--- /dev/null
+From f46e4c9c81623da0eda57acbbd4e04af334a14be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Aug 2023 15:29:56 +0100
+Subject: ALSA: hda/realtek: Add quirks for HP G11 Laptops
+
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+
+[ Upstream commit fb8cce69e5e56eedb35fc4d77b2f099860965859 ]
+
+These HP G11 laptops use Realtek HDA codec combined with
+2xCS35L41 Amplifiers using SPI or I2C with External Boost.
+
+Laptop 103c8c26 has been removed as this has been replaced
+by this new series of laptops.
+
+Fixes: 3e10f6ca76c4 ("ALSA: hda/realtek: Add quirk for HP EliteBook G10 laptops")
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20230809142957.675933-2-sbinding@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 526ec8cae9437..de6bd8a9871cf 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9596,7 +9596,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x8b96, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+ SND_PCI_QUIRK(0x103c, 0x8b97, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+ SND_PCI_QUIRK(0x103c, 0x8bf0, "HP", ALC236_FIXUP_HP_GPIO_LED),
+- SND_PCI_QUIRK(0x103c, 0x8c26, "HP HP EliteBook 800G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8c46, "HP EliteBook 830 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8c47, "HP EliteBook 840 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8c48, "HP EliteBook 860 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8c49, "HP Elite x360 830 2-in-1 G11", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8c70, "HP EliteBook 835 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8c71, "HP EliteBook 845 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8c72, "HP EliteBook 865 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+--
+2.40.1
+
--- /dev/null
+From 81f2e09fa2fae85ec96e620ab994e7ab0df8d78f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Aug 2023 15:54:23 +0800
+Subject: ALSA: hda/realtek - Remodified 3k pull low procedure
+
+From: Kailang Yang <kailang@realtek.com>
+
+[ Upstream commit 46cdff2369cbdf8d78081a22526e77bd1323f563 ]
+
+Set spec->en_3kpull_low default to true.
+Then fillback ALC236 and ALC257 to false.
+
+Additional note: this addresses a regression caused by the previous
+fix 69ea4c9d02b7 ("ALSA: hda/realtek - remove 3k pull low procedure").
+The previous workaround was applied too widely without necessity,
+which resulted in the pop noise at PM again. This patch corrects the
+condition and restores the old behavior for the devices that don't
+suffer from the original problem.
+
+Fixes: 69ea4c9d02b7 ("ALSA: hda/realtek - remove 3k pull low procedure")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217732
+Link: https://lore.kernel.org/r/01e212a538fc407ca6edd10b81ff7b05@realtek.com
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index de6bd8a9871cf..aa475154c582f 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10620,6 +10620,7 @@ static int patch_alc269(struct hda_codec *codec)
+ spec = codec->spec;
+ spec->gen.shared_mic_vref_pin = 0x18;
+ codec->power_save_node = 0;
++ spec->en_3kpull_low = true;
+
+ #ifdef CONFIG_PM
+ codec->patch_ops.suspend = alc269_suspend;
+@@ -10702,14 +10703,16 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->shutup = alc256_shutup;
+ spec->init_hook = alc256_init;
+ spec->gen.mixer_nid = 0; /* ALC256 does not have any loopback mixer path */
+- if (codec->bus->pci->vendor == PCI_VENDOR_ID_AMD)
+- spec->en_3kpull_low = true;
++ if (codec->core.vendor_id == 0x10ec0236 &&
++ codec->bus->pci->vendor != PCI_VENDOR_ID_AMD)
++ spec->en_3kpull_low = false;
+ break;
+ case 0x10ec0257:
+ spec->codec_variant = ALC269_TYPE_ALC257;
+ spec->shutup = alc256_shutup;
+ spec->init_hook = alc256_init;
+ spec->gen.mixer_nid = 0;
++ spec->en_3kpull_low = false;
+ break;
+ case 0x10ec0215:
+ case 0x10ec0245:
+--
+2.40.1
+
--- /dev/null
+From a6255a3d1a41186c551b23d3f0d635a6abcd28f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Nov 2022 15:42:22 +0100
+Subject: ARM: dts: imx: align LED node names with dtschema
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 4b0d1f2738899dbcc7a026d826373530019aa31b ]
+
+The node names should be generic and DT schema expects certain pattern:
+
+ imx50-kobo-aura.dtb: gpio-leds: 'on' does not match any of the regexes: '(^led-[0-9a-f]$|led)', 'pinctrl-[0-9]+'
+ imx6dl-yapp4-draco.dtb: led-controller@30: 'chan@0', 'chan@1', 'chan@2' do not match any of the regexes: '^led@[0-8]$', '^multi-led@[0-8]$', 'pinctrl-[0-9]+'
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Stable-dep-of: 762b700982a1 ("ARM: dts: imx6: phytec: fix RTC interrupt level")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx50-kobo-aura.dts | 2 +-
+ arch/arm/boot/dts/imx53-cx9020.dts | 10 +++++-----
+ arch/arm/boot/dts/imx53-m53evk.dts | 4 ++--
+ arch/arm/boot/dts/imx53-m53menlo.dts | 6 +++---
+ arch/arm/boot/dts/imx53-tx53.dtsi | 2 +-
+ arch/arm/boot/dts/imx53-usbarmory.dts | 2 +-
+ arch/arm/boot/dts/imx6dl-b1x5pv2.dtsi | 6 +++---
+ arch/arm/boot/dts/imx6dl-riotboard.dts | 4 ++--
+ arch/arm/boot/dts/imx6dl-yapp4-common.dtsi | 6 +++---
+ arch/arm/boot/dts/imx6q-gw5400-a.dts | 6 +++---
+ arch/arm/boot/dts/imx6q-h100.dts | 6 +++---
+ arch/arm/boot/dts/imx6q-kp.dtsi | 4 ++--
+ arch/arm/boot/dts/imx6q-marsboard.dts | 4 ++--
+ arch/arm/boot/dts/imx6q-tbs2910.dts | 2 +-
+ arch/arm/boot/dts/imx6qdl-emcon.dtsi | 4 ++--
+ arch/arm/boot/dts/imx6qdl-gw51xx.dtsi | 4 ++--
+ arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 6 +++---
+ arch/arm/boot/dts/imx6qdl-gw53xx.dtsi | 6 +++---
+ arch/arm/boot/dts/imx6qdl-gw54xx.dtsi | 6 +++---
+ arch/arm/boot/dts/imx6qdl-gw551x.dtsi | 2 +-
+ arch/arm/boot/dts/imx6qdl-gw552x.dtsi | 6 +++---
+ arch/arm/boot/dts/imx6qdl-gw553x.dtsi | 4 ++--
+ arch/arm/boot/dts/imx6qdl-gw560x.dtsi | 6 +++---
+ arch/arm/boot/dts/imx6qdl-gw5903.dtsi | 2 +-
+ arch/arm/boot/dts/imx6qdl-gw5904.dtsi | 6 +++---
+ arch/arm/boot/dts/imx6qdl-gw5907.dtsi | 4 ++--
+ arch/arm/boot/dts/imx6qdl-gw5910.dtsi | 6 +++---
+ arch/arm/boot/dts/imx6qdl-gw5912.dtsi | 6 +++---
+ arch/arm/boot/dts/imx6qdl-gw5913.dtsi | 4 ++--
+ arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi | 10 +++++-----
+ arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi | 4 ++--
+ arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi | 6 +++---
+ arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 4 ++--
+ arch/arm/boot/dts/imx6qdl-rex.dtsi | 2 +-
+ arch/arm/boot/dts/imx6qdl-sabreauto.dtsi | 2 +-
+ arch/arm/boot/dts/imx6qdl-sabresd.dtsi | 2 +-
+ arch/arm/boot/dts/imx6qdl-ts7970.dtsi | 4 ++--
+ arch/arm/boot/dts/imx6qdl-tx6.dtsi | 2 +-
+ arch/arm/boot/dts/imx6sl-evk.dts | 2 +-
+ arch/arm/boot/dts/imx6sll-evk.dts | 2 +-
+ arch/arm/boot/dts/imx6sx-sabreauto.dts | 2 +-
+ arch/arm/boot/dts/imx6sx-udoo-neo.dtsi | 4 ++--
+ arch/arm/boot/dts/imx6ul-phytec-phycore-som.dtsi | 2 +-
+ arch/arm/boot/dts/imx6ul-tx6ul.dtsi | 2 +-
+ 44 files changed, 93 insertions(+), 93 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx50-kobo-aura.dts b/arch/arm/boot/dts/imx50-kobo-aura.dts
+index 51bf6117fb124..467db6b4ed7f8 100644
+--- a/arch/arm/boot/dts/imx50-kobo-aura.dts
++++ b/arch/arm/boot/dts/imx50-kobo-aura.dts
+@@ -26,7 +26,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_leds>;
+
+- on {
++ led-on {
+ label = "kobo_aura:orange:on";
+ gpios = <&gpio6 24 GPIO_ACTIVE_LOW>;
+ panic-indicator;
+diff --git a/arch/arm/boot/dts/imx53-cx9020.dts b/arch/arm/boot/dts/imx53-cx9020.dts
+index cfb18849a92b4..055d23a9aee7c 100644
+--- a/arch/arm/boot/dts/imx53-cx9020.dts
++++ b/arch/arm/boot/dts/imx53-cx9020.dts
+@@ -86,27 +86,27 @@
+ leds {
+ compatible = "gpio-leds";
+
+- pwr-r {
++ led-pwr-r {
+ gpios = <&gpio3 22 GPIO_ACTIVE_HIGH>;
+ default-state = "off";
+ };
+
+- pwr-g {
++ led-pwr-g {
+ gpios = <&gpio3 24 GPIO_ACTIVE_HIGH>;
+ default-state = "on";
+ };
+
+- pwr-b {
++ led-pwr-b {
+ gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
+ default-state = "off";
+ };
+
+- sd1-b {
++ led-sd1-b {
+ linux,default-trigger = "mmc0";
+ gpios = <&gpio3 20 GPIO_ACTIVE_HIGH>;
+ };
+
+- sd2-b {
++ led-sd2-b {
+ linux,default-trigger = "mmc1";
+ gpios = <&gpio3 17 GPIO_ACTIVE_HIGH>;
+ };
+diff --git a/arch/arm/boot/dts/imx53-m53evk.dts b/arch/arm/boot/dts/imx53-m53evk.dts
+index a1a6228d1aa66..2bd2432d317ff 100644
+--- a/arch/arm/boot/dts/imx53-m53evk.dts
++++ b/arch/arm/boot/dts/imx53-m53evk.dts
+@@ -52,13 +52,13 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&led_pin_gpio>;
+
+- user1 {
++ led-user1 {
+ label = "user1";
+ gpios = <&gpio2 8 0>;
+ linux,default-trigger = "heartbeat";
+ };
+
+- user2 {
++ led-user2 {
+ label = "user2";
+ gpios = <&gpio2 9 0>;
+ linux,default-trigger = "heartbeat";
+diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts
+index d5c68d1ea707c..4d77b6077fc1b 100644
+--- a/arch/arm/boot/dts/imx53-m53menlo.dts
++++ b/arch/arm/boot/dts/imx53-m53menlo.dts
+@@ -34,19 +34,19 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_led>;
+
+- user1 {
++ led-user1 {
+ label = "TestLed601";
+ gpios = <&gpio6 1 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "mmc0";
+ };
+
+- user2 {
++ led-user2 {
+ label = "TestLed602";
+ gpios = <&gpio6 2 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "heartbeat";
+ };
+
+- eth {
++ led-eth {
+ label = "EthLedYe";
+ gpios = <&gpio2 11 GPIO_ACTIVE_LOW>;
+ linux,default-trigger = "netdev";
+diff --git a/arch/arm/boot/dts/imx53-tx53.dtsi b/arch/arm/boot/dts/imx53-tx53.dtsi
+index 892dd1a4bac35..a439a47fb65ac 100644
+--- a/arch/arm/boot/dts/imx53-tx53.dtsi
++++ b/arch/arm/boot/dts/imx53-tx53.dtsi
+@@ -94,7 +94,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_stk5led>;
+
+- user {
++ led-user {
+ label = "Heartbeat";
+ gpios = <&gpio2 20 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "heartbeat";
+diff --git a/arch/arm/boot/dts/imx53-usbarmory.dts b/arch/arm/boot/dts/imx53-usbarmory.dts
+index f34993a490ee8..acc44010d5106 100644
+--- a/arch/arm/boot/dts/imx53-usbarmory.dts
++++ b/arch/arm/boot/dts/imx53-usbarmory.dts
+@@ -67,7 +67,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_led>;
+
+- user {
++ led-user {
+ label = "LED";
+ gpios = <&gpio4 27 GPIO_ACTIVE_LOW>;
+ linux,default-trigger = "heartbeat";
+diff --git a/arch/arm/boot/dts/imx6dl-b1x5pv2.dtsi b/arch/arm/boot/dts/imx6dl-b1x5pv2.dtsi
+index 337db29b0010a..37697fac9dea9 100644
+--- a/arch/arm/boot/dts/imx6dl-b1x5pv2.dtsi
++++ b/arch/arm/boot/dts/imx6dl-b1x5pv2.dtsi
+@@ -211,17 +211,17 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_q7_gpio1 &pinctrl_q7_gpio3 &pinctrl_q7_gpio5>;
+
+- alarm1 {
++ led-alarm1 {
+ label = "alarm:red";
+ gpios = <&gpio1 8 GPIO_ACTIVE_HIGH>;
+ };
+
+- alarm2 {
++ led-alarm2 {
+ label = "alarm:yellow";
+ gpios = <&gpio4 27 GPIO_ACTIVE_HIGH>;
+ };
+
+- alarm3 {
++ led-alarm3 {
+ label = "alarm:blue";
+ gpios = <&gpio4 15 GPIO_ACTIVE_HIGH>;
+ };
+diff --git a/arch/arm/boot/dts/imx6dl-riotboard.dts b/arch/arm/boot/dts/imx6dl-riotboard.dts
+index e7be05f205d32..24c7f535f63bd 100644
+--- a/arch/arm/boot/dts/imx6dl-riotboard.dts
++++ b/arch/arm/boot/dts/imx6dl-riotboard.dts
+@@ -25,14 +25,14 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_led>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio5 2 GPIO_ACTIVE_LOW>;
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio3 28 GPIO_ACTIVE_LOW>;
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
+index 52162e8c7274b..aacbf317feea6 100644
+--- a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
++++ b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
+@@ -274,7 +274,7 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+- chan@0 {
++ led@0 {
+ chan-name = "R";
+ led-cur = /bits/ 8 <0x20>;
+ max-cur = /bits/ 8 <0x60>;
+@@ -282,7 +282,7 @@
+ color = <LED_COLOR_ID_RED>;
+ };
+
+- chan@1 {
++ led@1 {
+ chan-name = "G";
+ led-cur = /bits/ 8 <0x20>;
+ max-cur = /bits/ 8 <0x60>;
+@@ -290,7 +290,7 @@
+ color = <LED_COLOR_ID_GREEN>;
+ };
+
+- chan@2 {
++ led@2 {
+ chan-name = "B";
+ led-cur = /bits/ 8 <0x20>;
+ max-cur = /bits/ 8 <0x60>;
+diff --git a/arch/arm/boot/dts/imx6q-gw5400-a.dts b/arch/arm/boot/dts/imx6q-gw5400-a.dts
+index e894faba571f9..522a51042965a 100644
+--- a/arch/arm/boot/dts/imx6q-gw5400-a.dts
++++ b/arch/arm/boot/dts/imx6q-gw5400-a.dts
+@@ -34,20 +34,20 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* 102 -> MX6_PANLEDG */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio4 10 GPIO_ACTIVE_HIGH>; /* 106 -> MX6_PANLEDR */
+ default-state = "off";
+ };
+
+- led2: user3 {
++ led2: led-user3 {
+ label = "user3";
+ gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* 111 -> MX6_LOCLED# */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6q-h100.dts b/arch/arm/boot/dts/imx6q-h100.dts
+index b8feadbff967d..6406ade14f57b 100644
+--- a/arch/arm/boot/dts/imx6q-h100.dts
++++ b/arch/arm/boot/dts/imx6q-h100.dts
+@@ -76,19 +76,19 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_h100_leds>;
+
+- led0: power {
++ led0: led-power {
+ label = "power";
+ gpios = <&gpio3 0 GPIO_ACTIVE_LOW>;
+ default-state = "on";
+ };
+
+- led1: stream {
++ led1: led-stream {
+ label = "stream";
+ gpios = <&gpio2 29 GPIO_ACTIVE_LOW>;
+ default-state = "off";
+ };
+
+- led2: rec {
++ led2: led-rec {
+ label = "rec";
+ gpios = <&gpio2 28 GPIO_ACTIVE_LOW>;
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6q-kp.dtsi b/arch/arm/boot/dts/imx6q-kp.dtsi
+index 1ade0bff681d6..5e0ed55600405 100644
+--- a/arch/arm/boot/dts/imx6q-kp.dtsi
++++ b/arch/arm/boot/dts/imx6q-kp.dtsi
+@@ -66,14 +66,14 @@
+ leds {
+ compatible = "gpio-leds";
+
+- green {
++ led-green {
+ label = "led1";
+ gpios = <&gpio3 16 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "gpio";
+ default-state = "off";
+ };
+
+- red {
++ led-red {
+ label = "led0";
+ gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "gpio";
+diff --git a/arch/arm/boot/dts/imx6q-marsboard.dts b/arch/arm/boot/dts/imx6q-marsboard.dts
+index cc18010023942..2c9961333b0a8 100644
+--- a/arch/arm/boot/dts/imx6q-marsboard.dts
++++ b/arch/arm/boot/dts/imx6q-marsboard.dts
+@@ -73,14 +73,14 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_led>;
+
+- user1 {
++ led-user1 {
+ label = "imx6:green:user1";
+ gpios = <&gpio5 2 GPIO_ACTIVE_LOW>;
+ default-state = "off";
+ linux,default-trigger = "heartbeat";
+ };
+
+- user2 {
++ led-user2 {
+ label = "imx6:green:user2";
+ gpios = <&gpio3 28 GPIO_ACTIVE_LOW>;
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6q-tbs2910.dts b/arch/arm/boot/dts/imx6q-tbs2910.dts
+index 8daef65d5bb35..2f576e2ce73f2 100644
+--- a/arch/arm/boot/dts/imx6q-tbs2910.dts
++++ b/arch/arm/boot/dts/imx6q-tbs2910.dts
+@@ -49,7 +49,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- blue {
++ led-blue {
+ label = "blue_status_led";
+ gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
+ default-state = "keep";
+diff --git a/arch/arm/boot/dts/imx6qdl-emcon.dtsi b/arch/arm/boot/dts/imx6qdl-emcon.dtsi
+index 7228b894a763f..ee2dd75cead6d 100644
+--- a/arch/arm/boot/dts/imx6qdl-emcon.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-emcon.dtsi
+@@ -46,14 +46,14 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_som_leds>;
+
+- green {
++ led-green {
+ label = "som:green";
+ gpios = <&gpio3 0 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "heartbeat";
+ default-state = "on";
+ };
+
+- red {
++ led-red {
+ label = "som:red";
+ gpios = <&gpio3 1 GPIO_ACTIVE_LOW>;
+ default-state = "keep";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
+index 069c27fab432c..e75e1a5364b85 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
+@@ -71,14 +71,14 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+index 728810b9d677d..47d9a8d08197d 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+@@ -80,20 +80,20 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
+ default-state = "off";
+ };
+
+- led2: user3 {
++ led2: led-user3 {
+ label = "user3";
+ gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
+index 6c0c109046d80..fb1d29abe0991 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
+@@ -80,20 +80,20 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
+ default-state = "off";
+ };
+
+- led2: user3 {
++ led2: led-user3 {
+ label = "user3";
+ gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
+index a9b04f9f1c2bc..4e20cb97058eb 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
+@@ -81,20 +81,20 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
+ default-state = "off";
+ };
+
+- led2: user3 {
++ led2: led-user3 {
+ label = "user3";
+ gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
+index 435dec6338fe6..0fa4b8eeddee7 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
+@@ -115,7 +115,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 7 GPIO_ACTIVE_LOW>;
+ default-state = "on";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw552x.dtsi b/arch/arm/boot/dts/imx6qdl-gw552x.dtsi
+index 2e61102ae6946..77ae611b817a4 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw552x.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw552x.dtsi
+@@ -72,20 +72,20 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
+ default-state = "off";
+ };
+
+- led2: user3 {
++ led2: led-user3 {
+ label = "user3";
+ gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw553x.dtsi b/arch/arm/boot/dts/imx6qdl-gw553x.dtsi
+index 4662408b225a5..7f16c602cc075 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw553x.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw553x.dtsi
+@@ -113,14 +113,14 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 10 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio4 11 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw560x.dtsi b/arch/arm/boot/dts/imx6qdl-gw560x.dtsi
+index 4b81a975c979d..46cf4080fec38 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw560x.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw560x.dtsi
+@@ -139,20 +139,20 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
+ default-state = "off";
+ };
+
+- led2: user3 {
++ led2: led-user3 {
+ label = "user3";
+ gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw5903.dtsi b/arch/arm/boot/dts/imx6qdl-gw5903.dtsi
+index 1fdb7ba630f1b..a74cde0501589 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw5903.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw5903.dtsi
+@@ -123,7 +123,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio6 14 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw5904.dtsi b/arch/arm/boot/dts/imx6qdl-gw5904.dtsi
