--- /dev/null
+From b90289286e1473bd4ee37990bb533583e3e06ff2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jul 2023 22:25:11 +0800
+Subject: atheros: fix return value check in atl1_tso()
+
+From: Yuanjun Gong <ruc_gongyuanjun@163.com>
+
+[ Upstream commit ed96824b71ed67664390890441b229423a25317f ]
+
+in atl1_tso(), it should check the return value of pskb_trim(),
+and return an error code if an unexpected value is returned
+by pskb_trim().
+
+Fixes: 401c0aabec4b ("atl1: simplify tx packet descriptor")
+Signed-off-by: Yuanjun Gong <ruc_gongyuanjun@163.com>
+Link: https://lore.kernel.org/r/20230722142511.12448-1-ruc_gongyuanjun@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/atheros/atlx/atl1.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c
+index c8444bcdf5270..02aa6fd8ebc2d 100644
+--- a/drivers/net/ethernet/atheros/atlx/atl1.c
++++ b/drivers/net/ethernet/atheros/atlx/atl1.c
+@@ -2113,8 +2113,11 @@ static int atl1_tso(struct atl1_adapter *adapter, struct sk_buff *skb,
+
+ real_len = (((unsigned char *)iph - skb->data) +
+ ntohs(iph->tot_len));
+- if (real_len < skb->len)
+- pskb_trim(skb, real_len);
++ if (real_len < skb->len) {
++ err = pskb_trim(skb, real_len);
++ if (err)
++ return err;
++ }
+ hdr_len = skb_tcp_all_headers(skb);
+ if (skb->len == hdr_len) {
+ iph->check = 0;
+--
+2.39.2
+
--- /dev/null
+From 44baf95bf9e229042f20ead3e6c05f037f7378cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jul 2023 11:27:26 +0800
+Subject: benet: fix return value check in be_lancer_xmit_workarounds()
+
+From: Yuanjun Gong <ruc_gongyuanjun@163.com>
+
+[ Upstream commit 5c85f7065718a949902b238a6abd8fc907c5d3e0 ]
+
+in be_lancer_xmit_workarounds(), it should go to label 'tx_drop'
+if an unexpected value is returned by pskb_trim().
+
+Fixes: 93040ae5cc8d ("be2net: Fix to trim skb for padded vlan packets to workaround an ASIC Bug")
+Signed-off-by: Yuanjun Gong <ruc_gongyuanjun@163.com>
+Link: https://lore.kernel.org/r/20230725032726.15002-1-ruc_gongyuanjun@163.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/emulex/benet/be_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index 0defd519ba62e..7fa057d379c1a 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -1138,7 +1138,8 @@ static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter,
+ (lancer_chip(adapter) || BE3_chip(adapter) ||
+ skb_vlan_tag_present(skb)) && is_ipv4_pkt(skb)) {
+ ip = (struct iphdr *)ip_hdr(skb);
+- pskb_trim(skb, eth_hdr_len + ntohs(ip->tot_len));
++ if (unlikely(pskb_trim(skb, eth_hdr_len + ntohs(ip->tot_len))))
++ goto tx_drop;
+ }
+
+ /* If vlan tag is already inlined in the packet, skip HW VLAN
+--
+2.39.2
+
--- /dev/null
+From ff53752815121d38261160877f54f99c1aabf90e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 12:03:55 +0800
+Subject: bonding: reset bond's flags when down link is P2P device
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit da19a2b967cf1e2c426f50d28550d1915214a81d ]
+
+When adding a point to point downlink to the bond, we neglected to reset
+the bond's flags, which were still using flags like BROADCAST and
+MULTICAST. Consequently, this would initiate ARP/DAD for P2P downlink
+interfaces, such as when adding a GRE device to the bonding.
+
+To address this issue, let's reset the bond's flags for P2P interfaces.
+
+Before fix:
+7: gre0@NONE: <POINTOPOINT,NOARP,SLAVE,UP,LOWER_UP> mtu 1500 qdisc noqueue master bond0 state UNKNOWN group default qlen 1000
+ link/gre6 2006:70:10::1 peer 2006:70:10::2 permaddr 167f:18:f188::
+8: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
+ link/gre6 2006:70:10::1 brd 2006:70:10::2
+ inet6 fe80::200:ff:fe00:0/64 scope link
+ valid_lft forever preferred_lft forever
+
+After fix:
+7: gre0@NONE: <POINTOPOINT,NOARP,SLAVE,UP,LOWER_UP> mtu 1500 qdisc noqueue master bond2 state UNKNOWN group default qlen 1000
+ link/gre6 2006:70:10::1 peer 2006:70:10::2 permaddr c29e:557a:e9d9::
+8: bond0: <POINTOPOINT,NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
+ link/gre6 2006:70:10::1 peer 2006:70:10::2
+ inet6 fe80::1/64 scope link
+ valid_lft forever preferred_lft forever
+
+Reported-by: Liang Li <liali@redhat.com>
+Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2221438
+Fixes: 872254dd6b1f ("net/bonding: Enable bonding to enslave non ARPHRD_ETHER")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 091e035c76a6f..1a0776f9b008a 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1507,6 +1507,11 @@ static void bond_setup_by_slave(struct net_device *bond_dev,
+
+ memcpy(bond_dev->broadcast, slave_dev->broadcast,
+ slave_dev->addr_len);
++
++ if (slave_dev->flags & IFF_POINTOPOINT) {
++ bond_dev->flags &= ~(IFF_BROADCAST | IFF_MULTICAST);
++ bond_dev->flags |= (IFF_POINTOPOINT | IFF_NOARP);
++ }
+ }
+
+ /* On bonding slaves other than the currently active slave, suppress
+--
+2.39.2
+
--- /dev/null
+From ce2325b3fc54a3caec18fb272ab91d2fb4e5841a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jul 2023 22:42:19 +0800
+Subject: ethernet: atheros: fix return value check in atl1e_tso_csum()
+
+From: Yuanjun Gong <ruc_gongyuanjun@163.com>
+
+[ Upstream commit 69a184f7a372aac588babfb0bd681aaed9779f5b ]
+
+in atl1e_tso_csum, it should check the return value of pskb_trim(),
+and return an error code if an unexpected value is returned
+by pskb_trim().
+
+Fixes: a6a5325239c2 ("atl1e: Atheros L1E Gigabit Ethernet driver")
+Signed-off-by: Yuanjun Gong <ruc_gongyuanjun@163.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230720144219.39285-1-ruc_gongyuanjun@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+index 5db0f3495a32e..5935be190b9e2 100644
+--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+@@ -1641,8 +1641,11 @@ static int atl1e_tso_csum(struct atl1e_adapter *adapter,
+ real_len = (((unsigned char *)ip_hdr(skb) - skb->data)
+ + ntohs(ip_hdr(skb)->tot_len));
+
+- if (real_len < skb->len)
+- pskb_trim(skb, real_len);
++ if (real_len < skb->len) {
++ err = pskb_trim(skb, real_len);
++ if (err)
++ return err;
++ }
+
+ hdr_len = skb_tcp_all_headers(skb);
+ if (unlikely(skb->len == hdr_len)) {
+--
+2.39.2
+
--- /dev/null
+From 980f9eff06c13e6907ba4d739114fd1008d1beb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jul 2023 09:42:39 +0800
+Subject: i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
+
+From: Wang Ming <machel@vivo.com>
+
+[ Upstream commit 043b1f185fb0f3939b7427f634787706f45411c4 ]
+
+The debugfs_create_dir() function returns error pointers.
+It never returns NULL. Most incorrect error checks were fixed,
+but the one in i40e_dbg_init() was forgotten.
+
+Fix the remaining error check.
+
+Fixes: 02e9c290814c ("i40e: debugfs interface")
+Signed-off-by: Wang Ming <machel@vivo.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+index 9954493cd4489..62497f5565c59 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+@@ -1839,7 +1839,7 @@ void i40e_dbg_pf_exit(struct i40e_pf *pf)
+ void i40e_dbg_init(void)
+ {
+ i40e_dbg_root = debugfs_create_dir(i40e_driver_name, NULL);
+- if (!i40e_dbg_root)
++ if (IS_ERR(i40e_dbg_root))
+ pr_info("init of debugfs failed\n");
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 677156dbd8971c0ae5da58b1115858fd0449491e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jul 2023 13:41:28 -0700
+Subject: iavf: check for removal state before IAVF_FLAG_PF_COMMS_FAILED
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+[ Upstream commit 91896c8acce23d33ed078cffd46a9534b1f82be5 ]
+
+In iavf_adminq_task(), if the function can't acquire the
+adapter->crit_lock, it checks if the driver is removing. If so, it simply
+exits without re-enabling the interrupt. This is done to ensure that the
+task stops processing as soon as possible once the driver is being removed.
+
+However, if the IAVF_FLAG_PF_COMMS_FAILED is set, the function checks this
+before attempting to acquire the lock. In this case, the function exits
+early and re-enables the interrupt. This will happen even if the driver is
+already removing.
+
+Avoid this, by moving the check to after the adapter->crit_lock is
+acquired. This way, if the driver is removing, we will not re-enable the
+interrupt.
+
+Fixes: fc2e6b3b132a ("iavf: Rework mutexes for better synchronisation")
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index 6c25d240e70bc..e48810e0627d2 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -3286,9 +3286,6 @@ static void iavf_adminq_task(struct work_struct *work)
+ u32 val, oldval;
+ u16 pending;
+
+- if (adapter->flags & IAVF_FLAG_PF_COMMS_FAILED)
+- goto out;
+-
+ if (!mutex_trylock(&adapter->crit_lock)) {
+ if (adapter->state == __IAVF_REMOVE)
+ return;
+@@ -3297,6 +3294,9 @@ static void iavf_adminq_task(struct work_struct *work)
+ goto out;
+ }
+
++ if (adapter->flags & IAVF_FLAG_PF_COMMS_FAILED)
++ goto unlock;
++
+ event.buf_len = IAVF_MAX_AQ_BUF_SIZE;
+ event.msg_buf = kzalloc(event.buf_len, GFP_KERNEL);
+ if (!event.msg_buf)
+--
+2.39.2
+
--- /dev/null
+From dc245b37226519115311452bfa2fd09533fc717e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jul 2023 13:41:27 -0700
+Subject: iavf: fix potential deadlock on allocation failure
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+[ Upstream commit a2f054c10bef0b54600ec9cb776508443e941343 ]
+
+In iavf_adminq_task(), if kzalloc() fails to allocate the event.msg_buf,
+the function will exit without releasing the adapter->crit_lock.
+
+This is unlikely, but if it happens, the next access to that mutex will
+deadlock.
+
+Fix this by moving the unlock to the end of the function, and adding a new
+label to allow jumping to the unlock portion of the function exit flow.
+
+Fixes: fc2e6b3b132a ("iavf: Rework mutexes for better synchronisation")
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index ba96312feb505..6c25d240e70bc 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -3300,7 +3300,7 @@ static void iavf_adminq_task(struct work_struct *work)
+ event.buf_len = IAVF_MAX_AQ_BUF_SIZE;
+ event.msg_buf = kzalloc(event.buf_len, GFP_KERNEL);
+ if (!event.msg_buf)
+- goto out;
++ goto unlock;
+
+ do {
+ ret = iavf_clean_arq_element(hw, &event, &pending);
+@@ -3315,7 +3315,6 @@ static void iavf_adminq_task(struct work_struct *work)
+ if (pending != 0)
+ memset(event.msg_buf, 0, IAVF_MAX_AQ_BUF_SIZE);
+ } while (pending);
+- mutex_unlock(&adapter->crit_lock);
+
+ if (iavf_is_reset_in_progress(adapter))
+ goto freedom;
+@@ -3359,6 +3358,8 @@ static void iavf_adminq_task(struct work_struct *work)
+
+ freedom:
+ kfree(event.msg_buf);
++unlock:
++ mutex_unlock(&adapter->crit_lock);
+ out:
+ /* re-enable Admin queue interrupt cause */
+ iavf_misc_irq_enable(adapter);
+--
+2.39.2
+
--- /dev/null
+From e8caac5486daad4b9d799523de2fb0e6f51d845f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 08:58:54 -0700
+Subject: ice: Fix memory management in ice_ethtool_fdir.c
+
+From: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+
+[ Upstream commit a3336056504d780590ac6d6ac94fbba829994594 ]
+
+Fix ethtool FDIR logic to not use memory after its release.
+In the ice_ethtool_fdir.c file there are 2 spots where code can
+refer to pointers which may be missing.
+
+In the ice_cfg_fdir_xtrct_seq() function seg may be freed but
+even then may be still used by memcpy(&tun_seg[1], seg, sizeof(*seg)).
+
+In the ice_add_fdir_ethtool() function struct ice_fdir_fltr *input
+may first fail to be added via ice_fdir_update_list_entry() but then
+may be deleted by ice_fdir_update_list_entry.
+
+Terminate in both cases when the returned value of the previous
+operation is other than 0, free memory and don't use it anymore.
+
+Reported-by: Michal Schmidt <mschmidt@redhat.com>
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=2208423
+Fixes: cac2a27cd9ab ("ice: Support IPv4 Flow Director filters")
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://lore.kernel.org/r/20230721155854.1292805-1-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/intel/ice/ice_ethtool_fdir.c | 26 ++++++++++---------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
+index ead6d50fc0adc..8c6e13f87b7d3 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
+@@ -1281,16 +1281,21 @@ ice_cfg_fdir_xtrct_seq(struct ice_pf *pf, struct ethtool_rx_flow_spec *fsp,
+ ICE_FLOW_FLD_OFF_INVAL);
+ }
+
+- /* add filter for outer headers */
+ fltr_idx = ice_ethtool_flow_to_fltr(fsp->flow_type & ~FLOW_EXT);
++
++ assign_bit(fltr_idx, hw->fdir_perfect_fltr, perfect_filter);
++
++ /* add filter for outer headers */
+ ret = ice_fdir_set_hw_fltr_rule(pf, seg, fltr_idx,
+ ICE_FD_HW_SEG_NON_TUN);
+- if (ret == -EEXIST)
+- /* Rule already exists, free memory and continue */
+- devm_kfree(dev, seg);
+- else if (ret)
++ if (ret == -EEXIST) {
++ /* Rule already exists, free memory and count as success */
++ ret = 0;
++ goto err_exit;
++ } else if (ret) {
+ /* could not write filter, free memory */
+ goto err_exit;
++ }
+
+ /* make tunneled filter HW entries if possible */
+ memcpy(&tun_seg[1], seg, sizeof(*seg));
+@@ -1305,18 +1310,13 @@ ice_cfg_fdir_xtrct_seq(struct ice_pf *pf, struct ethtool_rx_flow_spec *fsp,
+ devm_kfree(dev, tun_seg);
+ }
+
+- if (perfect_filter)
+- set_bit(fltr_idx, hw->fdir_perfect_fltr);
+- else
+- clear_bit(fltr_idx, hw->fdir_perfect_fltr);
+-
+ return ret;
+
+ err_exit:
+ devm_kfree(dev, tun_seg);
+ devm_kfree(dev, seg);
+
+- return -EOPNOTSUPP;
++ return ret;
+ }
+
+ /**
+@@ -1914,7 +1914,9 @@ int ice_add_fdir_ethtool(struct ice_vsi *vsi, struct ethtool_rxnfc *cmd)
+ input->comp_report = ICE_FXD_FLTR_QW0_COMP_REPORT_SW_FAIL;
+
+ /* input struct is added to the HW filter list */
+- ice_fdir_update_list_entry(pf, input, fsp->location);
++ ret = ice_fdir_update_list_entry(pf, input, fsp->location);
++ if (ret)
++ goto release_lock;
+
+ ret = ice_fdir_write_all_fltr(pf, input, true);
+ if (ret)
+--
+2.39.2
+
--- /dev/null
+From 04d1373b4dc9bada2b408936044caa9b69929428 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jul 2023 09:12:50 -0700
+Subject: igc: Fix Kernel Panic during ndo_tx_timeout callback
+
+From: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
+
+[ Upstream commit d4a7ce642100765119a872d4aba1bf63e3a22c8a ]
+
+The Xeon validation group has been carrying out some loaded tests
+with various HW configurations, and they have seen some transmit
+queue time out happening during the test. This will cause the
+reset adapter function to be called by igc_tx_timeout().
+Similar race conditions may arise when the interface is being brought
+down and up in igc_reinit_locked(), an interrupt being generated, and
+igc_clean_tx_irq() being called to complete the TX.
+
+When the igc_tx_timeout() function is invoked, this patch will turn
+off all TX ring HW queues during igc_down() process. TX ring HW queues
+will be activated again during the igc_configure_tx_ring() process
+when performing the igc_up() procedure later.
+
+This patch also moved existing igc_disable_tx_ring_hw() to avoid using
+forward declaration.
+
+Kernel trace:
+[ 7678.747813] ------------[ cut here ]------------
+[ 7678.757914] NETDEV WATCHDOG: enp1s0 (igc): transmit queue 2 timed out
+[ 7678.770117] WARNING: CPU: 0 PID: 13 at net/sched/sch_generic.c:525 dev_watchdog+0x1ae/0x1f0
+[ 7678.784459] Modules linked in: xt_conntrack nft_chain_nat xt_MASQUERADE xt_addrtype nft_compat
+nf_tables nfnetlink br_netfilter bridge stp llc overlay dm_mod emrcha(PO) emriio(PO) rktpm(PO)
+cegbuf_mod(PO) patch_update(PO) se(PO) sgx_tgts(PO) mktme(PO) keylocker(PO) svtdx(PO) svfs_pci_hotplug(PO)
+vtd_mod(PO) davemem(PO) svmabort(PO) svindexio(PO) usbx2(PO) ehci_sched(PO) svheartbeat(PO) ioapic(PO)
+sv8259(PO) svintr(PO) lt(PO) pcierootport(PO) enginefw_mod(PO) ata(PO) smbus(PO) spiflash_cdf(PO) arden(PO)
+dsa_iax(PO) oobmsm_punit(PO) cpm(PO) svkdb(PO) ebg_pch(PO) pch(PO) sviotargets(PO) svbdf(PO) svmem(PO)
+svbios(PO) dram(PO) svtsc(PO) targets(PO) superio(PO) svkernel(PO) cswitch(PO) mcf(PO) pentiumIII_mod(PO)
+fs_svfs(PO) mdevdefdb(PO) svfs_os_services(O) ixgbe mdio mdio_devres libphy emeraldrapids_svdefs(PO)
+regsupport(O) libnvdimm nls_cp437 snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_intel
+snd_intel_dspcfg snd_hda_codec snd_hwdep x86_pkg_temp_thermal snd_hda_core snd_pcm snd_timer isst_if_mbox_pci
+[ 7678.784496] input_leds isst_if_mmio sg snd isst_if_common soundcore wmi button sad9(O) drm fuse backlight
+configfs efivarfs ip_tables x_tables vmd sdhci led_class rtl8150 r8152 hid_generic pegasus mmc_block usbhid
+mmc_core hid megaraid_sas ixgb igb i2c_algo_bit ice i40e hpsa scsi_transport_sas e1000e e1000 e100 ax88179_178a
+usbnet xhci_pci sd_mod xhci_hcd t10_pi crc32c_intel crc64_rocksoft igc crc64 crc_t10dif usbcore
+crct10dif_generic ptp crct10dif_common usb_common pps_core
+[ 7679.200403] RIP: 0010:dev_watchdog+0x1ae/0x1f0
+[ 7679.210201] Code: 28 e9 53 ff ff ff 4c 89 e7 c6 05 06 42 b9 00 01 e8 17 d1 fb ff 44 89 e9 4c
+89 e6 48 c7 c7 40 ad fb 81 48 89 c2 e8 52 62 82 ff <0f> 0b e9 72 ff ff ff 65 8b 05 80 7d 7c 7e
+89 c0 48 0f a3 05 0a c1
+[ 7679.245438] RSP: 0018:ffa00000001f7d90 EFLAGS: 00010282
+[ 7679.256021] RAX: 0000000000000000 RBX: ff11000109938440 RCX: 0000000000000000
+[ 7679.268710] RDX: ff11000361e26cd8 RSI: ff11000361e1b880 RDI: ff11000361e1b880
+[ 7679.281314] RBP: ffa00000001f7da8 R08: ff1100035f8fffe8 R09: 0000000000027ffb
+[ 7679.293840] R10: 0000000000001f0a R11: ff1100035f840000 R12: ff11000109938000
+[ 7679.306276] R13: 0000000000000002 R14: dead000000000122 R15: ffa00000001f7e18
+[ 7679.318648] FS: 0000000000000000(0000) GS:ff11000361e00000(0000) knlGS:0000000000000000
+[ 7679.332064] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 7679.342757] CR2: 00007ffff7fca168 CR3: 000000013b08a006 CR4: 0000000000471ef8
+[ 7679.354984] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 7679.367207] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
+[ 7679.379370] PKRU: 55555554
+[ 7679.386446] Call Trace:
+[ 7679.393152] <TASK>
+[ 7679.399363] ? __pfx_dev_watchdog+0x10/0x10
+[ 7679.407870] call_timer_fn+0x31/0x110
+[ 7679.415698] expire_timers+0xb2/0x120
+[ 7679.423403] run_timer_softirq+0x179/0x1e0
+[ 7679.431532] ? __schedule+0x2b1/0x820
+[ 7679.439078] __do_softirq+0xd1/0x295
+[ 7679.446426] ? __pfx_smpboot_thread_fn+0x10/0x10
+[ 7679.454867] run_ksoftirqd+0x22/0x30
+[ 7679.462058] smpboot_thread_fn+0xb7/0x160
+[ 7679.469670] kthread+0xcd/0xf0
+[ 7679.476097] ? __pfx_kthread+0x10/0x10
+[ 7679.483211] ret_from_fork+0x29/0x50
+[ 7679.490047] </TASK>
+[ 7679.495204] ---[ end trace 0000000000000000 ]---
+[ 7679.503179] igc 0000:01:00.0 enp1s0: Register Dump
+[ 7679.511230] igc 0000:01:00.0 enp1s0: Register Name Value
+[ 7679.519892] igc 0000:01:00.0 enp1s0: CTRL 181c0641
+[ 7679.528782] igc 0000:01:00.0 enp1s0: STATUS 40280683
+[ 7679.537551] igc 0000:01:00.0 enp1s0: CTRL_EXT 10000040
+[ 7679.546284] igc 0000:01:00.0 enp1s0: MDIC 180a3800
+[ 7679.554942] igc 0000:01:00.0 enp1s0: ICR 00000081
+[ 7679.563503] igc 0000:01:00.0 enp1s0: RCTL 04408022
+[ 7679.571963] igc 0000:01:00.0 enp1s0: RDLEN[0-3] 00001000 00001000 00001000 00001000
+[ 7679.583075] igc 0000:01:00.0 enp1s0: RDH[0-3] 00000068 000000b6 0000000f 00000031
+[ 7679.594162] igc 0000:01:00.0 enp1s0: RDT[0-3] 00000066 000000b2 0000000e 00000030
+[ 7679.605174] igc 0000:01:00.0 enp1s0: RXDCTL[0-3] 02040808 02040808 02040808 02040808
+[ 7679.616196] igc 0000:01:00.0 enp1s0: RDBAL[0-3] 1bb7c000 1bb7f000 1bb82000 0ef33000
+[ 7679.627242] igc 0000:01:00.0 enp1s0: RDBAH[0-3] 00000001 00000001 00000001 00000001
+[ 7679.638256] igc 0000:01:00.0 enp1s0: TCTL a503f0fa
+[ 7679.646607] igc 0000:01:00.0 enp1s0: TDBAL[0-3] 2ba4a000 1bb6f000 1bb74000 1bb79000
+[ 7679.657609] igc 0000:01:00.0 enp1s0: TDBAH[0-3] 00000001 00000001 00000001 00000001
+[ 7679.668551] igc 0000:01:00.0 enp1s0: TDLEN[0-3] 00001000 00001000 00001000 00001000
+[ 7679.679470] igc 0000:01:00.0 enp1s0: TDH[0-3] 000000a7 0000002d 000000bf 000000d9
+[ 7679.690406] igc 0000:01:00.0 enp1s0: TDT[0-3] 000000a7 0000002d 000000bf 000000d9
+[ 7679.701264] igc 0000:01:00.0 enp1s0: TXDCTL[0-3] 02100108 02100108 02100108 02100108
+[ 7679.712123] igc 0000:01:00.0 enp1s0: Reset adapter
+[ 7683.085967] igc 0000:01:00.0 enp1s0: NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX
+[ 8086.945561] ------------[ cut here ]------------
+Entering kdb (current=0xffffffff8220b200, pid 0) on processor 0
+Oops: (null) due to oops @ 0xffffffff81573888
+RIP: 0010:dql_completed+0x148/0x160
+Code: c9 00 48 89 57 58 e9 46 ff ff ff 45 85 e4 41 0f 95 c4 41 39 db 0f 95
+c1 41 84 cc 74 05 45 85 ed 78 0a 44 89 c1 e9 27 ff ff ff <0f> 0b 01 f6 44 89
+c1 29 f1 0f 48 ca eb 8c cc cc cc cc cc cc cc cc
+RSP: 0018:ffa0000000003e00 EFLAGS: 00010287
+RAX: 000000000000006c RBX: ffa0000003eb0f78 RCX: ff11000109938000
+RDX: 0000000000000003 RSI: 0000000000000160 RDI: ff110001002e9480
+RBP: ffa0000000003ed8 R08: ff110001002e93c0 R09: ffa0000000003d28
+R10: 0000000000007cc0 R11: 0000000000007c54 R12: 00000000ffffffd9
+R13: ff1100037039cb00 R14: 00000000ffffffd9 R15: ff1100037039c048
+FS: 0000000000000000(0000) GS:ff11000361e00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007ffff7fca168 CR3: 000000013b08a003 CR4: 0000000000471ef8
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
+PKRU: 55555554
+Call Trace:
+ <IRQ>
+ ? igc_poll+0x1a9/0x14d0 [igc]
+ __napi_poll+0x2e/0x1b0
+ net_rx_action+0x126/0x250
+ __do_softirq+0xd1/0x295
+ irq_exit_rcu+0xc5/0xf0
+ common_interrupt+0x86/0xa0
+ </IRQ>
+ <TASK>
+ asm_common_interrupt+0x27/0x40
+RIP: 0010:cpuidle_enter_state+0xd3/0x3e0
+Code: 73 f1 ff ff 49 89 c6 8b 05 e2 ca a7 00 85 c0 0f 8f b3 02 00 00 31 ff e8 1b
+de 75 ff 80 7d d7 00 0f 85 cd 01 00 00 fb 45 85 ff <0f> 88 fd 00 00 00 49 63 cf
+4c 2b 75 c8 48 8d 04 49 48 89 ca 48 8d
+RSP: 0018:ffffffff82203df0 EFLAGS: 00000202
+RAX: ff11000361e2a200 RBX: 0000000000000002 RCX: 000000000000001f
+RDX: 0000000000000000 RSI: 000000003cf3cf3d RDI: 0000000000000000
+RBP: ffffffff82203e28 R08: 0000075ae38471c8 R09: 0000000000000018
+R10: 000000000000031a R11: ffffffff8238dca0 R12: ffd1ffffff200000
+R13: ffffffff8238dca0 R14: 0000075ae38471c8 R15: 0000000000000002
+ cpuidle_enter+0x2e/0x50
+ call_cpuidle+0x23/0x40
+ do_idle+0x1be/0x220
+ cpu_startup_entry+0x20/0x30
+ rest_init+0xb5/0xc0
+ arch_call_rest_init+0xe/0x30
+ start_kernel+0x448/0x760
+ x86_64_start_kernel+0x109/0x150
+ secondary_startup_64_no_verify+0xe0/0xeb
+ </TASK>
+more>
+[0]kdb>
+
+[0]kdb>
+[0]kdb> go
+Catastrophic error detected
+kdb_continue_catastrophic=0, type go a second time if you really want to
+continue
+[0]kdb> go
+Catastrophic error detected
+kdb_continue_catastrophic=0, attempting to continue
+[ 8086.955689] refcount_t: underflow; use-after-free.
