--- /dev/null
+From 4a7270461d3dacebc2b65ee2c88df2ab67fae123 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 14:33:42 +0100
+Subject: ACPI: bus: Rework system-level device notification handling
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit c56610a869bce03490faf4f157076370c71b8ae3 ]
+
+For ACPI drivers that provide a ->notify() callback and set
+ACPI_DRIVER_ALL_NOTIFY_EVENTS in their flags, that callback can be
+invoked while either the ->add() or the ->remove() callback is running
+without any synchronization at the bus type level which is counter to
+the common-sense expectation that notification handling should only be
+enabled when the driver is actually bound to the device. As a result,
+if the driver is not careful enough, it's ->notify() callback may crash
+when it is invoked too early or too late [1].
+
+This issue has been amplified by commit d6fb6ee1820c ("ACPI: bus: Drop
+driver member of struct acpi_device") that made acpi_bus_notify() check
+for the presence of the driver and its ->notify() callback directly
+instead of using an extra driver pointer that was only set and cleared
+by the bus type code, but it was present before that commit although
+it was harder to reproduce then.
+
+It can be addressed by using the observation that
+acpi_device_install_notify_handler() can be modified to install the
+handler for all types of events when ACPI_DRIVER_ALL_NOTIFY_EVENTS is
+set in the driver flags, in which case acpi_bus_notify() will not need
+to invoke the driver's ->notify() callback any more and that callback
+will only be invoked after acpi_device_install_notify_handler() has run
+and before acpi_device_remove_notify_handler() runs, which implies the
+correct ordering with respect to the other ACPI driver callbacks.
+
+Modify the code accordingly and while at it, drop two redundant local
+variables from acpi_bus_notify() and turn its description comment into
+a proper kerneldoc one.
+
+Fixes: d6fb6ee1820c ("ACPI: bus: Drop driver member of struct acpi_device")
+Link: https://lore.kernel.org/linux-acpi/9f6cba7a8a57e5a687c934e8e406e28c.squirrel@mail.panix.com # [1]
+Reported-by: Pierre Asselin <pa@panix.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Tested-by: Pierre Asselin <pa@panix.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/bus.c | 83 +++++++++++++++++++++-------------------------
+ 1 file changed, 37 insertions(+), 46 deletions(-)
+
+diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
+index d466c81953146..3b6146b1e25cc 100644
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -456,85 +456,67 @@ static void acpi_bus_osc_negotiate_usb_control(void)
+ Notification Handling
+ -------------------------------------------------------------------------- */
+
+-/*
+- * acpi_bus_notify
+- * ---------------
+- * Callback for all 'system-level' device notifications (values 0x00-0x7F).
++/**
++ * acpi_bus_notify - Global system-level (0x00-0x7F) notifications handler
++ * @handle: Target ACPI object.
++ * @type: Notification type.
++ * @data: Ignored.
++ *
++ * This only handles notifications related to device hotplug.
+ */
+ static void acpi_bus_notify(acpi_handle handle, u32 type, void *data)
+ {
+ struct acpi_device *adev;
+- u32 ost_code = ACPI_OST_SC_NON_SPECIFIC_FAILURE;
+- bool hotplug_event = false;
+
+ switch (type) {
+ case ACPI_NOTIFY_BUS_CHECK:
+ acpi_handle_debug(handle, "ACPI_NOTIFY_BUS_CHECK event\n");
+- hotplug_event = true;
+ break;
+
+ case ACPI_NOTIFY_DEVICE_CHECK:
+ acpi_handle_debug(handle, "ACPI_NOTIFY_DEVICE_CHECK event\n");
+- hotplug_event = true;
+ break;
+
+ case ACPI_NOTIFY_DEVICE_WAKE:
+ acpi_handle_debug(handle, "ACPI_NOTIFY_DEVICE_WAKE event\n");
+- break;
++ return;
+
+ case ACPI_NOTIFY_EJECT_REQUEST:
+ acpi_handle_debug(handle, "ACPI_NOTIFY_EJECT_REQUEST event\n");
+- hotplug_event = true;
+ break;
+
+ case ACPI_NOTIFY_DEVICE_CHECK_LIGHT:
+ acpi_handle_debug(handle, "ACPI_NOTIFY_DEVICE_CHECK_LIGHT event\n");
+ /* TBD: Exactly what does 'light' mean? */
+- break;
++ return;
+
+ case ACPI_NOTIFY_FREQUENCY_MISMATCH:
+ acpi_handle_err(handle, "Device cannot be configured due "
+ "to a frequency mismatch\n");
+- break;
++ return;
+
+ case ACPI_NOTIFY_BUS_MODE_MISMATCH:
+ acpi_handle_err(handle, "Device cannot be configured due "
+ "to a bus mode mismatch\n");
+- break;
++ return;
+
+ case ACPI_NOTIFY_POWER_FAULT:
+ acpi_handle_err(handle, "Device has suffered a power fault\n");
+- break;
++ return;
+
+ default:
+ acpi_handle_debug(handle, "Unknown event type 0x%x\n", type);
+- break;
++ return;
+ }
+
+ adev = acpi_get_acpi_dev(handle);
+- if (!adev)
+- goto err;
+-
+- if (adev->dev.driver) {
+- struct acpi_driver *driver = to_acpi_driver(adev->dev.driver);
+-
+- if (driver && driver->ops.notify &&
+- (driver->flags & ACPI_DRIVER_ALL_NOTIFY_EVENTS))
+- driver->ops.notify(adev, type);
+- }
+-
+- if (!hotplug_event) {
+- acpi_put_acpi_dev(adev);
+- return;
+- }
+
+- if (ACPI_SUCCESS(acpi_hotplug_schedule(adev, type)))
++ if (adev && ACPI_SUCCESS(acpi_hotplug_schedule(adev, type)))
+ return;
+
+ acpi_put_acpi_dev(adev);
+
+- err:
+- acpi_evaluate_ost(handle, type, ost_code, NULL);
++ acpi_evaluate_ost(handle, type, ACPI_OST_SC_NON_SPECIFIC_FAILURE, NULL);
+ }
+
+ static void acpi_notify_device(acpi_handle handle, u32 event, void *data)
+@@ -559,42 +541,51 @@ static u32 acpi_device_fixed_event(void *data)
+ return ACPI_INTERRUPT_HANDLED;
+ }
+
+-static int acpi_device_install_notify_handler(struct acpi_device *device)
++static int acpi_device_install_notify_handler(struct acpi_device *device,
++ struct acpi_driver *acpi_drv)
+ {
+ acpi_status status;
+
+- if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON)
++ if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) {
+ status =
+ acpi_install_fixed_event_handler(ACPI_EVENT_POWER_BUTTON,
+ acpi_device_fixed_event,
+ device);
+- else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON)
++ } else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) {
+ status =
+ acpi_install_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON,
+ acpi_device_fixed_event,
+ device);
+- else
+- status = acpi_install_notify_handler(device->handle,
+- ACPI_DEVICE_NOTIFY,
++ } else {
++ u32 type = acpi_drv->flags & ACPI_DRIVER_ALL_NOTIFY_EVENTS ?
++ ACPI_ALL_NOTIFY : ACPI_DEVICE_NOTIFY;
++
++ status = acpi_install_notify_handler(device->handle, type,
+ acpi_notify_device,
+ device);
++ }
+
+ if (ACPI_FAILURE(status))
+ return -EINVAL;
+ return 0;
+ }
+
+-static void acpi_device_remove_notify_handler(struct acpi_device *device)
++static void acpi_device_remove_notify_handler(struct acpi_device *device,
++ struct acpi_driver *acpi_drv)
+ {
+- if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON)
++ if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON) {
+ acpi_remove_fixed_event_handler(ACPI_EVENT_POWER_BUTTON,
+ acpi_device_fixed_event);
+- else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON)
++ } else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON) {
+ acpi_remove_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON,
+ acpi_device_fixed_event);
+- else
+- acpi_remove_notify_handler(device->handle, ACPI_DEVICE_NOTIFY,
++ } else {
++ u32 type = acpi_drv->flags & ACPI_DRIVER_ALL_NOTIFY_EVENTS ?
++ ACPI_ALL_NOTIFY : ACPI_DEVICE_NOTIFY;
++
++ acpi_remove_notify_handler(device->handle, type,
+ acpi_notify_device);
++ }
+ }
+
+ /* Handle events targeting \_SB device (at present only graceful shutdown) */
+@@ -1036,7 +1027,7 @@ static int acpi_device_probe(struct device *dev)
+ acpi_drv->name, acpi_dev->pnp.bus_id);
+
+ if (acpi_drv->ops.notify) {
+- ret = acpi_device_install_notify_handler(acpi_dev);
++ ret = acpi_device_install_notify_handler(acpi_dev, acpi_drv);
+ if (ret) {
+ if (acpi_drv->ops.remove)
+ acpi_drv->ops.remove(acpi_dev);
+@@ -1059,7 +1050,7 @@ static void acpi_device_remove(struct device *dev)
+ struct acpi_driver *acpi_drv = to_acpi_driver(dev->driver);
+
+ if (acpi_drv->ops.notify)
+- acpi_device_remove_notify_handler(acpi_dev);
++ acpi_device_remove_notify_handler(acpi_dev, acpi_drv);
+
+ if (acpi_drv->ops.remove)
+ acpi_drv->ops.remove(acpi_dev);
+--
+2.39.2
+
--- /dev/null
+From bde6b3f91770a81e71e961a23f1a3400034105a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 15:28:38 +0100
+Subject: ALSA: usb-audio: Fix recursive locking at XRUN during syncing
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 8c721c53dda512fdd48eb24d6d99e56deee57898 ]
+
+The recent support of low latency playback in USB-audio driver made
+the snd_usb_queue_pending_output_urbs() function to be called via PCM
+ack ops. In the new code path, the function is performed already in
+the PCM stream lock. The problem is that, when an XRUN is detected,
+the function calls snd_pcm_xrun() to notify, but snd_pcm_xrun() is
+supposed to be called only outside the stream lock. As a result, it
+leads to a deadlock of PCM stream locking.
+
+For avoiding such a recursive locking, this patch adds an additional
+check to the code paths in PCM core that call the ack callback; now it
+checks the error code from the callback, and if it's -EPIPE, the XRUN
+is handled in the PCM core side gracefully. Along with it, the
+USB-audio driver code is changed to follow that, i.e. -EPIPE is
+returned instead of the explicit snd_pcm_xrun() call when the function
+is performed already in the stream lock.
+
+Fixes: d5f871f89e21 ("ALSA: usb-audio: Improved lowlatency playback support")
+Reported-and-tested-by: John Keeping <john@metanate.com>
+Link: https://lore.kernel.org/r/20230317195128.3911155-1-john@metanate.com
+Reviewed-by: Jaroslav Kysela <perex@perex.cz>
+Reviewed-by; Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20230320142838.494-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/pcm_lib.c | 2 ++
+ sound/usb/endpoint.c | 22 ++++++++++++++--------
+ sound/usb/endpoint.h | 4 ++--
+ sound/usb/pcm.c | 2 +-
+ 4 files changed, 19 insertions(+), 11 deletions(-)
+
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 8b6aeb8a78f7d..02fd65993e7e5 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -2155,6 +2155,8 @@ int pcm_lib_apply_appl_ptr(struct snd_pcm_substream *substream,
+ ret = substream->ops->ack(substream);
+ if (ret < 0) {
+ runtime->control->appl_ptr = old_appl_ptr;
++ if (ret == -EPIPE)
++ __snd_pcm_xrun(substream);
+ return ret;
+ }
+ }
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 419302e2057e8..647fa054d8b1d 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -455,8 +455,8 @@ static void push_back_to_ready_list(struct snd_usb_endpoint *ep,
+ * This function is used both for implicit feedback endpoints and in low-
+ * latency playback mode.
+ */
+-void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
+- bool in_stream_lock)
++int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
++ bool in_stream_lock)
+ {
+ bool implicit_fb = snd_usb_endpoint_implicit_feedback_sink(ep);
+
+@@ -480,7 +480,7 @@ void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
+ spin_unlock_irqrestore(&ep->lock, flags);
+
+ if (ctx == NULL)
+- return;
++ break;
+
+ /* copy over the length information */
+ if (implicit_fb) {
+@@ -495,11 +495,14 @@ void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
+ break;
+ if (err < 0) {
+ /* push back to ready list again for -EAGAIN */
+- if (err == -EAGAIN)
++ if (err == -EAGAIN) {
+ push_back_to_ready_list(ep, ctx);
+- else
++ break;
++ }
++
++ if (!in_stream_lock)
+ notify_xrun(ep);
+- return;
++ return -EPIPE;
+ }
+
+ err = usb_submit_urb(ctx->urb, GFP_ATOMIC);
+@@ -507,13 +510,16 @@ void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
+ usb_audio_err(ep->chip,
+ "Unable to submit urb #%d: %d at %s\n",
+ ctx->index, err, __func__);
+- notify_xrun(ep);
+- return;
++ if (!in_stream_lock)
++ notify_xrun(ep);
++ return -EPIPE;
+ }
+
+ set_bit(ctx->index, &ep->active_mask);
+ atomic_inc(&ep->submitted_urbs);
+ }
++
++ return 0;
+ }
+
+ /*
+diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h
+index 924f4351588ce..c09f68ce08b18 100644
+--- a/sound/usb/endpoint.h
++++ b/sound/usb/endpoint.h
+@@ -52,7 +52,7 @@ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep);
+ int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep,
+ struct snd_urb_ctx *ctx, int idx,
+ unsigned int avail);
+-void snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
+- bool in_stream_lock);
++int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
++ bool in_stream_lock);
+
+ #endif /* __USBAUDIO_ENDPOINT_H */
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 2c5765cbed2d6..1e1d7458bce10 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -1595,7 +1595,7 @@ static int snd_usb_pcm_playback_ack(struct snd_pcm_substream *substream)
+ * outputs here
+ */
+ if (!ep->active_mask)
+- snd_usb_queue_pending_output_urbs(ep, true);
++ return snd_usb_queue_pending_output_urbs(ep, true);
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From f4521775d0ad9fe4a38daa1e1cb0dec8fe88c9ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 06:24:22 +0300
+Subject: ALSA: ymfpci: Create card with device-managed snd_devm_card_new()
+
+From: Tasos Sahanidis <tasos@tasossah.com>
+
+[ Upstream commit f33fc1576757741479452255132d6e3aaf558ffe ]
+
+snd_card_ymfpci_remove() was removed in commit c6e6bb5eab74 ("ALSA:
+ymfpci: Allocate resources with device-managed APIs"), but the call to
+snd_card_new() was not replaced with snd_devm_card_new().
+
+Since there was no longer a call to snd_card_free, unloading the module
+would eventually result in Oops:
+
+[697561.532887] BUG: unable to handle page fault for address: ffffffffc0924480
+[697561.532893] #PF: supervisor read access in kernel mode
+[697561.532896] #PF: error_code(0x0000) - not-present page
+[697561.532899] PGD ae1e15067 P4D ae1e15067 PUD ae1e17067 PMD 11a8f5067 PTE 0
+[697561.532905] Oops: 0000 [#1] PREEMPT SMP NOPTI
+[697561.532909] CPU: 21 PID: 5080 Comm: wireplumber Tainted: G W OE 6.2.7 #1
+[697561.532914] Hardware name: System manufacturer System Product Name/TUF GAMING X570-PLUS, BIOS 4408 10/28/2022
+[697561.532916] RIP: 0010:try_module_get.part.0+0x1a/0xe0
+[697561.532924] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc bf 01 00 00 00 e8 56 3c f8 ff <41> 83 3c 24 02 0f 84 96 00 00 00 41 8b 84 24 30 03 00 00 85 c0 0f
+[697561.532927] RSP: 0018:ffffbe9b858c3bd8 EFLAGS: 00010246
+[697561.532930] RAX: ffff9815d14f1900 RBX: ffff9815c14e6000 RCX: 0000000000000000
+[697561.532933] RDX: 0000000000000000 RSI: ffffffffc055092c RDI: ffffffffb3778c1a
+[697561.532935] RBP: ffffbe9b858c3be8 R08: 0000000000000040 R09: ffff981a1a741380
+[697561.532937] R10: ffffbe9b858c3c80 R11: 00000009d56533a6 R12: ffffffffc0924480
+[697561.532939] R13: ffff9823439d8500 R14: 0000000000000025 R15: ffff9815cd109f80
+[697561.532942] FS: 00007f13084f1f80(0000) GS:ffff9824aef40000(0000) knlGS:0000000000000000
+[697561.532945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[697561.532947] CR2: ffffffffc0924480 CR3: 0000000145344000 CR4: 0000000000350ee0
+[697561.532949] Call Trace:
+[697561.532951] <TASK>
+[697561.532955] try_module_get+0x13/0x30
+[697561.532960] snd_ctl_open+0x61/0x1c0 [snd]
+[697561.532976] snd_open+0xb4/0x1e0 [snd]
+[697561.532989] chrdev_open+0xc7/0x240
+[697561.532995] ? fsnotify_perm.part.0+0x6e/0x160
+[697561.533000] ? __pfx_chrdev_open+0x10/0x10
+[697561.533005] do_dentry_open+0x169/0x440
+[697561.533009] vfs_open+0x2d/0x40
+[697561.533012] path_openat+0xa9d/0x10d0
+[697561.533017] ? debug_smp_processor_id+0x17/0x20
+[697561.533022] ? trigger_load_balance+0x65/0x370
+[697561.533026] do_filp_open+0xb2/0x160
+[697561.533032] ? _raw_spin_unlock+0x19/0x40
+[697561.533036] ? alloc_fd+0xa9/0x190
+[697561.533040] do_sys_openat2+0x9f/0x160
+[697561.533044] __x64_sys_openat+0x55/0x90
+[697561.533048] do_syscall_64+0x3b/0x90
+[697561.533052] entry_SYSCALL_64_after_hwframe+0x72/0xdc
+[697561.533056] RIP: 0033:0x7f1308a40db4
+[697561.533059] Code: 24 20 eb 8f 66 90 44 89 54 24 0c e8 46 68 f8 ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 32 44 89 c7 89 44 24 0c e8 78 68 f8 ff 8b 44
+[697561.533062] RSP: 002b:00007ffcce664450 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
+[697561.533066] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1308a40db4
+[697561.533068] RDX: 0000000000080000 RSI: 00007ffcce664690 RDI: 00000000ffffff9c
+[697561.533070] RBP: 00007ffcce664690 R08: 0000000000000000 R09: 0000000000000012
+[697561.533072] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000080000
+[697561.533074] R13: 00007f13054b069b R14: 0000565209f83200 R15: 0000000000000000
+[697561.533078] </TASK>
+
+Fixes: c6e6bb5eab74 ("ALSA: ymfpci: Allocate resources with device-managed APIs")
+Signed-off-by: Tasos Sahanidis <tasos@tasossah.com>
+Link: https://lore.kernel.org/r/20230329032422.170024-1-tasos@tasossah.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/ymfpci/ymfpci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/ymfpci/ymfpci.c b/sound/pci/ymfpci/ymfpci.c
+index 1e198e4d57b8d..82d4e0fda91be 100644
+--- a/sound/pci/ymfpci/ymfpci.c
++++ b/sound/pci/ymfpci/ymfpci.c
+@@ -170,7 +170,7 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,
+ return -ENOENT;
+ }
+
+- err = snd_card_new(&pci->dev, index[dev], id[dev], THIS_MODULE,
++ err = snd_devm_card_new(&pci->dev, index[dev], id[dev], THIS_MODULE,
+ sizeof(*chip), &card);
+ if (err < 0)
+ return err;
+--
+2.39.2
+
--- /dev/null
+From 1ee2c21b5a84d679e0aca8e7f29357c67231540d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 06:28:08 +0300
+Subject: ALSA: ymfpci: Fix BUG_ON in probe function
+
+From: Tasos Sahanidis <tasos@tasossah.com>
+
+[ Upstream commit 6be2e7522eb529b41c16d459f33bbdbcddbf5c15 ]
+
+The snd_dma_buffer.bytes field now contains the aligned size, which this
+snd_BUG_ON() did not account for, resulting in the following:
+
+[ 9.625915] ------------[ cut here ]------------
+[ 9.633440] WARNING: CPU: 0 PID: 126 at sound/pci/ymfpci/ymfpci_main.c:2168 snd_ymfpci_create+0x681/0x698 [snd_ymfpci]
+[ 9.648926] Modules linked in: snd_ymfpci(+) snd_intel_dspcfg kvm(+) snd_intel_sdw_acpi snd_ac97_codec snd_mpu401_uart snd_opl3_lib irqbypass snd_hda_codec gameport snd_rawmidi crct10dif_pclmul crc32_pclmul cfg80211 snd_hda_core polyval_clmulni polyval_generic gf128mul snd_seq_device ghash_clmulni_intel snd_hwdep ac97_bus sha512_ssse3 rfkill snd_pcm aesni_intel tg3 snd_timer crypto_simd snd mxm_wmi libphy cryptd k10temp fam15h_power pcspkr soundcore sp5100_tco wmi acpi_cpufreq mac_hid dm_multipath sg loop fuse dm_mod bpf_preload ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 sr_mod cdrom ata_generic pata_acpi firewire_ohci crc32c_intel firewire_core xhci_pci crc_itu_t pata_via xhci_pci_renesas floppy
+[ 9.711849] CPU: 0 PID: 126 Comm: kworker/0:2 Not tainted 6.1.21-1-lts #1 08d2e5ece03136efa7c6aeea9a9c40916b1bd8da
+[ 9.722200] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./990FX Extreme4, BIOS P2.70 06/05/2014
+[ 9.732204] Workqueue: events work_for_cpu_fn
+[ 9.736580] RIP: 0010:snd_ymfpci_create+0x681/0x698 [snd_ymfpci]
+[ 9.742594] Code: 8c c0 4c 89 e2 48 89 df 48 c7 c6 92 c6 8c c0 e8 15 d0 e9 ff 48 83 c4 08 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d3 7a 33 e3 <0f> 0b e9 cb fd ff ff 41 bd fb ff ff ff eb db 41 bd f4 ff ff ff eb
+[ 9.761358] RSP: 0018:ffffab64804e7da0 EFLAGS: 00010287
+[ 9.766594] RAX: ffff8fa2df06c400 RBX: ffff8fa3073a8000 RCX: ffff8fa303fbc4a8
+[ 9.773734] RDX: ffff8fa2df06d000 RSI: 0000000000000010 RDI: 0000000000000020
+[ 9.780876] RBP: ffff8fa300b5d0d0 R08: ffff8fa3073a8e50 R09: 00000000df06bf00
+[ 9.788018] R10: ffff8fa2df06bf00 R11: 00000000df068200 R12: ffff8fa3073a8918
+[ 9.795159] R13: 0000000000000000 R14: 0000000000000080 R15: ffff8fa2df068200
+[ 9.802317] FS: 0000000000000000(0000) GS:ffff8fa9fec00000(0000) knlGS:0000000000000000
+[ 9.810414] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 9.816158] CR2: 000055febaf66500 CR3: 0000000101a2e000 CR4: 00000000000406f0
+[ 9.823301] Call Trace:
+[ 9.825747] <TASK>
+[ 9.827889] snd_card_ymfpci_probe+0x194/0x950 [snd_ymfpci b78a5fe64b5663a6390a909c67808567e3e73615]
+[ 9.837030] ? finish_task_switch.isra.0+0x90/0x2d0
+[ 9.841918] local_pci_probe+0x45/0x80
+[ 9.845680] work_for_cpu_fn+0x1a/0x30
+[ 9.849431] process_one_work+0x1c7/0x380
+[ 9.853464] worker_thread+0x1af/0x390
+[ 9.857225] ? rescuer_thread+0x3b0/0x3b0
+[ 9.861254] kthread+0xde/0x110
+[ 9.864414] ? kthread_complete_and_exit+0x20/0x20
+[ 9.869210] ret_from_fork+0x22/0x30
+[ 9.872792] </TASK>
+[ 9.874985] ---[ end trace 0000000000000000 ]---
+
+Fixes: 5c1733e33c88 ("ALSA: memalloc: Align buffer allocations in page size")
+Signed-off-by: Tasos Sahanidis <tasos@tasossah.com>
+Link: https://lore.kernel.org/r/20230329032808.170403-1-tasos@tasossah.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/ymfpci/ymfpci_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
+index c80114c0ad7bf..b492c32ce0704 100644
+--- a/sound/pci/ymfpci/ymfpci_main.c
++++ b/sound/pci/ymfpci/ymfpci_main.c
+@@ -2165,7 +2165,7 @@ static int snd_ymfpci_memalloc(struct snd_ymfpci *chip)
+ chip->work_base = ptr;
+ chip->work_base_addr = ptr_addr;
+
+- snd_BUG_ON(ptr + chip->work_size !=
++ snd_BUG_ON(ptr + PAGE_ALIGN(chip->work_size) !=
+ chip->work_ptr->area + chip->work_ptr->bytes);
+
+ snd_ymfpci_writel(chip, YDSXGR_PLAYCTRLBASE, chip->bank_base_playback_addr);
+--
+2.39.2
+
--- /dev/null
+From 55d4f55c51c4cee8ab02bb20473298c0153781ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 18:30:21 -0700
+Subject: bnxt_en: Add missing 200G link speed reporting
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 581bce7bcb7e7f100908728e7b292e266c76895b ]
+
+bnxt_fw_to_ethtool_speed() is missing the case statement for 200G
+link speed reported by firmware. As a result, ethtool will report
+unknown speed when the firmware reports 200G link speed.
