--- /dev/null
+From be2c20726a6b667e88cbd92935c57c765e4a60ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 13:02:13 +0300
+Subject: ALSA: pci: lx6464es: fix a debug loop
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit 5dac9f8dc25fefd9d928b98f6477ff3daefd73e3 ]
+
+This loop accidentally reuses the "i" iterator for both the inside and
+the outside loop. The value of MAX_STREAM_BUFFER is 5. I believe that
+chip->rmh.stat_len is in the 2-12 range. If the value of .stat_len is
+4 or more then it will loop exactly one time, but if it's less then it
+is a forever loop.
+
+It looks like it was supposed to combined into one loop where
+conditions are checked.
+
+Fixes: 8e6320064c33 ("ALSA: lx_core: Remove useless #if 0 .. #endif")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/r/Y9jnJTis/mRFJAQp@kili
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/lx6464es/lx_core.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
+index d3f58a3d17fbc..b5b0d43bb8dcd 100644
+--- a/sound/pci/lx6464es/lx_core.c
++++ b/sound/pci/lx6464es/lx_core.c
+@@ -493,12 +493,11 @@ int lx_buffer_ask(struct lx6464es *chip, u32 pipe, int is_capture,
+ dev_dbg(chip->card->dev,
+ "CMD_08_ASK_BUFFERS: needed %d, freed %d\n",
+ *r_needed, *r_freed);
+- for (i = 0; i < MAX_STREAM_BUFFER; ++i) {
+- for (i = 0; i != chip->rmh.stat_len; ++i)
+- dev_dbg(chip->card->dev,
+- " stat[%d]: %x, %x\n", i,
+- chip->rmh.stat[i],
+- chip->rmh.stat[i] & MASK_DATA_SIZE);
++ for (i = 0; i < MAX_STREAM_BUFFER && i < chip->rmh.stat_len;
++ ++i) {
++ dev_dbg(chip->card->dev, " stat[%d]: %x, %x\n", i,
++ chip->rmh.stat[i],
++ chip->rmh.stat[i] & MASK_DATA_SIZE);
+ }
+ }
+
+--
+2.39.0
+
--- /dev/null
+From e84d2e084c5517d2093bacd965bd1a1af80ba4a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 18:40:14 +0800
+Subject: arm64: dts: mediatek: mt8195: Fix vdosys* compatible strings
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 97801cfcf9565247bcc53b67ea47fa87b1704375 ]
+
+When vdosys1 was initially added, it was incorrectly assumed to be
+compatible with vdosys0, and thus both had the same mt8195-mmsys
+compatible attached.
+
+This has since been corrected in commit b237efd47df7 ("dt-bindings:
+arm: mediatek: mmsys: change compatible for MT8195") and commit
+82219cfbef18 ("dt-bindings: arm: mediatek: mmsys: add vdosys1 compatible
+for MT8195"). The device tree needs to be fixed as well, otherwise
+the vdosys1 block fails to work, and causes its dependent power domain
+controller to not work either.
+
+Change the compatible string of vdosys1 to "mediatek,mt8195-vdosys1".
+While at it, also add the new "mediatek,mt8195-vdosys0" compatible to
+vdosys0.
+
+Fixes: 6aa5b46d1755 ("arm64: dts: mt8195: Add vdosys and vppsys clock nodes")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Tested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Acked-by: Matthias Brugger <matthias.bgg@gmail.com>
+Link: https://lore.kernel.org/r/20230202104014.2931517-1-wenst@chromium.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+index 0b85b5874a4f9..6f5fa7ca49013 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+@@ -1966,7 +1966,7 @@
+ };
+
+ vdosys0: syscon@1c01a000 {
+- compatible = "mediatek,mt8195-mmsys", "syscon";
++ compatible = "mediatek,mt8195-vdosys0", "mediatek,mt8195-mmsys", "syscon";
+ reg = <0 0x1c01a000 0 0x1000>;
+ mboxes = <&gce0 0 CMDQ_THR_PRIO_4>;
+ #clock-cells = <1>;
+@@ -2101,7 +2101,7 @@
+ };
+
+ vdosys1: syscon@1c100000 {
+- compatible = "mediatek,mt8195-mmsys", "syscon";
++ compatible = "mediatek,mt8195-vdosys1", "syscon";
+ reg = <0 0x1c100000 0 0x1000>;
+ #clock-cells = <1>;
+ };
+--
+2.39.0
+
--- /dev/null
+From 25e1e1f38cc6e42811178ee60192cfedcf9260be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Dec 2022 11:19:47 +0100
+Subject: arm64: dts: rockchip: fix input enable pinconf on rk3399
+
+From: Arnaud Ferraris <arnaud.ferraris@collabora.com>
+
+[ Upstream commit 6f515b663d49a14fb63f8c5d0a2a4ae53d44790a ]
+
+When the input enable pinconf was introduced, a default drive-strength
+value of 2 was set for the pull up/down configs. However, this parameter
+is unneeded when configuring the pin as input, and having a single
+hardcoded value here is actually harmful: GPIOs on the RK3399 have
+various same drive-strength capabilities depending on the bank and port
+they belong to.
+
+As an example, trying to configure the GPIO4_PD3 pin as an input with
+pull-up enabled fails with the following output:
+
+ [ 10.706542] rockchip-pinctrl pinctrl: unsupported driver strength 2
+ [ 10.713661] rockchip-pinctrl pinctrl: pin_config_set op failed for pin 155
+
+(acceptable drive-strength values for this pin being 3, 6, 9 and 12)
+
+Let's drop the drive-strength property from all input pinconfs in order
+to solve this issue.
+
+Fixes: ec48c3e82ca3 ("arm64: dts: rockchip: add an input enable pinconf to rk3399")
+Signed-off-by: Arnaud Ferraris <arnaud.ferraris@collabora.com>
+Reviewed-by: Caleb Connolly <kc@postmarketos.org>
+Link: https://lore.kernel.org/r/20221215101947.254896-1-arnaud.ferraris@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index 92c2207e686ce..59858f2dc8b9f 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -2221,13 +2221,11 @@
+ pcfg_input_pull_up: pcfg-input-pull-up {
+ input-enable;
+ bias-pull-up;
+- drive-strength = <2>;
+ };
+
+ pcfg_input_pull_down: pcfg-input-pull-down {
+ input-enable;
+ bias-pull-down;
+- drive-strength = <2>;
+ };
+
+ clock {
+--
+2.39.0
+
--- /dev/null
+From bcdc56cfbf7597122cb382aa15049d3d8d897c53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Jan 2023 12:24:32 +0100
+Subject: arm64: dts: rockchip: set sdmmc0 speed to sd-uhs-sdr50 on rock-3a
+
+From: Dan Johansen <strit@manjaro.org>
+
+[ Upstream commit bc121b707e816616567683e51fd9194c2309977a ]
+
+As other rk336x based devices, the Rock 3 Model A has issues with high
+speed SD cards, so lower the speed to 50 instead of 104 in the same
+manor has the Quartz64 Model B has.
+
+Fixes: 22a442e6586c ("arm64: dts: rockchip: add basic dts for the radxa rock3 model a")
+Signed-off-by: Dan Johansen <strit@manjaro.org>
+Link: https://lore.kernel.org/r/20230128112432.132302-1-strit@manjaro.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts b/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts
+index 539ef8cc77923..44313a18e484e 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts
+@@ -642,7 +642,7 @@
+ disable-wp;
+ pinctrl-names = "default";
+ pinctrl-0 = <&sdmmc0_bus4 &sdmmc0_clk &sdmmc0_cmd &sdmmc0_det>;
+- sd-uhs-sdr104;
++ sd-uhs-sdr50;
+ vmmc-supply = <&vcc3v3_sd>;
+ vqmmc-supply = <&vccio_sd>;
+ status = "okay";
+--
+2.39.0
+
--- /dev/null
+From 600bcf0a10f3442e46719e9cc2ef84a4091bc258 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 17:04:24 +0800
+Subject: ASoC: fsl_sai: fix getting version from VERID
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 29aab38823b61e482995c24644bd2d8acfe56185 ]
+
+The version information is at the bit31 ~ bit16 in the VERID
+register, so need to right shift 16bit to get it, otherwise
+the result of comparison "sai->verid.version >= 0x0301" is
+wrong.
+
+Fixes: 99c1e74f25d4 ("ASoC: fsl_sai: store full version instead of major/minor")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Reviewed-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Link: https://lore.kernel.org/r/1675760664-25193-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_sai.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index e60c7b3445623..8205b32171495 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -1141,6 +1141,7 @@ static int fsl_sai_check_version(struct device *dev)
+
+ sai->verid.version = val &
+ (FSL_SAI_VERID_MAJOR_MASK | FSL_SAI_VERID_MINOR_MASK);
++ sai->verid.version >>= FSL_SAI_VERID_MINOR_SHIFT;
+ sai->verid.feature = val & FSL_SAI_VERID_FEATURE_MASK;
+
+ ret = regmap_read(sai->regmap, FSL_SAI_PARAM, &val);
+--
+2.39.0
+
--- /dev/null
+From 9d61f91c6e3de4a322e53458b7c92209ddd79141 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Oct 2022 21:38:38 +1300
+Subject: ASoC: tas5805m: add missing page switch.
+
+From: Daniel Beer <daniel.beer@igorinstitute.com>
+
+[ Upstream commit e0576cd642ced1ac65370b4516b7be9f536a0498 ]
+
+In tas5805m_refresh, we switch pages to update the DSP volume control,
+but we need to switch back to page 0 before trying to alter the
+soft-mute control. This latter page-switch was missing.
+
+Fixes: ec45268467f4 ("ASoC: add support for TAS5805M digital amplifier")
+Signed-off-by: Daniel Beer <daniel.beer@igorinstitute.com>
+Link: https://lore.kernel.org/r/1fea38a71ea6ab0225d19ab28d1fa12828d762d0.1675497326.git.daniel.beer@igorinstitute.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas5805m.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/codecs/tas5805m.c b/sound/soc/codecs/tas5805m.c
+index 6e2edf045446e..4e38eb7acea1b 100644
+--- a/sound/soc/codecs/tas5805m.c
++++ b/sound/soc/codecs/tas5805m.c
+@@ -203,6 +203,9 @@ static void tas5805m_refresh(struct tas5805m_priv *tas5805m)
+ set_dsp_scale(rm, 0x24, tas5805m->vol[0]);
+ set_dsp_scale(rm, 0x28, tas5805m->vol[1]);
+
++ regmap_write(rm, REG_PAGE, 0x00);
++ regmap_write(rm, REG_BOOK, 0x00);
++
+ /* Set/clear digital soft-mute */
+ regmap_write(rm, REG_DEVICE_CTRL_2,
+ (tas5805m->is_muted ? DCTRL2_MUTE : 0) |
+--
+2.39.0
+
--- /dev/null
+From 5140996d3c29690cab0798dac7bbeff8ac632f9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Oct 2022 21:28:31 +1300
+Subject: ASoC: tas5805m: rework to avoid scheduling while atomic.
+
+From: Daniel Beer <daniel.beer@igorinstitute.com>
+
+[ Upstream commit 147323792693bf013f60dca160be1d32bd4d180a ]
+
+There's some setup we need to do in order to get the DSP initialized,
+and this can't be done until a bit-clock is ready. In an earlier version
+of this driver, this work was done in a DAPM callback.
+
+The DAPM callback doesn't guarantee that the bit-clock is running, so
+the work was moved instead to the trigger callback. Unfortunately this
+callback runs in atomic context, and the setup code needs to do I2C
+transactions.
+
+Here we use a work_struct to kick off the setup in a thread instead.
+
+Fixes: ec45268467f4 ("ASoC: add support for TAS5805M digital amplifier")
+Signed-off-by: Daniel Beer <daniel.beer@igorinstitute.com>
+Link: https://lore.kernel.org/r/85d8ba405cb009a7a3249b556dc8f3bdb1754fdf.1675497326.git.daniel.beer@igorinstitute.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas5805m.c | 128 ++++++++++++++++++++++++------------
+ 1 file changed, 87 insertions(+), 41 deletions(-)
+
+diff --git a/sound/soc/codecs/tas5805m.c b/sound/soc/codecs/tas5805m.c
+index beb4ec629a03c..6e2edf045446e 100644
+--- a/sound/soc/codecs/tas5805m.c
++++ b/sound/soc/codecs/tas5805m.c
+@@ -154,6 +154,7 @@ static const uint32_t tas5805m_volume[] = {
+ #define TAS5805M_VOLUME_MIN 0
+
+ struct tas5805m_priv {
++ struct i2c_client *i2c;
+ struct regulator *pvdd;
+ struct gpio_desc *gpio_pdn_n;
+
+@@ -165,6 +166,9 @@ struct tas5805m_priv {
+ int vol[2];
+ bool is_powered;
+ bool is_muted;
++
++ struct work_struct work;
++ struct mutex lock;
+ };
+
+ static void set_dsp_scale(struct regmap *rm, int offset, int vol)
+@@ -181,13 +185,11 @@ static void set_dsp_scale(struct regmap *rm, int offset, int vol)
+ regmap_bulk_write(rm, offset, v, ARRAY_SIZE(v));
+ }
+
+-static void tas5805m_refresh(struct snd_soc_component *component)
++static void tas5805m_refresh(struct tas5805m_priv *tas5805m)
+ {
+- struct tas5805m_priv *tas5805m =
+- snd_soc_component_get_drvdata(component);
+ struct regmap *rm = tas5805m->regmap;
+
+- dev_dbg(component->dev, "refresh: is_muted=%d, vol=%d/%d\n",
++ dev_dbg(&tas5805m->i2c->dev, "refresh: is_muted=%d, vol=%d/%d\n",
+ tas5805m->is_muted, tas5805m->vol[0], tas5805m->vol[1]);
+
+ regmap_write(rm, REG_PAGE, 0x00);
+@@ -226,8 +228,11 @@ static int tas5805m_vol_get(struct snd_kcontrol *kcontrol,
+ struct tas5805m_priv *tas5805m =
+ snd_soc_component_get_drvdata(component);
+
++ mutex_lock(&tas5805m->lock);
+ ucontrol->value.integer.value[0] = tas5805m->vol[0];
+ ucontrol->value.integer.value[1] = tas5805m->vol[1];
++ mutex_unlock(&tas5805m->lock);
++
+ return 0;
+ }
+
+@@ -243,11 +248,13 @@ static int tas5805m_vol_put(struct snd_kcontrol *kcontrol,
+ snd_soc_kcontrol_component(kcontrol);
+ struct tas5805m_priv *tas5805m =
+ snd_soc_component_get_drvdata(component);
++ int ret = 0;
+
+ if (!(volume_is_valid(ucontrol->value.integer.value[0]) &&
+ volume_is_valid(ucontrol->value.integer.value[1])))
+ return -EINVAL;
+
++ mutex_lock(&tas5805m->lock);
+ if (tas5805m->vol[0] != ucontrol->value.integer.value[0] ||
+ tas5805m->vol[1] != ucontrol->value.integer.value[1]) {
+ tas5805m->vol[0] = ucontrol->value.integer.value[0];
+@@ -256,11 +263,12 @@ static int tas5805m_vol_put(struct snd_kcontrol *kcontrol,
+ tas5805m->vol[0], tas5805m->vol[1],
+ tas5805m->is_powered);
+ if (tas5805m->is_powered)
+- tas5805m_refresh(component);
+- return 1;
++ tas5805m_refresh(tas5805m);
++ ret = 1;
+ }
++ mutex_unlock(&tas5805m->lock);
+
+- return 0;
++ return ret;
+ }
+
+ static const struct snd_kcontrol_new tas5805m_snd_controls[] = {
+@@ -294,54 +302,83 @@ static int tas5805m_trigger(struct snd_pcm_substream *substream, int cmd,
+ struct snd_soc_component *component = dai->component;
+ struct tas5805m_priv *tas5805m =
+ snd_soc_component_get_drvdata(component);
+- struct regmap *rm = tas5805m->regmap;
+- unsigned int chan, global1, global2;
+
+ switch (cmd) {
+ case SNDRV_PCM_TRIGGER_START:
+ case SNDRV_PCM_TRIGGER_RESUME:
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+- dev_dbg(component->dev, "DSP startup\n");
+-
+- /* We mustn't issue any I2C transactions until the I2S
+- * clock is stable. Furthermore, we must allow a 5ms
+- * delay after the first set of register writes to
+- * allow the DSP to boot before configuring it.
+- */
+- usleep_range(5000, 10000);
+- send_cfg(rm, dsp_cfg_preboot,
+- ARRAY_SIZE(dsp_cfg_preboot));
+- usleep_range(5000, 15000);
+- send_cfg(rm, tas5805m->dsp_cfg_data,
+- tas5805m->dsp_cfg_len);
+-
+- tas5805m->is_powered = true;
+- tas5805m_refresh(component);
++ dev_dbg(component->dev, "clock start\n");
++ schedule_work(&tas5805m->work);
+ break;
+
+ case SNDRV_PCM_TRIGGER_STOP:
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+- dev_dbg(component->dev, "DSP shutdown\n");
++ break;
+
+- tas5805m->is_powered = false;
++ default:
++ return -EINVAL;
++ }
+
+- regmap_write(rm, REG_PAGE, 0x00);
+- regmap_write(rm, REG_BOOK, 0x00);
++ return 0;
++}
+
+- regmap_read(rm, REG_CHAN_FAULT, &chan);
+- regmap_read(rm, REG_GLOBAL_FAULT1, &global1);
+- regmap_read(rm, REG_GLOBAL_FAULT2, &global2);
++static void do_work(struct work_struct *work)
++{
++ struct tas5805m_priv *tas5805m =
++ container_of(work, struct tas5805m_priv, work);
++ struct regmap *rm = tas5805m->regmap;
+
+- dev_dbg(component->dev,
+- "fault regs: CHAN=%02x, GLOBAL1=%02x, GLOBAL2=%02x\n",
+- chan, global1, global2);
++ dev_dbg(&tas5805m->i2c->dev, "DSP startup\n");
+
+- regmap_write(rm, REG_DEVICE_CTRL_2, DCTRL2_MODE_HIZ);
+- break;
++ mutex_lock(&tas5805m->lock);
++ /* We mustn't issue any I2C transactions until the I2S
++ * clock is stable. Furthermore, we must allow a 5ms
++ * delay after the first set of register writes to
++ * allow the DSP to boot before configuring it.
++ */
++ usleep_range(5000, 10000);
++ send_cfg(rm, dsp_cfg_preboot, ARRAY_SIZE(dsp_cfg_preboot));
++ usleep_range(5000, 15000);
++ send_cfg(rm, tas5805m->dsp_cfg_data, tas5805m->dsp_cfg_len);
++
++ tas5805m->is_powered = true;
++ tas5805m_refresh(tas5805m);
++ mutex_unlock(&tas5805m->lock);
++}
+
+- default:
+- return -EINVAL;
++static int tas5805m_dac_event(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
++{
++ struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
++ struct tas5805m_priv *tas5805m =
++ snd_soc_component_get_drvdata(component);
++ struct regmap *rm = tas5805m->regmap;
++
++ if (event & SND_SOC_DAPM_PRE_PMD) {
++ unsigned int chan, global1, global2;
++
++ dev_dbg(component->dev, "DSP shutdown\n");
++ cancel_work_sync(&tas5805m->work);
++
++ mutex_lock(&tas5805m->lock);
++ if (tas5805m->is_powered) {
++ tas5805m->is_powered = false;
++
++ regmap_write(rm, REG_PAGE, 0x00);
++ regmap_write(rm, REG_BOOK, 0x00);
++
++ regmap_read(rm, REG_CHAN_FAULT, &chan);
++ regmap_read(rm, REG_GLOBAL_FAULT1, &global1);
++ regmap_read(rm, REG_GLOBAL_FAULT2, &global2);
++
++ dev_dbg(component->dev, "fault regs: CHAN=%02x, "
++ "GLOBAL1=%02x, GLOBAL2=%02x\n",
++ chan, global1, global2);
++
++ regmap_write(rm, REG_DEVICE_CTRL_2, DCTRL2_MODE_HIZ);
++ }
++ mutex_unlock(&tas5805m->lock);
+ }
+
+ return 0;
+@@ -354,7 +391,8 @@ static const struct snd_soc_dapm_route tas5805m_audio_map[] = {
+
+ static const struct snd_soc_dapm_widget tas5805m_dapm_widgets[] = {
+ SND_SOC_DAPM_AIF_IN("DAC IN", "Playback", 0, SND_SOC_NOPM, 0, 0),
+- SND_SOC_DAPM_DAC("DAC", NULL, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_DAC_E("DAC", NULL, SND_SOC_NOPM, 0, 0,
++ tas5805m_dac_event, SND_SOC_DAPM_PRE_PMD),
+ SND_SOC_DAPM_OUTPUT("OUT")
+ };
+
+@@ -375,11 +413,14 @@ static int tas5805m_mute(struct snd_soc_dai *dai, int mute, int direction)
+ struct tas5805m_priv *tas5805m =
+ snd_soc_component_get_drvdata(component);
+
++ mutex_lock(&tas5805m->lock);
+ dev_dbg(component->dev, "set mute=%d (is_powered=%d)\n",
+ mute, tas5805m->is_powered);
++
+ tas5805m->is_muted = mute;
+ if (tas5805m->is_powered)
+- tas5805m_refresh(component);
++ tas5805m_refresh(tas5805m);
++ mutex_unlock(&tas5805m->lock);
+
+ return 0;
+ }
+@@ -434,6 +475,7 @@ static int tas5805m_i2c_probe(struct i2c_client *i2c)
+ if (!tas5805m)
+ return -ENOMEM;
+
++ tas5805m->i2c = i2c;
+ tas5805m->pvdd = devm_regulator_get(dev, "pvdd");
+ if (IS_ERR(tas5805m->pvdd)) {
+ dev_err(dev, "failed to get pvdd supply: %ld\n",
+@@ -507,6 +549,9 @@ static int tas5805m_i2c_probe(struct i2c_client *i2c)
+ gpiod_set_value(tas5805m->gpio_pdn_n, 1);
+ usleep_range(10000, 15000);
+
++ INIT_WORK(&tas5805m->work, do_work);
++ mutex_init(&tas5805m->lock);
++
+ /* Don't register through devm. We need to be able to unregister
+ * the component prior to deasserting PDN#
+ */
+@@ -527,6 +572,7 @@ static void tas5805m_i2c_remove(struct i2c_client *i2c)
+ struct device *dev = &i2c->dev;
+ struct tas5805m_priv *tas5805m = dev_get_drvdata(dev);
+
++ cancel_work_sync(&tas5805m->work);
+ snd_soc_unregister_component(dev);
+ gpiod_set_value(tas5805m->gpio_pdn_n, 0);
+ usleep_range(10000, 15000);
+--
+2.39.0
+
--- /dev/null
+From 45766f41ed5fb068166d4032d9a1beb5d3d2c191 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 22:04:28 +0100
+Subject: ASoC: topology: Return -ENOMEM on memory allocation failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit c173ee5b2fa6195066674d66d1d7e191010fb1ff ]
+
+When handling error path, ret needs to be set to correct value.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Fixes: d29d41e28eea ("ASoC: topology: Add support for multiple kcontrol types to a widget")
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Link: https://lore.kernel.org/r/20230207210428.2076354-1-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index c3be24b2fac55..a79a2fb260b87 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -1401,13 +1401,17 @@ static int soc_tplg_dapm_widget_create(struct soc_tplg *tplg,
+
+ template.num_kcontrols = le32_to_cpu(w->num_kcontrols);
+ kc = devm_kcalloc(tplg->dev, le32_to_cpu(w->num_kcontrols), sizeof(*kc), GFP_KERNEL);
+- if (!kc)
++ if (!kc) {
++ ret = -ENOMEM;
+ goto hdr_err;
++ }
+
+ kcontrol_type = devm_kcalloc(tplg->dev, le32_to_cpu(w->num_kcontrols), sizeof(unsigned int),
+ GFP_KERNEL);
+- if (!kcontrol_type)
++ if (!kcontrol_type) {
++ ret = -ENOMEM;
+ goto hdr_err;
++ }
+
+ for (i = 0; i < le32_to_cpu(w->num_kcontrols); i++) {
+ control_hdr = (struct snd_soc_tplg_ctl_hdr *)tplg->pos;
+--
+2.39.0
+
--- /dev/null
+From 939a53e27b351ff3d878d9b1fc768add769bbc0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 17:32:55 +0800
+Subject: bonding: fix error checking in bond_debug_reregister()
+
+From: Qi Zheng <zhengqi.arch@bytedance.com>
+
+[ Upstream commit cbe83191d40d8925b7a99969d037d2a0caf69294 ]
+
+Since commit ff9fb72bc077 ("debugfs: return error values,
+not NULL") changed return value of debugfs_rename() in
+error cases from %NULL to %ERR_PTR(-ERROR), we should
+also check error values instead of NULL.
