--- /dev/null
+From d5a1224aa68c8b124a4c5c390186e571815ed390 Mon Sep 17 00:00:00 2001
+From: Matt Roper <matthew.d.roper@intel.com>
+Date: Wed, 1 Feb 2023 14:28:29 -0800
+Subject: drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+commit d5a1224aa68c8b124a4c5c390186e571815ed390 upstream.
+
+The UNSLICE_UNIT_LEVEL_CLKGATE register programmed by this workaround
+has 'BUS' style reset, indicating that it does not lose its value on
+engine resets. Furthermore, this register is part of the GT forcewake
+domain rather than the RENDER domain, so it should not be impacted by
+RCS engine resets. As such, we should implement this on the GT
+workaround list rather than an engine list.
+
+Bspec: 19219
+Fixes: 3551ff928744 ("drm/i915/gen11: Moving WAs to rcs_engine_wa_init()")
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230201222831.608281-2-matthew.d.roper@intel.com
+(cherry picked from commit 5f21dc07b52eb54a908e66f5d6e05a87bcb5b049)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gt/intel_workarounds.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
+@@ -1249,6 +1249,13 @@ icl_gt_workarounds_init(struct intel_gt
+ GAMT_CHKN_BIT_REG,
+ GAMT_CHKN_DISABLE_L3_COH_PIPE);
+
++ /*
++ * Wa_1408615072:icl,ehl (vsunit)
++ * Wa_1407596294:icl,ehl (hsunit)
++ */
++ wa_write_or(wal, UNSLICE_UNIT_LEVEL_CLKGATE,
++ VSUNIT_CLKGATE_DIS | HSUNIT_CLKGATE_DIS);
++
+ /* Wa_1407352427:icl,ehl */
+ wa_write_or(wal, UNSLICE_UNIT_LEVEL_CLKGATE2,
+ PSDUNIT_CLKGATE_DIS);
+@@ -2369,13 +2376,6 @@ rcs_engine_wa_init(struct intel_engine_c
+ GEN11_ENABLE_32_PLANE_MODE);
+
+ /*
+- * Wa_1408615072:icl,ehl (vsunit)
+- * Wa_1407596294:icl,ehl (hsunit)
+- */
+- wa_write_or(wal, UNSLICE_UNIT_LEVEL_CLKGATE,
+- VSUNIT_CLKGATE_DIS | HSUNIT_CLKGATE_DIS);
+-
+- /*
+ * Wa_1408767742:icl[a2..forever],ehl[all]
+ * Wa_1605460711:icl[a0..c0]
+ */
--- /dev/null
+From 247a631f9c0ffb37ed0786a94cb4c5f2b6fc7ab1 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Fri, 27 Jan 2023 15:55:58 +0100
+Subject: drm/vc4: crtc: Increase setup cost in core clock calculation to handle extreme reduced blanking
+
+From: Dom Cobley <popcornmix@gmail.com>
+
+commit 247a631f9c0ffb37ed0786a94cb4c5f2b6fc7ab1 upstream.
+
+The formula that determines the core clock requirement based on pixel
+clock and blanking has been determined experimentally to minimise the
+clock while supporting all modes we've seen.
+
+A new reduced blanking mode (4kp60 at 533MHz rather than the standard
+594MHz) has been seen that doesn't produce a high enough clock and
+results in "flip_done timed out" error.
