--- /dev/null
+From 53987e309af1ad2ee31b566c21ebce62e237d040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jun 2021 16:05:26 +0200
+Subject: ALSA: ymfpci: Fix assignment in if condition
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit e7daaeedb4f270126792ae216f406c1ba2b8f4d9 ]
+
+PCI YMFPCI driver code contains lots of assignments in if condition,
+which is a bad coding style that may confuse readers and occasionally
+lead to bugs.
+
+This patch is merely for coding-style fixes, no functional changes.
+
+Link: https://lore.kernel.org/r/20210608140540.17885-53-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Stable-dep-of: 6be2e7522eb5 ("ALSA: ymfpci: Fix BUG_ON in probe function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/ymfpci/ymfpci.c | 71 +++++++++++++++++++--------------
+ sound/pci/ymfpci/ymfpci_main.c | 72 +++++++++++++++++++++++-----------
+ 2 files changed, 91 insertions(+), 52 deletions(-)
+
+diff --git a/sound/pci/ymfpci/ymfpci.c b/sound/pci/ymfpci/ymfpci.c
+index 9b0d18a7bf356..27fd10b976f77 100644
+--- a/sound/pci/ymfpci/ymfpci.c
++++ b/sound/pci/ymfpci/ymfpci.c
+@@ -78,7 +78,8 @@ static int snd_ymfpci_create_gameport(struct snd_ymfpci *chip, int dev,
+
+ if (io_port == 1) {
+ /* auto-detect */
+- if (!(io_port = pci_resource_start(chip->pci, 2)))
++ io_port = pci_resource_start(chip->pci, 2);
++ if (!io_port)
+ return -ENODEV;
+ }
+ } else {
+@@ -87,7 +88,8 @@ static int snd_ymfpci_create_gameport(struct snd_ymfpci *chip, int dev,
+ for (io_port = 0x201; io_port <= 0x205; io_port++) {
+ if (io_port == 0x203)
+ continue;
+- if ((r = request_region(io_port, 1, "YMFPCI gameport")) != NULL)
++ r = request_region(io_port, 1, "YMFPCI gameport");
++ if (r)
+ break;
+ }
+ if (!r) {
+@@ -108,10 +110,13 @@ static int snd_ymfpci_create_gameport(struct snd_ymfpci *chip, int dev,
+ }
+ }
+
+- if (!r && !(r = request_region(io_port, 1, "YMFPCI gameport"))) {
+- dev_err(chip->card->dev,
+- "joystick port %#x is in use.\n", io_port);
+- return -EBUSY;
++ if (!r) {
++ r = request_region(io_port, 1, "YMFPCI gameport");
++ if (!r) {
++ dev_err(chip->card->dev,
++ "joystick port %#x is in use.\n", io_port);
++ return -EBUSY;
++ }
+ }
+
+ chip->gameport = gp = gameport_allocate_port();
+@@ -199,8 +204,9 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,
+ /* auto-detect */
+ fm_port[dev] = pci_resource_start(pci, 1);
+ }
+- if (fm_port[dev] > 0 &&
+- (fm_res = request_region(fm_port[dev], 4, "YMFPCI OPL3")) != NULL) {
++ if (fm_port[dev] > 0)
++ fm_res = request_region(fm_port[dev], 4, "YMFPCI OPL3");
++ if (fm_res) {
+ legacy_ctrl |= YMFPCI_LEGACY_FMEN;
+ pci_write_config_word(pci, PCIR_DSXG_FMBASE, fm_port[dev]);
+ }
+@@ -208,8 +214,9 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,
+ /* auto-detect */
+ mpu_port[dev] = pci_resource_start(pci, 1) + 0x20;
+ }
+- if (mpu_port[dev] > 0 &&
+- (mpu_res = request_region(mpu_port[dev], 2, "YMFPCI MPU401")) != NULL) {
++ if (mpu_port[dev] > 0)
++ mpu_res = request_region(mpu_port[dev], 2, "YMFPCI MPU401");
++ if (mpu_res) {
+ legacy_ctrl |= YMFPCI_LEGACY_MEN;
+ pci_write_config_word(pci, PCIR_DSXG_MPU401BASE, mpu_port[dev]);
+ }
+@@ -221,8 +228,9 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,
+ case 0x3a8: legacy_ctrl2 |= 3; break;
+ default: fm_port[dev] = 0; break;
+ }
+- if (fm_port[dev] > 0 &&
+- (fm_res = request_region(fm_port[dev], 4, "YMFPCI OPL3")) != NULL) {
++ if (fm_port[dev] > 0)
++ fm_res = request_region(fm_port[dev], 4, "YMFPCI OPL3");
++ if (fm_res) {
+ legacy_ctrl |= YMFPCI_LEGACY_FMEN;
+ } else {
+ legacy_ctrl2 &= ~YMFPCI_LEGACY2_FMIO;
+@@ -235,8 +243,9 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,
+ case 0x334: legacy_ctrl2 |= 3 << 4; break;
+ default: mpu_port[dev] = 0; break;
+ }
+- if (mpu_port[dev] > 0 &&
+- (mpu_res = request_region(mpu_port[dev], 2, "YMFPCI MPU401")) != NULL) {
++ if (mpu_port[dev] > 0)
++ mpu_res = request_region(mpu_port[dev], 2, "YMFPCI MPU401");
++ if (mpu_res) {
+ legacy_ctrl |= YMFPCI_LEGACY_MEN;
+ } else {
+ legacy_ctrl2 &= ~YMFPCI_LEGACY2_MPUIO;
+@@ -250,9 +259,8 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,
+ pci_read_config_word(pci, PCIR_DSXG_LEGACY, &old_legacy_ctrl);
+ pci_write_config_word(pci, PCIR_DSXG_LEGACY, legacy_ctrl);
+ pci_write_config_word(pci, PCIR_DSXG_ELEGACY, legacy_ctrl2);
+- if ((err = snd_ymfpci_create(card, pci,
+- old_legacy_ctrl,
+- &chip)) < 0) {
++ err = snd_ymfpci_create(card, pci, old_legacy_ctrl, &chip);
++ if (err < 0) {
+ release_and_free_resource(mpu_res);
+ release_and_free_resource(fm_res);
+ goto free_card;
+@@ -293,11 +301,12 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,
+ goto free_card;
+
+ if (chip->mpu_res) {
+- if ((err = snd_mpu401_uart_new(card, 0, MPU401_HW_YMFPCI,
+- mpu_port[dev],
+- MPU401_INFO_INTEGRATED |
+- MPU401_INFO_IRQ_HOOK,
+- -1, &chip->rawmidi)) < 0) {
++ err = snd_mpu401_uart_new(card, 0, MPU401_HW_YMFPCI,
++ mpu_port[dev],
++ MPU401_INFO_INTEGRATED |
++ MPU401_INFO_IRQ_HOOK,
++ -1, &chip->rawmidi);
++ if (err < 0) {
+ dev_warn(card->dev,
+ "cannot initialize MPU401 at 0x%lx, skipping...\n",
+ mpu_port[dev]);
+@@ -306,18 +315,22 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,
+ }
+ }
+ if (chip->fm_res) {
+- if ((err = snd_opl3_create(card,
+- fm_port[dev],
+- fm_port[dev] + 2,
+- OPL3_HW_OPL3, 1, &opl3)) < 0) {
++ err = snd_opl3_create(card,
++ fm_port[dev],
++ fm_port[dev] + 2,
++ OPL3_HW_OPL3, 1, &opl3);
++ if (err < 0) {
+ dev_warn(card->dev,
+ "cannot initialize FM OPL3 at 0x%lx, skipping...\n",
+ fm_port[dev]);
+ legacy_ctrl &= ~YMFPCI_LEGACY_FMEN;
+ pci_write_config_word(pci, PCIR_DSXG_LEGACY, legacy_ctrl);
+- } else if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0) {
+- dev_err(card->dev, "cannot create opl3 hwdep\n");
+- goto free_card;
++ } else {
++ err = snd_opl3_hwdep_new(opl3, 0, 1, NULL);
++ if (err < 0) {
++ dev_err(card->dev, "cannot create opl3 hwdep\n");
++ goto free_card;
++ }
+ }
+ }
+
+diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
+index cacc6a9d14c8b..8fd0607698820 100644
+--- a/sound/pci/ymfpci/ymfpci_main.c
++++ b/sound/pci/ymfpci/ymfpci_main.c
+@@ -292,7 +292,8 @@ static void snd_ymfpci_pcm_interrupt(struct snd_ymfpci *chip, struct snd_ymfpci_
+ struct snd_ymfpci_pcm *ypcm;
+ u32 pos, delta;
+
+- if ((ypcm = voice->ypcm) == NULL)
++ ypcm = voice->ypcm;
++ if (!ypcm)
+ return;
+ if (ypcm->substream == NULL)
+ return;
+@@ -628,7 +629,8 @@ static int snd_ymfpci_playback_hw_params(struct snd_pcm_substream *substream,
+ struct snd_ymfpci_pcm *ypcm = runtime->private_data;
+ int err;
+
+- if ((err = snd_ymfpci_pcm_voice_alloc(ypcm, params_channels(hw_params))) < 0)
++ err = snd_ymfpci_pcm_voice_alloc(ypcm, params_channels(hw_params));
++ if (err < 0)
+ return err;
+ return 0;
+ }
+@@ -932,7 +934,8 @@ static int snd_ymfpci_playback_open(struct snd_pcm_substream *substream)
+ struct snd_ymfpci_pcm *ypcm;
+ int err;
+
+- if ((err = snd_ymfpci_playback_open_1(substream)) < 0)
++ err = snd_ymfpci_playback_open_1(substream);
++ if (err < 0)
+ return err;
+ ypcm = runtime->private_data;
+ ypcm->output_front = 1;
+@@ -954,7 +957,8 @@ static int snd_ymfpci_playback_spdif_open(struct snd_pcm_substream *substream)
+ struct snd_ymfpci_pcm *ypcm;
+ int err;
+
+- if ((err = snd_ymfpci_playback_open_1(substream)) < 0)
++ err = snd_ymfpci_playback_open_1(substream);
++ if (err < 0)
+ return err;
+ ypcm = runtime->private_data;
+ ypcm->output_front = 0;
+@@ -982,7 +986,8 @@ static int snd_ymfpci_playback_4ch_open(struct snd_pcm_substream *substream)
+ struct snd_ymfpci_pcm *ypcm;
+ int err;
+
+- if ((err = snd_ymfpci_playback_open_1(substream)) < 0)
++ err = snd_ymfpci_playback_open_1(substream);
++ if (err < 0)
+ return err;
+ ypcm = runtime->private_data;
+ ypcm->output_front = 0;
+@@ -1124,7 +1129,8 @@ int snd_ymfpci_pcm(struct snd_ymfpci *chip, int device)
+ struct snd_pcm *pcm;
+ int err;
+
+- if ((err = snd_pcm_new(chip->card, "YMFPCI", device, 32, 1, &pcm)) < 0)
++ err = snd_pcm_new(chip->card, "YMFPCI", device, 32, 1, &pcm);
++ if (err < 0)
+ return err;
+ pcm->private_data = chip;
+