+
+Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL")
+Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com>
+Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
+Link: https://lore.kernel.org/r/20230202093256.32458-1-zhengqi.arch@bytedance.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/bonding/bond_debugfs.c b/drivers/net/bonding/bond_debugfs.c
+index 4f9b4a18c74cd..5940945266489 100644
+--- a/drivers/net/bonding/bond_debugfs.c
++++ b/drivers/net/bonding/bond_debugfs.c
+@@ -76,7 +76,7 @@ void bond_debug_reregister(struct bonding *bond)
+
+ d = debugfs_rename(bonding_debug_root, bond->debug_dir,
+ bonding_debug_root, bond->dev->name);
+- if (d) {
++ if (!IS_ERR(d)) {
+ bond->debug_dir = d;
+ } else {
+ netdev_warn(bond->dev, "failed to reregister, so just unregister old one\n");
+--
+2.39.0
+
--- /dev/null
+From afe79b2f9174f04ba6a4e8227077102ecc095472 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 14:00:23 -0800
+Subject: cpufreq: qcom-hw: Fix cpufreq_driver->get() for non-LMH systems
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 51be2fffd65d9f9cb427030ab0ee85d791b4437d ]
+
+On a sc7180-based Chromebook, when I go to
+/sys/devices/system/cpu/cpu0/cpufreq I can see:
+
+ cpuinfo_cur_freq:2995200
+ cpuinfo_max_freq:1804800
+ scaling_available_frequencies:300000 576000 ... 1708800 1804800
+ scaling_cur_freq:1804800
+ scaling_max_freq:1804800
+
+As you can see the `cpuinfo_cur_freq` is bogus. It turns out that this
+bogus info started showing up as of commit c72cf0cb1d77 ("cpufreq:
+qcom-hw: Fix the frequency returned by cpufreq_driver->get()"). That
+commit seems to assume that everyone is on the LMH bandwagon, but
+sc7180 isn't.
+
+Let's go back to the old code in the case where LMH isn't used.
+
+Fixes: c72cf0cb1d77 ("cpufreq: qcom-hw: Fix the frequency returned by cpufreq_driver->get()")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+[ Viresh: Fixed the 'fixes' tag ]
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/qcom-cpufreq-hw.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c
+index 3c623a0bc147f..d10bf7635a0d5 100644
+--- a/drivers/cpufreq/qcom-cpufreq-hw.c
++++ b/drivers/cpufreq/qcom-cpufreq-hw.c
+@@ -137,40 +137,42 @@ static unsigned long qcom_lmh_get_throttle_freq(struct qcom_cpufreq_data *data)
+ return lval * xo_rate;
+ }
+
+-/* Get the current frequency of the CPU (after throttling) */
+-static unsigned int qcom_cpufreq_hw_get(unsigned int cpu)
++/* Get the frequency requested by the cpufreq core for the CPU */
++static unsigned int qcom_cpufreq_get_freq(unsigned int cpu)
+ {
+ struct qcom_cpufreq_data *data;
++ const struct qcom_cpufreq_soc_data *soc_data;
+ struct cpufreq_policy *policy;
++ unsigned int index;
+
+ policy = cpufreq_cpu_get_raw(cpu);
+ if (!policy)
+ return 0;
+
+ data = policy->driver_data;
++ soc_data = data->soc_data;
+
+- return qcom_lmh_get_throttle_freq(data) / HZ_PER_KHZ;
++ index = readl_relaxed(data->base + soc_data->reg_perf_state);
++ index = min(index, LUT_MAX_ENTRIES - 1);
++
++ return policy->freq_table[index].frequency;
+ }
+
+-/* Get the frequency requested by the cpufreq core for the CPU */
+-static unsigned int qcom_cpufreq_get_freq(unsigned int cpu)
++static unsigned int qcom_cpufreq_hw_get(unsigned int cpu)
+ {
+ struct qcom_cpufreq_data *data;
+- const struct qcom_cpufreq_soc_data *soc_data;
+ struct cpufreq_policy *policy;
+- unsigned int index;
+
+ policy = cpufreq_cpu_get_raw(cpu);
+ if (!policy)
+ return 0;
+
+ data = policy->driver_data;
+- soc_data = data->soc_data;
+
+- index = readl_relaxed(data->base + soc_data->reg_perf_state);
+- index = min(index, LUT_MAX_ENTRIES - 1);
++ if (data->throttle_irq >= 0)
++ return qcom_lmh_get_throttle_freq(data) / HZ_PER_KHZ;
+
+- return policy->freq_table[index].frequency;
++ return qcom_cpufreq_get_freq(cpu);
+ }
+
+ static unsigned int qcom_cpufreq_hw_fast_switch(struct cpufreq_policy *policy,
+--
+2.39.0
+
--- /dev/null
+From 4a0808fd1501f5e086f9d6ab26cf1272ad8550f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 22:17:19 +0000
+Subject: cpuset: Call set_cpus_allowed_ptr() with appropriate mask for task
+
+From: Will Deacon <will@kernel.org>
+
+[ Upstream commit 7a2127e66a00e073db8d90f9aac308f4a8a64226 ]
+
+set_cpus_allowed_ptr() will fail with -EINVAL if the requested
+affinity mask is not a subset of the task_cpu_possible_mask() for the
+task being updated. Consequently, on a heterogeneous system with cpusets
+spanning the different CPU types, updates to the cgroup hierarchy can
+silently fail to update task affinities when the effective affinity
+mask for the cpuset is expanded.
+
+For example, consider an arm64 system with 4 CPUs, where CPUs 2-3 are
+the only cores capable of executing 32-bit tasks. Attaching a 32-bit
+task to a cpuset containing CPUs 0-2 will correctly affine the task to
+CPU 2. Extending the cpuset to CPUs 0-3, however, will fail to extend
+the affinity mask of the 32-bit task because update_tasks_cpumask() will
+pass the full 0-3 mask to set_cpus_allowed_ptr().
+
+Extend update_tasks_cpumask() to take a temporary 'cpumask' paramater
+and use it to mask the 'effective_cpus' mask with the possible mask for
+each task being updated.
+
+Fixes: 431c69fac05b ("cpuset: Honour task_cpu_possible_mask() in guarantee_online_cpus()")
+Signed-off-by: Will Deacon <will@kernel.org>
+Acked-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cpuset.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index a753adcbc7c70..fac4260366208 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -1201,12 +1201,13 @@ void rebuild_sched_domains(void)
+ /**
+ * update_tasks_cpumask - Update the cpumasks of tasks in the cpuset.
+ * @cs: the cpuset in which each task's cpus_allowed mask needs to be changed
++ * @new_cpus: the temp variable for the new effective_cpus mask
+ *
+ * Iterate through each task of @cs updating its cpus_allowed to the
+ * effective cpuset's. As this function is called with cpuset_rwsem held,
+ * cpuset membership stays stable.
+ */
+-static void update_tasks_cpumask(struct cpuset *cs)
++static void update_tasks_cpumask(struct cpuset *cs, struct cpumask *new_cpus)
+ {
+ struct css_task_iter it;
+ struct task_struct *task;
+@@ -1220,7 +1221,10 @@ static void update_tasks_cpumask(struct cpuset *cs)
+ if (top_cs && (task->flags & PF_KTHREAD) &&
+ kthread_is_per_cpu(task))
+ continue;
+- set_cpus_allowed_ptr(task, cs->effective_cpus);
++
++ cpumask_and(new_cpus, cs->effective_cpus,
++ task_cpu_possible_mask(task));
++ set_cpus_allowed_ptr(task, new_cpus);
+ }
+ css_task_iter_end(&it);
+ }
+@@ -1505,7 +1509,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cs, int cmd,
+ spin_unlock_irq(&callback_lock);
+
+ if (adding || deleting)
+- update_tasks_cpumask(parent);
++ update_tasks_cpumask(parent, tmp->new_cpus);
+
+ /*
+ * Set or clear CS_SCHED_LOAD_BALANCE when partcmd_update, if necessary.
+@@ -1657,7 +1661,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp,
+ WARN_ON(!is_in_v2_mode() &&
+ !cpumask_equal(cp->cpus_allowed, cp->effective_cpus));
+
+- update_tasks_cpumask(cp);
++ update_tasks_cpumask(cp, tmp->new_cpus);
+
+ /*
+ * On legacy hierarchy, if the effective cpumask of any non-
+@@ -2305,7 +2309,7 @@ static int update_prstate(struct cpuset *cs, int new_prs)
+ }
+ }
+
+- update_tasks_cpumask(parent);
++ update_tasks_cpumask(parent, tmpmask.new_cpus);
+
+ if (parent->child_ecpus_count)
+ update_sibling_cpumasks(parent, cs, &tmpmask);
+@@ -3318,7 +3322,7 @@ hotplug_update_tasks_legacy(struct cpuset *cs,
+ * as the tasks will be migrated to an ancestor.
+ */
+ if (cpus_updated && !cpumask_empty(cs->cpus_allowed))
+- update_tasks_cpumask(cs);
++ update_tasks_cpumask(cs, new_cpus);
+ if (mems_updated && !nodes_empty(cs->mems_allowed))
+ update_tasks_nodemask(cs);
+
+@@ -3355,7 +3359,7 @@ hotplug_update_tasks(struct cpuset *cs,
+ spin_unlock_irq(&callback_lock);
+
+ if (cpus_updated)
+- update_tasks_cpumask(cs);
++ update_tasks_cpumask(cs, new_cpus);
+ if (mems_updated)
+ update_tasks_nodemask(cs);
+ }
+--
+2.39.0
+
--- /dev/null
+From a4622a89d4ea4831d2963e68c870a889cd08094a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 02:21:24 +0200
+Subject: drm/i915: Don't do the WM0->WM1 copy w/a if WM1 is already enabled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit 90d5e8301ac24550be80d193aa5582cab56c29fc ]
+
+Due to a workaround we have to make sure the WM1 watermarks block/lines
+values are sensible even when WM1 is disabled. To that end we copy those
+values from WM0.
+
+However since we now keep each wm level enabled on a per-plane basis
+it doesn't seem necessary to do that copy when we already have an
+enabled WM1 on the current plane. That is, we might be in a situation
+where another plane can only do WM0 (and thus needs the copy) but
+the current plane's WM1 is still perfectly valid (ie. fits into the
+current DDB allocation).
+
+Skipping the copy could avoid reprogramming the plane's registers
+needlessly in some cases.
+
+Fixes: a301cb0fca2d ("drm/i915: Keep plane watermarks enabled more aggressively")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230131002127.29305-1-ville.syrjala@linux.intel.com
+Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
+(cherry picked from commit c580c2d27ac8754cc6f01da1d715b7272f5f9cbb)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/skl_watermark.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/display/skl_watermark.c b/drivers/gpu/drm/i915/display/skl_watermark.c
+index 18178b01375e4..a7adf02476f6a 100644
+--- a/drivers/gpu/drm/i915/display/skl_watermark.c
++++ b/drivers/gpu/drm/i915/display/skl_watermark.c
+@@ -1587,7 +1587,8 @@ skl_crtc_allocate_plane_ddb(struct intel_atomic_state *state,
+ skl_check_wm_level(&wm->wm[level], ddb);
+
+ if (icl_need_wm1_wa(i915, plane_id) &&
+- level == 1 && wm->wm[0].enable) {
++ level == 1 && !wm->wm[level].enable &&
++ wm->wm[0].enable) {
+ wm->wm[level].blocks = wm->wm[0].blocks;
+ wm->wm[level].lines = wm->wm[0].lines;
+ wm->wm[level].ignore_lines = wm->wm[0].ignore_lines;
+--
+2.39.0
+
--- /dev/null
+From ca3bb9cae85043a6faf6c20e38d41b55e0e13c34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 15:33:44 -0800
+Subject: drm/virtio: exbuf->fence_fd unmodified on interrupted wait
+
+From: Ryan Neph <ryanneph@chromium.org>
+
+[ Upstream commit 8f20660f053cefd4693e69cfff9cf58f4f7c4929 ]
+
+An interrupted dma_fence_wait() becomes an -ERESTARTSYS returned
+to userspace ioctl(DRM_IOCTL_VIRTGPU_EXECBUFFER) calls, prompting to
+retry the ioctl(), but the passed exbuf->fence_fd has been reset to -1,
+making the retry attempt fail at sync_file_get_fence().
+
+The uapi for DRM_IOCTL_VIRTGPU_EXECBUFFER is changed to retain the
+passed value for exbuf->fence_fd when returning anything besides a
+successful result from the ioctl.
+
+Fixes: 2cd7b6f08bc4 ("drm/virtio: add in/out fence support for explicit synchronization")
+Signed-off-by: Ryan Neph <ryanneph@chromium.org>
+Reviewed-by: Rob Clark <robdclark@gmail.com>
+Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230203233345.2477767-1-ryanneph@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_ioctl.c | 5 +----
+ include/uapi/drm/virtgpu_drm.h | 1 +
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+index 9f4a90493aeac..da45215a933d0 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
++++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+@@ -126,7 +126,6 @@ static int virtio_gpu_execbuffer_ioctl(struct drm_device *dev, void *data,
+ void __user *user_bo_handles = NULL;
+ struct virtio_gpu_object_array *buflist = NULL;
+ struct sync_file *sync_file;
+- int in_fence_fd = exbuf->fence_fd;
+ int out_fence_fd = -1;
+ void *buf;
+ uint64_t fence_ctx;
+@@ -152,13 +151,11 @@ static int virtio_gpu_execbuffer_ioctl(struct drm_device *dev, void *data,
+ ring_idx = exbuf->ring_idx;
+ }
+
+- exbuf->fence_fd = -1;
+-
+ virtio_gpu_create_context(dev, file);
+ if (exbuf->flags & VIRTGPU_EXECBUF_FENCE_FD_IN) {
+ struct dma_fence *in_fence;
+
+- in_fence = sync_file_get_fence(in_fence_fd);
++ in_fence = sync_file_get_fence(exbuf->fence_fd);
+
+ if (!in_fence)
+ return -EINVAL;
+diff --git a/include/uapi/drm/virtgpu_drm.h b/include/uapi/drm/virtgpu_drm.h
+index 0512fde5e6978..7b158fcb02b45 100644
+--- a/include/uapi/drm/virtgpu_drm.h
++++ b/include/uapi/drm/virtgpu_drm.h
+@@ -64,6 +64,7 @@ struct drm_virtgpu_map {
+ __u32 pad;
+ };
+
++/* fence_fd is modified on success if VIRTGPU_EXECBUF_FENCE_FD_OUT flag is set. */
+ struct drm_virtgpu_execbuffer {
+ __u32 flags;
+ __u32 size;
+--
+2.39.0
+
--- /dev/null
+From e455b5c110ed6db252b74c0f9167ff749332121a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 16:08:49 -0600
+Subject: HID: amd_sfh: if no sensors are enabled, clean up
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 7bcfdab3f0c6672ca52be3cb65a0550d8b99554b ]
+
+It was reported that commit b300667b33b2 ("HID: amd_sfh: Disable the
+interrupt for all command") had caused increased resume time on HP Envy
+x360.
+
+Before this commit 3 sensors were reported, but they were not actually
+functional. After this commit the sensors are no longer reported, but
+also the resume time increased.
+
+To avoid this problem explicitly look for the number of disabled sensors.
+If all the sensors are disabled, clean everything up.
+
+Fixes: b300667b33b2 ("HID: amd_sfh: Disable the interrupt for all command")
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2115
+Reported-by: Xaver Hugl <xaver.hugl@gmail.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Link: https://lore.kernel.org/r/20230203220850.13924-1-mario.limonciello@amd.com
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/amd-sfh-hid/amd_sfh_client.c | 13 +++++++++++--
+ drivers/hid/amd-sfh-hid/amd_sfh_hid.h | 1 +
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_client.c b/drivers/hid/amd-sfh-hid/amd_sfh_client.c
+index 1fb0f7105fb21..c751d12f5df89 100644
+--- a/drivers/hid/amd-sfh-hid/amd_sfh_client.c
++++ b/drivers/hid/amd-sfh-hid/amd_sfh_client.c
+@@ -227,6 +227,7 @@ int amd_sfh_hid_client_init(struct amd_mp2_dev *privdata)
+ cl_data->num_hid_devices = amd_mp2_get_sensor_num(privdata, &cl_data->sensor_idx[0]);
+ if (cl_data->num_hid_devices == 0)
+ return -ENODEV;
++ cl_data->is_any_sensor_enabled = false;
+
+ INIT_DELAYED_WORK(&cl_data->work, amd_sfh_work);
+ INIT_DELAYED_WORK(&cl_data->work_buffer, amd_sfh_work_buffer);
+@@ -287,6 +288,7 @@ int amd_sfh_hid_client_init(struct amd_mp2_dev *privdata)
+ status = amd_sfh_wait_for_response
+ (privdata, cl_data->sensor_idx[i], SENSOR_ENABLED);
+ if (status == SENSOR_ENABLED) {
++ cl_data->is_any_sensor_enabled = true;
+ cl_data->sensor_sts[i] = SENSOR_ENABLED;
+ rc = amdtp_hid_probe(cl_data->cur_hid_dev, cl_data);
+ if (rc) {
+@@ -301,19 +303,26 @@ int amd_sfh_hid_client_init(struct amd_mp2_dev *privdata)
+ cl_data->sensor_sts[i]);
+ goto cleanup;
+ }
++ } else {
++ cl_data->sensor_sts[i] = SENSOR_DISABLED;
++ dev_dbg(dev, "sid 0x%x (%s) status 0x%x\n",
++ cl_data->sensor_idx[i],
++ get_sensor_name(cl_data->sensor_idx[i]),
++ cl_data->sensor_sts[i]);
+ }
+ dev_dbg(dev, "sid 0x%x (%s) status 0x%x\n",
+ cl_data->sensor_idx[i], get_sensor_name(cl_data->sensor_idx[i]),
+ cl_data->sensor_sts[i]);
+ }
+- if (mp2_ops->discovery_status && mp2_ops->discovery_status(privdata) == 0) {
++ if (!cl_data->is_any_sensor_enabled ||
++ (mp2_ops->discovery_status && mp2_ops->discovery_status(privdata) == 0)) {
+ amd_sfh_hid_client_deinit(privdata);
+ for (i = 0; i < cl_data->num_hid_devices; i++) {
+ devm_kfree(dev, cl_data->feature_report[i]);
+ devm_kfree(dev, in_data->input_report[i]);
+ devm_kfree(dev, cl_data->report_descr[i]);
+ }
+- dev_warn(dev, "Failed to discover, sensors not enabled\n");
++ dev_warn(dev, "Failed to discover, sensors not enabled is %d\n", cl_data->is_any_sensor_enabled);
+ return -EOPNOTSUPP;
+ }
+ schedule_delayed_work(&cl_data->work_buffer, msecs_to_jiffies(AMD_SFH_IDLE_LOOP));
+diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_hid.h b/drivers/hid/amd-sfh-hid/amd_sfh_hid.h
+index 3754fb423e3ae..528036892c9d2 100644
+--- a/drivers/hid/amd-sfh-hid/amd_sfh_hid.h
++++ b/drivers/hid/amd-sfh-hid/amd_sfh_hid.h
+@@ -32,6 +32,7 @@ struct amd_input_data {
+ struct amdtp_cl_data {
+ u8 init_done;
+ u32 cur_hid_dev;
++ bool is_any_sensor_enabled;
+ u32 hid_dev_count;
+ u32 num_hid_devices;
+ struct device_info *hid_devices;
+--
+2.39.0
+
--- /dev/null
+From ab1677d618922bf7bc91f9bbc2a3349a43ddbee5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 13:16:02 -0500
+Subject: IB/hfi1: Restore allocated resources on failed copyout
+
+From: Dean Luick <dean.luick@cornelisnetworks.com>
+
+[ Upstream commit 6601fc0d15ffc20654e39486f9bef35567106d68 ]
+
+Fix a resource leak if an error occurs.
+
+Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL")
+Signed-off-by: Dean Luick <dean.luick@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Link: https://lore.kernel.org/r/167354736291.2132367.10894218740150168180.stgit@awfm-02.cornelisnetworks.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/file_ops.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
+index f5f9269fdc162..7c5d487ec9168 100644
+--- a/drivers/infiniband/hw/hfi1/file_ops.c
++++ b/drivers/infiniband/hw/hfi1/file_ops.c
+@@ -1318,12 +1318,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg,
+ addr = arg + offsetof(struct hfi1_tid_info, tidcnt);
+ if (copy_to_user((void __user *)addr, &tinfo.tidcnt,
+ sizeof(tinfo.tidcnt)))
+- return -EFAULT;
++ ret = -EFAULT;
+
+ addr = arg + offsetof(struct hfi1_tid_info, length);
+- if (copy_to_user((void __user *)addr, &tinfo.length,
++ if (!ret && copy_to_user((void __user *)addr, &tinfo.length,
+ sizeof(tinfo.length)))
+ ret = -EFAULT;
++
++ if (ret)
++ hfi1_user_exp_rcv_invalid(fd, &tinfo);
+ }
+
+ return ret;
+--
+2.39.0
+
--- /dev/null
+From d6ae3bc90af48744378496742ea469260edf4067 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 20:24:18 +0200
+Subject: IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
+
+From: Dragos Tatulea <dtatulea@nvidia.com>
+
+[ Upstream commit e632291a2dbce45a24cddeb5fe28fe71d724ba43 ]
+
+The cited commit creates child PKEY interfaces over netlink will
+multiple tx and rx queues, but some devices doesn't support more than 1
+tx and 1 rx queues. This causes to a crash when traffic is sent over the
+PKEY interface due to the parent having a single queue but the child
+having multiple queues.
+
+This patch fixes the number of queues to 1 for legacy IPoIB at the
+earliest possible point in time.
+
+BUG: kernel NULL pointer dereference, address: 000000000000036b
+PGD 0 P4D 0
+Oops: 0000 [#1] SMP
+CPU: 4 PID: 209665 Comm: python3 Not tainted 6.1.0_for_upstream_min_debug_2022_12_12_17_02 #1
+Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+RIP: 0010:kmem_cache_alloc+0xcb/0x450
+Code: ce 7e 49 8b 50 08 49 83 78 10 00 4d 8b 28 0f 84 cb 02 00 00 4d 85 ed 0f 84 c2 02 00 00 41 8b 44 24 28 48 8d 4a
+01 49 8b 3c 24 <49> 8b 5c 05 00 4c 89 e8 65 48 0f c7 0f 0f 94 c0 84 c0 74 b8 41 8b
+RSP: 0018:ffff88822acbbab8 EFLAGS: 00010202
+RAX: 0000000000000070 RBX: ffff8881c28e3e00 RCX: 00000000064f8dae
+RDX: 00000000064f8dad RSI: 0000000000000a20 RDI: 0000000000030d00
+RBP: 0000000000000a20 R08: ffff8882f5d30d00 R09: ffff888104032f40
+R10: ffff88810fade828 R11: 736f6d6570736575 R12: ffff88810081c000
+R13: 00000000000002fb R14: ffffffff817fc865 R15: 0000000000000000
+FS: 00007f9324ff9700(0000) GS:ffff8882f5d00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 000000000000036b CR3: 00000001125af004 CR4: 0000000000370ea0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ skb_clone+0x55/0xd0
+ ip6_finish_output2+0x3fe/0x690
+ ip6_finish_output+0xfa/0x310
+ ip6_send_skb+0x1e/0x60
+ udp_v6_send_skb+0x1e5/0x420
+ udpv6_sendmsg+0xb3c/0xe60
+ ? ip_mc_finish_output+0x180/0x180
+ ? __switch_to_asm+0x3a/0x60
+ ? __switch_to_asm+0x34/0x60
+ sock_sendmsg+0x33/0x40
+ __sys_sendto+0x103/0x160
+ ? _copy_to_user+0x21/0x30
+ ? kvm_clock_get_cycles+0xd/0x10
+ ? ktime_get_ts64+0x49/0xe0
+ __x64_sys_sendto+0x25/0x30
+ do_syscall_64+0x3d/0x90
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+RIP: 0033:0x7f9374f1ed14
+Code: 42 41 f8 ff 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b
+7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 68 41 f8 ff 48 8b
+RSP: 002b:00007f9324ff7bd0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
+RAX: ffffffffffffffda RBX: 00007f9324ff7cc8 RCX: 00007f9374f1ed14
+RDX: 00000000000002fb RSI: 00007f93000052f0 RDI: 0000000000000030
+RBP: 0000000000000000 R08: 00007f9324ff7d40 R09: 000000000000001c
+R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
+R13: 000000012a05f200 R14: 0000000000000001 R15: 00007f9374d57bdc
+ </TASK>
+
+Fixes: dbc94a0fb817 ("IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces")
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Link: https://lore.kernel.org/r/95eb6b74c7cf49fa46281f9d056d685c9fa11d38.1674584576.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index ac25fc80fb337..f10d4bcf87d27 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -2200,6 +2200,14 @@ int ipoib_intf_init(struct ib_device *hca, u32 port, const char *name,
+ rn->attach_mcast = ipoib_mcast_attach;
+ rn->detach_mcast = ipoib_mcast_detach;
+ rn->hca = hca;
++
++ rc = netif_set_real_num_tx_queues(dev, 1);
++ if (rc)
++ goto out;
++
++ rc = netif_set_real_num_rx_queues(dev, 1);
++ if (rc)
++ goto out;
+ }
+
+ priv->rn_ops = dev->netdev_ops;
+--
+2.39.0
+
--- /dev/null
+From b60b6feb4a578028e51514be4b8f0a3e6dc8f0b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 14:06:40 -0800
+Subject: ice: Do not use WQ_MEM_RECLAIM flag for workqueue
+
+From: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+
+[ Upstream commit 4d159f7884f78b1aacb99b4fc37d1e3cb1194e39 ]
+
+When both ice and the irdma driver are loaded, a warning in
+check_flush_dependency is being triggered. This is due to ice driver
+workqueue being allocated with the WQ_MEM_RECLAIM flag and the irdma one
+is not.
