--- /dev/null
+From 09f69fb87049253d8ebd0e224e5d40102e866ae6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 May 2023 13:28:57 -0700
+Subject: af_packet: Don't send zero-byte data in packet_sendmsg_spkt().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 6a341729fb31b4c5df9f74f24b4b1c98410c9b87 ]
+
+syzkaller reported a warning below [0].
+
+We can reproduce it by sending 0-byte data from the (AF_PACKET,
+SOCK_PACKET) socket via some devices whose dev->hard_header_len
+is 0.
+
+ struct sockaddr_pkt addr = {
+ .spkt_family = AF_PACKET,
+ .spkt_device = "tun0",
+ };
+ int fd;
+
+ fd = socket(AF_PACKET, SOCK_PACKET, 0);
+ sendto(fd, NULL, 0, 0, (struct sockaddr *)&addr, sizeof(addr));
+
+We have a similar fix for the (AF_PACKET, SOCK_RAW) socket as
+commit dc633700f00f ("net/af_packet: check len when min_header_len
+equals to 0").
+
+Let's add the same test for the SOCK_PACKET socket.
+
+[0]:
+skb_assert_len
+WARNING: CPU: 1 PID: 19945 at include/linux/skbuff.h:2552 skb_assert_len include/linux/skbuff.h:2552 [inline]
+WARNING: CPU: 1 PID: 19945 at include/linux/skbuff.h:2552 __dev_queue_xmit+0x1f26/0x31d0 net/core/dev.c:4159
+Modules linked in:
+CPU: 1 PID: 19945 Comm: syz-executor.0 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
+RIP: 0010:skb_assert_len include/linux/skbuff.h:2552 [inline]
+RIP: 0010:__dev_queue_xmit+0x1f26/0x31d0 net/core/dev.c:4159
+Code: 89 de e8 1d a2 85 fd 84 db 75 21 e8 64 a9 85 fd 48 c7 c6 80 2a 1f 86 48 c7 c7 c0 06 1f 86 c6 05 23 cf 27 04 01 e8 fa ee 56 fd <0f> 0b e8 43 a9 85 fd 0f b6 1d 0f cf 27 04 31 ff 89 de e8 e3 a1 85
+RSP: 0018:ffff8880217af6e0 EFLAGS: 00010282
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90001133000
+RDX: 0000000000040000 RSI: ffffffff81186922 RDI: 0000000000000001
+RBP: ffff8880217af8b0 R08: 0000000000000001 R09: 0000000000000000
+R10: 0000000000000001 R11: 0000000000000001 R12: ffff888030045640
+R13: ffff8880300456b0 R14: ffff888030045650 R15: ffff888030045718
+FS: 00007fc5864da640(0000) GS:ffff88806cd00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000020005740 CR3: 000000003f856003 CR4: 0000000000770ee0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+PKRU: 55555554
+Call Trace:
+ <TASK>
+ dev_queue_xmit include/linux/netdevice.h:3085 [inline]
+ packet_sendmsg_spkt+0xc4b/0x1230 net/packet/af_packet.c:2066
+ sock_sendmsg_nosec net/socket.c:724 [inline]
+ sock_sendmsg+0x1b4/0x200 net/socket.c:747
+ ____sys_sendmsg+0x331/0x970 net/socket.c:2503
+ ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2557
+ __sys_sendmmsg+0x18c/0x430 net/socket.c:2643
+ __do_sys_sendmmsg net/socket.c:2672 [inline]
+ __se_sys_sendmmsg net/socket.c:2669 [inline]
+ __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2669
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3c/0x90 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x72/0xdc
+RIP: 0033:0x7fc58791de5d
+Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48
+RSP: 002b:00007fc5864d9cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
+RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007fc58791de5d
+RDX: 0000000000000001 RSI: 0000000020005740 RDI: 0000000000000004
+RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
+R13: 000000000000000b R14: 00007fc58797e530 R15: 0000000000000000
+ </TASK>
+---[ end trace 0000000000000000 ]---
+skb len=0 headroom=16 headlen=0 tailroom=304
+mac=(16,0) net=(16,-1) trans=-1
+shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0))
+csum(0x0 ip_summed=0 complete_sw=0 valid=0 level=0)
+hash(0x0 sw=0 l4=0) proto=0x0000 pkttype=0 iif=0
+dev name=sit0 feat=0x00000006401d7869
+sk family=17 type=10 proto=0
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index ecd9fc27e360c..b8c62d88567ba 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2034,7 +2034,7 @@ static int packet_sendmsg_spkt(struct socket *sock, struct msghdr *msg,
+ goto retry;
+ }
+
+- if (!dev_validate_header(dev, skb->data, len)) {
++ if (!dev_validate_header(dev, skb->data, len) || !skb->len) {
+ err = -EINVAL;
+ goto out_unlock;
+ }
+--
+2.39.2
+
--- /dev/null
+From 2b7eeab6889936987d241a577ec6bf005adb675f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 14:50:53 +0800
+Subject: ALSA: caiaq: input: Add error handling for unsupported input methods
+ in `snd_usb_caiaq_input_init`
+
+From: Ruliang Lin <u202112092@hust.edu.cn>
+
+[ Upstream commit 0d727e1856ef22dd9337199430258cb64cbbc658 ]
+
+Smatch complains that:
+snd_usb_caiaq_input_init() warn: missing error code 'ret'
+
+This patch adds a new case to handle the situation where the
+device does not support any input methods in the
+`snd_usb_caiaq_input_init` function. It returns an `-EINVAL` error code
+to indicate that no input methods are supported on the device.
+
+Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
+Signed-off-by: Ruliang Lin <u202112092@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Acked-by: Daniel Mack <daniel@zonque.org>
+Link: https://lore.kernel.org/r/20230504065054.3309-1-u202112092@hust.edu.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/caiaq/input.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/usb/caiaq/input.c b/sound/usb/caiaq/input.c
+index 1e2cf2f08eecd..84f26dce7f5d0 100644
+--- a/sound/usb/caiaq/input.c
++++ b/sound/usb/caiaq/input.c
+@@ -804,6 +804,7 @@ int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev)
+
+ default:
+ /* no input methods supported on this device */
++ ret = -EINVAL;
+ goto exit_free_idev;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From d75419b0f1c660499cd48d451a7643d7c522051c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 15:27:00 +0530
+Subject: arm64: Fix label placement in record_mmu_state()
+
+From: Neeraj Upadhyay <quic_neeraju@quicinc.com>
+
+[ Upstream commit 4e8f6e44bce8da3b0e2df37b12839f4bc9c9cabe ]
+
+Fix label so that pre_disable_mmu_workaround() is called
+before clearing sctlr_el1.M.
+
+Fixes: 2ced0f30a426 ("arm64: head: Switch endianness before populating the ID map")
+Signed-off-by: Neeraj Upadhyay <quic_neeraju@quicinc.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Link: https://lore.kernel.org/r/20230425095700.22005-1-quic_neeraju@quicinc.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/head.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index b98970907226b..e92caebff46a0 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -150,8 +150,8 @@ CPU_BE( tbz x19, #SCTLR_ELx_EE_SHIFT, 1f )
+ pre_disable_mmu_workaround
+ msr sctlr_el2, x19
+ b 3f
+- pre_disable_mmu_workaround
+-2: msr sctlr_el1, x19
++2: pre_disable_mmu_workaround
++ msr sctlr_el1, x19
+ 3: isb
+ mov x19, xzr
+ ret
+--
+2.39.2
+
--- /dev/null
+From 6f4e50e52acf3e42e810b20e03fc1d5c9677b1ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 11:28:17 -0700
+Subject: arm64: kernel: remove SHF_WRITE|SHF_EXECINSTR from .idmap.text
+
+From: ndesaulniers@google.com <ndesaulniers@google.com>
+
+[ Upstream commit 4df69e0df295822cdf816442fe4897f214cccb08 ]
+
+commit d54170812ef1 ("arm64: fix .idmap.text assertion for large kernels")
+modified some of the section assembler directives that declare
+.idmap.text to be SHF_ALLOC instead of
+SHF_ALLOC|SHF_WRITE|SHF_EXECINSTR.
+
+This patch fixes up the remaining stragglers that were left behind. Add
+Fixes tag so that this doesn't precede related change in stable.
+
+Fixes: d54170812ef1 ("arm64: fix .idmap.text assertion for large kernels")
+Reported-by: Greg Thelen <gthelen@google.com>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Link: https://lore.kernel.org/r/20230428-awx-v2-1-b197ffa16edc@google.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/cpu-reset.S | 2 +-
+ arch/arm64/kernel/sleep.S | 2 +-
+ arch/arm64/mm/proc.S | 6 +++---
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/kernel/cpu-reset.S b/arch/arm64/kernel/cpu-reset.S
+index 6b752fe897451..c87445dde6745 100644
+--- a/arch/arm64/kernel/cpu-reset.S
++++ b/arch/arm64/kernel/cpu-reset.S
+@@ -14,7 +14,7 @@
+ #include <asm/virt.h>
+
+ .text
+-.pushsection .idmap.text, "awx"
++.pushsection .idmap.text, "a"
+
+ /*
+ * cpu_soft_restart(el2_switch, entry, arg0, arg1, arg2)
+diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S
+index 2ae7cff1953aa..2aa5129d82537 100644
+--- a/arch/arm64/kernel/sleep.S
++++ b/arch/arm64/kernel/sleep.S
+@@ -97,7 +97,7 @@ SYM_FUNC_START(__cpu_suspend_enter)
+ ret
+ SYM_FUNC_END(__cpu_suspend_enter)
+
+- .pushsection ".idmap.text", "awx"
++ .pushsection ".idmap.text", "a"
+ SYM_CODE_START(cpu_resume)
+ mov x0, xzr
+ bl init_kernel_el
+diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
+index 91410f4880900..c2cb437821ca4 100644
+--- a/arch/arm64/mm/proc.S
++++ b/arch/arm64/mm/proc.S
+@@ -167,7 +167,7 @@ alternative_else_nop_endif
+ SYM_FUNC_END(cpu_do_resume)
+ #endif
+
+- .pushsection ".idmap.text", "awx"
++ .pushsection ".idmap.text", "a"
+
+ .macro __idmap_cpu_set_reserved_ttbr1, tmp1, tmp2
+ adrp \tmp1, reserved_pg_dir
+@@ -201,7 +201,7 @@ SYM_FUNC_END(idmap_cpu_replace_ttbr1)
+
+ #define KPTI_NG_PTE_FLAGS (PTE_ATTRINDX(MT_NORMAL) | SWAPPER_PTE_FLAGS)
+
+- .pushsection ".idmap.text", "awx"
++ .pushsection ".idmap.text", "a"
+
+ .macro kpti_mk_tbl_ng, type, num_entries
+ add end_\type\()p, cur_\type\()p, #\num_entries * 8
+@@ -400,7 +400,7 @@ SYM_FUNC_END(idmap_kpti_install_ng_mappings)
+ * Output:
+ * Return in x0 the value of the SCTLR_EL1 register.
+ */
+- .pushsection ".idmap.text", "awx"
++ .pushsection ".idmap.text", "a"
+ SYM_FUNC_START(__cpu_setup)
+ tlbi vmalle1 // Invalidate local TLB
+ dsb nsh
+--
+2.39.2
+
--- /dev/null
+From b0293de3c0347c42918e3365a20f6b71191c6c95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 20:37:14 +0200
+Subject: ASoC: Intel: soc-acpi-byt: Fix "WM510205" match no longer working
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit c963e2ec095cb3f855890be53f56f5a6c6fbe371 ]
+
+Commit 7e1d728a94ca ("ASoC: Intel: soc-acpi-byt: Add new WM5102 ACPI HID")
+added an extra HID to wm5102_comp_ids.codecs, but it forgot to bump
+wm5102_comp_ids.num_codecs, causing the last codec HID in the codecs list
+to no longer work.
+
+Bump wm5102_comp_ids.num_codecs to fix this.
+
+Fixes: 7e1d728a94ca ("ASoC: Intel: soc-acpi-byt: Add new WM5102 ACPI HID")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230421183714.35186-1-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/common/soc-acpi-intel-byt-match.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-byt-match.c b/sound/soc/intel/common/soc-acpi-intel-byt-match.c
+index db5a92b9875a8..87c44f284971a 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-byt-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-byt-match.c
+@@ -124,7 +124,7 @@ static const struct snd_soc_acpi_codecs rt5640_comp_ids = {
+ };
+
+ static const struct snd_soc_acpi_codecs wm5102_comp_ids = {
+- .num_codecs = 2,
++ .num_codecs = 3,
+ .codecs = { "10WM5102", "WM510204", "WM510205"},
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 435b207486d671fc8b688a50ea542ad97ab52279 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 12:51:49 +0800
+Subject: block: Skip destroyed blkg when restart in blkg_destroy_all()
+
+From: Tao Su <tao1.su@linux.intel.com>
+
+[ Upstream commit 8176080d59e6d4ff9fc97ae534063073b4f7a715 ]
+
+Kernel hang in blkg_destroy_all() when total blkg greater than
+BLKG_DESTROY_BATCH_SIZE, because of not removing destroyed blkg in
+blkg_list. So the size of blkg_list is same after destroying a
+batch of blkg, and the infinite 'restart' occurs.
+
+Since blkg should stay on the queue list until blkg_free_workfn(),
+skip destroyed blkg when restart a new round, which will solve this
+kernel hang issue and satisfy the previous will to restart.
+
+Reported-by: Xiangfei Ma <xiangfeix.ma@intel.com>
+Tested-by: Xiangfei Ma <xiangfeix.ma@intel.com>
+Tested-by: Farrah Chen <farrah.chen@intel.com>
+Signed-off-by: Tao Su <tao1.su@linux.intel.com>
+Fixes: f1c006f1c685 ("blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()")
+Suggested-and-reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20230428045149.1310073-1-tao1.su@linux.intel.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index bd50b55bdb613..75bad5d60c9f4 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -528,6 +528,9 @@ static void blkg_destroy_all(struct gendisk *disk)
+ list_for_each_entry_safe(blkg, n, &q->blkg_list, q_node) {
+ struct blkcg *blkcg = blkg->blkcg;
+
++ if (hlist_unhashed(&blkg->blkcg_node))
++ continue;
++
+ spin_lock(&blkcg->lock);
+ blkg_destroy(blkg);
+ spin_unlock(&blkcg->lock);
+--
+2.39.2
+
--- /dev/null
+From df21cb403758e9c9a3bbd05845df9c2d3b5f39bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 11:00:35 -0400
+Subject: crypto: engine - fix crypto_queue backlog handling
+
+From: Olivier Bacon <olivierb89@gmail.com>
+
+[ Upstream commit 4140aafcff167b5b9e8dae6a1709a6de7cac6f74 ]
+
+CRYPTO_TFM_REQ_MAY_BACKLOG tells the crypto driver that it should
+internally backlog requests until the crypto hw's queue becomes
+full. At that point, crypto_engine backlogs the request and returns
+-EBUSY. Calling driver such as dm-crypt then waits until the
+complete() function is called with a status of -EINPROGRESS before
+sending a new request.
+
+The problem lies in the call to complete() with a value of -EINPROGRESS
+that is made when a backlog item is present on the queue. The call is
+done before the successful execution of the crypto request. In the case
+that do_one_request() returns < 0 and the retry support is available,
+the request is put back in the queue. This leads upper drivers to send
+a new request even if the queue is still full.
+
+The problem can be reproduced by doing a large dd into a crypto
+dm-crypt device. This is pretty easy to see when using
+Freescale CAAM crypto driver and SWIOTLB dma. Since the actual amount
+of requests that can be hold in the queue is unlimited we get IOs error
+and dma allocation.
+
+The fix is to call complete with a value of -EINPROGRESS only if
+the request is not enqueued back in crypto_queue. This is done
+by calling complete() later in the code. In order to delay the decision,
+crypto_queue is modified to correctly set the backlog pointer
+when a request is enqueued back.
+
+Fixes: 6a89f492f8e5 ("crypto: engine - support for parallel requests based on retry mechanism")
+Co-developed-by: Sylvain Ouellet <souellet@genetec.com>
+Signed-off-by: Sylvain Ouellet <souellet@genetec.com>
+Signed-off-by: Olivier Bacon <obacon@genetec.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/algapi.c | 3 +++
+ crypto/crypto_engine.c | 6 +++---
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/crypto/algapi.c b/crypto/algapi.c
+index 9de0677b3643d..60b98d2c400e3 100644
+--- a/crypto/algapi.c
++++ b/crypto/algapi.c
+@@ -963,6 +963,9 @@ EXPORT_SYMBOL_GPL(crypto_enqueue_request);
+ void crypto_enqueue_request_head(struct crypto_queue *queue,
+ struct crypto_async_request *request)
+ {
++ if (unlikely(queue->qlen >= queue->max_qlen))
++ queue->backlog = queue->backlog->prev;
++
+ queue->qlen++;
+ list_add(&request->list, &queue->list);
+ }
+diff --git a/crypto/crypto_engine.c b/crypto/crypto_engine.c
+index 21f7916151145..74fcc08970411 100644
+--- a/crypto/crypto_engine.c
++++ b/crypto/crypto_engine.c
+@@ -129,9 +129,6 @@ static void crypto_pump_requests(struct crypto_engine *engine,
+ if (!engine->retry_support)
+ engine->cur_req = async_req;
+
+- if (backlog)
+- crypto_request_complete(backlog, -EINPROGRESS);
+-
+ if (engine->busy)
+ was_busy = true;
+ else
+@@ -217,6 +214,9 @@ static void crypto_pump_requests(struct crypto_engine *engine,
+ crypto_request_complete(async_req, ret);
+
+ retry:
++ if (backlog)
++ crypto_request_complete(backlog, -EINPROGRESS);
++
+ /* If retry mechanism is supported, send new requests to engine */
+ if (engine->retry_support) {
+ spin_lock_irqsave(&engine->queue_lock, flags);
+--
+2.39.2
+
--- /dev/null
+From 3a9307411835b05df967bf9a07ac59edd02ff132 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 22:25:09 +0200
+Subject: crypto: sun8i-ss - Fix a test in sun8i_ss_setup_ivs()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 8fd91151ebcb21b3f2f2bf158ac6092192550b2b ]
+
+SS_ENCRYPTION is (0 << 7 = 0), so the test can never be true.
+Use a direct comparison to SS_ENCRYPTION instead.
+
+The same king of test is already done the same way in sun8i_ss_run_task().
+
+Fixes: 359e893e8af4 ("crypto: sun8i-ss - rework handling of IV")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c
+index 83c6dfad77e1b..16966cc94e247 100644
+--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c
++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c
+@@ -151,7 +151,7 @@ static int sun8i_ss_setup_ivs(struct skcipher_request *areq)
+ }
+ rctx->p_iv[i] = a;
+ /* we need to setup all others IVs only in the decrypt way */
+- if (rctx->op_dir & SS_ENCRYPTION)
++ if (rctx->op_dir == SS_ENCRYPTION)
+ return 0;
+ todo = min(len, sg_dma_len(sg));
+ len -= todo;
+--
+2.39.2
+
--- /dev/null
+From 95b16325e16796309d94bc74f40a31657f346dd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 14:54:05 -0600
+Subject: drm/amd/display: Add missing WA and MCLK validation
+
+From: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+
+[ Upstream commit 822b84ecfc646da0f87fd947fa00dc3be5e45ecc ]
+
+When the commit fff7eb56b376 ("drm/amd/display: Don't set dram clock
+change requirement for SubVP") was merged, we missed some parts
+associated with the MCLK switch. This commit adds all the missing parts.
+
+Fixes: fff7eb56b376 ("drm/amd/display: Don't set dram clock change requirement for SubVP")
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 1 +
+ .../drm/amd/display/dc/dcn32/dcn32_resource.c | 2 +-
+ .../drm/amd/display/dc/dml/dcn30/dcn30_fpu.c | 18 +++++++++++++++++-
+ 3 files changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
+index 9d14045cccd63..eb51f5344436c 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
+@@ -912,6 +912,7 @@ void dcn32_init_hw(struct dc *dc)
+ if (dc->ctx->dmub_srv) {
+ dc_dmub_srv_query_caps_cmd(dc->ctx->dmub_srv->dmub);
+ dc->caps.dmub_caps.psr = dc->ctx->dmub_srv->dmub->feature_caps.psr;
++ dc->caps.dmub_caps.mclk_sw = dc->ctx->dmub_srv->dmub->feature_caps.fw_assisted_mclk_switch;
+ }
+ }
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c
+index 4b7abb4af6235..de19d26f4e134 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c
+@@ -2021,7 +2021,7 @@ int dcn32_populate_dml_pipes_from_context(
+ // In general cases we want to keep the dram clock change requirement
+ // (prefer configs that support MCLK switch). Only override to false
+ // for SubVP
+- if (subvp_in_use)
++ if (context->bw_ctx.bw.dcn.clk.fw_based_mclk_switching || subvp_in_use)
+ context->bw_ctx.dml.soc.dram_clock_change_requirement_final = false;
+ else
+ context->bw_ctx.dml.soc.dram_clock_change_requirement_final = true;
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn30/dcn30_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn30/dcn30_fpu.c
+index 4fa6363647937..fdfb19337ea6e 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn30/dcn30_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn30/dcn30_fpu.c
+@@ -368,7 +368,9 @@ void dcn30_fpu_update_soc_for_wm_a(struct dc *dc, struct dc_state *context)
+ dc_assert_fp_enabled();
+
+ if (dc->clk_mgr->bw_params->wm_table.nv_entries[WM_A].valid) {
+- context->bw_ctx.dml.soc.dram_clock_change_latency_us = dc->clk_mgr->bw_params->wm_table.nv_entries[WM_A].dml_input.pstate_latency_us;
++ if (!context->bw_ctx.bw.dcn.clk.fw_based_mclk_switching ||
++ context->bw_ctx.dml.soc.dram_clock_change_latency_us == 0)
++ context->bw_ctx.dml.soc.dram_clock_change_latency_us = dc->clk_mgr->bw_params->wm_table.nv_entries[WM_A].dml_input.pstate_latency_us;
+ context->bw_ctx.dml.soc.sr_enter_plus_exit_time_us = dc->clk_mgr->bw_params->wm_table.nv_entries[WM_A].dml_input.sr_enter_plus_exit_time_us;
+ context->bw_ctx.dml.soc.sr_exit_time_us = dc->clk_mgr->bw_params->wm_table.nv_entries[WM_A].dml_input.sr_exit_time_us;
+ }
+@@ -520,6 +522,20 @@ void dcn30_fpu_calculate_wm_and_dlg(
+ pipe_idx++;
+ }
+
++ // WA: restrict FPO to use first non-strobe mode (NV24 BW issue)
++ if (context->bw_ctx.bw.dcn.clk.fw_based_mclk_switching &&
++ dc->dml.soc.num_chans <= 4 &&
++ context->bw_ctx.dml.vba.DRAMSpeed <= 1700 &&
++ context->bw_ctx.dml.vba.DRAMSpeed >= 1500) {
++
++ for (i = 0; i < dc->dml.soc.num_states; i++) {
++ if (dc->dml.soc.clock_limits[i].dram_speed_mts > 1700) {
++ context->bw_ctx.dml.vba.DRAMSpeed = dc->dml.soc.clock_limits[i].dram_speed_mts;
++ break;
++ }
++ }
++ }
++
+ dcn20_calculate_dlg_params(dc, context, pipes, pipe_cnt, vlevel);
+
+ if (!pstate_en)
+--
+2.39.2
+
--- /dev/null
+From 14c2d59247e9f3853770a18c336e1acf16ca0603 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 15:48:48 -0400
+Subject: drm/amd/display: Do not clear GPINT register when releasing DMUB from
+ reset
+
+From: Aurabindo Pillai <aurabindo.pillai@amd.com>
+
+[ Upstream commit 99d92eaca5d915763b240aae24669f5bf3227ecf ]
+
+[Why & How]
+There's no need to clear GPINT register for DMUB
+when releasing it from reset. Fix that.
+
+Fixes: ac2e555e0a7f ("drm/amd/display: Add DMCUB source files and changes for DCN32/321")
+Reviewed-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c
+index b0adbf783aae9..9c20516be066c 100644
+--- a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c
++++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c
+@@ -137,7 +137,6 @@ void dmub_dcn32_reset(struct dmub_srv *dmub)
+
+ void dmub_dcn32_reset_release(struct dmub_srv *dmub)
+ {
+- REG_WRITE(DMCUB_GPINT_DATAIN1, 0);
+ REG_UPDATE(MMHUBBUB_SOFT_RESET, DMUIF_SOFT_RESET, 0);
+ REG_WRITE(DMCUB_SCRATCH15, dmub->psp_version & 0x001100FF);
+ REG_UPDATE_2(DMCUB_CNTL, DMCUB_ENABLE, 1, DMCUB_TRACEPORT_EN, 1);
+--
+2.39.2
+
--- /dev/null
+From 6330d479cf22cf37b629bfd10ab5623444413921 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 12:28:59 -0400
+Subject: drm/amd/display: Fixes for dcn32_clk_mgr implementation
+
+From: Aurabindo Pillai <aurabindo.pillai@amd.com>
+
+[ Upstream commit d1c5c3e252b8a911a524e6ee33b82aca81397745 ]
+
+[Why&How]
+Fix CLK MGR early initialization and add logging.
+
+Fixes: 265280b99822 ("drm/amd/display: add CLKMGR changes for DCN32/321")
+Reviewed-by: Leo Li <sunpeng.li@amd.com>
+Reviewed-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c
+index 61768bf726f8c..31ee81ebb4ea2 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c
+@@ -805,6 +805,8 @@ void dcn32_clk_mgr_construct(
+ struct pp_smu_funcs *pp_smu,
+ struct dccg *dccg)
+ {
++ struct clk_log_info log_info = {0};
++
+ clk_mgr->base.ctx = ctx;
+ clk_mgr->base.funcs = &dcn32_funcs;
+ if (ASICREV_IS_GC_11_0_2(clk_mgr->base.ctx->asic_id.hw_internal_rev)) {
+@@ -838,6 +840,7 @@ void dcn32_clk_mgr_construct(
+ clk_mgr->base.clks.ref_dtbclk_khz = 268750;
+ }
+
++
+ /* integer part is now VCO frequency in kHz */
+ clk_mgr->base.dentist_vco_freq_khz = dcn32_get_vco_frequency_from_reg(clk_mgr);
+
+@@ -845,6 +848,8 @@ void dcn32_clk_mgr_construct(
+ if (clk_mgr->base.dentist_vco_freq_khz == 0)
+ clk_mgr->base.dentist_vco_freq_khz = 4300000; /* Updated as per HW docs */
+
++ dcn32_dump_clk_registers(&clk_mgr->base.boot_snapshot, &clk_mgr->base, &log_info);
++
+ if (ctx->dc->debug.disable_dtb_ref_clk_switch &&
+ clk_mgr->base.clks.ref_dtbclk_khz != clk_mgr->base.boot_snapshot.dtbclk) {
+ clk_mgr->base.clks.ref_dtbclk_khz = clk_mgr->base.boot_snapshot.dtbclk;
+--
+2.39.2
+
--- /dev/null
+From 861cec8732d2fbc3da4b0bb3490a0dd9cd7ff78c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 May 2022 09:16:42 +0800
+Subject: drm/amd/display: Reset OUTBOX0 r/w pointer on DMUB reset
+
+From: Cruise Hung <Cruise.Hung@amd.com>
+
+[ Upstream commit 425afa0ac99a05b39e6cd00704fa0e3e925cee2b ]
+
+[Why & How]
+We missed resetting OUTBOX0 mailbox r/w pointer on DMUB reset.
+Fix it.
+
+Fixes: 6ecf9773a503 ("drm/amd/display: Fix DMUB outbox trace in S4 (#4465)")
+Signed-off-by: Cruise Hung <Cruise.Hung@amd.com>
+Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c
+index a76da0131addd..b0adbf783aae9 100644
+--- a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c
++++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c
+@@ -130,6 +130,8 @@ void dmub_dcn32_reset(struct dmub_srv *dmub)
+ REG_WRITE(DMCUB_INBOX1_WPTR, 0);
+ REG_WRITE(DMCUB_OUTBOX1_RPTR, 0);
+ REG_WRITE(DMCUB_OUTBOX1_WPTR, 0);
++ REG_WRITE(DMCUB_OUTBOX0_RPTR, 0);
++ REG_WRITE(DMCUB_OUTBOX0_WPTR, 0);
+ REG_WRITE(DMCUB_SCRATCH0, 0);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 858b531cad40abece0222565a974fe0e0bc73bbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 May 2022 10:54:30 -0400
+Subject: drm/amd/display: Return error code on DSC atomic check failure
+
+From: Hersen Wu <hersenxs.wu@amd.com>
+
+[ Upstream commit dd24662d9dfbad281bbf030f06d68c7938fa0c66 ]
+
+[Why&How]
+We were not returning -EINVAL on DSC atomic check fail. Add it.
+
+Fixes: 71be4b16d39a ("drm/amd/display: dsc validate fail not pass to atomic check")
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Hersen Wu <hersenxs.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 +
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 62af874f26e01..d486670e48c3e 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10150,6 +10150,7 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
+ ret = compute_mst_dsc_configs_for_state(state, dm_state->context, vars);
+ if (ret) {
+ DRM_DEBUG_DRIVER("compute_mst_dsc_configs_for_state() failed\n");
++ ret = -EINVAL;
+ goto fail;
+ }
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 8dc442f90eafa..d9191dd9d3cb2 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -1410,6 +1410,7 @@ int pre_validate_dsc(struct drm_atomic_state *state,
+ ret = pre_compute_mst_dsc_configs_for_state(state, local_dc_state, vars);
+ if (ret != 0) {
+ DRM_INFO_ONCE("pre_compute_mst_dsc_configs_for_state() failed\n");
++ ret = -EINVAL;
+ goto clean_exit;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 088bf982423b9fca117c3ee06b4b65bb3decf389 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 15:59:45 -0400
+Subject: drm/amd/display: Update bounding box values for DCN321
+
+From: Aurabindo Pillai <aurabindo.pillai@amd.com>
+
+[ Upstream commit 989cd3e76a4aab76fe7dd50090ac3fa501c537f6 ]
+
+[Why&how]
+
+Update bounding box values as per hardware spec
+
+Fixes: 197485c69543 ("drm/amd/display: Create dcn321_fpu file")
+Acked-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/dml/dcn321/dcn321_fpu.c | 24 +++++++++----------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
+index b80cef70fa60f..383a409a3f54c 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
+@@ -106,16 +106,16 @@ struct _vcs_dpi_soc_bounding_box_st dcn3_21_soc = {
+ .clock_limits = {
+ {
+ .state = 0,
+- .dcfclk_mhz = 1564.0,
+- .fabricclk_mhz = 400.0,
+- .dispclk_mhz = 2150.0,
+- .dppclk_mhz = 2150.0,
++ .dcfclk_mhz = 1434.0,
++ .fabricclk_mhz = 2250.0,
++ .dispclk_mhz = 1720.0,
++ .dppclk_mhz = 1720.0,
+ .phyclk_mhz = 810.0,
+ .phyclk_d18_mhz = 667.0,
+- .phyclk_d32_mhz = 625.0,
++ .phyclk_d32_mhz = 313.0,
+ .socclk_mhz = 1200.0,
+- .dscclk_mhz = 716.667,
+- .dram_speed_mts = 1600.0,
++ .dscclk_mhz = 573.333,
++ .dram_speed_mts = 16000.0,
+ .dtbclk_mhz = 1564.0,
+ },
+ },
+@@ -125,14 +125,14 @@ struct _vcs_dpi_soc_bounding_box_st dcn3_21_soc = {
+ .sr_exit_z8_time_us = 285.0,
+ .sr_enter_plus_exit_z8_time_us = 320,
+ .writeback_latency_us = 12.0,
+- .round_trip_ping_latency_dcfclk_cycles = 263,
++ .round_trip_ping_latency_dcfclk_cycles = 207,
+ .urgent_latency_pixel_data_only_us = 4,
+ .urgent_latency_pixel_mixed_with_vm_data_us = 4,
+ .urgent_latency_vm_data_only_us = 4,
+- .fclk_change_latency_us = 20,
+- .usr_retraining_latency_us = 2,
+- .smn_latency_us = 2,
+- .mall_allocated_for_dcn_mbytes = 64,
++ .fclk_change_latency_us = 7,
++ .usr_retraining_latency_us = 0,
++ .smn_latency_us = 0,
++ .mall_allocated_for_dcn_mbytes = 32,
+ .urgent_out_of_order_return_per_channel_pixel_only_bytes = 4096,
+ .urgent_out_of_order_return_per_channel_pixel_and_vm_bytes = 4096,
+ .urgent_out_of_order_return_per_channel_vm_only_bytes = 4096,
+--
+2.39.2
+
--- /dev/null
+From 5290a0ddfcdbf260d7574153d1593ab02736c368 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 15:54:55 -0700
+Subject: drm/amdgpu: add a missing lock for AMDGPU_SCHED
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chia-I Wu <olvaffe@gmail.com>
+
+[ Upstream commit 2397e3d8d2e120355201a8310b61929f5a8bd2c0 ]
+
+mgr->ctx_handles should be protected by mgr->lock.
+
+v2: improve commit message
+v3: add a Fixes tag
+
+Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Fixes: 52c6a62c64fa ("drm/amdgpu: add interface for editing a foreign process's priority v3")
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
+index e9b45089a28a6..863b2a34b2d64 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
+@@ -38,6 +38,7 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev,
+ {
+ struct fd f = fdget(fd);
+ struct amdgpu_fpriv *fpriv;
++ struct amdgpu_ctx_mgr *mgr;
+ struct amdgpu_ctx *ctx;
+ uint32_t id;
+ int r;
+@@ -51,8 +52,11 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev,
+ return r;
+ }
+
+- idr_for_each_entry(&fpriv->ctx_mgr.ctx_handles, ctx, id)
++ mgr = &fpriv->ctx_mgr;
++ mutex_lock(&mgr->lock);
++ idr_for_each_entry(&mgr->ctx_handles, ctx, id)
+ amdgpu_ctx_priority_override(ctx, priority);
++ mutex_unlock(&mgr->lock);
+
+ fdput(f);
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 9d951e83e7b47fa9886a8087bac9f742c0034ea8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 15:47:42 -0700
+Subject: drm/i915/guc: Actually return an error if GuC version range check
+ fails
+
+From: John Harrison <John.C.Harrison@Intel.com>
+
+[ Upstream commit 1816f4a17f54a01afa2f06d6571c39890b97d282 ]
+
+Dan Carpenter pointed out that 'err' was not being set in the case
+where the GuC firmware version range check fails. Fix that.
+
+Note that while this is a bug fix for a previous patch (see Fixes tag
+below). It is an exceedingly low risk bug. The range check is
+asserting that the GuC firmware version is within spec. So it should
+not be possible to ever have a firmware file that fails this check. If
+larger version numbers are required in the future, that would be a
+backwards breaking spec change and thus require a major version bump,
+in which case an old i915 driver would not load that new version anyway.
+
+Fixes: 9bbba0667f37 ("drm/i915/guc: Use GuC submission API version number")
+Reported-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Cc: John Harrison <John.C.Harrison@Intel.com>
+Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Alan Previn <alan.previn.teres.alexis@intel.com>
+Cc: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Andi Shyti <andi.shyti@linux.intel.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230421224742.2357198-1-John.C.Harrison@Intel.com
+(cherry picked from commit 80ab31799002166ac7c660bacfbff4f85bc29107)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c
+index 264c952f777bb..22786d9116fd0 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c
+@@ -622,9 +622,10 @@ static bool is_ver_8bit(struct intel_uc_fw_ver *ver)
+ return ver->major < 0xFF && ver->minor < 0xFF && ver->patch < 0xFF;
+ }
+
+-static bool guc_check_version_range(struct intel_uc_fw *uc_fw)
++static int guc_check_version_range(struct intel_uc_fw *uc_fw)
+ {
+ struct intel_guc *guc = container_of(uc_fw, struct intel_guc, fw);
++ struct intel_gt *gt = __uc_fw_to_gt(uc_fw);
+
+ /*
+ * GuC version number components are defined as being 8-bits.
+@@ -633,24 +634,24 @@ static bool guc_check_version_range(struct intel_uc_fw *uc_fw)
+ */
+
+ if (!is_ver_8bit(&uc_fw->file_selected.ver)) {
+- gt_warn(__uc_fw_to_gt(uc_fw), "%s firmware: invalid file version: 0x%02X:%02X:%02X\n",
++ gt_warn(gt, "%s firmware: invalid file version: 0x%02X:%02X:%02X\n",
+ intel_uc_fw_type_repr(uc_fw->type),
+ uc_fw->file_selected.ver.major,
+ uc_fw->file_selected.ver.minor,
+ uc_fw->file_selected.ver.patch);
+- return false;
++ return -EINVAL;
+ }
+
+ if (!is_ver_8bit(&guc->submission_version)) {
+- gt_warn(__uc_fw_to_gt(uc_fw), "%s firmware: invalid submit version: 0x%02X:%02X:%02X\n",
++ gt_warn(gt, "%s firmware: invalid submit version: 0x%02X:%02X:%02X\n",
+ intel_uc_fw_type_repr(uc_fw->type),
+ guc->submission_version.major,
+ guc->submission_version.minor,
+ guc->submission_version.patch);
+- return false;
++ return -EINVAL;
+ }
+
+- return true;
++ return i915_inject_probe_error(gt->i915, -EINVAL);
+ }
+
+ static int check_fw_header(struct intel_gt *gt,
+@@ -759,8 +760,11 @@ int intel_uc_fw_fetch(struct intel_uc_fw *uc_fw)
+ if (err)
+ goto fail;
+
+- if (uc_fw->type == INTEL_UC_FW_TYPE_GUC && !guc_check_version_range(uc_fw))
+- goto fail;
++ if (uc_fw->type == INTEL_UC_FW_TYPE_GUC) {
++ err = guc_check_version_range(uc_fw);
++ if (err)
++ goto fail;
++ }
+
+ if (uc_fw->file_wanted.ver.major && uc_fw->file_selected.ver.major) {
+ /* Check the file's major version was as it claimed */
+--
+2.39.2
+
--- /dev/null
+From bff3a2f1bf68bb0597fcb56c2a5654ff05e9aa7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 21:07:12 -0800
+Subject: drm/i915/guc: More debug print updates - UC firmware
+
+From: John Harrison <John.C.Harrison@Intel.com>
+
+[ Upstream commit 4fd4fde8e42e16425e7acab2e093614491107083 ]
+
+Update a bunch more debug prints to use the new GT based scheme.
+
+v2: Also change prints to use %pe for error values (MichalW).
+
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230207050717.1833718-2-John.C.Harrison@Intel.com
+Stable-dep-of: 1816f4a17f54 ("drm/i915/guc: Actually return an error if GuC version range check fails")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/uc/intel_uc.c | 42 ++++----
+ drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c | 116 +++++++++++------------
+ 2 files changed, 73 insertions(+), 85 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc.c b/drivers/gpu/drm/i915/gt/uc/intel_uc.c
+index de7f987cf6111..6648691bd6450 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_uc.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_uc.c
+@@ -83,15 +83,15 @@ static int __intel_uc_reset_hw(struct intel_uc *uc)
+
+ static void __confirm_options(struct intel_uc *uc)
+ {
+- struct drm_i915_private *i915 = uc_to_gt(uc)->i915;
++ struct intel_gt *gt = uc_to_gt(uc);
++ struct drm_i915_private *i915 = gt->i915;
+
+- drm_dbg(&i915->drm,
+- "enable_guc=%d (guc:%s submission:%s huc:%s slpc:%s)\n",
+- i915->params.enable_guc,
+- str_yes_no(intel_uc_wants_guc(uc)),
+- str_yes_no(intel_uc_wants_guc_submission(uc)),
+- str_yes_no(intel_uc_wants_huc(uc)),
+- str_yes_no(intel_uc_wants_guc_slpc(uc)));
++ gt_dbg(gt, "enable_guc=%d (guc:%s submission:%s huc:%s slpc:%s)\n",
++ i915->params.enable_guc,
++ str_yes_no(intel_uc_wants_guc(uc)),
++ str_yes_no(intel_uc_wants_guc_submission(uc)),
++ str_yes_no(intel_uc_wants_huc(uc)),
++ str_yes_no(intel_uc_wants_guc_slpc(uc)));
+
+ if (i915->params.enable_guc == 0) {
+ GEM_BUG_ON(intel_uc_wants_guc(uc));
+@@ -102,26 +102,22 @@ static void __confirm_options(struct intel_uc *uc)
+ }
+
+ if (!intel_uc_supports_guc(uc))
+- drm_info(&i915->drm,
+- "Incompatible option enable_guc=%d - %s\n",
+- i915->params.enable_guc, "GuC is not supported!");
++ gt_info(gt, "Incompatible option enable_guc=%d - %s\n",
++ i915->params.enable_guc, "GuC is not supported!");
+
+ if (i915->params.enable_guc & ENABLE_GUC_LOAD_HUC &&
+ !intel_uc_supports_huc(uc))
+- drm_info(&i915->drm,
+- "Incompatible option enable_guc=%d - %s\n",
+- i915->params.enable_guc, "HuC is not supported!");
++ gt_info(gt, "Incompatible option enable_guc=%d - %s\n",
++ i915->params.enable_guc, "HuC is not supported!");
+
+ if (i915->params.enable_guc & ENABLE_GUC_SUBMISSION &&
+ !intel_uc_supports_guc_submission(uc))
+- drm_info(&i915->drm,
+- "Incompatible option enable_guc=%d - %s\n",
+- i915->params.enable_guc, "GuC submission is N/A");
++ gt_info(gt, "Incompatible option enable_guc=%d - %s\n",
++ i915->params.enable_guc, "GuC submission is N/A");
+
+ if (i915->params.enable_guc & ~ENABLE_GUC_MASK)
+- drm_info(&i915->drm,
+- "Incompatible option enable_guc=%d - %s\n",
+- i915->params.enable_guc, "undocumented flag");
++ gt_info(gt, "Incompatible option enable_guc=%d - %s\n",
++ i915->params.enable_guc, "undocumented flag");
+ }
+
+ void intel_uc_init_early(struct intel_uc *uc)
+@@ -549,10 +545,8 @@ static int __uc_init_hw(struct intel_uc *uc)
+
+ intel_gsc_uc_load_start(&uc->gsc);
+
+- gt_info(gt, "GuC submission %s\n",
+- str_enabled_disabled(intel_uc_uses_guc_submission(uc)));
+- gt_info(gt, "GuC SLPC %s\n",
+- str_enabled_disabled(intel_uc_uses_guc_slpc(uc)));
++ guc_info(guc, "submission %s\n", str_enabled_disabled(intel_uc_uses_guc_submission(uc)));
++ guc_info(guc, "SLPC %s\n", str_enabled_disabled(intel_uc_uses_guc_slpc(uc)));
+
+ return 0;
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c
+index 65672ff826054..264c952f777bb 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_uc_fw.c
+@@ -11,6 +11,7 @@
+ #include <drm/drm_print.h>
+
+ #include "gem/i915_gem_lmem.h"
++#include "gt/intel_gt_print.h"
+ #include "intel_uc_fw.h"
+ #include "intel_uc_fw_abi.h"
+ #include "i915_drv.h"
+@@ -44,11 +45,10 @@ void intel_uc_fw_change_status(struct intel_uc_fw *uc_fw,
+ enum intel_uc_fw_status status)
+ {
+ uc_fw->__status = status;
+- drm_dbg(&__uc_fw_to_gt(uc_fw)->i915->drm,
+- "%s firmware -> %s\n",
+- intel_uc_fw_type_repr(uc_fw->type),
+- status == INTEL_UC_FIRMWARE_SELECTED ?
+- uc_fw->file_selected.path : intel_uc_fw_status_repr(status));
++ gt_dbg(__uc_fw_to_gt(uc_fw), "%s firmware -> %s\n",
++ intel_uc_fw_type_repr(uc_fw->type),
++ status == INTEL_UC_FIRMWARE_SELECTED ?
++ uc_fw->file_selected.path : intel_uc_fw_status_repr(status));
+ }
+ #endif
+
+@@ -562,15 +562,14 @@ static int check_ccs_header(struct intel_gt *gt,
+ const struct firmware *fw,
+ struct intel_uc_fw *uc_fw)
+ {
+- struct drm_i915_private *i915 = gt->i915;
+ struct uc_css_header *css;
+ size_t size;
+
+ /* Check the size of the blob before examining buffer contents */
+ if (unlikely(fw->size < sizeof(struct uc_css_header))) {
+- drm_warn(&i915->drm, "%s firmware %s: invalid size: %zu < %zu\n",
+- intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path,
+- fw->size, sizeof(struct uc_css_header));
++ gt_warn(gt, "%s firmware %s: invalid size: %zu < %zu\n",
++ intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path,
++ fw->size, sizeof(struct uc_css_header));
+ return -ENODATA;
+ }
+
+@@ -580,10 +579,9 @@ static int check_ccs_header(struct intel_gt *gt,
+ size = (css->header_size_dw - css->key_size_dw - css->modulus_size_dw -
+ css->exponent_size_dw) * sizeof(u32);
+ if (unlikely(size != sizeof(struct uc_css_header))) {
+- drm_warn(&i915->drm,
+- "%s firmware %s: unexpected header size: %zu != %zu\n",
+- intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path,
+- fw->size, sizeof(struct uc_css_header));
++ gt_warn(gt, "%s firmware %s: unexpected header size: %zu != %zu\n",
++ intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path,
++ fw->size, sizeof(struct uc_css_header));
+ return -EPROTO;
+ }
+
+@@ -596,18 +594,18 @@ static int check_ccs_header(struct intel_gt *gt,
+ /* At least, it should have header, uCode and RSA. Size of all three. */
+ size = sizeof(struct uc_css_header) + uc_fw->ucode_size + uc_fw->rsa_size;
+ if (unlikely(fw->size < size)) {
+- drm_warn(&i915->drm, "%s firmware %s: invalid size: %zu < %zu\n",
+- intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path,
+- fw->size, size);
++ gt_warn(gt, "%s firmware %s: invalid size: %zu < %zu\n",
++ intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path,
++ fw->size, size);
+ return -ENOEXEC;
+ }
+
+ /* Sanity check whether this fw is not larger than whole WOPCM memory */
+ size = __intel_uc_fw_get_upload_size(uc_fw);
+ if (unlikely(size >= gt->wopcm.size)) {
+- drm_warn(&i915->drm, "%s firmware %s: invalid size: %zu > %zu\n",
+- intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path,
+- size, (size_t)gt->wopcm.size);
++ gt_warn(gt, "%s firmware %s: invalid size: %zu > %zu\n",
++ intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path,
++ size, (size_t)gt->wopcm.size);
+ return -E2BIG;
+ }
+
+@@ -635,20 +633,20 @@ static bool guc_check_version_range(struct intel_uc_fw *uc_fw)
+ */
+
+ if (!is_ver_8bit(&uc_fw->file_selected.ver)) {
+- drm_warn(&__uc_fw_to_gt(uc_fw)->i915->drm, "%s firmware: invalid file version: 0x%02X:%02X:%02X\n",
+- intel_uc_fw_type_repr(uc_fw->type),
+- uc_fw->file_selected.ver.major,
+- uc_fw->file_selected.ver.minor,
+- uc_fw->file_selected.ver.patch);
++ gt_warn(__uc_fw_to_gt(uc_fw), "%s firmware: invalid file version: 0x%02X:%02X:%02X\n",
++ intel_uc_fw_type_repr(uc_fw->type),
++ uc_fw->file_selected.ver.major,
++ uc_fw->file_selected.ver.minor,
++ uc_fw->file_selected.ver.patch);
+ return false;
+ }
+
+ if (!is_ver_8bit(&guc->submission_version)) {
+- drm_warn(&__uc_fw_to_gt(uc_fw)->i915->drm, "%s firmware: invalid submit version: 0x%02X:%02X:%02X\n",
+- intel_uc_fw_type_repr(uc_fw->type),
+- guc->submission_version.major,
+- guc->submission_version.minor,
+- guc->submission_version.patch);
++ gt_warn(__uc_fw_to_gt(uc_fw), "%s firmware: invalid submit version: 0x%02X:%02X:%02X\n",
++ intel_uc_fw_type_repr(uc_fw->type),
++ guc->submission_version.major,
++ guc->submission_version.minor,
++ guc->submission_version.patch);
+ return false;
+ }
+
+@@ -687,10 +685,9 @@ static int try_firmware_load(struct intel_uc_fw *uc_fw, const struct firmware **
+ return err;
+
+ if ((*fw)->size > INTEL_UC_RSVD_GGTT_PER_FW) {
+- drm_err(>->i915->drm,
+- "%s firmware %s: size (%zuKB) exceeds max supported size (%uKB)\n",
+- intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path,
+- (*fw)->size / SZ_1K, INTEL_UC_RSVD_GGTT_PER_FW / SZ_1K);
++ gt_err(gt, "%s firmware %s: size (%zuKB) exceeds max supported size (%uKB)\n",
++ intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path,
++ (*fw)->size / SZ_1K, INTEL_UC_RSVD_GGTT_PER_FW / SZ_1K);
+
+ /* try to find another blob to load */
+ release_firmware(*fw);
+@@ -768,10 +765,10 @@ int intel_uc_fw_fetch(struct intel_uc_fw *uc_fw)
+ if (uc_fw->file_wanted.ver.major && uc_fw->file_selected.ver.major) {
+ /* Check the file's major version was as it claimed */
+ if (uc_fw->file_selected.ver.major != uc_fw->file_wanted.ver.major) {
+- drm_notice(&i915->drm, "%s firmware %s: unexpected version: %u.%u != %u.%u\n",
+- intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path,
+- uc_fw->file_selected.ver.major, uc_fw->file_selected.ver.minor,
+- uc_fw->file_wanted.ver.major, uc_fw->file_wanted.ver.minor);
++ gt_notice(gt, "%s firmware %s: unexpected version: %u.%u != %u.%u\n",
++ intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path,
++ uc_fw->file_selected.ver.major, uc_fw->file_selected.ver.minor,
++ uc_fw->file_wanted.ver.major, uc_fw->file_wanted.ver.minor);
+ if (!intel_uc_fw_is_overridden(uc_fw)) {
+ err = -ENOEXEC;
+ goto fail;
+@@ -786,16 +783,14 @@ int intel_uc_fw_fetch(struct intel_uc_fw *uc_fw)
+ /* Preserve the version that was really wanted */
+ memcpy(&uc_fw->file_wanted, &file_ideal, sizeof(uc_fw->file_wanted));
+
+- drm_notice(&i915->drm,
+- "%s firmware %s (%d.%d) is recommended, but only %s (%d.%d) was found\n",
+- intel_uc_fw_type_repr(uc_fw->type),
+- uc_fw->file_wanted.path,
+- uc_fw->file_wanted.ver.major, uc_fw->file_wanted.ver.minor,
+- uc_fw->file_selected.path,
+- uc_fw->file_selected.ver.major, uc_fw->file_selected.ver.minor);
+- drm_info(&i915->drm,
+- "Consider updating your linux-firmware pkg or downloading from %s\n",
+- INTEL_UC_FIRMWARE_URL);
++ gt_notice(gt, "%s firmware %s (%d.%d) is recommended, but only %s (%d.%d) was found\n",
++ intel_uc_fw_type_repr(uc_fw->type),
++ uc_fw->file_wanted.path,
++ uc_fw->file_wanted.ver.major, uc_fw->file_wanted.ver.minor,
++ uc_fw->file_selected.path,
++ uc_fw->file_selected.ver.major, uc_fw->file_selected.ver.minor);
++ gt_info(gt, "Consider updating your linux-firmware pkg or downloading from %s\n",
++ INTEL_UC_FIRMWARE_URL);
+ }
+
+ if (HAS_LMEM(i915)) {
+@@ -823,10 +818,10 @@ int intel_uc_fw_fetch(struct intel_uc_fw *uc_fw)
+ INTEL_UC_FIRMWARE_MISSING :
+ INTEL_UC_FIRMWARE_ERROR);
+
+- i915_probe_error(i915, "%s firmware %s: fetch failed with error %d\n",
+- intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path, err);
+- drm_info(&i915->drm, "%s firmware(s) can be downloaded from %s\n",
+- intel_uc_fw_type_repr(uc_fw->type), INTEL_UC_FIRMWARE_URL);
++ gt_probe_error(gt, "%s firmware %s: fetch failed %pe\n",
++ intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path, ERR_PTR(err));
++ gt_info(gt, "%s firmware(s) can be downloaded from %s\n",
++ intel_uc_fw_type_repr(uc_fw->type), INTEL_UC_FIRMWARE_URL);
+
+ release_firmware(fw); /* OK even if fw is NULL */
+ return err;
+@@ -932,9 +927,9 @@ static int uc_fw_xfer(struct intel_uc_fw *uc_fw, u32 dst_offset, u32 dma_flags)
+ /* Wait for DMA to finish */
+ ret = intel_wait_for_register_fw(uncore, DMA_CTRL, START_DMA, 0, 100);
+ if (ret)
+- drm_err(>->i915->drm, "DMA for %s fw failed, DMA_CTRL=%u\n",
+- intel_uc_fw_type_repr(uc_fw->type),
+- intel_uncore_read_fw(uncore, DMA_CTRL));
++ gt_err(gt, "DMA for %s fw failed, DMA_CTRL=%u\n",
++ intel_uc_fw_type_repr(uc_fw->type),
++ intel_uncore_read_fw(uncore, DMA_CTRL));
+
+ /* Disable the bits once DMA is over */
+ intel_uncore_write_fw(uncore, DMA_CTRL, _MASKED_BIT_DISABLE(dma_flags));
+@@ -950,9 +945,8 @@ int intel_uc_fw_mark_load_failed(struct intel_uc_fw *uc_fw, int err)
+
+ GEM_BUG_ON(!intel_uc_fw_is_loadable(uc_fw));
+
+- i915_probe_error(gt->i915, "Failed to load %s firmware %s (%d)\n",
+- intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path,
+- err);
++ gt_probe_error(gt, "Failed to load %s firmware %s %pe\n",
++ intel_uc_fw_type_repr(uc_fw->type), uc_fw->file_selected.path, ERR_PTR(err));
+ intel_uc_fw_change_status(uc_fw, INTEL_UC_FIRMWARE_LOAD_FAIL);
+
+ return err;
+@@ -1078,15 +1072,15 @@ int intel_uc_fw_init(struct intel_uc_fw *uc_fw)
+
+ err = i915_gem_object_pin_pages_unlocked(uc_fw->obj);
+ if (err) {
+- DRM_DEBUG_DRIVER("%s fw pin-pages err=%d\n",
+- intel_uc_fw_type_repr(uc_fw->type), err);
++ gt_dbg(__uc_fw_to_gt(uc_fw), "%s fw pin-pages failed %pe\n",
++ intel_uc_fw_type_repr(uc_fw->type), ERR_PTR(err));
+ goto out;
+ }
+
+ err = uc_fw_rsa_data_create(uc_fw);
+ if (err) {
+- DRM_DEBUG_DRIVER("%s fw rsa data creation failed, err=%d\n",
+- intel_uc_fw_type_repr(uc_fw->type), err);
++ gt_dbg(__uc_fw_to_gt(uc_fw), "%s fw rsa data creation failed %pe\n",
++ intel_uc_fw_type_repr(uc_fw->type), ERR_PTR(err));
+ goto out_unpin;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 34a99e4c10741c067ed28621b7411f50313f9ff9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 15:12:47 -0700
+Subject: drm/i915/mtl: Add the missing CPU transcoder mask in
+ intel_device_info
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
+
+[ Upstream commit 6ece90e3665a9b7fb2637fcca26cebd42991580b ]
+
+CPU transcoder mask is used to iterate over the available
+CPU transcoders in the macro for_each_cpu_transcoder().
