigned int oplock_change_type;
+
+	volatile_id = le64_to_cpu(req->VolatileFid);
+	persistent_id = le64_to_cpu(req->PersistentFid);
+	req_oplevel = req->OplockLevel;
+	ksmbd_debug(OPLOCK, "v_id %llu, p_id %llu request oplock level %d\n",
+		    volatile_id, persistent_id, req_oplevel);
+
+	fp = ksmbd_lookup_fd_slow(work, volatile_id, persistent_id);
+	if (!fp) {
+		rsp->hdr.Status = STATUS_FILE_CLOSED;
+		smb2_set_err_rsp(work);
+		return;
+	}
+
+	opinfo = opinfo_get(fp);
+	if (!opinfo) {
+		ksmbd_err("unexpected null oplock_info\n");
+		rsp->hdr.Status = STATUS_INVALID_OPLOCK_PROTOCOL;
+		smb2_set_err_rsp(work);
+		ksmbd_fd_put(work, fp);
+		return;
+	}
+
+	if (opinfo->level == SMB2_OPLOCK_LEVEL_NONE) {
+		rsp->hdr.Status = STATUS_INVALID_OPLOCK_PROTOCOL;
+		goto err_out;
+	}
+
+	if (opinfo->op_state == OPLOCK_STATE_NONE) {
+		ksmbd_debug(SMB, "unexpected oplock state 0x%x\n", opinfo->op_state);
+		rsp->hdr.Status = STATUS_UNSUCCESSFUL;
+		goto err_out;
+	}
+
+	if ((opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE ||
+	     opinfo->level == SMB2_OPLOCK_LEVEL_BATCH) &&
+	    (req_oplevel != SMB2_OPLOCK_LEVEL_II &&
+	     req_oplevel != SMB2_OPLOCK_LEVEL_NONE)) {
+		err = STATUS_INVALID_OPLOCK_PROTOCOL;
+		oplock_change_type = OPLOCK_WRITE_TO_NONE;
+	} else if (opinfo->level == SMB2_OPLOCK_LEVEL_II &&
+		   req_oplevel != SMB2_OPLOCK_LEVEL_NONE) {
+		err = STATUS_INVALID_OPLOCK_PROTOCOL;
+		oplock_change_type = OPLOCK_READ_TO_NONE;
+	} else if (req_oplevel == SMB2_OPLOCK_LEVEL_II ||
+		   req_oplevel == SMB2_OPLOCK_LEVEL_NONE) {
+		err = STATUS_INVALID_DEVICE_STATE;
+		if ((opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE ||
+		     opinfo->level == SMB2_OPLOCK_LEVEL_BATCH) &&
+		    req_oplevel == SMB2_OPLOCK_LEVEL_II) {
+			oplock_change_type = OPLOCK_WRITE_TO_READ;
+		} else if ((opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE ||
+			    opinfo->level == SMB2_OPLOCK_LEVEL_BATCH) &&
+			   req_oplevel == SMB2_OPLOCK_LEVEL_NONE) {
+			oplock_change_type = OPLOCK_WRITE_TO_NONE;
+		} else if (opinfo->level == SMB2_OPLOCK_LEVEL_II &&
+			   req_oplevel == SMB2_OPLOCK_LEVEL_NONE) {
+			oplock_change_type = OPLOCK_READ_TO_NONE;
+		} else {
+			oplock_change_type = 0;
+		}
+	} else {
+		oplock_change_type = 0;
+	}
+
+	switch (oplock_change_type) {
+	case OPLOCK_WRITE_TO_READ:
+		ret = opinfo_write_to_read(opinfo);
+		rsp_oplevel = SMB2_OPLOCK_LEVEL_II;
+		break;
+	case OPLOCK_WRITE_TO_NONE:
+		ret = opinfo_write_to_none(opinfo);
+		rsp_oplevel = SMB2_OPLOCK_LEVEL_NONE;
+		break;
+	case OPLOCK_READ_TO_NONE:
+		ret = opinfo_read_to_none(opinfo);
+		rsp_oplevel = SMB2_OPLOCK_LEVEL_NONE;
+		break;
+	default:
+		ksmbd_err("unknown oplock change 0x%x -> 0x%x\n",
+				opinfo->level, rsp_oplevel);
+	}
+
+	if (ret < 0) {
+		rsp->hdr.Status = err;
+		goto err_out;
+	}
+
+	opinfo_put(opinfo);
+	ksmbd_fd_put(work, fp);
+	opinfo->op_state = OPLOCK_STATE_NONE;
+	wake_up_interruptible_all(&opinfo->oplock_q);
+
+	rsp->StructureSize = cpu_to_le16(24);
+	rsp->OplockLevel = rsp_oplevel;
+	rsp->Reserved = 0;
+	rsp->Reserved2 = 0;
+	rsp->VolatileFid = cpu_to_le64(volatile_id);
+	rsp->PersistentFid = cpu_to_le64(persistent_id);
+	inc_rfc1001_len(rsp, 24);
+	return;
+
+err_out:
+	opinfo->op_state = OPLOCK_STATE_NONE;
+	wake_up_interruptible_all(&opinfo->oplock_q);
+
+	opinfo_put(opinfo);
+	ksmbd_fd_put(work, fp);
+	smb2_set_err_rsp(work);
+}
+
+static int check_lease_state(struct lease *lease, __le32 req_state)
+{
+	if ((lease->new_state ==
+	     (SMB2_LEASE_READ_CACHING_LE | SMB2_LEASE_HANDLE_CACHING_LE)) &&
+	    !(req_state & SMB2_LEASE_WRITE_CACHING_LE)) {
+		lease->new_state = req_state;
+		return 0;
+	}
+
+	if (lease->new_state == req_state)
+		return 0;
+
+	return 1;
+}
+
+/**
+ * smb21_lease_break_ack() - handler for smb2.1 lease break command
+ * @work:	smb work containing lease break command buffer
+ *
+ * Return:	0
+ */
+static void smb21_lease_break_ack(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_lease_ack *req = work->request_buf;
+	struct smb2_lease_ack *rsp = work->response_buf;
+	struct oplock_info *opinfo;
+	__le32 err = 0;
+	int ret = 0;
+	unsigned int lease_change_type;
+	__le32 lease_state;
+	struct lease *lease;
+
+	ksmbd_debug(OPLOCK, "smb21 lease break, lease state(0x%x)\n",
+			le32_to_cpu(req->LeaseState));
+	opinfo = lookup_lease_in_table(conn, req->LeaseKey);
+	if (!opinfo) {
+		ksmbd_debug(OPLOCK, "file not opened\n");
+		smb2_set_err_rsp(work);
+		rsp->hdr.Status = STATUS_UNSUCCESSFUL;
+		return;
+	}
+	lease = opinfo->o_lease;
+
+	if (opinfo->op_state == OPLOCK_STATE_NONE) {
+		ksmbd_err("unexpected lease break state 0x%x\n",
+				opinfo->op_state);
+		rsp->hdr.Status = STATUS_UNSUCCESSFUL;
+		goto err_out;
+	}
+
+	if (check_lease_state(lease, req->LeaseState)) {
+		rsp->hdr.Status = STATUS_REQUEST_NOT_ACCEPTED;
+		ksmbd_debug(OPLOCK,
+			"req lease state: 0x%x, expected state: 0x%x\n",
+				req->LeaseState, lease->new_state);
+		goto err_out;
+	}
+
+	if (!atomic_read(&opinfo->breaking_cnt)) {
+		rsp->hdr.Status = STATUS_UNSUCCESSFUL;
+		goto err_out;
+	}
+
+	/* check for bad lease state */
+	if (req->LeaseState & (~(SMB2_LEASE_READ_CACHING_LE |
+				 SMB2_LEASE_HANDLE_CACHING_LE))) {
+		err = STATUS_INVALID_OPLOCK_PROTOCOL;
+		if (lease->state & SMB2_LEASE_WRITE_CACHING_LE)
+			lease_change_type = OPLOCK_WRITE_TO_NONE;
+		else
+			lease_change_type = OPLOCK_READ_TO_NONE;
+		ksmbd_debug(OPLOCK, "handle bad lease state 0x%x -> 0x%x\n",
+			le32_to_cpu(lease->state),
+			le32_to_cpu(req->LeaseState));
+	} else if (lease->state == SMB2_LEASE_READ_CACHING_LE &&
+		   req->LeaseState != SMB2_LEASE_NONE_LE) {
+		err = STATUS_INVALID_OPLOCK_PROTOCOL;
+		lease_change_type = OPLOCK_READ_TO_NONE;
+		ksmbd_debug(OPLOCK, "handle bad lease state 0x%x -> 0x%x\n",
+			le32_to_cpu(lease->state),
+			le32_to_cpu(req->LeaseState));
+	} else {
+		/* valid lease state changes */
+		err = STATUS_INVALID_DEVICE_STATE;
+		if (req->LeaseState == SMB2_LEASE_NONE_LE) {
+			if (lease->state & SMB2_LEASE_WRITE_CACHING_LE)
+				lease_change_type = OPLOCK_WRITE_TO_NONE;
+			else
+				lease_change_type = OPLOCK_READ_TO_NONE;
+		} else if (req->LeaseState & SMB2_LEASE_READ_CACHING_LE) {
+			if (lease->state & SMB2_LEASE_WRITE_CACHING_LE)
+				lease_change_type = OPLOCK_WRITE_TO_READ;
+			else
+				lease_change_type = OPLOCK_READ_HANDLE_TO_READ;
+		} else {
+			lease_change_type = 0;
+		}
+	}
+
+	switch (lease_change_type) {
+	case OPLOCK_WRITE_TO_READ:
+		ret = opinfo_write_to_read(opinfo);
+		break;
+	case OPLOCK_READ_HANDLE_TO_READ:
+		ret = opinfo_read_handle_to_read(opinfo);
+		break;
+	case OPLOCK_WRITE_TO_NONE:
+		ret = opinfo_write_to_none(opinfo);
+		break;
+	case OPLOCK_READ_TO_NONE:
+		ret = opinfo_read_to_none(opinfo);
+		break;
+	default:
+		ksmbd_debug(OPLOCK, "unknown lease change 0x%x -> 0x%x\n",
+			le32_to_cpu(lease->state),
+			le32_to_cpu(req->LeaseState));
+	}
+
+	lease_state = lease->state;
+	opinfo->op_state = OPLOCK_STATE_NONE;
+	wake_up_interruptible_all(&opinfo->oplock_q);
+	atomic_dec(&opinfo->breaking_cnt);
+	wake_up_interruptible_all(&opinfo->oplock_brk);
+	opinfo_put(opinfo);
+
+	if (ret < 0) {
+		rsp->hdr.Status = err;
+		goto err_out;
+	}
+
+	rsp->StructureSize = cpu_to_le16(36);
+	rsp->Reserved = 0;
+	rsp->Flags = 0;
+	memcpy(rsp->LeaseKey, req->LeaseKey, 16);
+	rsp->LeaseState = lease_state;
+	rsp->LeaseDuration = 0;
+	inc_rfc1001_len(rsp, 36);
+	return;
+
+err_out:
+	opinfo->op_state = OPLOCK_STATE_NONE;
+	wake_up_interruptible_all(&opinfo->oplock_q);
+	atomic_dec(&opinfo->breaking_cnt);
+	wake_up_interruptible_all(&opinfo->oplock_brk);
+
+	opinfo_put(opinfo);
+	smb2_set_err_rsp(work);
+}
+
+/**
+ * smb2_oplock_break() - dispatcher for smb2.0 and 2.1 oplock/lease break
+ * @work:	smb work containing oplock/lease break command buffer
+ *
+ * Return:	0
+ */
+int smb2_oplock_break(struct ksmbd_work *work)
+{
+	struct smb2_oplock_break *req = work->request_buf;
+	struct smb2_oplock_break *rsp = work->response_buf;
+
+	switch (le16_to_cpu(req->StructureSize)) {
+	case OP_BREAK_STRUCT_SIZE_20:
+		smb20_oplock_break_ack(work);
+		break;
+	case OP_BREAK_STRUCT_SIZE_21:
+		smb21_lease_break_ack(work);
+		break;
+	default:
+		ksmbd_debug(OPLOCK, "invalid break cmd %d\n",
+			le16_to_cpu(req->StructureSize));
+		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+		smb2_set_err_rsp(work);
+	}
+
+	return 0;
+}
+
+/**
+ * smb2_notify() - handler for smb2 notify request
+ * @work:   smb work containing notify command buffer
+ *
+ * Return:      0
+ */
+int smb2_notify(struct ksmbd_work *work)
+{
+	struct smb2_notify_req *req;
+	struct smb2_notify_rsp *rsp;
+
+	WORK_BUFFERS(work, req, rsp);
+
+	if (work->next_smb2_rcv_hdr_off && req->hdr.NextCommand) {
+		rsp->hdr.Status = STATUS_INTERNAL_ERROR;
+		smb2_set_err_rsp(work);
+		return 0;
+	}
+
+	smb2_set_err_rsp(work);
+	rsp->hdr.Status = STATUS_NOT_IMPLEMENTED;
+	return 0;
+}
+
+/**
+ * smb2_is_sign_req() - handler for checking packet signing status
+ * @work:	smb work containing notify command buffer
+ * @command:	SMB2 command id
+ *
+ * Return:	true if packed is signed, false otherwise
+ */
+bool smb2_is_sign_req(struct ksmbd_work *work, unsigned int command)
+{
+	struct smb2_hdr *rcv_hdr2 = work->request_buf;
+
+	if ((rcv_hdr2->Flags & SMB2_FLAGS_SIGNED) &&
+	    command != SMB2_NEGOTIATE_HE &&
+	    command != SMB2_SESSION_SETUP_HE &&
+	    command != SMB2_OPLOCK_BREAK_HE)
+		return true;
+
+	return 0;
+}
+
+/**
+ * smb2_check_sign_req() - handler for req packet sign processing
+ * @work:   smb work containing notify command buffer
+ *
+ * Return:	1 on success, 0 otherwise
+ */
+int smb2_check_sign_req(struct ksmbd_work *work)
+{
+	struct smb2_hdr *hdr, *hdr_org;
+	char signature_req[SMB2_SIGNATURE_SIZE];
+	char signature[SMB2_HMACSHA256_SIZE];
+	struct kvec iov[1];
+	size_t len;
+
+	hdr_org = hdr = work->request_buf;
+	if (work->next_smb2_rcv_hdr_off)
+		hdr = REQUEST_BUF_NEXT(work);
+
+	if (!hdr->NextCommand && !work->next_smb2_rcv_hdr_off)
+		len = be32_to_cpu(hdr_org->smb2_buf_length);
+	else if (hdr->NextCommand)
+		len = le32_to_cpu(hdr->NextCommand);
+	else
+		len = be32_to_cpu(hdr_org->smb2_buf_length) -
+			work->next_smb2_rcv_hdr_off;
+
+	memcpy(signature_req, hdr->Signature, SMB2_SIGNATURE_SIZE);
+	memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE);
+
+	iov[0].iov_base = (char *)&hdr->ProtocolId;
+	iov[0].iov_len = len;
+
+	if (ksmbd_sign_smb2_pdu(work->conn, work->sess->sess_key, iov, 1,
+				signature))
+		return 0;
+
+	if (memcmp(signature, signature_req, SMB2_SIGNATURE_SIZE)) {
+		ksmbd_err("bad smb2 signature\n");
+		return 0;
+	}
+
+	return 1;
+}
+
+/**
+ * smb2_set_sign_rsp() - handler for rsp packet sign processing
+ * @work:   smb work containing notify command buffer
+ *
+ */
+void smb2_set_sign_rsp(struct ksmbd_work *work)
+{
+	struct smb2_hdr *hdr, *hdr_org;
+	struct smb2_hdr *req_hdr;
+	char signature[SMB2_HMACSHA256_SIZE];
+	struct kvec iov[2];
+	size_t len;
+	int n_vec = 1;
+
+	hdr_org = hdr = work->response_buf;
+	if (work->next_smb2_rsp_hdr_off)
+		hdr = RESPONSE_BUF_NEXT(work);
+
+	req_hdr = REQUEST_BUF_NEXT(work);
+
+	if (!work->next_smb2_rsp_hdr_off) {
+		len = get_rfc1002_len(hdr_org);
+		if (req_hdr->NextCommand)
+			len = ALIGN(len, 8);
+	} else {
+		len = get_rfc1002_len(hdr_org) - work->next_smb2_rsp_hdr_off;
+		len = ALIGN(len, 8);
+	}
+
+	if (req_hdr->NextCommand)
+		hdr->NextCommand = cpu_to_le32(len);
+
+	hdr->Flags |= SMB2_FLAGS_SIGNED;
+	memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE);
+
+	iov[0].iov_base = (char *)&hdr->ProtocolId;
+	iov[0].iov_len = len;
+
+	if (work->aux_payload_sz) {
+		iov[0].iov_len -= work->aux_payload_sz;
+
+		iov[1].iov_base = work->aux_payload_buf;
+		iov[1].iov_len = work->aux_payload_sz;
+		n_vec++;
+	}
+
+	if (!ksmbd_sign_smb2_pdu(work->conn, work->sess->sess_key, iov, n_vec,
+				 signature))
+		memcpy(hdr->Signature, signature, SMB2_SIGNATURE_SIZE);
+}
+
+/**
+ * smb3_check_sign_req() - handler for req packet sign processing
+ * @work:   smb work containing notify command buffer
+ *
+ * Return:	1 on success, 0 otherwise
+ */
+int smb3_check_sign_req(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn;
+	char *signing_key;
+	struct smb2_hdr *hdr, *hdr_org;
+	struct channel *chann;
+	char signature_req[SMB2_SIGNATURE_SIZE];
+	char signature[SMB2_CMACAES_SIZE];
+	struct kvec iov[1];
+	size_t len;
+
+	hdr_org = hdr = work->request_buf;
+	if (work->next_smb2_rcv_hdr_off)
+		hdr = REQUEST_BUF_NEXT(work);
+
+	if (!hdr->NextCommand && !work->next_smb2_rcv_hdr_off)
+		len = be32_to_cpu(hdr_org->smb2_buf_length);
+	else if (hdr->NextCommand)
+		len = le32_to_cpu(hdr->NextCommand);
+	else
+		len = be32_to_cpu(hdr_org->smb2_buf_length) -
+			work->next_smb2_rcv_hdr_off;
+
+	if (le16_to_cpu(hdr->Command) == SMB2_SESSION_SETUP_HE) {
+		signing_key = work->sess->smb3signingkey;
+		conn = work->sess->conn;
+	} else {
+		chann = lookup_chann_list(work->sess);
+		if (!chann)
+			return 0;
+		signing_key = chann->smb3signingkey;
+		conn = chann->conn;
+	}
+
+	if (!signing_key) {
+		ksmbd_err("SMB3 signing key is not generated\n");
+		return 0;
+	}
+
+	memcpy(signature_req, hdr->Signature, SMB2_SIGNATURE_SIZE);
+	memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE);
+	iov[0].iov_base = (char *)&hdr->ProtocolId;
+	iov[0].iov_len = len;
+
+	if (ksmbd_sign_smb3_pdu(conn, signing_key, iov, 1, signature))
+		return 0;
+
+	if (memcmp(signature, signature_req, SMB2_SIGNATURE_SIZE)) {
+		ksmbd_err("bad smb2 signature\n");
+		return 0;
+	}
+
+	return 1;
+}
+
+/**
+ * smb3_set_sign_rsp() - handler for rsp packet sign processing
+ * @work:   smb work containing notify command buffer
+ *
+ */
+void smb3_set_sign_rsp(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn;
+	struct smb2_hdr *req_hdr;
+	struct smb2_hdr *hdr, *hdr_org;
+	struct channel *chann;
+	char signature[SMB2_CMACAES_SIZE];
+	struct kvec iov[2];
+	int n_vec = 1;
+	size_t len;
+	char *signing_key;
+
+	hdr_org = hdr = work->response_buf;
+	if (work->next_smb2_rsp_hdr_off)
+		hdr = RESPONSE_BUF_NEXT(work);
+
+	req_hdr = REQUEST_BUF_NEXT(work);
+
+	if (!work->next_smb2_rsp_hdr_off) {
+		len = get_rfc1002_len(hdr_org);
+		if (req_hdr->NextCommand)
+			len = ALIGN(len, 8);
+	} else {
+		len = get_rfc1002_len(hdr_org) - work->next_smb2_rsp_hdr_off;
+		len = ALIGN(len, 8);
+	}
+
+	if (le16_to_cpu(hdr->Command) == SMB2_SESSION_SETUP_HE) {
+		signing_key = work->sess->smb3signingkey;
+		conn = work->sess->conn;
+	} else {
+		chann = lookup_chann_list(work->sess);
+		if (!chann)
+			return;
+		signing_key = chann->smb3signingkey;
+		conn = chann->conn;
+	}
+
+	if (!signing_key)
+		return;
+
+	if (req_hdr->NextCommand)
+		hdr->NextCommand = cpu_to_le32(len);
+
+	hdr->Flags |= SMB2_FLAGS_SIGNED;
+	memset(hdr->Signature, 0, SMB2_SIGNATURE_SIZE);
+	iov[0].iov_base = (char *)&hdr->ProtocolId;
+	iov[0].iov_len = len;
+	if (work->aux_payload_sz) {
+		iov[0].iov_len -= work->aux_payload_sz;
+		iov[1].iov_base = work->aux_payload_buf;
+		iov[1].iov_len = work->aux_payload_sz;
+		n_vec++;
+	}
+
+	if (!ksmbd_sign_smb3_pdu(conn, signing_key, iov, n_vec, signature))
+		memcpy(hdr->Signature, signature, SMB2_SIGNATURE_SIZE);
+}
+
+/**
+ * smb3_preauth_hash_rsp() - handler for computing preauth hash on response
+ * @work:   smb work containing response buffer
+ *
+ */
+void smb3_preauth_hash_rsp(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_session *sess = work->sess;
+	struct smb2_hdr *req, *rsp;
+
+	if (conn->dialect != SMB311_PROT_ID)
+		return;
+
+	WORK_BUFFERS(work, req, rsp);
+
+	if (le16_to_cpu(req->Command) == SMB2_NEGOTIATE_HE)
+		ksmbd_gen_preauth_integrity_hash(conn, (char *)rsp,
+			conn->preauth_info->Preauth_HashValue);
+
+	if (le16_to_cpu(rsp->Command) == SMB2_SESSION_SETUP_HE &&
+	    sess && sess->state == SMB2_SESSION_IN_PROGRESS) {
+		__u8 *hash_value;
+
+		hash_value = sess->Preauth_HashValue;
+		ksmbd_gen_preauth_integrity_hash(conn, (char *)rsp,
+				hash_value);
+	}
+}
+
+static void fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, char *old_buf,
+		__le16 cipher_type)
+{
+	struct smb2_hdr *hdr = (struct smb2_hdr *)old_buf;
+	unsigned int orig_len = get_rfc1002_len(old_buf);
+
+	memset(tr_hdr, 0, sizeof(struct smb2_transform_hdr));
+	tr_hdr->ProtocolId = SMB2_TRANSFORM_PROTO_NUM;
+	tr_hdr->OriginalMessageSize = cpu_to_le32(orig_len);
+	tr_hdr->Flags = cpu_to_le16(0x01);
+	if (cipher_type == SMB2_ENCRYPTION_AES128_GCM)
+		get_random_bytes(&tr_hdr->Nonce, SMB3_AES128GCM_NONCE);
+	else
+		get_random_bytes(&tr_hdr->Nonce, SMB3_AES128CCM_NONCE);
+	memcpy(&tr_hdr->SessionId, &hdr->SessionId, 8);
+	inc_rfc1001_len(tr_hdr, sizeof(struct smb2_transform_hdr) - 4);
+	inc_rfc1001_len(tr_hdr, orig_len);
+}
+
+int smb3_encrypt_resp(struct ksmbd_work *work)
+{
+	char *buf = work->response_buf;
+	struct smb2_transform_hdr *tr_hdr;
+	struct kvec iov[3];
+	int rc = -ENOMEM;
+	int buf_size = 0, rq_nvec = 2 + (work->aux_payload_sz ? 1 : 0);
+
+	if (ARRAY_SIZE(iov) < rq_nvec)
+		return -ENOMEM;
+
+	tr_hdr = kzalloc(sizeof(struct smb2_transform_hdr), GFP_KERNEL);
+	if (!tr_hdr)
+		return rc;
+
+	/* fill transform header */
+	fill_transform_hdr(tr_hdr, buf, work->conn->cipher_type);
+
+	iov[0].iov_base = tr_hdr;
+	iov[0].iov_len = sizeof(struct smb2_transform_hdr);
+	buf_size += iov[0].iov_len - 4;
+
+	iov[1].iov_base = buf + 4;
+	iov[1].iov_len = get_rfc1002_len(buf);
+	if (work->aux_payload_sz) {
+		iov[1].iov_len = work->resp_hdr_sz - 4;
+
+		iov[2].iov_base = work->aux_payload_buf;
+		iov[2].iov_len = work->aux_payload_sz;
+		buf_size += iov[2].iov_len;
+	}
+	buf_size += iov[1].iov_len;
+	work->resp_hdr_sz = iov[1].iov_len;
+
+	rc = ksmbd_crypt_message(work->conn, iov, rq_nvec, 1);
+	if (rc)
+		return rc;
+
+	memmove(buf, iov[1].iov_base, iov[1].iov_len);
+	tr_hdr->smb2_buf_length = cpu_to_be32(buf_size);
+	work->tr_buf = tr_hdr;
+
+	return rc;
+}
+
+int smb3_is_transform_hdr(void *buf)
+{
+	struct smb2_transform_hdr *trhdr = buf;
+
+	return trhdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM;
+}
+
+int smb3_decrypt_req(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct ksmbd_session *sess;
+	char *buf = work->request_buf;
+	struct smb2_hdr *hdr;
+	unsigned int pdu_length = get_rfc1002_len(buf);
+	struct kvec iov[2];
+	unsigned int buf_data_size = pdu_length + 4 -
+		sizeof(struct smb2_transform_hdr);
+	struct smb2_transform_hdr *tr_hdr = (struct smb2_transform_hdr *)buf;
+	unsigned int orig_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
+	int rc = 0;
+
+	sess = ksmbd_session_lookup(conn, le64_to_cpu(tr_hdr->SessionId));
+	if (!sess) {
+		ksmbd_err("invalid session id(%llx) in transform header\n",
+			le64_to_cpu(tr_hdr->SessionId));
+		return -ECONNABORTED;
+	}
+
+	if (pdu_length + 4 < sizeof(struct smb2_transform_hdr) +
+			sizeof(struct smb2_hdr)) {
+		ksmbd_err("Transform message is too small (%u)\n",
+				pdu_length);
+		return -ECONNABORTED;
+	}
+
+	if (pdu_length + 4 < orig_len + sizeof(struct smb2_transform_hdr)) {
+		ksmbd_err("Transform message is broken\n");
+		return -ECONNABORTED;
+	}
+
+	iov[0].iov_base = buf;
+	iov[0].iov_len = sizeof(struct smb2_transform_hdr);
+	iov[1].iov_base = buf + sizeof(struct smb2_transform_hdr);
+	iov[1].iov_len = buf_data_size;
+	rc = ksmbd_crypt_message(conn, iov, 2, 0);
+	if (rc)
+		return rc;
+
+	memmove(buf + 4, iov[1].iov_base, buf_data_size);
+	hdr = (struct smb2_hdr *)buf;
+	hdr->smb2_buf_length = cpu_to_be32(buf_data_size);
+
+	return rc;
+}
+
+bool smb3_11_final_sess_setup_resp(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+	struct smb2_hdr *rsp = work->response_buf;
+
+	if (conn->dialect < SMB30_PROT_ID)
+		return false;
+
+	if (work->next_smb2_rcv_hdr_off)
+		rsp = RESPONSE_BUF_NEXT(work);
+
+	if (le16_to_cpu(rsp->Command) == SMB2_SESSION_SETUP_HE &&
+	    rsp->Status == STATUS_SUCCESS)
+		return true;
+	return false;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smb2pdu.h linux-5.4.60-fbx/fs/cifsd/smb2pdu.h
--- linux-5.4.60-fbx/fs/cifsd./smb2pdu.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smb2pdu.h	2021-04-21 09:44:50.978505152 +0200
@@ -0,0 +1,1646 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef _SMB2PDU_H
+#define _SMB2PDU_H
+
+#include "ntlmssp.h"
+#include "smbacl.h"
+
+/*
+ * Note that, due to trying to use names similar to the protocol specifications,
+ * there are many mixed case field names in the structures below.  Although
+ * this does not match typical Linux kernel style, it is necessary to be
+ * able to match against the protocol specfication.
+ *
+ * SMB2 commands
+ * Some commands have minimal (wct=0,bcc=0), or uninteresting, responses
+ * (ie no useful data other than the SMB error code itself) and are marked such.
+ * Knowing this helps avoid response buffer allocations and copy in some cases.
+ */
+
+/* List of commands in host endian */
+#define SMB2_NEGOTIATE_HE	0x0000
+#define SMB2_SESSION_SETUP_HE	0x0001
+#define SMB2_LOGOFF_HE		0x0002 /* trivial request/resp */
+#define SMB2_TREE_CONNECT_HE	0x0003
+#define SMB2_TREE_DISCONNECT_HE	0x0004 /* trivial req/resp */
+#define SMB2_CREATE_HE		0x0005
+#define SMB2_CLOSE_HE		0x0006
+#define SMB2_FLUSH_HE		0x0007 /* trivial resp */
+#define SMB2_READ_HE		0x0008
+#define SMB2_WRITE_HE		0x0009
+#define SMB2_LOCK_HE		0x000A
+#define SMB2_IOCTL_HE		0x000B
+#define SMB2_CANCEL_HE		0x000C
+#define SMB2_ECHO_HE		0x000D
+#define SMB2_QUERY_DIRECTORY_HE	0x000E
+#define SMB2_CHANGE_NOTIFY_HE	0x000F
+#define SMB2_QUERY_INFO_HE	0x0010
+#define SMB2_SET_INFO_HE	0x0011
+#define SMB2_OPLOCK_BREAK_HE	0x0012
+
+/* The same list in little endian */
+#define SMB2_NEGOTIATE		cpu_to_le16(SMB2_NEGOTIATE_HE)
+#define SMB2_SESSION_SETUP	cpu_to_le16(SMB2_SESSION_SETUP_HE)
+#define SMB2_LOGOFF		cpu_to_le16(SMB2_LOGOFF_HE)
+#define SMB2_TREE_CONNECT	cpu_to_le16(SMB2_TREE_CONNECT_HE)
+#define SMB2_TREE_DISCONNECT	cpu_to_le16(SMB2_TREE_DISCONNECT_HE)
+#define SMB2_CREATE		cpu_to_le16(SMB2_CREATE_HE)
+#define SMB2_CLOSE		cpu_to_le16(SMB2_CLOSE_HE)
+#define SMB2_FLUSH		cpu_to_le16(SMB2_FLUSH_HE)
+#define SMB2_READ		cpu_to_le16(SMB2_READ_HE)
+#define SMB2_WRITE		cpu_to_le16(SMB2_WRITE_HE)
+#define SMB2_LOCK		cpu_to_le16(SMB2_LOCK_HE)
+#define SMB2_IOCTL		cpu_to_le16(SMB2_IOCTL_HE)
+#define SMB2_CANCEL		cpu_to_le16(SMB2_CANCEL_HE)
+#define SMB2_ECHO		cpu_to_le16(SMB2_ECHO_HE)
+#define SMB2_QUERY_DIRECTORY	cpu_to_le16(SMB2_QUERY_DIRECTORY_HE)
+#define SMB2_CHANGE_NOTIFY	cpu_to_le16(SMB2_CHANGE_NOTIFY_HE)
+#define SMB2_QUERY_INFO		cpu_to_le16(SMB2_QUERY_INFO_HE)
+#define SMB2_SET_INFO		cpu_to_le16(SMB2_SET_INFO_HE)
+#define SMB2_OPLOCK_BREAK	cpu_to_le16(SMB2_OPLOCK_BREAK_HE)
+
+/*Create Action Flags*/
+#define FILE_SUPERSEDED                0x00000000
+#define FILE_OPENED            0x00000001
+#define FILE_CREATED           0x00000002
+#define FILE_OVERWRITTEN       0x00000003
+
+/*
+ * Size of the session key (crypto key encrypted with the password
+ */
+#define SMB2_NTLMV2_SESSKEY_SIZE	16
+#define SMB2_SIGNATURE_SIZE		16
+#define SMB2_HMACSHA256_SIZE		32
+#define SMB2_CMACAES_SIZE		16
+
+/*
+ * Size of the smb3 signing key
+ */
+#define SMB3_SIGN_KEY_SIZE		16
+
+#define CIFS_CLIENT_CHALLENGE_SIZE	8
+#define SMB_SERVER_CHALLENGE_SIZE	8
+
+/* SMB2 Max Credits */
+#define SMB2_MAX_CREDITS		8192
+
+#define SMB2_CLIENT_GUID_SIZE		16
+#define SMB2_CREATE_GUID_SIZE		16
+
+/* Maximum buffer size value we can send with 1 credit */
+#define SMB2_MAX_BUFFER_SIZE 65536
+
+#define NUMBER_OF_SMB2_COMMANDS	0x0013
+
+/* BB FIXME - analyze following length BB */
+#define MAX_SMB2_HDR_SIZE 0x78 /* 4 len + 64 hdr + (2*24 wct) + 2 bct + 2 pad */
+
+#define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe) /* 'B''M''S' */
+#define SMB2_TRANSFORM_PROTO_NUM cpu_to_le32(0x424d53fd)
+
+#define SMB21_DEFAULT_IOSIZE	(1024 * 1024)
+#define SMB3_DEFAULT_IOSIZE	(4 * 1024 * 1024)
+#define SMB3_DEFAULT_TRANS_SIZE	(1024 * 1024)
+
+/*
+ * SMB2 Header Definition
+ *
+ * "MBZ" :  Must be Zero
+ * "BB"  :  BugBug, Something to check/review/analyze later
+ * "PDU" :  "Protocol Data Unit" (ie a network "frame")
+ *
+ */
+
+#define __SMB2_HEADER_STRUCTURE_SIZE	64
+#define SMB2_HEADER_STRUCTURE_SIZE				\
+	cpu_to_le16(__SMB2_HEADER_STRUCTURE_SIZE)
+
+struct smb2_hdr {
+	__be32 smb2_buf_length;	/* big endian on wire */
+				/*
+				 * length is only two or three bytes - with
+				 * one or two byte type preceding it that MBZ
+				 */
+	__le32 ProtocolId;	/* 0xFE 'S' 'M' 'B' */
+	__le16 StructureSize;	/* 64 */
+	__le16 CreditCharge;	/* MBZ */
+	__le32 Status;		/* Error from server */
+	__le16 Command;
+	__le16 CreditRequest;	/* CreditResponse */
+	__le32 Flags;
+	__le32 NextCommand;
+	__le64 MessageId;
+	union {
+		struct {
+			__le32 ProcessId;
+			__le32  TreeId;
+		} __packed SyncId;
+		__le64  AsyncId;
+	} __packed Id;
+	__le64  SessionId;
+	__u8   Signature[16];
+} __packed;
+
+struct smb2_pdu {
+	struct smb2_hdr hdr;
+	__le16 StructureSize2; /* size of wct area (varies, request specific) */
+} __packed;
+
+#define SMB3_AES128CCM_NONCE 11
+#define SMB3_AES128GCM_NONCE 12
+
+struct smb2_transform_hdr {
+	__be32 smb2_buf_length; /* big endian on wire */
+	/*
+	 * length is only two or three bytes - with
+	 * one or two byte type preceding it that MBZ
+	 */
+	__le32 ProtocolId;      /* 0xFD 'S' 'M' 'B' */
+	__u8   Signature[16];
+	__u8   Nonce[16];
+	__le32 OriginalMessageSize;
+	__u16  Reserved1;
+	__le16 Flags; /* EncryptionAlgorithm */
+	__le64  SessionId;
+} __packed;
+
+/*
+ *	SMB2 flag definitions
+ */
+#define SMB2_FLAGS_SERVER_TO_REDIR	cpu_to_le32(0x00000001)
+#define SMB2_FLAGS_ASYNC_COMMAND	cpu_to_le32(0x00000002)
+#define SMB2_FLAGS_RELATED_OPERATIONS	cpu_to_le32(0x00000004)
+#define SMB2_FLAGS_SIGNED		cpu_to_le32(0x00000008)
+#define SMB2_FLAGS_DFS_OPERATIONS	cpu_to_le32(0x10000000)
+#define SMB2_FLAGS_REPLAY_OPERATIONS	cpu_to_le32(0x20000000)
+
+/*
+ *	Definitions for SMB2 Protocol Data Units (network frames)
+ *
+ *  See MS-SMB2.PDF specification for protocol details.
+ *  The Naming convention is the lower case version of the SMB2
+ *  command code name for the struct. Note that structures must be packed.
+ *
+ */
+
+#define SMB2_ERROR_STRUCTURE_SIZE2	9
+#define SMB2_ERROR_STRUCTURE_SIZE2_LE	cpu_to_le16(SMB2_ERROR_STRUCTURE_SIZE2)
+
+struct smb2_err_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;
+	__u8   ErrorContextCount;
+	__u8   Reserved;
+	__le32 ByteCount;  /* even if zero, at least one byte follows */
+	__u8   ErrorData[1];  /* variable length */
+} __packed;
+
+struct smb2_negotiate_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 36 */
+	__le16 DialectCount;
+	__le16 SecurityMode;
+	__le16 Reserved;	/* MBZ */
+	__le32 Capabilities;
+	__u8   ClientGUID[SMB2_CLIENT_GUID_SIZE];
+	/* In SMB3.02 and earlier next three were MBZ le64 ClientStartTime */
+	__le32 NegotiateContextOffset; /* SMB3.1.1 only. MBZ earlier */
+	__le16 NegotiateContextCount;  /* SMB3.1.1 only. MBZ earlier */
+	__le16 Reserved2;
+	__le16 Dialects[1]; /* One dialect (vers=) at a time for now */
+} __packed;
+
+/* SecurityMode flags */
+#define SMB2_NEGOTIATE_SIGNING_ENABLED_LE	cpu_to_le16(0x0001)
+#define SMB2_NEGOTIATE_SIGNING_REQUIRED		0x0002
+#define SMB2_NEGOTIATE_SIGNING_REQUIRED_LE	cpu_to_le16(0x0002)
+/* Capabilities flags */
+#define SMB2_GLOBAL_CAP_DFS		0x00000001
+#define SMB2_GLOBAL_CAP_LEASING		0x00000002 /* Resp only New to SMB2.1 */
+#define SMB2_GLOBAL_CAP_LARGE_MTU	0X00000004 /* Resp only New to SMB2.1 */
+#define SMB2_GLOBAL_CAP_MULTI_CHANNEL	0x00000008 /* New to SMB3 */
+#define SMB2_GLOBAL_CAP_PERSISTENT_HANDLES 0x00000010 /* New to SMB3 */
+#define SMB2_GLOBAL_CAP_DIRECTORY_LEASING  0x00000020 /* New to SMB3 */
+#define SMB2_GLOBAL_CAP_ENCRYPTION	0x00000040 /* New to SMB3 */
+/* Internal types */
+#define SMB2_NT_FIND			0x00100000
+#define SMB2_LARGE_FILES		0x00200000
+
+#define SMB311_SALT_SIZE			32
+/* Hash Algorithm Types */
+#define SMB2_PREAUTH_INTEGRITY_SHA512	cpu_to_le16(0x0001)
+
+#define PREAUTH_HASHVALUE_SIZE		64
+
+struct preauth_integrity_info {
+	/* PreAuth integrity Hash ID */
+	__le16			Preauth_HashId;
+	/* PreAuth integrity Hash Value */
+	__u8			Preauth_HashValue[PREAUTH_HASHVALUE_SIZE];
+};
+
+/* offset is sizeof smb2_negotiate_rsp - 4 but rounded up to 8 bytes. */
+#ifdef CONFIG_SMB_SERVER_KERBEROS5
+/* sizeof(struct smb2_negotiate_rsp) - 4 =
+ * header(64) + response(64) + GSS_LENGTH(96) + GSS_PADDING(0)
+ */
+#define OFFSET_OF_NEG_CONTEXT	0xe0
+#else
+/* sizeof(struct smb2_negotiate_rsp) - 4 =
+ * header(64) + response(64) + GSS_LENGTH(74) + GSS_PADDING(6)
+ */
+#define OFFSET_OF_NEG_CONTEXT	0xd0
+#endif
+
+#define SMB2_PREAUTH_INTEGRITY_CAPABILITIES	cpu_to_le16(1)
+#define SMB2_ENCRYPTION_CAPABILITIES		cpu_to_le16(2)
+#define SMB2_COMPRESSION_CAPABILITIES		cpu_to_le16(3)
+#define SMB2_NETNAME_NEGOTIATE_CONTEXT_ID	cpu_to_le16(5)
+#define SMB2_POSIX_EXTENSIONS_AVAILABLE		cpu_to_le16(0x100)
+
+struct smb2_neg_context {
+	__le16  ContextType;
+	__le16  DataLength;
+	__le32  Reserved;
+	/* Followed by array of data */
+} __packed;
+
+struct smb2_preauth_neg_context {
+	__le16	ContextType; /* 1 */
+	__le16	DataLength;
+	__le32	Reserved;
+	__le16	HashAlgorithmCount; /* 1 */
+	__le16	SaltLength;
+	__le16	HashAlgorithms; /* HashAlgorithms[0] since only one defined */
+	__u8	Salt[SMB311_SALT_SIZE];
+} __packed;
+
+/* Encryption Algorithms Ciphers */
+#define SMB2_ENCRYPTION_AES128_CCM	cpu_to_le16(0x0001)
+#define SMB2_ENCRYPTION_AES128_GCM	cpu_to_le16(0x0002)
+
+struct smb2_encryption_neg_context {
+	__le16	ContextType; /* 2 */
+	__le16	DataLength;
+	__le32	Reserved;
+	__le16	CipherCount; /* AES-128-GCM and AES-128-CCM */
+	__le16	Ciphers[1]; /* Ciphers[0] since only one used now */
+} __packed;
+
+#define SMB3_COMPRESS_NONE	cpu_to_le16(0x0000)
+#define SMB3_COMPRESS_LZNT1	cpu_to_le16(0x0001)
+#define SMB3_COMPRESS_LZ77	cpu_to_le16(0x0002)
+#define SMB3_COMPRESS_LZ77_HUFF	cpu_to_le16(0x0003)
+
+struct smb2_compression_ctx {
+	__le16	ContextType; /* 3 */
+	__le16  DataLength;
+	__le32	Reserved;
+	__le16	CompressionAlgorithmCount;
+	__u16	Padding;
+	__le32	Reserved1;
+	__le16	CompressionAlgorithms[1];
+} __packed;
+
+#define POSIX_CTXT_DATA_LEN     16
+struct smb2_posix_neg_context {
+	__le16	ContextType; /* 0x100 */
+	__le16	DataLength;
+	__le32	Reserved;
+	__u8	Name[16]; /* POSIX ctxt GUID 93AD25509CB411E7B42383DE968BCD7C */
+} __packed;
+
+struct smb2_netname_neg_context {
+	__le16	ContextType; /* 0x100 */
+	__le16	DataLength;
+	__le32	Reserved;
+	__le16	NetName[0]; /* hostname of target converted to UCS-2 */
+} __packed;
+
+struct smb2_negotiate_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;	/* Must be 65 */
+	__le16 SecurityMode;
+	__le16 DialectRevision;
+	__le16 NegotiateContextCount; /* Prior to SMB3.1.1 was Reserved & MBZ */
+	__u8   ServerGUID[16];
+	__le32 Capabilities;
+	__le32 MaxTransactSize;
+	__le32 MaxReadSize;
+	__le32 MaxWriteSize;
+	__le64 SystemTime;	/* MBZ */
+	__le64 ServerStartTime;
+	__le16 SecurityBufferOffset;
+	__le16 SecurityBufferLength;
+	__le32 NegotiateContextOffset;	/* Pre:SMB3.1.1 was reserved/ignored */
+	__u8   Buffer[1];	/* variable length GSS security buffer */
+} __packed;
+
+/* Flags */
+#define SMB2_SESSION_REQ_FLAG_BINDING		0x01
+#define SMB2_SESSION_REQ_FLAG_ENCRYPT_DATA	0x04
+
+#define SMB2_SESSION_EXPIRED		(0)
+#define SMB2_SESSION_IN_PROGRESS	BIT(0)
+#define SMB2_SESSION_VALID		BIT(1)
+
+/* Flags */
+#define SMB2_SESSION_REQ_FLAG_BINDING		0x01
+#define SMB2_SESSION_REQ_FLAG_ENCRYPT_DATA	0x04
+
+struct smb2_sess_setup_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 25 */
+	__u8   Flags;
+	__u8   SecurityMode;
+	__le32 Capabilities;
+	__le32 Channel;
+	__le16 SecurityBufferOffset;
+	__le16 SecurityBufferLength;
+	__le64 PreviousSessionId;
+	__u8   Buffer[1];	/* variable length GSS security buffer */
+} __packed;
+
+/* Flags/Reserved for SMB3.1.1 */
+#define SMB2_SHAREFLAG_CLUSTER_RECONNECT	0x0001
+
+/* Currently defined SessionFlags */
+#define SMB2_SESSION_FLAG_IS_GUEST_LE		cpu_to_le16(0x0001)
+#define SMB2_SESSION_FLAG_IS_NULL_LE		cpu_to_le16(0x0002)
+#define SMB2_SESSION_FLAG_ENCRYPT_DATA_LE	cpu_to_le16(0x0004)
+struct smb2_sess_setup_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 9 */
+	__le16 SessionFlags;
+	__le16 SecurityBufferOffset;
+	__le16 SecurityBufferLength;
+	__u8   Buffer[1];	/* variable length GSS security buffer */
+} __packed;
+
+struct smb2_logoff_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;	/* Must be 4 */
+	__le16 Reserved;
+} __packed;
+
+struct smb2_logoff_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;	/* Must be 4 */
+	__le16 Reserved;
+} __packed;
+
+struct smb2_tree_connect_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;	/* Must be 9 */
+	__le16 Reserved;	/* Flags in SMB3.1.1 */
+	__le16 PathOffset;
+	__le16 PathLength;
+	__u8   Buffer[1];	/* variable length */
+} __packed;
+
+struct smb2_tree_connect_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;	/* Must be 16 */
+	__u8   ShareType;  /* see below */
+	__u8   Reserved;
+	__le32 ShareFlags; /* see below */
+	__le32 Capabilities; /* see below */
+	__le32 MaximalAccess;
+} __packed;
+
+/* Possible ShareType values */
+#define SMB2_SHARE_TYPE_DISK	0x01
+#define SMB2_SHARE_TYPE_PIPE	0x02
+#define	SMB2_SHARE_TYPE_PRINT	0x03
+
+/*
+ * Possible ShareFlags - exactly one and only one of the first 4 caching flags
+ * must be set (any of the remaining, SHI1005, flags may be set individually
+ * or in combination.
+ */
+#define SMB2_SHAREFLAG_MANUAL_CACHING			0x00000000
+#define SMB2_SHAREFLAG_AUTO_CACHING			0x00000010
+#define SMB2_SHAREFLAG_VDO_CACHING			0x00000020
+#define SMB2_SHAREFLAG_NO_CACHING			0x00000030
+#define SHI1005_FLAGS_DFS				0x00000001
+#define SHI1005_FLAGS_DFS_ROOT				0x00000002
+#define SHI1005_FLAGS_RESTRICT_EXCLUSIVE_OPENS		0x00000100
+#define SHI1005_FLAGS_FORCE_SHARED_DELETE		0x00000200
+#define SHI1005_FLAGS_ALLOW_NAMESPACE_CACHING		0x00000400
+#define SHI1005_FLAGS_ACCESS_BASED_DIRECTORY_ENUM	0x00000800
+#define SHI1005_FLAGS_FORCE_LEVELII_OPLOCK		0x00001000
+#define SHI1005_FLAGS_ENABLE_HASH			0x00002000
+
+/* Possible share capabilities */
+#define SMB2_SHARE_CAP_DFS	cpu_to_le32(0x00000008)
+
+struct smb2_tree_disconnect_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;	/* Must be 4 */
+	__le16 Reserved;
+} __packed;
+
+struct smb2_tree_disconnect_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;	/* Must be 4 */
+	__le16 Reserved;
+} __packed;
+
+#define ATTR_READONLY_LE	cpu_to_le32(ATTR_READONLY)
+#define ATTR_HIDDEN_LE		cpu_to_le32(ATTR_HIDDEN)
+#define ATTR_SYSTEM_LE		cpu_to_le32(ATTR_SYSTEM)
+#define ATTR_DIRECTORY_LE	cpu_to_le32(ATTR_DIRECTORY)
+#define ATTR_ARCHIVE_LE		cpu_to_le32(ATTR_ARCHIVE)
+#define ATTR_NORMAL_LE		cpu_to_le32(ATTR_NORMAL)
+#define ATTR_TEMPORARY_LE	cpu_to_le32(ATTR_TEMPORARY)
+#define ATTR_SPARSE_FILE_LE	cpu_to_le32(ATTR_SPARSE)
+#define ATTR_REPARSE_POINT_LE	cpu_to_le32(ATTR_REPARSE)
+#define ATTR_COMPRESSED_LE	cpu_to_le32(ATTR_COMPRESSED)
+#define ATTR_OFFLINE_LE		cpu_to_le32(ATTR_OFFLINE)
+#define ATTR_NOT_CONTENT_INDEXED_LE	cpu_to_le32(ATTR_NOT_CONTENT_INDEXED)
+#define ATTR_ENCRYPTED_LE	cpu_to_le32(ATTR_ENCRYPTED)
+#define ATTR_INTEGRITY_STREAML_LE	cpu_to_le32(0x00008000)
+#define ATTR_NO_SCRUB_DATA_LE	cpu_to_le32(0x00020000)
+#define ATTR_MASK_LE		cpu_to_le32(0x00007FB7)
+
+/* Oplock levels */
+#define SMB2_OPLOCK_LEVEL_NONE		0x00
+#define SMB2_OPLOCK_LEVEL_II		0x01
+#define SMB2_OPLOCK_LEVEL_EXCLUSIVE	0x08
+#define SMB2_OPLOCK_LEVEL_BATCH		0x09
+#define SMB2_OPLOCK_LEVEL_LEASE		0xFF
+/* Non-spec internal type */
+#define SMB2_OPLOCK_LEVEL_NOCHANGE	0x99
+
+/* Desired Access Flags */
+#define FILE_READ_DATA_LE		cpu_to_le32(0x00000001)
+#define FILE_LIST_DIRECTORY_LE		cpu_to_le32(0x00000001)
+#define FILE_WRITE_DATA_LE		cpu_to_le32(0x00000002)
+#define FILE_ADD_FILE_LE		cpu_to_le32(0x00000002)
+#define FILE_APPEND_DATA_LE		cpu_to_le32(0x00000004)
+#define FILE_ADD_SUBDIRECTORY_LE	cpu_to_le32(0x00000004)
+#define FILE_READ_EA_LE			cpu_to_le32(0x00000008)
+#define FILE_WRITE_EA_LE		cpu_to_le32(0x00000010)
+#define FILE_EXECUTE_LE			cpu_to_le32(0x00000020)
+#define FILE_TRAVERSE_LE		cpu_to_le32(0x00000020)
+#define FILE_DELETE_CHILD_LE		cpu_to_le32(0x00000040)
+#define FILE_READ_ATTRIBUTES_LE		cpu_to_le32(0x00000080)
+#define FILE_WRITE_ATTRIBUTES_LE	cpu_to_le32(0x00000100)
+#define FILE_DELETE_LE			cpu_to_le32(0x00010000)
+#define FILE_READ_CONTROL_LE		cpu_to_le32(0x00020000)
+#define FILE_WRITE_DAC_LE		cpu_to_le32(0x00040000)
+#define FILE_WRITE_OWNER_LE		cpu_to_le32(0x00080000)
+#define FILE_SYNCHRONIZE_LE		cpu_to_le32(0x00100000)
+#define FILE_ACCESS_SYSTEM_SECURITY_LE	cpu_to_le32(0x01000000)
+#define FILE_MAXIMAL_ACCESS_LE		cpu_to_le32(0x02000000)
+#define FILE_GENERIC_ALL_LE		cpu_to_le32(0x10000000)
+#define FILE_GENERIC_EXECUTE_LE		cpu_to_le32(0x20000000)
+#define FILE_GENERIC_WRITE_LE		cpu_to_le32(0x40000000)
+#define FILE_GENERIC_READ_LE		cpu_to_le32(0x80000000)
+#define DESIRED_ACCESS_MASK		cpu_to_le32(0xF21F01FF)
+
+/* ShareAccess Flags */
+#define FILE_SHARE_READ_LE		cpu_to_le32(0x00000001)
+#define FILE_SHARE_WRITE_LE		cpu_to_le32(0x00000002)
+#define FILE_SHARE_DELETE_LE		cpu_to_le32(0x00000004)
+#define FILE_SHARE_ALL_LE		cpu_to_le32(0x00000007)
+
+/* CreateDisposition Flags */
+#define FILE_SUPERSEDE_LE		cpu_to_le32(0x00000000)
+#define FILE_OPEN_LE			cpu_to_le32(0x00000001)
+#define FILE_CREATE_LE			cpu_to_le32(0x00000002)
+#define	FILE_OPEN_IF_LE			cpu_to_le32(0x00000003)
+#define FILE_OVERWRITE_LE		cpu_to_le32(0x00000004)
+#define FILE_OVERWRITE_IF_LE		cpu_to_le32(0x00000005)
+#define FILE_CREATE_MASK_LE		cpu_to_le32(0x00000007)
+
+#define FILE_READ_DESIRED_ACCESS_LE	(FILE_READ_DATA_LE |		\
+					FILE_READ_EA_LE |		\
+					FILE_GENERIC_READ_LE)
+#define FILE_WRITE_DESIRE_ACCESS_LE	(FILE_WRITE_DATA_LE |		\
+					FILE_APPEND_DATA_LE |		\
+					FILE_WRITE_EA_LE |		\
+					FILE_WRITE_ATTRIBUTES_LE |	\
+					FILE_GENERIC_WRITE_LE)
+
+/* Impersonation Levels */
+#define IL_ANONYMOUS_LE		cpu_to_le32(0x00000000)
+#define IL_IDENTIFICATION_LE	cpu_to_le32(0x00000001)
+#define IL_IMPERSONATION_LE	cpu_to_le32(0x00000002)
+#define IL_DELEGATE_LE		cpu_to_le32(0x00000003)
+
+/* Create Context Values */
+#define SMB2_CREATE_EA_BUFFER			"ExtA" /* extended attributes */
+#define SMB2_CREATE_SD_BUFFER			"SecD" /* security descriptor */
+#define SMB2_CREATE_DURABLE_HANDLE_REQUEST	"DHnQ"
+#define SMB2_CREATE_DURABLE_HANDLE_RECONNECT	"DHnC"
+#define SMB2_CREATE_ALLOCATION_SIZE		"AlSi"
+#define SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST "MxAc"
+#define SMB2_CREATE_TIMEWARP_REQUEST		"TWrp"
+#define SMB2_CREATE_QUERY_ON_DISK_ID		"QFid"
+#define SMB2_CREATE_REQUEST_LEASE		"RqLs"
+#define SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2   "DH2Q"
+#define SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 "DH2C"
+#define SMB2_CREATE_APP_INSTANCE_ID     "\x45\xBC\xA6\x6A\xEF\xA7\xF7\x4A\x90\x08\xFA\x46\x2E\x14\x4D\x74"
+ #define SMB2_CREATE_APP_INSTANCE_VERSION	"\xB9\x82\xD0\xB7\x3B\x56\x07\x4F\xA0\x7B\x52\x4A\x81\x16\xA0\x10"
+#define SVHDX_OPEN_DEVICE_CONTEXT       0x83CE6F1AD851E0986E34401CC9BCFCE9
+#define SMB2_CREATE_TAG_POSIX		"\x93\xAD\x25\x50\x9C\xB4\x11\xE7\xB4\x23\x83\xDE\x96\x8B\xCD\x7C"
+
+struct smb2_create_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;	/* Must be 57 */
+	__u8   SecurityFlags;
+	__u8   RequestedOplockLevel;
+	__le32 ImpersonationLevel;
+	__le64 SmbCreateFlags;
+	__le64 Reserved;
+	__le32 DesiredAccess;
+	__le32 FileAttributes;
+	__le32 ShareAccess;
+	__le32 CreateDisposition;
+	__le32 CreateOptions;
+	__le16 NameOffset;
+	__le16 NameLength;
+	__le32 CreateContextsOffset;
+	__le32 CreateContextsLength;
+	__u8   Buffer[0];
+} __packed;
+
+struct smb2_create_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;	/* Must be 89 */
+	__u8   OplockLevel;
+	__u8   Reserved;
+	__le32 CreateAction;
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le64 AllocationSize;
+	__le64 EndofFile;
+	__le32 FileAttributes;
+	__le32 Reserved2;
+	__le64  PersistentFileId;
+	__le64  VolatileFileId;
+	__le32 CreateContextsOffset;
+	__le32 CreateContextsLength;
+	__u8   Buffer[1];
+} __packed;
+
+struct create_context {
+	__le32 Next;
+	__le16 NameOffset;
+	__le16 NameLength;
+	__le16 Reserved;
+	__le16 DataOffset;
+	__le32 DataLength;
+	__u8 Buffer[0];
+} __packed;
+
+struct create_durable_req_v2 {
+	struct create_context ccontext;
+	__u8   Name[8];
+	__le32 Timeout;
+	__le32 Flags;
+	__u8 Reserved[8];
+	__u8 CreateGuid[16];
+} __packed;
+
+struct create_durable_reconn_req {
+	struct create_context ccontext;
+	__u8   Name[8];
+	union {
+		__u8  Reserved[16];
+		struct {
+			__le64 PersistentFileId;
+			__le64 VolatileFileId;
+		} Fid;
+	} Data;
+} __packed;
+
+struct create_durable_reconn_v2_req {
+	struct create_context ccontext;
+	__u8   Name[8];
+	struct {
+		__le64 PersistentFileId;
+		__le64 VolatileFileId;
+	} Fid;
+	__u8 CreateGuid[16];
+	__le32 Flags;
+} __packed;
+
+struct create_app_inst_id {
+	struct create_context ccontext;
+	__u8 Name[8];
+	__u8 Reserved[8];
+	__u8 AppInstanceId[16];
+} __packed;
+
+struct create_app_inst_id_vers {
+	struct create_context ccontext;
+	__u8 Name[8];
+	__u8 Reserved[2];
+	__u8 Padding[4];
+	__le64 AppInstanceVersionHigh;
+	__le64 AppInstanceVersionLow;
+} __packed;
+
+struct create_mxac_req {
+	struct create_context ccontext;
+	__u8   Name[8];
+	__le64 Timestamp;
+} __packed;
+
+struct create_alloc_size_req {
+	struct create_context ccontext;
+	__u8   Name[8];
+	__le64 AllocationSize;
+} __packed;
+
+struct create_posix {
+	struct create_context ccontext;
+	__u8    Name[16];
+	__le32  Mode;
+	__u32   Reserved;
+} __packed;
+
+struct create_durable_rsp {
+	struct create_context ccontext;
+	__u8   Name[8];
+	union {
+		__u8  Reserved[8];
+		__u64 data;
+	} Data;
+} __packed;
+
+struct create_durable_v2_rsp {
+	struct create_context ccontext;
+	__u8   Name[8];
+	__le32 Timeout;
+	__le32 Flags;
+} __packed;
+
+struct create_mxac_rsp {
+	struct create_context ccontext;
+	__u8   Name[8];
+	__le32 QueryStatus;
+	__le32 MaximalAccess;
+} __packed;
+
+struct create_disk_id_rsp {
+	struct create_context ccontext;
+	__u8   Name[8];
+	__le64 DiskFileId;
+	__le64 VolumeId;
+	__u8  Reserved[16];
+} __packed;
+
+/* equivalent of the contents of SMB3.1.1 POSIX open context response */
+struct create_posix_rsp {
+	struct create_context ccontext;
+	__u8    Name[16];
+	__le32 nlink;
+	__le32 reparse_tag;
+	__le32 mode;
+	u8 SidBuffer[40];
+} __packed;
+
+#define SMB2_LEASE_NONE_LE			cpu_to_le32(0x00)
+#define SMB2_LEASE_READ_CACHING_LE		cpu_to_le32(0x01)
+#define SMB2_LEASE_HANDLE_CACHING_LE		cpu_to_le32(0x02)
+#define SMB2_LEASE_WRITE_CACHING_LE		cpu_to_le32(0x04)
+
+#define SMB2_LEASE_FLAG_BREAK_IN_PROGRESS_LE	cpu_to_le32(0x02)
+
+struct lease_context {
+	__le64 LeaseKeyLow;
+	__le64 LeaseKeyHigh;
+	__le32 LeaseState;
+	__le32 LeaseFlags;
+	__le64 LeaseDuration;
+} __packed;
+
+struct create_lease {
+	struct create_context ccontext;
+	__u8   Name[8];
+	struct lease_context lcontext;
+} __packed;
+
+/* Currently defined values for close flags */
+#define SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB	cpu_to_le16(0x0001)
+struct smb2_close_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;	/* Must be 24 */
+	__le16 Flags;
+	__le32 Reserved;
+	__le64  PersistentFileId;
+	__le64  VolatileFileId;
+} __packed;
+
+struct smb2_close_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* 60 */
+	__le16 Flags;
+	__le32 Reserved;
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le64 AllocationSize;	/* Beginning of FILE_STANDARD_INFO equivalent */
+	__le64 EndOfFile;
+	__le32 Attributes;
+} __packed;
+
+struct smb2_flush_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;	/* Must be 24 */
+	__le16 Reserved1;
+	__le32 Reserved2;
+	__le64  PersistentFileId;
+	__le64  VolatileFileId;
+} __packed;
+
+struct smb2_flush_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;
+	__le16 Reserved;
+} __packed;
+
+struct smb2_buffer_desc_v1 {
+	__le64 offset;
+	__le32 token;
+	__le32 length;
+} __packed;
+
+#define SMB2_CHANNEL_NONE		cpu_to_le32(0x00000000)
+#define SMB2_CHANNEL_RDMA_V1		cpu_to_le32(0x00000001)
+#define SMB2_CHANNEL_RDMA_V1_INVALIDATE cpu_to_le32(0x00000002)
+
+struct smb2_read_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 49 */
+	__u8   Padding; /* offset from start of SMB2 header to place read */
+	__u8   Reserved;
+	__le32 Length;
+	__le64 Offset;
+	__le64  PersistentFileId;
+	__le64  VolatileFileId;
+	__le32 MinimumCount;
+	__le32 Channel; /* Reserved MBZ */
+	__le32 RemainingBytes;
+	__le16 ReadChannelInfoOffset; /* Reserved MBZ */
+	__le16 ReadChannelInfoLength; /* Reserved MBZ */
+	__u8   Buffer[1];
+} __packed;
+
+struct smb2_read_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 17 */
+	__u8   DataOffset;
+	__u8   Reserved;
+	__le32 DataLength;
+	__le32 DataRemaining;
+	__u32  Reserved2;
+	__u8   Buffer[1];
+} __packed;
+
+/* For write request Flags field below the following flag is defined: */
+#define SMB2_WRITEFLAG_WRITE_THROUGH 0x00000001
+
+struct smb2_write_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 49 */
+	__le16 DataOffset; /* offset from start of SMB2 header to write data */
+	__le32 Length;
+	__le64 Offset;
+	__le64  PersistentFileId;
+	__le64  VolatileFileId;
+	__le32 Channel; /* Reserved MBZ */
+	__le32 RemainingBytes;
+	__le16 WriteChannelInfoOffset; /* Reserved MBZ */
+	__le16 WriteChannelInfoLength; /* Reserved MBZ */
+	__le32 Flags;
+	__u8   Buffer[1];
+} __packed;
+
+struct smb2_write_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 17 */
+	__u8   DataOffset;
+	__u8   Reserved;
+	__le32 DataLength;
+	__le32 DataRemaining;
+	__u32  Reserved2;
+	__u8   Buffer[1];
+} __packed;
+
+#define SMB2_0_IOCTL_IS_FSCTL 0x00000001
+
+struct smb2_ioctl_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 57 */
+	__le16 Reserved; /* offset from start of SMB2 header to write data */
+	__le32 CntCode;
+	__le64  PersistentFileId;
+	__le64  VolatileFileId;
+	__le32 InputOffset; /* Reserved MBZ */
+	__le32 InputCount;
+	__le32 MaxInputResponse;
+	__le32 OutputOffset;
+	__le32 OutputCount;
+	__le32 MaxOutputResponse;
+	__le32 Flags;
+	__le32 Reserved2;
+	__u8   Buffer[1];
+} __packed;
+
+struct smb2_ioctl_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 49 */
+	__le16 Reserved; /* offset from start of SMB2 header to write data */
+	__le32 CntCode;
+	__le64  PersistentFileId;
+	__le64  VolatileFileId;
+	__le32 InputOffset; /* Reserved MBZ */
+	__le32 InputCount;
+	__le32 OutputOffset;
+	__le32 OutputCount;
+	__le32 Flags;
+	__le32 Reserved2;
+	__u8   Buffer[1];
+} __packed;
+
+struct validate_negotiate_info_req {
+	__le32 Capabilities;
+	__u8   Guid[SMB2_CLIENT_GUID_SIZE];
+	__le16 SecurityMode;
+	__le16 DialectCount;
+	__le16 Dialects[1]; /* dialect (someday maybe list) client asked for */
+} __packed;
+
+struct validate_negotiate_info_rsp {
+	__le32 Capabilities;
+	__u8   Guid[SMB2_CLIENT_GUID_SIZE];
+	__le16 SecurityMode;
+	__le16 Dialect; /* Dialect in use for the connection */
+} __packed;
+
+struct smb_sockaddr_in {
+	__be16 Port;
+	__be32 IPv4address;
+	__u8 Reserved[8];
+} __packed;
+
+struct smb_sockaddr_in6 {
+	__be16 Port;
+	__be32 FlowInfo;
+	__u8 IPv6address[16];
+	__be32 ScopeId;
+} __packed;
+
+#define INTERNETWORK	0x0002
+#define INTERNETWORKV6	0x0017
+
+struct sockaddr_storage_rsp {
+	__le16 Family;
+	union {
+		struct smb_sockaddr_in addr4;
+		struct smb_sockaddr_in6 addr6;
+	};
+} __packed;
+
+#define RSS_CAPABLE	0x00000001
+#define RDMA_CAPABLE	0x00000002
+
+struct network_interface_info_ioctl_rsp {
+	__le32 Next; /* next interface. zero if this is last one */
+	__le32 IfIndex;
+	__le32 Capability; /* RSS or RDMA Capable */
+	__le32 Reserved;
+	__le64 LinkSpeed;
+	char	SockAddr_Storage[128];
+} __packed;
+
+struct file_object_buf_type1_ioctl_rsp {
+	__u8 ObjectId[16];
+	__u8 BirthVolumeId[16];
+	__u8 BirthObjectId[16];
+	__u8 DomainId[16];
+} __packed;
+
+struct resume_key_ioctl_rsp {
+	__le64 ResumeKey[3];
+	__le32 ContextLength;
+	__u8 Context[4]; /* ignored, Windows sets to 4 bytes of zero */
+} __packed;
+
+struct copychunk_ioctl_req {
+	__le64 ResumeKey[3];
+	__le32 ChunkCount;
+	__le32 Reserved;
+	__u8 Chunks[1]; /* array of srv_copychunk */
+} __packed;
+
+struct srv_copychunk {
+	__le64 SourceOffset;
+	__le64 TargetOffset;
+	__le32 Length;
+	__le32 Reserved;
+} __packed;
+
+struct copychunk_ioctl_rsp {
+	__le32 ChunksWritten;
+	__le32 ChunkBytesWritten;
+	__le32 TotalBytesWritten;
+} __packed;
+
+struct file_sparse {
+	__u8	SetSparse;
+} __packed;
+
+struct file_zero_data_information {
+	__le64	FileOffset;
+	__le64	BeyondFinalZero;
+} __packed;
+
+struct file_allocated_range_buffer {
+	__le64	file_offset;
+	__le64	length;
+} __packed;
+
+struct reparse_data_buffer {
+	__le32	ReparseTag;
+	__le16	ReparseDataLength;
+	__u16	Reserved;
+	__u8	DataBuffer[]; /* Variable Length */
+} __packed;
+
+/* Completion Filter flags for Notify */
+#define FILE_NOTIFY_CHANGE_FILE_NAME	0x00000001
+#define FILE_NOTIFY_CHANGE_DIR_NAME	0x00000002
+#define FILE_NOTIFY_CHANGE_NAME		0x00000003
+#define FILE_NOTIFY_CHANGE_ATTRIBUTES	0x00000004
+#define FILE_NOTIFY_CHANGE_SIZE		0x00000008
+#define FILE_NOTIFY_CHANGE_LAST_WRITE	0x00000010
+#define FILE_NOTIFY_CHANGE_LAST_ACCESS	0x00000020
+#define FILE_NOTIFY_CHANGE_CREATION	0x00000040
+#define FILE_NOTIFY_CHANGE_EA		0x00000080
+#define FILE_NOTIFY_CHANGE_SECURITY	0x00000100
+#define FILE_NOTIFY_CHANGE_STREAM_NAME	0x00000200
+#define FILE_NOTIFY_CHANGE_STREAM_SIZE	0x00000400
+#define FILE_NOTIFY_CHANGE_STREAM_WRITE	0x00000800
+
+/* Flags */
+#define SMB2_WATCH_TREE	0x0001
+
+struct smb2_notify_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 32 */
+	__le16 Flags;
+	__le32 OutputBufferLength;
+	__le64 PersistentFileId;
+	__le64 VolatileFileId;
+	__u32 CompletionFileter;
+	__u32 Reserved;
+} __packed;
+
+struct smb2_notify_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 9 */
+	__le16 OutputBufferOffset;
+	__le32 OutputBufferLength;
+	__u8 Buffer[1];
+} __packed;
+
+/* SMB2 Notify Action Flags */
+#define FILE_ACTION_ADDED		0x00000001
+#define FILE_ACTION_REMOVED		0x00000002
+#define FILE_ACTION_MODIFIED		0x00000003
+#define FILE_ACTION_RENAMED_OLD_NAME	0x00000004
+#define FILE_ACTION_RENAMED_NEW_NAME	0x00000005
+#define FILE_ACTION_ADDED_STREAM	0x00000006
+#define FILE_ACTION_REMOVED_STREAM	0x00000007
+#define FILE_ACTION_MODIFIED_STREAM	0x00000008
+#define FILE_ACTION_REMOVED_BY_DELETE	0x00000009
+
+#define SMB2_LOCKFLAG_SHARED		0x0001
+#define SMB2_LOCKFLAG_EXCLUSIVE		0x0002
+#define SMB2_LOCKFLAG_UNLOCK		0x0004
+#define SMB2_LOCKFLAG_FAIL_IMMEDIATELY	0x0010
+#define SMB2_LOCKFLAG_MASK		0x0007
+
+struct smb2_lock_element {
+	__le64 Offset;
+	__le64 Length;
+	__le32 Flags;
+	__le32 Reserved;
+} __packed;
+
+struct smb2_lock_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 48 */
+	__le16 LockCount;
+	__le32 Reserved;
+	__le64  PersistentFileId;
+	__le64  VolatileFileId;
+	/* Followed by at least one */
+	struct smb2_lock_element locks[1];
+} __packed;
+
+struct smb2_lock_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 4 */
+	__le16 Reserved;
+} __packed;
+
+struct smb2_echo_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;	/* Must be 4 */
+	__u16  Reserved;
+} __packed;
+
+struct smb2_echo_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize;	/* Must be 4 */
+	__u16  Reserved;
+} __packed;
+
+/* search (query_directory) Flags field */
+#define SMB2_RESTART_SCANS		0x01
+#define SMB2_RETURN_SINGLE_ENTRY	0x02
+#define SMB2_INDEX_SPECIFIED		0x04
+#define SMB2_REOPEN			0x10
+
+struct smb2_query_directory_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 33 */
+	__u8   FileInformationClass;
+	__u8   Flags;
+	__le32 FileIndex;
+	__le64  PersistentFileId;
+	__le64  VolatileFileId;
+	__le16 FileNameOffset;
+	__le16 FileNameLength;
+	__le32 OutputBufferLength;
+	__u8   Buffer[1];
+} __packed;
+
+struct smb2_query_directory_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 9 */
+	__le16 OutputBufferOffset;
+	__le32 OutputBufferLength;
+	__u8   Buffer[1];
+} __packed;
+
+/* Possible InfoType values */
+#define SMB2_O_INFO_FILE	0x01
+#define SMB2_O_INFO_FILESYSTEM	0x02
+#define SMB2_O_INFO_SECURITY	0x03
+#define SMB2_O_INFO_QUOTA	0x04
+
+/* Security info type additionalinfo flags. See MS-SMB2 (2.2.37) or MS-DTYP */
+#define OWNER_SECINFO   0x00000001
+#define GROUP_SECINFO   0x00000002
+#define DACL_SECINFO   0x00000004
+#define SACL_SECINFO   0x00000008
+#define LABEL_SECINFO   0x00000010
+#define ATTRIBUTE_SECINFO   0x00000020
+#define SCOPE_SECINFO   0x00000040
+#define BACKUP_SECINFO   0x00010000
+#define UNPROTECTED_SACL_SECINFO   0x10000000
+#define UNPROTECTED_DACL_SECINFO   0x20000000
+#define PROTECTED_SACL_SECINFO   0x40000000
+#define PROTECTED_DACL_SECINFO   0x80000000
+
+struct smb2_query_info_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 41 */
+	__u8   InfoType;
+	__u8   FileInfoClass;
+	__le32 OutputBufferLength;
+	__le16 InputBufferOffset;
+	__u16  Reserved;
+	__le32 InputBufferLength;
+	__le32 AdditionalInformation;
+	__le32 Flags;
+	__le64  PersistentFileId;
+	__le64  VolatileFileId;
+	__u8   Buffer[1];
+} __packed;
+
+struct smb2_query_info_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 9 */
+	__le16 OutputBufferOffset;
+	__le32 OutputBufferLength;
+	__u8   Buffer[1];
+} __packed;
+
+struct smb2_set_info_req {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 33 */
+	__u8   InfoType;
+	__u8   FileInfoClass;
+	__le32 BufferLength;
+	__le16 BufferOffset;
+	__u16  Reserved;
+	__le32 AdditionalInformation;
+	__le64  PersistentFileId;
+	__le64  VolatileFileId;
+	__u8   Buffer[1];
+} __packed;
+
+struct smb2_set_info_rsp {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 2 */
+} __packed;
+
+/* FILE Info response size */
+#define FILE_DIRECTORY_INFORMATION_SIZE       1
+#define FILE_FULL_DIRECTORY_INFORMATION_SIZE  2
+#define FILE_BOTH_DIRECTORY_INFORMATION_SIZE  3
+#define FILE_BASIC_INFORMATION_SIZE           40
+#define FILE_STANDARD_INFORMATION_SIZE        24
+#define FILE_INTERNAL_INFORMATION_SIZE        8
+#define FILE_EA_INFORMATION_SIZE              4
+#define FILE_ACCESS_INFORMATION_SIZE          4
+#define FILE_NAME_INFORMATION_SIZE            9
+#define FILE_RENAME_INFORMATION_SIZE          10
+#define FILE_LINK_INFORMATION_SIZE            11
+#define FILE_NAMES_INFORMATION_SIZE           12
+#define FILE_DISPOSITION_INFORMATION_SIZE     13
+#define FILE_POSITION_INFORMATION_SIZE        14
+#define FILE_FULL_EA_INFORMATION_SIZE         15
+#define FILE_MODE_INFORMATION_SIZE            4
+#define FILE_ALIGNMENT_INFORMATION_SIZE       4
+#define FILE_ALL_INFORMATION_SIZE             104
+#define FILE_ALLOCATION_INFORMATION_SIZE      19
+#define FILE_END_OF_FILE_INFORMATION_SIZE     20
+#define FILE_ALTERNATE_NAME_INFORMATION_SIZE  8
+#define FILE_STREAM_INFORMATION_SIZE          32
+#define FILE_PIPE_INFORMATION_SIZE            23
+#define FILE_PIPE_LOCAL_INFORMATION_SIZE      24
+#define FILE_PIPE_REMOTE_INFORMATION_SIZE     25
+#define FILE_MAILSLOT_QUERY_INFORMATION_SIZE  26
+#define FILE_MAILSLOT_SET_INFORMATION_SIZE    27
+#define FILE_COMPRESSION_INFORMATION_SIZE     16
+#define FILE_OBJECT_ID_INFORMATION_SIZE       29
+/* Number 30 not defined in documents */
+#define FILE_MOVE_CLUSTER_INFORMATION_SIZE    31
+#define FILE_QUOTA_INFORMATION_SIZE           32
+#define FILE_REPARSE_POINT_INFORMATION_SIZE   33
+#define FILE_NETWORK_OPEN_INFORMATION_SIZE    56
+#define FILE_ATTRIBUTE_TAG_INFORMATION_SIZE   8
+
+/* FS Info response  size */
+#define FS_DEVICE_INFORMATION_SIZE     8
+#define FS_ATTRIBUTE_INFORMATION_SIZE  16
+#define FS_VOLUME_INFORMATION_SIZE     24
+#define FS_SIZE_INFORMATION_SIZE       24
+#define FS_FULL_SIZE_INFORMATION_SIZE  32
+#define FS_SECTOR_SIZE_INFORMATION_SIZE 28
+#define FS_OBJECT_ID_INFORMATION_SIZE 64
+#define FS_CONTROL_INFORMATION_SIZE 48
+#define FS_POSIX_INFORMATION_SIZE 56
+
+/* FS_ATTRIBUTE_File_System_Name */
+#define FS_TYPE_SUPPORT_SIZE   44
+struct fs_type_info {
+	char		*fs_name;
+	long		magic_number;
+} __packed;
+
+struct smb2_oplock_break {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 24 */
+	__u8   OplockLevel;
+	__u8   Reserved;
+	__le32 Reserved2;
+	__le64  PersistentFid;
+	__le64  VolatileFid;
+} __packed;
+
+#define SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED cpu_to_le32(0x01)
+
+struct smb2_lease_break {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 44 */
+	__le16 Reserved;
+	__le32 Flags;
+	__u8   LeaseKey[16];
+	__le32 CurrentLeaseState;
+	__le32 NewLeaseState;
+	__le32 BreakReason;
+	__le32 AccessMaskHint;
+	__le32 ShareMaskHint;
+} __packed;
+
+struct smb2_lease_ack {
+	struct smb2_hdr hdr;
+	__le16 StructureSize; /* Must be 36 */
+	__le16 Reserved;
+	__le32 Flags;
+	__u8   LeaseKey[16];
+	__le32 LeaseState;
+	__le64 LeaseDuration;
+} __packed;
+
+/*
+ *	PDU infolevel structure definitions
+ *	BB consider moving to a different header
+ */
+
+/* File System Information Classes */
+#define FS_VOLUME_INFORMATION		1 /* Query */
+#define FS_LABEL_INFORMATION		2 /* Set */
+#define FS_SIZE_INFORMATION		3 /* Query */
+#define FS_DEVICE_INFORMATION		4 /* Query */
+#define FS_ATTRIBUTE_INFORMATION	5 /* Query */
+#define FS_CONTROL_INFORMATION		6 /* Query, Set */
+#define FS_FULL_SIZE_INFORMATION	7 /* Query */
+#define FS_OBJECT_ID_INFORMATION	8 /* Query, Set */
+#define FS_DRIVER_PATH_INFORMATION	9 /* Query */
+#define FS_SECTOR_SIZE_INFORMATION	11 /* SMB3 or later. Query */
+#define FS_POSIX_INFORMATION		100 /* SMB3.1.1 POSIX. Query */
+
+struct smb2_fs_full_size_info {
+	__le64 TotalAllocationUnits;
+	__le64 CallerAvailableAllocationUnits;
+	__le64 ActualAvailableAllocationUnits;
+	__le32 SectorsPerAllocationUnit;
+	__le32 BytesPerSector;
+} __packed;
+
+#define SSINFO_FLAGS_ALIGNED_DEVICE		0x00000001
+#define SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE 0x00000002
+#define SSINFO_FLAGS_NO_SEEK_PENALTY		0x00000004
+#define SSINFO_FLAGS_TRIM_ENABLED		0x00000008
+
+/* sector size info struct */
+struct smb3_fs_ss_info {
+	__le32 LogicalBytesPerSector;
+	__le32 PhysicalBytesPerSectorForAtomicity;
+	__le32 PhysicalBytesPerSectorForPerf;
+	__le32 FSEffPhysicalBytesPerSectorForAtomicity;
+	__le32 Flags;
+	__le32 ByteOffsetForSectorAlignment;
+	__le32 ByteOffsetForPartitionAlignment;
+} __packed;
+
+/* File System Control Information */
+struct smb2_fs_control_info {
+	__le64 FreeSpaceStartFiltering;
+	__le64 FreeSpaceThreshold;
+	__le64 FreeSpaceStopFiltering;
+	__le64 DefaultQuotaThreshold;
+	__le64 DefaultQuotaLimit;
+	__le32 FileSystemControlFlags;
+	__le32 Padding;
+} __packed;
+
+/* partial list of QUERY INFO levels */
+#define FILE_DIRECTORY_INFORMATION	1
+#define FILE_FULL_DIRECTORY_INFORMATION 2
+#define FILE_BOTH_DIRECTORY_INFORMATION 3
+#define FILE_BASIC_INFORMATION		4
+#define FILE_STANDARD_INFORMATION	5
+#define FILE_INTERNAL_INFORMATION	6
+#define FILE_EA_INFORMATION	        7
+#define FILE_ACCESS_INFORMATION		8
+#define FILE_NAME_INFORMATION		9
+#define FILE_RENAME_INFORMATION		10
+#define FILE_LINK_INFORMATION		11
+#define FILE_NAMES_INFORMATION		12
+#define FILE_DISPOSITION_INFORMATION	13
+#define FILE_POSITION_INFORMATION	14
+#define FILE_FULL_EA_INFORMATION	15
+#define FILE_MODE_INFORMATION		16
+#define FILE_ALIGNMENT_INFORMATION	17
+#define FILE_ALL_INFORMATION		18
+#define FILE_ALLOCATION_INFORMATION	19
+#define FILE_END_OF_FILE_INFORMATION	20
+#define FILE_ALTERNATE_NAME_INFORMATION 21
+#define FILE_STREAM_INFORMATION		22
+#define FILE_PIPE_INFORMATION		23
+#define FILE_PIPE_LOCAL_INFORMATION	24
+#define FILE_PIPE_REMOTE_INFORMATION	25
+#define FILE_MAILSLOT_QUERY_INFORMATION 26
+#define FILE_MAILSLOT_SET_INFORMATION	27
+#define FILE_COMPRESSION_INFORMATION	28
+#define FILE_OBJECT_ID_INFORMATION	29
+/* Number 30 not defined in documents */
+#define FILE_MOVE_CLUSTER_INFORMATION	31
+#define FILE_QUOTA_INFORMATION		32
+#define FILE_REPARSE_POINT_INFORMATION	33
+#define FILE_NETWORK_OPEN_INFORMATION	34
+#define FILE_ATTRIBUTE_TAG_INFORMATION	35
+#define FILE_TRACKING_INFORMATION	36
+#define FILEID_BOTH_DIRECTORY_INFORMATION 37
+#define FILEID_FULL_DIRECTORY_INFORMATION 38
+#define FILE_VALID_DATA_LENGTH_INFORMATION 39
+#define FILE_SHORT_NAME_INFORMATION	40
+#define FILE_SFIO_RESERVE_INFORMATION	44
+#define FILE_SFIO_VOLUME_INFORMATION	45
+#define FILE_HARD_LINK_INFORMATION	46
+#define FILE_NORMALIZED_NAME_INFORMATION 48
+#define FILEID_GLOBAL_TX_DIRECTORY_INFORMATION 50
+#define FILE_STANDARD_LINK_INFORMATION	54
+
+#define OP_BREAK_STRUCT_SIZE_20		24
+#define OP_BREAK_STRUCT_SIZE_21		36
+
+struct smb2_file_access_info {
+	__le32 AccessFlags;
+} __packed;
+
+struct smb2_file_alignment_info {
+	__le32 AlignmentRequirement;
+} __packed;
+
+struct smb2_file_internal_info {
+	__le64 IndexNumber;
+} __packed; /* level 6 Query */
+
+struct smb2_file_rename_info { /* encoding of request for level 10 */
+	__u8   ReplaceIfExists; /* 1 = replace existing target with new */
+				/* 0 = fail if target already exists */
+	__u8   Reserved[7];
+	__u64  RootDirectory;  /* MBZ for network operations (why says spec?) */
+	__le32 FileNameLength;
+	char   FileName[0];     /* New name to be assigned */
+} __packed; /* level 10 Set */
+
+struct smb2_file_link_info { /* encoding of request for level 11 */
+	__u8   ReplaceIfExists; /* 1 = replace existing link with new */
+				/* 0 = fail if link already exists */
+	__u8   Reserved[7];
+	__u64  RootDirectory;  /* MBZ for network operations (why says spec?) */
+	__le32 FileNameLength;
+	char   FileName[0];     /* Name to be assigned to new link */
+} __packed; /* level 11 Set */
+
+/*
+ * This level 18, although with struct with same name is different from cifs
+ * level 0x107. Level 0x107 has an extra u64 between AccessFlags and
+ * CurrentByteOffset.
+ */
+struct smb2_file_all_info { /* data block encoding of response to level 18 */
+	__le64 CreationTime;	/* Beginning of FILE_BASIC_INFO equivalent */
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le32 Attributes;
+	__u32  Pad1;		/* End of FILE_BASIC_INFO_INFO equivalent */
+	__le64 AllocationSize;	/* Beginning of FILE_STANDARD_INFO equivalent */
+	__le64 EndOfFile;	/* size ie offset to first free byte in file */
+	__le32 NumberOfLinks;	/* hard links */
+	__u8   DeletePending;
+	__u8   Directory;
+	__u16  Pad2;		/* End of FILE_STANDARD_INFO equivalent */
+	__le64 IndexNumber;
+	__le32 EASize;
+	__le32 AccessFlags;
+	__le64 CurrentByteOffset;
+	__le32 Mode;
+	__le32 AlignmentRequirement;
+	__le32 FileNameLength;
+	char   FileName[1];
+} __packed; /* level 18 Query */
+
+struct smb2_file_alt_name_info {
+	__le32 FileNameLength;
+	char FileName[0];
+} __packed;
+
+struct smb2_file_stream_info {
+	__le32  NextEntryOffset;
+	__le32  StreamNameLength;
+	__le64 StreamSize;
+	__le64 StreamAllocationSize;
+	char   StreamName[0];
+} __packed;
+
+struct smb2_file_eof_info { /* encoding of request for level 10 */
+	__le64 EndOfFile; /* new end of file value */
+} __packed; /* level 20 Set */
+
+struct smb2_file_ntwrk_info {
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le64 AllocationSize;
+	__le64 EndOfFile;
+	__le32 Attributes;
+	__le32 Reserved;
+} __packed;
+
+struct smb2_file_standard_info {
+	__le64 AllocationSize;
+	__le64 EndOfFile;
+	__le32 NumberOfLinks;	/* hard links */
+	__u8   DeletePending;
+	__u8   Directory;
+	__le16 Reserved;
+} __packed; /* level 18 Query */
+
+struct smb2_file_ea_info {
+	__le32 EASize;
+} __packed;
+
+struct smb2_file_alloc_info {
+	__le64 AllocationSize;
+} __packed;
+
+struct smb2_file_disposition_info {
+	__u8 DeletePending;
+} __packed;
+
+struct smb2_file_pos_info {
+	__le64 CurrentByteOffset;
+} __packed;
+
+#define FILE_MODE_INFO_MASK cpu_to_le32(0x0000103e)
+
+struct smb2_file_mode_info {
+	__le32 Mode;
+} __packed;
+
+#define COMPRESSION_FORMAT_NONE 0x0000
+#define COMPRESSION_FORMAT_LZNT1 0x0002
+
+struct smb2_file_comp_info {
+	__le64 CompressedFileSize;
+	__le16 CompressionFormat;
+	__u8 CompressionUnitShift;
+	__u8 ChunkShift;
+	__u8 ClusterShift;
+	__u8 Reserved[3];
+} __packed;
+
+struct smb2_file_attr_tag_info {
+	__le32 FileAttributes;
+	__le32 ReparseTag;
+} __packed;
+
+#define SL_RESTART_SCAN	0x00000001
+#define SL_RETURN_SINGLE_ENTRY	0x00000002
+#define SL_INDEX_SPECIFIED	0x00000004
+
+struct smb2_ea_info_req {
+	__le32 NextEntryOffset;
+	__u8   EaNameLength;
+	char name[1];
+} __packed; /* level 15 Query */
+
+struct smb2_ea_info {
+	__le32 NextEntryOffset;
+	__u8   Flags;
+	__u8   EaNameLength;
+	__le16 EaValueLength;
+	char name[1];
+	/* optionally followed by value */
+} __packed; /* level 15 Query */
+
+struct create_ea_buf_req {
+	struct create_context ccontext;
+	__u8   Name[8];
+	struct smb2_ea_info ea;
+} __packed;
+
+struct create_sd_buf_req {
+	struct create_context ccontext;
+	__u8   Name[8];
+	struct smb_ntsd ntsd;
+} __packed;
+
+/* Find File infolevels */
+#define SMB_FIND_FILE_POSIX_INFO	0x064
+
+/* Level 100 query info */
+struct smb311_posix_qinfo {
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le64 EndOfFile;
+	__le64 AllocationSize;
+	__le32 DosAttributes;
+	__le64 Inode;
+	__le32 DeviceId;
+	__le32 Zero;
+	/* beginning of POSIX Create Context Response */
+	__le32 HardLinks;
+	__le32 ReparseTag;
+	__le32 Mode;
+	u8     Sids[];
+	/*
+	 * var sized owner SID
+	 * var sized group SID
+	 * le32 filenamelength
+	 * u8  filename[]
+	 */
+} __packed;
+
+struct smb2_posix_info {
+	__le32 NextEntryOffset;
+	__u32 Ignored;
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le64 EndOfFile;
+	__le64 AllocationSize;
+	__le32 DosAttributes;
+	__le64 Inode;
+	__le32 DeviceId;
+	__le32 Zero;
+	/* beginning of POSIX Create Context Response */
+	__le32 HardLinks;
+	__le32 ReparseTag;
+	__le32 Mode;
+	u8 SidBuffer[40];
+	__le32 name_len;
+	u8 name[1];
+	/*
+	 * var sized owner SID
+	 * var sized group SID
+	 * le32 filenamelength
+	 * u8  filename[]
+	 */
+} __packed;
+
+/* functions */
+int init_smb2_0_server(struct ksmbd_conn *conn);
+void init_smb2_1_server(struct ksmbd_conn *conn);
+void init_smb3_0_server(struct ksmbd_conn *conn);
+void init_smb3_02_server(struct ksmbd_conn *conn);
+int init_smb3_11_server(struct ksmbd_conn *conn);
+
+void init_smb2_max_read_size(unsigned int sz);
+void init_smb2_max_write_size(unsigned int sz);
+void init_smb2_max_trans_size(unsigned int sz);
+
+int is_smb2_neg_cmd(struct ksmbd_work *work);
+int is_smb2_rsp(struct ksmbd_work *work);
+
+u16 get_smb2_cmd_val(struct ksmbd_work *work);
+void set_smb2_rsp_status(struct ksmbd_work *work, __le32 err);
+int init_smb2_rsp_hdr(struct ksmbd_work *work);
+int smb2_allocate_rsp_buf(struct ksmbd_work *work);
+bool is_chained_smb2_message(struct ksmbd_work *work);
+int init_smb2_neg_rsp(struct ksmbd_work *work);
+void smb2_set_err_rsp(struct ksmbd_work *work);
+int smb2_check_user_session(struct ksmbd_work *work);
+int smb2_get_ksmbd_tcon(struct ksmbd_work *work);
+bool smb2_is_sign_req(struct ksmbd_work *work, unsigned int command);
+int smb2_check_sign_req(struct ksmbd_work *work);
+void smb2_set_sign_rsp(struct ksmbd_work *work);
+int smb3_check_sign_req(struct ksmbd_work *work);
+void smb3_set_sign_rsp(struct ksmbd_work *work);
+int find_matching_smb2_dialect(int start_index, __le16 *cli_dialects,
+		__le16 dialects_count);
+struct file_lock *smb_flock_init(struct file *f);
+int setup_async_work(struct ksmbd_work *work, void (*fn)(void **),
+		void **arg);
+void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status);
+struct channel *lookup_chann_list(struct ksmbd_session *sess);
+void smb3_preauth_hash_rsp(struct ksmbd_work *work);
+int smb3_is_transform_hdr(void *buf);
+int smb3_decrypt_req(struct ksmbd_work *work);
+int smb3_encrypt_resp(struct ksmbd_work *work);
+bool smb3_11_final_sess_setup_resp(struct ksmbd_work *work);
+int smb2_set_rsp_credits(struct ksmbd_work *work);
+
+/* smb2 misc functions */
+int ksmbd_smb2_check_message(struct ksmbd_work *work);
+
+/* smb2 command handlers */
+int smb2_handle_negotiate(struct ksmbd_work *work);
+int smb2_negotiate_request(struct ksmbd_work *work);
+int smb2_sess_setup(struct ksmbd_work *work);
+int smb2_tree_connect(struct ksmbd_work *work);
+int smb2_tree_disconnect(struct ksmbd_work *work);
+int smb2_session_logoff(struct ksmbd_work *work);
+int smb2_open(struct ksmbd_work *work);
+int smb2_query_info(struct ksmbd_work *work);
+int smb2_query_dir(struct ksmbd_work *work);
+int smb2_close(struct ksmbd_work *work);
+int smb2_echo(struct ksmbd_work *work);
+int smb2_set_info(struct ksmbd_work *work);
+int smb2_read(struct ksmbd_work *work);
+int smb2_write(struct ksmbd_work *work);
+int smb2_flush(struct ksmbd_work *work);
+int smb2_cancel(struct ksmbd_work *work);
+int smb2_lock(struct ksmbd_work *work);
+int smb2_ioctl(struct ksmbd_work *work);
+int smb2_oplock_break(struct ksmbd_work *work);
+int smb2_notify(struct ksmbd_work *ksmbd_work);
+
+#endif	/* _SMB2PDU_H */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smbacl.c linux-5.4.60-fbx/fs/cifsd/smbacl.c
--- linux-5.4.60-fbx/fs/cifsd./smbacl.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smbacl.c	2021-04-21 10:06:25.188514159 +0200
@@ -0,0 +1,1317 @@
+// SPDX-License-Identifier: LGPL-2.1+
+/*
+ *   Copyright (C) International Business Machines  Corp., 2007,2008
+ *   Author(s): Steve French (sfrench@us.ibm.com)
+ *   Copyright (C) 2020 Samsung Electronics Co., Ltd.
+ *   Author(s): Namjae Jeon <linkinjeon@kernel.org>
+ */
+
+#include <linux/fs.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+
+#include "smbacl.h"
+#include "smb_common.h"
+#include "server.h"
+#include "misc.h"
+#include "ksmbd_server.h"
+#include "mgmt/share_config.h"
+
+static const struct smb_sid domain = {1, 4, {0, 0, 0, 0, 0, 5},
+	{cpu_to_le32(21), cpu_to_le32(1), cpu_to_le32(2), cpu_to_le32(3),
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
+
+/* security id for everyone/world system group */
+static const struct smb_sid creator_owner = {
+	1, 1, {0, 0, 0, 0, 0, 3}, {0} };
+/* security id for everyone/world system group */
+static const struct smb_sid creator_group = {
+	1, 1, {0, 0, 0, 0, 0, 3}, {cpu_to_le32(1)} };
+
+/* security id for everyone/world system group */
+static const struct smb_sid sid_everyone = {
+	1, 1, {0, 0, 0, 0, 0, 1}, {0} };
+/* security id for Authenticated Users system group */
+static const struct smb_sid sid_authusers = {
+	1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11)} };
+
+/* S-1-22-1 Unmapped Unix users */
+static const struct smb_sid sid_unix_users = {1, 1, {0, 0, 0, 0, 0, 22},
+		{cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
+
+/* S-1-22-2 Unmapped Unix groups */
+static const struct smb_sid sid_unix_groups = { 1, 1, {0, 0, 0, 0, 0, 22},
+		{cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
+
+/*
+ * See http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx
+ */
+
+/* S-1-5-88 MS NFS and Apple style UID/GID/mode */
+
+/* S-1-5-88-1 Unix uid */
+static const struct smb_sid sid_unix_NFS_users = { 1, 2, {0, 0, 0, 0, 0, 5},
+	{cpu_to_le32(88),
+	 cpu_to_le32(1), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
+
+/* S-1-5-88-2 Unix gid */
+static const struct smb_sid sid_unix_NFS_groups = { 1, 2, {0, 0, 0, 0, 0, 5},
+	{cpu_to_le32(88),
+	 cpu_to_le32(2), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
+
+/* S-1-5-88-3 Unix mode */
+static const struct smb_sid sid_unix_NFS_mode = { 1, 2, {0, 0, 0, 0, 0, 5},
+	{cpu_to_le32(88),
+	 cpu_to_le32(3), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} };
+
+/*
+ * if the two SIDs (roughly equivalent to a UUID for a user or group) are
+ * the same returns zero, if they do not match returns non-zero.
+ */
+int compare_sids(const struct smb_sid *ctsid, const struct smb_sid *cwsid)
+{
+	int i;
+	int num_subauth, num_sat, num_saw;
+
+	if (!ctsid || !cwsid)
+		return 1;
+
+	/* compare the revision */
+	if (ctsid->revision != cwsid->revision) {
+		if (ctsid->revision > cwsid->revision)
+			return 1;
+		else
+			return -1;
+	}
+
+	/* compare all of the six auth values */
+	for (i = 0; i < NUM_AUTHS; ++i) {
+		if (ctsid->authority[i] != cwsid->authority[i]) {
+			if (ctsid->authority[i] > cwsid->authority[i])
+				return 1;
+			else
+				return -1;
+		}
+	}
+
+	/* compare all of the subauth values if any */
+	num_sat = ctsid->num_subauth;
+	num_saw = cwsid->num_subauth;
+	num_subauth = num_sat < num_saw ? num_sat : num_saw;
+	if (num_subauth) {
+		for (i = 0; i < num_subauth; ++i) {
+			if (ctsid->sub_auth[i] != cwsid->sub_auth[i]) {
+				if (le32_to_cpu(ctsid->sub_auth[i]) >
+				    le32_to_cpu(cwsid->sub_auth[i]))
+					return 1;
+				else
+					return -1;
+			}
+		}
+	}
+
+	return 0; /* sids compare/match */
+}
+
+static void smb_copy_sid(struct smb_sid *dst, const struct smb_sid *src)
+{
+	int i;
+
+	dst->revision = src->revision;
+	dst->num_subauth = min_t(u8, src->num_subauth, SID_MAX_SUB_AUTHORITIES);
+	for (i = 0; i < NUM_AUTHS; ++i)
+		dst->authority[i] = src->authority[i];
+	for (i = 0; i < dst->num_subauth; ++i)
+		dst->sub_auth[i] = src->sub_auth[i];
+}
+
+/*
+ * change posix mode to reflect permissions
+ * pmode is the existing mode (we only want to overwrite part of this
+ * bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
+ */
+static umode_t access_flags_to_mode(struct smb_fattr *fattr, __le32 ace_flags,
+		int type)
+{
+	__u32 flags = le32_to_cpu(ace_flags);
+	umode_t mode = 0;
+
+	if (flags & GENERIC_ALL) {
+		mode = 0777;
+		ksmbd_debug(SMB, "all perms\n");
+		return mode;
+	}
+
+	if ((flags & GENERIC_READ) || (flags & FILE_READ_RIGHTS))
+		mode = 0444;
+	if ((flags & GENERIC_WRITE) || (flags & FILE_WRITE_RIGHTS)) {
+		mode |= 0222;
+		if (S_ISDIR(fattr->cf_mode))
+			mode |= 0111;
+	}
+	if ((flags & GENERIC_EXECUTE) || (flags & FILE_EXEC_RIGHTS))
+		mode |= 0111;
+
+	if (type == ACCESS_DENIED_ACE_TYPE || type == ACCESS_DENIED_OBJECT_ACE_TYPE)
+		mode = ~mode;
+
+	ksmbd_debug(SMB, "access flags 0x%x mode now %04o\n", flags, mode);
+
+	return mode;
+}
+
+/*
+ * Generate access flags to reflect permissions mode is the existing mode.
+ * This function is called for every ACE in the DACL whose SID matches
+ * with either owner or group or everyone.
+ */
+static void mode_to_access_flags(umode_t mode, umode_t bits_to_use,
+		__u32 *pace_flags)
+{
+	/* reset access mask */
+	*pace_flags = 0x0;
+
+	/* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */
+	mode &= bits_to_use;
+
+	/*
+	 * check for R/W/X UGO since we do not know whose flags
+	 * is this but we have cleared all the bits sans RWX for
+	 * either user or group or other as per bits_to_use
+	 */
+	if (mode & 0444)
+		*pace_flags |= SET_FILE_READ_RIGHTS;
+	if (mode & 0222)
+		*pace_flags |= FILE_WRITE_RIGHTS;
+	if (mode & 0111)
+		*pace_flags |= SET_FILE_EXEC_RIGHTS;
+
+	ksmbd_debug(SMB, "mode: %o, access flags now 0x%x\n",
+		 mode, *pace_flags);
+}
+
+static __u16 fill_ace_for_sid(struct smb_ace *pntace,
+		const struct smb_sid *psid, int type, int flags,
+		umode_t mode, umode_t bits)
+{
+	int i;
+	__u16 size = 0;
+	__u32 access_req = 0;
+
+	pntace->type = type;
+	pntace->flags = flags;
+	mode_to_access_flags(mode, bits, &access_req);
+	if (!access_req)
+		access_req = SET_MINIMUM_RIGHTS;
+	pntace->access_req = cpu_to_le32(access_req);
+
+	pntace->sid.revision = psid->revision;
+	pntace->sid.num_subauth = psid->num_subauth;
+	for (i = 0; i < NUM_AUTHS; i++)
+		pntace->sid.authority[i] = psid->authority[i];
+	for (i = 0; i < psid->num_subauth; i++)
+		pntace->sid.sub_auth[i] = psid->sub_auth[i];
+
+	size = 1 + 1 + 2 + 4 + 1 + 1 + 6 + (psid->num_subauth * 4);
+	pntace->size = cpu_to_le16(size);
+
+	return size;
+}
+
+void id_to_sid(unsigned int cid, uint sidtype, struct smb_sid *ssid)
+{
+	switch (sidtype) {
+	case SIDOWNER:
+		smb_copy_sid(ssid, &server_conf.domain_sid);
+		break;
+	case SIDUNIX_USER:
+		smb_copy_sid(ssid, &sid_unix_users);
+		break;
+	case SIDUNIX_GROUP:
+		smb_copy_sid(ssid, &sid_unix_groups);
+		break;
+	case SIDCREATOR_OWNER:
+		smb_copy_sid(ssid, &creator_owner);
+		return;
+	case SIDCREATOR_GROUP:
+		smb_copy_sid(ssid, &creator_group);
+		return;
+	case SIDNFS_USER:
+		smb_copy_sid(ssid, &sid_unix_NFS_users);
+		break;
+	case SIDNFS_GROUP:
+		smb_copy_sid(ssid, &sid_unix_NFS_groups);
+		break;
+	case SIDNFS_MODE:
+		smb_copy_sid(ssid, &sid_unix_NFS_mode);
+		break;
+	default:
+		return;
+	}
+
+	/* RID */
+	ssid->sub_auth[ssid->num_subauth] = cpu_to_le32(cid);
+	ssid->num_subauth++;
+}
+
+static int sid_to_id(struct smb_sid *psid, uint sidtype,
+		struct smb_fattr *fattr)
+{
+	int rc = -EINVAL;
+
+	/*
+	 * If we have too many subauthorities, then something is really wrong.
+	 * Just return an error.
+	 */
+	if (unlikely(psid->num_subauth > SID_MAX_SUB_AUTHORITIES)) {
+		ksmbd_err("%s: %u subauthorities is too many!\n",
+			 __func__, psid->num_subauth);
+		return -EIO;
+	}
+
+	if (sidtype == SIDOWNER) {
+		kuid_t uid;
+		uid_t id;
+
+		id = le32_to_cpu(psid->sub_auth[psid->num_subauth - 1]);
+		if (id > 0) {
+			uid = make_kuid(&init_user_ns, id);
+			if (uid_valid(uid) && kuid_has_mapping(&init_user_ns, uid)) {
+				fattr->cf_uid = uid;
+				rc = 0;
+			}
+		}
+	} else {
+		kgid_t gid;
+		gid_t id;
+
+		id = le32_to_cpu(psid->sub_auth[psid->num_subauth - 1]);
+		if (id > 0) {
+			gid = make_kgid(&init_user_ns, id);
+			if (gid_valid(gid) && kgid_has_mapping(&init_user_ns, gid)) {
+				fattr->cf_gid = gid;
+				rc = 0;
+			}
+		}
+	}
+
+	return rc;
+}
+
+void posix_state_to_acl(struct posix_acl_state *state,
+		struct posix_acl_entry *pace)
+{
+	int i;
+
+	pace->e_tag = ACL_USER_OBJ;
+	pace->e_perm = state->owner.allow;
+	for (i = 0; i < state->users->n; i++) {
+		pace++;
+		pace->e_tag = ACL_USER;
+		pace->e_uid = state->users->aces[i].uid;
+		pace->e_perm = state->users->aces[i].perms.allow;
+	}
+
+	pace++;
+	pace->e_tag = ACL_GROUP_OBJ;
+	pace->e_perm = state->group.allow;
+
+	for (i = 0; i < state->groups->n; i++) {
+		pace++;
+		pace->e_tag = ACL_GROUP;
+		pace->e_gid = state->groups->aces[i].gid;
+		pace->e_perm = state->groups->aces[i].perms.allow;
+	}
+
+	if (state->users->n || state->groups->n) {
+		pace++;
+		pace->e_tag = ACL_MASK;
+		pace->e_perm = state->mask.allow;
+	}
+
+	pace++;
+	pace->e_tag = ACL_OTHER;
+	pace->e_perm = state->other.allow;
+}
+
+int init_acl_state(struct posix_acl_state *state, int cnt)
+{
+	int alloc;
+
+	memset(state, 0, sizeof(struct posix_acl_state));
+	/*
+	 * In the worst case, each individual acl could be for a distinct
+	 * named user or group, but we don't know which, so we allocate
+	 * enough space for either:
+	 */
+	alloc = sizeof(struct posix_ace_state_array)
+		+ cnt * sizeof(struct posix_user_ace_state);
+	state->users = kzalloc(alloc, GFP_KERNEL);
+	if (!state->users)
+		return -ENOMEM;
+	state->groups = kzalloc(alloc, GFP_KERNEL);
+	if (!state->groups) {
+		kfree(state->users);
+		return -ENOMEM;
+	}
+	return 0;
+}
+
+void free_acl_state(struct posix_acl_state *state)
+{
+	kfree(state->users);
+	kfree(state->groups);
+}
+
+static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl,
+		struct smb_sid *pownersid, struct smb_sid *pgrpsid,
+		struct smb_fattr *fattr)
+{
+	int i, ret;
+	int num_aces = 0;
+	int acl_size;
+	char *acl_base;
+	struct smb_ace **ppace;
+	struct posix_acl_entry *cf_pace, *cf_pdace;
+	struct posix_acl_state acl_state, default_acl_state;
+	umode_t mode = 0, acl_mode;
+	bool owner_found = false, group_found = false, others_found = false;
+
+	if (!pdacl)
+		return;
+
+	/* validate that we do not go past end of acl */
+	if (end_of_acl <= (char *)pdacl ||
+	    end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
+		ksmbd_err("ACL too small to parse DACL\n");
+		return;
+	}
+
+	ksmbd_debug(SMB, "DACL revision %d size %d num aces %d\n",
+		 le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size),
+		 le32_to_cpu(pdacl->num_aces));
+
+	acl_base = (char *)pdacl;
+	acl_size = sizeof(struct smb_acl);
+
+	num_aces = le32_to_cpu(pdacl->num_aces);
+	if (num_aces <= 0)
+		return;
+
+	if (num_aces > ULONG_MAX / sizeof(struct smb_ace *))
+		return;
+
+	ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *),
+			GFP_KERNEL);
+	if (!ppace)
+		return;
+
+	ret = init_acl_state(&acl_state, num_aces);
+	if (ret)
+		return;
+	ret = init_acl_state(&default_acl_state, num_aces);
+	if (ret) {
+		free_acl_state(&acl_state);
+		return;
+	}
+
+	/*
+	 * reset rwx permissions for user/group/other.
+	 * Also, if num_aces is 0 i.e. DACL has no ACEs,
+	 * user/group/other have no permissions
+	 */
+	for (i = 0; i < num_aces; ++i) {
+		ppace[i] = (struct smb_ace *)(acl_base + acl_size);
+		acl_base = (char *)ppace[i];
+		acl_size = le16_to_cpu(ppace[i]->size);
+		ppace[i]->access_req =
+			smb_map_generic_desired_access(ppace[i]->access_req);
+
+		if (!(compare_sids(&ppace[i]->sid, &sid_unix_NFS_mode))) {
+			fattr->cf_mode =
+				le32_to_cpu(ppace[i]->sid.sub_auth[2]);
+			break;
+		} else if (!compare_sids(&ppace[i]->sid, pownersid)) {
+			acl_mode = access_flags_to_mode(fattr,
+				ppace[i]->access_req, ppace[i]->type);
+			acl_mode &= 0700;
+
+			if (!owner_found) {
+				mode &= ~(0700);
+				mode |= acl_mode;
+			}
+			owner_found = true;
+		} else if (!compare_sids(&ppace[i]->sid, pgrpsid) ||
+			   ppace[i]->sid.sub_auth[ppace[i]->sid.num_subauth - 1] ==
+			    DOMAIN_USER_RID_LE) {
+			acl_mode = access_flags_to_mode(fattr,
+				ppace[i]->access_req, ppace[i]->type);
+			acl_mode &= 0070;
+			if (!group_found) {
+				mode &= ~(0070);
+				mode |= acl_mode;
+			}
+			group_found = true;
+		} else if (!compare_sids(&ppace[i]->sid, &sid_everyone)) {
+			acl_mode = access_flags_to_mode(fattr,
+				ppace[i]->access_req, ppace[i]->type);
+			acl_mode &= 0007;
+			if (!others_found) {
+				mode &= ~(0007);
+				mode |= acl_mode;
+			}
+			others_found = true;
+		} else if (!compare_sids(&ppace[i]->sid, &creator_owner)) {
+			continue;
+		} else if (!compare_sids(&ppace[i]->sid, &creator_group)) {
+			continue;
+		} else if (!compare_sids(&ppace[i]->sid, &sid_authusers)) {
+			continue;
+		} else {
+			struct smb_fattr temp_fattr;
+
+			acl_mode = access_flags_to_mode(fattr, ppace[i]->access_req,
+					ppace[i]->type);
+			temp_fattr.cf_uid = INVALID_UID;
+			ret = sid_to_id(&ppace[i]->sid, SIDOWNER, &temp_fattr);
+			if (ret || uid_eq(temp_fattr.cf_uid, INVALID_UID)) {
+				ksmbd_err("%s: Error %d mapping Owner SID to uid\n",
+						__func__, ret);
+				continue;
+			}
+
+			acl_state.owner.allow = ((acl_mode & 0700) >> 6) | 0004;
+			acl_state.users->aces[acl_state.users->n].uid =
+				temp_fattr.cf_uid;
+			acl_state.users->aces[acl_state.users->n++].perms.allow =
+				((acl_mode & 0700) >> 6) | 0004;
+			default_acl_state.owner.allow = ((acl_mode & 0700) >> 6) | 0004;
+			default_acl_state.users->aces[default_acl_state.users->n].uid =
+				temp_fattr.cf_uid;
+			default_acl_state.users->aces[default_acl_state.users->n++].perms.allow =
+				((acl_mode & 0700) >> 6) | 0004;
+		}
+	}
+	kfree(ppace);
+
+	if (owner_found) {
+		/* The owner must be set to at least read-only. */
+		acl_state.owner.allow = ((mode & 0700) >> 6) | 0004;
+		acl_state.users->aces[acl_state.users->n].uid = fattr->cf_uid;
+		acl_state.users->aces[acl_state.users->n++].perms.allow =
+			((mode & 0700) >> 6) | 0004;
+		default_acl_state.owner.allow = ((mode & 0700) >> 6) | 0004;
+		default_acl_state.users->aces[default_acl_state.users->n].uid =
+			fattr->cf_uid;
+		default_acl_state.users->aces[default_acl_state.users->n++].perms.allow =
+			((mode & 0700) >> 6) | 0004;
+	}
+
+	if (group_found) {
+		acl_state.group.allow = (mode & 0070) >> 3;
+		acl_state.groups->aces[acl_state.groups->n].gid =
+			fattr->cf_gid;
+		acl_state.groups->aces[acl_state.groups->n++].perms.allow =
+			(mode & 0070) >> 3;
+		default_acl_state.group.allow = (mode & 0070) >> 3;
+		default_acl_state.groups->aces[default_acl_state.groups->n].gid =
+			fattr->cf_gid;
+		default_acl_state.groups->aces[default_acl_state.groups->n++].perms.allow =
+			(mode & 0070) >> 3;
+	}
+
+	if (others_found) {
+		fattr->cf_mode &= ~(0007);
+		fattr->cf_mode |= mode & 0007;
+
+		acl_state.other.allow = mode & 0007;
+		default_acl_state.other.allow = mode & 0007;
+	}
+
+	if (acl_state.users->n || acl_state.groups->n) {
+		acl_state.mask.allow = 0x07;
+		fattr->cf_acls = ksmbd_vfs_posix_acl_alloc(acl_state.users->n +
+			acl_state.groups->n + 4, GFP_KERNEL);
+		if (fattr->cf_acls) {
+			cf_pace = fattr->cf_acls->a_entries;
+			posix_state_to_acl(&acl_state, cf_pace);
+		}
+	}
+
+	if (default_acl_state.users->n || default_acl_state.groups->n) {
+		default_acl_state.mask.allow = 0x07;
+		fattr->cf_dacls =
+			ksmbd_vfs_posix_acl_alloc(default_acl_state.users->n +
+			default_acl_state.groups->n + 4, GFP_KERNEL);
+		if (fattr->cf_dacls) {
+			cf_pdace = fattr->cf_dacls->a_entries;
+			posix_state_to_acl(&default_acl_state, cf_pdace);
+		}
+	}
+	free_acl_state(&acl_state);
+	free_acl_state(&default_acl_state);
+}
+
+static void set_posix_acl_entries_dacl(struct smb_ace *pndace,
+		struct smb_fattr *fattr, u32 *num_aces, u16 *size, u32 nt_aces_num)
+{
+	struct posix_acl_entry *pace;
+	struct smb_sid *sid;
+	struct smb_ace *ntace;
+	int i, j;
+
+	if (!fattr->cf_acls)
+		goto posix_default_acl;
+
+	pace = fattr->cf_acls->a_entries;
+	for (i = 0; i < fattr->cf_acls->a_count; i++, pace++) {
+		int flags = 0;
+
+		sid = kmalloc(sizeof(struct smb_sid), GFP_KERNEL);
+		if (!sid)
+			break;
+
+		if (pace->e_tag == ACL_USER) {
+			uid_t uid;
+			unsigned int sid_type = SIDOWNER;
+
+			uid = from_kuid(&init_user_ns, pace->e_uid);
+			if (!uid)
+				sid_type = SIDUNIX_USER;
+			id_to_sid(uid, sid_type, sid);
+		} else if (pace->e_tag == ACL_GROUP) {
+			gid_t gid;
+
+			gid = from_kgid(&init_user_ns, pace->e_gid);
+			id_to_sid(gid, SIDUNIX_GROUP, sid);
+		} else if (pace->e_tag == ACL_OTHER && !nt_aces_num) {
+			smb_copy_sid(sid, &sid_everyone);
+		} else {
+			kfree(sid);
+			continue;
+		}
+		ntace = pndace;
+		for (j = 0; j < nt_aces_num; j++) {
+			if (ntace->sid.sub_auth[ntace->sid.num_subauth - 1] ==
+					sid->sub_auth[sid->num_subauth - 1])
+				goto pass_same_sid;
+			ntace = (struct smb_ace *)((char *)ntace +
+					le16_to_cpu(ntace->size));
+		}
+
+		if (S_ISDIR(fattr->cf_mode) && pace->e_tag == ACL_OTHER)
+			flags = 0x03;
+
+		ntace = (struct smb_ace *)((char *)pndace + *size);
+		*size += fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, flags,
+				pace->e_perm, 0777);
+		(*num_aces)++;
+		if (pace->e_tag == ACL_USER)
+			ntace->access_req |=
+				FILE_DELETE_LE | FILE_DELETE_CHILD_LE;
+
+		if (S_ISDIR(fattr->cf_mode) &&
+		    (pace->e_tag == ACL_USER || pace->e_tag == ACL_GROUP)) {
+			ntace = (struct smb_ace *)((char *)pndace + *size);
+			*size += fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED,
+					0x03, pace->e_perm, 0777);
+			(*num_aces)++;
+			if (pace->e_tag == ACL_USER)
+				ntace->access_req |=
+					FILE_DELETE_LE | FILE_DELETE_CHILD_LE;
+		}
+
+pass_same_sid:
+		kfree(sid);
+	}
+
+	if (nt_aces_num)
+		return;
+
+posix_default_acl:
+	if (!fattr->cf_dacls)
+		return;
+
+	pace = fattr->cf_dacls->a_entries;
+	for (i = 0; i < fattr->cf_dacls->a_count; i++, pace++) {
+		sid = kmalloc(sizeof(struct smb_sid), GFP_KERNEL);
+		if (!sid)
+			break;
+
+		if (pace->e_tag == ACL_USER) {
+			uid_t uid;
+
+			uid = from_kuid(&init_user_ns, pace->e_uid);
+			id_to_sid(uid, SIDCREATOR_OWNER, sid);
+		} else if (pace->e_tag == ACL_GROUP) {
+			gid_t gid;
+
+			gid = from_kgid(&init_user_ns, pace->e_gid);
+			id_to_sid(gid, SIDCREATOR_GROUP, sid);
+		} else {
+			kfree(sid);
+			continue;
+		}
+
+		ntace = (struct smb_ace *)((char *)pndace + *size);
+		*size += fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, 0x0b,
+				pace->e_perm, 0777);
+		(*num_aces)++;
+		if (pace->e_tag == ACL_USER)
+			ntace->access_req |=
+				FILE_DELETE_LE | FILE_DELETE_CHILD_LE;
+		kfree(sid);
+	}
+}
+
+static void set_ntacl_dacl(struct smb_acl *pndacl, struct smb_acl *nt_dacl,
+		const struct smb_sid *pownersid, const struct smb_sid *pgrpsid,
+		struct smb_fattr *fattr)
+{
+	struct smb_ace *ntace, *pndace;
+	int nt_num_aces = le32_to_cpu(nt_dacl->num_aces), num_aces = 0;
+	unsigned short size = 0;
+	int i;
+
+	pndace = (struct smb_ace *)((char *)pndacl + sizeof(struct smb_acl));
+	if (nt_num_aces) {
+		ntace = (struct smb_ace *)((char *)nt_dacl + sizeof(struct smb_acl));
+		for (i = 0; i < nt_num_aces; i++) {
+			memcpy((char *)pndace + size, ntace, le16_to_cpu(ntace->size));
+			size += le16_to_cpu(ntace->size);
+			ntace = (struct smb_ace *)((char *)ntace + le16_to_cpu(ntace->size));
+			num_aces++;
+		}
+	}
+
+	set_posix_acl_entries_dacl(pndace, fattr, &num_aces, &size, nt_num_aces);
+	pndacl->num_aces = cpu_to_le32(num_aces);
+	pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size);
+}
+
+static void set_mode_dacl(struct smb_acl *pndacl, struct smb_fattr *fattr)
+{
+	struct smb_ace *pace, *pndace;
+	u32 num_aces = 0;
+	u16 size = 0, ace_size = 0;
+	uid_t uid;
+	const struct smb_sid *sid;
+
+	pace = pndace = (struct smb_ace *)((char *)pndacl + sizeof(struct smb_acl));
+
+	if (fattr->cf_acls) {
+		set_posix_acl_entries_dacl(pndace, fattr, &num_aces, &size, num_aces);
+		goto out;
+	}
+
+	/* owner RID */
+	uid = from_kuid(&init_user_ns, fattr->cf_uid);
+	if (uid)
+		sid = &server_conf.domain_sid;
+	else
+		sid = &sid_unix_users;
+	ace_size = fill_ace_for_sid(pace, sid, ACCESS_ALLOWED, 0,
+			fattr->cf_mode, 0700);
+	pace->sid.sub_auth[pace->sid.num_subauth++] = cpu_to_le32(uid);
+	pace->access_req |= FILE_DELETE_LE | FILE_DELETE_CHILD_LE;
+	pace->size = cpu_to_le16(ace_size + 4);
+	size += le16_to_cpu(pace->size);
+	pace = (struct smb_ace *)((char *)pndace + size);
+
+	/* Group RID */
+	ace_size = fill_ace_for_sid(pace, &sid_unix_groups,
+			ACCESS_ALLOWED, 0, fattr->cf_mode, 0070);
+	pace->sid.sub_auth[pace->sid.num_subauth++] =
+		cpu_to_le32(from_kgid(&init_user_ns, fattr->cf_gid));
+	pace->size = cpu_to_le16(ace_size + 4);
+	size += le16_to_cpu(pace->size);
+	pace = (struct smb_ace *)((char *)pndace + size);
+	num_aces = 3;
+
+	if (S_ISDIR(fattr->cf_mode)) {
+		pace = (struct smb_ace *)((char *)pndace + size);
+
+		/* creator owner */
+		size += fill_ace_for_sid(pace, &creator_owner, ACCESS_ALLOWED,
+				0x0b, fattr->cf_mode, 0700);
+		pace->access_req |= FILE_DELETE_LE | FILE_DELETE_CHILD_LE;
+		pace = (struct smb_ace *)((char *)pndace + size);
+
+		/* creator group */
+		size += fill_ace_for_sid(pace, &creator_group, ACCESS_ALLOWED,
+				0x0b, fattr->cf_mode, 0070);
+		pace = (struct smb_ace *)((char *)pndace + size);
+		num_aces = 5;
+	}
+
+	/* other */
+	size += fill_ace_for_sid(pace, &sid_everyone, ACCESS_ALLOWED, 0,
+			fattr->cf_mode, 0007);
+
+out:
+	pndacl->num_aces = cpu_to_le32(num_aces);
+	pndacl->size = cpu_to_le16(le16_to_cpu(pndacl->size) + size);
+}
+
+static int parse_sid(struct smb_sid *psid, char *end_of_acl)
+{
+	/*
+	 * validate that we do not go past end of ACL - sid must be at least 8
+	 * bytes long (assuming no sub-auths - e.g. the null SID
+	 */
+	if (end_of_acl < (char *)psid + 8) {
+		ksmbd_err("ACL too small to parse SID %p\n", psid);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/* Convert CIFS ACL to POSIX form */
+int parse_sec_desc(struct smb_ntsd *pntsd, int acl_len,
+		struct smb_fattr *fattr)
+{
+	int rc = 0;
+	struct smb_sid *owner_sid_ptr, *group_sid_ptr;
+	struct smb_acl *dacl_ptr; /* no need for SACL ptr */
+	char *end_of_acl = ((char *)pntsd) + acl_len;
+	__u32 dacloffset;
+	int pntsd_type;
+
+	if (!pntsd)
+		return -EIO;
+
+	owner_sid_ptr = (struct smb_sid *)((char *)pntsd +
+			le32_to_cpu(pntsd->osidoffset));
+	group_sid_ptr = (struct smb_sid *)((char *)pntsd +
+			le32_to_cpu(pntsd->gsidoffset));
+	dacloffset = le32_to_cpu(pntsd->dacloffset);
+	dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset);
+	ksmbd_debug(SMB,
+		"revision %d type 0x%x ooffset 0x%x goffset 0x%x sacloffset 0x%x dacloffset 0x%x\n",
+		 pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
+		 le32_to_cpu(pntsd->gsidoffset),
+		 le32_to_cpu(pntsd->sacloffset), dacloffset);
+
+	pntsd_type = le16_to_cpu(pntsd->type);
+	if (!(pntsd_type & DACL_PRESENT)) {
+		ksmbd_debug(SMB, "DACL_PRESENT in DACL type is not set\n");
+		return rc;
+	}
+
+	pntsd->type = cpu_to_le16(DACL_PRESENT);
+
+	if (pntsd->osidoffset) {
+		rc = parse_sid(owner_sid_ptr, end_of_acl);
+		if (rc) {
+			ksmbd_err("%s: Error %d parsing Owner SID\n", __func__, rc);
+			return rc;
+		}
+
+		rc = sid_to_id(owner_sid_ptr, SIDOWNER, fattr);
+		if (rc) {
+			ksmbd_err("%s: Error %d mapping Owner SID to uid\n",
+					__func__, rc);
+			owner_sid_ptr = NULL;
+		}
+	}
+
+	if (pntsd->gsidoffset) {
+		rc = parse_sid(group_sid_ptr, end_of_acl);
+		if (rc) {
+			ksmbd_err("%s: Error %d mapping Owner SID to gid\n",
+					__func__, rc);
+			return rc;
+		}
+		rc = sid_to_id(group_sid_ptr, SIDUNIX_GROUP, fattr);
+		if (rc) {
+			ksmbd_err("%s: Error %d mapping Group SID to gid\n",
+					__func__, rc);
+			group_sid_ptr = NULL;
+		}
+	}
+
+	if ((pntsd_type &
+	     (DACL_AUTO_INHERITED | DACL_AUTO_INHERIT_REQ)) ==
+	    (DACL_AUTO_INHERITED | DACL_AUTO_INHERIT_REQ))
+		pntsd->type |= cpu_to_le16(DACL_AUTO_INHERITED);
+	if (pntsd_type & DACL_PROTECTED)
+		pntsd->type |= cpu_to_le16(DACL_PROTECTED);
+
+	if (dacloffset) {
+		parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr, group_sid_ptr,
+				fattr);
+	}
+
+	return 0;
+}
+
+/* Convert permission bits from mode to equivalent CIFS ACL */
+int build_sec_desc(struct smb_ntsd *pntsd, struct smb_ntsd *ppntsd,
+		int addition_info, __u32 *secdesclen, struct smb_fattr *fattr)
+{
+	int rc = 0;
+	__u32 offset;
+	struct smb_sid *owner_sid_ptr, *group_sid_ptr;
+	struct smb_sid *nowner_sid_ptr, *ngroup_sid_ptr;
+	struct smb_acl *dacl_ptr = NULL; /* no need for SACL ptr */
+	uid_t uid;
+	gid_t gid;
+	unsigned int sid_type = SIDOWNER;
+
+	nowner_sid_ptr = kmalloc(sizeof(struct smb_sid), GFP_KERNEL);
+	if (!nowner_sid_ptr)
+		return -ENOMEM;
+
+	uid = from_kuid(&init_user_ns, fattr->cf_uid);
+	if (!uid)
+		sid_type = SIDUNIX_USER;
+	id_to_sid(uid, sid_type, nowner_sid_ptr);
+
+	ngroup_sid_ptr = kmalloc(sizeof(struct smb_sid), GFP_KERNEL);
+	if (!ngroup_sid_ptr) {
+		kfree(nowner_sid_ptr);
+		return -ENOMEM;
+	}
+
+	gid = from_kgid(&init_user_ns, fattr->cf_gid);
+	id_to_sid(gid, SIDUNIX_GROUP, ngroup_sid_ptr);
+
+	offset = sizeof(struct smb_ntsd);
+	pntsd->sacloffset = 0;
+	pntsd->revision = cpu_to_le16(1);
+	pntsd->type = cpu_to_le16(SELF_RELATIVE);
+	if (ppntsd)
+		pntsd->type |= ppntsd->type;
+
+	if (addition_info & OWNER_SECINFO) {
+		pntsd->osidoffset = cpu_to_le32(offset);
+		owner_sid_ptr = (struct smb_sid *)((char *)pntsd + offset);
+		smb_copy_sid(owner_sid_ptr, nowner_sid_ptr);
+		offset += 1 + 1 + 6 + (nowner_sid_ptr->num_subauth * 4);
+	}
+
+	if (addition_info & GROUP_SECINFO) {
+		pntsd->gsidoffset = cpu_to_le32(offset);
+		group_sid_ptr = (struct smb_sid *)((char *)pntsd + offset);
+		smb_copy_sid(group_sid_ptr, ngroup_sid_ptr);
+		offset += 1 + 1 + 6 + (ngroup_sid_ptr->num_subauth * 4);
+	}
+
+	if (addition_info & DACL_SECINFO) {
+		pntsd->type |= cpu_to_le16(DACL_PRESENT);
+		dacl_ptr = (struct smb_acl *)((char *)pntsd + offset);
+		dacl_ptr->revision = cpu_to_le16(2);
+		dacl_ptr->size = cpu_to_le16(sizeof(struct smb_acl));
+		dacl_ptr->num_aces = 0;
+
+		if (!ppntsd) {
+			set_mode_dacl(dacl_ptr, fattr);
+		} else if (!ppntsd->dacloffset) {
+			goto out;
+		} else {
+			struct smb_acl *ppdacl_ptr;
+
+			ppdacl_ptr = (struct smb_acl *)((char *)ppntsd +
+						le32_to_cpu(ppntsd->dacloffset));
+			set_ntacl_dacl(dacl_ptr, ppdacl_ptr, nowner_sid_ptr,
+				       ngroup_sid_ptr, fattr);
+		}
+		pntsd->dacloffset = cpu_to_le32(offset);
+		offset += le16_to_cpu(dacl_ptr->size);
+	}
+
+out:
+	kfree(nowner_sid_ptr);
+	kfree(ngroup_sid_ptr);
+	*secdesclen = offset;
+	return rc;
+}
+
+static void smb_set_ace(struct smb_ace *ace, const struct smb_sid *sid, u8 type,
+		u8 flags, __le32 access_req)
+{
+	ace->type = type;
+	ace->flags = flags;
+	ace->access_req = access_req;
+	smb_copy_sid(&ace->sid, sid);
+	ace->size = cpu_to_le16(1 + 1 + 2 + 4 + 1 + 1 + 6 + (sid->num_subauth * 4));
+}
+
+int smb_inherit_dacl(struct ksmbd_conn *conn, struct dentry *dentry,
+		unsigned int uid, unsigned int gid)
+{
+	const struct smb_sid *psid, *creator = NULL;
+	struct smb_ace *parent_aces, *aces;
+	struct smb_acl *parent_pdacl;
+	struct smb_ntsd *parent_pntsd = NULL;
+	struct smb_sid owner_sid, group_sid;
+	struct dentry *parent = dentry->d_parent;
+	int inherited_flags = 0, flags = 0, i, ace_cnt = 0, nt_size = 0;
+	int rc = -ENOENT, num_aces, dacloffset, pntsd_type, acl_len;
+	char *aces_base;
+	bool is_dir = S_ISDIR(dentry->d_inode->i_mode);
+
+	acl_len = ksmbd_vfs_get_sd_xattr(conn, parent, &parent_pntsd);
+	if (acl_len <= 0)
+		return rc;
+	dacloffset = le32_to_cpu(parent_pntsd->dacloffset);
+	if (!dacloffset)
+		goto out;
+
+	parent_pdacl = (struct smb_acl *)((char *)parent_pntsd + dacloffset);
+	num_aces = le32_to_cpu(parent_pdacl->num_aces);
+	pntsd_type = le16_to_cpu(parent_pntsd->type);
+
+	aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, GFP_KERNEL);
+	if (!aces_base)
+		goto out;
+
+	aces = (struct smb_ace *)aces_base;
+	parent_aces = (struct smb_ace *)((char *)parent_pdacl +
+			sizeof(struct smb_acl));
+
+	if (pntsd_type & DACL_AUTO_INHERITED)
+		inherited_flags = INHERITED_ACE;
+
+	for (i = 0; i < num_aces; i++) {
+		flags = parent_aces->flags;
+		if (!smb_inherit_flags(flags, is_dir))
+			goto pass;
+		if (is_dir) {
+			flags &= ~(INHERIT_ONLY_ACE | INHERITED_ACE);
+			if (!(flags & CONTAINER_INHERIT_ACE))
+				flags |= INHERIT_ONLY_ACE;
+			if (flags & NO_PROPAGATE_INHERIT_ACE)
+				flags = 0;
+		} else {
+			flags = 0;
+		}
+
+		if (!compare_sids(&creator_owner, &parent_aces->sid)) {
+			creator = &creator_owner;
+			id_to_sid(uid, SIDOWNER, &owner_sid);
+			psid = &owner_sid;
+		} else if (!compare_sids(&creator_group, &parent_aces->sid)) {
+			creator = &creator_group;
+			id_to_sid(gid, SIDUNIX_GROUP, &group_sid);
+			psid = &group_sid;
+		} else {
+			creator = NULL;
+			psid = &parent_aces->sid;
+		}
+
+		if (is_dir && creator && flags & CONTAINER_INHERIT_ACE) {
+			smb_set_ace(aces, psid, parent_aces->type, inherited_flags,
+					parent_aces->access_req);
+			nt_size += le16_to_cpu(aces->size);
+			ace_cnt++;
+			aces = (struct smb_ace *)((char *)aces + le16_to_cpu(aces->size));
+			flags |= INHERIT_ONLY_ACE;
+			psid = creator;
+		} else if (is_dir && !(parent_aces->flags & NO_PROPAGATE_INHERIT_ACE)) {
+			psid = &parent_aces->sid;
+		}
+
+		smb_set_ace(aces, psid, parent_aces->type, flags | inherited_flags,
+				parent_aces->access_req);
+		nt_size += le16_to_cpu(aces->size);
+		aces = (struct smb_ace *)((char *)aces + le16_to_cpu(aces->size));
+		ace_cnt++;
+pass:
+		parent_aces =
+			(struct smb_ace *)((char *)parent_aces + le16_to_cpu(parent_aces->size));
+	}
+
+	if (nt_size > 0) {
+		struct smb_ntsd *pntsd;
+		struct smb_acl *pdacl;
+		struct smb_sid *powner_sid = NULL, *pgroup_sid = NULL;
+		int powner_sid_size = 0, pgroup_sid_size = 0, pntsd_size;
+
+		if (parent_pntsd->osidoffset) {
+			powner_sid = (struct smb_sid *)((char *)parent_pntsd +
+					le32_to_cpu(parent_pntsd->osidoffset));
+			powner_sid_size = 1 + 1 + 6 + (powner_sid->num_subauth * 4);
+		}
+		if (parent_pntsd->gsidoffset) {
+			pgroup_sid = (struct smb_sid *)((char *)parent_pntsd +
+					le32_to_cpu(parent_pntsd->gsidoffset));
+			pgroup_sid_size = 1 + 1 + 6 + (pgroup_sid->num_subauth * 4);
+		}
+
+		pntsd = kzalloc(sizeof(struct smb_ntsd) + powner_sid_size +
+				pgroup_sid_size + sizeof(struct smb_acl) +
+				nt_size, GFP_KERNEL);
+		if (!pntsd) {
+			rc = -ENOMEM;
+			goto out;
+		}
+
+		pntsd->revision = cpu_to_le16(1);
+		pntsd->type = cpu_to_le16(SELF_RELATIVE | DACL_PRESENT);
+		if (le16_to_cpu(parent_pntsd->type) & DACL_AUTO_INHERITED)
+			pntsd->type |= cpu_to_le16(DACL_AUTO_INHERITED);
+		pntsd_size = sizeof(struct smb_ntsd);
+		pntsd->osidoffset = parent_pntsd->osidoffset;
+		pntsd->gsidoffset = parent_pntsd->gsidoffset;
+		pntsd->dacloffset = parent_pntsd->dacloffset;
+
+		if (pntsd->osidoffset) {
+			struct smb_sid *owner_sid = (struct smb_sid *)((char *)pntsd +
+					le32_to_cpu(pntsd->osidoffset));
+			memcpy(owner_sid, powner_sid, powner_sid_size);
+			pntsd_size += powner_sid_size;
+		}
+
+		if (pntsd->gsidoffset) {
+			struct smb_sid *group_sid = (struct smb_sid *)((char *)pntsd +
+					le32_to_cpu(pntsd->gsidoffset));
+			memcpy(group_sid, pgroup_sid, pgroup_sid_size);
+			pntsd_size += pgroup_sid_size;
+		}
+
+		if (pntsd->dacloffset) {
+			struct smb_ace *pace;
+
+			pdacl = (struct smb_acl *)((char *)pntsd + le32_to_cpu(pntsd->dacloffset));
+			pdacl->revision = cpu_to_le16(2);
+			pdacl->size = cpu_to_le16(sizeof(struct smb_acl) + nt_size);
+			pdacl->num_aces = cpu_to_le32(ace_cnt);
+			pace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl));
+			memcpy(pace, aces_base, nt_size);
+			pntsd_size += sizeof(struct smb_acl) + nt_size;
+		}
+
+		ksmbd_vfs_set_sd_xattr(conn, dentry, pntsd, pntsd_size);
+		kfree(pntsd);
+		rc = 0;
+	}
+
+	kfree(aces_base);
+out:
+	return rc;
+}
+
+bool smb_inherit_flags(int flags, bool is_dir)
+{
+	if (!is_dir)
+		return (flags & OBJECT_INHERIT_ACE) != 0;
+
+	if (flags & OBJECT_INHERIT_ACE && !(flags & NO_PROPAGATE_INHERIT_ACE))
+		return true;
+
+	if (flags & CONTAINER_INHERIT_ACE)
+		return true;
+	return false;
+}
+
+int smb_check_perm_dacl(struct ksmbd_conn *conn, struct dentry *dentry,
+		__le32 *pdaccess, int uid)
+{
+	struct smb_ntsd *pntsd = NULL;
+	struct smb_acl *pdacl;
+	struct posix_acl *posix_acls;
+	int rc = 0, acl_size;
+	struct smb_sid sid;
+	int granted = le32_to_cpu(*pdaccess & ~FILE_MAXIMAL_ACCESS_LE);
+	struct smb_ace *ace;
+	int i, found = 0;
+	unsigned int access_bits = 0;
+	struct smb_ace *others_ace = NULL;
+	struct posix_acl_entry *pa_entry;
+	unsigned int sid_type = SIDOWNER;
+	char *end_of_acl;
+
+	ksmbd_debug(SMB, "check permission using windows acl\n");
+	acl_size = ksmbd_vfs_get_sd_xattr(conn, dentry, &pntsd);
+	if (acl_size <= 0 || !pntsd || !pntsd->dacloffset) {
+		kfree(pntsd);
+		return 0;
+	}
+
+	pdacl = (struct smb_acl *)((char *)pntsd + le32_to_cpu(pntsd->dacloffset));
+	end_of_acl = ((char *)pntsd) + acl_size;
+	if (end_of_acl <= (char *)pdacl) {
+		kfree(pntsd);
+		return 0;
+	}
+
+	if (end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size) ||
+	    le16_to_cpu(pdacl->size) < sizeof(struct smb_acl)) {
+		kfree(pntsd);
+		return 0;
+	}
+
+	if (!pdacl->num_aces) {
+		if (!(le16_to_cpu(pdacl->size) - sizeof(struct smb_acl)) &&
+		    *pdaccess & ~(FILE_READ_CONTROL_LE | FILE_WRITE_DAC_LE)) {
+			rc = -EACCES;
+			goto err_out;
+		}
+		kfree(pntsd);
+		return 0;
+	}
+
+	if (*pdaccess & FILE_MAXIMAL_ACCESS_LE) {
+		granted = READ_CONTROL | WRITE_DAC | FILE_READ_ATTRIBUTES |
+			DELETE;
+
+		ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl));
+		for (i = 0; i < le32_to_cpu(pdacl->num_aces); i++) {
+			granted |= le32_to_cpu(ace->access_req);
+			ace = (struct smb_ace *)((char *)ace + le16_to_cpu(ace->size));
+			if (end_of_acl < (char *)ace)
+				goto err_out;
+		}
+
+		if (!pdacl->num_aces)
+			granted = GENERIC_ALL_FLAGS;
+	}
+
+	if (!uid)
+		sid_type = SIDUNIX_USER;
+	id_to_sid(uid, sid_type, &sid);
+
+	ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl));
+	for (i = 0; i < le32_to_cpu(pdacl->num_aces); i++) {
+		if (!compare_sids(&sid, &ace->sid) ||
+		    !compare_sids(&sid_unix_NFS_mode, &ace->sid)) {
+			found = 1;
+			break;
+		}
+		if (!compare_sids(&sid_everyone, &ace->sid))
+			others_ace = ace;
+
+		ace = (struct smb_ace *)((char *)ace + le16_to_cpu(ace->size));
+		if (end_of_acl < (char *)ace)
+			goto err_out;
+	}
+
+	if (*pdaccess & FILE_MAXIMAL_ACCESS_LE && found) {
+		granted = READ_CONTROL | WRITE_DAC | FILE_READ_ATTRIBUTES |
+			DELETE;
+
+		granted |= le32_to_cpu(ace->access_req);
+
+		if (!pdacl->num_aces)
+			granted = GENERIC_ALL_FLAGS;
+	}
+
+	posix_acls = ksmbd_vfs_get_acl(dentry->d_inode, ACL_TYPE_ACCESS);
+	if (posix_acls && !found) {
+		unsigned int id = -1;
+
+		pa_entry = posix_acls->a_entries;
+		for (i = 0; i < posix_acls->a_count; i++, pa_entry++) {
+			if (pa_entry->e_tag == ACL_USER)
+				id = from_kuid(&init_user_ns, pa_entry->e_uid);
+			else if (pa_entry->e_tag == ACL_GROUP)
+				id = from_kgid(&init_user_ns, pa_entry->e_gid);
+			else
+				continue;
+
+			if (id == uid) {
+				mode_to_access_flags(pa_entry->e_perm, 0777, &access_bits);
+				if (!access_bits)
+					access_bits = SET_MINIMUM_RIGHTS;
+				goto check_access_bits;
+			}
+		}
+	}
+	if (posix_acls)
+		posix_acl_release(posix_acls);
+
+	if (!found) {
+		if (others_ace) {
+			ace = others_ace;
+		} else {
+			ksmbd_debug(SMB, "Can't find corresponding sid\n");
+			rc = -EACCES;
+			goto err_out;
+		}
+	}
+
+	switch (ace->type) {
+	case ACCESS_ALLOWED_ACE_TYPE:
+		access_bits = le32_to_cpu(ace->access_req);
+		break;
+	case ACCESS_DENIED_ACE_TYPE:
+	case ACCESS_DENIED_CALLBACK_ACE_TYPE:
+		access_bits = le32_to_cpu(~ace->access_req);
+		break;
+	}
+
+check_access_bits:
+	if (granted & ~(access_bits | FILE_READ_ATTRIBUTES |
+		READ_CONTROL | WRITE_DAC | DELETE)) {
+		ksmbd_debug(SMB, "Access denied with winACL, granted : %x, access_req : %x\n",
+				granted, le32_to_cpu(ace->access_req));
+		rc = -EACCES;
+		goto err_out;
+	}
+
+	*pdaccess = cpu_to_le32(granted);
+err_out:
+	kfree(pntsd);
+	return rc;
+}
+
+int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon,
+		struct dentry *dentry, struct smb_ntsd *pntsd, int ntsd_len,
+		bool type_check)
+{
+	int rc;
+	struct smb_fattr fattr = {{0}};
+	struct inode *inode = dentry->d_inode;
+
+	fattr.cf_uid = INVALID_UID;
+	fattr.cf_gid = INVALID_GID;
+	fattr.cf_mode = inode->i_mode;
+
+	rc = parse_sec_desc(pntsd, ntsd_len, &fattr);
+	if (rc)
+		goto out;
+
+	inode->i_mode = (inode->i_mode & ~0777) | (fattr.cf_mode & 0777);
+	if (!uid_eq(fattr.cf_uid, INVALID_UID))
+		inode->i_uid = fattr.cf_uid;
+	if (!gid_eq(fattr.cf_gid, INVALID_GID))
+		inode->i_gid = fattr.cf_gid;
+	mark_inode_dirty(inode);
+
+	ksmbd_vfs_remove_acl_xattrs(dentry);
+	/* Update posix acls */
+	if (fattr.cf_dacls) {
+		rc = ksmbd_vfs_set_posix_acl(inode, ACL_TYPE_ACCESS,
+				fattr.cf_acls);
+		if (S_ISDIR(inode->i_mode) && fattr.cf_dacls)
+			rc = ksmbd_vfs_set_posix_acl(inode, ACL_TYPE_DEFAULT,
+					fattr.cf_dacls);
+	}
+
+	/* Check it only calling from SD BUFFER context */
+	if (type_check && !(le16_to_cpu(pntsd->type) & DACL_PRESENT))
+		goto out;
+
+	if (test_share_config_flag(tcon->share_conf, KSMBD_SHARE_FLAG_ACL_XATTR)) {
+		/* Update WinACL in xattr */
+		ksmbd_vfs_remove_sd_xattrs(dentry);
+		ksmbd_vfs_set_sd_xattr(conn, dentry, pntsd, ntsd_len);
+	}
+
+out:
+	posix_acl_release(fattr.cf_acls);
+	posix_acl_release(fattr.cf_dacls);
+	mark_inode_dirty(inode);
+	return rc;
+}
+
+void ksmbd_init_domain(u32 *sub_auth)
+{
+	int i;
+
+	memcpy(&server_conf.domain_sid, &domain, sizeof(struct smb_sid));
+	for (i = 0; i < 3; ++i)
+		server_conf.domain_sid.sub_auth[i + 1] = cpu_to_le32(sub_auth[i]);
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smbacl.h linux-5.4.60-fbx/fs/cifsd/smbacl.h
--- linux-5.4.60-fbx/fs/cifsd./smbacl.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smbacl.h	2021-04-21 09:44:50.978505152 +0200
@@ -0,0 +1,201 @@
+/* SPDX-License-Identifier: LGPL-2.1+ */
+/*
+ *   Copyright (c) International Business Machines  Corp., 2007
+ *   Author(s): Steve French (sfrench@us.ibm.com)
+ *   Modified by Namjae Jeon (linkinjeon@kernel.org)
+ */
+
+#ifndef _SMBACL_H
+#define _SMBACL_H
+
+#include <linux/fs.h>
+#include <linux/namei.h>
+#include <linux/posix_acl.h>
+
+#include "mgmt/tree_connect.h"
+
+#define NUM_AUTHS (6)	/* number of authority fields */
+#define SID_MAX_SUB_AUTHORITIES (15) /* max number of sub authority fields */
+
+#define ACCESS_ALLOWED	0
+#define ACCESS_DENIED	1
+
+#define SIDOWNER 1
+#define SIDGROUP 2
+#define SIDCREATOR_OWNER 3
+#define SIDCREATOR_GROUP 4
+#define SIDUNIX_USER 5
+#define SIDUNIX_GROUP 6
+#define SIDNFS_USER 7
+#define SIDNFS_GROUP 8
+#define SIDNFS_MODE 9
+
+/* Revision for ACLs */
+#define SD_REVISION	1
+
+/* Control flags for Security Descriptor */
+#define OWNER_DEFAULTED		0x0001
+#define GROUP_DEFAULTED		0x0002
+#define DACL_PRESENT		0x0004
+#define DACL_DEFAULTED		0x0008
+#define SACL_PRESENT		0x0010
+#define SACL_DEFAULTED		0x0020
+#define DACL_TRUSTED		0x0040
+#define SERVER_SECURITY		0x0080
+#define DACL_AUTO_INHERIT_REQ	0x0100
+#define SACL_AUTO_INHERIT_REQ	0x0200
+#define DACL_AUTO_INHERITED	0x0400
+#define SACL_AUTO_INHERITED	0x0800
+#define DACL_PROTECTED		0x1000
+#define SACL_PROTECTED		0x2000
+#define RM_CONTROL_VALID	0x4000
+#define SELF_RELATIVE		0x8000
+
+/* ACE types - see MS-DTYP 2.4.4.1 */
+#define ACCESS_ALLOWED_ACE_TYPE 0x00
+#define ACCESS_DENIED_ACE_TYPE  0x01
+#define SYSTEM_AUDIT_ACE_TYPE   0x02
+#define SYSTEM_ALARM_ACE_TYPE   0x03
+#define ACCESS_ALLOWED_COMPOUND_ACE_TYPE 0x04
+#define ACCESS_ALLOWED_OBJECT_ACE_TYPE  0x05
+#define ACCESS_DENIED_OBJECT_ACE_TYPE   0x06
+#define SYSTEM_AUDIT_OBJECT_ACE_TYPE    0x07
+#define SYSTEM_ALARM_OBJECT_ACE_TYPE    0x08
+#define ACCESS_ALLOWED_CALLBACK_ACE_TYPE 0x09
+#define ACCESS_DENIED_CALLBACK_ACE_TYPE 0x0A
+#define ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE 0x0B
+#define ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE  0x0C
+#define SYSTEM_AUDIT_CALLBACK_ACE_TYPE  0x0D
+#define SYSTEM_ALARM_CALLBACK_ACE_TYPE  0x0E /* Reserved */
+#define SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE 0x0F
+#define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE 0x10 /* reserved */
+#define SYSTEM_MANDATORY_LABEL_ACE_TYPE 0x11
+#define SYSTEM_RESOURCE_ATTRIBUTE_ACE_TYPE 0x12
+#define SYSTEM_SCOPED_POLICY_ID_ACE_TYPE 0x13
+
+/* ACE flags */
+#define OBJECT_INHERIT_ACE		0x01
+#define CONTAINER_INHERIT_ACE		0x02
+#define NO_PROPAGATE_INHERIT_ACE	0x04
+#define INHERIT_ONLY_ACE		0x08
+#define INHERITED_ACE			0x10
+#define SUCCESSFUL_ACCESS_ACE_FLAG	0x40
+#define FAILED_ACCESS_ACE_FLAG		0x80
+
+/*
+ * Maximum size of a string representation of a SID:
+ *
+ * The fields are unsigned values in decimal. So:
+ *
+ * u8:  max 3 bytes in decimal
+ * u32: max 10 bytes in decimal
+ *
+ * "S-" + 3 bytes for version field + 15 for authority field + NULL terminator
+ *
+ * For authority field, max is when all 6 values are non-zero and it must be
+ * represented in hex. So "-0x" + 12 hex digits.