+
+Increase the setup cost in the formula to make this work. The result is
+a reduced blanking mode increases by up to 7MHz while leaving the
+standard timing
+mode untouched
+
+Link: https://github.com/raspberrypi/linux/issues/4446
+Fixes: 16e101051f32 ("drm/vc4: Increase the core clock based on HVS load")
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230127145558.446123-1-maxime@cerno.tech
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vc4/vc4_crtc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -711,7 +711,7 @@ static int vc4_crtc_atomic_check(struct
+ struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder);
+
+ if (vc4_encoder->type == VC4_ENCODER_TYPE_HDMI0) {
+- vc4_state->hvs_load = max(mode->clock * mode->hdisplay / mode->htotal + 1000,
++ vc4_state->hvs_load = max(mode->clock * mode->hdisplay / mode->htotal + 8000,
+ mode->clock * 9 / 10) * 1000;
+ } else {
+ vc4_state->hvs_load = mode->clock * 1000;
--- /dev/null
+From 6b77b16de75a6efc0870b1fa467209387cbee8f3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 27 Jan 2023 16:57:08 +0100
+Subject: drm/vc4: Fix YUV plane handling when planes are in different buffers
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+commit 6b77b16de75a6efc0870b1fa467209387cbee8f3 upstream.
+
+YUV images can either be presented as one allocation with offsets
+for the different planes, or multiple allocations with 0 offsets.
+
+The driver only ever calls drm_fb_[dma|cma]_get_gem_obj with plane
+index 0, therefore any application using the second approach was
+incorrectly rendered.
+
+Correctly determine the address for each plane, removing the
+assumption that the base address is the same for each.
+
+Fixes: fc04023fafec ("drm/vc4: Add support for YUV planes.")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230127155708.454704-1-maxime@cerno.tech
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -340,7 +340,7 @@ static int vc4_plane_setup_clipping_and_
+ {
+ struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
+ struct drm_framebuffer *fb = state->fb;
+- struct drm_gem_dma_object *bo = drm_fb_dma_get_gem_obj(fb, 0);
++ struct drm_gem_dma_object *bo;
+ int num_planes = fb->format->num_planes;
+ struct drm_crtc_state *crtc_state;
+ u32 h_subsample = fb->format->hsub;
+@@ -359,8 +359,10 @@ static int vc4_plane_setup_clipping_and_
+ if (ret)
+ return ret;
+
+- for (i = 0; i < num_planes; i++)
++ for (i = 0; i < num_planes; i++) {
++ bo = drm_fb_dma_get_gem_obj(fb, i);
+ vc4_state->offsets[i] = bo->dma_addr + fb->offsets[i];
++ }
+
+ /*
+ * We don't support subpixel source positioning for scaling,
--- /dev/null
+From ce45ffb815e8e238f05de1630be3969b6bb15e4e Mon Sep 17 00:00:00 2001
+From: Jason Xing <kernelxing@tencent.com>
+Date: Wed, 8 Feb 2023 10:43:33 +0800
+Subject: i40e: add double of VLAN header when computing the max MTU
+
+From: Jason Xing <kernelxing@tencent.com>
+
+commit ce45ffb815e8e238f05de1630be3969b6bb15e4e upstream.
+
+Include the second VLAN HLEN into account when computing the maximum
+MTU size as other drivers do.
+
+Fixes: 0c8493d90b6b ("i40e: add XDP support for pass and drop actions")
+Signed-off-by: Jason Xing <kernelxing@tencent.com>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> (A Contingent Worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -2921,7 +2921,7 @@ static int i40e_change_mtu(struct net_de
+ struct i40e_pf *pf = vsi->back;
+
+ if (i40e_enabled_xdp_vsi(vsi)) {
+- int frame_size = new_mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN;
++ int frame_size = new_mtu + I40E_PACKET_HDR_PAD;
+
+ if (frame_size > i40e_max_xdp_frame_size(vsi))
+ return -EINVAL;
--- /dev/null
+From 43fbca02c2ddc39ff5879b6f3a4a097b1ba02098 Mon Sep 17 00:00:00 2001
+From: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Date: Mon, 6 Feb 2023 15:54:36 -0800
+Subject: ice: fix lost multicast packets in promisc mode
+
+From: Jesse Brandeburg <jesse.brandeburg@intel.com>
+
+commit 43fbca02c2ddc39ff5879b6f3a4a097b1ba02098 upstream.
+
+There was a problem reported to us where the addition of a VF with an IPv6
+address ending with a particular sequence would cause the parent device on
+the PF to no longer be able to respond to neighbor discovery packets.