+
+The macro is broken on MTL and got highlighted when audio
+state was being tracked for each transcoder added in [1].
+
+Add the missing CPU transcoder mask which is similar to ADL-P
+mask but without DSI transcoders.
+
+[1]: https://patchwork.freedesktop.org/patch/523723/
+
+Fixes: 7835303982d1 ("drm/i915/mtl: Add MeteorLake PCI IDs")
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
+Acked-by: Haridhar Kalvala <haridhar.kalvala@intel.com>
+Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230420221248.2511314-1-radhakrishna.sripada@intel.com
+(cherry picked from commit bddc18913bd44adae5c828fd514d570f43ba1576)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
+index a8d942b16223f..125f7ef1252c3 100644
+--- a/drivers/gpu/drm/i915/i915_pci.c
++++ b/drivers/gpu/drm/i915/i915_pci.c
+@@ -1135,6 +1135,8 @@ static const struct intel_gt_definition xelpmp_extra_gt[] = {
+ static const struct intel_device_info mtl_info = {
+ XE_HP_FEATURES,
+ XE_LPDP_FEATURES,
++ .__runtime.cpu_transcoder_mask = BIT(TRANSCODER_A) | BIT(TRANSCODER_B) |
++ BIT(TRANSCODER_C) | BIT(TRANSCODER_D),
+ /*
+ * Real graphics IP version will be obtained from hardware GMD_ID
+ * register. Value provided here is just for sanity checking.
+--
+2.39.2
+
--- /dev/null
+From 55395c53d15da3cef78b4ae13ac1ce4f90048621 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 19:03:22 +0100
+Subject: dt-bindings: perf: riscv,pmu: fix property dependencies
+
+From: Conor Dooley <conor.dooley@microchip.com>
+
+[ Upstream commit 4d276e4d3bb4a503e75086faab54f92c0a8fd368 ]
+
+Seemingly I mis-implemented the dependencies here. The OpenSBI docs only
+point out that the "riscv,event-to-mhpmcounters property is mandatory if
+riscv,event-to-mhpmevent is present". It never claims that
+riscv,event-to-mhpmcounters requires riscv,event-to-mhpmevent.
+
+Drop the dependency of riscv,event-to-mhpmcounters on
+riscv,event-to-mhpmevent.
+
+Fixes: 7e38085d9c59 ("dt-bindings: riscv: add SBI PMU event mappings")
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Atish Patra <atishp@rivosinc.com>
+Link: https://lore.kernel.org/r/20230404-tractor-confusing-8852e552539a@spud
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/perf/riscv,pmu.yaml | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/perf/riscv,pmu.yaml b/Documentation/devicetree/bindings/perf/riscv,pmu.yaml
+index a55a4d047d3fd..c8448de2f2a07 100644
+--- a/Documentation/devicetree/bindings/perf/riscv,pmu.yaml
++++ b/Documentation/devicetree/bindings/perf/riscv,pmu.yaml
+@@ -91,7 +91,6 @@ properties:
+
+ dependencies:
+ "riscv,event-to-mhpmevent": [ "riscv,event-to-mhpmcounters" ]
+- "riscv,event-to-mhpmcounters": [ "riscv,event-to-mhpmevent" ]
+
+ required:
+ - compatible
+--
+2.39.2
+
--- /dev/null
+From 4171b4ae7d4df4d96320c9f45f956002a9c45c96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 May 2023 15:20:50 +0300
+Subject: ethtool: Fix uninitialized number of lanes
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 9ad685dbfe7e856bbf17a7177b64676d324d6ed7 ]
+
+It is not possible to set the number of lanes when setting link modes
+using the legacy IOCTL ethtool interface. Since 'struct
+ethtool_link_ksettings' is not initialized in this path, drivers receive
+an uninitialized number of lanes in 'struct
+ethtool_link_ksettings::lanes'.
+
+When this information is later queried from drivers, it results in the
+ethtool code making decisions based on uninitialized memory, leading to
+the following KMSAN splat [1]. In practice, this most likely only
+happens with the tun driver that simply returns whatever it got in the
+set operation.
+
+As far as I can tell, this uninitialized memory is not leaked to user
+space thanks to the 'ethtool_ops->cap_link_lanes_supported' check in
+linkmodes_prepare_data().
+
+Fix by initializing the structure in the IOCTL path. Did not find any
+more call sites that pass an uninitialized structure when calling
+'ethtool_ops::set_link_ksettings()'.
+
+[1]
+BUG: KMSAN: uninit-value in ethnl_update_linkmodes net/ethtool/linkmodes.c:273 [inline]
+BUG: KMSAN: uninit-value in ethnl_set_linkmodes+0x190b/0x19d0 net/ethtool/linkmodes.c:333
+ ethnl_update_linkmodes net/ethtool/linkmodes.c:273 [inline]
+ ethnl_set_linkmodes+0x190b/0x19d0 net/ethtool/linkmodes.c:333
+ ethnl_default_set_doit+0x88d/0xde0 net/ethtool/netlink.c:640
+ genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline]
+ genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
+ genl_rcv_msg+0x141a/0x14c0 net/netlink/genetlink.c:1065
+ netlink_rcv_skb+0x3f8/0x750 net/netlink/af_netlink.c:2577
+ genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076
+ netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
+ netlink_unicast+0xf41/0x1270 net/netlink/af_netlink.c:1365
+ netlink_sendmsg+0x127d/0x1430 net/netlink/af_netlink.c:1942
+ sock_sendmsg_nosec net/socket.c:724 [inline]
+ sock_sendmsg net/socket.c:747 [inline]
+ ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501
+ ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555
+ __sys_sendmsg net/socket.c:2584 [inline]
+ __do_sys_sendmsg net/socket.c:2593 [inline]
+ __se_sys_sendmsg net/socket.c:2591 [inline]
+ __x64_sys_sendmsg+0x36b/0x540 net/socket.c:2591
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Uninit was stored to memory at:
+ tun_get_link_ksettings+0x37/0x60 drivers/net/tun.c:3544
+ __ethtool_get_link_ksettings+0x17b/0x260 net/ethtool/ioctl.c:441
+ ethnl_set_linkmodes+0xee/0x19d0 net/ethtool/linkmodes.c:327
+ ethnl_default_set_doit+0x88d/0xde0 net/ethtool/netlink.c:640
+ genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline]
+ genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
+ genl_rcv_msg+0x141a/0x14c0 net/netlink/genetlink.c:1065
+ netlink_rcv_skb+0x3f8/0x750 net/netlink/af_netlink.c:2577
+ genl_rcv+0x40/0x60 net/netlink/genetlink.c:1076
+ netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
+ netlink_unicast+0xf41/0x1270 net/netlink/af_netlink.c:1365
+ netlink_sendmsg+0x127d/0x1430 net/netlink/af_netlink.c:1942
+ sock_sendmsg_nosec net/socket.c:724 [inline]
+ sock_sendmsg net/socket.c:747 [inline]
+ ____sys_sendmsg+0xa24/0xe40 net/socket.c:2501
+ ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555
+ __sys_sendmsg net/socket.c:2584 [inline]
+ __do_sys_sendmsg net/socket.c:2593 [inline]
+ __se_sys_sendmsg net/socket.c:2591 [inline]
+ __x64_sys_sendmsg+0x36b/0x540 net/socket.c:2591
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Uninit was stored to memory at:
+ tun_set_link_ksettings+0x37/0x60 drivers/net/tun.c:3553
+ ethtool_set_link_ksettings+0x600/0x690 net/ethtool/ioctl.c:609
+ __dev_ethtool net/ethtool/ioctl.c:3024 [inline]
+ dev_ethtool+0x1db9/0x2a70 net/ethtool/ioctl.c:3078
+ dev_ioctl+0xb07/0x1270 net/core/dev_ioctl.c:524
+ sock_do_ioctl+0x295/0x540 net/socket.c:1213
+ sock_ioctl+0x729/0xd90 net/socket.c:1316
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:870 [inline]
+ __se_sys_ioctl+0x222/0x400 fs/ioctl.c:856
+ __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:856
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Local variable link_ksettings created at:
+ ethtool_set_link_ksettings+0x54/0x690 net/ethtool/ioctl.c:577
+ __dev_ethtool net/ethtool/ioctl.c:3024 [inline]
+ dev_ethtool+0x1db9/0x2a70 net/ethtool/ioctl.c:3078
+
+Fixes: 012ce4dd3102 ("ethtool: Extend link modes settings uAPI with lanes")
+Reported-and-tested-by: syzbot+ef6edd9f1baaa54d6235@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/netdev/0000000000004bb41105fa70f361@google.com/
+Reviewed-by: Danielle Ratson <danieller@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ethtool/ioctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c
+index 646b3e490c71a..f0c646a17700f 100644
+--- a/net/ethtool/ioctl.c
++++ b/net/ethtool/ioctl.c
+@@ -573,8 +573,8 @@ static int ethtool_get_link_ksettings(struct net_device *dev,
+ static int ethtool_set_link_ksettings(struct net_device *dev,
+ void __user *useraddr)
+ {
++ struct ethtool_link_ksettings link_ksettings = {};
+ int err;
+- struct ethtool_link_ksettings link_ksettings;
+
+ ASSERT_RTNL();
+
+--
+2.39.2
+
--- /dev/null
+From ef7881f382b1c2c70beef81ad14175c1941dc6ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 09:49:13 +0200
+Subject: i2c: gxp: fix build failure without CONFIG_I2C_SLAVE
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 5d388143fa6c351d985ffd23ea50c91c8839141b ]
+
+The gxp_i2c_slave_irq_handler() is hidden in an #ifdef, but the
+caller uses an IS_ENABLED() check:
+
+drivers/i2c/busses/i2c-gxp.c: In function 'gxp_i2c_irq_handler':
+drivers/i2c/busses/i2c-gxp.c:467:29: error: implicit declaration of function 'gxp_i2c_slave_irq_handler'; did you mean 'gxp_i2c_irq_handler'? [-Werror=implicit-function-declaration]
+
+It has to consistently use one method or the other to avoid warnings,
+so move to IS_ENABLED() here for readability and build coverage, and
+move the #ifdef in linux/i2c.h to allow building it as dead code.
+
+Fixes: 4a55ed6f89f5 ("i2c: Add GXP SoC I2C Controller")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nick Hawkins <nick.hawkins@hpe.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-gxp.c | 2 --
+ include/linux/i2c.h | 4 ++--
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-gxp.c b/drivers/i2c/busses/i2c-gxp.c
+index d4b55d989a268..8ea3fb5e4c7f7 100644
+--- a/drivers/i2c/busses/i2c-gxp.c
++++ b/drivers/i2c/busses/i2c-gxp.c
+@@ -353,7 +353,6 @@ static void gxp_i2c_chk_data_ack(struct gxp_i2c_drvdata *drvdata)
+ writew(value, drvdata->base + GXP_I2CMCMD);
+ }
+
+-#if IS_ENABLED(CONFIG_I2C_SLAVE)
+ static bool gxp_i2c_slave_irq_handler(struct gxp_i2c_drvdata *drvdata)
+ {
+ u8 value;
+@@ -437,7 +436,6 @@ static bool gxp_i2c_slave_irq_handler(struct gxp_i2c_drvdata *drvdata)
+
+ return true;
+ }
+-#endif
+
+ static irqreturn_t gxp_i2c_irq_handler(int irq, void *_drvdata)
+ {
+diff --git a/include/linux/i2c.h b/include/linux/i2c.h
+index 5ba89663ea865..13a1ce38cb0c5 100644
+--- a/include/linux/i2c.h
++++ b/include/linux/i2c.h
+@@ -385,7 +385,6 @@ static inline void i2c_set_clientdata(struct i2c_client *client, void *data)
+
+ /* I2C slave support */
+
+-#if IS_ENABLED(CONFIG_I2C_SLAVE)
+ enum i2c_slave_event {
+ I2C_SLAVE_READ_REQUESTED,
+ I2C_SLAVE_WRITE_REQUESTED,
+@@ -396,9 +395,10 @@ enum i2c_slave_event {
+
+ int i2c_slave_register(struct i2c_client *client, i2c_slave_cb_t slave_cb);
+ int i2c_slave_unregister(struct i2c_client *client);
+-bool i2c_detect_slave_mode(struct device *dev);
+ int i2c_slave_event(struct i2c_client *client,
+ enum i2c_slave_event event, u8 *val);
++#if IS_ENABLED(CONFIG_I2C_SLAVE)
++bool i2c_detect_slave_mode(struct device *dev);
+ #else
+ static inline bool i2c_detect_slave_mode(struct device *dev) { return false; }
+ #endif
+--
+2.39.2
+
--- /dev/null
+From 5193fc97ca092d60ea6f93cb2bea8c035002a606 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 18:09:14 +0530
+Subject: i2c: tegra: Fix PEC support for SMBUS block read
+
+From: Akhil R <akhilrajeev@nvidia.com>
+
+[ Upstream commit 9f855779a3874eee70e9f6be57b5f7774f14e510 ]
+
+Update the msg->len value correctly for SMBUS block read. The discrepancy
+went unnoticed as msg->len is used in SMBUS transfers only when a PEC
+byte is added.
+
+Fixes: d7583c8a5748 ("i2c: tegra: Add SMBus block read function")
+Signed-off-by: Akhil R <akhilrajeev@nvidia.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-tegra.c | 40 +++++++++++++++++++++++-----------
+ 1 file changed, 27 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
+index 6aab84c8d22b4..157066f06a32d 100644
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -242,9 +242,10 @@ struct tegra_i2c_hw_feature {
+ * @is_dvc: identifies the DVC I2C controller, has a different register layout
+ * @is_vi: identifies the VI I2C controller, has a different register layout
+ * @msg_complete: transfer completion notifier
++ * @msg_buf_remaining: size of unsent data in the message buffer
++ * @msg_len: length of message in current transfer
+ * @msg_err: error code for completed message
+ * @msg_buf: pointer to current message data
+- * @msg_buf_remaining: size of unsent data in the message buffer
+ * @msg_read: indicates that the transfer is a read access
+ * @timings: i2c timings information like bus frequency
+ * @multimaster_mode: indicates that I2C controller is in multi-master mode
+@@ -277,6 +278,7 @@ struct tegra_i2c_dev {
+
+ struct completion msg_complete;
+ size_t msg_buf_remaining;
++ unsigned int msg_len;
+ int msg_err;
+ u8 *msg_buf;
+
+@@ -1169,7 +1171,7 @@ static void tegra_i2c_push_packet_header(struct tegra_i2c_dev *i2c_dev,
+ else
+ i2c_writel(i2c_dev, packet_header, I2C_TX_FIFO);
+
+- packet_header = msg->len - 1;
++ packet_header = i2c_dev->msg_len - 1;
+
+ if (i2c_dev->dma_mode && !i2c_dev->msg_read)
+ *dma_buf++ = packet_header;
+@@ -1242,20 +1244,32 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev *i2c_dev,
+ return err;
+
+ i2c_dev->msg_buf = msg->buf;
++ i2c_dev->msg_len = msg->len;
+
+- /* The condition true implies smbus block read and len is already read */
+- if (msg->flags & I2C_M_RECV_LEN && end_state != MSG_END_CONTINUE)
+- i2c_dev->msg_buf = msg->buf + 1;
+-
+- i2c_dev->msg_buf_remaining = msg->len;
+ i2c_dev->msg_err = I2C_ERR_NONE;
+ i2c_dev->msg_read = !!(msg->flags & I2C_M_RD);
+ reinit_completion(&i2c_dev->msg_complete);
+
++ /*
++ * For SMBUS block read command, read only 1 byte in the first transfer.
++ * Adjust that 1 byte for the next transfer in the msg buffer and msg
++ * length.
++ */
++ if (msg->flags & I2C_M_RECV_LEN) {
++ if (end_state == MSG_END_CONTINUE) {
++ i2c_dev->msg_len = 1;
++ } else {
++ i2c_dev->msg_buf += 1;
++ i2c_dev->msg_len -= 1;
++ }
++ }
++
++ i2c_dev->msg_buf_remaining = i2c_dev->msg_len;
++
+ if (i2c_dev->msg_read)
+- xfer_size = msg->len;
++ xfer_size = i2c_dev->msg_len;
+ else
+- xfer_size = msg->len + I2C_PACKET_HEADER_SIZE;
++ xfer_size = i2c_dev->msg_len + I2C_PACKET_HEADER_SIZE;
+
+ xfer_size = ALIGN(xfer_size, BYTES_PER_FIFO_WORD);
+
+@@ -1295,7 +1309,7 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev *i2c_dev,
+ if (!i2c_dev->msg_read) {
+ if (i2c_dev->dma_mode) {
+ memcpy(i2c_dev->dma_buf + I2C_PACKET_HEADER_SIZE,
+- msg->buf, msg->len);
++ msg->buf, i2c_dev->msg_len);
+
+ dma_sync_single_for_device(i2c_dev->dma_dev,
+ i2c_dev->dma_phys,
+@@ -1352,7 +1366,7 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev *i2c_dev,
+ i2c_dev->dma_phys,
+ xfer_size, DMA_FROM_DEVICE);
+
+- memcpy(i2c_dev->msg_buf, i2c_dev->dma_buf, msg->len);
++ memcpy(i2c_dev->msg_buf, i2c_dev->dma_buf, i2c_dev->msg_len);
+ }
+ }
+
+@@ -1408,8 +1422,8 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
+ ret = tegra_i2c_xfer_msg(i2c_dev, &msgs[i], MSG_END_CONTINUE);
+ if (ret)
+ break;
+- /* Set the read byte as msg len */
+- msgs[i].len = msgs[i].buf[0];
++ /* Set the msg length from first byte */
++ msgs[i].len += msgs[i].buf[0];
+ dev_dbg(i2c_dev->dev, "reading %d bytes\n", msgs[i].len);
+ }
+ ret = tegra_i2c_xfer_msg(i2c_dev, &msgs[i], end_type);
+--
+2.39.2
+
--- /dev/null
+From 430c8a05597cd821f23d29b46825ed6cf8debc46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 08:39:35 -0700
+Subject: ice: block LAN in case of VF to VF offload
+
+From: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+
+[ Upstream commit 9f699b71c2f31c51bd1483a20e1c8ddc5986a8c9 ]
+
+VF to VF traffic shouldn't go outside. To enforce it, set only the loopback
+enable bit in case of all ingress type rules added via the tc tool.
+
+Fixes: 0d08a441fb1a ("ice: ndo_setup_tc implementation for PF")
+Reported-by: Sujai Buvaneswaran <Sujai.Buvaneswaran@intel.com>
+Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: George Kuruvinakunnel <george.kuruvinakunnel@intel.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_tc_lib.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.c b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
+index 76f29a5bf8d73..d1a31f236d26a 100644
+--- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
+@@ -693,17 +693,18 @@ ice_eswitch_add_tc_fltr(struct ice_vsi *vsi, struct ice_tc_flower_fltr *fltr)
+ * results into order of switch rule evaluation.
+ */
+ rule_info.priority = 7;
++ rule_info.flags_info.act_valid = true;
+
+ if (fltr->direction == ICE_ESWITCH_FLTR_INGRESS) {
+ rule_info.sw_act.flag |= ICE_FLTR_RX;
+ rule_info.sw_act.src = hw->pf_id;
+ rule_info.rx = true;
++ rule_info.flags_info.act = ICE_SINGLE_ACT_LB_ENABLE;
+ } else {
+ rule_info.sw_act.flag |= ICE_FLTR_TX;
+ rule_info.sw_act.src = vsi->idx;
+ rule_info.rx = false;
+ rule_info.flags_info.act = ICE_SINGLE_ACT_LAN_ENABLE;
+- rule_info.flags_info.act_valid = true;
+ }
+
+ /* specify the cookie as filter_rule_id */
+--
+2.39.2
+
--- /dev/null
+From 702397da5a1a221249320349de98c0eb384e654b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 May 2023 11:35:36 -0700
+Subject: ionic: catch failure from devlink_alloc
+
+From: Shannon Nelson <shannon.nelson@amd.com>
+
+[ Upstream commit 4a54903ff68ddb33b6463c94b4eb37fc584ef760 ]
+
+Add a check for NULL on the alloc return. If devlink_alloc() fails and
+we try to use devlink_priv() on the NULL return, the kernel gets very
+unhappy and panics. With this fix, the driver load will still fail,
+but at least it won't panic the kernel.
+
+Fixes: df69ba43217d ("ionic: Add basic framework for IONIC Network device driver")
+Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_devlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_devlink.c b/drivers/net/ethernet/pensando/ionic/ionic_devlink.c
+index e6ff757895abb..4ec66a6be0738 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_devlink.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_devlink.c
+@@ -61,6 +61,8 @@ struct ionic *ionic_devlink_alloc(struct device *dev)
+ struct devlink *dl;
+
+ dl = devlink_alloc(&ionic_dl_ops, sizeof(struct ionic), dev);
++ if (!dl)
++ return NULL;
+
+ return devlink_priv(dl);
+ }
+--
+2.39.2
+
--- /dev/null
+From ef07291b732d19a1f4ec5c138646de3858eaf2fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 May 2023 11:47:40 -0700
+Subject: ionic: remove noise from ethtool rxnfc error msg
+
+From: Shannon Nelson <shannon.nelson@amd.com>
+
+[ Upstream commit 3711d44fac1f80ea69ecb7315fed05b3812a7401 ]
+
+It seems that ethtool is calling into .get_rxnfc more often with
+ETHTOOL_GRXCLSRLCNT which ionic doesn't know about. We don't
+need to log a message about it, just return not supported.
+
+Fixes: aa3198819bea6 ("ionic: Add RSS support")
+Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
+index cf33503468a3d..9b2b96fa36af8 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
+@@ -794,7 +794,7 @@ static int ionic_get_rxnfc(struct net_device *netdev,
+ info->data = lif->nxqs;
+ break;
+ default:
+- netdev_err(netdev, "Command parameter %d is not supported\n",
++ netdev_dbg(netdev, "Command parameter %d is not supported\n",
+ info->cmd);
+ err = -EOPNOTSUPP;
+ }
+--
+2.39.2
+
--- /dev/null
+From 7a92f0f633dd68739af32d23e60269aec6469a60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 10:03:08 -0700
+Subject: ixgbe: Fix panic during XDP_TX with > 64 CPUs
+
+From: John Hickey <jjh@daedalian.us>
+
+[ Upstream commit c23ae5091a8b3e50fe755257df020907e7c029bb ]
+
+Commit 4fe815850bdc ("ixgbe: let the xdpdrv work with more than 64 cpus")
+adds support to allow XDP programs to run on systems with more than
+64 CPUs by locking the XDP TX rings and indexing them using cpu % 64
+(IXGBE_MAX_XDP_QS).
+
+Upon trying this out patch on a system with more than 64 cores,
+the kernel paniced with an array-index-out-of-bounds at the return in
+ixgbe_determine_xdp_ring in ixgbe.h, which means ixgbe_determine_xdp_q_idx
+was just returning the cpu instead of cpu % IXGBE_MAX_XDP_QS. An example
+splat:
+
+ ==========================================================================
+ UBSAN: array-index-out-of-bounds in
+ /var/lib/dkms/ixgbe/5.18.6+focal-1/build/src/ixgbe.h:1147:26
+ index 65 is out of range for type 'ixgbe_ring *[64]'
+ ==========================================================================
+ BUG: kernel NULL pointer dereference, address: 0000000000000058
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 0 P4D 0
+ Oops: 0000 [#1] SMP NOPTI
+ CPU: 65 PID: 408 Comm: ksoftirqd/65
+ Tainted: G IOE 5.15.0-48-generic #54~20.04.1-Ubuntu
+ Hardware name: Dell Inc. PowerEdge R640/0W23H8, BIOS 2.5.4 01/13/2020
+ RIP: 0010:ixgbe_xmit_xdp_ring+0x1b/0x1c0 [ixgbe]
+ Code: 3b 52 d4 cf e9 42 f2 ff ff 66 0f 1f 44 00 00 0f 1f 44 00 00 55 b9
+ 00 00 00 00 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 08 <44> 0f b7
+ 47 58 0f b7 47 5a 0f b7 57 54 44 0f b7 76 08 66 41 39 c0
+ RSP: 0018:ffffbc3fcd88fcb0 EFLAGS: 00010282
+ RAX: ffff92a253260980 RBX: ffffbc3fe68b00a0 RCX: 0000000000000000
+ RDX: ffff928b5f659000 RSI: ffff928b5f659000 RDI: 0000000000000000
+ RBP: ffffbc3fcd88fce0 R08: ffff92b9dfc20580 R09: 0000000000000001
+ R10: 3d3d3d3d3d3d3d3d R11: 3d3d3d3d3d3d3d3d R12: 0000000000000000
+ R13: ffff928b2f0fa8c0 R14: ffff928b9be20050 R15: 000000000000003c
+ FS: 0000000000000000(0000) GS:ffff92b9dfc00000(0000)
+ knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000058 CR3: 000000011dd6a002 CR4: 00000000007706e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ PKRU: 55555554
+ Call Trace:
+ <TASK>
+ ixgbe_poll+0x103e/0x1280 [ixgbe]
+ ? sched_clock_cpu+0x12/0xe0
+ __napi_poll+0x30/0x160
+ net_rx_action+0x11c/0x270
+ __do_softirq+0xda/0x2ee
+ run_ksoftirqd+0x2f/0x50
+ smpboot_thread_fn+0xb7/0x150
+ ? sort_range+0x30/0x30
+ kthread+0x127/0x150
+ ? set_kthread_struct+0x50/0x50
+ ret_from_fork+0x1f/0x30
+ </TASK>
+
+I think this is how it happens:
+
+Upon loading the first XDP program on a system with more than 64 CPUs,
+ixgbe_xdp_locking_key is incremented in ixgbe_xdp_setup. However,
+immediately after this, the rings are reconfigured by ixgbe_setup_tc.
+ixgbe_setup_tc calls ixgbe_clear_interrupt_scheme which calls
+ixgbe_free_q_vectors which calls ixgbe_free_q_vector in a loop.
+ixgbe_free_q_vector decrements ixgbe_xdp_locking_key once per call if
+it is non-zero. Commenting out the decrement in ixgbe_free_q_vector
+stopped my system from panicing.
+
+I suspect to make the original patch work, I would need to load an XDP
+program and then replace it in order to get ixgbe_xdp_locking_key back
+above 0 since ixgbe_setup_tc is only called when transitioning between
+XDP and non-XDP ring configurations, while ixgbe_xdp_locking_key is
+incremented every time ixgbe_xdp_setup is called.
+
+Also, ixgbe_setup_tc can be called via ethtool --set-channels, so this
+becomes another path to decrement ixgbe_xdp_locking_key to 0 on systems
+with more than 64 CPUs.
+
+Since ixgbe_xdp_locking_key only protects the XDP_TX path and is tied
+to the number of CPUs present, there is no reason to disable it upon
+unloading an XDP program. To avoid confusion, I have moved enabling
+ixgbe_xdp_locking_key into ixgbe_sw_init, which is part of the probe path.
+
+Fixes: 4fe815850bdc ("ixgbe: let the xdpdrv work with more than 64 cpus")
+Signed-off-by: John Hickey <jjh@daedalian.us>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> (A Contingent Worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://lore.kernel.org/r/20230425170308.2522429-1-anthony.l.nguyen@intel.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c | 3 ---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 6 ++++--
+ 2 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
+index f8156fe4b1dc4..0ee943db3dc92 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
+@@ -1035,9 +1035,6 @@ static void ixgbe_free_q_vector(struct ixgbe_adapter *adapter, int v_idx)
+ adapter->q_vector[v_idx] = NULL;
+ __netif_napi_del(&q_vector->napi);
+
+- if (static_key_enabled(&ixgbe_xdp_locking_key))
+- static_branch_dec(&ixgbe_xdp_locking_key);
+-
+ /*
+ * after a call to __netif_napi_del() napi may still be used and
+ * ixgbe_get_stats64() might access the rings on this vector,
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 773c35fecacef..d7c247e46dfcc 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -6495,6 +6495,10 @@ static int ixgbe_sw_init(struct ixgbe_adapter *adapter,
+ set_bit(0, adapter->fwd_bitmask);
+ set_bit(__IXGBE_DOWN, &adapter->state);
+
++ /* enable locking for XDP_TX if we have more CPUs than queues */
++ if (nr_cpu_ids > IXGBE_MAX_XDP_QS)
++ static_branch_enable(&ixgbe_xdp_locking_key);
++
+ return 0;
+ }
+
+@@ -10290,8 +10294,6 @@ static int ixgbe_xdp_setup(struct net_device *dev, struct bpf_prog *prog)
+ */
+ if (nr_cpu_ids > IXGBE_MAX_XDP_QS * 2)
+ return -ENOMEM;
+- else if (nr_cpu_ids > IXGBE_MAX_XDP_QS)
+- static_branch_inc(&ixgbe_xdp_locking_key);
+
+ old_prog = xchg(&adapter->xdp_prog, prog);
+ need_reset = (!!prog != !!old_prog);
+--
+2.39.2
+
--- /dev/null
+From 55f50de6b6407890a7c8d80754540f6b6cb2c85e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 11:27:53 +0200
+Subject: KVM: s390: fix race in gmap_make_secure()
+
+From: Claudio Imbrenda <imbrenda@linux.ibm.com>
+
+[ Upstream commit c148dc8e2fa403be501612ee409db866eeed35c0 ]
+
+Fix a potential race in gmap_make_secure() and remove the last user of
+follow_page() without FOLL_GET.
+
+The old code is locking something it doesn't have a reference to, and
+as explained by Jason and David in this discussion:
+https://lore.kernel.org/linux-mm/Y9J4P%2FRNvY1Ztn0Q@nvidia.com/
+it can lead to all kind of bad things, including the page getting
+unmapped (MADV_DONTNEED), freed, reallocated as a larger folio and the
+unlock_page() would target the wrong bit.
+There is also another race with the FOLL_WRITE, which could race
+between the follow_page() and the get_locked_pte().
+
+The main point is to remove the last use of follow_page() without
+FOLL_GET or FOLL_PIN, removing the races can be considered a nice
+bonus.
+
+Link: https://lore.kernel.org/linux-mm/Y9J4P%2FRNvY1Ztn0Q@nvidia.com/
+Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
+Fixes: 214d9bbcd3a6 ("s390/mm: provide memory management functions for protected KVM guests")
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Message-Id: <20230428092753.27913-2-imbrenda@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/uv.c | 32 +++++++++++---------------------
+ 1 file changed, 11 insertions(+), 21 deletions(-)
+
+diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c
+index 9f18a4af9c131..cb2ee06df286c 100644
+--- a/arch/s390/kernel/uv.c
++++ b/arch/s390/kernel/uv.c
+@@ -192,21 +192,10 @@ static int expected_page_refs(struct page *page)
+ return res;
+ }
+
+-static int make_secure_pte(pte_t *ptep, unsigned long addr,
+- struct page *exp_page, struct uv_cb_header *uvcb)
++static int make_page_secure(struct page *page, struct uv_cb_header *uvcb)
+ {
+- pte_t entry = READ_ONCE(*ptep);
+- struct page *page;
+ int expected, cc = 0;
+
+- if (!pte_present(entry))
+- return -ENXIO;
+- if (pte_val(entry) & _PAGE_INVALID)
+- return -ENXIO;
+-
+- page = pte_page(entry);
+- if (page != exp_page)
+- return -ENXIO;
+ if (PageWriteback(page))
+ return -EAGAIN;
+ expected = expected_page_refs(page);
+@@ -304,17 +293,18 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb)
+ goto out;
+
+ rc = -ENXIO;
+- page = follow_page(vma, uaddr, FOLL_WRITE);
+- if (IS_ERR_OR_NULL(page))
+- goto out;
+-
+- lock_page(page);
+ ptep = get_locked_pte(gmap->mm, uaddr, &ptelock);
+- if (should_export_before_import(uvcb, gmap->mm))
+- uv_convert_from_secure(page_to_phys(page));
+- rc = make_secure_pte(ptep, uaddr, page, uvcb);
++ if (pte_present(*ptep) && !(pte_val(*ptep) & _PAGE_INVALID) && pte_write(*ptep)) {
++ page = pte_page(*ptep);
++ rc = -EAGAIN;
++ if (trylock_page(page)) {
++ if (should_export_before_import(uvcb, gmap->mm))
++ uv_convert_from_secure(page_to_phys(page));
++ rc = make_page_secure(page, uvcb);
++ unlock_page(page);
++ }
++ }
+ pte_unmap_unlock(ptep, ptelock);
+- unlock_page(page);
+ out:
+ mmap_read_unlock(gmap->mm);
+
+--
+2.39.2
+
--- /dev/null
+From e57b712afd039d7b4bf06443409b4d525fc62ea6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 10:50:36 +0200
+Subject: KVM: s390: pv: fix asynchronous teardown for small VMs
+
+From: Claudio Imbrenda <imbrenda@linux.ibm.com>
+
+[ Upstream commit 292a7d6fca33df70ca4b8e9b0d0e74adf87582dc ]
+
+On machines without the Destroy Secure Configuration Fast UVC, the
+topmost level of page tables is set aside and freed asynchronously
+as last step of the asynchronous teardown.
+
+Each gmap has a host_to_guest radix tree mapping host (userspace)
+addresses (with 1M granularity) to gmap segment table entries (pmds).
+
+If a guest is smaller than 2GB, the topmost level of page tables is the
+segment table (i.e. there are only 2 levels). Replacing it means that
+the pointers in the host_to_guest mapping would become stale and cause
+all kinds of nasty issues.
+
+This patch fixes the issue by disallowing asynchronous teardown for
+guests with only 2 levels of page tables. Userspace should (and already
+does) try using the normal destroy if the asynchronous one fails.
+
+Update s390_replace_asce so it refuses to replace segment type ASCEs.
+This is still needed in case the normal destroy VM fails.
+
+Fixes: fb491d5500a7 ("KVM: s390: pv: asynchronous destroy for reboot")
+Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Message-Id: <20230421085036.52511-2-imbrenda@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/pv.c | 5 +++++
+ arch/s390/mm/gmap.c | 7 +++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/arch/s390/kvm/pv.c b/arch/s390/kvm/pv.c
+index e032ebbf51b97..3ce5f4351156a 100644
+--- a/arch/s390/kvm/pv.c
++++ b/arch/s390/kvm/pv.c
+@@ -314,6 +314,11 @@ int kvm_s390_pv_set_aside(struct kvm *kvm, u16 *rc, u16 *rrc)
+ */
+ if (kvm->arch.pv.set_aside)
+ return -EINVAL;
++
++ /* Guest with segment type ASCE, refuse to destroy asynchronously */
++ if ((kvm->arch.gmap->asce & _ASCE_TYPE_MASK) == _ASCE_TYPE_SEGMENT)
++ return -EINVAL;
++
+ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
+diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
+index 5a716bdcba05b..2267cf9819b2f 100644
+--- a/arch/s390/mm/gmap.c
++++ b/arch/s390/mm/gmap.c
+@@ -2833,6 +2833,9 @@ EXPORT_SYMBOL_GPL(s390_unlist_old_asce);
+ * s390_replace_asce - Try to replace the current ASCE of a gmap with a copy
+ * @gmap: the gmap whose ASCE needs to be replaced
+ *
++ * If the ASCE is a SEGMENT type then this function will return -EINVAL,
++ * otherwise the pointers in the host_to_guest radix tree will keep pointing
++ * to the wrong pages, causing use-after-free and memory corruption.
+ * If the allocation of the new top level page table fails, the ASCE is not
+ * replaced.
+ * In any case, the old ASCE is always removed from the gmap CRST list.
+@@ -2847,6 +2850,10 @@ int s390_replace_asce(struct gmap *gmap)
+
+ s390_unlist_old_asce(gmap);
+
++ /* Replacing segment type ASCEs would cause serious issues */
++ if ((gmap->asce & _ASCE_TYPE_MASK) == _ASCE_TYPE_SEGMENT)
++ return -EINVAL;
++
+ page = alloc_pages(GFP_KERNEL_ACCOUNT, CRST_ALLOC_ORDER);
+ if (!page)
+ return -ENOMEM;
+--
+2.39.2
+
--- /dev/null
+From 0d578de8876ba202f255a81fc951e6f6f1b698cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 16:07:27 -0700
+Subject: net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 93e0401e0fc0c54b0ac05b687cd135c2ac38187c ]
+
+The call to phy_stop() races with the later call to phy_disconnect(),
+resulting in concurrent phy_suspend() calls being run from different
+CPUs. The final call to phy_disconnect() ensures that the PHY is
+stopped and suspended, too.
+
+Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index d937daa8ee883..f28ffc31df220 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -3465,7 +3465,6 @@ static void bcmgenet_netif_stop(struct net_device *dev)
+ /* Disable MAC transmit. TX DMA disabled must be done before this */
+ umac_enable_set(priv, CMD_TX_EN, false);
+
+- phy_stop(dev->phydev);
+ bcmgenet_disable_rx_napi(priv);
+ bcmgenet_intr_disable(priv);
+
+--
+2.39.2
+
--- /dev/null
+From 3bf17adbd919ad3d453d284cfc5266a56d08ed8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 00:09:46 +0300
+Subject: net: dsa: mt7530: fix corrupt frames using trgmii on 40 MHz XTAL
+ MT7621
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arınç ÜNAL <arinc.unal@arinc9.com>
+
+[ Upstream commit 37c218d8021e36e226add4bab93d071d30fe0704 ]
+
+The multi-chip module MT7530 switch with a 40 MHz oscillator on the
+MT7621AT, MT7621DAT, and MT7621ST SoCs forwards corrupt frames using
+trgmii.
+
+This is caused by the assumption that MT7621 SoCs have got 150 MHz PLL,
+hence using the ncpo1 value, 0x0780.
+
+My testing shows this value works on Unielec U7621-06, Bartel's testing
+shows it won't work on Hi-Link HLK-MT7621A and Netgear WAC104. All devices
+tested have got 40 MHz oscillators.
+
+Using the value for 125 MHz PLL, 0x0640, works on all boards at hand. The
+definitions for 125 MHz PLL exist on the Banana Pi BPI-R2 BSP source code
+whilst 150 MHz PLL don't.
+
+Forwarding frames using trgmii on the MCM MT7530 switch with a 25 MHz
+oscillator on the said MT7621 SoCs works fine because the ncpo1 value
+defined for it is for 125 MHz PLL.
+
+Change the 150 MHz PLL comment to 125 MHz PLL, and use the 125 MHz PLL
+ncpo1 values for both oscillator frequencies.
+
+Link: https://github.com/BPI-SINOVOIP/BPI-R2-bsp/blob/81d24bbce7d99524d0771a8bdb2d6663e4eb4faa/u-boot-mt/drivers/net/rt2880_eth.c#L2195
+Fixes: 7ef6f6f8d237 ("net: dsa: mt7530: Add MT7621 TRGMII mode support")
+Tested-by: Bartel Eerdekens <bartel.eerdekens@constell8.be>
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mt7530.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 02410ac439b76..4d5c5820e4618 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -446,9 +446,9 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface)
+ else
+ ssc_delta = 0x87;
+ if (priv->id == ID_MT7621) {
+- /* PLL frequency: 150MHz: 1.2GBit */
++ /* PLL frequency: 125MHz: 1.0GBit */
+ if (xtal == HWTRAP_XTAL_40MHZ)
+- ncpo1 = 0x0780;
++ ncpo1 = 0x0640;
+ if (xtal == HWTRAP_XTAL_25MHZ)
+ ncpo1 = 0x0a00;
+ } else { /* PLL frequency: 250MHz: 2.0Gbit */
+--
+2.39.2
+
--- /dev/null
+From 2379aa0d88ce3da2717f67703cfa0fca5d5dc6b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 00:09:47 +0300
+Subject: net: dsa: mt7530: fix network connectivity with multiple CPU ports
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arınç ÜNAL <arinc.unal@arinc9.com>
+
+[ Upstream commit 120a56b01beed51ab5956a734adcfd2760307107 ]
+
+On mt753x_cpu_port_enable() there's code that enables flooding for the CPU
+port only. Since mt753x_cpu_port_enable() runs twice when both CPU ports
+are enabled, port 6 becomes the only port to forward the frames to. But
+port 5 is the active port, so no frames received from the user ports will
+be forwarded to port 5 which breaks network connectivity.
+
+Every bit of the BC_FFP, UNM_FFP, and UNU_FFP bits represents a port. Fix
+this issue by setting the bit that corresponds to the CPU port without
+overwriting the other bits.
+
+Clear the bits beforehand only for the MT7531 switch. According to the
+documents MT7621 Giga Switch Programming Guide v0.3 and MT7531 Reference
+Manual for Development Board v1.0, after reset, the BC_FFP, UNM_FFP, and
+UNU_FFP bits are set to 1 for MT7531, 0 for MT7530.
+
+The commit 5e5502e012b8 ("net: dsa: mt7530: fix roaming from DSA user
+ports") silently changed the method to set the bits on the MT7530_MFC.
+Instead of clearing the relevant bits before mt7530_cpu_port_enable()
+which runs under a for loop, the commit started doing it on
+mt7530_cpu_port_enable().
+
+Back then, this didn't really matter as only a single CPU port could be
+used since the CPU port number was hardcoded. The driver was later changed
+with commit 1f9a6abecf53 ("net: dsa: mt7530: get cpu-port via dp->cpu_dp
+instead of constant") to retrieve the CPU port via dp->cpu_dp. With that,
+this silent change became an issue for when using multiple CPU ports.
+
+Fixes: 5e5502e012b8 ("net: dsa: mt7530: fix roaming from DSA user ports")
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mt7530.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 8cbde093fbd9e..0c81f5830b90a 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -1008,9 +1008,9 @@ mt753x_cpu_port_enable(struct dsa_switch *ds, int port)
+ mt7530_write(priv, MT7530_PVC_P(port),
+ PORT_SPEC_TAG);
+
+- /* Disable flooding by default */
+- mt7530_rmw(priv, MT7530_MFC, BC_FFP_MASK | UNM_FFP_MASK | UNU_FFP_MASK,
+- BC_FFP(BIT(port)) | UNM_FFP(BIT(port)) | UNU_FFP(BIT(port)));
++ /* Enable flooding on the CPU port */
++ mt7530_set(priv, MT7530_MFC, BC_FFP(BIT(port)) | UNM_FFP(BIT(port)) |
++ UNU_FFP(BIT(port)));
+
+ /* Set CPU port number */
+ if (priv->id == ID_MT7621)
+@@ -2326,6 +2326,10 @@ mt7531_setup_common(struct dsa_switch *ds)
+ /* Enable and reset MIB counters */
+ mt7530_mib_reset(ds);
+
++ /* Disable flooding on all ports */
++ mt7530_clear(priv, MT7530_MFC, BC_FFP_MASK | UNM_FFP_MASK |
++ UNU_FFP_MASK);
++
+ for (i = 0; i < MT7530_NUM_PORTS; i++) {
+ /* Disable forwarding by default on all ports */
+ mt7530_rmw(priv, MT7530_PCR_P(i), PCR_MATRIX_MASK,
+--
+2.39.2
+
--- /dev/null
+From 8adcff83c85e20049014942c663610c9003337fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 02:19:02 +0100
+Subject: net: dsa: mt7530: split-off common parts from mt7531_setup
+
+From: Daniel Golle <daniel@makrotopia.org>
+
+[ Upstream commit 7f54cc9772ced2d76ac11832f0ada43798443ac9 ]
+
+MT7988 shares a significant part of the setup function with MT7531.
+Split-off those parts into a shared function which is going to be used
+also by mt7988_setup.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: 120a56b01bee ("net: dsa: mt7530: fix network connectivity with multiple CPU ports")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mt7530.c | 99 ++++++++++++++++++++++------------------
+ 1 file changed, 55 insertions(+), 44 deletions(-)
+
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 4d5c5820e4618..8cbde093fbd9e 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -2307,12 +2307,65 @@ mt7530_setup(struct dsa_switch *ds)
+ return 0;
+ }
+
++static int
++mt7531_setup_common(struct dsa_switch *ds)
++{
++ struct mt7530_priv *priv = ds->priv;
++ struct dsa_port *cpu_dp;
++ int ret, i;
++
++ /* BPDU to CPU port */
++ dsa_switch_for_each_cpu_port(cpu_dp, ds) {
++ mt7530_rmw(priv, MT7531_CFC, MT7531_CPU_PMAP_MASK,
++ BIT(cpu_dp->index));
++ break;
++ }
++ mt7530_rmw(priv, MT753X_BPC, MT753X_BPDU_PORT_FW_MASK,
++ MT753X_BPDU_CPU_ONLY);
++
++ /* Enable and reset MIB counters */
++ mt7530_mib_reset(ds);
++
++ for (i = 0; i < MT7530_NUM_PORTS; i++) {
++ /* Disable forwarding by default on all ports */
++ mt7530_rmw(priv, MT7530_PCR_P(i), PCR_MATRIX_MASK,
++ PCR_MATRIX_CLR);
++
++ /* Disable learning by default on all ports */
++ mt7530_set(priv, MT7530_PSC_P(i), SA_DIS);
++
++ mt7530_set(priv, MT7531_DBG_CNT(i), MT7531_DIS_CLR);
++
++ if (dsa_is_cpu_port(ds, i)) {
++ ret = mt753x_cpu_port_enable(ds, i);
++ if (ret)
++ return ret;
++ } else {
++ mt7530_port_disable(ds, i);
++
++ /* Set default PVID to 0 on all user ports */
++ mt7530_rmw(priv, MT7530_PPBV1_P(i), G0_PORT_VID_MASK,
++ G0_PORT_VID_DEF);
++ }
++
++ /* Enable consistent egress tag */
++ mt7530_rmw(priv, MT7530_PVC_P(i), PVC_EG_TAG_MASK,
++ PVC_EG_TAG(MT7530_VLAN_EG_CONSISTENT));
++ }
++
++ /* Flush the FDB table */
++ ret = mt7530_fdb_cmd(priv, MT7530_FDB_FLUSH, NULL);
++ if (ret < 0)
++ return ret;
++
++ return 0;
++}
++
+ static int
+ mt7531_setup(struct dsa_switch *ds)
+ {
+ struct mt7530_priv *priv = ds->priv;
+ struct mt7530_dummy_poll p;
+- struct dsa_port *cpu_dp;
+ u32 val, id;
+ int ret, i;
+
+@@ -2390,44 +2443,7 @@ mt7531_setup(struct dsa_switch *ds)
+ mt7531_ind_c45_phy_write(priv, MT753X_CTRL_PHY_ADDR, MDIO_MMD_VEND2,
+ CORE_PLL_GROUP4, val);
+
+- /* BPDU to CPU port */
+- dsa_switch_for_each_cpu_port(cpu_dp, ds) {
+- mt7530_rmw(priv, MT7531_CFC, MT7531_CPU_PMAP_MASK,
+- BIT(cpu_dp->index));
+- break;
+- }
+- mt7530_rmw(priv, MT753X_BPC, MT753X_BPDU_PORT_FW_MASK,
+- MT753X_BPDU_CPU_ONLY);
+-
+- /* Enable and reset MIB counters */
+- mt7530_mib_reset(ds);
+-
+- for (i = 0; i < MT7530_NUM_PORTS; i++) {
+- /* Disable forwarding by default on all ports */
+- mt7530_rmw(priv, MT7530_PCR_P(i), PCR_MATRIX_MASK,
+- PCR_MATRIX_CLR);
+-
+- /* Disable learning by default on all ports */
+- mt7530_set(priv, MT7530_PSC_P(i), SA_DIS);
+-
+- mt7530_set(priv, MT7531_DBG_CNT(i), MT7531_DIS_CLR);
+-
+- if (dsa_is_cpu_port(ds, i)) {
+- ret = mt753x_cpu_port_enable(ds, i);
+- if (ret)
+- return ret;
+- } else {
+- mt7530_port_disable(ds, i);
+-
+- /* Set default PVID to 0 on all user ports */
+- mt7530_rmw(priv, MT7530_PPBV1_P(i), G0_PORT_VID_MASK,
+- G0_PORT_VID_DEF);
+- }
+-
+- /* Enable consistent egress tag */
+- mt7530_rmw(priv, MT7530_PVC_P(i), PVC_EG_TAG_MASK,
+- PVC_EG_TAG(MT7530_VLAN_EG_CONSISTENT));
+- }
++ mt7531_setup_common(ds);
+
+ /* Setup VLAN ID 0 for VLAN-unaware bridges */
+ ret = mt7530_setup_vlan0(priv);
+@@ -2437,11 +2453,6 @@ mt7531_setup(struct dsa_switch *ds)
+ ds->assisted_learning_on_cpu_port = true;
+ ds->mtu_enforcement_ingress = true;
+
+- /* Flush the FDB table */
+- ret = mt7530_fdb_cmd(priv, MT7530_FDB_FLUSH, NULL);
+- if (ret < 0)
+- return ret;
+-
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From a1d7e68d382f29b6e88a2fd495065c95f249f99c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 22:28:15 +0200
+Subject: net: dsa: mv88e6xxx: add mv88e6321 rsvd2cpu
+
+From: Angelo Dureghello <angelo.dureghello@timesys.com>
+
+[ Upstream commit 6686317855c6997671982d4489ccdd946f644957 ]
+
+Add rsvd2cpu capability for mv88e6321 model, to allow proper bpdu
+processing.