+index 612b6e068e282..9fc79af2bc9aa 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw5904.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw5904.dtsi
+@@ -120,20 +120,20 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
+ default-state = "off";
+ };
+
+- led2: user3 {
++ led2: led-user3 {
+ label = "user3";
+ gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw5907.dtsi b/arch/arm/boot/dts/imx6qdl-gw5907.dtsi
+index fcd3bdfd61827..955a51226eda7 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw5907.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw5907.dtsi
+@@ -71,14 +71,14 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw5910.dtsi b/arch/arm/boot/dts/imx6qdl-gw5910.dtsi
+index 6bb4855d13ce5..218d6e667ed24 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw5910.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw5910.dtsi
+@@ -74,20 +74,20 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
+ default-state = "off";
+ };
+
+- led2: user3 {
++ led2: led-user3 {
+ label = "user3";
+ gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw5912.dtsi b/arch/arm/boot/dts/imx6qdl-gw5912.dtsi
+index 0415bcb416400..40e235e315cc4 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw5912.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw5912.dtsi
+@@ -72,20 +72,20 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
+ default-state = "off";
+ };
+
+- led2: user3 {
++ led2: led-user3 {
+ label = "user3";
+ gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; /* MX6_LOCLED# */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-gw5913.dtsi b/arch/arm/boot/dts/imx6qdl-gw5913.dtsi
+index 696427b487f01..82f47c295b085 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw5913.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw5913.dtsi
+@@ -71,14 +71,14 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- led0: user1 {
++ led0: led-user1 {
+ label = "user1";
+ gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDG */
+ default-state = "on";
+ linux,default-trigger = "heartbeat";
+ };
+
+- led1: user2 {
++ led1: led-user2 {
+ label = "user2";
+ gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>; /* MX6_PANLEDR */
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi b/arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi
+index a53a5d0766a51..6d4eab1942b94 100644
+--- a/arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-nit6xlite.dtsi
+@@ -85,31 +85,31 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_leds>;
+
+- j14-pin1 {
++ led-j14-pin1 {
+ gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
+ retain-state-suspended;
+ default-state = "off";
+ };
+
+- j14-pin3 {
++ led-j14-pin3 {
+ gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
+ retain-state-suspended;
+ default-state = "off";
+ };
+
+- j14-pins8-9 {
++ led-j14-pins8-9 {
+ gpios = <&gpio3 29 GPIO_ACTIVE_LOW>;
+ retain-state-suspended;
+ default-state = "off";
+ };
+
+- j46-pin2 {
++ led-j46-pin2 {
+ gpios = <&gpio1 7 GPIO_ACTIVE_LOW>;
+ retain-state-suspended;
+ default-state = "off";
+ };
+
+- j46-pin3 {
++ led-j46-pin3 {
+ gpios = <&gpio1 8 GPIO_ACTIVE_LOW>;
+ retain-state-suspended;
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
+index 57c21a01f126d..81a9a302aec1b 100644
+--- a/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
+@@ -181,13 +181,13 @@
+ leds {
+ compatible = "gpio-leds";
+
+- speaker-enable {
++ led-speaker-enable {
+ gpios = <&gpio1 29 GPIO_ACTIVE_HIGH>;
+ retain-state-suspended;
+ default-state = "off";
+ };
+
+- ttymxc4-rs232 {
++ led-ttymxc4-rs232 {
+ gpios = <&gpio6 10 GPIO_ACTIVE_HIGH>;
+ retain-state-suspended;
+ default-state = "on";
+diff --git a/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi
+index 120d6e997a4c5..1a599c294ab86 100644
+--- a/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi
+@@ -25,17 +25,17 @@
+ pinctrl-0 = <&pinctrl_gpioleds>;
+ status = "disabled";
+
+- red {
++ led-red {
+ label = "phyboard-mira:red";
+ gpios = <&gpio5 22 GPIO_ACTIVE_HIGH>;
+ };
+
+- green {
++ led-green {
+ label = "phyboard-mira:green";
+ gpios = <&gpio5 23 GPIO_ACTIVE_HIGH>;
+ };
+
+- blue {
++ led-blue {
+ label = "phyboard-mira:blue";
+ gpios = <&gpio5 24 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "mmc0";
+diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+index 768bc0e3a2b38..80adb2a02cc94 100644
+--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+@@ -47,12 +47,12 @@
+ pinctrl-0 = <&pinctrl_leds>;
+ compatible = "gpio-leds";
+
+- led_green: green {
++ led_green: led-green {
+ label = "phyflex:green";
+ gpios = <&gpio1 30 0>;
+ };
+
+- led_red: red {
++ led_red: led-red {
+ label = "phyflex:red";
+ gpios = <&gpio2 31 0>;
+ };
+diff --git a/arch/arm/boot/dts/imx6qdl-rex.dtsi b/arch/arm/boot/dts/imx6qdl-rex.dtsi
+index de514eb5aa99d..f804ff95a6ad6 100644
+--- a/arch/arm/boot/dts/imx6qdl-rex.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-rex.dtsi
+@@ -55,7 +55,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_led>;
+
+- led0: usr {
++ led0: led-usr {
+ label = "usr";
+ gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+index 3dbb460ef102e..10886a1461bfb 100644
+--- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+@@ -21,7 +21,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- user {
++ led-user {
+ label = "debug";
+ gpios = <&gpio5 15 GPIO_ACTIVE_HIGH>;
+ };
+diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+index 37482a9023fce..bcb83d52e26ed 100644
+--- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+@@ -130,7 +130,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_gpio_leds>;
+
+- red {
++ led-red {
+ gpios = <&gpio1 2 0>;
+ default-state = "on";
+ };
+diff --git a/arch/arm/boot/dts/imx6qdl-ts7970.dtsi b/arch/arm/boot/dts/imx6qdl-ts7970.dtsi
+index c096d25a6f5b5..1e0a041e9f60a 100644
+--- a/arch/arm/boot/dts/imx6qdl-ts7970.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-ts7970.dtsi
+@@ -73,13 +73,13 @@
+ default-state = "off";
+ };
+
+- en-usb-5v {
++ en-usb-5v-led {
+ label = "en-usb-5v";
+ gpios = <&gpio2 22 GPIO_ACTIVE_HIGH>;
+ default-state = "on";
+ };
+
+- sel_dc_usb {
++ sel-dc-usb-led {
+ label = "sel_dc_usb";
+ gpios = <&gpio5 17 GPIO_ACTIVE_HIGH>;
+ default-state = "off";
+diff --git a/arch/arm/boot/dts/imx6qdl-tx6.dtsi b/arch/arm/boot/dts/imx6qdl-tx6.dtsi
+index f41f86a76ea95..a197bac95cbac 100644
+--- a/arch/arm/boot/dts/imx6qdl-tx6.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-tx6.dtsi
+@@ -92,7 +92,7 @@
+ leds {
+ compatible = "gpio-leds";
+
+- user_led: user {
++ user_led: led-user {
+ label = "Heartbeat";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_user_led>;
+diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
+index f16c830f1e918..dc5d596c18db4 100644
+--- a/arch/arm/boot/dts/imx6sl-evk.dts
++++ b/arch/arm/boot/dts/imx6sl-evk.dts
+@@ -33,7 +33,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_led>;
+
+- user {
++ led-user {
+ label = "debug";
+ gpios = <&gpio3 20 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "heartbeat";
+diff --git a/arch/arm/boot/dts/imx6sll-evk.dts b/arch/arm/boot/dts/imx6sll-evk.dts
+index 32b3d82fec53c..269092ac881c5 100644
+--- a/arch/arm/boot/dts/imx6sll-evk.dts
++++ b/arch/arm/boot/dts/imx6sll-evk.dts
+@@ -37,7 +37,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_led>;
+
+- user {
++ led-user {
+ label = "debug";
+ gpios = <&gpio2 4 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "heartbeat";
+diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
+index 83ee97252ff11..b0c27b9b02446 100644
+--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
++++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
+@@ -20,7 +20,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_led>;
+
+- user {
++ led-user {
+ label = "debug";
+ gpios = <&gpio1 24 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "heartbeat";
+diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi b/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
+index c84ea1fac5e98..725d0b5cb55f6 100644
+--- a/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
++++ b/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
+@@ -15,14 +15,14 @@
+ leds {
+ compatible = "gpio-leds";
+
+- red {
++ led-red {
+ label = "udoo-neo:red:mmc";
+ gpios = <&gpio6 0 GPIO_ACTIVE_HIGH>;
+ default-state = "off";
+ linux,default-trigger = "mmc0";
+ };
+
+- orange {
++ led-orange {
+ label = "udoo-neo:orange:user";
+ gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>;
+ default-state = "keep";
+diff --git a/arch/arm/boot/dts/imx6ul-phytec-phycore-som.dtsi b/arch/arm/boot/dts/imx6ul-phytec-phycore-som.dtsi
+index 3cddc68917a08..e4d2652a75c0b 100644
+--- a/arch/arm/boot/dts/imx6ul-phytec-phycore-som.dtsi
++++ b/arch/arm/boot/dts/imx6ul-phytec-phycore-som.dtsi
+@@ -30,7 +30,7 @@
+ pinctrl-0 = <&pinctrl_gpioleds_som>;
+ compatible = "gpio-leds";
+
+- phycore-green {
++ led-phycore-green {
+ gpios = <&gpio5 4 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "heartbeat";
+ };
+diff --git a/arch/arm/boot/dts/imx6ul-tx6ul.dtsi b/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
+index 15ee0275feaff..70cef5e817bd1 100644
+--- a/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
+@@ -131,7 +131,7 @@
+ leds {
+ compatible = "gpio-leds";
+
+- user_led: user {
++ user_led: led-user {
+ label = "Heartbeat";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_led>;
+--
+2.40.1
+
--- /dev/null
+From b592d9ebcb28dea9752b26452dabb18dacd8a83d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jul 2023 15:57:47 +0800
+Subject: ARM: dts: imx: Set default tuning step for imx6sx usdhc
+
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+
+[ Upstream commit 0a2b96e42a0284c4fc03022236f656a085ca714a ]
+
+If the tuning step is not set, the tuning step is set to 1.
+For some sd cards, the following Tuning timeout will occur.
+
+Tuning failed, falling back to fixed sampling clock
+
+So set the default tuning step. This refers to the NXP vendor's
+commit below:
+
+https://github.com/nxp-imx/linux-imx/blob/lf-6.1.y/
+arch/arm/boot/dts/imx6sx.dtsi#L1108-L1109
+
+Fixes: 1e336aa0c025 ("mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting")
+Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6sx.dtsi | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
+index abc3572d699e6..1f1053a898fbf 100644
+--- a/arch/arm/boot/dts/imx6sx.dtsi
++++ b/arch/arm/boot/dts/imx6sx.dtsi
+@@ -981,6 +981,8 @@
+ <&clks IMX6SX_CLK_USDHC1>;
+ clock-names = "ipg", "ahb", "per";
+ bus-width = <4>;
++ fsl,tuning-start-tap = <20>;
++ fsl,tuning-step= <2>;
+ status = "disabled";
+ };
+
+@@ -993,6 +995,8 @@
+ <&clks IMX6SX_CLK_USDHC2>;
+ clock-names = "ipg", "ahb", "per";
+ bus-width = <4>;
++ fsl,tuning-start-tap = <20>;
++ fsl,tuning-step= <2>;
+ status = "disabled";
+ };
+
+@@ -1005,6 +1009,8 @@
+ <&clks IMX6SX_CLK_USDHC3>;
+ clock-names = "ipg", "ahb", "per";
+ bus-width = <4>;
++ fsl,tuning-start-tap = <20>;
++ fsl,tuning-step= <2>;
+ status = "disabled";
+ };
+
+--
+2.40.1
+
--- /dev/null
+From b7fcffbc25142cd3ab284a9ab7b898c99820b24c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jul 2023 13:43:26 +0200
+Subject: ARM: dts: imx6: phytec: fix RTC interrupt level
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andrej Picej <andrej.picej@norik.com>
+
+[ Upstream commit 762b700982a1e0f562184363f19860c3b9bdd0bf ]
+
+RTC interrupt level should be set to "LOW". This was revealed by the
+introduction of commit:
+
+ f181987ef477 ("rtc: m41t80: use IRQ flags obtained from fwnode")
+
+which changed the way IRQ type is obtained.
+
+Signed-off-by: Andrej Picej <andrej.picej@norik.com>
+Reviewed-by: Stefan Riedmüller <s.riedmueller@phytec.de>
+Fixes: 800d595151bb ("ARM: dts: imx6: Add initial support for phyBOARD-Mira")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi
+index 1a599c294ab86..1ca4d219609f6 100644
+--- a/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi
+@@ -182,7 +182,7 @@
+ pinctrl-0 = <&pinctrl_rtc_int>;
+ reg = <0x68>;
+ interrupt-parent = <&gpio7>;
+- interrupts = <8 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <8 IRQ_TYPE_LEVEL_LOW>;
+ status = "disabled";
+ };
+ };
+--
+2.40.1
+
--- /dev/null
+From 7498b27e1adbfb1419dfda652491825d1db76e64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jul 2023 20:26:28 -0300
+Subject: arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit f02b53375e8f14b4c27a14f6e4fb6e89914fdc29 ]
+
+The CSI1 PHY reference clock is limited to 125 MHz according to:
+i.MX 8M Mini Applications Processor Reference Manual, Rev. 3, 11/2020
+Table 5-1. Clock Root Table (continued) / page 307
+Slice Index n = 123 .
+
+Currently the IMX8MM_CLK_CSI1_PHY_REF clock is configured to be
+fed directly from 1 GHz PLL2 , which overclocks them. Instead, drop
+the configuration altogether, which defaults the clock to 24 MHz REF
+clock input, which for the PHY reference clock is just fine.
+
+Based on a patch from Marek Vasut for the imx8mn.
+
+Fixes: e523b7c54c05 ("arm64: dts: imx8mm: Add CSI nodes")
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Reviewed-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
+Reviewed-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm.dtsi | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+index 420ba0d6f1343..12c82bb1bb7aa 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+@@ -1145,10 +1145,9 @@
+ compatible = "fsl,imx8mm-mipi-csi2";
+ reg = <0x32e30000 0x1000>;
+ interrupts = <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>;
+- assigned-clocks = <&clk IMX8MM_CLK_CSI1_CORE>,
+- <&clk IMX8MM_CLK_CSI1_PHY_REF>;
+- assigned-clock-parents = <&clk IMX8MM_SYS_PLL2_1000M>,
+- <&clk IMX8MM_SYS_PLL2_1000M>;
++ assigned-clocks = <&clk IMX8MM_CLK_CSI1_CORE>;
++ assigned-clock-parents = <&clk IMX8MM_SYS_PLL2_1000M>;
++
+ clock-frequency = <333000000>;
+ clocks = <&clk IMX8MM_CLK_DISP_APB_ROOT>,
+ <&clk IMX8MM_CLK_CSI1_ROOT>,
+--
+2.40.1
+
--- /dev/null
+From 03fc43e4ba5da82da4cc82f62c1bd665d47a58ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jul 2023 10:34:35 +0200
+Subject: arm64: dts: imx93: Fix anatop node size
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 78e869dd8b2ba19765ac9b05cdea3e432d1dc188 ]
+
+Although the memory map of i.MX93 reference manual rev. 2 claims that
+analog top has start address of 0x44480000 and end address of 0x4448ffff,
+this overlaps with TMU memory area starting at 0x44482000, as stated in
+section 73.6.1.
+As PLL configuration registers start at addresses up to 0x44481400, as used
+by clk-imx93, reduce the anatop size to 0x2000, so exclude the TMU area
+but keep all PLL registers inside.
+
+Fixes: ec8b5b5058ea ("arm64: dts: freescale: Add i.MX93 dtsi support")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Jacky Bai <ping.bai@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi
+index 8ab9f8194702e..c2f60d41d6fd1 100644
+--- a/arch/arm64/boot/dts/freescale/imx93.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx93.dtsi
+@@ -254,7 +254,7 @@
+
+ anatop: anatop@44480000 {
+ compatible = "fsl,imx93-anatop", "syscon";
+- reg = <0x44480000 0x10000>;
++ reg = <0x44480000 0x2000>;
+ };
+ };
+
+--
+2.40.1
+
--- /dev/null
+From c9f270b68e65361bf3787c8353c71fb3af0aef40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jun 2023 16:12:24 +0300
+Subject: arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 798f1df86e5709b7b6aedf493cc04c7fedbf544a ]
+
+The commit 3a786086c6f8 ("arm64: dts: qcom: Add missing "-thermal"
+suffix for thermal zones") renamed the thermal zone in the pm8150l.dtsi
+file to comply with the schema. However this resulted in a clash with
+the RB5 board file, which already contained the pm8150l-thermal zone for
+the on-board sensor. This resulted in the board file definition
+overriding the thermal zone defined in the PMIC include file (and thus
+the on-die PMIC temp alarm was not probing at all).
+
+Rename the thermal zone in qcom/qrb5165-rb5.dts to remove this override.
+
+Fixes: 3a786086c6f8 ("arm64: dts: qcom: Add missing "-thermal" suffix for thermal zones")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230613131224.666668-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
+index bf8077a1cf9a7..9731a7c63d53b 100644
+--- a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
++++ b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
+@@ -121,7 +121,7 @@
+ };
+ };
+
+- pm8150l-thermal {
++ pm8150l-pcb-thermal {
+ polling-delay-passive = <0>;
+ polling-delay = <0>;
+ thermal-sensors = <&pm8150l_adc_tm 1>;
+--
+2.40.1
+
--- /dev/null
+From 87cdc0d45b49fb0690918036a2ee920af383609c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Jul 2023 15:42:55 +0100
+Subject: arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+
+
+From: Christopher Obbard <chris.obbard@collabora.com>
+
+[ Upstream commit 2bd1d2dd808c60532283e9cf05110bf1bf2f9079 ]
+
+There is some instablity with some eMMC modules on ROCK Pi 4 SBCs running
+in HS400 mode. This ends up resulting in some block errors after a while
+or after a "heavy" operation utilising the eMMC (e.g. resizing a
+filesystem). An example of these errors is as follows:
+
+ [ 289.171014] mmc1: running CQE recovery
+ [ 290.048972] mmc1: running CQE recovery
+ [ 290.054834] mmc1: running CQE recovery
+ [ 290.060817] mmc1: running CQE recovery
+ [ 290.061337] blk_update_request: I/O error, dev mmcblk1, sector 1411072 op 0x1:(WRITE) flags 0x800 phys_seg 36 prio class 0
+ [ 290.061370] EXT4-fs warning (device mmcblk1p1): ext4_end_bio:348: I/O error 10 writing to inode 29547 starting block 176466)
+ [ 290.061484] Buffer I/O error on device mmcblk1p1, logical block 172288
+ [ 290.061531] Buffer I/O error on device mmcblk1p1, logical block 172289
+ [ 290.061551] Buffer I/O error on device mmcblk1p1, logical block 172290
+ [ 290.061574] Buffer I/O error on device mmcblk1p1, logical block 172291
+ [ 290.061592] Buffer I/O error on device mmcblk1p1, logical block 172292
+ [ 290.061615] Buffer I/O error on device mmcblk1p1, logical block 172293
+ [ 290.061632] Buffer I/O error on device mmcblk1p1, logical block 172294
+ [ 290.061654] Buffer I/O error on device mmcblk1p1, logical block 172295
+ [ 290.061673] Buffer I/O error on device mmcblk1p1, logical block 172296
+ [ 290.061695] Buffer I/O error on device mmcblk1p1, logical block 172297
+
+Disabling the Command Queue seems to stop the CQE recovery from running,
+but doesn't seem to improve the I/O errors. Until this can be investigated
+further, disable HS400 mode on the ROCK Pi 4 SBCs to at least stop I/O
+errors from occurring.