+
+According to kernel documentation, this flag should be set if the
+workqueue will be involved in the kernel's memory reclamation flow.
+Since it is not, there is no need for the ice driver's WQ to have this
+flag set so remove it.
+
+Example trace:
+
+[ +0.000004] workqueue: WQ_MEM_RECLAIM ice:ice_service_task [ice] is flushing !WQ_MEM_RECLAIM infiniband:0x0
+[ +0.000139] WARNING: CPU: 0 PID: 728 at kernel/workqueue.c:2632 check_flush_dependency+0x178/0x1a0
+[ +0.000011] Modules linked in: bonding tls xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_cha
+in_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc rfkill vfat fat intel_rapl_msr intel
+_rapl_common isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct1
+0dif_pclmul crc32_pclmul ghash_clmulni_intel rapl intel_cstate rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_
+core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_cm iw_cm iTCO_wdt iTCO_vendor_support ipmi_ssif irdma mei_me ib_uverbs
+ib_core intel_uncore joydev pcspkr i2c_i801 acpi_ipmi mei lpc_ich i2c_smbus intel_pch_thermal ioatdma ipmi_si acpi_power_meter
+acpi_pad xfs libcrc32c sd_mod t10_pi crc64_rocksoft crc64 sg ahci ixgbe libahci ice i40e igb crc32c_intel mdio i2c_algo_bit liba
+ta dca wmi dm_mirror dm_region_hash dm_log dm_mod ipmi_devintf ipmi_msghandler fuse
+[ +0.000161] [last unloaded: bonding]
+[ +0.000006] CPU: 0 PID: 728 Comm: kworker/0:2 Tainted: G S 6.2.0-rc2_next-queue-13jan-00458-gc20aabd57164 #1
+[ +0.000006] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020
+[ +0.000003] Workqueue: ice ice_service_task [ice]
+[ +0.000127] RIP: 0010:check_flush_dependency+0x178/0x1a0
+[ +0.000005] Code: 89 8e 02 01 e8 49 3d 40 00 49 8b 55 18 48 8d 8d d0 00 00 00 48 8d b3 d0 00 00 00 4d 89 e0 48 c7 c7 e0 3b 08
+9f e8 bb d3 07 01 <0f> 0b e9 be fe ff ff 80 3d 24 89 8e 02 00 0f 85 6b ff ff ff e9 06
+[ +0.000004] RSP: 0018:ffff88810a39f990 EFLAGS: 00010282
+[ +0.000005] RAX: 0000000000000000 RBX: ffff888141bc2400 RCX: 0000000000000000
+[ +0.000004] RDX: 0000000000000001 RSI: dffffc0000000000 RDI: ffffffffa1213a80
+[ +0.000003] RBP: ffff888194bf3400 R08: ffffed117b306112 R09: ffffed117b306112
+[ +0.000003] R10: ffff888bd983088b R11: ffffed117b306111 R12: 0000000000000000
+[ +0.000003] R13: ffff888111f84d00 R14: ffff88810a3943ac R15: ffff888194bf3400
+[ +0.000004] FS: 0000000000000000(0000) GS:ffff888bd9800000(0000) knlGS:0000000000000000
+[ +0.000003] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ +0.000003] CR2: 000056035b208b60 CR3: 000000017795e005 CR4: 00000000007706f0
+[ +0.000003] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ +0.000003] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ +0.000002] PKRU: 55555554
+[ +0.000003] Call Trace:
+[ +0.000002] <TASK>
+[ +0.000003] __flush_workqueue+0x203/0x840
+[ +0.000006] ? mutex_unlock+0x84/0xd0
+[ +0.000008] ? __pfx_mutex_unlock+0x10/0x10
+[ +0.000004] ? __pfx___flush_workqueue+0x10/0x10
+[ +0.000006] ? mutex_lock+0xa3/0xf0
+[ +0.000005] ib_cache_cleanup_one+0x39/0x190 [ib_core]
+[ +0.000174] __ib_unregister_device+0x84/0xf0 [ib_core]
+[ +0.000094] ib_unregister_device+0x25/0x30 [ib_core]
+[ +0.000093] irdma_ib_unregister_device+0x97/0xc0 [irdma]
+[ +0.000064] ? __pfx_irdma_ib_unregister_device+0x10/0x10 [irdma]
+[ +0.000059] ? up_write+0x5c/0x90
+[ +0.000005] irdma_remove+0x36/0x90 [irdma]
+[ +0.000062] auxiliary_bus_remove+0x32/0x50
+[ +0.000007] device_release_driver_internal+0xfa/0x1c0
+[ +0.000005] bus_remove_device+0x18a/0x260
+[ +0.000007] device_del+0x2e5/0x650
+[ +0.000005] ? __pfx_device_del+0x10/0x10
+[ +0.000003] ? mutex_unlock+0x84/0xd0
+[ +0.000004] ? __pfx_mutex_unlock+0x10/0x10
+[ +0.000004] ? _raw_spin_unlock+0x18/0x40
+[ +0.000005] ice_unplug_aux_dev+0x52/0x70 [ice]
+[ +0.000160] ice_service_task+0x1309/0x14f0 [ice]
+[ +0.000134] ? __pfx___schedule+0x10/0x10
+[ +0.000006] process_one_work+0x3b1/0x6c0
+[ +0.000008] worker_thread+0x69/0x670
+[ +0.000005] ? __kthread_parkme+0xec/0x110
+[ +0.000007] ? __pfx_worker_thread+0x10/0x10
+[ +0.000005] kthread+0x17f/0x1b0
+[ +0.000005] ? __pfx_kthread+0x10/0x10
+[ +0.000004] ret_from_fork+0x29/0x50
+[ +0.000009] </TASK>
+
+Fixes: 940b61af02f4 ("ice: Initialize PF and setup miscellaneous interrupt")
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Signed-off-by: Marcin Szycik <marcin.szycik@linux.intel.com>
+Tested-by: Jakub Andrysiak <jakub.andrysiak@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 1ac5f0018c7eb..333582dabba16 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -5518,7 +5518,7 @@ static int __init ice_module_init(void)
+ pr_info("%s\n", ice_driver_string);
+ pr_info("%s\n", ice_copyright);
+
+- ice_wq = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0, KBUILD_MODNAME);
++ ice_wq = alloc_workqueue("%s", 0, 0, KBUILD_MODNAME);
+ if (!ice_wq) {
+ pr_err("Failed to create workqueue\n");
+ return -ENOMEM;
+--
+2.39.0
+
--- /dev/null
+From 3cc0b1a4fb3f15904141e0f75f7ef754f4282fb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jan 2023 13:34:58 +0100
+Subject: ice: Fix disabling Rx VLAN filtering with port VLAN enabled
+
+From: Brett Creeley <brett.creeley@intel.com>
+
+[ Upstream commit c793f8ea15e312789b5b6b4a5e7b0b92315be5cb ]
+
+If the user turns on the vf-true-promiscuous-support flag, then Rx VLAN
+filtering will be disabled if the VF requests to enable promiscuous
+mode. When the VF is in a port VLAN, this is the incorrect behavior
+because it will allow the VF to receive traffic outside of its port VLAN
+domain. Fortunately this only resulted in the VF(s) receiving broadcast
+traffic outside of the VLAN domain because all of the VLAN promiscuous
+rules are based on the port VLAN ID. Fix this by setting the
+.disable_rx_filtering VLAN op to a no-op when a port VLAN is enabled on
+the VF.
+
+Also, make sure to make this fix for both Single VLAN Mode and Double
+VLAN Mode enabled devices.
+
+Fixes: c31af68a1b94 ("ice: Add outer_vlan_ops and VSI specific VLAN ops implementations")
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Signed-off-by: Karen Ostrowska <karen.ostrowska@intel.com>
+Tested-by: Marek Szlosek <marek.szlosek@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c b/drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c
+index 5ecc0ee9a78e0..b1ffb81893d48 100644
+--- a/drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c
++++ b/drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.c
+@@ -44,13 +44,17 @@ void ice_vf_vsi_init_vlan_ops(struct ice_vsi *vsi)
+
+ /* outer VLAN ops regardless of port VLAN config */
+ vlan_ops->add_vlan = ice_vsi_add_vlan;
+- vlan_ops->dis_rx_filtering = ice_vsi_dis_rx_vlan_filtering;
+ vlan_ops->ena_tx_filtering = ice_vsi_ena_tx_vlan_filtering;
+ vlan_ops->dis_tx_filtering = ice_vsi_dis_tx_vlan_filtering;
+
+ if (ice_vf_is_port_vlan_ena(vf)) {
+ /* setup outer VLAN ops */
+ vlan_ops->set_port_vlan = ice_vsi_set_outer_port_vlan;
++ /* all Rx traffic should be in the domain of the
++ * assigned port VLAN, so prevent disabling Rx VLAN
++ * filtering
++ */
++ vlan_ops->dis_rx_filtering = noop_vlan;
+ vlan_ops->ena_rx_filtering =
+ ice_vsi_ena_rx_vlan_filtering;
+
+@@ -63,6 +67,9 @@ void ice_vf_vsi_init_vlan_ops(struct ice_vsi *vsi)
+ vlan_ops->ena_insertion = ice_vsi_ena_inner_insertion;
+ vlan_ops->dis_insertion = ice_vsi_dis_inner_insertion;
+ } else {
++ vlan_ops->dis_rx_filtering =
++ ice_vsi_dis_rx_vlan_filtering;
++
+ if (!test_bit(ICE_FLAG_VF_VLAN_PRUNING, pf->flags))
+ vlan_ops->ena_rx_filtering = noop_vlan;
+ else
+@@ -96,7 +103,14 @@ void ice_vf_vsi_init_vlan_ops(struct ice_vsi *vsi)
+ vlan_ops->set_port_vlan = ice_vsi_set_inner_port_vlan;
+ vlan_ops->ena_rx_filtering =
+ ice_vsi_ena_rx_vlan_filtering;
++ /* all Rx traffic should be in the domain of the
++ * assigned port VLAN, so prevent disabling Rx VLAN
++ * filtering
++ */
++ vlan_ops->dis_rx_filtering = noop_vlan;
+ } else {
++ vlan_ops->dis_rx_filtering =
++ ice_vsi_dis_rx_vlan_filtering;
+ if (!test_bit(ICE_FLAG_VF_VLAN_PRUNING, pf->flags))
+ vlan_ops->ena_rx_filtering = noop_vlan;
+ else
+--
+2.39.0
+
--- /dev/null
+From 5a6b17372d87264e4868e93f2ca26ffdd81b4bf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Dec 2022 15:11:26 -0800
+Subject: ice: switch: fix potential memleak in ice_add_adv_recipe()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 4a606ce68426c88ff2563382b33cc34f3485fe57 ]
+
+When ice_add_special_words() fails, the 'rm' is not released, which will
+lead to a memory leak. Fix this up by going to 'err_unroll' label.
+
+Compile tested only.
+
+Fixes: 8b032a55c1bd ("ice: low level support for tunnels")
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Tested-by: Sujai Buvaneswaran <sujai.buvaneswaran@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_switch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c
+index 9b762f7972ce5..61f844d225123 100644
+--- a/drivers/net/ethernet/intel/ice/ice_switch.c
++++ b/drivers/net/ethernet/intel/ice/ice_switch.c
+@@ -5420,7 +5420,7 @@ ice_add_adv_recipe(struct ice_hw *hw, struct ice_adv_lkup_elem *lkups,
+ */
+ status = ice_add_special_words(rinfo, lkup_exts, ice_is_dvm_ena(hw));
+ if (status)
+- goto err_free_lkup_exts;
++ goto err_unroll;
+
+ /* Group match words into recipes using preferred recipe grouping
+ * criteria.
+--
+2.39.0
+
--- /dev/null
+From 28991e54911dd43612d3bca009354220d8dc9a17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 15:58:18 -0800
+Subject: igc: Add ndo_tx_timeout support
+
+From: Sasha Neftin <sasha.neftin@intel.com>
+
+[ Upstream commit 9b275176270efd18f2f4e328b32be1bad34c4c0d ]
+
+On some platforms, 100/1000/2500 speeds seem to have sometimes problems
+reporting false positive tx unit hang during stressful UDP traffic. Likely
+other Intel drivers introduce responses to a tx hang. Update the 'tx hang'
+comparator with the comparison of the head and tail of ring pointers and
+restore the tx_timeout_factor to the previous value (one).
+
+This can be test by using netperf or iperf3 applications.
+Example:
+iperf3 -s -p 5001
+iperf3 -c 192.168.0.2 --udp -p 5001 --time 600 -b 0
+
+netserver -p 16604
+netperf -H 192.168.0.2 -l 600 -p 16604 -t UDP_STREAM -- -m 64000
+
+Fixes: b27b8dc77b5e ("igc: Increase timeout value for Speed 100/1000/2500")
+Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Naama Meir <naamax.meir@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://lore.kernel.org/r/20230206235818.662384-1-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 25 +++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
+index 34db1c006b20a..3b5b36206c44b 100644
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -2942,7 +2942,9 @@ static bool igc_clean_tx_irq(struct igc_q_vector *q_vector, int napi_budget)
+ if (tx_buffer->next_to_watch &&
+ time_after(jiffies, tx_buffer->time_stamp +
+ (adapter->tx_timeout_factor * HZ)) &&
+- !(rd32(IGC_STATUS) & IGC_STATUS_TXOFF)) {
++ !(rd32(IGC_STATUS) & IGC_STATUS_TXOFF) &&
++ (rd32(IGC_TDH(tx_ring->reg_idx)) !=
++ readl(tx_ring->tail))) {
+ /* detected Tx unit hang */
+ netdev_err(tx_ring->netdev,
+ "Detected Tx Unit Hang\n"
+@@ -5068,6 +5070,24 @@ static int igc_change_mtu(struct net_device *netdev, int new_mtu)
+ return 0;
+ }
+
++/**
++ * igc_tx_timeout - Respond to a Tx Hang
++ * @netdev: network interface device structure
++ * @txqueue: queue number that timed out
++ **/
++static void igc_tx_timeout(struct net_device *netdev,
++ unsigned int __always_unused txqueue)
++{
++ struct igc_adapter *adapter = netdev_priv(netdev);
++ struct igc_hw *hw = &adapter->hw;
++
++ /* Do the reset outside of interrupt context */
++ adapter->tx_timeout_count++;
++ schedule_work(&adapter->reset_task);
++ wr32(IGC_EICS,
++ (adapter->eims_enable_mask & ~adapter->eims_other));
++}
++
+ /**
+ * igc_get_stats64 - Get System Network Statistics
+ * @netdev: network interface device structure
+@@ -5495,7 +5515,7 @@ static void igc_watchdog_task(struct work_struct *work)
+ case SPEED_100:
+ case SPEED_1000:
+ case SPEED_2500:
+- adapter->tx_timeout_factor = 7;
++ adapter->tx_timeout_factor = 1;
+ break;
+ }
+
+@@ -6313,6 +6333,7 @@ static const struct net_device_ops igc_netdev_ops = {
+ .ndo_set_rx_mode = igc_set_rx_mode,
+ .ndo_set_mac_address = igc_set_mac,
+ .ndo_change_mtu = igc_change_mtu,
++ .ndo_tx_timeout = igc_tx_timeout,
+ .ndo_get_stats64 = igc_get_stats64,
+ .ndo_fix_features = igc_fix_features,
+ .ndo_set_features = igc_set_features,
+--
+2.39.0
+
--- /dev/null
+From 45c4c6558539b9693c403dc1886f55414e5ef148 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 13:55:35 -0800
+Subject: ionic: clean interrupt before enabling queue to avoid credit race
+
+From: Neel Patel <neel.patel@amd.com>
+
+[ Upstream commit e8797a058466b60fc5a3291b92430c93ba90eaff ]
+
+Clear the interrupt credits before enabling the queue rather
+than after to be sure that the enabled queue starts at 0 and
+that we don't wipe away possible credits after enabling the
+queue.
+
+Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling")
+Signed-off-by: Neel Patel <neel.patel@amd.com>
+Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+index 19d4848df17df..147e23435c3d1 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -269,6 +269,7 @@ static int ionic_qcq_enable(struct ionic_qcq *qcq)
+ .oper = IONIC_Q_ENABLE,
+ },
+ };
++ int ret;
+
+ idev = &lif->ionic->idev;
+ dev = lif->ionic->dev;
+@@ -276,16 +277,24 @@ static int ionic_qcq_enable(struct ionic_qcq *qcq)
+ dev_dbg(dev, "q_enable.index %d q_enable.qtype %d\n",
+ ctx.cmd.q_control.index, ctx.cmd.q_control.type);
+
++ if (qcq->flags & IONIC_QCQ_F_INTR)
++ ionic_intr_clean(idev->intr_ctrl, qcq->intr.index);
++
++ ret = ionic_adminq_post_wait(lif, &ctx);
++ if (ret)
++ return ret;
++
++ if (qcq->napi.poll)
++ napi_enable(&qcq->napi);
++
+ if (qcq->flags & IONIC_QCQ_F_INTR) {
+ irq_set_affinity_hint(qcq->intr.vector,
+ &qcq->intr.affinity_mask);
+- napi_enable(&qcq->napi);
+- ionic_intr_clean(idev->intr_ctrl, qcq->intr.index);
+ ionic_intr_mask(idev->intr_ctrl, qcq->intr.index,
+ IONIC_INTR_MASK_CLEAR);
+ }
+
+- return ionic_adminq_post_wait(lif, &ctx);
++ return 0;
+ }
+
+ static int ionic_qcq_disable(struct ionic_lif *lif, struct ionic_qcq *qcq, int fw_err)
+--
+2.39.0
+
--- /dev/null
+From 217ad7d182e420fd7c4886a2c67b0dcc292db28e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 13:55:37 -0800
+Subject: ionic: missed doorbell workaround
+
+From: Allen Hubbe <allen.hubbe@amd.com>
+
+[ Upstream commit b69585bfceceeffda940906cabfdaee4b47bde92 ]
+
+In one version of the HW there is a remote possibility that it
+will miss the doorbell ring. This adds a bit of protection to
+be sure we don't stall a queue from a missed doorbell.