+
+In this case, we had an ovs-bridge device living on top of a VLAN, which
+was on top of a PF, and it would not be able to talk anymore (the neighbor
+entry would expire and couldn't be restored).
+
+The root cause of the issue is that if the PF is asked to be in IFF_PROMISC
+mode (promiscuous mode) and it had an ipv6 address that needed the
+33:33:ff:00:00:04 multicast address to work, then when the VF was added
+with the need for the same multicast address, the VF would steal all the
+traffic destined for that address.
+
+The ice driver didn't auto-subscribe a request of IFF_PROMISC to the
+"multicast replication from other port's traffic" meaning that it won't get
+for instance, packets with an exact destination in the VF, as above.
+
+The VF's IPv6 address, which adds a "perfect filter" for 33:33:ff:00:00:04,
+results in no packets for that multicast address making it to the PF (which
+is in promisc but NOT "multicast replication").
+
+The fix is to enable "multicast promiscuous" whenever the driver is asked
+to enable IFF_PROMISC, and make sure to disable it when appropriate.
+
+Fixes: e94d44786693 ("ice: Implement filter sync, NDO operations and bump version")
+Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -270,6 +270,8 @@ static int ice_set_promisc(struct ice_vs
+ if (status && status != -EEXIST)
+ return status;
+
++ netdev_dbg(vsi->netdev, "set promisc filter bits for VSI %i: 0x%x\n",
++ vsi->vsi_num, promisc_m);
+ return 0;
+ }
+
+@@ -295,6 +297,8 @@ static int ice_clear_promisc(struct ice_
+ promisc_m, 0);
+ }
+
++ netdev_dbg(vsi->netdev, "clear promisc filter bits for VSI %i: 0x%x\n",
++ vsi->vsi_num, promisc_m);
+ return status;
+ }
+
+@@ -423,6 +427,16 @@ static int ice_vsi_sync_fltr(struct ice_
+ }
+ err = 0;
+ vlan_ops->dis_rx_filtering(vsi);
++
++ /* promiscuous mode implies allmulticast so
++ * that VSIs that are in promiscuous mode are
++ * subscribed to multicast packets coming to
++ * the port
++ */
++ err = ice_set_promisc(vsi,
++ ICE_MCAST_PROMISC_BITS);
++ if (err)
++ goto out_promisc;
+ }
+ } else {
+ /* Clear Rx filter to remove traffic from wire */
+@@ -439,6 +453,18 @@ static int ice_vsi_sync_fltr(struct ice_
+ NETIF_F_HW_VLAN_CTAG_FILTER)
+ vlan_ops->ena_rx_filtering(vsi);
+ }
++
++ /* disable allmulti here, but only if allmulti is not
++ * still enabled for the netdev
++ */
++ if (!(vsi->current_netdev_flags & IFF_ALLMULTI)) {
++ err = ice_clear_promisc(vsi,
++ ICE_MCAST_PROMISC_BITS);
++ if (err) {
++ netdev_err(netdev, "Error %d clearing multicast promiscuous on VSI %i\n",
++ err, vsi->vsi_num);
++ }
++ }
+ }
+ }
+ goto exit;
--- /dev/null
+From 1f090494170ea298530cf1285fb8d078e355b4c0 Mon Sep 17 00:00:00 2001
+From: Larysa Zaremba <larysa.zaremba@intel.com>
+Date: Thu, 9 Feb 2023 17:01:30 +0100
+Subject: ice: xsk: Fix cleaning of XDP_TX frames
+
+From: Larysa Zaremba <larysa.zaremba@intel.com>
+
+commit 1f090494170ea298530cf1285fb8d078e355b4c0 upstream.
+
+Incrementation of xsk_frames inside the for-loop produces
+infinite loop, if we have both normal AF_XDP-TX and XDP_TXed
+buffers to complete.
+
+Split xsk_frames into 2 variables (xsk_frames and completed_frames)
+to eliminate this bug.