+ *
+ * Add 11 bytes for each subauthority field (10 bytes each + 1 for '-')
+ */
+#define SID_STRING_BASE_SIZE (2 + 3 + 15 + 1)
+#define SID_STRING_SUBAUTH_SIZE (11) /* size of a single subauth string */
+
+#define DOMAIN_USER_RID_LE	cpu_to_le32(513)
+
+struct ksmbd_conn;
+
+struct smb_ntsd {
+	__le16 revision; /* revision level */
+	__le16 type;
+	__le32 osidoffset;
+	__le32 gsidoffset;
+	__le32 sacloffset;
+	__le32 dacloffset;
+} __packed;
+
+struct smb_sid {
+	__u8 revision; /* revision level */
+	__u8 num_subauth;
+	__u8 authority[NUM_AUTHS];
+	__le32 sub_auth[SID_MAX_SUB_AUTHORITIES]; /* sub_auth[num_subauth] */
+} __packed;
+
+/* size of a struct cifs_sid, sans sub_auth array */
+#define CIFS_SID_BASE_SIZE (1 + 1 + NUM_AUTHS)
+
+struct smb_acl {
+	__le16 revision; /* revision level */
+	__le16 size;
+	__le32 num_aces;
+} __packed;
+
+struct smb_ace {
+	__u8 type;
+	__u8 flags;
+	__le16 size;
+	__le32 access_req;
+	struct smb_sid sid; /* ie UUID of user or group who gets these perms */
+} __packed;
+
+struct smb_fattr {
+	kuid_t	cf_uid;
+	kgid_t	cf_gid;
+	umode_t	cf_mode;
+	__le32 daccess;
+	struct posix_acl *cf_acls;
+	struct posix_acl *cf_dacls;
+};
+
+struct posix_ace_state {
+	u32 allow;
+	u32 deny;
+};
+
+struct posix_user_ace_state {
+	union {
+		kuid_t uid;
+		kgid_t gid;
+	};
+	struct posix_ace_state perms;
+};
+
+struct posix_ace_state_array {
+	int n;
+	struct posix_user_ace_state aces[];
+};
+
+/*
+ * while processing the nfsv4 ace, this maintains the partial permissions
+ * calculated so far:
+ */
+
+struct posix_acl_state {
+	struct posix_ace_state owner;
+	struct posix_ace_state group;
+	struct posix_ace_state other;
+	struct posix_ace_state everyone;
+	struct posix_ace_state mask; /* deny unused in this case */
+	struct posix_ace_state_array *users;
+	struct posix_ace_state_array *groups;
+};
+
+int parse_sec_desc(struct smb_ntsd *pntsd, int acl_len,
+		struct smb_fattr *fattr);
+int build_sec_desc(struct smb_ntsd *pntsd, struct smb_ntsd *ppntsd,
+		int addition_info, __u32 *secdesclen, struct smb_fattr *fattr);
+int init_acl_state(struct posix_acl_state *state, int cnt);
+void free_acl_state(struct posix_acl_state *state);
+void posix_state_to_acl(struct posix_acl_state *state,
+		struct posix_acl_entry *pace);
+int compare_sids(const struct smb_sid *ctsid, const struct smb_sid *cwsid);
+bool smb_inherit_flags(int flags, bool is_dir);
+int smb_inherit_dacl(struct ksmbd_conn *conn, struct dentry *dentry,
+		unsigned int uid, unsigned int gid);
+int smb_check_perm_dacl(struct ksmbd_conn *conn, struct dentry *dentry,
+		__le32 *pdaccess, int uid);
+int set_info_sec(struct ksmbd_conn *conn, struct ksmbd_tree_connect *tcon,
+		struct dentry *dentry, struct smb_ntsd *pntsd, int ntsd_len,
+		bool type_check);
+void id_to_sid(unsigned int cid, uint sidtype, struct smb_sid *ssid);
+void ksmbd_init_domain(u32 *sub_auth);
+#endif /* _SMBACL_H */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smb_common.c linux-5.4.60-fbx/fs/cifsd/smb_common.c
--- linux-5.4.60-fbx/fs/cifsd./smb_common.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smb_common.c	2021-04-21 10:06:25.188514159 +0200
@@ -0,0 +1,711 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ *   Copyright (C) 2018 Namjae Jeon <linkinjeon@kernel.org>
+ */
+
+#include "smb_common.h"
+#ifdef CONFIG_SMB_INSECURE_SERVER
+#include "smb1pdu.h"
+#endif
+#include "server.h"
+#include "misc.h"
+#include "smbstatus.h"
+#include "connection.h"
+#include "ksmbd_work.h"
+#include "mgmt/user_session.h"
+#include "mgmt/user_config.h"
+#include "mgmt/tree_connect.h"
+#include "mgmt/share_config.h"
+
+/*for shortname implementation */
+static const char basechars[43] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%";
+#define MANGLE_BASE (sizeof(basechars) / sizeof(char) - 1)
+#define MAGIC_CHAR '~'
+#define PERIOD '.'
+#define mangle(V) ((char)(basechars[(V) % MANGLE_BASE]))
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+#define KSMBD_MIN_SUPPORTED_HEADER_SIZE	(sizeof(struct smb_hdr))
+#else
+#define KSMBD_MIN_SUPPORTED_HEADER_SIZE	(sizeof(struct smb2_hdr))
+#endif
+
+LIST_HEAD(global_lock_list);
+
+struct smb_protocol {
+	int		index;
+	char		*name;
+	char		*prot;
+	__u16		prot_id;
+};
+
+static struct smb_protocol smb_protos[] = {
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	{
+		SMB1_PROT,
+		"\2NT LM 0.12",
+		"NT1",
+		SMB10_PROT_ID
+	},
+	{
+		SMB2_PROT,
+		"\2SMB 2.002",
+		"SMB2_02",
+		SMB20_PROT_ID
+	},
+#endif
+	{
+		SMB21_PROT,
+		"\2SMB 2.1",
+		"SMB2_10",
+		SMB21_PROT_ID
+	},
+	{
+		SMB2X_PROT,
+		"\2SMB 2.???",
+		"SMB2_22",
+		SMB2X_PROT_ID
+	},
+	{
+		SMB30_PROT,
+		"\2SMB 3.0",
+		"SMB3_00",
+		SMB30_PROT_ID
+	},
+	{
+		SMB302_PROT,
+		"\2SMB 3.02",
+		"SMB3_02",
+		SMB302_PROT_ID
+	},
+	{
+		SMB311_PROT,
+		"\2SMB 3.1.1",
+		"SMB3_11",
+		SMB311_PROT_ID
+	},
+};
+
+unsigned int ksmbd_server_side_copy_max_chunk_count(void)
+{
+	return 256;
+}
+
+unsigned int ksmbd_server_side_copy_max_chunk_size(void)
+{
+	return (2U << 30) - 1;
+}
+
+unsigned int ksmbd_server_side_copy_max_total_size(void)
+{
+	return (2U << 30) - 1;
+}
+
+inline int ksmbd_min_protocol(void)
+{
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	return SMB1_PROT;
+#else
+	return SMB2_PROT;
+#endif
+}
+
+inline int ksmbd_max_protocol(void)
+{
+	return SMB311_PROT;
+}
+
+int ksmbd_lookup_protocol_idx(char *str)
+{
+	int offt = ARRAY_SIZE(smb_protos) - 1;
+	int len = strlen(str);
+
+	while (offt >= 0) {
+		if (!strncmp(str, smb_protos[offt].prot, len)) {
+			ksmbd_debug(SMB, "selected %s dialect idx = %d\n",
+					smb_protos[offt].prot, offt);
+			return smb_protos[offt].index;
+		}
+		offt--;
+	}
+	return -1;
+}
+
+/**
+ * ksmbd_verify_smb_message() - check for valid smb2 request header
+ * @work:	smb work
+ *
+ * check for valid smb signature and packet direction(request/response)
+ *
+ * Return:      0 on success, otherwise 1
+ */
+int ksmbd_verify_smb_message(struct ksmbd_work *work)
+{
+	struct smb2_hdr *smb2_hdr = work->request_buf;
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	if (smb2_hdr->ProtocolId == SMB2_PROTO_NUMBER) {
+		ksmbd_debug(SMB, "got SMB2 command\n");
+		return ksmbd_smb2_check_message(work);
+	}
+
+	return ksmbd_smb1_check_message(work);
+#else
+	if (smb2_hdr->ProtocolId == SMB2_PROTO_NUMBER)
+		return ksmbd_smb2_check_message(work);
+
+	return 0;
+#endif
+}
+
+/**
+ * ksmbd_smb_request() - check for valid smb request type
+ * @conn:	connection instance
+ *
+ * Return:      true on success, otherwise false
+ */
+bool ksmbd_smb_request(struct ksmbd_conn *conn)
+{
+	int type = *(char *)conn->request_buf;
+
+	switch (type) {
+	case RFC1002_SESSION_MESSAGE:
+		/* Regular SMB request */
+		return true;
+	case RFC1002_SESSION_KEEP_ALIVE:
+		ksmbd_debug(SMB, "RFC 1002 session keep alive\n");
+		break;
+	default:
+		ksmbd_debug(SMB, "RFC 1002 unknown request type 0x%x\n", type);
+	}
+
+	return false;
+}
+
+static bool supported_protocol(int idx)
+{
+	if (idx == SMB2X_PROT &&
+	    (server_conf.min_protocol >= SMB21_PROT ||
+	     server_conf.max_protocol <= SMB311_PROT))
+		return true;
+
+	return (server_conf.min_protocol <= idx &&
+			idx <= server_conf.max_protocol);
+}
+
+static char *next_dialect(char *dialect, int *next_off)
+{
+	dialect = dialect + *next_off;
+	*next_off = strlen(dialect);
+	return dialect;
+}
+
+static int ksmbd_lookup_dialect_by_name(char *cli_dialects, __le16 byte_count)
+{
+	int i, seq_num, bcount, next;
+	char *dialect;
+
+	for (i = ARRAY_SIZE(smb_protos) - 1; i >= 0; i--) {
+		seq_num = 0;
+		next = 0;
+		dialect = cli_dialects;
+		bcount = le16_to_cpu(byte_count);
+		do {
+			dialect = next_dialect(dialect, &next);
+			ksmbd_debug(SMB, "client requested dialect %s\n",
+				dialect);
+			if (!strcmp(dialect, smb_protos[i].name)) {
+				if (supported_protocol(smb_protos[i].index)) {
+					ksmbd_debug(SMB,
+						"selected %s dialect\n",
+						smb_protos[i].name);
+					if (smb_protos[i].index == SMB1_PROT)
+						return seq_num;
+					return smb_protos[i].prot_id;
+				}
+			}
+			seq_num++;
+			bcount -= (++next);
+		} while (bcount > 0);
+	}
+
+	return BAD_PROT_ID;
+}
+
+int ksmbd_lookup_dialect_by_id(__le16 *cli_dialects, __le16 dialects_count)
+{
+	int i;
+	int count;
+
+	for (i = ARRAY_SIZE(smb_protos) - 1; i >= 0; i--) {
+		count = le16_to_cpu(dialects_count);
+		while (--count >= 0) {
+			ksmbd_debug(SMB, "client requested dialect 0x%x\n",
+				le16_to_cpu(cli_dialects[count]));
+			if (le16_to_cpu(cli_dialects[count]) !=
+					smb_protos[i].prot_id)
+				continue;
+
+			if (supported_protocol(smb_protos[i].index)) {
+				ksmbd_debug(SMB, "selected %s dialect\n",
+					smb_protos[i].name);
+				return smb_protos[i].prot_id;
+			}
+		}
+	}
+
+	return BAD_PROT_ID;
+}
+
+int ksmbd_negotiate_smb_dialect(void *buf)
+{
+	__le32 proto;
+
+	proto = ((struct smb2_hdr *)buf)->ProtocolId;
+	if (proto == SMB2_PROTO_NUMBER) {
+		struct smb2_negotiate_req *req;
+
+		req = (struct smb2_negotiate_req *)buf;
+		return ksmbd_lookup_dialect_by_id(req->Dialects,
+						  req->DialectCount);
+	}
+
+	proto = *(__le32 *)((struct smb_hdr *)buf)->Protocol;
+	if (proto == SMB1_PROTO_NUMBER) {
+		struct smb_negotiate_req *req;
+
+		req = (struct smb_negotiate_req *)buf;
+		return ksmbd_lookup_dialect_by_name(req->DialectsArray,
+						    req->ByteCount);
+	}
+
+	return BAD_PROT_ID;
+}
+
+#define SMB_COM_NEGOTIATE	0x72
+int ksmbd_init_smb_server(struct ksmbd_work *work)
+{
+	struct ksmbd_conn *conn = work->conn;
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	void *buf = work->request_buf;
+	__le32 proto;
+#endif
+
+	if (conn->need_neg == false)
+		return 0;
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	proto = *(__le32 *)((struct smb_hdr *)buf)->Protocol;
+	if (proto == SMB1_PROTO_NUMBER)
+		init_smb1_server(conn);
+	else
+		init_smb2_0_server(conn);
+#else
+	init_smb3_11_server(conn);
+#endif
+
+	if (conn->ops->get_cmd_val(work) != SMB_COM_NEGOTIATE)
+		conn->need_neg = false;
+	return 0;
+}
+
+bool ksmbd_pdu_size_has_room(unsigned int pdu)
+{
+	return (pdu >= KSMBD_MIN_SUPPORTED_HEADER_SIZE - 4);
+}
+
+int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, int info_level,
+		struct ksmbd_file *dir, struct ksmbd_dir_info *d_info,
+		char *search_pattern, int (*fn)(struct ksmbd_conn *, int,
+			struct ksmbd_dir_info *, struct ksmbd_kstat *))
+{
+	int i, rc = 0;
+	struct ksmbd_conn *conn = work->conn;
+
+	for (i = 0; i < 2; i++) {
+		struct kstat kstat;
+		struct ksmbd_kstat ksmbd_kstat;
+
+		if (!dir->dot_dotdot[i]) { /* fill dot entry info */
+			if (i == 0) {
+				d_info->name = ".";
+				d_info->name_len = 1;
+			} else {
+				d_info->name = "..";
+				d_info->name_len = 2;
+			}
+
+			if (!match_pattern(d_info->name, d_info->name_len,
+					   search_pattern)) {
+				dir->dot_dotdot[i] = 1;
+				continue;
+			}
+
+			ksmbd_kstat.kstat = &kstat;
+			ksmbd_vfs_fill_dentry_attrs(work,
+				dir->filp->f_path.dentry->d_parent,
+				&ksmbd_kstat);
+			rc = fn(conn, info_level, d_info, &ksmbd_kstat);
+			if (rc)
+				break;
+			if (d_info->out_buf_len <= 0)
+				break;
+
+			dir->dot_dotdot[i] = 1;
+			if (d_info->flags & SMB2_RETURN_SINGLE_ENTRY) {
+				d_info->out_buf_len = 0;
+				break;
+			}
+		}
+	}
+
+	return rc;
+}
+
+/**
+ * ksmbd_extract_shortname() - get shortname from long filename
+ * @conn:	connection instance
+ * @longname:	source long filename
+ * @shortname:	destination short filename
+ *
+ * Return:	shortname length or 0 when source long name is '.' or '..'
+ * TODO: Though this function comforms the restriction of 8.3 Filename spec,
+ * but the result is different with Windows 7's one. need to check.
+ */
+int ksmbd_extract_shortname(struct ksmbd_conn *conn, const char *longname,
+		char *shortname)
+{
+	const char *p;
+	char base[9], extension[4];
+	char out[13] = {0};
+	int baselen = 0;
+	int extlen = 0, len = 0;
+	unsigned int csum = 0;
+	const unsigned char *ptr;
+	bool dot_present = true;
+
+	p = longname;
+	if ((*p == '.') || (!(strcmp(p, "..")))) {
+		/*no mangling required */
+		return 0;
+	}
+
+	p = strrchr(longname, '.');
+	if (p == longname) { /*name starts with a dot*/
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 3, 0)
+		strcpy(extension, "___");
+		extension[3] = '\0';
+#else
+		strscpy(extension, "___", strlen("___"));
+#endif
+	} else {
+		if (p) {
+			p++;
+			while (*p && extlen < 3) {
+				if (*p != '.')
+					extension[extlen++] = toupper(*p);
+				p++;
+			}
+			extension[extlen] = '\0';
+		} else {
+			dot_present = false;
+		}
+	}
+
+	p = longname;
+	if (*p == '.') {
+		p++;
+		longname++;
+	}
+	while (*p && (baselen < 5)) {
+		if (*p != '.')
+			base[baselen++] = toupper(*p);
+		p++;
+	}
+
+	base[baselen] = MAGIC_CHAR;
+	memcpy(out, base, baselen + 1);
+
+	ptr = longname;
+	len = strlen(longname);
+	for (; len > 0; len--, ptr++)
+		csum += *ptr;
+
+	csum = csum % (MANGLE_BASE * MANGLE_BASE);
+	out[baselen + 1] = mangle(csum / MANGLE_BASE);
+	out[baselen + 2] = mangle(csum);
+	out[baselen + 3] = PERIOD;
+
+	if (dot_present)
+		memcpy(&out[baselen + 4], extension, 4);
+	else
+		out[baselen + 4] = '\0';
+	smbConvertToUTF16((__le16 *)shortname, out, PATH_MAX,
+			conn->local_nls, 0);
+	len = strlen(out) * 2;
+	return len;
+}
+
+static int __smb2_negotiate(struct ksmbd_conn *conn)
+{
+	return (conn->dialect >= SMB20_PROT_ID &&
+			conn->dialect <= SMB311_PROT_ID);
+}
+
+#ifndef CONFIG_SMB_INSECURE_SERVER
+static int smb_handle_negotiate(struct ksmbd_work *work)
+{
+	struct smb_negotiate_rsp *neg_rsp = work->response_buf;
+
+	ksmbd_debug(SMB, "Unsupported SMB protocol\n");
+	neg_rsp->hdr.Status.CifsError = STATUS_INVALID_LOGON_TYPE;
+	return -EINVAL;
+}
+#endif
+
+int ksmbd_smb_negotiate_common(struct ksmbd_work *work, unsigned int command)
+{
+	struct ksmbd_conn *conn = work->conn;
+	int ret;
+
+	conn->dialect = ksmbd_negotiate_smb_dialect(work->request_buf);
+	ksmbd_debug(SMB, "conn->dialect 0x%x\n", conn->dialect);
+
+	if (command == SMB2_NEGOTIATE_HE) {
+		struct smb2_hdr *smb2_hdr = work->request_buf;
+
+		if (smb2_hdr->ProtocolId != SMB2_PROTO_NUMBER) {
+			ksmbd_debug(SMB, "Downgrade to SMB1 negotiation\n");
+			command = SMB_COM_NEGOTIATE;
+		}
+	}
+
+	if (command == SMB2_NEGOTIATE_HE) {
+		ret = smb2_handle_negotiate(work);
+		init_smb2_neg_rsp(work);
+		return ret;
+	}
+
+	if (command == SMB_COM_NEGOTIATE) {
+		if (__smb2_negotiate(conn)) {
+			conn->need_neg = true;
+			init_smb3_11_server(conn);
+			init_smb2_neg_rsp(work);
+			ksmbd_debug(SMB, "Upgrade to SMB2 negotiation\n");
+			return 0;
+		}
+		return smb_handle_negotiate(work);
+	}
+
+	ksmbd_err("Unknown SMB negotiation command: %u\n", command);
+	return -EINVAL;
+}
+
+enum SHARED_MODE_ERRORS {
+	SHARE_DELETE_ERROR,
+	SHARE_READ_ERROR,
+	SHARE_WRITE_ERROR,
+	FILE_READ_ERROR,
+	FILE_WRITE_ERROR,
+	FILE_DELETE_ERROR,
+};
+
+static const char * const shared_mode_errors[] = {
+	"Current access mode does not permit SHARE_DELETE",
+	"Current access mode does not permit SHARE_READ",
+	"Current access mode does not permit SHARE_WRITE",
+	"Desired access mode does not permit FILE_READ",
+	"Desired access mode does not permit FILE_WRITE",
+	"Desired access mode does not permit FILE_DELETE",
+};
+
+static void smb_shared_mode_error(int error, struct ksmbd_file *prev_fp,
+		struct ksmbd_file *curr_fp)
+{
+	ksmbd_debug(SMB, "%s\n", shared_mode_errors[error]);
+	ksmbd_debug(SMB, "Current mode: 0x%x Desired mode: 0x%x\n",
+		  prev_fp->saccess, curr_fp->daccess);
+}
+
+int ksmbd_smb_check_shared_mode(struct file *filp, struct ksmbd_file *curr_fp)
+{
+	int rc = 0;
+	struct ksmbd_file *prev_fp;
+	struct list_head *cur;
+
+	/*
+	 * Lookup fp in master fp list, and check desired access and
+	 * shared mode between previous open and current open.
+	 */
+	read_lock(&curr_fp->f_ci->m_lock);
+	list_for_each(cur, &curr_fp->f_ci->m_fp_list) {
+		prev_fp = list_entry(cur, struct ksmbd_file, node);
+		if (file_inode(filp) != FP_INODE(prev_fp))
+			continue;
+
+		if (filp == prev_fp->filp)
+			continue;
+
+		if (ksmbd_stream_fd(prev_fp) && ksmbd_stream_fd(curr_fp))
+			if (strcmp(prev_fp->stream.name, curr_fp->stream.name))
+				continue;
+
+		if (prev_fp->is_durable) {
+			prev_fp->is_durable = 0;
+			continue;
+		}
+
+		if (prev_fp->attrib_only != curr_fp->attrib_only)
+			continue;
+
+		if (!(prev_fp->saccess & FILE_SHARE_DELETE_LE) &&
+		    curr_fp->daccess & FILE_DELETE_LE) {
+			smb_shared_mode_error(SHARE_DELETE_ERROR,
+					      prev_fp,
+					      curr_fp);
+			rc = -EPERM;
+			break;
+		}
+
+		/*
+		 * Only check FILE_SHARE_DELETE if stream opened and
+		 * normal file opened.
+		 */
+		if (ksmbd_stream_fd(prev_fp) && !ksmbd_stream_fd(curr_fp))
+			continue;
+
+		if (!(prev_fp->saccess & FILE_SHARE_READ_LE) &&
+		    curr_fp->daccess & (FILE_EXECUTE_LE | FILE_READ_DATA_LE)) {
+			smb_shared_mode_error(SHARE_READ_ERROR,
+					      prev_fp,
+					      curr_fp);
+			rc = -EPERM;
+			break;
+		}
+
+		if (!(prev_fp->saccess & FILE_SHARE_WRITE_LE) &&
+		    curr_fp->daccess & (FILE_WRITE_DATA_LE | FILE_APPEND_DATA_LE)) {
+			smb_shared_mode_error(SHARE_WRITE_ERROR,
+					      prev_fp,
+					      curr_fp);
+			rc = -EPERM;
+			break;
+		}
+
+		if (prev_fp->daccess & (FILE_EXECUTE_LE | FILE_READ_DATA_LE) &&
+		    !(curr_fp->saccess & FILE_SHARE_READ_LE)) {
+			smb_shared_mode_error(FILE_READ_ERROR,
+					      prev_fp,
+					      curr_fp);
+			rc = -EPERM;
+			break;
+		}
+
+		if (prev_fp->daccess & (FILE_WRITE_DATA_LE | FILE_APPEND_DATA_LE) &&
+		    !(curr_fp->saccess & FILE_SHARE_WRITE_LE)) {
+			smb_shared_mode_error(FILE_WRITE_ERROR,
+					      prev_fp,
+					      curr_fp);
+			rc = -EPERM;
+			break;
+		}
+
+		if (prev_fp->daccess & FILE_DELETE_LE &&
+		    !(curr_fp->saccess & FILE_SHARE_DELETE_LE)) {
+			smb_shared_mode_error(FILE_DELETE_ERROR,
+					      prev_fp,
+					      curr_fp);
+			rc = -EPERM;
+			break;
+		}
+	}
+	read_unlock(&curr_fp->f_ci->m_lock);
+
+	return rc;
+}
+
+bool is_asterisk(char *p)
+{
+	return p && p[0] == '*';
+}
+
+int ksmbd_override_fsids(struct ksmbd_work *work)
+{
+	struct ksmbd_session *sess = work->sess;
+	struct ksmbd_share_config *share = work->tcon->share_conf;
+	struct cred *cred;
+	struct group_info *gi;
+	unsigned int uid;
+	unsigned int gid;
+
+	uid = user_uid(sess->user);
+	gid = user_gid(sess->user);
+	if (share->force_uid != KSMBD_SHARE_INVALID_UID)
+		uid = share->force_uid;
+	if (share->force_gid != KSMBD_SHARE_INVALID_GID)
+		gid = share->force_gid;
+
+	cred = prepare_kernel_cred(NULL);
+	if (!cred)
+		return -ENOMEM;
+
+	cred->fsuid = make_kuid(current_user_ns(), uid);
+	cred->fsgid = make_kgid(current_user_ns(), gid);
+
+	gi = groups_alloc(0);
+	if (!gi) {
+		abort_creds(cred);
+		return -ENOMEM;
+	}
+	set_groups(cred, gi);
+	put_group_info(gi);
+
+	if (!uid_eq(cred->fsuid, GLOBAL_ROOT_UID))
+		cred->cap_effective = cap_drop_fs_set(cred->cap_effective);
+
+	WARN_ON(work->saved_cred);
+	work->saved_cred = override_creds(cred);
+	if (!work->saved_cred) {
+		abort_creds(cred);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+void ksmbd_revert_fsids(struct ksmbd_work *work)
+{
+	const struct cred *cred;
+
+	WARN_ON(!work->saved_cred);
+
+	cred = current_cred();
+	revert_creds(work->saved_cred);
+	put_cred(cred);
+	work->saved_cred = NULL;
+}
+
+__le32 smb_map_generic_desired_access(__le32 daccess)
+{
+	if (daccess & FILE_GENERIC_READ_LE) {
+		daccess |= cpu_to_le32(GENERIC_READ_FLAGS);
+		daccess &= ~FILE_GENERIC_READ_LE;
+	}
+
+	if (daccess & FILE_GENERIC_WRITE_LE) {
+		daccess |= cpu_to_le32(GENERIC_WRITE_FLAGS);
+		daccess &= ~FILE_GENERIC_WRITE_LE;
+	}
+
+	if (daccess & FILE_GENERIC_EXECUTE_LE) {
+		daccess |= cpu_to_le32(GENERIC_EXECUTE_FLAGS);
+		daccess &= ~FILE_GENERIC_EXECUTE_LE;
+	}
+
+	if (daccess & FILE_GENERIC_ALL_LE) {
+		daccess |= cpu_to_le32(GENERIC_ALL_FLAGS);
+		daccess &= ~FILE_GENERIC_ALL_LE;
+	}
+
+	return daccess;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smb_common.h linux-5.4.60-fbx/fs/cifsd/smb_common.h
--- linux-5.4.60-fbx/fs/cifsd./smb_common.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smb_common.h	2021-04-21 09:44:50.978505152 +0200
@@ -0,0 +1,544 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __SMB_COMMON_H__
+#define __SMB_COMMON_H__
+
+#include <linux/kernel.h>
+
+#include "glob.h"
+#include "nterr.h"
+#include "smb2pdu.h"
+
+/* ksmbd's Specific ERRNO */
+#define ESHARE			50000
+
+#define SMB1_PROT		0
+#define SMB2_PROT		1
+#define SMB21_PROT		2
+/* multi-protocol negotiate request */
+#define SMB2X_PROT		3
+#define SMB30_PROT		4
+#define SMB302_PROT		5
+#define SMB311_PROT		6
+#define BAD_PROT		0xFFFF
+
+#define SMB1_VERSION_STRING	"1.0"
+#define SMB20_VERSION_STRING	"2.0"
+#define SMB21_VERSION_STRING	"2.1"
+#define SMB30_VERSION_STRING	"3.0"
+#define SMB302_VERSION_STRING	"3.02"
+#define SMB311_VERSION_STRING	"3.1.1"
+
+/* Dialects */
+#define SMB10_PROT_ID		0x00
+#define SMB20_PROT_ID		0x0202
+#define SMB21_PROT_ID		0x0210
+/* multi-protocol negotiate request */
+#define SMB2X_PROT_ID		0x02FF
+#define SMB30_PROT_ID		0x0300
+#define SMB302_PROT_ID		0x0302
+#define SMB311_PROT_ID		0x0311
+#define BAD_PROT_ID		0xFFFF
+
+#define SMB_ECHO_INTERVAL	(60 * HZ)
+
+#define CIFS_DEFAULT_IOSIZE	(64 * 1024)
+#define MAX_CIFS_SMALL_BUFFER_SIZE 448 /* big enough for most */
+
+extern struct list_head global_lock_list;
+
+#define IS_SMB2(x)		((x)->vals->protocol_id != SMB10_PROT_ID)
+
+#define HEADER_SIZE(conn)		((conn)->vals->header_size)
+#define HEADER_SIZE_NO_BUF_LEN(conn)	((conn)->vals->header_size - 4)
+#define MAX_HEADER_SIZE(conn)		((conn)->vals->max_header_size)
+
+/* RFC 1002 session packet types */
+#define RFC1002_SESSION_MESSAGE			0x00
+#define RFC1002_SESSION_REQUEST			0x81
+#define RFC1002_POSITIVE_SESSION_RESPONSE	0x82
+#define RFC1002_NEGATIVE_SESSION_RESPONSE	0x83
+#define RFC1002_RETARGET_SESSION_RESPONSE	0x84
+#define RFC1002_SESSION_KEEP_ALIVE		0x85
+
+/* Responses when opening a file. */
+#define F_SUPERSEDED	0
+#define F_OPENED	1
+#define F_CREATED	2
+#define F_OVERWRITTEN	3
+
+/*
+ * File Attribute flags
+ */
+#define ATTR_READONLY			0x0001
+#define ATTR_HIDDEN			0x0002
+#define ATTR_SYSTEM			0x0004
+#define ATTR_VOLUME			0x0008
+#define ATTR_DIRECTORY			0x0010
+#define ATTR_ARCHIVE			0x0020
+#define ATTR_DEVICE			0x0040
+#define ATTR_NORMAL			0x0080
+#define ATTR_TEMPORARY			0x0100
+#define ATTR_SPARSE			0x0200
+#define ATTR_REPARSE			0x0400
+#define ATTR_COMPRESSED			0x0800
+#define ATTR_OFFLINE			0x1000
+#define ATTR_NOT_CONTENT_INDEXED	0x2000
+#define ATTR_ENCRYPTED			0x4000
+#define ATTR_POSIX_SEMANTICS		0x01000000
+#define ATTR_BACKUP_SEMANTICS		0x02000000
+#define ATTR_DELETE_ON_CLOSE		0x04000000
+#define ATTR_SEQUENTIAL_SCAN		0x08000000
+#define ATTR_RANDOM_ACCESS		0x10000000
+#define ATTR_NO_BUFFERING		0x20000000
+#define ATTR_WRITE_THROUGH		0x80000000
+
+#define ATTR_READONLY_LE		cpu_to_le32(ATTR_READONLY)
+#define ATTR_HIDDEN_LE			cpu_to_le32(ATTR_HIDDEN)
+#define ATTR_SYSTEM_LE			cpu_to_le32(ATTR_SYSTEM)
+#define ATTR_DIRECTORY_LE		cpu_to_le32(ATTR_DIRECTORY)
+#define ATTR_ARCHIVE_LE			cpu_to_le32(ATTR_ARCHIVE)
+#define ATTR_NORMAL_LE			cpu_to_le32(ATTR_NORMAL)
+#define ATTR_TEMPORARY_LE		cpu_to_le32(ATTR_TEMPORARY)
+#define ATTR_SPARSE_FILE_LE		cpu_to_le32(ATTR_SPARSE)
+#define ATTR_REPARSE_POINT_LE		cpu_to_le32(ATTR_REPARSE)
+#define ATTR_COMPRESSED_LE		cpu_to_le32(ATTR_COMPRESSED)
+#define ATTR_OFFLINE_LE			cpu_to_le32(ATTR_OFFLINE)
+#define ATTR_NOT_CONTENT_INDEXED_LE	cpu_to_le32(ATTR_NOT_CONTENT_INDEXED)
+#define ATTR_ENCRYPTED_LE		cpu_to_le32(ATTR_ENCRYPTED)
+#define ATTR_INTEGRITY_STREAML_LE	cpu_to_le32(0x00008000)
+#define ATTR_NO_SCRUB_DATA_LE		cpu_to_le32(0x00020000)
+#define ATTR_MASK_LE			cpu_to_le32(0x00007FB7)
+
+/* List of FileSystemAttributes - see 2.5.1 of MS-FSCC */
+#define FILE_SUPPORTS_SPARSE_VDL	0x10000000 /* faster nonsparse extend */
+#define FILE_SUPPORTS_BLOCK_REFCOUNTING	0x08000000 /* allow ioctl dup extents */
+#define FILE_SUPPORT_INTEGRITY_STREAMS	0x04000000
+#define FILE_SUPPORTS_USN_JOURNAL	0x02000000
+#define FILE_SUPPORTS_OPEN_BY_FILE_ID	0x01000000
+#define FILE_SUPPORTS_EXTENDED_ATTRIBUTES 0x00800000
+#define FILE_SUPPORTS_HARD_LINKS	0x00400000
+#define FILE_SUPPORTS_TRANSACTIONS	0x00200000
+#define FILE_SEQUENTIAL_WRITE_ONCE	0x00100000
+#define FILE_READ_ONLY_VOLUME		0x00080000
+#define FILE_NAMED_STREAMS		0x00040000
+#define FILE_SUPPORTS_ENCRYPTION	0x00020000
+#define FILE_SUPPORTS_OBJECT_IDS	0x00010000
+#define FILE_VOLUME_IS_COMPRESSED	0x00008000
+#define FILE_SUPPORTS_REMOTE_STORAGE	0x00000100
+#define FILE_SUPPORTS_REPARSE_POINTS	0x00000080
+#define FILE_SUPPORTS_SPARSE_FILES	0x00000040
+#define FILE_VOLUME_QUOTAS		0x00000020
+#define FILE_FILE_COMPRESSION		0x00000010
+#define FILE_PERSISTENT_ACLS		0x00000008
+#define FILE_UNICODE_ON_DISK		0x00000004
+#define FILE_CASE_PRESERVED_NAMES	0x00000002
+#define FILE_CASE_SENSITIVE_SEARCH	0x00000001
+
+#define FILE_READ_DATA        0x00000001  /* Data can be read from the file   */
+#define FILE_WRITE_DATA       0x00000002  /* Data can be written to the file  */
+#define FILE_APPEND_DATA      0x00000004  /* Data can be appended to the file */
+#define FILE_READ_EA          0x00000008  /* Extended attributes associated   */
+/* with the file can be read        */
+#define FILE_WRITE_EA         0x00000010  /* Extended attributes associated   */
+/* with the file can be written     */
+#define FILE_EXECUTE          0x00000020  /*Data can be read into memory from */
+/* the file using system paging I/O */
+#define FILE_DELETE_CHILD     0x00000040
+#define FILE_READ_ATTRIBUTES  0x00000080  /* Attributes associated with the   */
+/* file can be read                 */
+#define FILE_WRITE_ATTRIBUTES 0x00000100  /* Attributes associated with the   */
+/* file can be written              */
+#define DELETE                0x00010000  /* The file can be deleted          */
+#define READ_CONTROL          0x00020000  /* The access control list and      */
+/* ownership associated with the    */
+/* file can be read                 */
+#define WRITE_DAC             0x00040000  /* The access control list and      */
+/* ownership associated with the    */
+/* file can be written.             */
+#define WRITE_OWNER           0x00080000  /* Ownership information associated */
+/* with the file can be written     */
+#define SYNCHRONIZE           0x00100000  /* The file handle can waited on to */
+/* synchronize with the completion  */
+/* of an input/output request       */
+#define GENERIC_ALL           0x10000000
+#define GENERIC_EXECUTE       0x20000000
+#define GENERIC_WRITE         0x40000000
+#define GENERIC_READ          0x80000000
+/* In summary - Relevant file       */
+/* access flags from CIFS are       */
+/* file_read_data, file_write_data  */
+/* file_execute, file_read_attributes*/
+/* write_dac, and delete.           */
+
+#define FILE_READ_RIGHTS (FILE_READ_DATA | FILE_READ_EA | FILE_READ_ATTRIBUTES)
+#define FILE_WRITE_RIGHTS (FILE_WRITE_DATA | FILE_APPEND_DATA \
+		| FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES)
+#define FILE_EXEC_RIGHTS (FILE_EXECUTE)
+
+#define SET_FILE_READ_RIGHTS (FILE_READ_DATA | FILE_READ_EA \
+		| FILE_READ_ATTRIBUTES \
+		| DELETE | READ_CONTROL | WRITE_DAC \
+		| WRITE_OWNER | SYNCHRONIZE)
+#define SET_FILE_WRITE_RIGHTS (FILE_WRITE_DATA | FILE_APPEND_DATA \
+		| FILE_WRITE_EA \
+		| FILE_DELETE_CHILD \
+		| FILE_WRITE_ATTRIBUTES \
+		| DELETE | READ_CONTROL | WRITE_DAC \
+		| WRITE_OWNER | SYNCHRONIZE)
+#define SET_FILE_EXEC_RIGHTS (FILE_READ_EA | FILE_WRITE_EA | FILE_EXECUTE \
+		| FILE_READ_ATTRIBUTES \
+		| FILE_WRITE_ATTRIBUTES \
+		| DELETE | READ_CONTROL | WRITE_DAC \
+		| WRITE_OWNER | SYNCHRONIZE)
+
+#define SET_MINIMUM_RIGHTS (FILE_READ_EA | FILE_READ_ATTRIBUTES \
+		| READ_CONTROL | SYNCHRONIZE)
+
+/* generic flags for file open */
+#define GENERIC_READ_FLAGS	(READ_CONTROL | FILE_READ_DATA | \
+		FILE_READ_ATTRIBUTES | \
+		FILE_READ_EA | SYNCHRONIZE)
+
+#define GENERIC_WRITE_FLAGS	(READ_CONTROL | FILE_WRITE_DATA | \
+		FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA | \
+		FILE_APPEND_DATA | SYNCHRONIZE)
+
+#define GENERIC_EXECUTE_FLAGS	(READ_CONTROL | FILE_EXECUTE | \
+		FILE_READ_ATTRIBUTES | SYNCHRONIZE)
+
+#define GENERIC_ALL_FLAGS	(DELETE | READ_CONTROL | WRITE_DAC | \
+		WRITE_OWNER | SYNCHRONIZE | FILE_READ_DATA | \
+		FILE_WRITE_DATA | FILE_APPEND_DATA | \
+		FILE_READ_EA | FILE_WRITE_EA | \
+		FILE_EXECUTE | FILE_DELETE_CHILD | \
+		FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES)
+
+#define SMB1_PROTO_NUMBER		cpu_to_le32(0x424d53ff)
+
+#define SMB1_CLIENT_GUID_SIZE		(16)
+struct smb_hdr {
+	__be32 smb_buf_length;
+	__u8 Protocol[4];
+	__u8 Command;
+	union {
+		struct {
+			__u8 ErrorClass;
+			__u8 Reserved;
+			__le16 Error;
+		} __packed DosError;
+		__le32 CifsError;
+	} __packed Status;
+	__u8 Flags;
+	__le16 Flags2;          /* note: le */
+	__le16 PidHigh;
+	union {
+		struct {
+			__le32 SequenceNumber;  /* le */
+			__u32 Reserved; /* zero */
+		} __packed Sequence;
+		__u8 SecuritySignature[8];      /* le */
+	} __packed Signature;
+	__u8 pad[2];
+	__le16 Tid;
+	__le16 Pid;
+	__le16 Uid;
+	__le16 Mid;
+	__u8 WordCount;
+} __packed;
+
+struct smb_negotiate_req {
+	struct smb_hdr hdr;     /* wct = 0 */
+	__le16 ByteCount;
+	unsigned char DialectsArray[1];
+} __packed;
+
+struct smb_negotiate_rsp {
+	struct smb_hdr hdr;     /* wct = 17 */
+	__le16 DialectIndex; /* 0xFFFF = no dialect acceptable */
+	__u8 SecurityMode;
+	__le16 MaxMpxCount;
+	__le16 MaxNumberVcs;
+	__le32 MaxBufferSize;
+	__le32 MaxRawSize;
+	__le32 SessionKey;
+	__le32 Capabilities;    /* see below */
+	__le32 SystemTimeLow;
+	__le32 SystemTimeHigh;
+	__le16 ServerTimeZone;
+	__u8 EncryptionKeyLength;
+	__le16 ByteCount;
+	union {
+		unsigned char EncryptionKey[8]; /* cap extended security off */
+		/* followed by Domain name - if extended security is off */
+		/* followed by 16 bytes of server GUID */
+		/* then security blob if cap_extended_security negotiated */
+		struct {
+			unsigned char GUID[SMB1_CLIENT_GUID_SIZE];
+			unsigned char SecurityBlob[1];
+		} __packed extended_response;
+	} __packed u;
+} __packed;
+
+struct filesystem_attribute_info {
+	__le32 Attributes;
+	__le32 MaxPathNameComponentLength;
+	__le32 FileSystemNameLen;
+	__le16 FileSystemName[1]; /* do not have to save this - get subset? */
+} __packed;
+
+struct filesystem_device_info {
+	__le32 DeviceType;
+	__le32 DeviceCharacteristics;
+} __packed; /* device info level 0x104 */
+
+struct filesystem_vol_info {
+	__le64 VolumeCreationTime;
+	__le32 SerialNumber;
+	__le32 VolumeLabelSize;
+	__le16 Reserved;
+	__le16 VolumeLabel[1];
+} __packed;
+
+struct filesystem_info {
+	__le64 TotalAllocationUnits;
+	__le64 FreeAllocationUnits;
+	__le32 SectorsPerAllocationUnit;
+	__le32 BytesPerSector;
+} __packed;     /* size info, level 0x103 */
+
+#define EXTENDED_INFO_MAGIC 0x43667364	/* Cfsd */
+#define STRING_LENGTH 28
+
+struct fs_extended_info {
+	__le32 magic;
+	__le32 version;
+	__le32 release;
+	__u64 rel_date;
+	char    version_string[STRING_LENGTH];
+} __packed;
+
+struct object_id_info {
+	char objid[16];
+	struct fs_extended_info extended_info;
+} __packed;
+
+struct file_directory_info {
+	__le32 NextEntryOffset;
+	__u32 FileIndex;
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le64 EndOfFile;
+	__le64 AllocationSize;
+	__le32 ExtFileAttributes;
+	__le32 FileNameLength;
+	char FileName[1];
+} __packed;   /* level 0x101 FF resp data */
+
+struct file_names_info {
+	__le32 NextEntryOffset;
+	__u32 FileIndex;
+	__le32 FileNameLength;
+	char FileName[1];
+} __packed;   /* level 0xc FF resp data */
+
+struct file_full_directory_info {
+	__le32 NextEntryOffset;
+	__u32 FileIndex;
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le64 EndOfFile;
+	__le64 AllocationSize;
+	__le32 ExtFileAttributes;
+	__le32 FileNameLength;
+	__le32 EaSize;
+	char FileName[1];
+} __packed; /* level 0x102 FF resp */
+
+struct file_both_directory_info {
+	__le32 NextEntryOffset;
+	__u32 FileIndex;
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le64 EndOfFile;
+	__le64 AllocationSize;
+	__le32 ExtFileAttributes;
+	__le32 FileNameLength;
+	__le32 EaSize; /* length of the xattrs */
+	__u8   ShortNameLength;
+	__u8   Reserved;
+	__u8   ShortName[24];
+	char FileName[1];
+} __packed; /* level 0x104 FFrsp data */
+
+struct file_id_both_directory_info {
+	__le32 NextEntryOffset;
+	__u32 FileIndex;
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le64 EndOfFile;
+	__le64 AllocationSize;
+	__le32 ExtFileAttributes;
+	__le32 FileNameLength;
+	__le32 EaSize; /* length of the xattrs */
+	__u8   ShortNameLength;
+	__u8   Reserved;
+	__u8   ShortName[24];
+	__le16 Reserved2;
+	__le64 UniqueId;
+	char FileName[1];
+} __packed;
+
+struct file_id_full_dir_info {
+	__le32 NextEntryOffset;
+	__u32 FileIndex;
+	__le64 CreationTime;
+	__le64 LastAccessTime;
+	__le64 LastWriteTime;
+	__le64 ChangeTime;
+	__le64 EndOfFile;
+	__le64 AllocationSize;
+	__le32 ExtFileAttributes;
+	__le32 FileNameLength;
+	__le32 EaSize; /* EA size */
+	__le32 Reserved;
+	__le64 UniqueId; /* inode num - le since Samba puts ino in low 32 bit*/
+	char FileName[1];
+} __packed; /* level 0x105 FF rsp data */
+
+struct smb_version_values {
+	char		*version_string;
+	__u16		protocol_id;
+	__le16		lock_cmd;
+	__u32		capabilities;
+	__u32		max_read_size;
+	__u32		max_write_size;
+	__u32		max_trans_size;
+	__u32		large_lock_type;
+	__u32		exclusive_lock_type;
+	__u32		shared_lock_type;
+	__u32		unlock_lock_type;
+	size_t		header_size;
+	size_t		max_header_size;
+	size_t		read_rsp_size;
+	unsigned int	cap_unix;
+	unsigned int	cap_nt_find;
+	unsigned int	cap_large_files;
+	__u16		signing_enabled;
+	__u16		signing_required;
+	size_t		create_lease_size;
+	size_t		create_durable_size;
+	size_t		create_durable_v2_size;
+	size_t		create_mxac_size;
+	size_t		create_disk_id_size;
+	size_t		create_posix_size;
+};
+
+struct filesystem_posix_info {
+	/* For undefined recommended transfer size return -1 in that field */
+	__le32 OptimalTransferSize;  /* bsize on some os, iosize on other os */
+	__le32 BlockSize;
+	/* The next three fields are in terms of the block size.
+	 * (above). If block size is unknown, 4096 would be a
+	 * reasonable block size for a server to report.
+	 * Note that returning the blocks/blocksavail removes need
+	 * to make a second call (to QFSInfo level 0x103 to get this info.
+	 * UserBlockAvail is typically less than or equal to BlocksAvail,
+	 * if no distinction is made return the same value in each
+	 */
+	__le64 TotalBlocks;
+	__le64 BlocksAvail;       /* bfree */
+	__le64 UserBlocksAvail;   /* bavail */
+	/* For undefined Node fields or FSID return -1 */
+	__le64 TotalFileNodes;
+	__le64 FreeFileNodes;
+	__le64 FileSysIdentifier;   /* fsid */
+	/* NB Namelen comes from FILE_SYSTEM_ATTRIBUTE_INFO call */
+	/* NB flags can come from FILE_SYSTEM_DEVICE_INFO call   */
+} __packed;
+
+struct smb_version_ops {
+	uint16_t (*get_cmd_val)(struct ksmbd_work *swork);
+	int (*init_rsp_hdr)(struct ksmbd_work *swork);
+	void (*set_rsp_status)(struct ksmbd_work *swork, __le32 err);
+	int (*allocate_rsp_buf)(struct ksmbd_work *work);
+	int (*set_rsp_credits)(struct ksmbd_work *work);
+	int (*check_user_session)(struct ksmbd_work *work);
+	int (*get_ksmbd_tcon)(struct ksmbd_work *work);
+	bool (*is_sign_req)(struct ksmbd_work *work, unsigned int command);
+	int (*check_sign_req)(struct ksmbd_work *work);
+	void (*set_sign_rsp)(struct ksmbd_work *work);
+	int (*generate_signingkey)(struct ksmbd_session *sess);
+	int (*generate_encryptionkey)(struct ksmbd_session *sess);
+	int (*is_transform_hdr)(void *buf);
+	int (*decrypt_req)(struct ksmbd_work *work);
+	int (*encrypt_resp)(struct ksmbd_work *work);
+};
+
+struct smb_version_cmds {
+	int (*proc)(struct ksmbd_work *swork);
+};
+
+int ksmbd_min_protocol(void);
+int ksmbd_max_protocol(void);
+
+int ksmbd_lookup_protocol_idx(char *str);
+
+int ksmbd_verify_smb_message(struct ksmbd_work *work);
+bool ksmbd_smb_request(struct ksmbd_conn *conn);
+
+int ksmbd_lookup_dialect_by_id(__le16 *cli_dialects, __le16 dialects_count);
+
+int ksmbd_negotiate_smb_dialect(void *buf);
+int ksmbd_init_smb_server(struct ksmbd_work *work);
+
+bool ksmbd_pdu_size_has_room(unsigned int pdu);
+
+struct ksmbd_kstat;
+int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work,
+				      int info_level,
+				      struct ksmbd_file *dir,
+				      struct ksmbd_dir_info *d_info,
+				      char *search_pattern,
+				      int (*fn)(struct ksmbd_conn *,
+						int,
+						struct ksmbd_dir_info *,
+						struct ksmbd_kstat *));
+
+int ksmbd_extract_shortname(struct ksmbd_conn *conn,
+			    const char *longname,
+			    char *shortname);
+
+int ksmbd_smb_negotiate_common(struct ksmbd_work *work, unsigned int command);
+
+int ksmbd_smb_check_shared_mode(struct file *filp, struct ksmbd_file *curr_fp);
+int ksmbd_override_fsids(struct ksmbd_work *work);
+void ksmbd_revert_fsids(struct ksmbd_work *work);
+
+unsigned int ksmbd_server_side_copy_max_chunk_count(void);
+unsigned int ksmbd_server_side_copy_max_chunk_size(void);
+unsigned int ksmbd_server_side_copy_max_total_size(void);
+bool is_asterisk(char *p);
+__le32 smb_map_generic_desired_access(__le32 daccess);
+
+static inline unsigned int get_rfc1002_len(void *buf)
+{
+	return be32_to_cpu(*((__be32 *)buf)) & 0xffffff;
+}
+
+static inline void inc_rfc1001_len(void *buf, int count)
+{
+	be32_add_cpu((__be32 *)buf, count);
+}
+#endif /* __SMB_COMMON_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smberr.h linux-5.4.60-fbx/fs/cifsd/smberr.h
--- linux-5.4.60-fbx/fs/cifsd./smberr.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smberr.h	2021-03-30 15:48:29.605052529 +0200
@@ -0,0 +1,235 @@
+/* SPDX-License-Identifier: LGPL-2.1+ */
+/*
+ *   Copyright (c) International Business Machines  Corp., 2002,2004
+ *   Author(s): Steve French (sfrench@us.ibm.com)
+ *
+ *   See Error Codes section of the SNIA CIFS Specification
+ *   for more information
+ */
+#ifndef __KSMBD_SMBERR_H
+#define __KSMBD_SMBERR_H
+
+#define SUCCESS	0x00	/* The request was successful. */
+#define ERRDOS	0x01	/* Error is from the core DOS operating system set */
+#define ERRSRV	0x02	/* Error is generated by the file server daemon */
+#define ERRHRD	0x03	/* Error is a hardware error. */
+#define ERRCMD	0xFF	/* Command was not in the "SMB" format. */
+
+/* The following error codes may be generated with the SUCCESS error class.*/
+
+/*#define SUCCESS	0	The request was successful. */
+
+/* The following error codes may be generated with the ERRDOS error class.*/
+
+#define ERRbadfunc		1	/*
+					 * Invalid function. The server did not
+					 * recognize or could not perform a
+					 * system call generated by the server,
+					 * e.g., set the DIRECTORY attribute on
+					 * a data file, invalid seek mode.
+					 */
+#define ERRbadfile		2	/*
+					 * File not found. The last component
+					 * of a file's pathname could not be
+					 * found.
+					 */
+#define ERRbadpath		3	/*
+					 * Directory invalid. A directory
+					 * component in a pathname could not be
+					 * found.
+					 */
+#define ERRnofids		4	/*
+					 * Too many open files. The server has
+					 * no file handles available.
+					 */
+#define ERRnoaccess		5	/*
+					 * Access denied, the client's context
+					 * does not permit the requested
+					 * function. This includes the
+					 * following conditions: invalid rename
+					 * command, write to Fid open for read
+					 * only, read on Fid open for write
+					 * only, attempt to delete a non-empty
+					 * directory
+					 */
+#define ERRbadfid		6	/*
+					 * Invalid file handle. The file handle
+					 * specified was not recognized by the
+					 * server.
+					 */
+#define ERRbadmcb		7	/* Memory control blocks destroyed. */
+#define ERRnomem		8	/*
+					 * Insufficient server memory to
+					 * perform the requested function.
+					 */
+#define ERRbadmem		9	/* Invalid memory block address. */
+#define ERRbadenv		10	/* Invalid environment. */
+#define ERRbadformat		11	/* Invalid format. */
+#define ERRbadaccess		12	/* Invalid open mode. */
+#define ERRbaddata		13	/*
+					 * Invalid data (generated only by
+					 * IOCTL calls within the server).
+					 */
+#define ERRbaddrive		15	/* Invalid drive specified. */
+#define ERRremcd		16	/*
+					 * A Delete Directory request attempted
+					 * to remove the server's current
+					 * directory.
+					 */
+#define ERRdiffdevice		17	/*
+					 * Not same device (e.g., a cross
+					 * volume rename was attempted
+					 */
+#define ERRnofiles		18	/*
+					 * A File Search command can find no
+					 * more files matching the specified
+					 * criteria.
+					 */
+#define ERRwriteprot		19	/* media is write protected */
+#define ERRgeneral		31
+#define ERRbadshare		32	/*
+					 * The sharing mode specified for an
+					 * Open conflicts with existing FIDs on
+					 * the file.
+					 */
+#define ERRlock			33	/*
+					 * A Lock request conflicted with an
+					 * existing lock or specified an
+					 * invalid mode, or an Unlock requested
+					 * attempted to remove a lock held by
+					 * another process.
+					 */
+#define ERRunsup		50
+#define ERRnosuchshare		67
+#define ERRfilexists		80	/*
+					 * The file named in the request
+					 * already exists.
+					 */
+#define ERRinvparm		87
+#define ERRdiskfull		112
+#define ERRinvname		123
+#define ERRinvlevel		124
+#define ERRdirnotempty		145
+#define ERRnotlocked		158
+#define ERRcancelviolation	173
+#define ERRnoatomiclocks	174
+#define ERRalreadyexists	183
+#define ERRbadpipe		230
+#define ERRpipebusy		231
+#define ERRpipeclosing		232
+#define ERRnotconnected		233
+#define ERRmoredata		234
+#define ERReasnotsupported	282
+#define ErrQuota		0x200	/*
+					 * The operation would cause a quota
+					 * limit to be exceeded.
+					 */
+#define ErrNotALink		0x201	/*
+					 * A link operation was performed on a
+					 * pathname that was not a link.
+					 */
+
+/*
+ * Below errors are used internally (do not come over the wire) for passthrough
+ * from STATUS codes to POSIX only
+ */
+#define ERRsymlink              0xFFFD
+#define ErrTooManyLinks         0xFFFE
+
+/* Following error codes may be generated with the ERRSRV error class.*/
+
+#define ERRerror		1	/*
+					 * Non-specific error code. It is
+					 * returned under the following
+					 * conditions: resource other than disk
+					 * space exhausted (e.g. TIDs), first
+					 * SMB command was not negotiate,
+					 * multiple negotiates attempted, and
+					 * internal server error.
+					 */
+#define ERRbadpw		2	/*
+					 * Bad password - name/password pair in
+					 * a TreeConnect or Session Setup are
+					 * invalid.
+					 */
+#define ERRbadtype		3	/*
+					 * used for indicating DFS referral
+					 * needed
+					 */
+#define ERRaccess		4	/*
+					 * The client does not have the
+					 * necessary access rights within the
+					 * specified context for requested
+					 * function.
+					 */
+#define ERRinvtid		5	/*
+					 * The Tid specified in a command was
+					 * invalid.
+					 */
+#define ERRinvnetname		6	/*
+					 * Invalid network name in tree
+					 * connect.
+					 */
+#define ERRinvdevice		7	/*
+					 * Invalid device - printer request
+					 * made to non-printer connection or
+					 * non-printer request made to printer
+					 * connection.
+					 */
+#define ERRqfull		49	/*
+					 * Print queue full (files) -- returned
+					 * by open print file.
+					 */
+#define ERRqtoobig		50	/* Print queue full -- no space. */
+#define ERRqeof			51	/* EOF on print queue dump */
+#define ERRinvpfid		52	/* Invalid print file FID. */
+#define ERRsmbcmd		64	/*
+					 * The server did not recognize the
+					 * command received.
+					 */
+#define ERRsrverror		65	/*
+					 * The server encountered an internal
+					 * error, e.g., system file
+					 * unavailable.
+					 */
+#define ERRbadBID		66	/* (obsolete) */
+#define ERRfilespecs		67	/*
+					 * The Fid and pathname parameters
+					 * contained an invalid combination of
+					 * values.
+					 */
+#define ERRbadLink		68	/* (obsolete) */
+#define ERRbadpermits		69	/*
+					 * The access permissions specified for
+					 * a file or directory are not a valid
+					 * combination.
+					 */
+#define ERRbadPID		70
+#define ERRsetattrmode		71	/* attribute (mode) is invalid */
+#define ERRpaused		81	/* Server is paused */
+#define ERRmsgoff		82	/* reserved - messaging off */
+#define ERRnoroom		83	/* reserved - no room for message */
+#define ERRrmuns		87	/* reserved - too many remote names */
+#define ERRtimeout		88	/* operation timed out */
+#define ERRnoresource		89	/* No resources available for request */
+#define ERRtoomanyuids		90	/*
+					 * Too many UIDs active on this session
+					 */
+#define ERRbaduid		91	/*
+					 * The UID is not known as a valid user
+					 */
+#define ERRusempx		250	/* temporarily unable to use raw */
+#define ERRusestd		251	/*
+					 * temporarily unable to use either raw
+					 * or mpx
+					 */
+#define ERR_NOTIFY_ENUM_DIR	1024
+#define ERRnoSuchUser		2238	/* user account does not exist */
+#define ERRaccountexpired	2239
+#define ERRbadclient		2240	/* can not logon from this client */
+#define ERRbadLogonTime		2241	/* logon hours do not allow this */
+#define ERRpasswordExpired	2242
+#define ERRnetlogonNotStarted	2455
+#define ERRnosupport		0xFFFF
+
+#endif /* __KSMBD_SMBERR_H */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smbfsctl.h linux-5.4.60-fbx/fs/cifsd/smbfsctl.h
--- linux-5.4.60-fbx/fs/cifsd./smbfsctl.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smbfsctl.h	2021-03-30 15:48:29.605052529 +0200
@@ -0,0 +1,90 @@
+/* SPDX-License-Identifier: LGPL-2.1+ */
+/*
+ *   fs/cifs/smbfsctl.h: SMB, CIFS, SMB2 FSCTL definitions
+ *
+ *   Copyright (c) International Business Machines  Corp., 2002,2009
+ *   Author(s): Steve French (sfrench@us.ibm.com)
+ */
+
+/* IOCTL information */
+/*
+ * List of ioctl/fsctl function codes that are or could be useful in the
+ * future to remote clients like cifs or SMB2 client.  There is probably
+ * a slightly larger set of fsctls that NTFS local filesystem could handle,
+ * including the seven below that we do not have struct definitions for.
+ * Even with protocol definitions for most of these now available, we still
+ * need to do some experimentation to identify which are practical to do
+ * remotely.  Some of the following, such as the encryption/compression ones
+ * could be invoked from tools via a specialized hook into the VFS rather
+ * than via the standard vfs entry points
+ */
+
+#ifndef __KSMBD_SMBFSCTL_H
+#define __KSMBD_SMBFSCTL_H
+
+#define FSCTL_DFS_GET_REFERRALS      0x00060194
+#define FSCTL_DFS_GET_REFERRALS_EX   0x000601B0
+#define FSCTL_REQUEST_OPLOCK_LEVEL_1 0x00090000
+#define FSCTL_REQUEST_OPLOCK_LEVEL_2 0x00090004
+#define FSCTL_REQUEST_BATCH_OPLOCK   0x00090008
+#define FSCTL_LOCK_VOLUME            0x00090018
+#define FSCTL_UNLOCK_VOLUME          0x0009001C
+#define FSCTL_IS_PATHNAME_VALID      0x0009002C /* BB add struct */
+#define FSCTL_GET_COMPRESSION        0x0009003C /* BB add struct */
+#define FSCTL_SET_COMPRESSION        0x0009C040 /* BB add struct */
+#define FSCTL_QUERY_FAT_BPB          0x00090058 /* BB add struct */
+/* Verify the next FSCTL number, we had it as 0x00090090 before */
+#define FSCTL_FILESYSTEM_GET_STATS   0x00090060 /* BB add struct */
+#define FSCTL_GET_NTFS_VOLUME_DATA   0x00090064 /* BB add struct */
+#define FSCTL_GET_RETRIEVAL_POINTERS 0x00090073 /* BB add struct */
+#define FSCTL_IS_VOLUME_DIRTY        0x00090078 /* BB add struct */
+#define FSCTL_ALLOW_EXTENDED_DASD_IO 0x00090083 /* BB add struct */
+#define FSCTL_REQUEST_FILTER_OPLOCK  0x0009008C
+#define FSCTL_FIND_FILES_BY_SID      0x0009008F /* BB add struct */
+#define FSCTL_SET_OBJECT_ID          0x00090098 /* BB add struct */
+#define FSCTL_GET_OBJECT_ID          0x0009009C /* BB add struct */
+#define FSCTL_DELETE_OBJECT_ID       0x000900A0 /* BB add struct */
+#define FSCTL_SET_REPARSE_POINT      0x000900A4 /* BB add struct */
+#define FSCTL_GET_REPARSE_POINT      0x000900A8 /* BB add struct */
+#define FSCTL_DELETE_REPARSE_POINT   0x000900AC /* BB add struct */
+#define FSCTL_SET_OBJECT_ID_EXTENDED 0x000900BC /* BB add struct */
+#define FSCTL_CREATE_OR_GET_OBJECT_ID 0x000900C0 /* BB add struct */
+#define FSCTL_SET_SPARSE             0x000900C4 /* BB add struct */
+#define FSCTL_SET_ZERO_DATA          0x000980C8 /* BB add struct */
+#define FSCTL_SET_ENCRYPTION         0x000900D7 /* BB add struct */
+#define FSCTL_ENCRYPTION_FSCTL_IO    0x000900DB /* BB add struct */
+#define FSCTL_WRITE_RAW_ENCRYPTED    0x000900DF /* BB add struct */
+#define FSCTL_READ_RAW_ENCRYPTED     0x000900E3 /* BB add struct */
+#define FSCTL_READ_FILE_USN_DATA     0x000900EB /* BB add struct */
+#define FSCTL_WRITE_USN_CLOSE_RECORD 0x000900EF /* BB add struct */
+#define FSCTL_SIS_COPYFILE           0x00090100 /* BB add struct */
+#define FSCTL_RECALL_FILE            0x00090117 /* BB add struct */
+#define FSCTL_QUERY_SPARING_INFO     0x00090138 /* BB add struct */
+#define FSCTL_SET_ZERO_ON_DEALLOC    0x00090194 /* BB add struct */
+#define FSCTL_SET_SHORT_NAME_BEHAVIOR 0x000901B4 /* BB add struct */
+#define FSCTL_QUERY_ALLOCATED_RANGES 0x000940CF /* BB add struct */
+#define FSCTL_SET_DEFECT_MANAGEMENT  0x00098134 /* BB add struct */
+#define FSCTL_SIS_LINK_FILES         0x0009C104
+#define FSCTL_PIPE_PEEK              0x0011400C /* BB add struct */
+#define FSCTL_PIPE_TRANSCEIVE        0x0011C017 /* BB add struct */
+/* strange that the number for this op is not sequential with previous op */
+#define FSCTL_PIPE_WAIT              0x00110018 /* BB add struct */
+#define FSCTL_REQUEST_RESUME_KEY     0x00140078
+#define FSCTL_LMR_GET_LINK_TRACK_INF 0x001400E8 /* BB add struct */
+#define FSCTL_LMR_SET_LINK_TRACK_INF 0x001400EC /* BB add struct */
+#define FSCTL_VALIDATE_NEGOTIATE_INFO 0x00140204
+#define FSCTL_QUERY_NETWORK_INTERFACE_INFO 0x001401FC
+#define FSCTL_COPYCHUNK              0x001440F2
+#define FSCTL_COPYCHUNK_WRITE        0x001480F2
+
+#define IO_REPARSE_TAG_MOUNT_POINT   0xA0000003
+#define IO_REPARSE_TAG_HSM           0xC0000004
+#define IO_REPARSE_TAG_SIS           0x80000007
+
+/* WSL reparse tags */
+#define IO_REPARSE_TAG_LX_SYMLINK_LE	cpu_to_le32(0xA000001D)
+#define IO_REPARSE_TAG_AF_UNIX_LE	cpu_to_le32(0x80000023)
+#define IO_REPARSE_TAG_LX_FIFO_LE	cpu_to_le32(0x80000024)
+#define IO_REPARSE_TAG_LX_CHR_LE	cpu_to_le32(0x80000025)
+#define IO_REPARSE_TAG_LX_BLK_LE	cpu_to_le32(0x80000026)
+#endif /* __KSMBD_SMBFSCTL_H */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./smbstatus.h linux-5.4.60-fbx/fs/cifsd/smbstatus.h
--- linux-5.4.60-fbx/fs/cifsd./smbstatus.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/smbstatus.h	2021-03-30 15:48:29.605052529 +0200
@@ -0,0 +1,1822 @@
+/* SPDX-License-Identifier: LGPL-2.1+ */
+/*
+ *   fs/cifs/smb2status.h
+ *
+ *   SMB2 Status code (network error) definitions
+ *   Definitions are from MS-ERREF
+ *
+ *   Copyright (c) International Business Machines  Corp., 2009,2011
+ *   Author(s): Steve French (sfrench@us.ibm.com)
+ */
+
+/*
+ *  0 1 2 3 4 5 6 7 8 9 0 A B C D E F 0 1 2 3 4 5 6 7 8 9 A B C D E F
+ *  SEV C N <-------Facility--------> <------Error Status Code------>
+ *
+ *  C is set if "customer defined" error, N bit is reserved and MBZ
+ */
+
+#define STATUS_SEVERITY_SUCCESS cpu_to_le32(0x0000)
+#define STATUS_SEVERITY_INFORMATIONAL cpu_to_le32(0x0001)
+#define STATUS_SEVERITY_WARNING cpu_to_le32(0x0002)
+#define STATUS_SEVERITY_ERROR cpu_to_le32(0x0003)
+
+struct ntstatus {
+	/* Facility is the high 12 bits of the following field */
+	__le32 Facility; /* low 2 bits Severity, next is Customer, then rsrvd */
+	__le32 Code;
+};
+
+#define STATUS_SUCCESS 0x00000000
+#define STATUS_WAIT_0 cpu_to_le32(0x00000000)
+#define STATUS_WAIT_1 cpu_to_le32(0x00000001)
+#define STATUS_WAIT_2 cpu_to_le32(0x00000002)
+#define STATUS_WAIT_3 cpu_to_le32(0x00000003)
+#define STATUS_WAIT_63 cpu_to_le32(0x0000003F)
+#define STATUS_ABANDONED cpu_to_le32(0x00000080)
+#define STATUS_ABANDONED_WAIT_0 cpu_to_le32(0x00000080)
+#define STATUS_ABANDONED_WAIT_63 cpu_to_le32(0x000000BF)
+#define STATUS_USER_APC cpu_to_le32(0x000000C0)
+#define STATUS_KERNEL_APC cpu_to_le32(0x00000100)
+#define STATUS_ALERTED cpu_to_le32(0x00000101)
+#define STATUS_TIMEOUT cpu_to_le32(0x00000102)
+#define STATUS_PENDING cpu_to_le32(0x00000103)
+#define STATUS_REPARSE cpu_to_le32(0x00000104)
+#define STATUS_MORE_ENTRIES cpu_to_le32(0x00000105)
+#define STATUS_NOT_ALL_ASSIGNED cpu_to_le32(0x00000106)
+#define STATUS_SOME_NOT_MAPPED cpu_to_le32(0x00000107)
+#define STATUS_OPLOCK_BREAK_IN_PROGRESS cpu_to_le32(0x00000108)
+#define STATUS_VOLUME_MOUNTED cpu_to_le32(0x00000109)
+#define STATUS_RXACT_COMMITTED cpu_to_le32(0x0000010A)
+#define STATUS_NOTIFY_CLEANUP cpu_to_le32(0x0000010B)
+#define STATUS_NOTIFY_ENUM_DIR cpu_to_le32(0x0000010C)
+#define STATUS_NO_QUOTAS_FOR_ACCOUNT cpu_to_le32(0x0000010D)
+#define STATUS_PRIMARY_TRANSPORT_CONNECT_FAILED cpu_to_le32(0x0000010E)
+#define STATUS_PAGE_FAULT_TRANSITION cpu_to_le32(0x00000110)
+#define STATUS_PAGE_FAULT_DEMAND_ZERO cpu_to_le32(0x00000111)
+#define STATUS_PAGE_FAULT_COPY_ON_WRITE cpu_to_le32(0x00000112)
+#define STATUS_PAGE_FAULT_GUARD_PAGE cpu_to_le32(0x00000113)
+#define STATUS_PAGE_FAULT_PAGING_FILE cpu_to_le32(0x00000114)
+#define STATUS_CACHE_PAGE_LOCKED cpu_to_le32(0x00000115)
+#define STATUS_CRASH_DUMP cpu_to_le32(0x00000116)
+#define STATUS_BUFFER_ALL_ZEROS cpu_to_le32(0x00000117)
+#define STATUS_REPARSE_OBJECT cpu_to_le32(0x00000118)
+#define STATUS_RESOURCE_REQUIREMENTS_CHANGED cpu_to_le32(0x00000119)
+#define STATUS_TRANSLATION_COMPLETE cpu_to_le32(0x00000120)
+#define STATUS_DS_MEMBERSHIP_EVALUATED_LOCALLY cpu_to_le32(0x00000121)
+#define STATUS_NOTHING_TO_TERMINATE cpu_to_le32(0x00000122)
+#define STATUS_PROCESS_NOT_IN_JOB cpu_to_le32(0x00000123)
+#define STATUS_PROCESS_IN_JOB cpu_to_le32(0x00000124)
+#define STATUS_VOLSNAP_HIBERNATE_READY cpu_to_le32(0x00000125)
+#define STATUS_FSFILTER_OP_COMPLETED_SUCCESSFULLY cpu_to_le32(0x00000126)
+#define STATUS_INTERRUPT_VECTOR_ALREADY_CONNECTED cpu_to_le32(0x00000127)
+#define STATUS_INTERRUPT_STILL_CONNECTED cpu_to_le32(0x00000128)
+#define STATUS_PROCESS_CLONED cpu_to_le32(0x00000129)
+#define STATUS_FILE_LOCKED_WITH_ONLY_READERS cpu_to_le32(0x0000012A)
+#define STATUS_FILE_LOCKED_WITH_WRITERS cpu_to_le32(0x0000012B)
+#define STATUS_RESOURCEMANAGER_READ_ONLY cpu_to_le32(0x00000202)
+#define STATUS_WAIT_FOR_OPLOCK cpu_to_le32(0x00000367)
+#define DBG_EXCEPTION_HANDLED cpu_to_le32(0x00010001)
+#define DBG_CONTINUE cpu_to_le32(0x00010002)
+#define STATUS_FLT_IO_COMPLETE cpu_to_le32(0x001C0001)
+#define STATUS_OBJECT_NAME_EXISTS cpu_to_le32(0x40000000)
+#define STATUS_THREAD_WAS_SUSPENDED cpu_to_le32(0x40000001)
+#define STATUS_WORKING_SET_LIMIT_RANGE cpu_to_le32(0x40000002)
+#define STATUS_IMAGE_NOT_AT_BASE cpu_to_le32(0x40000003)
+#define STATUS_RXACT_STATE_CREATED cpu_to_le32(0x40000004)
+#define STATUS_SEGMENT_NOTIFICATION cpu_to_le32(0x40000005)
+#define STATUS_LOCAL_USER_SESSION_KEY cpu_to_le32(0x40000006)
+#define STATUS_BAD_CURRENT_DIRECTORY cpu_to_le32(0x40000007)
+#define STATUS_SERIAL_MORE_WRITES cpu_to_le32(0x40000008)
+#define STATUS_REGISTRY_RECOVERED cpu_to_le32(0x40000009)
+#define STATUS_FT_READ_RECOVERY_FROM_BACKUP cpu_to_le32(0x4000000A)
+#define STATUS_FT_WRITE_RECOVERY cpu_to_le32(0x4000000B)
+#define STATUS_SERIAL_COUNTER_TIMEOUT cpu_to_le32(0x4000000C)
+#define STATUS_NULL_LM_PASSWORD cpu_to_le32(0x4000000D)
+#define STATUS_IMAGE_MACHINE_TYPE_MISMATCH cpu_to_le32(0x4000000E)
+#define STATUS_RECEIVE_PARTIAL cpu_to_le32(0x4000000F)
+#define STATUS_RECEIVE_EXPEDITED cpu_to_le32(0x40000010)
+#define STATUS_RECEIVE_PARTIAL_EXPEDITED cpu_to_le32(0x40000011)
+#define STATUS_EVENT_DONE cpu_to_le32(0x40000012)
+#define STATUS_EVENT_PENDING cpu_to_le32(0x40000013)
+#define STATUS_CHECKING_FILE_SYSTEM cpu_to_le32(0x40000014)
+#define STATUS_FATAL_APP_EXIT cpu_to_le32(0x40000015)
+#define STATUS_PREDEFINED_HANDLE cpu_to_le32(0x40000016)
+#define STATUS_WAS_UNLOCKED cpu_to_le32(0x40000017)
+#define STATUS_SERVICE_NOTIFICATION cpu_to_le32(0x40000018)
+#define STATUS_WAS_LOCKED cpu_to_le32(0x40000019)
+#define STATUS_LOG_HARD_ERROR cpu_to_le32(0x4000001A)
+#define STATUS_ALREADY_WIN32 cpu_to_le32(0x4000001B)
+#define STATUS_WX86_UNSIMULATE cpu_to_le32(0x4000001C)
+#define STATUS_WX86_CONTINUE cpu_to_le32(0x4000001D)
+#define STATUS_WX86_SINGLE_STEP cpu_to_le32(0x4000001E)
+#define STATUS_WX86_BREAKPOINT cpu_to_le32(0x4000001F)
+#define STATUS_WX86_EXCEPTION_CONTINUE cpu_to_le32(0x40000020)
+#define STATUS_WX86_EXCEPTION_LASTCHANCE cpu_to_le32(0x40000021)
+#define STATUS_WX86_EXCEPTION_CHAIN cpu_to_le32(0x40000022)
+#define STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE cpu_to_le32(0x40000023)
+#define STATUS_NO_YIELD_PERFORMED cpu_to_le32(0x40000024)
+#define STATUS_TIMER_RESUME_IGNORED cpu_to_le32(0x40000025)
+#define STATUS_ARBITRATION_UNHANDLED cpu_to_le32(0x40000026)
+#define STATUS_CARDBUS_NOT_SUPPORTED cpu_to_le32(0x40000027)
+#define STATUS_WX86_CREATEWX86TIB cpu_to_le32(0x40000028)
+#define STATUS_MP_PROCESSOR_MISMATCH cpu_to_le32(0x40000029)
+#define STATUS_HIBERNATED cpu_to_le32(0x4000002A)
+#define STATUS_RESUME_HIBERNATION cpu_to_le32(0x4000002B)
+#define STATUS_FIRMWARE_UPDATED cpu_to_le32(0x4000002C)
+#define STATUS_DRIVERS_LEAKING_LOCKED_PAGES cpu_to_le32(0x4000002D)
+#define STATUS_MESSAGE_RETRIEVED cpu_to_le32(0x4000002E)
+#define STATUS_SYSTEM_POWERSTATE_TRANSITION cpu_to_le32(0x4000002F)
+#define STATUS_ALPC_CHECK_COMPLETION_LIST cpu_to_le32(0x40000030)
+#define STATUS_SYSTEM_POWERSTATE_COMPLEX_TRANSITION cpu_to_le32(0x40000031)
+#define STATUS_ACCESS_AUDIT_BY_POLICY cpu_to_le32(0x40000032)
+#define STATUS_ABANDON_HIBERFILE cpu_to_le32(0x40000033)
+#define STATUS_BIZRULES_NOT_ENABLED cpu_to_le32(0x40000034)
+#define STATUS_WAKE_SYSTEM cpu_to_le32(0x40000294)
+#define STATUS_DS_SHUTTING_DOWN cpu_to_le32(0x40000370)
+#define DBG_REPLY_LATER cpu_to_le32(0x40010001)
+#define DBG_UNABLE_TO_PROVIDE_HANDLE cpu_to_le32(0x40010002)
+#define DBG_TERMINATE_THREAD cpu_to_le32(0x40010003)
+#define DBG_TERMINATE_PROCESS cpu_to_le32(0x40010004)
+#define DBG_CONTROL_C cpu_to_le32(0x40010005)
+#define DBG_PRINTEXCEPTION_C cpu_to_le32(0x40010006)
+#define DBG_RIPEXCEPTION cpu_to_le32(0x40010007)
+#define DBG_CONTROL_BREAK cpu_to_le32(0x40010008)
+#define DBG_COMMAND_EXCEPTION cpu_to_le32(0x40010009)
+#define RPC_NT_UUID_LOCAL_ONLY cpu_to_le32(0x40020056)
+#define RPC_NT_SEND_INCOMPLETE cpu_to_le32(0x400200AF)
+#define STATUS_CTX_CDM_CONNECT cpu_to_le32(0x400A0004)
+#define STATUS_CTX_CDM_DISCONNECT cpu_to_le32(0x400A0005)
+#define STATUS_SXS_RELEASE_ACTIVATION_CONTEXT cpu_to_le32(0x4015000D)
+#define STATUS_RECOVERY_NOT_NEEDED cpu_to_le32(0x40190034)
+#define STATUS_RM_ALREADY_STARTED cpu_to_le32(0x40190035)
+#define STATUS_LOG_NO_RESTART cpu_to_le32(0x401A000C)
+#define STATUS_VIDEO_DRIVER_DEBUG_REPORT_REQUEST cpu_to_le32(0x401B00EC)
+#define STATUS_GRAPHICS_PARTIAL_DATA_POPULATED cpu_to_le32(0x401E000A)
+#define STATUS_GRAPHICS_DRIVER_MISMATCH cpu_to_le32(0x401E0117)
+#define STATUS_GRAPHICS_MODE_NOT_PINNED cpu_to_le32(0x401E0307)
+#define STATUS_GRAPHICS_NO_PREFERRED_MODE cpu_to_le32(0x401E031E)
+#define STATUS_GRAPHICS_DATASET_IS_EMPTY cpu_to_le32(0x401E034B)
+#define STATUS_GRAPHICS_NO_MORE_ELEMENTS_IN_DATASET cpu_to_le32(0x401E034C)
+#define STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_PINNED	\
+	cpu_to_le32(0x401E0351)
+#define STATUS_GRAPHICS_UNKNOWN_CHILD_STATUS cpu_to_le32(0x401E042F)
+#define STATUS_GRAPHICS_LEADLINK_START_DEFERRED cpu_to_le32(0x401E0437)
+#define STATUS_GRAPHICS_POLLING_TOO_FREQUENTLY cpu_to_le32(0x401E0439)
+#define STATUS_GRAPHICS_START_DEFERRED cpu_to_le32(0x401E043A)
+#define STATUS_NDIS_INDICATION_REQUIRED cpu_to_le32(0x40230001)
+#define STATUS_GUARD_PAGE_VIOLATION cpu_to_le32(0x80000001)
+#define STATUS_DATATYPE_MISALIGNMENT cpu_to_le32(0x80000002)
+#define STATUS_BREAKPOINT cpu_to_le32(0x80000003)
+#define STATUS_SINGLE_STEP cpu_to_le32(0x80000004)
+#define STATUS_BUFFER_OVERFLOW cpu_to_le32(0x80000005)
+#define STATUS_NO_MORE_FILES cpu_to_le32(0x80000006)
+#define STATUS_WAKE_SYSTEM_DEBUGGER cpu_to_le32(0x80000007)
+#define STATUS_HANDLES_CLOSED cpu_to_le32(0x8000000A)
+#define STATUS_NO_INHERITANCE cpu_to_le32(0x8000000B)
+#define STATUS_GUID_SUBSTITUTION_MADE cpu_to_le32(0x8000000C)
+#define STATUS_PARTIAL_COPY cpu_to_le32(0x8000000D)
+#define STATUS_DEVICE_PAPER_EMPTY cpu_to_le32(0x8000000E)
+#define STATUS_DEVICE_POWERED_OFF cpu_to_le32(0x8000000F)
+#define STATUS_DEVICE_OFF_LINE cpu_to_le32(0x80000010)
+#define STATUS_DEVICE_BUSY cpu_to_le32(0x80000011)
+#define STATUS_NO_MORE_EAS cpu_to_le32(0x80000012)
+#define STATUS_INVALID_EA_NAME cpu_to_le32(0x80000013)
+#define STATUS_EA_LIST_INCONSISTENT cpu_to_le32(0x80000014)
+#define STATUS_INVALID_EA_FLAG cpu_to_le32(0x80000015)
+#define STATUS_VERIFY_REQUIRED cpu_to_le32(0x80000016)
+#define STATUS_EXTRANEOUS_INFORMATION cpu_to_le32(0x80000017)
+#define STATUS_RXACT_COMMIT_NECESSARY cpu_to_le32(0x80000018)
+#define STATUS_NO_MORE_ENTRIES cpu_to_le32(0x8000001A)
+#define STATUS_FILEMARK_DETECTED cpu_to_le32(0x8000001B)
+#define STATUS_MEDIA_CHANGED cpu_to_le32(0x8000001C)
+#define STATUS_BUS_RESET cpu_to_le32(0x8000001D)
+#define STATUS_END_OF_MEDIA cpu_to_le32(0x8000001E)
+#define STATUS_BEGINNING_OF_MEDIA cpu_to_le32(0x8000001F)
+#define STATUS_MEDIA_CHECK cpu_to_le32(0x80000020)
+#define STATUS_SETMARK_DETECTED cpu_to_le32(0x80000021)
+#define STATUS_NO_DATA_DETECTED cpu_to_le32(0x80000022)
+#define STATUS_REDIRECTOR_HAS_OPEN_HANDLES cpu_to_le32(0x80000023)
+#define STATUS_SERVER_HAS_OPEN_HANDLES cpu_to_le32(0x80000024)
+#define STATUS_ALREADY_DISCONNECTED cpu_to_le32(0x80000025)
+#define STATUS_LONGJUMP cpu_to_le32(0x80000026)
+#define STATUS_CLEANER_CARTRIDGE_INSTALLED cpu_to_le32(0x80000027)
+#define STATUS_PLUGPLAY_QUERY_VETOED cpu_to_le32(0x80000028)
+#define STATUS_UNWIND_CONSOLIDATE cpu_to_le32(0x80000029)
+#define STATUS_REGISTRY_HIVE_RECOVERED cpu_to_le32(0x8000002A)
+#define STATUS_DLL_MIGHT_BE_INSECURE cpu_to_le32(0x8000002B)
+#define STATUS_DLL_MIGHT_BE_INCOMPATIBLE cpu_to_le32(0x8000002C)
+#define STATUS_STOPPED_ON_SYMLINK cpu_to_le32(0x8000002D)
+#define STATUS_DEVICE_REQUIRES_CLEANING cpu_to_le32(0x80000288)
+#define STATUS_DEVICE_DOOR_OPEN cpu_to_le32(0x80000289)
+#define STATUS_DATA_LOST_REPAIR cpu_to_le32(0x80000803)
+#define DBG_EXCEPTION_NOT_HANDLED cpu_to_le32(0x80010001)
+#define STATUS_CLUSTER_NODE_ALREADY_UP cpu_to_le32(0x80130001)
+#define STATUS_CLUSTER_NODE_ALREADY_DOWN cpu_to_le32(0x80130002)
+#define STATUS_CLUSTER_NETWORK_ALREADY_ONLINE cpu_to_le32(0x80130003)
+#define STATUS_CLUSTER_NETWORK_ALREADY_OFFLINE cpu_to_le32(0x80130004)
+#define STATUS_CLUSTER_NODE_ALREADY_MEMBER cpu_to_le32(0x80130005)
+#define STATUS_COULD_NOT_RESIZE_LOG cpu_to_le32(0x80190009)
+#define STATUS_NO_TXF_METADATA cpu_to_le32(0x80190029)
+#define STATUS_CANT_RECOVER_WITH_HANDLE_OPEN cpu_to_le32(0x80190031)
+#define STATUS_TXF_METADATA_ALREADY_PRESENT cpu_to_le32(0x80190041)
+#define STATUS_TRANSACTION_SCOPE_CALLBACKS_NOT_SET cpu_to_le32(0x80190042)
+#define STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD_RECOVERED	\
+	cpu_to_le32(0x801B00EB)
+#define STATUS_FLT_BUFFER_TOO_SMALL cpu_to_le32(0x801C0001)
+#define STATUS_FVE_PARTIAL_METADATA cpu_to_le32(0x80210001)
+#define STATUS_UNSUCCESSFUL cpu_to_le32(0xC0000001)
+#define STATUS_NOT_IMPLEMENTED cpu_to_le32(0xC0000002)
+#define STATUS_INVALID_INFO_CLASS cpu_to_le32(0xC0000003)
+#define STATUS_INFO_LENGTH_MISMATCH cpu_to_le32(0xC0000004)
+#define STATUS_ACCESS_VIOLATION cpu_to_le32(0xC0000005)
+#define STATUS_IN_PAGE_ERROR cpu_to_le32(0xC0000006)
+#define STATUS_PAGEFILE_QUOTA cpu_to_le32(0xC0000007)
+#define STATUS_INVALID_HANDLE cpu_to_le32(0xC0000008)
+#define STATUS_BAD_INITIAL_STACK cpu_to_le32(0xC0000009)
+#define STATUS_BAD_INITIAL_PC cpu_to_le32(0xC000000A)
+#define STATUS_INVALID_CID cpu_to_le32(0xC000000B)
+#define STATUS_TIMER_NOT_CANCELED cpu_to_le32(0xC000000C)
+#define STATUS_INVALID_PARAMETER cpu_to_le32(0xC000000D)
+#define STATUS_NO_SUCH_DEVICE cpu_to_le32(0xC000000E)
+#define STATUS_NO_SUCH_FILE cpu_to_le32(0xC000000F)
+#define STATUS_INVALID_DEVICE_REQUEST cpu_to_le32(0xC0000010)
+#define STATUS_END_OF_FILE cpu_to_le32(0xC0000011)
+#define STATUS_WRONG_VOLUME cpu_to_le32(0xC0000012)
+#define STATUS_NO_MEDIA_IN_DEVICE cpu_to_le32(0xC0000013)
+#define STATUS_UNRECOGNIZED_MEDIA cpu_to_le32(0xC0000014)
+#define STATUS_NONEXISTENT_SECTOR cpu_to_le32(0xC0000015)
+#define STATUS_MORE_PROCESSING_REQUIRED cpu_to_le32(0xC0000016)
+#define STATUS_NO_MEMORY cpu_to_le32(0xC0000017)
+#define STATUS_CONFLICTING_ADDRESSES cpu_to_le32(0xC0000018)
+#define STATUS_NOT_MAPPED_VIEW cpu_to_le32(0xC0000019)
+#define STATUS_UNABLE_TO_FREE_VM cpu_to_le32(0xC000001A)
+#define STATUS_UNABLE_TO_DELETE_SECTION cpu_to_le32(0xC000001B)
+#define STATUS_INVALID_SYSTEM_SERVICE cpu_to_le32(0xC000001C)
+#define STATUS_ILLEGAL_INSTRUCTION cpu_to_le32(0xC000001D)
+#define STATUS_INVALID_LOCK_SEQUENCE cpu_to_le32(0xC000001E)
+#define STATUS_INVALID_VIEW_SIZE cpu_to_le32(0xC000001F)
+#define STATUS_INVALID_FILE_FOR_SECTION cpu_to_le32(0xC0000020)
+#define STATUS_ALREADY_COMMITTED cpu_to_le32(0xC0000021)
+#define STATUS_ACCESS_DENIED cpu_to_le32(0xC0000022)
+#define STATUS_BUFFER_TOO_SMALL cpu_to_le32(0xC0000023)
+#define STATUS_OBJECT_TYPE_MISMATCH cpu_to_le32(0xC0000024)
+#define STATUS_NONCONTINUABLE_EXCEPTION cpu_to_le32(0xC0000025)
+#define STATUS_INVALID_DISPOSITION cpu_to_le32(0xC0000026)
+#define STATUS_UNWIND cpu_to_le32(0xC0000027)
+#define STATUS_BAD_STACK cpu_to_le32(0xC0000028)
+#define STATUS_INVALID_UNWIND_TARGET cpu_to_le32(0xC0000029)
+#define STATUS_NOT_LOCKED cpu_to_le32(0xC000002A)
+#define STATUS_PARITY_ERROR cpu_to_le32(0xC000002B)
+#define STATUS_UNABLE_TO_DECOMMIT_VM cpu_to_le32(0xC000002C)
+#define STATUS_NOT_COMMITTED cpu_to_le32(0xC000002D)
+#define STATUS_INVALID_PORT_ATTRIBUTES cpu_to_le32(0xC000002E)
+#define STATUS_PORT_MESSAGE_TOO_LONG cpu_to_le32(0xC000002F)
+#define STATUS_INVALID_PARAMETER_MIX cpu_to_le32(0xC0000030)
+#define STATUS_INVALID_QUOTA_LOWER cpu_to_le32(0xC0000031)
+#define STATUS_DISK_CORRUPT_ERROR cpu_to_le32(0xC0000032)
+#define STATUS_OBJECT_NAME_INVALID cpu_to_le32(0xC0000033)
+#define STATUS_OBJECT_NAME_NOT_FOUND cpu_to_le32(0xC0000034)
+#define STATUS_OBJECT_NAME_COLLISION cpu_to_le32(0xC0000035)
+#define STATUS_PORT_DISCONNECTED cpu_to_le32(0xC0000037)
+#define STATUS_DEVICE_ALREADY_ATTACHED cpu_to_le32(0xC0000038)
+#define STATUS_OBJECT_PATH_INVALID cpu_to_le32(0xC0000039)
+#define STATUS_OBJECT_PATH_NOT_FOUND cpu_to_le32(0xC000003A)
+#define STATUS_OBJECT_PATH_SYNTAX_BAD cpu_to_le32(0xC000003B)
+#define STATUS_DATA_OVERRUN cpu_to_le32(0xC000003C)
+#define STATUS_DATA_LATE_ERROR cpu_to_le32(0xC000003D)
+#define STATUS_DATA_ERROR cpu_to_le32(0xC000003E)
+#define STATUS_CRC_ERROR cpu_to_le32(0xC000003F)
+#define STATUS_SECTION_TOO_BIG cpu_to_le32(0xC0000040)
+#define STATUS_PORT_CONNECTION_REFUSED cpu_to_le32(0xC0000041)
+#define STATUS_INVALID_PORT_HANDLE cpu_to_le32(0xC0000042)
+#define STATUS_SHARING_VIOLATION cpu_to_le32(0xC0000043)
+#define STATUS_QUOTA_EXCEEDED cpu_to_le32(0xC0000044)
+#define STATUS_INVALID_PAGE_PROTECTION cpu_to_le32(0xC0000045)
+#define STATUS_MUTANT_NOT_OWNED cpu_to_le32(0xC0000046)
+#define STATUS_SEMAPHORE_LIMIT_EXCEEDED cpu_to_le32(0xC0000047)
+#define STATUS_PORT_ALREADY_SET cpu_to_le32(0xC0000048)
+#define STATUS_SECTION_NOT_IMAGE cpu_to_le32(0xC0000049)
+#define STATUS_SUSPEND_COUNT_EXCEEDED cpu_to_le32(0xC000004A)
+#define STATUS_THREAD_IS_TERMINATING cpu_to_le32(0xC000004B)
+#define STATUS_BAD_WORKING_SET_LIMIT cpu_to_le32(0xC000004C)
+#define STATUS_INCOMPATIBLE_FILE_MAP cpu_to_le32(0xC000004D)
+#define STATUS_SECTION_PROTECTION cpu_to_le32(0xC000004E)
+#define STATUS_EAS_NOT_SUPPORTED cpu_to_le32(0xC000004F)
+#define STATUS_EA_TOO_LARGE cpu_to_le32(0xC0000050)
+#define STATUS_NONEXISTENT_EA_ENTRY cpu_to_le32(0xC0000051)
+#define STATUS_NO_EAS_ON_FILE cpu_to_le32(0xC0000052)
+#define STATUS_EA_CORRUPT_ERROR cpu_to_le32(0xC0000053)
+#define STATUS_FILE_LOCK_CONFLICT cpu_to_le32(0xC0000054)
+#define STATUS_LOCK_NOT_GRANTED cpu_to_le32(0xC0000055)
+#define STATUS_DELETE_PENDING cpu_to_le32(0xC0000056)
+#define STATUS_CTL_FILE_NOT_SUPPORTED cpu_to_le32(0xC0000057)
+#define STATUS_UNKNOWN_REVISION cpu_to_le32(0xC0000058)
+#define STATUS_REVISION_MISMATCH cpu_to_le32(0xC0000059)
+#define STATUS_INVALID_OWNER cpu_to_le32(0xC000005A)
+#define STATUS_INVALID_PRIMARY_GROUP cpu_to_le32(0xC000005B)
+#define STATUS_NO_IMPERSONATION_TOKEN cpu_to_le32(0xC000005C)
+#define STATUS_CANT_DISABLE_MANDATORY cpu_to_le32(0xC000005D)
+#define STATUS_NO_LOGON_SERVERS cpu_to_le32(0xC000005E)
+#define STATUS_NO_SUCH_LOGON_SESSION cpu_to_le32(0xC000005F)
+#define STATUS_NO_SUCH_PRIVILEGE cpu_to_le32(0xC0000060)
+#define STATUS_PRIVILEGE_NOT_HELD cpu_to_le32(0xC0000061)
+#define STATUS_INVALID_ACCOUNT_NAME cpu_to_le32(0xC0000062)
+#define STATUS_USER_EXISTS cpu_to_le32(0xC0000063)
+#define STATUS_NO_SUCH_USER cpu_to_le32(0xC0000064)
+#define STATUS_GROUP_EXISTS cpu_to_le32(0xC0000065)
+#define STATUS_NO_SUCH_GROUP cpu_to_le32(0xC0000066)
+#define STATUS_MEMBER_IN_GROUP cpu_to_le32(0xC0000067)
+#define STATUS_MEMBER_NOT_IN_GROUP cpu_to_le32(0xC0000068)
+#define STATUS_LAST_ADMIN cpu_to_le32(0xC0000069)
+#define STATUS_WRONG_PASSWORD cpu_to_le32(0xC000006A)
+#define STATUS_ILL_FORMED_PASSWORD cpu_to_le32(0xC000006B)
+#define STATUS_PASSWORD_RESTRICTION cpu_to_le32(0xC000006C)
+#define STATUS_LOGON_FAILURE cpu_to_le32(0xC000006D)
+#define STATUS_ACCOUNT_RESTRICTION cpu_to_le32(0xC000006E)
+#define STATUS_INVALID_LOGON_HOURS cpu_to_le32(0xC000006F)
+#define STATUS_INVALID_WORKSTATION cpu_to_le32(0xC0000070)
+#define STATUS_PASSWORD_EXPIRED cpu_to_le32(0xC0000071)
+#define STATUS_ACCOUNT_DISABLED cpu_to_le32(0xC0000072)
+#define STATUS_NONE_MAPPED cpu_to_le32(0xC0000073)
+#define STATUS_TOO_MANY_LUIDS_REQUESTED cpu_to_le32(0xC0000074)
+#define STATUS_LUIDS_EXHAUSTED cpu_to_le32(0xC0000075)
+#define STATUS_INVALID_SUB_AUTHORITY cpu_to_le32(0xC0000076)
+#define STATUS_INVALID_ACL cpu_to_le32(0xC0000077)
+#define STATUS_INVALID_SID cpu_to_le32(0xC0000078)
+#define STATUS_INVALID_SECURITY_DESCR cpu_to_le32(0xC0000079)
+#define STATUS_PROCEDURE_NOT_FOUND cpu_to_le32(0xC000007A)
+#define STATUS_INVALID_IMAGE_FORMAT cpu_to_le32(0xC000007B)
+#define STATUS_NO_TOKEN cpu_to_le32(0xC000007C)
+#define STATUS_BAD_INHERITANCE_ACL cpu_to_le32(0xC000007D)
+#define STATUS_RANGE_NOT_LOCKED cpu_to_le32(0xC000007E)
+#define STATUS_DISK_FULL cpu_to_le32(0xC000007F)
+#define STATUS_SERVER_DISABLED cpu_to_le32(0xC0000080)
+#define STATUS_SERVER_NOT_DISABLED cpu_to_le32(0xC0000081)
+#define STATUS_TOO_MANY_GUIDS_REQUESTED cpu_to_le32(0xC0000082)
+#define STATUS_GUIDS_EXHAUSTED cpu_to_le32(0xC0000083)
+#define STATUS_INVALID_ID_AUTHORITY cpu_to_le32(0xC0000084)
+#define STATUS_AGENTS_EXHAUSTED cpu_to_le32(0xC0000085)
+#define STATUS_INVALID_VOLUME_LABEL cpu_to_le32(0xC0000086)
+#define STATUS_SECTION_NOT_EXTENDED cpu_to_le32(0xC0000087)
+#define STATUS_NOT_MAPPED_DATA cpu_to_le32(0xC0000088)
+#define STATUS_RESOURCE_DATA_NOT_FOUND cpu_to_le32(0xC0000089)
+#define STATUS_RESOURCE_TYPE_NOT_FOUND cpu_to_le32(0xC000008A)
+#define STATUS_RESOURCE_NAME_NOT_FOUND cpu_to_le32(0xC000008B)
+#define STATUS_ARRAY_BOUNDS_EXCEEDED cpu_to_le32(0xC000008C)
+#define STATUS_FLOAT_DENORMAL_OPERAND cpu_to_le32(0xC000008D)
+#define STATUS_FLOAT_DIVIDE_BY_ZERO cpu_to_le32(0xC000008E)
+#define STATUS_FLOAT_INEXACT_RESULT cpu_to_le32(0xC000008F)
+#define STATUS_FLOAT_INVALID_OPERATION cpu_to_le32(0xC0000090)
+#define STATUS_FLOAT_OVERFLOW cpu_to_le32(0xC0000091)
+#define STATUS_FLOAT_STACK_CHECK cpu_to_le32(0xC0000092)
+#define STATUS_FLOAT_UNDERFLOW cpu_to_le32(0xC0000093)
+#define STATUS_INTEGER_DIVIDE_BY_ZERO cpu_to_le32(0xC0000094)
+#define STATUS_INTEGER_OVERFLOW cpu_to_le32(0xC0000095)
+#define STATUS_PRIVILEGED_INSTRUCTION cpu_to_le32(0xC0000096)
+#define STATUS_TOO_MANY_PAGING_FILES cpu_to_le32(0xC0000097)
+#define STATUS_FILE_INVALID cpu_to_le32(0xC0000098)
+#define STATUS_ALLOTTED_SPACE_EXCEEDED cpu_to_le32(0xC0000099)
+#define STATUS_INSUFFICIENT_RESOURCES cpu_to_le32(0xC000009A)
+#define STATUS_DFS_EXIT_PATH_FOUND cpu_to_le32(0xC000009B)
+#define STATUS_DEVICE_DATA_ERROR cpu_to_le32(0xC000009C)
+#define STATUS_DEVICE_NOT_CONNECTED cpu_to_le32(0xC000009D)
+#define STATUS_DEVICE_POWER_FAILURE cpu_to_le32(0xC000009E)
+#define STATUS_FREE_VM_NOT_AT_BASE cpu_to_le32(0xC000009F)
+#define STATUS_MEMORY_NOT_ALLOCATED cpu_to_le32(0xC00000A0)
+#define STATUS_WORKING_SET_QUOTA cpu_to_le32(0xC00000A1)
+#define STATUS_MEDIA_WRITE_PROTECTED cpu_to_le32(0xC00000A2)
+#define STATUS_DEVICE_NOT_READY cpu_to_le32(0xC00000A3)
+#define STATUS_INVALID_GROUP_ATTRIBUTES cpu_to_le32(0xC00000A4)
+#define STATUS_BAD_IMPERSONATION_LEVEL cpu_to_le32(0xC00000A5)
+#define STATUS_CANT_OPEN_ANONYMOUS cpu_to_le32(0xC00000A6)
+#define STATUS_BAD_VALIDATION_CLASS cpu_to_le32(0xC00000A7)
+#define STATUS_BAD_TOKEN_TYPE cpu_to_le32(0xC00000A8)
+#define STATUS_BAD_MASTER_BOOT_RECORD cpu_to_le32(0xC00000A9)
+#define STATUS_INSTRUCTION_MISALIGNMENT cpu_to_le32(0xC00000AA)
+#define STATUS_INSTANCE_NOT_AVAILABLE cpu_to_le32(0xC00000AB)
+#define STATUS_PIPE_NOT_AVAILABLE cpu_to_le32(0xC00000AC)
+#define STATUS_INVALID_PIPE_STATE cpu_to_le32(0xC00000AD)
+#define STATUS_PIPE_BUSY cpu_to_le32(0xC00000AE)
+#define STATUS_ILLEGAL_FUNCTION cpu_to_le32(0xC00000AF)
+#define STATUS_PIPE_DISCONNECTED cpu_to_le32(0xC00000B0)
+#define STATUS_PIPE_CLOSING cpu_to_le32(0xC00000B1)
+#define STATUS_PIPE_CONNECTED cpu_to_le32(0xC00000B2)
+#define STATUS_PIPE_LISTENING cpu_to_le32(0xC00000B3)
+#define STATUS_INVALID_READ_MODE cpu_to_le32(0xC00000B4)
+#define STATUS_IO_TIMEOUT cpu_to_le32(0xC00000B5)
+#define STATUS_FILE_FORCED_CLOSED cpu_to_le32(0xC00000B6)
+#define STATUS_PROFILING_NOT_STARTED cpu_to_le32(0xC00000B7)
+#define STATUS_PROFILING_NOT_STOPPED cpu_to_le32(0xC00000B8)
+#define STATUS_COULD_NOT_INTERPRET cpu_to_le32(0xC00000B9)
+#define STATUS_FILE_IS_A_DIRECTORY cpu_to_le32(0xC00000BA)
+#define STATUS_NOT_SUPPORTED cpu_to_le32(0xC00000BB)
+#define STATUS_REMOTE_NOT_LISTENING cpu_to_le32(0xC00000BC)
+#define STATUS_DUPLICATE_NAME cpu_to_le32(0xC00000BD)
+#define STATUS_BAD_NETWORK_PATH cpu_to_le32(0xC00000BE)
+#define STATUS_NETWORK_BUSY cpu_to_le32(0xC00000BF)
+#define STATUS_DEVICE_DOES_NOT_EXIST cpu_to_le32(0xC00000C0)
+#define STATUS_TOO_MANY_COMMANDS cpu_to_le32(0xC00000C1)
+#define STATUS_ADAPTER_HARDWARE_ERROR cpu_to_le32(0xC00000C2)
+#define STATUS_INVALID_NETWORK_RESPONSE cpu_to_le32(0xC00000C3)
+#define STATUS_UNEXPECTED_NETWORK_ERROR cpu_to_le32(0xC00000C4)
+#define STATUS_BAD_REMOTE_ADAPTER cpu_to_le32(0xC00000C5)
+#define STATUS_PRINT_QUEUE_FULL cpu_to_le32(0xC00000C6)
+#define STATUS_NO_SPOOL_SPACE cpu_to_le32(0xC00000C7)
+#define STATUS_PRINT_CANCELLED cpu_to_le32(0xC00000C8)
+#define STATUS_NETWORK_NAME_DELETED cpu_to_le32(0xC00000C9)
+#define STATUS_NETWORK_ACCESS_DENIED cpu_to_le32(0xC00000CA)
+#define STATUS_BAD_DEVICE_TYPE cpu_to_le32(0xC00000CB)
+#define STATUS_BAD_NETWORK_NAME cpu_to_le32(0xC00000CC)
+#define STATUS_TOO_MANY_NAMES cpu_to_le32(0xC00000CD)
+#define STATUS_TOO_MANY_SESSIONS cpu_to_le32(0xC00000CE)
+#define STATUS_SHARING_PAUSED cpu_to_le32(0xC00000CF)
+#define STATUS_REQUEST_NOT_ACCEPTED cpu_to_le32(0xC00000D0)
+#define STATUS_REDIRECTOR_PAUSED cpu_to_le32(0xC00000D1)
+#define STATUS_NET_WRITE_FAULT cpu_to_le32(0xC00000D2)
+#define STATUS_PROFILING_AT_LIMIT cpu_to_le32(0xC00000D3)
+#define STATUS_NOT_SAME_DEVICE cpu_to_le32(0xC00000D4)
+#define STATUS_FILE_RENAMED cpu_to_le32(0xC00000D5)
+#define STATUS_VIRTUAL_CIRCUIT_CLOSED cpu_to_le32(0xC00000D6)
+#define STATUS_NO_SECURITY_ON_OBJECT cpu_to_le32(0xC00000D7)
+#define STATUS_CANT_WAIT cpu_to_le32(0xC00000D8)
+#define STATUS_PIPE_EMPTY cpu_to_le32(0xC00000D9)
+#define STATUS_CANT_ACCESS_DOMAIN_INFO cpu_to_le32(0xC00000DA)
+#define STATUS_CANT_TERMINATE_SELF cpu_to_le32(0xC00000DB)
+#define STATUS_INVALID_SERVER_STATE cpu_to_le32(0xC00000DC)
+#define STATUS_INVALID_DOMAIN_STATE cpu_to_le32(0xC00000DD)
+#define STATUS_INVALID_DOMAIN_ROLE cpu_to_le32(0xC00000DE)
+#define STATUS_NO_SUCH_DOMAIN cpu_to_le32(0xC00000DF)
+#define STATUS_DOMAIN_EXISTS cpu_to_le32(0xC00000E0)
+#define STATUS_DOMAIN_LIMIT_EXCEEDED cpu_to_le32(0xC00000E1)
+#define STATUS_OPLOCK_NOT_GRANTED cpu_to_le32(0xC00000E2)
+#define STATUS_INVALID_OPLOCK_PROTOCOL cpu_to_le32(0xC00000E3)
+#define STATUS_INTERNAL_DB_CORRUPTION cpu_to_le32(0xC00000E4)
+#define STATUS_INTERNAL_ERROR cpu_to_le32(0xC00000E5)
+#define STATUS_GENERIC_NOT_MAPPED cpu_to_le32(0xC00000E6)
+#define STATUS_BAD_DESCRIPTOR_FORMAT cpu_to_le32(0xC00000E7)
+#define STATUS_INVALID_USER_BUFFER cpu_to_le32(0xC00000E8)
+#define STATUS_UNEXPECTED_IO_ERROR cpu_to_le32(0xC00000E9)
+#define STATUS_UNEXPECTED_MM_CREATE_ERR cpu_to_le32(0xC00000EA)
+#define STATUS_UNEXPECTED_MM_MAP_ERROR cpu_to_le32(0xC00000EB)
+#define STATUS_UNEXPECTED_MM_EXTEND_ERR cpu_to_le32(0xC00000EC)
+#define STATUS_NOT_LOGON_PROCESS cpu_to_le32(0xC00000ED)
+#define STATUS_LOGON_SESSION_EXISTS cpu_to_le32(0xC00000EE)
+#define STATUS_INVALID_PARAMETER_1 cpu_to_le32(0xC00000EF)
+#define STATUS_INVALID_PARAMETER_2 cpu_to_le32(0xC00000F0)
+#define STATUS_INVALID_PARAMETER_3 cpu_to_le32(0xC00000F1)
+#define STATUS_INVALID_PARAMETER_4 cpu_to_le32(0xC00000F2)
+#define STATUS_INVALID_PARAMETER_5 cpu_to_le32(0xC00000F3)
+#define STATUS_INVALID_PARAMETER_6 cpu_to_le32(0xC00000F4)
+#define STATUS_INVALID_PARAMETER_7 cpu_to_le32(0xC00000F5)
+#define STATUS_INVALID_PARAMETER_8 cpu_to_le32(0xC00000F6)
+#define STATUS_INVALID_PARAMETER_9 cpu_to_le32(0xC00000F7)
+#define STATUS_INVALID_PARAMETER_10 cpu_to_le32(0xC00000F8)
+#define STATUS_INVALID_PARAMETER_11 cpu_to_le32(0xC00000F9)
+#define STATUS_INVALID_PARAMETER_12 cpu_to_le32(0xC00000FA)
+#define STATUS_REDIRECTOR_NOT_STARTED cpu_to_le32(0xC00000FB)
+#define STATUS_REDIRECTOR_STARTED cpu_to_le32(0xC00000FC)
+#define STATUS_STACK_OVERFLOW cpu_to_le32(0xC00000FD)
+#define STATUS_NO_SUCH_PACKAGE cpu_to_le32(0xC00000FE)
+#define STATUS_BAD_FUNCTION_TABLE cpu_to_le32(0xC00000FF)
+#define STATUS_VARIABLE_NOT_FOUND cpu_to_le32(0xC0000100)
+#define STATUS_DIRECTORY_NOT_EMPTY cpu_to_le32(0xC0000101)
+#define STATUS_FILE_CORRUPT_ERROR cpu_to_le32(0xC0000102)
+#define STATUS_NOT_A_DIRECTORY cpu_to_le32(0xC0000103)
+#define STATUS_BAD_LOGON_SESSION_STATE cpu_to_le32(0xC0000104)
+#define STATUS_LOGON_SESSION_COLLISION cpu_to_le32(0xC0000105)
+#define STATUS_NAME_TOO_LONG cpu_to_le32(0xC0000106)
+#define STATUS_FILES_OPEN cpu_to_le32(0xC0000107)
+#define STATUS_CONNECTION_IN_USE cpu_to_le32(0xC0000108)
+#define STATUS_MESSAGE_NOT_FOUND cpu_to_le32(0xC0000109)
+#define STATUS_PROCESS_IS_TERMINATING cpu_to_le32(0xC000010A)
+#define STATUS_INVALID_LOGON_TYPE cpu_to_le32(0xC000010B)
+#define STATUS_NO_GUID_TRANSLATION cpu_to_le32(0xC000010C)
+#define STATUS_CANNOT_IMPERSONATE cpu_to_le32(0xC000010D)
+#define STATUS_IMAGE_ALREADY_LOADED cpu_to_le32(0xC000010E)
+#define STATUS_ABIOS_NOT_PRESENT cpu_to_le32(0xC000010F)
+#define STATUS_ABIOS_LID_NOT_EXIST cpu_to_le32(0xC0000110)
+#define STATUS_ABIOS_LID_ALREADY_OWNED cpu_to_le32(0xC0000111)
+#define STATUS_ABIOS_NOT_LID_OWNER cpu_to_le32(0xC0000112)
+#define STATUS_ABIOS_INVALID_COMMAND cpu_to_le32(0xC0000113)
+#define STATUS_ABIOS_INVALID_LID cpu_to_le32(0xC0000114)
+#define STATUS_ABIOS_SELECTOR_NOT_AVAILABLE cpu_to_le32(0xC0000115)
+#define STATUS_ABIOS_INVALID_SELECTOR cpu_to_le32(0xC0000116)
+#define STATUS_NO_LDT cpu_to_le32(0xC0000117)
+#define STATUS_INVALID_LDT_SIZE cpu_to_le32(0xC0000118)
+#define STATUS_INVALID_LDT_OFFSET cpu_to_le32(0xC0000119)
+#define STATUS_INVALID_LDT_DESCRIPTOR cpu_to_le32(0xC000011A)
+#define STATUS_INVALID_IMAGE_NE_FORMAT cpu_to_le32(0xC000011B)
+#define STATUS_RXACT_INVALID_STATE cpu_to_le32(0xC000011C)
+#define STATUS_RXACT_COMMIT_FAILURE cpu_to_le32(0xC000011D)
+#define STATUS_MAPPED_FILE_SIZE_ZERO cpu_to_le32(0xC000011E)
+#define STATUS_TOO_MANY_OPENED_FILES cpu_to_le32(0xC000011F)
+#define STATUS_CANCELLED cpu_to_le32(0xC0000120)
+#define STATUS_CANNOT_DELETE cpu_to_le32(0xC0000121)
+#define STATUS_INVALID_COMPUTER_NAME cpu_to_le32(0xC0000122)
+#define STATUS_FILE_DELETED cpu_to_le32(0xC0000123)
+#define STATUS_SPECIAL_ACCOUNT cpu_to_le32(0xC0000124)
+#define STATUS_SPECIAL_GROUP cpu_to_le32(0xC0000125)
+#define STATUS_SPECIAL_USER cpu_to_le32(0xC0000126)
+#define STATUS_MEMBERS_PRIMARY_GROUP cpu_to_le32(0xC0000127)
+#define STATUS_FILE_CLOSED cpu_to_le32(0xC0000128)
+#define STATUS_TOO_MANY_THREADS cpu_to_le32(0xC0000129)
+#define STATUS_THREAD_NOT_IN_PROCESS cpu_to_le32(0xC000012A)
+#define STATUS_TOKEN_ALREADY_IN_USE cpu_to_le32(0xC000012B)
+#define STATUS_PAGEFILE_QUOTA_EXCEEDED cpu_to_le32(0xC000012C)
+#define STATUS_COMMITMENT_LIMIT cpu_to_le32(0xC000012D)
+#define STATUS_INVALID_IMAGE_LE_FORMAT cpu_to_le32(0xC000012E)
+#define STATUS_INVALID_IMAGE_NOT_MZ cpu_to_le32(0xC000012F)
+#define STATUS_INVALID_IMAGE_PROTECT cpu_to_le32(0xC0000130)
+#define STATUS_INVALID_IMAGE_WIN_16 cpu_to_le32(0xC0000131)
+#define STATUS_LOGON_SERVER_CONFLICT cpu_to_le32(0xC0000132)
+#define STATUS_TIME_DIFFERENCE_AT_DC cpu_to_le32(0xC0000133)
+#define STATUS_SYNCHRONIZATION_REQUIRED cpu_to_le32(0xC0000134)
+#define STATUS_DLL_NOT_FOUND cpu_to_le32(0xC0000135)
+#define STATUS_OPEN_FAILED cpu_to_le32(0xC0000136)
+#define STATUS_IO_PRIVILEGE_FAILED cpu_to_le32(0xC0000137)
+#define STATUS_ORDINAL_NOT_FOUND cpu_to_le32(0xC0000138)
+#define STATUS_ENTRYPOINT_NOT_FOUND cpu_to_le32(0xC0000139)
+#define STATUS_CONTROL_C_EXIT cpu_to_le32(0xC000013A)
+#define STATUS_LOCAL_DISCONNECT cpu_to_le32(0xC000013B)
+#define STATUS_REMOTE_DISCONNECT cpu_to_le32(0xC000013C)
+#define STATUS_REMOTE_RESOURCES cpu_to_le32(0xC000013D)
+#define STATUS_LINK_FAILED cpu_to_le32(0xC000013E)
+#define STATUS_LINK_TIMEOUT cpu_to_le32(0xC000013F)
+#define STATUS_INVALID_CONNECTION cpu_to_le32(0xC0000140)
+#define STATUS_INVALID_ADDRESS cpu_to_le32(0xC0000141)
+#define STATUS_DLL_INIT_FAILED cpu_to_le32(0xC0000142)
+#define STATUS_MISSING_SYSTEMFILE cpu_to_le32(0xC0000143)
+#define STATUS_UNHANDLED_EXCEPTION cpu_to_le32(0xC0000144)
+#define STATUS_APP_INIT_FAILURE cpu_to_le32(0xC0000145)
+#define STATUS_PAGEFILE_CREATE_FAILED cpu_to_le32(0xC0000146)
+#define STATUS_NO_PAGEFILE cpu_to_le32(0xC0000147)
+#define STATUS_INVALID_LEVEL cpu_to_le32(0xC0000148)
+#define STATUS_WRONG_PASSWORD_CORE cpu_to_le32(0xC0000149)
+#define STATUS_ILLEGAL_FLOAT_CONTEXT cpu_to_le32(0xC000014A)
+#define STATUS_PIPE_BROKEN cpu_to_le32(0xC000014B)
+#define STATUS_REGISTRY_CORRUPT cpu_to_le32(0xC000014C)
+#define STATUS_REGISTRY_IO_FAILED cpu_to_le32(0xC000014D)
+#define STATUS_NO_EVENT_PAIR cpu_to_le32(0xC000014E)
+#define STATUS_UNRECOGNIZED_VOLUME cpu_to_le32(0xC000014F)
+#define STATUS_SERIAL_NO_DEVICE_INITED cpu_to_le32(0xC0000150)
+#define STATUS_NO_SUCH_ALIAS cpu_to_le32(0xC0000151)
+#define STATUS_MEMBER_NOT_IN_ALIAS cpu_to_le32(0xC0000152)
+#define STATUS_MEMBER_IN_ALIAS cpu_to_le32(0xC0000153)
+#define STATUS_ALIAS_EXISTS cpu_to_le32(0xC0000154)
+#define STATUS_LOGON_NOT_GRANTED cpu_to_le32(0xC0000155)
+#define STATUS_TOO_MANY_SECRETS cpu_to_le32(0xC0000156)
+#define STATUS_SECRET_TOO_LONG cpu_to_le32(0xC0000157)
+#define STATUS_INTERNAL_DB_ERROR cpu_to_le32(0xC0000158)
+#define STATUS_FULLSCREEN_MODE cpu_to_le32(0xC0000159)
+#define STATUS_TOO_MANY_CONTEXT_IDS cpu_to_le32(0xC000015A)
+#define STATUS_LOGON_TYPE_NOT_GRANTED cpu_to_le32(0xC000015B)
+#define STATUS_NOT_REGISTRY_FILE cpu_to_le32(0xC000015C)
+#define STATUS_NT_CROSS_ENCRYPTION_REQUIRED cpu_to_le32(0xC000015D)
+#define STATUS_DOMAIN_CTRLR_CONFIG_ERROR cpu_to_le32(0xC000015E)
+#define STATUS_FT_MISSING_MEMBER cpu_to_le32(0xC000015F)
+#define STATUS_ILL_FORMED_SERVICE_ENTRY cpu_to_le32(0xC0000160)
+#define STATUS_ILLEGAL_CHARACTER cpu_to_le32(0xC0000161)
+#define STATUS_UNMAPPABLE_CHARACTER cpu_to_le32(0xC0000162)
+#define STATUS_UNDEFINED_CHARACTER cpu_to_le32(0xC0000163)
+#define STATUS_FLOPPY_VOLUME cpu_to_le32(0xC0000164)
+#define STATUS_FLOPPY_ID_MARK_NOT_FOUND cpu_to_le32(0xC0000165)
+#define STATUS_FLOPPY_WRONG_CYLINDER cpu_to_le32(0xC0000166)
+#define STATUS_FLOPPY_UNKNOWN_ERROR cpu_to_le32(0xC0000167)
+#define STATUS_FLOPPY_BAD_REGISTERS cpu_to_le32(0xC0000168)
+#define STATUS_DISK_RECALIBRATE_FAILED cpu_to_le32(0xC0000169)
+#define STATUS_DISK_OPERATION_FAILED cpu_to_le32(0xC000016A)
+#define STATUS_DISK_RESET_FAILED cpu_to_le32(0xC000016B)
+#define STATUS_SHARED_IRQ_BUSY cpu_to_le32(0xC000016C)
+#define STATUS_FT_ORPHANING cpu_to_le32(0xC000016D)
+#define STATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT cpu_to_le32(0xC000016E)
+#define STATUS_PARTITION_FAILURE cpu_to_le32(0xC0000172)
+#define STATUS_INVALID_BLOCK_LENGTH cpu_to_le32(0xC0000173)
+#define STATUS_DEVICE_NOT_PARTITIONED cpu_to_le32(0xC0000174)
+#define STATUS_UNABLE_TO_LOCK_MEDIA cpu_to_le32(0xC0000175)
+#define STATUS_UNABLE_TO_UNLOAD_MEDIA cpu_to_le32(0xC0000176)
+#define STATUS_EOM_OVERFLOW cpu_to_le32(0xC0000177)
+#define STATUS_NO_MEDIA cpu_to_le32(0xC0000178)
+#define STATUS_NO_SUCH_MEMBER cpu_to_le32(0xC000017A)
+#define STATUS_INVALID_MEMBER cpu_to_le32(0xC000017B)
+#define STATUS_KEY_DELETED cpu_to_le32(0xC000017C)
+#define STATUS_NO_LOG_SPACE cpu_to_le32(0xC000017D)
+#define STATUS_TOO_MANY_SIDS cpu_to_le32(0xC000017E)
+#define STATUS_LM_CROSS_ENCRYPTION_REQUIRED cpu_to_le32(0xC000017F)
+#define STATUS_KEY_HAS_CHILDREN cpu_to_le32(0xC0000180)
+#define STATUS_CHILD_MUST_BE_VOLATILE cpu_to_le32(0xC0000181)
+#define STATUS_DEVICE_CONFIGURATION_ERROR cpu_to_le32(0xC0000182)
+#define STATUS_DRIVER_INTERNAL_ERROR cpu_to_le32(0xC0000183)
+#define STATUS_INVALID_DEVICE_STATE cpu_to_le32(0xC0000184)
+#define STATUS_IO_DEVICE_ERROR cpu_to_le32(0xC0000185)
+#define STATUS_DEVICE_PROTOCOL_ERROR cpu_to_le32(0xC0000186)
+#define STATUS_BACKUP_CONTROLLER cpu_to_le32(0xC0000187)
+#define STATUS_LOG_FILE_FULL cpu_to_le32(0xC0000188)
+#define STATUS_TOO_LATE cpu_to_le32(0xC0000189)
+#define STATUS_NO_TRUST_LSA_SECRET cpu_to_le32(0xC000018A)
+#define STATUS_NO_TRUST_SAM_ACCOUNT cpu_to_le32(0xC000018B)
+#define STATUS_TRUSTED_DOMAIN_FAILURE cpu_to_le32(0xC000018C)
+#define STATUS_TRUSTED_RELATIONSHIP_FAILURE cpu_to_le32(0xC000018D)
+#define STATUS_EVENTLOG_FILE_CORRUPT cpu_to_le32(0xC000018E)
+#define STATUS_EVENTLOG_CANT_START cpu_to_le32(0xC000018F)
+#define STATUS_TRUST_FAILURE cpu_to_le32(0xC0000190)
+#define STATUS_MUTANT_LIMIT_EXCEEDED cpu_to_le32(0xC0000191)
+#define STATUS_NETLOGON_NOT_STARTED cpu_to_le32(0xC0000192)
+#define STATUS_ACCOUNT_EXPIRED cpu_to_le32(0xC0000193)
+#define STATUS_POSSIBLE_DEADLOCK cpu_to_le32(0xC0000194)
+#define STATUS_NETWORK_CREDENTIAL_CONFLICT cpu_to_le32(0xC0000195)
+#define STATUS_REMOTE_SESSION_LIMIT cpu_to_le32(0xC0000196)
+#define STATUS_EVENTLOG_FILE_CHANGED cpu_to_le32(0xC0000197)
+#define STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT cpu_to_le32(0xC0000198)
+#define STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT cpu_to_le32(0xC0000199)
+#define STATUS_NOLOGON_SERVER_TRUST_ACCOUNT cpu_to_le32(0xC000019A)
+#define STATUS_DOMAIN_TRUST_INCONSISTENT cpu_to_le32(0xC000019B)
+#define STATUS_FS_DRIVER_REQUIRED cpu_to_le32(0xC000019C)
+#define STATUS_IMAGE_ALREADY_LOADED_AS_DLL cpu_to_le32(0xC000019D)
+#define STATUS_NETWORK_OPEN_RESTRICTION cpu_to_le32(0xC0000201)
+#define STATUS_NO_USER_SESSION_KEY cpu_to_le32(0xC0000202)
+#define STATUS_USER_SESSION_DELETED cpu_to_le32(0xC0000203)
+#define STATUS_RESOURCE_LANG_NOT_FOUND cpu_to_le32(0xC0000204)
+#define STATUS_INSUFF_SERVER_RESOURCES cpu_to_le32(0xC0000205)
+#define STATUS_INVALID_BUFFER_SIZE cpu_to_le32(0xC0000206)
+#define STATUS_INVALID_ADDRESS_COMPONENT cpu_to_le32(0xC0000207)
+#define STATUS_INVALID_ADDRESS_WILDCARD cpu_to_le32(0xC0000208)
+#define STATUS_TOO_MANY_ADDRESSES cpu_to_le32(0xC0000209)
+#define STATUS_ADDRESS_ALREADY_EXISTS cpu_to_le32(0xC000020A)
+#define STATUS_ADDRESS_CLOSED cpu_to_le32(0xC000020B)
+#define STATUS_CONNECTION_DISCONNECTED cpu_to_le32(0xC000020C)
+#define STATUS_CONNECTION_RESET cpu_to_le32(0xC000020D)
+#define STATUS_TOO_MANY_NODES cpu_to_le32(0xC000020E)
+#define STATUS_TRANSACTION_ABORTED cpu_to_le32(0xC000020F)
+#define STATUS_TRANSACTION_TIMED_OUT cpu_to_le32(0xC0000210)
+#define STATUS_TRANSACTION_NO_RELEASE cpu_to_le32(0xC0000211)
+#define STATUS_TRANSACTION_NO_MATCH cpu_to_le32(0xC0000212)
+#define STATUS_TRANSACTION_RESPONDED cpu_to_le32(0xC0000213)
+#define STATUS_TRANSACTION_INVALID_ID cpu_to_le32(0xC0000214)
+#define STATUS_TRANSACTION_INVALID_TYPE cpu_to_le32(0xC0000215)
+#define STATUS_NOT_SERVER_SESSION cpu_to_le32(0xC0000216)
+#define STATUS_NOT_CLIENT_SESSION cpu_to_le32(0xC0000217)
+#define STATUS_CANNOT_LOAD_REGISTRY_FILE cpu_to_le32(0xC0000218)
+#define STATUS_DEBUG_ATTACH_FAILED cpu_to_le32(0xC0000219)
+#define STATUS_SYSTEM_PROCESS_TERMINATED cpu_to_le32(0xC000021A)
+#define STATUS_DATA_NOT_ACCEPTED cpu_to_le32(0xC000021B)
+#define STATUS_NO_BROWSER_SERVERS_FOUND cpu_to_le32(0xC000021C)
+#define STATUS_VDM_HARD_ERROR cpu_to_le32(0xC000021D)
+#define STATUS_DRIVER_CANCEL_TIMEOUT cpu_to_le32(0xC000021E)
+#define STATUS_REPLY_MESSAGE_MISMATCH cpu_to_le32(0xC000021F)
+#define STATUS_MAPPED_ALIGNMENT cpu_to_le32(0xC0000220)
+#define STATUS_IMAGE_CHECKSUM_MISMATCH cpu_to_le32(0xC0000221)
+#define STATUS_LOST_WRITEBEHIND_DATA cpu_to_le32(0xC0000222)
+#define STATUS_CLIENT_SERVER_PARAMETERS_INVALID cpu_to_le32(0xC0000223)
+#define STATUS_PASSWORD_MUST_CHANGE cpu_to_le32(0xC0000224)
+#define STATUS_NOT_FOUND cpu_to_le32(0xC0000225)
+#define STATUS_NOT_TINY_STREAM cpu_to_le32(0xC0000226)
+#define STATUS_RECOVERY_FAILURE cpu_to_le32(0xC0000227)
+#define STATUS_STACK_OVERFLOW_READ cpu_to_le32(0xC0000228)
+#define STATUS_FAIL_CHECK cpu_to_le32(0xC0000229)
+#define STATUS_DUPLICATE_OBJECTID cpu_to_le32(0xC000022A)
+#define STATUS_OBJECTID_EXISTS cpu_to_le32(0xC000022B)
+#define STATUS_CONVERT_TO_LARGE cpu_to_le32(0xC000022C)
+#define STATUS_RETRY cpu_to_le32(0xC000022D)
+#define STATUS_FOUND_OUT_OF_SCOPE cpu_to_le32(0xC000022E)
+#define STATUS_ALLOCATE_BUCKET cpu_to_le32(0xC000022F)
+#define STATUS_PROPSET_NOT_FOUND cpu_to_le32(0xC0000230)
+#define STATUS_MARSHALL_OVERFLOW cpu_to_le32(0xC0000231)
+#define STATUS_INVALID_VARIANT cpu_to_le32(0xC0000232)
+#define STATUS_DOMAIN_CONTROLLER_NOT_FOUND cpu_to_le32(0xC0000233)
+#define STATUS_ACCOUNT_LOCKED_OUT cpu_to_le32(0xC0000234)
+#define STATUS_HANDLE_NOT_CLOSABLE cpu_to_le32(0xC0000235)
+#define STATUS_CONNECTION_REFUSED cpu_to_le32(0xC0000236)
+#define STATUS_GRACEFUL_DISCONNECT cpu_to_le32(0xC0000237)
+#define STATUS_ADDRESS_ALREADY_ASSOCIATED cpu_to_le32(0xC0000238)
+#define STATUS_ADDRESS_NOT_ASSOCIATED cpu_to_le32(0xC0000239)
+#define STATUS_CONNECTION_INVALID cpu_to_le32(0xC000023A)
+#define STATUS_CONNECTION_ACTIVE cpu_to_le32(0xC000023B)
+#define STATUS_NETWORK_UNREACHABLE cpu_to_le32(0xC000023C)
+#define STATUS_HOST_UNREACHABLE cpu_to_le32(0xC000023D)
+#define STATUS_PROTOCOL_UNREACHABLE cpu_to_le32(0xC000023E)
+#define STATUS_PORT_UNREACHABLE cpu_to_le32(0xC000023F)
+#define STATUS_REQUEST_ABORTED cpu_to_le32(0xC0000240)
+#define STATUS_CONNECTION_ABORTED cpu_to_le32(0xC0000241)
+#define STATUS_BAD_COMPRESSION_BUFFER cpu_to_le32(0xC0000242)
+#define STATUS_USER_MAPPED_FILE cpu_to_le32(0xC0000243)
+#define STATUS_AUDIT_FAILED cpu_to_le32(0xC0000244)
+#define STATUS_TIMER_RESOLUTION_NOT_SET cpu_to_le32(0xC0000245)
+#define STATUS_CONNECTION_COUNT_LIMIT cpu_to_le32(0xC0000246)
+#define STATUS_LOGIN_TIME_RESTRICTION cpu_to_le32(0xC0000247)
+#define STATUS_LOGIN_WKSTA_RESTRICTION cpu_to_le32(0xC0000248)
+#define STATUS_IMAGE_MP_UP_MISMATCH cpu_to_le32(0xC0000249)
+#define STATUS_INSUFFICIENT_LOGON_INFO cpu_to_le32(0xC0000250)
+#define STATUS_BAD_DLL_ENTRYPOINT cpu_to_le32(0xC0000251)
+#define STATUS_BAD_SERVICE_ENTRYPOINT cpu_to_le32(0xC0000252)
+#define STATUS_LPC_REPLY_LOST cpu_to_le32(0xC0000253)
+#define STATUS_IP_ADDRESS_CONFLICT1 cpu_to_le32(0xC0000254)
+#define STATUS_IP_ADDRESS_CONFLICT2 cpu_to_le32(0xC0000255)
+#define STATUS_REGISTRY_QUOTA_LIMIT cpu_to_le32(0xC0000256)
+#define STATUS_PATH_NOT_COVERED cpu_to_le32(0xC0000257)
+#define STATUS_NO_CALLBACK_ACTIVE cpu_to_le32(0xC0000258)
+#define STATUS_LICENSE_QUOTA_EXCEEDED cpu_to_le32(0xC0000259)
+#define STATUS_PWD_TOO_SHORT cpu_to_le32(0xC000025A)
+#define STATUS_PWD_TOO_RECENT cpu_to_le32(0xC000025B)
+#define STATUS_PWD_HISTORY_CONFLICT cpu_to_le32(0xC000025C)
+#define STATUS_PLUGPLAY_NO_DEVICE cpu_to_le32(0xC000025E)
+#define STATUS_UNSUPPORTED_COMPRESSION cpu_to_le32(0xC000025F)
+#define STATUS_INVALID_HW_PROFILE cpu_to_le32(0xC0000260)
+#define STATUS_INVALID_PLUGPLAY_DEVICE_PATH cpu_to_le32(0xC0000261)
+#define STATUS_DRIVER_ORDINAL_NOT_FOUND cpu_to_le32(0xC0000262)
+#define STATUS_DRIVER_ENTRYPOINT_NOT_FOUND cpu_to_le32(0xC0000263)
+#define STATUS_RESOURCE_NOT_OWNED cpu_to_le32(0xC0000264)
+#define STATUS_TOO_MANY_LINKS cpu_to_le32(0xC0000265)
+#define STATUS_QUOTA_LIST_INCONSISTENT cpu_to_le32(0xC0000266)
+#define STATUS_FILE_IS_OFFLINE cpu_to_le32(0xC0000267)
+#define STATUS_EVALUATION_EXPIRATION cpu_to_le32(0xC0000268)
+#define STATUS_ILLEGAL_DLL_RELOCATION cpu_to_le32(0xC0000269)
+#define STATUS_LICENSE_VIOLATION cpu_to_le32(0xC000026A)
+#define STATUS_DLL_INIT_FAILED_LOGOFF cpu_to_le32(0xC000026B)
+#define STATUS_DRIVER_UNABLE_TO_LOAD cpu_to_le32(0xC000026C)
+#define STATUS_DFS_UNAVAILABLE cpu_to_le32(0xC000026D)
+#define STATUS_VOLUME_DISMOUNTED cpu_to_le32(0xC000026E)
+#define STATUS_WX86_INTERNAL_ERROR cpu_to_le32(0xC000026F)
+#define STATUS_WX86_FLOAT_STACK_CHECK cpu_to_le32(0xC0000270)
+#define STATUS_VALIDATE_CONTINUE cpu_to_le32(0xC0000271)
+#define STATUS_NO_MATCH cpu_to_le32(0xC0000272)
+#define STATUS_NO_MORE_MATCHES cpu_to_le32(0xC0000273)
+#define STATUS_NOT_A_REPARSE_POINT cpu_to_le32(0xC0000275)
+#define STATUS_IO_REPARSE_TAG_INVALID cpu_to_le32(0xC0000276)
+#define STATUS_IO_REPARSE_TAG_MISMATCH cpu_to_le32(0xC0000277)
+#define STATUS_IO_REPARSE_DATA_INVALID cpu_to_le32(0xC0000278)
+#define STATUS_IO_REPARSE_TAG_NOT_HANDLED cpu_to_le32(0xC0000279)
+#define STATUS_REPARSE_POINT_NOT_RESOLVED cpu_to_le32(0xC0000280)
+#define STATUS_DIRECTORY_IS_A_REPARSE_POINT cpu_to_le32(0xC0000281)
+#define STATUS_RANGE_LIST_CONFLICT cpu_to_le32(0xC0000282)
+#define STATUS_SOURCE_ELEMENT_EMPTY cpu_to_le32(0xC0000283)
+#define STATUS_DESTINATION_ELEMENT_FULL cpu_to_le32(0xC0000284)
+#define STATUS_ILLEGAL_ELEMENT_ADDRESS cpu_to_le32(0xC0000285)
+#define STATUS_MAGAZINE_NOT_PRESENT cpu_to_le32(0xC0000286)
+#define STATUS_REINITIALIZATION_NEEDED cpu_to_le32(0xC0000287)
+#define STATUS_ENCRYPTION_FAILED cpu_to_le32(0xC000028A)
+#define STATUS_DECRYPTION_FAILED cpu_to_le32(0xC000028B)
+#define STATUS_RANGE_NOT_FOUND cpu_to_le32(0xC000028C)
+#define STATUS_NO_RECOVERY_POLICY cpu_to_le32(0xC000028D)
+#define STATUS_NO_EFS cpu_to_le32(0xC000028E)
+#define STATUS_WRONG_EFS cpu_to_le32(0xC000028F)
+#define STATUS_NO_USER_KEYS cpu_to_le32(0xC0000290)
+#define STATUS_FILE_NOT_ENCRYPTED cpu_to_le32(0xC0000291)
+#define STATUS_NOT_EXPORT_FORMAT cpu_to_le32(0xC0000292)
+#define STATUS_FILE_ENCRYPTED cpu_to_le32(0xC0000293)
+#define STATUS_WMI_GUID_NOT_FOUND cpu_to_le32(0xC0000295)
+#define STATUS_WMI_INSTANCE_NOT_FOUND cpu_to_le32(0xC0000296)
+#define STATUS_WMI_ITEMID_NOT_FOUND cpu_to_le32(0xC0000297)
+#define STATUS_WMI_TRY_AGAIN cpu_to_le32(0xC0000298)
+#define STATUS_SHARED_POLICY cpu_to_le32(0xC0000299)
+#define STATUS_POLICY_OBJECT_NOT_FOUND cpu_to_le32(0xC000029A)
+#define STATUS_POLICY_ONLY_IN_DS cpu_to_le32(0xC000029B)
+#define STATUS_VOLUME_NOT_UPGRADED cpu_to_le32(0xC000029C)
+#define STATUS_REMOTE_STORAGE_NOT_ACTIVE cpu_to_le32(0xC000029D)
+#define STATUS_REMOTE_STORAGE_MEDIA_ERROR cpu_to_le32(0xC000029E)
+#define STATUS_NO_TRACKING_SERVICE cpu_to_le32(0xC000029F)
+#define STATUS_SERVER_SID_MISMATCH cpu_to_le32(0xC00002A0)
+#define STATUS_DS_NO_ATTRIBUTE_OR_VALUE cpu_to_le32(0xC00002A1)
+#define STATUS_DS_INVALID_ATTRIBUTE_SYNTAX cpu_to_le32(0xC00002A2)
+#define STATUS_DS_ATTRIBUTE_TYPE_UNDEFINED cpu_to_le32(0xC00002A3)
+#define STATUS_DS_ATTRIBUTE_OR_VALUE_EXISTS cpu_to_le32(0xC00002A4)
+#define STATUS_DS_BUSY cpu_to_le32(0xC00002A5)
+#define STATUS_DS_UNAVAILABLE cpu_to_le32(0xC00002A6)
+#define STATUS_DS_NO_RIDS_ALLOCATED cpu_to_le32(0xC00002A7)
+#define STATUS_DS_NO_MORE_RIDS cpu_to_le32(0xC00002A8)
+#define STATUS_DS_INCORRECT_ROLE_OWNER cpu_to_le32(0xC00002A9)
+#define STATUS_DS_RIDMGR_INIT_ERROR cpu_to_le32(0xC00002AA)
+#define STATUS_DS_OBJ_CLASS_VIOLATION cpu_to_le32(0xC00002AB)
+#define STATUS_DS_CANT_ON_NON_LEAF cpu_to_le32(0xC00002AC)
+#define STATUS_DS_CANT_ON_RDN cpu_to_le32(0xC00002AD)
+#define STATUS_DS_CANT_MOD_OBJ_CLASS cpu_to_le32(0xC00002AE)
+#define STATUS_DS_CROSS_DOM_MOVE_FAILED cpu_to_le32(0xC00002AF)
+#define STATUS_DS_GC_NOT_AVAILABLE cpu_to_le32(0xC00002B0)
+#define STATUS_DIRECTORY_SERVICE_REQUIRED cpu_to_le32(0xC00002B1)
+#define STATUS_REPARSE_ATTRIBUTE_CONFLICT cpu_to_le32(0xC00002B2)
+#define STATUS_CANT_ENABLE_DENY_ONLY cpu_to_le32(0xC00002B3)
+#define STATUS_FLOAT_MULTIPLE_FAULTS cpu_to_le32(0xC00002B4)
+#define STATUS_FLOAT_MULTIPLE_TRAPS cpu_to_le32(0xC00002B5)
+#define STATUS_DEVICE_REMOVED cpu_to_le32(0xC00002B6)
+#define STATUS_JOURNAL_DELETE_IN_PROGRESS cpu_to_le32(0xC00002B7)
+#define STATUS_JOURNAL_NOT_ACTIVE cpu_to_le32(0xC00002B8)
+#define STATUS_NOINTERFACE cpu_to_le32(0xC00002B9)
+#define STATUS_DS_ADMIN_LIMIT_EXCEEDED cpu_to_le32(0xC00002C1)
+#define STATUS_DRIVER_FAILED_SLEEP cpu_to_le32(0xC00002C2)
+#define STATUS_MUTUAL_AUTHENTICATION_FAILED cpu_to_le32(0xC00002C3)
+#define STATUS_CORRUPT_SYSTEM_FILE cpu_to_le32(0xC00002C4)
+#define STATUS_DATATYPE_MISALIGNMENT_ERROR cpu_to_le32(0xC00002C5)
+#define STATUS_WMI_READ_ONLY cpu_to_le32(0xC00002C6)
+#define STATUS_WMI_SET_FAILURE cpu_to_le32(0xC00002C7)
+#define STATUS_COMMITMENT_MINIMUM cpu_to_le32(0xC00002C8)
+#define STATUS_REG_NAT_CONSUMPTION cpu_to_le32(0xC00002C9)
+#define STATUS_TRANSPORT_FULL cpu_to_le32(0xC00002CA)
+#define STATUS_DS_SAM_INIT_FAILURE cpu_to_le32(0xC00002CB)
+#define STATUS_ONLY_IF_CONNECTED cpu_to_le32(0xC00002CC)
+#define STATUS_DS_SENSITIVE_GROUP_VIOLATION cpu_to_le32(0xC00002CD)
+#define STATUS_PNP_RESTART_ENUMERATION cpu_to_le32(0xC00002CE)
+#define STATUS_JOURNAL_ENTRY_DELETED cpu_to_le32(0xC00002CF)
+#define STATUS_DS_CANT_MOD_PRIMARYGROUPID cpu_to_le32(0xC00002D0)
+#define STATUS_SYSTEM_IMAGE_BAD_SIGNATURE cpu_to_le32(0xC00002D1)
+#define STATUS_PNP_REBOOT_REQUIRED cpu_to_le32(0xC00002D2)
+#define STATUS_POWER_STATE_INVALID cpu_to_le32(0xC00002D3)
+#define STATUS_DS_INVALID_GROUP_TYPE cpu_to_le32(0xC00002D4)
+#define STATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN cpu_to_le32(0xC00002D5)
+#define STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN cpu_to_le32(0xC00002D6)
+#define STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER cpu_to_le32(0xC00002D7)
+#define STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER cpu_to_le32(0xC00002D8)
+#define STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER cpu_to_le32(0xC00002D9)
+#define STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER cpu_to_le32(0xC00002DA)
+#define STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER	\
+	cpu_to_le32(0xC00002DB)
+#define STATUS_DS_HAVE_PRIMARY_MEMBERS cpu_to_le32(0xC00002DC)
+#define STATUS_WMI_NOT_SUPPORTED cpu_to_le32(0xC00002DD)
+#define STATUS_INSUFFICIENT_POWER cpu_to_le32(0xC00002DE)
+#define STATUS_SAM_NEED_BOOTKEY_PASSWORD cpu_to_le32(0xC00002DF)
+#define STATUS_SAM_NEED_BOOTKEY_FLOPPY cpu_to_le32(0xC00002E0)
+#define STATUS_DS_CANT_START cpu_to_le32(0xC00002E1)
+#define STATUS_DS_INIT_FAILURE cpu_to_le32(0xC00002E2)
+#define STATUS_SAM_INIT_FAILURE cpu_to_le32(0xC00002E3)
+#define STATUS_DS_GC_REQUIRED cpu_to_le32(0xC00002E4)
+#define STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY cpu_to_le32(0xC00002E5)
+#define STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS cpu_to_le32(0xC00002E6)
+#define STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED cpu_to_le32(0xC00002E7)
+#define STATUS_MULTIPLE_FAULT_VIOLATION cpu_to_le32(0xC00002E8)
+#define STATUS_CURRENT_DOMAIN_NOT_ALLOWED cpu_to_le32(0xC00002E9)
+#define STATUS_CANNOT_MAKE cpu_to_le32(0xC00002EA)
+#define STATUS_SYSTEM_SHUTDOWN cpu_to_le32(0xC00002EB)
+#define STATUS_DS_INIT_FAILURE_CONSOLE cpu_to_le32(0xC00002EC)
+#define STATUS_DS_SAM_INIT_FAILURE_CONSOLE cpu_to_le32(0xC00002ED)
+#define STATUS_UNFINISHED_CONTEXT_DELETED cpu_to_le32(0xC00002EE)
+#define STATUS_NO_TGT_REPLY cpu_to_le32(0xC00002EF)
+#define STATUS_OBJECTID_NOT_FOUND cpu_to_le32(0xC00002F0)
+#define STATUS_NO_IP_ADDRESSES cpu_to_le32(0xC00002F1)
+#define STATUS_WRONG_CREDENTIAL_HANDLE cpu_to_le32(0xC00002F2)
+#define STATUS_CRYPTO_SYSTEM_INVALID cpu_to_le32(0xC00002F3)
+#define STATUS_MAX_REFERRALS_EXCEEDED cpu_to_le32(0xC00002F4)
+#define STATUS_MUST_BE_KDC cpu_to_le32(0xC00002F5)
+#define STATUS_STRONG_CRYPTO_NOT_SUPPORTED cpu_to_le32(0xC00002F6)
+#define STATUS_TOO_MANY_PRINCIPALS cpu_to_le32(0xC00002F7)
+#define STATUS_NO_PA_DATA cpu_to_le32(0xC00002F8)
+#define STATUS_PKINIT_NAME_MISMATCH cpu_to_le32(0xC00002F9)
+#define STATUS_SMARTCARD_LOGON_REQUIRED cpu_to_le32(0xC00002FA)
+#define STATUS_KDC_INVALID_REQUEST cpu_to_le32(0xC00002FB)
+#define STATUS_KDC_UNABLE_TO_REFER cpu_to_le32(0xC00002FC)
+#define STATUS_KDC_UNKNOWN_ETYPE cpu_to_le32(0xC00002FD)
+#define STATUS_SHUTDOWN_IN_PROGRESS cpu_to_le32(0xC00002FE)
+#define STATUS_SERVER_SHUTDOWN_IN_PROGRESS cpu_to_le32(0xC00002FF)
+#define STATUS_NOT_SUPPORTED_ON_SBS cpu_to_le32(0xC0000300)
+#define STATUS_WMI_GUID_DISCONNECTED cpu_to_le32(0xC0000301)
+#define STATUS_WMI_ALREADY_DISABLED cpu_to_le32(0xC0000302)
+#define STATUS_WMI_ALREADY_ENABLED cpu_to_le32(0xC0000303)
+#define STATUS_MFT_TOO_FRAGMENTED cpu_to_le32(0xC0000304)
+#define STATUS_COPY_PROTECTION_FAILURE cpu_to_le32(0xC0000305)
+#define STATUS_CSS_AUTHENTICATION_FAILURE cpu_to_le32(0xC0000306)
+#define STATUS_CSS_KEY_NOT_PRESENT cpu_to_le32(0xC0000307)
+#define STATUS_CSS_KEY_NOT_ESTABLISHED cpu_to_le32(0xC0000308)
+#define STATUS_CSS_SCRAMBLED_SECTOR cpu_to_le32(0xC0000309)
+#define STATUS_CSS_REGION_MISMATCH cpu_to_le32(0xC000030A)
+#define STATUS_CSS_RESETS_EXHAUSTED cpu_to_le32(0xC000030B)
+#define STATUS_PKINIT_FAILURE cpu_to_le32(0xC0000320)
+#define STATUS_SMARTCARD_SUBSYSTEM_FAILURE cpu_to_le32(0xC0000321)
+#define STATUS_NO_KERB_KEY cpu_to_le32(0xC0000322)
+#define STATUS_HOST_DOWN cpu_to_le32(0xC0000350)
+#define STATUS_UNSUPPORTED_PREAUTH cpu_to_le32(0xC0000351)
+#define STATUS_EFS_ALG_BLOB_TOO_BIG cpu_to_le32(0xC0000352)
+#define STATUS_PORT_NOT_SET cpu_to_le32(0xC0000353)
+#define STATUS_DEBUGGER_INACTIVE cpu_to_le32(0xC0000354)
+#define STATUS_DS_VERSION_CHECK_FAILURE cpu_to_le32(0xC0000355)
+#define STATUS_AUDITING_DISABLED cpu_to_le32(0xC0000356)
+#define STATUS_PRENT4_MACHINE_ACCOUNT cpu_to_le32(0xC0000357)
+#define STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER cpu_to_le32(0xC0000358)
+#define STATUS_INVALID_IMAGE_WIN_32 cpu_to_le32(0xC0000359)
+#define STATUS_INVALID_IMAGE_WIN_64 cpu_to_le32(0xC000035A)
+#define STATUS_BAD_BINDINGS cpu_to_le32(0xC000035B)
+#define STATUS_NETWORK_SESSION_EXPIRED cpu_to_le32(0xC000035C)
+#define STATUS_APPHELP_BLOCK cpu_to_le32(0xC000035D)
+#define STATUS_ALL_SIDS_FILTERED cpu_to_le32(0xC000035E)
+#define STATUS_NOT_SAFE_MODE_DRIVER cpu_to_le32(0xC000035F)
+#define STATUS_ACCESS_DISABLED_BY_POLICY_DEFAULT cpu_to_le32(0xC0000361)
+#define STATUS_ACCESS_DISABLED_BY_POLICY_PATH cpu_to_le32(0xC0000362)
+#define STATUS_ACCESS_DISABLED_BY_POLICY_PUBLISHER cpu_to_le32(0xC0000363)
+#define STATUS_ACCESS_DISABLED_BY_POLICY_OTHER cpu_to_le32(0xC0000364)
+#define STATUS_FAILED_DRIVER_ENTRY cpu_to_le32(0xC0000365)
+#define STATUS_DEVICE_ENUMERATION_ERROR cpu_to_le32(0xC0000366)
+#define STATUS_MOUNT_POINT_NOT_RESOLVED cpu_to_le32(0xC0000368)
+#define STATUS_INVALID_DEVICE_OBJECT_PARAMETER cpu_to_le32(0xC0000369)
+#define STATUS_MCA_OCCURRED cpu_to_le32(0xC000036A)
+#define STATUS_DRIVER_BLOCKED_CRITICAL cpu_to_le32(0xC000036B)
+#define STATUS_DRIVER_BLOCKED cpu_to_le32(0xC000036C)
+#define STATUS_DRIVER_DATABASE_ERROR cpu_to_le32(0xC000036D)
+#define STATUS_SYSTEM_HIVE_TOO_LARGE cpu_to_le32(0xC000036E)
+#define STATUS_INVALID_IMPORT_OF_NON_DLL cpu_to_le32(0xC000036F)
+#define STATUS_NO_SECRETS cpu_to_le32(0xC0000371)
+#define STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY cpu_to_le32(0xC0000372)
+#define STATUS_FAILED_STACK_SWITCH cpu_to_le32(0xC0000373)
+#define STATUS_HEAP_CORRUPTION cpu_to_le32(0xC0000374)
+#define STATUS_SMARTCARD_WRONG_PIN cpu_to_le32(0xC0000380)