+
+Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling")
+Signed-off-by: Allen Hubbe <allen.hubbe@amd.com>
+Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/pensando/ionic/ionic_dev.c | 9 +-
+ .../net/ethernet/pensando/ionic/ionic_dev.h | 12 +++
+ .../net/ethernet/pensando/ionic/ionic_lif.c | 41 ++++++++-
+ .../net/ethernet/pensando/ionic/ionic_lif.h | 2 +
+ .../net/ethernet/pensando/ionic/ionic_main.c | 29 +++++++
+ .../net/ethernet/pensando/ionic/ionic_txrx.c | 87 ++++++++++++++++++-
+ 6 files changed, 176 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.c b/drivers/net/ethernet/pensando/ionic/ionic_dev.c
+index 9d0514cfeb5c2..344a3924627d4 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_dev.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.c
+@@ -694,9 +694,16 @@ void ionic_q_post(struct ionic_queue *q, bool ring_doorbell, ionic_desc_cb cb,
+ q->lif->index, q->name, q->hw_type, q->hw_index,
+ q->head_idx, ring_doorbell);
+
+- if (ring_doorbell)
++ if (ring_doorbell) {
+ ionic_dbell_ring(lif->kern_dbpage, q->hw_type,
+ q->dbval | q->head_idx);
++
++ q->dbell_jiffies = jiffies;
++
++ if (q_to_qcq(q)->napi_qcq)
++ mod_timer(&q_to_qcq(q)->napi_qcq->napi_deadline,
++ jiffies + IONIC_NAPI_DEADLINE);
++ }
+ }
+
+ static bool ionic_q_is_posted(struct ionic_queue *q, unsigned int pos)
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.h b/drivers/net/ethernet/pensando/ionic/ionic_dev.h
+index 563c302eb033d..ad8a2a4453b76 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_dev.h
++++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.h
+@@ -25,6 +25,12 @@
+ #define IONIC_DEV_INFO_REG_COUNT 32
+ #define IONIC_DEV_CMD_REG_COUNT 32
+
++#define IONIC_NAPI_DEADLINE (HZ / 200) /* 5ms */
++#define IONIC_ADMIN_DOORBELL_DEADLINE (HZ / 2) /* 500ms */
++#define IONIC_TX_DOORBELL_DEADLINE (HZ / 100) /* 10ms */
++#define IONIC_RX_MIN_DOORBELL_DEADLINE (HZ / 100) /* 10ms */
++#define IONIC_RX_MAX_DOORBELL_DEADLINE (HZ * 5) /* 5s */
++
+ struct ionic_dev_bar {
+ void __iomem *vaddr;
+ phys_addr_t bus_addr;
+@@ -214,6 +220,8 @@ struct ionic_queue {
+ struct ionic_lif *lif;
+ struct ionic_desc_info *info;
+ u64 dbval;
++ unsigned long dbell_deadline;
++ unsigned long dbell_jiffies;
+ u16 head_idx;
+ u16 tail_idx;
+ unsigned int index;
+@@ -358,4 +366,8 @@ void ionic_q_service(struct ionic_queue *q, struct ionic_cq_info *cq_info,
+ int ionic_heartbeat_check(struct ionic *ionic);
+ bool ionic_is_fw_running(struct ionic_dev *idev);
+
++bool ionic_adminq_poke_doorbell(struct ionic_queue *q);
++bool ionic_txq_poke_doorbell(struct ionic_queue *q);
++bool ionic_rxq_poke_doorbell(struct ionic_queue *q);
++
+ #endif /* _IONIC_DEV_H_ */
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+index 147e23435c3d1..159bfcc76498c 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -16,6 +16,7 @@
+
+ #include "ionic.h"
+ #include "ionic_bus.h"
++#include "ionic_dev.h"
+ #include "ionic_lif.h"
+ #include "ionic_txrx.h"
+ #include "ionic_ethtool.h"
+@@ -200,6 +201,13 @@ void ionic_link_status_check_request(struct ionic_lif *lif, bool can_sleep)
+ }
+ }
+
++static void ionic_napi_deadline(struct timer_list *timer)
++{
++ struct ionic_qcq *qcq = container_of(timer, struct ionic_qcq, napi_deadline);
++
++ napi_schedule(&qcq->napi);
++}
++
+ static irqreturn_t ionic_isr(int irq, void *data)
+ {
+ struct napi_struct *napi = data;
+@@ -325,6 +333,7 @@ static int ionic_qcq_disable(struct ionic_lif *lif, struct ionic_qcq *qcq, int f
+ synchronize_irq(qcq->intr.vector);
+ irq_set_affinity_hint(qcq->intr.vector, NULL);
+ napi_disable(&qcq->napi);
++ del_timer_sync(&qcq->napi_deadline);
+ }
+
+ /* If there was a previous fw communcation error, don't bother with
+@@ -460,6 +469,7 @@ static void ionic_link_qcq_interrupts(struct ionic_qcq *src_qcq,
+
+ n_qcq->intr.vector = src_qcq->intr.vector;
+ n_qcq->intr.index = src_qcq->intr.index;
++ n_qcq->napi_qcq = src_qcq->napi_qcq;
+ }
+
+ static int ionic_alloc_qcq_interrupt(struct ionic_lif *lif, struct ionic_qcq *qcq)
+@@ -782,8 +792,14 @@ static int ionic_lif_txq_init(struct ionic_lif *lif, struct ionic_qcq *qcq)
+ dev_dbg(dev, "txq->hw_type %d\n", q->hw_type);
+ dev_dbg(dev, "txq->hw_index %d\n", q->hw_index);
+
+- if (test_bit(IONIC_LIF_F_SPLIT_INTR, lif->state))
++ q->dbell_deadline = IONIC_TX_DOORBELL_DEADLINE;
++ q->dbell_jiffies = jiffies;
++
++ if (test_bit(IONIC_LIF_F_SPLIT_INTR, lif->state)) {
+ netif_napi_add(lif->netdev, &qcq->napi, ionic_tx_napi);
++ qcq->napi_qcq = qcq;
++ timer_setup(&qcq->napi_deadline, ionic_napi_deadline, 0);
++ }
+
+ qcq->flags |= IONIC_QCQ_F_INITED;
+
+@@ -837,11 +853,17 @@ static int ionic_lif_rxq_init(struct ionic_lif *lif, struct ionic_qcq *qcq)
+ dev_dbg(dev, "rxq->hw_type %d\n", q->hw_type);
+ dev_dbg(dev, "rxq->hw_index %d\n", q->hw_index);
+
++ q->dbell_deadline = IONIC_RX_MIN_DOORBELL_DEADLINE;
++ q->dbell_jiffies = jiffies;
++
+ if (test_bit(IONIC_LIF_F_SPLIT_INTR, lif->state))
+ netif_napi_add(lif->netdev, &qcq->napi, ionic_rx_napi);
+ else
+ netif_napi_add(lif->netdev, &qcq->napi, ionic_txrx_napi);
+
++ qcq->napi_qcq = qcq;
++ timer_setup(&qcq->napi_deadline, ionic_napi_deadline, 0);
++
+ qcq->flags |= IONIC_QCQ_F_INITED;
+
+ return 0;
+@@ -1159,6 +1181,7 @@ static int ionic_adminq_napi(struct napi_struct *napi, int budget)
+ struct ionic_dev *idev = &lif->ionic->idev;
+ unsigned long irqflags;
+ unsigned int flags = 0;
++ bool resched = false;
+ int rx_work = 0;
+ int tx_work = 0;
+ int n_work = 0;
+@@ -1196,6 +1219,16 @@ static int ionic_adminq_napi(struct napi_struct *napi, int budget)
+ ionic_intr_credits(idev->intr_ctrl, intr->index, credits, flags);
+ }
+
++ if (!a_work && ionic_adminq_poke_doorbell(&lif->adminqcq->q))
++ resched = true;
++ if (lif->hwstamp_rxq && !rx_work && ionic_rxq_poke_doorbell(&lif->hwstamp_rxq->q))
++ resched = true;
++ if (lif->hwstamp_txq && !tx_work && ionic_txq_poke_doorbell(&lif->hwstamp_txq->q))
++ resched = true;
++ if (resched)
++ mod_timer(&lif->adminqcq->napi_deadline,
++ jiffies + IONIC_NAPI_DEADLINE);
++
+ return work_done;
+ }
+
+@@ -3175,8 +3208,14 @@ static int ionic_lif_adminq_init(struct ionic_lif *lif)
+ dev_dbg(dev, "adminq->hw_type %d\n", q->hw_type);
+ dev_dbg(dev, "adminq->hw_index %d\n", q->hw_index);
+
++ q->dbell_deadline = IONIC_ADMIN_DOORBELL_DEADLINE;
++ q->dbell_jiffies = jiffies;
++
+ netif_napi_add(lif->netdev, &qcq->napi, ionic_adminq_napi);
+
++ qcq->napi_qcq = qcq;
++ timer_setup(&qcq->napi_deadline, ionic_napi_deadline, 0);
++
+ napi_enable(&qcq->napi);
+
+ if (qcq->flags & IONIC_QCQ_F_INTR)
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.h b/drivers/net/ethernet/pensando/ionic/ionic_lif.h
+index a53984bf35448..734519895614f 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.h
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.h
+@@ -74,8 +74,10 @@ struct ionic_qcq {
+ struct ionic_queue q;
+ struct ionic_cq cq;
+ struct ionic_intr_info intr;
++ struct timer_list napi_deadline;
+ struct napi_struct napi;
+ unsigned int flags;
++ struct ionic_qcq *napi_qcq;
+ struct dentry *dentry;
+ };
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+index 5456c2b15d9bd..79272f5f380c6 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+@@ -289,6 +289,35 @@ static void ionic_adminq_cb(struct ionic_queue *q,
+ complete_all(&ctx->work);
+ }
+
++bool ionic_adminq_poke_doorbell(struct ionic_queue *q)
++{
++ struct ionic_lif *lif = q->lif;
++ unsigned long now, then, dif;
++ unsigned long irqflags;
++
++ spin_lock_irqsave(&lif->adminq_lock, irqflags);
++
++ if (q->tail_idx == q->head_idx) {
++ spin_unlock_irqrestore(&lif->adminq_lock, irqflags);
++ return false;
++ }
++
++ now = READ_ONCE(jiffies);
++ then = q->dbell_jiffies;
++ dif = now - then;
++
++ if (dif > q->dbell_deadline) {
++ ionic_dbell_ring(q->lif->kern_dbpage, q->hw_type,
++ q->dbval | q->head_idx);
++
++ q->dbell_jiffies = now;
++ }
++
++ spin_unlock_irqrestore(&lif->adminq_lock, irqflags);
++
++ return true;
++}
++
+ int ionic_adminq_post(struct ionic_lif *lif, struct ionic_admin_ctx *ctx)
+ {
+ struct ionic_desc_info *desc_info;
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+index 7977de4d67b76..f8f5eb1307681 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+@@ -22,6 +22,67 @@ static inline void ionic_rxq_post(struct ionic_queue *q, bool ring_dbell,
+ ionic_q_post(q, ring_dbell, cb_func, cb_arg);
+ }
+
++bool ionic_txq_poke_doorbell(struct ionic_queue *q)
++{
++ unsigned long now, then, dif;
++ struct netdev_queue *netdev_txq;
++ struct net_device *netdev;
++
++ netdev = q->lif->netdev;
++ netdev_txq = netdev_get_tx_queue(netdev, q->index);
++
++ HARD_TX_LOCK(netdev, netdev_txq, smp_processor_id());
++
++ if (q->tail_idx == q->head_idx) {
++ HARD_TX_UNLOCK(netdev, netdev_txq);
++ return false;
++ }
++
++ now = READ_ONCE(jiffies);
++ then = q->dbell_jiffies;
++ dif = now - then;
++
++ if (dif > q->dbell_deadline) {
++ ionic_dbell_ring(q->lif->kern_dbpage, q->hw_type,
++ q->dbval | q->head_idx);
++
++ q->dbell_jiffies = now;
++ }
++
++ HARD_TX_UNLOCK(netdev, netdev_txq);
++
++ return true;
++}
++
++bool ionic_rxq_poke_doorbell(struct ionic_queue *q)
++{
++ unsigned long now, then, dif;
++
++ /* no lock, called from rx napi or txrx napi, nothing else can fill */
++
++ if (q->tail_idx == q->head_idx)
++ return false;
++
++ now = READ_ONCE(jiffies);
++ then = q->dbell_jiffies;
++ dif = now - then;
++
++ if (dif > q->dbell_deadline) {
++ ionic_dbell_ring(q->lif->kern_dbpage, q->hw_type,
++ q->dbval | q->head_idx);
++
++ q->dbell_jiffies = now;
++
++ dif = 2 * q->dbell_deadline;
++ if (dif > IONIC_RX_MAX_DOORBELL_DEADLINE)
++ dif = IONIC_RX_MAX_DOORBELL_DEADLINE;
++
++ q->dbell_deadline = dif;
++ }
++
++ return true;
++}
++
+ static inline struct netdev_queue *q_to_ndq(struct ionic_queue *q)
+ {
+ return netdev_get_tx_queue(q->lif->netdev, q->index);
+@@ -424,6 +485,12 @@ void ionic_rx_fill(struct ionic_queue *q)
+
+ ionic_dbell_ring(q->lif->kern_dbpage, q->hw_type,
+ q->dbval | q->head_idx);
++
++ q->dbell_deadline = IONIC_RX_MIN_DOORBELL_DEADLINE;
++ q->dbell_jiffies = jiffies;
++
++ mod_timer(&q_to_qcq(q)->napi_qcq->napi_deadline,
++ jiffies + IONIC_NAPI_DEADLINE);
+ }
+
+ void ionic_rx_empty(struct ionic_queue *q)
+@@ -511,6 +578,9 @@ int ionic_tx_napi(struct napi_struct *napi, int budget)
+ work_done, flags);
+ }
+
++ if (!work_done && ionic_txq_poke_doorbell(&qcq->q))
++ mod_timer(&qcq->napi_deadline, jiffies + IONIC_NAPI_DEADLINE);
++
+ return work_done;
+ }
+
+@@ -544,23 +614,29 @@ int ionic_rx_napi(struct napi_struct *napi, int budget)
+ work_done, flags);
+ }
+
++ if (!work_done && ionic_rxq_poke_doorbell(&qcq->q))
++ mod_timer(&qcq->napi_deadline, jiffies + IONIC_NAPI_DEADLINE);
++
+ return work_done;
+ }
+
+ int ionic_txrx_napi(struct napi_struct *napi, int budget)
+ {
+- struct ionic_qcq *qcq = napi_to_qcq(napi);
++ struct ionic_qcq *rxqcq = napi_to_qcq(napi);
+ struct ionic_cq *rxcq = napi_to_cq(napi);
+ unsigned int qi = rxcq->bound_q->index;
++ struct ionic_qcq *txqcq;
+ struct ionic_dev *idev;
+ struct ionic_lif *lif;
+ struct ionic_cq *txcq;
++ bool resched = false;
+ u32 rx_work_done = 0;
+ u32 tx_work_done = 0;
+ u32 flags = 0;
+
+ lif = rxcq->bound_q->lif;
+ idev = &lif->ionic->idev;
++ txqcq = lif->txqcqs[qi];
+ txcq = &lif->txqcqs[qi]->cq;
+
+ tx_work_done = ionic_cq_service(txcq, IONIC_TX_BUDGET_DEFAULT,
+@@ -572,7 +648,7 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget)
+ ionic_rx_fill(rxcq->bound_q);
+
+ if (rx_work_done < budget && napi_complete_done(napi, rx_work_done)) {
+- ionic_dim_update(qcq, 0);
++ ionic_dim_update(rxqcq, 0);
+ flags |= IONIC_INTR_CRED_UNMASK;
+ rxcq->bound_intr->rearm_count++;
+ }
+@@ -583,6 +659,13 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget)
+ tx_work_done + rx_work_done, flags);
+ }
+
++ if (!rx_work_done && ionic_rxq_poke_doorbell(&rxqcq->q))
++ resched = true;
++ if (!tx_work_done && ionic_txq_poke_doorbell(&txqcq->q))
++ resched = true;
++ if (resched)
++ mod_timer(&rxqcq->napi_deadline, jiffies + IONIC_NAPI_DEADLINE);
++
+ return rx_work_done;
+ }
+
+--
+2.39.0
+
--- /dev/null
+From ebd8346c49f37e2283b86fc3abf5a3fb43cd8965 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Oct 2022 07:37:44 -0700
+Subject: ionic: refactor use of ionic_rx_fill()
+
+From: Neel Patel <neel@pensando.io>
+
+[ Upstream commit e55f0f5befc26e2ba6bb8c1f945ea8e37ee0e334 ]
+
+The same pre-work code is used before each call to
+ionic_rx_fill(), so bring it in and make it a part of
+the routine.
+
+Signed-off-by: Neel Patel <neel@pensando.io>
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: b69585bfcece ("ionic: missed doorbell workaround")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/pensando/ionic/ionic_txrx.c | 23 ++++++++++---------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+index c03986bf26289..7977de4d67b76 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+@@ -348,16 +348,25 @@ void ionic_rx_fill(struct ionic_queue *q)
+ struct ionic_rxq_sg_desc *sg_desc;
+ struct ionic_rxq_sg_elem *sg_elem;
+ struct ionic_buf_info *buf_info;
++ unsigned int fill_threshold;
+ struct ionic_rxq_desc *desc;
+ unsigned int remain_len;
+ unsigned int frag_len;
+ unsigned int nfrags;
++ unsigned int n_fill;
+ unsigned int i, j;
+ unsigned int len;
+
++ n_fill = ionic_q_space_avail(q);
++
++ fill_threshold = min_t(unsigned int, IONIC_RX_FILL_THRESHOLD,
++ q->num_descs / IONIC_RX_FILL_DIV);
++ if (n_fill < fill_threshold)
++ return;
++
+ len = netdev->mtu + ETH_HLEN + VLAN_HLEN;
+
+- for (i = ionic_q_space_avail(q); i; i--) {
++ for (i = n_fill; i; i--) {
+ nfrags = 0;
+ remain_len = len;
+ desc_info = &q->info[q->head_idx];
+@@ -511,7 +520,6 @@ int ionic_rx_napi(struct napi_struct *napi, int budget)
+ struct ionic_cq *cq = napi_to_cq(napi);
+ struct ionic_dev *idev;
+ struct ionic_lif *lif;
+- u16 rx_fill_threshold;
+ u32 work_done = 0;
+ u32 flags = 0;
+
+@@ -521,10 +529,7 @@ int ionic_rx_napi(struct napi_struct *napi, int budget)
+ work_done = ionic_cq_service(cq, budget,
+ ionic_rx_service, NULL, NULL);
+
+- rx_fill_threshold = min_t(u16, IONIC_RX_FILL_THRESHOLD,
+- cq->num_descs / IONIC_RX_FILL_DIV);
+- if (work_done && ionic_q_space_avail(cq->bound_q) >= rx_fill_threshold)
+- ionic_rx_fill(cq->bound_q);
++ ionic_rx_fill(cq->bound_q);
+
+ if (work_done < budget && napi_complete_done(napi, work_done)) {
+ ionic_dim_update(qcq, IONIC_LIF_F_RX_DIM_INTR);
+@@ -550,7 +555,6 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget)
+ struct ionic_dev *idev;
+ struct ionic_lif *lif;
+ struct ionic_cq *txcq;
+- u16 rx_fill_threshold;
+ u32 rx_work_done = 0;
+ u32 tx_work_done = 0;
+ u32 flags = 0;
+@@ -565,10 +569,7 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget)
+ rx_work_done = ionic_cq_service(rxcq, budget,
+ ionic_rx_service, NULL, NULL);
+
+- rx_fill_threshold = min_t(u16, IONIC_RX_FILL_THRESHOLD,
+- rxcq->num_descs / IONIC_RX_FILL_DIV);
+- if (rx_work_done && ionic_q_space_avail(rxcq->bound_q) >= rx_fill_threshold)
+- ionic_rx_fill(rxcq->bound_q);
++ ionic_rx_fill(rxcq->bound_q);
+
+ if (rx_work_done < budget && napi_complete_done(napi, rx_work_done)) {
+ ionic_dim_update(qcq, 0);
+--
+2.39.0
+
--- /dev/null
+From def2930ac9498d148af320124be0ee04bb119668 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Feb 2023 16:07:13 +0200
+Subject: net: dsa: mt7530: don't change PVC_EG_TAG when CPU port becomes
+ VLAN-aware
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 0b6d6425103a676e2b6a81f3fd35d7ea4f9b90ec ]
+
+Frank reports that in a mt7530 setup where some ports are standalone and
+some are in a VLAN-aware bridge, 8021q uppers of the standalone ports
+lose their VLAN tag on xmit, as seen by the link partner.
+
+This seems to occur because once the other ports join the VLAN-aware
+bridge, mt7530_port_vlan_filtering() also calls
+mt7530_port_set_vlan_aware(ds, cpu_dp->index), and this affects the way
+that the switch processes the traffic of the standalone port.
+
+Relevant is the PVC_EG_TAG bit. The MT7530 documentation says about it:
+
+EG_TAG: Incoming Port Egress Tag VLAN Attribution
+0: disabled (system default)
+1: consistent (keep the original ingress tag attribute)
+
+My interpretation is that this setting applies on the ingress port, and
+"disabled" is basically the normal behavior, where the egress tag format
+of the packet (tagged or untagged) is decided by the VLAN table
+(MT7530_VLAN_EGRESS_UNTAG or MT7530_VLAN_EGRESS_TAG).
+
+But there is also an option of overriding the system default behavior,
+and for the egress tagging format of packets to be decided not by the
+VLAN table, but simply by copying the ingress tag format (if ingress was
+tagged, egress is tagged; if ingress was untagged, egress is untagged;
+aka "consistent). This is useful in 2 scenarios:
+
+- VLAN-unaware bridge ports will always encounter a miss in the VLAN
+ table. They should forward a packet as-is, though. So we use
+ "consistent" there. See commit e045124e9399 ("net: dsa: mt7530: fix
+ tagged frames pass-through in VLAN-unaware mode").
+
+- Traffic injected from the CPU port. The operating system is in god
+ mode; if it wants a packet to exit as VLAN-tagged, it sends it as
+ VLAN-tagged. Otherwise it sends it as VLAN-untagged*.
+
+*This is true only if we don't consider the bridge TX forwarding offload
+feature, which mt7530 doesn't support.
+
+So for now, make the CPU port always stay in "consistent" mode to allow
+software VLANs to be forwarded to their egress ports with the VLAN tag
+intact, and not stripped.
+
+Link: https://lore.kernel.org/netdev/trinity-e6294d28-636c-4c40-bb8b-b523521b00be-1674233135062@3c-app-gmx-bs36/
+Fixes: e045124e9399 ("net: dsa: mt7530: fix tagged frames pass-through in VLAN-unaware mode")
+Reported-by: Frank Wunderlich <frank-w@public-files.de>
+Tested-by: Frank Wunderlich <frank-w@public-files.de>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20230205140713.1609281-1-vladimir.oltean@nxp.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mt7530.c | 26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index e74c6b4061728..a884f6f6a8c2c 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -1309,14 +1309,26 @@ mt7530_port_set_vlan_aware(struct dsa_switch *ds, int port)
+ if (!priv->ports[port].pvid)
+ mt7530_rmw(priv, MT7530_PVC_P(port), ACC_FRM_MASK,
+ MT7530_VLAN_ACC_TAGGED);
+- }
+
+- /* Set the port as a user port which is to be able to recognize VID
+- * from incoming packets before fetching entry within the VLAN table.
+- */
+- mt7530_rmw(priv, MT7530_PVC_P(port), VLAN_ATTR_MASK | PVC_EG_TAG_MASK,
+- VLAN_ATTR(MT7530_VLAN_USER) |
+- PVC_EG_TAG(MT7530_VLAN_EG_DISABLED));
++ /* Set the port as a user port which is to be able to recognize
++ * VID from incoming packets before fetching entry within the
++ * VLAN table.
++ */
++ mt7530_rmw(priv, MT7530_PVC_P(port),
++ VLAN_ATTR_MASK | PVC_EG_TAG_MASK,
++ VLAN_ATTR(MT7530_VLAN_USER) |
++ PVC_EG_TAG(MT7530_VLAN_EG_DISABLED));
++ } else {
++ /* Also set CPU ports to the "user" VLAN port attribute, to
++ * allow VLAN classification, but keep the EG_TAG attribute as
++ * "consistent" (i.o.w. don't change its value) for packets
++ * received by the switch from the CPU, so that tagged packets
++ * are forwarded to user ports as tagged, and untagged as
++ * untagged.
++ */
++ mt7530_rmw(priv, MT7530_PVC_P(port), VLAN_ATTR_MASK,
++ VLAN_ATTR(MT7530_VLAN_USER));
++ }
+ }
+
+ static void
+--
+2.39.0
+
--- /dev/null
+From dc7ef86dc3252a81972cb2cb333841d2dc6560a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 22:47:03 +0200
+Subject: net: ethernet: mtk_eth_soc: fix wrong parameters order in
+ __xdp_rxq_info_reg()
+
+From: Tariq Toukan <tariqt@nvidia.com>
+
+[ Upstream commit c966153d120222cd4e85e1e1601584d7d4d91dcb ]
+
+Parameters 'queue_index' and 'napi_id' are passed in a swapped order.
+Fix it here.
+
+Fixes: 23233e577ef9 ("net: ethernet: mtk_eth_soc: rely on page_pool for single page buffers")
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index 9aa1892a609c7..53ee9dea66388 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1495,8 +1495,8 @@ static struct page_pool *mtk_create_page_pool(struct mtk_eth *eth,
+ if (IS_ERR(pp))
+ return pp;
+
+- err = __xdp_rxq_info_reg(xdp_q, ð->dummy_dev, eth->rx_napi.napi_id,
+- id, PAGE_SIZE);
++ err = __xdp_rxq_info_reg(xdp_q, ð->dummy_dev, id,
++ eth->rx_napi.napi_id, PAGE_SIZE);
+ if (err < 0)
+ goto err_free_pp;
+
+--
+2.39.0
+
--- /dev/null
+From 5005767028535c1f809e54743f4c1b669cc2a71a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 17:56:19 +0530
+Subject: net: macb: Perform zynqmp dynamic configuration only for SGMII
+ interface
+
+From: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+
+[ Upstream commit c9011b028e956c3b6baa6f131d9eec43e4e52020 ]
+
+In zynqmp platforms where firmware supports dynamic SGMII configuration
+but has other non-SGMII ethernet devices, it fails them with no packets
+received at the RX interface.
+
+To fix this behaviour perform SGMII dynamic configuration only
+for the SGMII phy interface.
+
+Fixes: 32cee7818111 ("net: macb: Add zynqmp SGMII dynamic configuration support")
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Reported-by: Michal Simek <michal.simek@amd.com>
+Tested-by: Michal Simek <michal.simek@amd.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/1675340779-27499-1-git-send-email-radhey.shyam.pandey@amd.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 31 ++++++++++++------------
+ 1 file changed, 16 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 300f47ca42e3e..e255780f3867c 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -4614,25 +4614,26 @@ static int init_reset_optional(struct platform_device *pdev)
+ if (ret)
+ return dev_err_probe(&pdev->dev, ret,
+ "failed to init SGMII PHY\n");
+- }
+
+- ret = zynqmp_pm_is_function_supported(PM_IOCTL, IOCTL_SET_GEM_CONFIG);
+- if (!ret) {
+- u32 pm_info[2];
++ ret = zynqmp_pm_is_function_supported(PM_IOCTL, IOCTL_SET_GEM_CONFIG);
++ if (!ret) {
++ u32 pm_info[2];
++
++ ret = of_property_read_u32_array(pdev->dev.of_node, "power-domains",
++ pm_info, ARRAY_SIZE(pm_info));
++ if (ret) {
++ dev_err(&pdev->dev, "Failed to read power management information\n");
++ goto err_out_phy_exit;
++ }
++ ret = zynqmp_pm_set_gem_config(pm_info[1], GEM_CONFIG_FIXED, 0);
++ if (ret)
++ goto err_out_phy_exit;
+
+- ret = of_property_read_u32_array(pdev->dev.of_node, "power-domains",
+- pm_info, ARRAY_SIZE(pm_info));
+- if (ret) {
+- dev_err(&pdev->dev, "Failed to read power management information\n");
+- goto err_out_phy_exit;
++ ret = zynqmp_pm_set_gem_config(pm_info[1], GEM_CONFIG_SGMII_MODE, 1);
++ if (ret)
++ goto err_out_phy_exit;
+ }
+- ret = zynqmp_pm_set_gem_config(pm_info[1], GEM_CONFIG_FIXED, 0);
+- if (ret)
+- goto err_out_phy_exit;
+
+- ret = zynqmp_pm_set_gem_config(pm_info[1], GEM_CONFIG_SGMII_MODE, 1);
+- if (ret)
+- goto err_out_phy_exit;
+ }
+
+ /* Fully reset controller at hardware level if mapped in device tree */
+--
+2.39.0
+
--- /dev/null
+From 87a124cc281475024c6e4d64a235ca4a282c894e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 09:55:57 +0100
+Subject: net: microchip: sparx5: fix PTP init/deinit not checking all ports
+
+From: Casper Andersson <casper.casan@gmail.com>
+
+[ Upstream commit d7d94b2612f5dc25d61dc7bf58aafe7b31f40191 ]
+
+Check all ports instead of just port_count ports. PTP init was only
+checking ports 0 to port_count. If the hardware ports are not mapped
+starting from 0 then they would be missed, e.g. if only ports 20-30 were
+mapped it would attempt to init ports 0-10, resulting in NULL pointers
+when attempting to timestamp. Now it will init all mapped ports.