+
+Fixes: 246450344dad ("arm64: dts: rockchip: rk3399: Radxa ROCK 4C+")
+Signed-off-by: Christopher Obbard <chris.obbard@collabora.com>
+Link: https://lore.kernel.org/r/20230705144255.115299-3-chris.obbard@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts b/arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts
+index f9884902f8745..c3f53aa1ea4ac 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts
+@@ -548,9 +548,8 @@
+ &sdhci {
+ max-frequency = <150000000>;
+ bus-width = <8>;
+- mmc-hs400-1_8v;
++ mmc-hs200-1_8v;
+ non-removable;
+- mmc-hs400-enhanced-strobe;
+ status = "okay";
+ };
+
+--
+2.40.1
+
--- /dev/null
+From 4dd4afad975f575a66f1fac613c4d17776dc0193 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Jul 2023 15:42:54 +0100
+Subject: arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
+
+From: Christopher Obbard <chris.obbard@collabora.com>
+
+[ Upstream commit cee572756aa2cb46e959e9797ad4b730b78a050b ]
+
+There is some instablity with some eMMC modules on ROCK Pi 4 SBCs running
+in HS400 mode. This ends up resulting in some block errors after a while
+or after a "heavy" operation utilising the eMMC (e.g. resizing a
+filesystem). An example of these errors is as follows:
+
+ [ 289.171014] mmc1: running CQE recovery
+ [ 290.048972] mmc1: running CQE recovery
+ [ 290.054834] mmc1: running CQE recovery
+ [ 290.060817] mmc1: running CQE recovery
+ [ 290.061337] blk_update_request: I/O error, dev mmcblk1, sector 1411072 op 0x1:(WRITE) flags 0x800 phys_seg 36 prio class 0
+ [ 290.061370] EXT4-fs warning (device mmcblk1p1): ext4_end_bio:348: I/O error 10 writing to inode 29547 starting block 176466)
+ [ 290.061484] Buffer I/O error on device mmcblk1p1, logical block 172288
+ [ 290.061531] Buffer I/O error on device mmcblk1p1, logical block 172289
+ [ 290.061551] Buffer I/O error on device mmcblk1p1, logical block 172290
+ [ 290.061574] Buffer I/O error on device mmcblk1p1, logical block 172291
+ [ 290.061592] Buffer I/O error on device mmcblk1p1, logical block 172292
+ [ 290.061615] Buffer I/O error on device mmcblk1p1, logical block 172293
+ [ 290.061632] Buffer I/O error on device mmcblk1p1, logical block 172294
+ [ 290.061654] Buffer I/O error on device mmcblk1p1, logical block 172295
+ [ 290.061673] Buffer I/O error on device mmcblk1p1, logical block 172296
+ [ 290.061695] Buffer I/O error on device mmcblk1p1, logical block 172297
+
+Disabling the Command Queue seems to stop the CQE recovery from running,
+but doesn't seem to improve the I/O errors. Until this can be investigated
+further, disable HS400 mode on the ROCK Pi 4 SBCs to at least stop I/O
+errors from occurring.
+
+While we are here, set the eMMC maximum clock frequency to 1.5MHz to
+follow the ROCK 4C+.
+
+Fixes: 1b5715c602fd ("arm64: dts: rockchip: add ROCK Pi 4 DTS support")
+Signed-off-by: Christopher Obbard <chris.obbard@collabora.com>
+Tested-By: Folker Schwesinger <dev@folker-schwesinger.de>
+Link: https://lore.kernel.org/r/20230705144255.115299-2-chris.obbard@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
+index 1f76d3501bda3..24fbb06007f94 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
+@@ -645,9 +645,9 @@
+ };
+
+ &sdhci {
++ max-frequency = <150000000>;
+ bus-width = <8>;
+- mmc-hs400-1_8v;
+- mmc-hs400-enhanced-strobe;
++ mmc-hs200-1_8v;
+ non-removable;
+ status = "okay";
+ };
+--
+2.40.1
+
--- /dev/null
+From d2383ad45ae48a0d0315b369c78a1ec5bf81e719 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Aug 2023 19:19:31 +0200
+Subject: ASoC: meson: axg-tdm-formatter: fix channel slot allocation
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit c1f848f12103920ca165758aedb1c10904e193e1 ]
+
+When the tdm lane mask is computed, the driver currently fills the 1st lane
+before moving on to the next. If the stream has less channels than the
+lanes can accommodate, slots will be disabled on the last lanes.
+
+Unfortunately, the HW distribute channels in a different way. It distribute
+channels in pair on each lanes before moving on the next slots.
+
+This difference leads to problems if a device has an interface with more
+than 1 lane and with more than 2 slots per lane.
+
+For example: a playback interface with 2 lanes and 4 slots each (total 8
+slots - zero based numbering)
+- Playing a 8ch stream:
+ - All slots activated by the driver
+ - channel #2 will be played on lane #1 - slot #0 following HW placement
+- Playing a 4ch stream:
+ - Lane #1 disabled by the driver
+ - channel #2 will be played on lane #0 - slot #2
+
+This behaviour is obviously not desirable.
+
+Change the way slots are activated on the TDM lanes to follow what the HW
+does and make sure each channel always get mapped to the same slot/lane.
+
+Fixes: 1a11d88f499c ("ASoC: meson: add tdm formatter base driver")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20230809171931.1244502-1-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/axg-tdm-formatter.c | 42 ++++++++++++++++++-----------
+ 1 file changed, 26 insertions(+), 16 deletions(-)
+
+diff --git a/sound/soc/meson/axg-tdm-formatter.c b/sound/soc/meson/axg-tdm-formatter.c
+index 9883dc777f630..63333a2b0a9c3 100644
+--- a/sound/soc/meson/axg-tdm-formatter.c
++++ b/sound/soc/meson/axg-tdm-formatter.c
+@@ -30,27 +30,32 @@ int axg_tdm_formatter_set_channel_masks(struct regmap *map,
+ struct axg_tdm_stream *ts,
+ unsigned int offset)
+ {
+- unsigned int val, ch = ts->channels;
+- unsigned long mask;
+- int i, j;
++ unsigned int ch = ts->channels;
++ u32 val[AXG_TDM_NUM_LANES];
++ int i, j, k;
++
++ /*
++ * We need to mimick the slot distribution used by the HW to keep the
++ * channel placement consistent regardless of the number of channel
++ * in the stream. This is why the odd algorithm below is used.
++ */
++ memset(val, 0, sizeof(*val) * AXG_TDM_NUM_LANES);
+
+ /*
+ * Distribute the channels of the stream over the available slots
+- * of each TDM lane
++ * of each TDM lane. We need to go over the 32 slots ...
+ */
+- for (i = 0; i < AXG_TDM_NUM_LANES; i++) {
+- val = 0;
+- mask = ts->mask[i];
+-
+- for (j = find_first_bit(&mask, 32);
+- (j < 32) && ch;
+- j = find_next_bit(&mask, 32, j + 1)) {
+- val |= 1 << j;
+- ch -= 1;
++ for (i = 0; (i < 32) && ch; i += 2) {
++ /* ... of all the lanes ... */
++ for (j = 0; j < AXG_TDM_NUM_LANES; j++) {
++ /* ... then distribute the channels in pairs */
++ for (k = 0; k < 2; k++) {
++ if ((BIT(i + k) & ts->mask[j]) && ch) {
++ val[j] |= BIT(i + k);
++ ch -= 1;
++ }
++ }
+ }
+-
+- regmap_write(map, offset, val);
+- offset += regmap_get_reg_stride(map);
+ }
+
+ /*
+@@ -63,6 +68,11 @@ int axg_tdm_formatter_set_channel_masks(struct regmap *map,
+ return -EINVAL;
+ }
+
++ for (i = 0; i < AXG_TDM_NUM_LANES; i++) {
++ regmap_write(map, offset, val[i]);
++ offset += regmap_get_reg_stride(map);
++ }
++
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(axg_tdm_formatter_set_channel_masks);
+--
+2.40.1
+
--- /dev/null
+From 34cb91de6167ba6f3be5e64268401fd013e617d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Aug 2023 23:59:11 +0800
+Subject: ASoC: rt5665: add missed regulator_bulk_disable
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit c163108e706909570f8aa9aa5bcf6806e2b4c98c ]
+
+The driver forgets to call regulator_bulk_disable()
+
+Add the missed call to fix it.
+
+Fixes: 33ada14a26c8 ("ASoC: add rt5665 codec driver")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Link: https://lore.kernel.org/r/tencent_A560D01E3E0A00A85A12F137E4B5205B3508@qq.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5665.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5665.c b/sound/soc/codecs/rt5665.c
+index 6e66cc218fa8d..76ff097518c88 100644
+--- a/sound/soc/codecs/rt5665.c
++++ b/sound/soc/codecs/rt5665.c
+@@ -4472,6 +4472,8 @@ static void rt5665_remove(struct snd_soc_component *component)
+ struct rt5665_priv *rt5665 = snd_soc_component_get_drvdata(component);
+
+ regmap_write(rt5665->regmap, RT5665_RESET, 0);
++
++ regulator_bulk_disable(ARRAY_SIZE(rt5665->supplies), rt5665->supplies);
+ }
+
+ #ifdef CONFIG_PM
+--
+2.40.1
+
--- /dev/null
+From 9e9e345d2d9dee8f82e85ddf8d47cfd712688b3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jun 2023 10:18:23 +0300
+Subject: bus: ti-sysc: Flush posted write on enable before reset
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 34539b442b3bc7d5bf10164750302b60b91f18a7 ]
+
+The am335x devices started producing boot errors for resetting musb module
+in because of subtle timing changes:
+
+Unhandled fault: external abort on non-linefetch (0x1008)
+...
+sysc_poll_reset_sysconfig from sysc_reset+0x109/0x12
+sysc_reset from sysc_probe+0xa99/0xeb0
+...
+
+The fix is to flush posted write after enable before reset during
+probe. Note that some devices also need to specify the delay after enable
+with ti,sysc-delay-us, but this is not needed for musb on am335x based on
+my tests.
+
+Reported-by: kernelci.org bot <bot@kernelci.org>
+Closes: https://storage.kernelci.org/next/master/next-20230614/arm/multi_v7_defconfig+CONFIG_THUMB2_KERNEL=y/gcc-10/lab-cip/baseline-beaglebone-black.html
+Fixes: 596e7955692b ("bus: ti-sysc: Add support for software reset")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index cae078bffc715..9b7268bae66ab 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -2159,6 +2159,8 @@ static int sysc_reset(struct sysc *ddata)
+ sysc_val = sysc_read_sysconfig(ddata);
+ sysc_val |= sysc_mask;
+ sysc_write(ddata, sysc_offset, sysc_val);
++ /* Flush posted write */
++ sysc_val = sysc_read_sysconfig(ddata);
+ }
+
+ if (ddata->cfg.srst_udelay)
+--
+2.40.1
+
--- /dev/null
+From fb403edacca40e1efbe0ada76a5732e644981461 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Aug 2023 17:12:39 +0200
+Subject: drm/panel: simple: Fix AUO G121EAN01 panel timings according to the
+ docs
+
+From: Luca Ceresoli <luca.ceresoli@bootlin.com>
+
+[ Upstream commit e8470c0a7bcaa82f78ad34282d662dd7bd9630c2 ]
+
+Commit 03e909acd95a ("drm/panel: simple: Add support for AUO G121EAN01.4
+panel") added support for this panel model, but the timings it implements
+are very different from what the datasheet describes. I checked both the
+G121EAN01.0 datasheet from [0] and the G121EAN01.4 one from [1] and they
+all have the same timings: for example the LVDS clock typical value is 74.4
+MHz, not 66.7 MHz as implemented.
+
+Replace the timings with the ones from the documentation. These timings
+have been tested and the clock frequencies verified with an oscilloscope to
+ensure they are correct.
+
+Also use struct display_timing instead of struct drm_display_mode in order
+to also specify the minimum and maximum values.
+
+[0] https://embedded.avnet.com/product/g121ean01-0/
+[1] https://embedded.avnet.com/product/g121ean01-4/
+
+Fixes: 03e909acd95a ("drm/panel: simple: Add support for AUO G121EAN01.4 panel")
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230804151239.835216-1-luca.ceresoli@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index f851aaf2c5917..5e067ba7e5fba 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -969,21 +969,21 @@ static const struct panel_desc auo_g104sn02 = {
+ .connector_type = DRM_MODE_CONNECTOR_LVDS,
+ };
+
+-static const struct drm_display_mode auo_g121ean01_mode = {
+- .clock = 66700,
+- .hdisplay = 1280,
+- .hsync_start = 1280 + 58,
+- .hsync_end = 1280 + 58 + 8,
+- .htotal = 1280 + 58 + 8 + 70,
+- .vdisplay = 800,
+- .vsync_start = 800 + 6,
+- .vsync_end = 800 + 6 + 4,
+- .vtotal = 800 + 6 + 4 + 10,
++static const struct display_timing auo_g121ean01_timing = {
++ .pixelclock = { 60000000, 74400000, 90000000 },
++ .hactive = { 1280, 1280, 1280 },
++ .hfront_porch = { 20, 50, 100 },
++ .hback_porch = { 20, 50, 100 },
++ .hsync_len = { 30, 100, 200 },
++ .vactive = { 800, 800, 800 },
++ .vfront_porch = { 2, 10, 25 },
++ .vback_porch = { 2, 10, 25 },
++ .vsync_len = { 4, 18, 50 },
+ };
+
+ static const struct panel_desc auo_g121ean01 = {
+- .modes = &auo_g121ean01_mode,
+- .num_modes = 1,
++ .timings = &auo_g121ean01_timing,
++ .num_timings = 1,
+ .bpc = 8,
+ .size = {
+ .width = 261,
+--
+2.40.1
+
--- /dev/null
+From 09c495175c7f74f10b9b1a8bfb3659ec1e86db0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Aug 2023 09:47:32 +0200
+Subject: i40e: fix misleading debug logs
+
+From: Andrii Staikov <andrii.staikov@intel.com>
+
+[ Upstream commit 2f2beb8874cb0844e84ad26e990f05f4f13ff63f ]
+
+Change "write" into the actual "read" word.
+Change parameters description.
+
+Fixes: 7073f46e443e ("i40e: Add AQ commands for NVM Update for X722")
+Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Andrii Staikov <andrii.staikov@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_nvm.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
+index 17e3f26eee4a4..779ba907009a5 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
+@@ -210,11 +210,11 @@ static int i40e_read_nvm_word_srctl(struct i40e_hw *hw, u16 offset,
+ * @hw: pointer to the HW structure.
+ * @module_pointer: module pointer location in words from the NVM beginning
+ * @offset: offset in words from module start
+- * @words: number of words to write
+- * @data: buffer with words to write to the Shadow RAM
++ * @words: number of words to read
++ * @data: buffer with words to read to the Shadow RAM
+ * @last_command: tells the AdminQ that this is the last command
+ *
+- * Writes a 16 bit words buffer to the Shadow RAM using the admin command.
++ * Reads a 16 bit words buffer to the Shadow RAM using the admin command.
+ **/
+ static int i40e_read_nvm_aq(struct i40e_hw *hw,
+ u8 module_pointer, u32 offset,
+@@ -234,18 +234,18 @@ static int i40e_read_nvm_aq(struct i40e_hw *hw,
+ */
+ if ((offset + words) > hw->nvm.sr_size)
+ i40e_debug(hw, I40E_DEBUG_NVM,
+- "NVM write error: offset %d beyond Shadow RAM limit %d\n",
++ "NVM read error: offset %d beyond Shadow RAM limit %d\n",
+ (offset + words), hw->nvm.sr_size);
+ else if (words > I40E_SR_SECTOR_SIZE_IN_WORDS)
+- /* We can write only up to 4KB (one sector), in one AQ write */
++ /* We can read only up to 4KB (one sector), in one AQ write */
+ i40e_debug(hw, I40E_DEBUG_NVM,
+- "NVM write fail error: tried to write %d words, limit is %d.\n",
++ "NVM read fail error: tried to read %d words, limit is %d.\n",
+ words, I40E_SR_SECTOR_SIZE_IN_WORDS);
+ else if (((offset + (words - 1)) / I40E_SR_SECTOR_SIZE_IN_WORDS)
+ != (offset / I40E_SR_SECTOR_SIZE_IN_WORDS))
+- /* A single write cannot spread over two sectors */
++ /* A single read cannot spread over two sectors */
+ i40e_debug(hw, I40E_DEBUG_NVM,
+- "NVM write error: cannot spread over two sectors in a single write offset=%d words=%d\n",
++ "NVM read error: cannot spread over two sectors in a single read offset=%d words=%d\n",
+ offset, words);
+ else
+ ret_code = i40e_aq_read_nvm(hw, module_pointer,
+--
+2.40.1
+
--- /dev/null
+From 142e264061747748d1349c3e9d8be53c1e32b7f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Aug 2023 16:46:04 +0200
+Subject: iavf: fix FDIR rule fields masks validation
+
+From: Piotr Gardocki <piotrx.gardocki@intel.com>
+
+[ Upstream commit 751969e5b1196821ef78f0aa664a8a97c92c9057 ]
+
+Return an error if a field's mask is neither full nor empty. When a mask
+is only partial the field is not being used for rule programming but it
+gives a wrong impression it is used. Fix by returning an error on any
+partial mask to make it clear they are not supported.
+The ip_ver assignment is moved earlier in code to allow using it in
+iavf_validate_fdir_fltr_masks.
+
+Fixes: 527691bf0682 ("iavf: Support IPv4 Flow Director filters")
+Fixes: e90cbc257a6f ("iavf: Support IPv6 Flow Director filters")
+Signed-off-by: Piotr Gardocki <piotrx.gardocki@intel.com>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/intel/iavf/iavf_ethtool.c | 10 +++
+ drivers/net/ethernet/intel/iavf/iavf_fdir.c | 77 ++++++++++++++++++-
+ drivers/net/ethernet/intel/iavf/iavf_fdir.h | 2 +
+ 3 files changed, 85 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
+index f544d2b0abdbd..fe912b1c468ef 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c
+@@ -1289,6 +1289,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
+ fltr->ip_mask.src_port = fsp->m_u.tcp_ip4_spec.psrc;
+ fltr->ip_mask.dst_port = fsp->m_u.tcp_ip4_spec.pdst;
+ fltr->ip_mask.tos = fsp->m_u.tcp_ip4_spec.tos;
++ fltr->ip_ver = 4;
+ break;
+ case AH_V4_FLOW:
+ case ESP_V4_FLOW:
+@@ -1300,6 +1301,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
+ fltr->ip_mask.v4_addrs.dst_ip = fsp->m_u.ah_ip4_spec.ip4dst;
+ fltr->ip_mask.spi = fsp->m_u.ah_ip4_spec.spi;
+ fltr->ip_mask.tos = fsp->m_u.ah_ip4_spec.tos;
++ fltr->ip_ver = 4;
+ break;
+ case IPV4_USER_FLOW:
+ fltr->ip_data.v4_addrs.src_ip = fsp->h_u.usr_ip4_spec.ip4src;
+@@ -1312,6 +1314,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
+ fltr->ip_mask.l4_header = fsp->m_u.usr_ip4_spec.l4_4_bytes;
+ fltr->ip_mask.tos = fsp->m_u.usr_ip4_spec.tos;
+ fltr->ip_mask.proto = fsp->m_u.usr_ip4_spec.proto;
++ fltr->ip_ver = 4;
+ break;
+ case TCP_V6_FLOW:
+ case UDP_V6_FLOW:
+@@ -1330,6 +1333,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
+ fltr->ip_mask.src_port = fsp->m_u.tcp_ip6_spec.psrc;
+ fltr->ip_mask.dst_port = fsp->m_u.tcp_ip6_spec.pdst;
+ fltr->ip_mask.tclass = fsp->m_u.tcp_ip6_spec.tclass;
++ fltr->ip_ver = 6;
+ break;
+ case AH_V6_FLOW:
+ case ESP_V6_FLOW:
+@@ -1345,6 +1349,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
+ sizeof(struct in6_addr));
+ fltr->ip_mask.spi = fsp->m_u.ah_ip6_spec.spi;
+ fltr->ip_mask.tclass = fsp->m_u.ah_ip6_spec.tclass;
++ fltr->ip_ver = 6;
+ break;
+ case IPV6_USER_FLOW:
+ memcpy(&fltr->ip_data.v6_addrs.src_ip, fsp->h_u.usr_ip6_spec.ip6src,
+@@ -1361,6 +1366,7 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
+ fltr->ip_mask.l4_header = fsp->m_u.usr_ip6_spec.l4_4_bytes;
+ fltr->ip_mask.tclass = fsp->m_u.usr_ip6_spec.tclass;
+ fltr->ip_mask.proto = fsp->m_u.usr_ip6_spec.l4_proto;
++ fltr->ip_ver = 6;
+ break;
+ case ETHER_FLOW:
+ fltr->eth_data.etype = fsp->h_u.ether_spec.h_proto;
+@@ -1371,6 +1377,10 @@ iavf_add_fdir_fltr_info(struct iavf_adapter *adapter, struct ethtool_rx_flow_spe
+ return -EINVAL;
+ }
+
++ err = iavf_validate_fdir_fltr_masks(adapter, fltr);
++ if (err)
++ return err;
++
+ if (iavf_fdir_is_dup_fltr(adapter, fltr))
+ return -EEXIST;
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_fdir.c b/drivers/net/ethernet/intel/iavf/iavf_fdir.c
+index 505e82ebafe47..03e774bd2a5b4 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_fdir.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_fdir.c
+@@ -18,6 +18,79 @@ static const struct in6_addr ipv6_addr_full_mask = {
+ }
+ };
+
++static const struct in6_addr ipv6_addr_zero_mask = {
++ .in6_u = {
++ .u6_addr8 = {
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ }
++ }
++};
++
++/**
++ * iavf_validate_fdir_fltr_masks - validate Flow Director filter fields masks
++ * @adapter: pointer to the VF adapter structure
++ * @fltr: Flow Director filter data structure
++ *
++ * Returns 0 if all masks of packet fields are either full or empty. Returns
++ * error on at least one partial mask.