+#define STATUS_SMARTCARD_CARD_BLOCKED cpu_to_le32(0xC0000381)
+#define STATUS_SMARTCARD_CARD_NOT_AUTHENTICATED cpu_to_le32(0xC0000382)
+#define STATUS_SMARTCARD_NO_CARD cpu_to_le32(0xC0000383)
+#define STATUS_SMARTCARD_NO_KEY_CONTAINER cpu_to_le32(0xC0000384)
+#define STATUS_SMARTCARD_NO_CERTIFICATE cpu_to_le32(0xC0000385)
+#define STATUS_SMARTCARD_NO_KEYSET cpu_to_le32(0xC0000386)
+#define STATUS_SMARTCARD_IO_ERROR cpu_to_le32(0xC0000387)
+#define STATUS_DOWNGRADE_DETECTED cpu_to_le32(0xC0000388)
+#define STATUS_SMARTCARD_CERT_REVOKED cpu_to_le32(0xC0000389)
+#define STATUS_ISSUING_CA_UNTRUSTED cpu_to_le32(0xC000038A)
+#define STATUS_REVOCATION_OFFLINE_C cpu_to_le32(0xC000038B)
+#define STATUS_PKINIT_CLIENT_FAILURE cpu_to_le32(0xC000038C)
+#define STATUS_SMARTCARD_CERT_EXPIRED cpu_to_le32(0xC000038D)
+#define STATUS_DRIVER_FAILED_PRIOR_UNLOAD cpu_to_le32(0xC000038E)
+#define STATUS_SMARTCARD_SILENT_CONTEXT cpu_to_le32(0xC000038F)
+#define STATUS_PER_USER_TRUST_QUOTA_EXCEEDED cpu_to_le32(0xC0000401)
+#define STATUS_ALL_USER_TRUST_QUOTA_EXCEEDED cpu_to_le32(0xC0000402)
+#define STATUS_USER_DELETE_TRUST_QUOTA_EXCEEDED cpu_to_le32(0xC0000403)
+#define STATUS_DS_NAME_NOT_UNIQUE cpu_to_le32(0xC0000404)
+#define STATUS_DS_DUPLICATE_ID_FOUND cpu_to_le32(0xC0000405)
+#define STATUS_DS_GROUP_CONVERSION_ERROR cpu_to_le32(0xC0000406)
+#define STATUS_VOLSNAP_PREPARE_HIBERNATE cpu_to_le32(0xC0000407)
+#define STATUS_USER2USER_REQUIRED cpu_to_le32(0xC0000408)
+#define STATUS_STACK_BUFFER_OVERRUN cpu_to_le32(0xC0000409)
+#define STATUS_NO_S4U_PROT_SUPPORT cpu_to_le32(0xC000040A)
+#define STATUS_CROSSREALM_DELEGATION_FAILURE cpu_to_le32(0xC000040B)
+#define STATUS_REVOCATION_OFFLINE_KDC cpu_to_le32(0xC000040C)
+#define STATUS_ISSUING_CA_UNTRUSTED_KDC cpu_to_le32(0xC000040D)
+#define STATUS_KDC_CERT_EXPIRED cpu_to_le32(0xC000040E)
+#define STATUS_KDC_CERT_REVOKED cpu_to_le32(0xC000040F)
+#define STATUS_PARAMETER_QUOTA_EXCEEDED cpu_to_le32(0xC0000410)
+#define STATUS_HIBERNATION_FAILURE cpu_to_le32(0xC0000411)
+#define STATUS_DELAY_LOAD_FAILED cpu_to_le32(0xC0000412)
+#define STATUS_AUTHENTICATION_FIREWALL_FAILED cpu_to_le32(0xC0000413)
+#define STATUS_VDM_DISALLOWED cpu_to_le32(0xC0000414)
+#define STATUS_HUNG_DISPLAY_DRIVER_THREAD cpu_to_le32(0xC0000415)
+#define STATUS_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE	\
+	cpu_to_le32(0xC0000416)
+#define STATUS_INVALID_CRUNTIME_PARAMETER cpu_to_le32(0xC0000417)
+#define STATUS_NTLM_BLOCKED cpu_to_le32(0xC0000418)
+#define STATUS_ASSERTION_FAILURE cpu_to_le32(0xC0000420)
+#define STATUS_VERIFIER_STOP cpu_to_le32(0xC0000421)
+#define STATUS_CALLBACK_POP_STACK cpu_to_le32(0xC0000423)
+#define STATUS_INCOMPATIBLE_DRIVER_BLOCKED cpu_to_le32(0xC0000424)
+#define STATUS_HIVE_UNLOADED cpu_to_le32(0xC0000425)
+#define STATUS_COMPRESSION_DISABLED cpu_to_le32(0xC0000426)
+#define STATUS_FILE_SYSTEM_LIMITATION cpu_to_le32(0xC0000427)
+#define STATUS_INVALID_IMAGE_HASH cpu_to_le32(0xC0000428)
+#define STATUS_NOT_CAPABLE cpu_to_le32(0xC0000429)
+#define STATUS_REQUEST_OUT_OF_SEQUENCE cpu_to_le32(0xC000042A)
+#define STATUS_IMPLEMENTATION_LIMIT cpu_to_le32(0xC000042B)
+#define STATUS_ELEVATION_REQUIRED cpu_to_le32(0xC000042C)
+#define STATUS_BEYOND_VDL cpu_to_le32(0xC0000432)
+#define STATUS_ENCOUNTERED_WRITE_IN_PROGRESS cpu_to_le32(0xC0000433)
+#define STATUS_PTE_CHANGED cpu_to_le32(0xC0000434)
+#define STATUS_PURGE_FAILED cpu_to_le32(0xC0000435)
+#define STATUS_CRED_REQUIRES_CONFIRMATION cpu_to_le32(0xC0000440)
+#define STATUS_CS_ENCRYPTION_INVALID_SERVER_RESPONSE cpu_to_le32(0xC0000441)
+#define STATUS_CS_ENCRYPTION_UNSUPPORTED_SERVER cpu_to_le32(0xC0000442)
+#define STATUS_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE cpu_to_le32(0xC0000443)
+#define STATUS_CS_ENCRYPTION_NEW_ENCRYPTED_FILE cpu_to_le32(0xC0000444)
+#define STATUS_CS_ENCRYPTION_FILE_NOT_CSE cpu_to_le32(0xC0000445)
+#define STATUS_INVALID_LABEL cpu_to_le32(0xC0000446)
+#define STATUS_DRIVER_PROCESS_TERMINATED cpu_to_le32(0xC0000450)
+#define STATUS_AMBIGUOUS_SYSTEM_DEVICE cpu_to_le32(0xC0000451)
+#define STATUS_SYSTEM_DEVICE_NOT_FOUND cpu_to_le32(0xC0000452)
+#define STATUS_RESTART_BOOT_APPLICATION cpu_to_le32(0xC0000453)
+#define STATUS_INVALID_TASK_NAME cpu_to_le32(0xC0000500)
+#define STATUS_INVALID_TASK_INDEX cpu_to_le32(0xC0000501)
+#define STATUS_THREAD_ALREADY_IN_TASK cpu_to_le32(0xC0000502)
+#define STATUS_CALLBACK_BYPASS cpu_to_le32(0xC0000503)
+#define STATUS_PORT_CLOSED cpu_to_le32(0xC0000700)
+#define STATUS_MESSAGE_LOST cpu_to_le32(0xC0000701)
+#define STATUS_INVALID_MESSAGE cpu_to_le32(0xC0000702)
+#define STATUS_REQUEST_CANCELED cpu_to_le32(0xC0000703)
+#define STATUS_RECURSIVE_DISPATCH cpu_to_le32(0xC0000704)
+#define STATUS_LPC_RECEIVE_BUFFER_EXPECTED cpu_to_le32(0xC0000705)
+#define STATUS_LPC_INVALID_CONNECTION_USAGE cpu_to_le32(0xC0000706)
+#define STATUS_LPC_REQUESTS_NOT_ALLOWED cpu_to_le32(0xC0000707)
+#define STATUS_RESOURCE_IN_USE cpu_to_le32(0xC0000708)
+#define STATUS_HARDWARE_MEMORY_ERROR cpu_to_le32(0xC0000709)
+#define STATUS_THREADPOOL_HANDLE_EXCEPTION cpu_to_le32(0xC000070A)
+#define STATUS_THREADPOOL_SET_EVENT_ON_COMPLETION_FAILED cpu_to_le32(0xC000070B)
+#define STATUS_THREADPOOL_RELEASE_SEMAPHORE_ON_COMPLETION_FAILED	\
+	cpu_to_le32(0xC000070C)
+#define STATUS_THREADPOOL_RELEASE_MUTEX_ON_COMPLETION_FAILED	\
+	cpu_to_le32(0xC000070D)
+#define STATUS_THREADPOOL_FREE_LIBRARY_ON_COMPLETION_FAILED	\
+	cpu_to_le32(0xC000070E)
+#define STATUS_THREADPOOL_RELEASED_DURING_OPERATION cpu_to_le32(0xC000070F)
+#define STATUS_CALLBACK_RETURNED_WHILE_IMPERSONATING cpu_to_le32(0xC0000710)
+#define STATUS_APC_RETURNED_WHILE_IMPERSONATING cpu_to_le32(0xC0000711)
+#define STATUS_PROCESS_IS_PROTECTED cpu_to_le32(0xC0000712)
+#define STATUS_MCA_EXCEPTION cpu_to_le32(0xC0000713)
+#define STATUS_CERTIFICATE_MAPPING_NOT_UNIQUE cpu_to_le32(0xC0000714)
+#define STATUS_SYMLINK_CLASS_DISABLED cpu_to_le32(0xC0000715)
+#define STATUS_INVALID_IDN_NORMALIZATION cpu_to_le32(0xC0000716)
+#define STATUS_NO_UNICODE_TRANSLATION cpu_to_le32(0xC0000717)
+#define STATUS_ALREADY_REGISTERED cpu_to_le32(0xC0000718)
+#define STATUS_CONTEXT_MISMATCH cpu_to_le32(0xC0000719)
+#define STATUS_PORT_ALREADY_HAS_COMPLETION_LIST cpu_to_le32(0xC000071A)
+#define STATUS_CALLBACK_RETURNED_THREAD_PRIORITY cpu_to_le32(0xC000071B)
+#define STATUS_INVALID_THREAD cpu_to_le32(0xC000071C)
+#define STATUS_CALLBACK_RETURNED_TRANSACTION cpu_to_le32(0xC000071D)
+#define STATUS_CALLBACK_RETURNED_LDR_LOCK cpu_to_le32(0xC000071E)
+#define STATUS_CALLBACK_RETURNED_LANG cpu_to_le32(0xC000071F)
+#define STATUS_CALLBACK_RETURNED_PRI_BACK cpu_to_le32(0xC0000720)
+#define STATUS_CALLBACK_RETURNED_THREAD_AFFINITY cpu_to_le32(0xC0000721)
+#define STATUS_DISK_REPAIR_DISABLED cpu_to_le32(0xC0000800)
+#define STATUS_DS_DOMAIN_RENAME_IN_PROGRESS cpu_to_le32(0xC0000801)
+#define STATUS_DISK_QUOTA_EXCEEDED cpu_to_le32(0xC0000802)
+#define STATUS_CONTENT_BLOCKED cpu_to_le32(0xC0000804)
+#define STATUS_BAD_CLUSTERS cpu_to_le32(0xC0000805)
+#define STATUS_VOLUME_DIRTY cpu_to_le32(0xC0000806)
+#define STATUS_FILE_CHECKED_OUT cpu_to_le32(0xC0000901)
+#define STATUS_CHECKOUT_REQUIRED cpu_to_le32(0xC0000902)
+#define STATUS_BAD_FILE_TYPE cpu_to_le32(0xC0000903)
+#define STATUS_FILE_TOO_LARGE cpu_to_le32(0xC0000904)
+#define STATUS_FORMS_AUTH_REQUIRED cpu_to_le32(0xC0000905)
+#define STATUS_VIRUS_INFECTED cpu_to_le32(0xC0000906)
+#define STATUS_VIRUS_DELETED cpu_to_le32(0xC0000907)
+#define STATUS_BAD_MCFG_TABLE cpu_to_le32(0xC0000908)
+#define STATUS_WOW_ASSERTION cpu_to_le32(0xC0009898)
+#define STATUS_INVALID_SIGNATURE cpu_to_le32(0xC000A000)
+#define STATUS_HMAC_NOT_SUPPORTED cpu_to_le32(0xC000A001)
+#define STATUS_IPSEC_QUEUE_OVERFLOW cpu_to_le32(0xC000A010)
+#define STATUS_ND_QUEUE_OVERFLOW cpu_to_le32(0xC000A011)
+#define STATUS_HOPLIMIT_EXCEEDED cpu_to_le32(0xC000A012)
+#define STATUS_PROTOCOL_NOT_SUPPORTED cpu_to_le32(0xC000A013)
+#define STATUS_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED	\
+	cpu_to_le32(0xC000A080)
+#define STATUS_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR	\
+	cpu_to_le32(0xC000A081)
+#define STATUS_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR cpu_to_le32(0xC000A082)
+#define STATUS_XML_PARSE_ERROR cpu_to_le32(0xC000A083)
+#define STATUS_XMLDSIG_ERROR cpu_to_le32(0xC000A084)
+#define STATUS_WRONG_COMPARTMENT cpu_to_le32(0xC000A085)
+#define STATUS_AUTHIP_FAILURE cpu_to_le32(0xC000A086)
+#define DBG_NO_STATE_CHANGE cpu_to_le32(0xC0010001)
+#define DBG_APP_NOT_IDLE cpu_to_le32(0xC0010002)
+#define RPC_NT_INVALID_STRING_BINDING cpu_to_le32(0xC0020001)
+#define RPC_NT_WRONG_KIND_OF_BINDING cpu_to_le32(0xC0020002)
+#define RPC_NT_INVALID_BINDING cpu_to_le32(0xC0020003)
+#define RPC_NT_PROTSEQ_NOT_SUPPORTED cpu_to_le32(0xC0020004)
+#define RPC_NT_INVALID_RPC_PROTSEQ cpu_to_le32(0xC0020005)
+#define RPC_NT_INVALID_STRING_UUID cpu_to_le32(0xC0020006)
+#define RPC_NT_INVALID_ENDPOINT_FORMAT cpu_to_le32(0xC0020007)
+#define RPC_NT_INVALID_NET_ADDR cpu_to_le32(0xC0020008)
+#define RPC_NT_NO_ENDPOINT_FOUND cpu_to_le32(0xC0020009)
+#define RPC_NT_INVALID_TIMEOUT cpu_to_le32(0xC002000A)
+#define RPC_NT_OBJECT_NOT_FOUND cpu_to_le32(0xC002000B)
+#define RPC_NT_ALREADY_REGISTERED cpu_to_le32(0xC002000C)
+#define RPC_NT_TYPE_ALREADY_REGISTERED cpu_to_le32(0xC002000D)
+#define RPC_NT_ALREADY_LISTENING cpu_to_le32(0xC002000E)
+#define RPC_NT_NO_PROTSEQS_REGISTERED cpu_to_le32(0xC002000F)
+#define RPC_NT_NOT_LISTENING cpu_to_le32(0xC0020010)
+#define RPC_NT_UNKNOWN_MGR_TYPE cpu_to_le32(0xC0020011)
+#define RPC_NT_UNKNOWN_IF cpu_to_le32(0xC0020012)
+#define RPC_NT_NO_BINDINGS cpu_to_le32(0xC0020013)
+#define RPC_NT_NO_PROTSEQS cpu_to_le32(0xC0020014)
+#define RPC_NT_CANT_CREATE_ENDPOINT cpu_to_le32(0xC0020015)
+#define RPC_NT_OUT_OF_RESOURCES cpu_to_le32(0xC0020016)
+#define RPC_NT_SERVER_UNAVAILABLE cpu_to_le32(0xC0020017)
+#define RPC_NT_SERVER_TOO_BUSY cpu_to_le32(0xC0020018)
+#define RPC_NT_INVALID_NETWORK_OPTIONS cpu_to_le32(0xC0020019)
+#define RPC_NT_NO_CALL_ACTIVE cpu_to_le32(0xC002001A)
+#define RPC_NT_CALL_FAILED cpu_to_le32(0xC002001B)
+#define RPC_NT_CALL_FAILED_DNE cpu_to_le32(0xC002001C)
+#define RPC_NT_PROTOCOL_ERROR cpu_to_le32(0xC002001D)
+#define RPC_NT_UNSUPPORTED_TRANS_SYN cpu_to_le32(0xC002001F)
+#define RPC_NT_UNSUPPORTED_TYPE cpu_to_le32(0xC0020021)
+#define RPC_NT_INVALID_TAG cpu_to_le32(0xC0020022)
+#define RPC_NT_INVALID_BOUND cpu_to_le32(0xC0020023)
+#define RPC_NT_NO_ENTRY_NAME cpu_to_le32(0xC0020024)
+#define RPC_NT_INVALID_NAME_SYNTAX cpu_to_le32(0xC0020025)
+#define RPC_NT_UNSUPPORTED_NAME_SYNTAX cpu_to_le32(0xC0020026)
+#define RPC_NT_UUID_NO_ADDRESS cpu_to_le32(0xC0020028)
+#define RPC_NT_DUPLICATE_ENDPOINT cpu_to_le32(0xC0020029)
+#define RPC_NT_UNKNOWN_AUTHN_TYPE cpu_to_le32(0xC002002A)
+#define RPC_NT_MAX_CALLS_TOO_SMALL cpu_to_le32(0xC002002B)
+#define RPC_NT_STRING_TOO_LONG cpu_to_le32(0xC002002C)
+#define RPC_NT_PROTSEQ_NOT_FOUND cpu_to_le32(0xC002002D)
+#define RPC_NT_PROCNUM_OUT_OF_RANGE cpu_to_le32(0xC002002E)
+#define RPC_NT_BINDING_HAS_NO_AUTH cpu_to_le32(0xC002002F)
+#define RPC_NT_UNKNOWN_AUTHN_SERVICE cpu_to_le32(0xC0020030)
+#define RPC_NT_UNKNOWN_AUTHN_LEVEL cpu_to_le32(0xC0020031)
+#define RPC_NT_INVALID_AUTH_IDENTITY cpu_to_le32(0xC0020032)
+#define RPC_NT_UNKNOWN_AUTHZ_SERVICE cpu_to_le32(0xC0020033)
+#define EPT_NT_INVALID_ENTRY cpu_to_le32(0xC0020034)
+#define EPT_NT_CANT_PERFORM_OP cpu_to_le32(0xC0020035)
+#define EPT_NT_NOT_REGISTERED cpu_to_le32(0xC0020036)
+#define RPC_NT_NOTHING_TO_EXPORT cpu_to_le32(0xC0020037)
+#define RPC_NT_INCOMPLETE_NAME cpu_to_le32(0xC0020038)
+#define RPC_NT_INVALID_VERS_OPTION cpu_to_le32(0xC0020039)
+#define RPC_NT_NO_MORE_MEMBERS cpu_to_le32(0xC002003A)
+#define RPC_NT_NOT_ALL_OBJS_UNEXPORTED cpu_to_le32(0xC002003B)
+#define RPC_NT_INTERFACE_NOT_FOUND cpu_to_le32(0xC002003C)
+#define RPC_NT_ENTRY_ALREADY_EXISTS cpu_to_le32(0xC002003D)
+#define RPC_NT_ENTRY_NOT_FOUND cpu_to_le32(0xC002003E)
+#define RPC_NT_NAME_SERVICE_UNAVAILABLE cpu_to_le32(0xC002003F)
+#define RPC_NT_INVALID_NAF_ID cpu_to_le32(0xC0020040)
+#define RPC_NT_CANNOT_SUPPORT cpu_to_le32(0xC0020041)
+#define RPC_NT_NO_CONTEXT_AVAILABLE cpu_to_le32(0xC0020042)
+#define RPC_NT_INTERNAL_ERROR cpu_to_le32(0xC0020043)
+#define RPC_NT_ZERO_DIVIDE cpu_to_le32(0xC0020044)
+#define RPC_NT_ADDRESS_ERROR cpu_to_le32(0xC0020045)
+#define RPC_NT_FP_DIV_ZERO cpu_to_le32(0xC0020046)
+#define RPC_NT_FP_UNDERFLOW cpu_to_le32(0xC0020047)
+#define RPC_NT_FP_OVERFLOW cpu_to_le32(0xC0020048)
+#define RPC_NT_CALL_IN_PROGRESS cpu_to_le32(0xC0020049)
+#define RPC_NT_NO_MORE_BINDINGS cpu_to_le32(0xC002004A)
+#define RPC_NT_GROUP_MEMBER_NOT_FOUND cpu_to_le32(0xC002004B)
+#define EPT_NT_CANT_CREATE cpu_to_le32(0xC002004C)
+#define RPC_NT_INVALID_OBJECT cpu_to_le32(0xC002004D)
+#define RPC_NT_NO_INTERFACES cpu_to_le32(0xC002004F)
+#define RPC_NT_CALL_CANCELLED cpu_to_le32(0xC0020050)
+#define RPC_NT_BINDING_INCOMPLETE cpu_to_le32(0xC0020051)
+#define RPC_NT_COMM_FAILURE cpu_to_le32(0xC0020052)
+#define RPC_NT_UNSUPPORTED_AUTHN_LEVEL cpu_to_le32(0xC0020053)
+#define RPC_NT_NO_PRINC_NAME cpu_to_le32(0xC0020054)
+#define RPC_NT_NOT_RPC_ERROR cpu_to_le32(0xC0020055)
+#define RPC_NT_SEC_PKG_ERROR cpu_to_le32(0xC0020057)
+#define RPC_NT_NOT_CANCELLED cpu_to_le32(0xC0020058)
+#define RPC_NT_INVALID_ASYNC_HANDLE cpu_to_le32(0xC0020062)
+#define RPC_NT_INVALID_ASYNC_CALL cpu_to_le32(0xC0020063)
+#define RPC_NT_PROXY_ACCESS_DENIED cpu_to_le32(0xC0020064)
+#define RPC_NT_NO_MORE_ENTRIES cpu_to_le32(0xC0030001)
+#define RPC_NT_SS_CHAR_TRANS_OPEN_FAIL cpu_to_le32(0xC0030002)
+#define RPC_NT_SS_CHAR_TRANS_SHORT_FILE cpu_to_le32(0xC0030003)
+#define RPC_NT_SS_IN_NULL_CONTEXT cpu_to_le32(0xC0030004)
+#define RPC_NT_SS_CONTEXT_MISMATCH cpu_to_le32(0xC0030005)
+#define RPC_NT_SS_CONTEXT_DAMAGED cpu_to_le32(0xC0030006)
+#define RPC_NT_SS_HANDLES_MISMATCH cpu_to_le32(0xC0030007)
+#define RPC_NT_SS_CANNOT_GET_CALL_HANDLE cpu_to_le32(0xC0030008)
+#define RPC_NT_NULL_REF_POINTER cpu_to_le32(0xC0030009)
+#define RPC_NT_ENUM_VALUE_OUT_OF_RANGE cpu_to_le32(0xC003000A)
+#define RPC_NT_BYTE_COUNT_TOO_SMALL cpu_to_le32(0xC003000B)
+#define RPC_NT_BAD_STUB_DATA cpu_to_le32(0xC003000C)
+#define RPC_NT_INVALID_ES_ACTION cpu_to_le32(0xC0030059)
+#define RPC_NT_WRONG_ES_VERSION cpu_to_le32(0xC003005A)
+#define RPC_NT_WRONG_STUB_VERSION cpu_to_le32(0xC003005B)
+#define RPC_NT_INVALID_PIPE_OBJECT cpu_to_le32(0xC003005C)
+#define RPC_NT_INVALID_PIPE_OPERATION cpu_to_le32(0xC003005D)
+#define RPC_NT_WRONG_PIPE_VERSION cpu_to_le32(0xC003005E)
+#define RPC_NT_PIPE_CLOSED cpu_to_le32(0xC003005F)
+#define RPC_NT_PIPE_DISCIPLINE_ERROR cpu_to_le32(0xC0030060)
+#define RPC_NT_PIPE_EMPTY cpu_to_le32(0xC0030061)
+#define STATUS_PNP_BAD_MPS_TABLE cpu_to_le32(0xC0040035)
+#define STATUS_PNP_TRANSLATION_FAILED cpu_to_le32(0xC0040036)
+#define STATUS_PNP_IRQ_TRANSLATION_FAILED cpu_to_le32(0xC0040037)
+#define STATUS_PNP_INVALID_ID cpu_to_le32(0xC0040038)
+#define STATUS_IO_REISSUE_AS_CACHED cpu_to_le32(0xC0040039)
+#define STATUS_CTX_WINSTATION_NAME_INVALID cpu_to_le32(0xC00A0001)
+#define STATUS_CTX_INVALID_PD cpu_to_le32(0xC00A0002)
+#define STATUS_CTX_PD_NOT_FOUND cpu_to_le32(0xC00A0003)
+#define STATUS_CTX_CLOSE_PENDING cpu_to_le32(0xC00A0006)
+#define STATUS_CTX_NO_OUTBUF cpu_to_le32(0xC00A0007)
+#define STATUS_CTX_MODEM_INF_NOT_FOUND cpu_to_le32(0xC00A0008)
+#define STATUS_CTX_INVALID_MODEMNAME cpu_to_le32(0xC00A0009)
+#define STATUS_CTX_RESPONSE_ERROR cpu_to_le32(0xC00A000A)
+#define STATUS_CTX_MODEM_RESPONSE_TIMEOUT cpu_to_le32(0xC00A000B)
+#define STATUS_CTX_MODEM_RESPONSE_NO_CARRIER cpu_to_le32(0xC00A000C)
+#define STATUS_CTX_MODEM_RESPONSE_NO_DIALTONE cpu_to_le32(0xC00A000D)
+#define STATUS_CTX_MODEM_RESPONSE_BUSY cpu_to_le32(0xC00A000E)
+#define STATUS_CTX_MODEM_RESPONSE_VOICE cpu_to_le32(0xC00A000F)
+#define STATUS_CTX_TD_ERROR cpu_to_le32(0xC00A0010)
+#define STATUS_CTX_LICENSE_CLIENT_INVALID cpu_to_le32(0xC00A0012)
+#define STATUS_CTX_LICENSE_NOT_AVAILABLE cpu_to_le32(0xC00A0013)
+#define STATUS_CTX_LICENSE_EXPIRED cpu_to_le32(0xC00A0014)
+#define STATUS_CTX_WINSTATION_NOT_FOUND cpu_to_le32(0xC00A0015)
+#define STATUS_CTX_WINSTATION_NAME_COLLISION cpu_to_le32(0xC00A0016)
+#define STATUS_CTX_WINSTATION_BUSY cpu_to_le32(0xC00A0017)
+#define STATUS_CTX_BAD_VIDEO_MODE cpu_to_le32(0xC00A0018)
+#define STATUS_CTX_GRAPHICS_INVALID cpu_to_le32(0xC00A0022)
+#define STATUS_CTX_NOT_CONSOLE cpu_to_le32(0xC00A0024)
+#define STATUS_CTX_CLIENT_QUERY_TIMEOUT cpu_to_le32(0xC00A0026)
+#define STATUS_CTX_CONSOLE_DISCONNECT cpu_to_le32(0xC00A0027)
+#define STATUS_CTX_CONSOLE_CONNECT cpu_to_le32(0xC00A0028)
+#define STATUS_CTX_SHADOW_DENIED cpu_to_le32(0xC00A002A)
+#define STATUS_CTX_WINSTATION_ACCESS_DENIED cpu_to_le32(0xC00A002B)
+#define STATUS_CTX_INVALID_WD cpu_to_le32(0xC00A002E)
+#define STATUS_CTX_WD_NOT_FOUND cpu_to_le32(0xC00A002F)
+#define STATUS_CTX_SHADOW_INVALID cpu_to_le32(0xC00A0030)
+#define STATUS_CTX_SHADOW_DISABLED cpu_to_le32(0xC00A0031)
+#define STATUS_RDP_PROTOCOL_ERROR cpu_to_le32(0xC00A0032)
+#define STATUS_CTX_CLIENT_LICENSE_NOT_SET cpu_to_le32(0xC00A0033)
+#define STATUS_CTX_CLIENT_LICENSE_IN_USE cpu_to_le32(0xC00A0034)
+#define STATUS_CTX_SHADOW_ENDED_BY_MODE_CHANGE cpu_to_le32(0xC00A0035)
+#define STATUS_CTX_SHADOW_NOT_RUNNING cpu_to_le32(0xC00A0036)
+#define STATUS_CTX_LOGON_DISABLED cpu_to_le32(0xC00A0037)
+#define STATUS_CTX_SECURITY_LAYER_ERROR cpu_to_le32(0xC00A0038)
+#define STATUS_TS_INCOMPATIBLE_SESSIONS cpu_to_le32(0xC00A0039)
+#define STATUS_MUI_FILE_NOT_FOUND cpu_to_le32(0xC00B0001)
+#define STATUS_MUI_INVALID_FILE cpu_to_le32(0xC00B0002)
+#define STATUS_MUI_INVALID_RC_CONFIG cpu_to_le32(0xC00B0003)
+#define STATUS_MUI_INVALID_LOCALE_NAME cpu_to_le32(0xC00B0004)
+#define STATUS_MUI_INVALID_ULTIMATEFALLBACK_NAME cpu_to_le32(0xC00B0005)
+#define STATUS_MUI_FILE_NOT_LOADED cpu_to_le32(0xC00B0006)
+#define STATUS_RESOURCE_ENUM_USER_STOP cpu_to_le32(0xC00B0007)
+#define STATUS_CLUSTER_INVALID_NODE cpu_to_le32(0xC0130001)
+#define STATUS_CLUSTER_NODE_EXISTS cpu_to_le32(0xC0130002)
+#define STATUS_CLUSTER_JOIN_IN_PROGRESS cpu_to_le32(0xC0130003)
+#define STATUS_CLUSTER_NODE_NOT_FOUND cpu_to_le32(0xC0130004)
+#define STATUS_CLUSTER_LOCAL_NODE_NOT_FOUND cpu_to_le32(0xC0130005)
+#define STATUS_CLUSTER_NETWORK_EXISTS cpu_to_le32(0xC0130006)
+#define STATUS_CLUSTER_NETWORK_NOT_FOUND cpu_to_le32(0xC0130007)
+#define STATUS_CLUSTER_NETINTERFACE_EXISTS cpu_to_le32(0xC0130008)
+#define STATUS_CLUSTER_NETINTERFACE_NOT_FOUND cpu_to_le32(0xC0130009)
+#define STATUS_CLUSTER_INVALID_REQUEST cpu_to_le32(0xC013000A)
+#define STATUS_CLUSTER_INVALID_NETWORK_PROVIDER cpu_to_le32(0xC013000B)
+#define STATUS_CLUSTER_NODE_DOWN cpu_to_le32(0xC013000C)
+#define STATUS_CLUSTER_NODE_UNREACHABLE cpu_to_le32(0xC013000D)
+#define STATUS_CLUSTER_NODE_NOT_MEMBER cpu_to_le32(0xC013000E)
+#define STATUS_CLUSTER_JOIN_NOT_IN_PROGRESS cpu_to_le32(0xC013000F)
+#define STATUS_CLUSTER_INVALID_NETWORK cpu_to_le32(0xC0130010)
+#define STATUS_CLUSTER_NO_NET_ADAPTERS cpu_to_le32(0xC0130011)
+#define STATUS_CLUSTER_NODE_UP cpu_to_le32(0xC0130012)
+#define STATUS_CLUSTER_NODE_PAUSED cpu_to_le32(0xC0130013)
+#define STATUS_CLUSTER_NODE_NOT_PAUSED cpu_to_le32(0xC0130014)
+#define STATUS_CLUSTER_NO_SECURITY_CONTEXT cpu_to_le32(0xC0130015)
+#define STATUS_CLUSTER_NETWORK_NOT_INTERNAL cpu_to_le32(0xC0130016)
+#define STATUS_CLUSTER_POISONED cpu_to_le32(0xC0130017)
+#define STATUS_ACPI_INVALID_OPCODE cpu_to_le32(0xC0140001)
+#define STATUS_ACPI_STACK_OVERFLOW cpu_to_le32(0xC0140002)
+#define STATUS_ACPI_ASSERT_FAILED cpu_to_le32(0xC0140003)
+#define STATUS_ACPI_INVALID_INDEX cpu_to_le32(0xC0140004)
+#define STATUS_ACPI_INVALID_ARGUMENT cpu_to_le32(0xC0140005)
+#define STATUS_ACPI_FATAL cpu_to_le32(0xC0140006)
+#define STATUS_ACPI_INVALID_SUPERNAME cpu_to_le32(0xC0140007)
+#define STATUS_ACPI_INVALID_ARGTYPE cpu_to_le32(0xC0140008)
+#define STATUS_ACPI_INVALID_OBJTYPE cpu_to_le32(0xC0140009)
+#define STATUS_ACPI_INVALID_TARGETTYPE cpu_to_le32(0xC014000A)
+#define STATUS_ACPI_INCORRECT_ARGUMENT_COUNT cpu_to_le32(0xC014000B)
+#define STATUS_ACPI_ADDRESS_NOT_MAPPED cpu_to_le32(0xC014000C)
+#define STATUS_ACPI_INVALID_EVENTTYPE cpu_to_le32(0xC014000D)
+#define STATUS_ACPI_HANDLER_COLLISION cpu_to_le32(0xC014000E)
+#define STATUS_ACPI_INVALID_DATA cpu_to_le32(0xC014000F)
+#define STATUS_ACPI_INVALID_REGION cpu_to_le32(0xC0140010)
+#define STATUS_ACPI_INVALID_ACCESS_SIZE cpu_to_le32(0xC0140011)
+#define STATUS_ACPI_ACQUIRE_GLOBAL_LOCK cpu_to_le32(0xC0140012)
+#define STATUS_ACPI_ALREADY_INITIALIZED cpu_to_le32(0xC0140013)
+#define STATUS_ACPI_NOT_INITIALIZED cpu_to_le32(0xC0140014)
+#define STATUS_ACPI_INVALID_MUTEX_LEVEL cpu_to_le32(0xC0140015)
+#define STATUS_ACPI_MUTEX_NOT_OWNED cpu_to_le32(0xC0140016)
+#define STATUS_ACPI_MUTEX_NOT_OWNER cpu_to_le32(0xC0140017)
+#define STATUS_ACPI_RS_ACCESS cpu_to_le32(0xC0140018)
+#define STATUS_ACPI_INVALID_TABLE cpu_to_le32(0xC0140019)
+#define STATUS_ACPI_REG_HANDLER_FAILED cpu_to_le32(0xC0140020)
+#define STATUS_ACPI_POWER_REQUEST_FAILED cpu_to_le32(0xC0140021)
+#define STATUS_SXS_SECTION_NOT_FOUND cpu_to_le32(0xC0150001)
+#define STATUS_SXS_CANT_GEN_ACTCTX cpu_to_le32(0xC0150002)
+#define STATUS_SXS_INVALID_ACTCTXDATA_FORMAT cpu_to_le32(0xC0150003)
+#define STATUS_SXS_ASSEMBLY_NOT_FOUND cpu_to_le32(0xC0150004)
+#define STATUS_SXS_MANIFEST_FORMAT_ERROR cpu_to_le32(0xC0150005)
+#define STATUS_SXS_MANIFEST_PARSE_ERROR cpu_to_le32(0xC0150006)
+#define STATUS_SXS_ACTIVATION_CONTEXT_DISABLED cpu_to_le32(0xC0150007)
+#define STATUS_SXS_KEY_NOT_FOUND cpu_to_le32(0xC0150008)
+#define STATUS_SXS_VERSION_CONFLICT cpu_to_le32(0xC0150009)
+#define STATUS_SXS_WRONG_SECTION_TYPE cpu_to_le32(0xC015000A)
+#define STATUS_SXS_THREAD_QUERIES_DISABLED cpu_to_le32(0xC015000B)
+#define STATUS_SXS_ASSEMBLY_MISSING cpu_to_le32(0xC015000C)
+#define STATUS_SXS_PROCESS_DEFAULT_ALREADY_SET cpu_to_le32(0xC015000E)
+#define STATUS_SXS_EARLY_DEACTIVATION cpu_to_le32(0xC015000F)
+#define STATUS_SXS_INVALID_DEACTIVATION cpu_to_le32(0xC0150010)
+#define STATUS_SXS_MULTIPLE_DEACTIVATION cpu_to_le32(0xC0150011)
+#define STATUS_SXS_SYSTEM_DEFAULT_ACTIVATION_CONTEXT_EMPTY	\
+	cpu_to_le32(0xC0150012)
+#define STATUS_SXS_PROCESS_TERMINATION_REQUESTED cpu_to_le32(0xC0150013)
+#define STATUS_SXS_CORRUPT_ACTIVATION_STACK cpu_to_le32(0xC0150014)
+#define STATUS_SXS_CORRUPTION cpu_to_le32(0xC0150015)
+#define STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE cpu_to_le32(0xC0150016)
+#define STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME cpu_to_le32(0xC0150017)
+#define STATUS_SXS_IDENTITY_DUPLICATE_ATTRIBUTE cpu_to_le32(0xC0150018)
+#define STATUS_SXS_IDENTITY_PARSE_ERROR cpu_to_le32(0xC0150019)
+#define STATUS_SXS_COMPONENT_STORE_CORRUPT cpu_to_le32(0xC015001A)
+#define STATUS_SXS_FILE_HASH_MISMATCH cpu_to_le32(0xC015001B)
+#define STATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT	\
+	cpu_to_le32(0xC015001C)
+#define STATUS_SXS_IDENTITIES_DIFFERENT cpu_to_le32(0xC015001D)
+#define STATUS_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT cpu_to_le32(0xC015001E)
+#define STATUS_SXS_FILE_NOT_PART_OF_ASSEMBLY cpu_to_le32(0xC015001F)
+#define STATUS_ADVANCED_INSTALLER_FAILED cpu_to_le32(0xC0150020)
+#define STATUS_XML_ENCODING_MISMATCH cpu_to_le32(0xC0150021)
+#define STATUS_SXS_MANIFEST_TOO_BIG cpu_to_le32(0xC0150022)
+#define STATUS_SXS_SETTING_NOT_REGISTERED cpu_to_le32(0xC0150023)
+#define STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE cpu_to_le32(0xC0150024)
+#define STATUS_SMI_PRIMITIVE_INSTALLER_FAILED cpu_to_le32(0xC0150025)
+#define STATUS_GENERIC_COMMAND_FAILED cpu_to_le32(0xC0150026)
+#define STATUS_SXS_FILE_HASH_MISSING cpu_to_le32(0xC0150027)
+#define STATUS_TRANSACTIONAL_CONFLICT cpu_to_le32(0xC0190001)
+#define STATUS_INVALID_TRANSACTION cpu_to_le32(0xC0190002)
+#define STATUS_TRANSACTION_NOT_ACTIVE cpu_to_le32(0xC0190003)
+#define STATUS_TM_INITIALIZATION_FAILED cpu_to_le32(0xC0190004)
+#define STATUS_RM_NOT_ACTIVE cpu_to_le32(0xC0190005)
+#define STATUS_RM_METADATA_CORRUPT cpu_to_le32(0xC0190006)
+#define STATUS_TRANSACTION_NOT_JOINED cpu_to_le32(0xC0190007)
+#define STATUS_DIRECTORY_NOT_RM cpu_to_le32(0xC0190008)
+#define STATUS_TRANSACTIONS_UNSUPPORTED_REMOTE cpu_to_le32(0xC019000A)
+#define STATUS_LOG_RESIZE_INVALID_SIZE cpu_to_le32(0xC019000B)
+#define STATUS_REMOTE_FILE_VERSION_MISMATCH cpu_to_le32(0xC019000C)
+#define STATUS_CRM_PROTOCOL_ALREADY_EXISTS cpu_to_le32(0xC019000F)
+#define STATUS_TRANSACTION_PROPAGATION_FAILED cpu_to_le32(0xC0190010)
+#define STATUS_CRM_PROTOCOL_NOT_FOUND cpu_to_le32(0xC0190011)
+#define STATUS_TRANSACTION_SUPERIOR_EXISTS cpu_to_le32(0xC0190012)
+#define STATUS_TRANSACTION_REQUEST_NOT_VALID cpu_to_le32(0xC0190013)
+#define STATUS_TRANSACTION_NOT_REQUESTED cpu_to_le32(0xC0190014)
+#define STATUS_TRANSACTION_ALREADY_ABORTED cpu_to_le32(0xC0190015)
+#define STATUS_TRANSACTION_ALREADY_COMMITTED cpu_to_le32(0xC0190016)
+#define STATUS_TRANSACTION_INVALID_MARSHALL_BUFFER cpu_to_le32(0xC0190017)
+#define STATUS_CURRENT_TRANSACTION_NOT_VALID cpu_to_le32(0xC0190018)
+#define STATUS_LOG_GROWTH_FAILED cpu_to_le32(0xC0190019)
+#define STATUS_OBJECT_NO_LONGER_EXISTS cpu_to_le32(0xC0190021)
+#define STATUS_STREAM_MINIVERSION_NOT_FOUND cpu_to_le32(0xC0190022)
+#define STATUS_STREAM_MINIVERSION_NOT_VALID cpu_to_le32(0xC0190023)
+#define STATUS_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION	\
+	cpu_to_le32(0xC0190024)
+#define STATUS_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT cpu_to_le32(0xC0190025)
+#define STATUS_CANT_CREATE_MORE_STREAM_MINIVERSIONS cpu_to_le32(0xC0190026)
+#define STATUS_HANDLE_NO_LONGER_VALID cpu_to_le32(0xC0190028)
+#define STATUS_LOG_CORRUPTION_DETECTED cpu_to_le32(0xC0190030)
+#define STATUS_RM_DISCONNECTED cpu_to_le32(0xC0190032)
+#define STATUS_ENLISTMENT_NOT_SUPERIOR cpu_to_le32(0xC0190033)
+#define STATUS_FILE_IDENTITY_NOT_PERSISTENT cpu_to_le32(0xC0190036)
+#define STATUS_CANT_BREAK_TRANSACTIONAL_DEPENDENCY cpu_to_le32(0xC0190037)
+#define STATUS_CANT_CROSS_RM_BOUNDARY cpu_to_le32(0xC0190038)
+#define STATUS_TXF_DIR_NOT_EMPTY cpu_to_le32(0xC0190039)
+#define STATUS_INDOUBT_TRANSACTIONS_EXIST cpu_to_le32(0xC019003A)
+#define STATUS_TM_VOLATILE cpu_to_le32(0xC019003B)
+#define STATUS_ROLLBACK_TIMER_EXPIRED cpu_to_le32(0xC019003C)
+#define STATUS_TXF_ATTRIBUTE_CORRUPT cpu_to_le32(0xC019003D)
+#define STATUS_EFS_NOT_ALLOWED_IN_TRANSACTION cpu_to_le32(0xC019003E)
+#define STATUS_TRANSACTIONAL_OPEN_NOT_ALLOWED cpu_to_le32(0xC019003F)
+#define STATUS_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE cpu_to_le32(0xC0190040)
+#define STATUS_TRANSACTION_REQUIRED_PROMOTION cpu_to_le32(0xC0190043)
+#define STATUS_CANNOT_EXECUTE_FILE_IN_TRANSACTION cpu_to_le32(0xC0190044)
+#define STATUS_TRANSACTIONS_NOT_FROZEN cpu_to_le32(0xC0190045)
+#define STATUS_TRANSACTION_FREEZE_IN_PROGRESS cpu_to_le32(0xC0190046)
+#define STATUS_NOT_SNAPSHOT_VOLUME cpu_to_le32(0xC0190047)
+#define STATUS_NO_SAVEPOINT_WITH_OPEN_FILES cpu_to_le32(0xC0190048)
+#define STATUS_SPARSE_NOT_ALLOWED_IN_TRANSACTION cpu_to_le32(0xC0190049)
+#define STATUS_TM_IDENTITY_MISMATCH cpu_to_le32(0xC019004A)
+#define STATUS_FLOATED_SECTION cpu_to_le32(0xC019004B)
+#define STATUS_CANNOT_ACCEPT_TRANSACTED_WORK cpu_to_le32(0xC019004C)
+#define STATUS_CANNOT_ABORT_TRANSACTIONS cpu_to_le32(0xC019004D)
+#define STATUS_TRANSACTION_NOT_FOUND cpu_to_le32(0xC019004E)
+#define STATUS_RESOURCEMANAGER_NOT_FOUND cpu_to_le32(0xC019004F)
+#define STATUS_ENLISTMENT_NOT_FOUND cpu_to_le32(0xC0190050)
+#define STATUS_TRANSACTIONMANAGER_NOT_FOUND cpu_to_le32(0xC0190051)
+#define STATUS_TRANSACTIONMANAGER_NOT_ONLINE cpu_to_le32(0xC0190052)
+#define STATUS_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION	\
+	cpu_to_le32(0xC0190053)
+#define STATUS_TRANSACTION_NOT_ROOT cpu_to_le32(0xC0190054)
+#define STATUS_TRANSACTION_OBJECT_EXPIRED cpu_to_le32(0xC0190055)
+#define STATUS_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION cpu_to_le32(0xC0190056)
+#define STATUS_TRANSACTION_RESPONSE_NOT_ENLISTED cpu_to_le32(0xC0190057)
+#define STATUS_TRANSACTION_RECORD_TOO_LONG cpu_to_le32(0xC0190058)
+#define STATUS_NO_LINK_TRACKING_IN_TRANSACTION cpu_to_le32(0xC0190059)
+#define STATUS_OPERATION_NOT_SUPPORTED_IN_TRANSACTION cpu_to_le32(0xC019005A)
+#define STATUS_TRANSACTION_INTEGRITY_VIOLATED cpu_to_le32(0xC019005B)
+#define STATUS_LOG_SECTOR_INVALID cpu_to_le32(0xC01A0001)
+#define STATUS_LOG_SECTOR_PARITY_INVALID cpu_to_le32(0xC01A0002)
+#define STATUS_LOG_SECTOR_REMAPPED cpu_to_le32(0xC01A0003)
+#define STATUS_LOG_BLOCK_INCOMPLETE cpu_to_le32(0xC01A0004)
+#define STATUS_LOG_INVALID_RANGE cpu_to_le32(0xC01A0005)
+#define STATUS_LOG_BLOCKS_EXHAUSTED cpu_to_le32(0xC01A0006)
+#define STATUS_LOG_READ_CONTEXT_INVALID cpu_to_le32(0xC01A0007)
+#define STATUS_LOG_RESTART_INVALID cpu_to_le32(0xC01A0008)
+#define STATUS_LOG_BLOCK_VERSION cpu_to_le32(0xC01A0009)
+#define STATUS_LOG_BLOCK_INVALID cpu_to_le32(0xC01A000A)
+#define STATUS_LOG_READ_MODE_INVALID cpu_to_le32(0xC01A000B)
+#define STATUS_LOG_METADATA_CORRUPT cpu_to_le32(0xC01A000D)
+#define STATUS_LOG_METADATA_INVALID cpu_to_le32(0xC01A000E)
+#define STATUS_LOG_METADATA_INCONSISTENT cpu_to_le32(0xC01A000F)
+#define STATUS_LOG_RESERVATION_INVALID cpu_to_le32(0xC01A0010)
+#define STATUS_LOG_CANT_DELETE cpu_to_le32(0xC01A0011)
+#define STATUS_LOG_CONTAINER_LIMIT_EXCEEDED cpu_to_le32(0xC01A0012)
+#define STATUS_LOG_START_OF_LOG cpu_to_le32(0xC01A0013)
+#define STATUS_LOG_POLICY_ALREADY_INSTALLED cpu_to_le32(0xC01A0014)
+#define STATUS_LOG_POLICY_NOT_INSTALLED cpu_to_le32(0xC01A0015)
+#define STATUS_LOG_POLICY_INVALID cpu_to_le32(0xC01A0016)
+#define STATUS_LOG_POLICY_CONFLICT cpu_to_le32(0xC01A0017)
+#define STATUS_LOG_PINNED_ARCHIVE_TAIL cpu_to_le32(0xC01A0018)
+#define STATUS_LOG_RECORD_NONEXISTENT cpu_to_le32(0xC01A0019)
+#define STATUS_LOG_RECORDS_RESERVED_INVALID cpu_to_le32(0xC01A001A)
+#define STATUS_LOG_SPACE_RESERVED_INVALID cpu_to_le32(0xC01A001B)
+#define STATUS_LOG_TAIL_INVALID cpu_to_le32(0xC01A001C)
+#define STATUS_LOG_FULL cpu_to_le32(0xC01A001D)
+#define STATUS_LOG_MULTIPLEXED cpu_to_le32(0xC01A001E)
+#define STATUS_LOG_DEDICATED cpu_to_le32(0xC01A001F)
+#define STATUS_LOG_ARCHIVE_NOT_IN_PROGRESS cpu_to_le32(0xC01A0020)
+#define STATUS_LOG_ARCHIVE_IN_PROGRESS cpu_to_le32(0xC01A0021)
+#define STATUS_LOG_EPHEMERAL cpu_to_le32(0xC01A0022)
+#define STATUS_LOG_NOT_ENOUGH_CONTAINERS cpu_to_le32(0xC01A0023)
+#define STATUS_LOG_CLIENT_ALREADY_REGISTERED cpu_to_le32(0xC01A0024)
+#define STATUS_LOG_CLIENT_NOT_REGISTERED cpu_to_le32(0xC01A0025)
+#define STATUS_LOG_FULL_HANDLER_IN_PROGRESS cpu_to_le32(0xC01A0026)
+#define STATUS_LOG_CONTAINER_READ_FAILED cpu_to_le32(0xC01A0027)
+#define STATUS_LOG_CONTAINER_WRITE_FAILED cpu_to_le32(0xC01A0028)
+#define STATUS_LOG_CONTAINER_OPEN_FAILED cpu_to_le32(0xC01A0029)
+#define STATUS_LOG_CONTAINER_STATE_INVALID cpu_to_le32(0xC01A002A)
+#define STATUS_LOG_STATE_INVALID cpu_to_le32(0xC01A002B)
+#define STATUS_LOG_PINNED cpu_to_le32(0xC01A002C)
+#define STATUS_LOG_METADATA_FLUSH_FAILED cpu_to_le32(0xC01A002D)
+#define STATUS_LOG_INCONSISTENT_SECURITY cpu_to_le32(0xC01A002E)
+#define STATUS_LOG_APPENDED_FLUSH_FAILED cpu_to_le32(0xC01A002F)
+#define STATUS_LOG_PINNED_RESERVATION cpu_to_le32(0xC01A0030)
+#define STATUS_VIDEO_HUNG_DISPLAY_DRIVER_THREAD cpu_to_le32(0xC01B00EA)
+#define STATUS_FLT_NO_HANDLER_DEFINED cpu_to_le32(0xC01C0001)
+#define STATUS_FLT_CONTEXT_ALREADY_DEFINED cpu_to_le32(0xC01C0002)
+#define STATUS_FLT_INVALID_ASYNCHRONOUS_REQUEST cpu_to_le32(0xC01C0003)
+#define STATUS_FLT_DISALLOW_FAST_IO cpu_to_le32(0xC01C0004)
+#define STATUS_FLT_INVALID_NAME_REQUEST cpu_to_le32(0xC01C0005)
+#define STATUS_FLT_NOT_SAFE_TO_POST_OPERATION cpu_to_le32(0xC01C0006)
+#define STATUS_FLT_NOT_INITIALIZED cpu_to_le32(0xC01C0007)
+#define STATUS_FLT_FILTER_NOT_READY cpu_to_le32(0xC01C0008)
+#define STATUS_FLT_POST_OPERATION_CLEANUP cpu_to_le32(0xC01C0009)
+#define STATUS_FLT_INTERNAL_ERROR cpu_to_le32(0xC01C000A)
+#define STATUS_FLT_DELETING_OBJECT cpu_to_le32(0xC01C000B)
+#define STATUS_FLT_MUST_BE_NONPAGED_POOL cpu_to_le32(0xC01C000C)
+#define STATUS_FLT_DUPLICATE_ENTRY cpu_to_le32(0xC01C000D)
+#define STATUS_FLT_CBDQ_DISABLED cpu_to_le32(0xC01C000E)
+#define STATUS_FLT_DO_NOT_ATTACH cpu_to_le32(0xC01C000F)
+#define STATUS_FLT_DO_NOT_DETACH cpu_to_le32(0xC01C0010)
+#define STATUS_FLT_INSTANCE_ALTITUDE_COLLISION cpu_to_le32(0xC01C0011)
+#define STATUS_FLT_INSTANCE_NAME_COLLISION cpu_to_le32(0xC01C0012)
+#define STATUS_FLT_FILTER_NOT_FOUND cpu_to_le32(0xC01C0013)
+#define STATUS_FLT_VOLUME_NOT_FOUND cpu_to_le32(0xC01C0014)
+#define STATUS_FLT_INSTANCE_NOT_FOUND cpu_to_le32(0xC01C0015)
+#define STATUS_FLT_CONTEXT_ALLOCATION_NOT_FOUND cpu_to_le32(0xC01C0016)
+#define STATUS_FLT_INVALID_CONTEXT_REGISTRATION cpu_to_le32(0xC01C0017)
+#define STATUS_FLT_NAME_CACHE_MISS cpu_to_le32(0xC01C0018)
+#define STATUS_FLT_NO_DEVICE_OBJECT cpu_to_le32(0xC01C0019)
+#define STATUS_FLT_VOLUME_ALREADY_MOUNTED cpu_to_le32(0xC01C001A)
+#define STATUS_FLT_ALREADY_ENLISTED cpu_to_le32(0xC01C001B)
+#define STATUS_FLT_CONTEXT_ALREADY_LINKED cpu_to_le32(0xC01C001C)
+#define STATUS_FLT_NO_WAITER_FOR_REPLY cpu_to_le32(0xC01C0020)
+#define STATUS_MONITOR_NO_DESCRIPTOR cpu_to_le32(0xC01D0001)
+#define STATUS_MONITOR_UNKNOWN_DESCRIPTOR_FORMAT cpu_to_le32(0xC01D0002)
+#define STATUS_MONITOR_INVALID_DESCRIPTOR_CHECKSUM cpu_to_le32(0xC01D0003)
+#define STATUS_MONITOR_INVALID_STANDARD_TIMING_BLOCK cpu_to_le32(0xC01D0004)
+#define STATUS_MONITOR_WMI_DATABLOCK_REGISTRATION_FAILED cpu_to_le32(0xC01D0005)
+#define STATUS_MONITOR_INVALID_SERIAL_NUMBER_MONDSC_BLOCK	\
+	cpu_to_le32(0xC01D0006)
+#define STATUS_MONITOR_INVALID_USER_FRIENDLY_MONDSC_BLOCK	\
+	cpu_to_le32(0xC01D0007)
+#define STATUS_MONITOR_NO_MORE_DESCRIPTOR_DATA cpu_to_le32(0xC01D0008)
+#define STATUS_MONITOR_INVALID_DETAILED_TIMING_BLOCK cpu_to_le32(0xC01D0009)
+#define STATUS_GRAPHICS_NOT_EXCLUSIVE_MODE_OWNER cpu_to_le32(0xC01E0000)
+#define STATUS_GRAPHICS_INSUFFICIENT_DMA_BUFFER cpu_to_le32(0xC01E0001)
+#define STATUS_GRAPHICS_INVALID_DISPLAY_ADAPTER cpu_to_le32(0xC01E0002)
+#define STATUS_GRAPHICS_ADAPTER_WAS_RESET cpu_to_le32(0xC01E0003)
+#define STATUS_GRAPHICS_INVALID_DRIVER_MODEL cpu_to_le32(0xC01E0004)
+#define STATUS_GRAPHICS_PRESENT_MODE_CHANGED cpu_to_le32(0xC01E0005)
+#define STATUS_GRAPHICS_PRESENT_OCCLUDED cpu_to_le32(0xC01E0006)
+#define STATUS_GRAPHICS_PRESENT_DENIED cpu_to_le32(0xC01E0007)
+#define STATUS_GRAPHICS_CANNOTCOLORCONVERT cpu_to_le32(0xC01E0008)
+#define STATUS_GRAPHICS_NO_VIDEO_MEMORY cpu_to_le32(0xC01E0100)
+#define STATUS_GRAPHICS_CANT_LOCK_MEMORY cpu_to_le32(0xC01E0101)
+#define STATUS_GRAPHICS_ALLOCATION_BUSY cpu_to_le32(0xC01E0102)
+#define STATUS_GRAPHICS_TOO_MANY_REFERENCES cpu_to_le32(0xC01E0103)
+#define STATUS_GRAPHICS_TRY_AGAIN_LATER cpu_to_le32(0xC01E0104)
+#define STATUS_GRAPHICS_TRY_AGAIN_NOW cpu_to_le32(0xC01E0105)
+#define STATUS_GRAPHICS_ALLOCATION_INVALID cpu_to_le32(0xC01E0106)
+#define STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNAVAILABLE cpu_to_le32(0xC01E0107)
+#define STATUS_GRAPHICS_UNSWIZZLING_APERTURE_UNSUPPORTED cpu_to_le32(0xC01E0108)
+#define STATUS_GRAPHICS_CANT_EVICT_PINNED_ALLOCATION cpu_to_le32(0xC01E0109)
+#define STATUS_GRAPHICS_INVALID_ALLOCATION_USAGE cpu_to_le32(0xC01E0110)
+#define STATUS_GRAPHICS_CANT_RENDER_LOCKED_ALLOCATION cpu_to_le32(0xC01E0111)
+#define STATUS_GRAPHICS_ALLOCATION_CLOSED cpu_to_le32(0xC01E0112)
+#define STATUS_GRAPHICS_INVALID_ALLOCATION_INSTANCE cpu_to_le32(0xC01E0113)
+#define STATUS_GRAPHICS_INVALID_ALLOCATION_HANDLE cpu_to_le32(0xC01E0114)
+#define STATUS_GRAPHICS_WRONG_ALLOCATION_DEVICE cpu_to_le32(0xC01E0115)
+#define STATUS_GRAPHICS_ALLOCATION_CONTENT_LOST cpu_to_le32(0xC01E0116)
+#define STATUS_GRAPHICS_GPU_EXCEPTION_ON_DEVICE cpu_to_le32(0xC01E0200)
+#define STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY cpu_to_le32(0xC01E0300)
+#define STATUS_GRAPHICS_VIDPN_TOPOLOGY_NOT_SUPPORTED cpu_to_le32(0xC01E0301)
+#define STATUS_GRAPHICS_VIDPN_TOPOLOGY_CURRENTLY_NOT_SUPPORTED	\
+	cpu_to_le32(0xC01E0302)
+#define STATUS_GRAPHICS_INVALID_VIDPN cpu_to_le32(0xC01E0303)
+#define STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE cpu_to_le32(0xC01E0304)
+#define STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET cpu_to_le32(0xC01E0305)
+#define STATUS_GRAPHICS_VIDPN_MODALITY_NOT_SUPPORTED cpu_to_le32(0xC01E0306)
+#define STATUS_GRAPHICS_INVALID_VIDPN_SOURCEMODESET cpu_to_le32(0xC01E0308)
+#define STATUS_GRAPHICS_INVALID_VIDPN_TARGETMODESET cpu_to_le32(0xC01E0309)
+#define STATUS_GRAPHICS_INVALID_FREQUENCY cpu_to_le32(0xC01E030A)
+#define STATUS_GRAPHICS_INVALID_ACTIVE_REGION cpu_to_le32(0xC01E030B)
+#define STATUS_GRAPHICS_INVALID_TOTAL_REGION cpu_to_le32(0xC01E030C)
+#define STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_SOURCE_MODE	\
+	cpu_to_le32(0xC01E0310)
+#define STATUS_GRAPHICS_INVALID_VIDEO_PRESENT_TARGET_MODE	\
+	cpu_to_le32(0xC01E0311)
+#define STATUS_GRAPHICS_PINNED_MODE_MUST_REMAIN_IN_SET cpu_to_le32(0xC01E0312)
+#define STATUS_GRAPHICS_PATH_ALREADY_IN_TOPOLOGY cpu_to_le32(0xC01E0313)
+#define STATUS_GRAPHICS_MODE_ALREADY_IN_MODESET cpu_to_le32(0xC01E0314)
+#define STATUS_GRAPHICS_INVALID_VIDEOPRESENTSOURCESET cpu_to_le32(0xC01E0315)
+#define STATUS_GRAPHICS_INVALID_VIDEOPRESENTTARGETSET cpu_to_le32(0xC01E0316)
+#define STATUS_GRAPHICS_SOURCE_ALREADY_IN_SET cpu_to_le32(0xC01E0317)
+#define STATUS_GRAPHICS_TARGET_ALREADY_IN_SET cpu_to_le32(0xC01E0318)
+#define STATUS_GRAPHICS_INVALID_VIDPN_PRESENT_PATH cpu_to_le32(0xC01E0319)
+#define STATUS_GRAPHICS_NO_RECOMMENDED_VIDPN_TOPOLOGY cpu_to_le32(0xC01E031A)
+#define STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGESET	\
+	cpu_to_le32(0xC01E031B)
+#define STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE cpu_to_le32(0xC01E031C)
+#define STATUS_GRAPHICS_FREQUENCYRANGE_NOT_IN_SET cpu_to_le32(0xC01E031D)
+#define STATUS_GRAPHICS_FREQUENCYRANGE_ALREADY_IN_SET cpu_to_le32(0xC01E031F)
+#define STATUS_GRAPHICS_STALE_MODESET cpu_to_le32(0xC01E0320)
+#define STATUS_GRAPHICS_INVALID_MONITOR_SOURCEMODESET cpu_to_le32(0xC01E0321)
+#define STATUS_GRAPHICS_INVALID_MONITOR_SOURCE_MODE cpu_to_le32(0xC01E0322)
+#define STATUS_GRAPHICS_NO_RECOMMENDED_FUNCTIONAL_VIDPN cpu_to_le32(0xC01E0323)
+#define STATUS_GRAPHICS_MODE_ID_MUST_BE_UNIQUE cpu_to_le32(0xC01E0324)
+#define STATUS_GRAPHICS_EMPTY_ADAPTER_MONITOR_MODE_SUPPORT_INTERSECTION	\
+	cpu_to_le32(0xC01E0325)
+#define STATUS_GRAPHICS_VIDEO_PRESENT_TARGETS_LESS_THAN_SOURCES	\
+	cpu_to_le32(0xC01E0326)
+#define STATUS_GRAPHICS_PATH_NOT_IN_TOPOLOGY cpu_to_le32(0xC01E0327)
+#define STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_SOURCE	\
+	cpu_to_le32(0xC01E0328)
+#define STATUS_GRAPHICS_ADAPTER_MUST_HAVE_AT_LEAST_ONE_TARGET	\
+	cpu_to_le32(0xC01E0329)
+#define STATUS_GRAPHICS_INVALID_MONITORDESCRIPTORSET cpu_to_le32(0xC01E032A)
+#define STATUS_GRAPHICS_INVALID_MONITORDESCRIPTOR cpu_to_le32(0xC01E032B)
+#define STATUS_GRAPHICS_MONITORDESCRIPTOR_NOT_IN_SET cpu_to_le32(0xC01E032C)
+#define STATUS_GRAPHICS_MONITORDESCRIPTOR_ALREADY_IN_SET cpu_to_le32(0xC01E032D)
+#define STATUS_GRAPHICS_MONITORDESCRIPTOR_ID_MUST_BE_UNIQUE	\
+	cpu_to_le32(0xC01E032E)
+#define STATUS_GRAPHICS_INVALID_VIDPN_TARGET_SUBSET_TYPE cpu_to_le32(0xC01E032F)
+#define STATUS_GRAPHICS_RESOURCES_NOT_RELATED cpu_to_le32(0xC01E0330)
+#define STATUS_GRAPHICS_SOURCE_ID_MUST_BE_UNIQUE cpu_to_le32(0xC01E0331)
+#define STATUS_GRAPHICS_TARGET_ID_MUST_BE_UNIQUE cpu_to_le32(0xC01E0332)
+#define STATUS_GRAPHICS_NO_AVAILABLE_VIDPN_TARGET cpu_to_le32(0xC01E0333)
+#define STATUS_GRAPHICS_MONITOR_COULD_NOT_BE_ASSOCIATED_WITH_ADAPTER	\
+	cpu_to_le32(0xC01E0334)
+#define STATUS_GRAPHICS_NO_VIDPNMGR cpu_to_le32(0xC01E0335)
+#define STATUS_GRAPHICS_NO_ACTIVE_VIDPN cpu_to_le32(0xC01E0336)
+#define STATUS_GRAPHICS_STALE_VIDPN_TOPOLOGY cpu_to_le32(0xC01E0337)
+#define STATUS_GRAPHICS_MONITOR_NOT_CONNECTED cpu_to_le32(0xC01E0338)
+#define STATUS_GRAPHICS_SOURCE_NOT_IN_TOPOLOGY cpu_to_le32(0xC01E0339)
+#define STATUS_GRAPHICS_INVALID_PRIMARYSURFACE_SIZE cpu_to_le32(0xC01E033A)
+#define STATUS_GRAPHICS_INVALID_VISIBLEREGION_SIZE cpu_to_le32(0xC01E033B)
+#define STATUS_GRAPHICS_INVALID_STRIDE cpu_to_le32(0xC01E033C)
+#define STATUS_GRAPHICS_INVALID_PIXELFORMAT cpu_to_le32(0xC01E033D)
+#define STATUS_GRAPHICS_INVALID_COLORBASIS cpu_to_le32(0xC01E033E)
+#define STATUS_GRAPHICS_INVALID_PIXELVALUEACCESSMODE cpu_to_le32(0xC01E033F)
+#define STATUS_GRAPHICS_TARGET_NOT_IN_TOPOLOGY cpu_to_le32(0xC01E0340)
+#define STATUS_GRAPHICS_NO_DISPLAY_MODE_MANAGEMENT_SUPPORT	\
+	cpu_to_le32(0xC01E0341)
+#define STATUS_GRAPHICS_VIDPN_SOURCE_IN_USE cpu_to_le32(0xC01E0342)
+#define STATUS_GRAPHICS_CANT_ACCESS_ACTIVE_VIDPN cpu_to_le32(0xC01E0343)
+#define STATUS_GRAPHICS_INVALID_PATH_IMPORTANCE_ORDINAL cpu_to_le32(0xC01E0344)
+#define STATUS_GRAPHICS_INVALID_PATH_CONTENT_GEOMETRY_TRANSFORMATION	\
+	cpu_to_le32(0xC01E0345)
+#define STATUS_GRAPHICS_PATH_CONTENT_GEOMETRY_TRANSFORMATION_NOT_SUPPORTED \
+	cpu_to_le32(0xC01E0346)
+#define STATUS_GRAPHICS_INVALID_GAMMA_RAMP cpu_to_le32(0xC01E0347)
+#define STATUS_GRAPHICS_GAMMA_RAMP_NOT_SUPPORTED cpu_to_le32(0xC01E0348)
+#define STATUS_GRAPHICS_MULTISAMPLING_NOT_SUPPORTED cpu_to_le32(0xC01E0349)
+#define STATUS_GRAPHICS_MODE_NOT_IN_MODESET cpu_to_le32(0xC01E034A)
+#define STATUS_GRAPHICS_INVALID_VIDPN_TOPOLOGY_RECOMMENDATION_REASON	\
+	cpu_to_le32(0xC01E034D)
+#define STATUS_GRAPHICS_INVALID_PATH_CONTENT_TYPE cpu_to_le32(0xC01E034E)
+#define STATUS_GRAPHICS_INVALID_COPYPROTECTION_TYPE cpu_to_le32(0xC01E034F)
+#define STATUS_GRAPHICS_UNASSIGNED_MODESET_ALREADY_EXISTS	\
+	cpu_to_le32(0xC01E0350)
+#define STATUS_GRAPHICS_INVALID_SCANLINE_ORDERING cpu_to_le32(0xC01E0352)
+#define STATUS_GRAPHICS_TOPOLOGY_CHANGES_NOT_ALLOWED cpu_to_le32(0xC01E0353)
+#define STATUS_GRAPHICS_NO_AVAILABLE_IMPORTANCE_ORDINALS cpu_to_le32(0xC01E0354)
+#define STATUS_GRAPHICS_INCOMPATIBLE_PRIVATE_FORMAT cpu_to_le32(0xC01E0355)
+#define STATUS_GRAPHICS_INVALID_MODE_PRUNING_ALGORITHM cpu_to_le32(0xC01E0356)
+#define STATUS_GRAPHICS_INVALID_MONITOR_CAPABILITY_ORIGIN	\
+	cpu_to_le32(0xC01E0357)
+#define STATUS_GRAPHICS_INVALID_MONITOR_FREQUENCYRANGE_CONSTRAINT	\
+	cpu_to_le32(0xC01E0358)
+#define STATUS_GRAPHICS_MAX_NUM_PATHS_REACHED cpu_to_le32(0xC01E0359)
+#define STATUS_GRAPHICS_CANCEL_VIDPN_TOPOLOGY_AUGMENTATION	\
+	cpu_to_le32(0xC01E035A)
+#define STATUS_GRAPHICS_INVALID_CLIENT_TYPE cpu_to_le32(0xC01E035B)
+#define STATUS_GRAPHICS_CLIENTVIDPN_NOT_SET cpu_to_le32(0xC01E035C)
+#define STATUS_GRAPHICS_SPECIFIED_CHILD_ALREADY_CONNECTED	\
+	cpu_to_le32(0xC01E0400)
+#define STATUS_GRAPHICS_CHILD_DESCRIPTOR_NOT_SUPPORTED cpu_to_le32(0xC01E0401)
+#define STATUS_GRAPHICS_NOT_A_LINKED_ADAPTER cpu_to_le32(0xC01E0430)
+#define STATUS_GRAPHICS_LEADLINK_NOT_ENUMERATED cpu_to_le32(0xC01E0431)
+#define STATUS_GRAPHICS_CHAINLINKS_NOT_ENUMERATED cpu_to_le32(0xC01E0432)
+#define STATUS_GRAPHICS_ADAPTER_CHAIN_NOT_READY cpu_to_le32(0xC01E0433)
+#define STATUS_GRAPHICS_CHAINLINKS_NOT_STARTED cpu_to_le32(0xC01E0434)
+#define STATUS_GRAPHICS_CHAINLINKS_NOT_POWERED_ON cpu_to_le32(0xC01E0435)
+#define STATUS_GRAPHICS_INCONSISTENT_DEVICE_LINK_STATE cpu_to_le32(0xC01E0436)
+#define STATUS_GRAPHICS_NOT_POST_DEVICE_DRIVER cpu_to_le32(0xC01E0438)
+#define STATUS_GRAPHICS_ADAPTER_ACCESS_NOT_EXCLUDED cpu_to_le32(0xC01E043B)
+#define STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_COPP_SEMANTICS \
+	cpu_to_le32(0xC01E051C)
+#define STATUS_GRAPHICS_OPM_INVALID_INFORMATION_REQUEST cpu_to_le32(0xC01E051D)
+#define STATUS_GRAPHICS_OPM_DRIVER_INTERNAL_ERROR cpu_to_le32(0xC01E051E)
+#define STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_DOES_NOT_HAVE_OPM_SEMANTICS \
+	cpu_to_le32(0xC01E051F)
+#define STATUS_GRAPHICS_OPM_SIGNALING_NOT_SUPPORTED cpu_to_le32(0xC01E0520)
+#define STATUS_GRAPHICS_OPM_INVALID_CONFIGURATION_REQUEST	\
+	cpu_to_le32(0xC01E0521)
+#define STATUS_GRAPHICS_OPM_NOT_SUPPORTED cpu_to_le32(0xC01E0500)
+#define STATUS_GRAPHICS_COPP_NOT_SUPPORTED cpu_to_le32(0xC01E0501)
+#define STATUS_GRAPHICS_UAB_NOT_SUPPORTED cpu_to_le32(0xC01E0502)
+#define STATUS_GRAPHICS_OPM_INVALID_ENCRYPTED_PARAMETERS cpu_to_le32(0xC01E0503)
+#define STATUS_GRAPHICS_OPM_PARAMETER_ARRAY_TOO_SMALL cpu_to_le32(0xC01E0504)
+#define STATUS_GRAPHICS_OPM_NO_PROTECTED_OUTPUTS_EXIST cpu_to_le32(0xC01E0505)
+#define STATUS_GRAPHICS_PVP_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME	\
+	cpu_to_le32(0xC01E0506)
+#define STATUS_GRAPHICS_PVP_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP	\
+	cpu_to_le32(0xC01E0507)
+#define STATUS_GRAPHICS_PVP_MIRRORING_DEVICES_NOT_SUPPORTED	\
+	cpu_to_le32(0xC01E0508)
+#define STATUS_GRAPHICS_OPM_INVALID_POINTER cpu_to_le32(0xC01E050A)
+#define STATUS_GRAPHICS_OPM_INTERNAL_ERROR cpu_to_le32(0xC01E050B)
+#define STATUS_GRAPHICS_OPM_INVALID_HANDLE cpu_to_le32(0xC01E050C)
+#define STATUS_GRAPHICS_PVP_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE	\
+	cpu_to_le32(0xC01E050D)
+#define STATUS_GRAPHICS_PVP_INVALID_CERTIFICATE_LENGTH cpu_to_le32(0xC01E050E)
+#define STATUS_GRAPHICS_OPM_SPANNING_MODE_ENABLED cpu_to_le32(0xC01E050F)
+#define STATUS_GRAPHICS_OPM_THEATER_MODE_ENABLED cpu_to_le32(0xC01E0510)
+#define STATUS_GRAPHICS_PVP_HFS_FAILED cpu_to_le32(0xC01E0511)
+#define STATUS_GRAPHICS_OPM_INVALID_SRM cpu_to_le32(0xC01E0512)
+#define STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_HDCP cpu_to_le32(0xC01E0513)
+#define STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_ACP cpu_to_le32(0xC01E0514)
+#define STATUS_GRAPHICS_OPM_OUTPUT_DOES_NOT_SUPPORT_CGMSA	\
+	cpu_to_le32(0xC01E0515)
+#define STATUS_GRAPHICS_OPM_HDCP_SRM_NEVER_SET cpu_to_le32(0xC01E0516)
+#define STATUS_GRAPHICS_OPM_RESOLUTION_TOO_HIGH cpu_to_le32(0xC01E0517)
+#define STATUS_GRAPHICS_OPM_ALL_HDCP_HARDWARE_ALREADY_IN_USE	\
+	cpu_to_le32(0xC01E0518)
+#define STATUS_GRAPHICS_OPM_PROTECTED_OUTPUT_NO_LONGER_EXISTS	\
+	cpu_to_le32(0xC01E051A)
+#define STATUS_GRAPHICS_OPM_SESSION_TYPE_CHANGE_IN_PROGRESS	\
+	cpu_to_le32(0xC01E051B)
+#define STATUS_GRAPHICS_I2C_NOT_SUPPORTED cpu_to_le32(0xC01E0580)
+#define STATUS_GRAPHICS_I2C_DEVICE_DOES_NOT_EXIST cpu_to_le32(0xC01E0581)
+#define STATUS_GRAPHICS_I2C_ERROR_TRANSMITTING_DATA cpu_to_le32(0xC01E0582)
+#define STATUS_GRAPHICS_I2C_ERROR_RECEIVING_DATA cpu_to_le32(0xC01E0583)
+#define STATUS_GRAPHICS_DDCCI_VCP_NOT_SUPPORTED cpu_to_le32(0xC01E0584)
+#define STATUS_GRAPHICS_DDCCI_INVALID_DATA cpu_to_le32(0xC01E0585)
+#define STATUS_GRAPHICS_DDCCI_MONITOR_RETURNED_INVALID_TIMING_STATUS_BYTE \
+	cpu_to_le32(0xC01E0586)
+#define STATUS_GRAPHICS_DDCCI_INVALID_CAPABILITIES_STRING	\
+	cpu_to_le32(0xC01E0587)
+#define STATUS_GRAPHICS_MCA_INTERNAL_ERROR cpu_to_le32(0xC01E0588)
+#define STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_COMMAND cpu_to_le32(0xC01E0589)
+#define STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_LENGTH cpu_to_le32(0xC01E058A)
+#define STATUS_GRAPHICS_DDCCI_INVALID_MESSAGE_CHECKSUM cpu_to_le32(0xC01E058B)
+#define STATUS_GRAPHICS_INVALID_PHYSICAL_MONITOR_HANDLE cpu_to_le32(0xC01E058C)
+#define STATUS_GRAPHICS_MONITOR_NO_LONGER_EXISTS cpu_to_le32(0xC01E058D)
+#define STATUS_GRAPHICS_ONLY_CONSOLE_SESSION_SUPPORTED cpu_to_le32(0xC01E05E0)
+#define STATUS_GRAPHICS_NO_DISPLAY_DEVICE_CORRESPONDS_TO_NAME	\
+	cpu_to_le32(0xC01E05E1)
+#define STATUS_GRAPHICS_DISPLAY_DEVICE_NOT_ATTACHED_TO_DESKTOP	\
+	cpu_to_le32(0xC01E05E2)
+#define STATUS_GRAPHICS_MIRRORING_DEVICES_NOT_SUPPORTED cpu_to_le32(0xC01E05E3)
+#define STATUS_GRAPHICS_INVALID_POINTER cpu_to_le32(0xC01E05E4)
+#define STATUS_GRAPHICS_NO_MONITORS_CORRESPOND_TO_DISPLAY_DEVICE	\
+	cpu_to_le32(0xC01E05E5)
+#define STATUS_GRAPHICS_PARAMETER_ARRAY_TOO_SMALL cpu_to_le32(0xC01E05E6)
+#define STATUS_GRAPHICS_INTERNAL_ERROR cpu_to_le32(0xC01E05E7)
+#define STATUS_GRAPHICS_SESSION_TYPE_CHANGE_IN_PROGRESS cpu_to_le32(0xC01E05E8)
+#define STATUS_FVE_LOCKED_VOLUME cpu_to_le32(0xC0210000)
+#define STATUS_FVE_NOT_ENCRYPTED cpu_to_le32(0xC0210001)
+#define STATUS_FVE_BAD_INFORMATION cpu_to_le32(0xC0210002)
+#define STATUS_FVE_TOO_SMALL cpu_to_le32(0xC0210003)
+#define STATUS_FVE_FAILED_WRONG_FS cpu_to_le32(0xC0210004)
+#define STATUS_FVE_FAILED_BAD_FS cpu_to_le32(0xC0210005)
+#define STATUS_FVE_FS_NOT_EXTENDED cpu_to_le32(0xC0210006)
+#define STATUS_FVE_FS_MOUNTED cpu_to_le32(0xC0210007)
+#define STATUS_FVE_NO_LICENSE cpu_to_le32(0xC0210008)
+#define STATUS_FVE_ACTION_NOT_ALLOWED cpu_to_le32(0xC0210009)
+#define STATUS_FVE_BAD_DATA cpu_to_le32(0xC021000A)
+#define STATUS_FVE_VOLUME_NOT_BOUND cpu_to_le32(0xC021000B)
+#define STATUS_FVE_NOT_DATA_VOLUME cpu_to_le32(0xC021000C)
+#define STATUS_FVE_CONV_READ_ERROR cpu_to_le32(0xC021000D)
+#define STATUS_FVE_CONV_WRITE_ERROR cpu_to_le32(0xC021000E)
+#define STATUS_FVE_OVERLAPPED_UPDATE cpu_to_le32(0xC021000F)
+#define STATUS_FVE_FAILED_SECTOR_SIZE cpu_to_le32(0xC0210010)
+#define STATUS_FVE_FAILED_AUTHENTICATION cpu_to_le32(0xC0210011)
+#define STATUS_FVE_NOT_OS_VOLUME cpu_to_le32(0xC0210012)
+#define STATUS_FVE_KEYFILE_NOT_FOUND cpu_to_le32(0xC0210013)
+#define STATUS_FVE_KEYFILE_INVALID cpu_to_le32(0xC0210014)
+#define STATUS_FVE_KEYFILE_NO_VMK cpu_to_le32(0xC0210015)
+#define STATUS_FVE_TPM_DISABLED cpu_to_le32(0xC0210016)
+#define STATUS_FVE_TPM_SRK_AUTH_NOT_ZERO cpu_to_le32(0xC0210017)
+#define STATUS_FVE_TPM_INVALID_PCR cpu_to_le32(0xC0210018)
+#define STATUS_FVE_TPM_NO_VMK cpu_to_le32(0xC0210019)
+#define STATUS_FVE_PIN_INVALID cpu_to_le32(0xC021001A)
+#define STATUS_FVE_AUTH_INVALID_APPLICATION cpu_to_le32(0xC021001B)
+#define STATUS_FVE_AUTH_INVALID_CONFIG cpu_to_le32(0xC021001C)
+#define STATUS_FVE_DEBUGGER_ENABLED cpu_to_le32(0xC021001D)
+#define STATUS_FVE_DRY_RUN_FAILED cpu_to_le32(0xC021001E)
+#define STATUS_FVE_BAD_METADATA_POINTER cpu_to_le32(0xC021001F)
+#define STATUS_FVE_OLD_METADATA_COPY cpu_to_le32(0xC0210020)
+#define STATUS_FVE_REBOOT_REQUIRED cpu_to_le32(0xC0210021)
+#define STATUS_FVE_RAW_ACCESS cpu_to_le32(0xC0210022)
+#define STATUS_FVE_RAW_BLOCKED cpu_to_le32(0xC0210023)
+#define STATUS_FWP_CALLOUT_NOT_FOUND cpu_to_le32(0xC0220001)
+#define STATUS_FWP_CONDITION_NOT_FOUND cpu_to_le32(0xC0220002)
+#define STATUS_FWP_FILTER_NOT_FOUND cpu_to_le32(0xC0220003)
+#define STATUS_FWP_LAYER_NOT_FOUND cpu_to_le32(0xC0220004)
+#define STATUS_FWP_PROVIDER_NOT_FOUND cpu_to_le32(0xC0220005)
+#define STATUS_FWP_PROVIDER_CONTEXT_NOT_FOUND cpu_to_le32(0xC0220006)
+#define STATUS_FWP_SUBLAYER_NOT_FOUND cpu_to_le32(0xC0220007)
+#define STATUS_FWP_NOT_FOUND cpu_to_le32(0xC0220008)
+#define STATUS_FWP_ALREADY_EXISTS cpu_to_le32(0xC0220009)
+#define STATUS_FWP_IN_USE cpu_to_le32(0xC022000A)
+#define STATUS_FWP_DYNAMIC_SESSION_IN_PROGRESS cpu_to_le32(0xC022000B)
+#define STATUS_FWP_WRONG_SESSION cpu_to_le32(0xC022000C)
+#define STATUS_FWP_NO_TXN_IN_PROGRESS cpu_to_le32(0xC022000D)
+#define STATUS_FWP_TXN_IN_PROGRESS cpu_to_le32(0xC022000E)
+#define STATUS_FWP_TXN_ABORTED cpu_to_le32(0xC022000F)
+#define STATUS_FWP_SESSION_ABORTED cpu_to_le32(0xC0220010)
+#define STATUS_FWP_INCOMPATIBLE_TXN cpu_to_le32(0xC0220011)
+#define STATUS_FWP_TIMEOUT cpu_to_le32(0xC0220012)
+#define STATUS_FWP_NET_EVENTS_DISABLED cpu_to_le32(0xC0220013)
+#define STATUS_FWP_INCOMPATIBLE_LAYER cpu_to_le32(0xC0220014)
+#define STATUS_FWP_KM_CLIENTS_ONLY cpu_to_le32(0xC0220015)
+#define STATUS_FWP_LIFETIME_MISMATCH cpu_to_le32(0xC0220016)
+#define STATUS_FWP_BUILTIN_OBJECT cpu_to_le32(0xC0220017)
+#define STATUS_FWP_TOO_MANY_BOOTTIME_FILTERS cpu_to_le32(0xC0220018)
+#define STATUS_FWP_TOO_MANY_CALLOUTS cpu_to_le32(0xC0220018)
+#define STATUS_FWP_NOTIFICATION_DROPPED cpu_to_le32(0xC0220019)
+#define STATUS_FWP_TRAFFIC_MISMATCH cpu_to_le32(0xC022001A)
+#define STATUS_FWP_INCOMPATIBLE_SA_STATE cpu_to_le32(0xC022001B)
+#define STATUS_FWP_NULL_POINTER cpu_to_le32(0xC022001C)
+#define STATUS_FWP_INVALID_ENUMERATOR cpu_to_le32(0xC022001D)
+#define STATUS_FWP_INVALID_FLAGS cpu_to_le32(0xC022001E)
+#define STATUS_FWP_INVALID_NET_MASK cpu_to_le32(0xC022001F)
+#define STATUS_FWP_INVALID_RANGE cpu_to_le32(0xC0220020)
+#define STATUS_FWP_INVALID_INTERVAL cpu_to_le32(0xC0220021)
+#define STATUS_FWP_ZERO_LENGTH_ARRAY cpu_to_le32(0xC0220022)
+#define STATUS_FWP_NULL_DISPLAY_NAME cpu_to_le32(0xC0220023)
+#define STATUS_FWP_INVALID_ACTION_TYPE cpu_to_le32(0xC0220024)
+#define STATUS_FWP_INVALID_WEIGHT cpu_to_le32(0xC0220025)
+#define STATUS_FWP_MATCH_TYPE_MISMATCH cpu_to_le32(0xC0220026)
+#define STATUS_FWP_TYPE_MISMATCH cpu_to_le32(0xC0220027)
+#define STATUS_FWP_OUT_OF_BOUNDS cpu_to_le32(0xC0220028)
+#define STATUS_FWP_RESERVED cpu_to_le32(0xC0220029)
+#define STATUS_FWP_DUPLICATE_CONDITION cpu_to_le32(0xC022002A)
+#define STATUS_FWP_DUPLICATE_KEYMOD cpu_to_le32(0xC022002B)
+#define STATUS_FWP_ACTION_INCOMPATIBLE_WITH_LAYER cpu_to_le32(0xC022002C)
+#define STATUS_FWP_ACTION_INCOMPATIBLE_WITH_SUBLAYER cpu_to_le32(0xC022002D)
+#define STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_LAYER cpu_to_le32(0xC022002E)
+#define STATUS_FWP_CONTEXT_INCOMPATIBLE_WITH_CALLOUT cpu_to_le32(0xC022002F)
+#define STATUS_FWP_INCOMPATIBLE_AUTH_METHOD cpu_to_le32(0xC0220030)
+#define STATUS_FWP_INCOMPATIBLE_DH_GROUP cpu_to_le32(0xC0220031)
+#define STATUS_FWP_EM_NOT_SUPPORTED cpu_to_le32(0xC0220032)
+#define STATUS_FWP_NEVER_MATCH cpu_to_le32(0xC0220033)
+#define STATUS_FWP_PROVIDER_CONTEXT_MISMATCH cpu_to_le32(0xC0220034)
+#define STATUS_FWP_INVALID_PARAMETER cpu_to_le32(0xC0220035)
+#define STATUS_FWP_TOO_MANY_SUBLAYERS cpu_to_le32(0xC0220036)
+#define STATUS_FWP_CALLOUT_NOTIFICATION_FAILED cpu_to_le32(0xC0220037)
+#define STATUS_FWP_INCOMPATIBLE_AUTH_CONFIG cpu_to_le32(0xC0220038)
+#define STATUS_FWP_INCOMPATIBLE_CIPHER_CONFIG cpu_to_le32(0xC0220039)
+#define STATUS_FWP_TCPIP_NOT_READY cpu_to_le32(0xC0220100)
+#define STATUS_FWP_INJECT_HANDLE_CLOSING cpu_to_le32(0xC0220101)
+#define STATUS_FWP_INJECT_HANDLE_STALE cpu_to_le32(0xC0220102)
+#define STATUS_FWP_CANNOT_PEND cpu_to_le32(0xC0220103)
+#define STATUS_NDIS_CLOSING cpu_to_le32(0xC0230002)
+#define STATUS_NDIS_BAD_VERSION cpu_to_le32(0xC0230004)
+#define STATUS_NDIS_BAD_CHARACTERISTICS cpu_to_le32(0xC0230005)
+#define STATUS_NDIS_ADAPTER_NOT_FOUND cpu_to_le32(0xC0230006)
+#define STATUS_NDIS_OPEN_FAILED cpu_to_le32(0xC0230007)
+#define STATUS_NDIS_DEVICE_FAILED cpu_to_le32(0xC0230008)
+#define STATUS_NDIS_MULTICAST_FULL cpu_to_le32(0xC0230009)
+#define STATUS_NDIS_MULTICAST_EXISTS cpu_to_le32(0xC023000A)
+#define STATUS_NDIS_MULTICAST_NOT_FOUND cpu_to_le32(0xC023000B)
+#define STATUS_NDIS_REQUEST_ABORTED cpu_to_le32(0xC023000C)
+#define STATUS_NDIS_RESET_IN_PROGRESS cpu_to_le32(0xC023000D)
+#define STATUS_NDIS_INVALID_PACKET cpu_to_le32(0xC023000F)
+#define STATUS_NDIS_INVALID_DEVICE_REQUEST cpu_to_le32(0xC0230010)
+#define STATUS_NDIS_ADAPTER_NOT_READY cpu_to_le32(0xC0230011)
+#define STATUS_NDIS_INVALID_LENGTH cpu_to_le32(0xC0230014)
+#define STATUS_NDIS_INVALID_DATA cpu_to_le32(0xC0230015)
+#define STATUS_NDIS_BUFFER_TOO_SHORT cpu_to_le32(0xC0230016)
+#define STATUS_NDIS_INVALID_OID cpu_to_le32(0xC0230017)
+#define STATUS_NDIS_ADAPTER_REMOVED cpu_to_le32(0xC0230018)
+#define STATUS_NDIS_UNSUPPORTED_MEDIA cpu_to_le32(0xC0230019)
+#define STATUS_NDIS_GROUP_ADDRESS_IN_USE cpu_to_le32(0xC023001A)
+#define STATUS_NDIS_FILE_NOT_FOUND cpu_to_le32(0xC023001B)
+#define STATUS_NDIS_ERROR_READING_FILE cpu_to_le32(0xC023001C)
+#define STATUS_NDIS_ALREADY_MAPPED cpu_to_le32(0xC023001D)
+#define STATUS_NDIS_RESOURCE_CONFLICT cpu_to_le32(0xC023001E)
+#define STATUS_NDIS_MEDIA_DISCONNECTED cpu_to_le32(0xC023001F)
+#define STATUS_NDIS_INVALID_ADDRESS cpu_to_le32(0xC0230022)
+#define STATUS_NDIS_PAUSED cpu_to_le32(0xC023002A)
+#define STATUS_NDIS_INTERFACE_NOT_FOUND cpu_to_le32(0xC023002B)
+#define STATUS_NDIS_UNSUPPORTED_REVISION cpu_to_le32(0xC023002C)
+#define STATUS_NDIS_INVALID_PORT cpu_to_le32(0xC023002D)
+#define STATUS_NDIS_INVALID_PORT_STATE cpu_to_le32(0xC023002E)
+#define STATUS_NDIS_LOW_POWER_STATE cpu_to_le32(0xC023002F)
+#define STATUS_NDIS_NOT_SUPPORTED cpu_to_le32(0xC02300BB)
+#define STATUS_NDIS_DOT11_AUTO_CONFIG_ENABLED cpu_to_le32(0xC0232000)
+#define STATUS_NDIS_DOT11_MEDIA_IN_USE cpu_to_le32(0xC0232001)
+#define STATUS_NDIS_DOT11_POWER_STATE_INVALID cpu_to_le32(0xC0232002)
+#define STATUS_IPSEC_BAD_SPI cpu_to_le32(0xC0360001)
+#define STATUS_IPSEC_SA_LIFETIME_EXPIRED cpu_to_le32(0xC0360002)
+#define STATUS_IPSEC_WRONG_SA cpu_to_le32(0xC0360003)
+#define STATUS_IPSEC_REPLAY_CHECK_FAILED cpu_to_le32(0xC0360004)
+#define STATUS_IPSEC_INVALID_PACKET cpu_to_le32(0xC0360005)
+#define STATUS_IPSEC_INTEGRITY_CHECK_FAILED cpu_to_le32(0xC0360006)
+#define STATUS_IPSEC_CLEAR_TEXT_DROP cpu_to_le32(0xC0360007)
+
+#define STATUS_NO_PREAUTH_INTEGRITY_HASH_OVERLAP cpu_to_le32(0xC05D0000)
+#define STATUS_INVALID_LOCK_RANGE cpu_to_le32(0xC00001a1)
diff -Nruw linux-5.4.60-fbx/fs/cifsd./transport_ipc.c linux-5.4.60-fbx/fs/cifsd/transport_ipc.c
--- linux-5.4.60-fbx/fs/cifsd./transport_ipc.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/transport_ipc.c	2021-04-21 09:44:50.978505152 +0200
@@ -0,0 +1,884 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/jhash.h>
+#include <linux/slab.h>
+#include <linux/rwsem.h>
+#include <linux/mutex.h>
+#include <linux/wait.h>
+#include <linux/hashtable.h>
+#include <net/net_namespace.h>
+#include <net/genetlink.h>
+#include <linux/socket.h>
+#include <linux/workqueue.h>
+
+#include "vfs_cache.h"
+#include "transport_ipc.h"
+#include "buffer_pool.h"
+#include "server.h"
+#include "smb_common.h"
+
+#include "mgmt/user_config.h"
+#include "mgmt/share_config.h"
+#include "mgmt/user_session.h"
+#include "mgmt/tree_connect.h"
+#include "mgmt/ksmbd_ida.h"
+#include "connection.h"
+#include "transport_tcp.h"
+
+#define IPC_WAIT_TIMEOUT	(2 * HZ)
+
+#define IPC_MSG_HASH_BITS	3
+static DEFINE_HASHTABLE(ipc_msg_table, IPC_MSG_HASH_BITS);
+static DECLARE_RWSEM(ipc_msg_table_lock);
+static DEFINE_MUTEX(startup_lock);
+
+static DEFINE_IDA(ipc_ida);
+
+static unsigned int ksmbd_tools_pid;
+
+#define KSMBD_IPC_MSG_HANDLE(m)	(*(unsigned int *)m)
+
+static bool ksmbd_ipc_validate_version(struct genl_info *m)
+{
+	if (m->genlhdr->version != KSMBD_GENL_VERSION) {
+		ksmbd_err("%s. ksmbd: %d, kernel module: %d. %s.\n",
+			  "Daemon and kernel module version mismatch",
+			  m->genlhdr->version,
+			  KSMBD_GENL_VERSION,
+			  "User-space ksmbd should terminate");
+		return false;
+	}
+	return true;
+}
+
+struct ksmbd_ipc_msg {
+	unsigned int		type;
+	unsigned int		sz;
+	unsigned char		____payload[0];
+};
+
+#define KSMBD_IPC_MSG_PAYLOAD(m)					\
+	((void *)(((struct ksmbd_ipc_msg *)(m))->____payload))
+
+struct ipc_msg_table_entry {
+	unsigned int		handle;
+	unsigned int		type;
+	wait_queue_head_t	wait;
+	struct hlist_node	ipc_table_hlist;
+
+	void			*response;
+};
+
+static struct delayed_work ipc_timer_work;
+
+static int handle_startup_event(struct sk_buff *skb, struct genl_info *info);
+static int handle_unsupported_event(struct sk_buff *skb, struct genl_info *info);
+static int handle_generic_event(struct sk_buff *skb, struct genl_info *info);
+static int ksmbd_ipc_heartbeat_request(void);
+
+static const struct nla_policy ksmbd_nl_policy[KSMBD_EVENT_MAX] = {
+	[KSMBD_EVENT_UNSPEC] = {
+		.len = 0,
+	},
+	[KSMBD_EVENT_HEARTBEAT_REQUEST] = {
+		.len = sizeof(struct ksmbd_heartbeat),
+	},
+	[KSMBD_EVENT_STARTING_UP] = {
+		.len = sizeof(struct ksmbd_startup_request),
+	},
+	[KSMBD_EVENT_SHUTTING_DOWN] = {
+		.len = sizeof(struct ksmbd_shutdown_request),
+	},
+	[KSMBD_EVENT_LOGIN_REQUEST] = {
+		.len = sizeof(struct ksmbd_login_request),
+	},
+	[KSMBD_EVENT_LOGIN_RESPONSE] = {
+		.len = sizeof(struct ksmbd_login_response),
+	},
+	[KSMBD_EVENT_SHARE_CONFIG_REQUEST] = {
+		.len = sizeof(struct ksmbd_share_config_request),
+	},
+	[KSMBD_EVENT_SHARE_CONFIG_RESPONSE] = {
+		.len = sizeof(struct ksmbd_share_config_response),
+	},
+	[KSMBD_EVENT_TREE_CONNECT_REQUEST] = {
+		.len = sizeof(struct ksmbd_tree_connect_request),
+	},
+	[KSMBD_EVENT_TREE_CONNECT_RESPONSE] = {
+		.len = sizeof(struct ksmbd_tree_connect_response),
+	},
+	[KSMBD_EVENT_TREE_DISCONNECT_REQUEST] = {
+		.len = sizeof(struct ksmbd_tree_disconnect_request),
+	},
+	[KSMBD_EVENT_LOGOUT_REQUEST] = {
+		.len = sizeof(struct ksmbd_logout_request),
+	},
+	[KSMBD_EVENT_RPC_REQUEST] = {
+	},
+	[KSMBD_EVENT_RPC_RESPONSE] = {
+	},
+	[KSMBD_EVENT_SPNEGO_AUTHEN_REQUEST] = {
+	},
+	[KSMBD_EVENT_SPNEGO_AUTHEN_RESPONSE] = {
+	},
+};
+
+static struct genl_ops ksmbd_genl_ops[] = {
+	{
+		.cmd	= KSMBD_EVENT_UNSPEC,
+		.doit	= handle_unsupported_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_HEARTBEAT_REQUEST,
+		.doit	= handle_unsupported_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_STARTING_UP,
+		.doit	= handle_startup_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_SHUTTING_DOWN,
+		.doit	= handle_unsupported_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_LOGIN_REQUEST,
+		.doit	= handle_unsupported_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_LOGIN_RESPONSE,
+		.doit	= handle_generic_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_SHARE_CONFIG_REQUEST,
+		.doit	= handle_unsupported_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_SHARE_CONFIG_RESPONSE,
+		.doit	= handle_generic_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_TREE_CONNECT_REQUEST,
+		.doit	= handle_unsupported_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_TREE_CONNECT_RESPONSE,
+		.doit	= handle_generic_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_TREE_DISCONNECT_REQUEST,
+		.doit	= handle_unsupported_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_LOGOUT_REQUEST,
+		.doit	= handle_unsupported_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_RPC_REQUEST,
+		.doit	= handle_unsupported_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_RPC_RESPONSE,
+		.doit	= handle_generic_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_SPNEGO_AUTHEN_REQUEST,
+		.doit	= handle_unsupported_event,
+	},
+	{
+		.cmd	= KSMBD_EVENT_SPNEGO_AUTHEN_RESPONSE,
+		.doit	= handle_generic_event,
+	},
+};
+
+static struct genl_family ksmbd_genl_family = {
+	.name		= KSMBD_GENL_NAME,
+	.version	= KSMBD_GENL_VERSION,
+	.hdrsize	= 0,
+	.maxattr	= KSMBD_EVENT_MAX,
+	.netnsok	= true,
+	.module		= THIS_MODULE,
+	.ops		= ksmbd_genl_ops,
+	.n_ops		= ARRAY_SIZE(ksmbd_genl_ops),
+};
+
+static void ksmbd_nl_init_fixup(void)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(ksmbd_genl_ops); i++)
+		ksmbd_genl_ops[i].validate = GENL_DONT_VALIDATE_STRICT |
+						GENL_DONT_VALIDATE_DUMP;
+
+	ksmbd_genl_family.policy = ksmbd_nl_policy;
+}
+
+static int rpc_context_flags(struct ksmbd_session *sess)
+{
+	if (user_guest(sess->user))
+		return KSMBD_RPC_RESTRICTED_CONTEXT;
+	return 0;
+}
+
+static void ipc_update_last_active(void)
+{
+	if (server_conf.ipc_timeout)
+		server_conf.ipc_last_active = jiffies;
+}
+
+static struct ksmbd_ipc_msg *ipc_msg_alloc(size_t sz)
+{
+	struct ksmbd_ipc_msg *msg;
+	size_t msg_sz = sz + sizeof(struct ksmbd_ipc_msg);
+
+	msg = kvmalloc(msg_sz, GFP_KERNEL | __GFP_ZERO);
+	if (msg)
+		msg->sz = sz;
+	return msg;
+}
+
+static void ipc_msg_free(struct ksmbd_ipc_msg *msg)
+{
+	kvfree(msg);
+}
+
+static void ipc_msg_handle_free(int handle)
+{
+	if (handle >= 0)
+		ksmbd_release_id(&ipc_ida, handle);
+}
+
+static int handle_response(int type, void *payload, size_t sz)
+{
+	int handle = KSMBD_IPC_MSG_HANDLE(payload);
+	struct ipc_msg_table_entry *entry;
+	int ret = 0;
+
+	ipc_update_last_active();
+	down_read(&ipc_msg_table_lock);
+	hash_for_each_possible(ipc_msg_table, entry, ipc_table_hlist, handle) {
+		if (handle != entry->handle)
+			continue;
+
+		entry->response = NULL;
+		/*
+		 * Response message type value should be equal to
+		 * request message type + 1.
+		 */
+		if (entry->type + 1 != type) {
+			ksmbd_err("Waiting for IPC type %d, got %d. Ignore.\n",
+				entry->type + 1, type);
+		}
+
+		entry->response = kvmalloc(sz, GFP_KERNEL | __GFP_ZERO);
+		if (!entry->response) {
+			ret = -ENOMEM;
+			break;
+		}
+
+		memcpy(entry->response, payload, sz);
+		wake_up_interruptible(&entry->wait);
+		ret = 0;
+		break;
+	}
+	up_read(&ipc_msg_table_lock);
+
+	return ret;
+}
+
+static int ipc_server_config_on_startup(struct ksmbd_startup_request *req)
+{
+	int ret;
+
+	ksmbd_set_fd_limit(req->file_max);
+	server_conf.flags = req->flags;
+	server_conf.signing = req->signing;
+	server_conf.tcp_port = req->tcp_port;
+	server_conf.ipc_timeout = req->ipc_timeout * HZ;
+	server_conf.deadtime = req->deadtime * SMB_ECHO_INTERVAL;
+	server_conf.share_fake_fscaps = req->share_fake_fscaps;
+	ksmbd_init_domain(req->sub_auth);
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	server_conf.flags &= ~KSMBD_GLOBAL_FLAG_CACHE_TBUF;
+#endif
+
+	if (req->smb2_max_read)
+		init_smb2_max_read_size(req->smb2_max_read);
+	if (req->smb2_max_write)
+		init_smb2_max_write_size(req->smb2_max_write);
+	if (req->smb2_max_trans)
+		init_smb2_max_trans_size(req->smb2_max_trans);
+
+	ret = ksmbd_set_netbios_name(req->netbios_name);
+	ret |= ksmbd_set_server_string(req->server_string);
+	ret |= ksmbd_set_work_group(req->work_group);
+	ret |= ksmbd_tcp_set_interfaces(KSMBD_STARTUP_CONFIG_INTERFACES(req),
+					req->ifc_list_sz);
+	if (ret) {
+		ksmbd_err("Server configuration error: %s %s %s\n",
+				req->netbios_name,
+				req->server_string,
+				req->work_group);
+		return ret;
+	}
+
+	if (req->min_prot[0]) {
+		ret = ksmbd_lookup_protocol_idx(req->min_prot);
+		if (ret >= 0)
+			server_conf.min_protocol = ret;
+	}
+	if (req->max_prot[0]) {
+		ret = ksmbd_lookup_protocol_idx(req->max_prot);
+		if (ret >= 0)
+			server_conf.max_protocol = ret;
+	}
+
+	if (server_conf.ipc_timeout)
+		schedule_delayed_work(&ipc_timer_work, server_conf.ipc_timeout);
+	return 0;
+}
+
+static int handle_startup_event(struct sk_buff *skb, struct genl_info *info)
+{
+	int ret = 0;
+
+#ifdef CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN
+	if (!netlink_capable(skb, CAP_NET_ADMIN))
+		return -EPERM;
+#endif
+
+	if (!ksmbd_ipc_validate_version(info))
+		return -EINVAL;
+
+	if (!info->attrs[KSMBD_EVENT_STARTING_UP])
+		return -EINVAL;
+
+	mutex_lock(&startup_lock);
+	if (!ksmbd_server_configurable()) {
+		mutex_unlock(&startup_lock);
+		ksmbd_err("Server reset is in progress, can't start daemon\n");
+		return -EINVAL;
+	}
+
+	if (ksmbd_tools_pid) {
+		if (ksmbd_ipc_heartbeat_request() == 0) {
+			ret = -EINVAL;
+			goto out;
+		}
+
+		ksmbd_err("Reconnect to a new user space daemon\n");
+	} else {
+		struct ksmbd_startup_request *req;
+
+		req = nla_data(info->attrs[info->genlhdr->cmd]);
+		ret = ipc_server_config_on_startup(req);
+		if (ret)
+			goto out;
+		server_queue_ctrl_init_work();
+	}
+
+	ksmbd_tools_pid = info->snd_portid;
+	ipc_update_last_active();
+
+out:
+	mutex_unlock(&startup_lock);
+	return ret;
+}
+
+static int handle_unsupported_event(struct sk_buff *skb, struct genl_info *info)
+{
+	ksmbd_err("Unknown IPC event: %d, ignore.\n", info->genlhdr->cmd);
+	return -EINVAL;
+}
+
+static int handle_generic_event(struct sk_buff *skb, struct genl_info *info)
+{
+	void *payload;
+	int sz;
+	int type = info->genlhdr->cmd;
+
+#ifdef CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN
+	if (!netlink_capable(skb, CAP_NET_ADMIN))
+		return -EPERM;
+#endif
+
+	if (type >= KSMBD_EVENT_MAX) {
+		WARN_ON(1);
+		return -EINVAL;
+	}
+
+	if (!ksmbd_ipc_validate_version(info))
+		return -EINVAL;
+
+	if (!info->attrs[type])
+		return -EINVAL;
+
+	payload = nla_data(info->attrs[info->genlhdr->cmd]);
+	sz = nla_len(info->attrs[info->genlhdr->cmd]);
+	return handle_response(type, payload, sz);
+}
+
+static int ipc_msg_send(struct ksmbd_ipc_msg *msg)
+{
+	struct genlmsghdr *nlh;
+	struct sk_buff *skb;
+	int ret = -EINVAL;
+
+	if (!ksmbd_tools_pid)
+		return ret;
+
+	skb = genlmsg_new(msg->sz, GFP_KERNEL);
+	if (!skb)
+		return -ENOMEM;
+
+	nlh = genlmsg_put(skb, 0, 0, &ksmbd_genl_family, 0, msg->type);
+	if (!nlh)
+		goto out;
+
+	ret = nla_put(skb, msg->type, msg->sz, KSMBD_IPC_MSG_PAYLOAD(msg));
+	if (ret) {
+		genlmsg_cancel(skb, nlh);
+		goto out;
+	}
+
+	genlmsg_end(skb, nlh);
+	ret = genlmsg_unicast(&init_net, skb, ksmbd_tools_pid);
+	if (!ret)
+		ipc_update_last_active();
+	return ret;
+
+out:
+	nlmsg_free(skb);
+	return ret;
+}
+
+static void *ipc_msg_send_request(struct ksmbd_ipc_msg *msg, unsigned int handle)
+{
+	struct ipc_msg_table_entry entry;
+	int ret;
+
+	if ((int)handle < 0)
+		return NULL;
+
+	entry.type = msg->type;
+	entry.response = NULL;
+	init_waitqueue_head(&entry.wait);
+
+	down_write(&ipc_msg_table_lock);
+	entry.handle = handle;
+	hash_add(ipc_msg_table, &entry.ipc_table_hlist, entry.handle);
+	up_write(&ipc_msg_table_lock);
+
+	ret = ipc_msg_send(msg);
+	if (ret)
+		goto out;
+
+	ret = wait_event_interruptible_timeout(entry.wait,
+					       entry.response != NULL,
+					       IPC_WAIT_TIMEOUT);
+out:
+	down_write(&ipc_msg_table_lock);
+	hash_del(&entry.ipc_table_hlist);
+	up_write(&ipc_msg_table_lock);
+	return entry.response;
+}
+
+static int ksmbd_ipc_heartbeat_request(void)
+{
+	struct ksmbd_ipc_msg *msg;
+	int ret;
+
+	msg = ipc_msg_alloc(sizeof(struct ksmbd_heartbeat));
+	if (!msg)
+		return -EINVAL;
+
+	msg->type = KSMBD_EVENT_HEARTBEAT_REQUEST;
+	ret = ipc_msg_send(msg);
+	ipc_msg_free(msg);
+	return ret;
+}
+
+struct ksmbd_login_response *ksmbd_ipc_login_request(const char *account)
+{
+	struct ksmbd_ipc_msg *msg;
+	struct ksmbd_login_request *req;
+	struct ksmbd_login_response *resp;
+
+	if (strlen(account) >= KSMBD_REQ_MAX_ACCOUNT_NAME_SZ)
+		return NULL;
+
+	msg = ipc_msg_alloc(sizeof(struct ksmbd_login_request));
+	if (!msg)
+		return NULL;
+
+	msg->type = KSMBD_EVENT_LOGIN_REQUEST;
+	req = KSMBD_IPC_MSG_PAYLOAD(msg);
+	req->handle = ksmbd_acquire_id(&ipc_ida);
+	strscpy(req->account, account, KSMBD_REQ_MAX_ACCOUNT_NAME_SZ);
+	resp = ipc_msg_send_request(msg, req->handle);
+	ipc_msg_handle_free(req->handle);
+	ipc_msg_free(msg);
+	return resp;
+}
+
+struct ksmbd_spnego_authen_response *
+ksmbd_ipc_spnego_authen_request(const char *spnego_blob, int blob_len)
+{
+	struct ksmbd_ipc_msg *msg;
+	struct ksmbd_spnego_authen_request *req;
+	struct ksmbd_spnego_authen_response *resp;
+
+	msg = ipc_msg_alloc(sizeof(struct ksmbd_spnego_authen_request) +
+			blob_len + 1);
+	if (!msg)
+		return NULL;
+
+	msg->type = KSMBD_EVENT_SPNEGO_AUTHEN_REQUEST;
+	req = KSMBD_IPC_MSG_PAYLOAD(msg);
+	req->handle = ksmbd_acquire_id(&ipc_ida);
+	req->spnego_blob_len = blob_len;
+	memcpy(req->spnego_blob, spnego_blob, blob_len);
+
+	resp = ipc_msg_send_request(msg, req->handle);
+	ipc_msg_handle_free(req->handle);
+	ipc_msg_free(msg);
+	return resp;
+}
+
+struct ksmbd_tree_connect_response *
+ksmbd_ipc_tree_connect_request(struct ksmbd_session *sess,
+		struct ksmbd_share_config *share,
+		struct ksmbd_tree_connect *tree_conn,
+		struct sockaddr *peer_addr)
+{
+	struct ksmbd_ipc_msg *msg;
+	struct ksmbd_tree_connect_request *req;
+	struct ksmbd_tree_connect_response *resp;
+
+	if (strlen(user_name(sess->user)) >= KSMBD_REQ_MAX_ACCOUNT_NAME_SZ)
+		return NULL;
+
+	if (strlen(share->name) >= KSMBD_REQ_MAX_SHARE_NAME)
+		return NULL;
+
+	msg = ipc_msg_alloc(sizeof(struct ksmbd_tree_connect_request));
+	if (!msg)
+		return NULL;
+
+	msg->type = KSMBD_EVENT_TREE_CONNECT_REQUEST;
+	req = KSMBD_IPC_MSG_PAYLOAD(msg);
+
+	req->handle = ksmbd_acquire_id(&ipc_ida);
+	req->account_flags = sess->user->flags;
+	req->session_id = sess->id;
+	req->connect_id = tree_conn->id;
+	strscpy(req->account, user_name(sess->user), KSMBD_REQ_MAX_ACCOUNT_NAME_SZ);
+	strscpy(req->share, share->name, KSMBD_REQ_MAX_SHARE_NAME);
+	snprintf(req->peer_addr, sizeof(req->peer_addr), "%pIS", peer_addr);
+
+	if (peer_addr->sa_family == AF_INET6)
+		req->flags |= KSMBD_TREE_CONN_FLAG_REQUEST_IPV6;
+	if (test_session_flag(sess, CIFDS_SESSION_FLAG_SMB2))
+		req->flags |= KSMBD_TREE_CONN_FLAG_REQUEST_SMB2;
+
+	resp = ipc_msg_send_request(msg, req->handle);
+	ipc_msg_handle_free(req->handle);
+	ipc_msg_free(msg);
+	return resp;
+}
+
+int ksmbd_ipc_tree_disconnect_request(unsigned long long session_id,
+		unsigned long long connect_id)
+{
+	struct ksmbd_ipc_msg *msg;
+	struct ksmbd_tree_disconnect_request *req;
+	int ret;
+
+	msg = ipc_msg_alloc(sizeof(struct ksmbd_tree_disconnect_request));
+	if (!msg)
+		return -ENOMEM;
+
+	msg->type = KSMBD_EVENT_TREE_DISCONNECT_REQUEST;
+	req = KSMBD_IPC_MSG_PAYLOAD(msg);
+	req->session_id = session_id;
+	req->connect_id = connect_id;
+
+	ret = ipc_msg_send(msg);
+	ipc_msg_free(msg);
+	return ret;
+}
+
+int ksmbd_ipc_logout_request(const char *account)
+{
+	struct ksmbd_ipc_msg *msg;
+	struct ksmbd_logout_request *req;
+	int ret;
+
+	if (strlen(account) >= KSMBD_REQ_MAX_ACCOUNT_NAME_SZ)
+		return -EINVAL;
+
+	msg = ipc_msg_alloc(sizeof(struct ksmbd_logout_request));
+	if (!msg)
+		return -ENOMEM;
+
+	msg->type = KSMBD_EVENT_LOGOUT_REQUEST;
+	req = KSMBD_IPC_MSG_PAYLOAD(msg);
+	strscpy(req->account, account, KSMBD_REQ_MAX_ACCOUNT_NAME_SZ);
+
+	ret = ipc_msg_send(msg);
+	ipc_msg_free(msg);
+	return ret;
+}
+
+struct ksmbd_share_config_response *
+ksmbd_ipc_share_config_request(const char *name)
+{
+	struct ksmbd_ipc_msg *msg;
+	struct ksmbd_share_config_request *req;
+	struct ksmbd_share_config_response *resp;
+
+	if (strlen(name) >= KSMBD_REQ_MAX_SHARE_NAME)
+		return NULL;
+
+	msg = ipc_msg_alloc(sizeof(struct ksmbd_share_config_request));
+	if (!msg)
+		return NULL;
+
+	msg->type = KSMBD_EVENT_SHARE_CONFIG_REQUEST;
+	req = KSMBD_IPC_MSG_PAYLOAD(msg);
+	req->handle = ksmbd_acquire_id(&ipc_ida);
+	strscpy(req->share_name, name, KSMBD_REQ_MAX_SHARE_NAME);
+
+	resp = ipc_msg_send_request(msg, req->handle);
+	ipc_msg_handle_free(req->handle);
+	ipc_msg_free(msg);
+	return resp;
+}
+
+struct ksmbd_rpc_command *ksmbd_rpc_open(struct ksmbd_session *sess, int handle)
+{
+	struct ksmbd_ipc_msg *msg;
+	struct ksmbd_rpc_command *req;
+	struct ksmbd_rpc_command *resp;
+
+	msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command));
+	if (!msg)
+		return NULL;
+
+	msg->type = KSMBD_EVENT_RPC_REQUEST;
+	req = KSMBD_IPC_MSG_PAYLOAD(msg);
+	req->handle = handle;
+	req->flags = ksmbd_session_rpc_method(sess, handle);
+	req->flags |= KSMBD_RPC_OPEN_METHOD;
+	req->payload_sz = 0;
+
+	resp = ipc_msg_send_request(msg, req->handle);
+	ipc_msg_free(msg);
+	return resp;
+}
+
+struct ksmbd_rpc_command *ksmbd_rpc_close(struct ksmbd_session *sess, int handle)
+{
+	struct ksmbd_ipc_msg *msg;
+	struct ksmbd_rpc_command *req;
+	struct ksmbd_rpc_command *resp;
+
+	msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command));
+	if (!msg)
+		return NULL;
+
+	msg->type = KSMBD_EVENT_RPC_REQUEST;
+	req = KSMBD_IPC_MSG_PAYLOAD(msg);
+	req->handle = handle;
+	req->flags = ksmbd_session_rpc_method(sess, handle);
+	req->flags |= KSMBD_RPC_CLOSE_METHOD;
+	req->payload_sz = 0;
+
+	resp = ipc_msg_send_request(msg, req->handle);
+	ipc_msg_free(msg);
+	return resp;
+}
+
+struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handle,
+		void *payload, size_t payload_sz)
+{
+	struct ksmbd_ipc_msg *msg;
+	struct ksmbd_rpc_command *req;
+	struct ksmbd_rpc_command *resp;
+
+	msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command) + payload_sz + 1);
+	if (!msg)
+		return NULL;
+
+	msg->type = KSMBD_EVENT_RPC_REQUEST;
+	req = KSMBD_IPC_MSG_PAYLOAD(msg);
+	req->handle = handle;
+	req->flags = ksmbd_session_rpc_method(sess, handle);
+	req->flags |= rpc_context_flags(sess);
+	req->flags |= KSMBD_RPC_WRITE_METHOD;
+	req->payload_sz = payload_sz;
+	memcpy(req->payload, payload, payload_sz);
+
+	resp = ipc_msg_send_request(msg, req->handle);
+	ipc_msg_free(msg);
+	return resp;
+}
+
+struct ksmbd_rpc_command *ksmbd_rpc_read(struct ksmbd_session *sess, int handle)
+{
+	struct ksmbd_ipc_msg *msg;
+	struct ksmbd_rpc_command *req;
+	struct ksmbd_rpc_command *resp;
+
+	msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command));
+	if (!msg)
+		return NULL;
+
+	msg->type = KSMBD_EVENT_RPC_REQUEST;
+	req = KSMBD_IPC_MSG_PAYLOAD(msg);
+	req->handle = handle;
+	req->flags = ksmbd_session_rpc_method(sess, handle);
+	req->flags |= rpc_context_flags(sess);
+	req->flags |= KSMBD_RPC_READ_METHOD;
+	req->payload_sz = 0;
+
+	resp = ipc_msg_send_request(msg, req->handle);
+	ipc_msg_free(msg);
+	return resp;
+}
+
+struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handle,
+		void *payload, size_t payload_sz)
+{
+	struct ksmbd_ipc_msg *msg;
+	struct ksmbd_rpc_command *req;
+	struct ksmbd_rpc_command *resp;
+
+	msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command) + payload_sz + 1);
+	if (!msg)
+		return NULL;
+
+	msg->type = KSMBD_EVENT_RPC_REQUEST;
+	req = KSMBD_IPC_MSG_PAYLOAD(msg);
+	req->handle = handle;
+	req->flags = ksmbd_session_rpc_method(sess, handle);
+	req->flags |= rpc_context_flags(sess);
+	req->flags |= KSMBD_RPC_IOCTL_METHOD;
+	req->payload_sz = payload_sz;
+	memcpy(req->payload, payload, payload_sz);
+
+	resp = ipc_msg_send_request(msg, req->handle);
+	ipc_msg_free(msg);
+	return resp;
+}
+
+struct ksmbd_rpc_command *ksmbd_rpc_rap(struct ksmbd_session *sess, void *payload,
+		size_t payload_sz)
+{
+	struct ksmbd_ipc_msg *msg;
+	struct ksmbd_rpc_command *req;
+	struct ksmbd_rpc_command *resp;
+
+	msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command) + payload_sz + 1);
+	if (!msg)
+		return NULL;
+
+	msg->type = KSMBD_EVENT_RPC_REQUEST;
+	req = KSMBD_IPC_MSG_PAYLOAD(msg);
+	req->handle = ksmbd_acquire_id(&ipc_ida);
+	req->flags = rpc_context_flags(sess);
+	req->flags |= KSMBD_RPC_RAP_METHOD;
+	req->payload_sz = payload_sz;
+	memcpy(req->payload, payload, payload_sz);
+
+	resp = ipc_msg_send_request(msg, req->handle);
+	ipc_msg_handle_free(req->handle);
+	ipc_msg_free(msg);
+	return resp;
+}
+
+static int __ipc_heartbeat(void)
+{
+	unsigned long delta;
+
+	if (!ksmbd_server_running())
+		return 0;
+
+	if (time_after(jiffies, server_conf.ipc_last_active)) {
+		delta = (jiffies - server_conf.ipc_last_active);
+	} else {
+		ipc_update_last_active();
+		schedule_delayed_work(&ipc_timer_work,
+				      server_conf.ipc_timeout);
+		return 0;
+	}
+
+	if (delta < server_conf.ipc_timeout) {
+		schedule_delayed_work(&ipc_timer_work,
+				      server_conf.ipc_timeout - delta);
+		return 0;
+	}
+
+	if (ksmbd_ipc_heartbeat_request() == 0) {
+		schedule_delayed_work(&ipc_timer_work,
+				      server_conf.ipc_timeout);
+		return 0;
+	}
+
+	mutex_lock(&startup_lock);
+	WRITE_ONCE(server_conf.state, SERVER_STATE_RESETTING);
+	server_conf.ipc_last_active = 0;
+	ksmbd_tools_pid = 0;
+	ksmbd_err("No IPC daemon response for %lus\n", delta / HZ);
+	mutex_unlock(&startup_lock);
+	return -EINVAL;
+}
+
+static void ipc_timer_heartbeat(struct work_struct *w)
+{
+	if (__ipc_heartbeat())
+		server_queue_ctrl_reset_work();
+}
+
+int ksmbd_ipc_id_alloc(void)
+{
+	return ksmbd_acquire_id(&ipc_ida);
+}
+
+void ksmbd_rpc_id_free(int handle)
+{
+	ksmbd_release_id(&ipc_ida, handle);
+}
+
+void ksmbd_ipc_release(void)
+{
+	cancel_delayed_work_sync(&ipc_timer_work);
+	genl_unregister_family(&ksmbd_genl_family);
+}
+
+void ksmbd_ipc_soft_reset(void)
+{
+	mutex_lock(&startup_lock);
+	ksmbd_tools_pid = 0;
+	cancel_delayed_work_sync(&ipc_timer_work);
+	mutex_unlock(&startup_lock);
+}
+
+int ksmbd_ipc_init(void)
+{
+	int ret = 0;
+
+	ksmbd_nl_init_fixup();
+	INIT_DELAYED_WORK(&ipc_timer_work, ipc_timer_heartbeat);
+
+	ret = genl_register_family(&ksmbd_genl_family);
+	if (ret) {
+		ksmbd_err("Failed to register KSMBD netlink interface %d\n", ret);
+		cancel_delayed_work_sync(&ipc_timer_work);
+	}
+
+	return ret;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./transport_ipc.h linux-5.4.60-fbx/fs/cifsd/transport_ipc.h
--- linux-5.4.60-fbx/fs/cifsd./transport_ipc.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/transport_ipc.h	2021-04-21 09:44:50.978505152 +0200
@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __KSMBD_TRANSPORT_IPC_H__
+#define __KSMBD_TRANSPORT_IPC_H__
+
+#include <linux/wait.h>
+
+#define KSMBD_IPC_MAX_PAYLOAD	4096
+
+struct ksmbd_login_response *
+ksmbd_ipc_login_request(const char *account);
+
+struct ksmbd_session;
+struct ksmbd_share_config;
+struct ksmbd_tree_connect;
+struct sockaddr;
+
+struct ksmbd_tree_connect_response *
+ksmbd_ipc_tree_connect_request(struct ksmbd_session *sess,
+		struct ksmbd_share_config *share,
+		struct ksmbd_tree_connect *tree_conn,
+		struct sockaddr *peer_addr);
+
+int ksmbd_ipc_tree_disconnect_request(unsigned long long session_id,
+				      unsigned long long connect_id);
+int ksmbd_ipc_logout_request(const char *account);
+
+struct ksmbd_share_config_response *
+ksmbd_ipc_share_config_request(const char *name);
+
+struct ksmbd_spnego_authen_response *
+ksmbd_ipc_spnego_authen_request(const char *spnego_blob, int blob_len);
+
+int ksmbd_ipc_id_alloc(void);
+void ksmbd_rpc_id_free(int handle);
+
+struct ksmbd_rpc_command *ksmbd_rpc_open(struct ksmbd_session *sess, int handle);
+struct ksmbd_rpc_command *ksmbd_rpc_close(struct ksmbd_session *sess, int handle);
+
+struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handle,
+		void *payload, size_t payload_sz);
+struct ksmbd_rpc_command *ksmbd_rpc_read(struct ksmbd_session *sess, int handle);
+struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handle,
+		void *payload, size_t payload_sz);
+struct ksmbd_rpc_command *ksmbd_rpc_rap(struct ksmbd_session *sess, void *payload,
+		size_t payload_sz);
+
+void ksmbd_ipc_release(void);
+void ksmbd_ipc_soft_reset(void);
+int ksmbd_ipc_init(void);
+#endif /* __KSMBD_TRANSPORT_IPC_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./transport_rdma.h linux-5.4.60-fbx/fs/cifsd/transport_rdma.h
--- linux-5.4.60-fbx/fs/cifsd./transport_rdma.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/transport_rdma.h	2021-03-30 15:48:29.605052529 +0200
@@ -0,0 +1,61 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2017, Microsoft Corporation.
+ *   Copyright (C) 2018, LG Electronics.
+ */
+
+#ifndef __KSMBD_TRANSPORT_RDMA_H__
+#define __KSMBD_TRANSPORT_RDMA_H__
+
+#define SMB_DIRECT_PORT	5445
+
+/* SMB DIRECT negotiation request packet [MS-KSMBD] 2.2.1 */
+struct smb_direct_negotiate_req {
+	__le16 min_version;
+	__le16 max_version;
+	__le16 reserved;
+	__le16 credits_requested;
+	__le32 preferred_send_size;
+	__le32 max_receive_size;
+	__le32 max_fragmented_size;
+} __packed;
+
+/* SMB DIRECT negotiation response packet [MS-KSMBD] 2.2.2 */
+struct smb_direct_negotiate_resp {
+	__le16 min_version;
+	__le16 max_version;
+	__le16 negotiated_version;
+	__le16 reserved;
+	__le16 credits_requested;
+	__le16 credits_granted;
+	__le32 status;
+	__le32 max_readwrite_size;
+	__le32 preferred_send_size;
+	__le32 max_receive_size;
+	__le32 max_fragmented_size;
+} __packed;
+
+#define SMB_DIRECT_RESPONSE_REQUESTED 0x0001
+
+/* SMB DIRECT data transfer packet with payload [MS-KSMBD] 2.2.3 */
+struct smb_direct_data_transfer {
+	__le16 credits_requested;
+	__le16 credits_granted;
+	__le16 flags;
+	__le16 reserved;
+	__le32 remaining_data_length;
+	__le32 data_offset;
+	__le32 data_length;
+	__le32 padding;
+	__u8 buffer[];
+} __packed;
+
+#ifdef CONFIG_SMB_SERVER_SMBDIRECT
+int ksmbd_rdma_init(void);
+int ksmbd_rdma_destroy(void);
+#else
+static inline int ksmbd_rdma_init(void) { return 0; }
+static inline int ksmbd_rdma_destroy(void) { return 0; }
+#endif
+
+#endif /* __KSMBD_TRANSPORT_RDMA_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./transport_tcp.c linux-5.4.60-fbx/fs/cifsd/transport_tcp.c
--- linux-5.4.60-fbx/fs/cifsd./transport_tcp.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/transport_tcp.c	2021-04-21 09:44:50.981838485 +0200
@@ -0,0 +1,658 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/freezer.h>
+
+#include "smb_common.h"
+#include "server.h"
+#include "auth.h"
+#include "buffer_pool.h"
+#include "connection.h"
+#include "transport_tcp.h"
+
+#define IFACE_STATE_DOWN		BIT(0)
+#define IFACE_STATE_CONFIGURED		BIT(1)
+
+struct interface {
+	struct task_struct	*ksmbd_kthread;
+	struct socket		*ksmbd_socket;
+	struct list_head	entry;
+	char			*name;
+	struct mutex		sock_release_lock;
+	int			state;
+};
+
+static LIST_HEAD(iface_list);
+
+static int bind_additional_ifaces;
+
+struct tcp_transport {
+	struct ksmbd_transport		transport;
+	struct socket			*sock;
+	struct kvec			*iov;
+	unsigned int			nr_iov;
+};
+
+static struct ksmbd_transport_ops ksmbd_tcp_transport_ops;
+
+static void tcp_stop_kthread(struct task_struct *kthread);
+static struct interface *alloc_iface(char *ifname);
+
+#define KSMBD_TRANS(t)	(&(t)->transport)
+#define TCP_TRANS(t)	((struct tcp_transport *)container_of(t, \
+				struct tcp_transport, transport))
+
+static inline void ksmbd_tcp_nodelay(struct socket *sock)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 8, 0)
+	int val = 1;
+
+	kernel_setsockopt(sock, SOL_TCP, TCP_NODELAY,
+		(char *)&val, sizeof(val));
+#else
+	tcp_sock_set_nodelay(sock->sk);
+#endif
+}
+
+static inline void ksmbd_tcp_reuseaddr(struct socket *sock)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 8, 0)
+	int val = 1;
+
+	kernel_setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
+		(char *)&val, sizeof(val));
+#else
+	sock_set_reuseaddr(sock->sk);
+#endif
+}
+
+static inline void ksmbd_tcp_rcv_timeout(struct socket *sock, s64 secs)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 8, 0)
+	struct __kernel_old_timeval tv = { .tv_sec = secs, .tv_usec = 0 };
+
+	kernel_setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO_OLD, (char *)&tv,
+			  sizeof(tv));
+#else
+	lock_sock(sock->sk);
+	if (secs && secs < MAX_SCHEDULE_TIMEOUT / HZ - 1)
+		sock->sk->sk_rcvtimeo = secs * HZ;
+	else
+		sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
+	release_sock(sock->sk);
+#endif
+}
+
+static inline void ksmbd_tcp_snd_timeout(struct socket *sock, s64 secs)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 8, 0)
+	struct __kernel_old_timeval tv = { .tv_sec = secs, .tv_usec = 0 };
+
+	kernel_setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO_OLD, (char *)&tv,
+			  sizeof(tv));
+#else
+	sock_set_sndtimeo(sock->sk, secs);
+#endif
+}
+
+static struct tcp_transport *alloc_transport(struct socket *client_sk)
+{
+	struct tcp_transport *t;
+	struct ksmbd_conn *conn;
+
+	t = kzalloc(sizeof(*t), GFP_KERNEL);
+	if (!t)
+		return NULL;
+	t->sock = client_sk;
+
+	conn = ksmbd_conn_alloc();
+	if (!conn) {
+		kfree(t);
+		return NULL;
+	}
+
+	conn->transport = KSMBD_TRANS(t);
+	KSMBD_TRANS(t)->conn = conn;
+	KSMBD_TRANS(t)->ops = &ksmbd_tcp_transport_ops;
+	return t;
+}
+
+static void free_transport(struct tcp_transport *t)
+{
+	kernel_sock_shutdown(t->sock, SHUT_RDWR);
+	sock_release(t->sock);
+	t->sock = NULL;
+
+	ksmbd_conn_free(KSMBD_TRANS(t)->conn);
+	kfree(t->iov);
+	kfree(t);
+}
+
+/**
+ * kvec_array_init() - initialize a IO vector segment
+ * @new:	IO vector to be initialized
+ * @iov:	base IO vector
+ * @nr_segs:	number of segments in base iov
+ * @bytes:	total iovec length so far for read
+ *
+ * Return:	Number of IO segments
+ */
+static unsigned int kvec_array_init(struct kvec *new, struct kvec *iov,
+		unsigned int nr_segs, size_t bytes)
+{
+	size_t base = 0;
+
+	while (bytes || !iov->iov_len) {
+		int copy = min(bytes, iov->iov_len);
+
+		bytes -= copy;
+		base += copy;
+		if (iov->iov_len == base) {
+			iov++;
+			nr_segs--;
+			base = 0;
+		}
+	}
+
+	memcpy(new, iov, sizeof(*iov) * nr_segs);
+	new->iov_base += base;
+	new->iov_len -= base;
+	return nr_segs;
+}
+
+/**
+ * get_conn_iovec() - get connection iovec for reading from socket
+ * @t:		TCP transport instance
+ * @nr_segs:	number of segments in iov
+ *
+ * Return:	return existing or newly allocate iovec
+ */
+static struct kvec *get_conn_iovec(struct tcp_transport *t, unsigned int nr_segs)
+{
+	struct kvec *new_iov;
+
+	if (t->iov && nr_segs <= t->nr_iov)
+		return t->iov;
+
+	/* not big enough -- allocate a new one and release the old */
+	new_iov = kmalloc_array(nr_segs, sizeof(*new_iov), GFP_KERNEL);
+	if (new_iov) {
+		kfree(t->iov);
+		t->iov = new_iov;
+		t->nr_iov = nr_segs;
+	}
+	return new_iov;
+}
+
+static unsigned short ksmbd_tcp_get_port(const struct sockaddr *sa)
+{
+	switch (sa->sa_family) {
+	case AF_INET:
+		return ntohs(((struct sockaddr_in *)sa)->sin_port);
+	case AF_INET6:
+		return ntohs(((struct sockaddr_in6 *)sa)->sin6_port);
+	}
+	return 0;
+}
+
+/**
+ * ksmbd_tcp_new_connection() - create a new tcp session on mount
+ * @client_sk:	socket associated with new connection
+ *
+ * whenever a new connection is requested, create a conn thread
+ * (session thread) to handle new incoming smb requests from the connection
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int ksmbd_tcp_new_connection(struct socket *client_sk)
+{
+	struct sockaddr *csin;
+	int rc = 0;
+	struct tcp_transport *t;
+
+	t = alloc_transport(client_sk);
+	if (!t)
+		return -ENOMEM;
+
+	csin = KSMBD_TCP_PEER_SOCKADDR(KSMBD_TRANS(t)->conn);
+
+	if (kernel_getpeername(client_sk, csin) < 0) {
+		ksmbd_err("client ip resolution failed\n");
+		rc = -EINVAL;
+		goto out_error;
+	}
+	KSMBD_TRANS(t)->handler = kthread_run(ksmbd_conn_handler_loop,
+					KSMBD_TRANS(t)->conn,
+					"ksmbd:%u", ksmbd_tcp_get_port(csin));
+	if (IS_ERR(KSMBD_TRANS(t)->handler)) {
+		ksmbd_err("cannot start conn thread\n");
+		rc = PTR_ERR(KSMBD_TRANS(t)->handler);
+		free_transport(t);
+	}
+	return rc;
+
+out_error:
+	free_transport(t);
+	return rc;
+}
+
+/**
+ * ksmbd_kthread_fn() - listen to new SMB connections and callback server
+ * @p:		arguments to forker thread
+ *
+ * Return:	Returns a task_struct or ERR_PTR
+ */
+static int ksmbd_kthread_fn(void *p)
+{
+	struct socket *client_sk = NULL;
+	struct interface *iface = (struct interface *)p;
+	int ret;
+
+	while (!kthread_should_stop()) {
+		mutex_lock(&iface->sock_release_lock);
+		if (!iface->ksmbd_socket) {
+			mutex_unlock(&iface->sock_release_lock);
+			break;
+		}
+		ret = kernel_accept(iface->ksmbd_socket, &client_sk,
+				O_NONBLOCK);
+		mutex_unlock(&iface->sock_release_lock);
+		if (ret) {
+			if (ret == -EAGAIN)
+				/* check for new connections every 100 msecs */
+				schedule_timeout_interruptible(HZ / 10);
+			continue;
+		}
+
+		ksmbd_debug(CONN, "connect success: accepted new connection\n");
+		client_sk->sk->sk_rcvtimeo = KSMBD_TCP_RECV_TIMEOUT;
+		client_sk->sk->sk_sndtimeo = KSMBD_TCP_SEND_TIMEOUT;
+
+		ksmbd_tcp_new_connection(client_sk);
+	}
+
+	ksmbd_debug(CONN, "releasing socket\n");
+	return 0;
+}
+
+/**
+ * ksmbd_tcp_run_kthread() - start forker thread
+ * @iface: pointer to struct interface
+ *
+ * start forker thread(ksmbd/0) at module init time to listen
+ * on port 445 for new SMB connection requests. It creates per connection
+ * server threads(ksmbd/x)
+ *
+ * Return:	0 on success or error number
+ */
+static int ksmbd_tcp_run_kthread(struct interface *iface)
+{
+	int rc;
+	struct task_struct *kthread;
+
+	kthread = kthread_run(ksmbd_kthread_fn, (void *)iface,
+		"ksmbd-%s", iface->name);
+	if (IS_ERR(kthread)) {
+		rc = PTR_ERR(kthread);
+		return rc;
+	}
+	iface->ksmbd_kthread = kthread;
+
+	return 0;
+}
+
+/**
+ * ksmbd_tcp_readv() - read data from socket in given iovec
+ * @t:		TCP transport instance
+ * @iov_orig:	base IO vector
+ * @nr_segs:	number of segments in base iov
+ * @to_read:	number of bytes to read from socket
+ *
+ * Return:	on success return number of bytes read from socket,
+ *		otherwise return error number
+ */
+static int ksmbd_tcp_readv(struct tcp_transport *t, struct kvec *iov_orig,
+		unsigned int nr_segs, unsigned int to_read)
+{
+	int length = 0;
+	int total_read;
+	unsigned int segs;
+	struct msghdr ksmbd_msg;
+	struct kvec *iov;
+	struct ksmbd_conn *conn = KSMBD_TRANS(t)->conn;
+
+	iov = get_conn_iovec(t, nr_segs);
+	if (!iov)
+		return -ENOMEM;
+
+	ksmbd_msg.msg_control = NULL;
+	ksmbd_msg.msg_controllen = 0;
+
+	for (total_read = 0; to_read; total_read += length, to_read -= length) {
+		try_to_freeze();
+
+		if (!ksmbd_conn_alive(conn)) {
+			total_read = -ESHUTDOWN;
+			break;
+		}
+		segs = kvec_array_init(iov, iov_orig, nr_segs, total_read);
+
+		length = kernel_recvmsg(t->sock, &ksmbd_msg,
+					iov, segs, to_read, 0);
+
+		if (length == -EINTR) {
+			total_read = -ESHUTDOWN;
+			break;
+		} else if (conn->status == KSMBD_SESS_NEED_RECONNECT) {
+			total_read = -EAGAIN;
+			break;
+		} else if (length == -ERESTARTSYS || length == -EAGAIN) {
+			usleep_range(1000, 2000);
+			length = 0;
+			continue;
+		} else if (length <= 0) {
+			total_read = -EAGAIN;
+			break;
+		}
+	}
+	return total_read;
+}
+
+/**
+ * ksmbd_tcp_read() - read data from socket in given buffer
+ * @t:		TCP transport instance
+ * @buf:	buffer to store read data from socket
+ * @to_read:	number of bytes to read from socket
+ *
+ * Return:	on success return number of bytes read from socket,
+ *		otherwise return error number
+ */
+static int ksmbd_tcp_read(struct ksmbd_transport *t, char *buf, unsigned int to_read)
+{
+	struct kvec iov;
+
+	iov.iov_base = buf;
+	iov.iov_len = to_read;
+
+	return ksmbd_tcp_readv(TCP_TRANS(t), &iov, 1, to_read);
+}
+
+static int ksmbd_tcp_writev(struct ksmbd_transport *t, struct kvec *iov,
+		int nvecs, int size, bool need_invalidate, unsigned int remote_key)
+
+{
+	struct msghdr smb_msg = {.msg_flags = MSG_NOSIGNAL};
+
+	return kernel_sendmsg(TCP_TRANS(t)->sock, &smb_msg, iov, nvecs, size);
+}
+
+static void ksmbd_tcp_disconnect(struct ksmbd_transport *t)
+{
+	free_transport(TCP_TRANS(t));
+}
+
+static void tcp_destroy_socket(struct socket *ksmbd_socket)
+{
+	int ret;
+
+	if (!ksmbd_socket)
+		return;
+
+	/* set zero to timeout */
+	ksmbd_tcp_rcv_timeout(ksmbd_socket, 0);
+	ksmbd_tcp_snd_timeout(ksmbd_socket, 0);
+
+	ret = kernel_sock_shutdown(ksmbd_socket, SHUT_RDWR);
+	if (ret)
+		ksmbd_err("Failed to shutdown socket: %d\n", ret);
+	else
+		sock_release(ksmbd_socket);
+}
+
+/**
+ * create_socket - create socket for ksmbd/0
+ *
+ * Return:	Returns a task_struct or ERR_PTR
+ */
+static int create_socket(struct interface *iface)
+{
+	int ret;
+	struct sockaddr_in6 sin6;
+	struct sockaddr_in sin;
+	struct socket *ksmbd_socket;
+	bool ipv4 = false;
+
+	ret = sock_create(PF_INET6, SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket);
+	if (ret) {
+		ksmbd_err("Can't create socket for ipv6, try ipv4: %d\n", ret);
+		ret = sock_create(PF_INET, SOCK_STREAM, IPPROTO_TCP,
+				&ksmbd_socket);
+		if (ret) {
+			ksmbd_err("Can't create socket for ipv4: %d\n", ret);
+			goto out_error;
+		}
+
+		sin.sin_family = PF_INET;
+		sin.sin_addr.s_addr = htonl(INADDR_ANY);
+		sin.sin_port = htons(server_conf.tcp_port);
+		ipv4 = true;
+	} else {
+		sin6.sin6_family = PF_INET6;
+		sin6.sin6_addr = in6addr_any;
+		sin6.sin6_port = htons(server_conf.tcp_port);
+	}
+
+	ksmbd_tcp_nodelay(ksmbd_socket);
+	ksmbd_tcp_reuseaddr(ksmbd_socket);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 8, 0)
+	ret = kernel_setsockopt(ksmbd_socket,
+				SOL_SOCKET,
+				SO_BINDTODEVICE,
+				iface->name,
+				strlen(iface->name));
+#else
+	ret = sock_setsockopt(ksmbd_socket,
+			      SOL_SOCKET,
+			      SO_BINDTODEVICE,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 9, 0)
+			      (char __user *)iface->name,
+#else
+			      KERNEL_SOCKPTR(iface->name),
+#endif
+			      strlen(iface->name));
+#endif
+	if (ret != -ENODEV && ret < 0) {
+		ksmbd_err("Failed to set SO_BINDTODEVICE: %d\n", ret);
+		goto out_error;
+	}
+
+	if (ipv4)
+		ret = kernel_bind(ksmbd_socket, (struct sockaddr *)&sin,
+				sizeof(sin));
+	else
+		ret = kernel_bind(ksmbd_socket, (struct sockaddr *)&sin6,
+				sizeof(sin6));
+	if (ret) {
+		ksmbd_err("Failed to bind socket: %d\n", ret);
+		goto out_error;
+	}
+
+	ksmbd_socket->sk->sk_rcvtimeo = KSMBD_TCP_RECV_TIMEOUT;
+	ksmbd_socket->sk->sk_sndtimeo = KSMBD_TCP_SEND_TIMEOUT;
+
+	ret = kernel_listen(ksmbd_socket, KSMBD_SOCKET_BACKLOG);
+	if (ret) {
+		ksmbd_err("Port listen() error: %d\n", ret);
+		goto out_error;
+	}
+
+	iface->ksmbd_socket = ksmbd_socket;
+	ret = ksmbd_tcp_run_kthread(iface);
+	if (ret) {
+		ksmbd_err("Can't start ksmbd main kthread: %d\n", ret);
+		goto out_error;
+	}
+	iface->state = IFACE_STATE_CONFIGURED;
+
+	return 0;
+
+out_error:
+	tcp_destroy_socket(ksmbd_socket);
+	iface->ksmbd_socket = NULL;
+	return ret;
+}
+
+static int ksmbd_netdev_event(struct notifier_block *nb, unsigned long event,
+		void *ptr)
+{
+	struct net_device *netdev = netdev_notifier_info_to_dev(ptr);
+	struct interface *iface;
+	int ret, found = 0;
+
+	switch (event) {
+	case NETDEV_UP:
+		if (netdev->priv_flags & IFF_BRIDGE_PORT)
+			return NOTIFY_OK;
+
+		list_for_each_entry(iface, &iface_list, entry) {
+			if (!strcmp(iface->name, netdev->name)) {
+				found = 1;
+				if (iface->state != IFACE_STATE_DOWN)
+					break;
+				ret = create_socket(iface);
+				if (ret)
+					return NOTIFY_OK;
+				break;
+			}
+		}
+		if (!found && bind_additional_ifaces) {
+			iface = alloc_iface(kstrdup(netdev->name, GFP_KERNEL));
+			if (!iface)
+				return NOTIFY_OK;
+			ret = create_socket(iface);
+			if (ret)
+				break;
+		}
+		break;
+	case NETDEV_DOWN:
+		list_for_each_entry(iface, &iface_list, entry) {
+			if (!strcmp(iface->name, netdev->name) &&
+			    iface->state == IFACE_STATE_CONFIGURED) {
+				tcp_stop_kthread(iface->ksmbd_kthread);
+				iface->ksmbd_kthread = NULL;
+				mutex_lock(&iface->sock_release_lock);
+				tcp_destroy_socket(iface->ksmbd_socket);
+				iface->ksmbd_socket = NULL;
+				mutex_unlock(&iface->sock_release_lock);
+
+				iface->state = IFACE_STATE_DOWN;
+				break;
+			}
+		}
+		break;
+	}
+
+	return NOTIFY_DONE;
+}
+
+static struct notifier_block ksmbd_netdev_notifier = {
+	.notifier_call = ksmbd_netdev_event,
+};
+
+int ksmbd_tcp_init(void)
+{
+	register_netdevice_notifier(&ksmbd_netdev_notifier);
+
+	return 0;
+}
+
+static void tcp_stop_kthread(struct task_struct *kthread)
+{
+	int ret;
+
+	if (!kthread)
+		return;
+
+	ret = kthread_stop(kthread);
+	if (ret)
+		ksmbd_err("failed to stop forker thread\n");
+}
+
+void ksmbd_tcp_destroy(void)
+{
+	struct interface *iface, *tmp;
+
+	unregister_netdevice_notifier(&ksmbd_netdev_notifier);
+
+	list_for_each_entry_safe(iface, tmp, &iface_list, entry) {
+		list_del(&iface->entry);
+		kfree(iface->name);
+		kfree(iface);
+	}
+}
+
+static struct interface *alloc_iface(char *ifname)
+{
+	struct interface *iface;
+
+	if (!ifname)
+		return NULL;
+
+	iface = kzalloc(sizeof(struct interface), GFP_KERNEL);
+	if (!iface) {
+		kfree(ifname);
+		return NULL;
+	}
+
+	iface->name = ifname;
+	iface->state = IFACE_STATE_DOWN;
+	list_add(&iface->entry, &iface_list);
+	mutex_init(&iface->sock_release_lock);
+	return iface;
+}
+
+int ksmbd_tcp_set_interfaces(char *ifc_list, int ifc_list_sz)
+{
+	int sz = 0;
+
+	if (!ifc_list_sz) {
+		struct net_device *netdev;
+
+		rtnl_lock();
+		for_each_netdev(&init_net, netdev) {
+			if (netdev->priv_flags & IFF_BRIDGE_PORT)
+				continue;
+			if (!alloc_iface(kstrdup(netdev->name, GFP_KERNEL)))
+				return -ENOMEM;
+		}
+		rtnl_unlock();
+		bind_additional_ifaces = 1;
+		return 0;
+	}
+
+	while (ifc_list_sz > 0) {
+		if (!alloc_iface(kstrdup(ifc_list, GFP_KERNEL)))
+			return -ENOMEM;
+
+		sz = strlen(ifc_list);
+		if (!sz)
+			break;
+
+		ifc_list += sz + 1;
+		ifc_list_sz -= (sz + 1);
+	}
+
+	bind_additional_ifaces = 0;
+
+	return 0;
+}
+
+static struct ksmbd_transport_ops ksmbd_tcp_transport_ops = {
+	.read		= ksmbd_tcp_read,
+	.writev		= ksmbd_tcp_writev,
+	.disconnect	= ksmbd_tcp_disconnect,
+};
diff -Nruw linux-5.4.60-fbx/fs/cifsd./transport_tcp.h linux-5.4.60-fbx/fs/cifsd/transport_tcp.h
--- linux-5.4.60-fbx/fs/cifsd./transport_tcp.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/transport_tcp.h	2021-03-30 15:48:29.605052529 +0200
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __KSMBD_TRANSPORT_TCP_H__
+#define __KSMBD_TRANSPORT_TCP_H__
+
+int ksmbd_tcp_set_interfaces(char *ifc_list, int ifc_list_sz);
+int ksmbd_tcp_init(void);
+void ksmbd_tcp_destroy(void);
+
+#endif /* __KSMBD_TRANSPORT_TCP_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./unicode.c linux-5.4.60-fbx/fs/cifsd/unicode.c
--- linux-5.4.60-fbx/fs/cifsd./unicode.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/unicode.c	2021-04-21 09:44:50.981838485 +0200
@@ -0,0 +1,401 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Some of the source code in this file came from fs/cifs/cifs_unicode.c
+ *
+ *   Copyright (c) International Business Machines  Corp., 2000,2009
+ *   Modified by Steve French (sfrench@us.ibm.com)
+ *   Modified by Namjae Jeon (linkinjeon@kernel.org)
+ */
+#include <linux/fs.h>
+#include <linux/slab.h>
+#include <asm/unaligned.h>
+#include "glob.h"
+#include "unicode.h"
+#include "uniupr.h"
+#include "smb_common.h"
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+int smb1_utf16_name_length(const __le16 *from, int maxbytes)
+{
+	int i, len = 0;
+	int maxwords = maxbytes / 2;
+	__u16 ftmp;
+
+	for (i = 0; i < maxwords; i++) {
+		ftmp = get_unaligned_le16(&from[i]);
+		len += 2;
+		if (ftmp == 0)
+			break;
+	}
+
+	return len;
+}
+#endif
+
+/*
+ * smb_utf16_bytes() - how long will a string be after conversion?
+ * @from:	pointer to input string
+ * @maxbytes:	don't go past this many bytes of input string
+ * @codepage:	destination codepage
+ *
+ * Walk a utf16le string and return the number of bytes that the string will
+ * be after being converted to the given charset, not including any null
+ * termination required. Don't walk past maxbytes in the source buffer.
+ *
+ * Return:	string length after conversion
+ */
+static int smb_utf16_bytes(const __le16 *from, int maxbytes,
+		const struct nls_table *codepage)
+{
+	int i;
+	int charlen, outlen = 0;
+	int maxwords = maxbytes / 2;
+	char tmp[NLS_MAX_CHARSET_SIZE];
+	__u16 ftmp;
+
+	for (i = 0; i < maxwords; i++) {
+		ftmp = get_unaligned_le16(&from[i]);
+		if (ftmp == 0)
+			break;
+
+		charlen = codepage->uni2char(ftmp, tmp, NLS_MAX_CHARSET_SIZE);
+		if (charlen > 0)
+			outlen += charlen;
+		else
+			outlen++;
+	}
+
+	return outlen;
+}
+
+/*
+ * cifs_mapchar() - convert a host-endian char to proper char in codepage
+ * @target:	where converted character should be copied
+ * @src_char:	2 byte host-endian source character
+ * @cp:		codepage to which character should be converted
+ * @mapchar:	should character be mapped according to mapchars mount option?
+ *
+ * This function handles the conversion of a single character. It is the
+ * responsibility of the caller to ensure that the target buffer is large
+ * enough to hold the result of the conversion (at least NLS_MAX_CHARSET_SIZE).
+ *
+ * Return:	string length after conversion
+ */
+static int
+cifs_mapchar(char *target, const __u16 src_char, const struct nls_table *cp,
+		bool mapchar)
+{
+	int len = 1;
+
+	if (!mapchar)
+		goto cp_convert;
+
+	/*
+	 * BB: Cannot handle remapping UNI_SLASH until all the calls to
+	 *     build_path_from_dentry are modified, as they use slash as
+	 *     separator.
+	 */
+	switch (src_char) {
+	case UNI_COLON:
+		*target = ':';
+		break;
+	case UNI_ASTERISK:
+		*target = '*';
+		break;
+	case UNI_QUESTION:
+		*target = '?';
+		break;
+	case UNI_PIPE:
+		*target = '|';
+		break;
+	case UNI_GRTRTHAN:
+		*target = '>';
+		break;
+	case UNI_LESSTHAN:
+		*target = '<';
+		break;
+	default:
+		goto cp_convert;
+	}
+
+out:
+	return len;
+
+cp_convert:
+	len = cp->uni2char(src_char, target, NLS_MAX_CHARSET_SIZE);
+	if (len <= 0) {
+		*target = '?';
+		len = 1;
+	}
+
+	goto out;
+}
+
+/*
+ * is_char_allowed() - check for valid character
+ * @ch:		input character to be checked
+ *
+ * Return:	1 if char is allowed, otherwise 0
+ */
+static inline int is_char_allowed(char *ch)
+{
+	/* check for control chars, wildcards etc. */
+	if (!(*ch & 0x80) &&
+	    (*ch <= 0x1f ||
+	     *ch == '?' || *ch == '"' || *ch == '<' ||
+	     *ch == '>' || *ch == '|'))
+		return 0;
+
+	return 1;
+}
+
+/*
+ * smb_from_utf16() - convert utf16le string to local charset
+ * @to:		destination buffer
+ * @from:	source buffer
+ * @tolen:	destination buffer size (in bytes)
+ * @fromlen:	source buffer size (in bytes)
+ * @codepage:	codepage to which characters should be converted
+ * @mapchar:	should characters be remapped according to the mapchars option?
+ *
+ * Convert a little-endian utf16le string (as sent by the server) to a string
+ * in the provided codepage. The tolen and fromlen parameters are to ensure
+ * that the code doesn't walk off of the end of the buffer (which is always
+ * a danger if the alignment of the source buffer is off). The destination
+ * string is always properly null terminated and fits in the destination
+ * buffer. Returns the length of the destination string in bytes (including
+ * null terminator).
+ *
+ * Note that some windows versions actually send multiword UTF-16 characters
+ * instead of straight UTF16-2. The linux nls routines however aren't able to
+ * deal with those characters properly. In the event that we get some of
+ * those characters, they won't be translated properly.
