--- /dev/null
+From cf4e08bab5099b5df64699ec1c51217829627e83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 13:02:13 +0300
+Subject: ALSA: pci: lx6464es: fix a debug loop
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit 5dac9f8dc25fefd9d928b98f6477ff3daefd73e3 ]
+
+This loop accidentally reuses the "i" iterator for both the inside and
+the outside loop. The value of MAX_STREAM_BUFFER is 5. I believe that
+chip->rmh.stat_len is in the 2-12 range. If the value of .stat_len is
+4 or more then it will loop exactly one time, but if it's less then it
+is a forever loop.
+
+It looks like it was supposed to combined into one loop where
+conditions are checked.
+
+Fixes: 8e6320064c33 ("ALSA: lx_core: Remove useless #if 0 .. #endif")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/r/Y9jnJTis/mRFJAQp@kili
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/lx6464es/lx_core.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
+index d3f58a3d17fbc..b5b0d43bb8dcd 100644
+--- a/sound/pci/lx6464es/lx_core.c
++++ b/sound/pci/lx6464es/lx_core.c
+@@ -493,12 +493,11 @@ int lx_buffer_ask(struct lx6464es *chip, u32 pipe, int is_capture,
+ dev_dbg(chip->card->dev,
+ "CMD_08_ASK_BUFFERS: needed %d, freed %d\n",
+ *r_needed, *r_freed);
+- for (i = 0; i < MAX_STREAM_BUFFER; ++i) {
+- for (i = 0; i != chip->rmh.stat_len; ++i)
+- dev_dbg(chip->card->dev,
+- " stat[%d]: %x, %x\n", i,
+- chip->rmh.stat[i],
+- chip->rmh.stat[i] & MASK_DATA_SIZE);
++ for (i = 0; i < MAX_STREAM_BUFFER && i < chip->rmh.stat_len;
++ ++i) {
++ dev_dbg(chip->card->dev, " stat[%d]: %x, %x\n", i,
++ chip->rmh.stat[i],
++ chip->rmh.stat[i] & MASK_DATA_SIZE);
+ }
+ }
+
+--
+2.39.0
+
--- /dev/null
+From bc778462de163cb08c5c3dfa51e9584fc4746cdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 22:04:28 +0100
+Subject: ASoC: topology: Return -ENOMEM on memory allocation failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit c173ee5b2fa6195066674d66d1d7e191010fb1ff ]
+
+When handling error path, ret needs to be set to correct value.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Fixes: d29d41e28eea ("ASoC: topology: Add support for multiple kcontrol types to a widget")
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Link: https://lore.kernel.org/r/20230207210428.2076354-1-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index eff8d4f715611..55b69e3c67186 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -1480,13 +1480,17 @@ static int soc_tplg_dapm_widget_create(struct soc_tplg *tplg,
+
+ template.num_kcontrols = le32_to_cpu(w->num_kcontrols);
+ kc = devm_kcalloc(tplg->dev, le32_to_cpu(w->num_kcontrols), sizeof(*kc), GFP_KERNEL);
+- if (!kc)
++ if (!kc) {
++ ret = -ENOMEM;
+ goto hdr_err;
++ }
+
+ kcontrol_type = devm_kcalloc(tplg->dev, le32_to_cpu(w->num_kcontrols), sizeof(unsigned int),
+ GFP_KERNEL);
+- if (!kcontrol_type)
++ if (!kcontrol_type) {
++ ret = -ENOMEM;
+ goto hdr_err;
++ }
+
+ for (i = 0; i < w->num_kcontrols; i++) {
+ control_hdr = (struct snd_soc_tplg_ctl_hdr *)tplg->pos;
+--
+2.39.0
+
--- /dev/null
+From b80ce135a02bfad0cef814a98804843e03ecaabe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 17:32:55 +0800
+Subject: bonding: fix error checking in bond_debug_reregister()
+
+From: Qi Zheng <zhengqi.arch@bytedance.com>
+
+[ Upstream commit cbe83191d40d8925b7a99969d037d2a0caf69294 ]
+
+Since commit ff9fb72bc077 ("debugfs: return error values,
+not NULL") changed return value of debugfs_rename() in
+error cases from %NULL to %ERR_PTR(-ERROR), we should
+also check error values instead of NULL.
+
+Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL")
+Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com>
+Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
+Link: https://lore.kernel.org/r/20230202093256.32458-1-zhengqi.arch@bytedance.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/bonding/bond_debugfs.c b/drivers/net/bonding/bond_debugfs.c
+index 4f9b4a18c74cd..5940945266489 100644
+--- a/drivers/net/bonding/bond_debugfs.c
++++ b/drivers/net/bonding/bond_debugfs.c
+@@ -76,7 +76,7 @@ void bond_debug_reregister(struct bonding *bond)
+
+ d = debugfs_rename(bonding_debug_root, bond->debug_dir,
+ bonding_debug_root, bond->dev->name);
+- if (d) {
++ if (!IS_ERR(d)) {
+ bond->debug_dir = d;
+ } else {
+ netdev_warn(bond->dev, "failed to reregister, so just unregister old one\n");
+--
+2.39.0
+
--- /dev/null
+From cd828c5ce15fffda1942e2ddd436bbf4db4f0da1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 13:16:02 -0500
+Subject: IB/hfi1: Restore allocated resources on failed copyout
+
+From: Dean Luick <dean.luick@cornelisnetworks.com>
+
+[ Upstream commit 6601fc0d15ffc20654e39486f9bef35567106d68 ]
+
+Fix a resource leak if an error occurs.
+
+Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL")
+Signed-off-by: Dean Luick <dean.luick@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Link: https://lore.kernel.org/r/167354736291.2132367.10894218740150168180.stgit@awfm-02.cornelisnetworks.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/file_ops.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
+index 686d170a5947e..1c1172aeb36e9 100644
+--- a/drivers/infiniband/hw/hfi1/file_ops.c
++++ b/drivers/infiniband/hw/hfi1/file_ops.c
+@@ -1318,12 +1318,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg,
+ addr = arg + offsetof(struct hfi1_tid_info, tidcnt);
+ if (copy_to_user((void __user *)addr, &tinfo.tidcnt,
+ sizeof(tinfo.tidcnt)))
+- return -EFAULT;
++ ret = -EFAULT;
+
+ addr = arg + offsetof(struct hfi1_tid_info, length);
+- if (copy_to_user((void __user *)addr, &tinfo.length,
++ if (!ret && copy_to_user((void __user *)addr, &tinfo.length,
+ sizeof(tinfo.length)))
+ ret = -EFAULT;
++
++ if (ret)
++ hfi1_user_exp_rcv_invalid(fd, &tinfo);
+ }
+
+ return ret;
+--
+2.39.0
+
--- /dev/null
+From fee0c5d4e9971ac9817e2e0805df71e11ff40b15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 20:24:18 +0200
+Subject: IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
+
+From: Dragos Tatulea <dtatulea@nvidia.com>
+
+[ Upstream commit e632291a2dbce45a24cddeb5fe28fe71d724ba43 ]
+
+The cited commit creates child PKEY interfaces over netlink will
+multiple tx and rx queues, but some devices doesn't support more than 1
+tx and 1 rx queues. This causes to a crash when traffic is sent over the
+PKEY interface due to the parent having a single queue but the child
+having multiple queues.
+
+This patch fixes the number of queues to 1 for legacy IPoIB at the
+earliest possible point in time.
+
+BUG: kernel NULL pointer dereference, address: 000000000000036b
+PGD 0 P4D 0
+Oops: 0000 [#1] SMP
+CPU: 4 PID: 209665 Comm: python3 Not tainted 6.1.0_for_upstream_min_debug_2022_12_12_17_02 #1
+Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+RIP: 0010:kmem_cache_alloc+0xcb/0x450
+Code: ce 7e 49 8b 50 08 49 83 78 10 00 4d 8b 28 0f 84 cb 02 00 00 4d 85 ed 0f 84 c2 02 00 00 41 8b 44 24 28 48 8d 4a
+01 49 8b 3c 24 <49> 8b 5c 05 00 4c 89 e8 65 48 0f c7 0f 0f 94 c0 84 c0 74 b8 41 8b
+RSP: 0018:ffff88822acbbab8 EFLAGS: 00010202
+RAX: 0000000000000070 RBX: ffff8881c28e3e00 RCX: 00000000064f8dae
+RDX: 00000000064f8dad RSI: 0000000000000a20 RDI: 0000000000030d00
+RBP: 0000000000000a20 R08: ffff8882f5d30d00 R09: ffff888104032f40
+R10: ffff88810fade828 R11: 736f6d6570736575 R12: ffff88810081c000
+R13: 00000000000002fb R14: ffffffff817fc865 R15: 0000000000000000
+FS: 00007f9324ff9700(0000) GS:ffff8882f5d00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 000000000000036b CR3: 00000001125af004 CR4: 0000000000370ea0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ skb_clone+0x55/0xd0
+ ip6_finish_output2+0x3fe/0x690
+ ip6_finish_output+0xfa/0x310
+ ip6_send_skb+0x1e/0x60
+ udp_v6_send_skb+0x1e5/0x420
+ udpv6_sendmsg+0xb3c/0xe60
+ ? ip_mc_finish_output+0x180/0x180
+ ? __switch_to_asm+0x3a/0x60
+ ? __switch_to_asm+0x34/0x60
+ sock_sendmsg+0x33/0x40
+ __sys_sendto+0x103/0x160
+ ? _copy_to_user+0x21/0x30
+ ? kvm_clock_get_cycles+0xd/0x10
+ ? ktime_get_ts64+0x49/0xe0
+ __x64_sys_sendto+0x25/0x30
+ do_syscall_64+0x3d/0x90
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+RIP: 0033:0x7f9374f1ed14
+Code: 42 41 f8 ff 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b
+7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 68 41 f8 ff 48 8b
+RSP: 002b:00007f9324ff7bd0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
+RAX: ffffffffffffffda RBX: 00007f9324ff7cc8 RCX: 00007f9374f1ed14
+RDX: 00000000000002fb RSI: 00007f93000052f0 RDI: 0000000000000030
+RBP: 0000000000000000 R08: 00007f9324ff7d40 R09: 000000000000001c
+R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
+R13: 000000012a05f200 R14: 0000000000000001 R15: 00007f9374d57bdc
+ </TASK>
+
+Fixes: dbc94a0fb817 ("IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces")
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Link: https://lore.kernel.org/r/95eb6b74c7cf49fa46281f9d056d685c9fa11d38.1674584576.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 0aa8629fdf62e..1ea95f8009b82 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -2197,6 +2197,14 @@ int ipoib_intf_init(struct ib_device *hca, u32 port, const char *name,
+ rn->attach_mcast = ipoib_mcast_attach;
+ rn->detach_mcast = ipoib_mcast_detach;
+ rn->hca = hca;
++
++ rc = netif_set_real_num_tx_queues(dev, 1);
++ if (rc)
++ goto out;
++
++ rc = netif_set_real_num_rx_queues(dev, 1);
++ if (rc)
++ goto out;
+ }
+
+ priv->rn_ops = dev->netdev_ops;
+--
+2.39.0
+
--- /dev/null
+From 21bf121c8133936121a465dcaec544cc67ec0aa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 14:06:40 -0800
+Subject: ice: Do not use WQ_MEM_RECLAIM flag for workqueue
+
+From: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+
+[ Upstream commit 4d159f7884f78b1aacb99b4fc37d1e3cb1194e39 ]
+
+When both ice and the irdma driver are loaded, a warning in
+check_flush_dependency is being triggered. This is due to ice driver
+workqueue being allocated with the WQ_MEM_RECLAIM flag and the irdma one
+is not.