++ */
++int iavf_validate_fdir_fltr_masks(struct iavf_adapter *adapter,
++ struct iavf_fdir_fltr *fltr)
++{
++ if (fltr->eth_mask.etype && fltr->eth_mask.etype != htons(U16_MAX))
++ goto partial_mask;
++
++ if (fltr->ip_ver == 4) {
++ if (fltr->ip_mask.v4_addrs.src_ip &&
++ fltr->ip_mask.v4_addrs.src_ip != htonl(U32_MAX))
++ goto partial_mask;
++
++ if (fltr->ip_mask.v4_addrs.dst_ip &&
++ fltr->ip_mask.v4_addrs.dst_ip != htonl(U32_MAX))
++ goto partial_mask;
++
++ if (fltr->ip_mask.tos && fltr->ip_mask.tos != U8_MAX)
++ goto partial_mask;
++ } else if (fltr->ip_ver == 6) {
++ if (memcmp(&fltr->ip_mask.v6_addrs.src_ip, &ipv6_addr_zero_mask,
++ sizeof(struct in6_addr)) &&
++ memcmp(&fltr->ip_mask.v6_addrs.src_ip, &ipv6_addr_full_mask,
++ sizeof(struct in6_addr)))
++ goto partial_mask;
++
++ if (memcmp(&fltr->ip_mask.v6_addrs.dst_ip, &ipv6_addr_zero_mask,
++ sizeof(struct in6_addr)) &&
++ memcmp(&fltr->ip_mask.v6_addrs.dst_ip, &ipv6_addr_full_mask,
++ sizeof(struct in6_addr)))
++ goto partial_mask;
++
++ if (fltr->ip_mask.tclass && fltr->ip_mask.tclass != U8_MAX)
++ goto partial_mask;
++ }
++
++ if (fltr->ip_mask.proto && fltr->ip_mask.proto != U8_MAX)
++ goto partial_mask;
++
++ if (fltr->ip_mask.src_port && fltr->ip_mask.src_port != htons(U16_MAX))
++ goto partial_mask;
++
++ if (fltr->ip_mask.dst_port && fltr->ip_mask.dst_port != htons(U16_MAX))
++ goto partial_mask;
++
++ if (fltr->ip_mask.spi && fltr->ip_mask.spi != htonl(U32_MAX))
++ goto partial_mask;
++
++ if (fltr->ip_mask.l4_header &&
++ fltr->ip_mask.l4_header != htonl(U32_MAX))
++ goto partial_mask;
++
++ return 0;
++
++partial_mask:
++ dev_err(&adapter->pdev->dev, "Failed to add Flow Director filter, partial masks are not supported\n");
++ return -EOPNOTSUPP;
++}
++
+ /**
+ * iavf_pkt_udp_no_pay_len - the length of UDP packet without payload
+ * @fltr: Flow Director filter data structure
+@@ -263,8 +336,6 @@ iavf_fill_fdir_ip4_hdr(struct iavf_fdir_fltr *fltr,
+ VIRTCHNL_ADD_PROTO_HDR_FIELD_BIT(hdr, IPV4, DST);
+ }
+
+- fltr->ip_ver = 4;
+-
+ return 0;
+ }
+
+@@ -309,8 +380,6 @@ iavf_fill_fdir_ip6_hdr(struct iavf_fdir_fltr *fltr,
+ VIRTCHNL_ADD_PROTO_HDR_FIELD_BIT(hdr, IPV6, DST);
+ }
+
+- fltr->ip_ver = 6;
+-
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_fdir.h b/drivers/net/ethernet/intel/iavf/iavf_fdir.h
+index 33c55c366315b..9eb9f73f6adf3 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_fdir.h
++++ b/drivers/net/ethernet/intel/iavf/iavf_fdir.h
+@@ -110,6 +110,8 @@ struct iavf_fdir_fltr {
+ struct virtchnl_fdir_add vc_add_msg;
+ };
+
++int iavf_validate_fdir_fltr_masks(struct iavf_adapter *adapter,
++ struct iavf_fdir_fltr *fltr);
+ int iavf_fill_fdir_add_msg(struct iavf_adapter *adapter, struct iavf_fdir_fltr *fltr);
+ void iavf_print_fdir_fltr(struct iavf_adapter *adapter, struct iavf_fdir_fltr *fltr);
+ bool iavf_fdir_is_dup_fltr(struct iavf_adapter *adapter, struct iavf_fdir_fltr *fltr);
+--
+2.40.1
+
--- /dev/null
+From 810a31bef98fb8d288ba77c7e9e396d08a45ba18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Aug 2023 12:34:05 -0700
+Subject: ice: Block switchdev mode when ADQ is active and vice versa
+
+From: Marcin Szycik <marcin.szycik@linux.intel.com>
+
+[ Upstream commit 43d00e102d9ecbe2635d7e3f2e14d2e90183d6af ]
+
+ADQ and switchdev are not supported simultaneously. Enabling both at the
+same time can result in nullptr dereference.
+
+To prevent this, check if ADQ is active when changing devlink mode to
+switchdev mode, and check if switchdev is active when enabling ADQ.
+
+Fixes: fbc7b27af0f9 ("ice: enable ndo_setup_tc support for mqprio_qdisc")
+Signed-off-by: Marcin Szycik <marcin.szycik@linux.intel.com>
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Tested-by: Sujai Buvaneswaran <sujai.buvaneswaran@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20230816193405.1307580-1-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_eswitch.c | 6 ++++++
+ drivers/net/ethernet/intel/ice/ice_main.c | 5 +++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_eswitch.c b/drivers/net/ethernet/intel/ice/ice_eswitch.c
+index f9f15acae90a0..2ffe5708a045b 100644
+--- a/drivers/net/ethernet/intel/ice/ice_eswitch.c
++++ b/drivers/net/ethernet/intel/ice/ice_eswitch.c
+@@ -562,6 +562,12 @@ ice_eswitch_mode_set(struct devlink *devlink, u16 mode,
+ break;
+ case DEVLINK_ESWITCH_MODE_SWITCHDEV:
+ {
++ if (ice_is_adq_active(pf)) {
++ dev_err(ice_pf_to_dev(pf), "Couldn't change eswitch mode to switchdev - ADQ is active. Delete ADQ configs and try again, e.g. tc qdisc del dev $PF root");
++ NL_SET_ERR_MSG_MOD(extack, "Couldn't change eswitch mode to switchdev - ADQ is active. Delete ADQ configs and try again, e.g. tc qdisc del dev $PF root");
++ return -EOPNOTSUPP;
++ }
++
+ dev_info(ice_pf_to_dev(pf), "PF %d changed eswitch mode to switchdev",
+ pf->hw.pf_id);
+ NL_SET_ERR_MSG_MOD(extack, "Changed eswitch mode to switchdev");
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index a771e597795d3..7a00d297be3a9 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -8787,6 +8787,11 @@ ice_setup_tc(struct net_device *netdev, enum tc_setup_type type,
+ ice_setup_tc_block_cb,
+ np, np, true);
+ case TC_SETUP_QDISC_MQPRIO:
++ if (ice_is_eswitch_mode_switchdev(pf)) {
++ netdev_err(netdev, "TC MQPRIO offload not supported, switchdev is enabled\n");
++ return -EOPNOTSUPP;
++ }
++
+ if (pf->adev) {
+ mutex_lock(&pf->adev_mutex);
+ device_lock(&pf->adev->dev);
+--
+2.40.1
+
--- /dev/null
+From 18e866d5fb360c1346e65563dca4b2a4b69abc4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jul 2023 17:40:52 +0800
+Subject: ip6_vti: fix slab-use-after-free in decode_session6
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+[ Upstream commit 9fd41f1ba638938c9a1195d09bc6fa3be2712f25 ]
+
+When ipv6_vti device is set to the qdisc of the sfb type, the cb field
+of the sent skb may be modified during enqueuing. Then,
+slab-use-after-free may occur when ipv6_vti device sends IPv6 packets.
+
+The stack information is as follows:
+BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890
+Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0
+CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014
+Call Trace:
+<IRQ>
+dump_stack_lvl+0xd9/0x150
+print_address_description.constprop.0+0x2c/0x3c0
+kasan_report+0x11d/0x130
+decode_session6+0x103f/0x1890
+__xfrm_decode_session+0x54/0xb0
+vti6_tnl_xmit+0x3e6/0x1ee0
+dev_hard_start_xmit+0x187/0x700
+sch_direct_xmit+0x1a3/0xc30
+__qdisc_run+0x510/0x17a0
+__dev_queue_xmit+0x2215/0x3b10
+neigh_connected_output+0x3c2/0x550
+ip6_finish_output2+0x55a/0x1550
+ip6_finish_output+0x6b9/0x1270
+ip6_output+0x1f1/0x540
+ndisc_send_skb+0xa63/0x1890
+ndisc_send_rs+0x132/0x6f0
+addrconf_rs_timer+0x3f1/0x870
+call_timer_fn+0x1a0/0x580
+expire_timers+0x29b/0x4b0
+run_timer_softirq+0x326/0x910
+__do_softirq+0x1d4/0x905
+irq_exit_rcu+0xb7/0x120
+sysvec_apic_timer_interrupt+0x97/0xc0
+</IRQ>
+Allocated by task 9176:
+kasan_save_stack+0x22/0x40
+kasan_set_track+0x25/0x30
+__kasan_slab_alloc+0x7f/0x90
+kmem_cache_alloc_node+0x1cd/0x410
+kmalloc_reserve+0x165/0x270
+__alloc_skb+0x129/0x330
+netlink_sendmsg+0x9b1/0xe30
+sock_sendmsg+0xde/0x190
+____sys_sendmsg+0x739/0x920
+___sys_sendmsg+0x110/0x1b0
+__sys_sendmsg+0xf7/0x1c0
+do_syscall_64+0x39/0xb0
+entry_SYSCALL_64_after_hwframe+0x63/0xcd
+Freed by task 9176:
+kasan_save_stack+0x22/0x40
+kasan_set_track+0x25/0x30
+kasan_save_free_info+0x2b/0x40
+____kasan_slab_free+0x160/0x1c0
+slab_free_freelist_hook+0x11b/0x220
+kmem_cache_free+0xf0/0x490
+skb_free_head+0x17f/0x1b0
+skb_release_data+0x59c/0x850
+consume_skb+0xd2/0x170
+netlink_unicast+0x54f/0x7f0
+netlink_sendmsg+0x926/0xe30
+sock_sendmsg+0xde/0x190
+____sys_sendmsg+0x739/0x920
+___sys_sendmsg+0x110/0x1b0
+__sys_sendmsg+0xf7/0x1c0
+do_syscall_64+0x39/0xb0
+entry_SYSCALL_64_after_hwframe+0x63/0xcd
+The buggy address belongs to the object at ffff88802e08ed00
+which belongs to the cache skbuff_small_head of size 640
+The buggy address is located 194 bytes inside of
+freed 640-byte region [ffff88802e08ed00, ffff88802e08ef80)
+
+As commit f855691975bb ("xfrm6: Fix the nexthdr offset in
+_decode_session6.") showed, xfrm_decode_session was originally intended
+only for the receive path. IP6CB(skb)->nhoff is not set during
+transmission. Therefore, set the cb field in the skb to 0 before
+sending packets.
+
+Fixes: f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ip6_vti.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index 151337d7f67b4..cb71463bbbabd 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -570,12 +570,12 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
+ vti6_addr_conflict(t, ipv6_hdr(skb)))
+ goto tx_err;
+
+- xfrm_decode_session(skb, &fl, AF_INET6);
+ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
++ xfrm_decode_session(skb, &fl, AF_INET6);
+ break;
+ case htons(ETH_P_IP):
+- xfrm_decode_session(skb, &fl, AF_INET);
+ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
++ xfrm_decode_session(skb, &fl, AF_INET);
+ break;
+ default:
+ goto tx_err;
+--
+2.40.1
+
--- /dev/null
+From b43ebca3f4393a0debe62bc64a679d9e98a02017 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jul 2023 17:40:53 +0800
+Subject: ip_vti: fix potential slab-use-after-free in decode_session6
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+[ Upstream commit 6018a266279b1a75143c7c0804dd08a5fc4c3e0b ]
+
+When ip_vti device is set to the qdisc of the sfb type, the cb field
+of the sent skb may be modified during enqueuing. Then,
+slab-use-after-free may occur when ip_vti device sends IPv6 packets.
+As commit f855691975bb ("xfrm6: Fix the nexthdr offset in
+_decode_session6.") showed, xfrm_decode_session was originally intended
+only for the receive path. IP6CB(skb)->nhoff is not set during
+transmission. Therefore, set the cb field in the skb to 0 before
+sending packets.
+
+Fixes: f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_vti.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index 8c2bd1d9ddce3..615c1dcf3a28e 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -287,12 +287,12 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ switch (skb->protocol) {
+ case htons(ETH_P_IP):
+- xfrm_decode_session(skb, &fl, AF_INET);
+ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
++ xfrm_decode_session(skb, &fl, AF_INET);
+ break;
+ case htons(ETH_P_IPV6):
+- xfrm_decode_session(skb, &fl, AF_INET6);
+ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
++ xfrm_decode_session(skb, &fl, AF_INET6);
+ break;
+ default:
+ goto tx_err;
+--
+2.40.1
+
--- /dev/null
+From 40d0ccd3ef908700a830716866a0893e09a6b6b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Aug 2023 15:12:42 -0400
+Subject: ipvs: fix racy memcpy in proc_do_sync_threshold
+
+From: Sishuai Gong <sishuai.system@gmail.com>
+
+[ Upstream commit 5310760af1d4fbea1452bfc77db5f9a680f7ae47 ]
+
+When two threads run proc_do_sync_threshold() in parallel,
+data races could happen between the two memcpy():
+
+Thread-1 Thread-2
+memcpy(val, valp, sizeof(val));
+ memcpy(valp, val, sizeof(val));
+
+This race might mess up the (struct ctl_table *) table->data,
+so we add a mutex lock to serialize them.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Link: https://lore.kernel.org/netdev/B6988E90-0A1E-4B85-BF26-2DAF6D482433@gmail.com/
+Signed-off-by: Sishuai Gong <sishuai.system@gmail.com>
+Acked-by: Simon Horman <horms@kernel.org>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_ctl.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 03af6a2ffd567..17a1b731a76b1 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -1798,6 +1798,7 @@ static int
+ proc_do_sync_threshold(struct ctl_table *table, int write,
+ void *buffer, size_t *lenp, loff_t *ppos)
+ {
++ struct netns_ipvs *ipvs = table->extra2;
+ int *valp = table->data;
+ int val[2];
+ int rc;
+@@ -1807,6 +1808,7 @@ proc_do_sync_threshold(struct ctl_table *table, int write,
+ .mode = table->mode,
+ };
+
++ mutex_lock(&ipvs->sync_mutex);
+ memcpy(val, valp, sizeof(val));
+ rc = proc_dointvec(&tmp, write, buffer, lenp, ppos);
+ if (write) {
+@@ -1816,6 +1818,7 @@ proc_do_sync_threshold(struct ctl_table *table, int write,
+ else
+ memcpy(valp, val, sizeof(val));
+ }
++ mutex_unlock(&ipvs->sync_mutex);
+ return rc;
+ }
+
+@@ -4080,6 +4083,7 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
+ ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
+ ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
+ tbl[idx].data = &ipvs->sysctl_sync_threshold;
++ tbl[idx].extra2 = ipvs;
+ tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
+ ipvs->sysctl_sync_refresh_period = DEFAULT_SYNC_REFRESH_PERIOD;
+ tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
+--
+2.40.1
+
--- /dev/null
+From d58297710949c18304cf466139c0da08640a3c63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 11:39:54 +0800
+Subject: net: af_key: fix sadb_x_filter validation
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit 75065a8929069bc93181848818e23f147a73f83a ]
+
+When running xfrm_state_walk_init(), the xfrm_address_filter being used
+is okay to have a splen/dplen that equals to sizeof(xfrm_address_t)<<3.
+This commit replaces >= to > to make sure the boundary checking is
+correct.
+
+Fixes: 37bd22420f85 ("af_key: pfkey_dump needs parameter validation")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/key/af_key.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 8c21de50eadf8..8a8f2429d5d99 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -1848,9 +1848,9 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
+ if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
+ struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
+
+- if ((xfilter->sadb_x_filter_splen >=
++ if ((xfilter->sadb_x_filter_splen >
+ (sizeof(xfrm_address_t) << 3)) ||
+- (xfilter->sadb_x_filter_dplen >=
++ (xfilter->sadb_x_filter_dplen >
+ (sizeof(xfrm_address_t) << 3))) {
+ mutex_unlock(&pfk->dump_lock);
+ return -EINVAL;
+--
+2.40.1
+
--- /dev/null
+From 84fbc076c0dd0e9686f9415a72461860f42f868a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Aug 2023 14:21:58 +0000
+Subject: net: do not allow gso_size to be set to GSO_BY_FRAGS
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b616be6b97688f2f2bd7c4a47ab32f27f94fb2a9 ]
+
+One missing check in virtio_net_hdr_to_skb() allowed
+syzbot to crash kernels again [1]
+
+Do not allow gso_size to be set to GSO_BY_FRAGS (0xffff),
+because this magic value is used by the kernel.
+
+[1]
+general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN
+KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]
+CPU: 0 PID: 5039 Comm: syz-executor401 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
+RIP: 0010:skb_segment+0x1a52/0x3ef0 net/core/skbuff.c:4500
+Code: 00 00 00 e9 ab eb ff ff e8 6b 96 5d f9 48 8b 84 24 00 01 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e ea 21 00 00 48 8b 84 24 00 01
+RSP: 0018:ffffc90003d3f1c8 EFLAGS: 00010202
+RAX: dffffc0000000000 RBX: 000000000001fffe RCX: 0000000000000000
+RDX: 000000000000000e RSI: ffffffff882a3115 RDI: 0000000000000070
+RBP: ffffc90003d3f378 R08: 0000000000000005 R09: 000000000000ffff
+R10: 000000000000ffff R11: 5ee4a93e456187d6 R12: 000000000001ffc6
+R13: dffffc0000000000 R14: 0000000000000008 R15: 000000000000ffff
+FS: 00005555563f2380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000020020000 CR3: 000000001626d000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+<TASK>
+udp6_ufo_fragment+0x9d2/0xd50 net/ipv6/udp_offload.c:109
+ipv6_gso_segment+0x5c4/0x17b0 net/ipv6/ip6_offload.c:120
+skb_mac_gso_segment+0x292/0x610 net/core/gso.c:53
+__skb_gso_segment+0x339/0x710 net/core/gso.c:124
+skb_gso_segment include/net/gso.h:83 [inline]
+validate_xmit_skb+0x3a5/0xf10 net/core/dev.c:3625
+__dev_queue_xmit+0x8f0/0x3d60 net/core/dev.c:4329
+dev_queue_xmit include/linux/netdevice.h:3082 [inline]
+packet_xmit+0x257/0x380 net/packet/af_packet.c:276
+packet_snd net/packet/af_packet.c:3087 [inline]
+packet_sendmsg+0x24c7/0x5570 net/packet/af_packet.c:3119
+sock_sendmsg_nosec net/socket.c:727 [inline]
+sock_sendmsg+0xd9/0x180 net/socket.c:750
+____sys_sendmsg+0x6ac/0x940 net/socket.c:2496
+___sys_sendmsg+0x135/0x1d0 net/socket.c:2550
+__sys_sendmsg+0x117/0x1e0 net/socket.c:2579
+do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
+entry_SYSCALL_64_after_hwframe+0x63/0xcd
+RIP: 0033:0x7ff27cdb34d9
+
+Fixes: 3953c46c3ac7 ("sk_buff: allow segmenting based on frag sizes")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Xin Long <lucien.xin@gmail.com>
+Cc: "Michael S. Tsirkin" <mst@redhat.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20230816142158.1779798-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/virtio_net.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index a960de68ac69e..6047058d67037 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -148,6 +148,10 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ if (gso_type & SKB_GSO_UDP)
+ nh_off -= thlen;
+
++ /* Kernel has a special handling for GSO_BY_FRAGS. */
++ if (gso_size == GSO_BY_FRAGS)
++ return -EINVAL;
++
+ /* Too small packets are not really GSO ones. */
+ if (skb->len - nh_off > gso_size) {
+ shinfo->gso_size = gso_size;
+--
+2.40.1
+
--- /dev/null
+From c2e6bfff815486f542b391772504311ee60e19e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Aug 2023 17:13:23 -0700
+Subject: net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
+
+From: Alfred Lee <l00g33k@gmail.com>
+
+[ Upstream commit 23d775f12dcd23d052a4927195f15e970e27ab26 ]
+
+If the switch is reset during active EEPROM transactions, as in
+just after an SoC reset after power up, the I2C bus transaction
+may be cut short leaving the EEPROM internal I2C state machine
+in the wrong state. When the switch is reset again, the bad
+state machine state may result in data being read from the wrong
+memory location causing the switch to enter unexpected mode
+rendering it inoperational.