+
+Fixes: 70dfe25cd866 ("net: sparx5: Update extraction/injection for timestamping")
+Signed-off-by: Casper Andersson <casper.casan@gmail.com>
+Reviewed-by: Horatiu Vultur <horatiu.vultur@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c b/drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c
+index 0ed1ea7727c54..69e76634f9aa8 100644
+--- a/drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c
++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c
+@@ -633,7 +633,7 @@ int sparx5_ptp_init(struct sparx5 *sparx5)
+ /* Enable master counters */
+ spx5_wr(PTP_PTP_DOM_CFG_PTP_ENA_SET(0x7), sparx5, PTP_PTP_DOM_CFG);
+
+- for (i = 0; i < sparx5->port_count; i++) {
++ for (i = 0; i < SPX5_PORTS; i++) {
+ port = sparx5->ports[i];
+ if (!port)
+ continue;
+@@ -649,7 +649,7 @@ void sparx5_ptp_deinit(struct sparx5 *sparx5)
+ struct sparx5_port *port;
+ int i;
+
+- for (i = 0; i < sparx5->port_count; i++) {
++ for (i = 0; i < SPX5_PORTS; i++) {
+ port = sparx5->ports[i];
+ if (!port)
+ continue;
+--
+2.39.0
+
--- /dev/null
+From 6f796b0b3b5e57a8739d0ccf8401a206504495d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 14:47:12 +0100
+Subject: net/mlx5: Bridge, fix ageing of peer FDB entries
+
+From: Vlad Buslov <vladbu@nvidia.com>
+
+[ Upstream commit da0c52426cd23f8728eff72c2b2d2a3eb6b451f5 ]
+
+SWITCHDEV_FDB_ADD_TO_BRIDGE event handler that updates FDB entry 'lastuse'
+field is only executed for eswitch that owns the entry. However, if peer
+entry processed packets at least once it will have hardware counter 'used'
+value greater than entry 'lastuse' from that point on, which will cause FDB
+entry not being aged out.
+
+Process the event on all eswitch instances.
+
+Fixes: ff9b7521468b ("net/mlx5: Bridge, support LAG")
+Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
+Reviewed-by: Maor Dickman <maord@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c | 4 ----
+ drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c | 2 +-
+ 2 files changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c
+index 8099a21e674c9..ce85b48d327da 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c
+@@ -438,10 +438,6 @@ static int mlx5_esw_bridge_switchdev_event(struct notifier_block *nb,
+
+ switch (event) {
+ case SWITCHDEV_FDB_ADD_TO_BRIDGE:
+- /* only handle the event on native eswtich of representor */
+- if (!mlx5_esw_bridge_is_local(dev, rep, esw))
+- break;
+-
+ fdb_info = container_of(info,
+ struct switchdev_notifier_fdb_info,
+ info);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
+index 4fbff7bcc1556..d0b2676c32145 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
+@@ -1715,7 +1715,7 @@ void mlx5_esw_bridge_fdb_update_used(struct net_device *dev, u16 vport_num, u16
+ struct mlx5_esw_bridge *bridge;
+
+ port = mlx5_esw_bridge_port_lookup(vport_num, esw_owner_vhca_id, br_offloads);
+- if (!port || port->flags & MLX5_ESW_BRIDGE_PORT_FLAG_PEER)
++ if (!port)
+ return;
+
+ bridge = port->bridge;
+--
+2.39.0
+
--- /dev/null
+From 775b5d7c5aa3ab42ed67d1400df90aaf2b755c23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Jan 2023 23:24:56 +0200
+Subject: net/mlx5: Expose SF firmware pages counter
+
+From: Maher Sanalla <msanalla@nvidia.com>
+
+[ Upstream commit 9965bbebae59b3563a4d95e4aed121e8965dfdc2 ]
+
+Currently, each core device has VF pages counter which stores number of
+fw pages used by its VFs and SFs.
+
+The current design led to a hang when performing firmware reset on DPU,
+where the DPU PFs stalled in sriov unload flow due to waiting on release
+of SFs pages instead of waiting on only VFs pages.
+
+Thus, Add a separate counter for SF firmware pages, which will prevent
+the stall scenario described above.
+
+Fixes: 1958fc2f0712 ("net/mlx5: SF, Add auxiliary device driver")
+Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
+Reviewed-by: Shay Drory <shayd@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/debugfs.c | 1 +
+ drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 2 +-
+ include/linux/mlx5/driver.h | 1 +
+ 3 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c b/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c
+index c3e7c24a0971e..bb95b40d25eb5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c
+@@ -246,6 +246,7 @@ void mlx5_pages_debugfs_init(struct mlx5_core_dev *dev)
+
+ debugfs_create_u32("fw_pages_total", 0400, pages, &dev->priv.fw_pages);
+ debugfs_create_u32("fw_pages_vfs", 0400, pages, &dev->priv.page_counters[MLX5_VF]);
++ debugfs_create_u32("fw_pages_sfs", 0400, pages, &dev->priv.page_counters[MLX5_SF]);
+ debugfs_create_u32("fw_pages_host_pf", 0400, pages, &dev->priv.page_counters[MLX5_HOST_PF]);
+ debugfs_create_u32("fw_pages_alloc_failed", 0400, pages, &dev->priv.fw_pages_alloc_failed);
+ debugfs_create_u32("fw_pages_give_dropped", 0400, pages, &dev->priv.give_pages_dropped);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index 9f99292ab5ced..0eb50be175cc4 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -79,7 +79,7 @@ static u16 func_id_to_type(struct mlx5_core_dev *dev, u16 func_id, bool ec_funct
+ if (!func_id)
+ return mlx5_core_is_ecpf(dev) && !ec_function ? MLX5_HOST_PF : MLX5_PF;
+
+- return MLX5_VF;
++ return func_id <= mlx5_core_max_vfs(dev) ? MLX5_VF : MLX5_SF;
+ }
+
+ static struct rb_root *page_root_per_function(struct mlx5_core_dev *dev, u32 function)
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index 9b300aa4eb953..fff61e6d6d4de 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -576,6 +576,7 @@ struct mlx5_debugfs_entries {
+ enum mlx5_func_type {
+ MLX5_PF,
+ MLX5_VF,
++ MLX5_SF,
+ MLX5_HOST_PF,
+ MLX5_FUNC_TYPE_NUM,
+ };
+--
+2.39.0
+
--- /dev/null
+From 02967c7c276cb8a7d0b03dd350e26e2ea2a870c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 15:27:40 +0200
+Subject: net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit db561fed6b8fa3878e74d5df6512a4a38152b63e ]
+
+Whenever the driver is reading the string DBs into buffers, the driver
+is setting the load bit, but the driver never clears this bit.
+As a result, in case load bit is on and the driver query the device for
+new string DBs, the driver won't read again the string DBs.
+Fix it by clearing the load bit when query the device for new string
+DBs.
+
+Fixes: 2d69356752ff ("net/mlx5: Add support for fw live patch event")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+index 21831386b26e8..d82e98a0cdfa7 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+@@ -64,6 +64,7 @@ static int mlx5_query_mtrc_caps(struct mlx5_fw_tracer *tracer)
+ MLX5_GET(mtrc_cap, out, num_string_trace);
+ tracer->str_db.num_string_db = MLX5_GET(mtrc_cap, out, num_string_db);
+ tracer->owner = !!MLX5_GET(mtrc_cap, out, trace_owner);
++ tracer->str_db.loaded = false;
+
+ for (i = 0; i < tracer->str_db.num_string_db; i++) {
+ mtrc_cap_sp = MLX5_ADDR_OF(mtrc_cap, out, string_db_param[i]);
+--
+2.39.0
+
--- /dev/null
+From 24066a9529752bbe4b111d7bbfa9d3a82d4b4661 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 17:39:36 +0200
+Subject: net/mlx5: fw_tracer, Zero consumer index when reloading the tracer
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 184e1e4474dbcfebc4dbd1fa823a329978f25506 ]
+
+When tracer is reloaded, the device will log the traces at the
+beginning of the log buffer. Also, driver is reading the log buffer in
+chunks in accordance to the consumer index.
+Hence, zero consumer index when reloading the tracer.
+
+Fixes: 4383cfcc65e7 ("net/mlx5: Add devlink reload")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+index d82e98a0cdfa7..5b05b884b5fb3 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+@@ -757,6 +757,7 @@ static int mlx5_fw_tracer_set_mtrc_conf(struct mlx5_fw_tracer *tracer)
+ if (err)
+ mlx5_core_warn(dev, "FWTracer: Failed to set tracer configurations %d\n", err);
+
++ tracer->buff.consumer_index = 0;
+ return err;
+ }
+
+@@ -821,7 +822,6 @@ static void mlx5_fw_tracer_ownership_change(struct work_struct *work)
+ mlx5_core_dbg(tracer->dev, "FWTracer: ownership changed, current=(%d)\n", tracer->owner);
+ if (tracer->owner) {
+ tracer->owner = false;
+- tracer->buff.consumer_index = 0;
+ return;
+ }
+
+--
+2.39.0
+
--- /dev/null
+From d12d1405d83464b3edc55df6972e682dbfcb8568 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Dec 2022 22:16:23 +0200
+Subject: net/mlx5: Serialize module cleanup with reload and remove
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 8f0d1451ecf7b3bd5a06ffc866c753d0f3ab4683 ]
+
+Currently, remove and reload flows can run in parallel to module cleanup.
+This design is error prone. For example: aux_drivers callbacks are called
+from both cleanup and remove flows with different lockings, which can
+cause a deadlock[1].
+Hence, serialize module cleanup with reload and remove.
+
+[1]
+ cleanup remove
+ ------- ------
+ auxiliary_driver_unregister();
+ devl_lock()
+ auxiliary_device_delete(mlx5e_aux)
+ device_lock(mlx5e_aux)
+ devl_lock()
+ device_lock(mlx5e_aux)
+
+Fixes: 912cebf420c2 ("net/mlx5e: Connect ethernet part to auxiliary bus")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index d4db1adae3e3d..f07175549a87d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -2094,7 +2094,7 @@ static int __init mlx5_init(void)
+ mlx5_core_verify_params();
+ mlx5_register_debugfs();
+
+- err = pci_register_driver(&mlx5_core_driver);
++ err = mlx5e_init();
+ if (err)
+ goto err_debug;
+
+@@ -2102,16 +2102,16 @@ static int __init mlx5_init(void)
+ if (err)
+ goto err_sf;
+
+- err = mlx5e_init();
++ err = pci_register_driver(&mlx5_core_driver);
+ if (err)
+- goto err_en;
++ goto err_pci;
+
+ return 0;
+
+-err_en:
++err_pci:
+ mlx5_sf_driver_unregister();
+ err_sf:
+- pci_unregister_driver(&mlx5_core_driver);
++ mlx5e_cleanup();
+ err_debug:
+ mlx5_unregister_debugfs();
+ return err;
+@@ -2119,9 +2119,9 @@ static int __init mlx5_init(void)
+
+ static void __exit mlx5_cleanup(void)
+ {
+- mlx5e_cleanup();
+- mlx5_sf_driver_unregister();
+ pci_unregister_driver(&mlx5_core_driver);
++ mlx5_sf_driver_unregister();
++ mlx5e_cleanup();
+ mlx5_unregister_debugfs();
+ }
+
+--
+2.39.0
+
--- /dev/null
+From ed6bf3fd02c1f35aff845ab3e0eba7bbbed096b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Jan 2023 21:09:40 +0200
+Subject: net/mlx5: Store page counters in a single array
+
+From: Maher Sanalla <msanalla@nvidia.com>
+
+[ Upstream commit c3bdbaea654d8df39112de33037106134a520dc7 ]
+
+Currently, an independent page counter is used for tracking memory usage
+for each function type such as VF, PF and host PF (DPU).
+
+For better code-readibilty, use a single array that stores
+the number of allocated memory pages for each function type.
+
+Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
+Reviewed-by: Shay Drory <shayd@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Stable-dep-of: 9965bbebae59 ("net/mlx5: Expose SF firmware pages counter")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/debugfs.c | 4 +-
+ .../net/ethernet/mellanox/mlx5/core/ecpf.c | 2 +-
+ .../ethernet/mellanox/mlx5/core/pagealloc.c | 37 +++++++++++--------
+ .../net/ethernet/mellanox/mlx5/core/sriov.c | 2 +-
+ include/linux/mlx5/driver.h | 12 ++++--
+ 5 files changed, 34 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c b/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c
+index 3e232a65a0c3e..c3e7c24a0971e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c
+@@ -245,8 +245,8 @@ void mlx5_pages_debugfs_init(struct mlx5_core_dev *dev)
+ pages = dev->priv.dbg.pages_debugfs;
+
+ debugfs_create_u32("fw_pages_total", 0400, pages, &dev->priv.fw_pages);
+- debugfs_create_u32("fw_pages_vfs", 0400, pages, &dev->priv.vfs_pages);
+- debugfs_create_u32("fw_pages_host_pf", 0400, pages, &dev->priv.host_pf_pages);
++ debugfs_create_u32("fw_pages_vfs", 0400, pages, &dev->priv.page_counters[MLX5_VF]);
++ debugfs_create_u32("fw_pages_host_pf", 0400, pages, &dev->priv.page_counters[MLX5_HOST_PF]);
+ debugfs_create_u32("fw_pages_alloc_failed", 0400, pages, &dev->priv.fw_pages_alloc_failed);
+ debugfs_create_u32("fw_pages_give_dropped", 0400, pages, &dev->priv.give_pages_dropped);
+ debugfs_create_u32("fw_pages_reclaim_discard", 0400, pages,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ecpf.c b/drivers/net/ethernet/mellanox/mlx5/core/ecpf.c
+index 464eb3a184506..cdc87ecae5d39 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/ecpf.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/ecpf.c
+@@ -87,7 +87,7 @@ void mlx5_ec_cleanup(struct mlx5_core_dev *dev)
+
+ mlx5_host_pf_cleanup(dev);
+
+- err = mlx5_wait_for_pages(dev, &dev->priv.host_pf_pages);
++ err = mlx5_wait_for_pages(dev, &dev->priv.page_counters[MLX5_HOST_PF]);
+ if (err)
+ mlx5_core_warn(dev, "Timeout reclaiming external host PF pages err(%d)\n", err);
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index 60596357bfc7a..9f99292ab5ced 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -74,6 +74,14 @@ static u32 get_function(u16 func_id, bool ec_function)
+ return (u32)func_id | (ec_function << 16);
+ }
+
++static u16 func_id_to_type(struct mlx5_core_dev *dev, u16 func_id, bool ec_function)
++{
++ if (!func_id)
++ return mlx5_core_is_ecpf(dev) && !ec_function ? MLX5_HOST_PF : MLX5_PF;
++
++ return MLX5_VF;
++}
++
+ static struct rb_root *page_root_per_function(struct mlx5_core_dev *dev, u32 function)
+ {
+ struct rb_root *root;
+@@ -332,6 +340,7 @@ static int give_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
+ u32 out[MLX5_ST_SZ_DW(manage_pages_out)] = {0};
+ int inlen = MLX5_ST_SZ_BYTES(manage_pages_in);
+ int notify_fail = event;
++ u16 func_type;
+ u64 addr;
+ int err;
+ u32 *in;
+@@ -383,11 +392,9 @@ static int give_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
+ goto out_dropped;
+ }
+
++ func_type = func_id_to_type(dev, func_id, ec_function);
++ dev->priv.page_counters[func_type] += npages;
+ dev->priv.fw_pages += npages;
+- if (func_id)
+- dev->priv.vfs_pages += npages;
+- else if (mlx5_core_is_ecpf(dev) && !ec_function)
+- dev->priv.host_pf_pages += npages;
+
+ mlx5_core_dbg(dev, "npages %d, ec_function %d, func_id 0x%x, err %d\n",
+ npages, ec_function, func_id, err);
+@@ -414,6 +421,7 @@ static void release_all_pages(struct mlx5_core_dev *dev, u16 func_id,
+ struct rb_root *root;
+ struct rb_node *p;
+ int npages = 0;
++ u16 func_type;
+
+ root = xa_load(&dev->priv.page_root_xa, function);
+ if (WARN_ON_ONCE(!root))
+@@ -428,11 +436,9 @@ static void release_all_pages(struct mlx5_core_dev *dev, u16 func_id,
+ free_fwp(dev, fwp, fwp->free_count);
+ }
+
++ func_type = func_id_to_type(dev, func_id, ec_function);
++ dev->priv.page_counters[func_type] -= npages;
+ dev->priv.fw_pages -= npages;
+- if (func_id)
+- dev->priv.vfs_pages -= npages;
+- else if (mlx5_core_is_ecpf(dev) && !ec_function)
+- dev->priv.host_pf_pages -= npages;
+
+ mlx5_core_dbg(dev, "npages %d, ec_function %d, func_id 0x%x\n",
+ npages, ec_function, func_id);
+@@ -498,6 +504,7 @@ static int reclaim_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
+ int outlen = MLX5_ST_SZ_BYTES(manage_pages_out);
+ u32 in[MLX5_ST_SZ_DW(manage_pages_in)] = {};
+ int num_claimed;
++ u16 func_type;
+ u32 *out;
+ int err;
+ int i;
+@@ -549,11 +556,9 @@ static int reclaim_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
+ if (nclaimed)
+ *nclaimed = num_claimed;
+
++ func_type = func_id_to_type(dev, func_id, ec_function);
++ dev->priv.page_counters[func_type] -= num_claimed;
+ dev->priv.fw_pages -= num_claimed;
+- if (func_id)
+- dev->priv.vfs_pages -= num_claimed;
+- else if (mlx5_core_is_ecpf(dev) && !ec_function)
+- dev->priv.host_pf_pages -= num_claimed;
+
+ out_free:
+ kvfree(out);
+@@ -706,12 +711,12 @@ int mlx5_reclaim_startup_pages(struct mlx5_core_dev *dev)
+ WARN(dev->priv.fw_pages,
+ "FW pages counter is %d after reclaiming all pages\n",
+ dev->priv.fw_pages);
+- WARN(dev->priv.vfs_pages,
++ WARN(dev->priv.page_counters[MLX5_VF],
+ "VFs FW pages counter is %d after reclaiming all pages\n",
+- dev->priv.vfs_pages);
+- WARN(dev->priv.host_pf_pages,
++ dev->priv.page_counters[MLX5_VF]);
++ WARN(dev->priv.page_counters[MLX5_HOST_PF],
+ "External host PF FW pages counter is %d after reclaiming all pages\n",
+- dev->priv.host_pf_pages);
++ dev->priv.page_counters[MLX5_HOST_PF]);
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
+index c0e6c487c63c1..3008e9ce2bbff 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
+@@ -147,7 +147,7 @@ mlx5_device_disable_sriov(struct mlx5_core_dev *dev, int num_vfs, bool clear_vf)
+
+ mlx5_eswitch_disable_sriov(dev->priv.eswitch, clear_vf);
+
+- if (mlx5_wait_for_pages(dev, &dev->priv.vfs_pages))
++ if (mlx5_wait_for_pages(dev, &dev->priv.page_counters[MLX5_VF]))
+ mlx5_core_warn(dev, "timeout reclaiming VFs pages\n");
+ }
+
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index ad55470a9fb97..9b300aa4eb953 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -573,6 +573,13 @@ struct mlx5_debugfs_entries {
+ struct dentry *lag_debugfs;
+ };
+
++enum mlx5_func_type {
++ MLX5_PF,
++ MLX5_VF,
++ MLX5_HOST_PF,
++ MLX5_FUNC_TYPE_NUM,
++};
++
+ struct mlx5_ft_pool;
+ struct mlx5_priv {
+ /* IRQ table valid only for real pci devices PF or VF */
+@@ -583,11 +590,10 @@ struct mlx5_priv {
+ struct mlx5_nb pg_nb;
+ struct workqueue_struct *pg_wq;
+ struct xarray page_root_xa;
+- u32 fw_pages;
+ atomic_t reg_pages;
+ struct list_head free_list;
+- u32 vfs_pages;
+- u32 host_pf_pages;
++ u32 fw_pages;
++ u32 page_counters[MLX5_FUNC_TYPE_NUM];
+ u32 fw_pages_alloc_failed;
+ u32 give_pages_dropped;
+ u32 reclaim_pages_discard;
+--
+2.39.0
+
--- /dev/null
+From c3ae4af166bda2268f74db9ee6d612daaf3347e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Jan 2023 15:54:46 +0200
+Subject: net/mlx5e: Fix crash unsetting rx-vlan-filter in switchdev mode
+
+From: Amir Tzin <amirtz@nvidia.com>
+
+[ Upstream commit 8974aa9638df557f4642acef707af15648a03555 ]
+
+Moving to switchdev mode with rx-vlan-filter on and then setting it off
+causes the kernel to crash since fs->vlan is freed during nic profile
+cleanup flow.
+
+RX VLAN filtering is not supported in switchdev mode so unset it when
+changing to switchdev and restore its value when switching back to
+legacy.
+
+trace:
+[] RIP: 0010:mlx5e_disable_cvlan_filter+0x43/0x70
+[] set_feature_cvlan_filter+0x37/0x40 [mlx5_core]
+[] mlx5e_handle_feature+0x3a/0x60 [mlx5_core]
+[] mlx5e_set_features+0x6d/0x160 [mlx5_core]
+[] __netdev_update_features+0x288/0xa70
+[] ethnl_set_features+0x309/0x380
+[] ? __nla_parse+0x21/0x30
+[] genl_family_rcv_msg_doit.isra.17+0x110/0x150
+[] genl_rcv_msg+0x112/0x260
+[] ? features_reply_size+0xe0/0xe0
+[] ? genl_family_rcv_msg_doit.isra.17+0x150/0x150
+[] netlink_rcv_skb+0x4e/0x100
+[] genl_rcv+0x24/0x40
+[] netlink_unicast+0x1ab/0x290
+[] netlink_sendmsg+0x257/0x4f0
+[] sock_sendmsg+0x5c/0x70
+
+Fixes: cb67b832921c ("net/mlx5e: Introduce SRIOV VF representors")
+Signed-off-by: Amir Tzin <amirtz@nvidia.com>
+Reviewed-by: Maor Dickman <maord@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 2 +-
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ++++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+index 1892ccb889b3f..7cd36f4ac3efc 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+@@ -443,7 +443,7 @@ void mlx5e_enable_cvlan_filter(struct mlx5e_flow_steering *fs, bool promisc)
+
+ void mlx5e_disable_cvlan_filter(struct mlx5e_flow_steering *fs, bool promisc)
+ {
+- if (fs->vlan->cvlan_filter_disabled)
++ if (!fs->vlan || fs->vlan->cvlan_filter_disabled)
+ return;
+
+ fs->vlan->cvlan_filter_disabled = true;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 3e0d910b085d4..142ed2d98cd5d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -4005,6 +4005,10 @@ static netdev_features_t mlx5e_fix_uplink_rep_features(struct net_device *netdev
+ if (netdev->features & NETIF_F_GRO_HW)
+ netdev_warn(netdev, "Disabling HW_GRO, not supported in switchdev mode\n");
+
++ features &= ~NETIF_F_HW_VLAN_CTAG_FILTER;
++ if (netdev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
++ netdev_warn(netdev, "Disabling HW_VLAN CTAG FILTERING, not supported in switchdev mode\n");
++
+ return features;
+ }
+
+--
+2.39.0
+
--- /dev/null
+From 4e86cca756020b1ab4545fd95aeccafb80adbc33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 16:06:32 +0200
+Subject: net/mlx5e: IPoIB, Show unknown speed instead of error
+
+From: Dragos Tatulea <dtatulea@nvidia.com>
+
+[ Upstream commit 8aa5f171d51c1cb69e5e3106df4dd1a446102823 ]
+
+ethtool is returning an error for unknown speeds for the IPoIB interface:
+
+$ ethtool ib0
+netlink error: failed to retrieve link settings
+netlink error: Invalid argument
+netlink error: failed to retrieve link settings
+netlink error: Invalid argument
+Settings for ib0:
+Link detected: no
+
+After this change, ethtool will return success and show "unknown speed":
+
+$ ethtool ib0
+Settings for ib0:
+Supported ports: [ ]
+Supported link modes: Not reported
+Supported pause frame use: No
+Supports auto-negotiation: No
+Supported FEC modes: Not reported
+Advertised link modes: Not reported
+Advertised pause frame use: No
+Advertised auto-negotiation: No
+Advertised FEC modes: Not reported
+Speed: Unknown!