+
+Fixes: 532262ba3b84 ("bnxt_en: ethtool: support PAM4 link speeds up to 200G")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 +
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 02741d499bf4a..1d2588c92977e 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1225,6 +1225,7 @@ struct bnxt_link_info {
+ #define BNXT_LINK_SPEED_40GB PORT_PHY_QCFG_RESP_LINK_SPEED_40GB
+ #define BNXT_LINK_SPEED_50GB PORT_PHY_QCFG_RESP_LINK_SPEED_50GB
+ #define BNXT_LINK_SPEED_100GB PORT_PHY_QCFG_RESP_LINK_SPEED_100GB
++#define BNXT_LINK_SPEED_200GB PORT_PHY_QCFG_RESP_LINK_SPEED_200GB
+ u16 support_speeds;
+ u16 support_pam4_speeds;
+ u16 auto_link_speeds; /* fw adv setting */
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index cdbc62ad659cb..01b973bc509f5 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1712,6 +1712,8 @@ u32 bnxt_fw_to_ethtool_speed(u16 fw_link_speed)
+ return SPEED_50000;
+ case BNXT_LINK_SPEED_100GB:
+ return SPEED_100000;
++ case BNXT_LINK_SPEED_200GB:
++ return SPEED_200000;
+ default:
+ return SPEED_UNKNOWN;
+ }
+--
+2.39.2
+
--- /dev/null
+From 384cceff4ad049c4127ee3bd4924986283236b83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 18:30:19 -0700
+Subject: bnxt_en: Fix reporting of test result in ethtool selftest
+
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+
+[ Upstream commit 83714dc3db0e4a088673601bc8099b079bc1a077 ]
+
+When the selftest command fails, driver is not reporting the failure
+by updating the "test->flags" when bnxt_close_nic() fails.
+
+Fixes: eb51365846bc ("bnxt_en: Add basic ethtool -t selftest support.")
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 703fc163235f9..cdbc62ad659cb 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -3634,6 +3634,7 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest,
+ bnxt_ulp_stop(bp);
+ rc = bnxt_close_nic(bp, true, false);
+ if (rc) {
++ etest->flags |= ETH_TEST_FL_FAILED;
+ bnxt_ulp_start(bp, rc);
+ return;
+ }
+--
+2.39.2
+
--- /dev/null
+From c4a46662f0122b9510294ee90ca283166cf288f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 18:30:20 -0700
+Subject: bnxt_en: Fix typo in PCI id to device description string mapping
+
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+
+[ Upstream commit 62aad36ed31abc80f35db11e187e690448a79f7d ]
+
+Fix 57502 and 57508 NPAR description string entries. The typos
+caused these devices to not match up with lspci output.
+
+Fixes: 49c98421e6ab ("bnxt_en: Add PCI IDs for 57500 series NPAR devices.")
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 251b102d2792b..c6e36603bd2db 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -175,12 +175,12 @@ static const struct pci_device_id bnxt_pci_tbl[] = {
+ { PCI_VDEVICE(BROADCOM, 0x1750), .driver_data = BCM57508 },
+ { PCI_VDEVICE(BROADCOM, 0x1751), .driver_data = BCM57504 },
+ { PCI_VDEVICE(BROADCOM, 0x1752), .driver_data = BCM57502 },
+- { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57508_NPAR },
++ { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57502_NPAR },
+ { PCI_VDEVICE(BROADCOM, 0x1801), .driver_data = BCM57504_NPAR },
+- { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57502_NPAR },
+- { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57508_NPAR },
++ { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57508_NPAR },
++ { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57502_NPAR },
+ { PCI_VDEVICE(BROADCOM, 0x1804), .driver_data = BCM57504_NPAR },
+- { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57502_NPAR },
++ { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57508_NPAR },
+ { PCI_VDEVICE(BROADCOM, 0xd802), .driver_data = BCM58802 },
+ { PCI_VDEVICE(BROADCOM, 0xd804), .driver_data = BCM58804 },
+ #ifdef CONFIG_BNXT_SRIOV
+--
+2.39.2
+
--- /dev/null
+From 159d7c4d3ab2ea72506dfaf28d86194bd01297ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 11:18:24 -0800
+Subject: ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx()
+
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+
+[ Upstream commit 748b2f5e82d17480404b3e2895388fc2925f7caf ]
+
+mac_len is of type unsigned, which can never be less than zero.
+
+ mac_len = ieee802154_hdr_peek_addrs(skb, &header);
+ if (mac_len < 0)
+ return mac_len;
+
+Change this to type int as ieee802154_hdr_peek_addrs() can return negative
+integers, this is found by static analysis with smatch.
+
+Fixes: 6c993779ea1d ("ca8210: fix mac_len negative array access")
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Acked-by: Alexander Aring <aahringo@redhat.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230306191824.4115839-1-harshit.m.mogalapalli@oracle.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ieee802154/ca8210.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index 0b0c6c0764fe9..d0b5129439ed6 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -1902,10 +1902,9 @@ static int ca8210_skb_tx(
+ struct ca8210_priv *priv
+ )
+ {
+- int status;
+ struct ieee802154_hdr header = { };
+ struct secspec secspec;
+- unsigned int mac_len;
++ int mac_len, status;
+
+ dev_dbg(&priv->spi->dev, "%s called\n", __func__);
+
+--
+2.39.2
+
--- /dev/null
+From a534ec4746b933fb7919c71167bbf4e603a75802 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 16:04:45 +0400
+Subject: can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
+
+From: Ivan Orlov <ivan.orlov0322@gmail.com>
+
+[ Upstream commit 2b4c99f7d9a57ecd644eda9b1fb0a1072414959f ]
+
+Syzkaller reported the following issue:
+
+=====================================================
+BUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline]
+BUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600
+ aio_rw_done fs/aio.c:1520 [inline]
+ aio_write+0x899/0x950 fs/aio.c:1600
+ io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019
+ __do_sys_io_submit fs/aio.c:2078 [inline]
+ __se_sys_io_submit+0x293/0x770 fs/aio.c:2048
+ __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Uninit was created at:
+ slab_post_alloc_hook mm/slab.h:766 [inline]
+ slab_alloc_node mm/slub.c:3452 [inline]
+ __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491
+ __do_kmalloc_node mm/slab_common.c:967 [inline]
+ __kmalloc+0x11d/0x3b0 mm/slab_common.c:981
+ kmalloc_array include/linux/slab.h:636 [inline]
+ bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930
+ bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351
+ sock_sendmsg_nosec net/socket.c:714 [inline]
+ sock_sendmsg net/socket.c:734 [inline]
+ sock_write_iter+0x495/0x5e0 net/socket.c:1108
+ call_write_iter include/linux/fs.h:2189 [inline]
+ aio_write+0x63a/0x950 fs/aio.c:1600
+ io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019
+ __do_sys_io_submit fs/aio.c:2078 [inline]
+ __se_sys_io_submit+0x293/0x770 fs/aio.c:2048
+ __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
+=====================================================
+
+We can follow the call chain and find that 'bcm_tx_setup' function
+calls 'memcpy_from_msg' to copy some content to the newly allocated
+frame of 'op->frames'. After that the 'len' field of copied structure
+being compared with some constant value (64 or 8). However, if
+'memcpy_from_msg' returns an error, we will compare some uninitialized
+memory. This triggers 'uninit-value' issue.
+
+This patch will add 'memcpy_from_msg' possible errors processing to
+avoid uninit-value issue.
+
+Tested via syzkaller
+
+Reported-by: syzbot+c9bfd85eca611ebf5db1@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?id=47f897f8ad958bbde5790ebf389b5e7e0a345089
+Signed-off-by: Ivan Orlov <ivan.orlov0322@gmail.com>
+Fixes: 6f3b911d5f29b ("can: bcm: add support for CAN FD frames")
+Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Link: https://lore.kernel.org/all/20230314120445.12407-1-ivan.orlov0322@gmail.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/bcm.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 27706f6ace34a..a962ec2b8ba5b 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -941,6 +941,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+
+ cf = op->frames + op->cfsiz * i;
+ err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz);
++ if (err < 0)
++ goto free_op;
+
+ if (op->flags & CAN_FD_FRAME) {
+ if (cf->len > 64)
+@@ -950,12 +952,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ err = -EINVAL;
+ }
+
+- if (err < 0) {
+- if (op->frames != &op->sframe)
+- kfree(op->frames);
+- kfree(op);
+- return err;
+- }
++ if (err < 0)
++ goto free_op;
+
+ if (msg_head->flags & TX_CP_CAN_ID) {
+ /* copy can_id into frame */
+@@ -1026,6 +1024,12 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ bcm_tx_start_timer(op);
+
+ return msg_head->nframes * op->cfsiz + MHSIZ;
++
++free_op:
++ if (op->frames != &op->sframe)
++ kfree(op->frames);
++ kfree(op);
++ return err;
+ }
+
+ /*
+--
+2.39.2
+
--- /dev/null
+From 84fbca8b2679fdf17da75355ad546ac0689baa38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 15:17:13 +0200
+Subject: drm/i915/tc: Fix the ICL PHY ownership check in TC-cold state
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Imre Deak <imre.deak@intel.com>
+
+[ Upstream commit 38c583019484f190d5b33f59b8ae810e6b1763c6 ]
+
+The commit renaming icl_tc_phy_is_in_safe_mode() to
+icl_tc_phy_take_ownership() didn't flip the function's return value
+accordingly, fix this up.
+
+This didn't cause an actual problem besides state check errors, since
+the function is only used during HW readout.
+
+Cc: José Roberto de Souza <jose.souza@intel.com>
+Fixes: f53979d68a77 ("drm/i915/display/tc: Rename safe_mode functions ownership")
+Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230316131724.359612-4-imre.deak@intel.com
+(cherry picked from commit f2c7959dda614d9b7c6a41510492de39d31705ec)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_tc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_tc.c b/drivers/gpu/drm/i915/display/intel_tc.c
+index e5af955b5600f..8d6dac32c8960 100644
+--- a/drivers/gpu/drm/i915/display/intel_tc.c
++++ b/drivers/gpu/drm/i915/display/intel_tc.c
+@@ -440,9 +440,9 @@ static bool icl_tc_phy_is_owned(struct intel_digital_port *dig_port)
+ PORT_TX_DFLEXDPCSSS(dig_port->tc_phy_fia));
+ if (val == 0xffffffff) {
+ drm_dbg_kms(&i915->drm,
+- "Port %s: PHY in TCCOLD, assume safe mode\n",
++ "Port %s: PHY in TCCOLD, assume not owned\n",
+ dig_port->tc_port_name);
+- return true;
++ return false;
+ }
+
+ return val & DP_PHY_MODE_STATUS_NOT_SAFE(dig_port->tc_phy_fia_idx);
+--
+2.39.2
+
--- /dev/null
+From 4058e3534e79481955e2e23cf5a6dbbb6eace1ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 10:26:59 -0700
+Subject: i40e: fix registers dump after run ethtool adapter self test
+
+From: Radoslaw Tyl <radoslawx.tyl@intel.com>
+
+[ Upstream commit c5cff16f461a4a434a9915a7be7ac9ced861a8a4 ]
+
+Fix invalid registers dump from ethtool -d ethX after adapter self test
+by ethtool -t ethY. It causes invalid data display.
+
+The problem was caused by overwriting i40e_reg_list[].elements
+which is common for ethtool self test and dump.
+
+Fixes: 22dd9ae8afcc ("i40e: Rework register diagnostic")
+Signed-off-by: Radoslaw Tyl <radoslawx.tyl@intel.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: Arpana Arland <arpanax.arland@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/20230328172659.3906413-1-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_diag.c | 11 ++++++-----
+ drivers/net/ethernet/intel/i40e/i40e_diag.h | 2 +-
+ 2 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.c b/drivers/net/ethernet/intel/i40e/i40e_diag.c
+index ef4d3762bf371..ca229b0efeb65 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_diag.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.c
+@@ -44,7 +44,7 @@ static i40e_status i40e_diag_reg_pattern_test(struct i40e_hw *hw,
+ return 0;
+ }
+
+-struct i40e_diag_reg_test_info i40e_reg_list[] = {
++const struct i40e_diag_reg_test_info i40e_reg_list[] = {
+ /* offset mask elements stride */
+ {I40E_QTX_CTL(0), 0x0000FFBF, 1,
+ I40E_QTX_CTL(1) - I40E_QTX_CTL(0)},
+@@ -78,27 +78,28 @@ i40e_status i40e_diag_reg_test(struct i40e_hw *hw)
+ {
+ i40e_status ret_code = 0;
+ u32 reg, mask;
++ u32 elements;
+ u32 i, j;
+
+ for (i = 0; i40e_reg_list[i].offset != 0 &&
+ !ret_code; i++) {
+
++ elements = i40e_reg_list[i].elements;
+ /* set actual reg range for dynamically allocated resources */
+ if (i40e_reg_list[i].offset == I40E_QTX_CTL(0) &&
+ hw->func_caps.num_tx_qp != 0)
+- i40e_reg_list[i].elements = hw->func_caps.num_tx_qp;
++ elements = hw->func_caps.num_tx_qp;
+ if ((i40e_reg_list[i].offset == I40E_PFINT_ITRN(0, 0) ||
+ i40e_reg_list[i].offset == I40E_PFINT_ITRN(1, 0) ||
+ i40e_reg_list[i].offset == I40E_PFINT_ITRN(2, 0) ||
+ i40e_reg_list[i].offset == I40E_QINT_TQCTL(0) ||
+ i40e_reg_list[i].offset == I40E_QINT_RQCTL(0)) &&
+ hw->func_caps.num_msix_vectors != 0)
+- i40e_reg_list[i].elements =
+- hw->func_caps.num_msix_vectors - 1;
++ elements = hw->func_caps.num_msix_vectors - 1;
+
+ /* test register access */
+ mask = i40e_reg_list[i].mask;
+- for (j = 0; j < i40e_reg_list[i].elements && !ret_code; j++) {
++ for (j = 0; j < elements && !ret_code; j++) {
+ reg = i40e_reg_list[i].offset +
+ (j * i40e_reg_list[i].stride);
+ ret_code = i40e_diag_reg_pattern_test(hw, reg, mask);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.h b/drivers/net/ethernet/intel/i40e/i40e_diag.h
+index c3340f320a18c..1db7c6d572311 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_diag.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.h
+@@ -20,7 +20,7 @@ struct i40e_diag_reg_test_info {
+ u32 stride; /* bytes between each element */
+ };
+
+-extern struct i40e_diag_reg_test_info i40e_reg_list[];
++extern const struct i40e_diag_reg_test_info i40e_reg_list[];
+
+ i40e_status i40e_diag_reg_test(struct i40e_hw *hw);
+ i40e_status i40e_diag_eeprom_test(struct i40e_hw *hw);
+--
+2.39.2
+
--- /dev/null
+From 321dae0811e0419626a2c5c459382620827c0853 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 10:03:15 +0800
+Subject: ice: add profile conflict check for AVF FDIR
+
+From: Junfeng Guo <junfeng.guo@intel.com>
+
+[ Upstream commit 29486b6df3e6a63b57d1ed1dce06051267282ff4 ]
+
+Add profile conflict check while adding some FDIR rules to avoid
+unexpected flow behavior, rules may have conflict including:
+ IPv4 <---> {IPv4_UDP, IPv4_TCP, IPv4_SCTP}
+ IPv6 <---> {IPv6_UDP, IPv6_TCP, IPv6_SCTP}
+
+For example, when we create an FDIR rule for IPv4, this rule will work
+on packets including IPv4, IPv4_UDP, IPv4_TCP and IPv4_SCTP. But if we
+then create an FDIR rule for IPv4_UDP and then destroy it, the first
+FDIR rule for IPv4 cannot work on pkt IPv4_UDP then.
+
+To prevent this unexpected behavior, we add restriction in software
+when creating FDIR rules by adding necessary profile conflict check.
+
+Fixes: 1f7ea1cd6a37 ("ice: Enable FDIR Configure for AVF")
+Signed-off-by: Junfeng Guo <junfeng.guo@intel.com>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/intel/ice/ice_virtchnl_fdir.c | 73 +++++++++++++++++++
+ 1 file changed, 73 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
+index c6a58343d81d8..a2645ff3100e4 100644
+--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
+@@ -541,6 +541,72 @@ static void ice_vc_fdir_rem_prof_all(struct ice_vf *vf)
+ }
+ }
+
++/**
++ * ice_vc_fdir_has_prof_conflict
++ * @vf: pointer to the VF structure
++ * @conf: FDIR configuration for each filter
++ *
++ * Check if @conf has conflicting profile with existing profiles
++ *
++ * Return: true on success, and false on error.