+[ 8086.955697] WARNING: CPU: 0 PID: 0 at lib/refcount.c:28 refcount_warn_saturate+0xc2/0x110
+[ 8086.955706] Modules linked in: xt_conntrack nft_chain_nat xt_MASQUERADE xt_addrtype nft_compat
+nf_tables nfnetlink br_netfilter bridge stp llc overlay dm_mod emrcha(PO) emriio(PO) rktpm(PO)
+cegbuf_mod(PO) patch_update(PO) se(PO) sgx_tgts(PO) mktme(PO) keylocker(PO) svtdx(PO)
+svfs_pci_hotplug(PO) vtd_mod(PO) davemem(PO) svmabort(PO) svindexio(PO) usbx2(PO) ehci_sched(PO)
+svheartbeat(PO) ioapic(PO) sv8259(PO) svintr(PO) lt(PO) pcierootport(PO) enginefw_mod(PO) ata(PO)
+smbus(PO) spiflash_cdf(PO) arden(PO) dsa_iax(PO) oobmsm_punit(PO) cpm(PO) svkdb(PO) ebg_pch(PO)
+pch(PO) sviotargets(PO) svbdf(PO) svmem(PO) svbios(PO) dram(PO) svtsc(PO) targets(PO) superio(PO)
+svkernel(PO) cswitch(PO) mcf(PO) pentiumIII_mod(PO) fs_svfs(PO) mdevdefdb(PO) svfs_os_services(O)
+ixgbe mdio mdio_devres libphy emeraldrapids_svdefs(PO) regsupport(O) libnvdimm nls_cp437
+snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_intel snd_intel_dspcfg
+snd_hda_codec snd_hwdep x86_pkg_temp_thermal snd_hda_core snd_pcm snd_timer isst_if_mbox_pci
+[ 8086.955751] input_leds isst_if_mmio sg snd isst_if_common soundcore wmi button sad9(O) drm
+fuse backlight configfs efivarfs ip_tables x_tables vmd sdhci led_class rtl8150 r8152 hid_generic
+pegasus mmc_block usbhid mmc_core hid megaraid_sas ixgb igb i2c_algo_bit ice i40e hpsa
+scsi_transport_sas e1000e e1000 e100 ax88179_178a usbnet xhci_pci sd_mod xhci_hcd t10_pi
+crc32c_intel crc64_rocksoft igc crc64 crc_t10dif usbcore crct10dif_generic ptp crct10dif_common
+usb_common pps_core
+[ 8086.955784] RIP: 0010:refcount_warn_saturate+0xc2/0x110
+[ 8086.955788] Code: 01 e8 82 e7 b4 ff 0f 0b 5d c3 cc cc cc cc 80 3d 68 c6 eb 00 00 75 81
+48 c7 c7 a0 87 f6 81 c6 05 58 c6 eb 00 01 e8 5e e7 b4 ff <0f> 0b 5d c3 cc cc cc cc 80 3d
+42 c6 eb 00 00 0f 85 59 ff ff ff 48
+[ 8086.955790] RSP: 0018:ffa0000000003da0 EFLAGS: 00010286
+[ 8086.955793] RAX: 0000000000000000 RBX: ff1100011da40ee0 RCX: ff11000361e1b888
+[ 8086.955794] RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ff11000361e1b880
+[ 8086.955795] RBP: ffa0000000003da0 R08: 80000000ffff9f45 R09: ffa0000000003d28
+[ 8086.955796] R10: ff1100035f840000 R11: 0000000000000028 R12: ff11000319ff8000
+[ 8086.955797] R13: ff1100011bb79d60 R14: 00000000ffffffd6 R15: ff1100037039cb00
+[ 8086.955798] FS: 0000000000000000(0000) GS:ff11000361e00000(0000) knlGS:0000000000000000
+[ 8086.955800] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 8086.955801] CR2: 00007ffff7fca168 CR3: 000000013b08a003 CR4: 0000000000471ef8
+[ 8086.955803] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 8086.955803] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
+[ 8086.955804] PKRU: 55555554
+[ 8086.955805] Call Trace:
+[ 8086.955806] <IRQ>
+[ 8086.955808] tcp_wfree+0x112/0x130
+[ 8086.955814] skb_release_head_state+0x24/0xa0
+[ 8086.955818] napi_consume_skb+0x9c/0x160
+[ 8086.955821] igc_poll+0x5d8/0x14d0 [igc]
+[ 8086.955835] __napi_poll+0x2e/0x1b0
+[ 8086.955839] net_rx_action+0x126/0x250
+[ 8086.955843] __do_softirq+0xd1/0x295
+[ 8086.955846] irq_exit_rcu+0xc5/0xf0
+[ 8086.955851] common_interrupt+0x86/0xa0
+[ 8086.955857] </IRQ>
+[ 8086.955857] <TASK>
+[ 8086.955858] asm_common_interrupt+0x27/0x40
+[ 8086.955862] RIP: 0010:cpuidle_enter_state+0xd3/0x3e0
+[ 8086.955866] Code: 73 f1 ff ff 49 89 c6 8b 05 e2 ca a7 00 85 c0 0f 8f b3 02 00 00 31 ff e8
+1b de 75 ff 80 7d d7 00 0f 85 cd 01 00 00 fb 45 85 ff <0f> 88 fd 00 00 00 49 63 cf 4c 2b 75
+c8 48 8d 04 49 48 89 ca 48 8d
+[ 8086.955867] RSP: 0018:ffffffff82203df0 EFLAGS: 00000202
+[ 8086.955869] RAX: ff11000361e2a200 RBX: 0000000000000002 RCX: 000000000000001f
+[ 8086.955870] RDX: 0000000000000000 RSI: 000000003cf3cf3d RDI: 0000000000000000
+[ 8086.955871] RBP: ffffffff82203e28 R08: 0000075ae38471c8 R09: 0000000000000018
+[ 8086.955872] R10: 000000000000031a R11: ffffffff8238dca0 R12: ffd1ffffff200000
+[ 8086.955873] R13: ffffffff8238dca0 R14: 0000075ae38471c8 R15: 0000000000000002
+[ 8086.955875] cpuidle_enter+0x2e/0x50
+[ 8086.955880] call_cpuidle+0x23/0x40
+[ 8086.955884] do_idle+0x1be/0x220
+[ 8086.955887] cpu_startup_entry+0x20/0x30
+[ 8086.955889] rest_init+0xb5/0xc0
+[ 8086.955892] arch_call_rest_init+0xe/0x30
+[ 8086.955895] start_kernel+0x448/0x760
+[ 8086.955898] x86_64_start_kernel+0x109/0x150
+[ 8086.955900] secondary_startup_64_no_verify+0xe0/0xeb
+[ 8086.955904] </TASK>
+[ 8086.955904] ---[ end trace 0000000000000000 ]---
+[ 8086.955912] ------------[ cut here ]------------
+[ 8086.955913] kernel BUG at lib/dynamic_queue_limits.c:27!
+[ 8086.955918] invalid opcode: 0000 [#1] SMP
+[ 8086.955922] RIP: 0010:dql_completed+0x148/0x160
+[ 8086.955925] Code: c9 00 48 89 57 58 e9 46 ff ff ff 45 85 e4 41 0f 95 c4 41 39 db
+0f 95 c1 41 84 cc 74 05 45 85 ed 78 0a 44 89 c1 e9 27 ff ff ff <0f> 0b 01 f6 44 89
+c1 29 f1 0f 48 ca eb 8c cc cc cc cc cc cc cc cc
+[ 8086.955927] RSP: 0018:ffa0000000003e00 EFLAGS: 00010287
+[ 8086.955928] RAX: 000000000000006c RBX: ffa0000003eb0f78 RCX: ff11000109938000
+[ 8086.955929] RDX: 0000000000000003 RSI: 0000000000000160 RDI: ff110001002e9480
+[ 8086.955930] RBP: ffa0000000003ed8 R08: ff110001002e93c0 R09: ffa0000000003d28
+[ 8086.955931] R10: 0000000000007cc0 R11: 0000000000007c54 R12: 00000000ffffffd9
+[ 8086.955932] R13: ff1100037039cb00 R14: 00000000ffffffd9 R15: ff1100037039c048
+[ 8086.955933] FS: 0000000000000000(0000) GS:ff11000361e00000(0000) knlGS:0000000000000000
+[ 8086.955934] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 8086.955935] CR2: 00007ffff7fca168 CR3: 000000013b08a003 CR4: 0000000000471ef8
+[ 8086.955936] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 8086.955937] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
+[ 8086.955938] PKRU: 55555554
+[ 8086.955939] Call Trace:
+[ 8086.955939] <IRQ>
+[ 8086.955940] ? igc_poll+0x1a9/0x14d0 [igc]
+[ 8086.955949] __napi_poll+0x2e/0x1b0
+[ 8086.955952] net_rx_action+0x126/0x250
+[ 8086.955956] __do_softirq+0xd1/0x295
+[ 8086.955958] irq_exit_rcu+0xc5/0xf0
+[ 8086.955961] common_interrupt+0x86/0xa0
+[ 8086.955964] </IRQ>
+[ 8086.955965] <TASK>
+[ 8086.955965] asm_common_interrupt+0x27/0x40
+[ 8086.955968] RIP: 0010:cpuidle_enter_state+0xd3/0x3e0
+[ 8086.955971] Code: 73 f1 ff ff 49 89 c6 8b 05 e2 ca a7 00 85 c0 0f 8f b3 02 00 00
+31 ff e8 1b de 75 ff 80 7d d7 00 0f 85 cd 01 00 00 fb 45 85 ff <0f> 88 fd 00 00 00
+49 63 cf 4c 2b 75 c8 48 8d 04 49 48 89 ca 48 8d
+[ 8086.955972] RSP: 0018:ffffffff82203df0 EFLAGS: 00000202
+[ 8086.955973] RAX: ff11000361e2a200 RBX: 0000000000000002 RCX: 000000000000001f
+[ 8086.955974] RDX: 0000000000000000 RSI: 000000003cf3cf3d RDI: 0000000000000000
+[ 8086.955974] RBP: ffffffff82203e28 R08: 0000075ae38471c8 R09: 0000000000000018
+[ 8086.955975] R10: 000000000000031a R11: ffffffff8238dca0 R12: ffd1ffffff200000
+[ 8086.955976] R13: ffffffff8238dca0 R14: 0000075ae38471c8 R15: 0000000000000002
+[ 8086.955978] cpuidle_enter+0x2e/0x50
+[ 8086.955981] call_cpuidle+0x23/0x40
+[ 8086.955984] do_idle+0x1be/0x220
+[ 8086.955985] cpu_startup_entry+0x20/0x30
+[ 8086.955987] rest_init+0xb5/0xc0
+[ 8086.955990] arch_call_rest_init+0xe/0x30
+[ 8086.955992] start_kernel+0x448/0x760
+[ 8086.955994] x86_64_start_kernel+0x109/0x150
+[ 8086.955996] secondary_startup_64_no_verify+0xe0/0xeb
+[ 8086.955998] </TASK>
+[ 8086.955999] Modules linked in: xt_conntrack nft_chain_nat xt_MASQUERADE xt_addrtype
+nft_compat nf_tables nfnetlink br_netfilter bridge stp llc overlay dm_mod emrcha(PO) emriio(PO)
+rktpm(PO) cegbuf_mod(PO) patch_update(PO) se(PO) sgx_tgts(PO) mktme(PO) keylocker(PO) svtdx(PO)
+svfs_pci_hotplug(PO) vtd_mod(PO) davemem(PO) svmabort(PO) svindexio(PO) usbx2(PO) ehci_sched(PO)
+svheartbeat(PO) ioapic(PO) sv8259(PO) svintr(PO) lt(PO) pcierootport(PO) enginefw_mod(PO) ata(PO)
+smbus(PO) spiflash_cdf(PO) arden(PO) dsa_iax(PO) oobmsm_punit(PO) cpm(PO) svkdb(PO) ebg_pch(PO)
+pch(PO) sviotargets(PO) svbdf(PO) svmem(PO) svbios(PO) dram(PO) svtsc(PO) targets(PO) superio(PO)
+svkernel(PO) cswitch(PO) mcf(PO) pentiumIII_mod(PO) fs_svfs(PO) mdevdefdb(PO) svfs_os_services(O)
+ixgbe mdio mdio_devres libphy emeraldrapids_svdefs(PO) regsupport(O) libnvdimm nls_cp437
+snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_intel snd_intel_dspcfg
+snd_hda_codec snd_hwdep x86_pkg_temp_thermal snd_hda_core snd_pcm snd_timer isst_if_mbox_pci
+[ 8086.956029] input_leds isst_if_mmio sg snd isst_if_common soundcore wmi button sad9(O) drm
+fuse backlight configfs efivarfs ip_tables x_tables vmd sdhci led_class rtl8150 r8152 hid_generic
+pegasus mmc_block usbhid mmc_core hid megaraid_sas ixgb igb i2c_algo_bit ice i40e hpsa
+scsi_transport_sas e1000e e1000 e100 ax88179_178a usbnet xhci_pci sd_mod xhci_hcd t10_pi
+crc32c_intel crc64_rocksoft igc crc64 crc_t10dif usbcore crct10dif_generic ptp crct10dif_common
+usb_common pps_core
+[16762.543675] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.593 msecs
+[16762.543678] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.595 msecs
+[16762.543673] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.495 msecs
+[16762.543679] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.599 msecs
+[16762.543678] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.598 msecs
+[16762.543690] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.605 msecs
+[16762.543684] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.599 msecs
+[16762.543693] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.613 msecs
+[16762.543784] ---[ end trace 0000000000000000 ]---
+[16762.849099] RIP: 0010:dql_completed+0x148/0x160
+PANIC: Fatal exception in interrupt
+
+Fixes: 9b275176270e ("igc: Add ndo_tx_timeout support")
+Tested-by: Alejandra Victoria Alcaraz <alejandra.victoria.alcaraz@intel.com>
+Signed-off-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
+Acked-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Naama Meir <naamax.meir@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 40 ++++++++++++++++-------
+ 1 file changed, 28 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
+index 496a4eb687b00..3ccf2fedc5af7 100644
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -316,6 +316,33 @@ static void igc_clean_all_tx_rings(struct igc_adapter *adapter)
+ igc_clean_tx_ring(adapter->tx_ring[i]);
+ }
+
++static void igc_disable_tx_ring_hw(struct igc_ring *ring)
++{
++ struct igc_hw *hw = &ring->q_vector->adapter->hw;
++ u8 idx = ring->reg_idx;
++ u32 txdctl;
++
++ txdctl = rd32(IGC_TXDCTL(idx));
++ txdctl &= ~IGC_TXDCTL_QUEUE_ENABLE;
++ txdctl |= IGC_TXDCTL_SWFLUSH;
++ wr32(IGC_TXDCTL(idx), txdctl);
++}
++
++/**
++ * igc_disable_all_tx_rings_hw - Disable all transmit queue operation
++ * @adapter: board private structure
++ */
++static void igc_disable_all_tx_rings_hw(struct igc_adapter *adapter)
++{
++ int i;
++
++ for (i = 0; i < adapter->num_tx_queues; i++) {
++ struct igc_ring *tx_ring = adapter->tx_ring[i];
++
++ igc_disable_tx_ring_hw(tx_ring);
++ }
++}
++
+ /**
+ * igc_setup_tx_resources - allocate Tx resources (Descriptors)
+ * @tx_ring: tx descriptor ring (for a specific queue) to setup
+@@ -5056,6 +5083,7 @@ void igc_down(struct igc_adapter *adapter)
+ /* clear VLAN promisc flag so VFTA will be updated if necessary */
+ adapter->flags &= ~IGC_FLAG_VLAN_PROMISC;
+
++ igc_disable_all_tx_rings_hw(adapter);
+ igc_clean_all_tx_rings(adapter);
+ igc_clean_all_rx_rings(adapter);
+ }
+@@ -7274,18 +7302,6 @@ void igc_enable_rx_ring(struct igc_ring *ring)
+ igc_alloc_rx_buffers(ring, igc_desc_unused(ring));
+ }
+
+-static void igc_disable_tx_ring_hw(struct igc_ring *ring)
+-{
+- struct igc_hw *hw = &ring->q_vector->adapter->hw;
+- u8 idx = ring->reg_idx;
+- u32 txdctl;
+-
+- txdctl = rd32(IGC_TXDCTL(idx));
+- txdctl &= ~IGC_TXDCTL_QUEUE_ENABLE;
+- txdctl |= IGC_TXDCTL_SWFLUSH;
+- wr32(IGC_TXDCTL(idx), txdctl);
+-}
+-
+ void igc_disable_tx_ring(struct igc_ring *ring)
+ {
+ igc_disable_tx_ring_hw(ring);
+--
+2.39.2
+
--- /dev/null
+From efe18902d0ec51a76aea094fc5f0931431422589 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jul 2023 09:00:22 -0700
+Subject: ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new
+ temporary address
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maciej Żenczykowski <maze@google.com>
+
+[ Upstream commit 69172f0bcb6a09110c5d2a6d792627f5095a9018 ]
+
+currently on 6.4 net/main:
+
+ # ip link add dummy1 type dummy
+ # echo 1 > /proc/sys/net/ipv6/conf/dummy1/use_tempaddr
+ # ip link set dummy1 up
+ # ip -6 addr add 2000::1/64 mngtmpaddr dev dummy1
+ # ip -6 addr show dev dummy1
+
+ 11: dummy1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
+ inet6 2000::44f3:581c:8ca:3983/64 scope global temporary dynamic
+ valid_lft 604800sec preferred_lft 86172sec
+ inet6 2000::1/64 scope global mngtmpaddr
+ valid_lft forever preferred_lft forever
+ inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link
+ valid_lft forever preferred_lft forever
+
+ # ip -6 addr del 2000::44f3:581c:8ca:3983/64 dev dummy1
+
+ (can wait a few seconds if you want to, the above delete isn't [directly] the problem)
+
+ # ip -6 addr show dev dummy1
+
+ 11: dummy1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
+ inet6 2000::1/64 scope global mngtmpaddr
+ valid_lft forever preferred_lft forever
+ inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link
+ valid_lft forever preferred_lft forever
+
+ # ip -6 addr del 2000::1/64 mngtmpaddr dev dummy1
+ # ip -6 addr show dev dummy1
+
+ 11: dummy1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
+ inet6 2000::81c9:56b7:f51a:b98f/64 scope global temporary dynamic
+ valid_lft 604797sec preferred_lft 86169sec
+ inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link
+ valid_lft forever preferred_lft forever
+
+This patch prevents this new 'global temporary dynamic' address from being
+created by the deletion of the related (same subnet prefix) 'mngtmpaddr'
+(which is triggered by there already being no temporary addresses).
+
+Cc: Jiri Pirko <jiri@resnulli.us>
+Fixes: 53bd67491537 ("ipv6 addrconf: introduce IFA_F_MANAGETEMPADDR to tell kernel to manage temporary addresses")
+Reported-by: Xiao Ma <xiaom@google.com>
+Signed-off-by: Maciej Żenczykowski <maze@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/20230720160022.1887942-1-maze@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 5affca8e2f53a..c63f1d62d60a5 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -2561,12 +2561,18 @@ static void manage_tempaddrs(struct inet6_dev *idev,
+ ipv6_ifa_notify(0, ift);
+ }
+
+- if ((create || list_empty(&idev->tempaddr_list)) &&
+- idev->cnf.use_tempaddr > 0) {
++ /* Also create a temporary address if it's enabled but no temporary
++ * address currently exists.
++ * However, we get called with valid_lft == 0, prefered_lft == 0, create == false
++ * as part of cleanup (ie. deleting the mngtmpaddr).
++ * We don't want that to result in creating a new temporary ip address.
++ */
++ if (list_empty(&idev->tempaddr_list) && (valid_lft || prefered_lft))
++ create = true;
++
++ if (create && idev->cnf.use_tempaddr > 0) {
+ /* When a new public address is created as described
+ * in [ADDRCONF], also create a new temporary address.
+- * Also create a temporary address if it's enabled but
+- * no temporary address currently exists.