+
+Fixes: a3dcb3e7e70c ("net: dsa: mv88e6xxx: Wait for EEPROM done after HW reset")
+Signed-off-by: Alfred Lee <l00g33k@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20230815001323.24739-1-l00g33k@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index b69bd44ada1f2..a73008b9e0b3c 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3006,6 +3006,14 @@ static void mv88e6xxx_hardware_reset(struct mv88e6xxx_chip *chip)
+
+ /* If there is a GPIO connected to the reset pin, toggle it */
+ if (gpiod) {
++ /* If the switch has just been reset and not yet completed
++ * loading EEPROM, the reset may interrupt the I2C transaction
++ * mid-byte, causing the first EEPROM read after the reset
++ * from the wrong location resulting in the switch booting
++ * to wrong mode and inoperable.
++ */
++ mv88e6xxx_g1_wait_eeprom_done(chip);
++
+ gpiod_set_value_cansleep(gpiod, 1);
+ usleep_range(10000, 20000);
+ gpiod_set_value_cansleep(gpiod, 0);
+--
+2.40.1
+
--- /dev/null
+From af7f4e7cfdf2bf3c833afa9feb9873ead77217b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Aug 2023 18:44:51 +0530
+Subject: net: macb: In ZynqMP resume always configure PS GTR for non-wakeup
+ source
+
+From: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+
+[ Upstream commit 6c461e394d11a981c662cc16cebfb05b602e23ba ]
+
+On Zynq UltraScale+ MPSoC ubuntu platform when systemctl issues suspend,
+network manager bring down the interface and goes into suspend. When it
+wakes up it again enables the interface.
+
+This leads to xilinx-psgtr "PLL lock timeout" on interface bringup, as
+the power management controller power down the entire FPD (including
+SERDES) if none of the FPD devices are in use and serdes is not
+initialized on resume.
+
+$ sudo rtcwake -m no -s 120 -v
+$ sudo systemctl suspend <this does ifconfig eth1 down>
+$ ifconfig eth1 up
+xilinx-psgtr fd400000.phy: lane 0 (type 10, protocol 5): PLL lock timeout
+phy phy-fd400000.phy.0: phy poweron failed --> -110
+
+macb driver is called in this way:
+1. macb_close: Stop network interface. In this function, it
+ reset MACB IP and disables PHY and network interface.
+
+2. macb_suspend: It is called in kernel suspend flow. But because
+ network interface has been disabled(netif_running(ndev) is
+ false), it does nothing and returns directly;
+
+3. System goes into suspend state. Some time later, system is
+ waken up by RTC wakeup device;
+
+4. macb_resume: It does nothing because network interface has
+ been disabled;
+
+5. macb_open: It is called to enable network interface again. ethernet
+ interface is initialized in this API but serdes which is power-off
+ by PMUFW during FPD-off suspend is not initialized again and so
+ we hit GT PLL lock issue on open.
+
+To resolve this PLL timeout issue always do PS GTR initialization
+when ethernet device is configured as non-wakeup source.
+
+Fixes: f22bd29ba19a ("net: macb: Fix ZynqMP SGMII non-wakeup source resume failure")
+Fixes: 8b73fa3ae02b ("net: macb: Added ZynqMP-specific initialization")
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Link: https://lore.kernel.org/r/1691414091-2260697-1-git-send-email-radhey.shyam.pandey@amd.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index abd6cc0cd641f..5fb991835078a 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -5070,6 +5070,9 @@ static int __maybe_unused macb_suspend(struct device *dev)
+ unsigned int q;
+ int err;
+
++ if (!device_may_wakeup(&bp->dev->dev))
++ phy_exit(bp->sgmii_phy);
++
+ if (!netif_running(netdev))
+ return 0;
+
+@@ -5130,7 +5133,6 @@ static int __maybe_unused macb_suspend(struct device *dev)
+ if (!(bp->wol & MACB_WOL_ENABLED)) {
+ rtnl_lock();
+ phylink_stop(bp->phylink);
+- phy_exit(bp->sgmii_phy);
+ rtnl_unlock();
+ spin_lock_irqsave(&bp->lock, flags);
+ macb_reset_hw(bp);
+@@ -5160,6 +5162,9 @@ static int __maybe_unused macb_resume(struct device *dev)
+ unsigned int q;
+ int err;
+
++ if (!device_may_wakeup(&bp->dev->dev))
++ phy_init(bp->sgmii_phy);
++
+ if (!netif_running(netdev))
+ return 0;
+
+@@ -5220,8 +5225,6 @@ static int __maybe_unused macb_resume(struct device *dev)
+ macb_set_rx_mode(netdev);
+ macb_restore_features(bp);
+ rtnl_lock();
+- if (!device_may_wakeup(&bp->dev->dev))
+- phy_init(bp->sgmii_phy);
+
+ phylink_start(bp->phylink);
+ rtnl_unlock();
+--
+2.40.1
+
--- /dev/null
+From 79f7b530a84cff6fac4ae55e0d5802f31a3fca03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Aug 2023 13:38:40 -0700
+Subject: net: openvswitch: reject negative ifindex
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit a552bfa16bab4ce901ee721346a28c4e483f4066 ]
+
+Recent changes in net-next (commit 759ab1edb56c ("net: store netdevs
+in an xarray")) refactored the handling of pre-assigned ifindexes
+and let syzbot surface a latent problem in ovs. ovs does not validate
+ifindex, making it possible to create netdev ports with negative
+ifindex values. It's easy to repro with YNL:
+
+$ ./cli.py --spec netlink/specs/ovs_datapath.yaml \
+ --do new \
+ --json '{"upcall-pid": 1, "name":"my-dp"}'
+$ ./cli.py --spec netlink/specs/ovs_vport.yaml \
+ --do new \
+ --json '{"upcall-pid": "00000001", "name": "some-port0", "dp-ifindex":3,"ifindex":4294901760,"type":2}'
+
+$ ip link show
+-65536: some-port0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
+ link/ether 7a:48:21:ad:0b:fb brd ff:ff:ff:ff:ff:ff
+...
+
+Validate the inputs. Now the second command correctly returns:
+
+$ ./cli.py --spec netlink/specs/ovs_vport.yaml \
+ --do new \
+ --json '{"upcall-pid": "00000001", "name": "some-port0", "dp-ifindex":3,"ifindex":4294901760,"type":2}'
+
+lib.ynl.NlError: Netlink error: Numerical result out of range
+nl_len = 108 (92) nl_flags = 0x300 nl_type = 2
+ error: -34 extack: {'msg': 'integer out of range', 'unknown': [[type:4 len:36] b'\x0c\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x03\x00\xff\xff\xff\x7f\x00\x00\x00\x00\x08\x00\x01\x00\x08\x00\x00\x00'], 'bad-attr': '.ifindex'}
+
+Accept 0 since it used to be silently ignored.
+
+Fixes: 54c4ef34c4b6 ("openvswitch: allow specifying ifindex of new interfaces")
+Reported-by: syzbot+7456b5dcf65111553320@syzkaller.appspotmail.com
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Reviewed-by: Aaron Conole <aconole@redhat.com>
+Link: https://lore.kernel.org/r/20230814203840.2908710-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/datapath.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index 5920fdca12875..3c7b245354096 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -1806,7 +1806,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ parms.port_no = OVSP_LOCAL;
+ parms.upcall_portids = a[OVS_DP_ATTR_UPCALL_PID];
+ parms.desired_ifindex = a[OVS_DP_ATTR_IFINDEX]
+- ? nla_get_u32(a[OVS_DP_ATTR_IFINDEX]) : 0;
++ ? nla_get_s32(a[OVS_DP_ATTR_IFINDEX]) : 0;
+
+ /* So far only local changes have been made, now need the lock. */
+ ovs_lock();
+@@ -2026,7 +2026,7 @@ static const struct nla_policy datapath_policy[OVS_DP_ATTR_MAX + 1] = {
+ [OVS_DP_ATTR_USER_FEATURES] = { .type = NLA_U32 },
+ [OVS_DP_ATTR_MASKS_CACHE_SIZE] = NLA_POLICY_RANGE(NLA_U32, 0,
+ PCPU_MIN_UNIT_SIZE / sizeof(struct mask_cache_entry)),
+- [OVS_DP_ATTR_IFINDEX] = {.type = NLA_U32 },
++ [OVS_DP_ATTR_IFINDEX] = NLA_POLICY_MIN(NLA_S32, 0),
+ };
+
+ static const struct genl_small_ops dp_datapath_genl_ops[] = {
+@@ -2276,7 +2276,7 @@ static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ parms.port_no = port_no;
+ parms.upcall_portids = a[OVS_VPORT_ATTR_UPCALL_PID];
+ parms.desired_ifindex = a[OVS_VPORT_ATTR_IFINDEX]
+- ? nla_get_u32(a[OVS_VPORT_ATTR_IFINDEX]) : 0;
++ ? nla_get_s32(a[OVS_VPORT_ATTR_IFINDEX]) : 0;
+
+ vport = new_vport(&parms);
+ err = PTR_ERR(vport);
+@@ -2513,7 +2513,7 @@ static const struct nla_policy vport_policy[OVS_VPORT_ATTR_MAX + 1] = {
+ [OVS_VPORT_ATTR_TYPE] = { .type = NLA_U32 },
+ [OVS_VPORT_ATTR_UPCALL_PID] = { .type = NLA_UNSPEC },
+ [OVS_VPORT_ATTR_OPTIONS] = { .type = NLA_NESTED },
+- [OVS_VPORT_ATTR_IFINDEX] = { .type = NLA_U32 },
++ [OVS_VPORT_ATTR_IFINDEX] = NLA_POLICY_MIN(NLA_S32, 0),
+ [OVS_VPORT_ATTR_NETNSID] = { .type = NLA_S32 },
+ };
+
+--
+2.40.1
+
--- /dev/null
+From 659f6212a8eddd5a45a15384f0bb739160641f62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Aug 2023 22:06:39 +0800
+Subject: net: pcs: Add missing put_device call in miic_create
+
+From: Xiang Yang <xiangyang3@huawei.com>
+
+[ Upstream commit 829c6524d6729d05a82575dbcc16f99be5ee843d ]
+
+The reference of pdev->dev is taken by of_find_device_by_node, so
+it should be released when not need anymore.
+
+Fixes: 7dc54d3b8d91 ("net: pcs: add Renesas MII converter driver")
+Signed-off-by: Xiang Yang <xiangyang3@huawei.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/pcs/pcs-rzn1-miic.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/pcs/pcs-rzn1-miic.c b/drivers/net/pcs/pcs-rzn1-miic.c
+index c1424119e8212..847ab37f13671 100644
+--- a/drivers/net/pcs/pcs-rzn1-miic.c
++++ b/drivers/net/pcs/pcs-rzn1-miic.c
+@@ -317,15 +317,21 @@ struct phylink_pcs *miic_create(struct device *dev, struct device_node *np)
+
+ pdev = of_find_device_by_node(pcs_np);
+ of_node_put(pcs_np);
+- if (!pdev || !platform_get_drvdata(pdev))
++ if (!pdev || !platform_get_drvdata(pdev)) {
++ if (pdev)
++ put_device(&pdev->dev);
+ return ERR_PTR(-EPROBE_DEFER);
++ }
+
+ miic_port = kzalloc(sizeof(*miic_port), GFP_KERNEL);
+- if (!miic_port)
++ if (!miic_port) {
++ put_device(&pdev->dev);
+ return ERR_PTR(-ENOMEM);
++ }
+
+ miic = platform_get_drvdata(pdev);
+ device_link_add(dev, miic->dev, DL_FLAG_AUTOREMOVE_CONSUMER);
++ put_device(&pdev->dev);
+
+ miic_port->miic = miic;
+ miic_port->port = port - 1;
+--
+2.40.1
+
--- /dev/null
+From 7564c37393e2159be5a993bd3f741a54255976ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Aug 2023 21:41:47 -0700
+Subject: net: phy: broadcom: stub c45 read/write for 54810
+
+From: Justin Chen <justin.chen@broadcom.com>
+
+[ Upstream commit 096516d092d54604d590827d05b1022c8f326639 ]
+
+The 54810 does not support c45. The mmd_phy_indirect accesses return
+arbirtary values leading to odd behavior like saying it supports EEE
+when it doesn't. We also see that reading/writing these non-existent
+MMD registers leads to phy instability in some cases.
+
+Fixes: b14995ac2527 ("net: phy: broadcom: Add BCM54810 PHY entry")
+Signed-off-by: Justin Chen <justin.chen@broadcom.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://lore.kernel.org/r/1691901708-28650-1-git-send-email-justin.chen@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/broadcom.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
+index ad71c88c87e78..f9ad8902100f3 100644
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -486,6 +486,17 @@ static int bcm54xx_resume(struct phy_device *phydev)
+ return bcm54xx_config_init(phydev);
+ }
+
++static int bcm54810_read_mmd(struct phy_device *phydev, int devnum, u16 regnum)
++{
++ return -EOPNOTSUPP;
++}
++
++static int bcm54810_write_mmd(struct phy_device *phydev, int devnum, u16 regnum,
++ u16 val)
++{
++ return -EOPNOTSUPP;
++}
++
+ static int bcm54811_config_init(struct phy_device *phydev)
+ {
+ int err, reg;
+@@ -981,6 +992,8 @@ static struct phy_driver broadcom_drivers[] = {
+ .get_strings = bcm_phy_get_strings,
+ .get_stats = bcm54xx_get_stats,
+ .probe = bcm54xx_phy_probe,
++ .read_mmd = bcm54810_read_mmd,
++ .write_mmd = bcm54810_write_mmd,
+ .config_init = bcm54xx_config_init,
+ .config_aneg = bcm5481_config_aneg,
+ .config_intr = bcm_phy_config_intr,
+--
+2.40.1
+
--- /dev/null
+From f68fe102b836478f50aa8dd78575218c6332ba22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Aug 2023 11:26:30 +0100
+Subject: net: phy: fix IRQ-based wake-on-lan over hibernate / power off
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit cc941e548bffc01b5816b4edc5cb432a137a58b3 ]
+
+Uwe reports:
+"Most PHYs signal WoL using an interrupt. So disabling interrupts [at
+shutdown] breaks WoL at least on PHYs covered by the marvell driver."
+
+Discussing with Ioana, the problem which was trying to be solved was:
+"The board in question is a LS1021ATSN which has two AR8031 PHYs that
+share an interrupt line. In case only one of the PHYs is probed and
+there are pending interrupts on the PHY#2 an IRQ storm will happen
+since there is no entity to clear the interrupt from PHY#2's registers.
+PHY#1's driver will get stuck in .handle_interrupt() indefinitely."
+
+Further confirmation that "the two AR8031 PHYs are on the same MDIO
+bus."
+
+With WoL using interrupts to wake the system, in such a case, the
+system will begin booting with an asserted interrupt. Thus, we need to
+cope with an interrupt asserted during boot.
+
+Solve this instead by disabling interrupts during PHY probe. This will
+ensure in Ioana's situation that both PHYs of the same type sharing an
+interrupt line on a common MDIO bus will have their interrupt outputs
+disabled when the driver probes the device, but before we hook in any
+interrupt handlers - thus avoiding the interrupt storm.
+
+A better fix would be for platform firmware to disable the interrupting
+devices at source during boot, before control is handed to the kernel.
+
+Fixes: e2f016cf7751 ("net: phy: add a shutdown procedure")
+Link: 20230804071757.383971-1-u.kleine-koenig@pengutronix.de
+Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy_device.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 82f74f96eba29..944f76e6fc8eb 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -3050,6 +3050,8 @@ static int phy_probe(struct device *dev)
+ goto out;
+ }
+
++ phy_disable_interrupts(phydev);
++
+ /* Start out supporting everything. Eventually,
+ * a controller will attach, and may modify one
+ * or both of these values
+@@ -3137,16 +3139,6 @@ static int phy_remove(struct device *dev)
+ return 0;
+ }
+
+-static void phy_shutdown(struct device *dev)
+-{
+- struct phy_device *phydev = to_phy_device(dev);
+-
+- if (phydev->state == PHY_READY || !phydev->attached_dev)
+- return;
+-
+- phy_disable_interrupts(phydev);
+-}
+-
+ /**
+ * phy_driver_register - register a phy_driver with the PHY layer
+ * @new_driver: new phy_driver to register
+@@ -3180,7 +3172,6 @@ int phy_driver_register(struct phy_driver *new_driver, struct module *owner)
+ new_driver->mdiodrv.driver.bus = &mdio_bus_type;
+ new_driver->mdiodrv.driver.probe = phy_probe;
+ new_driver->mdiodrv.driver.remove = phy_remove;
+- new_driver->mdiodrv.driver.shutdown = phy_shutdown;
+ new_driver->mdiodrv.driver.owner = owner;
+ new_driver->mdiodrv.driver.probe_type = PROBE_FORCE_SYNCHRONOUS;
+
+--
+2.40.1
+
--- /dev/null
+From 44fe766eb6d69c5b7649643515459af44ae2cd71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 16:19:11 +0800
+Subject: net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit d1e0e61d617ba17aa516db707aa871387566bbf7 ]
+
+According to all consumers code of attrs[XFRMA_SEC_CTX], like
+
+* verify_sec_ctx_len(), convert to xfrm_user_sec_ctx*
+* xfrm_state_construct(), call security_xfrm_state_alloc whose prototype
+is int security_xfrm_state_alloc(.., struct xfrm_user_sec_ctx *sec_ctx);
+* copy_from_user_sec_ctx(), convert to xfrm_user_sec_ctx *
+...
+
+It seems that the expected parsing result for XFRMA_SEC_CTX should be
+structure xfrm_user_sec_ctx, and the current xfrm_sec_ctx is confusing
+and misleading (Luckily, they happen to have same size 8 bytes).
+
+This commit amend the policy structure to xfrm_user_sec_ctx to avoid
+ambiguity.
