--- /dev/null
+From 7d9df38c9c037ab84502ce7eeae9f1e1e7e72603 Mon Sep 17 00:00:00 2001
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Wed, 12 Jun 2024 16:17:36 -0700
+Subject: bnxt_en: Cap the size of HWRM_PORT_PHY_QCFG forwarded response
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+commit 7d9df38c9c037ab84502ce7eeae9f1e1e7e72603 upstream.
+
+Firmware interface 1.10.2.118 has increased the size of
+HWRM_PORT_PHY_QCFG response beyond the maximum size that can be
+forwarded. When the VF's link state is not the default auto state,
+the PF will need to forward the response back to the VF to indicate
+the forced state. This regression may cause the VF to fail to
+initialize.
+
+Fix it by capping the HWRM_PORT_PHY_QCFG response to the maximum
+96 bytes. The SPEEDS2_SUPPORTED flag needs to be cleared because the
+new speeds2 fields are beyond the legacy structure. Also modify
+bnxt_hwrm_fwd_resp() to print a warning if the message size exceeds 96
+bytes to make this failure more obvious.
+
+Fixes: 84a911db8305 ("bnxt_en: Update firmware interface to 1.10.2.118")
+Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://lore.kernel.org/r/20240612231736.57823-1-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[Samasth: backport to 6.6.y]
+Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 51 ++++++++++++++++++++++++
+ drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 12 ++++-
+ 2 files changed, 61 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1195,6 +1195,57 @@ struct bnxt_ntuple_filter {
+ #define BNXT_FLTR_UPDATE 1
+ };
+
++/* Compat version of hwrm_port_phy_qcfg_output capped at 96 bytes. The
++ * first 95 bytes are identical to hwrm_port_phy_qcfg_output in bnxt_hsi.h.
++ * The last valid byte in the compat version is different.
++ */
++struct hwrm_port_phy_qcfg_output_compat {
++ __le16 error_code;
++ __le16 req_type;
++ __le16 seq_id;
++ __le16 resp_len;
++ u8 link;
++ u8 active_fec_signal_mode;
++ __le16 link_speed;
++ u8 duplex_cfg;
++ u8 pause;
++ __le16 support_speeds;
++ __le16 force_link_speed;
++ u8 auto_mode;
++ u8 auto_pause;
++ __le16 auto_link_speed;
++ __le16 auto_link_speed_mask;
++ u8 wirespeed;
++ u8 lpbk;
++ u8 force_pause;
++ u8 module_status;
++ __le32 preemphasis;
++ u8 phy_maj;
++ u8 phy_min;
++ u8 phy_bld;
++ u8 phy_type;
++ u8 media_type;
++ u8 xcvr_pkg_type;
++ u8 eee_config_phy_addr;
++ u8 parallel_detect;
++ __le16 link_partner_adv_speeds;
++ u8 link_partner_adv_auto_mode;
++ u8 link_partner_adv_pause;
++ __le16 adv_eee_link_speed_mask;
++ __le16 link_partner_adv_eee_link_speed_mask;
++ __le32 xcvr_identifier_type_tx_lpi_timer;
++ __le16 fec_cfg;
++ u8 duplex_state;
++ u8 option_flags;
++ char phy_vendor_name[16];
++ char phy_vendor_partnumber[16];
++ __le16 support_pam4_speeds;
++ __le16 force_pam4_link_speed;
++ __le16 auto_pam4_link_speed_mask;
++ u8 link_partner_pam4_adv_speeds;
++ u8 valid;
++};
++
+ struct bnxt_link_info {
+ u8 phy_type;
+ u8 media_type;
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+@@ -942,8 +942,11 @@ static int bnxt_hwrm_fwd_resp(struct bnx
+ struct hwrm_fwd_resp_input *req;
+ int rc;
+
+- if (BNXT_FWD_RESP_SIZE_ERR(msg_size))
++ if (BNXT_FWD_RESP_SIZE_ERR(msg_size)) {
++ netdev_warn_once(bp->dev, "HWRM fwd response too big (%d bytes)\n",
++ msg_size);
+ return -EINVAL;
++ }
+
+ rc = hwrm_req_init(bp, req, HWRM_FWD_RESP);
+ if (!rc) {
+@@ -1077,7 +1080,7 @@ static int bnxt_vf_set_link(struct bnxt
+ rc = bnxt_hwrm_exec_fwd_resp(
+ bp, vf, sizeof(struct hwrm_port_phy_qcfg_input));
+ } else {
+- struct hwrm_port_phy_qcfg_output phy_qcfg_resp = {0};
++ struct hwrm_port_phy_qcfg_output_compat phy_qcfg_resp = {};
+ struct hwrm_port_phy_qcfg_input *phy_qcfg_req;
+
+ phy_qcfg_req =
+@@ -1088,6 +1091,11 @@ static int bnxt_vf_set_link(struct bnxt
+ mutex_unlock(&bp->link_lock);
+ phy_qcfg_resp.resp_len = cpu_to_le16(sizeof(phy_qcfg_resp));
+ phy_qcfg_resp.seq_id = phy_qcfg_req->seq_id;
++ /* New SPEEDS2 fields are beyond the legacy structure, so
++ * clear the SPEEDS2_SUPPORTED flag.