+
+Signed-off-by: Angelo Dureghello <angelo.dureghello@timesys.com>
+Fixes: 51c901a775621 ("net: dsa: mv88e6xxx: distinguish Global 2 Rsvd2CPU")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 7108f745fbf01..902f407213404 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -5182,6 +5182,7 @@ static const struct mv88e6xxx_ops mv88e6321_ops = {
+ .set_cpu_port = mv88e6095_g1_set_cpu_port,
+ .set_egress_port = mv88e6095_g1_set_egress_port,
+ .watchdog_ops = &mv88e6390_watchdog_ops,
++ .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
+ .reset = mv88e6352_g1_reset,
+ .vtu_getnext = mv88e6185_g1_vtu_getnext,
+ .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge,
+--
+2.39.2
+
--- /dev/null
+From b2fce6a795e4d103c76c78e2d516fc8df6888a86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 16:03:59 +0800
+Subject: net: enetc: check the index of the SFI rather than the handle
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit 299efdc2380aac588557f4d0b2ce7bee05bd0cf2 ]
+
+We should check whether the current SFI (Stream Filter Instance) table
+is full before creating a new SFI entry. However, the previous logic
+checks the handle by mistake and might lead to unpredictable behavior.
+
+Fixes: 888ae5a3952b ("net: enetc: add tc flower psfp offload driver")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc_qos.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_qos.c b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
+index 130ebf6853e61..83c27bbbc6edf 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_qos.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
+@@ -1247,7 +1247,7 @@ static int enetc_psfp_parse_clsflower(struct enetc_ndev_priv *priv,
+ int index;
+
+ index = enetc_get_free_index(priv);
+- if (sfi->handle < 0) {
++ if (index < 0) {
+ NL_SET_ERR_MSG_MOD(extack, "No Stream Filter resource!");
+ err = -ENOSPC;
+ goto free_fmi;
+--
+2.39.2
+
--- /dev/null
+From 9e4c18146ae91894707fdcb0e47f1a3dcf009478 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 19:21:53 +0200
+Subject: net: ethernet: mtk_eth_soc: drop generic vlan rx offload, only use
+ DSA untagging
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit c6d96df9fa2c1d19525239d4262889cce594ce6c ]
+
+Through testing I found out that hardware vlan rx offload support seems to
+have some hardware issues. At least when using multiple MACs and when
+receiving tagged packets on the secondary MAC, the hardware can sometimes
+start to emit wrong tags on the first MAC as well.
+
+In order to avoid such issues, drop the feature configuration and use
+the offload feature only for DSA hardware untagging on MT7621/MT7622
+devices where this feature works properly.
+
+Fixes: 08666cbb7dd5 ("net: ethernet: mtk_eth_soc: add support for configuring vlan rx offload")
+Tested-by: Frank Wunderlich <frank-w@public-files.de>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
+Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Link: https://lore.kernel.org/r/20230426172153.8352-1-linux@fw-web.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 106 ++++++++------------
+ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 1 -
+ 2 files changed, 40 insertions(+), 67 deletions(-)
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index e14050e178624..c9fb1d7084d57 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1921,9 +1921,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
+
+ while (done < budget) {
+ unsigned int pktlen, *rxdcsum;
+- bool has_hwaccel_tag = false;
+ struct net_device *netdev;
+- u16 vlan_proto, vlan_tci;
+ dma_addr_t dma_addr;
+ u32 hash, reason;
+ int mac = 0;
+@@ -2058,31 +2056,16 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
+ skb_checksum_none_assert(skb);
+ skb->protocol = eth_type_trans(skb, netdev);
+
+- if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX) {
+- if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+- if (trxd.rxd3 & RX_DMA_VTAG_V2) {
+- vlan_proto = RX_DMA_VPID(trxd.rxd4);
+- vlan_tci = RX_DMA_VID(trxd.rxd4);
+- has_hwaccel_tag = true;
+- }
+- } else if (trxd.rxd2 & RX_DMA_VTAG) {
+- vlan_proto = RX_DMA_VPID(trxd.rxd3);
+- vlan_tci = RX_DMA_VID(trxd.rxd3);
+- has_hwaccel_tag = true;
+- }
+- }
+-
+ /* When using VLAN untagging in combination with DSA, the
+ * hardware treats the MTK special tag as a VLAN and untags it.
+ */
+- if (has_hwaccel_tag && netdev_uses_dsa(netdev)) {
+- unsigned int port = vlan_proto & GENMASK(2, 0);
++ if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2) &&
++ (trxd.rxd2 & RX_DMA_VTAG) && netdev_uses_dsa(netdev)) {
++ unsigned int port = RX_DMA_VPID(trxd.rxd3) & GENMASK(2, 0);
+
+ if (port < ARRAY_SIZE(eth->dsa_meta) &&
+ eth->dsa_meta[port])
+ skb_dst_set_noref(skb, ð->dsa_meta[port]->dst);
+- } else if (has_hwaccel_tag) {
+- __vlan_hwaccel_put_tag(skb, htons(vlan_proto), vlan_tci);
+ }
+
+ if (reason == MTK_PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED)
+@@ -2910,29 +2893,11 @@ static netdev_features_t mtk_fix_features(struct net_device *dev,
+
+ static int mtk_set_features(struct net_device *dev, netdev_features_t features)
+ {
+- struct mtk_mac *mac = netdev_priv(dev);
+- struct mtk_eth *eth = mac->hw;
+ netdev_features_t diff = dev->features ^ features;
+- int i;
+
+ if ((diff & NETIF_F_LRO) && !(features & NETIF_F_LRO))
+ mtk_hwlro_netdev_disable(dev);
+
+- /* Set RX VLAN offloading */
+- if (!(diff & NETIF_F_HW_VLAN_CTAG_RX))
+- return 0;
+-
+- mtk_w32(eth, !!(features & NETIF_F_HW_VLAN_CTAG_RX),
+- MTK_CDMP_EG_CTRL);
+-
+- /* sync features with other MAC */
+- for (i = 0; i < MTK_MAC_COUNT; i++) {
+- if (!eth->netdev[i] || eth->netdev[i] == dev)
+- continue;
+- eth->netdev[i]->features &= ~NETIF_F_HW_VLAN_CTAG_RX;
+- eth->netdev[i]->features |= features & NETIF_F_HW_VLAN_CTAG_RX;
+- }
+-
+ return 0;
+ }
+
+@@ -3250,30 +3215,6 @@ static int mtk_open(struct net_device *dev)
+ struct mtk_eth *eth = mac->hw;
+ int i, err;
+
+- if (mtk_uses_dsa(dev) && !eth->prog) {
+- for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
+- struct metadata_dst *md_dst = eth->dsa_meta[i];
+-
+- if (md_dst)
+- continue;
+-
+- md_dst = metadata_dst_alloc(0, METADATA_HW_PORT_MUX,
+- GFP_KERNEL);
+- if (!md_dst)
+- return -ENOMEM;
+-
+- md_dst->u.port_info.port_id = i;
+- eth->dsa_meta[i] = md_dst;
+- }
+- } else {
+- /* Hardware special tag parsing needs to be disabled if at least
+- * one MAC does not use DSA.
+- */
+- u32 val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
+- val &= ~MTK_CDMP_STAG_EN;
+- mtk_w32(eth, val, MTK_CDMP_IG_CTRL);
+- }
+-
+ err = phylink_of_phy_connect(mac->phylink, mac->of_node, 0);
+ if (err) {
+ netdev_err(dev, "%s: could not attach PHY: %d\n", __func__,
+@@ -3312,6 +3253,40 @@ static int mtk_open(struct net_device *dev)
+ phylink_start(mac->phylink);
+ netif_tx_start_all_queues(dev);
+
++ if (MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2))
++ return 0;
++
++ if (mtk_uses_dsa(dev) && !eth->prog) {
++ for (i = 0; i < ARRAY_SIZE(eth->dsa_meta); i++) {
++ struct metadata_dst *md_dst = eth->dsa_meta[i];
++
++ if (md_dst)
++ continue;
++
++ md_dst = metadata_dst_alloc(0, METADATA_HW_PORT_MUX,
++ GFP_KERNEL);
++ if (!md_dst)
++ return -ENOMEM;
++
++ md_dst->u.port_info.port_id = i;
++ eth->dsa_meta[i] = md_dst;
++ }
++ } else {
++ /* Hardware special tag parsing needs to be disabled if at least
++ * one MAC does not use DSA.
++ */
++ u32 val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
++
++ val &= ~MTK_CDMP_STAG_EN;
++ mtk_w32(eth, val, MTK_CDMP_IG_CTRL);
++
++ val = mtk_r32(eth, MTK_CDMQ_IG_CTRL);
++ val &= ~MTK_CDMQ_STAG_EN;
++ mtk_w32(eth, val, MTK_CDMQ_IG_CTRL);
++
++ mtk_w32(eth, 0, MTK_CDMP_EG_CTRL);
++ }
++
+ return 0;
+ }
+
+@@ -3796,10 +3771,9 @@ static int mtk_hw_init(struct mtk_eth *eth, bool reset)
+ if (!MTK_HAS_CAPS(eth->soc->caps, MTK_NETSYS_V2)) {
+ val = mtk_r32(eth, MTK_CDMP_IG_CTRL);
+ mtk_w32(eth, val | MTK_CDMP_STAG_EN, MTK_CDMP_IG_CTRL);
+- }
+
+- /* Enable RX VLan Offloading */
+- mtk_w32(eth, 1, MTK_CDMP_EG_CTRL);
++ mtk_w32(eth, 1, MTK_CDMP_EG_CTRL);
++ }
+
+ /* set interrupt delays based on current Net DIM sample */
+ mtk_dim_rx(ð->rx_dim.work);
+@@ -4437,7 +4411,7 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
+ eth->netdev[id]->hw_features |= NETIF_F_LRO;
+
+ eth->netdev[id]->vlan_features = eth->soc->hw_features &
+- ~(NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX);
++ ~NETIF_F_HW_VLAN_CTAG_TX;
+ eth->netdev[id]->features |= eth->soc->hw_features;
+ eth->netdev[id]->ethtool_ops = &mtk_ethtool_ops;
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+index 084a6badef6d9..ac57dc87c59a3 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -48,7 +48,6 @@
+ #define MTK_HW_FEATURES (NETIF_F_IP_CSUM | \
+ NETIF_F_RXCSUM | \
+ NETIF_F_HW_VLAN_CTAG_TX | \
+- NETIF_F_HW_VLAN_CTAG_RX | \
+ NETIF_F_SG | NETIF_F_TSO | \
+ NETIF_F_TSO6 | \
+ NETIF_F_IPV6_CSUM |\
+--
+2.39.2
+
--- /dev/null
+From bff27c9775f1d011e0c52e75c304a3c5a0eef4be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 10:35:17 -0500
+Subject: net: fec: correct the counting of XDP sent frames
+
+From: Shenwei Wang <shenwei.wang@nxp.com>
+
+[ Upstream commit 26312c685ae0bca61e06ac75ee158b1e69546415 ]
+
+In the current xdp_xmit implementation, if any single frame fails to
+transmit due to insufficient buffer descriptors, the function nevertheless
+reports success in sending all frames. This results in erroneously
+indicating that frames were transmitted when in fact they were dropped.
+
+This patch fixes the issue by ensureing the return value properly
+indicates the actual number of frames successfully transmitted, rather than
+potentially reporting success for all frames when some could not transmit.
+
+Fixes: 6d6b39f180b8 ("net: fec: add initial XDP support")
+Signed-off-by: Gagandeep Singh <g.singh@nxp.com>
+Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 160c1b3525f5b..42ec6ca3bf035 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3798,7 +3798,8 @@ static int fec_enet_txq_xmit_frame(struct fec_enet_private *fep,
+ entries_free = fec_enet_get_free_txdesc_num(txq);
+ if (entries_free < MAX_SKB_FRAGS + 1) {
+ netdev_err(fep->netdev, "NOT enough BD for SG!\n");
+- return NETDEV_TX_OK;
++ xdp_return_frame(frame);
++ return NETDEV_TX_BUSY;
+ }
+
+ /* Fill in a Tx ring entry */
+@@ -3856,6 +3857,7 @@ static int fec_enet_xdp_xmit(struct net_device *dev,
+ struct fec_enet_private *fep = netdev_priv(dev);
+ struct fec_enet_priv_tx_q *txq;
+ int cpu = smp_processor_id();
++ unsigned int sent_frames = 0;
+ struct netdev_queue *nq;
+ unsigned int queue;
+ int i;
+@@ -3866,8 +3868,11 @@ static int fec_enet_xdp_xmit(struct net_device *dev,
+
+ __netif_tx_lock(nq, cpu);
+
+- for (i = 0; i < num_frames; i++)
+- fec_enet_txq_xmit_frame(fep, txq, frames[i]);
++ for (i = 0; i < num_frames; i++) {
++ if (fec_enet_txq_xmit_frame(fep, txq, frames[i]) != 0)
++ break;
++ sent_frames++;
++ }
+
+ /* Make sure the update to bdp and tx_skbuff are performed. */
+ wmb();
+@@ -3877,7 +3882,7 @@ static int fec_enet_xdp_xmit(struct net_device *dev,
+
+ __netif_tx_unlock(nq);
+
+- return num_frames;
++ return sent_frames;
+ }
+
+ static const struct net_device_ops fec_netdev_ops = {
+--
+2.39.2
+
--- /dev/null
+From 5f3de268eaee3eec8647bcae9384d7942b2073c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 11:21:59 +0200
+Subject: net: ipv6: fix skb hash for some RST packets
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit dc6456e938e938d64ffb6383a286b2ac9790a37f ]
+
+The skb hash comes from sk->sk_txhash when using TCP, except for some
+IPv6 RST packets. This is because in tcp_v6_send_reset when not in
+TIME_WAIT the hash is taken from sk->sk_hash, while it should come from
+sk->sk_txhash as those two hashes are not computed the same way.
+
+Packetdrill script to test the above,
+
+ 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+ +0 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0
+ +0 connect(3, ..., ...) = -1 EINPROGRESS (Operation now in progress)
+
+ +0 > (flowlabel 0x1) S 0:0(0) <...>
+
+ // Wrong ack seq, trigger a rst.
+ +0 < S. 0:0(0) ack 0 win 4000
+
+ // Check the flowlabel matches prior one from SYN.
+ +0 > (flowlabel 0x1) R 0:0(0) <...>
+
+Fixes: 9258b8b1be2e ("ipv6: tcp: send consistent autoflowlabel in RST packets")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/tcp_ipv6.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 1e747241c7710..4d52e25deb9e3 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1064,7 +1064,7 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
+ if (np->repflow)
+ label = ip6_flowlabel(ipv6h);
+ priority = sk->sk_priority;
+- txhash = sk->sk_hash;
++ txhash = sk->sk_txhash;
+ }
+ if (sk->sk_state == TCP_TIME_WAIT) {
+ label = cpu_to_be32(inet_twsk(sk)->tw_flowlabel);
+--
+2.39.2
+
--- /dev/null
+From 9c010c726bfa66f10d2cb8037d8a13e170f6923e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 16:13:50 +0800
+Subject: net/ncsi: clear Tx enable mode when handling a Config required AEN
+
+From: Cosmo Chou <chou.cosmo@gmail.com>
+
+[ Upstream commit 6f75cd166a5a3c0bc50441faa8b8304f60522fdd ]
+
+ncsi_channel_is_tx() determines whether a given channel should be
+used for Tx or not. However, when reconfiguring the channel by
+handling a Configuration Required AEN, there is a misjudgment that
+the channel Tx has already been enabled, which results in the Enable
+Channel Network Tx command not being sent.
+
+Clear the channel Tx enable flag before reconfiguring the channel to
+avoid the misjudgment.
+
+Fixes: 8d951a75d022 ("net/ncsi: Configure multi-package, multi-channel modes with failover")
+Signed-off-by: Cosmo Chou <chou.cosmo@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ncsi/ncsi-aen.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c
+index b635c194f0a85..62fb1031763d1 100644
+--- a/net/ncsi/ncsi-aen.c
++++ b/net/ncsi/ncsi-aen.c
+@@ -165,6 +165,7 @@ static int ncsi_aen_handler_cr(struct ncsi_dev_priv *ndp,
+ nc->state = NCSI_CHANNEL_INACTIVE;
+ list_add_tail_rcu(&nc->link, &ndp->channel_queue);
+ spin_unlock_irqrestore(&ndp->lock, flags);
++ nc->modes[NCSI_MODE_TX_ENABLE].enable = 0;
+
+ return ncsi_process_next_channel(ndp);
+ }
+--
+2.39.2
+
--- /dev/null
+From 367270f9d07b91bf4d779371b2d6e9efa56bc7cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 15:19:40 +0000
+Subject: net/sched: act_mirred: Add carrier check
+
+From: Victor Nogueira <victor@mojatatu.com>
+
+[ Upstream commit 526f28bd0fbdc699cda31426928802650c1528e5 ]
+
+There are cases where the device is adminstratively UP, but operationally
+down. For example, we have a physical device (Nvidia ConnectX-6 Dx, 25Gbps)
+who's cable was pulled out, here is its ip link output:
+
+5: ens2f1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000
+ link/ether b8:ce:f6:4b:68:35 brd ff:ff:ff:ff:ff:ff
+ altname enp179s0f1np1
+
+As you can see, it's administratively UP but operationally down.
+In this case, sending a packet to this port caused a nasty kernel hang (so
+nasty that we were unable to capture it). Aborting a transmit based on
+operational status (in addition to administrative status) fixes the issue.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Victor Nogueira <victor@mojatatu.com>
+v1->v2: Add fixes tag
+v2->v3: Remove blank line between tags + add change log, suggested by Leon
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_mirred.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index 8037ec9b1d311..a61482c5edbe7 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -264,7 +264,7 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,
+ goto out;
+ }
+
+- if (unlikely(!(dev->flags & IFF_UP))) {
++ if (unlikely(!(dev->flags & IFF_UP)) || !netif_carrier_ok(dev)) {
+ net_notice_ratelimited("tc mirred to Houston: device %s is down\n",
+ dev->name);
+ goto out;
+--
+2.39.2
+
--- /dev/null
+From 063cfe8a23cc8d371aa32b0e31f7abe1c10c54ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 14:31:11 +0200
+Subject: net/sched: cls_api: remove block_cb from driver_list before freeing
+
+From: Vlad Buslov <vladbu@nvidia.com>
+
+[ Upstream commit da94a7781fc3c92e7df7832bc2746f4d39bc624e ]
+
+Error handler of tcf_block_bind() frees the whole bo->cb_list on error.
+However, by that time the flow_block_cb instances are already in the driver
+list because driver ndo_setup_tc() callback is called before that up the
+call chain in tcf_block_offload_cmd(). This leaves dangling pointers to
+freed objects in the list and causes use-after-free[0]. Fix it by also
+removing flow_block_cb instances from driver_list before deallocating them.
+
+[0]:
+[ 279.868433] ==================================================================
+[ 279.869964] BUG: KASAN: slab-use-after-free in flow_block_cb_setup_simple+0x631/0x7c0
+[ 279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963
+
+[ 279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6+ #4
+[ 279.874273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+[ 279.876295] Call Trace:
+[ 279.876882] <TASK>
+[ 279.877413] dump_stack_lvl+0x33/0x50
+[ 279.878198] print_report+0xc2/0x610
+[ 279.878987] ? flow_block_cb_setup_simple+0x631/0x7c0
+[ 279.879994] kasan_report+0xae/0xe0
+[ 279.880750] ? flow_block_cb_setup_simple+0x631/0x7c0
+[ 279.881744] ? mlx5e_tc_reoffload_flows_work+0x240/0x240 [mlx5_core]
+[ 279.883047] flow_block_cb_setup_simple+0x631/0x7c0
+[ 279.884027] tcf_block_offload_cmd.isra.0+0x189/0x2d0
+[ 279.885037] ? tcf_block_setup+0x6b0/0x6b0
+[ 279.885901] ? mutex_lock+0x7d/0xd0
+[ 279.886669] ? __mutex_unlock_slowpath.constprop.0+0x2d0/0x2d0
+[ 279.887844] ? ingress_init+0x1c0/0x1c0 [sch_ingress]
+[ 279.888846] tcf_block_get_ext+0x61c/0x1200
+[ 279.889711] ingress_init+0x112/0x1c0 [sch_ingress]
+[ 279.890682] ? clsact_init+0x2b0/0x2b0 [sch_ingress]
+[ 279.891701] qdisc_create+0x401/0xea0
+[ 279.892485] ? qdisc_tree_reduce_backlog+0x470/0x470
+[ 279.893473] tc_modify_qdisc+0x6f7/0x16d0
+[ 279.894344] ? tc_get_qdisc+0xac0/0xac0
+[ 279.895213] ? mutex_lock+0x7d/0xd0
+[ 279.896005] ? __mutex_lock_slowpath+0x10/0x10
+[ 279.896910] rtnetlink_rcv_msg+0x5fe/0x9d0
+[ 279.897770] ? rtnl_calcit.isra.0+0x2b0/0x2b0
+[ 279.898672] ? __sys_sendmsg+0xb5/0x140
+[ 279.899494] ? do_syscall_64+0x3d/0x90
+[ 279.900302] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0
+[ 279.901337] ? kasan_save_stack+0x2e/0x40
+[ 279.902177] ? kasan_save_stack+0x1e/0x40
+[ 279.903058] ? kasan_set_track+0x21/0x30
+[ 279.903913] ? kasan_save_free_info+0x2a/0x40
+[ 279.904836] ? ____kasan_slab_free+0x11a/0x1b0
+[ 279.905741] ? kmem_cache_free+0x179/0x400
+[ 279.906599] netlink_rcv_skb+0x12c/0x360
+[ 279.907450] ? rtnl_calcit.isra.0+0x2b0/0x2b0
+[ 279.908360] ? netlink_ack+0x1550/0x1550
+[ 279.909192] ? rhashtable_walk_peek+0x170/0x170
+[ 279.910135] ? kmem_cache_alloc_node+0x1af/0x390
+[ 279.911086] ? _copy_from_iter+0x3d6/0xc70
+[ 279.912031] netlink_unicast+0x553/0x790
+[ 279.912864] ? netlink_attachskb+0x6a0/0x6a0
+[ 279.913763] ? netlink_recvmsg+0x416/0xb50
+[ 279.914627] netlink_sendmsg+0x7a1/0xcb0
+[ 279.915473] ? netlink_unicast+0x790/0x790
+[ 279.916334] ? iovec_from_user.part.0+0x4d/0x220
+[ 279.917293] ? netlink_unicast+0x790/0x790
+[ 279.918159] sock_sendmsg+0xc5/0x190
+[ 279.918938] ____sys_sendmsg+0x535/0x6b0
+[ 279.919813] ? import_iovec+0x7/0x10
+[ 279.920601] ? kernel_sendmsg+0x30/0x30
+[ 279.921423] ? __copy_msghdr+0x3c0/0x3c0
+[ 279.922254] ? import_iovec+0x7/0x10
+[ 279.923041] ___sys_sendmsg+0xeb/0x170
+[ 279.923854] ? copy_msghdr_from_user+0x110/0x110
+[ 279.924797] ? ___sys_recvmsg+0xd9/0x130
+[ 279.925630] ? __perf_event_task_sched_in+0x183/0x470
+[ 279.926656] ? ___sys_sendmsg+0x170/0x170
+[ 279.927529] ? ctx_sched_in+0x530/0x530
+[ 279.928369] ? update_curr+0x283/0x4f0
+[ 279.929185] ? perf_event_update_userpage+0x570/0x570
+[ 279.930201] ? __fget_light+0x57/0x520
+[ 279.931023] ? __switch_to+0x53d/0xe70
+[ 279.931846] ? sockfd_lookup_light+0x1a/0x140
+[ 279.932761] __sys_sendmsg+0xb5/0x140
+[ 279.933560] ? __sys_sendmsg_sock+0x20/0x20
+[ 279.934436] ? fpregs_assert_state_consistent+0x1d/0xa0
+[ 279.935490] do_syscall_64+0x3d/0x90
+[ 279.936300] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+[ 279.937311] RIP: 0033:0x7f21c814f887
+[ 279.938085] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
+[ 279.941448] RSP: 002b:00007fff11efd478 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+[ 279.942964] RAX: ffffffffffffffda RBX: 0000000064401979 RCX: 00007f21c814f887
+[ 279.944337] RDX: 0000000000000000 RSI: 00007fff11efd4e0 RDI: 0000000000000003
+[ 279.945660] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
+[ 279.947003] R10: 00007f21c8008708 R11: 0000000000000246 R12: 0000000000000001
+[ 279.948345] R13: 0000000000409980 R14: 000000000047e538 R15: 0000000000485400
+[ 279.949690] </TASK>
+
+[ 279.950706] Allocated by task 2960:
+[ 279.951471] kasan_save_stack+0x1e/0x40
+[ 279.952338] kasan_set_track+0x21/0x30
+[ 279.953165] __kasan_kmalloc+0x77/0x90
+[ 279.954006] flow_block_cb_setup_simple+0x3dd/0x7c0
+[ 279.955001] tcf_block_offload_cmd.isra.0+0x189/0x2d0
+[ 279.956020] tcf_block_get_ext+0x61c/0x1200
+[ 279.956881] ingress_init+0x112/0x1c0 [sch_ingress]
+[ 279.957873] qdisc_create+0x401/0xea0
+[ 279.958656] tc_modify_qdisc+0x6f7/0x16d0
+[ 279.959506] rtnetlink_rcv_msg+0x5fe/0x9d0
+[ 279.960392] netlink_rcv_skb+0x12c/0x360
+[ 279.961216] netlink_unicast+0x553/0x790
+[ 279.962044] netlink_sendmsg+0x7a1/0xcb0
+[ 279.962906] sock_sendmsg+0xc5/0x190
+[ 279.963702] ____sys_sendmsg+0x535/0x6b0
+[ 279.964534] ___sys_sendmsg+0xeb/0x170
+[ 279.965343] __sys_sendmsg+0xb5/0x140
+[ 279.966132] do_syscall_64+0x3d/0x90
+[ 279.966908] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+[ 279.968407] Freed by task 2960:
+[ 279.969114] kasan_save_stack+0x1e/0x40
+[ 279.969929] kasan_set_track+0x21/0x30
+[ 279.970729] kasan_save_free_info+0x2a/0x40
+[ 279.971603] ____kasan_slab_free+0x11a/0x1b0
+[ 279.972483] __kmem_cache_free+0x14d/0x280
+[ 279.973337] tcf_block_setup+0x29d/0x6b0
+[ 279.974173] tcf_block_offload_cmd.isra.0+0x226/0x2d0
+[ 279.975186] tcf_block_get_ext+0x61c/0x1200
+[ 279.976080] ingress_init+0x112/0x1c0 [sch_ingress]
+[ 279.977065] qdisc_create+0x401/0xea0
+[ 279.977857] tc_modify_qdisc+0x6f7/0x16d0
+[ 279.978695] rtnetlink_rcv_msg+0x5fe/0x9d0
+[ 279.979562] netlink_rcv_skb+0x12c/0x360
+[ 279.980388] netlink_unicast+0x553/0x790
+[ 279.981214] netlink_sendmsg+0x7a1/0xcb0
+[ 279.982043] sock_sendmsg+0xc5/0x190
+[ 279.982827] ____sys_sendmsg+0x535/0x6b0
+[ 279.983703] ___sys_sendmsg+0xeb/0x170
+[ 279.984510] __sys_sendmsg+0xb5/0x140
+[ 279.985298] do_syscall_64+0x3d/0x90
+[ 279.986076] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+[ 279.987532] The buggy address belongs to the object at ffff888147e2bf00
+ which belongs to the cache kmalloc-192 of size 192
+[ 279.989747] The buggy address is located 32 bytes inside of
+ freed 192-byte region [ffff888147e2bf00, ffff888147e2bfc0)
+
+[ 279.992367] The buggy address belongs to the physical page:
+[ 279.993430] page:00000000550f405c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x147e2a
+[ 279.995182] head:00000000550f405c order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0
+[ 279.996713] anon flags: 0x200000000010200(slab|head|node=0|zone=2)
+[ 279.997878] raw: 0200000000010200 ffff888100042a00 0000000000000000 dead000000000001
+[ 279.999384] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
+[ 280.000894] page dumped because: kasan: bad access detected
+
+[ 280.002386] Memory state around the buggy address:
+[ 280.003338] ffff888147e2be00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 280.004781] ffff888147e2be80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
+[ 280.006224] >ffff888147e2bf00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 280.007700] ^
+[ 280.008592] ffff888147e2bf80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
+[ 280.010035] ffff888147e2c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+[ 280.011564] ==================================================================
+
+Fixes: 59094b1e5094 ("net: sched: use flow block API")
+Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/cls_api.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 3c3629c9e7b65..2621550bfddc1 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -1589,6 +1589,7 @@ static int tcf_block_bind(struct tcf_block *block,
+
+ err_unroll:
+ list_for_each_entry_safe(block_cb, next, &bo->cb_list, list) {
++ list_del(&block_cb->driver_list);
+ if (i-- > 0) {
+ list_del(&block_cb->list);
+ tcf_block_playback_offloads(block, block_cb->cb,
+--
+2.39.2
+
--- /dev/null
+From 8fbdc60090c1056b09292569fb189a7d423a0256 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 20:16:16 +0200
+Subject: net/sched: flower: fix error handler on replace
+
+From: Vlad Buslov <vladbu@nvidia.com>
+
+[ Upstream commit fd741f0d9f702c193b2b44225c004f8c5d5be163 ]
+
+When replacing a filter (i.e. 'fold' pointer is not NULL) the insertion of
+new filter to idr is postponed until later in code since handle is already
+provided by the user. However, the error handling code in fl_change()
+always assumes that the new filter had been inserted into idr. If error
+handler is reached when replacing existing filter it may remove it from idr
+therefore making it unreachable for delete or dump afterwards. Fix the
+issue by verifying that 'fold' argument wasn't provided by caller before
+calling idr_remove().
+
+Fixes: 08a0063df3ae ("net/sched: flower: Move filter handle initialization earlier")
+Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
+Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/cls_flower.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index d62947eef9727..72edaa6277ce1 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -2339,7 +2339,8 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
+ errout_mask:
+ fl_mask_put(head, fnew->mask);
+ errout_idr:
+- idr_remove(&head->handle_idr, fnew->handle);
++ if (!fold)
++ idr_remove(&head->handle_idr, fnew->handle);
+ __fl_put(fnew);
+ errout_tb:
+ kfree(tb);
+--
+2.39.2
+
--- /dev/null
+From bac20d112038afbe34455708329c50f674c5bc7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 20:16:14 +0200
+Subject: net/sched: flower: fix filter idr initialization
+
+From: Vlad Buslov <vladbu@nvidia.com>
+
+[ Upstream commit dd4f6bbfa646f258e5bcdfac57a5c413d687f588 ]
+
+The cited commit moved idr initialization too early in fl_change() which
+allows concurrent users to access the filter that is still being
+initialized and is in inconsistent state, which, in turn, can cause NULL
+pointer dereference [0]. Since there is no obvious way to fix the ordering
+without reverting the whole cited commit, alternative approach taken to
+first insert NULL pointer into idr in order to allocate the handle but
+still cause fl_get() to return NULL and prevent concurrent users from
+seeing the filter while providing miss-to-action infrastructure with valid
+handle id early in fl_change().
+
+[ 152.434728] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN
+[ 152.436163] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
+[ 152.437269] CPU: 4 PID: 3877 Comm: tc Not tainted 6.3.0-rc4+ #5
+[ 152.438110] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+[ 152.439644] RIP: 0010:fl_dump_key+0x8b/0x1d10 [cls_flower]
+[ 152.440461] Code: 01 f2 02 f2 c7 40 08 04 f2 04 f2 c7 40 0c 04 f3 f3 f3 65 48 8b 04 25 28 00 00 00 48 89 84 24 00 01 00 00 48 89 c8 48 c1 e8 03 <0f> b6 04 10 84 c0 74 08 3c 03 0f 8e 98 19 00 00 8b 13 85 d2 74 57
+[ 152.442885] RSP: 0018:ffff88817a28f158 EFLAGS: 00010246
+[ 152.443851] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
+[ 152.444826] RDX: dffffc0000000000 RSI: ffffffff8500ae80 RDI: ffff88810a987900
+[ 152.445791] RBP: ffff888179d88240 R08: ffff888179d8845c R09: ffff888179d88240
+[ 152.446780] R10: ffffed102f451e48 R11: 00000000fffffff2 R12: ffff88810a987900
+[ 152.447741] R13: ffffffff8500ae80 R14: ffff88810a987900 R15: ffff888149b3c738
+[ 152.448756] FS: 00007f5eb2a34800(0000) GS:ffff88881ec00000(0000) knlGS:0000000000000000
+[ 152.449888] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 152.450685] CR2: 000000000046ad19 CR3: 000000010b0bd006 CR4: 0000000000370ea0
+[ 152.451641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 152.452628] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 152.453588] Call Trace:
+[ 152.454032] <TASK>
+[ 152.454447] ? netlink_sendmsg+0x7a1/0xcb0
+[ 152.455109] ? sock_sendmsg+0xc5/0x190
+[ 152.455689] ? ____sys_sendmsg+0x535/0x6b0
+[ 152.456320] ? ___sys_sendmsg+0xeb/0x170
+[ 152.456916] ? do_syscall_64+0x3d/0x90
+[ 152.457529] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0
+[ 152.458321] ? ___sys_sendmsg+0xeb/0x170
+[ 152.458958] ? __sys_sendmsg+0xb5/0x140
+[ 152.459564] ? do_syscall_64+0x3d/0x90
+[ 152.460122] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0
+[ 152.460852] ? fl_dump_key_options.part.0+0xea0/0xea0 [cls_flower]
+[ 152.461710] ? _raw_spin_lock+0x7a/0xd0
+[ 152.462299] ? _raw_read_lock_irq+0x30/0x30
+[ 152.462924] ? nla_put+0x15e/0x1c0
+[ 152.463480] fl_dump+0x228/0x650 [cls_flower]
+[ 152.464112] ? fl_tmplt_dump+0x210/0x210 [cls_flower]
+[ 152.464854] ? __kmem_cache_alloc_node+0x1a7/0x330
+[ 152.465592] ? nla_put+0x15e/0x1c0
+[ 152.466160] tcf_fill_node+0x515/0x9a0
+[ 152.466766] ? tc_setup_offload_action+0xf0/0xf0
+[ 152.467463] ? __alloc_skb+0x13c/0x2a0
+[ 152.468067] ? __build_skb_around+0x330/0x330
+[ 152.468814] ? fl_get+0x107/0x1a0 [cls_flower]
+[ 152.469503] tc_del_tfilter+0x718/0x1330
+[ 152.470115] ? is_bpf_text_address+0xa/0x20
+[ 152.470765] ? tc_ctl_chain+0xee0/0xee0
+[ 152.471335] ? __kernel_text_address+0xe/0x30
+[ 152.471948] ? unwind_get_return_address+0x56/0xa0
+[ 152.472639] ? __thaw_task+0x150/0x150
+[ 152.473218] ? arch_stack_walk+0x98/0xf0
+[ 152.473839] ? __stack_depot_save+0x35/0x4c0
+[ 152.474501] ? stack_trace_save+0x91/0xc0
+[ 152.475119] ? security_capable+0x51/0x90
+[ 152.475741] rtnetlink_rcv_msg+0x2c1/0x9d0
+[ 152.476387] ? rtnl_calcit.isra.0+0x2b0/0x2b0
+[ 152.477042] ? __sys_sendmsg+0xb5/0x140
+[ 152.477664] ? do_syscall_64+0x3d/0x90
+[ 152.478255] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0
+[ 152.479010] ? __stack_depot_save+0x35/0x4c0
+[ 152.479679] ? __stack_depot_save+0x35/0x4c0
+[ 152.480346] netlink_rcv_skb+0x12c/0x360
+[ 152.480929] ? rtnl_calcit.isra.0+0x2b0/0x2b0
+[ 152.481517] ? do_syscall_64+0x3d/0x90
+[ 152.482061] ? netlink_ack+0x1550/0x1550
+[ 152.482612] ? rhashtable_walk_peek+0x170/0x170
+[ 152.483262] ? kmem_cache_alloc_node+0x1af/0x390
+[ 152.483875] ? _copy_from_iter+0x3d6/0xc70
+[ 152.484528] netlink_unicast+0x553/0x790
+[ 152.485168] ? netlink_attachskb+0x6a0/0x6a0
+[ 152.485848] ? unwind_next_frame+0x11cc/0x1a10
+[ 152.486538] ? arch_stack_walk+0x61/0xf0
+[ 152.487169] netlink_sendmsg+0x7a1/0xcb0
+[ 152.487799] ? netlink_unicast+0x790/0x790
+[ 152.488355] ? iovec_from_user.part.0+0x4d/0x220
+[ 152.488990] ? _raw_spin_lock+0x7a/0xd0
+[ 152.489598] ? netlink_unicast+0x790/0x790
+[ 152.490236] sock_sendmsg+0xc5/0x190
+[ 152.490796] ____sys_sendmsg+0x535/0x6b0
+[ 152.491394] ? import_iovec+0x7/0x10
+[ 152.491964] ? kernel_sendmsg+0x30/0x30
+[ 152.492561] ? __copy_msghdr+0x3c0/0x3c0
+[ 152.493160] ? do_syscall_64+0x3d/0x90
+[ 152.493706] ___sys_sendmsg+0xeb/0x170
+[ 152.494283] ? may_open_dev+0xd0/0xd0
+[ 152.494858] ? copy_msghdr_from_user+0x110/0x110
+[ 152.495541] ? __handle_mm_fault+0x2678/0x4ad0
+[ 152.496205] ? copy_page_range+0x2360/0x2360
+[ 152.496862] ? __fget_light+0x57/0x520
+[ 152.497449] ? mas_find+0x1c0/0x1c0
+[ 152.498026] ? sockfd_lookup_light+0x1a/0x140
+[ 152.498703] __sys_sendmsg+0xb5/0x140
+[ 152.499306] ? __sys_sendmsg_sock+0x20/0x20
+[ 152.499951] ? do_user_addr_fault+0x369/0xd80
+[ 152.500595] do_syscall_64+0x3d/0x90
+[ 152.501185] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+[ 152.501917] RIP: 0033:0x7f5eb294f887
+[ 152.502494] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
+[ 152.505008] RSP: 002b:00007ffd2c708f78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+[ 152.506152] RAX: ffffffffffffffda RBX: 00000000642d9472 RCX: 00007f5eb294f887
+[ 152.507134] RDX: 0000000000000000 RSI: 00007ffd2c708fe0 RDI: 0000000000000003
+[ 152.508113] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
+[ 152.509119] R10: 00007f5eb2808708 R11: 0000000000000246 R12: 0000000000000001
+[ 152.510068] R13: 0000000000000000 R14: 00007ffd2c70d1b8 R15: 0000000000485400
+[ 152.511031] </TASK>
+[ 152.511444] Modules linked in: cls_flower sch_ingress openvswitch nsh mlx5_vdpa vringh vhost_iotlb vdpa mlx5_ib mlx5_core rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay zram zsmalloc fuse [last unloaded: mlx5_core]
+[ 152.515720] ---[ end trace 0000000000000000 ]---
+
+Fixes: 08a0063df3ae ("net/sched: flower: Move filter handle initialization earlier")
+Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
+Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/cls_flower.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index fa6c2bb0b6267..d62947eef9727 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -2210,10 +2210,10 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
+ spin_lock(&tp->lock);
+ if (!handle) {
+ handle = 1;
+- err = idr_alloc_u32(&head->handle_idr, fnew, &handle,
++ err = idr_alloc_u32(&head->handle_idr, NULL, &handle,
+ INT_MAX, GFP_ATOMIC);
+ } else {
+- err = idr_alloc_u32(&head->handle_idr, fnew, &handle,
++ err = idr_alloc_u32(&head->handle_idr, NULL, &handle,
+ handle, GFP_ATOMIC);
+
+ /* Filter with specified handle was concurrently
+@@ -2378,7 +2378,7 @@ static void fl_walk(struct tcf_proto *tp, struct tcf_walker *arg,
+ rcu_read_lock();
+ idr_for_each_entry_continue_ul(&head->handle_idr, f, tmp, id) {
+ /* don't return filters that are being deleted */
+- if (!refcount_inc_not_zero(&f->refcnt))
++ if (!f || !refcount_inc_not_zero(&f->refcnt))
+ continue;
+ rcu_read_unlock();
+
+--
+2.39.2
+
--- /dev/null
+From 1eb6ef143b65e5adba92965acd9c71756589aa0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 16:06:04 +0200
+Subject: net/sched: flower: Fix wrong handle assignment during filter change
+
+From: Ivan Vecera <ivecera@redhat.com>
+
+[ Upstream commit 32eff6bacec2cb574677c15378169a9fa30043ef ]
+
+Commit 08a0063df3ae ("net/sched: flower: Move filter handle initialization
+earlier") moved filter handle initialization but an assignment of
+the handle to fnew->handle is done regardless of fold value. This is wrong
+because if fold != NULL (so fold->handle == handle) no new handle is
+allocated and passed handle is assigned to fnew->handle. Then if any
+subsequent action in fl_change() fails then the handle value is
+removed from IDR that is incorrect as we will have still valid old filter
+instance with handle that is not present in IDR.
+Fix this issue by moving the assignment so it is done only when passed
+fold == NULL.
+
+Prior the patch:
+[root@machine tc-testing]# ./tdc.py -d enp1s0f0np0 -e 14be
+Test 14be: Concurrently replace same range of 100k flower filters from 10 tc instances
+exit: 123
+exit: 0
+RTNETLINK answers: Invalid argument
+We have an error talking to the kernel
+Command failed tmp/replace_6:1885
+
+All test results:
+
+1..1
+not ok 1 14be - Concurrently replace same range of 100k flower filters from 10 tc instances
+ Command exited with 123, expected 0
+RTNETLINK answers: Invalid argument
+We have an error talking to the kernel
+Command failed tmp/replace_6:1885
+
+After the patch:
+[root@machine tc-testing]# ./tdc.py -d enp1s0f0np0 -e 14be
+Test 14be: Concurrently replace same range of 100k flower filters from 10 tc instances
+
+All test results:
+
+1..1
+ok 1 14be - Concurrently replace same range of 100k flower filters from 10 tc instances
+
+Fixes: 08a0063df3ae ("net/sched: flower: Move filter handle initialization earlier")
+Signed-off-by: Ivan Vecera <ivecera@redhat.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230425140604.169881-1-ivecera@redhat.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/cls_flower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index 475fe222a8556..fa6c2bb0b6267 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -2231,8 +2231,8 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
+ kfree(fnew);
+ goto errout_tb;
+ }
++ fnew->handle = handle;
+ }
+- fnew->handle = handle;
+
+ err = tcf_exts_init_ex(&fnew->exts, net, TCA_FLOWER_ACT, 0, tp, handle,
+ !tc_skip_hw(fnew->flags));
+--
+2.39.2
+
--- /dev/null
+From 803121a83aa83eab8267675919548422924c2278 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 00:34:28 +0200
+Subject: netfilter: nf_tables: extended netlink error reporting for netdevice
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit c3c060adc0249355411a93e61888051e6902b8a1 ]
+
+Flowtable and netdev chains are bound to one or several netdevice,
+extend netlink error reporting to specify the the netdevice that
+triggers the error.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Stable-dep-of: 8509f62b0b07 ("netfilter: nf_tables: hit ENOENT on unexisting chain/flowtable update with missing attributes")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 38 ++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 14 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 46f60648a57d1..6e027fc9b443f 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1955,7 +1955,8 @@ static struct nft_hook *nft_hook_list_find(struct list_head *hook_list,
+
+ static int nf_tables_parse_netdev_hooks(struct net *net,
+ const struct nlattr *attr,
+- struct list_head *hook_list)
++ struct list_head *hook_list,
++ struct netlink_ext_ack *extack)
+ {
+ struct nft_hook *hook, *next;
+ const struct nlattr *tmp;
+@@ -1969,10 +1970,12 @@ static int nf_tables_parse_netdev_hooks(struct net *net,
+
+ hook = nft_netdev_hook_alloc(net, tmp);
+ if (IS_ERR(hook)) {
++ NL_SET_BAD_ATTR(extack, tmp);
+ err = PTR_ERR(hook);
+ goto err_hook;
+ }
+ if (nft_hook_list_find(hook_list, hook)) {
++ NL_SET_BAD_ATTR(extack, tmp);
+ kfree(hook);
+ err = -EEXIST;
+ goto err_hook;
+@@ -2005,20 +2008,23 @@ struct nft_chain_hook {
+
+ static int nft_chain_parse_netdev(struct net *net,
+ struct nlattr *tb[],
+- struct list_head *hook_list)
++ struct list_head *hook_list,
++ struct netlink_ext_ack *extack)
+ {
+ struct nft_hook *hook;
+ int err;
+
+ if (tb[NFTA_HOOK_DEV]) {
+ hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]);
+- if (IS_ERR(hook))
++ if (IS_ERR(hook)) {
++ NL_SET_BAD_ATTR(extack, tb[NFTA_HOOK_DEV]);
+ return PTR_ERR(hook);
++ }
+
+ list_add_tail(&hook->list, hook_list);
+ } else if (tb[NFTA_HOOK_DEVS]) {
+ err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS],
+- hook_list);
++ hook_list, extack);
+ if (err < 0)
+ return err;
+
+@@ -2086,7 +2092,7 @@ static int nft_chain_parse_hook(struct net *net,
+
+ INIT_LIST_HEAD(&hook->list);
+ if (nft_base_chain_netdev(family, hook->num)) {
+- err = nft_chain_parse_netdev(net, ha, &hook->list);
++ err = nft_chain_parse_netdev(net, ha, &hook->list, extack);
+ if (err < 0) {
+ module_put(type->owner);
+ return err;
+@@ -7580,7 +7586,8 @@ static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX
+ static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
+ const struct nlattr *attr,
+ struct nft_flowtable_hook *flowtable_hook,
+- struct nft_flowtable *flowtable, bool add)
++ struct nft_flowtable *flowtable,
++ struct netlink_ext_ack *extack, bool add)
+ {
+ struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
+ struct nft_hook *hook;
+@@ -7627,7 +7634,8 @@ static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
+ if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) {
+ err = nf_tables_parse_netdev_hooks(ctx->net,
+ tb[NFTA_FLOWTABLE_HOOK_DEVS],
+- &flowtable_hook->list);
++ &flowtable_hook->list,
++ extack);
+ if (err < 0)
+ return err;
+ }
+@@ -7770,7 +7778,8 @@ static void nft_flowtable_hooks_destroy(struct list_head *hook_list)
+ }
+
+ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
+- struct nft_flowtable *flowtable)
++ struct nft_flowtable *flowtable,
++ struct netlink_ext_ack *extack)
+ {
+ const struct nlattr * const *nla = ctx->nla;
+ struct nft_flowtable_hook flowtable_hook;
+@@ -7781,7 +7790,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
+ int err;
+
+ err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
+- &flowtable_hook, flowtable, false);
++ &flowtable_hook, flowtable, extack, false);
+ if (err < 0)
+ return err;
+
+@@ -7886,7 +7895,7 @@ static int nf_tables_newflowtable(struct sk_buff *skb,
+
+ nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
+
+- return nft_flowtable_update(&ctx, info->nlh, flowtable);
++ return nft_flowtable_update(&ctx, info->nlh, flowtable, extack);
+ }
+
+ nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
+@@ -7927,7 +7936,7 @@ static int nf_tables_newflowtable(struct sk_buff *skb,
+ goto err3;
+
+ err = nft_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
+- &flowtable_hook, flowtable, true);
++ &flowtable_hook, flowtable, extack, true);
+ if (err < 0)
+ goto err4;
+
+@@ -7979,7 +7988,8 @@ static void nft_flowtable_hook_release(struct nft_flowtable_hook *flowtable_hook
+ }
+
+ static int nft_delflowtable_hook(struct nft_ctx *ctx,
+- struct nft_flowtable *flowtable)
++ struct nft_flowtable *flowtable,
++ struct netlink_ext_ack *extack)
+ {
+ const struct nlattr * const *nla = ctx->nla;
+ struct nft_flowtable_hook flowtable_hook;
+@@ -7989,7 +7999,7 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx,
+ int err;
+
+ err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
+- &flowtable_hook, flowtable, false);
++ &flowtable_hook, flowtable, extack, false);
+ if (err < 0)
+ return err;
+
+@@ -8071,7 +8081,7 @@ static int nf_tables_delflowtable(struct sk_buff *skb,
+ nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
+
+ if (nla[NFTA_FLOWTABLE_HOOK])
+- return nft_delflowtable_hook(&ctx, flowtable);
++ return nft_delflowtable_hook(&ctx, flowtable, extack);
+
+ if (flowtable->use > 0) {
+ NL_SET_BAD_ATTR(extack, attr);
+--
+2.39.2
+
--- /dev/null
+From ba960ac1fefc06466b43e25086ee4f201d1e07df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 12:00:18 +0200
+Subject: netfilter: nf_tables: fix ct untracked match breakage
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit f057b63bc11d86a98176de31b437e46789f44d8f ]
+
+"ct untracked" no longer works properly due to erroneous NFT_BREAK.
+We have to check ctinfo enum first.
+
+Fixes: d9e789147605 ("netfilter: nf_tables: avoid retpoline overhead for some ct expression calls")
+Reported-by: Rvfg <i@rvf6.com>
+Link: https://marc.info/?l=netfilter&m=168294996212038&w=2
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_ct_fast.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/nft_ct_fast.c b/net/netfilter/nft_ct_fast.c
+index 89983b0613fa3..e684c8a918487 100644
+--- a/net/netfilter/nft_ct_fast.c
++++ b/net/netfilter/nft_ct_fast.c
+@@ -15,10 +15,6 @@ void nft_ct_get_fast_eval(const struct nft_expr *expr,
+ unsigned int state;
+
+ ct = nf_ct_get(pkt->skb, &ctinfo);
+- if (!ct) {
+- regs->verdict.code = NFT_BREAK;
+- return;
+- }
+
+ switch (priv->key) {
+ case NFT_CT_STATE:
+@@ -30,6 +26,16 @@ void nft_ct_get_fast_eval(const struct nft_expr *expr,
+ state = NF_CT_STATE_INVALID_BIT;
+ *dest = state;
+ return;
++ default:
++ break;
++ }
++
++ if (!ct) {
++ regs->verdict.code = NFT_BREAK;
++ return;
++ }
++
++ switch (priv->key) {
+ case NFT_CT_DIRECTION:
+ nft_reg_store8(dest, CTINFO2DIR(ctinfo));
+ return;
+--
+2.39.2
+
--- /dev/null
+From 2b09cbf876a3d84bcdb4b6defe5b860fadf838b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 16:50:32 +0200
+Subject: netfilter: nf_tables: hit ENOENT on unexisting chain/flowtable update
+ with missing attributes
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 8509f62b0b07ae8d6dec5aa9613ab1b250ff632f ]
+
+If user does not specify hook number and priority, then assume this is
+a chain/flowtable update. Therefore, report ENOENT which provides a
+better hint than EINVAL. Set on extended netlink error report to refer
+to the chain name.