+ *
+ * Return:	string length after conversion
+ */
+static int smb_from_utf16(char *to, const __le16 *from, int tolen, int fromlen,
+		const struct nls_table *codepage, bool mapchar)
+{
+	int i, charlen, safelen;
+	int outlen = 0;
+	int nullsize = nls_nullsize(codepage);
+	int fromwords = fromlen / 2;
+	char tmp[NLS_MAX_CHARSET_SIZE];
+	__u16 ftmp;
+
+	/*
+	 * because the chars can be of varying widths, we need to take care
+	 * not to overflow the destination buffer when we get close to the
+	 * end of it. Until we get to this offset, we don't need to check
+	 * for overflow however.
+	 */
+	safelen = tolen - (NLS_MAX_CHARSET_SIZE + nullsize);
+
+	for (i = 0; i < fromwords; i++) {
+		ftmp = get_unaligned_le16(&from[i]);
+		if (ftmp == 0)
+			break;
+
+		/*
+		 * check to see if converting this character might make the
+		 * conversion bleed into the null terminator
+		 */
+		if (outlen >= safelen) {
+			charlen = cifs_mapchar(tmp, ftmp, codepage, mapchar);
+			if ((outlen + charlen) > (tolen - nullsize))
+				break;
+		}
+
+		/* put converted char into 'to' buffer */
+		charlen = cifs_mapchar(&to[outlen], ftmp, codepage, mapchar);
+		outlen += charlen;
+	}
+
+	/* properly null-terminate string */
+	for (i = 0; i < nullsize; i++)
+		to[outlen++] = 0;
+
+	return outlen;
+}
+
+/*
+ * smb_strtoUTF16() - Convert character string to unicode string
+ * @to:		destination buffer
+ * @from:	source buffer
+ * @len:	destination buffer size (in bytes)
+ * @codepage:	codepage to which characters should be converted
+ *
+ * Return:	string length after conversion
+ */
+int smb_strtoUTF16(__le16 *to, const char *from, int len,
+	      const struct nls_table *codepage)
+{
+	int charlen;
+	int i;
+	wchar_t wchar_to; /* needed to quiet sparse */
+
+	/* special case for utf8 to handle no plane0 chars */
+	if (!strcmp(codepage->charset, "utf8")) {
+		/*
+		 * convert utf8 -> utf16, we assume we have enough space
+		 * as caller should have assumed conversion does not overflow
+		 * in destination len is length in wchar_t units (16bits)
+		 */
+		i  = utf8s_to_utf16s(from, len, UTF16_LITTLE_ENDIAN,
+				       (wchar_t *)to, len);
+
+		/* if success terminate and exit */
+		if (i >= 0)
+			goto success;
+		/*
+		 * if fails fall back to UCS encoding as this
+		 * function should not return negative values
+		 * currently can fail only if source contains
+		 * invalid encoded characters
+		 */
+	}
+
+	for (i = 0; len > 0 && *from; i++, from += charlen, len -= charlen) {
+		charlen = codepage->char2uni(from, len, &wchar_to);
+		if (charlen < 1) {
+			/* A question mark */
+			wchar_to = 0x003f;
+			charlen = 1;
+		}
+		put_unaligned_le16(wchar_to, &to[i]);
+	}
+
+success:
+	put_unaligned_le16(0, &to[i]);
+	return i;
+}
+
+/*
+ * smb_strndup_from_utf16() - copy a string from wire format to the local
+ *		codepage
+ * @src:	source string
+ * @maxlen:	don't walk past this many bytes in the source string
+ * @is_unicode:	is this a unicode string?
+ * @codepage:	destination codepage
+ *
+ * Take a string given by the server, convert it to the local codepage and
+ * put it in a new buffer. Returns a pointer to the new string or NULL on
+ * error.
+ *
+ * Return:	destination string buffer or error ptr
+ */
+char *smb_strndup_from_utf16(const char *src, const int maxlen,
+		const bool is_unicode, const struct nls_table *codepage)
+{
+	int len, ret;
+	char *dst;
+
+	if (is_unicode) {
+		len = smb_utf16_bytes((__le16 *)src, maxlen, codepage);
+		len += nls_nullsize(codepage);
+		dst = kmalloc(len, GFP_KERNEL);
+		if (!dst)
+			return ERR_PTR(-ENOMEM);
+		ret = smb_from_utf16(dst, (__le16 *)src, len, maxlen, codepage,
+			       false);
+		if (ret < 0) {
+			kfree(dst);
+			return ERR_PTR(-EINVAL);
+		}
+	} else {
+		len = strnlen(src, maxlen);
+		len++;
+		dst = kmalloc(len, GFP_KERNEL);
+		if (!dst)
+			return ERR_PTR(-ENOMEM);
+		strscpy(dst, src, len);
+	}
+
+	return dst;
+}
+
+/*
+ * Convert 16 bit Unicode pathname to wire format from string in current code
+ * page. Conversion may involve remapping up the six characters that are
+ * only legal in POSIX-like OS (if they are present in the string). Path
+ * names are little endian 16 bit Unicode on the wire
+ */
+/*
+ * smbConvertToUTF16() - convert string from local charset to utf16
+ * @target:	destination buffer
+ * @source:	source buffer
+ * @srclen:	source buffer size (in bytes)
+ * @cp:		codepage to which characters should be converted
+ * @mapchar:	should characters be remapped according to the mapchars option?
+ *
+ * Convert 16 bit Unicode pathname to wire format from string in current code
+ * page. Conversion may involve remapping up the six characters that are
+ * only legal in POSIX-like OS (if they are present in the string). Path
+ * names are little endian 16 bit Unicode on the wire
+ *
+ * Return:	char length after conversion
+ */
+int smbConvertToUTF16(__le16 *target, const char *source, int srclen,
+		const struct nls_table *cp, int mapchars)
+{
+	int i, j, charlen;
+	char src_char;
+	__le16 dst_char;
+	wchar_t tmp;
+
+	if (!mapchars)
+		return smb_strtoUTF16(target, source, srclen, cp);
+
+	for (i = 0, j = 0; i < srclen; j++) {
+		src_char = source[i];
+		charlen = 1;
+		switch (src_char) {
+		case 0:
+			put_unaligned(0, &target[j]);
+			return j;
+		case ':':
+			dst_char = cpu_to_le16(UNI_COLON);
+			break;
+		case '*':
+			dst_char = cpu_to_le16(UNI_ASTERISK);
+			break;
+		case '?':
+			dst_char = cpu_to_le16(UNI_QUESTION);
+			break;
+		case '<':
+			dst_char = cpu_to_le16(UNI_LESSTHAN);
+			break;
+		case '>':
+			dst_char = cpu_to_le16(UNI_GRTRTHAN);
+			break;
+		case '|':
+			dst_char = cpu_to_le16(UNI_PIPE);
+			break;
+		/*
+		 * FIXME: We can not handle remapping backslash (UNI_SLASH)
+		 * until all the calls to build_path_from_dentry are modified,
+		 * as they use backslash as separator.
+		 */
+		default:
+			charlen = cp->char2uni(source + i, srclen - i, &tmp);
+			dst_char = cpu_to_le16(tmp);
+
+			/*
+			 * if no match, use question mark, which at least in
+			 * some cases serves as wild card
+			 */
+			if (charlen < 1) {
+				dst_char = cpu_to_le16(0x003f);
+				charlen = 1;
+			}
+		}
+		/*
+		 * character may take more than one byte in the source string,
+		 * but will take exactly two bytes in the target string
+		 */
+		i += charlen;
+		put_unaligned(dst_char, &target[j]);
+	}
+
+	return j;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./unicode.h linux-5.4.60-fbx/fs/cifsd/unicode.h
--- linux-5.4.60-fbx/fs/cifsd./unicode.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/unicode.h	2021-04-21 09:44:50.981838485 +0200
@@ -0,0 +1,359 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Some of the source code in this file came from fs/cifs/cifs_unicode.c
+ * cifs_unicode:  Unicode kernel case support
+ *
+ * Function:
+ *     Convert a unicode character to upper or lower case using
+ *     compressed tables.
+ *
+ *   Copyright (c) International Business Machines  Corp., 2000,2009
+ *
+ *
+ * Notes:
+ *     These APIs are based on the C library functions.  The semantics
+ *     should match the C functions but with expanded size operands.
+ *
+ *     The upper/lower functions are based on a table created by mkupr.
+ *     This is a compressed table of upper and lower case conversion.
+ *
+ */
+#ifndef _CIFS_UNICODE_H
+#define _CIFS_UNICODE_H
+
+#include <asm/byteorder.h>
+#include <linux/types.h>
+#include <linux/nls.h>
+
+#define  UNIUPR_NOLOWER		/* Example to not expand lower case tables */
+
+/*
+ * Windows maps these to the user defined 16 bit Unicode range since they are
+ * reserved symbols (along with \ and /), otherwise illegal to store
+ * in filenames in NTFS
+ */
+#define UNI_ASTERISK    ((__u16)('*' + 0xF000))
+#define UNI_QUESTION    ((__u16)('?' + 0xF000))
+#define UNI_COLON       ((__u16)(':' + 0xF000))
+#define UNI_GRTRTHAN    ((__u16)('>' + 0xF000))
+#define UNI_LESSTHAN    ((__u16)('<' + 0xF000))
+#define UNI_PIPE        ((__u16)('|' + 0xF000))
+#define UNI_SLASH       ((__u16)('\\' + 0xF000))
+
+/* Just define what we want from uniupr.h.  We don't want to define the tables
+ * in each source file.
+ */
+#ifndef	UNICASERANGE_DEFINED
+struct UniCaseRange {
+	wchar_t start;
+	wchar_t end;
+	signed char *table;
+};
+#endif				/* UNICASERANGE_DEFINED */
+
+#ifndef UNIUPR_NOUPPER
+extern signed char SmbUniUpperTable[512];
+extern const struct UniCaseRange SmbUniUpperRange[];
+#endif				/* UNIUPR_NOUPPER */
+
+#ifndef UNIUPR_NOLOWER
+extern signed char CifsUniLowerTable[512];
+extern const struct UniCaseRange CifsUniLowerRange[];
+#endif				/* UNIUPR_NOLOWER */
+
+#ifdef __KERNEL__
+#ifdef CONFIG_SMB_INSECURE_SERVER
+int smb1_utf16_name_length(const __le16 *from, int maxbytes);
+#endif
+int smb_strtoUTF16(__le16 *to, const char *from, int len,
+		const struct nls_table *codepage);
+char *smb_strndup_from_utf16(const char *src, const int maxlen,
+		const bool is_unicode, const struct nls_table *codepage);
+int smbConvertToUTF16(__le16 *target, const char *source, int srclen,
+		const struct nls_table *cp, int mapchars);
+char *ksmbd_extract_sharename(char *treename);
+#endif
+
+/*
+ * UniStrcat:  Concatenate the second string to the first
+ *
+ * Returns:
+ *     Address of the first string
+ */
+static inline wchar_t *UniStrcat(wchar_t *ucs1, const wchar_t *ucs2)
+{
+	wchar_t *anchor = ucs1;	/* save a pointer to start of ucs1 */
+
+	while (*ucs1++)
+	/*NULL*/;	/* To end of first string */
+	ucs1--;			/* Return to the null */
+	while ((*ucs1++ = *ucs2++))
+	/*NULL*/;	/* copy string 2 over */
+	return anchor;
+}
+
+/*
+ * UniStrchr:  Find a character in a string
+ *
+ * Returns:
+ *     Address of first occurrence of character in string
+ *     or NULL if the character is not in the string
+ */
+static inline wchar_t *UniStrchr(const wchar_t *ucs, wchar_t uc)
+{
+	while ((*ucs != uc) && *ucs)
+		ucs++;
+
+	if (*ucs == uc)
+		return (wchar_t *)ucs;
+	return NULL;
+}
+
+/*
+ * UniStrcmp:  Compare two strings
+ *
+ * Returns:
+ *     < 0:  First string is less than second
+ *     = 0:  Strings are equal
+ *     > 0:  First string is greater than second
+ */
+static inline int UniStrcmp(const wchar_t *ucs1, const wchar_t *ucs2)
+{
+	while ((*ucs1 == *ucs2) && *ucs1) {
+		ucs1++;
+		ucs2++;
+	}
+	return (int)*ucs1 - (int)*ucs2;
+}
+
+/*
+ * UniStrcpy:  Copy a string
+ */
+static inline wchar_t *UniStrcpy(wchar_t *ucs1, const wchar_t *ucs2)
+{
+	wchar_t *anchor = ucs1;	/* save the start of result string */
+
+	while ((*ucs1++ = *ucs2++))
+	/*NULL*/;
+	return anchor;
+}
+
+/*
+ * UniStrlen:  Return the length of a string (in 16 bit Unicode chars not bytes)
+ */
+static inline size_t UniStrlen(const wchar_t *ucs1)
+{
+	int i = 0;
+
+	while (*ucs1++)
+		i++;
+	return i;
+}
+
+/*
+ * UniStrnlen:  Return the length (in 16 bit Unicode chars not bytes) of a
+ *		string (length limited)
+ */
+static inline size_t UniStrnlen(const wchar_t *ucs1, int maxlen)
+{
+	int i = 0;
+
+	while (*ucs1++) {
+		i++;
+		if (i >= maxlen)
+			break;
+	}
+	return i;
+}
+
+/*
+ * UniStrncat:  Concatenate length limited string
+ */
+static inline wchar_t *UniStrncat(wchar_t *ucs1, const wchar_t *ucs2, size_t n)
+{
+	wchar_t *anchor = ucs1;	/* save pointer to string 1 */
+
+	while (*ucs1++)
+	/*NULL*/;
+	ucs1--;			/* point to null terminator of s1 */
+	while (n-- && (*ucs1 = *ucs2)) {	/* copy s2 after s1 */
+		ucs1++;
+		ucs2++;
+	}
+	*ucs1 = 0;		/* Null terminate the result */
+	return anchor;
+}
+
+/*
+ * UniStrncmp:  Compare length limited string
+ */
+static inline int UniStrncmp(const wchar_t *ucs1, const wchar_t *ucs2, size_t n)
+{
+	if (!n)
+		return 0;	/* Null strings are equal */
+	while ((*ucs1 == *ucs2) && *ucs1 && --n) {
+		ucs1++;
+		ucs2++;
+	}
+	return (int)*ucs1 - (int)*ucs2;
+}
+
+/*
+ * UniStrncmp_le:  Compare length limited string - native to little-endian
+ */
+	static inline int
+UniStrncmp_le(const wchar_t *ucs1, const wchar_t *ucs2, size_t n)
+{
+	if (!n)
+		return 0;	/* Null strings are equal */
+	while ((*ucs1 == __le16_to_cpu(*ucs2)) && *ucs1 && --n) {
+		ucs1++;
+		ucs2++;
+	}
+	return (int)*ucs1 - (int)__le16_to_cpu(*ucs2);
+}
+
+/*
+ * UniStrncpy:  Copy length limited string with pad
+ */
+static inline wchar_t *UniStrncpy(wchar_t *ucs1, const wchar_t *ucs2, size_t n)
+{
+	wchar_t *anchor = ucs1;
+
+	while (n-- && *ucs2)	/* Copy the strings */
+		*ucs1++ = *ucs2++;
+
+	n++;
+	while (n--)		/* Pad with nulls */
+		*ucs1++ = 0;
+	return anchor;
+}
+
+/*
+ * UniStrncpy_le:  Copy length limited string with pad to little-endian
+ */
+static inline wchar_t *UniStrncpy_le(wchar_t *ucs1, const wchar_t *ucs2, size_t n)
+{
+	wchar_t *anchor = ucs1;
+
+	while (n-- && *ucs2)	/* Copy the strings */
+		*ucs1++ = __le16_to_cpu(*ucs2++);
+
+	n++;
+	while (n--)		/* Pad with nulls */
+		*ucs1++ = 0;
+	return anchor;
+}
+
+/*
+ * UniStrstr:  Find a string in a string
+ *
+ * Returns:
+ *     Address of first match found
+ *     NULL if no matching string is found
+ */
+static inline wchar_t *UniStrstr(const wchar_t *ucs1, const wchar_t *ucs2)
+{
+	const wchar_t *anchor1 = ucs1;
+	const wchar_t *anchor2 = ucs2;
+
+	while (*ucs1) {
+		if (*ucs1 == *ucs2) {
+			/* Partial match found */
+			ucs1++;
+			ucs2++;
+		} else {
+			if (!*ucs2)	/* Match found */
+				return (wchar_t *)anchor1;
+			ucs1 = ++anchor1;	/* No match */
+			ucs2 = anchor2;
+		}
+	}
+
+	if (!*ucs2)		/* Both end together */
+		return (wchar_t *)anchor1;	/* Match found */
+	return NULL;		/* No match */
+}
+
+#ifndef UNIUPR_NOUPPER
+/*
+ * UniToupper:  Convert a unicode character to upper case
+ */
+static inline wchar_t UniToupper(register wchar_t uc)
+{
+	register const struct UniCaseRange *rp;
+
+	if (uc < sizeof(SmbUniUpperTable)) {
+		/* Latin characters */
+		return uc + SmbUniUpperTable[uc];	/* Use base tables */
+	}
+
+	rp = SmbUniUpperRange;	/* Use range tables */
+	while (rp->start) {
+		if (uc < rp->start)	/* Before start of range */
+			return uc;	/* Uppercase = input */
+		if (uc <= rp->end)	/* In range */
+			return uc + rp->table[uc - rp->start];
+		rp++;	/* Try next range */
+	}
+	return uc;		/* Past last range */
+}
+
+/*
+ * UniStrupr:  Upper case a unicode string
+ */
+static inline __le16 *UniStrupr(register __le16 *upin)
+{
+	register __le16 *up;
+
+	up = upin;
+	while (*up) {		/* For all characters */
+		*up = cpu_to_le16(UniToupper(le16_to_cpu(*up)));
+		up++;
+	}
+	return upin;		/* Return input pointer */
+}
+#endif				/* UNIUPR_NOUPPER */
+
+#ifndef UNIUPR_NOLOWER
+/*
+ * UniTolower:  Convert a unicode character to lower case
+ */
+static inline wchar_t UniTolower(register wchar_t uc)
+{
+	register const struct UniCaseRange *rp;
+
+	if (uc < sizeof(CifsUniLowerTable)) {
+		/* Latin characters */
+		return uc + CifsUniLowerTable[uc];	/* Use base tables */
+	}
+
+	rp = CifsUniLowerRange;	/* Use range tables */
+	while (rp->start) {
+		if (uc < rp->start)	/* Before start of range */
+			return uc;	/* Uppercase = input */
+		if (uc <= rp->end)	/* In range */
+			return uc + rp->table[uc - rp->start];
+		rp++;	/* Try next range */
+	}
+	return uc;		/* Past last range */
+}
+
+/*
+ * UniStrlwr:  Lower case a unicode string
+ */
+static inline wchar_t *UniStrlwr(register wchar_t *upin)
+{
+	register wchar_t *up;
+
+	up = upin;
+	while (*up) {		/* For all characters */
+		*up = UniTolower(*up);
+		up++;
+	}
+	return upin;		/* Return input pointer */
+}
+
+#endif
+
+#endif /* _CIFS_UNICODE_H */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./uniupr.h linux-5.4.60-fbx/fs/cifsd/uniupr.h
--- linux-5.4.60-fbx/fs/cifsd./uniupr.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/uniupr.h	2021-03-30 15:48:29.605052529 +0200
@@ -0,0 +1,268 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Some of the source code in this file came from fs/cifs/uniupr.h
+ *   Copyright (c) International Business Machines  Corp., 2000,2002
+ *
+ * uniupr.h - Unicode compressed case ranges
+ *
+ */
+#ifndef __KSMBD_UNIUPR_H
+#define __KSMBD_UNIUPR_H
+
+#ifndef UNIUPR_NOUPPER
+/*
+ * Latin upper case
+ */
+signed char SmbUniUpperTable[512] = {
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 000-00f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 010-01f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 020-02f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 030-03f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 040-04f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 050-05f */
+	0, -32, -32, -32, -32, -32, -32, -32, -32, -32, -32,
+				-32, -32, -32, -32, -32,	/* 060-06f */
+	-32, -32, -32, -32, -32, -32, -32, -32, -32, -32,
+				-32, 0, 0, 0, 0, 0,	/* 070-07f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 080-08f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 090-09f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 0a0-0af */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 0b0-0bf */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 0c0-0cf */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 0d0-0df */
+	-32, -32, -32, -32, -32, -32, -32, -32, -32, -32,
+			 -32, -32, -32, -32, -32, -32,	/* 0e0-0ef */
+	-32, -32, -32, -32, -32, -32, -32, 0, -32, -32,
+			 -32, -32, -32, -32, -32, 121,	/* 0f0-0ff */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 100-10f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 110-11f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 120-12f */
+	0, 0, 0, -1, 0, -1, 0, -1, 0, 0, -1, 0, -1, 0, -1, 0,	/* 130-13f */
+	-1, 0, -1, 0, -1, 0, -1, 0, -1, 0, 0, -1, 0, -1, 0, -1,	/* 140-14f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 150-15f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 160-16f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, 0, -1, 0, -1, 0, -1, 0,	/* 170-17f */
+	0, 0, 0, -1, 0, -1, 0, 0, -1, 0, 0, 0, -1, 0, 0, 0,	/* 180-18f */
+	0, 0, -1, 0, 0, 0, 0, 0, 0, -1, 0, 0, 0, 0, 0, 0,	/* 190-19f */
+	0, -1, 0, -1, 0, -1, 0, 0, -1, 0, 0, 0, 0, -1, 0, 0,	/* 1a0-1af */
+	-1, 0, 0, 0, -1, 0, -1, 0, 0, -1, 0, 0, 0, -1, 0, 0,	/* 1b0-1bf */
+	0, 0, 0, 0, 0, -1, -2, 0, -1, -2, 0, -1, -2, 0, -1, 0,	/* 1c0-1cf */
+	-1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, -79, 0, -1, /* 1d0-1df */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1e0-1ef */
+	0, 0, -1, -2, 0, -1, 0, 0, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1f0-1ff */
+};
+
+/* Upper case range - Greek */
+static signed char UniCaseRangeU03a0[47] = {
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -38, -37, -37, -37,	/* 3a0-3af */
+	0, -32, -32, -32, -32, -32, -32, -32, -32, -32, -32, -32,
+					 -32, -32, -32, -32,	/* 3b0-3bf */
+	-32, -32, -31, -32, -32, -32, -32, -32, -32, -32, -32, -32, -64,
+	-63, -63,
+};
+
+/* Upper case range - Cyrillic */
+static signed char UniCaseRangeU0430[48] = {
+	-32, -32, -32, -32, -32, -32, -32, -32, -32, -32, -32, -32,
+					 -32, -32, -32, -32,	/* 430-43f */
+	-32, -32, -32, -32, -32, -32, -32, -32, -32, -32, -32, -32,
+					 -32, -32, -32, -32,	/* 440-44f */
+	0, -80, -80, -80, -80, -80, -80, -80, -80, -80, -80,
+					 -80, -80, 0, -80, -80,	/* 450-45f */
+};
+
+/* Upper case range - Extended cyrillic */
+static signed char UniCaseRangeU0490[61] = {
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 490-49f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 4a0-4af */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 4b0-4bf */
+	0, 0, -1, 0, -1, 0, 0, 0, -1, 0, 0, 0, -1,
+};
+
+/* Upper case range - Extended latin and greek */
+static signed char UniCaseRangeU1e00[509] = {
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1e00-1e0f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1e10-1e1f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1e20-1e2f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1e30-1e3f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1e40-1e4f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1e50-1e5f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1e60-1e6f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1e70-1e7f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1e80-1e8f */
+	0, -1, 0, -1, 0, -1, 0, 0, 0, 0, 0, -59, 0, -1, 0, -1,	/* 1e90-1e9f */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1ea0-1eaf */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1eb0-1ebf */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1ec0-1ecf */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1ed0-1edf */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, -1,	/* 1ee0-1eef */
+	0, -1, 0, -1, 0, -1, 0, -1, 0, -1, 0, 0, 0, 0, 0, 0,	/* 1ef0-1eff */
+	8, 8, 8, 8, 8, 8, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1f00-1f0f */
+	8, 8, 8, 8, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1f10-1f1f */
+	8, 8, 8, 8, 8, 8, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1f20-1f2f */
+	8, 8, 8, 8, 8, 8, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1f30-1f3f */
+	8, 8, 8, 8, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1f40-1f4f */
+	0, 8, 0, 8, 0, 8, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1f50-1f5f */
+	8, 8, 8, 8, 8, 8, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1f60-1f6f */
+	74, 74, 86, 86, 86, 86, 100, 100, 0, 0, 112, 112,
+				 126, 126, 0, 0,	/* 1f70-1f7f */
+	8, 8, 8, 8, 8, 8, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1f80-1f8f */
+	8, 8, 8, 8, 8, 8, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1f90-1f9f */
+	8, 8, 8, 8, 8, 8, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1fa0-1faf */
+	8, 8, 0, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1fb0-1fbf */
+	0, 0, 0, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1fc0-1fcf */
+	8, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1fd0-1fdf */
+	8, 8, 0, 0, 0, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1fe0-1fef */
+	0, 0, 0, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+};
+
+/* Upper case range - Wide latin */
+static signed char UniCaseRangeUff40[27] = {
+	0, -32, -32, -32, -32, -32, -32, -32, -32, -32, -32,
+			 -32, -32, -32, -32, -32,	/* ff40-ff4f */
+	-32, -32, -32, -32, -32, -32, -32, -32, -32, -32, -32,
+};
+
+/*
+ * Upper Case Range
+ */
+const struct UniCaseRange SmbUniUpperRange[] = {
+	{0x03a0, 0x03ce, UniCaseRangeU03a0},
+	{0x0430, 0x045f, UniCaseRangeU0430},
+	{0x0490, 0x04cc, UniCaseRangeU0490},
+	{0x1e00, 0x1ffc, UniCaseRangeU1e00},
+	{0xff40, 0xff5a, UniCaseRangeUff40},
+	{0}
+};
+#endif
+
+#ifndef UNIUPR_NOLOWER
+/*
+ * Latin lower case
+ */
+signed char CifsUniLowerTable[512] = {
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 000-00f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 010-01f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 020-02f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 030-03f */
+	0, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
+					 32, 32, 32,	/* 040-04f */
+	32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 0, 0,
+					 0, 0, 0,	/* 050-05f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 060-06f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 070-07f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 080-08f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 090-09f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 0a0-0af */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 0b0-0bf */
+	32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
+				 32, 32, 32, 32,	/* 0c0-0cf */
+	32, 32, 32, 32, 32, 32, 32, 0, 32, 32, 32, 32,
+					 32, 32, 32, 0,	/* 0d0-0df */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 0e0-0ef */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 0f0-0ff */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 100-10f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 110-11f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 120-12f */
+	0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1,	/* 130-13f */
+	0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0,	/* 140-14f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 150-15f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 160-16f */
+	1, 0, 1, 0, 1, 0, 1, 0, -121, 1, 0, 1, 0, 1, 0,
+						 0,	/* 170-17f */
+	0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 79,
+						 0,	/* 180-18f */
+	0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0,	/* 190-19f */
+	1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1,	/* 1a0-1af */
+	0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0,	/* 1b0-1bf */
+	0, 0, 0, 0, 2, 1, 0, 2, 1, 0, 2, 1, 0, 1, 0, 1,	/* 1c0-1cf */
+	0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0,	/* 1d0-1df */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1e0-1ef */
+	0, 2, 1, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1f0-1ff */
+};
+
+/* Lower case range - Greek */
+static signed char UniCaseRangeL0380[44] = {
+	0, 0, 0, 0, 0, 0, 38, 0, 37, 37, 37, 0, 64, 0, 63, 63,	/* 380-38f */
+	0, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
+						 32, 32, 32,	/* 390-39f */
+	32, 32, 0, 32, 32, 32, 32, 32, 32, 32, 32, 32,
+};
+
+/* Lower case range - Cyrillic */
+static signed char UniCaseRangeL0400[48] = {
+	0, 80, 80, 80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
+					 0, 80, 80,	/* 400-40f */
+	32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
+					 32, 32, 32,	/* 410-41f */
+	32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
+					 32, 32, 32,	/* 420-42f */
+};
+
+/* Lower case range - Extended cyrillic */
+static signed char UniCaseRangeL0490[60] = {
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 490-49f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 4a0-4af */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 4b0-4bf */
+	0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1,
+};
+
+/* Lower case range - Extended latin and greek */
+static signed char UniCaseRangeL1e00[504] = {
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1e00-1e0f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1e10-1e1f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1e20-1e2f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1e30-1e3f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1e40-1e4f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1e50-1e5f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1e60-1e6f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1e70-1e7f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1e80-1e8f */
+	1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0,	/* 1e90-1e9f */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1ea0-1eaf */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1eb0-1ebf */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1ec0-1ecf */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1ed0-1edf */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0,	/* 1ee0-1eef */
+	1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0,	/* 1ef0-1eff */
+	0, 0, 0, 0, 0, 0, 0, 0, -8, -8, -8, -8, -8, -8, -8, -8,	/* 1f00-1f0f */
+	0, 0, 0, 0, 0, 0, 0, 0, -8, -8, -8, -8, -8, -8, 0, 0,	/* 1f10-1f1f */
+	0, 0, 0, 0, 0, 0, 0, 0, -8, -8, -8, -8, -8, -8, -8, -8,	/* 1f20-1f2f */
+	0, 0, 0, 0, 0, 0, 0, 0, -8, -8, -8, -8, -8, -8, -8, -8,	/* 1f30-1f3f */
+	0, 0, 0, 0, 0, 0, 0, 0, -8, -8, -8, -8, -8, -8, 0, 0,	/* 1f40-1f4f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, -8, 0, -8, 0, -8, 0, -8,	/* 1f50-1f5f */
+	0, 0, 0, 0, 0, 0, 0, 0, -8, -8, -8, -8, -8, -8, -8, -8,	/* 1f60-1f6f */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,	/* 1f70-1f7f */
+	0, 0, 0, 0, 0, 0, 0, 0, -8, -8, -8, -8, -8, -8, -8, -8,	/* 1f80-1f8f */
+	0, 0, 0, 0, 0, 0, 0, 0, -8, -8, -8, -8, -8, -8, -8, -8,	/* 1f90-1f9f */
+	0, 0, 0, 0, 0, 0, 0, 0, -8, -8, -8, -8, -8, -8, -8, -8,	/* 1fa0-1faf */
+	0, 0, 0, 0, 0, 0, 0, 0, -8, -8, -74, -74, -9, 0, 0, 0,	/* 1fb0-1fbf */
+	0, 0, 0, 0, 0, 0, 0, 0, -86, -86, -86, -86, -9, 0,
+							 0, 0,	/* 1fc0-1fcf */
+	0, 0, 0, 0, 0, 0, 0, 0, -8, -8, -100, -100, 0, 0, 0, 0,	/* 1fd0-1fdf */
+	0, 0, 0, 0, 0, 0, 0, 0, -8, -8, -112, -112, -7, 0,
+							 0, 0,	/* 1fe0-1fef */
+	0, 0, 0, 0, 0, 0, 0, 0,
+};
+
+/* Lower case range - Wide latin */
+static signed char UniCaseRangeLff20[27] = {
+	0, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
+							 32,	/* ff20-ff2f */
+	32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32,
+};
+
+/*
+ * Lower Case Range
+ */
+const struct UniCaseRange CifsUniLowerRange[] = {
+	{0x0380, 0x03ab, UniCaseRangeL0380},
+	{0x0400, 0x042f, UniCaseRangeL0400},
+	{0x0490, 0x04cb, UniCaseRangeL0490},
+	{0x1e00, 0x1ff7, UniCaseRangeL1e00},
+	{0xff20, 0xff3a, UniCaseRangeLff20},
+	{0}
+};
+#endif
+
+#endif /* __KSMBD_UNIUPR_H */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./vfs.c linux-5.4.60-fbx/fs/cifsd/vfs.c
--- linux-5.4.60-fbx/fs/cifsd./vfs.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/vfs.c	2021-04-21 10:06:25.188514159 +0200
@@ -0,0 +1,2503 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/kernel.h>
+#include <linux/fs.h>
+#include <linux/uaccess.h>
+#include <linux/backing-dev.h>
+#include <linux/writeback.h>
+#include <linux/version.h>
+#include <linux/xattr.h>
+#include <linux/falloc.h>
+#include <linux/genhd.h>
+#include <linux/blkdev.h>
+#include <linux/fsnotify.h>
+#include <linux/dcache.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/crc32c.h>
+#include <linux/sched/xacct.h>
+
+#include "glob.h"
+#include "oplock.h"
+#include "connection.h"
+#include "buffer_pool.h"
+#include "vfs.h"
+#include "vfs_cache.h"
+#include "smbacl.h"
+#include "ndr.h"
+#include "auth.h"
+#include "misc.h"
+
+#include "smb_common.h"
+#include "mgmt/share_config.h"
+#include "mgmt/tree_connect.h"
+#include "mgmt/user_session.h"
+#include "mgmt/user_config.h"
+
+static char *extract_last_component(char *path)
+{
+	char *p = strrchr(path, '/');
+
+	if (p && p[1] != '\0') {
+		*p = '\0';
+		p++;
+	} else {
+		p = NULL;
+		ksmbd_err("Invalid path %s\n", path);
+	}
+	return p;
+}
+
+static void ksmbd_vfs_inherit_owner(struct ksmbd_work *work,
+		struct inode *parent_inode, struct inode *inode)
+{
+	if (!test_share_config_flag(work->tcon->share_conf,
+				    KSMBD_SHARE_FLAG_INHERIT_OWNER))
+		return;
+
+	i_uid_write(inode, i_uid_read(parent_inode));
+}
+
+int ksmbd_vfs_inode_permission(struct dentry *dentry, int acc_mode, bool delete)
+{
+	int mask, ret = 0;
+
+	mask = 0;
+	acc_mode &= O_ACCMODE;
+
+	if (acc_mode == O_RDONLY)
+		mask = MAY_READ;
+	else if (acc_mode == O_WRONLY)
+		mask = MAY_WRITE;
+	else if (acc_mode == O_RDWR)
+		mask = MAY_READ | MAY_WRITE;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	if (inode_permission(&init_user_ns, d_inode(dentry), mask | MAY_OPEN))
+#else
+	if (inode_permission(d_inode(dentry), mask | MAY_OPEN))
+#endif
+		return -EACCES;
+
+	if (delete) {
+		struct dentry *child, *parent;
+
+		parent = dget_parent(dentry);
+		inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
+		child = lookup_one_len(dentry->d_name.name, parent,
+				dentry->d_name.len);
+		if (IS_ERR(child)) {
+			ret = PTR_ERR(child);
+			goto out_lock;
+		}
+
+		if (child != dentry) {
+			ret = -ESTALE;
+			dput(child);
+			goto out_lock;
+		}
+		dput(child);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		if (inode_permission(&init_user_ns, d_inode(parent), MAY_EXEC | MAY_WRITE)) {
+#else
+		if (inode_permission(d_inode(parent), MAY_EXEC | MAY_WRITE)) {
+#endif
+			ret = -EACCES;
+			goto out_lock;
+		}
+out_lock:
+		inode_unlock(d_inode(parent));
+		dput(parent);
+	}
+	return ret;
+}
+
+int ksmbd_vfs_query_maximal_access(struct dentry *dentry, __le32 *daccess)
+{
+	struct dentry *parent, *child;
+	int ret = 0;
+
+	*daccess = cpu_to_le32(FILE_READ_ATTRIBUTES | READ_CONTROL);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	if (!inode_permission(&init_user_ns, d_inode(dentry), MAY_OPEN | MAY_WRITE))
+#else
+	if (!inode_permission(d_inode(dentry), MAY_OPEN | MAY_WRITE))
+#endif
+		*daccess |= cpu_to_le32(WRITE_DAC | WRITE_OWNER | SYNCHRONIZE |
+				FILE_WRITE_DATA | FILE_APPEND_DATA |
+				FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES |
+				FILE_DELETE_CHILD);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	if (!inode_permission(&init_user_ns, d_inode(dentry), MAY_OPEN | MAY_READ))
+#else
+	if (!inode_permission(d_inode(dentry), MAY_OPEN | MAY_READ))
+#endif
+		*daccess |= FILE_READ_DATA_LE | FILE_READ_EA_LE;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	if (!inode_permission(&init_user_ns, d_inode(dentry), MAY_OPEN | MAY_EXEC))
+#else
+	if (!inode_permission(d_inode(dentry), MAY_OPEN | MAY_EXEC))
+#endif
+		*daccess |= FILE_EXECUTE_LE;
+
+	parent = dget_parent(dentry);
+	inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
+	child = lookup_one_len(dentry->d_name.name, parent,
+			dentry->d_name.len);
+	if (IS_ERR(child)) {
+		ret = PTR_ERR(child);
+		goto out_lock;
+	}
+
+	if (child != dentry) {
+		ret = -ESTALE;
+		dput(child);
+		goto out_lock;
+	}
+	dput(child);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	if (!inode_permission(&init_user_ns, d_inode(parent), MAY_EXEC | MAY_WRITE))
+#else
+	if (!inode_permission(d_inode(parent), MAY_EXEC | MAY_WRITE))
+#endif
+		*daccess |= FILE_DELETE_LE;
+
+out_lock:
+	inode_unlock(d_inode(parent));
+	dput(parent);
+	return ret;
+}
+
+/**
+ * ksmbd_vfs_create() - vfs helper for smb create file
+ * @work:	work
+ * @name:	file name
+ * @mode:	file create mode
+ *
+ * Return:	0 on success, otherwise error
+ */
+int ksmbd_vfs_create(struct ksmbd_work *work, const char *name, umode_t mode)
+{
+	struct path path;
+	struct dentry *dentry;
+	int err;
+
+	dentry = kern_path_create(AT_FDCWD, name, &path, 0);
+	if (IS_ERR(dentry)) {
+		err = PTR_ERR(dentry);
+		if (err != -ENOENT)
+			ksmbd_err("path create failed for %s, err %d\n",
+				name, err);
+		return err;
+	}
+
+	mode |= S_IFREG;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	err = vfs_create(&init_user_ns, d_inode(path.dentry), dentry, mode, true);
+#else
+	err = vfs_create(d_inode(path.dentry), dentry, mode, true);
+#endif
+	if (!err) {
+		ksmbd_vfs_inherit_owner(work, d_inode(path.dentry),
+			d_inode(dentry));
+	} else {
+		ksmbd_err("File(%s): creation failed (err:%d)\n", name, err);
+	}
+	done_path_create(&path, dentry);
+	return err;
+}
+
+/**
+ * ksmbd_vfs_mkdir() - vfs helper for smb create directory
+ * @work:	work
+ * @name:	directory name
+ * @mode:	directory create mode
+ *
+ * Return:	0 on success, otherwise error
+ */
+int ksmbd_vfs_mkdir(struct ksmbd_work *work, const char *name, umode_t mode)
+{
+	struct path path;
+	struct dentry *dentry;
+	int err;
+
+	dentry = kern_path_create(AT_FDCWD, name, &path, LOOKUP_DIRECTORY);
+	if (IS_ERR(dentry)) {
+		err = PTR_ERR(dentry);
+		if (err != -EEXIST)
+			ksmbd_debug(VFS, "path create failed for %s, err %d\n",
+					name, err);
+		return err;
+	}
+
+	mode |= S_IFDIR;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	err = vfs_mkdir(&init_user_ns, d_inode(path.dentry), dentry, mode);
+#else
+	err = vfs_mkdir(d_inode(path.dentry), dentry, mode);
+#endif
+	if (err)
+		goto out;
+	else if (d_unhashed(dentry)) {
+		struct dentry *d;
+
+		d = lookup_one_len(dentry->d_name.name,
+			       dentry->d_parent,
+			       dentry->d_name.len);
+		if (IS_ERR(d)) {
+			err = PTR_ERR(d);
+			goto out;
+		}
+		if (unlikely(d_is_negative(d))) {
+			dput(d);
+			err = -ENOENT;
+			goto out;
+		}
+
+		ksmbd_vfs_inherit_owner(work, d_inode(path.dentry),
+			d_inode(d));
+		dput(d);
+	}
+out:
+	done_path_create(&path, dentry);
+	if (err)
+		ksmbd_err("mkdir(%s): creation failed (err:%d)\n", name, err);
+	return err;
+}
+
+static ssize_t ksmbd_vfs_getcasexattr(struct dentry *dentry, char *attr_name,
+		int attr_name_len, char **attr_value)
+{
+	char *name, *xattr_list = NULL;
+	ssize_t value_len = -ENOENT, xattr_list_len;
+
+	xattr_list_len = ksmbd_vfs_listxattr(dentry, &xattr_list);
+	if (xattr_list_len <= 0)
+		goto out;
+
+	for (name = xattr_list; name - xattr_list < xattr_list_len;
+			name += strlen(name) + 1) {
+		ksmbd_debug(VFS, "%s, len %zd\n", name, strlen(name));
+		if (strncasecmp(attr_name, name, attr_name_len))
+			continue;
+
+		value_len = ksmbd_vfs_getxattr(dentry,
+					       name,
+					       attr_value);
+		if (value_len < 0)
+			ksmbd_err("failed to get xattr in file\n");
+		break;
+	}
+
+out:
+	kvfree(xattr_list);
+	return value_len;
+}
+
+static int ksmbd_vfs_stream_read(struct ksmbd_file *fp, char *buf, loff_t *pos,
+		size_t count)
+{
+	ssize_t v_len;
+	char *stream_buf = NULL;
+	int err;
+
+	ksmbd_debug(VFS, "read stream data pos : %llu, count : %zd\n",
+			*pos, count);
+
+	v_len = ksmbd_vfs_getcasexattr(fp->filp->f_path.dentry,
+				       fp->stream.name,
+				       fp->stream.size,
+				       &stream_buf);
+	if (v_len == -ENOENT) {
+		ksmbd_err("not found stream in xattr : %zd\n", v_len);
+		err = -ENOENT;
+		return err;
+	}
+
+	memcpy(buf, &stream_buf[*pos], count);
+	return v_len > count ? count : v_len;
+}
+
+/**
+ * check_lock_range() - vfs helper for smb byte range file locking
+ * @filp:	the file to apply the lock to
+ * @start:	lock start byte offset
+ * @end:	lock end byte offset
+ * @type:	byte range type read/write
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int check_lock_range(struct file *filp, loff_t start, loff_t end,
+		unsigned char type)
+{
+	struct file_lock *flock;
+	struct file_lock_context *ctx = file_inode(filp)->i_flctx;
+	int error = 0;
+
+	if (!ctx || list_empty_careful(&ctx->flc_posix))
+		return 0;
+
+	spin_lock(&ctx->flc_lock);
+	list_for_each_entry(flock, &ctx->flc_posix, fl_list) {
+		/* check conflict locks */
+		if (flock->fl_end >= start && end >= flock->fl_start) {
+			if (flock->fl_type == F_RDLCK) {
+				if (type == WRITE) {
+					ksmbd_err("not allow write by shared lock\n");
+					error = 1;
+					goto out;
+				}
+			} else if (flock->fl_type == F_WRLCK) {
+				/* check owner in lock */
+				if (flock->fl_file != filp) {
+					error = 1;
+					ksmbd_err("not allow rw access by exclusive lock from other opens\n");
+					goto out;
+				}
+			}
+		}
+	}
+out:
+	spin_unlock(&ctx->flc_lock);
+	return error;
+}
+
+/**
+ * ksmbd_vfs_read() - vfs helper for smb file read
+ * @work:	smb work
+ * @fid:	file id of open file
+ * @count:	read byte count
+ * @pos:	file pos
+ *
+ * Return:	number of read bytes on success, otherwise error
+ */
+int ksmbd_vfs_read(struct ksmbd_work *work, struct ksmbd_file *fp, size_t count,
+		 loff_t *pos)
+{
+	struct file *filp;
+	ssize_t nbytes = 0;
+	char *rbuf;
+	struct inode *inode;
+
+	rbuf = work->aux_payload_buf;
+	filp = fp->filp;
+	inode = file_inode(filp);
+	if (S_ISDIR(inode->i_mode))
+		return -EISDIR;
+
+	if (unlikely(count == 0))
+		return 0;
+
+	if (work->conn->connection_type) {
+		if (!(fp->daccess & (FILE_READ_DATA_LE | FILE_EXECUTE_LE))) {
+			ksmbd_err("no right to read(%s)\n", FP_FILENAME(fp));
+			return -EACCES;
+		}
+	}
+
+	if (ksmbd_stream_fd(fp))
+		return ksmbd_vfs_stream_read(fp, rbuf, pos, count);
+
+	if (!work->tcon->posix_extensions) {
+		int ret;
+
+		ret = check_lock_range(filp, *pos, *pos + count - 1,
+				READ);
+		if (ret) {
+			ksmbd_err("unable to read due to lock\n");
+			return -EAGAIN;
+		}
+	}
+
+	nbytes = kernel_read(filp, rbuf, count, pos);
+	if (nbytes < 0) {
+		ksmbd_err("smb read failed for (%s), err = %zd\n",
+				fp->filename, nbytes);
+		return nbytes;
+	}
+
+	filp->f_pos = *pos;
+	return nbytes;
+}
+
+static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos,
+		size_t count)
+{
+	char *stream_buf = NULL, *wbuf;
+	size_t size, v_len;
+	int err = 0;
+
+	ksmbd_debug(VFS, "write stream data pos : %llu, count : %zd\n",
+			*pos, count);
+
+	size = *pos + count;
+	if (size > XATTR_SIZE_MAX) {
+		size = XATTR_SIZE_MAX;
+		count = (*pos + count) - XATTR_SIZE_MAX;
+	}
+
+	v_len = ksmbd_vfs_getcasexattr(fp->filp->f_path.dentry,
+				       fp->stream.name,
+				       fp->stream.size,
+				       &stream_buf);
+	if (v_len == -ENOENT) {
+		ksmbd_err("not found stream in xattr : %zd\n", v_len);
+		err = -ENOENT;
+		goto out;
+	}
+
+	if (v_len < size) {
+		wbuf = kvmalloc(size, GFP_KERNEL | __GFP_ZERO);
+		if (!wbuf) {
+			err = -ENOMEM;
+			goto out;
+		}
+
+		if (v_len > 0)
+			memcpy(wbuf, stream_buf, v_len);
+		stream_buf = wbuf;
+	}
+
+	memcpy(&stream_buf[*pos], buf, count);
+
+	err = ksmbd_vfs_setxattr(fp->filp->f_path.dentry,
+				 fp->stream.name,
+				 (void *)stream_buf,
+				 size,
+				 0);
+	if (err < 0)
+		goto out;
+
+	fp->filp->f_pos = *pos;
+	err = 0;
+out:
+	kvfree(stream_buf);
+	return err;
+}
+
+/**
+ * ksmbd_vfs_write() - vfs helper for smb file write
+ * @work:	work
+ * @fid:	file id of open file
+ * @buf:	buf containing data for writing
+ * @count:	read byte count
+ * @pos:	file pos
+ * @sync:	fsync after write
+ * @written:	number of bytes written
+ *
+ * Return:	0 on success, otherwise error
+ */
+int ksmbd_vfs_write(struct ksmbd_work *work, struct ksmbd_file *fp,
+		char *buf, size_t count, loff_t *pos, bool sync,
+		ssize_t *written)
+{
+	struct ksmbd_session *sess = work->sess;
+	struct file *filp;
+	loff_t	offset = *pos;
+	int err = 0;
+
+	if (sess->conn->connection_type) {
+		if (!(fp->daccess & FILE_WRITE_DATA_LE)) {
+			ksmbd_err("no right to write(%s)\n", FP_FILENAME(fp));
+			err = -EACCES;
+			goto out;
+		}
+	}
+
+	filp = fp->filp;
+
+	if (ksmbd_stream_fd(fp)) {
+		err = ksmbd_vfs_stream_write(fp, buf, pos, count);
+		if (!err)
+			*written = count;
+		goto out;
+	}
+
+	if (!work->tcon->posix_extensions) {
+		err = check_lock_range(filp, *pos, *pos + count - 1, WRITE);
+		if (err) {
+			ksmbd_err("unable to write due to lock\n");
+			err = -EAGAIN;
+			goto out;
+		}
+	}
+
+	/* Do we need to break any of a levelII oplock? */
+	smb_break_all_levII_oplock(work, fp, 1);
+
+	err = kernel_write(filp, buf, count, pos);
+	if (err < 0) {
+		ksmbd_debug(VFS, "smb write failed, err = %d\n", err);
+		goto out;
+	}
+
+	filp->f_pos = *pos;
+	*written = err;
+	err = 0;
+	if (sync) {
+		err = vfs_fsync_range(filp, offset, offset + *written, 0);
+		if (err < 0)
+			ksmbd_err("fsync failed for filename = %s, err = %d\n",
+					FP_FILENAME(fp), err);
+	}
+
+out:
+	return err;
+}
+
+/**
+ * ksmbd_vfs_getattr() - vfs helper for smb getattr
+ * @work:	work
+ * @fid:	file id of open file
+ * @attrs:	inode attributes
+ *
+ * Return:	0 on success, otherwise error
+ */
+int ksmbd_vfs_getattr(struct path *path, struct kstat *stat)
+{
+	int err;
+
+	err = vfs_getattr(path, stat, STATX_BTIME, AT_STATX_SYNC_AS_STAT);
+	if (err)
+		ksmbd_err("getattr failed, err %d\n", err);
+	return err;
+}
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+/**
+ * smb_check_attrs() - sanitize inode attributes
+ * @inode:	inode
+ * @attrs:	inode attributes
+ */
+static void smb_check_attrs(struct inode *inode, struct iattr *attrs)
+{
+	/* sanitize the mode change */
+	if (attrs->ia_valid & ATTR_MODE) {
+		attrs->ia_mode &= S_IALLUGO;
+		attrs->ia_mode |= (inode->i_mode & ~S_IALLUGO);
+	}
+
+	/* Revoke setuid/setgid on chown */
+	if (!S_ISDIR(inode->i_mode) &&
+	    (((attrs->ia_valid & ATTR_UID) &&
+	      !uid_eq(attrs->ia_uid, inode->i_uid)) ||
+	     ((attrs->ia_valid & ATTR_GID) &&
+	      !gid_eq(attrs->ia_gid, inode->i_gid)))) {
+		attrs->ia_valid |= ATTR_KILL_PRIV;
+		if (attrs->ia_valid & ATTR_MODE) {
+			/* we're setting mode too, just clear the s*id bits */
+			attrs->ia_mode &= ~S_ISUID;
+			if (attrs->ia_mode & 0010)
+				attrs->ia_mode &= ~S_ISGID;
+		} else {
+			/* set ATTR_KILL_* bits and let VFS handle it */
+			attrs->ia_valid |= (ATTR_KILL_SUID | ATTR_KILL_SGID);
+		}
+	}
+}
+
+/**
+ * ksmbd_vfs_setattr() - vfs helper for smb setattr
+ * @work:	work
+ * @name:	file name
+ * @fid:	file id of open file
+ * @attrs:	inode attributes
+ *
+ * Return:	0 on success, otherwise error
+ */
+int ksmbd_vfs_setattr(struct ksmbd_work *work, const char *name, u64 fid,
+		struct iattr *attrs)
+{
+	struct file *filp;
+	struct dentry *dentry;
+	struct inode *inode;
+	struct path path;
+	bool update_size = false;
+	int err = 0;
+	struct ksmbd_file *fp = NULL;
+
+	if (ksmbd_override_fsids(work))
+		return -ENOMEM;
+
+	if (name) {
+		err = kern_path(name, 0, &path);
+		if (err) {
+			ksmbd_revert_fsids(work);
+			ksmbd_debug(VFS, "lookup failed for %s, err = %d\n",
+					name, err);
+			return -ENOENT;
+		}
+		dentry = path.dentry;
+		inode = d_inode(dentry);
+	} else {
+		fp = ksmbd_lookup_fd_fast(work, fid);
+		if (!fp) {
+			ksmbd_revert_fsids(work);
+			ksmbd_err("failed to get filp for fid %llu\n", fid);
+			return -ENOENT;
+		}
+
+		filp = fp->filp;
+		dentry = filp->f_path.dentry;
+		inode = d_inode(dentry);
+	}
+
+	err = ksmbd_vfs_inode_permission(dentry, O_WRONLY, false);
+	if (err)
+		goto out;
+
+	/* no need to update mode of symlink */
+	if (S_ISLNK(inode->i_mode))
+		attrs->ia_valid &= ~ATTR_MODE;
+
+	/* skip setattr, if nothing to update */
+	if (!attrs->ia_valid) {
+		err = 0;
+		goto out;
+	}
+
+	smb_check_attrs(inode, attrs);
+	if (attrs->ia_valid & ATTR_SIZE) {
+		err = get_write_access(inode);
+		if (err)
+			goto out;
+
+		err = locks_verify_truncate(inode, NULL, attrs->ia_size);
+		if (err) {
+			put_write_access(inode);
+			goto out;
+		}
+		update_size = true;
+	}
+
+	attrs->ia_valid |= ATTR_CTIME;
+
+	inode_lock(inode);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	err = notify_change(&init_user_ns, dentry, attrs, NULL);
+#else
+	err = notify_change(dentry, attrs, NULL);
+#endif
+	inode_unlock(inode);
+
+	if (update_size)
+		put_write_access(inode);
+
+	if (!err) {
+		sync_inode_metadata(inode, 1);
+		ksmbd_debug(VFS, "fid %llu, setattr done\n", fid);
+	}
+
+out:
+	if (name)
+		path_put(&path);
+	ksmbd_fd_put(work, fp);
+	ksmbd_revert_fsids(work);
+	return err;
+}
+
+/**
+ * ksmbd_vfs_symlink() - vfs helper for creating smb symlink
+ * @name:	source file name
+ * @symname:	symlink name
+ *
+ * Return:	0 on success, otherwise error
+ */
+int ksmbd_vfs_symlink(struct ksmbd_work *work, const char *name,
+		const char *symname)
+{
+	struct path path;
+	struct dentry *dentry;
+	int err;
+
+	if (ksmbd_override_fsids(work))
+		return -ENOMEM;
+
+	dentry = kern_path_create(AT_FDCWD, symname, &path, 0);
+	if (IS_ERR(dentry)) {
+		ksmbd_revert_fsids(work);
+		err = PTR_ERR(dentry);
+		ksmbd_err("path create failed for %s, err %d\n", name, err);
+		return err;
+	}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	err = vfs_symlink(&init_user_ns, d_inode(dentry->d_parent), dentry, name);
+#else
+	err = vfs_symlink(d_inode(dentry->d_parent), dentry, name);
+#endif
+	if (err && (err != -EEXIST || err != -ENOSPC))
+		ksmbd_debug(VFS, "failed to create symlink, err %d\n", err);
+
+	done_path_create(&path, dentry);
+	ksmbd_revert_fsids(work);
+	return err;
+}
+
+/**
+ * ksmbd_vfs_readlink() - vfs helper for reading value of symlink
+ * @path:	path of symlink
+ * @buf:	destination buffer for symlink value
+ * @lenp:	destination buffer length
+ *
+ * Return:	symlink value length on success, otherwise error
+ */
+int ksmbd_vfs_readlink(struct path *path, char *buf, int lenp)
+{
+	struct inode *inode;
+	int err;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)
+	const char *link;
+	DEFINE_DELAYED_CALL(done);
+	int len;
+#else
+	mm_segment_t old_fs;
+#endif
+
+	if (!path)
+		return -ENOENT;
+
+	inode = d_inode(path->dentry);
+	if (!S_ISLNK(inode->i_mode))
+		return -EINVAL;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)
+	link = vfs_get_link(path->dentry, &done);
+	if (IS_ERR(link)) {
+		err = PTR_ERR(link);
+		ksmbd_err("readlink failed, err = %d\n", err);
+		return err;
+	}
+
+	len = strlen(link);
+	if (len > lenp)
+		len = lenp;
+
+	memcpy(buf, link, len);
+	do_delayed_call(&done);
+
+	return 0;
+#else
+	old_fs = get_fs();
+	set_fs(KERNEL_DS);
+	err = inode->i_op->readlink(path->dentry, (char __user *)buf, lenp);
+	set_fs(old_fs);
+	if (err < 0)
+		ksmbd_err("readlink failed, err = %d\n", err);
+
+	return err;
+#endif
+}
+
+int ksmbd_vfs_readdir_name(struct ksmbd_work *work, struct ksmbd_kstat *ksmbd_kstat,
+		const char *de_name, int de_name_len, const char *dir_path)
+{
+	struct path path;
+	int rc, file_pathlen, dir_pathlen;
+	char *name;
+
+	dir_pathlen = strlen(dir_path);
+	/* 1 for '/'*/
+	file_pathlen = dir_pathlen +  de_name_len + 1;
+	name = kmalloc(file_pathlen + 1, GFP_KERNEL);
+	if (!name)
+		return -ENOMEM;
+
+	memcpy(name, dir_path, dir_pathlen);
+	memset(name + dir_pathlen, '/', 1);
+	memcpy(name + dir_pathlen + 1, de_name, de_name_len);
+	name[file_pathlen] = '\0';
+
+	rc = ksmbd_vfs_kern_path(name, LOOKUP_FOLLOW, &path, 1);
+	if (rc) {
+		ksmbd_err("lookup failed: %s [%d]\n", name, rc);
+		kfree(name);
+		return -ENOMEM;
+	}
+
+	ksmbd_vfs_fill_dentry_attrs(work, path.dentry, ksmbd_kstat);
+	path_put(&path);
+	kfree(name);
+	return 0;
+}
+#endif
+
+/**
+ * ksmbd_vfs_fsync() - vfs helper for smb fsync
+ * @work:	work
+ * @fid:	file id of open file
+ *
+ * Return:	0 on success, otherwise error
+ */
+int ksmbd_vfs_fsync(struct ksmbd_work *work, u64 fid, u64 p_id)
+{
+	struct ksmbd_file *fp;
+	int err;
+
+	fp = ksmbd_lookup_fd_slow(work, fid, p_id);
+	if (!fp) {
+		ksmbd_err("failed to get filp for fid %llu\n", fid);
+		return -ENOENT;
+	}
+	err = vfs_fsync(fp->filp, 0);
+	if (err < 0)
+		ksmbd_err("smb fsync failed, err = %d\n", err);
+	ksmbd_fd_put(work, fp);
+	return err;
+}
+
+/**
+ * ksmbd_vfs_remove_file() - vfs helper for smb rmdir or unlink
+ * @name:	absolute directory or file name
+ *
+ * Return:	0 on success, otherwise error
+ */
+int ksmbd_vfs_remove_file(struct ksmbd_work *work, char *name)
+{
+	struct path path;
+	struct dentry *dentry, *parent;
+	int err;
+
+	if (ksmbd_override_fsids(work))
+		return -ENOMEM;
+
+	err = kern_path(name, LOOKUP_FOLLOW, &path);
+	if (err) {
+		ksmbd_debug(VFS, "can't get %s, err %d\n", name, err);
+		ksmbd_revert_fsids(work);
+		return err;
+	}
+
+	parent = dget_parent(path.dentry);
+	inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
+	dentry = lookup_one_len(path.dentry->d_name.name, parent,
+			strlen(path.dentry->d_name.name));
+	if (IS_ERR(dentry)) {
+		err = PTR_ERR(dentry);
+		ksmbd_debug(VFS, "%s: lookup failed, err %d\n",
+				path.dentry->d_name.name, err);
+		goto out_err;
+	}
+
+	if (!d_inode(dentry) || !d_inode(dentry)->i_nlink) {
+		dput(dentry);
+		err = -ENOENT;
+		goto out_err;
+	}
+
+	if (S_ISDIR(d_inode(dentry)->i_mode)) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		err = vfs_rmdir(&init_user_ns, d_inode(parent), dentry);
+#else
+		err = vfs_rmdir(d_inode(parent), dentry);
+#endif
+		if (err && err != -ENOTEMPTY)
+			ksmbd_debug(VFS, "%s: rmdir failed, err %d\n", name,
+				err);
+	} else {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		err = vfs_unlink(&init_user_ns, d_inode(parent), dentry,
+				 NULL);
+#else
+		err = vfs_unlink(d_inode(parent), dentry, NULL);
+#endif
+		if (err)
+			ksmbd_debug(VFS, "%s: unlink failed, err %d\n", name,
+				err);
+	}
+
+	dput(dentry);
+out_err:
+	inode_unlock(d_inode(parent));
+	dput(parent);
+	path_put(&path);
+	ksmbd_revert_fsids(work);
+	return err;
+}
+
+/**
+ * ksmbd_vfs_link() - vfs helper for creating smb hardlink
+ * @oldname:	source file name
+ * @newname:	hardlink name
+ *
+ * Return:	0 on success, otherwise error
+ */
+int ksmbd_vfs_link(struct ksmbd_work *work, const char *oldname,
+		const char *newname)
+{
+	struct path oldpath, newpath;
+	struct dentry *dentry;
+	int err;
+
+	if (ksmbd_override_fsids(work))
+		return -ENOMEM;
+
+	err = kern_path(oldname, LOOKUP_FOLLOW, &oldpath);
+	if (err) {
+		ksmbd_err("cannot get linux path for %s, err = %d\n",
+				oldname, err);
+		goto out1;
+	}
+
+	dentry = kern_path_create(AT_FDCWD, newname, &newpath,
+			LOOKUP_FOLLOW | LOOKUP_REVAL);
+	if (IS_ERR(dentry)) {
+		err = PTR_ERR(dentry);
+		ksmbd_err("path create err for %s, err %d\n", newname, err);
+		goto out2;
+	}
+
+	err = -EXDEV;
+	if (oldpath.mnt != newpath.mnt) {
+		ksmbd_err("vfs_link failed err %d\n", err);
+		goto out3;
+	}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	err = vfs_link(oldpath.dentry, &init_user_ns, d_inode(newpath.dentry),
+			dentry, NULL);
+#else
+	err = vfs_link(oldpath.dentry, d_inode(newpath.dentry), dentry, NULL);
+#endif
+	if (err)
+		ksmbd_debug(VFS, "vfs_link failed err %d\n", err);
+
+out3:
+	done_path_create(&newpath, dentry);
+out2:
+	path_put(&oldpath);
+out1:
+	ksmbd_revert_fsids(work);
+	return err;
+}
+
+static int __ksmbd_vfs_rename(struct ksmbd_work *work,
+		struct dentry *src_dent_parent, struct dentry *src_dent,
+		struct dentry *dst_dent_parent, struct dentry *trap_dent,
+		char *dst_name)
+{
+	struct dentry *dst_dent;
+	int err;
+
+	if (!work->tcon->posix_extensions) {
+		spin_lock(&src_dent->d_lock);
+		list_for_each_entry(dst_dent, &src_dent->d_subdirs, d_child) {
+			struct ksmbd_file *child_fp;
+
+			if (d_really_is_negative(dst_dent))
+				continue;
+
+			child_fp = ksmbd_lookup_fd_inode(d_inode(dst_dent));
+			if (child_fp) {
+				spin_unlock(&src_dent->d_lock);
+				ksmbd_debug(VFS, "Forbid rename, sub file/dir is in use\n");
+				return -EACCES;
+			}
+		}
+		spin_unlock(&src_dent->d_lock);
+	}
+
+	if (d_really_is_negative(src_dent_parent))
+		return -ENOENT;
+	if (d_really_is_negative(dst_dent_parent))
+		return -ENOENT;
+	if (d_really_is_negative(src_dent))
+		return -ENOENT;
+	if (src_dent == trap_dent)
+		return -EINVAL;
+
+	if (ksmbd_override_fsids(work))
+		return -ENOMEM;
+
+	dst_dent = lookup_one_len(dst_name, dst_dent_parent, strlen(dst_name));
+	err = PTR_ERR(dst_dent);
+	if (IS_ERR(dst_dent)) {
+		ksmbd_err("lookup failed %s [%d]\n", dst_name, err);
+		goto out;
+	}
+
+	err = -ENOTEMPTY;
+	if (dst_dent != trap_dent && !d_really_is_positive(dst_dent)) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		struct renamedata rd = {
+			.old_mnt_userns	= &init_user_ns,
+			.old_dir	= d_inode(src_dent_parent),
+			.old_dentry	= src_dent,
+			.new_mnt_userns	= &init_user_ns,
+			.new_dir	= d_inode(dst_dent_parent),
+			.new_dentry	= dst_dent,
+		};
+		err = vfs_rename(&rd);
+#else
+		err = vfs_rename(d_inode(src_dent_parent),
+				 src_dent,
+				 d_inode(dst_dent_parent),
+				 dst_dent,
+				 NULL,
+				 0);
+#endif
+	}
+	if (err)
+		ksmbd_err("vfs_rename failed err %d\n", err);
+	if (dst_dent)
+		dput(dst_dent);
+out:
+	ksmbd_revert_fsids(work);
+	return err;
+}
+
+int ksmbd_vfs_fp_rename(struct ksmbd_work *work, struct ksmbd_file *fp,
+		char *newname)
+{
+	struct path dst_path;
+	struct dentry *src_dent_parent, *dst_dent_parent;
+	struct dentry *src_dent, *trap_dent, *src_child;
+	char *dst_name;
+	int err;
+
+	dst_name = extract_last_component(newname);
+	if (!dst_name)
+		return -EINVAL;
+
+	src_dent_parent = dget_parent(fp->filp->f_path.dentry);
+	src_dent = fp->filp->f_path.dentry;
+
+	err = kern_path(newname, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &dst_path);
+	if (err) {
+		ksmbd_debug(VFS, "Cannot get path for %s [%d]\n", newname, err);
+		goto out;
+	}
+	dst_dent_parent = dst_path.dentry;
+
+	trap_dent = lock_rename(src_dent_parent, dst_dent_parent);
+	dget(src_dent);
+	dget(dst_dent_parent);
+	src_child = lookup_one_len(src_dent->d_name.name, src_dent_parent,
+			src_dent->d_name.len);
+	if (IS_ERR(src_child)) {
+		err = PTR_ERR(src_child);
+		goto out_lock;
+	}
+
+	if (src_child != src_dent) {
+		err = -ESTALE;
+		dput(src_child);
+		goto out_lock;
+	}
+	dput(src_child);
+
+	err = __ksmbd_vfs_rename(work,
+				 src_dent_parent,
+				 src_dent,
+				 dst_dent_parent,
+				 trap_dent,
+				 dst_name);
+out_lock:
+	dput(src_dent);
+	dput(dst_dent_parent);
+	unlock_rename(src_dent_parent, dst_dent_parent);
+	path_put(&dst_path);
+out:
+	dput(src_dent_parent);
+	return err;
+}
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+int ksmbd_vfs_rename_slowpath(struct ksmbd_work *work, char *oldname, char *newname)
+{
+	struct path dst_path, src_path;
+	struct dentry *src_dent_parent, *dst_dent_parent;
+	struct dentry *src_dent = NULL, *trap_dent;
+	char *src_name, *dst_name;
+	int err;
+
+	src_name = extract_last_component(oldname);
+	if (!src_name)
+		return -EINVAL;
+	dst_name = extract_last_component(newname);
+	if (!dst_name)
+		return -EINVAL;
+
+	err = kern_path(oldname, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &src_path);
+	if (err) {
+		ksmbd_err("Cannot get path for %s [%d]\n", oldname, err);
+		return err;
+	}
+	src_dent_parent = src_path.dentry;
+	dget(src_dent_parent);
+
+	err = kern_path(newname, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &dst_path);
+	if (err) {
+		ksmbd_err("Cannot get path for %s [%d]\n", newname, err);
+		dput(src_dent_parent);
+		path_put(&src_path);
+		return err;
+	}
+	dst_dent_parent = dst_path.dentry;
+	dget(dst_dent_parent);
+
+	trap_dent = lock_rename(src_dent_parent, dst_dent_parent);
+	src_dent = lookup_one_len(src_name, src_dent_parent, strlen(src_name));
+	err = PTR_ERR(src_dent);
+	if (IS_ERR(src_dent)) {
+		src_dent = NULL;
+		ksmbd_err("%s lookup failed with error = %d\n", src_name, err);
+		goto out;
+	}
+
+	err = __ksmbd_vfs_rename(work, src_dent_parent,
+				 src_dent,
+				 dst_dent_parent,
+				 trap_dent,
+				 dst_name);
+out:
+	if (src_dent)
+		dput(src_dent);
+	dput(dst_dent_parent);
+	dput(src_dent_parent);
+	unlock_rename(src_dent_parent, dst_dent_parent);
+	path_put(&src_path);
+	path_put(&dst_path);
+	return err;
+}
+#else
+int ksmbd_vfs_rename_slowpath(struct ksmbd_work *work, char *oldname,
+		char *newname)
+{
+	return 0;
+}
+#endif
+
+/**
+ * ksmbd_vfs_truncate() - vfs helper for smb file truncate
+ * @work:	work
+ * @name:	old filename
+ * @fid:	file id of old file
+ * @size:	truncate to given size
+ *
+ * Return:	0 on success, otherwise error
+ */
+int ksmbd_vfs_truncate(struct ksmbd_work *work, const char *name,
+		struct ksmbd_file *fp, loff_t size)
+{
+	struct path path;
+	int err = 0;
+
+	if (name) {
+		err = kern_path(name, 0, &path);
+		if (err) {
+			ksmbd_err("cannot get linux path for %s, err %d\n",
+					name, err);
+			return err;
+		}
+		err = vfs_truncate(&path, size);
+		if (err)
+			ksmbd_err("truncate failed for %s err %d\n",
+					name, err);
+		path_put(&path);
+	} else {
+		struct file *filp;
+
+		filp = fp->filp;
+
+		/* Do we need to break any of a levelII oplock? */
+		smb_break_all_levII_oplock(work, fp, 1);
+
+		if (!work->tcon->posix_extensions) {
+			struct inode *inode = file_inode(filp);
+
+			if (size < inode->i_size) {
+				err = check_lock_range(filp, size,
+						inode->i_size - 1, WRITE);
+			} else {
+				err = check_lock_range(filp, inode->i_size,
+						size - 1, WRITE);
+			}
+
+			if (err) {
+				ksmbd_err("failed due to lock\n");
+				return -EAGAIN;
+			}
+		}
+
+		err = vfs_truncate(&filp->f_path, size);
+		if (err)
+			ksmbd_err("truncate failed for filename : %s err %d\n",
+					fp->filename, err);
+	}
+
+	return err;
+}
+
+/**
+ * ksmbd_vfs_listxattr() - vfs helper for smb list extended attributes
+ * @dentry:	dentry of file for listing xattrs
+ * @list:	destination buffer
+ * @size:	destination buffer length
+ *
+ * Return:	xattr list length on success, otherwise error
+ */
+ssize_t ksmbd_vfs_listxattr(struct dentry *dentry, char **list)
+{
+	ssize_t size;
+	char *vlist = NULL;
+
+	size = vfs_listxattr(dentry, NULL, 0);
+	if (size <= 0)
+		return size;
+
+	vlist = kvmalloc(size, GFP_KERNEL | __GFP_ZERO);
+	if (!vlist)
+		return -ENOMEM;
+
+	*list = vlist;
+	size = vfs_listxattr(dentry, vlist, size);
+	if (size < 0) {
+		ksmbd_debug(VFS, "listxattr failed\n");
+		kvfree(vlist);
+		*list = NULL;
+	}
+
+	return size;
+}
+
+static ssize_t ksmbd_vfs_xattr_len(struct dentry *dentry, char *xattr_name)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	return vfs_getxattr(&init_user_ns, dentry, xattr_name, NULL, 0);
+#else
+	return vfs_getxattr(dentry, xattr_name, NULL, 0);
+#endif
+}
+
+/**
+ * ksmbd_vfs_getxattr() - vfs helper for smb get extended attributes value
+ * @dentry:	dentry of file for getting xattrs
+ * @xattr_name:	name of xattr name to query
+ * @xattr_buf:	destination buffer xattr value
+ *
+ * Return:	read xattr value length on success, otherwise error
+ */
+ssize_t ksmbd_vfs_getxattr(struct dentry *dentry, char *xattr_name,
+		char **xattr_buf)
+{
+	ssize_t xattr_len;
+	char *buf;
+
+	*xattr_buf = NULL;
+	xattr_len = ksmbd_vfs_xattr_len(dentry, xattr_name);
+	if (xattr_len < 0)
+		return xattr_len;
+
+	buf = kmalloc(xattr_len + 1, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	xattr_len = vfs_getxattr(&init_user_ns, dentry, xattr_name, (void *)buf,
+			xattr_len);
+#else
+	xattr_len = vfs_getxattr(dentry, xattr_name, (void *)buf, xattr_len);
+#endif
+	if (xattr_len > 0)
+		*xattr_buf = buf;
+	else
+		kfree(buf);
+	return xattr_len;
+}
+
+/**
+ * ksmbd_vfs_setxattr() - vfs helper for smb set extended attributes value
+ * @dentry:	dentry to set XATTR at
+ * @name:	xattr name for setxattr
+ * @value:	xattr value to set
+ * @size:	size of xattr value
+ * @flags:	destination buffer length
+ *
+ * Return:	0 on success, otherwise error
+ */
+int ksmbd_vfs_setxattr(struct dentry *dentry, const char *attr_name,
+		const void *attr_value, size_t attr_size, int flags)
+{
+	int err;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	err = vfs_setxattr(&init_user_ns, dentry,
+#else
+	err = vfs_setxattr(dentry,
+#endif
+			   attr_name,
+			   attr_value,
+			   attr_size,
+			   flags);
+	if (err)
+		ksmbd_debug(VFS, "setxattr failed, err %d\n", err);
+	return err;
+}
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+int ksmbd_vfs_fsetxattr(struct ksmbd_work *work, const char *filename,
+		const char *attr_name, const void *attr_value, size_t attr_size,
+		int flags)
+{
+	struct path path;
+	int err;
+
+	if (ksmbd_override_fsids(work))
+		return -ENOMEM;
+
+	err = kern_path(filename, 0, &path);
+	if (err) {
+		ksmbd_revert_fsids(work);
+		ksmbd_debug(VFS, "cannot get linux path %s, err %d\n",
+				filename, err);
+		return err;
+	}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	err = vfs_setxattr(&init_user_ns, path.dentry,
+#else
+	err = vfs_setxattr(path.dentry,
+#endif
+			   attr_name,
+			   attr_value,
+			   attr_size,
+			   flags);
+	if (err)
+		ksmbd_debug(VFS, "setxattr failed, err %d\n", err);
+	path_put(&path);
+	ksmbd_revert_fsids(work);
+	return err;
+}
+#endif
+
+int ksmbd_vfs_remove_acl_xattrs(struct dentry *dentry)
+{
+	char *name, *xattr_list = NULL;
+	ssize_t xattr_list_len;
+	int err = 0;
+
+	xattr_list_len = ksmbd_vfs_listxattr(dentry, &xattr_list);
+	if (xattr_list_len < 0) {
+		goto out;
+	} else if (!xattr_list_len) {
+		ksmbd_debug(SMB, "empty xattr in the file\n");
+		goto out;
+	}
+
+	for (name = xattr_list; name - xattr_list < xattr_list_len;
+			name += strlen(name) + 1) {
+		ksmbd_debug(SMB, "%s, len %zd\n", name, strlen(name));
+
+		if (!strncmp(name, XATTR_NAME_POSIX_ACL_ACCESS,
+			     sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1) ||
+		    !strncmp(name, XATTR_NAME_POSIX_ACL_DEFAULT,
+			     sizeof(XATTR_NAME_POSIX_ACL_DEFAULT) - 1)) {
+			err = ksmbd_vfs_remove_xattr(dentry, name);
+			if (err)
+				ksmbd_debug(SMB,
+					"remove acl xattr failed : %s\n", name);
+		}
+	}
+out:
+	kvfree(xattr_list);
+	return err;
+}
+
+int ksmbd_vfs_remove_sd_xattrs(struct dentry *dentry)
+{
+	char *name, *xattr_list = NULL;
+	ssize_t xattr_list_len;
+	int err = 0;
+
+	xattr_list_len = ksmbd_vfs_listxattr(dentry, &xattr_list);
+	if (xattr_list_len < 0) {
+		goto out;
+	} else if (!xattr_list_len) {
+		ksmbd_debug(SMB, "empty xattr in the file\n");
+		goto out;
+	}
+
+	for (name = xattr_list; name - xattr_list < xattr_list_len;
+			name += strlen(name) + 1) {
+		ksmbd_debug(SMB, "%s, len %zd\n", name, strlen(name));
+
+		if (!strncmp(name, XATTR_NAME_SD, XATTR_NAME_SD_LEN)) {
+			err = ksmbd_vfs_remove_xattr(dentry, name);
+			if (err)
+				ksmbd_debug(SMB, "remove xattr failed : %s\n", name);
+		}
+	}
+out:
+	kvfree(xattr_list);
+	return err;
+}
+
+static struct xattr_smb_acl *ksmbd_vfs_make_xattr_posix_acl(struct inode *inode,
+		int acl_type)
+{
+	struct xattr_smb_acl *smb_acl = NULL;
+	struct posix_acl *posix_acls;
+	struct posix_acl_entry *pa_entry;
+	struct xattr_acl_entry *xa_entry;
+	int i;
+
+	posix_acls = ksmbd_vfs_get_acl(inode, acl_type);
+	if (!posix_acls)
+		return NULL;
+
+	smb_acl = kzalloc(sizeof(struct xattr_smb_acl) +
+			  sizeof(struct xattr_acl_entry) * posix_acls->a_count,
+			  GFP_KERNEL);
+	if (!smb_acl)
+		goto out;
+
+	smb_acl->count = posix_acls->a_count;
+	pa_entry = posix_acls->a_entries;
+	xa_entry = smb_acl->entries;
+	for (i = 0; i < posix_acls->a_count; i++, pa_entry++, xa_entry++) {
+		switch (pa_entry->e_tag) {
+		case ACL_USER:
+			xa_entry->type = SMB_ACL_USER;
+			xa_entry->uid = from_kuid(&init_user_ns, pa_entry->e_uid);
+			break;
+		case ACL_USER_OBJ:
+			xa_entry->type = SMB_ACL_USER_OBJ;
+			break;
+		case ACL_GROUP:
+			xa_entry->type = SMB_ACL_GROUP;
+			xa_entry->gid = from_kgid(&init_user_ns, pa_entry->e_gid);
+			break;
+		case ACL_GROUP_OBJ:
+			xa_entry->type = SMB_ACL_GROUP_OBJ;
+			break;
+		case ACL_OTHER:
+			xa_entry->type = SMB_ACL_OTHER;
+			break;
+		case ACL_MASK:
+			xa_entry->type = SMB_ACL_MASK;
+			break;
+		default:
+			ksmbd_err("unknown type : 0x%x\n", pa_entry->e_tag);
+			goto out;
+		}
+
+		if (pa_entry->e_perm & ACL_READ)
+			xa_entry->perm |= SMB_ACL_READ;
+		if (pa_entry->e_perm & ACL_WRITE)
+			xa_entry->perm |= SMB_ACL_WRITE;
+		if (pa_entry->e_perm & ACL_EXECUTE)
+			xa_entry->perm |= SMB_ACL_EXECUTE;
+	}
+out:
+	posix_acl_release(posix_acls);
+	return smb_acl;
+}
+
+int ksmbd_vfs_set_sd_xattr(struct ksmbd_conn *conn, struct dentry *dentry,
+		struct smb_ntsd *pntsd, int len)
+{
+	int rc;
+	struct ndr sd_ndr = {0}, acl_ndr = {0};
+	struct xattr_ntacl acl = {0};
+	struct xattr_smb_acl *smb_acl, *def_smb_acl = NULL;
+	struct inode *inode = dentry->d_inode;
+
+	acl.version = 4;
+	acl.hash_type = XATTR_SD_HASH_TYPE_SHA256;
+	acl.current_time = ksmbd_UnixTimeToNT(current_time(dentry->d_inode));
+
+	memcpy(acl.desc, "posix_acl", 9);
+	acl.desc_len = 10;
+
+	pntsd->osidoffset =
+		cpu_to_le32(le32_to_cpu(pntsd->osidoffset) + NDR_NTSD_OFFSETOF);
+	pntsd->gsidoffset =
+		cpu_to_le32(le32_to_cpu(pntsd->gsidoffset) + NDR_NTSD_OFFSETOF);
+	pntsd->dacloffset =
+		cpu_to_le32(le32_to_cpu(pntsd->dacloffset) + NDR_NTSD_OFFSETOF);
+
+	acl.sd_buf = (char *)pntsd;
+	acl.sd_size = len;
+
+	rc = ksmbd_gen_sd_hash(conn, acl.sd_buf, acl.sd_size, acl.hash);
+	if (rc) {
+		ksmbd_err("failed to generate hash for ndr acl\n");
+		return rc;
+	}
+
+	smb_acl = ksmbd_vfs_make_xattr_posix_acl(dentry->d_inode, ACL_TYPE_ACCESS);
+	if (S_ISDIR(inode->i_mode))
+		def_smb_acl = ksmbd_vfs_make_xattr_posix_acl(dentry->d_inode,
+				ACL_TYPE_DEFAULT);
+
+	rc = ndr_encode_posix_acl(&acl_ndr, inode, smb_acl, def_smb_acl);
+	if (rc) {
+		ksmbd_err("failed to encode ndr to posix acl\n");
+		goto out;
+	}
+
+	rc = ksmbd_gen_sd_hash(conn, acl_ndr.data, acl_ndr.offset,
+			acl.posix_acl_hash);
+	if (rc) {
+		ksmbd_err("failed to generate hash for ndr acl\n");
+		goto out;
+	}
+
+	rc = ndr_encode_v4_ntacl(&sd_ndr, &acl);
+	if (rc) {
+		ksmbd_err("failed to encode ndr to posix acl\n");
+		goto out;
+	}
+
+	rc = ksmbd_vfs_setxattr(dentry, XATTR_NAME_SD, sd_ndr.data,
+			sd_ndr.offset, 0);
+	if (rc < 0)
+		ksmbd_err("Failed to store XATTR ntacl :%d\n", rc);
+
+	kfree(sd_ndr.data);
+out:
+	kfree(acl_ndr.data);
+	kfree(smb_acl);
+	kfree(def_smb_acl);
+	return rc;
+}
+
+int ksmbd_vfs_get_sd_xattr(struct ksmbd_conn *conn, struct dentry *dentry,
+		struct smb_ntsd **pntsd)
+{
+	int rc;
+	struct ndr n;
+
+	rc = ksmbd_vfs_getxattr(dentry, XATTR_NAME_SD, &n.data);
+	if (rc > 0) {
+		struct inode *inode = dentry->d_inode;
+		struct ndr acl_ndr = {0};
+		struct xattr_ntacl acl;
+		struct xattr_smb_acl *smb_acl = NULL, *def_smb_acl = NULL;
+		__u8 cmp_hash[XATTR_SD_HASH_SIZE] = {0};
+
+		n.length = rc;
+		rc = ndr_decode_v4_ntacl(&n, &acl);
+		if (rc)
+			return rc;
+
+		smb_acl = ksmbd_vfs_make_xattr_posix_acl(inode,
+				ACL_TYPE_ACCESS);
+		if (S_ISDIR(inode->i_mode))
+			def_smb_acl = ksmbd_vfs_make_xattr_posix_acl(inode,
+					ACL_TYPE_DEFAULT);
+
+		rc = ndr_encode_posix_acl(&acl_ndr, inode, smb_acl, def_smb_acl);
+		if (rc) {
+			ksmbd_err("failed to encode ndr to posix acl\n");
+			goto out;
+		}
+
+		rc = ksmbd_gen_sd_hash(conn, acl_ndr.data, acl_ndr.offset,
+				cmp_hash);
+		if (rc) {
+			ksmbd_err("failed to generate hash for ndr acl\n");
+			goto out;
+		}
+
+		if (memcmp(cmp_hash, acl.posix_acl_hash, XATTR_SD_HASH_SIZE)) {
+			ksmbd_err("hash value diff\n");
+			rc = -EINVAL;
+			goto out;
+		}
+
+		*pntsd = acl.sd_buf;
+		(*pntsd)->osidoffset =
+			cpu_to_le32(le32_to_cpu((*pntsd)->osidoffset) - NDR_NTSD_OFFSETOF);
+		(*pntsd)->gsidoffset =
+			cpu_to_le32(le32_to_cpu((*pntsd)->gsidoffset) - NDR_NTSD_OFFSETOF);
+		(*pntsd)->dacloffset =
+			cpu_to_le32(le32_to_cpu((*pntsd)->dacloffset) - NDR_NTSD_OFFSETOF);
+
+		rc = acl.sd_size;
+out:
+		kfree(n.data);
+		kfree(acl_ndr.data);
+		kfree(smb_acl);
+		kfree(def_smb_acl);
+	}
+
+	return rc;
+}
+
+int ksmbd_vfs_set_dos_attrib_xattr(struct dentry *dentry,
+		struct xattr_dos_attrib *da)
+{
+	struct ndr n;
+	int err;
+
+	err = ndr_encode_dos_attr(&n, da);
+	if (err)
+		return err;
+
+	err = ksmbd_vfs_setxattr(dentry,
+			XATTR_NAME_DOS_ATTRIBUTE,
+			(void *)n.data,
+			n.offset,
+			0);
+	if (err)
+		ksmbd_debug(SMB, "failed to store dos attribute in xattr\n");
+	kfree(n.data);
+
+	return err;
+}
+
+int ksmbd_vfs_get_dos_attrib_xattr(struct dentry *dentry,
+		struct xattr_dos_attrib *da)
+{
+	struct ndr n;
+	int err;
+
+	err = ksmbd_vfs_getxattr(dentry,
+			XATTR_NAME_DOS_ATTRIBUTE,
+			(char **)&n.data);
+	if (err > 0) {
+		n.length = err;
+		if (ndr_decode_dos_attr(&n, da))
+			err = -EINVAL;
+		kfree(n.data);
+	} else {
+		ksmbd_debug(SMB, "failed to load dos attribute in xattr\n");
+	}
+
+	return err;
+}
+
+struct posix_acl *ksmbd_vfs_posix_acl_alloc(int count, gfp_t flags)
+{
+#if IS_ENABLED(CONFIG_FS_POSIX_ACL)
+	return posix_acl_alloc(count, flags);
+#else
+	return NULL;
+#endif
+}
+
+struct posix_acl *ksmbd_vfs_get_acl(struct inode *inode, int type)
+{
+#if IS_ENABLED(CONFIG_FS_POSIX_ACL)
+	return get_acl(inode, type);
+#else
+	return NULL;
+#endif
+}
+
+int ksmbd_vfs_set_posix_acl(struct inode *inode, int type,
+		struct posix_acl *acl)
+{
+#if IS_ENABLED(CONFIG_FS_POSIX_ACL)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	return set_posix_acl(&init_user_ns, inode, type, acl);
+#else
+	return set_posix_acl(inode, type, acl);
+#endif
+#else
+	return -EOPNOTSUPP;
+#endif
+}
+
+/**
+ * ksmbd_vfs_set_fadvise() - convert smb IO caching options to linux options
+ * @filp:	file pointer for IO
+ * @options:	smb IO options
+ */
+void ksmbd_vfs_set_fadvise(struct file *filp, __le32 option)
+{
+	struct address_space *mapping;
+
+	mapping = filp->f_mapping;
+
+	if (!option || !mapping)
+		return;
+
+	if (option & FILE_WRITE_THROUGH_LE) {
+		filp->f_flags |= O_SYNC;
+	} else if (option & FILE_SEQUENTIAL_ONLY_LE) {
+		filp->f_ra.ra_pages = inode_to_bdi(mapping->host)->ra_pages * 2;
+		spin_lock(&filp->f_lock);
+		filp->f_mode &= ~FMODE_RANDOM;
+		spin_unlock(&filp->f_lock);
+	} else if (option & FILE_RANDOM_ACCESS_LE) {
+		spin_lock(&filp->f_lock);
+		filp->f_mode |= FMODE_RANDOM;
+		spin_unlock(&filp->f_lock);
+	}
+}
+
+/**
+ * ksmbd_vfs_lock() - vfs helper for smb file locking
+ * @filp:	the file to apply the lock to
+ * @cmd:	type of locking operation (F_SETLK, F_GETLK, etc.)
+ * @flock:	The lock to be applied
+ *
+ * Return:	0 on success, otherwise error
+ */
+int ksmbd_vfs_lock(struct file *filp, int cmd,
+			struct file_lock *flock)
+{
+	ksmbd_debug(VFS, "calling vfs_lock_file\n");
+	return vfs_lock_file(filp, cmd, flock, NULL);
+}
+
+int ksmbd_vfs_readdir(struct file *file, struct ksmbd_readdir_data *rdata)
+{
+	return iterate_dir(file, &rdata->ctx);
+}
+
+int ksmbd_vfs_alloc_size(struct ksmbd_work *work, struct ksmbd_file *fp,
+		loff_t len)
+{
+	smb_break_all_levII_oplock(work, fp, 1);
+	return vfs_fallocate(fp->filp, FALLOC_FL_KEEP_SIZE, 0, len);
+}
+
+int ksmbd_vfs_zero_data(struct ksmbd_work *work, struct ksmbd_file *fp,
+		loff_t off, loff_t len)
+{
+	smb_break_all_levII_oplock(work, fp, 1);
+	if (fp->f_ci->m_fattr & ATTR_SPARSE_FILE_LE)
+		return vfs_fallocate(fp->filp,
+			FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, off, len);
+
+	return vfs_fallocate(fp->filp, FALLOC_FL_ZERO_RANGE, off, len);
+}
+
+int ksmbd_vfs_fqar_lseek(struct ksmbd_file *fp, loff_t start, loff_t length,
+		struct file_allocated_range_buffer *ranges, int in_count,
+		int *out_count)
+{
+	struct file *f = fp->filp;
+	struct inode *inode = FP_INODE(fp);
+	loff_t maxbytes = (u64)inode->i_sb->s_maxbytes, end;
+	loff_t extent_start, extent_end;
+	int ret = 0;
+
+	if (start > maxbytes)
+		return -EFBIG;
+
+	if (!in_count)
+		return 0;
+
+	/*
+	 * Shrink request scope to what the fs can actually handle.
+	 */
+	if (length > maxbytes || (maxbytes - length) < start)
+		length = maxbytes - start;
+
+	if (start + length > inode->i_size)
+		length = inode->i_size - start;
+
+	*out_count = 0;
+	end = start + length;
+	while (start < end && *out_count < in_count) {
+		extent_start = f->f_op->llseek(f, start, SEEK_DATA);
+		if (extent_start < 0) {
+			if (extent_start != -ENXIO)
+				ret = (int)extent_start;
+			break;
+		}
+
+		if (extent_start >= end)
+			break;
+
+		extent_end = f->f_op->llseek(f, extent_start, SEEK_HOLE);
+		if (extent_end < 0) {
+			if (extent_end != -ENXIO)
+				ret = (int)extent_end;
+			break;
+		} else if (extent_start >= extent_end) {
+			break;
+		}
+
+		ranges[*out_count].file_offset = cpu_to_le64(extent_start);
+		ranges[(*out_count)++].length =
+			cpu_to_le64(min(extent_end, end) - extent_start);
+
+		start = extent_end;
+	}
+
+	return ret;
+}
+
+int ksmbd_vfs_remove_xattr(struct dentry *dentry, char *attr_name)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	return vfs_removexattr(&init_user_ns, dentry, attr_name);
+#else
+	return vfs_removexattr(dentry, attr_name);
+#endif
+}
+
+int ksmbd_vfs_unlink(struct dentry *dir, struct dentry *dentry)
+{
+	struct dentry *child;
+	int err = 0;
+
+	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
+	dget(dentry);
+	child = lookup_one_len(dentry->d_name.name, dir,
+			dentry->d_name.len);
+	if (IS_ERR(child)) {
+		err = PTR_ERR(child);
+		goto out;
+	}
+
+	if (child != dentry) {
+		err = -ESTALE;
+		dput(child);
+		goto out;
+	}
+	dput(child);
+
+	if (S_ISDIR(d_inode(dentry)->i_mode))
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+		err = vfs_rmdir(&init_user_ns, d_inode(dir), dentry);
+	else
+		err = vfs_unlink(&init_user_ns, d_inode(dir), dentry, NULL);
+#else
+		err = vfs_rmdir(d_inode(dir), dentry);
+	else
+		err = vfs_unlink(d_inode(dir), dentry, NULL);
+#endif
+
+out:
+	dput(dentry);
+	inode_unlock(d_inode(dir));
+	if (err)
+		ksmbd_debug(VFS, "failed to delete, err %d\n", err);
+
+	return err;
+}
+
+/*
+ * ksmbd_vfs_get_logical_sector_size() - get logical sector size from inode
+ * @inode: inode
+ *
+ * Return: logical sector size
+ */
+unsigned short ksmbd_vfs_logical_sector_size(struct inode *inode)
+{
+	struct request_queue *q;
+	unsigned short ret_val = 512;
+
+	if (!inode->i_sb->s_bdev)
+		return ret_val;
+
+	q = inode->i_sb->s_bdev->bd_disk->queue;
+
+	if (q && q->limits.logical_block_size)
+		ret_val = q->limits.logical_block_size;
+
+	return ret_val;
+}
+
+/*
+ * ksmbd_vfs_get_smb2_sector_size() - get fs sector sizes
+ * @inode: inode
+ * @fs_ss: fs sector size struct
+ */
+void ksmbd_vfs_smb2_sector_size(struct inode *inode,
+		struct ksmbd_fs_sector_size *fs_ss)
+{
+	struct request_queue *q;
+
+	fs_ss->logical_sector_size = 512;
+	fs_ss->physical_sector_size = 512;
+	fs_ss->optimal_io_size = 512;
+
+	if (!inode->i_sb->s_bdev)
+		return;
+
+	q = inode->i_sb->s_bdev->bd_disk->queue;
+
+	if (q) {
+		if (q->limits.logical_block_size)
+			fs_ss->logical_sector_size =
+				q->limits.logical_block_size;
+		if (q->limits.physical_block_size)
+			fs_ss->physical_sector_size =
+				q->limits.physical_block_size;
+		if (q->limits.io_opt)
+			fs_ss->optimal_io_size = q->limits.io_opt;
+	}
+}
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+/**
+ * ksmbd_vfs_dentry_open() - open a dentry and provide fid for it
+ * @work:	smb work ptr
+ * @path:	path of dentry to be opened
+ * @flags:	open flags
+ * @ret_id:	fid returned on this
+ * @option:	file access pattern options for fadvise
+ * @fexist:	file already present or not
+ *
+ * Return:	0 on success, otherwise error
+ */
+struct ksmbd_file *ksmbd_vfs_dentry_open(struct ksmbd_work *work,
+		const struct path *path, int flags, __le32 option, int fexist)
+{
+	struct file *filp;
+	int err = 0;
+	struct ksmbd_file *fp = NULL;
+
+	filp = dentry_open(path, flags | O_LARGEFILE, current_cred());
+	if (IS_ERR(filp)) {
+		err = PTR_ERR(filp);
+		ksmbd_err("dentry open failed, err %d\n", err);
+		return ERR_PTR(err);
+	}
+
+	ksmbd_vfs_set_fadvise(filp, option);
+
+	fp = ksmbd_open_fd(work, filp);
+	if (IS_ERR(fp)) {
+		fput(filp);
+		err = PTR_ERR(fp);
+		ksmbd_err("id insert failed\n");
+		goto err_out;
+	}
+
+	if (flags & O_TRUNC) {
+		if (fexist)
+			smb_break_all_oplock(work, fp);
+		err = vfs_truncate((struct path *)path, 0);
+		if (err)
+			goto err_out;
+	}
+	return fp;
+
+err_out:
+	if (!IS_ERR(fp))
+		ksmbd_close_fd(work, fp->volatile_id);
+	if (err) {
+		fp = ERR_PTR(err);
+		ksmbd_err("err : %d\n", err);
+	}
+	return fp;
+}
+#else
+struct ksmbd_file *ksmbd_vfs_dentry_open(struct ksmbd_work *work,
+		const struct path *path, int flags, __le32 option, int fexist)
+{
+	return NULL;
+}
+#endif
+
+static int __dir_empty(struct dir_context *ctx, const char *name, int namlen,
+		loff_t offset, u64 ino, unsigned int d_type)
+{
+	struct ksmbd_readdir_data *buf;
+
+	buf = container_of(ctx, struct ksmbd_readdir_data, ctx);
+	buf->dirent_count++;
+
+	if (buf->dirent_count > 2)
+		return -ENOTEMPTY;
+	return 0;
+}
+
+/**
+ * ksmbd_vfs_empty_dir() - check for empty directory
+ * @fp:	ksmbd file pointer
+ *
+ * Return:	true if directory empty, otherwise false
+ */
+int ksmbd_vfs_empty_dir(struct ksmbd_file *fp)
+{
+	int err;
+	struct ksmbd_readdir_data readdir_data;
+
+	memset(&readdir_data, 0, sizeof(struct ksmbd_readdir_data));
+
+	set_ctx_actor(&readdir_data.ctx, __dir_empty);
+	readdir_data.dirent_count = 0;
+
+	err = ksmbd_vfs_readdir(fp->filp, &readdir_data);
+	if (readdir_data.dirent_count > 2)
+		err = -ENOTEMPTY;
+	else
+		err = 0;
+	return err;
+}
+
+static int __caseless_lookup(struct dir_context *ctx, const char *name,
+		int namlen, loff_t offset, u64 ino, unsigned int d_type)
+{
+	struct ksmbd_readdir_data *buf;
+
+	buf = container_of(ctx, struct ksmbd_readdir_data, ctx);
+
+	if (buf->used != namlen)
+		return 0;
+	if (!strncasecmp((char *)buf->private, name, namlen)) {
+		memcpy((char *)buf->private, name, namlen);
+		buf->dirent_count = 1;
+		return -EEXIST;
+	}
+	return 0;
+}
+
+/**
+ * ksmbd_vfs_lookup_in_dir() - lookup a file in a directory
+ * @dir:	path info
+ * @name:	filename to lookup
+ * @namelen:	filename length
+ *
+ * Return:	0 on success, otherwise error
+ */
+static int ksmbd_vfs_lookup_in_dir(struct path *dir, char *name, size_t namelen)
+{
+	int ret;
+	struct file *dfilp;
+	int flags = O_RDONLY | O_LARGEFILE;
+	struct ksmbd_readdir_data readdir_data = {
+		.ctx.actor	= __caseless_lookup,
+		.private	= name,
+		.used		= namelen,
+		.dirent_count	= 0,
+	};
+
+	dfilp = dentry_open(dir, flags, current_cred());
+	if (IS_ERR(dfilp))
+		return PTR_ERR(dfilp);
+
+	ret = ksmbd_vfs_readdir(dfilp, &readdir_data);
+	if (readdir_data.dirent_count > 0)
+		ret = 0;
+	fput(dfilp);
+	return ret;
+}
+
+/**
+ * ksmbd_vfs_kern_path() - lookup a file and get path info
+ * @name:	name of file for lookup
+ * @flags:	lookup flags
+ * @path:	if lookup succeed, return path info
+ * @caseless:	caseless filename lookup
+ *
+ * Return:	0 on success, otherwise error
+ */
+int ksmbd_vfs_kern_path(char *name, unsigned int flags, struct path *path,
+		bool caseless)
+{
+	int err;
+
+	if (name[0] != '/')
+		return -EINVAL;
+
+	err = kern_path(name, flags, path);
+	if (!err)
+		return 0;
+
+	if (caseless) {
+		char *filepath;
+		struct path parent;
+		size_t path_len, remain_len;
+
+		filepath = kstrdup(name, GFP_KERNEL);
+		if (!filepath)
+			return -ENOMEM;
+
+		path_len = strlen(filepath);
+		remain_len = path_len - 1;
+
+		err = kern_path("/", flags, &parent);
+		if (err)
+			goto out;
+
+		while (d_can_lookup(parent.dentry)) {
+			char *filename = filepath + path_len - remain_len;
+			char *next = strchrnul(filename, '/');
+			size_t filename_len = next - filename;
+			bool is_last = !next[0];
+
+			if (filename_len == 0)
+				break;
+
+			err = ksmbd_vfs_lookup_in_dir(&parent, filename,
+						      filename_len);
+			if (err) {
+				path_put(&parent);
+				goto out;
+			}
+
+			path_put(&parent);
+			next[0] = '\0';
+
+			err = kern_path(filepath, flags, &parent);
+			if (err)
+				goto out;
+
+			if (is_last) {
+				path->mnt = parent.mnt;
+				path->dentry = parent.dentry;
+				goto out;
+			}
+
+			next[0] = '/';
+			remain_len -= filename_len + 1;
+		}
+
+		path_put(&parent);
+		err = -EINVAL;
+out:
+		kfree(filepath);
+	}
+	return err;
+}
+
+/**
+ * ksmbd_vfs_init_kstat() - convert unix stat information to smb stat format
+ * @p:          destination buffer
+ * @ksmbd_kstat:      ksmbd kstat wrapper
+ */
+void *ksmbd_vfs_init_kstat(char **p, struct ksmbd_kstat *ksmbd_kstat)
+{
+	struct file_directory_info *info = (struct file_directory_info *)(*p);
+	struct kstat *kstat = ksmbd_kstat->kstat;
+	u64 time;
+
+	info->FileIndex = 0;
+	info->CreationTime = cpu_to_le64(ksmbd_kstat->create_time);
+	time = ksmbd_UnixTimeToNT(kstat->atime);
+	info->LastAccessTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(kstat->mtime);
+	info->LastWriteTime = cpu_to_le64(time);
+	time = ksmbd_UnixTimeToNT(kstat->ctime);
+	info->ChangeTime = cpu_to_le64(time);
+
+	if (ksmbd_kstat->file_attributes & ATTR_DIRECTORY_LE) {
+		info->EndOfFile = 0;
+		info->AllocationSize = 0;
+	} else {
+		info->EndOfFile = cpu_to_le64(kstat->size);
+		info->AllocationSize = cpu_to_le64(kstat->blocks << 9);
+	}
+	info->ExtFileAttributes = ksmbd_kstat->file_attributes;
+
+	return info;
+}
+
+int ksmbd_vfs_fill_dentry_attrs(struct ksmbd_work *work, struct dentry *dentry,
+		struct ksmbd_kstat *ksmbd_kstat)
+{
+	u64 time;
+	int rc;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	generic_fillattr(&init_user_ns, d_inode(dentry), ksmbd_kstat->kstat);
+#else
+	generic_fillattr(d_inode(dentry), ksmbd_kstat->kstat);
+#endif
+
+	time = ksmbd_UnixTimeToNT(ksmbd_kstat->kstat->ctime);
+	ksmbd_kstat->create_time = time;
+
+	/*
+	 * set default value for the case that store dos attributes is not yes
+	 * or that acl is disable in server's filesystem and the config is yes.
+	 */
+	if (S_ISDIR(ksmbd_kstat->kstat->mode))
+		ksmbd_kstat->file_attributes = ATTR_DIRECTORY_LE;
+	else
+		ksmbd_kstat->file_attributes = ATTR_ARCHIVE_LE;
+
+	if (test_share_config_flag(work->tcon->share_conf,
+				   KSMBD_SHARE_FLAG_STORE_DOS_ATTRS)) {
+		struct xattr_dos_attrib da;
+
+		rc = ksmbd_vfs_get_dos_attrib_xattr(dentry, &da);
+		if (rc > 0) {
+			ksmbd_kstat->file_attributes = cpu_to_le32(da.attr);
+			ksmbd_kstat->create_time = da.create_time;
+		} else {
+			ksmbd_debug(VFS, "fail to load dos attribute.\n");
+		}
+	}
+
+	return 0;
+}
+
+ssize_t ksmbd_vfs_casexattr_len(struct dentry *dentry, char *attr_name,
+		int attr_name_len)
+{
+	char *name, *xattr_list = NULL;
+	ssize_t value_len = -ENOENT, xattr_list_len;
+
+	xattr_list_len = ksmbd_vfs_listxattr(dentry, &xattr_list);
+	if (xattr_list_len <= 0)
+		goto out;
+
+	for (name = xattr_list; name - xattr_list < xattr_list_len;
+			name += strlen(name) + 1) {
+		ksmbd_debug(VFS, "%s, len %zd\n", name, strlen(name));
+		if (strncasecmp(attr_name, name, attr_name_len))
+			continue;
+
+		value_len = ksmbd_vfs_xattr_len(dentry, name);
+		break;
+	}
+
+out:
+	kvfree(xattr_list);
+	return value_len;
+}
+
+int ksmbd_vfs_xattr_stream_name(char *stream_name, char **xattr_stream_name,
+		size_t *xattr_stream_name_size, int s_type)
+{
+	int stream_name_size;
+	char *xattr_stream_name_buf;
+	char *type;
+	int type_len;
+
+	if (s_type == DIR_STREAM)
+		type = ":$INDEX_ALLOCATION";
+	else
+		type = ":$DATA";
+
+	type_len = strlen(type);
+	stream_name_size = strlen(stream_name);
+	*xattr_stream_name_size = stream_name_size + XATTR_NAME_STREAM_LEN + 1;
+	xattr_stream_name_buf = kmalloc(*xattr_stream_name_size + type_len,
+			GFP_KERNEL);
+	if (!xattr_stream_name_buf)
+		return -ENOMEM;
+
+	memcpy(xattr_stream_name_buf,
+		XATTR_NAME_STREAM,
+		XATTR_NAME_STREAM_LEN);
+
+	if (stream_name_size) {
+		memcpy(&xattr_stream_name_buf[XATTR_NAME_STREAM_LEN],
+			stream_name,
+			stream_name_size);
+	}
+	memcpy(&xattr_stream_name_buf[*xattr_stream_name_size - 1], type, type_len);
+		*xattr_stream_name_size += type_len;
+
+	xattr_stream_name_buf[*xattr_stream_name_size - 1] = '\0';
+	*xattr_stream_name = xattr_stream_name_buf;
+
+	return 0;
+}
+
+static int ksmbd_vfs_copy_file_range(struct file *file_in, loff_t pos_in,
+		struct file *file_out, loff_t pos_out, size_t len)
+{
+	struct inode *inode_in = file_inode(file_in);
+	struct inode *inode_out = file_inode(file_out);
+	int ret;
+
+	ret = vfs_copy_file_range(file_in, pos_in, file_out, pos_out, len, 0);
+	/* do splice for the copy between different file systems */
+	if (ret != -EXDEV)
+		return ret;
+
+	if (S_ISDIR(inode_in->i_mode) || S_ISDIR(inode_out->i_mode))
+		return -EISDIR;
+	if (!S_ISREG(inode_in->i_mode) || !S_ISREG(inode_out->i_mode))
+		return -EINVAL;
+
+	if (!(file_in->f_mode & FMODE_READ) ||
+	    !(file_out->f_mode & FMODE_WRITE))
+		return -EBADF;
+
+	if (len == 0)
+		return 0;
+
+	file_start_write(file_out);
+
+	/*
+	 * skip the verification of the range of data. it will be done
+	 * in do_splice_direct
+	 */
+	ret = do_splice_direct(file_in, &pos_in, file_out, &pos_out,
+			len > MAX_RW_COUNT ? MAX_RW_COUNT : len, 0);
+	if (ret > 0) {
+		fsnotify_access(file_in);
+		add_rchar(current, ret);
+		fsnotify_modify(file_out);
+		add_wchar(current, ret);
+	}
+
+	inc_syscr(current);
+	inc_syscw(current);
+
+	file_end_write(file_out);
+	return ret;
+}
+
+int ksmbd_vfs_copy_file_ranges(struct ksmbd_work *work,
+		struct ksmbd_file *src_fp, struct ksmbd_file *dst_fp,
+		struct srv_copychunk *chunks, unsigned int chunk_count,
+		unsigned int *chunk_count_written,
+		unsigned int *chunk_size_written, loff_t *total_size_written)
+{
+	unsigned int i;
+	loff_t src_off, dst_off, src_file_size;
+	size_t len;
+	int ret;
+
+	*chunk_count_written = 0;
+	*chunk_size_written = 0;
+	*total_size_written = 0;
+
+	if (!(src_fp->daccess & (FILE_READ_DATA_LE | FILE_EXECUTE_LE))) {
+		ksmbd_err("no right to read(%s)\n", FP_FILENAME(src_fp));
+		return -EACCES;
+	}
+	if (!(dst_fp->daccess & (FILE_WRITE_DATA_LE | FILE_APPEND_DATA_LE))) {
+		ksmbd_err("no right to write(%s)\n", FP_FILENAME(dst_fp));
+		return -EACCES;
+	}
+
+	if (ksmbd_stream_fd(src_fp) || ksmbd_stream_fd(dst_fp))
+		return -EBADF;
+
+	smb_break_all_levII_oplock(work, dst_fp, 1);
+
+	if (!work->tcon->posix_extensions) {
+		for (i = 0; i < chunk_count; i++) {
+			src_off = le64_to_cpu(chunks[i].SourceOffset);
+			dst_off = le64_to_cpu(chunks[i].TargetOffset);
+			len = le32_to_cpu(chunks[i].Length);
+
+			if (check_lock_range(src_fp->filp, src_off,
+					     src_off + len - 1, READ))
+				return -EAGAIN;
+			if (check_lock_range(dst_fp->filp, dst_off,
+					     dst_off + len - 1, WRITE))
+				return -EAGAIN;
+		}
+	}
+
+	src_file_size = i_size_read(file_inode(src_fp->filp));
+
+	for (i = 0; i < chunk_count; i++) {
+		src_off = le64_to_cpu(chunks[i].SourceOffset);
+		dst_off = le64_to_cpu(chunks[i].TargetOffset);
+		len = le32_to_cpu(chunks[i].Length);
+
+		if (src_off + len > src_file_size)
+			return -E2BIG;
+
+		ret = ksmbd_vfs_copy_file_range(src_fp->filp, src_off,
+				dst_fp->filp, dst_off, len);
+		if (ret < 0)
+			return ret;
+
+		*chunk_count_written += 1;
+		*total_size_written += ret;
+	}
+	return 0;
+}
+
+int ksmbd_vfs_posix_lock_wait(struct file_lock *flock)
+{
+	return wait_event_interruptible(flock->fl_wait, !flock->fl_blocker);
+}
+
+int ksmbd_vfs_posix_lock_wait_timeout(struct file_lock *flock, long timeout)
+{
+	return wait_event_interruptible_timeout(flock->fl_wait,
+						!flock->fl_blocker,
+						timeout);
+}
+
+void ksmbd_vfs_posix_lock_unblock(struct file_lock *flock)
+{
+	locks_delete_block(flock);
+}
+
+int ksmbd_vfs_set_init_posix_acl(struct inode *inode)
+{
+	struct posix_acl_state acl_state;
+	struct posix_acl *acls;
+	int rc;
+
+	ksmbd_debug(SMB, "Set posix acls\n");
+	rc = init_acl_state(&acl_state, 1);
+	if (rc)
+		return rc;
+
+	/* Set default owner group */
+	acl_state.owner.allow = (inode->i_mode & 0700) >> 6;
+	acl_state.group.allow = (inode->i_mode & 0070) >> 3;
+	acl_state.other.allow = inode->i_mode & 0007;
+	acl_state.users->aces[acl_state.users->n].uid = inode->i_uid;
+	acl_state.users->aces[acl_state.users->n++].perms.allow =
+		acl_state.owner.allow;
+	acl_state.groups->aces[acl_state.groups->n].gid = inode->i_gid;
+	acl_state.groups->aces[acl_state.groups->n++].perms.allow =
+		acl_state.group.allow;
+	acl_state.mask.allow = 0x07;
+
+	acls = ksmbd_vfs_posix_acl_alloc(6, GFP_KERNEL);
+	if (!acls) {
+		free_acl_state(&acl_state);
+		return -ENOMEM;
+	}
+	posix_state_to_acl(&acl_state, acls->a_entries);
+	rc = ksmbd_vfs_set_posix_acl(inode, ACL_TYPE_ACCESS, acls);
+	if (rc < 0)
+		ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_ACCESS) failed, rc : %d\n",
+				rc);
+	else if (S_ISDIR(inode->i_mode)) {
+		posix_state_to_acl(&acl_state, acls->a_entries);
+		rc = ksmbd_vfs_set_posix_acl(inode, ACL_TYPE_DEFAULT, acls);
+		if (rc < 0)
+			ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_DEFAULT) failed, rc : %d\n",
+					rc);
+	}
+	free_acl_state(&acl_state);
+	posix_acl_release(acls);
+	return rc;
+}
+
+int ksmbd_vfs_inherit_posix_acl(struct inode *inode, struct inode *parent_inode)
+{
+	struct posix_acl *acls;
+	struct posix_acl_entry *pace;
+	int rc, i;
+
+	acls = ksmbd_vfs_get_acl(parent_inode, ACL_TYPE_DEFAULT);
+	if (!acls)
+		return -ENOENT;
+	pace = acls->a_entries;
+
+	for (i = 0; i < acls->a_count; i++, pace++) {
+		if (pace->e_tag == ACL_MASK) {
+			pace->e_perm = 0x07;
+			break;
+		}
+	}
+
+	rc = ksmbd_vfs_set_posix_acl(inode, ACL_TYPE_ACCESS, acls);
+	if (rc < 0)
+		ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_ACCESS) failed, rc : %d\n",
+				rc);
+	if (S_ISDIR(inode->i_mode)) {
+		rc = ksmbd_vfs_set_posix_acl(inode, ACL_TYPE_DEFAULT, acls);
+		if (rc < 0)
+			ksmbd_debug(SMB, "Set posix acl(ACL_TYPE_DEFAULT) failed, rc : %d\n",
+					rc);
+	}
+	posix_acl_release(acls);
+	return rc;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./vfs_cache.c linux-5.4.60-fbx/fs/cifsd/vfs_cache.c
--- linux-5.4.60-fbx/fs/cifsd./vfs_cache.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/vfs_cache.c	2021-04-21 10:06:25.188514159 +0200
@@ -0,0 +1,781 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ * Copyright (C) 2019 Samsung Electronics Co., Ltd.
+ */
+
+#include <linux/fs.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+
+#include "glob.h"
+#include "vfs_cache.h"
+#include "buffer_pool.h"
+#include "oplock.h"
+#include "vfs.h"
+#include "connection.h"
+#include "mgmt/tree_connect.h"
+#include "mgmt/user_session.h"
+#include "smb_common.h"
+
+#define S_DEL_PENDING			1
+#define S_DEL_ON_CLS			2
+#define S_DEL_ON_CLS_STREAM		8
+
+static unsigned int inode_hash_mask __read_mostly;
+static unsigned int inode_hash_shift __read_mostly;
+static struct hlist_head *inode_hashtable __read_mostly;
+static DEFINE_RWLOCK(inode_hash_lock);
+
+static struct ksmbd_file_table global_ft;
+static atomic_long_t fd_limit;
+
+void ksmbd_set_fd_limit(unsigned long limit)
+{
+	limit = min(limit, get_max_files());
+	atomic_long_set(&fd_limit, limit);
+}
+
+static bool fd_limit_depleted(void)
+{
+	long v = atomic_long_dec_return(&fd_limit);
+
+	if (v >= 0)
+		return false;
+	atomic_long_inc(&fd_limit);
+	return true;
+}
+
+static void fd_limit_close(void)
+{
+	atomic_long_inc(&fd_limit);
+}
+
+/*
+ * INODE hash
+ */
+
+static unsigned long inode_hash(struct super_block *sb, unsigned long hashval)
+{
+	unsigned long tmp;
+
+	tmp = (hashval * (unsigned long)sb) ^ (GOLDEN_RATIO_PRIME + hashval) /
+		L1_CACHE_BYTES;
+	tmp = tmp ^ ((tmp ^ GOLDEN_RATIO_PRIME) >> inode_hash_shift);
+	return tmp & inode_hash_mask;
+}
+
+static struct ksmbd_inode *__ksmbd_inode_lookup(struct inode *inode)
+{
+	struct hlist_head *head = inode_hashtable +
+		inode_hash(inode->i_sb, inode->i_ino);
+	struct ksmbd_inode *ci = NULL, *ret_ci = NULL;
+
+	hlist_for_each_entry(ci, head, m_hash) {
+		if (ci->m_inode == inode) {
+			if (atomic_inc_not_zero(&ci->m_count))
+				ret_ci = ci;
+			break;
+		}
+	}
+	return ret_ci;
+}
+
+static struct ksmbd_inode *ksmbd_inode_lookup(struct ksmbd_file *fp)
+{
+	return __ksmbd_inode_lookup(FP_INODE(fp));
+}
+
+static struct ksmbd_inode *ksmbd_inode_lookup_by_vfsinode(struct inode *inode)
+{
+	struct ksmbd_inode *ci;
+
+	read_lock(&inode_hash_lock);
+	ci = __ksmbd_inode_lookup(inode);
+	read_unlock(&inode_hash_lock);
+	return ci;
+}
+
+int ksmbd_query_inode_status(struct inode *inode)
+{
+	struct ksmbd_inode *ci;
+	int ret = KSMBD_INODE_STATUS_UNKNOWN;
+
+	read_lock(&inode_hash_lock);
+	ci = __ksmbd_inode_lookup(inode);
+	if (ci) {
+		ret = KSMBD_INODE_STATUS_OK;
+		if (ci->m_flags & S_DEL_PENDING)
+			ret = KSMBD_INODE_STATUS_PENDING_DELETE;
+		atomic_dec(&ci->m_count);
+	}
+	read_unlock(&inode_hash_lock);
+	return ret;
+}
+
+bool ksmbd_inode_pending_delete(struct ksmbd_file *fp)
+{
+	return (fp->f_ci->m_flags & S_DEL_PENDING);
+}
+
+void ksmbd_set_inode_pending_delete(struct ksmbd_file *fp)
+{
+	fp->f_ci->m_flags |= S_DEL_PENDING;
+}
+
+void ksmbd_clear_inode_pending_delete(struct ksmbd_file *fp)
+{
+	fp->f_ci->m_flags &= ~S_DEL_PENDING;
+}
+
+void ksmbd_fd_set_delete_on_close(struct ksmbd_file *fp,
+				  int file_info)
+{
+	if (ksmbd_stream_fd(fp)) {
+		fp->f_ci->m_flags |= S_DEL_ON_CLS_STREAM;
+		return;
+	}
+
+	fp->f_ci->m_flags |= S_DEL_ON_CLS;
+}
+
+static void ksmbd_inode_hash(struct ksmbd_inode *ci)
+{
+	struct hlist_head *b = inode_hashtable +
+		inode_hash(ci->m_inode->i_sb, ci->m_inode->i_ino);
+
+	hlist_add_head(&ci->m_hash, b);
+}
+
+static void ksmbd_inode_unhash(struct ksmbd_inode *ci)
+{
+	write_lock(&inode_hash_lock);
+	hlist_del_init(&ci->m_hash);
+	write_unlock(&inode_hash_lock);
+}
+
+static int ksmbd_inode_init(struct ksmbd_inode *ci, struct ksmbd_file *fp)
+{
+	ci->m_inode = FP_INODE(fp);
+	atomic_set(&ci->m_count, 1);
+	atomic_set(&ci->op_count, 0);
+	atomic_set(&ci->sop_count, 0);
+	ci->m_flags = 0;
+	ci->m_fattr = 0;
+	INIT_LIST_HEAD(&ci->m_fp_list);
+	INIT_LIST_HEAD(&ci->m_op_list);
+	rwlock_init(&ci->m_lock);
+	return 0;
+}
+
+static struct ksmbd_inode *ksmbd_inode_get(struct ksmbd_file *fp)
+{
+	struct ksmbd_inode *ci, *tmpci;
+	int rc;
+
+	read_lock(&inode_hash_lock);
+	ci = ksmbd_inode_lookup(fp);
+	read_unlock(&inode_hash_lock);
+	if (ci)
+		return ci;
+
+	ci = kmalloc(sizeof(struct ksmbd_inode), GFP_KERNEL);
+	if (!ci)
+		return NULL;
+
+	rc = ksmbd_inode_init(ci, fp);
+	if (rc) {
+		ksmbd_err("inode initialized failed\n");
+		kfree(ci);
+		return NULL;
+	}
+
+	write_lock(&inode_hash_lock);
+	tmpci = ksmbd_inode_lookup(fp);
+	if (!tmpci) {
+		ksmbd_inode_hash(ci);
+	} else {
+		kfree(ci);
+		ci = tmpci;
+	}
+	write_unlock(&inode_hash_lock);
+	return ci;
+}
+
+static void ksmbd_inode_free(struct ksmbd_inode *ci)
+{
+	ksmbd_inode_unhash(ci);
+	kfree(ci);
+}
+
+static void ksmbd_inode_put(struct ksmbd_inode *ci)
+{
+	if (atomic_dec_and_test(&ci->m_count))
+		ksmbd_inode_free(ci);
+}
+
+int __init ksmbd_inode_hash_init(void)
+{
+	unsigned int loop;
+	unsigned long numentries = 16384;
+	unsigned long bucketsize = sizeof(struct hlist_head);
+	unsigned long size;
+
+	inode_hash_shift = ilog2(numentries);
+	inode_hash_mask = (1 << inode_hash_shift) - 1;
+
+	size = bucketsize << inode_hash_shift;
+
+	/* init master fp hash table */
+	inode_hashtable = vmalloc(size);
+	if (!inode_hashtable)
+		return -ENOMEM;
+
+	for (loop = 0; loop < (1U << inode_hash_shift); loop++)
+		INIT_HLIST_HEAD(&inode_hashtable[loop]);
+	return 0;
+}
+
+void ksmbd_release_inode_hash(void)
+{
+	vfree(inode_hashtable);
+}
+
+static void __ksmbd_inode_close(struct ksmbd_file *fp)
+{
+	struct dentry *dir, *dentry;
+	struct ksmbd_inode *ci = fp->f_ci;
+	int err;
+	struct file *filp;
+
+	filp = fp->filp;
+	if (ksmbd_stream_fd(fp) && (ci->m_flags & S_DEL_ON_CLS_STREAM)) {
+		ci->m_flags &= ~S_DEL_ON_CLS_STREAM;
+		err = ksmbd_vfs_remove_xattr(filp->f_path.dentry,
+					     fp->stream.name);
+		if (err)
+			ksmbd_err("remove xattr failed : %s\n",
+				fp->stream.name);
+	}
+
+	if (atomic_dec_and_test(&ci->m_count)) {
+		write_lock(&ci->m_lock);
+		if (ci->m_flags & (S_DEL_ON_CLS | S_DEL_PENDING)) {
+			dentry = filp->f_path.dentry;
+			dir = dentry->d_parent;
+			ci->m_flags &= ~(S_DEL_ON_CLS | S_DEL_PENDING);
+			write_unlock(&ci->m_lock);
+			ksmbd_vfs_unlink(dir, dentry);
+			write_lock(&ci->m_lock);
+		}
+		write_unlock(&ci->m_lock);
+
+		ksmbd_inode_free(ci);
+	}
+}
+
+static void __ksmbd_remove_durable_fd(struct ksmbd_file *fp)
+{
+	if (!HAS_FILE_ID(fp->persistent_id))
+		return;
+
+	write_lock(&global_ft.lock);
+	idr_remove(global_ft.idr, fp->persistent_id);
+	write_unlock(&global_ft.lock);
+}
+
+static void __ksmbd_remove_fd(struct ksmbd_file_table *ft, struct ksmbd_file *fp)
+{
+	if (!HAS_FILE_ID(fp->volatile_id))
+		return;
+
+	write_lock(&fp->f_ci->m_lock);
+	list_del_init(&fp->node);
+	write_unlock(&fp->f_ci->m_lock);
+
+	write_lock(&ft->lock);
+	idr_remove(ft->idr, fp->volatile_id);
+	write_unlock(&ft->lock);
+}
+
+static void __ksmbd_close_fd(struct ksmbd_file_table *ft, struct ksmbd_file *fp)
+{
+	struct file *filp;
+
+	fd_limit_close();
+	__ksmbd_remove_durable_fd(fp);
+	__ksmbd_remove_fd(ft, fp);
+
+	close_id_del_oplock(fp);
+	filp = fp->filp;
+
+	__ksmbd_inode_close(fp);
+	if (!IS_ERR_OR_NULL(filp))
+		fput(filp);
+	kfree(fp->filename);
+	if (ksmbd_stream_fd(fp))
+		kfree(fp->stream.name);
+	ksmbd_free_file_struct(fp);
+}
+
+static struct ksmbd_file *ksmbd_fp_get(struct ksmbd_file *fp)
+{
+	if (!atomic_inc_not_zero(&fp->refcount))
+		return NULL;
+	return fp;
+}
+
+static struct ksmbd_file *__ksmbd_lookup_fd(struct ksmbd_file_table *ft,
+		unsigned int id)
+{
+	struct ksmbd_file *fp;
+
+	read_lock(&ft->lock);
+	fp = idr_find(ft->idr, id);
+	if (fp)
+		fp = ksmbd_fp_get(fp);
+	read_unlock(&ft->lock);
+	return fp;
+}
+
+static void __put_fd_final(struct ksmbd_work *work, struct ksmbd_file *fp)
+{
+	__ksmbd_close_fd(&work->sess->file_table, fp);
+	atomic_dec(&work->conn->stats.open_files_count);
+}
+
+static void set_close_state_blocked_works(struct ksmbd_file *fp)
+{
+	struct ksmbd_work *cancel_work, *ctmp;
+
+	spin_lock(&fp->f_lock);
+	list_for_each_entry_safe(cancel_work, ctmp, &fp->blocked_works,
+			fp_entry) {
+		list_del(&cancel_work->fp_entry);
+		cancel_work->state = KSMBD_WORK_CLOSED;
+		cancel_work->cancel_fn(cancel_work->cancel_argv);
+	}
+	spin_unlock(&fp->f_lock);
+}
+
+int ksmbd_close_fd(struct ksmbd_work *work, unsigned int id)
+{
+	struct ksmbd_file	*fp;
+	struct ksmbd_file_table	*ft;
+
+	if (!HAS_FILE_ID(id))
+		return 0;
+
+	ft = &work->sess->file_table;
+	read_lock(&ft->lock);
+	fp = idr_find(ft->idr, id);
+	if (fp) {
+		set_close_state_blocked_works(fp);
+
+		if (!atomic_dec_and_test(&fp->refcount))
+			fp = NULL;
+	}
+	read_unlock(&ft->lock);
+
+	if (!fp)
+		return -EINVAL;
+
+	__put_fd_final(work, fp);
+	return 0;
+}
+
+void ksmbd_fd_put(struct ksmbd_work *work, struct ksmbd_file *fp)
+{
+	if (!fp)
+		return;
+
+	if (!atomic_dec_and_test(&fp->refcount))
+		return;
+	__put_fd_final(work, fp);
+}
+
+static bool __sanity_check(struct ksmbd_tree_connect *tcon, struct ksmbd_file *fp)
+{
+	if (!fp)
+		return false;
+	if (fp->tcon != tcon)
+		return false;
+	return true;
+}
+
+struct ksmbd_file *ksmbd_lookup_foreign_fd(struct ksmbd_work *work, unsigned int id)
+{
+	return __ksmbd_lookup_fd(&work->sess->file_table, id);
+}
+
+struct ksmbd_file *ksmbd_lookup_fd_fast(struct ksmbd_work *work, unsigned int id)
+{
+	struct ksmbd_file *fp = __ksmbd_lookup_fd(&work->sess->file_table, id);
+
+	if (__sanity_check(work->tcon, fp))
+		return fp;
+
+	ksmbd_fd_put(work, fp);
+	return NULL;
+}
+
+struct ksmbd_file *ksmbd_lookup_fd_slow(struct ksmbd_work *work, unsigned int id,
+		unsigned int pid)
+{
+	struct ksmbd_file *fp;
+
+	if (!HAS_FILE_ID(id)) {
+		id = work->compound_fid;
+		pid = work->compound_pfid;
+	}
+
+	if (!HAS_FILE_ID(id))
+		return NULL;
+
+	fp = __ksmbd_lookup_fd(&work->sess->file_table, id);
+	if (!__sanity_check(work->tcon, fp)) {
+		ksmbd_fd_put(work, fp);
+		return NULL;
+	}
+	if (fp->persistent_id != pid) {
+		ksmbd_fd_put(work, fp);
+		return NULL;
+	}
+	return fp;
+}
+
+struct ksmbd_file *ksmbd_lookup_durable_fd(unsigned long long id)
+{
+	return __ksmbd_lookup_fd(&global_ft, id);
+}
+
+int ksmbd_close_fd_app_id(struct ksmbd_work *work, char *app_id)
+{
+	struct ksmbd_file	*fp = NULL;
+	unsigned int		id;
+
+	read_lock(&global_ft.lock);
+	idr_for_each_entry(global_ft.idr, fp, id) {
+		if (!memcmp(fp->app_instance_id,
+			    app_id,
+			    SMB2_CREATE_GUID_SIZE)) {
+			if (!atomic_dec_and_test(&fp->refcount))
+				fp = NULL;
+			break;
+		}
+	}
+	read_unlock(&global_ft.lock);
+
+	if (!fp)
+		return -EINVAL;
+
+	__put_fd_final(work, fp);
+	return 0;
+}
+
+struct ksmbd_file *ksmbd_lookup_fd_cguid(char *cguid)
+{
+	struct ksmbd_file	*fp = NULL;
+	unsigned int		id;
+
+	read_lock(&global_ft.lock);
+	idr_for_each_entry(global_ft.idr, fp, id) {
+		if (!memcmp(fp->create_guid,
+			    cguid,
+			    SMB2_CREATE_GUID_SIZE)) {
+			fp = ksmbd_fp_get(fp);
+			break;
+		}
+	}
+	read_unlock(&global_ft.lock);
+
+	return fp;
+}
+
+struct ksmbd_file *ksmbd_lookup_fd_filename(struct ksmbd_work *work, char *filename)
+{
+	struct ksmbd_file	*fp = NULL;
+	unsigned int		id;
+
+	read_lock(&work->sess->file_table.lock);
+	idr_for_each_entry(work->sess->file_table.idr, fp, id) {
+		if (!strcmp(fp->filename, filename)) {
+			fp = ksmbd_fp_get(fp);
+			break;
+		}
+	}
+	read_unlock(&work->sess->file_table.lock);
+
+	return fp;
+}
+
+struct ksmbd_file *ksmbd_lookup_fd_inode(struct inode *inode)
+{
+	struct ksmbd_file	*lfp;
+	struct ksmbd_inode	*ci;
+	struct list_head	*cur;
+
+	ci = ksmbd_inode_lookup_by_vfsinode(inode);
+	if (!ci)
+		return NULL;
+
+	read_lock(&ci->m_lock);
+	list_for_each(cur, &ci->m_fp_list) {
+		lfp = list_entry(cur, struct ksmbd_file, node);
+		if (inode == FP_INODE(lfp)) {
+			atomic_dec(&ci->m_count);
+			read_unlock(&ci->m_lock);
+			return lfp;
+		}
+	}
+	atomic_dec(&ci->m_count);
+	read_unlock(&ci->m_lock);
+	return NULL;
+}
+
+#define OPEN_ID_TYPE_VOLATILE_ID	(0)
+#define OPEN_ID_TYPE_PERSISTENT_ID	(1)
+
+static void __open_id_set(struct ksmbd_file *fp, unsigned int id, int type)
+{
+	if (type == OPEN_ID_TYPE_VOLATILE_ID)
+		fp->volatile_id = id;
+	if (type == OPEN_ID_TYPE_PERSISTENT_ID)
+		fp->persistent_id = id;
+}
+
+static int __open_id(struct ksmbd_file_table *ft, struct ksmbd_file *fp,
+		     int type)
+{
+	unsigned int		id = 0;
+	int			ret;
+
+	if (type == OPEN_ID_TYPE_VOLATILE_ID && fd_limit_depleted()) {
+		__open_id_set(fp, KSMBD_NO_FID, type);
+		return -EMFILE;
+	}
+
+	idr_preload(GFP_KERNEL);
+	write_lock(&ft->lock);
+	ret = idr_alloc_cyclic(ft->idr, fp, 0, INT_MAX, GFP_NOWAIT);
+	if (ret >= 0) {
+		id = ret;
+		ret = 0;
+	} else {
+		id = KSMBD_NO_FID;
+		fd_limit_close();
+	}
+
+	__open_id_set(fp, id, type);
+	write_unlock(&ft->lock);
+	idr_preload_end();
+	return ret;
+}
+
+unsigned int ksmbd_open_durable_fd(struct ksmbd_file *fp)
+{
+	__open_id(&global_ft, fp, OPEN_ID_TYPE_PERSISTENT_ID);
+	return fp->persistent_id;
+}
+
+struct ksmbd_file *ksmbd_open_fd(struct ksmbd_work *work, struct file *filp)
+{
+	struct ksmbd_file	*fp;
+	int ret;
+
+	fp = ksmbd_alloc_file_struct();
+	if (!fp) {
+		ksmbd_err("Failed to allocate memory\n");
+		return ERR_PTR(-ENOMEM);
+	}
+
+	INIT_LIST_HEAD(&fp->blocked_works);
+	INIT_LIST_HEAD(&fp->node);
+	spin_lock_init(&fp->f_lock);
+	atomic_set(&fp->refcount, 1);
+
+	fp->filp		= filp;
+	fp->conn		= work->sess->conn;
+	fp->tcon		= work->tcon;
+	fp->volatile_id		= KSMBD_NO_FID;
+	fp->persistent_id	= KSMBD_NO_FID;
+	fp->f_ci		= ksmbd_inode_get(fp);
+
+	if (!fp->f_ci) {
+		ksmbd_free_file_struct(fp);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	ret = __open_id(&work->sess->file_table, fp, OPEN_ID_TYPE_VOLATILE_ID);
+	if (ret) {
+		ksmbd_inode_put(fp->f_ci);
+		ksmbd_free_file_struct(fp);
+		return ERR_PTR(ret);
+	}
+
+	atomic_inc(&work->conn->stats.open_files_count);
+	return fp;
+}
+
+static inline bool is_reconnectable(struct ksmbd_file *fp)
+{
+	struct oplock_info *opinfo = opinfo_get(fp);
+	bool reconn = false;
+
+	if (!opinfo)
+		return false;
+
+	if (opinfo->op_state != OPLOCK_STATE_NONE) {
+		opinfo_put(opinfo);
+		return false;
+	}
+
+	if (fp->is_resilient || fp->is_persistent)
+		reconn = true;
+	else if (fp->is_durable && opinfo->is_lease &&
+		 opinfo->o_lease->state & SMB2_LEASE_HANDLE_CACHING_LE)
+		reconn = true;
+
+	else if (fp->is_durable && opinfo->level == SMB2_OPLOCK_LEVEL_BATCH)
+		reconn = true;
+
+	opinfo_put(opinfo);
+	return reconn;
+}
+
+static int
+__close_file_table_ids(struct ksmbd_file_table *ft, struct ksmbd_tree_connect *tcon,
+		bool (*skip)(struct ksmbd_tree_connect *tcon, struct ksmbd_file *fp))
+{
+	unsigned int			id;
+	struct ksmbd_file		*fp;
+	int				num = 0;
+
+	idr_for_each_entry(ft->idr, fp, id) {
+		if (skip(tcon, fp))
+			continue;
+
+		set_close_state_blocked_works(fp);
+
+		if (!atomic_dec_and_test(&fp->refcount))
+			continue;
+		__ksmbd_close_fd(ft, fp);
+		num++;
+	}
+	return num;
+}
+
+static bool tree_conn_fd_check(struct ksmbd_tree_connect *tcon, struct ksmbd_file *fp)
+{
+	return fp->tcon != tcon;
+}
+
+static bool session_fd_check(struct ksmbd_tree_connect *tcon, struct ksmbd_file *fp)
+{
+	if (!is_reconnectable(fp))
+		return false;
+
+	fp->conn = NULL;
+	fp->tcon = NULL;
+	fp->volatile_id = KSMBD_NO_FID;
+	return true;
+}
+
+void ksmbd_close_tree_conn_fds(struct ksmbd_work *work)
+{
+	int num = __close_file_table_ids(&work->sess->file_table,
+					 work->tcon,
+					 tree_conn_fd_check);
+
+	atomic_sub(num, &work->conn->stats.open_files_count);
+}
+
+void ksmbd_close_session_fds(struct ksmbd_work *work)
+{
+	int num = __close_file_table_ids(&work->sess->file_table,
+					 work->tcon,
+					 session_fd_check);
+
+	atomic_sub(num, &work->conn->stats.open_files_count);
+}
+
+int ksmbd_init_global_file_table(void)
+{
+	return ksmbd_init_file_table(&global_ft);
+}
+
+void ksmbd_free_global_file_table(void)
+{
+	struct ksmbd_file	*fp = NULL;
+	unsigned int		id;
+
+	idr_for_each_entry(global_ft.idr, fp, id) {
+		__ksmbd_remove_durable_fd(fp);
+		ksmbd_free_file_struct(fp);
+	}
+
+	ksmbd_destroy_file_table(&global_ft);
+}
+
+int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp)
+{
+	if (!fp->is_durable || fp->conn || fp->tcon) {
+		ksmbd_err("Invalid durable fd [%p:%p]\n",
+				fp->conn, fp->tcon);
+		return -EBADF;
+	}
+
+	if (HAS_FILE_ID(fp->volatile_id)) {
+		ksmbd_err("Still in use durable fd: %u\n", fp->volatile_id);
+		return -EBADF;
+	}
+
+	fp->conn = work->sess->conn;
+	fp->tcon = work->tcon;
+
+	__open_id(&work->sess->file_table, fp, OPEN_ID_TYPE_VOLATILE_ID);
+	if (!HAS_FILE_ID(fp->volatile_id)) {
+		fp->conn = NULL;
+		fp->tcon = NULL;
+		return -EBADF;
+	}
+	return 0;
+}
+
+int ksmbd_file_table_flush(struct ksmbd_work *work)
+{
+	struct ksmbd_file	*fp = NULL;
+	unsigned int		id;
+	int			ret;
+
+	read_lock(&work->sess->file_table.lock);
+	idr_for_each_entry(work->sess->file_table.idr, fp, id) {
+		ret = ksmbd_vfs_fsync(work, fp->volatile_id, KSMBD_NO_FID);
+		if (ret)
+			break;
+	}
+	read_unlock(&work->sess->file_table.lock);
+	return ret;
+}
+
+int ksmbd_init_file_table(struct ksmbd_file_table *ft)
+{
+	ft->idr = kzalloc(sizeof(struct idr), GFP_KERNEL);
+	if (!ft->idr)
+		return -ENOMEM;
+
+	idr_init(ft->idr);
+	rwlock_init(&ft->lock);
+	return 0;
+}
+
+void ksmbd_destroy_file_table(struct ksmbd_file_table *ft)
+{
+	if (!ft->idr)
+		return;
+
+	__close_file_table_ids(ft, NULL, session_fd_check);
+	idr_destroy(ft->idr);
+	kfree(ft->idr);
+	ft->idr = NULL;
+}
diff -Nruw linux-5.4.60-fbx/fs/cifsd./vfs_cache.h linux-5.4.60-fbx/fs/cifsd/vfs_cache.h
--- linux-5.4.60-fbx/fs/cifsd./vfs_cache.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/vfs_cache.h	2021-04-21 10:06:25.188514159 +0200
@@ -0,0 +1,193 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2019 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __VFS_CACHE_H__
+#define __VFS_CACHE_H__
+
+#include <linux/version.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/rwsem.h>
+#include <linux/spinlock.h>
+#include <linux/idr.h>
+#include <linux/workqueue.h>
+
+#include "vfs.h"
+
+/* Windows style file permissions for extended response */
+#define	FILE_GENERIC_ALL	0x1F01FF
+#define	FILE_GENERIC_READ	0x120089
+#define	FILE_GENERIC_WRITE	0x120116
+#define	FILE_GENERIC_EXECUTE	0X1200a0
+
+#define KSMBD_START_FID		0
+#define KSMBD_NO_FID		(UINT_MAX)
+#define SMB2_NO_FID		(0xFFFFFFFFFFFFFFFFULL)
+
+#define FP_FILENAME(fp)		fp->filp->f_path.dentry->d_name.name
+#define FP_INODE(fp)		fp->filp->f_path.dentry->d_inode
+#define PARENT_INODE(fp)	fp->filp->f_path.dentry->d_parent->d_inode
+
+#define ATTR_FP(fp) (fp->attrib_only && \
+		(fp->cdoption != FILE_OVERWRITE_IF_LE && \
+		fp->cdoption != FILE_OVERWRITE_LE && \
+		fp->cdoption != FILE_SUPERSEDE_LE))
+
+struct ksmbd_conn;
+struct ksmbd_session;
+
+struct ksmbd_lock {
+	struct file_lock *fl;
+	struct list_head glist;
+	struct list_head llist;
+	unsigned int flags;
+	int cmd;
+	int zero_len;
+	unsigned long long start;
+	unsigned long long end;
+};
+
+struct stream {
+	char *name;
+	ssize_t size;
+};
+
+struct ksmbd_inode {
+	rwlock_t			m_lock;
+	atomic_t			m_count;
+	atomic_t			op_count;
+	/* opinfo count for streams */
+	atomic_t			sop_count;
+	struct inode			*m_inode;
+	unsigned int			m_flags;
+	struct hlist_node		m_hash;
+	struct list_head		m_fp_list;
+	struct list_head		m_op_list;
+	struct oplock_info		*m_opinfo;
+	__le32				m_fattr;
+};
+
+struct ksmbd_file {
+	struct file			*filp;
+	char				*filename;
+	unsigned int			persistent_id;
+	unsigned int			volatile_id;
+
+	spinlock_t			f_lock;
+
+	struct ksmbd_inode		*f_ci;
+	struct ksmbd_inode		*f_parent_ci;
+	struct oplock_info __rcu	*f_opinfo;
+	struct ksmbd_conn		*conn;
+	struct ksmbd_tree_connect	*tcon;
+
+	atomic_t			refcount;
+	__le32				daccess;
+	__le32				saccess;
+	__le32				coption;
+	__le32				cdoption;
+	__u64				create_time;
+	__u64				itime;
+
+	bool				is_durable;
+	bool				is_resilient;
+	bool				is_persistent;
+	bool				is_nt_open;
+	bool				attrib_only;
+
+	char				client_guid[16];
+	char				create_guid[16];
+	char				app_instance_id[16];
+
+	struct stream			stream;
+	struct list_head		node;
+	struct list_head		blocked_works;
+
+	int				durable_timeout;
+
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	/* for SMB1 */
+	int				pid;
+
+	/* conflict lock fail count for SMB1 */
+	unsigned int			cflock_cnt;
+	/* last lock failure start offset for SMB1 */
+	unsigned long long		llock_fstart;
+
+	int				dirent_offset;
+#endif
+	/* if ls is happening on directory, below is valid*/
+	struct ksmbd_readdir_data	readdir_data;
+	int				dot_dotdot[2];
+};
+
+static inline void set_ctx_actor(struct dir_context *ctx,
+				 filldir_t actor)
+{
+	ctx->actor = actor;
+}
+
+#define KSMBD_NR_OPEN_DEFAULT BITS_PER_LONG
+
+struct ksmbd_file_table {
+	rwlock_t		lock;
+	struct idr		*idr;
+};
+
+static inline bool HAS_FILE_ID(unsigned long long req)
+{
+	unsigned int id = (unsigned int)req;
+
+	return id < KSMBD_NO_FID;
+}
+
+static inline bool ksmbd_stream_fd(struct ksmbd_file *fp)
+{
+	return fp->stream.name != NULL;
+}
+
+int ksmbd_init_file_table(struct ksmbd_file_table *ft);
+void ksmbd_destroy_file_table(struct ksmbd_file_table *ft);
+int ksmbd_close_fd(struct ksmbd_work *work, unsigned int id);
+struct ksmbd_file *ksmbd_lookup_fd_fast(struct ksmbd_work *work, unsigned int id);
+struct ksmbd_file *ksmbd_lookup_foreign_fd(struct ksmbd_work *work, unsigned int id);
+struct ksmbd_file *ksmbd_lookup_fd_slow(struct ksmbd_work *work, unsigned int id,
+		unsigned int pid);
+void ksmbd_fd_put(struct ksmbd_work *work, struct ksmbd_file *fp);
+int ksmbd_close_fd_app_id(struct ksmbd_work *work, char *app_id);
+struct ksmbd_file *ksmbd_lookup_durable_fd(unsigned long long id);
+struct ksmbd_file *ksmbd_lookup_fd_cguid(char *cguid);
+struct ksmbd_file *ksmbd_lookup_fd_filename(struct ksmbd_work *work, char *filename);
+struct ksmbd_file *ksmbd_lookup_fd_inode(struct inode *inode);
+unsigned int ksmbd_open_durable_fd(struct ksmbd_file *fp);
+struct ksmbd_file *ksmbd_open_fd(struct ksmbd_work *work, struct file *filp);
+void ksmbd_close_tree_conn_fds(struct ksmbd_work *work);
+void ksmbd_close_session_fds(struct ksmbd_work *work);
+int ksmbd_close_inode_fds(struct ksmbd_work *work, struct inode *inode);
+int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp);
+int ksmbd_init_global_file_table(void);
+void ksmbd_free_global_file_table(void);
+int ksmbd_file_table_flush(struct ksmbd_work *work);
+void ksmbd_set_fd_limit(unsigned long limit);
+
+/*
+ * INODE hash
+ */
+int __init ksmbd_inode_hash_init(void);
+void ksmbd_release_inode_hash(void);
+
+enum KSMBD_INODE_STATUS {
+	KSMBD_INODE_STATUS_OK,
+	KSMBD_INODE_STATUS_UNKNOWN,
+	KSMBD_INODE_STATUS_PENDING_DELETE,
+};
+
+int ksmbd_query_inode_status(struct inode *inode);
+bool ksmbd_inode_pending_delete(struct ksmbd_file *fp);
+void ksmbd_set_inode_pending_delete(struct ksmbd_file *fp);
+void ksmbd_clear_inode_pending_delete(struct ksmbd_file *fp);
+void ksmbd_fd_set_delete_on_close(struct ksmbd_file *fp,
+				  int file_info);
+#endif /* __VFS_CACHE_H__ */
diff -Nruw linux-5.4.60-fbx/fs/cifsd./vfs.h linux-5.4.60-fbx/fs/cifsd/vfs.h
--- linux-5.4.60-fbx/fs/cifsd./vfs.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/cifsd/vfs.h	2021-04-21 09:44:50.981838485 +0200
@@ -0,0 +1,289 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ *   Copyright (C) 2016 Namjae Jeon <linkinjeon@kernel.org>
+ *   Copyright (C) 2018 Samsung Electronics Co., Ltd.
+ */
+
+#ifndef __KSMBD_VFS_H__
+#define __KSMBD_VFS_H__
+
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/namei.h>
+#include <uapi/linux/xattr.h>
+#include <linux/posix_acl.h>
+
+#include "smbacl.h"
+
+/* STREAM XATTR PREFIX */
+#define STREAM_PREFIX			"DosStream."
+#define STREAM_PREFIX_LEN		(sizeof(STREAM_PREFIX) - 1)
+#define XATTR_NAME_STREAM		(XATTR_USER_PREFIX STREAM_PREFIX)
+#define XATTR_NAME_STREAM_LEN		(sizeof(XATTR_NAME_STREAM) - 1)
+
+enum {
+	XATTR_DOSINFO_ATTRIB		= 0x00000001,
+	XATTR_DOSINFO_EA_SIZE		= 0x00000002,
+	XATTR_DOSINFO_SIZE		= 0x00000004,
+	XATTR_DOSINFO_ALLOC_SIZE	= 0x00000008,
+	XATTR_DOSINFO_CREATE_TIME	= 0x00000010,
+	XATTR_DOSINFO_CHANGE_TIME	= 0x00000020,
+	XATTR_DOSINFO_ITIME		= 0x00000040
+};
+
+struct xattr_dos_attrib {
+	__u16	version;
+	__u32	flags;
+	__u32	attr;
+	__u32	ea_size;
+	__u64	size;
+	__u64	alloc_size;
+	__u64	create_time;
+	__u64	change_time;
+	__u64	itime;
+};
+
+/* DOS ATTRIBUITE XATTR PREFIX */
+#define DOS_ATTRIBUTE_PREFIX		"DOSATTRIB"
+#define DOS_ATTRIBUTE_PREFIX_LEN	(sizeof(DOS_ATTRIBUTE_PREFIX) - 1)
+#define XATTR_NAME_DOS_ATTRIBUTE	\
+		(XATTR_USER_PREFIX DOS_ATTRIBUTE_PREFIX)
+#define XATTR_NAME_DOS_ATTRIBUTE_LEN	\
+		(sizeof(XATTR_USER_PREFIX DOS_ATTRIBUTE_PREFIX) - 1)
+
+#define XATTR_SD_HASH_TYPE_SHA256	0x1
+#define XATTR_SD_HASH_SIZE		64
+
+#define SMB_ACL_READ			4
+#define SMB_ACL_WRITE			2
+#define SMB_ACL_EXECUTE			1
+
+enum {
+	SMB_ACL_TAG_INVALID = 0,
+	SMB_ACL_USER,
+	SMB_ACL_USER_OBJ,
+	SMB_ACL_GROUP,
+	SMB_ACL_GROUP_OBJ,
+	SMB_ACL_OTHER,
+	SMB_ACL_MASK
+};
+
+struct xattr_acl_entry {
+	int type;
+	uid_t uid;
+	gid_t gid;
+	mode_t perm;
+};
+
+struct xattr_smb_acl {
+	int count;
+	int next;
+	struct xattr_acl_entry entries[0];
+};
+
+struct xattr_ntacl {
+	__u16	version;
+	void	*sd_buf;
+	__u32	sd_size;
+	__u16	hash_type;
+	__u8	desc[10];
+	__u16	desc_len;
+	__u64	current_time;
+	__u8	hash[XATTR_SD_HASH_SIZE];
+	__u8	posix_acl_hash[XATTR_SD_HASH_SIZE];
+};
+
+/* SECURITY DESCRIPTOR XATTR PREFIX */
+#define SD_PREFIX			"NTACL"
+#define SD_PREFIX_LEN	(sizeof(SD_PREFIX) - 1)
+#define XATTR_NAME_SD	\
+		(XATTR_SECURITY_PREFIX SD_PREFIX)
+#define XATTR_NAME_SD_LEN	\
+		(sizeof(XATTR_SECURITY_PREFIX SD_PREFIX) - 1)
+
+/* CreateOptions */
+/* Flag is set, it must not be a file , valid for directory only */
+#define FILE_DIRECTORY_FILE_LE			cpu_to_le32(0x00000001)
+#define FILE_WRITE_THROUGH_LE			cpu_to_le32(0x00000002)
+#define FILE_SEQUENTIAL_ONLY_LE			cpu_to_le32(0x00000004)
+
+/* Should not buffer on server*/
+#define FILE_NO_INTERMEDIATE_BUFFERING_LE	cpu_to_le32(0x00000008)
+/* MBZ */
+#define FILE_SYNCHRONOUS_IO_ALERT_LE		cpu_to_le32(0x00000010)
+/* MBZ */
+#define FILE_SYNCHRONOUS_IO_NONALERT_LE		cpu_to_le32(0x00000020)
+
+/* Flaf must not be set for directory */
+#define FILE_NON_DIRECTORY_FILE_LE		cpu_to_le32(0x00000040)
+
+/* Should be zero */
+#define CREATE_TREE_CONNECTION			cpu_to_le32(0x00000080)
+#define FILE_COMPLETE_IF_OPLOCKED_LE		cpu_to_le32(0x00000100)
+#define FILE_NO_EA_KNOWLEDGE_LE			cpu_to_le32(0x00000200)
+#define FILE_OPEN_REMOTE_INSTANCE		cpu_to_le32(0x00000400)
+
+/**
+ * Doc says this is obsolete "open for recovery" flag should be zero
+ * in any case.