++ */
++ phy_qcfg_resp.option_flags &=
++ ~PORT_PHY_QCAPS_RESP_FLAGS2_SPEEDS2_SUPPORTED;
+ phy_qcfg_resp.valid = 1;
+
+ if (vf->flags & BNXT_VF_LINK_UP) {
--- /dev/null
+From a7801540f325d104de5065850a003f1d9bdc6ad3 Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Wed, 11 Jan 2023 12:10:04 +0100
+Subject: can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into mcp251xfd_chip_start/stop()
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit a7801540f325d104de5065850a003f1d9bdc6ad3 upstream.
+
+The mcp251xfd wakes up from Low Power or Sleep Mode when SPI activity
+is detected. To avoid this, make sure that the timestamp worker is
+stopped before shutting down the chip.
+
+Split the starting of the timestamp worker out of
+mcp251xfd_timestamp_init() into the separate function
+mcp251xfd_timestamp_start().
+
+Call mcp251xfd_timestamp_init() before mcp251xfd_chip_start(), move
+mcp251xfd_timestamp_start() to mcp251xfd_chip_start(). In this way,
+mcp251xfd_timestamp_stop() can be called unconditionally by
+mcp251xfd_chip_stop().
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 8 +++++---
+ drivers/net/can/spi/mcp251xfd/mcp251xfd-timestamp.c | 7 +++++--
+ drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 1 +
+ 3 files changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+@@ -744,6 +744,7 @@ static void mcp251xfd_chip_stop(struct m
+
+ mcp251xfd_chip_interrupts_disable(priv);
+ mcp251xfd_chip_rx_int_disable(priv);
++ mcp251xfd_timestamp_stop(priv);
+ mcp251xfd_chip_sleep(priv);
+ }
+
+@@ -763,6 +764,8 @@ static int mcp251xfd_chip_start(struct m
+ if (err)
+ goto out_chip_stop;
+
++ mcp251xfd_timestamp_start(priv);
++
+ err = mcp251xfd_set_bittiming(priv);
+ if (err)
+ goto out_chip_stop;
+@@ -1610,11 +1613,12 @@ static int mcp251xfd_open(struct net_dev
+ if (err)
+ goto out_mcp251xfd_ring_free;
+
++ mcp251xfd_timestamp_init(priv);
++
+ err = mcp251xfd_chip_start(priv);
+ if (err)
+ goto out_transceiver_disable;
+
+- mcp251xfd_timestamp_init(priv);
+ clear_bit(MCP251XFD_FLAGS_DOWN, priv->flags);
+ can_rx_offload_enable(&priv->offload);
+
+@@ -1648,7 +1652,6 @@ out_destroy_workqueue:
+ out_can_rx_offload_disable:
+ can_rx_offload_disable(&priv->offload);
+ set_bit(MCP251XFD_FLAGS_DOWN, priv->flags);
+- mcp251xfd_timestamp_stop(priv);
+ out_transceiver_disable:
+ mcp251xfd_transceiver_disable(priv);
+ out_mcp251xfd_ring_free:
+@@ -1674,7 +1677,6 @@ static int mcp251xfd_stop(struct net_dev
+ free_irq(ndev->irq, priv);
+ destroy_workqueue(priv->wq);
+ can_rx_offload_disable(&priv->offload);
+- mcp251xfd_timestamp_stop(priv);
+ mcp251xfd_chip_stop(priv, CAN_STATE_STOPPED);
+ mcp251xfd_transceiver_disable(priv);
+ mcp251xfd_ring_free(priv);
+--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-timestamp.c
++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-timestamp.c
+@@ -48,9 +48,12 @@ void mcp251xfd_timestamp_init(struct mcp
+ cc->shift = 1;
+ cc->mult = clocksource_hz2mult(priv->can.clock.freq, cc->shift);
+
+- timecounter_init(&priv->tc, &priv->cc, ktime_get_real_ns());
+-
+ INIT_DELAYED_WORK(&priv->timestamp, mcp251xfd_timestamp_work);
++}
++
++void mcp251xfd_timestamp_start(struct mcp251xfd_priv *priv)
++{
++ timecounter_init(&priv->tc, &priv->cc, ktime_get_real_ns());
+ schedule_delayed_work(&priv->timestamp,
+ MCP251XFD_TIMESTAMP_WORK_DELAY_SEC * HZ);
+ }