+
+Fixes: cf5cb79f6946 ("[XFRM] netlink: Establish an attribute policy")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_compat.c | 2 +-
+ net/xfrm/xfrm_user.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/xfrm/xfrm_compat.c b/net/xfrm/xfrm_compat.c
+index 8cbf45a8bcdc2..655fe4ff86212 100644
+--- a/net/xfrm/xfrm_compat.c
++++ b/net/xfrm/xfrm_compat.c
+@@ -108,7 +108,7 @@ static const struct nla_policy compat_policy[XFRMA_MAX+1] = {
+ [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
+ [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
+ [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
+- [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) },
++ [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) },
+ [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
+ [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
+ [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 3e32fe99a6818..c6803318ac63e 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -2969,7 +2969,7 @@ const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
+ [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
+ [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
+ [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
+- [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) },
++ [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) },
+ [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
+ [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
+ [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
+--
+2.40.1
+
--- /dev/null
+From a1e0edff4b0a46313427ef9fc8358730693c916f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 11:31:38 +0800
+Subject: net: xfrm: Fix xfrm_address_filter OOB read
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit dfa73c17d55b921e1d4e154976de35317e43a93a ]
+
+We found below OOB crash:
+
+[ 44.211730] ==================================================================
+[ 44.212045] BUG: KASAN: slab-out-of-bounds in memcmp+0x8b/0xb0
+[ 44.212045] Read of size 8 at addr ffff88800870f320 by task poc.xfrm/97
+[ 44.212045]
+[ 44.212045] CPU: 0 PID: 97 Comm: poc.xfrm Not tainted 6.4.0-rc7-00072-gdad9774deaf1-dirty #4
+[ 44.212045] Call Trace:
+[ 44.212045] <TASK>
+[ 44.212045] dump_stack_lvl+0x37/0x50
+[ 44.212045] print_report+0xcc/0x620
+[ 44.212045] ? __virt_addr_valid+0xf3/0x170
+[ 44.212045] ? memcmp+0x8b/0xb0
+[ 44.212045] kasan_report+0xb2/0xe0
+[ 44.212045] ? memcmp+0x8b/0xb0
+[ 44.212045] kasan_check_range+0x39/0x1c0
+[ 44.212045] memcmp+0x8b/0xb0
+[ 44.212045] xfrm_state_walk+0x21c/0x420
+[ 44.212045] ? __pfx_dump_one_state+0x10/0x10
+[ 44.212045] xfrm_dump_sa+0x1e2/0x290
+[ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10
+[ 44.212045] ? __kernel_text_address+0xd/0x40
+[ 44.212045] ? kasan_unpoison+0x27/0x60
+[ 44.212045] ? mutex_lock+0x60/0xe0
+[ 44.212045] ? __pfx_mutex_lock+0x10/0x10
+[ 44.212045] ? kasan_save_stack+0x22/0x50
+[ 44.212045] netlink_dump+0x322/0x6c0
+[ 44.212045] ? __pfx_netlink_dump+0x10/0x10
+[ 44.212045] ? mutex_unlock+0x7f/0xd0
+[ 44.212045] ? __pfx_mutex_unlock+0x10/0x10
+[ 44.212045] __netlink_dump_start+0x353/0x430
+[ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410
+[ 44.212045] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
+[ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10
+[ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10
+[ 44.212045] ? __pfx_xfrm_dump_sa_done+0x10/0x10
+[ 44.212045] ? __stack_depot_save+0x382/0x4e0
+[ 44.212045] ? filter_irq_stacks+0x1c/0x70
+[ 44.212045] ? kasan_save_stack+0x32/0x50
+[ 44.212045] ? kasan_save_stack+0x22/0x50
+[ 44.212045] ? kasan_set_track+0x25/0x30
+[ 44.212045] ? __kasan_slab_alloc+0x59/0x70
+[ 44.212045] ? kmem_cache_alloc_node+0xf7/0x260
+[ 44.212045] ? kmalloc_reserve+0xab/0x120
+[ 44.212045] ? __alloc_skb+0xcf/0x210
+[ 44.212045] ? netlink_sendmsg+0x509/0x700
+[ 44.212045] ? sock_sendmsg+0xde/0xe0
+[ 44.212045] ? __sys_sendto+0x18d/0x230
+[ 44.212045] ? __x64_sys_sendto+0x71/0x90
+[ 44.212045] ? do_syscall_64+0x3f/0x90
+[ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
+[ 44.212045] ? netlink_sendmsg+0x509/0x700
+[ 44.212045] ? sock_sendmsg+0xde/0xe0
+[ 44.212045] ? __sys_sendto+0x18d/0x230
+[ 44.212045] ? __x64_sys_sendto+0x71/0x90
+[ 44.212045] ? do_syscall_64+0x3f/0x90
+[ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
+[ 44.212045] ? kasan_save_stack+0x22/0x50
+[ 44.212045] ? kasan_set_track+0x25/0x30
+[ 44.212045] ? kasan_save_free_info+0x2e/0x50
+[ 44.212045] ? __kasan_slab_free+0x10a/0x190
+[ 44.212045] ? kmem_cache_free+0x9c/0x340
+[ 44.212045] ? netlink_recvmsg+0x23c/0x660
+[ 44.212045] ? sock_recvmsg+0xeb/0xf0
+[ 44.212045] ? __sys_recvfrom+0x13c/0x1f0
+[ 44.212045] ? __x64_sys_recvfrom+0x71/0x90
+[ 44.212045] ? do_syscall_64+0x3f/0x90
+[ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
+[ 44.212045] ? copyout+0x3e/0x50
+[ 44.212045] netlink_rcv_skb+0xd6/0x210
+[ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10
+[ 44.212045] ? __pfx_netlink_rcv_skb+0x10/0x10
+[ 44.212045] ? __pfx_sock_has_perm+0x10/0x10
+[ 44.212045] ? mutex_lock+0x8d/0xe0
+[ 44.212045] ? __pfx_mutex_lock+0x10/0x10
+[ 44.212045] xfrm_netlink_rcv+0x44/0x50
+[ 44.212045] netlink_unicast+0x36f/0x4c0
+[ 44.212045] ? __pfx_netlink_unicast+0x10/0x10
+[ 44.212045] ? netlink_recvmsg+0x500/0x660
+[ 44.212045] netlink_sendmsg+0x3b7/0x700
+[ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10
+[ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10
+[ 44.212045] sock_sendmsg+0xde/0xe0
+[ 44.212045] __sys_sendto+0x18d/0x230
+[ 44.212045] ? __pfx___sys_sendto+0x10/0x10
+[ 44.212045] ? rcu_core+0x44a/0xe10
+[ 44.212045] ? __rseq_handle_notify_resume+0x45b/0x740
+[ 44.212045] ? _raw_spin_lock_irq+0x81/0xe0
+[ 44.212045] ? __pfx___rseq_handle_notify_resume+0x10/0x10
+[ 44.212045] ? __pfx_restore_fpregs_from_fpstate+0x10/0x10
+[ 44.212045] ? __pfx_blkcg_maybe_throttle_current+0x10/0x10
+[ 44.212045] ? __pfx_task_work_run+0x10/0x10
+[ 44.212045] __x64_sys_sendto+0x71/0x90
+[ 44.212045] do_syscall_64+0x3f/0x90
+[ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc
+[ 44.212045] RIP: 0033:0x44b7da
+[ 44.212045] RSP: 002b:00007ffdc8838548 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
+[ 44.212045] RAX: ffffffffffffffda RBX: 00007ffdc8839978 RCX: 000000000044b7da
+[ 44.212045] RDX: 0000000000000038 RSI: 00007ffdc8838770 RDI: 0000000000000003
+[ 44.212045] RBP: 00007ffdc88385b0 R08: 00007ffdc883858c R09: 000000000000000c
+[ 44.212045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
+[ 44.212045] R13: 00007ffdc8839968 R14: 00000000004c37d0 R15: 0000000000000001
+[ 44.212045] </TASK>
+[ 44.212045]
+[ 44.212045] Allocated by task 97:
+[ 44.212045] kasan_save_stack+0x22/0x50
+[ 44.212045] kasan_set_track+0x25/0x30
+[ 44.212045] __kasan_kmalloc+0x7f/0x90
+[ 44.212045] __kmalloc_node_track_caller+0x5b/0x140
+[ 44.212045] kmemdup+0x21/0x50
+[ 44.212045] xfrm_dump_sa+0x17d/0x290
+[ 44.212045] netlink_dump+0x322/0x6c0
+[ 44.212045] __netlink_dump_start+0x353/0x430
+[ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410
+[ 44.212045] netlink_rcv_skb+0xd6/0x210
+[ 44.212045] xfrm_netlink_rcv+0x44/0x50
+[ 44.212045] netlink_unicast+0x36f/0x4c0
+[ 44.212045] netlink_sendmsg+0x3b7/0x700
+[ 44.212045] sock_sendmsg+0xde/0xe0
+[ 44.212045] __sys_sendto+0x18d/0x230
+[ 44.212045] __x64_sys_sendto+0x71/0x90
+[ 44.212045] do_syscall_64+0x3f/0x90
+[ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc
+[ 44.212045]
+[ 44.212045] The buggy address belongs to the object at ffff88800870f300
+[ 44.212045] which belongs to the cache kmalloc-64 of size 64
+[ 44.212045] The buggy address is located 32 bytes inside of
+[ 44.212045] allocated 36-byte region [ffff88800870f300, ffff88800870f324)
+[ 44.212045]
+[ 44.212045] The buggy address belongs to the physical page:
+[ 44.212045] page:00000000e4de16ee refcount:1 mapcount:0 mapping:000000000 ...
+[ 44.212045] flags: 0x100000000000200(slab|node=0|zone=1)
+[ 44.212045] page_type: 0xffffffff()
+[ 44.212045] raw: 0100000000000200 ffff888004c41640 dead000000000122 0000000000000000
+[ 44.212045] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
+[ 44.212045] page dumped because: kasan: bad access detected
+[ 44.212045]
+[ 44.212045] Memory state around the buggy address:
+[ 44.212045] ffff88800870f200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
+[ 44.212045] ffff88800870f280: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
+[ 44.212045] >ffff88800870f300: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc
+[ 44.212045] ^
+[ 44.212045] ffff88800870f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 44.212045] ffff88800870f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 44.212045] ==================================================================
+
+By investigating the code, we find the root cause of this OOB is the lack
+of checks in xfrm_dump_sa(). The buggy code allows a malicious user to pass
+arbitrary value of filter->splen/dplen. Hence, with crafted xfrm states,
+the attacker can achieve 8 bytes heap OOB read, which causes info leak.
+
+ if (attrs[XFRMA_ADDRESS_FILTER]) {
+ filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]),
+ sizeof(*filter), GFP_KERNEL);
+ if (filter == NULL)
+ return -ENOMEM;
+ // NO MORE CHECKS HERE !!!
+ }
+
+This patch fixes the OOB by adding necessary boundary checks, just like
+the code in pfkey_dump() function.
+
+Fixes: d3623099d350 ("ipsec: add support of limited SA dump")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_user.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 2d68a173b2273..3e32fe99a6818 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1250,6 +1250,15 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
+ sizeof(*filter), GFP_KERNEL);
+ if (filter == NULL)
+ return -ENOMEM;
++
++ /* see addr_match(), (prefix length >> 5) << 2
++ * will be used to compare xfrm_address_t
++ */
++ if (filter->splen > (sizeof(xfrm_address_t) << 3) ||
++ filter->dplen > (sizeof(xfrm_address_t) << 3)) {
++ kfree(filter);
++ return -EINVAL;
++ }
+ }
+
+ if (attrs[XFRMA_PROTO])
+--
+2.40.1
+
--- /dev/null
+From c97d091f2b8dc058bcabb8b590bc851afe912e77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Aug 2023 13:05:16 +0200
+Subject: netfilter: nf_tables: deactivate catchall elements in next generation
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 90e5b3462efa37b8bba82d7c4e63683856e188af ]
+
+When flushing, individual set elements are disabled in the next
+generation via the ->flush callback.
+
+Catchall elements are not disabled. This is incorrect and may lead to
+double-deactivations of catchall elements which then results in memory
+leaks:
+
+WARNING: CPU: 1 PID: 3300 at include/net/netfilter/nf_tables.h:1172 nft_map_deactivate+0x549/0x730
+CPU: 1 PID: 3300 Comm: nft Not tainted 6.5.0-rc5+ #60
+RIP: 0010:nft_map_deactivate+0x549/0x730
+ [..]
+ ? nft_map_deactivate+0x549/0x730
+ nf_tables_delset+0xb66/0xeb0
+
+(the warn is due to nft_use_dec() detecting underflow).
+
+Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
+Reported-by: lonial con <kongln9170@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index f6e6273838859..4c2df7af73f76 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -6874,6 +6874,7 @@ static int nft_set_catchall_flush(const struct nft_ctx *ctx,
+ ret = __nft_set_catchall_flush(ctx, set, &elem);
+ if (ret < 0)
+ break;
++ nft_set_elem_change_active(ctx->net, set, ext);
+ }
+
+ return ret;
+--
+2.40.1
+
--- /dev/null
+From 9e25fbf467dd5bbc226b15974777b72b48cb9071 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Aug 2023 20:40:17 +0200
+Subject: netfilter: nf_tables: fix false-positive lockdep splat
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit b9f052dc68f69dac89fe1e24693354c033daa091 ]
+
+->abort invocation may cause splat on debug kernels:
+
+WARNING: suspicious RCU usage
+net/netfilter/nft_set_pipapo.c:1697 suspicious rcu_dereference_check() usage!
+[..]
+rcu_scheduler_active = 2, debug_locks = 1
+1 lock held by nft/133554: [..] (nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid
+[..]
+ lockdep_rcu_suspicious+0x1ad/0x260
+ nft_pipapo_abort+0x145/0x180
+ __nf_tables_abort+0x5359/0x63d0
+ nf_tables_abort+0x24/0x40
+ nfnetlink_rcv+0x1a0a/0x22c0
+ netlink_unicast+0x73c/0x900
+ netlink_sendmsg+0x7f0/0xc20
+ ____sys_sendmsg+0x48d/0x760
+
+Transaction mutex is held, so parallel updates are not possible.
+Switch to _protected and check mutex is held for lockdep enabled builds.
+
+Fixes: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_set_pipapo.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
+index a81829c10feab..32cfd0a84b0e2 100644
+--- a/net/netfilter/nft_set_pipapo.c
++++ b/net/netfilter/nft_set_pipapo.c
+@@ -1665,6 +1665,17 @@ static void nft_pipapo_commit(const struct nft_set *set)
+ priv->clone = new_clone;
+ }
+
++static bool nft_pipapo_transaction_mutex_held(const struct nft_set *set)
++{
++#ifdef CONFIG_PROVE_LOCKING
++ const struct net *net = read_pnet(&set->net);
++
++ return lockdep_is_held(&nft_pernet(net)->commit_mutex);
++#else
++ return true;
++#endif
++}
++
+ static void nft_pipapo_abort(const struct nft_set *set)
+ {
+ struct nft_pipapo *priv = nft_set_priv(set);
+@@ -1673,7 +1684,7 @@ static void nft_pipapo_abort(const struct nft_set *set)
+ if (!priv->dirty)
+ return;
+
+- m = rcu_dereference(priv->match);
++ m = rcu_dereference_protected(priv->match, nft_pipapo_transaction_mutex_held(set));
+
+ new_clone = pipapo_clone(m);
+ if (IS_ERR(new_clone))
+--
+2.40.1
+
--- /dev/null
+From 8d1edc29239a7138ce2047350f646aeabcebfc2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Aug 2023 15:39:02 +0200
+Subject: netfilter: nft_dynset: disallow object maps
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 23185c6aed1ffb8fc44087880ba2767aba493779 ]
+
+Do not allow to insert elements from datapath to objects maps.
+
+Fixes: 8aeff920dcc9 ("netfilter: nf_tables: add stateful object reference to set elements")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_dynset.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
+index e65a83328b554..cf9a1ae87d9b1 100644
+--- a/net/netfilter/nft_dynset.c
++++ b/net/netfilter/nft_dynset.c
+@@ -191,6 +191,9 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
+ if (IS_ERR(set))
+ return PTR_ERR(set);
+
++ if (set->flags & NFT_SET_OBJECT)
++ return -EOPNOTSUPP;
++
+ if (set->ops->update == NULL)
+ return -EOPNOTSUPP;
+
+--
+2.40.1
+
--- /dev/null
+From 4b975d228cd7179852df4434fe6a1de32df11b2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Aug 2023 17:01:13 +0200
+Subject: octeon_ep: cancel ctrl_mbox_task after intr_poll_task
+
+From: Michal Schmidt <mschmidt@redhat.com>
+
+[ Upstream commit 607a7a45cdf38c1901e0d81e4e00a2a88786330a ]
+
+intr_poll_task may queue ctrl_mbox_task. The function
+octep_poll_non_ioq_interrupts_cn93_pf does this.
+
+When removing the driver and canceling these two works, cancel
+ctrl_mbox_task last to guarantee it does not run anymore.
+
+Fixes: 24d4333233b3 ("octeon_ep: poll for control messages")
+Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
+Link: https://lore.kernel.org/r/20230810150114.107765-4-mschmidt@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+index d4ec46d1c8cfb..2342c821fc9b0 100644
+--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+@@ -1121,12 +1121,12 @@ static void octep_remove(struct pci_dev *pdev)
+ if (!oct)
+ return;
+
+- cancel_work_sync(&oct->ctrl_mbox_task);
+ netdev = oct->netdev;
+ if (netdev->reg_state == NETREG_REGISTERED)
+ unregister_netdev(netdev);
+
+ cancel_work_sync(&oct->tx_timeout_task);
++ cancel_work_sync(&oct->ctrl_mbox_task);
+ octep_device_cleanup(oct);
+ pci_release_mem_regions(pdev);
+ free_netdev(netdev);
+--
+2.40.1
+
--- /dev/null
+From 3244ee57c9b03c1570ec46e23a283e7997a3c120 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Aug 2023 17:01:12 +0200
+Subject: octeon_ep: cancel tx_timeout_task later in remove sequence
+
+From: Michal Schmidt <mschmidt@redhat.com>
+
+[ Upstream commit 28458c80006bb4e993a09fc094094a8578cad292 ]
+
+tx_timeout_task is canceled too early when removing the driver. Nothing
+prevents .ndo_tx_timeout from triggering and queuing the work again.
+
+Better cancel it after the netdev is unregistered.
+It's harmless for octep_tx_timeout_task to run in the window between the
+unregistration and cancelation, because it checks netif_running.
+
+Fixes: 862cd659a6fb ("octeon_ep: Add driver framework and device initialization")
+Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
+Link: https://lore.kernel.org/r/20230810150114.107765-3-mschmidt@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+index 8979dd05e873f..d4ec46d1c8cfb 100644
+--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
++++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+@@ -1121,12 +1121,12 @@ static void octep_remove(struct pci_dev *pdev)
+ if (!oct)
+ return;
+
+- cancel_work_sync(&oct->tx_timeout_task);
+ cancel_work_sync(&oct->ctrl_mbox_task);
+ netdev = oct->netdev;
+ if (netdev->reg_state == NETREG_REGISTERED)
+ unregister_netdev(netdev);
+
++ cancel_work_sync(&oct->tx_timeout_task);
+ octep_device_cleanup(oct);
+ pci_release_mem_regions(pdev);
+ free_netdev(netdev);
+--
+2.40.1
+
--- /dev/null
+From 5dcf8f524be855bea9a68297047148eae1594918 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Aug 2023 20:37:11 +0530
+Subject: qede: fix firmware halt over suspend and resume
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit 2eb9625a3a32251ecea470cd576659a3a03b4e59 ]
+
+While performing certain power-off sequences, PCI drivers are
+called to suspend and resume their underlying devices through
+PCI PM (power management) interface. However this NIC hardware
+does not support PCI PM suspend/resume operations so system wide
+suspend/resume leads to bad MFW (management firmware) state which
+causes various follow-up errors in driver when communicating with
+the device/firmware afterwards.
+
+To fix this driver implements PCI PM suspend handler to indicate
+unsupported operation to the PCI subsystem explicitly, thus avoiding
+system to go into suspended/standby mode.
+
+Without this fix device/firmware does not recover unless system
+is power cycled.
+
+Fixes: 2950219d87b0 ("qede: Add basic network device support")
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Alok Prasad <palok@marvell.com>
+Reviewed-by: John Meneghini <jmeneghi@redhat.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20230816150711.59035-1-manishc@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qede/qede_main.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
+index e8d427c7d1cff..dc43e74147fbf 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
+@@ -177,6 +177,15 @@ static int qede_sriov_configure(struct pci_dev *pdev, int num_vfs_param)
+ }
+ #endif
+
++static int __maybe_unused qede_suspend(struct device *dev)
++{
++ dev_info(dev, "Device does not support suspend operation\n");
++
++ return -EOPNOTSUPP;
++}
++
++static DEFINE_SIMPLE_DEV_PM_OPS(qede_pm_ops, qede_suspend, NULL);
++
+ static const struct pci_error_handlers qede_err_handler = {
+ .error_detected = qede_io_error_detected,
+ };
+@@ -191,6 +200,7 @@ static struct pci_driver qede_pci_driver = {
+ .sriov_configure = qede_sriov_configure,
+ #endif
+ .err_handler = &qede_err_handler,
++ .driver.pm = &qede_pm_ops,
+ };
+
+ static struct qed_eth_cb_ops qede_ll_ops = {
+--
+2.40.1
+
--- /dev/null
+From d832c3165a2f945488425365368bca3e67389116 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Aug 2023 17:06:04 +0200
+Subject: riscv: uaccess: Return the number of bytes effectively not copied
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexandre Ghiti <alexghiti@rivosinc.com>
+
+[ Upstream commit 4b05b993900dd3eba0fc83ef5c5ddc7d65d786c6 ]
+
+It was reported that the riscv kernel hangs while executing the test
+in [1].
+
+Indeed, the test hangs when trying to write a buffer to a file. The
+problem is that the riscv implementation of raw_copy_from_user() does not
+return the correct number of bytes not written when an exception happens
+and is fixed up, instead it always returns the initial size to copy,
+even if some bytes were actually copied.
+
+generic_perform_write() pre-faults the user pages and bails out if nothing
+can be written, otherwise it will access the userspace buffer: here the
+riscv implementation keeps returning it was not able to copy any byte
+though the pre-faulting indicates otherwise. So generic_perform_write()
+keeps retrying to access the user memory and ends up in an infinite
+loop.
+
+Note that before the commit mentioned in [1] that introduced this
+regression, it worked because generic_perform_write() would bail out if
+only one byte could not be written.
