--- /dev/null
+From bbb1e09de4ccc227f482a35eefd8df63bdb68272 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 23:15:40 +0900
+Subject: ALSA: firewire-motu: fix unreleased lock warning in hwdep device
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit c7a806d9ce6757ff56078674916e53bd859f242d ]
+
+Smatch static analysis tool detects that acquired lock is not released
+in hwdep device when condition branch is passed due to no event. It is
+unlikely to occur, while fulfilling is preferable for better coding.
+
+Reported-by: Dan Carpenter <error27@gmail.com>
+Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model")
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20230130141540.102854-1-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/motu/motu-hwdep.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/firewire/motu/motu-hwdep.c b/sound/firewire/motu/motu-hwdep.c
+index a900fc0e7644..88d1f4b56e4b 100644
+--- a/sound/firewire/motu/motu-hwdep.c
++++ b/sound/firewire/motu/motu-hwdep.c
+@@ -87,6 +87,10 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
+ return -EFAULT;
+
+ count = consumed;
++ } else {
++ spin_unlock_irq(&motu->lock);
++
++ count = 0;
+ }
+
+ return count;
+--
+2.39.0
+
--- /dev/null
+From bac19fbbbaf61b9708ea09ee807652686dd4a2b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 00:22:59 -0800
+Subject: ALSA: hda/via: Avoid potential array out-of-bound in
+ add_secret_dac_path()
+
+From: Artemii Karasev <karasev@ispras.ru>
+
+[ Upstream commit b9cee506da2b7920b5ea02ccd8e78a907d0ee7aa ]
+
+snd_hda_get_connections() can return a negative error code.
+It may lead to accessing 'conn' array at a negative index.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Signed-off-by: Artemii Karasev <karasev@ispras.ru>
+Fixes: 30b4503378c9 ("ALSA: hda - Expose secret DAC-AA connection of some VIA codecs")
+Link: https://lore.kernel.org/r/20230119082259.3634-1-karasev@ispras.ru
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_via.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index aea7fae2ca4b..2994f85bc1b9 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -819,6 +819,9 @@ static int add_secret_dac_path(struct hda_codec *codec)
+ return 0;
+ nums = snd_hda_get_connections(codec, spec->gen.mixer_nid, conn,
+ ARRAY_SIZE(conn) - 1);
++ if (nums < 0)
++ return nums;
++
+ for (i = 0; i < nums; i++) {
+ if (get_wcaps_type(get_wcaps(codec, conn[i])) == AC_WID_AUD_OUT)
+ return 0;
+--
+2.39.0
+
--- /dev/null
+From ad1ed2c0da44c14019dddefdd7594dfd042cb1a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 16:31:04 +0100
+Subject: ALSA: memalloc: Workaround for Xen PV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 53466ebdec614f915c691809b0861acecb941e30 ]
+
+We change recently the memalloc helper to use
+dma_alloc_noncontiguous() and the fallback to get_pages(). Although
+lots of issues with IOMMU (or non-IOMMU) have been addressed, but
+there seems still a regression on Xen PV. Interestingly, the only
+proper way to work is use dma_alloc_coherent(). The use of
+dma_alloc_coherent() for SG buffer was dropped as it's problematic on
+IOMMU systems. OTOH, Xen PV has a different way, and it's fine to use
+the dma_alloc_coherent().
+
+This patch is a workaround for Xen PV. It consists of the following
+changes:
+- For Xen PV, use only the fallback allocation without
+ dma_alloc_noncontiguous()
+- In the fallback allocation, use dma_alloc_coherent();
+ the DMA address from dma_alloc_coherent() is returned in get_addr
+ ops
+- The DMA addresses are stored in an array; the first entry stores the
+ number of allocated pages in lower bits, which are referred at
+ releasing pages again
+
+Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+Fixes: a8d302a0b770 ("ALSA: memalloc: Revive x86-specific WC page allocations again")
+Fixes: 9736a325137b ("ALSA: memalloc: Don't fall back for SG-buffer with IOMMU")
+Link: https://lore.kernel.org/r/87tu256lqs.wl-tiwai@suse.de
+Link: https://lore.kernel.org/r/20230125153104.5527-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/memalloc.c | 87 ++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 69 insertions(+), 18 deletions(-)
+
+diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c
+index 7268304009ad..11ff1ee51345 100644
+--- a/sound/core/memalloc.c
++++ b/sound/core/memalloc.c
+@@ -542,16 +542,15 @@ static void *snd_dma_noncontig_alloc(struct snd_dma_buffer *dmab, size_t size)
+ struct sg_table *sgt;
+ void *p;
+
++#ifdef CONFIG_SND_DMA_SGBUF
++ if (cpu_feature_enabled(X86_FEATURE_XENPV))
++ return snd_dma_sg_fallback_alloc(dmab, size);
++#endif
+ sgt = dma_alloc_noncontiguous(dmab->dev.dev, size, dmab->dev.dir,
+ DEFAULT_GFP, 0);
+ #ifdef CONFIG_SND_DMA_SGBUF
+- if (!sgt && !get_dma_ops(dmab->dev.dev)) {
+- if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG)
+- dmab->dev.type = SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK;
+- else
+- dmab->dev.type = SNDRV_DMA_TYPE_DEV_SG_FALLBACK;
++ if (!sgt && !get_dma_ops(dmab->dev.dev))
+ return snd_dma_sg_fallback_alloc(dmab, size);
+- }
+ #endif
+ if (!sgt)
+ return NULL;
+@@ -718,19 +717,38 @@ static const struct snd_malloc_ops snd_dma_sg_wc_ops = {
+
+ /* Fallback SG-buffer allocations for x86 */
+ struct snd_dma_sg_fallback {
++ bool use_dma_alloc_coherent;
+ size_t count;
+ struct page **pages;
++ /* DMA address array; the first page contains #pages in ~PAGE_MASK */
++ dma_addr_t *addrs;
+ };
+
+ static void __snd_dma_sg_fallback_free(struct snd_dma_buffer *dmab,
+ struct snd_dma_sg_fallback *sgbuf)
+ {
+- bool wc = dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK;
+- size_t i;
+-
+- for (i = 0; i < sgbuf->count && sgbuf->pages[i]; i++)
+- do_free_pages(page_address(sgbuf->pages[i]), PAGE_SIZE, wc);
++ size_t i, size;
++
++ if (sgbuf->pages && sgbuf->addrs) {
++ i = 0;
++ while (i < sgbuf->count) {
++ if (!sgbuf->pages[i] || !sgbuf->addrs[i])
++ break;
++ size = sgbuf->addrs[i] & ~PAGE_MASK;
++ if (WARN_ON(!size))
++ break;
++ if (sgbuf->use_dma_alloc_coherent)
++ dma_free_coherent(dmab->dev.dev, size << PAGE_SHIFT,
++ page_address(sgbuf->pages[i]),
++ sgbuf->addrs[i] & PAGE_MASK);
++ else
++ do_free_pages(page_address(sgbuf->pages[i]),
++ size << PAGE_SHIFT, false);
++ i += size;
++ }
++ }
+ kvfree(sgbuf->pages);
++ kvfree(sgbuf->addrs);
+ kfree(sgbuf);
+ }
+
+@@ -739,24 +757,36 @@ static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size)
+ struct snd_dma_sg_fallback *sgbuf;
+ struct page **pagep, *curp;
+ size_t chunk, npages;
++ dma_addr_t *addrp;
+ dma_addr_t addr;
+ void *p;
+- bool wc = dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK;
++
++ /* correct the type */
++ if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_SG)
++ dmab->dev.type = SNDRV_DMA_TYPE_DEV_SG_FALLBACK;
++ else if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG)
++ dmab->dev.type = SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK;
+
+ sgbuf = kzalloc(sizeof(*sgbuf), GFP_KERNEL);
+ if (!sgbuf)
+ return NULL;
++ sgbuf->use_dma_alloc_coherent = cpu_feature_enabled(X86_FEATURE_XENPV);
+ size = PAGE_ALIGN(size);
+ sgbuf->count = size >> PAGE_SHIFT;
+ sgbuf->pages = kvcalloc(sgbuf->count, sizeof(*sgbuf->pages), GFP_KERNEL);
+- if (!sgbuf->pages)
++ sgbuf->addrs = kvcalloc(sgbuf->count, sizeof(*sgbuf->addrs), GFP_KERNEL);
++ if (!sgbuf->pages || !sgbuf->addrs)
+ goto error;
+
+ pagep = sgbuf->pages;
+- chunk = size;
++ addrp = sgbuf->addrs;
++ chunk = (PAGE_SIZE - 1) << PAGE_SHIFT; /* to fit in low bits in addrs */
+ while (size > 0) {
+ chunk = min(size, chunk);
+- p = do_alloc_pages(dmab->dev.dev, chunk, &addr, wc);
++ if (sgbuf->use_dma_alloc_coherent)
++ p = dma_alloc_coherent(dmab->dev.dev, chunk, &addr, DEFAULT_GFP);
++ else
++ p = do_alloc_pages(dmab->dev.dev, chunk, &addr, false);
+ if (!p) {
+ if (chunk <= PAGE_SIZE)
+ goto error;
+@@ -768,17 +798,25 @@ static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size)
+ size -= chunk;
+ /* fill pages */
+ npages = chunk >> PAGE_SHIFT;
++ *addrp = npages; /* store in lower bits */
+ curp = virt_to_page(p);
+- while (npages--)
++ while (npages--) {
+ *pagep++ = curp++;
++ *addrp++ |= addr;
++ addr += PAGE_SIZE;
++ }
+ }
+
+ p = vmap(sgbuf->pages, sgbuf->count, VM_MAP, PAGE_KERNEL);
+ if (!p)
+ goto error;
++
++ if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK)
++ set_pages_array_wc(sgbuf->pages, sgbuf->count);
++
+ dmab->private_data = sgbuf;
+ /* store the first page address for convenience */
+- dmab->addr = snd_sgbuf_get_addr(dmab, 0);
++ dmab->addr = sgbuf->addrs[0] & PAGE_MASK;
+ return p;
+
+ error:
+@@ -788,10 +826,23 @@ static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size)
+
+ static void snd_dma_sg_fallback_free(struct snd_dma_buffer *dmab)
+ {
++ struct snd_dma_sg_fallback *sgbuf = dmab->private_data;
++
++ if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK)
++ set_pages_array_wb(sgbuf->pages, sgbuf->count);
+ vunmap(dmab->area);
+ __snd_dma_sg_fallback_free(dmab, dmab->private_data);
+ }
+
++static dma_addr_t snd_dma_sg_fallback_get_addr(struct snd_dma_buffer *dmab,
++ size_t offset)
++{
++ struct snd_dma_sg_fallback *sgbuf = dmab->private_data;
++ size_t index = offset >> PAGE_SHIFT;
++
++ return (sgbuf->addrs[index] & PAGE_MASK) | (offset & ~PAGE_MASK);
++}
++
+ static int snd_dma_sg_fallback_mmap(struct snd_dma_buffer *dmab,
+ struct vm_area_struct *area)
+ {
+@@ -806,8 +857,8 @@ static const struct snd_malloc_ops snd_dma_sg_fallback_ops = {
+ .alloc = snd_dma_sg_fallback_alloc,
+ .free = snd_dma_sg_fallback_free,
+ .mmap = snd_dma_sg_fallback_mmap,
++ .get_addr = snd_dma_sg_fallback_get_addr,
+ /* reuse vmalloc helpers */
+- .get_addr = snd_dma_vmalloc_get_addr,
+ .get_page = snd_dma_vmalloc_get_page,
+ .get_chunk_size = snd_dma_vmalloc_get_chunk_size,
+ };
+--
+2.39.0
+
--- /dev/null
+From 4ea53b7cd10a006c8703f5aa37eb58c2b8b7e23d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 16:07:40 -0500
+Subject: arm64: dts: freescale: imx8dxl: fix sc_pwrkey's property name
+ linux,keycode
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit cfb47bf5a470bdd80e8ac2f7b2f3a34563ecd4ea ]
+
+linux,keycode should be "linux,keycodes" according binding-doc
+Documentation/devicetree/bindings/input/fsl,scu-key.yaml
+
+Fixes: f537ee7f1e76 ("arm64: dts: freescale: add i.MX8DXL SoC support")
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8dxl.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8dxl.dtsi b/arch/arm64/boot/dts/freescale/imx8dxl.dtsi
+index 5ddbda0b4def..f2c4d13b2f3c 100644
+--- a/arch/arm64/boot/dts/freescale/imx8dxl.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8dxl.dtsi
+@@ -157,7 +157,7 @@
+
+ sc_pwrkey: keys {
+ compatible = "fsl,imx8qxp-sc-key", "fsl,imx-sc-key";
+- linux,keycode = <KEY_POWER>;
++ linux,keycodes = <KEY_POWER>;
+ wakeup-source;
+ };
+
+--
+2.39.0
+
--- /dev/null
+From f62189fe2d77d2ca4ed3ff227ab08797dfdb27d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 11:04:02 -0300
+Subject: arm64: dts: imx8m-venice: Remove incorrect 'uart-has-rtscts'
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit fca053893e8d5be8173c92876c6329cbee78b880 ]
+
+The following build warnings are seen when running:
+
+make dtbs_check DT_SCHEMA_FILES=fsl-imx-uart.yaml
+
+arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dtb: serial@30860000: cts-gpios: False schema does not allow [[33, 3, 1]]
+ From schema: Documentation/devicetree/bindings/serial/fsl-imx-uart.yaml
+arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dtb: serial@30860000: rts-gpios: False schema does not allow [[33, 5, 1]]
+ From schema: Documentation/devicetree/bindings/serial/fsl-imx-uart.yaml
+...
+
+The imx8m Venice Gateworks boards do not expose the UART RTS and CTS
+as native UART pins, so 'uart-has-rtscts' should not be used.
+
+Using 'uart-has-rtscts' with 'rts-gpios' is an invalid combination
+detected by serial.yaml.
+
+Fix the problem by removing the incorrect 'uart-has-rtscts' property.
+
+Fixes: 27c8f4ccc1b9 ("arm64: dts: imx8mm-venice-gw72xx-0x: add dt overlays for serial modes")
+Fixes: d9a9a7cf32c9 ("arm64: dts: imx8m{m,n}-venice-*: add missing uart-has-rtscts property to UARTs")
+Fixes: 870f645b396b ("arm64: dts: imx8mp-venice-gw74xx: add WiFi/BT module support")
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Acked-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs232-rts.dts | 1 -
+ .../boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs232-rts.dts | 1 -
+ arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx.dtsi | 1 -
+ arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts | 3 ---
+ arch/arm64/boot/dts/freescale/imx8mm-venice-gw7902.dts | 3 ---
+ arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dts | 1 -
+ arch/arm64/boot/dts/freescale/imx8mn-venice-gw7902.dts | 1 -
+ arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts | 1 -
+ 8 files changed, 12 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs232-rts.dts b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs232-rts.dts
+index 3ea73a6886ff..f6ad1a4b8b66 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs232-rts.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs232-rts.dts
+@@ -33,7 +33,6 @@
+ pinctrl-0 = <&pinctrl_uart2>;
+ rts-gpios = <&gpio5 29 GPIO_ACTIVE_LOW>;
+ cts-gpios = <&gpio5 28 GPIO_ACTIVE_LOW>;
+- uart-has-rtscts;
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs232-rts.dts b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs232-rts.dts
+index 2fa635e1c1a8..1f8ea20dfafc 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs232-rts.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs232-rts.dts
+@@ -33,7 +33,6 @@
+ pinctrl-0 = <&pinctrl_uart2>;
+ rts-gpios = <&gpio5 29 GPIO_ACTIVE_LOW>;
+ cts-gpios = <&gpio5 28 GPIO_ACTIVE_LOW>;
+- uart-has-rtscts;
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx.dtsi
+index 244ef8d6cc68..7761d5671cb1 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx.dtsi
+@@ -222,7 +222,6 @@
+ pinctrl-0 = <&pinctrl_uart3>, <&pinctrl_bten>;
+ cts-gpios = <&gpio5 8 GPIO_ACTIVE_LOW>;
+ rts-gpios = <&gpio5 9 GPIO_ACTIVE_LOW>;
+- uart-has-rtscts;
+ status = "okay";
+
+ bluetooth {
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts
+index 72311b55f06d..5a770c8b777e 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts
+@@ -721,7 +721,6 @@
+ dtr-gpios = <&gpio1 14 GPIO_ACTIVE_LOW>;
+ dsr-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>;
+ dcd-gpios = <&gpio1 11 GPIO_ACTIVE_LOW>;
+- uart-has-rtscts;
+ status = "okay";
+ };
+
+@@ -737,7 +736,6 @@
+ pinctrl-0 = <&pinctrl_uart3>, <&pinctrl_uart3_gpio>;
+ cts-gpios = <&gpio4 10 GPIO_ACTIVE_LOW>;
+ rts-gpios = <&gpio4 9 GPIO_ACTIVE_LOW>;
+- uart-has-rtscts;
+ status = "okay";
+ };
+
+@@ -746,7 +744,6 @@
+ pinctrl-0 = <&pinctrl_uart4>, <&pinctrl_uart4_gpio>;
+ cts-gpios = <&gpio5 11 GPIO_ACTIVE_LOW>;
+ rts-gpios = <&gpio5 12 GPIO_ACTIVE_LOW>;
+- uart-has-rtscts;
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7902.dts b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7902.dts
+index 31f4c735fe4f..ba0b3f507855 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7902.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7902.dts
+@@ -651,7 +651,6 @@
+ pinctrl-0 = <&pinctrl_uart1>, <&pinctrl_uart1_gpio>;
+ rts-gpios = <&gpio4 10 GPIO_ACTIVE_LOW>;
+ cts-gpios = <&gpio4 24 GPIO_ACTIVE_LOW>;
+- uart-has-rtscts;
+ status = "okay";
+ };
+
+@@ -668,7 +667,6 @@
+ pinctrl-0 = <&pinctrl_uart3>, <&pinctrl_uart3_gpio>;
+ rts-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
+ cts-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
+- uart-has-rtscts;
+ status = "okay";
+
+ bluetooth {
+@@ -686,7 +684,6 @@
+ dtr-gpios = <&gpio4 3 GPIO_ACTIVE_LOW>;
+ dsr-gpios = <&gpio4 4 GPIO_ACTIVE_LOW>;
+ dcd-gpios = <&gpio4 6 GPIO_ACTIVE_LOW>;
+- uart-has-rtscts;
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dts b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dts
+index 19f6d2943d26..8e861b920d09 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dts
+@@ -572,7 +572,6 @@
+ dtr-gpios = <&gpio1 0 GPIO_ACTIVE_LOW>;
+ dsr-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>;
+ dcd-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>;
+- uart-has-rtscts;
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mn-venice-gw7902.dts b/arch/arm64/boot/dts/freescale/imx8mn-venice-gw7902.dts
+index dd4302ac1de4..e7362d7615bd 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mn-venice-gw7902.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mn-venice-gw7902.dts
+@@ -631,7 +631,6 @@
+ pinctrl-0 = <&pinctrl_uart3>, <&pinctrl_uart3_gpio>;
+ rts-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
+ cts-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
+- uart-has-rtscts;
+ status = "okay";
+
+ bluetooth {
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts
+index 06b4c93c5876..d68ef4f0726f 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts
+@@ -611,7 +611,6 @@
+ pinctrl-0 = <&pinctrl_uart3>, <&pinctrl_uart3_gpio>;
+ cts-gpios = <&gpio3 21 GPIO_ACTIVE_LOW>;
+ rts-gpios = <&gpio3 22 GPIO_ACTIVE_LOW>;
+- uart-has-rtscts;
+ status = "okay";
+
+ bluetooth {
+--
+2.39.0
+
--- /dev/null
+From 741f0f9a5d820a5208119d6f11ee556a40efbacd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Jan 2023 22:35:03 +0100
+Subject: arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierluigi Passaro <pierluigi.p@variscite.com>
+
+[ Upstream commit 47123900f3e4a7f769631d6ec15abf44086276f6 ]
+
+According section
+ 8.2.5.313 Select Input Register (IOMUXC_UART1_RXD_SELECT_INPUT)
+of
+ i.MX 8M Mini Applications Processor Reference Manual, Rev. 3, 11/2020
+the required setting for this specific pin configuration is "1"
+
+Signed-off-by: Pierluigi Passaro <pierluigi.p@variscite.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Fixes: c1c9d41319c3 ("dt-bindings: imx: Add pinctrl binding doc for imx8mm")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h
+index 83c8f715cd90..b1f11098d248 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h
++++ b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h
+@@ -602,7 +602,7 @@
+ #define MX8MM_IOMUXC_UART1_RXD_GPIO5_IO22 0x234 0x49C 0x000 0x5 0x0
+ #define MX8MM_IOMUXC_UART1_RXD_TPSMP_HDATA24 0x234 0x49C 0x000 0x7 0x0
+ #define MX8MM_IOMUXC_UART1_TXD_UART1_DCE_TX 0x238 0x4A0 0x000 0x0 0x0
+-#define MX8MM_IOMUXC_UART1_TXD_UART1_DTE_RX 0x238 0x4A0 0x4F4 0x0 0x0
++#define MX8MM_IOMUXC_UART1_TXD_UART1_DTE_RX 0x238 0x4A0 0x4F4 0x0 0x1
+ #define MX8MM_IOMUXC_UART1_TXD_ECSPI3_MOSI 0x238 0x4A0 0x000 0x1 0x0
+ #define MX8MM_IOMUXC_UART1_TXD_GPIO5_IO23 0x238 0x4A0 0x000 0x5 0x0
+ #define MX8MM_IOMUXC_UART1_TXD_TPSMP_HDATA25 0x238 0x4A0 0x000 0x7 0x0
+--
+2.39.0
+
--- /dev/null
+From fb2253bd739d56a269035b365f9ce206f5d9824c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jan 2023 15:01:52 +0100
+Subject: arm64: dts: imx8mm-verdin: Do not power down eth-phy
+
+From: Philippe Schenker <philippe.schenker@toradex.com>
+
+[ Upstream commit 39c95d0c357d7ef76aea958c1bece6b24f9b2e7e ]
+
+Currently if suspending using either freeze or memory state, the fec
+driver tries to power down the phy which leads to crash of the kernel
+and non-responsible kernel with the following call trace:
+
+[ 24.839889 ] Call trace:
+[ 24.839892 ] phy_error+0x18/0x60
+[ 24.839898 ] kszphy_handle_interrupt+0x6c/0x80
+[ 24.839903 ] phy_interrupt+0x20/0x2c
+[ 24.839909 ] irq_thread_fn+0x30/0xa0
+[ 24.839919 ] irq_thread+0x178/0x2c0
+[ 24.839925 ] kthread+0x154/0x160
+[ 24.839932 ] ret_from_fork+0x10/0x20
+
+Since there is currently no functionality in the phy subsystem to power
+down phys let's just disable the feature of powering-down the ethernet
+phy.
+
+Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini")
+Signed-off-by: Philippe Schenker <philippe.schenker@toradex.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi
+index bcab830c6e95..59445f916d7f 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi
+@@ -98,6 +98,7 @@
+ off-on-delay = <500000>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_reg_eth>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-max-microvolt = <3300000>;
+ regulator-min-microvolt = <3300000>;
+--
+2.39.0
+
--- /dev/null
+From 5419eacbb98f30506fc41ee0b2e92ef9ed33715a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 13:23:56 +0200
+Subject: ASoC: amd: acp-es8336: Drop reference count of ACPI device after use
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit d784fc8be6814b31854f7b529919ca4506ff8066 ]
+
+Theoretically the device might gone if its reference count drops to 0.
+This might be the case when we try to find the first physical node of
+the ACPI device. We need to keep reference to it until we get a result
+of the above mentioned call. Refactor the code to drop the reference
+count at the correct place.
+
+While at it, move to acpi_dev_put() as symmetrical call to the
+acpi_dev_get_first_match_dev().
+
+Fixes: 02527c3f2300 ("ASoC: amd: add Machine driver for Jadeite platform")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+Link: https://lore.kernel.org/r/20230112112356.67643-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp-es8336.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/amd/acp-es8336.c b/sound/soc/amd/acp-es8336.c
+index 2fe8df86053a..89499542c803 100644
+--- a/sound/soc/amd/acp-es8336.c
++++ b/sound/soc/amd/acp-es8336.c
+@@ -198,9 +198,11 @@ static int st_es8336_late_probe(struct snd_soc_card *card)
+ int ret;
+
+ adev = acpi_dev_get_first_match_dev("ESSX8336", NULL, -1);
+- if (adev)
+- put_device(&adev->dev);
++ if (!adev)
++ return -ENODEV;
++
+ codec_dev = acpi_get_first_physical_node(adev);
++ acpi_dev_put(adev);
+ if (!codec_dev)
+ dev_err(card->dev, "can not find codec dev\n");
+
+--
+2.39.0
+
--- /dev/null
+From 3586444c1dcc8cc075f7bf15903b973ec0423487 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 20:03:08 +0100
+Subject: ASoC: Intel: avs: Implement PCI shutdown
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit f89d783d68dcc6b2ce4fe3bda972ae0f84df0dca ]
+
+On shutdown reference to i915 driver needs to be released to not spam
+logs with unnecessary warnings. While at it do some additional cleanup
+to make sure DSP is powered down and interrupts from device are
+disabled.
+
+Fixes: 1affc44ea5dd ("ASoC: Intel: avs: PCI driver implementation")
+Reported-by: Kornel Dulęba <korneld@google.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://lore.kernel.org/r/20230113190310.1451693-2-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/avs/core.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c
+index 4f93639ce488..5bb3eee2f783 100644
+--- a/sound/soc/intel/avs/core.c
++++ b/sound/soc/intel/avs/core.c
+@@ -476,6 +476,29 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ return ret;
+ }
+
++static void avs_pci_shutdown(struct pci_dev *pci)
++{
++ struct hdac_bus *bus = pci_get_drvdata(pci);
++ struct avs_dev *adev = hdac_to_avs(bus);
++
++ cancel_work_sync(&adev->probe_work);
++ avs_ipc_block(adev->ipc);
++
++ snd_hdac_stop_streams(bus);
++ avs_dsp_op(adev, int_control, false);
++ snd_hdac_ext_bus_ppcap_int_enable(bus, false);
++ snd_hdac_ext_bus_link_power_down_all(bus);
++
++ snd_hdac_bus_stop_chip(bus);
++ snd_hdac_display_power(bus, HDA_CODEC_IDX_CONTROLLER, false);
++
++ if (avs_platattr_test(adev, CLDMA))
++ pci_free_irq(pci, 0, &code_loader);
++ pci_free_irq(pci, 0, adev);
++ pci_free_irq(pci, 0, bus);
++ pci_free_irq_vectors(pci);
++}
++
+ static void avs_pci_remove(struct pci_dev *pci)
+ {
+ struct hdac_device *hdev, *save;
+@@ -679,6 +702,7 @@ static struct pci_driver avs_pci_driver = {
+ .id_table = avs_ids,
+ .probe = avs_pci_probe,
+ .remove = avs_pci_remove,
++ .shutdown = avs_pci_shutdown,
+ .driver = {
+ .pm = &avs_dev_pm,
+ },
+--
+2.39.0
+
--- /dev/null
+From f9ff09e3ad46aa8d4b35dfbd8a079ceb7a2df3b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 13:28:48 +0200
+Subject: ASoC: Intel: bytcht_es8316: Drop reference count of ACPI device after
+ use
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 6b1c0bd6fdefbf3c3d75680c2708f5423ef72e46 ]
+
+Theoretically the device might gone if its reference count drops to 0.
+This might be the case when we try to find the first physical node of
+the ACPI device. We need to keep reference to it until we get a result
+of the above mentioned call. Refactor the code to drop the reference
+count at the correct place.
+
+While at it, move to acpi_dev_put() as symmetrical call to the
+acpi_dev_get_first_match_dev().
+
+Fixes: 3c22a73fb873 ("ASoC: Intel: bytcht_es8316: fix HID handling")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230112112852.67714-2-andriy.shevchenko@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcht_es8316.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index a935c5fd9edb..4dd37848b30e 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -497,21 +497,28 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev)
+ if (adev) {
+ snprintf(codec_name, sizeof(codec_name),
+ "i2c-%s", acpi_dev_name(adev));
+- put_device(&adev->dev);
+ byt_cht_es8316_dais[dai_index].codecs->name = codec_name;
+ } else {
+ dev_err(dev, "Error cannot find '%s' dev\n", mach->id);
+ return -ENXIO;
+ }
+
++ codec_dev = acpi_get_first_physical_node(adev);
++ acpi_dev_put(adev);
++ if (!codec_dev)
++ return -EPROBE_DEFER;
++ priv->codec_dev = get_device(codec_dev);
++
+ /* override platform name, if required */
+ byt_cht_es8316_card.dev = dev;
+ platform_name = mach->mach_params.platform;
+
+ ret = snd_soc_fixup_dai_links_platform_name(&byt_cht_es8316_card,
+ platform_name);
+- if (ret)
++ if (ret) {
++ put_device(codec_dev);
+ return ret;
++ }
+
+ /* Check for BYTCR or other platform and setup quirks */
+ dmi_id = dmi_first_match(byt_cht_es8316_quirk_table);
+@@ -539,13 +546,10 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev)
+
+ /* get the clock */
+ priv->mclk = devm_clk_get(dev, "pmc_plt_clk_3");
+- if (IS_ERR(priv->mclk))
++ if (IS_ERR(priv->mclk)) {
++ put_device(codec_dev);
+ return dev_err_probe(dev, PTR_ERR(priv->mclk), "clk_get pmc_plt_clk_3 failed\n");
+-
+- codec_dev = acpi_get_first_physical_node(adev);
+- if (!codec_dev)
+- return -EPROBE_DEFER;
+- priv->codec_dev = get_device(codec_dev);
++ }
+
+ if (quirk & BYT_CHT_ES8316_JD_INVERTED)
+ props[cnt++] = PROPERTY_ENTRY_BOOL("everest,jack-detect-inverted");
+--
+2.39.0
+
--- /dev/null
+From 846f2e32ea985246796e1d411816befd2fd90b0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 13:28:50 +0200
+Subject: ASoC: Intel: bytcr_rt5640: Drop reference count of ACPI device after
+ use
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit cbf87bcf46e399e9a5288430d940efbad3551c68 ]
+
+Theoretically the device might gone if its reference count drops to 0.
+This might be the case when we try to find the first physical node of
+the ACPI device. We need to keep reference to it until we get a result
+of the above mentioned call. Refactor the code to drop the reference
+count at the correct place.
+
+While at it, move to acpi_dev_put() as symmetrical call to the
+acpi_dev_get_first_match_dev().
+
+Fixes: a232b96dcece ("ASoC: Intel: bytcr_rt5640: use HID translation util")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230112112852.67714-4-andriy.shevchenko@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index ddd2625bed90..4f46f52c38e4 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -1626,13 +1626,18 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
+ if (adev) {
+ snprintf(byt_rt5640_codec_name, sizeof(byt_rt5640_codec_name),
+ "i2c-%s", acpi_dev_name(adev));
+- put_device(&adev->dev);
+ byt_rt5640_dais[dai_index].codecs->name = byt_rt5640_codec_name;
+ } else {
+ dev_err(dev, "Error cannot find '%s' dev\n", mach->id);
+ return -ENXIO;
+ }
+
++ codec_dev = acpi_get_first_physical_node(adev);
++ acpi_dev_put(adev);
++ if (!codec_dev)
++ return -EPROBE_DEFER;
++ priv->codec_dev = get_device(codec_dev);
++
+ /*
+ * swap SSP0 if bytcr is detected
+ * (will be overridden if DMI quirk is detected)
+@@ -1707,11 +1712,6 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
+ byt_rt5640_quirk = quirk_override;
+ }
+
+- codec_dev = acpi_get_first_physical_node(adev);
+- if (!codec_dev)
+- return -EPROBE_DEFER;
+- priv->codec_dev = get_device(codec_dev);
+-
+ if (byt_rt5640_quirk & BYT_RT5640_JD_HP_ELITEP_1000G2) {
+ acpi_dev_add_driver_gpios(ACPI_COMPANION(priv->codec_dev),
+ byt_rt5640_hp_elitepad_1000g2_gpios);
+--
+2.39.0
+
--- /dev/null
+From 4025a0bc5017b66fa01627419567cb367df46e4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 13:28:49 +0200
+Subject: ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after
+ use
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 721858823d7cdc8f2a897579b040e935989f6f02 ]
+
+Theoretically the device might gone if its reference count drops to 0.
+This might be the case when we try to find the first physical node of
+the ACPI device. We need to keep reference to it until we get a result
+of the above mentioned call. Refactor the code to drop the reference
+count at the correct place.
+
+While at it, move to acpi_dev_put() as symmetrical call to the
+acpi_dev_get_first_match_dev().
+
+Fixes: 02c0a3b3047f ("ASoC: Intel: bytcr_rt5651: add MCLK, quirks and cleanups")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230112112852.67714-3-andriy.shevchenko@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5651.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
+index 2beb686768f2..d74d184e1c7f 100644
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -922,7 +922,6 @@ static int snd_byt_rt5651_mc_probe(struct platform_device *pdev)
+ if (adev) {
+ snprintf(byt_rt5651_codec_name, sizeof(byt_rt5651_codec_name),
+ "i2c-%s", acpi_dev_name(adev));
+- put_device(&adev->dev);
+ byt_rt5651_dais[dai_index].codecs->name = byt_rt5651_codec_name;
+ } else {
+ dev_err(dev, "Error cannot find '%s' dev\n", mach->id);
+@@ -930,6 +929,7 @@ static int snd_byt_rt5651_mc_probe(struct platform_device *pdev)
+ }
+
+ codec_dev = acpi_get_first_physical_node(adev);
++ acpi_dev_put(adev);
+ if (!codec_dev)
+ return -EPROBE_DEFER;
+ priv->codec_dev = get_device(codec_dev);
+--
+2.39.0
+
--- /dev/null
+From 2f29cc175c02a95178aea6db188d79c9b54d8644 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 13:28:51 +0200
+Subject: ASoC: Intel: bytcr_wm5102: Drop reference count of ACPI device after
+ use
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit c8aa49abdeda2ab587aadb083e670f6aa0236f93 ]
+
+Theoretically the device might gone if its reference count drops to 0.
+This might be the case when we try to find the first physical node of
+the ACPI device. We need to keep reference to it until we get a result
+of the above mentioned call. Refactor the code to drop the reference
+count at the correct place.
+
+While at it, move to acpi_dev_put() as symmetrical call to the
+acpi_dev_get_first_match_dev().
+
+Fixes: 9a87fc1e0619 ("ASoC: Intel: bytcr_wm5102: Add machine driver for BYT/WM5102")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230112112852.67714-5-andriy.shevchenko@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_wm5102.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_wm5102.c b/sound/soc/intel/boards/bytcr_wm5102.c
+index 45a6805787f5..f8da1bcd010e 100644
+--- a/sound/soc/intel/boards/bytcr_wm5102.c
++++ b/sound/soc/intel/boards/bytcr_wm5102.c
+@@ -411,9 +411,9 @@ static int snd_byt_wm5102_mc_probe(struct platform_device *pdev)
+ return -ENOENT;
+ }
+ snprintf(codec_name, sizeof(codec_name), "spi-%s", acpi_dev_name(adev));
+- put_device(&adev->dev);
+
+ codec_dev = bus_find_device_by_name(&spi_bus_type, NULL, codec_name);
++ acpi_dev_put(adev);
+ if (!codec_dev)
+ return -EPROBE_DEFER;
+
+--
+2.39.0
+
--- /dev/null
+From 8aa5b026f83d17e1433c1ce6c3c19f2a2d702d80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 13:28:52 +0200
+Subject: ASoC: Intel: sof_es8336: Drop reference count of ACPI device after
+ use
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 64e57b2195725c1ae2246a8a2ce224abb60620ac ]
+
+Theoretically the device might gone if its reference count drops to 0.
+This might be the case when we try to find the first physical node of
+the ACPI device. We need to keep reference to it until we get a result
+of the above mentioned call. Refactor the code to drop the reference
+count at the correct place.
+
+While at it, move to acpi_dev_put() as symmetrical call to the
+acpi_dev_get_first_match_dev().
+
+Fixes: a164137ce91a ("ASoC: Intel: add machine driver for SOF+ES8336")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230112112852.67714-6-andriy.shevchenko@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_es8336.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c
+index 773e5d1d87d4..894b6610b9e2 100644
+--- a/sound/soc/intel/boards/sof_es8336.c
++++ b/sound/soc/intel/boards/sof_es8336.c
+@@ -681,7 +681,6 @@ static int sof_es8336_probe(struct platform_device *pdev)
+ if (adev) {
+ snprintf(codec_name, sizeof(codec_name),
+ "i2c-%s", acpi_dev_name(adev));
+- put_device(&adev->dev);
+ dai_links[0].codecs->name = codec_name;
+
+ /* also fixup codec dai name if relevant */
+@@ -692,16 +691,19 @@ static int sof_es8336_probe(struct platform_device *pdev)
+ return -ENXIO;
+ }
+
+- ret = snd_soc_fixup_dai_links_platform_name(&sof_es8336_card,
+- mach->mach_params.platform);
+- if (ret)
+- return ret;
+-
+ codec_dev = acpi_get_first_physical_node(adev);
++ acpi_dev_put(adev);
+ if (!codec_dev)
+ return -EPROBE_DEFER;
+ priv->codec_dev = get_device(codec_dev);
+
++ ret = snd_soc_fixup_dai_links_platform_name(&sof_es8336_card,
++ mach->mach_params.platform);
++ if (ret) {
++ put_device(codec_dev);
++ return ret;
++ }
++
+ if (quirk & SOF_ES8336_JD_INVERTED)
+ props[cnt++] = PROPERTY_ENTRY_BOOL("everest,jack-detect-inverted");
+
+--
+2.39.0
+
--- /dev/null
+From 796c68693cc5781f2e2e78d0ff2731915ae0e97b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 17:58:54 +0300
+Subject: ASoC: SOF: ipc4-mtrace: prevent underflow in
+ sof_ipc4_priority_mask_dfs_write()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit ea57680af47587397f5005d7758022441ed66d54 ]
+
+The "id" comes from the user. Change the type to unsigned to prevent
+an array underflow.
+
+Fixes: f4ea22f7aa75 ("ASoC: SOF: ipc4: Add support for mtrace log extraction")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/Y8laruWOEwOC/dx9@kili
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4-mtrace.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/sof/ipc4-mtrace.c b/sound/soc/sof/ipc4-mtrace.c
+index 70dea8ae706e..0ec6ef681012 100644
+--- a/sound/soc/sof/ipc4-mtrace.c
++++ b/sound/soc/sof/ipc4-mtrace.c
+@@ -344,9 +344,10 @@ static ssize_t sof_ipc4_priority_mask_dfs_write(struct file *file,
+ size_t count, loff_t *ppos)
+ {
+ struct sof_mtrace_priv *priv = file->private_data;
+- int id, ret;
++ unsigned int id;
+ char *buf;
+ u32 mask;
++ int ret;
+
+ /*
+ * To update Nth mask entry, write:
+@@ -357,9 +358,9 @@ static ssize_t sof_ipc4_priority_mask_dfs_write(struct file *file,
+ if (IS_ERR(buf))
+ return PTR_ERR(buf);
+
+- ret = sscanf(buf, "%d,0x%x", &id, &mask);
++ ret = sscanf(buf, "%u,0x%x", &id, &mask);
+ if (ret != 2) {
+- ret = sscanf(buf, "%d,%x", &id, &mask);
++ ret = sscanf(buf, "%u,%x", &id, &mask);
+ if (ret != 2) {
+ ret = -EINVAL;
+ goto out;
+--
+2.39.0
+
--- /dev/null
+From 1ff97ff6a50a22ea6c8f7eacc82f11feacc7d817 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 12:27:41 +0900
+Subject: ata: libata: Fix sata_down_spd_limit() when no link speed is reported
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+[ Upstream commit 69f2c9346313ba3d3dfa4091ff99df26c67c9021 ]
+
+Commit 2dc0b46b5ea3 ("libata: sata_down_spd_limit should return if
+driver has not recorded sstatus speed") changed the behavior of
+sata_down_spd_limit() to return doing nothing if a drive does not report
+a current link speed, to avoid reducing the link speed to the lowest 1.5
+Gbps speed.
+
+However, the change assumed that a speed was recorded before probing
+(e.g. before a suspend/resume) and set in link->sata_spd. This causes
+problems with adapters/drives combination failing to establish a link
+speed during probe autonegotiation. One example reported of this problem
+is an mvebu adapter with a 3Gbps port-multiplier box: autonegotiation
+fails, leaving no recorded link speed and no reported current link
+speed. Probe retries also fail as no action is taken by sata_set_spd()
+after each retry.
+
+Fix this by returning early in sata_down_spd_limit() only if we do have
+a recorded link speed, that is, if link->sata_spd is not 0. With this
+fix, a failed probe not leading to a recorded link speed is retried at
+the lower 1.5 Gbps speed, with the link speed potentially increased
+later on the second revalidate of the device if the device reports
+that it supports higher link speeds.
+
+Reported-by: Marius Dinu <marius@psihoexpert.ro>
+Fixes: 2dc0b46b5ea3 ("libata: sata_down_spd_limit should return if driver has not recorded sstatus speed")
+Reviewed-by: Niklas Cassel <niklas.cassel@wdc.com>
+Tested-by: Marius Dinu <marius@psihoexpert.ro>
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index d3ce5c383f3a..26a75f5cce95 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -3108,7 +3108,7 @@ int sata_down_spd_limit(struct ata_link *link, u32 spd_limit)
+ */
+ if (spd > 1)
+ mask &= (1 << (spd - 1)) - 1;
+- else
++ else if (link->sata_spd)
+ return -EINVAL;
+
+ /* were we already at the bottom? */
+--
+2.39.0
+
--- /dev/null
+From 2caec17ccc2ec59bc4be9d1b298a5ff24e8a4f75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 22:02:33 -0800
+Subject: bcache: Silence memcpy() run-time false positive warnings
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit be0d8f48ad97f5b775b0af3310343f676dbf318a ]
+
+struct bkey has internal padding in a union, but it isn't always named
+the same (e.g. key ## _pad, key_p, etc). This makes it extremely hard
+for the compiler to reason about the available size of copies done
+against such keys. Use unsafe_memcpy() for now, to silence the many
+run-time false positive warnings:
+
+ memcpy: detected field-spanning write (size 264) of single field "&i->j" at drivers/md/bcache/journal.c:152 (size 240)
+ memcpy: detected field-spanning write (size 24) of single field "&b->key" at drivers/md/bcache/btree.c:939 (size 16)
+ memcpy: detected field-spanning write (size 24) of single field "&temp.key" at drivers/md/bcache/extents.c:428 (size 16)
+
+Reported-by: Alexandre Pereira <alexpereira@disroot.org>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216785
+Acked-by: Coly Li <colyli@suse.de>
+Cc: Kent Overstreet <kent.overstreet@gmail.com>
+Cc: linux-bcache@vger.kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230106060229.never.047-kees@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/bcache_ondisk.h | 3 ++-
+ drivers/md/bcache/journal.c | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/bcache/bcache_ondisk.h b/drivers/md/bcache/bcache_ondisk.h
+index 97413586195b..f96034e0ba4f 100644
+--- a/drivers/md/bcache/bcache_ondisk.h
++++ b/drivers/md/bcache/bcache_ondisk.h
+@@ -106,7 +106,8 @@ static inline unsigned long bkey_bytes(const struct bkey *k)
+ return bkey_u64s(k) * sizeof(__u64);
+ }
+
+-#define bkey_copy(_dest, _src) memcpy(_dest, _src, bkey_bytes(_src))
++#define bkey_copy(_dest, _src) unsafe_memcpy(_dest, _src, bkey_bytes(_src), \
++ /* bkey is always padded */)
+
+ static inline void bkey_copy_key(struct bkey *dest, const struct bkey *src)
+ {
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index e5da469a4235..c182c21de2e8 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -149,7 +149,8 @@ reread: left = ca->sb.bucket_size - offset;
+ bytes, GFP_KERNEL);
+ if (!i)
+ return -ENOMEM;
+- memcpy(&i->j, j, bytes);
++ unsafe_memcpy(&i->j, j, bytes,
++ /* "bytes" was calculated by set_bytes() above */);
+ /* Add to the location after 'where' points to */
+ list_add(&i->list, where);
+ ret = 1;
+--
+2.39.0
+
--- /dev/null
+From e6711f08f95034aec1e04ff3e9330e8f48782480 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 09:41:36 +0800
+Subject: block, bfq: fix uaf for bfqq in bic_set_bfqq()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit b600de2d7d3a16f9007fad1bdae82a3951a26af2 ]
+
+After commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'"),
+bic->bfqq will be accessed in bic_set_bfqq(), however, in some context
+bic->bfqq will be freed, and bic_set_bfqq() is called with the freed
+bic->bfqq.
+
+Fix the problem by always freeing bfqq after bic_set_bfqq().
+
+Fixes: 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'")
+Reported-and-tested-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230130014136.591038-1-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-cgroup.c | 2 +-
+ block/bfq-iosched.c | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
+index dfb6d1d8bd46..60b4299bec8e 100644
+--- a/block/bfq-cgroup.c
++++ b/block/bfq-cgroup.c
+@@ -761,8 +761,8 @@ static void *__bfq_bic_change_cgroup(struct bfq_data *bfqd,
+ * request from the old cgroup.