+--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd.h
++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd.h
+@@ -957,6 +957,7 @@ int mcp251xfd_ring_alloc(struct mcp251xf
+ int mcp251xfd_handle_rxif(struct mcp251xfd_priv *priv);
+ int mcp251xfd_handle_tefif(struct mcp251xfd_priv *priv);
+ void mcp251xfd_timestamp_init(struct mcp251xfd_priv *priv);
++void mcp251xfd_timestamp_start(struct mcp251xfd_priv *priv);
+ void mcp251xfd_timestamp_stop(struct mcp251xfd_priv *priv);
+
+ void mcp251xfd_tx_obj_write_sync(struct work_struct *work);
--- /dev/null
+From 51b2a721612236335ddec4f3fb5f59e72a204f3a Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Thu, 25 Apr 2024 10:14:45 +0200
+Subject: can: mcp251xfd: properly indent labels
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit 51b2a721612236335ddec4f3fb5f59e72a204f3a upstream.
+
+To fix the coding style, remove the whitespace in front of labels.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 34 +++++++++++------------
+ drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c | 2 -
+ drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c | 2 -
+ drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c | 2 -
+ 4 files changed, 20 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+@@ -791,7 +791,7 @@ static int mcp251xfd_chip_start(struct m
+
+ return 0;
+
+- out_chip_stop:
++out_chip_stop:
+ mcp251xfd_dump(priv);
+ mcp251xfd_chip_stop(priv, CAN_STATE_STOPPED);
+
+@@ -1576,7 +1576,7 @@ static irqreturn_t mcp251xfd_irq(int irq
+ handled = IRQ_HANDLED;
+ } while (1);
+
+- out_fail:
++out_fail:
+ can_rx_offload_threaded_irq_finish(&priv->offload);
+
+ netdev_err(priv->ndev, "IRQ handler returned %d (intf=0x%08x).\n",
+@@ -1641,22 +1641,22 @@ static int mcp251xfd_open(struct net_dev
+
+ return 0;
+
+- out_free_irq:
++out_free_irq:
+ free_irq(spi->irq, priv);
+- out_destroy_workqueue:
++out_destroy_workqueue:
+ destroy_workqueue(priv->wq);
+- out_can_rx_offload_disable:
++out_can_rx_offload_disable:
+ can_rx_offload_disable(&priv->offload);
+ set_bit(MCP251XFD_FLAGS_DOWN, priv->flags);
+ mcp251xfd_timestamp_stop(priv);
+- out_transceiver_disable:
++out_transceiver_disable:
+ mcp251xfd_transceiver_disable(priv);
+- out_mcp251xfd_ring_free:
++out_mcp251xfd_ring_free:
+ mcp251xfd_ring_free(priv);
+- out_pm_runtime_put:
++out_pm_runtime_put:
+ mcp251xfd_chip_stop(priv, CAN_STATE_STOPPED);
+ pm_runtime_put(ndev->dev.parent);
+- out_close_candev:
++out_close_candev:
+ close_candev(ndev);
+
+ return err;
+@@ -1820,9 +1820,9 @@ mcp251xfd_register_get_dev_id(const stru
+ *effective_speed_hz_slow = xfer[0].effective_speed_hz;
+ *effective_speed_hz_fast = xfer[1].effective_speed_hz;
+
+- out_kfree_buf_tx:
++out_kfree_buf_tx:
+ kfree(buf_tx);
+- out_kfree_buf_rx:
++out_kfree_buf_rx:
+ kfree(buf_rx);
+
+ return err;
+@@ -1936,13 +1936,13 @@ static int mcp251xfd_register(struct mcp
+
+ return 0;
+
+- out_unregister_candev:
++out_unregister_candev:
+ unregister_candev(ndev);
+- out_chip_sleep:
++out_chip_sleep:
+ mcp251xfd_chip_sleep(priv);
+- out_runtime_disable:
++out_runtime_disable:
+ pm_runtime_disable(ndev->dev.parent);
+- out_runtime_put_noidle:
++out_runtime_put_noidle:
+ pm_runtime_put_noidle(ndev->dev.parent);
+ mcp251xfd_clks_and_vdd_disable(priv);
+
+@@ -2162,9 +2162,9 @@ static int mcp251xfd_probe(struct spi_de
+
+ return 0;
+
+- out_can_rx_offload_del:
++out_can_rx_offload_del:
+ can_rx_offload_del(&priv->offload);
+- out_free_candev:
++out_free_candev:
+ spi->max_speed_hz = priv->spi_max_speed_hz_orig;
+
+ free_candev(ndev);
+--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c
++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-dump.c
+@@ -94,7 +94,7 @@ static void mcp251xfd_dump_registers(con
+ kfree(buf);
+ }
+
+- out:
++out:
+ mcp251xfd_dump_header(iter, MCP251XFD_DUMP_OBJECT_TYPE_REG, reg);
+ }
+
+--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c
++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-regmap.c
+@@ -397,7 +397,7 @@ mcp251xfd_regmap_crc_read(void *context,
+
+ return err;
+ }
+- out:
++out:
+ memcpy(val_buf, buf_rx->data, val_len);
+
+ return 0;
+--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c
++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c
+@@ -219,7 +219,7 @@ int mcp251xfd_handle_tefif(struct mcp251
+ total_frame_len += frame_len;
+ }
+
+- out_netif_wake_queue:
++out_netif_wake_queue:
+ len = i; /* number of handled goods TEFs */
+ if (len) {
+ struct mcp251xfd_tef_ring *ring = priv->tef;
--- /dev/null
+From b440396387418fe2feaacd41ca16080e7a8bc9ad Mon Sep 17 00:00:00 2001
+From: Kent Gibson <warthog618@gmail.com>
+Date: Wed, 26 Jun 2024 13:29:23 +0800
+Subject: gpiolib: cdev: Ignore reconfiguration without direction
+
+From: Kent Gibson <warthog618@gmail.com>
+
+commit b440396387418fe2feaacd41ca16080e7a8bc9ad upstream.
+
+linereq_set_config() behaves badly when direction is not set.
+The configuration validation is borrowed from linereq_create(), where,
+to verify the intent of the user, the direction must be set to in order to
+effect a change to the electrical configuration of a line. But, when
+applied to reconfiguration, that validation does not allow for the unset
+direction case, making it possible to clear flags set previously without
+specifying the line direction.
+
+Adding to the inconsistency, those changes are not immediately applied by
+linereq_set_config(), but will take effect when the line value is next get
+or set.
+
+For example, by requesting a configuration with no flags set, an output
+line with GPIO_V2_LINE_FLAG_ACTIVE_LOW and GPIO_V2_LINE_FLAG_OPEN_DRAIN
+set could have those flags cleared, inverting the sense of the line and
+changing the line drive to push-pull on the next line value set.
+
+Skip the reconfiguration of lines for which the direction is not set, and
+only reconfigure the lines for which direction is set.
+
+Fixes: a54756cb24ea ("gpiolib: cdev: support GPIO_V2_LINE_SET_CONFIG_IOCTL")
+Signed-off-by: Kent Gibson <warthog618@gmail.com>
+Link: https://lore.kernel.org/r/20240626052925.174272-3-warthog618@gmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpiolib-cdev.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpio/gpiolib-cdev.c
++++ b/drivers/gpio/gpiolib-cdev.c
+@@ -1565,12 +1565,14 @@ static long linereq_set_config_unlocked(
+ line = &lr->lines[i];
+ desc = lr->lines[i].desc;
+ flags = gpio_v2_line_config_flags(lc, i);
+- gpio_v2_line_config_flags_to_desc_flags(flags, &desc->flags);
+- edflags = flags & GPIO_V2_LINE_EDGE_DETECTOR_FLAGS;
+ /*
+- * Lines have to be requested explicitly for input
+- * or output, else the line will be treated "as is".
++ * Lines not explicitly reconfigured as input or output
++ * are left unchanged.