+
+According to kernel documentation, this flag should be set if the
+workqueue will be involved in the kernel's memory reclamation flow.
+Since it is not, there is no need for the ice driver's WQ to have this
+flag set so remove it.
+
+Example trace:
+
+[ +0.000004] workqueue: WQ_MEM_RECLAIM ice:ice_service_task [ice] is flushing !WQ_MEM_RECLAIM infiniband:0x0
+[ +0.000139] WARNING: CPU: 0 PID: 728 at kernel/workqueue.c:2632 check_flush_dependency+0x178/0x1a0
+[ +0.000011] Modules linked in: bonding tls xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_cha
+in_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc rfkill vfat fat intel_rapl_msr intel
+_rapl_common isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct1
+0dif_pclmul crc32_pclmul ghash_clmulni_intel rapl intel_cstate rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_
+core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_cm iw_cm iTCO_wdt iTCO_vendor_support ipmi_ssif irdma mei_me ib_uverbs
+ib_core intel_uncore joydev pcspkr i2c_i801 acpi_ipmi mei lpc_ich i2c_smbus intel_pch_thermal ioatdma ipmi_si acpi_power_meter
+acpi_pad xfs libcrc32c sd_mod t10_pi crc64_rocksoft crc64 sg ahci ixgbe libahci ice i40e igb crc32c_intel mdio i2c_algo_bit liba
+ta dca wmi dm_mirror dm_region_hash dm_log dm_mod ipmi_devintf ipmi_msghandler fuse
+[ +0.000161] [last unloaded: bonding]
+[ +0.000006] CPU: 0 PID: 728 Comm: kworker/0:2 Tainted: G S 6.2.0-rc2_next-queue-13jan-00458-gc20aabd57164 #1
+[ +0.000006] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020
+[ +0.000003] Workqueue: ice ice_service_task [ice]
+[ +0.000127] RIP: 0010:check_flush_dependency+0x178/0x1a0
+[ +0.000005] Code: 89 8e 02 01 e8 49 3d 40 00 49 8b 55 18 48 8d 8d d0 00 00 00 48 8d b3 d0 00 00 00 4d 89 e0 48 c7 c7 e0 3b 08
+9f e8 bb d3 07 01 <0f> 0b e9 be fe ff ff 80 3d 24 89 8e 02 00 0f 85 6b ff ff ff e9 06
+[ +0.000004] RSP: 0018:ffff88810a39f990 EFLAGS: 00010282
+[ +0.000005] RAX: 0000000000000000 RBX: ffff888141bc2400 RCX: 0000000000000000
+[ +0.000004] RDX: 0000000000000001 RSI: dffffc0000000000 RDI: ffffffffa1213a80
+[ +0.000003] RBP: ffff888194bf3400 R08: ffffed117b306112 R09: ffffed117b306112
+[ +0.000003] R10: ffff888bd983088b R11: ffffed117b306111 R12: 0000000000000000
+[ +0.000003] R13: ffff888111f84d00 R14: ffff88810a3943ac R15: ffff888194bf3400
+[ +0.000004] FS: 0000000000000000(0000) GS:ffff888bd9800000(0000) knlGS:0000000000000000
+[ +0.000003] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ +0.000003] CR2: 000056035b208b60 CR3: 000000017795e005 CR4: 00000000007706f0
+[ +0.000003] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ +0.000003] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ +0.000002] PKRU: 55555554
+[ +0.000003] Call Trace:
+[ +0.000002] <TASK>
+[ +0.000003] __flush_workqueue+0x203/0x840
+[ +0.000006] ? mutex_unlock+0x84/0xd0
+[ +0.000008] ? __pfx_mutex_unlock+0x10/0x10
+[ +0.000004] ? __pfx___flush_workqueue+0x10/0x10
+[ +0.000006] ? mutex_lock+0xa3/0xf0
+[ +0.000005] ib_cache_cleanup_one+0x39/0x190 [ib_core]
+[ +0.000174] __ib_unregister_device+0x84/0xf0 [ib_core]
+[ +0.000094] ib_unregister_device+0x25/0x30 [ib_core]
+[ +0.000093] irdma_ib_unregister_device+0x97/0xc0 [irdma]
+[ +0.000064] ? __pfx_irdma_ib_unregister_device+0x10/0x10 [irdma]
+[ +0.000059] ? up_write+0x5c/0x90
+[ +0.000005] irdma_remove+0x36/0x90 [irdma]
+[ +0.000062] auxiliary_bus_remove+0x32/0x50
+[ +0.000007] device_release_driver_internal+0xfa/0x1c0
+[ +0.000005] bus_remove_device+0x18a/0x260
+[ +0.000007] device_del+0x2e5/0x650
+[ +0.000005] ? __pfx_device_del+0x10/0x10
+[ +0.000003] ? mutex_unlock+0x84/0xd0
+[ +0.000004] ? __pfx_mutex_unlock+0x10/0x10
+[ +0.000004] ? _raw_spin_unlock+0x18/0x40
+[ +0.000005] ice_unplug_aux_dev+0x52/0x70 [ice]
+[ +0.000160] ice_service_task+0x1309/0x14f0 [ice]
+[ +0.000134] ? __pfx___schedule+0x10/0x10
+[ +0.000006] process_one_work+0x3b1/0x6c0
+[ +0.000008] worker_thread+0x69/0x670
+[ +0.000005] ? __kthread_parkme+0xec/0x110
+[ +0.000007] ? __pfx_worker_thread+0x10/0x10
+[ +0.000005] kthread+0x17f/0x1b0
+[ +0.000005] ? __pfx_kthread+0x10/0x10
+[ +0.000004] ret_from_fork+0x29/0x50
+[ +0.000009] </TASK>
+
+Fixes: 940b61af02f4 ("ice: Initialize PF and setup miscellaneous interrupt")
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Signed-off-by: Marcin Szycik <marcin.szycik@linux.intel.com>
+Tested-by: Jakub Andrysiak <jakub.andrysiak@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 348105aa5cf54..6f674cd117d3d 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -5130,7 +5130,7 @@ static int __init ice_module_init(void)
+ pr_info("%s\n", ice_driver_string);
+ pr_info("%s\n", ice_copyright);
+
+- ice_wq = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0, KBUILD_MODNAME);
++ ice_wq = alloc_workqueue("%s", 0, 0, KBUILD_MODNAME);
+ if (!ice_wq) {
+ pr_err("Failed to create workqueue\n");
+ return -ENOMEM;
+--
+2.39.0
+
--- /dev/null
+From a30da95ce92985ed3449710682b38619c4e621ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 15:58:18 -0800
+Subject: igc: Add ndo_tx_timeout support
+
+From: Sasha Neftin <sasha.neftin@intel.com>
+
+[ Upstream commit 9b275176270efd18f2f4e328b32be1bad34c4c0d ]
+
+On some platforms, 100/1000/2500 speeds seem to have sometimes problems
+reporting false positive tx unit hang during stressful UDP traffic. Likely
+other Intel drivers introduce responses to a tx hang. Update the 'tx hang'
+comparator with the comparison of the head and tail of ring pointers and
+restore the tx_timeout_factor to the previous value (one).
+
+This can be test by using netperf or iperf3 applications.