+@@ -1157,7 +1163,8 @@ int snd_ymfpci_pcm2(struct snd_ymfpci *chip, int device)
+ struct snd_pcm *pcm;
+ int err;
+
+- if ((err = snd_pcm_new(chip->card, "YMFPCI - PCM2", device, 0, 1, &pcm)) < 0)
++ err = snd_pcm_new(chip->card, "YMFPCI - PCM2", device, 0, 1, &pcm);
++ if (err < 0)
+ return err;
+ pcm->private_data = chip;
+
+@@ -1190,7 +1197,8 @@ int snd_ymfpci_pcm_spdif(struct snd_ymfpci *chip, int device)
+ struct snd_pcm *pcm;
+ int err;
+
+- if ((err = snd_pcm_new(chip->card, "YMFPCI - IEC958", device, 1, 0, &pcm)) < 0)
++ err = snd_pcm_new(chip->card, "YMFPCI - IEC958", device, 1, 0, &pcm);
++ if (err < 0)
+ return err;
+ pcm->private_data = chip;
+
+@@ -1230,7 +1238,8 @@ int snd_ymfpci_pcm_4ch(struct snd_ymfpci *chip, int device)
+ struct snd_pcm *pcm;
+ int err;
+
+- if ((err = snd_pcm_new(chip->card, "YMFPCI - Rear", device, 1, 0, &pcm)) < 0)
++ err = snd_pcm_new(chip->card, "YMFPCI - Rear", device, 1, 0, &pcm);
++ if (err < 0)
+ return err;
+ pcm->private_data = chip;
+
+@@ -1785,7 +1794,8 @@ int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch)
+ .read = snd_ymfpci_codec_read,
+ };
+
+- if ((err = snd_ac97_bus(chip->card, 0, &ops, chip, &chip->ac97_bus)) < 0)
++ err = snd_ac97_bus(chip->card, 0, &ops, chip, &chip->ac97_bus);
++ if (err < 0)
+ return err;
+ chip->ac97_bus->private_free = snd_ymfpci_mixer_free_ac97_bus;
+ chip->ac97_bus->no_vra = 1; /* YMFPCI doesn't need VRA */
+@@ -1793,7 +1803,8 @@ int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch)
+ memset(&ac97, 0, sizeof(ac97));
+ ac97.private_data = chip;
+ ac97.private_free = snd_ymfpci_mixer_free_ac97;
+- if ((err = snd_ac97_mixer(chip->ac97_bus, &ac97, &chip->ac97)) < 0)
++ err = snd_ac97_mixer(chip->ac97_bus, &ac97, &chip->ac97);
++ if (err < 0)
+ return err;
+
+ /* to be sure */
+@@ -1801,7 +1812,8 @@ int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch)
+ AC97_EA_VRA|AC97_EA_VRM, 0);
+
+ for (idx = 0; idx < ARRAY_SIZE(snd_ymfpci_controls); idx++) {
+- if ((err = snd_ctl_add(chip->card, snd_ctl_new1(&snd_ymfpci_controls[idx], chip))) < 0)
++ err = snd_ctl_add(chip->card, snd_ctl_new1(&snd_ymfpci_controls[idx], chip));
++ if (err < 0)
+ return err;
+ }
+ if (chip->ac97->ext_id & AC97_EI_SDAC) {
+@@ -1814,27 +1826,37 @@ int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch)
+ /* add S/PDIF control */
+ if (snd_BUG_ON(!chip->pcm_spdif))
+ return -ENXIO;
+- if ((err = snd_ctl_add(chip->card, kctl = snd_ctl_new1(&snd_ymfpci_spdif_default, chip))) < 0)
++ kctl = snd_ctl_new1(&snd_ymfpci_spdif_default, chip);
++ err = snd_ctl_add(chip->card, kctl);
++ if (err < 0)
+ return err;
+ kctl->id.device = chip->pcm_spdif->device;
+- if ((err = snd_ctl_add(chip->card, kctl = snd_ctl_new1(&snd_ymfpci_spdif_mask, chip))) < 0)
++ kctl = snd_ctl_new1(&snd_ymfpci_spdif_mask, chip);
++ err = snd_ctl_add(chip->card, kctl);
++ if (err < 0)
+ return err;
+ kctl->id.device = chip->pcm_spdif->device;
+- if ((err = snd_ctl_add(chip->card, kctl = snd_ctl_new1(&snd_ymfpci_spdif_stream, chip))) < 0)
++ kctl = snd_ctl_new1(&snd_ymfpci_spdif_stream, chip);
++ err = snd_ctl_add(chip->card, kctl);
++ if (err < 0)
+ return err;
+ kctl->id.device = chip->pcm_spdif->device;
+ chip->spdif_pcm_ctl = kctl;
+
+ /* direct recording source */
+- if (chip->device_id == PCI_DEVICE_ID_YAMAHA_754 &&
+- (err = snd_ctl_add(chip->card, kctl = snd_ctl_new1(&snd_ymfpci_drec_source, chip))) < 0)
+- return err;
++ if (chip->device_id == PCI_DEVICE_ID_YAMAHA_754) {
++ kctl = snd_ctl_new1(&snd_ymfpci_drec_source, chip);
++ err = snd_ctl_add(chip->card, kctl);
++ if (err < 0)
++ return err;
++ }
+
+ /*
+ * shared rear/line-in
+ */
+ if (rear_switch) {
+- if ((err = snd_ctl_add(chip->card, snd_ctl_new1(&snd_ymfpci_rear_shared, chip))) < 0)
++ err = snd_ctl_add(chip->card, snd_ctl_new1(&snd_ymfpci_rear_shared, chip));
++ if (err < 0)
+ return err;
+ }
+
+@@ -1847,7 +1869,8 @@ int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch)
+ kctl->id.device = chip->pcm->device;
+ kctl->id.subdevice = idx;
+ kctl->private_value = (unsigned long)substream;
+- if ((err = snd_ctl_add(chip->card, kctl)) < 0)
++ err = snd_ctl_add(chip->card, kctl);
++ if (err < 0)
+ return err;
+ chip->pcm_mixer[idx].left = 0x8000;
+ chip->pcm_mixer[idx].right = 0x8000;
+@@ -1928,7 +1951,8 @@ int snd_ymfpci_timer(struct snd_ymfpci *chip, int device)
+ tid.card = chip->card->number;
+ tid.device = device;
+ tid.subdevice = 0;
+- if ((err = snd_timer_new(chip->card, "YMFPCI", &tid, &timer)) >= 0) {
++ err = snd_timer_new(chip->card, "YMFPCI", &tid, &timer);
++ if (err >= 0) {
+ strcpy(timer->name, "YMFPCI timer");
+ timer->private_data = chip;
+ timer->hw = snd_ymfpci_timer_hw;
+@@ -2334,7 +2358,8 @@ int snd_ymfpci_create(struct snd_card *card,
+ *rchip = NULL;
+
+ /* enable PCI device */
+- if ((err = pci_enable_device(pci)) < 0)
++ err = pci_enable_device(pci);
++ if (err < 0)
+ return err;
+
+ chip = kzalloc(sizeof(*chip), GFP_KERNEL);
+@@ -2357,7 +2382,8 @@ int snd_ymfpci_create(struct snd_card *card,
+ pci_set_master(pci);
+ chip->src441_used = -1;
+
+- if ((chip->res_reg_area = request_mem_region(chip->reg_area_phys, 0x8000, "YMFPCI")) == NULL) {
++ chip->res_reg_area = request_mem_region(chip->reg_area_phys, 0x8000, "YMFPCI");
++ if (!chip->res_reg_area) {
+ dev_err(chip->card->dev,
+ "unable to grab memory region 0x%lx-0x%lx\n",
+ chip->reg_area_phys, chip->reg_area_phys + 0x8000 - 1);
+--
+2.39.2
+
--- /dev/null
+From d5ed8d0a12358497d685ea6146005058897de3cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 06:28:08 +0300
+Subject: ALSA: ymfpci: Fix BUG_ON in probe function
+
+From: Tasos Sahanidis <tasos@tasossah.com>
+
+[ Upstream commit 6be2e7522eb529b41c16d459f33bbdbcddbf5c15 ]
+
+The snd_dma_buffer.bytes field now contains the aligned size, which this
+snd_BUG_ON() did not account for, resulting in the following:
+
+[ 9.625915] ------------[ cut here ]------------
+[ 9.633440] WARNING: CPU: 0 PID: 126 at sound/pci/ymfpci/ymfpci_main.c:2168 snd_ymfpci_create+0x681/0x698 [snd_ymfpci]
+[ 9.648926] Modules linked in: snd_ymfpci(+) snd_intel_dspcfg kvm(+) snd_intel_sdw_acpi snd_ac97_codec snd_mpu401_uart snd_opl3_lib irqbypass snd_hda_codec gameport snd_rawmidi crct10dif_pclmul crc32_pclmul cfg80211 snd_hda_core polyval_clmulni polyval_generic gf128mul snd_seq_device ghash_clmulni_intel snd_hwdep ac97_bus sha512_ssse3 rfkill snd_pcm aesni_intel tg3 snd_timer crypto_simd snd mxm_wmi libphy cryptd k10temp fam15h_power pcspkr soundcore sp5100_tco wmi acpi_cpufreq mac_hid dm_multipath sg loop fuse dm_mod bpf_preload ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 sr_mod cdrom ata_generic pata_acpi firewire_ohci crc32c_intel firewire_core xhci_pci crc_itu_t pata_via xhci_pci_renesas floppy
+[ 9.711849] CPU: 0 PID: 126 Comm: kworker/0:2 Not tainted 6.1.21-1-lts #1 08d2e5ece03136efa7c6aeea9a9c40916b1bd8da
+[ 9.722200] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./990FX Extreme4, BIOS P2.70 06/05/2014
+[ 9.732204] Workqueue: events work_for_cpu_fn
+[ 9.736580] RIP: 0010:snd_ymfpci_create+0x681/0x698 [snd_ymfpci]
+[ 9.742594] Code: 8c c0 4c 89 e2 48 89 df 48 c7 c6 92 c6 8c c0 e8 15 d0 e9 ff 48 83 c4 08 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d3 7a 33 e3 <0f> 0b e9 cb fd ff ff 41 bd fb ff ff ff eb db 41 bd f4 ff ff ff eb
+[ 9.761358] RSP: 0018:ffffab64804e7da0 EFLAGS: 00010287
+[ 9.766594] RAX: ffff8fa2df06c400 RBX: ffff8fa3073a8000 RCX: ffff8fa303fbc4a8
+[ 9.773734] RDX: ffff8fa2df06d000 RSI: 0000000000000010 RDI: 0000000000000020
+[ 9.780876] RBP: ffff8fa300b5d0d0 R08: ffff8fa3073a8e50 R09: 00000000df06bf00
+[ 9.788018] R10: ffff8fa2df06bf00 R11: 00000000df068200 R12: ffff8fa3073a8918
+[ 9.795159] R13: 0000000000000000 R14: 0000000000000080 R15: ffff8fa2df068200
+[ 9.802317] FS: 0000000000000000(0000) GS:ffff8fa9fec00000(0000) knlGS:0000000000000000
+[ 9.810414] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 9.816158] CR2: 000055febaf66500 CR3: 0000000101a2e000 CR4: 00000000000406f0
+[ 9.823301] Call Trace:
+[ 9.825747] <TASK>
+[ 9.827889] snd_card_ymfpci_probe+0x194/0x950 [snd_ymfpci b78a5fe64b5663a6390a909c67808567e3e73615]