+ */
++ if (!(flags & GPIO_V2_LINE_DIRECTION_FLAGS))
++ continue;
++ gpio_v2_line_config_flags_to_desc_flags(flags, &desc->flags);
++ edflags = flags & GPIO_V2_LINE_EDGE_DETECTOR_FLAGS;
+ if (flags & GPIO_V2_LINE_FLAG_OUTPUT) {
+ int val = gpio_v2_line_config_output_value(lc, i);
+
+@@ -1578,7 +1580,7 @@ static long linereq_set_config_unlocked(
+ ret = gpiod_direction_output(desc, val);
+ if (ret)
+ return ret;
+- } else if (flags & GPIO_V2_LINE_FLAG_INPUT) {
++ } else {
+ ret = gpiod_direction_input(desc);
+ if (ret)
+ return ret;
--- /dev/null
+From stable+bounces-76608-greg=kroah.com@vger.kernel.org Tue Sep 17 22:25:05 2024
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Tue, 17 Sep 2024 22:24:44 +0200
+Subject: netfilter: nf_tables: missing iterator type in lookup walk
+To: netfilter-devel@vger.kernel.org
+Cc: gregkh@linuxfoundation.org, sashal@kernel.org, stable@vger.kernel.org
+Message-ID: <20240917202444.171526-3-pablo@netfilter.org>
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit efefd4f00c967d00ad7abe092554ffbb70c1a793 upstream.
+
+Add missing decorator type to lookup expression and tighten WARN_ON_ONCE
+check in pipapo to spot earlier that this is unset.
+
+Fixes: 29b359cf6d95 ("netfilter: nft_set_pipapo: walk over current view on netlink dump")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nft_lookup.c | 1 +
+ net/netfilter/nft_set_pipapo.c | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/netfilter/nft_lookup.c
++++ b/net/netfilter/nft_lookup.c
+@@ -217,6 +217,7 @@ static int nft_lookup_validate(const str
+ return 0;
+
+ iter.genmask = nft_genmask_next(ctx->net);
++ iter.type = NFT_ITER_UPDATE;
+ iter.skip = 0;
+ iter.count = 0;
+ iter.err = 0;
+--- a/net/netfilter/nft_set_pipapo.c
++++ b/net/netfilter/nft_set_pipapo.c
+@@ -2041,7 +2041,8 @@ static void nft_pipapo_walk(const struct
+ const struct nft_pipapo_field *f;
+ int i, r;
+
+- WARN_ON_ONCE(iter->type == NFT_ITER_UNSPEC);
++ WARN_ON_ONCE(iter->type != NFT_ITER_READ &&
++ iter->type != NFT_ITER_UPDATE);
+
+ rcu_read_lock();
+ if (iter->type == NFT_ITER_READ)
--- /dev/null
+From stable+bounces-76607-greg=kroah.com@vger.kernel.org Tue Sep 17 22:25:05 2024
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Tue, 17 Sep 2024 22:24:43 +0200
+Subject: netfilter: nft_set_pipapo: walk over current view on netlink dump
+To: netfilter-devel@vger.kernel.org
+Cc: gregkh@linuxfoundation.org, sashal@kernel.org, stable@vger.kernel.org
+Message-ID: <20240917202444.171526-2-pablo@netfilter.org>
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit 29b359cf6d95fd60730533f7f10464e95bd17c73 upstream.
+
+The generation mask can be updated while netlink dump is in progress.
+The pipapo set backend walk iterator cannot rely on it to infer what
+view of the datastructure is to be used. Add notation to specify if user
+wants to read/update the set.
+
+Based on patch from Florian Westphal.