+Example:
+iperf3 -s -p 5001
+iperf3 -c 192.168.0.2 --udp -p 5001 --time 600 -b 0
+
+netserver -p 16604
+netperf -H 192.168.0.2 -l 600 -p 16604 -t UDP_STREAM -- -m 64000
+
+Fixes: b27b8dc77b5e ("igc: Increase timeout value for Speed 100/1000/2500")
+Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Naama Meir <naamax.meir@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://lore.kernel.org/r/20230206235818.662384-1-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 25 +++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
+index 3726c8413c741..bde3fea2c442e 100644
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -2892,7 +2892,9 @@ static bool igc_clean_tx_irq(struct igc_q_vector *q_vector, int napi_budget)
+ if (tx_buffer->next_to_watch &&
+ time_after(jiffies, tx_buffer->time_stamp +
+ (adapter->tx_timeout_factor * HZ)) &&
+- !(rd32(IGC_STATUS) & IGC_STATUS_TXOFF)) {
++ !(rd32(IGC_STATUS) & IGC_STATUS_TXOFF) &&
++ (rd32(IGC_TDH(tx_ring->reg_idx)) !=
++ readl(tx_ring->tail))) {
+ /* detected Tx unit hang */
+ netdev_err(tx_ring->netdev,
+ "Detected Tx Unit Hang\n"
+@@ -5019,6 +5021,24 @@ static int igc_change_mtu(struct net_device *netdev, int new_mtu)
+ return 0;
+ }
+
++/**
++ * igc_tx_timeout - Respond to a Tx Hang
++ * @netdev: network interface device structure
++ * @txqueue: queue number that timed out
++ **/
++static void igc_tx_timeout(struct net_device *netdev,
++ unsigned int __always_unused txqueue)
++{
++ struct igc_adapter *adapter = netdev_priv(netdev);
++ struct igc_hw *hw = &adapter->hw;
++
++ /* Do the reset outside of interrupt context */
++ adapter->tx_timeout_count++;
++ schedule_work(&adapter->reset_task);
++ wr32(IGC_EICS,
++ (adapter->eims_enable_mask & ~adapter->eims_other));
++}
++
+ /**
+ * igc_get_stats64 - Get System Network Statistics
+ * @netdev: network interface device structure
+@@ -5446,7 +5466,7 @@ static void igc_watchdog_task(struct work_struct *work)
+ case SPEED_100:
+ case SPEED_1000:
+ case SPEED_2500:
+- adapter->tx_timeout_factor = 7;
++ adapter->tx_timeout_factor = 1;
+ break;
+ }
+
+@@ -6264,6 +6284,7 @@ static const struct net_device_ops igc_netdev_ops = {
+ .ndo_set_rx_mode = igc_set_rx_mode,
+ .ndo_set_mac_address = igc_set_mac,
+ .ndo_change_mtu = igc_change_mtu,
++ .ndo_tx_timeout = igc_tx_timeout,
+ .ndo_get_stats64 = igc_get_stats64,
+ .ndo_fix_features = igc_fix_features,
+ .ndo_set_features = igc_set_features,
+--
+2.39.0
+
--- /dev/null
+From 6117cc0f6ab23260060265699a51020133839c1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 13:55:35 -0800
+Subject: ionic: clean interrupt before enabling queue to avoid credit race
+
+From: Neel Patel <neel.patel@amd.com>
+
+[ Upstream commit e8797a058466b60fc5a3291b92430c93ba90eaff ]
+
+Clear the interrupt credits before enabling the queue rather
+than after to be sure that the enabled queue starts at 0 and
+that we don't wipe away possible credits after enabling the
+queue.
+
+Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling")
+Signed-off-by: Neel Patel <neel.patel@amd.com>
+Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+index 886c997a3ad14..6fbd2a51d66ce 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -268,6 +268,7 @@ static int ionic_qcq_enable(struct ionic_qcq *qcq)
+ .oper = IONIC_Q_ENABLE,
+ },
+ };
++ int ret;
+
+ idev = &lif->ionic->idev;
+ dev = lif->ionic->dev;
+@@ -275,16 +276,24 @@ static int ionic_qcq_enable(struct ionic_qcq *qcq)
+ dev_dbg(dev, "q_enable.index %d q_enable.qtype %d\n",
+ ctx.cmd.q_control.index, ctx.cmd.q_control.type);
+
++ if (qcq->flags & IONIC_QCQ_F_INTR)
++ ionic_intr_clean(idev->intr_ctrl, qcq->intr.index);
++
++ ret = ionic_adminq_post_wait(lif, &ctx);
++ if (ret)
++ return ret;
++
++ if (qcq->napi.poll)
++ napi_enable(&qcq->napi);
++
+ if (qcq->flags & IONIC_QCQ_F_INTR) {
+ irq_set_affinity_hint(qcq->intr.vector,
+ &qcq->intr.affinity_mask);
+- napi_enable(&qcq->napi);
+- ionic_intr_clean(idev->intr_ctrl, qcq->intr.index);
+ ionic_intr_mask(idev->intr_ctrl, qcq->intr.index,
+ IONIC_INTR_MASK_CLEAR);
+ }
+
+- return ionic_adminq_post_wait(lif, &ctx);
++ return 0;
+ }
+
+ static int ionic_qcq_disable(struct ionic_qcq *qcq, bool send_to_hw)
+--
+2.39.0
+
--- /dev/null
+From 7b49c31c87bdca771508abeaeddfc18d74ba741e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Feb 2023 16:07:13 +0200
+Subject: net: dsa: mt7530: don't change PVC_EG_TAG when CPU port becomes
+ VLAN-aware
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 0b6d6425103a676e2b6a81f3fd35d7ea4f9b90ec ]
+
+Frank reports that in a mt7530 setup where some ports are standalone and
+some are in a VLAN-aware bridge, 8021q uppers of the standalone ports
+lose their VLAN tag on xmit, as seen by the link partner.
+
+This seems to occur because once the other ports join the VLAN-aware
+bridge, mt7530_port_vlan_filtering() also calls
+mt7530_port_set_vlan_aware(ds, cpu_dp->index), and this affects the way
+that the switch processes the traffic of the standalone port.
+
+Relevant is the PVC_EG_TAG bit. The MT7530 documentation says about it:
+
+EG_TAG: Incoming Port Egress Tag VLAN Attribution
+0: disabled (system default)
+1: consistent (keep the original ingress tag attribute)
+
+My interpretation is that this setting applies on the ingress port, and
+"disabled" is basically the normal behavior, where the egress tag format
+of the packet (tagged or untagged) is decided by the VLAN table
+(MT7530_VLAN_EGRESS_UNTAG or MT7530_VLAN_EGRESS_TAG).
+
+But there is also an option of overriding the system default behavior,
+and for the egress tagging format of packets to be decided not by the
+VLAN table, but simply by copying the ingress tag format (if ingress was
+tagged, egress is tagged; if ingress was untagged, egress is untagged;
+aka "consistent). This is useful in 2 scenarios:
+
+- VLAN-unaware bridge ports will always encounter a miss in the VLAN
+ table. They should forward a packet as-is, though. So we use
+ "consistent" there. See commit e045124e9399 ("net: dsa: mt7530: fix
+ tagged frames pass-through in VLAN-unaware mode").
+
+- Traffic injected from the CPU port. The operating system is in god
+ mode; if it wants a packet to exit as VLAN-tagged, it sends it as
+ VLAN-tagged. Otherwise it sends it as VLAN-untagged*.
+
+*This is true only if we don't consider the bridge TX forwarding offload
+feature, which mt7530 doesn't support.
+
+So for now, make the CPU port always stay in "consistent" mode to allow
+software VLANs to be forwarded to their egress ports with the VLAN tag
+intact, and not stripped.
+
+Link: https://lore.kernel.org/netdev/trinity-e6294d28-636c-4c40-bb8b-b523521b00be-1674233135062@3c-app-gmx-bs36/
+Fixes: e045124e9399 ("net: dsa: mt7530: fix tagged frames pass-through in VLAN-unaware mode")
+Reported-by: Frank Wunderlich <frank-w@public-files.de>
+Tested-by: Frank Wunderlich <frank-w@public-files.de>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20230205140713.1609281-1-vladimir.oltean@nxp.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mt7530.c | 26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 704ba461a6000..c1505de23957f 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -1290,14 +1290,26 @@ mt7530_port_set_vlan_aware(struct dsa_switch *ds, int port)
+ if (!priv->ports[port].pvid)
+ mt7530_rmw(priv, MT7530_PVC_P(port), ACC_FRM_MASK,
+ MT7530_VLAN_ACC_TAGGED);
+- }
+
+- /* Set the port as a user port which is to be able to recognize VID
+- * from incoming packets before fetching entry within the VLAN table.
+- */
+- mt7530_rmw(priv, MT7530_PVC_P(port), VLAN_ATTR_MASK | PVC_EG_TAG_MASK,
+- VLAN_ATTR(MT7530_VLAN_USER) |
+- PVC_EG_TAG(MT7530_VLAN_EG_DISABLED));
++ /* Set the port as a user port which is to be able to recognize
++ * VID from incoming packets before fetching entry within the
++ * VLAN table.
++ */
++ mt7530_rmw(priv, MT7530_PVC_P(port),
++ VLAN_ATTR_MASK | PVC_EG_TAG_MASK,
++ VLAN_ATTR(MT7530_VLAN_USER) |
++ PVC_EG_TAG(MT7530_VLAN_EG_DISABLED));
++ } else {
++ /* Also set CPU ports to the "user" VLAN port attribute, to
++ * allow VLAN classification, but keep the EG_TAG attribute as
++ * "consistent" (i.o.w. don't change its value) for packets
++ * received by the switch from the CPU, so that tagged packets
++ * are forwarded to user ports as tagged, and untagged as
++ * untagged.
++ */
++ mt7530_rmw(priv, MT7530_PVC_P(port), VLAN_ATTR_MASK,
++ VLAN_ATTR(MT7530_VLAN_USER));
++ }
+ }
+
+ static void
+--
+2.39.0
+
--- /dev/null
+From 36f4d5931715367b252ebb87413a4f740b037010 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 14:47:12 +0100
+Subject: net/mlx5: Bridge, fix ageing of peer FDB entries
+
+From: Vlad Buslov <vladbu@nvidia.com>
+
+[ Upstream commit da0c52426cd23f8728eff72c2b2d2a3eb6b451f5 ]
+
+SWITCHDEV_FDB_ADD_TO_BRIDGE event handler that updates FDB entry 'lastuse'
+field is only executed for eswitch that owns the entry. However, if peer
+entry processed packets at least once it will have hardware counter 'used'
+value greater than entry 'lastuse' from that point on, which will cause FDB
+entry not being aged out.
+
+Process the event on all eswitch instances.
