--- /dev/null
+From bc3b31977314433e4685ae92853d1b6e91ad7bc2 Mon Sep 17 00:00:00 2001
+From: Li Li <boolli@google.com>
+Date: Fri, 23 Jan 2026 06:58:06 +0000
+Subject: idpf: nullify pointers after they are freed
+
+From: Li Li <boolli@google.com>
+
+commit bc3b31977314433e4685ae92853d1b6e91ad7bc2 upstream.
+
+rss_data->rss_key needs to be nullified after it is freed.
+Checks like "if (!rss_data->rss_key)" in the code could fail
+if it is not nullified.
+
+Tested: built and booted the kernel.
+
+Fixes: 83f38f210b85 ("idpf: Fix RSS LUT NULL pointer crash on early ethtool operations")
+Signed-off-by: Li Li <boolli@google.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_lib.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -1230,6 +1230,7 @@ static struct idpf_vport *idpf_vport_all
+
+ free_rss_key:
+ kfree(rss_data->rss_key);
++ rss_data->rss_key = NULL;
+ free_vector_idxs:
+ kfree(vport->q_vector_idxs);
+ free_vport:
--- /dev/null
+From bbb11b8d758d17a4ce34b8ed0b49de150568265b Mon Sep 17 00:00:00 2001
+From: Justin Chen <justin.chen@broadcom.com>
+Date: Tue, 20 Jan 2026 11:23:39 -0800
+Subject: net: bcmasp: Fix network filter wake for asp-3.0
+
+From: Justin Chen <justin.chen@broadcom.com>
+
+commit bbb11b8d758d17a4ce34b8ed0b49de150568265b upstream.
+
+We need to apply the tx_chan_offset to the netfilter cfg channel or the
+output channel will be incorrect for asp-3.0 and newer.
+
+Fixes: e9f31435ee7d ("net: bcmasp: Add support for asp-v3.0")
+Signed-off-by: Justin Chen <justin.chen@broadcom.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://patch.msgid.link/20260120192339.2031648-1-justin.chen@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/asp2/bcmasp.c | 5 +++--
+ drivers/net/ethernet/broadcom/asp2/bcmasp.h | 1 +
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/asp2/bcmasp.c
++++ b/drivers/net/ethernet/broadcom/asp2/bcmasp.c
+@@ -156,7 +156,7 @@ static void bcmasp_netfilt_hw_en_wake(st
+ ASP_RX_FILTER_NET_OFFSET_L4(32),
+ ASP_RX_FILTER_NET_OFFSET(nfilt->hw_index + 1));
+
+- rx_filter_core_wl(priv, ASP_RX_FILTER_NET_CFG_CH(nfilt->port + 8) |
++ rx_filter_core_wl(priv, ASP_RX_FILTER_NET_CFG_CH(nfilt->ch) |
+ ASP_RX_FILTER_NET_CFG_EN |
+ ASP_RX_FILTER_NET_CFG_L2_EN |
+ ASP_RX_FILTER_NET_CFG_L3_EN |
+@@ -166,7 +166,7 @@ static void bcmasp_netfilt_hw_en_wake(st
+ ASP_RX_FILTER_NET_CFG_UMC(nfilt->port),
+ ASP_RX_FILTER_NET_CFG(nfilt->hw_index));
+
+- rx_filter_core_wl(priv, ASP_RX_FILTER_NET_CFG_CH(nfilt->port + 8) |
++ rx_filter_core_wl(priv, ASP_RX_FILTER_NET_CFG_CH(nfilt->ch) |
+ ASP_RX_FILTER_NET_CFG_EN |
+ ASP_RX_FILTER_NET_CFG_L2_EN |
+ ASP_RX_FILTER_NET_CFG_L3_EN |
+@@ -714,6 +714,7 @@ struct bcmasp_net_filter *bcmasp_netfilt
+ nfilter = &priv->net_filters[open_index];
+ nfilter->claimed = true;
+ nfilter->port = intf->port;
++ nfilter->ch = intf->channel + priv->tx_chan_offset;
+ nfilter->hw_index = open_index;
+ }
+
+--- a/drivers/net/ethernet/broadcom/asp2/bcmasp.h
++++ b/drivers/net/ethernet/broadcom/asp2/bcmasp.h
+@@ -348,6 +348,7 @@ struct bcmasp_net_filter {
+ bool wake_filter;
+
+ int port;
++ int ch;
+ unsigned int hw_index;
+ };
+
--- /dev/null
+From 18ff09c1b94fa1584b31d3f4e9eecdca29230ce5 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <florian.fainelli@broadcom.com>
+Date: Fri, 18 Jul 2025 14:22:42 -0700
+Subject: net: bcmasp: Restore programming of TX map vector register
+
+From: Florian Fainelli <florian.fainelli@broadcom.com>
+
+commit 18ff09c1b94fa1584b31d3f4e9eecdca29230ce5 upstream.
+
+On ASP versions v2.x we need to program the TX map vector register to
+properly exercise end-to-end flow control, otherwise the TX engine can
+either lock-up, or cause the hardware calculated checksum to be
+wrong/corrupted when multiple back to back packets are being submitted
+for transmission. This register defaults to 0, which means no flow
+control being applied.
+
+Fixes: e9f31435ee7d ("net: bcmasp: Add support for asp-v3.0")
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://patch.msgid.link/20250718212242.3447751-1-florian.fainelli@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c
++++ b/drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c
+@@ -815,6 +815,9 @@ static void bcmasp_init_tx(struct bcmasp
+ /* Tx SPB */
+ tx_spb_ctrl_wl(intf, ((intf->channel + 8) << TX_SPB_CTRL_XF_BID_SHIFT),
+ TX_SPB_CTRL_XF_CTRL2);
++
++ if (intf->parent->tx_chan_offset)
++ tx_pause_ctrl_wl(intf, (1 << (intf->channel + 8)), TX_PAUSE_MAP_VECTOR);
+ tx_spb_top_wl(intf, 0x1e, TX_SPB_TOP_BLKOUT);
+
+ tx_spb_dma_wq(intf, intf->tx_spb_dma_addr, TX_SPB_DMA_READ);
xen-privcmd-unregister-xenstore-notifier-on-module-e.patch
futex-require-sys_futex_requeue-to-have-identical-fl.patch
dmaengine-idxd-fix-leaking-event-log-memory.patch
+net-bcmasp-restore-programming-of-tx-map-vector-register.patch
+net-bcmasp-fix-network-filter-wake-for-asp-3.0.patch
+idpf-nullify-pointers-after-they-are-freed.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