+ */
+ read_unlock_bh(&idev->lock);
+ ipv6_create_tempaddr(ifp, false);
+--
+2.39.2
+
--- /dev/null
+From bf3e115369ff5fd3b2c3e2f2bacbc4498d7a80a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Jul 2023 16:02:05 +0800
+Subject: macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit 55cef78c244d0d076f5a75a35530ca63c92f4426 ]
+
+The previous commit 954d1fa1ac93 ("macvlan: Add netlink attribute for
+broadcast cutoff") added one additional attribute named
+IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff.
+
+However, it forgot to describe the nla_policy at macvlan_policy
+(drivers/net/macvlan.c). Hence, this suppose NLA_S32 (4 bytes) integer
+can be faked as empty (0 bytes) by a malicious user, which could leads
+to OOB in heap just like CVE-2023-3773.
+
+To fix it, this commit just completes the nla_policy description for
+IFLA_MACVLAN_BC_CUTOFF. This enforces the length check and avoids the
+potential OOB read.
+
+Fixes: 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230723080205.3715164-1-linma@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/macvlan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 4a53debf9d7c4..ed908165a8b4e 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -1746,6 +1746,7 @@ static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = {
+ [IFLA_MACVLAN_MACADDR_COUNT] = { .type = NLA_U32 },
+ [IFLA_MACVLAN_BC_QUEUE_LEN] = { .type = NLA_U32 },
+ [IFLA_MACVLAN_BC_QUEUE_LEN_USED] = { .type = NLA_REJECT },
++ [IFLA_MACVLAN_BC_CUTOFF] = { .type = NLA_S32 },
+ };
+
+ int macvlan_link_register(struct rtnl_link_ops *ops)
+--
+2.39.2
+
--- /dev/null
+From 36632d5c057816c400e7857404133bb33773471d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 22:10:15 +0200
+Subject: media: amphion: Fix firmware path to match linux-firmware
+
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+
+[ Upstream commit dcff0b56f661b6b42e828012b464d22cc2068c38 ]
+
+The path did not match the one it was submitted into linux-firmware
+which prevented generic distribution from having working CODEC.
+
+Fixes: 9f599f351e86 ("media: amphion: add vpu core driver")
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vpu_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
+index de23627a119a0..82bf8b3be66a2 100644
+--- a/drivers/media/platform/amphion/vpu_core.c
++++ b/drivers/media/platform/amphion/vpu_core.c
+@@ -826,7 +826,7 @@ static const struct dev_pm_ops vpu_core_pm_ops = {
+
+ static struct vpu_core_resources imx8q_enc = {
+ .type = VPU_CORE_TYPE_ENC,
+- .fwname = "vpu/vpu_fw_imx8_enc.bin",
++ .fwname = "amphion/vpu/vpu_fw_imx8_enc.bin",
+ .stride = 16,
+ .max_width = 1920,
+ .max_height = 1920,
+@@ -841,7 +841,7 @@ static struct vpu_core_resources imx8q_enc = {
+
+ static struct vpu_core_resources imx8q_dec = {
+ .type = VPU_CORE_TYPE_DEC,
+- .fwname = "vpu/vpu_fw_imx8_dec.bin",
++ .fwname = "amphion/vpu/vpu_fw_imx8_dec.bin",
+ .stride = 256,
+ .max_width = 8188,
+ .max_height = 8188,
+--
+2.39.2
+
--- /dev/null
+From cb9edc6fa5fb333d2f5e78543ea023b38f494d97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 May 2023 16:41:42 -0700
+Subject: media: mtk-jpeg: move data/code inside CONFIG_OF blocks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit da4ede4b7fd6aa341b69e3a9d2517b8df5e744fd ]
+
+Lots of data and functions here are not needed when CONFIG_OF is not
+set, so move them inside #ifdef CONFIG_OF blocks to prevent the warnings.
+
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1645:29: warning: ‘mtk_jpeg_clocks’ defined but not used [-Wunused-variable]
+ 1645 | static struct clk_bulk_data mtk_jpeg_clocks[] = {
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1640:29: warning: ‘mt8173_jpeg_dec_clocks’ defined but not used [-Wunused-variable]
+ 1640 | static struct clk_bulk_data mt8173_jpeg_dec_clocks[] = {
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1481:20: warning: ‘mtk_jpeg_dec_irq’ defined but not used [-Wunused-function]
+ 1481 | static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv)
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1461:20: warning: ‘mtk_jpeg_enc_irq’ defined but not used [-Wunused-function]
+ 1461 | static irqreturn_t mtk_jpeg_enc_irq(int irq, void *priv)
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1180:13: warning: ‘mtk_jpegdec_worker’ defined but not used [-Wunused-function]
+ 1180 | static void mtk_jpegdec_worker(struct work_struct *work)
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:986:13: warning: ‘mtk_jpegenc_worker’ defined but not used [-Wunused-function]
+ 986 | static void mtk_jpegenc_worker(struct work_struct *work)
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:79:28: warning: ‘mtk_jpeg_dec_formats’ defined but not used [-Wunused-variable]
+ 79 | static struct mtk_jpeg_fmt mtk_jpeg_dec_formats[] = {
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:31:28: warning: ‘mtk_jpeg_enc_formats’ defined but not used [-Wunused-variable]
+ 31 | static struct mtk_jpeg_fmt mtk_jpeg_enc_formats[] = {
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1222:20: warning: ‘mtk_jpeg_enc_done’ defined but not used [-Wunused-function]
+ 1222 | static irqreturn_t mtk_jpeg_enc_done(struct mtk_jpeg_dev *jpeg)
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1072:12: warning: ‘mtk_jpegdec_set_hw_param’ defined but not used [-Wunused-function]
+ 1072 | static int mtk_jpegdec_set_hw_param(struct mtk_jpeg_ctx *ctx,
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1060:12: warning: ‘mtk_jpegdec_put_hw’ defined but not used [-Wunused-function]
+ 1060 | static int mtk_jpegdec_put_hw(struct mtk_jpeg_dev *jpeg, int hw_id)
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1038:12: warning: ‘mtk_jpegdec_get_hw’ defined but not used [-Wunused-function]
+ 1038 | static int mtk_jpegdec_get_hw(struct mtk_jpeg_ctx *ctx)
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:977:12: warning: ‘mtk_jpegenc_put_hw’ defined but not used [-Wunused-function]
+ 977 | static int mtk_jpegenc_put_hw(struct mtk_jpeg_dev *jpeg, int hw_id)
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:963:12: warning: ‘mtk_jpegenc_set_hw_param’ defined but not used [-Wunused-function]
+ 963 | static int mtk_jpegenc_set_hw_param(struct mtk_jpeg_ctx *ctx,
+../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:941:12: warning: ‘mtk_jpegenc_get_hw’ defined but not used [-Wunused-function]
+ 941 | static int mtk_jpegenc_get_hw(struct mtk_jpeg_ctx *ctx)
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/linux-media/202305042146.j4ZxuvpM-lkp@intel.com/
+Cc: Bin Liu <bin.liu@mediatek.com>
+Cc: oushixiong <oushixiong@kylinos.cn>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Cc: linux-media@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Stable-dep-of: 20de9fdaf488 ("media: mtk_jpeg_core: avoid unused-variable warning")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/jpeg/mtk_jpeg_core.c | 858 +++++++++---------
+ 1 file changed, 430 insertions(+), 428 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+index 0051f372a66cf..4768156181c99 100644
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+@@ -28,6 +28,7 @@
+ #include "mtk_jpeg_core.h"
+ #include "mtk_jpeg_dec_parse.h"
+
++#if defined(CONFIG_OF)
+ static struct mtk_jpeg_fmt mtk_jpeg_enc_formats[] = {
+ {
+ .fourcc = V4L2_PIX_FMT_JPEG,
+@@ -101,6 +102,7 @@ static struct mtk_jpeg_fmt mtk_jpeg_dec_formats[] = {
+ .flags = MTK_JPEG_FMT_FLAG_CAPTURE,
+ },
+ };
++#endif
+
+ #define MTK_JPEG_ENC_NUM_FORMATS ARRAY_SIZE(mtk_jpeg_enc_formats)
+ #define MTK_JPEG_DEC_NUM_FORMATS ARRAY_SIZE(mtk_jpeg_dec_formats)
+@@ -936,148 +938,6 @@ static int mtk_jpeg_set_dec_dst(struct mtk_jpeg_ctx *ctx,
+ return 0;
+ }
+
+-static int mtk_jpegenc_get_hw(struct mtk_jpeg_ctx *ctx)
+-{
+- struct mtk_jpegenc_comp_dev *comp_jpeg;
+- struct mtk_jpeg_dev *jpeg = ctx->jpeg;
+- unsigned long flags;
+- int hw_id = -1;
+- int i;
+-
+- spin_lock_irqsave(&jpeg->hw_lock, flags);
+- for (i = 0; i < MTK_JPEGENC_HW_MAX; i++) {
+- comp_jpeg = jpeg->enc_hw_dev[i];
+- if (comp_jpeg->hw_state == MTK_JPEG_HW_IDLE) {
+- hw_id = i;
+- comp_jpeg->hw_state = MTK_JPEG_HW_BUSY;
+- break;
+- }
+- }
+- spin_unlock_irqrestore(&jpeg->hw_lock, flags);
+-
+- return hw_id;
+-}
+-
+-static int mtk_jpegenc_set_hw_param(struct mtk_jpeg_ctx *ctx,
+- int hw_id,
+- struct vb2_v4l2_buffer *src_buf,
+- struct vb2_v4l2_buffer *dst_buf)
+-{
+- struct mtk_jpegenc_comp_dev *jpeg = ctx->jpeg->enc_hw_dev[hw_id];
+-
+- jpeg->hw_param.curr_ctx = ctx;
+- jpeg->hw_param.src_buffer = src_buf;
+- jpeg->hw_param.dst_buffer = dst_buf;
+-
+- return 0;
+-}
+-
+-static int mtk_jpegenc_put_hw(struct mtk_jpeg_dev *jpeg, int hw_id)
+-{
+- unsigned long flags;
+-
+- spin_lock_irqsave(&jpeg->hw_lock, flags);
+- jpeg->enc_hw_dev[hw_id]->hw_state = MTK_JPEG_HW_IDLE;
+- spin_unlock_irqrestore(&jpeg->hw_lock, flags);
+-
+- return 0;
+-}
+-
+-static void mtk_jpegenc_worker(struct work_struct *work)
+-{
+- struct mtk_jpegenc_comp_dev *comp_jpeg[MTK_JPEGENC_HW_MAX];
+- enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
+- struct mtk_jpeg_src_buf *jpeg_dst_buf;
+- struct vb2_v4l2_buffer *src_buf, *dst_buf;
+- int ret, i, hw_id = 0;
+- unsigned long flags;
+-
+- struct mtk_jpeg_ctx *ctx = container_of(work,
+- struct mtk_jpeg_ctx,
+- jpeg_work);
+- struct mtk_jpeg_dev *jpeg = ctx->jpeg;
+-
+- for (i = 0; i < MTK_JPEGENC_HW_MAX; i++)
+- comp_jpeg[i] = jpeg->enc_hw_dev[i];
+- i = 0;
+-
+-retry_select:
+- hw_id = mtk_jpegenc_get_hw(ctx);
+- if (hw_id < 0) {
+- ret = wait_event_interruptible(jpeg->hw_wq,
+- atomic_read(&jpeg->hw_rdy) > 0);
+- if (ret != 0 || (i++ > MTK_JPEG_MAX_RETRY_TIME)) {
+- dev_err(jpeg->dev, "%s : %d, all HW are busy\n",
+- __func__, __LINE__);
+- v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+- return;
+- }
+-
+- goto retry_select;
+- }
+-
+- atomic_dec(&jpeg->hw_rdy);
+- src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+- if (!src_buf)
+- goto getbuf_fail;
+-
+- dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
+- if (!dst_buf)
+- goto getbuf_fail;
+-
+- v4l2_m2m_buf_copy_metadata(src_buf, dst_buf, true);
+-
+- mtk_jpegenc_set_hw_param(ctx, hw_id, src_buf, dst_buf);
+- ret = pm_runtime_get_sync(comp_jpeg[hw_id]->dev);
+- if (ret < 0) {
+- dev_err(jpeg->dev, "%s : %d, pm_runtime_get_sync fail !!!\n",
+- __func__, __LINE__);
+- goto enc_end;
+- }
+-
+- ret = clk_prepare_enable(comp_jpeg[hw_id]->venc_clk.clks->clk);
+- if (ret) {
+- dev_err(jpeg->dev, "%s : %d, jpegenc clk_prepare_enable fail\n",
+- __func__, __LINE__);
+- goto enc_end;
+- }
+-
+- v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+- v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+-
+- schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work,
+- msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));
+-
+- spin_lock_irqsave(&comp_jpeg[hw_id]->hw_lock, flags);
+- jpeg_dst_buf = mtk_jpeg_vb2_to_srcbuf(&dst_buf->vb2_buf);
+- jpeg_dst_buf->curr_ctx = ctx;
+- jpeg_dst_buf->frame_num = ctx->total_frame_num;
+- ctx->total_frame_num++;
+- mtk_jpeg_enc_reset(comp_jpeg[hw_id]->reg_base);
+- mtk_jpeg_set_enc_dst(ctx,
+- comp_jpeg[hw_id]->reg_base,
+- &dst_buf->vb2_buf);
+- mtk_jpeg_set_enc_src(ctx,
+- comp_jpeg[hw_id]->reg_base,
+- &src_buf->vb2_buf);
+- mtk_jpeg_set_enc_params(ctx, comp_jpeg[hw_id]->reg_base);
+- mtk_jpeg_enc_start(comp_jpeg[hw_id]->reg_base);
+- v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+- spin_unlock_irqrestore(&comp_jpeg[hw_id]->hw_lock, flags);
+-
+- return;
+-
+-enc_end:
+- v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+- v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+- v4l2_m2m_buf_done(src_buf, buf_state);
+- v4l2_m2m_buf_done(dst_buf, buf_state);
+-getbuf_fail:
+- atomic_inc(&jpeg->hw_rdy);
+- mtk_jpegenc_put_hw(jpeg, hw_id);
+- v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+-}
+-
+ static void mtk_jpeg_enc_device_run(void *priv)
+ {
+ struct mtk_jpeg_ctx *ctx = priv;
+@@ -1128,206 +988,39 @@ static void mtk_jpeg_multicore_enc_device_run(void *priv)
+ queue_work(jpeg->workqueue, &ctx->jpeg_work);
+ }
+
+-static int mtk_jpegdec_get_hw(struct mtk_jpeg_ctx *ctx)
++static void mtk_jpeg_multicore_dec_device_run(void *priv)
+ {
+- struct mtk_jpegdec_comp_dev *comp_jpeg;
++ struct mtk_jpeg_ctx *ctx = priv;
+ struct mtk_jpeg_dev *jpeg = ctx->jpeg;
+- unsigned long flags;
+- int hw_id = -1;
+- int i;
+-
+- spin_lock_irqsave(&jpeg->hw_lock, flags);
+- for (i = 0; i < MTK_JPEGDEC_HW_MAX; i++) {
+- comp_jpeg = jpeg->dec_hw_dev[i];
+- if (comp_jpeg->hw_state == MTK_JPEG_HW_IDLE) {
+- hw_id = i;
+- comp_jpeg->hw_state = MTK_JPEG_HW_BUSY;
+- break;
+- }
+- }
+- spin_unlock_irqrestore(&jpeg->hw_lock, flags);
+-
+- return hw_id;
+-}
+-
+-static int mtk_jpegdec_put_hw(struct mtk_jpeg_dev *jpeg, int hw_id)
+-{
+- unsigned long flags;
+-
+- spin_lock_irqsave(&jpeg->hw_lock, flags);
+- jpeg->dec_hw_dev[hw_id]->hw_state =
+- MTK_JPEG_HW_IDLE;
+- spin_unlock_irqrestore(&jpeg->hw_lock, flags);
+-
+- return 0;
+-}
+-
+-static int mtk_jpegdec_set_hw_param(struct mtk_jpeg_ctx *ctx,
+- int hw_id,
+- struct vb2_v4l2_buffer *src_buf,
+- struct vb2_v4l2_buffer *dst_buf)
+-{
+- struct mtk_jpegdec_comp_dev *jpeg =
+- ctx->jpeg->dec_hw_dev[hw_id];
+-
+- jpeg->hw_param.curr_ctx = ctx;
+- jpeg->hw_param.src_buffer = src_buf;
+- jpeg->hw_param.dst_buffer = dst_buf;
+
+- return 0;
++ queue_work(jpeg->workqueue, &ctx->jpeg_work);
+ }
+
+-static void mtk_jpegdec_worker(struct work_struct *work)
++static void mtk_jpeg_dec_device_run(void *priv)
+ {
+- struct mtk_jpeg_ctx *ctx = container_of(work, struct mtk_jpeg_ctx,
+- jpeg_work);
+- struct mtk_jpegdec_comp_dev *comp_jpeg[MTK_JPEGDEC_HW_MAX];
+- enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
+- struct mtk_jpeg_src_buf *jpeg_src_buf, *jpeg_dst_buf;
+- struct vb2_v4l2_buffer *src_buf, *dst_buf;
++ struct mtk_jpeg_ctx *ctx = priv;
+ struct mtk_jpeg_dev *jpeg = ctx->jpeg;
+- int ret, i, hw_id = 0;
++ struct vb2_v4l2_buffer *src_buf, *dst_buf;
++ enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
++ unsigned long flags;
++ struct mtk_jpeg_src_buf *jpeg_src_buf;
+ struct mtk_jpeg_bs bs;
+ struct mtk_jpeg_fb fb;
+- unsigned long flags;
+-
+- for (i = 0; i < MTK_JPEGDEC_HW_MAX; i++)
+- comp_jpeg[i] = jpeg->dec_hw_dev[i];
+- i = 0;
+-
+-retry_select:
+- hw_id = mtk_jpegdec_get_hw(ctx);
+- if (hw_id < 0) {
+- ret = wait_event_interruptible_timeout(jpeg->hw_wq,
+- atomic_read(&jpeg->hw_rdy) > 0,
+- MTK_JPEG_HW_TIMEOUT_MSEC);
+- if (ret != 0 || (i++ > MTK_JPEG_MAX_RETRY_TIME)) {
+- dev_err(jpeg->dev, "%s : %d, all HW are busy\n",
+- __func__, __LINE__);
+- v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+- return;
+- }
+-
+- goto retry_select;
+- }
++ int ret;
+
+- atomic_dec(&jpeg->hw_rdy);
+ src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+- if (!src_buf)
+- goto getbuf_fail;
+-
+ dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
+- if (!dst_buf)
+- goto getbuf_fail;
+-
+- v4l2_m2m_buf_copy_metadata(src_buf, dst_buf, true);
+ jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf);
+- jpeg_dst_buf = mtk_jpeg_vb2_to_srcbuf(&dst_buf->vb2_buf);
+
+- if (mtk_jpeg_check_resolution_change(ctx,
+- &jpeg_src_buf->dec_param)) {
++ if (mtk_jpeg_check_resolution_change(ctx, &jpeg_src_buf->dec_param)) {
+ mtk_jpeg_queue_src_chg_event(ctx);
+ ctx->state = MTK_JPEG_SOURCE_CHANGE;
+- goto getbuf_fail;
++ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
++ return;
+ }
+
+- jpeg_src_buf->curr_ctx = ctx;
+- jpeg_src_buf->frame_num = ctx->total_frame_num;
+- jpeg_dst_buf->curr_ctx = ctx;
+- jpeg_dst_buf->frame_num = ctx->total_frame_num;
+-
+- mtk_jpegdec_set_hw_param(ctx, hw_id, src_buf, dst_buf);
+- ret = pm_runtime_get_sync(comp_jpeg[hw_id]->dev);
+- if (ret < 0) {
+- dev_err(jpeg->dev, "%s : %d, pm_runtime_get_sync fail !!!\n",
+- __func__, __LINE__);
+- goto dec_end;
+- }
+-
+- ret = clk_prepare_enable(comp_jpeg[hw_id]->jdec_clk.clks->clk);
+- if (ret) {
+- dev_err(jpeg->dev, "%s : %d, jpegdec clk_prepare_enable fail\n",
+- __func__, __LINE__);
+- goto clk_end;
+- }
+-
+- v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+- v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+-
+- schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work,
+- msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));
+-
+- mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs);
+- if (mtk_jpeg_set_dec_dst(ctx,
+- &jpeg_src_buf->dec_param,
+- &dst_buf->vb2_buf, &fb)) {
+- dev_err(jpeg->dev, "%s : %d, mtk_jpeg_set_dec_dst fail\n",
+- __func__, __LINE__);
+- goto setdst_end;
+- }
+-
+- spin_lock_irqsave(&comp_jpeg[hw_id]->hw_lock, flags);
+- ctx->total_frame_num++;
+- mtk_jpeg_dec_reset(comp_jpeg[hw_id]->reg_base);
+- mtk_jpeg_dec_set_config(comp_jpeg[hw_id]->reg_base,
+- &jpeg_src_buf->dec_param,
+- jpeg_src_buf->bs_size,
+- &bs,
+- &fb);
+- mtk_jpeg_dec_start(comp_jpeg[hw_id]->reg_base);
+- v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+- spin_unlock_irqrestore(&comp_jpeg[hw_id]->hw_lock, flags);
+-
+- return;
+-
+-setdst_end:
+- clk_disable_unprepare(comp_jpeg[hw_id]->jdec_clk.clks->clk);
+-clk_end:
+- pm_runtime_put(comp_jpeg[hw_id]->dev);
+-dec_end:
+- v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+- v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+- v4l2_m2m_buf_done(src_buf, buf_state);
+- v4l2_m2m_buf_done(dst_buf, buf_state);
+-getbuf_fail:
+- atomic_inc(&jpeg->hw_rdy);
+- mtk_jpegdec_put_hw(jpeg, hw_id);
+- v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+-}
+-
+-static void mtk_jpeg_multicore_dec_device_run(void *priv)
+-{
+- struct mtk_jpeg_ctx *ctx = priv;
+- struct mtk_jpeg_dev *jpeg = ctx->jpeg;
+-
+- queue_work(jpeg->workqueue, &ctx->jpeg_work);
+-}
+-
+-static void mtk_jpeg_dec_device_run(void *priv)
+-{
+- struct mtk_jpeg_ctx *ctx = priv;
+- struct mtk_jpeg_dev *jpeg = ctx->jpeg;
+- struct vb2_v4l2_buffer *src_buf, *dst_buf;
+- enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
+- unsigned long flags;
+- struct mtk_jpeg_src_buf *jpeg_src_buf;
+- struct mtk_jpeg_bs bs;
+- struct mtk_jpeg_fb fb;
+- int ret;
+-
+- src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+- dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
+- jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf);
+-
+- if (mtk_jpeg_check_resolution_change(ctx, &jpeg_src_buf->dec_param)) {
+- mtk_jpeg_queue_src_chg_event(ctx);
+- ctx->state = MTK_JPEG_SOURCE_CHANGE;
+- v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+- return;
+- }
+-
+- ret = pm_runtime_resume_and_get(jpeg->dev);
+- if (ret < 0)
++ ret = pm_runtime_resume_and_get(jpeg->dev);
++ if (ret < 0)
+ goto dec_end;
+
+ schedule_delayed_work(&jpeg->job_timeout_work,
+@@ -1430,101 +1123,6 @@ static void mtk_jpeg_clk_off(struct mtk_jpeg_dev *jpeg)
+ jpeg->variant->clks);
+ }
+
+-static irqreturn_t mtk_jpeg_enc_done(struct mtk_jpeg_dev *jpeg)
+-{
+- struct mtk_jpeg_ctx *ctx;
+- struct vb2_v4l2_buffer *src_buf, *dst_buf;
+- enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
+- u32 result_size;
+-
+- ctx = v4l2_m2m_get_curr_priv(jpeg->m2m_dev);
+- if (!ctx) {
+- v4l2_err(&jpeg->v4l2_dev, "Context is NULL\n");
+- return IRQ_HANDLED;
+- }
+-
+- src_buf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+- dst_buf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+-
+- result_size = mtk_jpeg_enc_get_file_size(jpeg->reg_base);
+- vb2_set_plane_payload(&dst_buf->vb2_buf, 0, result_size);
+-
+- buf_state = VB2_BUF_STATE_DONE;
+-
+- v4l2_m2m_buf_done(src_buf, buf_state);
+- v4l2_m2m_buf_done(dst_buf, buf_state);
+- v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+- pm_runtime_put(ctx->jpeg->dev);
+- return IRQ_HANDLED;
+-}
+-
+-static irqreturn_t mtk_jpeg_enc_irq(int irq, void *priv)
+-{
+- struct mtk_jpeg_dev *jpeg = priv;
+- u32 irq_status;
+- irqreturn_t ret = IRQ_NONE;
+-
+- cancel_delayed_work(&jpeg->job_timeout_work);
+-
+- irq_status = readl(jpeg->reg_base + JPEG_ENC_INT_STS) &
+- JPEG_ENC_INT_STATUS_MASK_ALLIRQ;
+- if (irq_status)
+- writel(0, jpeg->reg_base + JPEG_ENC_INT_STS);
+-
+- if (!(irq_status & JPEG_ENC_INT_STATUS_DONE))
+- return ret;
+-
+- ret = mtk_jpeg_enc_done(jpeg);
+- return ret;
+-}
+-
+-static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv)
+-{
+- struct mtk_jpeg_dev *jpeg = priv;
+- struct mtk_jpeg_ctx *ctx;
+- struct vb2_v4l2_buffer *src_buf, *dst_buf;
+- struct mtk_jpeg_src_buf *jpeg_src_buf;
+- enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
+- u32 dec_irq_ret;
+- u32 dec_ret;
+- int i;
+-
+- cancel_delayed_work(&jpeg->job_timeout_work);
+-
+- dec_ret = mtk_jpeg_dec_get_int_status(jpeg->reg_base);
+- dec_irq_ret = mtk_jpeg_dec_enum_result(dec_ret);
+- ctx = v4l2_m2m_get_curr_priv(jpeg->m2m_dev);
+- if (!ctx) {
+- v4l2_err(&jpeg->v4l2_dev, "Context is NULL\n");
+- return IRQ_HANDLED;
+- }
+-
+- src_buf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+- dst_buf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+- jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf);
+-
+- if (dec_irq_ret >= MTK_JPEG_DEC_RESULT_UNDERFLOW)
+- mtk_jpeg_dec_reset(jpeg->reg_base);
+-
+- if (dec_irq_ret != MTK_JPEG_DEC_RESULT_EOF_DONE) {
+- dev_err(jpeg->dev, "decode failed\n");
+- goto dec_end;
+- }
+-
+- for (i = 0; i < dst_buf->vb2_buf.num_planes; i++)
+- vb2_set_plane_payload(&dst_buf->vb2_buf, i,
+- jpeg_src_buf->dec_param.comp_size[i]);
+-
+- buf_state = VB2_BUF_STATE_DONE;
+-
+-dec_end:
+- v4l2_m2m_buf_done(src_buf, buf_state);
+- v4l2_m2m_buf_done(dst_buf, buf_state);
+- v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+- pm_runtime_put(ctx->jpeg->dev);
+- return IRQ_HANDLED;
+-}
+-
+ static void mtk_jpeg_set_default_params(struct mtk_jpeg_ctx *ctx)
+ {
+ struct mtk_jpeg_q_data *q = &ctx->out_q;
+@@ -1637,15 +1235,6 @@ static const struct v4l2_file_operations mtk_jpeg_fops = {
+ .mmap = v4l2_m2m_fop_mmap,
+ };
+
+-static struct clk_bulk_data mt8173_jpeg_dec_clocks[] = {
+- { .id = "jpgdec-smi" },
+- { .id = "jpgdec" },
+-};
+-
+-static struct clk_bulk_data mtk_jpeg_clocks[] = {
+- { .id = "jpgenc" },
+-};
+-
+ static void mtk_jpeg_job_timeout_work(struct work_struct *work)
+ {
+ struct mtk_jpeg_dev *jpeg = container_of(work, struct mtk_jpeg_dev,
+@@ -1867,6 +1456,419 @@ static const struct dev_pm_ops mtk_jpeg_pm_ops = {
+ };
+
+ #if defined(CONFIG_OF)
++static int mtk_jpegenc_get_hw(struct mtk_jpeg_ctx *ctx)
++{
++ struct mtk_jpegenc_comp_dev *comp_jpeg;
++ struct mtk_jpeg_dev *jpeg = ctx->jpeg;
++ unsigned long flags;
++ int hw_id = -1;
++ int i;
++
++ spin_lock_irqsave(&jpeg->hw_lock, flags);
++ for (i = 0; i < MTK_JPEGENC_HW_MAX; i++) {
++ comp_jpeg = jpeg->enc_hw_dev[i];
++ if (comp_jpeg->hw_state == MTK_JPEG_HW_IDLE) {
++ hw_id = i;
++ comp_jpeg->hw_state = MTK_JPEG_HW_BUSY;
++ break;
++ }
++ }
++ spin_unlock_irqrestore(&jpeg->hw_lock, flags);
++
++ return hw_id;
++}
++
++static int mtk_jpegenc_set_hw_param(struct mtk_jpeg_ctx *ctx,
++ int hw_id,
++ struct vb2_v4l2_buffer *src_buf,
++ struct vb2_v4l2_buffer *dst_buf)
++{
++ struct mtk_jpegenc_comp_dev *jpeg = ctx->jpeg->enc_hw_dev[hw_id];
++
++ jpeg->hw_param.curr_ctx = ctx;
++ jpeg->hw_param.src_buffer = src_buf;
++ jpeg->hw_param.dst_buffer = dst_buf;
++
++ return 0;
++}
++
++static int mtk_jpegenc_put_hw(struct mtk_jpeg_dev *jpeg, int hw_id)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&jpeg->hw_lock, flags);
++ jpeg->enc_hw_dev[hw_id]->hw_state = MTK_JPEG_HW_IDLE;
++ spin_unlock_irqrestore(&jpeg->hw_lock, flags);
++
++ return 0;
++}
++
++static int mtk_jpegdec_get_hw(struct mtk_jpeg_ctx *ctx)
++{
++ struct mtk_jpegdec_comp_dev *comp_jpeg;
++ struct mtk_jpeg_dev *jpeg = ctx->jpeg;
++ unsigned long flags;
++ int hw_id = -1;
++ int i;
++
++ spin_lock_irqsave(&jpeg->hw_lock, flags);
++ for (i = 0; i < MTK_JPEGDEC_HW_MAX; i++) {
++ comp_jpeg = jpeg->dec_hw_dev[i];
++ if (comp_jpeg->hw_state == MTK_JPEG_HW_IDLE) {
++ hw_id = i;
++ comp_jpeg->hw_state = MTK_JPEG_HW_BUSY;
++ break;
++ }
++ }
++ spin_unlock_irqrestore(&jpeg->hw_lock, flags);
++
++ return hw_id;
++}
++
++static int mtk_jpegdec_put_hw(struct mtk_jpeg_dev *jpeg, int hw_id)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&jpeg->hw_lock, flags);
++ jpeg->dec_hw_dev[hw_id]->hw_state =
++ MTK_JPEG_HW_IDLE;
++ spin_unlock_irqrestore(&jpeg->hw_lock, flags);
++
++ return 0;
++}
++
++static int mtk_jpegdec_set_hw_param(struct mtk_jpeg_ctx *ctx,
++ int hw_id,
++ struct vb2_v4l2_buffer *src_buf,
++ struct vb2_v4l2_buffer *dst_buf)
++{
++ struct mtk_jpegdec_comp_dev *jpeg =
++ ctx->jpeg->dec_hw_dev[hw_id];
++
++ jpeg->hw_param.curr_ctx = ctx;
++ jpeg->hw_param.src_buffer = src_buf;
++ jpeg->hw_param.dst_buffer = dst_buf;
++
++ return 0;
++}
++
++static irqreturn_t mtk_jpeg_enc_done(struct mtk_jpeg_dev *jpeg)
++{
++ struct mtk_jpeg_ctx *ctx;
++ struct vb2_v4l2_buffer *src_buf, *dst_buf;
++ enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
++ u32 result_size;
++
++ ctx = v4l2_m2m_get_curr_priv(jpeg->m2m_dev);
++ if (!ctx) {
++ v4l2_err(&jpeg->v4l2_dev, "Context is NULL\n");
++ return IRQ_HANDLED;
++ }
++
++ src_buf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++ dst_buf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++
++ result_size = mtk_jpeg_enc_get_file_size(jpeg->reg_base);
++ vb2_set_plane_payload(&dst_buf->vb2_buf, 0, result_size);
++
++ buf_state = VB2_BUF_STATE_DONE;
++
++ v4l2_m2m_buf_done(src_buf, buf_state);
++ v4l2_m2m_buf_done(dst_buf, buf_state);
++ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
++ pm_runtime_put(ctx->jpeg->dev);
++ return IRQ_HANDLED;
++}
++
++static void mtk_jpegenc_worker(struct work_struct *work)
++{
++ struct mtk_jpegenc_comp_dev *comp_jpeg[MTK_JPEGENC_HW_MAX];
++ enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
++ struct mtk_jpeg_src_buf *jpeg_dst_buf;
++ struct vb2_v4l2_buffer *src_buf, *dst_buf;
++ int ret, i, hw_id = 0;
++ unsigned long flags;
++
++ struct mtk_jpeg_ctx *ctx = container_of(work,
++ struct mtk_jpeg_ctx,
++ jpeg_work);
++ struct mtk_jpeg_dev *jpeg = ctx->jpeg;
++
++ for (i = 0; i < MTK_JPEGENC_HW_MAX; i++)
++ comp_jpeg[i] = jpeg->enc_hw_dev[i];
++ i = 0;
++
++retry_select:
++ hw_id = mtk_jpegenc_get_hw(ctx);
++ if (hw_id < 0) {
++ ret = wait_event_interruptible(jpeg->hw_wq,
++ atomic_read(&jpeg->hw_rdy) > 0);
++ if (ret != 0 || (i++ > MTK_JPEG_MAX_RETRY_TIME)) {
++ dev_err(jpeg->dev, "%s : %d, all HW are busy\n",
++ __func__, __LINE__);
++ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
++ return;
++ }
++
++ goto retry_select;
++ }
++
++ atomic_dec(&jpeg->hw_rdy);
++ src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
++ if (!src_buf)
++ goto getbuf_fail;
++
++ dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
++ if (!dst_buf)
++ goto getbuf_fail;
++
++ v4l2_m2m_buf_copy_metadata(src_buf, dst_buf, true);
++
++ mtk_jpegenc_set_hw_param(ctx, hw_id, src_buf, dst_buf);
++ ret = pm_runtime_get_sync(comp_jpeg[hw_id]->dev);
++ if (ret < 0) {
++ dev_err(jpeg->dev, "%s : %d, pm_runtime_get_sync fail !!!\n",
++ __func__, __LINE__);
++ goto enc_end;
++ }
++
++ ret = clk_prepare_enable(comp_jpeg[hw_id]->venc_clk.clks->clk);
++ if (ret) {
++ dev_err(jpeg->dev, "%s : %d, jpegenc clk_prepare_enable fail\n",
++ __func__, __LINE__);
++ goto enc_end;
++ }
++
++ v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++ v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++
++ schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work,
++ msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));
++
++ spin_lock_irqsave(&comp_jpeg[hw_id]->hw_lock, flags);
++ jpeg_dst_buf = mtk_jpeg_vb2_to_srcbuf(&dst_buf->vb2_buf);
++ jpeg_dst_buf->curr_ctx = ctx;
++ jpeg_dst_buf->frame_num = ctx->total_frame_num;
++ ctx->total_frame_num++;
++ mtk_jpeg_enc_reset(comp_jpeg[hw_id]->reg_base);
++ mtk_jpeg_set_enc_dst(ctx,
++ comp_jpeg[hw_id]->reg_base,
++ &dst_buf->vb2_buf);
++ mtk_jpeg_set_enc_src(ctx,
++ comp_jpeg[hw_id]->reg_base,
++ &src_buf->vb2_buf);
++ mtk_jpeg_set_enc_params(ctx, comp_jpeg[hw_id]->reg_base);
++ mtk_jpeg_enc_start(comp_jpeg[hw_id]->reg_base);
++ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
++ spin_unlock_irqrestore(&comp_jpeg[hw_id]->hw_lock, flags);
++
++ return;
++
++enc_end:
++ v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++ v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++ v4l2_m2m_buf_done(src_buf, buf_state);
++ v4l2_m2m_buf_done(dst_buf, buf_state);
++getbuf_fail:
++ atomic_inc(&jpeg->hw_rdy);
++ mtk_jpegenc_put_hw(jpeg, hw_id);
++ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
++}
++
++static void mtk_jpegdec_worker(struct work_struct *work)
++{
++ struct mtk_jpeg_ctx *ctx = container_of(work, struct mtk_jpeg_ctx,
++ jpeg_work);
++ struct mtk_jpegdec_comp_dev *comp_jpeg[MTK_JPEGDEC_HW_MAX];
++ enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
++ struct mtk_jpeg_src_buf *jpeg_src_buf, *jpeg_dst_buf;
++ struct vb2_v4l2_buffer *src_buf, *dst_buf;
++ struct mtk_jpeg_dev *jpeg = ctx->jpeg;
++ int ret, i, hw_id = 0;
++ struct mtk_jpeg_bs bs;
++ struct mtk_jpeg_fb fb;
++ unsigned long flags;
++
++ for (i = 0; i < MTK_JPEGDEC_HW_MAX; i++)
++ comp_jpeg[i] = jpeg->dec_hw_dev[i];
++ i = 0;
++
++retry_select:
++ hw_id = mtk_jpegdec_get_hw(ctx);
++ if (hw_id < 0) {
++ ret = wait_event_interruptible_timeout(jpeg->hw_wq,
++ atomic_read(&jpeg->hw_rdy) > 0,
++ MTK_JPEG_HW_TIMEOUT_MSEC);
++ if (ret != 0 || (i++ > MTK_JPEG_MAX_RETRY_TIME)) {
++ dev_err(jpeg->dev, "%s : %d, all HW are busy\n",
++ __func__, __LINE__);
++ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
++ return;
++ }
++
++ goto retry_select;
++ }
++
++ atomic_dec(&jpeg->hw_rdy);
++ src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
++ if (!src_buf)
++ goto getbuf_fail;
++
++ dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
++ if (!dst_buf)
++ goto getbuf_fail;
++
++ v4l2_m2m_buf_copy_metadata(src_buf, dst_buf, true);
++ jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf);
++ jpeg_dst_buf = mtk_jpeg_vb2_to_srcbuf(&dst_buf->vb2_buf);
++
++ if (mtk_jpeg_check_resolution_change(ctx,
++ &jpeg_src_buf->dec_param)) {
++ mtk_jpeg_queue_src_chg_event(ctx);
++ ctx->state = MTK_JPEG_SOURCE_CHANGE;
++ goto getbuf_fail;
++ }
++
++ jpeg_src_buf->curr_ctx = ctx;
++ jpeg_src_buf->frame_num = ctx->total_frame_num;
++ jpeg_dst_buf->curr_ctx = ctx;
++ jpeg_dst_buf->frame_num = ctx->total_frame_num;
++
++ mtk_jpegdec_set_hw_param(ctx, hw_id, src_buf, dst_buf);
++ ret = pm_runtime_get_sync(comp_jpeg[hw_id]->dev);
++ if (ret < 0) {
++ dev_err(jpeg->dev, "%s : %d, pm_runtime_get_sync fail !!!\n",
++ __func__, __LINE__);
++ goto dec_end;
++ }
++
++ ret = clk_prepare_enable(comp_jpeg[hw_id]->jdec_clk.clks->clk);
++ if (ret) {
++ dev_err(jpeg->dev, "%s : %d, jpegdec clk_prepare_enable fail\n",
++ __func__, __LINE__);
++ goto clk_end;
++ }
++
++ v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++ v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++
++ schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work,
++ msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));
++
++ mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs);
++ if (mtk_jpeg_set_dec_dst(ctx,
++ &jpeg_src_buf->dec_param,
++ &dst_buf->vb2_buf, &fb)) {
++ dev_err(jpeg->dev, "%s : %d, mtk_jpeg_set_dec_dst fail\n",
++ __func__, __LINE__);
++ goto setdst_end;
++ }
++
++ spin_lock_irqsave(&comp_jpeg[hw_id]->hw_lock, flags);
++ ctx->total_frame_num++;
++ mtk_jpeg_dec_reset(comp_jpeg[hw_id]->reg_base);
++ mtk_jpeg_dec_set_config(comp_jpeg[hw_id]->reg_base,
++ &jpeg_src_buf->dec_param,
++ jpeg_src_buf->bs_size,
++ &bs,
++ &fb);
++ mtk_jpeg_dec_start(comp_jpeg[hw_id]->reg_base);
++ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
++ spin_unlock_irqrestore(&comp_jpeg[hw_id]->hw_lock, flags);
++
++ return;
++
++setdst_end:
++ clk_disable_unprepare(comp_jpeg[hw_id]->jdec_clk.clks->clk);
++clk_end:
++ pm_runtime_put(comp_jpeg[hw_id]->dev);
++dec_end:
++ v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++ v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++ v4l2_m2m_buf_done(src_buf, buf_state);
++ v4l2_m2m_buf_done(dst_buf, buf_state);
++getbuf_fail:
++ atomic_inc(&jpeg->hw_rdy);
++ mtk_jpegdec_put_hw(jpeg, hw_id);
++ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
++}
++
++static irqreturn_t mtk_jpeg_enc_irq(int irq, void *priv)
++{
++ struct mtk_jpeg_dev *jpeg = priv;
++ u32 irq_status;
++ irqreturn_t ret = IRQ_NONE;
++
++ cancel_delayed_work(&jpeg->job_timeout_work);
++
++ irq_status = readl(jpeg->reg_base + JPEG_ENC_INT_STS) &
++ JPEG_ENC_INT_STATUS_MASK_ALLIRQ;
++ if (irq_status)
++ writel(0, jpeg->reg_base + JPEG_ENC_INT_STS);
++
++ if (!(irq_status & JPEG_ENC_INT_STATUS_DONE))
++ return ret;
++
++ ret = mtk_jpeg_enc_done(jpeg);
++ return ret;
++}
++
++static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv)
++{
++ struct mtk_jpeg_dev *jpeg = priv;
++ struct mtk_jpeg_ctx *ctx;
++ struct vb2_v4l2_buffer *src_buf, *dst_buf;
++ struct mtk_jpeg_src_buf *jpeg_src_buf;
++ enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
++ u32 dec_irq_ret;
++ u32 dec_ret;
++ int i;
++
++ cancel_delayed_work(&jpeg->job_timeout_work);
++
++ dec_ret = mtk_jpeg_dec_get_int_status(jpeg->reg_base);
++ dec_irq_ret = mtk_jpeg_dec_enum_result(dec_ret);
++ ctx = v4l2_m2m_get_curr_priv(jpeg->m2m_dev);
++ if (!ctx) {
++ v4l2_err(&jpeg->v4l2_dev, "Context is NULL\n");
++ return IRQ_HANDLED;
++ }
++
++ src_buf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
++ dst_buf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
++ jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf);
++
++ if (dec_irq_ret >= MTK_JPEG_DEC_RESULT_UNDERFLOW)
++ mtk_jpeg_dec_reset(jpeg->reg_base);
++
++ if (dec_irq_ret != MTK_JPEG_DEC_RESULT_EOF_DONE) {
++ dev_err(jpeg->dev, "decode failed\n");
++ goto dec_end;
++ }
++
++ for (i = 0; i < dst_buf->vb2_buf.num_planes; i++)
++ vb2_set_plane_payload(&dst_buf->vb2_buf, i,
++ jpeg_src_buf->dec_param.comp_size[i]);
++
++ buf_state = VB2_BUF_STATE_DONE;
++
++dec_end:
++ v4l2_m2m_buf_done(src_buf, buf_state);
++ v4l2_m2m_buf_done(dst_buf, buf_state);
++ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
++ pm_runtime_put(ctx->jpeg->dev);
++ return IRQ_HANDLED;
++}
++
++static struct clk_bulk_data mtk_jpeg_clocks[] = {
++ { .id = "jpgenc" },
++};
++
++static struct clk_bulk_data mt8173_jpeg_dec_clocks[] = {
++ { .id = "jpgdec-smi" },
++ { .id = "jpgdec" },
++};
++
+ static const struct mtk_jpeg_variant mt8173_jpeg_drvdata = {
+ .clks = mt8173_jpeg_dec_clocks,
+ .num_clks = ARRAY_SIZE(mt8173_jpeg_dec_clocks),
+--
+2.39.2
+
--- /dev/null
+From 3c5beda92faac393882604f02ff2861974130c4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 23:37:22 +0200
+Subject: media: mtk_jpeg_core: avoid unused-variable warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 20de9fdaf4883deffb0138eef28e9cbbead32cfd ]
+
+The mtk8195_jpegenc_drvdata object was added outside of an #ifdef causing
+a harmless build warning.
+
+drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1879:32: error: 'mtk8195_jpegenc_drvdata' defined but not used [-Werror=unused-variable]
+ 1879 | static struct mtk_jpeg_variant mtk8195_jpegenc_drvdata = {
+ | ^~~~~~~~~~~~~~~~~~~~~~~
+
+A follow-up patch moved it inside of an #ifdef, which caused more
+warnings, and a third patch ended up adding even more #ifdefs. These
+were all bogus, since the actual problem here is the incorrect use
+of of_ptr(). Since the driver (like any other modern platform driver)
+only works in combination with CONFIG_OF, there is no point in hiding
+the reference, so just remove that along with all the pointless #ifdef
+checks in the driver.
+
+This improves build coverage and avoids running into the same problem
+again when another part of the driver gets changed that relies on
+the #ifdef blocks to be completely matched.