+
+Fixes: ff9b7521468b ("net/mlx5: Bridge, support LAG")
+Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
+Reviewed-by: Maor Dickman <maord@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c | 4 ----
+ drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c | 2 +-
+ 2 files changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c
+index 8e7177d4539e3..291bd59639044 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c
+@@ -432,10 +432,6 @@ static int mlx5_esw_bridge_switchdev_event(struct notifier_block *nb,
+
+ switch (event) {
+ case SWITCHDEV_FDB_ADD_TO_BRIDGE:
+- /* only handle the event on native eswtich of representor */
+- if (!mlx5_esw_bridge_is_local(dev, rep, esw))
+- break;
+-
+ fdb_info = container_of(info,
+ struct switchdev_notifier_fdb_info,
+ info);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
+index 317d76b97c42a..aec0f67cef005 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
+@@ -1270,7 +1270,7 @@ void mlx5_esw_bridge_fdb_update_used(struct net_device *dev, u16 vport_num, u16
+ struct mlx5_esw_bridge *bridge;
+
+ port = mlx5_esw_bridge_port_lookup(vport_num, esw_owner_vhca_id, br_offloads);
+- if (!port || port->flags & MLX5_ESW_BRIDGE_PORT_FLAG_PEER)
++ if (!port)
+ return;
+
+ bridge = port->bridge;
+--
+2.39.0
+
--- /dev/null
+From 7d82638abb46a979d1b4d5af0e2180e07c517348 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 15:27:40 +0200
+Subject: net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit db561fed6b8fa3878e74d5df6512a4a38152b63e ]
+
+Whenever the driver is reading the string DBs into buffers, the driver
+is setting the load bit, but the driver never clears this bit.
+As a result, in case load bit is on and the driver query the device for
+new string DBs, the driver won't read again the string DBs.
+Fix it by clearing the load bit when query the device for new string
+DBs.
+
+Fixes: 2d69356752ff ("net/mlx5: Add support for fw live patch event")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+index 326e0b170e363..265f4ae835ce5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+@@ -64,6 +64,7 @@ static int mlx5_query_mtrc_caps(struct mlx5_fw_tracer *tracer)
+ MLX5_GET(mtrc_cap, out, num_string_trace);
+ tracer->str_db.num_string_db = MLX5_GET(mtrc_cap, out, num_string_db);
+ tracer->owner = !!MLX5_GET(mtrc_cap, out, trace_owner);
++ tracer->str_db.loaded = false;
+
+ for (i = 0; i < tracer->str_db.num_string_db; i++) {
+ mtrc_cap_sp = MLX5_ADDR_OF(mtrc_cap, out, string_db_param[i]);
+--
+2.39.0
+
--- /dev/null
+From be549c943bebdebde229f8491834ef0c4533fec1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 17:39:36 +0200
+Subject: net/mlx5: fw_tracer, Zero consumer index when reloading the tracer
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 184e1e4474dbcfebc4dbd1fa823a329978f25506 ]
+
+When tracer is reloaded, the device will log the traces at the
+beginning of the log buffer. Also, driver is reading the log buffer in
+chunks in accordance to the consumer index.
+Hence, zero consumer index when reloading the tracer.
+
+Fixes: 4383cfcc65e7 ("net/mlx5: Add devlink reload")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+index 265f4ae835ce5..1c72fc0b7b68a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+@@ -757,6 +757,7 @@ static int mlx5_fw_tracer_set_mtrc_conf(struct mlx5_fw_tracer *tracer)
+ if (err)
+ mlx5_core_warn(dev, "FWTracer: Failed to set tracer configurations %d\n", err);
+
++ tracer->buff.consumer_index = 0;
+ return err;
+ }
+
+@@ -821,7 +822,6 @@ static void mlx5_fw_tracer_ownership_change(struct work_struct *work)
+ mlx5_core_dbg(tracer->dev, "FWTracer: ownership changed, current=(%d)\n", tracer->owner);
+ if (tracer->owner) {
+ tracer->owner = false;
+- tracer->buff.consumer_index = 0;
+ return;
+ }
+
+--
+2.39.0
+
--- /dev/null
+From 67b96dcb0749836125edcb22871e7d97821e36aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Dec 2022 22:16:23 +0200
+Subject: net/mlx5: Serialize module cleanup with reload and remove
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 8f0d1451ecf7b3bd5a06ffc866c753d0f3ab4683 ]
+
+Currently, remove and reload flows can run in parallel to module cleanup.
+This design is error prone. For example: aux_drivers callbacks are called
+from both cleanup and remove flows with different lockings, which can
+cause a deadlock[1].
+Hence, serialize module cleanup with reload and remove.
+
+[1]
+ cleanup remove
+ ------- ------
+ auxiliary_driver_unregister();
+ devl_lock()
+ auxiliary_device_delete(mlx5e_aux)
+ device_lock(mlx5e_aux)
+ devl_lock()
+ device_lock(mlx5e_aux)
+
+Fixes: 912cebf420c2 ("net/mlx5e: Connect ethernet part to auxiliary bus")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 9e15eea9743fe..485a6a6220f6a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -1862,7 +1862,7 @@ static int __init mlx5_init(void)
+ mlx5_fpga_ipsec_build_fs_cmds();
+ mlx5_register_debugfs();
+
+- err = pci_register_driver(&mlx5_core_driver);
++ err = mlx5e_init();
+ if (err)
+ goto err_debug;
+
+@@ -1870,16 +1870,16 @@ static int __init mlx5_init(void)
+ if (err)
+ goto err_sf;
+
+- err = mlx5e_init();
++ err = pci_register_driver(&mlx5_core_driver);
+ if (err)
+- goto err_en;
++ goto err_pci;
+
+ return 0;
+
+-err_en:
++err_pci:
+ mlx5_sf_driver_unregister();
+ err_sf:
+- pci_unregister_driver(&mlx5_core_driver);
++ mlx5e_cleanup();
+ err_debug:
+ mlx5_unregister_debugfs();
+ return err;
+@@ -1887,9 +1887,9 @@ static int __init mlx5_init(void)
+
+ static void __exit mlx5_cleanup(void)
+ {
+- mlx5e_cleanup();
+- mlx5_sf_driver_unregister();
+ pci_unregister_driver(&mlx5_core_driver);
++ mlx5_sf_driver_unregister();
++ mlx5e_cleanup();
+ mlx5_unregister_debugfs();
+ }
+
+--
+2.39.0
+
--- /dev/null
+From d2e1cbce921950598500053f76e93ad7697640d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Sep 2022 09:29:02 -0700
+Subject: net/mlx5e: Introduce the mlx5e_flush_rq function
+
+From: Maxim Mikityanskiy <maximmi@nvidia.com>
+
+[ Upstream commit d9ba64deb2f1ad58eb3067c7485518f3e96559ee ]
+
+Add a function to flush an RQ: clean up descriptors, release pages and
+reset the RQ. This procedure is used by the recovery flow, and it will
+also be used in a following commit to free some memory when switching a
+channel to the XSK mode.
+
+Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 1e66220948df ("net/mlx5e: Update rx ring hw mtu upon each rx-fcs flag change")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +-
+ .../mellanox/mlx5/core/en/reporter_rx.c | 23 +--------------
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 28 ++++++++++++++++++-
+ 3 files changed, 29 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+index c22a38e5337b2..c822c3ac0544b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+@@ -1002,7 +1002,7 @@ void mlx5e_activate_priv_channels(struct mlx5e_priv *priv);
+ void mlx5e_deactivate_priv_channels(struct mlx5e_priv *priv);
+ int mlx5e_ptp_rx_manage_fs_ctx(struct mlx5e_priv *priv, void *ctx);
+
+-int mlx5e_modify_rq_state(struct mlx5e_rq *rq, int curr_state, int next_state);
++int mlx5e_flush_rq(struct mlx5e_rq *rq, int curr_state);
+ void mlx5e_activate_rq(struct mlx5e_rq *rq);
+ void mlx5e_deactivate_rq(struct mlx5e_rq *rq);
+ void mlx5e_activate_icosq(struct mlx5e_icosq *icosq);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c
+index 0f1dbad7c9f1a..899a9a73eef68 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c
+@@ -129,34 +129,13 @@ static int mlx5e_rx_reporter_err_icosq_cqe_recover(void *ctx)
+ return err;
+ }
+
+-static int mlx5e_rq_to_ready(struct mlx5e_rq *rq, int curr_state)
+-{
+- struct net_device *dev = rq->netdev;
+- int err;
+-
+- err = mlx5e_modify_rq_state(rq, curr_state, MLX5_RQC_STATE_RST);
+- if (err) {
+- netdev_err(dev, "Failed to move rq 0x%x to reset\n", rq->rqn);
+- return err;
+- }
+- err = mlx5e_modify_rq_state(rq, MLX5_RQC_STATE_RST, MLX5_RQC_STATE_RDY);
+- if (err) {
+- netdev_err(dev, "Failed to move rq 0x%x to ready\n", rq->rqn);
+- return err;
+- }
+-
+- return 0;
+-}
+-
+ static int mlx5e_rx_reporter_err_rq_cqe_recover(void *ctx)
+ {
+ struct mlx5e_rq *rq = ctx;
+ int err;
+
+ mlx5e_deactivate_rq(rq);
+- mlx5e_free_rx_descs(rq);
+-
+- err = mlx5e_rq_to_ready(rq, MLX5_RQC_STATE_ERR);
++ err = mlx5e_flush_rq(rq, MLX5_RQC_STATE_ERR);
+ clear_bit(MLX5E_RQ_STATE_RECOVERING, &rq->state);
+ if (err)
+ return err;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index be19f5cf9d150..866242ac72c29 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -672,7 +672,7 @@ int mlx5e_create_rq(struct mlx5e_rq *rq, struct mlx5e_rq_param *param)
+ return err;
+ }
+
+-int mlx5e_modify_rq_state(struct mlx5e_rq *rq, int curr_state, int next_state)
++static int mlx5e_modify_rq_state(struct mlx5e_rq *rq, int curr_state, int next_state)
+ {
+ struct mlx5_core_dev *mdev = rq->mdev;
+
+@@ -701,6 +701,32 @@ int mlx5e_modify_rq_state(struct mlx5e_rq *rq, int curr_state, int next_state)
+ return err;
+ }
+
++static int mlx5e_rq_to_ready(struct mlx5e_rq *rq, int curr_state)
++{
++ struct net_device *dev = rq->netdev;
++ int err;
++
++ err = mlx5e_modify_rq_state(rq, curr_state, MLX5_RQC_STATE_RST);
++ if (err) {
++ netdev_err(dev, "Failed to move rq 0x%x to reset\n", rq->rqn);
++ return err;
++ }
++ err = mlx5e_modify_rq_state(rq, MLX5_RQC_STATE_RST, MLX5_RQC_STATE_RDY);
++ if (err) {
++ netdev_err(dev, "Failed to move rq 0x%x to ready\n", rq->rqn);
++ return err;
++ }
++
++ return 0;
++}
++
++int mlx5e_flush_rq(struct mlx5e_rq *rq, int curr_state)
++{
++ mlx5e_free_rx_descs(rq);
++
++ return mlx5e_rq_to_ready(rq, curr_state);
++}
++
+ static int mlx5e_modify_rq_scatter_fcs(struct mlx5e_rq *rq, bool enable)
+ {
+ struct mlx5_core_dev *mdev = rq->mdev;
+--
+2.39.0
+
--- /dev/null
+From bbd29846e7b53cdc0aa37dea752869ec72bfd9b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 16:06:32 +0200
+Subject: net/mlx5e: IPoIB, Show unknown speed instead of error
+
+From: Dragos Tatulea <dtatulea@nvidia.com>
+
+[ Upstream commit 8aa5f171d51c1cb69e5e3106df4dd1a446102823 ]
+
+ethtool is returning an error for unknown speeds for the IPoIB interface:
+
+$ ethtool ib0
+netlink error: failed to retrieve link settings
+netlink error: Invalid argument
+netlink error: failed to retrieve link settings
+netlink error: Invalid argument
+Settings for ib0:
+Link detected: no
+
+After this change, ethtool will return success and show "unknown speed":
+
+$ ethtool ib0
+Settings for ib0:
+Supported ports: [ ]
+Supported link modes: Not reported
+Supported pause frame use: No
+Supports auto-negotiation: No
+Supported FEC modes: Not reported
+Advertised link modes: Not reported
+Advertised pause frame use: No
+Advertised auto-negotiation: No
+Advertised FEC modes: Not reported
+Speed: Unknown!