+
+Fixes: 29322791bc8b ("ice: xsk: change batched Tx descriptor cleaning")
+Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Acked-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://lore.kernel.org/r/20230209160130.1779890-1-larysa.zaremba@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_xsk.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_xsk.c
++++ b/drivers/net/ethernet/intel/ice/ice_xsk.c
+@@ -789,6 +789,7 @@ static void ice_clean_xdp_irq_zc(struct
+ struct ice_tx_desc *tx_desc;
+ u16 cnt = xdp_ring->count;
+ struct ice_tx_buf *tx_buf;
++ u16 completed_frames = 0;
+ u16 xsk_frames = 0;
+ u16 last_rs;
+ int i;
+@@ -798,19 +799,21 @@ static void ice_clean_xdp_irq_zc(struct
+ if ((tx_desc->cmd_type_offset_bsz &
+ cpu_to_le64(ICE_TX_DESC_DTYPE_DESC_DONE))) {
+ if (last_rs >= ntc)
+- xsk_frames = last_rs - ntc + 1;
++ completed_frames = last_rs - ntc + 1;
+ else
+- xsk_frames = last_rs + cnt - ntc + 1;
++ completed_frames = last_rs + cnt - ntc + 1;
+ }
+
+- if (!xsk_frames)
++ if (!completed_frames)
+ return;
+
+- if (likely(!xdp_ring->xdp_tx_active))
++ if (likely(!xdp_ring->xdp_tx_active)) {
++ xsk_frames = completed_frames;
+ goto skip;
++ }
+
+ ntc = xdp_ring->next_to_clean;
+- for (i = 0; i < xsk_frames; i++) {
++ for (i = 0; i < completed_frames; i++) {
+ tx_buf = &xdp_ring->tx_buf[ntc];
+
+ if (tx_buf->raw_buf) {
+@@ -826,7 +829,7 @@ static void ice_clean_xdp_irq_zc(struct
+ }
+ skip:
+ tx_desc->cmd_type_offset_bsz = 0;
+- xdp_ring->next_to_clean += xsk_frames;
++ xdp_ring->next_to_clean += completed_frames;
+ if (xdp_ring->next_to_clean >= cnt)
+ xdp_ring->next_to_clean -= cnt;
+ if (xsk_frames)
--- /dev/null
+From f9cd6a4418bac6a046ee78382423b1ae7565fb24 Mon Sep 17 00:00:00 2001
+From: Jason Xing <kernelxing@tencent.com>
+Date: Wed, 8 Feb 2023 10:43:32 +0800
+Subject: ixgbe: allow to increase MTU to 3K with XDP enabled
+
+From: Jason Xing <kernelxing@tencent.com>
+
+commit f9cd6a4418bac6a046ee78382423b1ae7565fb24 upstream.
+
+Recently I encountered one case where I cannot increase the MTU size
+directly from 1500 to a much bigger value with XDP enabled if the
+server is equipped with IXGBE card, which happened on thousands of
+servers in production environment. After applying the current patch,
+we can set the maximum MTU size to 3K.
+
+This patch follows the behavior of changing MTU as i40e/ice does.