++ */
++static bool
++ice_vc_fdir_has_prof_conflict(struct ice_vf *vf,
++ struct virtchnl_fdir_fltr_conf *conf)
++{
++ struct ice_fdir_fltr *desc;
++
++ list_for_each_entry(desc, &vf->fdir.fdir_rule_list, fltr_node) {
++ struct virtchnl_fdir_fltr_conf *existing_conf;
++ enum ice_fltr_ptype flow_type_a, flow_type_b;
++ struct ice_fdir_fltr *a, *b;
++
++ existing_conf = to_fltr_conf_from_desc(desc);
++ a = &existing_conf->input;
++ b = &conf->input;
++ flow_type_a = a->flow_type;
++ flow_type_b = b->flow_type;
++
++ /* No need to compare two rules with different tunnel types or
++ * with the same protocol type.
++ */
++ if (existing_conf->ttype != conf->ttype ||
++ flow_type_a == flow_type_b)
++ continue;
++
++ switch (flow_type_a) {
++ case ICE_FLTR_PTYPE_NONF_IPV4_UDP:
++ case ICE_FLTR_PTYPE_NONF_IPV4_TCP:
++ case ICE_FLTR_PTYPE_NONF_IPV4_SCTP:
++ if (flow_type_b == ICE_FLTR_PTYPE_NONF_IPV4_OTHER)
++ return true;
++ break;
++ case ICE_FLTR_PTYPE_NONF_IPV4_OTHER:
++ if (flow_type_b == ICE_FLTR_PTYPE_NONF_IPV4_UDP ||
++ flow_type_b == ICE_FLTR_PTYPE_NONF_IPV4_TCP ||
++ flow_type_b == ICE_FLTR_PTYPE_NONF_IPV4_SCTP)
++ return true;
++ break;
++ case ICE_FLTR_PTYPE_NONF_IPV6_UDP:
++ case ICE_FLTR_PTYPE_NONF_IPV6_TCP:
++ case ICE_FLTR_PTYPE_NONF_IPV6_SCTP:
++ if (flow_type_b == ICE_FLTR_PTYPE_NONF_IPV6_OTHER)
++ return true;
++ break;
++ case ICE_FLTR_PTYPE_NONF_IPV6_OTHER:
++ if (flow_type_b == ICE_FLTR_PTYPE_NONF_IPV6_UDP ||
++ flow_type_b == ICE_FLTR_PTYPE_NONF_IPV6_TCP ||
++ flow_type_b == ICE_FLTR_PTYPE_NONF_IPV6_SCTP)
++ return true;
++ break;
++ default:
++ break;
++ }
++ }
++
++ return false;
++}
++
+ /**
+ * ice_vc_fdir_write_flow_prof
+ * @vf: pointer to the VF structure
+@@ -677,6 +743,13 @@ ice_vc_fdir_config_input_set(struct ice_vf *vf, struct virtchnl_fdir_add *fltr,
+ enum ice_fltr_ptype flow;
+ int ret;
+
++ ret = ice_vc_fdir_has_prof_conflict(vf, conf);
++ if (ret) {
++ dev_dbg(dev, "Found flow profile conflict for VF %d\n",
++ vf->vf_id);
++ return ret;
++ }
++
+ flow = input->flow_type;
+ ret = ice_vc_fdir_alloc_prof(vf, flow);
+ if (ret) {
+--
+2.39.2
+
--- /dev/null
+From 6b8761cae28c05f80f4b11d682a8cf9fee649026 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 13:36:08 -0700
+Subject: ice: Fix ice_cfg_rdma_fltr() to only update relevant fields
+
+From: Brett Creeley <brett.creeley@intel.com>
+
+[ Upstream commit d94dbdc4e0209b5e7d736ab696f8d635b034e3ee ]
+
+The current implementation causes ice_vsi_update() to update all VSI
+fields based on the cached VSI context. This also assumes that the
+ICE_AQ_VSI_PROP_Q_OPT_VALID bit is set. This can cause problems if the
+VSI context is not correctly synced by the driver. Fix this by only
+updating the fields that correspond to ICE_AQ_VSI_PROP_Q_OPT_VALID.
+Also, make sure to save the updated result in the cached VSI context
+on success.
+
+Fixes: 348048e724a0 ("ice: Implement iidc operations")
+Co-developed-by: Robert Malz <robertx.malz@intel.com>
+Signed-off-by: Robert Malz <robertx.malz@intel.com>
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Reviewed-by: Piotr Raczynski <piotr.raczynski@intel.com>
+Tested-by: Jakub Andrysiak <jakub.andrysiak@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_switch.c | 26 +++++++++++++++++----
+ 1 file changed, 22 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c
+index 61f844d225123..46b36851af460 100644
+--- a/drivers/net/ethernet/intel/ice/ice_switch.c
++++ b/drivers/net/ethernet/intel/ice/ice_switch.c
+@@ -1780,18 +1780,36 @@ ice_update_vsi(struct ice_hw *hw, u16 vsi_handle, struct ice_vsi_ctx *vsi_ctx,
+ int
+ ice_cfg_rdma_fltr(struct ice_hw *hw, u16 vsi_handle, bool enable)
+ {
+- struct ice_vsi_ctx *ctx;
++ struct ice_vsi_ctx *ctx, *cached_ctx;
++ int status;
++
++ cached_ctx = ice_get_vsi_ctx(hw, vsi_handle);
++ if (!cached_ctx)
++ return -ENOENT;
+
+- ctx = ice_get_vsi_ctx(hw, vsi_handle);
++ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+ if (!ctx)
+- return -EIO;
++ return -ENOMEM;
++
++ ctx->info.q_opt_rss = cached_ctx->info.q_opt_rss;
++ ctx->info.q_opt_tc = cached_ctx->info.q_opt_tc;
++ ctx->info.q_opt_flags = cached_ctx->info.q_opt_flags;
++
++ ctx->info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_Q_OPT_VALID);
+
+ if (enable)
+ ctx->info.q_opt_flags |= ICE_AQ_VSI_Q_OPT_PE_FLTR_EN;
+ else
+ ctx->info.q_opt_flags &= ~ICE_AQ_VSI_Q_OPT_PE_FLTR_EN;
+
+- return ice_update_vsi(hw, vsi_handle, ctx, NULL);
++ status = ice_update_vsi(hw, vsi_handle, ctx, NULL);
++ if (!status) {
++ cached_ctx->info.q_opt_flags = ctx->info.q_opt_flags;
++ cached_ctx->info.valid_sections |= ctx->info.valid_sections;
++ }
++
++ kfree(ctx);
++ return status;
+ }
+
+ /**
+--
+2.39.2
+
--- /dev/null
+From d6f8c9ed0b1b934796d77caf250416b7cbe786d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 13:48:15 +0100
+Subject: ice: fix invalid check for empty list in ice_sched_assoc_vsi_to_agg()
+
+From: Jakob Koschel <jkl820.git@gmail.com>
+
+[ Upstream commit e9a1cc2e4c4ee7c7e60fb26345618c2522a2a10f ]
+
+The code implicitly assumes that the list iterator finds a correct
+handle. If 'vsi_handle' is not found the 'old_agg_vsi_info' was
+pointing to an bogus memory location. For safety a separate list
+iterator variable should be used to make the != NULL check on
+'old_agg_vsi_info' correct under any circumstances.
+
+Additionally Linus proposed to avoid any use of the list iterator
+variable after the loop, in the attempt to move the list iterator
+variable declaration into the macro to avoid any potential misuse after
+the loop. Using it in a pointer comparison after the loop is undefined
+behavior and should be omitted if possible [1].
+
+Fixes: 37c592062b16 ("ice: remove the VSI info from previous agg")
+Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1]
+Signed-off-by: Jakob Koschel <jkl820.git@gmail.com>
+Tested-by: Arpana Arland <arpanax.arland@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_sched.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c
+index 118595763bba3..2c62c1763ee0d 100644
+--- a/drivers/net/ethernet/intel/ice/ice_sched.c
++++ b/drivers/net/ethernet/intel/ice/ice_sched.c
+@@ -2756,7 +2756,7 @@ static int
+ ice_sched_assoc_vsi_to_agg(struct ice_port_info *pi, u32 agg_id,
+ u16 vsi_handle, unsigned long *tc_bitmap)
+ {
+- struct ice_sched_agg_vsi_info *agg_vsi_info, *old_agg_vsi_info = NULL;
++ struct ice_sched_agg_vsi_info *agg_vsi_info, *iter, *old_agg_vsi_info = NULL;
+ struct ice_sched_agg_info *agg_info, *old_agg_info;
+ struct ice_hw *hw = pi->hw;
+ int status = 0;
+@@ -2774,11 +2774,13 @@ ice_sched_assoc_vsi_to_agg(struct ice_port_info *pi, u32 agg_id,
+ if (old_agg_info && old_agg_info != agg_info) {
+ struct ice_sched_agg_vsi_info *vtmp;
+
+- list_for_each_entry_safe(old_agg_vsi_info, vtmp,
++ list_for_each_entry_safe(iter, vtmp,
+ &old_agg_info->agg_vsi_list,
+ list_entry)
+- if (old_agg_vsi_info->vsi_handle == vsi_handle)
++ if (iter->vsi_handle == vsi_handle) {
++ old_agg_vsi_info = iter;
+ break;
++ }
+ }
+
+ /* check if entry already exist */
+--
+2.39.2
+
--- /dev/null
+From c74f0a59c90199015d8c7a41d3ec65dcb3d65070 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 13:54:30 +0100
+Subject: loop: LOOP_CONFIGURE: send uevents for partitions
+
+From: Alyssa Ross <hi@alyssa.is>
+
+[ Upstream commit bb430b69422640891b0b8db762885730579a4145 ]
+
+LOOP_CONFIGURE is, as far as I understand it, supposed to be a way to
+combine LOOP_SET_FD and LOOP_SET_STATUS64 into a single syscall. When
+using LOOP_SET_FD+LOOP_SET_STATUS64, a single uevent would be sent for
+each partition found on the loop device after the second ioctl(), but
+when using LOOP_CONFIGURE, no such uevent was being sent.
+
+In the old setup, uevents are disabled for LOOP_SET_FD, but not for
+LOOP_SET_STATUS64. This makes sense, as it prevents uevents being
+sent for a partially configured device during LOOP_SET_FD - they're
+only sent at the end of LOOP_SET_STATUS64. But for LOOP_CONFIGURE,
+uevents were disabled for the entire operation, so that final
+notification was never issued. To fix this, reduce the critical
+section to exclude the loop_reread_partitions() call, which causes
+the uevents to be issued, to after uevents are re-enabled, matching
+the behaviour of the LOOP_SET_FD+LOOP_SET_STATUS64 combination.
+
+I noticed this because Busybox's losetup program recently changed from
+using LOOP_SET_FD+LOOP_SET_STATUS64 to LOOP_CONFIGURE, and this broke
+my setup, for which I want a notification from the kernel any time a
+new partition becomes available.
+
+Signed-off-by: Alyssa Ross <hi@alyssa.is>
+[hch: reduced the critical section]
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Fixes: 3448914e8cc5 ("loop: Add LOOP_CONFIGURE ioctl")
+Link: https://lore.kernel.org/r/20230320125430.55367-1-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 793ae876918ce..426d0b42685a0 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1010,9 +1010,6 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
+ /* This is safe, since we have a reference from open(). */
+ __module_get(THIS_MODULE);
+
+- /* suppress uevents while reconfiguring the device */
+- dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 1);
+-
+ /*
+ * If we don't hold exclusive handle for the device, upgrade to it
+ * here to avoid changing device under exclusive owner.
+@@ -1067,6 +1064,9 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
+ }
+ }
+
++ /* suppress uevents while reconfiguring the device */
++ dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 1);
++
+ disk_force_media_change(lo->lo_disk, DISK_EVENT_MEDIA_CHANGE);
+ set_disk_ro(lo->lo_disk, (lo->lo_flags & LO_FLAGS_READ_ONLY) != 0);
+
+@@ -1109,17 +1109,17 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
+ if (partscan)
+ clear_bit(GD_SUPPRESS_PART_SCAN, &lo->lo_disk->state);
+
++ /* enable and uncork uevent now that we are done */
++ dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0);
++
+ loop_global_unlock(lo, is_loop);
+ if (partscan)
+ loop_reread_partitions(lo);
++
+ if (!(mode & FMODE_EXCL))
+ bd_abort_claiming(bdev, loop_configure);
+
+- error = 0;
+-done:
+- /* enable and uncork uevent now that we are done */
+- dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0);
+- return error;
++ return 0;
+
+ out_unlock:
+ loop_global_unlock(lo, is_loop);
+@@ -1130,7 +1130,7 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
+ fput(file);
+ /* This is safe: open() is still holding a reference. */
+ module_put(THIS_MODULE);
+- goto done;
++ return error;
+ }
+
+ static void __loop_clr_fd(struct loop_device *lo, bool release)
+--
+2.39.2
+
--- /dev/null
+From b30514ff2eacde2f119912f4a77d97419876d277 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 11:20:04 +0100
+Subject: mips: bmips: BCM6358: disable RAC flush for TP1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit ab327f8acdf8d06601fbf058859a539a9422afff ]
+
+RAC flush causes kernel panics on BCM6358 with EHCI/OHCI when booting from TP1:
+[ 3.881739] usb 1-1: new high-speed USB device number 2 using ehci-platform
+[ 3.895011] Reserved instruction in kernel code[#1]:
+[ 3.900113] CPU: 0 PID: 1 Comm: init Not tainted 5.10.16 #0
+[ 3.905829] $ 0 : 00000000 10008700 00000000 77d94060
+[ 3.911238] $ 4 : 7fd1f088 00000000 81431cac 81431ca0
+[ 3.916641] $ 8 : 00000000 ffffefff 8075cd34 00000000
+[ 3.922043] $12 : 806f8d40 f3e812b7 00000000 000d9aaa
+[ 3.927446] $16 : 7fd1f068 7fd1f080 7ff559b8 81428470
+[ 3.932848] $20 : 00000000 00000000 55590000 77d70000
+[ 3.938251] $24 : 00000018 00000010
+[ 3.943655] $28 : 81430000 81431e60 81431f28 800157fc
+[ 3.949058] Hi : 00000000
+[ 3.952013] Lo : 00000000
+[ 3.955019] epc : 80015808 setup_sigcontext+0x54/0x24c
+[ 3.960464] ra : 800157fc setup_sigcontext+0x48/0x24c
+[ 3.965913] Status: 10008703 KERNEL EXL IE
+[ 3.970216] Cause : 00800028 (ExcCode 0a)
+[ 3.974340] PrId : 0002a010 (Broadcom BMIPS4350)
+[ 3.979170] Modules linked in: ohci_platform ohci_hcd fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug usbcore nls_base usb_common
+[ 3.992907] Process init (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=77e22ec8)
+[ 4.000776] Stack : 81431ef4 7fd1f080 81431f28 81428470 7fd1f068 81431edc 7ff559b8 81428470
+[ 4.009467] 81431f28 7fd1f080 55590000 77d70000 77d5498c 80015c70 806f0000 8063ae74
+[ 4.018149] 08100002 81431f28 0000000a 08100002 81431f28 0000000a 77d6b418 00000003
+[ 4.026831] ffffffff 80016414 80080734 81431ecc 81431ecc 00000001 00000000 04000000
+[ 4.035512] 77d54874 00000000 00000000 00000000 00000000 00000012 00000002 00000000
+[ 4.044196] ...
+[ 4.046706] Call Trace:
+[ 4.049238] [<80015808>] setup_sigcontext+0x54/0x24c
+[ 4.054356] [<80015c70>] setup_frame+0xdc/0x124
+[ 4.059015] [<80016414>] do_notify_resume+0x1dc/0x288
+[ 4.064207] [<80011b50>] work_notifysig+0x10/0x18
+[ 4.069036]
+[ 4.070538] Code: 8fc300b4 00001025 26240008 <ac820000> ac830004 3c048063 0c0228aa 24846a00 26240010
+[ 4.080686]
+[ 4.082517] ---[ end trace 22a8edb41f5f983b ]---
+[ 4.087374] Kernel panic - not syncing: Fatal exception
+[ 4.092753] Rebooting in 1 seconds..
+
+Because the bootloader (CFE) is not initializing the Read-ahead cache properly
+on the second thread (TP1). Since the RAC was not initialized properly, we
+should avoid flushing it at the risk of corrupting the instruction stream as
+seen in the trace above.
+
+Fixes: d59098a0e9cb ("MIPS: bmips: use generic dma noncoherent ops")
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/bmips/dma.c | 5 +++++
+ arch/mips/bmips/setup.c | 8 ++++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/arch/mips/bmips/dma.c b/arch/mips/bmips/dma.c
+index 33788668cbdbf..3779e7855bd75 100644
+--- a/arch/mips/bmips/dma.c
++++ b/arch/mips/bmips/dma.c
+@@ -5,6 +5,8 @@
+ #include <asm/bmips.h>
+ #include <asm/io.h>
+
++bool bmips_rac_flush_disable;
++
+ void arch_sync_dma_for_cpu_all(void)
+ {
+ void __iomem *cbr = BMIPS_GET_CBR();
+@@ -15,6 +17,9 @@ void arch_sync_dma_for_cpu_all(void)
+ boot_cpu_type() != CPU_BMIPS4380)
+ return;
+
++ if (unlikely(bmips_rac_flush_disable))
++ return;
++
+ /* Flush stale data out of the readahead cache */
+ cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
+ __raw_writel(cfg | 0x100, cbr + BMIPS_RAC_CONFIG);
+diff --git a/arch/mips/bmips/setup.c b/arch/mips/bmips/setup.c
+index e95b3f78e7cd4..549a6392a3d2d 100644
+--- a/arch/mips/bmips/setup.c
++++ b/arch/mips/bmips/setup.c
+@@ -35,6 +35,8 @@
+ #define REG_BCM6328_OTP ((void __iomem *)CKSEG1ADDR(0x1000062c))
+ #define BCM6328_TP1_DISABLED BIT(9)
+
++extern bool bmips_rac_flush_disable;
++
+ static const unsigned long kbase = VMLINUX_LOAD_ADDRESS & 0xfff00000;
+
+ struct bmips_quirk {
+@@ -104,6 +106,12 @@ static void bcm6358_quirks(void)
+ * disable SMP for now
+ */
+ bmips_smp_enabled = 0;
++
++ /*
++ * RAC flush causes kernel panics on BCM6358 when booting from TP1
++ * because the bootloader is not initializing it properly.
++ */
++ bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local() & (1 << 31));
+ }
+
+ static void bcm6368_quirks(void)
+--
+2.39.2
+
--- /dev/null
+From e441ee2a4f0bb1e693950104905178427474d63b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 12:08:45 +0100
+Subject: mtd: nand: mxic-ecc: Fix mxic_ecc_data_xfer_wait_for_completion()
+ when irq is used
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 75dce6a941e3f16c3b4878c8b2f46d5d07c619ce ]
+
+wait_for_completion_timeout() and readl_poll_timeout() don't handle their
+return value the same way.
+
+wait_for_completion_timeout() returns 0 on time out (and >0 in all other
+cases)
+readl_poll_timeout() returns 0 on success and -ETIMEDOUT upon a timeout.
+
+In order for the error handling path to work in both cases, the logic
+against wait_for_completion_timeout() needs to be inverted.
+
+Fixes: 48e6633a9fa2 ("mtd: nand: mxic-ecc: Add Macronix external ECC engine support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/beddbc374557e44ceec897e68c4a5d12764ddbb9.1676459308.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/ecc-mxic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mtd/nand/ecc-mxic.c b/drivers/mtd/nand/ecc-mxic.c
+index 8afdca731b874..6b487ffe2f2dc 100644
+--- a/drivers/mtd/nand/ecc-mxic.c
++++ b/drivers/mtd/nand/ecc-mxic.c
+@@ -429,6 +429,7 @@ static int mxic_ecc_data_xfer_wait_for_completion(struct mxic_ecc_engine *mxic)
+ mxic_ecc_enable_int(mxic);
+ ret = wait_for_completion_timeout(&mxic->complete,
+ msecs_to_jiffies(1000));
++ ret = ret ? 0 : -ETIMEDOUT;
+ mxic_ecc_disable_int(mxic);
+ } else {
+ ret = readl_poll_timeout(mxic->regs + INTRPT_STS, val,
+--
+2.39.2
+
--- /dev/null
+From 912cc0accb86cb57ce65868dce707910bdbae4d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 13:24:25 +0300
+Subject: mtd: rawnand: meson: initialize struct with zeroes
+
+From: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
+
+[ Upstream commit 4ce341de6c02d02aba7c78a6447ccfcaa9eeb328 ]
+
+This structure must be zeroed, because it's field 'hw->core' is used as
+'parent' in 'clk_core_fill_parent_index()', but it will be uninitialized.