+
+So fix this by returning the number of bytes effectively not written in
+__asm_copy_[to|from]_user() and __clear_user(), as it is expected.
+
+Link: https://lore.kernel.org/linux-riscv/20230309151841.bomov6hq3ybyp42a@debian/ [1]
+Fixes: ebcbd75e3962 ("riscv: Fix the bug in memory access fixup code")
+Reported-by: Bo YU <tsu.yubo@gmail.com>
+Closes: https://lore.kernel.org/linux-riscv/20230309151841.bomov6hq3ybyp42a@debian/#t
+Reported-by: Aurelien Jarno <aurelien@aurel32.net>
+Closes: https://lore.kernel.org/linux-riscv/ZNOnCakhwIeue3yr@aurel32.net/
+Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Reviewed-by: Björn Töpel <bjorn@rivosinc.com>
+Tested-by: Aurelien Jarno <aurelien@aurel32.net>
+Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+Link: https://lore.kernel.org/r/20230811150604.1621784-1-alexghiti@rivosinc.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/lib/uaccess.S | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/lib/uaccess.S b/arch/riscv/lib/uaccess.S
+index ec486e5369d9b..09b47ebacf2e8 100644
+--- a/arch/riscv/lib/uaccess.S
++++ b/arch/riscv/lib/uaccess.S
+@@ -17,8 +17,11 @@ ENTRY(__asm_copy_from_user)
+ li t6, SR_SUM
+ csrs CSR_STATUS, t6
+
+- /* Save for return value */
+- mv t5, a2
++ /*
++ * Save the terminal address which will be used to compute the number
++ * of bytes copied in case of a fixup exception.
++ */
++ add t5, a0, a2
+
+ /*
+ * Register allocation for code below:
+@@ -176,7 +179,7 @@ ENTRY(__asm_copy_from_user)
+ 10:
+ /* Disable access to user memory */
+ csrc CSR_STATUS, t6
+- mv a0, t5
++ sub a0, t5, a0
+ ret
+ ENDPROC(__asm_copy_to_user)
+ ENDPROC(__asm_copy_from_user)
+@@ -228,7 +231,7 @@ ENTRY(__clear_user)
+ 11:
+ /* Disable access to user memory */
+ csrc CSR_STATUS, t6
+- mv a0, a1
++ sub a0, a3, a0
+ ret
+ ENDPROC(__clear_user)
+ EXPORT_SYMBOL(__clear_user)
+--
+2.40.1
+
--- /dev/null
+From 2637f8fc543b5ad239c88198b2e30b4ea1f148ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Aug 2023 17:59:27 +0200
+Subject: selftests: mirror_gre_changes: Tighten up the TTL test match
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit 855067defa36b1f9effad8c219d9a85b655cf500 ]
+
+This test verifies whether the encapsulated packets have the correct
+configured TTL. It does so by sending ICMP packets through the test
+topology and mirroring them to a gretap netdevice. On a busy host
+however, more than just the test ICMP packets may end up flowing
+through the topology, get mirrored, and counted. This leads to
+potential spurious failures as the test observes much more mirrored
+packets than the sent test packets, and assumes a bug.
+
+Fix this by tightening up the mirror action match. Change it from
+matchall to a flower classifier matching on ICMP packets specifically.
+
+Fixes: 45315673e0c5 ("selftests: forwarding: Test changes in mirror-to-gretap")
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Tested-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/forwarding/mirror_gre_changes.sh | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh b/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh
+index aff88f78e3391..5ea9d63915f77 100755
+--- a/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh
++++ b/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh
+@@ -72,7 +72,8 @@ test_span_gre_ttl()
+
+ RET=0
+
+- mirror_install $swp1 ingress $tundev "matchall $tcflags"
++ mirror_install $swp1 ingress $tundev \
++ "prot ip flower $tcflags ip_prot icmp"
+ tc filter add dev $h3 ingress pref 77 prot $prot \
+ flower skip_hw ip_ttl 50 action pass
+
+--
+2.40.1
+
btrfs-fix-bug_on-condition-in-btrfs_cancel_balance.patch
i2c-designware-correct-length-byte-validation-logic.patch
i2c-designware-handle-invalid-smbus-block-data-response-length-value.patch
+net-xfrm-fix-xfrm_address_filter-oob-read.patch
+net-af_key-fix-sadb_x_filter-validation.patch
+net-xfrm-amend-xfrma_sec_ctx-nla_policy-structure.patch
+xfrm-fix-slab-use-after-free-in-decode_session6.patch
+ip6_vti-fix-slab-use-after-free-in-decode_session6.patch
+ip_vti-fix-potential-slab-use-after-free-in-decode_s.patch
+xfrm-add-null-check-in-xfrm_update_ae_params.patch
+xfrm-add-forgotten-nla_policy-for-xfrma_mtimer_thres.patch
+virtio_net-notify-mac-address-change-on-device-initi.patch
+virtio-net-set-queues-after-driver_ok.patch
+net-pcs-add-missing-put_device-call-in-miic_create.patch
+net-phy-fix-irq-based-wake-on-lan-over-hibernate-pow.patch
+selftests-mirror_gre_changes-tighten-up-the-ttl-test.patch
+drm-panel-simple-fix-auo-g121ean01-panel-timings-acc.patch
+net-macb-in-zynqmp-resume-always-configure-ps-gtr-fo.patch
+octeon_ep-cancel-tx_timeout_task-later-in-remove-seq.patch
+octeon_ep-cancel-ctrl_mbox_task-after-intr_poll_task.patch
+netfilter-nf_tables-fix-false-positive-lockdep-splat.patch
+netfilter-nf_tables-deactivate-catchall-elements-in-.patch
+ipvs-fix-racy-memcpy-in-proc_do_sync_threshold.patch
+netfilter-nft_dynset-disallow-object-maps.patch
+net-phy-broadcom-stub-c45-read-write-for-54810.patch
+team-fix-incorrect-deletion-of-eth_p_8021ad-protocol.patch
+net-openvswitch-reject-negative-ifindex.patch
+iavf-fix-fdir-rule-fields-masks-validation.patch
+i40e-fix-misleading-debug-logs.patch
+net-dsa-mv88e6xxx-wait-for-eeprom-done-before-hw-res.patch
+sfc-don-t-unregister-flow_indr-if-it-was-never-regis.patch
+sock-fix-misuse-of-sk_under_memory_pressure.patch
+net-do-not-allow-gso_size-to-be-set-to-gso_by_frags.patch
+qede-fix-firmware-halt-over-suspend-and-resume.patch
+ice-block-switchdev-mode-when-adq-is-active-and-vice.patch
+bus-ti-sysc-flush-posted-write-on-enable-before-rese.patch
+arm64-dts-qcom-qrb5165-rb5-fix-thermal-zone-conflict.patch
+arm64-dts-rockchip-disable-hs400-for-emmc-on-rock-pi.patch
+arm64-dts-rockchip-disable-hs400-for-emmc-on-rock-4c.patch
+arm-dts-imx-align-led-node-names-with-dtschema.patch
+arm-dts-imx6-phytec-fix-rtc-interrupt-level.patch
+arm64-dts-imx8mm-drop-csi1-phy-reference-clock-confi.patch
+arm-dts-imx-set-default-tuning-step-for-imx6sx-usdhc.patch
+arm64-dts-imx93-fix-anatop-node-size.patch
+asoc-rt5665-add-missed-regulator_bulk_disable.patch
+asoc-meson-axg-tdm-formatter-fix-channel-slot-alloca.patch
+alsa-hda-realtek-add-quirks-for-hp-g11-laptops.patch
+soc-aspeed-uart-routing-use-__sysfs_match_string.patch
+soc-aspeed-socinfo-add-kfree-for-kstrdup.patch
+x86-srso-disable-the-mitigation-on-unaffected-config.patch
+x86-cpu-fix-__x86_return_thunk-symbol-type.patch
+x86-cpu-fix-up-srso_safe_ret-and-__x86_return_thunk.patch
+alsa-hda-realtek-remodified-3k-pull-low-procedure.patch
+riscv-uaccess-return-the-number-of-bytes-effectively.patch
+x86-static_call-fix-__static_call_fixup.patch
+x86-srso-correct-the-mitigation-status-when-smt-is-d.patch
--- /dev/null
+From 35cc467dc7e6bf68fbe4af1928aabc486b359de6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Aug 2023 16:57:27 +0100
+Subject: sfc: don't unregister flow_indr if it was never registered
+
+From: Edward Cree <ecree.xilinx@gmail.com>
+
+[ Upstream commit fa165e1949976704500a442faeef8d9596faee76 ]
+
+In efx_init_tc(), move the setting of efx->tc->up after the
+ flow_indr_dev_register() call, so that if it fails, efx_fini_tc()
+ won't call flow_indr_dev_unregister().
+
+Fixes: 5b2e12d51bd8 ("sfc: bind indirect blocks for TC offload on EF100")
+Suggested-by: Pieter Jansen van Vuuren <pieter.jansen-van-vuuren@amd.com>
+Reviewed-by: Martin Habets <habetsm.xilinx@gmail.com>
+Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>
+Link: https://lore.kernel.org/r/a81284d7013aba74005277bd81104e4cfbea3f6f.1692114888.git.ecree.xilinx@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/tc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/sfc/tc.c b/drivers/net/ethernet/sfc/tc.c
+index 3478860d40232..d312147cd2dd7 100644
+--- a/drivers/net/ethernet/sfc/tc.c
++++ b/drivers/net/ethernet/sfc/tc.c
+@@ -603,10 +603,10 @@ int efx_init_tc(struct efx_nic *efx)
+ rc = efx_tc_configure_rep_mport(efx);
+ if (rc)
+ return rc;
+- efx->tc->up = true;
+ rc = flow_indr_dev_register(efx_tc_indr_setup_cb, efx);
+ if (rc)
+ return rc;
++ efx->tc->up = true;
+ return 0;
+ }
+
+--
+2.40.1
+
--- /dev/null
+From ebbbbe0feebaa42ec912de3d7f01e246753ab37b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Aug 2023 22:01:04 +0930
+Subject: soc: aspeed: socinfo: Add kfree for kstrdup
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 6e6d847a8ce18ab2fbec4f579f682486a82d2c6b ]
+
+Add kfree() in the later error handling in order to avoid memory leak.
+
+Fixes: e0218dca5787 ("soc: aspeed: Add soc info driver")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20230707021625.7727-1-jiasheng@iscas.ac.cn
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Link: https://lore.kernel.org/r/20230810123104.231167-1-joel@jms.id.au
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-socinfo.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
+index 1ca140356a084..3f759121dc00a 100644
+--- a/drivers/soc/aspeed/aspeed-socinfo.c
++++ b/drivers/soc/aspeed/aspeed-socinfo.c
+@@ -137,6 +137,7 @@ static int __init aspeed_socinfo_init(void)
+
+ soc_dev = soc_device_register(attrs);
+ if (IS_ERR(soc_dev)) {
++ kfree(attrs->machine);
+ kfree(attrs->soc_id);
+ kfree(attrs->serial_number);
+ kfree(attrs);
+--
+2.40.1
+
--- /dev/null
+From f056abe2e5562efc25553f30e7b42557c845a735 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Aug 2023 21:59:41 +0930
+Subject: soc: aspeed: uart-routing: Use __sysfs_match_string
+
+From: Zev Weiss <zev@bewilderbeest.net>
+
+[ Upstream commit e4ad279ae345413d900d791f2f618d0a1cd0d791 ]
+
+The existing use of match_string() caused it to reject 'echo foo' due
+to the implicitly appended newline, which was somewhat ergonomically
+awkward and inconsistent with typical sysfs behavior. Using the
+__sysfs_* variant instead provides more convenient and consistent
+linefeed-agnostic behavior.
+
+Signed-off-by: Zev Weiss <zev@bewilderbeest.net>
+Fixes: c6807970c3bc ("soc: aspeed: Add UART routing support")
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Link: https://lore.kernel.org/r/20230628083735.19946-2-zev@bewilderbeest.net
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Link: https://lore.kernel.org/r/20230810122941.231085-1-joel@jms.id.au
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-uart-routing.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/aspeed/aspeed-uart-routing.c b/drivers/soc/aspeed/aspeed-uart-routing.c
+index ef8b24fd18518..59123e1f27acb 100644
+--- a/drivers/soc/aspeed/aspeed-uart-routing.c
++++ b/drivers/soc/aspeed/aspeed-uart-routing.c
+@@ -524,7 +524,7 @@ static ssize_t aspeed_uart_routing_store(struct device *dev,
+ struct aspeed_uart_routing_selector *sel = to_routing_selector(attr);
+ int val;
+
+- val = match_string(sel->options, -1, buf);
++ val = __sysfs_match_string(sel->options, -1, buf);
+ if (val < 0) {
+ dev_err(dev, "invalid value \"%s\"\n", buf);
+ return -EINVAL;
+--
+2.40.1
+
--- /dev/null
+From ae1b981463b47a1b05c682b02d9ac0ae5db1bcd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Aug 2023 17:12:22 +0800
+Subject: sock: Fix misuse of sk_under_memory_pressure()
+
+From: Abel Wu <wuyun.abel@bytedance.com>
+
+[ Upstream commit 2d0c88e84e483982067a82073f6125490ddf3614 ]
+
+The status of global socket memory pressure is updated when:
+
+ a) __sk_mem_raise_allocated():
+
+ enter: sk_memory_allocated(sk) > sysctl_mem[1]
+ leave: sk_memory_allocated(sk) <= sysctl_mem[0]
+
+ b) __sk_mem_reduce_allocated():
+
+ leave: sk_under_memory_pressure(sk) &&
+ sk_memory_allocated(sk) < sysctl_mem[0]
+
+So the conditions of leaving global pressure are inconstant, which
+may lead to the situation that one pressured net-memcg prevents the
+global pressure from being cleared when there is indeed no global
+pressure, thus the global constrains are still in effect unexpectedly
+on the other sockets.
+
+This patch fixes this by ignoring the net-memcg's pressure when
+deciding whether should leave global memory pressure.
+
+Fixes: e1aab161e013 ("socket: initial cgroup code.")
+Signed-off-by: Abel Wu <wuyun.abel@bytedance.com>
+Acked-by: Shakeel Butt <shakeelb@google.com>
+Link: https://lore.kernel.org/r/20230816091226.1542-1-wuyun.abel@bytedance.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sock.h | 6 ++++++
+ net/core/sock.c | 2 +-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 1bbdddcf61542..699408944952c 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1445,6 +1445,12 @@ static inline bool sk_has_memory_pressure(const struct sock *sk)
+ return sk->sk_prot->memory_pressure != NULL;
+ }
+
++static inline bool sk_under_global_memory_pressure(const struct sock *sk)
++{
++ return sk->sk_prot->memory_pressure &&
++ !!*sk->sk_prot->memory_pressure;
++}
++
+ static inline bool sk_under_memory_pressure(const struct sock *sk)
+ {
+ if (!sk->sk_prot->memory_pressure)
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 3b5304f084ef3..509773919d302 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3099,7 +3099,7 @@ void __sk_mem_reduce_allocated(struct sock *sk, int amount)
+ if (mem_cgroup_sockets_enabled && sk->sk_memcg)
+ mem_cgroup_uncharge_skmem(sk->sk_memcg, amount);
+
+- if (sk_under_memory_pressure(sk) &&
++ if (sk_under_global_memory_pressure(sk) &&
+ (sk_memory_allocated(sk) < sk_prot_mem_limits(sk, 0)))
+ sk_leave_memory_pressure(sk);
+ }
+--
+2.40.1
+
--- /dev/null
+From a65d5472e335a5918fc4382e47bc937994618708 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Aug 2023 11:23:01 +0800
+Subject: team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+[ Upstream commit dafcbce07136d799edc4c67f04f9fd69ff1eac1f ]
+
+Similar to commit 01f4fd270870 ("bonding: Fix incorrect deletion of
+ETH_P_8021AD protocol vid from slaves"), we can trigger BUG_ON(!vlan_info)
+in unregister_vlan_dev() with the following testcase:
+
+ # ip netns add ns1
+ # ip netns exec ns1 ip link add team1 type team
+ # ip netns exec ns1 ip link add team_slave type veth peer veth2
+ # ip netns exec ns1 ip link set team_slave master team1
+ # ip netns exec ns1 ip link add link team_slave name team_slave.10 type vlan id 10 protocol 802.1ad
+ # ip netns exec ns1 ip link add link team1 name team1.10 type vlan id 10 protocol 802.1ad
+ # ip netns exec ns1 ip link set team_slave nomaster
+ # ip netns del ns1
+
+Add S-VLAN tag related features support to team driver. So the team driver
+will always propagate the VLAN info to its slaves.
+
+Fixes: 8ad227ff89a7 ("net: vlan: add 802.1ad support")
+Suggested-by: Ido Schimmel <idosch@idosch.org>
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20230814032301.2804971-1-william.xuanziyang@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/team/team.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 509ba706781ed..921ca59822b0f 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -2200,7 +2200,9 @@ static void team_setup(struct net_device *dev)
+
+ dev->hw_features = TEAM_VLAN_FEATURES |
+ NETIF_F_HW_VLAN_CTAG_RX |
+- NETIF_F_HW_VLAN_CTAG_FILTER;
++ NETIF_F_HW_VLAN_CTAG_FILTER |
++ NETIF_F_HW_VLAN_STAG_RX |
++ NETIF_F_HW_VLAN_STAG_FILTER;
+
+ dev->hw_features |= NETIF_F_GSO_ENCAP_ALL;
+ dev->features |= dev->hw_features;
+--
+2.40.1
+
--- /dev/null
+From 129804372240867a3dc05361f40310fda8add320 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Aug 2023 23:12:56 -0400
+Subject: virtio-net: set queues after driver_ok
+
+From: Jason Wang <jasowang@redhat.com>
+
+[ Upstream commit 51b813176f098ff61bd2833f627f5319ead098a5 ]
+
+Commit 25266128fe16 ("virtio-net: fix race between set queues and
+probe") tries to fix the race between set queues and probe by calling
+_virtnet_set_queues() before DRIVER_OK is set. This violates virtio
+spec. Fixing this by setting queues after virtio_device_ready().
+
+Note that rtnl needs to be held for userspace requests to change the
+number of queues. So we are serialized in this way.
+
+Fixes: 25266128fe16 ("virtio-net: fix race between set queues and probe")
+Reported-by: Dragos Tatulea <dtatulea@nvidia.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index b7a4df4bab817..55c20ccb791ea 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -3942,8 +3942,6 @@ static int virtnet_probe(struct virtio_device *vdev)
+ if (vi->has_rss || vi->has_rss_hash_report)
+ virtnet_init_default_rss(vi);
+
+- _virtnet_set_queues(vi, vi->curr_queue_pairs);
+-
+ /* serialize netdev register + virtio_device_ready() with ndo_open() */
+ rtnl_lock();
+
+@@ -3956,6 +3954,8 @@ static int virtnet_probe(struct virtio_device *vdev)
+
+ virtio_device_ready(vdev);
+
++ _virtnet_set_queues(vi, vi->curr_queue_pairs);
++
+ /* a random MAC address has been assigned, notify the device.
+ * We don't fail probe if VIRTIO_NET_F_CTRL_MAC_ADDR is not there
+ * because many devices work fine without getting MAC explicitly
+--
+2.40.1
+
--- /dev/null
+From cb40edc14debaa85e2cf079719fddee7fa769b61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 21:45:00 +0100
+Subject: virtio_net: notify MAC address change on device initialization
+
+From: Laurent Vivier <lvivier@redhat.com>
+
+[ Upstream commit 9f62d221a4b0aa6a8d2a18053a0ca349c025297c ]
+
+In virtnet_probe(), if the device doesn't provide a MAC address the
+driver assigns a random one.
+As we modify the MAC address we need to notify the device to allow it
+to update all the related information.
+
+The problem can be seen with vDPA and mlx5_vdpa driver as it doesn't
+assign a MAC address by default. The virtio_net device uses a random
+MAC address (we can see it with "ip link"), but we can't ping a net
+namespace from another one using the virtio-vdpa device because the
+new MAC address has not been provided to the hardware:
+RX packets are dropped since they don't go through the receive filters,
+TX packets go through unaffected.
+
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 51b813176f09 ("virtio-net: set queues after driver_ok")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 075d5d42f5eb6..b7a4df4bab817 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -3825,6 +3825,8 @@ static int virtnet_probe(struct virtio_device *vdev)
+ eth_hw_addr_set(dev, addr);
+ } else {
+ eth_hw_addr_random(dev);
++ dev_info(&vdev->dev, "Assigned random MAC address %pM\n",
++ dev->dev_addr);
+ }
+
+ /* Set up our device-specific information */
+@@ -3954,6 +3956,24 @@ static int virtnet_probe(struct virtio_device *vdev)
+
+ virtio_device_ready(vdev);
+
++ /* a random MAC address has been assigned, notify the device.