+ */
+#define CREATE_OPEN_FOR_RECOVERY		cpu_to_le32(0x00000400)
+#define FILE_RANDOM_ACCESS_LE			cpu_to_le32(0x00000800)
+#define FILE_DELETE_ON_CLOSE_LE			cpu_to_le32(0x00001000)
+#define FILE_OPEN_BY_FILE_ID_LE			cpu_to_le32(0x00002000)
+#define FILE_OPEN_FOR_BACKUP_INTENT_LE		cpu_to_le32(0x00004000)
+#define FILE_NO_COMPRESSION_LE			cpu_to_le32(0x00008000)
+
+/* Should be zero*/
+#define FILE_OPEN_REQUIRING_OPLOCK		cpu_to_le32(0x00010000)
+#define FILE_DISALLOW_EXCLUSIVE			cpu_to_le32(0x00020000)
+#define FILE_RESERVE_OPFILTER_LE		cpu_to_le32(0x00100000)
+#define FILE_OPEN_REPARSE_POINT_LE		cpu_to_le32(0x00200000)
+#define FILE_OPEN_NO_RECALL_LE			cpu_to_le32(0x00400000)
+
+/* Should be zero */
+#define FILE_OPEN_FOR_FREE_SPACE_QUERY_LE	cpu_to_le32(0x00800000)
+#define CREATE_OPTIONS_MASK			cpu_to_le32(0x00FFFFFF)
+#define CREATE_OPTION_READONLY			0x10000000
+/* system. NB not sent over wire */
+#define CREATE_OPTION_SPECIAL			0x20000000
+
+struct ksmbd_work;
+struct ksmbd_file;
+struct ksmbd_conn;
+
+struct ksmbd_dir_info {
+	const char	*name;
+#ifdef CONFIG_SMB_INSECURE_SERVER
+	char		*smb1_name;
+#endif
+	char		*wptr;
+	char		*rptr;
+	int		name_len;
+	int		out_buf_len;
+	int		num_entry;
+	int		data_count;
+	int		last_entry_offset;
+	bool		hide_dot_file;
+	int		flags;
+};
+
+struct ksmbd_readdir_data {
+	struct dir_context	ctx;
+	union {
+		void		*private;
+		char		*dirent;
+	};
+
+	unsigned int		used;
+	unsigned int		dirent_count;
+	unsigned int		file_attr;
+};
+
+/* ksmbd kstat wrapper to get valid create time when reading dir entry */
+struct ksmbd_kstat {
+	struct kstat		*kstat;
+	unsigned long long	create_time;
+	__le32			file_attributes;
+};
+
+struct ksmbd_fs_sector_size {
+	unsigned short	logical_sector_size;
+	unsigned int	physical_sector_size;
+	unsigned int	optimal_io_size;
+};
+
+int ksmbd_vfs_inode_permission(struct dentry *dentry, int acc_mode,
+		bool delete);
+int ksmbd_vfs_query_maximal_access(struct dentry *dentry, __le32 *daccess);
+int ksmbd_vfs_create(struct ksmbd_work *work, const char *name, umode_t mode);
+int ksmbd_vfs_mkdir(struct ksmbd_work *work, const char *name, umode_t mode);
+int ksmbd_vfs_read(struct ksmbd_work *work, struct ksmbd_file *fp,
+		size_t count, loff_t *pos);
+int ksmbd_vfs_write(struct ksmbd_work *work, struct ksmbd_file *fp,
+		char *buf, size_t count, loff_t *pos, bool sync,
+		ssize_t *written);
+int ksmbd_vfs_fsync(struct ksmbd_work *work, u64 fid, u64 p_id);
+int ksmbd_vfs_remove_file(struct ksmbd_work *work, char *name);
+int ksmbd_vfs_link(struct ksmbd_work *work,
+		const char *oldname, const char *newname);
+int ksmbd_vfs_getattr(struct path *path, struct kstat *stat);
+#ifdef CONFIG_SMB_INSECURE_SERVER
+int ksmbd_vfs_setattr(struct ksmbd_work *work, const char *name,
+		u64 fid, struct iattr *attrs);
+int ksmbd_vfs_symlink(struct ksmbd_work *work,
+		const char *name, const char *symname);
+int ksmbd_vfs_readlink(struct path *path, char *buf, int lenp);
+int ksmbd_vfs_readdir_name(struct ksmbd_work *work,
+		struct ksmbd_kstat *ksmbd_kstat, const char *de_name,
+		int de_name_len, const char *dir_path);
+#endif
+int ksmbd_vfs_fp_rename(struct ksmbd_work *work, struct ksmbd_file *fp,
+		char *newname);
+int ksmbd_vfs_rename_slowpath(struct ksmbd_work *work,
+		char *oldname, char *newname);
+int ksmbd_vfs_truncate(struct ksmbd_work *work, const char *name,
+		struct ksmbd_file *fp, loff_t size);
+struct srv_copychunk;
+int ksmbd_vfs_copy_file_ranges(struct ksmbd_work *work,
+		struct ksmbd_file *src_fp, struct ksmbd_file *dst_fp,
+		struct srv_copychunk *chunks, unsigned int chunk_count,
+		unsigned int *chunk_count_written,
+		unsigned int *chunk_size_written, loff_t  *total_size_written);
+struct ksmbd_file *ksmbd_vfs_dentry_open(struct ksmbd_work *work,
+		const struct path *path, int flags, __le32 option, int fexist);
+ssize_t ksmbd_vfs_listxattr(struct dentry *dentry, char **list);
+ssize_t ksmbd_vfs_getxattr(struct dentry *dentry, char *xattr_name,
+		char **xattr_buf);
+ssize_t ksmbd_vfs_casexattr_len(struct dentry *dentry, char *attr_name,
+		int attr_name_len);
+int ksmbd_vfs_setxattr(struct dentry *dentry, const char *attr_name,
+		const void *attr_value, size_t attr_size, int flags);
+int ksmbd_vfs_fsetxattr(struct ksmbd_work *work, const char *filename,
+		const char *attr_name, const void *attr_value, size_t attr_size,
+		int flags);
+int ksmbd_vfs_xattr_stream_name(char *stream_name, char **xattr_stream_name,
+		size_t *xattr_stream_name_size, int s_type);
+int ksmbd_vfs_remove_xattr(struct dentry *dentry, char *attr_name);
+int ksmbd_vfs_kern_path(char *name, unsigned int flags, struct path *path,
+		bool caseless);
+int ksmbd_vfs_empty_dir(struct ksmbd_file *fp);
+void ksmbd_vfs_set_fadvise(struct file *filp, __le32 option);
+int ksmbd_vfs_lock(struct file *filp, int cmd, struct file_lock *flock);
+int ksmbd_vfs_readdir(struct file *file, struct ksmbd_readdir_data *rdata);
+int ksmbd_vfs_alloc_size(struct ksmbd_work *work, struct ksmbd_file *fp,
+		loff_t len);
+int ksmbd_vfs_zero_data(struct ksmbd_work *work, struct ksmbd_file *fp,
+		loff_t off, loff_t len);
+struct file_allocated_range_buffer;
+int ksmbd_vfs_fqar_lseek(struct ksmbd_file *fp, loff_t start, loff_t length,
+		struct file_allocated_range_buffer *ranges,
+		int in_count, int *out_count);
+int ksmbd_vfs_unlink(struct dentry *dir, struct dentry *dentry);
+unsigned short ksmbd_vfs_logical_sector_size(struct inode *inode);
+void ksmbd_vfs_smb2_sector_size(struct inode *inode,
+		struct ksmbd_fs_sector_size *fs_ss);
+void *ksmbd_vfs_init_kstat(char **p, struct ksmbd_kstat *ksmbd_kstat);
+int ksmbd_vfs_fill_dentry_attrs(struct ksmbd_work *work, struct dentry *dentry,
+		struct ksmbd_kstat *ksmbd_kstat);
+int ksmbd_vfs_posix_lock_wait(struct file_lock *flock);
+int ksmbd_vfs_posix_lock_wait_timeout(struct file_lock *flock, long timeout);
+void ksmbd_vfs_posix_lock_unblock(struct file_lock *flock);
+int ksmbd_vfs_remove_acl_xattrs(struct dentry *dentry);
+int ksmbd_vfs_remove_sd_xattrs(struct dentry *dentry);
+int ksmbd_vfs_set_sd_xattr(struct ksmbd_conn *conn, struct dentry *dentry,
+		struct smb_ntsd *pntsd, int len);
+int ksmbd_vfs_get_sd_xattr(struct ksmbd_conn *conn, struct dentry *dentry,
+		struct smb_ntsd **pntsd);
+int ksmbd_vfs_set_dos_attrib_xattr(struct dentry *dentry,
+		struct xattr_dos_attrib *da);
+int ksmbd_vfs_get_dos_attrib_xattr(struct dentry *dentry,
+		struct xattr_dos_attrib *da);
+struct posix_acl *ksmbd_vfs_posix_acl_alloc(int count, gfp_t flags);
+struct posix_acl *ksmbd_vfs_get_acl(struct inode *inode, int type);
+int ksmbd_vfs_set_posix_acl(struct inode *inode, int type,
+		struct posix_acl *acl);
+int ksmbd_vfs_set_init_posix_acl(struct inode *inode);
+int ksmbd_vfs_inherit_posix_acl(struct inode *inode,
+		struct inode *parent_inode);
+#endif /* __KSMBD_VFS_H__ */
diff -Nruw linux-5.4.60-fbx/fs/exfat./bitmap.c linux-5.4.60-fbx/fs/exfat/bitmap.c
--- linux-5.4.60-fbx/fs/exfat./bitmap.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/bitmap.c	2021-03-04 13:21:00.760839022 +0100
@@ -0,0 +1,606 @@
+/*
+ * bitmap.c for exfat
+ * Created by <nschichan@freebox.fr> on Thu Aug  8 19:21:05 2013
+ */
+
+#include <linux/buffer_head.h>
+#include <linux/fs.h>
+
+#include "exfat.h"
+#include "exfat_fs.h"
+
+
+static inline sector_t exfat_bitmap_sector(struct exfat_sb_info *sbi,
+					   u32 cluster)
+{
+	return sbi->first_bitmap_sector + ((cluster / 8) >> sbi->sectorbits);
+}
+
+static inline u32 exfat_bitmap_off(struct exfat_sb_info *sbi,
+				   u32 cluster)
+{
+	return (cluster / 8) & sbi->sectormask;
+}
+
+static inline u32 exfat_bitmap_shift(u32 cluster)
+{
+	return cluster & 7;
+}
+
+static int __find_get_free_cluster(struct inode *inode, u32 *out_cluster)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+
+	while (1) {
+		sector_t sect = exfat_bitmap_sector(sbi,
+						    sbi->cur_bitmap_cluster);
+		u32 off = exfat_bitmap_off(sbi, sbi->cur_bitmap_cluster);
+		u32 shift = exfat_bitmap_shift(sbi->cur_bitmap_cluster);
+
+		/* disk is full */
+		if (!sbi->free_clusters)
+			break;
+
+		if (!sbi->cur_bitmap_bh ||
+		    sect != sbi->cur_bitmap_sector) {
+			if (sbi->cur_bitmap_bh)
+				brelse(sbi->cur_bitmap_bh);
+			sbi->cur_bitmap_bh = sb_bread(inode->i_sb, sect);
+			sbi->cur_bitmap_sector = sect;
+			if (!sbi->cur_bitmap_bh) {
+				exfat_msg(inode->i_sb, KERN_ERR,
+					  "unable to read bitmap sector "
+					  "at %llu", (unsigned long long)sect);
+				return -EIO;
+			}
+		}
+
+		if (!(sbi->cur_bitmap_bh->b_data[off] & (1 << shift))) {
+			sbi->cur_bitmap_bh->b_data[off] |= (1 << shift);
+			*out_cluster = sbi->cur_bitmap_cluster;
+			goto found;
+		}
+
+		++sbi->cur_bitmap_cluster;
+		if (sbi->cur_bitmap_cluster == sbi->cluster_count)
+			sbi->cur_bitmap_cluster = 0;
+	}
+	return -ENOSPC;
+
+found:
+	sbi->prev_free_cluster = *out_cluster;
+	--sbi->free_clusters;
+	mark_buffer_dirty(sbi->cur_bitmap_bh);
+	return 0;
+}
+
+static int __put_cluster(struct inode *inode, u32 cluster)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+	sector_t sect = exfat_bitmap_sector(sbi, cluster);
+	u32 off = exfat_bitmap_off(sbi, cluster);
+	u32 shift = exfat_bitmap_shift(cluster);
+
+
+	if (!sbi->cur_bitmap_bh || sect != sbi->cur_bitmap_sector) {
+		if (sbi->cur_bitmap_bh)
+			brelse(sbi->cur_bitmap_bh);
+		sbi->cur_bitmap_bh = sb_bread(inode->i_sb, sect);
+		if (!sbi->cur_bitmap_bh) {
+			exfat_msg(inode->i_sb, KERN_ERR,
+				  "unable to read bitmap sector at %llu",
+				  (unsigned long long)sect);
+			return -EIO;
+		}
+		sbi->cur_bitmap_sector = sect;
+		sbi->cur_bitmap_cluster = cluster;
+	}
+	if ((sbi->cur_bitmap_bh->b_data[off] & (1 << shift)) == 0) {
+		exfat_fs_error(inode->i_sb, "put_cluster: cluster %u "
+			  "already free.", cluster);
+		return -EIO;
+	}
+
+	++sbi->free_clusters;
+	sbi->cur_bitmap_bh->b_data[off] &= ~(1 << shift);
+	sbi->prev_free_cluster = cluster;
+	mark_buffer_dirty(sbi->cur_bitmap_bh);
+	/* sync_dirty_buffer(sbi->cur_bitmap_bh); */
+	return 0;
+}
+
+/*
+ * setup search to start at given cluster.
+ */
+static void __exfat_reset_bitmap(struct exfat_sb_info *sbi, u32 cluster)
+{
+	sector_t sect;
+
+	if (cluster >= sbi->cluster_count)
+		cluster = 0;
+
+	sect = exfat_bitmap_sector(sbi, cluster);
+	if (sbi->cur_bitmap_sector != sect) {
+		sbi->cur_bitmap_sector = sect;
+		if (sbi->cur_bitmap_bh) {
+			brelse(sbi->cur_bitmap_bh);
+			sbi->cur_bitmap_bh = NULL;
+		}
+	}
+	sbi->cur_bitmap_cluster = cluster;
+}
+
+static bool all_contiguous(u32 *clusters, u32 nr)
+{
+	u32 i;
+
+	for (i = 0; i < nr - 1; ++i) {
+		if (clusters[i] != clusters[i + 1] - 1)
+			return false;
+	}
+	return true;
+}
+
+/*
+ * hint must be the immediately after the last allocated cluster of
+ * the inode.
+ */
+int exfat_alloc_clusters(struct inode *inode, u32 hint, u32 *clusters, u32 nr)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+	struct exfat_inode_info *info = EXFAT_I(inode);
+	u32 i;
+
+	mutex_lock(&sbi->bitmap_mutex);
+	__exfat_reset_bitmap(sbi, hint - 2);
+	for (i = 0; i < nr; ++i) {
+		u32 new;
+		int error;
+
+		error = __find_get_free_cluster(inode, &new);
+		if (error) {
+			mutex_unlock(&sbi->bitmap_mutex);
+			return error;
+		}
+
+		clusters[i] = new + 2;
+	}
+	mutex_unlock(&sbi->bitmap_mutex);
+
+	/*
+	 * all clusters found: now see if we need to update/create a
+	 * fat chain.
+	 */
+	if (info->first_cluster == 0) {
+		info->first_cluster = clusters[0];
+		if (all_contiguous(clusters, nr)) {
+			/*
+			 * first cluster alloc on inode and all
+			 * clusters are contiguous.
+			 */
+			info->flags |= EXFAT_I_FAT_INVALID;
+		} else {
+			/*
+			 * first alloc and already fragmented.
+			 */
+			return exfat_write_fat(inode, 0, clusters, nr);
+		}
+	} else {
+		int error;
+		if ((info->flags & EXFAT_I_FAT_INVALID) &&
+		    (clusters[0] != hint || !all_contiguous(clusters, nr))) {
+			/*
+			 * must now use fat chain instead of bitmap.
+			 */
+			info->flags &= ~(EXFAT_I_FAT_INVALID);
+
+			/*
+			 * write the contiguous chain that would
+			 * previously be accessed without the FAT
+			 * chain.
+			 */
+			error = exfat_write_fat_contiguous(inode,
+						  info->first_cluster,
+						  hint - info->first_cluster);
+			if (error)
+				return error;
+		}
+
+		if ((info->flags & EXFAT_I_FAT_INVALID) == 0) {
+			/*
+			 * link the allocated clusters after hint.
+			 */
+			error = exfat_write_fat(inode, hint - 1, clusters, nr);
+			if (error)
+				return  error;
+		}
+
+	}
+
+	/*
+	 * update i_blocks.
+	 */
+	inode->i_blocks += nr << (sbi->clusterbits - 9);
+	info->allocated_clusters += nr;
+
+	/*
+	 * caller must call mark_inode_dirty so that inode
+	 * first_cluster and inode flags get written to the disk.
+	 * caller must update inode size (directory and regular file
+	 * have different rules).
+	 */
+	return 0;
+}
+
+
+static int exfat_free_clusters_contiguous(struct inode *inode,
+					  u32 start, u32 nr)
+{
+	u32 cluster;
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+	int error = 0;
+
+	mutex_lock(&sbi->bitmap_mutex);
+	for (cluster = start; cluster < start + nr; ++cluster) {
+		error = __put_cluster(inode, cluster - 2);
+		if (error)
+			break;
+	}
+	mutex_unlock(&sbi->bitmap_mutex);
+	return error;
+}
+
+static int exfat_free_clusters_fat(struct inode *inode,
+				   u32 fcluster_start, u32 nr)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+	u32 fcluster;
+	int error = 0;
+
+	mutex_lock(&sbi->bitmap_mutex);
+	for (fcluster = fcluster_start; fcluster < fcluster_start + nr;
+	     ++fcluster) {
+		u32 dcluster;
+		int error;
+
+		error = exfat_get_fat_cluster(inode, fcluster, &dcluster);
+		if (error)
+			break;
+
+		error = __put_cluster(inode, dcluster - 2);
+		if (error)
+			break;
+	}
+	mutex_unlock(&sbi->bitmap_mutex);
+
+	/*
+	 * per-inode file cluster to disk cluster translation cache
+	 * mostly now holds entries to the zone we just truncated, so
+	 * they must not be kept (this could lead to FS corruption).
+	 */
+	exfat_inode_cache_drop(inode);
+
+	return error;
+}
+
+int exfat_free_clusters_inode(struct inode *inode, u32 fcluster_start)
+{
+	struct exfat_inode_info *info = EXFAT_I(inode);
+	int error;
+	u32 nr_to_free = info->allocated_clusters - fcluster_start;
+
+	if (info->first_cluster == 0 || nr_to_free == 0)
+		/*
+		 * no clusters allocated, or nothing to do
+		 */
+		return 0;
+
+	if (info->flags & EXFAT_I_FAT_INVALID)
+		error = exfat_free_clusters_contiguous(inode,
+				       info->first_cluster + fcluster_start,
+				       nr_to_free);
+	else
+		error = exfat_free_clusters_fat(inode, fcluster_start,
+					nr_to_free);
+	if (error)
+		return error;
+
+	info->allocated_clusters -= nr_to_free;
+	inode->i_blocks = EXFAT_I(inode)->allocated_clusters <<
+		(EXFAT_SB(inode->i_sb)->clusterbits - 9);
+
+	/*
+	 * update inode info, caller must call mark_inode_dirty and
+	 * update inode->i_size.
+	 */
+	if (fcluster_start == 0) {
+		info->first_cluster = 0;
+		info->flags &= ~(EXFAT_I_FAT_INVALID);
+	}
+	return 0;
+}
+
+static u32 count_clusters_bh(struct buffer_head *bh, u32 count)
+{
+	u8 *ptr = bh->b_data;
+	u32 ret = 0;
+	u8 val;
+
+	while (count >= sizeof (u64) * 8) {
+		u64 val = *(u64*)ptr;
+
+		ret += hweight64(~val);
+		count -= sizeof (u64) * 8;
+		ptr += sizeof (u64);
+	}
+	if (count >= sizeof (u32) * 8) {
+		u32 val = *(u32*)ptr;
+
+		ret += hweight32(~val);
+		count -= sizeof (u32) * 8;
+		ptr += sizeof (u32);
+	}
+	if (count >= sizeof (u16) * 8) {
+		u16 val = *(u16*)ptr;
+
+		ret += hweight16(~val);
+		count -= sizeof (u16) * 8;
+		ptr += sizeof (u16);
+	}
+	if (count >= sizeof (u8) * 8) {
+		u8 val = *ptr;
+
+		ret += hweight8(~val);
+		count -= sizeof (u8) * 8;
+		ptr += sizeof (u8);
+	}
+
+	if (count) {
+		val = *ptr;
+		while (count) {
+			ret += (~val & 1);
+			val >>= 1;
+			--count;
+		}
+	}
+	return ret;
+}
+
+/*
+ * only called during mount, so taking sbi->bitmap_mutex should not be
+ * needed.
+ */
+static int exfat_get_free_cluster_count(struct super_block *sb, u32 *out_count)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	u32 clusters_per_sector = 8 * sbi->sectorsize;
+	u32 cluster;
+
+	*out_count = 0;
+	for (cluster = 0; cluster < sbi->cluster_count;
+	     cluster += clusters_per_sector) {
+		sector_t sect = exfat_bitmap_sector(sbi, cluster);
+		struct buffer_head *bh;
+		u32 count = clusters_per_sector;
+
+		if (cluster + clusters_per_sector > sbi->cluster_count)
+			count = sbi->cluster_count - cluster;
+
+		bh = sb_bread(sb, sect);
+		if (!bh) {
+			exfat_msg(sb, KERN_ERR,
+				  "unable to read bitmap sector at %llu",
+				  (unsigned long long)sect);
+			return -EIO;
+		}
+		*out_count += count_clusters_bh(bh, count);
+		brelse(bh);
+	}
+	return 0;
+}
+
+/*
+ * setup a bitmap context, preload a bh from the requested starting
+ * cluster.
+ */
+int exfat_init_bitmap_context(struct super_block *sb,
+			      struct exfat_bitmap_ctx *ctx,
+			      u32 cluster)
+{
+	memset(ctx, 0, sizeof (*ctx));
+	ctx->sb = sb;
+
+	cluster -= 2;
+	if (cluster >= EXFAT_SB(sb)->cluster_count)
+		return -ENOSPC;
+
+	ctx->cur_sector = exfat_bitmap_sector(EXFAT_SB(sb), cluster);
+	ctx->bh = sb_bread(ctx->sb, ctx->cur_sector);
+
+	if (!ctx->bh) {
+		exfat_msg(sb, KERN_ERR, "unable to read bitmap sector at %llu",
+			  (unsigned long long)ctx->cur_sector);
+		return -EIO;
+	}
+	return 0;
+}
+
+/*
+ * release bh in an already setup bitmap context.
+ */
+void exfat_exit_bitmap_context(struct exfat_bitmap_ctx *ctx)
+{
+	if (ctx->bh)
+		brelse(ctx->bh);
+}
+
+/*
+ * test a specific cluster usage in the bitmap. reuse the bh in the
+ * exfat_bitmap_ctx or read a new one if starting cluster is outside
+ * the current one.
+ */
+static int exfat_test_bitmap_cluster(struct exfat_bitmap_ctx *ctx,
+				     uint32_t cluster, bool *cluster_in_use)
+{
+	sector_t sect;
+	uint32_t off = exfat_bitmap_off(EXFAT_SB(ctx->sb), cluster);
+	int shift = exfat_bitmap_shift(cluster);
+
+	sect = exfat_bitmap_sector(EXFAT_SB(ctx->sb), cluster);
+	if (sect != ctx->cur_sector) {
+		ctx->cur_sector = sect;
+		ctx->bh = sb_bread(ctx->sb, ctx->cur_sector);
+		if (!ctx->bh) {
+			exfat_msg(ctx->sb, KERN_ERR,
+				  "unable to read bitmap sector at %llu",
+				  (unsigned long long)sect);
+			return -EIO;
+		}
+	}
+
+	*cluster_in_use = !!(ctx->bh->b_data[off] & (1 << shift));
+	return 0;
+}
+
+/*
+ * update first_in_use and nr_in_use with the first zone of used
+ * clusters starting from start_cluster.
+ */
+int exfat_test_bitmap(struct exfat_bitmap_ctx *ctx, uint32_t start_cluster,
+		      uint32_t *first_in_use, uint32_t *nr_in_use)
+{
+	bool in_use = false;
+	int error = 0;
+	struct exfat_sb_info *sbi = EXFAT_SB(ctx->sb);
+
+	start_cluster -= 2;
+
+	/*
+	 * scan bitmap until we find a cluster that is in use.
+	 */
+	while (1) {
+		if (start_cluster == sbi->cluster_count) {
+			/*
+			 * readched end of disk: no more in use
+			 * cluster found.
+			 */
+			*first_in_use = sbi->cluster_count;
+			*nr_in_use = 0;
+			return 0;
+		}
+		error = exfat_test_bitmap_cluster(ctx, start_cluster, &in_use);
+		if (error)
+			return error;
+		if (in_use)
+			break;
+		++start_cluster;
+	}
+
+
+	/*
+	 * update first_in_use, and scan until a free cluster is
+	 * found.
+	 */
+	*first_in_use = start_cluster + 2;
+	*nr_in_use = 0;
+	while (1) {
+		error = exfat_test_bitmap_cluster(ctx, start_cluster, &in_use);
+		if (error)
+			return error;
+		if (!in_use)
+			break;
+		++(*nr_in_use);
+		++start_cluster;
+	}
+	return 0;
+}
+
+int exfat_init_bitmap(struct inode *root)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(root->i_sb);
+	struct exfat_bitmap_entry *be;
+	struct exfat_dir_ctx dctx;
+	u32 first_bitmap_cluster;
+	u32 last_bitmap_cluster;
+
+	int error;
+
+	mutex_init(&sbi->bitmap_mutex);
+
+	error = exfat_init_dir_ctx(root, &dctx, 0);
+	if (error)
+		return error;
+
+try_bitmap:
+	error = -ENOENT;
+	be = __exfat_dentry_next(&dctx, E_EXFAT_BITMAP, 0xff, true, NULL);
+	if (!be) {
+		exfat_msg(root->i_sb, KERN_ERR, "root directory does not "
+			  "have a bitmap entry.");
+		goto fail;
+	}
+
+	if (exfat_bitmap_nr(be->flags) != 0)
+		/*
+		 * not expected to find a second bitmap entry here
+		 * since we checked during superblock fill that we
+		 * were not on a texFAT volume ...
+		 */
+		goto try_bitmap;
+
+
+	error = -EINVAL;
+	if (__le64_to_cpu(be->length) * 8 < sbi->cluster_count) {
+		exfat_msg(root->i_sb, KERN_INFO, "bitmap does not cover "
+			  "the whole cluster heap.");
+		goto fail;
+	}
+
+	first_bitmap_cluster = __le32_to_cpu(be->cluster_addr);
+	last_bitmap_cluster = first_bitmap_cluster +
+		(__le32_to_cpu(be->length) >> sbi->clusterbits);
+
+	/*
+	 * check that bitmap start and end clusters are inside the
+	 * disk.
+	 */
+	error = -ERANGE;
+	if (first_bitmap_cluster < 2 &&
+	    first_bitmap_cluster >= sbi->cluster_count) {
+		exfat_msg(root->i_sb, KERN_ERR, "bitmap start cluster is "
+			  "outside disk limits.");
+		goto fail;
+	}
+	if (last_bitmap_cluster < 2 &&
+	    last_bitmap_cluster >= sbi->cluster_count) {
+		exfat_msg(root->i_sb, KERN_ERR, "bitmap last cluster is "
+			  "outside disk limits.");
+		goto fail;
+	}
+
+	sbi->bitmap_length = __le32_to_cpu(be->length);
+	sbi->first_bitmap_sector = exfat_cluster_sector(sbi,
+					__le32_to_cpu(be->cluster_addr));
+	sbi->last_bitmap_sector = sbi->first_bitmap_sector +
+		DIV_ROUND_UP(sbi->bitmap_length, sbi->sectorsize);
+
+	error = exfat_get_free_cluster_count(root->i_sb, &sbi->free_clusters);
+	if (error)
+		goto fail;
+
+	sbi->prev_free_cluster = 0;
+
+	exfat_cleanup_dir_ctx(&dctx);
+	return 0;
+fail:
+	exfat_cleanup_dir_ctx(&dctx);
+	return error;
+}
+
+void exfat_exit_bitmap(struct super_block *sb)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+
+	if (sbi->cur_bitmap_bh)
+		brelse(sbi->cur_bitmap_bh);
+}
diff -Nruw linux-5.4.60-fbx/fs/exfat./dir.c linux-5.4.60-fbx/fs/exfat/dir.c
--- linux-5.4.60-fbx/fs/exfat./dir.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/dir.c	2021-03-30 16:07:01.591769549 +0200
@@ -0,0 +1,402 @@
+/*
+ * dir.c for exfat
+ * Created by <nschichan@freebox.fr> on Tue Aug 20 11:42:46 2013
+ */
+
+#include <linux/types.h>
+#include <linux/fs.h>
+#include <linux/buffer_head.h>
+#include <linux/slab.h>
+#include <linux/nls.h>
+
+#include "exfat.h"
+#include "exfat_fs.h"
+
+/*
+ * setup an exfat_dir_ctx structure so that __exfat_dentry_next can
+ * work with it.
+ */
+int exfat_init_dir_ctx(struct inode *inode, struct exfat_dir_ctx *ctx,
+		       off_t start)
+{
+	u32 cluster = EXFAT_I(inode)->first_cluster;
+
+	memset(ctx, 0, sizeof (*ctx));
+
+	if (cluster == 0) {
+		ctx->empty = true;
+		ctx->sb = inode->i_sb;
+		return 0;
+	}
+
+	if (cluster < EXFAT_CLUSTER_FIRSTVALID ||
+	    cluster > EXFAT_CLUSTER_LASTVALID) {
+		exfat_msg(inode->i_sb, KERN_ERR, "exfat_init_dir_ctx: invalid "
+			  "cluster %u", cluster);
+		return -EINVAL;
+	}
+
+	start &= ~(0x20 - 1);
+	if (start == 0)
+		ctx->off = -1;
+	else
+		ctx->off = start - 0x20;
+
+	ctx->sb = inode->i_sb;
+	ctx->inode = inode;
+
+	return 0;
+}
+
+void exfat_cleanup_dir_ctx(struct exfat_dir_ctx *dctx)
+{
+	if (dctx->bh)
+		brelse(dctx->bh);
+}
+
+/*
+ * calculate the checksum for the current direntry. fields containing
+ * the checksum for the first entry is not part of the checksum
+ * calculation.
+ */
+u16 exfat_direntry_checksum(void *data, u16 checksum, bool first)
+{
+	u8 *ptr = data;
+	int i;
+
+	for (i = 0; i < 0x20; ++i) {
+		if (first && (i == 2 || i == 3))
+			continue ;
+		checksum = ((checksum << 15) | (checksum >> 1)) + (u16)ptr[i];
+	}
+	return checksum;
+}
+
+u32 exfat_dctx_fpos(struct exfat_dir_ctx *dctx)
+{
+	return dctx->off;
+}
+
+u64 exfat_dctx_dpos(struct exfat_dir_ctx *dctx)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(dctx->sb);
+
+	return (dctx->sector << sbi->sectorbits) +
+		(dctx->off & sbi->sectormask);
+}
+
+static int exfat_get_dctx_disk_cluster(struct exfat_dir_ctx *dctx,
+				       u32 file_cluster, u32 *disk_cluster)
+{
+	struct exfat_inode_info *info = EXFAT_I(dctx->inode);
+
+	if (info->flags & EXFAT_I_FAT_INVALID) {
+		*disk_cluster = info->first_cluster + file_cluster;
+		return 0;
+	} else {
+		return exfat_get_fat_cluster(dctx->inode, file_cluster,
+					     disk_cluster);
+	}
+}
+
+/*
+ * get the next typed dentry in the exfat_dir_ctx structure. can_skip
+ * indicates whether the entry must be immediately there in the entry
+ * stream. *end indicates whether end of directory entry stream is
+ * reached or not.
+ *
+ * only one buffer_head is kept at a time. subsequent calls to
+ * __exfat_dentry_next can invalidate pointers from previous calls due
+ * to that.
+ */
+void *__exfat_dentry_next(struct exfat_dir_ctx *dctx, int type, int mask,
+			  bool can_skip, bool *end)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(dctx->sb);
+
+	if (dctx->empty) {
+		if (end)
+			*end = true;
+		return NULL;
+	}
+
+	if (end)
+		*end = false;
+
+	if (dctx->off == -1)
+		dctx->off = 0;
+	else
+		dctx->off += 0x20;
+
+	for (;;) {
+		sector_t wanted_sector;
+		u32 file_cluster = dctx->off >> sbi->clusterbits;
+		u32 disk_cluster;
+		int error;
+		int sector_offset;
+		sector_t sector_in_cluster;
+
+		if (dctx->off >= dctx->inode->i_size) {
+			*end = true;
+			return NULL;
+		}
+
+
+		error = exfat_get_dctx_disk_cluster(dctx, file_cluster,
+						    &disk_cluster);
+		if (error)
+			return NULL;
+
+		sector_in_cluster = (dctx->off >> sbi->sectorbits) %
+			sbi->sectors_per_cluster;
+
+		wanted_sector = exfat_cluster_sector(sbi, disk_cluster) +
+			sector_in_cluster;
+		if (wanted_sector != dctx->sector || !dctx->bh) {
+			/*
+			 * need to fetch a new sector from the current
+			 * cluster.
+			 */
+			dctx->sector = wanted_sector;
+			if (dctx->bh)
+				brelse(dctx->bh);
+			dctx->bh = sb_bread(dctx->sb, dctx->sector);
+			if (!dctx->bh)
+				return NULL;
+		}
+
+		sector_offset = dctx->off & sbi->sectormask;
+		if ((dctx->bh->b_data[sector_offset] & mask) == (type & mask))
+			/*
+			 * return pointer to entry if type matches the
+			 * one given.
+			 */
+			return dctx->bh->b_data + sector_offset;
+
+		if (dctx->bh->b_data[sector_offset] == 0 && end)
+			/*
+			 * set end if no more entries in this directory.
+			 */
+			*end = true;
+
+		if (dctx->bh->b_data[sector_offset] == 0 || !can_skip)
+			/*
+			 * handle can_skip / end of directory.
+			 */
+			return NULL;
+
+		/*
+		 * move to next entry.
+		 */
+		dctx->off += 0x20;
+	}
+	return NULL;
+}
+
+/*
+ * helper around __exfat_dentry_next that copies the content of the
+ * found entry in a user supplied buffer.
+ */
+int exfat_dentry_next(void *out, struct exfat_dir_ctx *dctx,
+			     int type, bool can_skip)
+{
+	bool end;
+
+	void *ptr = __exfat_dentry_next(dctx, type, 0xff, can_skip, &end);
+
+	if (!ptr) {
+		if (end)
+			return -ENOENT;
+		else {
+			exfat_msg(dctx->sb, KERN_INFO, "no ptr and "
+				  "end not reached: "
+				  "type %02x, can_skip %s\n", type,
+				  can_skip ? "true" : "false");
+			return -EIO;
+		}
+	}
+	memcpy(out, ptr, 0x20);
+	return 0;
+}
+
+/*
+ * extract name by parsing consecutive E_EXFAT_FILENAME entries in a
+ * caller provided buffer. also update the checksum on the fly.
+ *
+ * no utf16 to utf8 conversion is performed.
+ */
+int __exfat_get_name(struct exfat_dir_ctx *dctx, u32 name_length,
+			    __le16 *name, u16 *calc_checksum,
+			    struct exfat_iloc *iloc)
+{
+	__le16 *ptr;
+	int error;
+	int nr;
+
+	ptr = name;
+
+	error = -EIO;
+	nr = 0;
+	while (name_length) {
+		struct exfat_filename_entry *e;
+		u32 len = 15;
+
+		e = __exfat_dentry_next(dctx, E_EXFAT_FILENAME, 0xff,
+					false, NULL);
+		if (!e)
+			goto fail;
+		*calc_checksum = exfat_direntry_checksum(e, *calc_checksum,
+							 false);
+
+		if (iloc)
+			iloc->disk_offs[nr + 2] = exfat_dctx_dpos(dctx);
+		if (name_length < 15)
+			len = name_length;
+
+		memcpy(ptr, e->name_frag, len * sizeof (__le16));
+		name_length -= len;
+		ptr += len;
+		nr++;
+	}
+	return 0;
+
+fail:
+	return error;
+}
+
+/*
+ * walk the directory and invoke filldir on all found entries.
+ */
+static int __exfat_iterate(struct exfat_dir_ctx *dctx, struct file *file,
+			   struct dir_context *ctx)
+{
+	int error;
+	char *name = __getname();
+	__le16 *utf16name = __getname();
+
+	if (!name)
+		return -ENOMEM;
+	if (!utf16name) {
+		__putname(name);
+		return -ENOMEM;
+	}
+
+	for (;;) {
+		struct exfat_filedir_entry *efd;
+		struct exfat_stream_extension_entry *esx;
+		int dtype = DT_REG;
+		int name_length;
+		bool end;
+		u16 calc_checksum;
+		u16 expect_checksum;
+
+		/*
+		 * get the next filedir entry, we are allowed to skip
+		 * entries for that.
+		 */
+		error = -EIO;
+		efd = __exfat_dentry_next(dctx, E_EXFAT_FILEDIR, 0xff,
+					  true, &end);
+		if (!efd) {
+			if (end)
+				break;
+			else
+				goto fail;
+		}
+		expect_checksum = __le16_to_cpu(efd->set_checksum);
+		calc_checksum = exfat_direntry_checksum(efd, 0, true);
+
+		if (__le16_to_cpu(efd->attributes & E_EXFAT_ATTR_DIRECTORY))
+			dtype = DT_DIR;
+
+		/*
+		 * get immediate stream extension entry.
+		 */
+		esx = __exfat_dentry_next(dctx, E_EXFAT_STREAM_EXT, 0xff, false,
+					  NULL);
+		if (!esx)
+			goto fail;
+		calc_checksum = exfat_direntry_checksum(esx, calc_checksum,
+							false);
+
+		/*
+		 * get immediate name.
+		 */
+		error = __exfat_get_name(dctx, esx->name_length, utf16name,
+					 &calc_checksum, NULL);
+		if (error) {
+			exfat_msg(dctx->sb, KERN_INFO, "__exfat_get_name "
+				  "has failed with %i", error);
+			goto fail;
+		}
+
+		if (calc_checksum != expect_checksum) {
+			exfat_msg(dctx->sb, KERN_INFO, "checksum: "
+				  "calculated %04x, expect %04x",
+				  calc_checksum, expect_checksum);
+			error = -EIO;
+			goto fail;
+		}
+
+		/*
+		 * convert utf16 to utf8 for kernel filldir callback.
+		 */
+		name_length = utf16s_to_utf8s(utf16name, esx->name_length,
+						   UTF16_LITTLE_ENDIAN,
+						   name, NAME_MAX + 2);
+		if (name_length < 0) {
+			error = name_length;
+			goto fail;
+		}
+		if (name_length > 255) {
+			error = -ENAMETOOLONG;
+			goto fail;
+		}
+
+		/*
+		 * tell the kernel we have an entry by calling
+		 * dir_emit
+		 */
+		if (dir_emit(ctx, name, name_length, 1, dtype))
+			ctx->pos = 2 + exfat_dctx_fpos(dctx);
+		else
+			goto fail;
+	}
+	__putname(name);
+	__putname(utf16name);
+	ctx->pos = file_inode(file)->i_size + 2;
+	return 0;
+fail:
+	__putname(name);
+	__putname(utf16name);
+	return error;
+}
+
+/*
+ * readdir callback for VFS. fill "." and "..", then invoke
+ * __exfat_iterate.
+ */
+int exfat_iterate(struct file *file, struct dir_context *ctx)
+{
+	struct exfat_dir_ctx dctx;
+	int error;
+	struct inode *inode = file_inode(file);
+
+	switch (ctx->pos) {
+	case 0:
+		if (!dir_emit_dots(file, ctx))
+			return 0;
+		/* fallthrough */
+	default:
+		if (ctx->pos >= inode->i_size + 2)
+			return 0;
+		error = exfat_init_dir_ctx(inode, &dctx, ctx->pos - 2);
+		if (error)
+			return error;
+		exfat_lock_super(inode->i_sb);
+		error = __exfat_iterate(&dctx, file, ctx);
+		exfat_unlock_super(inode->i_sb);
+		exfat_cleanup_dir_ctx(&dctx);
+		return error;
+	}
+}
diff -Nruw linux-5.4.60-fbx/fs/exfat./exfat_fs.h linux-5.4.60-fbx/fs/exfat/exfat_fs.h
--- linux-5.4.60-fbx/fs/exfat./exfat_fs.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/exfat_fs.h	2021-03-04 13:21:00.760839022 +0100
@@ -0,0 +1,200 @@
+/*
+ * exfat_fs.h for exfat
+ * Created by <nschichan@freebox.fr> on Mon Jul 29 15:06:38 2013
+ */
+
+#ifndef __EXFAT_FS_H
+# define __EXFAT_FS_H
+
+/*
+ * exfat on disk structures and constants
+ */
+
+#include <linux/types.h>
+
+struct exfat_vbr {
+	u8	jump[3];
+	u8	fsname[8];
+	u8	reserved1[53];
+
+	__le64	partition_offset;
+	__le64	volume_length;
+
+	__le32	fat_offset;
+	__le32	fat_length;
+
+	__le32	cluster_heap_offset;
+	__le32	cluster_count;
+	__le32	cluster_root_dir;
+
+	__le32	serial_number;
+
+	__le16	fs_rev;
+	__le16	volume_flags;
+
+	u8	bytes_per_sector;
+	u8	sectors_per_cluster;
+
+	u8	fat_num;
+	u8	drive_select;
+	u8	heap_use_percent;
+
+	u8	reserved2[7];
+	u8	boot_code[390];
+
+	u8	boot_sig[2];
+};
+
+enum {
+	EXFAT_CLUSTER_FIRSTVALID	= 0x00000002,
+	EXFAT_CLUSTER_LASTVALID		= 0xfffffff6,
+	EXFAT_CLUSTER_BADBLK		= 0xfffffff7,
+	EXFAT_CLUSTER_MEDIATYPE		= 0xfffffff8,
+	EXFAT_CLUSTER_EOF		= 0xffffffff,
+};
+
+enum {
+	EXFAT_ACTIVEFAT_MASK = (1 << 0),
+	EXFAT_FLAG_DIRTY = (1 << 1),
+	EXFAT_FLAG_MEDIA_FAILURE = (1 << 2),
+};
+
+static inline int exfat_active_fat(u16 flags)
+{
+	return flags & EXFAT_ACTIVEFAT_MASK;
+}
+
+#define EXFAT_CHECKSUM_SECTORS	11
+
+enum {
+	EXFAT_I_ALLOC_POSSIBLE = (1 << 0),
+	EXFAT_I_FAT_INVALID = (1 << 1),
+};
+
+/*
+ * directory cluster content
+ */
+
+/*
+ * entry types
+ */
+enum {
+	E_EXFAT_EOD		= 0x00,
+	E_EXFAT_VOLUME_LABEL	= 0x83,
+	E_EXFAT_BITMAP		= 0x81,
+	E_EXFAT_UPCASE_TABLE	= 0x82,
+	E_EXFAT_GUID		= 0xa0,
+	E_EXFAT_PADDING		= 0xa1,
+	E_EXFAT_ACL		= 0xe2,
+	E_EXFAT_FILEDIR		= 0x85,
+	E_EXFAT_STREAM_EXT	= 0xc0,
+	E_EXFAT_FILENAME	= 0xc1,
+};
+
+/*
+ * file attributes in exfat_filedir_entry
+ */
+enum {
+	E_EXFAT_ATTR_RO		= (1 << 0),
+	E_EXFAT_ATTR_HIDDEN	= (1 << 1),
+	E_EXFAT_ATTR_SYSTEM	= (1 << 2),
+	/* bit 3 reserved */
+	E_EXFAT_ATTR_DIRECTORY	= (1 << 4),
+	E_EXFAT_ATTR_ARCHIVE	= (1 << 5),
+	/* bits 6-15 reserved */
+};
+
+/* type 0x83 */
+struct exfat_volume_label_entry {
+	u8 type;
+	u8 charcount;
+	__u16 label[11];
+	u8 reserved1[8];
+};
+
+static inline int exfat_bitmap_nr(u8 flags)
+{
+	return flags & 1;
+}
+
+/* type 0x81 */
+struct exfat_bitmap_entry {
+	u8 type;
+	u8 flags;
+	u8 reserved1[18];
+	__le32 cluster_addr;
+	__le64 length;
+};
+
+/* type 0x82 */
+struct exfat_upcase_entry {
+	u8 type;
+	u8 reserved1[3];
+	__le32 checksum;
+	u8 reserved2[12];
+	__le32 cluster_addr;
+	__le64 length;
+};
+
+/* type 0xa0 */
+struct exfat_guid_entry {
+	u8 type;
+	u8 secondary_count;
+	__le16 set_checksum;
+	__le16 flags;
+	u8 guid[16];
+	u8 reserved1[10];
+};
+
+/* type 0xa1 */
+struct exfat_padding_entry {
+	u8 type;
+	u8 reserved1[31];
+};
+
+/* type 0xe2 */
+struct exfat_acl_entry {
+	u8 type;
+	u8 reserved1[31];
+};
+
+/* type 0x85 */
+struct exfat_filedir_entry {
+	u8 type;
+	u8 secondary_count;
+	__le16 set_checksum;
+	__le16 attributes;
+	u8 reserved1[2];
+	__le32 create;
+	__le32 modified;
+	__le32 accessed;
+	u8 create_10ms;
+	u8 modified_10ms;
+	s8 create_tz_offset;
+	s8 modified_tz_offset;
+	s8 accessed_tz_offset;
+	u8 reserved2[7];
+};
+
+/* 0xc0 */
+struct exfat_stream_extension_entry {
+	u8 type;
+	u8 flags;
+	u8 reserved1;
+	u8 name_length;
+	__le16 name_hash;
+	u8 reserved2[2];
+	__le64 valid_data_length;
+	u8 reserved3[4];
+	__le32 first_cluster;
+	__le64 data_length;
+};
+
+/* 0xc1 */
+struct exfat_filename_entry {
+	u8 type;
+	u8 flags;
+	__le16 name_frag[15];
+};
+
+#endif /*! __EXFAT_FS_H */
diff -Nruw linux-5.4.60-fbx/fs/exfat./exfat.h linux-5.4.60-fbx/fs/exfat/exfat.h
--- linux-5.4.60-fbx/fs/exfat./exfat.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/exfat.h	2021-03-04 13:21:00.760839022 +0100
@@ -0,0 +1,325 @@
+/*
+ * exfat.h for exfat
+ * Created by <nschichan@freebox.fr> on Tue Jul 23 12:37:12 2013
+ */
+
+#ifndef __EXFAT_H
+# define __EXFAT_H
+
+#define EXFAT_HASH_BITS	(8)
+#define EXFAT_HASH_SIZE	(1 << EXFAT_HASH_BITS)
+
+/*
+ * special inode number for root directory.
+ */
+#define EXFAT_ROOT_INO	1
+
+enum {
+	EXFAT_ERROR_ACTION_CONTINUE,
+	EXFAT_ERROR_ACTION_REMOUNT_RO,
+	EXFAT_ERROR_ACTION_PANIC,
+};
+
+struct exfat_sb_options {
+	kuid_t	uid;
+	kgid_t	gid;
+	mode_t	dmask;
+	mode_t	fmask;
+	int	time_offset;
+	int	time_offset_set;
+	int	error_action;
+};
+
+struct exfat_sb_info {
+	struct exfat_sb_options options;
+
+	struct buffer_head *sb_bh;
+	struct exfat_vbr *vbr;
+	bool dirty;
+
+	u32 sectorsize; /* in bytes*/
+	u32 clustersize; /* in bytes */
+	u32 sectors_per_cluster;
+	int sectorbits;
+	int clusterbits;
+	u32 sectormask;
+	u32 clustermask;
+
+	u32 fat_offset;
+	u32 fat_length;
+
+	u32 root_dir_cluster;
+	u32 cluster_heap_offset;
+	u32 cluster_count;
+
+	__le16	*upcase_table;
+	u32	upcase_len;
+
+	/*
+	 * bitmap fields
+	 */
+	struct mutex		bitmap_mutex;
+	u32			bitmap_length;
+	sector_t		first_bitmap_sector;
+	sector_t		last_bitmap_sector;
+	sector_t		cur_bitmap_sector;
+	u32			cur_bitmap_cluster;
+	struct buffer_head	*cur_bitmap_bh;
+	u32			free_clusters;
+	u32			prev_free_cluster;
+
+	/*
+	 * inode hash fields
+	 */
+	spinlock_t		inode_hash_lock;
+	struct hlist_head	inode_hash[EXFAT_HASH_SIZE];
+
+	struct mutex		sb_mutex;
+};
+
+struct exfat_cache_entry {
+	struct list_head list;
+	u32 file_cluster;
+	u32 disk_cluster;
+	u32 nr_contig;
+};
+
+struct exfat_cache {
+	struct mutex		mutex;
+	struct list_head	entries;
+	u32			nr_entries;
+};
+
+struct exfat_iloc {
+	u8 nr_secondary;
+	u32 file_off;
+	u64 disk_offs[19];
+};
+
+struct exfat_inode_info {
+	u8			flags;
+	u16			attributes;
+	u32			first_cluster;
+	u32			allocated_clusters;
+	loff_t			mmu_private;
+	struct exfat_iloc	iloc;
+	struct hlist_node	hash_list;
+
+	struct exfat_cache	exfat_cache;
+	struct inode		vfs_inode;
+};
+
+static inline struct exfat_sb_info *EXFAT_SB(struct super_block *sb)
+{
+	return sb->s_fs_info;
+}
+
+static inline struct exfat_inode_info *EXFAT_I(struct inode *inode)
+{
+	return container_of(inode, struct exfat_inode_info, vfs_inode);
+}
+
+loff_t exfat_dir_links(struct inode *inode);
+
+int exfat_write_fat_contiguous(struct inode *inode, u32 first_cluster,
+			       u32 nr_clusters);
+int exfat_write_fat(struct inode *inode, u32 prev_cluster, u32 *clusters,
+		    u32 nr_clusters);
+
+__printf(3, 4) void exfat_msg(struct super_block *sb, const char *level,
+			      const char *fmt, ...);
+__printf(2, 3) void exfat_fs_error(struct super_block *sb,
+				   const char *fmt, ...);
+int exfat_get_fat_cluster(struct inode *inode, u32 fcluster, u32 *dcluster);
+int __exfat_get_fat_cluster(struct inode *inode, u32 fcluster, u32 *dcluster,
+			    bool eof_is_fatal);
+
+void exfat_inode_cache_init(struct inode *inode);
+void exfat_inode_cache_drop(struct inode *inode);
+
+int exfat_init_fat(struct super_block *sb);
+
+int exfat_init_bitmap(struct inode *root);
+void exfat_exit_bitmap(struct super_block *sb);
+int exfat_alloc_clusters(struct inode *inode, u32 hint_cluster,
+			 u32 *cluster, u32 nr);
+int exfat_free_clusters_inode(struct inode *inode, u32 start);
+
+
+/*
+ * read only bitmap accessors: used by EXFAT_IOCGETBITMAP ioctl.
+ */
+struct exfat_bitmap_ctx {
+	struct super_block *sb;
+	struct buffer_head *bh;
+	sector_t cur_sector;
+};
+
+int exfat_init_bitmap_context(struct super_block *sb,
+			      struct exfat_bitmap_ctx *ctx, u32 cluster);
+void exfat_exit_bitmap_context(struct exfat_bitmap_ctx *ctx);
+int exfat_test_bitmap(struct exfat_bitmap_ctx *ctx, uint32_t start_cluster,
+		      uint32_t *first_in_use, uint32_t *nr_in_use);
+
+
+/*
+ * return the physical sector address for a given cluster.
+ */
+static inline sector_t exfat_cluster_sector(struct exfat_sb_info *sbi,
+					    u32 cluster)
+{
+	return (sector_t)sbi->cluster_heap_offset + (cluster - 2) *
+		(sector_t)sbi->sectors_per_cluster;
+}
+
+/*
+ * in dir.c
+ */
+struct exfat_dir_ctx {
+	struct super_block	*sb;
+	struct inode		*inode;
+	struct buffer_head	*bh;
+
+	off_t			off; /* from beginning of directory */
+	sector_t		sector;
+	bool empty;
+};
+
+int exfat_init_dir_ctx(struct inode *inode, struct exfat_dir_ctx *ctx,
+		       off_t off);
+void exfat_cleanup_dir_ctx(struct exfat_dir_ctx *dctx);
+int exfat_get_cluster_hint(struct inode *inode, u32 *out_hint);
+int exfat_dentry_next(void *, struct exfat_dir_ctx *, int, bool);
+void *__exfat_dentry_next(struct exfat_dir_ctx *dctx, int type, int mask,
+			  bool can_skip, bool *end);
+u16 exfat_direntry_checksum(void *data, u16 checksum, bool first);
+u32 exfat_dctx_fpos(struct exfat_dir_ctx *dctx);
+u64 exfat_dctx_dpos(struct exfat_dir_ctx *dctx);
+int __exfat_get_name(struct exfat_dir_ctx *dctx, u32 name_length, __le16 *name,
+		     u16 *calc_checksum, struct exfat_iloc *iloc);
+
+/*
+ * in namei.c
+ */
+
+/*
+ * hold a pointer to an exfat dir entry, with the corresponding bh.
+ */
+struct dir_entry_buffer {
+	struct buffer_head *bh;
+	u32 off; /* in bytes, inside the buffer_head b_data array */
+	void *start;
+};
+
+int exfat_get_dir_entry_buffers(struct inode *dir, struct exfat_iloc *iloc,
+				struct dir_entry_buffer *entries,
+				size_t nr_entries);
+u16 exfat_dir_entries_checksum(struct dir_entry_buffer *entries, u32 nr);
+void exfat_dirty_dir_entries(struct dir_entry_buffer *entries,
+			     size_t nr_entries, bool sync);
+void exfat_write_time(struct exfat_sb_info *sbi, struct timespec64 *ts,
+		      __le32 *datetime, u8 *time_cs, u8 *tz_offset);
+
+/*
+ * in inode.c
+ */
+
+int exfat_init_inodes(void);
+void exfat_exit_inodes(void);
+
+struct inode *exfat_iget(struct super_block *sb, loff_t disk_pos);
+void exfat_insert_inode_hash(struct inode *inode);
+void exfat_remove_inode_hash(struct inode *inode);
+int __exfat_write_inode(struct inode *inode, bool sync);
+
+/*
+ * in upcase.c
+ */
+int exfat_upcase_init(struct inode *root);
+static inline __le16 exfat_upcase_convert(struct super_block *sb, __le16 _c)
+{
+	u16 c = __le16_to_cpu(_c);
+
+	if (c >= EXFAT_SB(sb)->upcase_len)
+		return _c;
+	return EXFAT_SB(sb)->upcase_table[c];
+}
+
+/*
+ * superblock operations
+ */
+struct inode *exfat_alloc_inode(struct super_block *sb);
+void exfat_destroy_inode(struct inode *_inode);
+int exfat_drop_inode(struct inode *inode);
+void exfat_evict_inode(struct inode *inode);
+
+/*
+ * file operations
+ */
+int exfat_iterate(struct file *f, struct dir_context *ctx);
+long exfat_ioctl(struct file *, unsigned int, unsigned long);
+int exfat_truncate_blocks(struct inode *inode, loff_t newsize);
+
+/*
+ * inode operations
+ */
+struct dentry *exfat_inode_lookup(struct inode *, struct dentry *,
+				  unsigned int);
+int exfat_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode,
+		       bool excl);
+int exfat_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
+
+mode_t exfat_make_mode(struct exfat_sb_info *sbi, mode_t mode, u16 attrs);
+
+int exfat_write_inode(struct inode *inode, struct writeback_control *wbc);
+
+int exfat_inode_unlink(struct inode *inode, struct dentry *dentry);
+
+int exfat_inode_rmdir(struct inode *inode, struct dentry *dentry);
+
+int exfat_getattr(const struct path *, struct kstat *, u32, unsigned int);
+int exfat_setattr(struct dentry *, struct iattr *);
+int exfat_rename(struct inode *, struct dentry *,
+		 struct inode *, struct dentry *, unsigned int);
+
+/*
+ * address space operations
+ */
+int exfat_readpage(struct file *file, struct page *page);
+int exfat_readpages(struct file *file, struct address_space *mapping,
+		    struct list_head *pages, unsigned nr_pages);
+int exfat_write_begin(struct file *file, struct address_space *mapping,
+		      loff_t pos, unsigned len, unsigned flags,
+		      struct page **pagep, void **fsdata);
+int exfat_write_end(struct file *file, struct address_space *mapping,
+		    loff_t pos, unsigned len, unsigned copied,
+		    struct page *page, void *fsdata);
+int exfat_writepage(struct page *page, struct writeback_control *wbc);
+int exfat_writepages(struct address_space *, struct writeback_control *);
+
+
+extern const struct inode_operations exfat_dir_inode_operations;
+extern const struct inode_operations exfat_file_inode_operations;
+extern const struct file_operations exfat_dir_operations;
+extern const struct file_operations exfat_file_operations;
+extern const struct address_space_operations exfat_address_space_operations;
+
+/*
+ * time functions
+ */
+void exfat_time_2unix(struct timespec64 *ts, u32 datetime, u8 time_cs,
+		      s8 tz_offset);
+void exfat_time_2exfat(struct exfat_sb_info *sbi, struct timespec64 *ts,
+		       u32 *datetime, u8 *time_cs, s8 *tz_offset);
+
+static inline void exfat_lock_super(struct super_block *sb)
+{
+	mutex_lock(&EXFAT_SB(sb)->sb_mutex);
+}
+
+static inline void exfat_unlock_super(struct super_block *sb)
+{
+	mutex_unlock(&EXFAT_SB(sb)->sb_mutex);
+}
+
+#endif /*! __EXFAT_H */
diff -Nruw linux-5.4.60-fbx/fs/exfat./fat.c linux-5.4.60-fbx/fs/exfat/fat.c
--- linux-5.4.60-fbx/fs/exfat./fat.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/fat.c	2021-03-04 13:21:00.760839022 +0100
@@ -0,0 +1,424 @@
+/*
+ * fat.c for exfat
+ * Created by <nschichan@freebox.fr> on Mon Jul 29 19:43:38 2013
+ */
+
+#include <linux/fs.h>
+#include <linux/buffer_head.h>
+#include <linux/slab.h>
+
+#include "exfat.h"
+#include "exfat_fs.h"
+
+#define MAX_CACHED_FAT	16
+
+/*
+ * helpers for exfat_next_fat_cluster.
+ */
+
+/*
+ * get the sector number in the fat where the next requested cluster
+ * number is to be found.
+ */
+static inline sector_t cluster_sector(struct exfat_sb_info *sbi, u32 cluster)
+{
+	return sbi->fat_offset + (((u64)cluster * sizeof (u32)) >> sbi->sectorbits);
+}
+
+/*
+ * get the offset in the fat sector where the next requested cluster
+ * number is to be found.
+ */
+static inline off_t cluster_offset(struct exfat_sb_info *sbi, u32 cluster)
+{
+	return (cluster * sizeof (u32)) & sbi->sectormask;
+}
+
+/*
+ * walk one step in the fat chain.
+ */
+static int exfat_next_fat_cluster(struct super_block *sb, u32 *cluster)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	sector_t sect = cluster_sector(sbi, *cluster);
+	off_t off = cluster_offset(sbi, *cluster);
+	struct buffer_head *bh;
+
+	bh = sb_bread(sb, sect);
+	if (!bh) {
+		exfat_msg(sb, KERN_ERR, "unable to read FAT sector at %llu",
+			  (unsigned long long)sect);
+		return -EIO;
+	}
+
+	*cluster = __le32_to_cpu(*(u32*)&bh->b_data[off]);
+	brelse(bh);
+	return 0;
+}
+
+/*
+ * setup inode cache
+ */
+void exfat_inode_cache_init(struct inode *inode)
+{
+	mutex_init(&EXFAT_I(inode)->exfat_cache.mutex);
+	EXFAT_I(inode)->exfat_cache.nr_entries = 0;
+	INIT_LIST_HEAD(&EXFAT_I(inode)->exfat_cache.entries);
+}
+
+/*
+ * drop inode cache content
+ */
+void exfat_inode_cache_drop(struct inode *inode)
+{
+	struct exfat_cache *cache = &EXFAT_I(inode)->exfat_cache;
+	struct exfat_cache_entry *e, *tmp;
+
+	mutex_lock(&cache->mutex);
+	list_for_each_entry_safe (e, tmp, &cache->entries, list) {
+		kfree(e);
+	}
+	INIT_LIST_HEAD(&cache->entries);
+	cache->nr_entries = 0;
+	mutex_unlock(&cache->mutex);
+}
+
+/*
+ * move the entry to the head of the list, this will make it less
+ * likely to be the victim in when caching new entries.
+ *
+ * caller must hold cache->mutex.
+ */
+static void __exfat_fat_lru(struct exfat_cache *cache,
+			  struct exfat_cache_entry *e)
+{
+	if (cache->entries.next != &e->list)
+		list_move(&e->list, &cache->entries);
+}
+
+/*
+ * find a cache entry that is close to the wanted fcluster (ideally
+ * spanning over the requested file cluster).
+ *
+ * caller must hold cache->mutex.
+ */
+static struct exfat_cache_entry *__exfat_cache_lookup(struct exfat_cache *cache,
+						      u32 fcluster)
+{
+	struct exfat_cache_entry *e;
+	struct exfat_cache_entry *best = NULL;
+
+	list_for_each_entry (e, &cache->entries, list) {
+		if (e->file_cluster <= fcluster &&
+		    e->file_cluster + e->nr_contig >= fcluster)
+			return e;
+
+		if (!best && e->file_cluster < fcluster)
+			best = e;
+		if (best && best->file_cluster < e->file_cluster &&
+		    e->file_cluster < fcluster)
+			best = e;
+	}
+	return best;
+}
+
+/*
+ * caller must hold cache->mutex.
+ */
+static int __exfat_cache_cluster(struct exfat_cache *cache,
+			       struct exfat_cache_entry *nearest,
+			       u32 fcluster, u32 dcluster)
+{
+	struct exfat_cache_entry *e;
+
+	/*
+	 * see if we can merge with the nearest entry. in the ideal
+	 * case, all cluster in the chain are contiguous, and only
+	 * one entry is needed for a single file.
+	 */
+	if (nearest &&
+	    nearest->file_cluster + nearest->nr_contig + 1 == fcluster &&
+	    nearest->disk_cluster + nearest->nr_contig + 1 == dcluster) {
+		list_move(&nearest->list, &cache->entries);
+		nearest->nr_contig++;
+		return 0;
+	}
+
+	/*
+	 * allocate a new entry or reuse an existing one if the number
+	 * of cached entries is too hihc.
+	 */
+	if (cache->nr_entries < MAX_CACHED_FAT) {
+		e = kmalloc(sizeof (*e), GFP_NOFS);
+		list_add(&e->list, &cache->entries);
+		++cache->nr_entries;
+	} else {
+		e = list_entry(cache->entries.prev, struct exfat_cache_entry,
+			       list);
+		list_move(&e->list, &cache->entries);
+	}
+
+	if (!e)
+		return -ENOMEM;
+
+	e->file_cluster = fcluster;
+	e->disk_cluster = dcluster;
+	e->nr_contig = 0;
+
+	return 0;
+}
+
+int __exfat_get_fat_cluster(struct inode *inode, u32 fcluster, u32 *dcluster,
+			    bool eof_is_fatal)
+{
+	struct exfat_inode_info *info = EXFAT_I(inode);
+	struct exfat_cache *cache = &info->exfat_cache;
+	int error;
+	struct exfat_cache_entry *e;
+	u32 fcluster_start;
+
+	/*
+	 * intial translation: first file cluster is found in the
+	 * inode info.
+	 */
+	if (fcluster == 0) {
+		*dcluster = info->first_cluster;
+		return 0;
+	}
+
+	mutex_lock(&cache->mutex);
+	/*
+	 * try to find a cached entry either covering the file cluster
+	 * we want or at least close to the file cluster.
+	 */
+	e = __exfat_cache_lookup(cache, fcluster);
+	if (e && e->file_cluster <= fcluster &&
+	    e->file_cluster + e->nr_contig >= fcluster) {
+		/*
+		 * perfect match, entry zone covers the requested file
+		 * cluster.
+		 */
+		__exfat_fat_lru(cache, e);
+		*dcluster = e->disk_cluster + (fcluster - e->file_cluster);
+		mutex_unlock(&cache->mutex);
+		return 0;
+	}
+
+	if (e) {
+		/*
+		 * we have an entry, hopefully close enough, setup
+		 * cluster walk from there.
+		 */
+		*dcluster = e->disk_cluster + e->nr_contig;
+		fcluster_start = e->file_cluster + e->nr_contig;
+	} else {
+		/*
+		 * no entry, walk the FAT chain from the start of the
+		 * file.
+		 */
+		fcluster_start = 0;
+		*dcluster = info->first_cluster;
+	}
+
+	/*
+	 * walk fhe FAT chain the number of time required to get the
+	 * disk cluster corresponding to the file cluster.
+	 */
+	while (fcluster_start != fcluster) {
+		error = exfat_next_fat_cluster(inode->i_sb, dcluster);
+		if (error) {
+			mutex_unlock(&cache->mutex);
+			return error;
+		}
+		if (*dcluster == EXFAT_CLUSTER_EOF) {
+			if (eof_is_fatal)
+				/*
+				 * exfat_fill_root uses
+				 * __exfat_get_fat_cluster with
+				 * eof_is_fatal set to false, as the
+				 * root inode does not have a size
+				 * field and thus requires a complete
+				 * FAT walk to compute the size.
+				 */
+				exfat_fs_error(inode->i_sb, "premature EOF in FAT "
+					       "chain. file cluster %u out "
+					       "of %u\n", fcluster_start,
+					       fcluster);
+			mutex_unlock(&cache->mutex);
+			return -EIO;
+		}
+		if (*dcluster < EXFAT_CLUSTER_FIRSTVALID) {
+			exfat_fs_error(inode->i_sb, "invalid cluster %u found "
+				       "in fat chain.", *dcluster);
+			mutex_unlock(&cache->mutex);
+			return -EIO;
+		}
+		++fcluster_start;
+	}
+
+	/*
+	 * cache the result.
+	 */
+	__exfat_cache_cluster(cache, e, fcluster, *dcluster);
+	mutex_unlock(&cache->mutex);
+	return 0;
+}
+
+int exfat_get_fat_cluster(struct inode *inode, u32 fcluster, u32 *dcluster)
+{
+	return __exfat_get_fat_cluster(inode, fcluster, dcluster, true);
+}
+
+int exfat_init_fat(struct super_block *sb)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	struct buffer_head *bh;
+	int error = 0;
+	u32 first, second;
+
+	bh = sb_bread(sb, sbi->fat_offset);
+	if (!bh) {
+		exfat_msg(sb, KERN_ERR, "unable to read FAT sector at %u",
+			  sbi->fat_offset);
+		return -EIO;
+	}
+
+	first = __le32_to_cpu(*(__le32*)(bh->b_data + 0));
+	second = __le32_to_cpu(*(__le32*)(bh->b_data + sizeof (__le32)));
+
+	if (first != 0xf8ffffff && second != 0xffffffff) {
+		exfat_msg(sb, KERN_INFO, "invalid FAT start: %08x, %08x",
+			  first, second);
+		error = -ENXIO;
+	}
+
+	brelse(bh);
+	return error;
+}
+
+/*
+ * fat write context, store the current buffer_head and current
+ * cluster to avoid having sb_bread all the time when the clusters are
+ * contiguous or at least not too far apart.
+ */
+struct fat_write_ctx {
+	struct super_block *sb;
+	struct buffer_head *bh;
+	u32 cur_cluster;
+};
+
+static void fat_init_write_ctx(struct fat_write_ctx *fwctx,
+				struct super_block *sb)
+{
+	memset(fwctx, 0, sizeof (*fwctx));
+	fwctx->sb = sb;
+}
+
+static void fat_exit_write_ctx(struct fat_write_ctx *fwctx)
+{
+	if (fwctx->bh)
+		brelse(fwctx->bh);
+}
+
+static int __fat_write_entry(struct fat_write_ctx *fwctx,
+			       u32 cluster, u32 next)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(fwctx->sb);
+	sector_t current_sector = cluster_sector(sbi, fwctx->cur_cluster);
+	sector_t wanted_sector = cluster_sector(sbi, cluster);
+	off_t off = cluster_offset(sbi, cluster);
+
+	/*
+	 * first see if we need a different buffer head from the
+	 * current one in the fat_write_ctx.
+	 */
+	if (current_sector != wanted_sector || !fwctx->bh) {
+		if (fwctx->bh)
+			brelse(fwctx->bh);
+		fwctx->bh = sb_bread(fwctx->sb, wanted_sector);
+		if (!fwctx->bh) {
+			exfat_msg(fwctx->sb, KERN_ERR,
+				  "unable to read FAT sector at %llu",
+				  (unsigned long long)wanted_sector);
+			return -EIO;
+		}
+	}
+
+	/*
+	 * set fat cluster to point to the next cluster, and mark bh
+	 * dirty so that the change hits the storage device.
+	 */
+	fwctx->cur_cluster = cluster;
+	*(__le32*)(fwctx->bh->b_data + off) = __cpu_to_le32(next);
+	mark_buffer_dirty(fwctx->bh);
+	return 0;
+}
+
+/*
+ * write nr_clusters contiguous clusters starting at first_cluster.
+ */
+int exfat_write_fat_contiguous(struct inode *inode, u32 first_cluster,
+			       u32 nr_clusters)
+{
+	u32 cluster;
+	struct fat_write_ctx fwctx;
+	int error = 0;
+
+	fat_init_write_ctx(&fwctx, inode->i_sb);
+	for (cluster = first_cluster;
+	     cluster < first_cluster + nr_clusters - 1;
+	     ++cluster) {
+		error = __fat_write_entry(&fwctx, cluster, cluster + 1);
+		if (error)
+			goto end;
+	}
+
+	/*
+	 * set EOF
+	 */
+	error = __fat_write_entry(&fwctx, cluster, EXFAT_CLUSTER_EOF);
+end:
+	fat_exit_write_ctx(&fwctx);
+	return error;
+
+}
+
+/*
+ * write cluster nr_clusters stored in clusters array, link with prev_cluster.
+ */
+int exfat_write_fat(struct inode *inode, u32 prev_cluster, u32 *clusters,
+		    u32 nr_clusters)
+{
+	u32 i;
+	struct fat_write_ctx fwctx;
+	int error;
+
+	if (!nr_clusters)
+		/* ??! */
+		return 0;
+
+	fat_init_write_ctx(&fwctx, inode->i_sb);
+
+	if (prev_cluster) {
+		/*
+		 * link with previous cluster if applicable.
+		 */
+		error = __fat_write_entry(&fwctx, prev_cluster, clusters[0]);
+		if (error)
+			goto end;
+	}
+	for (i = 0; i < nr_clusters - 1; ++i) {
+		error = __fat_write_entry(&fwctx, clusters[i], clusters[i + 1]);
+		if (error)
+			goto end;
+	}
+
+	/*
+	 * set EOF.
+	 */
+	error = __fat_write_entry(&fwctx, clusters[i], EXFAT_CLUSTER_EOF);
+
+ end:
+	fat_exit_write_ctx(&fwctx);
+	return error;
+}
diff -Nruw linux-5.4.60-fbx/fs/exfat./file.c linux-5.4.60-fbx/fs/exfat/file.c
--- linux-5.4.60-fbx/fs/exfat./file.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/file.c	2021-03-04 13:21:00.760839022 +0100
@@ -0,0 +1,427 @@
+/*
+ * file.c for exfat
+ * Created by <nschichan@freebox.fr> on Tue Aug 20 14:39:41 2013
+ */
+
+#include <linux/buffer_head.h>
+#include <linux/fs.h>
+#include <linux/exfat_user.h>
+
+#include "exfat.h"
+#include "exfat_fs.h"
+
+static int append_fragment(struct exfat_fragment __user *ufrag,
+			   struct exfat_fragment *kfrag)
+{
+	if (copy_to_user(ufrag, kfrag, sizeof (*kfrag)))
+		return -EFAULT;
+	return 0;
+}
+
+static void setup_fragment(struct exfat_sb_info *sbi,
+			  struct exfat_fragment *fragment, uint32_t fcluster,
+			  uint32_t dcluster)
+{
+	fragment->fcluster_start = fcluster;
+	fragment->dcluster_start = dcluster;
+	fragment->sector_start = exfat_cluster_sector(sbi, dcluster);
+	fragment->nr_clusters = 1;
+}
+
+static int exfat_ioctl_get_fragments(struct inode *inode,
+				     struct exfat_fragment_head __user *uhead)
+{
+	struct exfat_fragment_head head;
+	struct exfat_fragment fragment;
+	u32 fcluster;
+	u32 prev_dcluster;
+	u32 cur_fragment;
+	struct exfat_inode_info *info = EXFAT_I(inode);
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+	int error;
+
+	memset(&fragment, 0, sizeof (fragment));
+
+	if (copy_from_user(&head, uhead, sizeof (head)))
+		return -EFAULT;
+
+
+	if (put_user(sbi->sectorsize, &uhead->sector_size) ||
+	    put_user(sbi->clustersize, &uhead->cluster_size))
+		return -EFAULT;
+
+	if (!head.nr_fragments) {
+		/*
+		 * user did not provide space for fragments after
+		 * header.
+		 */
+		return 0;
+	}
+
+	if (head.fcluster_start >= info->allocated_clusters) {
+		/*
+		 * requested start cluster is after file EOF
+		 */
+		if (put_user(0, &uhead->nr_fragments))
+			return -EFAULT;
+		return 0;
+	}
+
+	if (info->flags & EXFAT_I_FAT_INVALID) {
+		/*
+		 * not FAT chain, this file has only one fragment.
+		 */
+		fragment.fcluster_start = head.fcluster_start;
+		fragment.dcluster_start =
+			info->first_cluster + head.fcluster_start;
+		fragment.nr_clusters = info->allocated_clusters -
+			head.fcluster_start;
+		fragment.sector_start =
+			exfat_cluster_sector(sbi, fragment.dcluster_start);
+
+		if (copy_to_user(&uhead->fragments[0], &fragment,
+				 sizeof (fragment)))
+			return -EFAULT;
+		if (put_user(1, &uhead->nr_fragments))
+			return -EFAULT;
+		if (put_user(info->first_cluster + info->allocated_clusters,
+			     &uhead->fcluster_start))
+			return -EFAULT;
+		return 0;
+	}
+
+	fcluster = head.fcluster_start;
+	cur_fragment = 0;
+
+	/*
+	 * initial fragment setup
+	 */
+	error = exfat_get_fat_cluster(inode, fcluster,
+				      &prev_dcluster);
+	if (error)
+		return error;
+	setup_fragment(sbi, &fragment, fcluster, prev_dcluster);
+	++fcluster;
+	while (fcluster < info->allocated_clusters) {
+		int error;
+		u32 dcluster;
+
+		/*
+		 * walk one step in the FAT.
+		 */
+		error = exfat_get_fat_cluster(inode, fcluster, &dcluster);
+		if (error)
+			return error;
+
+		if (prev_dcluster == dcluster - 1) {
+			/*
+			 * dcluster and prev_dcluster are contiguous.
+			 */
+			++fragment.nr_clusters;
+		} else {
+			/*
+			 * put this cluster in the user array
+			 */
+			error = append_fragment(&uhead->fragments[cur_fragment],
+						&fragment);
+			if (error)
+				return error;
+
+			++cur_fragment;
+			if (cur_fragment == head.nr_fragments)
+				break;
+
+			/*
+			 * setup a new fragment.
+			 */
+			setup_fragment(sbi, &fragment, fcluster, dcluster);
+		}
+		++fcluster;
+		prev_dcluster = dcluster;
+	}
+
+	if (cur_fragment < head.nr_fragments) {
+		append_fragment(&uhead->fragments[cur_fragment], &fragment);
+		++cur_fragment;
+	}
+
+	/*
+	 * update nr_fragments in user supplied head.
+	 */
+	if (cur_fragment != head.nr_fragments &&
+	    put_user(cur_fragment, &uhead->nr_fragments))
+		return -EFAULT;
+
+	/*
+	 * update fcluster_start in user supplied head.
+	 */
+	if (put_user(fcluster, &uhead->fcluster_start))
+		return -EFAULT;
+
+
+	return 0;
+}
+
+static int exfat_ioctl_get_bitmap(struct super_block *sb,
+				  struct exfat_bitmap_head __user *uhead)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	struct exfat_bitmap_head head;
+	uint32_t i;
+	int error;
+	struct exfat_bitmap_ctx ctx;
+	uint32_t start_cluster;
+
+	if (copy_from_user(&head, uhead, sizeof (head)))
+		return -EFAULT;
+
+	start_cluster = head.start_cluster;
+	if (start_cluster < 2)
+		return -EINVAL;
+
+
+	error = exfat_init_bitmap_context(sb, &ctx, head.start_cluster);
+	if (error)
+		return error;
+	for (i = 0; i < head.nr_entries; ++i) {
+		uint32_t first_in_use;
+		uint32_t nr_in_use;
+		int error;
+
+		error = exfat_test_bitmap(&ctx, start_cluster, &first_in_use,
+					  &nr_in_use);
+		if (error)
+			goto out_error;
+
+		if (first_in_use == sbi->cluster_count)
+			break;
+		if (put_user(first_in_use, &uhead->entries[i].start_cluster))
+			goto out_efault;
+		if (put_user(nr_in_use, &uhead->entries[i].nr_clusters))
+			goto out_efault;
+		if (put_user(exfat_cluster_sector(sbi, first_in_use),
+			     &uhead->entries[i].sector_start))
+			goto out_efault;
+		if (put_user((u64)nr_in_use * sbi->sectors_per_cluster,
+			     &uhead->entries[i].nr_sectors))
+			goto out_efault;
+		start_cluster = first_in_use + nr_in_use + 1;
+	}
+
+	exfat_exit_bitmap_context(&ctx);
+	if (put_user(i, &uhead->nr_entries))
+		return -EFAULT;
+	if (put_user(start_cluster, &uhead->start_cluster))
+		return -EFAULT;
+
+	return 0;
+
+out_efault:
+	error = -EFAULT;
+out_error:
+	exfat_exit_bitmap_context(&ctx);
+	return error;
+}
+
+static int exfat_ioctl_get_dirents(struct inode *inode,
+				   struct exfat_dirent_head __user *uhead)
+{
+	struct exfat_dir_ctx dctx;
+	struct exfat_dirent_head head;
+	int error;
+	uint32_t i;
+
+	if (!S_ISDIR(inode->i_mode))
+		return -ENOTDIR;
+
+	if (copy_from_user(&head, uhead, sizeof (head)))
+		return -EFAULT;
+
+	/* make sure we're aligned on an entry boundary */
+	head.offset &= ~0x1f;
+
+	error = exfat_init_dir_ctx(inode, &dctx, head.offset);
+	if (error < 0)
+		return error;
+
+	error = 0;
+	for (i = 0; i < head.nr_entries; ++i) {
+		bool end;
+		u8 *entry = __exfat_dentry_next(&dctx, 0, 0, false, &end);
+		u8 type;
+
+		if (!entry && end)
+			/* genuine end of file */
+			break;
+		if (!entry) {
+			/* something went wrong */
+			error = -EIO;
+			goto out;
+		}
+		type = *entry;
+
+		if (put_user(type, &uhead->entries[i])) {
+			error = -EFAULT;
+			goto out;
+		}
+	}
+
+	/*
+	 * update head nr_entries and offset.
+	 */
+	if (put_user(i, &uhead->nr_entries))  {
+		error = -EFAULT;
+		goto out;
+	}
+	if (put_user(head.offset + 0x20 * i, &uhead->offset)) {
+		error = -EFAULT;
+		goto out;
+	}
+
+ out:
+	exfat_cleanup_dir_ctx(&dctx);
+	return error;
+}
+
+long exfat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	switch (cmd) {
+	case EXFAT_IOCGETFRAGMENTS:
+		return exfat_ioctl_get_fragments(file_inode(file),
+						 (void __user*)arg);
+	case EXFAT_IOCGETBITMAP:
+		return exfat_ioctl_get_bitmap(file_inode(file)->i_sb,
+					      (void __user*)arg);
+	case EXFAT_IOCGETDIRENTS:
+		return exfat_ioctl_get_dirents(file_inode(file),
+					       (void __user*)arg);
+	default:
+		return -ENOTTY;
+	}
+}
+
+static int exfat_cont_expand(struct inode *inode, loff_t newsize)
+{
+	int error;
+
+	error = generic_cont_expand_simple(inode, newsize);
+	if (error)
+		return error;
+
+	inode->i_mtime = current_time(inode);
+	mark_inode_dirty(inode);
+
+	if (IS_SYNC(inode))
+		exfat_msg(inode->i_sb, KERN_ERR, "TODO: cont_expand with "
+			  "sync mode.");
+	return 0;
+}
+
+int exfat_truncate_blocks(struct inode *inode, loff_t newsize)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+	u32 fcluster = (newsize + sbi->clustersize - 1) >> sbi->clusterbits;
+	int error;
+
+	if (EXFAT_I(inode)->mmu_private > newsize)
+		EXFAT_I(inode)->mmu_private = newsize;
+
+	error = exfat_free_clusters_inode(inode, fcluster);
+	if (error) {
+		exfat_msg(inode->i_sb, KERN_INFO, "exfat_free_clusters_inode: "
+			  "%i", error);
+		return error;
+	}
+
+	return 0;
+}
+
+int exfat_getattr(const struct path *path, struct kstat *stat, u32 request_mask,
+		  unsigned int flags)
+{
+	struct inode *inode = d_inode(path->dentry);
+	generic_fillattr(inode, stat);
+	stat->blksize = EXFAT_SB(inode->i_sb)->clustersize;
+	return 0;
+}
+
+#define EXFAT_VALID_MODE       (S_IFREG | S_IFDIR | S_IRWXUGO)
+
+static int exfat_mode_fixup(struct inode *inode, umode_t *mode)
+{
+	mode_t mask, perm;
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+
+	if (S_ISDIR(*mode))
+		mask = sbi->options.dmask;
+	else
+		mask = sbi->options.fmask;
+
+	perm = *mode & ~(S_IFMT | mask);
+
+	/*
+	 * we want 'r' and 'x' bits when mask allows for it.
+	 */
+	if ((perm & (S_IRUGO | S_IXUGO)) !=
+	    (inode->i_mode & ~mask & (S_IRUGO | S_IXUGO))) {
+		return -EPERM;
+	}
+
+	/*
+	 * we want all 'w' bits or none, depending on mask.
+	 */
+	if ((perm & S_IWUGO) && (perm & S_IWUGO) != (~mask & S_IWUGO))
+		return -EPERM;
+	*mode &= ~mask;
+	return 0;
+}
+
+int exfat_setattr(struct dentry *dentry, struct iattr *attrs)
+{
+	struct inode *inode = dentry->d_inode;
+	int error;
+
+	/*
+	 * can set uid/gid, only if it the same as the current one in
+	 * the inode.
+	 */
+	if (attrs->ia_valid & ATTR_UID &&
+	    !uid_eq(inode->i_uid, attrs->ia_uid))
+		return -EPERM;
+
+	if (attrs->ia_valid & ATTR_GID &&
+	    !gid_eq(inode->i_gid, attrs->ia_gid))
+		return -EPERM;
+
+	if (attrs->ia_valid & ATTR_MODE &&
+	    (attrs->ia_mode & ~EXFAT_VALID_MODE ||
+	     exfat_mode_fixup(inode, &attrs->ia_mode) < 0)) {
+		/*
+		 * silently ignore mode change if we're not OK with
+		 * it (same behavior as vfat).
+		 */
+		attrs->ia_valid &= ~ATTR_MODE;
+	}
+
+	if (attrs->ia_valid & ATTR_SIZE) {
+		inode_dio_wait(inode);
+		if (attrs->ia_size > inode->i_size) {
+			/*
+			 * expand file
+			 */
+			error = exfat_cont_expand(inode, attrs->ia_size);
+			if (error)
+				return error;
+		} else {
+			/*
+			 * shrink file
+			 */
+			truncate_setsize(inode, attrs->ia_size);
+			exfat_truncate_blocks(inode, attrs->ia_size);
+		}
+	}
+
+	setattr_copy(inode, attrs);
+	mark_inode_dirty(inode);
+	return 0;
+}
diff -Nruw linux-5.4.60-fbx/fs/exfat./inode.c linux-5.4.60-fbx/fs/exfat/inode.c
--- linux-5.4.60-fbx/fs/exfat./inode.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/inode.c	2021-03-04 13:21:00.760839022 +0100
@@ -0,0 +1,277 @@
+/*
+ * inode.c<2> for exfat
+ * Created by <nschichan@freebox.fr> on Wed Jul 24 16:15:52 2013
+ */
+
+#include <linux/kernel.h>
+#include <linux/fs.h>
+#include <linux/slab.h>
+#include <linux/buffer_head.h>
+#include <linux/writeback.h>
+#include <linux/hash.h>
+
+#include "exfat_fs.h"
+#include "exfat.h"
+
+static struct kmem_cache *exfat_inodes_cachep;
+
+/*
+ * inode callbacks.
+ */
+struct inode *exfat_alloc_inode(struct super_block *sb)
+{
+	struct exfat_inode_info *ei = kmem_cache_alloc(exfat_inodes_cachep,
+						       GFP_NOFS);
+
+	if (!ei)
+		return NULL;
+
+	return &ei->vfs_inode;
+}
+
+static void exfat_i_callback(struct rcu_head *head)
+{
+	struct inode *inode = container_of(head, struct inode, i_rcu);
+
+	kmem_cache_free(exfat_inodes_cachep, EXFAT_I(inode));
+}
+
+void exfat_destroy_inode(struct inode *_inode)
+{
+	struct exfat_inode_info *inode = EXFAT_I(_inode);
+
+	call_rcu(&inode->vfs_inode.i_rcu, exfat_i_callback);
+}
+
+static void exfat_inode_init_once(void *ptr)
+{
+	struct exfat_inode_info *info = ptr;
+
+	INIT_HLIST_NODE(&info->hash_list);
+	exfat_inode_cache_init(&info->vfs_inode);
+	inode_init_once(&info->vfs_inode);
+}
+
+/*
+ * inode cache create/destroy.
+ */
+int exfat_init_inodes(void)
+{
+	exfat_inodes_cachep = kmem_cache_create("exfat-inodes",
+				       sizeof (struct exfat_inode_info), 0,
+				       SLAB_RECLAIM_ACCOUNT |SLAB_MEM_SPREAD,
+				       exfat_inode_init_once);
+	if (!exfat_inodes_cachep)
+		return -ENOMEM;
+	return 0;
+}
+
+void exfat_exit_inodes(void)
+{
+	kmem_cache_destroy(exfat_inodes_cachep);
+}
+
+int exfat_drop_inode(struct inode *inode)
+{
+	return generic_drop_inode(inode);
+}
+
+void exfat_evict_inode(struct inode *inode)
+{
+	truncate_inode_pages_final(&inode->i_data);
+	if (!inode->i_nlink) {
+		inode->i_size = 0;
+		exfat_free_clusters_inode(inode, 0);
+	}
+	invalidate_inode_buffers(inode);
+	clear_inode(inode);
+	exfat_remove_inode_hash(inode);
+	exfat_inode_cache_drop(inode);
+}
+
+static u32 exfat_hash(loff_t disk_pos)
+{
+	return hash_32(disk_pos, EXFAT_HASH_BITS);
+}
+
+struct inode *exfat_iget(struct super_block *sb, loff_t disk_pos)
+{
+	struct exfat_inode_info *info;
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	struct hlist_head *head = sbi->inode_hash + exfat_hash(disk_pos);
+	struct inode *ret = NULL;
+
+
+	spin_lock(&sbi->inode_hash_lock);
+	hlist_for_each_entry (info, head, hash_list) {
+		if (info->iloc.disk_offs[0] != disk_pos)
+			continue ;
+		ret = igrab(&info->vfs_inode);
+		if (ret)
+			break;
+	}
+	spin_unlock(&sbi->inode_hash_lock);
+	return ret;
+}
+
+void exfat_insert_inode_hash(struct inode *inode)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+	struct exfat_inode_info *info = EXFAT_I(inode);
+	struct hlist_head *head = sbi->inode_hash +
+		exfat_hash(info->iloc.disk_offs[0]);
+
+	spin_lock(&sbi->inode_hash_lock);
+	hlist_add_head(&info->hash_list, head);
+	spin_unlock(&sbi->inode_hash_lock);
+}
+
+void exfat_remove_inode_hash(struct inode *inode)
+{
+	struct exfat_inode_info *info = EXFAT_I(inode);
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+
+	spin_lock(&sbi->inode_hash_lock);
+	info->iloc.disk_offs[0] = 0;
+	hlist_del_init(&info->hash_list);
+	spin_unlock(&sbi->inode_hash_lock);
+}
+
+/*
+ * calculate the number of links in a directory. this is the number of
+ * EXFAT_FILEDIR_ENTRY typed elements in the directory stream. This
+ * does not include the '.' and '..' entries.
+ */
+loff_t exfat_dir_links(struct inode *inode)
+{
+	size_t ret = 0;
+	struct exfat_dir_ctx dctx;
+	int error;
+	bool end;
+
+	error = exfat_init_dir_ctx(inode, &dctx, 0);
+	if (error)
+		return error;
+
+	error = -EIO;
+	for (;;) {
+		struct exfat_filedir_entry *e =
+			__exfat_dentry_next(&dctx, E_EXFAT_FILEDIR, 0xff,
+					    true, &end);
+		if (!e) {
+			if (end)
+				error = 0;
+			goto out;
+		}
+		++ret;
+	}
+out:
+	exfat_cleanup_dir_ctx(&dctx);
+	if (error)
+		return error;
+	return ret;
+}
+
+int exfat_get_cluster_hint(struct inode *inode, u32 *out_hint)
+{
+	struct exfat_inode_info *info = EXFAT_I(inode);
+	int error;
+	u32 first_cluster = info->first_cluster;
+
+
+	if (!first_cluster) {
+		/*
+		 * empty file, return a cluster likely to be free.
+		 */
+		*out_hint = EXFAT_SB(inode->i_sb)->prev_free_cluster + 2;
+		return 0;
+	}
+
+	if (info->flags & EXFAT_I_FAT_INVALID) {
+		/*
+		 * not fat run, all clusters are contiguous, set hint
+		 * to next last file cluster.
+		 */
+		*out_hint = first_cluster + info->allocated_clusters;
+		return 0;
+	}
+
+	/*
+	 * fat run available, walk it to get the last physical cluster
+	 * address and set hint to the immediate next physical
+	 * cluster.
+	 */
+	error = exfat_get_fat_cluster(inode, info->allocated_clusters - 1,
+				      out_hint);
+	if (error)
+		return error;
+	(*out_hint)++;
+	return 0;
+}
+
+int __exfat_write_inode(struct inode *inode, bool sync)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+	struct exfat_inode_info *info = EXFAT_I(inode);
+	struct dir_entry_buffer entries[info->iloc.nr_secondary];
+	int error;
+	struct exfat_filedir_entry *efd;
+	struct exfat_stream_extension_entry *esx;
+	u16 checksum;
+
+	if (inode->i_ino == EXFAT_ROOT_INO)
+		return 0;
+
+	if (info->iloc.disk_offs[0] == 0) {
+		/*
+		 * write_inode() to unlinked inode: don't corrupt
+		 * superblock.
+		 */
+		return 0;
+	}
+
+	error = exfat_get_dir_entry_buffers(inode, &info->iloc,
+					    entries, info->iloc.nr_secondary);
+	if (error)
+		return error;
+
+	if (inode->i_mode & S_IWUGO)
+		info->attributes &= ~E_EXFAT_ATTR_RO;
+	else
+		info->attributes |= E_EXFAT_ATTR_RO;
+
+	efd = entries[0].start;
+	esx = entries[1].start;
+
+	efd->attributes = __cpu_to_le16(info->attributes);
+	esx->data_length = __cpu_to_le64(inode->i_size);
+	esx->valid_data_length = esx->data_length =
+		__cpu_to_le64(inode->i_size);
+	esx->flags = info->flags;
+	esx->first_cluster = __cpu_to_le32(info->first_cluster);
+
+	exfat_write_time(sbi, &inode->i_ctime, &efd->create, &efd->create_10ms,
+			 &efd->create_tz_offset);
+	exfat_write_time(sbi, &inode->i_mtime, &efd->modified,
+			 &efd->modified_10ms, &efd->modified_tz_offset);
+	exfat_write_time(sbi, &inode->i_atime, &efd->accessed, NULL,
+			 &efd->accessed_tz_offset);
+
+	checksum = exfat_dir_entries_checksum(entries, info->iloc.nr_secondary);
+	efd->set_checksum = __cpu_to_le16(checksum);
+
+	exfat_dirty_dir_entries(entries, info->iloc.nr_secondary, sync);
+
+
+	return 0;
+}
+
+int exfat_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+	int ret;
+
+	exfat_lock_super(inode->i_sb);
+	ret = __exfat_write_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
+	exfat_unlock_super(inode->i_sb);
+	return ret;
+}
diff -Nruw linux-5.4.60-fbx/fs/exfat./Kconfig linux-5.4.60-fbx/fs/exfat/Kconfig
--- linux-5.4.60-fbx/fs/exfat./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/Kconfig	2021-03-04 13:21:00.760839022 +0100
@@ -0,0 +1,3 @@
+
+config EXFAT_FS_FBX
+	tristate "exFAT fs support"
diff -Nruw linux-5.4.60-fbx/fs/exfat./Makefile linux-5.4.60-fbx/fs/exfat/Makefile
--- linux-5.4.60-fbx/fs/exfat./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/Makefile	2021-03-04 13:21:00.760839022 +0100
@@ -0,0 +1,13 @@
+
+obj-$(CONFIG_EXFAT_FS_FBX)	+= exfat.o
+
+exfat-y	= super.o				\
+	inode.o					\
+	fat.o					\
+	read-write.o				\
+	upcase.o				\
+	bitmap.o				\
+	time.o					\
+	dir.o					\
+	namei.o					\
+	file.o
diff -Nruw linux-5.4.60-fbx/fs/exfat./namei.c linux-5.4.60-fbx/fs/exfat/namei.c
--- linux-5.4.60-fbx/fs/exfat./namei.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/namei.c	2021-03-04 13:21:00.760839022 +0100
@@ -0,0 +1,931 @@
+/*
+ * namei.c for exfat
+ * Created by <nschichan@freebox.fr> on Tue Aug 20 12:00:27 2013
+ */
+
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/fs.h>
+#include <linux/buffer_head.h>
+#include <linux/nls.h>
+
+#include "exfat.h"
+#include "exfat_fs.h"
+
+static u16 exfat_filename_hash_cont(struct super_block *sb,
+				    const __le16 *name, u16 hash, size_t len);
+
+
+void exfat_write_time(struct exfat_sb_info *sbi, struct timespec64 *ts,
+		      __le32 *datetime, u8 *time_cs, u8 *tz_offset)
+{
+	u32 cpu_datetime;
+
+	exfat_time_2exfat(sbi, ts, &cpu_datetime, time_cs, tz_offset);
+	*datetime = __cpu_to_le32(cpu_datetime);
+}
+
+static void exfat_read_time(struct timespec64 *ts, __le32 datetime, u8 time_cs,
+			    u8 tz_offset)
+{
+	u32 cpu_datetime = __le32_to_cpu(datetime);
+	exfat_time_2unix(ts, cpu_datetime, time_cs, tz_offset);
+}
+
+static int exfat_zero_cluster(struct super_block *sb, u32 cluster, bool sync)
+{
+	sector_t start = exfat_cluster_sector(EXFAT_SB(sb), cluster);
+	sector_t end = start + EXFAT_SB(sb)->sectors_per_cluster;
+	sector_t sect;
+
+	for (sect = start; sect < end; ++sect) {
+		struct buffer_head *bh = sb_bread(sb, sect);
+		if (!bh) {
+			exfat_msg(sb, KERN_WARNING,
+				  "unable to read sector %llu for zeroing.",
+				  (unsigned long long)sect);
+			return -EIO;
+		}
+		memset(bh->b_data, 0, bh->b_size);
+		mark_buffer_dirty(bh);
+		if (sync)
+			sync_dirty_buffer(bh);
+		brelse(bh);
+	}
+	return 0;
+}
+
+/*
+ * use per superblock fmask or dmaks, depending on provided entry
+ * attribute to restrict the provided mode even more.
+ */
+mode_t exfat_make_mode(struct exfat_sb_info *sbi, mode_t mode, u16 attrs)
+{
+	if (attrs & E_EXFAT_ATTR_DIRECTORY)
+		mode = (mode & ~sbi->options.dmask) | S_IFDIR;
+	else
+		mode = (mode & ~sbi->options.fmask) | S_IFREG;
+	if (attrs & E_EXFAT_ATTR_RO)
+		mode &= ~S_IWUGO;
+	return mode;
+}
+
+/*
+ * populate inode fields.
+ */
+static struct inode *exfat_populate_inode(struct super_block *sb,
+			  const struct exfat_filedir_entry *efd,
+			  const struct exfat_stream_extension_entry *esx,
+			  const struct exfat_iloc *iloc)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	struct inode *inode;
+
+	inode = exfat_iget(sb, iloc->disk_offs[0]);
+	if (inode)
+		return inode;
+
+	inode = new_inode(sb);
+	if (!inode)
+		return NULL;
+
+	inode->i_ino = iunique(sb, EXFAT_ROOT_INO);
+	EXFAT_I(inode)->first_cluster = __le32_to_cpu(esx->first_cluster);
+	EXFAT_I(inode)->flags = esx->flags;
+	EXFAT_I(inode)->iloc = *iloc;
+	EXFAT_I(inode)->attributes = __le16_to_cpu(efd->attributes);
+
+	inode->i_size = __le64_to_cpu(esx->data_length);
+	EXFAT_I(inode)->allocated_clusters = inode->i_size >> sbi->clusterbits;
+	if (inode->i_size & sbi->clustermask)
+		EXFAT_I(inode)->allocated_clusters++;
+	inode->i_blocks = EXFAT_I(inode)->allocated_clusters <<
+		(sbi->clusterbits - 9);
+	EXFAT_I(inode)->mmu_private = inode->i_size;
+
+	inode->i_uid = sbi->options.uid;
+	inode->i_gid = sbi->options.gid;
+	inode->i_mode = exfat_make_mode(sbi, S_IRWXUGO,
+					EXFAT_I(inode)->attributes);
+
+	if (EXFAT_I(inode)->attributes & E_EXFAT_ATTR_DIRECTORY) {
+		loff_t nlinks = exfat_dir_links(inode);
+		if (nlinks < 0)
+			goto iput;
+		set_nlink(inode, nlinks + 2);
+	} else
+		set_nlink(inode, 1);
+
+	if (esx->data_length != esx->valid_data_length)
+		exfat_msg(sb, KERN_WARNING, "data length (%llu) != valid data "
+			  "length (%llu)", __le64_to_cpu(esx->data_length),
+			  __le64_to_cpu(esx->valid_data_length));
+
+	if (S_ISDIR(inode->i_mode)) {
+		inode->i_fop = &exfat_dir_operations;
+		inode->i_op = &exfat_dir_inode_operations;
+	} else {
+		/* until we support write */
+		inode->i_fop = &exfat_file_operations;
+		inode->i_op = &exfat_file_inode_operations;
+		inode->i_data.a_ops = &exfat_address_space_operations;
+	}
+
+
+	exfat_read_time(&inode->i_ctime, efd->create, efd->create_10ms,
+			efd->create_tz_offset);
+	exfat_read_time(&inode->i_mtime, efd->modified, efd->modified_10ms,
+			efd->modified_tz_offset);
+	exfat_read_time(&inode->i_atime, efd->accessed, 0,
+			efd->accessed_tz_offset);
+
+	exfat_insert_inode_hash(inode);
+	insert_inode_hash(inode);
+	return inode;
+iput:
+	iput(inode);
+	return NULL;
+}
+
+/*
+ * lookup an inode.
+ */
+struct dentry *exfat_inode_lookup(struct inode *parent, struct dentry *dentry,
+				  unsigned int flags)
+{
+	struct super_block *sb = dentry->d_sb;
+	struct exfat_dir_ctx dctx;
+	int error;
+	struct exfat_filedir_entry efd;
+	struct exfat_stream_extension_entry esx;
+	__le16 *name = __getname();
+	__le16 *utf16_name = __getname();
+	unsigned int utf16_name_length;
+	__le16 name_hash;
+
+	exfat_lock_super(parent->i_sb);
+
+	if (!name || !utf16_name) {
+		error = -ENOMEM;
+		goto putnames;
+	}
+
+	utf16_name_length = utf8s_to_utf16s(dentry->d_name.name,
+					    dentry->d_name.len,
+					    UTF16_LITTLE_ENDIAN,
+					    utf16_name, 255 + 2);
+	if (utf16_name_length > 255) {
+		error = -ENAMETOOLONG;
+		goto putnames;
+	}
+
+	/*
+	 * get the name hash of the wanted inode early so that we can
+	 * skip entries with only an efd and an esx entry.
+	 */
+	name_hash = __cpu_to_le16(exfat_filename_hash_cont(sb, utf16_name, 0,
+							   utf16_name_length));
+
+	/*
+	 * create a dir ctx from the parent so that we can iterate on
+	 * it.
+	 */
+	error = exfat_init_dir_ctx(parent, &dctx, 0);
+	if (error)
+		goto putnames;
+
+	for (;;) {
+		u32 name_length;
+		struct inode *inode;
+		u16 calc_checksum;
+		u16 expect_checksum;
+		struct exfat_iloc iloc;
+
+		memset(&iloc, 0, sizeof (iloc));
+		/*
+		 * get filedir and stream extension entries.
+		 */
+		error = exfat_dentry_next(&efd, &dctx, E_EXFAT_FILEDIR, true);
+		if (error < 0)
+			/* end of directory reached, or other error */
+			goto cleanup;
+
+		error = -EINVAL;
+		if (efd.secondary_count > 18)
+			goto cleanup;
+
+		iloc.file_off = exfat_dctx_fpos(&dctx);
+		iloc.disk_offs[0] = exfat_dctx_dpos(&dctx);
+		iloc.nr_secondary = efd.secondary_count + 1;
+
+		error = exfat_dentry_next(&esx, &dctx, E_EXFAT_STREAM_EXT,
+					  false);
+		if (error)
+			goto cleanup;
+
+		if (esx.name_hash != name_hash)
+			/*
+			 * stored name hash is not the same as the
+			 * wanted hash: no point in processing the
+			 * remaining entries for the current efd/esx
+			 * any further.
+			 */
+			continue ;
+
+		/*
+		 * now that the hash matches it is ok to update the
+		 * checksum for the efd and esx entries.
+		 */
+		expect_checksum = __le16_to_cpu(efd.set_checksum);
+		calc_checksum = exfat_direntry_checksum(&efd, 0, true);
+
+		calc_checksum = exfat_direntry_checksum(&esx,
+							calc_checksum, false);
+		iloc.disk_offs[1] = exfat_dctx_dpos(&dctx);
+
+		/*
+		 * fetch name.
+		 */
+		name_length = esx.name_length;
+		error = __exfat_get_name(&dctx, name_length, name,
+					 &calc_checksum, &iloc);
+		if (error)
+			goto cleanup;
+
+		if (calc_checksum != expect_checksum) {
+			exfat_msg(dctx.sb, KERN_INFO, "checksum: "
+				  "calculated %04x, expect %04x",
+				  calc_checksum, expect_checksum);
+			error = -EIO;
+			goto cleanup;
+		}
+
+
+		if (utf16_name_length != name_length)
+			continue ;
+
+		if (memcmp(utf16_name, name, name_length * sizeof (__le16)))
+			continue ;
+
+		inode = exfat_populate_inode(sb, &efd, &esx, &iloc);
+		if (inode) {
+			d_add(dentry, inode);
+			error = 0;
+		} else
+			error = -EIO;
+		goto cleanup;
+	}
+
+cleanup:
+	exfat_cleanup_dir_ctx(&dctx);
+putnames:
+	if (name)
+		__putname(name);
+	if (utf16_name)
+		__putname(utf16_name);
+	exfat_unlock_super(parent->i_sb);
+	if (error && error != -ENOENT)
+		return ERR_PTR(error);
+	return NULL;
+}
+
+/*
+ * find nr unused directory entries (type & 0x80 == 0).
+ */
+static int exfat_find_dir_iloc(struct inode *inode, int nr,
+			       struct exfat_iloc *iloc)
+{
+	struct exfat_dir_ctx dctx;
+	bool end = false;
+	int error;
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+	u32 nr_new_clusters, i;
+	u32 new_clusters[2];
+	u32 hint_cluster;
+
+retry:
+	memset(iloc, 0, sizeof (*iloc));
+	iloc->nr_secondary = nr;
+
+	error = exfat_init_dir_ctx(inode, &dctx, 0);
+	if (error)
+		return error;
+
+	while (1) {
+		int nr_free;
+		void *ent;
+
+		ent = __exfat_dentry_next(&dctx, 0x00, 0x80, true, &end);
+		if (end)
+			break;
+		if (!ent) {
+			exfat_cleanup_dir_ctx(&dctx);
+			return -EIO;
+		}
+
+		nr_free = 1;
+		iloc->file_off = exfat_dctx_fpos(&dctx);
+		iloc->disk_offs[0] = exfat_dctx_dpos(&dctx);
+		while (__exfat_dentry_next(&dctx, 0x00, 0x80, false, &end)
+		       != NULL && nr_free < nr) {
+			iloc->disk_offs[nr_free] = exfat_dctx_dpos(&dctx);
+			++nr_free;
+		}
+		if (nr_free == nr) {
+			/*
+			 * we found enough consecutive free entries.
+			 */
+			exfat_cleanup_dir_ctx(&dctx);
+			return 0;
+		}
+
+	}
+
+	/*
+	 * not enough consecutive free entries found, kick the cluster
+	 * allocator and retry.
+	 */
+	exfat_cleanup_dir_ctx(&dctx);
+
+	/*
+	 * with the smallest cluster size, a file can take more than
+	 * two clusters. allocate two in that case reardless of what
+	 * is needed to make code simplier.
+	 */
+	switch (sbi->clustersize) {
+	case 512:
+		nr_new_clusters = 2;
+		break;
+	default:
+		nr_new_clusters = 1;
+		break;
+	}
+
+	/*
+	 * get a hint cluster for the cluster allocator.
+	 */
+	error = exfat_get_cluster_hint(inode, &hint_cluster);
+	if (error)
+		return error;
+
+	/*
+	 * peform the allocation.
+	 */
+	error = exfat_alloc_clusters(inode, hint_cluster, new_clusters,
+				     nr_new_clusters);
+	if (error)
+		return error;
+
+	/*
+	 * fill new cluster(s) with zero.
+	 */
+	for (i = 0; i < nr_new_clusters; ++i)
+		exfat_zero_cluster(inode->i_sb, new_clusters[i], false);
+
+	/*
+	 * update size and mark inode as dirty so that write_inode()
+	 * can update it's size, and the other fields updated by
+	 * exfat_alloc_clusters.
+	 */
+	inode->i_size += nr_new_clusters << sbi->clusterbits;
+	mark_inode_dirty(inode);
+
+	/*
+	 * kick the whole place search again, this time with the newly
+	 * allocated clusters.
+	 */
+	goto retry;
+}
+
+/*
+ * setup dir_entry_buffers starting at using iloc.
+ */
+int exfat_get_dir_entry_buffers(struct inode *dir, struct exfat_iloc *iloc,
+				struct dir_entry_buffer *entries,
+				size_t nr_entries)
+{
+	size_t i;
+	int error;
+	struct exfat_sb_info *sbi = EXFAT_SB(dir->i_sb);
+
+	BUG_ON(iloc->nr_secondary != nr_entries);
+
+	memset(entries, 0, sizeof (*entries) * nr_entries);
+	for (i = 0; i < nr_entries; ++i) {
+		sector_t sector = iloc->disk_offs[i] >> sbi->sectorbits;
+
+		entries[i].off = iloc->disk_offs[i] & sbi->sectormask;
+		entries[i].bh = sb_bread(dir->i_sb, sector);
+		if (!entries[i].bh) {
+			error = -EIO;
+			goto fail;
+		}
+		entries[i].start = entries[i].bh->b_data + entries[i].off;
+	}
+	return 0;
+
+fail:
+	for (i = 0; i < nr_entries; ++i)
+		if (entries[i].bh)
+			brelse(entries[i].bh);
+	return error;
+}
+
+static u16 exfat_filename_hash_cont(struct super_block *sb,
+				    const __le16 *name, u16 hash, size_t len)
+{
+	while (len) {
+		u16 c = __le16_to_cpu(exfat_upcase_convert(sb, *name));
+
+		hash = ((hash << 15) | (hash >> 1)) + (c & 0xff);
+		hash = ((hash << 15) | (hash >> 1)) + (c >> 8);
+		--len;
+		++name;
+	}
+	return hash;
+}
+
+u16 exfat_dir_entries_checksum(struct dir_entry_buffer *entries, u32 nr)
+{
+	u32 checksum = 0;
+
+	if (nr) {
+		checksum = exfat_direntry_checksum(entries->start,
+						   checksum, true);
+		--nr;
+		++entries;
+	}
+	while (nr) {
+		checksum = exfat_direntry_checksum(entries->start,
+						   checksum, false);
+		--nr;
+		++entries;
+	}
+	return checksum;
+}
+
+/*
+ * setup exfat_filedir_entry and exfat_stream_extension_entry for a
+ * new entry, with attribute attrs, and named name.
+ */
+static void exfat_fill_dir_entries(struct super_block *sb,
+				  struct dir_entry_buffer *entries,
+				  size_t nr_entries, u8 attrs,
+				  __le16 *name, int name_length)
+{
+	struct exfat_filedir_entry *efd;
+	struct exfat_stream_extension_entry *esx;
+	int i;
+	u16 name_hash;
+	u16 checksum;
+	struct timespec64 ts;
+
+        ktime_get_coarse_real_ts64(&ts);
+
+	efd = entries[0].start;
+	esx = entries[1].start;
+
+	/*
+	 * fill exfat filedir entry
+	 */
+	memset(efd, 0, sizeof (*efd));
+	efd->type = E_EXFAT_FILEDIR;
+	efd->secondary_count = nr_entries - 1;
+	efd->set_checksum = 0;
+	efd->attributes = __cpu_to_le16(attrs);
+
+	/*
+	 * update file directory entry times
+	 */
+	efd = entries[0].start;
+	exfat_write_time(EXFAT_SB(sb), &ts, &efd->create, &efd->create_10ms,
+			 &efd->create_tz_offset);
+	efd->modified = efd->accessed = efd->create;
+	efd->modified_10ms = efd->create_10ms;
+	efd->accessed_tz_offset = efd->modified_tz_offset =
+		efd->create_tz_offset;
+
+	/*
+	 * fill exfat stream extension entry
+	 */
+	memset(esx, 0, sizeof (*esx));
+	esx->type = E_EXFAT_STREAM_EXT;
+	esx->flags = EXFAT_I_ALLOC_POSSIBLE;
+	esx->first_cluster = __cpu_to_le32(0);
+	esx->data_length = __cpu_to_le64(0);
+	esx->valid_data_length = __cpu_to_le64(0);
+	esx->name_length = name_length;
+
+	/*
+	 * fill name fragments.
+	 */
+	name_hash = 0;
+	for (i = 0; i < nr_entries - 2; ++i, name_length -= 15) {
+		struct exfat_filename_entry *efn = entries[i + 2].start;
+		int len = 15;
+
+		if (name_length < 15)
+			len = name_length;
+
+		memset(efn, 0, sizeof (*efn));
+		efn->type = E_EXFAT_FILENAME;
+		memcpy(efn->name_frag, name + i * 15, len * sizeof (__le16));
+		name_hash = exfat_filename_hash_cont(sb, efn->name_frag,
+						     name_hash, len);
+	}
+	esx->name_hash = __cpu_to_le16(name_hash);
+
+	checksum = exfat_dir_entries_checksum(entries, nr_entries);
+	efd->set_checksum = __cpu_to_le16(checksum);
+}
+
+/*
+ * mark all buffer heads in the entries array as dirty. optionally
+ * sync them if required.
+ */
+void exfat_dirty_dir_entries(struct dir_entry_buffer *entries,
+			     size_t nr_entries, bool sync)
+{
+	size_t i;
+
+	for (i = 0; i < nr_entries; ++i) {
+		mark_buffer_dirty(entries[i].bh);
+		if (sync)
+			sync_dirty_buffer(entries[i].bh);
+		brelse(entries[i].bh);
+	}
+}
+
+/*
+ * cleanup all buffer heads in entries.
+ */
+static void exfat_cleanup_dir_entries(struct dir_entry_buffer *entries,
+				     size_t nr_entries)
+{
+	size_t i;
+
+	for (i = 0; i < nr_entries; ++i)
+		brelse(entries[i].bh);
+}
+
+/*
+ * create an inode
+ */
+static int __exfat_inode_create(struct inode *dir, struct dentry *dentry,
+				umode_t mode, bool is_dir)
+{
+	int nr_entries;
+	struct dir_entry_buffer entries[19];
+	struct inode *new;
+	struct exfat_iloc iloc;
+	int error;
+	u8 attr = 0;
+	__le16 *utf16_name;
+	int utf16_name_length;
+
+	if (is_dir)
+		attr |= E_EXFAT_ATTR_DIRECTORY;
+
+	exfat_lock_super(dir->i_sb);
+
+	utf16_name = __getname();
+	if (!utf16_name) {
+		error = -ENOMEM;
+		goto unlock_super;
+	}
+
+	utf16_name_length = utf8s_to_utf16s(dentry->d_name.name,
+					    dentry->d_name.len,
+					    UTF16_LITTLE_ENDIAN, utf16_name,
+					    255 + 2);
+	if (utf16_name_length < 0) {
+		error = utf16_name_length;
+		goto putname;
+	}
+	if (utf16_name_length > 255) {
+		error = -ENAMETOOLONG;
+		goto putname;
+	}
+
+
+	nr_entries = 2 + DIV_ROUND_UP(utf16_name_length, 15);
+	if (nr_entries > 19) {
+		error = -ENAMETOOLONG;
+		goto putname;
+	}
+
+	error = exfat_find_dir_iloc(dir, nr_entries, &iloc);
+	if (error < 0)
+		goto putname;
+
+	error = exfat_get_dir_entry_buffers(dir, &iloc, entries, nr_entries);
+	if (error)
+		goto putname;
+	exfat_fill_dir_entries(dir->i_sb, entries, nr_entries, attr,
+				       utf16_name, utf16_name_length);
+
+	/*
+	 * create an inode with it.
+	 */
+	error = -ENOMEM;
+	new = exfat_populate_inode(dir->i_sb, entries[0].start,
+				   entries[1].start, &iloc);
+	if (!new)
+		goto cleanup;
+	inc_nlink(dir);
+	d_instantiate(dentry, new);
+
+	/*
+	 * update directory atime / ctime.
+	 */
+	dir->i_atime = dir->i_mtime = current_time(dir);
+	if (IS_DIRSYNC(dir))
+		__exfat_write_inode(dir, true);
+	else
+		mark_inode_dirty(dir);
+
+	/*
+	 * write to disk
+	 */
+	exfat_dirty_dir_entries(entries, nr_entries, false);
+	__putname(utf16_name);
+	exfat_unlock_super(dir->i_sb);
+	return 0;
+
+cleanup:
+	exfat_cleanup_dir_entries(entries, nr_entries);
+putname:
+	__putname(utf16_name);
+unlock_super:
+	exfat_unlock_super(dir->i_sb);
+	return error;
+}
+
+int exfat_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode,
+		       bool excl)
+{
+	return __exfat_inode_create(dir, dentry, mode, false);
+}
+
+int exfat_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+{
+	return __exfat_inode_create(dir, dentry, mode, true);
+}
+
+/*
+ * inode unlink: find all direntry buffers and clear seventh bit of
+ * the entry type to mark the as unused.
+ */
+static int __exfat_inode_unlink(struct inode *dir, struct dentry *dentry)
+{
+	struct inode *inode = dentry->d_inode;
+	struct exfat_inode_info *info = EXFAT_I(inode);
+	struct dir_entry_buffer entries[info->iloc.nr_secondary];
+	int error;
+	u32 i;
+
+	error = exfat_get_dir_entry_buffers(inode, &info->iloc,
+					    entries, info->iloc.nr_secondary);
+	if (error)
+		return error;
+
+	for (i = 0; i < info->iloc.nr_secondary; ++i) {
+		u8 *type = entries[i].start;
+
+		*type &= 0x7f;
+	}
+
+	drop_nlink(dir);
+	clear_nlink(inode);
+	inode->i_mtime = inode->i_atime = current_time(inode);
+
+	/*
+	 * update atime & mtime for parent directory.
+	 */
+	dir->i_mtime = dir->i_atime = current_time(dir);
+	if (IS_DIRSYNC(dir))
+		__exfat_write_inode(dir, true);
+	else
+		mark_inode_dirty(dir);
+
+	exfat_dirty_dir_entries(entries, info->iloc.nr_secondary, false);
+	exfat_remove_inode_hash(inode);
+	return 0;
+}
+
+int exfat_inode_unlink(struct inode *dir, struct dentry *dentry)
+{
+	int ret;
+
+	exfat_lock_super(dir->i_sb);
+	ret = __exfat_inode_unlink(dir, dentry);
+	exfat_unlock_super(dir->i_sb);
+	return ret;
+}
+
+/*
+ * inode rmdir: check that links is not greater than 2 (meaning that
+ * the directory is empty) and invoke unlink.
+ */
+static int __exfat_inode_rmdir(struct inode *dir, struct dentry *dentry)
+{
+	struct inode *inode = dentry->d_inode;
+
+	if (inode->i_nlink > 2)
+		return -ENOTEMPTY;
+
+	return __exfat_inode_unlink(dir, dentry);
+}
+
+int exfat_inode_rmdir(struct inode *dir, struct dentry *dentry)
+{
+	int ret;
+
+	exfat_lock_super(dir->i_sb);
+	ret = __exfat_inode_rmdir(dir, dentry);
+	exfat_unlock_super(dir->i_sb);
+	return ret;
+}
+
+int exfat_rename(struct inode *old_dir, struct dentry *old_dentry,
+		 struct inode *new_dir, struct dentry *new_dentry,
+		 unsigned int flags)
+{
+	struct inode *old_inode = old_dentry->d_inode;
+	struct inode *new_inode = new_dentry->d_inode;
+	int new_nr_entries;
+	int error = 0;
+	struct exfat_iloc new_iloc;
+	struct exfat_inode_info *old_info = EXFAT_I(old_inode);
+	struct dir_entry_buffer old_buffers[old_info->iloc.nr_secondary];
+	struct dir_entry_buffer new_buffers[19];
+	struct exfat_filedir_entry *efd;
+	struct exfat_stream_extension_entry *esx;
+	int name_length;
+	__le16 *name;
+	u16 name_hash;
+	int i;
+
+	if (flags & ~RENAME_NOREPLACE)
+		return -EINVAL;
+
+	exfat_lock_super(new_dir->i_sb);
+
+	/*
+	 * convert new name to utf16
+	 */
+	name = __getname();
+	if (!name) {
+		error = -ENOMEM;
+		goto unlock_super;
+	}
+	name_length = utf8s_to_utf16s(new_dentry->d_name.name,
+				      new_dentry->d_name.len,
+				      UTF16_LITTLE_ENDIAN, name, 255 + 2);
+
+	if (name_length > 255) {
+		error = -ENAMETOOLONG;
+		goto err_putname;
+	}
+	if (name_length < 0) {
+		error = name_length;
+		goto err_putname;
+	}
+
+	new_nr_entries = 2 + DIV_ROUND_UP(name_length, 15);
+
+	/*
+	 * find space for new entry
+	 */
+	error = exfat_find_dir_iloc(new_dir, new_nr_entries, &new_iloc);
+	if (error < 0)
+		goto err_putname;
+
+	/*
+	 * get buffers for old and new entries.
+	 */
+	error = exfat_get_dir_entry_buffers(old_dir, &old_info->iloc,
+				    old_buffers, old_info->iloc.nr_secondary);
+	if (error < 0)
+		goto err_putname;
+
+	error = exfat_get_dir_entry_buffers(new_dir, &new_iloc, new_buffers,
+					    new_nr_entries);
+	if (error < 0)
+		goto err_cleanup_old_buffers;
+
+
+	/*
+	 * remove new inode, if it exists.
+	 */
+	if (new_inode) {
+		if (S_ISDIR(new_inode->i_mode))
+			error = __exfat_inode_rmdir(new_dir, new_dentry);
+		else
+			error = __exfat_inode_unlink(new_dir, new_dentry);
+		if (error < 0)
+			goto err_cleanup_new_buffers;
+	}
+
+	/*
+	 * move old esd to new esd (and ditto for esx).
+	 */
+	efd = new_buffers[0].start;
+	esx = new_buffers[1].start;
+	memcpy(efd, old_buffers[0].start, sizeof (*efd));
+	memcpy(esx, old_buffers[1].start, sizeof (*esx));
+
+	efd->secondary_count = new_nr_entries - 1;
+
+	/*
+	 * patch new name after that.
+	 */
+	esx->name_length = __cpu_to_le16(name_length);
+
+	/*
+	 * fill name fragments.
+	 */
+	name_hash = 0;
+	for (i = 0; i < new_nr_entries - 2; ++i, name_length -= 15) {
+		struct exfat_filename_entry *efn = new_buffers[i + 2].start;
+		int len = 15;
+
+		if (name_length < 15)
+			len = name_length;
+
+		memset(efn, 0, sizeof (*efn));
+		efn->type = E_EXFAT_FILENAME;
+		memcpy(efn->name_frag, name + i * 15, len * sizeof (__le16));
+		name_hash = exfat_filename_hash_cont(new_dir->i_sb,
+						     efn->name_frag,
+						     name_hash, len);
+	}
+	__putname(name);
+	esx->name_hash = __cpu_to_le16(name_hash);
+	efd->set_checksum = exfat_dir_entries_checksum(new_buffers,
+						       new_nr_entries);
+	efd->set_checksum = __cpu_to_le16(efd->set_checksum);
+
+	/*
+	 * mark old buffer entries as unused.
+	 */
+	for (i = 0; i < old_info->iloc.nr_secondary; ++i)
+		*((u8*)old_buffers[i].start) &= 0x7f;
+
+	/*
+	 * dirty old & new entries buffers.
+	 */
+	exfat_dirty_dir_entries(new_buffers, new_nr_entries, false);
+	exfat_dirty_dir_entries(old_buffers, old_info->iloc.nr_secondary,
+				false);
+
+	/*
+	 * update links if new_dir and old_dir are differents.
+	 */
+	if (new_dir != old_dir) {
+		drop_nlink(old_dir);
+		inc_nlink(new_dir);
+	}
+
+	/*
+	 * make old inode use the new iloc, and update sb inode hash.
+	 */
+	exfat_remove_inode_hash(old_inode);
+	old_info->iloc = new_iloc;
+	exfat_insert_inode_hash(old_inode);
+
+	/*
+	 * update new dir & old dir mtime/atime
+	 */
+	if (new_dir == old_dir) {
+		new_dir->i_mtime = new_dir->i_atime = current_time(new_dir);
+		if (IS_DIRSYNC(new_dir))
+			__exfat_write_inode(new_dir, true);
+		else
+			mark_inode_dirty(new_dir);
+	} else {
+		new_dir->i_mtime = new_dir->i_atime =
+			old_dir->i_mtime = old_dir->i_atime =
+				current_time(old_dir);
+		if (IS_DIRSYNC(new_dir)) {
+			__exfat_write_inode(new_dir, true);
+			__exfat_write_inode(old_dir, true);
+		} else {
+			mark_inode_dirty(new_dir);
+			mark_inode_dirty(old_dir);
+		}
+	}
+
+	exfat_unlock_super(new_dir->i_sb);
+	return 0;
+
+err_cleanup_new_buffers:
+	exfat_cleanup_dir_entries(new_buffers, new_nr_entries);
+err_cleanup_old_buffers:
+	exfat_cleanup_dir_entries(old_buffers, old_info->iloc.nr_secondary);
+err_putname:
+	__putname(name);
+unlock_super:
+	exfat_unlock_super(new_dir->i_sb);
+	return error;
+}
diff -Nruw linux-5.4.60-fbx/fs/exfat./read-write.c linux-5.4.60-fbx/fs/exfat/read-write.c
--- linux-5.4.60-fbx/fs/exfat./read-write.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/read-write.c	2021-03-04 13:21:00.760839022 +0100
@@ -0,0 +1,150 @@
+/*
+ * read-write.c for exfat
+ * Created by <nschichan@freebox.fr> on Wed Jul 31 16:37:51 2013
+ */
+
+#include <linux/slab.h>
+#include <linux/kernel.h>
+#include <linux/fs.h>
+#include <linux/mpage.h>
+#include <linux/buffer_head.h>
+
+#include "exfat.h"
+#include "exfat_fs.h"
+
+/*
+ * map file sector to disk sector.
+ */
+static int exfat_bmap(struct inode *inode, sector_t fsect, sector_t *dsect)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+	struct exfat_inode_info *info = EXFAT_I(inode);
+	u32 cluster_nr = fsect >> (sbi->clusterbits - sbi->sectorbits);
+	u32 cluster;
+	unsigned int offset = fsect & (sbi->sectors_per_cluster - 1);
+
+	if (info->flags & EXFAT_I_FAT_INVALID)
+		cluster = info->first_cluster + cluster_nr;
+	else {
+		int error;
+
+		error = exfat_get_fat_cluster(inode, cluster_nr, &cluster);
+		if (error)
+			return error;
+	}
+
+	*dsect = exfat_cluster_sector(sbi, cluster) + offset;
+	return 0;
+}
+
+static int exfat_get_block(struct inode *inode, sector_t block,
+			   struct buffer_head *bh, int create)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
+	struct exfat_inode_info *info = EXFAT_I(inode);
+	sector_t last_block;
+	unsigned int offset;
+	sector_t dblock;
+	int error;
+
+	last_block = (i_size_read(inode) + sbi->sectorsize - 1) >>
+		sbi->sectorbits;
+	offset = block & (sbi->sectors_per_cluster - 1);
+
+	if (!create && block >= last_block)
+		return 0;
+
+	if (create && block >= last_block && offset == 0) {
+		u32 hint, cluster;
+
+		/*
+		 * request for first sector in a cluster immediate to
+		 * the last allocated cluster of the file: must
+		 * allocate a new clluster.
+		 */
+		error = exfat_get_cluster_hint(inode, &hint);
+		if (error)
+			return error;
+
+		error = exfat_alloc_clusters(inode, hint, &cluster, 1);
+		if (error)
+			return error;
+	}
+
+	error = exfat_bmap(inode, block, &dblock);
+	if (error)
+		return error;
+
+	if (create && block >= last_block) {
+		/*
+		 * currently in create mode: we need to update
+		 * mmu_private.
+		 */
+		info->mmu_private += sbi->sectorsize;
+		set_buffer_new(bh);
+	}
+	map_bh(bh, inode->i_sb, dblock);
+	return 0;
+}
+
+int exfat_readpage(struct file *file, struct page *page)
+{
+	return mpage_readpage(page, exfat_get_block);
+}
+
+int exfat_readpages(struct file *file, struct address_space *mapping,
+		    struct list_head *pages, unsigned nr_pages)
+{
+	return mpage_readpages(mapping, pages, nr_pages, exfat_get_block);
+}
+
+static int exfat_write_error(struct inode *inode, loff_t to)
+{
+	if (to > inode->i_size) {
+		truncate_pagecache(inode, to);
+		exfat_truncate_blocks(inode, inode->i_size);
+	}
+	return 0;
+}
+
+int exfat_write_begin(struct file *file, struct address_space *mapping,
+		      loff_t pos, unsigned len, unsigned flags,
+		      struct page **pagep, void **fsdata)
+{
+	struct inode *inode = mapping->host;
+	int error;
+
+	*pagep = NULL;
+	error = cont_write_begin(file, mapping, pos, len, flags, pagep, fsdata,
+				 exfat_get_block, &EXFAT_I(inode)->mmu_private);
+
+	if (error)
+		exfat_write_error(inode, pos + len);
+	return error;
+}
+
+int exfat_write_end(struct file *file, struct address_space *mapping,
+		    loff_t pos, unsigned len, unsigned copied,
+		    struct page *page, void *fsdata)
+{
+	struct inode *inode = mapping->host;
+	int error;
+
+	error = generic_write_end(file, mapping, pos, len, copied, page,
+				  fsdata);
+
+	if (error < len)
+		exfat_write_error(inode, pos + len);
+	return error;
+}
+
+int exfat_writepage(struct page *page, struct writeback_control *wbc)
+{
+	return block_write_full_page(page, exfat_get_block, wbc);
+}
+
+int exfat_writepages(struct address_space *mapping,
+		     struct writeback_control *wbc)
+{
+	return mpage_writepages(mapping, wbc, exfat_get_block);
+}
diff -Nruw linux-5.4.60-fbx/fs/exfat./super.c linux-5.4.60-fbx/fs/exfat/super.c
--- linux-5.4.60-fbx/fs/exfat./super.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/super.c	2021-03-04 13:21:00.760839022 +0100
@@ -0,0 +1,742 @@
+/*
+ * super.c<2> for exfat
+ * Created by <nschichan@freebox.fr> on Tue Jul 23 12:33:53 2013
+ */
+
+#include <linux/kernel.h>
+#include <linux/bug.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/slab.h>
+#include <linux/buffer_head.h>
+#include <linux/statfs.h>
+#include <linux/parser.h>
+#include <linux/seq_file.h>
+#include <linux/sched.h>
+#include <linux/cred.h>
+#include <linux/iversion.h>
+
+#include "exfat_fs.h"
+#include "exfat.h"
+
+
+#define PFX	"exFAT: "
+
+static void exfat_put_super(struct super_block *sb);
+static int exfat_statfs(struct dentry *dentry, struct kstatfs *kstat);
+static int exfat_show_options(struct seq_file *m, struct dentry *root);
+static int exfat_remount(struct super_block *sb, int *flags, char *opts);
+
+static const struct super_operations exfat_super_ops = {
+	.alloc_inode	= exfat_alloc_inode,
+	.destroy_inode	= exfat_destroy_inode,
+	.drop_inode	= exfat_drop_inode,
+	.evict_inode	= exfat_evict_inode,
+	.write_inode	= exfat_write_inode,
+	.statfs         = exfat_statfs,
+	.put_super      = exfat_put_super,
+	.show_options	= exfat_show_options,
+	.remount_fs	= exfat_remount,
+};
+
+const struct file_operations exfat_dir_operations = {
+	.llseek = generic_file_llseek,
+	.read = generic_read_dir,
+	.iterate = exfat_iterate,
+	.unlocked_ioctl	= exfat_ioctl,
+};
+
+const struct file_operations exfat_file_operations = {
+	.llseek		= generic_file_llseek,
+	.read_iter	= generic_file_read_iter,
+	.write_iter	= generic_file_write_iter,
+	.mmap		= generic_file_mmap,
+	.splice_read	= generic_file_splice_read,
+	.unlocked_ioctl	= exfat_ioctl,
+	.fsync		= generic_file_fsync,
+};
+
+const struct inode_operations exfat_dir_inode_operations =
+{
+	.create = exfat_inode_create,
+	.mkdir	= exfat_inode_mkdir,
+	.lookup = exfat_inode_lookup,
+	.rmdir	= exfat_inode_rmdir,
+	.unlink	= exfat_inode_unlink,
+	.rename	= exfat_rename,
+	.setattr = exfat_setattr,
+	.getattr = exfat_getattr,
+};
+
+const struct inode_operations exfat_file_inode_operations = {
+	.setattr = exfat_setattr,
+	.getattr = exfat_getattr,
+};
+
+const struct address_space_operations exfat_address_space_operations = {
+	.readpage	= exfat_readpage,
+	.readpages	= exfat_readpages,
+	.write_begin	= exfat_write_begin,
+	.write_end	= exfat_write_end,
+	.writepage	= exfat_writepage,
+	.writepages	= exfat_writepages,
+};
+
+void exfat_msg(struct super_block *sb, const char *prefix,
+		const char *fmt, ...)
+{
+	struct va_format vaf;
+	va_list args;
+
+	va_start(args, fmt);
+	vaf.fmt = fmt;
+	vaf.va = &args;
+	printk("%sexFAT-fs (%s): %pV\n", prefix, sb->s_id, &vaf);
+	va_end(args);
+}
+
+void exfat_fs_error(struct super_block *sb, const char *fmt, ...)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	struct va_format vaf;
+	va_list args;
+
+	va_start(args, fmt);
+	vaf.fmt = fmt;
+	vaf.va = &args;
+	exfat_msg(sb, KERN_ERR, "error: %pV", &vaf);
+	va_end(args);
+
+	if (sbi->options.error_action == EXFAT_ERROR_ACTION_REMOUNT_RO &&
+	    !(sb->s_flags & SB_RDONLY)) {
+		sb->s_flags |= SB_RDONLY;
+		exfat_msg(sb, KERN_ERR, "remounted read-only due to fs error.");
+	} else if (sbi->options.error_action == EXFAT_ERROR_ACTION_PANIC)
+		panic("exFAT-fs (%s): panic due fs error.\n", sb->s_id);
+}
+
+/*
+ * process checksum on buffer head. first indicates if the special
+ * treatment of the first sector needs to be done or not.
+ *
+ * first sector can be changed (volume flags, and heap use percent),
+ * those fields are excluded from the checksum to allow updating
+ * without recalculating the checksum.
+ */
+static u32 exfat_sb_checksum_process(struct buffer_head *bh, u32 checksum,
+				     unsigned int size,
+				     bool first)
+{
+	unsigned int i;
+
+	for (i = 0; i < size; ++i) {
+		if (first && (i == 106 || i == 107 || i == 112))
+			continue ;
+		checksum = ((checksum << 31) | (checksum >> 1)) +
+			(unsigned char)bh->b_data[i];
+	}
+	return checksum;
+}
+
+static int exfat_check_sb_checksum(struct super_block *sb)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	u32 checksum;
+	int i;
+	int err;
+	struct buffer_head *bh[EXFAT_CHECKSUM_SECTORS + 1];
+
+	/*
+	 * fetch needed sectors, reuse first sector from sbi.
+	 */
+	err = -ENOMEM;
+	memset(bh, 0, sizeof (struct buffer_head*) *
+	       (EXFAT_CHECKSUM_SECTORS + 1));
+	bh[0] = sbi->sb_bh;
+	for (i = 1; i < EXFAT_CHECKSUM_SECTORS + 1; ++i) {
+		bh[i] = sb_bread(sb, i);
+		if (!bh[i])
+			goto out;
+	}
+
+	/*
+	 * calculate checksum.
+	 */
+	checksum = exfat_sb_checksum_process(bh[0], 0, sbi->sectorsize, true);
+	for (i = 1; i < EXFAT_CHECKSUM_SECTORS; ++i) {
+		checksum = exfat_sb_checksum_process(bh[i], checksum,
+						     sbi->sectorsize, false);
+	}
+
+	/*
+	 * compare with the checksum sector.
+	 */
+	err = -EINVAL;
+	for (i = 0; i < sbi->sectorsize; i += sizeof (u32)) {
+		__le32 val = *(u32*)(bh[EXFAT_CHECKSUM_SECTORS]->b_data + i);
+
+		if (__le32_to_cpu(val) != checksum) {
+			exfat_msg(sb, KERN_INFO, "at offset %i, checksum "
+				  "%08x != %08x", i, __le32_to_cpu(val), checksum);
+			goto out;
+		}
+	}
+	err = 0;
+
+out:
+	for (i = 1; i < EXFAT_CHECKSUM_SECTORS; ++i)
+		if (bh[i])
+			brelse(bh[i]);
+	return err;
+}
+
+static int exfat_check_sb(struct super_block *sb)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	struct exfat_vbr *vbr = sbi->vbr;
+	u16 fs_rev;
+	u16 flags;
+	int active_fat;
+	u16 num_fats;
+
+	if (memcmp(vbr->jump, "\xeb\x76\x90", sizeof (vbr->jump))) {
+		exfat_msg(sb, KERN_INFO, "invalid jump field in vbr.");
+		return -EINVAL;
+	}
+
+	if (memcmp(vbr->fsname, "EXFAT   ", 8)) {
+		exfat_msg(sb, KERN_INFO, "invalid fsname field in vbr: %s.",
+			  vbr->fsname);
+		return -EINVAL;
+	}
+
+	fs_rev = __le16_to_cpu(vbr->fs_rev);
+	if (fs_rev != 0x0100) {
+		exfat_msg(sb, KERN_INFO, "filesystem version invalid: "
+			  "have 0x%04x, need 0x0100", fs_rev);
+		return -EINVAL;
+	}
+
+	flags = __le16_to_cpu(vbr->volume_flags);
+	active_fat = exfat_active_fat(flags);
+	if (active_fat != 0) {
+		exfat_msg(sb, KERN_INFO, "filesystems with active fat > 0 are "
+			  "not supported.");
+		return -EINVAL;
+	}
+
+	if (flags & EXFAT_FLAG_MEDIA_FAILURE)
+		exfat_msg(sb, KERN_WARNING, "filesystem had media failure(s)");
+
+	/*
+	 * bytes per sectors are on the range 2^9 - 2^12 (512 - 4096)
+	 */
+	if (vbr->bytes_per_sector < 9 || vbr->bytes_per_sector > 12) {
+		exfat_msg(sb, KERN_ERR, "invalid byte per sectors: %u",
+			  (1 << vbr->bytes_per_sector));
+		return -EINVAL;
+	}
+
+	/*
+	 * sectors per cluster can be as low as 0, and must not result
+	 * in a cluster size higher than 32MB (byte_per_sector +
+	 * sectors_per_cluster must not be creater than 25)
+	 */
+	if (vbr->bytes_per_sector + vbr->sectors_per_cluster > 25) {
+		exfat_msg(sb, KERN_ERR, "invalid cluster size: %u",
+		  1 << (vbr->bytes_per_sector + vbr->sectors_per_cluster));
+		return -EINVAL;
+	}
+
+	num_fats = __le16_to_cpu(vbr->fat_num);
+	if (num_fats == 0) {
+		exfat_msg(sb, KERN_ERR, "superblock reports no FAT.");
+		return -EINVAL;
+	}
+	if (num_fats > 1) {
+		exfat_msg(sb, KERN_ERR, "TexFAT is not supported.");
+		return -EINVAL;
+	}
+
+	if (memcmp(vbr->boot_sig, "\x55\xaa", 2)) {
+		exfat_msg(sb, KERN_ERR, "invalid end boot signature: %02x%02x.",
+			  vbr->boot_sig[0], vbr->boot_sig[1]);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int exfat_fill_root(struct super_block *sb, struct inode *root)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	u32 nclust;
+	u32 dummy;
+	loff_t links;
+
+	root->i_ino = EXFAT_ROOT_INO;
+	inode_set_iversion(root, 1);
+	EXFAT_I(root)->first_cluster =
+		__le32_to_cpu(sbi->root_dir_cluster);
+	EXFAT_I(root)->attributes = E_EXFAT_ATTR_DIRECTORY;
+
+	root->i_uid = sbi->options.uid;
+	root->i_gid = sbi->options.gid;
+
+	root->i_mode = exfat_make_mode(sbi, S_IRWXUGO, E_EXFAT_ATTR_DIRECTORY);
+	inode_inc_iversion(root);
+	root->i_generation = 0;
+
+	root->i_op = &exfat_dir_inode_operations;
+	root->i_fop = &exfat_dir_operations;
+
+	/*
+	 * root inode cannot use bitmap.
+	 */
+	EXFAT_I(root)->flags = EXFAT_I_ALLOC_POSSIBLE;
+
+	/*
+	 * set i_size
+	 */
+	nclust = 0;
+	while (__exfat_get_fat_cluster(root, nclust, &dummy, false) == 0)
+		++nclust;
+	root->i_size = nclust << sbi->clusterbits;
+	root->i_blocks = nclust << (sbi->clusterbits - 9);
+	EXFAT_I(root)->allocated_clusters = nclust;
+
+	/*
+	 * +2 to account for '.' and '..'
+	 */
+	links = exfat_dir_links(root);
+	if (links < 0)
+		return links;
+	set_nlink(root, links + 2);
+
+	root->i_mtime = root->i_atime = root->i_ctime = current_time(root);
+
+	return 0;
+}
+
+static loff_t exfat_file_max_byte(struct exfat_sb_info *sbi)
+{
+	u32 max_clusters = EXFAT_CLUSTER_LASTVALID -
+		EXFAT_CLUSTER_FIRSTVALID + 1;
+
+	return (loff_t)max_clusters << sbi->clusterbits;
+}
+
+static int exfat_show_options(struct seq_file *m, struct dentry *root)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(root->d_inode->i_sb);
+
+	if (!uid_eq(sbi->options.uid, GLOBAL_ROOT_UID))
+		seq_printf(m, ",uid=%u",
+			   from_kuid_munged(&init_user_ns, sbi->options.uid));
+	if (!gid_eq(sbi->options.gid, GLOBAL_ROOT_GID))
+		seq_printf(m, ",gid=%u",
+			   from_kgid_munged(&init_user_ns, sbi->options.gid));
+
+	seq_printf(m, ",fmask=%04o", sbi->options.fmask);
+	seq_printf(m, ",dmask=%04o", sbi->options.dmask);
+
+	if (sbi->options.time_offset_set)
+		seq_printf(m, ",time_offset=%d", sbi->options.time_offset);
+
+	switch (sbi->options.error_action) {
+	case EXFAT_ERROR_ACTION_PANIC:
+		seq_printf(m, ",errors=panic");
+		break;
+	case EXFAT_ERROR_ACTION_REMOUNT_RO:
+		seq_printf(m, ",errors=remount-ro");
+		break;
+	default:
+		seq_printf(m, ",errors=continue");
+		break;
+	}
+
+	return 0;
+}
+
+enum {
+	Opt_exfat_uid,
+	Opt_exfat_gid,
+	Opt_exfat_dmask,
+	Opt_exfat_fmask,
+	Opt_exfat_time_offset,
+	Opt_exfat_error_continue,
+	Opt_exfat_error_remount_ro,
+	Opt_exfat_error_panic,
+	Opt_exfat_err,
+};
+
+static const match_table_t exfat_tokens = {
+	{ Opt_exfat_uid, "uid=%u", },
+	{ Opt_exfat_gid, "gid=%u", },
+	{ Opt_exfat_dmask, "dmask=%04o", },
+	{ Opt_exfat_fmask, "fmask=%04o", },
+	{ Opt_exfat_time_offset, "time_offset=%d", },
+	{ Opt_exfat_error_continue, "errors=continue", },
+	{ Opt_exfat_error_remount_ro, "errors=remount-ro", },
+	{ Opt_exfat_error_panic, "errors=panic", },
+	{ Opt_exfat_err, NULL },
+};
+
+static int exfat_parse_options(struct super_block *sb, char *opts, int silent)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	char *p;
+
+	sbi->options.uid = current_uid();
+	sbi->options.gid = current_gid();
+
+	sbi->options.dmask = current_umask();
+	sbi->options.fmask = current_umask();
+	sbi->options.time_offset_set = 0;
+	sbi->options.error_action = EXFAT_ERROR_ACTION_CONTINUE;
+
+	while (1) {
+		int token;
+		substring_t args[MAX_OPT_ARGS];
+		unsigned int optval;
+
+		p = strsep(&opts, ",");
+		if (!p)
+			break;
+		token = match_token(p, exfat_tokens, args);
+
+		switch (token) {
+		case Opt_exfat_uid:
+			if (match_int(&args[0], &optval))
+				return -EINVAL;
+			sbi->options.uid = make_kuid(current_user_ns(), optval);
+			break;
+
+		case Opt_exfat_gid:
+			if (match_int(&args[0], &optval))
+				return -EINVAL;
+			sbi->options.gid = make_kgid(current_user_ns(), optval);
+			break;
+
+		case Opt_exfat_dmask:
+			if (match_octal(&args[0], &optval))
+				return -EINVAL;
+			sbi->options.dmask = optval;
+			break;
+
+		case Opt_exfat_fmask:
+			if (match_octal(&args[0], &optval))
+				return -EINVAL;
+			sbi->options.fmask = optval;
+			break;
+
+		case Opt_exfat_time_offset:
+			if (match_int(&args[0], &optval))
+				return -EINVAL;
+			if (optval < -12 * 60 && optval > 12 * 60) {
+				if (!silent)
+					exfat_msg(sb, KERN_INFO, "invalid "
+						  "time_offset value %d: "
+						  "should be between %d and %d",
+						  optval, -12 * 60, 12 * 60);
+				return -EINVAL;
+			}
+			sbi->options.time_offset = optval;
+			sbi->options.time_offset_set = 1;
+			break;
+
+		case Opt_exfat_error_continue:
+			sbi->options.error_action = EXFAT_ERROR_ACTION_CONTINUE;
+			break;
+
+		case Opt_exfat_error_remount_ro:
+			sbi->options.error_action =
+				EXFAT_ERROR_ACTION_REMOUNT_RO;
+			break;
+
+		case Opt_exfat_error_panic:
+			sbi->options.error_action = EXFAT_ERROR_ACTION_PANIC;
+			break;
+
+		default:
+			if (!silent)
+				exfat_msg(sb, KERN_INFO, "Unrecognized mount "
+					  "option %s or missing parameter.\n",
+					  p);
+			return -EINVAL;
+		}
+	}
+	return 0;
+}
+
+static void exfat_set_sb_dirty(struct super_block *sb, bool set, bool force)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	u16 flags;
+
+	/*
+	 * do not change anything if mounted read only and not
+	 * forced. the force case would happen during remount.
+	 */
+	if ((sb->s_flags & SB_RDONLY) && !force)
+		return ;
+
+	if (sbi->dirty) {
+		if (set)
+			exfat_msg(sb, KERN_WARNING, "Volume was not cleanly "
+				  "umounted. fsck should probably be needed.");
+		return ;
+	}
+
+	flags = __le16_to_cpu(sbi->vbr->volume_flags);
+	if (set)
+		flags |= EXFAT_FLAG_DIRTY;
+	else
+		flags &= ~EXFAT_FLAG_DIRTY;
+	sbi->vbr->volume_flags = __cpu_to_le16(flags);
+
+	mark_buffer_dirty(sbi->sb_bh);
+	sync_dirty_buffer(sbi->sb_bh);
+}
+
+static int exfat_remount(struct super_block *sb, int *flags, char *opts)
+{
+	int new_rdonly = *flags & SB_RDONLY;
+
+	if (new_rdonly != (sb->s_flags & SB_RDONLY)) {
+		if (new_rdonly)
+			exfat_set_sb_dirty(sb, false, false);
+		else
+			/*
+			 * sb->s_flag still has SB_RDONLY, so we need
+			 * to force the dirty state
+			 */
+			exfat_set_sb_dirty(sb, true, true);
+	}
+	return 0;
+}
+
+static int exfat_fill_super(struct super_block *sb, void *data, int silent)
+{
+	struct exfat_sb_info *sbi = NULL;
+	int ret = -ENOMEM;
+	struct inode *root = NULL;
+	int i;
+
+	sbi = kzalloc(sizeof (*sbi), GFP_KERNEL);
+	if (!sbi)
+		return -ENOMEM;
+
+	sb->s_fs_info = sbi;
+	if (exfat_parse_options(sb, data, silent) < 0)
+		return -EINVAL;
+
+	mutex_init(&sbi->sb_mutex);
+	spin_lock_init(&sbi->inode_hash_lock);
+
+	/*
+	 * first block, before we know sector size.
+	 */
+	sbi->sb_bh = sb_bread(sb, 0);
+	if (!sbi->sb_bh)
+		goto fail;
+
+	sbi->vbr = (struct exfat_vbr*)sbi->sb_bh->b_data;
+	sb->s_op = &exfat_super_ops;
+
+
+	ret = exfat_check_sb(sb);
+	if (ret)
+		goto fail;
+
+	/*
+	 * time granularity of FS for use by current_time(inode): in
+	 * nsec so 1000000000 for 1 sec granularity.
+	 */
+	sb->s_time_gran = 1000 * 1000 * 1000;
+
+	/*
+	 * vbr seems sane, fill sbi.
+	 */
+	sbi->sectorsize = (1 << sbi->vbr->bytes_per_sector);
+	sbi->clustersize = sbi->sectorsize *
+		(1 << sbi->vbr->sectors_per_cluster);
+
+	sbi->sectors_per_cluster = sbi->clustersize / sbi->sectorsize;
+
+	sbi->sectorbits = sbi->vbr->bytes_per_sector;
+	sbi->clusterbits = sbi->vbr->sectors_per_cluster + sbi->sectorbits;
+	sbi->sectormask = sbi->sectorsize - 1;
+	sbi->clustermask = sbi->clustersize - 1;
+
+
+	sbi->fat_offset = __le32_to_cpu(sbi->vbr->fat_offset);
+	sbi->fat_length = __le32_to_cpu(sbi->vbr->fat_length);
+
+	sbi->root_dir_cluster = __le32_to_cpu(sbi->vbr->cluster_root_dir);
+
+	sbi->cluster_heap_offset = __le32_to_cpu(sbi->vbr->cluster_heap_offset);
+	sbi->cluster_count = __le32_to_cpu(sbi->vbr->cluster_count);
+
+	sbi->dirty = !!(__le16_to_cpu(sbi->vbr->volume_flags) &
+			EXFAT_FLAG_DIRTY);
+
+	/*
+	 * now that we know sector size, reread superblock with
+	 * correct sector size.
+	 */
+	ret = -EIO;
+	if (sb->s_blocksize != sbi->sectorsize) {
+		if (!sb_set_blocksize(sb, sbi->sectorsize)) {
+			exfat_msg(sb, KERN_INFO, "bad block size %d.",
+				  sbi->sectorsize);
+			goto fail;
+		}
+
+		brelse(sbi->sb_bh);
+		sbi->vbr = NULL;
+
+		sbi->sb_bh = sb_bread(sb, 0);
+		if (!sbi->sb_bh)
+			goto fail;
+		sbi->vbr = (struct exfat_vbr*)sbi->sb_bh->b_data;
+		sb->s_fs_info = sbi;
+	}
+
+	ret = exfat_check_sb_checksum(sb);
+	if (ret)
+		goto fail;
+
+	sb->s_maxbytes = exfat_file_max_byte(sbi);
+
+	ret = exfat_init_fat(sb);
+	if (ret)
+		goto fail;
+
+	for (i = 0 ; i < EXFAT_HASH_SIZE; ++i) {
+		INIT_HLIST_HEAD(&sbi->inode_hash[i]);
+	}
+
+	/*
+	 * create root inode.