+This happens, because when this struct is not zeroed, pointer 'hw' is
+"initialized" by garbage, which is valid pointer, but points to some
+garbage. So 'hw' will be dereferenced, but 'core' contains some random
+data which will be interpreted as a pointer. The following backtrace is
+result of dereference of such pointer:
+
+[ 1.081319] __clk_register+0x414/0x820
+[ 1.085113] devm_clk_register+0x64/0xd0
+[ 1.088995] meson_nfc_probe+0x258/0x6ec
+[ 1.092875] platform_probe+0x70/0xf0
+[ 1.096498] really_probe+0xc8/0x3e0
+[ 1.100034] __driver_probe_device+0x84/0x190
+[ 1.104346] driver_probe_device+0x44/0x120
+[ 1.108487] __driver_attach+0xb4/0x220
+[ 1.112282] bus_for_each_dev+0x78/0xd0
+[ 1.116077] driver_attach+0x2c/0x40
+[ 1.119613] bus_add_driver+0x184/0x240
+[ 1.123408] driver_register+0x80/0x140
+[ 1.127203] __platform_driver_register+0x30/0x40
+[ 1.131860] meson_nfc_driver_init+0x24/0x30
+
+Fixes: 1e4d3ba66888 ("mtd: rawnand: meson: fix the clock")
+Signed-off-by: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
+Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20230227102425.793841-1-AVKrasnov@sberdevices.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/meson_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c
+index 5ee01231ac4cd..30e326adabfc1 100644
+--- a/drivers/mtd/nand/raw/meson_nand.c
++++ b/drivers/mtd/nand/raw/meson_nand.c
+@@ -991,7 +991,7 @@ static const struct mtd_ooblayout_ops meson_ooblayout_ops = {
+
+ static int meson_nfc_clk_init(struct meson_nfc *nfc)
+ {
+- struct clk_parent_data nfc_divider_parent_data[1];
++ struct clk_parent_data nfc_divider_parent_data[1] = {0};
+ struct clk_init_data init = {0};
+ int ret;
+
+--
+2.39.2
+
--- /dev/null
+From 8a0c0fe6fd0e4f7b222ca07ba3735eafa86ee333 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 10:32:44 +0300
+Subject: mtd: rawnand: meson: invalidate cache on polling ECC bit
+
+From: Arseniy Krasnov <avkrasnov@sberdevices.ru>
+
+[ Upstream commit e732e39ed9929c05fd219035bc9653ba4100d4fa ]
+
+'info_buf' memory is cached and driver polls ECC bit in it. This bit
+is set by the NAND controller. If 'usleep_range()' returns before device
+sets this bit, 'info_buf' will be cached and driver won't see update of
+this bit and will loop forever.
+
+Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller")
+Signed-off-by: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/d4ef0bd6-816e-f6fa-9385-f05f775f0ae2@sberdevices.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/meson_nand.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c
+index 30e326adabfc1..a28574c009003 100644
+--- a/drivers/mtd/nand/raw/meson_nand.c
++++ b/drivers/mtd/nand/raw/meson_nand.c
+@@ -176,6 +176,7 @@ struct meson_nfc {
+
+ dma_addr_t daddr;
+ dma_addr_t iaddr;
++ u32 info_bytes;
+
+ unsigned long assigned_cs;
+ };
+@@ -503,6 +504,7 @@ static int meson_nfc_dma_buffer_setup(struct nand_chip *nand, void *databuf,
+ nfc->daddr, datalen, dir);
+ return ret;
+ }
++ nfc->info_bytes = infolen;
+ cmd = GENCMDIADDRL(NFC_CMD_AIL, nfc->iaddr);
+ writel(cmd, nfc->reg_base + NFC_REG_CMD);
+
+@@ -520,8 +522,10 @@ static void meson_nfc_dma_buffer_release(struct nand_chip *nand,
+ struct meson_nfc *nfc = nand_get_controller_data(nand);
+
+ dma_unmap_single(nfc->dev, nfc->daddr, datalen, dir);
+- if (infolen)
++ if (infolen) {
+ dma_unmap_single(nfc->dev, nfc->iaddr, infolen, dir);
++ nfc->info_bytes = 0;
++ }
+ }
+
+ static int meson_nfc_read_buf(struct nand_chip *nand, u8 *buf, int len)
+@@ -710,6 +714,8 @@ static void meson_nfc_check_ecc_pages_valid(struct meson_nfc *nfc,
+ usleep_range(10, 15);
+ /* info is updated by nfc dma engine*/
+ smp_rmb();
++ dma_sync_single_for_cpu(nfc->dev, nfc->iaddr, nfc->info_bytes,
++ DMA_FROM_DEVICE);
+ ret = *info & ECC_COMPLETE;
+ } while (!ret);
+ }
+--
+2.39.2
+
--- /dev/null
+From 88e86126ac0c7be2dd32a7439b26c7b0d8513826 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 09:06:04 +0100
+Subject: net: dsa: microchip: ksz8: fix ksz8_fdb_dump() to extract all 1024
+ entries
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 5d90492dd4ff50ad65c582c76c345d0b90001728 ]
+
+Current ksz8_fdb_dump() is able to extract only max 249 entries on
+the ksz8863/ksz8873 series of switches. This happened due to wrong
+bit mask and offset calculation.
+
+This commit corrects the issue and allows for the complete extraction of
+all 1024 entries.
+
+Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Acked-by: Arun Ramadoss <arun.ramadoss@microchip.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/microchip/ksz_common.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
+index 07f6776bba12b..b15a0b844c34b 100644
+--- a/drivers/net/dsa/microchip/ksz_common.c
++++ b/drivers/net/dsa/microchip/ksz_common.c
+@@ -360,10 +360,10 @@ static const u32 ksz8863_masks[] = {
+ [STATIC_MAC_TABLE_FID] = GENMASK(29, 26),
+ [STATIC_MAC_TABLE_OVERRIDE] = BIT(20),
+ [STATIC_MAC_TABLE_FWD_PORTS] = GENMASK(18, 16),
+- [DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(5, 0),
++ [DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(1, 0),
+ [DYNAMIC_MAC_TABLE_MAC_EMPTY] = BIT(7),
+ [DYNAMIC_MAC_TABLE_NOT_READY] = BIT(7),
+- [DYNAMIC_MAC_TABLE_ENTRIES] = GENMASK(31, 28),
++ [DYNAMIC_MAC_TABLE_ENTRIES] = GENMASK(31, 24),
+ [DYNAMIC_MAC_TABLE_FID] = GENMASK(19, 16),
+ [DYNAMIC_MAC_TABLE_SRC_PORT] = GENMASK(21, 20),
+ [DYNAMIC_MAC_TABLE_TIMESTAMP] = GENMASK(23, 22),
+@@ -373,7 +373,7 @@ static u8 ksz8863_shifts[] = {
+ [VLAN_TABLE_MEMBERSHIP_S] = 16,
+ [STATIC_MAC_FWD_PORTS] = 16,
+ [STATIC_MAC_FID] = 22,
+- [DYNAMIC_MAC_ENTRIES_H] = 3,
++ [DYNAMIC_MAC_ENTRIES_H] = 8,
+ [DYNAMIC_MAC_ENTRIES] = 24,
+ [DYNAMIC_MAC_FID] = 16,
+ [DYNAMIC_MAC_TIMESTAMP] = 24,
+--
+2.39.2
+
--- /dev/null
+From 448da3f486b30b6c8c9bacc048a169b32bfc9dd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 09:06:03 +0100
+Subject: net: dsa: microchip: ksz8: fix ksz8_fdb_dump()
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 88e943e83827a349f70c3464b3eba7260be7461d ]
+
+Before this patch, the ksz8_fdb_dump() function had several issues, such
+as uninitialized variables and incorrect usage of source port as a bit
+mask. These problems caused inaccurate reporting of vid information and
+port assignment in the bridge fdb.
+
+Fixes: e587be759e6e ("net: dsa: microchip: update fdb add/del/dump in ksz_common")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Acked-by: Arun Ramadoss <arun.ramadoss@microchip.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/microchip/ksz8795.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/dsa/microchip/ksz8795.c b/drivers/net/dsa/microchip/ksz8795.c
+index bd3b133e7085b..22250ae222b5b 100644
+--- a/drivers/net/dsa/microchip/ksz8795.c
++++ b/drivers/net/dsa/microchip/ksz8795.c
+@@ -907,15 +907,14 @@ int ksz8_fdb_dump(struct ksz_device *dev, int port,
+ u16 entries = 0;
+ u8 timestamp = 0;
+ u8 fid;
+- u8 member;
+- struct alu_struct alu;
++ u8 src_port;
++ u8 mac[ETH_ALEN];
+
+ do {
+- alu.is_static = false;
+- ret = ksz8_r_dyn_mac_table(dev, i, alu.mac, &fid, &member,
++ ret = ksz8_r_dyn_mac_table(dev, i, mac, &fid, &src_port,
+ ×tamp, &entries);
+- if (!ret && (member & BIT(port))) {
+- ret = cb(alu.mac, alu.fid, alu.is_static, data);
++ if (!ret && port == src_port) {
++ ret = cb(mac, fid, false, data);
+ if (ret)
+ break;
+ }
+--
+2.39.2
+
--- /dev/null
+From b7cf29ca0efb19c614734b495236ec10e4fa1198 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 09:06:08 +0100
+Subject: net: dsa: microchip: ksz8: fix MDB configuration with non-zero VID
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 9aa5757e1f71d85facdc3c98028762cbab8d15c7 ]
+
+FID is directly mapped to VID. However, configuring a MAC address with a
+VID != 0 resulted in incorrect configuration due to an incorrect bit
+mask. This kernel commit fixed the issue by correcting the bit mask and
+ensuring proper configuration of MAC addresses with non-zero VID.
+
+Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Acked-by: Arun Ramadoss <arun.ramadoss@microchip.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/microchip/ksz_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
+index 286e081830e7c..3d59298eaa5cf 100644
+--- a/drivers/net/dsa/microchip/ksz_common.c
++++ b/drivers/net/dsa/microchip/ksz_common.c
+@@ -357,7 +357,7 @@ static const u32 ksz8863_masks[] = {
+ [VLAN_TABLE_VALID] = BIT(19),
+ [STATIC_MAC_TABLE_VALID] = BIT(19),
+ [STATIC_MAC_TABLE_USE_FID] = BIT(21),
+- [STATIC_MAC_TABLE_FID] = GENMASK(29, 26),
++ [STATIC_MAC_TABLE_FID] = GENMASK(25, 22),
+ [STATIC_MAC_TABLE_OVERRIDE] = BIT(20),
+ [STATIC_MAC_TABLE_FWD_PORTS] = GENMASK(18, 16),
+ [DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(1, 0),
+--
+2.39.2
+
--- /dev/null
+From 1ed643d2938f4141dde8824ecfe1f93b50fdf3a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 09:06:05 +0100
+Subject: net: dsa: microchip: ksz8: fix offset for the timestamp filed
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit b3177aab89be540dc50d2328427b073361093e38 ]
+
+We are using wrong offset, so we will get not a timestamp.
+
+Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Acked-by: Arun Ramadoss <arun.ramadoss@microchip.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/microchip/ksz_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
+index b15a0b844c34b..160d7ad26ca09 100644
+--- a/drivers/net/dsa/microchip/ksz_common.c
++++ b/drivers/net/dsa/microchip/ksz_common.c
+@@ -376,7 +376,7 @@ static u8 ksz8863_shifts[] = {
+ [DYNAMIC_MAC_ENTRIES_H] = 8,
+ [DYNAMIC_MAC_ENTRIES] = 24,
+ [DYNAMIC_MAC_FID] = 16,
+- [DYNAMIC_MAC_TIMESTAMP] = 24,
++ [DYNAMIC_MAC_TIMESTAMP] = 22,
+ [DYNAMIC_MAC_SRC_PORT] = 20,
+ };
+
+--
+2.39.2
+
--- /dev/null
+From e06adb99e0789707f57a460d09b6f1e901eca0f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 09:06:06 +0100
+Subject: net: dsa: microchip: ksz8: ksz8_fdb_dump: avoid extracting ghost
+ entry from empty dynamic MAC table.
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 492606cdc74804d372ab1bdb8f3ef4a6fb6f9f59 ]
+
+If the dynamic MAC table is empty, we will still extract one outdated
+entry. Fix it by using correct bit offset.
+
+Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Acked-by: Arun Ramadoss <arun.ramadoss@microchip.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/microchip/ksz_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
+index 160d7ad26ca09..286e081830e7c 100644
+--- a/drivers/net/dsa/microchip/ksz_common.c
++++ b/drivers/net/dsa/microchip/ksz_common.c
+@@ -361,7 +361,7 @@ static const u32 ksz8863_masks[] = {
+ [STATIC_MAC_TABLE_OVERRIDE] = BIT(20),
+ [STATIC_MAC_TABLE_FWD_PORTS] = GENMASK(18, 16),
+ [DYNAMIC_MAC_TABLE_ENTRIES_H] = GENMASK(1, 0),
+- [DYNAMIC_MAC_TABLE_MAC_EMPTY] = BIT(7),
++ [DYNAMIC_MAC_TABLE_MAC_EMPTY] = BIT(2),
+ [DYNAMIC_MAC_TABLE_NOT_READY] = BIT(7),
+ [DYNAMIC_MAC_TABLE_ENTRIES] = GENMASK(31, 24),
+ [DYNAMIC_MAC_TABLE_FID] = GENMASK(19, 16),
+--
+2.39.2
+
--- /dev/null
+From 5376e580ebbd4e4bbedd1ba8b156f53bb0ccc291 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 09:06:07 +0100
+Subject: net: dsa: microchip: ksz8863_smi: fix bulk access
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 392ff7a84cbca34118ca286dfbfe8aee24605897 ]
+
+Current regmap bulk access is broken, resulting to wrong reads/writes
+if ksz_read64/ksz_write64 functions are used.
+Mostly this issue was visible by using ksz8_fdb_dump(), which returned
+corrupt MAC address.
+
+The reason is that regmap was configured to have max_raw_read/write,
+even if ksz8863_mdio_read/write functions are able to handle unlimited
+read/write accesses. On ksz_read64 function we are using multiple 32bit
+accesses by incrementing each access by 1 instead of 4. Resulting buffer
+had 01234567.12345678 instead of 01234567.89abcdef.
+
+We have multiple ways to fix it:
+- enable 4 byte alignment for 32bit accesses. Since the HW do not have
+ this requirement. It will break driver.
+- disable max_raw_* limit.
+
+This patch is removing max_raw_* limit for regmap accesses in ksz8863_smi.
+
+Fixes: 60a364760002 ("net: dsa: microchip: Add Microchip KSZ8863 SMI based driver support")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/microchip/ksz8863_smi.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/net/dsa/microchip/ksz8863_smi.c b/drivers/net/dsa/microchip/ksz8863_smi.c
+index ddb40838181ef..ed77ac2228951 100644
+--- a/drivers/net/dsa/microchip/ksz8863_smi.c
++++ b/drivers/net/dsa/microchip/ksz8863_smi.c
+@@ -82,22 +82,16 @@ static const struct regmap_bus regmap_smi[] = {
+ {
+ .read = ksz8863_mdio_read,
+ .write = ksz8863_mdio_write,
+- .max_raw_read = 1,
+- .max_raw_write = 1,
+ },
+ {
+ .read = ksz8863_mdio_read,
+ .write = ksz8863_mdio_write,
+ .val_format_endian_default = REGMAP_ENDIAN_BIG,
+- .max_raw_read = 2,
+- .max_raw_write = 2,
+ },
+ {
+ .read = ksz8863_mdio_read,
+ .write = ksz8863_mdio_write,
+ .val_format_endian_default = REGMAP_ENDIAN_BIG,
+- .max_raw_read = 4,
+- .max_raw_write = 4,
+ }
+ };
+
+@@ -108,7 +102,6 @@ static const struct regmap_config ksz8863_regmap_config[] = {
+ .pad_bits = 24,
+ .val_bits = 8,
+ .cache_type = REGCACHE_NONE,
+- .use_single_read = 1,
+ .lock = ksz_regmap_lock,
+ .unlock = ksz_regmap_unlock,
+ },
+@@ -118,7 +111,6 @@ static const struct regmap_config ksz8863_regmap_config[] = {
+ .pad_bits = 24,
+ .val_bits = 16,
+ .cache_type = REGCACHE_NONE,
+- .use_single_read = 1,
+ .lock = ksz_regmap_lock,
+ .unlock = ksz_regmap_unlock,
+ },
+@@ -128,7 +120,6 @@ static const struct regmap_config ksz8863_regmap_config[] = {
+ .pad_bits = 24,
+ .val_bits = 32,
+ .cache_type = REGCACHE_NONE,
+- .use_single_read = 1,
+ .lock = ksz_regmap_lock,
+ .unlock = ksz_regmap_unlock,
+ }
+--
+2.39.2
+
--- /dev/null
+From b8de1c4d6934846573ec4c70e9ff0285a9d20879 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 12:01:40 -0300
+Subject: net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Steffen Bätz <steffen@innosonix.de>
+
+[ Upstream commit 7bcad0f0e6fbc1d613e49e0ee35c8e5f2e685bb0 ]
+
+Do not set the MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP bit on CPU or DSA ports.
+
+This allows the host CPU port to be a regular IGMP listener by sending out
+IGMP Membership Reports, which would otherwise not be forwarded by the
+mv88exxx chip, but directly looped back to the CPU port itself.
+
+Fixes: 54d792f257c6 ("net: dsa: Centralise global and port setup code into mv88e6xxx.")
+Signed-off-by: Steffen Bätz <steffen@innosonix.de>
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20230329150140.701559-1-festevam@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 3a6db36574ad7..8cf27e2654fcf 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3354,9 +3354,14 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+ * If this is the upstream port for this switch, enable
+ * forwarding of unknown unicasts and multicasts.
+ */
+- reg = MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP |
+- MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP |
++ reg = MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP |
+ MV88E6XXX_PORT_CTL0_STATE_FORWARDING;
++ /* Forward any IPv4 IGMP or IPv6 MLD frames received
++ * by a USER port to the CPU port to allow snooping.
++ */
++ if (dsa_is_user_port(ds, port))
++ reg |= MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP;
++
+ err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_CTL0, reg);
+ if (err)
+ return err;
+--
+2.39.2
+
--- /dev/null
+From 6df54d34dda3096c63182093b5f9487aaad1a64f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 11:37:35 +0100
+Subject: net: dsa: realtek: fix out-of-bounds access
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+[ Upstream commit b93eb564869321d0dffaf23fcc5c88112ed62466 ]
+
+The probe function sets priv->chip_data to (void *)priv + sizeof(*priv)
+with the expectation that priv has enough trailing space.
+
+However, only realtek-smi actually allocated this chip_data space.
+Do likewise in realtek-mdio to fix out-of-bounds accesses.
+
+These accesses likely went unnoticed so far, because of an (unused)
+buf[4096] member in struct realtek_priv, which caused kmalloc to
+round up the allocated buffer to a big enough size, so nothing of
+value was overwritten. With a different allocator (like in the barebox
+bootloader port of the driver) or with KASAN, the memory corruption
+becomes quickly apparent.
+
+Fixes: aac94001067d ("net: dsa: realtek: add new mdio interface for drivers")
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
+Reviewed-by: Alvin Šipraga <alsi@bang-olufsen.dk>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Link: https://lore.kernel.org/r/20230323103735.2331786-1-a.fatoum@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/realtek/realtek-mdio.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/realtek/realtek-mdio.c b/drivers/net/dsa/realtek/realtek-mdio.c
+index 3e54fac5f9027..5a8fe707ca25e 100644
+--- a/drivers/net/dsa/realtek/realtek-mdio.c
++++ b/drivers/net/dsa/realtek/realtek-mdio.c
+@@ -21,6 +21,7 @@
+
+ #include <linux/module.h>
+ #include <linux/of_device.h>
++#include <linux/overflow.h>
+ #include <linux/regmap.h>
+
+ #include "realtek.h"
+@@ -152,7 +153,9 @@ static int realtek_mdio_probe(struct mdio_device *mdiodev)
+ if (!var)
+ return -EINVAL;
+
+- priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
++ priv = devm_kzalloc(&mdiodev->dev,
++ size_add(sizeof(*priv), var->chip_data_sz),
++ GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
+
+--
+2.39.2
+
--- /dev/null
+From 1919ba92d72bd121410a1ef35bb1ab43d4606c1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 14:08:40 +0200
+Subject: net: ethernet: mtk_eth_soc: add missing ppe cache flush when deleting
+ a flow
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 924531326e2dd4ceabe7240f2b55a88e7d894ec2 ]
+
+The cache needs to be flushed to ensure that the hardware stops offloading
+the flow immediately.
+
+Fixes: 33fc42de3327 ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries")
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/20230330120840.52079-3-nbd@nbd.name
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_ppe.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_ppe.c b/drivers/net/ethernet/mediatek/mtk_ppe.c
+index 34ea8af48c3d0..d6eed204574a9 100644
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -438,6 +438,7 @@ __mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ hwe->ib1 &= ~MTK_FOE_IB1_STATE;
+ hwe->ib1 |= FIELD_PREP(MTK_FOE_IB1_STATE, MTK_FOE_STATE_INVALID);
+ dma_wmb();
++ mtk_ppe_cache_clear(ppe);
+ }
+ entry->hash = 0xffff;
+
+--
+2.39.2
+
--- /dev/null
+From ed4b4e931791b7d6d959179992adf331e0382210 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 14:08:38 +0200
+Subject: net: ethernet: mtk_eth_soc: fix flow block refcounting logic
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 8c1cb87c2a5c29da416848451a687473f379611c ]
+
+Since we call flow_block_cb_decref on FLOW_BLOCK_UNBIND, we also need to
+call flow_block_cb_incref for a newly allocated cb.
+Also fix the accidentally inverted refcount check on unbind.