+ */
+ bfq_put_cooperator(sync_bfqq);
+- bfq_release_process_ref(bfqd, sync_bfqq);
+ bic_set_bfqq(bic, NULL, true);
++ bfq_release_process_ref(bfqd, sync_bfqq);
+ }
+ }
+ }
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 917939b60ef8..ff9d23889415 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -5491,9 +5491,11 @@ static void bfq_check_ioprio_change(struct bfq_io_cq *bic, struct bio *bio)
+
+ bfqq = bic_to_bfqq(bic, false);
+ if (bfqq) {
+- bfq_release_process_ref(bfqd, bfqq);
++ struct bfq_queue *old_bfqq = bfqq;
++
+ bfqq = bfq_get_queue(bfqd, bio, false, bic, true);
+ bic_set_bfqq(bic, bfqq, false);
++ bfq_release_process_ref(bfqd, old_bfqq);
+ }
+
+ bfqq = bic_to_bfqq(bic, true);
+--
+2.39.0
+
--- /dev/null
+From ba6460877c5b3e323e12d59f16cbdde4ce248b37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Dec 2022 11:31:55 +0800
+Subject: block, bfq: replace 0/1 with false/true in bic apis
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 337366e02b370d2800110fbc99940f6ddddcbdfa ]
+
+Just to make the code a litter cleaner, there are no functional changes.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20221214033155.3455754-3-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: b600de2d7d3a ("block, bfq: fix uaf for bfqq in bic_set_bfqq()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-cgroup.c | 8 ++++----
+ block/bfq-iosched.c | 4 ++--
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
+index 7d624a3a3f0f..dfb6d1d8bd46 100644
+--- a/block/bfq-cgroup.c
++++ b/block/bfq-cgroup.c
+@@ -718,15 +718,15 @@ static void *__bfq_bic_change_cgroup(struct bfq_data *bfqd,
+ struct bfq_io_cq *bic,
+ struct bfq_group *bfqg)
+ {
+- struct bfq_queue *async_bfqq = bic_to_bfqq(bic, 0);
+- struct bfq_queue *sync_bfqq = bic_to_bfqq(bic, 1);
++ struct bfq_queue *async_bfqq = bic_to_bfqq(bic, false);
++ struct bfq_queue *sync_bfqq = bic_to_bfqq(bic, true);
+ struct bfq_entity *entity;
+
+ if (async_bfqq) {
+ entity = &async_bfqq->entity;
+
+ if (entity->sched_data != &bfqg->sched_data) {
+- bic_set_bfqq(bic, NULL, 0);
++ bic_set_bfqq(bic, NULL, false);
+ bfq_release_process_ref(bfqd, async_bfqq);
+ }
+ }
+@@ -762,7 +762,7 @@ static void *__bfq_bic_change_cgroup(struct bfq_data *bfqd,
+ */
+ bfq_put_cooperator(sync_bfqq);
+ bfq_release_process_ref(bfqd, sync_bfqq);
+- bic_set_bfqq(bic, NULL, 1);
++ bic_set_bfqq(bic, NULL, true);
+ }
+ }
+ }
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 7b894df32e32..917939b60ef8 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -3180,7 +3180,7 @@ bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic,
+ /*
+ * Merge queues (that is, let bic redirect its requests to new_bfqq)
+ */
+- bic_set_bfqq(bic, new_bfqq, 1);
++ bic_set_bfqq(bic, new_bfqq, true);
+ bfq_mark_bfqq_coop(new_bfqq);
+ /*
+ * new_bfqq now belongs to at least two bics (it is a shared queue):
+@@ -6627,7 +6627,7 @@ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq)
+ return bfqq;
+ }
+
+- bic_set_bfqq(bic, NULL, 1);
++ bic_set_bfqq(bic, NULL, true);
+
+ bfq_put_cooperator(bfqq);
+
+--
+2.39.0
+
--- /dev/null
+From 0fce056679bf830de1c3cfedf40ed027240fe5a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 02:05:52 -0500
+Subject: block: ublk: extending queue_size to fix overflow
+
+From: Liu Xiaodong <xiaodong.liu@intel.com>
+
+[ Upstream commit 29baef789c838bd5c02f50c88adbbc6b955aaf61 ]
+
+When validating drafted SPDK ublk target, in a case that
+assigning large queue depth to multiqueue ublk device,
+ublk target would run into a weird incorrect state. During
+rounds of review and debug, An overflow bug was found
+in ublk driver.
+
+In ublk_cmd.h, UBLK_MAX_QUEUE_DEPTH is 4096 which means
+each ublk queue depth can be set as large as 4096. But
+when setting qd for a ublk device,
+sizeof(struct ublk_queue) + depth * sizeof(struct ublk_io)
+will be larger than 65535 if qd is larger than 2728.
+Then queue_size is overflowed, and ublk_get_queue()
+references a wrong pointer position. The wrong content of
+ublk_queue elements will lead to out-of-bounds memory
+access.
+
+Extend queue_size in ublk_device as "unsigned int".
+
+Signed-off-by: Liu Xiaodong <xiaodong.liu@intel.com>
+Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver")
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20230131070552.115067-1-xiaodong.liu@intel.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/ublk_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
+index e54693204630..6368b56eacf1 100644
+--- a/drivers/block/ublk_drv.c
++++ b/drivers/block/ublk_drv.c
+@@ -137,7 +137,7 @@ struct ublk_device {
+
+ char *__queues;
+
+- unsigned short queue_size;
++ unsigned int queue_size;
+ struct ublksrv_ctrl_dev_info dev_info;
+
+ struct blk_mq_tag_set tag_set;
+--
+2.39.0
+
--- /dev/null
+From e979ec2158d753a572e5ee08b826b39d9896e306 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 13:21:48 +0100
+Subject: bpf: Add missing btf_put to register_btf_id_dtor_kfuncs
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 74bc3a5acc82f020d2e126f56c535d02d1e74e37 ]
+
+We take the BTF reference before we register dtors and we need
+to put it back when it's done.
+
+We probably won't se a problem with kernel BTF, but module BTF
+would stay loaded (because of the extra ref) even when its module
+is removed.
+
+Cc: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Fixes: 5ce937d613a4 ("bpf: Populate pairs of btf_id and destructor kfunc in btf")
+Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20230120122148.1522359-1-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index efdbba2a0230..a7c2f0c3fc19 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -7607,9 +7607,9 @@ int register_btf_id_dtor_kfuncs(const struct btf_id_dtor_kfunc *dtors, u32 add_c
+
+ sort(tab->dtors, tab->cnt, sizeof(tab->dtors[0]), btf_id_cmp_func, NULL);
+
+- return 0;
+ end:
+- btf_free_dtor_kfunc_tab(btf);
++ if (ret)
++ btf_free_dtor_kfunc_tab(btf);
+ btf_put(btf);
+ return ret;
+ }
+--
+2.39.0
+
--- /dev/null
+From 18e84f69d61455dd5f7501cc1bd4b6c1e2f952fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 12:48:15 -0800
+Subject: bpf: Fix a possible task gone issue with bpf_send_signal[_thread]()
+ helpers
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit bdb7fdb0aca8b96cef9995d3a57e251c2289322f ]
+
+In current bpf_send_signal() and bpf_send_signal_thread() helper
+implementation, irq_work is used to handle nmi context. Hao Sun
+reported in [1] that the current task at the entry of the helper
+might be gone during irq_work callback processing. To fix the issue,
+a reference is acquired for the current task before enqueuing into
+the irq_work so that the queued task is still available during
+irq_work callback processing.
+
+ [1] https://lore.kernel.org/bpf/20230109074425.12556-1-sunhao.th@gmail.com/
+
+Fixes: 8b401f9ed244 ("bpf: implement bpf_send_signal() helper")
+Tested-by: Hao Sun <sunhao.th@gmail.com>
+Reported-by: Hao Sun <sunhao.th@gmail.com>
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/r/20230118204815.3331855-1-yhs@fb.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index eb8c117cc8b6..9d4163abadf4 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -832,6 +832,7 @@ static void do_bpf_send_signal(struct irq_work *entry)
+
+ work = container_of(entry, struct send_signal_irq_work, irq_work);
+ group_send_sig_info(work->sig, SEND_SIG_PRIV, work->task, work->type);
++ put_task_struct(work->task);
+ }
+
+ static int bpf_send_signal_common(u32 sig, enum pid_type type)
+@@ -866,7 +867,7 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type)
+ * to the irq_work. The current task may change when queued
+ * irq works get executed.
+ */
+- work->task = current;
++ work->task = get_task_struct(current);
+ work->sig = sig;
+ work->type = type;
+ irq_work_queue(&work->irq_work);
+--
+2.39.0
+
--- /dev/null
+From 17874deb379044d0d0e75b0e7d5ba9b8042c6be1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jan 2023 16:46:30 +0800
+Subject: bpf: Fix off-by-one error in bpf_mem_cache_idx()
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 36024d023d139a0c8b552dc3b7f4dc7b4c139e8f ]
+
+According to the definition of sizes[NUM_CACHES], when the size passed
+to bpf_mem_cache_size() is 256, it should return 6 instead 7.
+
+Fixes: 7c8199e24fa0 ("bpf: Introduce any context BPF specific memory allocator.")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/r/20230118084630.3750680-1-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/memalloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c
+index 4901fa1048cd..6187c28d266f 100644
+--- a/kernel/bpf/memalloc.c
++++ b/kernel/bpf/memalloc.c
+@@ -71,7 +71,7 @@ static int bpf_mem_cache_idx(size_t size)
+ if (size <= 192)
+ return size_index[(size - 1) / 8] - 1;
+
+- return fls(size - 1) - 1;
++ return fls(size - 1) - 2;
+ }
+
+ #define NUM_CACHES 11
+--
+2.39.0
+
--- /dev/null
+From 89ca4b1cbbd9accd7550f97aa00952a3c2856424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 16:17:32 -0800
+Subject: bpf: Fix the kernel crash caused by bpf_setsockopt().
+
+From: Kui-Feng Lee <kuifeng@meta.com>
+
+[ Upstream commit 5416c9aea8323583e8696f0500b6142dfae80821 ]
+
+The kernel crash was caused by a BPF program attached to the
+"lsm_cgroup/socket_sock_rcv_skb" hook, which performed a call to
+`bpf_setsockopt()` in order to set the TCP_NODELAY flag as an
+example. Flags like TCP_NODELAY can prompt the kernel to flush a
+socket's outgoing queue, and this hook
+"lsm_cgroup/socket_sock_rcv_skb" is frequently triggered by
+softirqs. The issue was that in certain circumstances, when
+`tcp_write_xmit()` was called to flush the queue, it would also allow
+BH (bottom-half) to run. This could lead to our program attempting to
+flush the same socket recursively, which caused a `skbuff` to be
+unlinked twice.
+
+`security_sock_rcv_skb()` is triggered by `tcp_filter()`. This occurs
+before the sock ownership is checked in `tcp_v4_rcv()`. Consequently,
+if a bpf program runs on `security_sock_rcv_skb()` while under softirq
+conditions, it may not possess the lock needed for `bpf_setsockopt()`,
+thus presenting an issue.
+
+The patch fixes this issue by ensuring that a BPF program attached to
+the "lsm_cgroup/socket_sock_rcv_skb" hook is not allowed to call
+`bpf_setsockopt()`.
+
+The differences from v1 are
+ - changing commit log to explain holding the lock of the sock,
+ - emphasizing that TCP_NODELAY is not the only flag, and
+ - adding the fixes tag.
+
+v1: https://lore.kernel.org/bpf/20230125000244.1109228-1-kuifeng@meta.com/
+
+Signed-off-by: Kui-Feng Lee <kuifeng@meta.com>
+Fixes: 9113d7e48e91 ("bpf: expose bpf_{g,s}etsockopt to lsm cgroup")
+Link: https://lore.kernel.org/r/20230127001732.4162630-1-kuifeng@meta.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/bpf_lsm.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
+index d6c9b3705f24..e6a76da4bca7 100644
+--- a/kernel/bpf/bpf_lsm.c
++++ b/kernel/bpf/bpf_lsm.c
+@@ -51,7 +51,6 @@ BTF_SET_END(bpf_lsm_current_hooks)
+ */
+ BTF_SET_START(bpf_lsm_locked_sockopt_hooks)
+ #ifdef CONFIG_SECURITY_NETWORK
+-BTF_ID(func, bpf_lsm_socket_sock_rcv_skb)
+ BTF_ID(func, bpf_lsm_sock_graft)
+ BTF_ID(func, bpf_lsm_inet_csk_clone)
+ BTF_ID(func, bpf_lsm_inet_conn_established)
+--
+2.39.0
+
--- /dev/null
+From 96208e047412682e9629fb119ae85c7b3c939591 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 16:22:13 +0200
+Subject: bpf: Fix to preserve reg parent/live fields when copying range info
+
+From: Eduard Zingerman <eddyz87@gmail.com>
+
+[ Upstream commit 71f656a50176915d6813751188b5758daa8d012b ]
+
+Register range information is copied in several places. The intent is
+to transfer range/id information from one register/stack spill to
+another. Currently this is done using direct register assignment, e.g.:
+
+static void find_equal_scalars(..., struct bpf_reg_state *known_reg)
+{
+ ...
+ struct bpf_reg_state *reg;
+ ...
+ *reg = *known_reg;
+ ...
+}
+
+However, such assignments also copy the following bpf_reg_state fields:
+
+struct bpf_reg_state {
+ ...
+ struct bpf_reg_state *parent;
+ ...
+ enum bpf_reg_liveness live;
+ ...
+};
+
+Copying of these fields is accidental and incorrect, as could be
+demonstrated by the following example:
+
+ 0: call ktime_get_ns()
+ 1: r6 = r0
+ 2: call ktime_get_ns()
+ 3: r7 = r0
+ 4: if r0 > r6 goto +1 ; r0 & r6 are unbound thus generated
+ ; branch states are identical
+ 5: *(u64 *)(r10 - 8) = 0xdeadbeef ; 64-bit write to fp[-8]
+ --- checkpoint ---
+ 6: r1 = 42 ; r1 marked as written
+ 7: *(u8 *)(r10 - 8) = r1 ; 8-bit write, fp[-8] parent & live
+ ; overwritten
+ 8: r2 = *(u64 *)(r10 - 8)
+ 9: r0 = 0
+ 10: exit
+
+This example is unsafe because 64-bit write to fp[-8] at (5) is
+conditional, thus not all bytes of fp[-8] are guaranteed to be set
+when it is read at (8). However, currently the example passes
+verification.
+
+First, the execution path 1-10 is examined by verifier.
+Suppose that a new checkpoint is created by is_state_visited() at (6).
+After checkpoint creation:
+- r1.parent points to checkpoint.r1,
+- fp[-8].parent points to checkpoint.fp[-8].
+At (6) the r1.live is set to REG_LIVE_WRITTEN.
+At (7) the fp[-8].parent is set to r1.parent and fp[-8].live is set to
+REG_LIVE_WRITTEN, because of the following code called in
+check_stack_write_fixed_off():
+
+static void save_register_state(struct bpf_func_state *state,
+ int spi, struct bpf_reg_state *reg,
+ int size)
+{
+ ...
+ state->stack[spi].spilled_ptr = *reg; // <--- parent & live copied
+ if (size == BPF_REG_SIZE)
+ state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN;
+ ...
+}
+
+Note the intent to mark stack spill as written only if 8 bytes are
+spilled to a slot, however this intent is spoiled by a 'live' field copy.
+At (8) the checkpoint.fp[-8] should be marked as REG_LIVE_READ but
+this does not happen:
+- fp[-8] in a current state is already marked as REG_LIVE_WRITTEN;
+- fp[-8].parent points to checkpoint.r1, parentage chain is used by
+ mark_reg_read() to mark checkpoint states.
+At (10) the verification is finished for path 1-10 and jump 4-6 is
+examined. The checkpoint.fp[-8] never gets REG_LIVE_READ mark and this
+spill is pruned from the cached states by clean_live_states(). Hence
+verifier state obtained via path 1-4,6 is deemed identical to one
+obtained via path 1-6 and program marked as safe.
+
+Note: the example should be executed with BPF_F_TEST_STATE_FREQ flag
+set to force creation of intermediate verifier states.
+
+This commit revisits the locations where bpf_reg_state instances are
+copied and replaces the direct copies with a call to a function
+copy_register_state(dst, src) that preserves 'parent' and 'live'
+fields of the 'dst'.
+
+Fixes: 679c782de14b ("bpf/verifier: per-register parent pointers")
+Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
+Link: https://lore.kernel.org/r/20230106142214.1040390-2-eddyz87@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 398a0008aff7..82f2da71eb35 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -3011,13 +3011,24 @@ static bool __is_pointer_value(bool allow_ptr_leaks,
+ return reg->type != SCALAR_VALUE;
+ }
+
++/* Copy src state preserving dst->parent and dst->live fields */
++static void copy_register_state(struct bpf_reg_state *dst, const struct bpf_reg_state *src)
++{
++ struct bpf_reg_state *parent = dst->parent;
++ enum bpf_reg_liveness live = dst->live;
++
++ *dst = *src;
++ dst->parent = parent;
++ dst->live = live;
++}
++
+ static void save_register_state(struct bpf_func_state *state,
+ int spi, struct bpf_reg_state *reg,
+ int size)
+ {
+ int i;
+
+- state->stack[spi].spilled_ptr = *reg;
++ copy_register_state(&state->stack[spi].spilled_ptr, reg);
+ if (size == BPF_REG_SIZE)
+ state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN;
+
+@@ -3345,7 +3356,7 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env,
+ */
+ s32 subreg_def = state->regs[dst_regno].subreg_def;
+
+- state->regs[dst_regno] = *reg;
++ copy_register_state(&state->regs[dst_regno], reg);
+ state->regs[dst_regno].subreg_def = subreg_def;
+ } else {
+ for (i = 0; i < size; i++) {
+@@ -3366,7 +3377,7 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env,
+
+ if (dst_regno >= 0) {
+ /* restore register state from stack */
+- state->regs[dst_regno] = *reg;
++ copy_register_state(&state->regs[dst_regno], reg);
+ /* mark reg as written since spilled pointer state likely
+ * has its liveness marks cleared by is_state_visited()
+ * which resets stack/reg liveness for state transitions
+@@ -8085,7 +8096,7 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
+ */
+ if (!ptr_is_dst_reg) {
+ tmp = *dst_reg;
+- *dst_reg = *ptr_reg;
++ copy_register_state(dst_reg, ptr_reg);
+ }
+ ret = sanitize_speculative_path(env, NULL, env->insn_idx + 1,
+ env->insn_idx);
+@@ -9338,7 +9349,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ * to propagate min/max range.
+ */
+ src_reg->id = ++env->id_gen;
+- *dst_reg = *src_reg;
++ copy_register_state(dst_reg, src_reg);
+ dst_reg->live |= REG_LIVE_WRITTEN;
+ dst_reg->subreg_def = DEF_NOT_SUBREG;
+ } else {
+@@ -9349,7 +9360,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ insn->src_reg);
+ return -EACCES;
+ } else if (src_reg->type == SCALAR_VALUE) {
+- *dst_reg = *src_reg;
++ copy_register_state(dst_reg, src_reg);
+ /* Make sure ID is cleared otherwise
+ * dst_reg min/max could be incorrectly
+ * propagated into src_reg by find_equal_scalars()
+@@ -10145,7 +10156,7 @@ static void find_equal_scalars(struct bpf_verifier_state *vstate,
+
+ bpf_for_each_reg_in_vstate(vstate, state, reg, ({
+ if (reg->type == SCALAR_VALUE && reg->id == known_reg->id)
+- *reg = *known_reg;
++ copy_register_state(reg, known_reg);
+ }));
+ }
+
+--
+2.39.0
+
--- /dev/null
+From 8c6f0fb40e0c04ab569520b889f1c67e19f42174 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jan 2023 13:41:44 +0100
+Subject: bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
+
+From: Jakub Sitnicki <jakub@cloudflare.com>
+
+[ Upstream commit ddce1e091757d0259107c6c0c7262df201de2b66 ]
+
+A listening socket linked to a sockmap has its sk_prot overridden. It
+points to one of the struct proto variants in tcp_bpf_prots. The variant
+depends on the socket's family and which sockmap programs are attached.
+
+A child socket cloned from a TCP listener initially inherits their sk_prot.
+But before cloning is finished, we restore the child's proto to the
+listener's original non-tcp_bpf_prots one. This happens in
+tcp_create_openreq_child -> tcp_bpf_clone.
+
+Today, in tcp_bpf_clone we detect if the child's proto should be restored
+by checking only for the TCP_BPF_BASE proto variant. This is not
+correct. The sk_prot of listening socket linked to a sockmap can point to
+to any variant in tcp_bpf_prots.
+
+If the listeners sk_prot happens to be not the TCP_BPF_BASE variant, then
+the child socket unintentionally is left if the inherited sk_prot by
+tcp_bpf_clone.
+
+This leads to issues like infinite recursion on close [1], because the
+child state is otherwise not set up for use with tcp_bpf_prot operations.
+
+Adjust the check in tcp_bpf_clone to detect all of tcp_bpf_prots variants.
+
+Note that it wouldn't be sufficient to check the socket state when
+overriding the sk_prot in tcp_bpf_update_proto in order to always use the
+TCP_BPF_BASE variant for listening sockets. Since commit
+b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap usage")
+it is possible for a socket to transition to TCP_LISTEN state while already
+linked to a sockmap, e.g. connect() -> insert into map ->
+connect(AF_UNSPEC) -> listen().
+
+[1]: https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/
+
+Fixes: e80251555f0b ("tcp_bpf: Don't let child socket inherit parent protocol ops on copy")
+Reported-by: syzbot+04c21ed96d861dccc5cd@syzkaller.appspotmail.com
+Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/r/20230113-sockmap-fix-v2-2-1e0ee7ac2f90@cloudflare.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/util_macros.h | 12 ++++++++++++
+ net/ipv4/tcp_bpf.c | 4 ++--
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/util_macros.h b/include/linux/util_macros.h
+index 72299f261b25..43db6e47503c 100644
+--- a/include/linux/util_macros.h
++++ b/include/linux/util_macros.h
+@@ -38,4 +38,16 @@
+ */
+ #define find_closest_descending(x, a, as) __find_closest(x, a, as, >=)
+
++/**
++ * is_insidevar - check if the @ptr points inside the @var memory range.
++ * @ptr: the pointer to a memory address.
++ * @var: the variable which address and size identify the memory range.
++ *
++ * Evaluates to true if the address in @ptr lies within the memory
++ * range allocated to @var.
++ */
++#define is_insidevar(ptr, var) \
++ ((uintptr_t)(ptr) >= (uintptr_t)(var) && \
++ (uintptr_t)(ptr) < (uintptr_t)(var) + sizeof(var))
++
+ #endif
+diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
+index 94aad3870c5f..cf26d65ca389 100644
+--- a/net/ipv4/tcp_bpf.c
++++ b/net/ipv4/tcp_bpf.c
+@@ -6,6 +6,7 @@
+ #include <linux/bpf.h>
+ #include <linux/init.h>
+ #include <linux/wait.h>
++#include <linux/util_macros.h>
+
+ #include <net/inet_common.h>
+ #include <net/tls.h>
+@@ -639,10 +640,9 @@ EXPORT_SYMBOL_GPL(tcp_bpf_update_proto);
+ */
+ void tcp_bpf_clone(const struct sock *sk, struct sock *newsk)
+ {
+- int family = sk->sk_family == AF_INET6 ? TCP_BPF_IPV6 : TCP_BPF_IPV4;
+ struct proto *prot = newsk->sk_prot;
+
+- if (prot == &tcp_bpf_prots[family][TCP_BPF_BASE])
++ if (is_insidevar(prot, tcp_bpf_prots))
+ newsk->sk_prot = sk->sk_prot_creator;
+ }
+ #endif /* CONFIG_BPF_SYSCALL */
+--
+2.39.0
+
--- /dev/null
+From c07ae1b5e528fd28bf4ed4fbc067fc417c3f303b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Nov 2022 09:42:00 +0000
+Subject: bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit f71eaf2708be7831428eacae7db25d8ec6b8b4c5 ]
+
+The sunxi_rsb_init() returns the platform_driver_register() directly
+without checking its return value, if platform_driver_register() failed,
+the sunxi_rsb_bus is not unregistered.
+Fix by unregister sunxi_rsb_bus when platform_driver_register() failed.
+
+Fixes: d787dcdb9c8f ("bus: sunxi-rsb: Add driver for Allwinner Reduced Serial Bus")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://lore.kernel.org/r/20221123094200.12036-1-yuancan@huawei.com
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/sunxi-rsb.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c
+index 3aa91aed3bf7..226e87b85116 100644
+--- a/drivers/bus/sunxi-rsb.c
++++ b/drivers/bus/sunxi-rsb.c
+@@ -857,7 +857,13 @@ static int __init sunxi_rsb_init(void)
+ return ret;
+ }
+
+- return platform_driver_register(&sunxi_rsb_driver);
++ ret = platform_driver_register(&sunxi_rsb_driver);
++ if (ret) {
++ bus_unregister(&sunxi_rsb_bus);
++ return ret;
++ }
++
++ return 0;
+ }
+ module_init(sunxi_rsb_init);
+
+--
+2.39.0
+
--- /dev/null
+From 7b9ebfd10386131725af9515150416a66185ad20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Sep 2021 17:42:00 +0800
+Subject: can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+[ Upstream commit d0553680f94c49bbe0e39eb50d033ba563b4212d ]
+
+The conclusion "j1939_session_deactivate() should be called with a
+session ref-count of at least 2" is incorrect. In some concurrent
+scenarios, j1939_session_deactivate can be called with the session
+ref-count less than 2. But there is not any problem because it
+will check the session active state before session putting in
+j1939_session_deactivate_locked().
+
+Here is the concurrent scenario of the problem reported by syzbot
+and my reproduction log.
+
+ cpu0 cpu1
+ j1939_xtp_rx_eoma
+j1939_xtp_rx_abort_one
+ j1939_session_get_by_addr [kref == 2]
+j1939_session_get_by_addr [kref == 3]
+j1939_session_deactivate [kref == 2]
+j1939_session_put [kref == 1]
+ j1939_session_completed
+ j1939_session_deactivate
+ WARN_ON_ONCE(kref < 2)
+
+=====================================================
+WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70
+CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014
+RIP: 0010:j1939_session_deactivate+0x5f/0x70
+Call Trace:
+ j1939_session_deactivate_activate_next+0x11/0x28
+ j1939_xtp_rx_eoma+0x12a/0x180
+ j1939_tp_recv+0x4a2/0x510
+ j1939_can_recv+0x226/0x380
+ can_rcv_filter+0xf8/0x220
+ can_receive+0x102/0x220
+ ? process_backlog+0xf0/0x2c0
+ can_rcv+0x53/0xf0
+ __netif_receive_skb_one_core+0x67/0x90
+ ? process_backlog+0x97/0x2c0
+ __netif_receive_skb+0x22/0x80
+
+Fixes: 0c71437dd50d ("can: j1939: j1939_session_deactivate(): clarify lifetime of session object")
+Reported-by: syzbot+9981a614060dcee6eeca@syzkaller.appspotmail.com
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://lore.kernel.org/all/20210906094200.95868-1-william.xuanziyang@huawei.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/j1939/transport.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
+index 55f29c9f9e08..4177e9617070 100644
+--- a/net/can/j1939/transport.c
++++ b/net/can/j1939/transport.c
+@@ -1092,10 +1092,6 @@ static bool j1939_session_deactivate(struct j1939_session *session)
+ bool active;
+
+ j1939_session_list_lock(priv);
+- /* This function should be called with a session ref-count of at
+- * least 2.
+- */
+- WARN_ON_ONCE(kref_read(&session->kref) < 2);
+ active = j1939_session_deactivate_locked(session);
+ j1939_session_list_unlock(priv);
+
+--
+2.39.0
+
--- /dev/null
+From 8a6a3d47d706b1cb3b39889554c3c7fbf506b42b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 09:03:42 +0100
+Subject: can: mcp251xfd: mcp251xfd_ring_set_ringparam(): assign missing
+ tx_obj_num_coalesce_irq
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 1613fff7a32e1d9e2ac09db73feba0e71a188445 ]
+
+If the a new ring layout is set, the max coalesced frames for RX and
+TX are re-calculated, too. Add the missing assignment of the newly
+calculated TX max coalesced frames.
+
+Fixes: 656fc12ddaf8 ("can: mcp251xfd: add TX IRQ coalescing ethtool support")
+Link: https://lore.kernel.org/all/20230130154334.1578518-1-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/spi/mcp251xfd/mcp251xfd-ethtool.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-ethtool.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-ethtool.c
+index 3585f02575df..57eeb066a945 100644
+--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-ethtool.c
++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-ethtool.c
+@@ -48,6 +48,7 @@ mcp251xfd_ring_set_ringparam(struct net_device *ndev,
+ priv->rx_obj_num = layout.cur_rx;
+ priv->rx_obj_num_coalesce_irq = layout.rx_coalesce;
+ priv->tx->obj_num = layout.cur_tx;
++ priv->tx_obj_num_coalesce_irq = layout.tx_coalesce;
+
+ return 0;
+ }
+--
+2.39.0
+
--- /dev/null
+From 3af660e809b5d266319296bae2fb9aae95989741 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 11:56:13 +0100
+Subject: can: raw: fix CAN FD frame transmissions over CAN XL devices
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+[ Upstream commit 3793301cbaa4a62d83e21f685307da7671f812ab ]
+
+A CAN XL device is always capable to process CAN FD frames. The former
+check when sending CAN FD frames relied on the existence of a CAN FD
+device and did not check for a CAN XL device that would be correct
+too.
+
+With this patch the CAN FD feature is enabled automatically when CAN
+XL is switched on - and CAN FD cannot be switch off while CAN XL is
+enabled.
+
+This precondition also leads to a clean up and reduction of checks in
+the hot path in raw_rcv() and raw_sendmsg(). Some conditions are
+reordered to handle simple checks first.
+
+changes since v1: https://lore.kernel.org/all/20230131091012.50553-1-socketcan@hartkopp.net
+- fixed typo: devive -> device
+changes since v2: https://lore.kernel.org/all/20230131091824.51026-1-socketcan@hartkopp.net/
+- reorder checks in if statements to handle simple checks first
+
+Fixes: 626332696d75 ("can: raw: add CAN XL support")
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Link: https://lore.kernel.org/all/20230131105613.55228-1-socketcan@hartkopp.net
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/raw.c | 47 +++++++++++++++++++++++++++++++----------------
+ 1 file changed, 31 insertions(+), 16 deletions(-)
+
+diff --git a/net/can/raw.c b/net/can/raw.c
+index 3eb7d3e2b541..4abab2c3011a 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -132,8 +132,8 @@ static void raw_rcv(struct sk_buff *oskb, void *data)
+ return;
+
+ /* make sure to not pass oversized frames to the socket */
+- if ((can_is_canfd_skb(oskb) && !ro->fd_frames && !ro->xl_frames) ||
+- (can_is_canxl_skb(oskb) && !ro->xl_frames))
++ if ((!ro->fd_frames && can_is_canfd_skb(oskb)) ||
++ (!ro->xl_frames && can_is_canxl_skb(oskb)))
+ return;
+
+ /* eliminate multiple filter matches for the same skb */
+@@ -670,6 +670,11 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+ if (copy_from_sockptr(&ro->fd_frames, optval, optlen))
+ return -EFAULT;
+
++ /* Enabling CAN XL includes CAN FD */
++ if (ro->xl_frames && !ro->fd_frames) {
++ ro->fd_frames = ro->xl_frames;
++ return -EINVAL;
++ }
+ break;
+
+ case CAN_RAW_XL_FRAMES:
+@@ -679,6 +684,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+ if (copy_from_sockptr(&ro->xl_frames, optval, optlen))
+ return -EFAULT;
+
++ /* Enabling CAN XL includes CAN FD */
++ if (ro->xl_frames)
++ ro->fd_frames = ro->xl_frames;
+ break;
+
+ case CAN_RAW_JOIN_FILTERS:
+@@ -786,6 +794,25 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
+ return 0;
+ }
+
++static bool raw_bad_txframe(struct raw_sock *ro, struct sk_buff *skb, int mtu)
++{
++ /* Classical CAN -> no checks for flags and device capabilities */
++ if (can_is_can_skb(skb))
++ return false;
++
++ /* CAN FD -> needs to be enabled and a CAN FD or CAN XL device */
++ if (ro->fd_frames && can_is_canfd_skb(skb) &&
++ (mtu == CANFD_MTU || can_is_canxl_dev_mtu(mtu)))
++ return false;
++
++ /* CAN XL -> needs to be enabled and a CAN XL device */
++ if (ro->xl_frames && can_is_canxl_skb(skb) &&
++ can_is_canxl_dev_mtu(mtu))
++ return false;
++
++ return true;
++}
++
+ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+ {
+ struct sock *sk = sock->sk;
+@@ -833,20 +860,8 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+ goto free_skb;
+
+ err = -EINVAL;
+- if (ro->xl_frames && can_is_canxl_dev_mtu(dev->mtu)) {
+- /* CAN XL, CAN FD and Classical CAN */
+- if (!can_is_canxl_skb(skb) && !can_is_canfd_skb(skb) &&
+- !can_is_can_skb(skb))
+- goto free_skb;
+- } else if (ro->fd_frames && dev->mtu == CANFD_MTU) {
+- /* CAN FD and Classical CAN */
+- if (!can_is_canfd_skb(skb) && !can_is_can_skb(skb))
+- goto free_skb;
+- } else {
+- /* Classical CAN */
+- if (!can_is_can_skb(skb))
+- goto free_skb;
+- }
++ if (raw_bad_txframe(ro, skb, dev->mtu))
++ goto free_skb;
+
+ sockcm_init(&sockc, sk);
+ if (msg->msg_controllen) {
+--
+2.39.0
+
--- /dev/null
+From ea37ba179fe324e644b87a88733b16fb0194b444 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 09:43:22 +0100
+Subject: certs: Fix build error when PKCS#11 URI contains semicolon
+
+From: Jan Luebbe <jlu@pengutronix.de>
+
+[ Upstream commit b1c3d2beed8ef3699fab106340e33a79052df116 ]
+
+When CONFIG_MODULE_SIG_KEY is PKCS#11 URI (pkcs11:*) and contains a
+semicolon, signing_key.x509 fails to build:
+
+ certs/extract-cert pkcs11:token=foo;object=bar;pin-value=1111 certs/signing_key.x509
+ Usage: extract-cert <source> <dest>
+
+Add quotes to the extract-cert argument to avoid splitting by the shell.
+
+This approach was suggested by Masahiro Yamada <masahiroy@kernel.org>.
+
+Fixes: 129ab0d2d9f3 ("kbuild: do not quote string values in include/config/auto.conf")
+Signed-off-by: Jan Luebbe <jlu@pengutronix.de>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ certs/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/certs/Makefile b/certs/Makefile
+index 9486ed924731..799ad7b9e68a 100644
+--- a/certs/Makefile
++++ b/certs/Makefile
+@@ -23,8 +23,8 @@ $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE
+ targets += blacklist_hash_list
+
+ quiet_cmd_extract_certs = CERT $@
+- cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@
+-extract-cert-in = $(or $(filter-out $(obj)/extract-cert, $(real-prereqs)),"")
++ cmd_extract_certs = $(obj)/extract-cert "$(extract-cert-in)" $@
++extract-cert-in = $(filter-out $(obj)/extract-cert, $(real-prereqs))
+
+ $(obj)/system_certificates.o: $(obj)/x509_certificate_list
+
+--
+2.39.0
+
--- /dev/null
+From 59d3842634810c81a1ef83793275ed6f2ccbbd8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Sep 2022 18:55:18 -0400
+Subject: copy_oldmem_kernel() - WRITE is "data source", not destination
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 0e1e4a2238d465199e8f11eb7a779bcb224a0505 ]
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/crash_dump.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
+index e4ef67e4da0a..a19a2763e8d4 100644
+--- a/arch/s390/kernel/crash_dump.c
++++ b/arch/s390/kernel/crash_dump.c
+@@ -153,7 +153,7 @@ int copy_oldmem_kernel(void *dst, unsigned long src, size_t count)
+
+ kvec.iov_base = dst;
+ kvec.iov_len = count;
+- iov_iter_kvec(&iter, WRITE, &kvec, 1, count);
++ iov_iter_kvec(&iter, READ, &kvec, 1, count);
+ if (copy_oldmem_iter(&iter, src, count) < count)
+ return -EFAULT;
+ return 0;
+--
+2.39.0
+
--- /dev/null
+From af1de54aba5563662e968942e919945255fd022e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 08:49:01 +0100
+Subject: dpaa2-eth: execute xdp_do_flush() before napi_complete_done()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Magnus Karlsson <magnus.karlsson@intel.com>
+
+[ Upstream commit a3191c4d86c5d3bd35b00dfde6910b88391436a0 ]
+
+Make sure that xdp_do_flush() is always executed before
+napi_complete_done(). This is important for two reasons. First, a
+redirect to an XSKMAP assumes that a call to xdp_do_redirect() from
+napi context X on CPU Y will be followed by a xdp_do_flush() from the
+same napi context and CPU. This is not guaranteed if the
+napi_complete_done() is executed before xdp_do_flush(), as it tells
+the napi logic that it is fine to schedule napi context X on another
+CPU. Details from a production system triggering this bug using the
+veth driver can be found following the first link below.
+
+The second reason is that the XDP_REDIRECT logic in itself relies on
+being inside a single NAPI instance through to the xdp_do_flush() call
+for RCU protection of all in-kernel data structures. Details can be
+found in the second link below.
+
+Fixes: d678be1dc1ec ("dpaa2-eth: add XDP_REDIRECT support")
+Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com
+Link: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+index 8d029addddad..6383d9805dac 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -1868,10 +1868,15 @@ static int dpaa2_eth_poll(struct napi_struct *napi, int budget)
+ if (rx_cleaned >= budget ||
+ txconf_cleaned >= DPAA2_ETH_TXCONF_PER_NAPI) {
+ work_done = budget;
++ if (ch->xdp.res & XDP_REDIRECT)
++ xdp_do_flush();
+ goto out;
+ }
+ } while (store_cleaned);
+
++ if (ch->xdp.res & XDP_REDIRECT)
++ xdp_do_flush();
++
+ /* Update NET DIM with the values for this CDAN */
+ dpaa2_io_update_net_dim(ch->dpio, ch->stats.frames_per_cdan,
+ ch->stats.bytes_per_cdan);
+@@ -1902,9 +1907,7 @@ static int dpaa2_eth_poll(struct napi_struct *napi, int budget)
+ txc_fq->dq_bytes = 0;
+ }
+
+- if (ch->xdp.res & XDP_REDIRECT)
+- xdp_do_flush_map();
+- else if (rx_cleaned && ch->xdp.res & XDP_TX)
++ if (rx_cleaned && ch->xdp.res & XDP_TX)
+ dpaa2_eth_xdp_tx_flush(priv, ch, &priv->fq[flowid]);
+
+ return work_done;
+--
+2.39.0
+
--- /dev/null
+From 887859ffa95dbcb485c7c66c3bbfab2c2c8862b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 08:49:00 +0100
+Subject: dpaa_eth: execute xdp_do_flush() before napi_complete_done()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Magnus Karlsson <magnus.karlsson@intel.com>
+
+[ Upstream commit b534013798b77f81a36f36dafd59bab9de837619 ]
+
+Make sure that xdp_do_flush() is always executed before
+napi_complete_done(). This is important for two reasons. First, a
+redirect to an XSKMAP assumes that a call to xdp_do_redirect() from
+napi context X on CPU Y will be followed by a xdp_do_flush() from the
+same napi context and CPU. This is not guaranteed if the
+napi_complete_done() is executed before xdp_do_flush(), as it tells
+the napi logic that it is fine to schedule napi context X on another
+CPU. Details from a production system triggering this bug using the
+veth driver can be found following the first link below.
+
+The second reason is that the XDP_REDIRECT logic in itself relies on
+being inside a single NAPI instance through to the xdp_do_flush() call
+for RCU protection of all in-kernel data structures. Details can be
+found in the second link below.
+
+Fixes: a1e031ffb422 ("dpaa_eth: add XDP_REDIRECT support")
+Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com
+Link: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/
+Acked-by: Camelia Groza <camelia.groza@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index fc68a32ce2f7..d8fb7d4ebd51 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2400,6 +2400,9 @@ static int dpaa_eth_poll(struct napi_struct *napi, int budget)
+
+ cleaned = qman_p_poll_dqrr(np->p, budget);
+
++ if (np->xdp_act & XDP_REDIRECT)
++ xdp_do_flush();
++
+ if (cleaned < budget) {
+ napi_complete_done(napi, cleaned);
+ qman_p_irqsource_add(np->p, QM_PIRQ_DQRI);
+@@ -2407,9 +2410,6 @@ static int dpaa_eth_poll(struct napi_struct *napi, int budget)
+ qman_p_irqsource_add(np->p, QM_PIRQ_DQRI);
+ }
+
+- if (np->xdp_act & XDP_REDIRECT)
+- xdp_do_flush();
+-
+ return cleaned;
+ }
+
+--
+2.39.0
+
--- /dev/null
+From 83266dd75d75036d773245df6b6a9ade7e398ccd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 14:56:22 -0500
+Subject: drm/amd/display: Fix timing not changning when freesync video is
+ enabled
+
+From: Aurabindo Pillai <aurabindo.pillai@amd.com>
+
+[ Upstream commit 4b069553246f993c4221e382d0d0ae34f5ba730e ]
+
+[Why&How]
+Switching between certain modes that are freesync video modes and those
+are not freesync video modes result in timing not changing as seen by
+the monitor due to incorrect timing being driven.
+
+The issue is fixed by ensuring that when a non freesync video mode is
+set, we reset the freesync status on the crtc.
+
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Alan Liu <HaoPing.Liu@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 85bd1f18259c..b425ec00817c 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -8784,6 +8784,13 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
+ if (!dm_old_crtc_state->stream)
+ goto skip_modeset;
+
++ /* Unset freesync video if it was active before */
++ if (dm_old_crtc_state->freesync_config.state == VRR_STATE_ACTIVE_FIXED) {
++ dm_new_crtc_state->freesync_config.state = VRR_STATE_INACTIVE;
++ dm_new_crtc_state->freesync_config.fixed_refresh_in_uhz = 0;
++ }
++
++ /* Now check if we should set freesync video mode */
+ if (amdgpu_freesync_vid_mode && dm_new_crtc_state->stream &&
+ is_timing_unchanged_for_freesync(new_crtc_state,
+ old_crtc_state)) {
+--
+2.39.0
+
--- /dev/null
+From 3005a6cadf61686a2e94cd957c7a49ad638056c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 15:11:31 +0530
+Subject: drm/i915/adlp: Fix typo for reference clock
+
+From: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+
+[ Upstream commit 47a2bd9d985bfdb55900f313603619fc9234f317 ]
+
+Fix typo for reference clock from 24400 to 24000.
+
+Bspec: 55409
+Fixes: 626426ff9ce4 ("drm/i915/adl_p: Add cdclk support for ADL-P")
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230112094131.550252-1-chaitanya.kumar.borah@intel.com
+(cherry picked from commit 2b6f7e39ccae065abfbe3b6e562ec95ccad09f1e)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_cdclk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_cdclk.c b/drivers/gpu/drm/i915/display/intel_cdclk.c
+index ed05070b7307..92925f0f7239 100644
+--- a/drivers/gpu/drm/i915/display/intel_cdclk.c
++++ b/drivers/gpu/drm/i915/display/intel_cdclk.c
+@@ -1323,7 +1323,7 @@ static const struct intel_cdclk_vals adlp_cdclk_table[] = {
+ { .refclk = 24000, .cdclk = 192000, .divider = 2, .ratio = 16 },
+ { .refclk = 24000, .cdclk = 312000, .divider = 2, .ratio = 26 },
+ { .refclk = 24000, .cdclk = 552000, .divider = 2, .ratio = 46 },
+- { .refclk = 24400, .cdclk = 648000, .divider = 2, .ratio = 54 },
++ { .refclk = 24000, .cdclk = 648000, .divider = 2, .ratio = 54 },
+
+ { .refclk = 38400, .cdclk = 179200, .divider = 3, .ratio = 14 },
+ { .refclk = 38400, .cdclk = 192000, .divider = 2, .ratio = 10 },
+--
+2.39.0
+
--- /dev/null
+From e8211b93de1375cf1e656c105e381991668909c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 16:28:36 -0800
+Subject: drm/i915: Fix request ref counting during error capture & debugfs
+ dump
+
+From: John Harrison <John.C.Harrison@Intel.com>
+
+[ Upstream commit 86d8ddc74124c3fdfc139f246ba6da15e45e86e3 ]
+
+When GuC support was added to error capture, the reference counting
+around the request object was broken. Fix it up.
+
+The context based search manages the spinlocking around the search
+internally. So it needs to grab the reference count internally as
+well. The execlist only request based search relies on external
+locking, so it needs an external reference count but within the
+spinlock not outside it.
+
+The only other caller of the context based search is the code for
+dumping engine state to debugfs. That code wasn't previously getting
+an explicit reference at all as it does everything while holding the
+execlist specific spinlock. So, that needs updaing as well as that
+spinlock doesn't help when using GuC submission. Rather than trying to
+conditionally get/put depending on submission model, just change it to
+always do the get/put.
+
+v2: Explicitly document adding an extra blank line in some dense code
+(Andy Shevchenko). Fix multiple potential null pointer derefs in case
+of no request found (some spotted by Tvrtko, but there was more!).
+Also fix a leaked request in case of !started and another in
+__guc_reset_context now that intel_context_find_active_request is
+actually reference counting the returned request.
+v3: Add a _get suffix to intel_context_find_active_request now that it
+grabs a reference (Daniele).
+v4: Split the intel_guc_find_hung_context change to a separate patch
+and rename intel_context_find_active_request_get to
+intel_context_get_active_request (Tvrtko).