+
+Fixes: 5b6743fb2c2a ("netfilter: nf_tables: skip flowtable hooknum and priority on device updates")
+Fixes: 5efe72698a97 ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 29 +++++++++++++++++------------
+ 1 file changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index f64e83323473a..45f701fd86f06 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2066,8 +2066,10 @@ static int nft_chain_parse_hook(struct net *net,
+
+ if (!basechain) {
+ if (!ha[NFTA_HOOK_HOOKNUM] ||
+- !ha[NFTA_HOOK_PRIORITY])
+- return -EINVAL;
++ !ha[NFTA_HOOK_PRIORITY]) {
++ NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
++ return -ENOENT;
++ }
+
+ hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
+ hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
+@@ -7630,7 +7632,7 @@ static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX
+ };
+
+ static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
+- const struct nlattr *attr,
++ const struct nlattr * const nla[],
+ struct nft_flowtable_hook *flowtable_hook,
+ struct nft_flowtable *flowtable,
+ struct netlink_ext_ack *extack, bool add)
+@@ -7642,15 +7644,18 @@ static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
+
+ INIT_LIST_HEAD(&flowtable_hook->list);
+
+- err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
++ err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX,
++ nla[NFTA_FLOWTABLE_HOOK],
+ nft_flowtable_hook_policy, NULL);
+ if (err < 0)
+ return err;
+
+ if (add) {
+ if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
+- !tb[NFTA_FLOWTABLE_HOOK_PRIORITY])
+- return -EINVAL;
++ !tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) {
++ NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
++ return -ENOENT;
++ }
+
+ hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
+ if (hooknum != NF_NETDEV_INGRESS)
+@@ -7835,8 +7840,8 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
+ u32 flags;
+ int err;
+
+- err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
+- &flowtable_hook, flowtable, extack, false);
++ err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable,
++ extack, false);
+ if (err < 0)
+ return err;
+
+@@ -7981,8 +7986,8 @@ static int nf_tables_newflowtable(struct sk_buff *skb,
+ if (err < 0)
+ goto err3;
+
+- err = nft_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
+- &flowtable_hook, flowtable, extack, true);
++ err = nft_flowtable_parse_hook(&ctx, nla, &flowtable_hook, flowtable,
++ extack, true);
+ if (err < 0)
+ goto err4;
+
+@@ -8044,8 +8049,8 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx,
+ struct nft_trans *trans;
+ int err;
+
+- err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
+- &flowtable_hook, flowtable, extack, false);
++ err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable,
++ extack, false);
+ if (err < 0)
+ return err;
+
+--
+2.39.2
+
--- /dev/null
+From a35dd8180402c4ef37c3dea7b486876ea6a9ca50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 00:34:30 +0200
+Subject: netfilter: nf_tables: rename function to destroy hook list
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit cdc32546632354305afdcf399a5431138a31c9e0 ]
+
+Rename nft_flowtable_hooks_destroy() by nft_hooks_destroy() to prepare
+for netdev chain device updates.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Stable-dep-of: 8509f62b0b07 ("netfilter: nf_tables: hit ENOENT on unexisting chain/flowtable update with missing attributes")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 6e027fc9b443f..d41f35e88642b 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -7767,7 +7767,7 @@ static int nft_register_flowtable_net_hooks(struct net *net,
+ return err;
+ }
+
+-static void nft_flowtable_hooks_destroy(struct list_head *hook_list)
++static void nft_hooks_destroy(struct list_head *hook_list)
+ {
+ struct nft_hook *hook, *next;
+
+@@ -7948,7 +7948,7 @@ static int nf_tables_newflowtable(struct sk_buff *skb,
+ &flowtable->hook_list,
+ flowtable);
+ if (err < 0) {
+- nft_flowtable_hooks_destroy(&flowtable->hook_list);
++ nft_hooks_destroy(&flowtable->hook_list);
+ goto err4;
+ }
+
+@@ -8776,7 +8776,7 @@ static void nft_commit_release(struct nft_trans *trans)
+ case NFT_MSG_DELFLOWTABLE:
+ case NFT_MSG_DESTROYFLOWTABLE:
+ if (nft_trans_flowtable_update(trans))
+- nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans));
++ nft_hooks_destroy(&nft_trans_flowtable_hooks(trans));
+ else
+ nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
+ break;
+@@ -9429,7 +9429,7 @@ static void nf_tables_abort_release(struct nft_trans *trans)
+ break;
+ case NFT_MSG_NEWFLOWTABLE:
+ if (nft_trans_flowtable_update(trans))
+- nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans));
++ nft_hooks_destroy(&nft_trans_flowtable_hooks(trans));
+ else
+ nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
+ break;
+--
+2.39.2
+
--- /dev/null
+From 1cd130da4e0a1bf48a1c31ba7878adc914cb8ac8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 00:34:31 +0200
+Subject: netfilter: nf_tables: support for adding new devices to an existing
+ netdev chain
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit b9703ed44ffbfba85c103b9de01886a225e14b38 ]
+
+This patch allows users to add devices to an existing netdev chain.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Stable-dep-of: 8509f62b0b07 ("netfilter: nf_tables: hit ENOENT on unexisting chain/flowtable update with missing attributes")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_tables.h | 6 +
+ net/netfilter/nf_tables_api.c | 217 +++++++++++++++++++-----------
+ 2 files changed, 142 insertions(+), 81 deletions(-)
+
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index 9dace9bcba8e5..3eb7d20ddfc97 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -1602,6 +1602,8 @@ struct nft_trans_chain {
+ struct nft_stats __percpu *stats;
+ u8 policy;
+ u32 chain_id;
++ struct nft_base_chain *basechain;
++ struct list_head hook_list;
+ };
+
+ #define nft_trans_chain_update(trans) \
+@@ -1614,6 +1616,10 @@ struct nft_trans_chain {
+ (((struct nft_trans_chain *)trans->data)->policy)
+ #define nft_trans_chain_id(trans) \
+ (((struct nft_trans_chain *)trans->data)->chain_id)
++#define nft_trans_basechain(trans) \
++ (((struct nft_trans_chain *)trans->data)->basechain)
++#define nft_trans_chain_hooks(trans) \
++ (((struct nft_trans_chain *)trans->data)->hook_list)
+
+ struct nft_trans_table {
+ bool update;
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index d41f35e88642b..f64e83323473a 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1575,7 +1575,8 @@ static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
+ }
+
+ static int nft_dump_basechain_hook(struct sk_buff *skb, int family,
+- const struct nft_base_chain *basechain)
++ const struct nft_base_chain *basechain,
++ const struct list_head *hook_list)
+ {
+ const struct nf_hook_ops *ops = &basechain->ops;
+ struct nft_hook *hook, *first = NULL;
+@@ -1592,7 +1593,11 @@ static int nft_dump_basechain_hook(struct sk_buff *skb, int family,
+
+ if (nft_base_chain_netdev(family, ops->hooknum)) {
+ nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS);
+- list_for_each_entry(hook, &basechain->hook_list, list) {
++
++ if (!hook_list)
++ hook_list = &basechain->hook_list;
++
++ list_for_each_entry(hook, hook_list, list) {
+ if (!first)
+ first = hook;
+
+@@ -1617,7 +1622,8 @@ static int nft_dump_basechain_hook(struct sk_buff *skb, int family,
+ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
+ u32 portid, u32 seq, int event, u32 flags,
+ int family, const struct nft_table *table,
+- const struct nft_chain *chain)
++ const struct nft_chain *chain,
++ const struct list_head *hook_list)
+ {
+ struct nlmsghdr *nlh;
+
+@@ -1639,7 +1645,7 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
+ const struct nft_base_chain *basechain = nft_base_chain(chain);
+ struct nft_stats __percpu *stats;
+
+- if (nft_dump_basechain_hook(skb, family, basechain))
++ if (nft_dump_basechain_hook(skb, family, basechain, hook_list))
+ goto nla_put_failure;
+
+ if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
+@@ -1674,7 +1680,8 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
+ return -1;
+ }
+
+-static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
++static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event,
++ const struct list_head *hook_list)
+ {
+ struct nftables_pernet *nft_net;
+ struct sk_buff *skb;
+@@ -1694,7 +1701,7 @@ static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
+
+ err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
+ event, flags, ctx->family, ctx->table,
+- ctx->chain);
++ ctx->chain, hook_list);
+ if (err < 0) {
+ kfree_skb(skb);
+ goto err;
+@@ -1740,7 +1747,7 @@ static int nf_tables_dump_chains(struct sk_buff *skb,
+ NFT_MSG_NEWCHAIN,
+ NLM_F_MULTI,
+ table->family, table,
+- chain) < 0)
++ chain, NULL) < 0)
+ goto done;
+
+ nl_dump_check_consistent(cb, nlmsg_hdr(skb));
+@@ -1794,7 +1801,7 @@ static int nf_tables_getchain(struct sk_buff *skb, const struct nfnl_info *info,
+
+ err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
+ info->nlh->nlmsg_seq, NFT_MSG_NEWCHAIN,
+- 0, family, table, chain);
++ 0, family, table, chain, NULL);
+ if (err < 0)
+ goto err_fill_chain_info;
+
+@@ -2038,9 +2045,10 @@ static int nft_chain_parse_netdev(struct net *net,
+ }
+
+ static int nft_chain_parse_hook(struct net *net,
++ struct nft_base_chain *basechain,
+ const struct nlattr * const nla[],
+ struct nft_chain_hook *hook, u8 family,
+- struct netlink_ext_ack *extack, bool autoload)
++ struct netlink_ext_ack *extack)
+ {
+ struct nftables_pernet *nft_net = nft_pernet(net);
+ struct nlattr *ha[NFTA_HOOK_MAX + 1];
+@@ -2056,31 +2064,46 @@ static int nft_chain_parse_hook(struct net *net,
+ if (err < 0)
+ return err;
+
+- if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
+- ha[NFTA_HOOK_PRIORITY] == NULL)
+- return -EINVAL;
++ if (!basechain) {
++ if (!ha[NFTA_HOOK_HOOKNUM] ||
++ !ha[NFTA_HOOK_PRIORITY])
++ return -EINVAL;
+
+- hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
+- hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
++ hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
++ hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
+
+- type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT);
+- if (!type)
+- return -EOPNOTSUPP;
++ type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT);
++ if (!type)
++ return -EOPNOTSUPP;
+
+- if (nla[NFTA_CHAIN_TYPE]) {
+- type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
+- family, autoload);
+- if (IS_ERR(type)) {
+- NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]);
+- return PTR_ERR(type);
++ if (nla[NFTA_CHAIN_TYPE]) {
++ type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
++ family, true);
++ if (IS_ERR(type)) {
++ NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]);
++ return PTR_ERR(type);
++ }
+ }
+- }
+- if (hook->num >= NFT_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
+- return -EOPNOTSUPP;
++ if (hook->num >= NFT_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
++ return -EOPNOTSUPP;
+
+- if (type->type == NFT_CHAIN_T_NAT &&
+- hook->priority <= NF_IP_PRI_CONNTRACK)
+- return -EOPNOTSUPP;
++ if (type->type == NFT_CHAIN_T_NAT &&
++ hook->priority <= NF_IP_PRI_CONNTRACK)
++ return -EOPNOTSUPP;
++ } else {
++ if (ha[NFTA_HOOK_HOOKNUM]) {
++ hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
++ if (hook->num != basechain->ops.hooknum)
++ return -EOPNOTSUPP;
++ }
++ if (ha[NFTA_HOOK_PRIORITY]) {
++ hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
++ if (hook->priority != basechain->ops.priority)
++ return -EOPNOTSUPP;
++ }
++
++ type = basechain->type;
++ }
+
+ if (!try_module_get(type->owner)) {
+ if (nla[NFTA_CHAIN_TYPE])
+@@ -2178,12 +2201,8 @@ static int nft_basechain_init(struct nft_base_chain *basechain, u8 family,
+ list_splice_init(&hook->list, &basechain->hook_list);
+ list_for_each_entry(h, &basechain->hook_list, list)
+ nft_basechain_hook_init(&h->ops, family, hook, chain);
+-
+- basechain->ops.hooknum = hook->num;
+- basechain->ops.priority = hook->priority;
+- } else {
+- nft_basechain_hook_init(&basechain->ops, family, hook, chain);
+ }
++ nft_basechain_hook_init(&basechain->ops, family, hook, chain);
+
+ chain->flags |= NFT_CHAIN_BASE | flags;
+ basechain->policy = NF_ACCEPT;
+@@ -2234,13 +2253,13 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
+
+ if (nla[NFTA_CHAIN_HOOK]) {
+ struct nft_stats __percpu *stats = NULL;
+- struct nft_chain_hook hook;
++ struct nft_chain_hook hook = {};
+
+ if (flags & NFT_CHAIN_BINDING)
+ return -EOPNOTSUPP;
+
+- err = nft_chain_parse_hook(net, nla, &hook, family, extack,
+- true);
++ err = nft_chain_parse_hook(net, NULL, nla, &hook, family,
++ extack);
+ if (err < 0)
+ return err;
+
+@@ -2355,65 +2374,57 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
+ return err;
+ }
+
+-static bool nft_hook_list_equal(struct list_head *hook_list1,
+- struct list_head *hook_list2)
+-{
+- struct nft_hook *hook;
+- int n = 0, m = 0;
+-
+- n = 0;
+- list_for_each_entry(hook, hook_list2, list) {
+- if (!nft_hook_list_find(hook_list1, hook))
+- return false;
+-
+- n++;
+- }
+- list_for_each_entry(hook, hook_list1, list)
+- m++;
+-
+- return n == m;
+-}
+-
+ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
+ u32 flags, const struct nlattr *attr,
+ struct netlink_ext_ack *extack)
+ {
+ const struct nlattr * const *nla = ctx->nla;
++ struct nft_base_chain *basechain = NULL;
+ struct nft_table *table = ctx->table;
+ struct nft_chain *chain = ctx->chain;
+- struct nft_base_chain *basechain;
++ struct nft_chain_hook hook = {};
+ struct nft_stats *stats = NULL;
+- struct nft_chain_hook hook;
++ struct nft_hook *h, *next;
+ struct nf_hook_ops *ops;
+ struct nft_trans *trans;
++ bool unregister = false;
+ int err;
+
+ if (chain->flags ^ flags)
+ return -EOPNOTSUPP;
+
++ INIT_LIST_HEAD(&hook.list);
++
+ if (nla[NFTA_CHAIN_HOOK]) {
+ if (!nft_is_base_chain(chain)) {
+ NL_SET_BAD_ATTR(extack, attr);
+ return -EEXIST;
+ }
+- err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
+- extack, false);
++
++ basechain = nft_base_chain(chain);
++ err = nft_chain_parse_hook(ctx->net, basechain, nla, &hook,
++ ctx->family, extack);
+ if (err < 0)
+ return err;
+
+- basechain = nft_base_chain(chain);
+ if (basechain->type != hook.type) {
+ nft_chain_release_hook(&hook);
+ NL_SET_BAD_ATTR(extack, attr);
+ return -EEXIST;
+ }
+
+- if (nft_base_chain_netdev(ctx->family, hook.num)) {
+- if (!nft_hook_list_equal(&basechain->hook_list,
+- &hook.list)) {
+- nft_chain_release_hook(&hook);
+- NL_SET_BAD_ATTR(extack, attr);
+- return -EEXIST;
++ if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) {
++ list_for_each_entry_safe(h, next, &hook.list, list) {
++ h->ops.pf = basechain->ops.pf;
++ h->ops.hooknum = basechain->ops.hooknum;
++ h->ops.priority = basechain->ops.priority;
++ h->ops.priv = basechain->ops.priv;
++ h->ops.hook = basechain->ops.hook;
++
++ if (nft_hook_list_find(&basechain->hook_list, h)) {
++ list_del(&h->list);
++ kfree(h);
++ }
+ }
+ } else {
+ ops = &basechain->ops;
+@@ -2424,7 +2435,6 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
+ return -EEXIST;
+ }
+ }
+- nft_chain_release_hook(&hook);
+ }
+
+ if (nla[NFTA_CHAIN_HANDLE] &&
+@@ -2435,24 +2445,43 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
+ nla[NFTA_CHAIN_NAME], genmask);
+ if (!IS_ERR(chain2)) {
+ NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
+- return -EEXIST;
++ err = -EEXIST;
++ goto err_hooks;
+ }
+ }
+
+ if (nla[NFTA_CHAIN_COUNTERS]) {
+- if (!nft_is_base_chain(chain))
+- return -EOPNOTSUPP;
++ if (!nft_is_base_chain(chain)) {
++ err = -EOPNOTSUPP;
++ goto err_hooks;
++ }
+
+ stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
+- if (IS_ERR(stats))
+- return PTR_ERR(stats);
++ if (IS_ERR(stats)) {
++ err = PTR_ERR(stats);
++ goto err_hooks;
++ }
+ }
+
++ if (!(table->flags & NFT_TABLE_F_DORMANT) &&
++ nft_is_base_chain(chain) &&
++ !list_empty(&hook.list)) {
++ basechain = nft_base_chain(chain);
++ ops = &basechain->ops;
++
++ if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) {
++ err = nft_netdev_register_hooks(ctx->net, &hook.list);
++ if (err < 0)
++ goto err_hooks;
++ }
++ }
++
++ unregister = true;
+ err = -ENOMEM;
+ trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
+ sizeof(struct nft_trans_chain));
+ if (trans == NULL)
+- goto err;
++ goto err_trans;
+
+ nft_trans_chain_stats(trans) = stats;
+ nft_trans_chain_update(trans) = true;
+@@ -2471,7 +2500,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
+ err = -ENOMEM;
+ name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT);
+ if (!name)
+- goto err;
++ goto err_trans;
+
+ err = -EEXIST;
+ list_for_each_entry(tmp, &nft_net->commit_list, list) {
+@@ -2482,18 +2511,35 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
+ strcmp(name, nft_trans_chain_name(tmp)) == 0) {
+ NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
+ kfree(name);
+- goto err;
++ goto err_trans;
+ }
+ }
+
+ nft_trans_chain_name(trans) = name;
+ }
++
++ nft_trans_basechain(trans) = basechain;
++ INIT_LIST_HEAD(&nft_trans_chain_hooks(trans));
++ list_splice(&hook.list, &nft_trans_chain_hooks(trans));
++
+ nft_trans_commit_list_add_tail(ctx->net, trans);
+
+ return 0;
+-err:
++
++err_trans:
+ free_percpu(stats);
+ kfree(trans);
++err_hooks:
++ if (nla[NFTA_CHAIN_HOOK]) {
++ list_for_each_entry_safe(h, next, &hook.list, list) {
++ if (unregister)
++ nf_unregister_net_hook(ctx->net, &h->ops);
++ list_del(&h->list);
++ kfree_rcu(h, rcu);
++ }
++ module_put(hook.type->owner);
++ }
++
+ return err;
+ }
+
+@@ -9233,19 +9279,22 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+ case NFT_MSG_NEWCHAIN:
+ if (nft_trans_chain_update(trans)) {
+ nft_chain_commit_update(trans);
+- nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
++ nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN,
++ &nft_trans_chain_hooks(trans));
++ list_splice(&nft_trans_chain_hooks(trans),
++ &nft_trans_basechain(trans)->hook_list);
+ /* trans destroyed after rcu grace period */
+ } else {
+ nft_chain_commit_drop_policy(trans);
+ nft_clear(net, trans->ctx.chain);
+- nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
++ nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN, NULL);
+ nft_trans_destroy(trans);
+ }
+ break;
+ case NFT_MSG_DELCHAIN:
+ case NFT_MSG_DESTROYCHAIN:
+ nft_chain_del(trans->ctx.chain);
+- nf_tables_chain_notify(&trans->ctx, trans->msg_type);
++ nf_tables_chain_notify(&trans->ctx, trans->msg_type, NULL);
+ nf_tables_unregister_hook(trans->ctx.net,
+ trans->ctx.table,
+ trans->ctx.chain);
+@@ -9412,7 +9461,10 @@ static void nf_tables_abort_release(struct nft_trans *trans)
+ nf_tables_table_destroy(&trans->ctx);
+ break;
+ case NFT_MSG_NEWCHAIN:
+- nf_tables_chain_destroy(&trans->ctx);
++ if (nft_trans_chain_update(trans))
++ nft_hooks_destroy(&nft_trans_chain_hooks(trans));
++ else
++ nf_tables_chain_destroy(&trans->ctx);
+ break;
+ case NFT_MSG_NEWRULE:
+ nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
+@@ -9475,6 +9527,9 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
+ break;
+ case NFT_MSG_NEWCHAIN:
+ if (nft_trans_chain_update(trans)) {
++ nft_netdev_unregister_hooks(net,
++ &nft_trans_chain_hooks(trans),
++ true);
+ free_percpu(nft_trans_chain_stats(trans));
+ kfree(nft_trans_chain_name(trans));
+ nft_trans_destroy(trans);
+--
+2.39.2
+
--- /dev/null
+From c4015dccf1a32eebe0238f4a6f920dddb343732a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 12:39:38 +0530
+Subject: octeontx2-af: Add validation for lmac type
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit cb5edce271764524b88b1a6866b3e626686d9a33 ]
+
+Upon physical link change, firmware reports to the kernel about the
+change along with the details like speed, lmac_type_id, etc.
+Kernel derives lmac_type based on lmac_type_id received from firmware.
+
+In a few scenarios, firmware returns an invalid lmac_type_id, which
+is resulting in below kernel panic. This patch adds the missing
+validation of the lmac_type_id field.
+
+Internal error: Oops: 96000005 [#1] PREEMPT SMP
+[ 35.321595] Modules linked in:
+[ 35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted
+5.4.210-g2e3169d8e1bc-dirty #17
+[ 35.337014] Hardware name: Marvell CN103XX board (DT)
+[ 35.344297] Workqueue: events work_for_cpu_fn
+[ 35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO)
+[ 35.360267] pc : strncpy+0x10/0x30
+[ 35.366595] lr : cgx_link_change_handler+0x90/0x180
+
+Fixes: 61071a871ea6 ("octeontx2-af: Forward CGX link notifications to PFs")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
+Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+index 724df6398bbe2..bd77152bb8d7c 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+@@ -1231,6 +1231,14 @@ static inline void link_status_user_format(u64 lstat,
+ linfo->an = FIELD_GET(RESP_LINKSTAT_AN, lstat);
+ linfo->fec = FIELD_GET(RESP_LINKSTAT_FEC, lstat);
+ linfo->lmac_type_id = FIELD_GET(RESP_LINKSTAT_LMAC_TYPE, lstat);
++
++ if (linfo->lmac_type_id >= LMAC_MODE_MAX) {
++ dev_err(&cgx->pdev->dev, "Unknown lmac_type_id %d reported by firmware on cgx port%d:%d",
++ linfo->lmac_type_id, cgx->cgx_id, lmac_id);
++ strncpy(linfo->lmac_type, "Unknown", LMACTYPE_STR_LEN - 1);
++ return;
++ }
++
+ lmac_string = cgx_lmactype_string[linfo->lmac_type_id];
+ strncpy(linfo->lmac_type, lmac_string, LMACTYPE_STR_LEN - 1);
+ }
+--
+2.39.2
+
--- /dev/null
+From 49b6697929776f25a51ab40b719532856a6dd8d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 12:39:36 +0530
+Subject: octeontx2-af: Fix depth of cam and mem table.
+
+From: Ratheesh Kannoth <rkannoth@marvell.com>
+
+[ Upstream commit 60999cb83554ebcf6cfff8894bc2c3d99ea858ba ]
+
+In current driver, NPC cam and mem table sizes are read from wrong
+register offset. This patch fixes the register offset so that correct
+values are populated on read.
+
+Fixes: b747923afff8 ("octeontx2-af: Exact match support")
+Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
+Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
+Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
+index 20ebb9c95c733..6597af84aa367 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
+@@ -1868,9 +1868,9 @@ int rvu_npc_exact_init(struct rvu *rvu)
+ rvu->hw->table = table;
+
+ /* Read table size, ways and depth */
+- table->mem_table.depth = FIELD_GET(GENMASK_ULL(31, 24), npc_const3);
+ table->mem_table.ways = FIELD_GET(GENMASK_ULL(19, 16), npc_const3);
+- table->cam_table.depth = FIELD_GET(GENMASK_ULL(15, 0), npc_const3);
++ table->mem_table.depth = FIELD_GET(GENMASK_ULL(15, 0), npc_const3);
++ table->cam_table.depth = FIELD_GET(GENMASK_ULL(31, 24), npc_const3);
+
+ dev_dbg(rvu->dev, "%s: NPC exact match 4way_2k table(ways=%d, depth=%d)\n",
+ __func__, table->mem_table.ways, table->cam_table.depth);
+--
+2.39.2
+
--- /dev/null
+From 8fbf80d075540ead7b2e61e78bc081e14303a30c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 12:39:41 +0530
+Subject: octeontx2-af: Fix issues with NPC field hash extract
+
+From: Ratheesh Kannoth <rkannoth@marvell.com>
+
+[ Upstream commit f66155905959076619c9c519fb099e8ae6cb6f7b ]
+
+1. Allow field hash configuration for both source and destination IPv6.
+2. Configure hardware parser based on hash extract feature enable flag
+ for IPv6.
+3. Fix IPv6 endianness issue while updating the source/destination IP
+ address via ntuple rule.
+
+Fixes: 56d9f5fd2246 ("octeontx2-af: Use hashed field in MCAM key")
+Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
+Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
+Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../marvell/octeontx2/af/rvu_npc_fs.c | 23 +++--
+ .../marvell/octeontx2/af/rvu_npc_fs.h | 4 +
+ .../marvell/octeontx2/af/rvu_npc_hash.c | 88 ++++++++++---------
+ .../marvell/octeontx2/af/rvu_npc_hash.h | 4 +-
+ 4 files changed, 69 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
+index f15efd41972ee..952319453701b 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
+@@ -13,11 +13,6 @@
+ #include "rvu_npc_fs.h"
+ #include "rvu_npc_hash.h"
+
+-#define NPC_BYTESM GENMASK_ULL(19, 16)
+-#define NPC_HDR_OFFSET GENMASK_ULL(15, 8)
+-#define NPC_KEY_OFFSET GENMASK_ULL(5, 0)
+-#define NPC_LDATA_EN BIT_ULL(7)
+-
+ static const char * const npc_flow_names[] = {
+ [NPC_DMAC] = "dmac",
+ [NPC_SMAC] = "smac",
+@@ -442,6 +437,7 @@ static void npc_handle_multi_layer_fields(struct rvu *rvu, int blkaddr, u8 intf)
+ static void npc_scan_ldata(struct rvu *rvu, int blkaddr, u8 lid,
+ u8 lt, u64 cfg, u8 intf)
+ {
++ struct npc_mcam_kex_hash *mkex_hash = rvu->kpu.mkex_hash;
+ struct npc_mcam *mcam = &rvu->hw->mcam;
+ u8 hdr, key, nr_bytes, bit_offset;
+ u8 la_ltype, la_start;
+@@ -490,8 +486,21 @@ do { \
+ NPC_SCAN_HDR(NPC_SIP_IPV4, NPC_LID_LC, NPC_LT_LC_IP, 12, 4);
+ NPC_SCAN_HDR(NPC_DIP_IPV4, NPC_LID_LC, NPC_LT_LC_IP, 16, 4);
+ NPC_SCAN_HDR(NPC_IPFRAG_IPV6, NPC_LID_LC, NPC_LT_LC_IP6_EXT, 6, 1);
+- NPC_SCAN_HDR(NPC_SIP_IPV6, NPC_LID_LC, NPC_LT_LC_IP6, 8, 16);
+- NPC_SCAN_HDR(NPC_DIP_IPV6, NPC_LID_LC, NPC_LT_LC_IP6, 24, 16);
++ if (rvu->hw->cap.npc_hash_extract) {
++ if (mkex_hash->lid_lt_ld_hash_en[intf][lid][lt][0])
++ NPC_SCAN_HDR(NPC_SIP_IPV6, NPC_LID_LC, NPC_LT_LC_IP6, 8, 4);
++ else
++ NPC_SCAN_HDR(NPC_SIP_IPV6, NPC_LID_LC, NPC_LT_LC_IP6, 8, 16);
++
++ if (mkex_hash->lid_lt_ld_hash_en[intf][lid][lt][1])
++ NPC_SCAN_HDR(NPC_DIP_IPV6, NPC_LID_LC, NPC_LT_LC_IP6, 24, 4);
++ else
++ NPC_SCAN_HDR(NPC_DIP_IPV6, NPC_LID_LC, NPC_LT_LC_IP6, 24, 16);
++ } else {
++ NPC_SCAN_HDR(NPC_SIP_IPV6, NPC_LID_LC, NPC_LT_LC_IP6, 8, 16);
++ NPC_SCAN_HDR(NPC_DIP_IPV6, NPC_LID_LC, NPC_LT_LC_IP6, 24, 16);
++ }
++
+ NPC_SCAN_HDR(NPC_SPORT_UDP, NPC_LID_LD, NPC_LT_LD_UDP, 0, 2);
+ NPC_SCAN_HDR(NPC_DPORT_UDP, NPC_LID_LD, NPC_LT_LD_UDP, 2, 2);
+ NPC_SCAN_HDR(NPC_SPORT_TCP, NPC_LID_LD, NPC_LT_LD_TCP, 0, 2);
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.h
+index bdd65ce56a32d..3f5c9042d10e7 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.h
+@@ -9,6 +9,10 @@
+ #define __RVU_NPC_FS_H
+
+ #define IPV6_WORDS 4
++#define NPC_BYTESM GENMASK_ULL(19, 16)
++#define NPC_HDR_OFFSET GENMASK_ULL(15, 8)
++#define NPC_KEY_OFFSET GENMASK_ULL(5, 0)
++#define NPC_LDATA_EN BIT_ULL(7)
+
+ void npc_update_entry(struct rvu *rvu, enum key_fields type,
+ struct mcam_entry *entry, u64 val_lo,
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
+index 68f813040363d..51209119f0f2f 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
+@@ -78,42 +78,43 @@ static u32 rvu_npc_toeplitz_hash(const u64 *data, u64 *key, size_t data_bit_len,
+ return hash_out;
+ }
+
+-u32 npc_field_hash_calc(u64 *ldata, struct npc_mcam_kex_hash *mkex_hash,
+- u64 *secret_key, u8 intf, u8 hash_idx)
++u32 npc_field_hash_calc(u64 *ldata, struct npc_get_field_hash_info_rsp rsp,
++ u8 intf, u8 hash_idx)
+ {
+ u64 hash_key[3];
+ u64 data_padded[2];
+ u32 field_hash;
+
+- hash_key[0] = secret_key[1] << 31;
+- hash_key[0] |= secret_key[2];
+- hash_key[1] = secret_key[1] >> 33;
+- hash_key[1] |= secret_key[0] << 31;
+- hash_key[2] = secret_key[0] >> 33;
++ hash_key[0] = rsp.secret_key[1] << 31;
++ hash_key[0] |= rsp.secret_key[2];
++ hash_key[1] = rsp.secret_key[1] >> 33;
++ hash_key[1] |= rsp.secret_key[0] << 31;
++ hash_key[2] = rsp.secret_key[0] >> 33;
+
+- data_padded[0] = mkex_hash->hash_mask[intf][hash_idx][0] & ldata[0];
+- data_padded[1] = mkex_hash->hash_mask[intf][hash_idx][1] & ldata[1];
++ data_padded[0] = rsp.hash_mask[intf][hash_idx][0] & ldata[0];
++ data_padded[1] = rsp.hash_mask[intf][hash_idx][1] & ldata[1];
+ field_hash = rvu_npc_toeplitz_hash(data_padded, hash_key, 128, 159);
+
+- field_hash &= mkex_hash->hash_ctrl[intf][hash_idx] >> 32;
+- field_hash |= mkex_hash->hash_ctrl[intf][hash_idx];
++ field_hash &= FIELD_GET(GENMASK(63, 32), rsp.hash_ctrl[intf][hash_idx]);
++ field_hash += FIELD_GET(GENMASK(31, 0), rsp.hash_ctrl[intf][hash_idx]);
+ return field_hash;
+ }
+
+-static u64 npc_update_use_hash(int lt, int ld)
++static u64 npc_update_use_hash(struct rvu *rvu, int blkaddr,
++ u8 intf, int lid, int lt, int ld)
+ {
+- u64 cfg = 0;
+-
+- switch (lt) {
+- case NPC_LT_LC_IP6:
+- /* Update use_hash(bit-20) and bytesm1 (bit-16:19)
+- * in KEX_LD_CFG
+- */
+- cfg = KEX_LD_CFG_USE_HASH(0x1, 0x03,
+- ld ? 0x18 : 0x8,
+- 0x1, 0x0, ld ? 0x14 : 0x10);
+- break;
+- }
++ u8 hdr, key;
++ u64 cfg;
++
++ cfg = rvu_read64(rvu, blkaddr, NPC_AF_INTFX_LIDX_LTX_LDX_CFG(intf, lid, lt, ld));
++ hdr = FIELD_GET(NPC_HDR_OFFSET, cfg);
++ key = FIELD_GET(NPC_KEY_OFFSET, cfg);
++
++ /* Update use_hash(bit-20) to 'true' and
++ * bytesm1(bit-16:19) to '0x3' in KEX_LD_CFG
++ */
++ cfg = KEX_LD_CFG_USE_HASH(0x1, 0x03,
++ hdr, 0x1, 0x0, key);
+
+ return cfg;
+ }
+@@ -132,11 +133,13 @@ static void npc_program_mkex_hash_rx(struct rvu *rvu, int blkaddr,
+ for (lt = 0; lt < NPC_MAX_LT; lt++) {
+ for (ld = 0; ld < NPC_MAX_LD; ld++) {
+ if (mkex_hash->lid_lt_ld_hash_en[intf][lid][lt][ld]) {
+- u64 cfg = npc_update_use_hash(lt, ld);
++ u64 cfg;
+
+ if (hash_cnt == NPC_MAX_HASH)
+ return;
+
++ cfg = npc_update_use_hash(rvu, blkaddr,
++ intf, lid, lt, ld);
+ /* Set updated KEX configuration */
+ SET_KEX_LD(intf, lid, lt, ld, cfg);
+ /* Set HASH configuration */
+@@ -170,11 +173,13 @@ static void npc_program_mkex_hash_tx(struct rvu *rvu, int blkaddr,
+ for (lt = 0; lt < NPC_MAX_LT; lt++) {
+ for (ld = 0; ld < NPC_MAX_LD; ld++)
+ if (mkex_hash->lid_lt_ld_hash_en[intf][lid][lt][ld]) {
+- u64 cfg = npc_update_use_hash(lt, ld);
++ u64 cfg;
+
+ if (hash_cnt == NPC_MAX_HASH)
+ return;
+
++ cfg = npc_update_use_hash(rvu, blkaddr,
++ intf, lid, lt, ld);
+ /* Set updated KEX configuration */
+ SET_KEX_LD(intf, lid, lt, ld, cfg);
+ /* Set HASH configuration */
+@@ -264,44 +269,45 @@ void npc_update_field_hash(struct rvu *rvu, u8 intf,
+ * is hashed to 32 bit value.
+ */
+ case NPC_LT_LC_IP6:
+- if (features & BIT_ULL(NPC_SIP_IPV6)) {
++ /* ld[0] == hash_idx[0] == Source IPv6
++ * ld[1] == hash_idx[1] == Destination IPv6
++ */
++ if ((features & BIT_ULL(NPC_SIP_IPV6)) && !hash_idx) {
+ u32 src_ip[IPV6_WORDS];
+
+ be32_to_cpu_array(src_ip, pkt->ip6src, IPV6_WORDS);
+- ldata[0] = (u64)src_ip[0] << 32 | src_ip[1];
+- ldata[1] = (u64)src_ip[2] << 32 | src_ip[3];
++ ldata[1] = (u64)src_ip[0] << 32 | src_ip[1];
++ ldata[0] = (u64)src_ip[2] << 32 | src_ip[3];
+ field_hash = npc_field_hash_calc(ldata,
+- mkex_hash,
+- rsp.secret_key,
++ rsp,
+ intf,
+ hash_idx);
+ npc_update_entry(rvu, NPC_SIP_IPV6, entry,
+- field_hash, 0, 32, 0, intf);
++ field_hash, 0,
++ GENMASK(31, 0), 0, intf);
+ memcpy(&opkt->ip6src, &pkt->ip6src,
+ sizeof(pkt->ip6src));
+ memcpy(&omask->ip6src, &mask->ip6src,
+ sizeof(mask->ip6src));
+- break;
+- }
+-
+- if (features & BIT_ULL(NPC_DIP_IPV6)) {
++ } else if ((features & BIT_ULL(NPC_DIP_IPV6)) && hash_idx) {
+ u32 dst_ip[IPV6_WORDS];
+
+ be32_to_cpu_array(dst_ip, pkt->ip6dst, IPV6_WORDS);
+- ldata[0] = (u64)dst_ip[0] << 32 | dst_ip[1];
+- ldata[1] = (u64)dst_ip[2] << 32 | dst_ip[3];
++ ldata[1] = (u64)dst_ip[0] << 32 | dst_ip[1];
++ ldata[0] = (u64)dst_ip[2] << 32 | dst_ip[3];
+ field_hash = npc_field_hash_calc(ldata,
+- mkex_hash,
+- rsp.secret_key,
++ rsp,
+ intf,
+ hash_idx);
+ npc_update_entry(rvu, NPC_DIP_IPV6, entry,
+- field_hash, 0, 32, 0, intf);
++ field_hash, 0,
++ GENMASK(31, 0), 0, intf);
+ memcpy(&opkt->ip6dst, &pkt->ip6dst,
+ sizeof(pkt->ip6dst));
+ memcpy(&omask->ip6dst, &mask->ip6dst,
+ sizeof(mask->ip6dst));
+ }
++
+ break;
+ }
+ }
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h
+index 65936f4aeaacf..a1c3d987b8044 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h
+@@ -62,8 +62,8 @@ void npc_update_field_hash(struct rvu *rvu, u8 intf,
+ struct flow_msg *omask);
+ void npc_config_secret_key(struct rvu *rvu, int blkaddr);
+ void npc_program_mkex_hash(struct rvu *rvu, int blkaddr);
+-u32 npc_field_hash_calc(u64 *ldata, struct npc_mcam_kex_hash *mkex_hash,
+- u64 *secret_key, u8 intf, u8 hash_idx);
++u32 npc_field_hash_calc(u64 *ldata, struct npc_get_field_hash_info_rsp rsp,
++ u8 intf, u8 hash_idx);
+
+ static struct npc_mcam_kex_hash npc_mkex_hash_default __maybe_unused = {
+ .lid_lt_ld_hash_en = {
+--
+2.39.2
+
--- /dev/null
+From 632dac3b355b3c6e0e3a2fee9e62c29ba5b6092c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 12:39:35 +0530
+Subject: octeontx2-af: Fix start and end bit for scan config
+
+From: Ratheesh Kannoth <rkannoth@marvell.com>
+
+[ Upstream commit c60a6b90e7890453f09e0d2163d6acadabe3415b ]
+
+In the current driver, NPC exact match feature was not getting
+enabled as configured bit was not read properly.
+for_each_set_bit_from() need end bit as one bit post
+position in the bit map to read NPC exact nibble enable
+bits properly. This patch fixes the same.
+
+Fixes: b747923afff8 ("octeontx2-af: Exact match support")
+Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
+Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
+Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
+index 006beb5cf98dd..f15efd41972ee 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
+@@ -594,8 +594,7 @@ static int npc_scan_kex(struct rvu *rvu, int blkaddr, u8 intf)
+ */
+ masked_cfg = cfg & NPC_EXACT_NIBBLE;
+ bitnr = NPC_EXACT_NIBBLE_START;
+- for_each_set_bit_from(bitnr, (unsigned long *)&masked_cfg,
+- NPC_EXACT_NIBBLE_START) {
++ for_each_set_bit_from(bitnr, (unsigned long *)&masked_cfg, NPC_EXACT_NIBBLE_END + 1) {
+ npc_scan_exact_result(mcam, bitnr, key_nibble, intf);
+ key_nibble++;
+ }
+--
+2.39.2
+
--- /dev/null
+From a4e218a431d8b8ff5646659e00d102e0f0d13f65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 11:55:22 +0530
+Subject: octeontx2-af: mcs: Config parser to skip 8B header
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit 65cdc2b637a5749c7dec0ce14fe2c48f1f91f671 ]
+
+When ptp timestamp is enabled in RPM, RPM will append 8B
+timestamp header for all RX traffic. MCS need to skip these
+8 bytes header while parsing the packet header, so that
+correct tcam key is created for lookup.
+This patch fixes the mcs parser configuration to skip this
+8B header for ptp packets.
+
+Fixes: ca7f49ff8846 ("octeontx2-af: cn10k: Introduce driver for macsec block.")
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/marvell/octeontx2/af/mcs_reg.h | 1 +
+ .../marvell/octeontx2/af/mcs_rvu_if.c | 37 +++++++++++++++++++
+ .../net/ethernet/marvell/octeontx2/af/rvu.h | 1 +
+ .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +
+ 4 files changed, 41 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h b/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h
+index c95a8b8f5eaf7..7427e3b1490f4 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h
+@@ -97,6 +97,7 @@
+ #define MCSX_PEX_TX_SLAVE_VLAN_CFGX(a) (0x46f8ull + (a) * 0x8ull)
+ #define MCSX_PEX_TX_SLAVE_CUSTOM_TAG_REL_MODE_SEL(a) (0x788ull + (a) * 0x8ull)
+ #define MCSX_PEX_TX_SLAVE_PORT_CONFIG(a) (0x4738ull + (a) * 0x8ull)
++#define MCSX_PEX_RX_SLAVE_PORT_CFGX(a) (0x3b98ull + (a) * 0x8ull)
+ #define MCSX_PEX_RX_SLAVE_RULE_ETYPE_CFGX(a) ({ \
+ u64 offset; \
+ \
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c
+index eb25e458266ca..dfd23580e3b8e 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c
+@@ -11,6 +11,7 @@
+
+ #include "mcs.h"
+ #include "rvu.h"
++#include "mcs_reg.h"
+ #include "lmac_common.h"
+
+ #define M(_name, _id, _fn_name, _req_type, _rsp_type) \
+@@ -32,6 +33,42 @@ static struct _req_type __maybe_unused \
+ MBOX_UP_MCS_MESSAGES
+ #undef M
+
++void rvu_mcs_ptp_cfg(struct rvu *rvu, u8 rpm_id, u8 lmac_id, bool ena)
++{
++ struct mcs *mcs;
++ u64 cfg;
++ u8 port;
++
++ if (!rvu->mcs_blk_cnt)
++ return;
++
++ /* When ptp is enabled, RPM appends 8B header for all
++ * RX packets. MCS PEX need to configure to skip 8B
++ * during packet parsing.
++ */
++
++ /* CNF10K-B */
++ if (rvu->mcs_blk_cnt > 1) {
++ mcs = mcs_get_pdata(rpm_id);
++ cfg = mcs_reg_read(mcs, MCSX_PEX_RX_SLAVE_PEX_CONFIGURATION);
++ if (ena)
++ cfg |= BIT_ULL(lmac_id);
++ else
++ cfg &= ~BIT_ULL(lmac_id);
++ mcs_reg_write(mcs, MCSX_PEX_RX_SLAVE_PEX_CONFIGURATION, cfg);
++ return;
++ }
++ /* CN10KB */
++ mcs = mcs_get_pdata(0);
++ port = (rpm_id * rvu->hw->lmac_per_cgx) + lmac_id;
++ cfg = mcs_reg_read(mcs, MCSX_PEX_RX_SLAVE_PORT_CFGX(port));
++ if (ena)
++ cfg |= BIT_ULL(0);
++ else
++ cfg &= ~BIT_ULL(0);
++ mcs_reg_write(mcs, MCSX_PEX_RX_SLAVE_PORT_CFGX(port), cfg);
++}
++
+ int rvu_mbox_handler_mcs_set_lmac_mode(struct rvu *rvu,
+ struct mcs_set_lmac_mode *req,
+ struct msg_rsp *rsp)
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+index ef721caeac49b..d655bf04a483d 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+@@ -920,6 +920,7 @@ int rvu_get_hwvf(struct rvu *rvu, int pcifunc);
+ /* CN10K MCS */
+ int rvu_mcs_init(struct rvu *rvu);
+ int rvu_mcs_flr_handler(struct rvu *rvu, u16 pcifunc);
++void rvu_mcs_ptp_cfg(struct rvu *rvu, u8 rpm_id, u8 lmac_id, bool ena);
+ void rvu_mcs_exit(struct rvu *rvu);
+
+ #endif /* RVU_H */
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+index 438b212fb54a7..83b342fa8d753 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+@@ -773,6 +773,8 @@ static int rvu_cgx_ptp_rx_cfg(struct rvu *rvu, u16 pcifunc, bool enable)
+ /* This flag is required to clean up CGX conf if app gets killed */
+ pfvf->hw_rx_tstamp_en = enable;
+
++ /* Inform MCS about 8B RX header */
++ rvu_mcs_ptp_cfg(rvu, cgx_id, lmac_id, enable);
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 906e8970c1720a5a48d6e5e45603f59d6c6ebebe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 11:55:23 +0530
+Subject: octeontx2-af: mcs: Fix MCS block interrupt
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit b8aebeaaf9ffb1e99c642eb3751e28981f9be475 ]
+
+On CN10KB, MCS IP vector number, BBE and PAB interrupt mask
+got changed to support more block level interrupts.
+To address this changes, this patch fixes the bbe and pab
+interrupt handlers.
+
+Fixes: 6c635f78c474 ("octeontx2-af: cn10k: mcs: Handle MCS block interrupts")
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/af/mcs.c | 95 ++++++++-----------
+ .../net/ethernet/marvell/octeontx2/af/mcs.h | 26 +++--
+ .../marvell/octeontx2/af/mcs_cnf10kb.c | 63 ++++++++++++
+ .../ethernet/marvell/octeontx2/af/mcs_reg.h | 5 +-
+ 4 files changed, 119 insertions(+), 70 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
+index 148417d633a56..c43f19dfbd744 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
+@@ -936,60 +936,42 @@ static void mcs_tx_misc_intr_handler(struct mcs *mcs, u64 intr)
+ mcs_add_intr_wq_entry(mcs, &event);
+ }
+
+-static void mcs_bbe_intr_handler(struct mcs *mcs, u64 intr, enum mcs_direction dir)
++void cn10kb_mcs_bbe_intr_handler(struct mcs *mcs, u64 intr,
++ enum mcs_direction dir)
+ {
+- struct mcs_intr_event event = { 0 };
+- int i;
++ u64 val, reg;
++ int lmac;
+
+- if (!(intr & MCS_BBE_INT_MASK))
++ if (!(intr & 0x6ULL))
+ return;
+
+- event.mcs_id = mcs->mcs_id;
+- event.pcifunc = mcs->pf_map[0];
++ if (intr & BIT_ULL(1))
++ reg = (dir == MCS_RX) ? MCSX_BBE_RX_SLAVE_DFIFO_OVERFLOW_0 :
++ MCSX_BBE_TX_SLAVE_DFIFO_OVERFLOW_0;
++ else
++ reg = (dir == MCS_RX) ? MCSX_BBE_RX_SLAVE_PLFIFO_OVERFLOW_0 :
++ MCSX_BBE_TX_SLAVE_PLFIFO_OVERFLOW_0;
++ val = mcs_reg_read(mcs, reg);
+
+- for (i = 0; i < MCS_MAX_BBE_INT; i++) {
+- if (!(intr & BIT_ULL(i)))
++ /* policy/data over flow occurred */
++ for (lmac = 0; lmac < mcs->hw->lmac_cnt; lmac++) {
++ if (!(val & BIT_ULL(lmac)))
+ continue;
+-
+- /* Lower nibble denotes data fifo overflow interrupts and
+- * upper nibble indicates policy fifo overflow interrupts.
+- */
+- if (intr & 0xFULL)
+- event.intr_mask = (dir == MCS_RX) ?
+- MCS_BBE_RX_DFIFO_OVERFLOW_INT :
+- MCS_BBE_TX_DFIFO_OVERFLOW_INT;
+- else
+- event.intr_mask = (dir == MCS_RX) ?