+
+Fixes: 502e84e2382d ("net: ethernet: mtk_eth_soc: add flow offloading support")
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/20230330120840.52079-1-nbd@nbd.name
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+index 28bbd1df3e305..6a72687d5b83f 100644
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -570,6 +570,7 @@ mtk_eth_setup_tc_block(struct net_device *dev, struct flow_block_offload *f)
+ if (IS_ERR(block_cb))
+ return PTR_ERR(block_cb);
+
++ flow_block_cb_incref(block_cb);
+ flow_block_cb_add(block_cb, f);
+ list_add_tail(&block_cb->driver_list, &block_cb_list);
+ return 0;
+@@ -578,7 +579,7 @@ mtk_eth_setup_tc_block(struct net_device *dev, struct flow_block_offload *f)
+ if (!block_cb)
+ return -ENOENT;
+
+- if (flow_block_cb_decref(block_cb)) {
++ if (!flow_block_cb_decref(block_cb)) {
+ flow_block_cb_remove(block_cb, f);
+ list_del(&block_cb->driver_list);
+ }
+--
+2.39.2
+
--- /dev/null
+From 59c6fbed5807b3d7aed8000532b7c44884b20234 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 11:27:51 -0500
+Subject: net: ipa: compute DMA pool size properly
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 6c75dc94f2b27fff57b305af9236eea181a00b6c ]
+
+In gsi_trans_pool_init_dma(), the total size of a pool of memory
+used for DMA transactions is calculated. However the calculation is
+done incorrectly.
+
+For 4KB pages, this total size is currently always more than one
+page, and as a result, the calculation produces a positive (though
+incorrect) total size. The code still works in this case; we just
+end up with fewer DMA pool entries than we intended.
+
+Bjorn Andersson tested booting a kernel with 16KB pages, and hit a
+null pointer derereference in sg_alloc_append_table_from_pages(),
+descending from gsi_trans_pool_init_dma(). The cause of this was
+that a 16KB total size was going to be allocated, and with 16KB
+pages the order of that allocation is 0. The total_size calculation
+yielded 0, which eventually led to the crash.
+
+Correcting the total_size calculation fixes the problem.
+
+Reported-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Tested-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Fixes: 9dd441e4ed57 ("soc: qcom: ipa: GSI transactions")
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Alex Elder <elder@linaro.org>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/20230328162751.2861791-1-elder@linaro.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipa/gsi_trans.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ipa/gsi_trans.c b/drivers/net/ipa/gsi_trans.c
+index 26b7f683a3e17..fa6863c265eb9 100644
+--- a/drivers/net/ipa/gsi_trans.c
++++ b/drivers/net/ipa/gsi_trans.c
+@@ -153,7 +153,7 @@ int gsi_trans_pool_init_dma(struct device *dev, struct gsi_trans_pool *pool,
+ * gsi_trans_pool_exit_dma() can assume the total allocated
+ * size is exactly (count * size).
+ */
+- total_size = get_order(total_size) << PAGE_SHIFT;
++ total_size = PAGE_SIZE << get_order(total_size);
+
+ virt = dma_alloc_coherent(dev, total_size, &addr, GFP_KERNEL);
+ if (!virt)
+--
+2.39.2
+
--- /dev/null
+From b8bdabaab6d6e4bcee059e74c8bd3be1828eda2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Mar 2023 17:40:29 +0100
+Subject: net: mvpp2: classifier flow fix fragmentation flags
+
+From: Sven Auhagen <sven.auhagen@voleatech.de>
+
+[ Upstream commit 9a251cae51d57289908222e6c322ca61fccc25fd ]
+
+Add missing IP Fragmentation Flag.
+
+Fixes: f9358e12a0af ("net: mvpp2: split ingress traffic into multiple flows")
+Signed-off-by: Sven Auhagen <sven.auhagen@voleatech.de>
+Reviewed-by: Marcin Wojtas <mw@semihalf.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/mvpp2/mvpp2_cls.c | 30 +++++++++++--------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c
+index 41d935d1aaf6f..40aeaa7bd739f 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c
+@@ -62,35 +62,38 @@ static const struct mvpp2_cls_flow cls_flows[MVPP2_N_PRS_FLOWS] = {
+ MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_UNTAG,
+ MVPP22_CLS_HEK_IP4_2T,
+ MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4 |
+- MVPP2_PRS_RI_L4_TCP,
++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_TCP,
+ MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK),
+
+ MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_UNTAG,
+ MVPP22_CLS_HEK_IP4_2T,
+ MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4_OPT |
+- MVPP2_PRS_RI_L4_TCP,
++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_TCP,
+ MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK),
+
+ MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_UNTAG,
+ MVPP22_CLS_HEK_IP4_2T,
+ MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4_OTHER |
+- MVPP2_PRS_RI_L4_TCP,
++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_TCP,
+ MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK),
+
+ /* TCP over IPv4 flows, fragmented, with vlan tag */
+ MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_TAG,
+ MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED,
+- MVPP2_PRS_RI_L3_IP4 | MVPP2_PRS_RI_L4_TCP,
++ MVPP2_PRS_RI_L3_IP4 | MVPP2_PRS_RI_IP_FRAG_TRUE |
++ MVPP2_PRS_RI_L4_TCP,
+ MVPP2_PRS_IP_MASK),
+
+ MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_TAG,
+ MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED,
+- MVPP2_PRS_RI_L3_IP4_OPT | MVPP2_PRS_RI_L4_TCP,
++ MVPP2_PRS_RI_L3_IP4_OPT | MVPP2_PRS_RI_IP_FRAG_TRUE |
++ MVPP2_PRS_RI_L4_TCP,
+ MVPP2_PRS_IP_MASK),
+
+ MVPP2_DEF_FLOW(MVPP22_FLOW_TCP4, MVPP2_FL_IP4_TCP_FRAG_TAG,
+ MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED,
+- MVPP2_PRS_RI_L3_IP4_OTHER | MVPP2_PRS_RI_L4_TCP,
++ MVPP2_PRS_RI_L3_IP4_OTHER | MVPP2_PRS_RI_IP_FRAG_TRUE |
++ MVPP2_PRS_RI_L4_TCP,
+ MVPP2_PRS_IP_MASK),
+
+ /* UDP over IPv4 flows, Not fragmented, no vlan tag */
+@@ -132,35 +135,38 @@ static const struct mvpp2_cls_flow cls_flows[MVPP2_N_PRS_FLOWS] = {
+ MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_UNTAG,
+ MVPP22_CLS_HEK_IP4_2T,
+ MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4 |
+- MVPP2_PRS_RI_L4_UDP,
++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_UDP,
+ MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK),
+
+ MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_UNTAG,
+ MVPP22_CLS_HEK_IP4_2T,
+ MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4_OPT |
+- MVPP2_PRS_RI_L4_UDP,
++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_UDP,
+ MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK),
+
+ MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_UNTAG,
+ MVPP22_CLS_HEK_IP4_2T,
+ MVPP2_PRS_RI_VLAN_NONE | MVPP2_PRS_RI_L3_IP4_OTHER |
+- MVPP2_PRS_RI_L4_UDP,
++ MVPP2_PRS_RI_IP_FRAG_TRUE | MVPP2_PRS_RI_L4_UDP,
+ MVPP2_PRS_IP_MASK | MVPP2_PRS_RI_VLAN_MASK),
+
+ /* UDP over IPv4 flows, fragmented, with vlan tag */
+ MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_TAG,
+ MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED,
+- MVPP2_PRS_RI_L3_IP4 | MVPP2_PRS_RI_L4_UDP,
++ MVPP2_PRS_RI_L3_IP4 | MVPP2_PRS_RI_IP_FRAG_TRUE |
++ MVPP2_PRS_RI_L4_UDP,
+ MVPP2_PRS_IP_MASK),
+
+ MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_TAG,
+ MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED,
+- MVPP2_PRS_RI_L3_IP4_OPT | MVPP2_PRS_RI_L4_UDP,
++ MVPP2_PRS_RI_L3_IP4_OPT | MVPP2_PRS_RI_IP_FRAG_TRUE |
++ MVPP2_PRS_RI_L4_UDP,
+ MVPP2_PRS_IP_MASK),
+
+ MVPP2_DEF_FLOW(MVPP22_FLOW_UDP4, MVPP2_FL_IP4_UDP_FRAG_TAG,
+ MVPP22_CLS_HEK_IP4_2T | MVPP22_CLS_HEK_TAGGED,
+- MVPP2_PRS_RI_L3_IP4_OTHER | MVPP2_PRS_RI_L4_UDP,
++ MVPP2_PRS_RI_L3_IP4_OTHER | MVPP2_PRS_RI_IP_FRAG_TRUE |
++ MVPP2_PRS_RI_L4_UDP,
+ MVPP2_PRS_IP_MASK),
+
+ /* TCP over IPv6 flows, not fragmented, no vlan tag */
+--
+2.39.2
+
--- /dev/null
+From 7be460475896c9c8f0a03112211ddf20374018a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Mar 2023 17:41:05 +0100
+Subject: net: mvpp2: parser fix PPPoE
+
+From: Sven Auhagen <sven.auhagen@voleatech.de>
+
+[ Upstream commit 031a416c2170866be5132ae42e14453d669b0cb1 ]
+
+In PPPoE add all IPv4 header option length to the parser
+and adjust the L3 and L4 offset accordingly.
+Currently the L4 match does not work with PPPoE and
+all packets are matched as L3 IP4 OPT.
+
+Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
+Signed-off-by: Sven Auhagen <sven.auhagen@voleatech.de>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/mvpp2/mvpp2_prs.c | 82 ++++++++-----------
+ 1 file changed, 34 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+index ed8be396428b9..9af22f497a40f 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -1607,59 +1607,45 @@ static int mvpp2_prs_vlan_init(struct platform_device *pdev, struct mvpp2 *priv)
+ static int mvpp2_prs_pppoe_init(struct mvpp2 *priv)
+ {
+ struct mvpp2_prs_entry pe;
+- int tid;
+-
+- /* IPv4 over PPPoE with options */
+- tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
+- MVPP2_PE_LAST_FREE_TID);
+- if (tid < 0)
+- return tid;
+-
+- memset(&pe, 0, sizeof(pe));
+- mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_PPPOE);
+- pe.index = tid;
+-
+- mvpp2_prs_match_etype(&pe, 0, PPP_IP);
+-
+- mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP4);
+- mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP4_OPT,
+- MVPP2_PRS_RI_L3_PROTO_MASK);
+- /* goto ipv4 dest-address (skip eth_type + IP-header-size - 4) */
+- mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN +
+- sizeof(struct iphdr) - 4,
+- MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD);
+- /* Set L3 offset */
+- mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3,
+- MVPP2_ETH_TYPE_LEN,
+- MVPP2_PRS_SRAM_OP_SEL_UDF_ADD);
+-
+- /* Update shadow table and hw entry */
+- mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_PPPOE);
+- mvpp2_prs_hw_write(priv, &pe);
++ int tid, ihl;
+
+- /* IPv4 over PPPoE without options */
+- tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
+- MVPP2_PE_LAST_FREE_TID);
+- if (tid < 0)
+- return tid;
++ /* IPv4 over PPPoE with header length >= 5 */
++ for (ihl = MVPP2_PRS_IPV4_IHL_MIN; ihl <= MVPP2_PRS_IPV4_IHL_MAX; ihl++) {
++ tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
++ MVPP2_PE_LAST_FREE_TID);
++ if (tid < 0)
++ return tid;
+
+- pe.index = tid;
++ memset(&pe, 0, sizeof(pe));
++ mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_PPPOE);
++ pe.index = tid;
+
+- mvpp2_prs_tcam_data_byte_set(&pe, MVPP2_ETH_TYPE_LEN,
+- MVPP2_PRS_IPV4_HEAD |
+- MVPP2_PRS_IPV4_IHL_MIN,
+- MVPP2_PRS_IPV4_HEAD_MASK |
+- MVPP2_PRS_IPV4_IHL_MASK);
++ mvpp2_prs_match_etype(&pe, 0, PPP_IP);
++ mvpp2_prs_tcam_data_byte_set(&pe, MVPP2_ETH_TYPE_LEN,
++ MVPP2_PRS_IPV4_HEAD | ihl,
++ MVPP2_PRS_IPV4_HEAD_MASK |
++ MVPP2_PRS_IPV4_IHL_MASK);
+
+- /* Clear ri before updating */
+- pe.sram[MVPP2_PRS_SRAM_RI_WORD] = 0x0;
+- pe.sram[MVPP2_PRS_SRAM_RI_CTRL_WORD] = 0x0;
+- mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP4,
+- MVPP2_PRS_RI_L3_PROTO_MASK);
++ mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP4);
++ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP4,
++ MVPP2_PRS_RI_L3_PROTO_MASK);
++ /* goto ipv4 dst-address (skip eth_type + IP-header-size - 4) */
++ mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN +
++ sizeof(struct iphdr) - 4,
++ MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD);
++ /* Set L3 offset */
++ mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3,
++ MVPP2_ETH_TYPE_LEN,
++ MVPP2_PRS_SRAM_OP_SEL_UDF_ADD);
++ /* Set L4 offset */
++ mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L4,
++ MVPP2_ETH_TYPE_LEN + (ihl * 4),
++ MVPP2_PRS_SRAM_OP_SEL_UDF_ADD);
+
+- /* Update shadow table and hw entry */
+- mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_PPPOE);
+- mvpp2_prs_hw_write(priv, &pe);
++ /* Update shadow table and hw entry */
++ mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_PPPOE);
++ mvpp2_prs_hw_write(priv, &pe);
++ }
+
+ /* IPv6 over PPPoE */
+ tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
+--
+2.39.2
+
--- /dev/null
+From 03f1651968e750a8988fab71f099e7481b5a56da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Mar 2023 17:40:53 +0100
+Subject: net: mvpp2: parser fix QinQ
+
+From: Sven Auhagen <sven.auhagen@voleatech.de>
+
+[ Upstream commit a587a84813b90372cb0a7565e201a4075da67919 ]
+
+The mvpp2 parser entry for QinQ has the inner and outer VLAN
+in the wrong order.
+Fix the problem by swapping them.
+
+Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
+Signed-off-by: Sven Auhagen <sven.auhagen@voleatech.de>
+Reviewed-by: Marcin Wojtas <mw@semihalf.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+index 75ba57bd1d46d..ed8be396428b9 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -1539,8 +1539,8 @@ static int mvpp2_prs_vlan_init(struct platform_device *pdev, struct mvpp2 *priv)
+ if (!priv->prs_double_vlans)
+ return -ENOMEM;
+
+- /* Double VLAN: 0x8100, 0x88A8 */
+- err = mvpp2_prs_double_vlan_add(priv, ETH_P_8021Q, ETH_P_8021AD,
++ /* Double VLAN: 0x88A8, 0x8100 */
++ err = mvpp2_prs_double_vlan_add(priv, ETH_P_8021AD, ETH_P_8021Q,
+ MVPP2_PRS_PORT_MASK);
+ if (err)
+ return err;
+--
+2.39.2
+
--- /dev/null
+From 63702331721e7fa402c236d3e6054847395a41d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 17:19:54 +0800
+Subject: net/net_failover: fix txq exceeding warning
+
+From: Faicker Mo <faicker.mo@ucloud.cn>
+
+[ Upstream commit e3cbdcb0fbb61045ef3ce0e072927cc41737f787 ]
+
+The failover txq is inited as 16 queues.
+when a packet is transmitted from the failover device firstly,
+the failover device will select the queue which is returned from
+the primary device if the primary device is UP and running.
+If the primary device txq is bigger than the default 16,
+it can lead to the following warning:
+eth0 selects TX queue 18, but real number of TX queues is 16
+
+The warning backtrace is:
+[ 32.146376] CPU: 18 PID: 9134 Comm: chronyd Tainted: G E 6.2.8-1.el7.centos.x86_64 #1
+[ 32.147175] Hardware name: Red Hat KVM, BIOS 1.10.2-3.el7_4.1 04/01/2014
+[ 32.147730] Call Trace:
+[ 32.147971] <TASK>
+[ 32.148183] dump_stack_lvl+0x48/0x70
+[ 32.148514] dump_stack+0x10/0x20
+[ 32.148820] netdev_core_pick_tx+0xb1/0xe0
+[ 32.149180] __dev_queue_xmit+0x529/0xcf0
+[ 32.149533] ? __check_object_size.part.0+0x21c/0x2c0
+[ 32.149967] ip_finish_output2+0x278/0x560
+[ 32.150327] __ip_finish_output+0x1fe/0x2f0
+[ 32.150690] ip_finish_output+0x2a/0xd0
+[ 32.151032] ip_output+0x7a/0x110
+[ 32.151337] ? __pfx_ip_finish_output+0x10/0x10
+[ 32.151733] ip_local_out+0x5e/0x70
+[ 32.152054] ip_send_skb+0x19/0x50
+[ 32.152366] udp_send_skb.isra.0+0x163/0x3a0
+[ 32.152736] udp_sendmsg+0xba8/0xec0
+[ 32.153060] ? __folio_memcg_unlock+0x25/0x60
+[ 32.153445] ? __pfx_ip_generic_getfrag+0x10/0x10
+[ 32.153854] ? sock_has_perm+0x85/0xa0
+[ 32.154190] inet_sendmsg+0x6d/0x80
+[ 32.154508] ? inet_sendmsg+0x6d/0x80
+[ 32.154838] sock_sendmsg+0x62/0x70
+[ 32.155152] ____sys_sendmsg+0x134/0x290
+[ 32.155499] ___sys_sendmsg+0x81/0xc0
+[ 32.155828] ? _get_random_bytes.part.0+0x79/0x1a0
+[ 32.156240] ? ip4_datagram_release_cb+0x5f/0x1e0
+[ 32.156649] ? get_random_u16+0x69/0xf0
+[ 32.156989] ? __fget_light+0xcf/0x110
+[ 32.157326] __sys_sendmmsg+0xc4/0x210
+[ 32.157657] ? __sys_connect+0xb7/0xe0
+[ 32.157995] ? __audit_syscall_entry+0xce/0x140
+[ 32.158388] ? syscall_trace_enter.isra.0+0x12c/0x1a0
+[ 32.158820] __x64_sys_sendmmsg+0x24/0x30
+[ 32.159171] do_syscall_64+0x38/0x90
+[ 32.159493] entry_SYSCALL_64_after_hwframe+0x72/0xdc
+
+Fix that by reducing txq number as the non-existent primary-dev does.
+
+Fixes: cfc80d9a1163 ("net: Introduce net_failover driver")
+Signed-off-by: Faicker Mo <faicker.mo@ucloud.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/net_failover.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c
+index 7a28e082436e4..d0c916a53d7ce 100644
+--- a/drivers/net/net_failover.c
++++ b/drivers/net/net_failover.c
+@@ -130,14 +130,10 @@ static u16 net_failover_select_queue(struct net_device *dev,
+ txq = ops->ndo_select_queue(primary_dev, skb, sb_dev);
+ else
+ txq = netdev_pick_tx(primary_dev, skb, NULL);
+-
+- qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping;
+-
+- return txq;
++ } else {
++ txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0;
+ }
+
+- txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0;
+-
+ /* Save the original txq to restore before passing to the driver */
+ qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping;
+
+--
+2.39.2
+
--- /dev/null
+From 42736ddc09a1713aa7320defb5afe1341afe0123 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Mar 2023 13:28:15 +0200
+Subject: net: stmmac: don't reject VLANs when IFF_PROMISC is set
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit a7602e7332b97cfbec7bacb0f1ade99a575fe104 ]
+
+The blamed commit has introduced the following tests to
+dwmac4_add_hw_vlan_rx_fltr(), called from stmmac_vlan_rx_add_vid():
+
+ if (hw->promisc) {
+ netdev_err(dev,
+ "Adding VLAN in promisc mode not supported\n");
+ return -EPERM;
+ }
+
+"VLAN promiscuous" mode is keyed in this driver to IFF_PROMISC, and so,
+vlan_vid_add() and vlan_vid_del() calls cannot take place in IFF_PROMISC
+mode. I have the following 2 arguments that this restriction is.... hm,
+how shall I put it nicely... unproductive :)
+
+First, take the case of a Linux bridge. If the kernel is compiled with
+CONFIG_BRIDGE_VLAN_FILTERING=y, then this bridge shall have a VLAN
+database. The bridge shall try to call vlan_add_vid() on its bridge
+ports for each VLAN in the VLAN table. It will do this irrespectively of
+whether that port is *currently* VLAN-aware or not. So it will do this
+even when the bridge was created with vlan_filtering 0.
+But the Linux bridge, in VLAN-unaware mode, configures its ports in
+promiscuous (IFF_PROMISC) mode, so that they accept packets with any
+MAC DA (a switch must do this in order to forward those packets which
+are not directly targeted to its MAC address).
+
+As a result, the stmmac driver does not work as a bridge port, when the
+kernel is compiled with CONFIG_BRIDGE_VLAN_FILTERING=y.
+
+$ ip link add br0 type bridge && ip link set br0 up
+$ ip link set eth0 master br0 && ip link set eth0 up
+[ 2333.943296] br0: port 1(eth0) entered blocking state
+[ 2333.943381] br0: port 1(eth0) entered disabled state
+[ 2333.943782] device eth0 entered promiscuous mode
+[ 2333.944080] 4033c000.ethernet eth0: Adding VLAN in promisc mode not supported
+[ 2333.976509] 4033c000.ethernet eth0: failed to initialize vlan filtering on this port
+RTNETLINK answers: Operation not permitted
+
+Secondly, take the case of stmmac as DSA master. Some switch tagging
+protocols are based on 802.1Q VLANs (tag_sja1105.c), and as such,
+tag_8021q.c uses vlan_vid_add() to work with VLAN-filtering DSA masters.