+
+Fixes: 934e8bccac95 ("mtk-jpegenc: support jpegenc multi-hardware")
+Fixes: 4ae47770d57b ("media: mtk-jpegenc: Fix a compilation issue")
+Fixes: da4ede4b7fd6 ("media: mtk-jpeg: move data/code inside CONFIG_OF blocks")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 6 +-----
+ drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c | 4 +---
+ drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c | 4 +---
+ 3 files changed, 3 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+index 4768156181c99..40cb3cb87ba17 100644
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+@@ -28,7 +28,6 @@
+ #include "mtk_jpeg_core.h"
+ #include "mtk_jpeg_dec_parse.h"
+
+-#if defined(CONFIG_OF)
+ static struct mtk_jpeg_fmt mtk_jpeg_enc_formats[] = {
+ {
+ .fourcc = V4L2_PIX_FMT_JPEG,
+@@ -102,7 +101,6 @@ static struct mtk_jpeg_fmt mtk_jpeg_dec_formats[] = {
+ .flags = MTK_JPEG_FMT_FLAG_CAPTURE,
+ },
+ };
+-#endif
+
+ #define MTK_JPEG_ENC_NUM_FORMATS ARRAY_SIZE(mtk_jpeg_enc_formats)
+ #define MTK_JPEG_DEC_NUM_FORMATS ARRAY_SIZE(mtk_jpeg_dec_formats)
+@@ -1455,7 +1453,6 @@ static const struct dev_pm_ops mtk_jpeg_pm_ops = {
+ SET_RUNTIME_PM_OPS(mtk_jpeg_pm_suspend, mtk_jpeg_pm_resume, NULL)
+ };
+
+-#if defined(CONFIG_OF)
+ static int mtk_jpegenc_get_hw(struct mtk_jpeg_ctx *ctx)
+ {
+ struct mtk_jpegenc_comp_dev *comp_jpeg;
+@@ -1951,14 +1948,13 @@ static const struct of_device_id mtk_jpeg_match[] = {
+ };
+
+ MODULE_DEVICE_TABLE(of, mtk_jpeg_match);
+-#endif
+
+ static struct platform_driver mtk_jpeg_driver = {
+ .probe = mtk_jpeg_probe,
+ .remove_new = mtk_jpeg_remove,
+ .driver = {
+ .name = MTK_JPEG_NAME,
+- .of_match_table = of_match_ptr(mtk_jpeg_match),
++ .of_match_table = mtk_jpeg_match,
+ .pm = &mtk_jpeg_pm_ops,
+ },
+ };
+diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c
+index 869068fac5e2f..baa7be58ce691 100644
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c
+@@ -39,7 +39,6 @@ enum mtk_jpeg_color {
+ MTK_JPEG_COLOR_400 = 0x00110000
+ };
+
+-#if defined(CONFIG_OF)
+ static const struct of_device_id mtk_jpegdec_hw_ids[] = {
+ {
+ .compatible = "mediatek,mt8195-jpgdec-hw",
+@@ -47,7 +46,6 @@ static const struct of_device_id mtk_jpegdec_hw_ids[] = {
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, mtk_jpegdec_hw_ids);
+-#endif
+
+ static inline int mtk_jpeg_verify_align(u32 val, int align, u32 reg)
+ {
+@@ -653,7 +651,7 @@ static struct platform_driver mtk_jpegdec_hw_driver = {
+ .probe = mtk_jpegdec_hw_probe,
+ .driver = {
+ .name = "mtk-jpegdec-hw",
+- .of_match_table = of_match_ptr(mtk_jpegdec_hw_ids),
++ .of_match_table = mtk_jpegdec_hw_ids,
+ },
+ };
+
+diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c
+index 71e85b4bbf127..244018365b6f1 100644
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_enc_hw.c
+@@ -46,7 +46,6 @@ static const struct mtk_jpeg_enc_qlt mtk_jpeg_enc_quality[] = {
+ {.quality_param = 97, .hardware_value = JPEG_ENC_QUALITY_Q97},
+ };
+
+-#if defined(CONFIG_OF)
+ static const struct of_device_id mtk_jpegenc_drv_ids[] = {
+ {
+ .compatible = "mediatek,mt8195-jpgenc-hw",
+@@ -54,7 +53,6 @@ static const struct of_device_id mtk_jpegenc_drv_ids[] = {
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, mtk_jpegenc_drv_ids);
+-#endif
+
+ void mtk_jpeg_enc_reset(void __iomem *base)
+ {
+@@ -377,7 +375,7 @@ static struct platform_driver mtk_jpegenc_hw_driver = {
+ .probe = mtk_jpegenc_hw_probe,
+ .driver = {
+ .name = "mtk-jpegenc-hw",
+- .of_match_table = of_match_ptr(mtk_jpegenc_drv_ids),
++ .of_match_table = mtk_jpegenc_drv_ids,
+ },
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 5ab3917ee3f25ee9fcea7391e8cf93f1a5434c8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jun 2023 18:47:53 +0200
+Subject: media: staging: atomisp: select V4L2_FWNODE
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit bf4c985707d3168ebb7d87d15830de66949d979c ]
+
+Select V4L2_FWNODE as the driver depends on it.
+
+Reported-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Fixes: aa31f6514047 ("media: atomisp: allow building the driver again")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Tested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/media/atomisp/Kconfig b/drivers/staging/media/atomisp/Kconfig
+index c9bff98e5309a..e9b168ba97bf1 100644
+--- a/drivers/staging/media/atomisp/Kconfig
++++ b/drivers/staging/media/atomisp/Kconfig
+@@ -13,6 +13,7 @@ config VIDEO_ATOMISP
+ tristate "Intel Atom Image Signal Processor Driver"
+ depends on VIDEO_DEV && INTEL_ATOMISP
+ depends on PMIC_OPREGION
++ select V4L2_FWNODE
+ select IOSF_MBI
+ select VIDEOBUF2_VMALLOC
+ select VIDEO_V4L2_SUBDEV_API
+--
+2.39.2
+
--- /dev/null
+From 32e0c33cbdb4fc4a29d57f629aa892b5e159f502 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 12:16:39 +0200
+Subject: media: tc358746: Address compiler warnings
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 9c2dcfc2cf0f2e4e0a0db33bc1a626e35928c475 ]
+
+Address these compiler warnings by initialising the m_best and p_best
+values to 0 and 1 respectively (as latter is used as a divisor):
+
+ drivers/media/i2c/tc358746.c: In function 'tc358746_find_pll_settings':
+>> drivers/media/i2c/tc358746.c:817:13: warning: 'p_best' is used uninitialized
+[-Wuninitialized]
+ 817 | u16 p_best, p;
+ | ^~~~~~
+>> drivers/media/i2c/tc358746.c:816:13: warning: 'm_best' is used uninitialized
+[-Wuninitialized]
+ 816 | u16 m_best, mul;
+ | ^~~~~~
+
+The warnings may well be a false positive but it is difficult for a
+compiler to find out whether that truly is the case.
+
+Closes: https://lore.kernel.org/oe-kbuild-all/202305301627.fLT3Bkds-lkp@intel.com/
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: 80a21da3605 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tc358746.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/tc358746.c b/drivers/media/i2c/tc358746.c
+index ec1a193ba161a..25fbce5cabdaa 100644
+--- a/drivers/media/i2c/tc358746.c
++++ b/drivers/media/i2c/tc358746.c
+@@ -813,8 +813,8 @@ static unsigned long tc358746_find_pll_settings(struct tc358746 *tc358746,
+ u32 min_delta = 0xffffffff;
+ u16 prediv_max = 17;
+ u16 prediv_min = 1;
+- u16 m_best, mul;
+- u16 p_best, p;
++ u16 m_best = 0, mul;
++ u16 p_best = 1, p;
+ u8 postdiv;
+
+ if (fout > 1000 * HZ_PER_MHZ) {
+--
+2.39.2
+
--- /dev/null
+From fab3d30338a59ea047eab0c85c821fb2df93fbf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jul 2023 09:38:32 -0700
+Subject: mm: suppress mm fault logging if fatal signal already pending
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 5f0bc0b042fc77ff70e14c790abdec960cde4ec1 ]
+
+Commit eda0047296a1 ("mm: make the page fault mmap locking killable")
+intentionally made it much easier to trigger the "page fault fails
+because a fatal signal is pending" situation, by having the mmap locking
+fail early in that case.
+
+We have long aborted page faults in other fatal cases when the actual IO
+for a page is interrupted by SIGKILL - which is particularly useful for
+the traditional case of NFS hanging due to network issues, but local
+filesystems could cause it too if you happened to get the SIGKILL while
+waiting for a page to be faulted in (eg lock_folio_maybe_drop_mmap()).
+
+So aborting the page fault wasn't a new condition - but it now triggers
+earlier, before we even get to 'handle_mm_fault()'. And as a result the
+error doesn't go through our 'fault_signal_pending()' logic, and doesn't
+get filtered away there.
+
+Normally you'd never even notice, because if a fatal signal is pending,
+the new SIGSEGV we send ends up being ignored anyway.
+
+But it turns out that there is one very noticeable exception: if you
+enable 'show_unhandled_signals', the aborted page fault will be logged
+in the kernel messages, and you'll get a scary line looking something
+like this in your logs:
+
+ pverados[2183248]: segfault at 55e5a00f9ae0 ip 000055e5a00f9ae0 sp 00007ffc0720bea8 error 14 in perl[55e5a00d4000+195000] likely on CPU 10 (core 4, socket 0)
+
+which is rather misleading. It's not really a segfault at all, it's
+just "the thread was killed before the page fault completed, so we
+aborted the page fault".
+
+Fix this by just making it clear that a pending fatal signal means that
+any new signal coming in after that is implicitly handled. This will
+avoid the misleading logging, since now the signal isn't 'unhandled' any
+more.
+
+Reported-and-tested-by: Fiona Ebner <f.ebner@proxmox.com>
+Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+Link: https://lore.kernel.org/lkml/8d063a26-43f5-0bb7-3203-c6a04dc159f8@proxmox.com/
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Fixes: eda0047296a1 ("mm: make the page fault mmap locking killable")
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/signal.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 2547fa73bde51..1b39cba7dfd38 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -561,6 +561,10 @@ bool unhandled_signal(struct task_struct *tsk, int sig)
+ if (handler != SIG_IGN && handler != SIG_DFL)
+ return false;
+
++ /* If dying, we handle all new signals by ignoring them */
++ if (fatal_signal_pending(tsk))
++ return false;
++
+ /* if ptraced, let the tracer determine */
+ return !tsk->ptrace;
+ }
+--
+2.39.2
+
--- /dev/null
+From c9296157252c237133e5f9b53c0888ccbdc21954 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 16:35:59 +0800
+Subject: net: fec: avoid tx queue timeout when XDP is enabled
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit bb7a0156365dffe2fcd63e2051145fbe4f8908b4 ]
+
+According to the implementation of XDP of FEC driver, the XDP path
+shares the transmit queues with the kernel network stack, so it is
+possible to lead to a tx timeout event when XDP uses the tx queue
+pretty much exclusively. And this event will cause the reset of the
+FEC hardware.
+To avoid timeout in this case, we use the txq_trans_cond_update()
+interface to update txq->trans_start to jiffies so that watchdog
+won't generate a transmit timeout warning.
+
+Fixes: 6d6b39f180b8 ("net: fec: add initial XDP support")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Link: https://lore.kernel.org/r/20230721083559.2857312-1-wei.fang@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 7659888a96917..a1b0abe54a0e5 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3908,6 +3908,8 @@ static int fec_enet_xdp_xmit(struct net_device *dev,
+
+ __netif_tx_lock(nq, cpu);
+
++ /* Avoid tx timeout as XDP shares the queue with kernel stack */
++ txq_trans_cond_update(nq);
+ for (i = 0; i < num_frames; i++) {
+ if (fec_enet_txq_xmit_frame(fep, txq, frames[i]) != 0)
+ break;
+--
+2.39.2
+
--- /dev/null
+From 1e530148781472c023640c3146bd91e898ad7303 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jul 2023 15:41:48 +0800
+Subject: net: fec: tx processing does not call XDP APIs if budget is 0
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit 15cec633fc7bfe4cd69aa012c3b35b31acfc86f2 ]
+
+According to the clarification [1] in the latest napi.rst, the tx
+processing cannot call any XDP (or page pool) APIs if the "budget"
+is 0. Because NAPI is called with the budget of 0 (such as netpoll)
+indicates we may be in an IRQ context, however, we cannot use the
+page pool from IRQ context.
+
+[1] https://lore.kernel.org/all/20230720161323.2025379-1-kuba@kernel.org/
+
+Fixes: 20f797399035 ("net: fec: recycle pages for transmitted XDP frames")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Link: https://lore.kernel.org/r/20230725074148.2936402-1-wei.fang@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index a1b0abe54a0e5..92410f30ad241 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -1372,7 +1372,7 @@ fec_enet_hwtstamp(struct fec_enet_private *fep, unsigned ts,
+ }
+
+ static void
+-fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
++fec_enet_tx_queue(struct net_device *ndev, u16 queue_id, int budget)
+ {
+ struct fec_enet_private *fep;
+ struct xdp_frame *xdpf;
+@@ -1416,6 +1416,14 @@ fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
+ if (!skb)
+ goto tx_buf_done;
+ } else {
++ /* Tx processing cannot call any XDP (or page pool) APIs if
++ * the "budget" is 0. Because NAPI is called with budget of
++ * 0 (such as netpoll) indicates we may be in an IRQ context,
++ * however, we can't use the page pool from IRQ context.
++ */
++ if (unlikely(!budget))
++ break;
++
+ xdpf = txq->tx_buf[index].xdp;
+ if (bdp->cbd_bufaddr)
+ dma_unmap_single(&fep->pdev->dev,
+@@ -1508,14 +1516,14 @@ fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
+ writel(0, txq->bd.reg_desc_active);
+ }
+
+-static void fec_enet_tx(struct net_device *ndev)
++static void fec_enet_tx(struct net_device *ndev, int budget)
+ {
+ struct fec_enet_private *fep = netdev_priv(ndev);
+ int i;
+
+ /* Make sure that AVB queues are processed first. */
+ for (i = fep->num_tx_queues - 1; i >= 0; i--)
+- fec_enet_tx_queue(ndev, i);
++ fec_enet_tx_queue(ndev, i, budget);
+ }
+
+ static void fec_enet_update_cbd(struct fec_enet_priv_rx_q *rxq,
+@@ -1858,7 +1866,7 @@ static int fec_enet_rx_napi(struct napi_struct *napi, int budget)
+
+ do {
+ done += fec_enet_rx(ndev, budget - done);
+- fec_enet_tx(ndev);
++ fec_enet_tx(ndev, budget);
+ } while ((done < budget) && fec_enet_collect_events(fep));
+
+ if (done < budget) {
+--
+2.39.2
+
--- /dev/null
+From c5c7501f19edbea85f1ba6da7f832b5868fa2417 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jul 2023 10:05:07 +0800
+Subject: net: hns3: fix the imp capability bit cannot exceed 32 bits issue
+
+From: Hao Lan <lanhao@huawei.com>
+
+[ Upstream commit b27d0232e8897f7c896dc8ad80c9907dd57fd3f3 ]
+
+Current only the first 32 bits of the capability flag bit are considered.
+When the matching capability flag bit is greater than 31 bits,
+it will get an error bit.This patch use bitmap to solve this issue.
+It can handle each capability bit whitout bit width limit.
+
+Fixes: da77aef9cc58 ("net: hns3: create common cmdq resource allocate/free/query APIs")
+Signed-off-by: Hao Lan <lanhao@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hnae3.h | 3 ++-
+ .../hns3/hns3_common/hclge_comm_cmd.c | 21 ++++++++++++++++---
+ 2 files changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index 9c9c72dc57e00..06f29e80104c0 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -31,6 +31,7 @@
+ #include <linux/pci.h>
+ #include <linux/pkt_sched.h>
+ #include <linux/types.h>
++#include <linux/bitmap.h>
+ #include <net/pkt_cls.h>
+ #include <net/pkt_sched.h>
+
+@@ -407,7 +408,7 @@ struct hnae3_ae_dev {
+ unsigned long hw_err_reset_req;
+ struct hnae3_dev_specs dev_specs;
+ u32 dev_version;
+- unsigned long caps[BITS_TO_LONGS(HNAE3_DEV_CAPS_MAX_NUM)];
++ DECLARE_BITMAP(caps, HNAE3_DEV_CAPS_MAX_NUM);
+ void *priv;
+ };
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c
+index b85c412683ddc..16ba98ff2c9b1 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c
+@@ -171,6 +171,20 @@ static const struct hclge_comm_caps_bit_map hclge_vf_cmd_caps[] = {
+ {HCLGE_COMM_CAP_GRO_B, HNAE3_DEV_SUPPORT_GRO_B},
+ };
+
++static void
++hclge_comm_capability_to_bitmap(unsigned long *bitmap, __le32 *caps)
++{
++ const unsigned int words = HCLGE_COMM_QUERY_CAP_LENGTH;
++ u32 val[HCLGE_COMM_QUERY_CAP_LENGTH];
++ unsigned int i;
++
++ for (i = 0; i < words; i++)
++ val[i] = __le32_to_cpu(caps[i]);
++
++ bitmap_from_arr32(bitmap, val,
++ HCLGE_COMM_QUERY_CAP_LENGTH * BITS_PER_TYPE(u32));
++}
++
+ static void
+ hclge_comm_parse_capability(struct hnae3_ae_dev *ae_dev, bool is_pf,
+ struct hclge_comm_query_version_cmd *cmd)
+@@ -179,11 +193,12 @@ hclge_comm_parse_capability(struct hnae3_ae_dev *ae_dev, bool is_pf,
+ is_pf ? hclge_pf_cmd_caps : hclge_vf_cmd_caps;
+ u32 size = is_pf ? ARRAY_SIZE(hclge_pf_cmd_caps) :
+ ARRAY_SIZE(hclge_vf_cmd_caps);
+- u32 caps, i;
++ DECLARE_BITMAP(caps, HCLGE_COMM_QUERY_CAP_LENGTH * BITS_PER_TYPE(u32));
++ u32 i;
+
+- caps = __le32_to_cpu(cmd->caps[0]);
++ hclge_comm_capability_to_bitmap(caps, cmd->caps);
+ for (i = 0; i < size; i++)
+- if (hnae3_get_bit(caps, caps_map[i].imp_bit))
++ if (test_bit(caps_map[i].imp_bit, caps))
+ set_bit(caps_map[i].local_bit, ae_dev->caps);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From d6219003d01e2167109d36560963b514a16d1fd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jul 2023 10:05:10 +0800
+Subject: net: hns3: fix wrong bw weight of disabled tc issue
+
+From: Jijie Shao <shaojijie@huawei.com>
+
+[ Upstream commit 882481b1c55fc44861d7e2d54b4e0936b1b39f2c ]
+
+In dwrr mode, the default bandwidth weight of disabled tc is set to 0.
+If the bandwidth weight is 0, the mode will change to sp.
+Therefore, disabled tc default bandwidth weight need changed to 1,
+and 0 is returned when query the bandwidth weight of disabled tc.
+In addition, driver need stop configure bandwidth weight if tc is disabled.
+
+Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver")
+Signed-off-by: Jie Wang <wangjie125@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 17 ++++++++++++++---
+ .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 3 ++-
+ 2 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+index c4aded65e848b..09362823140d5 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+@@ -52,7 +52,10 @@ static void hclge_tm_info_to_ieee_ets(struct hclge_dev *hdev,
+
+ for (i = 0; i < HNAE3_MAX_TC; i++) {
+ ets->prio_tc[i] = hdev->tm_info.prio_tc[i];
+- ets->tc_tx_bw[i] = hdev->tm_info.pg_info[0].tc_dwrr[i];
++ if (i < hdev->tm_info.num_tc)
++ ets->tc_tx_bw[i] = hdev->tm_info.pg_info[0].tc_dwrr[i];
++ else
++ ets->tc_tx_bw[i] = 0;
+
+ if (hdev->tm_info.tc_info[i].tc_sch_mode ==
+ HCLGE_SCH_MODE_SP)
+@@ -123,7 +126,8 @@ static u8 hclge_ets_tc_changed(struct hclge_dev *hdev, struct ieee_ets *ets,
+ }
+
+ static int hclge_ets_sch_mode_validate(struct hclge_dev *hdev,
+- struct ieee_ets *ets, bool *changed)
++ struct ieee_ets *ets, bool *changed,
++ u8 tc_num)
+ {
+ bool has_ets_tc = false;
+ u32 total_ets_bw = 0;
+@@ -137,6 +141,13 @@ static int hclge_ets_sch_mode_validate(struct hclge_dev *hdev,
+ *changed = true;
+ break;
+ case IEEE_8021QAZ_TSA_ETS:
++ if (i >= tc_num) {
++ dev_err(&hdev->pdev->dev,
++ "tc%u is disabled, cannot set ets bw\n",
++ i);
++ return -EINVAL;
++ }
++
+ /* The hardware will switch to sp mode if bandwidth is
+ * 0, so limit ets bandwidth must be greater than 0.
+ */
+@@ -176,7 +187,7 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,
+ if (ret)
+ return ret;
+
+- ret = hclge_ets_sch_mode_validate(hdev, ets, changed);
++ ret = hclge_ets_sch_mode_validate(hdev, ets, changed, tc_num);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index 922c0da3660c7..150f146fa24fb 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -785,6 +785,7 @@ static void hclge_tm_tc_info_init(struct hclge_dev *hdev)
+ static void hclge_tm_pg_info_init(struct hclge_dev *hdev)
+ {
+ #define BW_PERCENT 100
++#define DEFAULT_BW_WEIGHT 1
+
+ u8 i;
+
+@@ -806,7 +807,7 @@ static void hclge_tm_pg_info_init(struct hclge_dev *hdev)
+ for (k = 0; k < hdev->tm_info.num_tc; k++)
+ hdev->tm_info.pg_info[i].tc_dwrr[k] = BW_PERCENT;
+ for (; k < HNAE3_MAX_TC; k++)
+- hdev->tm_info.pg_info[i].tc_dwrr[k] = 0;
++ hdev->tm_info.pg_info[i].tc_dwrr[k] = DEFAULT_BW_WEIGHT;
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 10b8f4d4918fcc154952f191c84c8bc45ee81437 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jul 2023 10:05:09 +0800
+Subject: net: hns3: fix wrong tc bandwidth weight data issue
+
+From: Jijie Shao <shaojijie@huawei.com>
+
+[ Upstream commit 116d9f732eef634abbd871f2c6f613a5b4677742 ]
+
+Currently, the weight saved by the driver is used as the query result,
+which may be different from the actual weight in the register.
+Therefore, the register value read from the firmware is used
+as the query result
+
+Fixes: 0e32038dc856 ("net: hns3: refactor dump tc of debugfs")
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c
+index 233c132dc513e..409db2e709651 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c
+@@ -693,8 +693,7 @@ static int hclge_dbg_dump_tc(struct hclge_dev *hdev, char *buf, int len)
+ for (i = 0; i < HNAE3_MAX_TC; i++) {
+ sch_mode_str = ets_weight->tc_weight[i] ? "dwrr" : "sp";
+ pos += scnprintf(buf + pos, len - pos, "%u %4s %3u\n",
+- i, sch_mode_str,
+- hdev->tm_info.pg_info[0].tc_dwrr[i]);
++ i, sch_mode_str, ets_weight->tc_weight[i]);
+ }
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From b9d6553b64c0b3765e8bb082b10fd93fa36f71f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jul 2023 17:22:33 +0800
+Subject: net: phy: marvell10g: fix 88x3310 power up
+
+From: Jiawen Wu <jiawenwu@trustnetic.com>
+
+[ Upstream commit c7b75bea853daeb64fc831dbf39a6bbabcc402ac ]
+
+Clear MV_V2_PORT_CTRL_PWRDOWN bit to set power up for 88x3310 PHY,
+it sometimes does not take effect immediately. And a read of this
+register causes the bit not to clear. This will cause mv3310_reset()
+to time out, which will fail the config initialization. So add a delay
+before the next access.
+
+Fixes: c9cc1c815d36 ("net: phy: marvell10g: place in powersave mode at probe")
+Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/marvell10g.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/phy/marvell10g.c b/drivers/net/phy/marvell10g.c
+index 55d9d7acc32eb..d4bb90d768811 100644
+--- a/drivers/net/phy/marvell10g.c
++++ b/drivers/net/phy/marvell10g.c
+@@ -328,6 +328,13 @@ static int mv3310_power_up(struct phy_device *phydev)
+ ret = phy_clear_bits_mmd(phydev, MDIO_MMD_VEND2, MV_V2_PORT_CTRL,
+ MV_V2_PORT_CTRL_PWRDOWN);
+
++ /* Sometimes, the power down bit doesn't clear immediately, and
++ * a read of this register causes the bit not to clear. Delay
++ * 100us to allow the PHY to come out of power down mode before
++ * the next access.
++ */
++ udelay(100);
++
+ if (phydev->drv->phy_id != MARVELL_PHY_ID_88X3310 ||
+ priv->firmware_ver < 0x00030000)
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From 93de6502f4621097bd29a03cdb813cfc0bb84573 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jul 2023 10:42:27 +0800
+Subject: net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit 6c58c8816abb7b93b21fa3b1d0c1726402e5e568 ]
+
+The nla_for_each_nested parsing in function mqprio_parse_nlattr() does
+not check the length of the nested attribute. This can lead to an
+out-of-attribute read and allow a malformed nlattr (e.g., length 0) to
+be viewed as 8 byte integer and passed to priv->max_rate/min_rate.
+
+This patch adds the check based on nla_len() when check the nla_type(),
+which ensures that the length of these two attribute must equals
+sizeof(u64).