+
+Fixes: 2b84e215f874 ("netfilter: nft_set_pipapo: .walk does not deal with generations")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/netfilter/nf_tables.h | 13 +++++++++++++
+ net/netfilter/nf_tables_api.c | 5 +++++
+ net/netfilter/nft_set_pipapo.c | 5 +++--
+ 3 files changed, 21 insertions(+), 2 deletions(-)
+
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -297,9 +297,22 @@ struct nft_set_elem {
+ void *priv;
+ };
+
++/**
++ * enum nft_iter_type - nftables set iterator type
++ *
++ * @NFT_ITER_READ: read-only iteration over set elements
++ * @NFT_ITER_UPDATE: iteration under mutex to update set element state
++ */
++enum nft_iter_type {
++ NFT_ITER_UNSPEC,
++ NFT_ITER_READ,
++ NFT_ITER_UPDATE,
++};
++
+ struct nft_set;
+ struct nft_set_iter {
+ u8 genmask;
++ enum nft_iter_type type:8;
+ unsigned int count;
+ unsigned int skip;
+ int err;
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -628,6 +628,7 @@ static void nft_map_deactivate(const str
+ {
+ struct nft_set_iter iter = {
+ .genmask = nft_genmask_next(ctx->net),
++ .type = NFT_ITER_UPDATE,
+ .fn = nft_mapelem_deactivate,
+ };
+
+@@ -5392,6 +5393,7 @@ int nf_tables_bind_set(const struct nft_
+ }
+
+ iter.genmask = nft_genmask_next(ctx->net);
++ iter.type = NFT_ITER_UPDATE;
+ iter.skip = 0;
+ iter.count = 0;
+ iter.err = 0;
+@@ -5467,6 +5469,7 @@ static void nft_map_activate(const struc
+ {
+ struct nft_set_iter iter = {
+ .genmask = nft_genmask_next(ctx->net),
++ .type = NFT_ITER_UPDATE,
+ .fn = nft_mapelem_activate,
+ };
+
+@@ -5845,6 +5848,7 @@ static int nf_tables_dump_set(struct sk_
+ args.skb = skb;
+ args.reset = reset;
+ args.iter.genmask = nft_genmask_cur(net);
++ args.iter.type = NFT_ITER_READ;
+ args.iter.skip = cb->args[0];
+ args.iter.count = 0;
+ args.iter.err = 0;
+@@ -7246,6 +7250,7 @@ static int nft_set_flush(struct nft_ctx
+ {
+ struct nft_set_iter iter = {
+ .genmask = genmask,
++ .type = NFT_ITER_UPDATE,
+ .fn = nft_setelem_flush,
+ };
+
+--- a/net/netfilter/nft_set_pipapo.c
++++ b/net/netfilter/nft_set_pipapo.c
+@@ -2037,13 +2037,14 @@ static void nft_pipapo_walk(const struct
+ struct nft_set_iter *iter)
+ {
+ struct nft_pipapo *priv = nft_set_priv(set);
+- struct net *net = read_pnet(&set->net);
+ const struct nft_pipapo_match *m;
+ const struct nft_pipapo_field *f;
+ int i, r;
+
++ WARN_ON_ONCE(iter->type == NFT_ITER_UNSPEC);
++
+ rcu_read_lock();
+- if (iter->genmask == nft_genmask_cur(net))
++ if (iter->type == NFT_ITER_READ)
+ m = rcu_dereference(priv->match);
+ else
+ m = priv->clone;
--- /dev/null
+From 83bdfcbdbe5d901c5fa432decf12e1725a840a56 Mon Sep 17 00:00:00 2001
+From: Keith Busch <kbusch@kernel.org>
+Date: Wed, 11 Sep 2024 10:39:59 -0700
+Subject: nvme-pci: qdepth 1 quirk
+
+From: Keith Busch <kbusch@kernel.org>
+
+commit 83bdfcbdbe5d901c5fa432decf12e1725a840a56 upstream.
+
+Another device has been reported to be unreliable if we have more than
+one outstanding command. In this new case, data corruption may occur.
+Since we have two devices now needing this quirky behavior, make a
+generic quirk flag.
+
+The same Apple quirk is clearly not "temporary", so update the comment
+while moving it.
+
+Link: https://lore.kernel.org/linux-nvme/191d810a4e3.fcc6066c765804.973611676137075390@collabora.com/
+Reported-by: Robert Beckett <bob.beckett@collabora.com>
+Reviewed-by: Christoph Hellwig hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Cc: "Gagniuc, Alexandru" <alexandru.gagniuc@hp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/nvme.h | 5 +++++
+ drivers/nvme/host/pci.c | 18 +++++++++---------
+ 2 files changed, 14 insertions(+), 9 deletions(-)
+
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -89,6 +89,11 @@ enum nvme_quirks {
+ NVME_QUIRK_NO_DEEPEST_PS = (1 << 5),
+
+ /*
++ * Problems seen with concurrent commands
++ */
++ NVME_QUIRK_QDEPTH_ONE = (1 << 6),
++
++ /*
+ * Set MEDIUM priority on SQ creation
+ */
+ NVME_QUIRK_MEDIUM_PRIO_SQ = (1 << 7),
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2526,15 +2526,8 @@ static int nvme_pci_enable(struct nvme_d
+ else
+ dev->io_sqes = NVME_NVM_IOSQES;
+
+- /*
+- * Temporary fix for the Apple controller found in the MacBook8,1 and
+- * some MacBook7,1 to avoid controller resets and data loss.