+But also, when a DSA port becomes promiscuous (for example when it joins
+a bridge), the DSA framework also makes the DSA master promiscuous.
+
+Moreover, for every VLAN that a DSA switch sends to the CPU, DSA also
+programs a VLAN filter on the DSA master, because if the the DSA switch
+uses a tail tag, then the hardware frame parser of the DSA master will
+see VLAN as VLAN, and might filter them out, for being unknown.
+
+Due to the above 2 reasons, my belief is that the stmmac driver does not
+get to choose to not accept vlan_vid_add() calls while IFF_PROMISC is
+enabled, because the 2 are completely independent and there are code
+paths in the network stack which directly lead to this situation
+occurring, without the user's direct input.
+
+In fact, my belief is that "VLAN promiscuous" mode should have never
+been keyed on IFF_PROMISC in the first place, but rather, on the
+NETIF_F_HW_VLAN_CTAG_FILTER feature flag which can be toggled by the
+user through ethtool -k, when present in netdev->hw_features.
+
+In the stmmac driver, NETIF_F_HW_VLAN_CTAG_FILTER is only present in
+"features", making this feature "on [fixed]".
+
+I have this belief because I am unaware of any definition of promiscuity
+which implies having an effect on anything other than MAC DA (therefore
+not VLAN). However, I seem to be rather alone in having this opinion,
+looking back at the disagreements from this discussion:
+https://lore.kernel.org/netdev/20201110153958.ci5ekor3o2ekg3ky@ipetronik.com/
+
+In any case, to remove the vlan_vid_add() dependency on !IFF_PROMISC,
+one would need to remove the check and see what fails. I guess the test
+was there because of the way in which dwmac4_vlan_promisc_enable() is
+implemented.
+
+For context, the dwmac4 supports Perfect Filtering for a limited number
+of VLANs - dwmac4_get_num_vlan(), priv->hw->num_vlan, with a fallback on
+Hash Filtering - priv->dma_cap.vlhash - see stmmac_vlan_update(), also
+visible in cat /sys/kernel/debug/stmmaceth/eth0/dma_cap | grep 'VLAN
+Hash Filtering'.
+
+The perfect filtering is based on MAC_VLAN_Tag_Filter/MAC_VLAN_Tag_Data
+registers, accessed in the driver through dwmac4_write_vlan_filter().
+
+The hash filtering is based on the MAC_VLAN_Hash_Table register, named
+GMAC_VLAN_HASH_TABLE in the driver and accessed by dwmac4_update_vlan_hash().
+The control bit for enabling hash filtering is GMAC_VLAN_VTHM
+(MAC_VLAN_Tag_Ctrl bit VTHM: VLAN Tag Hash Table Match Enable).
+
+Now, the description of dwmac4_vlan_promisc_enable() is that it iterates
+through the driver's cache of perfect filter entries (hw->vlan_filter[i],
+added by dwmac4_add_hw_vlan_rx_fltr()), and evicts them from hardware by
+unsetting their GMAC_VLAN_TAG_DATA_VEN (MAC_VLAN_Tag_Data bit VEN - VLAN
+Tag Enable) bit. Then it unsets the GMAC_VLAN_VTHM bit, which disables
+hash matching.
+
+This leaves the MAC, according to table "VLAN Match Status" from the
+documentation, to always enter these data paths:
+
+VID |VLAN Perfect Filter |VTHM Bit |VLAN Hash Filter |Final VLAN Match
+ |Match Result | |Match Result |Status
+-------|--------------------|---------|-----------------|----------------
+VID!=0 |Fail |0 |don't care |Pass
+
+So, dwmac4_vlan_promisc_enable() does its job, but by unsetting
+GMAC_VLAN_VTHM, it conflicts with the other code path which controls
+this bit: dwmac4_update_vlan_hash(), called through stmmac_update_vlan_hash()
+from stmmac_vlan_rx_add_vid() and from stmmac_vlan_rx_kill_vid().
+This is, I guess, why dwmac4_add_hw_vlan_rx_fltr() is not allowed to run
+after dwmac4_vlan_promisc_enable() has unset GMAC_VLAN_VTHM: because if
+it did, then dwmac4_update_vlan_hash() would set GMAC_VLAN_VTHM again,
+breaking the "VLAN promiscuity".
+
+It turns out that dwmac4_vlan_promisc_enable() is way too complicated
+for what needs to be done. The MAC_Packet_Filter register also has the
+VTFE bit (VLAN Tag Filter Enable), which simply controls whether VLAN
+tagged packets which don't match the filtering tables (either perfect or
+hash) are dropped or not. At the moment, this driver unconditionally
+sets GMAC_PACKET_FILTER_VTFE if NETIF_F_HW_VLAN_CTAG_FILTER was detected
+through the priv->dma_cap.vlhash capability bits of the device, in
+stmmac_dvr_probe().
+
+I would suggest deleting the unnecessarily complex logic from
+dwmac4_vlan_promisc_enable(), and simply unsetting GMAC_PACKET_FILTER_VTFE
+when becoming IFF_PROMISC, which has the same effect of allowing packets
+with any VLAN tags, but has the additional benefit of being able to run
+concurrently with stmmac_vlan_rx_add_vid() and stmmac_vlan_rx_kill_vid().
+
+As much as I believe that the VTFE bit should have been exclusively
+controlled by NETIF_F_HW_VLAN_CTAG_FILTER through ethtool, and not by
+IFF_PROMISC, changing that is not a punctual fix to the problem, and it
+would probably break the VFFQ feature added by the later commit
+e0f9956a3862 ("net: stmmac: Add option for VLAN filter fail queue
+enable"). From the commit description, VFFQ needs IFF_PROMISC=on and
+VTFE=off in order to work (and this change respects that). But if VTFE
+was changed to be controlled through ethtool -k, then a user-visible
+change would have been introduced in Intel's scripts (a need to run
+"ethtool -k eth0 rx-vlan-filter off" which did not exist before).
+
+The patch was tested with this set of commands:
+
+ ip link set eth0 up
+ ip link add link eth0 name eth0.100 type vlan id 100
+ ip addr add 192.168.100.2/24 dev eth0.100 && ip link set eth0.100 up
+ ip link set eth0 promisc on
+ ip link add link eth0 name eth0.101 type vlan id 101
+ ip addr add 192.168.101.2/24 dev eth0.101 && ip link set eth0.101 up
+ ip link set eth0 promisc off
+ ping -c 5 192.168.100.1
+ ping -c 5 192.168.101.1
+ ip link set eth0 promisc on
+ ping -c 5 192.168.100.1
+ ping -c 5 192.168.101.1
+ ip link del eth0.100
+ ip link del eth0.101
+ # Wait for VLAN-tagged pings from the other end...
+ # Check with "tcpdump -i eth0 -e -n -p" and we should see them
+ ip link set eth0 promisc off
+ # Wait for VLAN-tagged pings from the other end...
+ # Check with "tcpdump -i eth0 -e -n -p" and we shouldn't see them
+ # anymore, but remove the "-p" argument from tcpdump and they're there.
+
+Fixes: c89f44ff10fd ("net: stmmac: Add support for VLAN promiscuous mode")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/common.h | 1 -
+ .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 61 +------------------
+ 2 files changed, 3 insertions(+), 59 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
+index ec9c130276d89..54bb072aeb2d3 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/common.h
++++ b/drivers/net/ethernet/stmicro/stmmac/common.h
+@@ -532,7 +532,6 @@ struct mac_device_info {
+ unsigned int xlgmac;
+ unsigned int num_vlan;
+ u32 vlan_filter[32];
+- unsigned int promisc;
+ bool vlan_fail_q_en;
+ u8 vlan_fail_q;
+ };
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index e5cfde1cbd5ce..188a00065f66c 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -481,12 +481,6 @@ static int dwmac4_add_hw_vlan_rx_fltr(struct net_device *dev,
+ if (vid > 4095)
+ return -EINVAL;
+
+- if (hw->promisc) {
+- netdev_err(dev,
+- "Adding VLAN in promisc mode not supported\n");
+- return -EPERM;
+- }
+-
+ /* Single Rx VLAN Filter */
+ if (hw->num_vlan == 1) {
+ /* For single VLAN filter, VID 0 means VLAN promiscuous */
+@@ -536,12 +530,6 @@ static int dwmac4_del_hw_vlan_rx_fltr(struct net_device *dev,
+ {
+ int i, ret = 0;
+
+- if (hw->promisc) {
+- netdev_err(dev,
+- "Deleting VLAN in promisc mode not supported\n");
+- return -EPERM;
+- }
+-
+ /* Single Rx VLAN Filter */
+ if (hw->num_vlan == 1) {
+ if ((hw->vlan_filter[0] & GMAC_VLAN_TAG_VID) == vid) {
+@@ -566,39 +554,6 @@ static int dwmac4_del_hw_vlan_rx_fltr(struct net_device *dev,
+ return ret;
+ }
+
+-static void dwmac4_vlan_promisc_enable(struct net_device *dev,
+- struct mac_device_info *hw)
+-{
+- void __iomem *ioaddr = hw->pcsr;
+- u32 value;
+- u32 hash;
+- u32 val;
+- int i;
+-
+- /* Single Rx VLAN Filter */
+- if (hw->num_vlan == 1) {
+- dwmac4_write_single_vlan(dev, 0);
+- return;
+- }
+-
+- /* Extended Rx VLAN Filter Enable */
+- for (i = 0; i < hw->num_vlan; i++) {
+- if (hw->vlan_filter[i] & GMAC_VLAN_TAG_DATA_VEN) {
+- val = hw->vlan_filter[i] & ~GMAC_VLAN_TAG_DATA_VEN;
+- dwmac4_write_vlan_filter(dev, hw, i, val);
+- }
+- }
+-
+- hash = readl(ioaddr + GMAC_VLAN_HASH_TABLE);
+- if (hash & GMAC_VLAN_VLHT) {
+- value = readl(ioaddr + GMAC_VLAN_TAG);
+- if (value & GMAC_VLAN_VTHM) {
+- value &= ~GMAC_VLAN_VTHM;
+- writel(value, ioaddr + GMAC_VLAN_TAG);
+- }
+- }
+-}
+-
+ static void dwmac4_restore_hw_vlan_rx_fltr(struct net_device *dev,
+ struct mac_device_info *hw)
+ {
+@@ -718,22 +673,12 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ }
+
+ /* VLAN filtering */
+- if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
++ if (dev->flags & IFF_PROMISC && !hw->vlan_fail_q_en)
++ value &= ~GMAC_PACKET_FILTER_VTFE;
++ else if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
+ value |= GMAC_PACKET_FILTER_VTFE;
+
+ writel(value, ioaddr + GMAC_PACKET_FILTER);
+-
+- if (dev->flags & IFF_PROMISC && !hw->vlan_fail_q_en) {
+- if (!hw->promisc) {
+- hw->promisc = 1;
+- dwmac4_vlan_promisc_enable(dev, hw);
+- }
+- } else {
+- if (hw->promisc) {
+- hw->promisc = 0;
+- dwmac4_restore_hw_vlan_rx_fltr(dev, hw);
+- }
+- }
+ }
+
+ static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex,
+--
+2.39.2
+
--- /dev/null
+From 4866df8075f3ce36181209d8170d9e605315a6f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 21:34:58 +0900
+Subject: PCI: dwc: Fix PORT_LINK_CONTROL update when CDM check enabled
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit cdce67099117ece371582f706c6eff7d3a65326d ]
+
+If CDM_CHECK is enabled (by the DT "snps,enable-cdm-check" property), 'val'
+is overwritten by PCIE_PL_CHK_REG_CONTROL_STATUS initialization. Commit
+ec7b952f453c ("PCI: dwc: Always enable CDM check if "snps,enable-cdm-check"
+exists") did not account for further usage of 'val', so we wrote improper
+values to PCIE_PORT_LINK_CONTROL when the CDM check is enabled.
+
+Move the PCIE_PORT_LINK_CONTROL update to be completely after the
+PCIE_PL_CHK_REG_CONTROL_STATUS register initialization.
+
+[bhelgaas: commit log adapted from Serge's version]
+Fixes: ec7b952f453c ("PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists")
+Link: https://lore.kernel.org/r/20230310123510.675685-2-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-designware.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c
+index 9e4d96e5a3f5a..575834cae3b9e 100644
+--- a/drivers/pci/controller/dwc/pcie-designware.c
++++ b/drivers/pci/controller/dwc/pcie-designware.c
+@@ -645,11 +645,6 @@ void dw_pcie_setup(struct dw_pcie *pci)
+ dw_pcie_writel_dbi(pci, PCIE_LINK_WIDTH_SPEED_CONTROL, val);
+ }
+
+- val = dw_pcie_readl_dbi(pci, PCIE_PORT_LINK_CONTROL);
+- val &= ~PORT_LINK_FAST_LINK_MODE;
+- val |= PORT_LINK_DLL_LINK_EN;
+- dw_pcie_writel_dbi(pci, PCIE_PORT_LINK_CONTROL, val);
+-
+ if (of_property_read_bool(np, "snps,enable-cdm-check")) {
+ val = dw_pcie_readl_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS);
+ val |= PCIE_PL_CHK_REG_CHK_REG_CONTINUOUS |
+@@ -657,6 +652,11 @@ void dw_pcie_setup(struct dw_pcie *pci)
+ dw_pcie_writel_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS, val);
+ }
+
++ val = dw_pcie_readl_dbi(pci, PCIE_PORT_LINK_CONTROL);
++ val &= ~PORT_LINK_FAST_LINK_MODE;
++ val |= PORT_LINK_DLL_LINK_EN;
++ dw_pcie_writel_dbi(pci, PCIE_PORT_LINK_CONTROL, val);
++
+ of_property_read_u32(np, "num-lanes", &pci->num_lanes);
+ if (!pci->num_lanes) {
+ dev_dbg(pci->dev, "Using h/w default number of lanes\n");
+--
+2.39.2
+
--- /dev/null
+From d20aa194931d9e6bda71a7f9c23d7d506b5d1608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 11:30:57 +0800
+Subject: platform/surface: aggregator: Add missing fwnode_handle_put()
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit acd0acb802b90f88d19ad4337183e44fd0f77c50 ]
+
+In fwnode_for_each_child_node(), we should add
+fwnode_handle_put() when break out of the iteration
+fwnode_for_each_child_node() as it will automatically
+increase and decrease the refcounter.
+
+Fixes: fc622b3d36e6 ("platform/surface: Set up Surface Aggregator device registry")
+Signed-off-by: Liang He <windhl@126.com>
+Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20230322033057.1855741-1-windhl@126.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/surface/aggregator/bus.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/surface/aggregator/bus.c b/drivers/platform/surface/aggregator/bus.c
+index de539938896e2..b501a79f2a08a 100644
+--- a/drivers/platform/surface/aggregator/bus.c
++++ b/drivers/platform/surface/aggregator/bus.c
+@@ -485,8 +485,10 @@ int __ssam_register_clients(struct device *parent, struct ssam_controller *ctrl,
+ * device, so ignore it and continue with the next one.
+ */
+ status = ssam_add_client_device(parent, ctrl, child);
+- if (status && status != -ENODEV)
++ if (status && status != -ENODEV) {
++ fwnode_handle_put(child);
+ goto err;
++ }
+ }
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 0084cada6776a352f69d00b6a86b493736f2deaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 14:20:29 -0700
+Subject: platform/x86/intel/pmc: Alder Lake PCH slp_s0_residency fix
+
+From: Rajvi Jingar <rajvi.jingar@linux.intel.com>
+
+[ Upstream commit fb5755100a0a5aa5957bdb204fd1e249684557fc ]
+
+For platforms with Alder Lake PCH (Alder Lake S and Raptor Lake S) the
+slp_s0_residency attribute has been reporting the wrong value. Unlike other
+platforms, ADL PCH does not have a counter for the time that the SLP_S0
+signal was asserted. Instead, firmware uses the aggregate of the Low Power
+Mode (LPM) substate counters as the S0ix value. Since the LPM counters run
+at a different frequency, this lead to misreporting of the S0ix time.
+
+Add a check for Alder Lake PCH and adjust the frequency accordingly when
+display slp_s0_residency.
+
+Fixes: bbab31101f44 ("platform/x86/intel: pmc/core: Add Alderlake support to pmc core driver")
+Signed-off-by: Rajvi Jingar <rajvi.jingar@linux.intel.com>
+Signed-off-by: David E. Box <david.e.box@linux.intel.com>
+Reviewed-by: Rajneesh Bhardwaj <irenic.rajneesh@gmail.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20230320212029.3154407-1-david.e.box@linux.intel.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/pmc/core.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel/pmc/core.c b/drivers/platform/x86/intel/pmc/core.c
+index 17ec5825d13d7..be0fb9401202a 100644
+--- a/drivers/platform/x86/intel/pmc/core.c
++++ b/drivers/platform/x86/intel/pmc/core.c
+@@ -958,7 +958,18 @@ static inline void pmc_core_reg_write(struct pmc_dev *pmcdev, int reg_offset,
+
+ static inline u64 pmc_core_adjust_slp_s0_step(struct pmc_dev *pmcdev, u32 value)
+ {
+- return (u64)value * pmcdev->map->slp_s0_res_counter_step;
++ /*
++ * ADL PCH does not have the SLP_S0 counter and LPM Residency counters are
++ * used as a workaround which uses 30.5 usec tick. All other client
++ * programs have the legacy SLP_S0 residency counter that is using the 122
++ * usec tick.
++ */
++ const int lpm_adj_x2 = pmcdev->map->lpm_res_counter_step_x2;
++
++ if (pmcdev->map == &adl_reg_map)
++ return (u64)value * GET_X2_COUNTER((u64)lpm_adj_x2);
++ else
++ return (u64)value * pmcdev->map->slp_s0_res_counter_step;
+ }
+
+ static int set_etr3(struct pmc_dev *pmcdev)
+--
+2.39.2
+
--- /dev/null
+From 721e429642881d4970498881fb010333e8d56c6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Mar 2023 20:32:18 -0400
+Subject: platform/x86: think-lmi: add missing type attribute
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit 583329dcf22e568a328a944f20427ccfc95dce01 ]
+
+This driver was missing the mandatory type attribute...oops.
+
+Add it in along with logic to determine whether the attribute is an
+enumeration type or a string by parsing the possible_values attribute.
+
+Upstream bug https://bugzilla.kernel.org/show_bug.cgi?id=216460
+
+Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms")
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Link: https://lore.kernel.org/r/20230320003221.561750-1-mpearson-lenovo@squebb.ca
+Reviewed-by: Thomas Weißschuh <linux@weissschuh.net>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/think-lmi.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
+index a01a92769c1a3..07c9dc21eff52 100644
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -947,6 +947,20 @@ static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute
+ return sysfs_emit(buf, "%s\n", setting->possible_values);
+ }
+
++static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr,
++ char *buf)
++{
++ struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
++
++ if (setting->possible_values) {
++ /* Figure out what setting type is as BIOS does not return this */
++ if (strchr(setting->possible_values, ','))
++ return sysfs_emit(buf, "enumeration\n");
++ }
++ /* Anything else is going to be a string */
++ return sysfs_emit(buf, "string\n");
++}
++
+ static ssize_t current_value_store(struct kobject *kobj,
+ struct kobj_attribute *attr,
+ const char *buf, size_t count)
+@@ -1036,10 +1050,13 @@ static struct kobj_attribute attr_possible_values = __ATTR_RO(possible_values);
+
+ static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 0600);
+
++static struct kobj_attribute attr_type = __ATTR_RO(type);
++
+ static struct attribute *tlmi_attrs[] = {
+ &attr_displ_name.attr,
+ &attr_current_val.attr,
+ &attr_possible_values.attr,
++ &attr_type.attr,
+ NULL
+ };
+
+--
+2.39.2
+
--- /dev/null
+From d60190d06b0f2609aee8d96a4791a09fa57d3e78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Mar 2023 20:32:21 -0400
+Subject: platform/x86: think-lmi: Add possible_values for ThinkStation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit 8a02d70679fc1c434401863333c8ea7dbf201494 ]
+
+ThinkStation platforms don't support the API to return possible_values
+but instead embed it in the settings string.
+
+Try and extract this information and set the possible_values attribute
+appropriately.
+
+Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms")
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Link: https://lore.kernel.org/r/20230320003221.561750-4-mpearson-lenovo@squebb.ca
+Reviewed-by: Thomas Weißschuh <linux@weissschuh.net>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/think-lmi.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
+index ccd085bacf298..74af3e593b2ca 100644
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -1450,6 +1450,26 @@ static int tlmi_analyze(void)
+ if (ret || !setting->possible_values)
+ pr_info("Error retrieving possible values for %d : %s\n",
+ i, setting->display_name);
++ } else {
++ /*
++ * Older Thinkstations don't support the bios_selections API.
++ * Instead they store this as a [Optional:Option1,Option2] section of the
++ * name string.