+[ 9.837030] ? finish_task_switch.isra.0+0x90/0x2d0
+[ 9.841918] local_pci_probe+0x45/0x80
+[ 9.845680] work_for_cpu_fn+0x1a/0x30
+[ 9.849431] process_one_work+0x1c7/0x380
+[ 9.853464] worker_thread+0x1af/0x390
+[ 9.857225] ? rescuer_thread+0x3b0/0x3b0
+[ 9.861254] kthread+0xde/0x110
+[ 9.864414] ? kthread_complete_and_exit+0x20/0x20
+[ 9.869210] ret_from_fork+0x22/0x30
+[ 9.872792] </TASK>
+[ 9.874985] ---[ end trace 0000000000000000 ]---
+
+Fixes: 5c1733e33c88 ("ALSA: memalloc: Align buffer allocations in page size")
+Signed-off-by: Tasos Sahanidis <tasos@tasossah.com>
+Link: https://lore.kernel.org/r/20230329032808.170403-1-tasos@tasossah.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/ymfpci/ymfpci_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
+index 8fd0607698820..0cd9b4029dab1 100644
+--- a/sound/pci/ymfpci/ymfpci_main.c
++++ b/sound/pci/ymfpci/ymfpci_main.c
+@@ -2164,7 +2164,7 @@ static int snd_ymfpci_memalloc(struct snd_ymfpci *chip)
+ chip->work_base = ptr;
+ chip->work_base_addr = ptr_addr;
+
+- snd_BUG_ON(ptr + chip->work_size !=
++ snd_BUG_ON(ptr + PAGE_ALIGN(chip->work_size) !=
+ chip->work_ptr.area + chip->work_ptr.bytes);
+
+ snd_ymfpci_writel(chip, YDSXGR_PLAYCTRLBASE, chip->bank_base_playback_addr);
+--
+2.39.2
+
--- /dev/null
+From 3e814d0c577bfabd62f5c1a5f82b7de8a3f0c54b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 18:30:21 -0700
+Subject: bnxt_en: Add missing 200G link speed reporting
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 581bce7bcb7e7f100908728e7b292e266c76895b ]
+
+bnxt_fw_to_ethtool_speed() is missing the case statement for 200G
+link speed reported by firmware. As a result, ethtool will report
+unknown speed when the firmware reports 200G link speed.
+
+Fixes: 532262ba3b84 ("bnxt_en: ethtool: support PAM4 link speeds up to 200G")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 +
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 34affd1de91da..b7b07beb17ffb 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1198,6 +1198,7 @@ struct bnxt_link_info {
+ #define BNXT_LINK_SPEED_40GB PORT_PHY_QCFG_RESP_LINK_SPEED_40GB
+ #define BNXT_LINK_SPEED_50GB PORT_PHY_QCFG_RESP_LINK_SPEED_50GB
+ #define BNXT_LINK_SPEED_100GB PORT_PHY_QCFG_RESP_LINK_SPEED_100GB
++#define BNXT_LINK_SPEED_200GB PORT_PHY_QCFG_RESP_LINK_SPEED_200GB
+ u16 support_speeds;
+ u16 support_pam4_speeds;
+ u16 auto_link_speeds; /* fw adv setting */
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 81b63d1c2391f..1e67e86fc3344 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1653,6 +1653,8 @@ u32 bnxt_fw_to_ethtool_speed(u16 fw_link_speed)
+ return SPEED_50000;
+ case BNXT_LINK_SPEED_100GB:
+ return SPEED_100000;
++ case BNXT_LINK_SPEED_200GB:
++ return SPEED_200000;
+ default:
+ return SPEED_UNKNOWN;
+ }
+--
+2.39.2
+
--- /dev/null
+From 8e86ae9f1e7ab6ce953a1598c0a0929b06d14af1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 18:30:20 -0700
+Subject: bnxt_en: Fix typo in PCI id to device description string mapping
+
+From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+
+[ Upstream commit 62aad36ed31abc80f35db11e187e690448a79f7d ]
+
+Fix 57502 and 57508 NPAR description string entries. The typos
+caused these devices to not match up with lspci output.
+
+Fixes: 49c98421e6ab ("bnxt_en: Add PCI IDs for 57500 series NPAR devices.")
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 6928c0b578abb..3a9fcf942a6de 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -219,12 +219,12 @@ static const struct pci_device_id bnxt_pci_tbl[] = {
+ { PCI_VDEVICE(BROADCOM, 0x1750), .driver_data = BCM57508 },
+ { PCI_VDEVICE(BROADCOM, 0x1751), .driver_data = BCM57504 },
+ { PCI_VDEVICE(BROADCOM, 0x1752), .driver_data = BCM57502 },
+- { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57508_NPAR },
++ { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57502_NPAR },
+ { PCI_VDEVICE(BROADCOM, 0x1801), .driver_data = BCM57504_NPAR },
+- { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57502_NPAR },
+- { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57508_NPAR },
++ { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57508_NPAR },
++ { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57502_NPAR },
+ { PCI_VDEVICE(BROADCOM, 0x1804), .driver_data = BCM57504_NPAR },
+- { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57502_NPAR },
++ { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57508_NPAR },
+ { PCI_VDEVICE(BROADCOM, 0xd802), .driver_data = BCM58802 },
+ { PCI_VDEVICE(BROADCOM, 0xd804), .driver_data = BCM58804 },
+ #ifdef CONFIG_BNXT_SRIOV
+--
+2.39.2
+
--- /dev/null
+From 93f5323eb87c0aa1c55bbbb59ff6e15cf83bb82a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 11:18:24 -0800
+Subject: ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx()
+
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+
+[ Upstream commit 748b2f5e82d17480404b3e2895388fc2925f7caf ]
+
+mac_len is of type unsigned, which can never be less than zero.
+
+ mac_len = ieee802154_hdr_peek_addrs(skb, &header);
+ if (mac_len < 0)
+ return mac_len;
+
+Change this to type int as ieee802154_hdr_peek_addrs() can return negative
+integers, this is found by static analysis with smatch.
+
+Fixes: 6c993779ea1d ("ca8210: fix mac_len negative array access")
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Acked-by: Alexander Aring <aahringo@redhat.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230306191824.4115839-1-harshit.m.mogalapalli@oracle.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ieee802154/ca8210.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index 5beb447529f9e..1c5d70c60354b 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -1945,10 +1945,9 @@ static int ca8210_skb_tx(
+ struct ca8210_priv *priv
+ )
+ {
+- int status;
+ struct ieee802154_hdr header = { };
+ struct secspec secspec;
+- unsigned int mac_len;
++ int mac_len, status;
+
+ dev_dbg(&priv->spi->dev, "%s called\n", __func__);
+
+--
+2.39.2
+
--- /dev/null
+From 0aea207d704b4484dc82b1e1a9af64cd7cb6360f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 16:04:45 +0400
+Subject: can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
+
+From: Ivan Orlov <ivan.orlov0322@gmail.com>
+
+[ Upstream commit 2b4c99f7d9a57ecd644eda9b1fb0a1072414959f ]
+
+Syzkaller reported the following issue:
+
+=====================================================
+BUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline]
+BUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600
+ aio_rw_done fs/aio.c:1520 [inline]
+ aio_write+0x899/0x950 fs/aio.c:1600
+ io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019
+ __do_sys_io_submit fs/aio.c:2078 [inline]
+ __se_sys_io_submit+0x293/0x770 fs/aio.c:2048
+ __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Uninit was created at:
+ slab_post_alloc_hook mm/slab.h:766 [inline]
+ slab_alloc_node mm/slub.c:3452 [inline]
+ __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491
+ __do_kmalloc_node mm/slab_common.c:967 [inline]
+ __kmalloc+0x11d/0x3b0 mm/slab_common.c:981
+ kmalloc_array include/linux/slab.h:636 [inline]
+ bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930
+ bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351
+ sock_sendmsg_nosec net/socket.c:714 [inline]
+ sock_sendmsg net/socket.c:734 [inline]
+ sock_write_iter+0x495/0x5e0 net/socket.c:1108
+ call_write_iter include/linux/fs.h:2189 [inline]
+ aio_write+0x63a/0x950 fs/aio.c:1600
+ io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019
+ __do_sys_io_submit fs/aio.c:2078 [inline]
+ __se_sys_io_submit+0x293/0x770 fs/aio.c:2048
+ __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
+=====================================================
+
+We can follow the call chain and find that 'bcm_tx_setup' function
+calls 'memcpy_from_msg' to copy some content to the newly allocated
+frame of 'op->frames'. After that the 'len' field of copied structure
+being compared with some constant value (64 or 8). However, if
+'memcpy_from_msg' returns an error, we will compare some uninitialized
+memory. This triggers 'uninit-value' issue.