+v5: s/locking/reference counting/ in commit message (Tvrtko)
+
+Fixes: dc0dad365c5e ("drm/i915/guc: Fix for error capture after full GPU reset with GuC")
+Fixes: 573ba126aef3 ("drm/i915/guc: Capture error state on context reset")
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Acked-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Andrzej Hajda <andrzej.hajda@intel.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Cc: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Cc: Michael Cheng <michael.cheng@intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: Tejas Upadhyay <tejaskumarx.surendrakumar.upadhyay@intel.com>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Aravind Iddamsetty <aravind.iddamsetty@intel.com>
+Cc: Alan Previn <alan.previn.teres.alexis@intel.com>
+Cc: Bruce Chang <yu.bruce.chang@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-3-John.C.Harrison@Intel.com
+(cherry picked from commit 3700e353781e27f1bc7222f51f2cc36cbeb9b4ec)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_context.c | 4 +++-
+ drivers/gpu/drm/i915/gt/intel_context.h | 3 +--
+ drivers/gpu/drm/i915/gt/intel_engine_cs.c | 6 +++++-
+ drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 3 ++-
+ drivers/gpu/drm/i915/i915_gpu_error.c | 13 ++++++-------
+ 5 files changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_context.c b/drivers/gpu/drm/i915/gt/intel_context.c
+index e94365b08f1e..2aa63ec521b8 100644
+--- a/drivers/gpu/drm/i915/gt/intel_context.c
++++ b/drivers/gpu/drm/i915/gt/intel_context.c
+@@ -528,7 +528,7 @@ struct i915_request *intel_context_create_request(struct intel_context *ce)
+ return rq;
+ }
+
+-struct i915_request *intel_context_find_active_request(struct intel_context *ce)
++struct i915_request *intel_context_get_active_request(struct intel_context *ce)
+ {
+ struct intel_context *parent = intel_context_to_parent(ce);
+ struct i915_request *rq, *active = NULL;
+@@ -552,6 +552,8 @@ struct i915_request *intel_context_find_active_request(struct intel_context *ce)
+
+ active = rq;
+ }
++ if (active)
++ active = i915_request_get_rcu(active);
+ spin_unlock_irqrestore(&parent->guc_state.lock, flags);
+
+ return active;
+diff --git a/drivers/gpu/drm/i915/gt/intel_context.h b/drivers/gpu/drm/i915/gt/intel_context.h
+index be09fb2e883a..4ab6c8ddd6ec 100644
+--- a/drivers/gpu/drm/i915/gt/intel_context.h
++++ b/drivers/gpu/drm/i915/gt/intel_context.h
+@@ -268,8 +268,7 @@ int intel_context_prepare_remote_request(struct intel_context *ce,
+
+ struct i915_request *intel_context_create_request(struct intel_context *ce);
+
+-struct i915_request *
+-intel_context_find_active_request(struct intel_context *ce);
++struct i915_request *intel_context_get_active_request(struct intel_context *ce);
+
+ static inline bool intel_context_is_barrier(const struct intel_context *ce)
+ {
+diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+index fcbccd8d244e..4327c6d91ce9 100644
+--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
++++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+@@ -2201,9 +2201,11 @@ static void engine_dump_active_requests(struct intel_engine_cs *engine, struct d
+ if (guc) {
+ ce = intel_engine_get_hung_context(engine);
+ if (ce)
+- hung_rq = intel_context_find_active_request(ce);
++ hung_rq = intel_context_get_active_request(ce);
+ } else {
+ hung_rq = intel_engine_execlist_find_hung_request(engine);
++ if (hung_rq)
++ hung_rq = i915_request_get_rcu(hung_rq);
+ }
+
+ if (hung_rq)
+@@ -2214,6 +2216,8 @@ static void engine_dump_active_requests(struct intel_engine_cs *engine, struct d
+ else
+ intel_engine_dump_active_requests(&engine->sched_engine->requests,
+ hung_rq, m);
++ if (hung_rq)
++ i915_request_put(hung_rq);
+ }
+
+ void intel_engine_dump(struct intel_engine_cs *engine,
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+index 259162002c3a..0ec07dad1dcf 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+@@ -1685,7 +1685,7 @@ static void __guc_reset_context(struct intel_context *ce, intel_engine_mask_t st
+ goto next_context;
+
+ guilty = false;
+- rq = intel_context_find_active_request(ce);
++ rq = intel_context_get_active_request(ce);
+ if (!rq) {
+ head = ce->ring->tail;
+ goto out_replay;
+@@ -1698,6 +1698,7 @@ static void __guc_reset_context(struct intel_context *ce, intel_engine_mask_t st
+ head = intel_ring_wrap(ce->ring, rq->head);
+
+ __i915_request_reset(rq, guilty);
++ i915_request_put(rq);
+ out_replay:
+ guc_reset_state(ce, head, guilty);
+ next_context:
+diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
+index 9ea2fe34e7d3..a8ee4cd2ff16 100644
+--- a/drivers/gpu/drm/i915/i915_gpu_error.c
++++ b/drivers/gpu/drm/i915/i915_gpu_error.c
+@@ -1603,7 +1603,7 @@ capture_engine(struct intel_engine_cs *engine,
+ ce = intel_engine_get_hung_context(engine);
+ if (ce) {
+ intel_engine_clear_hung_context(engine);
+- rq = intel_context_find_active_request(ce);
++ rq = intel_context_get_active_request(ce);
+ if (!rq || !i915_request_started(rq))
+ goto no_request_capture;
+ } else {
+@@ -1614,21 +1614,18 @@ capture_engine(struct intel_engine_cs *engine,
+ if (!intel_uc_uses_guc_submission(&engine->gt->uc)) {
+ spin_lock_irqsave(&engine->sched_engine->lock, flags);
+ rq = intel_engine_execlist_find_hung_request(engine);
++ if (rq)
++ rq = i915_request_get_rcu(rq);
+ spin_unlock_irqrestore(&engine->sched_engine->lock,
+ flags);
+ }
+ }
+- if (rq)
+- rq = i915_request_get_rcu(rq);
+-
+ if (!rq)
+ goto no_request_capture;
+
+ capture = intel_engine_coredump_add_request(ee, rq, ATOMIC_MAYFAIL);
+- if (!capture) {
+- i915_request_put(rq);
++ if (!capture)
+ goto no_request_capture;
+- }
+ if (dump_flags & CORE_DUMP_FLAG_IS_GUC_CAPTURE)
+ intel_guc_capture_get_matching_node(engine->gt, ee, ce);
+
+@@ -1638,6 +1635,8 @@ capture_engine(struct intel_engine_cs *engine,
+ return ee;
+
+ no_request_capture:
++ if (rq)
++ i915_request_put(rq);
+ kfree(ee);
+ return NULL;
+ }
+--
+2.39.0
+
--- /dev/null
+From 2c53009b2ecf4788d32c5a651d928e60e0c6ddfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 16:28:37 -0800
+Subject: drm/i915: Fix up locking around dumping requests lists
+
+From: John Harrison <John.C.Harrison@Intel.com>
+
+[ Upstream commit 5bc4b43d5c6c9692ddc7b96116650cdf9406f3da ]
+
+The debugfs dump of requests was confused about what state requires
+the execlist lock versus the GuC lock. There was also a bunch of
+duplicated messy code between it and the error capture code.
+
+So refactor the hung request search into a re-usable function. And
+reduce the span of the execlist state lock to only the execlist
+specific code paths. In order to do that, also move the report of hold
+count (which is an execlist only concept) from the top level dump
+function to the lower level execlist specific function. Also, move the
+execlist specific code into the execlist source file.
+
+v2: Rename some functions and move to more appropriate files (Daniele).
+v3: Rename new execlist dump function (Daniele)
+
+Fixes: dc0dad365c5e ("drm/i915/guc: Fix for error capture after full GPU reset with GuC")
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Acked-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Cc: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Cc: Michael Cheng <michael.cheng@intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: Bruce Chang <yu.bruce.chang@intel.com>
+Cc: Alan Previn <alan.previn.teres.alexis@intel.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-4-John.C.Harrison@Intel.com
+(cherry picked from commit a4be3dca53172d9d2091e4b474fb795c81ed3d6c)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_engine.h | 4 +-
+ drivers/gpu/drm/i915/gt/intel_engine_cs.c | 74 +++++++++----------
+ .../drm/i915/gt/intel_execlists_submission.c | 27 +++++++
+ .../drm/i915/gt/intel_execlists_submission.h | 4 +
+ drivers/gpu/drm/i915/i915_gpu_error.c | 26 +------
+ 5 files changed, 73 insertions(+), 62 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_engine.h b/drivers/gpu/drm/i915/gt/intel_engine.h
+index cbc8b857d5f7..7a4504ea35c3 100644
+--- a/drivers/gpu/drm/i915/gt/intel_engine.h
++++ b/drivers/gpu/drm/i915/gt/intel_engine.h
+@@ -248,8 +248,8 @@ void intel_engine_dump_active_requests(struct list_head *requests,
+ ktime_t intel_engine_get_busy_time(struct intel_engine_cs *engine,
+ ktime_t *now);
+
+-struct i915_request *
+-intel_engine_execlist_find_hung_request(struct intel_engine_cs *engine);
++void intel_engine_get_hung_entity(struct intel_engine_cs *engine,
++ struct intel_context **ce, struct i915_request **rq);
+
+ u32 intel_engine_context_size(struct intel_gt *gt, u8 class);
+ struct intel_context *
+diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+index 4327c6d91ce9..b458547e1fc6 100644
+--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
++++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+@@ -2078,17 +2078,6 @@ static void print_request_ring(struct drm_printer *m, struct i915_request *rq)
+ }
+ }
+
+-static unsigned long list_count(struct list_head *list)
+-{
+- struct list_head *pos;
+- unsigned long count = 0;
+-
+- list_for_each(pos, list)
+- count++;
+-
+- return count;
+-}
+-
+ static unsigned long read_ul(void *p, size_t x)
+ {
+ return *(unsigned long *)(p + x);
+@@ -2180,11 +2169,11 @@ void intel_engine_dump_active_requests(struct list_head *requests,
+ }
+ }
+
+-static void engine_dump_active_requests(struct intel_engine_cs *engine, struct drm_printer *m)
++static void engine_dump_active_requests(struct intel_engine_cs *engine,
++ struct drm_printer *m)
+ {
++ struct intel_context *hung_ce = NULL;
+ struct i915_request *hung_rq = NULL;
+- struct intel_context *ce;
+- bool guc;
+
+ /*
+ * No need for an engine->irq_seqno_barrier() before the seqno reads.
+@@ -2193,29 +2182,20 @@ static void engine_dump_active_requests(struct intel_engine_cs *engine, struct d
+ * But the intention here is just to report an instantaneous snapshot
+ * so that's fine.
+ */
+- lockdep_assert_held(&engine->sched_engine->lock);
++ intel_engine_get_hung_entity(engine, &hung_ce, &hung_rq);
+
+ drm_printf(m, "\tRequests:\n");
+
+- guc = intel_uc_uses_guc_submission(&engine->gt->uc);
+- if (guc) {
+- ce = intel_engine_get_hung_context(engine);
+- if (ce)
+- hung_rq = intel_context_get_active_request(ce);
+- } else {
+- hung_rq = intel_engine_execlist_find_hung_request(engine);
+- if (hung_rq)
+- hung_rq = i915_request_get_rcu(hung_rq);
+- }
+-
+ if (hung_rq)
+ engine_dump_request(hung_rq, m, "\t\thung");
++ else if (hung_ce)
++ drm_printf(m, "\t\tGot hung ce but no hung rq!\n");
+
+- if (guc)
++ if (intel_uc_uses_guc_submission(&engine->gt->uc))
+ intel_guc_dump_active_requests(engine, hung_rq, m);
+ else
+- intel_engine_dump_active_requests(&engine->sched_engine->requests,
+- hung_rq, m);
++ intel_execlists_dump_active_requests(engine, hung_rq, m);
++
+ if (hung_rq)
+ i915_request_put(hung_rq);
+ }
+@@ -2227,7 +2207,6 @@ void intel_engine_dump(struct intel_engine_cs *engine,
+ struct i915_gpu_error * const error = &engine->i915->gpu_error;
+ struct i915_request *rq;
+ intel_wakeref_t wakeref;
+- unsigned long flags;
+ ktime_t dummy;
+
+ if (header) {
+@@ -2264,13 +2243,8 @@ void intel_engine_dump(struct intel_engine_cs *engine,
+ i915_reset_count(error));
+ print_properties(engine, m);
+
+- spin_lock_irqsave(&engine->sched_engine->lock, flags);
+ engine_dump_active_requests(engine, m);
+
+- drm_printf(m, "\tOn hold?: %lu\n",
+- list_count(&engine->sched_engine->hold));
+- spin_unlock_irqrestore(&engine->sched_engine->lock, flags);
+-
+ drm_printf(m, "\tMMIO base: 0x%08x\n", engine->mmio_base);
+ wakeref = intel_runtime_pm_get_if_in_use(engine->uncore->rpm);
+ if (wakeref) {
+@@ -2316,8 +2290,7 @@ intel_engine_create_virtual(struct intel_engine_cs **siblings,
+ return siblings[0]->cops->create_virtual(siblings, count, flags);
+ }
+
+-struct i915_request *
+-intel_engine_execlist_find_hung_request(struct intel_engine_cs *engine)
++static struct i915_request *engine_execlist_find_hung_request(struct intel_engine_cs *engine)
+ {
+ struct i915_request *request, *active = NULL;
+
+@@ -2369,6 +2342,33 @@ intel_engine_execlist_find_hung_request(struct intel_engine_cs *engine)
+ return active;
+ }
+
++void intel_engine_get_hung_entity(struct intel_engine_cs *engine,
++ struct intel_context **ce, struct i915_request **rq)
++{
++ unsigned long flags;
++
++ *ce = intel_engine_get_hung_context(engine);
++ if (*ce) {
++ intel_engine_clear_hung_context(engine);
++
++ *rq = intel_context_get_active_request(*ce);
++ return;
++ }
++
++ /*
++ * Getting here with GuC enabled means it is a forced error capture
++ * with no actual hang. So, no need to attempt the execlist search.
++ */
++ if (intel_uc_uses_guc_submission(&engine->gt->uc))
++ return;
++
++ spin_lock_irqsave(&engine->sched_engine->lock, flags);
++ *rq = engine_execlist_find_hung_request(engine);
++ if (*rq)
++ *rq = i915_request_get_rcu(*rq);
++ spin_unlock_irqrestore(&engine->sched_engine->lock, flags);
++}
++
+ void xehp_enable_ccs_engines(struct intel_engine_cs *engine)
+ {
+ /*
+diff --git a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c
+index c718e6dc40b5..bfd1ffc71a48 100644
+--- a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c
++++ b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c
+@@ -4144,6 +4144,33 @@ void intel_execlists_show_requests(struct intel_engine_cs *engine,
+ spin_unlock_irqrestore(&sched_engine->lock, flags);
+ }
+
++static unsigned long list_count(struct list_head *list)
++{
++ struct list_head *pos;
++ unsigned long count = 0;
++
++ list_for_each(pos, list)
++ count++;
++
++ return count;
++}
++
++void intel_execlists_dump_active_requests(struct intel_engine_cs *engine,
++ struct i915_request *hung_rq,
++ struct drm_printer *m)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&engine->sched_engine->lock, flags);
++
++ intel_engine_dump_active_requests(&engine->sched_engine->requests, hung_rq, m);
++
++ drm_printf(m, "\tOn hold?: %lu\n",
++ list_count(&engine->sched_engine->hold));
++
++ spin_unlock_irqrestore(&engine->sched_engine->lock, flags);
++}
++
+ #if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)
+ #include "selftest_execlists.c"
+ #endif
+diff --git a/drivers/gpu/drm/i915/gt/intel_execlists_submission.h b/drivers/gpu/drm/i915/gt/intel_execlists_submission.h
+index a1aa92c983a5..d2c7d45ea062 100644
+--- a/drivers/gpu/drm/i915/gt/intel_execlists_submission.h
++++ b/drivers/gpu/drm/i915/gt/intel_execlists_submission.h
+@@ -32,6 +32,10 @@ void intel_execlists_show_requests(struct intel_engine_cs *engine,
+ int indent),
+ unsigned int max);
+
++void intel_execlists_dump_active_requests(struct intel_engine_cs *engine,
++ struct i915_request *hung_rq,
++ struct drm_printer *m);
++
+ bool
+ intel_engine_in_execlists_submission_mode(const struct intel_engine_cs *engine);
+
+diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
+index a8ee4cd2ff16..847b9e6af1a1 100644
+--- a/drivers/gpu/drm/i915/i915_gpu_error.c
++++ b/drivers/gpu/drm/i915/i915_gpu_error.c
+@@ -1592,35 +1592,15 @@ capture_engine(struct intel_engine_cs *engine,
+ {
+ struct intel_engine_capture_vma *capture = NULL;
+ struct intel_engine_coredump *ee;
+- struct intel_context *ce;
++ struct intel_context *ce = NULL;
+ struct i915_request *rq = NULL;
+- unsigned long flags;
+
+ ee = intel_engine_coredump_alloc(engine, ALLOW_FAIL, dump_flags);
+ if (!ee)
+ return NULL;
+
+- ce = intel_engine_get_hung_context(engine);
+- if (ce) {
+- intel_engine_clear_hung_context(engine);
+- rq = intel_context_get_active_request(ce);
+- if (!rq || !i915_request_started(rq))
+- goto no_request_capture;
+- } else {
+- /*
+- * Getting here with GuC enabled means it is a forced error capture
+- * with no actual hang. So, no need to attempt the execlist search.
+- */
+- if (!intel_uc_uses_guc_submission(&engine->gt->uc)) {
+- spin_lock_irqsave(&engine->sched_engine->lock, flags);
+- rq = intel_engine_execlist_find_hung_request(engine);
+- if (rq)
+- rq = i915_request_get_rcu(rq);
+- spin_unlock_irqrestore(&engine->sched_engine->lock,
+- flags);
+- }
+- }
+- if (!rq)
++ intel_engine_get_hung_entity(engine, &ce, &rq);
++ if (!rq || !i915_request_started(rq))
+ goto no_request_capture;
+
+ capture = intel_engine_coredump_add_request(ee, rq, ATOMIC_MAYFAIL);
+--
+2.39.0
+
--- /dev/null
+From bb9fdc1ba1a931c91f1b15b47f0e48e547b26855 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 16:28:35 -0800
+Subject: drm/i915/guc: Fix locking when searching for a hung request
+
+From: John Harrison <John.C.Harrison@Intel.com>
+
+[ Upstream commit 87b04e53daf806945c415e94de9f90943d434aed ]
+
+intel_guc_find_hung_context() was not acquiring the correct spinlock
+before searching the request list. So fix that up. While at it, add
+some extra whitespace padding for readability.
+
+Fixes: dc0dad365c5e ("drm/i915/guc: Fix for error capture after full GPU reset with GuC")
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Acked-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Cc: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Cc: Michael Cheng <michael.cheng@intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: Tejas Upadhyay <tejaskumarx.surendrakumar.upadhyay@intel.com>
+Cc: Chris Wilson <chris.p.wilson@intel.com>
+Cc: Bruce Chang <yu.bruce.chang@intel.com>
+Cc: Alan Previn <alan.previn.teres.alexis@intel.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-2-John.C.Harrison@Intel.com
+(cherry picked from commit d1c3717501bcf56536e8b8c1bdaf5cd5357f6bb2)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+index 1a23e901cc66..259162002c3a 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+@@ -4587,6 +4587,8 @@ void intel_guc_find_hung_context(struct intel_engine_cs *engine)
+
+ xa_lock_irqsave(&guc->context_lookup, flags);
+ xa_for_each(&guc->context_lookup, index, ce) {
++ bool found;
++
+ if (!kref_get_unless_zero(&ce->ref))
+ continue;
+
+@@ -4603,10 +4605,18 @@ void intel_guc_find_hung_context(struct intel_engine_cs *engine)
+ goto next;
+ }
+
++ found = false;
++ spin_lock(&ce->guc_state.lock);
+ list_for_each_entry(rq, &ce->guc_state.requests, sched.link) {
+ if (i915_test_request_state(rq) != I915_REQUEST_ACTIVE)
+ continue;
+
++ found = true;
++ break;
++ }
++ spin_unlock(&ce->guc_state.lock);
++
++ if (found) {
+ intel_engine_set_hung_context(engine, ce);
+
+ /* Can only cope with one hang at a time... */
+@@ -4614,6 +4624,7 @@ void intel_guc_find_hung_context(struct intel_engine_cs *engine)
+ xa_lock(&guc->context_lookup);
+ goto done;
+ }
++
+ next:
+ intel_context_put(ce);
+ xa_lock(&guc->context_lookup);
+--
+2.39.0
+
--- /dev/null
+From 7c10e6e9fd4c6c80055a4af47a702d7c6f2529f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 19:01:08 -0800
+Subject: drm/panel: boe-tv101wum-nl6: Ensure DSI writes succeed during disable
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit a3ee9e0b57f8ecca02d1c16fad4941e09bfe2941 ]
+
+The unprepare sequence has started to fail after moving to panel bridge
+code in the msm drm driver (commit 007ac0262b0d ("drm/msm/dsi: switch to
+DRM_PANEL_BRIDGE")). You'll see messages like this in the kernel logs:
+
+ panel-boe-tv101wum-nl6 ae94000.dsi.0: failed to set panel off: -22
+
+This is because boe_panel_enter_sleep_mode() needs an operating DSI link
+to set the panel into sleep mode. Performing those writes in the
+unprepare phase of bridge ops is too late, because the link has already
+been torn down by the DSI controller in post_disable, i.e. the PHY has
+been disabled, etc. See dsi_mgr_bridge_post_disable() for more details
+on the DSI .
+
+Split the unprepare function into a disable part and an unprepare part.
+For now, just the DSI writes to enter sleep mode are put in the disable
+function. This fixes the panel off routine and keeps the panel happy.
+
+My Wormdingler has an integrated touchscreen that stops responding to
+touch if the panel is only half disabled too. This patch fixes it. And
+finally, this saves power when the screen is off because without this
+fix the regulators for the panel are left enabled when nothing is being
+displayed on the screen.
+
+Fixes: 007ac0262b0d ("drm/msm/dsi: switch to DRM_PANEL_BRIDGE")
+Fixes: a869b9db7adf ("drm/panel: support for boe tv101wum-nl6 wuxga dsi video mode panel")
+Cc: yangcong <yangcong5@huaqin.corp-partner.google.com>
+Cc: Douglas Anderson <dianders@chromium.org>
+Cc: Jitao Shi <jitao.shi@mediatek.com>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Cc: Rob Clark <robdclark@chromium.org>
+Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230106030108.2542081-1-swboyd@chromium.org
+(cherry picked from commit c913cd5489930abbb557ef144a333846286754c3)
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+index 857a2f0420d7..c924f1124ebc 100644
+--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+@@ -1193,14 +1193,11 @@ static int boe_panel_enter_sleep_mode(struct boe_panel *boe)
+ return 0;
+ }
+
+-static int boe_panel_unprepare(struct drm_panel *panel)
++static int boe_panel_disable(struct drm_panel *panel)
+ {
+ struct boe_panel *boe = to_boe_panel(panel);
+ int ret;
+
+- if (!boe->prepared)
+- return 0;
+-
+ ret = boe_panel_enter_sleep_mode(boe);
+ if (ret < 0) {
+ dev_err(panel->dev, "failed to set panel off: %d\n", ret);
+@@ -1209,6 +1206,16 @@ static int boe_panel_unprepare(struct drm_panel *panel)
+
+ msleep(150);
+
++ return 0;
++}
++
++static int boe_panel_unprepare(struct drm_panel *panel)
++{
++ struct boe_panel *boe = to_boe_panel(panel);
++
++ if (!boe->prepared)
++ return 0;
++
+ if (boe->desc->discharge_on_disable) {
+ regulator_disable(boe->avee);
+ regulator_disable(boe->avdd);
+@@ -1528,6 +1535,7 @@ static enum drm_panel_orientation boe_panel_get_orientation(struct drm_panel *pa
+ }
+
+ static const struct drm_panel_funcs boe_panel_funcs = {
++ .disable = boe_panel_disable,
+ .unprepare = boe_panel_unprepare,
+ .prepare = boe_panel_prepare,
+ .enable = boe_panel_enable,
+--
+2.39.0
+
--- /dev/null
+From 5646905ccd3a1f96d245bdb75615b31619bf825b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 19:42:30 +0100
+Subject: drm/ssd130x: Init display before the SSD130X_DISPLAY_ON command
+
+From: Javier Martinez Canillas <javierm@redhat.com>
+
+[ Upstream commit 343c700480982214dc4f834f536a49a4098e556a ]
+
+Commit 622113b9f11f ("drm/ssd130x: Replace simple display helpers with the
+atomic helpers") changed the driver to just use the atomic helpers instead
+of the simple KMS abstraction layer.
+
+But the commit also made a subtle change on the display power sequence and
+initialization order, by moving the ssd130x_power_on() call to the encoder
+.atomic_enable handler and the ssd130x_init() call to CRTC .reset handler.
+
+Before this change, both ssd130x_power_on() and ssd130x_init() were called
+in the simple display pipeline .enable handler, so the display was already
+initialized by the time the SSD130X_DISPLAY_ON command was sent.
+
+For some reasons, it only made the ssd130x SPI driver to fail but the I2C
+was still working. That is the reason why the bug was not noticed before.
+
+To revert to the old driver behavior, move the ssd130x_init() call to the
+encoder .atomic_enable as well. Besides fixing the panel not being turned
+on when using SPI, it also gets rid of the custom CRTC .reset callback.
+
+Fixes: 622113b9f11f ("drm/ssd130x: Replace simple display helpers with the atomic helpers")
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230125184230.3343206-1-javierm@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/solomon/ssd130x.c | 18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/solomon/ssd130x.c b/drivers/gpu/drm/solomon/ssd130x.c
+index bc41a5ae810a..4bb3a247732d 100644
+--- a/drivers/gpu/drm/solomon/ssd130x.c
++++ b/drivers/gpu/drm/solomon/ssd130x.c
+@@ -665,18 +665,8 @@ static const struct drm_crtc_helper_funcs ssd130x_crtc_helper_funcs = {
+ .atomic_check = ssd130x_crtc_helper_atomic_check,
+ };
+
+-static void ssd130x_crtc_reset(struct drm_crtc *crtc)
+-{
+- struct drm_device *drm = crtc->dev;
+- struct ssd130x_device *ssd130x = drm_to_ssd130x(drm);
+-
+- ssd130x_init(ssd130x);
+-
+- drm_atomic_helper_crtc_reset(crtc);
+-}
+-
+ static const struct drm_crtc_funcs ssd130x_crtc_funcs = {
+- .reset = ssd130x_crtc_reset,
++ .reset = drm_atomic_helper_crtc_reset,
+ .destroy = drm_crtc_cleanup,
+ .set_config = drm_atomic_helper_set_config,
+ .page_flip = drm_atomic_helper_page_flip,
+@@ -695,6 +685,12 @@ static void ssd130x_encoder_helper_atomic_enable(struct drm_encoder *encoder,
+ if (ret)
+ return;
+
++ ret = ssd130x_init(ssd130x);
++ if (ret) {
++ ssd130x_power_off(ssd130x);
++ return;
++ }
++
+ ssd130x_write_cmd(ssd130x, 1, SSD130X_DISPLAY_ON);
+
+ backlight_enable(ssd130x->bl_dev);
+--
+2.39.0
+
--- /dev/null
+From c05a3d5d4a309ec810feeae7ca02255834ca70ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 10:02:19 +0100
+Subject: drm/vc4: hdmi: make CEC adapter name unique
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 51128c3f2a7c98055ea1d27e34910dc10977f618 ]
+
+The bcm2711 has two HDMI outputs, each with their own CEC adapter.
+The CEC adapter name has to be unique, but it is currently
+hardcoded to "vc4" for both outputs. Change this to use the card_name
+from the variant information in order to make the adapter name unique.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Fixes: 15b4511a4af6 ("drm/vc4: add HDMI CEC support")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/dcf1db75-d9cc-62cc-fa12-baf1b2b3bf31@xs4all.nl
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index 470432c8fd70..c4b73d9dd040 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -3009,7 +3009,8 @@ static int vc4_hdmi_cec_init(struct vc4_hdmi *vc4_hdmi)
+ }
+
+ vc4_hdmi->cec_adap = cec_allocate_adapter(&vc4_hdmi_cec_adap_ops,
+- vc4_hdmi, "vc4",
++ vc4_hdmi,
++ vc4_hdmi->variant->card_name,
+ CEC_CAP_DEFAULTS |
+ CEC_CAP_CONNECTOR_INFO, 1);
+ ret = PTR_ERR_OR_ZERO(vc4_hdmi->cec_adap);
+--
+2.39.0
+
--- /dev/null
+From 4b15f20631e98a2723e708d0950814d2626d52ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 16:22:13 +0300
+Subject: efi: fix potential NULL deref in efi_mem_reserve_persistent
+
+From: Anton Gusev <aagusev@ispras.ru>
+
+[ Upstream commit 966d47e1f27c45507c5df82b2a2157e5a4fd3909 ]
+
+When iterating on a linked list, a result of memremap is dereferenced
+without checking it for NULL.
+
+This patch adds a check that falls back on allocating a new page in
+case memremap doesn't succeed.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 18df7577adae ("efi/memreserve: deal with memreserve entries in unmapped memory")
+Signed-off-by: Anton Gusev <aagusev@ispras.ru>
+[ardb: return -ENOMEM instead of breaking out of the loop]
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/efi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index 033aac6be7da..b43e5e6ddaf6 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -984,6 +984,8 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size)
+ /* first try to find a slot in an existing linked list entry */
+ for (prsv = efi_memreserve_root->next; prsv; ) {
+ rsv = memremap(prsv, sizeof(*rsv), MEMREMAP_WB);
++ if (!rsv)
++ return -ENOMEM;
+ index = atomic_fetch_add_unless(&rsv->count, 1, rsv->size);
+ if (index < rsv->size) {
+ rsv->entry[index].base = addr;
+--
+2.39.0
+
--- /dev/null
+From 15c8644204c5b32d048cadb27de61eb62b4428e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Sep 2022 19:09:39 -0400
+Subject: fix 'direction' argument of iov_iter_{init,bvec}()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit e3bf3df824675ea9cadc3cd2c75d08ee83a6ae26 ]
+
+READ means "data destination", WRITE - "data source".
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vhost.c | 6 +++---
+ drivers/vhost/vringh.c | 4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 547f89a6940f..c234869d6727 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -833,7 +833,7 @@ static int vhost_copy_to_user(struct vhost_virtqueue *vq, void __user *to,
+ VHOST_ACCESS_WO);
+ if (ret < 0)
+ goto out;
+- iov_iter_init(&t, WRITE, vq->iotlb_iov, ret, size);
++ iov_iter_init(&t, READ, vq->iotlb_iov, ret, size);
+ ret = copy_to_iter(from, size, &t);
+ if (ret == size)
+ ret = 0;
+@@ -872,7 +872,7 @@ static int vhost_copy_from_user(struct vhost_virtqueue *vq, void *to,
+ (unsigned long long) size);
+ goto out;
+ }
+- iov_iter_init(&f, READ, vq->iotlb_iov, ret, size);
++ iov_iter_init(&f, WRITE, vq->iotlb_iov, ret, size);
+ ret = copy_from_iter(to, size, &f);
+ if (ret == size)
+ ret = 0;
+@@ -2136,7 +2136,7 @@ static int get_indirect(struct vhost_virtqueue *vq,
+ vq_err(vq, "Translation failure %d in indirect.\n", ret);
+ return ret;
+ }
+- iov_iter_init(&from, READ, vq->indirect, ret, len);
++ iov_iter_init(&from, WRITE, vq->indirect, ret, len);
+ count = len / sizeof desc;
+ /* Buffers are chained via a 16 bit next field, so
+ * we can have at most 2^16 of these. */
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index 828c29306565..139c782848c6 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -1161,7 +1161,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
+ else if (ret < 0)
+ return ret;
+
+- iov_iter_bvec(&iter, READ, iov, ret, translated);
++ iov_iter_bvec(&iter, WRITE, iov, ret, translated);
+
+ ret = copy_from_iter(dst, translated, &iter);
+ if (ret < 0)
+@@ -1194,7 +1194,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
+ else if (ret < 0)
+ return ret;
+
+- iov_iter_bvec(&iter, WRITE, iov, ret, translated);
++ iov_iter_bvec(&iter, READ, iov, ret, translated);
+
+ ret = copy_to_iter(src, translated, &iter);
+ if (ret < 0)
+--
+2.39.0
+
--- /dev/null
+From 09ad65ee301cb6f20ae4832a45d4f9e29d770df0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Sep 2022 19:16:56 -0400
+Subject: fix "direction" argument of iov_iter_kvec()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit fc02f33787d8dd227b54f263eba983d5b249c032 ]
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-back.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index d6f945fd4147..21b9c850a382 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -129,13 +129,13 @@ static bool pvcalls_conn_back_read(void *opaque)
+ if (masked_prod < masked_cons) {
+ vec[0].iov_base = data->in + masked_prod;
+ vec[0].iov_len = wanted;
+- iov_iter_kvec(&msg.msg_iter, WRITE, vec, 1, wanted);
++ iov_iter_kvec(&msg.msg_iter, READ, vec, 1, wanted);
+ } else {
+ vec[0].iov_base = data->in + masked_prod;
+ vec[0].iov_len = array_size - masked_prod;
+ vec[1].iov_base = data->in;
+ vec[1].iov_len = wanted - vec[0].iov_len;
+- iov_iter_kvec(&msg.msg_iter, WRITE, vec, 2, wanted);
++ iov_iter_kvec(&msg.msg_iter, READ, vec, 2, wanted);
+ }
+
+ atomic_set(&map->read, 0);
+@@ -188,13 +188,13 @@ static bool pvcalls_conn_back_write(struct sock_mapping *map)
+ if (pvcalls_mask(prod, array_size) > pvcalls_mask(cons, array_size)) {
+ vec[0].iov_base = data->out + pvcalls_mask(cons, array_size);
+ vec[0].iov_len = size;
+- iov_iter_kvec(&msg.msg_iter, READ, vec, 1, size);
++ iov_iter_kvec(&msg.msg_iter, WRITE, vec, 1, size);
+ } else {
+ vec[0].iov_base = data->out + pvcalls_mask(cons, array_size);
+ vec[0].iov_len = array_size - pvcalls_mask(cons, array_size);
+ vec[1].iov_base = data->out;
+ vec[1].iov_len = size - vec[0].iov_len;
+- iov_iter_kvec(&msg.msg_iter, READ, vec, 2, size);
++ iov_iter_kvec(&msg.msg_iter, WRITE, vec, 2, size);
+ }
+
+ atomic_set(&map->write, 0);
+--
+2.39.0
+
--- /dev/null
+From 1001a259456372f0a03db49cf03349d7b215c3dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Sep 2022 19:04:18 -0400
+Subject: fix iov_iter_bvec() "direction" argument
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit b676668d99155e6859d99bbf2df18b3f03851902 ]
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_file.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
+index 28aa643be5d5..55935040541b 100644
+--- a/drivers/target/target_core_file.c
++++ b/drivers/target/target_core_file.c
+@@ -337,7 +337,7 @@ static int fd_do_rw(struct se_cmd *cmd, struct file *fd,
+ len += sg->length;
+ }
+
+- iov_iter_bvec(&iter, READ, bvec, sgl_nents, len);
++ iov_iter_bvec(&iter, is_write, bvec, sgl_nents, len);
+ if (is_write)
+ ret = vfs_iter_write(fd, &iter, &pos, 0);
+ else
+@@ -473,7 +473,7 @@ fd_execute_write_same(struct se_cmd *cmd)
+ len += se_dev->dev_attrib.block_size;
+ }
+
+- iov_iter_bvec(&iter, READ, bvec, nolb, len);
++ iov_iter_bvec(&iter, WRITE, bvec, nolb, len);
+ ret = vfs_iter_write(fd_dev->fd_file, &iter, &pos, 0);
+
+ kfree(bvec);
+--
+2.39.0
+
--- /dev/null
+From 97b1dc985ce1d6235a025671abbaf83173e3c1c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 19:52:10 +0800
+Subject: fscache: Use wait_on_bit() to wait for the freeing of relinquished
+ volume
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 8226e37d82f43657da34dd770e2b38f20242ada7 ]
+
+The freeing of relinquished volume will wake up the pending volume
+acquisition by using wake_up_bit(), however it is mismatched with
+wait_var_event() used in fscache_wait_on_volume_collision() and it will
+never wake up the waiter in the wait-queue because these two functions
+operate on different wait-queues.
+
+According to the implementation in fscache_wait_on_volume_collision(),
+if the wake-up of pending acquisition is delayed longer than 20 seconds
+(e.g., due to the delay of on-demand fd closing), the first
+wait_var_event_timeout() will timeout and the following wait_var_event()
+will hang forever as shown below:
+
+ FS-Cache: Potential volume collision new=00000024 old=00000022
+ ......
+ INFO: task mount:1148 blocked for more than 122 seconds.
+ Not tainted 6.1.0-rc6+ #1
+ task:mount state:D stack:0 pid:1148 ppid:1
+ Call Trace:
+ <TASK>
+ __schedule+0x2f6/0xb80
+ schedule+0x67/0xe0
+ fscache_wait_on_volume_collision.cold+0x80/0x82
+ __fscache_acquire_volume+0x40d/0x4e0
+ erofs_fscache_register_volume+0x51/0xe0 [erofs]
+ erofs_fscache_register_fs+0x19c/0x240 [erofs]
+ erofs_fc_fill_super+0x746/0xaf0 [erofs]
+ vfs_get_super+0x7d/0x100
+ get_tree_nodev+0x16/0x20
+ erofs_fc_get_tree+0x20/0x30 [erofs]
+ vfs_get_tree+0x24/0xb0
+ path_mount+0x2fa/0xa90
+ do_mount+0x7c/0xa0
+ __x64_sys_mount+0x8b/0xe0
+ do_syscall_64+0x30/0x60
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+Considering that wake_up_bit() is more selective, so fix it by using
+wait_on_bit() instead of wait_var_event() to wait for the freeing of
+relinquished volume. In addition because waitqueue_active() is used in
+wake_up_bit() and clear_bit() doesn't imply any memory barrier, use
+clear_and_wake_up_bit() to add the missing memory barrier between
+cursor->flags and waitqueue_active().
+
+Fixes: 62ab63352350 ("fscache: Implement volume registration")
+Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Link: https://lore.kernel.org/r/20230113115211.2895845-2-houtao@huaweicloud.com/ # v3
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fscache/volume.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/fscache/volume.c b/fs/fscache/volume.c
+index ab8ceddf9efa..903af9d85f8b 100644
+--- a/fs/fscache/volume.c
++++ b/fs/fscache/volume.c
+@@ -141,13 +141,14 @@ static bool fscache_is_acquire_pending(struct fscache_volume *volume)
+ static void fscache_wait_on_volume_collision(struct fscache_volume *candidate,
+ unsigned int collidee_debug_id)
+ {
+- wait_var_event_timeout(&candidate->flags,
+- !fscache_is_acquire_pending(candidate), 20 * HZ);
++ wait_on_bit_timeout(&candidate->flags, FSCACHE_VOLUME_ACQUIRE_PENDING,
++ TASK_UNINTERRUPTIBLE, 20 * HZ);
+ if (fscache_is_acquire_pending(candidate)) {
+ pr_notice("Potential volume collision new=%08x old=%08x",
+ candidate->debug_id, collidee_debug_id);
+ fscache_stat(&fscache_n_volumes_collision);
+- wait_var_event(&candidate->flags, !fscache_is_acquire_pending(candidate));
++ wait_on_bit(&candidate->flags, FSCACHE_VOLUME_ACQUIRE_PENDING,
++ TASK_UNINTERRUPTIBLE);
+ }
+ }
+
+@@ -347,8 +348,8 @@ static void fscache_wake_pending_volume(struct fscache_volume *volume,
+ hlist_bl_for_each_entry(cursor, p, h, hash_link) {
+ if (fscache_volume_same(cursor, volume)) {
+ fscache_see_volume(cursor, fscache_volume_see_hash_wake);
+- clear_bit(FSCACHE_VOLUME_ACQUIRE_PENDING, &cursor->flags);
+- wake_up_bit(&cursor->flags, FSCACHE_VOLUME_ACQUIRE_PENDING);
++ clear_and_wake_up_bit(FSCACHE_VOLUME_ACQUIRE_PENDING,
++ &cursor->flags);
+ return;
+ }
+ }
+--
+2.39.0
+
--- /dev/null
+From 021af8422d999b964839507042340e7fdbd41dba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jan 2023 22:39:55 +0530
+Subject: i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit 2ece0930ac5662bccce0ba4c59b84c98d2437200 ]
+
+Add additional supported PCI IDs for latest AMD NAVI GPU card which
+has an integrated Type-C controller and designware I2C with PCI
+interface.
+
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Tested-by: Sanath S <Sanath.S@amd.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-pcidrv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c
+index e499f96506c5..782fe1ef3ca1 100644
+--- a/drivers/i2c/busses/i2c-designware-pcidrv.c
++++ b/drivers/i2c/busses/i2c-designware-pcidrv.c
+@@ -396,6 +396,8 @@ static const struct pci_device_id i2_designware_pci_ids[] = {
+ { PCI_VDEVICE(ATI, 0x73a4), navi_amd },
+ { PCI_VDEVICE(ATI, 0x73e4), navi_amd },
+ { PCI_VDEVICE(ATI, 0x73c4), navi_amd },
++ { PCI_VDEVICE(ATI, 0x7444), navi_amd },
++ { PCI_VDEVICE(ATI, 0x7464), navi_amd },
+ { 0,}
+ };
+ MODULE_DEVICE_TABLE(pci, i2_designware_pci_ids);
+--
+2.39.0
+
--- /dev/null
+From d372e779c4e4b7038bd03d8a0eca94539e97ac37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Jan 2023 13:32:29 +0100
+Subject: i2c: mxs: suppress probe-deferral error message
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 78a4471fa1a76a8bef4919105de67660a89a1e9b ]
+
+During boot of I2SE Duckbill the kernel log contains a
+confusing error:
+
+ Failed to request dma
+
+This is caused by i2c-mxs tries to request a not yet available DMA
+channel (-EPROBE_DEFER). So suppress this message by using
+dev_err_probe().
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mxs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
+index 5af5cffc444e..d113bed79545 100644
+--- a/drivers/i2c/busses/i2c-mxs.c
++++ b/drivers/i2c/busses/i2c-mxs.c
+@@ -826,8 +826,8 @@ static int mxs_i2c_probe(struct platform_device *pdev)
+ /* Setup the DMA */
+ i2c->dmach = dma_request_chan(dev, "rx-tx");
+ if (IS_ERR(i2c->dmach)) {
+- dev_err(dev, "Failed to request dma\n");
+- return PTR_ERR(i2c->dmach);
++ return dev_err_probe(dev, PTR_ERR(i2c->dmach),
++ "Failed to request dma\n");
+ }
+
+ platform_set_drvdata(pdev, i2c);
+--
+2.39.0
+
--- /dev/null
+From 860d859ec57099db13f61584805ccfe33fff156b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 22:38:05 -0800
+Subject: i2c: rk3x: fix a bunch of kernel-doc warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 0582d984793d30442da88fe458674502bad1ad29 ]
+
+Fix multiple W=1 kernel-doc warnings in i2c-rk3x.c:
+
+drivers/i2c/busses/i2c-rk3x.c:83: warning: missing initial short description on line:
+ * struct i2c_spec_values:
+drivers/i2c/busses/i2c-rk3x.c:139: warning: missing initial short description on line:
+ * struct rk3x_i2c_calced_timings:
+drivers/i2c/busses/i2c-rk3x.c:162: warning: missing initial short description on line:
+ * struct rk3x_i2c_soc_data:
+drivers/i2c/busses/i2c-rk3x.c:242: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
+ * Generate a START condition, which triggers a REG_INT_START interrupt.
+drivers/i2c/busses/i2c-rk3x.c:261: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
+ * Generate a STOP condition, which triggers a REG_INT_STOP interrupt.
+drivers/i2c/busses/i2c-rk3x.c:304: warning: expecting prototype for Setup a read according to i2c(). Prototype was for rk3x_i2c_prepare_read() instead
+drivers/i2c/busses/i2c-rk3x.c:335: warning: expecting prototype for Fill the transmit buffer with data from i2c(). Prototype was for rk3x_i2c_fill_transmit_buf() instead
+drivers/i2c/busses/i2c-rk3x.c:535: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
+ * Get timing values of I2C specification
+drivers/i2c/busses/i2c-rk3x.c:552: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
+ * Calculate divider values for desired SCL frequency
+drivers/i2c/busses/i2c-rk3x.c:713: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
+ * Calculate timing values for desired SCL frequency
+drivers/i2c/busses/i2c-rk3x.c:963: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
+ * Setup I2C registers for an I2C operation specified by msgs, num.
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rk3x.c | 44 +++++++++++++++++------------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
+index d1658ed76562..b31cf4f18f85 100644
+--- a/drivers/i2c/busses/i2c-rk3x.c
++++ b/drivers/i2c/busses/i2c-rk3x.c
+@@ -80,7 +80,7 @@ enum {
+ #define DEFAULT_SCL_RATE (100 * 1000) /* Hz */
+
+ /**
+- * struct i2c_spec_values:
++ * struct i2c_spec_values - I2C specification values for various modes
+ * @min_hold_start_ns: min hold time (repeated) START condition
+ * @min_low_ns: min LOW period of the SCL clock
+ * @min_high_ns: min HIGH period of the SCL cloc
+@@ -136,7 +136,7 @@ static const struct i2c_spec_values fast_mode_plus_spec = {
+ };
+
+ /**
+- * struct rk3x_i2c_calced_timings:
++ * struct rk3x_i2c_calced_timings - calculated V1 timings
+ * @div_low: Divider output for low
+ * @div_high: Divider output for high
+ * @tuning: Used to adjust setup/hold data time,
+@@ -159,7 +159,7 @@ enum rk3x_i2c_state {
+ };
+
+ /**
+- * struct rk3x_i2c_soc_data:
++ * struct rk3x_i2c_soc_data - SOC-specific data
+ * @grf_offset: offset inside the grf regmap for setting the i2c type
+ * @calc_timings: Callback function for i2c timing information calculated
+ */
+@@ -239,7 +239,8 @@ static inline void rk3x_i2c_clean_ipd(struct rk3x_i2c *i2c)
+ }
+
+ /**
+- * Generate a START condition, which triggers a REG_INT_START interrupt.
++ * rk3x_i2c_start - Generate a START condition, which triggers a REG_INT_START interrupt.
++ * @i2c: target controller data
+ */
+ static void rk3x_i2c_start(struct rk3x_i2c *i2c)
+ {
+@@ -258,8 +259,8 @@ static void rk3x_i2c_start(struct rk3x_i2c *i2c)
+ }
+
+ /**
+- * Generate a STOP condition, which triggers a REG_INT_STOP interrupt.
+- *
++ * rk3x_i2c_stop - Generate a STOP condition, which triggers a REG_INT_STOP interrupt.