+Duplex: Full
+Auto-negotiation: off
+Port: Other
+PHYAD: 0
+Transceiver: internal
+Link detected: no
+
+Fixes: eb234ee9d541 ("net/mlx5e: IPoIB, Add support for get_link_ksettings in ethtool")
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Gal Pressman <gal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c
+index eff92dc0927c1..e09518f887a04 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c
+@@ -189,16 +189,16 @@ static inline int mlx5_ptys_rate_enum_to_int(enum mlx5_ptys_rate rate)
+ }
+ }
+
+-static int mlx5i_get_speed_settings(u16 ib_link_width_oper, u16 ib_proto_oper)
++static u32 mlx5i_get_speed_settings(u16 ib_link_width_oper, u16 ib_proto_oper)
+ {
+ int rate, width;
+
+ rate = mlx5_ptys_rate_enum_to_int(ib_proto_oper);
+ if (rate < 0)
+- return -EINVAL;
++ return SPEED_UNKNOWN;
+ width = mlx5_ptys_width_enum_to_int(ib_link_width_oper);
+ if (width < 0)
+- return -EINVAL;
++ return SPEED_UNKNOWN;
+
+ return rate * width;
+ }
+@@ -221,16 +221,13 @@ static int mlx5i_get_link_ksettings(struct net_device *netdev,
+ ethtool_link_ksettings_zero_link_mode(link_ksettings, advertising);
+
+ speed = mlx5i_get_speed_settings(ib_link_width_oper, ib_proto_oper);
+- if (speed < 0)
+- return -EINVAL;
++ link_ksettings->base.speed = speed;
++ link_ksettings->base.duplex = speed == SPEED_UNKNOWN ? DUPLEX_UNKNOWN : DUPLEX_FULL;
+
+- link_ksettings->base.duplex = DUPLEX_FULL;
+ link_ksettings->base.port = PORT_OTHER;
+
+ link_ksettings->base.autoneg = AUTONEG_DISABLE;
+
+- link_ksettings->base.speed = speed;
+-
+ return 0;
+ }
+
+--
+2.39.0
+
--- /dev/null
+From 2e89c1e6018ef64e1d9389e79640e92d9a0f3833 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Jan 2023 18:09:32 +0200
+Subject: net/mlx5e: Update rx ring hw mtu upon each rx-fcs flag change
+
+From: Adham Faris <afaris@nvidia.com>
+
+[ Upstream commit 1e66220948df815d7b37e0ff8b4627ce10433738 ]
+
+rq->hw_mtu is used in function en_rx.c/mlx5e_skb_from_cqe_mpwrq_linear()
+to catch oversized packets. If FCS is concatenated to the end of the
+packet then the check should be updated accordingly.
+
+Rx rings initialization (mlx5e_init_rxq_rq()) invoked for every new set
+of channels, as part of mlx5e_safe_switch_params(), unknowingly if it
+runs with default configuration or not. Current rq->hw_mtu
+initialization assumes default configuration and ignores
+params->scatter_fcs_en flag state.
+Fix this, by accounting for params->scatter_fcs_en flag state during
+rq->hw_mtu initialization.
+
+In addition, updating rq->hw_mtu value during ingress traffic might
+lead to packets drop and oversize_pkts_sw_drop counter increase with no
+good reason. Hence we remove this optimization and switch the set of
+channels with a new one, to make sure we don't get false positives on
+the oversize_pkts_sw_drop counter.
+
+Fixes: 102722fc6832 ("net/mlx5e: Add support for RXFCS feature flag")
+Signed-off-by: Adham Faris <afaris@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 86 ++++---------------
+ 1 file changed, 15 insertions(+), 71 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 4dc149ef618c4..3e0d910b085d4 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -591,7 +591,8 @@ static int mlx5e_init_rxq_rq(struct mlx5e_channel *c, struct mlx5e_params *param
+ rq->ix = c->ix;
+ rq->channel = c;
+ rq->mdev = mdev;
+- rq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu);
++ rq->hw_mtu =
++ MLX5E_SW2HW_MTU(params, params->sw_mtu) - ETH_FCS_LEN * !params->scatter_fcs_en;
+ rq->xdpsq = &c->rq_xdpsq;
+ rq->stats = &c->priv->channel_stats[c->ix]->rq;
+ rq->ptp_cyc2time = mlx5_rq_ts_translator(mdev);
+@@ -1014,35 +1015,6 @@ int mlx5e_flush_rq(struct mlx5e_rq *rq, int curr_state)
+ return mlx5e_rq_to_ready(rq, curr_state);
+ }
+
+-static int mlx5e_modify_rq_scatter_fcs(struct mlx5e_rq *rq, bool enable)
+-{
+- struct mlx5_core_dev *mdev = rq->mdev;
+-
+- void *in;
+- void *rqc;
+- int inlen;
+- int err;
+-
+- inlen = MLX5_ST_SZ_BYTES(modify_rq_in);
+- in = kvzalloc(inlen, GFP_KERNEL);
+- if (!in)
+- return -ENOMEM;
+-
+- rqc = MLX5_ADDR_OF(modify_rq_in, in, ctx);
+-
+- MLX5_SET(modify_rq_in, in, rq_state, MLX5_RQC_STATE_RDY);
+- MLX5_SET64(modify_rq_in, in, modify_bitmask,
+- MLX5_MODIFY_RQ_IN_MODIFY_BITMASK_SCATTER_FCS);
+- MLX5_SET(rqc, rqc, scatter_fcs, enable);
+- MLX5_SET(rqc, rqc, state, MLX5_RQC_STATE_RDY);
+-
+- err = mlx5_core_modify_rq(mdev, rq->rqn, in);
+-
+- kvfree(in);
+-
+- return err;
+-}
+-
+ static int mlx5e_modify_rq_vsd(struct mlx5e_rq *rq, bool vsd)
+ {
+ struct mlx5_core_dev *mdev = rq->mdev;
+@@ -3301,20 +3273,6 @@ static void mlx5e_cleanup_nic_tx(struct mlx5e_priv *priv)
+ mlx5e_destroy_tises(priv);
+ }
+
+-static int mlx5e_modify_channels_scatter_fcs(struct mlx5e_channels *chs, bool enable)
+-{
+- int err = 0;
+- int i;
+-
+- for (i = 0; i < chs->num; i++) {
+- err = mlx5e_modify_rq_scatter_fcs(&chs->c[i]->rq, enable);
+- if (err)
+- return err;
+- }
+-
+- return 0;
+-}
+-
+ static int mlx5e_modify_channels_vsd(struct mlx5e_channels *chs, bool vsd)
+ {
+ int err;
+@@ -3890,41 +3848,27 @@ static int mlx5e_set_rx_port_ts(struct mlx5_core_dev *mdev, bool enable)
+ return mlx5_set_ports_check(mdev, in, sizeof(in));
+ }
+
++static int mlx5e_set_rx_port_ts_wrap(struct mlx5e_priv *priv, void *ctx)
++{
++ struct mlx5_core_dev *mdev = priv->mdev;
++ bool enable = *(bool *)ctx;
++
++ return mlx5e_set_rx_port_ts(mdev, enable);
++}
++
+ static int set_feature_rx_fcs(struct net_device *netdev, bool enable)
+ {
+ struct mlx5e_priv *priv = netdev_priv(netdev);
+ struct mlx5e_channels *chs = &priv->channels;
+- struct mlx5_core_dev *mdev = priv->mdev;
++ struct mlx5e_params new_params;
+ int err;
+
+ mutex_lock(&priv->state_lock);
+
+- if (enable) {
+- err = mlx5e_set_rx_port_ts(mdev, false);
+- if (err)
+- goto out;
+-
+- chs->params.scatter_fcs_en = true;
+- err = mlx5e_modify_channels_scatter_fcs(chs, true);
+- if (err) {
+- chs->params.scatter_fcs_en = false;
+- mlx5e_set_rx_port_ts(mdev, true);
+- }
+- } else {
+- chs->params.scatter_fcs_en = false;
+- err = mlx5e_modify_channels_scatter_fcs(chs, false);
+- if (err) {
+- chs->params.scatter_fcs_en = true;
+- goto out;
+- }
+- err = mlx5e_set_rx_port_ts(mdev, true);
+- if (err) {
+- mlx5_core_warn(mdev, "Failed to set RX port timestamp %d\n", err);
+- err = 0;
+- }
+- }
+-
+-out:
++ new_params = chs->params;
++ new_params.scatter_fcs_en = enable;
++ err = mlx5e_safe_switch_params(priv, &new_params, mlx5e_set_rx_port_ts_wrap,
++ &new_params.scatter_fcs_en, true);
+ mutex_unlock(&priv->state_lock);
+ return err;
+ }
+--
+2.39.0
+
--- /dev/null
+From d2465ea8eb49d0b19096870050b24ba790dc9951 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 20:31:17 +0200
+Subject: net: mscc: ocelot: fix all IPv6 getting trapped to CPU when PTP
+ timestamping is used
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 2fcde9fe258ec8b88d41def38e43ca4da32c0a9a ]
+
+While running this selftest which usually passes:
+
+~/selftests/drivers/net/dsa# ./local_termination.sh eno0 swp0
+TEST: swp0: Unicast IPv4 to primary MAC address [ OK ]
+TEST: swp0: Unicast IPv4 to macvlan MAC address [ OK ]
+TEST: swp0: Unicast IPv4 to unknown MAC address [ OK ]
+TEST: swp0: Unicast IPv4 to unknown MAC address, promisc [ OK ]
+TEST: swp0: Unicast IPv4 to unknown MAC address, allmulti [ OK ]
+TEST: swp0: Multicast IPv4 to joined group [ OK ]
+TEST: swp0: Multicast IPv4 to unknown group [ OK ]
+TEST: swp0: Multicast IPv4 to unknown group, promisc [ OK ]
+TEST: swp0: Multicast IPv4 to unknown group, allmulti [ OK ]
+TEST: swp0: Multicast IPv6 to joined group [ OK ]
+TEST: swp0: Multicast IPv6 to unknown group [ OK ]
+TEST: swp0: Multicast IPv6 to unknown group, promisc [ OK ]
+TEST: swp0: Multicast IPv6 to unknown group, allmulti [ OK ]
+
+if I start PTP timestamping then run it again (debug prints added by me),
+the unknown IPv6 MC traffic is seen by the CPU port even when it should
+have been dropped:
+
+~/selftests/drivers/net/dsa# ptp4l -i swp0 -2 -P -m
+ptp4l[225.410]: selected /dev/ptp1 as PTP clock
+[ 225.445746] mscc_felix 0000:00:00.5: ocelot_l2_ptp_trap_add: port 0 adding L2 PTP trap
+[ 225.453815] mscc_felix 0000:00:00.5: ocelot_ipv4_ptp_trap_add: port 0 adding IPv4 PTP event trap
+[ 225.462703] mscc_felix 0000:00:00.5: ocelot_ipv4_ptp_trap_add: port 0 adding IPv4 PTP general trap
+[ 225.471768] mscc_felix 0000:00:00.5: ocelot_ipv6_ptp_trap_add: port 0 adding IPv6 PTP event trap
+[ 225.480651] mscc_felix 0000:00:00.5: ocelot_ipv6_ptp_trap_add: port 0 adding IPv6 PTP general trap
+ptp4l[225.488]: port 1: INITIALIZING to LISTENING on INIT_COMPLETE
+ptp4l[225.488]: port 0: INITIALIZING to LISTENING on INIT_COMPLETE
+^C
+~/selftests/drivers/net/dsa# ./local_termination.sh eno0 swp0
+TEST: swp0: Unicast IPv4 to primary MAC address [ OK ]
+TEST: swp0: Unicast IPv4 to macvlan MAC address [ OK ]
+TEST: swp0: Unicast IPv4 to unknown MAC address [ OK ]
+TEST: swp0: Unicast IPv4 to unknown MAC address, promisc [ OK ]
+TEST: swp0: Unicast IPv4 to unknown MAC address, allmulti [ OK ]
+TEST: swp0: Multicast IPv4 to joined group [ OK ]
+TEST: swp0: Multicast IPv4 to unknown group [ OK ]
+TEST: swp0: Multicast IPv4 to unknown group, promisc [ OK ]
+TEST: swp0: Multicast IPv4 to unknown group, allmulti [ OK ]
+TEST: swp0: Multicast IPv6 to joined group [ OK ]
+TEST: swp0: Multicast IPv6 to unknown group [FAIL]
+ reception succeeded, but should have failed
+TEST: swp0: Multicast IPv6 to unknown group, promisc [ OK ]
+TEST: swp0: Multicast IPv6 to unknown group, allmulti [ OK ]
+
+The PGID_MCIPV6 is configured correctly to not flood to the CPU,
+I checked that.
+
+Furthermore, when I disable back PTP RX timestamping (ptp4l doesn't do
+that when it exists), packets are RX filtered again as they should be:
+
+~/selftests/drivers/net/dsa# hwstamp_ctl -i swp0 -r 0
+[ 218.202854] mscc_felix 0000:00:00.5: ocelot_l2_ptp_trap_del: port 0 removing L2 PTP trap
+[ 218.212656] mscc_felix 0000:00:00.5: ocelot_ipv4_ptp_trap_del: port 0 removing IPv4 PTP event trap
+[ 218.222975] mscc_felix 0000:00:00.5: ocelot_ipv4_ptp_trap_del: port 0 removing IPv4 PTP general trap
+[ 218.233133] mscc_felix 0000:00:00.5: ocelot_ipv6_ptp_trap_del: port 0 removing IPv6 PTP event trap
+[ 218.242251] mscc_felix 0000:00:00.5: ocelot_ipv6_ptp_trap_del: port 0 removing IPv6 PTP general trap
+current settings:
+tx_type 1
+rx_filter 12
+new settings:
+tx_type 1
+rx_filter 0
+~/selftests/drivers/net/dsa# ./local_termination.sh eno0 swp0
+TEST: swp0: Unicast IPv4 to primary MAC address [ OK ]
+TEST: swp0: Unicast IPv4 to macvlan MAC address [ OK ]
+TEST: swp0: Unicast IPv4 to unknown MAC address [ OK ]
+TEST: swp0: Unicast IPv4 to unknown MAC address, promisc [ OK ]
+TEST: swp0: Unicast IPv4 to unknown MAC address, allmulti [ OK ]
+TEST: swp0: Multicast IPv4 to joined group [ OK ]
+TEST: swp0: Multicast IPv4 to unknown group [ OK ]
+TEST: swp0: Multicast IPv4 to unknown group, promisc [ OK ]
+TEST: swp0: Multicast IPv4 to unknown group, allmulti [ OK ]
+TEST: swp0: Multicast IPv6 to joined group [ OK ]
+TEST: swp0: Multicast IPv6 to unknown group [ OK ]
+TEST: swp0: Multicast IPv6 to unknown group, promisc [ OK ]
+TEST: swp0: Multicast IPv6 to unknown group, allmulti [ OK ]
+
+So it's clear that something in the PTP RX trapping logic went wrong.
+
+Looking a bit at the code, I can see that there are 4 typos, which
+populate "ipv4" VCAP IS2 key filter fields for IPv6 keys.
+
+VCAP IS2 keys of type OCELOT_VCAP_KEY_IPV4 and OCELOT_VCAP_KEY_IPV6 are
+handled by is2_entry_set(). OCELOT_VCAP_KEY_IPV4 looks at
+&filter->key.ipv4, and OCELOT_VCAP_KEY_IPV6 at &filter->key.ipv6.
+Simply put, when we populate the wrong key field, &filter->key.ipv6
+fields "proto.mask" and "proto.value" remain all zeroes (or "don't care").
+So is2_entry_set() will enter the "else" of this "if" condition:
+
+ if (msk == 0xff && (val == IPPROTO_TCP || val == IPPROTO_UDP))
+
+and proceed to ignore the "proto" field. The resulting rule will match
+on all IPv6 traffic, trapping it to the CPU.
+
+This is the reason why the local_termination.sh selftest sees it,
+because control traps are stronger than the PGID_MCIPV6 used for
+flooding (from the forwarding data path).
+
+But the problem is in fact much deeper. We trap all IPv6 traffic to the
+CPU, but if we're bridged, we set skb->offload_fwd_mark = 1, so software
+forwarding will not take place and IPv6 traffic will never reach its
+destination.
+
+The fix is simple - correct the typos.
+
+I was intentionally inaccurate in the commit message about the breakage
+occurring when any PTP timestamping is enabled. In fact it only happens
+when L4 timestamping is requested (HWTSTAMP_FILTER_PTP_V2_EVENT or
+HWTSTAMP_FILTER_PTP_V2_L4_EVENT). But ptp4l requests a larger RX
+timestamping filter than it needs for "-2": HWTSTAMP_FILTER_PTP_V2_EVENT.
+I wanted people skimming through git logs to not think that the bug
+doesn't affect them because they only use ptp4l in L2 mode.
+
+Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230207183117.1745754-1-vladimir.oltean@nxp.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot_ptp.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot_ptp.c b/drivers/net/ethernet/mscc/ocelot_ptp.c
+index 1a82f10c88539..2180ae94c7447 100644
+--- a/drivers/net/ethernet/mscc/ocelot_ptp.c
++++ b/drivers/net/ethernet/mscc/ocelot_ptp.c
+@@ -335,8 +335,8 @@ static void
+ ocelot_populate_ipv6_ptp_event_trap_key(struct ocelot_vcap_filter *trap)
+ {
+ trap->key_type = OCELOT_VCAP_KEY_IPV6;
+- trap->key.ipv4.proto.value[0] = IPPROTO_UDP;
+- trap->key.ipv4.proto.mask[0] = 0xff;
++ trap->key.ipv6.proto.value[0] = IPPROTO_UDP;
++ trap->key.ipv6.proto.mask[0] = 0xff;
+ trap->key.ipv6.dport.value = PTP_EV_PORT;
+ trap->key.ipv6.dport.mask = 0xffff;
+ }
+@@ -355,8 +355,8 @@ static void
+ ocelot_populate_ipv6_ptp_general_trap_key(struct ocelot_vcap_filter *trap)
+ {
+ trap->key_type = OCELOT_VCAP_KEY_IPV6;
+- trap->key.ipv4.proto.value[0] = IPPROTO_UDP;
+- trap->key.ipv4.proto.mask[0] = 0xff;
++ trap->key.ipv6.proto.value[0] = IPPROTO_UDP;
++ trap->key.ipv6.proto.mask[0] = 0xff;
+ trap->key.ipv6.dport.value = PTP_GEN_PORT;
+ trap->key.ipv6.dport.mask = 0xffff;
+ }
+--
+2.39.0
+
--- /dev/null
+From 40f6380f1cb59167642ef940881811ce64c95024 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Feb 2023 21:24:08 +0200
+Subject: net: mscc: ocelot: fix VCAP filters not matching on MAC with
+ "protocol 802.1Q"
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit f964f8399df29d3e3ced77177cf35131cd2491bf ]
+
+Alternative short title: don't instruct the hardware to match on
+EtherType with "protocol 802.1Q" flower filters. It doesn't work for the
+reasons detailed below.
+
+With a command such as the following:
+
+tc filter add dev $swp1 ingress chain $(IS1 2) pref 3 \
+ protocol 802.1Q flower skip_sw vlan_id 200 src_mac $h1_mac \
+ action vlan modify id 300 \
+ action goto chain $(IS2 0 0)
+
+the created filter is set by ocelot_flower_parse_key() to be of type
+OCELOT_VCAP_KEY_ETYPE, and etype is set to {value=0x8100, mask=0xffff}.
+This gets propagated all the way to is1_entry_set() which commits it to
+hardware (the VCAP_IS1_HK_ETYPE field of the key). Compare this to the
+case where src_mac isn't specified - the key type is OCELOT_VCAP_KEY_ANY,
+and is1_entry_set() doesn't populate VCAP_IS1_HK_ETYPE.
+
+The problem is that for VLAN-tagged frames, the hardware interprets the
+ETYPE field as holding the encapsulated VLAN protocol. So the above
+filter will only match those packets which have an encapsulated protocol
+of 0x8100, rather than all packets with VLAN ID 200 and the given src_mac.
+
+The reason why this is allowed to occur is because, although we have a
+block of code in ocelot_flower_parse_key() which sets "match_protocol"
+to false when VLAN keys are present, that code executes too late.
+There is another block of code, which executes for Ethernet addresses,
+and has a "goto finished_key_parsing" and skips the VLAN header parsing.
+By skipping it, "match_protocol" remains with the value it was
+initialized with, i.e. "true", and "proto" is set to f->common.protocol,
+or 0x8100.
+
+The concept of ignoring some keys rather than erroring out when they are
+present but can't be offloaded is dubious in itself, but is present
+since the initial commit fe3490e6107e ("net: mscc: ocelot: Hardware
+ofload for tc flower filter"), and it's outside of the scope of this
+patch to change that.
+
+The problem was introduced when the driver started to interpret the
+flower filter's protocol, and populate the VCAP filter's ETYPE field
+based on it.
+
+To fix this, it is sufficient to move the code that parses the VLAN keys
+earlier than the "goto finished_key_parsing" instruction. This will
+ensure that if we have a flower filter with both VLAN and Ethernet
+address keys, it won't match on ETYPE 0x8100, because the VLAN key
+parsing sets "match_protocol = false".
+
+Fixes: 86b956de119c ("net: mscc: ocelot: support matching on EtherType")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230205192409.1796428-1-vladimir.oltean@nxp.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot_flower.c | 24 +++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot_flower.c b/drivers/net/ethernet/mscc/ocelot_flower.c
+index 7c0897e779dc6..ee052404eb55a 100644
+--- a/drivers/net/ethernet/mscc/ocelot_flower.c
++++ b/drivers/net/ethernet/mscc/ocelot_flower.c
+@@ -605,6 +605,18 @@ ocelot_flower_parse_key(struct ocelot *ocelot, int port, bool ingress,
+ flow_rule_match_control(rule, &match);
+ }
+
++ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) {
++ struct flow_match_vlan match;
++
++ flow_rule_match_vlan(rule, &match);
++ filter->key_type = OCELOT_VCAP_KEY_ANY;
++ filter->vlan.vid.value = match.key->vlan_id;
++ filter->vlan.vid.mask = match.mask->vlan_id;
++ filter->vlan.pcp.value[0] = match.key->vlan_priority;
++ filter->vlan.pcp.mask[0] = match.mask->vlan_priority;
++ match_protocol = false;
++ }
++
+ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
+ struct flow_match_eth_addrs match;
+
+@@ -737,18 +749,6 @@ ocelot_flower_parse_key(struct ocelot *ocelot, int port, bool ingress,
+ match_protocol = false;
+ }
+
+- if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) {
+- struct flow_match_vlan match;
+-
+- flow_rule_match_vlan(rule, &match);
+- filter->key_type = OCELOT_VCAP_KEY_ANY;
+- filter->vlan.vid.value = match.key->vlan_id;
+- filter->vlan.vid.mask = match.mask->vlan_id;
+- filter->vlan.pcp.value[0] = match.key->vlan_priority;
+- filter->vlan.pcp.mask[0] = match.mask->vlan_priority;
+- match_protocol = false;
+- }
+-
+ finished_key_parsing:
+ if (match_protocol && proto != ETH_P_ALL) {
+ if (filter->block_id == VCAP_ES0) {
+--
+2.39.0
+
--- /dev/null
+From debd0718df8a400c711ec371a107a7b5040ea410 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 21:45:36 +0100
+Subject: net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 69ff53e4a4c9498eeed7d1441f68a1481dc69251 ]
+
+Jerome provided the information that also the GXL internal PHY doesn't
+support MMD register access and EEE. MMD reads return 0xffff, what
+results in e.g. completely wrong ethtool --show-eee output.
+Therefore use the MMD dummy stubs.
+
+Fixes: d853d145ea3e ("net: phy: add an option to disable EEE advertisement")
+Suggested-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://lore.kernel.org/r/84432fe4-0be4-bc82-4e5c-557206b40f56@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/meson-gxl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c
+index 5e41658b1e2fa..a6015cd03bff8 100644
+--- a/drivers/net/phy/meson-gxl.c
++++ b/drivers/net/phy/meson-gxl.c
+@@ -261,6 +261,8 @@ static struct phy_driver meson_gxl_phy[] = {
+ .handle_interrupt = meson_gxl_handle_interrupt,
+ .suspend = genphy_suspend,
+ .resume = genphy_resume,
++ .read_mmd = genphy_read_mmd_unsupported,
++ .write_mmd = genphy_write_mmd_unsupported,
+ }, {
+ PHY_ID_MATCH_EXACT(0x01803301),
+ .name = "Meson G12A Internal PHY",
+--
+2.39.0
+
--- /dev/null
+From 0265be99d995f9fb298e80b0f7d15f4c79d5f369 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 11:02:42 +0100
+Subject: net: phylink: move phy_device_free() to correctly release phy device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Léger <clement.leger@bootlin.com>
+
+[ Upstream commit ce93fdb5f2ca5c9e2a9668411cc39091507f8dc9 ]
+
+After calling fwnode_phy_find_device(), the phy device refcount is
+incremented. Then, when the phy device is attached to a netdev with
+phy_attach_direct(), the refcount is also incremented but only
+decremented in the caller if phy_attach_direct() fails. Move
+phy_device_free() before the "if" to always release it correctly.