+
+This patch will add 'memcpy_from_msg' possible errors processing to
+avoid uninit-value issue.
+
+Tested via syzkaller
+
+Reported-by: syzbot+c9bfd85eca611ebf5db1@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?id=47f897f8ad958bbde5790ebf389b5e7e0a345089
+Signed-off-by: Ivan Orlov <ivan.orlov0322@gmail.com>
+Fixes: 6f3b911d5f29b ("can: bcm: add support for CAN FD frames")
+Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Link: https://lore.kernel.org/all/20230314120445.12407-1-ivan.orlov0322@gmail.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/bcm.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index afa82adaf6cd5..ddba4e12da783 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -936,6 +936,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+
+ cf = op->frames + op->cfsiz * i;
+ err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz);
++ if (err < 0)
++ goto free_op;
+
+ if (op->flags & CAN_FD_FRAME) {
+ if (cf->len > 64)
+@@ -945,12 +947,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ err = -EINVAL;
+ }
+
+- if (err < 0) {
+- if (op->frames != &op->sframe)
+- kfree(op->frames);
+- kfree(op);
+- return err;
+- }
++ if (err < 0)
++ goto free_op;
+
+ if (msg_head->flags & TX_CP_CAN_ID) {
+ /* copy can_id into frame */
+@@ -1021,6 +1019,12 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ bcm_tx_start_timer(op);
+
+ return msg_head->nframes * op->cfsiz + MHSIZ;
++
++free_op:
++ if (op->frames != &op->sframe)
++ kfree(op->frames);
++ kfree(op);
++ return err;
+ }
+
+ /*
+--
+2.39.2
+
--- /dev/null
+From 50956810a7064978a6b992c9ecff81c1089f47a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 10:26:59 -0700
+Subject: i40e: fix registers dump after run ethtool adapter self test
+
+From: Radoslaw Tyl <radoslawx.tyl@intel.com>
+
+[ Upstream commit c5cff16f461a4a434a9915a7be7ac9ced861a8a4 ]
+
+Fix invalid registers dump from ethtool -d ethX after adapter self test
+by ethtool -t ethY. It causes invalid data display.
+
+The problem was caused by overwriting i40e_reg_list[].elements
+which is common for ethtool self test and dump.
+
+Fixes: 22dd9ae8afcc ("i40e: Rework register diagnostic")
+Signed-off-by: Radoslaw Tyl <radoslawx.tyl@intel.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Tested-by: Arpana Arland <arpanax.arland@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/20230328172659.3906413-1-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_diag.c | 11 ++++++-----
+ drivers/net/ethernet/intel/i40e/i40e_diag.h | 2 +-
+ 2 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.c b/drivers/net/ethernet/intel/i40e/i40e_diag.c
+index ef4d3762bf371..ca229b0efeb65 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_diag.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.c
+@@ -44,7 +44,7 @@ static i40e_status i40e_diag_reg_pattern_test(struct i40e_hw *hw,
+ return 0;
+ }
+
+-struct i40e_diag_reg_test_info i40e_reg_list[] = {
++const struct i40e_diag_reg_test_info i40e_reg_list[] = {
+ /* offset mask elements stride */
+ {I40E_QTX_CTL(0), 0x0000FFBF, 1,
+ I40E_QTX_CTL(1) - I40E_QTX_CTL(0)},
+@@ -78,27 +78,28 @@ i40e_status i40e_diag_reg_test(struct i40e_hw *hw)
+ {
+ i40e_status ret_code = 0;
+ u32 reg, mask;
++ u32 elements;
+ u32 i, j;
+
+ for (i = 0; i40e_reg_list[i].offset != 0 &&
+ !ret_code; i++) {
+
++ elements = i40e_reg_list[i].elements;
+ /* set actual reg range for dynamically allocated resources */
+ if (i40e_reg_list[i].offset == I40E_QTX_CTL(0) &&
+ hw->func_caps.num_tx_qp != 0)
+- i40e_reg_list[i].elements = hw->func_caps.num_tx_qp;
++ elements = hw->func_caps.num_tx_qp;
+ if ((i40e_reg_list[i].offset == I40E_PFINT_ITRN(0, 0) ||
+ i40e_reg_list[i].offset == I40E_PFINT_ITRN(1, 0) ||
+ i40e_reg_list[i].offset == I40E_PFINT_ITRN(2, 0) ||
+ i40e_reg_list[i].offset == I40E_QINT_TQCTL(0) ||
+ i40e_reg_list[i].offset == I40E_QINT_RQCTL(0)) &&
+ hw->func_caps.num_msix_vectors != 0)
+- i40e_reg_list[i].elements =
+- hw->func_caps.num_msix_vectors - 1;
++ elements = hw->func_caps.num_msix_vectors - 1;
+
+ /* test register access */
+ mask = i40e_reg_list[i].mask;
+- for (j = 0; j < i40e_reg_list[i].elements && !ret_code; j++) {
++ for (j = 0; j < elements && !ret_code; j++) {
+ reg = i40e_reg_list[i].offset +
+ (j * i40e_reg_list[i].stride);
+ ret_code = i40e_diag_reg_pattern_test(hw, reg, mask);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.h b/drivers/net/ethernet/intel/i40e/i40e_diag.h
+index c3340f320a18c..1db7c6d572311 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_diag.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.h
+@@ -20,7 +20,7 @@ struct i40e_diag_reg_test_info {
+ u32 stride; /* bytes between each element */
+ };
+
+-extern struct i40e_diag_reg_test_info i40e_reg_list[];
++extern const struct i40e_diag_reg_test_info i40e_reg_list[];
+
+ i40e_status i40e_diag_reg_test(struct i40e_hw *hw);
+ i40e_status i40e_diag_eeprom_test(struct i40e_hw *hw);
+--
+2.39.2
+
--- /dev/null
+From bd2239725e5c0f2decf01e39498c6deb6498ab9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 11:20:04 +0100
+Subject: mips: bmips: BCM6358: disable RAC flush for TP1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+[ Upstream commit ab327f8acdf8d06601fbf058859a539a9422afff ]
+
+RAC flush causes kernel panics on BCM6358 with EHCI/OHCI when booting from TP1:
+[ 3.881739] usb 1-1: new high-speed USB device number 2 using ehci-platform
+[ 3.895011] Reserved instruction in kernel code[#1]:
+[ 3.900113] CPU: 0 PID: 1 Comm: init Not tainted 5.10.16 #0
+[ 3.905829] $ 0 : 00000000 10008700 00000000 77d94060
+[ 3.911238] $ 4 : 7fd1f088 00000000 81431cac 81431ca0
+[ 3.916641] $ 8 : 00000000 ffffefff 8075cd34 00000000
+[ 3.922043] $12 : 806f8d40 f3e812b7 00000000 000d9aaa
+[ 3.927446] $16 : 7fd1f068 7fd1f080 7ff559b8 81428470
+[ 3.932848] $20 : 00000000 00000000 55590000 77d70000
+[ 3.938251] $24 : 00000018 00000010
+[ 3.943655] $28 : 81430000 81431e60 81431f28 800157fc
+[ 3.949058] Hi : 00000000
+[ 3.952013] Lo : 00000000
+[ 3.955019] epc : 80015808 setup_sigcontext+0x54/0x24c
+[ 3.960464] ra : 800157fc setup_sigcontext+0x48/0x24c
+[ 3.965913] Status: 10008703 KERNEL EXL IE
+[ 3.970216] Cause : 00800028 (ExcCode 0a)
+[ 3.974340] PrId : 0002a010 (Broadcom BMIPS4350)
+[ 3.979170] Modules linked in: ohci_platform ohci_hcd fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug usbcore nls_base usb_common
+[ 3.992907] Process init (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=77e22ec8)
+[ 4.000776] Stack : 81431ef4 7fd1f080 81431f28 81428470 7fd1f068 81431edc 7ff559b8 81428470
+[ 4.009467] 81431f28 7fd1f080 55590000 77d70000 77d5498c 80015c70 806f0000 8063ae74
+[ 4.018149] 08100002 81431f28 0000000a 08100002 81431f28 0000000a 77d6b418 00000003
+[ 4.026831] ffffffff 80016414 80080734 81431ecc 81431ecc 00000001 00000000 04000000
+[ 4.035512] 77d54874 00000000 00000000 00000000 00000000 00000012 00000002 00000000
+[ 4.044196] ...
+[ 4.046706] Call Trace:
+[ 4.049238] [<80015808>] setup_sigcontext+0x54/0x24c
+[ 4.054356] [<80015c70>] setup_frame+0xdc/0x124
+[ 4.059015] [<80016414>] do_notify_resume+0x1dc/0x288
+[ 4.064207] [<80011b50>] work_notifysig+0x10/0x18
+[ 4.069036]
+[ 4.070538] Code: 8fc300b4 00001025 26240008 <ac820000> ac830004 3c048063 0c0228aa 24846a00 26240010
+[ 4.080686]
+[ 4.082517] ---[ end trace 22a8edb41f5f983b ]---
+[ 4.087374] Kernel panic - not syncing: Fatal exception
+[ 4.092753] Rebooting in 1 seconds..
+
+Because the bootloader (CFE) is not initializing the Read-ahead cache properly
+on the second thread (TP1). Since the RAC was not initialized properly, we
+should avoid flushing it at the risk of corrupting the instruction stream as
+seen in the trace above.