++ * @i2c: target controller data
+ * @error: Error code to return in rk3x_i2c_xfer
+ */
+ static void rk3x_i2c_stop(struct rk3x_i2c *i2c, int error)
+@@ -298,7 +299,8 @@ static void rk3x_i2c_stop(struct rk3x_i2c *i2c, int error)
+ }
+
+ /**
+- * Setup a read according to i2c->msg
++ * rk3x_i2c_prepare_read - Setup a read according to i2c->msg
++ * @i2c: target controller data
+ */
+ static void rk3x_i2c_prepare_read(struct rk3x_i2c *i2c)
+ {
+@@ -329,7 +331,8 @@ static void rk3x_i2c_prepare_read(struct rk3x_i2c *i2c)
+ }
+
+ /**
+- * Fill the transmit buffer with data from i2c->msg
++ * rk3x_i2c_fill_transmit_buf - Fill the transmit buffer with data from i2c->msg
++ * @i2c: target controller data
+ */
+ static void rk3x_i2c_fill_transmit_buf(struct rk3x_i2c *i2c)
+ {
+@@ -532,11 +535,10 @@ static irqreturn_t rk3x_i2c_irq(int irqno, void *dev_id)
+ }
+
+ /**
+- * Get timing values of I2C specification
+- *
++ * rk3x_i2c_get_spec - Get timing values of I2C specification
+ * @speed: Desired SCL frequency
+ *
+- * Returns: Matched i2c spec values.
++ * Return: Matched i2c_spec_values.
+ */
+ static const struct i2c_spec_values *rk3x_i2c_get_spec(unsigned int speed)
+ {
+@@ -549,13 +551,12 @@ static const struct i2c_spec_values *rk3x_i2c_get_spec(unsigned int speed)
+ }
+
+ /**
+- * Calculate divider values for desired SCL frequency
+- *
++ * rk3x_i2c_v0_calc_timings - Calculate divider values for desired SCL frequency
+ * @clk_rate: I2C input clock rate
+ * @t: Known I2C timing information
+ * @t_calc: Caculated rk3x private timings that would be written into regs
+ *
+- * Returns: 0 on success, -EINVAL if the goal SCL rate is too slow. In that case
++ * Return: %0 on success, -%EINVAL if the goal SCL rate is too slow. In that case
+ * a best-effort divider value is returned in divs. If the target rate is
+ * too high, we silently use the highest possible rate.
+ */
+@@ -710,13 +711,12 @@ static int rk3x_i2c_v0_calc_timings(unsigned long clk_rate,
+ }
+
+ /**
+- * Calculate timing values for desired SCL frequency
+- *
++ * rk3x_i2c_v1_calc_timings - Calculate timing values for desired SCL frequency
+ * @clk_rate: I2C input clock rate
+ * @t: Known I2C timing information
+ * @t_calc: Caculated rk3x private timings that would be written into regs
+ *
+- * Returns: 0 on success, -EINVAL if the goal SCL rate is too slow. In that case
++ * Return: %0 on success, -%EINVAL if the goal SCL rate is too slow. In that case
+ * a best-effort divider value is returned in divs. If the target rate is
+ * too high, we silently use the highest possible rate.
+ * The following formulas are v1's method to calculate timings.
+@@ -960,14 +960,14 @@ static int rk3x_i2c_clk_notifier_cb(struct notifier_block *nb, unsigned long
+ }
+
+ /**
+- * Setup I2C registers for an I2C operation specified by msgs, num.
+- *
+- * Must be called with i2c->lock held.
+- *
++ * rk3x_i2c_setup - Setup I2C registers for an I2C operation specified by msgs, num.
++ * @i2c: target controller data
+ * @msgs: I2C msgs to process
+ * @num: Number of msgs
+ *
+- * returns: Number of I2C msgs processed or negative in case of error
++ * Must be called with i2c->lock held.
++ *
++ * Return: Number of I2C msgs processed or negative in case of error
+ */
+ static int rk3x_i2c_setup(struct rk3x_i2c *i2c, struct i2c_msg *msgs, int num)
+ {
+--
+2.39.0
+
--- /dev/null
+From e32d7e59dd44f76de5eb806d154c1f976304db87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 09:19:43 -0800
+Subject: ice: Prevent set_channel from changing queues while RDMA active
+
+From: Dave Ertman <david.m.ertman@intel.com>
+
+[ Upstream commit a6a0974aae4209d039ba81226ded5246eea14961 ]
+
+The PF controls the set of queues that the RDMA auxiliary_driver requests
+resources from. The set_channel command will alter that pool and trigger a
+reconfiguration of the VSI, which breaks RDMA functionality.
+
+Prevent set_channel from executing when RDMA driver bound to auxiliary
+device.
+
+Adding a locked variable to pass down the call chain to avoid double
+locking the device_lock.
+
+Fixes: 348048e724a0 ("ice: Implement iidc operations")
+Signed-off-by: Dave Ertman <david.m.ertman@intel.com>
+Tested-by: Gurucharan G <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice.h | 2 +-
+ drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 23 +++++++++-------
+ drivers/net/ethernet/intel/ice/ice_dcb_lib.h | 4 +--
+ drivers/net/ethernet/intel/ice/ice_ethtool.c | 28 +++++++++++++++++---
+ drivers/net/ethernet/intel/ice/ice_main.c | 5 ++--
+ 5 files changed, 43 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
+index 001500afc4a6..e04871379baa 100644
+--- a/drivers/net/ethernet/intel/ice/ice.h
++++ b/drivers/net/ethernet/intel/ice/ice.h
+@@ -856,7 +856,7 @@ void ice_set_ethtool_repr_ops(struct net_device *netdev);
+ void ice_set_ethtool_safe_mode_ops(struct net_device *netdev);
+ u16 ice_get_avail_txq_count(struct ice_pf *pf);
+ u16 ice_get_avail_rxq_count(struct ice_pf *pf);
+-int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx);
++int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked);
+ void ice_update_vsi_stats(struct ice_vsi *vsi);
+ void ice_update_pf_stats(struct ice_pf *pf);
+ void
+diff --git a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
+index add90e75f05c..9aa0437aa598 100644
+--- a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c
+@@ -434,7 +434,7 @@ int ice_pf_dcb_cfg(struct ice_pf *pf, struct ice_dcbx_cfg *new_cfg, bool locked)
+ goto out;
+ }
+
+- ice_pf_dcb_recfg(pf);
++ ice_pf_dcb_recfg(pf, false);
+
+ out:
+ /* enable previously downed VSIs */
+@@ -724,12 +724,13 @@ static int ice_dcb_noncontig_cfg(struct ice_pf *pf)
+ /**
+ * ice_pf_dcb_recfg - Reconfigure all VEBs and VSIs
+ * @pf: pointer to the PF struct
++ * @locked: is adev device lock held
+ *
+ * Assumed caller has already disabled all VSIs before
+ * calling this function. Reconfiguring DCB based on
+ * local_dcbx_cfg.
+ */
+-void ice_pf_dcb_recfg(struct ice_pf *pf)
++void ice_pf_dcb_recfg(struct ice_pf *pf, bool locked)
+ {
+ struct ice_dcbx_cfg *dcbcfg = &pf->hw.port_info->qos_cfg.local_dcbx_cfg;
+ struct iidc_event *event;
+@@ -776,14 +777,16 @@ void ice_pf_dcb_recfg(struct ice_pf *pf)
+ if (vsi->type == ICE_VSI_PF)
+ ice_dcbnl_set_all(vsi);
+ }
+- /* Notify the AUX drivers that TC change is finished */
+- event = kzalloc(sizeof(*event), GFP_KERNEL);
+- if (!event)
+- return;
++ if (!locked) {
++ /* Notify the AUX drivers that TC change is finished */
++ event = kzalloc(sizeof(*event), GFP_KERNEL);
++ if (!event)
++ return;
+
+- set_bit(IIDC_EVENT_AFTER_TC_CHANGE, event->type);
+- ice_send_event_to_aux(pf, event);
+- kfree(event);
++ set_bit(IIDC_EVENT_AFTER_TC_CHANGE, event->type);
++ ice_send_event_to_aux(pf, event);
++ kfree(event);
++ }
+ }
+
+ /**
+@@ -1034,7 +1037,7 @@ ice_dcb_process_lldp_set_mib_change(struct ice_pf *pf,
+ }
+
+ /* changes in configuration update VSI */
+- ice_pf_dcb_recfg(pf);
++ ice_pf_dcb_recfg(pf, false);
+
+ /* enable previously downed VSIs */
+ ice_dcb_ena_dis_vsi(pf, true, true);
+diff --git a/drivers/net/ethernet/intel/ice/ice_dcb_lib.h b/drivers/net/ethernet/intel/ice/ice_dcb_lib.h
+index 4c421c842a13..800879a88c5e 100644
+--- a/drivers/net/ethernet/intel/ice/ice_dcb_lib.h
++++ b/drivers/net/ethernet/intel/ice/ice_dcb_lib.h
+@@ -23,7 +23,7 @@ u8 ice_dcb_get_tc(struct ice_vsi *vsi, int queue_index);
+ int
+ ice_pf_dcb_cfg(struct ice_pf *pf, struct ice_dcbx_cfg *new_cfg, bool locked);
+ int ice_dcb_bwchk(struct ice_pf *pf, struct ice_dcbx_cfg *dcbcfg);
+-void ice_pf_dcb_recfg(struct ice_pf *pf);
++void ice_pf_dcb_recfg(struct ice_pf *pf, bool locked);
+ void ice_vsi_cfg_dcb_rings(struct ice_vsi *vsi);
+ int ice_init_pf_dcb(struct ice_pf *pf, bool locked);
+ void ice_update_dcb_stats(struct ice_pf *pf);
+@@ -128,7 +128,7 @@ static inline u8 ice_get_pfc_mode(struct ice_pf *pf)
+ return 0;
+ }
+
+-static inline void ice_pf_dcb_recfg(struct ice_pf *pf) { }
++static inline void ice_pf_dcb_recfg(struct ice_pf *pf, bool locked) { }
+ static inline void ice_vsi_cfg_dcb_rings(struct ice_vsi *vsi) { }
+ static inline void ice_update_dcb_stats(struct ice_pf *pf) { }
+ static inline void
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index b7be84bbe72d..e1f6373a3a2c 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -3472,7 +3472,9 @@ static int ice_set_channels(struct net_device *dev, struct ethtool_channels *ch)
+ struct ice_vsi *vsi = np->vsi;
+ struct ice_pf *pf = vsi->back;
+ int new_rx = 0, new_tx = 0;
++ bool locked = false;
+ u32 curr_combined;
++ int ret = 0;
+
+ /* do not support changing channels in Safe Mode */
+ if (ice_is_safe_mode(pf)) {
+@@ -3536,15 +3538,33 @@ static int ice_set_channels(struct net_device *dev, struct ethtool_channels *ch)
+ return -EINVAL;
+ }
+
+- ice_vsi_recfg_qs(vsi, new_rx, new_tx);
++ if (pf->adev) {
++ mutex_lock(&pf->adev_mutex);
++ device_lock(&pf->adev->dev);
++ locked = true;
++ if (pf->adev->dev.driver) {
++ netdev_err(dev, "Cannot change channels when RDMA is active\n");
++ ret = -EBUSY;
++ goto adev_unlock;
++ }
++ }
++
++ ice_vsi_recfg_qs(vsi, new_rx, new_tx, locked);
+
+- if (!netif_is_rxfh_configured(dev))
+- return ice_vsi_set_dflt_rss_lut(vsi, new_rx);
++ if (!netif_is_rxfh_configured(dev)) {
++ ret = ice_vsi_set_dflt_rss_lut(vsi, new_rx);
++ goto adev_unlock;
++ }
+
+ /* Update rss_size due to change in Rx queues */
+ vsi->rss_size = ice_get_valid_rss_size(&pf->hw, new_rx);
+
+- return 0;
++adev_unlock:
++ if (locked) {
++ device_unlock(&pf->adev->dev);
++ mutex_unlock(&pf->adev_mutex);
++ }
++ return ret;
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index ca2898467dcb..1ac5f0018c7e 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -4192,12 +4192,13 @@ bool ice_is_wol_supported(struct ice_hw *hw)
+ * @vsi: VSI being changed
+ * @new_rx: new number of Rx queues
+ * @new_tx: new number of Tx queues
++ * @locked: is adev device_lock held
+ *
+ * Only change the number of queues if new_tx, or new_rx is non-0.
+ *
+ * Returns 0 on success.
+ */
+-int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx)
++int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked)
+ {
+ struct ice_pf *pf = vsi->back;
+ int err = 0, timeout = 50;
+@@ -4226,7 +4227,7 @@ int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx)
+
+ ice_vsi_close(vsi);
+ ice_vsi_rebuild(vsi, false);
+- ice_pf_dcb_recfg(pf);
++ ice_pf_dcb_recfg(pf, locked);
+ ice_vsi_open(vsi);
+ done:
+ clear_bit(ICE_CFG_BUSY, pf->state);
+--
+2.39.0
+
--- /dev/null
+From ec896a458986c0b410175ff72f9d239a8209fada Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 13:54:37 -0800
+Subject: igc: return an error if the mac type is unknown in
+ igc_ptp_systim_to_hwtstamp()
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit a2df8463e15c10a8a882090f3d7a760fdb7b189d ]
+
+clang static analysis reports
+drivers/net/ethernet/intel/igc/igc_ptp.c:673:3: warning: The left operand of
+ '+' is a garbage value [core.UndefinedBinaryOperatorResult]
+ ktime_add_ns(shhwtstamps.hwtstamp, adjust);
+ ^ ~~~~~~~~~~~~~~~~~~~~
+
+igc_ptp_systim_to_hwtstamp() silently returns without setting the hwtstamp
+if the mac type is unknown. This should be treated as an error.
+
+Fixes: 81b055205e8b ("igc: Add support for RX timestamping")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Acked-by: Sasha Neftin <sasha.neftin@intel.com>
+Tested-by: Naama Meir <naamax.meir@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://lore.kernel.org/r/20230131215437.1528994-1-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_ptp.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c
+index c34734d432e0..4e10ced736db 100644
+--- a/drivers/net/ethernet/intel/igc/igc_ptp.c
++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c
+@@ -417,10 +417,12 @@ static int igc_ptp_verify_pin(struct ptp_clock_info *ptp, unsigned int pin,
+ *
+ * We need to convert the system time value stored in the RX/TXSTMP registers
+ * into a hwtstamp which can be used by the upper level timestamping functions.
++ *
++ * Returns 0 on success.
+ **/
+-static void igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter,
+- struct skb_shared_hwtstamps *hwtstamps,
+- u64 systim)
++static int igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter,
++ struct skb_shared_hwtstamps *hwtstamps,
++ u64 systim)
+ {
+ switch (adapter->hw.mac.type) {
+ case igc_i225:
+@@ -430,8 +432,9 @@ static void igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter,
+ systim & 0xFFFFFFFF);
+ break;
+ default:
+- break;
++ return -EINVAL;
+ }
++ return 0;
+ }
+
+ /**
+@@ -652,7 +655,8 @@ static void igc_ptp_tx_hwtstamp(struct igc_adapter *adapter)
+
+ regval = rd32(IGC_TXSTMPL);
+ regval |= (u64)rd32(IGC_TXSTMPH) << 32;
+- igc_ptp_systim_to_hwtstamp(adapter, &shhwtstamps, regval);
++ if (igc_ptp_systim_to_hwtstamp(adapter, &shhwtstamps, regval))
++ return;
+
+ switch (adapter->link_speed) {
+ case SPEED_10:
+--
+2.39.0
+
--- /dev/null
+From 2a3f19ec5524fb7a90ed733505c302d081168d06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 16:46:45 +1300
+Subject: ip/ip6_gre: Fix changing addr gen mode not generating IPv6 link local
+ address
+
+From: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
+
+[ Upstream commit 23ca0c2c93406bdb1150659e720bda1cec1fad04 ]
+
+For our point-to-point GRE tunnels, they have IN6_ADDR_GEN_MODE_NONE
+when they are created then we set IN6_ADDR_GEN_MODE_EUI64 when they
+come up to generate the IPv6 link local address for the interface.
+Recently we found that they were no longer generating IPv6 addresses.
+This issue would also have affected SIT tunnels.
+
+Commit e5dd729460ca changed the code path so that GRE tunnels
+generate an IPv6 address based on the tunnel source address.
+It also changed the code path so GRE tunnels don't call addrconf_addr_gen
+in addrconf_dev_config which is called by addrconf_sysctl_addr_gen_mode
+when the IN6_ADDR_GEN_MODE is changed.
+
+This patch aims to fix this issue by moving the code in addrconf_notify
+which calls the addr gen for GRE and SIT into a separate function
+and calling it in the places that expect the IPv6 address to be
+generated.
+
+The previous addrconf_dev_config is renamed to addrconf_eth_config
+since it only expected eth type interfaces and follows the
+addrconf_gre/sit_config format.
+
+A part of this changes means that the loopback address will be
+attempted to be configured when changing addr_gen_mode for lo.
+This should not be a problem because the address should exist anyway
+and if does already exist then no error is produced.
+
+Fixes: e5dd729460ca ("ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL address")
+Signed-off-by: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 49 +++++++++++++++++++++++++--------------------
+ 1 file changed, 27 insertions(+), 22 deletions(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 9c3f5202a97b..eaecaf2ffe00 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -3447,6 +3447,30 @@ static void addrconf_gre_config(struct net_device *dev)
+ }
+ #endif
+
++static void addrconf_init_auto_addrs(struct net_device *dev)
++{
++ switch (dev->type) {
++#if IS_ENABLED(CONFIG_IPV6_SIT)
++ case ARPHRD_SIT:
++ addrconf_sit_config(dev);
++ break;
++#endif
++#if IS_ENABLED(CONFIG_NET_IPGRE) || IS_ENABLED(CONFIG_IPV6_GRE)
++ case ARPHRD_IP6GRE:
++ case ARPHRD_IPGRE:
++ addrconf_gre_config(dev);
++ break;
++#endif
++ case ARPHRD_LOOPBACK:
++ init_loopback(dev);
++ break;
++
++ default:
++ addrconf_dev_config(dev);
++ break;
++ }
++}
++
+ static int fixup_permanent_addr(struct net *net,
+ struct inet6_dev *idev,
+ struct inet6_ifaddr *ifp)
+@@ -3615,26 +3639,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
+ run_pending = 1;
+ }
+
+- switch (dev->type) {
+-#if IS_ENABLED(CONFIG_IPV6_SIT)
+- case ARPHRD_SIT:
+- addrconf_sit_config(dev);
+- break;
+-#endif
+-#if IS_ENABLED(CONFIG_NET_IPGRE) || IS_ENABLED(CONFIG_IPV6_GRE)
+- case ARPHRD_IP6GRE:
+- case ARPHRD_IPGRE:
+- addrconf_gre_config(dev);
+- break;
+-#endif
+- case ARPHRD_LOOPBACK:
+- init_loopback(dev);
+- break;
+-
+- default:
+- addrconf_dev_config(dev);
+- break;
+- }
++ addrconf_init_auto_addrs(dev);
+
+ if (!IS_ERR_OR_NULL(idev)) {
+ if (run_pending)
+@@ -6397,7 +6402,7 @@ static int addrconf_sysctl_addr_gen_mode(struct ctl_table *ctl, int write,
+
+ if (idev->cnf.addr_gen_mode != new_val) {
+ idev->cnf.addr_gen_mode = new_val;
+- addrconf_dev_config(idev->dev);
++ addrconf_init_auto_addrs(idev->dev);
+ }
+ } else if (&net->ipv6.devconf_all->addr_gen_mode == ctl->data) {
+ struct net_device *dev;
+@@ -6408,7 +6413,7 @@ static int addrconf_sysctl_addr_gen_mode(struct ctl_table *ctl, int write,
+ if (idev &&
+ idev->cnf.addr_gen_mode != new_val) {
+ idev->cnf.addr_gen_mode = new_val;
+- addrconf_dev_config(idev->dev);
++ addrconf_init_auto_addrs(idev->dev);
+ }
+ }
+ }
+--
+2.39.0
+
--- /dev/null
+From 80c5276d45492d51962b3d36af335cf7819e05b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 16:46:46 +1300
+Subject: ip/ip6_gre: Fix non-point-to-point tunnel not generating IPv6 link
+ local address
+
+From: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
+
+[ Upstream commit 30e2291f61f93f7132c060190f8360df52644ec1 ]
+
+We recently found that our non-point-to-point tunnels were not
+generating any IPv6 link local address and instead generating an
+IPv6 compat address, breaking IPv6 communication on the tunnel.
+
+Previously, addrconf_gre_config always would call addrconf_addr_gen
+and generate a EUI64 link local address for the tunnel.
+Then commit e5dd729460ca changed the code path so that add_v4_addrs
+is called but this only generates a compat IPv6 address for
+non-point-to-point tunnels.
+
+I assume the compat address is specifically for SIT tunnels so
+have kept that only for SIT - GRE tunnels now always generate link
+local addresses.
+
+Fixes: e5dd729460ca ("ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL address")
+Signed-off-by: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index eaecaf2ffe00..e6c7edcf6834 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -3127,17 +3127,17 @@ static void add_v4_addrs(struct inet6_dev *idev)
+ offset = sizeof(struct in6_addr) - 4;
+ memcpy(&addr.s6_addr32[3], idev->dev->dev_addr + offset, 4);
+
+- if (idev->dev->flags&IFF_POINTOPOINT) {
++ if (!(idev->dev->flags & IFF_POINTOPOINT) && idev->dev->type == ARPHRD_SIT) {
++ scope = IPV6_ADDR_COMPATv4;
++ plen = 96;
++ pflags |= RTF_NONEXTHOP;
++ } else {
+ if (idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_NONE)
+ return;
+
+ addr.s6_addr32[0] = htonl(0xfe800000);
+ scope = IFA_LINK;
+ plen = 64;
+- } else {
+- scope = IPV6_ADDR_COMPATv4;
+- plen = 96;
+- pflags |= RTF_NONEXTHOP;
+ }
+
+ if (addr.s6_addr32[3]) {
+--
+2.39.0
+
--- /dev/null
+From 41e6cb052ec3b74ae9f73830d304123305f827bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 09:43:23 +0100
+Subject: kbuild: modinst: Fix build error when CONFIG_MODULE_SIG_KEY is a
+ PKCS#11 URI
+
+From: Jan Luebbe <jlu@pengutronix.de>
+
+[ Upstream commit 22e46f6480e83bcf49b6d5e6b66c81872c97a902 ]
+
+When CONFIG_MODULE_SIG_KEY is PKCS#11 URI (pkcs11:*), signing of modules
+fails:
+
+ scripts/sign-file sha256 /.../linux/pkcs11:token=foo;object=bar;pin-value=1111 certs/signing_key.x509 /.../kernel/crypto/tcrypt.ko
+ Usage: scripts/sign-file [-dp] <hash algo> <key> <x509> <module> [<dest>]
+ scripts/sign-file -s <raw sig> <hash algo> <x509> <module> [<dest>]
+
+First, we need to avoid adding the $(srctree)/ prefix to the URL.
+
+Second, since the kconfig string values no longer include quotes, we need to add
+them again when passing a PKCS#11 URI to sign-file. This avoids
+splitting by the shell if the URI contains semicolons.
+
+Fixes: 4db9c2e3d055 ("kbuild: stop using config_filename in scripts/Makefile.modsign")
+Fixes: 129ab0d2d9f3 ("kbuild: do not quote string values in include/config/auto.conf")
+Signed-off-by: Jan Luebbe <jlu@pengutronix.de>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Makefile.modinst | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst
+index a4c987c23750..10df89b9ef67 100644
+--- a/scripts/Makefile.modinst
++++ b/scripts/Makefile.modinst
+@@ -66,9 +66,13 @@ endif
+ # Don't stop modules_install even if we can't sign external modules.
+ #
+ ifeq ($(CONFIG_MODULE_SIG_ALL),y)
++ifeq ($(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)),)
+ sig-key := $(if $(wildcard $(CONFIG_MODULE_SIG_KEY)),,$(srctree)/)$(CONFIG_MODULE_SIG_KEY)
++else
++sig-key := $(CONFIG_MODULE_SIG_KEY)
++endif
+ quiet_cmd_sign = SIGN $@
+- cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(sig-key) certs/signing_key.x509 $@ \
++ cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) "$(sig-key)" certs/signing_key.x509 $@ \
+ $(if $(KBUILD_EXTMOD),|| true)
+ else
+ quiet_cmd_sign :=
+--
+2.39.0
+
--- /dev/null
+From 630cbbd98b333d40992cc21a1916e9437fd8a296 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 10:35:03 +0800
+Subject: kunit: fix kunit_test_init_section_suites(...)
+
+From: Brendan Higgins <brendan.higgins@linux.dev>
+
+[ Upstream commit 254c71374a70051a043676b67ba4f7ad392b5fe6 ]
+
+Looks like kunit_test_init_section_suites(...) was messed up in a merge
+conflict. This fixes it.
+
+kunit_test_init_section_suites(...) was not updated to avoid the extra
+level of indirection when .kunit_test_suites was flattened. Given no-one
+was actively using it, this went unnoticed for a long period of time.
+
+Fixes: e5857d396f35 ("kunit: flatten kunit_suite*** to kunit_suite** in .kunit_test_suites")
+Signed-off-by: Brendan Higgins <brendan.higgins@linux.dev>
+Signed-off-by: David Gow <davidgow@google.com>
+Tested-by: Martin Fernandez <martin.fernandez@eclypsium.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/kunit/test.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/include/kunit/test.h b/include/kunit/test.h
+index b1ab6b32216d..ebcdbddf8344 100644
+--- a/include/kunit/test.h
++++ b/include/kunit/test.h
+@@ -299,7 +299,6 @@ static inline int kunit_run_all_tests(void)
+ */
+ #define kunit_test_init_section_suites(__suites...) \
+ __kunit_test_suites(CONCATENATE(__UNIQUE_ID(array), _probe), \
+- CONCATENATE(__UNIQUE_ID(suites), _probe), \
+ ##__suites)
+
+ #define kunit_test_init_section_suite(suite) \
+--
+2.39.0
+
--- /dev/null
+From b83f75545c813dbc8eb591825a4536d24790408d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Nov 2022 23:43:08 +0000
+Subject: maple_tree: should get pivots boundary by type
+
+From: Wei Yang <richard.weiyang@gmail.com>
+
+[ Upstream commit ab6ef70a8b0d314c2160af70b0de984664d675e0 ]
+
+We should get pivots boundary by type. Fixes a potential overindexing of
+mt_pivots[].
+
+Link: https://lkml.kernel.org/r/20221112234308.23823-1-richard.weiyang@gmail.com
+Fixes: 54a611b60590 ("Maple Tree: add new data structure")
+Signed-off-by: Wei Yang <richard.weiyang@gmail.com>
+Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/maple_tree.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/lib/maple_tree.c b/lib/maple_tree.c
+index fe21bf276d91..5bfaae60ed8b 100644
+--- a/lib/maple_tree.c
++++ b/lib/maple_tree.c
+@@ -665,12 +665,13 @@ static inline unsigned long mte_pivot(const struct maple_enode *mn,
+ unsigned char piv)
+ {
+ struct maple_node *node = mte_to_node(mn);
++ enum maple_type type = mte_node_type(mn);
+
+- if (piv >= mt_pivots[piv]) {
++ if (piv >= mt_pivots[type]) {
+ WARN_ON(1);
+ return 0;
+ }
+- switch (mte_node_type(mn)) {
++ switch (type) {
+ case maple_arange_64:
+ return node->ma64.pivot[piv];
+ case maple_range_64:
+--
+2.39.0
+
--- /dev/null
+From 76aa7f1c321c8fb34caf270e6ce7e339b68c851a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Dec 2022 18:02:27 +0100
+Subject: media: v4l2-ctrls-api.c: move ctrl->is_new = 1 to the correct line
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit a1550700629f30c5bd554161524f14f14600d554 ]
+
+The patch that fixed string control support somehow got mangled when it was
+merged in mainline: the added line ended up in the wrong place.
+
+Fix this.
+
+Fixes: 73278d483378 ("media: v4l2-ctrls-api.c: add back dropped ctrl->is_new = 1")
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-ctrls-api.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls-api.c b/drivers/media/v4l2-core/v4l2-ctrls-api.c
+index 3d3b6dc24ca6..002ea6588edf 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls-api.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls-api.c
+@@ -150,8 +150,8 @@ static int user_to_new(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl)
+ * then return an error.
+ */
+ if (strlen(ctrl->p_new.p_char) == ctrl->maximum && last)
+- ctrl->is_new = 1;
+ return -ERANGE;
++ ctrl->is_new = 1;
+ }
+ return ret;
+ default:
+--
+2.39.0
+
--- /dev/null
+From da917408f0816a4e3720dfdfd3f18e0cc859e20d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Oct 2022 13:29:08 -0400
+Subject: memcpy_real(): WRITE is "data source", not destination...
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 77729412acde120712f5793e9134c2b1cbd1ee02 ]
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/mm/maccess.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c
+index 1571cdcb0c50..753b006c8ea5 100644
+--- a/arch/s390/mm/maccess.c
++++ b/arch/s390/mm/maccess.c
+@@ -128,7 +128,7 @@ int memcpy_real(void *dest, unsigned long src, size_t count)
+
+ kvec.iov_base = dest;
+ kvec.iov_len = count;
+- iov_iter_kvec(&iter, WRITE, &kvec, 1, count);
++ iov_iter_kvec(&iter, READ, &kvec, 1, count);
+ if (memcpy_real_iter(&iter, src, count) < count)
+ return -EFAULT;
+ return 0;
+--
+2.39.0
+
--- /dev/null
+From afcb5a4cc0ea868edfcf9fc86617d04b14b57556 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 00:02:18 +0300
+Subject: net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 0c598aed445eb45b0ee7ba405f7ece99ee349c30 ]
+
+Syzkaller reports a memory leak of new_flow in ovs_flow_cmd_new() as it is
+not freed when an allocation of a key fails.
+
+BUG: memory leak
+unreferenced object 0xffff888116668000 (size 632):
+ comm "syz-executor231", pid 1090, jiffies 4294844701 (age 18.871s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<00000000defa3494>] kmem_cache_zalloc include/linux/slab.h:654 [inline]
+ [<00000000defa3494>] ovs_flow_alloc+0x19/0x180 net/openvswitch/flow_table.c:77
+ [<00000000c67d8873>] ovs_flow_cmd_new+0x1de/0xd40 net/openvswitch/datapath.c:957
+ [<0000000010a539a8>] genl_family_rcv_msg_doit+0x22d/0x330 net/netlink/genetlink.c:739
+ [<00000000dff3302d>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
+ [<00000000dff3302d>] genl_rcv_msg+0x328/0x590 net/netlink/genetlink.c:800
+ [<000000000286dd87>] netlink_rcv_skb+0x153/0x430 net/netlink/af_netlink.c:2515
+ [<0000000061fed410>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
+ [<000000009dc0f111>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
+ [<000000009dc0f111>] netlink_unicast+0x545/0x7f0 net/netlink/af_netlink.c:1339
+ [<000000004a5ee816>] netlink_sendmsg+0x8e7/0xde0 net/netlink/af_netlink.c:1934
+ [<00000000482b476f>] sock_sendmsg_nosec net/socket.c:651 [inline]
+ [<00000000482b476f>] sock_sendmsg+0x152/0x190 net/socket.c:671
+ [<00000000698574ba>] ____sys_sendmsg+0x70a/0x870 net/socket.c:2356
+ [<00000000d28d9e11>] ___sys_sendmsg+0xf3/0x170 net/socket.c:2410
+ [<0000000083ba9120>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439
+ [<00000000c00628f8>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
+ [<000000004abfdcf4>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
+
+To fix this the patch rearranges the goto labels to reflect the order of
+object allocations and adds appropriate goto statements on the error
+paths.
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Fixes: 68bb10101e6b ("openvswitch: Fix flow lookup to use unmasked key")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Acked-by: Eelco Chaudron <echaudro@redhat.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230201210218.361970-1-pchelkin@ispras.ru
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/datapath.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index fa0f1952d763..5920fdca1287 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -979,14 +979,14 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ key = kzalloc(sizeof(*key), GFP_KERNEL);
+ if (!key) {
+ error = -ENOMEM;
+- goto err_kfree_key;
++ goto err_kfree_flow;
+ }
+
+ ovs_match_init(&match, key, false, &mask);
+ error = ovs_nla_get_match(net, &match, a[OVS_FLOW_ATTR_KEY],
+ a[OVS_FLOW_ATTR_MASK], log);
+ if (error)
+- goto err_kfree_flow;
++ goto err_kfree_key;
+
+ ovs_flow_mask_key(&new_flow->key, key, true, &mask);
+
+@@ -994,14 +994,14 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ error = ovs_nla_get_identifier(&new_flow->id, a[OVS_FLOW_ATTR_UFID],
+ key, log);
+ if (error)
+- goto err_kfree_flow;
++ goto err_kfree_key;
+
+ /* Validate actions. */
+ error = ovs_nla_copy_actions(net, a[OVS_FLOW_ATTR_ACTIONS],
+ &new_flow->key, &acts, log);
+ if (error) {
+ OVS_NLERR(log, "Flow actions may not be safe on all matching packets.");
+- goto err_kfree_flow;
++ goto err_kfree_key;
+ }
+
+ reply = ovs_flow_cmd_alloc_info(acts, &new_flow->id, info, false,
+@@ -1101,10 +1101,10 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ kfree_skb(reply);
+ err_kfree_acts:
+ ovs_nla_free_flow_actions(acts);
+-err_kfree_flow:
+- ovs_flow_free(new_flow, false);
+ err_kfree_key:
+ kfree(key);
++err_kfree_flow:
++ ovs_flow_free(new_flow, false);
+ error:
+ return error;
+ }
+--
+2.39.0
+
--- /dev/null
+From 8798d6fbdab6e4cd78a58bb002e0b1ed6b0138ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 19:23:26 +0100
+Subject: net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices
+
+From: Andre Kalb <andre.kalb@sma.de>
+
+[ Upstream commit 422ae7d9c7221e8d4c8526d0f54106307d69d2dc ]
+
+The probe() function is only used for the DP83822 PHY, leaving the
+private data pointer uninitialized for the smaller DP83825/26 models.
+While all uses of the private data structure are hidden in 82822 specific
+callbacks, configuring the interrupt is shared across all models.
+This causes a NULL pointer dereference on the smaller PHYs as it accesses
+the private data unchecked. Verifying the pointer avoids that.
+
+Fixes: 5dc39fd5ef35 ("net: phy: DP83822: Add ability to advertise Fiber connection")
+Signed-off-by: Andre Kalb <andre.kalb@sma.de>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/Y9FzniUhUtbaGKU7@pc6682
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/dp83822.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c
+index b60db8b6f477..267e6fd3d444 100644
+--- a/drivers/net/phy/dp83822.c
++++ b/drivers/net/phy/dp83822.c
+@@ -233,7 +233,8 @@ static int dp83822_config_intr(struct phy_device *phydev)
+ DP83822_ENERGY_DET_INT_EN |
+ DP83822_LINK_QUAL_INT_EN);
+
+- if (!dp83822->fx_enabled)
++ /* Private data pointer is NULL on DP83825/26 */
++ if (!dp83822 || !dp83822->fx_enabled)
+ misr_status |= DP83822_ANEG_COMPLETE_INT_EN |
+ DP83822_DUP_MODE_CHANGE_INT_EN |
+ DP83822_SPEED_CHANGED_INT_EN;
+@@ -253,7 +254,8 @@ static int dp83822_config_intr(struct phy_device *phydev)
+ DP83822_PAGE_RX_INT_EN |
+ DP83822_EEE_ERROR_CHANGE_INT_EN);
+
+- if (!dp83822->fx_enabled)
++ /* Private data pointer is NULL on DP83825/26 */
++ if (!dp83822 || !dp83822->fx_enabled)
+ misr_status |= DP83822_ANEG_ERR_INT_EN |
+ DP83822_WOL_PKT_INT_EN;
+
+--
+2.39.0
+
--- /dev/null
+From c9c2011cb3774d0330167191102c6e6b493df216 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 15:14:02 -0800
+Subject: net: phy: meson-gxl: Add generic dummy stubs for MMD register access
+
+From: Chris Healy <healych@amazon.com>
+
+[ Upstream commit afc2336f89dc0fc0ef25b92366814524b0fd90fb ]
+
+The Meson G12A Internal PHY does not support standard IEEE MMD extended
+register access, therefore add generic dummy stubs to fail the read and
+write MMD calls. This is necessary to prevent the core PHY code from
+erroneously believing that EEE is supported by this PHY even though this
+PHY does not support EEE, as MMD register access returns all FFFFs.
+
+Fixes: 5c3407abb338 ("net: phy: meson-gxl: add g12a support")
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Chris Healy <healych@amazon.com>
+Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20230130231402.471493-1-cphealy@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/meson-gxl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c
+index c49062ad72c6..5e41658b1e2f 100644
+--- a/drivers/net/phy/meson-gxl.c
++++ b/drivers/net/phy/meson-gxl.c
+@@ -271,6 +271,8 @@ static struct phy_driver meson_gxl_phy[] = {
+ .handle_interrupt = meson_gxl_handle_interrupt,
+ .suspend = genphy_suspend,
+ .resume = genphy_resume,
++ .read_mmd = genphy_read_mmd_unsupported,
++ .write_mmd = genphy_write_mmd_unsupported,
+ },
+ };
+
+--
+2.39.0
+
--- /dev/null
+From d390cdf61b502621ab5294863f35fbbf91fea46a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Jan 2023 16:29:17 +0000
+Subject: net/tls: tls_is_tx_ready() checked list_entry
+
+From: Pietro Borrello <borrello@diag.uniroma1.it>
+
+[ Upstream commit ffe2a22562444720b05bdfeb999c03e810d84cbb ]
+
+tls_is_tx_ready() checks that list_first_entry() does not return NULL.
+This condition can never happen. For empty lists, list_first_entry()
+returns the list_entry() of the head, which is a type confusion.
+Use list_first_entry_or_null() which returns NULL in case of empty
+lists.
+
+Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
+Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
+Link: https://lore.kernel.org/r/20230128-list-entry-null-check-tls-v1-1-525bbfe6f0d0@diag.uniroma1.it
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_sw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 9ed978634125..a83d2b4275fa 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -2427,7 +2427,7 @@ static bool tls_is_tx_ready(struct tls_sw_context_tx *ctx)
+ {
+ struct tls_rec *rec;
+
+- rec = list_first_entry(&ctx->tx_list, struct tls_rec, list);
++ rec = list_first_entry_or_null(&ctx->tx_list, struct tls_rec, list);
+ if (!rec)
+ return false;
+
+--
+2.39.0
+
--- /dev/null
+From 7b5c69ae142be3ea0a20c8a5dbe3c6f7c93469ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 13:25:35 +0000
+Subject: net: wwan: t7xx: Fix Runtime PM initialization
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kornel Dulęba <mindal@semihalf.com>
+
+[ Upstream commit e3d6d152a1cbdee25f2e3962009a2751b54e2297 ]
+
+For PCI devices the Runtime PM refcount is incremented twice:
+1. During device enumeration with a call to pm_runtime_forbid.
+2. Just before a driver probe logic is called.
+Because of that in order to enable Runtime PM on a given device
+we have to call both pm_runtime_allow and pm_runtime_put_noidle,
+once it's ready to be runtime suspended.
+The former was missing causing the pm refcount to never reach 0.
+
+Fixes: d10b3a695ba0 ("net: wwan: t7xx: Runtime PM")
+Signed-off-by: Kornel Dulęba <mindal@semihalf.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wwan/t7xx/t7xx_pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wwan/t7xx/t7xx_pci.c b/drivers/net/wwan/t7xx/t7xx_pci.c
+index 871f2a27a398..226fc1703e90 100644
+--- a/drivers/net/wwan/t7xx/t7xx_pci.c
++++ b/drivers/net/wwan/t7xx/t7xx_pci.c
+@@ -121,6 +121,8 @@ void t7xx_pci_pm_init_late(struct t7xx_pci_dev *t7xx_dev)
+ iowrite32(T7XX_L1_BIT(0), IREG_BASE(t7xx_dev) + ENABLE_ASPM_LOWPWR);
+ atomic_set(&t7xx_dev->md_pm_state, MTK_PM_RESUMED);
+
++ pm_runtime_mark_last_busy(&t7xx_dev->pdev->dev);
++ pm_runtime_allow(&t7xx_dev->pdev->dev);
+ pm_runtime_put_noidle(&t7xx_dev->pdev->dev);
+ }
+
+--
+2.39.0
+
--- /dev/null
+From c6213128a4c27d43d5201b77f7381a89dfb651e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 11:43:23 -0800
+Subject: net/x25: Fix to not accept on connected socket
+
+From: Hyunwoo Kim <v4bel@theori.io>
+
+[ Upstream commit f2b0b5210f67c56a3bcdf92ff665fb285d6e0067 ]
+
+When listen() and accept() are called on an x25 socket
+that connect() succeeds, accept() succeeds immediately.
+This is because x25_connect() queues the skb to
+sk->sk_receive_queue, and x25_accept() dequeues it.
+
+This creates a child socket with the sk of the parent
+x25 socket, which can cause confusion.
+
+Fix x25_listen() to return -EINVAL if the socket has
+already been successfully connect()ed to avoid this issue.
+
+Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/x25/af_x25.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 3b55502b2965..5c7ad301d742 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -482,6 +482,12 @@ static int x25_listen(struct socket *sock, int backlog)
+ int rc = -EOPNOTSUPP;
+
+ lock_sock(sk);
++ if (sock->state != SS_UNCONNECTED) {
++ rc = -EINVAL;
++ release_sock(sk);
++ return rc;
++ }
++
+ if (sk->sk_state != TCP_LISTEN) {
+ memset(&x25_sk(sk)->dest_addr, 0, X25_ADDR_LEN);
+ sk->sk_max_ack_backlog = backlog;
+--
+2.39.0
+
--- /dev/null
+From 4f1a85b827f5976a8cf402ae8e5bf19fded707d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 11:39:29 +0100
+Subject: netfilter: br_netfilter: disable sabotage_in hook after first
+ suppression
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 2b272bb558f1d3a5aa95ed8a82253786fd1a48ba ]
+
+When using a xfrm interface in a bridged setup (the outgoing device is
+bridged), the incoming packets in the xfrm interface are only tracked
+in the outgoing direction.
+
+$ brctl show
+bridge name interfaces
+br_eth1 eth1
+
+$ conntrack -L
+tcp 115 SYN_SENT src=192... dst=192... [UNREPLIED] ...
+
+If br_netfilter is enabled, the first (encrypted) packet is received onR
+eth1, conntrack hooks are called from br_netfilter emulation which
+allocates nf_bridge info for this skb.
+
+If the packet is for local machine, skb gets passed up the ip stack.
+The skb passes through ip prerouting a second time. br_netfilter
+ip_sabotage_in supresses the re-invocation of the hooks.
+
+After this, skb gets decrypted in xfrm layer and appears in
+network stack a second time (after decryption).
+
+Then, ip_sabotage_in is called again and suppresses netfilter
+hook invocation, even though the bridge layer never called them
+for the plaintext incarnation of the packet.
+
+Free the bridge info after the first suppression to avoid this.
+
+I was unable to figure out where the regression comes from, as far as i
+can see br_netfilter always had this problem; i did not expect that skb
+is looped again with different headers.
+
+Fixes: c4b0e771f906 ("netfilter: avoid using skb->nf_bridge directly")
+Reported-and-tested-by: Wolfgang Nothdurft <wolfgang@linogate.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_netfilter_hooks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
+index f20f4373ff40..9554abcfd5b4 100644
+--- a/net/bridge/br_netfilter_hooks.c
++++ b/net/bridge/br_netfilter_hooks.c
+@@ -871,6 +871,7 @@ static unsigned int ip_sabotage_in(void *priv,
+ if (nf_bridge && !nf_bridge->in_prerouting &&
+ !netif_is_l3_master(skb->dev) &&
+ !netif_is_l3_slave(skb->dev)) {
++ nf_bridge_info_free(skb);
+ state->okfn(state->net, state->sk, skb);
+ return NF_STOLEN;
+ }
+--
+2.39.0
+
--- /dev/null
+From 7539e8f773b4f43599dff15ddf63874a5a641348 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 18:32:50 -0800
+Subject: netrom: Fix use-after-free caused by accept on already connected
+ socket
+
+From: Hyunwoo Kim <v4bel@theori.io>
+
+[ Upstream commit 611792920925fb088ddccbe2783c7f92fdfb6b64 ]
+
+If you call listen() and accept() on an already connect()ed
+AF_NETROM socket, accept() can successfully connect.
+This is because when the peer socket sends data to sendmsg,
+the skb with its own sk stored in the connected socket's
+sk->sk_receive_queue is connected, and nr_accept() dequeues
+the skb waiting in the sk->sk_receive_queue.
+
+As a result, nr_accept() allocates and returns a sock with
+the sk of the parent AF_NETROM socket.
+
+And here use-after-free can happen through complex race conditions:
+```
+ cpu0 cpu1
+ 1. socket_2 = socket(AF_NETROM)
+ .
+ .
+ listen(socket_2)
+ accepted_socket = accept(socket_2)
+ 2. socket_1 = socket(AF_NETROM)
+ nr_create() // sk refcount : 1
+ connect(socket_1)
+ 3. write(accepted_socket)
+ nr_sendmsg()
+ nr_output()
+ nr_kick()
+ nr_send_iframe()
+ nr_transmit_buffer()
+ nr_route_frame()
+ nr_loopback_queue()
+ nr_loopback_timer()
+ nr_rx_frame()
+ nr_process_rx_frame(sk, skb); // sk : socket_1's sk
+ nr_state3_machine()
+ nr_queue_rx_frame()
+ sock_queue_rcv_skb()
+ sock_queue_rcv_skb_reason()
+ __sock_queue_rcv_skb()
+ __skb_queue_tail(list, skb); // list : socket_1's sk->sk_receive_queue
+ 4. listen(socket_1)
+ nr_listen()
+ uaf_socket = accept(socket_1)
+ nr_accept()
+ skb_dequeue(&sk->sk_receive_queue);
+ 5. close(accepted_socket)
+ nr_release()
+ nr_write_internal(sk, NR_DISCREQ)
+ nr_transmit_buffer() // NR_DISCREQ
+ nr_route_frame()
+ nr_loopback_queue()
+ nr_loopback_timer()
+ nr_rx_frame() // sk : socket_1's sk
+ nr_process_rx_frame() // NR_STATE_3
+ nr_state3_machine() // NR_DISCREQ
+ nr_disconnect()
+ nr_sk(sk)->state = NR_STATE_0;
+ 6. close(socket_1) // sk refcount : 3
+ nr_release() // NR_STATE_0
+ sock_put(sk); // sk refcount : 0
+ sk_free(sk);
+ close(uaf_socket)
+ nr_release()
+ sock_hold(sk); // UAF
+```
+
+KASAN report by syzbot:
+```
+BUG: KASAN: use-after-free in nr_release+0x66/0x460 net/netrom/af_netrom.c:520
+Write of size 4 at addr ffff8880235d8080 by task syz-executor564/5128
+
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
+ print_address_description mm/kasan/report.c:306 [inline]
+ print_report+0x15e/0x461 mm/kasan/report.c:417
+ kasan_report+0xbf/0x1f0 mm/kasan/report.c:517
+ check_region_inline mm/kasan/generic.c:183 [inline]
+ kasan_check_range+0x141/0x190 mm/kasan/generic.c:189
+ instrument_atomic_read_write include/linux/instrumented.h:102 [inline]
+ atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:116 [inline]
+ __refcount_add include/linux/refcount.h:193 [inline]
+ __refcount_inc include/linux/refcount.h:250 [inline]
+ refcount_inc include/linux/refcount.h:267 [inline]
+ sock_hold include/net/sock.h:775 [inline]
+ nr_release+0x66/0x460 net/netrom/af_netrom.c:520
+ __sock_release+0xcd/0x280 net/socket.c:650
+ sock_close+0x1c/0x20 net/socket.c:1365
+ __fput+0x27c/0xa90 fs/file_table.c:320
+ task_work_run+0x16f/0x270 kernel/task_work.c:179
+ exit_task_work include/linux/task_work.h:38 [inline]
+ do_exit+0xaa8/0x2950 kernel/exit.c:867
+ do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
+ get_signal+0x21c3/0x2450 kernel/signal.c:2859
+ arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
+ exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
+ exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203
+ __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
+ syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296
+ do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+RIP: 0033:0x7f6c19e3c9b9
+Code: Unable to access opcode bytes at 0x7f6c19e3c98f.