+	 */
+	root = new_inode(sb);
+	if (!root)
+		goto fail;
+
+	exfat_fill_root(sb, root);
+
+	ret = exfat_upcase_init(root);
+	if (ret)
+		goto fail_iput;
+
+	ret = exfat_init_bitmap(root);
+	if (ret)
+		goto fail_iput;
+
+
+	sb->s_root = d_make_root(root);
+	if (!sb->s_root)
+		goto fail_iput;
+
+	exfat_set_sb_dirty(sb, true, false);
+	return 0;
+
+fail_iput:
+	iput(root);
+
+fail:
+	if (sbi->sb_bh)
+		brelse(sbi->sb_bh);
+	if (sbi)
+		kfree(sbi);
+	return ret;
+}
+
+static struct dentry *exfat_mount(struct file_system_type *fstype,
+				  int flags, const char *dev_name, void *data)
+{
+	return mount_bdev(fstype, flags, dev_name, data, exfat_fill_super);
+}
+
+static void exfat_put_super(struct super_block *sb)
+{
+	struct exfat_sb_info *sbi;
+
+	sbi = EXFAT_SB(sb);
+	if (sbi) {
+		exfat_set_sb_dirty(sb, false, false);
+		exfat_exit_bitmap(sb);
+		brelse(sbi->sb_bh);
+		kfree(sbi->upcase_table);
+		kfree(sbi);
+	}
+}
+
+static int exfat_statfs(struct dentry *dentry, struct kstatfs *kstat)
+{
+	struct super_block *sb = dentry->d_inode->i_sb;
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	u64 id = huge_encode_dev(sb->s_bdev->bd_dev);
+
+	memset(kstat, 0, sizeof (*kstat));
+
+
+	kstat->f_bsize = sbi->clustersize;
+	kstat->f_blocks = sbi->cluster_count;
+	kstat->f_bfree = sbi->free_clusters;
+	kstat->f_bavail = sbi->free_clusters;
+	kstat->f_namelen = 255;
+	kstat->f_fsid.val[0] = (u32)id;
+	kstat->f_fsid.val[1] = (u32)(id >> 32);
+
+	return 0;
+}
+
+static struct file_system_type exfat_fs_type = {
+	.owner		= THIS_MODULE,
+	.name		= "exfat",
+	.mount		= exfat_mount,
+	.kill_sb	= kill_block_super,
+	.fs_flags	= FS_REQUIRES_DEV,
+};
+
+static int __init exfat_init(void)
+{
+	int error;
+
+	/* some sanity check on internal structure sizes */
+	BUILD_BUG_ON(sizeof (struct exfat_vbr) != 512);
+
+	BUILD_BUG_ON(sizeof (struct exfat_volume_label_entry) != 0x20);
+	BUILD_BUG_ON(sizeof (struct exfat_bitmap_entry) != 0x20);
+	BUILD_BUG_ON(sizeof (struct exfat_upcase_entry) != 0x20);
+	BUILD_BUG_ON(sizeof (struct exfat_guid_entry) != 0x20);
+	BUILD_BUG_ON(sizeof (struct exfat_padding_entry) != 0x20);
+	BUILD_BUG_ON(sizeof (struct exfat_acl_entry) != 0x20);
+	BUILD_BUG_ON(sizeof (struct exfat_filedir_entry) != 0x20);
+	BUILD_BUG_ON(sizeof (struct exfat_stream_extension_entry) != 0x20);
+	BUILD_BUG_ON(sizeof (struct exfat_filename_entry) != 0x20);
+
+	error = exfat_init_inodes();
+	if (error)
+		return error;
+
+
+	error = register_filesystem(&exfat_fs_type);
+	if (error)
+		exfat_exit_inodes();
+	return error;
+}
+
+static void __exit exfat_exit(void)
+{
+	unregister_filesystem(&exfat_fs_type);
+	exfat_exit_inodes();
+}
+
+module_init(exfat_init);
+module_exit(exfat_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Nicolas Schichan <nschichan@freebox.fr>");
diff -Nruw linux-5.4.60-fbx/fs/exfat./time.c linux-5.4.60-fbx/fs/exfat/time.c
--- linux-5.4.60-fbx/fs/exfat./time.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/time.c	2021-03-04 13:21:00.760839022 +0100
@@ -0,0 +1,126 @@
+
+#include <linux/kernel.h>
+#include <linux/fs.h>
+
+#include "exfat.h"
+#include "exfat_fs.h"
+
+
+
+extern struct timezone sys_tz;
+
+/*
+ * The epoch of FAT timestamp is 1980.
+ *     :  bits :     value
+ * date:  0 -  4: day	(1 -  31)
+ * date:  5 -  8: month	(1 -  12)
+ * date:  9 - 15: year	(0 - 127) from 1980
+ * time:  0 -  4: sec	(0 -  29) 2sec counts
+ * time:  5 - 10: min	(0 -  59)
+ * time: 11 - 15: hour	(0 -  23)
+ */
+#define SECS_PER_MIN	60
+#define SECS_PER_HOUR	(60 * 60)
+#define SECS_PER_DAY	(SECS_PER_HOUR * 24)
+/* days between 1.1.70 and 1.1.80 (2 leap days) */
+#define DAYS_DELTA	(365 * 10 + 2)
+/* 120 (2100 - 1980) isn't leap year */
+#define YEAR_2100	120
+#define IS_LEAP_YEAR(y)	(!((y) & 3) && (y) != YEAR_2100)
+
+/* Linear day numbers of the respective 1sts in non-leap years. */
+static time_t days_in_year[] = {
+	/* Jan  Feb  Mar  Apr  May  Jun  Jul  Aug  Sep  Oct  Nov  Dec */
+	0,   0,  31,  59,  90, 120, 151, 181, 212, 243, 273, 304, 334, 0, 0, 0,
+};
+
+/* Convert a FAT time/date pair to a UNIX date (seconds since 1 1 70). */
+void exfat_time_2unix(struct timespec64 *ts, u32 datetime, u8 time_cs,
+		      s8 tz_offset)
+{
+	u16 date = (datetime >> 16);
+	u16 time = (datetime & 0xffff);
+	time_t second, day, leap_day, month, year;
+
+	year  = date >> 9;
+	month = max(1, (date >> 5) & 0xf);
+	day   = max(1, date & 0x1f) - 1;
+
+	if (((tz_offset & (1 << 6)) == 0))
+		tz_offset &= ~(1 << 7);
+
+	leap_day = (year + 3) / 4;
+	if (year > YEAR_2100)		/* 2100 isn't leap year */
+		leap_day--;
+	if (IS_LEAP_YEAR(year) && month > 2)
+		leap_day++;
+
+	second =  (time & 0x1f) << 1;
+	second += ((time >> 5) & 0x3f) * SECS_PER_MIN;
+	second += (time >> 11) * SECS_PER_HOUR;
+	second += (year * 365 + leap_day
+		   + days_in_year[month] + day
+		   + DAYS_DELTA) * SECS_PER_DAY;
+
+	second -= tz_offset * 15 * SECS_PER_MIN;
+
+	if (time_cs) {
+		ts->tv_sec = second + (time_cs / 100);
+		ts->tv_nsec = (time_cs % 100) * 10000000;
+	} else {
+		ts->tv_sec = second;
+		ts->tv_nsec = 0;
+	}
+}
+
+/* Convert linear UNIX date to a FAT time/date pair. */
+void exfat_time_2exfat(struct exfat_sb_info *sbi, struct timespec64 *ts,
+		       u32 *datetime, u8 *time_cs, s8 *tz_offset)
+{
+	struct tm tm;
+	u16 time;
+	u16 date;
+	int offset;
+
+	if (sbi->options.time_offset_set) {
+		offset = -sbi->options.time_offset;
+	} else
+		offset = sys_tz.tz_minuteswest;
+
+	time64_to_tm(ts->tv_sec, -offset * SECS_PER_MIN, &tm);
+
+	/*  FAT can only support year between 1980 to 2107 */
+	if (tm.tm_year < 1980 - 1900) {
+		time = 0;
+		date = cpu_to_le16((0 << 9) | (1 << 5) | 1);
+		if (time_cs)
+			*time_cs = 0;
+		*tz_offset = 0;
+		return;
+	}
+	if (tm.tm_year > 2107 - 1900) {
+		time = cpu_to_le16((23 << 11) | (59 << 5) | 29);
+		date = cpu_to_le16((127 << 9) | (12 << 5) | 31);
+		if (time_cs)
+			*time_cs = 199;
+		*tz_offset = 0;
+		return;
+	}
+
+	/* from 1900 -> from 1980 */
+	tm.tm_year -= 80;
+	/* 0~11 -> 1~12 */
+	tm.tm_mon++;
+	/* 0~59 -> 0~29(2sec counts) */
+	tm.tm_sec >>= 1;
+
+	time = cpu_to_le16(tm.tm_hour << 11 | tm.tm_min << 5 | tm.tm_sec);
+	date = cpu_to_le16(tm.tm_year << 9 | tm.tm_mon << 5 | tm.tm_mday);
+
+	*datetime = (date << 16) | time;
+
+	if (time_cs)
+		*time_cs = (ts->tv_sec & 1) * 100 + ts->tv_nsec / 10000000;
+	*tz_offset = -offset / 15;
+	*tz_offset |= (1 << 7);
+}
diff -Nruw linux-5.4.60-fbx/fs/exfat./upcase.c linux-5.4.60-fbx/fs/exfat/upcase.c
--- linux-5.4.60-fbx/fs/exfat./upcase.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/fs/exfat/upcase.c	2021-03-04 13:21:00.760839022 +0100
@@ -0,0 +1,137 @@
+/*
+ * upcase.c for exfat
+ * Created by <nschichan@freebox.fr> on Wed Aug  7 11:51:37 2013
+ */
+
+#include <linux/buffer_head.h>
+#include <linux/slab.h>
+#include <linux/fs.h>
+
+#include "exfat.h"
+#include "exfat_fs.h"
+
+static u32 exfat_calc_upcase_checksum(const u8 *data, u32 checksum,
+				      size_t count)
+{
+	while (count) {
+		checksum = ((checksum << 31) | (checksum >> 1)) + *data;
+		--count;
+		++data;
+	}
+	return checksum;
+}
+
+static int exfat_load_upcase_table(struct super_block *sb, u32 disk_cluster,
+				   u32 *out_checksum)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+	struct buffer_head *bh;
+	sector_t start, sect, end;
+	u32 off = 0;
+	u32 byte_len = sbi->upcase_len * sizeof (__le16);
+	u32 checksum = 0;
+
+	/*
+	 * up-case table are not fragmented, so sequential cluster
+	 * read will do here.
+	 */
+	start = exfat_cluster_sector(sbi, disk_cluster);
+	end = start + DIV_ROUND_UP(byte_len,
+			   sbi->sectorsize);
+	for (sect = start; sect < end; ++sect) {
+		u32 len = sbi->sectorsize;
+
+		if (sect == end - 1)
+			len = byte_len & sbi->sectormask;
+
+		bh = sb_bread(sb, sect);
+		if (!bh) {
+			exfat_msg(sb, KERN_ERR,
+				  "unable to read upcase sector %llu",
+				  (unsigned long long)sect);
+			return -EIO;
+		}
+		memcpy((u8*)sbi->upcase_table + off, bh->b_data,
+		       len);
+
+		checksum = exfat_calc_upcase_checksum(bh->b_data, checksum,
+						      len);
+
+		off += len;
+		brelse(bh);
+	}
+
+	BUG_ON(off != byte_len);
+	*out_checksum = checksum;
+	return 0;
+}
+
+int exfat_upcase_init(struct inode *root)
+{
+	struct exfat_sb_info *sbi = EXFAT_SB(root->i_sb);
+	struct exfat_upcase_entry *upcase;
+	struct exfat_dir_ctx dctx;
+	int error;
+	u64 upcase_length;
+	u32 checksum;
+
+	/*
+	 * configure directory context and look for an upcase table
+	 * entry.
+	 */
+	if (exfat_init_dir_ctx(root, &dctx, 0) < 0)
+		return -EIO;
+
+	error = -EIO;
+	upcase = __exfat_dentry_next(&dctx, E_EXFAT_UPCASE_TABLE, 0xff,
+				     true, NULL);
+	if (!upcase)
+		goto fail;
+
+	/*
+	 * check upcase table length. we need it to be non-zero,
+	 * ending on a __le16 boundary and provide at most a
+	 * conversion for the whole __le16 space.
+	 */
+	upcase_length = __le64_to_cpu(upcase->length);
+	if (upcase_length == 0 ||
+	    upcase_length & (sizeof (__le16) - 1) ||
+	    upcase_length > 0xffff * sizeof (__le16)) {
+		exfat_msg(root->i_sb, KERN_ERR, "invalid upcase length %llu",
+			  (unsigned long long)upcase_length);
+		goto fail;
+	}
+
+	/*
+	 * load complete upcase table in memory.
+	 */
+	error = -ENOMEM;
+	sbi->upcase_len = upcase_length / sizeof (__le16);
+	sbi->upcase_table = kmalloc(upcase_length, GFP_NOFS);
+	if (!sbi->upcase_table)
+		goto fail;
+
+	error = exfat_load_upcase_table(root->i_sb,
+					__le32_to_cpu(upcase->cluster_addr),
+					&checksum);
+	if (error)
+		goto fail;
+
+	if (checksum != __le32_to_cpu(upcase->checksum)) {
+		exfat_msg(root->i_sb, KERN_INFO,
+			  "upcase table checksum mismatch: have %08x, "
+			  "expect %08x", checksum,
+			  __le32_to_cpu(upcase->checksum));
+		error = -EINVAL;
+		goto fail;
+	}
+
+	exfat_cleanup_dir_ctx(&dctx);
+	return 0;
+
+fail:
+	if (sbi->upcase_table)
+		kfree(sbi->upcase_table);
+	exfat_cleanup_dir_ctx(&dctx);
+	return error;
+}
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/linux/fbxatm_dev.h	2021-03-30 16:07:01.591769549 +0200
@@ -0,0 +1,436 @@
+#ifndef LINUX_FBXATM_DEV_H_
+#define LINUX_FBXATM_DEV_H_
+
+#include <linux/types.h>
+#include <linux/list.h>
+#include <linux/err.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
+#include <linux/skbuff.h>
+#include <linux/mutex.h>
+#include <linux/fbxatm.h>
+#include <linux/device.h>
+#include <asm/atomic.h>
+#include <linux/if_vlan.h>
+#include <linux/fbxatm_remote.h>
+
+/*
+ * atm cell helper
+ */
+#define ATM_CELL_HDR_SIZE	5
+
+#define ATM_GET_GFC(h)		(((h)[0] & 0xf0) >> 4)
+#define ATM_SET_GFC(h,v)	do {					\
+					(h)[0] &= ~0xf0;		\
+					(h)[0] |= (v) << 4;		\
+				} while (0)
+
+#define ATM_GET_VPI(h)		((((h)[0] & 0x0f) << 4) |		\
+				 (((h)[1] & 0xf0) >> 4))
+#define ATM_SET_VPI(h,v)	do {					\
+					(h)[0] &= ~0xf;			\
+					(h)[1] &= ~0xf0;		\
+					(h)[0] |= (v) >> 4;		\
+					(h)[1] |= ((v) & 0xf) << 4;	\
+				} while (0)
+
+#define ATM_GET_VCI(h)		((((h)[1] & 0x0f) << 12) |		\
+				 ((h)[2] << 4) |			\
+				 ((((h)[3] & 0xf0) >> 4)))
+#define ATM_SET_VCI(h,v)	do {					\
+					(h)[1] &= ~0xf;			\
+					(h)[3] &= ~0xf0;		\
+					(h)[1] |= (v) >> 12;		\
+					(h)[2] = ((v) & 0xff0) >> 4;	\
+					(h)[3] |= ((v) & 0xf) << 4;	\
+				} while (0)
+
+
+#define ATM_GET_PT(h)		(((h)[3] & 0x0e) >> 1)
+#define ATM_SET_PT(h,v)		do {					\
+					(h)[3] &= ~0xe;			\
+					(h)[3] |= (v) << 1;		\
+				} while (0)
+
+#define ATM_GET_CLP(h)		(((h)[3] & 0x01))
+#define ATM_SET_CLP(h,v)	do {					\
+					(h)[3] &= ~1;			\
+					(h)[3] |= (v);			\
+				} while (0)
+
+#define ATM_GET_HEC(h)		((h)[4])
+#define ATM_SET_HEC(h,v)	do {					\
+					(h)[4] = (v);			\
+				} while (0)
+
+
+/*
+ * OAM definition
+ */
+#define OAM_VCI_SEG_F4			3
+#define OAM_VCI_END2END_F4		4
+
+#define OAM_PTI_SEG_F5			0x4
+#define OAM_PTI_END2END_F5		0x5
+
+#define OAM_TYPE_SHIFT			4
+#define OAM_TYPE_MASK			(0xf << OAM_TYPE_SHIFT)
+#define OAM_TYPE_FAULT_MANAGEMENT	0x1
+#define OAM_TYPE_PERF_MANAGEMENT	0x2
+#define OAM_TYPE_ACTIVATION		0x8
+
+#define FUNC_TYPE_SHIFT			0
+#define FUNC_TYPE_MASK			(0xf << FUNC_TYPE_SHIFT)
+#define FUNC_TYPE_AIS			0x0
+#define FUNC_TYPE_FERF			0x1
+#define FUNC_TYPE_CONT_CHECK		0x4
+#define FUNC_TYPE_OAM_LOOPBACK		0x8
+
+struct fbxatm_oam_cell_payload {
+	u8			cell_hdr[5];
+	u8			cell_type;
+	u8			loopback_indication;
+	u8			correlation_tag[4];
+	u8			loopback_id[16];
+	u8			source_id[16];
+	u8			reserved[8];
+	u8			crc10[2];
+};
+
+struct fbxatm_oam_cell {
+	struct fbxatm_oam_cell_payload	payload;
+	struct list_head		next;
+};
+
+struct fbxatm_oam_ping {
+	struct fbxatm_oam_ping_req	req;
+	u32				correlation_id;
+	int				replied;
+	wait_queue_head_t		wq;
+	struct list_head		next;
+};
+
+/*
+ * vcc/device stats
+ */
+struct fbxatm_vcc_stats {
+	u32			rx_bytes;
+	u32			tx_bytes;
+	u32			rx_aal5;
+	u32			tx_aal5;
+};
+
+struct fbxatm_dev_stats {
+	u32			rx_bytes;
+	u32			tx_bytes;
+	u32			rx_aal5;
+	u32			tx_aal5;
+	u32			rx_f4_oam;
+	u32			tx_f4_oam;
+	u32			rx_f5_oam;
+	u32			tx_f5_oam;
+	u32			rx_bad_oam;
+	u32			rx_bad_llid_oam;
+	u32			rx_other_oam;
+	u32			rx_dropped;
+	u32			tx_drop_nolink;
+};
+
+/*
+ * vcc user ops
+ */
+struct fbxatm_vcc_uops {
+	void	(*link_change)(void *cb_data, int link,
+			       unsigned int rx_cell_rate,
+			       unsigned int tx_cell_rate);
+	void	(*rx_pkt)(struct sk_buff *skb, void *cb_data);
+	void	(*tx_done)(void *cb_data);
+};
+
+/*
+ * vcc status flags
+ */
+enum {
+	FBXATM_VCC_F_FULL		= (1 << 0),
+
+	FBXATM_VCC_F_LINK_UP		= (1 << 1),
+};
+
+
+/*
+ * vcc definition
+ */
+struct fbxatm_dev;
+
+struct fbxatm_vcc {
+	unsigned int			vpi;
+	unsigned int			vci;
+
+	struct fbxatm_vcc_qos		qos;
+
+	struct fbxatm_vcc_stats		stats;
+
+	enum fbxatm_vcc_user		user;
+	void				*user_priv;
+
+	struct fbxatm_dev		*adev;
+	void				*dev_priv;
+
+	spinlock_t			user_ops_lock;
+	const struct fbxatm_vcc_uops	*user_ops;
+	void				*user_cb_data;
+
+	unsigned int			to_drop_pkt;
+
+	spinlock_t			tx_lock;
+	unsigned long			vcc_flags;
+
+	struct list_head		next;
+};
+
+/*
+ * fbxatm device operation
+ */
+struct fbxatm_dev_ops {
+	int (*open)(struct fbxatm_vcc *vcc);
+
+	void (*close)(struct fbxatm_vcc *vcc);
+
+	int (*ioctl)(struct fbxatm_dev *adev,
+		     unsigned int cmd, void __user *arg);
+
+	int (*send)(struct fbxatm_vcc *vcc, struct sk_buff *skb);
+
+	int (*send_oam)(struct fbxatm_dev *adev,
+			struct fbxatm_oam_cell *cell);
+
+	int (*init_procfs)(struct fbxatm_dev *adev);
+	void (*release_procfs)(struct fbxatm_dev *adev);
+
+	struct module			*owner;
+};
+
+/*
+ * device flags
+ */
+enum {
+	FBXATM_DEV_F_LINK_UP		= (1 << 0),
+};
+
+/*
+ * fbxatm device definition
+ */
+struct fbxatm_dev {
+	int				ifindex;
+	unsigned long			dev_flags;
+	spinlock_t			dev_link_lock;
+
+	unsigned int			max_vcc;
+	unsigned int			vci_mask;
+	unsigned int			vpi_mask;
+	unsigned int			max_priority;
+	unsigned int			max_rx_priority;
+	unsigned int			tx_headroom;
+
+	char				*name;
+
+	/* unit: b/s */
+	unsigned int			link_rate_ds;
+	unsigned int			link_rate_us;
+
+	unsigned int			link_cell_rate_ds;
+	unsigned int			link_cell_rate_us;
+
+	const struct fbxatm_dev_ops	*ops;
+
+	spinlock_t			stats_lock;
+	struct fbxatm_dev_stats		stats;
+
+	spinlock_t			vcc_list_lock;
+	struct list_head		vcc_list;
+
+	struct device			dev;
+
+	spinlock_t			oam_list_lock;
+	struct list_head		rx_oam_cells;
+	unsigned int			rx_oam_cells_count;
+	struct work_struct		oam_work;
+
+	struct list_head		oam_pending_ping;
+	u32				oam_correlation_id;
+
+	struct proc_dir_entry		*dev_proc_entry;
+	void				*priv;
+	struct list_head		next;
+};
+
+/*
+ * API for device drivers
+ */
+struct fbxatm_dev *fbxatm_alloc_device(int sizeof_priv);
+
+int fbxatm_register_device(struct fbxatm_dev *adev,
+			   const char *base_name,
+			   const struct fbxatm_dev_ops *ops);
+
+void fbxatm_free_device(struct fbxatm_dev *adev);
+
+void fbxatm_dev_set_link_up(struct fbxatm_dev *adev);
+
+void fbxatm_dev_set_link_down(struct fbxatm_dev *adev);
+
+int fbxatm_unregister_device(struct fbxatm_dev *adev);
+
+void fbxatm_netifrx_oam(struct fbxatm_dev *adev,
+			struct fbxatm_oam_cell *cell);
+
+
+static inline int fbxatm_vcc_link_is_up(struct fbxatm_vcc *vcc)
+{
+	return test_bit(FBXATM_VCC_F_LINK_UP, &vcc->vcc_flags);
+}
+
+#define	FBXATMDEV_ALIGN		4
+
+static inline void *fbxatm_dev_priv(struct fbxatm_dev *adev)
+{
+	return (u8 *)adev + ((sizeof(struct fbxatm_dev)
+			      + (FBXATMDEV_ALIGN - 1))
+			     & ~(FBXATMDEV_ALIGN - 1));
+}
+
+/*
+ * API for FBXATM stack user
+ */
+struct fbxatm_ioctl {
+	int (*handler)(struct socket *sock,
+		       unsigned int cmd, void __user *useraddr);
+
+	void (*release)(struct socket *sock);
+
+	struct module		*owner;
+	struct list_head	next;
+};
+
+void fbxatm_set_uops(struct fbxatm_vcc *vcc,
+		     const struct fbxatm_vcc_uops *user_ops,
+		     void *user_cb_data);
+
+struct fbxatm_vcc *
+fbxatm_bind_to_vcc(const struct fbxatm_vcc_id *id,
+		   enum fbxatm_vcc_user user);
+
+void fbxatm_unbind_vcc(struct fbxatm_vcc *vcc);
+
+
+static inline int fbxatm_vcc_queue_full(struct fbxatm_vcc *vcc)
+{
+	return test_bit(FBXATM_VCC_F_FULL, &vcc->vcc_flags);
+}
+
+#ifdef CONFIG_FBXATM_STACK
+/*
+ * stack user callback to send data on given vcc
+ */
+static inline int fbxatm_send(struct fbxatm_vcc *vcc, struct sk_buff *skb)
+{
+	int ret;
+	unsigned int len;
+
+	len = skb->len;
+
+	spin_lock_bh(&vcc->tx_lock);
+	if (!test_bit(FBXATM_VCC_F_LINK_UP, &vcc->vcc_flags)) {
+		spin_unlock_bh(&vcc->tx_lock);
+		dev_kfree_skb(skb);
+		spin_lock(&vcc->adev->stats_lock);
+		vcc->adev->stats.tx_drop_nolink++;
+		spin_unlock(&vcc->adev->stats_lock);
+		return 0;
+	}
+
+	ret = vcc->adev->ops->send(vcc, skb);
+	if (!ret) {
+		vcc->stats.tx_bytes += len;
+		vcc->stats.tx_aal5++;
+	}
+	spin_unlock_bh(&vcc->tx_lock);
+
+	if (!ret) {
+		spin_lock_bh(&vcc->adev->stats_lock);
+		vcc->adev->stats.tx_bytes += len;
+		vcc->adev->stats.tx_aal5++;
+		spin_unlock_bh(&vcc->adev->stats_lock);
+	}
+	return ret;
+}
+
+/*
+ * device callback when packet comes in
+ */
+static inline void fbxatm_netifrx(struct fbxatm_vcc *vcc, struct sk_buff *skb)
+{
+	unsigned int len;
+
+	len = skb->len;
+
+	spin_lock_bh(&vcc->user_ops_lock);
+	if (!vcc->user_ops) {
+		spin_unlock_bh(&vcc->user_ops_lock);
+		dev_kfree_skb(skb);
+		return;
+	}
+
+	if (vcc->to_drop_pkt) {
+		vcc->to_drop_pkt--;
+		spin_unlock_bh(&vcc->user_ops_lock);
+		dev_kfree_skb(skb);
+		return;
+	}
+
+	vcc->stats.rx_bytes += len;
+	vcc->stats.rx_aal5++;
+
+	vcc->user_ops->rx_pkt(skb, vcc->user_cb_data);
+	spin_unlock_bh(&vcc->user_ops_lock);
+
+	spin_lock_bh(&vcc->adev->stats_lock);
+	vcc->adev->stats.rx_bytes += len;
+	vcc->adev->stats.rx_aal5++;
+	spin_unlock_bh(&vcc->adev->stats_lock);
+}
+
+/*
+ * device callback when tx is done on vcc
+ */
+static inline void fbxatm_tx_done(struct fbxatm_vcc *vcc)
+{
+	spin_lock_bh(&vcc->user_ops_lock);
+	if (vcc->user_ops)
+		vcc->user_ops->tx_done(vcc->user_cb_data);
+	spin_unlock_bh(&vcc->user_ops_lock);
+}
+#else
+int fbxatm_send(struct fbxatm_vcc *vcc, struct sk_buff *skb);
+void fbxatm_netifrx(struct fbxatm_vcc *vcc, struct sk_buff *skb);
+void fbxatm_tx_done(struct fbxatm_vcc *vcc);
+#endif
+
+static inline unsigned int fbxatm_rx_reserve(void)
+{
+#ifdef CONFIG_FBXATM_STACK
+	/* normal stack, no headroom needed */
+	return 0;
+#else
+	/* remote stub, we need to send rx skb to another location,
+	 * adding the fbxatm_remote header, an ethernet header (with
+	 * possible vlan) */
+	return ALIGN(sizeof (struct fbxatm_remote_hdr) + VLAN_ETH_HLEN, 4);
+#endif
+}
+
+void fbxatm_register_ioctl(struct fbxatm_ioctl *ioctl);
+
+void fbxatm_unregister_ioctl(struct fbxatm_ioctl *ioctl);
+
+#endif /* !LINUX_FBXATM_DEV_H_ */
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/linux/fbxatm_remote.h	2021-03-04 13:21:00.967505698 +0100
@@ -0,0 +1,216 @@
+#ifndef FBXATM_REMOTE_H_
+#define FBXATM_REMOTE_H_
+
+#include <linux/types.h>
+#include <linux/if_ether.h>
+#include <linux/netdevice.h>
+
+/*
+ * fbxatm remote protocol messages
+ */
+#define ETH_P_FBXATM_REMOTE	0x8844
+#define FBXATM_REMOTE_MAGIC	0xd76f8d2f
+
+enum fbxatm_remote_flags {
+	FBXATM_RFLAGS_ACK = (1 << 0),
+};
+
+enum fbxatm_remote_mtype {
+	/* driver => stub */
+	FBXATM_RMT_CONNECT = 0,
+
+	/* stub => driver */
+	FBXATM_RMT_DEV_LINK,
+	FBXATM_RMT_DEV_RX_OAM,
+
+	/* driver => stub */
+	FBXATM_RMT_KEEPALIVE,
+	FBXATM_RMT_DEV_SEND_OAM,
+	FBXATM_RMT_VCC_ACTION,
+
+	/* driver => stub */
+	FBXATM_RMT_VCC_SEND,
+
+	/* stub => driver */
+	FBXATM_RMT_VCC_QEMPTY,
+	FBXATM_RMT_VCC_RX,
+};
+
+struct fbxatm_remote_hdr {
+	u32	magic;
+	u8	flags;
+	u8	seq;
+	u16	len;
+	u16	sport;
+	u16	dport;
+
+	u32	session_id;
+	u32	mtype;
+};
+
+/*
+ * sent to destination port 0
+ */
+struct fbxatm_remote_connect {
+	u8	name[32];
+
+	u16	dev_link_port;
+	u16	dev_rx_oam_port;
+};
+
+struct fbxatm_remote_connect_ack {
+	u16	vcc_action_port;
+	u16	dev_send_oam_port;
+	u16	keepalive_port;
+	u16	pad;
+
+	u32	max_vcc;
+	u32	vci_mask;
+	u32	vpi_mask;
+	u32	max_priority;
+	u32	max_rx_priority;
+
+	u32	link;
+	u32	link_rate_ds;
+	u32	link_rate_us;
+	u32	link_cell_rate_ds;
+	u32	link_cell_rate_us;
+};
+
+/*
+ * sent on dev_link port
+ */
+struct fbxatm_remote_dev_link {
+	u32	link;
+	u32	link_rate_ds;
+	u32	link_rate_us;
+	u32	link_cell_rate_ds;
+	u32	link_cell_rate_us;
+};
+
+/*
+ * sent on vcc_action port
+ */
+struct fbxatm_remote_vcc_action {
+	/* 1: open - 0: close */
+	u32	action;
+
+	/*
+	 * open args
+	 */
+	u16	vcc_rx_port;
+	u16	vcc_qempty_port;
+
+	/* from vcc id struct */
+	u32	vpi;
+	u32	vci;
+
+	/* from qos struct */
+	u32	traffic_class;
+	u32	max_sdu;
+	u32	max_buffered_pkt;
+	u32	priority;
+	u32	rx_priority;
+
+	/*
+	 * close args
+	 */
+	u32	vcc_remote_id;
+};
+
+struct fbxatm_remote_vcc_action_ack {
+	u32	ret;
+
+	/* open args ack */
+	u32	vcc_remote_id;
+	u16	vcc_send_port;
+	u16	pad;
+};
+
+/*
+ * sent on vcc_send port
+ */
+struct fbxatm_remote_vcc_send_ack {
+	u32	full;
+};
+
+/*
+ * pseudo socket layer
+ */
+struct fbxatm_remote_sock;
+struct fbxatm_remote_ctx;
+
+struct fbxatm_remote_sockaddr {
+	u16		lport;
+	u16		dport;
+	u32		mtype;
+	int		infinite_retry;
+	int		(*deliver)(void *priv, struct sk_buff *skb,
+				   struct sk_buff **ack);
+	void		(*response)(void *priv, struct sk_buff *skb);
+	void		*priv;
+};
+
+struct sk_buff *fbxatm_remote_alloc_skb(struct fbxatm_remote_ctx *ctx,
+					unsigned int size);
+
+unsigned int fbxatm_remote_headroom(struct fbxatm_remote_ctx *ctx);
+
+void fbxatm_remote_sock_getaddr(struct fbxatm_remote_sock *sock,
+				struct fbxatm_remote_sockaddr *addr);
+
+void fbxatm_remote_sock_purge(struct fbxatm_remote_sock *sock);
+
+int fbxatm_remote_sock_pending(struct fbxatm_remote_sock *sock);
+
+struct fbxatm_remote_ctx *fbxatm_remote_alloc_ctx(struct net_device *netdev,
+						  u8 *remote_mac,
+						  u32 session_id,
+						  void (*timeout)(void *priv),
+						  void *priv);
+
+struct fbxatm_remote_sock *
+fbxatm_remote_sock_bind(struct fbxatm_remote_ctx *ctx,
+			struct fbxatm_remote_sockaddr *addr,
+			int send_ack);
+
+struct fbxatm_remote_sock *
+fbxatm_remote_sock_connect(struct fbxatm_remote_ctx *ctx,
+			   struct fbxatm_remote_sockaddr *addr,
+			   int need_ack);
+
+int fbxatm_remote_sock_send(struct fbxatm_remote_sock *sock,
+			    struct sk_buff *skb);
+
+int fbxatm_remote_sock_send_ack(struct fbxatm_remote_sock *sock,
+				struct sk_buff *skb);
+
+int fbxatm_remote_sock_send_raw_ack(struct fbxatm_remote_ctx *ctx,
+				    struct net_device *dev,
+				    u8 *remote_mac,
+				    struct fbxatm_remote_hdr *hdr,
+				    struct sk_buff *ack);
+
+void fbxatm_remote_sock_close(struct fbxatm_remote_sock *sock);
+
+void fbxatm_remote_set_unknown_cb(void (*cb)(struct net_device *,
+					     struct sk_buff *));
+
+void fbxatm_remote_free_ctx(struct fbxatm_remote_ctx *ctx);
+
+void fbxatm_remote_ctx_set_dead(struct fbxatm_remote_ctx *ctx);
+
+int fbxatm_remote_init(void);
+
+void fbxatm_remote_exit(void);
+
+/*
+ * platform data for fbxatm_remote driver
+ */
+struct fbxatm_remote_pdata {
+	u8	remote_mac[ETH_ALEN];
+	char	netdev_name[IFNAMSIZ];
+	char	remote_name[32];
+};
+
+#endif /* !FBXATM_REMOTE_H_ */
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/linux/fbxgpio_core.h	2021-03-04 13:21:00.967505698 +0100
@@ -0,0 +1,45 @@
+/*
+ * fbxgpio.h for linux-freebox
+ * Created by <nschichan@freebox.fr> on Wed Feb 21 22:09:46 2007
+ * Freebox SA
+ */
+
+#ifndef FBXGPIO_H
+# define FBXGPIO_H
+
+# include <linux/types.h>
+
+/* can change pin direction */
+#define FBXGPIO_PIN_DIR_RW	(1 << 0)
+#define FBXGPIO_PIN_REVERSE_POL	(1 << 1)
+
+struct fbxgpio_operations {
+	int  (*get_datain)(int gpio);
+	void (*set_dataout)(int gpio, int val);
+	int  (*get_dataout)(int gpio);
+	int (*set_direction)(int gpio, int dir);
+	int  (*get_direction)(int gpio);
+};
+
+
+struct fbxgpio_pin {
+	const struct fbxgpio_operations	*ops;
+	const char			*pin_name;
+	uint32_t			flags;
+	int				direction;
+	int				pin_num;
+	bool				claimed;
+	unsigned int			cur_dataout;
+	struct device			*dev;
+	struct device_node		*of_node;
+};
+
+
+#define GPIO_DIR_IN	0x1
+#define GPIO_DIR_OUT	0x0
+
+struct fbxgpio_pin *fbxgpio_of_get(struct device_node *np,
+				   const char *propname,
+				   int index);
+
+#endif /* !FBXGPIO_H */
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/linux/fbxprocfs.h	2021-03-04 13:21:00.967505698 +0100
@@ -0,0 +1,40 @@
+#ifndef FBXPROCFS_H_
+#define FBXPROCFS_H_
+
+#include <linux/proc_fs.h>
+#include <asm/atomic.h>
+#include <linux/seq_file.h>
+
+struct fbxprocfs_client
+{
+	const char *dirname;
+	struct module *owner;
+	struct proc_dir_entry *dir;
+	atomic_t refcount;
+	struct list_head list;
+};
+
+struct fbxprocfs_desc {
+	char		*name;
+	unsigned long	id;
+	int	(*rfunc)(struct seq_file *, void *);
+	int	(*wfunc)(struct file *, const char *, unsigned long, void *);
+};
+
+struct fbxprocfs_client *fbxprocfs_add_client(const char *dirname,
+					      struct module *owner);
+
+int fbxprocfs_remove_client(struct fbxprocfs_client *client);
+
+
+int
+fbxprocfs_create_entries(struct fbxprocfs_client *client,
+			 const struct fbxprocfs_desc *ro_desc,
+			 const struct fbxprocfs_desc *rw_desc);
+
+int
+fbxprocfs_remove_entries(struct fbxprocfs_client *client,
+			 const struct fbxprocfs_desc *ro_desc,
+			 const struct fbxprocfs_desc *rw_desc);
+
+#endif /* FBXPROCFS_H_ */
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/linux/fbxserial.h	2021-03-04 13:21:00.967505698 +0100
@@ -0,0 +1,129 @@
+#ifndef FBXSERIAL_H_
+#define FBXSERIAL_H_
+
+#include <linux/kernel.h>
+#include <linux/string.h>
+
+/*
+ * some part of serial may vary, we use abstract struct to store this,
+ * data content depends on type.
+ */
+#define EXTINFO_SIZE		128
+#define EXTINFO_MAX_COUNT	16
+
+/*
+ * extdev desc
+ */
+#define EXTINFO_TYPE_EXTDEV	1
+
+#define EXTDEV_TYPE_BUNDLE	1
+#define EXTDEV_TYPE_MAX		2
+
+struct fbx_serial_extinfo {
+	u32			type;
+
+	union {
+		/* extdev */
+		struct {
+			u32	type;
+			u32	model;
+			char	serial[64];
+		} extdev;
+
+		/* raw access */
+		unsigned char	data[EXTINFO_SIZE];
+	} u;
+}  __attribute__ ((packed));;
+
+
+/*
+ * master serial structure
+ */
+
+#define FBXSERIAL_VERSION	1
+
+#define FBXSERIAL_MAGIC		0x2d9521ab
+
+#define MAC_ADDR_SIZE		6
+#define RANDOM_DATA_SIZE	32
+
+/*
+ * this  is the  maximum size  we accept  to check  crc32  against, so
+ * structure may no grow larger than this
+ */
+#define FBXSERIAL_MAX_SIZE	8192
+
+struct fbx_serial {
+	u32	crc32;
+	u32	magic;
+	u32	struct_version;
+	u32	len;
+
+	/* board serial */
+	u16	type;
+	u8	version;
+	u8	manufacturer;
+	u16	year;
+	u8	week;
+	u32	number;
+	u32	flags;
+
+	/* mac address base */
+	u8	mac_addr_base[MAC_ADDR_SIZE];
+
+	/* mac address count */
+	u8	mac_count;
+
+	/* random data */
+	u8	random_data[RANDOM_DATA_SIZE];
+
+	/* last update of data (seconds since epoch) */
+	u32	last_modified;
+
+	/* count of following extinfo tag */
+	u32	extinfo_count;
+
+	/* beginning of extended info */
+	struct fbx_serial_extinfo	extinfos[EXTINFO_MAX_COUNT];
+
+} __attribute__ ((packed));
+
+
+/*
+ * default value to use in case magic is wrong (no cksum in that case)
+ */
+static inline void fbxserial_set_default(struct fbx_serial *s)
+{
+	memset(s, 0, sizeof (*s));
+	s->magic = FBXSERIAL_MAGIC;
+	s->struct_version = FBXSERIAL_VERSION;
+	s->len = sizeof (*s);
+	s->manufacturer = '_';
+	memcpy(s->mac_addr_base, "\x00\x07\xCB\x00\x00\xFD", 6);
+	s->mac_count = 1;
+}
+
+void
+fbxserialinfo_get_random(unsigned char *data, unsigned int len);
+
+const void *
+fbxserialinfo_get_mac_addr(unsigned int index);
+
+int
+fbxserialinfo_read(const void *data, struct fbx_serial *out);
+
+struct fbx_serial *fbxserialinfo_get(void);
+
+/*
+ * implemented in board specific code
+ */
+#ifdef CONFIG_ARCH_HAS_FBXSERIAL
+extern const struct fbx_serial *arch_get_fbxserial(void);
+#else
+static inline const struct fbx_serial *arch_get_fbxserial(void)
+{
+	return NULL;
+}
+#endif
+
+#endif /* FBXSERIAL_H_ */
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/linux/smsc_cap1066.h	2021-03-04 13:21:01.047505701 +0100
@@ -0,0 +1,12 @@
+#ifndef SMSC_CAP1066_H_
+#define SMSC_CAP1066_H_
+
+#define CAP1066_MAX_BTNS	6
+
+struct smsc_cap1066_pdata {
+	u32		key_map[CAP1066_MAX_BTNS];
+	unsigned int	irq_gpio;
+	bool		has_irq_gpio;
+};
+
+#endif /* ! SMSC_CAP1066_H_ */
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/net/ip6_ffn.h	2021-03-04 13:21:01.080839036 +0100
@@ -0,0 +1,53 @@
+#ifndef IP6_FFN_H_
+#define IP6_FFN_H_
+
+#include <linux/types.h>
+#include <linux/net.h>
+#include <net/route.h>
+#include <net/netfilter/nf_conntrack.h>
+
+struct ffn6_data {
+	u32 new_sip[4];
+	u32 new_dip[4];
+
+	u16 new_sport;
+	u16 new_dport;
+	__sum16 adjustment;
+	u8 new_tos;
+	u32 new_skb_prio;
+	u32 new_mark;
+
+	u32 force_skb_prio : 1;
+	u32 alter : 1;
+	u32 tos_change : 1;
+	struct dst_entry *dst;
+	struct nf_conn *ct;
+	enum ip_conntrack_info ctinfo;
+
+	void (*priv_destructor)(void *);
+	u32 ffn_priv_area[8];
+};
+
+struct ffn6_lookup_entry {
+	u32 sip[4];
+	u32 dip[4];
+	u16 sport;
+	u16 dport;
+	u8 protocol;
+	u8 added_when;
+#ifdef CONFIG_IPV6_FFN_PROCFS
+	uint64_t forwarded_bytes;
+	uint32_t forwarded_packets;
+#endif
+	struct list_head next;
+	struct ffn6_data manip;
+	struct list_head all_next;
+};
+
+extern spinlock_t ffn6_lock;
+struct ffn6_lookup_entry *__ffn6_get(const u32 *sip,
+				     const u32 *dip,
+				     u16 sport, u16 dport,
+				     int is_tcp);
+
+#endif /* ! IP6_FFN_H_*/
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/net/ip_ffn.h	2021-03-04 13:21:01.080839036 +0100
@@ -0,0 +1,51 @@
+#ifndef IP_FFN_H_
+#define IP_FFN_H_
+
+#include <linux/types.h>
+#include <linux/net.h>
+#include <net/route.h>
+#include <net/netfilter/nf_conntrack.h>
+
+struct ffn_data {
+	u32 new_sip;
+	u32 new_dip;
+	u16 new_sport;
+	u16 new_dport;
+	u8 new_tos;
+	u8 force_skb_prio : 1;
+	u8 alter : 1;
+	u8 tos_change : 1;
+	__sum16 ip_adjustment;
+	__sum16 l4_adjustment;
+	unsigned int new_skb_prio;
+	u32 new_mark;
+	struct dst_entry *dst;
+	struct nf_conn *ct;
+	enum ip_conntrack_info ctinfo;
+
+	void (*priv_destructor)(void *);
+	u32 ffn_priv_area[8];
+};
+
+struct ffn_lookup_entry {
+	int added_when;
+	u32 sip;
+	u32 dip;
+	u16 sport;
+	u16 dport;
+	u8 protocol;
+#ifdef CONFIG_IP_FFN_PROCFS
+	uint64_t forwarded_bytes;
+	uint32_t forwarded_packets;
+#endif
+	struct list_head next;
+	struct ffn_data manip;
+	struct list_head all_next;
+};
+
+extern spinlock_t ffn_lock;
+struct ffn_lookup_entry *__ffn_get(u32 sip, u32 dip,
+				   u16 sport, u16 dport,
+				   int is_tcp);
+
+#endif /* ! IP_FFN_H_*/
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/bcm63xx_rdp_ioctl.h	2021-03-04 13:21:01.120839038 +0100
@@ -0,0 +1,71 @@
+#ifndef LINUX_BCM63XX_RDP_IOCTL_H_
+#define LINUX_BCM63XX_RDP_IOCTL_H_
+
+#include <linux/types.h>
+
+enum {
+	RDP_IOC_OP_GET_INFO,
+
+	RDP_IOC_OP_READ8,
+	RDP_IOC_OP_READ16,
+	RDP_IOC_OP_READ32,
+	RDP_IOC_OP_WRITE8,
+	RDP_IOC_OP_WRITE16,
+	RDP_IOC_OP_WRITE32,
+
+	RDP_IOC_OP_READ_TM_32,
+	RDP_IOC_OP_WRITE_TM_32,
+	RDP_IOC_OP_READ_MC_32,
+	RDP_IOC_OP_WRITE_MC_32,
+
+	RDP_IOC_OP_RESET,
+
+	RDP_IOC_DMA_MAP,
+	RDP_IOC_DMA_GET_INFO,
+	RDP_IOC_DMA_FLUSH_ALL,
+	RDP_IOC_DMA_READ_BUFFER,
+	RDP_IOC_DMA_WRITE_BUFFER,
+
+	RDP_IOC_OP_MAP_INTERRUPTS,
+};
+
+struct bcm_rdp_pioctl_dma_result {
+	__u32		id;
+	__u32		size;
+	__u64		virt_addr;
+	__u64		dma_addr;
+};
+
+struct bcm_rdp_pioctl_get_info_result {
+	__u64		tm_dma_addr;
+	__u64		mc_dma_addr;
+	__u32		tm_size;
+	__u32		mc_size;
+};
+
+struct bcm_rdp_pioctl {
+	union {
+		/* for get_info op */
+		struct {
+			void __user	*buf_addr;
+		} get_info;
+
+		/* for read/write op */
+		struct {
+			__u32		reg_area;
+			__u32		offset;
+			__u32		size;
+			void __user	*buf_addr;
+		} io;
+
+		/* for dma op */
+		struct {
+			__u32		id;
+			__u32		size;
+			void __user	*buf_addr;
+		} dma;
+	} u;
+};
+
+#endif /* LINUX_BCM63XX_RDP_IOCTL_H_ */
+
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/exfat_user.h	2021-03-04 13:21:01.124172371 +0100
@@ -0,0 +1,47 @@
+/*
+ * exfat_user.h for exfat
+ * Created by <nschichan@freebox.fr> on Fri Aug 23 15:31:08 2013
+ */
+
+#ifndef __EXFAT_USER_H
+# define __EXFAT_USER_H
+
+struct exfat_fragment {
+	uint32_t	fcluster_start;
+	uint32_t	dcluster_start;
+	uint32_t	nr_clusters;
+	uint64_t	sector_start;
+};
+
+struct exfat_fragment_head {
+	uint32_t		fcluster_start;
+	uint32_t		nr_fragments;
+	uint32_t		sector_size;
+	uint32_t		cluster_size;
+	struct exfat_fragment	fragments[0];
+};
+
+struct exfat_bitmap_data {
+	uint32_t		start_cluster;
+	uint32_t		nr_clusters;
+	uint64_t		sector_start;
+	uint64_t		nr_sectors;
+};
+
+struct exfat_bitmap_head {
+	uint32_t			start_cluster;
+	uint32_t			nr_entries;
+	struct exfat_bitmap_data	entries[0];
+};
+
+struct exfat_dirent_head {
+	uint32_t offset;
+	uint32_t nr_entries;
+	uint8_t entries[0];
+};
+
+#define EXFAT_IOCGETFRAGMENTS	_IOR('X', 0x01, struct exfat_fragment_head)
+#define EXFAT_IOCGETBITMAP	_IOR('X', 0x02, struct exfat_bitmap_head)
+#define EXFAT_IOCGETDIRENTS	_IOR('X', 0x03, struct exfat_dirent_head)
+
+#endif /* !__EXFAT_USER_H */
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/fbxatm.h	2021-03-04 13:21:01.124172371 +0100
@@ -0,0 +1,159 @@
+/*
+ * Generic fbxatm definition, exported to userspace
+ */
+#ifndef LINUX_FBXATM_H_
+#define LINUX_FBXATM_H_
+
+#include <linux/types.h>
+#include <linux/if.h>
+
+#define FBXATM_IOCTL_MAGIC		0xd3
+
+/* allow userspace usage without up to date kernel headers */
+#ifndef PF_FBXATM
+#define PF_FBXATM			32
+#define AF_FBXATM			PF_FBXATM
+#endif
+
+struct fbxatm_vcc_id {
+	int				dev_idx;
+	__u32				vpi;
+	__u32				vci;
+};
+
+enum fbxatm_vcc_user {
+	FBXATM_VCC_USER_NONE = 0,
+	FBXATM_VCC_USER_2684,
+	FBXATM_VCC_USER_PPPOA,
+};
+
+enum fbxatm_vcc_traffic_class {
+	FBXATM_VCC_TC_UBR_NO_PCR = 0,
+	FBXATM_VCC_TC_UBR,
+};
+
+struct fbxatm_vcc_qos {
+	__u32				traffic_class;
+	__u32				max_sdu;
+	__u32				max_buffered_pkt;
+	__u32				priority;
+	__u32				rx_priority;
+};
+
+
+/*
+ * VCC related
+ */
+struct fbxatm_vcc_params {
+	/* ADD/DEL/GET */
+	struct fbxatm_vcc_id		id;
+
+	/* ADD/GET */
+	struct fbxatm_vcc_qos		qos;
+
+	/* GET */
+	enum fbxatm_vcc_user		user;
+};
+
+#define FBXATM_IOCADD		_IOW(FBXATM_IOCTL_MAGIC,	1,	\
+					struct fbxatm_vcc_params)
+
+#define FBXATM_IOCDEL		_IOR(FBXATM_IOCTL_MAGIC,	2,	\
+					struct fbxatm_vcc_params)
+
+#define FBXATM_IOCGET		_IOWR(FBXATM_IOCTL_MAGIC,	3,	\
+					struct fbxatm_vcc_params)
+
+
+struct fbxatm_vcc_drop_params {
+	struct fbxatm_vcc_id		id;
+	unsigned int			drop_count;
+};
+
+#define FBXATM_IOCDROP		_IOWR(FBXATM_IOCTL_MAGIC,	5,	\
+					struct fbxatm_vcc_drop_params)
+
+/*
+ * OAM related
+ */
+enum fbxatm_oam_ping_type {
+	FBXATM_OAM_PING_SEG_F4	= 0,
+	FBXATM_OAM_PING_SEG_F5,
+	FBXATM_OAM_PING_E2E_F4,
+	FBXATM_OAM_PING_E2E_F5,
+};
+
+struct fbxatm_oam_ping_req {
+	/* only dev_idx for F4 */
+	struct fbxatm_vcc_id		id;
+
+	__u8				llid[16];
+	enum fbxatm_oam_ping_type	type;
+};
+
+#define FBXATM_IOCOAMPING	_IOWR(FBXATM_IOCTL_MAGIC,	10,	\
+				      struct fbxatm_oam_ping_req)
+
+
+/*
+ * PPPOA related
+ */
+enum fbxatm_pppoa_encap {
+	FBXATM_EPPPOA_AUTODETECT = 0,
+	FBXATM_EPPPOA_VCMUX,
+	FBXATM_EPPPOA_LLC,
+};
+
+struct fbxatm_pppoa_vcc_params {
+	struct fbxatm_vcc_id		id;
+	__u32				encap;
+	__u32				cur_encap;
+};
+
+#define FBXATM_PPPOA_IOCADD	_IOW(FBXATM_IOCTL_MAGIC,	20,	\
+					struct fbxatm_pppoa_vcc_params)
+
+#define FBXATM_PPPOA_IOCDEL	_IOW(FBXATM_IOCTL_MAGIC,	21,	\
+					struct fbxatm_pppoa_vcc_params)
+
+#define FBXATM_PPPOA_IOCGET	_IOWR(FBXATM_IOCTL_MAGIC,	22,	\
+					struct fbxatm_pppoa_vcc_params)
+
+
+
+/*
+ * 2684 related
+ */
+enum fbxatm_2684_encap {
+	FBXATM_E2684_VCMUX = 0,
+	FBXATM_E2684_LLC,
+};
+
+enum fbxatm_2684_payload {
+	FBXATM_P2684_BRIDGE = 0,
+	FBXATM_P2684_ROUTED,
+};
+
+#define FBXATM_2684_MAX_VCC		8
+
+struct fbxatm_2684_vcc_params {
+	struct fbxatm_vcc_id		id_list[FBXATM_2684_MAX_VCC];
+	size_t				id_count;
+
+	__u32				encap;
+	__u32				payload;
+	char				dev_name[IFNAMSIZ];
+	__u8				perm_addr[6];
+};
+
+
+#define FBXATM_2684_IOCADD	_IOW(FBXATM_IOCTL_MAGIC,	30,	\
+					struct fbxatm_2684_vcc_params)
+
+#define FBXATM_2684_IOCDEL	_IOW(FBXATM_IOCTL_MAGIC,	31,	\
+					struct fbxatm_2684_vcc_params)
+
+#define FBXATM_2684_IOCGET	_IOWR(FBXATM_IOCTL_MAGIC,	32,	\
+					struct fbxatm_2684_vcc_params)
+
+#endif /* LINUX_FBXATM_H_ */
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/fbxbridge.h	2021-03-04 13:21:01.124172371 +0100
@@ -0,0 +1,72 @@
+#ifndef _UAPI_FBXBRIDGE_H
+# define _UAPI_FBXBRIDGE_H
+
+#include <linux/if.h>
+#include <linux/if_ether.h>
+
+#define MAX_ALIASES				3
+
+#define FBXBRIDGE_FLAGS_FILTER			(1 << 0)
+#define FBXBRIDGE_FLAGS_DHCPD			(1 << 1)
+#define FBXBRIDGE_FLAGS_NETFILTER		(1 << 2)
+
+/*
+ * ioctl command
+ */
+
+enum fbxbridge_ioctl_cmd
+{
+	E_CMD_BR_CHG = 0,
+	E_CMD_BR_DEV_CHG,
+	E_CMD_BR_PARAMS,
+};
+
+struct fbxbridge_ioctl_chg
+{
+	char	brname[IFNAMSIZ];
+	__u32	action;
+};
+
+struct fbxbridge_ioctl_dev_chg
+{
+	char	brname[IFNAMSIZ];
+	char	devname[IFNAMSIZ];
+	__u32	wan;
+	__u32	action;
+};
+
+struct fbxbridge_port_info
+{
+	char	name[IFNAMSIZ];
+	__u32	present;
+};
+
+struct fbxbridge_ioctl_params
+{
+	int				action;
+	char				brname[IFNAMSIZ];
+
+	/* config */
+	__u32				flags;
+	__be32				dns1_addr;
+	__be32				dns2_addr;
+	__be32				ip_aliases[MAX_ALIASES];
+	__u32				dhcpd_renew_time;
+	__u32				dhcpd_rebind_time;
+	__u32				dhcpd_lease_time;
+	__u32				inputmark;
+
+	/* status */
+	struct fbxbridge_port_info	wan_dev;
+	struct fbxbridge_port_info	lan_dev;
+	__u8				lan_hwaddr[ETH_ALEN];
+	__u32				have_hw_addr;
+};
+
+struct fbxbridge_ioctl_req
+{
+	enum fbxbridge_ioctl_cmd	cmd;
+	unsigned long			arg;
+};
+
+#endif /* _UAPI_FBXBRIDGE_H */
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/fbxjtag.h	2021-03-04 13:21:01.124172371 +0100
@@ -0,0 +1,89 @@
+#ifndef FBXJTAG_H_
+# define FBXJTAG_H_
+
+#ifdef __KERNEL__
+# include <linux/types.h>
+#endif
+
+# define JTAG_RESET_STEPS	16
+# define JTAG_DATA_READ_SIZE	128
+# define JTAG_INST_READ_SIZE	128
+# define JTAG_DEF_CLOCK_DELAY	500
+# define JTAG_DEF_WAIT_TMS	0
+
+enum jtag_main_state {
+	JTAG_STATE_TEST_MASK	=	0x10,
+	JTAG_STATE_RUN_MASK	=	0x20,
+	JTAG_STATE_DR_MASK	=	0x40,
+	JTAG_STATE_IR_MASK	=	0x80,
+};
+#define JTAG_STATE_MASK			0xF0
+
+enum jtag_sub_state {
+	JTAG_SUB_STATE_SELECT	=	0x0,
+	JTAG_SUB_STATE_CAPTURE	=	0x1,
+	JTAG_SUB_STATE_SHIFT	=	0x2,
+	JTAG_SUB_STATE_EXIT1	=	0x3,
+	JTAG_SUB_STATE_PAUSE	=	0x4,
+	JTAG_SUB_STATE_EXIT2	=	0x5,
+	JTAG_SUB_STATE_UPDATE	=	0x6,
+};
+#define JTAG_SUB_STATE_MASK		0xF
+
+enum jtag_state {
+	JTAG_STATE_UNDEF	= 0,
+	JTAG_STATE_TEST_LOGIC_RESET	= JTAG_STATE_TEST_MASK,
+	JTAG_STATE_RUN_TEST_IDLE	= JTAG_STATE_RUN_MASK,
+
+	JTAG_STATE_SELECT_DR	= JTAG_STATE_DR_MASK | JTAG_SUB_STATE_SELECT,
+	JTAG_STATE_CAPTURE_DR	= JTAG_STATE_DR_MASK | JTAG_SUB_STATE_CAPTURE,
+	JTAG_STATE_SHIFT_DR	= JTAG_STATE_DR_MASK | JTAG_SUB_STATE_SHIFT,
+	JTAG_STATE_EXIT1_DR	= JTAG_STATE_DR_MASK | JTAG_SUB_STATE_EXIT1,
+	JTAG_STATE_PAUSE_DR	= JTAG_STATE_DR_MASK | JTAG_SUB_STATE_PAUSE,
+	JTAG_STATE_EXIT2_DR	= JTAG_STATE_DR_MASK | JTAG_SUB_STATE_EXIT2,
+	JTAG_STATE_UPDATE_DR	= JTAG_STATE_DR_MASK | JTAG_SUB_STATE_UPDATE,
+
+	JTAG_STATE_SELECT_IR	= JTAG_STATE_IR_MASK | JTAG_SUB_STATE_SELECT,
+	JTAG_STATE_CAPTURE_IR	= JTAG_STATE_IR_MASK | JTAG_SUB_STATE_CAPTURE,
+	JTAG_STATE_SHIFT_IR	= JTAG_STATE_IR_MASK | JTAG_SUB_STATE_SHIFT,
+	JTAG_STATE_EXIT1_IR	= JTAG_STATE_IR_MASK | JTAG_SUB_STATE_EXIT1,
+	JTAG_STATE_PAUSE_IR	= JTAG_STATE_IR_MASK | JTAG_SUB_STATE_PAUSE,
+	JTAG_STATE_EXIT2_IR	= JTAG_STATE_IR_MASK | JTAG_SUB_STATE_EXIT2,
+	JTAG_STATE_UPDATE_IR	= JTAG_STATE_IR_MASK | JTAG_SUB_STATE_UPDATE,
+
+	JTAG_STATE_MAX
+};
+
+#define JTAG_STATE_IN_DR(state)	((state) & JTAG_STATE_DR_MASK)
+#define JTAG_STATE_IN_IR(state)	((state) & JTAG_STATE_IR_MASK)
+
+#ifdef __KERNEL__
+
+#define JTAG_BUF_SIZE	2048
+
+struct fbxjtag_data {
+	const char	*name;
+	struct {
+		struct fbxgpio_pin	*tck;
+		struct fbxgpio_pin	*tms;
+		struct fbxgpio_pin	*tdi;
+		struct fbxgpio_pin	*tdo;
+	}		gpios;
+	u32		clock_delay;
+	u32		wait_tms;
+	u32		data_read_size;
+	u32		instruction_read_size;
+	bool		last_tms_dataout;
+	struct device	*dev;
+	enum jtag_state state;
+	char		nb_reset;
+	char		dr_buf[JTAG_BUF_SIZE];
+	unsigned 	dr_w;
+	unsigned 	dr_r;
+	char		ir_buf[JTAG_BUF_SIZE];
+	unsigned 	ir_r;
+	unsigned 	ir_w;
+};
+#endif
+
+#endif /* !FBXJTAG_H_ */
diff -Nruw linux-5.4.60-fbx/include/uapi/linux/hdmi-cec./dev.h linux-5.4.60-fbx/include/uapi/linux/hdmi-cec/dev.h
--- linux-5.4.60-fbx/include/uapi/linux/hdmi-cec./dev.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/include/uapi/linux/hdmi-cec/dev.h	2021-03-04 13:21:01.124172371 +0100
@@ -0,0 +1,30 @@
+#ifndef __HDMI_CEC_DEV_H
+#define __HDMI_CEC_DEV_H
+
+#include <linux/ioctl.h>
+#include <linux/hdmi-cec/hdmi-cec.h>
+
+#define CEC_IOCTL_BASE	'C'
+
+#define CEC_SET_LOGICAL_ADDRESS	_IOW(CEC_IOCTL_BASE, 0, int)
+#define CEC_RESET_DEVICE	_IOW(CEC_IOCTL_BASE, 3, int)
+#define CEC_GET_COUNTERS	_IOR(CEC_IOCTL_BASE, 4, struct cec_counters)
+#define CEC_SET_RX_MODE		_IOW(CEC_IOCTL_BASE, 5, enum cec_rx_mode)
+#define CEC_GET_TX_STATUS	_IOW(CEC_IOCTL_BASE, 6, struct cec_tx_status)
+#define CEC_SET_DETACHED_CONFIG	_IOW(CEC_IOCTL_BASE, 7, struct cec_detached_config)
+
+#define CEC_MAX_DEVS	(10)
+
+#ifdef __KERNEL__
+
+struct cec_adapter;
+
+int __init cec_cdev_init(void);
+void __exit cec_cdev_exit(void);
+
+int cec_create_adapter_node(struct cec_adapter *);
+void cec_remove_adapter_node(struct cec_adapter *);
+
+#endif /* __KERNEL__ */
+
+#endif /* __HDMI_CEC_DEV_H */
diff -Nruw linux-5.4.60-fbx/include/uapi/linux/hdmi-cec./hdmi-cec.h linux-5.4.60-fbx/include/uapi/linux/hdmi-cec/hdmi-cec.h
--- linux-5.4.60-fbx/include/uapi/linux/hdmi-cec./hdmi-cec.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/include/uapi/linux/hdmi-cec/hdmi-cec.h	2021-03-04 13:21:01.124172371 +0100
@@ -0,0 +1,153 @@
+#ifndef __UAPI_HDMI_CEC_H
+#define __UAPI_HDMI_CEC_H
+
+#include <linux/kernel.h>
+#include <linux/types.h>
+
+/* Common defines for HDMI CEC */
+#define CEC_BCAST_ADDR		(0x0f)
+#define CEC_ADDR_MAX		CEC_BCAST_ADDR
+
+#define CEC_MAX_MSG_LEN		(16)	/* 16 blocks */
+
+enum cec_rx_msg_flags {
+	/*
+	 * an ACK was received for this message
+	 */
+	CEC_RX_F_ACKED			= (1 << 0),
+
+	/*
+	 * message was fully received
+	 */
+	CEC_RX_F_COMPLETE		= (1 << 1),
+};
+
+/**
+ * struct cec_rx_msg - user-space exposed cec message cookie
+ * @data:	cec message payload
+ * @len:	cec message length
+ * @valid:	0 for invalid message
+ * @flags:	flag field (cec_rx_msg_flags)
+ */
+struct cec_rx_msg {
+	__u8	data[CEC_MAX_MSG_LEN];
+	__u8	len;
+	__u8	valid;
+	__u8	flags;
+
+} __attribute__((packed));
+
+enum cec_tx_status_flags {
+	/*
+	 * message was nacked at some point
+	 */
+	CEC_TX_F_NACK			= (1 << 0),
+
+	/*
+	 * abort sending because total time to send was elapsed
+	 */
+	CEC_TX_F_TIMEOUT		= (1 << 1),
+
+	/*
+	 * abort sending because maximum number of retry has passed
+	 */
+	CEC_TX_F_MAX_RETRIES		= (1 << 2),
+
+	/*
+	 * abort sending because of arbitration loss
+	 */
+	CEC_TX_F_ARBITRATION_LOST	= (1 << 3),
+
+	/*
+	 * message failed for other reason
+	 */
+	CEC_TX_F_UNKNOWN_ERROR		= (1 << 7),
+};
+
+/**
+ * struct cec_tx_msg - user-space exposed cec message cookie
+ * @expire_ms:	how long we try to send message (milliseconds)
+ * @data:	cec message payload
+ * @len:	cec message length
+ * @success:	0 => message was sent, else => failed to send message
+ * @flags:	flag field (cec_tx_msg_flags)
+ * @tries:	number of try done to send message
+ */
+struct cec_tx_msg {
+	__u16	expire_ms;
+	__u8	data[CEC_MAX_MSG_LEN];
+	__u8	len;
+	__u8	success;
+	__u8	flags;
+	__u8	tries;
+} __attribute__((packed));
+
+struct cec_tx_status {
+	__u8	sent;
+	__u8	success;
+	__u8	flags;
+	__u8	tries;
+} __attribute__((packed));
+
+#define DETACH_CFG_F_WAKEUP		(1 << 0)
+
+struct cec_detached_config {
+	__u8	phys_addr_valid;
+	__u8	phys_addr[2];
+	__u8	flags;
+} __attribute__((packed));
+
+/* Counters */
+
+/**
+ * struct cec_rx_counters - cec adpater RX counters
+ */
+struct cec_rx_counters {
+	__u8	pkts;
+	__u8	filtered_pkts;
+	__u8	valid_pkts;
+	__u8	rx_queue_full;
+	__u8	late_ack;
+	__u8	error;
+	__u8	rx_timeout_abort;
+	__u8	rx_throttled;
+};
+
+/**
+ * struct cec_tx_counters - cec adapter TX counters
+ */
+struct cec_tx_counters {
+	__u8	done;
+	__u8	fail;
+	__u8	timeout;
+	__u8	arb_loss;
+	__u8	bad_ack_timings;
+	__u8	tx_miss_early;
+	__u8	tx_miss_late;
+};
+
+/**
+ * struct cec_counters - tx and rx cec counters
+ * @rx:	struct cec_rx_counters
+ * @tx: struct cec_tx_counters
+ */
+struct cec_counters {
+	struct cec_rx_counters	rx;
+	struct cec_tx_counters	tx;
+};
+
+/**
+ * enum cec_rx_mode - cec adapter rx mode
+ * @CEC_RX_MODE_DISABLED:	RX path is disabled (default)
+ * @CEC_RX_MODE_DEFAULT:	accept only unicast traffic
+ * @CEC_RX_MODE_ACCEPT_ALL:	accept all incoming RX traffic (sniffing mode)
+ * @CEC_RX_MODE_MAX:		sentinel
+ */
+enum cec_rx_mode {
+	CEC_RX_MODE_DISABLED = 0,
+	CEC_RX_MODE_DEFAULT,
+	CEC_RX_MODE_ACCEPT_ALL,
+	CEC_RX_MODE_MAX
+};
+
+#endif /* __UAPI_HDMI_CEC_H */
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/include/uapi/linux/prctl-private.h	2021-03-04 13:21:01.137505705 +0100
@@ -0,0 +1,10 @@
+#ifndef _LINUX_PRCTL_PRIVATE_H
+#define _LINUX_PRCTL_PRIVATE_H
+
+/*
+ * Freebox addition: set/get exec mode.
+ */
+#define PR_SET_EXEC_MODE	57
+#define PR_GET_EXEC_MODE	58
+
+#endif /* ! _LINUX_PRCTL_PRIVATE_H */
diff -Nruw linux-5.4.60-fbx/include/uapi/linux/remoti./remoti.h linux-5.4.60-fbx/include/uapi/linux/remoti/remoti.h
--- linux-5.4.60-fbx/include/uapi/linux/remoti./remoti.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/include/uapi/linux/remoti/remoti.h	2021-03-04 13:21:01.140839039 +0100
@@ -0,0 +1,137 @@
+#ifndef _UAPI_REMOTI_H
+#define _UAPI_REMOTI_H
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+/*
+ * subsystem definitions
+ */
+#define NPI_SYS_RES0		0
+#define NPI_SYS_SYS		1
+#define NPI_SYS_MAC		2
+#define NPI_SYS_NWK		3
+#define NPI_SYS_AF		4
+#define NPI_SYS_ZDO		5
+#define NPI_SYS_SAPI		6
+#define NPI_SYS_UTIL		7
+#define NPI_SYS_DBG		8
+#define NPI_SYS_APP		9
+#define NPI_SYS_RCAF		10
+#define NPI_SYS_RCN		11
+#define NPI_SYS_RCN_CLI		12
+#define NPI_SYS_BOOT		13
+#define NPI_SYS_MAX		14
+#define NPI_SYS_MASK		0x1F
+
+/*
+ * type definitions
+ */
+#define NPI_POLL		0
+#define NPI_SREQ		1
+#define NPI_AREQ		2
+#define NPI_SRSP		3
+#define NPI_TYPE_MAX		4
+#define NPI_TYPE_MASK		3
+#define NPI_TYPE_SHIFT		5
+
+
+/* common error codes (see RemoTI API) */
+#define RTI_SUCCESS		0x00
+
+/*
+ * rti user message
+ */
+#define NPI_MAX_DATA_LEN	123
+
+struct rti_msg {
+	__u8	type;
+	__u8	subsys;
+	__u8	cmd;
+
+	__u8	data_len;
+	__u8	data[NPI_MAX_DATA_LEN];
+
+	__u8	custom_reply_cmd;
+	__u8	reply_cmd;
+	__u8	reply_len;
+	__u8	reply[NPI_MAX_DATA_LEN];
+};
+
+/*
+ * socket addr family on "user" device
+ */
+#ifndef PF_REMOTI
+#define PF_REMOTI			37
+#define AF_REMOTI			PF_REMOTI
+#endif
+
+struct sockaddr_rti {
+	__u32	device_id;
+};
+
+#define SOL_REMOTI			280
+#define REMOTI_REGISTER_CB		0
+
+struct rti_callback {
+	__u8	subsys;
+	__u8	cmd;
+};
+
+/*
+ * ioctl on uart device
+ */
+enum rti_dev_state {
+	RTI_DEV_S_STOPPED = 0,
+	RTI_DEV_S_BOOTING,
+	RTI_DEV_S_BOOT_FAILED,
+	RTI_DEV_S_OPERATIONAL,
+	RTI_DEV_S_STOPPING,
+	RTI_DEV_S_DEAD,
+};
+
+struct rti_dev_status {
+	__u32	dev_state;
+	__u32	fw_version;
+};
+
+struct rti_dev_stats {
+	__u64	tx_bytes;
+	__u64	tx_packets;
+
+	__u64	tx_boot_packets;
+	__u64	tx_rcaf_packets;
+	__u64	tx_util_packets;
+	__u64	tx_other_packets;
+
+
+	__u64	rx_bytes;
+	__u64	rx_packets;
+	__u64	rx_bad_sof;
+	__u64	rx_len_errors;
+	__u64	rx_fcs_errors;
+	__u64	rx_tty_errors;
+	__u64	rx_full_errors;
+	__u64	rx_subsys_errors;
+	__u64	rx_type_errors;
+	__u64	rx_no_callback;
+
+	__u64	rx_boot_packets;
+	__u64	rx_rcaf_packets;
+	__u64	rx_util_packets;
+	__u64	rx_other_packets;
+};
+
+enum {
+	RTI_BOOT_FLAGS_FORCE_UPDATE	= (1 << 0),
+};
+
+#define RTI_IOCTL_MAGIC		0xd4
+#define RTI_ATTACH_DEVICE	_IOR(RTI_IOCTL_MAGIC, 1, __u32)
+#define RTI_GET_STATUS		_IOW(RTI_IOCTL_MAGIC, 2, struct rti_dev_status)
+#define RTI_GET_STATS		_IOW(RTI_IOCTL_MAGIC, 3, struct rti_dev_stats)
+
+#define RTI_START_DEVICE	_IOR(RTI_IOCTL_MAGIC, 8, __u32)
+#define RTI_STOP_DEVICE		_IO(RTI_IOCTL_MAGIC, 9)
+
+#endif /* _UAPI_REMOTI_H */
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/lib/fbxserial.c	2021-03-04 13:21:01.324172380 +0100
@@ -0,0 +1,178 @@
+#include <linux/compiler.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/vmalloc.h>
+#include <linux/crc32.h>
+#include <linux/slab.h>
+
+#include <asm/io.h>
+
+#include <linux/fbxserial.h>
+
+#define PFX "builtin-fbxserial: "
+
+static void __init
+fbxserialinfo_use_default(struct fbx_serial *serial)
+{
+	printk(KERN_WARNING PFX "warning: using default serial infos\n");
+	fbxserial_set_default(serial);
+}
+
+/*
+ * add trailing 0 for bundle string here.
+ */
+static void __init
+bundle_fixup(struct fbx_serial *serial)
+{
+	struct fbx_serial_extinfo *p;
+	int i;
+
+	for (i = 0; i < be32_to_cpu(serial->extinfo_count); i++) {
+
+		if (i >= EXTINFO_MAX_COUNT)
+			break;
+
+		p = &serial->extinfos[i];
+		if (be32_to_cpu(p->type) == EXTINFO_TYPE_EXTDEV &&
+		    be32_to_cpu(p->u.extdev.type) == EXTDEV_TYPE_BUNDLE) {
+			int size;
+
+			size = sizeof (p->u.extdev.serial);
+			p->u.extdev.serial[size - 1] = 0;
+		}
+	}
+}
+
+/*
+ * called from  arch code early  in the boot sequence.   This function
+ * returns 1  in case serial infos are  invalid/unreadable and default
+ * values have been used.
+ */
+int __init
+fbxserialinfo_read(const void *data, struct fbx_serial *out)
+{
+	uint32_t sum;
+
+	/*
+	 * get partial serial data from flash/whatever.
+	 */
+	memcpy(out, data, sizeof (*out));
+
+	/* check magic first */
+	if (be32_to_cpu(out->magic) != FBXSERIAL_MAGIC) {
+		printk(KERN_NOTICE PFX "invalid magic (%08x, expected %08x), "
+			"using defaults !\n", be32_to_cpu(out->magic),
+		       FBXSERIAL_MAGIC);
+		goto out_default;
+	}
+
+	/* fetch size for which we have to check CRC */
+	if (be32_to_cpu(out->len) > FBXSERIAL_MAX_SIZE) {
+		printk(KERN_NOTICE PFX "structure size too big (%d), "
+		       "using defaults !\n", be32_to_cpu(out->len));
+		goto out_default;
+	}
+
+	/* compute and check checksum */
+	sum = crc32(0, data + 4, be32_to_cpu(out->len) - 4);
+
+	if (be32_to_cpu(out->crc32) != sum) {
+		printk(KERN_NOTICE PFX "invalid checksum (%08x, "
+		       "expected %08x), using defaults !\n", sum,
+		       be32_to_cpu(out->crc32));
+		goto out_default;
+	}
+
+	printk(KERN_INFO PFX "Found valid serial infos !\n");
+	bundle_fixup(out);
+	return 0;
+
+ out_default:
+	fbxserialinfo_use_default(out);
+	bundle_fixup(out);
+	return 1;
+}
+
+void
+fbxserialinfo_get_random(unsigned char *data, unsigned int len)
+{
+	const struct fbx_serial *s;
+
+	memset(data, 0, 6);
+	s = arch_get_fbxserial();
+	if (WARN(!s, "arch_get_fbxserial returned NULL"))
+		return;
+
+	if (len > sizeof (s->random_data))
+		len = sizeof (s->random_data);
+
+	memcpy(data, s->random_data, len);
+}
+EXPORT_SYMBOL(fbxserialinfo_get_random);
+
+static u8 *mac_table;
+
+static void inc_mac(u8 *mac, int count)
+{
+	int index = 5;
+	int overflow;
+
+	do {
+		unsigned int val = mac[index] + count;
+
+		overflow = val >> 8;
+		mac[index] = val;
+		count = (count + 255) >> 8;
+		--index;
+	} while (index >= 0 && overflow);
+}
+
+static int gen_mac_table(const struct fbx_serial *s)
+{
+	int i;
+
+	mac_table = kmalloc(6 * s->mac_count, GFP_KERNEL);
+	if (!mac_table)
+		return -ENOMEM;
+
+	for (i = 0; i < s->mac_count; ++i) {
+		u8 *mac = &mac_table[6 * i];
+
+		memcpy(mac, s->mac_addr_base, 6);
+		inc_mac(mac, i);
+	}
+	return 0;
+}
+
+const void *
+fbxserialinfo_get_mac_addr(unsigned int index)
+{
+	const struct fbx_serial *s;
+
+	s = arch_get_fbxserial();
+
+	if (!s) {
+		pr_warn(PFX "no serial available: using default.\n");
+		goto default_mac;
+	}
+
+	if (index >= s->mac_count) {
+		pr_warn(PFX "mac index %d too high: using default.\n",
+			index);
+		goto default_mac;
+	}
+
+	if (!mac_table) {
+		int error = gen_mac_table(s);
+		if (error) {
+			pr_err(PFX "gen_mac_table() failed: using default.\n");
+			goto default_mac;
+		}
+	}
+
+	return &mac_table[6 * index];
+
+default_mac:
+	 return "\x00\x07\xcb\x00\x00\xfd";
+}
+EXPORT_SYMBOL(fbxserialinfo_get_mac_addr);
diff -Nruw linux-5.4.60-fbx/net/fbxatm./crc10.c linux-5.4.60-fbx/net/fbxatm/crc10.c
--- linux-5.4.60-fbx/net/fbxatm./crc10.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxatm/crc10.c	2021-03-04 13:21:01.410839051 +0100
@@ -0,0 +1,48 @@
+#include <linux/types.h>
+
+static const u16 crc10_table[256] = {
+	0x0000, 0x0233, 0x0255, 0x0066, 0x0299, 0x00aa, 0x00cc, 0x02ff,
+	0x0301, 0x0132, 0x0154, 0x0367, 0x0198, 0x03ab, 0x03cd, 0x01fe,
+	0x0031, 0x0202, 0x0264, 0x0057, 0x02a8, 0x009b, 0x00fd, 0x02ce,
+	0x0330, 0x0103, 0x0165, 0x0356, 0x01a9, 0x039a, 0x03fc, 0x01cf,
+	0x0062, 0x0251, 0x0237, 0x0004, 0x02fb, 0x00c8, 0x00ae, 0x029d,
+	0x0363, 0x0150, 0x0136, 0x0305, 0x01fa, 0x03c9, 0x03af, 0x019c,
+	0x0053, 0x0260, 0x0206, 0x0035, 0x02ca, 0x00f9, 0x009f, 0x02ac,
+	0x0352, 0x0161, 0x0107, 0x0334, 0x01cb, 0x03f8, 0x039e, 0x01ad,
+	0x00c4, 0x02f7, 0x0291, 0x00a2, 0x025d, 0x006e, 0x0008, 0x023b,
+	0x03c5, 0x01f6, 0x0190, 0x03a3, 0x015c, 0x036f, 0x0309, 0x013a,
+	0x00f5, 0x02c6, 0x02a0, 0x0093, 0x026c, 0x005f, 0x0039, 0x020a,
+	0x03f4, 0x01c7, 0x01a1, 0x0392, 0x016d, 0x035e, 0x0338, 0x010b,
+	0x00a6, 0x0295, 0x02f3, 0x00c0, 0x023f, 0x000c, 0x006a, 0x0259,
+	0x03a7, 0x0194, 0x01f2, 0x03c1, 0x013e, 0x030d, 0x036b, 0x0158,
+	0x0097, 0x02a4, 0x02c2, 0x00f1, 0x020e, 0x003d, 0x005b, 0x0268,
+	0x0396, 0x01a5, 0x01c3, 0x03f0, 0x010f, 0x033c, 0x035a, 0x0169,
+	0x0188, 0x03bb, 0x03dd, 0x01ee, 0x0311, 0x0122, 0x0144, 0x0377,
+	0x0289, 0x00ba, 0x00dc, 0x02ef, 0x0010, 0x0223, 0x0245, 0x0076,
+	0x01b9, 0x038a, 0x03ec, 0x01df, 0x0320, 0x0113, 0x0175, 0x0346,
+	0x02b8, 0x008b, 0x00ed, 0x02de, 0x0021, 0x0212, 0x0274, 0x0047,
+	0x01ea, 0x03d9, 0x03bf, 0x018c, 0x0373, 0x0140, 0x0126, 0x0315,
+	0x02eb, 0x00d8, 0x00be, 0x028d, 0x0072, 0x0241, 0x0227, 0x0014,
+	0x01db, 0x03e8, 0x038e, 0x01bd, 0x0342, 0x0171, 0x0117, 0x0324,
+	0x02da, 0x00e9, 0x008f, 0x02bc, 0x0043, 0x0270, 0x0216, 0x0025,
+	0x014c, 0x037f, 0x0319, 0x012a, 0x03d5, 0x01e6, 0x0180, 0x03b3,
+	0x024d, 0x007e, 0x0018, 0x022b, 0x00d4, 0x02e7, 0x0281, 0x00b2,
+	0x017d, 0x034e, 0x0328, 0x011b, 0x03e4, 0x01d7, 0x01b1, 0x0382,
+	0x027c, 0x004f, 0x0029, 0x021a, 0x00e5, 0x02d6, 0x02b0, 0x0083,
+	0x012e, 0x031d, 0x037b, 0x0148, 0x03b7, 0x0184, 0x01e2, 0x03d1,
+	0x022f, 0x001c, 0x007a, 0x0249, 0x00b6, 0x0285, 0x02e3, 0x00d0,
+	0x011f, 0x032c, 0x034a, 0x0179, 0x0386, 0x01b5, 0x01d3, 0x03e0,
+	0x021e, 0x002d, 0x004b, 0x0278, 0x0087, 0x02b4, 0x02d2, 0x00e1,
+};
+
+static u16 crc10_byte(u16 crc, const u8 c)
+{
+	return ((crc << 8) & 0x3ff) ^ crc10_table[(crc >> 2) & 0xff] ^ c;
+}
+
+u16 crc10(u16 crc, const u8 *buffer, size_t len)
+{
+	while (len--)
+		crc = crc10_byte(crc, *buffer++);
+	return crc;
+}
diff -Nruw linux-5.4.60-fbx/net/fbxatm./fbxatm_2684.c linux-5.4.60-fbx/net/fbxatm/fbxatm_2684.c
--- linux-5.4.60-fbx/net/fbxatm./fbxatm_2684.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxatm/fbxatm_2684.c	2021-03-04 13:21:01.410839051 +0100
@@ -0,0 +1,852 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/spinlock.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+#include <linux/rtnetlink.h>
+#include <linux/pkt_sched.h>
+#include <linux/net.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/udp.h>
+#include <linux/icmp.h>
+#include <linux/proc_fs.h>
+#include <net/ip.h>
+#include <net/route.h>
+#include <linux/fbxatm_dev.h>
+
+#include "fbxatm_priv.h"
+
+#define PFX	"fbxatm_2684: "
+
+static LIST_HEAD(fbxatm_2684_dev_list);
+static DEFINE_MUTEX(fbxatm_2684_mutex);
+
+#define LLC_NEEDED_HEADROOM		10
+#define VCMUX_BRIDGED_NEEDED_HEADROOM	2
+
+#define LLC			0xaa, 0xaa, 0x03
+#define SNAP_BRIDGED		0x00, 0x80, 0xc2
+#define SNAP_ROUTED		0x00, 0x00, 0x00
+#define PID_ETHERNET_NOFCS	0x00, 0x07
+
+static u8 llc_bridged_802d3_pad[] = { LLC, SNAP_BRIDGED, PID_ETHERNET_NOFCS,
+				      0, 0 };
+static u8 llc_snap_routed[] = { LLC, SNAP_ROUTED };
+
+/*
+ * private data for 2684 vcc
+ */
+struct fbxatm_2684_vcc;
+
+struct fbxatm_2684_queue {
+	struct fbxatm_vcc		*vcc;
+	unsigned int			queue_idx;
+	struct fbxatm_2684_vcc		*priv;
+};
+
+struct fbxatm_2684_vcc {
+	struct fbxatm_2684_queue	queues[FBXATM_2684_MAX_VCC];
+	size_t				queue_count;
+
+	struct net_device		*dev;
+	struct fbxatm_2684_vcc_params	params;
+
+	spinlock_t			tx_lock;
+
+	struct rtnl_link_stats64	stats;
+
+	struct list_head		next;
+};
+
+static uint32_t tel_last_ip;
+
+static void warn_if_tel(struct fbxatm_2684_vcc *vcc, struct sk_buff *skb)
+{
+	struct iphdr *iph;
+	struct udphdr *udph = NULL;
+
+	iph = (struct iphdr *)skb->data;
+
+	if (iph->protocol != IPPROTO_UDP)
+		return;
+
+	if (skb_headlen(skb) < (iph->ihl * 4) + sizeof (struct udphdr))
+		return;
+
+	udph = (struct udphdr *)((unsigned char *)iph + (iph->ihl * 4));
+	if (ntohs(udph->dest) >= 5004 && ntohs(udph->dest) <= 5020) {
+		static u32 last_ip;
+		static unsigned long last_time;
+		unsigned long now;
+
+		now = jiffies;
+		if ((last_ip == iph->saddr &&
+		     (!last_time || time_before(now, last_time + 2 * HZ)))) {
+			static unsigned int consecutive;
+			consecutive++;
+			if (consecutive > 5) {
+				tel_last_ip = iph->saddr;
+				consecutive = 0;
+			}
+		}
+
+		last_time = now;
+		last_ip = iph->saddr;
+	}
+}
+
+/*
+ * procfs read callback
+ */
+static int tel_proc_show(struct seq_file *m, void *v)
+{
+	seq_printf(m, "%pI4\n", &tel_last_ip);
+	return 0;
+}
+
+static ssize_t tel_proc_write(struct file *file, const char __user *ubuf,
+			      size_t len, loff_t *off)
+{
+	tel_last_ip = 0;
+	return len;
+}
+
+static int tel_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, tel_proc_show, PDE_DATA(inode));
+}
+
+static const struct file_operations tel_proc_fops = {
+	.owner          = THIS_MODULE,
+	.open           = tel_proc_open,
+	.read           = seq_read,
+	.write		= tel_proc_write,
+	.llseek         = seq_lseek,
+	.release        = single_release,
+};
+
+/*
+ * fbxatm stack receive callback, called from softirq
+ */
+static void vcc_rx_callback(struct sk_buff *skb, void *data)
+{
+	struct fbxatm_2684_queue *queue;
+	struct fbxatm_2684_vcc *priv;
+
+	queue = (struct fbxatm_2684_queue *)data;
+	priv = queue->priv;
+
+	switch (priv->params.encap) {
+	case FBXATM_E2684_VCMUX:
+		switch (priv->params.payload) {
+		case FBXATM_P2684_BRIDGE:
+			/* assume 802.3, need to remove 2 bytes zero
+			 * padding */
+			if (skb->len < 2 || memcmp(skb->data, "\0\0", 2))
+				goto drop;
+			skb_pull(skb, 2);
+			skb->protocol = eth_type_trans(skb, priv->dev);
+			memset(skb->data, 0, 2);
+			break;
+
+		case FBXATM_P2684_ROUTED:
+			/* kludge to detect ipv6 or ipv4 */
+			if (skb->len && (skb->data[0] & 0xf0) == 0x60)
+				skb->protocol = htons(ETH_P_IPV6);
+			else
+				skb->protocol = htons(ETH_P_IP);
+			skb_reset_mac_header(skb);
+			break;
+		}
+		break;
+
+	case FBXATM_E2684_LLC:
+		switch (priv->params.payload) {
+		case FBXATM_P2684_BRIDGE:
+		{
+			/* recognize only 802.3 */
+			if (skb->len < sizeof(llc_bridged_802d3_pad))
+				goto drop;
+
+			if (memcmp(skb->data, llc_bridged_802d3_pad, 7))
+				goto drop;
+
+			/* don't check the last bytes of pid, it can
+			 * be 1 or 7 depending on the presence of
+			 * FCS */
+			skb_pull(skb, sizeof(llc_bridged_802d3_pad));
+			skb->protocol = eth_type_trans(skb, priv->dev);
+			break;
+		}
+
+		case FBXATM_P2684_ROUTED:
+		{
+			u16 proto;
+			unsigned int offset;
+
+			if (skb->len < sizeof(llc_snap_routed) + 2)
+				goto drop;
+
+			offset = sizeof (llc_snap_routed);
+			proto = skb->data[offset] << 8;
+			proto |= skb->data[offset + 1];
+
+			skb->protocol = proto;
+			skb_pull(skb, sizeof(llc_snap_routed) + 2);
+			skb_reset_mac_header(skb);
+			break;
+		}
+		}
+		break;
+	}
+
+	skb->dev = priv->dev;
+	skb->pkt_type = PACKET_HOST;
+	priv->stats.rx_bytes += skb->len;
+	priv->stats.rx_packets++;
+
+	if (priv->params.encap == FBXATM_E2684_VCMUX &&
+	    priv->params.payload == FBXATM_P2684_ROUTED &&
+	    queue->vcc->vpi == 8 && queue->vcc->vci == 35)
+		warn_if_tel(priv, skb);
+
+	netif_rx(skb);
+	return;
+
+drop:
+	priv->stats.rx_errors++;
+	dev_kfree_skb(skb);
+}
+
+/*
+ * fbxatm stack tx done callback, called from softirq
+ */
+static void vcc_tx_done_callback(void *data)
+{
+	struct fbxatm_2684_queue *queue;
+	struct fbxatm_2684_vcc *priv;
+
+	queue = (struct fbxatm_2684_queue *)data;
+	priv = queue->priv;
+
+	spin_lock(&priv->tx_lock);
+	if (__netif_subqueue_stopped(priv->dev, queue->queue_idx))
+		netif_wake_subqueue(priv->dev, queue->queue_idx);
+	spin_unlock(&priv->tx_lock);
+}
+
+/*
+ * fbxatm stack callback when vcc link changes
+ */
+static void vcc_link_change(void *data, int link,
+			    unsigned int rx_cell_rate,
+			    unsigned int tx_cell_rate)
+{
+	struct fbxatm_2684_queue *queue;
+	struct fbxatm_2684_vcc *priv;
+
+	queue = (struct fbxatm_2684_queue *)data;
+	priv = queue->priv;
+
+	if (link)
+		netif_carrier_on(priv->dev);
+	else
+		netif_carrier_off(priv->dev);
+}
+
+/*
+ * vcc user ops, callback from fbxatm stack
+ */
+static const struct fbxatm_vcc_uops fbxatm_2684_uops = {
+	.link_change	= vcc_link_change,
+	.rx_pkt		= vcc_rx_callback,
+	.tx_done	= vcc_tx_done_callback,
+};
+
+/*
+ * netdevice ->ndo_select_queue() callback
+ */
+static u16 fbxatm_2684_netdev_select_queue(struct net_device *dev,
+					   struct sk_buff *skb,
+					   struct net_device *sb_dev)
+{
+	/* force lower band to avoid kernel doing round robin */
+	return 0;
+}
+
+/*
+ * netdevice xmit callback
+ */
+static int fbxatm_2684_netdev_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	struct fbxatm_2684_vcc *priv;
+	int ret, queue_idx;
+	unsigned int needed_headroom;
+	struct fbxatm_2684_queue *queue;
+	unsigned int len;
+
+	priv = netdev_priv(dev);
+	queue_idx = skb_get_queue_mapping(skb);
+	queue = &priv->queues[queue_idx];
+
+	/*
+	 * check if we have to expand skb head
+	 */
+	needed_headroom = 0;
+	if (priv->params.encap == FBXATM_E2684_VCMUX) {
+		if (priv->params.payload == FBXATM_P2684_BRIDGE)
+			needed_headroom = VCMUX_BRIDGED_NEEDED_HEADROOM;
+	} else
+		needed_headroom = LLC_NEEDED_HEADROOM;
+
+	if (skb_headroom(skb) < needed_headroom) {
+		struct sk_buff *nskb;
+		unsigned int new_head;
+
+		new_head = skb_headroom(skb) + needed_headroom;
+		nskb = skb_realloc_headroom(skb, new_head);
+		dev_kfree_skb(skb);
+		if (!nskb)
+			goto dropped;
+		skb = nskb;
+	}
+
+	switch (priv->params.encap) {
+	case FBXATM_E2684_VCMUX:
+		switch (priv->params.payload) {
+		case FBXATM_P2684_BRIDGE:
+			skb_push(skb, 2);
+			memset(skb->data, 0, 2);
+			break;
+		case FBXATM_P2684_ROUTED:
+			/* nothing to do */
+			break;
+		}
+		break;
+
+	case FBXATM_E2684_LLC:
+		switch (priv->params.payload) {
+		case FBXATM_P2684_BRIDGE:
+			skb_push(skb, sizeof(llc_bridged_802d3_pad));
+			memcpy(skb->data, llc_bridged_802d3_pad,
+			       sizeof(llc_bridged_802d3_pad));
+			break;
+
+		case FBXATM_P2684_ROUTED:
+		{
+			unsigned int offset;
+
+			skb_push(skb, sizeof(llc_snap_routed));
+			memcpy(skb->data, llc_snap_routed,
+			       sizeof(llc_snap_routed));
+
+			offset = sizeof (llc_snap_routed);
+			skb->data[offset] = (skb->protocol >> 8) & 0xff;
+			skb->data[offset + 1] = skb->protocol & 0xff;
+			break;
+		}
+		}
+		break;
+	}
+
+	spin_lock(&priv->tx_lock);
+
+	len = skb->len;
+	ret = fbxatm_send(queue->vcc, skb);
+	if (ret) {
+		/* packet was not sent, queue is full */
+		netif_stop_subqueue(dev, queue_idx);
+		spin_unlock(&priv->tx_lock);
+		WARN_ONCE(1, "fbxatm2684_xmit called with full queue");
+		priv->stats.tx_errors++;
+		dev_kfree_skb(skb);
+		return NETDEV_TX_OK;
+	}
+
+	priv->stats.tx_bytes += len;
+	priv->stats.tx_packets++;
+
+	/* check if queue is full */
+	if (fbxatm_vcc_queue_full(queue->vcc))
+		netif_stop_subqueue(dev, queue_idx);
+	spin_unlock(&priv->tx_lock);
+
+	return NETDEV_TX_OK;
+
+dropped:
+	priv->stats.tx_errors++;
+	return NETDEV_TX_OK;
+}
+
+/*
+ * netdevice get_stats callback
+ */
+static void
+fbxatm_2684_netdev_get_stats64(struct net_device *dev,
+			       struct rtnl_link_stats64 *stats)
+{
+	struct fbxatm_2684_vcc *priv;
+	priv = netdev_priv(dev);
+	memcpy(stats, &priv->stats, sizeof (*stats));
+}
+
+/*
+ * netdevice setup callback for bridge encap
+ */
+static void setup_bridged(struct net_device *dev)
+{
+	ether_setup(dev);
+}
+
+/*
+ * netdevice setup callback for routed encap
+ */
+static void setup_routed(struct net_device *dev)
+{
+	dev->type		= ARPHRD_PPP;
+	dev->hard_header_len	= 0;
+	dev->mtu		= 1500;
+	dev->addr_len		= 0;
+	dev->tx_queue_len	= 128;
+	dev->flags		= IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
+}
+
+static const struct net_device_ops fbxatm_2684_ops = {
+	.ndo_start_xmit		= fbxatm_2684_netdev_xmit,
+	.ndo_get_stats64	= fbxatm_2684_netdev_get_stats64,
+	.ndo_select_queue	= fbxatm_2684_netdev_select_queue,
+};
+
+/*
+ * sysfs callback, show encapsulation
+ */
+static ssize_t show_encap(struct device *d,
+			  struct device_attribute *attr, char *buf)
+{
+	struct fbxatm_2684_vcc *priv = netdev_priv(to_net_dev(d));
+
+	switch (priv->params.encap) {
+	case FBXATM_E2684_LLC:
+		return sprintf(buf, "llc\n");
+	case FBXATM_E2684_VCMUX:
+	default:
+		return sprintf(buf, "vcmux\n");
+	}
+}
+
+static DEVICE_ATTR(encap, S_IRUGO, show_encap, NULL);
+
+/*
+ * sysfs callback, show payload
+ */
+static ssize_t show_payload(struct device *d,
+			    struct device_attribute *attr, char *buf)
+{
+	struct fbxatm_2684_vcc *priv = netdev_priv(to_net_dev(d));
+
+	switch (priv->params.payload) {
+	case FBXATM_P2684_BRIDGE:
+		return sprintf(buf, "bridge\n");
+	case FBXATM_P2684_ROUTED:
+	default:
+		return sprintf(buf, "routed\n");
+	}
+}
+
+static DEVICE_ATTR(payload, S_IRUGO, show_payload, NULL);
+
+/*
+ * sysfs callback, show vcc id
+ */
+static ssize_t show_vcc(struct device *d,
+			struct device_attribute *attr, char *buf)
+{
+	struct fbxatm_2684_vcc *priv = netdev_priv(to_net_dev(d));
+
+	return sprintf(buf, "%u.%u.%u\n",
+		       priv->queues[0].vcc->adev->ifindex,
+		       priv->queues[0].vcc->vpi, priv->queues[0].vcc->vci);
+}
+
+static DEVICE_ATTR(vcc, S_IRUGO, show_vcc, NULL);
+
+static struct attribute *fbxatm2684_attrs[] = {
+	&dev_attr_encap.attr,
+	&dev_attr_payload.attr,
+	&dev_attr_vcc.attr,
+	NULL
+};
+
+static struct attribute_group fbxatm2684_group = {
+	.name = "fbxatm2684",
+	.attrs = fbxatm2684_attrs,
+};
+
+/*
+ * create sysfs files for 2684 device
+ */
+static int vcc2684_sysfs_register(struct fbxatm_2684_vcc *priv,
+				  struct net_device *dev)
+{
+	int ret;
+
+	ret = sysfs_create_group(&dev->dev.kobj, &fbxatm2684_group);
+	if (ret)
+		goto out1;
+
+	ret = sysfs_create_link(&dev->dev.kobj,
+				&priv->queues[0].vcc->adev->dev.kobj,
+				"fbxatm_dev");
+	if (ret)
+		goto out2;
+
+	return 0;
+
+out2:
+	sysfs_remove_group(&dev->dev.kobj, &fbxatm2684_group);
+out1:
+	return ret;
+}
+
+/*
+ * remove sysfs files for 2684 device
+ */
+static void vcc2684_sysfs_unregister(struct fbxatm_2684_vcc *priv,
+				     struct net_device *dev)
+{
+	sysfs_remove_group(&dev->dev.kobj, &fbxatm2684_group);
+	sysfs_remove_link(&dev->dev.kobj, "fbxatm_dev");
+}
+
+/*
+ * register netdevice & sysfs attribute
+ */
+static int register_2684_netdev(struct fbxatm_2684_vcc *priv,
+				struct net_device *dev)
+{
+	int ret;
+
+	/* hold rtnl while registering netdevice and creating sysfs
+	 * files to avoid race */
+	rtnl_lock();
+
+	if (strchr(dev->name, '%')) {
+		ret = dev_alloc_name(dev, dev->name);
+		if (ret < 0)
+			goto out;
+	}
+
+	ret = register_netdevice(dev);
+	if (ret)
+		goto out;
+
+	ret = vcc2684_sysfs_register(priv, dev);
+	if (ret)
+		goto out_unregister;
+
+	rtnl_unlock();
+	return 0;
+
+out_unregister:
+	unregister_netdevice(dev);
+
+out:
+	rtnl_unlock();
+	return ret;
+}
+
+/*
+ * create a RFC2684 encapsulation on given vcc
+ */
+static int __create_2684_vcc(const struct fbxatm_2684_vcc_params *params)
+{
+	struct fbxatm_2684_vcc *priv;
+	struct fbxatm_vcc *vccs[FBXATM_2684_MAX_VCC];
+	struct net_device *dev = NULL;
+	void (*netdev_setup_cb)(struct net_device *dev);
+	unsigned int headroom;
+	size_t i;
+	int ret;
+
+	/* sanity check */
+	switch (params->encap) {
+	case FBXATM_E2684_VCMUX:
+	case FBXATM_E2684_LLC:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	switch (params->payload) {
+	case FBXATM_P2684_BRIDGE:
+		netdev_setup_cb = setup_bridged;
+		break;
+	case FBXATM_P2684_ROUTED:
+		netdev_setup_cb = setup_routed;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (!params->dev_name[0])
+		return -EINVAL;
+
+	/* bind to vcc */
+	memset(vccs, 0, sizeof (vccs));
+	for (i = 0; i < params->id_count; i++) {
+		struct fbxatm_vcc *vcc;
+
+		vcc = fbxatm_bind_to_vcc(&params->id_list[i],
+					 FBXATM_VCC_USER_2684);
+		if (IS_ERR(vcc)) {
+			ret = PTR_ERR(vcc);
+			goto fail;
+		}
+		vccs[i] = vcc;
+	}
+
+	/* create netdevice */
+	dev = alloc_netdev_mqs(sizeof(*priv), params->dev_name,
+			       NET_NAME_UNKNOWN, netdev_setup_cb,
+			       params->id_count, 1);
+	if (!dev) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	netif_set_real_num_tx_queues(dev, params->id_count);
+	netif_set_real_num_rx_queues(dev, 1);
+
+	priv = netdev_priv(dev);
+	memset(priv, 0, sizeof (*priv));
+	memcpy(&priv->params, params, sizeof (*params));
+	memcpy(dev->name, priv->params.dev_name, IFNAMSIZ);
+
+	spin_lock_init(&priv->tx_lock);
+	priv->dev = dev;
+	for (i = 0; i < params->id_count; i++) {
+		priv->queues[i].vcc = vccs[i];
+		priv->queues[i].queue_idx = i;
+		priv->queues[i].priv = priv;
+	}
+	priv->queue_count = params->id_count;
+
+	if (!is_zero_ether_addr(params->perm_addr))
+		memcpy(dev->perm_addr, params->perm_addr, 6);
+
+	dev->netdev_ops = &fbxatm_2684_ops;
+
+	/* make sure kernel generated packet have correct headroom for
+	 * encapsulation/payload */
+	headroom = 0;
+	for (i = 0; i < params->id_count; i++)
+		headroom = max_t(int, headroom, vccs[i]->adev->tx_headroom);
+	dev->hard_header_len += headroom;
+
+
+	switch (params->encap) {
+	case FBXATM_E2684_VCMUX:
+	default:
+		if (params->payload == FBXATM_P2684_BRIDGE)
+			dev->hard_header_len += VCMUX_BRIDGED_NEEDED_HEADROOM;
+		break;
+	case FBXATM_E2684_LLC:
+		dev->hard_header_len += LLC_NEEDED_HEADROOM;
+		break;
+	}
+
+	ret = register_2684_netdev(priv, dev);
+	if (ret)
+		goto fail;
+
+	if (fbxatm_vcc_link_is_up(vccs[0])) {
+		netif_carrier_on(dev);
+		netif_tx_start_all_queues(dev);
+	} else
+		netif_carrier_off(dev);
+	list_add_tail(&priv->next, &fbxatm_2684_dev_list);
+
+	for (i = 0; i < params->id_count; i++)
+		fbxatm_set_uops(vccs[i], &fbxatm_2684_uops, &priv->queues[i]);
+
+	return 0;
+
+fail:
+	for (i = 0; i < ARRAY_SIZE(vccs); i++) {
+		if (vccs[i])
+			fbxatm_unbind_vcc(vccs[i]);
+	}
+	if (dev)
+		free_netdev(dev);
+	return ret;
+}
+
+/*
+ * find 2684 vcc from id list
+ */
+static struct fbxatm_2684_vcc *__find_2684_vcc(const struct fbxatm_vcc_id *id,
+					       size_t count)
+{
+	struct fbxatm_2684_vcc *priv;
+	size_t i;
+
+	/* find it */
+	list_for_each_entry(priv, &fbxatm_2684_dev_list, next) {
+		for (i = 0; i < priv->queue_count; i++) {
+			struct fbxatm_2684_queue *q;
+			size_t j;
+
+			q = &priv->queues[i];
+
+			for (j = 0; j < count; j++) {
+				if (q->vcc->adev->ifindex == id[j].dev_idx &&
+				    q->vcc->vpi == id[0].vpi &&
+				    q->vcc->vci == id[0].vci)
+					return priv;
+			}
+		}
+	}
+	return NULL;
+}
+
+/*
+ * create a RFC2684 encapsulation on given vcc
+ */
+static int create_2684_vcc(const struct fbxatm_2684_vcc_params *params)
+{
+	int ret;
+
+	mutex_lock(&fbxatm_2684_mutex);
+	ret = __create_2684_vcc(params);
+	mutex_unlock(&fbxatm_2684_mutex);
+	return ret;
+}
+
+/*
+ * remove RFC2684 encapsulation from given vcc
+ */
+static int __remove_2684_vcc(const struct fbxatm_2684_vcc_params *params)
+{
+	struct fbxatm_2684_vcc *priv;
+	size_t i;
+
+	priv = __find_2684_vcc(params->id_list, params->id_count);
+	if (!priv)
+		return -ENOENT;
+
+	/* close netdevice, fbxatm_2684_netdev_xmit cannot be called
+	 * again */
+	rtnl_lock();
+	dev_close(priv->dev);
+	rtnl_unlock();
+
+	for (i = 0; i < priv->queue_count; i++)
+		fbxatm_unbind_vcc(priv->queues[i].vcc);
+	vcc2684_sysfs_unregister(priv, priv->dev);
+	unregister_netdev(priv->dev);
+	list_del(&priv->next);
+	free_netdev(priv->dev);
+	return 0;
+}
+
+/*
+ * remove RFC2684 encapsulation from given vcc
+ */
+static int remove_2684_vcc(const struct fbxatm_2684_vcc_params *params)
+{
+	int ret;
+
+	mutex_lock(&fbxatm_2684_mutex);
+	ret = __remove_2684_vcc(params);
+	mutex_unlock(&fbxatm_2684_mutex);
+	return ret;
+}
+
+/*
+ * 2684 related ioctl handler
+ */
+static int fbxatm_2684_ioctl(struct socket *sock,
+			     unsigned int cmd, void __user *useraddr)
+{
+	int ret;
+
+	ret = 0;
+
+	switch (cmd) {
+	case FBXATM_2684_IOCADD:
+	case FBXATM_2684_IOCDEL:
+	{
+		struct fbxatm_2684_vcc_params params;
+
+		if (copy_from_user(&params, useraddr, sizeof(params)))
+			return -EFAULT;
+
+		if (cmd == FBXATM_2684_IOCADD)
+			ret = create_2684_vcc(&params);
+		else
+			ret = remove_2684_vcc(&params);
+		break;
+	}
+
+	case FBXATM_2684_IOCGET:
+	{
+		struct fbxatm_2684_vcc_params params;
+		struct fbxatm_2684_vcc *priv;
+
+		if (copy_from_user(&params, useraddr, sizeof(params)))
+			return -EFAULT;
+
+		mutex_lock(&fbxatm_2684_mutex);
+		priv = __find_2684_vcc(params.id_list, params.id_count);
+		if (!priv)
+			ret = -ENOENT;
+		else {
+			memcpy(&params, &priv->params, sizeof (params));
+			memcpy(params.dev_name, priv->dev->name, IFNAMSIZ);
+		}
+		mutex_unlock(&fbxatm_2684_mutex);
+
+		if (ret)
+			return ret;
+
+		if (copy_to_user(useraddr, &params, sizeof(params)))
+			return -EFAULT;
+		break;
+	}
+
+	default:
+		return -ENOIOCTLCMD;
+	}
+
+	return ret;
+}
+
+static struct fbxatm_ioctl fbxatm_2684_ioctl_ops = {
+	.handler	= fbxatm_2684_ioctl,
+	.owner		= THIS_MODULE,
+};
+
+int __init fbxatm_2684_init(void)
+{
+	struct proc_dir_entry *root, *proc;
+
+	root = fbxatm_proc_misc_register("tel");
+	if (!root)
+		return -ENOMEM;
+
+	/* tel debug crap */
+	proc = proc_create_data("bad_ip", 0666, root, &tel_proc_fops, NULL);
+	if (!proc)
+		return -ENOMEM;
+
+	fbxatm_register_ioctl(&fbxatm_2684_ioctl_ops);
+	return 0;
+}
+
+void fbxatm_2684_exit(void)
+{
+	fbxatm_unregister_ioctl(&fbxatm_2684_ioctl_ops);
+}
diff -Nruw linux-5.4.60-fbx/net/fbxatm./fbxatm_core.c linux-5.4.60-fbx/net/fbxatm/fbxatm_core.c
--- linux-5.4.60-fbx/net/fbxatm./fbxatm_core.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxatm/fbxatm_core.c	2021-03-04 13:21:01.410839051 +0100
@@ -0,0 +1,206 @@
+#include <linux/init.h>
+#include <linux/net.h>
+#include <linux/socket.h>
+#include <linux/fbxatm.h>
+#include <linux/fbxatm_dev.h>
+#include <linux/module.h>
+#include <net/sock.h>
+#include "fbxatm_priv.h"
+
+static DEFINE_MUTEX(ioctl_mutex);
+static LIST_HEAD(ioctl_list);
+
+void fbxatm_register_ioctl(struct fbxatm_ioctl *ioctl)
+{
+	mutex_lock(&ioctl_mutex);
+	list_add_tail(&ioctl->next, &ioctl_list);
+	mutex_unlock(&ioctl_mutex);
+}
+
+void fbxatm_unregister_ioctl(struct fbxatm_ioctl *ioctl)
+{
+	mutex_lock(&ioctl_mutex);
+	list_del(&ioctl->next);
+	mutex_unlock(&ioctl_mutex);
+}
+
+static int fbxatm_sock_ioctl(struct socket *sock, unsigned int cmd,
+			     unsigned long arg)
+{
+	struct fbxatm_ioctl *ioctl;
+	void __user *useraddr;
+	int ret;
+
+	/* sanity check */
+	useraddr = (void __user *)arg;
+
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+
+	ret = -ENOIOCTLCMD;
+	mutex_lock(&ioctl_mutex);
+
+	list_for_each_entry(ioctl, &ioctl_list, next) {
+		if (!ioctl->handler)
+			continue;
+
+		if (!try_module_get(ioctl->owner))
+			continue;
+
+		ret = ioctl->handler(sock, cmd, useraddr);
+		module_put(ioctl->owner);
+		if (ret != -ENOIOCTLCMD)
+			break;
+	}
+	mutex_unlock(&ioctl_mutex);
+
+	return ret;
+}
+
+static int fbxatm_sock_release(struct socket *sock)
+{
+	struct fbxatm_ioctl *ioctl;
+	struct sock *sk = sock->sk;
+
+	mutex_lock(&ioctl_mutex);
+
+	list_for_each_entry(ioctl, &ioctl_list, next) {
+		if (!ioctl->release)
+			continue;
+
+		if (!try_module_get(ioctl->owner))
+			continue;
+
+		ioctl->release(sock);
+		module_put(ioctl->owner);
+	}
+	mutex_unlock(&ioctl_mutex);
+
+	if (sk)
+		sock_put(sk);
+
+	return 0;
+}
+
+static const struct proto_ops fbxatm_proto_ops = {
+	.family		= PF_FBXATM,
+
+	.release =	fbxatm_sock_release,
+	.ioctl =	fbxatm_sock_ioctl,
+
+	.bind =		sock_no_bind,
+	.connect =	sock_no_connect,
+	.socketpair =	sock_no_socketpair,
+	.accept =	sock_no_accept,
+	.getname =	sock_no_getname,
+	.listen =	sock_no_listen,
+	.shutdown =	sock_no_shutdown,
+	.setsockopt =	sock_no_setsockopt,
+	.getsockopt =	sock_no_getsockopt,
+	.sendmsg =	sock_no_sendmsg,
+	.recvmsg =	sock_no_recvmsg,
+	.mmap =		sock_no_mmap,
+	.sendpage =	sock_no_sendpage,
+	.owner		= THIS_MODULE,
+};
+
+static struct proto fbxatm_proto = {
+        .name           = "fbxatm",
+        .owner          =  THIS_MODULE,
+        .obj_size       = sizeof (struct sock),
+};
+
+static int fbxatm_sock_create(struct net *net, struct socket *sock,
+			      int protocol, int kern)
+{
+	struct sock *sk;
+
+        sk = sk_alloc(net, PF_FBXATM, GFP_KERNEL, &fbxatm_proto, kern);
+	if (!sk)
+		return -ENOMEM;
+
+        sock_init_data(sock, sk);
+        sock->state = SS_UNCONNECTED;
+        sock->ops = &fbxatm_proto_ops;
+	return 0;
+}
+
+static struct net_proto_family fbxatm_family_ops = {
+	.family = PF_FBXATM,
+	.create = fbxatm_sock_create,
+	.owner = THIS_MODULE,
+};
+
+
+static int __init fbxatm_init(void)
+{
+	int ret;
+
+	printk(KERN_INFO "Freebox ATM stack\n");
+	ret = fbxatm_sysfs_init();
+	if (ret)
+		return ret;
+
+	ret = fbxatm_procfs_init();
+	if (ret)
+		goto fail_sysfs;
+
+	ret = fbxatm_vcc_init();
+	if (ret)
+		goto fail_procfs;
+
+	ret = fbxatm_2684_init();
+	if (ret)
+		goto fail_vcc;
+
+	ret = fbxatm_pppoa_init();
+	if (ret)
+		goto fail_2684;
+
+	ret = proto_register(&fbxatm_proto, 0);
+	if (ret)
+		goto fail_pppoa;
+
+	ret = sock_register(&fbxatm_family_ops);
+	if (ret)
+		goto fail_proto;
+
+	return 0;
+
+fail_proto:
+	proto_unregister(&fbxatm_proto);
+
+fail_pppoa:
+	fbxatm_pppoa_exit();
+
+fail_2684:
+	fbxatm_2684_exit();
+
+fail_vcc:
+	fbxatm_vcc_exit();
+
+fail_procfs:
+	fbxatm_procfs_exit();
+
+fail_sysfs:
+	fbxatm_sysfs_exit();
+	printk(KERN_ERR "failed to initialize Freebox ATM stack\n");
+	return ret;
+}
+
+static void __exit fbxatm_exit(void)
+{
+	sock_unregister(PF_FBXATM);
+	proto_unregister(&fbxatm_proto);
+	fbxatm_pppoa_exit();
+	fbxatm_2684_exit();
+	fbxatm_vcc_exit();
+	fbxatm_procfs_exit();
+	fbxatm_sysfs_exit();
+}
+
+subsys_initcall(fbxatm_init);
+module_exit(fbxatm_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_NETPROTO(PF_FBXATM);
diff -Nruw linux-5.4.60-fbx/net/fbxatm./fbxatm_dev.c linux-5.4.60-fbx/net/fbxatm/fbxatm_dev.c
--- linux-5.4.60-fbx/net/fbxatm./fbxatm_dev.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxatm/fbxatm_dev.c	2021-03-04 13:21:01.410839051 +0100
@@ -0,0 +1,983 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <linux/sched.h>
+#include <linux/mutex.h>
+#include <linux/bitops.h>
+#include <linux/fbxatm_dev.h>
+#include "fbxatm_priv.h"
+
+/*
+ * list of registered device & lock
+ */
+LIST_HEAD(fbxatm_dev_list);
+
+/*
+ * big "rtnl" lock
+ */
+DEFINE_MUTEX(fbxatm_mutex);
+static int fbxatm_ifindex = -1;
+
+/*
+ * find device by index
+ */
+static struct fbxatm_dev *__fbxatm_dev_get_by_index(int ifindex)
+{
+	struct fbxatm_dev *pdev;
+
+	list_for_each_entry(pdev, &fbxatm_dev_list, next) {
+		if (pdev->ifindex == ifindex)
+			return pdev;
+	}
+	return NULL;
+}
+
+/*
+ * find vcc by id
+ */
+static struct fbxatm_vcc *
+__fbxatm_vcc_get_by_id(const struct fbxatm_vcc_id *id)
+{
+	struct fbxatm_dev *adev;
+	struct fbxatm_vcc *vcc;
+	int found;
+
+	adev = __fbxatm_dev_get_by_index(id->dev_idx);
+	if (!adev)
+		return ERR_PTR(-ENODEV);
+
+	found = 0;
+	spin_lock_bh(&adev->vcc_list_lock);
+	list_for_each_entry(vcc, &adev->vcc_list, next) {
+		if (vcc->vpi != id->vpi || vcc->vci != id->vci)
+			continue;
+		found = 1;
+		break;
+	}
+	spin_unlock_bh(&adev->vcc_list_lock);
+
+	if (found)
+		return vcc;
+	return ERR_PTR(-ENOENT);
+}
+
+/*
+ * allocate device
+ */
+struct fbxatm_dev *fbxatm_alloc_device(int sizeof_priv)
+{
+	unsigned int size;
+
+	size = sizeof(struct fbxatm_dev) + sizeof_priv + FBXATMDEV_ALIGN;
+	return kzalloc(size, GFP_KERNEL);
+}
+
+EXPORT_SYMBOL(fbxatm_alloc_device);
+
+/*
+ * calculate crc10 of oam cell
+ */
+static void compute_oam_crc10(struct fbxatm_oam_cell_payload *cell)
+{
+	u8 *pdu;
+	u16 crc;
+
+	/* crc10 does not cover header */
+	pdu = (u8 *)&cell->cell_type;
+	memset(cell->crc10, 0, 2);
+
+	crc = crc10(0, pdu, sizeof (*cell) - sizeof (cell->cell_hdr));
+	cell->crc10[0] = crc >> 8;
+	cell->crc10[1] = crc & 0xff;
+}
+
+/*
+ * check crc10 of oam cell
+ */
+static int check_oam_crc10(struct fbxatm_oam_cell_payload *cell)
+{
+	u8 *pdu;
+	u16 crc;
+
+	pdu = (u8 *)&cell->cell_type;
+
+	crc = (cell->crc10[0] << 8) | cell->crc10[1];
+	memset(cell->crc10, 0, 2);
+
+	if (crc != crc10(0, pdu, sizeof (*cell) - sizeof (cell->cell_hdr)))
+		return 1;
+
+	return 0;
+}
+
+/*
+ * send an oam ping and wait for answer
+ */
+static int do_oam_ping(struct fbxatm_oam_ping *ping)
+{
+	struct fbxatm_dev *adev;
+	struct fbxatm_oam_cell *oam_cell;
+	struct fbxatm_oam_cell_payload *cell;
+	u8 *hdr;
+	int ret;
+
+	switch (ping->req.type) {
+	case FBXATM_OAM_PING_SEG_F4:
+	case FBXATM_OAM_PING_E2E_F4:
+		return -ENOTSUPP;
+	case FBXATM_OAM_PING_SEG_F5:
+	case FBXATM_OAM_PING_E2E_F5:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	/* find device */
+	mutex_lock(&fbxatm_mutex);
+	adev = __fbxatm_dev_get_by_index(ping->req.id.dev_idx);
+	if (!adev) {
+		ret = -ENODEV;
+		goto out_unlock;
+	}
+
+	/* if f5, vcc need to be opened */
+	switch (ping->req.type) {
+	case FBXATM_OAM_PING_SEG_F5:
+	case FBXATM_OAM_PING_E2E_F5:
+	{
+		struct fbxatm_vcc *vcc;
+
+		vcc = __fbxatm_vcc_get_by_id(&ping->req.id);
+		if (IS_ERR(vcc)) {
+			ret = -ENETDOWN;
+			goto out_unlock;
+		}
+		break;
+	}
+
+	default:
+		break;
+	}
+
+	ping->correlation_id = ++adev->oam_correlation_id;
+
+	/* prepare atm oam cell and send it */
+	oam_cell = kmalloc(sizeof (*oam_cell), GFP_KERNEL);
+	if (!oam_cell) {
+		ret = -ENOMEM;
+		goto out_unlock;
+	}
+	cell = &oam_cell->payload;
+
+	hdr = cell->cell_hdr;
+	ATM_SET_GFC(hdr, 0);
+
+	ATM_SET_VPI(hdr, ping->req.id.vpi);
+	ATM_SET_VCI(hdr, ping->req.id.vci);
+	if (ping->req.type == FBXATM_OAM_PING_E2E_F5)
+		ATM_SET_PT(hdr, OAM_PTI_END2END_F5);
+	else
+		ATM_SET_PT(hdr, OAM_PTI_SEG_F5);
+	ATM_SET_CLP(hdr, 0);
+	ATM_SET_HEC(hdr, 0);
+
+	cell->cell_type = (OAM_TYPE_FAULT_MANAGEMENT << OAM_TYPE_SHIFT) |
+		(FUNC_TYPE_OAM_LOOPBACK << FUNC_TYPE_SHIFT);
+	cell->loopback_indication = 1;
+
+	memcpy(cell->correlation_tag, &ping->correlation_id,
+	       sizeof (cell->correlation_tag));
+	memcpy(cell->loopback_id, ping->req.llid, sizeof (ping->req.llid));
+	memset(cell->source_id, 0x6a, sizeof (cell->source_id));
+	memset(cell->reserved, 0x6a, sizeof (cell->reserved));
+
+	compute_oam_crc10(cell);
+
+	spin_lock_bh(&adev->dev_link_lock);
+	if (!test_bit(FBXATM_DEV_F_LINK_UP, &adev->dev_flags))
+		ret = -ENETDOWN;
+	else
+		ret = adev->ops->send_oam(adev, oam_cell);
+	spin_unlock_bh(&adev->dev_link_lock);
+	if (ret)
+		goto out_unlock;
+
+	/* wait for an answer */
+	adev->stats.tx_f5_oam++;
+	list_add(&ping->next, &adev->oam_pending_ping);
+	ping->replied = 0;
+	init_waitqueue_head(&ping->wq);
+	mutex_unlock(&fbxatm_mutex);
+
+	ret = wait_event_interruptible_timeout(ping->wq, ping->replied,
+					       HZ * 5);
+	list_del(&ping->next);
+
+	if (ret == -ERESTARTSYS)
+		return ret;
+
+	if (ping->replied < 0) {
+		/* ping failed */
+		return ping->replied;
+	}
+
+	if (!ping->replied) {
+		/* timeout */
+		return -ETIME;
+	}
+
+	return 0;
+
+
+out_unlock:
+	mutex_unlock(&fbxatm_mutex);
+	return ret;
+}
+
+/*
+ * special llid values
+ */
+static const u8 llid_all1[16] = { 0xff, 0xff, 0xff, 0xff,
+				  0xff, 0xff, 0xff, 0xff,
+				  0xff, 0xff, 0xff, 0xff,
+				  0xff, 0xff, 0xff, 0xff };
+
+static const u8 llid_all0[16] = { 0 };
+
+/*
+ * handle incoming oam cell
+ */
+static void handle_oam_cell(struct fbxatm_dev *adev,
+			    struct fbxatm_oam_cell *oam_cell)
+{
+	struct fbxatm_oam_cell_payload *cell;
+	u16 vci;
+	u8 *hdr, pt, oam, func;
+
+	/* check CRC10 */
+	cell = &oam_cell->payload;
+	if (check_oam_crc10(cell)) {
+		adev->stats.rx_bad_oam++;
+		goto out;
+	}
+
+	/* drop f4 cells */
+	hdr = cell->cell_hdr;
+	vci = ATM_GET_VCI(hdr);
+
+	if (vci == OAM_VCI_SEG_F4 || vci == OAM_VCI_END2END_F4) {
+		adev->stats.rx_f4_oam++;
+		goto out;
+	}
+
+	/* keep f5 cells only */
+	pt = ATM_GET_PT(hdr);
+	if (pt != OAM_PTI_SEG_F5 && pt != OAM_PTI_END2END_F5) {
+		adev->stats.rx_other_oam++;
+		goto out;
+	}
+
+	adev->stats.rx_f5_oam++;
+
+	/* keep oam loopback type only */
+	oam = (cell->cell_type & OAM_TYPE_MASK) >> OAM_TYPE_SHIFT;
+	func = (cell->cell_type & FUNC_TYPE_MASK) >> FUNC_TYPE_SHIFT;
+
+	if (oam != OAM_TYPE_FAULT_MANAGEMENT ||
+	    func != FUNC_TYPE_OAM_LOOPBACK) {
+		adev->stats.rx_other_oam++;
+		goto out;
+	}
+
+	if (cell->loopback_indication & 1) {
+		int match, ret;
+
+		/* request, check for llid match */
+		match = 0;
+		switch (pt) {
+		case OAM_PTI_SEG_F5:
+			/* 0x0 or 0xffffffff */
+			if (!memcmp(cell->loopback_id, llid_all0,
+				    sizeof (llid_all0)))
+				match = 1;
+			/* fallthrough */
+
+		case OAM_PTI_END2END_F5:
+			/* 0xffffffff only */
+			if (!memcmp(cell->loopback_id, llid_all1,
+				    sizeof (llid_all1)))
+				match = 1;
+			break;
+		}
+
+		if (!match) {
+			adev->stats.rx_bad_llid_oam++;
+			goto out;
+		}
+
+		/* ok, update llid and answer */
+		cell->loopback_indication = 0;
+		memcpy(cell->loopback_id, llid_all1, sizeof (llid_all1));
+		compute_oam_crc10(cell);
+
+		spin_lock_bh(&adev->dev_link_lock);
+		if (!test_bit(FBXATM_DEV_F_LINK_UP, &adev->dev_flags))
+			ret = adev->ops->send_oam(adev, oam_cell);
+		else
+			ret = -ENETDOWN;
+		spin_unlock_bh(&adev->dev_link_lock);
+
+		if (!ret) {
+			/* send successful, don't free cell */
+			adev->stats.tx_f5_oam++;
+			return;
+		}
+
+	} else {
+		struct fbxatm_oam_ping *ping;
+
+		/* reply, find a matching sender */
+		spin_lock_bh(&adev->oam_list_lock);
+		list_for_each_entry(ping, &adev->oam_pending_ping, next) {
+
+			/* compare correlation id */
+			if (memcmp(&ping->correlation_id,
+				   cell->correlation_tag,
+				   sizeof (cell->correlation_tag)))
+				continue;
+
+			/* compare ping type */
+			switch (ping->req.type) {
+			case FBXATM_OAM_PING_SEG_F5:
+				if (pt != OAM_PTI_SEG_F5)
+					continue;
+				break;
+			case FBXATM_OAM_PING_E2E_F5:
+				if (pt != OAM_PTI_END2END_F5)
+					continue;
+				break;
+			default:
+				break;
+			}
+
+			/* seems we have a match */
+			ping->replied = 1;
+			wake_up(&ping->wq);
+		}
+		spin_unlock_bh(&adev->oam_list_lock);
+	}
+
+out:
+	kfree(oam_cell);
+}
+
+/*
+ * oam rx processing workqueue
+ */
+static void fbxatm_oam_work(struct work_struct *work)
+{
+	struct fbxatm_dev *adev;
+	struct fbxatm_oam_cell *cell;
+
+	adev = container_of(work, struct fbxatm_dev, oam_work);
+
+	do {
+		cell = NULL;
+		spin_lock_bh(&adev->oam_list_lock);
+		if (!list_empty(&adev->rx_oam_cells)) {
+			cell = list_first_entry(&adev->rx_oam_cells,
+						struct fbxatm_oam_cell, next);
+			list_del(&cell->next);
+			adev->rx_oam_cells_count--;
+		}
+		spin_unlock_bh(&adev->oam_list_lock);
+
+		if (cell)
+			handle_oam_cell(adev, cell);
+
+	} while (cell);
+}
+
+/*
+ * register given device
+ */
+static int __fbxatm_register_device(struct fbxatm_dev *adev,
+				    const char *base_name,
+				    const struct fbxatm_dev_ops *ops)
+{
+	struct fbxatm_dev *pdev;
+	int name_len, count, ret;
+	long *inuse;
+
+	adev->ops = ops;
+	INIT_LIST_HEAD(&adev->vcc_list);
+	spin_lock_init(&adev->vcc_list_lock);
+	INIT_LIST_HEAD(&adev->next);
+	spin_lock_init(&adev->stats_lock);
+	spin_lock_init(&adev->oam_list_lock);
+	spin_lock_init(&adev->dev_link_lock);
+	INIT_LIST_HEAD(&adev->rx_oam_cells);
+	INIT_WORK(&adev->oam_work, fbxatm_oam_work);
+	INIT_LIST_HEAD(&adev->oam_pending_ping);
+	get_random_bytes(&adev->oam_correlation_id, 4);
+
+	name_len = strlen(base_name);
+	adev->name = kmalloc(name_len + 10, GFP_KERNEL);
+	if (!adev->name) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	/* allocate ifindex */
+	while (1) {
+		if (++fbxatm_ifindex < 0)
+			fbxatm_ifindex = 0;
+		if (__fbxatm_dev_get_by_index(fbxatm_ifindex))
+			continue;
+		adev->ifindex = fbxatm_ifindex;
+		break;
+	}
+
+	/* allocate device name */
+	inuse = (long *)get_zeroed_page(GFP_ATOMIC);
+	if (!inuse) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	list_for_each_entry(pdev, &fbxatm_dev_list, next) {
+		unsigned long val;
+		char *end;
+
+		/* look for common prefix */
+		if (strncmp(base_name, pdev->name, name_len))
+			continue;
+
+		/* make sure name is the same, not just a prefix */
+		val = simple_strtoul(pdev->name + name_len, &end, 10);
+		if (!*end)
+			continue;
+
+		set_bit(val, inuse);
+	}
+
+	count = find_first_zero_bit(inuse, PAGE_SIZE * 8);
+	free_page((unsigned long)inuse);
+
+	snprintf(adev->name, name_len + 10, "%s%d", base_name, count);
+	list_add_tail(&adev->next, &fbxatm_dev_list);
+
+	/* create procfs entries */
+	ret = fbxatm_proc_dev_register(adev);
+	if (ret)
+		goto fail;
+
+	/* call device procfs init if any */
+	if (adev->ops->init_procfs) {
+		ret = adev->ops->init_procfs(adev);
+		if (ret)
+			goto fail_procfs;
+	}
+
+	/* create sysfs entries */
+	ret = fbxatm_register_dev_sysfs(adev);
+	if (ret)
+		goto fail_procfs;
+
+	return 0;
+
+fail_procfs:
+	fbxatm_proc_dev_deregister(adev);
+
+fail:
+	list_del(&adev->next);
+	kfree(adev->name);
+	return ret;
+}
+
+/*
+ * take lock and register device
+ */
+int fbxatm_register_device(struct fbxatm_dev *adev,
+			   const char *base_name,
+			   const struct fbxatm_dev_ops *ops)
+{
+	int ret;
+
+	mutex_lock(&fbxatm_mutex);
+	ret = __fbxatm_register_device(adev, base_name, ops);
+	mutex_unlock(&fbxatm_mutex);
+	return ret;
+}
+
+EXPORT_SYMBOL(fbxatm_register_device);
+
+/*
+ * change device "link" state
+ */
+static void fbxatm_dev_set_link(struct fbxatm_dev *adev, int link)
+{
+	struct fbxatm_vcc *vcc;
+
+	if (link) {
+		memset(&adev->stats, 0, sizeof (adev->stats));
+		set_bit(FBXATM_DEV_F_LINK_UP, &adev->dev_flags);
+
+		spin_lock_bh(&adev->vcc_list_lock);
+		list_for_each_entry(vcc, &adev->vcc_list, next) {
+			memset(&vcc->stats, 0, sizeof (vcc->stats));
+			set_bit(FBXATM_VCC_F_LINK_UP, &vcc->vcc_flags);
+			if (!vcc->user_ops || !vcc->user_ops->link_change)
+				continue;
+			vcc->user_ops->link_change(vcc->user_cb_data, 1,
+						   adev->link_cell_rate_ds,
+						   adev->link_cell_rate_us);
+		}
+		spin_unlock_bh(&adev->vcc_list_lock);
+	} else {
+		/* prevent further oam cells input */
+		spin_lock_bh(&adev->dev_link_lock);
+		clear_bit(FBXATM_DEV_F_LINK_UP, &adev->dev_flags);
+		spin_unlock_bh(&adev->dev_link_lock);
+
+		/* flush rx oam work */
+		cancel_work_sync(&adev->oam_work);
+
+		/* now disable tx on all vcc */
+		spin_lock_bh(&adev->vcc_list_lock);
+		list_for_each_entry(vcc, &adev->vcc_list, next) {
+			spin_lock_bh(&vcc->tx_lock);
+			clear_bit(FBXATM_VCC_F_LINK_UP, &vcc->vcc_flags);
+			spin_unlock_bh(&vcc->tx_lock);
+			if (!vcc->user_ops || !vcc->user_ops->link_change)
+				continue;
+			vcc->user_ops->link_change(vcc->user_cb_data, 0, 0, 0);
+		}
+		spin_unlock_bh(&adev->vcc_list_lock);
+	}
+
+	fbxatm_dev_change_sysfs(adev);
+}
+
+/*
+ * set device "link" to up, allowing vcc/device send ops to be called,
+ * this function sleeps
+ */
+void fbxatm_dev_set_link_up(struct fbxatm_dev *adev)
+{
+	if (!test_bit(FBXATM_DEV_F_LINK_UP, &adev->dev_flags))
+		printk(KERN_INFO "%s: link UP - "
+		       "down: %u kbit/s - up: %u kbit/s\n", adev->name,
+		       adev->link_rate_ds / 1000, adev->link_rate_us / 1000);
+	return fbxatm_dev_set_link(adev, 1);
+}
+
+EXPORT_SYMBOL(fbxatm_dev_set_link_up);
+
+/*
+ * set device link to down, disallowing any vcc/device send ops to be
+ * called, this function sleeps
+ */
+void fbxatm_dev_set_link_down(struct fbxatm_dev *adev)
+{
+	if (test_bit(FBXATM_DEV_F_LINK_UP, &adev->dev_flags))
+		printk(KERN_INFO "%s: link DOWN\n", adev->name);
+	return fbxatm_dev_set_link(adev, 0);
+}
+
+EXPORT_SYMBOL(fbxatm_dev_set_link_down);
+
+/*
+ * take lock and unregister device
+ */
+int fbxatm_unregister_device(struct fbxatm_dev *adev)
+{
+	int ret;
+	bool empty;
+
+	ret = 0;
+	mutex_lock(&fbxatm_mutex);
+
+	spin_lock_bh(&adev->vcc_list_lock);
+	empty = list_empty(&adev->vcc_list);
+	spin_unlock_bh(&adev->vcc_list_lock);
+	if (!empty) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	if (!list_empty(&adev->oam_pending_ping)) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	list_del(&adev->next);
+
+	if (adev->ops->release_procfs)
+		adev->ops->release_procfs(adev);
+	fbxatm_proc_dev_deregister(adev);
+
+	fbxatm_unregister_dev_sysfs(adev);
+out:
+	mutex_unlock(&fbxatm_mutex);
+	return ret;
+}
+
+EXPORT_SYMBOL(fbxatm_unregister_device);
+
+/*
+ * actually free device memory
+ */
+void __fbxatm_free_device(struct fbxatm_dev *adev)
+{
+	kfree(adev->name);
+	kfree(adev);
+}
+
+/*
+ * free device memory
+ */
+void fbxatm_free_device(struct fbxatm_dev *adev)
+{
+	/* actual free is done in sysfs release */
+//	class_device_put(&adev->class_dev);
+}
+
+EXPORT_SYMBOL(fbxatm_free_device);
+
+/*
+ * device callback when oam cell comes in
+ */
+void fbxatm_netifrx_oam(struct fbxatm_dev *adev, struct fbxatm_oam_cell *cell)
+{
+	bool link_up;
+
+	spin_lock_bh(&adev->dev_link_lock);
+	link_up = test_bit(FBXATM_DEV_F_LINK_UP, &adev->dev_flags);
+	spin_unlock_bh(&adev->dev_link_lock);
+
+	if (!link_up || adev->rx_oam_cells_count > 8) {
+		kfree(cell);
+		return;
+	}
+
+	adev->rx_oam_cells_count++;
+	spin_lock_bh(&adev->oam_list_lock);
+	list_add_tail(&cell->next, &adev->rx_oam_cells);
+	spin_unlock_bh(&adev->oam_list_lock);
+	schedule_work(&adev->oam_work);
+}
+
+EXPORT_SYMBOL(fbxatm_netifrx_oam);
+
+/*
+ * set user ops on vcc
+ */
+void fbxatm_set_uops(struct fbxatm_vcc *vcc,
+		     const struct fbxatm_vcc_uops *user_ops,
+		     void *user_cb_data)
+{
+	spin_lock_bh(&vcc->user_ops_lock);
+	vcc->user_ops = user_ops;
+	vcc->user_cb_data = user_cb_data;
+	spin_unlock_bh(&vcc->user_ops_lock);
+}
+
+/*
+ * bind to given vcc
+ */
+static struct fbxatm_vcc *
+__fbxatm_bind_to_vcc(const struct fbxatm_vcc_id *id,
+		     enum fbxatm_vcc_user user)
+{
+	struct fbxatm_vcc *vcc;
+
+	vcc = __fbxatm_vcc_get_by_id(id);
+	if (IS_ERR(vcc))
+		return vcc;
+
+	if (vcc->user != FBXATM_VCC_USER_NONE)
+		return ERR_PTR(-EBUSY);
+
+	vcc->user = user;
+	return vcc;
+}
+
+/*
+ * bind to given vcc
+ */
+struct fbxatm_vcc *
+fbxatm_bind_to_vcc(const struct fbxatm_vcc_id *id,
+		   enum fbxatm_vcc_user user)
+{
+	struct fbxatm_vcc *vcc;
+
+	mutex_lock(&fbxatm_mutex);
+	vcc = __fbxatm_bind_to_vcc(id, user);
+	mutex_unlock(&fbxatm_mutex);
+	return vcc;
+}
+
+/*
+ * unbind from given vcc
+ */
+void fbxatm_unbind_vcc(struct fbxatm_vcc *vcc)
+{
+	spin_lock_bh(&vcc->user_ops_lock);
+	vcc->user_ops = NULL;
+	vcc->user_cb_data = NULL;
+	vcc->user = FBXATM_VCC_USER_NONE;
+	spin_unlock_bh(&vcc->user_ops_lock);
+}
+
+/*
+ * open vcc on given device
+ */
+static int __fbxatm_dev_open_vcc(const struct fbxatm_vcc_id *id,
+				 const struct fbxatm_vcc_qos *qos)
+{
+	struct fbxatm_vcc *vcc;
+	struct fbxatm_dev *adev;
+	int ret, count;
+
+	/* check vpi/vci unicity  */
+	vcc = __fbxatm_vcc_get_by_id(id);
+	if (!IS_ERR(vcc))
+		return -EBUSY;
+
+	/* sanity check */
+	switch (qos->traffic_class) {
+	case FBXATM_VCC_TC_UBR_NO_PCR:
+	case FBXATM_VCC_TC_UBR:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (qos->max_sdu > 4096)
+		return -EINVAL;
+
+	if (!qos->max_buffered_pkt || qos->max_buffered_pkt > 128)
+		return -EINVAL;
+
+	adev = __fbxatm_dev_get_by_index(id->dev_idx);
+	if (!adev)
+		return -ENODEV;
+
+	/* make sure device accept requested priorities */
+	if (qos->priority > adev->max_priority)
+		return -EINVAL;
+
+	if (qos->rx_priority > adev->max_rx_priority)
+		return -EINVAL;
+
+	/* don't open more vcc than device can handle */
+	count = 0;
+	list_for_each_entry(vcc, &adev->vcc_list, next)
+		count++;
+	if (count + 1 > adev->max_vcc)
+		return -ENOSPC;
+
+	/* make sure vpi/vci is valid for this device */
+	if ((~adev->vpi_mask & id->vpi) || (~adev->vci_mask & id->vci))
+		return -EINVAL;
+
+	if (!try_module_get(adev->ops->owner))
+		return -ENODEV;
+
+	/* ok, create vcc */
+	vcc = kzalloc(sizeof (*vcc), GFP_KERNEL);
+	if (!vcc)
+		return -ENOMEM;
+
+	spin_lock_init(&vcc->user_ops_lock);
+	spin_lock_init(&vcc->tx_lock);
+	vcc->vpi = id->vpi;
+	vcc->vci = id->vci;
+	vcc->adev = adev;
+	vcc->to_drop_pkt = 0;
+	memcpy(&vcc->qos, qos, sizeof (*qos));
+
+	ret = adev->ops->open(vcc);
+	if (ret) {
+		kfree(vcc);
+		return ret;
+	}
+
+	/* inherit vcc link state from device */
+	spin_lock_bh(&adev->vcc_list_lock);
+	if (test_bit(FBXATM_DEV_F_LINK_UP, &adev->dev_flags))
+		set_bit(FBXATM_VCC_F_LINK_UP, &vcc->vcc_flags);
+	list_add_tail(&vcc->next, &adev->vcc_list);
+	spin_unlock_bh(&adev->vcc_list_lock);
+
+	return ret;
+}
+
+/*
+ * find device & open vcc on it
+ */
+static int fbxatm_dev_open_vcc(const struct fbxatm_vcc_id *id,
+			       const struct fbxatm_vcc_qos *qos)
+{
+	int ret;
+
+	mutex_lock(&fbxatm_mutex);
+	ret = __fbxatm_dev_open_vcc(id, qos);
+	mutex_unlock(&fbxatm_mutex);
+	return ret;
+}
+
+/*
+ * close vcc on device
+ */
+static int __fbxatm_dev_close_vcc(struct fbxatm_vcc *vcc)
+{
+	struct fbxatm_dev *adev;
+
+	if (vcc->user != FBXATM_VCC_USER_NONE)
+		return -EBUSY;
+	adev = vcc->adev;
+	module_put(adev->ops->owner);
+	adev->ops->close(vcc);
+	spin_lock_bh(&adev->vcc_list_lock);
+	list_del(&vcc->next);
+	spin_unlock_bh(&adev->vcc_list_lock);
+	kfree(vcc);
+	return 0;
+}
+
+/*
+ * find device & vcc and close it
+ */
+static int fbxatm_dev_close_vcc(const struct fbxatm_vcc_id *id)
+{
+	struct fbxatm_vcc *vcc;
+	int ret;
+
+	mutex_lock(&fbxatm_mutex);
+	vcc = __fbxatm_vcc_get_by_id(id);
+	if (IS_ERR(vcc))
+		ret = PTR_ERR(vcc);
+	else
+		ret = __fbxatm_dev_close_vcc(vcc);
+	mutex_unlock(&fbxatm_mutex);
+	return ret;
+}
+
+/*
+ * ioctl handler
+ */
+static int fbxatm_vcc_ioctl(struct socket *sock,
+			    unsigned int cmd, void __user *useraddr)
+{
+	int ret;
+
+	ret = 0;
+
+	switch (cmd) {
+	case FBXATM_IOCADD:
+	case FBXATM_IOCDEL:
+	{
+		struct fbxatm_vcc_params params;
+
+		if (copy_from_user(&params, useraddr, sizeof(params)))
+			return -EFAULT;
+
+		if (cmd == FBXATM_IOCADD)
+			ret = fbxatm_dev_open_vcc(&params.id, &params.qos);
+		else
+			ret = fbxatm_dev_close_vcc(&params.id);
+		break;
+	}
+
+	case FBXATM_IOCGET:
+	{
+		struct fbxatm_vcc_params params;
+		struct fbxatm_vcc *vcc;
+
+		if (copy_from_user(&params, useraddr, sizeof(params)))
+			return -EFAULT;
+
+		mutex_lock(&fbxatm_mutex);
+		vcc = __fbxatm_vcc_get_by_id(&params.id);
+		if (IS_ERR(vcc))
+			ret = PTR_ERR(vcc);
+		else {
+			memcpy(&params.qos, &vcc->qos, sizeof (vcc->qos));
+			params.user = vcc->user;
+		}
+		mutex_unlock(&fbxatm_mutex);
+
+		if (ret)
+			return ret;
+
+		if (copy_to_user(useraddr, &params, sizeof(params)))
+			return -EFAULT;
+		break;
+	}
+
+	case FBXATM_IOCOAMPING:
+	{
+		struct fbxatm_oam_ping ping;
+
+		if (copy_from_user(&ping.req, useraddr, sizeof(ping.req)))
+			return -EFAULT;
+
+		ret = do_oam_ping(&ping);
+		if (ret)
+			return ret;
+
+		if (copy_to_user(useraddr, &ping.req, sizeof(ping.req)))
+			return -EFAULT;
+		break;
+	}
+
+	case FBXATM_IOCDROP:
+	{
+		struct fbxatm_vcc_drop_params params;
+		struct fbxatm_vcc *vcc;
+
+		if (copy_from_user(&params, useraddr, sizeof(params)))
+			return -EFAULT;
+
+		mutex_lock(&fbxatm_mutex);
+		vcc = __fbxatm_vcc_get_by_id(&params.id);
+		if (IS_ERR(vcc))
+			ret = PTR_ERR(vcc);
+		else {
+			spin_lock_bh(&vcc->user_ops_lock);
+			vcc->to_drop_pkt += params.drop_count;
+			spin_unlock_bh(&vcc->user_ops_lock);
+			ret = 0;
+		}
+		mutex_unlock(&fbxatm_mutex);
+
+		if (ret)
+			return ret;
+		break;
+	}
+
+	default:
+		return -ENOIOCTLCMD;
+	}
+
+	return ret;
+}
+
+static struct fbxatm_ioctl fbxatm_vcc_ioctl_ops = {
+	.handler	= fbxatm_vcc_ioctl,
+	.owner		= THIS_MODULE,
+};
+
+int __init fbxatm_vcc_init(void)
+{
+	fbxatm_register_ioctl(&fbxatm_vcc_ioctl_ops);
+	return 0;
+}
+
+void fbxatm_vcc_exit(void)
+{
+	fbxatm_unregister_ioctl(&fbxatm_vcc_ioctl_ops);
+}
diff -Nruw linux-5.4.60-fbx/net/fbxatm./fbxatm_pppoa.c linux-5.4.60-fbx/net/fbxatm/fbxatm_pppoa.c
--- linux-5.4.60-fbx/net/fbxatm./fbxatm_pppoa.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxatm/fbxatm_pppoa.c	2021-03-04 13:21:01.410839051 +0100
@@ -0,0 +1,500 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/netdevice.h>
+#include <linux/if_pppox.h>
+#include <linux/ppp_channel.h>
+#include <linux/ppp_defs.h>
+#include <linux/if_ppp.h>
+#include <linux/fbxatm.h>
+#include <linux/fbxatm_dev.h>
+#include "fbxatm_priv.h"
+
+#define PFX	"fbxatm_pppoa: "
+
+static LIST_HEAD(fbxatm_pppoa_vcc_list);
+static DEFINE_MUTEX(fbxatm_pppoa_mutex);
+
+/*
+ * private data for pppoa vcc
+ */
+struct fbxatm_pppoa_vcc {
+	struct fbxatm_vcc		*vcc;
+	struct fbxatm_pppoa_vcc_params	params;
+	enum fbxatm_pppoa_encap		cur_encap;
+
+	/* used by ppp */
+	int				flags;
+	struct ppp_channel		chan;
+	struct tasklet_struct		tx_done_tasklet;
+
+	struct socket			*sock;
+	struct list_head		next;
+};
+
+
+#define __LLC_HDR		0xfe, 0xfe, 0x03
+#define __NLPID_PPP		0xcf
+#define __PPP_LCP		0xc0, 0x21
+
+static const u8 llc_ppp[]	= { __LLC_HDR, __NLPID_PPP };
+static const u8 llc_ppp_lcp[]	= { __LLC_HDR, __NLPID_PPP, __PPP_LCP };
+static const u8 lcp[]		= { __PPP_LCP };
+
+
+/*
+ * fbxatm stack receive callback, called from softirq
+ */
+static void vcc_rx_callback(struct sk_buff *skb, void *data)
+{
+	struct fbxatm_pppoa_vcc *priv;
+
+	priv = (struct fbxatm_pppoa_vcc *)data;
+
+	if (priv->chan.ppp == NULL) {
+		dev_kfree_skb(skb);
+		return;
+	}
+
+	switch (priv->cur_encap) {
+	case FBXATM_EPPPOA_VCMUX:
+		/* nothing to do */
+		break;
+
+	case FBXATM_EPPPOA_LLC:
+		/* make sure llc header is present and remove */
+		if (skb->len < sizeof(llc_ppp) ||
+		    memcmp(skb->data, llc_ppp, sizeof(llc_ppp)))
+			goto error;
+		skb_pull(skb, sizeof(llc_ppp));
+		break;
+
+	case FBXATM_EPPPOA_AUTODETECT:
+		/* look for lcp, with an llc header or not */
+		if (skb->len >= sizeof(llc_ppp_lcp) &&
+		    !memcmp(skb->data, llc_ppp_lcp, sizeof(llc_ppp_lcp))) {
+			priv->cur_encap = FBXATM_EPPPOA_LLC;
+			skb_pull(skb, sizeof(llc_ppp));
+			break;
+		}
+
+		if (skb->len >= sizeof(lcp) &&
+		    !memcmp(skb->data, lcp, sizeof (lcp))) {
+			priv->cur_encap = FBXATM_EPPPOA_VCMUX;
+			break;
+		}
+
+		/* no match */
+		goto error;
+	}
+
+	ppp_input(&priv->chan, skb);
+	return;
+
+error:
+	dev_kfree_skb(skb);
+	ppp_input_error(&priv->chan, 0);
+}
+
+/*
+ * tx done tasklet callback
+ */
+static void tx_done_tasklet_func(unsigned long data)
+{
+	struct fbxatm_pppoa_vcc *priv = (struct fbxatm_pppoa_vcc *)data;
+	ppp_output_wakeup(&priv->chan);
+}
+
+/*
+ * fbxatm stack tx done callback, called from softirq
+ */
+static void vcc_tx_done_callback(void *data)
+{
+	struct fbxatm_pppoa_vcc *priv = data;
+
+	/* schedule taslket to avoid re-entering in ppp_xmit */
+	tasklet_schedule(&priv->tx_done_tasklet);
+}
+
+/*
+ * vcc user ops, callback from fbxatm stack
+ */
+static const struct fbxatm_vcc_uops fbxatm_pppoa_vcc_uops = {
+	.rx_pkt		= vcc_rx_callback,
+	.tx_done	= vcc_tx_done_callback,
+};
+
+/*
+ * ppp xmit callback
+ */
+static int ppp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+{
+	struct fbxatm_pppoa_vcc *priv;
+	struct sk_buff *to_send_skb, *nskb;
+	int ret;
+
+	priv = (struct fbxatm_pppoa_vcc *)chan->private;
+
+	/* MAYBE FIXME: handle protocol compression ? */
+
+	to_send_skb = skb;
+	nskb = NULL;
+
+	/* send using vcmux encap if not yet known */
+	switch (priv->cur_encap) {
+	case FBXATM_EPPPOA_AUTODETECT:
+	case FBXATM_EPPPOA_VCMUX:
+		break;
+
+	case FBXATM_EPPPOA_LLC:
+	{
+		unsigned int headroom;
+
+		headroom = skb_headroom(skb);
+
+		if (headroom < sizeof(llc_ppp)) {
+			headroom += sizeof(llc_ppp);
+			nskb = skb_realloc_headroom(skb, headroom);
+			if (!nskb) {
+				dev_kfree_skb(skb);
+				return 1;
+			}
+			to_send_skb = nskb;
+		}
+
+		skb_push(to_send_skb, sizeof(llc_ppp));
+		memcpy(to_send_skb->data, llc_ppp, sizeof(llc_ppp));
+		break;
+	}
+	}
+
+	ret = fbxatm_send(priv->vcc, to_send_skb);
+	if (ret) {
+		/* packet was not sent, queue is full, free any newly
+		 * created skb */
+		if (nskb)
+			dev_kfree_skb(nskb);
+		else {
+			/* restore original skb if we altered it */
+			if (priv->cur_encap == FBXATM_EPPPOA_LLC)
+				skb_pull(skb, sizeof(llc_ppp));
+		}
+
+		/* suspend ppp output, will be woken up by
+		 * ppp_output_wakeup, we're called under ppp lock so
+		 * we can't race with tx done */
+		return 0;
+	}
+
+	/* packet was sent, if we sent a copy free the original */
+	if (nskb)
+		dev_kfree_skb(skb);
+
+	if (fbxatm_vcc_queue_full(priv->vcc))
+		ppp_output_stop(chan);
+
+	return 1;
+}
+
+static int ppp_ioctl(struct ppp_channel *chan, unsigned int cmd,
+		     unsigned long arg)
+{
+	struct fbxatm_pppoa_vcc *priv;
+	int ret;
+
+	priv = (struct fbxatm_pppoa_vcc *)chan->private;
+
+	switch (cmd) {
+	case PPPIOCGFLAGS:
+		ret = put_user(priv->flags, (int __user *)arg) ? -EFAULT : 0;
+		break;
+	case PPPIOCSFLAGS:
+		ret = get_user(priv->flags, (int __user *) arg) ? -EFAULT : 0;
+		break;
+	default:
+		ret = -ENOTTY;
+		break;
+	}
+	return ret;
+}
+
+static struct ppp_channel_ops fbxatm_pppoa_ppp_ops = {
+	.start_xmit = ppp_xmit,
+	.ioctl = ppp_ioctl,
+};
+
+/*
+ * find pppoa vcc from id
+ */
+static struct fbxatm_pppoa_vcc *
+__find_pppoa_vcc(const struct fbxatm_vcc_id *id)
+{
+	struct fbxatm_pppoa_vcc *priv;
+	int found;
+
+	/* find it */
+	found = 0;
+	list_for_each_entry(priv, &fbxatm_pppoa_vcc_list, next) {
+		if (priv->vcc->adev->ifindex != id->dev_idx ||
+		    priv->vcc->vpi != id->vpi ||
+		    priv->vcc->vci != id->vci)
+			continue;
+
+		found = 1;
+		break;
+	}
+
+	if (found)
+		return priv;
+	return NULL;
+}
+
+/*
+ * find pppoa vcc from socket
+ */
+static struct fbxatm_pppoa_vcc *
+__find_pppoa_vcc_from_socket(const struct socket *sock)
+{
+	struct fbxatm_pppoa_vcc *priv;
+	int found;
+
+	/* find it */
+	found = 0;
+	list_for_each_entry(priv, &fbxatm_pppoa_vcc_list, next) {
+		if (priv->sock != sock)
+			continue;
+
+		found = 1;
+		break;
+	}
+
+	if (found)
+		return priv;
+	return NULL;
+}
+
+/*
+ * bind to given vcc
+ */
+static int __bind_pppoa_vcc(const struct fbxatm_pppoa_vcc_params *params,
+			    struct socket *sock)
+{
+	struct fbxatm_pppoa_vcc *priv;
+	int ret;
+
+	/* sanity check */
+	switch (params->encap) {
+	case FBXATM_EPPPOA_AUTODETECT:
+	case FBXATM_EPPPOA_VCMUX:
+	case FBXATM_EPPPOA_LLC:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+	memcpy(&priv->params, params, sizeof (*params));
+	priv->cur_encap = params->encap;
+
+	/* bind to vcc */
+	priv->vcc = fbxatm_bind_to_vcc(&params->id, FBXATM_VCC_USER_PPPOA);
+	if (IS_ERR(priv->vcc)) {
+		ret = PTR_ERR(priv->vcc);
+		goto fail;
+	}
+
+	fbxatm_set_uops(priv->vcc, &fbxatm_pppoa_vcc_uops, priv);
+	priv->chan.private = priv;
+	priv->chan.ops = &fbxatm_pppoa_ppp_ops;
+	priv->chan.mtu = priv->vcc->qos.max_sdu - PPP_HDRLEN;
+	priv->chan.hdrlen = 0;
+	priv->sock = sock;
+	tasklet_init(&priv->tx_done_tasklet, tx_done_tasklet_func,
+		     (unsigned long)priv);
+
+	if (priv->cur_encap != FBXATM_EPPPOA_VCMUX) {
+		/* assume worst case if vcmux is not forced */
+		priv->chan.mtu -= sizeof(llc_ppp);
+		priv->chan.hdrlen += sizeof(llc_ppp);
+	}
+
+	priv->chan.mtu -= priv->vcc->adev->tx_headroom;
+	priv->chan.hdrlen += priv->vcc->adev->tx_headroom;
+
+	ret = ppp_register_channel(&priv->chan);
+	if (ret)
+		goto fail_unbind;
+	list_add_tail(&priv->next, &fbxatm_pppoa_vcc_list);
+	return 0;
+
+fail_unbind:
+	fbxatm_unbind_vcc(priv->vcc);
+
+fail:
+	kfree(priv);
+	return ret;
+}
+
+/*
+ * bind to given vcc
+ */
+static int bind_pppoa_vcc(const struct fbxatm_pppoa_vcc_params *params,
+			  struct socket *sock)
+{
+	int ret;
+
+	mutex_lock(&fbxatm_pppoa_mutex);
+	ret = __bind_pppoa_vcc(params, sock);
+	mutex_unlock(&fbxatm_pppoa_mutex);
+	return ret;
+}
+
+/*
+ * unbind from given vcc
+ */
+static void __unbind_pppoa_vcc(struct fbxatm_pppoa_vcc *priv)
+{
+	ppp_unregister_channel(&priv->chan);
+	fbxatm_unbind_vcc(priv->vcc);
+	tasklet_kill(&priv->tx_done_tasklet);
+	list_del(&priv->next);
+	kfree(priv);
+}
+
+/*
+ * unbind from given vcc
+ */
+static int unbind_pppoa_vcc(const struct fbxatm_pppoa_vcc_params *params)
+{
+	struct fbxatm_pppoa_vcc *priv;
+	int ret;
+
+	ret = 0;
+	mutex_lock(&fbxatm_pppoa_mutex);
+	priv = __find_pppoa_vcc(&params->id);
+	if (!priv)
+		ret = -ENOENT;
+	else
+		__unbind_pppoa_vcc(priv);
+	mutex_unlock(&fbxatm_pppoa_mutex);
+	return ret;
+}
+
+/*
+ * pppoa related ioctl handler
+ */
+static int fbxatm_pppoa_ioctl(struct socket *sock,
+			      unsigned int cmd, void __user *useraddr)
+{
+	int ret;
+
+	ret = 0;
+
+	switch (cmd) {
+	case FBXATM_PPPOA_IOCADD:
+	case FBXATM_PPPOA_IOCDEL:
+	{
+		struct fbxatm_pppoa_vcc_params params;
+
+		if (copy_from_user(&params, useraddr, sizeof(params)))
+			return -EFAULT;
+
+		if (cmd == FBXATM_PPPOA_IOCADD)
+			ret = bind_pppoa_vcc(&params, sock);
+		else
+			ret = unbind_pppoa_vcc(&params);
+		break;
+	}
+
+	case FBXATM_PPPOA_IOCGET:
+	{
+		struct fbxatm_pppoa_vcc_params params;
+		struct fbxatm_pppoa_vcc *priv;
+
+		if (copy_from_user(&params, useraddr, sizeof(params)))
+			return -EFAULT;
+
+		mutex_lock(&fbxatm_pppoa_mutex);
+		priv = __find_pppoa_vcc(&params.id);
+		if (!priv)
+			ret = -ENOENT;
+		else
+			memcpy(&params, &priv->params, sizeof (params));
+		mutex_unlock(&fbxatm_pppoa_mutex);
+
+		if (ret)
+			return ret;
+
+		if (copy_to_user(useraddr, &params, sizeof(params)))
+			return -EFAULT;
+		break;
+	}
+
+	case PPPIOCGCHAN:
+	case PPPIOCGUNIT:
+	{
+		struct fbxatm_pppoa_vcc *priv;
+		int value;
+
+		value = 0;
+
+		mutex_lock(&fbxatm_pppoa_mutex);
+		priv = __find_pppoa_vcc_from_socket(sock);
+		if (!priv)
+			ret = -ENOENT;
+		else {
+			if (cmd == PPPIOCGCHAN)
+				value = ppp_channel_index(&priv->chan);
+			else
+				value = ppp_unit_number(&priv->chan);
+		}
+		mutex_unlock(&fbxatm_pppoa_mutex);
+
+		if (ret)
+			return ret;
+
+		if (copy_to_user(useraddr, &value, sizeof(value)))
+			ret = -EFAULT;
+		break;
+	}
+
+	default:
+		return -ENOIOCTLCMD;
+	}
+
+	return ret;
+}
+
+/*
+ * pppoa related release handler
+ */
+static void fbxatm_pppoa_release(struct socket *sock)
+{
+	struct fbxatm_pppoa_vcc *priv;
+
+	mutex_lock(&fbxatm_pppoa_mutex);
+	priv = __find_pppoa_vcc_from_socket(sock);
+	if (priv)
+		__unbind_pppoa_vcc(priv);
+	mutex_unlock(&fbxatm_pppoa_mutex);
+}
+
+static struct fbxatm_ioctl fbxatm_pppoa_ioctl_ops = {
+	.handler	= fbxatm_pppoa_ioctl,
+	.release	= fbxatm_pppoa_release,
+	.owner		= THIS_MODULE,
+};
+
+int __init fbxatm_pppoa_init(void)
+{
+	fbxatm_register_ioctl(&fbxatm_pppoa_ioctl_ops);
+	return 0;
+}
+
+void fbxatm_pppoa_exit(void)
+{
+	fbxatm_unregister_ioctl(&fbxatm_pppoa_ioctl_ops);
+}
diff -Nruw linux-5.4.60-fbx/net/fbxatm./fbxatm_priv.h linux-5.4.60-fbx/net/fbxatm/fbxatm_priv.h
--- linux-5.4.60-fbx/net/fbxatm./fbxatm_priv.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxatm/fbxatm_priv.h	2021-03-04 13:21:01.410839051 +0100
@@ -0,0 +1,67 @@
+#ifndef FBXATM_PRIV_H_
+#define FBXATM_PRIV_H_
+
+#include <linux/list.h>
+#include <linux/mutex.h>
+
+extern struct list_head fbxatm_dev_list;
+extern struct mutex fbxatm_mutex;
+
+int __init fbxatm_vcc_init(void);
+
+void fbxatm_vcc_exit(void);
+
+void __fbxatm_free_device(struct fbxatm_dev *adev);
+
+int __init fbxatm_2684_init(void);
+
+void fbxatm_2684_exit(void);
+
+/*
+ * pppoa
+ */
+#ifdef CONFIG_PPP
+int __init fbxatm_pppoa_init(void);
+
+void fbxatm_pppoa_exit(void);
+#else
+static inline int fbxatm_pppoa_init(void) { return 0; };
+static inline void fbxatm_pppoa_exit(void) { };
+#endif
+
+/*
+ * procfs stuff
+ */
+int fbxatm_proc_dev_register(struct fbxatm_dev *dev);
+
+void fbxatm_proc_dev_deregister(struct fbxatm_dev *dev);
+
+struct proc_dir_entry *fbxatm_proc_misc_register(const char *path);
+
+void fbxatm_proc_misc_deregister(const char *path);
+
+int __init fbxatm_procfs_init(void);
+
+void fbxatm_procfs_exit(void);
+
+
+/*
+ * sysfs stuff
+ */
+int __init fbxatm_sysfs_init(void);
+
+void fbxatm_sysfs_exit(void);
+
+void fbxatm_dev_change_sysfs(struct fbxatm_dev *adev);
+
+int fbxatm_register_dev_sysfs(struct fbxatm_dev *adev);
+
+void fbxatm_unregister_dev_sysfs(struct fbxatm_dev *adev);
+
+
+/*
+ * crc10
+ */
+u16 crc10(u16 crc, const u8 *buffer, size_t len);
+
+#endif /* !FBXATM_PRIV_H_ */
diff -Nruw linux-5.4.60-fbx/net/fbxatm./fbxatm_procfs.c linux-5.4.60-fbx/net/fbxatm/fbxatm_procfs.c
--- linux-5.4.60-fbx/net/fbxatm./fbxatm_procfs.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxatm/fbxatm_procfs.c	2021-03-30 16:07:01.591769549 +0200
@@ -0,0 +1,340 @@
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <linux/fbxatm_dev.h>
+#include <net/net_namespace.h>
+#include "fbxatm_priv.h"
+
+static struct proc_dir_entry *fbxatm_proc_root;
+
+/*
+ * /proc/net/atm/vcc
+ */
+static int vcc_seq_show(struct seq_file *seq, void *v)
+{
+	struct fbxatm_vcc *vcc;
+
+	if (v == (void *)SEQ_START_TOKEN) {
+		seq_printf(seq, "%s",
+			   "Itf.VPI.VCI USER TC MaxSDU  RX TX  RXAAL5 "
+			   "TXAAL5\n");
+		return 0;
+	}
+
+	vcc = (struct fbxatm_vcc *)v;
+	seq_printf(seq, "%d.%u.%u %d ", vcc->adev->ifindex,
+		   vcc->vpi, vcc->vci, vcc->user);
+	seq_printf(seq, "%u %u ", vcc->qos.traffic_class, vcc->qos.max_sdu);
+	seq_printf(seq, "%u %u  %u %u\n",
+		   vcc->stats.rx_bytes,
+		   vcc->stats.tx_bytes,
+		   vcc->stats.rx_aal5,
+		   vcc->stats.tx_aal5);
+	return 0;
+}
+
+static void *vcc_seq_start(struct seq_file *seq, loff_t *pos)
+{
+	struct fbxatm_dev *adev;
+	struct fbxatm_vcc *tvcc, *vcc;
+	int count;
+
+	mutex_lock(&fbxatm_mutex);
+
+	if (!*pos)
+		return SEQ_START_TOKEN;
+
+	count = 1;
+	tvcc = NULL;
+	list_for_each_entry(adev, &fbxatm_dev_list, next) {
+		list_for_each_entry(vcc, &adev->vcc_list, next) {
+			if (count == *pos) {
+				tvcc = vcc;
+				break;
+			}
+			count++;
+		}
+	}
+
+	return tvcc;
+}
+