+
+Fixes: d59098a0e9cb ("MIPS: bmips: use generic dma noncoherent ops")
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/bmips/dma.c | 5 +++++
+ arch/mips/bmips/setup.c | 8 ++++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/arch/mips/bmips/dma.c b/arch/mips/bmips/dma.c
+index 49061b870680b..daef44f682984 100644
+--- a/arch/mips/bmips/dma.c
++++ b/arch/mips/bmips/dma.c
+@@ -64,6 +64,8 @@ phys_addr_t dma_to_phys(struct device *dev, dma_addr_t dma_addr)
+ return dma_addr;
+ }
+
++bool bmips_rac_flush_disable;
++
+ void arch_sync_dma_for_cpu_all(void)
+ {
+ void __iomem *cbr = BMIPS_GET_CBR();
+@@ -74,6 +76,9 @@ void arch_sync_dma_for_cpu_all(void)
+ boot_cpu_type() != CPU_BMIPS4380)
+ return;
+
++ if (unlikely(bmips_rac_flush_disable))
++ return;
++
+ /* Flush stale data out of the readahead cache */
+ cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG);
+ __raw_writel(cfg | 0x100, cbr + BMIPS_RAC_CONFIG);
+diff --git a/arch/mips/bmips/setup.c b/arch/mips/bmips/setup.c
+index 1b06b25aea87d..16063081d61ec 100644
+--- a/arch/mips/bmips/setup.c
++++ b/arch/mips/bmips/setup.c
+@@ -34,6 +34,8 @@
+ #define REG_BCM6328_OTP ((void __iomem *)CKSEG1ADDR(0x1000062c))
+ #define BCM6328_TP1_DISABLED BIT(9)
+
++extern bool bmips_rac_flush_disable;
++
+ static const unsigned long kbase = VMLINUX_LOAD_ADDRESS & 0xfff00000;
+
+ struct bmips_quirk {
+@@ -103,6 +105,12 @@ static void bcm6358_quirks(void)
+ * disable SMP for now
+ */
+ bmips_smp_enabled = 0;
++
++ /*
++ * RAC flush causes kernel panics on BCM6358 when booting from TP1
++ * because the bootloader is not initializing it properly.
++ */
++ bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local() & (1 << 31));
+ }
+
+ static void bcm6368_quirks(void)
+--
+2.39.2
+
--- /dev/null
+From 1b8be86c31cba2bf6a589c4275728080031c6317 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 10:32:44 +0300
+Subject: mtd: rawnand: meson: invalidate cache on polling ECC bit
+
+From: Arseniy Krasnov <avkrasnov@sberdevices.ru>
+
+[ Upstream commit e732e39ed9929c05fd219035bc9653ba4100d4fa ]
+
+'info_buf' memory is cached and driver polls ECC bit in it. This bit
+is set by the NAND controller. If 'usleep_range()' returns before device
+sets this bit, 'info_buf' will be cached and driver won't see update of
+this bit and will loop forever.
+
+Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller")
+Signed-off-by: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/d4ef0bd6-816e-f6fa-9385-f05f775f0ae2@sberdevices.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/meson_nand.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c
+index 38f490088d764..dc631c5143187 100644
+--- a/drivers/mtd/nand/raw/meson_nand.c
++++ b/drivers/mtd/nand/raw/meson_nand.c
+@@ -172,6 +172,7 @@ struct meson_nfc {
+
+ dma_addr_t daddr;
+ dma_addr_t iaddr;
++ u32 info_bytes;
+
+ unsigned long assigned_cs;
+ };
+@@ -499,6 +500,7 @@ static int meson_nfc_dma_buffer_setup(struct nand_chip *nand, void *databuf,
+ nfc->daddr, datalen, dir);
+ return ret;
+ }
++ nfc->info_bytes = infolen;
+ cmd = GENCMDIADDRL(NFC_CMD_AIL, nfc->iaddr);
+ writel(cmd, nfc->reg_base + NFC_REG_CMD);
+
+@@ -516,8 +518,10 @@ static void meson_nfc_dma_buffer_release(struct nand_chip *nand,
+ struct meson_nfc *nfc = nand_get_controller_data(nand);
+
+ dma_unmap_single(nfc->dev, nfc->daddr, datalen, dir);
+- if (infolen)
++ if (infolen) {
+ dma_unmap_single(nfc->dev, nfc->iaddr, infolen, dir);
++ nfc->info_bytes = 0;
++ }
+ }
+
+ static int meson_nfc_read_buf(struct nand_chip *nand, u8 *buf, int len)
+@@ -706,6 +710,8 @@ static void meson_nfc_check_ecc_pages_valid(struct meson_nfc *nfc,
+ usleep_range(10, 15);
+ /* info is updated by nfc dma engine*/
+ smp_rmb();
++ dma_sync_single_for_cpu(nfc->dev, nfc->iaddr, nfc->info_bytes,
++ DMA_FROM_DEVICE);
+ ret = *info & ECC_COMPLETE;
+ } while (!ret);
+ }
+--
+2.39.2
+
--- /dev/null
+From 20be5bb3abbe57b59f1106ee50fd25bc33462b10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 12:01:40 -0300
+Subject: net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Steffen Bätz <steffen@innosonix.de>
+
+[ Upstream commit 7bcad0f0e6fbc1d613e49e0ee35c8e5f2e685bb0 ]
+
+Do not set the MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP bit on CPU or DSA ports.
+
+This allows the host CPU port to be a regular IGMP listener by sending out
+IGMP Membership Reports, which would otherwise not be forwarded by the
+mv88exxx chip, but directly looped back to the CPU port itself.
+
+Fixes: 54d792f257c6 ("net: dsa: Centralise global and port setup code into mv88e6xxx.")
+Signed-off-by: Steffen Bätz <steffen@innosonix.de>
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20230329150140.701559-1-festevam@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index a253476a52b01..0b104a90c0d80 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2611,9 +2611,14 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+ * If this is the upstream port for this switch, enable
+ * forwarding of unknown unicasts and multicasts.
+ */
+- reg = MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP |
+- MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP |
++ reg = MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP |
+ MV88E6XXX_PORT_CTL0_STATE_FORWARDING;
++ /* Forward any IPv4 IGMP or IPv6 MLD frames received
++ * by a USER port to the CPU port to allow snooping.
++ */
++ if (dsa_is_user_port(ds, port))
++ reg |= MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP;
++
+ err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_CTL0, reg);
+ if (err)
+ return err;
+--
+2.39.2
+
--- /dev/null
+From 2266be3f73dedb2a13cafa02a1022981bb4956ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 11:27:51 -0500
+Subject: net: ipa: compute DMA pool size properly
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 6c75dc94f2b27fff57b305af9236eea181a00b6c ]
+
+In gsi_trans_pool_init_dma(), the total size of a pool of memory
+used for DMA transactions is calculated. However the calculation is
+done incorrectly.
+
+For 4KB pages, this total size is currently always more than one
+page, and as a result, the calculation produces a positive (though
+incorrect) total size. The code still works in this case; we just
+end up with fewer DMA pool entries than we intended.
+
+Bjorn Andersson tested booting a kernel with 16KB pages, and hit a
+null pointer derereference in sg_alloc_append_table_from_pages(),
+descending from gsi_trans_pool_init_dma(). The cause of this was
+that a 16KB total size was going to be allocated, and with 16KB
+pages the order of that allocation is 0. The total_size calculation
+yielded 0, which eventually led to the crash.
+
+Correcting the total_size calculation fixes the problem.
+
+Reported-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Tested-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Fixes: 9dd441e4ed57 ("soc: qcom: ipa: GSI transactions")
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Alex Elder <elder@linaro.org>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/20230328162751.2861791-1-elder@linaro.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipa/gsi_trans.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ipa/gsi_trans.c b/drivers/net/ipa/gsi_trans.c
+index 70c2b585f98d6..1e0d626393012 100644
+--- a/drivers/net/ipa/gsi_trans.c
++++ b/drivers/net/ipa/gsi_trans.c
+@@ -159,7 +159,7 @@ int gsi_trans_pool_init_dma(struct device *dev, struct gsi_trans_pool *pool,
+ * gsi_trans_pool_exit_dma() can assume the total allocated
+ * size is exactly (count * size).
+ */
+- total_size = get_order(total_size) << PAGE_SHIFT;
++ total_size = PAGE_SIZE << get_order(total_size);
+
+ virt = dma_alloc_coherent(dev, total_size, &addr, GFP_KERNEL);
+ if (!virt)
+--
+2.39.2
+
--- /dev/null
+From 514edffe9a013287bb3b425686251fd5b546de6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 17:19:54 +0800
+Subject: net/net_failover: fix txq exceeding warning
+
+From: Faicker Mo <faicker.mo@ucloud.cn>
+
+[ Upstream commit e3cbdcb0fbb61045ef3ce0e072927cc41737f787 ]
+
+The failover txq is inited as 16 queues.
+when a packet is transmitted from the failover device firstly,
+the failover device will select the queue which is returned from
+the primary device if the primary device is UP and running.
+If the primary device txq is bigger than the default 16,
+it can lead to the following warning:
+eth0 selects TX queue 18, but real number of TX queues is 16
+
+The warning backtrace is:
+[ 32.146376] CPU: 18 PID: 9134 Comm: chronyd Tainted: G E 6.2.8-1.el7.centos.x86_64 #1
+[ 32.147175] Hardware name: Red Hat KVM, BIOS 1.10.2-3.el7_4.1 04/01/2014
+[ 32.147730] Call Trace:
+[ 32.147971] <TASK>
+[ 32.148183] dump_stack_lvl+0x48/0x70
+[ 32.148514] dump_stack+0x10/0x20
+[ 32.148820] netdev_core_pick_tx+0xb1/0xe0
+[ 32.149180] __dev_queue_xmit+0x529/0xcf0
+[ 32.149533] ? __check_object_size.part.0+0x21c/0x2c0
+[ 32.149967] ip_finish_output2+0x278/0x560
+[ 32.150327] __ip_finish_output+0x1fe/0x2f0
+[ 32.150690] ip_finish_output+0x2a/0xd0
+[ 32.151032] ip_output+0x7a/0x110
+[ 32.151337] ? __pfx_ip_finish_output+0x10/0x10
+[ 32.151733] ip_local_out+0x5e/0x70
+[ 32.152054] ip_send_skb+0x19/0x50
+[ 32.152366] udp_send_skb.isra.0+0x163/0x3a0
+[ 32.152736] udp_sendmsg+0xba8/0xec0
+[ 32.153060] ? __folio_memcg_unlock+0x25/0x60
+[ 32.153445] ? __pfx_ip_generic_getfrag+0x10/0x10
+[ 32.153854] ? sock_has_perm+0x85/0xa0
+[ 32.154190] inet_sendmsg+0x6d/0x80
+[ 32.154508] ? inet_sendmsg+0x6d/0x80
+[ 32.154838] sock_sendmsg+0x62/0x70
+[ 32.155152] ____sys_sendmsg+0x134/0x290
+[ 32.155499] ___sys_sendmsg+0x81/0xc0
+[ 32.155828] ? _get_random_bytes.part.0+0x79/0x1a0
+[ 32.156240] ? ip4_datagram_release_cb+0x5f/0x1e0
+[ 32.156649] ? get_random_u16+0x69/0xf0
+[ 32.156989] ? __fget_light+0xcf/0x110
+[ 32.157326] __sys_sendmmsg+0xc4/0x210
+[ 32.157657] ? __sys_connect+0xb7/0xe0
+[ 32.157995] ? __audit_syscall_entry+0xce/0x140
+[ 32.158388] ? syscall_trace_enter.isra.0+0x12c/0x1a0
+[ 32.158820] __x64_sys_sendmmsg+0x24/0x30
+[ 32.159171] do_syscall_64+0x38/0x90
+[ 32.159493] entry_SYSCALL_64_after_hwframe+0x72/0xdc
+
+Fix that by reducing txq number as the non-existent primary-dev does.