+RSP: 002b:00007fffd4ba2ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
+RAX: 0000000000000116 RBX: 0000000000000003 RCX: 00007f6c19e3c9b9
+RDX: 0000000000000318 RSI: 00000000200bd000 RDI: 0000000000000006
+RBP: 0000000000000003 R08: 000000000000000d R09: 000000000000000d
+R10: 0000000000000000 R11: 0000000000000246 R12: 000055555566a2c0
+R13: 0000000000000011 R14: 0000000000000000 R15: 0000000000000000
+ </TASK>
+
+Allocated by task 5128:
+ kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
+ kasan_set_track+0x25/0x30 mm/kasan/common.c:52
+ ____kasan_kmalloc mm/kasan/common.c:371 [inline]
+ ____kasan_kmalloc mm/kasan/common.c:330 [inline]
+ __kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:380
+ kasan_kmalloc include/linux/kasan.h:211 [inline]
+ __do_kmalloc_node mm/slab_common.c:968 [inline]
+ __kmalloc+0x5a/0xd0 mm/slab_common.c:981
+ kmalloc include/linux/slab.h:584 [inline]
+ sk_prot_alloc+0x140/0x290 net/core/sock.c:2038
+ sk_alloc+0x3a/0x7a0 net/core/sock.c:2091
+ nr_create+0xb6/0x5f0 net/netrom/af_netrom.c:433
+ __sock_create+0x359/0x790 net/socket.c:1515
+ sock_create net/socket.c:1566 [inline]
+ __sys_socket_create net/socket.c:1603 [inline]
+ __sys_socket_create net/socket.c:1588 [inline]
+ __sys_socket+0x133/0x250 net/socket.c:1636
+ __do_sys_socket net/socket.c:1649 [inline]
+ __se_sys_socket net/socket.c:1647 [inline]
+ __x64_sys_socket+0x73/0xb0 net/socket.c:1647
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Freed by task 5128:
+ kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
+ kasan_set_track+0x25/0x30 mm/kasan/common.c:52
+ kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:518
+ ____kasan_slab_free mm/kasan/common.c:236 [inline]
+ ____kasan_slab_free+0x13b/0x1a0 mm/kasan/common.c:200
+ kasan_slab_free include/linux/kasan.h:177 [inline]
+ __cache_free mm/slab.c:3394 [inline]
+ __do_kmem_cache_free mm/slab.c:3580 [inline]
+ __kmem_cache_free+0xcd/0x3b0 mm/slab.c:3587
+ sk_prot_free net/core/sock.c:2074 [inline]
+ __sk_destruct+0x5df/0x750 net/core/sock.c:2166
+ sk_destruct net/core/sock.c:2181 [inline]
+ __sk_free+0x175/0x460 net/core/sock.c:2192
+ sk_free+0x7c/0xa0 net/core/sock.c:2203
+ sock_put include/net/sock.h:1991 [inline]
+ nr_release+0x39e/0x460 net/netrom/af_netrom.c:554
+ __sock_release+0xcd/0x280 net/socket.c:650
+ sock_close+0x1c/0x20 net/socket.c:1365
+ __fput+0x27c/0xa90 fs/file_table.c:320
+ task_work_run+0x16f/0x270 kernel/task_work.c:179
+ exit_task_work include/linux/task_work.h:38 [inline]
+ do_exit+0xaa8/0x2950 kernel/exit.c:867
+ do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
+ get_signal+0x21c3/0x2450 kernel/signal.c:2859
+ arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
+ exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
+ exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203
+ __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
+ syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296
+ do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+```
+
+To fix this issue, nr_listen() returns -EINVAL for sockets that
+successfully nr_connect().
+
+Reported-by: syzbot+caa188bdfc1eeafeb418@syzkaller.appspotmail.com
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netrom/af_netrom.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
+index 6f7f4392cffb..5a4cb796150f 100644
+--- a/net/netrom/af_netrom.c
++++ b/net/netrom/af_netrom.c
+@@ -400,6 +400,11 @@ static int nr_listen(struct socket *sock, int backlog)
+ struct sock *sk = sock->sk;
+
+ lock_sock(sk);
++ if (sock->state != SS_UNCONNECTED) {
++ release_sock(sk);
++ return -EINVAL;
++ }
++
+ if (sk->sk_state != TCP_LISTEN) {
+ memset(&nr_sk(sk)->user_addr, 0, AX25_ADDR_LEN);
+ sk->sk_max_ack_backlog = backlog;
+--
+2.39.0
+
--- /dev/null
+From 277e68660b5ddbe04f9820bd4ceed22a2a05b083 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 11:46:59 +0530
+Subject: octeontx2-af: Fix devlink unregister
+
+From: Ratheesh Kannoth <rkannoth@marvell.com>
+
+[ Upstream commit 917d5e04d4dd2bbbf36fc6976ba442e284ccc42d ]
+
+Exact match feature is only available in CN10K-B.
+Unregister exact match devlink entry only for
+this silicon variant.
+
+Fixes: 87e4ea29b030 ("octeontx2-af: Debugsfs support for exact match.")
+Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/20230131061659.1025137-1-rkannoth@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../marvell/octeontx2/af/rvu_devlink.c | 35 ++++++++++++++-----
+ 1 file changed, 27 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
+index 88dee589cb21..dc7bd2ce78f7 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
+@@ -1500,6 +1500,9 @@ static const struct devlink_param rvu_af_dl_params[] = {
+ BIT(DEVLINK_PARAM_CMODE_RUNTIME),
+ rvu_af_dl_dwrr_mtu_get, rvu_af_dl_dwrr_mtu_set,
+ rvu_af_dl_dwrr_mtu_validate),
++};
++
++static const struct devlink_param rvu_af_dl_param_exact_match[] = {
+ DEVLINK_PARAM_DRIVER(RVU_AF_DEVLINK_PARAM_ID_NPC_EXACT_FEATURE_DISABLE,
+ "npc_exact_feature_disable", DEVLINK_PARAM_TYPE_STRING,
+ BIT(DEVLINK_PARAM_CMODE_RUNTIME),
+@@ -1563,7 +1566,6 @@ int rvu_register_dl(struct rvu *rvu)
+ {
+ struct rvu_devlink *rvu_dl;
+ struct devlink *dl;
+- size_t size;
+ int err;
+
+ dl = devlink_alloc(&rvu_devlink_ops, sizeof(struct rvu_devlink),
+@@ -1585,21 +1587,32 @@ int rvu_register_dl(struct rvu *rvu)
+ goto err_dl_health;
+ }
+
++ err = devlink_params_register(dl, rvu_af_dl_params, ARRAY_SIZE(rvu_af_dl_params));
++ if (err) {
++ dev_err(rvu->dev,
++ "devlink params register failed with error %d", err);
++ goto err_dl_health;
++ }
++
+ /* Register exact match devlink only for CN10K-B */
+- size = ARRAY_SIZE(rvu_af_dl_params);
+ if (!rvu_npc_exact_has_match_table(rvu))
+- size -= 1;
++ goto done;
+
+- err = devlink_params_register(dl, rvu_af_dl_params, size);
++ err = devlink_params_register(dl, rvu_af_dl_param_exact_match,
++ ARRAY_SIZE(rvu_af_dl_param_exact_match));
+ if (err) {
+ dev_err(rvu->dev,
+- "devlink params register failed with error %d", err);
+- goto err_dl_health;
++ "devlink exact match params register failed with error %d", err);
++ goto err_dl_exact_match;
+ }
+
++done:
+ devlink_register(dl);
+ return 0;
+
++err_dl_exact_match:
++ devlink_params_unregister(dl, rvu_af_dl_params, ARRAY_SIZE(rvu_af_dl_params));
++
+ err_dl_health:
+ rvu_health_reporters_destroy(rvu);
+ devlink_free(dl);
+@@ -1612,8 +1625,14 @@ void rvu_unregister_dl(struct rvu *rvu)
+ struct devlink *dl = rvu_dl->dl;
+
+ devlink_unregister(dl);
+- devlink_params_unregister(dl, rvu_af_dl_params,
+- ARRAY_SIZE(rvu_af_dl_params));
++
++ devlink_params_unregister(dl, rvu_af_dl_params, ARRAY_SIZE(rvu_af_dl_params));
++
++ /* Unregister exact match devlink only for CN10K-B */
++ if (rvu_npc_exact_has_match_table(rvu))
++ devlink_params_unregister(dl, rvu_af_dl_param_exact_match,
++ ARRAY_SIZE(rvu_af_dl_param_exact_match));
++
+ rvu_health_reporters_destroy(rvu);
+ devlink_free(dl);
+ }
+--
+2.39.0
+
--- /dev/null
+From 69205c5c840990d5f414fa0ff917101ca9b56249 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 08:04:46 -0800
+Subject: perf/x86/intel: Add Emerald Rapids
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+[ Upstream commit 6795e558e9cc6123c24e2100a2ebe88e58a792bc ]
+
+From core PMU's perspective, Emerald Rapids is the same as the Sapphire
+Rapids. The only difference is the event list, which will be
+supported in the perf tool later.
+
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20230106160449.3566477-1-kan.liang@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 1b92bf05fd65..5a1d0ea402e4 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -6342,6 +6342,7 @@ __init int intel_pmu_init(void)
+ break;
+
+ case INTEL_FAM6_SAPPHIRERAPIDS_X:
++ case INTEL_FAM6_EMERALDRAPIDS_X:
+ pmem = true;
+ x86_pmu.late_ack = true;
+ memcpy(hw_cache_event_ids, spr_hw_cache_event_ids, sizeof(hw_cache_event_ids));
+--
+2.39.0
+
--- /dev/null
+From b9aace868eebbf1456ce2d4959a9d5034772948e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 08:04:47 -0800
+Subject: perf/x86/intel/cstate: Add Emerald Rapids
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+[ Upstream commit 5a8a05f165fb18d37526062419774d9088c2a9b9 ]
+
+From the perspective of Intel cstate residency counters,
+Emerald Rapids is the same as the Sapphire Rapids and Ice Lake.
+Add Emerald Rapids model.
+
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20230106160449.3566477-2-kan.liang@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/cstate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
+index 3019fb1926e3..551741e79e03 100644
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -677,6 +677,7 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
+ X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_X, &icx_cstates),
+ X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_D, &icx_cstates),
+ X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X, &icx_cstates),
++ X86_MATCH_INTEL_FAM6_MODEL(EMERALDRAPIDS_X, &icx_cstates),
+
+ X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE_L, &icl_cstates),
+ X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE, &icl_cstates),
+--
+2.39.0
+
--- /dev/null
+From 48dd53839297f3997f73aaf9d1a4148405ee5aab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 13:15:18 -0600
+Subject: platform/x86/amd: pmc: Disable IRQ1 wakeup for RN/CZN
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 8e60615e8932167057b363c11a7835da7f007106 ]
+
+By default when the system is configured for low power idle in the FADT
+the keyboard is set up as a wake source. This matches the behavior that
+Windows uses for Modern Standby as well.
+
+It has been reported that a variety of AMD based designs there are
+spurious wakeups are happening where two IRQ sources are active.
+
+For example:
+```
+PM: Triggering wakeup from IRQ 9
+PM: Triggering wakeup from IRQ 1
+```
+
+In these designs IRQ 9 is the ACPI SCI and IRQ 1 is the keyboard.
+One way to trigger this problem is to suspend the laptop and then unplug
+the AC adapter. The SOC will be in a hardware sleep state and plugging
+in the AC adapter returns control to the kernel's s2idle loop.
+
+Normally if just IRQ 9 was active the s2idle loop would advance any EC
+transactions and no other IRQ being active would cause the s2idle loop
+to put the SOC back into hardware sleep state.
+
+When this bug occurred IRQ 1 is also active even if no keyboard activity
+occurred. This causes the s2idle loop to break and the system to wake.
+
+This is a platform firmware bug triggering IRQ1 without keyboard activity.
+This occurs in Windows as well, but Windows will enter "SW DRIPS" and
+then with no activity enters back into "HW DRIPS" (hardware sleep state).
+
+This issue affects Renoir, Lucienne, Cezanne, and Barcelo platforms. It
+does not happen on newer systems such as Mendocino or Rembrandt.
+
+It's been fixed in newer platform firmware. To avoid triggering the bug
+on older systems check the SMU F/W version and adjust the policy at suspend
+time for s2idle wakeup from keyboard on these systems. A lot of thought
+and experimentation has been given around the timing of disabling IRQ1,
+and to make it work the "suspend" PM callback is restored.
+
+Reported-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Reported-by: Xaver Hugl <xaver.hugl@gmail.com>
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2115
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/1951
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20230120191519.15926-1-mario.limonciello@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc.c | 50 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 50 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c
+index 8d924986381b..be1b49824edb 100644
+--- a/drivers/platform/x86/amd/pmc.c
++++ b/drivers/platform/x86/amd/pmc.c
+@@ -22,6 +22,7 @@
+ #include <linux/pci.h>
+ #include <linux/platform_device.h>
+ #include <linux/rtc.h>
++#include <linux/serio.h>
+ #include <linux/suspend.h>
+ #include <linux/seq_file.h>
+ #include <linux/uaccess.h>
+@@ -653,6 +654,33 @@ static int amd_pmc_get_os_hint(struct amd_pmc_dev *dev)
+ return -EINVAL;
+ }
+
++static int amd_pmc_czn_wa_irq1(struct amd_pmc_dev *pdev)
++{
++ struct device *d;
++ int rc;
++
++ if (!pdev->major) {
++ rc = amd_pmc_get_smu_version(pdev);
++ if (rc)
++ return rc;
++ }
++
++ if (pdev->major > 64 || (pdev->major == 64 && pdev->minor > 65))
++ return 0;
++
++ d = bus_find_device_by_name(&serio_bus, NULL, "serio0");
++ if (!d)
++ return 0;
++ if (device_may_wakeup(d)) {
++ dev_info_once(d, "Disabling IRQ1 wakeup source to avoid platform firmware bug\n");
++ disable_irq_wake(1);
++ device_set_wakeup_enable(d, false);
++ }
++ put_device(d);
++
++ return 0;
++}
++
+ static int amd_pmc_verify_czn_rtc(struct amd_pmc_dev *pdev, u32 *arg)
+ {
+ struct rtc_device *rtc_device;
+@@ -782,6 +810,25 @@ static struct acpi_s2idle_dev_ops amd_pmc_s2idle_dev_ops = {
+ .check = amd_pmc_s2idle_check,
+ .restore = amd_pmc_s2idle_restore,
+ };
++
++static int __maybe_unused amd_pmc_suspend_handler(struct device *dev)
++{
++ struct amd_pmc_dev *pdev = dev_get_drvdata(dev);
++
++ if (pdev->cpu_id == AMD_CPU_ID_CZN) {
++ int rc = amd_pmc_czn_wa_irq1(pdev);
++
++ if (rc) {
++ dev_err(pdev->dev, "failed to adjust keyboard wakeup: %d\n", rc);
++ return rc;
++ }
++ }
++
++ return 0;
++}
++
++static SIMPLE_DEV_PM_OPS(amd_pmc_pm, amd_pmc_suspend_handler, NULL);
++
+ #endif
+
+ static const struct pci_device_id pmc_pci_ids[] = {
+@@ -980,6 +1027,9 @@ static struct platform_driver amd_pmc_driver = {
+ .name = "amd_pmc",
+ .acpi_match_table = amd_pmc_acpi_ids,
+ .dev_groups = pmc_groups,
++#ifdef CONFIG_SUSPEND
++ .pm = &amd_pmc_pm,
++#endif
+ },
+ .probe = amd_pmc_probe,
+ .remove = amd_pmc_remove,
+--
+2.39.0
+
--- /dev/null
+From c5da981e17f1db54482f0a081bc2ff1b846eeda3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 15:29:33 +0530
+Subject: platform/x86/amd/pmf: Add helper routine to check pprof is balanced
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 16909aa8c9cc284085f1202c6403ecb9814af812 ]
+
+Add helper routine to check if the current platform profile
+is balanced mode and remove duplicate code occurrences.
+
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20230125095936.3292883-3-Shyam-sundar.S-k@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Stable-dep-of: f21bf62290dd ("platform/x86/amd/pmf: Fix to update SPS thermals when power supply change")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/cnqf.c | 6 +++---
+ drivers/platform/x86/amd/pmf/pmf.h | 1 +
+ drivers/platform/x86/amd/pmf/sps.c | 5 +++++
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/platform/x86/amd/pmf/cnqf.c b/drivers/platform/x86/amd/pmf/cnqf.c
+index ef2ac30ff15e..f39275ec5cc9 100644
+--- a/drivers/platform/x86/amd/pmf/cnqf.c
++++ b/drivers/platform/x86/amd/pmf/cnqf.c
+@@ -103,7 +103,7 @@ int amd_pmf_trans_cnqf(struct amd_pmf_dev *dev, int socket_power, ktime_t time_l
+
+ src = amd_pmf_cnqf_get_power_source(dev);
+
+- if (dev->current_profile == PLATFORM_PROFILE_BALANCED) {
++ if (is_pprof_balanced(dev)) {
+ amd_pmf_set_cnqf(dev, src, config_store.current_mode, NULL);
+ } else {
+ /*
+@@ -317,7 +317,7 @@ static ssize_t cnqf_enable_store(struct device *dev,
+ src = amd_pmf_cnqf_get_power_source(pdev);
+ pdev->cnqf_enabled = input;
+
+- if (pdev->cnqf_enabled && pdev->current_profile == PLATFORM_PROFILE_BALANCED) {
++ if (pdev->cnqf_enabled && is_pprof_balanced(pdev)) {
+ amd_pmf_set_cnqf(pdev, src, config_store.current_mode, NULL);
+ } else {
+ if (is_apmf_func_supported(pdev, APMF_FUNC_STATIC_SLIDER_GRANULAR))
+@@ -382,7 +382,7 @@ int amd_pmf_init_cnqf(struct amd_pmf_dev *dev)
+ dev->cnqf_enabled = amd_pmf_check_flags(dev);
+
+ /* update the thermal for CnQF */
+- if (dev->cnqf_enabled && dev->current_profile == PLATFORM_PROFILE_BALANCED) {
++ if (dev->cnqf_enabled && is_pprof_balanced(dev)) {
+ src = amd_pmf_cnqf_get_power_source(dev);
+ amd_pmf_set_cnqf(dev, src, config_store.current_mode, NULL);
+ }
+diff --git a/drivers/platform/x86/amd/pmf/pmf.h b/drivers/platform/x86/amd/pmf/pmf.h
+index b5b77a353b96..b94e1a9030f8 100644
+--- a/drivers/platform/x86/amd/pmf/pmf.h
++++ b/drivers/platform/x86/amd/pmf/pmf.h
+@@ -391,6 +391,7 @@ int amd_pmf_init_sps(struct amd_pmf_dev *dev);
+ void amd_pmf_deinit_sps(struct amd_pmf_dev *dev);
+ int apmf_get_static_slider_granular(struct amd_pmf_dev *pdev,
+ struct apmf_static_slider_granular_output *output);
++bool is_pprof_balanced(struct amd_pmf_dev *pmf);
+
+
+ int apmf_update_fan_idx(struct amd_pmf_dev *pdev, bool manual, u32 idx);
+diff --git a/drivers/platform/x86/amd/pmf/sps.c b/drivers/platform/x86/amd/pmf/sps.c
+index 5bccea137bda..bed762d47a14 100644
+--- a/drivers/platform/x86/amd/pmf/sps.c
++++ b/drivers/platform/x86/amd/pmf/sps.c
+@@ -83,6 +83,11 @@ int amd_pmf_set_sps_power_limits(struct amd_pmf_dev *pmf)
+ return 0;
+ }
+
++bool is_pprof_balanced(struct amd_pmf_dev *pmf)
++{
++ return (pmf->current_profile == PLATFORM_PROFILE_BALANCED) ? true : false;
++}
++
+ static int amd_pmf_profile_get(struct platform_profile_handler *pprof,
+ enum platform_profile_option *profile)
+ {
+--
+2.39.0
+
--- /dev/null
+From 42372f190ff2d6d7a54efd2c6e7578f42e65719d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 15:29:32 +0530
+Subject: platform/x86/amd/pmf: Add helper routine to update SPS thermals
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit c5258d39fc4cbed37e20945715e7eb102f26d65b ]
+
+Add helper routine to update the static slider information
+and remove the duplicate code occurrences after this change.
+
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20230125095936.3292883-2-Shyam-sundar.S-k@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Stable-dep-of: 635f79bc73cf ("platform/x86/amd/pmf: Fix to update SPS default pprof thermals")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/auto-mode.c | 7 +------
+ drivers/platform/x86/amd/pmf/cnqf.c | 8 ++------
+ drivers/platform/x86/amd/pmf/pmf.h | 1 +
+ drivers/platform/x86/amd/pmf/sps.c | 20 ++++++++++++++------
+ 4 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/platform/x86/amd/pmf/auto-mode.c b/drivers/platform/x86/amd/pmf/auto-mode.c
+index 85ce9ed25b85..96a8e1832c05 100644
+--- a/drivers/platform/x86/amd/pmf/auto-mode.c
++++ b/drivers/platform/x86/amd/pmf/auto-mode.c
+@@ -275,13 +275,8 @@ int amd_pmf_reset_amt(struct amd_pmf_dev *dev)
+ */
+
+ if (is_apmf_func_supported(dev, APMF_FUNC_STATIC_SLIDER_GRANULAR)) {
+- int mode = amd_pmf_get_pprof_modes(dev);
+-
+- if (mode < 0)
+- return mode;
+-
+ dev_dbg(dev->dev, "resetting AMT thermals\n");
+- amd_pmf_update_slider(dev, SLIDER_OP_SET, mode, NULL);
++ amd_pmf_set_sps_power_limits(dev);
+ }
+ return 0;
+ }
+diff --git a/drivers/platform/x86/amd/pmf/cnqf.c b/drivers/platform/x86/amd/pmf/cnqf.c
+index 668c7c0fea83..ef2ac30ff15e 100644
+--- a/drivers/platform/x86/amd/pmf/cnqf.c
++++ b/drivers/platform/x86/amd/pmf/cnqf.c
+@@ -307,13 +307,9 @@ static ssize_t cnqf_enable_store(struct device *dev,
+ const char *buf, size_t count)
+ {
+ struct amd_pmf_dev *pdev = dev_get_drvdata(dev);
+- int mode, result, src;
++ int result, src;
+ bool input;
+
+- mode = amd_pmf_get_pprof_modes(pdev);
+- if (mode < 0)
+- return mode;
+-
+ result = kstrtobool(buf, &input);
+ if (result)
+ return result;
+@@ -325,7 +321,7 @@ static ssize_t cnqf_enable_store(struct device *dev,
+ amd_pmf_set_cnqf(pdev, src, config_store.current_mode, NULL);
+ } else {
+ if (is_apmf_func_supported(pdev, APMF_FUNC_STATIC_SLIDER_GRANULAR))
+- amd_pmf_update_slider(pdev, SLIDER_OP_SET, mode, NULL);
++ amd_pmf_set_sps_power_limits(pdev);
+ }
+
+ dev_dbg(pdev->dev, "Received CnQF %s\n", input ? "on" : "off");
+diff --git a/drivers/platform/x86/amd/pmf/pmf.h b/drivers/platform/x86/amd/pmf/pmf.h
+index 84bbe2c6ea61..b5b77a353b96 100644
+--- a/drivers/platform/x86/amd/pmf/pmf.h
++++ b/drivers/platform/x86/amd/pmf/pmf.h
+@@ -394,6 +394,7 @@ int apmf_get_static_slider_granular(struct amd_pmf_dev *pdev,
+
+
+ int apmf_update_fan_idx(struct amd_pmf_dev *pdev, bool manual, u32 idx);
++int amd_pmf_set_sps_power_limits(struct amd_pmf_dev *pmf);
+
+ /* Auto Mode Layer */
+ int apmf_get_auto_mode_def(struct amd_pmf_dev *pdev, struct apmf_auto_mode *data);
+diff --git a/drivers/platform/x86/amd/pmf/sps.c b/drivers/platform/x86/amd/pmf/sps.c
+index dba7e36962dc..5f842d6e6db2 100644
+--- a/drivers/platform/x86/amd/pmf/sps.c
++++ b/drivers/platform/x86/amd/pmf/sps.c
+@@ -70,6 +70,19 @@ void amd_pmf_update_slider(struct amd_pmf_dev *dev, bool op, int idx,
+ }
+ }
+
++int amd_pmf_set_sps_power_limits(struct amd_pmf_dev *pmf)
++{
++ int mode;
++
++ mode = amd_pmf_get_pprof_modes(pmf);
++ if (mode < 0)
++ return mode;
++
++ amd_pmf_update_slider(pmf, SLIDER_OP_SET, mode, NULL);
++
++ return 0;
++}
++
+ static int amd_pmf_profile_get(struct platform_profile_handler *pprof,
+ enum platform_profile_option *profile)
+ {
+@@ -105,15 +118,10 @@ static int amd_pmf_profile_set(struct platform_profile_handler *pprof,
+ enum platform_profile_option profile)
+ {
+ struct amd_pmf_dev *pmf = container_of(pprof, struct amd_pmf_dev, pprof);
+- int mode;
+
+ pmf->current_profile = profile;
+- mode = amd_pmf_get_pprof_modes(pmf);
+- if (mode < 0)
+- return mode;
+
+- amd_pmf_update_slider(pmf, SLIDER_OP_SET, mode, NULL);
+- return 0;
++ return amd_pmf_set_sps_power_limits(pmf);
+ }
+
+ int amd_pmf_init_sps(struct amd_pmf_dev *dev)
+--
+2.39.0
+
--- /dev/null
+From 5d9dc7b10becfc5a8b50c42fb64c89dc1dc70e5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 14:25:54 +0100
+Subject: platform/x86/amd/pmf: Ensure mutexes are initialized before use
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit e0c40529ff942a985eb0f3dacf18d35ee4dbb03d ]
+
+As soon as the first handler or sysfs file is registered
+the mutex may get used.
+
+Move the initialization to before any handler registration /
+sysfs file creation.
+
+Likewise move the destruction of the mutex to after all
+the de-initialization is done.
+
+Fixes: da5ce22df5fe ("platform/x86/amd/pmf: Add support for PMF core layer")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230130132554.696025-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/core.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c
+index c9f7bcef4ac8..da23639071d7 100644
+--- a/drivers/platform/x86/amd/pmf/core.c
++++ b/drivers/platform/x86/amd/pmf/core.c
+@@ -385,6 +385,9 @@ static int amd_pmf_probe(struct platform_device *pdev)
+ if (!dev->regbase)
+ return -ENOMEM;
+
++ mutex_init(&dev->lock);
++ mutex_init(&dev->update_mutex);
++
+ apmf_acpi_init(dev);
+ platform_set_drvdata(pdev, dev);
+ amd_pmf_init_features(dev);
+@@ -394,8 +397,6 @@ static int amd_pmf_probe(struct platform_device *pdev)
+ dev->pwr_src_notifier.notifier_call = amd_pmf_pwr_src_notify_call;
+ power_supply_reg_notifier(&dev->pwr_src_notifier);
+
+- mutex_init(&dev->lock);
+- mutex_init(&dev->update_mutex);
+ dev_info(dev->dev, "registered PMF device successfully\n");
+
+ return 0;
+@@ -406,11 +407,11 @@ static int amd_pmf_remove(struct platform_device *pdev)
+ struct amd_pmf_dev *dev = platform_get_drvdata(pdev);
+
+ power_supply_unreg_notifier(&dev->pwr_src_notifier);
+- mutex_destroy(&dev->lock);
+- mutex_destroy(&dev->update_mutex);
+ amd_pmf_deinit_features(dev);
+ apmf_acpi_deinit(dev);
+ amd_pmf_dbgfs_unregister(dev);
++ mutex_destroy(&dev->lock);
++ mutex_destroy(&dev->update_mutex);
+ kfree(dev->buf);
+ return 0;
+ }
+--
+2.39.0
+
--- /dev/null
+From 5e527315ab65e25853433b84be40a4822bf9f3ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 15:29:35 +0530
+Subject: platform/x86/amd/pmf: Fix to update SPS default pprof thermals
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 635f79bc73cf3d40c4198a20b3a0e7016dd6f0d3 ]
+
+By design PMF static slider will be set to BALANCED during
+init, but updating to corresponding thermal values from
+the PMF config store was missed, leading to improper settings
+getting propagated to PMFW.
+
+Fixes: 4c71ae414474 ("platform/x86/amd/pmf: Add support SPS PMF feature")
+Suggested-by: Patil Rajesh Reddy <Patil.Reddy@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20230125095936.3292883-5-Shyam-sundar.S-k@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/sps.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmf/sps.c b/drivers/platform/x86/amd/pmf/sps.c
+index 5f842d6e6db2..5bccea137bda 100644
+--- a/drivers/platform/x86/amd/pmf/sps.c
++++ b/drivers/platform/x86/amd/pmf/sps.c
+@@ -131,6 +131,9 @@ int amd_pmf_init_sps(struct amd_pmf_dev *dev)
+ dev->current_profile = PLATFORM_PROFILE_BALANCED;
+ amd_pmf_load_defaults_sps(dev);
+
++ /* update SPS balanced power mode thermals */
++ amd_pmf_set_sps_power_limits(dev);
++
+ dev->pprof.profile_get = amd_pmf_profile_get;
+ dev->pprof.profile_set = amd_pmf_profile_set;
+
+--
+2.39.0
+
--- /dev/null
+From ad0756aa22b26c742d083eea17f6a0f6a1134024 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 15:29:36 +0530
+Subject: platform/x86/amd/pmf: Fix to update SPS thermals when power supply
+ change
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit f21bf62290dd4d769594dcf0e6a688783d74f6a0 ]
+
+Every power mode of static power slider has its own AC and DC power
+settings.
+
+When the power source changes from AC to DC, corresponding DC thermals
+were not updated from PMF config store and this leads the system to always
+run on AC power settings.
+
+Fix it by registering with power_supply notifier and apply DC settings
+upon getting notified by the power_supply handler.
+
+Fixes: da5ce22df5fe ("platform/x86/amd/pmf: Add support for PMF core layer")
+Suggested-by: Patil Rajesh Reddy <Patil.Reddy@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20230125095936.3292883-6-Shyam-sundar.S-k@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/core.c | 23 +++++++++++++++++++++++
+ drivers/platform/x86/amd/pmf/pmf.h | 1 +
+ 2 files changed, 24 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c
+index a5f5a4bcff6d..c9f7bcef4ac8 100644
+--- a/drivers/platform/x86/amd/pmf/core.c
++++ b/drivers/platform/x86/amd/pmf/core.c
+@@ -58,6 +58,25 @@ static bool force_load;
+ module_param(force_load, bool, 0444);
+ MODULE_PARM_DESC(force_load, "Force load this driver on supported older platforms (experimental)");
+
++static int amd_pmf_pwr_src_notify_call(struct notifier_block *nb, unsigned long event, void *data)
++{
++ struct amd_pmf_dev *pmf = container_of(nb, struct amd_pmf_dev, pwr_src_notifier);
++
++ if (event != PSY_EVENT_PROP_CHANGED)
++ return NOTIFY_OK;
++
++ if (is_apmf_func_supported(pmf, APMF_FUNC_AUTO_MODE) ||
++ is_apmf_func_supported(pmf, APMF_FUNC_DYN_SLIDER_DC) ||
++ is_apmf_func_supported(pmf, APMF_FUNC_DYN_SLIDER_AC)) {
++ if ((pmf->amt_enabled || pmf->cnqf_enabled) && is_pprof_balanced(pmf))
++ return NOTIFY_DONE;
++ }
++
++ amd_pmf_set_sps_power_limits(pmf);
++
++ return NOTIFY_OK;
++}
++
+ static int current_power_limits_show(struct seq_file *seq, void *unused)
+ {
+ struct amd_pmf_dev *dev = seq->private;
+@@ -372,6 +391,9 @@ static int amd_pmf_probe(struct platform_device *pdev)
+ apmf_install_handler(dev);
+ amd_pmf_dbgfs_register(dev);
+
++ dev->pwr_src_notifier.notifier_call = amd_pmf_pwr_src_notify_call;
++ power_supply_reg_notifier(&dev->pwr_src_notifier);
++
+ mutex_init(&dev->lock);
+ mutex_init(&dev->update_mutex);
+ dev_info(dev->dev, "registered PMF device successfully\n");
+@@ -383,6 +405,7 @@ static int amd_pmf_remove(struct platform_device *pdev)
+ {
+ struct amd_pmf_dev *dev = platform_get_drvdata(pdev);
+
++ power_supply_unreg_notifier(&dev->pwr_src_notifier);
+ mutex_destroy(&dev->lock);
+ mutex_destroy(&dev->update_mutex);
+ amd_pmf_deinit_features(dev);
+diff --git a/drivers/platform/x86/amd/pmf/pmf.h b/drivers/platform/x86/amd/pmf/pmf.h
+index b94e1a9030f8..06c30cdc0573 100644
+--- a/drivers/platform/x86/amd/pmf/pmf.h
++++ b/drivers/platform/x86/amd/pmf/pmf.h
+@@ -169,6 +169,7 @@ struct amd_pmf_dev {
+ struct mutex update_mutex; /* protects race between ACPI handler and metrics thread */
+ bool cnqf_enabled;
+ bool cnqf_supported;
++ struct notifier_block pwr_src_notifier;
+ };
+
+ struct apmf_sps_prop_granular {
+--
+2.39.0
+
--- /dev/null
+From 4983ffb1bebabe6343344fb4eb7ac38961e1fe2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 15:29:34 +0530
+Subject: platform/x86/amd/pmf: update to auto-mode limits only after AMT event
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 3dfe28c936f87373a2b6ada750be4c52c0f249f3 ]
+
+Auto-mode thermal limits should be updated only after receiving the AMT
+event. But due to a bug in the older commit, these settings were getting
+applied during the auto-mode init.
+
+Fix this by removing amd_pmf_set_automode() during auto-mode
+initialization.
+
+Fixes: 3f5571d99524 ("platform/x86/amd/pmf: Add support for Auto mode feature")
+Suggested-by: Patil Rajesh Reddy <Patil.Reddy@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20230125095936.3292883-4-Shyam-sundar.S-k@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/auto-mode.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/platform/x86/amd/pmf/auto-mode.c b/drivers/platform/x86/amd/pmf/auto-mode.c
+index 644af42e07cf..85ce9ed25b85 100644
+--- a/drivers/platform/x86/amd/pmf/auto-mode.c
++++ b/drivers/platform/x86/amd/pmf/auto-mode.c
+@@ -299,7 +299,5 @@ void amd_pmf_deinit_auto_mode(struct amd_pmf_dev *dev)
+ void amd_pmf_init_auto_mode(struct amd_pmf_dev *dev)
+ {
+ amd_pmf_load_defaults_auto_mode(dev);
+- /* update the thermal limits for Automode */
+- amd_pmf_set_automode(dev, config_store.current_mode, NULL);
+ amd_pmf_init_metrics_table(dev);
+ }
+--
+2.39.0
+
--- /dev/null
+From c08d5dadbc75cd68a171cb3853cf418a45e79a3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 20:34:36 +0800
+Subject: platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010
+ table
+
+From: Koba Ko <koba.ko@canonical.com>
+
+[ Upstream commit 83bcf3e52e9cfc727df33f1055ef0618c91719d0 ]
+
+Some platforms send the speaker-mute key from EC. dell-wmi can't
+recognize it.
+
+Add a new keymap for KEY_MUTE in type 0x0010 table.
+
+Signed-off-by: Koba Ko <koba.ko@canonical.com>
+Link: https://lore.kernel.org/r/20230117123436.200440-1-koba.ko@canonical.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/dell/dell-wmi-base.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/platform/x86/dell/dell-wmi-base.c b/drivers/platform/x86/dell/dell-wmi-base.c
+index 0a259a27459f..502783a7adb1 100644
+--- a/drivers/platform/x86/dell/dell-wmi-base.c
++++ b/drivers/platform/x86/dell/dell-wmi-base.c
+@@ -261,6 +261,9 @@ static const struct key_entry dell_wmi_keymap_type_0010[] = {
+ { KE_KEY, 0x57, { KEY_BRIGHTNESSDOWN } },
+ { KE_KEY, 0x58, { KEY_BRIGHTNESSUP } },
+
++ /*Speaker Mute*/
++ { KE_KEY, 0x109, { KEY_MUTE} },
++
+ /* Mic mute */
+ { KE_KEY, 0x150, { KEY_MICMUTE } },
+
+--
+2.39.0
+
--- /dev/null
+From e4e5816cb07208d5773420993fead2e676a16f21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 20:39:25 +0530
+Subject: platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kevin Kuriakose <kevinmkuriakose@gmail.com>
+
+[ Upstream commit a410429a3b7e748a9db9f357e71e2e085a21c902 ]
+
+To the best of my knowledge this is the same board as the B450M DS3H-CF,
+but with an added WiFi card. Name obtained using dmidecode, tested
+with force_load on v6.1.6
+
+Signed-off-by: Kevin Kuriakose <kevinmkuriakose@gmail.com>
+Acked-by: Thomas Weißschuh <linux@weissschuh.net>
+Link: https://lore.kernel.org/r/20230119150925.31962-1-kevinmkuriakose@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/gigabyte-wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/gigabyte-wmi.c b/drivers/platform/x86/gigabyte-wmi.c
+index 5e7e6659a849..322cfaeda17b 100644
+--- a/drivers/platform/x86/gigabyte-wmi.c
++++ b/drivers/platform/x86/gigabyte-wmi.c
+@@ -141,6 +141,7 @@ static u8 gigabyte_wmi_detect_sensor_usability(struct wmi_device *wdev)
+
+ static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = {
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M DS3H-CF"),
++ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M DS3H WIFI-CF"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M S2H V2"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE AX V2"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE"),
+--
+2.39.0
+
--- /dev/null
+From cecd9bfb2610a027a7e9644d318ebb717f70c363 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jan 2023 03:42:14 +0530
+Subject: platform/x86: hp-wmi: Handle Omen Key event
+
+From: Rishit Bansal <rishitbansal0@gmail.com>
+
+[ Upstream commit 3ee5447b2048c8389ed899838a40b40180d50906 ]
+
+Add support to map the "HP Omen Key" to KEY_PROG2. Laptops in the HP
+Omen Series open the HP Omen Command Center application on windows. But,
+on linux it fails with the following message from the hp-wmi driver:
+
+[ 5143.415714] hp_wmi: Unknown event_id - 29 - 0x21a5
+
+Also adds support to map Fn+Esc to KEY_FN_ESC. This currently throws the
+following message on the hp-wmi driver:
+
+[ 6082.143785] hp_wmi: Unknown key code - 0x21a7
+
+There is also a "Win-Lock" key on HP Omen Laptops which supports
+Enabling and Disabling the Windows key, which trigger commands 0x21a4
+and 0x121a4 respectively, but I wasn't able to find any KEY in input.h
+to map this to.
+
+Signed-off-by: Rishit Bansal <rishitbansal0@gmail.com>
+Link: https://lore.kernel.org/r/20230120221214.24426-1-rishitbansal0@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/hp-wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index 0a99058be813..4a3851332ef2 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -90,6 +90,7 @@ enum hp_wmi_event_ids {
+ HPWMI_PEAKSHIFT_PERIOD = 0x0F,
+ HPWMI_BATTERY_CHARGE_PERIOD = 0x10,
+ HPWMI_SANITIZATION_MODE = 0x17,
++ HPWMI_OMEN_KEY = 0x1D,
+ HPWMI_SMART_EXPERIENCE_APP = 0x21,
+ };
+
+@@ -216,6 +217,8 @@ static const struct key_entry hp_wmi_keymap[] = {
+ { KE_KEY, 0x213b, { KEY_INFO } },
+ { KE_KEY, 0x2169, { KEY_ROTATE_DISPLAY } },
+ { KE_KEY, 0x216a, { KEY_SETUP } },
++ { KE_KEY, 0x21a5, { KEY_PROG2 } }, /* HP Omen Key */
++ { KE_KEY, 0x21a7, { KEY_FN_ESC } },
+ { KE_KEY, 0x21a9, { KEY_TOUCHPAD_OFF } },
+ { KE_KEY, 0x121a9, { KEY_TOUCHPAD_ON } },
+ { KE_KEY, 0x231b, { KEY_HELP } },
+@@ -810,6 +813,7 @@ static void hp_wmi_notify(u32 value, void *context)
+ case HPWMI_SMART_ADAPTER:
+ break;
+ case HPWMI_BEZEL_BUTTON:
++ case HPWMI_OMEN_KEY:
+ key_code = hp_wmi_read_int(HPWMI_HOTKEY_QUERY);
+ if (key_code < 0)
+ break;
+--
+2.39.0
+
--- /dev/null
+From 7343db90457126535c0f4989a94232fb05fe34a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Jan 2023 00:57:23 +0100
+Subject: platform/x86: thinkpad_acpi: Fix thinklight LED brightness returning
+ 255
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit eebf82012dddbdcb09e4e49d3cdfafb93bc66eb2 ]
+
+Reading the thinklight LED brightnes while the LED is on returns
+255 (LED_FULL) but we advertise a max_brightness of 1, so this should
+be 1 (LED_ON).
+
+Fixes: db5e2a4ca0a7 ("platform/x86: thinkpad_acpi: Fix max_brightness of thinklight")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230127235723.412864-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 7fd735c67a8e..2a48a2d880d8 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -5566,7 +5566,7 @@ static int light_sysfs_set(struct led_classdev *led_cdev,
+
+ static enum led_brightness light_sysfs_get(struct led_classdev *led_cdev)
+ {
+- return (light_get_status() == 1) ? LED_FULL : LED_OFF;
++ return (light_get_status() == 1) ? LED_ON : LED_OFF;
+ }
+
+ static struct tpacpi_led_classdev tpacpi_led_thinklight = {
+--
+2.39.0
+
--- /dev/null
+From 173e6aedd94f202ba3a21659c2b19e6c9a095938 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 08:48:57 +0100
+Subject: qede: execute xdp_do_flush() before napi_complete_done()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Magnus Karlsson <magnus.karlsson@intel.com>
+
+[ Upstream commit 2ccce20d51faa0178086163ccb6c84a099a87ab4 ]
+
+Make sure that xdp_do_flush() is always executed before
+napi_complete_done(). This is important for two reasons. First, a
+redirect to an XSKMAP assumes that a call to xdp_do_redirect() from
+napi context X on CPU Y will be followed by a xdp_do_flush() from the
+same napi context and CPU. This is not guaranteed if the
+napi_complete_done() is executed before xdp_do_flush(), as it tells
+the napi logic that it is fine to schedule napi context X on another
+CPU. Details from a production system triggering this bug using the
+veth driver can be found following the first link below.
+
+The second reason is that the XDP_REDIRECT logic in itself relies on
+being inside a single NAPI instance through to the xdp_do_flush() call
+for RCU protection of all in-kernel data structures. Details can be
+found in the second link below.
+
+Fixes: d1b25b79e162b ("qede: add .ndo_xdp_xmit() and XDP_REDIRECT support")
+Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com
+Link: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qede/qede_fp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+index 7c2af482192d..cb1746bc0e0c 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+@@ -1438,6 +1438,10 @@ int qede_poll(struct napi_struct *napi, int budget)
+ rx_work_done = (likely(fp->type & QEDE_FASTPATH_RX) &&
+ qede_has_rx_work(fp->rxq)) ?
+ qede_rx_int(fp, budget) : 0;
++
++ if (fp->xdp_xmit & QEDE_XDP_REDIRECT)
++ xdp_do_flush();
++
+ /* Handle case where we are called by netpoll with a budget of 0 */
+ if (rx_work_done < budget || !budget) {
+ if (!qede_poll_is_more_work(fp)) {
+@@ -1457,9 +1461,6 @@ int qede_poll(struct napi_struct *napi, int budget)
+ qede_update_tx_producer(fp->xdp_tx);
+ }
+
+- if (fp->xdp_xmit & QEDE_XDP_REDIRECT)
+- xdp_do_flush_map();
+-
+ return rx_work_done;
+ }
+
+--
+2.39.0
+
--- /dev/null
+From 0782949e2c212f49834b5cdc7b9aa7a0abfef923 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Sep 2022 19:01:10 -0400
+Subject: READ is "data destination", not source...