+- MCS_BBE_RX_PLFIFO_OVERFLOW_INT :
+- MCS_BBE_TX_PLFIFO_OVERFLOW_INT;
+-
+- /* Notify the lmac_id info which ran into BBE fatal error */
+- event.lmac_id = i & 0x3ULL;
+- mcs_add_intr_wq_entry(mcs, &event);
++ dev_warn(mcs->dev, "BEE:Policy or data overflow occurred on lmac:%d\n", lmac);
+ }
+ }
+
+-static void mcs_pab_intr_handler(struct mcs *mcs, u64 intr, enum mcs_direction dir)
++void cn10kb_mcs_pab_intr_handler(struct mcs *mcs, u64 intr,
++ enum mcs_direction dir)
+ {
+- struct mcs_intr_event event = { 0 };
+- int i;
++ int lmac;
+
+- if (!(intr & MCS_PAB_INT_MASK))
++ if (!(intr & 0xFFFFFULL))
+ return;
+
+- event.mcs_id = mcs->mcs_id;
+- event.pcifunc = mcs->pf_map[0];
+-
+- for (i = 0; i < MCS_MAX_PAB_INT; i++) {
+- if (!(intr & BIT_ULL(i)))
+- continue;
+-
+- event.intr_mask = (dir == MCS_RX) ? MCS_PAB_RX_CHAN_OVERFLOW_INT :
+- MCS_PAB_TX_CHAN_OVERFLOW_INT;
+-
+- /* Notify the lmac_id info which ran into PAB fatal error */
+- event.lmac_id = i;
+- mcs_add_intr_wq_entry(mcs, &event);
++ for (lmac = 0; lmac < mcs->hw->lmac_cnt; lmac++) {
++ if (intr & BIT_ULL(lmac))
++ dev_warn(mcs->dev, "PAB: overflow occurred on lmac:%d\n", lmac);
+ }
+ }
+
+@@ -998,9 +980,8 @@ static irqreturn_t mcs_ip_intr_handler(int irq, void *mcs_irq)
+ struct mcs *mcs = (struct mcs *)mcs_irq;
+ u64 intr, cpm_intr, bbe_intr, pab_intr;
+
+- /* Disable and clear the interrupt */
++ /* Disable the interrupt */
+ mcs_reg_write(mcs, MCSX_IP_INT_ENA_W1C, BIT_ULL(0));
+- mcs_reg_write(mcs, MCSX_IP_INT, BIT_ULL(0));
+
+ /* Check which block has interrupt*/
+ intr = mcs_reg_read(mcs, MCSX_TOP_SLAVE_INT_SUM);
+@@ -1047,7 +1028,7 @@ static irqreturn_t mcs_ip_intr_handler(int irq, void *mcs_irq)
+ /* BBE RX */
+ if (intr & MCS_BBE_RX_INT_ENA) {
+ bbe_intr = mcs_reg_read(mcs, MCSX_BBE_RX_SLAVE_BBE_INT);
+- mcs_bbe_intr_handler(mcs, bbe_intr, MCS_RX);
++ mcs->mcs_ops->mcs_bbe_intr_handler(mcs, bbe_intr, MCS_RX);
+
+ /* Clear the interrupt */
+ mcs_reg_write(mcs, MCSX_BBE_RX_SLAVE_BBE_INT_INTR_RW, 0);
+@@ -1057,7 +1038,7 @@ static irqreturn_t mcs_ip_intr_handler(int irq, void *mcs_irq)
+ /* BBE TX */
+ if (intr & MCS_BBE_TX_INT_ENA) {
+ bbe_intr = mcs_reg_read(mcs, MCSX_BBE_TX_SLAVE_BBE_INT);
+- mcs_bbe_intr_handler(mcs, bbe_intr, MCS_TX);
++ mcs->mcs_ops->mcs_bbe_intr_handler(mcs, bbe_intr, MCS_TX);
+
+ /* Clear the interrupt */
+ mcs_reg_write(mcs, MCSX_BBE_TX_SLAVE_BBE_INT_INTR_RW, 0);
+@@ -1067,7 +1048,7 @@ static irqreturn_t mcs_ip_intr_handler(int irq, void *mcs_irq)
+ /* PAB RX */
+ if (intr & MCS_PAB_RX_INT_ENA) {
+ pab_intr = mcs_reg_read(mcs, MCSX_PAB_RX_SLAVE_PAB_INT);
+- mcs_pab_intr_handler(mcs, pab_intr, MCS_RX);
++ mcs->mcs_ops->mcs_pab_intr_handler(mcs, pab_intr, MCS_RX);
+
+ /* Clear the interrupt */
+ mcs_reg_write(mcs, MCSX_PAB_RX_SLAVE_PAB_INT_INTR_RW, 0);
+@@ -1077,14 +1058,15 @@ static irqreturn_t mcs_ip_intr_handler(int irq, void *mcs_irq)
+ /* PAB TX */
+ if (intr & MCS_PAB_TX_INT_ENA) {
+ pab_intr = mcs_reg_read(mcs, MCSX_PAB_TX_SLAVE_PAB_INT);
+- mcs_pab_intr_handler(mcs, pab_intr, MCS_TX);
++ mcs->mcs_ops->mcs_pab_intr_handler(mcs, pab_intr, MCS_TX);
+
+ /* Clear the interrupt */
+ mcs_reg_write(mcs, MCSX_PAB_TX_SLAVE_PAB_INT_INTR_RW, 0);
+ mcs_reg_write(mcs, MCSX_PAB_TX_SLAVE_PAB_INT, pab_intr);
+ }
+
+- /* Enable the interrupt */
++ /* Clear and enable the interrupt */
++ mcs_reg_write(mcs, MCSX_IP_INT, BIT_ULL(0));
+ mcs_reg_write(mcs, MCSX_IP_INT_ENA_W1S, BIT_ULL(0));
+
+ return IRQ_HANDLED;
+@@ -1166,7 +1148,7 @@ static int mcs_register_interrupts(struct mcs *mcs)
+ return ret;
+ }
+
+- ret = request_irq(pci_irq_vector(mcs->pdev, MCS_INT_VEC_IP),
++ ret = request_irq(pci_irq_vector(mcs->pdev, mcs->hw->ip_vec),
+ mcs_ip_intr_handler, 0, "MCS_IP", mcs);
+ if (ret) {
+ dev_err(mcs->dev, "MCS IP irq registration failed\n");
+@@ -1185,11 +1167,11 @@ static int mcs_register_interrupts(struct mcs *mcs)
+ mcs_reg_write(mcs, MCSX_CPM_TX_SLAVE_TX_INT_ENB, 0x7ULL);
+ mcs_reg_write(mcs, MCSX_CPM_RX_SLAVE_RX_INT_ENB, 0x7FULL);
+
+- mcs_reg_write(mcs, MCSX_BBE_RX_SLAVE_BBE_INT_ENB, 0xff);
+- mcs_reg_write(mcs, MCSX_BBE_TX_SLAVE_BBE_INT_ENB, 0xff);
++ mcs_reg_write(mcs, MCSX_BBE_RX_SLAVE_BBE_INT_ENB, 0xFFULL);
++ mcs_reg_write(mcs, MCSX_BBE_TX_SLAVE_BBE_INT_ENB, 0xFFULL);
+
+- mcs_reg_write(mcs, MCSX_PAB_RX_SLAVE_PAB_INT_ENB, 0xff);
+- mcs_reg_write(mcs, MCSX_PAB_TX_SLAVE_PAB_INT_ENB, 0xff);
++ mcs_reg_write(mcs, MCSX_PAB_RX_SLAVE_PAB_INT_ENB, 0xFFFFFULL);
++ mcs_reg_write(mcs, MCSX_PAB_TX_SLAVE_PAB_INT_ENB, 0xFFFFFULL);
+
+ mcs->tx_sa_active = alloc_mem(mcs, mcs->hw->sc_entries);
+ if (!mcs->tx_sa_active) {
+@@ -1200,7 +1182,7 @@ static int mcs_register_interrupts(struct mcs *mcs)
+ return ret;
+
+ free_irq:
+- free_irq(pci_irq_vector(mcs->pdev, MCS_INT_VEC_IP), mcs);
++ free_irq(pci_irq_vector(mcs->pdev, mcs->hw->ip_vec), mcs);
+ exit:
+ pci_free_irq_vectors(mcs->pdev);
+ mcs->num_vec = 0;
+@@ -1497,6 +1479,7 @@ void cn10kb_mcs_set_hw_capabilities(struct mcs *mcs)
+ hw->lmac_cnt = 20; /* lmacs/ports per mcs block */
+ hw->mcs_x2p_intf = 5; /* x2p clabration intf */
+ hw->mcs_blks = 1; /* MCS blocks */
++ hw->ip_vec = MCS_CN10KB_INT_VEC_IP; /* IP vector */
+ }
+
+ static struct mcs_ops cn10kb_mcs_ops = {
+@@ -1505,6 +1488,8 @@ static struct mcs_ops cn10kb_mcs_ops = {
+ .mcs_tx_sa_mem_map_write = cn10kb_mcs_tx_sa_mem_map_write,
+ .mcs_rx_sa_mem_map_write = cn10kb_mcs_rx_sa_mem_map_write,
+ .mcs_flowid_secy_map = cn10kb_mcs_flowid_secy_map,
++ .mcs_bbe_intr_handler = cn10kb_mcs_bbe_intr_handler,
++ .mcs_pab_intr_handler = cn10kb_mcs_pab_intr_handler,
+ };
+
+ static int mcs_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+@@ -1605,7 +1590,7 @@ static void mcs_remove(struct pci_dev *pdev)
+
+ /* Set MCS to external bypass */
+ mcs_set_external_bypass(mcs, true);
+- free_irq(pci_irq_vector(pdev, MCS_INT_VEC_IP), mcs);
++ free_irq(pci_irq_vector(pdev, mcs->hw->ip_vec), mcs);
+ pci_free_irq_vectors(pdev);
+ pci_release_regions(pdev);
+ pci_disable_device(pdev);
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs.h b/drivers/net/ethernet/marvell/octeontx2/af/mcs.h
+index 64dc2b80e15dd..0f89dcb764654 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs.h
+@@ -43,24 +43,15 @@
+ /* Reserved resources for default bypass entry */
+ #define MCS_RSRC_RSVD_CNT 1
+
+-/* MCS Interrupt Vector Enumeration */
+-enum mcs_int_vec_e {
+- MCS_INT_VEC_MIL_RX_GBL = 0x0,
+- MCS_INT_VEC_MIL_RX_LMACX = 0x1,
+- MCS_INT_VEC_MIL_TX_LMACX = 0x5,
+- MCS_INT_VEC_HIL_RX_GBL = 0x9,
+- MCS_INT_VEC_HIL_RX_LMACX = 0xa,
+- MCS_INT_VEC_HIL_TX_GBL = 0xe,
+- MCS_INT_VEC_HIL_TX_LMACX = 0xf,
+- MCS_INT_VEC_IP = 0x13,
+- MCS_INT_VEC_CNT = 0x14,
+-};
++/* MCS Interrupt Vector */
++#define MCS_CNF10KB_INT_VEC_IP 0x13
++#define MCS_CN10KB_INT_VEC_IP 0x53
+
+ #define MCS_MAX_BBE_INT 8ULL
+ #define MCS_BBE_INT_MASK 0xFFULL
+
+-#define MCS_MAX_PAB_INT 4ULL
+-#define MCS_PAB_INT_MASK 0xFULL
++#define MCS_MAX_PAB_INT 8ULL
++#define MCS_PAB_INT_MASK 0xFULL
+
+ #define MCS_BBE_RX_INT_ENA BIT_ULL(0)
+ #define MCS_BBE_TX_INT_ENA BIT_ULL(1)
+@@ -137,6 +128,7 @@ struct hwinfo {
+ u8 lmac_cnt;
+ u8 mcs_blks;
+ unsigned long lmac_bmap; /* bitmap of enabled mcs lmac */
++ u16 ip_vec;
+ };
+
+ struct mcs {
+@@ -165,6 +157,8 @@ struct mcs_ops {
+ void (*mcs_tx_sa_mem_map_write)(struct mcs *mcs, struct mcs_tx_sc_sa_map *map);
+ void (*mcs_rx_sa_mem_map_write)(struct mcs *mcs, struct mcs_rx_sc_sa_map *map);
+ void (*mcs_flowid_secy_map)(struct mcs *mcs, struct secy_mem_map *map, int dir);
++ void (*mcs_bbe_intr_handler)(struct mcs *mcs, u64 intr, enum mcs_direction dir);
++ void (*mcs_pab_intr_handler)(struct mcs *mcs, u64 intr, enum mcs_direction dir);
+ };
+
+ extern struct pci_driver mcs_driver;
+@@ -219,6 +213,8 @@ void cn10kb_mcs_tx_sa_mem_map_write(struct mcs *mcs, struct mcs_tx_sc_sa_map *ma
+ void cn10kb_mcs_flowid_secy_map(struct mcs *mcs, struct secy_mem_map *map, int dir);
+ void cn10kb_mcs_rx_sa_mem_map_write(struct mcs *mcs, struct mcs_rx_sc_sa_map *map);
+ void cn10kb_mcs_parser_cfg(struct mcs *mcs);
++void cn10kb_mcs_pab_intr_handler(struct mcs *mcs, u64 intr, enum mcs_direction dir);
++void cn10kb_mcs_bbe_intr_handler(struct mcs *mcs, u64 intr, enum mcs_direction dir);
+
+ /* CNF10K-B APIs */
+ struct mcs_ops *cnf10kb_get_mac_ops(void);
+@@ -229,6 +225,8 @@ void cnf10kb_mcs_rx_sa_mem_map_write(struct mcs *mcs, struct mcs_rx_sc_sa_map *m
+ void cnf10kb_mcs_parser_cfg(struct mcs *mcs);
+ void cnf10kb_mcs_tx_pn_thresh_reached_handler(struct mcs *mcs);
+ void cnf10kb_mcs_tx_pn_wrapped_handler(struct mcs *mcs);
++void cnf10kb_mcs_bbe_intr_handler(struct mcs *mcs, u64 intr, enum mcs_direction dir);
++void cnf10kb_mcs_pab_intr_handler(struct mcs *mcs, u64 intr, enum mcs_direction dir);
+
+ /* Stats APIs */
+ void mcs_get_sc_stats(struct mcs *mcs, struct mcs_sc_stats *stats, int id, int dir);
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs_cnf10kb.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs_cnf10kb.c
+index 7b62054144286..9f9b904ab2cd0 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs_cnf10kb.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs_cnf10kb.c
+@@ -13,6 +13,8 @@ static struct mcs_ops cnf10kb_mcs_ops = {
+ .mcs_tx_sa_mem_map_write = cnf10kb_mcs_tx_sa_mem_map_write,
+ .mcs_rx_sa_mem_map_write = cnf10kb_mcs_rx_sa_mem_map_write,
+ .mcs_flowid_secy_map = cnf10kb_mcs_flowid_secy_map,
++ .mcs_bbe_intr_handler = cnf10kb_mcs_bbe_intr_handler,
++ .mcs_pab_intr_handler = cnf10kb_mcs_pab_intr_handler,
+ };
+
+ struct mcs_ops *cnf10kb_get_mac_ops(void)
+@@ -31,6 +33,7 @@ void cnf10kb_mcs_set_hw_capabilities(struct mcs *mcs)
+ hw->lmac_cnt = 4; /* lmacs/ports per mcs block */
+ hw->mcs_x2p_intf = 1; /* x2p clabration intf */
+ hw->mcs_blks = 7; /* MCS blocks */
++ hw->ip_vec = MCS_CNF10KB_INT_VEC_IP; /* IP vector */
+ }
+
+ void cnf10kb_mcs_parser_cfg(struct mcs *mcs)
+@@ -212,3 +215,63 @@ void cnf10kb_mcs_tx_pn_wrapped_handler(struct mcs *mcs)
+ mcs_add_intr_wq_entry(mcs, &event);
+ }
+ }
++
++void cnf10kb_mcs_bbe_intr_handler(struct mcs *mcs, u64 intr,
++ enum mcs_direction dir)
++{
++ struct mcs_intr_event event = { 0 };
++ int i;
++
++ if (!(intr & MCS_BBE_INT_MASK))
++ return;
++
++ event.mcs_id = mcs->mcs_id;
++ event.pcifunc = mcs->pf_map[0];
++
++ for (i = 0; i < MCS_MAX_BBE_INT; i++) {
++ if (!(intr & BIT_ULL(i)))
++ continue;
++
++ /* Lower nibble denotes data fifo overflow interrupts and
++ * upper nibble indicates policy fifo overflow interrupts.
++ */
++ if (intr & 0xFULL)
++ event.intr_mask = (dir == MCS_RX) ?
++ MCS_BBE_RX_DFIFO_OVERFLOW_INT :
++ MCS_BBE_TX_DFIFO_OVERFLOW_INT;
++ else
++ event.intr_mask = (dir == MCS_RX) ?
++ MCS_BBE_RX_PLFIFO_OVERFLOW_INT :
++ MCS_BBE_TX_PLFIFO_OVERFLOW_INT;
++
++ /* Notify the lmac_id info which ran into BBE fatal error */
++ event.lmac_id = i & 0x3ULL;
++ mcs_add_intr_wq_entry(mcs, &event);
++ }
++}
++
++void cnf10kb_mcs_pab_intr_handler(struct mcs *mcs, u64 intr,
++ enum mcs_direction dir)
++{
++ struct mcs_intr_event event = { 0 };
++ int i;
++
++ if (!(intr & MCS_PAB_INT_MASK))
++ return;
++
++ event.mcs_id = mcs->mcs_id;
++ event.pcifunc = mcs->pf_map[0];
++
++ for (i = 0; i < MCS_MAX_PAB_INT; i++) {
++ if (!(intr & BIT_ULL(i)))
++ continue;
++
++ event.intr_mask = (dir == MCS_RX) ?
++ MCS_PAB_RX_CHAN_OVERFLOW_INT :
++ MCS_PAB_TX_CHAN_OVERFLOW_INT;
++
++ /* Notify the lmac_id info which ran into PAB fatal error */
++ event.lmac_id = i;
++ mcs_add_intr_wq_entry(mcs, &event);
++ }
++}
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h b/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h
+index 7427e3b1490f4..f3ab01fc363c8 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs_reg.h
+@@ -276,7 +276,10 @@
+ #define MCSX_BBE_RX_SLAVE_CAL_ENTRY 0x180ull
+ #define MCSX_BBE_RX_SLAVE_CAL_LEN 0x188ull
+ #define MCSX_PAB_RX_SLAVE_FIFO_SKID_CFGX(a) (0x290ull + (a) * 0x40ull)
+-
++#define MCSX_BBE_RX_SLAVE_DFIFO_OVERFLOW_0 0xe20
++#define MCSX_BBE_TX_SLAVE_DFIFO_OVERFLOW_0 0x1298
++#define MCSX_BBE_RX_SLAVE_PLFIFO_OVERFLOW_0 0xe40
++#define MCSX_BBE_TX_SLAVE_PLFIFO_OVERFLOW_0 0x12b8
+ #define MCSX_BBE_RX_SLAVE_BBE_INT ({ \
+ u64 offset; \
+ \
+--
+2.39.2
+
--- /dev/null
+From 1fad31b69f369c2195234f94f4de7053447561e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 11:55:21 +0530
+Subject: octeontx2-af: mcs: Write TCAM_DATA and TCAM_MASK registers at once
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit b51612198603fce33d6cf57b4864e3018a1cd9b8 ]
+
+As per hardware errata on CN10KB, all the four TCAM_DATA
+and TCAM_MASK registers has to be written at once otherwise
+write to individual registers will fail. Hence write to all
+TCAM_DATA registers and then to all TCAM_MASK registers.
+
+Fixes: cfc14181d497 ("octeontx2-af: cn10k: mcs: Manage the MCS block hardware resources")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/mcs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
+index 492baa0b594ce..148417d633a56 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
+@@ -473,6 +473,8 @@ void mcs_flowid_entry_write(struct mcs *mcs, u64 *data, u64 *mask, int flow_id,
+ for (reg_id = 0; reg_id < 4; reg_id++) {
+ reg = MCSX_CPM_RX_SLAVE_FLOWID_TCAM_DATAX(reg_id, flow_id);
+ mcs_reg_write(mcs, reg, data[reg_id]);
++ }
++ for (reg_id = 0; reg_id < 4; reg_id++) {
+ reg = MCSX_CPM_RX_SLAVE_FLOWID_TCAM_MASKX(reg_id, flow_id);
+ mcs_reg_write(mcs, reg, mask[reg_id]);
+ }
+@@ -480,6 +482,8 @@ void mcs_flowid_entry_write(struct mcs *mcs, u64 *data, u64 *mask, int flow_id,
+ for (reg_id = 0; reg_id < 4; reg_id++) {
+ reg = MCSX_CPM_TX_SLAVE_FLOWID_TCAM_DATAX(reg_id, flow_id);
+ mcs_reg_write(mcs, reg, data[reg_id]);
++ }
++ for (reg_id = 0; reg_id < 4; reg_id++) {
+ reg = MCSX_CPM_TX_SLAVE_FLOWID_TCAM_MASKX(reg_id, flow_id);
+ mcs_reg_write(mcs, reg, mask[reg_id]);
+ }
+--
+2.39.2
+
--- /dev/null
+From 0eaffdc20235e5da65ad41c40014c36bb1f86997 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 12:39:34 +0530
+Subject: octeontx2-af: Secure APR table update with the lock
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit 048486f81d01db4d100af021ee2ea211d19732a0 ]
+
+APR table contains the lmtst base address of PF/VFs. These entries
+are updated by the PF/VF during the device probe. The lmtst address
+is fetched from HW using "TXN_REQ" and "ADDR_RSP_STS" registers.
+The lock tries to protect these registers from getting overwritten
+when multiple PFs invokes rvu_get_lmtaddr() simultaneously.
+
+For example, if PF1 submit the request and got permitted before it
+reads the response and PF2 got scheduled submit the request then the
+response of PF1 is overwritten by the PF2 response.
+
+Fixes: 893ae97214c3 ("octeontx2-af: cn10k: Support configurable LMTST regions")
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
+Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
+index 4ad9ff025c964..0e74c5a2231e6 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
+@@ -60,13 +60,14 @@ static int rvu_get_lmtaddr(struct rvu *rvu, u16 pcifunc,
+ u64 iova, u64 *lmt_addr)
+ {
+ u64 pa, val, pf;
+- int err;
++ int err = 0;
+
+ if (!iova) {
+ dev_err(rvu->dev, "%s Requested Null address for transulation\n", __func__);
+ return -EINVAL;
+ }
+
++ mutex_lock(&rvu->rsrc_lock);
+ rvu_write64(rvu, BLKADDR_RVUM, RVU_AF_SMMU_ADDR_REQ, iova);
+ pf = rvu_get_pf(pcifunc) & 0x1F;
+ val = BIT_ULL(63) | BIT_ULL(14) | BIT_ULL(13) | pf << 8 |
+@@ -76,12 +77,13 @@ static int rvu_get_lmtaddr(struct rvu *rvu, u16 pcifunc,
+ err = rvu_poll_reg(rvu, BLKADDR_RVUM, RVU_AF_SMMU_ADDR_RSP_STS, BIT_ULL(0), false);
+ if (err) {
+ dev_err(rvu->dev, "%s LMTLINE iova transulation failed\n", __func__);
+- return err;
++ goto exit;
+ }
+ val = rvu_read64(rvu, BLKADDR_RVUM, RVU_AF_SMMU_ADDR_RSP_STS);
+ if (val & ~0x1ULL) {
+ dev_err(rvu->dev, "%s LMTLINE iova transulation failed err:%llx\n", __func__, val);
+- return -EIO;
++ err = -EIO;
++ goto exit;
+ }
+ /* PA[51:12] = RVU_AF_SMMU_TLN_FLIT0[57:18]
+ * PA[11:0] = IOVA[11:0]
+@@ -89,8 +91,9 @@ static int rvu_get_lmtaddr(struct rvu *rvu, u16 pcifunc,
+ pa = rvu_read64(rvu, BLKADDR_RVUM, RVU_AF_SMMU_TLN_FLIT0) >> 18;
+ pa &= GENMASK_ULL(39, 0);
+ *lmt_addr = (pa << 12) | (iova & 0xFFF);
+-
+- return 0;
++exit:
++ mutex_unlock(&rvu->rsrc_lock);
++ return err;
+ }
+
+ static int rvu_update_lmtaddr(struct rvu *rvu, u16 pcifunc, u64 lmt_addr)
+--
+2.39.2
+
--- /dev/null
+From 41c055f7a51605541f547bdea852aef5d75322c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 12:39:42 +0530
+Subject: octeontx2-af: Skip PFs if not enabled
+
+From: Ratheesh Kannoth <rkannoth@marvell.com>
+
+[ Upstream commit 5eb1b7220948a69298a436148a735f32ec325289 ]
+
+Firmware enables PFs and allocate mbox resources for each of the PFs.
+Currently PF driver configures mbox resources without checking whether
+PF is enabled or not. This results in crash. This patch fixes this issue
+by skipping disabled PF's mbox initialization.
+
+Fixes: 9bdc47a6e328 ("octeontx2-af: Mbox communication support btw AF and it's VFs")
+Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
+Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
+Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/af/mbox.c | 5 +-
+ .../net/ethernet/marvell/octeontx2/af/mbox.h | 3 +-
+ .../net/ethernet/marvell/octeontx2/af/rvu.c | 49 +++++++++++++++----
+ 3 files changed, 46 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.c b/drivers/net/ethernet/marvell/octeontx2/af/mbox.c
+index 2898931d5260a..9690ac01f02c8 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.c
+@@ -157,7 +157,7 @@ EXPORT_SYMBOL(otx2_mbox_init);
+ */
+ int otx2_mbox_regions_init(struct otx2_mbox *mbox, void **hwbase,
+ struct pci_dev *pdev, void *reg_base,
+- int direction, int ndevs)
++ int direction, int ndevs, unsigned long *pf_bmap)
+ {
+ struct otx2_mbox_dev *mdev;
+ int devid, err;
+@@ -169,6 +169,9 @@ int otx2_mbox_regions_init(struct otx2_mbox *mbox, void **hwbase,
+ mbox->hwbase = hwbase[0];
+
+ for (devid = 0; devid < ndevs; devid++) {
++ if (!test_bit(devid, pf_bmap))
++ continue;
++
+ mdev = &mbox->dev[devid];
+ mdev->mbase = hwbase[devid];
+ mdev->hwbase = hwbase[devid];
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
+index 0ce533848536e..26636a4d7dcc6 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
+@@ -96,9 +96,10 @@ void otx2_mbox_destroy(struct otx2_mbox *mbox);
+ int otx2_mbox_init(struct otx2_mbox *mbox, void __force *hwbase,
+ struct pci_dev *pdev, void __force *reg_base,
+ int direction, int ndevs);
++
+ int otx2_mbox_regions_init(struct otx2_mbox *mbox, void __force **hwbase,
+ struct pci_dev *pdev, void __force *reg_base,
+- int direction, int ndevs);
++ int direction, int ndevs, unsigned long *bmap);
+ void otx2_mbox_msg_send(struct otx2_mbox *mbox, int devid);
+ int otx2_mbox_wait_for_rsp(struct otx2_mbox *mbox, int devid);
+ int otx2_mbox_busy_poll_for_rsp(struct otx2_mbox *mbox, int devid);
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+index 8683ce57ed3fb..9f673bda9dbdd 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+@@ -2282,7 +2282,7 @@ static inline void rvu_afvf_mbox_up_handler(struct work_struct *work)
+ }
+
+ static int rvu_get_mbox_regions(struct rvu *rvu, void **mbox_addr,
+- int num, int type)
++ int num, int type, unsigned long *pf_bmap)
+ {
+ struct rvu_hwinfo *hw = rvu->hw;
+ int region;
+@@ -2294,6 +2294,9 @@ static int rvu_get_mbox_regions(struct rvu *rvu, void **mbox_addr,
+ */
+ if (type == TYPE_AFVF) {
+ for (region = 0; region < num; region++) {
++ if (!test_bit(region, pf_bmap))
++ continue;
++
+ if (hw->cap.per_pf_mbox_regs) {
+ bar4 = rvu_read64(rvu, BLKADDR_RVUM,
+ RVU_AF_PFX_BAR4_ADDR(0)) +
+@@ -2315,6 +2318,9 @@ static int rvu_get_mbox_regions(struct rvu *rvu, void **mbox_addr,
+ * RVU_AF_PF_BAR4_ADDR register.
+ */
+ for (region = 0; region < num; region++) {
++ if (!test_bit(region, pf_bmap))
++ continue;
++
+ if (hw->cap.per_pf_mbox_regs) {
+ bar4 = rvu_read64(rvu, BLKADDR_RVUM,
+ RVU_AF_PFX_BAR4_ADDR(region));
+@@ -2343,20 +2349,41 @@ static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw,
+ int err = -EINVAL, i, dir, dir_up;
+ void __iomem *reg_base;
+ struct rvu_work *mwork;
++ unsigned long *pf_bmap;
+ void **mbox_regions;
+ const char *name;
++ u64 cfg;
+
+- mbox_regions = kcalloc(num, sizeof(void *), GFP_KERNEL);
+- if (!mbox_regions)
++ pf_bmap = bitmap_zalloc(num, GFP_KERNEL);
++ if (!pf_bmap)
+ return -ENOMEM;
+
++ /* RVU VFs */
++ if (type == TYPE_AFVF)
++ bitmap_set(pf_bmap, 0, num);
++
++ if (type == TYPE_AFPF) {
++ /* Mark enabled PFs in bitmap */
++ for (i = 0; i < num; i++) {
++ cfg = rvu_read64(rvu, BLKADDR_RVUM, RVU_PRIV_PFX_CFG(i));
++ if (cfg & BIT_ULL(20))
++ set_bit(i, pf_bmap);
++ }
++ }
++
++ mbox_regions = kcalloc(num, sizeof(void *), GFP_KERNEL);
++ if (!mbox_regions) {
++ err = -ENOMEM;
++ goto free_bitmap;
++ }
++
+ switch (type) {
+ case TYPE_AFPF:
+ name = "rvu_afpf_mailbox";
+ dir = MBOX_DIR_AFPF;
+ dir_up = MBOX_DIR_AFPF_UP;
+ reg_base = rvu->afreg_base;
+- err = rvu_get_mbox_regions(rvu, mbox_regions, num, TYPE_AFPF);
++ err = rvu_get_mbox_regions(rvu, mbox_regions, num, TYPE_AFPF, pf_bmap);
+ if (err)
+ goto free_regions;
+ break;
+@@ -2365,7 +2392,7 @@ static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw,
+ dir = MBOX_DIR_PFVF;
+ dir_up = MBOX_DIR_PFVF_UP;
+ reg_base = rvu->pfreg_base;
+- err = rvu_get_mbox_regions(rvu, mbox_regions, num, TYPE_AFVF);
++ err = rvu_get_mbox_regions(rvu, mbox_regions, num, TYPE_AFVF, pf_bmap);
+ if (err)
+ goto free_regions;
+ break;
+@@ -2396,16 +2423,19 @@ static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw,
+ }
+
+ err = otx2_mbox_regions_init(&mw->mbox, mbox_regions, rvu->pdev,
+- reg_base, dir, num);
++ reg_base, dir, num, pf_bmap);
+ if (err)
+ goto exit;
+
+ err = otx2_mbox_regions_init(&mw->mbox_up, mbox_regions, rvu->pdev,
+- reg_base, dir_up, num);
++ reg_base, dir_up, num, pf_bmap);
+ if (err)
+ goto exit;
+
+ for (i = 0; i < num; i++) {
++ if (!test_bit(i, pf_bmap))
++ continue;
++
+ mwork = &mw->mbox_wrk[i];
+ mwork->rvu = rvu;
+ INIT_WORK(&mwork->work, mbox_handler);
+@@ -2414,8 +2444,7 @@ static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw,
+ mwork->rvu = rvu;
+ INIT_WORK(&mwork->work, mbox_up_handler);
+ }
+- kfree(mbox_regions);
+- return 0;
++ goto free_regions;
+
+ exit:
+ destroy_workqueue(mw->mbox_wq);
+@@ -2424,6 +2453,8 @@ static int rvu_mbox_init(struct rvu *rvu, struct mbox_wq_info *mw,
+ iounmap((void __iomem *)mbox_regions[num]);
+ free_regions:
+ kfree(mbox_regions);
++free_bitmap:
++ bitmap_free(pf_bmap);
+ return err;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From b0257805072a907aca50c88f11e293d6e7c45a1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 12:39:39 +0530
+Subject: octeontx2-af: Update correct mask to filter IPv4 fragments
+
+From: Suman Ghosh <sumang@marvell.com>
+
+[ Upstream commit 2075bf150ddf320df02c05e242774dc0f73be1a1 ]
+
+During the initial design, the IPv4 ip_flag mask was set to 0xff.
+Which results to filter only fragmets with (fragment_offset == 0).
+As part of the fix, updated the mask to 0x20 to filter all the
+fragmented packets irrespective of the fragment_offset value.
+
+Fixes: c672e3727989 ("octeontx2-pf: Add support to filter packet based on IP fragment")
+Signed-off-by: Suman Ghosh <sumang@marvell.com>
+Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
+Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
+index 044cc211424ed..8392f63e433fc 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
+@@ -544,7 +544,7 @@ static int otx2_tc_prepare_flow(struct otx2_nic *nic, struct otx2_tc_flow *node,
+ if (match.mask->flags & FLOW_DIS_IS_FRAGMENT) {
+ if (ntohs(flow_spec->etype) == ETH_P_IP) {
+ flow_spec->ip_flag = IPV4_FLAG_MORE;
+- flow_mask->ip_flag = 0xff;
++ flow_mask->ip_flag = IPV4_FLAG_MORE;
+ req->features |= BIT_ULL(NPC_IPFRAG_IPV4);
+ } else if (ntohs(flow_spec->etype) == ETH_P_IPV6) {
+ flow_spec->next_header = IPPROTO_FRAGMENT;
+--
+2.39.2
+
--- /dev/null
+From 9b36274116fff03a314c426e2ca02d0da32950ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 12:39:40 +0530
+Subject: octeontx2-af: Update/Fix NPC field hash extract feature
+
+From: Ratheesh Kannoth <rkannoth@marvell.com>
+
+[ Upstream commit 406bed11fb91a0b35c26fe633d8700febaec6439 ]
+
+1. As per previous implementation, mask and control parameter to
+generate the field hash value was not passed to the caller program.
+Updated the secret key mbox to share that information as well,
+as a part of the fix.
+2. Earlier implementation did not consider hash reduction of both
+source and destination IPv6 addresses. Only source IPv6 address
+was considered. This fix solves that and provides option to hash
+
+Fixes: 56d9f5fd2246 ("octeontx2-af: Use hashed field in MCAM key")
+Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
+Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
+Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/af/mbox.h | 16 +++++---
+ .../marvell/octeontx2/af/rvu_npc_hash.c | 37 ++++++++++++-------
+ .../marvell/octeontx2/af/rvu_npc_hash.h | 6 +++
+ 3 files changed, 41 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
+index 5727d67e0259c..0ce533848536e 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
+@@ -245,9 +245,9 @@ M(NPC_MCAM_READ_BASE_RULE, 0x6011, npc_read_base_steer_rule, \
+ M(NPC_MCAM_GET_STATS, 0x6012, npc_mcam_entry_stats, \
+ npc_mcam_get_stats_req, \
+ npc_mcam_get_stats_rsp) \
+-M(NPC_GET_SECRET_KEY, 0x6013, npc_get_secret_key, \
+- npc_get_secret_key_req, \
+- npc_get_secret_key_rsp) \
++M(NPC_GET_FIELD_HASH_INFO, 0x6013, npc_get_field_hash_info, \
++ npc_get_field_hash_info_req, \
++ npc_get_field_hash_info_rsp) \
+ M(NPC_GET_FIELD_STATUS, 0x6014, npc_get_field_status, \
+ npc_get_field_status_req, \
+ npc_get_field_status_rsp) \
+@@ -1524,14 +1524,20 @@ struct npc_mcam_get_stats_rsp {
+ u8 stat_ena; /* enabled */
+ };
+
+-struct npc_get_secret_key_req {
++struct npc_get_field_hash_info_req {
+ struct mbox_msghdr hdr;
+ u8 intf;
+ };
+
+-struct npc_get_secret_key_rsp {
++struct npc_get_field_hash_info_rsp {
+ struct mbox_msghdr hdr;
+ u64 secret_key[3];
++#define NPC_MAX_HASH 2
++#define NPC_MAX_HASH_MASK 2
++ /* NPC_AF_INTF(0..1)_HASH(0..1)_MASK(0..1) */
++ u64 hash_mask[NPC_MAX_INTF][NPC_MAX_HASH][NPC_MAX_HASH_MASK];
++ /* NPC_AF_INTF(0..1)_HASH(0..1)_RESULT_CTRL */
++ u64 hash_ctrl[NPC_MAX_INTF][NPC_MAX_HASH];
+ };
+
+ enum ptp_op {
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
+index 6597af84aa367..68f813040363d 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
+@@ -110,8 +110,8 @@ static u64 npc_update_use_hash(int lt, int ld)
+ * in KEX_LD_CFG
+ */
+ cfg = KEX_LD_CFG_USE_HASH(0x1, 0x03,
+- ld ? 0x8 : 0x18,
+- 0x1, 0x0, 0x10);
++ ld ? 0x18 : 0x8,
++ 0x1, 0x0, ld ? 0x14 : 0x10);
+ break;
+ }
+
+@@ -134,7 +134,6 @@ static void npc_program_mkex_hash_rx(struct rvu *rvu, int blkaddr,
+ if (mkex_hash->lid_lt_ld_hash_en[intf][lid][lt][ld]) {
+ u64 cfg = npc_update_use_hash(lt, ld);
+
+- hash_cnt++;
+ if (hash_cnt == NPC_MAX_HASH)
+ return;
+
+@@ -149,6 +148,8 @@ static void npc_program_mkex_hash_rx(struct rvu *rvu, int blkaddr,
+ mkex_hash->hash_mask[intf][ld][1]);
+ SET_KEX_LD_HASH_CTRL(intf, ld,
+ mkex_hash->hash_ctrl[intf][ld]);
++
++ hash_cnt++;
+ }
+ }
+ }
+@@ -171,7 +172,6 @@ static void npc_program_mkex_hash_tx(struct rvu *rvu, int blkaddr,
+ if (mkex_hash->lid_lt_ld_hash_en[intf][lid][lt][ld]) {
+ u64 cfg = npc_update_use_hash(lt, ld);
+
+- hash_cnt++;
+ if (hash_cnt == NPC_MAX_HASH)
+ return;
+
+@@ -187,8 +187,6 @@ static void npc_program_mkex_hash_tx(struct rvu *rvu, int blkaddr,
+ SET_KEX_LD_HASH_CTRL(intf, ld,
+ mkex_hash->hash_ctrl[intf][ld]);
+ hash_cnt++;
+- if (hash_cnt == NPC_MAX_HASH)
+- return;
+ }
+ }
+ }
+@@ -238,8 +236,8 @@ void npc_update_field_hash(struct rvu *rvu, u8 intf,
+ struct flow_msg *omask)
+ {
+ struct npc_mcam_kex_hash *mkex_hash = rvu->kpu.mkex_hash;
+- struct npc_get_secret_key_req req;
+- struct npc_get_secret_key_rsp rsp;
++ struct npc_get_field_hash_info_req req;
++ struct npc_get_field_hash_info_rsp rsp;
+ u64 ldata[2], cfg;
+ u32 field_hash;
+ u8 hash_idx;
+@@ -250,7 +248,7 @@ void npc_update_field_hash(struct rvu *rvu, u8 intf,
+ }
+
+ req.intf = intf;
+- rvu_mbox_handler_npc_get_secret_key(rvu, &req, &rsp);
++ rvu_mbox_handler_npc_get_field_hash_info(rvu, &req, &rsp);
+
+ for (hash_idx = 0; hash_idx < NPC_MAX_HASH; hash_idx++) {
+ cfg = rvu_read64(rvu, blkaddr, NPC_AF_INTFX_HASHX_CFG(intf, hash_idx));
+@@ -311,13 +309,13 @@ void npc_update_field_hash(struct rvu *rvu, u8 intf,
+ }
+ }
+
+-int rvu_mbox_handler_npc_get_secret_key(struct rvu *rvu,
+- struct npc_get_secret_key_req *req,
+- struct npc_get_secret_key_rsp *rsp)
++int rvu_mbox_handler_npc_get_field_hash_info(struct rvu *rvu,
++ struct npc_get_field_hash_info_req *req,
++ struct npc_get_field_hash_info_rsp *rsp)
+ {
+ u64 *secret_key = rsp->secret_key;
+ u8 intf = req->intf;
+- int blkaddr;
++ int i, j, blkaddr;
+
+ blkaddr = rvu_get_blkaddr(rvu, BLKTYPE_NPC, 0);
+ if (blkaddr < 0) {
+@@ -329,6 +327,19 @@ int rvu_mbox_handler_npc_get_secret_key(struct rvu *rvu,
+ secret_key[1] = rvu_read64(rvu, blkaddr, NPC_AF_INTFX_SECRET_KEY1(intf));
+ secret_key[2] = rvu_read64(rvu, blkaddr, NPC_AF_INTFX_SECRET_KEY2(intf));
+
++ for (i = 0; i < NPC_MAX_HASH; i++) {
++ for (j = 0; j < NPC_MAX_HASH_MASK; j++) {
++ rsp->hash_mask[NIX_INTF_RX][i][j] =
++ GET_KEX_LD_HASH_MASK(NIX_INTF_RX, i, j);
++ rsp->hash_mask[NIX_INTF_TX][i][j] =
++ GET_KEX_LD_HASH_MASK(NIX_INTF_TX, i, j);
++ }
++ }
++
++ for (i = 0; i < NPC_MAX_INTF; i++)
++ for (j = 0; j < NPC_MAX_HASH; j++)
++ rsp->hash_ctrl[i][j] = GET_KEX_LD_HASH_CTRL(i, j);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h
+index 3efeb09c58dec..65936f4aeaacf 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h
+@@ -31,6 +31,12 @@
+ rvu_write64(rvu, blkaddr, \
+ NPC_AF_INTFX_HASHX_MASKX(intf, ld, mask_idx), cfg)
+
++#define GET_KEX_LD_HASH_CTRL(intf, ld) \
++ rvu_read64(rvu, blkaddr, NPC_AF_INTFX_HASHX_RESULT_CTRL(intf, ld))
++
++#define GET_KEX_LD_HASH_MASK(intf, ld, mask_idx) \
++ rvu_read64(rvu, blkaddr, NPC_AF_INTFX_HASHX_MASKX(intf, ld, mask_idx))
++
+ #define SET_KEX_LD_HASH_CTRL(intf, ld, cfg) \
+ rvu_write64(rvu, blkaddr, \
+ NPC_AF_INTFX_HASHX_RESULT_CTRL(intf, ld), cfg)
+--
+2.39.2
+
--- /dev/null
+From 2c26d7b7739ddff5e0c1c4996ff5a049269b8190 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 12:39:43 +0530
+Subject: octeontx2-pf: Disable packet I/O for graceful exit
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit c926252205c424c4842dbdbe02f8e3296f623204 ]
+
+At the stage of enabling packet I/O in otx2_open, If mailbox
+timeout occurs then interface ends up in down state where as
+hardware packet I/O is enabled. Hence disable packet I/O also
+before bailing out.
+
+Fixes: 1ea0166da050 ("octeontx2-pf: Fix the device state on error")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
+Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+index a75c944cc739d..18284ad751572 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+@@ -1835,13 +1835,22 @@ int otx2_open(struct net_device *netdev)
+ otx2_dmacflt_reinstall_flows(pf);
+
+ err = otx2_rxtx_enable(pf, true);
+- if (err)
++ /* If a mbox communication error happens at this point then interface
++ * will end up in a state such that it is in down state but hardware
++ * mcam entries are enabled to receive the packets. Hence disable the
++ * packet I/O.
++ */
++ if (err == EIO)
++ goto err_disable_rxtx;
++ else if (err)
+ goto err_tx_stop_queues;
+
+ otx2_do_set_rx_mode(pf);
+
+ return 0;
+
++err_disable_rxtx:
++ otx2_rxtx_enable(pf, false);
+ err_tx_stop_queues:
+ netif_tx_stop_all_queues(netdev);
+ netif_carrier_off(netdev);
+--
+2.39.2
+
--- /dev/null
+From 6fd669fe78118f365f76d51c1e24655da3f1f932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 12:39:37 +0530
+Subject: octeontx2-pf: Increase the size of dmac filter flows
+
+From: Ratheesh Kannoth <rkannoth@marvell.com>
+
+[ Upstream commit 2a6eecc592b4d59a04d513aa25fc0f30d52100cd ]
+
+CN10kb supports large number of dmac filter flows to be
+inserted. Increase the field size to accommodate the same
+
+Fixes: b747923afff8 ("octeontx2-af: Exact match support")
+Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
+Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
+Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+index f42b2b65bfd7b..0c8fc66ade82d 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+@@ -335,11 +335,11 @@ struct otx2_flow_config {
+ #define OTX2_PER_VF_VLAN_FLOWS 2 /* Rx + Tx per VF */
+ #define OTX2_VF_VLAN_RX_INDEX 0
+ #define OTX2_VF_VLAN_TX_INDEX 1
+- u16 max_flows;
+- u8 dmacflt_max_flows;
+ u32 *bmap_to_dmacindex;
+ unsigned long *dmacflt_bmap;
+ struct list_head flow_list;
++ u32 dmacflt_max_flows;
++ u16 max_flows;
+ };
+
+ struct otx2_tc_info {
+--
+2.39.2
+
--- /dev/null
+From 2f0fdf57260c7e40ca71dc8f1385d2c2e5dfc65c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 11:55:26 +0530
+Subject: octeontx2-pf: mcs: Clear stats before freeing resource
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit 815debbbf7b52026462c37eea3be70d6377a7a9a ]
+
+When freeing MCS hardware resources like SecY, SC and
+SA the corresponding stats needs to be cleared. Otherwise
+previous stats are shown in newly created macsec interfaces.
+
+Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
+index f699209978fef..13faca9add9f4 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
+@@ -150,11 +150,20 @@ static void cn10k_mcs_free_rsrc(struct otx2_nic *pfvf, enum mcs_direction dir,
+ enum mcs_rsrc_type type, u16 hw_rsrc_id,
+ bool all)
+ {
++ struct mcs_clear_stats *clear_req;
+ struct mbox *mbox = &pfvf->mbox;
+ struct mcs_free_rsrc_req *req;
+
+ mutex_lock(&mbox->lock);
+
++ clear_req = otx2_mbox_alloc_msg_mcs_clear_stats(mbox);
++ if (!clear_req)
++ goto fail;
++
++ clear_req->id = hw_rsrc_id;
++ clear_req->type = type;
++ clear_req->dir = dir;
++
+ req = otx2_mbox_alloc_msg_mcs_free_resources(mbox);
+ if (!req)
+ goto fail;
+--
+2.39.2
+
--- /dev/null
+From 30137dbc4e6d0a904252941e3edae17594782c86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 11:55:28 +0530
+Subject: octeontx2-pf: mcs: Do not reset PN while updating secy
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit 3c99bace4ad08ad0264285ba8ad73117560992c2 ]
+
+After creating SecYs, SCs and SAs a SecY can be modified
+to change attributes like validation mode, protect frames
+mode etc. During this SecY update, packet number is reset to
+initial user given value by mistake. Hence do not reset
+PN when updating SecY parameters.
+
+Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
+index 3ad8d7ef20be6..a487a98eac88c 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
+@@ -1134,6 +1134,7 @@ static int cn10k_mdo_upd_secy(struct macsec_context *ctx)
+ struct macsec_secy *secy = ctx->secy;
+ struct macsec_tx_sa *sw_tx_sa;
+ struct cn10k_mcs_txsc *txsc;
++ bool active;
+ u8 sa_num;
+ int err;
+
+@@ -1141,15 +1142,19 @@ static int cn10k_mdo_upd_secy(struct macsec_context *ctx)
+ if (!txsc)
+ return -ENOENT;
+
+- txsc->encoding_sa = secy->tx_sc.encoding_sa;
+-
+- sa_num = txsc->encoding_sa;
+- sw_tx_sa = rcu_dereference_bh(secy->tx_sc.sa[sa_num]);
++ /* Encoding SA got changed */
++ if (txsc->encoding_sa != secy->tx_sc.encoding_sa) {
++ txsc->encoding_sa = secy->tx_sc.encoding_sa;
++ sa_num = txsc->encoding_sa;
++ sw_tx_sa = rcu_dereference_bh(secy->tx_sc.sa[sa_num]);
++ active = sw_tx_sa ? sw_tx_sa->active : false;
++ cn10k_mcs_link_tx_sa2sc(pfvf, secy, txsc, sa_num, active);
++ }
+
+ if (netif_running(secy->netdev)) {
+ cn10k_mcs_sync_stats(pfvf, secy, txsc);
+
+- err = cn10k_mcs_secy_tx_cfg(pfvf, secy, txsc, sw_tx_sa, sa_num);
++ err = cn10k_mcs_secy_tx_cfg(pfvf, secy, txsc, NULL, 0);
+ if (err)
+ return err;
+ }
+--
+2.39.2
+
--- /dev/null
+From 3751a15f1cbe5876e83d78e861f5413bdb37362d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 11:55:24 +0530
+Subject: octeontx2-pf: mcs: Fix NULL pointer dereferences
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit 699af748c61574125d269db260dabbe20436d74e ]
+
+When system is rebooted after creating macsec interface
+below NULL pointer dereference crashes occurred. This
+patch fixes those crashes by using correct order of teardown
+
+[ 3324.406942] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+[ 3324.415726] Mem abort info:
+[ 3324.418510] ESR = 0x96000006
+[ 3324.421557] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 3324.426865] SET = 0, FnV = 0
+[ 3324.429913] EA = 0, S1PTW = 0
+[ 3324.433047] Data abort info:
+[ 3324.435921] ISV = 0, ISS = 0x00000006
+[ 3324.439748] CM = 0, WnR = 0
+....
+[ 3324.575915] Call trace:
+[ 3324.578353] cn10k_mdo_del_secy+0x24/0x180
+[ 3324.582440] macsec_common_dellink+0xec/0x120
+[ 3324.586788] macsec_notify+0x17c/0x1c0
+[ 3324.590529] raw_notifier_call_chain+0x50/0x70
+[ 3324.594965] call_netdevice_notifiers_info+0x34/0x7c
+[ 3324.599921] rollback_registered_many+0x354/0x5bc
+[ 3324.604616] unregister_netdevice_queue+0x88/0x10c
+[ 3324.609399] unregister_netdev+0x20/0x30
+[ 3324.613313] otx2_remove+0x8c/0x310
+[ 3324.616794] pci_device_shutdown+0x30/0x70
+[ 3324.620882] device_shutdown+0x11c/0x204
+
+[ 966.664930] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+[ 966.673712] Mem abort info:
+[ 966.676497] ESR = 0x96000006
+[ 966.679543] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 966.684848] SET = 0, FnV = 0
+[ 966.687895] EA = 0, S1PTW = 0
+[ 966.691028] Data abort info:
+[ 966.693900] ISV = 0, ISS = 0x00000006
+[ 966.697729] CM = 0, WnR = 0
+[ 966.833467] Call trace:
+[ 966.835904] cn10k_mdo_stop+0x20/0xa0
+[ 966.839557] macsec_dev_stop+0xe8/0x11c
+[ 966.843384] __dev_close_many+0xbc/0x140
+[ 966.847298] dev_close_many+0x84/0x120
+[ 966.851039] rollback_registered_many+0x114/0x5bc
+[ 966.855735] unregister_netdevice_many.part.0+0x14/0xa0
+[ 966.860952] unregister_netdevice_many+0x18/0x24
+[ 966.865560] macsec_notify+0x1ac/0x1c0
+[ 966.869303] raw_notifier_call_chain+0x50/0x70
+[ 966.873738] call_netdevice_notifiers_info+0x34/0x7c
+[ 966.878694] rollback_registered_many+0x354/0x5bc
+[ 966.883390] unregister_netdevice_queue+0x88/0x10c
+[ 966.888173] unregister_netdev+0x20/0x30
+[ 966.892090] otx2_remove+0x8c/0x310
+[ 966.895571] pci_device_shutdown+0x30/0x70
+[ 966.899660] device_shutdown+0x11c/0x204
+[ 966.903574] __do_sys_reboot+0x208/0x290
+[ 966.907487] __arm64_sys_reboot+0x20/0x30
+[ 966.911489] el0_svc_handler+0x80/0x1c0
+[ 966.915316] el0_svc+0x8/0x180
+[ 966.918362] Code: f9400000 f9400a64 91220014 f94b3403 (f9400060)
+[ 966.924448] ---[ end trace 341778e799c3d8d7 ]---
+
+Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+index 179433d0a54a6..a75c944cc739d 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+@@ -3073,8 +3073,6 @@ static void otx2_remove(struct pci_dev *pdev)
+ otx2_config_pause_frm(pf);
+ }
+
+- cn10k_mcs_free(pf);
+-
+ #ifdef CONFIG_DCB
+ /* Disable PFC config */
+ if (pf->pfc_en) {
+@@ -3088,6 +3086,7 @@ static void otx2_remove(struct pci_dev *pdev)
+
+ otx2_unregister_dl(pf);
+ unregister_netdev(netdev);
++ cn10k_mcs_free(pf);
+ otx2_sriov_disable(pf->pdev);
+ otx2_sriov_vfcfg_cleanup(pf);
+ if (pf->otx2_wq)
+--
+2.39.2
+
--- /dev/null
+From 51a5a70605ebff366b26f13cf2da197eab57dee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 11:55:27 +0530
+Subject: octeontx2-pf: mcs: Fix shared counters logic
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit 9bdfe61054fb2b989eb58df20bf99c0cf67e3038 ]
+
+Macsec stats like InPktsLate and InPktsDelayed share
+same counter in hardware. If SecY replay_protect is true
+then counter represents InPktsLate otherwise InPktsDelayed.
+This mode change was tracked based on protect_frames
+instead of replay_protect mistakenly. Similarly InPktsUnchecked
+and InPktsOk share same counter and mode change was tracked
+based on validate_check instead of validate_disabled.
+This patch fixes those problems.
+
+Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 14 +++++++-------
+ .../ethernet/marvell/octeontx2/nic/otx2_common.h | 2 +-
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
+index 13faca9add9f4..3ad8d7ef20be6 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
+@@ -1014,7 +1014,7 @@ static void cn10k_mcs_sync_stats(struct otx2_nic *pfvf, struct macsec_secy *secy
+
+ /* Check if sync is really needed */
+ if (secy->validate_frames == txsc->last_validate_frames &&
+- secy->protect_frames == txsc->last_protect_frames)
++ secy->replay_protect == txsc->last_replay_protect)
+ return;
+
+ cn10k_mcs_secy_stats(pfvf, txsc->hw_secy_id_rx, &rx_rsp, MCS_RX, true);
+@@ -1036,19 +1036,19 @@ static void cn10k_mcs_sync_stats(struct otx2_nic *pfvf, struct macsec_secy *secy
+ rxsc->stats.InPktsInvalid += sc_rsp.pkt_invalid_cnt;
+ rxsc->stats.InPktsNotValid += sc_rsp.pkt_notvalid_cnt;
+
+- if (txsc->last_protect_frames)
++ if (txsc->last_replay_protect)
+ rxsc->stats.InPktsLate += sc_rsp.pkt_late_cnt;
+ else
+ rxsc->stats.InPktsDelayed += sc_rsp.pkt_late_cnt;
+
+- if (txsc->last_validate_frames == MACSEC_VALIDATE_CHECK)
++ if (txsc->last_validate_frames == MACSEC_VALIDATE_DISABLED)
+ rxsc->stats.InPktsUnchecked += sc_rsp.pkt_unchecked_cnt;
+ else
+ rxsc->stats.InPktsOK += sc_rsp.pkt_unchecked_cnt;
+ }
+
+ txsc->last_validate_frames = secy->validate_frames;
+- txsc->last_protect_frames = secy->protect_frames;
++ txsc->last_replay_protect = secy->replay_protect;
+ }
+
+ static int cn10k_mdo_open(struct macsec_context *ctx)
+@@ -1117,7 +1117,7 @@ static int cn10k_mdo_add_secy(struct macsec_context *ctx)
+ txsc->sw_secy = secy;
+ txsc->encoding_sa = secy->tx_sc.encoding_sa;
+ txsc->last_validate_frames = secy->validate_frames;
+- txsc->last_protect_frames = secy->protect_frames;
++ txsc->last_replay_protect = secy->replay_protect;
+
+ list_add(&txsc->entry, &cfg->txsc_list);
+
+@@ -1538,12 +1538,12 @@ static int cn10k_mdo_get_rx_sc_stats(struct macsec_context *ctx)
+ rxsc->stats.InPktsInvalid += rsp.pkt_invalid_cnt;
+ rxsc->stats.InPktsNotValid += rsp.pkt_notvalid_cnt;
+
+- if (secy->protect_frames)
++ if (secy->replay_protect)
+ rxsc->stats.InPktsLate += rsp.pkt_late_cnt;
+ else
+ rxsc->stats.InPktsDelayed += rsp.pkt_late_cnt;
+
+- if (secy->validate_frames == MACSEC_VALIDATE_CHECK)
++ if (secy->validate_frames == MACSEC_VALIDATE_DISABLED)
+ rxsc->stats.InPktsUnchecked += rsp.pkt_unchecked_cnt;
+ else
+ rxsc->stats.InPktsOK += rsp.pkt_unchecked_cnt;
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+index 3d22cc6a2804a..f42b2b65bfd7b 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+@@ -389,7 +389,7 @@ struct cn10k_mcs_txsc {
+ struct cn10k_txsc_stats stats;
+ struct list_head entry;
+ enum macsec_validation_type last_validate_frames;
+- bool last_protect_frames;
++ bool last_replay_protect;
+ u16 hw_secy_id_tx;
+ u16 hw_secy_id_rx;
+ u16 hw_flow_id;
+--
+2.39.2
+
--- /dev/null
+From 5934f2c362a3c15efca787f47dc67614de372e39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 11:55:25 +0530
+Subject: octeontx2-pf: mcs: Match macsec ethertype along with DMAC
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit 57d00d4364f314485092667d2a48718985515deb ]
+
+On CN10KB silicon a single hardware macsec block is
+present and offloads macsec operations for all the
+ethernet LMACs. TCAM match with macsec ethertype 0x88e5
+alone at RX side is not sufficient to distinguish all the
+macsec interfaces created on top of netdevs. Hence append
+the DMAC of the macsec interface too. Otherwise the first
+created macsec interface only receives all the macsec traffic.