+
+Fixes: cfc80d9a1163 ("net: Introduce net_failover driver")
+Signed-off-by: Faicker Mo <faicker.mo@ucloud.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/net_failover.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c
+index fb182bec8f062..6b7bba720d8c7 100644
+--- a/drivers/net/net_failover.c
++++ b/drivers/net/net_failover.c
+@@ -130,14 +130,10 @@ static u16 net_failover_select_queue(struct net_device *dev,
+ txq = ops->ndo_select_queue(primary_dev, skb, sb_dev);
+ else
+ txq = netdev_pick_tx(primary_dev, skb, NULL);
+-
+- qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping;
+-
+- return txq;
++ } else {
++ txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0;
+ }
+
+- txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0;
+-
+ /* Save the original txq to restore before passing to the driver */
+ qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping;
+
+--
+2.39.2
+
--- /dev/null
+From 6da259d0b55fb5c59835d224ca1c753eb8f1ac63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Mar 2023 13:28:15 +0200
+Subject: net: stmmac: don't reject VLANs when IFF_PROMISC is set
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit a7602e7332b97cfbec7bacb0f1ade99a575fe104 ]
+
+The blamed commit has introduced the following tests to
+dwmac4_add_hw_vlan_rx_fltr(), called from stmmac_vlan_rx_add_vid():
+
+ if (hw->promisc) {
+ netdev_err(dev,
+ "Adding VLAN in promisc mode not supported\n");
+ return -EPERM;
+ }
+
+"VLAN promiscuous" mode is keyed in this driver to IFF_PROMISC, and so,
+vlan_vid_add() and vlan_vid_del() calls cannot take place in IFF_PROMISC
+mode. I have the following 2 arguments that this restriction is.... hm,
+how shall I put it nicely... unproductive :)
+
+First, take the case of a Linux bridge. If the kernel is compiled with
+CONFIG_BRIDGE_VLAN_FILTERING=y, then this bridge shall have a VLAN
+database. The bridge shall try to call vlan_add_vid() on its bridge
+ports for each VLAN in the VLAN table. It will do this irrespectively of
+whether that port is *currently* VLAN-aware or not. So it will do this
+even when the bridge was created with vlan_filtering 0.
+But the Linux bridge, in VLAN-unaware mode, configures its ports in
+promiscuous (IFF_PROMISC) mode, so that they accept packets with any
+MAC DA (a switch must do this in order to forward those packets which
+are not directly targeted to its MAC address).
+
+As a result, the stmmac driver does not work as a bridge port, when the
+kernel is compiled with CONFIG_BRIDGE_VLAN_FILTERING=y.
+
+$ ip link add br0 type bridge && ip link set br0 up
+$ ip link set eth0 master br0 && ip link set eth0 up
+[ 2333.943296] br0: port 1(eth0) entered blocking state
+[ 2333.943381] br0: port 1(eth0) entered disabled state
+[ 2333.943782] device eth0 entered promiscuous mode
+[ 2333.944080] 4033c000.ethernet eth0: Adding VLAN in promisc mode not supported
+[ 2333.976509] 4033c000.ethernet eth0: failed to initialize vlan filtering on this port
+RTNETLINK answers: Operation not permitted
+
+Secondly, take the case of stmmac as DSA master. Some switch tagging
+protocols are based on 802.1Q VLANs (tag_sja1105.c), and as such,
+tag_8021q.c uses vlan_vid_add() to work with VLAN-filtering DSA masters.
+But also, when a DSA port becomes promiscuous (for example when it joins
+a bridge), the DSA framework also makes the DSA master promiscuous.
+
+Moreover, for every VLAN that a DSA switch sends to the CPU, DSA also
+programs a VLAN filter on the DSA master, because if the the DSA switch
+uses a tail tag, then the hardware frame parser of the DSA master will
+see VLAN as VLAN, and might filter them out, for being unknown.
+
+Due to the above 2 reasons, my belief is that the stmmac driver does not
+get to choose to not accept vlan_vid_add() calls while IFF_PROMISC is
+enabled, because the 2 are completely independent and there are code
+paths in the network stack which directly lead to this situation
+occurring, without the user's direct input.
+
+In fact, my belief is that "VLAN promiscuous" mode should have never
+been keyed on IFF_PROMISC in the first place, but rather, on the
+NETIF_F_HW_VLAN_CTAG_FILTER feature flag which can be toggled by the
+user through ethtool -k, when present in netdev->hw_features.
+
+In the stmmac driver, NETIF_F_HW_VLAN_CTAG_FILTER is only present in
+"features", making this feature "on [fixed]".
+
+I have this belief because I am unaware of any definition of promiscuity
+which implies having an effect on anything other than MAC DA (therefore
+not VLAN). However, I seem to be rather alone in having this opinion,
+looking back at the disagreements from this discussion:
+https://lore.kernel.org/netdev/20201110153958.ci5ekor3o2ekg3ky@ipetronik.com/
+
+In any case, to remove the vlan_vid_add() dependency on !IFF_PROMISC,
+one would need to remove the check and see what fails. I guess the test
+was there because of the way in which dwmac4_vlan_promisc_enable() is
+implemented.
+
+For context, the dwmac4 supports Perfect Filtering for a limited number
+of VLANs - dwmac4_get_num_vlan(), priv->hw->num_vlan, with a fallback on
+Hash Filtering - priv->dma_cap.vlhash - see stmmac_vlan_update(), also
+visible in cat /sys/kernel/debug/stmmaceth/eth0/dma_cap | grep 'VLAN
+Hash Filtering'.
+
+The perfect filtering is based on MAC_VLAN_Tag_Filter/MAC_VLAN_Tag_Data
+registers, accessed in the driver through dwmac4_write_vlan_filter().
+
+The hash filtering is based on the MAC_VLAN_Hash_Table register, named
+GMAC_VLAN_HASH_TABLE in the driver and accessed by dwmac4_update_vlan_hash().
+The control bit for enabling hash filtering is GMAC_VLAN_VTHM
+(MAC_VLAN_Tag_Ctrl bit VTHM: VLAN Tag Hash Table Match Enable).
+
+Now, the description of dwmac4_vlan_promisc_enable() is that it iterates
+through the driver's cache of perfect filter entries (hw->vlan_filter[i],
+added by dwmac4_add_hw_vlan_rx_fltr()), and evicts them from hardware by
+unsetting their GMAC_VLAN_TAG_DATA_VEN (MAC_VLAN_Tag_Data bit VEN - VLAN
+Tag Enable) bit. Then it unsets the GMAC_VLAN_VTHM bit, which disables
+hash matching.
+
+This leaves the MAC, according to table "VLAN Match Status" from the
+documentation, to always enter these data paths:
+
+VID |VLAN Perfect Filter |VTHM Bit |VLAN Hash Filter |Final VLAN Match
+ |Match Result | |Match Result |Status
+-------|--------------------|---------|-----------------|----------------
+VID!=0 |Fail |0 |don't care |Pass
+
+So, dwmac4_vlan_promisc_enable() does its job, but by unsetting
+GMAC_VLAN_VTHM, it conflicts with the other code path which controls
+this bit: dwmac4_update_vlan_hash(), called through stmmac_update_vlan_hash()
+from stmmac_vlan_rx_add_vid() and from stmmac_vlan_rx_kill_vid().
+This is, I guess, why dwmac4_add_hw_vlan_rx_fltr() is not allowed to run
+after dwmac4_vlan_promisc_enable() has unset GMAC_VLAN_VTHM: because if
+it did, then dwmac4_update_vlan_hash() would set GMAC_VLAN_VTHM again,
+breaking the "VLAN promiscuity".
+
+It turns out that dwmac4_vlan_promisc_enable() is way too complicated
+for what needs to be done. The MAC_Packet_Filter register also has the
+VTFE bit (VLAN Tag Filter Enable), which simply controls whether VLAN
+tagged packets which don't match the filtering tables (either perfect or
+hash) are dropped or not. At the moment, this driver unconditionally
+sets GMAC_PACKET_FILTER_VTFE if NETIF_F_HW_VLAN_CTAG_FILTER was detected
+through the priv->dma_cap.vlhash capability bits of the device, in
+stmmac_dvr_probe().
+
+I would suggest deleting the unnecessarily complex logic from
+dwmac4_vlan_promisc_enable(), and simply unsetting GMAC_PACKET_FILTER_VTFE
+when becoming IFF_PROMISC, which has the same effect of allowing packets
+with any VLAN tags, but has the additional benefit of being able to run
+concurrently with stmmac_vlan_rx_add_vid() and stmmac_vlan_rx_kill_vid().
+
+As much as I believe that the VTFE bit should have been exclusively
+controlled by NETIF_F_HW_VLAN_CTAG_FILTER through ethtool, and not by
+IFF_PROMISC, changing that is not a punctual fix to the problem, and it
+would probably break the VFFQ feature added by the later commit
+e0f9956a3862 ("net: stmmac: Add option for VLAN filter fail queue
+enable"). From the commit description, VFFQ needs IFF_PROMISC=on and
+VTFE=off in order to work (and this change respects that). But if VTFE
+was changed to be controlled through ethtool -k, then a user-visible
+change would have been introduced in Intel's scripts (a need to run
+"ethtool -k eth0 rx-vlan-filter off" which did not exist before).