++ * We don't fail probe if VIRTIO_NET_F_CTRL_MAC_ADDR is not there
++ * because many devices work fine without getting MAC explicitly
++ */
++ if (!virtio_has_feature(vdev, VIRTIO_NET_F_MAC) &&
++ virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
++ struct scatterlist sg;
++
++ sg_init_one(&sg, dev->dev_addr, dev->addr_len);
++ if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MAC,
++ VIRTIO_NET_CTRL_MAC_ADDR_SET, &sg)) {
++ pr_debug("virtio_net: setting MAC address failed\n");
++ rtnl_unlock();
++ err = -EINVAL;
++ goto free_unregister_netdev;
++ }
++ }
++
+ rtnl_unlock();
+
+ err = virtnet_cpu_notif_add(vi);
+--
+2.40.1
+
--- /dev/null
+From 824485511e11da5e7c94033dab59fc541b266e3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Aug 2023 13:44:27 +0200
+Subject: x86/cpu: Fix __x86_return_thunk symbol type
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 77f67119004296a9b2503b377d610e08b08afc2a ]
+
+Commit
+
+ fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
+
+reimplemented __x86_return_thunk with a mix of SYM_FUNC_START and
+SYM_CODE_END, this is not a sane combination.
+
+Since nothing should ever actually 'CALL' this, make it consistently
+CODE.
+
+Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230814121148.571027074@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/lib/retpoline.S | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S
+index 30e76fab678a5..591d4a2419b55 100644
+--- a/arch/x86/lib/retpoline.S
++++ b/arch/x86/lib/retpoline.S
+@@ -207,7 +207,9 @@ SYM_CODE_END(srso_safe_ret)
+ SYM_FUNC_END(srso_untrain_ret)
+ __EXPORT_THUNK(srso_untrain_ret)
+
+-SYM_FUNC_START(__x86_return_thunk)
++SYM_CODE_START(__x86_return_thunk)
++ UNWIND_HINT_FUNC
++ ANNOTATE_NOENDBR
+ ALTERNATIVE_2 "jmp __ret", "call srso_safe_ret", X86_FEATURE_SRSO, \
+ "call srso_safe_ret_alias", X86_FEATURE_SRSO_ALIAS
+ int3
+--
+2.40.1
+
--- /dev/null
+From f6d1cb7cfaefec06c3b26fc414351f9700385dbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Aug 2023 13:44:28 +0200
+Subject: x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit af023ef335f13c8b579298fc432daeef609a9e60 ]
+
+ vmlinux.o: warning: objtool: srso_untrain_ret() falls through to next function __x86_return_skl()
+ vmlinux.o: warning: objtool: __x86_return_thunk() falls through to next function __x86_return_skl()
+
+This is because these functions (can) end with CALL, which objtool
+does not consider a terminating instruction. Therefore, replace the
+INT3 instruction (which is a non-fatal trap) with UD2 (which is a
+fatal-trap).
+
+This indicates execution will not continue past this point.
+
+Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230814121148.637802730@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/lib/retpoline.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S
+index 591d4a2419b55..271f6560448de 100644
+--- a/arch/x86/lib/retpoline.S
++++ b/arch/x86/lib/retpoline.S
+@@ -202,7 +202,7 @@ SYM_INNER_LABEL(srso_safe_ret, SYM_L_GLOBAL)
+ int3
+ lfence
+ call srso_safe_ret
+- int3
++ ud2
+ SYM_CODE_END(srso_safe_ret)
+ SYM_FUNC_END(srso_untrain_ret)
+ __EXPORT_THUNK(srso_untrain_ret)
+@@ -212,7 +212,7 @@ SYM_CODE_START(__x86_return_thunk)
+ ANNOTATE_NOENDBR
+ ALTERNATIVE_2 "jmp __ret", "call srso_safe_ret", X86_FEATURE_SRSO, \
+ "call srso_safe_ret_alias", X86_FEATURE_SRSO_ALIAS
+- int3
++ ud2
+ SYM_CODE_END(__x86_return_thunk)
+ EXPORT_SYMBOL(__x86_return_thunk)
+
+--
+2.40.1
+
--- /dev/null
+From b705656ee1f3dc6f3d0cc32dfa341beaf6c8feee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Aug 2023 11:53:13 +0200
+Subject: x86/srso: Correct the mitigation status when SMT is disabled
+
+From: Borislav Petkov (AMD) <bp@alien8.de>
+
+[ Upstream commit 6405b72e8d17bd1875a56ae52d23ec3cd51b9d66 ]
+
+Specify how is SRSO mitigated when SMT is disabled. Also, correct the
+SMT check for that.
+
+Fixes: e9fbc47b818b ("x86/srso: Disable the mitigation on unaffected configurations")
+Suggested-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Link: https://lore.kernel.org/r/20230814200813.p5czl47zssuej7nv@treble
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/bugs.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 97a4819ad8386..f07947f37dfd0 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -2388,8 +2388,7 @@ static void __init srso_select_mitigation(void)
+ * Zen1/2 with SMT off aren't vulnerable after the right
+ * IBPB microcode has been applied.
+ */
+- if ((boot_cpu_data.x86 < 0x19) &&
+- (!cpu_smt_possible() || (cpu_smt_control == CPU_SMT_DISABLED))) {
++ if (boot_cpu_data.x86 < 0x19 && !cpu_smt_possible()) {
+ setup_force_cpu_cap(X86_FEATURE_SRSO_NO);
+ return;
+ }
+@@ -2675,7 +2674,7 @@ static ssize_t gds_show_state(char *buf)
+ static ssize_t srso_show_state(char *buf)
+ {
+ if (boot_cpu_has(X86_FEATURE_SRSO_NO))
+- return sysfs_emit(buf, "Not affected\n");
++ return sysfs_emit(buf, "Mitigation: SMT disabled\n");
+
+ return sysfs_emit(buf, "%s%s\n",
+ srso_strings[srso_mitigation],
+--
+2.40.1
+
--- /dev/null
+From b7b59c5c2bb9ec66b57428e5594b89331f598960 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Aug 2023 12:39:34 +0200
+Subject: x86/srso: Disable the mitigation on unaffected configurations
+
+From: Borislav Petkov (AMD) <bp@alien8.de>
+
+[ Upstream commit e9fbc47b818b964ddff5df5b2d5c0f5f32f4a147 ]
+
+Skip the srso cmd line parsing which is not needed on Zen1/2 with SMT
+disabled and with the proper microcode applied (latter should be the
+case anyway) as those are not affected.
+
+Fixes: 5a15d8348881 ("x86/srso: Tie SBPB bit setting to microcode patch detection")
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230813104517.3346-1-bp@alien8.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/bugs.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index d98f33ea57e47..97a4819ad8386 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -2389,8 +2389,10 @@ static void __init srso_select_mitigation(void)
+ * IBPB microcode has been applied.
+ */
+ if ((boot_cpu_data.x86 < 0x19) &&
+- (!cpu_smt_possible() || (cpu_smt_control == CPU_SMT_DISABLED)))
++ (!cpu_smt_possible() || (cpu_smt_control == CPU_SMT_DISABLED))) {
+ setup_force_cpu_cap(X86_FEATURE_SRSO_NO);
++ return;
++ }
+ }
+
+ if (retbleed_mitigation == RETBLEED_MITIGATION_IBPB) {
+@@ -2672,6 +2674,9 @@ static ssize_t gds_show_state(char *buf)
+
+ static ssize_t srso_show_state(char *buf)
+ {
++ if (boot_cpu_has(X86_FEATURE_SRSO_NO))
++ return sysfs_emit(buf, "Not affected\n");
++
+ return sysfs_emit(buf, "%s%s\n",
+ srso_strings[srso_mitigation],
+ (cpu_has_ibpb_brtype_microcode() ? "" : ", no microcode"));
+--
+2.40.1
+
--- /dev/null
+From 283cdb0bcc62097bfda78afe28ac1867ddfa49bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Aug 2023 12:44:19 +0200
+Subject: x86/static_call: Fix __static_call_fixup()
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 54097309620ef0dc2d7083783dc521c6a5fef957 ]
+
+Christian reported spurious module load crashes after some of Song's
+module memory layout patches.
+
+Turns out that if the very last instruction on the very last page of the
+module is a 'JMP __x86_return_thunk' then __static_call_fixup() will
+trip a fault and die.
+
+And while the module rework made this slightly more likely to happen,
+it's always been possible.
+
+Fixes: ee88d363d156 ("x86,static_call: Use alternative RET encoding")
+Reported-by: Christian Bricart <christian@bricart.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Link: https://lkml.kernel.org/r/20230816104419.GA982867@hirez.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/static_call.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/arch/x86/kernel/static_call.c b/arch/x86/kernel/static_call.c
+index a9b54b795ebff..3fbb491688275 100644
+--- a/arch/x86/kernel/static_call.c
++++ b/arch/x86/kernel/static_call.c
+@@ -184,6 +184,19 @@ EXPORT_SYMBOL_GPL(arch_static_call_transform);
+ */
+ bool __static_call_fixup(void *tramp, u8 op, void *dest)
+ {
++ unsigned long addr = (unsigned long)tramp;
++ /*
++ * Not all .return_sites are a static_call trampoline (most are not).
++ * Check if the 3 bytes after the return are still kernel text, if not,
++ * then this definitely is not a trampoline and we need not worry
++ * further.
++ *
++ * This avoids the memcmp() below tripping over pagefaults etc..
++ */
++ if (((addr >> PAGE_SHIFT) != ((addr + 7) >> PAGE_SHIFT)) &&
++ !kernel_text_address(addr + 7))
++ return false;
++
+ if (memcmp(tramp+5, tramp_ud, 3)) {
+ /* Not a trampoline site, not our problem. */
+ return false;
+--
+2.40.1
+
--- /dev/null
+From 56df40fe6c369be6b971d13fd051049f7145bc8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Jul 2023 15:41:10 +0800
+Subject: xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit 5e2424708da7207087934c5c75211e8584d553a0 ]
+
+The previous commit 4e484b3e969b ("xfrm: rate limit SA mapping change
+message to user space") added one additional attribute named
+XFRMA_MTIMER_THRESH and described its type at compat_policy
+(net/xfrm/xfrm_compat.c).
+
+However, the author forgot to also describe the nla_policy at
+xfrma_policy (net/xfrm/xfrm_user.c). Hence, this suppose NLA_U32 (4
+bytes) value can be faked as empty (0 bytes) by a malicious user, which
+leads to 4 bytes overflow read and heap information leak when parsing
+nlattrs.
+
+To exploit this, one malicious user can spray the SLUB objects and then
+leverage this 4 bytes OOB read to leak the heap data into
+x->mapping_maxage (see xfrm_update_ae_params(...)), and leak it to
+userspace via copy_to_user_state_extra(...).
+
+The above bug is assigned CVE-2023-3773. To fix it, this commit just
+completes the nla_policy description for XFRMA_MTIMER_THRESH, which
+enforces the length check and avoids such OOB read.
+
+Fixes: 4e484b3e969b ("xfrm: rate limit SA mapping change message to user space")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_user.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 9fc1da47d02e0..d042ca01211fa 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -2989,6 +2989,7 @@ const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
+ [XFRMA_SET_MARK] = { .type = NLA_U32 },
+ [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 },
+ [XFRMA_IF_ID] = { .type = NLA_U32 },
++ [XFRMA_MTIMER_THRESH] = { .type = NLA_U32 },
+ };
+ EXPORT_SYMBOL_GPL(xfrma_policy);
+
+--
+2.40.1
+
--- /dev/null
+From 4960da02260c656c753d74d328d3abba3d49a576 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 22:51:03 +0800
+Subject: xfrm: add NULL check in xfrm_update_ae_params
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit 00374d9b6d9f932802b55181be9831aa948e5b7c ]
+
+Normally, x->replay_esn and x->preplay_esn should be allocated at
+xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the
+xfrm_update_ae_params(...) is okay to update them. However, the current
+implementation of xfrm_new_ae(...) allows a malicious user to directly
+dereference a NULL pointer and crash the kernel like below.
+
+BUG: kernel NULL pointer dereference, address: 0000000000000000
+PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0
+Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI
+CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4
+RIP: 0010:memcpy_orig+0xad/0x140
+Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c
+RSP: 0018:ffff888008f57658 EFLAGS: 00000202
+RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571
+RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000
+RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818
+R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000
+FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0
+Call Trace:
+ <TASK>
+ ? __die+0x1f/0x70
+ ? page_fault_oops+0x1e8/0x500
+ ? __pfx_is_prefetch.constprop.0+0x10/0x10
+ ? __pfx_page_fault_oops+0x10/0x10
+ ? _raw_spin_unlock_irqrestore+0x11/0x40
+ ? fixup_exception+0x36/0x460
+ ? _raw_spin_unlock_irqrestore+0x11/0x40
+ ? exc_page_fault+0x5e/0xc0
+ ? asm_exc_page_fault+0x26/0x30
+ ? xfrm_update_ae_params+0xd1/0x260
+ ? memcpy_orig+0xad/0x140
+ ? __pfx__raw_spin_lock_bh+0x10/0x10
+ xfrm_update_ae_params+0xe7/0x260
+ xfrm_new_ae+0x298/0x4e0
+ ? __pfx_xfrm_new_ae+0x10/0x10
+ ? __pfx_xfrm_new_ae+0x10/0x10
+ xfrm_user_rcv_msg+0x25a/0x410
+ ? __pfx_xfrm_user_rcv_msg+0x10/0x10
+ ? __alloc_skb+0xcf/0x210
+ ? stack_trace_save+0x90/0xd0
+ ? filter_irq_stacks+0x1c/0x70
+ ? __stack_depot_save+0x39/0x4e0
+ ? __kasan_slab_free+0x10a/0x190
+ ? kmem_cache_free+0x9c/0x340
+ ? netlink_recvmsg+0x23c/0x660
+ ? sock_recvmsg+0xeb/0xf0
+ ? __sys_recvfrom+0x13c/0x1f0
+ ? __x64_sys_recvfrom+0x71/0x90
+ ? do_syscall_64+0x3f/0x90
+ ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
+ ? copyout+0x3e/0x50
+ netlink_rcv_skb+0xd6/0x210
+ ? __pfx_xfrm_user_rcv_msg+0x10/0x10
+ ? __pfx_netlink_rcv_skb+0x10/0x10
+ ? __pfx_sock_has_perm+0x10/0x10
+ ? mutex_lock+0x8d/0xe0
+ ? __pfx_mutex_lock+0x10/0x10
+ xfrm_netlink_rcv+0x44/0x50
+ netlink_unicast+0x36f/0x4c0
+ ? __pfx_netlink_unicast+0x10/0x10
+ ? netlink_recvmsg+0x500/0x660
+ netlink_sendmsg+0x3b7/0x700
+
+This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit
+adds additional NULL check in xfrm_update_ae_params to fix the NPD.
+
+Fixes: d8647b79c3b7 ("xfrm: Add user interface for esn and big anti-replay windows")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index c6803318ac63e..9fc1da47d02e0 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -615,7 +615,7 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
+ struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
+ struct nlattr *mt = attrs[XFRMA_MTIMER_THRESH];
+
+- if (re) {
++ if (re && x->replay_esn && x->preplay_esn) {
+ struct xfrm_replay_state_esn *replay_esn;
+ replay_esn = nla_data(re);
+ memcpy(x->replay_esn, replay_esn,
+--
+2.40.1
+
--- /dev/null
+From 1b6be04e1c4b56636ad295c5ac2b5a567ffd0e35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jul 2023 17:40:51 +0800
+Subject: xfrm: fix slab-use-after-free in decode_session6
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+[ Upstream commit 53223f2ed1ef5c90dad814daaaefea4e68a933c8 ]
+
+When the xfrm device is set to the qdisc of the sfb type, the cb field
+of the sent skb may be modified during enqueuing. Then,
+slab-use-after-free may occur when the xfrm device sends IPv6 packets.
+
+The stack information is as follows:
+BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890
+Read of size 1 at addr ffff8881111458ef by task swapper/3/0
+CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.4.0-next-20230707 #409
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014
+Call Trace:
+<IRQ>
+dump_stack_lvl+0xd9/0x150
+print_address_description.constprop.0+0x2c/0x3c0
+kasan_report+0x11d/0x130
+decode_session6+0x103f/0x1890
+__xfrm_decode_session+0x54/0xb0
+xfrmi_xmit+0x173/0x1ca0
+dev_hard_start_xmit+0x187/0x700
+sch_direct_xmit+0x1a3/0xc30
+__qdisc_run+0x510/0x17a0
+__dev_queue_xmit+0x2215/0x3b10
+neigh_connected_output+0x3c2/0x550
+ip6_finish_output2+0x55a/0x1550
+ip6_finish_output+0x6b9/0x1270
+ip6_output+0x1f1/0x540
+ndisc_send_skb+0xa63/0x1890
+ndisc_send_rs+0x132/0x6f0
+addrconf_rs_timer+0x3f1/0x870
+call_timer_fn+0x1a0/0x580
+expire_timers+0x29b/0x4b0
+run_timer_softirq+0x326/0x910
+__do_softirq+0x1d4/0x905
+irq_exit_rcu+0xb7/0x120
+sysvec_apic_timer_interrupt+0x97/0xc0
+</IRQ>
+<TASK>
+asm_sysvec_apic_timer_interrupt+0x1a/0x20
+RIP: 0010:intel_idle_hlt+0x23/0x30
+Code: 1f 84 00 00 00 00 00 f3 0f 1e fa 41 54 41 89 d4 0f 1f 44 00 00 66 90 0f 1f 44 00 00 0f 00 2d c4 9f ab 00 0f 1f 44 00 00 fb f4 <fa> 44 89 e0 41 5c c3 66 0f 1f 44 00 00 f3 0f 1e fa 41 54 41 89 d4
+RSP: 0018:ffffc90000197d78 EFLAGS: 00000246
+RAX: 00000000000a83c3 RBX: ffffe8ffffd09c50 RCX: ffffffff8a22d8e5
+RDX: 0000000000000001 RSI: ffffffff8d3f8080 RDI: ffffe8ffffd09c50
+RBP: ffffffff8d3f8080 R08: 0000000000000001 R09: ffffed1026ba6d9d
+R10: ffff888135d36ceb R11: 0000000000000001 R12: 0000000000000001
+R13: ffffffff8d3f8100 R14: 0000000000000001 R15: 0000000000000000
+cpuidle_enter_state+0xd3/0x6f0
+cpuidle_enter+0x4e/0xa0
+do_idle+0x2fe/0x3c0
+cpu_startup_entry+0x18/0x20
+start_secondary+0x200/0x290
+secondary_startup_64_no_verify+0x167/0x16b
+</TASK>
+Allocated by task 939:
+kasan_save_stack+0x22/0x40
+kasan_set_track+0x25/0x30
+__kasan_slab_alloc+0x7f/0x90
+kmem_cache_alloc_node+0x1cd/0x410
+kmalloc_reserve+0x165/0x270
+__alloc_skb+0x129/0x330
+inet6_ifa_notify+0x118/0x230
+__ipv6_ifa_notify+0x177/0xbe0
+addrconf_dad_completed+0x133/0xe00
+addrconf_dad_work+0x764/0x1390
+process_one_work+0xa32/0x16f0
+worker_thread+0x67d/0x10c0
+kthread+0x344/0x440
+ret_from_fork+0x1f/0x30
+The buggy address belongs to the object at ffff888111145800
+which belongs to the cache skbuff_small_head of size 640
+The buggy address is located 239 bytes inside of
+freed 640-byte region [ffff888111145800, ffff888111145a80)
+
+As commit f855691975bb ("xfrm6: Fix the nexthdr offset in
+_decode_session6.") showed, xfrm_decode_session was originally intended
+only for the receive path. IP6CB(skb)->nhoff is not set during
+transmission. Therefore, set the cb field in the skb to 0 before
+sending packets.
+
+Fixes: f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_interface_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c
+index 94a3609548b11..d71dbe822096a 100644
+--- a/net/xfrm/xfrm_interface_core.c
++++ b/net/xfrm/xfrm_interface_core.c
+@@ -528,8 +528,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ switch (skb->protocol) {
+ case htons(ETH_P_IPV6):
+- xfrm_decode_session(skb, &fl, AF_INET6);
+ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
++ xfrm_decode_session(skb, &fl, AF_INET6);
+ if (!dst) {
+ fl.u.ip6.flowi6_oif = dev->ifindex;
+ fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
+@@ -543,8 +543,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
+ }
+ break;
+ case htons(ETH_P_IP):
+- xfrm_decode_session(skb, &fl, AF_INET);
+ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
++ xfrm_decode_session(skb, &fl, AF_INET);
+ if (!dst) {
+ struct rtable *rt;
+
+--
+2.40.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