+
+Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
+index 9ec5f38d38a84..f699209978fef 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
+@@ -9,6 +9,7 @@
+ #include <net/macsec.h>
+ #include "otx2_common.h"
+
++#define MCS_TCAM0_MAC_DA_MASK GENMASK_ULL(47, 0)
+ #define MCS_TCAM0_MAC_SA_MASK GENMASK_ULL(63, 48)
+ #define MCS_TCAM1_MAC_SA_MASK GENMASK_ULL(31, 0)
+ #define MCS_TCAM1_ETYPE_MASK GENMASK_ULL(47, 32)
+@@ -237,8 +238,10 @@ static int cn10k_mcs_write_rx_flowid(struct otx2_nic *pfvf,
+ struct cn10k_mcs_rxsc *rxsc, u8 hw_secy_id)
+ {
+ struct macsec_rx_sc *sw_rx_sc = rxsc->sw_rxsc;
++ struct macsec_secy *secy = rxsc->sw_secy;
+ struct mcs_flowid_entry_write_req *req;
+ struct mbox *mbox = &pfvf->mbox;
++ u64 mac_da;
+ int ret;
+
+ mutex_lock(&mbox->lock);
+@@ -249,11 +252,16 @@ static int cn10k_mcs_write_rx_flowid(struct otx2_nic *pfvf,
+ goto fail;
+ }
+
++ mac_da = ether_addr_to_u64(secy->netdev->dev_addr);
++
++ req->data[0] = FIELD_PREP(MCS_TCAM0_MAC_DA_MASK, mac_da);
++ req->mask[0] = ~0ULL;
++ req->mask[0] = ~MCS_TCAM0_MAC_DA_MASK;
++
+ req->data[1] = FIELD_PREP(MCS_TCAM1_ETYPE_MASK, ETH_P_MACSEC);
+ req->mask[1] = ~0ULL;
+ req->mask[1] &= ~MCS_TCAM1_ETYPE_MASK;
+
+- req->mask[0] = ~0ULL;
+ req->mask[2] = ~0ULL;
+ req->mask[3] = ~0ULL;
+
+--
+2.39.2
+
--- /dev/null
+From ea16a264e6c917efa3eb8fa3e6fd204bffa646cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 May 2023 12:39:44 +0530
+Subject: octeontx2-vf: Detach LF resources on probe cleanup
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit 99ae1260fdb5f15beab8a3adfb93a9041c87a2c1 ]
+
+When a VF device probe fails due to error in MSIX vector allocation then
+the resources NIX and NPA LFs were not detached. Fix this by detaching
+the LFs when MSIX vector allocation fails.
+
+Fixes: 3184fb5ba96e ("octeontx2-vf: Virtual function driver support")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
+Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
+index ab126f8706c74..53366dbfbf27c 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
+@@ -621,7 +621,7 @@ static int otx2vf_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ err = otx2vf_realloc_msix_vectors(vf);
+ if (err)
+- goto err_mbox_destroy;
++ goto err_detach_rsrc;
+
+ err = otx2_set_real_num_queues(netdev, qcount, qcount);
+ if (err)
+--
+2.39.2
+
--- /dev/null
+From b83831f3d052c0ebc42b7fd440ba2d81085345c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 11:55:20 +0530
+Subject: octeonxt2-af: mcs: Fix per port bypass config
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit c222b292a3568754828ffd30338d2909b14ed160 ]
+
+For each lmac port, MCS has two MCS_TOP_SLAVE_CHANNEL_CONFIGX
+registers. For CN10KB both register need to be configured for the
+port level mcs bypass to work. This patch also sets bitmap
+of flowid/secy entry reserved for default bypass so that these
+entries can be shown in debugfs.
+
+Fixes: bd69476e86fc ("octeontx2-af: cn10k: mcs: Install a default TCAM for normal traffic")
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/mcs.c | 11 ++++++++++-
+ .../net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 5 +++--
+ 2 files changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
+index f68a6a0e3aa41..492baa0b594ce 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
+@@ -494,6 +494,9 @@ int mcs_install_flowid_bypass_entry(struct mcs *mcs)
+
+ /* Flow entry */
+ flow_id = mcs->hw->tcam_entries - MCS_RSRC_RSVD_CNT;
++ __set_bit(flow_id, mcs->rx.flow_ids.bmap);
++ __set_bit(flow_id, mcs->tx.flow_ids.bmap);
++
+ for (reg_id = 0; reg_id < 4; reg_id++) {
+ reg = MCSX_CPM_RX_SLAVE_FLOWID_TCAM_MASKX(reg_id, flow_id);
+ mcs_reg_write(mcs, reg, GENMASK_ULL(63, 0));
+@@ -504,6 +507,8 @@ int mcs_install_flowid_bypass_entry(struct mcs *mcs)
+ }
+ /* secy */
+ secy_id = mcs->hw->secy_entries - MCS_RSRC_RSVD_CNT;
++ __set_bit(secy_id, mcs->rx.secy.bmap);
++ __set_bit(secy_id, mcs->tx.secy.bmap);
+
+ /* Set validate frames to NULL and enable control port */
+ plcy = 0x7ull;
+@@ -528,6 +533,7 @@ int mcs_install_flowid_bypass_entry(struct mcs *mcs)
+ /* Enable Flowid entry */
+ mcs_ena_dis_flowid_entry(mcs, flow_id, MCS_RX, true);
+ mcs_ena_dis_flowid_entry(mcs, flow_id, MCS_TX, true);
++
+ return 0;
+ }
+
+@@ -1325,8 +1331,11 @@ void mcs_reset_port(struct mcs *mcs, u8 port_id, u8 reset)
+ void mcs_set_lmac_mode(struct mcs *mcs, int lmac_id, u8 mode)
+ {
+ u64 reg;
++ int id = lmac_id * 2;
+
+- reg = MCSX_MCS_TOP_SLAVE_CHANNEL_CFG(lmac_id * 2);
++ reg = MCSX_MCS_TOP_SLAVE_CHANNEL_CFG(id);
++ mcs_reg_write(mcs, reg, (u64)mode);
++ reg = MCSX_MCS_TOP_SLAVE_CHANNEL_CFG((id + 1));
+ mcs_reg_write(mcs, reg, (u64)mode);
+ }
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+index 26cfa501f1a11..9533b1d929604 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+@@ -497,8 +497,9 @@ static int rvu_dbg_mcs_rx_secy_stats_display(struct seq_file *filp, void *unused
+ stats.octet_validated_cnt);
+ seq_printf(filp, "secy%d: Pkts on disable port: %lld\n", secy_id,
+ stats.pkt_port_disabled_cnt);
+- seq_printf(filp, "secy%d: Octets validated: %lld\n", secy_id, stats.pkt_badtag_cnt);
+- seq_printf(filp, "secy%d: Octets validated: %lld\n", secy_id, stats.pkt_nosa_cnt);
++ seq_printf(filp, "secy%d: Pkts with badtag: %lld\n", secy_id, stats.pkt_badtag_cnt);
++ seq_printf(filp, "secy%d: Pkts with no SA(sectag.tci.c=0): %lld\n", secy_id,
++ stats.pkt_nosa_cnt);
+ seq_printf(filp, "secy%d: Pkts with nosaerror: %lld\n", secy_id,
+ stats.pkt_nosaerror_cnt);
+ seq_printf(filp, "secy%d: Tagged ctrl pkts: %lld\n", secy_id,
+--
+2.39.2
+
--- /dev/null
+From e3cf193948dcb415df4968b95696f8f5d4017469 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 22:57:41 -0800
+Subject: perf build: Support python/perf.so testing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 7a9b223ca0761a7c7c72e569b86b84a907aa0f92 ]
+
+Add a build target to echo the python/perf.so's name from
+Makefile.perf. Use it in tests/make so the correct target is built and
+tested for.
+
+Fixes: caec54705adb73b0 ("perf build: Fix python/perf.so library's name")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andres Freund <andres@anarazel.de>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Leo Yan <leo.yan@linaro.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Martin Liška <mliska@suse.cz>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: Pavithra Gurushankar <gpavithrasha@gmail.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Quentin Monnet <quentin@isovalent.com>
+Cc: Roberto Sassu <roberto.sassu@huawei.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
+Cc: Tom Rix <trix@redhat.com>
+Cc: Yang Jihong <yangjihong1@huawei.com>
+Cc: llvm@lists.linux.dev
+Link: https://lore.kernel.org/r/20230311065753.3012826-2-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/Makefile.perf | 7 +++++--
+ tools/perf/tests/make | 5 +++--
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
+index bac9272682b75..2fcee585b225d 100644
+--- a/tools/perf/Makefile.perf
++++ b/tools/perf/Makefile.perf
+@@ -647,13 +647,16 @@ all: shell_compatibility_test $(ALL_PROGRAMS) $(LANG_BINDINGS) $(OTHER_PROGRAMS)
+ # Create python binding output directory if not already present
+ _dummy := $(shell [ -d '$(OUTPUT)python' ] || mkdir -p '$(OUTPUT)python')
+
+-$(OUTPUT)python/perf$(PYTHON_EXTENSION_SUFFIX): $(PYTHON_EXT_SRCS) $(PYTHON_EXT_DEPS) $(LIBPERF)
++$(OUTPUT)python/perf$(PYTHON_EXTENSION_SUFFIX): $(PYTHON_EXT_SRCS) $(PYTHON_EXT_DEPS) $(LIBPERF) $(LIBSUBCMD)
+ $(QUIET_GEN)LDSHARED="$(CC) -pthread -shared" \
+ CFLAGS='$(CFLAGS)' LDFLAGS='$(LDFLAGS)' \
+ $(PYTHON_WORD) util/setup.py \
+ --quiet build_ext; \
+ cp $(PYTHON_EXTBUILD_LIB)perf*.so $(OUTPUT)python/
+
++python_perf_target:
++ @echo "Target is: $(OUTPUT)python/perf$(PYTHON_EXTENSION_SUFFIX)"
++
+ please_set_SHELL_PATH_to_a_more_modern_shell:
+ $(Q)$$(:)
+
+@@ -1152,7 +1155,7 @@ FORCE:
+ .PHONY: all install clean config-clean strip install-gtk
+ .PHONY: shell_compatibility_test please_set_SHELL_PATH_to_a_more_modern_shell
+ .PHONY: .FORCE-PERF-VERSION-FILE TAGS tags cscope FORCE prepare
+-.PHONY: archheaders
++.PHONY: archheaders python_perf_target
+
+ endif # force_fixdep
+
+diff --git a/tools/perf/tests/make b/tools/perf/tests/make
+index 009d6efb673ce..deb37fb982e97 100644
+--- a/tools/perf/tests/make
++++ b/tools/perf/tests/make
+@@ -62,10 +62,11 @@ lib = lib
+ endif
+
+ has = $(shell which $1 2>/dev/null)
++python_perf_so := $(shell $(MAKE) python_perf_target|grep "Target is:"|awk '{print $$3}')
+
+ # standard single make variable specified
+ make_clean_all := clean all
+-make_python_perf_so := python/perf.so
++make_python_perf_so := $(python_perf_so)
+ make_debug := DEBUG=1
+ make_no_libperl := NO_LIBPERL=1
+ make_no_libpython := NO_LIBPYTHON=1
+@@ -204,7 +205,7 @@ test_make_doc := $(test_ok)
+ test_make_help_O := $(test_ok)
+ test_make_doc_O := $(test_ok)
+
+-test_make_python_perf_so := test -f $(PERF_O)/python/perf.so
++test_make_python_perf_so := test -f $(PERF_O)/$(python_perf_so)
+
+ test_make_perf_o := test -f $(PERF_O)/perf.o
+ test_make_util_map_o := test -f $(PERF_O)/util/map.o
+--
+2.39.2
+
--- /dev/null
+From eee3aeeaba43f7be590129766d1c3fc5c8842885 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 14:47:41 +0100
+Subject: perf cs-etm: Fix timeless decode mode detection
+
+From: James Clark <james.clark@arm.com>
+
+[ Upstream commit 449067f3fc9f340da54e383738286881e6634d0b ]
+
+In this context, timeless refers to the trace data rather than the perf
+event data. But when detecting whether there are timestamps in the trace
+data or not, the presence of a timestamp flag on any perf event is used.
+
+Since commit f42c0ce573df ("perf record: Always get text_poke events
+with --kcore option") timestamps were added to a tracking event when
+--kcore is used which breaks this detection mechanism. Fix it by
+detecting if trace timestamps exist by looking at the ETM config flags.
+This would have always been a more accurate way of doing it anyway.
+
+This fixes the following error message when using --kcore with
+Coresight:
+
+ $ perf record --kcore -e cs_etm// --per-thread
+ $ perf report
+ The perf.data/data data has no samples!
+
+Fixes: f42c0ce573df79d1 ("perf record: Always get text_poke events with --kcore option")
+Reported-by: Yang Shi <shy828301@gmail.com>
+Signed-off-by: James Clark <james.clark@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Leo Yan <leo.yan@linaro.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: coresight@lists.linaro.org
+Cc: denik@google.com
+Cc: linux-arm-kernel@lists.infradead.org
+Link: https://lore.kernel.org/lkml/CAHbLzkrJQTrYBtPkf=jf3OpQ-yBcJe7XkvQstX9j2frz4WF-SQ@mail.gmail.com/
+Link: https://lore.kernel.org/r/20230424134748.228137-2-james.clark@arm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/cs-etm.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
+index f65bac5ddbdb6..e43bc9eea3087 100644
+--- a/tools/perf/util/cs-etm.c
++++ b/tools/perf/util/cs-etm.c
+@@ -2517,26 +2517,29 @@ static int cs_etm__process_auxtrace_event(struct perf_session *session,
+ return 0;
+ }
+
+-static bool cs_etm__is_timeless_decoding(struct cs_etm_auxtrace *etm)
++static int cs_etm__setup_timeless_decoding(struct cs_etm_auxtrace *etm)
+ {
+ struct evsel *evsel;
+ struct evlist *evlist = etm->session->evlist;
+- bool timeless_decoding = true;
+
+ /* Override timeless mode with user input from --itrace=Z */
+- if (etm->synth_opts.timeless_decoding)
+- return true;
++ if (etm->synth_opts.timeless_decoding) {
++ etm->timeless_decoding = true;
++ return 0;
++ }
+
+ /*
+- * Circle through the list of event and complain if we find one
+- * with the time bit set.
++ * Find the cs_etm evsel and look at what its timestamp setting was
+ */
+- evlist__for_each_entry(evlist, evsel) {
+- if ((evsel->core.attr.sample_type & PERF_SAMPLE_TIME))
+- timeless_decoding = false;
+- }
++ evlist__for_each_entry(evlist, evsel)
++ if (cs_etm__evsel_is_auxtrace(etm->session, evsel)) {
++ etm->timeless_decoding =
++ !(evsel->core.attr.config & BIT(ETM_OPT_TS));
++ return 0;
++ }
+
+- return timeless_decoding;
++ pr_err("CS ETM: Couldn't find ETM evsel\n");
++ return -EINVAL;
+ }
+
+ /*
+@@ -2943,7 +2946,6 @@ int cs_etm__process_auxtrace_info_full(union perf_event *event,
+ etm->snapshot_mode = (ptr[CS_ETM_SNAPSHOT] != 0);
+ etm->metadata = metadata;
+ etm->auxtrace_type = auxtrace_info->type;
+- etm->timeless_decoding = cs_etm__is_timeless_decoding(etm);
+
+ /* Use virtual timestamps if all ETMs report ts_source = 1 */
+ etm->has_virtual_ts = cs_etm__has_virtual_ts(metadata, num_cpu);
+@@ -2960,6 +2962,10 @@ int cs_etm__process_auxtrace_info_full(union perf_event *event,
+ etm->auxtrace.evsel_is_auxtrace = cs_etm__evsel_is_auxtrace;
+ session->auxtrace = &etm->auxtrace;
+
++ err = cs_etm__setup_timeless_decoding(etm);
++ if (err)
++ return err;
++
+ etm->unknown_thread = thread__new(999999999, 999999999);
+ if (!etm->unknown_thread) {
+ err = -ENOMEM;
+--
+2.39.2
+
--- /dev/null
+From 0957535a5d90118e392c45a1d78e123ae48c73eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 03:27:02 +0000
+Subject: perf ftrace: Make system wide the default target for latency
+ subcommand
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit ecd4960d908e27e40b63a7046df2f942c148c6f6 ]
+
+If no target is specified for 'latency' subcommand, the execution fails
+because - 1 (invalid value) is written to set_ftrace_pid tracefs file.
+Make system wide the default target, which is the same as the default
+behavior of 'trace' subcommand.
+
+Before the fix:
+
+ # perf ftrace latency -T schedule
+ failed to set ftrace pid
+
+After the fix:
+
+ # perf ftrace latency -T schedule
+ ^C# DURATION | COUNT | GRAPH |
+ 0 - 1 us | 0 | |
+ 1 - 2 us | 0 | |
+ 2 - 4 us | 0 | |
+ 4 - 8 us | 2828 | #### |
+ 8 - 16 us | 23953 | ######################################## |
+ 16 - 32 us | 408 | |
+ 32 - 64 us | 318 | |
+ 64 - 128 us | 4 | |
+ 128 - 256 us | 3 | |
+ 256 - 512 us | 0 | |
+ 512 - 1024 us | 1 | |
+ 1 - 2 ms | 4 | |
+ 2 - 4 ms | 0 | |
+ 4 - 8 ms | 0 | |
+ 8 - 16 ms | 0 | |
+ 16 - 32 ms | 0 | |
+ 32 - 64 ms | 0 | |
+ 64 - 128 ms | 0 | |
+ 128 - 256 ms | 4 | |
+ 256 - 512 ms | 2 | |
+ 512 - 1024 ms | 0 | |
+ 1 - ... s | 0 | |
+
+Fixes: 53be50282269b46c ("perf ftrace: Add 'latency' subcommand")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20230324032702.109964-1-yangjihong1@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-ftrace.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
+index d7fe00f66b831..fb1b66ef2e167 100644
+--- a/tools/perf/builtin-ftrace.c
++++ b/tools/perf/builtin-ftrace.c
+@@ -1228,10 +1228,12 @@ int cmd_ftrace(int argc, const char **argv)
+ goto out_delete_filters;
+ }
+
++ /* Make system wide (-a) the default target. */
++ if (!argc && target__none(&ftrace.target))
++ ftrace.target.system_wide = true;
++
+ switch (subcmd) {
+ case PERF_FTRACE_TRACE:
+- if (!argc && target__none(&ftrace.target))
+- ftrace.target.system_wide = true;
+ cmd_func = __cmd_ftrace;
+ break;
+ case PERF_FTRACE_LATENCY:
+--
+2.39.2
+
--- /dev/null
+From e5f15cb3be9055ae317c76f4b23472ea8ee4fb40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 19:50:05 -0700
+Subject: perf hist: Improve srcfile sort key performance (really)
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 6094c7744bb0563e833e81d8df8513f9a4e7a257 ]
+
+The earlier commit f0cdde28fecc0d7f ("perf hist: Improve srcfile sort
+key performance") updated the srcfile logic but missed to change the
+->cmp() callback which is called for every sample.
+
+It should use the same logic like in the srcline to speed up the
+processing because it'd return the same information repeatedly for the
+same address. The real processing will be done in
+sort__srcfile_collapse().
+
+Fixes: f0cdde28fecc0d7f ("perf hist: Improve srcfile sort key performance")
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20230323025005.191239-1-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/sort.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
+index 093a0c8b2e3d3..4d6a51b1c1b2e 100644
+--- a/tools/perf/util/sort.c
++++ b/tools/perf/util/sort.c
+@@ -611,12 +611,7 @@ static char *hist_entry__get_srcfile(struct hist_entry *e)
+ static int64_t
+ sort__srcfile_cmp(struct hist_entry *left, struct hist_entry *right)
+ {
+- if (!left->srcfile)
+- left->srcfile = hist_entry__get_srcfile(left);
+- if (!right->srcfile)
+- right->srcfile = hist_entry__get_srcfile(right);
+-
+- return strcmp(right->srcfile, left->srcfile);
++ return sort__srcline_cmp(left, right);
+ }
+
+ static int64_t
+--
+2.39.2
+
--- /dev/null
+From 8071f32dd806328908a39a1b40f9afd0eabecb59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 16:30:20 -0800
+Subject: perf lock contention: Fix compiler builtin detection
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 17535a33a9c1e4fb52f3db1d72a7ddbe4cea1a2e ]
+
+__has_builtin was passed the macro rather than the actual builtin
+feature. The builtin test isn't sufficient and a clang version test
+also needs to be performed.
+
+Fixes: 1bece1351c653c3d ("perf lock contention: Support old rw_semaphore type")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Martin KaFai Lau <martin.lau@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: bpf@vger.kernel.org
+Link: https://lore.kernel.org/r/20230308003020.3653271-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf_skel/lock_contention.bpf.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/bpf_skel/lock_contention.bpf.c b/tools/perf/util/bpf_skel/lock_contention.bpf.c
+index e6007eaeda1a6..141b36d13b19a 100644
+--- a/tools/perf/util/bpf_skel/lock_contention.bpf.c
++++ b/tools/perf/util/bpf_skel/lock_contention.bpf.c
+@@ -182,7 +182,13 @@ static inline struct task_struct *get_lock_owner(__u64 lock, __u32 flags)
+ struct mutex *mutex = (void *)lock;
+ owner = BPF_CORE_READ(mutex, owner.counter);
+ } else if (flags == LCB_F_READ || flags == LCB_F_WRITE) {
+-#if __has_builtin(bpf_core_type_matches)
++ /*
++ * Support for the BPF_TYPE_MATCHES argument to the
++ * __builtin_preserve_type_info builtin was added at some point during
++ * development of clang 15 and it's what is needed for
++ * bpf_core_type_matches.
++ */
++#if __has_builtin(__builtin_preserve_type_info) && __clang_major__ >= 15
+ if (bpf_core_type_matches(struct rw_semaphore___old)) {
+ struct rw_semaphore___old *rwsem = (void *)lock;
+ owner = (unsigned long)BPF_CORE_READ(rwsem, owner);
+--
+2.39.2
+
--- /dev/null
+From 5185cf688e7b8c7d699327823738e93f7e2abfbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 14:46:39 +0200
+Subject: perf map: Delete two variable initialisations before null pointer
+ checks in sort__sym_from_cmp()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Elfring <Markus.Elfring@web.de>
+
+[ Upstream commit c160118a90d4acf335993d8d59b02ae2147a524e ]
+
+Addresses of two data structure members were determined before
+corresponding null pointer checks in the implementation of the function
+“sort__sym_from_cmp”.
+
+Thus avoid the risk for undefined behaviour by removing extra
+initialisations for the local variables “from_l” and “from_r” (also
+because they were already reassigned with the same value behind this
+pointer check).
+
+This issue was detected by using the Coccinelle software.
+
+Fixes: 1b9e97a2a95e4941 ("perf tools: Fix report -F symbol_from for data without branch info")
+Signed-off-by: <elfring@users.sourceforge.net>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/cocci/54a21fea-64e3-de67-82ef-d61b90ffad05@web.de/
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/sort.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
+index 4d6a51b1c1b2e..2770105823bf0 100644
+--- a/tools/perf/util/sort.c
++++ b/tools/perf/util/sort.c
+@@ -974,8 +974,7 @@ static int hist_entry__dso_to_filter(struct hist_entry *he, int type,
+ static int64_t
+ sort__sym_from_cmp(struct hist_entry *left, struct hist_entry *right)
+ {
+- struct addr_map_symbol *from_l = &left->branch_info->from;
+- struct addr_map_symbol *from_r = &right->branch_info->from;
++ struct addr_map_symbol *from_l, *from_r;
+
+ if (!left->branch_info || !right->branch_info)
+ return cmp_null(left->branch_info, right->branch_info);
+--
+2.39.2
+
--- /dev/null
+From 7301c912b5dec3010cff73912b9ad23a2eff399b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 10:23:35 -0300
+Subject: perf pmu: zfree() expects a pointer to a pointer to zero it after
+ freeing its contents
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 57f14b5ae1a97537f2abd2828ee7212cada7036e ]
+
+An audit showed just this one problem with zfree(), fix it.
+
+Fixes: 9fbc61f832ebf432 ("perf pmu: Add support for PMU capabilities")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/pmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index c256b29defad3..d64d7b43f806d 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -1745,7 +1745,7 @@ static int perf_pmu__new_caps(struct list_head *list, char *name, char *value)
+ return 0;
+
+ free_name:
+- zfree(caps->name);
++ zfree(&caps->name);
+ free_caps:
+ free(caps);
+
+--
+2.39.2
+
--- /dev/null
+From a8190131b0421b1b6d76a17f4f4fc83e2637a8b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Mar 2023 07:04:13 -0800
+Subject: perf record: Fix "read LOST count failed" msg with sample read
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+[ Upstream commit 07d85ba9d04e1ebd282f656a29ddf08c5b7b32a2 ]
+
+Hundreds of "read LOST count failed" error messages may be displayed,
+when the below command is launched.
+
+perf record -e '{cpu/mem-loads-aux/,cpu/event=0xcd,umask=0x1/}:S' -a
+
+According to the commit 89e3106fa25fb1b6 ("libperf: Handle read format
+in perf_evsel__read()"), the PERF_FORMAT_GROUP is only available for
+the leader. However, the record__read_lost_samples() goes through every
+entry of an evlist, which includes both leader and member. The member
+event errors out and triggers the error message. Since there may be
+hundreds of CPUs on a server, the message will be printed hundreds of
+times, which is very annoying.
+
+The message itself is correct, but the pr_err is a overkill. Other error
+messages in the record__read_lost_samples() are all pr_debug. To make
+the output format consistent, change the pr_err("read LOST count
+failed\n"); to pr_debug("read LOST count failed\n");.
+User can still get the message via -v option.
+
+Fixes: e3a23261ad06d598 ("perf record: Read and inject LOST_SAMPLES events")
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20230301150413.27011-1-kan.liang@linux.intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-record.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
+index 8374117e66f6e..be7c0c29d15b0 100644
+--- a/tools/perf/builtin-record.c
++++ b/tools/perf/builtin-record.c
+@@ -1866,7 +1866,7 @@ static void __record__read_lost_samples(struct record *rec, struct evsel *evsel,
+ int id_hdr_size;
+
+ if (perf_evsel__read(&evsel->core, cpu_idx, thread_idx, &count) < 0) {
+- pr_err("read LOST count failed\n");
++ pr_debug("read LOST count failed\n");
+ return;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 9d5717d476dc87d65ebf2e24e2d9168a1f03cdc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 10:43:21 +0200
+Subject: perf script: Fix Python support when no libtraceevent
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 80c3a7d9f20401169283b5670dbb8d7ac07a1d55 ]
+
+Python scripting can be used without libtraceevent. In particular,
+scripting for Intel PT does not use tracepoints, and so does not need
+libtraceevent support.
+
+Alter the build and employ conditional compilation to allow Python
+scripting without libtraceevent.
+
+Example:
+
+ Before:
+
+ $ ldd `which perf` | grep -i python
+ $ ldd `which perf` | grep -i libtraceevent
+ $ perf record -e intel_pt//u uname
+ Linux
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.031 MB perf.data ]
+ $ perf script intel-pt-events.py |& head -3
+ Error: Couldn't find script `intel-pt-events.py'
+
+ See perf script -l for available scripts.
+
+ After:
+
+ $ ldd `which perf` | grep -i python
+ libpython3.10.so.1.0 => /lib/x86_64-linux-gnu/libpython3.10.so.1.0 (0x00007f4bac400000)
+ $ ldd `which perf` | grep -i libtraceevent
+ $ perf script intel-pt-events.py | head
+ Intel PT Branch Trace, Power Events, Event Trace and PTWRITE
+ Switch In 8021/8021 [000] 11234.097713404 0/0
+ perf-exec 8021/8021 [000] 11234.098041726 psb offset: 0x0 0 [unknown] ([unknown])
+ perf-exec 8021/8021 [000] 11234.098041726 cbr 45 freq: 4505 MHz (161%) 0 [unknown] ([unknown])
+ uname 8021/8021 [000] 11234.098082170 branches:uH tr strt 0 [unknown] ([unknown]) => 7f3a8b9422b0 _start+0x0 (/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2)
+ uname 8021/8021 [000] 11234.098082379 branches:uH tr end 7f3a8b9422b0 _start+0x0 (/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2) => 0 [unknown] ([unknown])
+ uname 8021/8021 [000] 11234.098083629 branches:uH tr strt 0 [unknown] ([unknown]) => 7f3a8b9422b0 _start+0x0 (/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2)
+ uname 8021/8021 [000] 11234.098083629 branches:uH call 7f3a8b9422b3 _start+0x3 (/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2) => 7f3a8b943050 _dl_start+0x0 (/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2)
+ uname 8021/8021 [000] 11234.098083837 branches:uH tr end 7f3a8b943060 _dl_start+0x10 (/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2) => 0 [unknown] ([unknown]) IPC: 0.01 (9/938)
+ uname 8021/8021 [000] 11234.098084670 branches:uH tr strt 0 [unknown] ([unknown]) => 7f3a8b943060 _dl_start+0x10 (/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2)
+
+Fixes: 378ef0f5d9d7f465 ("perf build: Use libtraceevent from the system")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20230315084321.14563-1-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/Build | 2 +-
+ tools/perf/builtin-script.c | 2 +-
+ tools/perf/scripts/Build | 4 +-
+ .../perf/scripts/python/Perf-Trace-Util/Build | 2 +-
+ .../scripts/python/Perf-Trace-Util/Context.c | 4 +
+ tools/perf/util/Build | 2 +-
+ tools/perf/util/scripting-engines/Build | 2 +-
+ .../scripting-engines/trace-event-python.c | 75 +++++++++++++------
+ tools/perf/util/trace-event-scripting.c | 9 ++-
+ 9 files changed, 72 insertions(+), 30 deletions(-)
+
+diff --git a/tools/perf/Build b/tools/perf/Build
+index 6dd67e5022955..aa76236228349 100644
+--- a/tools/perf/Build
++++ b/tools/perf/Build
+@@ -56,6 +56,6 @@ CFLAGS_builtin-report.o += -DDOCDIR="BUILD_STR($(srcdir_SQ)/Documentation)"
+ perf-y += util/
+ perf-y += arch/
+ perf-y += ui/
+-perf-$(CONFIG_LIBTRACEEVENT) += scripts/
++perf-y += scripts/
+
+ gtk-y += ui/gtk/
+diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
+index a792214d1af85..6f085602b7bd3 100644
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -2318,8 +2318,8 @@ static void setup_scripting(void)
+ {
+ #ifdef HAVE_LIBTRACEEVENT
+ setup_perl_scripting();
+- setup_python_scripting();
+ #endif
++ setup_python_scripting();
+ }
+
+ static int flush_scripting(void)
+diff --git a/tools/perf/scripts/Build b/tools/perf/scripts/Build
+index 68d4b54574adb..7d8e2e57faac5 100644
+--- a/tools/perf/scripts/Build
++++ b/tools/perf/scripts/Build
+@@ -1,2 +1,4 @@
+-perf-$(CONFIG_LIBPERL) += perl/Perf-Trace-Util/
++ifeq ($(CONFIG_LIBTRACEEVENT),y)
++ perf-$(CONFIG_LIBPERL) += perl/Perf-Trace-Util/
++endif
+ perf-$(CONFIG_LIBPYTHON) += python/Perf-Trace-Util/
+diff --git a/tools/perf/scripts/python/Perf-Trace-Util/Build b/tools/perf/scripts/python/Perf-Trace-Util/Build
+index d5fed4e426179..7d0e33ce6aba4 100644
+--- a/tools/perf/scripts/python/Perf-Trace-Util/Build
++++ b/tools/perf/scripts/python/Perf-Trace-Util/Build
+@@ -1,3 +1,3 @@
+-perf-$(CONFIG_LIBTRACEEVENT) += Context.o
++perf-y += Context.o
+
+ CFLAGS_Context.o += $(PYTHON_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-nested-externs
+diff --git a/tools/perf/scripts/python/Perf-Trace-Util/Context.c b/tools/perf/scripts/python/Perf-Trace-Util/Context.c
+index 895f5fc239653..b0d449f41650f 100644
+--- a/tools/perf/scripts/python/Perf-Trace-Util/Context.c
++++ b/tools/perf/scripts/python/Perf-Trace-Util/Context.c
+@@ -59,6 +59,7 @@ static struct scripting_context *get_scripting_context(PyObject *args)
+ return get_args(args, "context", NULL);
+ }
+
++#ifdef HAVE_LIBTRACEEVENT
+ static PyObject *perf_trace_context_common_pc(PyObject *obj, PyObject *args)
+ {
+ struct scripting_context *c = get_scripting_context(args);
+@@ -90,6 +91,7 @@ static PyObject *perf_trace_context_common_lock_depth(PyObject *obj,
+
+ return Py_BuildValue("i", common_lock_depth(c));
+ }
++#endif
+
+ static PyObject *perf_sample_insn(PyObject *obj, PyObject *args)
+ {
+@@ -178,12 +180,14 @@ static PyObject *perf_sample_srccode(PyObject *obj, PyObject *args)
+ }
+
+ static PyMethodDef ContextMethods[] = {
++#ifdef HAVE_LIBTRACEEVENT
+ { "common_pc", perf_trace_context_common_pc, METH_VARARGS,
+ "Get the common preempt count event field value."},
+ { "common_flags", perf_trace_context_common_flags, METH_VARARGS,
+ "Get the common flags event field value."},
+ { "common_lock_depth", perf_trace_context_common_lock_depth,
+ METH_VARARGS, "Get the common lock depth event field value."},
++#endif
+ { "perf_sample_insn", perf_sample_insn,
+ METH_VARARGS, "Get the machine code instruction."},
+ { "perf_set_itrace_options", perf_set_itrace_options,
+diff --git a/tools/perf/util/Build b/tools/perf/util/Build
+index 918b501f9bd8b..4868e3bf7df96 100644
+--- a/tools/perf/util/Build
++++ b/tools/perf/util/Build
+@@ -78,7 +78,7 @@ perf-y += pmu-bison.o
+ perf-y += pmu-hybrid.o
+ perf-y += svghelper.o
+ perf-$(CONFIG_LIBTRACEEVENT) += trace-event-info.o
+-perf-$(CONFIG_LIBTRACEEVENT) += trace-event-scripting.o
++perf-y += trace-event-scripting.o
+ perf-$(CONFIG_LIBTRACEEVENT) += trace-event.o
+ perf-$(CONFIG_LIBTRACEEVENT) += trace-event-parse.o
+ perf-$(CONFIG_LIBTRACEEVENT) += trace-event-read.o
+diff --git a/tools/perf/util/scripting-engines/Build b/tools/perf/util/scripting-engines/Build
+index 2c96aa3cc1ec8..c220fec970324 100644
+--- a/tools/perf/util/scripting-engines/Build
++++ b/tools/perf/util/scripting-engines/Build
+@@ -1,7 +1,7 @@
+ ifeq ($(CONFIG_LIBTRACEEVENT),y)
+ perf-$(CONFIG_LIBPERL) += trace-event-perl.o
+- perf-$(CONFIG_LIBPYTHON) += trace-event-python.o
+ endif
++perf-$(CONFIG_LIBPYTHON) += trace-event-python.o
+
+ CFLAGS_trace-event-perl.o += $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow -Wno-nested-externs -Wno-undef -Wno-switch-default -Wno-bad-function-cast -Wno-declaration-after-statement -Wno-switch-enum
+
+diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
+index 2c2697c5d0254..0f4ef61f2ffae 100644
+--- a/tools/perf/util/scripting-engines/trace-event-python.c
++++ b/tools/perf/util/scripting-engines/trace-event-python.c
+@@ -30,7 +30,9 @@
+ #include <linux/bitmap.h>
+ #include <linux/compiler.h>
+ #include <linux/time64.h>
++#ifdef HAVE_LIBTRACEEVENT
+ #include <traceevent/event-parse.h>
++#endif
+
+ #include "../build-id.h"
+ #include "../counts.h"
+@@ -87,18 +89,21 @@ PyMODINIT_FUNC initperf_trace_context(void);
+ PyMODINIT_FUNC PyInit_perf_trace_context(void);
+ #endif
+
++#ifdef HAVE_LIBTRACEEVENT
+ #define TRACE_EVENT_TYPE_MAX \
+ ((1 << (sizeof(unsigned short) * 8)) - 1)
+
+ static DECLARE_BITMAP(events_defined, TRACE_EVENT_TYPE_MAX);
+
+-#define MAX_FIELDS 64
+ #define N_COMMON_FIELDS 7
+
+-extern struct scripting_context *scripting_context;
+-
+ static char *cur_field_name;
+ static int zero_flag_atom;
++#endif
++
++#define MAX_FIELDS 64
++
++extern struct scripting_context *scripting_context;
+
+ static PyObject *main_module, *main_dict;
+
+@@ -153,6 +158,26 @@ static PyObject *get_handler(const char *handler_name)
+ return handler;
+ }
+
++static void call_object(PyObject *handler, PyObject *args, const char *die_msg)
++{
++ PyObject *retval;
++
++ retval = PyObject_CallObject(handler, args);
++ if (retval == NULL)
++ handler_call_die(die_msg);
++ Py_DECREF(retval);
++}
++
++static void try_call_object(const char *handler_name, PyObject *args)
++{
++ PyObject *handler;
++
++ handler = get_handler(handler_name);
++ if (handler)
++ call_object(handler, args, handler_name);
++}
++
++#ifdef HAVE_LIBTRACEEVENT
+ static int get_argument_count(PyObject *handler)
+ {
+ int arg_count = 0;
+@@ -181,25 +206,6 @@ static int get_argument_count(PyObject *handler)
+ return arg_count;
+ }
+
+-static void call_object(PyObject *handler, PyObject *args, const char *die_msg)
+-{
+- PyObject *retval;
+-
+- retval = PyObject_CallObject(handler, args);
+- if (retval == NULL)
+- handler_call_die(die_msg);
+- Py_DECREF(retval);
+-}
+-
+-static void try_call_object(const char *handler_name, PyObject *args)
+-{
+- PyObject *handler;
+-
+- handler = get_handler(handler_name);
+- if (handler)
+- call_object(handler, args, handler_name);
+-}
+-
+ static void define_value(enum tep_print_arg_type field_type,
+ const char *ev_name,
+ const char *field_name,
+@@ -379,6 +385,7 @@ static PyObject *get_field_numeric_entry(struct tep_event *event,
+ obj = list;
+ return obj;
+ }
++#endif
+
+ static const char *get_dsoname(struct map *map)
+ {
+@@ -906,6 +913,7 @@ static PyObject *get_perf_sample_dict(struct perf_sample *sample,
+ return dict;
+ }
+
++#ifdef HAVE_LIBTRACEEVENT
+ static void python_process_tracepoint(struct perf_sample *sample,
+ struct evsel *evsel,
+ struct addr_location *al,
+@@ -1035,6 +1043,16 @@ static void python_process_tracepoint(struct perf_sample *sample,
+
+ Py_DECREF(t);
+ }
++#else
++static void python_process_tracepoint(struct perf_sample *sample __maybe_unused,
++ struct evsel *evsel __maybe_unused,
++ struct addr_location *al __maybe_unused,
++ struct addr_location *addr_al __maybe_unused)
++{
++ fprintf(stderr, "Tracepoint events are not supported because "
++ "perf is not linked with libtraceevent.\n");
++}
++#endif
+
+ static PyObject *tuple_new(unsigned int sz)
+ {
+@@ -1965,6 +1983,7 @@ static int python_stop_script(void)
+ return 0;
+ }
+
++#ifdef HAVE_LIBTRACEEVENT
+ static int python_generate_script(struct tep_handle *pevent, const char *outfile)
+ {
+ int i, not_first, count, nr_events;
+@@ -2155,6 +2174,18 @@ static int python_generate_script(struct tep_handle *pevent, const char *outfile
+
+ return 0;
+ }
++#else
++static int python_generate_script(struct tep_handle *pevent __maybe_unused,
++ const char *outfile __maybe_unused)
++{
++ fprintf(stderr, "Generating Python perf-script is not supported."
++ " Install libtraceevent and rebuild perf to enable it.\n"
++ "For example:\n # apt install libtraceevent-dev (ubuntu)"
++ "\n # yum install libtraceevent-devel (Fedora)"
++ "\n etc.\n");
++ return -1;
++}
++#endif
+
+ struct scripting_ops python_scripting_ops = {
+ .name = "Python",
+diff --git a/tools/perf/util/trace-event-scripting.c b/tools/perf/util/trace-event-scripting.c
+index 56175c53f9af7..bd0000300c774 100644
+--- a/tools/perf/util/trace-event-scripting.c
++++ b/tools/perf/util/trace-event-scripting.c
+@@ -9,7 +9,9 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <errno.h>
++#ifdef HAVE_LIBTRACEEVENT
+ #include <traceevent/event-parse.h>
++#endif
+
+ #include "debug.h"
+ #include "trace-event.h"
+@@ -27,10 +29,11 @@ void scripting_context__update(struct scripting_context *c,
+ struct addr_location *addr_al)
+ {
+ c->event_data = sample->raw_data;
++ c->pevent = NULL;
++#ifdef HAVE_LIBTRACEEVENT
+ if (evsel->tp_format)
+ c->pevent = evsel->tp_format->tep;
+- else
+- c->pevent = NULL;
++#endif
+ c->event = event;
+ c->sample = sample;
+ c->evsel = evsel;
+@@ -122,6 +125,7 @@ void setup_python_scripting(void)
+ }
+ #endif
+
++#ifdef HAVE_LIBTRACEEVENT
+ static void print_perl_unsupported_msg(void)
+ {
+ fprintf(stderr, "Perl scripting not supported."
+@@ -186,3 +190,4 @@ void setup_perl_scripting(void)
+ register_perl_scripting(&perl_scripting_ops);
+ }
+ #endif
++#endif
+--
+2.39.2
+
--- /dev/null
+From d8840ba2393258c9cc5ce45660c082000a191d45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:04:45 +0000
+Subject: perf scripts intel-pt-events.py: Fix IPC output for Python 2
+
+From: Roman Lozko <lozko.roma@gmail.com>
+
+[ Upstream commit 1f64cfdebfe0494264271e8d7a3a47faf5f58ec7 ]
+
+Integers are not converted to floats during division in Python 2 which
+results in incorrect IPC values. Fix by switching to new division
+behavior.
+
+Fixes: a483e64c0b62e93a ("perf scripting python: intel-pt-events.py: Add --insn-trace and --src-trace")
+Signed-off-by: Roman Lozko <lozko.roma@gmail.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20230310150445.2925841-1-lozko.roma@gmail.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/scripts/python/intel-pt-events.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/scripts/python/intel-pt-events.py b/tools/perf/scripts/python/intel-pt-events.py
+index 08862a2582f44..1c76368f13c1a 100644
+--- a/tools/perf/scripts/python/intel-pt-events.py
++++ b/tools/perf/scripts/python/intel-pt-events.py
+@@ -11,7 +11,7 @@
+ # FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ # more details.
+
+-from __future__ import print_function
++from __future__ import division, print_function
+
+ import io
+ import os
+--
+2.39.2
+
--- /dev/null
+From bcd513807757f1bfdb28cf3822b9cdfb3e70fa88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 20:23:16 +0200
+Subject: perf stat: Separate bperf from bpf_profiler
+
+From: Dmitrii Dolgov <9erthalion6@gmail.com>
+
+[ Upstream commit ecc68ee216c6c5b2f84915e1441adf436f1b019b ]
+
+It seems that perf stat -b <prog id> doesn't produce any results:
+
+ $ perf stat -e cycles -b 4 -I 10000 -vvv
+ Control descriptor is not initialized
+ cycles: 0 0 0
+ time counts unit events
+ 10.007641640 <not supported> cycles
+
+Looks like this happens because fentry/fexit progs are getting loaded, but the
+corresponding perf event is not enabled and not added into the events bpf map.
+I think there is some mixing up between two type of bpf support, one for bperf
+and one for bpf_profiler. Both are identified via evsel__is_bpf, based on which
+perf events are enabled, but for the latter (bpf_profiler) a perf event is
+required. Using evsel__is_bperf to check only bperf produces expected results:
+
+ $ perf stat -e cycles -b 4 -I 10000 -vvv
+ Control descriptor is not initialized
+ ------------------------------------------------------------
+ perf_event_attr:
+ size 136
+ sample_type IDENTIFIER
+ read_format TOTAL_TIME_ENABLED|TOTAL_TIME_RUNNING
+ disabled 1
+ exclude_guest 1
+ ------------------------------------------------------------
+ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 3
+ ------------------------------------------------------------
+ [...perf_event_attr for other CPUs...]
+ ------------------------------------------------------------
+ cycles: 309426 169009 169009
+ time counts unit events
+ 10.010091271 309426 cycles
+
+The final numbers correspond (at least in the level of magnitude) to the
+same metric obtained via bpftool.
+
+Fixes: 112cb56164bc2108 ("perf stat: Introduce config stat.bpf-counter-events")
+Reviewed-by: Song Liu <song@kernel.org>
+Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com>
+Tested-by: Song Liu <song@kernel.org>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230412182316.11628-1-9erthalion6@gmail.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-stat.c | 4 ++--
+ tools/perf/util/evsel.h | 5 +++++
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index fa7c40956d0fa..eeba93ae3b584 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -773,7 +773,7 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
+ counter->reset_group = false;
+ if (bpf_counter__load(counter, &target))
+ return -1;
+- if (!evsel__is_bpf(counter))
++ if (!(evsel__is_bperf(counter)))
+ all_counters_use_bpf = false;
+ }
+
+@@ -789,7 +789,7 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
+
+ if (counter->reset_group || counter->errored)
+ continue;
+- if (evsel__is_bpf(counter))
++ if (evsel__is_bperf(counter))
+ continue;
+ try_again:
+ if (create_perf_stat_counter(counter, &stat_config, &target,
+diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
+index 24cb807ef6ce0..1a7358b46ad4e 100644
+--- a/tools/perf/util/evsel.h
++++ b/tools/perf/util/evsel.h
+@@ -267,6 +267,11 @@ static inline bool evsel__is_bpf(struct evsel *evsel)
+ return evsel->bpf_counter_ops != NULL;
+ }
+
++static inline bool evsel__is_bperf(struct evsel *evsel)
++{
++ return evsel->bpf_counter_ops != NULL && list_empty(&evsel->bpf_counter_list);
++}
++
+ #define EVSEL__MAX_ALIASES 8
+
+ extern const char *const evsel__hw_cache[PERF_COUNT_HW_CACHE_MAX][EVSEL__MAX_ALIASES];
+--
+2.39.2
+
--- /dev/null
+From 3bc958470efc5ebac141e9389828f6fad972c305 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 01:28:41 +0000
+Subject: perf symbols: Fix return incorrect build_id size in
+ elf_read_build_id()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 1511e4696acb715a4fe48be89e1e691daec91c0e ]
+
+In elf_read_build_id(), if gnu build_id is found, should return the size of
+the actually copied data. If descsz is greater thanBuild_ID_SIZE,
+write_buildid data access may occur.
+
+Fixes: be96ea8ffa788dcc ("perf symbols: Fix issue with binaries using 16-bytes buildids (v2)")
+Reported-by: Will Ochowicz <Will.Ochowicz@genusplc.com>
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Tested-by: Will Ochowicz <Will.Ochowicz@genusplc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Leo Yan <leo.yan@linaro.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: https://lore.kernel.org/lkml/CWLP265MB49702F7BA3D6D8F13E4B1A719C649@CWLP265MB4970.GBRP265.PROD.OUTLOOK.COM/T/
+Link: https://lore.kernel.org/r/20230427012841.231729-1-yangjihong1@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/symbol-elf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 42b83bef67aaf..cfb4109a37098 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -909,7 +909,7 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
+ size_t sz = min(size, descsz);
+ memcpy(bf, ptr, sz);
+ memset(bf + sz, 0, size - sz);
+- err = descsz;
++ err = sz;
+ break;
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From d842c5f1b6af4584ec2cdb813c7628d16e67703a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 21:41:55 +0200
+Subject: perf symbols: Fix unaligned access in get_x86_64_plt_disp()
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit a2410b579c72242ac0f77b3768093d8c1b48012e ]
+
+Use memcpy() to avoid unaligned access.
+
+Discovered using EXTRA_CFLAGS="-fsanitize=undefined -fsanitize=address".
+
+Fixes: ce4c8e7966f317ef ("perf symbols: Get symbols for .plt.got for x86-64")
+Reported-by: kernel test robot <yujie.liu@intel.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/oe-lkp/202303061424.6ad43294-yujie.liu@intel.com
+Link: https://lore.kernel.org/r/20230316194156.8320-2-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/symbol-elf.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 98a18fb854180..42b83bef67aaf 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -565,9 +565,12 @@ static u32 get_x86_64_plt_disp(const u8 *p)
+ n += 1;
+ /* jmp with 4-byte displacement */
+ if (p[n] == 0xff && p[n + 1] == 0x25) {
++ u32 disp;
++
+ n += 2;
+ /* Also add offset from start of entry to end of instruction */
+- return n + 4 + le32toh(*(const u32 *)(p + n));
++ memcpy(&disp, p + n, sizeof(disp));
++ return n + 4 + le32toh(disp);
+ }
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From ac0b63cd210b67bdad736c0bf4f7320b7ae6b4f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 21:41:54 +0200
+Subject: perf symbols: Fix use-after-free in get_plt_got_name()
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit c8bb2d76a40ac0ccf6303d369e536fddcde847fb ]
+
+Fix use-after-free in get_plt_got_name().
+
+Discovered using EXTRA_CFLAGS="-fsanitize=undefined -fsanitize=address".
+
+Fixes: ce4c8e7966f317ef ("perf symbols: Get symbols for .plt.got for x86-64")
+Reported-by: kernel test robot <yujie.liu@intel.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/oe-lkp/202303061424.6ad43294-yujie.liu@intel.com
+Link: https://lore.kernel.org/r/20230316194156.8320-2-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/symbol-elf.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 41882ae8452e5..98a18fb854180 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -580,6 +580,7 @@ static bool get_plt_got_name(GElf_Shdr *shdr, size_t i,
+ const char *sym_name;
+ char *demangled;
+ GElf_Sym sym;
++ bool result;
+ u32 disp;
+
+ if (!di->sorted)
+@@ -606,9 +607,11 @@ static bool get_plt_got_name(GElf_Shdr *shdr, size_t i,
+
+ snprintf(buf, buf_sz, "%s@plt", sym_name);
+
++ result = *sym_name;
++
+ free(demangled);
+
+- return *sym_name;
++ return result;
+ }
+
+ static int dso__synthesize_plt_got_symbols(struct dso *dso, Elf *elf,
+--
+2.39.2
+
--- /dev/null
+From 00b9347f95bce496b159f5a97a1722a274398828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 16:27:14 -0800
+Subject: perf test: Fix "PMU event table sanity" for NO_JEVENTS=1
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 07fc5921a014e227bd3b622d31a8a35ff3f19afb ]
+
+A table was renamed and needed to be renamed in the empty case.