+Indeed, either phy_attach_direct() failed and we don't want to keep a
+reference to the phydev or it succeeded and a reference has been taken
+internally.
+
+Fixes: 25396f680dd6 ("net: phylink: introduce phylink_fwnode_phy_connect()")
+Signed-off-by: Clément Léger <clement.leger@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phylink.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index 2805b04d64028..a202ce6611fde 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -1793,10 +1793,9 @@ int phylink_fwnode_phy_connect(struct phylink *pl,
+
+ ret = phy_attach_direct(pl->netdev, phy_dev, flags,
+ pl->link_interface);
+- if (ret) {
+- phy_device_free(phy_dev);
++ phy_device_free(phy_dev);
++ if (ret)
+ return ret;
+- }
+
+ ret = phylink_bringup_phy(pl, phy_dev, pl->link_config.interface);
+ if (ret)
+--
+2.39.0
+
--- /dev/null
+From b870b6bab9ab2dcff502df42fe319223413be838 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 07:05:28 +1000
+Subject: nvidiafb: detect the hardware support before removing console.
+
+From: Dave Airlie <airlied@redhat.com>
+
+[ Upstream commit 04119ab1a49fc41cb70f0472be5455af268fa260 ]
+
+This driver removed the console, but hasn't yet decided if it could
+take over the console yet. Instead of doing that, probe the hw for
+support and then remove the console afterwards.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216859
+Fixes: 145eed48de27 ("fbdev: Remove conflicting devices on PCI bus")
+Reported-by: Zeno Davatz <zdavatz@gmail.com>
+Tested-by: Zeno Davatz <zdavatz@gmail.com>
+Tested-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230205210751.3842103-1-airlied@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/nvidia/nvidia.c | 81 +++++++++++++++--------------
+ 1 file changed, 42 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c
+index 329e2e8133c69..a6c3bc2222463 100644
+--- a/drivers/video/fbdev/nvidia/nvidia.c
++++ b/drivers/video/fbdev/nvidia/nvidia.c
+@@ -1197,17 +1197,17 @@ static int nvidia_set_fbinfo(struct fb_info *info)
+ return nvidiafb_check_var(&info->var, info);
+ }
+
+-static u32 nvidia_get_chipset(struct fb_info *info)
++static u32 nvidia_get_chipset(struct pci_dev *pci_dev,
++ volatile u32 __iomem *REGS)
+ {
+- struct nvidia_par *par = info->par;
+- u32 id = (par->pci_dev->vendor << 16) | par->pci_dev->device;
++ u32 id = (pci_dev->vendor << 16) | pci_dev->device;
+
+ printk(KERN_INFO PFX "Device ID: %x \n", id);
+
+ if ((id & 0xfff0) == 0x00f0 ||
+ (id & 0xfff0) == 0x02e0) {
+ /* pci-e */
+- id = NV_RD32(par->REGS, 0x1800);
++ id = NV_RD32(REGS, 0x1800);
+
+ if ((id & 0x0000ffff) == 0x000010DE)
+ id = 0x10DE0000 | (id >> 16);
+@@ -1220,12 +1220,11 @@ static u32 nvidia_get_chipset(struct fb_info *info)
+ return id;
+ }
+
+-static u32 nvidia_get_arch(struct fb_info *info)
++static u32 nvidia_get_arch(u32 Chipset)
+ {
+- struct nvidia_par *par = info->par;
+ u32 arch = 0;
+
+- switch (par->Chipset & 0x0ff0) {
++ switch (Chipset & 0x0ff0) {
+ case 0x0100: /* GeForce 256 */
+ case 0x0110: /* GeForce2 MX */
+ case 0x0150: /* GeForce2 */
+@@ -1278,16 +1277,44 @@ static int nvidiafb_probe(struct pci_dev *pd, const struct pci_device_id *ent)
+ struct fb_info *info;
+ unsigned short cmd;
+ int ret;
++ volatile u32 __iomem *REGS;
++ int Chipset;
++ u32 Architecture;
+
+ NVTRACE_ENTER();
+ assert(pd != NULL);
+
++ if (pci_enable_device(pd)) {
++ printk(KERN_ERR PFX "cannot enable PCI device\n");
++ return -ENODEV;
++ }
++
++ /* enable IO and mem if not already done */
++ pci_read_config_word(pd, PCI_COMMAND, &cmd);
++ cmd |= (PCI_COMMAND_IO | PCI_COMMAND_MEMORY);
++ pci_write_config_word(pd, PCI_COMMAND, cmd);
++
++ nvidiafb_fix.mmio_start = pci_resource_start(pd, 0);
++ nvidiafb_fix.mmio_len = pci_resource_len(pd, 0);
++
++ REGS = ioremap(nvidiafb_fix.mmio_start, nvidiafb_fix.mmio_len);
++ if (!REGS) {
++ printk(KERN_ERR PFX "cannot ioremap MMIO base\n");
++ return -ENODEV;
++ }
++
++ Chipset = nvidia_get_chipset(pd, REGS);
++ Architecture = nvidia_get_arch(Chipset);
++ if (Architecture == 0) {
++ printk(KERN_ERR PFX "unknown NV_ARCH\n");
++ goto err_out;
++ }
++
+ ret = aperture_remove_conflicting_pci_devices(pd, "nvidiafb");
+ if (ret)
+- return ret;
++ goto err_out;
+
+ info = framebuffer_alloc(sizeof(struct nvidia_par), &pd->dev);
+-
+ if (!info)
+ goto err_out;
+
+@@ -1298,11 +1325,6 @@ static int nvidiafb_probe(struct pci_dev *pd, const struct pci_device_id *ent)
+ if (info->pixmap.addr == NULL)
+ goto err_out_kfree;
+
+- if (pci_enable_device(pd)) {
+- printk(KERN_ERR PFX "cannot enable PCI device\n");
+- goto err_out_enable;
+- }
+-
+ if (pci_request_regions(pd, "nvidiafb")) {
+ printk(KERN_ERR PFX "cannot request PCI regions\n");
+ goto err_out_enable;
+@@ -1318,34 +1340,17 @@ static int nvidiafb_probe(struct pci_dev *pd, const struct pci_device_id *ent)
+ par->paneltweak = paneltweak;
+ par->reverse_i2c = reverse_i2c;
+
+- /* enable IO and mem if not already done */
+- pci_read_config_word(pd, PCI_COMMAND, &cmd);
+- cmd |= (PCI_COMMAND_IO | PCI_COMMAND_MEMORY);
+- pci_write_config_word(pd, PCI_COMMAND, cmd);
+-
+- nvidiafb_fix.mmio_start = pci_resource_start(pd, 0);
+ nvidiafb_fix.smem_start = pci_resource_start(pd, 1);
+- nvidiafb_fix.mmio_len = pci_resource_len(pd, 0);
+-
+- par->REGS = ioremap(nvidiafb_fix.mmio_start, nvidiafb_fix.mmio_len);
+
+- if (!par->REGS) {
+- printk(KERN_ERR PFX "cannot ioremap MMIO base\n");
+- goto err_out_free_base0;
+- }
++ par->REGS = REGS;
+
+- par->Chipset = nvidia_get_chipset(info);
+- par->Architecture = nvidia_get_arch(info);
+-
+- if (par->Architecture == 0) {
+- printk(KERN_ERR PFX "unknown NV_ARCH\n");
+- goto err_out_arch;
+- }
++ par->Chipset = Chipset;
++ par->Architecture = Architecture;
+
+ sprintf(nvidiafb_fix.id, "NV%x", (pd->device & 0x0ff0) >> 4);
+
+ if (NVCommonSetup(info))
+- goto err_out_arch;
++ goto err_out_free_base0;
+
+ par->FbAddress = nvidiafb_fix.smem_start;
+ par->FbMapSize = par->RamAmountKBytes * 1024;
+@@ -1401,7 +1406,6 @@ static int nvidiafb_probe(struct pci_dev *pd, const struct pci_device_id *ent)
+ goto err_out_iounmap_fb;
+ }
+
+-
+ printk(KERN_INFO PFX
+ "PCI nVidia %s framebuffer (%dMB @ 0x%lX)\n",
+ info->fix.id,
+@@ -1415,15 +1419,14 @@ static int nvidiafb_probe(struct pci_dev *pd, const struct pci_device_id *ent)
+ err_out_free_base1:
+ fb_destroy_modedb(info->monspecs.modedb);
+ nvidia_delete_i2c_busses(par);
+-err_out_arch:
+- iounmap(par->REGS);
+- err_out_free_base0:
++err_out_free_base0:
+ pci_release_regions(pd);
+ err_out_enable:
+ kfree(info->pixmap.addr);
+ err_out_kfree:
+ framebuffer_release(info);
+ err_out:
++ iounmap(REGS);
+ return -ENODEV;
+ }
+
+--
+2.39.0
+
--- /dev/null
+From bd0632bb648270b8da4e85d7961e052c43c0600e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 10:22:47 -0600
+Subject: of: Make OF framebuffer device names unique
+
+From: Michal Suchanek <msuchanek@suse.de>
+
+[ Upstream commit 241d2fb56a18473af5f2ff0d512992a996eb64dd ]
+
+Since Linux 5.19 this error is observed:
+
+sysfs: cannot create duplicate filename '/devices/platform/of-display'
+
+This is because multiple devices with the same name 'of-display' are
+created on the same bus. Update the code to create numbered device names
+for the displays.
+
+Also, fix a node refcounting issue when exiting the boot display loop.
+
+cc: linuxppc-dev@lists.ozlabs.org
+References: https://bugzilla.kernel.org/show_bug.cgi?id=216095
+Fixes: 52b1b46c39ae ("of: Create platform devices for OF framebuffers")
+Reported-by: Erhard F. <erhard_f@mailbox.org>
+Suggested-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Michal Suchanek <msuchanek@suse.de>
+Link: https://lore.kernel.org/r/20230201162247.3575506-1-robh@kernel.org
+[robh: Rework to avoid node refcount leaks]
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/platform.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/of/platform.c b/drivers/of/platform.c
+index 3507095a69f69..6e93fd37ccd1a 100644
+--- a/drivers/of/platform.c
++++ b/drivers/of/platform.c
+@@ -526,6 +526,7 @@ static int __init of_platform_default_populate_init(void)
+ if (IS_ENABLED(CONFIG_PPC)) {
+ struct device_node *boot_display = NULL;
+ struct platform_device *dev;
++ int display_number = 0;
+ int ret;
+
+ /* Check if we have a MacOS display without a node spec */
+@@ -556,16 +557,23 @@ static int __init of_platform_default_populate_init(void)
+ if (!of_get_property(node, "linux,opened", NULL) ||
+ !of_get_property(node, "linux,boot-display", NULL))
+ continue;
+- dev = of_platform_device_create(node, "of-display", NULL);
++ dev = of_platform_device_create(node, "of-display.0", NULL);
++ of_node_put(node);
+ if (WARN_ON(!dev))
+ return -ENOMEM;
+ boot_display = node;
++ display_number++;
+ break;
+ }
+ for_each_node_by_type(node, "display") {
++ char buf[14];
++ const char *of_display_format = "of-display.%d";
++
+ if (!of_get_property(node, "linux,opened", NULL) || node == boot_display)
+ continue;
+- of_platform_device_create(node, "of-display", NULL);
++ ret = snprintf(buf, sizeof(buf), of_display_format, display_number++);
++ if (ret < sizeof(buf))
++ of_platform_device_create(node, buf, NULL);
+ }
+
+ } else {
+--
+2.39.0
+
--- /dev/null
+From fb1e5b523e0b9323b5a54abe69689cd319ca29b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 10:52:30 -0800
+Subject: RDMA/irdma: Fix potential NULL-ptr-dereference
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 5d9745cead1f121974322b94ceadfb4d1e67960e ]
+
+in_dev_get() can return NULL which will cause a failure once idev is
+dereferenced in in_dev_for_each_ifa_rtnl(). This patch adds a
+check for NULL value in idev beforehand.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Link: https://lore.kernel.org/r/20230126185230.62464-1-n.zhandarovich@fintech.ru
+Reviewed-by: Sindhu Devale <sindhu.devale@intel.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/cm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/hw/irdma/cm.c b/drivers/infiniband/hw/irdma/cm.c
+index 7b086fe63a245..195aa9ea18b6c 100644
+--- a/drivers/infiniband/hw/irdma/cm.c
++++ b/drivers/infiniband/hw/irdma/cm.c
+@@ -1722,6 +1722,9 @@ static int irdma_add_mqh_4(struct irdma_device *iwdev,
+ continue;
+
+ idev = in_dev_get(ip_dev);
++ if (!idev)
++ continue;
++
+ in_dev_for_each_ifa_rtnl(ifa, idev) {
+ ibdev_dbg(&iwdev->ibdev,
+ "CM: Allocating child CM Listener forIP=%pI4, vlan_id=%d, MAC=%pM\n",
+--
+2.39.0
+
--- /dev/null
+From aebd09db7337b985b99045ac4b15001b4a0f94aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jan 2023 17:37:57 +0800
+Subject: RDMA/usnic: use iommu_map_atomic() under spin_lock()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit b7e08a5a63a11627601915473c3b569c1f6c6c06 ]
+
+usnic_uiom_map_sorted_intervals() is called under spin_lock(), iommu_map()
+might sleep, use iommu_map_atomic() to avoid potential sleep in atomic
+context.
+
+Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20230129093757.637354-1-yangyingliang@huawei.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/usnic/usnic_uiom.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/usnic/usnic_uiom.c b/drivers/infiniband/hw/usnic/usnic_uiom.c
+index 67923ced6e2d1..b343f6f1bda57 100644
+--- a/drivers/infiniband/hw/usnic/usnic_uiom.c
++++ b/drivers/infiniband/hw/usnic/usnic_uiom.c
+@@ -277,8 +277,8 @@ static int usnic_uiom_map_sorted_intervals(struct list_head *intervals,
+ size = pa_end - pa_start + PAGE_SIZE;
+ usnic_dbg("va 0x%lx pa %pa size 0x%zx flags 0x%x",
+ va_start, &pa_start, size, flags);
+- err = iommu_map(pd->domain, va_start, pa_start,
+- size, flags);
++ err = iommu_map_atomic(pd->domain, va_start,
++ pa_start, size, flags);
+ if (err) {
+ usnic_err("Failed to map va 0x%lx pa %pa size 0x%zx with err %d\n",
+ va_start, &pa_start, size, err);
+@@ -294,8 +294,8 @@ static int usnic_uiom_map_sorted_intervals(struct list_head *intervals,
+ size = pa - pa_start + PAGE_SIZE;
+ usnic_dbg("va 0x%lx pa %pa size 0x%zx flags 0x%x\n",
+ va_start, &pa_start, size, flags);
+- err = iommu_map(pd->domain, va_start, pa_start,
+- size, flags);
++ err = iommu_map_atomic(pd->domain, va_start,
++ pa_start, size, flags);
+ if (err) {
+ usnic_err("Failed to map va 0x%lx pa %pa size 0x%zx with err %d\n",
+ va_start, &pa_start, size, err);
+--
+2.39.0
+
--- /dev/null
+From f2e6200d8e30a38219508cac72185913e35d151c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 18:26:34 +0000
+Subject: rds: rds_rm_zerocopy_callback() use list_first_entry()
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+[ Upstream commit f753a68980cf4b59a80fe677619da2b1804f526d ]
+
+rds_rm_zerocopy_callback() uses list_entry() on the head of a list
+causing a type confusion.
+Use list_first_entry() to actually access the first element of the
+rs_zcookie_queue list.
+
+Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification")
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Link: https://lore.kernel.org/r/20230202-rds-zerocopy-v3-1-83b0df974f9a@diag.uniroma1.it
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/message.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/rds/message.c b/net/rds/message.c
+index 44dbc612ef549..9402bc941823f 100644
+--- a/net/rds/message.c
++++ b/net/rds/message.c
+@@ -104,9 +104,9 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs,
+ spin_lock_irqsave(&q->lock, flags);
+ head = &q->zcookie_head;
+ if (!list_empty(head)) {
+- info = list_entry(head, struct rds_msg_zcopy_info,
+- rs_zcookie_next);
+- if (info && rds_zcookie_add(info, cookie)) {
++ info = list_first_entry(head, struct rds_msg_zcopy_info,
++ rs_zcookie_next);
++ if (rds_zcookie_add(info, cookie)) {
+ spin_unlock_irqrestore(&q->lock, flags);
+ kfree(rds_info_from_znotifier(znotif));
+ /* caller invokes rds_wake_sk_sleep() */
+--
+2.39.0
+
--- /dev/null
+From c6543161a07688639409fd48ee2ff14cf5cf70bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 10:50:38 +0800
+Subject: riscv: stacktrace: Fix missing the first frame
+
+From: Liu Shixin <liushixin2@huawei.com>
+
+[ Upstream commit cb80242cc679d6397e77d8a964deeb3ff218d2b5 ]
+
+When running kfence_test, I found some testcases failed like this:
+
+ # test_out_of_bounds_read: EXPECTATION FAILED at mm/kfence/kfence_test.c:346
+ Expected report_matches(&expect) to be true, but is false
+ not ok 1 - test_out_of_bounds_read
+
+The corresponding call-trace is:
+
+ BUG: KFENCE: out-of-bounds read in kunit_try_run_case+0x38/0x84
+
+ Out-of-bounds read at 0x(____ptrval____) (32B right of kfence-#10):
+ kunit_try_run_case+0x38/0x84
+ kunit_generic_run_threadfn_adapter+0x12/0x1e
+ kthread+0xc8/0xde
+ ret_from_exception+0x0/0xc
+
+The kfence_test using the first frame of call trace to check whether the
+testcase is succeed or not. Commit 6a00ef449370 ("riscv: eliminate
+unreliable __builtin_frame_address(1)") skip first frame for all
+case, which results the kfence_test failed. Indeed, we only need to skip
+the first frame for case (task==NULL || task==current).
+
+With this patch, the call-trace will be:
+
+ BUG: KFENCE: out-of-bounds read in test_out_of_bounds_read+0x88/0x19e
+
+ Out-of-bounds read at 0x(____ptrval____) (1B left of kfence-#7):
+ test_out_of_bounds_read+0x88/0x19e
+ kunit_try_run_case+0x38/0x84
+ kunit_generic_run_threadfn_adapter+0x12/0x1e
+ kthread+0xc8/0xde
+ ret_from_exception+0x0/0xc
+
+Fixes: 6a00ef449370 ("riscv: eliminate unreliable __builtin_frame_address(1)")
+Signed-off-by: Liu Shixin <liushixin2@huawei.com>
+Tested-by: Samuel Holland <samuel@sholland.org>
+Link: https://lore.kernel.org/r/20221207025038.1022045-1-liushixin2@huawei.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/stacktrace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c
+index bcfe9eb55f80f..85cd5442d2f81 100644
+--- a/arch/riscv/kernel/stacktrace.c
++++ b/arch/riscv/kernel/stacktrace.c
+@@ -30,6 +30,7 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,
+ fp = (unsigned long)__builtin_frame_address(0);
+ sp = current_stack_pointer;
+ pc = (unsigned long)walk_stackframe;
++ level = -1;
+ } else {
+ /* task blocked in __switch_to */
+ fp = task->thread.s[0];
+@@ -41,7 +42,7 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,
+ unsigned long low, high;
+ struct stackframe *frame;
+
+- if (unlikely(!__kernel_text_address(pc) || (level++ >= 1 && !fn(arg, pc))))
++ if (unlikely(!__kernel_text_address(pc) || (level++ >= 0 && !fn(arg, pc))))
+ break;
+
+ /* Validate frame pointer */
+--
+2.39.0
+
--- /dev/null
+From 662f3b9a1ac118f659d276bc56cc9d7bae586854 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 16:18:19 +0200
+Subject: selftests: Fix failing VXLAN VNI filtering test
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit b963d9d5b9437a6b99504987310f98537c9e77d4 ]
+
+iproute2 does not recognize the "group6" and "remote6" keywords. Fix by
+using "group" and "remote" instead.
+
+Before:
+
+ # ./test_vxlan_vnifiltering.sh
+ [...]
+ Tests passed: 25
+ Tests failed: 2
+
+After:
+
+ # ./test_vxlan_vnifiltering.sh
+ [...]
+ Tests passed: 27
+ Tests failed: 0
+
+Fixes: 3edf5f66c12a ("selftests: add new tests for vxlan vnifiltering")
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Link: https://lore.kernel.org/r/20230207141819.256689-1-idosch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/net/test_vxlan_vnifiltering.sh | 18 +++++-------------
+ 1 file changed, 5 insertions(+), 13 deletions(-)
+
+diff --git a/tools/testing/selftests/net/test_vxlan_vnifiltering.sh b/tools/testing/selftests/net/test_vxlan_vnifiltering.sh
+index 704997ffc2449..8c3ac0a725451 100755
+--- a/tools/testing/selftests/net/test_vxlan_vnifiltering.sh
++++ b/tools/testing/selftests/net/test_vxlan_vnifiltering.sh
+@@ -293,19 +293,11 @@ setup-vm() {
+ elif [[ -n $vtype && $vtype == "vnifilterg" ]]; then
+ # Add per vni group config with 'bridge vni' api
+ if [ -n "$group" ]; then
+- if [ "$family" == "v4" ]; then
+- if [ $mcast -eq 1 ]; then
+- bridge -netns hv-$hvid vni add dev $vxlandev vni $tid group $group
+- else
+- bridge -netns hv-$hvid vni add dev $vxlandev vni $tid remote $group
+- fi
+- else
+- if [ $mcast -eq 1 ]; then
+- bridge -netns hv-$hvid vni add dev $vxlandev vni $tid group6 $group
+- else
+- bridge -netns hv-$hvid vni add dev $vxlandev vni $tid remote6 $group
+- fi
+- fi
++ if [ $mcast -eq 1 ]; then
++ bridge -netns hv-$hvid vni add dev $vxlandev vni $tid group $group
++ else
++ bridge -netns hv-$hvid vni add dev $vxlandev vni $tid remote $group
++ fi
+ fi
+ fi
+ done
+--
+2.39.0
+
--- /dev/null
+From fb66e8afd1493de4f07fa6d2c7406e4b1b741b56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 11:21:10 +0800
+Subject: selftests: forwarding: lib: quote the sysctl values
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 3a082086aa200852545cf15159213582c0c80eba ]
+
+When set/restore sysctl value, we should quote the value as some keys
+may have multi values, e.g. net.ipv4.ping_group_range
+
+Fixes: f5ae57784ba8 ("selftests: forwarding: lib: Add sysctl_set(), sysctl_restore()")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Link: https://lore.kernel.org/r/20230208032110.879205-1-liuhangbin@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/forwarding/lib.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index 3ffb9d6c09504..f4721f1b2886b 100755
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -906,14 +906,14 @@ sysctl_set()
+ local value=$1; shift
+
+ SYSCTL_ORIG[$key]=$(sysctl -n $key)
+- sysctl -qw $key=$value
++ sysctl -qw $key="$value"
+ }
+
+ sysctl_restore()
+ {
+ local key=$1; shift
+
+- sysctl -qw $key=${SYSCTL_ORIG["$key"]}
++ sysctl -qw $key="${SYSCTL_ORIG[$key]}"
+ }
+
+ forwarding_enable()
+--
+2.39.0
+
of-address-return-an-error-when-no-valid-dma-ranges-are-found.patch
can-j1939-do-not-wait-250-ms-if-the-same-addr-was-already-claimed.patch
hid-logitech-disable-hi-res-scrolling-on-usb.patch
+xfrm-compat-change-expression-for-switch-in-xfrm_xla.patch
+ib-hfi1-restore-allocated-resources-on-failed-copyou.patch
+xfrm-compat-prevent-potential-spectre-v1-gadget-in-x.patch
+ib-ipoib-fix-legacy-ipoib-due-to-wrong-number-of-que.patch
+xfrm-annotate-data-race-around-use_time.patch
+rdma-irdma-fix-potential-null-ptr-dereference.patch
+rdma-usnic-use-iommu_map_atomic-under-spin_lock.patch
+xfrm-fix-bug-with-dscp-copy-to-v6-from-v4-tunnel.patch
+of-make-of-framebuffer-device-names-unique.patch
+net-phylink-move-phy_device_free-to-correctly-releas.patch
+bonding-fix-error-checking-in-bond_debug_reregister.patch
+net-macb-perform-zynqmp-dynamic-configuration-only-f.patch
+net-phy-meson-gxl-use-mmd-access-dummy-stubs-for-gxl.patch
+ionic-clean-interrupt-before-enabling-queue-to-avoid.patch
+ionic-refactor-use-of-ionic_rx_fill.patch
+ionic-missed-doorbell-workaround.patch
+cpufreq-qcom-hw-fix-cpufreq_driver-get-for-non-lmh-s.patch
+uapi-add-missing-ip-ipv6-header-dependencies-for-lin.patch
+net-microchip-sparx5-fix-ptp-init-deinit-not-checkin.patch
+hid-amd_sfh-if-no-sensors-are-enabled-clean-up.patch
+drm-i915-don-t-do-the-wm0-wm1-copy-w-a-if-wm1-is-alr.patch
+drm-virtio-exbuf-fence_fd-unmodified-on-interrupted-.patch
+cpuset-call-set_cpus_allowed_ptr-with-appropriate-ma.patch
+nvidiafb-detect-the-hardware-support-before-removing.patch
+ice-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch
+ice-fix-disabling-rx-vlan-filtering-with-port-vlan-e.patch
+ice-switch-fix-potential-memleak-in-ice_add_adv_reci.patch
+net-dsa-mt7530-don-t-change-pvc_eg_tag-when-cpu-port.patch
+net-mscc-ocelot-fix-vcap-filters-not-matching-on-mac.patch
+net-mlx5e-update-rx-ring-hw-mtu-upon-each-rx-fcs-fla.patch
+net-mlx5-bridge-fix-ageing-of-peer-fdb-entries.patch
+net-mlx5e-fix-crash-unsetting-rx-vlan-filter-in-swit.patch
+net-mlx5e-ipoib-show-unknown-speed-instead-of-error.patch
+net-mlx5-store-page-counters-in-a-single-array.patch
+net-mlx5-expose-sf-firmware-pages-counter.patch
+net-mlx5-fw_tracer-clear-load-bit-when-freeing-strin.patch
+net-mlx5-fw_tracer-zero-consumer-index-when-reloadin.patch
+net-mlx5-serialize-module-cleanup-with-reload-and-re.patch
+igc-add-ndo_tx_timeout-support.patch
+net-ethernet-mtk_eth_soc-fix-wrong-parameters-order-.patch
+txhash-fix-sk-sk_txrehash-default.patch
+selftests-fix-failing-vxlan-vni-filtering-test.patch
+rds-rds_rm_zerocopy_callback-use-list_first_entry.patch
+net-mscc-ocelot-fix-all-ipv6-getting-trapped-to-cpu-.patch
+selftests-forwarding-lib-quote-the-sysctl-values.patch
+arm64-dts-rockchip-fix-input-enable-pinconf-on-rk339.patch
+arm64-dts-rockchip-set-sdmmc0-speed-to-sd-uhs-sdr50-.patch
+alsa-pci-lx6464es-fix-a-debug-loop.patch
+riscv-stacktrace-fix-missing-the-first-frame.patch
+arm64-dts-mediatek-mt8195-fix-vdosys-compatible-stri.patch
+asoc-tas5805m-rework-to-avoid-scheduling-while-atomi.patch
+asoc-tas5805m-add-missing-page-switch.patch
+asoc-fsl_sai-fix-getting-version-from-verid.patch
+asoc-topology-return-enomem-on-memory-allocation-fai.patch
--- /dev/null
+From f49d752abcbafca538d86d265d31578590923963 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 02:08:20 +0000
+Subject: txhash: fix sk->sk_txrehash default
+
+From: Kevin Yang <yyd@google.com>
+
+[ Upstream commit c11204c78d6966c5bda6dd05c3ac5cbb193f93e3 ]
+
+This code fix a bug that sk->sk_txrehash gets its default enable
+value from sysctl_txrehash only when the socket is a TCP listener.