+- */
+- if (pdev->vendor == PCI_VENDOR_ID_APPLE && pdev->device == 0x2001) {
++ if (dev->ctrl.quirks & NVME_QUIRK_QDEPTH_ONE) {
+ dev->q_depth = 2;
+- dev_warn(dev->ctrl.device, "detected Apple NVMe controller, "
+- "set queue depth=%u to work around controller resets\n",
+- dev->q_depth);
+ } else if (pdev->vendor == PCI_VENDOR_ID_SAMSUNG &&
+ (pdev->device == 0xa821 || pdev->device == 0xa822) &&
+ NVME_CAP_MQES(dev->ctrl.cap) == 0) {
+@@ -3399,6 +3392,8 @@ static const struct pci_device_id nvme_i
+ NVME_QUIRK_BOGUS_NID, },
+ { PCI_VDEVICE(REDHAT, 0x0010), /* Qemu emulated controller */
+ .driver_data = NVME_QUIRK_BOGUS_NID, },
++ { PCI_DEVICE(0x1217, 0x8760), /* O2 Micro 64GB Steam Deck */
++ .driver_data = NVME_QUIRK_QDEPTH_ONE },
+ { PCI_DEVICE(0x126f, 0x2262), /* Silicon Motion generic */
+ .driver_data = NVME_QUIRK_NO_DEEPEST_PS |
+ NVME_QUIRK_BOGUS_NID, },
+@@ -3531,7 +3526,12 @@ static const struct pci_device_id nvme_i
+ { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0xcd02),
+ .driver_data = NVME_QUIRK_DMA_ADDRESS_BITS_48, },
+ { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001),
+- .driver_data = NVME_QUIRK_SINGLE_VECTOR },
++ /*
++ * Fix for the Apple controller found in the MacBook8,1 and
++ * some MacBook7,1 to avoid controller resets and data loss.
++ */
++ .driver_data = NVME_QUIRK_SINGLE_VECTOR |
++ NVME_QUIRK_QDEPTH_ONE },
+ { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) },
+ { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2005),
+ .driver_data = NVME_QUIRK_SINGLE_VECTOR |
--- /dev/null
+From pkshih@realtek.com Fri Sep 27 09:45:55 2024
+From: Ping-Ke Shih <pkshih@realtek.com>
+Date: Thu, 26 Sep 2024 08:30:17 +0800
+Subject: Revert "wifi: cfg80211: check wiphy mutex is held for wdev mutex"
+To: <stable@vger.kernel.org>
+Cc: <linux-wireless@vger.kernel.org>, <johannes@sipsolutions.net>
+Message-ID: <20240926003017.5427-1-pkshih@realtek.com>
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+This reverts commit 268f84a827534c4e4c2540a4e29daa73359fc0a5 which is
+commmit 1474bc87fe57deac726cc10203f73daa6c3212f7 upstream.