+
+Fixes: 4e8b86c06269 ("mqprio: Introduce new hardware offload mode and shaper in mqprio")
+Reviewed-by: Victor Nogueira <victor@mojatatu.com>
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Link: https://lore.kernel.org/r/20230725024227.426561-1-linma@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_mqprio.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
+index ab69ff7577fc7..793009f445c03 100644
+--- a/net/sched/sch_mqprio.c
++++ b/net/sched/sch_mqprio.c
+@@ -290,6 +290,13 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt,
+ "Attribute type expected to be TCA_MQPRIO_MIN_RATE64");
+ return -EINVAL;
+ }
++
++ if (nla_len(attr) != sizeof(u64)) {
++ NL_SET_ERR_MSG_ATTR(extack, attr,
++ "Attribute TCA_MQPRIO_MIN_RATE64 expected to have 8 bytes length");
++ return -EINVAL;
++ }
++
+ if (i >= qopt->num_tc)
+ break;
+ priv->min_rate[i] = nla_get_u64(attr);
+@@ -312,6 +319,13 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt,
+ "Attribute type expected to be TCA_MQPRIO_MAX_RATE64");
+ return -EINVAL;
+ }
++
++ if (nla_len(attr) != sizeof(u64)) {
++ NL_SET_ERR_MSG_ATTR(extack, attr,
++ "Attribute TCA_MQPRIO_MAX_RATE64 expected to have 8 bytes length");
++ return -EINVAL;
++ }
++
+ if (i >= qopt->num_tc)
+ break;
+ priv->max_rate[i] = nla_get_u64(attr);
+--
+2.39.2
+
--- /dev/null
+From aa786dcc7951728865bf387d921e8f3a70035154 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 15:39:20 +0200
+Subject: net: stmmac: Apply redundant write work around on 4.xx too
+
+From: Vincent Whitchurch <vincent.whitchurch@axis.com>
+
+[ Upstream commit 284779dbf4e98753458708783af8c35630674a21 ]
+
+commit a3a57bf07de23fe1ff779e0fdf710aa581c3ff73 ("net: stmmac: work
+around sporadic tx issue on link-up") worked around a problem with TX
+sometimes not working after a link-up by avoiding a redundant write to
+MAC_CTRL_REG (aka GMAC_CONFIG), since the IP appeared to have problems
+with handling multiple writes to that register in some cases.
+
+That commit however only added the work around to dwmac_lib.c (apart
+from the common code in stmmac_main.c), but my systems with version
+4.21a of the IP exhibit the same problem, so add the work around to
+dwmac4_lib.c too.
+
+Fixes: a3a57bf07de2 ("net: stmmac: work around sporadic tx issue on link-up")
+Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230721-stmmac-tx-workaround-v1-1-9411cbd5ee07@axis.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
+index df41eac54058f..03ceb6a940732 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
+@@ -240,13 +240,15 @@ void stmmac_dwmac4_set_mac_addr(void __iomem *ioaddr, const u8 addr[6],
+ void stmmac_dwmac4_set_mac(void __iomem *ioaddr, bool enable)
+ {
+ u32 value = readl(ioaddr + GMAC_CONFIG);
++ u32 old_val = value;
+
+ if (enable)
+ value |= GMAC_CONFIG_RE | GMAC_CONFIG_TE;
+ else
+ value &= ~(GMAC_CONFIG_TE | GMAC_CONFIG_RE);
+
+- writel(value, ioaddr + GMAC_CONFIG);
++ if (value != old_val)
++ writel(value, ioaddr + GMAC_CONFIG);
+ }
+
+ void stmmac_dwmac4_get_mac_addr(void __iomem *ioaddr, unsigned char *addr,
+--
+2.39.2
+
--- /dev/null
+From 0a52e71ed054603f310ce2db33e0dd691d52ae4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Jul 2023 16:41:48 +0200
+Subject: netfilter: nf_tables: disallow rule addition to bound chain via
+ NFTA_RULE_CHAIN_ID
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 0ebc1064e4874d5987722a2ddbc18f94aa53b211 ]
+
+Bail out with EOPNOTSUPP when adding rule to bound chain via
+NFTA_RULE_CHAIN_ID. The following warning splat is shown when
+adding a rule to a deleted bound chain:
+
+ WARNING: CPU: 2 PID: 13692 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
+ CPU: 2 PID: 13692 Comm: chain-bound-rul Not tainted 6.1.39 #1
+ RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
+
+Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
+Reported-by: Kevin Rich <kevinrich1337@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index ccf0b3d80fd97..da00c411a9cd4 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3810,8 +3810,6 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+ NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
+ return PTR_ERR(chain);
+ }
+- if (nft_chain_is_bound(chain))
+- return -EOPNOTSUPP;
+
+ } else if (nla[NFTA_RULE_CHAIN_ID]) {
+ chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID],
+@@ -3824,6 +3822,9 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+ return -EINVAL;
+ }
+
++ if (nft_chain_is_bound(chain))
++ return -EOPNOTSUPP;
++
+ if (nla[NFTA_RULE_HANDLE]) {
+ handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
+ rule = __nft_rule_lookup(chain, handle);
+--
+2.39.2
+
--- /dev/null
+From ec20cc0105609141b1023dce12a17c2b5ffbead0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Jul 2023 16:24:46 +0200
+Subject: netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 0a771f7b266b02d262900c75f1e175c7fe76fec2 ]
+
+On error when building the rule, the immediate expression unbinds the
+chain, hence objects can be deactivated by the transaction records.
+
+Otherwise, it is possible to trigger the following warning:
+
+ WARNING: CPU: 3 PID: 915 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
+ CPU: 3 PID: 915 Comm: chain-bind-err- Not tainted 6.1.39 #1
+ RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
+
+Fixes: 4bedf9eee016 ("netfilter: nf_tables: fix chain binding transaction logic")
+Reported-by: Kevin Rich <kevinrich1337@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_immediate.c | 27 ++++++++++++++++++---------
+ 1 file changed, 18 insertions(+), 9 deletions(-)
+
+diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
+index 407d7197f75bb..fccb3cf7749c1 100644
+--- a/net/netfilter/nft_immediate.c
++++ b/net/netfilter/nft_immediate.c
+@@ -125,15 +125,27 @@ static void nft_immediate_activate(const struct nft_ctx *ctx,
+ return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg));
+ }
+
++static void nft_immediate_chain_deactivate(const struct nft_ctx *ctx,
++ struct nft_chain *chain,
++ enum nft_trans_phase phase)
++{
++ struct nft_ctx chain_ctx;
++ struct nft_rule *rule;
++
++ chain_ctx = *ctx;
++ chain_ctx.chain = chain;
++
++ list_for_each_entry(rule, &chain->rules, list)
++ nft_rule_expr_deactivate(&chain_ctx, rule, phase);
++}
++
+ static void nft_immediate_deactivate(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ enum nft_trans_phase phase)
+ {
+ const struct nft_immediate_expr *priv = nft_expr_priv(expr);
+ const struct nft_data *data = &priv->data;
+- struct nft_ctx chain_ctx;
+ struct nft_chain *chain;
+- struct nft_rule *rule;
+
+ if (priv->dreg == NFT_REG_VERDICT) {
+ switch (data->verdict.code) {
+@@ -143,20 +155,17 @@ static void nft_immediate_deactivate(const struct nft_ctx *ctx,
+ if (!nft_chain_binding(chain))
+ break;
+
+- chain_ctx = *ctx;
+- chain_ctx.chain = chain;
+-
+- list_for_each_entry(rule, &chain->rules, list)
+- nft_rule_expr_deactivate(&chain_ctx, rule, phase);
+-
+ switch (phase) {
+ case NFT_TRANS_PREPARE_ERROR:
+ nf_tables_unbind_chain(ctx, chain);
+- fallthrough;
++ nft_deactivate_next(ctx->net, chain);
++ break;
+ case NFT_TRANS_PREPARE:
++ nft_immediate_chain_deactivate(ctx, chain, phase);
+ nft_deactivate_next(ctx->net, chain);
+ break;
+ default:
++ nft_immediate_chain_deactivate(ctx, chain, phase);
+ nft_chain_del(chain);
+ chain->bound = false;
+ nft_use_dec(&chain->table->use);
+--
+2.39.2
+
--- /dev/null
+From 608d982ad67da33a2e1671597209e54a1f043ad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jul 2023 21:30:05 +0200
+Subject: netfilter: nft_set_rbtree: fix overlap expiration walk
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit f718863aca469a109895cb855e6b81fff4827d71 ]
+
+The lazy gc on insert that should remove timed-out entries fails to release
+the other half of the interval, if any.
+
+Can be reproduced with tests/shell/testcases/sets/0044interval_overlap_0
+in nftables.git and kmemleak enabled kernel.
+
+Second bug is the use of rbe_prev vs. prev pointer.
+If rbe_prev() returns NULL after at least one iteration, rbe_prev points
+to element that is not an end interval, hence it should not be removed.
+
+Lastly, check the genmask of the end interval if this is active in the
+current generation.
+
+Fixes: c9e6978e2725 ("netfilter: nft_set_rbtree: Switch to node list walk for overlap detection")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_set_rbtree.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
+index 5c05c9b990fba..8d73fffd2d09d 100644
+--- a/net/netfilter/nft_set_rbtree.c
++++ b/net/netfilter/nft_set_rbtree.c
+@@ -217,29 +217,37 @@ static void *nft_rbtree_get(const struct net *net, const struct nft_set *set,
+
+ static int nft_rbtree_gc_elem(const struct nft_set *__set,
+ struct nft_rbtree *priv,
+- struct nft_rbtree_elem *rbe)
++ struct nft_rbtree_elem *rbe,
++ u8 genmask)
+ {
+ struct nft_set *set = (struct nft_set *)__set;
+ struct rb_node *prev = rb_prev(&rbe->node);
+- struct nft_rbtree_elem *rbe_prev = NULL;
++ struct nft_rbtree_elem *rbe_prev;
+ struct nft_set_gc_batch *gcb;
+
+ gcb = nft_set_gc_batch_check(set, NULL, GFP_ATOMIC);
+ if (!gcb)
+ return -ENOMEM;
+
+- /* search for expired end interval coming before this element. */
++ /* search for end interval coming before this element.
++ * end intervals don't carry a timeout extension, they
++ * are coupled with the interval start element.
++ */
+ while (prev) {
+ rbe_prev = rb_entry(prev, struct nft_rbtree_elem, node);
+- if (nft_rbtree_interval_end(rbe_prev))
++ if (nft_rbtree_interval_end(rbe_prev) &&
++ nft_set_elem_active(&rbe_prev->ext, genmask))
+ break;
+
+ prev = rb_prev(prev);
+ }
+
+- if (rbe_prev) {
++ if (prev) {
++ rbe_prev = rb_entry(prev, struct nft_rbtree_elem, node);
++
+ rb_erase(&rbe_prev->node, &priv->root);
+ atomic_dec(&set->nelems);
++ nft_set_gc_batch_add(gcb, rbe_prev);
+ }
+
+ rb_erase(&rbe->node, &priv->root);
+@@ -321,7 +329,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
+
+ /* perform garbage collection to avoid bogus overlap reports. */
+ if (nft_set_elem_expired(&rbe->ext)) {
+- err = nft_rbtree_gc_elem(set, priv, rbe);
++ err = nft_rbtree_gc_elem(set, priv, rbe, genmask);
+ if (err < 0)
+ return err;
+
+--
+2.39.2
+
--- /dev/null
+From 120385592b83c0a16f1175323e8534441808487b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 11:42:22 +0530
+Subject: octeontx2-af: Fix hash extraction enable configuration
+
+From: Suman Ghosh <sumang@marvell.com>
+
+[ Upstream commit 4e62c99d71e56817c934caa2a709a775c8cee078 ]
+
+As of today, hash extraction support is enabled for all the silicons.
+Because of which we are facing initialization issues when the silicon
+does not support hash extraction. During creation of the hardware
+parsing table for IPv6 address, we need to consider if hash extraction
+is enabled then extract only 32 bit, otherwise 128 bit needs to be
+extracted. This patch fixes the issue and configures the hardware parser
+based on the availability of the feature.
+
+Fixes: a95ab93550d3 ("octeontx2-af: Use hashed field in MCAM key")
+Signed-off-by: Suman Ghosh <sumang@marvell.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230721061222.2632521-1-sumang@marvell.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../marvell/octeontx2/af/rvu_npc_hash.c | 43 ++++++++++++++++++-
+ .../marvell/octeontx2/af/rvu_npc_hash.h | 8 ++--
+ 2 files changed, 46 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
+index 6fe67f3a7f6f1..7e20282c12d00 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
+@@ -218,13 +218,54 @@ void npc_config_secret_key(struct rvu *rvu, int blkaddr)
+
+ void npc_program_mkex_hash(struct rvu *rvu, int blkaddr)
+ {
++ struct npc_mcam_kex_hash *mh = rvu->kpu.mkex_hash;
+ struct hw_cap *hwcap = &rvu->hw->cap;
++ u8 intf, ld, hdr_offset, byte_len;
+ struct rvu_hwinfo *hw = rvu->hw;
+- u8 intf;
++ u64 cfg;
+
++ /* Check if hardware supports hash extraction */
+ if (!hwcap->npc_hash_extract)
+ return;
+
++ /* Check if IPv6 source/destination address
++ * should be hash enabled.
++ * Hashing reduces 128bit SIP/DIP fields to 32bit
++ * so that 224 bit X2 key can be used for IPv6 based filters as well,
++ * which in turn results in more number of MCAM entries available for
++ * use.
++ *
++ * Hashing of IPV6 SIP/DIP is enabled in below scenarios
++ * 1. If the silicon variant supports hashing feature
++ * 2. If the number of bytes of IP addr being extracted is 4 bytes ie
++ * 32bit. The assumption here is that if user wants 8bytes of LSB of
++ * IP addr or full 16 bytes then his intention is not to use 32bit
++ * hash.
++ */
++ for (intf = 0; intf < hw->npc_intfs; intf++) {
++ for (ld = 0; ld < NPC_MAX_LD; ld++) {
++ cfg = rvu_read64(rvu, blkaddr,
++ NPC_AF_INTFX_LIDX_LTX_LDX_CFG(intf,
++ NPC_LID_LC,
++ NPC_LT_LC_IP6,
++ ld));
++ hdr_offset = FIELD_GET(NPC_HDR_OFFSET, cfg);
++ byte_len = FIELD_GET(NPC_BYTESM, cfg);
++ /* Hashing of IPv6 source/destination address should be
++ * enabled if,
++ * hdr_offset == 8 (offset of source IPv6 address) or
++ * hdr_offset == 24 (offset of destination IPv6)
++ * address) and the number of byte to be
++ * extracted is 4. As per hardware configuration
++ * byte_len should be == actual byte_len - 1.
++ * Hence byte_len is checked against 3 but nor 4.
++ */
++ if ((hdr_offset == 8 || hdr_offset == 24) && byte_len == 3)
++ mh->lid_lt_ld_hash_en[intf][NPC_LID_LC][NPC_LT_LC_IP6][ld] = true;
++ }
++ }
++
++ /* Update hash configuration if the field is hash enabled */
+ for (intf = 0; intf < hw->npc_intfs; intf++) {
+ npc_program_mkex_hash_rx(rvu, blkaddr, intf);
+ npc_program_mkex_hash_tx(rvu, blkaddr, intf);
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h
+index a1c3d987b8044..57a09328d46b5 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h
+@@ -70,8 +70,8 @@ static struct npc_mcam_kex_hash npc_mkex_hash_default __maybe_unused = {
+ [NIX_INTF_RX] = {
+ [NPC_LID_LC] = {
+ [NPC_LT_LC_IP6] = {
+- true,
+- true,
++ false,
++ false,
+ },
+ },
+ },
+@@ -79,8 +79,8 @@ static struct npc_mcam_kex_hash npc_mkex_hash_default __maybe_unused = {
+ [NIX_INTF_TX] = {
+ [NPC_LID_LC] = {
+ [NPC_LT_LC_IP6] = {
+- true,
+- true,
++ false,
++ false,
+ },
+ },
+ },
+--
+2.39.2
+
--- /dev/null
+From 9343612490360b5954c8067eb9a608642ea67997 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 02:05:55 -0700
+Subject: phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
+
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+
+[ Upstream commit 13c088cf3657d70893d75cf116be937f1509cc0f ]
+
+The size of array 'priv->ports[]' is INNO_PHY_PORT_NUM.
+
+In the for loop, 'i' is used as the index for array 'priv->ports[]'
+with a check (i > INNO_PHY_PORT_NUM) which indicates that
+INNO_PHY_PORT_NUM is allowed value for 'i' in the same loop.
+
+This > comparison needs to be changed to >=, otherwise it potentially leads
+to an out of bounds write on the next iteration through the loop
+
+Fixes: ba8b0ee81fbb ("phy: add inno-usb2-phy driver for hi3798cv200 SoC")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Link: https://lore.kernel.org/r/20230721090558.3588613-1-harshit.m.mogalapalli@oracle.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/hisilicon/phy-hisi-inno-usb2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/hisilicon/phy-hisi-inno-usb2.c b/drivers/phy/hisilicon/phy-hisi-inno-usb2.c
+index b133ae06757ab..a922fb11a1092 100644
+--- a/drivers/phy/hisilicon/phy-hisi-inno-usb2.c
++++ b/drivers/phy/hisilicon/phy-hisi-inno-usb2.c
+@@ -158,7 +158,7 @@ static int hisi_inno_phy_probe(struct platform_device *pdev)
+ phy_set_drvdata(phy, &priv->ports[i]);
+ i++;
+
+- if (i > INNO_PHY_PORT_NUM) {
++ if (i >= INNO_PHY_PORT_NUM) {
+ dev_warn(dev, "Support %d ports in maximum\n", i);
+ of_node_put(child);
+ break;
+--
+2.39.2
+
--- /dev/null
+From 1136a2046c2d365f848963b08f5aa8f2191b0350 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 10:43:07 +0200
+Subject: phy: mediatek: hdmi: mt8195: fix prediv bad upper limit test
+
+From: Guillaume Ranquet <granquet@baylibre.com>
+
+[ Upstream commit 95bd315f0a5ed7d7afe771776272c5b3cdb29bc8 ]
+
+The pll prediv calculus searchs for the smallest prediv that gets
+the ns_hdmipll_ck in the range of 5 GHz to 12 GHz.
+
+A typo in the upper bound test was testing for 5Ghz to 1Ghz
+
+Fixes: 45810d486bb44 ("phy: mediatek: add support for phy-mtk-hdmi-mt8195")
+Signed-off-by: Guillaume Ranquet <granquet@baylibre.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230529-hdmi_phy_fix-v1-1-bf65f53af533@baylibre.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/mediatek/phy-mtk-hdmi-mt8195.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/mediatek/phy-mtk-hdmi-mt8195.c b/drivers/phy/mediatek/phy-mtk-hdmi-mt8195.c
+index 8aa7251de4a96..bbfe11d6a69d7 100644
+--- a/drivers/phy/mediatek/phy-mtk-hdmi-mt8195.c
++++ b/drivers/phy/mediatek/phy-mtk-hdmi-mt8195.c
+@@ -253,7 +253,7 @@ static int mtk_hdmi_pll_calc(struct mtk_hdmi_phy *hdmi_phy, struct clk_hw *hw,
+ for (i = 0; i < ARRAY_SIZE(txpredivs); i++) {
+ ns_hdmipll_ck = 5 * tmds_clk * txposdiv * txpredivs[i];
+ if (ns_hdmipll_ck >= 5 * GIGA &&
+- ns_hdmipll_ck <= 1 * GIGA)
++ ns_hdmipll_ck <= 12 * GIGA)
+ break;
+ }
+ if (i == (ARRAY_SIZE(txpredivs) - 1) &&
+--
+2.39.2
+
--- /dev/null
+From 71e1a3035eb29989def192e67fd4fabf2593d97d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jul 2023 09:13:25 +0300
+Subject: phy: phy-mtk-dp: Fix an error code in probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 5782017cc4d0c8f3425d55b893675bb8a20c33e9 ]
+
+Negative -EINVAL was intended instead of positive EINVAL.
+
+Fixes: 6a23afad443a ("phy: phy-mtk-dp: Add driver for DP phy")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/3c699e00-2883-40d9-92c3-0da1dc38fdd4@moroto.mountain
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/mediatek/phy-mtk-dp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/mediatek/phy-mtk-dp.c b/drivers/phy/mediatek/phy-mtk-dp.c
+index 232fd3f1ff1b1..d7024a1443358 100644
+--- a/drivers/phy/mediatek/phy-mtk-dp.c
++++ b/drivers/phy/mediatek/phy-mtk-dp.c
+@@ -169,7 +169,7 @@ static int mtk_dp_phy_probe(struct platform_device *pdev)
+
+ regs = *(struct regmap **)dev->platform_data;
+ if (!regs)
+- return dev_err_probe(dev, EINVAL,
++ return dev_err_probe(dev, -EINVAL,
+ "No data passed, requires struct regmap**\n");
+
+ dp_phy = devm_kzalloc(dev, sizeof(*dp_phy), GFP_KERNEL);
+--
+2.39.2
+
--- /dev/null
+From caa017d7edc93957fc4cee160059559226fd413d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 10:45:38 -0400
+Subject: phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime
+ suspend
+
+From: Adrien Thierry <athierry@redhat.com>
+
+[ Upstream commit 45d89a344eb46db9dce851c28e14f5e3c635c251 ]
+
+In the dwc3 core, both system and runtime suspend end up calling
+dwc3_suspend_common(). From there, what happens for the PHYs depends on
+the USB mode and whether the controller is entering system or runtime
+suspend.
+
+HOST mode:
+ (1) system suspend on a non-wakeup-capable controller
+
+ The [1] if branch is taken. dwc3_core_exit() is called, which ends up
+ calling phy_power_off() and phy_exit(). Those two functions decrease the
+ PM runtime count at some point, so they will trigger the PHY runtime
+ sleep (assuming the count is right).
+
+ (2) runtime suspend / system suspend on a wakeup-capable controller
+
+ The [1] branch is not taken. dwc3_suspend_common() calls
+ phy_pm_runtime_put_sync(). Assuming the ref count is right, the PHY
+ runtime suspend op is called.
+
+DEVICE mode:
+ dwc3_core_exit() is called on both runtime and system sleep
+ unless the controller is already runtime suspended.
+
+OTG mode:
+ (1) system suspend : dwc3_core_exit() is called
+
+ (2) runtime suspend : do nothing
+
+In host mode, the code seems to make a distinction between 1) runtime
+sleep / system sleep for wakeup-capable controller, and 2) system sleep
+for non-wakeup-capable controller, where phy_power_off() and phy_exit()
+are only called for the latter. This suggests the PHY is not supposed to
+be in a fully powered-off state for runtime sleep and system sleep for
+wakeup-capable controller.
+
+Moreover, downstream, cfg_ahb_clk only gets disabled for system suspend.
+The clocks are disabled by phy->set_suspend() [2] which is only called
+in the system sleep path through dwc3_core_exit() [3].
+
+With that in mind, don't disable the clocks during the femto PHY runtime
+suspend callback. The clocks will only be disabled during system suspend
+for non-wakeup-capable controllers, through dwc3_core_exit().
+
+[1] https://elixir.bootlin.com/linux/v6.4/source/drivers/usb/dwc3/core.c#L1988
+[2] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/LV.AU.1.2.1.r2-05300-gen3meta.0/drivers/usb/phy/phy-msm-snps-hs.c#L524
+[3] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/LV.AU.1.2.1.r2-05300-gen3meta.0/drivers/usb/dwc3/core.c#L1915
+
+Signed-off-by: Adrien Thierry <athierry@redhat.com>
+Link: https://lore.kernel.org/r/20230629144542.14906-2-athierry@redhat.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Stable-dep-of: 8a0eb8f9b9a0 ("phy: qcom-snps-femto-v2: properly enable ref clock")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
+index 6c237f3cc66db..3335480fc395a 100644
+--- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
++++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
+@@ -165,22 +165,13 @@ static int qcom_snps_hsphy_suspend(struct qcom_snps_hsphy *hsphy)
+ 0, USB2_AUTO_RESUME);
+ }
+
+- clk_disable_unprepare(hsphy->cfg_ahb_clk);
+ return 0;
+ }
+
+ static int qcom_snps_hsphy_resume(struct qcom_snps_hsphy *hsphy)
+ {
+- int ret;
+-
+ dev_dbg(&hsphy->phy->dev, "Resume QCOM SNPS PHY, mode\n");
+
+- ret = clk_prepare_enable(hsphy->cfg_ahb_clk);
+- if (ret) {
+- dev_err(&hsphy->phy->dev, "failed to enable cfg ahb clock\n");
+- return ret;
+- }
+-
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From d83d30c5d0f7466d450a70c0b38594d4508cdffc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jun 2023 10:45:39 -0400
+Subject: phy: qcom-snps-femto-v2: properly enable ref clock
+
+From: Adrien Thierry <athierry@redhat.com>
+
+[ Upstream commit 8a0eb8f9b9a002291a3934acfd913660b905249e ]
+
+The driver is not enabling the ref clock, which thus gets disabled by
+the clk_disable_unused() initcall. This leads to the dwc3 controller
+failing to initialize if probed after clk_disable_unused() is called,
+for instance when the driver is built as a module.