+
+Fixes: 62774db2a05dc878 ("perf jevents: Generate metrics and events as separate tables")
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kajol Jain <kjain@linux.ibm.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20230308002714.1755698-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/empty-pmu-events.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/pmu-events/empty-pmu-events.c b/tools/perf/pmu-events/empty-pmu-events.c
+index a938b74cf487c..e74defb5284ff 100644
+--- a/tools/perf/pmu-events/empty-pmu-events.c
++++ b/tools/perf/pmu-events/empty-pmu-events.c
+@@ -227,7 +227,7 @@ static const struct pmu_events_map pmu_events_map[] = {
+ },
+ };
+
+-static const struct pmu_event pme_test_soc_sys[] = {
++static const struct pmu_event pmu_events__test_soc_sys[] = {
+ {
+ .name = "sys_ddr_pmu.write_cycles",
+ .event = "event=0x2b",
+@@ -258,8 +258,8 @@ struct pmu_sys_events {
+
+ static const struct pmu_sys_events pmu_sys_event_tables[] = {
+ {
+- .table = { pme_test_soc_sys },
+- .name = "pme_test_soc_sys",
++ .table = { pmu_events__test_soc_sys },
++ .name = "pmu_events__test_soc_sys",
+ },
+ {
+ .table = { 0 }
+--
+2.39.2
+
--- /dev/null
+From 7c72a2ea07acb9f956757fa96e093aa12ab89eb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Mar 2023 10:47:31 +0100
+Subject: perf test: Fix wrong size expectation for 'Setup struct
+ perf_event_attr'
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit 30df88a80f32ccca5c5cdcf2710d1fb2de5e314d ]
+
+The test case "perf test 'Setup struct perf_event_attr'" is failing.
+
+On s390 this output is observed:
+
+ # ./perf test -Fvvvv 17
+ 17: Setup struct perf_event_attr :
+ --- start ---
+ running './tests/attr/test-stat-C0'
+ Using CPUID IBM,8561,703,T01,3.6,002f
+ .....
+ Event event:base-stat
+ fd = 1
+ group_fd = -1
+ flags = 0|8
+ cpu = *
+ type = 0
+ size = 128 <<<--- wrong, specified in file base-stat
+ config = 0
+ sample_period = 0
+ sample_type = 65536
+ ...
+ 'PERF_TEST_ATTR=/tmp/tmpgw574wvg ./perf stat -o \
+ /tmp/tmpgw574wvg/perf.data -e cycles -C 0 kill >/dev/null \
+ 2>&1 ret '1', expected '1'
+ loading result events
+ Event event-0-0-4
+ fd = 4
+ group_fd = -1
+ cpu = 0
+ pid = -1
+ flags = 8
+ type = 0
+ size = 136 <<<--- actual size used in system call
+ .....
+ compare
+ matching [event-0-0-4]
+ to [event:base-stat]
+ [cpu] 0 *
+ [flags] 8 0|8
+ [type] 0 0
+ [size] 136 128
+ ->FAIL
+ match: [event-0-0-4] matches []
+ expected size=136, got 128
+ FAILED './tests/attr/test-stat-C0' - match failure
+
+This mismatch is caused by
+commit 09519ec3b19e ("perf: Add perf_event_attr::config3")
+which enlarges the structure perf_event_attr by 8 bytes.
+
+Fix this by adjusting the expected value of size.
+
+Output after:
+ # ./perf test -Fvvvv 17
+ 17: Setup struct perf_event_attr :
+ --- start ---
+ running './tests/attr/test-stat-C0'
+ Using CPUID IBM,8561,703,T01,3.6,002f
+ ...
+ matched
+ compare
+ matching [event-0-0-4]
+ to [event:base-stat]
+ [cpu] 0 *
+ [flags] 8 0|8
+ [type] 0 0
+ [size] 136 136
+ ....
+ ->OK
+ match: [event-0-0-4] matches ['event:base-stat']
+ matched
+
+Fixes: 09519ec3b19e4144 ("perf: Add perf_event_attr::config3")
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Rob Herring <robh@kernel.org>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Sven Schnelle <svens@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Cc: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20230322094731.1768281-1-tmricht@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/attr/base-record | 2 +-
+ tools/perf/tests/attr/base-stat | 2 +-
+ tools/perf/tests/attr/system-wide-dummy | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/tests/attr/base-record b/tools/perf/tests/attr/base-record
+index 3ef07a12aa142..27c21271a16c9 100644
+--- a/tools/perf/tests/attr/base-record
++++ b/tools/perf/tests/attr/base-record
+@@ -5,7 +5,7 @@ group_fd=-1
+ flags=0|8
+ cpu=*
+ type=0|1
+-size=128
++size=136
+ config=0
+ sample_period=*
+ sample_type=263
+diff --git a/tools/perf/tests/attr/base-stat b/tools/perf/tests/attr/base-stat
+index 4081644565306..a21fb65bc012e 100644
+--- a/tools/perf/tests/attr/base-stat
++++ b/tools/perf/tests/attr/base-stat
+@@ -5,7 +5,7 @@ group_fd=-1
+ flags=0|8
+ cpu=*
+ type=0
+-size=128
++size=136
+ config=0
+ sample_period=0
+ sample_type=65536
+diff --git a/tools/perf/tests/attr/system-wide-dummy b/tools/perf/tests/attr/system-wide-dummy
+index 8fec06eda5f90..2f3e3eb728eb4 100644
+--- a/tools/perf/tests/attr/system-wide-dummy
++++ b/tools/perf/tests/attr/system-wide-dummy
+@@ -7,7 +7,7 @@ cpu=*
+ pid=-1
+ flags=8
+ type=1
+-size=128
++size=136
+ config=9
+ sample_period=4000
+ sample_type=455
+--
+2.39.2
+
--- /dev/null
+From 8996031ab9275bdcc71e2accda5b74e9ada3b551 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 20:30:58 +0100
+Subject: perf tests record_offcpu.sh: Fix redirection of stderr to stdin
+
+From: Patrice Duroux <patrice.duroux@gmail.com>
+
+[ Upstream commit 9835b742ac3ee16dee361e7ccda8022f99d1cd94 ]
+
+It's not 2&>1, the correct is 2>&1
+
+Fixes: ade1d0307b2fb3d9 ("perf offcpu: Update offcpu test for child process")
+Signed-off-by: Patrice Duroux <patrice.duroux@gmail.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20230303193058.21274-1-patrice.duroux@gmail.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/record_offcpu.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/shell/record_offcpu.sh b/tools/perf/tests/shell/record_offcpu.sh
+index e01973d4e0fba..f062ae9a95e1a 100755
+--- a/tools/perf/tests/shell/record_offcpu.sh
++++ b/tools/perf/tests/shell/record_offcpu.sh
+@@ -65,7 +65,7 @@ test_offcpu_child() {
+
+ # perf bench sched messaging creates 400 processes
+ if ! perf record --off-cpu -e dummy -o ${perfdata} -- \
+- perf bench sched messaging -g 10 > /dev/null 2&>1
++ perf bench sched messaging -g 10 > /dev/null 2>&1
+ then
+ echo "Child task off-cpu test [Failed record]"
+ err=1
+--
+2.39.2
+
--- /dev/null
+From 596c8fccfdcfeb462c74bcdde7c787240bebfc9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 02:59:53 +0000
+Subject: perf tracepoint: Fix memory leak in is_valid_tracepoint()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 9b86c49710eec7b4fbb78a0232b2dd0972a2b576 ]
+
+When is_valid_tracepoint() returns 1, need to call put_events_file() to
+free `dir_path`.
+
+Fixes: 25a7d914274de386 ("perf parse-events: Use get/put_events_file()")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20230421025953.173826-1-yangjihong1@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/tracepoint.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/perf/util/tracepoint.c b/tools/perf/util/tracepoint.c
+index 89ef56c433110..92dd8b455b902 100644
+--- a/tools/perf/util/tracepoint.c
++++ b/tools/perf/util/tracepoint.c
+@@ -50,6 +50,7 @@ int is_valid_tracepoint(const char *event_string)
+ sys_dirent->d_name, evt_dirent->d_name);
+ if (!strcmp(evt_path, event_string)) {
+ closedir(evt_dir);
++ put_events_file(dir_path);
+ closedir(sys_dir);
+ return 1;
+ }
+--
+2.39.2
+
--- /dev/null
+From 1b5819fb0b5f20469cfa0da5ed4a6b55803472d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 16:59:08 +0530
+Subject: perf vendor events power9: Remove UTF-8 characters from JSON files
+
+From: Kajol Jain <kjain@linux.ibm.com>
+
+[ Upstream commit 5d9df8731c0941f3add30f96745a62586a0c9d52 ]
+
+Commit 3c22ba5243040c13 ("perf vendor events powerpc: Update POWER9
+events") added and updated power9 PMU JSON events. However some of the
+JSON events which are part of other.json and pipeline.json files,
+contains UTF-8 characters in their brief description. Having UTF-8
+character could breaks the perf build on some distros.
+
+Fix this issue by removing the UTF-8 characters from other.json and
+pipeline.json files.
+
+Result without the fix:
+
+ [command]# file -i pmu-events/arch/powerpc/power9/*
+ pmu-events/arch/powerpc/power9/cache.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/floating-point.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/frontend.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/marked.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/memory.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/metrics.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/nest_metrics.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/other.json: application/json; charset=utf-8
+ pmu-events/arch/powerpc/power9/pipeline.json: application/json; charset=utf-8
+ pmu-events/arch/powerpc/power9/pmc.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/translation.json: application/json; charset=us-ascii
+ [command]#
+
+Result with the fix:
+
+ [command]# file -i pmu-events/arch/powerpc/power9/*
+ pmu-events/arch/powerpc/power9/cache.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/floating-point.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/frontend.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/marked.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/memory.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/metrics.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/nest_metrics.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/other.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/pipeline.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/pmc.json: application/json; charset=us-ascii
+ pmu-events/arch/powerpc/power9/translation.json: application/json; charset=us-ascii
+ [command]#
+
+Fixes: 3c22ba5243040c13 ("perf vendor events powerpc: Update POWER9 events")
+Reported-by: Arnaldo Carvalho de Melo <acme@kernel.com>
+Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Cc: Disha Goel <disgoel@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
+Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Cc: linuxppc-dev@lists.ozlabs.org
+Link: https://lore.kernel.org/lkml/ZBxP77deq7ikTxwG@kernel.org/
+Link: https://lore.kernel.org/r/20230328112908.113158-1-kjain@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/arch/powerpc/power9/other.json | 4 ++--
+ tools/perf/pmu-events/arch/powerpc/power9/pipeline.json | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/pmu-events/arch/powerpc/power9/other.json b/tools/perf/pmu-events/arch/powerpc/power9/other.json
+index 3f69422c21f99..f10bd554521a0 100644
+--- a/tools/perf/pmu-events/arch/powerpc/power9/other.json
++++ b/tools/perf/pmu-events/arch/powerpc/power9/other.json
+@@ -1417,7 +1417,7 @@
+ {
+ "EventCode": "0x45054",
+ "EventName": "PM_FMA_CMPL",
+- "BriefDescription": "two flops operation completed (fmadd, fnmadd, fmsub, fnmsub) Scalar instructions only. "
++ "BriefDescription": "two flops operation completed (fmadd, fnmadd, fmsub, fnmsub) Scalar instructions only."
+ },
+ {
+ "EventCode": "0x201E8",
+@@ -2017,7 +2017,7 @@
+ {
+ "EventCode": "0xC0BC",
+ "EventName": "PM_LSU_FLUSH_OTHER",
+- "BriefDescription": "Other LSU flushes including: Sync (sync ack from L2 caused search of LRQ for oldest snooped load, This will either signal a Precise Flush of the oldest snooped loa or a Flush Next PPC); Data Valid Flush Next (several cases of this, one example is store and reload are lined up such that a store-hit-reload scenario exists and the CDF has already launched and has gotten bad/stale data); Bad Data Valid Flush Next (might be a few cases of this, one example is a larxa (D$ hit) return data and dval but can't allocate to LMQ (LMQ full or other reason). Already gave dval but can't watch it for snoop_hit_larx. Need to take the “bad dval” back and flush all younger ops)"
++ "BriefDescription": "Other LSU flushes including: Sync (sync ack from L2 caused search of LRQ for oldest snooped load, This will either signal a Precise Flush of the oldest snooped loa or a Flush Next PPC); Data Valid Flush Next (several cases of this, one example is store and reload are lined up such that a store-hit-reload scenario exists and the CDF has already launched and has gotten bad/stale data); Bad Data Valid Flush Next (might be a few cases of this, one example is a larxa (D$ hit) return data and dval but can't allocate to LMQ (LMQ full or other reason). Already gave dval but can't watch it for snoop_hit_larx. Need to take the 'bad dval' back and flush all younger ops)"
+ },
+ {
+ "EventCode": "0x5094",
+diff --git a/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json b/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json
+index d0265f255de2b..723bffa41c448 100644
+--- a/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json
++++ b/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json
+@@ -442,7 +442,7 @@
+ {
+ "EventCode": "0x4D052",
+ "EventName": "PM_2FLOP_CMPL",
+- "BriefDescription": "DP vector version of fmul, fsub, fcmp, fsel, fabs, fnabs, fres ,fsqrte, fneg "
++ "BriefDescription": "DP vector version of fmul, fsub, fcmp, fsel, fabs, fnabs, fres ,fsqrte, fneg"
+ },
+ {
+ "EventCode": "0x1F142",
+--
+2.39.2
+
--- /dev/null
+From 86c8a63954567df42bc47f33a8553373994a1c62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 13:25:32 +0100
+Subject: perf vendor events s390: Remove UTF-8 characters from JSON file
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit eb2feb68cb7d404288493c41480843bc9f404789 ]
+
+Commit 7f76b31130680fb3 ("perf list: Add IBM z16 event description for
+s390") contains the verbal description for z16 extended counter set.
+
+However some entries of the public description contain UTF-8 characters
+which breaks the build on some distros.
+
+Fix this and remove the UTF-8 characters.
+
+Fixes: 7f76b31130680fb3 ("perf list: Add IBM z16 event description for s390")
+Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Suggested-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Sven Schnelle <svens@linux.ibm.com>
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Link: https://lore.kernel.org/r/ZBwkl77/I31AQk12@osiris
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/arch/s390/cf_z16/extended.json | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tools/perf/pmu-events/arch/s390/cf_z16/extended.json b/tools/perf/pmu-events/arch/s390/cf_z16/extended.json
+index c306190fc06f2..c2b10ec1c6e01 100644
+--- a/tools/perf/pmu-events/arch/s390/cf_z16/extended.json
++++ b/tools/perf/pmu-events/arch/s390/cf_z16/extended.json
+@@ -95,28 +95,28 @@
+ "EventCode": "145",
+ "EventName": "DCW_REQ",
+ "BriefDescription": "Directory Write Level 1 Data Cache from Cache",
+- "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from the requestor’s Level-2 cache."
++ "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from the requestors Level-2 cache."
+ },
+ {
+ "Unit": "CPU-M-CF",
+ "EventCode": "146",
+ "EventName": "DCW_REQ_IV",
+ "BriefDescription": "Directory Write Level 1 Data Cache from Cache with Intervention",
+- "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from the requestor’s Level-2 cache with intervention."
++ "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from the requestors Level-2 cache with intervention."
+ },
+ {
+ "Unit": "CPU-M-CF",
+ "EventCode": "147",
+ "EventName": "DCW_REQ_CHIP_HIT",
+ "BriefDescription": "Directory Write Level 1 Data Cache from Cache with Chip HP Hit",
+- "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from the requestor’s Level-2 cache after using chip level horizontal persistence, Chip-HP hit."
++ "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from the requestors Level-2 cache after using chip level horizontal persistence, Chip-HP hit."
+ },
+ {
+ "Unit": "CPU-M-CF",
+ "EventCode": "148",
+ "EventName": "DCW_REQ_DRAWER_HIT",
+ "BriefDescription": "Directory Write Level 1 Data Cache from Cache with Drawer HP Hit",
+- "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from the requestor’s Level-2 cache after using drawer level horizontal persistence, Drawer-HP hit."
++ "PublicDescription": "A directory write to the Level-1 Data cache directory where the returned cache line was sourced from the requestors Level-2 cache after using drawer level horizontal persistence, Drawer-HP hit."
+ },
+ {
+ "Unit": "CPU-M-CF",
+@@ -284,7 +284,7 @@
+ "EventCode": "172",
+ "EventName": "ICW_REQ_DRAWER_HIT",
+ "BriefDescription": "Directory Write Level 1 Instruction Cache from Cache with Drawer HP Hit",
+- "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from the requestor’s Level-2 cache using drawer level horizontal persistence, Drawer-HP hit."
++ "PublicDescription": "A directory write to the Level-1 Instruction cache directory where the returned cache line was sourced from the requestors Level-2 cache using drawer level horizontal persistence, Drawer-HP hit."
+ },
+ {
+ "Unit": "CPU-M-CF",
+--
+2.39.2
+
--- /dev/null
+From f264a1bbb740b18eb61f2c81c77d230bf8aa72ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 16:53:29 +0800
+Subject: r8152: fix flow control issue of RTL8156A
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit 8ceda6d5a1e5402fd852e6cc59a286ce3dc545ee ]
+
+The feature of flow control becomes abnormal, if the device sends a
+pause frame and the tx/rx is disabled before sending a release frame. It
+causes the lost of packets.
+
+Set PLA_RX_FIFO_FULL and PLA_RX_FIFO_EMPTY to zeros before disabling the
+tx/rx. And, toggle FC_PATCH_TASK before enabling tx/rx to reset the flow
+control patch and timer. Then, the hardware could clear the state and
+the flow control becomes normal after enabling tx/rx.
+
+Besides, remove inline for fc_pause_on_auto() and fc_pause_off_auto().
+
+Fixes: 195aae321c82 ("r8152: support new chips")
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 56 ++++++++++++++++++++++++++---------------
+ 1 file changed, 36 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 0fc4b959edc18..afd50e90d1fee 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -5986,6 +5986,25 @@ static void rtl8153_disable(struct r8152 *tp)
+ r8153_aldps_en(tp, true);
+ }
+
++static u32 fc_pause_on_auto(struct r8152 *tp)
++{
++ return (ALIGN(mtu_to_size(tp->netdev->mtu), 1024) + 6 * 1024);
++}
++
++static u32 fc_pause_off_auto(struct r8152 *tp)
++{
++ return (ALIGN(mtu_to_size(tp->netdev->mtu), 1024) + 14 * 1024);
++}
++
++static void r8156_fc_parameter(struct r8152 *tp)
++{
++ u32 pause_on = tp->fc_pause_on ? tp->fc_pause_on : fc_pause_on_auto(tp);
++ u32 pause_off = tp->fc_pause_off ? tp->fc_pause_off : fc_pause_off_auto(tp);
++
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_RX_FIFO_FULL, pause_on / 16);
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_RX_FIFO_EMPTY, pause_off / 16);
++}
++
+ static int rtl8156_enable(struct r8152 *tp)
+ {
+ u32 ocp_data;
+@@ -5994,6 +6013,7 @@ static int rtl8156_enable(struct r8152 *tp)
+ if (test_bit(RTL8152_UNPLUG, &tp->flags))
+ return -ENODEV;
+
++ r8156_fc_parameter(tp);
+ set_tx_qlen(tp);
+ rtl_set_eee_plus(tp);
+ r8153_set_rx_early_timeout(tp);
+@@ -6025,9 +6045,24 @@ static int rtl8156_enable(struct r8152 *tp)
+ ocp_write_word(tp, MCU_TYPE_USB, USB_L1_CTRL, ocp_data);
+ }
+
++ ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_FW_TASK);
++ ocp_data &= ~FC_PATCH_TASK;
++ ocp_write_word(tp, MCU_TYPE_USB, USB_FW_TASK, ocp_data);
++ usleep_range(1000, 2000);
++ ocp_data |= FC_PATCH_TASK;
++ ocp_write_word(tp, MCU_TYPE_USB, USB_FW_TASK, ocp_data);
++
+ return rtl_enable(tp);
+ }
+
++static void rtl8156_disable(struct r8152 *tp)
++{
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_RX_FIFO_FULL, 0);
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_RX_FIFO_EMPTY, 0);
++
++ rtl8153_disable(tp);
++}
++
+ static int rtl8156b_enable(struct r8152 *tp)
+ {
+ u32 ocp_data;
+@@ -6429,25 +6464,6 @@ static void rtl8153c_up(struct r8152 *tp)
+ r8153b_u1u2en(tp, true);
+ }
+
+-static inline u32 fc_pause_on_auto(struct r8152 *tp)
+-{
+- return (ALIGN(mtu_to_size(tp->netdev->mtu), 1024) + 6 * 1024);
+-}
+-
+-static inline u32 fc_pause_off_auto(struct r8152 *tp)
+-{
+- return (ALIGN(mtu_to_size(tp->netdev->mtu), 1024) + 14 * 1024);
+-}
+-
+-static void r8156_fc_parameter(struct r8152 *tp)
+-{
+- u32 pause_on = tp->fc_pause_on ? tp->fc_pause_on : fc_pause_on_auto(tp);
+- u32 pause_off = tp->fc_pause_off ? tp->fc_pause_off : fc_pause_off_auto(tp);
+-
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_RX_FIFO_FULL, pause_on / 16);
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_RX_FIFO_EMPTY, pause_off / 16);
+-}
+-
+ static void rtl8156_change_mtu(struct r8152 *tp)
+ {
+ u32 rx_max_size = mtu_to_size(tp->netdev->mtu);
+@@ -9340,7 +9356,7 @@ static int rtl_ops_init(struct r8152 *tp)
+ case RTL_VER_10:
+ ops->init = r8156_init;
+ ops->enable = rtl8156_enable;
+- ops->disable = rtl8153_disable;
++ ops->disable = rtl8156_disable;
+ ops->up = rtl8156_up;
+ ops->down = rtl8156_down;
+ ops->unload = rtl8153_unload;
+--
+2.39.2
+
--- /dev/null
+From 0486c4b22c8089b659d817396bea6aa3204c4c00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 May 2023 11:36:27 +0800
+Subject: r8152: fix the autosuspend doesn't work
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit 0fbd79c01a9a657348f7032df70c57a406468c86 ]
+
+Set supports_autosuspend = 1 for the rtl8152_cfgselector_driver.
+
+Fixes: ec51fbd1b8a2 ("r8152: add USB device driver for config selection")
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 755b0f72dd44f..0999a58ca9d26 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -9910,6 +9910,7 @@ static struct usb_device_driver rtl8152_cfgselector_driver = {
+ .probe = rtl8152_cfgselector_probe,
+ .id_table = rtl8152_table,
+ .generic_subclass = 1,
++ .supports_autosuspend = 1,
+ };
+
+ static int __init rtl8152_driver_init(void)
+--
+2.39.2
+
--- /dev/null
+From b9f064740dfad8a1caf8aa0a3de30f65f9e4475f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 16:53:30 +0800
+Subject: r8152: fix the poor throughput for 2.5G devices
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit 61b0ad6f58e2066e054c6d4839d67974d2861a7d ]
+
+Fix the poor throughput for 2.5G devices, when changing the speed from
+auto mode to force mode. This patch is used to notify the MAC when the
+mode is changed.
+
+Fixes: 195aae321c82 ("r8152: support new chips")
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index afd50e90d1fee..58670a65b840d 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -199,6 +199,7 @@
+ #define OCP_EEE_AR 0xa41a
+ #define OCP_EEE_DATA 0xa41c
+ #define OCP_PHY_STATUS 0xa420
++#define OCP_INTR_EN 0xa424
+ #define OCP_NCTL_CFG 0xa42c
+ #define OCP_POWER_CFG 0xa430
+ #define OCP_EEE_CFG 0xa432
+@@ -620,6 +621,9 @@ enum spd_duplex {
+ #define PHY_STAT_LAN_ON 3
+ #define PHY_STAT_PWRDN 5
+
++/* OCP_INTR_EN */
++#define INTR_SPEED_FORCE BIT(3)
++
+ /* OCP_NCTL_CFG */
+ #define PGA_RETURN_EN BIT(1)
+
+@@ -7554,6 +7558,11 @@ static void r8156_hw_phy_cfg(struct r8152 *tp)
+ ((swap_a & 0x1f) << 8) |
+ ((swap_a >> 8) & 0x1f));
+ }
++
++ /* Notify the MAC when the speed is changed to force mode. */
++ data = ocp_reg_read(tp, OCP_INTR_EN);
++ data |= INTR_SPEED_FORCE;
++ ocp_reg_write(tp, OCP_INTR_EN, data);
+ break;
+ default:
+ break;
+@@ -7949,6 +7958,11 @@ static void r8156b_hw_phy_cfg(struct r8152 *tp)
+ break;
+ }
+
++ /* Notify the MAC when the speed is changed to force mode. */
++ data = ocp_reg_read(tp, OCP_INTR_EN);
++ data |= INTR_SPEED_FORCE;
++ ocp_reg_write(tp, OCP_INTR_EN, data);
++
+ if (rtl_phy_patch_request(tp, true, true))
+ return;
+
+--
+2.39.2
+
--- /dev/null
+From a87242fba19e4fe286c42be0941c6d56832820b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 16:53:31 +0800
+Subject: r8152: move setting r8153b_rx_agg_chg_indicate()
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit cce8334f4aacd9936309a002d4a4de92a07cd2c2 ]
+
+Move setting r8153b_rx_agg_chg_indicate() for 2.5G devices. The
+r8153b_rx_agg_chg_indicate() has to be called after enabling tx/rx.
+Otherwise, the coalescing settings are useless.
+
+Fixes: 195aae321c82 ("r8152: support new chips")
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 58670a65b840d..755b0f72dd44f 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -3027,12 +3027,16 @@ static int rtl_enable(struct r8152 *tp)
+ ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CR, ocp_data);
+
+ switch (tp->version) {
+- case RTL_VER_08:
+- case RTL_VER_09:
+- case RTL_VER_14:
+- r8153b_rx_agg_chg_indicate(tp);
++ case RTL_VER_01:
++ case RTL_VER_02:
++ case RTL_VER_03:
++ case RTL_VER_04:
++ case RTL_VER_05:
++ case RTL_VER_06:
++ case RTL_VER_07:
+ break;
+ default:
++ r8153b_rx_agg_chg_indicate(tp);
+ break;
+ }
+
+@@ -3086,7 +3090,6 @@ static void r8153_set_rx_early_timeout(struct r8152 *tp)
+ 640 / 8);
+ ocp_write_word(tp, MCU_TYPE_USB, USB_RX_EXTRA_AGGR_TMR,
+ ocp_data);
+- r8153b_rx_agg_chg_indicate(tp);
+ break;
+
+ default:
+@@ -3120,7 +3123,6 @@ static void r8153_set_rx_early_size(struct r8152 *tp)
+ case RTL_VER_15:
+ ocp_write_word(tp, MCU_TYPE_USB, USB_RX_EARLY_SIZE,
+ ocp_data / 8);
+- r8153b_rx_agg_chg_indicate(tp);
+ break;
+ default:
+ WARN_ON_ONCE(1);
+--
+2.39.2
+
--- /dev/null
+From e2db90b43633b899c2e5cb10a5ae5ced88956bff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 16:16:22 -0600
+Subject: RDMA/rxe: Change rxe_dbg to rxe_dbg_dev
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit a9fb3287211e64b94ceb2b6b4791cc2b829d0d56 ]
+
+Replace the name rxe_dbg with rxe_dbg_dev which better matches
+the remaining rxe_dbg_xxx macros for debug messages with a
+rxe device parameter. Reuse the name rxe_dbg for debug messages
+which do not have a rxe device parameter.
+
+Link: https://lore.kernel.org/r/20230303221623.8053-3-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 78b26a335310 ("RDMA/rxe: Remove tasklet call from rxe_cq.c")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.c | 2 +-
+ drivers/infiniband/sw/rxe/rxe.h | 3 ++-
+ drivers/infiniband/sw/rxe/rxe_cq.c | 6 +++---
+ drivers/infiniband/sw/rxe/rxe_icrc.c | 4 ++--
+ drivers/infiniband/sw/rxe/rxe_mmap.c | 6 +++---
+ drivers/infiniband/sw/rxe/rxe_net.c | 4 ++--
+ drivers/infiniband/sw/rxe/rxe_qp.c | 16 ++++++++--------
+ drivers/infiniband/sw/rxe/rxe_srq.c | 6 +++---
+ drivers/infiniband/sw/rxe/rxe_verbs.c | 2 +-
+ 9 files changed, 25 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index a3f05fdd9fac2..d57ba7a5964b9 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -187,7 +187,7 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev)
+ rxe = rxe_get_dev_from_net(ndev);
+ if (rxe) {
+ ib_device_put(&rxe->ib_dev);
+- rxe_dbg(rxe, "already configured on %s\n", ndev->name);
++ rxe_dbg_dev(rxe, "already configured on %s\n", ndev->name);
+ err = -EEXIST;
+ goto err;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h
+index 2415f3704f576..0757acc381038 100644
+--- a/drivers/infiniband/sw/rxe/rxe.h
++++ b/drivers/infiniband/sw/rxe/rxe.h
+@@ -38,7 +38,8 @@
+
+ #define RXE_ROCE_V2_SPORT (0xc000)
+
+-#define rxe_dbg(rxe, fmt, ...) ibdev_dbg(&(rxe)->ib_dev, \
++#define rxe_dbg(fmt, ...) pr_debug("%s: " fmt "\n", __func__, ##__VA_ARGS__)
++#define rxe_dbg_dev(rxe, fmt, ...) ibdev_dbg(&(rxe)->ib_dev, \
+ "%s: " fmt, __func__, ##__VA_ARGS__)
+ #define rxe_dbg_uc(uc, fmt, ...) ibdev_dbg((uc)->ibuc.device, \
+ "uc#%d %s: " fmt, (uc)->elem.index, __func__, ##__VA_ARGS__)
+diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
+index faf49c50bbaba..519ddec29b4ba 100644
+--- a/drivers/infiniband/sw/rxe/rxe_cq.c
++++ b/drivers/infiniband/sw/rxe/rxe_cq.c
+@@ -14,12 +14,12 @@ int rxe_cq_chk_attr(struct rxe_dev *rxe, struct rxe_cq *cq,
+ int count;
+
+ if (cqe <= 0) {
+- rxe_dbg(rxe, "cqe(%d) <= 0\n", cqe);
++ rxe_dbg_dev(rxe, "cqe(%d) <= 0\n", cqe);
+ goto err1;
+ }
+
+ if (cqe > rxe->attr.max_cqe) {
+- rxe_dbg(rxe, "cqe(%d) > max_cqe(%d)\n",
++ rxe_dbg_dev(rxe, "cqe(%d) > max_cqe(%d)\n",
+ cqe, rxe->attr.max_cqe);
+ goto err1;
+ }
+@@ -50,7 +50,7 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
+ cq->queue = rxe_queue_init(rxe, &cqe,
+ sizeof(struct rxe_cqe), type);
+ if (!cq->queue) {
+- rxe_dbg(rxe, "unable to create cq\n");
++ rxe_dbg_dev(rxe, "unable to create cq\n");
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_icrc.c b/drivers/infiniband/sw/rxe/rxe_icrc.c
+index 71bc2c1895888..fdf5f08cd8f17 100644
+--- a/drivers/infiniband/sw/rxe/rxe_icrc.c
++++ b/drivers/infiniband/sw/rxe/rxe_icrc.c
+@@ -21,7 +21,7 @@ int rxe_icrc_init(struct rxe_dev *rxe)
+
+ tfm = crypto_alloc_shash("crc32", 0, 0);
+ if (IS_ERR(tfm)) {
+- rxe_dbg(rxe, "failed to init crc32 algorithm err: %ld\n",
++ rxe_dbg_dev(rxe, "failed to init crc32 algorithm err: %ld\n",
+ PTR_ERR(tfm));
+ return PTR_ERR(tfm);
+ }
+@@ -51,7 +51,7 @@ static __be32 rxe_crc32(struct rxe_dev *rxe, __be32 crc, void *next, size_t len)
+ *(__be32 *)shash_desc_ctx(shash) = crc;
+ err = crypto_shash_update(shash, next, len);
+ if (unlikely(err)) {
+- rxe_dbg(rxe, "failed crc calculation, err: %d\n", err);
++ rxe_dbg_dev(rxe, "failed crc calculation, err: %d\n", err);
+ return (__force __be32)crc32_le((__force u32)crc, next, len);
+ }
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mmap.c b/drivers/infiniband/sw/rxe/rxe_mmap.c
+index a47d72dbc5376..6b7f2bd698799 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mmap.c
++++ b/drivers/infiniband/sw/rxe/rxe_mmap.c
+@@ -79,7 +79,7 @@ int rxe_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
+
+ /* Don't allow a mmap larger than the object. */
+ if (size > ip->info.size) {
+- rxe_dbg(rxe, "mmap region is larger than the object!\n");
++ rxe_dbg_dev(rxe, "mmap region is larger than the object!\n");
+ spin_unlock_bh(&rxe->pending_lock);
+ ret = -EINVAL;
+ goto done;
+@@ -87,7 +87,7 @@ int rxe_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
+
+ goto found_it;
+ }
+- rxe_dbg(rxe, "unable to find pending mmap info\n");
++ rxe_dbg_dev(rxe, "unable to find pending mmap info\n");
+ spin_unlock_bh(&rxe->pending_lock);
+ ret = -EINVAL;
+ goto done;
+@@ -98,7 +98,7 @@ int rxe_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
+
+ ret = remap_vmalloc_range(vma, ip->obj, 0);
+ if (ret) {
+- rxe_dbg(rxe, "err %d from remap_vmalloc_range\n", ret);
++ rxe_dbg_dev(rxe, "err %d from remap_vmalloc_range\n", ret);
+ goto done;
+ }
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
+index e02e1624bcf4d..a2ace42e95366 100644
+--- a/drivers/infiniband/sw/rxe/rxe_net.c
++++ b/drivers/infiniband/sw/rxe/rxe_net.c
+@@ -596,7 +596,7 @@ static int rxe_notify(struct notifier_block *not_blk,
+ rxe_port_down(rxe);
+ break;
+ case NETDEV_CHANGEMTU:
+- rxe_dbg(rxe, "%s changed mtu to %d\n", ndev->name, ndev->mtu);
++ rxe_dbg_dev(rxe, "%s changed mtu to %d\n", ndev->name, ndev->mtu);
+ rxe_set_mtu(rxe, ndev->mtu);
+ break;
+ case NETDEV_CHANGE:
+@@ -608,7 +608,7 @@ static int rxe_notify(struct notifier_block *not_blk,
+ case NETDEV_CHANGENAME:
+ case NETDEV_FEAT_CHANGE:
+ default:
+- rxe_dbg(rxe, "ignoring netdev event = %ld for %s\n",
++ rxe_dbg_dev(rxe, "ignoring netdev event = %ld for %s\n",
+ event, ndev->name);
+ break;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index 13283ec06f95e..d5de5ba6940f1 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -19,33 +19,33 @@ static int rxe_qp_chk_cap(struct rxe_dev *rxe, struct ib_qp_cap *cap,
+ int has_srq)
+ {
+ if (cap->max_send_wr > rxe->attr.max_qp_wr) {
+- rxe_dbg(rxe, "invalid send wr = %u > %d\n",
++ rxe_dbg_dev(rxe, "invalid send wr = %u > %d\n",
+ cap->max_send_wr, rxe->attr.max_qp_wr);
+ goto err1;
+ }
+
+ if (cap->max_send_sge > rxe->attr.max_send_sge) {
+- rxe_dbg(rxe, "invalid send sge = %u > %d\n",
++ rxe_dbg_dev(rxe, "invalid send sge = %u > %d\n",
+ cap->max_send_sge, rxe->attr.max_send_sge);
+ goto err1;
+ }
+
+ if (!has_srq) {
+ if (cap->max_recv_wr > rxe->attr.max_qp_wr) {
+- rxe_dbg(rxe, "invalid recv wr = %u > %d\n",
++ rxe_dbg_dev(rxe, "invalid recv wr = %u > %d\n",
+ cap->max_recv_wr, rxe->attr.max_qp_wr);
+ goto err1;
+ }
+
+ if (cap->max_recv_sge > rxe->attr.max_recv_sge) {
+- rxe_dbg(rxe, "invalid recv sge = %u > %d\n",
++ rxe_dbg_dev(rxe, "invalid recv sge = %u > %d\n",
+ cap->max_recv_sge, rxe->attr.max_recv_sge);
+ goto err1;
+ }
+ }
+
+ if (cap->max_inline_data > rxe->max_inline_data) {
+- rxe_dbg(rxe, "invalid max inline data = %u > %d\n",
++ rxe_dbg_dev(rxe, "invalid max inline data = %u > %d\n",
+ cap->max_inline_data, rxe->max_inline_data);
+ goto err1;
+ }
+@@ -73,7 +73,7 @@ int rxe_qp_chk_init(struct rxe_dev *rxe, struct ib_qp_init_attr *init)
+ }
+
+ if (!init->recv_cq || !init->send_cq) {
+- rxe_dbg(rxe, "missing cq\n");
++ rxe_dbg_dev(rxe, "missing cq\n");
+ goto err1;
+ }
+
+@@ -82,14 +82,14 @@ int rxe_qp_chk_init(struct rxe_dev *rxe, struct ib_qp_init_attr *init)
+
+ if (init->qp_type == IB_QPT_GSI) {
+ if (!rdma_is_port_valid(&rxe->ib_dev, port_num)) {
+- rxe_dbg(rxe, "invalid port = %d\n", port_num);
++ rxe_dbg_dev(rxe, "invalid port = %d\n", port_num);
+ goto err1;
+ }
+
+ port = &rxe->port;
+
+ if (init->qp_type == IB_QPT_GSI && port->qp_gsi_index) {
+- rxe_dbg(rxe, "GSI QP exists for port %d\n", port_num);
++ rxe_dbg_dev(rxe, "GSI QP exists for port %d\n", port_num);
+ goto err1;
+ }
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rxe/rxe_srq.c
+index 82e37a41ced40..27ca82ec0826b 100644
+--- a/drivers/infiniband/sw/rxe/rxe_srq.c
++++ b/drivers/infiniband/sw/rxe/rxe_srq.c
+@@ -13,13 +13,13 @@ int rxe_srq_chk_init(struct rxe_dev *rxe, struct ib_srq_init_attr *init)
+ struct ib_srq_attr *attr = &init->attr;
+
+ if (attr->max_wr > rxe->attr.max_srq_wr) {
+- rxe_dbg(rxe, "max_wr(%d) > max_srq_wr(%d)\n",
++ rxe_dbg_dev(rxe, "max_wr(%d) > max_srq_wr(%d)\n",
+ attr->max_wr, rxe->attr.max_srq_wr);
+ goto err1;
+ }
+
+ if (attr->max_wr <= 0) {
+- rxe_dbg(rxe, "max_wr(%d) <= 0\n", attr->max_wr);
++ rxe_dbg_dev(rxe, "max_wr(%d) <= 0\n", attr->max_wr);
+ goto err1;
+ }
+
+@@ -27,7 +27,7 @@ int rxe_srq_chk_init(struct rxe_dev *rxe, struct ib_srq_init_attr *init)
+ attr->max_wr = RXE_MIN_SRQ_WR;
+
+ if (attr->max_sge > rxe->attr.max_srq_sge) {
+- rxe_dbg(rxe, "max_sge(%d) > max_srq_sge(%d)\n",
++ rxe_dbg_dev(rxe, "max_sge(%d) > max_srq_sge(%d)\n",
+ attr->max_sge, rxe->attr.max_srq_sge);
+ goto err1;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
+index 6803ac76ae572..a40a6d0581500 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
+@@ -1093,7 +1093,7 @@ int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name)
+
+ err = ib_register_device(dev, ibdev_name, NULL);
+ if (err)
+- rxe_dbg(rxe, "failed with error %d\n", err);
++ rxe_dbg_dev(rxe, "failed with error %d\n", err);
+
+ /*
+ * Note that rxe may be invalid at this point if another thread
+--
+2.39.2
+
--- /dev/null
+From fcc2810e9f6d6d3953b041045530b83903c8f011 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 16:16:23 -0600
+Subject: RDMA/rxe: Extend dbg log messages to err and info
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 9ac01f434a1eb56ea94611bd75cf62fa276b41f4 ]
+
+Extend the dbg log messages (e.g. rxe_dbg_xxx) to include
+err and info types. rxe.c is modified to use these new log
+messages as examples.
+
+Link: https://lore.kernel.org/r/20230303221623.8053-4-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Stable-dep-of: 78b26a335310 ("RDMA/rxe: Remove tasklet call from rxe_cq.c")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.c | 8 ++++---
+ drivers/infiniband/sw/rxe/rxe.h | 42 +++++++++++++++++++++++++++++++++
+ 2 files changed, 47 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index d57ba7a5964b9..7a7e713de52db 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -160,6 +160,8 @@ void rxe_set_mtu(struct rxe_dev *rxe, unsigned int ndev_mtu)
+
+ port->attr.active_mtu = mtu;
+ port->mtu_cap = ib_mtu_enum_to_int(mtu);
++
++ rxe_info_dev(rxe, "Set mtu to %d", port->mtu_cap);
+ }
+
+ /* called by ifc layer to create new rxe device.
+@@ -179,7 +181,7 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev)
+ int err = 0;
+
+ if (is_vlan_dev(ndev)) {
+- pr_err("rxe creation allowed on top of a real device only\n");
++ rxe_err("rxe creation allowed on top of a real device only");
+ err = -EPERM;
+ goto err;
+ }
+@@ -187,14 +189,14 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev)
+ rxe = rxe_get_dev_from_net(ndev);
+ if (rxe) {
+ ib_device_put(&rxe->ib_dev);
+- rxe_dbg_dev(rxe, "already configured on %s\n", ndev->name);
++ rxe_err_dev(rxe, "already configured on %s", ndev->name);
+ err = -EEXIST;
+ goto err;
+ }
+
+ err = rxe_net_add(ibdev_name, ndev);
+ if (err) {
+- pr_debug("failed to add %s\n", ndev->name);
++ rxe_err("failed to add %s\n", ndev->name);
+ goto err;
+ }
+ err:
+diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h
+index 0757acc381038..bd8a8ea4ea8fd 100644
+--- a/drivers/infiniband/sw/rxe/rxe.h
++++ b/drivers/infiniband/sw/rxe/rxe.h
+@@ -58,6 +58,48 @@
+ #define rxe_dbg_mw(mw, fmt, ...) ibdev_dbg((mw)->ibmw.device, \
+ "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__)
+
++#define rxe_err(fmt, ...) pr_err_ratelimited("%s: " fmt "\n", __func__, \
++ ##__VA_ARGS__)
++#define rxe_err_dev(rxe, fmt, ...) ibdev_err_ratelimited(&(rxe)->ib_dev, \
++ "%s: " fmt, __func__, ##__VA_ARGS__)
++#define rxe_err_uc(uc, fmt, ...) ibdev_err_ratelimited((uc)->ibuc.device, \
++ "uc#%d %s: " fmt, (uc)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_pd(pd, fmt, ...) ibdev_err_ratelimited((pd)->ibpd.device, \
++ "pd#%d %s: " fmt, (pd)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_ah(ah, fmt, ...) ibdev_err_ratelimited((ah)->ibah.device, \
++ "ah#%d %s: " fmt, (ah)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_srq(srq, fmt, ...) ibdev_err_ratelimited((srq)->ibsrq.device, \
++ "srq#%d %s: " fmt, (srq)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_qp(qp, fmt, ...) ibdev_err_ratelimited((qp)->ibqp.device, \
++ "qp#%d %s: " fmt, (qp)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_cq(cq, fmt, ...) ibdev_err_ratelimited((cq)->ibcq.device, \
++ "cq#%d %s: " fmt, (cq)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_mr(mr, fmt, ...) ibdev_err_ratelimited((mr)->ibmr.device, \
++ "mr#%d %s: " fmt, (mr)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_err_mw(mw, fmt, ...) ibdev_err_ratelimited((mw)->ibmw.device, \
++ "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__)
++
++#define rxe_info(fmt, ...) pr_info_ratelimited("%s: " fmt "\n", __func__, \
++ ##__VA_ARGS__)
++#define rxe_info_dev(rxe, fmt, ...) ibdev_info_ratelimited(&(rxe)->ib_dev, \
++ "%s: " fmt, __func__, ##__VA_ARGS__)
++#define rxe_info_uc(uc, fmt, ...) ibdev_info_ratelimited((uc)->ibuc.device, \
++ "uc#%d %s: " fmt, (uc)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_pd(pd, fmt, ...) ibdev_info_ratelimited((pd)->ibpd.device, \
++ "pd#%d %s: " fmt, (pd)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_ah(ah, fmt, ...) ibdev_info_ratelimited((ah)->ibah.device, \
++ "ah#%d %s: " fmt, (ah)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_srq(srq, fmt, ...) ibdev_info_ratelimited((srq)->ibsrq.device, \
++ "srq#%d %s: " fmt, (srq)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_qp(qp, fmt, ...) ibdev_info_ratelimited((qp)->ibqp.device, \
++ "qp#%d %s: " fmt, (qp)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_cq(cq, fmt, ...) ibdev_info_ratelimited((cq)->ibcq.device, \
++ "cq#%d %s: " fmt, (cq)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_mr(mr, fmt, ...) ibdev_info_ratelimited((mr)->ibmr.device, \
++ "mr#%d %s: " fmt, (mr)->elem.index, __func__, ##__VA_ARGS__)
++#define rxe_info_mw(mw, fmt, ...) ibdev_info_ratelimited((mw)->ibmw.device, \
++ "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__)
++
+ /* responder states */
+ enum resp_states {
+ RESPST_NONE,
+--
+2.39.2
+
--- /dev/null
+From d6fc7b9dc0090395816c062741335e16e8b690ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 14:43:20 +0800
+Subject: RISC-V: mm: Enable huge page support to kernel_page_present()
+ function
+
+From: Sia Jee Heng <jeeheng.sia@starfivetech.com>
+
+[ Upstream commit a15c90b67a662c75f469822a7f95c7aaa049e28f ]
+
+Currently kernel_page_present() function doesn't support huge page
+detection causes the function to mistakenly return false to the
+hibernation core.
+
+Add huge page detection to the function to solve the problem.
+
+Fixes: 9e953cda5cdf ("riscv: Introduce huge page support for 32/64bit kernel")
+Signed-off-by: Sia Jee Heng <jeeheng.sia@starfivetech.com>
+Reviewed-by: Ley Foon Tan <leyfoon.tan@starfivetech.com>
+Reviewed-by: Mason Huo <mason.huo@starfivetech.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Link: https://lore.kernel.org/r/20230330064321.1008373-4-jeeheng.sia@starfivetech.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/mm/pageattr.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c
+index 86c56616e5dea..ea3d61de065b3 100644
+--- a/arch/riscv/mm/pageattr.c
++++ b/arch/riscv/mm/pageattr.c
+@@ -217,18 +217,26 @@ bool kernel_page_present(struct page *page)
+ pgd = pgd_offset_k(addr);
+ if (!pgd_present(*pgd))
+ return false;
++ if (pgd_leaf(*pgd))
++ return true;
+
+ p4d = p4d_offset(pgd, addr);
+ if (!p4d_present(*p4d))
+ return false;
++ if (p4d_leaf(*p4d))
++ return true;
+
+ pud = pud_offset(p4d, addr);
+ if (!pud_present(*pud))
+ return false;
++ if (pud_leaf(*pud))
++ return true;
+
+ pmd = pmd_offset(pud, addr);
+ if (!pmd_present(*pmd))
+ return false;
++ if (pmd_leaf(*pmd))
++ return true;
+
+ pte = pte_offset_kernel(pmd, addr);
+ return pte_present(*pte);
+--
+2.39.2
+
--- /dev/null
+From 58b960552bd85d66430f64a5f2dd52b163185d92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 May 2023 15:33:54 -0700
+Subject: riscv: compat_syscall_table: Fixup compile warning
+
+From: Guo Ren <guoren@linux.alibaba.com>
+
+[ Upstream commit f9c4bbddece7eff1155c70d48e3c9c2a01b9d778 ]
+
+../arch/riscv/kernel/compat_syscall_table.c:12:41: warning: initialized
+field overwritten [-Woverride-init]
+ 12 | #define __SYSCALL(nr, call) [nr] = (call),
+ | ^
+../include/uapi/asm-generic/unistd.h:567:1: note: in expansion of macro
+'__SYSCALL'
+ 567 | __SYSCALL(__NR_semget, sys_semget)
+
+Fixes: 59c10c52f573 ("riscv: compat: syscall: Add compat_sys_call_table implementation")
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Tested-by: Jisheng Zhang <jszhang@kernel.org>
+Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
+Signed-off-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Drew Fustini <dfustini@baylibre.com>
+Link: https://lore.kernel.org/r/20230501223353.2833899-1-dfustini@baylibre.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/riscv/kernel/Makefile b/arch/riscv/kernel/Makefile
+index 4cf303a779ab9..8d02b9d05738d 100644
+--- a/arch/riscv/kernel/Makefile
++++ b/arch/riscv/kernel/Makefile
+@@ -9,6 +9,7 @@ CFLAGS_REMOVE_patch.o = $(CC_FLAGS_FTRACE)
+ CFLAGS_REMOVE_sbi.o = $(CC_FLAGS_FTRACE)
+ endif
+ CFLAGS_syscall_table.o += $(call cc-option,-Wno-override-init,)
++CFLAGS_compat_syscall_table.o += $(call cc-option,-Wno-override-init,)
+
+ ifdef CONFIG_KEXEC
+ AFLAGS_kexec_relocate.o := -mcmodel=medany $(call cc-option,-mno-relax)
+--
+2.39.2
+
--- /dev/null
+From 065e738af48f467912e4bd7ecc45f874cb608a02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 21:27:54 +0100
+Subject: rxrpc: Fix hard call timeout units
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 0d098d83c5d9e107b2df7f5e11f81492f56d2fe7 ]
+
+The hard call timeout is specified in the RXRPC_SET_CALL_TIMEOUT cmsg in
+seconds, so fix the point at which sendmsg() applies it to the call to
+convert to jiffies from seconds, not milliseconds.
+
+Fixes: a158bdd3247b ("rxrpc: Fix timeout of a call that hasn't yet been granted a channel")
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: "David S. Miller" <davem@davemloft.net>
+cc: Eric Dumazet <edumazet@google.com>
+cc: Jakub Kicinski <kuba@kernel.org>
+cc: Paolo Abeni <pabeni@redhat.com>
+cc: linux-afs@lists.infradead.org
+cc: netdev@vger.kernel.org
+cc: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/sendmsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index 6caa47d352ed6..7498a77b5d397 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -699,7 +699,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
+ fallthrough;
+ case 1:
+ if (p.call.timeouts.hard > 0) {
+- j = msecs_to_jiffies(p.call.timeouts.hard);
++ j = p.call.timeouts.hard * HZ;
+ now = jiffies;
+ j += now;
+ WRITE_ONCE(call->expect_term_by, j);
+--
+2.39.2
+
--- /dev/null
+From bd7564ddbf17028e29dd0f286422582761d8b4b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 13:56:35 +0100
+Subject: rxrpc: Fix potential data race in rxrpc_wait_to_be_connected()
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 2b5fdc0f5caa505afe34d608e2eefadadf2ee67a ]
+
+Inside the loop in rxrpc_wait_to_be_connected() it checks call->error to
+see if it should exit the loop without first checking the call state. This
+is probably safe as if call->error is set, the call is dead anyway, but we
+should probably wait for the call state to have been set to completion
+first, lest it cause surprise on the way out.