+
+The reverted commit is based on implementation of wiphy locking that isn't
+planned to redo on a stable kernel, so revert it to avoid warning:
+
+ WARNING: CPU: 0 PID: 9 at net/wireless/core.h:231 disconnect_work+0xb8/0x144 [cfg80211]
+ CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.6.51-00141-ga1649b6f8ed6 #7
+ Hardware name: Freescale i.MX6 SoloX (Device Tree)
+ Workqueue: events disconnect_work [cfg80211]
+ unwind_backtrace from show_stack+0x10/0x14
+ show_stack from dump_stack_lvl+0x58/0x70
+ dump_stack_lvl from __warn+0x70/0x1c0
+ __warn from warn_slowpath_fmt+0x16c/0x294
+ warn_slowpath_fmt from disconnect_work+0xb8/0x144 [cfg80211]
+ disconnect_work [cfg80211] from process_one_work+0x204/0x620
+ process_one_work from worker_thread+0x1b0/0x474
+ worker_thread from kthread+0x10c/0x12c
+ kthread from ret_from_fork+0x14/0x24
+
+Reported-by: petter@technux.se
+Closes: https://lore.kernel.org/linux-wireless/9e98937d781c990615ef27ee0c858ff9@technux.se/T/#t
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/wireless/core.h | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -228,7 +228,6 @@ void cfg80211_register_wdev(struct cfg80
+ static inline void wdev_lock(struct wireless_dev *wdev)
+ __acquires(wdev)
+ {
+- lockdep_assert_held(&wdev->wiphy->mtx);
+ mutex_lock(&wdev->mtx);
+ __acquire(wdev->mtx);
+ }
+@@ -236,16 +235,11 @@ static inline void wdev_lock(struct wire
+ static inline void wdev_unlock(struct wireless_dev *wdev)
+ __releases(wdev)
+ {
+- lockdep_assert_held(&wdev->wiphy->mtx);
+ __release(wdev->mtx);
+ mutex_unlock(&wdev->mtx);
+ }
+
+-static inline void ASSERT_WDEV_LOCK(struct wireless_dev *wdev)
+-{
+- lockdep_assert_held(&wdev->wiphy->mtx);
+- lockdep_assert_held(&wdev->mtx);
+-}
++#define ASSERT_WDEV_LOCK(wdev) lockdep_assert_held(&(wdev)->mtx)
+
+ static inline bool cfg80211_has_monitors_only(struct cfg80211_registered_device *rdev)
+ {
powercap-intel_rapl-add-support-for-amd-family-1ah.patch
netfilter-nft_socket-make-cgroupsv2-matching-work-with-namespaces.patch
netfilter-nft_socket-fix-a-null-vs-is_err-bug-in-nft_socket_cgroup_subtree_level.patch
+bnxt_en-cap-the-size-of-hwrm_port_phy_qcfg-forwarded-response.patch
+netfilter-nft_set_pipapo-walk-over-current-view-on-netlink-dump.patch
+netfilter-nf_tables-missing-iterator-type-in-lookup-walk.patch
+revert-wifi-cfg80211-check-wiphy-mutex-is-held-for-wdev-mutex.patch
+gpiolib-cdev-ignore-reconfiguration-without-direction.patch
+nvme-pci-qdepth-1-quirk.patch
+x86-mm-switch-to-new-intel-cpu-model-defines.patch
+can-mcp251xfd-properly-indent-labels.patch
+can-mcp251xfd-move-mcp251xfd_timestamp_start-stop-into-mcp251xfd_chip_start-stop.patch
--- /dev/null
+From 2eda374e883ad297bd9fe575a16c1dc850346075 Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Wed, 24 Apr 2024 11:15:18 -0700
+Subject: x86/mm: Switch to new Intel CPU model defines
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit 2eda374e883ad297bd9fe575a16c1dc850346075 upstream.
+
+New CPU #defines encode vendor and family as well as model.
+
+[ dhansen: vertically align 0's in invlpg_miss_ids[] ]
+
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/all/20240424181518.41946-1-tony.luck%40intel.com
+[ Ricardo: I used the old match macro X86_MATCH_INTEL_FAM6_MODEL()
+ instead of X86_MATCH_VFM() as in the upstream commit. ]
+Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/init.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+--- a/arch/x86/mm/init.c
++++ b/arch/x86/mm/init.c
+@@ -261,21 +261,17 @@ static void __init probe_page_size_mask(
+ }
+ }
+
+-#define INTEL_MATCH(_model) { .vendor = X86_VENDOR_INTEL, \
+- .family = 6, \
+- .model = _model, \
+- }
+ /*
+ * INVLPG may not properly flush Global entries
+ * on these CPUs when PCIDs are enabled.
+ */
+ static const struct x86_cpu_id invlpg_miss_ids[] = {
+- INTEL_MATCH(INTEL_FAM6_ALDERLAKE ),
+- INTEL_MATCH(INTEL_FAM6_ALDERLAKE_L ),
+- INTEL_MATCH(INTEL_FAM6_ATOM_GRACEMONT ),
+- INTEL_MATCH(INTEL_FAM6_RAPTORLAKE ),
+- INTEL_MATCH(INTEL_FAM6_RAPTORLAKE_P),
+- INTEL_MATCH(INTEL_FAM6_RAPTORLAKE_S),
++ X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE, 0),
++ X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, 0),
++ X86_MATCH_INTEL_FAM6_MODEL(ATOM_GRACEMONT, 0),
++ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, 0),
++ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, 0),
++ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, 0),
+ {}
+ };
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