+
+References:
+[1] commit 23b44513c3e6 ("ice: allow 3k MTU for XDP")
+[2] commit 0c8493d90b6b ("i40e: add XDP support for pass and drop actions")
+
+Fixes: fabf1bce103a ("ixgbe: Prevent unsupported configurations with XDP")
+Signed-off-by: Jason Xing <kernelxing@tencent.com>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> (A Contingent Worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 25 ++++++++++++++++---------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -6778,6 +6778,18 @@ static void ixgbe_free_all_rx_resources(
+ }
+
+ /**
++ * ixgbe_max_xdp_frame_size - returns the maximum allowed frame size for XDP
++ * @adapter: device handle, pointer to adapter
++ */
++static int ixgbe_max_xdp_frame_size(struct ixgbe_adapter *adapter)
++{
++ if (PAGE_SIZE >= 8192 || adapter->flags2 & IXGBE_FLAG2_RX_LEGACY)
++ return IXGBE_RXBUFFER_2K;
++ else
++ return IXGBE_RXBUFFER_3K;
++}
++
++/**
+ * ixgbe_change_mtu - Change the Maximum Transfer Unit
+ * @netdev: network interface device structure
+ * @new_mtu: new value for maximum frame size
+@@ -6788,18 +6800,13 @@ static int ixgbe_change_mtu(struct net_d
+ {
+ struct ixgbe_adapter *adapter = netdev_priv(netdev);
+
+- if (adapter->xdp_prog) {
++ if (ixgbe_enabled_xdp_adapter(adapter)) {
+ int new_frame_size = new_mtu + ETH_HLEN + ETH_FCS_LEN +
+ VLAN_HLEN;
+- int i;
+-
+- for (i = 0; i < adapter->num_rx_queues; i++) {
+- struct ixgbe_ring *ring = adapter->rx_ring[i];
+
+- if (new_frame_size > ixgbe_rx_bufsz(ring)) {
+- e_warn(probe, "Requested MTU size is not supported with XDP\n");
+- return -EINVAL;
+- }
++ if (new_frame_size > ixgbe_max_xdp_frame_size(adapter)) {
++ e_warn(probe, "Requested MTU size is not supported with XDP\n");
++ return -EINVAL;
+ }
+ }
+
--- /dev/null
+From d61615c366a489646a1bfe5b33455f916762d5f4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 8 Feb 2023 10:16:37 +0100
+Subject: net: bgmac: fix BCM5358 support by setting correct flags
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+commit d61615c366a489646a1bfe5b33455f916762d5f4 upstream.
+
+Code blocks handling BCMA_CHIP_ID_BCM5357 and BCMA_CHIP_ID_BCM53572 were
+incorrectly unified. Chip package values are not unique and cannot be
+checked independently. They are meaningful only in a context of a given
+chip.
+
+Packages BCM5358 and BCM47188 share the same value but then belong to
+different chips. Code unification resulted in treating BCM5358 as
+BCM47188 and broke its initialization.
+
+Link: https://github.com/openwrt/openwrt/issues/8278
+Fixes: cb1b0f90acfe ("net: ethernet: bgmac: unify code of the same family")
+Cc: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20230208091637.16291-1-zajec5@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bgmac-bcma.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
+@@ -240,12 +240,12 @@ static int bgmac_probe(struct bcma_devic
+ bgmac->feature_flags |= BGMAC_FEAT_CLKCTLST;
+ bgmac->feature_flags |= BGMAC_FEAT_FLW_CTRL1;
+ bgmac->feature_flags |= BGMAC_FEAT_SW_TYPE_PHY;
+- if (ci->pkg == BCMA_PKG_ID_BCM47188 ||
+- ci->pkg == BCMA_PKG_ID_BCM47186) {
++ if ((ci->id == BCMA_CHIP_ID_BCM5357 && ci->pkg == BCMA_PKG_ID_BCM47186) ||
++ (ci->id == BCMA_CHIP_ID_BCM53572 && ci->pkg == BCMA_PKG_ID_BCM47188)) {
+ bgmac->feature_flags |= BGMAC_FEAT_SW_TYPE_RGMII;
+ bgmac->feature_flags |= BGMAC_FEAT_IOST_ATTACHED;
+ }
+- if (ci->pkg == BCMA_PKG_ID_BCM5358)
++ if (ci->id == BCMA_CHIP_ID_BCM5357 && ci->pkg == BCMA_PKG_ID_BCM5358)
+ bgmac->feature_flags |= BGMAC_FEAT_SW_TYPE_EPHYRMII;
+ break;
+ case BCMA_CHIP_ID_BCM53573:
--- /dev/null
+From 0ed577e7e8e508c24e22ba07713ecc4903e147c3 Mon Sep 17 00:00:00 2001
+From: Siddharth Vadapalli <s-vadapalli@ti.com>
+Date: Thu, 9 Feb 2023 14:14:32 +0530
+Subject: net: ethernet: ti: am65-cpsw: Add RX DMA Channel Teardown Quirk
+
+From: Siddharth Vadapalli <s-vadapalli@ti.com>
+
+commit 0ed577e7e8e508c24e22ba07713ecc4903e147c3 upstream.