+
+The patch was tested with this set of commands:
+
+ ip link set eth0 up
+ ip link add link eth0 name eth0.100 type vlan id 100
+ ip addr add 192.168.100.2/24 dev eth0.100 && ip link set eth0.100 up
+ ip link set eth0 promisc on
+ ip link add link eth0 name eth0.101 type vlan id 101
+ ip addr add 192.168.101.2/24 dev eth0.101 && ip link set eth0.101 up
+ ip link set eth0 promisc off
+ ping -c 5 192.168.100.1
+ ping -c 5 192.168.101.1
+ ip link set eth0 promisc on
+ ping -c 5 192.168.100.1
+ ping -c 5 192.168.101.1
+ ip link del eth0.100
+ ip link del eth0.101
+ # Wait for VLAN-tagged pings from the other end...
+ # Check with "tcpdump -i eth0 -e -n -p" and we should see them
+ ip link set eth0 promisc off
+ # Wait for VLAN-tagged pings from the other end...
+ # Check with "tcpdump -i eth0 -e -n -p" and we shouldn't see them
+ # anymore, but remove the "-p" argument from tcpdump and they're there.
+
+Fixes: c89f44ff10fd ("net: stmmac: Add support for VLAN promiscuous mode")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/common.h | 1 -
+ .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 61 +------------------
+ 2 files changed, 3 insertions(+), 59 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
+index df7de50497a0d..af43035239297 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/common.h
++++ b/drivers/net/ethernet/stmicro/stmmac/common.h
+@@ -480,7 +480,6 @@ struct mac_device_info {
+ unsigned int xlgmac;
+ unsigned int num_vlan;
+ u32 vlan_filter[32];
+- unsigned int promisc;
+ bool vlan_fail_q_en;
+ u8 vlan_fail_q;
+ };
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index 5b052fdd2696e..cd11be005390b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -453,12 +453,6 @@ static int dwmac4_add_hw_vlan_rx_fltr(struct net_device *dev,
+ if (vid > 4095)
+ return -EINVAL;
+
+- if (hw->promisc) {
+- netdev_err(dev,
+- "Adding VLAN in promisc mode not supported\n");
+- return -EPERM;
+- }
+-
+ /* Single Rx VLAN Filter */
+ if (hw->num_vlan == 1) {
+ /* For single VLAN filter, VID 0 means VLAN promiscuous */
+@@ -508,12 +502,6 @@ static int dwmac4_del_hw_vlan_rx_fltr(struct net_device *dev,
+ {
+ int i, ret = 0;
+
+- if (hw->promisc) {
+- netdev_err(dev,
+- "Deleting VLAN in promisc mode not supported\n");
+- return -EPERM;
+- }
+-
+ /* Single Rx VLAN Filter */
+ if (hw->num_vlan == 1) {
+ if ((hw->vlan_filter[0] & GMAC_VLAN_TAG_VID) == vid) {
+@@ -538,39 +526,6 @@ static int dwmac4_del_hw_vlan_rx_fltr(struct net_device *dev,
+ return ret;
+ }
+
+-static void dwmac4_vlan_promisc_enable(struct net_device *dev,
+- struct mac_device_info *hw)
+-{
+- void __iomem *ioaddr = hw->pcsr;
+- u32 value;
+- u32 hash;
+- u32 val;
+- int i;
+-
+- /* Single Rx VLAN Filter */
+- if (hw->num_vlan == 1) {
+- dwmac4_write_single_vlan(dev, 0);
+- return;
+- }
+-
+- /* Extended Rx VLAN Filter Enable */
+- for (i = 0; i < hw->num_vlan; i++) {
+- if (hw->vlan_filter[i] & GMAC_VLAN_TAG_DATA_VEN) {
+- val = hw->vlan_filter[i] & ~GMAC_VLAN_TAG_DATA_VEN;
+- dwmac4_write_vlan_filter(dev, hw, i, val);
+- }
+- }
+-
+- hash = readl(ioaddr + GMAC_VLAN_HASH_TABLE);
+- if (hash & GMAC_VLAN_VLHT) {
+- value = readl(ioaddr + GMAC_VLAN_TAG);
+- if (value & GMAC_VLAN_VTHM) {
+- value &= ~GMAC_VLAN_VTHM;
+- writel(value, ioaddr + GMAC_VLAN_TAG);
+- }
+- }
+-}
+-
+ static void dwmac4_restore_hw_vlan_rx_fltr(struct net_device *dev,
+ struct mac_device_info *hw)
+ {
+@@ -690,22 +645,12 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ }
+
+ /* VLAN filtering */
+- if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
++ if (dev->flags & IFF_PROMISC && !hw->vlan_fail_q_en)
++ value &= ~GMAC_PACKET_FILTER_VTFE;
++ else if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
+ value |= GMAC_PACKET_FILTER_VTFE;
+
+ writel(value, ioaddr + GMAC_PACKET_FILTER);
+-
+- if (dev->flags & IFF_PROMISC && !hw->vlan_fail_q_en) {
+- if (!hw->promisc) {
+- hw->promisc = 1;
+- dwmac4_vlan_promisc_enable(dev, hw);
+- }
+- } else {
+- if (hw->promisc) {
+- hw->promisc = 0;
+- dwmac4_restore_hw_vlan_rx_fltr(dev, hw);
+- }
+- }
+ }
+
+ static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex,
+--
+2.39.2
+
--- /dev/null
+From 31f46ab079f11940c34a93417a2e75c68cc5b1fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 11:14:06 +0800
+Subject: ptp_qoriq: fix memory leak in probe()
+
+From: SongJingyi <u201912584@hust.edu.cn>
+
+[ Upstream commit f33642224e38d7e0d59336e10e7b4e370b1c4506 ]
+
+Smatch complains that:
+drivers/ptp/ptp_qoriq.c ptp_qoriq_probe()
+warn: 'base' from ioremap() not released.
+
+Fix this by revising the parameter from 'ptp_qoriq->base' to 'base'.
+This is only a bug if ptp_qoriq_init() returns on the
+first -ENODEV error path.
+For other error paths ptp_qoriq->base and base are the same.
+And this change makes the code more readable.
+
+Fixes: 7f4399ba405b ("ptp_qoriq: fix NULL access if ptp dt node missing")
+Signed-off-by: SongJingyi <u201912584@hust.edu.cn>
+Reviewed-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230324031406.1895159-1-u201912584@hust.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_qoriq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ptp/ptp_qoriq.c b/drivers/ptp/ptp_qoriq.c
+index 08f4cf0ad9e3c..8fa9772acf79b 100644
+--- a/drivers/ptp/ptp_qoriq.c
++++ b/drivers/ptp/ptp_qoriq.c
+@@ -601,7 +601,7 @@ static int ptp_qoriq_probe(struct platform_device *dev)
+ return 0;
+
+ no_clock:
+- iounmap(ptp_qoriq->base);
++ iounmap(base);
+ no_ioremap:
+ release_resource(ptp_qoriq->rsrc);
+ no_resource:
+--
+2.39.2
+
--- /dev/null
+From 859e4ce6c651c4c741447defc2c990b1598d89cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 22:33:09 +0800
+Subject: r8169: fix RTL8168H and RTL8107E rx crc error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: ChunHao Lin <hau@realtek.com>
+
+[ Upstream commit 33189f0a94b9639c058781fcf82e4ea3803b1682 ]
+
+When link speed is 10 Mbps and temperature is under -20°C, RTL8168H and
+RTL8107E may have rx crc error. Disable phy 10 Mbps pll off to fix this
+issue.
+
+Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E")
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_phy_config.c b/drivers/net/ethernet/realtek/r8169_phy_config.c
+index 913d030d73eb4..e18a76f5049fd 100644
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -970,6 +970,9 @@ static void rtl8168h_2_hw_phy_config(struct rtl8169_private *tp,
+ /* disable phy pfm mode */
+ phy_modify_paged(phydev, 0x0a44, 0x11, BIT(7), 0);
+
++ /* disable 10m pll off */
++ phy_modify_paged(phydev, 0x0a43, 0x10, BIT(0), 0);
++
+ rtl8168g_disable_aldps(phydev);
+ rtl8168g_config_eee_phy(phydev);
+ }
+--
+2.39.2
+
--- /dev/null
+From e49ee79b52f6a03ec596b2a5d2e77f875449beef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 10:29:33 +0200
+Subject: regulator: Handle deferred clk
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 02bcba0b9f9da706d5bd1e8cbeb83493863e17b5 ]
+
+devm_clk_get() can return -EPROBE_DEFER. So it is better to return the
+error code from devm_clk_get(), instead of a hard coded -ENOENT.
+
+This gives more opportunities to successfully probe the driver.
+
+Fixes: 8959e5324485 ("regulator: fixed: add possibility to enable by clock")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/18459fae3d017a66313699c7c8456b28158b2dd0.1679819354.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/fixed.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
+index 3de7709bdcd4c..4acfff1908072 100644
+--- a/drivers/regulator/fixed.c
++++ b/drivers/regulator/fixed.c
+@@ -175,7 +175,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev)
+ drvdata->enable_clock = devm_clk_get(dev, NULL);
+ if (IS_ERR(drvdata->enable_clock)) {
+ dev_err(dev, "Can't get enable-clock from devicetree\n");
+- return -ENOENT;
++ return PTR_ERR(drvdata->enable_clock);
+ }
+ } else {
+ drvdata->desc.ops = &fixed_voltage_ops;
+--
+2.39.2
+
--- /dev/null
+From 0c59934184cd8798be105d9d9a984243f2a16c77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 11:04:47 -0400
+Subject: s390/vfio-ap: fix memory leak in vfio_ap device driver
+
+From: Tony Krowiak <akrowiak@linux.ibm.com>
+
+[ Upstream commit 8f8cf767589f2131ae5d40f3758429095c701c84 ]
+
+The device release callback function invoked to release the matrix device
+uses the dev_get_drvdata(device *dev) function to retrieve the
+pointer to the vfio_matrix_dev object in order to free its storage. The
+problem is, this object is not stored as drvdata with the device; since the
+kfree function will accept a NULL pointer, the memory for the
+vfio_matrix_dev object is never freed.
+
+Since the device being released is contained within the vfio_matrix_dev
+object, the container_of macro will be used to retrieve its pointer.