+
+We should have sysctl_txrehash to set the default sk->sk_txrehash,
+no matter TCP, nor listerner/connector.
+
+Tested by following packetdrill:
+ 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+ +0 socket(..., SOCK_DGRAM, IPPROTO_UDP) = 4
+ // SO_TXREHASH == 74, default to sysctl_txrehash == 1
+ +0 getsockopt(3, SOL_SOCKET, 74, [1], [4]) = 0
+ +0 getsockopt(4, SOL_SOCKET, 74, [1], [4]) = 0
+
+Fixes: 26859240e4ee ("txhash: Add socket option to control TX hash rethink behavior")
+Signed-off-by: Kevin Yang <yyd@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 3 ++-
+ net/ipv4/af_inet.c | 1 +
+ net/ipv4/inet_connection_sock.c | 3 ---
+ net/ipv6/af_inet6.c | 1 +
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 30407b2dd2ac4..ba6ea61b3458b 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1524,6 +1524,8 @@ int sk_setsockopt(struct sock *sk, int level, int optname,
+ ret = -EINVAL;
+ break;
+ }
++ if ((u8)val == SOCK_TXREHASH_DEFAULT)
++ val = READ_ONCE(sock_net(sk)->core.sysctl_txrehash);
+ /* Paired with READ_ONCE() in tcp_rtx_synack() */
+ WRITE_ONCE(sk->sk_txrehash, (u8)val);
+ break;
+@@ -3428,7 +3430,6 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+ sk->sk_pacing_rate = ~0UL;
+ WRITE_ONCE(sk->sk_pacing_shift, 10);
+ sk->sk_incoming_cpu = -1;
+- sk->sk_txrehash = SOCK_TXREHASH_DEFAULT;
+
+ sk_rx_queue_clear(sk);
+ /*
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 92d4237862518..5b19b77d5d759 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -347,6 +347,7 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
+ sk->sk_destruct = inet_sock_destruct;
+ sk->sk_protocol = protocol;
+ sk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
++ sk->sk_txrehash = READ_ONCE(net->core.sysctl_txrehash);
+
+ inet->uc_ttl = -1;
+ inet->mc_loop = 1;
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 647b3c6b575ef..7152ede18f115 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -1225,9 +1225,6 @@ int inet_csk_listen_start(struct sock *sk)
+ sk->sk_ack_backlog = 0;
+ inet_csk_delack_init(sk);
+
+- if (sk->sk_txrehash == SOCK_TXREHASH_DEFAULT)
+- sk->sk_txrehash = READ_ONCE(sock_net(sk)->core.sysctl_txrehash);
+-
+ /* There is race window here: we announce ourselves listening,
+ * but this transition is still not validated by get_port().
+ * It is OK, because this socket enters to hash table only
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index 7b0cd54da452b..fb1bf6eb0ff8e 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -221,6 +221,7 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
+ np->pmtudisc = IPV6_PMTUDISC_WANT;
+ np->repflow = net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_ESTABLISHED;
+ sk->sk_ipv6only = net->ipv6.sysctl.bindv6only;
++ sk->sk_txrehash = READ_ONCE(net->core.sysctl_txrehash);
+
+ /* Init the ipv4 part of the socket since we can have sockets
+ * using v6 API for ipv4.
+--
+2.39.0
+
--- /dev/null
+From d93f1a676add49768ec34120ee914cd440687041 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 13:04:48 -0300
+Subject: uapi: add missing ip/ipv6 header dependencies for linux/stddef.h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Herton R. Krzesinski <herton@redhat.com>
+
+[ Upstream commit 03702d4d29be4e2510ec80b248dbbde4e57030d9 ]
+
+Since commit 58e0be1ef6118 ("net: use struct_group to copy ip/ipv6
+header addresses"), ip and ipv6 headers started to use the __struct_group
+definition, which is defined at include/uapi/linux/stddef.h. However,
+linux/stddef.h isn't explicitly included in include/uapi/linux/{ip,ipv6}.h,
+which breaks build of xskxceiver bpf selftest if you install the uapi
+headers in the system:
+
+$ make V=1 xskxceiver -C tools/testing/selftests/bpf
+...
+make: Entering directory '(...)/tools/testing/selftests/bpf'
+gcc -g -O0 -rdynamic -Wall -Werror (...)
+In file included from xskxceiver.c:79:
+/usr/include/linux/ip.h:103:9: error: expected specifier-qualifier-list before ‘__struct_group’
+ 103 | __struct_group(/* no tag */, addrs, /* no attrs */,
+ | ^~~~~~~~~~~~~~
+...
+
+Include the missing <linux/stddef.h> dependency in ip.h and do the
+same for the ipv6.h header.
+
+Fixes: 58e0be1ef611 ("net: use struct_group to copy ip/ipv6 header addresses")
+Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
+Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+Tested-by: Carlos O'Donell <carlos@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/ip.h | 1 +
+ include/uapi/linux/ipv6.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/include/uapi/linux/ip.h b/include/uapi/linux/ip.h
+index 874a92349bf5b..283dec7e36451 100644
+--- a/include/uapi/linux/ip.h
++++ b/include/uapi/linux/ip.h
+@@ -18,6 +18,7 @@
+ #ifndef _UAPI_LINUX_IP_H
+ #define _UAPI_LINUX_IP_H
+ #include <linux/types.h>
++#include <linux/stddef.h>
+ #include <asm/byteorder.h>
+
+ #define IPTOS_TOS_MASK 0x1E
+diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
+index 81f4243bebb1c..53326dfc59ecb 100644
+--- a/include/uapi/linux/ipv6.h
++++ b/include/uapi/linux/ipv6.h
+@@ -4,6 +4,7 @@
+
+ #include <linux/libc-compat.h>
+ #include <linux/types.h>
++#include <linux/stddef.h>
+ #include <linux/in6.h>
+ #include <asm/byteorder.h>
+
+--
+2.39.0
+
--- /dev/null
+From 4da9d47f48e51533ed6d23f71f958f5e3ca63b17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 11:21:30 +0000
+Subject: xfrm: annotate data-race around use_time
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 0a9e5794b21e2d1303759ff8fe5f9215db7757ba ]
+
+KCSAN reported multiple cpus can update use_time
+at the same time.
+
+Adds READ_ONCE()/WRITE_ONCE() annotations.
+
+Note that 32bit arches are not fully protected,
+but they will probably no longer be supported/used in 2106.
+
+BUG: KCSAN: data-race in __xfrm_policy_check / __xfrm_policy_check
+
+write to 0xffff88813e7ec108 of 8 bytes by interrupt on cpu 0:
+__xfrm_policy_check+0x6ae/0x17f0 net/xfrm/xfrm_policy.c:3664
+__xfrm_policy_check2 include/net/xfrm.h:1174 [inline]
+xfrm_policy_check include/net/xfrm.h:1179 [inline]
+xfrm6_policy_check+0x2e9/0x320 include/net/xfrm.h:1189
+udpv6_queue_rcv_one_skb+0x48/0xa30 net/ipv6/udp.c:703
+udpv6_queue_rcv_skb+0x2d6/0x310 net/ipv6/udp.c:792
+udp6_unicast_rcv_skb+0x16b/0x190 net/ipv6/udp.c:935
+__udp6_lib_rcv+0x84b/0x9b0 net/ipv6/udp.c:1020
+udpv6_rcv+0x4b/0x50 net/ipv6/udp.c:1133
+ip6_protocol_deliver_rcu+0x99e/0x1020 net/ipv6/ip6_input.c:439
+ip6_input_finish net/ipv6/ip6_input.c:484 [inline]
+NF_HOOK include/linux/netfilter.h:302 [inline]
+ip6_input+0xca/0x180 net/ipv6/ip6_input.c:493
+dst_input include/net/dst.h:454 [inline]
+ip6_rcv_finish+0x1e9/0x2d0 net/ipv6/ip6_input.c:79
+NF_HOOK include/linux/netfilter.h:302 [inline]
+ipv6_rcv+0x85/0x140 net/ipv6/ip6_input.c:309
+__netif_receive_skb_one_core net/core/dev.c:5482 [inline]
+__netif_receive_skb+0x8b/0x1b0 net/core/dev.c:5596
+process_backlog+0x23f/0x3b0 net/core/dev.c:5924
+__napi_poll+0x65/0x390 net/core/dev.c:6485
+napi_poll net/core/dev.c:6552 [inline]
+net_rx_action+0x37e/0x730 net/core/dev.c:6663
+__do_softirq+0xf2/0x2c7 kernel/softirq.c:571
+do_softirq+0xb1/0xf0 kernel/softirq.c:472
+__local_bh_enable_ip+0x6f/0x80 kernel/softirq.c:396
+__raw_read_unlock_bh include/linux/rwlock_api_smp.h:257 [inline]
+_raw_read_unlock_bh+0x17/0x20 kernel/locking/spinlock.c:284
+wg_socket_send_skb_to_peer+0x107/0x120 drivers/net/wireguard/socket.c:184
+wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
+wg_packet_tx_worker+0x142/0x360 drivers/net/wireguard/send.c:276
+process_one_work+0x3d3/0x720 kernel/workqueue.c:2289
+worker_thread+0x618/0xa70 kernel/workqueue.c:2436
+kthread+0x1a9/0x1e0 kernel/kthread.c:376
+ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
+
+write to 0xffff88813e7ec108 of 8 bytes by interrupt on cpu 1:
+__xfrm_policy_check+0x6ae/0x17f0 net/xfrm/xfrm_policy.c:3664
+__xfrm_policy_check2 include/net/xfrm.h:1174 [inline]
+xfrm_policy_check include/net/xfrm.h:1179 [inline]
+xfrm6_policy_check+0x2e9/0x320 include/net/xfrm.h:1189
+udpv6_queue_rcv_one_skb+0x48/0xa30 net/ipv6/udp.c:703
+udpv6_queue_rcv_skb+0x2d6/0x310 net/ipv6/udp.c:792
+udp6_unicast_rcv_skb+0x16b/0x190 net/ipv6/udp.c:935
+__udp6_lib_rcv+0x84b/0x9b0 net/ipv6/udp.c:1020
+udpv6_rcv+0x4b/0x50 net/ipv6/udp.c:1133
+ip6_protocol_deliver_rcu+0x99e/0x1020 net/ipv6/ip6_input.c:439
+ip6_input_finish net/ipv6/ip6_input.c:484 [inline]
+NF_HOOK include/linux/netfilter.h:302 [inline]
+ip6_input+0xca/0x180 net/ipv6/ip6_input.c:493
+dst_input include/net/dst.h:454 [inline]
+ip6_rcv_finish+0x1e9/0x2d0 net/ipv6/ip6_input.c:79
+NF_HOOK include/linux/netfilter.h:302 [inline]
+ipv6_rcv+0x85/0x140 net/ipv6/ip6_input.c:309
+__netif_receive_skb_one_core net/core/dev.c:5482 [inline]
+__netif_receive_skb+0x8b/0x1b0 net/core/dev.c:5596
+process_backlog+0x23f/0x3b0 net/core/dev.c:5924
+__napi_poll+0x65/0x390 net/core/dev.c:6485
+napi_poll net/core/dev.c:6552 [inline]
+net_rx_action+0x37e/0x730 net/core/dev.c:6663
+__do_softirq+0xf2/0x2c7 kernel/softirq.c:571
+do_softirq+0xb1/0xf0 kernel/softirq.c:472
+__local_bh_enable_ip+0x6f/0x80 kernel/softirq.c:396
+__raw_read_unlock_bh include/linux/rwlock_api_smp.h:257 [inline]
+_raw_read_unlock_bh+0x17/0x20 kernel/locking/spinlock.c:284
+wg_socket_send_skb_to_peer+0x107/0x120 drivers/net/wireguard/socket.c:184
+wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
+wg_packet_tx_worker+0x142/0x360 drivers/net/wireguard/send.c:276
+process_one_work+0x3d3/0x720 kernel/workqueue.c:2289
+worker_thread+0x618/0xa70 kernel/workqueue.c:2436
+kthread+0x1a9/0x1e0 kernel/kthread.c:376
+ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
+
+value changed: 0x0000000063c62d6f -> 0x0000000063c62d70
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 1 PID: 4185 Comm: kworker/1:2 Tainted: G W 6.2.0-rc4-syzkaller-00009-gd532dd102151-dirty #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
+Workqueue: wg-crypt-wg0 wg_packet_tx_worker
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_policy.c | 11 +++++++----
+ net/xfrm/xfrm_state.c | 10 +++++-----
+ 2 files changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index e392d8d05e0ca..52538d5360673 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -336,7 +336,7 @@ static void xfrm_policy_timer(struct timer_list *t)
+ }
+ if (xp->lft.hard_use_expires_seconds) {
+ time64_t tmo = xp->lft.hard_use_expires_seconds +
+- (xp->curlft.use_time ? : xp->curlft.add_time) - now;
++ (READ_ONCE(xp->curlft.use_time) ? : xp->curlft.add_time) - now;
+ if (tmo <= 0)
+ goto expired;
+ if (tmo < next)
+@@ -354,7 +354,7 @@ static void xfrm_policy_timer(struct timer_list *t)
+ }
+ if (xp->lft.soft_use_expires_seconds) {
+ time64_t tmo = xp->lft.soft_use_expires_seconds +
+- (xp->curlft.use_time ? : xp->curlft.add_time) - now;
++ (READ_ONCE(xp->curlft.use_time) ? : xp->curlft.add_time) - now;
+ if (tmo <= 0) {
+ warn = 1;
+ tmo = XFRM_KM_TIMEOUT;
+@@ -3586,7 +3586,8 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
+ return 1;
+ }
+
+- pol->curlft.use_time = ktime_get_real_seconds();
++ /* This lockless write can happen from different cpus. */
++ WRITE_ONCE(pol->curlft.use_time, ktime_get_real_seconds());
+
+ pols[0] = pol;
+ npols++;
+@@ -3601,7 +3602,9 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
+ xfrm_pol_put(pols[0]);
+ return 0;
+ }
+- pols[1]->curlft.use_time = ktime_get_real_seconds();
++ /* This write can happen from different cpus. */
++ WRITE_ONCE(pols[1]->curlft.use_time,
++ ktime_get_real_seconds());
+ npols++;
+ }
+ }
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 3d2fe7712ac5b..0f88cb6fc3c22 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -572,7 +572,7 @@ static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me)
+ }
+ if (x->lft.hard_use_expires_seconds) {
+ long tmo = x->lft.hard_use_expires_seconds +
+- (x->curlft.use_time ? : now) - now;
++ (READ_ONCE(x->curlft.use_time) ? : now) - now;
+ if (tmo <= 0)
+ goto expired;
+ if (tmo < next)
+@@ -594,7 +594,7 @@ static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me)
+ }
+ if (x->lft.soft_use_expires_seconds) {
+ long tmo = x->lft.soft_use_expires_seconds +
+- (x->curlft.use_time ? : now) - now;
++ (READ_ONCE(x->curlft.use_time) ? : now) - now;
+ if (tmo <= 0)
+ warn = 1;
+ else if (tmo < next)
+@@ -1754,7 +1754,7 @@ int xfrm_state_update(struct xfrm_state *x)
+
+ hrtimer_start(&x1->mtimer, ktime_set(1, 0),
+ HRTIMER_MODE_REL_SOFT);
+- if (x1->curlft.use_time)
++ if (READ_ONCE(x1->curlft.use_time))
+ xfrm_state_check_expire(x1);
+
+ if (x->props.smark.m || x->props.smark.v || x->if_id) {
+@@ -1786,8 +1786,8 @@ EXPORT_SYMBOL(xfrm_state_update);
+
+ int xfrm_state_check_expire(struct xfrm_state *x)
+ {
+- if (!x->curlft.use_time)
+- x->curlft.use_time = ktime_get_real_seconds();
++ if (!READ_ONCE(x->curlft.use_time))
++ WRITE_ONCE(x->curlft.use_time, ktime_get_real_seconds());
+
+ if (x->curlft.bytes >= x->lft.hard_byte_limit ||
+ x->curlft.packets >= x->lft.hard_packet_limit) {
+--
+2.39.0
+
--- /dev/null
+From 289060cf8e1612a46ceaaa27042bd82b14bff7f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 12:14:50 +0300
+Subject: xfrm: compat: change expression for switch in xfrm_xlate64
+
+From: Anastasia Belova <abelova@astralinux.ru>
+
+[ Upstream commit eb6c59b735aa6cca77cdbb59cc69d69a0d63d986 ]
+
+Compare XFRM_MSG_NEWSPDINFO (value from netlink
+configuration messages enum) with nlh_src->nlmsg_type
+instead of nlh_src->nlmsg_type - XFRM_MSG_BASE.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 4e9505064f58 ("net/xfrm/compat: Copy xfrm_spdattr_type_t atributes")
+Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
+Acked-by: Dmitry Safonov <0x7f454c46@gmail.com>
+Tested-by: Dmitry Safonov <0x7f454c46@gmail.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_compat.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/xfrm/xfrm_compat.c b/net/xfrm/xfrm_compat.c
+index a0f62fa02e06e..12405aa5bce84 100644
+--- a/net/xfrm/xfrm_compat.c
++++ b/net/xfrm/xfrm_compat.c
+@@ -302,7 +302,7 @@ static int xfrm_xlate64(struct sk_buff *dst, const struct nlmsghdr *nlh_src)
+ nla_for_each_attr(nla, attrs, len, remaining) {
+ int err;
+
+- switch (type) {
++ switch (nlh_src->nlmsg_type) {
+ case XFRM_MSG_NEWSPDINFO:
+ err = xfrm_nla_cpy(dst, nla, nla_len(nla));
+ break;
+--
+2.39.0
+
--- /dev/null
+From 2ed1d1d69e54eb060f4f961d61a4b18ca696e180 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 13:02:49 +0000
+Subject: xfrm/compat: prevent potential spectre v1 gadget in
+ xfrm_xlate32_attr()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b6ee896385380aa621102e8ea402ba12db1cabff ]
+
+ int type = nla_type(nla);
+
+ if (type > XFRMA_MAX) {
+ return -EOPNOTSUPP;
+ }
+
+@type is then used as an array index and can be used
+as a Spectre v1 gadget.
+
+ if (nla_len(nla) < compat_policy[type].len) {
+
+array_index_nospec() can be used to prevent leaking
+content of kernel memory to malicious users.
+
+Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Dmitry Safonov <dima@arista.com>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Reviewed-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_compat.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/xfrm/xfrm_compat.c b/net/xfrm/xfrm_compat.c
+index 12405aa5bce84..8cbf45a8bcdc2 100644
+--- a/net/xfrm/xfrm_compat.c
++++ b/net/xfrm/xfrm_compat.c
+@@ -5,6 +5,7 @@
+ * Based on code and translator idea by: Florian Westphal <fw@strlen.de>
+ */
+ #include <linux/compat.h>
++#include <linux/nospec.h>
+ #include <linux/xfrm.h>
+ #include <net/xfrm.h>
+
+@@ -437,6 +438,7 @@ static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla,
+ NL_SET_ERR_MSG(extack, "Bad attribute");
+ return -EOPNOTSUPP;
+ }
++ type = array_index_nospec(type, XFRMA_MAX + 1);
+ if (nla_len(nla) < compat_policy[type].len) {
+ NL_SET_ERR_MSG(extack, "Attribute bad length");
+ return -EOPNOTSUPP;
+--
+2.39.0
+
--- /dev/null
+From c6efc58ef397e1aed6cc0628109360a66df8a3b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 11:33:50 -0500
+Subject: xfrm: fix bug with DSCP copy to v6 from v4 tunnel
+
+From: Christian Hopps <chopps@chopps.org>
+
+[ Upstream commit 6028da3f125fec34425dbd5fec18e85d372b2af6 ]
+
+When copying the DSCP bits for decap-dscp into IPv6 don't assume the
+outer encap is always IPv6. Instead, as with the inner IPv4 case, copy
+the DSCP bits from the correctly saved "tos" value in the control block.
+
+Fixes: 227620e29509 ("[IPSEC]: Separate inner/outer mode processing on input")
+Signed-off-by: Christian Hopps <chopps@chopps.org>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_input.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index 97074f6f2bdee..2defd89da700d 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -279,8 +279,7 @@ static int xfrm6_remove_tunnel_encap(struct xfrm_state *x, struct sk_buff *skb)
+ goto out;
+
+ if (x->props.flags & XFRM_STATE_DECAP_DSCP)
+- ipv6_copy_dscp(ipv6_get_dsfield(ipv6_hdr(skb)),
+- ipipv6_hdr(skb));
++ ipv6_copy_dscp(XFRM_MODE_SKB_CB(skb)->tos, ipipv6_hdr(skb));
+ if (!(x->props.flags & XFRM_STATE_NOECN))
+ ipip6_ecn_decapsulate(skb);
+
+--
+2.39.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