+Duplex: Full
+Auto-negotiation: off
+Port: Other
+PHYAD: 0
+Transceiver: internal
+Link detected: no
+
+Fixes: eb234ee9d541 ("net/mlx5e: IPoIB, Add support for get_link_ksettings in ethtool")
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Gal Pressman <gal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c
+index 0c8594c7df21d..908e5ee1a30fa 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c
+@@ -172,16 +172,16 @@ static inline int mlx5_ptys_rate_enum_to_int(enum mlx5_ptys_rate rate)
+ }
+ }
+
+-static int mlx5i_get_speed_settings(u16 ib_link_width_oper, u16 ib_proto_oper)
++static u32 mlx5i_get_speed_settings(u16 ib_link_width_oper, u16 ib_proto_oper)
+ {
+ int rate, width;
+
+ rate = mlx5_ptys_rate_enum_to_int(ib_proto_oper);
+ if (rate < 0)
+- return -EINVAL;
++ return SPEED_UNKNOWN;
+ width = mlx5_ptys_width_enum_to_int(ib_link_width_oper);
+ if (width < 0)
+- return -EINVAL;
++ return SPEED_UNKNOWN;
+
+ return rate * width;
+ }
+@@ -204,16 +204,13 @@ static int mlx5i_get_link_ksettings(struct net_device *netdev,
+ ethtool_link_ksettings_zero_link_mode(link_ksettings, advertising);
+
+ speed = mlx5i_get_speed_settings(ib_link_width_oper, ib_proto_oper);
+- if (speed < 0)
+- return -EINVAL;
++ link_ksettings->base.speed = speed;
++ link_ksettings->base.duplex = speed == SPEED_UNKNOWN ? DUPLEX_UNKNOWN : DUPLEX_FULL;
+
+- link_ksettings->base.duplex = DUPLEX_FULL;
+ link_ksettings->base.port = PORT_OTHER;
+
+ link_ksettings->base.autoneg = AUTONEG_DISABLE;
+
+- link_ksettings->base.speed = speed;
+-
+ return 0;
+ }
+
+--
+2.39.0
+
--- /dev/null
+From 0dc602c71bbdddc603408fe147b4f9cd3b1e16e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Sep 2022 00:21:55 -0700
+Subject: net/mlx5e: Move repeating clear_bit in
+ mlx5e_rx_reporter_err_rq_cqe_recover
+
+From: Maxim Mikityanskiy <maximmi@nvidia.com>
+
+[ Upstream commit e64d71d055ca01fa5054d25b99fb29b98e543a31 ]
+
+The same clear_bit is called in both error and success flows. Move the
+call to do it only once and remove the out label.
+
+Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
+Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 1e66220948df ("net/mlx5e: Update rx ring hw mtu upon each rx-fcs flag change")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c
+index e329158fdc555..0f1dbad7c9f1a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c
+@@ -157,16 +157,13 @@ static int mlx5e_rx_reporter_err_rq_cqe_recover(void *ctx)
+ mlx5e_free_rx_descs(rq);
+
+ err = mlx5e_rq_to_ready(rq, MLX5_RQC_STATE_ERR);
++ clear_bit(MLX5E_RQ_STATE_RECOVERING, &rq->state);
+ if (err)
+- goto out;
++ return err;
+
+- clear_bit(MLX5E_RQ_STATE_RECOVERING, &rq->state);
+ mlx5e_activate_rq(rq);
+ rq->stats->recover++;
+ return 0;
+-out:
+- clear_bit(MLX5E_RQ_STATE_RECOVERING, &rq->state);
+- return err;
+ }
+
+ static int mlx5e_rx_reporter_timeout_recover(void *ctx)
+--
+2.39.0
+
--- /dev/null
+From 893a71a8dd17d05ec9f49fd954951808be835a65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Jan 2023 18:09:32 +0200
+Subject: net/mlx5e: Update rx ring hw mtu upon each rx-fcs flag change
+
+From: Adham Faris <afaris@nvidia.com>
+
+[ Upstream commit 1e66220948df815d7b37e0ff8b4627ce10433738 ]
+
+rq->hw_mtu is used in function en_rx.c/mlx5e_skb_from_cqe_mpwrq_linear()
+to catch oversized packets. If FCS is concatenated to the end of the
+packet then the check should be updated accordingly.
+
+Rx rings initialization (mlx5e_init_rxq_rq()) invoked for every new set
+of channels, as part of mlx5e_safe_switch_params(), unknowingly if it
+runs with default configuration or not. Current rq->hw_mtu
+initialization assumes default configuration and ignores
+params->scatter_fcs_en flag state.
+Fix this, by accounting for params->scatter_fcs_en flag state during
+rq->hw_mtu initialization.
+
+In addition, updating rq->hw_mtu value during ingress traffic might
+lead to packets drop and oversize_pkts_sw_drop counter increase with no
+good reason. Hence we remove this optimization and switch the set of
+channels with a new one, to make sure we don't get false positives on
+the oversize_pkts_sw_drop counter.