+
+Fixes: 1fde573413b5 ("s390: vfio-ap: base implementation of VFIO AP device driver")
+Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com>
+Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
+Link: https://lore.kernel.org/r/20230320150447.34557-1-akrowiak@linux.ibm.com
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/vfio_ap_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c
+index 7dc72cb718b0e..22128eb44f7fa 100644
+--- a/drivers/s390/crypto/vfio_ap_drv.c
++++ b/drivers/s390/crypto/vfio_ap_drv.c
+@@ -82,8 +82,9 @@ static void vfio_ap_queue_dev_remove(struct ap_device *apdev)
+
+ static void vfio_ap_matrix_dev_release(struct device *dev)
+ {
+- struct ap_matrix_dev *matrix_dev = dev_get_drvdata(dev);
++ struct ap_matrix_dev *matrix_dev;
+
++ matrix_dev = container_of(dev, struct ap_matrix_dev, device);
+ kfree(matrix_dev);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 7fd8a7cd7b3e728cdd9e2b3e97b152562df3afeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 16:01:34 +0100
+Subject: scsi: megaraid_sas: Fix crash after a double completion
+
+From: Tomas Henzl <thenzl@redhat.com>
+
+[ Upstream commit 2309df27111a51734cb9240b4d3c25f2f3c6ab06 ]
+
+When a physical disk is attached directly "without JBOD MAP support" (see
+megasas_get_tm_devhandle()) then there is no real error handling in the
+driver. Return FAILED instead of SUCCESS.
+
+Fixes: 18365b138508 ("megaraid_sas: Task management support")
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Link: https://lore.kernel.org/r/20230324150134.14696-1-thenzl@redhat.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index 7838c7911adde..8eb126d48462b 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -4656,7 +4656,7 @@ int megasas_task_abort_fusion(struct scsi_cmnd *scmd)
+ devhandle = megasas_get_tm_devhandle(scmd->device);
+
+ if (devhandle == (u16)ULONG_MAX) {
+- ret = SUCCESS;
++ ret = FAILED;
+ sdev_printk(KERN_INFO, scmd->device,
+ "task abort issued for invalid devhandle\n");
+ mutex_unlock(&instance->reset_mutex);
+@@ -4726,7 +4726,7 @@ int megasas_reset_target_fusion(struct scsi_cmnd *scmd)
+ devhandle = megasas_get_tm_devhandle(scmd->device);
+
+ if (devhandle == (u16)ULONG_MAX) {
+- ret = SUCCESS;
++ ret = FAILED;
+ sdev_printk(KERN_INFO, scmd->device,
+ "target reset issued for invalid devhandle\n");
+ mutex_unlock(&instance->reset_mutex);
+--
+2.39.2
+
fbdev-au1200fb-fix-potential-divide-by-zero.patch
tools-power-turbostat-fix-dev-cpu_dma_latency-warnin.patch
tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch
+ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch
+mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch
+mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch
+sfc-ef10-don-t-overwrite-offload-features-at-nic-res.patch
+scsi-megaraid_sas-fix-crash-after-a-double-completio.patch
+ptp_qoriq-fix-memory-leak-in-probe.patch
+r8169-fix-rtl8168h-and-rtl8107e-rx-crc-error.patch
+regulator-handle-deferred-clk.patch
+net-net_failover-fix-txq-exceeding-warning.patch
+net-stmmac-don-t-reject-vlans-when-iff_promisc-is-se.patch
+can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch
+s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch
+alsa-ymfpci-fix-assignment-in-if-condition.patch
+alsa-ymfpci-fix-bug_on-in-probe-function.patch
+net-ipa-compute-dma-pool-size-properly.patch
+i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch
+bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch
+bnxt_en-add-missing-200g-link-speed-reporting.patch
+net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch
--- /dev/null
+From cc49ac03034d1afce598c2ed6646a1240d107a09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 09:34:17 +0100
+Subject: sfc: ef10: don't overwrite offload features at NIC reset
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Íñigo Huguet <ihuguet@redhat.com>
+
+[ Upstream commit ca4a80e4bb7e87daf33b27d2ab9e4f5311018a89 ]
+
+At NIC reset, some offload features related to encapsulated traffic
+might have changed (this mainly happens if the firmware-variant is
+changed with the sfboot userspace tool). Because of this, features are
+checked and set again at reset time.
+
+However, this was not done right, and some features were improperly
+overwritten at NIC reset:
+- Tunneled IPv6 segmentation was always disabled
+- Features disabled with ethtool were reenabled
+- Features that becomes unsupported after the reset were not disabled
+
+Also, checking if the device supports IPV6_CSUM to enable TSO6 is no
+longer necessary because all currently supported devices support it.
+Additionally, move the assignment of some other features to the
+EF10_OFFLOAD_FEATURES macro, like it is done in ef100, leaving the
+selection of features in efx_pci_probe_post_io a bit cleaner.
+
+Fixes: ffffd2454a7a ("sfc: correctly advertise tunneled IPv6 segmentation")
+Fixes: 24b2c3751aa3 ("sfc: advertise encapsulated offloads on EF10")
+Reported-by: Tianhao Zhao <tizhao@redhat.com>
+Suggested-by: Jonathan Cooper <jonathan.s.cooper@amd.com>
+Tested-by: Jonathan Cooper <jonathan.s.cooper@amd.com>
+Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
+Acked-by: Edward Cree <ecree.xilinx@gmail.com>
+Link: https://lore.kernel.org/r/20230323083417.7345-1-ihuguet@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 38 ++++++++++++++++++++++-----------
+ drivers/net/ethernet/sfc/efx.c | 17 ++++++---------
+ 2 files changed, 33 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index eb1be73020822..32654fe1f8b59 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -1304,7 +1304,8 @@ static void efx_ef10_fini_nic(struct efx_nic *efx)
+ static int efx_ef10_init_nic(struct efx_nic *efx)
+ {
+ struct efx_ef10_nic_data *nic_data = efx->nic_data;
+- netdev_features_t hw_enc_features = 0;
++ struct net_device *net_dev = efx->net_dev;
++ netdev_features_t tun_feats, tso_feats;
+ int rc;
+
+ if (nic_data->must_check_datapath_caps) {
+@@ -1349,20 +1350,30 @@ static int efx_ef10_init_nic(struct efx_nic *efx)
+ nic_data->must_restore_piobufs = false;
+ }
+
+- /* add encapsulated checksum offload features */
++ /* encap features might change during reset if fw variant changed */
+ if (efx_has_cap(efx, VXLAN_NVGRE) && !efx_ef10_is_vf(efx))
+- hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+- /* add encapsulated TSO features */
+- if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) {
+- netdev_features_t encap_tso_features;
++ net_dev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
++ else
++ net_dev->hw_enc_features &= ~(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM);
+
+- encap_tso_features = NETIF_F_GSO_UDP_TUNNEL | NETIF_F_GSO_GRE |
+- NETIF_F_GSO_UDP_TUNNEL_CSUM | NETIF_F_GSO_GRE_CSUM;
++ tun_feats = NETIF_F_GSO_UDP_TUNNEL | NETIF_F_GSO_GRE |
++ NETIF_F_GSO_UDP_TUNNEL_CSUM | NETIF_F_GSO_GRE_CSUM;
++ tso_feats = NETIF_F_TSO | NETIF_F_TSO6;
+
+- hw_enc_features |= encap_tso_features | NETIF_F_TSO;
+- efx->net_dev->features |= encap_tso_features;
++ if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) {
++ /* If this is first nic_init, or if it is a reset and a new fw
++ * variant has added new features, enable them by default.
++ * If the features are not new, maintain their current value.
++ */
++ if (!(net_dev->hw_features & tun_feats))
++ net_dev->features |= tun_feats;
++ net_dev->hw_enc_features |= tun_feats | tso_feats;
++ net_dev->hw_features |= tun_feats;
++ } else {
++ net_dev->hw_enc_features &= ~(tun_feats | tso_feats);
++ net_dev->hw_features &= ~tun_feats;
++ net_dev->features &= ~tun_feats;
+ }
+- efx->net_dev->hw_enc_features = hw_enc_features;
+
+ /* don't fail init if RSS setup doesn't work */
+ rc = efx->type->rx_push_rss_config(efx, false,
+@@ -3977,7 +3988,10 @@ static unsigned int ef10_check_caps(const struct efx_nic *efx,
+ NETIF_F_HW_VLAN_CTAG_FILTER | \
+ NETIF_F_IPV6_CSUM | \
+ NETIF_F_RXHASH | \
+- NETIF_F_NTUPLE)
++ NETIF_F_NTUPLE | \
++ NETIF_F_SG | \
++ NETIF_F_RXCSUM | \
++ NETIF_F_RXALL)
+
+ const struct efx_nic_type efx_hunt_a0_vf_nic_type = {
+ .is_vf = true,
+diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
+index 29c8d2c990044..c069659c9e2d0 100644
+--- a/drivers/net/ethernet/sfc/efx.c
++++ b/drivers/net/ethernet/sfc/efx.c
+@@ -1045,21 +1045,18 @@ static int efx_pci_probe_post_io(struct efx_nic *efx)
+ }
+
+ /* Determine netdevice features */
+- net_dev->features |= (efx->type->offload_features | NETIF_F_SG |
+- NETIF_F_TSO | NETIF_F_RXCSUM | NETIF_F_RXALL);
+- if (efx->type->offload_features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM)) {
+- net_dev->features |= NETIF_F_TSO6;
+- if (efx_has_cap(efx, TX_TSO_V2_ENCAP))
+- net_dev->hw_enc_features |= NETIF_F_TSO6;
+- }
+- /* Check whether device supports TSO */
+- if (!efx->type->tso_versions || !efx->type->tso_versions(efx))
+- net_dev->features &= ~NETIF_F_ALL_TSO;
++ net_dev->features |= efx->type->offload_features;
++
++ /* Add TSO features */
++ if (efx->type->tso_versions && efx->type->tso_versions(efx))
++ net_dev->features |= NETIF_F_TSO | NETIF_F_TSO6;
++
+ /* Mask for features that also apply to VLAN devices */
+ net_dev->vlan_features |= (NETIF_F_HW_CSUM | NETIF_F_SG |
+ NETIF_F_HIGHDMA | NETIF_F_ALL_TSO |
+ NETIF_F_RXCSUM);
+
++ /* Determine user configurable features */
+ net_dev->hw_features |= net_dev->features & ~efx->fixed_features;
+
+ /* Disable receiving frames with bad FCS, by default. */
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