+
+In TI's AM62x/AM64x SoCs, successful teardown of RX DMA Channel raises an
+interrupt. The process of servicing this interrupt involves flushing all
+pending RX DMA descriptors and clearing the teardown completion marker
+(TDCM). The am65_cpsw_nuss_rx_packets() function invoked from the RX
+NAPI callback services the interrupt. Thus, it is necessary to wait for
+this handler to run, drain all packets and clear TDCM, before calling
+napi_disable() in am65_cpsw_nuss_common_stop() function post channel
+teardown. If napi_disable() executes before ensuring that TDCM is
+cleared, the TDCM remains set when the interfaces are down, resulting in
+an interrupt storm when the interfaces are brought up again.
+
+Since the interrupt raised to indicate the RX DMA Channel teardown is
+specific to the AM62x and AM64x SoCs, add a quirk for it.
+
+Fixes: 4f7cce272403 ("net: ethernet: ti: am65-cpsw: add support for am64x cpsw3g")
+Co-developed-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Reviewed-by: Roger Quadros <rogerq@kernel.org>
+Link: https://lore.kernel.org/r/20230209084432.189222-1-s-vadapalli@ti.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/am65-cpsw-nuss.c | 12 +++++++++++-
+ drivers/net/ethernet/ti/am65-cpsw-nuss.h | 1 +
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+@@ -500,7 +500,15 @@ static int am65_cpsw_nuss_common_stop(st
+ k3_udma_glue_disable_tx_chn(common->tx_chns[i].tx_chn);
+ }
+
++ reinit_completion(&common->tdown_complete);
+ k3_udma_glue_tdown_rx_chn(common->rx_chns.rx_chn, true);
++
++ if (common->pdata.quirks & AM64_CPSW_QUIRK_DMA_RX_TDOWN_IRQ) {
++ i = wait_for_completion_timeout(&common->tdown_complete, msecs_to_jiffies(1000));
++ if (!i)
++ dev_err(common->dev, "rx teardown timeout\n");
++ }
++
+ napi_disable(&common->napi_rx);
+
+ for (i = 0; i < AM65_CPSW_MAX_RX_FLOWS; i++)
+@@ -704,6 +712,8 @@ static int am65_cpsw_nuss_rx_packets(str
+
+ if (cppi5_desc_is_tdcm(desc_dma)) {
+ dev_dbg(dev, "%s RX tdown flow: %u\n", __func__, flow_idx);
++ if (common->pdata.quirks & AM64_CPSW_QUIRK_DMA_RX_TDOWN_IRQ)
++ complete(&common->tdown_complete);
+ return 0;
+ }
+
+@@ -2634,7 +2644,7 @@ static const struct am65_cpsw_pdata j721
+ };
+
+ static const struct am65_cpsw_pdata am64x_cpswxg_pdata = {
+- .quirks = 0,
++ .quirks = AM64_CPSW_QUIRK_DMA_RX_TDOWN_IRQ,
+ .ale_dev_id = "am64-cpswxg",
+ .fdqring_mode = K3_RINGACC_RING_MODE_RING,
+ };
+--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.h
++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.h
+@@ -86,6 +86,7 @@ struct am65_cpsw_rx_chn {
+ };
+
+ #define AM65_CPSW_QUIRK_I2027_NO_TX_CSUM BIT(0)
++#define AM64_CPSW_QUIRK_DMA_RX_TDOWN_IRQ BIT(1)
+
+ struct am65_cpsw_pdata {
+ u32 quirks;
--- /dev/null
+From ee059170b1f7e94e55fa6cadee544e176a6e59c2 Mon Sep 17 00:00:00 2001
+From: Pedro Tammela <pctammela@mojatatu.com>
+Date: Thu, 9 Feb 2023 11:37:39 -0300
+Subject: net/sched: tcindex: update imperfect hash filters respecting rcu
+
+From: Pedro Tammela <pctammela@mojatatu.com>
+
+commit ee059170b1f7e94e55fa6cadee544e176a6e59c2 upstream.