+
+Fixes: 102722fc6832 ("net/mlx5e: Add support for RXFCS feature flag")
+Signed-off-by: Adham Faris <afaris@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 86 ++++---------------
+ 1 file changed, 15 insertions(+), 71 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 866242ac72c29..f1dd966e2bdbf 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -392,7 +392,8 @@ static int mlx5e_init_rxq_rq(struct mlx5e_channel *c, struct mlx5e_params *param
+ rq->icosq = &c->icosq;
+ rq->ix = c->ix;
+ rq->mdev = mdev;
+- rq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu);
++ rq->hw_mtu =
++ MLX5E_SW2HW_MTU(params, params->sw_mtu) - ETH_FCS_LEN * !params->scatter_fcs_en;
+ rq->xdpsq = &c->rq_xdpsq;
+ rq->stats = &c->priv->channel_stats[c->ix].rq;
+ rq->ptp_cyc2time = mlx5_rq_ts_translator(mdev);
+@@ -727,35 +728,6 @@ int mlx5e_flush_rq(struct mlx5e_rq *rq, int curr_state)
+ return mlx5e_rq_to_ready(rq, curr_state);
+ }
+
+-static int mlx5e_modify_rq_scatter_fcs(struct mlx5e_rq *rq, bool enable)
+-{
+- struct mlx5_core_dev *mdev = rq->mdev;
+-
+- void *in;
+- void *rqc;
+- int inlen;
+- int err;
+-
+- inlen = MLX5_ST_SZ_BYTES(modify_rq_in);
+- in = kvzalloc(inlen, GFP_KERNEL);
+- if (!in)
+- return -ENOMEM;
+-
+- rqc = MLX5_ADDR_OF(modify_rq_in, in, ctx);
+-
+- MLX5_SET(modify_rq_in, in, rq_state, MLX5_RQC_STATE_RDY);
+- MLX5_SET64(modify_rq_in, in, modify_bitmask,
+- MLX5_MODIFY_RQ_IN_MODIFY_BITMASK_SCATTER_FCS);
+- MLX5_SET(rqc, rqc, scatter_fcs, enable);
+- MLX5_SET(rqc, rqc, state, MLX5_RQC_STATE_RDY);
+-
+- err = mlx5_core_modify_rq(mdev, rq->rqn, in);
+-
+- kvfree(in);
+-
+- return err;
+-}
+-
+ static int mlx5e_modify_rq_vsd(struct mlx5e_rq *rq, bool vsd)
+ {
+ struct mlx5_core_dev *mdev = rq->mdev;
+@@ -2876,20 +2848,6 @@ static void mlx5e_cleanup_nic_tx(struct mlx5e_priv *priv)
+ mlx5e_destroy_tises(priv);
+ }
+
+-static int mlx5e_modify_channels_scatter_fcs(struct mlx5e_channels *chs, bool enable)
+-{
+- int err = 0;
+- int i;
+-
+- for (i = 0; i < chs->num; i++) {
+- err = mlx5e_modify_rq_scatter_fcs(&chs->c[i]->rq, enable);
+- if (err)
+- return err;
+- }
+-
+- return 0;
+-}
+-
+ static int mlx5e_modify_channels_vsd(struct mlx5e_channels *chs, bool vsd)
+ {
+ int err;
+@@ -3401,41 +3359,27 @@ static int mlx5e_set_rx_port_ts(struct mlx5_core_dev *mdev, bool enable)
+ return mlx5_set_ports_check(mdev, in, sizeof(in));
+ }
+
++static int mlx5e_set_rx_port_ts_wrap(struct mlx5e_priv *priv, void *ctx)
++{
++ struct mlx5_core_dev *mdev = priv->mdev;
++ bool enable = *(bool *)ctx;
++
++ return mlx5e_set_rx_port_ts(mdev, enable);
++}
++
+ static int set_feature_rx_fcs(struct net_device *netdev, bool enable)
+ {
+ struct mlx5e_priv *priv = netdev_priv(netdev);
+ struct mlx5e_channels *chs = &priv->channels;
+- struct mlx5_core_dev *mdev = priv->mdev;
++ struct mlx5e_params new_params;
+ int err;
+
+ mutex_lock(&priv->state_lock);
+
+- if (enable) {
+- err = mlx5e_set_rx_port_ts(mdev, false);
+- if (err)
+- goto out;
+-
+- chs->params.scatter_fcs_en = true;
+- err = mlx5e_modify_channels_scatter_fcs(chs, true);
+- if (err) {
+- chs->params.scatter_fcs_en = false;
+- mlx5e_set_rx_port_ts(mdev, true);
+- }
+- } else {
+- chs->params.scatter_fcs_en = false;
+- err = mlx5e_modify_channels_scatter_fcs(chs, false);
+- if (err) {
+- chs->params.scatter_fcs_en = true;
+- goto out;
+- }
+- err = mlx5e_set_rx_port_ts(mdev, true);
+- if (err) {
+- mlx5_core_warn(mdev, "Failed to set RX port timestamp %d\n", err);
+- err = 0;
+- }
+- }
+-
+-out:
++ new_params = chs->params;
++ new_params.scatter_fcs_en = enable;
++ err = mlx5e_safe_switch_params(priv, &new_params, mlx5e_set_rx_port_ts_wrap,
++ &new_params.scatter_fcs_en, true);
+ mutex_unlock(&priv->state_lock);
+ return err;
+ }
+--
+2.39.0
+
--- /dev/null
+From 8237acb2d89d6d865180a482d922bfbed62c7ade Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Feb 2023 21:24:08 +0200
+Subject: net: mscc: ocelot: fix VCAP filters not matching on MAC with
+ "protocol 802.1Q"
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit f964f8399df29d3e3ced77177cf35131cd2491bf ]
+
+Alternative short title: don't instruct the hardware to match on
+EtherType with "protocol 802.1Q" flower filters. It doesn't work for the
+reasons detailed below.
+
+With a command such as the following:
+
+tc filter add dev $swp1 ingress chain $(IS1 2) pref 3 \
+ protocol 802.1Q flower skip_sw vlan_id 200 src_mac $h1_mac \
+ action vlan modify id 300 \
+ action goto chain $(IS2 0 0)
+
+the created filter is set by ocelot_flower_parse_key() to be of type
+OCELOT_VCAP_KEY_ETYPE, and etype is set to {value=0x8100, mask=0xffff}.
+This gets propagated all the way to is1_entry_set() which commits it to
+hardware (the VCAP_IS1_HK_ETYPE field of the key). Compare this to the
+case where src_mac isn't specified - the key type is OCELOT_VCAP_KEY_ANY,
+and is1_entry_set() doesn't populate VCAP_IS1_HK_ETYPE.
+
+The problem is that for VLAN-tagged frames, the hardware interprets the
+ETYPE field as holding the encapsulated VLAN protocol. So the above
+filter will only match those packets which have an encapsulated protocol
+of 0x8100, rather than all packets with VLAN ID 200 and the given src_mac.
+
+The reason why this is allowed to occur is because, although we have a
+block of code in ocelot_flower_parse_key() which sets "match_protocol"
+to false when VLAN keys are present, that code executes too late.
+There is another block of code, which executes for Ethernet addresses,
+and has a "goto finished_key_parsing" and skips the VLAN header parsing.
+By skipping it, "match_protocol" remains with the value it was
+initialized with, i.e. "true", and "proto" is set to f->common.protocol,
+or 0x8100.
+
+The concept of ignoring some keys rather than erroring out when they are
+present but can't be offloaded is dubious in itself, but is present
+since the initial commit fe3490e6107e ("net: mscc: ocelot: Hardware
+ofload for tc flower filter"), and it's outside of the scope of this
+patch to change that.
+
+The problem was introduced when the driver started to interpret the
+flower filter's protocol, and populate the VCAP filter's ETYPE field
+based on it.
+
+To fix this, it is sufficient to move the code that parses the VLAN keys
+earlier than the "goto finished_key_parsing" instruction. This will
+ensure that if we have a flower filter with both VLAN and Ethernet
+address keys, it won't match on ETYPE 0x8100, because the VLAN key
+parsing sets "match_protocol = false".
+
+Fixes: 86b956de119c ("net: mscc: ocelot: support matching on EtherType")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230205192409.1796428-1-vladimir.oltean@nxp.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot_flower.c | 24 +++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot_flower.c b/drivers/net/ethernet/mscc/ocelot_flower.c
+index a3a5ad5dbb0e0..b7e7bd744a1b8 100644
+--- a/drivers/net/ethernet/mscc/ocelot_flower.c
++++ b/drivers/net/ethernet/mscc/ocelot_flower.c
+@@ -473,6 +473,18 @@ ocelot_flower_parse_key(struct ocelot *ocelot, int port, bool ingress,
+ flow_rule_match_control(rule, &match);
+ }
+
++ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) {
++ struct flow_match_vlan match;
++
++ flow_rule_match_vlan(rule, &match);
++ filter->key_type = OCELOT_VCAP_KEY_ANY;
++ filter->vlan.vid.value = match.key->vlan_id;
++ filter->vlan.vid.mask = match.mask->vlan_id;
++ filter->vlan.pcp.value[0] = match.key->vlan_priority;
++ filter->vlan.pcp.mask[0] = match.mask->vlan_priority;
++ match_protocol = false;
++ }
++
+ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
+ struct flow_match_eth_addrs match;
+
+@@ -605,18 +617,6 @@ ocelot_flower_parse_key(struct ocelot *ocelot, int port, bool ingress,
+ match_protocol = false;
+ }
+
+- if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) {
+- struct flow_match_vlan match;
+-
+- flow_rule_match_vlan(rule, &match);
+- filter->key_type = OCELOT_VCAP_KEY_ANY;
+- filter->vlan.vid.value = match.key->vlan_id;
+- filter->vlan.vid.mask = match.mask->vlan_id;
+- filter->vlan.pcp.value[0] = match.key->vlan_priority;
+- filter->vlan.pcp.mask[0] = match.mask->vlan_priority;
+- match_protocol = false;
+- }
+-
+ finished_key_parsing:
+ if (match_protocol && proto != ETH_P_ALL) {
+ if (filter->block_id == VCAP_ES0) {
+--
+2.39.0
+
--- /dev/null
+From a0a8eb2205d6d86dfbcbe01ec85a3966c859ea0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 21:45:36 +0100
+Subject: net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 69ff53e4a4c9498eeed7d1441f68a1481dc69251 ]
+
+Jerome provided the information that also the GXL internal PHY doesn't
+support MMD register access and EEE. MMD reads return 0xffff, what
+results in e.g. completely wrong ethtool --show-eee output.
+Therefore use the MMD dummy stubs.
+
+Fixes: d853d145ea3e ("net: phy: add an option to disable EEE advertisement")
+Suggested-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://lore.kernel.org/r/84432fe4-0be4-bc82-4e5c-557206b40f56@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/meson-gxl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c
+index 5e41658b1e2fa..a6015cd03bff8 100644
+--- a/drivers/net/phy/meson-gxl.c
++++ b/drivers/net/phy/meson-gxl.c
+@@ -261,6 +261,8 @@ static struct phy_driver meson_gxl_phy[] = {
+ .handle_interrupt = meson_gxl_handle_interrupt,
+ .suspend = genphy_suspend,
+ .resume = genphy_resume,
++ .read_mmd = genphy_read_mmd_unsupported,
++ .write_mmd = genphy_write_mmd_unsupported,
+ }, {
+ PHY_ID_MATCH_EXACT(0x01803301),
+ .name = "Meson G12A Internal PHY",
+--
+2.39.0
+
--- /dev/null
+From 69f63675d09ca87bec6df91941dc08ea44ee8212 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 11:02:42 +0100
+Subject: net: phylink: move phy_device_free() to correctly release phy device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Léger <clement.leger@bootlin.com>
+
+[ Upstream commit ce93fdb5f2ca5c9e2a9668411cc39091507f8dc9 ]
+
+After calling fwnode_phy_find_device(), the phy device refcount is
+incremented. Then, when the phy device is attached to a netdev with
+phy_attach_direct(), the refcount is also incremented but only
+decremented in the caller if phy_attach_direct() fails. Move
+phy_device_free() before the "if" to always release it correctly.
+Indeed, either phy_attach_direct() failed and we don't want to keep a
+reference to the phydev or it succeeded and a reference has been taken
+internally.