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 355d2c2798e9dc39f6714fa7ef8902c0d4c5350b ]
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 8546b8816524..88282b288abd 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -966,7 +966,7 @@ static void rtrs_clt_init_req(struct rtrs_clt_io_req *req,
+ refcount_set(&req->ref, 1);
+ req->mp_policy = clt_path->clt->mp_policy;
+
+- iov_iter_kvec(&iter, READ, vec, 1, usr_len);
++ iov_iter_kvec(&iter, WRITE, vec, 1, usr_len);
+ len = _copy_from_iter(req->iu->buf, usr_len, &iter);
+ WARN_ON(len != usr_len);
+
+--
+2.39.0
+
--- /dev/null
+From 93d079890c729fc5eafc4f0d78cdf74e981ceded Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 20:14:42 +0100
+Subject: Revert "gfs2: stop using generic_writepages in gfs2_ail1_start_one"
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 95ecbd0f162fc06ef4c4045a66f653f47b62a2d3 ]
+
+Commit b2b0a5e97855 switched from generic_writepages() to
+filemap_fdatawrite_wbc() in gfs2_ail1_start_one() on the path to
+replacing ->writepage() with ->writepages() and eventually eliminating
+the former. Function gfs2_ail1_start_one() is called from
+gfs2_log_flush(), our main function for flushing the filesystem log.
+
+Unfortunately, at least as implemented today, ->writepage() and
+->writepages() are entirely different operations for journaled data
+inodes: while the former creates and submits transactions covering the
+data to be written, the latter flushes dirty buffers out to disk.
+
+With gfs2_ail1_start_one() now calling ->writepages(), we end up
+creating filesystem transactions while we are in the course of a log
+flush, which immediately deadlocks on the sdp->sd_log_flush_lock
+semaphore.
+
+Work around that by going back to how things used to work before commit
+b2b0a5e97855 for now; figuring out a superior solution will take time we
+don't have available right now. However ...
+
+Since the removal of generic_writepages() is imminent, open-code it
+here. We're already inside a blk_start_plug() ... blk_finish_plug()
+section here, so skip that part of the original generic_writepages().
+
+This reverts commit b2b0a5e978552e348f85ad9c7568b630a5ede659.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Acked-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/log.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
+index 723639376ae2..61323deb80bc 100644
+--- a/fs/gfs2/log.c
++++ b/fs/gfs2/log.c
+@@ -80,6 +80,15 @@ void gfs2_remove_from_ail(struct gfs2_bufdata *bd)
+ brelse(bd->bd_bh);
+ }
+
++static int __gfs2_writepage(struct page *page, struct writeback_control *wbc,
++ void *data)
++{
++ struct address_space *mapping = data;
++ int ret = mapping->a_ops->writepage(page, wbc);
++ mapping_set_error(mapping, ret);
++ return ret;
++}
++
+ /**
+ * gfs2_ail1_start_one - Start I/O on a transaction
+ * @sdp: The superblock
+@@ -131,7 +140,7 @@ __acquires(&sdp->sd_ail_lock)
+ if (!mapping)
+ continue;
+ spin_unlock(&sdp->sd_ail_lock);
+- ret = filemap_fdatawrite_wbc(mapping, wbc);
++ ret = write_cache_pages(mapping, wbc, __gfs2_writepage, mapping);
+ if (need_resched()) {
+ blk_finish_plug(plug);
+ cond_resched();
+--
+2.39.0
+
--- /dev/null
+From ca76327b433d475958e3267feb81e0479a83b8fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 23:06:04 -0500
+Subject: riscv: kprobe: Fixup kernel panic when probing an illegal position
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guo Ren <guoren@linux.alibaba.com>
+
+[ Upstream commit 87f48c7ccc73afc78630530d9af51f458f58cab8 ]
+
+The kernel would panic when probed for an illegal position. eg:
+
+(CONFIG_RISCV_ISA_C=n)
+
+echo 'p:hello kernel_clone+0x16 a0=%a0' >> kprobe_events
+echo 1 > events/kprobes/hello/enable
+cat trace
+
+Kernel panic - not syncing: stack-protector: Kernel stack
+is corrupted in: __do_sys_newfstatat+0xb8/0xb8
+CPU: 0 PID: 111 Comm: sh Not tainted
+6.2.0-rc1-00027-g2d398fe49a4d #490
+Hardware name: riscv-virtio,qemu (DT)
+Call Trace:
+[<ffffffff80007268>] dump_backtrace+0x38/0x48
+[<ffffffff80c5e83c>] show_stack+0x50/0x68
+[<ffffffff80c6da28>] dump_stack_lvl+0x60/0x84
+[<ffffffff80c6da6c>] dump_stack+0x20/0x30
+[<ffffffff80c5ecf4>] panic+0x160/0x374
+[<ffffffff80c6db94>] generic_handle_arch_irq+0x0/0xa8
+[<ffffffff802deeb0>] sys_newstat+0x0/0x30
+[<ffffffff800158c0>] sys_clone+0x20/0x30
+[<ffffffff800039e8>] ret_from_syscall+0x0/0x4
+---[ end Kernel panic - not syncing: stack-protector:
+Kernel stack is corrupted in: __do_sys_newfstatat+0xb8/0xb8 ]---
+
+That is because the kprobe's ebreak instruction broke the kernel's
+original code. The user should guarantee the correction of the probe
+position, but it couldn't make the kernel panic.
+
+This patch adds arch_check_kprobe in arch_prepare_kprobe to prevent an
+illegal position (Such as the middle of an instruction).
+
+Fixes: c22b0bcb1dd0 ("riscv: Add kprobes supported")
+Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
+Signed-off-by: Guo Ren <guoren@kernel.org>
+Reviewed-by: Björn Töpel <bjorn@kernel.org>
+Link: https://lore.kernel.org/r/20230201040604.3390509-1-guoren@kernel.org
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/probes/kprobes.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c
+index e6e950b7cf32..388ecada500c 100644
+--- a/arch/riscv/kernel/probes/kprobes.c
++++ b/arch/riscv/kernel/probes/kprobes.c
+@@ -48,6 +48,21 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs)
+ post_kprobe_handler(p, kcb, regs);
+ }
+
++static bool __kprobes arch_check_kprobe(struct kprobe *p)
++{
++ unsigned long tmp = (unsigned long)p->addr - p->offset;
++ unsigned long addr = (unsigned long)p->addr;
++
++ while (tmp <= addr) {
++ if (tmp == addr)
++ return true;
++
++ tmp += GET_INSN_LENGTH(*(u16 *)tmp);
++ }
++
++ return false;
++}
++
+ int __kprobes arch_prepare_kprobe(struct kprobe *p)
+ {
+ unsigned long probe_addr = (unsigned long)p->addr;
+@@ -55,6 +70,9 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
+ if (probe_addr & 0x1)
+ return -EILSEQ;
+
++ if (!arch_check_kprobe(p))
++ return -EILSEQ;
++
+ /* copy instruction */
+ p->opcode = *p->addr;
+
+--
+2.39.0
+
--- /dev/null
+From 3672f40dfe3581efc0bfcff13c8b114e0cdc1ca6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 18:24:44 +0100
+Subject: rtc: sunplus: fix format string for printing resource
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 08279468a294d8c996a657ecc9e51bd5c084c75d ]
+
+On 32-bit architectures with 64-bit resource_size_t, sp_rtc_probe()
+causes a compiler warning:
+
+drivers/rtc/rtc-sunplus.c: In function 'sp_rtc_probe':
+drivers/rtc/rtc-sunplus.c:243:33: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+ 243 | dev_dbg(&plat_dev->dev, "res = 0x%x, reg_base = 0x%lx\n",
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The best way to print a resource is the special %pR format string,
+and similarly to print a pointer we can use %p and avoid the cast.
+
+Fixes: fad6cbe9b2b4 ("rtc: Add driver for RTC in Sunplus SP7021")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20230117172450.2938962-1-arnd@kernel.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-sunplus.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/rtc-sunplus.c b/drivers/rtc/rtc-sunplus.c
+index e8e2ab1103fc..4b578e4d44f6 100644
+--- a/drivers/rtc/rtc-sunplus.c
++++ b/drivers/rtc/rtc-sunplus.c
+@@ -240,8 +240,8 @@ static int sp_rtc_probe(struct platform_device *plat_dev)
+ if (IS_ERR(sp_rtc->reg_base))
+ return dev_err_probe(&plat_dev->dev, PTR_ERR(sp_rtc->reg_base),
+ "%s devm_ioremap_resource fail\n", RTC_REG_NAME);
+- dev_dbg(&plat_dev->dev, "res = 0x%x, reg_base = 0x%lx\n",
+- sp_rtc->res->start, (unsigned long)sp_rtc->reg_base);
++ dev_dbg(&plat_dev->dev, "res = %pR, reg_base = %p\n",
++ sp_rtc->res, sp_rtc->reg_base);
+
+ sp_rtc->irq = platform_get_irq(plat_dev, 0);
+ if (sp_rtc->irq < 0)
+--
+2.39.0
+
--- /dev/null
+From d712ca765374736b33e7c5eaacd720e3a2405b03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 13:39:37 -0600
+Subject: scsi: iscsi_tcp: Fix UAF during login when accessing the shost
+ ipaddress
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3 ]
+
+If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails,
+userspace could be accessing the host's ipaddress attr. If we then free the
+session via iscsi_session_teardown() while userspace is still accessing the
+session we will hit a use after free bug.
+
+Set the tcp_sw_host->session after we have completed session creation and
+can no longer fail.
+
+Link: https://lore.kernel.org/r/20230117193937.21244-3-michael.christie@oracle.com
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Acked-by: Ding Hui <dinghui@sangfor.com.cn>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/iscsi_tcp.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
+index 9c0c8f34ef67..c3ad04ad66e0 100644
+--- a/drivers/scsi/iscsi_tcp.c
++++ b/drivers/scsi/iscsi_tcp.c
+@@ -848,7 +848,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost,
+ enum iscsi_host_param param, char *buf)
+ {
+ struct iscsi_sw_tcp_host *tcp_sw_host = iscsi_host_priv(shost);
+- struct iscsi_session *session = tcp_sw_host->session;
++ struct iscsi_session *session;
+ struct iscsi_conn *conn;
+ struct iscsi_tcp_conn *tcp_conn;
+ struct iscsi_sw_tcp_conn *tcp_sw_conn;
+@@ -858,6 +858,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost,
+
+ switch (param) {
+ case ISCSI_HOST_PARAM_IPADDRESS:
++ session = tcp_sw_host->session;
+ if (!session)
+ return -ENOTCONN;
+
+@@ -958,11 +959,13 @@ iscsi_sw_tcp_session_create(struct iscsi_endpoint *ep, uint16_t cmds_max,
+ if (!cls_session)
+ goto remove_host;
+ session = cls_session->dd_data;
+- tcp_sw_host = iscsi_host_priv(shost);
+- tcp_sw_host->session = session;
+
+ if (iscsi_tcp_r2tpool_alloc(session))
+ goto remove_session;
++
++ /* We are now fully setup so expose the session to sysfs. */
++ tcp_sw_host = iscsi_host_priv(shost);
++ tcp_sw_host->session = session;
+ return cls_session;
+
+ remove_session:
+--
+2.39.0
+
--- /dev/null
+From 880f111fdf807a6b95aa569f938643e4c29b3a8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 13:39:36 -0600
+Subject: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost
+ ipaddress
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit 6f1d64b13097e85abda0f91b5638000afc5f9a06 ]
+
+Bug report and analysis from Ding Hui.
+
+During iSCSI session logout, if another task accesses the shost ipaddress
+attr, we can get a KASAN UAF report like this:
+
+[ 276.942144] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x78/0xe0
+[ 276.942535] Write of size 4 at addr ffff8881053b45b8 by task cat/4088
+[ 276.943511] CPU: 2 PID: 4088 Comm: cat Tainted: G E 6.1.0-rc8+ #3
+[ 276.943997] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
+[ 276.944470] Call Trace:
+[ 276.944943] <TASK>
+[ 276.945397] dump_stack_lvl+0x34/0x48
+[ 276.945887] print_address_description.constprop.0+0x86/0x1e7
+[ 276.946421] print_report+0x36/0x4f
+[ 276.947358] kasan_report+0xad/0x130
+[ 276.948234] kasan_check_range+0x35/0x1c0
+[ 276.948674] _raw_spin_lock_bh+0x78/0xe0
+[ 276.949989] iscsi_sw_tcp_host_get_param+0xad/0x2e0 [iscsi_tcp]
+[ 276.951765] show_host_param_ISCSI_HOST_PARAM_IPADDRESS+0xe9/0x130 [scsi_transport_iscsi]
+[ 276.952185] dev_attr_show+0x3f/0x80
+[ 276.953005] sysfs_kf_seq_show+0x1fb/0x3e0
+[ 276.953401] seq_read_iter+0x402/0x1020
+[ 276.954260] vfs_read+0x532/0x7b0
+[ 276.955113] ksys_read+0xed/0x1c0
+[ 276.955952] do_syscall_64+0x38/0x90
+[ 276.956347] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+[ 276.956769] RIP: 0033:0x7f5d3a679222
+[ 276.957161] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 32 c0 0b 00 e8 a5 fe 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24
+[ 276.958009] RSP: 002b:00007ffc864d16a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
+[ 276.958431] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5d3a679222
+[ 276.958857] RDX: 0000000000020000 RSI: 00007f5d3a4fe000 RDI: 0000000000000003
+[ 276.959281] RBP: 00007f5d3a4fe000 R08: 00000000ffffffff R09: 0000000000000000
+[ 276.959682] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000020000
+[ 276.960126] R13: 0000000000000003 R14: 0000000000000000 R15: 0000557a26dada58
+[ 276.960536] </TASK>
+[ 276.961357] Allocated by task 2209:
+[ 276.961756] kasan_save_stack+0x1e/0x40
+[ 276.962170] kasan_set_track+0x21/0x30
+[ 276.962557] __kasan_kmalloc+0x7e/0x90
+[ 276.962923] __kmalloc+0x5b/0x140
+[ 276.963308] iscsi_alloc_session+0x28/0x840 [scsi_transport_iscsi]
+[ 276.963712] iscsi_session_setup+0xda/0xba0 [libiscsi]
+[ 276.964078] iscsi_sw_tcp_session_create+0x1fd/0x330 [iscsi_tcp]
+[ 276.964431] iscsi_if_create_session.isra.0+0x50/0x260 [scsi_transport_iscsi]
+[ 276.964793] iscsi_if_recv_msg+0xc5a/0x2660 [scsi_transport_iscsi]
+[ 276.965153] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi]
+[ 276.965546] netlink_unicast+0x4d5/0x7b0
+[ 276.965905] netlink_sendmsg+0x78d/0xc30
+[ 276.966236] sock_sendmsg+0xe5/0x120
+[ 276.966576] ____sys_sendmsg+0x5fe/0x860
+[ 276.966923] ___sys_sendmsg+0xe0/0x170
+[ 276.967300] __sys_sendmsg+0xc8/0x170
+[ 276.967666] do_syscall_64+0x38/0x90
+[ 276.968028] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+[ 276.968773] Freed by task 2209:
+[ 276.969111] kasan_save_stack+0x1e/0x40
+[ 276.969449] kasan_set_track+0x21/0x30
+[ 276.969789] kasan_save_free_info+0x2a/0x50
+[ 276.970146] __kasan_slab_free+0x106/0x190
+[ 276.970470] __kmem_cache_free+0x133/0x270
+[ 276.970816] device_release+0x98/0x210
+[ 276.971145] kobject_cleanup+0x101/0x360
+[ 276.971462] iscsi_session_teardown+0x3fb/0x530 [libiscsi]
+[ 276.971775] iscsi_sw_tcp_session_destroy+0xd8/0x130 [iscsi_tcp]
+[ 276.972143] iscsi_if_recv_msg+0x1bf1/0x2660 [scsi_transport_iscsi]
+[ 276.972485] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi]
+[ 276.972808] netlink_unicast+0x4d5/0x7b0
+[ 276.973201] netlink_sendmsg+0x78d/0xc30
+[ 276.973544] sock_sendmsg+0xe5/0x120
+[ 276.973864] ____sys_sendmsg+0x5fe/0x860
+[ 276.974248] ___sys_sendmsg+0xe0/0x170
+[ 276.974583] __sys_sendmsg+0xc8/0x170
+[ 276.974891] do_syscall_64+0x38/0x90
+[ 276.975216] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+We can easily reproduce by two tasks:
+1. while :; do iscsiadm -m node --login; iscsiadm -m node --logout; done
+2. while :; do cat \
+/sys/devices/platform/host*/iscsi_host/host*/ipaddress; done
+
+ iscsid | cat
+--------------------------------+---------------------------------------
+|- iscsi_sw_tcp_session_destroy |
+ |- iscsi_session_teardown |
+ |- device_release |
+ |- iscsi_session_release ||- dev_attr_show
+ |- kfree | |- show_host_param_
+ | ISCSI_HOST_PARAM_IPADDRESS
+ | |- iscsi_sw_tcp_host_get_param
+ | |- r/w tcp_sw_host->session (UAF)
+ |- iscsi_host_remove |
+ |- iscsi_host_free |
+
+Fix the above bug by splitting the session removal into 2 parts:
+
+ 1. removal from iSCSI class which includes sysfs and removal from host
+ tracking.
+
+ 2. freeing of session.
+
+During iscsi_tcp host and session removal we can remove the session from
+sysfs then remove the host from sysfs. At this point we know userspace is
+not accessing the kernel via sysfs so we can free the session and host.
+
+Link: https://lore.kernel.org/r/20230117193937.21244-2-michael.christie@oracle.com
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Acked-by: Ding Hui <dinghui@sangfor.com.cn>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/iscsi_tcp.c | 11 +++++++++--
+ drivers/scsi/libiscsi.c | 38 +++++++++++++++++++++++++++++++-------
+ include/scsi/libiscsi.h | 2 ++
+ 3 files changed, 42 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
+index 5fb1f364e815..9c0c8f34ef67 100644
+--- a/drivers/scsi/iscsi_tcp.c
++++ b/drivers/scsi/iscsi_tcp.c
+@@ -982,10 +982,17 @@ static void iscsi_sw_tcp_session_destroy(struct iscsi_cls_session *cls_session)
+ if (WARN_ON_ONCE(session->leadconn))
+ return;
+
++ iscsi_session_remove(cls_session);
++ /*
++ * Our get_host_param needs to access the session, so remove the
++ * host from sysfs before freeing the session to make sure userspace
++ * is no longer accessing the callout.
++ */
++ iscsi_host_remove(shost, false);
++
+ iscsi_tcp_r2tpool_free(cls_session->dd_data);
+- iscsi_session_teardown(cls_session);
+
+- iscsi_host_remove(shost, false);
++ iscsi_session_free(cls_session);
+ iscsi_host_free(shost);
+ }
+
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index d95f4bcdeb2e..6e811d753cb1 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -3104,17 +3104,32 @@ iscsi_session_setup(struct iscsi_transport *iscsit, struct Scsi_Host *shost,
+ }
+ EXPORT_SYMBOL_GPL(iscsi_session_setup);
+
+-/**
+- * iscsi_session_teardown - destroy session, host, and cls_session
+- * @cls_session: iscsi session
++/*
++ * issi_session_remove - Remove session from iSCSI class.
+ */
+-void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
++void iscsi_session_remove(struct iscsi_cls_session *cls_session)
+ {
+ struct iscsi_session *session = cls_session->dd_data;
+- struct module *owner = cls_session->transport->owner;
+ struct Scsi_Host *shost = session->host;
+
+ iscsi_remove_session(cls_session);
++ /*
++ * host removal only has to wait for its children to be removed from
++ * sysfs, and iscsi_tcp needs to do iscsi_host_remove before freeing
++ * the session, so drop the session count here.
++ */
++ iscsi_host_dec_session_cnt(shost);
++}
++EXPORT_SYMBOL_GPL(iscsi_session_remove);
++
++/**
++ * iscsi_session_free - Free iscsi session and it's resources
++ * @cls_session: iscsi session
++ */
++void iscsi_session_free(struct iscsi_cls_session *cls_session)
++{
++ struct iscsi_session *session = cls_session->dd_data;
++ struct module *owner = cls_session->transport->owner;
+
+ iscsi_pool_free(&session->cmdpool);
+ kfree(session->password);
+@@ -3132,10 +3147,19 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
+ kfree(session->discovery_parent_type);
+
+ iscsi_free_session(cls_session);
+-
+- iscsi_host_dec_session_cnt(shost);
+ module_put(owner);
+ }
++EXPORT_SYMBOL_GPL(iscsi_session_free);
++
++/**
++ * iscsi_session_teardown - destroy session and cls_session
++ * @cls_session: iscsi session
++ */
++void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
++{
++ iscsi_session_remove(cls_session);
++ iscsi_session_free(cls_session);
++}
+ EXPORT_SYMBOL_GPL(iscsi_session_teardown);
+
+ /**
+diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
+index 654cc3918c94..7fb3cb787df4 100644
+--- a/include/scsi/libiscsi.h
++++ b/include/scsi/libiscsi.h
+@@ -422,6 +422,8 @@ extern int iscsi_host_get_max_scsi_cmds(struct Scsi_Host *shost,
+ extern struct iscsi_cls_session *
+ iscsi_session_setup(struct iscsi_transport *, struct Scsi_Host *shost,
+ uint16_t, int, int, uint32_t, unsigned int);
++void iscsi_session_remove(struct iscsi_cls_session *cls_session);
++void iscsi_session_free(struct iscsi_cls_session *cls_session);
+ extern void iscsi_session_teardown(struct iscsi_cls_session *);
+ extern void iscsi_session_recovery_timedout(struct iscsi_cls_session *);
+ extern int iscsi_set_param(struct iscsi_cls_conn *cls_conn,
+--
+2.39.0
+
--- /dev/null
+From d05614853f64dfe9d339e9c04602441d9de3b2e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 22:06:08 -0500
+Subject: scsi: Revert "scsi: core: map PQ=1, PDT=other values to
+ SCSI_SCAN_TARGET_PRESENT"
+
+From: Martin K. Petersen <martin.petersen@oracle.com>
+
+[ Upstream commit 15600159bcc6abbeae6b33a849bef90dca28b78f ]
+
+This reverts commit 948e922fc44611ee2de0c89583ca958cb5307d36.
+
+Not all targets that return PQ=1 and PDT=0 should be ignored. While
+the SCSI spec is vague in this department, there appears to be a
+critical mass of devices which rely on devices being accessible with
+this combination of reported values.
+
+Fixes: 948e922fc446 ("scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT")
+Link: https://lore.kernel.org/r/yq1lelrleqr.fsf@ca-mkp.ca.oracle.com
+Acked-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: Martin Wilck <mwilck@suse.com>
+Acked-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_scan.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index 5d27f5196de6..d149b218715e 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -1233,8 +1233,7 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
+ * that no LUN is present, so don't add sdev in these cases.
+ * Two specific examples are:
+ * 1) NetApp targets: return PQ=1, PDT=0x1f
+- * 2) IBM/2145 targets: return PQ=1, PDT=0
+- * 3) USB UFI: returns PDT=0x1f, with the PQ bits being "reserved"
++ * 2) USB UFI: returns PDT=0x1f, with the PQ bits being "reserved"
+ * in the UFI 1.0 spec (we cannot rely on reserved bits).
+ *
+ * References:
+@@ -1248,8 +1247,8 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
+ * PDT=00h Direct-access device (floppy)
+ * PDT=1Fh none (no FDD connected to the requested logical unit)
+ */
+- if (((result[0] >> 5) == 1 ||
+- (starget->pdt_1f_for_no_lun && (result[0] & 0x1f) == 0x1f)) &&
++ if (((result[0] >> 5) == 1 || starget->pdt_1f_for_no_lun) &&
++ (result[0] & 0x1f) == 0x1f &&
+ !scsi_is_wlun(lun)) {
+ SCSI_LOG_SCAN_BUS(3, sdev_printk(KERN_INFO, sdev,
+ "scsi scan: peripheral device type"
+--
+2.39.0
+
--- /dev/null
+From 6877d12142b25874811d740d5b0580a0433f8b8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 13:53:10 +0100
+Subject: scsi: target: core: Fix warning on RT kernels
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+[ Upstream commit 84ed64b1a7a7fcd507598dee7708c1f225123711 ]
+
+Calling spin_lock_irqsave() does not disable the interrupts on realtime
+kernels, remove the warning and replace assert_spin_locked() with
+lockdep_assert_held().
+
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20230110125310.55884-1-mlombard@redhat.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_tmr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
+index bac111456fa1..2b95b4550a63 100644
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -73,8 +73,8 @@ static bool __target_check_io_state(struct se_cmd *se_cmd,
+ {
+ struct se_session *sess = se_cmd->se_sess;
+
+- assert_spin_locked(&sess->sess_cmd_lock);
+- WARN_ON_ONCE(!irqs_disabled());
++ lockdep_assert_held(&sess->sess_cmd_lock);
++
+ /*
+ * If command already reached CMD_T_COMPLETE state within
+ * target_complete_cmd() or CMD_T_FABRIC_STOP due to shutdown,
+--
+2.39.0
+
--- /dev/null
+From 8f0edf16ddd6f7a40efc0d9a8242e68a633218e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 11:25:33 -0500
+Subject: sctp: do not check hb_timer.expires when resetting hb_timer
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 8f35ae17ef565a605de5f409e04bcd49a55d7646 ]
+
+It tries to avoid the frequently hb_timer refresh in commit ba6f5e33bdbb
+("sctp: avoid refreshing heartbeat timer too often"), and it only allows
+mod_timer when the new expires is after hb_timer.expires. It means even
+a much shorter interval for hb timer gets applied, it will have to wait
+until the current hb timer to time out.
+
+In sctp_do_8_2_transport_strike(), when a transport enters PF state, it
+expects to update the hb timer to resend a heartbeat every rto after
+calling sctp_transport_reset_hb_timer(), which will not work as the
+change mentioned above.
+
+The frequently hb_timer refresh was caused by sctp_transport_reset_timers()
+called in sctp_outq_flush() and it was already removed in the commit above.
+So we don't have to check hb_timer.expires when resetting hb_timer as it is
+now not called very often.
+
+Fixes: ba6f5e33bdbb ("sctp: avoid refreshing heartbeat timer too often")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Link: https://lore.kernel.org/r/d958c06985713ec84049a2d5664879802710179a.1675095933.git.lucien.xin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/transport.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/net/sctp/transport.c b/net/sctp/transport.c
+index f8fd98784977..b3f1a91e9a07 100644
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -196,9 +196,7 @@ void sctp_transport_reset_hb_timer(struct sctp_transport *transport)
+
+ /* When a data chunk is sent, reset the heartbeat interval. */
+ expires = jiffies + sctp_transport_timeout(transport);
+- if ((time_before(transport->hb_timer.expires, expires) ||
+- !timer_pending(&transport->hb_timer)) &&
+- !mod_timer(&transport->hb_timer,
++ if (!mod_timer(&transport->hb_timer,
+ expires + prandom_u32_max(transport->rto)))
+ sctp_transport_hold(transport);
+ }
+--
+2.39.0
+
--- /dev/null
+From 69f32dbae8719c1e064d10d2da7d66e538d72ba1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 16:15:31 +0800
+Subject: selftests/filesystems: grant executable permission to
+ run_fat_tests.sh
+
+From: Pengfei Xu <pengfei.xu@intel.com>
+
+[ Upstream commit 24b5308cf5ee9f52dd22f3af78a5b0cdc9d35e72 ]
+
+When use tools/testing/selftests/kselftest_install.sh to make the
+kselftest-list.txt under tools/testing/selftests/kselftest_install.
+
+Then use tools/testing/selftests/kselftest_install/run_kselftest.sh to run
+all the kselftests in kselftest-list.txt, it will be blocked by case
+"filesystems/fat: run_fat_tests.sh" with "Warning: file run_fat_tests.sh
+is not executable", so grant executable permission to run_fat_tests.sh to
+fix this issue.
+
+Link: https://lkml.kernel.org/r/dfdbba6df8a1ab34bb1e81cd8bd7ca3f9ed5c369.1673424747.git.pengfei.xu@intel.com
+Fixes: dd7c9be330d8 ("selftests/filesystems: add a vfat RENAME_EXCHANGE test")
+Signed-off-by: Pengfei Xu <pengfei.xu@intel.com>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/filesystems/fat/run_fat_tests.sh | 0
+ 1 file changed, 0 insertions(+), 0 deletions(-)
+ mode change 100644 => 100755 tools/testing/selftests/filesystems/fat/run_fat_tests.sh
+
+diff --git a/tools/testing/selftests/filesystems/fat/run_fat_tests.sh b/tools/testing/selftests/filesystems/fat/run_fat_tests.sh
+old mode 100644
+new mode 100755
+--
+2.39.0
+
--- /dev/null
+From 65712ac83f2484850b1f5f4a1b10487c970df190 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 00:16:14 +0000
+Subject: selftests: net: udpgso_bench: Fix racing bug between the rx/tx
+ programs
+
+From: Andrei Gherzan <andrei.gherzan@canonical.com>
+
+[ Upstream commit dafe93b9ee21028d625dce347118b82659652eff ]
+
+"udpgro_bench.sh" invokes udpgso_bench_rx/udpgso_bench_tx programs
+subsequently and while doing so, there is a chance that the rx one is not
+ready to accept socket connections. This racing bug could fail the test
+with at least one of the following:
+
+./udpgso_bench_tx: connect: Connection refused
+./udpgso_bench_tx: sendmsg: Connection refused
+./udpgso_bench_tx: write: Connection refused
+
+This change addresses this by making udpgro_bench.sh wait for the rx
+program to be ready before firing off the tx one - up to a 10s timeout.
+
+Fixes: 3a687bef148d ("selftests: udp gso benchmark")
+Signed-off-by: Andrei Gherzan <andrei.gherzan@canonical.com>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Link: https://lore.kernel.org/r/20230201001612.515730-3-andrei.gherzan@canonical.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/udpgso_bench.sh | 24 +++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/net/udpgso_bench.sh b/tools/testing/selftests/net/udpgso_bench.sh
+index dc932fd65363..640bc43452fa 100755
+--- a/tools/testing/selftests/net/udpgso_bench.sh
++++ b/tools/testing/selftests/net/udpgso_bench.sh
+@@ -7,6 +7,7 @@ readonly GREEN='\033[0;92m'
+ readonly YELLOW='\033[0;33m'
+ readonly RED='\033[0;31m'
+ readonly NC='\033[0m' # No Color
++readonly TESTPORT=8000
+
+ readonly KSFT_PASS=0
+ readonly KSFT_FAIL=1
+@@ -56,11 +57,26 @@ trap wake_children EXIT
+
+ run_one() {
+ local -r args=$@
++ local nr_socks=0
++ local i=0
++ local -r timeout=10
++
++ ./udpgso_bench_rx -p "$TESTPORT" &
++ ./udpgso_bench_rx -p "$TESTPORT" -t &
++
++ # Wait for the above test program to get ready to receive connections.
++ while [ "$i" -lt "$timeout" ]; do
++ nr_socks="$(ss -lnHi | grep -c "\*:${TESTPORT}")"
++ [ "$nr_socks" -eq 2 ] && break
++ i=$((i + 1))
++ sleep 1
++ done
++ if [ "$nr_socks" -ne 2 ]; then
++ echo "timed out while waiting for udpgso_bench_rx"
++ exit 1
++ fi
+
+- ./udpgso_bench_rx &
+- ./udpgso_bench_rx -t &
+-
+- ./udpgso_bench_tx ${args}
++ ./udpgso_bench_tx -p "$TESTPORT" ${args}
+ }
+
+ run_in_netns() {
+--
+2.39.0
+
--- /dev/null
+From 061298ff4d2b806c98677e87b304a2788311a451 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 00:16:10 +0000
+Subject: selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler
+ warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andrei Gherzan <andrei.gherzan@canonical.com>
+
+[ Upstream commit c03c80e3a03ffb4f790901d60797e9810539d946 ]
+
+This change fixes the following compiler warning:
+
+/usr/include/x86_64-linux-gnu/bits/error.h:40:5: warning: ‘gso_size’ may
+be used uninitialized [-Wmaybe-uninitialized]
+ 40 | __error_noreturn (__status, __errnum, __format,
+ __va_arg_pack ());
+ |
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ udpgso_bench_rx.c: In function ‘main’:
+ udpgso_bench_rx.c:253:23: note: ‘gso_size’ was declared here
+ 253 | int ret, len, gso_size, budget = 256;
+
+Fixes: 3327a9c46352 ("selftests: add functionals test for UDP GRO")
+Signed-off-by: Andrei Gherzan <andrei.gherzan@canonical.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Link: https://lore.kernel.org/r/20230201001612.515730-1-andrei.gherzan@canonical.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/udpgso_bench_rx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c
+index 6a193425c367..d0895bd1933f 100644
+--- a/tools/testing/selftests/net/udpgso_bench_rx.c
++++ b/tools/testing/selftests/net/udpgso_bench_rx.c
+@@ -250,7 +250,7 @@ static int recv_msg(int fd, char *buf, int len, int *gso_size)
+ static void do_flush_udp(int fd)
+ {
+ static char rbuf[ETH_MAX_MTU];
+- int ret, len, gso_size, budget = 256;
++ int ret, len, gso_size = 0, budget = 256;
+
+ len = cfg_read_all ? sizeof(rbuf) : 0;
+ while (budget--) {
+--
+2.39.0
+
--- /dev/null
+From 323d0f030372b74127929dc4d6c78ffe1001f347 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 00:16:12 +0000
+Subject: selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are
+ provided
+
+From: Andrei Gherzan <andrei.gherzan@canonical.com>
+
+[ Upstream commit db9b47ee9f5f375ab0c5daeb20321c75b4fa657d ]
+
+Leaving unrecognized arguments buried in the output, can easily hide a
+CLI/script typo. Avoid this by exiting when wrong arguments are provided to
+the udpgso_bench test programs.
+
+Fixes: 3a687bef148d ("selftests: udp gso benchmark")
+Signed-off-by: Andrei Gherzan <andrei.gherzan@canonical.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Link: https://lore.kernel.org/r/20230201001612.515730-2-andrei.gherzan@canonical.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/udpgso_bench_rx.c | 2 ++
+ tools/testing/selftests/net/udpgso_bench_tx.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c
+index d0895bd1933f..4058c7451e70 100644
+--- a/tools/testing/selftests/net/udpgso_bench_rx.c
++++ b/tools/testing/selftests/net/udpgso_bench_rx.c
+@@ -336,6 +336,8 @@ static void parse_opts(int argc, char **argv)
+ cfg_verify = true;
+ cfg_read_all = true;
+ break;
++ default:
++ exit(1);
+ }
+ }
+
+diff --git a/tools/testing/selftests/net/udpgso_bench_tx.c b/tools/testing/selftests/net/udpgso_bench_tx.c
+index f1fdaa270291..b47b5c32039f 100644
+--- a/tools/testing/selftests/net/udpgso_bench_tx.c
++++ b/tools/testing/selftests/net/udpgso_bench_tx.c
+@@ -490,6 +490,8 @@ static void parse_opts(int argc, char **argv)
+ case 'z':
+ cfg_zerocopy = true;
+ break;
++ default:
++ exit(1);
+ }
+ }
+
+--
+2.39.0
+
--- /dev/null
+From 66b7e00df43adf2f281de4af990779e5b61ce040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Feb 2023 00:16:16 +0000
+Subject: selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy
+ benchmarking
+
+From: Andrei Gherzan <andrei.gherzan@canonical.com>
+
+[ Upstream commit 329c9cd769c2e306957df031efff656c40922c76 ]
+
+The test tool can check that the zerocopy number of completions value is
+valid taking into consideration the number of datagram send calls. This can
+catch the system into a state where the datagrams are still in the system
+(for example in a qdisk, waiting for the network interface to return a
+completion notification, etc).
+
+This change adds a retry logic of computing the number of completions up to
+a configurable (via CLI) timeout (default: 2 seconds).
+
+Fixes: 79ebc3c26010 ("net/udpgso_bench_tx: options to exercise TX CMSG")
+Signed-off-by: Andrei Gherzan <andrei.gherzan@canonical.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Link: https://lore.kernel.org/r/20230201001612.515730-4-andrei.gherzan@canonical.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/udpgso_bench_tx.c | 34 +++++++++++++++----
+ 1 file changed, 27 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/net/udpgso_bench_tx.c b/tools/testing/selftests/net/udpgso_bench_tx.c
+index b47b5c32039f..477392715a9a 100644
+--- a/tools/testing/selftests/net/udpgso_bench_tx.c
++++ b/tools/testing/selftests/net/udpgso_bench_tx.c
+@@ -62,6 +62,7 @@ static int cfg_payload_len = (1472 * 42);
+ static int cfg_port = 8000;
+ static int cfg_runtime_ms = -1;
+ static bool cfg_poll;
++static int cfg_poll_loop_timeout_ms = 2000;
+ static bool cfg_segment;
+ static bool cfg_sendmmsg;
+ static bool cfg_tcp;
+@@ -235,16 +236,17 @@ static void flush_errqueue_recv(int fd)
+ }
+ }
+
+-static void flush_errqueue(int fd, const bool do_poll)
++static void flush_errqueue(int fd, const bool do_poll,
++ unsigned long poll_timeout, const bool poll_err)
+ {
+ if (do_poll) {
+ struct pollfd fds = {0};
+ int ret;
+
+ fds.fd = fd;
+- ret = poll(&fds, 1, 500);
++ ret = poll(&fds, 1, poll_timeout);
+ if (ret == 0) {
+- if (cfg_verbose)
++ if ((cfg_verbose) && (poll_err))
+ fprintf(stderr, "poll timeout\n");
+ } else if (ret < 0) {
+ error(1, errno, "poll");
+@@ -254,6 +256,20 @@ static void flush_errqueue(int fd, const bool do_poll)
+ flush_errqueue_recv(fd);
+ }
+
++static void flush_errqueue_retry(int fd, unsigned long num_sends)
++{
++ unsigned long tnow, tstop;
++ bool first_try = true;
++
++ tnow = gettimeofday_ms();
++ tstop = tnow + cfg_poll_loop_timeout_ms;
++ do {
++ flush_errqueue(fd, true, tstop - tnow, first_try);
++ first_try = false;
++ tnow = gettimeofday_ms();
++ } while ((stat_zcopies != num_sends) && (tnow < tstop));
++}
++
+ static int send_tcp(int fd, char *data)
+ {
+ int ret, done = 0, count = 0;
+@@ -413,7 +429,8 @@ static int send_udp_segment(int fd, char *data)
+
+ static void usage(const char *filepath)
+ {
+- error(1, 0, "Usage: %s [-46acmHPtTuvz] [-C cpu] [-D dst ip] [-l secs] [-M messagenr] [-p port] [-s sendsize] [-S gsosize]",
++ error(1, 0, "Usage: %s [-46acmHPtTuvz] [-C cpu] [-D dst ip] [-l secs] "
++ "[-L secs] [-M messagenr] [-p port] [-s sendsize] [-S gsosize]",
+ filepath);
+ }
+
+@@ -423,7 +440,7 @@ static void parse_opts(int argc, char **argv)
+ int max_len, hdrlen;
+ int c;
+
+- while ((c = getopt(argc, argv, "46acC:D:Hl:mM:p:s:PS:tTuvz")) != -1) {
++ while ((c = getopt(argc, argv, "46acC:D:Hl:L:mM:p:s:PS:tTuvz")) != -1) {
+ switch (c) {
+ case '4':
+ if (cfg_family != PF_UNSPEC)
+@@ -452,6 +469,9 @@ static void parse_opts(int argc, char **argv)
+ case 'l':
+ cfg_runtime_ms = strtoul(optarg, NULL, 10) * 1000;
+ break;
++ case 'L':
++ cfg_poll_loop_timeout_ms = strtoul(optarg, NULL, 10) * 1000;
++ break;
+ case 'm':
+ cfg_sendmmsg = true;
+ break;
+@@ -679,7 +699,7 @@ int main(int argc, char **argv)
+ num_sends += send_udp(fd, buf[i]);
+ num_msgs++;
+ if ((cfg_zerocopy && ((num_msgs & 0xF) == 0)) || cfg_tx_tstamp)
+- flush_errqueue(fd, cfg_poll);
++ flush_errqueue(fd, cfg_poll, 500, true);
+
+ if (cfg_msg_nr && num_msgs >= cfg_msg_nr)
+ break;
+@@ -698,7 +718,7 @@ int main(int argc, char **argv)
+ } while (!interrupted && (cfg_runtime_ms == -1 || tnow < tstop));
+
+ if (cfg_zerocopy || cfg_tx_tstamp)
+- flush_errqueue(fd, true);
++ flush_errqueue_retry(fd, num_sends);
+
+ if (close(fd))
+ error(1, errno, "close");
+--
+2.39.0
+
--- /dev/null
+From 30bd9afe6d55a72cec45bf4a4aa710c601297d6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jan 2023 11:33:07 -0500
+Subject: selftests/vm: remove __USE_GNU in hugetlb-madvise.c
+
+From: Peter Xu <peterx@redhat.com>
+
+[ Upstream commit 0ca2c535f5a07f01118a6a70bfab78576e02fcae ]
+
+__USE_GNU should be an internal macro only used inside glibc. Either
+memfd_create() or fallocate() requires _GNU_SOURCE per man page, where
+__USE_GNU will further be defined by glibc headers include/features.h:
+
+ #ifdef _GNU_SOURCE
+ # define __USE_GNU 1
+ #endif
+
+This fixes:
+
+ >> hugetlb-madvise.c:20: warning: "__USE_GNU" redefined
+ 20 | #define __USE_GNU
+ |
+ In file included from /usr/include/x86_64-linux-gnu/bits/libc-header-start.h:33,
+ from /usr/include/stdlib.h:26,
+ from hugetlb-madvise.c:16:
+ /usr/include/features.h:407: note: this is the location of the previous definition
+ 407 | # define __USE_GNU 1
+ |
+
+Link: https://lkml.kernel.org/r/Y8V9z+z6Tk7NetI3@x1n
+Signed-off-by: Peter Xu <peterx@redhat.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Mike Kravetz <mike.kravetz@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vm/hugetlb-madvise.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/tools/testing/selftests/vm/hugetlb-madvise.c b/tools/testing/selftests/vm/hugetlb-madvise.c
+index 3c9943131881..b3f01f1f7a60 100644
+--- a/tools/testing/selftests/vm/hugetlb-madvise.c
++++ b/tools/testing/selftests/vm/hugetlb-madvise.c
+@@ -16,7 +16,6 @@
+ #include <stdio.h>
+ #include <unistd.h>
+ #include <sys/mman.h>
+-#define __USE_GNU
+ #include <fcntl.h>
+
+ #define USAGE "USAGE: %s <hugepagefile_name>\n"
+--
+2.39.0
+
firewire-fix-memory-leak-for-payload-of-request-subaction-to-iec-61883-1-fcp-region.patch
+bus-sunxi-rsb-fix-error-handling-in-sunxi_rsb_init.patch
+arm64-dts-imx8m-venice-remove-incorrect-uart-has-rts.patch
+arm64-dts-freescale-imx8dxl-fix-sc_pwrkey-s-property.patch
+asoc-amd-acp-es8336-drop-reference-count-of-acpi-dev.patch
+asoc-intel-bytcht_es8316-drop-reference-count-of-acp.patch
+asoc-intel-bytcr_rt5651-drop-reference-count-of-acpi.patch
+asoc-intel-bytcr_rt5640-drop-reference-count-of-acpi.patch
+asoc-intel-bytcr_wm5102-drop-reference-count-of-acpi.patch
+asoc-intel-sof_es8336-drop-reference-count-of-acpi-d.patch
+asoc-intel-avs-implement-pci-shutdown.patch
+selftests-vm-remove-__use_gnu-in-hugetlb-madvise.c.patch
+bpf-fix-off-by-one-error-in-bpf_mem_cache_idx.patch
+bpf-fix-a-possible-task-gone-issue-with-bpf_send_sig.patch
+alsa-hda-via-avoid-potential-array-out-of-bound-in-a.patch
+bpf-fix-to-preserve-reg-parent-live-fields-when-copy.patch
+selftests-filesystems-grant-executable-permission-to.patch
+asoc-sof-ipc4-mtrace-prevent-underflow-in-sof_ipc4_p.patch
+bpf-add-missing-btf_put-to-register_btf_id_dtor_kfun.patch
+media-v4l2-ctrls-api.c-move-ctrl-is_new-1-to-the-cor.patch
+bpf-sockmap-check-for-any-of-tcp_bpf_prots-when-clon.patch
+arm64-dts-imx8mm-fix-pad-control-for-uart1_dte_rx.patch
+arm64-dts-imx8mm-verdin-do-not-power-down-eth-phy.patch
+drm-vc4-hdmi-make-cec-adapter-name-unique.patch
+drm-ssd130x-init-display-before-the-ssd130x_display_.patch
+scsi-revert-scsi-core-map-pq-1-pdt-other-values-to-s.patch
+bpf-fix-the-kernel-crash-caused-by-bpf_setsockopt.patch
+alsa-memalloc-workaround-for-xen-pv.patch
+vhost-net-clear-the-pending-messages-when-the-backen.patch
+copy_oldmem_kernel-write-is-data-source-not-destinat.patch
+write-is-data-source-not-destination.patch
+read-is-data-destination-not-source.patch
+zcore-write-is-data-source-not-destination.patch
+memcpy_real-write-is-data-source-not-destination.patch
+fix-iov_iter_bvec-direction-argument.patch
+fix-direction-argument-of-iov_iter_-init-bvec.patch
+fix-direction-argument-of-iov_iter_kvec.patch
+use-less-confusing-names-for-iov_iter-direction-init.patch
+vhost-scsi-unbreak-any-layout-for-response.patch
+ice-prevent-set_channel-from-changing-queues-while-r.patch
+qede-execute-xdp_do_flush-before-napi_complete_done.patch
+virtio-net-execute-xdp_do_flush-before-napi_complete.patch
+dpaa_eth-execute-xdp_do_flush-before-napi_complete_d.patch
+dpaa2-eth-execute-xdp_do_flush-before-napi_complete_.patch
+skb-do-mix-page-pool-and-page-referenced-frags-in-gr.patch
+sfc-correctly-advertise-tunneled-ipv6-segmentation.patch
+net-phy-dp83822-fix-null-pointer-access-on-dp83825-d.patch
+net-wwan-t7xx-fix-runtime-pm-initialization.patch
+block-bfq-replace-0-1-with-false-true-in-bic-apis.patch
+block-bfq-fix-uaf-for-bfqq-in-bic_set_bfqq.patch
+netrom-fix-use-after-free-caused-by-accept-on-alread.patch
+fscache-use-wait_on_bit-to-wait-for-the-freeing-of-r.patch
+platform-x86-amd-pmf-update-to-auto-mode-limits-only.patch
+platform-x86-amd-pmf-add-helper-routine-to-update-sp.patch
+platform-x86-amd-pmf-fix-to-update-sps-default-pprof.patch
+platform-x86-amd-pmf-add-helper-routine-to-check-ppr.patch
+platform-x86-amd-pmf-fix-to-update-sps-thermals-when.patch
+platform-x86-amd-pmf-ensure-mutexes-are-initialized-.patch
+platform-x86-thinkpad_acpi-fix-thinklight-led-bright.patch
+drm-i915-guc-fix-locking-when-searching-for-a-hung-r.patch
+drm-i915-fix-request-ref-counting-during-error-captu.patch
+drm-i915-fix-up-locking-around-dumping-requests-list.patch
+drm-i915-adlp-fix-typo-for-reference-clock.patch
+net-tls-tls_is_tx_ready-checked-list_entry.patch
+alsa-firewire-motu-fix-unreleased-lock-warning-in-hw.patch
+netfilter-br_netfilter-disable-sabotage_in-hook-afte.patch
+block-ublk-extending-queue_size-to-fix-overflow.patch
+kunit-fix-kunit_test_init_section_suites.patch
+squashfs-harden-sanity-check-in-squashfs_read_xattr_.patch
+maple_tree-should-get-pivots-boundary-by-type.patch
+sctp-do-not-check-hb_timer.expires-when-resetting-hb.patch
+net-phy-meson-gxl-add-generic-dummy-stubs-for-mmd-re.patch
+drm-panel-boe-tv101wum-nl6-ensure-dsi-writes-succeed.patch
+ip-ip6_gre-fix-changing-addr-gen-mode-not-generating.patch
+ip-ip6_gre-fix-non-point-to-point-tunnel-not-generat.patch
+riscv-kprobe-fixup-kernel-panic-when-probing-an-ille.patch
+igc-return-an-error-if-the-mac-type-is-unknown-in-ig.patch
+octeontx2-af-fix-devlink-unregister.patch
+can-j1939-fix-errant-warn_on_once-in-j1939_session_d.patch
+can-raw-fix-can-fd-frame-transmissions-over-can-xl-d.patch
+can-mcp251xfd-mcp251xfd_ring_set_ringparam-assign-mi.patch
+ata-libata-fix-sata_down_spd_limit-when-no-link-spee.patch
+selftests-net-udpgso_bench_rx-fix-used-uninitialized.patch
+selftests-net-udpgso_bench_rx-tx-stop-when-wrong-cli.patch
+selftests-net-udpgso_bench-fix-racing-bug-between-th.patch
+selftests-net-udpgso_bench_tx-cater-for-pending-data.patch
+virtio-net-keep-stop-to-follow-mirror-sequence-of-op.patch
+net-openvswitch-fix-flow-memory-leak-in-ovs_flow_cmd.patch
+efi-fix-potential-null-deref-in-efi_mem_reserve_pers.patch
+rtc-sunplus-fix-format-string-for-printing-resource.patch
+certs-fix-build-error-when-pkcs-11-uri-contains-semi.patch
+kbuild-modinst-fix-build-error-when-config_module_si.patch
+i2c-designware-pci-add-new-pci-ids-for-amd-navi-gpu.patch
+i2c-mxs-suppress-probe-deferral-error-message.patch
+scsi-target-core-fix-warning-on-rt-kernels.patch
+x86-aperfmperf-erase-stale-arch_freq_scale-values-wh.patch
+perf-x86-intel-add-emerald-rapids.patch
+perf-x86-intel-cstate-add-emerald-rapids.patch
+scsi-iscsi_tcp-fix-uaf-during-logout-when-accessing-.patch
+scsi-iscsi_tcp-fix-uaf-during-login-when-accessing-t.patch
+i2c-rk3x-fix-a-bunch-of-kernel-doc-warnings.patch
+revert-gfs2-stop-using-generic_writepages-in-gfs2_ai.patch
+x86-build-move-mindirect-branch-cs-prefix-out-of-gcc.patch
+platform-x86-dell-wmi-add-a-keymap-for-key_mute-in-t.patch
+platform-x86-hp-wmi-handle-omen-key-event.patch
+platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch
+platform-x86-amd-pmc-disable-irq1-wakeup-for-rn-czn.patch
+net-x25-fix-to-not-accept-on-connected-socket.patch
+drm-amd-display-fix-timing-not-changning-when-freesy.patch
+bcache-silence-memcpy-run-time-false-positive-warnin.patch
--- /dev/null
+From 2acb1140dd8a6d81d7b2434aac8b1d0027754604 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 15:35:13 +0100
+Subject: sfc: correctly advertise tunneled IPv6 segmentation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Íñigo Huguet <ihuguet@redhat.com>
+
+[ Upstream commit ffffd2454a7a1bc9f7242b12c4cc0b05c12692b4 ]
+
+Recent sfc NICs are TSO capable for some tunnel protocols. However, it
+was not working properly because the feature was not advertised in
+hw_enc_features, but in hw_features only.