+
+To fix this, switch to the clk_bulk API to handle both cfg_ahb and ref
+clocks at the proper places.
+
+Note that the cfg_ahb clock is currently not used by any device tree
+instantiation of the PHY. Work needs to be done separately to fix this.
+
+Link: https://lore.kernel.org/linux-arm-msm/ZEqvy+khHeTkC2hf@fedora/
+Fixes: 51e8114f80d0 ("phy: qcom-snps: Add SNPS USB PHY driver for QCOM based SOCs")
+Signed-off-by: Adrien Thierry <athierry@redhat.com>
+Link: https://lore.kernel.org/r/20230629144542.14906-3-athierry@redhat.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 63 ++++++++++++++-----
+ 1 file changed, 48 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
+index 3335480fc395a..6170f8fd118e2 100644
+--- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
++++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
+@@ -110,11 +110,13 @@ struct phy_override_seq {
+ /**
+ * struct qcom_snps_hsphy - snps hs phy attributes
+ *
++ * @dev: device structure
++ *
+ * @phy: generic phy
+ * @base: iomapped memory space for snps hs phy
+ *
+- * @cfg_ahb_clk: AHB2PHY interface clock
+- * @ref_clk: phy reference clock
++ * @num_clks: number of clocks
++ * @clks: array of clocks
+ * @phy_reset: phy reset control
+ * @vregs: regulator supplies bulk data
+ * @phy_initialized: if PHY has been initialized correctly
+@@ -122,11 +124,13 @@ struct phy_override_seq {
+ * @update_seq_cfg: tuning parameters for phy init
+ */
+ struct qcom_snps_hsphy {
++ struct device *dev;
++
+ struct phy *phy;
+ void __iomem *base;
+
+- struct clk *cfg_ahb_clk;
+- struct clk *ref_clk;
++ int num_clks;
++ struct clk_bulk_data *clks;
+ struct reset_control *phy_reset;
+ struct regulator_bulk_data vregs[SNPS_HS_NUM_VREGS];
+
+@@ -135,6 +139,34 @@ struct qcom_snps_hsphy {
+ struct phy_override_seq update_seq_cfg[NUM_HSPHY_TUNING_PARAMS];
+ };
+
++static int qcom_snps_hsphy_clk_init(struct qcom_snps_hsphy *hsphy)
++{
++ struct device *dev = hsphy->dev;
++
++ hsphy->num_clks = 2;
++ hsphy->clks = devm_kcalloc(dev, hsphy->num_clks, sizeof(*hsphy->clks), GFP_KERNEL);
++ if (!hsphy->clks)
++ return -ENOMEM;
++
++ /*
++ * TODO: Currently no device tree instantiation of the PHY is using the clock.
++ * This needs to be fixed in order for this code to be able to use devm_clk_bulk_get().
++ */
++ hsphy->clks[0].id = "cfg_ahb";
++ hsphy->clks[0].clk = devm_clk_get_optional(dev, "cfg_ahb");
++ if (IS_ERR(hsphy->clks[0].clk))
++ return dev_err_probe(dev, PTR_ERR(hsphy->clks[0].clk),
++ "failed to get cfg_ahb clk\n");
++
++ hsphy->clks[1].id = "ref";
++ hsphy->clks[1].clk = devm_clk_get(dev, "ref");
++ if (IS_ERR(hsphy->clks[1].clk))
++ return dev_err_probe(dev, PTR_ERR(hsphy->clks[1].clk),
++ "failed to get ref clk\n");
++
++ return 0;
++}
++
+ static inline void qcom_snps_hsphy_write_mask(void __iomem *base, u32 offset,
+ u32 mask, u32 val)
+ {
+@@ -365,16 +397,16 @@ static int qcom_snps_hsphy_init(struct phy *phy)
+ if (ret)
+ return ret;
+
+- ret = clk_prepare_enable(hsphy->cfg_ahb_clk);
++ ret = clk_bulk_prepare_enable(hsphy->num_clks, hsphy->clks);
+ if (ret) {
+- dev_err(&phy->dev, "failed to enable cfg ahb clock, %d\n", ret);
++ dev_err(&phy->dev, "failed to enable clocks, %d\n", ret);
+ goto poweroff_phy;
+ }
+
+ ret = reset_control_assert(hsphy->phy_reset);
+ if (ret) {
+ dev_err(&phy->dev, "failed to assert phy_reset, %d\n", ret);
+- goto disable_ahb_clk;
++ goto disable_clks;
+ }
+
+ usleep_range(100, 150);
+@@ -382,7 +414,7 @@ static int qcom_snps_hsphy_init(struct phy *phy)
+ ret = reset_control_deassert(hsphy->phy_reset);
+ if (ret) {
+ dev_err(&phy->dev, "failed to de-assert phy_reset, %d\n", ret);
+- goto disable_ahb_clk;
++ goto disable_clks;
+ }
+
+ qcom_snps_hsphy_write_mask(hsphy->base, USB2_PHY_USB_PHY_CFG0,
+@@ -439,8 +471,8 @@ static int qcom_snps_hsphy_init(struct phy *phy)
+
+ return 0;
+
+-disable_ahb_clk:
+- clk_disable_unprepare(hsphy->cfg_ahb_clk);
++disable_clks:
++ clk_bulk_disable_unprepare(hsphy->num_clks, hsphy->clks);
+ poweroff_phy:
+ regulator_bulk_disable(ARRAY_SIZE(hsphy->vregs), hsphy->vregs);
+
+@@ -452,7 +484,7 @@ static int qcom_snps_hsphy_exit(struct phy *phy)
+ struct qcom_snps_hsphy *hsphy = phy_get_drvdata(phy);
+
+ reset_control_assert(hsphy->phy_reset);
+- clk_disable_unprepare(hsphy->cfg_ahb_clk);
++ clk_bulk_disable_unprepare(hsphy->num_clks, hsphy->clks);
+ regulator_bulk_disable(ARRAY_SIZE(hsphy->vregs), hsphy->vregs);
+ hsphy->phy_initialized = false;
+
+@@ -545,14 +577,15 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev)
+ if (!hsphy)
+ return -ENOMEM;
+
++ hsphy->dev = dev;
++
+ hsphy->base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(hsphy->base))
+ return PTR_ERR(hsphy->base);
+
+- hsphy->ref_clk = devm_clk_get(dev, "ref");
+- if (IS_ERR(hsphy->ref_clk))
+- return dev_err_probe(dev, PTR_ERR(hsphy->ref_clk),
+- "failed to get ref clk\n");
++ ret = qcom_snps_hsphy_clk_init(hsphy);
++ if (ret)
++ return dev_err_probe(dev, ret, "failed to initialize clocks\n");
+
+ hsphy->phy_reset = devm_reset_control_get_exclusive(&pdev->dev, NULL);
+ if (IS_ERR(hsphy->phy_reset)) {
+--
+2.39.2
+
--- /dev/null
+From 701b9f31ff78904d69ecf55d04124f10e424b36e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 17:54:23 +0300
+Subject: platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
+
+From: Maxim Mikityanskiy <maxtram95@gmail.com>
+
+[ Upstream commit ad084a6d99bc182bf109c190c808e2ea073ec57b ]
+
+Only the HW rfkill state is toggled on laptops with quirks->ec_read_only
+(so far only MSI Wind U90/U100). There are, however, a few issues with
+the implementation:
+
+1. The initial HW state is always unblocked, regardless of the actual
+ state on boot, because msi_init_rfkill only sets the SW state,
+ regardless of ec_read_only.
+
+2. The initial SW state corresponds to the actual state on boot, but it
+ can't be changed afterwards, because set_device_state returns
+ -EOPNOTSUPP. It confuses the userspace, making Wi-Fi and/or Bluetooth
+ unusable if it was blocked on boot, and breaking the airplane mode if
+ the rfkill was unblocked on boot.
+
+Address the above issues by properly initializing the HW state on
+ec_read_only laptops and by allowing the userspace to toggle the SW
+state. Don't set the SW state ourselves and let the userspace fully
+control it. Toggling the SW state is a no-op, however, it allows the
+userspace to properly toggle the airplane mode. The actual SW radio
+disablement is handled by the corresponding rtl818x_pci and btusb
+drivers that have their own rfkills.
+
+Tested on MSI Wind U100 Plus, BIOS ver 1.0G, EC ver 130.
+
+Fixes: 0816392b97d4 ("msi-laptop: merge quirk tables to one")
+Fixes: 0de6575ad0a8 ("msi-laptop: Add MSI Wind U90/U100 support")
+Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com>
+Link: https://lore.kernel.org/r/20230721145423.161057-1-maxtram95@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/msi-laptop.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/msi-laptop.c b/drivers/platform/x86/msi-laptop.c
+index 6b18ec543ac3a..f4c6c36e05a52 100644
+--- a/drivers/platform/x86/msi-laptop.c
++++ b/drivers/platform/x86/msi-laptop.c
+@@ -208,7 +208,7 @@ static ssize_t set_device_state(const char *buf, size_t count, u8 mask)
+ return -EINVAL;
+
+ if (quirks->ec_read_only)
+- return -EOPNOTSUPP;
++ return 0;
+
+ /* read current device state */
+ result = ec_read(MSI_STANDARD_EC_COMMAND_ADDRESS, &rdata);
+@@ -838,15 +838,15 @@ static bool msi_laptop_i8042_filter(unsigned char data, unsigned char str,
+ static void msi_init_rfkill(struct work_struct *ignored)
+ {
+ if (rfk_wlan) {
+- rfkill_set_sw_state(rfk_wlan, !wlan_s);
++ msi_rfkill_set_state(rfk_wlan, !wlan_s);
+ rfkill_wlan_set(NULL, !wlan_s);
+ }
+ if (rfk_bluetooth) {
+- rfkill_set_sw_state(rfk_bluetooth, !bluetooth_s);
++ msi_rfkill_set_state(rfk_bluetooth, !bluetooth_s);
+ rfkill_bluetooth_set(NULL, !bluetooth_s);
+ }
+ if (rfk_threeg) {
+- rfkill_set_sw_state(rfk_threeg, !threeg_s);
++ msi_rfkill_set_state(rfk_threeg, !threeg_s);
+ rfkill_threeg_set(NULL, !threeg_s);
+ }
+ }
+--
+2.39.2
+
ext4-add-ext4_mb_hint_goal_only-test-in-ext4_mb_use_.patch
ext4-mballoc-remove-useless-setting-of-ac_criteria.patch
ext4-fix-rbtree-traversal-bug-in-ext4_mb_use_preallo.patch
+phy-phy-mtk-dp-fix-an-error-code-in-probe.patch
+phy-mediatek-hdmi-mt8195-fix-prediv-bad-upper-limit-.patch
+phy-qcom-snps-femto-v2-keep-cfg_ahb_clk-enabled-duri.patch
+phy-qcom-snps-femto-v2-properly-enable-ref-clock.patch
+soundwire-qcom-update-status-correctly-with-mask.patch
+soundwire-amd-fix-a-check-for-errors-in-probe.patch
+media-tc358746-address-compiler-warnings.patch
+media-staging-atomisp-select-v4l2_fwnode.patch
+media-amphion-fix-firmware-path-to-match-linux-firmw.patch
+media-mtk-jpeg-move-data-code-inside-config_of-block.patch
+media-mtk_jpeg_core-avoid-unused-variable-warning.patch
+i40e-fix-an-null-vs-is_err-bug-for-debugfs_create_di.patch
+iavf-fix-potential-deadlock-on-allocation-failure.patch
+iavf-check-for-removal-state-before-iavf_flag_pf_com.patch
+net-phy-marvell10g-fix-88x3310-power-up.patch
+net-hns3-fix-the-imp-capability-bit-cannot-exceed-32.patch
+net-hns3-fix-wrong-tc-bandwidth-weight-data-issue.patch
+net-hns3-fix-wrong-bw-weight-of-disabled-tc-issue.patch
+vxlan-calculate-correct-header-length-for-gpe.patch
+vxlan-generalize-vxlan_parse_gpe_hdr-and-remove-unus.patch
+vxlan-fix-gro-with-vxlan-gpe.patch
+phy-hisilicon-fix-an-out-of-bounds-check-in-hisi_inn.patch
+atheros-fix-return-value-check-in-atl1_tso.patch
+ethernet-atheros-fix-return-value-check-in-atl1e_tso.patch
+ipv6-addrconf-fix-bug-where-deleting-a-mngtmpaddr-ca.patch
+net-fec-avoid-tx-queue-timeout-when-xdp-is-enabled.patch
+tcp-reduce-chance-of-collisions-in-inet6_hashfn.patch
+ice-fix-memory-management-in-ice_ethtool_fdir.c.patch
+bonding-reset-bond-s-flags-when-down-link-is-p2p-dev.patch
+team-reset-team-s-flags-when-down-link-is-p2p-device.patch
+octeontx2-af-fix-hash-extraction-enable-configuratio.patch
+net-stmmac-apply-redundant-write-work-around-on-4.xx.patch
+platform-x86-msi-laptop-fix-rfkill-out-of-sync-on-ms.patch
+x86-traps-fix-load_unaligned_zeropad-handling-for-sh.patch
+macvlan-add-forgotten-nla_policy-for-ifla_macvlan_bc.patch
+igc-fix-kernel-panic-during-ndo_tx_timeout-callback.patch
+netfilter-nft_set_rbtree-fix-overlap-expiration-walk.patch
+netfilter-nf_tables-skip-immediate-deactivate-in-_pr.patch
+netfilter-nf_tables-disallow-rule-addition-to-bound-.patch
+mm-suppress-mm-fault-logging-if-fatal-signal-already.patch
+tools-ynl-gen-fix-enum-index-in-_decode_enum.patch
+net-fec-tx-processing-does-not-call-xdp-apis-if-budg.patch
+net-sched-mqprio-add-length-check-for-tca_mqprio_-ma.patch
+benet-fix-return-value-check-in-be_lancer_xmit_worka.patch
+tipc-check-return-value-of-pskb_trim.patch
+tipc-stop-tipc-crypto-on-failure-in-tipc_node_create.patch
--- /dev/null
+From 4e2a88c5792a74536e8db0787e726f6f207a9049 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 08:42:10 +0300
+Subject: soundwire: amd: Fix a check for errors in probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 7891d0a5ce6f627132d3068ba925cf86f29008b1 ]
+
+This code has two problems:
+1) The devm_ioremap() function returns NULL, not error pointers.
+2) It's checking the wrong variable. ->mmio instead of ->acp_mmio.
+
+Fixes: d8f48fbdfd9a ("soundwire: amd: Add support for AMD Manager driver")
+Suggested-by: "Mukunda,Vijendar" <vijendar.mukunda@amd.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/9863b2bf-0de2-4bf8-8f09-fe24dc5c63ff@moroto.mountain
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/amd_manager.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soundwire/amd_manager.c b/drivers/soundwire/amd_manager.c
+index 9fb7f91ca1827..21c638e38c51f 100644
+--- a/drivers/soundwire/amd_manager.c
++++ b/drivers/soundwire/amd_manager.c
+@@ -910,9 +910,9 @@ static int amd_sdw_manager_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ amd_manager->acp_mmio = devm_ioremap(dev, res->start, resource_size(res));
+- if (IS_ERR(amd_manager->mmio)) {
++ if (!amd_manager->acp_mmio) {
+ dev_err(dev, "mmio not found\n");
+- return PTR_ERR(amd_manager->mmio);
++ return -ENOMEM;
+ }
+ amd_manager->instance = pdata->instance;
+ amd_manager->mmio = amd_manager->acp_mmio +
+--
+2.39.2
+
--- /dev/null
+From c155084bd60355b633c708f676ab3640dd986547 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 14:38:09 +0100
+Subject: soundwire: qcom: update status correctly with mask
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit f84d41b2a083b990cbdf70f3b24b6b108b9678ad ]
+
+SoundWire device status can be incorrectly updated without
+proper mask, fix this by adding a mask before updating the status.
+
+Fixes: c7d49c76d1d5 ("soundwire: qcom: add support to new interrupts")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230525133812.30841-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/qcom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c
+index e3ef5ebae6b7c..027979c66486c 100644
+--- a/drivers/soundwire/qcom.c
++++ b/drivers/soundwire/qcom.c
+@@ -437,7 +437,7 @@ static int qcom_swrm_get_alert_slave_dev_num(struct qcom_swrm_ctrl *ctrl)
+ status = (val >> (dev_num * SWRM_MCP_SLV_STATUS_SZ));
+
+ if ((status & SWRM_MCP_SLV_STATUS_MASK) == SDW_SLAVE_ALERT) {
+- ctrl->status[dev_num] = status;
++ ctrl->status[dev_num] = status & SWRM_MCP_SLV_STATUS_MASK;
+ return dev_num;
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From e8b44d23043eb07ce23c209259508fe08ef1627f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 15:24:10 -0700
+Subject: tcp: Reduce chance of collisions in inet6_hashfn().
+
+From: Stewart Smith <trawets@amazon.com>
+
+[ Upstream commit d11b0df7ddf1831f3e170972f43186dad520bfcc ]
+
+For both IPv4 and IPv6 incoming TCP connections are tracked in a hash
+table with a hash over the source & destination addresses and ports.
+However, the IPv6 hash is insufficient and can lead to a high rate of
+collisions.
+
+The IPv6 hash used an XOR to fit everything into the 96 bits for the
+fast jenkins hash, meaning it is possible for an external entity to
+ensure the hash collides, thus falling back to a linear search in the
+bucket, which is slow.
+
+We take the approach of hash the full length of IPv6 address in
+__ipv6_addr_jhash() so that all users can benefit from a more secure
+version.
+
+While this may look like it adds overhead, the reality of modern CPUs
+means that this is unmeasurable in real world scenarios.
+
+In simulating with llvm-mca, the increase in cycles for the hashing
+code was ~16 cycles on Skylake (from a base of ~155), and an extra ~9
+on Nehalem (base of ~173).
+
+In commit dd6d2910c5e0 ("netfilter: conntrack: switch to siphash")
+netfilter switched from a jenkins hash to a siphash, but even the faster
+hsiphash is a more significant overhead (~20-30%) in some preliminary
+testing. So, in this patch, we keep to the more conservative approach to
+ensure we don't add much overhead per SYN.
+
+In testing, this results in a consistently even spread across the
+connection buckets. In both testing and real-world scenarios, we have
+not found any measurable performance impact.
+
+Fixes: 08dcdbf6a7b9 ("ipv6: use a stronger hash for tcp")
+Signed-off-by: Stewart Smith <trawets@amazon.com>
+Signed-off-by: Samuel Mendoza-Jonas <samjonas@amazon.com>
+Suggested-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20230721222410.17914-1-kuniyu@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ipv6.h | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 7332296eca44b..2acc4c808d45d 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -752,12 +752,8 @@ static inline u32 ipv6_addr_hash(const struct in6_addr *a)
+ /* more secured version of ipv6_addr_hash() */
+ static inline u32 __ipv6_addr_jhash(const struct in6_addr *a, const u32 initval)
+ {
+- u32 v = (__force u32)a->s6_addr32[0] ^ (__force u32)a->s6_addr32[1];
+-
+- return jhash_3words(v,
+- (__force u32)a->s6_addr32[2],
+- (__force u32)a->s6_addr32[3],
+- initval);
++ return jhash2((__force const u32 *)a->s6_addr32,
++ ARRAY_SIZE(a->s6_addr32), initval);
+ }
+
+ static inline bool ipv6_addr_loopback(const struct in6_addr *a)
+--
+2.39.2
+
--- /dev/null
+From bf639f94b9f5993d230d27d3797c3c76159c2b95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 12:03:56 +0800
+Subject: team: reset team's flags when down link is P2P device
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit fa532bee17d15acf8bba4bc8e2062b7a093ba801 ]
+
+When adding a point to point downlink to team device, we neglected to reset
+the team's flags, which were still using flags like BROADCAST and
+MULTICAST. Consequently, this would initiate ARP/DAD for P2P downlink
+interfaces, such as when adding a GRE device to team device. Fix this by
+remove multicast/broadcast flags and add p2p and noarp flags.
+
+After removing the none ethernet interface and adding an ethernet interface
+to team, we need to reset team interface flags. Unlike bonding interface,
+team do not need restore IFF_MASTER, IFF_SLAVE flags.
+
+Reported-by: Liang Li <liali@redhat.com>
+Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2221438
+Fixes: 1d76efe1577b ("team: add support for non-ethernet devices")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/team/team.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 555b0b1e9a789..d3dc22509ea58 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -2135,6 +2135,15 @@ static void team_setup_by_port(struct net_device *dev,
+ dev->mtu = port_dev->mtu;
+ memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len);
+ eth_hw_addr_inherit(dev, port_dev);
++
++ if (port_dev->flags & IFF_POINTOPOINT) {
++ dev->flags &= ~(IFF_BROADCAST | IFF_MULTICAST);
++ dev->flags |= (IFF_POINTOPOINT | IFF_NOARP);
++ } else if ((port_dev->flags & (IFF_BROADCAST | IFF_MULTICAST)) ==
++ (IFF_BROADCAST | IFF_MULTICAST)) {
++ dev->flags |= (IFF_BROADCAST | IFF_MULTICAST);
++ dev->flags &= ~(IFF_POINTOPOINT | IFF_NOARP);
++ }
+ }
+
+ static int team_dev_type_check_change(struct net_device *dev,
+--
+2.39.2
+
--- /dev/null
+From e9ab9c1093c2b59a3317ec36212c05a850ce0dde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jul 2023 14:48:10 +0800
+Subject: tipc: check return value of pskb_trim()
+
+From: Yuanjun Gong <ruc_gongyuanjun@163.com>
+
+[ Upstream commit e46e06ffc6d667a89b979701288e2264f45e6a7b ]
+
+goto free_skb if an unexpected result is returned by pskb_tirm()
+in tipc_crypto_rcv_complete().
+
+Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
+Signed-off-by: Yuanjun Gong <ruc_gongyuanjun@163.com>
+Reviewed-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
+Link: https://lore.kernel.org/r/20230725064810.5820-1-ruc_gongyuanjun@163.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/crypto.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c
+index 577fa5af33ec7..302fd749c4249 100644
+--- a/net/tipc/crypto.c
++++ b/net/tipc/crypto.c
+@@ -1960,7 +1960,8 @@ static void tipc_crypto_rcv_complete(struct net *net, struct tipc_aead *aead,
+
+ skb_reset_network_header(*skb);
+ skb_pull(*skb, tipc_ehdr_size(ehdr));
+- pskb_trim(*skb, (*skb)->len - aead->authsize);
++ if (pskb_trim(*skb, (*skb)->len - aead->authsize))
++ goto free_skb;
+
+ /* Validate TIPCv2 message */
+ if (unlikely(!tipc_msg_validate(skb))) {
+--
+2.39.2
+
--- /dev/null
+From a19980b48acc230ab15501b9313f0d6d55edd6ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jul 2023 00:46:25 +0300
+Subject: tipc: stop tipc crypto on failure in tipc_node_create
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit de52e17326c3e9a719c9ead4adb03467b8fae0ef ]
+
+If tipc_link_bc_create() fails inside tipc_node_create() for a newly
+allocated tipc node then we should stop its tipc crypto and free the
+resources allocated with a call to tipc_crypto_start().
+
+As the node ref is initialized to one to that point, just put the ref on
+tipc_link_bc_create() error case that would lead to tipc_node_free() be
+eventually executed and properly clean the node and its crypto resources.