++ * Try and pull that out if it's available.
++ */
++ char *item, *optstart, *optend;
++
++ if (!tlmi_setting(setting->index, &item, LENOVO_BIOS_SETTING_GUID)) {
++ optstart = strstr(item, "[Optional:");
++ if (optstart) {
++ optstart += strlen("[Optional:");
++ optend = strstr(optstart, "]");
++ if (optend)
++ setting->possible_values =
++ kstrndup(optstart, optend - optstart,
++ GFP_KERNEL);
++ }
++ }
+ }
+ /*
+ * firmware-attributes requires that possible_values are separated by ';' but
+--
+2.39.2
+
--- /dev/null
+From fd28f861574db9c6c4f9acb29511030ec1d4819f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Mar 2023 20:32:20 -0400
+Subject: platform/x86: think-lmi: only display possible_values if available
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit cf337f27f3bfc4aeab4954c468239fd6233c7638 ]
+
+Some attributes don't have any values available. In those cases don't
+make the possible_values entry visible.
+
+Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms")
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Link: https://lore.kernel.org/r/20230320003221.561750-3-mpearson-lenovo@squebb.ca
+Reviewed-by: Thomas Weißschuh <linux@weissschuh.net>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/think-lmi.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
+index 62241680c8a90..ccd085bacf298 100644
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -941,9 +941,6 @@ static ssize_t possible_values_show(struct kobject *kobj, struct kobj_attribute
+ {
+ struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
+
+- if (!tlmi_priv.can_get_bios_selections)
+- return -EOPNOTSUPP;
+-
+ return sysfs_emit(buf, "%s\n", setting->possible_values);
+ }
+
+@@ -1052,6 +1049,18 @@ static struct kobj_attribute attr_current_val = __ATTR_RW_MODE(current_value, 06
+
+ static struct kobj_attribute attr_type = __ATTR_RO(type);
+
++static umode_t attr_is_visible(struct kobject *kobj,
++ struct attribute *attr, int n)
++{
++ struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
++
++ /* We don't want to display possible_values attributes if not available */
++ if ((attr == &attr_possible_values.attr) && (!setting->possible_values))
++ return 0;
++
++ return attr->mode;
++}
++
+ static struct attribute *tlmi_attrs[] = {
+ &attr_displ_name.attr,
+ &attr_current_val.attr,
+@@ -1061,6 +1070,7 @@ static struct attribute *tlmi_attrs[] = {
+ };
+
+ static const struct attribute_group tlmi_attr_group = {
++ .is_visible = attr_is_visible,
+ .attrs = tlmi_attrs,
+ };
+
+--
+2.39.2
+
--- /dev/null
+From f14b14339fd979920623a21c9987f788755d62dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Mar 2023 20:32:19 -0400
+Subject: platform/x86: think-lmi: use correct possible_values delimiters
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit 45e21289bfc6e257885514790a8a8887da822d40 ]
+
+firmware-attributes class requires that possible values are delimited
+using ';' but the Lenovo firmware uses ',' instead.
+Parse string and replace where appropriate.
+
+Suggested-by: Thomas Weißschuh <linux@weissschuh.net>
+Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms")
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Link: https://lore.kernel.org/r/20230320003221.561750-2-mpearson-lenovo@squebb.ca
+Reviewed-by: Thomas Weißschuh <linux@weissschuh.net>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/think-lmi.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
+index 07c9dc21eff52..62241680c8a90 100644
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -954,7 +954,7 @@ static ssize_t type_show(struct kobject *kobj, struct kobj_attribute *attr,
+
+ if (setting->possible_values) {
+ /* Figure out what setting type is as BIOS does not return this */
+- if (strchr(setting->possible_values, ','))
++ if (strchr(setting->possible_values, ';'))
+ return sysfs_emit(buf, "enumeration\n");
+ }
+ /* Anything else is going to be a string */
+@@ -1441,6 +1441,13 @@ static int tlmi_analyze(void)
+ pr_info("Error retrieving possible values for %d : %s\n",
+ i, setting->display_name);
+ }
++ /*
++ * firmware-attributes requires that possible_values are separated by ';' but
++ * Lenovo FW uses ','. Replace appropriately.
++ */
++ if (setting->possible_values)
++ strreplace(setting->possible_values, ',', ';');
++
+ kobject_init(&setting->kobj, &tlmi_attr_setting_ktype);
+ tlmi_priv.setting[i] = setting;
+ kfree(item);
+--
+2.39.2
+
--- /dev/null
+From 5ff7753013de9674b790fa7be9114e529b448f51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 11:14:06 +0800
+Subject: ptp_qoriq: fix memory leak in probe()
+
+From: SongJingyi <u201912584@hust.edu.cn>
+
+[ Upstream commit f33642224e38d7e0d59336e10e7b4e370b1c4506 ]
+
+Smatch complains that:
+drivers/ptp/ptp_qoriq.c ptp_qoriq_probe()
+warn: 'base' from ioremap() not released.
+
+Fix this by revising the parameter from 'ptp_qoriq->base' to 'base'.
+This is only a bug if ptp_qoriq_init() returns on the
+first -ENODEV error path.
+For other error paths ptp_qoriq->base and base are the same.
+And this change makes the code more readable.
+
+Fixes: 7f4399ba405b ("ptp_qoriq: fix NULL access if ptp dt node missing")
+Signed-off-by: SongJingyi <u201912584@hust.edu.cn>
+Reviewed-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230324031406.1895159-1-u201912584@hust.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_qoriq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ptp/ptp_qoriq.c b/drivers/ptp/ptp_qoriq.c
+index 08f4cf0ad9e3c..8fa9772acf79b 100644
+--- a/drivers/ptp/ptp_qoriq.c
++++ b/drivers/ptp/ptp_qoriq.c
+@@ -601,7 +601,7 @@ static int ptp_qoriq_probe(struct platform_device *dev)
+ return 0;
+
+ no_clock:
+- iounmap(ptp_qoriq->base);
++ iounmap(base);
+ no_ioremap:
+ release_resource(ptp_qoriq->rsrc);
+ no_resource:
+--
+2.39.2
+
--- /dev/null
+From 7ef0b336fe466e30cb700213373fcc05bd5a862e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 22:33:09 +0800
+Subject: r8169: fix RTL8168H and RTL8107E rx crc error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: ChunHao Lin <hau@realtek.com>
+
+[ Upstream commit 33189f0a94b9639c058781fcf82e4ea3803b1682 ]
+
+When link speed is 10 Mbps and temperature is under -20°C, RTL8168H and
+RTL8107E may have rx crc error. Disable phy 10 Mbps pll off to fix this
+issue.
+
+Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E")
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_phy_config.c b/drivers/net/ethernet/realtek/r8169_phy_config.c
+index 930496cd34ed0..b50f16786c246 100644
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -826,6 +826,9 @@ static void rtl8168h_2_hw_phy_config(struct rtl8169_private *tp,
+ /* disable phy pfm mode */
+ phy_modify_paged(phydev, 0x0a44, 0x11, BIT(7), 0);
+
++ /* disable 10m pll off */
++ phy_modify_paged(phydev, 0x0a43, 0x10, BIT(0), 0);
++
+ rtl8168g_disable_aldps(phydev);
+ rtl8168g_config_eee_phy(phydev);
+ }
+--
+2.39.2
+
--- /dev/null
+From de22acd95a5435ea1ff89604fc7adca7e1aefdea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 10:29:33 +0200
+Subject: regulator: Handle deferred clk
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 02bcba0b9f9da706d5bd1e8cbeb83493863e17b5 ]
+
+devm_clk_get() can return -EPROBE_DEFER. So it is better to return the
+error code from devm_clk_get(), instead of a hard coded -ENOENT.
+
+This gives more opportunities to successfully probe the driver.
+
+Fixes: 8959e5324485 ("regulator: fixed: add possibility to enable by clock")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/18459fae3d017a66313699c7c8456b28158b2dd0.1679819354.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/fixed.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
+index 2a9867abba20c..e6724a229d237 100644
+--- a/drivers/regulator/fixed.c
++++ b/drivers/regulator/fixed.c
+@@ -215,7 +215,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev)
+ drvdata->enable_clock = devm_clk_get(dev, NULL);
+ if (IS_ERR(drvdata->enable_clock)) {
+ dev_err(dev, "Can't get enable-clock from devicetree\n");
+- return -ENOENT;
++ return PTR_ERR(drvdata->enable_clock);
+ }
+ } else if (drvtype && drvtype->has_performance_state) {
+ drvdata->desc.ops = &fixed_voltage_domain_ops;
+--
+2.39.2
+
--- /dev/null
+From d3dfce788ffd1dcce0597d066a234ab5d947577e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Feb 2023 14:27:11 +0000
+Subject: riscv/kvm: Fix VM hang in case of timer delta being zero.
+
+From: Rajnesh Kanwal <rkanwal@rivosinc.com>
+
+[ Upstream commit 6eff38048944cadc3cddcf117acfa5199ec32490 ]
+
+In case when VCPU is blocked due to WFI, we schedule the timer
+from `kvm_riscv_vcpu_timer_blocking()` to keep timer interrupt
+ticking.
+
+But in case when delta_ns comes to be zero, we never schedule
+the timer and VCPU keeps sleeping indefinitely until any activity
+is done with VM console.
+
+This is easily reproduce-able using kvmtool.
+./lkvm-static run -c1 --console virtio -p "earlycon root=/dev/vda" \
+ -k ./Image -d rootfs.ext4
+
+Also, just add a print in kvm_riscv_vcpu_vstimer_expired() to
+check the interrupt delivery and run `top` or similar auto-upating
+cmd from guest. Within sometime one can notice that print from
+timer expiry routine stops and the `top` cmd output will stop
+updating.
+
+This change fixes this by making sure we schedule the timer even
+with delta_ns being zero to bring the VCPU out of sleep immediately.
+
+Fixes: 8f5cb44b1bae ("RISC-V: KVM: Support sstc extension")
+Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
+Reviewed-by: Atish Patra <atishp@rivosinc.com>
+Signed-off-by: Anup Patel <anup@brainfault.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kvm/vcpu_timer.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/kvm/vcpu_timer.c b/arch/riscv/kvm/vcpu_timer.c
+index ad34519c8a13d..3ac2ff6a65dac 100644
+--- a/arch/riscv/kvm/vcpu_timer.c
++++ b/arch/riscv/kvm/vcpu_timer.c
+@@ -147,10 +147,8 @@ static void kvm_riscv_vcpu_timer_blocking(struct kvm_vcpu *vcpu)
+ return;
+
+ delta_ns = kvm_riscv_delta_cycles2ns(t->next_cycles, gt, t);
+- if (delta_ns) {
+- hrtimer_start(&t->hrt, ktime_set(0, delta_ns), HRTIMER_MODE_REL);
+- t->next_set = true;
+- }
++ hrtimer_start(&t->hrt, ktime_set(0, delta_ns), HRTIMER_MODE_REL);
++ t->next_set = true;
+ }
+
+ static void kvm_riscv_vcpu_timer_unblocking(struct kvm_vcpu *vcpu)
+--
+2.39.2
+
--- /dev/null
+From ad003cfb4b79a51657f9024070a79216d2f339c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 11:04:47 -0400
+Subject: s390/vfio-ap: fix memory leak in vfio_ap device driver
+
+From: Tony Krowiak <akrowiak@linux.ibm.com>
+
+[ Upstream commit 8f8cf767589f2131ae5d40f3758429095c701c84 ]
+
+The device release callback function invoked to release the matrix device
+uses the dev_get_drvdata(device *dev) function to retrieve the
+pointer to the vfio_matrix_dev object in order to free its storage. The
+problem is, this object is not stored as drvdata with the device; since the
+kfree function will accept a NULL pointer, the memory for the
+vfio_matrix_dev object is never freed.
+
+Since the device being released is contained within the vfio_matrix_dev
+object, the container_of macro will be used to retrieve its pointer.
+
+Fixes: 1fde573413b5 ("s390: vfio-ap: base implementation of VFIO AP device driver")
+Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com>
+Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
+Link: https://lore.kernel.org/r/20230320150447.34557-1-akrowiak@linux.ibm.com
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/vfio_ap_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c
+index f43cfeabd2cc8..0afceb63ac43c 100644
+--- a/drivers/s390/crypto/vfio_ap_drv.c
++++ b/drivers/s390/crypto/vfio_ap_drv.c
+@@ -54,8 +54,9 @@ static struct ap_driver vfio_ap_drv = {
+
+ static void vfio_ap_matrix_dev_release(struct device *dev)
+ {
+- struct ap_matrix_dev *matrix_dev = dev_get_drvdata(dev);
++ struct ap_matrix_dev *matrix_dev;
+
++ matrix_dev = container_of(dev, struct ap_matrix_dev, device);
+ kfree(matrix_dev);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 0f42837de2d4ba63ac839c59f484b5ff459d5d47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 16:01:34 +0100
+Subject: scsi: megaraid_sas: Fix crash after a double completion
+
+From: Tomas Henzl <thenzl@redhat.com>
+
+[ Upstream commit 2309df27111a51734cb9240b4d3c25f2f3c6ab06 ]
+
+When a physical disk is attached directly "without JBOD MAP support" (see
+megasas_get_tm_devhandle()) then there is no real error handling in the
+driver. Return FAILED instead of SUCCESS.
+
+Fixes: 18365b138508 ("megaraid_sas: Task management support")
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Link: https://lore.kernel.org/r/20230324150134.14696-1-thenzl@redhat.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index 6650f8c8e9b04..af22ffa8f6a25 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -4768,7 +4768,7 @@ int megasas_task_abort_fusion(struct scsi_cmnd *scmd)
+ devhandle = megasas_get_tm_devhandle(scmd->device);
+
+ if (devhandle == (u16)ULONG_MAX) {
+- ret = SUCCESS;
++ ret = FAILED;
+ sdev_printk(KERN_INFO, scmd->device,
+ "task abort issued for invalid devhandle\n");
+ mutex_unlock(&instance->reset_mutex);
+@@ -4838,7 +4838,7 @@ int megasas_reset_target_fusion(struct scsi_cmnd *scmd)
+ devhandle = megasas_get_tm_devhandle(scmd->device);
+
+ if (devhandle == (u16)ULONG_MAX) {
+- ret = SUCCESS;
++ ret = FAILED;
+ sdev_printk(KERN_INFO, scmd->device,
+ "target reset issued for invalid devhandle\n");
+ mutex_unlock(&instance->reset_mutex);
+--
+2.39.2
+
--- /dev/null
+From c9b3bfdf30ab72146a2e234d102fa98880912307 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 12:32:04 -0700
+Subject: scsi: mpt3sas: Don't print sense pool info twice
+
+From: Jerry Snitselaar <jsnitsel@redhat.com>
+
+[ Upstream commit d684a7a26f7d2c7122a4581ac966ed64e88fb29c ]
+
+_base_allocate_sense_dma_pool() already prints out the sense pool
+information, so don't print it a second time after calling it in
+_base_allocate_memory_pools(). In addition the version in
+_base_allocate_memory_pools() was using the wrong size value, sz, which was
+last assigned when doing some nvme calculations instead of sense_sz to
+determine the pool size in kilobytes.
+
+Cc: Sathya Prakash <sathya.prakash@broadcom.com>
+Cc: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Cc: Suganath Prabu Subramani <suganath-prabu.subramani@broadcom.com>
+Cc: MPT-FusionLinux.pdl@broadcom.com
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
+Fixes: 970ac2bb70e7 ("scsi: mpt3sas: Force sense buffer allocations to be within same 4 GB region")
+Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Link: https://lore.kernel.org/r/20230324193204.567932-1-jsnitsel@redhat.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 2ee9ea57554d7..14ae0a9c5d3d8 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -6616,11 +6616,6 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc)
+ else if (rc == -EAGAIN)
+ goto try_32bit_dma;
+ total_sz += sense_sz;
+- ioc_info(ioc,
+- "sense pool(0x%p)- dma(0x%llx): depth(%d),"
+- "element_size(%d), pool_size(%d kB)\n",
+- ioc->sense, (unsigned long long)ioc->sense_dma, ioc->scsiio_depth,
+- SCSI_SENSE_BUFFERSIZE, sz / 1024);
+ /* reply pool, 4 byte align */
+ sz = ioc->reply_free_queue_depth * ioc->reply_sz;
+ rc = _base_allocate_reply_pool(ioc, sz);
+--
+2.39.2
+
tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch
btrfs-fix-uninitialized-variable-warning-in-btrfs_up.patch
btrfs-use-temporary-variable-for-space_info-in-btrfs.patch
+mtd-rawnand-meson-initialize-struct-with-zeroes.patch
+mtd-nand-mxic-ecc-fix-mxic_ecc_data_xfer_wait_for_co.patch
+swiotlb-fix-the-deadlock-in-swiotlb_do_find_slots.patch
+ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch
+riscv-kvm-fix-vm-hang-in-case-of-timer-delta-being-z.patch
+mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch
+alsa-usb-audio-fix-recursive-locking-at-xrun-during-.patch
+pci-dwc-fix-port_link_control-update-when-cdm-check-.patch
+swiotlb-fix-slot-alignment-checks.patch
+platform-x86-think-lmi-add-missing-type-attribute.patch
+platform-x86-think-lmi-use-correct-possible_values-d.patch
+platform-x86-think-lmi-only-display-possible_values-.patch
+platform-x86-think-lmi-add-possible_values-for-think.patch
+platform-surface-aggregator-add-missing-fwnode_handl.patch
+mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch
+sunrpc-fix-shutdown-of-nfs-tcp-client-socket.patch
+sfc-ef10-don-t-overwrite-offload-features-at-nic-res.patch
+scsi-megaraid_sas-fix-crash-after-a-double-completio.patch
+scsi-mpt3sas-don-t-print-sense-pool-info-twice.patch
+net-dsa-realtek-fix-out-of-bounds-access.patch
+ptp_qoriq-fix-memory-leak-in-probe.patch
+net-dsa-microchip-ksz8-fix-ksz8_fdb_dump.patch
+net-dsa-microchip-ksz8-fix-ksz8_fdb_dump-to-extract-.patch
+net-dsa-microchip-ksz8-fix-offset-for-the-timestamp-.patch
+net-dsa-microchip-ksz8-ksz8_fdb_dump-avoid-extractin.patch
+net-dsa-microchip-ksz8863_smi-fix-bulk-access.patch
+net-dsa-microchip-ksz8-fix-mdb-configuration-with-no.patch
+r8169-fix-rtl8168h-and-rtl8107e-rx-crc-error.patch
+regulator-handle-deferred-clk.patch
+net-net_failover-fix-txq-exceeding-warning.patch
+net-stmmac-don-t-reject-vlans-when-iff_promisc-is-se.patch
+drm-i915-tc-fix-the-icl-phy-ownership-check-in-tc-co.patch
+platform-x86-intel-pmc-alder-lake-pch-slp_s0_residen.patch
+can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch
+s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch
+acpi-bus-rework-system-level-device-notification-han.patch
+loop-loop_configure-send-uevents-for-partitions.patch
+net-mvpp2-classifier-flow-fix-fragmentation-flags.patch
+net-mvpp2-parser-fix-qinq.patch
+net-mvpp2-parser-fix-pppoe.patch
+smsc911x-avoid-phy-being-resumed-when-interface-is-n.patch
+ice-fix-ice_cfg_rdma_fltr-to-only-update-relevant-fi.patch
+ice-add-profile-conflict-check-for-avf-fdir.patch
+ice-fix-invalid-check-for-empty-list-in-ice_sched_as.patch
+alsa-ymfpci-create-card-with-device-managed-snd_devm.patch
+alsa-ymfpci-fix-bug_on-in-probe-function.patch
+net-ipa-compute-dma-pool-size-properly.patch
+i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch
+bnxt_en-fix-reporting-of-test-result-in-ethtool-self.patch
+bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch
+bnxt_en-add-missing-200g-link-speed-reporting.patch
+net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch
+net-ethernet-mtk_eth_soc-fix-flow-block-refcounting-.patch
+net-ethernet-mtk_eth_soc-add-missing-ppe-cache-flush.patch
--- /dev/null
+From 51c0b9abb89690238026903e183faf637c04acb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 09:34:17 +0100
+Subject: sfc: ef10: don't overwrite offload features at NIC reset
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Íñigo Huguet <ihuguet@redhat.com>
+
+[ Upstream commit ca4a80e4bb7e87daf33b27d2ab9e4f5311018a89 ]
+
+At NIC reset, some offload features related to encapsulated traffic
+might have changed (this mainly happens if the firmware-variant is
+changed with the sfboot userspace tool). Because of this, features are
+checked and set again at reset time.
+
+However, this was not done right, and some features were improperly
+overwritten at NIC reset:
+- Tunneled IPv6 segmentation was always disabled
+- Features disabled with ethtool were reenabled
+- Features that becomes unsupported after the reset were not disabled
+
+Also, checking if the device supports IPV6_CSUM to enable TSO6 is no
+longer necessary because all currently supported devices support it.
+Additionally, move the assignment of some other features to the
+EF10_OFFLOAD_FEATURES macro, like it is done in ef100, leaving the
+selection of features in efx_pci_probe_post_io a bit cleaner.