+
+The imperfect hash area can be updated while packets are traversing,
+which will cause a use-after-free when 'tcf_exts_exec()' is called
+with the destroyed tcf_ext.
+
+CPU 0: CPU 1:
+tcindex_set_parms tcindex_classify
+tcindex_lookup
+ tcindex_lookup
+tcf_exts_change
+ tcf_exts_exec [UAF]
+
+Stop operating on the shared area directly, by using a local copy,
+and update the filter with 'rcu_replace_pointer()'. Delete the old
+filter version only after a rcu grace period elapsed.
+
+Fixes: 9b0d4446b569 ("net: sched: avoid atomic swap in tcf_exts_change")
+Reported-by: valis <sec@valis.email>
+Suggested-by: valis <sec@valis.email>
+Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
+Link: https://lore.kernel.org/r/20230209143739.279867-1-pctammela@mojatatu.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/cls_tcindex.c | 34 ++++++++++++++++++++++++++++++----
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+--- a/net/sched/cls_tcindex.c
++++ b/net/sched/cls_tcindex.c
+@@ -12,6 +12,7 @@
+ #include <linux/errno.h>
+ #include <linux/slab.h>
+ #include <linux/refcount.h>
++#include <linux/rcupdate.h>
+ #include <net/act_api.h>
+ #include <net/netlink.h>
+ #include <net/pkt_cls.h>
+@@ -338,6 +339,7 @@ tcindex_set_parms(struct net *net, struc
+ struct tcf_result cr = {};
+ int err, balloc = 0;
+ struct tcf_exts e;
++ bool update_h = false;
+
+ err = tcf_exts_init(&e, net, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
+ if (err < 0)
+@@ -455,10 +457,13 @@ tcindex_set_parms(struct net *net, struc
+ }
+ }
+
+- if (cp->perfect)
++ if (cp->perfect) {
+ r = cp->perfect + handle;
+- else
+- r = tcindex_lookup(cp, handle) ? : &new_filter_result;
++ } else {
++ /* imperfect area is updated in-place using rcu */
++ update_h = !!tcindex_lookup(cp, handle);
++ r = &new_filter_result;
++ }
+
+ if (r == &new_filter_result) {
+ f = kzalloc(sizeof(*f), GFP_KERNEL);
+@@ -484,7 +489,28 @@ tcindex_set_parms(struct net *net, struc
+
+ rcu_assign_pointer(tp->root, cp);
+
+- if (r == &new_filter_result) {
++ if (update_h) {
++ struct tcindex_filter __rcu **fp;
++ struct tcindex_filter *cf;
++
++ f->result.res = r->res;
++ tcf_exts_change(&f->result.exts, &r->exts);
++
++ /* imperfect area bucket */
++ fp = cp->h + (handle % cp->hash);
++
++ /* lookup the filter, guaranteed to exist */
++ for (cf = rcu_dereference_bh_rtnl(*fp); cf;
++ fp = &cf->next, cf = rcu_dereference_bh_rtnl(*fp))
++ if (cf->key == handle)
++ break;
++
++ f->next = cf->next;
++
++ cf = rcu_replace_pointer(*fp, f, 1);
++ tcf_exts_get_net(&cf->result.exts);
++ tcf_queue_work(&cf->rwork, tcindex_destroy_fexts_work);
++ } else if (r == &new_filter_result) {
+ struct tcindex_filter *nfp;
+ struct tcindex_filter __rcu **fp;
+
--- /dev/null
+From a5b21d8d791cd4db609d0bbcaa9e0c7e019888d1 Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Thu, 2 Feb 2023 18:07:35 -0800
+Subject: revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit a5b21d8d791cd4db609d0bbcaa9e0c7e019888d1 upstream.