+static void *vcc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+	struct fbxatm_dev *adev;
+	struct fbxatm_vcc *last_vcc, *vcc, *tvcc;
+
+	if (v == (void *)SEQ_START_TOKEN) {
+		if (list_empty(&fbxatm_dev_list))
+			return NULL;
+		adev = list_entry(fbxatm_dev_list.next, struct fbxatm_dev,
+				  next);
+		last_vcc = NULL;
+	} else {
+		last_vcc = (struct fbxatm_vcc *)v;
+		adev = last_vcc->adev;
+	}
+
+	tvcc = NULL;
+	list_for_each_entry_continue(adev, &fbxatm_dev_list, next) {
+
+		if (last_vcc && last_vcc->adev == adev) {
+			vcc = last_vcc;
+			list_for_each_entry_continue(vcc, &adev->vcc_list,
+						     next) {
+				tvcc = vcc;
+				break;
+			}
+		} else {
+			list_for_each_entry(vcc, &adev->vcc_list, next) {
+				tvcc = vcc;
+				break;
+			}
+		}
+	}
+
+	if (tvcc)
+		(*pos)++;
+	return tvcc;
+}
+
+static void vcc_seq_stop(struct seq_file *seq, void *v)
+{
+	mutex_unlock(&fbxatm_mutex);
+}
+
+static const struct seq_operations vcc_seq_ops = {
+	.start		= vcc_seq_start,
+	.next		= vcc_seq_next,
+	.stop		= vcc_seq_stop,
+	.show		= vcc_seq_show,
+};
+
+static int vcc_seq_open(struct inode *inode, struct file *file)
+{
+	return seq_open(file, &vcc_seq_ops);
+}
+
+static const struct file_operations vcc_seq_fops = {
+	.open		= vcc_seq_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= seq_release,
+};
+
+/*
+ * /proc/net/atm/dev
+ */
+static int adev_seq_show(struct seq_file *seq, void *v)
+{
+	struct fbxatm_dev *adev;
+
+	if (v == (void *)SEQ_START_TOKEN) {
+		seq_printf(seq, "%s",
+			   "Itf  RX TX  RXAAL5 TXAAL5  RXF4OAM TXF4OAM  "
+			   "RXF5OAM TXF5OAM  RXBADOAM RXBADLLIDOAM "
+			   "RXOTHEROAM RXDROPPED TXDROPNOLINK\n");
+		return 0;
+	}
+
+	adev = (struct fbxatm_dev *)v;
+	seq_printf(seq, "%d  %u %u  %u %u  ",
+		   adev->ifindex,
+		   adev->stats.rx_bytes,
+		   adev->stats.tx_bytes,
+		   adev->stats.rx_aal5,
+		   adev->stats.tx_aal5);
+
+	seq_printf(seq, "%u %u  %u %u  %u %u %u %u %u\n",
+		   adev->stats.rx_f4_oam,
+		   adev->stats.tx_f4_oam,
+
+		   adev->stats.rx_f5_oam,
+		   adev->stats.tx_f5_oam,
+
+		   adev->stats.rx_bad_oam,
+		   adev->stats.rx_bad_llid_oam,
+		   adev->stats.rx_other_oam,
+		   adev->stats.rx_dropped,
+		   adev->stats.tx_drop_nolink);
+	return 0;
+}
+
+static void *adev_seq_start(struct seq_file *seq, loff_t *pos)
+{
+	struct fbxatm_dev *adev, *tadev;
+	int count;
+
+	mutex_lock(&fbxatm_mutex);
+
+	if (!*pos)
+		return SEQ_START_TOKEN;
+
+	count = 1;
+	tadev = NULL;
+	list_for_each_entry(adev, &fbxatm_dev_list, next) {
+		if (count == *pos) {
+			tadev = adev;
+			break;
+		}
+		count++;
+	}
+
+	return tadev;
+}
+
+static void *adev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+	struct fbxatm_dev *adev, *tadev;
+
+	if (v == (void *)SEQ_START_TOKEN) {
+		if (list_empty(&fbxatm_dev_list))
+			return NULL;
+		adev = list_entry(fbxatm_dev_list.next, struct fbxatm_dev,
+				  next);
+	} else
+		adev = (struct fbxatm_dev *)v;
+
+	tadev = NULL;
+	list_for_each_entry_continue(adev, &fbxatm_dev_list, next) {
+		tadev = adev;
+		break;
+	}
+
+	if (tadev)
+		(*pos)++;
+	return tadev;
+}
+
+static void adev_seq_stop(struct seq_file *seq, void *v)
+{
+	mutex_unlock(&fbxatm_mutex);
+}
+
+static const struct seq_operations adev_seq_ops = {
+	.start		= adev_seq_start,
+	.next		= adev_seq_next,
+	.stop		= adev_seq_stop,
+	.show		= adev_seq_show,
+};
+
+static int adev_seq_open(struct inode *inode, struct file *file)
+{
+	return seq_open(file, &adev_seq_ops);
+}
+
+static const struct file_operations adev_seq_fops = {
+	.open		= adev_seq_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= seq_release,
+};
+
+
+/*
+ * create device private entry in proc
+ */
+int fbxatm_proc_dev_register(struct fbxatm_dev *adev)
+{
+	adev->dev_proc_entry = proc_mkdir(adev->name, fbxatm_proc_root);
+	if (!adev->dev_proc_entry)
+		return 1;
+	return 0;
+}
+
+
+void fbxatm_proc_dev_deregister(struct fbxatm_dev *adev)
+{
+	remove_proc_entry(adev->name, fbxatm_proc_root);
+}
+
+/*
+ * create misc private entry in proc
+ */
+struct proc_dir_entry *fbxatm_proc_misc_register(const char *path)
+{
+	return proc_mkdir(path, fbxatm_proc_root);
+}
+
+void fbxatm_proc_misc_deregister(const char *path)
+{
+	remove_proc_entry(path, fbxatm_proc_root);
+}
+
+/*
+ * list of proc entries for fbxatm
+ */
+static struct fbxatm_proc_entry {
+	char *name;
+	const struct file_operations *proc_fops;
+	struct proc_dir_entry *dirent;
+
+} fbxatm_proc_entries[] = {
+	{
+		.name = "dev",
+		.proc_fops = &adev_seq_fops,
+	},
+	{
+		.name = "vcc",
+		.proc_fops = &vcc_seq_fops,
+	},
+};
+
+static void fbxatm_remove_proc(void)
+{
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(fbxatm_proc_entries); i++) {
+		struct fbxatm_proc_entry *e;
+
+		e = &fbxatm_proc_entries[i];
+
+		if (!e->dirent)
+			continue;
+		remove_proc_entry(e->name, fbxatm_proc_root);
+		e->dirent = NULL;
+	}
+
+	remove_proc_entry("fbxatm", init_net.proc_net);
+}
+
+int __init fbxatm_procfs_init(void)
+{
+	unsigned int i;
+	int ret;
+
+	fbxatm_proc_root = proc_net_mkdir(&init_net, "fbxatm",
+					  init_net.proc_net);
+	if (!fbxatm_proc_root) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(fbxatm_proc_entries); i++) {
+		struct proc_dir_entry *dirent;
+		struct fbxatm_proc_entry *e;
+
+		e = &fbxatm_proc_entries[i];
+
+		dirent = proc_create_data(e->name, S_IRUGO, fbxatm_proc_root,
+					  e->proc_fops, NULL);
+		if (!dirent) {
+			ret = -ENOMEM;
+			goto err;
+		}
+		e->dirent = dirent;
+	}
+
+	return 0;
+
+err:
+	if (fbxatm_proc_root)
+		fbxatm_remove_proc();
+	return ret;
+}
+
+void fbxatm_procfs_exit(void)
+{
+	fbxatm_remove_proc();
+}
diff -Nruw linux-5.4.60-fbx/net/fbxatm./fbxatm_remote.c linux-5.4.60-fbx/net/fbxatm/fbxatm_remote.c
--- linux-5.4.60-fbx/net/fbxatm./fbxatm_remote.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxatm/fbxatm_remote.c	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,808 @@
+#include <linux/module.h>
+#include <linux/fbxatm.h>
+#include <linux/fbxatm_dev.h>
+#include <linux/fbxatm_remote.h>
+#include <asm/unaligned.h>
+
+#define PFX		"fbxatm_remote: "
+#define MAX_PORTS	64
+#define MAX_RETRANS	10
+#define RETRANS_TIMER	(HZ / 3)
+
+struct fbxatm_remote_ctx;
+
+struct fbxatm_remote_sock {
+	spinlock_t			lock;
+	struct fbxatm_remote_sockaddr	addr;
+
+	struct timer_list		retrans_timer;
+	unsigned int			retrans_count;
+
+	struct sk_buff			*pending;
+
+	/* 1 for output */
+	int				direction;
+
+	/* wait ack for output, send ack for input */
+	int				has_ack;
+
+	u8				seq;
+
+	struct fbxatm_remote_ctx	*ctx;
+	struct list_head		next;
+};
+
+struct fbxatm_remote_ctx {
+	spinlock_t			lock;
+	int				dead;
+
+	struct net_device		*netdev;
+	u8				remote_mac[ETH_ALEN];
+	u32				session_id;
+
+	struct fbxatm_remote_sock	*socks_per_lport[MAX_PORTS];
+	struct sk_buff			*pending_zero_ack;
+
+	void				(*timeout_cb)(void *priv);
+	void				*priv;
+
+	struct list_head		next;
+};
+
+static struct list_head ctx_list;
+static DEFINE_SPINLOCK(ctx_list_lock);
+static void (*unknown_cb)(struct net_device *,
+			  struct sk_buff *);
+
+unsigned int fbxatm_remote_headroom(struct fbxatm_remote_ctx *ctx)
+{
+	return sizeof (struct fbxatm_remote_hdr) +
+		ctx->netdev->hard_header_len + ctx->netdev->needed_headroom;
+}
+
+EXPORT_SYMBOL(fbxatm_remote_headroom);
+
+/*
+ * allocate skb with enough headroom for header
+ */
+struct sk_buff *fbxatm_remote_alloc_skb(struct fbxatm_remote_ctx *ctx,
+					unsigned int size)
+{
+	struct sk_buff *skb;
+	unsigned int hroom_size;
+
+	hroom_size = fbxatm_remote_headroom(ctx);
+	skb = dev_alloc_skb(hroom_size + size);
+	if (!skb)
+		return NULL;
+	skb_reserve(skb, hroom_size);
+	return skb;
+}
+
+EXPORT_SYMBOL(fbxatm_remote_alloc_skb);
+
+/*
+ * return sock addr
+ */
+void fbxatm_remote_sock_getaddr(struct fbxatm_remote_sock *sock,
+				struct fbxatm_remote_sockaddr *addr)
+{
+	memcpy(addr, &sock->addr, sizeof (*addr));
+}
+
+EXPORT_SYMBOL(fbxatm_remote_sock_getaddr);
+
+/*
+ * socket retrans timer callback
+ */
+static void sock_timer(struct timer_list *timer)
+{
+	struct fbxatm_remote_sock *sock;
+	struct sk_buff *skb;
+
+	sock = container_of(timer, struct fbxatm_remote_sock, retrans_timer);
+
+	spin_lock_bh(&sock->ctx->lock);
+	spin_lock(&sock->lock);
+
+	if (!sock->addr.infinite_retry && sock->retrans_count >= MAX_RETRANS) {
+		printk(KERN_ERR PFX "retrans max reached\n");
+		sock->ctx->dead = 1;
+		dev_kfree_skb(sock->pending);
+		sock->pending = NULL;
+		if (sock->ctx->timeout_cb)
+			sock->ctx->timeout_cb(sock->ctx->priv);
+		spin_unlock(&sock->lock);
+		spin_unlock_bh(&sock->ctx->lock);
+		return;
+	}
+
+	sock->retrans_count++;
+	sock->retrans_timer.expires = jiffies + RETRANS_TIMER;
+
+	skb = skb_clone(sock->pending, GFP_ATOMIC);
+	if (skb)
+		dev_queue_xmit(skb);
+	add_timer(&sock->retrans_timer);
+
+	spin_unlock(&sock->lock);
+	spin_unlock_bh(&sock->ctx->lock);
+}
+
+/*
+ * append header for given socket
+ */
+static int append_tx_header(struct fbxatm_remote_sock *sock,
+			    struct sk_buff *skb)
+{
+	struct fbxatm_remote_hdr *hdr;
+	unsigned int needed;
+
+	needed = skb->dev->hard_header_len + skb->dev->needed_headroom +
+		sizeof (*hdr);
+
+	if (unlikely(skb_headroom(skb) < needed)) {
+		if (net_ratelimit())
+			printk(KERN_WARNING PFX "headroom too small %d < %d\n",
+			       skb_headroom(skb), needed);
+	}
+
+	if (skb_cow_head(skb, needed))
+		return 1;
+
+	hdr = (struct fbxatm_remote_hdr *)skb_push(skb, sizeof (*hdr));
+	skb_set_network_header(skb, 0);
+
+	put_unaligned(htonl(FBXATM_REMOTE_MAGIC), &hdr->magic);
+	if (sock->direction == 1) {
+		/* output */
+		hdr->flags = 0;
+	} else {
+		/* input */
+		hdr->flags = FBXATM_RFLAGS_ACK;
+	}
+	hdr->seq = sock->seq;
+	put_unaligned(htons(skb->len), &hdr->len);
+	put_unaligned(sock->addr.lport, &hdr->sport);
+	put_unaligned(sock->addr.dport, &hdr->dport);
+
+	put_unaligned(sock->addr.mtype, &hdr->mtype);
+	put_unaligned(sock->ctx->session_id, &hdr->session_id);
+
+	skb->protocol = htons(ETH_P_FBXATM_REMOTE);
+	if (dev_hard_header(skb, skb->dev, ETH_P_FBXATM_REMOTE,
+			    sock->ctx->remote_mac, NULL, skb->len) < 0)
+		return 1;
+
+	return 0;
+}
+
+/*
+ * purge socket send queue, advance next sequence
+ */
+void fbxatm_remote_sock_purge(struct fbxatm_remote_sock *sock)
+{
+	spin_lock_bh(&sock->lock);
+	if (sock->pending) {
+		del_timer_sync(&sock->retrans_timer);
+		dev_kfree_skb(sock->pending);
+		sock->pending = NULL;
+		sock->seq++;
+	}
+	spin_unlock_bh(&sock->lock);
+}
+
+EXPORT_SYMBOL(fbxatm_remote_sock_purge);
+
+/*
+ * check if tx is pending on socket
+ */
+int fbxatm_remote_sock_pending(struct fbxatm_remote_sock *sock)
+{
+	int ret;
+
+	spin_lock_bh(&sock->lock);
+	ret = sock->pending ? 1 : 0;
+	spin_unlock_bh(&sock->lock);
+	return ret;
+}
+
+EXPORT_SYMBOL(fbxatm_remote_sock_pending);
+
+/*
+ * send skb on socket
+ */
+int fbxatm_remote_sock_send(struct fbxatm_remote_sock *sock,
+			    struct sk_buff *skb)
+{
+	BUG_ON(sock->direction == 0);
+
+	spin_lock_bh(&sock->lock);
+	skb->dev = sock->ctx->netdev;
+
+	if (append_tx_header(sock, skb)) {
+		spin_unlock_bh(&sock->lock);
+		dev_kfree_skb(skb);
+		return 1;
+	}
+
+	if (unlikely(sock->ctx->dead)) {
+		spin_unlock_bh(&sock->lock);
+		dev_kfree_skb(skb);
+		return 0;
+	}
+
+	/* start retrans timer if needed */
+	if (sock->has_ack) {
+		if (sock->pending) {
+			printk(KERN_ERR PFX "sock already has tx pending\n");
+			spin_unlock_bh(&sock->lock);
+			dev_kfree_skb(skb);
+			return 1;
+		}
+
+		sock->pending = skb_clone(skb, GFP_ATOMIC);
+		if (sock->pending) {
+			sock->retrans_count = 0;
+			sock->retrans_timer.expires = jiffies + RETRANS_TIMER;
+			add_timer(&sock->retrans_timer);
+		}
+	}
+
+	spin_unlock_bh(&sock->lock);
+	dev_queue_xmit(skb);
+
+	return 0;
+}
+
+EXPORT_SYMBOL(fbxatm_remote_sock_send);
+
+/*
+ * send ack skb on socket
+ */
+int fbxatm_remote_sock_send_ack(struct fbxatm_remote_sock *sock,
+				struct sk_buff *skb)
+{
+	BUG_ON(sock->direction == 1);
+
+	spin_lock_bh(&sock->lock);
+
+	skb->dev = sock->ctx->netdev;
+
+	if (append_tx_header(sock, skb)) {
+		spin_unlock_bh(&sock->lock);
+		dev_kfree_skb(skb);
+		return 1;
+	}
+
+	if (unlikely(sock->ctx->dead)) {
+		spin_unlock_bh(&sock->lock);
+		dev_kfree_skb(skb);
+		return 0;
+	}
+
+	skb->dev = sock->ctx->netdev;
+	sock->pending = skb_clone(skb, GFP_ATOMIC);
+	spin_unlock_bh(&sock->lock);
+	dev_queue_xmit(skb);
+
+	return 0;
+}
+
+EXPORT_SYMBOL(fbxatm_remote_sock_send_ack);
+
+/*
+ * send raw ack
+ */
+int fbxatm_remote_sock_send_raw_ack(struct fbxatm_remote_ctx *ctx,
+				    struct net_device *dev,
+				    u8 *remote_mac,
+				    struct fbxatm_remote_hdr *hdr,
+				    struct sk_buff *ack)
+{
+	struct fbxatm_remote_hdr *ack_hdr;
+
+	if (skb_cow_head(ack, sizeof (*ack_hdr))) {
+		dev_kfree_skb(ack);
+		return 1;
+	}
+
+	ack_hdr = (struct fbxatm_remote_hdr *)skb_push(ack, sizeof (*hdr));
+	skb_set_network_header(ack, 0);
+
+	put_unaligned(htonl(FBXATM_REMOTE_MAGIC), &ack_hdr->magic);
+	ack_hdr->flags = FBXATM_RFLAGS_ACK;
+	ack_hdr->seq = hdr->seq;
+
+	put_unaligned(htons(ack->len), &ack_hdr->len);
+	put_unaligned(hdr->dport, &ack_hdr->sport);
+	put_unaligned(hdr->sport, &ack_hdr->dport);
+	put_unaligned(hdr->mtype, &ack_hdr->mtype);
+	put_unaligned(hdr->session_id, &ack_hdr->session_id);
+
+	ack->dev = dev;
+
+	if (dev_hard_header(ack, dev, ETH_P_FBXATM_REMOTE,
+			    remote_mac, NULL, ack->len) < 0) {
+		dev_kfree_skb(ack);
+		return 1;
+	}
+
+	if (hdr->dport == 0) {
+		kfree(ctx->pending_zero_ack);
+		ctx->pending_zero_ack = skb_clone(ack, GFP_ATOMIC);
+	}
+
+	if (dev_queue_xmit(ack))
+		return 1;
+
+	return 0;
+}
+
+EXPORT_SYMBOL(fbxatm_remote_sock_send_raw_ack);
+
+/*
+ * handle input data on 'in' direction socket
+ */
+static void __in_sock_rcv(struct fbxatm_remote_sock *sock,
+			  struct sk_buff *skb,
+			  struct fbxatm_remote_hdr *hdr)
+{
+	struct sk_buff *ack;
+	int ret;
+
+	spin_lock(&sock->lock);
+
+	if (sock->has_ack) {
+		u8 expected_seq;
+
+		/* check for duplicate seq  */
+		if (hdr->seq == sock->seq) {
+
+			/* got last packet again, ack has been
+			 * lost, send it again if we have it */
+			if (sock->pending) {
+				ack = skb_clone(sock->pending, GFP_ATOMIC);
+				if (ack)
+					dev_queue_xmit(ack);
+			}
+
+			spin_unlock(&sock->lock);
+			dev_kfree_skb(skb);
+			return;
+		}
+
+		expected_seq = sock->seq + 1;
+		if (hdr->seq != expected_seq) {
+			/* lost sync */
+			spin_unlock(&sock->lock);
+			dev_kfree_skb(skb);
+			return;
+		}
+
+		/* about to accept new packet, free any pending ack */
+		dev_kfree_skb(sock->pending);
+		sock->pending = NULL;
+
+		sock->seq = hdr->seq;
+
+		/* set sock dport to last receive packet to send
+		 * correct ack */
+		sock->addr.dport = hdr->sport;
+	}
+
+	/* deliver packet to socket */
+	ret = sock->addr.deliver(sock->addr.priv, skb, &ack);
+
+	if (!sock->has_ack || !ret) {
+		/* don't send ack now */
+		spin_unlock(&sock->lock);
+		return;
+	}
+
+	if (!ack) {
+		/* generate empty ack */
+		ack = fbxatm_remote_alloc_skb(sock->ctx, 0);
+		if (!ack) {
+			spin_unlock(&sock->lock);
+			return;
+		}
+	}
+
+	ack->dev = sock->ctx->netdev;
+
+	if (append_tx_header(sock, ack)) {
+		spin_unlock(&sock->lock);
+		dev_kfree_skb(ack);
+		return;
+	}
+
+	sock->pending = ack;
+
+	/* send ack now */
+	ack = skb_clone(sock->pending, GFP_ATOMIC);
+	spin_unlock(&sock->lock);
+
+	if (ack)
+		dev_queue_xmit(ack);
+}
+
+/*
+ * handle data on 'out' direction socket
+ */
+static void __out_sock_rcv(struct fbxatm_remote_sock *sock,
+			   struct sk_buff *skb,
+			   struct fbxatm_remote_hdr *hdr)
+{
+	if (!sock->has_ack) {
+		dev_kfree_skb(skb);
+		printk(KERN_ERR PFX "ack for non ack sock\n");
+		return;
+	}
+
+	spin_lock(&sock->lock);
+
+	/* check if ack if for last sent seq */
+	if (hdr->seq != sock->seq) {
+		spin_unlock(&sock->lock);
+		dev_kfree_skb(skb);
+		return;
+	}
+
+	/* make sure we're expecting it */
+	if (!sock->pending) {
+		spin_unlock(&sock->lock);
+		dev_kfree_skb(skb);
+		return;
+	}
+
+	del_timer_sync(&sock->retrans_timer);
+	dev_kfree_skb(sock->pending);
+	sock->pending = NULL;
+	sock->seq++;
+
+	if (sock->addr.response)
+		sock->addr.response(sock->addr.priv, skb);
+	else
+		dev_kfree_skb(skb);
+
+	spin_unlock(&sock->lock);
+}
+
+/*
+ * fbxatm ethertype rx callback
+ */
+static int fbxatm_rcv(struct sk_buff *skb, struct net_device *dev,
+		      struct packet_type *pt, struct net_device *orig_dev)
+{
+	struct fbxatm_remote_hdr *hdr;
+	struct fbxatm_remote_ctx *ctx;
+	int found;
+	unsigned int len;
+	u16 port;
+
+	if (!netif_running(dev)) {
+		dev_kfree_skb(skb);
+		return 0;
+	}
+
+	skb = skb_unshare(skb, GFP_ATOMIC);
+	if (!skb)
+		return 0;
+
+	/* decode fbxatm ethertype */
+	if (!pskb_may_pull(skb, sizeof (*hdr))) {
+		dev_kfree_skb(skb);
+		return 0;
+	}
+
+	hdr = (struct fbxatm_remote_hdr *)skb_network_header(skb);
+	if (ntohl(hdr->magic) != FBXATM_REMOTE_MAGIC) {
+		if (net_ratelimit())
+			printk(KERN_ERR PFX "bad fbxatm remote magic: %08x\n",
+			       ntohl(hdr->magic));
+		dev_kfree_skb(skb);
+		return 0;
+	}
+
+	/* check len */
+	len = ntohs(hdr->len);
+	if (skb->len < len) {
+		if (net_ratelimit())
+			printk(KERN_ERR PFX "short packet\n");
+		dev_kfree_skb(skb);
+		return 0;
+	}
+
+	/* trim skb to correct size */
+	if (pskb_trim(skb, len)) {
+		dev_kfree_skb(skb);
+		return 0;
+	}
+
+	port = ntohs(hdr->dport);
+	if (port >= MAX_PORTS) {
+		dev_kfree_skb(skb);
+		printk(KERN_ERR PFX "bad port %u\n", port);
+		return 0;
+	}
+
+	/* remove header */
+	skb_set_network_header(skb, 0);
+	__skb_pull(skb, sizeof (*hdr));
+	skb_set_transport_header(skb, 0);
+
+	/* find context by mac/session id */
+	found = 0;
+	spin_lock_bh(&ctx_list_lock);
+	list_for_each_entry(ctx, &ctx_list, next) {
+		struct ethhdr *eth;
+		struct fbxatm_remote_sock *sock;
+		int is_ack;
+
+		eth = eth_hdr(skb);
+		if (memcmp(eth->h_source, ctx->remote_mac, ETH_ALEN))
+			continue;
+
+		if (hdr->session_id != ctx->session_id)
+			continue;
+
+		spin_lock(&ctx->lock);
+
+		if (unlikely(ctx->dead)) {
+			spin_unlock(&ctx->lock);
+			continue;
+		}
+
+		/* found context, find socket by port */
+		found = 1;
+
+		/* special case for port 0, in case ack is lost */
+		if (port == 0 && ctx->pending_zero_ack) {
+			struct sk_buff *ack;
+			ack = skb_clone(ctx->pending_zero_ack, GFP_ATOMIC);
+			if (ack)
+				dev_queue_xmit(ack);
+			spin_unlock(&ctx->lock);
+			break;
+		}
+
+		sock = ctx->socks_per_lport[port];
+		if (!sock) {
+			printk(KERN_ERR PFX "context but no socket for "
+			       "port: %u\n", port);
+			spin_unlock(&ctx->lock);
+			break;
+		}
+
+		if (hdr->mtype != sock->addr.mtype) {
+			printk(KERN_ERR PFX "incorrect mtype for sock\n");
+			spin_unlock(&ctx->lock);
+			break;
+		}
+
+		/* check direction, we should only get ack for output
+		 * socket */
+		is_ack = (hdr->flags & FBXATM_RFLAGS_ACK) ? 1 : 0;
+		if (sock->direction ^ is_ack) {
+			printk(KERN_ERR PFX "incorrect ack value for sock\n");
+			spin_unlock(&ctx->lock);
+			break;
+		}
+
+		/* ok deliver */
+		if (sock->direction)
+			__out_sock_rcv(sock, skb, hdr);
+		else
+			__in_sock_rcv(sock, skb, hdr);
+
+		spin_unlock(&ctx->lock);
+		spin_unlock_bh(&ctx_list_lock);
+		return 0;
+	}
+
+	spin_unlock_bh(&ctx_list_lock);
+
+	if (!found && unknown_cb)
+		unknown_cb(dev, skb);
+	else
+		dev_kfree_skb(skb);
+
+	return 0;
+}
+
+void fbxatm_remote_set_unknown_cb(void (*cb)(struct net_device *,
+					     struct sk_buff *))
+{
+	unknown_cb = cb;
+}
+
+EXPORT_SYMBOL(fbxatm_remote_set_unknown_cb);
+
+/*
+ * allocate local port for socket
+ */
+static int __alloc_lport(struct fbxatm_remote_ctx *ctx,
+			 struct fbxatm_remote_sock *sock)
+{
+	int i;
+
+	for (i = 1; i < ARRAY_SIZE(ctx->socks_per_lport); i++) {
+		if (ctx->socks_per_lport[i])
+			continue;
+		sock->addr.lport = htons(i);
+		ctx->socks_per_lport[i] = sock;
+		return 0;
+	}
+	return -EADDRINUSE;
+}
+
+static struct fbxatm_remote_sock *sock_new(struct fbxatm_remote_sockaddr *addr)
+{
+	struct fbxatm_remote_sock *sock;
+
+	sock = kzalloc(sizeof (*sock), GFP_KERNEL);
+	if (!sock)
+		return NULL;
+	memcpy(&sock->addr, addr, sizeof (*addr));
+	timer_setup(&sock->retrans_timer, sock_timer, 0);
+	spin_lock_init(&sock->lock);
+	return sock;
+}
+
+struct fbxatm_remote_sock *
+fbxatm_remote_sock_connect(struct fbxatm_remote_ctx *ctx,
+			   struct fbxatm_remote_sockaddr *addr,
+			   int need_ack)
+{
+	struct fbxatm_remote_sock *sock;
+
+	sock = sock_new(addr);
+	if (!sock)
+		return NULL;
+
+	spin_lock_bh(&ctx->lock);
+	sock->ctx = ctx;
+	if (__alloc_lport(ctx, sock)) {
+		spin_unlock_bh(&ctx->lock);
+		kfree(sock);
+		return NULL;
+	}
+
+	sock->direction = 1;
+	sock->seq = 0;
+	sock->has_ack = need_ack;
+	spin_unlock_bh(&ctx->lock);
+
+	return sock;
+}
+
+EXPORT_SYMBOL(fbxatm_remote_sock_connect);
+
+struct fbxatm_remote_sock *
+fbxatm_remote_sock_bind(struct fbxatm_remote_ctx *ctx,
+			struct fbxatm_remote_sockaddr *addr,
+			int send_ack)
+{
+	struct fbxatm_remote_sock *sock;
+
+	sock = sock_new(addr);
+	if (!sock)
+		return NULL;
+
+	spin_lock_bh(&ctx->lock);
+	sock->ctx = ctx;
+	if (__alloc_lport(ctx, sock)) {
+		spin_unlock_bh(&ctx->lock);
+		kfree(sock);
+		return NULL;
+	}
+
+	sock->direction = 0;
+	sock->seq = ~0;
+	sock->has_ack = send_ack;
+	spin_unlock_bh(&ctx->lock);
+
+	return sock;
+}
+
+EXPORT_SYMBOL(fbxatm_remote_sock_bind);
+
+void fbxatm_remote_sock_close(struct fbxatm_remote_sock *sock)
+{
+	spin_lock_bh(&sock->ctx->lock);
+	if (sock->addr.lport)
+		sock->ctx->socks_per_lport[ntohs(sock->addr.lport)] = NULL;
+
+	spin_lock(&sock->lock);
+	del_timer_sync(&sock->retrans_timer);
+	dev_kfree_skb(sock->pending);
+	spin_unlock(&sock->lock);
+	spin_unlock_bh(&sock->ctx->lock);
+	kfree(sock);
+}
+
+EXPORT_SYMBOL(fbxatm_remote_sock_close);
+
+struct fbxatm_remote_ctx *fbxatm_remote_alloc_ctx(struct net_device *netdev,
+						  u8 *remote_mac,
+						  u32 session_id,
+						  void (*timeout)(void *priv),
+						  void *priv)
+{
+	struct fbxatm_remote_ctx *ctx;
+
+	ctx = kzalloc(sizeof (*ctx), GFP_KERNEL);
+	if (!ctx)
+		return NULL;
+	ctx->netdev = netdev;
+	spin_lock_init(&ctx->lock);
+	memcpy(ctx->remote_mac, remote_mac, ETH_ALEN);
+	ctx->session_id = session_id;
+	ctx->timeout_cb = timeout;
+	ctx->priv = priv;
+
+	spin_lock_bh(&ctx_list_lock);
+	list_add_tail(&ctx->next, &ctx_list);
+	spin_unlock_bh(&ctx_list_lock);
+
+	return ctx;
+}
+
+EXPORT_SYMBOL(fbxatm_remote_alloc_ctx);
+
+void fbxatm_remote_ctx_set_dead(struct fbxatm_remote_ctx *ctx)
+{
+	spin_lock_bh(&ctx->lock);
+	ctx->dead = 1;
+	spin_unlock_bh(&ctx->lock);
+}
+
+EXPORT_SYMBOL(fbxatm_remote_ctx_set_dead);
+
+void fbxatm_remote_free_ctx(struct fbxatm_remote_ctx *ctx)
+{
+	int i;
+
+	spin_lock_bh(&ctx_list_lock);
+	spin_lock(&ctx->lock);
+
+	for (i = 1; i < ARRAY_SIZE(ctx->socks_per_lport); i++) {
+		if (!ctx->socks_per_lport[i])
+			continue;
+		printk(KERN_ERR PFX "socket count is not 0\n");
+		spin_unlock(&ctx->lock);
+		spin_unlock_bh(&ctx_list_lock);
+		return;
+	}
+
+	kfree(ctx->pending_zero_ack);
+	list_del(&ctx->next);
+	spin_unlock(&ctx->lock);
+	spin_unlock_bh(&ctx_list_lock);
+	kfree(ctx);
+}
+
+EXPORT_SYMBOL(fbxatm_remote_free_ctx);
+
+static struct packet_type fbxatm_packet_type = {
+	.type	= __constant_htons(ETH_P_FBXATM_REMOTE),
+	.func	= fbxatm_rcv,
+};
+
+int fbxatm_remote_init(void)
+{
+	spin_lock_init(&ctx_list_lock);
+	INIT_LIST_HEAD(&ctx_list);
+	dev_add_pack(&fbxatm_packet_type);
+	return 0;
+}
+
+EXPORT_SYMBOL(fbxatm_remote_init);
+
+void fbxatm_remote_exit(void)
+{
+	dev_remove_pack(&fbxatm_packet_type);
+}
+
+EXPORT_SYMBOL(fbxatm_remote_exit);
diff -Nruw linux-5.4.60-fbx/net/fbxatm./fbxatm_remote_driver.c linux-5.4.60-fbx/net/fbxatm/fbxatm_remote_driver.c
--- linux-5.4.60-fbx/net/fbxatm./fbxatm_remote_driver.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxatm/fbxatm_remote_driver.c	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,1185 @@
+/*
+ * "remote" driver for fbxatm, "connect" to a remote fbxatm stack in
+ * net stub mode and control its PHYs
+ *
+ * Copyright (C) 2009 Maxime Bizon <mbizon@freebox.fr>
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/sched.h>
+#include <linux/of.h>
+#include <linux/of_net.h>
+
+#include "fbxatm_remote_driver.h"
+
+#define PFX	"fbxatm_remote_driver: "
+
+static struct list_head remote_dev_list;
+static DEFINE_SPINLOCK(remote_lock);
+
+/*
+ * request moving to dead state and schedule
+ */
+static void set_dying(struct driver_remote *priv)
+{
+	priv->want_die = 1;
+	schedule_delayed_work(&priv->fsm_work, 0);
+}
+
+/*
+ * socket deliver callback for vcc_rx socket
+ */
+static int vcc_rx_deliver(void *data, struct sk_buff *skb,
+			  struct sk_buff **ack)
+{
+	struct driver_remote_vcc *pvcc;
+
+	pvcc = (struct driver_remote_vcc *)data;
+	fbxatm_netifrx(pvcc->vcc, skb);
+	return 0;
+}
+
+/*
+ * socket deliver callback for vcc_qempty socket
+ */
+static int vcc_qempty_deliver(void *data, struct sk_buff *skb,
+			      struct sk_buff **ack)
+{
+	struct driver_remote_vcc *pvcc;
+	struct driver_remote *priv;
+
+	pvcc = (struct driver_remote_vcc *)data;
+	priv = pvcc->priv;
+
+	spin_lock(&priv->tx_lock);
+
+	if (pvcc->tx_pending) {
+		/* wait until we get tx ack */
+		pvcc->tx_got_qempty = 1;
+		goto send_ack;
+	}
+
+	/* report tx done event */
+	clear_bit(FBXATM_VCC_F_FULL, &pvcc->vcc->vcc_flags);
+
+send_ack:
+	dev_kfree_skb(skb);
+	*ack = NULL;
+	spin_unlock(&priv->tx_lock);
+	/* send ack now */
+	fbxatm_tx_done(pvcc->vcc);
+	return 1;
+}
+
+/*
+ * socket response callback for vcc_send socket, called with bh
+ * disabled
+ */
+static void vcc_send_response(void *data, struct sk_buff *skb)
+{
+	struct fbxatm_remote_vcc_send_ack *pkt_ack;
+	struct driver_remote_vcc *pvcc;
+	struct driver_remote *priv;
+
+	pvcc = (struct driver_remote_vcc *)data;
+	priv = pvcc->priv;
+
+	spin_lock(&priv->tx_lock);
+
+	if (unlikely(!pvcc->tx_pending)) {
+		printk(KERN_ERR PFX "send response while no tx pending\n");
+		goto out;
+	}
+
+	if (!pskb_may_pull(skb, sizeof (*pkt_ack))) {
+		printk(KERN_ERR PFX "bad vcc send ack\n");
+		goto out;
+	}
+
+	pvcc->tx_pending = 0;
+
+	pkt_ack = (struct fbxatm_remote_vcc_send_ack *)skb->data;
+	if (pkt_ack->full) {
+		/* qempty will wake us up later, but maybe we got it
+		 * already ? */
+		if (!pvcc->tx_got_qempty)
+			goto out;
+	}
+
+	/* wake up queue */
+	clear_bit(FBXATM_VCC_F_FULL, &pvcc->vcc->vcc_flags);
+	spin_unlock(&priv->tx_lock);
+	dev_kfree_skb(skb);
+	fbxatm_tx_done(pvcc->vcc);
+	return;
+
+out:
+	spin_unlock(&priv->tx_lock);
+	dev_kfree_skb(skb);
+}
+
+/*
+ * fbxatm request to send aal5 on given vcc, called with bh disabled
+ */
+static int remote_send(struct fbxatm_vcc *vcc, struct sk_buff *skb)
+{
+	struct driver_remote_vcc *pvcc;
+	struct driver_remote *priv;
+
+	pvcc = vcc->dev_priv;
+	priv = pvcc->priv;
+
+	spin_lock(&priv->tx_lock);
+	if (priv->state != RSTATE_S_ACTIVE)
+		goto drop;
+
+	if (test_bit(FBXATM_VCC_F_FULL, &vcc->vcc_flags)) {
+		spin_unlock(&priv->tx_lock);
+		/* return queue full */
+		return 1;
+	}
+
+	if (fbxatm_remote_sock_send(pvcc->vcc_send_sock, skb)) {
+		/* packet has been dropped */
+		spin_unlock(&priv->tx_lock);
+		return 0;
+	}
+
+	set_bit(FBXATM_VCC_F_FULL, &vcc->vcc_flags);
+	pvcc->tx_pending = 1;
+	pvcc->tx_got_qempty = 0;
+
+	spin_unlock(&priv->tx_lock);
+	return 0;
+
+drop:
+	spin_unlock(&priv->tx_lock);
+	dev_kfree_skb(skb);
+	return 0;
+}
+
+/*
+ * sleep until we get an ack for sockets using wq
+ */
+static int __wait_ack(struct driver_remote *priv)
+{
+	wait_event(priv->wq, priv->wq_res != 0 ||
+		   priv->state != RSTATE_S_ACTIVE);
+
+	if (priv->wq_res == 2 || priv->state != RSTATE_S_ACTIVE) {
+		/* timeout or device will die soon */
+		return -EIO;
+	}
+
+	return 0;
+}
+
+/*
+ * fbxatm callback to send oam cell
+ */
+static int remote_send_oam(struct fbxatm_dev *adev,
+			   struct fbxatm_oam_cell *cell)
+{
+	struct driver_remote *priv;
+	struct sk_buff *skb;
+	int ret;
+
+	priv = fbxatm_dev_priv(adev);
+	mutex_lock(&priv->mutex);
+
+	if (priv->state != RSTATE_S_ACTIVE) {
+		mutex_unlock(&priv->mutex);
+		return -ENODEV;
+	}
+
+	/* prepare outgoing packet */
+	skb = fbxatm_remote_alloc_skb(priv->remote_ctx,
+				      sizeof (cell->payload));
+	if (!skb) {
+		mutex_unlock(&priv->mutex);
+		kfree(cell);
+		return -ENOMEM;
+	}
+
+	memcpy(skb_put(skb, sizeof (cell->payload)), &cell->payload,
+	       sizeof (cell->payload));
+	kfree(cell);
+
+	/* send & wait for ack */
+	skb_queue_purge(&priv->wq_acks);
+	priv->wq_res = 0;
+
+	if (fbxatm_remote_sock_send(priv->dev_send_oam_sock, skb))
+		return -ENOMEM;
+
+	ret = __wait_ack(priv);
+	mutex_unlock(&priv->mutex);
+
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/*
+ * fbxatm callback to open given vcc
+ */
+static int remote_vcc_open(struct fbxatm_vcc *vcc)
+{
+	struct fbxatm_remote_vcc_action *pkt;
+	struct fbxatm_remote_vcc_action_ack *pkt_ack;
+	struct sk_buff *skb, *ack;
+	struct fbxatm_remote_sockaddr addr;
+	struct driver_remote_vcc *pvcc;
+	struct driver_remote *priv;
+	int ret;
+
+	priv = fbxatm_dev_priv(vcc->adev);
+	mutex_lock(&priv->mutex);
+
+	if (priv->state != RSTATE_S_ACTIVE) {
+		mutex_unlock(&priv->mutex);
+		return -EIO;
+	}
+
+	/* allocate private vcc context */
+	pvcc = kzalloc(sizeof (*pvcc), GFP_KERNEL);
+	if (!pvcc) {
+		mutex_unlock(&priv->mutex);
+		return -ENOMEM;
+	}
+
+	pvcc->priv = priv;
+	pvcc->vcc = vcc;
+	vcc->dev_priv = pvcc;
+
+	/* open input sockets */
+	memset(&addr, 0, sizeof (addr));
+	addr.mtype = htonl(FBXATM_RMT_VCC_RX);
+	addr.priv = pvcc;
+	addr.deliver = vcc_rx_deliver;
+	pvcc->vcc_rx_sock = fbxatm_remote_sock_bind(priv->remote_ctx,
+						    &addr, 0);
+	if (!pvcc->vcc_rx_sock) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	memset(&addr, 0, sizeof (addr));
+	addr.mtype = htonl(FBXATM_RMT_VCC_QEMPTY);
+	addr.priv = pvcc;
+	addr.deliver = vcc_qempty_deliver;
+	pvcc->vcc_qempty_sock = fbxatm_remote_sock_bind(priv->remote_ctx,
+							&addr, 1);
+	if (!pvcc->vcc_qempty_sock) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	/* prepare outgoing packet */
+	skb = fbxatm_remote_alloc_skb(priv->remote_ctx,
+				      sizeof (*pkt));
+	if (!skb) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+	pkt = (struct fbxatm_remote_vcc_action *)skb_put(skb, sizeof (*pkt));
+	pkt->action = htonl(1);
+
+	fbxatm_remote_sock_getaddr(pvcc->vcc_rx_sock, &addr);
+	pkt->vcc_rx_port = addr.lport;
+
+	fbxatm_remote_sock_getaddr(pvcc->vcc_qempty_sock, &addr);
+	pkt->vcc_qempty_port = addr.lport;
+
+	pkt->vpi = htonl(vcc->vpi);
+	pkt->vci = htonl(vcc->vci);
+	pkt->traffic_class = htonl(vcc->qos.traffic_class);
+	pkt->max_sdu = htonl(vcc->qos.max_sdu);
+	pkt->max_buffered_pkt = htonl(vcc->qos.max_buffered_pkt);
+	pkt->priority = htonl(vcc->qos.priority);
+	pkt->rx_priority = htonl(vcc->qos.rx_priority);
+
+	/* send & wait for ack */
+	skb_queue_purge(&priv->wq_acks);
+	priv->wq_res = 0;
+
+	if (fbxatm_remote_sock_send(priv->vcc_action_sock, skb)) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	ret = __wait_ack(priv);
+
+	if (ret) {
+		/* timeout, device will die soon */
+		goto fail;
+	}
+
+	/* check ack */
+	ack = skb_dequeue(&priv->wq_acks);
+	if (!pskb_may_pull(ack, sizeof (*pkt_ack))) {
+		printk(KERN_ERR PFX "bad vcc action ack\n");
+		dev_kfree_skb(ack);
+		set_dying(priv);
+		ret = -EIO;
+		goto fail;
+	}
+
+	pkt_ack = (struct fbxatm_remote_vcc_action_ack *)ack->data;
+	if (pkt_ack->ret) {
+		printk(KERN_ERR PFX "remote vcc open failed\n");
+		dev_kfree_skb(ack);
+		set_dying(priv);
+		ret = -EIO;
+		goto fail;
+	}
+
+	pvcc->remote_id = pkt_ack->vcc_remote_id;
+
+	memset(&addr, 0, sizeof (addr));
+	addr.mtype = htonl(FBXATM_RMT_VCC_SEND);
+	addr.priv = pvcc;
+	addr.dport = pkt_ack->vcc_send_port;
+	addr.response = vcc_send_response;
+	pvcc->vcc_send_sock = fbxatm_remote_sock_connect(priv->remote_ctx,
+							 &addr, 1);
+	if (!pvcc->vcc_send_sock) {
+		dev_kfree_skb(ack);
+		set_dying(priv);
+		ret = -EIO;
+		goto fail;
+	}
+
+	dev_kfree_skb(ack);
+	list_add(&pvcc->next, &priv->pvcc_list);
+	mutex_unlock(&priv->mutex);
+	return 0;
+
+fail:
+	if (pvcc->vcc_qempty_sock)
+		fbxatm_remote_sock_close(pvcc->vcc_qempty_sock);
+	if (pvcc->vcc_rx_sock)
+		fbxatm_remote_sock_close(pvcc->vcc_rx_sock);
+	kfree(pvcc);
+	mutex_unlock(&priv->mutex);
+	return ret;
+}
+
+/*
+ * fbxatm callback to close & flush given vcc
+ */
+static void remote_vcc_close(struct fbxatm_vcc *vcc)
+{
+	struct driver_remote *priv;
+	struct driver_remote_vcc *pvcc;
+	struct sk_buff *skb, *ack;
+	struct fbxatm_remote_vcc_action *pkt;
+	struct fbxatm_remote_vcc_action_ack *pkt_ack;
+	int ret;
+
+	priv = fbxatm_dev_priv(vcc->adev);
+	mutex_lock(&priv->mutex);
+
+	pvcc = vcc->dev_priv;
+
+	if (priv->state != RSTATE_S_ACTIVE) {
+		/* just close vcc, don't tell remote */
+		list_del(&pvcc->next);
+		kfree(pvcc);
+
+		/* warn fsm so it can restart */
+		schedule_delayed_work(&priv->fsm_work, 0);
+		goto out_unlock;
+	}
+
+	/* prepare outgoing packet */
+	skb = fbxatm_remote_alloc_skb(priv->remote_ctx,
+				      sizeof (*pkt));
+	if (!skb) {
+		set_dying(priv);
+		goto out_unlock;
+	}
+
+	pkt = (struct fbxatm_remote_vcc_action *)skb_put(skb, sizeof (*pkt));
+	pkt->action = htonl(0);
+	pkt->vcc_remote_id = pvcc->remote_id;
+
+	/* free vcc now, failure will trigger dead state */
+	fbxatm_remote_sock_close(pvcc->vcc_send_sock);
+	fbxatm_remote_sock_close(pvcc->vcc_rx_sock);
+	fbxatm_remote_sock_close(pvcc->vcc_qempty_sock);
+	list_del(&pvcc->next);
+	kfree(pvcc);
+
+	/* send & wait for ack */
+	skb_queue_purge(&priv->wq_acks);
+	priv->wq_res = 0;
+
+	if (fbxatm_remote_sock_send(priv->vcc_action_sock, skb)) {
+		set_dying(priv);
+		goto out_unlock;
+	}
+
+	ret = __wait_ack(priv);
+
+	if (ret) {
+		/* timeout, device will die soon */
+		mutex_unlock(&priv->mutex);
+		return;
+	}
+
+	/* check ack */
+	ack = skb_dequeue(&priv->wq_acks);
+	if (!pskb_may_pull(ack, sizeof (*pkt_ack))) {
+		printk(KERN_ERR PFX "bad vcc action close ack\n");
+		dev_kfree_skb(ack);
+		set_dying(priv);
+		goto out_unlock;
+	}
+
+	pkt_ack = (struct fbxatm_remote_vcc_action_ack *)ack->data;
+	if (pkt_ack->ret) {
+		printk(KERN_ERR PFX "remote vcc close failed\n");
+		dev_kfree_skb(ack);
+		set_dying(priv);
+		goto out_unlock;
+	}
+
+out_unlock:
+	mutex_unlock(&priv->mutex);
+}
+
+/*
+ * common response for vcc action & send oam socket
+ */
+static void common_response(void *data, struct sk_buff *skb)
+{
+	struct driver_remote *priv;
+
+	priv = (struct driver_remote *)data;
+	skb_queue_tail(&priv->wq_acks, skb);
+	priv->wq_res = 1;
+	wake_up(&priv->wq);
+}
+
+/*
+ * create device procfs entries
+ */
+static int remote_init_procfs(struct fbxatm_dev *adev)
+{
+	return 0;
+}
+
+/*
+ * release device procfs entries
+ */
+static void remote_release_procfs(struct fbxatm_dev *adev)
+{
+}
+
+/*
+ * local fake fbxatm device callbacks
+ */
+static const struct fbxatm_dev_ops remote_fbxatm_ops = {
+	.open		= remote_vcc_open,
+	.close		= remote_vcc_close,
+	.send		= remote_send,
+	.send_oam	= remote_send_oam,
+	.init_procfs	= remote_init_procfs,
+	.release_procfs	= remote_release_procfs,
+	.owner		= THIS_MODULE,
+};
+
+/*
+ * dev_rx_oam socket rx callback
+ */
+static int dev_rx_oam_deliver(void *data, struct sk_buff *skb,
+			      struct sk_buff **ack)
+{
+	struct driver_remote *priv;
+
+	priv = (struct driver_remote *)data;
+	skb_queue_tail(&priv->dev_oam_reqs, skb);
+	schedule_delayed_work(&priv->fsm_work, 0);
+
+	return 0;
+}
+
+/*
+ * dev_link socket rx callback
+ */
+static int dev_link_deliver(void *data, struct sk_buff *skb,
+			    struct sk_buff **ack)
+{
+	struct driver_remote *priv;
+
+	priv = (struct driver_remote *)data;
+	skb_queue_tail(&priv->dev_link_reqs, skb);
+	schedule_delayed_work(&priv->fsm_work, 0);
+
+	/* send ack later */
+	return 0;
+}
+
+/*
+ * dev_connect socket tx ack callback
+ */
+static void dev_connect_response(void *data, struct sk_buff *skb)
+{
+	struct driver_remote *priv;
+
+	priv = (struct driver_remote *)data;
+	skb_queue_tail(&priv->connect_acks, skb);
+	schedule_delayed_work(&priv->fsm_work, 0);
+}
+
+/*
+ * handle link change queue
+ */
+static void handle_dev_link_queue(struct driver_remote *priv)
+{
+	struct sk_buff *skb;
+
+	do {
+		struct fbxatm_remote_dev_link *pkt;
+		struct fbxatm_dev *adev;
+		struct sk_buff *ack;
+
+		skb = skb_dequeue(&priv->dev_link_reqs);
+		if (!skb)
+			break;
+
+		if (!pskb_may_pull(skb, sizeof (*pkt))) {
+			printk(KERN_ERR PFX "bad rx dev link\n");
+			dev_kfree_skb(skb);
+			continue;
+		}
+
+		pkt = (struct fbxatm_remote_dev_link *)skb->data;
+
+		adev = priv->fbxatm_dev;
+		adev->link_rate_ds = ntohl(pkt->link_rate_ds);
+		adev->link_rate_us = ntohl(pkt->link_rate_us);
+		adev->link_cell_rate_ds = ntohl(pkt->link_cell_rate_ds);
+		adev->link_cell_rate_us = ntohl(pkt->link_cell_rate_us);
+
+		if (pkt->link)
+			fbxatm_dev_set_link_up(adev);
+		else
+			fbxatm_dev_set_link_down(adev);
+
+		/* send ack */
+		ack = fbxatm_remote_alloc_skb(priv->remote_ctx, 0);
+		if (!ack)
+			continue;
+		fbxatm_remote_sock_send_ack(priv->dev_link_sock, ack);
+
+	} while (1);
+}
+
+/*
+ * handle oam rx queue
+ */
+static void handle_oam_rx_queue(struct driver_remote *priv)
+{
+	struct fbxatm_oam_cell *cell;
+	struct sk_buff *skb;
+
+	do {
+		skb = skb_dequeue(&priv->dev_oam_reqs);
+		if (!skb)
+			break;
+
+		cell = kmalloc(sizeof (*cell), GFP_KERNEL);
+		if (!cell) {
+			dev_kfree_skb(skb);
+			continue;
+		}
+
+		if (!pskb_may_pull(skb, sizeof (cell->payload))) {
+			printk(KERN_ERR PFX "bad rx oam\n");
+			kfree(cell);
+			dev_kfree_skb(skb);
+			continue;
+		}
+
+		memcpy(&cell->payload, skb->data, sizeof (cell->payload));
+		dev_kfree_skb(skb);
+		fbxatm_netifrx_oam(priv->fbxatm_dev, cell);
+
+	} while (1);
+}
+
+/*
+ * free all and set to dead state
+ */
+static void remote_free(struct driver_remote *priv)
+{
+	struct driver_remote_vcc *pvcc;
+
+	if (priv->state == RSTATE_S_DEAD)
+		return;
+
+	priv->want_die = 0;
+
+	/* make sure remote_send device operation doesn't use sockets
+	 * any more */
+	spin_lock_bh(&priv->tx_lock);
+	priv->state = RSTATE_S_DEAD;
+	spin_unlock_bh(&priv->tx_lock);
+
+	/* same goes for open_vcc, close_vcc and send_oam ops,
+	 * RSTATE_S_DEAD will prevent function from being entered, and
+	 * any sleeper will be woken up */
+	wake_up(&priv->wq);
+
+	mutex_lock(&priv->mutex);
+
+	/* no vcc can be created, close all vcc sockets */
+	list_for_each_entry(pvcc, &priv->pvcc_list, next) {
+
+		if (pvcc->vcc_send_sock) {
+			fbxatm_remote_sock_close(pvcc->vcc_send_sock);
+			pvcc->vcc_send_sock = NULL;
+		}
+
+		if (pvcc->vcc_rx_sock) {
+			fbxatm_remote_sock_close(pvcc->vcc_rx_sock);
+			pvcc->vcc_rx_sock = NULL;
+		}
+
+		if (pvcc->vcc_qempty_sock) {
+			fbxatm_remote_sock_close(pvcc->vcc_qempty_sock);
+			pvcc->vcc_qempty_sock = NULL;
+		}
+	}
+	mutex_unlock(&priv->mutex);
+
+	/* no external callback from fbxatm can use sockets now */
+
+	/* close all sockets */
+	if (priv->dev_connect_sock) {
+		fbxatm_remote_sock_close(priv->dev_connect_sock);
+		priv->dev_connect_sock = NULL;
+	}
+
+	if (priv->keepalive_sock) {
+		fbxatm_remote_sock_close(priv->keepalive_sock);
+		priv->keepalive_sock = NULL;
+	}
+
+	if (priv->dev_link_sock) {
+		fbxatm_remote_sock_close(priv->dev_link_sock);
+		priv->dev_link_sock = NULL;
+	}
+
+	if (priv->dev_rx_oam_sock) {
+		fbxatm_remote_sock_close(priv->dev_rx_oam_sock);
+		priv->dev_rx_oam_sock = NULL;
+	}
+
+	if (priv->vcc_action_sock) {
+		fbxatm_remote_sock_close(priv->vcc_action_sock);
+		priv->vcc_action_sock = NULL;
+	}
+
+	if (priv->dev_send_oam_sock) {
+		fbxatm_remote_sock_close(priv->dev_send_oam_sock);
+		priv->dev_send_oam_sock = NULL;
+	}
+
+	if (priv->netdev) {
+		dev_put(priv->netdev);
+		priv->netdev = NULL;
+	}
+
+	if (priv->remote_ctx) {
+		fbxatm_remote_free_ctx(priv->remote_ctx);
+		priv->remote_ctx = NULL;
+	}
+
+	skb_queue_purge(&priv->connect_acks);
+	skb_queue_purge(&priv->dev_link_reqs);
+	skb_queue_purge(&priv->dev_oam_reqs);
+	skb_queue_purge(&priv->wq_acks);
+
+	if (priv->fbxatm_dev_registered) {
+		fbxatm_dev_set_link_down(priv->fbxatm_dev);
+		printk(KERN_WARNING "%s: marking dead\n",
+		       priv->fbxatm_dev->name);
+	}
+}
+
+/*
+ * remote context timeout on any socket
+ */
+static void remote_sock_timeout(void *data)
+{
+	set_dying((struct driver_remote *)data);
+}
+
+/*
+ * main workqueue to handle device fsm
+ */
+static void remote_fsm(struct work_struct *t)
+{
+	struct delayed_work *dwork;
+	struct driver_remote *priv;
+	struct net_device *netdev;
+	struct fbxatm_remote_sockaddr addr;
+
+	dwork = container_of(t, struct delayed_work, work);
+	priv = container_of(dwork, struct driver_remote, fsm_work);
+
+	if (priv->want_die) {
+		remote_free(priv);
+		/* let FSM restart if needed */
+	}
+
+	switch (priv->state) {
+	case RSTATE_S_WAIT_NETDEV:
+	{
+		struct fbxatm_remote_connect *pkt;
+		struct fbxatm_remote_ctx *ctx;
+		struct sk_buff *skb;
+		u32 session_id;
+
+		netdev = dev_get_by_name(&init_net, priv->pd->netdev_name);
+		if (!netdev) {
+			/* netdev notifier will reschedule */
+			return;
+		}
+		priv->netdev = netdev;
+
+		/* got netdev, open remote context */
+		get_random_bytes(&session_id, sizeof (session_id));
+		ctx = fbxatm_remote_alloc_ctx(netdev, priv->pd->remote_mac,
+					      session_id,
+					      remote_sock_timeout,
+					      priv);
+		if (!ctx) {
+			printk(KERN_ERR PFX "unable to allocate remote ctx\n");
+			remote_free(priv);
+			return;
+		}
+		priv->remote_ctx = ctx;
+
+		/* open rx sockets */
+		memset(&addr, 0, sizeof (addr));
+		addr.mtype = htonl(FBXATM_RMT_DEV_LINK);
+		addr.deliver = dev_link_deliver;
+		addr.priv = priv;
+		priv->dev_link_sock = fbxatm_remote_sock_bind(ctx, &addr, 1);
+		if (!priv->dev_link_sock) {
+			remote_free(priv);
+			return;
+		}
+
+		memset(&addr, 0, sizeof (addr));
+		addr.mtype = htonl(FBXATM_RMT_DEV_RX_OAM);
+		addr.deliver = dev_rx_oam_deliver;
+		addr.priv = priv;
+		priv->dev_rx_oam_sock = fbxatm_remote_sock_bind(ctx, &addr, 0);
+		if (!priv->dev_rx_oam_sock) {
+			remote_free(priv);
+			return;
+		}
+
+		/* create socket for initial connexion */
+		memset(&addr, 0, sizeof (addr));
+		addr.mtype = htonl(FBXATM_RMT_CONNECT);
+		addr.response = dev_connect_response;
+		addr.priv = priv;
+		addr.infinite_retry = 1;
+		priv->dev_connect_sock = fbxatm_remote_sock_connect(ctx,
+								    &addr, 1);
+		if (!priv->dev_connect_sock) {
+			remote_free(priv);
+			return;
+		}
+
+		/* send the connect packet */
+		skb = fbxatm_remote_alloc_skb(priv->remote_ctx,
+					      sizeof (*pkt));
+		if (!skb) {
+			remote_free(priv);
+			return;
+		}
+
+		pkt = (struct fbxatm_remote_connect *)
+			skb_put(skb, sizeof (*pkt));
+
+		memcpy(pkt->name, priv->pd->remote_name, sizeof (pkt->name));
+
+		fbxatm_remote_sock_getaddr(priv->dev_link_sock, &addr);
+		pkt->dev_link_port = addr.lport;
+
+		fbxatm_remote_sock_getaddr(priv->dev_rx_oam_sock, &addr);
+		pkt->dev_rx_oam_port = addr.lport;
+
+		if (fbxatm_remote_sock_send(priv->dev_connect_sock, skb)) {
+			dev_kfree_skb(skb);
+			remote_free(priv);
+			return;
+		}
+
+		/* wait for connect ack... */
+		priv->state = RSTATE_S_WAIT_REMOTE;
+		break;
+	}
+
+	case RSTATE_S_WAIT_REMOTE:
+	{
+		struct fbxatm_remote_connect_ack *pkt_ack;
+		struct fbxatm_remote_ctx *ctx;
+		struct fbxatm_dev *adev;
+		struct sk_buff *skb;
+		int ret;
+
+		skb = skb_dequeue(&priv->connect_acks);
+		if (!skb)
+			return;
+
+		if (!pskb_may_pull(skb, sizeof (*pkt_ack))) {
+			printk(KERN_ERR PFX "bad connect ack\n");
+			dev_kfree_skb(skb);
+			return;
+		}
+
+		pkt_ack = (struct fbxatm_remote_connect_ack *)skb->data;
+		ctx = priv->remote_ctx;
+
+		/* open sockets */
+		memset(&addr, 0, sizeof (addr));
+		addr.mtype = htonl(FBXATM_RMT_VCC_ACTION);
+		addr.response = common_response;
+		addr.dport = pkt_ack->vcc_action_port;
+		addr.priv = priv;
+		priv->vcc_action_sock = fbxatm_remote_sock_connect(ctx,
+								   &addr, 1);
+		if (!priv->vcc_action_sock) {
+			remote_free(priv);
+			return;
+		}
+
+		memset(&addr, 0, sizeof (addr));
+		addr.mtype = htonl(FBXATM_RMT_DEV_SEND_OAM);
+		addr.response = common_response;
+		addr.dport = pkt_ack->dev_send_oam_port;
+		addr.priv = priv;
+		priv->dev_send_oam_sock = fbxatm_remote_sock_connect(ctx,
+								     &addr, 1);
+		if (!priv->dev_send_oam_sock) {
+			remote_free(priv);
+			return;
+		}
+
+		memset(&addr, 0, sizeof (addr));
+		addr.mtype = htonl(FBXATM_RMT_KEEPALIVE);
+		addr.priv = priv;
+		addr.dport = pkt_ack->keepalive_port;
+		priv->keepalive_sock = fbxatm_remote_sock_connect(ctx,
+								  &addr, 1);
+		if (!priv->keepalive_sock) {
+			remote_free(priv);
+			return;
+		}
+
+		/* all set, register fbxatm device */
+		adev = priv->fbxatm_dev;
+		adev->max_vcc = ntohl(pkt_ack->max_vcc);
+		adev->vci_mask = ntohl(pkt_ack->vci_mask);
+		adev->vpi_mask = ntohl(pkt_ack->vpi_mask);
+		adev->max_priority = ntohl(pkt_ack->max_priority);
+		adev->max_rx_priority = ntohl(pkt_ack->max_rx_priority);
+		adev->link_rate_ds = ntohl(pkt_ack->link_rate_ds);
+		adev->link_rate_us = ntohl(pkt_ack->link_rate_us);
+		adev->link_cell_rate_ds = ntohl(pkt_ack->link_cell_rate_ds);
+		adev->link_cell_rate_us = ntohl(pkt_ack->link_cell_rate_us);
+		adev->tx_headroom = fbxatm_remote_headroom(ctx);
+
+		/* register atm device */
+		priv->state = RSTATE_S_ACTIVE;
+
+		if (!priv->fbxatm_dev_registered) {
+			ret = fbxatm_register_device(adev, "remote_fbxatm",
+						     &remote_fbxatm_ops);
+			if (ret) {
+				remote_free(priv);
+				return;
+			}
+		}
+
+		priv->fbxatm_dev_registered = 1;
+		printk(KERN_INFO "%s: connected to %s - %pM6/%s\n",
+		       adev->name, priv->pd->remote_name,
+		       priv->pd->remote_mac, priv->netdev->name);
+
+		if (pkt_ack->link)
+			fbxatm_dev_set_link_up(adev);
+		else
+			fbxatm_dev_set_link_down(adev);
+
+		schedule_delayed_work(&priv->fsm_work, HZ);
+		break;
+	}
+
+	case RSTATE_S_ACTIVE:
+	{
+		/* process link change event if any */
+		handle_dev_link_queue(priv);
+
+		/* process rx oam if any */
+		handle_oam_rx_queue(priv);
+
+		/* send keepalive */
+		if (!fbxatm_remote_sock_pending(priv->keepalive_sock)) {
+			struct sk_buff *skb;
+
+			skb = fbxatm_remote_alloc_skb(priv->remote_ctx, 0);
+			if (skb)
+				fbxatm_remote_sock_send(priv->keepalive_sock,
+							skb);
+		}
+
+		schedule_delayed_work(&priv->fsm_work, HZ);
+		break;
+	}
+
+	case RSTATE_S_DEAD:
+		/* wait until open vcc list is empty */
+		if (!list_empty(&priv->pvcc_list))
+			break;
+
+		priv->state = RSTATE_S_WAIT_NETDEV;
+		if (priv->fbxatm_dev_registered)
+			printk(KERN_INFO "%s: reconnecting\n",
+			       priv->fbxatm_dev->name);
+		schedule_delayed_work(&priv->fsm_work, HZ);
+		break;
+	}
+}
+
+/*
+ * netdevice notifier callback
+ */
+static int remote_device_event(struct notifier_block *this,
+			       unsigned long event, void *ptr)
+{
+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+	struct driver_remote *priv;
+
+	spin_lock_bh(&remote_lock);
+
+	/* go through remote list to check if device matches one */
+	list_for_each_entry(priv, &remote_dev_list, next) {
+
+		switch (event) {
+		case NETDEV_REGISTER:
+		case NETDEV_CHANGENAME:
+			if (strcmp(dev->name, priv->pd->netdev_name))
+				continue;
+			break;
+
+		case NETDEV_UNREGISTER:
+			if (dev != priv->netdev)
+				continue;
+			priv->want_die = 1;
+			break;
+
+		default:
+			continue;
+		}
+		schedule_delayed_work(&priv->fsm_work, 0);
+	}
+
+	spin_unlock_bh(&remote_lock);
+
+	return 0;
+}
+
+static struct notifier_block remote_notifier = {
+	.notifier_call = remote_device_event,
+};
+
+/*
+ * get remote pdata through of
+ */
+static struct fbxatm_remote_pdata *
+remote_of_probe(struct platform_device *pdev)
+{
+	struct device_node *np = pdev->dev.of_node;
+	struct fbxatm_remote_pdata *pd;
+	const void *mac_addr;
+	const char *netdev_name;
+	const char *remote_name;
+	int len;
+
+	pd = devm_kzalloc(&pdev->dev, sizeof (*pd), GFP_KERNEL);
+	if (!pd)
+		return ERR_PTR(-ENOMEM);
+
+	mac_addr = of_get_mac_address(np);
+	if (!mac_addr) {
+		printk(KERN_ERR PFX "missing of mac-address\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	netdev_name = of_get_property(np, "netdev-name", &len);
+	if (!netdev_name || len >= sizeof (pd->netdev_name)) {
+		printk(KERN_ERR PFX "missing of netdev-name\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	remote_name = of_get_property(np, "remote-name", &len);
+	if (!remote_name || len >= sizeof (pd->remote_name)) {
+		printk(KERN_ERR PFX "missing of remote-name\n");
+		return ERR_PTR(-EINVAL);
+	}
+
+	memcpy(pd->remote_mac, mac_addr, 6);
+	strlcpy(pd->netdev_name, netdev_name, sizeof (pd->netdev_name));
+	strlcpy(pd->remote_name, remote_name, sizeof (pd->remote_name));
+
+	return pd;
+}
+
+/*
+ * platform data probe callback
+ */
+static int remote_probe(struct platform_device *pdev)
+{
+	struct fbxatm_remote_pdata *pd;
+	struct driver_remote *priv;
+	struct fbxatm_dev *adev;
+
+	pd = pdev->dev.platform_data;
+	if (pd) {
+		if (!pd->netdev_name[0])
+			return -EINVAL;
+	} else if (pdev->dev.of_node) {
+		pd = remote_of_probe(pdev);
+		if (IS_ERR(pd))
+			return PTR_ERR(pd);
+	} else
+		return -EINVAL;
+
+	/* allocate fbxatm device */
+	adev = fbxatm_alloc_device(sizeof (*priv));
+	if (!adev)
+		return -ENOMEM;
+
+	priv = fbxatm_dev_priv(adev);
+
+	priv->fbxatm_dev = adev;
+	INIT_LIST_HEAD(&priv->pvcc_list);
+	spin_lock_init(&priv->tx_lock);
+	mutex_init(&priv->mutex);
+
+	priv->state = RSTATE_S_WAIT_NETDEV;
+	INIT_DELAYED_WORK(&priv->fsm_work, remote_fsm);
+
+	skb_queue_head_init(&priv->connect_acks);
+	skb_queue_head_init(&priv->dev_link_reqs);
+	skb_queue_head_init(&priv->dev_oam_reqs);
+	init_waitqueue_head(&priv->wq);
+	skb_queue_head_init(&priv->wq_acks);
+	priv->pd = pd;
+
+	spin_lock_bh(&remote_lock);
+	list_add_tail(&priv->next, &remote_dev_list);
+	spin_unlock_bh(&remote_lock);
+
+	platform_set_drvdata(pdev, priv);
+
+	printk(KERN_INFO PFX "connecting to %s - %pM6/%s\n",
+	       priv->pd->remote_name,
+	       priv->pd->remote_mac,
+	       priv->pd->netdev_name);
+
+	/* kick fsm  */
+	schedule_delayed_work(&priv->fsm_work, 0);
+	return 0;
+}
+
+static int remote_remove(struct platform_device *pdev)
+{
+	struct driver_remote *priv;
+	struct fbxatm_dev *adev;
+
+	priv = platform_get_drvdata(pdev);
+	adev = priv->fbxatm_dev;
+
+	/* remove from global list so network notifier can't find us */
+	spin_lock_bh(&remote_lock);
+	list_del(&priv->next);
+	spin_unlock_bh(&remote_lock);
+
+	/* cancel any pending fsm */
+	cancel_delayed_work_sync(&priv->fsm_work);
+
+	/* force dead state */
+	remote_free(priv);
+
+	if (priv->fbxatm_dev_registered)
+		fbxatm_unregister_device(adev);
+	fbxatm_free_device(adev);
+	return 0;
+}
+
+static const struct of_device_id fbxatm_remote_of_table[] = {
+	{ .compatible = "freebox,fbxatm-remote" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, fbxatm_remote_of_table);
+
+struct platform_driver fbxatm_remote_driver = {
+	.probe	= remote_probe,
+	.remove	= remote_remove,
+	.driver	= {
+		.name	= "fbxatm_remote",
+		.owner  = THIS_MODULE,
+		.of_match_table	= of_match_ptr(fbxatm_remote_of_table),
+	},
+};
+
+static int __init fbxatm_remote_driver_init(void)
+{
+	int ret;
+
+	INIT_LIST_HEAD(&remote_dev_list);
+	ret = fbxatm_remote_init();
+	if (ret)
+		goto fail;
+	ret = register_netdevice_notifier(&remote_notifier);
+	if (ret)
+		goto fail_remote;
+	ret = platform_driver_register(&fbxatm_remote_driver);
+	if (ret)
+		goto fail_notifier;
+	return 0;
+
+fail_notifier:
+	unregister_netdevice_notifier(&remote_notifier);
+fail_remote:
+	fbxatm_remote_exit();
+fail:
+	return ret;
+}
+
+static void __exit fbxatm_remote_driver_exit(void)
+{
+	fbxatm_remote_exit();
+	unregister_netdevice_notifier(&remote_notifier);
+	platform_driver_unregister(&fbxatm_remote_driver);
+}
+
+module_init(fbxatm_remote_driver_init);
+module_exit(fbxatm_remote_driver_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_VERSION("1.0");
+MODULE_AUTHOR("Maxime Bizon <mbizon@freebox.fr>");
diff -Nruw linux-5.4.60-fbx/net/fbxatm./fbxatm_remote_driver.h linux-5.4.60-fbx/net/fbxatm/fbxatm_remote_driver.h
--- linux-5.4.60-fbx/net/fbxatm./fbxatm_remote_driver.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxatm/fbxatm_remote_driver.h	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,79 @@
+#ifndef FBXATM_REMOTE_DRIVER_H_
+#define FBXATM_REMOTE_DRIVER_H_
+
+#include <linux/spinlock.h>
+#include <linux/workqueue.h>
+#include <linux/fbxatm.h>
+#include <linux/fbxatm_dev.h>
+#include <linux/fbxatm_remote.h>
+
+enum remote_state {
+	RSTATE_S_WAIT_NETDEV = 0,
+	RSTATE_S_WAIT_REMOTE,
+	RSTATE_S_ACTIVE,
+	RSTATE_S_DEAD,
+};
+
+struct driver_remote;
+
+struct driver_remote_vcc {
+
+	struct fbxatm_vcc		*vcc;
+	struct driver_remote		*priv;
+
+	unsigned int			remote_id;
+
+	int				tx_pending;
+	int				tx_got_qempty;
+
+	/* output */
+	struct fbxatm_remote_sock	*vcc_send_sock;
+
+	/* input */
+	struct fbxatm_remote_sock	*vcc_rx_sock;
+	struct fbxatm_remote_sock	*vcc_qempty_sock;
+
+	struct list_head		next;
+};
+
+struct driver_remote {
+	struct fbxatm_dev		*fbxatm_dev;
+	int				fbxatm_dev_registered;
+
+	struct list_head		pvcc_list;
+
+	spinlock_t			tx_lock;
+	struct mutex			mutex;
+
+	struct fbxatm_remote_ctx	*remote_ctx;
+	struct net_device		*netdev;
+
+	enum remote_state		state;
+	struct delayed_work		fsm_work;
+	int				want_die;
+
+	/* output */
+	struct fbxatm_remote_sock	*dev_connect_sock;
+	struct sk_buff_head		connect_acks;
+
+	struct fbxatm_remote_sock	*keepalive_sock;
+
+	/* input */
+	struct fbxatm_remote_sock	*dev_link_sock;
+	struct sk_buff_head		dev_link_reqs;
+
+	struct fbxatm_remote_sock	*dev_rx_oam_sock;
+	struct sk_buff_head		dev_oam_reqs;
+
+	/* used to wait for send_oam & vcc_action */
+	struct fbxatm_remote_sock	*vcc_action_sock;
+	struct fbxatm_remote_sock	*dev_send_oam_sock;
+	wait_queue_head_t		wq;
+	int				wq_res;
+	struct sk_buff_head		wq_acks;
+
+	struct fbxatm_remote_pdata	*pd;
+	struct list_head		next;
+};
+
+#endif /* ! FBXATM_REMOTE_DRIVER_H_ */
diff -Nruw linux-5.4.60-fbx/net/fbxatm./fbxatm_sysfs.c linux-5.4.60-fbx/net/fbxatm/fbxatm_sysfs.c
--- linux-5.4.60-fbx/net/fbxatm./fbxatm_sysfs.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxatm/fbxatm_sysfs.c	2021-03-30 16:07:01.591769549 +0200
@@ -0,0 +1,182 @@
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/kobject.h>
+#include <linux/stat.h>
+#include <linux/fbxatm_dev.h>
+#include "fbxatm_priv.h"
+
+#define to_fbxatm_dev(cldev) container_of(cldev, struct fbxatm_dev, dev)
+
+static ssize_t show_ifindex(struct device *dev,
+			  struct device_attribute *attr, char *buf)
+{
+	struct fbxatm_dev *adev = to_fbxatm_dev(dev);
+	return sprintf(buf, "%d\n", adev->ifindex);
+}
+
+static ssize_t show_link_state(struct device *dev,
+			       struct device_attribute *attr, char *buf)
+{
+	struct fbxatm_dev *adev = to_fbxatm_dev(dev);
+	return sprintf(buf, "%d\n",
+		       test_bit(FBXATM_DEV_F_LINK_UP, &adev->dev_flags) ?
+		       1 : 0);
+}
+
+static ssize_t show_link_rate_us(struct device *dev,
+				 struct device_attribute *attr, char *buf)
+{
+	struct fbxatm_dev *adev = to_fbxatm_dev(dev);
+	return sprintf(buf, "%d\n", adev->link_rate_us);
+}
+
+static ssize_t show_link_rate_ds(struct device *dev,
+				 struct device_attribute *attr, char *buf)
+{
+	struct fbxatm_dev *adev = to_fbxatm_dev(dev);
+	return sprintf(buf, "%d\n", adev->link_rate_ds);
+}
+
+static ssize_t show_max_priority(struct device *dev,
+				 struct device_attribute *attr, char *buf)
+{
+	struct fbxatm_dev *adev = to_fbxatm_dev(dev);
+	return sprintf(buf, "%d\n", adev->max_priority);
+}
+
+static ssize_t show_max_rx_priority(struct device *dev,
+				    struct device_attribute *attr, char *buf)
+{
+	struct fbxatm_dev *adev = to_fbxatm_dev(dev);
+	return sprintf(buf, "%d\n", adev->max_rx_priority);
+}
+
+static ssize_t show_rx_bytes(struct device *dev,
+			     struct device_attribute *attr, char *buf)
+{
+	struct fbxatm_dev *adev = to_fbxatm_dev(dev);
+	u32 val;
+
+	spin_lock_bh(&adev->stats_lock);
+	val = adev->stats.rx_bytes;
+	spin_unlock_bh(&adev->stats_lock);
+	return sprintf(buf, "%u\n", val);
+}
+
+static ssize_t show_tx_bytes(struct device *dev,
+			     struct device_attribute *attr, char *buf)
+{
+	struct fbxatm_dev *adev = to_fbxatm_dev(dev);
+	u32 val;
+
+	spin_lock_bh(&adev->stats_lock);
+	val = adev->stats.tx_bytes;
+	spin_unlock_bh(&adev->stats_lock);
+	return sprintf(buf, "%u\n", val);
+}
+
+static DEVICE_ATTR(ifindex, S_IRUGO, show_ifindex, NULL);
+static DEVICE_ATTR(link_state, S_IRUGO, show_link_state, NULL);
+static DEVICE_ATTR(link_rate_us, S_IRUGO, show_link_rate_us, NULL);
+static DEVICE_ATTR(link_rate_ds, S_IRUGO, show_link_rate_ds, NULL);
+static DEVICE_ATTR(max_priority, S_IRUGO, show_max_priority, NULL);
+static DEVICE_ATTR(max_rx_priority, S_IRUGO, show_max_rx_priority, NULL);
+static DEVICE_ATTR(rx_bytes, S_IRUGO, show_rx_bytes, NULL);
+static DEVICE_ATTR(tx_bytes, S_IRUGO, show_tx_bytes, NULL);
+
+static struct device_attribute *fbxatm_attrs[] = {
+	&dev_attr_ifindex,
+	&dev_attr_link_state,
+	&dev_attr_link_rate_us,
+	&dev_attr_link_rate_ds,
+	&dev_attr_max_priority,
+	&dev_attr_max_rx_priority,
+	&dev_attr_rx_bytes,
+	&dev_attr_tx_bytes,
+};
+
+static int fbxatm_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+	struct fbxatm_dev *adev;
+
+	if (!dev)
+		return -ENODEV;
+
+	adev = to_fbxatm_dev(dev);
+	if (!adev)
+		return -ENODEV;
+
+	if (add_uevent_var(env, "NAME=%s", adev->name))
+		return -ENOMEM;
+
+	if (add_uevent_var(env, "IFINDEX=%u", adev->ifindex))
+		return -ENOMEM;
+
+	if (add_uevent_var(env, "LINK=%u",
+			   test_bit(FBXATM_DEV_F_LINK_UP, &adev->dev_flags) ?
+			   1 : 0))
+		return -ENOMEM;
+
+	return 0;
+}
+
+static void fbxatm_release(struct device *dev)
+{
+	struct fbxatm_dev *adev = to_fbxatm_dev(dev);
+	__fbxatm_free_device(adev);
+}
+
+static struct class fbxatm_class = {
+	.name		= "fbxatm",
+	.dev_release	= fbxatm_release,
+	.dev_uevent	= fbxatm_uevent,
+};
+
+void fbxatm_dev_change_sysfs(struct fbxatm_dev *adev)
+{
+	struct device *dev = &adev->dev;
+
+	kobject_uevent_env(&dev->kobj, KOBJ_CHANGE, NULL);
+}
+
+int fbxatm_register_dev_sysfs(struct fbxatm_dev *adev)
+{
+	struct device *dev = &adev->dev;
+	int i, j, ret;
+
+	dev->class = &fbxatm_class;
+	dev_set_name(dev, "%s", adev->name);
+	ret = device_register(dev);
+	if (ret < 0)
+		return ret;
+
+	for (i = 0; i < ARRAY_SIZE(fbxatm_attrs); i++) {
+		ret = device_create_file(dev, fbxatm_attrs[i]);
+		if (ret)
+			goto err;
+	}
+	return 0;
+
+err:
+	for (j = 0; j < i; j++)
+		device_remove_file(dev, fbxatm_attrs[j]);
+	device_del(dev);
+	return ret;
+}
+
+void fbxatm_unregister_dev_sysfs(struct fbxatm_dev *adev)
+{
+	struct device *dev = &adev->dev;
+	device_del(dev);
+}
+
+int __init fbxatm_sysfs_init(void)
+{
+	return class_register(&fbxatm_class);
+}
+
+void fbxatm_sysfs_exit(void)
+{
+	class_unregister(&fbxatm_class);
+}
diff -Nruw linux-5.4.60-fbx/net/fbxatm./Kconfig linux-5.4.60-fbx/net/fbxatm/Kconfig
--- linux-5.4.60-fbx/net/fbxatm./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxatm/Kconfig	2021-03-04 13:21:01.410839051 +0100
@@ -0,0 +1,28 @@
+menuconfig FBXATM
+	tristate "Freebox Asynchronous Transfer Mode (ATM)"
+
+if FBXATM
+
+config FBXATM_REMOTE
+	bool
+
+choice
+	prompt "mode"
+	default FBXATM_STACK
+
+config FBXATM_STACK
+	bool "standard"
+
+config FBXATM_REMOTE_STUB
+	bool "remote stub"
+	select FBXATM_REMOTE
+
+endchoice
+
+config FBXATM_REMOTE_DRIVER
+	tristate "remote fbxatm driver"
+	depends on FBXATM_STACK
+	select FBXATM_REMOTE
+	select OF
+
+endif
diff -Nruw linux-5.4.60-fbx/net/fbxatm./Makefile linux-5.4.60-fbx/net/fbxatm/Makefile
--- linux-5.4.60-fbx/net/fbxatm./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxatm/Makefile	2021-03-04 13:21:01.410839051 +0100
@@ -0,0 +1,18 @@
+obj-$(CONFIG_FBXATM) += fbxatm.o
+obj-$(CONFIG_FBXATM_REMOTE) += fbxatm_remote.o
+
+fbxatm-y := fbxatm_procfs.o fbxatm_sysfs.o
+
+ifeq ($(CONFIG_FBXATM_STACK),y)
+fbxatm-y += 	fbxatm_core.o	\
+		fbxatm_2684.o	\
+		fbxatm_dev.o	\
+		crc10.o
+fbxatm-$(CONFIG_PPP) += fbxatm_pppoa.o
+endif
+
+ifeq ($(CONFIG_FBXATM_REMOTE_STUB),y)
+fbxatm-y += fbxatm_remote_stub.o
+endif
+
+obj-$(CONFIG_FBXATM_REMOTE_DRIVER) += fbxatm_remote_driver.o
diff -Nruw linux-5.4.60-fbx/net/fbxbridge./fbxbr_dev.c linux-5.4.60-fbx/net/fbxbridge/fbxbr_dev.c
--- linux-5.4.60-fbx/net/fbxbridge./fbxbr_dev.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxbridge/fbxbr_dev.c	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,734 @@
+#define pr_fmt(fmt)	"fbxbridge: " fmt
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/sockios.h>
+#include <linux/inetdevice.h>
+#include <linux/notifier.h>
+#include <linux/if_arp.h>
+#include <linux/mutex.h>
+#include <net/neighbour.h>
+#include <net/netevent.h>
+#include <net/ip.h>
+#include "fbxbr_private.h"
+
+static LIST_HEAD(fbxbr_list);
+static DEFINE_MUTEX(fbxbr_list_mutex);
+
+/*
+ * ioctl "install" func
+ */
+extern void fbxbridge_set(int (*hook)(struct net *net,
+				      unsigned int, void __user *));
+
+
+/*
+ * caller must hold rtnl lock
+ */
+struct fbxbr *__fbxbr_get_by_name(struct net *net, const char *name)
+{
+	struct net_device *dev;
+
+	dev = __dev_get_by_name(net, name);
+	if (dev == NULL)
+		return ERR_PTR(-ENODEV);
+
+	if (!(dev->priv_flags & IFF_FBXBRIDGE))
+		return ERR_PTR(-ENODEV);
+
+	return netdev_priv(dev);
+}
+
+/*
+ * compute ip address that we will pretend to be on the lan side
+ */
+static inline __be32 gen_lan_gw(__be32 be_ipaddr, __be32 be_netmask)
+{
+	u32 ipaddr, netmask;
+	u32 gw, mask;
+
+	ipaddr = __be32_to_cpu(be_ipaddr);
+	netmask = __be32_to_cpu(be_netmask);
+
+	/* default to last address of subnet */
+	gw = ipaddr & netmask;
+	mask = ~netmask;
+	gw |= (mask - 1);
+
+	/* if it happens to be the ip address, then take another one */
+	if (gw == ipaddr) {
+		gw &= netmask;
+		gw |= mask - 2;
+	}
+	return __cpu_to_be32(gw);
+}
+
+/*
+ * must be called with bridge write lock held
+ */
+static void __fetch_wan_parameters(struct fbxbr *br, struct in_ifaddr *ifa)
+{
+	struct net_device *wan_dev;
+
+	if (!ifa)
+		return;
+
+	if (WARN_ON(!br->wan_port))
+		return;
+
+	if (br->wan_ipaddr == ifa->ifa_local &&
+	    br->wan_netmask == ifa->ifa_mask)
+		return;
+
+	br->wan_ipaddr = ifa->ifa_local;
+	br->wan_netmask = ifa->ifa_mask;
+
+	if (br->wan_netmask != 0xffffffff) {
+		/* standard netmask */
+		br->lan_gw = gen_lan_gw(br->wan_ipaddr,	br->wan_netmask);
+		br->lan_netmask = br->wan_netmask;
+	} else {
+		u32 gw;
+
+		/* switch to /24 if wan it pointtopoint */
+		gw = ntohl(br->wan_ipaddr) & 0xffffff00;
+		if ((gw | 0xfe) == ntohl(br->wan_ipaddr))
+			gw |= 0xfd;
+		else
+			gw |= 0xfe;
+
+		br->lan_gw = htonl(gw);
+		br->lan_netmask = htonl(0xffffff00);
+	}
+
+	wan_dev = br->wan_port->dev;
+	pr_notice("%s: wan inet device %s address changed to [%pI4]\n",
+		  br->dev->name, wan_dev->name, &br->wan_ipaddr);
+
+	pr_info("%s: %s: wan netmask: %pI4\n",
+		br->dev->name, wan_dev->name, &br->wan_netmask);
+
+	pr_info("%s: %s: lan gw: %pI4\n",
+		br->dev->name, wan_dev->name, &br->lan_gw);
+}
+
+/*
+ * caller must hold rtnl lock
+ */
+int __fbxbr_add_br_port(struct net *net, const char *name,
+			const char *port_name, bool is_wan)
+{
+	struct net_device *dev;
+	struct fbxbr *br;
+	struct fbxbr_port *p;
+	int ret;
+
+	/* locate bridge */
+	br = __fbxbr_get_by_name(net, name);
+	if (IS_ERR(br))
+		return PTR_ERR(br);
+
+	/* check that we don't have a device already */
+	if ((is_wan && br->wan_port) || (!is_wan && br->lan_port))
+		return -EBUSY;
+
+	/* locate port */
+	dev = __dev_get_by_name(net, port_name);
+	if (!dev)
+		return -ENODEV;
+
+	/* make sure it's not used by us */
+	if (dev->priv_flags & (IFF_FBXBRIDGE | IFF_FBXBRIDGE_PORT))
+		return -EBUSY;
+
+	/* allocate new port */
+	p = kzalloc(sizeof (*p), GFP_KERNEL);
+	if (p == NULL)
+		return -ENOMEM;
+
+	p->br = br;
+	p->dev = dev;
+	p->is_wan = is_wan;
+
+	write_lock_bh(&br->lock);
+	if (is_wan)
+		br->wan_port = p;
+	else
+		br->lan_port = p;
+
+	if (is_wan) {
+		struct in_device *in_dev;
+
+		rcu_read_lock();
+
+		in_dev = __in_dev_get_rcu(dev);
+		if (in_dev)
+			__fetch_wan_parameters(br, in_dev->ifa_list);
+
+		rcu_read_unlock();
+	}
+
+	write_unlock_bh(&br->lock);
+
+	ret = netdev_rx_handler_register(dev, fbxbr_handle_frame, p);
+	if (ret)
+		goto err;
+
+	dev->priv_flags |= IFF_FBXBRIDGE_PORT;
+
+	ret = netdev_master_upper_dev_link(dev, br->dev, NULL, NULL, NULL);
+	if (ret)
+		goto err;
+
+	pr_info("%s: %s device %s grabbed\n",
+		br->dev->name, is_wan ? "wan" : "lan", dev->name);
+
+	return 0;
+
+err:
+	write_lock_bh(&br->lock);
+	netdev_rx_handler_unregister(dev);
+	if (is_wan)
+		br->wan_port = NULL;
+	else
+		br->lan_port = NULL;
+	dev->priv_flags &= ~IFF_FBXBRIDGE_PORT;
+	write_unlock_bh(&br->lock);
+	kfree(p);
+	return ret;
+}
+
+/*
+ * caller must hold rtnl lock
+ */
+void __fbxbr_del_br_port(struct fbxbr_port *p)
+{
+	struct fbxbr *br = p->br;
+	struct net_device *dev = p->dev;
+	bool is_wan;
+
+	netdev_upper_dev_unlink(dev, br->dev);
+	netdev_rx_handler_unregister(dev);
+	dev->priv_flags &= ~IFF_FBXBRIDGE_PORT;
+	is_wan = p->is_wan;
+
+	write_lock_bh(&br->lock);
+	if (p->is_wan)
+		br->wan_port = NULL;
+	else
+		br->lan_port = NULL;
+
+	if (p->rt)
+		ip_rt_put(p->rt);
+	write_unlock_bh(&br->lock);
+	kfree(p);
+
+	pr_info("%s: %s device %s released\n",
+		br->dev->name, is_wan ? "wan" : "lan", dev->name);
+}
+
+/*
+ * caller must hold rtnl lock
+ */
+int __fbxbr_del_br_port_by_name(struct net *net, const char *name,
+				const char *port_name)
+{
+	struct net_device *dev;
+	struct fbxbr *br;
+	struct fbxbr_port *p;
+
+	/* locate bridge */
+	br = __fbxbr_get_by_name(net, name);
+	if (IS_ERR(br))
+		return PTR_ERR(br);
+
+	/* locate port */
+	dev = __dev_get_by_name(net, port_name);
+	if (!dev)
+		return -ENODEV;
+
+	p = fbxbr_port_get_rtnl(dev);
+	if (!p || p->br != br)
+		return -EINVAL;
+
+	__fbxbr_del_br_port(p);
+	return 0;
+}
+
+/*
+ * bridge device netdevice ops
+ */
+static int fbxbr_net_open(struct net_device *dev)
+{
+	return 0;
+}
+
+static int fbxbr_net_stop(struct net_device *dev)
+{
+	return 0;
+}
+
+static int fbxbr_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	struct fbxbr *br = netdev_priv(dev);
+	const struct iphdr *iph;
+
+	read_lock(&br->lock);
+
+	if (skb->protocol != htons(ETH_P_IP))
+		goto drop;
+
+	if (!br->wan_ipaddr)
+		goto drop;
+
+	if (!br->lan_port)
+		goto drop;
+
+	if (!pskb_may_pull(skb, sizeof (*iph)))
+		goto drop;
+
+	iph = ip_hdr(skb);
+
+	if (ipv4_is_multicast(iph->daddr)) {
+		dev->stats.tx_packets++;
+		dev->stats.tx_bytes += skb->len;
+		fbxbr_output_lan_mcast_frame(br, skb);
+		goto done;
+	}
+
+	if (iph->daddr != br->br_remote_ipaddr)
+		goto drop;
+
+	fbxbr_dnat_packet(skb, br->wan_ipaddr);
+	dev->stats.tx_packets++;
+	dev->stats.tx_bytes += skb->len;
+	fbxbr_output_lan_frame(br, skb);
+
+done:
+	read_unlock(&br->lock);
+	return 0;
+
+drop:
+	dev->stats.tx_dropped++;
+	read_unlock(&br->lock);
+	kfree(skb);
+	return 0;
+}
+
+static const struct net_device_ops fbxbr_net_ops = {
+	.ndo_open		= fbxbr_net_open,
+	.ndo_stop		= fbxbr_net_stop,
+	.ndo_start_xmit		= fbxbr_net_start_xmit,
+};
+
+static struct device_type fbxbr_type = {
+	.name	= "fbxbridge",
+};
+
+/*
+ * fbxbridge alloc_netdev setup func
+ */
+#define COMMON_FEATURES (NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA | \
+			 NETIF_F_GSO_MASK | NETIF_F_HW_CSUM)
+
+static void fbxbr_netdev_setup(struct net_device *dev)
+{
+	struct fbxbr *br = netdev_priv(dev);
+	size_t i;
+
+	dev->flags = IFF_NOARP;
+	dev->type = ARPHRD_PPP;
+	dev->mtu = 1500;
+	dev->hard_header_len = 16;
+
+	dev->netdev_ops = &fbxbr_net_ops;
+	dev->needs_free_netdev = true;
+	SET_NETDEV_DEVTYPE(dev, &fbxbr_type);
+	dev->priv_flags = IFF_FBXBRIDGE | IFF_NO_QUEUE;
+
+	dev->features = 0;
+	dev->hw_features = 0;
+	dev->vlan_features = 0;
+
+	br->dev = dev;
+	rwlock_init(&br->lock);
+	rwlock_init(&br->lan_hwaddr_lock);
+	br->dhcpd_renew_time = DEFAULT_RENEWAL_TIME;
+	br->dhcpd_rebind_time = DEFAULT_REBIND_TIME;
+	br->dhcpd_lease_time = DEFAULT_LEASE_TIME;
+	spin_lock_init(&br->last_arp_lock);
+	br->last_arp_send = jiffies;
+
+	rwlock_init(&br->fwcache_lock);
+	INIT_LIST_HEAD(&br->fwcache_rules);
+	for (i = 0; i < ARRAY_SIZE(br->fwcache_hrules); i++)
+		INIT_HLIST_HEAD(&br->fwcache_hrules[i]);
+}
+
+/*
+ *
+ */
+int fbxbr_add_br(struct net *net, const char *name)
+{
+	struct net_device *dev;
+	struct fbxbr *br;
+	int ret;
+
+	dev = alloc_netdev(sizeof (struct fbxbr), name, NET_NAME_UNKNOWN,
+			   fbxbr_netdev_setup);
+	if (!dev)
+		return -ENOMEM;
+
+	dev_net_set(dev, net);
+
+	ret = register_netdev(dev);
+	if (ret) {
+		free_netdev(dev);
+		return ret;
+	}
+
+	br = netdev_priv(dev);
+	mutex_lock(&fbxbr_list_mutex);
+	list_add(&br->next, &fbxbr_list);
+	mutex_unlock(&fbxbr_list_mutex);
+
+	pr_notice("%s: new fbxbridge\n", dev->name);
+	return 0;
+}
+
+
+/*
+ * caller must hold rtnl lock
+ */
+int __fbxbr_del_br(struct net *net, const char *name)
+{
+	struct fbxbr *br;
+
+	br = __fbxbr_get_by_name(net, name);
+	if (IS_ERR(br))
+		return PTR_ERR(br);
+
+	mutex_lock(&fbxbr_list_mutex);
+	list_del(&br->next);
+	mutex_unlock(&fbxbr_list_mutex);
+
+	if (br->wan_port)
+		__fbxbr_del_br_port(br->wan_port);
+	if (br->lan_port)
+		__fbxbr_del_br_port(br->lan_port);
+
+	unregister_netdevice(br->dev);
+	return 0;
+}
+
+/*
+ *
+ */
+int fbxbr_get_params(struct net *net, const char *name,
+		     struct fbxbridge_ioctl_params *params)
+{
+	struct fbxbr *br;
+
+	rtnl_lock();
+
+	/* locate bridge */
+	br = __fbxbr_get_by_name(net, name);
+	if (IS_ERR(br)) {
+		rtnl_unlock();
+		return PTR_ERR(br);
+	}
+
+	/* copy current config */
+	params->flags = br->flags;
+	params->dns1_addr = br->dns1_ipaddr;
+	params->dns2_addr = br->dns2_ipaddr;
+	memcpy(params->ip_aliases, br->ip_aliases, sizeof (br->ip_aliases));
+	params->dhcpd_renew_time = br->dhcpd_renew_time;
+	params->dhcpd_rebind_time = br->dhcpd_rebind_time;
+	params->dhcpd_lease_time = br->dhcpd_lease_time;
+	params->inputmark = br->inputmark;
+
+	/* current ports */
+	if (br->wan_port) {
+		memcpy(params->wan_dev.name,
+		       br->wan_port->dev->name,
+		       IFNAMSIZ);
+		params->wan_dev.present = 1;
+	} else {
+		params->wan_dev.name[0] = 0;
+		params->wan_dev.present = 0;
+	}
+
+	if (br->lan_port) {
+		memcpy(params->lan_dev.name,
+		       br->lan_port->dev->name,
+		       IFNAMSIZ);
+		params->lan_dev.present = 1;
+	} else {
+		params->lan_dev.name[0] = 0;
+		params->lan_dev.present = 0;
+	}
+
+	/* copy state */
+	read_lock_bh(&br->lan_hwaddr_lock);
+	params->have_hw_addr = br->have_hw_addr;
+	memcpy(params->lan_hwaddr, br->lan_hwaddr, ETH_ALEN);
+	read_unlock_bh(&br->lan_hwaddr_lock);
+
+	rtnl_unlock();
+
+	return 0;
+}
+
+/*
+ *
+ */
+int fbxbr_set_params(struct net *net, const char *name,
+		     const struct fbxbridge_ioctl_params *params)
+{
+	struct fbxbr *br;
+
+	rtnl_lock();
+
+	/* locate bridge */
+	br = __fbxbr_get_by_name(net, name);
+	if (IS_ERR(br)) {
+		rtnl_unlock();
+		return PTR_ERR(br);
+	}
+
+	write_lock_bh(&br->lock);
+
+	br->flags = params->flags;
+	br->dns1_ipaddr = params->dns1_addr;
+	br->dns2_ipaddr = params->dns2_addr;
+	memcpy(br->ip_aliases, params->ip_aliases, sizeof (br->ip_aliases));
+	br->dhcpd_renew_time = params->dhcpd_renew_time;
+	br->dhcpd_rebind_time = params->dhcpd_rebind_time;
+	br->dhcpd_lease_time = params->dhcpd_lease_time;
+	br->inputmark = params->inputmark;
+
+	write_unlock_bh(&br->lock);
+
+	fbxbr_fwcache_flush(br);
+
+	rtnl_unlock();
+
+	return 0;
+}
+
+/*
+ *
+ */
+void fbxbr_flush_cache(void)
+{
+	struct fbxbr *br;
+
+	mutex_lock(&fbxbr_list_mutex);
+	list_for_each_entry(br, &fbxbr_list, next)
+		fbxbr_fwcache_flush(br);
+	mutex_unlock(&fbxbr_list_mutex);
+}
+
+/*
+ * must be called with BH disabled
+ */
+void fbxbr_capture_hw_addr(struct fbxbr *br, const u8 *hwaddr)
+{
+	bool same;
+
+	read_lock(&br->lan_hwaddr_lock);
+	same = (br->have_hw_addr && !memcmp(br->lan_hwaddr, hwaddr, ETH_ALEN));
+	read_unlock(&br->lan_hwaddr_lock);
+
+	if (same)
+		return;
+
+	write_lock(&br->lan_hwaddr_lock);
+	memcpy(br->lan_hwaddr, hwaddr, ETH_ALEN);
+	br->have_hw_addr = 1;
+	write_unlock(&br->lan_hwaddr_lock);
+
+	pr_notice("%s: new lan hw address is now %pM\n",
+		  br->dev->name, hwaddr);
+}
+
+/*
+ * netdevice notifier callback, called with rtnl lock
+ */
+static int fbxbr_netdev_event_callback(struct notifier_block *this,
+				       unsigned long event, void *ptr)
+{
+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+
+	ASSERT_RTNL();
+
+	if (!(dev->priv_flags & IFF_FBXBRIDGE_PORT))
+		return NOTIFY_DONE;
+
+	/* catch port that goes away */
+	switch (event) {
+	case NETDEV_UNREGISTER:
+		__fbxbr_del_br_port(fbxbr_port_get_rtnl(dev));
+		break;
+
+	default:
+		break;
+	};
+
+	return NOTIFY_DONE;
+}
+
+/*
+ * handle inet configuration event on port
+ */
+static void __handle_inet_port_event(struct fbxbr_port *p,
+				     unsigned long event,
+				     struct in_ifaddr *ifa)
+{
+	struct fbxbr *br;
+
+	if (!p->is_wan)
+		return;
+
+	br = p->br;
+
+	switch (event) {
+	case NETDEV_UP:
+		write_lock_bh(&br->lan_hwaddr_lock);
+		__fetch_wan_parameters(br, ifa);
+		write_unlock_bh(&br->lan_hwaddr_lock);
+		break;
+
+	case NETDEV_DOWN:
+		/* we never  clear wan address, so we  can continue to
+		 * use the bridge on lan side even if wan is down */
+		break;
+
+	default:
+		break;
+	}
+}
+
+/*
+ * handle inet configuration event on bridge interface (fbxbr%d)
+ */
+static void __handle_inet_bridge_event(struct fbxbr *br,
+				       unsigned long event,
+				       struct in_ifaddr *ifa)
+{
+	switch (event) {
+	case NETDEV_UP:
+		if (!ifa->ifa_address || ifa->ifa_local == ifa->ifa_address)
+			return;
+
+		write_lock_bh(&br->lan_hwaddr_lock);
+		br->br_ipaddr = ifa->ifa_local;
+		br->br_remote_ipaddr = ifa->ifa_address;
+		write_unlock_bh(&br->lan_hwaddr_lock);
+
+		if (br->br_ipaddr)
+			pr_info("%s: bridge local interface configured: "
+				"[%pI4 -> %pI4]\n",
+				br->dev->name,
+				&br->br_ipaddr,
+				&br->br_remote_ipaddr);
+		break;
+
+	case NETDEV_DOWN:
+		write_lock_bh(&br->lan_hwaddr_lock);
+		if (br->br_ipaddr) {
+			br->br_ipaddr = br->br_remote_ipaddr = 0;
+			pr_info("%s: bridge interface unconfigured\n",
+				br->dev->name);
+		}
+		write_unlock_bh(&br->lan_hwaddr_lock);
+		break;
+
+	default:
+		return;
+	}
+}
+
+/*
+ * kernel inet event notifier callback
+ */
+static int fbxbr_inet_event_callback(struct notifier_block *this,
+				     unsigned long event, void *ptr)
+{
+	struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
+	struct net_device *dev = ifa->ifa_dev->dev;
+
+	ASSERT_RTNL();
+
+	/* is it a bridge ? */
+	if (dev->priv_flags & IFF_FBXBRIDGE) {
+		struct fbxbr *br = netdev_priv(dev);
+		__handle_inet_bridge_event(br, event, ifa);
+		return NOTIFY_DONE;
+	}
+
+	/* is it a bridge port */
+	if (dev->priv_flags & IFF_FBXBRIDGE_PORT) {
+		struct fbxbr_port *p = fbxbr_port_get_rtnl(dev);
+		__handle_inet_port_event(p, event, ifa);
+		return NOTIFY_DONE;
+	}
+
+	return NOTIFY_DONE;
+}
+
+
+static struct notifier_block fbxbr_netdev_notifier = {
+	notifier_call: fbxbr_netdev_event_callback,
+};
+
+static struct notifier_block fbxbr_inet_notifier = {
+	notifier_call: fbxbr_inet_event_callback,
+};
+
+/*
+ *
+ */
+static int __init fbxbr_init_module(void)
+{
+	int err;
+
+	err = register_netdevice_notifier(&fbxbr_netdev_notifier);
+	if (err) {
+		pr_err("can't register netdevice notifier\n");
+		return err;
+	}
+
+	err = register_inetaddr_notifier(&fbxbr_inet_notifier);
+	if (err) {
+		pr_err("can't register inet notifier\n");
+		goto err_netdev;
+	}
+
+	fbxbridge_set(fbxbr_ioctl);
+	return 0;
+
+err_netdev:
+	unregister_netdevice_notifier(&fbxbr_netdev_notifier);
+	return err;
+}
+
+/*
+ *
+ */
+static void __exit fbxbr_exit_module(void)
+{
+	unregister_netdevice_notifier(&fbxbr_netdev_notifier);
+	unregister_inetaddr_notifier(&fbxbr_inet_notifier);
+	fbxbridge_set(NULL);
+}
+
+module_init(fbxbr_init_module);
+module_exit(fbxbr_exit_module);
+
+MODULE_AUTHOR("Maxime Bizon <mbizon@freebox.fr>");
+MODULE_DESCRIPTION("Freebox Network Bridge - www.freebox.fr");
+MODULE_LICENSE("GPL");
diff -Nruw linux-5.4.60-fbx/net/fbxbridge./fbxbr_dhcp.c linux-5.4.60-fbx/net/fbxbridge/fbxbr_dhcp.c
--- linux-5.4.60-fbx/net/fbxbridge./fbxbr_dhcp.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxbridge/fbxbr_dhcp.c	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,502 @@
+#include "fbxbr_private.h"
+#include <linux/udp.h>
+#include <net/ip.h>
+#include <asm/checksum.h>
+
+#define BOOTP_REQUEST   1
+#define BOOTP_REPLY     2
+
+struct bootp_pkt {              /* BOOTP packet format */
+	struct iphdr iph;       /* IP header */
+	struct udphdr udph;     /* UDP header */
+	u8 op;                  /* 1=request, 2=reply */
+	u8 htype;               /* HW address type */
+	u8 hlen;                /* HW address length */
+	u8 hops;                /* Used only by gateways */
+	u32 xid;                /* Transaction ID */
+	u16 secs;               /* Seconds since we started */
+	u16 flags;              /* Just what it says */
+	u32 client_ip;          /* Client's IP address if known */
+	u32 your_ip;            /* Assigned IP address */
+	u32 server_ip;          /* (Next, e.g. NFS) Server's IP address */
+	u32 relay_ip;           /* IP address of BOOTP relay */
+	u8 hw_addr[16];         /* Client's HW address */
+	u8 serv_name[64];       /* Server host name */
+	u8 boot_file[128];      /* Name of boot file */
+	u8 exten[312];          /* DHCP options / BOOTP vendor extensions */
+};
+
+#define FBX_OPT_VENDOR_F_IGNORE_BRIDGE	(1 << 0)
+
+struct fbx_opt_vendor {
+	u8	oui[3];
+	u32	version;
+	u32	flags;
+} __attribute__((packed));
+
+#define DHCPDISCOVER	1
+#define DHCPOFFER	2
+#define DHCPREQUEST	3
+#define DHCPDECLINE	4
+#define DHCPACK		5
+#define DHCPNACK	6
+#define DHCPRELEASE	7
+#define DHCPINFORM	8
+
+#define BROADCAST_FLAG	0x8000 /* "I need broadcast replies" */
+
+static const char *dhcp_to_name[] = {
+	"NONE",
+	"DHCPDISCOVER",
+	"DHCPOFFER",
+	"DHCPREQUEST",
+	"DHCPDECLINE",
+	"DHCPACK",
+	"DHCPNACK",
+	"DHCPRELEASE",
+	"DHCPINFORM",
+};
+
+
+#define PARAM_SUBMASK	(1 << 0)
+#define PARAM_ROUTER	(1 << 1)
+#define PARAM_DNS	(1 << 2)
+#define PARAM_BROADCAST	(1 << 3)
+
+struct dhcp_options
+{
+	u8	msg_type;
+	u32	t1;		/* renewal timeout */
+	u32	t2;		/* rebinding timemout */
+	u32	lease_time;	/* lease time */
+	u32	server_id;	/* server identifier */
+	u32	request_param;	/* requested config params (bitfield) */
+
+	u32	netmask;	/* netmask assigne to client */
+	u32	router;
+	u32	bcast;
+	u32	dns1;
+	u32	dns2;
+	u32	requested_ip;
+
+	struct fbx_opt_vendor	fbx;
+	bool			fbx_valid;
+
+	bool	need_bcast;
+};
+
+static const unsigned char dhcp_magic_cookie[] = { 0x63, 0x82, 0x53, 0x63 };
+
+/* parse the dhcp options string to a struct */
+static void parse_dhcp_opts(const u8 *opts_str, int maxlen,
+			    struct dhcp_options *opts)
+{
+	const u8 *p, *end;
+
+	memset(opts, 0, sizeof(*opts));
+
+	/* check magic cookie */
+	if (memcmp(opts_str, dhcp_magic_cookie, sizeof(dhcp_magic_cookie)))
+		return;
+
+	/* now go for options */
+	p = opts_str + 4;
+	end = opts_str + maxlen;
+
+	while (p < end && *p != 0xff) {
+		const u8 *option;
+		size_t len, i;
+
+		option = p++;
+
+                if (*option == 0)
+                        continue;
+
+		/* jump of 'len' + 1 bytes */
+		len = *p;
+		p += len + 1;
+		if (p >= end)
+			break;
+
+		/* search for known parameter */
+		switch (*option) {
+		case 53: /* msg_type */
+			if (len)
+				opts->msg_type = option[2];
+			break;
+
+		case 55: /* param request */
+			for (i = 0; i < len; i++) {
+				switch (option[2 + i]) {
+				case 1: /* subnet */
+					opts->request_param |= PARAM_SUBMASK;
+					break;
+
+				case 3: /* router */
+					opts->request_param |= PARAM_ROUTER;
+					break;
+
+				case 6: /* dns */
+					opts->request_param |= PARAM_DNS;
+					break;
+
+				case 28: /* broadcast */
+					opts->request_param |= PARAM_BROADCAST;
+					break;
+				}
+			}
+			break;
+
+		case 50: /* requested_ip */
+			if (len >= 4)
+				memcpy(&opts->requested_ip, option + 2, 4);
+			break;
+
+		case 54: /* server_id */
+			if (len >= 4)
+				memcpy(&opts->server_id, option + 2, 4);
+			break;
+
+		case 224: /* IANA reserved for freebox use */
+		{
+			if (len >= sizeof (opts->fbx)) {
+				memcpy(&opts->fbx, option + 2,
+				       sizeof (opts->fbx));
+				if (opts->fbx.oui[0] == 0x00 &&
+				    opts->fbx.oui[1] == 0x07 &&
+				    opts->fbx.oui[2] == 0xCB)
+					opts->fbx_valid = true;
+			}
+			break;
+		}
+		}
+	}
+}
+
+static void dump_dhcp_message(struct fbxbr *br, struct sk_buff *skb,
+			      struct bootp_pkt *bpkt, const char *action,
+			      const char *dest)
+{
+	struct dhcp_options opts;
+
+	parse_dhcp_opts(bpkt->exten, skb->len - (sizeof(*bpkt) - 312),
+			&opts);
+
+	if (opts.msg_type < 9) {
+		struct iphdr *iph;
+
+		iph = ip_hdr(skb);
+		printk(KERN_DEBUG "%s: %s dhcp %s %s "
+		       "(%pI4 -> %pI4) "
+		       "(caddr: %pI4 - yaddr: %pI4 - "
+		       "saddr: %pI4 - req_addr: %pI4)\n",
+		       br->dev->name,
+		       action,
+		       dhcp_to_name[opts.msg_type],
+		       dest,
+		       &iph->saddr,
+		       &iph->daddr,
+		       &bpkt->client_ip,
+		       &bpkt->your_ip,
+		       &bpkt->server_ip,
+		       &opts.requested_ip);
+	} else {
+		printk(KERN_DEBUG "%s: %s unknown dhcp message %s\n",
+		       br->dev->name, action, dest);
+	}
+}
+
+/* write a the dhcp options string from a struct */
+static void make_dhcp_opts(u8 *opts_str, const struct dhcp_options *opts,
+			   int type)
+{
+	int len = 0;
+
+	memcpy(opts_str, dhcp_magic_cookie, sizeof(dhcp_magic_cookie));
+	len += sizeof(dhcp_magic_cookie);
+
+	/* msg type (REPLY or OFFER) */
+	opts_str[len++] = 53;
+	opts_str[len++] = 1;
+	opts_str[len++] = opts->msg_type;
+
+	/* server id */
+	opts_str[len++] = 54;
+	opts_str[len++] = 4;
+	memcpy(opts_str + len, &opts->server_id, 4);
+	len += 4;
+
+	/* t1 */
+	if (opts->t1) {
+		opts_str[len++] = 58;
+		opts_str[len++] = 4;
+		memcpy(opts_str + len, &opts->t1, 4);
+		len += 4;
+	}
+
+	/* t2 */
+	if (opts->t2) {
+		opts_str[len++] = 59;
+		opts_str[len++] = 4;
+		memcpy(opts_str + len, &opts->t2, 4);
+		len += 4;
+	}
+
+	/* lease time */
+	if (opts->lease_time) {
+		opts_str[len++] = 51;
+		opts_str[len++] = 4;
+		memcpy(opts_str + len, &opts->lease_time, 4);
+		len += 4;
+	}
+
+	/* add requested_param */
+	if (opts->request_param & PARAM_SUBMASK) {
+		opts_str[len++] = 1;
+		opts_str[len++] = 4;
+		memcpy(opts_str + len, &opts->netmask, 4);
+		len += 4;
+	}
+
+	if (opts->request_param & PARAM_ROUTER) {
+		opts_str[len++] = 3;
+		opts_str[len++] = 4;
+		memcpy(opts_str + len, &opts->router, 4);
+		len += 4;
+	}
+
+	if (opts->request_param & PARAM_BROADCAST) {
+		opts_str[len++] = 28;
+		opts_str[len++] = 4;
+		memcpy(opts_str + len, &opts->bcast, 4);
+		len += 4;
+	}
+
+	if (opts->request_param & PARAM_DNS) {
+		opts_str[len++] = 6;
+		opts_str[len++] = (opts->dns2 ? 8 : 4);
+		memcpy(opts_str + len, &opts->dns1, 4);
+		if (opts->dns2)
+			memcpy(opts_str + len + 4, &opts->dns2, 4);
+		len += (opts->dns2 ? 8 : 4);
+	}
+
+	opts_str[len++] = 255;
+}
+
+/* dhcp server */
+static void send_dhcp_reply(struct fbxbr *br,
+			    struct net_device *dev,
+			    const u8 *dest_hw,
+			    int type,
+			    const struct bootp_pkt *src_packet,
+			    const struct dhcp_options *src_opts)
+{
+	struct sk_buff *skb;
+	struct iphdr *h;
+	struct bootp_pkt *b;
+	struct dhcp_options dhcp_opts;
+	int hlen = LL_RESERVED_SPACE(dev);
+	int tlen = dev->needed_tailroom;
+
+	/* Allocate packet */
+	skb = alloc_skb(sizeof (struct bootp_pkt) + hlen + tlen, GFP_ATOMIC);
+	if (!skb)
+		return;
+
+	skb->dev = dev;
+	skb_reserve(skb, hlen);
+	skb_reset_network_header(skb);
+
+	b = (struct bootp_pkt *)skb_put(skb, sizeof(struct bootp_pkt));
+	memset(b, 0, sizeof(struct bootp_pkt));
+
+	/* Construct IP header */
+	h = &b->iph;
+	h->version = 4;
+	h->ihl = 5;
+	h->tot_len = htons(sizeof(struct bootp_pkt));
+	h->frag_off = htons(IP_DF);
+	h->ttl = 64;
+	h->protocol = IPPROTO_UDP;
+	h->saddr = br->lan_gw;
+
+	switch (type) {
+	case DHCPOFFER:
+	case DHCPACK:
+		if (src_packet->client_ip)
+			h->daddr = src_packet->client_ip;
+                else if (src_opts->need_bcast)
+                        h->daddr = INADDR_BROADCAST;
+		else
+			h->daddr = br->wan_ipaddr;
+		break;
+
+	case DHCPNACK:
+		/* always broadcast NAK */
+		h->daddr = INADDR_BROADCAST;
+		break;
+	}
+
+	h->check = ip_fast_csum((unsigned char *) h, h->ihl);
+
+	/* Construct UDP header */
+	b->udph.source = __constant_htons(67);
+	b->udph.dest = __constant_htons(68);
+	b->udph.len = htons(sizeof(struct bootp_pkt) - sizeof(struct iphdr));
+
+	/* Construct DHCP header */
+	b->op = BOOTP_REPLY;
+	b->htype = ARPHRD_ETHER;
+	b->hlen = ETH_ALEN;
+	b->secs = 0;
+	b->xid = src_packet->xid;
+
+	switch (type) {
+	case DHCPOFFER:
+		b->server_ip = br->lan_gw;
+		b->your_ip = br->wan_ipaddr;
+		break;
+
+	case DHCPACK:
+		b->client_ip = src_packet->client_ip;
+		b->server_ip = br->lan_gw;
+		b->your_ip = br->wan_ipaddr;
+		break;
+
+	case DHCPNACK:
+		break;
+	}
+
+	b->relay_ip = src_packet->relay_ip;
+	memcpy(b->hw_addr, src_packet->hw_addr, sizeof(src_packet->hw_addr));
+
+	/* Construct DHCP options */
+	memset(&dhcp_opts, 0, sizeof (dhcp_opts));
+	dhcp_opts.msg_type = type;
+	dhcp_opts.server_id = br->lan_gw;
+
+	switch (type) {
+	case DHCPOFFER:
+	case DHCPACK:
+		dhcp_opts.t1 = htonl(br->dhcpd_renew_time);
+		dhcp_opts.t2 = htonl(br->dhcpd_rebind_time);
+		dhcp_opts.lease_time = htonl(br->dhcpd_lease_time);
+		dhcp_opts.netmask = br->lan_netmask;
+		dhcp_opts.bcast = (br->lan_netmask & br->lan_gw) |
+			~br->lan_netmask;
+		dhcp_opts.dns1 = br->dns1_ipaddr;
+		dhcp_opts.dns2 = br->dns2_ipaddr ? br->dns2_ipaddr : 0;
+		dhcp_opts.router = br->lan_gw;
+		dhcp_opts.request_param = src_opts->request_param;
+		break;
+	}
+
+	make_dhcp_opts(b->exten, &dhcp_opts, type);
+	dump_dhcp_message(br, skb, b, "sending", "to lan");
+
+	if (dev_hard_header(skb, dev, ETH_P_IP,
+			    dest_hw, dev->dev_addr, skb->len) < 0) {
+		kfree(skb);
+		return;
+	}
+
+	dev_queue_xmit(skb);
+}
+
+/*
+ * called under bridge lock
+ *
+ * packet must be a valid IP & UDP packet with dport 67
+ *
+ * answer will be sent to skb->dev
+ */
+void fbxbr_dhcpd(struct fbxbr *br, struct sk_buff *skb)
+{
+	struct bootp_pkt *bpkt;
+	struct dhcp_options opts;
+
+	/* code assumes linear skb */
+	if (skb_linearize(skb) < 0)
+		return;
+
+	/* reject short packet */
+	if (skb->len < (sizeof(*bpkt) - 312))
+		return;
+
+	bpkt = (struct bootp_pkt *)skb->data;
+
+	/* select only valid BOOTP Request/Discover */
+	if (bpkt->op != BOOTP_REQUEST || bpkt->hlen != ETH_ALEN)
+		return;
+
+	parse_dhcp_opts(bpkt->exten, skb->len - (sizeof(*bpkt) - 312), &opts);
+
+	if (opts.fbx_valid &&
+	    (be32_to_cpu(opts.fbx.flags) & FBX_OPT_VENDOR_F_IGNORE_BRIDGE)) {
+		printk(KERN_DEBUG "%s: ignore DHCP message with "
+		       "freebox ignore-bridge flags set\n", br->dev->name);
+		return;
+	}
+
+        if (ntohs(bpkt->flags) & BROADCAST_FLAG)
+		opts.need_bcast = true;
+
+	dump_dhcp_message(br, skb, bpkt, "received", "from lan");
+
+	/* select DHCPDISCOVER to send a DHCPOFFER */
+	if (opts.msg_type == DHCPDISCOVER) {
+		send_dhcp_reply(br, skb->dev, bpkt->hw_addr,
+				DHCPOFFER, bpkt, &opts);
+
+	} else if (opts.msg_type == DHCPREQUEST) {
+		/* send ACK or NACK */
+		if (!opts.requested_ip) {
+			/* RENEWING/REBINDING */
+			if (!bpkt->client_ip) {
+				/* invalid packet; ignore */
+				return;
+			}
+
+			if (bpkt->client_ip != br->wan_ipaddr)
+				send_dhcp_reply(br, skb->dev, bpkt->hw_addr,
+						DHCPNACK, bpkt, &opts);
+			else {
+				send_dhcp_reply(br, skb->dev, bpkt->hw_addr,
+						DHCPACK, bpkt, &opts);
+				fbxbr_capture_hw_addr(br, bpkt->hw_addr);
+			}
+			return;
+
+		}
+
+		/* INIT-REBOOT or SELECTING */
+		if (bpkt->client_ip) {
+			/* invalid packet; ignore */
+			return;
+		}
+
+		if (!opts.server_id) {
+			/* INIT-REBOOT */
+			if (opts.requested_ip != br->wan_ipaddr)
+				send_dhcp_reply(br, skb->dev, bpkt->hw_addr,
+						DHCPNACK, bpkt, &opts);
+			else {
+				send_dhcp_reply(br, skb->dev, bpkt->hw_addr,
+						DHCPACK, bpkt, &opts);
+				fbxbr_capture_hw_addr(br, bpkt->hw_addr);
+			}
+			return;
+		}
+
+		/* SELECTING */
+		if (opts.server_id == br->lan_gw) {
+			/* client selected us */
+			send_dhcp_reply(br, skb->dev, bpkt->hw_addr,
+					DHCPACK, bpkt, &opts);
+			fbxbr_capture_hw_addr(br, bpkt->hw_addr);
+		} else {
+			/* ignore */
+		}
+	}
+}
diff -Nruw linux-5.4.60-fbx/net/fbxbridge./fbxbr_filter.c linux-5.4.60-fbx/net/fbxbridge/fbxbr_filter.c
--- linux-5.4.60-fbx/net/fbxbridge./fbxbr_filter.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxbridge/fbxbr_filter.c	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,258 @@
+#include <net/ip.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <linux/netfilter.h>
+#include "fbxbr_private.h"
+
+static int lolfn(struct net *net, struct sock *sk, struct sk_buff *skb)
+{
+	return 0;
+}
+
+/*
+ * invoke netfilter table for finer grained control
+ */
+static int
+netfilter_call_hook(struct sk_buff *skb,
+		    unsigned int hook,
+		    struct net_device *in_dev,
+		    struct net_device *out_dev)
+{
+	struct iphdr *iph = ip_hdr(skb);
+	int ret;
+
+	/* don't run frags into netfilter */
+	if ((iph->frag_off & htons(IP_OFFSET)))
+		return NF_ACCEPT;
+
+	nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
+
+	/* NF_HOOK will kfree_skb(), guard against this */
+	skb_get(skb);
+
+	ret = NF_HOOK(NFPROTO_IPV4,
+		      hook,
+		      &init_net,
+		      NULL,
+		      skb,
+		      in_dev,
+		      out_dev,
+		      lolfn);
+
+	if (ret < 0)
+		return NF_DROP;
+
+	skb_unref(skb);
+	return NF_ACCEPT;
+}
+
+static int
+netfilter_forward_hook(struct sk_buff *skb,
+		       struct net_device *in_dev,
+		       struct net_device *out_dev)
+{
+	return netfilter_call_hook(skb, NF_INET_FORWARD, in_dev, out_dev);
+}
+
+static int
+netfilter_input_hook(struct sk_buff *skb, struct net_device *in_dev)
+{
+	return netfilter_call_hook(skb, NF_INET_LOCAL_IN, in_dev, NULL);
+}
+
+/*
+ * set input mark bits, return true if changed
+ */
+static bool skb_set_br_inputmark(struct fbxbr *br, struct sk_buff *skb)
+{
+	if (unlikely(skb->mark & br->inputmark)) {
+		if (net_ratelimit())
+			pr_err("%s: input mark already set on skb\n",
+			       br->dev->name);
+		return false;
+	}
+
+	skb->mark |= br->inputmark;
+	return true;
+}
+
+static inline void skb_clear_br_inputmark(struct fbxbr *br,
+					  struct sk_buff *skb)
+{
+	skb->mark &= ~br->inputmark;
+}
+
+/*
+ * assume linear ip header
+ */
+static bool wan_to_lan_want_keep(struct fbxbr *br,
+				 struct sk_buff *skb)
+{
+	struct iphdr *iph = ip_hdr(skb);
+	bool changed;
+	int ret;
+
+	/* keep ETHER_IP packets */
+	if (iph->protocol == 97)
+		return true;
+
+	/* give ipv6 in ip private to freebox back to the
+	 * kernel */
+	if (iph->protocol == IPPROTO_IPV6) {
+		struct ipv6hdr *iph6;
+		unsigned int hlen;
+
+		/* capture at least all traffic from our GW
+		 * (192.88.99.101) */
+		if (iph->saddr == htonl(0xc0586365))
+			return true;
+
+		/* rest if peer-to-peer shortcut traffic, check if
+		 * this is for our IPv6 subnet, we cannot do it on
+		 * fragmented traffic thought */
+		if (iph->frag_off & htons(IP_OFFSET))
+			return false;
+
+		/* sanity check on header value */
+		hlen = iph->ihl * 4;
+		if (skb->len < hlen + sizeof(struct ipv6hdr))
+			return false;
+
+		iph6 = (struct ipv6hdr *)((unsigned char *)iph + hlen);
+		if ((iph6->daddr.s6_addr32[0] & htonl(0xfffffff0)) ==
+		    htonl(0x2a010e30))
+			return true;
+	}
+
+	if (!(br->flags & FBXBRIDGE_FLAGS_NETFILTER))
+		return false;
+
+	/* we cant filter frags with netfilter */
+	if (iph->frag_off & htons(IP_OFFSET))
+		return false;
+
+	/* check netfilter input hook */
+	changed = skb_set_br_inputmark(br, skb);
+	ret = netfilter_input_hook(skb, skb->dev);
+	if (changed)
+		skb_clear_br_inputmark(br, skb);
+
+	if (ret == NF_ACCEPT)
+		return true;
+
+	return false;
+}
+
+/*
+ * assume linear ip header
+ */
+static bool wan_to_lan_can_forward(struct fbxbr *br, struct sk_buff *skb)
+{
+	if ((br->flags & FBXBRIDGE_FLAGS_NETFILTER)) {
+		int ret;
+
+		ret = netfilter_forward_hook(skb, br->wan_port->dev, br->dev);
+		if (ret == NF_DROP)
+			return false;
+	}
+	return true;
+}
+
+/*
+ * note: caller assured that ip header is valid and holds bridge read
+ * lock
+ *
+ * use netfilter hook return type
+ */
+int
+fbxbr_filter_wan_to_lan_packet(struct fbxbr *br, struct sk_buff *skb)
+{
+	int ret;
+
+	if (wan_to_lan_want_keep(br, skb))
+		return NF_STOP;
+
+	if (!br->lan_port)
+		return NF_DROP;
+
+	ret = wan_to_lan_can_forward(br, skb);
+	if (ret != NF_ACCEPT)
+		return NF_DROP;
+
+	return NF_ACCEPT;
+}
+
+/*
+ * assume linear ip header
+ */
+static bool lan_to_wan_want_keep(struct fbxbr *br, struct sk_buff *skb)
+{
+	return false;
+}
+
+/*
+ * assume linear ip header
+ */
+static bool lan_to_wan_can_forward(struct fbxbr *br, struct sk_buff *skb)
+{
+	struct iphdr *iph = ip_hdr(skb);
+
+	/* disallow source spoofing */
+	if (iph->saddr != br->wan_ipaddr)
+		return false;
+
+	/* disallow all private net destination */
+	if (ipv4_is_loopback(iph->daddr) ||
+	    ipv4_is_private_10(iph->daddr) ||
+	    ipv4_is_private_172(iph->daddr) ||
+	    ipv4_is_private_192(iph->daddr) ||
+	    ipv4_is_linklocal_169(iph->daddr) ||
+	    ipv4_is_anycast_6to4(iph->daddr) ||
+	    ipv4_is_test_192(iph->daddr) ||
+	    ipv4_is_test_198(iph->daddr))
+		return false;
+
+	/* no multicast please */
+	if (ipv4_is_multicast(iph->daddr))
+		return false;
+
+	/* Don't let IP broadcast go through us */
+	if (ipv4_is_zeronet(iph->daddr))
+		return false;
+
+	if (ipv4_is_lbcast(iph->daddr))
+		return false;
+
+	if ((br->flags & FBXBRIDGE_FLAGS_NETFILTER)) {
+		int ret;
+
+		ret = netfilter_forward_hook(skb, br->dev, br->wan_port->dev);
+		if (ret == NF_DROP)
+			return false;
+	}
+
+	return true;
+}
+
+/*
+ * note: caller assured that ip header is valid and holds bridge read
+ * lock
+ *
+ * use netfilter hook return type
+ */
+int
+fbxbr_filter_lan_to_wan_packet(struct fbxbr *br, struct sk_buff *skb)
+{
+	int ret;
+
+	if (lan_to_wan_want_keep(br, skb))
+		return NF_STOP;
+
+	if (!br->wan_port)
+		return NF_DROP;
+
+	ret = lan_to_wan_can_forward(br, skb);
+	if (ret != NF_ACCEPT)
+		return NF_DROP;
+
+	return NF_ACCEPT;
+}
diff -Nruw linux-5.4.60-fbx/net/fbxbridge./fbxbr_fwcache.c linux-5.4.60-fbx/net/fbxbridge/fbxbr_fwcache.c
--- linux-5.4.60-fbx/net/fbxbridge./fbxbr_fwcache.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxbridge/fbxbr_fwcache.c	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,177 @@
+#include <linux/jhash.h>
+#include <net/ip.h>
+#include "fbxbr_private.h"
+
+/*
+ *
+ */
+u32 fbxbr_fwcache_hash(const struct fbxbr_fwcache_key *k)
+{
+	return jhash_3words(k->lan_ip,
+			    k->is_tcp ? k->wan_ip : ~k->wan_ip,
+			    k->lan_port | k->wan_port << 16, 0);
+}
+
+/*
+ * must be called with bh disabled and fwcache held
+ */
+struct fbxbr_fwcache *
+__fbxbr_fwcache_lookup(struct fbxbr *br, u32 hash,
+		       const struct fbxbr_fwcache_key *k)
+{
+	struct fbxbr_fwcache *fwc;
+
+	hlist_for_each_entry(fwc,
+			     &br->fwcache_hrules[hash % FBXBR_FWCACHE_SIZE],
+			     hnext) {
+		/* compare entry */
+		if (fwc->lan_ip == k->lan_ip &&
+		    fwc->wan_ip == k->wan_ip &&
+		    fwc->is_tcp == k->is_tcp &&
+		    fwc->lan_port == k->lan_port &&
+		    fwc->wan_port == k->wan_port)
+			return fwc;
+	}
+
+	return NULL;
+}
+
+/*
+ * return true if the flow has a chance to be in the fwcache
+ *
+ * skb must be a valid ipv4 packet
+ */
+bool fbxbr_fwcache_skb_allowable(struct sk_buff *skb,
+				 bool from_wan,
+				 struct fbxbr_fwcache_key *k,
+				 bool *can_create)
+{
+	const struct iphdr *iph;
+	__be16 psrc, pdst;
+
+	iph = ip_hdr(skb);
+
+	if (iph->frag_off & htons(IP_OFFSET))
+		return false;
+
+	if (iph->protocol != IPPROTO_UDP && iph->protocol != IPPROTO_TCP)
+		return false;
+
+	if (from_wan) {
+		k->wan_ip = iph->saddr;
+		k->lan_ip = iph->daddr;
+	} else {
+		k->lan_ip = iph->saddr;
+		k->wan_ip = iph->daddr;
+	}
+
+	if (iph->protocol == IPPROTO_UDP) {
+		struct udphdr *udph;
+
+		if (!pskb_may_pull(skb, skb_transport_offset(skb) +
+				   sizeof (struct udphdr)))
+			return false;
+
+		udph = (struct udphdr *)skb_transport_header(skb);
+		*can_create = true;
+
+		psrc = udph->source;
+		pdst = udph->dest;
+		k->is_tcp = false;
+	} else {
+		struct tcphdr *tcph;
+
+		if (!pskb_may_pull(skb, skb_transport_offset(skb) +
+				   sizeof (struct tcphdr)))
+			return false;
+
+		tcph = (struct tcphdr *)skb_transport_header(skb);
+		if (tcph->syn)
+			*can_create = true;
+		else
+			*can_create = false;
+
+		psrc = tcph->source;
+		pdst = tcph->dest;
+		k->is_tcp = true;
+	}
+
+	if (from_wan) {
+		k->wan_port = psrc;
+		k->lan_port = pdst;
+	} else {
+		k->lan_port = psrc;
+		k->wan_port = pdst;
+	}
+	return true;
+}
+
+/*
+ * must be called with bh disabled
+ */
+int fbxbr_fwcache_add(struct fbxbr *br,
+		      u32 hash, const struct fbxbr_fwcache_key *k)
+{
+	struct fbxbr_fwcache *fwc;
+
+	write_lock(&br->fwcache_lock);
+
+	if (unlikely(__fbxbr_fwcache_lookup(br, hash, k)))
+		goto done;
+
+	/* add new entry */
+	if (br->fwcache_count < FBXBR_FWCACHE_MAX_ENTRY) {
+		fwc = kmalloc(sizeof (*fwc), GFP_ATOMIC);
+		if (!fwc)
+			goto done;
+		br->fwcache_count++;
+	} else {
+		fwc = list_first_entry(&br->fwcache_rules,
+				       struct fbxbr_fwcache,
+				       next);
+		hlist_del(&fwc->hnext);
+		list_del(&fwc->next);
+		if (fwc->priv_destructor)
+			fwc->priv_destructor((void *)fwc->priv_area);
+	}
+
+	fwc->lan_ip = k->lan_ip;
+	fwc->wan_ip = k->wan_ip;
+	fwc->lan_port = k->lan_port;
+	fwc->wan_port = k->wan_port;
+	fwc->is_tcp = k->is_tcp;
+	fwc->priv_destructor = NULL;
+	memset(fwc->priv_area, 0, sizeof (fwc->priv_area));
+
+	hlist_add_head(&fwc->hnext,
+		       &br->fwcache_hrules[hash % FBXBR_FWCACHE_SIZE]);
+	list_add_tail(&fwc->next, &br->fwcache_rules);
+
+done:
+	write_unlock(&br->fwcache_lock);
+	return 0;
+}
+
+/*
+ *
+ */
+void fbxbr_fwcache_flush(struct fbxbr *br)
+{
+	struct fbxbr_fwcache *fwc, *tmp;
+	size_t i;
+
+	write_lock_bh(&br->fwcache_lock);
+
+	list_for_each_entry_safe(fwc, tmp, &br->fwcache_rules, next) {
+		if (fwc->priv_destructor)
+			fwc->priv_destructor((void *)fwc->priv_area);
+		kfree(fwc);
+	}
+
+	INIT_LIST_HEAD(&br->fwcache_rules);
+	for (i = 0; i < ARRAY_SIZE(br->fwcache_hrules); i++)
+		INIT_HLIST_HEAD(&br->fwcache_hrules[i]);
+	br->fwcache_count = 0;
+
+	write_unlock_bh(&br->fwcache_lock);
+}
diff -Nruw linux-5.4.60-fbx/net/fbxbridge./fbxbr_input.c linux-5.4.60-fbx/net/fbxbridge/fbxbr_input.c
--- linux-5.4.60-fbx/net/fbxbridge./fbxbr_input.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxbridge/fbxbr_input.c	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,347 @@
+#include <linux/if_arp.h>
+#include <linux/in.h>
+#include <linux/udp.h>
+#include <net/ip.h>
+#include "fbxbr_private.h"
+
+/*
+ *
+ */
+static rx_handler_result_t __handle_wan_frame(struct fbxbr_port *p,
+					      struct sk_buff *skb)
+{
+	struct fbxbr *br = p->br;
+	struct fbxbr_fwcache_key fwk;
+	bool fwc_present, fwc_can_create;
+	u32 hash = 0;
+	int ret;
+
+	/* give back non IPv4 packets */
+	if (skb->protocol != htons(ETH_P_IP))
+		return RX_HANDLER_PASS;
+
+	/* stop here if we have no idea what the wan ip address is or
+	 * was */
+	if (!br->wan_ipaddr)
+		goto drop;
+
+	if (!fbxbr_is_valid_ip_packet(skb))
+		goto drop;
+
+	/* lookup into forward cache */
+	fwc_present = false;
+	fwc_can_create = false;
+
+	if (fbxbr_fwcache_skb_allowable(skb, true, &fwk, &fwc_can_create)) {
+		hash = fbxbr_fwcache_hash(&fwk);
+		read_lock(&br->fwcache_lock);
+		fwc_present = (__fbxbr_fwcache_lookup(br, hash, &fwk) != NULL);
+		read_unlock(&br->fwcache_lock);
+	}
+
+	if (fwc_present)
+		goto output_lan;
+
+	ret = fbxbr_filter_wan_to_lan_packet(br, skb);
+	switch (ret) {
+	default:
+		WARN(1, "unsupported filter action");
+		/* fallthrough */
+
+	case NF_DROP:
+		kfree_skb(skb);
+		return RX_HANDLER_CONSUMED;
+
+	case NF_STOP:
+		nf_reset_ct(skb);
+		return RX_HANDLER_PASS;
+
+	case NF_ACCEPT:
+		break;
+	}
+
+output_lan:
+	if (!br->lan_port)
+		goto drop;
+
+	fbxbr_output_lan_frame(br, skb);
+
+	if (!fwc_present && fwc_can_create)
+		fbxbr_fwcache_add(br, hash, &fwk);
+
+	return RX_HANDLER_CONSUMED;
+
+drop:
+	kfree_skb(skb);
+	return RX_HANDLER_CONSUMED;
+}
+
+/*
+ *
+ */
+static void
+__handle_lan_arp_frame(struct fbxbr_port *p, struct sk_buff *skb)
+{
+	struct net_device *dev = p->dev;
+	struct fbxbr *br = p->br;
+	__be32 sender_ipaddr, target_ipaddr;
+	u8 *sender_hwaddr, *req;
+	struct arphdr *arp;
+
+	if (!pskb_may_pull(skb, arp_hdr_len(p->dev)))
+		goto done;
+
+	arp = arp_hdr(skb);
+	if (arp->ar_hln != dev->addr_len || arp->ar_pln != 4)
+		goto done;
+
+	if ((arp->ar_hrd != htons(ARPHRD_ETHER) &&
+	     arp->ar_hrd != htons(ARPHRD_IEEE802)) ||
+	    arp->ar_pro != htons(ETH_P_IP))
+		goto done;
+
+	if (arp->ar_op != htons(ARPOP_REQUEST) &&
+	    arp->ar_op != htons(ARPOP_REPLY))
+		goto done;
+
+	/* fetch subfields */
+	req = (unsigned char *)(arp + 1);
+
+	sender_hwaddr = req;
+	req += ETH_ALEN;
+
+	memcpy(&sender_ipaddr, req, 4);
+	req += 4;
+
+	/* skip target_hwaddr */
+	req += dev->addr_len;
+
+	memcpy(&target_ipaddr, req, 4);
+
+	/* ignore gratuitous ARP */
+	if (!sender_ipaddr)
+		goto done;
+
+	if (arp->ar_op == htons(ARPOP_REQUEST)) {
+
+		/* client is sending an arp request */
+		if (!br->wan_ipaddr) {
+			/* wan has never been up, our wan address is
+			 * not known, answer to every arp requests */
+
+			/* ignore what looks like gratuitous ARP */
+			if (sender_ipaddr == target_ipaddr)
+				goto done;
+
+			/* don't answer for special ip address */
+			if (ipv4_is_private_10(target_ipaddr) ||
+			    ipv4_is_private_172(target_ipaddr) ||
+			    ipv4_is_private_192(target_ipaddr) ||
+			    ipv4_is_linklocal_169(target_ipaddr) ||
+			    ipv4_is_anycast_6to4(target_ipaddr) ||
+			    ipv4_is_test_192(target_ipaddr) ||
+			    ipv4_is_test_198(target_ipaddr))
+				goto done;
+
+			/* ok, will reply with a zero source
+			 * address */
+		} else {
+			/* wan is up, filter our arp reply to match
+			 * WAN */
+
+			/* accept only arp from remote client */
+			if (sender_ipaddr != br->wan_ipaddr)
+				goto done;
+
+			/* accept only arp request for wan network */
+			if ((target_ipaddr & br->lan_netmask) !=
+			    (br->wan_ipaddr & br->lan_netmask))
+				goto done;
+
+			/* request is for the client's address, keep quiet */
+			if (target_ipaddr == br->wan_ipaddr)
+				goto done;
+		}
+
+		/* ok I can answer */
+		fbxbr_send_arp_frame(dev, ARPOP_REPLY, sender_hwaddr,
+				     target_ipaddr, NULL,
+				     br->wan_ipaddr, sender_hwaddr);
+
+		/* keep the client address */
+		fbxbr_capture_hw_addr(br, sender_hwaddr);
+
+	} else {
+
+		/* accept only arp from remote client */
+		if (sender_ipaddr != br->wan_ipaddr)
+			goto done;
+
+		/* we received  an arp reply,  iff it was  addressed to
+		 * us, then keep the client mac address  */
+		if (target_ipaddr != br->lan_gw)
+			goto done;
+
+		fbxbr_capture_hw_addr(br, sender_hwaddr);
+	}
+
+done:
+	kfree_skb(skb);
+}
+
+/*
+ *
+ */
+static inline bool __is_local_ip(struct fbxbr *br, __be32 ipaddr)
+{
+	int i;
+
+	if (ipaddr == br->br_ipaddr || ipv4_is_multicast(ipaddr))
+		return true;
+
+	for (i = 0; i < MAX_ALIASES; i++) {
+		if (br->ip_aliases[i] && br->ip_aliases[i] == ipaddr)
+			return true;
+	}
+
+	return false;
+}
+
+/*
+ *
+ */
+static rx_handler_result_t __handle_lan_frame(struct fbxbr_port *p,
+					      struct sk_buff *skb)
+{
+	struct fbxbr *br = p->br;
+	struct iphdr *iph;
+	struct fbxbr_fwcache_key fwk;
+	bool fwc_present, fwc_can_create, is_fragment;
+	u32 hash = 0;
+	int ret;
+
+	if (skb->protocol == htons(ETH_P_ARP)) {
+		__handle_lan_arp_frame(p, skb);
+		return RX_HANDLER_CONSUMED;
+	}
+
+	/* give back non IPv4 packets */
+	if (skb->protocol != htons(ETH_P_IP))
+		return RX_HANDLER_PASS;
+
+	if (!fbxbr_is_valid_ip_packet(skb))
+		goto drop;
+
+	iph = ip_hdr(skb);
+
+	/* look  the destination  address, if  talking to  our private
+	 * address or alias, then frame is local */
+	if (__is_local_ip(br, iph->daddr)) {
+
+		if (!br->br_remote_ipaddr)
+			goto drop;
+
+		/* packet comes from lan, snat it and make it local */
+		fbxbr_snat_packet(skb, br->br_remote_ipaddr);
+		skb->dev = br->dev;
+		skb->pkt_type = PACKET_HOST;
+		br->dev->stats.rx_packets++;
+		br->dev->stats.rx_bytes += skb->len;
+		netif_rx(skb);
+		return RX_HANDLER_CONSUMED;
+	}
+
+	/* stop here if we have no idea what the wan ip address is or
+	 * was */
+	if (!br->wan_ipaddr)
+		goto drop;
+
+	/* lookup into forward cache */
+	fwc_present = false;
+	fwc_can_create = false;
+
+	if (fbxbr_fwcache_skb_allowable(skb, false, &fwk, &fwc_can_create)) {
+		hash = fbxbr_fwcache_hash(&fwk);
+		read_lock(&br->fwcache_lock);
+		fwc_present = (__fbxbr_fwcache_lookup(br, hash, &fwk) != NULL);
+		read_unlock(&br->fwcache_lock);
+	}
+
+	if (fwc_present)
+		goto output_wan;
+
+	/* process DHCP if enabled */
+	is_fragment = iph->frag_off & htons(IP_OFFSET);
+	if (iph->protocol == IPPROTO_UDP &&
+	    !is_fragment &&
+	    (br->flags & FBXBRIDGE_FLAGS_DHCPD)) {
+		struct udphdr *udp;
+
+		if (!fbxbr_is_valid_udp_tcp_packet(skb))
+			goto drop;
+
+		udp = udp_hdr(skb);
+		if (udp->dest == htons(67)) {
+			fbxbr_dhcpd(br, skb);
+			goto drop;
+		}
+	}
+
+	ret = fbxbr_filter_lan_to_wan_packet(br, skb);
+	switch (ret) {
+	default:
+		WARN(1, "unsupported filter action");
+		/* fallthrough */
+
+	case NF_DROP:
+		kfree_skb(skb);
+		return RX_HANDLER_CONSUMED;
+
+	case NF_STOP:
+		nf_reset_ct(skb);
+		return RX_HANDLER_PASS;
+
+	case NF_ACCEPT:
+		break;
+	}
+
+output_wan:
+	if (!br->wan_port)
+		goto drop;
+
+	fbxbr_output_wan_frame(br, skb);
+
+	if (!fwc_present && fwc_can_create)
+		fbxbr_fwcache_add(br, hash, &fwk);
+
+	return RX_HANDLER_CONSUMED;
+
+drop:
+	kfree_skb(skb);
+	return RX_HANDLER_CONSUMED;
+}
+
+/*
+ *
+ */
+rx_handler_result_t fbxbr_handle_frame(struct sk_buff **pskb)
+{
+	struct sk_buff *skb = *pskb;
+	struct fbxbr_port *p;
+	rx_handler_result_t ret;
+
+	skb = skb_share_check(skb, GFP_ATOMIC);
+	if (!skb)
+		return RX_HANDLER_CONSUMED;
+
+	p = fbxbr_port_get_rcu(skb->dev);
+
+	read_lock(&p->br->lock);
+	if (p->is_wan)
+		ret = __handle_wan_frame(p, skb);
+	else
+		ret = __handle_lan_frame(p, skb);
+	read_unlock(&p->br->lock);
+
+	return ret;
+}
diff -Nruw linux-5.4.60-fbx/net/fbxbridge./fbxbr_ioctl.c linux-5.4.60-fbx/net/fbxbridge/fbxbr_ioctl.c
--- linux-5.4.60-fbx/net/fbxbridge./fbxbr_ioctl.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxbridge/fbxbr_ioctl.c	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,85 @@
+#include <linux/capability.h>
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <net/net_namespace.h>
+#include <linux/uaccess.h>
+#include "fbxbr_private.h"
+
+/*
+ * ioctl handling
+ */
+int fbxbr_ioctl(struct net *net, unsigned int ign, void __user *arg)
+{
+	struct fbxbridge_ioctl_req req;
+	struct fbxbridge_ioctl_chg chg;
+	struct fbxbridge_ioctl_dev_chg dev_chg;
+	struct fbxbridge_ioctl_params params;
+	int ret;
+
+	/* fetch ioctl request */
+	if (copy_from_user(&req, arg, sizeof (req)))
+		return -EFAULT;
+
+	switch (req.cmd) {
+	case E_CMD_BR_CHG:
+		if (copy_from_user(&chg, (void *)req.arg, sizeof (chg)))
+			return -EFAULT;
+
+		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+			return -EPERM;
+
+		if (!chg.action)
+			return fbxbr_add_br(net, chg.brname);
+
+		rtnl_lock();
+		ret = __fbxbr_del_br(net, chg.brname);
+		rtnl_unlock();
+		return ret;
+
+	case E_CMD_BR_DEV_CHG:
+		if (copy_from_user(&dev_chg, (void *)req.arg,
+				   sizeof (dev_chg)))
+			return -EFAULT;
+
+		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+			return -EPERM;
+
+		rtnl_lock();
+		if (!dev_chg.action)
+			ret = __fbxbr_add_br_port(net,
+						  dev_chg.brname,
+						  dev_chg.devname,
+						  dev_chg.wan);
+		else
+			ret = __fbxbr_del_br_port_by_name(net,
+							  dev_chg.brname,
+							  dev_chg.devname);
+		rtnl_unlock();
+		return ret;
+
+	case E_CMD_BR_PARAMS:
+		if (copy_from_user(&params, (void *)req.arg, sizeof (params)))
+			return -EFAULT;
+
+		if (!params.action) {
+			/* this is a get */
+			ret = fbxbr_get_params(net, params.brname, &params);
+			if (ret)
+				return ret;
+
+			return copy_to_user((void *)req.arg, &params,
+					    sizeof (params));
+		}
+
+		/* this is a set */
+		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+			return -EPERM;
+
+		return fbxbr_set_params(net, params.brname, &params);
+
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
diff -Nruw linux-5.4.60-fbx/net/fbxbridge./fbxbr_output.c linux-5.4.60-fbx/net/fbxbridge/fbxbr_output.c
--- linux-5.4.60-fbx/net/fbxbridge./fbxbr_output.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxbridge/fbxbr_output.c	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,164 @@
+#include <net/ip.h>
+#include <net/arp.h>
+#include "fbxbr_private.h"
+
+/*
+ * caller must hold bridge lock
+ *
+ * lan port must be valid
+ */
+void fbxbr_output_lan_mcast_frame(struct fbxbr *br, struct sk_buff *skb)
+{
+	struct fbxbr_port *p = br->lan_port;
+	struct net_device *dev = p->dev;
+	struct iphdr *ip;
+	u8 mcast_hwaddr[6];
+	u32 daddr;
+
+	ip = ip_hdr(skb);
+
+	/* compute mcast hwaddr */
+	mcast_hwaddr[0] = 0x1;
+	mcast_hwaddr[1] = 0x0;
+	mcast_hwaddr[2] = 0x5e;
+	daddr = ntohl(ip->daddr);
+	mcast_hwaddr[3] = (daddr & 0x7f0000) >> 16;
+	mcast_hwaddr[4] = (daddr & 0xff00) >> 8;
+	mcast_hwaddr[5] = (daddr & 0xff);
+
+	skb->dev = dev;
+	dev_hard_header(skb, dev, ETH_P_802_3, mcast_hwaddr, dev->dev_addr,
+			ETH_P_IP);
+	dev_queue_xmit(skb);
+}
+
+/*
+ * caller must hold bridge lock and have BH disabled
+ *
+ * lan port must be valid
+ *
+ * must be a valid ip packet
+ */
+void fbxbr_output_lan_frame(struct fbxbr *br, struct sk_buff *skb)
+{
+	struct fbxbr_port *p = br->lan_port;
+	struct net_device *dev = p->dev;
+	struct iphdr *iph;
+	const char *dest_hw;
+
+	iph = ip_hdr(skb);
+
+	if (!br->have_hw_addr && iph->daddr != INADDR_BROADCAST) {
+
+		/* (fixme: try to queue instead of dropping ?) */
+		kfree_skb(skb);
+
+		/* rate limit arp sending to ARP_RATE_LIMIT  */
+		spin_lock(&br->last_arp_lock);
+		if (time_before(jiffies, br->last_arp_send + ARP_RATE_LIMIT)) {
+			spin_unlock(&br->last_arp_lock);
+			return;
+		}
+
+		br->last_arp_send = jiffies;
+		spin_unlock(&br->last_arp_lock);
+
+		fbxbr_send_arp_frame(dev,
+				     ARPOP_REQUEST,
+				     NULL,
+				     br->lan_gw,
+				     NULL,
+				     br->wan_ipaddr,
+				     NULL);
+		return;
+	}
+
+	/* we have  an active device, send  to the hw addr  if we have
+	 * it, or to  the bcast hw addr if we don't  or the packet is
+	 * an ip broadcast */
+	skb->dev = dev;
+
+	if (br->have_hw_addr && iph->daddr != INADDR_BROADCAST)
+		dest_hw = br->lan_hwaddr;
+	else
+		dest_hw = dev->broadcast;
+
+	dev_hard_header(skb, dev, ETH_P_802_3, dest_hw, dev->dev_addr,
+			ETH_P_IP);
+	dev_queue_xmit(skb);
+}
+
+/*
+ * caller must hold bridge lock and have BH disabled
+ *
+ * wan port must be valid
+ *
+ * must be a valid ip packet
+ */
+void fbxbr_output_wan_frame(struct fbxbr *br, struct sk_buff *skb)
+{
+	struct fbxbr_port *p = br->wan_port;
+	struct net_device *dev = p->dev;
+	struct iphdr *iph;
+	struct neighbour *neigh;
+	__be32 nh;
+
+	skb->dev = dev;
+
+	if (!dev->hard_header_len) {
+		dev_queue_xmit(skb);
+		return;
+	}
+
+	iph = ip_hdr(skb);
+
+	/* resolve next hop */
+	nh = iph->daddr;
+	if ((nh & br->wan_netmask) != (br->wan_ipaddr & br->wan_netmask)) {
+		struct rtable *rt;
+
+		rt = p->rt;
+		if (rt && rt->dst.obsolete > 0) {
+			ip_rt_put(rt);
+			p->rt = NULL;
+			rt = NULL;
+		}
+
+		/* need to find default gateway */
+		if (!rt) {
+			rt = ip_route_output(&init_net, nh, 0, 0,
+					     dev->ifindex);
+			if (IS_ERR(rt) || rt->rt_type != RTN_UNICAST) {
+				kfree_skb(skb);
+				return;
+			}
+
+			p->rt = rt;
+		}
+
+		nh = rt_nexthop(rt, nh);
+	}
+
+	/* resolve neighbour */
+	neigh = __ipv4_neigh_lookup_noref(dev, nh);
+        if (unlikely(!neigh))
+                neigh = __neigh_create(&arp_tbl, &nh, dev, false);
+
+	if (IS_ERR(neigh)) {
+		kfree_skb(skb);
+		return;
+	}
+
+	if (!(neigh->nud_state & NUD_VALID)) {
+		neigh_event_send(neigh, NULL);
+		kfree_skb(skb);
+		return;
+	}
+
+	neigh_event_send(neigh, NULL);
+
+	/* send */
+	dev_hard_header(skb, dev, ETH_P_802_3, neigh->ha, dev->dev_addr,
+			ETH_P_IP);
+	dev_queue_xmit(skb);
+}
diff -Nruw linux-5.4.60-fbx/net/fbxbridge./fbxbr_private.h linux-5.4.60-fbx/net/fbxbridge/fbxbr_private.h
--- linux-5.4.60-fbx/net/fbxbridge./fbxbr_private.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxbridge/fbxbr_private.h	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,197 @@
+#ifndef FBXBRIDGE_PRIVATE_H_
+#define FBXBRIDGE_PRIVATE_H_
+
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/fbxbridge.h>
+#include <linux/rtnetlink.h>
+#include <linux/spinlock.h>
+
+#define ARP_RATE_LIMIT			(HZ)
+#define ARP_ETHER_SIZE			(8 + ETH_ALEN * 2 + 4 * 2)
+#define	DEFAULT_RENEWAL_TIME		60
+#define	DEFAULT_REBIND_TIME		300
+#define	DEFAULT_LEASE_TIME		600
+
+#define FBXBR_FWCACHE_SIZE		256
+#define FBXBR_FWCACHE_MAX_ENTRY		2048
+
+struct fbxbr;
+
+struct fbxbr_fwcache_key {
+	__be32			lan_ip;
+	__be32			wan_ip;
+	__be16			lan_port;
+	__be16			wan_port;
+	bool			is_tcp;
+};
+
+struct fbxbr_fwcache {
+	__be32			lan_ip;
+	__be32			wan_ip;
+	__be16			lan_port;
+	__be16			wan_port;
+	u8			is_tcp;
+	struct hlist_node       hnext;
+	struct list_head        next;
+
+	void			(*priv_destructor)(void *);
+	u32			priv_area[8];
+};
+
+struct fbxbr_port {
+	struct fbxbr		*br;
+	struct net_device	*dev;
+	struct rtable		*rt;
+	bool			is_wan;
+};
+
+struct fbxbr {
+	struct net_device	*dev;
+
+	/* protect all fields but lan_hwaddr */
+	rwlock_t		lock;
+
+	/*
+	 * currently assigned lan & wan port, updated by userspace
+	 * under rtnl
+	 */
+	struct fbxbr_port	*wan_port;
+	struct fbxbr_port	*lan_port;
+
+	/*
+	 * config, updated by userspace
+	 */
+	unsigned int		flags;
+	unsigned int		inputmark;
+
+	unsigned int		dns1_ipaddr;
+	unsigned int		dns2_ipaddr;
+
+	unsigned long		dhcpd_renew_time;
+	unsigned long		dhcpd_rebind_time;
+	unsigned long		dhcpd_lease_time;
+
+	/* list of ip we consider to be local */
+	unsigned long		ip_aliases[MAX_ALIASES];
+
+	/*
+	 * runtime state
+	 */
+
+	/* local and remote (fbx) ip address, maintained using inet
+	 * notifier */
+	__be32			br_ipaddr;
+	__be32			br_remote_ipaddr;
+
+	/* wan side inet info */
+	__be32			wan_ipaddr;
+	__be32			wan_netmask;
+	__be32			lan_gw;
+	__be32			lan_netmask;
+
+	/* currently detected lan device hardware address */
+	rwlock_t		lan_hwaddr_lock;
+	bool			have_hw_addr;
+	unsigned char		lan_hwaddr[ETH_ALEN];
+
+	spinlock_t		last_arp_lock;
+	unsigned long		last_arp_send;
+
+	rwlock_t		fwcache_lock;
+        struct hlist_head       fwcache_hrules[FBXBR_FWCACHE_SIZE];
+        struct list_head        fwcache_rules;
+        unsigned int            fwcache_count;
+
+	struct list_head	next;
+};
+
+/*
+ * helpers to get bridge port from netdevice
+ */
+#define fbxbr_port_exists(dev) (dev->priv_flags & IFF_FBXBRIDGE_PORT)
+
+static inline struct fbxbr_port *
+fbxbr_port_get_rcu(const struct net_device *dev)
+{
+	return rcu_dereference(dev->rx_handler_data);
+}
+
+static inline struct fbxbr_port *
+fbxbr_port_get_rtnl(const struct net_device *dev)
+{
+	return fbxbr_port_exists(dev) ?