+
+Fixes: 25396f680dd6 ("net: phylink: introduce phylink_fwnode_phy_connect()")
+Signed-off-by: Clément Léger <clement.leger@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phylink.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index 7afcf6310d59f..422dc92ecac94 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -1166,10 +1166,9 @@ int phylink_fwnode_phy_connect(struct phylink *pl,
+
+ ret = phy_attach_direct(pl->netdev, phy_dev, flags,
+ pl->link_interface);
+- if (ret) {
+- phy_device_free(phy_dev);
++ phy_device_free(phy_dev);
++ if (ret)
+ return ret;
+- }
+
+ ret = phylink_bringup_phy(pl, phy_dev, pl->link_config.interface);
+ if (ret)
+--
+2.39.0
+
--- /dev/null
+From 56fd8ed7707d46f707b57b30dce7a14b08ebc1b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 10:52:30 -0800
+Subject: RDMA/irdma: Fix potential NULL-ptr-dereference
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 5d9745cead1f121974322b94ceadfb4d1e67960e ]
+
+in_dev_get() can return NULL which will cause a failure once idev is
+dereferenced in in_dev_for_each_ifa_rtnl(). This patch adds a
+check for NULL value in idev beforehand.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Link: https://lore.kernel.org/r/20230126185230.62464-1-n.zhandarovich@fintech.ru
+Reviewed-by: Sindhu Devale <sindhu.devale@intel.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/cm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/hw/irdma/cm.c b/drivers/infiniband/hw/irdma/cm.c
+index b08c67bb264c9..a8ec3d8f6e465 100644
+--- a/drivers/infiniband/hw/irdma/cm.c
++++ b/drivers/infiniband/hw/irdma/cm.c
+@@ -1723,6 +1723,9 @@ irdma_add_mqh_4(struct irdma_device *iwdev, struct irdma_cm_info *cm_info,
+ continue;
+
+ idev = in_dev_get(ip_dev);
++ if (!idev)
++ continue;
++
+ in_dev_for_each_ifa_rtnl(ifa, idev) {
+ ibdev_dbg(&iwdev->ibdev,
+ "CM: Allocating child CM Listener forIP=%pI4, vlan_id=%d, MAC=%pM\n",
+--
+2.39.0
+
--- /dev/null
+From 0f8838afd9936f6b45569e4b4af2b456b10861b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jan 2023 17:37:57 +0800
+Subject: RDMA/usnic: use iommu_map_atomic() under spin_lock()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit b7e08a5a63a11627601915473c3b569c1f6c6c06 ]
+
+usnic_uiom_map_sorted_intervals() is called under spin_lock(), iommu_map()
+might sleep, use iommu_map_atomic() to avoid potential sleep in atomic
+context.
+
+Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20230129093757.637354-1-yangyingliang@huawei.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/usnic/usnic_uiom.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/usnic/usnic_uiom.c b/drivers/infiniband/hw/usnic/usnic_uiom.c
+index 760b254ba42d6..48a57568cad69 100644
+--- a/drivers/infiniband/hw/usnic/usnic_uiom.c
++++ b/drivers/infiniband/hw/usnic/usnic_uiom.c
+@@ -281,8 +281,8 @@ static int usnic_uiom_map_sorted_intervals(struct list_head *intervals,
+ size = pa_end - pa_start + PAGE_SIZE;
+ usnic_dbg("va 0x%lx pa %pa size 0x%zx flags 0x%x",
+ va_start, &pa_start, size, flags);
+- err = iommu_map(pd->domain, va_start, pa_start,
+- size, flags);
++ err = iommu_map_atomic(pd->domain, va_start,
++ pa_start, size, flags);
+ if (err) {
+ usnic_err("Failed to map va 0x%lx pa %pa size 0x%zx with err %d\n",
+ va_start, &pa_start, size, err);
+@@ -298,8 +298,8 @@ static int usnic_uiom_map_sorted_intervals(struct list_head *intervals,
+ size = pa - pa_start + PAGE_SIZE;
+ usnic_dbg("va 0x%lx pa %pa size 0x%zx flags 0x%x\n",
+ va_start, &pa_start, size, flags);
+- err = iommu_map(pd->domain, va_start, pa_start,
+- size, flags);
++ err = iommu_map_atomic(pd->domain, va_start,
++ pa_start, size, flags);
+ if (err) {
+ usnic_err("Failed to map va 0x%lx pa %pa size 0x%zx with err %d\n",
+ va_start, &pa_start, size, err);
+--
+2.39.0
+
--- /dev/null
+From cb33f695162333d6d7625d3c5eacc5b3c3de8fb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Feb 2023 18:26:34 +0000
+Subject: rds: rds_rm_zerocopy_callback() use list_first_entry()
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+[ Upstream commit f753a68980cf4b59a80fe677619da2b1804f526d ]
+
+rds_rm_zerocopy_callback() uses list_entry() on the head of a list
+causing a type confusion.
+Use list_first_entry() to actually access the first element of the
+rs_zcookie_queue list.
+
+Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification")
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Link: https://lore.kernel.org/r/20230202-rds-zerocopy-v3-1-83b0df974f9a@diag.uniroma1.it
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/message.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/rds/message.c b/net/rds/message.c
+index 799034e0f513d..b363ef13c75ef 100644
+--- a/net/rds/message.c
++++ b/net/rds/message.c
+@@ -104,9 +104,9 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs,
+ spin_lock_irqsave(&q->lock, flags);
+ head = &q->zcookie_head;
+ if (!list_empty(head)) {
+- info = list_entry(head, struct rds_msg_zcopy_info,
+- rs_zcookie_next);
+- if (info && rds_zcookie_add(info, cookie)) {
++ info = list_first_entry(head, struct rds_msg_zcopy_info,
++ rs_zcookie_next);
++ if (rds_zcookie_add(info, cookie)) {
+ spin_unlock_irqrestore(&q->lock, flags);
+ kfree(rds_info_from_znotifier(znotif));
+ /* caller invokes rds_wake_sk_sleep() */
+--
+2.39.0
+
--- /dev/null
+From 91bed2bba786bbe8302cbdcd568c09d57653b62e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 10:50:38 +0800
+Subject: riscv: stacktrace: Fix missing the first frame
+
+From: Liu Shixin <liushixin2@huawei.com>
+
+[ Upstream commit cb80242cc679d6397e77d8a964deeb3ff218d2b5 ]
+
+When running kfence_test, I found some testcases failed like this:
+
+ # test_out_of_bounds_read: EXPECTATION FAILED at mm/kfence/kfence_test.c:346
+ Expected report_matches(&expect) to be true, but is false
+ not ok 1 - test_out_of_bounds_read
+
+The corresponding call-trace is:
+
+ BUG: KFENCE: out-of-bounds read in kunit_try_run_case+0x38/0x84
+
+ Out-of-bounds read at 0x(____ptrval____) (32B right of kfence-#10):
+ kunit_try_run_case+0x38/0x84
+ kunit_generic_run_threadfn_adapter+0x12/0x1e
+ kthread+0xc8/0xde
+ ret_from_exception+0x0/0xc
+
+The kfence_test using the first frame of call trace to check whether the
+testcase is succeed or not. Commit 6a00ef449370 ("riscv: eliminate
+unreliable __builtin_frame_address(1)") skip first frame for all
+case, which results the kfence_test failed. Indeed, we only need to skip
+the first frame for case (task==NULL || task==current).
+
+With this patch, the call-trace will be:
+
+ BUG: KFENCE: out-of-bounds read in test_out_of_bounds_read+0x88/0x19e
+
+ Out-of-bounds read at 0x(____ptrval____) (1B left of kfence-#7):
+ test_out_of_bounds_read+0x88/0x19e
+ kunit_try_run_case+0x38/0x84
+ kunit_generic_run_threadfn_adapter+0x12/0x1e
+ kthread+0xc8/0xde
+ ret_from_exception+0x0/0xc
+
+Fixes: 6a00ef449370 ("riscv: eliminate unreliable __builtin_frame_address(1)")
+Signed-off-by: Liu Shixin <liushixin2@huawei.com>
+Tested-by: Samuel Holland <samuel@sholland.org>
+Link: https://lore.kernel.org/r/20221207025038.1022045-1-liushixin2@huawei.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/stacktrace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c
+index 811e837a8c4ee..ee8ef91c8aaf4 100644
+--- a/arch/riscv/kernel/stacktrace.c
++++ b/arch/riscv/kernel/stacktrace.c
+@@ -32,6 +32,7 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,
+ fp = (unsigned long)__builtin_frame_address(0);
+ sp = sp_in_global;
+ pc = (unsigned long)walk_stackframe;
++ level = -1;
+ } else {
+ /* task blocked in __switch_to */
+ fp = task->thread.s[0];
+@@ -43,7 +44,7 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,
+ unsigned long low, high;
+ struct stackframe *frame;
+
+- if (unlikely(!__kernel_text_address(pc) || (level++ >= 1 && !fn(arg, pc))))
++ if (unlikely(!__kernel_text_address(pc) || (level++ >= 0 && !fn(arg, pc))))
+ break;
+
+ /* Validate frame pointer */
+--
+2.39.0
+
--- /dev/null
+From 24853dee522a046c9992f3b2cad068b8d51a9585 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 11:21:10 +0800
+Subject: selftests: forwarding: lib: quote the sysctl values
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 3a082086aa200852545cf15159213582c0c80eba ]
+
+When set/restore sysctl value, we should quote the value as some keys
+may have multi values, e.g. net.ipv4.ping_group_range
+
+Fixes: f5ae57784ba8 ("selftests: forwarding: lib: Add sysctl_set(), sysctl_restore()")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Link: https://lore.kernel.org/r/20230208032110.879205-1-liuhangbin@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/forwarding/lib.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index c9507df9c05bc..b7d946cf14eb5 100644