+
+This fix was nacked by Philip, for reasons identified in the email linked
+below.
+
+Link: https://lkml.kernel.org/r/68f15d67-8945-2728-1f17-5b53a80ec52d@squashfs.org.uk
+Fixes: 72e544b1b28325 ("squashfs: harden sanity check in squashfs_read_xattr_id_table")
+Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Cc: Fedor Pchelkin <pchelkin@ispras.ru>
+Cc: Phillip Lougher <phillip@squashfs.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/squashfs/xattr_id.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/squashfs/xattr_id.c
++++ b/fs/squashfs/xattr_id.c
+@@ -76,7 +76,7 @@ __le64 *squashfs_read_xattr_id_table(str
+ /* Sanity check values */
+
+ /* there is always at least one xattr id */
+- if (*xattr_ids <= 0)
++ if (*xattr_ids == 0)
+ return ERR_PTR(-EINVAL);
+
+ len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);
--- /dev/null
+From a1221703a0f75a9d81748c516457e0fc76951496 Mon Sep 17 00:00:00 2001
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+Date: Thu, 9 Feb 2023 12:13:05 +0000
+Subject: sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+commit a1221703a0f75a9d81748c516457e0fc76951496 upstream.
+
+Use list_is_first() to check whether tsp->asoc matches the first
+element of ep->asocs, as the list is not guaranteed to have an entry.
+
+Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Link: https://lore.kernel.org/r/20230208-sctp-filter-v2-1-6e1f4017f326@diag.uniroma1.it
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/diag.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/net/sctp/diag.c
++++ b/net/sctp/diag.c
+@@ -343,11 +343,9 @@ static int sctp_sock_filter(struct sctp_
+ struct sctp_comm_param *commp = p;
+ struct sock *sk = ep->base.sk;
+ const struct inet_diag_req_v2 *r = commp->r;
+- struct sctp_association *assoc =
+- list_entry(ep->asocs.next, struct sctp_association, asocs);
+
+ /* find the ep only once through the transports by this condition */
+- if (tsp->asoc != assoc)
++ if (!list_is_first(&tsp->asoc->asocs, &ep->asocs))
+ return 0;
+
+ if (r->sdiag_family != AF_UNSPEC && sk->sk_family != r->sdiag_family)
coredump-move-dump_emit_page-to-kill-unused-warning.patch
revert-mm-always-release-pages-to-the-buddy-allocator-in-memblock_free_late.patch
net-fix-unwanted-sign-extension-in-netdev_stats_to_stats64.patch
+revert-squashfs-harden-sanity-check-in-squashfs_read_xattr_id_table.patch
+drm-vc4-crtc-increase-setup-cost-in-core-clock-calculation-to-handle-extreme-reduced-blanking.patch
+drm-vc4-fix-yuv-plane-handling-when-planes-are-in-different-buffers.patch
+drm-i915-gen11-wa_1408615072-wa_1407596294-should-be-on-gt-list.patch
+ice-fix-lost-multicast-packets-in-promisc-mode.patch
+ixgbe-allow-to-increase-mtu-to-3k-with-xdp-enabled.patch
+i40e-add-double-of-vlan-header-when-computing-the-max-mtu.patch
+net-bgmac-fix-bcm5358-support-by-setting-correct-flags.patch
+net-ethernet-ti-am65-cpsw-add-rx-dma-channel-teardown-quirk.patch
+sctp-sctp_sock_filter-avoid-list_entry-on-possibly-empty-list.patch
+net-sched-tcindex-update-imperfect-hash-filters-respecting-rcu.patch
+ice-xsk-fix-cleaning-of-xdp_tx-frames.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