+
+Setting up a GENEVE tunnel and using iperf3 to send IPv4 and IPv6 traffic
+to the tunnel show, with tcpdump, that the IPv4 packets still had ~64k
+size but the IPv6 ones had only ~1500 bytes (they had been segmented by
+software, not offloaded). With this patch segmentation is offloaded as
+expected and the traffic is correctly received at the other end.
+
+Fixes: 24b2c3751aa3 ("sfc: advertise encapsulated offloads on EF10")
+Reported-by: Tianhao Zhao <tizhao@redhat.com>
+Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
+Acked-by: Martin Habets <habetsm.xilinx@gmail.com>
+Link: https://lore.kernel.org/r/20230125143513.25841-1-ihuguet@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/efx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
+index 0556542d7a6b..3a86f1213a05 100644
+--- a/drivers/net/ethernet/sfc/efx.c
++++ b/drivers/net/ethernet/sfc/efx.c
+@@ -1003,8 +1003,11 @@ static int efx_pci_probe_post_io(struct efx_nic *efx)
+ /* Determine netdevice features */
+ net_dev->features |= (efx->type->offload_features | NETIF_F_SG |
+ NETIF_F_TSO | NETIF_F_RXCSUM | NETIF_F_RXALL);
+- if (efx->type->offload_features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM))
++ if (efx->type->offload_features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM)) {
+ net_dev->features |= NETIF_F_TSO6;
++ if (efx_has_cap(efx, TX_TSO_V2_ENCAP))
++ net_dev->hw_enc_features |= NETIF_F_TSO6;
++ }
+ /* Check whether device supports TSO */
+ if (!efx->type->tso_versions || !efx->type->tso_versions(efx))
+ net_dev->features &= ~NETIF_F_ALL_TSO;
+--
+2.39.0
+
--- /dev/null
+From 92eb647db502bb1cc1cf45ab6172793cfe270067 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 11:06:59 -0800
+Subject: skb: Do mix page pool and page referenced frags in GRO
+
+From: Alexander Duyck <alexanderduyck@fb.com>
+
+[ Upstream commit 7d2c89b325874a35564db5630a459966afab04cc ]
+
+GSO should not merge page pool recycled frames with standard reference
+counted frames. Traditionally this didn't occur, at least not often.
+However as we start looking at adding support for wireless adapters there
+becomes the potential to mix the two due to A-MSDU repartitioning frames in
+the receive path. There are possibly other places where this may have
+occurred however I suspect they must be few and far between as we have not
+seen this issue until now.
+
+Fixes: 53e0961da1c7 ("page_pool: add frag page recycling support in page pool")
+Reported-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Alexander Duyck <alexanderduyck@fb.com>
+Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/167475990764.1934330.11960904198087757911.stgit@localhost.localdomain
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/gro.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/net/core/gro.c b/net/core/gro.c
+index 1b4abfb9a7a1..352f966cb1da 100644
+--- a/net/core/gro.c
++++ b/net/core/gro.c
+@@ -162,6 +162,15 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
+ struct sk_buff *lp;
+ int segs;
+
++ /* Do not splice page pool based packets w/ non-page pool
++ * packets. This can result in reference count issues as page
++ * pool pages will not decrement the reference count and will
++ * instead be immediately returned to the pool or have frag
++ * count decremented.
++ */
++ if (p->pp_recycle != skb->pp_recycle)
++ return -ETOOMANYREFS;
++
+ /* pairs with WRITE_ONCE() in netif_set_gro_max_size() */
+ gro_max_size = READ_ONCE(p->dev->gro_max_size);
+
+--
+2.39.0
+
--- /dev/null
+From 32066f52db63f47e43b93bcb663882a7e9a5ef4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 13:52:26 +0300
+Subject: squashfs: harden sanity check in squashfs_read_xattr_id_table
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 72e544b1b28325fe78a4687b980871a7e4101f76 ]
+
+While mounting a corrupted filesystem, a signed integer '*xattr_ids' can
+become less than zero. This leads to the incorrect computation of 'len'
+and 'indexes' values which can cause null-ptr-deref in copy_bio_to_actor()
+or out-of-bounds accesses in the next sanity checks inside
+squashfs_read_xattr_id_table().
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Link: https://lkml.kernel.org/r/20230117105226.329303-2-pchelkin@ispras.ru
+Fixes: 506220d2ba21 ("squashfs: add more sanity checks in xattr id lookup")
+Reported-by: <syzbot+082fa4af80a5bb1a9843@syzkaller.appspotmail.com>
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Cc: Phillip Lougher <phillip@squashfs.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/squashfs/xattr_id.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/squashfs/xattr_id.c b/fs/squashfs/xattr_id.c
+index 087cab8c78f4..f6d78cbc3e74 100644
+--- a/fs/squashfs/xattr_id.c
++++ b/fs/squashfs/xattr_id.c
+@@ -76,7 +76,7 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,
+ /* Sanity check values */
+
+ /* there is always at least one xattr id */
+- if (*xattr_ids == 0)
++ if (*xattr_ids <= 0)
+ return ERR_PTR(-EINVAL);
+
+ len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);
+--
+2.39.0
+
--- /dev/null
+From f656e023949336b0f70921c14f9a12548fe8a59a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Sep 2022 20:25:47 -0400
+Subject: use less confusing names for iov_iter direction initializers
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit de4eda9de2d957ef2d6a8365a01e26a435e958cb ]
+
+READ/WRITE proved to be actively confusing - the meanings are
+"data destination, as used with read(2)" and "data source, as
+used with write(2)", but people keep interpreting those as
+"we read data from it" and "we write data to it", i.e. exactly
+the wrong way.
+
+Call them ITER_DEST and ITER_SOURCE - at least that is harder
+to misinterpret...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/crash_dump.c | 2 +-
+ arch/s390/mm/maccess.c | 2 +-
+ arch/x86/kernel/cpu/microcode/intel.c | 2 +-
+ arch/x86/kernel/crash_dump_64.c | 2 +-
+ crypto/testmgr.c | 4 ++--
+ drivers/acpi/pfr_update.c | 2 +-
+ drivers/block/drbd/drbd_main.c | 2 +-
+ drivers/block/drbd/drbd_receiver.c | 2 +-
+ drivers/block/loop.c | 12 ++++++------
+ drivers/block/nbd.c | 10 +++++-----
+ drivers/char/random.c | 4 ++--
+ drivers/fsi/fsi-sbefifo.c | 6 +++---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +-
+ drivers/isdn/mISDN/l1oip_core.c | 2 +-
+ drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +++---
+ drivers/net/ppp/ppp_generic.c | 2 +-
+ drivers/nvme/host/tcp.c | 4 ++--
+ drivers/nvme/target/io-cmd-file.c | 4 ++--
+ drivers/nvme/target/tcp.c | 2 +-
+ drivers/s390/char/zcore.c | 2 +-
+ drivers/scsi/sg.c | 2 +-
+ drivers/target/iscsi/iscsi_target_util.c | 4 ++--
+ drivers/target/target_core_file.c | 2 +-
+ drivers/usb/usbip/usbip_common.c | 2 +-
+ drivers/vhost/net.c | 6 +++---
+ drivers/vhost/scsi.c | 10 +++++-----
+ drivers/vhost/vhost.c | 6 +++---
+ drivers/vhost/vringh.c | 4 ++--
+ drivers/vhost/vsock.c | 4 ++--
+ drivers/xen/pvcalls-back.c | 8 ++++----
+ fs/9p/vfs_addr.c | 4 ++--
+ fs/9p/vfs_dir.c | 2 +-
+ fs/9p/xattr.c | 4 ++--
+ fs/afs/cmservice.c | 2 +-
+ fs/afs/dir.c | 2 +-
+ fs/afs/file.c | 4 ++--
+ fs/afs/internal.h | 4 ++--
+ fs/afs/rxrpc.c | 10 +++++-----
+ fs/afs/write.c | 4 ++--
+ fs/aio.c | 4 ++--
+ fs/btrfs/ioctl.c | 4 ++--
+ fs/ceph/addr.c | 4 ++--
+ fs/ceph/file.c | 4 ++--
+ fs/cifs/connect.c | 6 +++---
+ fs/cifs/file.c | 4 ++--
+ fs/cifs/fscache.c | 4 ++--
+ fs/cifs/smb2ops.c | 4 ++--
+ fs/cifs/transport.c | 6 +++---
+ fs/coredump.c | 2 +-
+ fs/erofs/fscache.c | 6 +++---
+ fs/fscache/io.c | 2 +-
+ fs/fuse/ioctl.c | 4 ++--
+ fs/netfs/io.c | 6 +++---
+ fs/nfs/fscache.c | 4 ++--
+ fs/nfsd/vfs.c | 4 ++--
+ fs/ocfs2/cluster/tcp.c | 2 +-
+ fs/orangefs/inode.c | 8 ++++----
+ fs/proc/vmcore.c | 6 +++---
+ fs/read_write.c | 12 ++++++------
+ fs/seq_file.c | 2 +-
+ fs/splice.c | 10 +++++-----
+ include/linux/uio.h | 3 +++
+ io_uring/net.c | 14 +++++++-------
+ io_uring/rw.c | 10 +++++-----
+ kernel/trace/trace_events_user.c | 2 +-
+ mm/madvise.c | 2 +-
+ mm/page_io.c | 4 ++--
+ mm/process_vm_access.c | 2 +-
+ net/9p/client.c | 2 +-
+ net/bluetooth/6lowpan.c | 2 +-
+ net/bluetooth/a2mp.c | 2 +-
+ net/bluetooth/smp.c | 2 +-
+ net/ceph/messenger_v1.c | 4 ++--
+ net/ceph/messenger_v2.c | 14 +++++++-------
+ net/compat.c | 3 ++-
+ net/ipv4/tcp.c | 4 ++--
+ net/netfilter/ipvs/ip_vs_sync.c | 2 +-
+ net/smc/smc_clc.c | 6 +++---
+ net/smc/smc_tx.c | 2 +-
+ net/socket.c | 12 ++++++------
+ net/sunrpc/socklib.c | 6 +++---
+ net/sunrpc/svcsock.c | 4 ++--
+ net/sunrpc/xprtsock.c | 6 +++---
+ net/tipc/topsrv.c | 2 +-
+ net/tls/tls_device.c | 4 ++--
+ net/xfrm/espintcp.c | 2 +-
+ security/keys/keyctl.c | 4 ++--
+ 87 files changed, 195 insertions(+), 191 deletions(-)
+
+diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
+index a19a2763e8d4..c13b1455ec8c 100644
+--- a/arch/s390/kernel/crash_dump.c
++++ b/arch/s390/kernel/crash_dump.c
+@@ -153,7 +153,7 @@ int copy_oldmem_kernel(void *dst, unsigned long src, size_t count)
+
+ kvec.iov_base = dst;
+ kvec.iov_len = count;
+- iov_iter_kvec(&iter, READ, &kvec, 1, count);
++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, count);
+ if (copy_oldmem_iter(&iter, src, count) < count)
+ return -EFAULT;
+ return 0;
+diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c
+index 753b006c8ea5..4824d1cd33d8 100644
+--- a/arch/s390/mm/maccess.c
++++ b/arch/s390/mm/maccess.c
+@@ -128,7 +128,7 @@ int memcpy_real(void *dest, unsigned long src, size_t count)
+
+ kvec.iov_base = dest;
+ kvec.iov_len = count;
+- iov_iter_kvec(&iter, READ, &kvec, 1, count);
++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, count);
+ if (memcpy_real_iter(&iter, src, count) < count)
+ return -EFAULT;
+ return 0;
+diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
+index 048e38ec99e7..1def66118b03 100644
+--- a/arch/x86/kernel/cpu/microcode/intel.c
++++ b/arch/x86/kernel/cpu/microcode/intel.c
+@@ -902,7 +902,7 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device,
+
+ kvec.iov_base = (void *)firmware->data;
+ kvec.iov_len = firmware->size;
+- iov_iter_kvec(&iter, WRITE, &kvec, 1, firmware->size);
++ iov_iter_kvec(&iter, ITER_SOURCE, &kvec, 1, firmware->size);
+ ret = generic_load_microcode(cpu, &iter);
+
+ release_firmware(firmware);
+diff --git a/arch/x86/kernel/crash_dump_64.c b/arch/x86/kernel/crash_dump_64.c
+index e75bc2f217ff..32d710f7eb84 100644
+--- a/arch/x86/kernel/crash_dump_64.c
++++ b/arch/x86/kernel/crash_dump_64.c
+@@ -57,7 +57,7 @@ ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos)
+ struct kvec kvec = { .iov_base = buf, .iov_len = count };
+ struct iov_iter iter;
+
+- iov_iter_kvec(&iter, READ, &kvec, 1, count);
++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, count);
+
+ return read_from_oldmem(&iter, count, ppos,
+ cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT));
+diff --git a/crypto/testmgr.c b/crypto/testmgr.c
+index bcd059caa1c8..814d2dc87d7e 100644
+--- a/crypto/testmgr.c
++++ b/crypto/testmgr.c
+@@ -766,7 +766,7 @@ static int build_cipher_test_sglists(struct cipher_test_sglists *tsgls,
+ struct iov_iter input;
+ int err;
+
+- iov_iter_kvec(&input, WRITE, inputs, nr_inputs, src_total_len);
++ iov_iter_kvec(&input, ITER_SOURCE, inputs, nr_inputs, src_total_len);
+ err = build_test_sglist(&tsgls->src, cfg->src_divs, alignmask,
+ cfg->inplace_mode != OUT_OF_PLACE ?
+ max(dst_total_len, src_total_len) :
+@@ -1180,7 +1180,7 @@ static int build_hash_sglist(struct test_sglist *tsgl,
+
+ kv.iov_base = (void *)vec->plaintext;
+ kv.iov_len = vec->psize;
+- iov_iter_kvec(&input, WRITE, &kv, 1, vec->psize);
++ iov_iter_kvec(&input, ITER_SOURCE, &kv, 1, vec->psize);
+ return build_test_sglist(tsgl, cfg->src_divs, alignmask, vec->psize,
+ &input, divs);
+ }
+diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c
+index 9d2bdc13253a..98267f163e2b 100644
+--- a/drivers/acpi/pfr_update.c
++++ b/drivers/acpi/pfr_update.c
+@@ -455,7 +455,7 @@ static ssize_t pfru_write(struct file *file, const char __user *buf,
+
+ iov.iov_base = (void __user *)buf;
+ iov.iov_len = len;
+- iov_iter_init(&iter, WRITE, &iov, 1, len);
++ iov_iter_init(&iter, ITER_SOURCE, &iov, 1, len);
+
+ /* map the communication buffer */
+ phy_addr = (phys_addr_t)((buf_info.addr_hi << 32) | buf_info.addr_lo);
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index 677240232684..590d1b50ab5d 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -1816,7 +1816,7 @@ int drbd_send(struct drbd_connection *connection, struct socket *sock,
+
+ /* THINK if (signal_pending) return ... ? */
+
+- iov_iter_kvec(&msg.msg_iter, WRITE, &iov, 1, size);
++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iov, 1, size);
+
+ if (sock == connection->data.socket) {
+ rcu_read_lock();
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index ee69d50ba4fd..54010eac6ca9 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -507,7 +507,7 @@ static int drbd_recv_short(struct socket *sock, void *buf, size_t size, int flag
+ struct msghdr msg = {
+ .msg_flags = (flags ? flags : MSG_WAITALL | MSG_NOSIGNAL)
+ };
+- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, size);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, size);
+ return sock_recvmsg(sock, &msg, msg.msg_flags);
+ }
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index d12d3d171ec4..df628e30bca4 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -243,7 +243,7 @@ static int lo_write_bvec(struct file *file, struct bio_vec *bvec, loff_t *ppos)
+ struct iov_iter i;
+ ssize_t bw;
+
+- iov_iter_bvec(&i, WRITE, bvec, 1, bvec->bv_len);
++ iov_iter_bvec(&i, ITER_SOURCE, bvec, 1, bvec->bv_len);
+
+ file_start_write(file);
+ bw = vfs_iter_write(file, &i, ppos, 0);
+@@ -286,7 +286,7 @@ static int lo_read_simple(struct loop_device *lo, struct request *rq,
+ ssize_t len;
+
+ rq_for_each_segment(bvec, rq, iter) {
+- iov_iter_bvec(&i, READ, &bvec, 1, bvec.bv_len);
++ iov_iter_bvec(&i, ITER_DEST, &bvec, 1, bvec.bv_len);
+ len = vfs_iter_read(lo->lo_backing_file, &i, &pos, 0);
+ if (len < 0)
+ return len;
+@@ -392,7 +392,7 @@ static void lo_rw_aio_complete(struct kiocb *iocb, long ret)
+ }
+
+ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
+- loff_t pos, bool rw)
++ loff_t pos, int rw)
+ {
+ struct iov_iter iter;
+ struct req_iterator rq_iter;
+@@ -448,7 +448,7 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
+ cmd->iocb.ki_flags = IOCB_DIRECT;
+ cmd->iocb.ki_ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_NONE, 0);
+
+- if (rw == WRITE)
++ if (rw == ITER_SOURCE)
+ ret = call_write_iter(file, &cmd->iocb, &iter);
+ else
+ ret = call_read_iter(file, &cmd->iocb, &iter);
+@@ -490,12 +490,12 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq)
+ return lo_fallocate(lo, rq, pos, FALLOC_FL_PUNCH_HOLE);
+ case REQ_OP_WRITE:
+ if (cmd->use_aio)
+- return lo_rw_aio(lo, cmd, pos, WRITE);
++ return lo_rw_aio(lo, cmd, pos, ITER_SOURCE);
+ else
+ return lo_write_simple(lo, rq, pos);
+ case REQ_OP_READ:
+ if (cmd->use_aio)
+- return lo_rw_aio(lo, cmd, pos, READ);
++ return lo_rw_aio(lo, cmd, pos, ITER_DEST);
+ else
+ return lo_read_simple(lo, rq, pos);
+ default:
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 5cffd96ef2d7..e379ccc63c52 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -563,7 +563,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
+ u32 nbd_cmd_flags = 0;
+ int sent = nsock->sent, skip = 0;
+
+- iov_iter_kvec(&from, WRITE, &iov, 1, sizeof(request));
++ iov_iter_kvec(&from, ITER_SOURCE, &iov, 1, sizeof(request));
+
+ type = req_to_nbd_cmd_type(req);
+ if (type == U32_MAX)
+@@ -649,7 +649,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
+
+ dev_dbg(nbd_to_dev(nbd), "request %p: sending %d bytes data\n",
+ req, bvec.bv_len);
+- iov_iter_bvec(&from, WRITE, &bvec, 1, bvec.bv_len);
++ iov_iter_bvec(&from, ITER_SOURCE, &bvec, 1, bvec.bv_len);
+ if (skip) {
+ if (skip >= iov_iter_count(&from)) {
+ skip -= iov_iter_count(&from);
+@@ -701,7 +701,7 @@ static int nbd_read_reply(struct nbd_device *nbd, int index,
+ int result;
+
+ reply->magic = 0;
+- iov_iter_kvec(&to, READ, &iov, 1, sizeof(*reply));
++ iov_iter_kvec(&to, ITER_DEST, &iov, 1, sizeof(*reply));
+ result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL);
+ if (result < 0) {
+ if (!nbd_disconnected(nbd->config))
+@@ -790,7 +790,7 @@ static struct nbd_cmd *nbd_handle_reply(struct nbd_device *nbd, int index,
+ struct iov_iter to;
+
+ rq_for_each_segment(bvec, req, iter) {
+- iov_iter_bvec(&to, READ, &bvec, 1, bvec.bv_len);
++ iov_iter_bvec(&to, ITER_DEST, &bvec, 1, bvec.bv_len);
+ result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL);
+ if (result < 0) {
+ dev_err(disk_to_dev(nbd->disk), "Receive data failed (result %d)\n",
+@@ -1267,7 +1267,7 @@ static void send_disconnects(struct nbd_device *nbd)
+ for (i = 0; i < config->num_connections; i++) {
+ struct nbd_sock *nsock = config->socks[i];
+
+- iov_iter_kvec(&from, WRITE, &iov, 1, sizeof(request));
++ iov_iter_kvec(&from, ITER_SOURCE, &iov, 1, sizeof(request));
+ mutex_lock(&nsock->tx_lock);
+ ret = sock_xmit(nbd, i, 1, &from, 0, NULL);
+ if (ret < 0)
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index f5868dddbb61..5d1c8e1c99b5 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1329,7 +1329,7 @@ SYSCALL_DEFINE3(getrandom, char __user *, ubuf, size_t, len, unsigned int, flags
+ return ret;
+ }
+
+- ret = import_single_range(READ, ubuf, len, &iov, &iter);
++ ret = import_single_range(ITER_DEST, ubuf, len, &iov, &iter);
+ if (unlikely(ret))
+ return ret;
+ return get_random_bytes_user(&iter);
+@@ -1447,7 +1447,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+ return -EINVAL;
+ if (get_user(len, p++))
+ return -EFAULT;
+- ret = import_single_range(WRITE, p, len, &iov, &iter);
++ ret = import_single_range(ITER_SOURCE, p, len, &iov, &iter);
+ if (unlikely(ret))
+ return ret;
+ ret = write_pool_user(&iter);
+diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c
+index efd4942aa043..9912b7a6a4b9 100644
+--- a/drivers/fsi/fsi-sbefifo.c
++++ b/drivers/fsi/fsi-sbefifo.c
+@@ -659,7 +659,7 @@ static void sbefifo_collect_async_ffdc(struct sbefifo *sbefifo)
+ }
+ ffdc_iov.iov_base = ffdc;
+ ffdc_iov.iov_len = SBEFIFO_MAX_FFDC_SIZE;
+- iov_iter_kvec(&ffdc_iter, READ, &ffdc_iov, 1, SBEFIFO_MAX_FFDC_SIZE);
++ iov_iter_kvec(&ffdc_iter, ITER_DEST, &ffdc_iov, 1, SBEFIFO_MAX_FFDC_SIZE);
+ cmd[0] = cpu_to_be32(2);
+ cmd[1] = cpu_to_be32(SBEFIFO_CMD_GET_SBE_FFDC);
+ rc = sbefifo_do_command(sbefifo, cmd, 2, &ffdc_iter);
+@@ -756,7 +756,7 @@ int sbefifo_submit(struct device *dev, const __be32 *command, size_t cmd_len,
+ rbytes = (*resp_len) * sizeof(__be32);
+ resp_iov.iov_base = response;
+ resp_iov.iov_len = rbytes;
+- iov_iter_kvec(&resp_iter, READ, &resp_iov, 1, rbytes);
++ iov_iter_kvec(&resp_iter, ITER_DEST, &resp_iov, 1, rbytes);
+
+ /* Perform the command */
+ rc = mutex_lock_interruptible(&sbefifo->lock);
+@@ -839,7 +839,7 @@ static ssize_t sbefifo_user_read(struct file *file, char __user *buf,
+ /* Prepare iov iterator */
+ resp_iov.iov_base = buf;
+ resp_iov.iov_len = len;
+- iov_iter_init(&resp_iter, READ, &resp_iov, 1, len);
++ iov_iter_init(&resp_iter, ITER_DEST, &resp_iov, 1, len);
+
+ /* Perform the command */
+ rc = mutex_lock_interruptible(&sbefifo->lock);
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 88282b288abd..730f2f1e09bb 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -966,7 +966,7 @@ static void rtrs_clt_init_req(struct rtrs_clt_io_req *req,
+ refcount_set(&req->ref, 1);
+ req->mp_policy = clt_path->clt->mp_policy;
+
+- iov_iter_kvec(&iter, WRITE, vec, 1, usr_len);
++ iov_iter_kvec(&iter, ITER_SOURCE, vec, 1, usr_len);
+ len = _copy_from_iter(req->iu->buf, usr_len, &iter);
+ WARN_ON(len != usr_len);
+
+diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c
+index a77195e378b7..c24771336f61 100644
+--- a/drivers/isdn/mISDN/l1oip_core.c
++++ b/drivers/isdn/mISDN/l1oip_core.c
+@@ -706,7 +706,7 @@ l1oip_socket_thread(void *data)
+ printk(KERN_DEBUG "%s: socket created and open\n",
+ __func__);
+ while (!signal_pending(current)) {
+- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, recvbuf_size);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, recvbuf_size);
+ recvlen = sock_recvmsg(socket, &msg, 0);
+ if (recvlen > 0) {
+ l1oip_socket_parse(hc, &sin_rx, recvbuf, recvlen);
+diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+index 844264e1b88c..73d71c4ec139 100644
+--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+@@ -3044,7 +3044,7 @@ ssize_t vmci_qpair_enqueue(struct vmci_qp *qpair,
+ if (!qpair || !buf)
+ return VMCI_ERROR_INVALID_ARGS;
+
+- iov_iter_kvec(&from, WRITE, &v, 1, buf_size);
++ iov_iter_kvec(&from, ITER_SOURCE, &v, 1, buf_size);
+
+ qp_lock(qpair);
+
+@@ -3088,7 +3088,7 @@ ssize_t vmci_qpair_dequeue(struct vmci_qp *qpair,
+ if (!qpair || !buf)
+ return VMCI_ERROR_INVALID_ARGS;
+
+- iov_iter_kvec(&to, READ, &v, 1, buf_size);
++ iov_iter_kvec(&to, ITER_DEST, &v, 1, buf_size);
+
+ qp_lock(qpair);
+
+@@ -3133,7 +3133,7 @@ ssize_t vmci_qpair_peek(struct vmci_qp *qpair,
+ if (!qpair || !buf)
+ return VMCI_ERROR_INVALID_ARGS;
+
+- iov_iter_kvec(&to, READ, &v, 1, buf_size);
++ iov_iter_kvec(&to, ITER_DEST, &v, 1, buf_size);
+
+ qp_lock(qpair);
+
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index d4c821c8cf57..1d71f5276241 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -480,7 +480,7 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
+ ret = -EFAULT;
+ iov.iov_base = buf;
+ iov.iov_len = count;
+- iov_iter_init(&to, READ, &iov, 1, count);
++ iov_iter_init(&to, ITER_DEST, &iov, 1, count);
+ if (skb_copy_datagram_iter(skb, 0, &to, skb->len))
+ goto outf;
+ ret = skb->len;
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index eacd445b5333..4c052c261517 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -301,7 +301,7 @@ static inline void nvme_tcp_advance_req(struct nvme_tcp_request *req,
+ if (!iov_iter_count(&req->iter) &&
+ req->data_sent < req->data_len) {
+ req->curr_bio = req->curr_bio->bi_next;
+- nvme_tcp_init_iter(req, WRITE);
++ nvme_tcp_init_iter(req, ITER_SOURCE);
+ }
+ }
+
+@@ -781,7 +781,7 @@ static int nvme_tcp_recv_data(struct nvme_tcp_queue *queue, struct sk_buff *skb,
+ nvme_tcp_init_recv_ctx(queue);
+ return -EIO;
+ }
+- nvme_tcp_init_iter(req, READ);
++ nvme_tcp_init_iter(req, ITER_DEST);
+ }
+
+ /* we can read only from what is left in this bio */
+diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
+index e55ec6fefd7f..871c4f32f443 100644
+--- a/drivers/nvme/target/io-cmd-file.c
++++ b/drivers/nvme/target/io-cmd-file.c
+@@ -92,10 +92,10 @@ static ssize_t nvmet_file_submit_bvec(struct nvmet_req *req, loff_t pos,
+ if (req->cmd->rw.control & cpu_to_le16(NVME_RW_FUA))
+ ki_flags |= IOCB_DSYNC;
+ call_iter = req->ns->file->f_op->write_iter;
+- rw = WRITE;
++ rw = ITER_SOURCE;
+ } else {
+ call_iter = req->ns->file->f_op->read_iter;
+- rw = READ;
++ rw = ITER_DEST;
+ }
+
+ iov_iter_bvec(&iter, rw, req->f.bvec, nr_segs, count);
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index 6c1476e086ef..cc05c094de22 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -331,7 +331,7 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
+ sg_offset = 0;
+ }
+
+- iov_iter_bvec(&cmd->recv_msg.msg_iter, READ, cmd->iov,
++ iov_iter_bvec(&cmd->recv_msg.msg_iter, ITER_DEST, cmd->iov,
+ nr_pages, cmd->pdu_len);
+ }
+
+diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
+index 83ddac1e5838..a41833557d55 100644
+--- a/drivers/s390/char/zcore.c
++++ b/drivers/s390/char/zcore.c
+@@ -103,7 +103,7 @@ static inline int memcpy_hsa_kernel(void *dst, unsigned long src, size_t count)
+
+ kvec.iov_base = dst;
+ kvec.iov_len = count;
+- iov_iter_kvec(&iter, READ, &kvec, 1, count);
++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, count);
+ if (memcpy_hsa_iter(&iter, src, count) < count)
+ return -EIO;
+ return 0;
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index ce34a8ad53b4..12344be14232 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1726,7 +1726,7 @@ sg_start_req(Sg_request *srp, unsigned char *cmd)
+ Sg_scatter_hold *rsv_schp = &sfp->reserve;
+ struct request_queue *q = sfp->parentdp->device->request_queue;
+ struct rq_map_data *md, map_data;
+- int rw = hp->dxfer_direction == SG_DXFER_TO_DEV ? WRITE : READ;
++ int rw = hp->dxfer_direction == SG_DXFER_TO_DEV ? ITER_SOURCE : ITER_DEST;
+ struct scsi_cmnd *scmd;
+
+ SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp,
+diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
+index 8d9f21372b67..26dc8ed3045b 100644
+--- a/drivers/target/iscsi/iscsi_target_util.c
++++ b/drivers/target/iscsi/iscsi_target_util.c
+@@ -1225,7 +1225,7 @@ int rx_data(
+ return -1;
+
+ memset(&msg, 0, sizeof(struct msghdr));
+- iov_iter_kvec(&msg.msg_iter, READ, iov, iov_count, data);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, iov, iov_count, data);
+
+ while (msg_data_left(&msg)) {
+ rx_loop = sock_recvmsg(conn->sock, &msg, MSG_WAITALL);
+@@ -1261,7 +1261,7 @@ int tx_data(
+
+ memset(&msg, 0, sizeof(struct msghdr));
+
+- iov_iter_kvec(&msg.msg_iter, WRITE, iov, iov_count, data);
++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iov, iov_count, data);
+
+ while (msg_data_left(&msg)) {
+ int tx_loop = sock_sendmsg(conn->sock, &msg);
+diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
+index 55935040541b..7e81a53dbf3c 100644
+--- a/drivers/target/target_core_file.c
++++ b/drivers/target/target_core_file.c
+@@ -473,7 +473,7 @@ fd_execute_write_same(struct se_cmd *cmd)
+ len += se_dev->dev_attrib.block_size;
+ }
+
+- iov_iter_bvec(&iter, WRITE, bvec, nolb, len);
++ iov_iter_bvec(&iter, ITER_SOURCE, bvec, nolb, len);
+ ret = vfs_iter_write(fd_dev->fd_file, &iter, &pos, 0);
+
+ kfree(bvec);
+diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
+index 053a2bca4c47..f8b326eed54d 100644
+--- a/drivers/usb/usbip/usbip_common.c
++++ b/drivers/usb/usbip/usbip_common.c
+@@ -309,7 +309,7 @@ int usbip_recv(struct socket *sock, void *buf, int size)
+ if (!sock || !buf || !size)
+ return -EINVAL;
+
+- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, size);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, size);
+
+ usbip_dbg_xmit("enter\n");
+
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index c7e44d818252..4c538b30fd76 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -611,7 +611,7 @@ static size_t init_iov_iter(struct vhost_virtqueue *vq, struct iov_iter *iter,
+ /* Skip header. TODO: support TSO. */
+ size_t len = iov_length(vq->iov, out);
+
+- iov_iter_init(iter, WRITE, vq->iov, out, len);
++ iov_iter_init(iter, ITER_SOURCE, vq->iov, out, len);
+ iov_iter_advance(iter, hdr_size);
+
+ return iov_iter_count(iter);
+@@ -1184,14 +1184,14 @@ static void handle_rx(struct vhost_net *net)
+ msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
+ /* On overrun, truncate and discard */
+ if (unlikely(headcount > UIO_MAXIOV)) {
+- iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
++ iov_iter_init(&msg.msg_iter, ITER_DEST, vq->iov, 1, 1);
+ err = sock->ops->recvmsg(sock, &msg,
+ 1, MSG_DONTWAIT | MSG_TRUNC);
+ pr_debug("Discarded rx packet: len %zd\n", sock_len);
+ continue;
+ }
+ /* We don't need to be notified again. */
+- iov_iter_init(&msg.msg_iter, READ, vq->iov, in, vhost_len);
++ iov_iter_init(&msg.msg_iter, ITER_DEST, vq->iov, in, vhost_len);
+ fixup = msg.msg_iter;
+ if (unlikely((vhost_hlen))) {
+ /* We will supply the header ourselves
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index 7ebf106d50c1..dca6346d75b3 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -563,7 +563,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
+ memcpy(v_rsp.sense, cmd->tvc_sense_buf,
+ se_cmd->scsi_sense_length);
+
+- iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov,
++ iov_iter_init(&iov_iter, ITER_DEST, &cmd->tvc_resp_iov,
+ cmd->tvc_in_iovs, sizeof(v_rsp));
+ ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter);
+ if (likely(ret == sizeof(v_rsp))) {
+@@ -864,7 +864,7 @@ vhost_scsi_get_desc(struct vhost_scsi *vs, struct vhost_virtqueue *vq,
+ * point at the start of the outgoing WRITE payload, if
+ * DMA_TO_DEVICE is set.