+
+Fixes: ffffd2454a7a ("sfc: correctly advertise tunneled IPv6 segmentation")
+Fixes: 24b2c3751aa3 ("sfc: advertise encapsulated offloads on EF10")
+Reported-by: Tianhao Zhao <tizhao@redhat.com>
+Suggested-by: Jonathan Cooper <jonathan.s.cooper@amd.com>
+Tested-by: Jonathan Cooper <jonathan.s.cooper@amd.com>
+Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
+Acked-by: Edward Cree <ecree.xilinx@gmail.com>
+Link: https://lore.kernel.org/r/20230323083417.7345-1-ihuguet@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 38 ++++++++++++++++++++++-----------
+ drivers/net/ethernet/sfc/efx.c | 17 ++++++---------
+ 2 files changed, 33 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index 7022fb2005a2f..d30459dbfe8f8 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -1304,7 +1304,8 @@ static void efx_ef10_fini_nic(struct efx_nic *efx)
+ static int efx_ef10_init_nic(struct efx_nic *efx)
+ {
+ struct efx_ef10_nic_data *nic_data = efx->nic_data;
+- netdev_features_t hw_enc_features = 0;
++ struct net_device *net_dev = efx->net_dev;
++ netdev_features_t tun_feats, tso_feats;
+ int rc;
+
+ if (nic_data->must_check_datapath_caps) {
+@@ -1349,20 +1350,30 @@ static int efx_ef10_init_nic(struct efx_nic *efx)
+ nic_data->must_restore_piobufs = false;
+ }
+
+- /* add encapsulated checksum offload features */
++ /* encap features might change during reset if fw variant changed */
+ if (efx_has_cap(efx, VXLAN_NVGRE) && !efx_ef10_is_vf(efx))
+- hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+- /* add encapsulated TSO features */
+- if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) {
+- netdev_features_t encap_tso_features;
++ net_dev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
++ else
++ net_dev->hw_enc_features &= ~(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM);
+
+- encap_tso_features = NETIF_F_GSO_UDP_TUNNEL | NETIF_F_GSO_GRE |
+- NETIF_F_GSO_UDP_TUNNEL_CSUM | NETIF_F_GSO_GRE_CSUM;
++ tun_feats = NETIF_F_GSO_UDP_TUNNEL | NETIF_F_GSO_GRE |
++ NETIF_F_GSO_UDP_TUNNEL_CSUM | NETIF_F_GSO_GRE_CSUM;
++ tso_feats = NETIF_F_TSO | NETIF_F_TSO6;
+
+- hw_enc_features |= encap_tso_features | NETIF_F_TSO;
+- efx->net_dev->features |= encap_tso_features;
++ if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) {
++ /* If this is first nic_init, or if it is a reset and a new fw
++ * variant has added new features, enable them by default.
++ * If the features are not new, maintain their current value.
++ */
++ if (!(net_dev->hw_features & tun_feats))
++ net_dev->features |= tun_feats;
++ net_dev->hw_enc_features |= tun_feats | tso_feats;
++ net_dev->hw_features |= tun_feats;
++ } else {
++ net_dev->hw_enc_features &= ~(tun_feats | tso_feats);
++ net_dev->hw_features &= ~tun_feats;
++ net_dev->features &= ~tun_feats;
+ }
+- efx->net_dev->hw_enc_features = hw_enc_features;
+
+ /* don't fail init if RSS setup doesn't work */
+ rc = efx->type->rx_push_rss_config(efx, false,
+@@ -4021,7 +4032,10 @@ static unsigned int efx_ef10_recycle_ring_size(const struct efx_nic *efx)
+ NETIF_F_HW_VLAN_CTAG_FILTER | \
+ NETIF_F_IPV6_CSUM | \
+ NETIF_F_RXHASH | \
+- NETIF_F_NTUPLE)
++ NETIF_F_NTUPLE | \
++ NETIF_F_SG | \
++ NETIF_F_RXCSUM | \
++ NETIF_F_RXALL)
+
+ const struct efx_nic_type efx_hunt_a0_vf_nic_type = {
+ .is_vf = true,
+diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
+index 3a86f1213a051..6a1bff54bc6c3 100644
+--- a/drivers/net/ethernet/sfc/efx.c
++++ b/drivers/net/ethernet/sfc/efx.c
+@@ -1001,21 +1001,18 @@ static int efx_pci_probe_post_io(struct efx_nic *efx)
+ }
+
+ /* Determine netdevice features */
+- net_dev->features |= (efx->type->offload_features | NETIF_F_SG |
+- NETIF_F_TSO | NETIF_F_RXCSUM | NETIF_F_RXALL);
+- if (efx->type->offload_features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM)) {
+- net_dev->features |= NETIF_F_TSO6;
+- if (efx_has_cap(efx, TX_TSO_V2_ENCAP))
+- net_dev->hw_enc_features |= NETIF_F_TSO6;
+- }
+- /* Check whether device supports TSO */
+- if (!efx->type->tso_versions || !efx->type->tso_versions(efx))
+- net_dev->features &= ~NETIF_F_ALL_TSO;
++ net_dev->features |= efx->type->offload_features;
++
++ /* Add TSO features */
++ if (efx->type->tso_versions && efx->type->tso_versions(efx))
++ net_dev->features |= NETIF_F_TSO | NETIF_F_TSO6;
++
+ /* Mask for features that also apply to VLAN devices */
+ net_dev->vlan_features |= (NETIF_F_HW_CSUM | NETIF_F_SG |
+ NETIF_F_HIGHDMA | NETIF_F_ALL_TSO |
+ NETIF_F_RXCSUM);
+
++ /* Determine user configurable features */
+ net_dev->hw_features |= net_dev->features & ~efx->fixed_features;
+
+ /* Disable receiving frames with bad FCS, by default. */
+--
+2.39.2
+
--- /dev/null
+From 60facf69dd3d0888c3fbe28a7d9f68512407f0d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Mar 2023 10:31:38 +0200
+Subject: smsc911x: avoid PHY being resumed when interface is not up
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit f22c993f31fa9615df46e49cd768b713d39a852f ]
+
+SMSC911x doesn't need mdiobus suspend/resume, that's why it sets
+'mac_managed_pm'. However, setting it needs to be moved from init to
+probe, so mdiobus PM functions will really never be called (e.g. when
+the interface is not up yet during suspend/resume).
+
+Fixes: 3ce9f2bef755 ("net: smsc911x: Stop and start PHY during suspend and resume")
+Suggested-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230327083138.6044-1-wsa+renesas@sang-engineering.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/smsc/smsc911x.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index a2e511912e6a9..a690d139e1770 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -1037,8 +1037,6 @@ static int smsc911x_mii_probe(struct net_device *dev)
+ return ret;
+ }
+
+- /* Indicate that the MAC is responsible for managing PHY PM */
+- phydev->mac_managed_pm = true;
+ phy_attached_info(phydev);
+
+ phy_set_max_speed(phydev, SPEED_100);
+@@ -1066,6 +1064,7 @@ static int smsc911x_mii_init(struct platform_device *pdev,
+ struct net_device *dev)
+ {
+ struct smsc911x_data *pdata = netdev_priv(dev);
++ struct phy_device *phydev;
+ int err = -ENXIO;
+
+ pdata->mii_bus = mdiobus_alloc();
+@@ -1108,6 +1107,10 @@ static int smsc911x_mii_init(struct platform_device *pdev,
+ goto err_out_free_bus_2;
+ }
+
++ phydev = phy_find_first(pdata->mii_bus);
++ if (phydev)
++ phydev->mac_managed_pm = true;
++
+ return 0;
+
+ err_out_free_bus_2:
+--
+2.39.2
+
--- /dev/null
+From a1979014c94f8adee2c4531f3835439b56f0d6da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 20:37:40 +0000
+Subject: SUNRPC: fix shutdown of NFS TCP client socket
+
+From: Siddharth Kawar <Siddharth.Kawar@microsoft.com>
+
+[ Upstream commit 943d045a6d796175e5d08f9973953b1d2c07d797 ]
+
+NFS server Duplicate Request Cache (DRC) algorithms rely on NFS clients
+reconnecting using the same local TCP port. Unique NFS operations are
+identified by the per-TCP connection set of XIDs. This prevents file
+corruption when non-idempotent NFS operations are retried.
+
+Currently, NFS client TCP connections are using different local TCP ports
+when reconnecting to NFS servers.
+
+After an NFS server initiates shutdown of the TCP connection, the NFS
+client's TCP socket is set to NULL after the socket state has reached
+TCP_LAST_ACK(9). When reconnecting, the new socket attempts to reuse
+the same local port but fails with EADDRNOTAVAIL (99). This forces the
+socket to use a different local TCP port to reconnect to the remote NFS
+server.
+
+State Transition and Events:
+TCP_CLOSE_WAIT(8)
+TCP_LAST_ACK(9)
+connect(fail EADDRNOTAVAIL(99))
+TCP_CLOSE(7)
+bind on new port
+connect success
+
+dmesg excerpts showing reconnect switching from TCP local port of 926 to
+763 after commit 7c81e6a9d75b:
+[13354.947854] NFS call mkdir testW
+...
+[13405.654781] RPC: xs_tcp_state_change client 00000000037d0f03...
+[13405.654813] RPC: state 8 conn 1 dead 0 zapped 1 sk_shutdown 1
+[13405.654826] RPC: xs_data_ready...
+[13405.654892] RPC: xs_tcp_state_change client 00000000037d0f03...
+[13405.654895] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3
+[13405.654899] RPC: xs_tcp_state_change client 00000000037d0f03...
+[13405.654900] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3
+[13405.654950] RPC: xs_connect scheduled xprt 00000000037d0f03
+[13405.654975] RPC: xs_bind 0.0.0.0:926: ok (0)
+[13405.654980] RPC: worker connecting xprt 00000000037d0f03 via tcp
+ to 10.101.6.228 (port 2049)
+[13405.654991] RPC: 00000000037d0f03 connect status 99 connected 0
+ sock state 7
+[13405.655001] RPC: xs_tcp_state_change client 00000000037d0f03...
+[13405.655002] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3
+[13405.655024] RPC: xs_connect scheduled xprt 00000000037d0f03
+[13405.655038] RPC: xs_bind 0.0.0.0:763: ok (0)
+[13405.655041] RPC: worker connecting xprt 00000000037d0f03 via tcp
+ to 10.101.6.228 (port 2049)
+[13405.655065] RPC: 00000000037d0f03 connect status 115 connected 0
+ sock state 2
+
+State Transition and Events with patch applied:
+TCP_CLOSE_WAIT(8)
+TCP_LAST_ACK(9)
+TCP_CLOSE(7)
+connect(reuse of port succeeds)
+
+dmesg excerpts showing reconnect on same TCP local port of 936 with patch
+applied:
+[ 257.139935] NFS: mkdir(0:59/560857152), testQ
+[ 257.139937] NFS call mkdir testQ
+...
+[ 307.822702] RPC: state 8 conn 1 dead 0 zapped 1 sk_shutdown 1
+[ 307.822714] RPC: xs_data_ready...
+[ 307.822817] RPC: xs_tcp_state_change client 00000000ce702f14...
+[ 307.822821] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3
+[ 307.822825] RPC: xs_tcp_state_change client 00000000ce702f14...
+[ 307.822826] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3
+[ 307.823606] RPC: xs_tcp_state_change client 00000000ce702f14...
+[ 307.823609] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3
+[ 307.823629] RPC: xs_tcp_state_change client 00000000ce702f14...
+[ 307.823632] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3
+[ 307.823676] RPC: xs_connect scheduled xprt 00000000ce702f14
+[ 307.823704] RPC: xs_bind 0.0.0.0:936: ok (0)
+[ 307.823709] RPC: worker connecting xprt 00000000ce702f14 via tcp
+ to 10.101.1.30 (port 2049)
+[ 307.823748] RPC: 00000000ce702f14 connect status 115 connected 0
+ sock state 2
+...
+[ 314.916193] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3
+[ 314.916251] RPC: xs_connect scheduled xprt 00000000ce702f14
+[ 314.916282] RPC: xs_bind 0.0.0.0:936: ok (0)
+[ 314.916292] RPC: worker connecting xprt 00000000ce702f14 via tcp
+ to 10.101.1.30 (port 2049)
+[ 314.916342] RPC: 00000000ce702f14 connect status 115 connected 0
+ sock state 2
+
+Fixes: 7c81e6a9d75b ("SUNRPC: Tweak TCP socket shutdown in the RPC client")
+Signed-off-by: Siddharth Rajendra Kawar <sikawar@microsoft.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtsock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index b3ab6d9d752ea..05aa32696e7c2 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2153,6 +2153,7 @@ static void xs_tcp_shutdown(struct rpc_xprt *xprt)
+ switch (skst) {
+ case TCP_FIN_WAIT1:
+ case TCP_FIN_WAIT2:
++ case TCP_LAST_ACK:
+ break;
+ case TCP_ESTABLISHED:
+ case TCP_CLOSE_WAIT:
+--
+2.39.2
+
--- /dev/null
+From 6b19ccf221a13a2afa961c8ffffd7472127e69bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 09:31:27 +0100
+Subject: swiotlb: fix slot alignment checks
+
+From: Petr Tesarik <petr.tesarik.ext@huawei.com>
+
+[ Upstream commit 0eee5ae1025699ea93d44fdb6ef2365505082103 ]
+
+Explicit alignment and page alignment are used only to calculate
+the stride, not when checking actual slot physical address.
+
+Originally, only page alignment was implemented, and that worked,
+because the whole SWIOTLB is allocated on a page boundary, so
+aligning the start index was sufficient to ensure a page-aligned
+slot.
+
+When commit 1f221a0d0dbf ("swiotlb: respect min_align_mask") added
+support for min_align_mask, the index could be incremented in the
+search loop, potentially finding an unaligned slot if minimum device
+alignment is between IO_TLB_SIZE and PAGE_SIZE. The bug could go
+unnoticed, because the slot size is 2 KiB, and the most common page
+size is 4 KiB, so there is no alignment value in between.
+
+IIUC the intention has been to find a slot that conforms to all
+alignment constraints: device minimum alignment, an explicit
+alignment (given as function parameter) and optionally page
+alignment (if allocation size is >= PAGE_SIZE). The most
+restrictive mask can be trivially computed with logical AND. The
+rest can stay.
+
+Fixes: 1f221a0d0dbf ("swiotlb: respect min_align_mask")
+Fixes: e81e99bacc9f ("swiotlb: Support aligned swiotlb buffers")
+Signed-off-by: Petr Tesarik <petr.tesarik.ext@huawei.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/swiotlb.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
+index 1ecd0d1f7231a..eeb5695c3f286 100644
+--- a/kernel/dma/swiotlb.c
++++ b/kernel/dma/swiotlb.c
+@@ -626,22 +626,26 @@ static int swiotlb_do_find_slots(struct device *dev, int area_index,
+ BUG_ON(!nslots);
+ BUG_ON(area_index >= mem->nareas);
+
++ /*
++ * For allocations of PAGE_SIZE or larger only look for page aligned
++ * allocations.
++ */
++ if (alloc_size >= PAGE_SIZE)
++ iotlb_align_mask &= PAGE_MASK;
++ iotlb_align_mask &= alloc_align_mask;
++
+ /*
+ * For mappings with an alignment requirement don't bother looping to
+- * unaligned slots once we found an aligned one. For allocations of
+- * PAGE_SIZE or larger only look for page aligned allocations.
++ * unaligned slots once we found an aligned one.
+ */
+ stride = (iotlb_align_mask >> IO_TLB_SHIFT) + 1;
+- if (alloc_size >= PAGE_SIZE)
+- stride = max(stride, stride << (PAGE_SHIFT - IO_TLB_SHIFT));
+- stride = max(stride, (alloc_align_mask >> IO_TLB_SHIFT) + 1);
+
+ spin_lock_irqsave(&area->lock, flags);
+ if (unlikely(nslots > mem->area_nslabs - area->used))
+ goto not_found;
+
+ slot_base = area_index * mem->area_nslabs;
+- index = wrap_area_index(mem, ALIGN(area->index, stride));
++ index = area->index;
+
+ for (slots_checked = 0; slots_checked < mem->area_nslabs; ) {
+ slot_index = slot_base + index;
+--
+2.39.2
+
--- /dev/null
+From 9466c1da4cf8169876da5c26c0e31427150d91cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Feb 2023 00:53:15 +0800
+Subject: swiotlb: fix the deadlock in swiotlb_do_find_slots
+
+From: GuoRui.Yu <GuoRui.Yu@linux.alibaba.com>
+
+[ Upstream commit 7c3940bf81e5664cdb50c3fedfec8f0a756a34fb ]
+
+In general, if swiotlb is sufficient, the logic of index =
+wrap_area_index(mem, index + 1) is fine, it will quickly take a slot and
+release the area->lock; But if swiotlb is insufficient and the device
+has min_align_mask requirements, such as NVME, we may not be able to
+satisfy index == wrap and exit the loop properly. In this case, other
+kernel threads will not be able to acquire the area->lock and release
+the slot, resulting in a deadlock.
+
+The current implementation of wrap_area_index does not involve a modulo
+operation, so adjusting the wrap to ensure the loop ends is not trivial.
+Introduce a new variable to record the number of loops and exit the loop
+after completing the traversal.
+
+Backtraces:
+Other CPUs are waiting this core to exit the swiotlb_do_find_slots
+loop.
+[10199.924391] RIP: 0010:swiotlb_do_find_slots+0x1fe/0x3e0
+[10199.924403] Call Trace:
+[10199.924404] <TASK>
+[10199.924405] swiotlb_tbl_map_single+0xec/0x1f0
+[10199.924407] swiotlb_map+0x5c/0x260
+[10199.924409] ? nvme_pci_setup_prps+0x1ed/0x340
+[10199.924411] dma_direct_map_page+0x12e/0x1c0
+[10199.924413] nvme_map_data+0x304/0x370
+[10199.924415] nvme_prep_rq.part.0+0x31/0x120
+[10199.924417] nvme_queue_rq+0x77/0x1f0
+
+...
+[ 9639.596311] NMI backtrace for cpu 48
+[ 9639.596336] Call Trace:
+[ 9639.596337]
+[ 9639.596338] _raw_spin_lock_irqsave+0x37/0x40
+[ 9639.596341] swiotlb_do_find_slots+0xef/0x3e0
+[ 9639.596344] swiotlb_tbl_map_single+0xec/0x1f0
+[ 9639.596347] swiotlb_map+0x5c/0x260
+[ 9639.596349] dma_direct_map_sg+0x7a/0x280
+[ 9639.596352] __dma_map_sg_attrs+0x30/0x70
+[ 9639.596355] dma_map_sgtable+0x1d/0x30
+[ 9639.596356] nvme_map_data+0xce/0x370
+
+...
+[ 9639.595665] NMI backtrace for cpu 50
+[ 9639.595682] Call Trace:
+[ 9639.595682]
+[ 9639.595683] _raw_spin_lock_irqsave+0x37/0x40
+[ 9639.595686] swiotlb_release_slots.isra.0+0x86/0x180
+[ 9639.595688] dma_direct_unmap_sg+0xcf/0x1a0
+[ 9639.595690] nvme_unmap_data.part.0+0x43/0xc0
+
+Fixes: 1f221a0d0dbf ("swiotlb: respect min_align_mask")
+Signed-off-by: GuoRui.Yu <GuoRui.Yu@linux.alibaba.com>
+Signed-off-by: Xiaokang Hu <xiaokang.hxk@alibaba-inc.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/swiotlb.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
+index 339a990554e7f..1ecd0d1f7231a 100644
+--- a/kernel/dma/swiotlb.c
++++ b/kernel/dma/swiotlb.c
+@@ -617,8 +617,8 @@ static int swiotlb_do_find_slots(struct device *dev, int area_index,
+ unsigned int iotlb_align_mask =
+ dma_get_min_align_mask(dev) & ~(IO_TLB_SIZE - 1);
+ unsigned int nslots = nr_slots(alloc_size), stride;
+- unsigned int index, wrap, count = 0, i;
+ unsigned int offset = swiotlb_align_offset(dev, orig_addr);
++ unsigned int index, slots_checked, count = 0, i;
+ unsigned long flags;
+ unsigned int slot_base;
+ unsigned int slot_index;
+@@ -641,15 +641,16 @@ static int swiotlb_do_find_slots(struct device *dev, int area_index,
+ goto not_found;
+
+ slot_base = area_index * mem->area_nslabs;
+- index = wrap = wrap_area_index(mem, ALIGN(area->index, stride));
++ index = wrap_area_index(mem, ALIGN(area->index, stride));
+
+- do {
++ for (slots_checked = 0; slots_checked < mem->area_nslabs; ) {
+ slot_index = slot_base + index;
+
+ if (orig_addr &&
+ (slot_addr(tbl_dma_addr, slot_index) &
+ iotlb_align_mask) != (orig_addr & iotlb_align_mask)) {
+ index = wrap_area_index(mem, index + 1);
++ slots_checked++;
+ continue;
+ }
+
+@@ -665,7 +666,8 @@ static int swiotlb_do_find_slots(struct device *dev, int area_index,
+ goto found;
+ }
+ index = wrap_area_index(mem, index + stride);
+- } while (index != wrap);
++ slots_checked += stride;
++ }
+
+ not_found:
+ spin_unlock_irqrestore(&area->lock, flags);
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