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -817,14 +817,14 @@ sysctl_set()
+ local value=$1; shift
+
+ SYSCTL_ORIG[$key]=$(sysctl -n $key)
+- sysctl -qw $key=$value
++ sysctl -qw $key="$value"
+ }
+
+ sysctl_restore()
+ {
+ local key=$1; shift
+
+- sysctl -qw $key=${SYSCTL_ORIG["$key"]}
++ sysctl -qw $key="${SYSCTL_ORIG[$key]}"
+ }
+
+ forwarding_enable()
+--
+2.39.0
+
tracing-fix-poll-and-select-do-not-work-on-per_cpu-trace_pipe-and-trace_pipe_raw.patch
of-address-return-an-error-when-no-valid-dma-ranges-are-found.patch
can-j1939-do-not-wait-250-ms-if-the-same-addr-was-already-claimed.patch
+xfrm-compat-change-expression-for-switch-in-xfrm_xla.patch
+ib-hfi1-restore-allocated-resources-on-failed-copyou.patch
+xfrm-compat-prevent-potential-spectre-v1-gadget-in-x.patch
+ib-ipoib-fix-legacy-ipoib-due-to-wrong-number-of-que.patch
+rdma-irdma-fix-potential-null-ptr-dereference.patch
+rdma-usnic-use-iommu_map_atomic-under-spin_lock.patch
+xfrm-fix-bug-with-dscp-copy-to-v6-from-v4-tunnel.patch
+net-phylink-move-phy_device_free-to-correctly-releas.patch
+bonding-fix-error-checking-in-bond_debug_reregister.patch
+net-phy-meson-gxl-use-mmd-access-dummy-stubs-for-gxl.patch
+ionic-clean-interrupt-before-enabling-queue-to-avoid.patch
+uapi-add-missing-ip-ipv6-header-dependencies-for-lin.patch
+ice-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch
+net-dsa-mt7530-don-t-change-pvc_eg_tag-when-cpu-port.patch
+net-mscc-ocelot-fix-vcap-filters-not-matching-on-mac.patch
+net-mlx5e-move-repeating-clear_bit-in-mlx5e_rx_repor.patch
+net-mlx5e-introduce-the-mlx5e_flush_rq-function.patch
+net-mlx5e-update-rx-ring-hw-mtu-upon-each-rx-fcs-fla.patch
+net-mlx5-bridge-fix-ageing-of-peer-fdb-entries.patch
+net-mlx5e-ipoib-show-unknown-speed-instead-of-error.patch
+net-mlx5-fw_tracer-clear-load-bit-when-freeing-strin.patch
+net-mlx5-fw_tracer-zero-consumer-index-when-reloadin.patch
+net-mlx5-serialize-module-cleanup-with-reload-and-re.patch
+igc-add-ndo_tx_timeout-support.patch
+rds-rds_rm_zerocopy_callback-use-list_first_entry.patch
+selftests-forwarding-lib-quote-the-sysctl-values.patch
+alsa-pci-lx6464es-fix-a-debug-loop.patch
+riscv-stacktrace-fix-missing-the-first-frame.patch
+asoc-topology-return-enomem-on-memory-allocation-fai.patch
--- /dev/null
+From 80d9e865606967ba2f4a57ce2ccf342357ed7cd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 13:04:48 -0300
+Subject: uapi: add missing ip/ipv6 header dependencies for linux/stddef.h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Herton R. Krzesinski <herton@redhat.com>
+
+[ Upstream commit 03702d4d29be4e2510ec80b248dbbde4e57030d9 ]
+
+Since commit 58e0be1ef6118 ("net: use struct_group to copy ip/ipv6
+header addresses"), ip and ipv6 headers started to use the __struct_group
+definition, which is defined at include/uapi/linux/stddef.h. However,
+linux/stddef.h isn't explicitly included in include/uapi/linux/{ip,ipv6}.h,
+which breaks build of xskxceiver bpf selftest if you install the uapi
+headers in the system:
+
+$ make V=1 xskxceiver -C tools/testing/selftests/bpf
+...
+make: Entering directory '(...)/tools/testing/selftests/bpf'
+gcc -g -O0 -rdynamic -Wall -Werror (...)
+In file included from xskxceiver.c:79:
+/usr/include/linux/ip.h:103:9: error: expected specifier-qualifier-list before ‘__struct_group’
+ 103 | __struct_group(/* no tag */, addrs, /* no attrs */,
+ | ^~~~~~~~~~~~~~
+...
+
+Include the missing <linux/stddef.h> dependency in ip.h and do the
+same for the ipv6.h header.
+
+Fixes: 58e0be1ef611 ("net: use struct_group to copy ip/ipv6 header addresses")
+Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
+Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+Tested-by: Carlos O'Donell <carlos@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/ip.h | 1 +
+ include/uapi/linux/ipv6.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/include/uapi/linux/ip.h b/include/uapi/linux/ip.h
+index d2f143393780c..860bbf6bf29cb 100644
+--- a/include/uapi/linux/ip.h
++++ b/include/uapi/linux/ip.h
+@@ -18,6 +18,7 @@
+ #ifndef _UAPI_LINUX_IP_H
+ #define _UAPI_LINUX_IP_H
+ #include <linux/types.h>
++#include <linux/stddef.h>
+ #include <asm/byteorder.h>
+
+ #define IPTOS_TOS_MASK 0x1E
+diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
+index 62e5e16ef539d..39c6add59a1a6 100644
+--- a/include/uapi/linux/ipv6.h
++++ b/include/uapi/linux/ipv6.h
+@@ -4,6 +4,7 @@
+
+ #include <linux/libc-compat.h>
+ #include <linux/types.h>
++#include <linux/stddef.h>
+ #include <linux/in6.h>
+ #include <asm/byteorder.h>
+
+--
+2.39.0
+
--- /dev/null
+From b66b4b828ef3faa861ce30a359cbed7fc64df65d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 12:14:50 +0300
+Subject: xfrm: compat: change expression for switch in xfrm_xlate64
+
+From: Anastasia Belova <abelova@astralinux.ru>
+
+[ Upstream commit eb6c59b735aa6cca77cdbb59cc69d69a0d63d986 ]
+
+Compare XFRM_MSG_NEWSPDINFO (value from netlink
+configuration messages enum) with nlh_src->nlmsg_type
+instead of nlh_src->nlmsg_type - XFRM_MSG_BASE.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 4e9505064f58 ("net/xfrm/compat: Copy xfrm_spdattr_type_t atributes")
+Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
+Acked-by: Dmitry Safonov <0x7f454c46@gmail.com>
+Tested-by: Dmitry Safonov <0x7f454c46@gmail.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_compat.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/xfrm/xfrm_compat.c b/net/xfrm/xfrm_compat.c
+index a0f62fa02e06e..12405aa5bce84 100644
+--- a/net/xfrm/xfrm_compat.c
++++ b/net/xfrm/xfrm_compat.c
+@@ -302,7 +302,7 @@ static int xfrm_xlate64(struct sk_buff *dst, const struct nlmsghdr *nlh_src)
+ nla_for_each_attr(nla, attrs, len, remaining) {
+ int err;
+
+- switch (type) {
++ switch (nlh_src->nlmsg_type) {
+ case XFRM_MSG_NEWSPDINFO:
+ err = xfrm_nla_cpy(dst, nla, nla_len(nla));
+ break;
+--
+2.39.0
+
--- /dev/null
+From cf66cdd2a9f692b1f9bff5411bbcc71c87244cdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 13:02:49 +0000
+Subject: xfrm/compat: prevent potential spectre v1 gadget in
+ xfrm_xlate32_attr()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b6ee896385380aa621102e8ea402ba12db1cabff ]
+
+ int type = nla_type(nla);
+
+ if (type > XFRMA_MAX) {
+ return -EOPNOTSUPP;
+ }
+
+@type is then used as an array index and can be used
+as a Spectre v1 gadget.
+
+ if (nla_len(nla) < compat_policy[type].len) {
+
+array_index_nospec() can be used to prevent leaking
+content of kernel memory to malicious users.
+
+Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Dmitry Safonov <dima@arista.com>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Reviewed-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_compat.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/xfrm/xfrm_compat.c b/net/xfrm/xfrm_compat.c
+index 12405aa5bce84..8cbf45a8bcdc2 100644
+--- a/net/xfrm/xfrm_compat.c
++++ b/net/xfrm/xfrm_compat.c
+@@ -5,6 +5,7 @@
+ * Based on code and translator idea by: Florian Westphal <fw@strlen.de>
+ */
+ #include <linux/compat.h>
++#include <linux/nospec.h>
+ #include <linux/xfrm.h>
+ #include <net/xfrm.h>
+
+@@ -437,6 +438,7 @@ static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla,
+ NL_SET_ERR_MSG(extack, "Bad attribute");
+ return -EOPNOTSUPP;
+ }
++ type = array_index_nospec(type, XFRMA_MAX + 1);
+ if (nla_len(nla) < compat_policy[type].len) {
+ NL_SET_ERR_MSG(extack, "Attribute bad length");
+ return -EOPNOTSUPP;
+--
+2.39.0
+
--- /dev/null
+From 36b3842cb3f5a857e965275f42f368f474a53800 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 11:33:50 -0500
+Subject: xfrm: fix bug with DSCP copy to v6 from v4 tunnel
+
+From: Christian Hopps <chopps@chopps.org>
+
+[ Upstream commit 6028da3f125fec34425dbd5fec18e85d372b2af6 ]
+
+When copying the DSCP bits for decap-dscp into IPv6 don't assume the
+outer encap is always IPv6. Instead, as with the inner IPv4 case, copy
+the DSCP bits from the correctly saved "tos" value in the control block.
+
+Fixes: 227620e29509 ("[IPSEC]: Separate inner/outer mode processing on input")
+Signed-off-by: Christian Hopps <chopps@chopps.org>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_input.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index 3d8668d62e639..7c5958a2eed46 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -278,8 +278,7 @@ static int xfrm6_remove_tunnel_encap(struct xfrm_state *x, struct sk_buff *skb)
+ goto out;
+
+ if (x->props.flags & XFRM_STATE_DECAP_DSCP)
+- ipv6_copy_dscp(ipv6_get_dsfield(ipv6_hdr(skb)),
+- ipipv6_hdr(skb));
++ ipv6_copy_dscp(XFRM_MODE_SKB_CB(skb)->tos, ipipv6_hdr(skb));
+ if (!(x->props.flags & XFRM_STATE_NOECN))
+ ipip6_ecn_decapsulate(skb);
+
+--
+2.39.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