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Fixes: cb8092d70a6f ("tipc: move bc link creation back to tipc_node_create")
+Suggested-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Reviewed-by: Xin Long <lucien.xin@gmail.com>
+Link: https://lore.kernel.org/r/20230725214628.25246-1-pchelkin@ispras.ru
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/node.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tipc/node.c b/net/tipc/node.c
+index 5e000fde80676..a9c5b6594889b 100644
+--- a/net/tipc/node.c
++++ b/net/tipc/node.c
+@@ -583,7 +583,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id,
+ n->capabilities, &n->bc_entry.inputq1,
+ &n->bc_entry.namedq, snd_l, &n->bc_entry.link)) {
+ pr_warn("Broadcast rcv link creation failed, no memory\n");
+- kfree(n);
++ tipc_node_put(n);
+ n = NULL;
+ goto exit;
+ }
+--
+2.39.2
+
--- /dev/null
+From 2fc9cc6caba918a041a764b703174e29aee5d06c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jul 2023 12:16:41 +0200
+Subject: tools: ynl-gen: fix enum index in _decode_enum(..)
+
+From: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+
+[ Upstream commit d7ddf5f4269fcaf19aafe971e635d91897423a3a ]
+
+Remove wrong index adjustment, which is leftover from adding
+support for sparse enums.
+enum.entries_by_val() function shall not subtract the start-value, as
+it is indexed with real enum value.
+
+Fixes: c311aaa74ca1 ("tools: ynl: fix enum-as-flags in the generic CLI")
+Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
+Link: https://lore.kernel.org/r/20230725101642.267248-2-arkadiusz.kubalewski@intel.com
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/net/ynl/lib/ynl.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/net/ynl/lib/ynl.py b/tools/net/ynl/lib/ynl.py
+index 3144f33196be4..35462c7ce48b5 100644
+--- a/tools/net/ynl/lib/ynl.py
++++ b/tools/net/ynl/lib/ynl.py
+@@ -405,8 +405,8 @@ class YnlFamily(SpecFamily):
+ def _decode_enum(self, rsp, attr_spec):
+ raw = rsp[attr_spec['name']]
+ enum = self.consts[attr_spec['enum']]
+- i = attr_spec.get('value-start', 0)
+ if 'enum-as-flags' in attr_spec and attr_spec['enum-as-flags']:
++ i = 0
+ value = set()
+ while raw:
+ if raw & 1:
+@@ -414,7 +414,7 @@ class YnlFamily(SpecFamily):
+ raw >>= 1
+ i += 1
+ else:
+- value = enum.entries_by_val[raw - i].name
++ value = enum.entries_by_val[raw].name
+ rsp[attr_spec['name']] = value
+
+ def _decode_binary(self, attr, attr_spec):
+--
+2.39.2
+
--- /dev/null
+From 56d9beb1e6ed6d283aa976899595bd8bf5363860 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jul 2023 11:05:56 +0200
+Subject: vxlan: calculate correct header length for GPE
+
+From: Jiri Benc <jbenc@redhat.com>
+
+[ Upstream commit 94d166c5318c6edd1e079df8552233443e909c33 ]
+
+VXLAN-GPE does not add an extra inner Ethernet header. Take that into
+account when calculating header length.
+
+This causes problems in skb_tunnel_check_pmtu, where incorrect PMTU is
+cached.
+
+In the collect_md mode (which is the only mode that VXLAN-GPE
+supports), there's no magic auto-setting of the tunnel interface MTU.
+It can't be, since the destination and thus the underlying interface
+may be different for each packet.
+
+So, the administrator is responsible for setting the correct tunnel
+interface MTU. Apparently, the administrators are capable enough to
+calculate that the maximum MTU for VXLAN-GPE is (their_lower_MTU - 36).
+They set the tunnel interface MTU to 1464. If you run a TCP stream over
+such interface, it's then segmented according to the MTU 1464, i.e.
+producing 1514 bytes frames. Which is okay, this still fits the lower
+MTU.
+
+However, skb_tunnel_check_pmtu (called from vxlan_xmit_one) uses 50 as
+the header size and thus incorrectly calculates the frame size to be
+1528. This leads to ICMP too big message being generated (locally),
+PMTU of 1450 to be cached and the TCP stream to be resegmented.
+
+The fix is to use the correct actual header size, especially for
+skb_tunnel_check_pmtu calculation.
+
+Fixes: e1e5314de08ba ("vxlan: implement GPE")
+Signed-off-by: Jiri Benc <jbenc@redhat.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +-
+ drivers/net/vxlan/vxlan_core.c | 23 ++++++++-----------
+ include/net/vxlan.h | 13 +++++++----
+ 3 files changed, 20 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 1726297f2e0df..8eb9839a3ca69 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -8479,7 +8479,7 @@ static void ixgbe_atr(struct ixgbe_ring *ring,
+ struct ixgbe_adapter *adapter = q_vector->adapter;
+
+ if (unlikely(skb_tail_pointer(skb) < hdr.network +
+- VXLAN_HEADROOM))
++ vxlan_headroom(0)))
+ return;
+
+ /* verify the port is recognized as VXLAN */
+diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
+index 561fe1b314f5f..fed54702b7e21 100644
+--- a/drivers/net/vxlan/vxlan_core.c
++++ b/drivers/net/vxlan/vxlan_core.c
+@@ -2515,7 +2515,7 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+ }
+
+ ndst = &rt->dst;
+- err = skb_tunnel_check_pmtu(skb, ndst, VXLAN_HEADROOM,
++ err = skb_tunnel_check_pmtu(skb, ndst, vxlan_headroom(flags & VXLAN_F_GPE),
+ netif_is_any_bridge_port(dev));
+ if (err < 0) {
+ goto tx_error;
+@@ -2576,7 +2576,8 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+ goto out_unlock;
+ }
+
+- err = skb_tunnel_check_pmtu(skb, ndst, VXLAN6_HEADROOM,
++ err = skb_tunnel_check_pmtu(skb, ndst,
++ vxlan_headroom((flags & VXLAN_F_GPE) | VXLAN_F_IPV6),
+ netif_is_any_bridge_port(dev));
+ if (err < 0) {
+ goto tx_error;
+@@ -2988,14 +2989,12 @@ static int vxlan_change_mtu(struct net_device *dev, int new_mtu)
+ struct vxlan_rdst *dst = &vxlan->default_dst;
+ struct net_device *lowerdev = __dev_get_by_index(vxlan->net,
+ dst->remote_ifindex);
+- bool use_ipv6 = !!(vxlan->cfg.flags & VXLAN_F_IPV6);
+
+ /* This check is different than dev->max_mtu, because it looks at
+ * the lowerdev->mtu, rather than the static dev->max_mtu
+ */
+ if (lowerdev) {
+- int max_mtu = lowerdev->mtu -
+- (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
++ int max_mtu = lowerdev->mtu - vxlan_headroom(vxlan->cfg.flags);
+ if (new_mtu > max_mtu)
+ return -EINVAL;
+ }
+@@ -3641,11 +3640,11 @@ static void vxlan_config_apply(struct net_device *dev,
+ struct vxlan_dev *vxlan = netdev_priv(dev);
+ struct vxlan_rdst *dst = &vxlan->default_dst;
+ unsigned short needed_headroom = ETH_HLEN;
+- bool use_ipv6 = !!(conf->flags & VXLAN_F_IPV6);
+ int max_mtu = ETH_MAX_MTU;
++ u32 flags = conf->flags;
+
+ if (!changelink) {
+- if (conf->flags & VXLAN_F_GPE)
++ if (flags & VXLAN_F_GPE)
+ vxlan_raw_setup(dev);
+ else
+ vxlan_ether_setup(dev);
+@@ -3670,8 +3669,7 @@ static void vxlan_config_apply(struct net_device *dev,
+
+ dev->needed_tailroom = lowerdev->needed_tailroom;
+
+- max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :
+- VXLAN_HEADROOM);
++ max_mtu = lowerdev->mtu - vxlan_headroom(flags);
+ if (max_mtu < ETH_MIN_MTU)
+ max_mtu = ETH_MIN_MTU;
+
+@@ -3682,10 +3680,9 @@ static void vxlan_config_apply(struct net_device *dev,
+ if (dev->mtu > max_mtu)
+ dev->mtu = max_mtu;
+
+- if (use_ipv6 || conf->flags & VXLAN_F_COLLECT_METADATA)
+- needed_headroom += VXLAN6_HEADROOM;
+- else
+- needed_headroom += VXLAN_HEADROOM;
++ if (flags & VXLAN_F_COLLECT_METADATA)
++ flags |= VXLAN_F_IPV6;
++ needed_headroom += vxlan_headroom(flags);
+ dev->needed_headroom = needed_headroom;
+
+ memcpy(&vxlan->cfg, conf, sizeof(*conf));
+diff --git a/include/net/vxlan.h b/include/net/vxlan.h
+index 20bd7d893e10a..b57567296bc67 100644
+--- a/include/net/vxlan.h
++++ b/include/net/vxlan.h
+@@ -384,10 +384,15 @@ static inline netdev_features_t vxlan_features_check(struct sk_buff *skb,
+ return features;
+ }
+
+-/* IP header + UDP + VXLAN + Ethernet header */
+-#define VXLAN_HEADROOM (20 + 8 + 8 + 14)
+-/* IPv6 header + UDP + VXLAN + Ethernet header */
+-#define VXLAN6_HEADROOM (40 + 8 + 8 + 14)
++static inline int vxlan_headroom(u32 flags)
++{
++ /* VXLAN: IP4/6 header + UDP + VXLAN + Ethernet header */
++ /* VXLAN-GPE: IP4/6 header + UDP + VXLAN */
++ return (flags & VXLAN_F_IPV6 ? sizeof(struct ipv6hdr) :
++ sizeof(struct iphdr)) +
++ sizeof(struct udphdr) + sizeof(struct vxlanhdr) +
++ (flags & VXLAN_F_GPE ? 0 : ETH_HLEN);
++}
+
+ static inline struct vxlanhdr *vxlan_hdr(struct sk_buff *skb)
+ {
+--
+2.39.2
+
--- /dev/null
+From 4832b68f448bcb3f3b6f611e0702cd43853f4af8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 16:30:47 +0200
+Subject: vxlan: fix GRO with VXLAN-GPE
+
+From: Jiri Benc <jbenc@redhat.com>
+
+[ Upstream commit b0b672c4d0957e5897685667fc848132b8bd2d71 ]
+
+In VXLAN-GPE, there may not be an Ethernet header following the VXLAN
+header. But in GRO, the vxlan driver calls eth_gro_receive
+unconditionally, which means the following header is incorrectly parsed
+as Ethernet.
+
+Introduce GPE specific GRO handling.
+
+For better performance, do not check for GPE during GRO but rather
+install a different set of functions at setup time.
+
+Fixes: e1e5314de08ba ("vxlan: implement GPE")
+Reported-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Jiri Benc <jbenc@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan/vxlan_core.c | 84 ++++++++++++++++++++++++++++------
+ 1 file changed, 69 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
+index cb2d82785d900..7532cac2154c5 100644
+--- a/drivers/net/vxlan/vxlan_core.c
++++ b/drivers/net/vxlan/vxlan_core.c
+@@ -675,26 +675,24 @@ static struct vxlanhdr *vxlan_gro_remcsum(struct sk_buff *skb,
+ return vh;
+ }
+
+-static struct sk_buff *vxlan_gro_receive(struct sock *sk,
+- struct list_head *head,
+- struct sk_buff *skb)
++static struct vxlanhdr *vxlan_gro_prepare_receive(struct sock *sk,
++ struct list_head *head,
++ struct sk_buff *skb,
++ struct gro_remcsum *grc)
+ {
+- struct sk_buff *pp = NULL;
+ struct sk_buff *p;
+ struct vxlanhdr *vh, *vh2;
+ unsigned int hlen, off_vx;
+- int flush = 1;
+ struct vxlan_sock *vs = rcu_dereference_sk_user_data(sk);
+ __be32 flags;
+- struct gro_remcsum grc;
+
+- skb_gro_remcsum_init(&grc);
++ skb_gro_remcsum_init(grc);
+
+ off_vx = skb_gro_offset(skb);
+ hlen = off_vx + sizeof(*vh);
+ vh = skb_gro_header(skb, hlen, off_vx);
+ if (unlikely(!vh))
+- goto out;
++ return NULL;
+
+ skb_gro_postpull_rcsum(skb, vh, sizeof(struct vxlanhdr));
+
+@@ -702,12 +700,12 @@ static struct sk_buff *vxlan_gro_receive(struct sock *sk,
+
+ if ((flags & VXLAN_HF_RCO) && (vs->flags & VXLAN_F_REMCSUM_RX)) {
+ vh = vxlan_gro_remcsum(skb, off_vx, vh, sizeof(struct vxlanhdr),
+- vh->vx_vni, &grc,
++ vh->vx_vni, grc,
+ !!(vs->flags &
+ VXLAN_F_REMCSUM_NOPARTIAL));
+
+ if (!vh)
+- goto out;
++ return NULL;
+ }
+
+ skb_gro_pull(skb, sizeof(struct vxlanhdr)); /* pull vxlan header */
+@@ -724,12 +722,48 @@ static struct sk_buff *vxlan_gro_receive(struct sock *sk,
+ }
+ }
+
+- pp = call_gro_receive(eth_gro_receive, head, skb);
+- flush = 0;
++ return vh;
++}
++
++static struct sk_buff *vxlan_gro_receive(struct sock *sk,
++ struct list_head *head,
++ struct sk_buff *skb)
++{
++ struct sk_buff *pp = NULL;
++ struct gro_remcsum grc;
++ int flush = 1;
+
+-out:
++ if (vxlan_gro_prepare_receive(sk, head, skb, &grc)) {
++ pp = call_gro_receive(eth_gro_receive, head, skb);
++ flush = 0;
++ }
+ skb_gro_flush_final_remcsum(skb, pp, flush, &grc);
++ return pp;
++}
+
++static struct sk_buff *vxlan_gpe_gro_receive(struct sock *sk,
++ struct list_head *head,
++ struct sk_buff *skb)
++{
++ const struct packet_offload *ptype;
++ struct sk_buff *pp = NULL;
++ struct gro_remcsum grc;
++ struct vxlanhdr *vh;
++ __be16 protocol;
++ int flush = 1;
++
++ vh = vxlan_gro_prepare_receive(sk, head, skb, &grc);
++ if (vh) {
++ if (!vxlan_parse_gpe_proto(vh, &protocol))
++ goto out;
++ ptype = gro_find_receive_by_type(protocol);
++ if (!ptype)
++ goto out;
++ pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb);
++ flush = 0;
++ }
++out:
++ skb_gro_flush_final_remcsum(skb, pp, flush, &grc);
+ return pp;
+ }
+
+@@ -741,6 +775,21 @@ static int vxlan_gro_complete(struct sock *sk, struct sk_buff *skb, int nhoff)
+ return eth_gro_complete(skb, nhoff + sizeof(struct vxlanhdr));
+ }
+
++static int vxlan_gpe_gro_complete(struct sock *sk, struct sk_buff *skb, int nhoff)
++{
++ struct vxlanhdr *vh = (struct vxlanhdr *)(skb->data + nhoff);
++ const struct packet_offload *ptype;
++ int err = -ENOSYS;
++ __be16 protocol;
++
++ if (!vxlan_parse_gpe_proto(vh, &protocol))
++ return err;
++ ptype = gro_find_complete_by_type(protocol);
++ if (ptype)
++ err = ptype->callbacks.gro_complete(skb, nhoff + sizeof(struct vxlanhdr));
++ return err;
++}
++
+ static struct vxlan_fdb *vxlan_fdb_alloc(struct vxlan_dev *vxlan, const u8 *mac,
+ __u16 state, __be32 src_vni,
+ __u16 ndm_flags)
+@@ -3373,8 +3422,13 @@ static struct vxlan_sock *vxlan_socket_create(struct net *net, bool ipv6,
+ tunnel_cfg.encap_rcv = vxlan_rcv;
+ tunnel_cfg.encap_err_lookup = vxlan_err_lookup;
+ tunnel_cfg.encap_destroy = NULL;
+- tunnel_cfg.gro_receive = vxlan_gro_receive;
+- tunnel_cfg.gro_complete = vxlan_gro_complete;
++ if (vs->flags & VXLAN_F_GPE) {
++ tunnel_cfg.gro_receive = vxlan_gpe_gro_receive;
++ tunnel_cfg.gro_complete = vxlan_gpe_gro_complete;
++ } else {
++ tunnel_cfg.gro_receive = vxlan_gro_receive;
++ tunnel_cfg.gro_complete = vxlan_gro_complete;
++ }
+
+ setup_udp_tunnel_sock(net, sock, &tunnel_cfg);
+
+--
+2.39.2
+
--- /dev/null
+From 050a20dc6eff6f7747cfb1d20b16b8af12f262fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 16:30:46 +0200
+Subject: vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
+
+From: Jiri Benc <jbenc@redhat.com>
+
+[ Upstream commit 17a0a64448b568442a101de09575f81ffdc45d15 ]
+
+The vxlan_parse_gpe_hdr function extracts the next protocol value from
+the GPE header and marks GPE bits as parsed.
+
+In order to be used in the next patch, split the function into protocol
+extraction and bit marking. The bit marking is meaningful only in
+vxlan_rcv; move it directly there.
+
+Rename the function to vxlan_parse_gpe_proto to reflect what it now
+does. Remove unused arguments skb and vxflags. Move the function earlier
+in the file to allow it to be called from more places in the next patch.
+
+Signed-off-by: Jiri Benc <jbenc@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: b0b672c4d095 ("vxlan: fix GRO with VXLAN-GPE")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan/vxlan_core.c | 58 ++++++++++++++++------------------
+ 1 file changed, 28 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
+index fed54702b7e21..cb2d82785d900 100644
+--- a/drivers/net/vxlan/vxlan_core.c
++++ b/drivers/net/vxlan/vxlan_core.c
+@@ -623,6 +623,32 @@ static int vxlan_fdb_append(struct vxlan_fdb *f,
+ return 1;
+ }
+
++static bool vxlan_parse_gpe_proto(struct vxlanhdr *hdr, __be16 *protocol)
++{
++ struct vxlanhdr_gpe *gpe = (struct vxlanhdr_gpe *)hdr;
++
++ /* Need to have Next Protocol set for interfaces in GPE mode. */
++ if (!gpe->np_applied)
++ return false;
++ /* "The initial version is 0. If a receiver does not support the
++ * version indicated it MUST drop the packet.
++ */
++ if (gpe->version != 0)
++ return false;
++ /* "When the O bit is set to 1, the packet is an OAM packet and OAM
++ * processing MUST occur." However, we don't implement OAM
++ * processing, thus drop the packet.
++ */
++ if (gpe->oam_flag)
++ return false;
++
++ *protocol = tun_p_to_eth_p(gpe->next_protocol);
++ if (!*protocol)
++ return false;
++
++ return true;
++}
++
+ static struct vxlanhdr *vxlan_gro_remcsum(struct sk_buff *skb,
+ unsigned int off,
+ struct vxlanhdr *vh, size_t hdrlen,
+@@ -1525,35 +1551,6 @@ static void vxlan_parse_gbp_hdr(struct vxlanhdr *unparsed,
+ unparsed->vx_flags &= ~VXLAN_GBP_USED_BITS;
+ }
+
+-static bool vxlan_parse_gpe_hdr(struct vxlanhdr *unparsed,
+- __be16 *protocol,
+- struct sk_buff *skb, u32 vxflags)
+-{
+- struct vxlanhdr_gpe *gpe = (struct vxlanhdr_gpe *)unparsed;
+-
+- /* Need to have Next Protocol set for interfaces in GPE mode. */
+- if (!gpe->np_applied)
+- return false;
+- /* "The initial version is 0. If a receiver does not support the
+- * version indicated it MUST drop the packet.
+- */
+- if (gpe->version != 0)
+- return false;
+- /* "When the O bit is set to 1, the packet is an OAM packet and OAM
+- * processing MUST occur." However, we don't implement OAM
+- * processing, thus drop the packet.
+- */
+- if (gpe->oam_flag)
+- return false;
+-
+- *protocol = tun_p_to_eth_p(gpe->next_protocol);
+- if (!*protocol)
+- return false;
+-
+- unparsed->vx_flags &= ~VXLAN_GPE_USED_BITS;
+- return true;
+-}
+-
+ static bool vxlan_set_mac(struct vxlan_dev *vxlan,
+ struct vxlan_sock *vs,
+ struct sk_buff *skb, __be32 vni)
+@@ -1655,8 +1652,9 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
+ * used by VXLAN extensions if explicitly requested.
+ */
+ if (vs->flags & VXLAN_F_GPE) {
+- if (!vxlan_parse_gpe_hdr(&unparsed, &protocol, skb, vs->flags))
++ if (!vxlan_parse_gpe_proto(&unparsed, &protocol))
+ goto drop;
++ unparsed.vx_flags &= ~VXLAN_GPE_USED_BITS;
+ raw_proto = true;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From bcce2af7e83cf2da1661717f9a46ab31335a398d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jul 2023 02:03:29 +0300
+Subject: x86/traps: Fix load_unaligned_zeropad() handling for shared TDX
+ memory
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit 9f9116406120638b4d8db3831ffbc430dd2e1e95 ]
+
+Commit c4e34dd99f2e ("x86: simplify load_unaligned_zeropad()
+implementation") changes how exceptions around load_unaligned_zeropad()
+handled. The kernel now uses the fault_address in fixup_exception() to
+verify the address calculations for the load_unaligned_zeropad().
+
+It works fine for #PF, but breaks on #VE since no fault address is
+passed down to fixup_exception().
+
+Propagating ve_info.gla down to fixup_exception() resolves the issue.
+
+See commit 1e7769653b06 ("x86/tdx: Handle load_unaligned_zeropad()
+page-cross to a shared page") for more context.
+
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Reported-by: Michael Kelley <mikelley@microsoft.com>
+Fixes: c4e34dd99f2e ("x86: simplify load_unaligned_zeropad() implementation")
+Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/traps.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
+index 58b1f208eff51..4a817d20ce3bb 100644
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -697,9 +697,10 @@ static bool try_fixup_enqcmd_gp(void)
+ }
+
+ static bool gp_try_fixup_and_notify(struct pt_regs *regs, int trapnr,
+- unsigned long error_code, const char *str)
++ unsigned long error_code, const char *str,
++ unsigned long address)
+ {
+- if (fixup_exception(regs, trapnr, error_code, 0))
++ if (fixup_exception(regs, trapnr, error_code, address))
+ return true;
+
+ current->thread.error_code = error_code;
+@@ -759,7 +760,7 @@ DEFINE_IDTENTRY_ERRORCODE(exc_general_protection)
+ goto exit;
+ }
+
+- if (gp_try_fixup_and_notify(regs, X86_TRAP_GP, error_code, desc))
++ if (gp_try_fixup_and_notify(regs, X86_TRAP_GP, error_code, desc, 0))
+ goto exit;
+
+ if (error_code)
+@@ -1357,17 +1358,20 @@ DEFINE_IDTENTRY(exc_device_not_available)
+
+ #define VE_FAULT_STR "VE fault"
+
+-static void ve_raise_fault(struct pt_regs *regs, long error_code)
++static void ve_raise_fault(struct pt_regs *regs, long error_code,
++ unsigned long address)
+ {
+ if (user_mode(regs)) {
+ gp_user_force_sig_segv(regs, X86_TRAP_VE, error_code, VE_FAULT_STR);
+ return;
+ }
+
+- if (gp_try_fixup_and_notify(regs, X86_TRAP_VE, error_code, VE_FAULT_STR))
++ if (gp_try_fixup_and_notify(regs, X86_TRAP_VE, error_code,
++ VE_FAULT_STR, address)) {
+ return;
++ }
+
+- die_addr(VE_FAULT_STR, regs, error_code, 0);
++ die_addr(VE_FAULT_STR, regs, error_code, address);
+ }
+
+ /*
+@@ -1431,7 +1435,7 @@ DEFINE_IDTENTRY(exc_virtualization_exception)
+ * it successfully, treat it as #GP(0) and handle it.
+ */
+ if (!tdx_handle_virt_exception(regs, &ve))
+- ve_raise_fault(regs, 0);
++ ve_raise_fault(regs, 0, ve.gla);
+
+ cond_local_irq_disable(regs);
+ }
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