+		rtnl_dereference(dev->rx_handler_data) : NULL;
+}
+
+/* fbxbr_dev.c */
+int fbxbr_add_br(struct net *net, const char *name);
+
+int __fbxbr_del_br(struct net *net, const char *name);
+
+int __fbxbr_add_br_port(struct net *net, const char *name,
+			const char *port_name, bool is_wan);
+
+int __fbxbr_del_br_port_by_name(struct net *net, const char *name,
+				const char *port_name);
+
+void __fbxbr_del_br_port(struct fbxbr_port *p);
+
+int fbxbr_get_params(struct net *net, const char *name,
+		     struct fbxbridge_ioctl_params *params);
+
+int fbxbr_set_params(struct net *net, const char *name,
+		     const struct fbxbridge_ioctl_params *params);
+
+void fbxbr_capture_hw_addr(struct fbxbr *br, const u8 *hwaddr);
+
+
+/* fbxbr_dhcp.c */
+void fbxbr_dhcpd(struct fbxbr *br, struct sk_buff *skb);
+
+/* fbxbr_filter.c */
+int
+fbxbr_filter_wan_to_lan_packet(struct fbxbr *br, struct sk_buff *skb);
+int
+fbxbr_filter_lan_to_wan_packet(struct fbxbr *br, struct sk_buff *skb);
+
+/* fbxbr_fwcache.c */
+u32 fbxbr_fwcache_hash(const struct fbxbr_fwcache_key *k);
+
+struct fbxbr_fwcache *
+__fbxbr_fwcache_lookup(struct fbxbr *br, u32 hash,
+		       const struct fbxbr_fwcache_key *k);
+
+bool fbxbr_fwcache_skb_allowable(struct sk_buff *skb,
+				 bool from_wan,
+				 struct fbxbr_fwcache_key *k,
+				 bool *can_create);
+int fbxbr_fwcache_add(struct fbxbr *br,
+		      u32 hash, const struct fbxbr_fwcache_key *k);
+
+void fbxbr_fwcache_flush(struct fbxbr *br);
+
+/* fbxbr_ioctl.c */
+int fbxbr_ioctl(struct net *net, unsigned int ign, void __user *arg);
+
+/* fbxbr_input.c */
+rx_handler_result_t fbxbr_handle_frame(struct sk_buff **pskb);
+
+/* fbxbr_output.c */
+void fbxbr_output_lan_mcast_frame(struct fbxbr *br, struct sk_buff *skb);
+void fbxbr_output_lan_frame(struct fbxbr *br, struct sk_buff *skb);
+void fbxbr_output_wan_frame(struct fbxbr *br, struct sk_buff *skb);
+
+/* fbxbr_utils.c */
+int fbxbr_send_arp_frame(struct net_device *dev, u16 op,
+			 const u8 *dest_hw,
+			 __be32 src_ip, const u8 *src_hw,
+			 __be32 target_ip, const u8 *target_hw);
+
+bool fbxbr_is_valid_ip_packet(struct sk_buff *skb);
+bool fbxbr_is_valid_udp_tcp_packet(struct sk_buff *skb);
+void fbxbr_snat_packet(struct sk_buff *skb, __be32 new_addr);
+void fbxbr_dnat_packet(struct sk_buff *skb, __be32 new_addr);
+
+
+#endif /* !FBXBRIDGE_PRIVATE_H_ */
diff -Nruw linux-5.4.60-fbx/net/fbxbridge./fbxbr_utils.c linux-5.4.60-fbx/net/fbxbridge/fbxbr_utils.c
--- linux-5.4.60-fbx/net/fbxbridge./fbxbr_utils.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxbridge/fbxbr_utils.c	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,204 @@
+#include <linux/if_arp.h>
+#include <net/ip.h>
+#include "fbxbr_private.h"
+
+/*
+ * allocate & send ARP frame to given device
+ *
+ * src_hw can be NULL, device address is used instead
+ * dest_hw can be NULL, device broadcast address is used instead
+ * target_hw can be NULL, empty address is used instead
+ */
+int fbxbr_send_arp_frame(struct net_device *dev, u16 op,
+			 const u8 *dest_hw,
+			 __be32 src_ip, const u8 *src_hw,
+			 __be32 target_ip, const u8 *target_hw)
+{
+	struct arphdr *arp;
+	struct sk_buff *skb;
+	unsigned char *arp_ptr;
+	int hlen = LL_RESERVED_SPACE(dev);
+	int tlen = dev->needed_tailroom;
+	int ret;
+
+	/* prepare arp packet */
+	skb = alloc_skb(arp_hdr_len(dev) + hlen + tlen, GFP_ATOMIC);
+	if (!skb)
+		return -ENOMEM;
+
+	skb_reserve(skb, hlen);
+	skb_reset_network_header(skb);
+	arp = skb_put(skb, arp_hdr_len(dev));
+	skb->dev = dev;
+	skb->protocol = htons(ETH_P_ARP);
+
+	if (!src_hw)
+		src_hw = dev->dev_addr;
+	if (!dest_hw)
+		dest_hw = dev->broadcast;
+
+	arp->ar_hrd = htons(dev->type);
+	arp->ar_pro = htons(ETH_P_IP);
+	arp->ar_hln = dev->addr_len;
+	arp->ar_pln = 4;
+	arp->ar_op = htons(op);
+
+	arp_ptr = (unsigned char *)(arp + 1);
+
+	memcpy(arp_ptr, src_hw, dev->addr_len);
+	arp_ptr += dev->addr_len;
+	memcpy(arp_ptr, &src_ip, 4);
+	arp_ptr += 4;
+
+	if (target_hw)
+		memcpy(arp_ptr, target_hw, dev->addr_len);
+	else
+		memset(arp_ptr, 0, dev->addr_len);
+
+	arp_ptr += dev->addr_len;
+	memcpy(arp_ptr, &target_ip, 4);
+
+	ret = dev_hard_header(skb, dev, ETH_P_ARP, dest_hw, src_hw, skb->len);
+	if (ret < 0) {
+		kfree(skb);
+		return ret;
+	}
+
+	return dev_queue_xmit(skb);
+}
+
+/*
+ * validate header fields & checksum, also linearize IP header and
+ * setup transport headers
+ */
+bool fbxbr_is_valid_ip_packet(struct sk_buff *skb)
+{
+	const struct iphdr *iph;
+
+	if (!pskb_may_pull(skb, sizeof (*iph)))
+		return false;
+
+	iph = ip_hdr(skb);
+
+	if (iph->ihl < 5 || iph->version != 4)
+		return false;
+
+	if (!pskb_may_pull(skb, iph->ihl * 4))
+		return false;
+
+	iph = ip_hdr(skb);
+
+	if (ntohs(iph->tot_len) > skb->len)
+		return false;
+
+	skb->transport_header = skb->network_header + iph->ihl * 4;
+
+	return true;
+}
+
+/*
+ * make sure the udp/tcp header is present in the linear section
+ */
+bool fbxbr_is_valid_udp_tcp_packet(struct sk_buff *skb)
+{
+	const struct iphdr *iph;
+
+	iph = ip_hdr(skb);
+
+	switch (iph->protocol) {
+	case IPPROTO_UDP:
+		if (!pskb_may_pull(skb, skb_transport_offset(skb) +
+				   sizeof (struct udphdr)))
+			return false;
+		break;
+	case IPPROTO_TCP:
+		if (!pskb_may_pull(skb, skb_transport_offset(skb) +
+				   sizeof (struct tcphdr)))
+			return false;
+		break;
+	}
+	return true;
+}
+
+
+/*
+ * do source or destination nat
+ */
+static void recalculate_l4_checksum(struct sk_buff *skb,
+				    __be32 osaddr, __be32 odaddr)
+{
+	struct iphdr *iph;
+	u16 check;
+
+	iph = ip_hdr(skb);
+	if (iph->frag_off & htons(IP_OFFSET))
+		return;
+
+	if (!fbxbr_is_valid_udp_tcp_packet(skb))
+		return;
+
+	iph = ip_hdr(skb);
+
+	switch (iph->protocol) {
+	case IPPROTO_TCP:
+	{
+		struct tcphdr *tcph;
+
+		tcph = (struct tcphdr *)skb_transport_header(skb);
+		check = tcph->check;
+		if (skb->ip_summed != CHECKSUM_COMPLETE)
+			check = ~check;
+		check = csum_tcpudp_magic(iph->saddr, iph->daddr, 0, 0, check);
+		check = csum_tcpudp_magic(~osaddr, ~odaddr, 0, 0, ~check);
+		if (skb->ip_summed == CHECKSUM_COMPLETE)
+			check = ~check;
+		tcph->check = check;
+		break;
+	}
+
+	case IPPROTO_UDP:
+	{
+		struct udphdr *udph;
+
+		udph = (struct udphdr *)skb_transport_header(skb);
+		check = udph->check;
+		if (check != 0) {
+			check = csum_tcpudp_magic(iph->saddr, iph->daddr,
+						  0, 0, ~check);
+			check = csum_tcpudp_magic(~osaddr, ~odaddr, 0, 0,
+						  ~check);
+			udph->check = check ? : 0xFFFF;
+		}
+		break;
+	}
+	}
+}
+
+/*
+ * packet must be valid IPv4 with header in linear section
+ */
+void fbxbr_snat_packet(struct sk_buff *skb, __be32 new_addr)
+{
+	struct iphdr *ip;
+	__be32 oaddr;
+
+	ip = ip_hdr(skb);
+	oaddr = ip->saddr;
+	ip->saddr = new_addr;
+	ip->check = 0;
+	ip->check = ip_fast_csum((unsigned char *) ip, ip->ihl);
+	recalculate_l4_checksum(skb, oaddr, ip->daddr);
+}
+
+void fbxbr_dnat_packet(struct sk_buff *skb, __be32 new_addr)
+{
+	struct iphdr *ip;
+	__be32 oaddr;
+
+	ip = ip_hdr(skb);
+	oaddr = ip->daddr;
+	ip->daddr = new_addr;
+	ip->check = 0;
+	ip->check = ip_fast_csum((unsigned char *) ip, ip->ihl);
+	recalculate_l4_checksum(skb, ip->saddr, oaddr);
+}
diff -Nruw linux-5.4.60-fbx/net/fbxbridge./Kconfig linux-5.4.60-fbx/net/fbxbridge/Kconfig
--- linux-5.4.60-fbx/net/fbxbridge./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxbridge/Kconfig	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,8 @@
+
+#
+# Freebox bridge
+#
+config FBXBRIDGE
+	bool "Freebox Bridge"
+	select NETFILTER
+	select NF_CONNTRACK
diff -Nruw linux-5.4.60-fbx/net/fbxbridge./Makefile linux-5.4.60-fbx/net/fbxbridge/Makefile
--- linux-5.4.60-fbx/net/fbxbridge./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/fbxbridge/Makefile	2021-03-04 13:21:01.414172385 +0100
@@ -0,0 +1,12 @@
+
+obj-$(CONFIG_FBXBRIDGE)	+= fbxbridge.o
+
+fbxbridge-objs := 		\
+	fbxbr_dev.o		\
+	fbxbr_dhcp.o		\
+	fbxbr_filter.o		\
+	fbxbr_fwcache.o		\
+	fbxbr_input.o		\
+	fbxbr_ioctl.o		\
+	fbxbr_output.o		\
+	fbxbr_utils.o
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/net/ipv4/ip_ffn.c	2021-04-21 09:44:50.981838485 +0200
@@ -0,0 +1,709 @@
+/*
+ * IP fast forwarding and NAT
+ *
+ * Very restrictive code, that only cope non fragmented UDP and TCP
+ * packets, that are routed and NATed with no other modification.
+ *
+ * Provide a fast path for established conntrack entries so that
+ * packets go out ASAP.
+ */
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/net.h>
+#include <linux/tcp.h>
+#include <linux/udp.h>
+#include <linux/jhash.h>
+#include <linux/proc_fs.h>
+#include <net/ip.h>
+#include <net/route.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+
+#include <net/ip_ffn.h>
+
+#define FFN_CACHE_SIZE		256
+#define MAX_FFN_ENTRY		2048
+
+DEFINE_SPINLOCK(ffn_lock);
+static struct list_head ffn_cache[FFN_CACHE_SIZE];
+static struct list_head ffn_all;
+static unsigned int ffn_entry_count;
+
+/*
+ * hash on five parameter
+ */
+static inline unsigned int ffn_hash(u32 sip, u32 dip, u16 sport, u16 dport,
+				    int is_tcp)
+{
+	return jhash_3words(sip, is_tcp ? dip : ~dip, sport | dport << 16, 0);
+}
+
+/*
+ * attempt to find entry with given value in cache
+ */
+static struct ffn_lookup_entry *__ffn_find(u32 sip, u32 dip,
+					   u16 sport, u16 dport,
+					   u8 protocol,
+					   unsigned int hash)
+{
+	struct ffn_lookup_entry *tmp;
+
+	list_for_each_entry(tmp, &ffn_cache[hash % FFN_CACHE_SIZE], next) {
+
+		/* compare entry */
+		if (tmp->sip == sip && tmp->dip == dip &&
+		    tmp->sport == sport && tmp->dport == dport &&
+		    tmp->protocol == protocol)
+			return tmp;
+	}
+	return NULL;
+}
+
+struct ffn_lookup_entry *__ffn_get(u32 sip, u32 dip,
+				   u16 sport, u16 dport,
+				   int is_tcp)
+{
+	unsigned int hash;
+	u8 protocol;
+
+	/* lookup entry in cache */
+	protocol = (is_tcp) ? IPPROTO_TCP : IPPROTO_UDP;
+	hash = ffn_hash(sip, dip, sport, dport, is_tcp);
+	return __ffn_find(sip, dip, sport, dport, protocol, hash);
+}
+
+static void __ffn_remove_entry(struct ffn_lookup_entry *e)
+{
+	if (e->manip.priv_destructor)
+		e->manip.priv_destructor((void *)e->manip.ffn_priv_area);
+	list_del(&e->next);
+	list_del(&e->all_next);
+	ffn_entry_count--;
+	dst_release(e->manip.dst);
+	kfree(e);
+}
+
+static int __ffn_add_entry(struct ffn_lookup_entry *e,
+			   u8 proto, unsigned int hash)
+{
+	/* make sure it's not present */
+	if (__ffn_find(e->sip, e->dip, e->sport, e->dport, proto, hash))
+		return 1;
+
+	if (ffn_entry_count >= MAX_FFN_ENTRY)
+		return 1;
+
+	/* add new entry */
+	list_add_tail(&e->next, &ffn_cache[hash % FFN_CACHE_SIZE]);
+	list_add_tail(&e->all_next, &ffn_all);
+	ffn_entry_count++;
+	return 0;
+}
+
+/*
+ *
+ */
+static inline __sum16 checksum_adjust(u32 osip,
+				      u32 nsip,
+				      u32 odip,
+				      u32 ndip,
+				      u16 osport,
+				      u16 nsport,
+				      u16 odport,
+				      u16 ndport)
+{
+	const u32 old[] = { osip, odip, osport, odport };
+	const u32 new[] = { nsip, ndip, nsport, ndport };
+	__wsum osum, nsum;
+
+	osum = csum_partial(old, sizeof (old), 0);
+	nsum = csum_partial(new, sizeof (new), 0);
+
+	return ~csum_fold(csum_sub(nsum, osum));
+}
+
+/*
+ *
+ */
+static inline __sum16 checksum_adjust_ip(u32 osip,
+					 u32 nsip,
+					 u32 odip,
+					 u32 ndip)
+{
+	const u32 old[] = { osip, odip };
+	const u32 new[] = { nsip, ndip };
+	__wsum osum, nsum;
+
+	osum = csum_partial(old, sizeof (old), 0);
+	nsum = csum_partial(new, sizeof (new), 0);
+
+	/* -1 for TTL decrease */
+	return ~csum_fold(csum_sub(csum_sub(nsum, osum), 1));
+}
+
+/*
+ * two hooks into netfilter code
+ */
+extern int external_tcpv4_packet(struct nf_conn *ct,
+				 struct sk_buff *skb,
+				 unsigned int dataoff,
+				 enum ip_conntrack_info ctinfo);
+
+extern int external_udpv4_packet(struct nf_conn *ct,
+				 struct sk_buff *skb,
+				 unsigned int dataoff,
+				 enum ip_conntrack_info ctinfo);
+
+extern int ip_local_deliver_finish(struct net *net,
+				   struct sock *sk, struct sk_buff *skb);
+
+/*
+ * check if packet is in ffn cache, or mark it if it can be added
+ * later
+ */
+int ip_ffn_process(struct sk_buff *skb)
+{
+	struct ffn_lookup_entry *e;
+	struct nf_conntrack *nfct;
+	struct iphdr *iph;
+	struct tcphdr *tcph = NULL;
+	struct udphdr *udph = NULL;
+	bool remove_me;
+	u16 tcheck;
+	u8 proto;
+	int res, added_when;
+
+	if (!net_eq(dev_net(skb->dev), &init_net))
+		goto not_ffnable;
+
+	iph = ip_hdr(skb);
+
+	/* refuse fragmented IP packet, or packets with IP options */
+	if (iph->ihl > 5 || (iph->frag_off & htons(IP_MF | IP_OFFSET)))
+		goto not_ffnable;
+
+	/* check encapsulated protocol is udp or tcp */
+	if (iph->protocol != IPPROTO_TCP && iph->protocol != IPPROTO_UDP)
+		goto not_ffnable;
+
+	if (iph->ttl <= 1)
+		goto not_ffnable;
+
+	proto = iph->protocol;
+	if (proto == IPPROTO_TCP) {
+		if (skb_headlen(skb) < sizeof (*iph) + sizeof (struct tcphdr))
+			goto not_ffnable;
+
+		tcph = (struct tcphdr *)((unsigned char *)iph + sizeof (*iph));
+
+		if (tcph->doff * 4 < sizeof (struct tcphdr))
+			goto not_ffnable;
+
+		if (skb_headlen(skb) < sizeof (*iph) + tcph->doff * 4)
+			goto not_ffnable;
+
+		spin_lock_bh(&ffn_lock);
+		e = __ffn_get(iph->saddr, iph->daddr, tcph->source,
+			      tcph->dest, 1);
+	} else {
+		if (skb_headlen(skb) < sizeof (*iph) + sizeof (struct udphdr))
+			goto not_ffnable;
+
+		udph = (struct udphdr *)((unsigned char *)iph + sizeof (*iph));
+		spin_lock_bh(&ffn_lock);
+		e = __ffn_get(iph->saddr, iph->daddr, udph->source,
+			      udph->dest, 0);
+	}
+
+	if (!e) {
+		spin_unlock_bh(&ffn_lock);
+		goto ffnable;
+	}
+
+	if (e->manip.dst->obsolete > 0) {
+		__ffn_remove_entry(e);
+		spin_unlock_bh(&ffn_lock);
+		goto ffnable;
+	}
+
+	nfct = &e->manip.ct->ct_general;
+	nf_conntrack_get(nfct);
+
+	remove_me = false;
+	if (proto == IPPROTO_TCP) {
+		/* do sequence number checking and update
+		 * conntrack info */
+		res = external_tcpv4_packet(e->manip.ct, skb, sizeof (*iph),
+					    e->manip.ctinfo);
+		if (e->manip.ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED)
+			remove_me = true;
+		tcheck = tcph->check;
+
+	} else {
+		res = external_udpv4_packet(e->manip.ct, skb, sizeof (*iph),
+					    e->manip.ctinfo);
+		tcheck = udph->check;
+	}
+
+	if (unlikely(res != NF_ACCEPT)) {
+		/* packet rejected by conntrack, unless asked to drop,
+		 * send it back into kernel */
+		if (remove_me)
+			__ffn_remove_entry(e);
+
+		spin_unlock_bh(&ffn_lock);
+		nf_conntrack_put(nfct);
+
+		if (res == NF_DROP) {
+			dev_kfree_skb(skb);
+			return 0;
+		}
+
+		goto ffnable;
+	}
+
+	if (!e->manip.alter)
+		goto fix_ip_hdr;
+
+	if (skb->ip_summed != CHECKSUM_PARTIAL) {
+		/* fix ports & transport protocol checksum */
+		if (proto == IPPROTO_TCP) {
+			tcph->source = e->manip.new_sport;
+			tcph->dest = e->manip.new_dport;
+			tcph->check = csum16_sub(tcph->check,
+						 e->manip.l4_adjustment);
+		} else {
+			udph->source = e->manip.new_sport;
+			udph->dest = e->manip.new_dport;
+			if (udph->check) {
+				u16 tcheck;
+
+				tcheck = csum16_sub(udph->check,
+						    e->manip.l4_adjustment);
+				udph->check = tcheck ? tcheck : 0xffff;
+			}
+		}
+	} else {
+		unsigned int len;
+
+		/*
+		 * assume tcph->check only covers ip pseudo header, so
+		 * don't update checksum wrt port change
+		 *
+		 * we might check skb->csum_offset to confirm that
+		 * this is a valid assertion
+		 */
+		if (proto == IPPROTO_TCP) {
+			len = skb->len - ((void *)tcph - (void *)iph);
+			tcheck = ~csum_tcpudp_magic(e->manip.new_sip,
+						    e->manip.new_dip,
+						    len, IPPROTO_TCP, 0);
+			tcph->check = tcheck;
+			tcph->source = e->manip.new_sport;
+			tcph->dest = e->manip.new_dport;
+		} else {
+			len = skb->len - ((void *)udph - (void *)iph);
+			if (udph->check) {
+				tcheck = ~csum_tcpudp_magic(e->manip.new_sip,
+							    e->manip.new_dip,
+							    len,
+							    IPPROTO_UDP, 0);
+				udph->check = tcheck ? tcheck : 0xffff;
+			}
+			udph->source = e->manip.new_sport;
+			udph->dest = e->manip.new_dport;
+		}
+	}
+
+	/* update IP header field */
+	iph->saddr = e->manip.new_sip;
+	iph->daddr = e->manip.new_dip;
+
+fix_ip_hdr:
+	iph->ttl--;
+
+	if (e->manip.tos_change) {
+		iph->tos = e->manip.new_tos;
+		iph->check = 0;
+		iph->check = ip_fast_csum((u8 *)iph, 5);
+	} else {
+		iph->check = csum16_sub(iph->check,
+					e->manip.ip_adjustment);
+	}
+
+	/* forward skb */
+	if (e->manip.force_skb_prio)
+		skb->priority = e->manip.new_skb_prio;
+	else
+		skb->priority = rt_tos2priority(iph->tos);
+
+	skb->mark = e->manip.new_mark;
+
+#ifdef CONFIG_IP_FFN_PROCFS
+	e->forwarded_packets++;
+	e->forwarded_bytes += skb->len;
+#endif
+
+	skb_dst_drop(skb);
+	skb_dst_set(skb, dst_clone(e->manip.dst));
+
+	if (nfct == skb_nfct(skb)) {
+		/*
+		 * skbs to/from localhost will have the conntrack
+		 * already set, don't leak references here.
+		 */
+		nf_conntrack_put(nfct);
+	} else {
+		if (unlikely(skb_nfct(skb) != NULL)) {
+			/*
+			 * conntrack is not NULL here and it is not
+			 * the same as the one we have in the
+			 * ffn_entry, this shoud not happen, warn once
+			 * and switch to slow path.
+			 */
+			WARN_ONCE(1,
+				  "weird skb->nfct %p, NULL was expected\n",
+				  skb_nfct(skb));
+			printk_once(KERN_WARNING "ffn entry:\n"
+				    " added_when: %i\n"
+				    " sip: %pI4 -> %pI4\n"
+				    " dip: %pI4 -> %pI4\n"
+				    " sport: %u -> %u\n"
+				    " dport: %u -> %u\n",
+				    e->added_when,
+				    &e->sip, &e->manip.new_sip,
+				    &e->dip, &e->manip.new_dip,
+				    htons(e->sport), htons(e->manip.new_sport),
+				    htons(e->dport), htons(e->manip.new_dport));
+			goto not_ffnable;
+		}
+		nf_ct_set(skb, (struct nf_conn *)nfct, e->manip.ctinfo);
+	}
+
+	added_when = e->added_when;
+	if (remove_me)
+		__ffn_remove_entry(e);
+	spin_unlock_bh(&ffn_lock);
+
+	skb->ffn_state = FFN_STATE_FAST_FORWARDED;
+	IPCB(skb)->flags |= IPSKB_FORWARDED;
+
+	if (added_when == IP_FFN_FINISH_OUT)
+		dst_output(&init_net, skb->sk, skb);
+	else
+		ip_local_deliver_finish(&init_net, skb->sk, skb);
+
+	return 0;
+
+ffnable:
+	skb->ffn_state = FFN_STATE_FORWARDABLE;
+	skb->ffn_orig_tos = iph->tos;
+	return 1;
+
+not_ffnable:
+	skb->ffn_state = FFN_STATE_INCOMPATIBLE;
+	return 1;
+}
+
+/*
+ * check if skb is candidate for ffn, and if so add it to ffn cache
+ *
+ * called after post routing
+ */
+void ip_ffn_add(struct sk_buff *skb, int when)
+{
+	struct nf_conn *ct;
+	struct nf_conntrack_tuple *tuple, *rtuple;
+	enum ip_conntrack_info ctinfo;
+	struct ffn_lookup_entry *e;
+	struct iphdr *iph;
+	unsigned int hash;
+	struct net *skb_net;
+	int dir;
+	u8 proto;
+
+	skb_net = dev_net(skb->dev);
+	if (!unlikely(net_eq(skb_net, &init_net)))
+		return;
+
+	/* make sure external_tcp_packet/external_udp_packet won't
+	 * attempt to checksum packet, the ffn code does not update
+	 * skb->csum, which must stay valid if skb_checksum_complete
+	 * has been called */
+	if (unlikely(skb_net->ct.sysctl_checksum))
+		skb_net->ct.sysctl_checksum = 0;
+
+	if (ffn_entry_count >= MAX_FFN_ENTRY)
+		return;
+
+	iph = ip_hdr(skb);
+
+	if (skb_dst(skb)->output != ip_output && when == IP_FFN_FINISH_OUT)
+		return;
+
+	ct = nf_ct_get(skb, &ctinfo);
+	if (!ct || ctinfo == IP_CT_UNTRACKED)
+		return;
+
+	if ((ctinfo != IP_CT_ESTABLISHED) &&
+	    (ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY)) {
+		return;
+	}
+
+	if (nfct_help(ct))
+		return;
+
+	dir = (ctinfo == IP_CT_ESTABLISHED) ?
+		IP_CT_DIR_ORIGINAL : IP_CT_DIR_REPLY;
+	tuple = &ct->tuplehash[dir].tuple;
+
+	if (tuple->dst.protonum != IPPROTO_TCP &&
+	    tuple->dst.protonum != IPPROTO_UDP)
+		return;
+
+	if (tuple->dst.protonum == IPPROTO_TCP &&
+	    ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED)
+		return;
+
+	rtuple = &ct->tuplehash[1 - dir].tuple;
+
+	e = kmalloc(sizeof (*e), GFP_ATOMIC);
+	if (!e)
+		return;
+
+	e->added_when = when;
+	e->sip = tuple->src.u3.ip;
+	e->dip = tuple->dst.u3.ip;
+	e->sport = tuple->src.u.all;
+	e->dport = tuple->dst.u.all;
+	e->protocol = tuple->dst.protonum;
+
+#ifdef CONFIG_IP_FFN_PROCFS
+	e->forwarded_packets = 0;
+	e->forwarded_bytes = 0;
+#endif
+
+	e->manip.new_sip = rtuple->dst.u3.ip;
+	e->manip.new_dip = rtuple->src.u3.ip;
+	e->manip.new_sport = rtuple->dst.u.all;
+	e->manip.new_dport = rtuple->src.u.all;
+
+	if (e->manip.new_sip == e->sip &&
+	    e->manip.new_dip == e->dip &&
+	    e->manip.new_sport == e->sport &&
+	    e->manip.new_dport == e->dport)
+		e->manip.alter = 0;
+	else
+		e->manip.alter = 1;
+
+	if (e->manip.alter) {
+		/* compute checksum adjustement */
+		e->manip.l4_adjustment = checksum_adjust(e->sip,
+							 e->manip.new_sip,
+							 e->dip,
+							 e->manip.new_dip,
+							 e->sport,
+							 e->manip.new_sport,
+							 e->dport,
+							 e->manip.new_dport);
+	}
+
+	e->manip.ip_adjustment = checksum_adjust_ip(e->sip,
+						    e->manip.new_sip,
+						    e->dip,
+						    e->manip.new_dip);
+
+	if (skb->ffn_orig_tos != iph->tos) {
+		e->manip.tos_change = 1;
+		e->manip.new_tos = iph->tos;
+	} else
+		e->manip.tos_change = 0;
+
+	if (skb->priority != rt_tos2priority(iph->tos)) {
+		e->manip.force_skb_prio = 1;
+		e->manip.new_skb_prio = skb->priority;
+	} else
+		e->manip.force_skb_prio = 0;
+
+	e->manip.new_mark = skb->mark;
+	e->manip.priv_destructor = NULL;
+	e->manip.dst = skb_dst(skb);
+	dst_hold(e->manip.dst);
+	e->manip.ct = ct;
+	e->manip.ctinfo = ctinfo;
+
+	hash = ffn_hash(e->sip, e->dip, e->sport, e->dport,
+			e->protocol == IPPROTO_TCP);
+	proto = (e->protocol == IPPROTO_TCP) ? IPPROTO_TCP : IPPROTO_UDP;
+
+	spin_lock_bh(&ffn_lock);
+	if (__ffn_add_entry(e, proto, hash)) {
+		spin_unlock_bh(&ffn_lock);
+		dst_release(e->manip.dst);
+		kfree(e);
+		return;
+	}
+	spin_unlock_bh(&ffn_lock);
+}
+
+/*
+ * netfilter callback when conntrack is about to be destroyed
+ */
+void ip_ffn_ct_destroy(struct nf_conn *ct)
+{
+	struct nf_conntrack_tuple *tuple;
+	struct ffn_lookup_entry *e;
+	int dir;
+
+	/* locate all entry that use this conntrack */
+	for (dir = 0; dir < 2; dir++) {
+		tuple = &ct->tuplehash[dir].tuple;
+
+		if (tuple->dst.protonum != IPPROTO_TCP &&
+		    tuple->dst.protonum != IPPROTO_UDP)
+			return;
+
+		spin_lock_bh(&ffn_lock);
+		e = __ffn_get(tuple->src.u3.ip, tuple->dst.u3.ip,
+			      tuple->src.u.all, tuple->dst.u.all,
+			      tuple->dst.protonum == IPPROTO_TCP);
+		if (e)
+			__ffn_remove_entry(e);
+		spin_unlock_bh(&ffn_lock);
+	}
+}
+
+/*
+ * initialize ffn cache data
+ */
+static void __ip_ffn_init_cache(void)
+{
+	int i;
+
+	for (i = 0; i < FFN_CACHE_SIZE; i++)
+		INIT_LIST_HEAD(&ffn_cache[i]);
+	INIT_LIST_HEAD(&ffn_all);
+	ffn_entry_count = 0;
+}
+
+/*
+ * flush all ffn cache
+ */
+void ip_ffn_flush_all(void)
+{
+	struct ffn_lookup_entry *e, *tmp;
+
+	spin_lock_bh(&ffn_lock);
+	list_for_each_entry_safe(e, tmp, &ffn_all, all_next)
+		__ffn_remove_entry(e);
+	__ip_ffn_init_cache();
+	spin_unlock_bh(&ffn_lock);
+}
+
+#ifdef CONFIG_IP_FFN_PROCFS
+struct proc_dir_entry *proc_net_ip_ffn;
+
+static int ip_ffn_entries_show(struct seq_file *m, void *v)
+{
+	int i;
+
+	spin_lock_bh(&ffn_lock);
+
+	for (i = 0; i < FFN_CACHE_SIZE; ++i) {
+		struct ffn_lookup_entry *e;
+
+		if (list_empty(&ffn_cache[i]))
+			continue;
+
+		seq_printf(m, "Bucket %i:\n", i);
+		list_for_each_entry (e, &ffn_cache[i], next) {
+			seq_printf(m, " Protocol: ");
+			switch (e->protocol) {
+			case IPPROTO_TCP:
+				seq_printf(m, "TCPv4\n");
+				break;
+			case IPPROTO_UDP:
+				seq_printf(m, "UDPv4\n");
+				break;
+			default:
+				seq_printf(m, "ipproto_%i\n", e->protocol);
+				break;
+			}
+			seq_printf(m, " Original flow: %pI4:%u -> %pI4:%u\n",
+				   &e->sip,
+				   ntohs(e->sport),
+				   &e->dip,
+				   ntohs(e->dport));
+
+			if (e->sip != e->manip.new_sip ||
+			    e->dip != e->manip.new_dip ||
+			    e->sport != e->manip.new_sport ||
+			    e->dport != e->manip.new_dport) {
+				seq_printf(m,
+					   " Modified flow: %pI4:%u -> "
+					   "%pI4:%u\n",
+					   &e->manip.new_sip,
+					   ntohs(e->manip.new_sport),
+					   &e->manip.new_dip,
+					   ntohs(e->manip.new_dport));
+			}
+
+			seq_printf(m, "  Forwarded packets: %u\n",
+				   e->forwarded_packets);
+			seq_printf(m, "  Forwarded bytes: %llu\n",
+				   e->forwarded_bytes);
+			seq_printf(m, "\n");
+		}
+	}
+
+	spin_unlock_bh(&ffn_lock);
+	return 0;
+}
+
+static int ip_ffn_entries_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, ip_ffn_entries_show, NULL);
+}
+
+static const struct file_operations ip_ffn_entries_fops = {
+	.owner = THIS_MODULE,
+	.open	= ip_ffn_entries_open,
+	.release = single_release,
+	.read = seq_read,
+	.llseek = seq_lseek,
+};
+
+
+static int __init __ip_ffn_init_procfs(void)
+{
+	proc_net_ip_ffn = proc_net_mkdir(&init_net, "ip_ffn",
+					 init_net.proc_net);
+	if (!proc_net_ip_ffn) {
+		printk(KERN_ERR "proc_mkdir() has failed for 'net/ip_ffn'.\n");
+		return -1;
+	}
+
+	if (proc_create("entries", 0400, proc_net_ip_ffn,
+			&ip_ffn_entries_fops) == NULL) {
+		printk(KERN_ERR "proc_create() has failed for "
+		       "'net/ip_ffn/entries'.\n");
+		return -1;
+	}
+	return 0;
+}
+#endif
+
+/*
+ * initialize ffn
+ */
+void __init ip_ffn_init(void)
+{
+	printk("IP Fast Forward and NAT enabled\n");
+	__ip_ffn_init_cache();
+
+#ifdef CONFIG_IP_FFN_PROCFS
+	if (__ip_ffn_init_procfs() < 0)
+		printk(KERN_WARNING "IP FFN: unable to create proc entries.\n");
+#endif
+}
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/net/ipv6/ip6_ffn.c	2021-04-21 09:44:50.981838485 +0200
@@ -0,0 +1,647 @@
+/*
+ * IPv6 fast forwarding and NAT
+ *
+ * Very restrictive code, that only cope non fragmented UDP and TCP
+ * packets, that are routed and NATed with no other modification.
+ *
+ * Provide a fast path for established conntrack entries so that
+ * packets go out ASAP.
+ */
+
+#include <linux/tcp.h>
+#include <linux/udp.h>
+#include <linux/jhash.h>
+#include <linux/proc_fs.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+
+#include <net/ip6_ffn.h>
+#include <net/dsfield.h>
+
+#define FFN6_CACHE_SIZE		256
+#define MAX_FFN6_ENTRY		2048
+
+DEFINE_SPINLOCK(ffn6_lock);
+static struct list_head ffn6_cache[FFN6_CACHE_SIZE];
+static struct list_head ffn6_all;
+static unsigned int ffn6_entry_count;
+
+static void __ffn6_remove_entry(struct ffn6_lookup_entry *e)
+{
+	if (e->manip.priv_destructor)
+		e->manip.priv_destructor((void *)e->manip.ffn_priv_area);
+	list_del(&e->next);
+	list_del(&e->all_next);
+	ffn6_entry_count--;
+	dst_release(e->manip.dst);
+	kfree(e);
+}
+
+/*
+ * hash on five parameter
+ */
+static inline unsigned int ffn6_hash(const u32 *sip, const u32 *dip,
+				     u16 sport, u16 dport,
+				     int is_tcp)
+{
+	return jhash_3words(sip[3], is_tcp ? dip[3] : ~dip[3],
+			    sport | dport << 16, 0);
+}
+
+/*
+ * attempt to find entry with given value in cache
+ */
+static struct ffn6_lookup_entry *__ffn6_find(const u32 *sip, const u32 *dip,
+					     u16 sport, u16 dport,
+					     u8 protocol,
+					     unsigned int hash)
+{
+	struct ffn6_lookup_entry *tmp;
+
+	list_for_each_entry(tmp, &ffn6_cache[hash % FFN6_CACHE_SIZE], next) {
+
+		/* compare entry */
+		if (!memcmp(tmp->sip, sip, 16) &&
+		    !memcmp(tmp->dip, dip, 16) &&
+		    tmp->sport == sport && tmp->dport == dport &&
+		    tmp->protocol == protocol)
+			return tmp;
+	}
+	return NULL;
+}
+
+struct ffn6_lookup_entry *__ffn6_get(const u32 *sip, const u32 *dip,
+				     u16 sport, u16 dport,
+				     int is_tcp)
+{
+	unsigned int hash;
+	u8 protocol;
+
+	/* lookup entry in cache */
+	protocol = (is_tcp) ? IPPROTO_TCP : IPPROTO_UDP;
+	hash = ffn6_hash(sip, dip, sport, dport, is_tcp);
+	return __ffn6_find(sip, dip, sport, dport, protocol, hash);
+}
+
+static int __ffn6_add_entry(struct ffn6_lookup_entry *e,
+			    u8 proto, unsigned int hash)
+{
+	/* make sure it's not present */
+	if (__ffn6_find(e->sip, e->dip, e->sport, e->dport, proto, hash))
+		return 1;
+
+	if (ffn6_entry_count >= MAX_FFN6_ENTRY)
+		return 1;
+
+	/* add new entry */
+	list_add_tail(&e->next, &ffn6_cache[hash % FFN6_CACHE_SIZE]);
+	list_add_tail(&e->all_next, &ffn6_all);
+	ffn6_entry_count++;
+	return 0;
+}
+
+/*
+ * two hooks into netfilter code
+ */
+extern int external_tcpv6_packet(struct nf_conn *ct,
+				 struct sk_buff *skb,
+				 unsigned int dataoff,
+				 enum ip_conntrack_info ctinfo);
+
+extern int external_udpv6_packet(struct nf_conn *ct,
+				 struct sk_buff *skb,
+				 unsigned int dataoff,
+				 enum ip_conntrack_info ctinfo);
+
+/*
+ * check if packet is in ffn cache, or mark it if it can be added
+ * later
+ */
+int ipv6_ffn_process(struct sk_buff *skb)
+{
+	struct ffn6_lookup_entry *e;
+	struct nf_conntrack *nfct;
+	struct ipv6hdr *iph;
+	struct tcphdr *tcph = NULL;
+	struct udphdr *udph = NULL;
+	bool remove_me;
+	int added_when;
+	u8 proto;
+	int res;
+
+	if (!net_eq(dev_net(skb->dev), &init_net))
+		goto not_ffnable;
+
+	iph = ipv6_hdr(skb);
+
+	/* check encapsulated protocol is udp or tcp */
+	proto = iph->nexthdr;
+	if (proto != IPPROTO_TCP && proto != IPPROTO_UDP)
+		goto not_ffnable;
+
+	if (iph->hop_limit <= 1 || !iph->payload_len)
+		goto not_ffnable;
+
+	/* TODO: implement this later, no hardware to test for now */
+	if (skb->ip_summed == CHECKSUM_PARTIAL)
+		goto not_ffnable;
+
+	proto = iph->nexthdr;
+	if (proto == IPPROTO_TCP) {
+		if (skb_headlen(skb) < sizeof (*iph) + sizeof (struct tcphdr))
+			goto not_ffnable;
+
+		tcph = (struct tcphdr *)((unsigned char *)iph + sizeof (*iph));
+
+		if (tcph->doff * 4 < sizeof (struct tcphdr))
+			goto not_ffnable;
+
+		if (skb_headlen(skb) < sizeof (*iph) + tcph->doff * 4)
+			goto not_ffnable;
+
+		spin_lock_bh(&ffn6_lock);
+		e = __ffn6_get(iph->saddr.s6_addr32, iph->daddr.s6_addr32,
+			       tcph->source, tcph->dest, 1);
+	} else {
+
+		if (skb_headlen(skb) < sizeof (*iph) + sizeof (struct udphdr))
+			goto not_ffnable;
+
+		udph = (struct udphdr *)((unsigned char *)iph + sizeof (*iph));
+
+		spin_lock_bh(&ffn6_lock);
+		e = __ffn6_get(iph->saddr.s6_addr32, iph->daddr.s6_addr32,
+			       udph->source, udph->dest, 0);
+	}
+
+	if (!e) {
+		spin_unlock_bh(&ffn6_lock);
+		goto ffnable;
+	}
+
+	if (e->manip.dst->obsolete > 0) {
+		__ffn6_remove_entry(e);
+		spin_unlock_bh(&ffn6_lock);
+		goto ffnable;
+	}
+
+	nfct = &e->manip.ct->ct_general;
+	nf_conntrack_get(nfct);
+
+	remove_me = false;
+	if (proto == IPPROTO_TCP) {
+		/* do sequence number checking and update
+		 * conntrack info */
+		res = external_tcpv6_packet(e->manip.ct, skb, sizeof (*iph),
+					    e->manip.ctinfo);
+		if (e->manip.ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED)
+			remove_me = true;
+	} else {
+		res = external_udpv6_packet(e->manip.ct, skb, sizeof (*iph),
+					    e->manip.ctinfo);
+	}
+
+	if (unlikely(res != NF_ACCEPT)) {
+		/* packet rejected by conntrack, unless asked to drop,
+		 * send it back into kernel */
+		if (remove_me)
+			__ffn6_remove_entry(e);
+
+		spin_unlock_bh(&ffn6_lock);
+		nf_conntrack_put(nfct);
+
+		if (res == NF_DROP) {
+			dev_kfree_skb(skb);
+			return 0;
+		}
+
+		goto ffnable;
+	}
+
+	if (!e->manip.alter)
+		goto fix_ip_hdr;
+
+	/* fix ports & transport protocol checksum */
+	if (proto == IPPROTO_TCP) {
+		tcph->source = e->manip.new_sport;
+		tcph->dest = e->manip.new_dport;
+		tcph->check = csum16_sub(tcph->check, e->manip.adjustment);
+	} else {
+		udph->source = e->manip.new_sport;
+		udph->dest = e->manip.new_dport;
+		if (udph->check) {
+			u16 tcheck;
+
+			tcheck = csum16_sub(udph->check, e->manip.adjustment);
+			udph->check = tcheck ? tcheck : 0xffff;
+		}
+	}
+
+	memcpy(iph->saddr.s6_addr32, e->manip.new_sip, 16);
+	memcpy(iph->daddr.s6_addr32, e->manip.new_dip, 16);
+
+fix_ip_hdr:
+	/* update IP header field */
+	iph->hop_limit--;
+	if (e->manip.tos_change)
+		ipv6_change_dsfield(iph, 0, e->manip.new_tos);
+
+	if (e->manip.force_skb_prio)
+		skb->priority = e->manip.new_skb_prio;
+	else
+		skb->priority = rt_tos2priority(ipv6_get_dsfield(iph));
+
+	skb->mark = e->manip.new_mark;
+
+#ifdef CONFIG_IPV6_FFN_PROCFS
+	e->forwarded_packets++;
+	e->forwarded_bytes += skb->len;
+#endif
+
+	skb_dst_drop(skb);
+	skb_dst_set(skb, dst_clone(e->manip.dst));
+
+	if (nfct == skb_nfct(skb)) {
+		/*
+		 * skbs to/from localhost will have the conntrack
+		 * already set, don't leak references here.
+		 */
+		nf_conntrack_put(nfct);
+	} else {
+		if (unlikely(skb_nfct(skb) != NULL)) {
+			/*
+			 * conntrack is not NULL here and it is not
+			 * the same as the one we have in the
+			 * ffn_entry, this shoud not happen, warn once
+			 * and switch to slow path.
+			 */
+			WARN_ONCE(1,
+				  "weird skb->nfct %p, NULL was expected\n",
+				  skb_nfct(skb));
+			printk_once(KERN_WARNING "ffn entry:\n"
+				    " added_when: %i\n"
+				    " sip: %pI6 -> %pI6\n"
+				    " dip: %pI6 -> %pI6\n"
+				    " sport: %u -> %u\n"
+				    " dport: %u -> %u\n",
+				    e->added_when,
+				    e->sip, e->manip.new_sip,
+				    e->dip, e->manip.new_dip,
+				    htons(e->sport), htons(e->manip.new_sport),
+				    htons(e->dport), htons(e->manip.new_dport));
+			goto not_ffnable;
+		}
+		nf_ct_set(skb, (struct nf_conn *)nfct, e->manip.ctinfo);
+	}
+
+	added_when = e->added_when;
+	if (remove_me)
+		__ffn6_remove_entry(e);
+	spin_unlock_bh(&ffn6_lock);
+
+	skb->ffn_state = FFN_STATE_FAST_FORWARDED;
+
+	if (added_when == IPV6_FFN_FINISH_OUT)
+		dst_output(&init_net, skb->sk, skb);
+	else
+		ip6_input_finish(&init_net, skb->sk, skb);
+
+	return 0;
+
+ffnable:
+	skb->ffn_state = FFN_STATE_FORWARDABLE;
+	skb->ffn_orig_tos = ipv6_get_dsfield(iph);
+	return 1;
+
+not_ffnable:
+	skb->ffn_state = FFN_STATE_INCOMPATIBLE;
+	return 1;
+}
+
+/*
+ *
+ */
+static inline __sum16 checksum_adjust(const u32 *osip,
+				      const u32 *nsip,
+				      const u32 *odip,
+				      const u32 *ndip,
+				      u16 osport,
+				      u16 nsport,
+				      u16 odport,
+				      u16 ndport)
+{
+	const u32 oports[] = { osport, odport };
+	const u32 nports[] = { nsport, ndport };
+	__wsum osum, nsum;
+
+	osum = csum_partial(osip, 16, 0);
+	osum = csum_partial(odip, 16, osum);
+	osum = csum_partial(oports, 8, osum);
+
+	nsum = csum_partial(nsip, 16, 0);
+	nsum = csum_partial(ndip, 16, nsum);
+	nsum = csum_partial(nports, 8, nsum);
+
+	return ~csum_fold(csum_sub(nsum, osum));
+}
+
+/*
+ * check if skb is candidate for ffn, and if so add it to ffn cache
+ *
+ * called after post routing
+ */
+void ipv6_ffn_add(struct sk_buff *skb, int when)
+{
+	struct nf_conn *ct;
+	struct nf_conntrack_tuple *tuple, *rtuple;
+	enum ip_conntrack_info ctinfo;
+	struct ffn6_lookup_entry *e;
+	struct ipv6hdr *iph;
+	unsigned int hash;
+	int dir;
+	struct net *skb_net;
+	u8 proto, tos;
+
+	skb_net = dev_net(skb->dev);
+	if (!unlikely(net_eq(skb_net, &init_net)))
+		return;
+
+	/* make sure external_tcp_packet/external_udp_packet won't
+	 * attempt to checksum packet, the ffn code does not update
+	 * skb->csum, which must stay valid if skb_checksum_complete
+	 * has been called */
+	if (unlikely(skb_net->ct.sysctl_checksum))
+		skb_net->ct.sysctl_checksum = 0;
+
+	if (ffn6_entry_count >= MAX_FFN6_ENTRY)
+		return;
+
+	iph = ipv6_hdr(skb);
+
+	if ((when == IPV6_FFN_FINISH_OUT &&
+	     skb_dst(skb)->output != ip6_output))
+		return;
+
+	ct = nf_ct_get(skb, &ctinfo);
+	if (!ct || ctinfo == IP_CT_UNTRACKED)
+		return;
+
+	if ((ctinfo != IP_CT_ESTABLISHED) &&
+	    (ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY)) {
+		return;
+	}
+
+	if (nfct_help(ct))
+		return;
+
+	dir = (ctinfo == IP_CT_ESTABLISHED) ?
+		IP_CT_DIR_ORIGINAL : IP_CT_DIR_REPLY;
+	tuple = &ct->tuplehash[dir].tuple;
+
+	if (tuple->dst.protonum != IPPROTO_TCP &&
+	    tuple->dst.protonum != IPPROTO_UDP)
+		return;
+
+	if (tuple->dst.protonum == IPPROTO_TCP &&
+	    ct->proto.tcp.state != TCP_CONNTRACK_ESTABLISHED)
+		return;
+
+	rtuple = &ct->tuplehash[1 - dir].tuple;
+
+	e = kmalloc(sizeof (*e), GFP_ATOMIC);
+	if (!e)
+		return;
+
+	e->added_when = when;
+	memcpy(e->sip, tuple->src.u3.ip6, 16);
+	memcpy(e->dip, tuple->dst.u3.ip6, 16);
+	e->sport = tuple->src.u.all;
+	e->dport = tuple->dst.u.all;
+	e->protocol = tuple->dst.protonum;
+
+#ifdef CONFIG_IPV6_FFN_PROCFS
+	e->forwarded_packets = 0;
+	e->forwarded_bytes = 0;
+#endif
+
+	memcpy(e->manip.new_sip, rtuple->dst.u3.ip6, 16);
+	memcpy(e->manip.new_dip, rtuple->src.u3.ip6, 16);
+	e->manip.new_sport = rtuple->dst.u.all;
+	e->manip.new_dport = rtuple->src.u.all;
+
+	if (!memcmp(e->manip.new_sip, e->sip, 16) &&
+	    !memcmp(e->manip.new_dip, e->dip, 16) &&
+	    e->manip.new_sport == e->sport &&
+	    e->manip.new_dport == e->dport)
+		e->manip.alter = 0;
+	else
+		e->manip.alter = 1;
+
+	if (e->manip.alter) {
+		/* compute checksum adjustement */
+		e->manip.adjustment = checksum_adjust(e->sip,
+						      e->manip.new_sip,
+						      e->dip,
+						      e->manip.new_dip,
+						      e->sport,
+						      e->manip.new_sport,
+						      e->dport,
+						      e->manip.new_dport);
+	}
+
+	tos = ipv6_get_dsfield(iph);
+	if (skb->ffn_orig_tos != tos) {
+		e->manip.tos_change = 1;
+		e->manip.new_tos = tos;
+	} else
+		e->manip.tos_change = 0;
+
+	if (skb->priority != rt_tos2priority(tos)) {
+		e->manip.force_skb_prio = 1;
+		e->manip.new_skb_prio = skb->priority;
+	} else
+		e->manip.force_skb_prio = 0;
+
+	e->manip.new_mark = skb->mark;
+	e->manip.dst = skb_dst(skb);
+	e->manip.priv_destructor = NULL;
+	dst_hold(e->manip.dst);
+	e->manip.ct = ct;
+	e->manip.ctinfo = ctinfo;
+
+	hash = ffn6_hash(e->sip, e->dip, e->sport, e->dport,
+			 e->protocol == IPPROTO_TCP);
+	proto = (e->protocol == IPPROTO_TCP) ? IPPROTO_TCP : IPPROTO_UDP;
+
+	spin_lock_bh(&ffn6_lock);
+	if (__ffn6_add_entry(e, proto, hash)) {
+		spin_unlock_bh(&ffn6_lock);
+		dst_release(e->manip.dst);
+		kfree(e);
+		return;
+	}
+	spin_unlock_bh(&ffn6_lock);
+}
+
+/*
+ * netfilter callback when conntrack is about to be destroyed
+ */
+void ipv6_ffn_ct_destroy(struct nf_conn *ct)
+{
+	struct nf_conntrack_tuple *tuple;
+	struct ffn6_lookup_entry *e;
+	int dir;
+
+	/* locate all entry that use this conntrack */
+	for (dir = 0; dir < 2; dir++) {
+		tuple = &ct->tuplehash[dir].tuple;
+
+		if (tuple->dst.protonum != IPPROTO_TCP &&
+		    tuple->dst.protonum != IPPROTO_UDP)
+			return;
+
+		spin_lock_bh(&ffn6_lock);
+		e = __ffn6_get(tuple->src.u3.ip6, tuple->dst.u3.ip6,
+			       tuple->src.u.all, tuple->dst.u.all,
+			       tuple->dst.protonum == IPPROTO_TCP);
+		if (e)
+			__ffn6_remove_entry(e);
+		spin_unlock_bh(&ffn6_lock);
+	}
+}
+
+/*
+ * initialize ffn cache data
+ */
+static void __ipv6_ffn_init_cache(void)
+{
+	int i;
+
+	for (i = 0; i < FFN6_CACHE_SIZE; i++)
+		INIT_LIST_HEAD(&ffn6_cache[i]);
+	INIT_LIST_HEAD(&ffn6_all);
+	ffn6_entry_count = 0;
+}
+
+/*
+ * flush all ffn cache
+ */
+void ipv6_ffn_flush_all(void)
+{
+	struct ffn6_lookup_entry *e, *tmp;
+
+	spin_lock_bh(&ffn6_lock);
+	list_for_each_entry_safe(e, tmp, &ffn6_all, all_next)
+		__ffn6_remove_entry(e);
+	__ipv6_ffn_init_cache();
+	spin_unlock_bh(&ffn6_lock);
+}
+
+#ifdef CONFIG_IPV6_FFN_PROCFS
+struct proc_dir_entry *proc_net_ipv6_ffn;
+
+static int ipv6_ffn_entries_show(struct seq_file *m, void *v)
+{
+	int i;
+
+	spin_lock_bh(&ffn6_lock);
+
+	for (i = 0; i < FFN6_CACHE_SIZE; ++i) {
+		struct ffn6_lookup_entry *e;
+
+		if (list_empty(&ffn6_cache[i]))
+			continue;
+
+		seq_printf(m, "Bucket %i:\n", i);
+		list_for_each_entry (e, &ffn6_cache[i], next) {
+			seq_printf(m, " Protocol: ");
+			switch (e->protocol) {
+			case IPPROTO_TCP:
+				seq_printf(m, "TCPv6\n");
+				break;
+			case IPPROTO_UDP:
+				seq_printf(m, "UDPv6\n");
+				break;
+			default:
+				seq_printf(m, "ipproto_%i\n", e->protocol);
+				break;
+			}
+
+			seq_printf(m, " Original flow: %pI6:%u -> %pI6:%u\n",
+				   e->sip,
+				   ntohs(e->sport),
+				   e->dip,
+				   ntohs(e->dport));
+
+			if (memcmp(e->sip, e->manip.new_sip, 16) ||
+			    memcmp(e->dip, e->manip.new_dip, 16) ||
+			    e->sport != e->manip.new_sport ||
+			    e->dport != e->manip.new_dport) {
+				seq_printf(m,
+					   " Modified flow: %pI6:%u -> "
+					   "%pI6:%u\n",
+					   e->manip.new_sip,
+					   ntohs(e->manip.new_sport),
+					   e->manip.new_dip,
+					   ntohs(e->manip.new_dport));
+			}
+
+			seq_printf(m, "  Forwarded packets: %u\n",
+				   e->forwarded_packets);
+			seq_printf(m, "  Forwarded bytes: %llu\n",
+				   e->forwarded_bytes);
+			seq_printf(m, "\n");
+		}
+	}
+
+	spin_unlock_bh(&ffn6_lock);
+	return 0;
+}
+
+static int ipv6_ffn_entries_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, ipv6_ffn_entries_show, NULL);
+}
+
+static const struct file_operations ipv6_ffn_entries_fops = {
+	.owner = THIS_MODULE,
+	.open	= ipv6_ffn_entries_open,
+	.release = single_release,
+	.read = seq_read,
+	.llseek = seq_lseek,
+};
+
+
+static int __init __ipv6_ffn_init_procfs(void)
+{
+	proc_net_ipv6_ffn = proc_net_mkdir(&init_net, "ipv6_ffn",
+					 init_net.proc_net);
+	if (!proc_net_ipv6_ffn) {
+		printk(KERN_ERR "proc_mkdir() has failed "
+		       "for 'net/ipv6_ffn'.\n");
+		return -1;
+	}
+
+	if (proc_create("entries", 0400, proc_net_ipv6_ffn,
+			&ipv6_ffn_entries_fops) == NULL) {
+		printk(KERN_ERR "proc_create() has failed for "
+		       "'net/ipv6_ffn/entries'.\n");
+		return -1;
+	}
+	return 0;
+}
+#endif
+
+/*
+ * initialize ffn
+ */
+void __init ipv6_ffn_init(void)
+{
+	printk("IPv6 Fast Forward and NAT enabled\n");
+	__ipv6_ffn_init_cache();
+
+#ifdef CONFIG_IPV6_FFN_PROCFS
+	if (__ipv6_ffn_init_procfs() < 0)
+		printk(KERN_WARNING "IPv6 FFN: unable to create proc entries.\n");
+#endif
+}
diff -Nruw linux-5.4.60-fbx/net/nmesh-mbh./Kconfig linux-5.4.60-fbx/net/nmesh-mbh/Kconfig
--- linux-5.4.60-fbx/net/nmesh-mbh./Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/nmesh-mbh/Kconfig	2021-03-04 13:21:01.484172387 +0100
@@ -0,0 +1,4 @@
+config NET_NMESH_MBH
+        tristate "nmesh multi backhaul ethernet support"
+        help
+          This is part of qubercomm's magic to support ethernet as a backhaul
diff -Nruw linux-5.4.60-fbx/net/nmesh-mbh./Makefile linux-5.4.60-fbx/net/nmesh-mbh/Makefile
--- linux-5.4.60-fbx/net/nmesh-mbh./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/nmesh-mbh/Makefile	2021-03-04 13:21:01.484172387 +0100
@@ -0,0 +1 @@
+obj-$(CONFIG_NET_NMESH_MBH)	   += nmesh-mbh.o
diff -Nruw linux-5.4.60-fbx/net/nmesh-mbh./nmesh-mbh.c linux-5.4.60-fbx/net/nmesh-mbh/nmesh-mbh.c
--- linux-5.4.60-fbx/net/nmesh-mbh./nmesh-mbh.c	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/nmesh-mbh/nmesh-mbh.c	2021-03-04 13:21:01.484172387 +0100
@@ -0,0 +1,794 @@
+/*
+ * Copyright (c) 2019 Qubercomm Technologies, Inc.
+ */
+
+#include <linux/icmpv6.h>
+#include <net/addrconf.h>
+#include <net/ip6_checksum.h>
+#include "nmesh-mbh.h"
+
+#define ICMPV6_NMESH_MBH		254
+
+static struct nmesh_mbh mbh;
+static const u8 _mbh_icmp6_mc_ebeacon_addr[] = {
+	0x33, 0x33, 0x00, 0x00, 0x00, 0x01,
+};
+static const u8 _mbh_eth_mc_ebeacon_addr[] = {
+	0x01, 0x80, 0xC2, 0xFF, 0xFF, 0xFE,
+};
+
+static struct mbh_iface *mbh_iface_find_by_name(char *name)
+{
+	struct mbh_iface *iface;
+
+	lockdep_assert_held(&mbh.iface_lock);
+
+	list_for_each_entry(iface, &mbh.ifaces, list) {
+		if (!strcmp(iface->name, name))
+			return iface;
+	}
+	return NULL;
+}
+
+static struct mbh_iface *mbh_iface_find_by_mac(unsigned char *mac)
+{
+	struct mbh_iface *iface;
+
+	lockdep_assert_held(&mbh.iface_lock);
+
+	list_for_each_entry(iface, &mbh.ifaces, list) {
+		if (ether_addr_equal(iface->mac, mac))
+			return iface;
+	}
+	return NULL;
+}
+
+static struct mbh_remote_peer *mbh_remote_peer_find_by_mac(struct mbh_iface *iface,
+							   unsigned char *mac)
+{
+	struct mbh_remote_peer *remote_peer;
+
+	lockdep_assert_held(&mbh.iface_lock);
+
+	list_for_each_entry(remote_peer, &iface->remote_peers_list, list) {
+		if (ether_addr_equal(remote_peer->mac, mac))
+			return remote_peer;
+	}
+	return NULL;
+}
+
+static char mbh_is_nmeshd_alive(void)
+{
+	struct task_struct *task;
+	struct pid *pid;
+
+	rcu_read_lock();
+
+	pid = find_pid_ns(mbh.nmeshd_pid, &init_pid_ns);
+	if (unlikely(!pid)) {
+		rcu_read_unlock();
+		return 0;
+	}
+
+	task = pid_task(pid, PIDTYPE_PID);
+
+	rcu_read_unlock();
+
+	if(unlikely(!task))
+		return 0;
+
+	return 1;
+}
+
+static inline void mbh_stop_hb_timer(void)
+{
+	if (!test_bit(MBH_HB_SCHEDULED, &mbh.flags))
+		return;
+
+	del_timer(&mbh.hb_timer);
+	clear_bit(MBH_HB_SCHEDULED, &mbh.flags);
+}
+
+/* It's not possible to cancel a timer (heart beat timer)
+ * within the same timer context. This tasklet helps in
+ * such a situation. */
+void mbh_cancel_hb_timer_tasklet(unsigned long data)
+{
+	mbh_stop_hb_timer();
+}
+
+static void mbh_iface_cleanup(void)
+{
+	struct mbh_iface *iface, *tmp;
+	struct mbh_remote_peer *remote_peer, *rtmp;
+
+	spin_lock_bh(&mbh.iface_lock);
+	list_for_each_entry_safe(iface, tmp, &mbh.ifaces, list) {
+		if (iface->hb_payload)
+			kfree(iface->hb_payload);
+
+		list_for_each_entry_safe(remote_peer, rtmp,
+					 &iface->remote_peers_list, list) {
+			list_del(&remote_peer->list);
+			kfree(remote_peer);
+		}
+
+		list_del(&iface->list);
+                kfree(iface);
+	}
+	spin_unlock_bh(&mbh.iface_lock);
+}
+
+static void mbh_send_uevent(struct mbh_event_hdr *ehdr_to_send,
+			    char *payload, int payload_size)
+{
+	struct sk_buff  *skb;
+	struct nlmsghdr *nlh;
+	struct mbh_event_hdr *ehdr;
+	int len, ret;
+
+	len = NLMSG_HDRLEN + sizeof(struct mbh_event_hdr) + payload_size;
+
+	skb = nlmsg_new(len, gfp_any());
+	if (!skb)
+		return;
+
+	nlh = nlmsg_put(skb, 0, 0, NLMSG_DONE, len - NLMSG_HDRLEN, 0);
+	if (!nlh) {
+		kfree_skb(skb);
+		return;
+	}
+
+	ehdr = nlmsg_data(nlh);
+	*ehdr = *ehdr_to_send;
+	memcpy(ehdr + 1, payload, payload_size);
+
+	/* send composed event to the user space */
+	ret = netlink_unicast(mbh.nl_soc, skb,
+			      mbh.nmeshd_pid, MSG_DONTWAIT);
+
+	if (ret == -ECONNREFUSED && !mbh_is_nmeshd_alive())
+		mbh_stop_hb_timer();
+}
+
+static int mbh_record_remote_peer_hb_time(struct net_device *dev,
+					   unsigned char *remote_peer_mac)
+{
+	struct mbh_iface *iface;
+	struct mbh_remote_peer *remote_peer;
+	int found = 0;
+
+	if (unlikely(!dev || !remote_peer_mac))
+		return found;
+
+	spin_lock_bh(&mbh.iface_lock);
+	iface = mbh_iface_find_by_name(dev->name);
+	if (!iface)
+		goto unlock;
+
+	found = 1;
+	remote_peer = mbh_remote_peer_find_by_mac(iface, remote_peer_mac);
+	if (unlikely(!remote_peer)) {
+		remote_peer = kzalloc(sizeof(*remote_peer), GFP_ATOMIC);
+		if (!remote_peer)
+			goto unlock;
+
+		ether_addr_copy(remote_peer->mac, remote_peer_mac);
+		list_add(&remote_peer->list, &iface->remote_peers_list);
+	}
+
+	remote_peer->last_hb_rx_time = jiffies;
+unlock:
+	spin_unlock_bh(&mbh.iface_lock);
+	return found;
+}
+
+static bool mbh_check_icmpv6(struct sk_buff *skb)
+{
+	struct ipv6hdr *ip6_hdr;
+	struct icmp6hdr *icmpv6_hdr;
+
+	if (skb->protocol != cpu_to_be16(ETH_P_IPV6))
+		return false;
+
+	/*
+	 * Check that packets has enough data to be icmpv6 eventually in
+	 * separate pages
+	 */
+	if (!pskb_may_pull(skb, sizeof(*ip6_hdr) + sizeof(*icmpv6_hdr)))
+		return false;
+
+	ip6_hdr = ipv6_hdr(skb);
+	if (ip6_hdr->nexthdr != IPPROTO_ICMPV6)
+		return false;
+
+	/* Check for DA ? */
+	skb_pull(skb, sizeof(*ip6_hdr));
+
+	/* Check for icmpv6 header */
+	skb_reset_transport_header(skb);
+	icmpv6_hdr = icmp6_hdr(skb);
+	if (icmpv6_hdr->icmp6_type != ICMPV6_NMESH_MBH)
+		return false;
+
+	skb_pull(skb, sizeof(*icmpv6_hdr));
+	return true;
+}
+
+int mbh_bridge_rx(struct sk_buff *skb)
+{
+	struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC);
+	struct mbh_event_hdr event_hdr;
+	struct mbh_iface *iface;
+	struct mbh_hdr *mbh_hdr;
+	int ret = 0, found;
+
+	if (!clone)
+		return 0;
+
+	if ((skb->protocol != cpu_to_be16(ETH_P_NMESH_MBH)) &&
+		!mbh_check_icmpv6(clone)) {
+		goto notmbh;
+	}
+
+	if (!test_bit(MBH_HB_SCHEDULED, &mbh.flags)) {
+		/* heart beat frame tx is already stopped,
+		 * there is no point processing rx pkt */
+		goto drop;
+	}
+
+	if (!pskb_may_pull(clone, sizeof(*mbh_hdr)))
+		goto notmbh;
+
+	mbh_hdr = (struct mbh_hdr *)clone->data;
+	if (mbh_hdr->frame_type == MBH_HEART_BEAT_FRAME) {
+		/* loop back case: drop the heart beat initiated in
+		 * the same system on the another ethernet interface. */
+		spin_lock_bh(&mbh.iface_lock);
+		iface = mbh_iface_find_by_mac(eth_hdr(clone)->h_source);
+		spin_unlock_bh(&mbh.iface_lock);
+		if (iface)
+			goto drop;
+
+		found = mbh_record_remote_peer_hb_time(clone->dev,
+				eth_hdr(clone)->h_source);
+		/*
+		 * Packet was not received in nmeshd managed interface yet, let
+		 * linux stack process it again until it is received on proper
+		 * interface
+		 */
+		if (!found)
+			goto notmbh;
+
+		skb_pull(clone, sizeof(struct mbh_hdr));
+		event_hdr.type = MBH_HB_FRAME;
+		ether_addr_copy(event_hdr.h_source, eth_hdr(clone)->h_source);
+		ether_addr_copy(event_hdr.h_dest, clone->dev->dev_addr);
+
+		/* send heart beat frame to user space */
+		mbh_send_uevent(&event_hdr, clone->data, clone->len);
+	}
+drop:
+	kfree_skb(skb);
+	ret = 1;
+notmbh:
+	kfree_skb(clone);
+	return ret;
+}
+
+static void mbh_cleanup_aged_out_remote_peers(void)
+{
+	struct mbh_remote_peer *remote_peer, *rtmp;
+	struct mbh_iface *iface;
+
+	lockdep_assert_held(&mbh.iface_lock);
+
+	list_for_each_entry(iface, &mbh.ifaces, list) {
+	    list_for_each_entry_safe(remote_peer, rtmp,
+				     &iface->remote_peers_list, list) {
+		if (time_before(jiffies,
+				remote_peer->last_hb_rx_time +
+				msecs_to_jiffies(MBH_REMOTE_PEER_AGE_TIMEOUT)))
+			continue;
+
+		/* remote peer aged out */
+		list_del(&remote_peer->list);
+		kfree(remote_peer);
+	     }
+	}
+}
+
+static void mbh_send_icmp6_heart_beat_mc(struct mbh_iface *iface,
+					 struct net_device *dev)
+{
+	struct in6_addr saddr, daddr;
+	struct icmp6hdr *icmpv6_hdr;
+	struct mbh_hdr *mbh_hdr;
+	struct ipv6hdr *ip6_hdr;
+	struct ethhdr *eth_hdr;
+	struct sk_buff *skb;
+	size_t totlen;
+
+	/* Set fake SA and DA to ff02::1 */
+	ipv6_addr_set(&saddr, htonl(0xfe800000), 0, 0, htonl(0xfffe));
+	ipv6_addr_set(&daddr, htonl(0xff020000), 0, 0, htonl(1));
+
+
+	totlen = ETH_HLEN + sizeof(*ip6_hdr) + sizeof(*icmpv6_hdr) +
+		sizeof(*mbh_hdr) + iface->hb_payload_len;
+	skb = dev_alloc_skb(totlen + NET_IP_ALIGN);
+	if (!skb)
+		return;
+
+	/* Reserve space up to transport header (included) */
+	skb_reserve(skb, NET_IP_ALIGN + ETH_HLEN + sizeof(*ip6_hdr) +
+			sizeof(*icmpv6_hdr));
+
+	/* pack mbh hdr */
+	mbh_hdr = skb_put(skb, sizeof(*mbh_hdr));
+	mbh_hdr->frame_type = MBH_HEART_BEAT_FRAME;
+	/* copy user configured payload */
+	memcpy(skb_put(skb, iface->hb_payload_len),
+		       iface->hb_payload, iface->hb_payload_len);
+
+
+	/* prepare ICMPv6 Header */
+	icmpv6_hdr = skb_push(skb, sizeof(*icmpv6_hdr));
+	skb_reset_transport_header(skb);
+	*icmpv6_hdr = (struct icmp6hdr) {
+		.icmp6_type = ICMPV6_NMESH_MBH,
+	};
+	icmpv6_hdr->icmp6_cksum = csum_ipv6_magic(&saddr, &daddr, skb->len,
+						 IPPROTO_ICMPV6,
+						 csum_partial(icmpv6_hdr,
+							      skb->len, 0));
+
+	/* prepare IPv6 header */
+	ip6_hdr = skb_push(skb, sizeof(*ip6_hdr));
+	skb_reset_network_header(skb);
+	ip6_flow_hdr(ip6_hdr, 0, 0);
+	ip6_hdr->payload_len = htons(skb->len - sizeof(*ip6_hdr));
+	ip6_hdr->nexthdr = IPPROTO_ICMPV6;
+	ip6_hdr->hop_limit = 255; /* Maybe set maxhop to 1 ? */
+	ip6_hdr->saddr = saddr;
+	ip6_hdr->daddr = daddr;
+
+	/* prepare 802.3 header */
+	eth_hdr = skb_push(skb, ETH_HLEN);
+	skb_reset_mac_header(skb);
+	ether_addr_copy(eth_hdr->h_dest, _mbh_icmp6_mc_ebeacon_addr);
+	ether_addr_copy(eth_hdr->h_source, dev->dev_addr);
+	eth_hdr->h_proto = htons(ETH_P_IPV6);
+
+	skb->dev = dev;
+	skb->protocol = htons(ETH_P_IPV6);
+	skb->priority = TC_PRIO_CONTROL;
+
+	/* note: ethernet driver may add pad bytes (with zero) before tx */
+	dev_queue_xmit(skb);
+}
+
+static void mbh_send_eth_heart_beat_mc(struct mbh_iface *iface,
+				       struct net_device *dev)
+{
+	struct mbh_hdr *mbh_hdr;
+	struct ethhdr *eth_hdr;
+	struct sk_buff *skb;
+
+	skb = dev_alloc_skb(ETH_HLEN + sizeof(struct mbh_hdr) +
+			    iface->hb_payload_len + NET_IP_ALIGN);
+	if (!skb)
+		return;
+
+	skb_reserve(skb, NET_IP_ALIGN);
+
+	/* prepare .3 header */
+	eth_hdr = (struct ethhdr *) skb_put(skb, ETH_HLEN);
+	skb_reset_mac_header(skb);
+	ether_addr_copy(eth_hdr->h_source, dev->dev_addr);
+	ether_addr_copy(eth_hdr->h_dest, _mbh_eth_mc_ebeacon_addr);
+	eth_hdr->h_proto = htons(ETH_P_NMESH_MBH);
+
+	/* pack mbh hdr */
+	mbh_hdr = (struct mbh_hdr *)skb_put(skb, sizeof(struct mbh_hdr));
+	mbh_hdr->frame_type = MBH_HEART_BEAT_FRAME;
+
+	/* copy user configured payload */
+	memcpy(skb_put(skb, iface->hb_payload_len),
+		       iface->hb_payload, iface->hb_payload_len);
+	skb_reset_network_header(skb);
+
+	skb->dev = dev;
+	skb->protocol = htons(ETH_P_NMESH_MBH);
+	skb->priority = TC_PRIO_CONTROL;
+
+	dev_queue_xmit(skb);
+}
+
+static void mbh_send_heart_beat_mc(struct mbh_iface *iface,
+				   struct net_device *dev)
+{
+	mbh_send_eth_heart_beat_mc(iface, dev);
+	mbh_send_icmp6_heart_beat_mc(iface, dev);
+	iface->bcast_hb_last_tx_time = jiffies;
+}
+
+static void mbh_send_heart_beat_uc(struct mbh_iface *iface,
+				   struct net_device *dev)
+{
+	struct mbh_remote_peer *remote_peer;
+	struct sk_buff *skb, *skb_to_send;
+	struct mbh_hdr *mbh_hdr;
+	struct ethhdr *eth_hdr;
+
+	skb = dev_alloc_skb(ETH_HLEN + sizeof(struct mbh_hdr) +
+			    iface->hb_payload_len + NET_IP_ALIGN);
+	if (!skb)
+		return;
+
+	skb_reserve(skb, NET_IP_ALIGN);
+
+	/* prepare .3 header */
+	eth_hdr = (struct ethhdr *) skb_put(skb, ETH_HLEN);
+	skb_reset_mac_header(skb);
+	ether_addr_copy(eth_hdr->h_source, dev->dev_addr);
+	eth_hdr->h_proto = htons(ETH_P_NMESH_MBH);
+
+	/* pack mbh hdr */
+	mbh_hdr = (struct mbh_hdr *)skb_put(skb, sizeof(struct mbh_hdr));
+	mbh_hdr->frame_type = MBH_HEART_BEAT_FRAME;
+
+	/* copy user configured payload */
+	memcpy(skb_put(skb, iface->hb_payload_len),
+		       iface->hb_payload, iface->hb_payload_len);
+	skb_reset_network_header(skb);
+
+	skb->dev = dev;
+	skb->protocol = htons(ETH_P_NMESH_MBH);
+	skb->priority = TC_PRIO_CONTROL;
+
+	/* send unicast heart beat frame for every remote peer */
+	list_for_each_entry(remote_peer, &iface->remote_peers_list, list) {
+		if (list_is_last(&remote_peer->list, &iface->remote_peers_list)) {
+			skb_to_send = skb;
+		} else {
+			skb_to_send = skb_copy(skb, GFP_ATOMIC);
+			if (!skb_to_send)
+				skb_to_send = skb;
+		}
+
+		/* pack remote peer address in destination field */
+		eth_hdr = (struct ethhdr *) skb_mac_header(skb_to_send);
+		ether_addr_copy(eth_hdr->h_dest, remote_peer->mac);
+
+		dev_queue_xmit(skb_to_send);
+
+		if (skb == skb_to_send)
+			break;
+	}
+}
+
+static void mbh_send_heart_beat_frame(struct net_device *dev)
+{
+	struct mbh_iface *iface;
+
+	/* nmeshd alive check for the every heart beat timer expiry seems to
+	 * be overkill. hence, do this only after the certain hb interval. */
+	if (++mbh.nmeshd_alive_check_count >= MBH_HB_EXPIRE_FOR_NMESHD_ALIVE_CHECK) {
+		if (mbh_is_nmeshd_alive()) {
+			mbh.nmeshd_alive_check_count = 0;
+		} else {
+			/* nmeshd is dead, stop further heart beat tx */
+			tasklet_schedule(&mbh.cancel_hb_timer_tasklet);
+			return;
+		}
+	}
+
+	spin_lock_bh(&mbh.iface_lock);
+
+	mbh_cleanup_aged_out_remote_peers();
+
+	iface = mbh_iface_find_by_name(dev->name);
+	if (!iface || !iface->hb_payload)
+		goto unlock;
+
+	if (iface->initial_bcast_hb_tx_count < MBH_INITIAL_BCAST_HB_TX_COUNT_MAX) {
+		iface->initial_bcast_hb_tx_count++;
+		mbh_send_heart_beat_mc(iface, dev);
+	} else if (time_after(jiffies,
+			iface->bcast_hb_last_tx_time +
+			msecs_to_jiffies(MBH_PERIODIC_BCAST_HB_INTERVAL))) {
+		mbh_send_heart_beat_mc(iface, dev);
+	} else if (!list_empty(&iface->remote_peers_list)) {
+		mbh_send_heart_beat_uc(iface, dev);
+	}
+
+unlock:
+	spin_unlock_bh(&mbh.iface_lock);
+}
+
+static void mbh_heart_beat_timer(struct timer_list *t)
+{
+	struct net_device *dev;
+	struct net_bridge *br;
+	struct net_bridge_port *p;
+
+	dev = dev_get_by_name(&init_net, mbh.br_name);
+	if (!dev)
+		goto reshedule;
+
+	br = netdev_priv(dev);
+
+	/* send heart beat frame on each non wireless interfaces
+	 * linked to the bridge */
+	list_for_each_entry(p, &br->port_list, list) {
+		if (p->state == BR_STATE_DISABLED ||
+		    !p->dev || !(p->dev->flags & IFF_UP))
+			continue;
+
+		/* skip wireless interface */
+		if (p->dev->ieee80211_ptr)
+			continue;
+
+		mbh_send_heart_beat_frame(p->dev);
+	}
+	dev_put(dev);
+
+reshedule:
+	mod_timer(&mbh.hb_timer,
+		  jiffies + msecs_to_jiffies(mbh.hb_timer_interval));
+}
+
+static void mbh_set_hb_payload_cmd(struct mbh_set_hb_payload_cmd *msg)
+{
+	struct mbh_iface *iface;
+	struct net_device *dev;
+
+	if (msg->payload_len > MBH_HB_MAX_PAYLOAD) {
+		printk(KERN_ERR "mbh: hb payload len exceeding max limit (max:%d, received:%d)\n",
+		       MBH_HB_MAX_PAYLOAD, msg->payload_len);
+		return;
+	}
+
+	dev = dev_get_by_name(&init_net, msg->iface_name);
+	if (!dev) {
+		printk(KERN_ERR "mbh: device %s is not present in the system\n",
+		       msg->iface_name);
+		return;
+	}
+
+	spin_lock_bh(&mbh.iface_lock);
+
+	iface = mbh_iface_find_by_name(msg->iface_name);
+	if (!iface) {
+		iface = kzalloc(sizeof(*iface), GFP_ATOMIC);
+		if (!iface) {
+			spin_unlock_bh(&mbh.iface_lock);
+			dev_put(dev);
+			return;
+		}
+
+		snprintf(iface->name, sizeof(iface->name), msg->iface_name);
+		ether_addr_copy(iface->mac, dev->dev_addr);
+		INIT_LIST_HEAD(&iface->remote_peers_list);
+		list_add(&iface->list, &mbh.ifaces);
+	}
+
+	dev_put(dev);
+
+	if (iface->hb_payload)
+		kfree(iface->hb_payload);
+
+	if (msg->payload_len) {
+		iface->hb_payload = kmalloc(msg->payload_len, GFP_ATOMIC);
+		if (iface->hb_payload) {
+			memcpy(iface->hb_payload, &msg->payload,
+			       msg->payload_len);
+			iface->hb_payload_len = msg->payload_len;
+		}
+	} else {
+		iface->hb_payload = NULL;
+	}
+
+	spin_unlock_bh(&mbh.iface_lock);
+}
+
+static void mbh_start_cmd(u32 pid, struct mbh_start_cmd *msg)
+{
+	struct mbh_iface *iface;
+
+	mbh_stop_hb_timer();
+
+	mbh.nmeshd_pid = pid;
+
+	if (msg->hb_timer_interval)
+		mbh.hb_timer_interval = msg->hb_timer_interval;
+	else
+		mbh.hb_timer_interval = MBH_HB_TIMER_DEFAULT_INTERVAL;
+
+	memcpy(&mbh.br_name, &msg->br_name, IFNAMSIZ);
+
+	/* reset initial bcast hb counter to force each interface
+	 * to start with broadcast heart beat frame. */
+	spin_lock_bh(&mbh.iface_lock);
+	list_for_each_entry(iface, &mbh.ifaces, list)
+		iface->initial_bcast_hb_tx_count = 0;
+	spin_unlock_bh(&mbh.iface_lock);
+
+	RCU_INIT_POINTER(nmesh_mbh_bridge_rx, mbh_bridge_rx);
+
+	set_bit(MBH_HB_SCHEDULED, &mbh.flags);
+	mod_timer(&mbh.hb_timer,
+		  jiffies + msecs_to_jiffies(mbh.hb_timer_interval));
+}
+
+static void mbh_stop_cmd(void)
+{
+	mbh_stop_hb_timer();
+	RCU_INIT_POINTER(nmesh_mbh_bridge_rx, NULL);
+	rcu_barrier();
+}
+
+static void mbh_nl_soc_recv(struct sk_buff *skb)
+{
+	struct nlmsghdr *nlh;
+	struct mbh_cmd_hdr *hdr;
+	void *msg;
+
+	nlh = nlmsg_hdr(skb);
+	hdr = nlmsg_data(nlh);
+	msg = hdr + 1;
+
+	if (hdr->magic != MBH_HDR_MAGIC)
+		return;
+
+	switch (hdr->cmd) {
+	case MBH_SET_HB_PAYLOAD_CMD:
+		mbh_set_hb_payload_cmd(msg);
+		break;
+	case MBH_START_CMD:
+		mbh_start_cmd(nlh->nlmsg_pid, msg);
+		break;
+	case MBH_STOP_CMD:
+		mbh_stop_cmd();
+		break;
+	default:
+		break;
+	}
+}
+
+static ssize_t mbh_debugfs_read_status(struct file *file,
+				       char __user *user_buf,
+				       size_t count, loff_t *ppos)
+{
+	unsigned int len = 0, buf_len = 800, ago;
+	struct mbh_iface *iface;
+	struct mbh_remote_peer *remote_peer;
+	char *buf;
+	int ret_cnt;
+
+	buf = kzalloc(buf_len, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+	len += scnprintf(buf + len, buf_len - len, "heart_beat_timer = %s\n",
+			 test_bit(MBH_HB_SCHEDULED, &mbh.flags) ? "running" : "stopped");
+	if (mbh.hb_timer_interval)
+		len += scnprintf(buf + len, buf_len - len,
+				 "heart_beat_timer_interval = %ld msec\n",
+				 mbh.hb_timer_interval);
+	if (strlen(mbh.br_name))
+		len += scnprintf(buf + len, buf_len - len,
+				 "bridge = %s\n", mbh.br_name);
+
+	spin_lock_bh(&mbh.iface_lock);
+
+	mbh_cleanup_aged_out_remote_peers();
+
+	list_for_each_entry(iface, &mbh.ifaces, list) {
+		len += scnprintf(buf + len, buf_len - len, "%s:\n", iface->name);
+		len += scnprintf(buf + len, buf_len - len,
+				 "  mac = %pM\n", iface->mac);
+		len += scnprintf(buf + len, buf_len - len,
+				 "  heart_beat = %s\n",
+				 test_bit(MBH_HB_SCHEDULED, &mbh.flags) &&
+				 iface->hb_payload ? "active" : "inactive");
+		if (iface->hb_payload) {
+			len += scnprintf(buf + len, buf_len - len,
+					 "  heart_beat_payload_len = %d bytes\n",
+					 iface->hb_payload_len);
+		}
+		len += scnprintf(buf + len, buf_len - len,
+				 "  remote_peers: %s",
+				 list_empty(&iface->remote_peers_list) ? "not found\n" : "\n");
+
+		list_for_each_entry(remote_peer, &iface->remote_peers_list, list) {
+			ago = jiffies_to_msecs(jiffies - remote_peer->last_hb_rx_time);
+			len += scnprintf(buf + len, buf_len - len,
+					 "    mac: %pM, last_seen: %u msec ago\n",
+					 remote_peer->mac, ago);
+		}
+	}
+
+	spin_unlock_bh(&mbh.iface_lock);
+
+	ret_cnt = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+
+	kfree(buf);
+	return ret_cnt;
+}
+
+static const struct file_operations fops_debugfs_status = {
+	.read = mbh_debugfs_read_status,
+	.open = simple_open,
+	.owner = THIS_MODULE,
+	.llseek = default_llseek,
+};
+
+static int mbh_debugfs_init(void)
+{
+	struct dentry *entry;
+
+	mbh.debugfs_dir = debugfs_create_dir("nmesh-mbh", NULL);
+	if (IS_ERR_OR_NULL(mbh.debugfs_dir)) {
+		printk(KERN_ERR "mbh: nmesh-mbh debugfs directory creation failed!");
+		return -ENOMEM;
+	}
+
+	entry = debugfs_create_file("status", S_IRUSR, mbh.debugfs_dir, NULL,
+				    &fops_debugfs_status);
+	if (!entry) {
+		printk(KERN_ERR "mbh: status debugfs entry creation failed!");
+		debugfs_remove_recursive(mbh.debugfs_dir);
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+static int __init mbh_init(void)
+{
+	struct netlink_kernel_cfg cfg = {
+		.input =  mbh_nl_soc_recv,
+	};
+	int ret;
+
+	spin_lock_init(&mbh.iface_lock);
+	INIT_LIST_HEAD(&mbh.ifaces);
+
+	mbh.nl_soc = netlink_kernel_create(&init_net,
+					   NETLINK_NMESH_MBH, &cfg);
+	if (!mbh.nl_soc) {
+		printk(KERN_ERR "mbh: unable to create netlink socket!");
+		return -ENOMEM;
+	}
+
+	timer_setup(&mbh.hb_timer, mbh_heart_beat_timer, 0);
+	tasklet_init(&mbh.cancel_hb_timer_tasklet,
+		     mbh_cancel_hb_timer_tasklet, 0);
+
+	ret = mbh_debugfs_init();
+	if (ret) {
+		netlink_kernel_release(mbh.nl_soc);
+		return ret;
+	}
+
+	return 0;
+}
+
+static void __exit mbh_exit(void)
+{
+	mbh_stop_cmd();
+
+	tasklet_kill(&mbh.cancel_hb_timer_tasklet);
+
+	mbh_stop_hb_timer();
+	mbh_iface_cleanup();
+
+	debugfs_remove_recursive(mbh.debugfs_dir);
+	netlink_kernel_release(mbh.nl_soc);
+}
+
+module_init(mbh_init);
+module_exit(mbh_exit);
+MODULE_LICENSE("GPL");
diff -Nruw linux-5.4.60-fbx/net/nmesh-mbh./nmesh-mbh.h linux-5.4.60-fbx/net/nmesh-mbh/nmesh-mbh.h
--- linux-5.4.60-fbx/net/nmesh-mbh./nmesh-mbh.h	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/net/nmesh-mbh/nmesh-mbh.h	2021-03-04 13:21:01.484172387 +0100
@@ -0,0 +1,114 @@
+/*
+ * Copyright (c) 2019 Qubercomm Technologies, Inc.
+ */
+
+#ifndef MBH_H
+#define MBH_H
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/if_bridge.h>
+#include <linux/etherdevice.h>
+#include <net/netlink.h>
+#include <linux/timer.h>
+#include <linux/if.h>
+#include "../bridge/br_private.h"
+#include <linux/sched.h>
+#include <linux/pid.h>
+#include <linux/debugfs.h>
+
+#define NETLINK_NMESH_MBH	31
+
+#define MBH_HB_TIMER_DEFAULT_INTERVAL	1000 	/*  in msec */
+#define MBH_HDR_MAGIC			0xBAFA
+#define MBH_HB_MAX_PAYLOAD		512
+
+#define MBH_INITIAL_BCAST_HB_TX_COUNT_MAX	5
+#define MBH_REMOTE_PEER_AGE_TIMEOUT		10000    /* in msec, 10 sec */
+#define MBH_PERIODIC_BCAST_HB_INTERVAL		300000   /* in msec, 5 min */
+
+/* check nmeshd alive status after every 3 heart beat timer expiry */
+#define MBH_HB_EXPIRE_FOR_NMESHD_ALIVE_CHECK	3
+
+enum mbh_frame_type {
+	MBH_HEART_BEAT_FRAME,
+};
+
+struct mbh_hdr {
+	char frame_type;
+} __packed;
+
+enum mbh_cmd_table {
+	MBH_SET_HB_PAYLOAD_CMD,
+	MBH_START_CMD,
+	MBH_STOP_CMD,
+};
+
+struct mbh_cmd_hdr {
+        unsigned short magic;
+        char cmd;
+};
+
+struct mbh_set_hb_payload_cmd {
+	char iface_name[IFNAMSIZ];
+	unsigned short payload_len;
+	char payload[MBH_HB_MAX_PAYLOAD];
+};
+
+struct mbh_start_cmd {
+	char br_name[IFNAMSIZ];
+	unsigned long hb_timer_interval; /* in msec */
+};
+
+enum mbh_event_type {
+	MBH_HB_FRAME,
+};
+
+struct mbh_event_hdr {
+	unsigned char type; /* Refer enum mbh_event_type  */
+	unsigned char h_source[ETH_ALEN];
+	unsigned char h_dest[ETH_ALEN];
+} __attribute__((packed));
+
+enum mbh_flags {
+	MBH_HB_SCHEDULED,
+};
+
+struct mbh_remote_peer {
+	struct list_head list;
+	unsigned char mac[ETH_ALEN];
+	unsigned long last_hb_rx_time;
+};
+
+struct mbh_iface {
+	struct list_head list;
+	struct list_head remote_peers_list; /* struct mbh_remote_peer */
+	char name[IFNAMSIZ];
+	unsigned char mac[ETH_ALEN];
+	char *hb_payload;
+	unsigned short hb_payload_len;
+	unsigned char initial_bcast_hb_tx_count;
+	unsigned long bcast_hb_last_tx_time;
+};
+
+struct nmesh_mbh {
+	struct sock *nl_soc;
+	u32 nmeshd_pid;
+	char br_name[IFNAMSIZ];
+
+	struct timer_list hb_timer;
+	unsigned long hb_timer_interval;
+	unsigned long flags; /* Refer: enum mbh_flags */
+
+	spinlock_t iface_lock;
+	struct list_head ifaces;
+
+	unsigned char nmeshd_alive_check_count;
+	struct tasklet_struct cancel_hb_timer_tasklet;
+
+	struct dentry *debugfs_dir;
+};
+
+extern int (*nmesh_mbh_bridge_rx)(struct sk_buff *skb);
+
+#endif /* MBH_H */
diff -Nruw linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/broadcom/bcm63xx./Makefile linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/broadcom/bcm63xx/Makefile
--- linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/broadcom/bcm63xx./Makefile	1970-01-01 01:00:00.000000000 +0100
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/broadcom/bcm63xx/Makefile	2021-03-04 13:20:57.004172187 +0100
@@ -0,0 +1,5 @@
+dtb-$(CONFIG_ARCH_BCM63XX) += bcm963158ref1d.dtb fbxgw8r.dtb
+
+always		:= $(dtb-y)
+subdir-y	:= $(dts-dirs)
+clean-files	:= *.dtb
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/fbxgw7r-common.dtsi	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,925 @@
+/ {
+	chosen {
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		ramoops@3fff8000 {
+			compatible = "ramoops";
+			/* RAM top - 32k */
+			reg = <0x0 0x3fff8000 0x0 (32 * 1024)>;
+			record-size = <(32 * 1024)>;
+			ecc-size = <16>;
+			no-dump-oops;
+		};
+        };
+
+	memory@00000000 {
+		device_type = "memory";
+		// hopefully patched by ATF.
+		reg = <0x0 0x0 0x0 0x0>;
+	};
+
+	firmware {
+		optee {
+			compatible = "linaro,optee-tz";
+			method = "smc";
+		};
+	};
+
+	fbx7r-fbxgpio {
+		compatible = "fbx,fbxgpio";
+
+		lan-sfp-txdis {
+			gpio = <&cp0_gpio2 22 0>;
+			output-high;
+#ifdef USE_PHYLINK_SFP
+			no-claim;
+#endif
+		};
+		lan-sfp-txfault {
+			gpio = <&cp0_gpio2 21 0>;
+			input;
+#ifdef USE_PHYLINK_SFP
+			no-claim;
+#endif
+		};
+		lan-sfp-pwren {
+			gpio = <&io_expander1 7 0>;
+			output-low;
+#ifdef USE_PHYLINK_SFP
+			no-claim;
+#endif
+		};
+		lan-sfp-presence {
+			gpio = <&cp1_gpio1 27 0>;
+			input;
+#ifdef USE_PHYLINK_SFP
+			no-claim;
+#endif
+		};
+		lan-sfp-pwrgood {
+			gpio = <&cp1_gpio1 10 0>;
+			input;
+#ifdef USE_PHYLINK_SFP
+			no-claim;
+#endif
+		};
+		lan-sfp-rxlos {
+			gpio = <&cp1_gpio1 28 0>;
+			input;
+#ifdef USE_PHYLINK_SFP
+			no-claim;
+#endif
+		};
+
+		sata0-pwren {
+			gpio = <&io_expander0 13 0>;
+			output-low;
+		};
+		sata1-pwren {
+			gpio = <&io_expander0 14 0>;
+			output-low;
+		};
+		sata0-pwrfault {
+			gpio = <&io_expander0 11 0>;
+			input;
+		};
+		sata1-pwrfault {
+			gpio = <&io_expander0 12 0>;
+			input;
+		};
+
+		sata2-pwren {
+			gpio = <&io_expander1 11 0>;
+			output-low;
+		};
+		sata3-pwren {
+			gpio = <&io_expander1 10 0>;
+			output-low;
+		};
+		sata2-pwrfault {
+			gpio = <&io_expander1 5 0>;
+			input;
+		};
+		sata3-pwrfault {
+			gpio = <&io_expander1 4 0>;
+			input;
+		};
+
+		usbhub2-rst {
+			gpio = <&io_expander0 15 0>;
+			output-low;
+		};
+		usbhub3-rst {
+			gpio = <&io_expander1 6 0>;
+			output-low;
+		};
+
+		mpcie0-rst {
+			/* WiFi 5.0Ghz */
+			gpio = <&io_expander0 8 0>;
+			output-low;
+			no-claim;
+		};
+		mpcie1-rst {
+			/* WiFI 2.4 Ghz */
+			gpio = <&io_expander1 15 0>;
+			output-low;
+			no-claim;
+		};
+		mpcie2-rst {
+			/* WiFi Listen */
+			gpio = <&io_expander1 9 0>;
+			output-low;
+			no-claim;
+		};
+
+		ha-rst {
+			gpio = <&cp1_gpio1 25 0 >;
+			output-low;
+		};
+
+		sw-int {
+			gpio = <&cp0_gpio2 1 0>;
+			input;
+		};
+		sw-reset {
+			gpio = <&io_expander0 0 0>;
+			output-high;
+			no-claim;
+		};
+		phy-int {
+			gpio = <&cp0_gpio2 20 0>;
+			input;
+		};
+		phy-reset {
+			gpio = <&io_expander0 1 0>;
+			output-high;
+		};
+
+		dect_jtag_tck: dect-jtag-tck {
+			gpio = <&cp1_gpio1 20 0>;
+			output-low;
+		};
+		dect_jtag_tdi: dect-jtag-tdi {
+			gpio = <&cp1_gpio1 17 0>;
+			output-low;
+		};
+		dect_jtag_tdo: dect-jtag-tdo {
+			gpio = <&cp1_gpio1 18 0>;
+			input;
+		};
+		dect_jtag_tms: dect-jtag-tms {
+			gpio = <&cp1_gpio1 26 0>;
+			output-low;
+		};
+		dect-reset {
+			gpio = <&cp1_gpio1 4 0>;
+			output-low;
+		};
+
+		exp1-rst0 {
+			gpio = <&io_expander0 2 0>;
+			output-low;
+		};
+		exp1-rst1 {
+			gpio = <&io_expander0 3 0>;
+			output-high;
+		};
+		exp1-3v3-en {
+			gpio = <&io_expander0 6 0>;
+			output-low;
+		};
+		exp1-20v-pwren {
+			gpio = <&io_expander0 5 0>;
+			output-low;
+		};
+
+		exp2-rst0 {
+			gpio = <&io_expander1 3 0>;
+			output-low;
+		};
+		exp2-rst1 {
+			gpio = <&io_expander1 1 0>;
+			output-high;
+		};
+		exp2-3v3-en {
+			gpio = <&io_expander1 2 0>;
+			output-low;
+		};
+		exp2-20v-pwren {
+			gpio = <&io_expander1 8 0>;
+			output-low;
+		};
+
+
+		boot-eth {
+			gpio = <&cp0_gpio2 29 0>;
+			input;
+		};
+	};
+
+	/*
+	 * I2C mux isolating LAN SFP, both expansion boards
+	 * Expansion boards branches from each other.
+	 */
+	i2c_bigmux {
+		compatible = "i2c-mux-gpio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		mux-gpios = <&cp1_gpio1 24 0>, /* lan-sfp-i2c-en */
+			<&io_expander1 12 0>, /* exp2-i2c-en */
+			<&io_expander1 13 0>; /* exp1-i2c-en */
+		idle-state = <0x0>;
+		i2c-parent = <&misc_i2c>;
+
+		lan_sfp_i2c: i2c@1 {
+			reg = <0x1>;
+		};
+
+		exp2_ext_i2c: i2c@2 {
+			reg = <0x2>;
+		};
+
+		exp1_ext_i2c: i2c@4 {
+			reg = <0x4>;
+		};
+	};
+
+	jtag_dect {
+		compatible = "fbx,fbxjtag";
+
+		clock-delay = <500>;
+		wait-tms = <0>;
+		data-read-size = <128>;
+		inst-read-size = <128>;
+
+		fbxgpio-tck = <&dect_jtag_tck>;
+		fbxgpio-tdo = <&dect_jtag_tdo>;
+		fbxgpio-tdi = <&dect_jtag_tdi>;
+		fbxgpio-tms = <&dect_jtag_tms>;
+	};
+
+	cp0_i2c1_gpio: cp0_i2c1_gpio {
+		/* aka I2C #1, A8K I2C bus CP0_I2C1 */
+		compatible = "i2c-gpio";
+		gpios = <&cp0_gpio2 3 0 /* sda */
+			 &cp0_gpio2 4 0 /* scl */
+			>;
+		i2c-gpio,delay-us = <2>;	/* ~100 kHz */
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		spd@0x53 {
+			/* SPD eeprom */
+			compatible = "at24,ee1004";
+			reg = <0x53>;
+		};
+	};
+
+	misc_i2c: cp1_mss_i2c {
+		/* aka I2C #2, A8K I2C bus CP1_MSS_I2C */
+		compatible = "i2c-gpio";
+		gpios = <&cp1_gpio1 29 0 /* sda */
+			 &cp1_gpio1 30 0 /* scl */
+			>;
+		i2c-gpio,delay-us = <2>;	/* ~100 kHz */
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+#ifdef USE_PHYLINK_SFP
+	sfp_lan: sfp-lan {
+		compatible = "sff,sfp";
+		i2c-bus = <&lan_sfp_i2c>;
+		maximum-power-milliwatt = <3000>;
+		los-gpios = <&cp1_gpio1 28 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpios = <&cp1_gpio1 27 GPIO_ACTIVE_LOW>;
+		tx-disable-gpios = <&cp0_gpio2 22 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpios = <&cp0_gpio2 21 GPIO_ACTIVE_HIGH>;
+		pwr-enable-gpios = <&io_expander1 7 GPIO_ACTIVE_HIGH>;
+	};
+#endif
+
+	exp1_sfp: exp1-sfp {
+		status = "disabled";
+	};
+
+	exp2_sfp: exp2-sfp {
+		status = "disabled";
+	};
+
+	aliases {
+		/* console */
+		serial0 = &uart0;
+		/* DECT */
+		serial1 = &cp0_uart0;
+		/* EXP2 */
+		serial2 = &cp0_uart1;
+		/* EXP1 */
+		serial3 = &cp0_uart2;
+		/* BT */
+		serial4 = &cp1_uart0;
+		/* HA */
+		serial5 = &cp1_uart2;
+
+		i2c0 = &cp0_i2c0;
+		i2c1 = &cp0_i2c1_gpio;
+		i2c2 = &misc_i2c;
+		i2c3 = &lan_sfp_i2c;
+		i2c4 = &exp2_ext_i2c;
+		i2c5 = &exp1_ext_i2c;
+		i2c6 = &cp0_mss_i2c;
+	};
+};
+
+&cp1_gpio1 {
+	gpio-line-names = "", /* 0 */
+			  "", /* 1 */
+			  "", /* 2 */
+			  "", /* 3 */
+			  "tdm-rst", /* 4 */
+			  "", /* 5 */
+			  "", /* 6 */
+			  "", /* 7 */
+			  "", /* 8 */
+			  "nfc-int", /* 9 */
+			  "lan-sfp-pwrfault", /* 10 */
+			  "", /* 11 */
+			  "", /* 12 */
+			  "", /* 13 */
+			  "", /* 14 */
+			  "", /* 15 */
+			  "", /* 16 */
+			  "dect-jtag-tdi", /* 17 */
+			  "dect-jtag-tdo", /* 18 */
+			  "ha-swd", /* 19 */
+			  "dect-jtag-tck", /* 20 */
+			  "display-swc", /* 21 */
+			  "", /* 22 */
+			  "display-swd", /* 23 */
+			  "lan-sfp-i2c-en", /* 24 */
+			  "ha-reset", /* 25 */
+			  "dect-jtag-tms", /* 26 */
+			  "lan-sfp-presence", /* 27 */
+			  "lan-sfp-rxlos", /* 28 */
+			  "", /* 29 */
+			  "", /* 30 */
+			  "exp1-3v3-pwrfault"; /* 31 */
+};
+
+&cp0_gpio2 {
+	/* starts at offset 32 in cp110-master */
+
+	gpio-line-names = "exp2-3v3-pwrfault", /* 0 */
+			  "sw-int", /* 1 */
+			  "keypad-int", /* 2 */
+			  "", /* 3 */
+			  "", /* 4 */
+			  "", /* 5 */
+			  "", /* 6 */
+			  "", /* 7 */
+			  "", /* 8 */
+			  "", /* 9 */
+			  "", /* 10 */
+			  "", /* 11 */
+			  "ha-swc", /* 12 */
+			  "", /* 13 */
+			  "keypad-rst", /* 14 */
+			  "", /* 15 */
+			  "io-expander-reset", /* 16 */
+			  "", /* 17 */
+			  "", /* 18 */
+			  "", /* 19 */
+			  "phy-int", /* 20 */
+			  "lan-sfp-txfault", /* 21 */
+			  "lan-sfp-txdisable", /* 22 */
+			  "sdr-event", /* 23 */
+			  "fan-alert-int", /* 24 */
+			  "", /* 25 */
+			  "", /* 26 */
+			  "", /* 27 */
+			  "", /* 28 */
+			  "boot-eth", /* 29 */
+			  ""; /* 30 */
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&ap_sdhci0 {
+	status = "okay";
+	bus-width = <8>;
+	non-removable;
+
+	partitions-main {
+		compatible = "fixed-partitions";
+		#address-cells = <2>;
+		#size-cells = <2>;
+		disk-name = "mmcblk%d";
+
+		bank0@0 {
+			label = "bank0";
+			reg = /bits/64 <0 (32 * 1024 * 1024)>;
+			read-only;
+		};
+
+		bank1@0 {
+			label = "bank1";
+			reg = /bits/64 <(-1) (256 * 1024 * 1024)>;
+		};
+
+		nvram@0 {
+			label = "nvram";
+			reg = /bits/64 <(-1) (4 * 1024 * 1024)>;
+		};
+
+		config@0 {
+			label = "config";
+			reg = /bits/64 <(-1) (32 * 1024 * 1024)>;
+		};
+
+		new-bank0@0 {
+			label = "new_bank0";
+			reg = /bits/64 <(-1) (32 * 1024 * 1024)>;
+		};
+
+		fbxmbr@0 {
+			label = "fbxmbr";
+			reg = /bits/64 <(-1) (4096)>;
+		};
+
+		fortknox@0 {
+			label = "fortknox";
+			reg = /bits/64 <(-1) (128 * 1024 * 1024)>;
+		};
+
+		userdata@0 {
+			label = "userdata";
+			reg = /bits/64 <(-1) (-1)>;
+		};
+	};
+
+	partitions-boot {
+		compatible = "fixed-partitions";
+		#address-cells = <2>;
+		#size-cells = <2>;
+		disk-name = "mmcblk%dboot0";
+
+		ipl@0 {
+			label = "ipl";
+			reg = /bits/64 <0 (1 * 1024 * 1024)>;
+			read-only;
+		};
+
+		serial@0 {
+			label = "fbxserial";
+			reg = /bits/64 <(-1) (8 * 1024)>;
+			read-only;
+		};
+
+		randomdata@0 {
+			label = "randomdata";
+			reg = /bits/64 <(-1) (8 * 1024)>;
+			read-only;
+		};
+
+		calibration@0 {
+			label = "calibration";
+			reg = /bits/64 <(-1) (64 * 1024)>;
+			read-only;
+		};
+
+		field-calibration@0 {
+			label = "field_calibration";
+			reg = /bits/64 <(-1) (64 * 1024)>;
+		};
+	};
+
+	partitions-boot1 {
+		compatible = "fixed-partitions";
+		#address-cells = <2>;
+		#size-cells = <2>;
+		disk-name = "mmcblk%dboot1";
+
+		backup-ipl@0 {
+			label = "backup-ipl";
+			reg = /bits/64 <0 (1 * 1024 * 1024)>;
+			read-only;
+		};
+	};
+};
+
+&ap_hwmon {
+	status = "okay";
+	fbx,requires-smc;
+};
+
+&cp0_hwmon {
+	status = "okay";
+};
+
+&cp1_hwmon {
+	status = "okay";
+	fbx,requires-smc;
+};
+
+&cp0_i2c0 {
+	status = "okay";
+	pinctrl-names = "default";
+
+	adt7475@2e {
+		compatible = "adi,adt7475";
+		reg = <0x2e>;
+	};
+
+	io_expander0: exp0@74 {
+		compatible = "nxp,pca9539";
+		reg = <0x74>;
+		gpio-controller;
+		ngpios = <16>;
+		#gpio-cells = <2>;
+		gpio-line-names = "sw-rst", /* 0 */
+				  "phy-rst", /* 1 */
+				  "exp1-rst1", /* 2 */
+				  "exp1-rst2", /* 3 */
+				  "exp1-presence", /* 4 */
+				  "exp1-20v-pwren", /* 5 */
+				  "exp1-3v3-pwren", /* 6 */
+				  "", /* 7 */
+				  "pcie0-rst", /* 8 */
+				  "nfc-en", /* 9 */
+				  "type-c-i2c-en", /* 10 */
+				  "sata0-pwrfault", /* 11 */
+				  "sata1-pwrfault", /* 12 */
+				  "sata0-pwren", /* 13 */
+				  "sata1-pwren", /* 14 */
+				  "usbhub2-rst"; /* 15 */
+	};
+
+	io_expander1: exp1@75 {
+		compatible = "nxp,pca9539";
+		reg = <0x75>;
+		gpio-controller;
+		gpiobase = <300>;
+		ngpios = <16>;
+		#gpio-cells = <2>;
+		gpio-line-names = "exp2-presence", /* 0 */
+				  "exp2-rst1", /* 1 */
+				  "exp2-3v3-en", /* 2 */
+				  "exp2-rst0", /* 3 */
+				  "sata3-pwrfault", /* 4 */
+				  "sata2-pwrfault", /* 5 */
+				  "usbhub3-rst", /* 6 */
+				  "lan-sfp-pwren", /* 7 */
+				  "exp2-20v-pwren", /* 8 */
+				  "pcie2-rst", /* 9 */
+				  "sata3-pwren", /* 10 */
+				  "sata2-pwren", /* 11 */
+				  "exp2-i2c-en", /* 12 */
+				  "exp1-i2c-en", /* 13 */
+				  "pcie1-bt-rst", /* 14 */
+				  "pcie1-rst"; /* 15 */
+	};
+};
+
+&cp0_mss_i2c {
+	status = "okay";
+	pinctrl-0 = <&cp0_mss_i2c_pins>;
+	pinctrl-names = "default";
+
+	ld6710-fbx@68 {
+		compatible = "leadtrend,ld6710-fbx";
+		reg = <0x68>;
+	};
+};
+
+&cp0_ethernet {
+	status = "okay";
+};
+
+&cp0_mdio {
+	status = "okay";
+
+	mv6141: mv6141@16 {
+		compatible = "freebox,fbxgw7r-mv6141";
+		reg = <0>;
+		gpio-reset = <&io_expander0 0 0>;
+	};
+};
+
+
+/*
+ * Internal port to midplane for "EXP2" expansion connector. Can
+ * operate in 10GBase-KR.
+ */
+&cp0_comphy2 {
+	kr-gen1-s0-amplitude = <0x12>;
+	kr-gen1-s0-emphasis = <0x8>;
+	kr-gen1-s2-emphasis = <0x2>;
+
+	kr-ffe-cap-sel = <0xe>;
+	kr-ffe-res-sel = <0x6>;
+	kr-ffe-dfe-res = <0x1>;
+	kr-phase-offset = <0x60>;
+};
+&cp0_eth0 {
+	managed = "in-band-status";
+	status = "okay";
+	phys = <&cp0_comphy2 0>;
+	phy-mode = "1000base-x";
+	mac-address = [00 07 cb 00 00 fd];
+	sfp = <&exp2_sfp>;
+};
+
+/*
+ * Switch uplink port in 2500Base-X.
+ */
+&cp0_eth2 {
+	managed = "in-band-status";
+	status = "okay";
+	phy-mode = "1000base-x";
+	phys = <&cp0_comphy5 2>;
+	fbxserial-mac-address = <0>;
+	mdio-bus = <&cp0_mdio>;
+};
+
+&cp1_ethernet {
+	status = "okay";
+};
+
+/*
+ * 10G Lan port (SFP)
+ */
+&cp1_comphy4 {
+	kr-gen1-s0-amplitude = <0x12>;
+	kr-gen1-s0-emphasis = <0x4>;
+	kr-gen1-s2-emphasis = <0x0>;
+};
+
+&cp1_eth0 {
+	managed = "in-band-status";
+	status = "okay";
+	phys = <&cp1_comphy4 0>;
+	phy-mode = "10gbase-kr";
+	fbxserial-mac-address = <1>;
+#ifdef USE_PHYLINK_SFP
+	sfp = <&sfp_lan>;
+#endif
+};
+
+/*
+ * Internal port to midplane for "EXP1" expansion connector. 1000BaseX
+ * only, not 10G capapable
+ */
+&cp1_eth2 {
+	managed = "in-band-status";
+	status = "okay";
+	phys = <&cp1_comphy5 2>;
+	phy-mode = "1000base-x";
+	mac-address = [00 07 cb 00 00 fd];
+	sfp = <&exp1_sfp>;
+};
+
+&cp0_comphy1 {
+	sata-gen3-s0-amplitude = <0x15>;
+	sata-gen3-s0-emphasis = <0x7>;
+	sata-gen3-s4-dfe-res = <0x1>;
+	sata-phase-offset = <0x61>;
+};
+
+&cp0_comphy3 {
+	sata-gen3-s0-amplitude = <0x15>;
+	sata-gen3-s0-emphasis = <0x5>;
+	sata-gen3-s4-dfe-res = <0x1>;
+	sata-phase-offset = <0x61>;
+};
+
+&cp0_sata0 {
+	status = "okay";
+	comreset_u = <0x17>;
+	comwake = <0x6>;
+
+	sata-port@0 {
+		status = "okay";
+		reg = <0>;
+		phys = <&cp0_comphy1 0>;
+	};
+	sata-port@1 {
+		status = "okay";
+		reg = <1>;
+		phys = <&cp0_comphy3 1>;
+	};
+};
+
+&cp1_comphy2 {
+	sata-gen3-s0-amplitude = <0x14>;
+	sata-gen3-s0-emphasis = <0x5>;
+	sata-gen3-s4-dfe-res = <0x1>;
+	sata-phase-offset = <0x61>;
+};
+
+&cp1_comphy3 {
+	sata-gen3-s0-amplitude = <0x14>;
+	sata-gen3-s0-emphasis = <0x5>;
+	sata-gen3-s4-dfe-res = <0x1>;
+	sata-phase-offset = <0x61>;
+};
+
+&cp1_sata0 {
+	status = "okay";
+	comreset_u = <0x17>;
+	comwake = <0x6>;
+
+	sata-port@1 {
+		status = "okay";
+		reg = <1>;
+		phys = <&cp1_comphy3 1>;
+	};
+	sata-port@0 {
+		status = "okay";
+		reg = <0>;
+		phys = <&cp1_comphy2 0>;
+	};
+};
+
+&cp0_usb3_1 {
+	status = "okay";
+
+	phys = <&cp0_utmi 0>;
+	phy-names = "usb2";
+};
+
+&cp1_usb3_0 {
+	status = "okay";
+
+	phys = <&cp1_comphy1 0>,
+		<&cp1_utmi 0>;
+	phy-names = "usb3", "usb2";
+};
+
+&cp0_pcie0 {
+	/*
+	 * WiFi 5.0Ghz
+	 */
+	status = "okay";
+	num-lanes = <1>;
+
+	phys = <&cp0_comphy0 0>;
+	phy-names = "lane0";
+
+	reset-gpios = <&io_expander0 8 0>;
+};
+
+&cp0_pcie1 {
+	/*
+	 * WiFi Listen
+	 */
+	status = "okay";
+	num-lanes = <1>;
+
+	phys = <&cp0_comphy4 1>;
+	phy-names = "lane0";
+
+	reset-gpio = <&io_expander1 9 0>;
+};
+
+&cp1_pcie0 {
+	/*
+	 * WiFi 2.4 Ghz
+	 */
+	status = "okay";
+	num-lanes = <1>;
+
+	phys = <&cp1_comphy0 0>;
+	phy-names = "lane0";
+	reset-gpio = <&io_expander1 15 0>, <&io_expander1 14 0>;
+};
+
+&cp0_spi0 {
+	status = "okay";
+	pinctrl-0 = <&cp0_spi0_pins>;
+	pinctrl-names = "default";
+
+	spi-slac@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "microsemi,le9641";
+		reg = <0>;
+		spi-max-frequency = <5000000>;
+	};
+};
+
+&cp1_spi1 {
+	status = "okay";
+	pinctrl-0 = <&cp1_spi1_pins>;
+	pinctrl-names = "default";
+};
+
+&cp0_pinctrl {
+	/* DECT */
+	cp0_uart0_pins: uart0-pins-0 {
+		marvell,pins = "mpp45", "mpp62";
+		marvell,function = "uart0";
+	};
+	/* EXP2 */
+	cp0_uart1_pins: uart1-pins-0 {
+		marvell,pins = "mpp59", "mpp60";
+		marvell,function = "uart1";
+	};
+	/* EXP1 */
+	cp0_uart2_pins: uart2-pins-0 {
+		marvell,pins = "mpp50", "mpp51";
+		marvell,function = "uart2";
+	};
+	/* SPI SLAC */
+	cp0_spi0_pins: spi0-pins-0 {
+		marvell,pins = "mpp39", "mpp40", "mpp41", "mpp42", "mpp43";
+		marvell,function = "spi0";
+	};
+	cp0_mss_i2c_pins: mss-i2c-pins-0 {
+		marvell,pins = "mpp57", "mpp58";
+		marvell,function = "mss_i2c";
+	};
+};
+
+&cp1_pinctrl {
+	cp1_mss_i2c_pins: mss-i2c-pins-0 {
+		marvell,pins = "mpp29", "mpp30";
+		marvell,function = "mss_i2c";
+	};
+	cp1_spi1_pins: spi1-pins-0 {
+		marvell,pins = "mpp12", "mpp13", "mpp14", "mpp15", "mpp16";
+		marvell,function = "spi1";
+	};
+	cp1_tdm0_pins: tdm0-pins-0 {
+		marvell,pins = "mpp0", "mpp1", "mpp2", "mpp3", "mpp5";
+		marvell,function = "tdm";
+	};
+	/* BT */
+	cp1_uart0_pins: uart0-pins-0 {
+		marvell,pins = "mpp6", "mpp7";
+		marvell,function = "uart0";
+	};
+	/* HA */
+	cp1_uart2_pins: uart2-pins-0 {
+		marvell,pins = "mpp8", "mpp11";
+		marvell,function = "uart2";
+	};
+};
+
+/* DECT */
+&cp0_uart0 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_uart0_pins>;
+};
+
+/* EXP2 */
+&cp0_uart1 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_uart1_pins>;
+};
+
+/* EXP1 */
+&cp0_uart2 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_uart2_pins>;
+};
+
+&cp1_tdm0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp1_tdm0_pins>;
+	status = "okay";
+	pclk-freq-mhz = <2>;
+};
+
+/* BT */
+&cp1_uart0 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp1_uart0_pins>;
+};
+
+/* HA */
+&cp1_uart2 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp1_uart2_pins>;
+};
+
+&cp1_trng {
+	/* secure TRNG on fbxgw7r */
+	status = "foutu";
+};
+
+&cp1_clk {
+	fbx,ignore-eip150;
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/fbxgw7r.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,23 @@
+#include <dt-bindings/input/linux-event-codes.h>
+#include <dt-bindings/gpio/gpio.h>
+
+#include "armada-8040.dtsi"
+
+#include "fbxgw7r-common.dtsi"
+
+/ {
+	model = "Freebox V7R Board";
+	compatible = "freebox,fbxgw7r", "marvell,armada8040",
+		     "marvell,armada-ap806-quad", "marvell,armada-ap806";
+};
+
+&cp0_spi0 {
+	spi-panel@1 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "freebox,fbxgw7r-panel";
+		reg = <1>;
+		spi-max-frequency = <(750 * 1000)>;
+		irq-gpio = <&cp0_gpio2 2 0>;
+	};
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/fbxgw7r_exp1_dsl_lte.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,33 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "freebox,fbxgw7r";
+
+    fragment@0 {
+	target-path="/";
+        __overlay__ {
+		fbxatm-remote@0 {
+			compatible = "freebox,fbxatm-remote";
+			mac-address = [00 07 cb 00 00 fe];
+			netdev-name = "bcmfbxatm0";
+			remote-name = "bcm63xx_fbxxtm0";
+		};
+        };
+    };
+
+    fragment@1 {
+	target = <&cp1_spi1>;
+        __overlay__ {
+		#address-cells = <0x1>;
+		#size-cells = <0x0>;
+
+		exp1-flash@1 {
+			compatible = "m25p80";
+			reg = <1>;
+			spi-max-frequency = <(1 * 1000 * 1000)>;
+			label = "exp1-spi-flash";
+		};
+	};
+    };
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/fbxgw7r_exp1_ftth_p2p.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,4 @@
+#undef USE_PHYLINK_SFP
+
+#define EXP_SLOT		exp1
+#include "fbxgw7r_expX_ftth_p2p.dts"
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/fbxgw7r_exp1_test_module.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,4 @@
+#define EXP_SLOT		exp1
+#define EXP_SPI_FLASH_LABEL	"exp1-spi-flash"
+#define EXP_SPI_FLASH_CS	1
+#include "fbxgw7r_expX_test_module.dts"
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/fbxgw7r_exp2_ftth_p2p.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,4 @@
+#undef USE_PHYLINK_SFP
+
+#define EXP_SLOT	exp2
+#include "fbxgw7r_expX_ftth_p2p.dts"
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/fbxgw7r_exp2_ftth_pon.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,13 @@
+#include <dt-bindings/gpio/gpio.h>
+
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "freebox,fbxgw7r";
+    fragment@0 {
+	target-path="/";
+        __overlay__ {
+	};
+    };	
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/fbxgw7r_exp2_test_module.dts	2021-03-04 13:20:57.010838855 +0100
@@ -0,0 +1,4 @@
+#define EXP_SLOT		exp2
+#define EXP_SPI_FLASH_LABEL	"exp2-spi-flash"
+#define EXP_SPI_FLASH_CS	0
+#include "fbxgw7r_expX_test_module.dts"
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/fbxgw7r_exp_common.dtsi	2021-03-04 13:20:57.014172187 +0100
@@ -0,0 +1,5 @@
+#define PASTER(x, y) x ## y
+#define EVALUATOR(x, y) PASTER(x, y)
+#define EXP_LABEL(name) EVALUATOR(EXP_SLOT, EVALUATOR(_, name))
+#define EXP_NODE_NAME(name) EVALUATOR(EXP_SLOT, EVALUATOR(-, name))
+#define ADDRESSIFY(addr) EVALUATOR(0x, addr)
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/fbxgw7r_expX_ftth_p2p.dts	2021-03-04 13:20:57.014172187 +0100
@@ -0,0 +1,156 @@
+#include <dt-bindings/gpio/gpio.h>
+
+#include "fbxgw7r_exp_common.dtsi"
+
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "freebox,fbxgw7r";
+
+    fragment@0 {
+	target = <&EXP_LABEL(ext_i2c)>;
+        __overlay__ {
+		#address-cells = <0x1>;
+		#size-cells = <0x0>;
+
+		// IO expander found only on P2P Fiber
+		// expansion board.
+		EXP_LABEL(gpio_extender): EXP_NODE_NAME(gpio_extender)@74 {
+			compatible = "nxp,pca9539";
+			reg = <0x74>;
+			gpio-controller;
+			ngpios = <16>;
+			#gpio-cells = <2>;
+			gpio-line-names = "wan-sfp-pwren", /* 0 */
+				"wan-sfp-pwrgood", /* 1 */
+				"wan-sfp-txfault", /* 2 */
+				"wan-sfp-txdisable", /* 3 */
+				"wan-sfp-presence", /* 4 */
+				"wan-sfp-rxlos", /* 5 */
+				"wan-sfp-led", /* 6 */
+				"wan-sfp-i2cen", /* 7 */
+				"redriver-eqb", /* 8 */
+				"redriver-fgb", /* 9 */
+				"redriver-swb", /* 10 */
+				"redriver-eqa", /* 11 */
+				"redriver-fga", /* 12 */
+				"redriver-swa", /* 13 */
+				"redriver-mode", /* 14 */
+				"redriver-enable"; /* 15 */
+		};
+        };
+    };
+
+     fragment@1 {
+	target-path="/";
+        __overlay__ {
+		EXP_NODE_NAME(ftth-p2p-fbxgpio) {
+			compatible = "fbx,fbxgpio";
+			EXP_NODE_NAME(ftth-p2p-sfp-pwren) {
+				gpio = <&EXP_LABEL(gpio_extender) 0 0>;
+				output-low;
+#ifdef USE_PHYLINK_SFP
+				no-claim;
+#endif
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-pwrgood) {
+				gpio = <&EXP_LABEL(gpio_extender) 1 0>;
+				input;
+#ifdef USE_PHYLINK_SFP
+				no-claim;
+#endif
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-txfault) {
+				gpio = <&EXP_LABEL(gpio_extender) 2 0>;
+				input;
+#ifdef USE_PHYLINK_SFP
+				no-claim;
+#endif
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-txdis) {
+				gpio = <&EXP_LABEL(gpio_extender) 3 0>;
+				output-high;
+#ifdef USE_PHYLINK_SFP
+				no-claim;
+#endif
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-presence) {
+				gpio = <&EXP_LABEL(gpio_extender) 4 0>;
+				input;
+#ifdef USE_PHYLINK_SFP
+				no-claim;
+#endif
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-rxlos) {
+				gpio = <&EXP_LABEL(gpio_extender) 5 0>;
+				input;
+#ifdef USE_PHYLINK_SFP
+				no-claim;
+#endif
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-link-led) {
+				gpio = <&EXP_LABEL(gpio_extender) 6 GPIO_ACTIVE_LOW>;
+				output-low;
+			};
+			EXP_NODE_NAME(ftth-p2p-sfp-i2cen) {
+				gpio = <&EXP_LABEL(gpio_extender) 7 0>;
+				/* enable it by default, revisit later */
+				output-high;
+			};
+
+			EXP_NODE_NAME(ftth-p2p-redriver-eqb) {
+				gpio = <&EXP_LABEL(gpio_extender) 8 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-fgb) {
+				gpio = <&EXP_LABEL(gpio_extender) 9 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-swb) {
+				gpio = <&EXP_LABEL(gpio_extender) 10 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-eqa) {
+				gpio = <&EXP_LABEL(gpio_extender) 11 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-fga) {
+				gpio = <&EXP_LABEL(gpio_extender) 12 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-swa) {
+				gpio = <&EXP_LABEL(gpio_extender) 13 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-mode) {
+				gpio = <&EXP_LABEL(gpio_extender) 14 0>;
+				output-low;
+			};
+			EXP_NODE_NAME(ftth-p2p-redriver-en) {
+				gpio = <&EXP_LABEL(gpio_extender) 15 0>;
+				output-low;
+			};
+		};
+        };
+    };
+
+#ifdef USE_PHYLINK_SFP
+    fragment@2 {
+	target = <&EXP_LABEL(sfp)>;
+	__overlay__ {
+		status = "okay";
+		compatible = "sff,sfp";
+		i2c-bus = <&EXP_LABEL(ext_i2c)>;
+		maximum-power-milliwatt = <3000>;
+		los-gpios = <&EXP_LABEL(gpio_extender) 5 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpios = <&EXP_LABEL(gpio_extender) 4 GPIO_ACTIVE_LOW>;
+		tx-disable-gpios = <&EXP_LABEL(gpio_extender) 3 GPIO_ACTIVE_HIGH>;
+		tx-fault-gpios = <&EXP_LABEL(gpio_extender) 2 GPIO_ACTIVE_HIGH>;
+		pwr-enable-gpios = <&EXP_LABEL(gpio_extender) 0 GPIO_ACTIVE_HIGH>;
+	};
+    };
+#endif
+
+
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/fbxgw7r_expX_test_module.dts	2021-03-04 13:20:57.014172187 +0100
@@ -0,0 +1,99 @@
+#include <dt-bindings/gpio/gpio.h>
+
+#include "fbxgw7r_exp_common.dtsi"
+
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "freebox,fbxgw7r";
+
+    fragment@0 {
+	target = <&EXP_LABEL(ext_i2c)>;
+        __overlay__ {
+		#address-cells = <0x1>;
+		#size-cells = <0x0>;
+
+		EXP_LABEL(gpio_extender): exp1@74 {
+			compatible = "nxp,pca9539";
+			reg = <0x74>;
+			gpio-controller;
+			ngpios = <16>;
+			#gpio-cells = <2>;
+			gpio-line-names = "sfp-pwren", /* 0 */
+				"sfp-pwrgood", /* 1 */
+				"sfp-txfault", /* 2 */
+				"sfp-txdisable", /* 3 */
+				"sfp-presence", /* 4 */
+				"sfp-rxlos", /* 5 */
+				"sfp-led", /* 6 */
+				"sfp-i2cen", /* 7 */
+				"", /* 8 */
+				"", /* 9 */
+				"", /* 10 */
+				"", /* 11 */
+				"", /* 12 */
+				"", /* 13 */
+				"", /* 14 */
+				""; /* 15 */
+		};
+        };
+    };
+
+     fragment@1 {
+	target-path="/";
+        __overlay__ {
+		EXP_NODE_NAME(test-module-fbxgpio) {
+			compatible = "fbx,fbxgpio";
+			EXP_NODE_NAME(test-module-sfp-pwren) {
+				gpio = <&EXP_LABEL(gpio_extender) 0 0>;
+				output-low;
+			};
+			EXP_NODE_NAME(test-module-sfp-pwrgood) {
+				gpio = <&EXP_LABEL(gpio_extender) 1 0>;
+				input;
+			};
+			EXP_NODE_NAME(test-module-sfp-txfault) {
+				gpio = <&EXP_LABEL(gpio_extender) 2 0>;
+				input;
+			};
+			EXP_NODE_NAME(test-module-sfp-txdis) {
+				gpio = <&EXP_LABEL(gpio_extender) 3 0>;
+				output-high;
+			};
+			EXP_NODE_NAME(test-module-sfp-presence) {
+				gpio = <&EXP_LABEL(gpio_extender) 4 0>;
+				input;
+			};
+			EXP_NODE_NAME(test-module-sfp-rxlos) {
+				gpio = <&EXP_LABEL(gpio_extender) 5 0>;
+				input;
+			};
+			EXP_NODE_NAME(test-module-sfp-link-led) {
+				gpio = <&EXP_LABEL(gpio_extender) 6 GPIO_ACTIVE_LOW>;
+				output-low;
+			};
+			EXP_NODE_NAME(test-module-sfp-i2cen) {
+				gpio = <&EXP_LABEL(gpio_extender) 7 0>;
+				/* enable it by default, revisit later */
+				output-high;
+			};
+		};
+        };
+    };
+
+    fragment@2 {
+	target = <&cp1_spi1>;
+        __overlay__ {
+		#address-cells = <0x1>;
+		#size-cells = <0x0>;
+
+		EXP_NODE_NAME(flash)@1 {
+			compatible = "m25p80";
+			reg = <EXP_SPI_FLASH_CS>;
+			spi-max-frequency = <(1 * 1000 * 1000)>;
+			label = EXP_SPI_FLASH_LABEL;
+		};
+	};
+    };
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/jbxgw7r.dts	2021-03-04 13:20:57.014172187 +0100
@@ -0,0 +1,114 @@
+#include <dt-bindings/input/linux-event-codes.h>
+#include <dt-bindings/gpio/gpio.h>
+
+#include "armada-8040.dtsi"
+
+#define USE_PHYLINK_SFP
+
+#include "fbxgw7r-common.dtsi"
+
+/ {
+	model = "Freebox JaguarBox V7R Board";
+	compatible = "freebox,jbxgw7r", "marvell,armada8040",
+		     "marvell,armada-ap806-quad", "marvell,armada-ap806";
+
+	fbx7r-fbxgpio {
+		pos-sense {
+			gpio = <&io_expander0 7 0>;
+			input;
+		};
+	};
+};
+
+
+&cp0_spi0 {
+	ssd1327@1 {
+		compatible = "solomon,ssd1327";
+		status = "okay";
+		reg = <1>;
+		spi-max-frequency = <(5 * 1000 * 1000)>;
+		ssd1327,width = <128>;
+		ssd1327,height = <128>;
+		ssd1327,rotate = <270>;
+		ssd1327,watchdog = <300>;
+
+		ssd1327,data-select-gpio = <&cp1_gpio1 23 GPIO_ACTIVE_HIGH>;
+		ssd1327,vcc-gpio = <&cp0_gpio2 14 GPIO_ACTIVE_HIGH>;
+		ssd1327,reset-gpio = <&cp1_gpio1 21 0>;
+		ssd1327,init-sequence = "p32202";
+	};
+};
+
+
+&cp0_i2c0 {
+        cap1066@28 {
+		/* SMSC cap1066 */
+		compatible = "smsc,smsc_cap1066";
+		reg = <0x28>;
+		keymap = <KEY_DOWN
+			  KEY_LEFT
+			  KEY_UP
+			  0
+			  KEY_ENTER
+			  KEY_RIGHT>;
+	};
+
+	led1202@58 {
+		compatible = "st,led1202";
+		reg = <0x58>;
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		blue@0 {
+			label = "front-d67-blue";
+			reg = <0>;
+		};
+		green@1 {
+			label = "front-d67-green";
+			reg = <1>;
+		};
+		red@2 {
+			label = "front-d67-red";
+			reg = <2>;
+		};
+	};
+
+	led1202@59 {
+		compatible = "st,led1202";
+		reg = <0x59>;
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		blue@0 {
+			label = "rear-d1-red";
+			reg = <0>;
+		};
+		green@1 {
+			label = "rear-d1-green";
+			reg = <1>;
+		};
+		red@2 {
+			label = "rear-d1-blue";
+			reg = <2>;
+		};
+	};
+};
+
+/*
+ * for routing comfort on the midplane, rx & tx lanes polarity is swapped
+ * on jbxgw7r's expansion 1 backplane serdes.
+ */
+&cp1_comphy5 {
+	rx-swap-polarity;
+	tx-swap-polarity;
+};
+
+
+/*
+ * CP1 sata is completely unused on jbxgw7r.
+ */
+&cp1_sata0 {
+	status = "disabled";
+};
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/jbxgw7r_exp1_ftth_p2p.dts	2021-03-04 13:20:57.014172187 +0100
@@ -0,0 +1,4 @@
+#define USE_PHYLINK_SFP
+
+#define EXP_SLOT		exp1
+#include "fbxgw7r_expX_ftth_p2p.dts"
--- /dev/null	2021-04-15 09:21:41.728292489 +0200
+++ linux-5.4.60-fbx/scripts/dtc/include-prefixes/arm64/marvell/jbxgw7r_exp2_ftth_p2p.dts	2021-03-04 13:20:57.014172187 +0100
@@ -0,0 +1,4 @@
+#define USE_PHYLINK_SFP
+
+#define EXP_SLOT		exp2
+#include "fbxgw7r_expX_ftth_p2p.dts"