+
+Fix this by only accessing call->error if the call is complete. We don't
+actually need to access the error inside the loop as we'll do that after.
+
+This caused the following report:
+
+ BUG: KCSAN: data-race in rxrpc_send_data / rxrpc_set_call_completion
+
+ write to 0xffff888159cf3c50 of 4 bytes by task 25673 on cpu 1:
+ rxrpc_set_call_completion+0x71/0x1c0 net/rxrpc/call_state.c:22
+ rxrpc_send_data_packet+0xba9/0x1650 net/rxrpc/output.c:479
+ rxrpc_transmit_one+0x1e/0x130 net/rxrpc/output.c:714
+ rxrpc_decant_prepared_tx net/rxrpc/call_event.c:326 [inline]
+ rxrpc_transmit_some_data+0x496/0x600 net/rxrpc/call_event.c:350
+ rxrpc_input_call_event+0x564/0x1220 net/rxrpc/call_event.c:464
+ rxrpc_io_thread+0x307/0x1d80 net/rxrpc/io_thread.c:461
+ kthread+0x1ac/0x1e0 kernel/kthread.c:376
+ ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
+
+ read to 0xffff888159cf3c50 of 4 bytes by task 25672 on cpu 0:
+ rxrpc_send_data+0x29e/0x1950 net/rxrpc/sendmsg.c:296
+ rxrpc_do_sendmsg+0xb7a/0xc20 net/rxrpc/sendmsg.c:726
+ rxrpc_sendmsg+0x413/0x520 net/rxrpc/af_rxrpc.c:565
+ sock_sendmsg_nosec net/socket.c:724 [inline]
+ sock_sendmsg net/socket.c:747 [inline]
+ ____sys_sendmsg+0x375/0x4c0 net/socket.c:2501
+ ___sys_sendmsg net/socket.c:2555 [inline]
+ __sys_sendmmsg+0x263/0x500 net/socket.c:2641
+ __do_sys_sendmmsg net/socket.c:2670 [inline]
+ __se_sys_sendmmsg net/socket.c:2667 [inline]
+ __x64_sys_sendmmsg+0x57/0x60 net/socket.c:2667
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+ value changed: 0x00000000 -> 0xffffffea
+
+Fixes: 9d35d880e0e4 ("rxrpc: Move client call connection to the I/O thread")
+Reported-by: syzbot+ebc945fdb4acd72cba78@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/000000000000e7c6d205fa10a3cd@google.com/
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Dmitry Vyukov <dvyukov@google.com>
+cc: "David S. Miller" <davem@davemloft.net>
+cc: Eric Dumazet <edumazet@google.com>
+cc: Jakub Kicinski <kuba@kernel.org>
+cc: Paolo Abeni <pabeni@redhat.com>
+cc: linux-afs@lists.infradead.org
+cc: linux-fsdevel@vger.kernel.org
+cc: netdev@vger.kernel.org
+Link: https://lore.kernel.org/r/508133.1682427395@warthog.procyon.org.uk
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/sendmsg.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index da49fcf1c4567..6caa47d352ed6 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -50,15 +50,11 @@ static int rxrpc_wait_to_be_connected(struct rxrpc_call *call, long *timeo)
+ _enter("%d", call->debug_id);
+
+ if (rxrpc_call_state(call) != RXRPC_CALL_CLIENT_AWAIT_CONN)
+- return call->error;
++ goto no_wait;
+
+ add_wait_queue_exclusive(&call->waitq, &myself);
+
+ for (;;) {
+- ret = call->error;
+- if (ret < 0)
+- break;
+-
+ switch (call->interruptibility) {
+ case RXRPC_INTERRUPTIBLE:
+ case RXRPC_PREINTERRUPTIBLE:
+@@ -69,10 +65,9 @@ static int rxrpc_wait_to_be_connected(struct rxrpc_call *call, long *timeo)
+ set_current_state(TASK_UNINTERRUPTIBLE);
+ break;
+ }
+- if (rxrpc_call_state(call) != RXRPC_CALL_CLIENT_AWAIT_CONN) {
+- ret = call->error;
++
++ if (rxrpc_call_state(call) != RXRPC_CALL_CLIENT_AWAIT_CONN)
+ break;
+- }
+ if ((call->interruptibility == RXRPC_INTERRUPTIBLE ||
+ call->interruptibility == RXRPC_PREINTERRUPTIBLE) &&
+ signal_pending(current)) {
+@@ -85,6 +80,7 @@ static int rxrpc_wait_to_be_connected(struct rxrpc_call *call, long *timeo)
+ remove_wait_queue(&call->waitq, &myself);
+ __set_current_state(TASK_RUNNING);
+
++no_wait:
+ if (ret == 0 && rxrpc_call_is_complete(call))
+ ret = call->error;
+
+--
+2.39.2
+
--- /dev/null
+From 17aefe419adc815bc18972167745b605fc143a1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 21:27:56 +0100
+Subject: rxrpc: Fix timeout of a call that hasn't yet been granted a channel
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit db099c625b13a74d462521a46d98a8ce5b53af5d ]
+
+afs_make_call() calls rxrpc_kernel_begin_call() to begin a call (which may
+get stalled in the background waiting for a connection to become
+available); it then calls rxrpc_kernel_set_max_life() to set the timeouts -
+but that starts the call timer so the call timer might then expire before
+we get a connection assigned - leading to the following oops if the call
+stalled:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ ...
+ CPU: 1 PID: 5111 Comm: krxrpcio/0 Not tainted 6.3.0-rc7-build3+ #701
+ RIP: 0010:rxrpc_alloc_txbuf+0xc0/0x157
+ ...
+ Call Trace:
+ <TASK>
+ rxrpc_send_ACK+0x50/0x13b
+ rxrpc_input_call_event+0x16a/0x67d
+ rxrpc_io_thread+0x1b6/0x45f
+ ? _raw_spin_unlock_irqrestore+0x1f/0x35
+ ? rxrpc_input_packet+0x519/0x519
+ kthread+0xe7/0xef
+ ? kthread_complete_and_exit+0x1b/0x1b
+ ret_from_fork+0x22/0x30
+
+Fix this by noting the timeouts in struct rxrpc_call when the call is
+created. The timer will be started when the first packet is transmitted.
+
+It shouldn't be possible to trigger this directly from userspace through
+AF_RXRPC as sendmsg() will return EBUSY if the call is in the
+waiting-for-conn state if it dropped out of the wait due to a signal.
+
+Fixes: 9d35d880e0e4 ("rxrpc: Move client call connection to the I/O thread")
+Reported-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: "David S. Miller" <davem@davemloft.net>
+cc: Eric Dumazet <edumazet@google.com>
+cc: Jakub Kicinski <kuba@kernel.org>
+cc: Paolo Abeni <pabeni@redhat.com>
+cc: linux-afs@lists.infradead.org
+cc: netdev@vger.kernel.org
+cc: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/afs.h | 4 ++--
+ fs/afs/internal.h | 2 +-
+ fs/afs/rxrpc.c | 8 +++-----
+ include/net/af_rxrpc.h | 21 +++++++++++----------
+ net/rxrpc/af_rxrpc.c | 3 +++
+ net/rxrpc/ar-internal.h | 1 +
+ net/rxrpc/call_object.c | 9 ++++++++-
+ net/rxrpc/sendmsg.c | 1 +
+ 8 files changed, 30 insertions(+), 19 deletions(-)
+
+diff --git a/fs/afs/afs.h b/fs/afs/afs.h
+index 432cb4b239614..81815724db6c9 100644
+--- a/fs/afs/afs.h
++++ b/fs/afs/afs.h
+@@ -19,8 +19,8 @@
+ #define AFSPATHMAX 1024 /* Maximum length of a pathname plus NUL */
+ #define AFSOPAQUEMAX 1024 /* Maximum length of an opaque field */
+
+-#define AFS_VL_MAX_LIFESPAN (120 * HZ)
+-#define AFS_PROBE_MAX_LIFESPAN (30 * HZ)
++#define AFS_VL_MAX_LIFESPAN 120
++#define AFS_PROBE_MAX_LIFESPAN 30
+
+ typedef u64 afs_volid_t;
+ typedef u64 afs_vnodeid_t;
+diff --git a/fs/afs/internal.h b/fs/afs/internal.h
+index ad8523d0d0386..68ae91d21b578 100644
+--- a/fs/afs/internal.h
++++ b/fs/afs/internal.h
+@@ -128,7 +128,7 @@ struct afs_call {
+ spinlock_t state_lock;
+ int error; /* error code */
+ u32 abort_code; /* Remote abort ID or 0 */
+- unsigned int max_lifespan; /* Maximum lifespan to set if not 0 */
++ unsigned int max_lifespan; /* Maximum lifespan in secs to set if not 0 */
+ unsigned request_size; /* size of request data */
+ unsigned reply_max; /* maximum size of reply */
+ unsigned count2; /* count used in unmarshalling */
+diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
+index 7817e2b860e5e..6862e3dde364b 100644
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -334,7 +334,9 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp)
+ /* create a call */
+ rxcall = rxrpc_kernel_begin_call(call->net->socket, srx, call->key,
+ (unsigned long)call,
+- tx_total_len, gfp,
++ tx_total_len,
++ call->max_lifespan,
++ gfp,
+ (call->async ?
+ afs_wake_up_async_call :
+ afs_wake_up_call_waiter),
+@@ -349,10 +351,6 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp)
+ }
+
+ call->rxcall = rxcall;
+-
+- if (call->max_lifespan)
+- rxrpc_kernel_set_max_life(call->net->socket, rxcall,
+- call->max_lifespan);
+ call->issue_time = ktime_get_real();
+
+ /* send the request */
+diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
+index ba717eac0229a..73644bd42a3f9 100644
+--- a/include/net/af_rxrpc.h
++++ b/include/net/af_rxrpc.h
+@@ -40,16 +40,17 @@ typedef void (*rxrpc_user_attach_call_t)(struct rxrpc_call *, unsigned long);
+ void rxrpc_kernel_new_call_notification(struct socket *,
+ rxrpc_notify_new_call_t,
+ rxrpc_discard_new_call_t);
+-struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *,
+- struct sockaddr_rxrpc *,
+- struct key *,
+- unsigned long,
+- s64,
+- gfp_t,
+- rxrpc_notify_rx_t,
+- bool,
+- enum rxrpc_interruptibility,
+- unsigned int);
++struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
++ struct sockaddr_rxrpc *srx,
++ struct key *key,
++ unsigned long user_call_ID,
++ s64 tx_total_len,
++ u32 hard_timeout,
++ gfp_t gfp,
++ rxrpc_notify_rx_t notify_rx,
++ bool upgrade,
++ enum rxrpc_interruptibility interruptibility,
++ unsigned int debug_id);
+ int rxrpc_kernel_send_data(struct socket *, struct rxrpc_call *,
+ struct msghdr *, size_t,
+ rxrpc_notify_end_tx_t);
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index 102f5cbff91a3..a6f0d29f35ef9 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -265,6 +265,7 @@ static int rxrpc_listen(struct socket *sock, int backlog)
+ * @key: The security context to use (defaults to socket setting)
+ * @user_call_ID: The ID to use
+ * @tx_total_len: Total length of data to transmit during the call (or -1)
++ * @hard_timeout: The maximum lifespan of the call in sec
+ * @gfp: The allocation constraints
+ * @notify_rx: Where to send notifications instead of socket queue
+ * @upgrade: Request service upgrade for call
+@@ -283,6 +284,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
+ struct key *key,
+ unsigned long user_call_ID,
+ s64 tx_total_len,
++ u32 hard_timeout,
+ gfp_t gfp,
+ rxrpc_notify_rx_t notify_rx,
+ bool upgrade,
+@@ -313,6 +315,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
+ p.tx_total_len = tx_total_len;
+ p.interruptibility = interruptibility;
+ p.kernel = true;
++ p.timeouts.hard = hard_timeout;
+
+ memset(&cp, 0, sizeof(cp));
+ cp.local = rx->local;
+diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
+index 67b0a894162d7..5d44dc08f66d0 100644
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -616,6 +616,7 @@ struct rxrpc_call {
+ unsigned long expect_term_by; /* When we expect call termination by */
+ u32 next_rx_timo; /* Timeout for next Rx packet (jif) */
+ u32 next_req_timo; /* Timeout for next Rx request packet (jif) */
++ u32 hard_timo; /* Maximum lifetime or 0 (jif) */
+ struct timer_list timer; /* Combined event timer */
+ struct work_struct destroyer; /* In-process-context destroyer */
+ rxrpc_notify_rx_t notify_rx; /* kernel service Rx notification function */
+diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
+index e9f1f49d18c2a..fecbc73054bc2 100644
+--- a/net/rxrpc/call_object.c
++++ b/net/rxrpc/call_object.c
+@@ -226,6 +226,13 @@ static struct rxrpc_call *rxrpc_alloc_client_call(struct rxrpc_sock *rx,
+ if (cp->exclusive)
+ __set_bit(RXRPC_CALL_EXCLUSIVE, &call->flags);
+
++ if (p->timeouts.normal)
++ call->next_rx_timo = min(msecs_to_jiffies(p->timeouts.normal), 1UL);
++ if (p->timeouts.idle)
++ call->next_req_timo = min(msecs_to_jiffies(p->timeouts.idle), 1UL);
++ if (p->timeouts.hard)
++ call->hard_timo = p->timeouts.hard * HZ;
++
+ ret = rxrpc_init_client_call_security(call);
+ if (ret < 0) {
+ rxrpc_prefail_call(call, RXRPC_CALL_LOCAL_ERROR, ret);
+@@ -257,7 +264,7 @@ void rxrpc_start_call_timer(struct rxrpc_call *call)
+ call->keepalive_at = j;
+ call->expect_rx_by = j;
+ call->expect_req_by = j;
+- call->expect_term_by = j;
++ call->expect_term_by = j + call->hard_timo;
+ call->timer.expires = now;
+ }
+
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index c1b074c17b33e..8e0b94714e849 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -651,6 +651,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
+ if (IS_ERR(call))
+ return PTR_ERR(call);
+ /* ... and we have the call lock. */
++ p.call.nr_timeouts = 0;
+ ret = 0;
+ if (rxrpc_call_is_complete(call))
+ goto out_put_unlock;
+--
+2.39.2
+
--- /dev/null
+From f5ddc32b4da4f7f6bf73c56c51b1189ab8a9a35e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 21:27:55 +0100
+Subject: rxrpc: Make it so that a waiting process can be aborted
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 0eb362d254814ce04848730bf32e75b8ee1a4d6c ]
+
+When sendmsg() creates an rxrpc call, it queues it to wait for a connection
+and channel to be assigned and then waits before it can start shovelling
+data as the encrypted DATA packet content includes a summary of the
+connection parameters.
+
+However, sendmsg() may get interrupted before a connection gets assigned
+and further sendmsg() calls will fail with EBUSY until an assignment is
+made.
+
+Fix this so that the call can at least be aborted without failing on
+EBUSY. We have to be careful here as sendmsg() mustn't be allowed to start
+the call timer if the call doesn't yet have a connection assigned as an
+oops may follow shortly thereafter.
+
+Fixes: 540b1c48c37a ("rxrpc: Fix deadlock between call creation and sendmsg/recvmsg")
+Reported-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: "David S. Miller" <davem@davemloft.net>
+cc: Eric Dumazet <edumazet@google.com>
+cc: Jakub Kicinski <kuba@kernel.org>
+cc: Paolo Abeni <pabeni@redhat.com>
+cc: linux-afs@lists.infradead.org
+cc: netdev@vger.kernel.org
+cc: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/sendmsg.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index 7498a77b5d397..c1b074c17b33e 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -656,10 +656,13 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
+ goto out_put_unlock;
+ } else {
+ switch (rxrpc_call_state(call)) {
+- case RXRPC_CALL_UNINITIALISED:
+ case RXRPC_CALL_CLIENT_AWAIT_CONN:
+- case RXRPC_CALL_SERVER_PREALLOC:
+ case RXRPC_CALL_SERVER_SECURING:
++ if (p.command == RXRPC_CMD_SEND_ABORT)
++ break;
++ fallthrough;
++ case RXRPC_CALL_UNINITIALISED:
++ case RXRPC_CALL_SERVER_PREALLOC:
+ rxrpc_put_call(call, rxrpc_call_put_sendmsg);
+ ret = -EBUSY;
+ goto error_release_sock;
+--
+2.39.2
+
--- /dev/null
+From 721f31354174290adf85c3a5781e3e7608d043c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 11:34:22 +0800
+Subject: scsi: qedi: Fix use after free bug in qedi_remove()
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit c5749639f2d0a1f6cbe187d05f70c2e7c544d748 ]
+
+In qedi_probe() we call __qedi_probe() which initializes
+&qedi->recovery_work with qedi_recovery_handler() and
+&qedi->board_disable_work with qedi_board_disable_work().
+
+When qedi_schedule_recovery_handler() is called, schedule_delayed_work()
+will finally start the work.
+
+In qedi_remove(), which is called to remove the driver, the following
+sequence may be observed:
+
+Fix this by finishing the work before cleanup in qedi_remove().
+
+CPU0 CPU1
+
+ |qedi_recovery_handler
+qedi_remove |
+ __qedi_remove |
+iscsi_host_free |
+scsi_host_put |
+//free shost |
+ |iscsi_host_for_each_session
+ |//use qedi->shost
+
+Cancel recovery_work and board_disable_work in __qedi_remove().
+
+Fixes: 4b1068f5d74b ("scsi: qedi: Add MFW error recovery process")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Link: https://lore.kernel.org/r/20230413033422.28003-1-zyytlz.wz@163.com
+Acked-by: Manish Rangankar <mrangankar@marvell.com>
+Reviewed-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedi/qedi_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index f2ee49756df8d..45d3595541820 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -2450,6 +2450,9 @@ static void __qedi_remove(struct pci_dev *pdev, int mode)
+ qedi_ops->ll2->stop(qedi->cdev);
+ }
+
++ cancel_delayed_work_sync(&qedi->recovery_work);
++ cancel_delayed_work_sync(&qedi->board_disable_work);
++
+ qedi_free_iscsi_pf_param(qedi);
+
+ rval = qedi_ops->common->update_drv_state(qedi->cdev, false);
+--
+2.39.2
+
--- /dev/null
+From d0750727f6474d26b0c51a85fa4015dffde19776 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 16:03:56 +0800
+Subject: scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue
+
+From: Alice Chao <alice.chao@mediatek.com>
+
+[ Upstream commit 948afc69615167a3c82430f99bfd046332b89912 ]
+
+When ufshcd_err_handler() is executed, CQ event interrupt can enter waiting
+for the same lock. This can happen in ufshcd_handle_mcq_cq_events() and
+also in ufs_mtk_mcq_intr(). The following warning message will be generated
+when &hwq->cq_lock is used in IRQ context with IRQ enabled. Use
+ufshcd_mcq_poll_cqe_lock() with spin_lock_irqsave instead of spin_lock to
+resolve the deadlock issue.
+
+[name:lockdep&]WARNING: inconsistent lock state
+[name:lockdep&]--------------------------------
+[name:lockdep&]inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
+[name:lockdep&]kworker/u16:4/260 [HC0[0]:SC0[0]:HE1:SE1] takes:
+ ffffff8028444600 (&hwq->cq_lock){?.-.}-{2:2}, at:
+ufshcd_mcq_poll_cqe_lock+0x30/0xe0
+[name:lockdep&]{IN-HARDIRQ-W} state was registered at:
+ lock_acquire+0x17c/0x33c
+ _raw_spin_lock+0x5c/0x7c
+ ufshcd_mcq_poll_cqe_lock+0x30/0xe0
+ ufs_mtk_mcq_intr+0x60/0x1bc [ufs_mediatek_mod]
+ __handle_irq_event_percpu+0x140/0x3ec
+ handle_irq_event+0x50/0xd8
+ handle_fasteoi_irq+0x148/0x2b0
+ generic_handle_domain_irq+0x4c/0x6c
+ gic_handle_irq+0x58/0x134
+ call_on_irq_stack+0x40/0x74
+ do_interrupt_handler+0x84/0xe4
+ el1_interrupt+0x3c/0x78
+<snip>
+
+Possible unsafe locking scenario:
+ CPU0
+ ----
+ lock(&hwq->cq_lock);
+ <Interrupt>
+ lock(&hwq->cq_lock);
+ *** DEADLOCK ***
+2 locks held by kworker/u16:4/260:
+
+[name:lockdep&]
+ stack backtrace:
+CPU: 7 PID: 260 Comm: kworker/u16:4 Tainted: G S W OE
+6.1.17-mainline-android14-2-g277223301adb #1
+Workqueue: ufs_eh_wq_0 ufshcd_err_handler
+
+ Call trace:
+ dump_backtrace+0x10c/0x160
+ show_stack+0x20/0x30
+ dump_stack_lvl+0x98/0xd8
+ dump_stack+0x20/0x60
+ print_usage_bug+0x584/0x76c
+ mark_lock_irq+0x488/0x510
+ mark_lock+0x1ec/0x25c
+ __lock_acquire+0x4d8/0xffc
+ lock_acquire+0x17c/0x33c
+ _raw_spin_lock+0x5c/0x7c
+ ufshcd_mcq_poll_cqe_lock+0x30/0xe0
+ ufshcd_poll+0x68/0x1b0
+ ufshcd_transfer_req_compl+0x9c/0xc8
+ ufshcd_err_handler+0x3bc/0xea0
+ process_one_work+0x2f4/0x7e8
+ worker_thread+0x234/0x450
+ kthread+0x110/0x134
+ ret_from_fork+0x10/0x20
+
+Fixes: ed975065c31c ("scsi: ufs: core: mcq: Add completion support in poll")
+Reviewed-by: Can Guo <quic_cang@quicinc.com>
+Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Alice Chao <alice.chao@mediatek.com>
+Link: https://lore.kernel.org/r/20230424080400.8955-1-alice.chao@mediatek.com
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufs-mcq.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c
+index 31df052fbc417..202ff71e1b582 100644
+--- a/drivers/ufs/core/ufs-mcq.c
++++ b/drivers/ufs/core/ufs-mcq.c
+@@ -299,11 +299,11 @@ EXPORT_SYMBOL_GPL(ufshcd_mcq_poll_cqe_nolock);
+ unsigned long ufshcd_mcq_poll_cqe_lock(struct ufs_hba *hba,
+ struct ufs_hw_queue *hwq)
+ {
+- unsigned long completed_reqs;
++ unsigned long completed_reqs, flags;
+
+- spin_lock(&hwq->cq_lock);
++ spin_lock_irqsave(&hwq->cq_lock, flags);
+ completed_reqs = ufshcd_mcq_poll_cqe_nolock(hba, hwq);
+- spin_unlock(&hwq->cq_lock);
++ spin_unlock_irqrestore(&hwq->cq_lock, flags);
+
+ return completed_reqs;
+ }
+--
+2.39.2
+
--- /dev/null
+From 43a57614ec5338771d0251190b0a165fb3402359 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 22:11:39 +0100
+Subject: selftests: netfilter: fix libmnl pkg-config usage
+
+From: Jeremy Sowden <jeremy@azazel.net>
+
+[ Upstream commit de4773f0235acf74554f6a64ea60adc0d7b01895 ]
+
+1. Don't hard-code pkg-config
+2. Remove distro-specific default for CFLAGS
+3. Use pkg-config for LDLIBS
+
+Fixes: a50a88f026fb ("selftests: netfilter: fix a build error on openSUSE")
+Suggested-by: Jan Engelhardt <jengelh@inai.de>
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/netfilter/Makefile | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
+index 4504ee07be08d..3686bfa6c58d7 100644
+--- a/tools/testing/selftests/netfilter/Makefile
++++ b/tools/testing/selftests/netfilter/Makefile
+@@ -8,8 +8,11 @@ TEST_PROGS := nft_trans_stress.sh nft_fib.sh nft_nat.sh bridge_brouter.sh \
+ ipip-conntrack-mtu.sh conntrack_tcp_unreplied.sh \
+ conntrack_vrf.sh nft_synproxy.sh rpath.sh
+
+-CFLAGS += $(shell pkg-config --cflags libmnl 2>/dev/null || echo "-I/usr/include/libmnl")
+-LDLIBS = -lmnl
++HOSTPKG_CONFIG := pkg-config
++
++CFLAGS += $(shell $(HOSTPKG_CONFIG) --cflags libmnl 2>/dev/null)
++LDLIBS += $(shell $(HOSTPKG_CONFIG) --libs libmnl 2>/dev/null || echo -lmnl)
++
+ TEST_GEN_FILES = nf-queue connect_close
+
+ include ../lib.mk
+--
+2.39.2
+
--- /dev/null
+From ce70d2e2b8d620c54d31222afd24230fd81c7851 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Apr 2023 11:49:23 +0200
+Subject: selftests: srv6: make srv6_end_dt46_l3vpn_test more robust
+
+From: Andrea Mayer <andrea.mayer@uniroma2.it>
+
+[ Upstream commit 46ef24c60f8ee70662968ac55325297ed4624d61 ]
+
+On some distributions, the rp_filter is automatically set (=1) by
+default on a netdev basis (also on VRFs).
+In an SRv6 End.DT46 behavior, decapsulated IPv4 packets are routed using
+the table associated with the VRF bound to that tunnel. During lookup
+operations, the rp_filter can lead to packet loss when activated on the
+VRF.
+Therefore, we chose to make this selftest more robust by explicitly
+disabling the rp_filter during tests (as it is automatically set by some
+Linux distributions).
+
+Fixes: 03a0b567a03d ("selftests: seg6: add selftest for SRv6 End.DT46 Behavior")
+Reported-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
+Tested-by: Hangbin Liu <liuhangbin@gmail.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testing/selftests/net/srv6_end_dt46_l3vpn_test.sh | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh b/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh
+index aebaab8ce44cb..441eededa0312 100755
+--- a/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh
++++ b/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh
+@@ -292,6 +292,11 @@ setup_hs()
+ ip netns exec ${hsname} sysctl -wq net.ipv6.conf.all.accept_dad=0
+ ip netns exec ${hsname} sysctl -wq net.ipv6.conf.default.accept_dad=0
+
++ # disable the rp_filter otherwise the kernel gets confused about how
++ # to route decap ipv4 packets.
++ ip netns exec ${rtname} sysctl -wq net.ipv4.conf.all.rp_filter=0
++ ip netns exec ${rtname} sysctl -wq net.ipv4.conf.default.rp_filter=0
++
+ ip -netns ${hsname} link add veth0 type veth peer name ${rtveth}
+ ip -netns ${hsname} link set ${rtveth} netns ${rtname}
+ ip -netns ${hsname} addr add ${IPv6_HS_NETWORK}::${hs}/64 dev veth0 nodad
+@@ -316,11 +321,6 @@ setup_hs()
+ ip netns exec ${rtname} sysctl -wq net.ipv6.conf.${rtveth}.proxy_ndp=1
+ ip netns exec ${rtname} sysctl -wq net.ipv4.conf.${rtveth}.proxy_arp=1
+
+- # disable the rp_filter otherwise the kernel gets confused about how
+- # to route decap ipv4 packets.
+- ip netns exec ${rtname} sysctl -wq net.ipv4.conf.all.rp_filter=0
+- ip netns exec ${rtname} sysctl -wq net.ipv4.conf.${rtveth}.rp_filter=0
+-
+ ip netns exec ${rtname} sh -c "echo 1 > /proc/sys/net/vrf/strict_mode"
+ }
+
+--
+2.39.2
+
soc-qcom-llcc-do-not-create-edac-platform-device-on-.patch
mtd-spi-nor-spansion-enable-jffs2-write-buffer-for-i.patch-29548
fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lo.patch
+rdma-rxe-change-rxe_dbg-to-rxe_dbg_dev.patch
+rdma-rxe-extend-dbg-log-messages-to-err-and-info.patch
+asoc-intel-soc-acpi-byt-fix-wm510205-match-no-longer.patch
+scsi-ufs-core-mcq-fix-hwq-cq_lock-deadlock-issue.patch
+scsi-qedi-fix-use-after-free-bug-in-qedi_remove.patch
+arm64-fix-label-placement-in-record_mmu_state.patch
+drm-amd-display-add-missing-wa-and-mclk-validation.patch
+drm-amd-display-return-error-code-on-dsc-atomic-chec.patch
+drm-amd-display-fixes-for-dcn32_clk_mgr-implementati.patch
+drm-amd-display-reset-outbox0-r-w-pointer-on-dmub-re.patch
+drm-amd-display-do-not-clear-gpint-register-when-rel.patch
+drm-amd-display-update-bounding-box-values-for-dcn32.patch
+rxrpc-fix-potential-data-race-in-rxrpc_wait_to_be_co.patch
+net-sched-flower-fix-wrong-handle-assignment-during-.patch
+ixgbe-fix-panic-during-xdp_tx-with-64-cpus.patch
+octeonxt2-af-mcs-fix-per-port-bypass-config.patch
+octeontx2-af-mcs-write-tcam_data-and-tcam_mask-regis.patch
+octeontx2-af-mcs-config-parser-to-skip-8b-header.patch
+octeontx2-af-mcs-fix-mcs-block-interrupt.patch
+octeontx2-pf-mcs-fix-null-pointer-dereferences.patch
+octeontx2-pf-mcs-match-macsec-ethertype-along-with-d.patch
+octeontx2-pf-mcs-clear-stats-before-freeing-resource.patch
+octeontx2-pf-mcs-fix-shared-counters-logic.patch
+octeontx2-pf-mcs-do-not-reset-pn-while-updating-secy.patch
+net-ncsi-clear-tx-enable-mode-when-handling-a-config.patch
+tcp-fix-skb_copy_ubufs-vs-big-tcp.patch
+net-sched-cls_api-remove-block_cb-from-driver_list-b.patch
+sit-update-dev-needed_headroom-in-ipip6_tunnel_bind_.patch
+selftests-srv6-make-srv6_end_dt46_l3vpn_test-more-ro.patch
+net-ipv6-fix-skb-hash-for-some-rst-packets.patch
+net-dsa-mv88e6xxx-add-mv88e6321-rsvd2cpu.patch
+writeback-fix-call-of-incorrect-macro.patch
+block-skip-destroyed-blkg-when-restart-in-blkg_destr.patch
+watchdog-dw_wdt-fix-the-error-handling-path-of-dw_wd.patch
+risc-v-mm-enable-huge-page-support-to-kernel_page_pr.patch
+i2c-tegra-fix-pec-support-for-smbus-block-read.patch
+net-sched-act_mirred-add-carrier-check.patch
+r8152-fix-flow-control-issue-of-rtl8156a.patch
+r8152-fix-the-poor-throughput-for-2.5g-devices.patch
+r8152-move-setting-r8153b_rx_agg_chg_indicate.patch
+sfc-fix-module-eeprom-reporting-for-qsfp-modules.patch
+rxrpc-fix-hard-call-timeout-units.patch
+rxrpc-make-it-so-that-a-waiting-process-can-be-abort.patch
+rxrpc-fix-timeout-of-a-call-that-hasn-t-yet-been-gra.patch
+riscv-compat_syscall_table-fixup-compile-warning.patch
+arm64-kernel-remove-shf_write-shf_execinstr-from-.id.patch
+net-ethernet-mtk_eth_soc-drop-generic-vlan-rx-offloa.patch
+drm-i915-guc-more-debug-print-updates-uc-firmware.patch
+drm-i915-guc-actually-return-an-error-if-guc-version.patch
+drm-i915-mtl-add-the-missing-cpu-transcoder-mask-in-.patch
+netfilter-nf_tables-extended-netlink-error-reporting.patch
+netfilter-nf_tables-rename-function-to-destroy-hook-.patch
+netfilter-nf_tables-support-for-adding-new-devices-t.patch
+netfilter-nf_tables-hit-enoent-on-unexisting-chain-f.patch
+selftests-netfilter-fix-libmnl-pkg-config-usage.patch
+octeontx2-af-secure-apr-table-update-with-the-lock.patch
+octeontx2-af-fix-start-and-end-bit-for-scan-config.patch
+octeontx2-af-fix-depth-of-cam-and-mem-table.patch
+octeontx2-pf-increase-the-size-of-dmac-filter-flows.patch
+octeontx2-af-add-validation-for-lmac-type.patch
+octeontx2-af-update-correct-mask-to-filter-ipv4-frag.patch
+octeontx2-af-update-fix-npc-field-hash-extract-featu.patch
+octeontx2-af-fix-issues-with-npc-field-hash-extract.patch
+octeontx2-af-skip-pfs-if-not-enabled.patch
+octeontx2-pf-disable-packet-i-o-for-graceful-exit.patch
+octeontx2-vf-detach-lf-resources-on-probe-cleanup.patch
+ionic-remove-noise-from-ethtool-rxnfc-error-msg.patch
+r8152-fix-the-autosuspend-doesn-t-work.patch
+ethtool-fix-uninitialized-number-of-lanes.patch
+ionic-catch-failure-from-devlink_alloc.patch
+af_packet-don-t-send-zero-byte-data-in-packet_sendms.patch
+netfilter-nf_tables-fix-ct-untracked-match-breakage.patch
+i2c-gxp-fix-build-failure-without-config_i2c_slave.patch
+ublk-add-timeout-handler.patch
+drm-amdgpu-add-a-missing-lock-for-amdgpu_sched.patch
+alsa-caiaq-input-add-error-handling-for-unsupported-.patch
+kvm-s390-pv-fix-asynchronous-teardown-for-small-vms.patch
+kvm-s390-fix-race-in-gmap_make_secure.patch
+dt-bindings-perf-riscv-pmu-fix-property-dependencies.patch
+net-dsa-mt7530-fix-corrupt-frames-using-trgmii-on-40.patch
+net-dsa-mt7530-split-off-common-parts-from-mt7531_se.patch
+net-dsa-mt7530-fix-network-connectivity-with-multipl.patch
+ice-block-lan-in-case-of-vf-to-vf-offload.patch
+virtio_net-suppress-cpu-stall-when-free_unused_bufs.patch
+net-enetc-check-the-index-of-the-sfi-rather-than-the.patch
+net-fec-correct-the-counting-of-xdp-sent-frames.patch
+net-sched-flower-fix-filter-idr-initialization.patch
+net-sched-flower-fix-error-handler-on-replace.patch
+net-bcmgenet-remove-phy_stop-from-bcmgenet_netif_sto.patch
+perf-record-fix-read-lost-count-failed-msg-with-samp.patch
+perf-lock-contention-fix-compiler-builtin-detection.patch
+perf-build-support-python-perf.so-testing.patch
+perf-test-fix-pmu-event-table-sanity-for-no_jevents-.patch
+perf-scripts-intel-pt-events.py-fix-ipc-output-for-p.patch
+perf-script-fix-python-support-when-no-libtraceevent.patch
+perf-test-fix-wrong-size-expectation-for-setup-struc.patch
+perf-hist-improve-srcfile-sort-key-performance-reall.patch
+perf-vendor-events-s390-remove-utf-8-characters-from.patch
+perf-tests-record_offcpu.sh-fix-redirection-of-stder.patch
+perf-ftrace-make-system-wide-the-default-target-for-.patch
+perf-vendor-events-power9-remove-utf-8-characters-fr.patch
+perf-symbols-fix-use-after-free-in-get_plt_got_name.patch
+perf-symbols-fix-unaligned-access-in-get_x86_64_plt_.patch
+perf-pmu-zfree-expects-a-pointer-to-a-pointer-to-zer.patch
+perf-map-delete-two-variable-initialisations-before-.patch
+perf-cs-etm-fix-timeless-decode-mode-detection.patch
+crypto-sun8i-ss-fix-a-test-in-sun8i_ss_setup_ivs.patch
+crypto-engine-fix-crypto_queue-backlog-handling.patch
+perf-symbols-fix-return-incorrect-build_id-size-in-e.patch
+perf-tracepoint-fix-memory-leak-in-is_valid_tracepoi.patch
+perf-stat-separate-bperf-from-bpf_profiler.patch
--- /dev/null
+From 669a32281ca8af8917bc52eeb7bcb5eaaa3df883 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 12:33:33 +0100
+Subject: sfc: Fix module EEPROM reporting for QSFP modules
+
+From: Andy Moreton <andy.moreton@amd.com>
+
+[ Upstream commit 281900a923d4c50df109b52a22ae3cdac150159b ]
+
+The sfc driver does not report QSFP module EEPROM contents correctly
+as only the first page is fetched from hardware.
+
+Commit 0e1a2a3e6e7d ("ethtool: Add SFF-8436 and SFF-8636 max EEPROM
+length definitions") added ETH_MODULE_SFF_8436_MAX_LEN for the overall
+size of the EEPROM info, so use that to report the full EEPROM contents.
+
+Fixes: 9b17010da57a ("sfc: Add ethtool -m support for QSFP modules")
+Signed-off-by: Andy Moreton <andy.moreton@amd.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/mcdi_port_common.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/sfc/mcdi_port_common.c b/drivers/net/ethernet/sfc/mcdi_port_common.c
+index 899cc16710048..0ab14f3d01d4d 100644
+--- a/drivers/net/ethernet/sfc/mcdi_port_common.c
++++ b/drivers/net/ethernet/sfc/mcdi_port_common.c
+@@ -972,12 +972,15 @@ static u32 efx_mcdi_phy_module_type(struct efx_nic *efx)
+
+ /* A QSFP+ NIC may actually have an SFP+ module attached.
+ * The ID is page 0, byte 0.
++ * QSFP28 is of type SFF_8636, however, this is treated
++ * the same by ethtool, so we can also treat them the same.
+ */
+ switch (efx_mcdi_phy_get_module_eeprom_byte(efx, 0, 0)) {
+- case 0x3:
++ case 0x3: /* SFP */
+ return MC_CMD_MEDIA_SFP_PLUS;
+- case 0xc:
+- case 0xd:
++ case 0xc: /* QSFP */
++ case 0xd: /* QSFP+ */
++ case 0x11: /* QSFP28 */
+ return MC_CMD_MEDIA_QSFP_PLUS;
+ default:
+ return 0;
+@@ -1075,7 +1078,7 @@ int efx_mcdi_phy_get_module_info(struct efx_nic *efx, struct ethtool_modinfo *mo
+
+ case MC_CMD_MEDIA_QSFP_PLUS:
+ modinfo->type = ETH_MODULE_SFF_8436;
+- modinfo->eeprom_len = ETH_MODULE_SFF_8436_LEN;
++ modinfo->eeprom_len = ETH_MODULE_SFF_8436_MAX_LEN;
+ break;
+
+ default:
+--
+2.39.2
+
--- /dev/null
+From 6df676b5204dc640c43e51c4e55a0d10b8f2a8a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 23:00:06 -0700
+Subject: sit: update dev->needed_headroom in ipip6_tunnel_bind_dev()
+
+From: Cong Wang <cong.wang@bytedance.com>
+
+[ Upstream commit c88f8d5cd95fd039cff95d682b8e71100c001df0 ]
+
+When a tunnel device is bound with the underlying device, its
+dev->needed_headroom needs to be updated properly. IPv4 tunnels
+already do the same in ip_tunnel_bind_dev(). Otherwise we may
+not have enough header room for skb, especially after commit
+b17f709a2401 ("gue: TX support for using remote checksum offload option").
+
+Fixes: 32b8a8e59c9c ("sit: add IPv4 over IPv4 support")
+Reported-by: Palash Oswal <oswalpalash@gmail.com>
+Link: https://lore.kernel.org/netdev/CAGyP=7fDcSPKu6nttbGwt7RXzE3uyYxLjCSE97J64pRxJP8jPA@mail.gmail.com/
+Cc: Kuniyuki Iwashima <kuniyu@amazon.com>
+Cc: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Cong Wang <cong.wang@bytedance.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/sit.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 70d81bba50939..3ffb6a5b1f82a 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1095,12 +1095,13 @@ static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb,
+
+ static void ipip6_tunnel_bind_dev(struct net_device *dev)
+ {
++ struct ip_tunnel *tunnel = netdev_priv(dev);
++ int t_hlen = tunnel->hlen + sizeof(struct iphdr);
+ struct net_device *tdev = NULL;
+- struct ip_tunnel *tunnel;
++ int hlen = LL_MAX_HEADER;
+ const struct iphdr *iph;
+ struct flowi4 fl4;
+
+- tunnel = netdev_priv(dev);
+ iph = &tunnel->parms.iph;
+
+ if (iph->daddr) {
+@@ -1123,14 +1124,15 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
+ tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link);
+
+ if (tdev && !netif_is_l3_master(tdev)) {
+- int t_hlen = tunnel->hlen + sizeof(struct iphdr);
+ int mtu;
+
+ mtu = tdev->mtu - t_hlen;
+ if (mtu < IPV6_MIN_MTU)
+ mtu = IPV6_MIN_MTU;
+ WRITE_ONCE(dev->mtu, mtu);
++ hlen = tdev->hard_header_len + tdev->needed_headroom;
+ }
++ dev->needed_headroom = t_hlen + hlen;
+ }
+
+ static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p,
+--
+2.39.2
+
--- /dev/null
+From 798d4e35cc3ea047edbced56c41ffd895fabf020 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 04:32:31 +0000
+Subject: tcp: fix skb_copy_ubufs() vs BIG TCP
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 7e692df3933628d974acb9f5b334d2b3e885e2a6 ]
+
+David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy
+using hugepages, and skb length bigger than ~68 KB.
+
+skb_copy_ubufs() assumed it could copy all payload using up to
+MAX_SKB_FRAGS order-0 pages.
+
+This assumption broke when BIG TCP was able to put up to 512 KB per skb.
+
+We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45
+and limit gso_max_size to 180000.
+
+A solution is to use higher order pages if needed.
+
+v2: add missing __GFP_COMP, or we leak memory.
+
+Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536")
+Reported-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/netdev/c70000f6-baa4-4a05-46d0-4b3e0dc1ccc8@gmail.com/T/
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Xin Long <lucien.xin@gmail.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Cc: Coco Li <lixiaoyan@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skbuff.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 2f9bb98170ab0..14bb41aafee30 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -1705,7 +1705,7 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
+ {
+ int num_frags = skb_shinfo(skb)->nr_frags;
+ struct page *page, *head = NULL;
+- int i, new_frags;
++ int i, order, psize, new_frags;
+ u32 d_off;
+
+ if (skb_shared(skb) || skb_unclone(skb, gfp_mask))
+@@ -1714,9 +1714,17 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
+ if (!num_frags)
+ goto release;
+
+- new_frags = (__skb_pagelen(skb) + PAGE_SIZE - 1) >> PAGE_SHIFT;
++ /* We might have to allocate high order pages, so compute what minimum
++ * page order is needed.
++ */
++ order = 0;
++ while ((PAGE_SIZE << order) * MAX_SKB_FRAGS < __skb_pagelen(skb))
++ order++;
++ psize = (PAGE_SIZE << order);
++
++ new_frags = (__skb_pagelen(skb) + psize - 1) >> (PAGE_SHIFT + order);
+ for (i = 0; i < new_frags; i++) {
+- page = alloc_page(gfp_mask);
++ page = alloc_pages(gfp_mask | __GFP_COMP, order);
+ if (!page) {
+ while (head) {
+ struct page *next = (struct page *)page_private(head);
+@@ -1743,11 +1751,11 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
+ vaddr = kmap_atomic(p);
+
+ while (done < p_len) {
+- if (d_off == PAGE_SIZE) {
++ if (d_off == psize) {
+ d_off = 0;
+ page = (struct page *)page_private(page);
+ }
+- copy = min_t(u32, PAGE_SIZE - d_off, p_len - done);
++ copy = min_t(u32, psize - d_off, p_len - done);
+ memcpy(page_address(page) + d_off,
+ vaddr + p_off + done, copy);
+ done += copy;
+@@ -1763,7 +1771,7 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
+
+ /* skb frags point to kernel buffers */
+ for (i = 0; i < new_frags - 1; i++) {
+- __skb_fill_page_desc(skb, i, head, 0, PAGE_SIZE);
++ __skb_fill_page_desc(skb, i, head, 0, psize);
+ head = (struct page *)page_private(head);
+ }
+ __skb_fill_page_desc(skb, new_frags - 1, head, 0, d_off);
+--
+2.39.2
+
--- /dev/null
+From 2ed946d81bddef0378c308b627e089012ca82c53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 May 2023 10:42:31 +0800
+Subject: ublk: add timeout handler
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit c0b79b0ff53be5b05be98e3caaa6a39de1fe9520 ]
+
+Add timeout handler, so that we can provide forward progress guarantee for
+unprivileged ublk, which can't be trusted.
+
+One thing is that sync() calls sync_bdevs(wait) for all block devices after
+running sync_bdevs(no_wait), and if one device can't move on, the sync() won't
+return any more.
+
+Add timeout for unprivileged ublk to avoid such affect for other users which call
+sync() syscall.
+
+Meantime clear UBLK_F_USER_RECOVERY_REISSUE for unprivileged ublk since
+that feature may cause IO hang too.
+
+Fixes: 4093cb5a0634 ("ublk_drv: add mechanism for supporting unprivileged ublk device")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20230502024231.888498-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/ublk_drv.c | 31 +++++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
+index 604c1a13c76ef..41c35ab2c25a1 100644
+--- a/drivers/block/ublk_drv.c
++++ b/drivers/block/ublk_drv.c
+@@ -128,6 +128,7 @@ struct ublk_queue {
+ unsigned long io_addr; /* mapped vm address */
+ unsigned int max_io_sz;
+ bool force_abort;
++ bool timeout;
+ unsigned short nr_io_ready; /* how many ios setup */
+ struct ublk_device *dev;
+ struct ublk_io ios[];
+@@ -900,6 +901,22 @@ static void ublk_queue_cmd(struct ublk_queue *ubq, struct request *rq)
+ }
+ }
+
++static enum blk_eh_timer_return ublk_timeout(struct request *rq)
++{
++ struct ublk_queue *ubq = rq->mq_hctx->driver_data;
++
++ if (ubq->flags & UBLK_F_UNPRIVILEGED_DEV) {
++ if (!ubq->timeout) {
++ send_sig(SIGKILL, ubq->ubq_daemon, 0);
++ ubq->timeout = true;
++ }
++
++ return BLK_EH_DONE;
++ }
++
++ return BLK_EH_RESET_TIMER;
++}
++
+ static blk_status_t ublk_queue_rq(struct blk_mq_hw_ctx *hctx,
+ const struct blk_mq_queue_data *bd)
+ {
+@@ -959,6 +976,7 @@ static const struct blk_mq_ops ublk_mq_ops = {
+ .queue_rq = ublk_queue_rq,
+ .init_hctx = ublk_init_hctx,
+ .init_request = ublk_init_rq,
++ .timeout = ublk_timeout,
+ };
+
+ static int ublk_ch_open(struct inode *inode, struct file *filp)
+@@ -1721,6 +1739,18 @@ static int ublk_ctrl_add_dev(struct io_uring_cmd *cmd)
+ else if (!(info.flags & UBLK_F_UNPRIVILEGED_DEV))
+ return -EPERM;
+
++ /*
++ * unprivileged device can't be trusted, but RECOVERY and
++ * RECOVERY_REISSUE still may hang error handling, so can't
++ * support recovery features for unprivileged ublk now
++ *
++ * TODO: provide forward progress for RECOVERY handler, so that
++ * unprivileged device can benefit from it
++ */
++ if (info.flags & UBLK_F_UNPRIVILEGED_DEV)
++ info.flags &= ~(UBLK_F_USER_RECOVERY_REISSUE |
++ UBLK_F_USER_RECOVERY);
++
+ /* the created device is always owned by current user */
+ ublk_store_owner_uid_gid(&info.owner_uid, &info.owner_gid);
+
+@@ -1989,6 +2019,7 @@ static void ublk_queue_reinit(struct ublk_device *ub, struct ublk_queue *ubq)
+ put_task_struct(ubq->ubq_daemon);
+ /* We have to reset it to NULL, otherwise ub won't accept new FETCH_REQ */
+ ubq->ubq_daemon = NULL;
++ ubq->timeout = false;
+
+ for (i = 0; i < ubq->q_depth; i++) {
+ struct ublk_io *io = &ubq->ios[i];
+--
+2.39.2
+
--- /dev/null
+From af76b74394b857fdcc061f86114ada0db67d7b4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 10:27:06 +0800
+Subject: virtio_net: suppress cpu stall when free_unused_bufs
+
+From: Wenliang Wang <wangwenliang.1995@bytedance.com>
+
+[ Upstream commit f8bb5104394560e29017c25bcade4c6b7aabd108 ]
+
+For multi-queue and large ring-size use case, the following error
+occurred when free_unused_bufs:
+rcu: INFO: rcu_sched self-detected stall on CPU.
+
+Fixes: 986a4f4d452d ("virtio_net: multiqueue support")
+Signed-off-by: Wenliang Wang <wangwenliang.1995@bytedance.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index ea1bd4bb326d1..744bdc8a1abd2 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -3559,12 +3559,14 @@ static void free_unused_bufs(struct virtnet_info *vi)
+ struct virtqueue *vq = vi->sq[i].vq;
+ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL)
+ virtnet_sq_free_unused_buf(vq, buf);
++ cond_resched();
+ }
+
+ for (i = 0; i < vi->max_queue_pairs; i++) {
+ struct virtqueue *vq = vi->rq[i].vq;
+ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL)
+ virtnet_rq_free_unused_buf(vq, buf);
++ cond_resched();
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 045557cf62307122842075a7b570d8fcae8bd9f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Apr 2023 08:52:48 +0200
+Subject: watchdog: dw_wdt: Fix the error handling path of dw_wdt_drv_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 7f5390750645756bd5da2b24fac285f2654dd922 ]
+
+The commit in Fixes has only updated the remove function and missed the
+error handling path of the probe.
+
+Add the missing reset_control_assert() call.
+
+Fixes: 65a3b6935d92 ("watchdog: dw_wdt: get reset lines from dt")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/fbb650650bbb33a8fa2fd028c23157bedeed50e1.1682491863.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/dw_wdt.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/dw_wdt.c b/drivers/watchdog/dw_wdt.c
+index 462f15bd5ffa6..8e2ac522c945d 100644
+--- a/drivers/watchdog/dw_wdt.c
++++ b/drivers/watchdog/dw_wdt.c
+@@ -635,7 +635,7 @@ static int dw_wdt_drv_probe(struct platform_device *pdev)
+
+ ret = dw_wdt_init_timeouts(dw_wdt, dev);
+ if (ret)
+- goto out_disable_clk;
++ goto out_assert_rst;
+
+ wdd = &dw_wdt->wdd;
+ wdd->ops = &dw_wdt_ops;
+@@ -667,12 +667,15 @@ static int dw_wdt_drv_probe(struct platform_device *pdev)
+
+ ret = watchdog_register_device(wdd);
+ if (ret)
+- goto out_disable_pclk;
++ goto out_assert_rst;
+
+ dw_wdt_dbgfs_init(dw_wdt);
+
+ return 0;
+
++out_assert_rst:
++ reset_control_assert(dw_wdt->rst);
++
+ out_disable_pclk:
+ clk_disable_unprepare(dw_wdt->pclk);
+
+--
+2.39.2
+
--- /dev/null
+From bf3c186aa318d3d7361e21f71c3d7d45309366f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 13:44:43 +0300
+Subject: writeback: fix call of incorrect macro
+
+From: Maxim Korotkov <korotkov.maxim.s@gmail.com>
+
+[ Upstream commit 3e46c89c74f2c38e5337d2cf44b0b551adff1cb4 ]
+
+ the variable 'history' is of type u16, it may be an error
+ that the hweight32 macro was used for it
+ I guess macro hweight16 should be used
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 2a81490811d0 ("writeback: implement foreign cgroup inode detection")
+Signed-off-by: Maxim Korotkov <korotkov.maxim.s@gmail.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230119104443.3002-1-korotkov.maxim.s@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fs-writeback.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 1db3e3c24b43a..ae4e51e91ee33 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -829,7 +829,7 @@ void wbc_detach_inode(struct writeback_control *wbc)
+ * is okay. The main goal is avoiding keeping an inode on
+ * the wrong wb for an extended period of time.
+ */
+- if (hweight32(history) > WB_FRN_HIST_THR_SLOTS)
++ if (hweight16(history) > WB_FRN_HIST_THR_SLOTS)
+ inode_switch_wbs(inode, max_id);
+ }
+
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