+ */
+- iov_iter_init(&vc->out_iter, WRITE, vq->iov, vc->out, vc->out_size);
++ iov_iter_init(&vc->out_iter, ITER_SOURCE, vq->iov, vc->out, vc->out_size);
+ ret = 0;
+
+ done:
+@@ -1016,7 +1016,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
+ data_direction = DMA_FROM_DEVICE;
+ exp_data_len = vc.in_size - vc.rsp_size;
+
+- iov_iter_init(&in_iter, READ, &vq->iov[vc.out], vc.in,
++ iov_iter_init(&in_iter, ITER_DEST, &vq->iov[vc.out], vc.in,
+ vc.rsp_size + exp_data_len);
+ iov_iter_advance(&in_iter, vc.rsp_size);
+ data_iter = in_iter;
+@@ -1146,7 +1146,7 @@ vhost_scsi_send_tmf_resp(struct vhost_scsi *vs, struct vhost_virtqueue *vq,
+ memset(&rsp, 0, sizeof(rsp));
+ rsp.response = tmf_resp_code;
+
+- iov_iter_init(&iov_iter, READ, resp_iov, in_iovs, sizeof(rsp));
++ iov_iter_init(&iov_iter, ITER_DEST, resp_iov, in_iovs, sizeof(rsp));
+
+ ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);
+ if (likely(ret == sizeof(rsp)))
+@@ -1238,7 +1238,7 @@ vhost_scsi_send_an_resp(struct vhost_scsi *vs,
+ memset(&rsp, 0, sizeof(rsp)); /* event_actual = 0 */
+ rsp.response = VIRTIO_SCSI_S_OK;
+
+- iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp));
++ iov_iter_init(&iov_iter, ITER_DEST, &vq->iov[vc->out], vc->in, sizeof(rsp));
+
+ ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);
+ if (likely(ret == sizeof(rsp)))
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index c234869d6727..43c9770b86e5 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -833,7 +833,7 @@ static int vhost_copy_to_user(struct vhost_virtqueue *vq, void __user *to,
+ VHOST_ACCESS_WO);
+ if (ret < 0)
+ goto out;
+- iov_iter_init(&t, READ, vq->iotlb_iov, ret, size);
++ iov_iter_init(&t, ITER_DEST, vq->iotlb_iov, ret, size);
+ ret = copy_to_iter(from, size, &t);
+ if (ret == size)
+ ret = 0;
+@@ -872,7 +872,7 @@ static int vhost_copy_from_user(struct vhost_virtqueue *vq, void *to,
+ (unsigned long long) size);
+ goto out;
+ }
+- iov_iter_init(&f, WRITE, vq->iotlb_iov, ret, size);
++ iov_iter_init(&f, ITER_SOURCE, vq->iotlb_iov, ret, size);
+ ret = copy_from_iter(to, size, &f);
+ if (ret == size)
+ ret = 0;
+@@ -2136,7 +2136,7 @@ static int get_indirect(struct vhost_virtqueue *vq,
+ vq_err(vq, "Translation failure %d in indirect.\n", ret);
+ return ret;
+ }
+- iov_iter_init(&from, WRITE, vq->indirect, ret, len);
++ iov_iter_init(&from, ITER_SOURCE, vq->indirect, ret, len);
+ count = len / sizeof desc;
+ /* Buffers are chained via a 16 bit next field, so
+ * we can have at most 2^16 of these. */
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index 139c782848c6..33eb941fcf15 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -1161,7 +1161,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
+ else if (ret < 0)
+ return ret;
+
+- iov_iter_bvec(&iter, WRITE, iov, ret, translated);
++ iov_iter_bvec(&iter, ITER_SOURCE, iov, ret, translated);
+
+ ret = copy_from_iter(dst, translated, &iter);
+ if (ret < 0)
+@@ -1194,7 +1194,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
+ else if (ret < 0)
+ return ret;
+
+- iov_iter_bvec(&iter, READ, iov, ret, translated);
++ iov_iter_bvec(&iter, ITER_DEST, iov, ret, translated);
+
+ ret = copy_to_iter(src, translated, &iter);
+ if (ret < 0)
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index 10a7d23731fe..a2b374372363 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -165,7 +165,7 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
+ break;
+ }
+
+- iov_iter_init(&iov_iter, READ, &vq->iov[out], in, iov_len);
++ iov_iter_init(&iov_iter, ITER_DEST, &vq->iov[out], in, iov_len);
+ payload_len = pkt->len - pkt->off;
+
+ /* If the packet is greater than the space available in the
+@@ -371,7 +371,7 @@ vhost_vsock_alloc_pkt(struct vhost_virtqueue *vq,
+ return NULL;
+
+ len = iov_length(vq->iov, out);
+- iov_iter_init(&iov_iter, WRITE, vq->iov, out, len);
++ iov_iter_init(&iov_iter, ITER_SOURCE, vq->iov, out, len);
+
+ nbytes = copy_from_iter(&pkt->hdr, sizeof(pkt->hdr), &iov_iter);
+ if (nbytes != sizeof(pkt->hdr)) {
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index 21b9c850a382..28b2a1fa25ab 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -129,13 +129,13 @@ static bool pvcalls_conn_back_read(void *opaque)
+ if (masked_prod < masked_cons) {
+ vec[0].iov_base = data->in + masked_prod;
+ vec[0].iov_len = wanted;
+- iov_iter_kvec(&msg.msg_iter, READ, vec, 1, wanted);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, vec, 1, wanted);
+ } else {
+ vec[0].iov_base = data->in + masked_prod;
+ vec[0].iov_len = array_size - masked_prod;
+ vec[1].iov_base = data->in;
+ vec[1].iov_len = wanted - vec[0].iov_len;
+- iov_iter_kvec(&msg.msg_iter, READ, vec, 2, wanted);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, vec, 2, wanted);
+ }
+
+ atomic_set(&map->read, 0);
+@@ -188,13 +188,13 @@ static bool pvcalls_conn_back_write(struct sock_mapping *map)
+ if (pvcalls_mask(prod, array_size) > pvcalls_mask(cons, array_size)) {
+ vec[0].iov_base = data->out + pvcalls_mask(cons, array_size);
+ vec[0].iov_len = size;
+- iov_iter_kvec(&msg.msg_iter, WRITE, vec, 1, size);
++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, vec, 1, size);
+ } else {
+ vec[0].iov_base = data->out + pvcalls_mask(cons, array_size);
+ vec[0].iov_len = array_size - pvcalls_mask(cons, array_size);
+ vec[1].iov_base = data->out;
+ vec[1].iov_len = size - vec[0].iov_len;
+- iov_iter_kvec(&msg.msg_iter, WRITE, vec, 2, size);
++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, vec, 2, size);
+ }
+
+ atomic_set(&map->write, 0);
+diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
+index 47b9a1122f34..a19891015f19 100644
+--- a/fs/9p/vfs_addr.c
++++ b/fs/9p/vfs_addr.c
+@@ -40,7 +40,7 @@ static void v9fs_issue_read(struct netfs_io_subrequest *subreq)
+ size_t len = subreq->len - subreq->transferred;
+ int total, err;
+
+- iov_iter_xarray(&to, READ, &rreq->mapping->i_pages, pos, len);
++ iov_iter_xarray(&to, ITER_DEST, &rreq->mapping->i_pages, pos, len);
+
+ total = p9_client_read(fid, pos, &to, &err);
+
+@@ -172,7 +172,7 @@ static int v9fs_vfs_write_folio_locked(struct folio *folio)
+
+ len = min_t(loff_t, i_size - start, len);
+
+- iov_iter_xarray(&from, WRITE, &folio_mapping(folio)->i_pages, start, len);
++ iov_iter_xarray(&from, ITER_SOURCE, &folio_mapping(folio)->i_pages, start, len);
+
+ /* We should have writeback_fid always set */
+ BUG_ON(!v9inode->writeback_fid);
+diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
+index 000fbaae9b18..3bb95adc9619 100644
+--- a/fs/9p/vfs_dir.c
++++ b/fs/9p/vfs_dir.c
+@@ -109,7 +109,7 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
+ struct iov_iter to;
+ int n;
+
+- iov_iter_kvec(&to, READ, &kvec, 1, buflen);
++ iov_iter_kvec(&to, ITER_DEST, &kvec, 1, buflen);
+ n = p9_client_read(file->private_data, ctx->pos, &to,
+ &err);
+ if (err)
+diff --git a/fs/9p/xattr.c b/fs/9p/xattr.c
+index 1f9298a4bd42..2807bb63f780 100644
+--- a/fs/9p/xattr.c
++++ b/fs/9p/xattr.c
+@@ -24,7 +24,7 @@ ssize_t v9fs_fid_xattr_get(struct p9_fid *fid, const char *name,
+ struct iov_iter to;
+ int err;
+
+- iov_iter_kvec(&to, READ, &kvec, 1, buffer_size);
++ iov_iter_kvec(&to, ITER_DEST, &kvec, 1, buffer_size);
+
+ attr_fid = p9_client_xattrwalk(fid, name, &attr_size);
+ if (IS_ERR(attr_fid)) {
+@@ -109,7 +109,7 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name,
+ struct iov_iter from;
+ int retval, err;
+
+- iov_iter_kvec(&from, WRITE, &kvec, 1, value_len);
++ iov_iter_kvec(&from, ITER_SOURCE, &kvec, 1, value_len);
+
+ p9_debug(P9_DEBUG_VFS, "name = %s value_len = %zu flags = %d\n",
+ name, value_len, flags);
+diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
+index 0a090d614e76..7dcd59693a0c 100644
+--- a/fs/afs/cmservice.c
++++ b/fs/afs/cmservice.c
+@@ -298,7 +298,7 @@ static int afs_deliver_cb_callback(struct afs_call *call)
+ if (call->count2 != call->count && call->count2 != 0)
+ return afs_protocol_error(call, afs_eproto_cb_count);
+ call->iter = &call->def_iter;
+- iov_iter_discard(&call->def_iter, READ, call->count2 * 3 * 4);
++ iov_iter_discard(&call->def_iter, ITER_DEST, call->count2 * 3 * 4);
+ call->unmarshall++;
+
+ fallthrough;
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index 230c2d19116d..104df2964225 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -305,7 +305,7 @@ static struct afs_read *afs_read_dir(struct afs_vnode *dvnode, struct key *key)
+ req->actual_len = i_size; /* May change */
+ req->len = nr_pages * PAGE_SIZE; /* We can ask for more than there is */
+ req->data_version = dvnode->status.data_version; /* May change */
+- iov_iter_xarray(&req->def_iter, READ, &dvnode->netfs.inode.i_mapping->i_pages,
++ iov_iter_xarray(&req->def_iter, ITER_DEST, &dvnode->netfs.inode.i_mapping->i_pages,
+ 0, i_size);
+ req->iter = &req->def_iter;
+
+diff --git a/fs/afs/file.c b/fs/afs/file.c
+index d1cfb235c4b9..2eeab57df133 100644
+--- a/fs/afs/file.c
++++ b/fs/afs/file.c
+@@ -324,7 +324,7 @@ static void afs_issue_read(struct netfs_io_subrequest *subreq)
+ fsreq->vnode = vnode;
+ fsreq->iter = &fsreq->def_iter;
+
+- iov_iter_xarray(&fsreq->def_iter, READ,
++ iov_iter_xarray(&fsreq->def_iter, ITER_DEST,
+ &fsreq->vnode->netfs.inode.i_mapping->i_pages,
+ fsreq->pos, fsreq->len);
+
+@@ -346,7 +346,7 @@ static int afs_symlink_read_folio(struct file *file, struct folio *folio)
+ fsreq->len = folio_size(folio);
+ fsreq->vnode = vnode;
+ fsreq->iter = &fsreq->def_iter;
+- iov_iter_xarray(&fsreq->def_iter, READ, &folio->mapping->i_pages,
++ iov_iter_xarray(&fsreq->def_iter, ITER_DEST, &folio->mapping->i_pages,
+ fsreq->pos, fsreq->len);
+
+ ret = afs_fetch_data(fsreq->vnode, fsreq);
+diff --git a/fs/afs/internal.h b/fs/afs/internal.h
+index 723d162078a3..9ba7b68375c9 100644
+--- a/fs/afs/internal.h
++++ b/fs/afs/internal.h
+@@ -1301,7 +1301,7 @@ static inline void afs_extract_begin(struct afs_call *call, void *buf, size_t si
+ call->iov_len = size;
+ call->kvec[0].iov_base = buf;
+ call->kvec[0].iov_len = size;
+- iov_iter_kvec(&call->def_iter, READ, call->kvec, 1, size);
++ iov_iter_kvec(&call->def_iter, ITER_DEST, call->kvec, 1, size);
+ }
+
+ static inline void afs_extract_to_tmp(struct afs_call *call)
+@@ -1319,7 +1319,7 @@ static inline void afs_extract_to_tmp64(struct afs_call *call)
+ static inline void afs_extract_discard(struct afs_call *call, size_t size)
+ {
+ call->iov_len = size;
+- iov_iter_discard(&call->def_iter, READ, size);
++ iov_iter_discard(&call->def_iter, ITER_DEST, size);
+ }
+
+ static inline void afs_extract_to_buf(struct afs_call *call, size_t size)
+diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
+index eccc3cd0cb70..c62939e5ea1f 100644
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -359,7 +359,7 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp)
+
+ msg.msg_name = NULL;
+ msg.msg_namelen = 0;
+- iov_iter_kvec(&msg.msg_iter, WRITE, iov, 1, call->request_size);
++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iov, 1, call->request_size);
+ msg.msg_control = NULL;
+ msg.msg_controllen = 0;
+ msg.msg_flags = MSG_WAITALL | (call->write_iter ? MSG_MORE : 0);
+@@ -400,7 +400,7 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp)
+ RX_USER_ABORT, ret, "KSD");
+ } else {
+ len = 0;
+- iov_iter_kvec(&msg.msg_iter, READ, NULL, 0, 0);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, NULL, 0, 0);
+ rxrpc_kernel_recv_data(call->net->socket, rxcall,
+ &msg.msg_iter, &len, false,
+ &call->abort_code, &call->service_id);
+@@ -485,7 +485,7 @@ static void afs_deliver_to_call(struct afs_call *call)
+ ) {
+ if (state == AFS_CALL_SV_AWAIT_ACK) {
+ len = 0;
+- iov_iter_kvec(&call->def_iter, READ, NULL, 0, 0);
++ iov_iter_kvec(&call->def_iter, ITER_DEST, NULL, 0, 0);
+ ret = rxrpc_kernel_recv_data(call->net->socket,
+ call->rxcall, &call->def_iter,
+ &len, false, &remote_abort,
+@@ -822,7 +822,7 @@ void afs_send_empty_reply(struct afs_call *call)
+
+ msg.msg_name = NULL;
+ msg.msg_namelen = 0;
+- iov_iter_kvec(&msg.msg_iter, WRITE, NULL, 0, 0);
++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, NULL, 0, 0);
+ msg.msg_control = NULL;
+ msg.msg_controllen = 0;
+ msg.msg_flags = 0;
+@@ -862,7 +862,7 @@ void afs_send_simple_reply(struct afs_call *call, const void *buf, size_t len)
+ iov[0].iov_len = len;
+ msg.msg_name = NULL;
+ msg.msg_namelen = 0;
+- iov_iter_kvec(&msg.msg_iter, WRITE, iov, 1, len);
++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iov, 1, len);
+ msg.msg_control = NULL;
+ msg.msg_controllen = 0;
+ msg.msg_flags = 0;
+diff --git a/fs/afs/write.c b/fs/afs/write.c
+index 9ebdd36eaf2f..08fd456dde67 100644
+--- a/fs/afs/write.c
++++ b/fs/afs/write.c
+@@ -609,7 +609,7 @@ static ssize_t afs_write_back_from_locked_folio(struct address_space *mapping,
+ */
+ afs_write_to_cache(vnode, start, len, i_size, caching);
+
+- iov_iter_xarray(&iter, WRITE, &mapping->i_pages, start, len);
++ iov_iter_xarray(&iter, ITER_SOURCE, &mapping->i_pages, start, len);
+ ret = afs_store_data(vnode, &iter, start, false);
+ } else {
+ _debug("write discard %x @%llx [%llx]", len, start, i_size);
+@@ -1000,7 +1000,7 @@ int afs_launder_folio(struct folio *folio)
+ bv[0].bv_page = &folio->page;
+ bv[0].bv_offset = f;
+ bv[0].bv_len = t - f;
+- iov_iter_bvec(&iter, WRITE, bv, 1, bv[0].bv_len);
++ iov_iter_bvec(&iter, ITER_SOURCE, bv, 1, bv[0].bv_len);
+
+ trace_afs_folio_dirty(vnode, tracepoint_string("launder"), folio);
+ ret = afs_store_data(vnode, &iter, folio_pos(folio) + f, true);
+diff --git a/fs/aio.c b/fs/aio.c
+index 5b2ff20ad322..562916d85cba 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -1552,7 +1552,7 @@ static int aio_read(struct kiocb *req, const struct iocb *iocb,
+ if (unlikely(!file->f_op->read_iter))
+ return -EINVAL;
+
+- ret = aio_setup_rw(READ, iocb, &iovec, vectored, compat, &iter);
++ ret = aio_setup_rw(ITER_DEST, iocb, &iovec, vectored, compat, &iter);
+ if (ret < 0)
+ return ret;
+ ret = rw_verify_area(READ, file, &req->ki_pos, iov_iter_count(&iter));
+@@ -1580,7 +1580,7 @@ static int aio_write(struct kiocb *req, const struct iocb *iocb,
+ if (unlikely(!file->f_op->write_iter))
+ return -EINVAL;
+
+- ret = aio_setup_rw(WRITE, iocb, &iovec, vectored, compat, &iter);
++ ret = aio_setup_rw(ITER_SOURCE, iocb, &iovec, vectored, compat, &iter);
+ if (ret < 0)
+ return ret;
+ ret = rw_verify_area(WRITE, file, &req->ki_pos, iov_iter_count(&iter));
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index fd1902573cde..c05f16a35bca 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -5283,7 +5283,7 @@ static int btrfs_ioctl_encoded_read(struct file *file, void __user *argp,
+ goto out_acct;
+ }
+
+- ret = import_iovec(READ, args.iov, args.iovcnt, ARRAY_SIZE(iovstack),
++ ret = import_iovec(ITER_DEST, args.iov, args.iovcnt, ARRAY_SIZE(iovstack),
+ &iov, &iter);
+ if (ret < 0)
+ goto out_acct;
+@@ -5382,7 +5382,7 @@ static int btrfs_ioctl_encoded_write(struct file *file, void __user *argp, bool
+ if (args.len > args.unencoded_len - args.unencoded_offset)
+ goto out_acct;
+
+- ret = import_iovec(WRITE, args.iov, args.iovcnt, ARRAY_SIZE(iovstack),
++ ret = import_iovec(ITER_SOURCE, args.iov, args.iovcnt, ARRAY_SIZE(iovstack),
+ &iov, &iter);
+ if (ret < 0)
+ goto out_acct;
+diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
+index dcf701b05cc1..61f47debec5a 100644
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -288,7 +288,7 @@ static bool ceph_netfs_issue_op_inline(struct netfs_io_subrequest *subreq)
+ }
+
+ len = min_t(size_t, iinfo->inline_len - subreq->start, subreq->len);
+- iov_iter_xarray(&iter, READ, &rreq->mapping->i_pages, subreq->start, len);
++ iov_iter_xarray(&iter, ITER_DEST, &rreq->mapping->i_pages, subreq->start, len);
+ err = copy_to_iter(iinfo->inline_data + subreq->start, len, &iter);
+ if (err == 0)
+ err = -EFAULT;
+@@ -327,7 +327,7 @@ static void ceph_netfs_issue_read(struct netfs_io_subrequest *subreq)
+ }
+
+ dout("%s: pos=%llu orig_len=%zu len=%llu\n", __func__, subreq->start, subreq->len, len);
+- iov_iter_xarray(&iter, READ, &rreq->mapping->i_pages, subreq->start, len);
++ iov_iter_xarray(&iter, ITER_DEST, &rreq->mapping->i_pages, subreq->start, len);
+ err = iov_iter_get_pages_alloc2(&iter, &pages, len, &page_off);
+ if (err < 0) {
+ dout("%s: iov_ter_get_pages_alloc returned %d\n", __func__, err);
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index 04fd34557de8..6f9580defb2b 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -1161,7 +1161,7 @@ static void ceph_aio_complete_req(struct ceph_osd_request *req)
+ aio_req->total_len = rc + zlen;
+ }
+
+- iov_iter_bvec(&i, READ, osd_data->bvec_pos.bvecs,
++ iov_iter_bvec(&i, ITER_DEST, osd_data->bvec_pos.bvecs,
+ osd_data->num_bvecs, len);
+ iov_iter_advance(&i, rc);
+ iov_iter_zero(zlen, &i);
+@@ -1400,7 +1400,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
+ int zlen = min_t(size_t, len - ret,
+ size - pos - ret);
+
+- iov_iter_bvec(&i, READ, bvecs, num_pages, len);
++ iov_iter_bvec(&i, ITER_DEST, bvecs, num_pages, len);
+ iov_iter_advance(&i, ret);
+ iov_iter_zero(zlen, &i);
+ ret += zlen;
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index eab36e4ea130..384c7c0e1088 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -761,7 +761,7 @@ cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
+ {
+ struct msghdr smb_msg = {};
+ struct kvec iov = {.iov_base = buf, .iov_len = to_read};
+- iov_iter_kvec(&smb_msg.msg_iter, READ, &iov, 1, to_read);
++ iov_iter_kvec(&smb_msg.msg_iter, ITER_DEST, &iov, 1, to_read);
+
+ return cifs_readv_from_socket(server, &smb_msg);
+ }
+@@ -776,7 +776,7 @@ cifs_discard_from_socket(struct TCP_Server_Info *server, size_t to_read)
+ * and cifs_readv_from_socket sets msg_control and msg_controllen
+ * so little to initialize in struct msghdr
+ */
+- iov_iter_discard(&smb_msg.msg_iter, READ, to_read);
++ iov_iter_discard(&smb_msg.msg_iter, ITER_DEST, to_read);
+
+ return cifs_readv_from_socket(server, &smb_msg);
+ }
+@@ -788,7 +788,7 @@ cifs_read_page_from_socket(struct TCP_Server_Info *server, struct page *page,
+ struct msghdr smb_msg = {};
+ struct bio_vec bv = {
+ .bv_page = page, .bv_len = to_read, .bv_offset = page_offset};
+- iov_iter_bvec(&smb_msg.msg_iter, READ, &bv, 1, to_read);
++ iov_iter_bvec(&smb_msg.msg_iter, ITER_DEST, &bv, 1, to_read);
+ return cifs_readv_from_socket(server, &smb_msg);
+ }
+
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index cd9698209930..209dfc06fd6d 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -3532,7 +3532,7 @@ static ssize_t __cifs_writev(
+ ctx->iter = *from;
+ ctx->len = len;
+ } else {
+- rc = setup_aio_ctx_iter(ctx, from, WRITE);
++ rc = setup_aio_ctx_iter(ctx, from, ITER_SOURCE);
+ if (rc) {
+ kref_put(&ctx->refcount, cifs_aio_ctx_release);
+ return rc;
+@@ -4276,7 +4276,7 @@ static ssize_t __cifs_readv(
+ ctx->iter = *to;
+ ctx->len = len;
+ } else {
+- rc = setup_aio_ctx_iter(ctx, to, READ);
++ rc = setup_aio_ctx_iter(ctx, to, ITER_DEST);
+ if (rc) {
+ kref_put(&ctx->refcount, cifs_aio_ctx_release);
+ return rc;
+diff --git a/fs/cifs/fscache.c b/fs/cifs/fscache.c
+index a1751b956318..f6f3a6b75601 100644
+--- a/fs/cifs/fscache.c
++++ b/fs/cifs/fscache.c
+@@ -150,7 +150,7 @@ static int fscache_fallback_read_page(struct inode *inode, struct page *page)
+ bvec[0].bv_page = page;
+ bvec[0].bv_offset = 0;
+ bvec[0].bv_len = PAGE_SIZE;
+- iov_iter_bvec(&iter, READ, bvec, ARRAY_SIZE(bvec), PAGE_SIZE);
++ iov_iter_bvec(&iter, ITER_DEST, bvec, ARRAY_SIZE(bvec), PAGE_SIZE);
+
+ ret = fscache_begin_read_operation(&cres, cookie);
+ if (ret < 0)
+@@ -180,7 +180,7 @@ static int fscache_fallback_write_page(struct inode *inode, struct page *page,
+ bvec[0].bv_page = page;
+ bvec[0].bv_offset = 0;
+ bvec[0].bv_len = PAGE_SIZE;
+- iov_iter_bvec(&iter, WRITE, bvec, ARRAY_SIZE(bvec), PAGE_SIZE);
++ iov_iter_bvec(&iter, ITER_SOURCE, bvec, ARRAY_SIZE(bvec), PAGE_SIZE);
+
+ ret = fscache_begin_write_operation(&cres, cookie);
+ if (ret < 0)
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 1ff5b6b0e07a..78c2d618eb51 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -4737,13 +4737,13 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ return 0;
+ }
+
+- iov_iter_bvec(&iter, WRITE, bvec, npages, data_len);
++ iov_iter_bvec(&iter, ITER_SOURCE, bvec, npages, data_len);
+ } else if (buf_len >= data_offset + data_len) {
+ /* read response payload is in buf */
+ WARN_ONCE(npages > 0, "read data can be either in buf or in pages");
+ iov.iov_base = buf + data_offset;
+ iov.iov_len = data_len;
+- iov_iter_kvec(&iter, WRITE, &iov, 1, data_len);
++ iov_iter_kvec(&iter, ITER_SOURCE, &iov, 1, data_len);
+ } else {
+ /* read response payload cannot be in both buf and pages */
+ WARN_ONCE(1, "buf can not contain only a part of read data");
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 575fa8f58342..3851d0aaa288 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -347,7 +347,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
+ .iov_base = &rfc1002_marker,
+ .iov_len = 4
+ };
+- iov_iter_kvec(&smb_msg.msg_iter, WRITE, &hiov, 1, 4);
++ iov_iter_kvec(&smb_msg.msg_iter, ITER_SOURCE, &hiov, 1, 4);
+ rc = smb_send_kvec(server, &smb_msg, &sent);
+ if (rc < 0)
+ goto unmask;
+@@ -368,7 +368,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
+ size += iov[i].iov_len;
+ }
+
+- iov_iter_kvec(&smb_msg.msg_iter, WRITE, iov, n_vec, size);
++ iov_iter_kvec(&smb_msg.msg_iter, ITER_SOURCE, iov, n_vec, size);
+
+ rc = smb_send_kvec(server, &smb_msg, &sent);
+ if (rc < 0)
+@@ -384,7 +384,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
+ rqst_page_get_length(&rqst[j], i, &bvec.bv_len,
+ &bvec.bv_offset);
+
+- iov_iter_bvec(&smb_msg.msg_iter, WRITE,
++ iov_iter_bvec(&smb_msg.msg_iter, ITER_SOURCE,
+ &bvec, 1, bvec.bv_len);
+ rc = smb_send_kvec(server, &smb_msg, &sent);
+ if (rc < 0)
+diff --git a/fs/coredump.c b/fs/coredump.c
+index 7bad7785e8e6..095ed821c8ac 100644
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -853,7 +853,7 @@ static int dump_emit_page(struct coredump_params *cprm, struct page *page)
+ if (dump_interrupted())
+ return 0;
+ pos = file->f_pos;
+- iov_iter_bvec(&iter, WRITE, &bvec, 1, PAGE_SIZE);
++ iov_iter_bvec(&iter, ITER_SOURCE, &bvec, 1, PAGE_SIZE);
+ n = __kernel_write_iter(cprm->file, &iter, &pos);
+ if (n != PAGE_SIZE)
+ return 0;
+diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c
+index 6a792a513d6b..b04f93bc062a 100644
+--- a/fs/erofs/fscache.c
++++ b/fs/erofs/fscache.c
+@@ -194,7 +194,7 @@ static int erofs_fscache_read_folios_async(struct fscache_cookie *cookie,
+
+ atomic_inc(&rreq->nr_outstanding);
+
+- iov_iter_xarray(&iter, READ, &rreq->mapping->i_pages,
++ iov_iter_xarray(&iter, ITER_DEST, &rreq->mapping->i_pages,
+ start + done, subreq->len);
+
+ ret = fscache_read(cres, subreq->start, &iter,
+@@ -290,7 +290,7 @@ static int erofs_fscache_data_read(struct address_space *mapping,
+ if (IS_ERR(src))
+ return PTR_ERR(src);
+
+- iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, PAGE_SIZE);
++ iov_iter_xarray(&iter, ITER_DEST, &mapping->i_pages, pos, PAGE_SIZE);
+ if (copy_to_iter(src + offset, size, &iter) != size) {
+ erofs_put_metabuf(&buf);
+ return -EFAULT;
+@@ -302,7 +302,7 @@ static int erofs_fscache_data_read(struct address_space *mapping,
+
+ if (!(map.m_flags & EROFS_MAP_MAPPED)) {
+ count = len;
+- iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, count);
++ iov_iter_xarray(&iter, ITER_DEST, &mapping->i_pages, pos, count);
+ iov_iter_zero(count, &iter);
+ return count;
+ }
+diff --git a/fs/fscache/io.c b/fs/fscache/io.c
+index 3af3b08a9bb3..0d2b8dec8f82 100644
+--- a/fs/fscache/io.c
++++ b/fs/fscache/io.c
+@@ -286,7 +286,7 @@ void __fscache_write_to_cache(struct fscache_cookie *cookie,
+ * taken into account.
+ */
+
+- iov_iter_xarray(&iter, WRITE, &mapping->i_pages, start, len);
++ iov_iter_xarray(&iter, ITER_SOURCE, &mapping->i_pages, start, len);
+ fscache_write(cres, start, &iter, fscache_wreq_done, wreq);
+ return;
+
+diff --git a/fs/fuse/ioctl.c b/fs/fuse/ioctl.c
+index 61d8afcb10a3..fcce94ace2c2 100644
+--- a/fs/fuse/ioctl.c
++++ b/fs/fuse/ioctl.c
+@@ -255,7 +255,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
+ ap.args.in_pages = true;
+
+ err = -EFAULT;
+- iov_iter_init(&ii, WRITE, in_iov, in_iovs, in_size);
++ iov_iter_init(&ii, ITER_SOURCE, in_iov, in_iovs, in_size);
+ for (i = 0; iov_iter_count(&ii) && !WARN_ON(i >= ap.num_pages); i++) {
+ c = copy_page_from_iter(ap.pages[i], 0, PAGE_SIZE, &ii);
+ if (c != PAGE_SIZE && iov_iter_count(&ii))
+@@ -324,7 +324,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
+ goto out;
+
+ err = -EFAULT;
+- iov_iter_init(&ii, READ, out_iov, out_iovs, transferred);
++ iov_iter_init(&ii, ITER_DEST, out_iov, out_iovs, transferred);
+ for (i = 0; iov_iter_count(&ii) && !WARN_ON(i >= ap.num_pages); i++) {
+ c = copy_page_to_iter(ap.pages[i], 0, PAGE_SIZE, &ii);
+ if (c != PAGE_SIZE && iov_iter_count(&ii))
+diff --git a/fs/netfs/io.c b/fs/netfs/io.c
+index e374767d1b68..7f753380e047 100644
+--- a/fs/netfs/io.c
++++ b/fs/netfs/io.c
+@@ -23,7 +23,7 @@ static void netfs_clear_unread(struct netfs_io_subrequest *subreq)
+ {
+ struct iov_iter iter;
+
+- iov_iter_xarray(&iter, READ, &subreq->rreq->mapping->i_pages,
++ iov_iter_xarray(&iter, ITER_DEST, &subreq->rreq->mapping->i_pages,
+ subreq->start + subreq->transferred,
+ subreq->len - subreq->transferred);
+ iov_iter_zero(iov_iter_count(&iter), &iter);
+@@ -49,7 +49,7 @@ static void netfs_read_from_cache(struct netfs_io_request *rreq,
+ struct iov_iter iter;
+
+ netfs_stat(&netfs_n_rh_read);
+- iov_iter_xarray(&iter, READ, &rreq->mapping->i_pages,
++ iov_iter_xarray(&iter, ITER_DEST, &rreq->mapping->i_pages,
+ subreq->start + subreq->transferred,
+ subreq->len - subreq->transferred);
+
+@@ -208,7 +208,7 @@ static void netfs_rreq_do_write_to_cache(struct netfs_io_request *rreq)
+ continue;
+ }
+
+- iov_iter_xarray(&iter, WRITE, &rreq->mapping->i_pages,
++ iov_iter_xarray(&iter, ITER_SOURCE, &rreq->mapping->i_pages,
+ subreq->start, subreq->len);
+
+ atomic_inc(&rreq->nr_copy_ops);
+diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
+index e861d7bae305..e731c00a9fcb 100644
+--- a/fs/nfs/fscache.c
++++ b/fs/nfs/fscache.c
+@@ -252,7 +252,7 @@ static int fscache_fallback_read_page(struct inode *inode, struct page *page)
+ bvec[0].bv_page = page;
+ bvec[0].bv_offset = 0;
+ bvec[0].bv_len = PAGE_SIZE;
+- iov_iter_bvec(&iter, READ, bvec, ARRAY_SIZE(bvec), PAGE_SIZE);
++ iov_iter_bvec(&iter, ITER_DEST, bvec, ARRAY_SIZE(bvec), PAGE_SIZE);
+
+ ret = fscache_begin_read_operation(&cres, cookie);
+ if (ret < 0)
+@@ -282,7 +282,7 @@ static int fscache_fallback_write_page(struct inode *inode, struct page *page,
+ bvec[0].bv_page = page;
+ bvec[0].bv_offset = 0;
+ bvec[0].bv_len = PAGE_SIZE;
+- iov_iter_bvec(&iter, WRITE, bvec, ARRAY_SIZE(bvec), PAGE_SIZE);
++ iov_iter_bvec(&iter, ITER_SOURCE, bvec, ARRAY_SIZE(bvec), PAGE_SIZE);
+
+ ret = fscache_begin_write_operation(&cres, cookie);
+ if (ret < 0)
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 2934ab1d9862..0d49c6bb22eb 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -943,7 +943,7 @@ __be32 nfsd_readv(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ ssize_t host_err;
+
+ trace_nfsd_read_vector(rqstp, fhp, offset, *count);
+- iov_iter_kvec(&iter, READ, vec, vlen, *count);
++ iov_iter_kvec(&iter, ITER_DEST, vec, vlen, *count);
+ host_err = vfs_iter_read(file, &iter, &ppos, 0);
+ return nfsd_finish_read(rqstp, fhp, file, offset, count, eof, host_err);
+ }
+@@ -1033,7 +1033,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
+ if (stable && !use_wgather)
+ flags |= RWF_SYNC;
+
+- iov_iter_kvec(&iter, WRITE, vec, vlen, *cnt);
++ iov_iter_kvec(&iter, ITER_SOURCE, vec, vlen, *cnt);
+ since = READ_ONCE(file->f_wb_err);
+ if (verf)
+ nfsd_copy_write_verifier(verf, nn);
+diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
+index f660c0dbdb63..785cabd71d67 100644
+--- a/fs/ocfs2/cluster/tcp.c
++++ b/fs/ocfs2/cluster/tcp.c
+@@ -900,7 +900,7 @@ static int o2net_recv_tcp_msg(struct socket *sock, void *data, size_t len)
+ {
+ struct kvec vec = { .iov_len = len, .iov_base = data, };
+ struct msghdr msg = { .msg_flags = MSG_DONTWAIT, };
+- iov_iter_kvec(&msg.msg_iter, READ, &vec, 1, len);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &vec, 1, len);
+ return sock_recvmsg(sock, &msg, MSG_DONTWAIT);
+ }
+
+diff --git a/fs/orangefs/inode.c b/fs/orangefs/inode.c
+index 7a8c0c6e698d..b3bbb5a5787a 100644
+--- a/fs/orangefs/inode.c
++++ b/fs/orangefs/inode.c
+@@ -53,7 +53,7 @@ static int orangefs_writepage_locked(struct page *page,
+ bv.bv_len = wlen;
+ bv.bv_offset = off % PAGE_SIZE;
+ WARN_ON(wlen == 0);
+- iov_iter_bvec(&iter, WRITE, &bv, 1, wlen);
++ iov_iter_bvec(&iter, ITER_SOURCE, &bv, 1, wlen);
+
+ ret = wait_for_direct_io(ORANGEFS_IO_WRITE, inode, &off, &iter, wlen,
+ len, wr, NULL, NULL);
+@@ -112,7 +112,7 @@ static int orangefs_writepages_work(struct orangefs_writepages *ow,
+ else
+ ow->bv[i].bv_offset = 0;
+ }
+- iov_iter_bvec(&iter, WRITE, ow->bv, ow->npages, ow->len);
++ iov_iter_bvec(&iter, ITER_SOURCE, ow->bv, ow->npages, ow->len);
+
+ WARN_ON(ow->off >= len);
+ if (ow->off + ow->len > len)
+@@ -270,7 +270,7 @@ static void orangefs_readahead(struct readahead_control *rac)
+ offset = readahead_pos(rac);
+ i_pages = &rac->mapping->i_pages;
+
+- iov_iter_xarray(&iter, READ, i_pages, offset, readahead_length(rac));
++ iov_iter_xarray(&iter, ITER_DEST, i_pages, offset, readahead_length(rac));
+
+ /* read in the pages. */
+ if ((ret = wait_for_direct_io(ORANGEFS_IO_READ, inode,
+@@ -303,7 +303,7 @@ static int orangefs_read_folio(struct file *file, struct folio *folio)
+ bv.bv_page = &folio->page;
+ bv.bv_len = folio_size(folio);
+ bv.bv_offset = 0;
+- iov_iter_bvec(&iter, READ, &bv, 1, folio_size(folio));
++ iov_iter_bvec(&iter, ITER_DEST, &bv, 1, folio_size(folio));
+
+ ret = wait_for_direct_io(ORANGEFS_IO_READ, inode, &off, &iter,
+ folio_size(folio), inode->i_size, NULL, NULL, file);
+diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
+index f2aa86c421f2..5aa527ca6dbe 100644
+--- a/fs/proc/vmcore.c
++++ b/fs/proc/vmcore.c
+@@ -199,7 +199,7 @@ ssize_t __weak elfcorehdr_read(char *buf, size_t count, u64 *ppos)
+ struct kvec kvec = { .iov_base = buf, .iov_len = count };
+ struct iov_iter iter;
+
+- iov_iter_kvec(&iter, READ, &kvec, 1, count);
++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, count);
+
+ return read_from_oldmem(&iter, count, ppos, false);
+ }
+@@ -212,7 +212,7 @@ ssize_t __weak elfcorehdr_read_notes(char *buf, size_t count, u64 *ppos)
+ struct kvec kvec = { .iov_base = buf, .iov_len = count };
+ struct iov_iter iter;
+
+- iov_iter_kvec(&iter, READ, &kvec, 1, count);
++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, count);
+
+ return read_from_oldmem(&iter, count, ppos,
+ cc_platform_has(CC_ATTR_MEM_ENCRYPT));
+@@ -437,7 +437,7 @@ static vm_fault_t mmap_vmcore_fault(struct vm_fault *vmf)
+ offset = (loff_t) index << PAGE_SHIFT;
+ kvec.iov_base = page_address(page);
+ kvec.iov_len = PAGE_SIZE;
+- iov_iter_kvec(&iter, READ, &kvec, 1, PAGE_SIZE);
++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, PAGE_SIZE);
+
+ rc = __read_vmcore(&iter, &offset);
+ if (rc < 0) {
+diff --git a/fs/read_write.c b/fs/read_write.c
+index 24b9668d6377..7a2ff6157eda 100644
+--- a/fs/read_write.c
++++ b/fs/read_write.c
+@@ -384,7 +384,7 @@ static ssize_t new_sync_read(struct file *filp, char __user *buf, size_t len, lo
+
+ init_sync_kiocb(&kiocb, filp);
+ kiocb.ki_pos = (ppos ? *ppos : 0);
+- iov_iter_ubuf(&iter, READ, buf, len);
++ iov_iter_ubuf(&iter, ITER_DEST, buf, len);
+
+ ret = call_read_iter(filp, &kiocb, &iter);
+ BUG_ON(ret == -EIOCBQUEUED);
+@@ -424,7 +424,7 @@ ssize_t __kernel_read(struct file *file, void *buf, size_t count, loff_t *pos)
+
+ init_sync_kiocb(&kiocb, file);
+ kiocb.ki_pos = pos ? *pos : 0;
+- iov_iter_kvec(&iter, READ, &iov, 1, iov.iov_len);
++ iov_iter_kvec(&iter, ITER_DEST, &iov, 1, iov.iov_len);
+ ret = file->f_op->read_iter(&kiocb, &iter);
+ if (ret > 0) {
+ if (pos)
+@@ -486,7 +486,7 @@ static ssize_t new_sync_write(struct file *filp, const char __user *buf, size_t
+
+ init_sync_kiocb(&kiocb, filp);
+ kiocb.ki_pos = (ppos ? *ppos : 0);
+- iov_iter_ubuf(&iter, WRITE, (void __user *)buf, len);
++ iov_iter_ubuf(&iter, ITER_SOURCE, (void __user *)buf, len);
+
+ ret = call_write_iter(filp, &kiocb, &iter);
+ BUG_ON(ret == -EIOCBQUEUED);
+@@ -533,7 +533,7 @@ ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t
+ .iov_len = min_t(size_t, count, MAX_RW_COUNT),
+ };
+ struct iov_iter iter;
+- iov_iter_kvec(&iter, WRITE, &iov, 1, iov.iov_len);
++ iov_iter_kvec(&iter, ITER_SOURCE, &iov, 1, iov.iov_len);
+ return __kernel_write_iter(file, &iter, pos);
+ }
+ /*
+@@ -911,7 +911,7 @@ static ssize_t vfs_readv(struct file *file, const struct iovec __user *vec,
+ struct iov_iter iter;
+ ssize_t ret;
+
+- ret = import_iovec(READ, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);
++ ret = import_iovec(ITER_DEST, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);
+ if (ret >= 0) {
+ ret = do_iter_read(file, &iter, pos, flags);
+ kfree(iov);
+@@ -928,7 +928,7 @@ static ssize_t vfs_writev(struct file *file, const struct iovec __user *vec,
+ struct iov_iter iter;
+ ssize_t ret;
+
+- ret = import_iovec(WRITE, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);
++ ret = import_iovec(ITER_SOURCE, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);
+ if (ret >= 0) {
+ file_start_write(file);
+ ret = do_iter_write(file, &iter, pos, flags);
+diff --git a/fs/seq_file.c b/fs/seq_file.c
+index 9456a2032224..f5fdaf3b1572 100644
+--- a/fs/seq_file.c
++++ b/fs/seq_file.c
+@@ -156,7 +156,7 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
+ ssize_t ret;
+
+ init_sync_kiocb(&kiocb, file);
+- iov_iter_init(&iter, READ, &iov, 1, size);
++ iov_iter_init(&iter, ITER_DEST, &iov, 1, size);
+
+ kiocb.ki_pos = *ppos;
+ ret = seq_read_iter(&kiocb, &iter);
+diff --git a/fs/splice.c b/fs/splice.c
+index 0878b852b355..5969b7a1d353 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -303,7 +303,7 @@ ssize_t generic_file_splice_read(struct file *in, loff_t *ppos,
+ struct kiocb kiocb;
+ int ret;
+
+- iov_iter_pipe(&to, READ, pipe, len);
++ iov_iter_pipe(&to, ITER_DEST, pipe, len);
+ init_sync_kiocb(&kiocb, in);
+ kiocb.ki_pos = *ppos;
+ ret = call_read_iter(in, &kiocb, &to);
+@@ -682,7 +682,7 @@ iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
+ n++;
+ }
+
+- iov_iter_bvec(&from, WRITE, array, n, sd.total_len - left);
++ iov_iter_bvec(&from, ITER_SOURCE, array, n, sd.total_len - left);
+ ret = vfs_iter_write(out, &from, &sd.pos, 0);
+ if (ret <= 0)
+ break;
+@@ -1263,9 +1263,9 @@ static int vmsplice_type(struct fd f, int *type)
+ if (!f.file)
+ return -EBADF;
+ if (f.file->f_mode & FMODE_WRITE) {
+- *type = WRITE;
++ *type = ITER_SOURCE;
+ } else if (f.file->f_mode & FMODE_READ) {
+- *type = READ;
++ *type = ITER_DEST;
+ } else {
+ fdput(f);
+ return -EBADF;
+@@ -1314,7 +1314,7 @@ SYSCALL_DEFINE4(vmsplice, int, fd, const struct iovec __user *, uiov,
+
+ if (!iov_iter_count(&iter))
+ error = 0;
+- else if (iov_iter_rw(&iter) == WRITE)
++ else if (type == ITER_SOURCE)
+ error = vmsplice_to_pipe(f.file, &iter, flags);
+ else
+ error = vmsplice_to_user(f.file, &iter, flags);
+diff --git a/include/linux/uio.h b/include/linux/uio.h
+index 2e3134b14ffd..87fc3d0dda98 100644
+--- a/include/linux/uio.h
++++ b/include/linux/uio.h
+@@ -29,6 +29,9 @@ enum iter_type {
+ ITER_UBUF,
+ };
+
++#define ITER_SOURCE 1 // == WRITE
++#define ITER_DEST 0 // == READ
++
+ struct iov_iter_state {
+ size_t iov_offset;
+ size_t count;
+diff --git a/io_uring/net.c b/io_uring/net.c
+index 9046e269e5a5..520a73b5a448 100644
+--- a/io_uring/net.c
++++ b/io_uring/net.c
+@@ -364,7 +364,7 @@ int io_send(struct io_kiocb *req, unsigned int issue_flags)
+ if (unlikely(!sock))
+ return -ENOTSOCK;
+
+- ret = import_single_range(WRITE, sr->buf, sr->len, &iov, &msg.msg_iter);
++ ret = import_single_range(ITER_SOURCE, sr->buf, sr->len, &iov, &msg.msg_iter);
+ if (unlikely(ret))
+ return ret;
+
+@@ -450,7 +450,7 @@ static int __io_recvmsg_copy_hdr(struct io_kiocb *req,
+ }
+ } else {
+ iomsg->free_iov = iomsg->fast_iov;
+- ret = __import_iovec(READ, msg.msg_iov, msg.msg_iovlen, UIO_FASTIOV,
++ ret = __import_iovec(ITER_DEST, msg.msg_iov, msg.msg_iovlen, UIO_FASTIOV,
+ &iomsg->free_iov, &iomsg->msg.msg_iter,
+ false);
+ if (ret > 0)
+@@ -503,7 +503,7 @@ static int __io_compat_recvmsg_copy_hdr(struct io_kiocb *req,
+ }
+ } else {
+ iomsg->free_iov = iomsg->fast_iov;
+- ret = __import_iovec(READ, (struct iovec __user *)uiov, msg.msg_iovlen,
++ ret = __import_iovec(ITER_DEST, (struct iovec __user *)uiov, msg.msg_iovlen,
+ UIO_FASTIOV, &iomsg->free_iov,
+ &iomsg->msg.msg_iter, true);
+ if (ret < 0)
+@@ -763,7 +763,7 @@ int io_recvmsg(struct io_kiocb *req, unsigned int issue_flags)
+
+ kmsg->fast_iov[0].iov_base = buf;
+ kmsg->fast_iov[0].iov_len = len;
+- iov_iter_init(&kmsg->msg.msg_iter, READ, kmsg->fast_iov, 1,
++ iov_iter_init(&kmsg->msg.msg_iter, ITER_DEST, kmsg->fast_iov, 1,
+ len);
+ }
+
+@@ -857,7 +857,7 @@ int io_recv(struct io_kiocb *req, unsigned int issue_flags)
+ sr->buf = buf;
+ }
+
+- ret = import_single_range(READ, sr->buf, len, &iov, &msg.msg_iter);
++ ret = import_single_range(ITER_DEST, sr->buf, len, &iov, &msg.msg_iter);
+ if (unlikely(ret))
+ goto out_free;
+
+@@ -1097,13 +1097,13 @@ int io_send_zc(struct io_kiocb *req, unsigned int issue_flags)
+ return io_setup_async_addr(req, &__address, issue_flags);
+
+ if (zc->flags & IORING_RECVSEND_FIXED_BUF) {
+- ret = io_import_fixed(WRITE, &msg.msg_iter, req->imu,
++ ret = io_import_fixed(ITER_SOURCE, &msg.msg_iter, req->imu,
+ (u64)(uintptr_t)zc->buf, zc->len);
+ if (unlikely(ret))
+ return ret;
+ msg.sg_from_iter = io_sg_from_iter;
+ } else {
+- ret = import_single_range(WRITE, zc->buf, zc->len, &iov,
++ ret = import_single_range(ITER_SOURCE, zc->buf, zc->len, &iov,
+ &msg.msg_iter);
+ if (unlikely(ret))
+ return ret;
+diff --git a/io_uring/rw.c b/io_uring/rw.c
+index 6223472095d2..0218fae12edd 100644
+--- a/io_uring/rw.c
++++ b/io_uring/rw.c
+@@ -548,12 +548,12 @@ static inline int io_rw_prep_async(struct io_kiocb *req, int rw)
+
+ int io_readv_prep_async(struct io_kiocb *req)
+ {
+- return io_rw_prep_async(req, READ);
++ return io_rw_prep_async(req, ITER_DEST);
+ }
+
+ int io_writev_prep_async(struct io_kiocb *req)
+ {
+- return io_rw_prep_async(req, WRITE);
++ return io_rw_prep_async(req, ITER_SOURCE);
+ }
+
+ /*
+@@ -704,7 +704,7 @@ int io_read(struct io_kiocb *req, unsigned int issue_flags)
+ loff_t *ppos;
+
+ if (!req_has_async_data(req)) {
+- ret = io_import_iovec(READ, req, &iovec, s, issue_flags);
++ ret = io_import_iovec(ITER_DEST, req, &iovec, s, issue_flags);
+ if (unlikely(ret < 0))
+ return ret;
+ } else {
+@@ -716,7 +716,7 @@ int io_read(struct io_kiocb *req, unsigned int issue_flags)
+ * buffers, as we dropped the selected one before retry.
+ */
+ if (io_do_buffer_select(req)) {
+- ret = io_import_iovec(READ, req, &iovec, s, issue_flags);
++ ret = io_import_iovec(ITER_DEST, req, &iovec, s, issue_flags);
+ if (unlikely(ret < 0))
+ return ret;
+ }
+@@ -851,7 +851,7 @@ int io_write(struct io_kiocb *req, unsigned int issue_flags)
+ loff_t *ppos;
+
+ if (!req_has_async_data(req)) {
+- ret = io_import_iovec(WRITE, req, &iovec, s, issue_flags);
++ ret = io_import_iovec(ITER_SOURCE, req, &iovec, s, issue_flags);
+ if (unlikely(ret < 0))
+ return ret;
+ } else {
+diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c
+index 9cb53182bb31..908e8a13c675 100644
+--- a/kernel/trace/trace_events_user.c
++++ b/kernel/trace/trace_events_user.c
+@@ -1489,7 +1489,7 @@ static ssize_t user_events_write(struct file *file, const char __user *ubuf,
+ if (unlikely(*ppos != 0))
+ return -EFAULT;
+
+- if (unlikely(import_single_range(WRITE, (char __user *)ubuf,
++ if (unlikely(import_single_range(ITER_SOURCE, (char __user *)ubuf,
+ count, &iov, &i)))
+ return -EFAULT;
+
+diff --git a/mm/madvise.c b/mm/madvise.c
+index b913ba6efc10..d03e149ffe6e 100644
+--- a/mm/madvise.c
++++ b/mm/madvise.c
+@@ -1459,7 +1459,7 @@ SYSCALL_DEFINE5(process_madvise, int, pidfd, const struct iovec __user *, vec,
+ goto out;
+ }
+
+- ret = import_iovec(READ, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);
++ ret = import_iovec(ITER_DEST, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter);
+ if (ret < 0)
+ goto out;
+
+diff --git a/mm/page_io.c b/mm/page_io.c
+index 2af34dd8fa4d..3a5f921b932e 100644
+--- a/mm/page_io.c
++++ b/mm/page_io.c
+@@ -376,7 +376,7 @@ void swap_write_unplug(struct swap_iocb *sio)
+ struct address_space *mapping = sio->iocb.ki_filp->f_mapping;
+ int ret;
+
+- iov_iter_bvec(&from, WRITE, sio->bvec, sio->pages, sio->len);
++ iov_iter_bvec(&from, ITER_SOURCE, sio->bvec, sio->pages, sio->len);
+ ret = mapping->a_ops->swap_rw(&sio->iocb, &from);
+ if (ret != -EIOCBQUEUED)
+ sio_write_complete(&sio->iocb, ret);
+@@ -530,7 +530,7 @@ void __swap_read_unplug(struct swap_iocb *sio)
+ struct address_space *mapping = sio->iocb.ki_filp->f_mapping;
+ int ret;
+
+- iov_iter_bvec(&from, READ, sio->bvec, sio->pages, sio->len);
++ iov_iter_bvec(&from, ITER_DEST, sio->bvec, sio->pages, sio->len);
+ ret = mapping->a_ops->swap_rw(&sio->iocb, &from);
+ if (ret != -EIOCBQUEUED)
+ sio_read_complete(&sio->iocb, ret);
+diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
+index 4bcc11958089..78dfaf9e8990 100644
+--- a/mm/process_vm_access.c
++++ b/mm/process_vm_access.c
+@@ -263,7 +263,7 @@ static ssize_t process_vm_rw(pid_t pid,
+ struct iovec *iov_r;
+ struct iov_iter iter;
+ ssize_t rc;
+- int dir = vm_write ? WRITE : READ;
++ int dir = vm_write ? ITER_SOURCE : ITER_DEST;
+
+ if (flags != 0)
+ return -EINVAL;
+diff --git a/net/9p/client.c b/net/9p/client.c
+index b5aa25f82b78..554a4b11f4fe 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -2049,7 +2049,7 @@ int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset)
+ struct kvec kv = {.iov_base = data, .iov_len = count};
+ struct iov_iter to;
+
+- iov_iter_kvec(&to, READ, &kv, 1, count);
++ iov_iter_kvec(&to, ITER_DEST, &kv, 1, count);
+
+ p9_debug(P9_DEBUG_9P, ">>> TREADDIR fid %d offset %llu count %d\n",
+ fid->fid, offset, count);
+diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
+index c57d643afb10..4eb1b3ced0d2 100644
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -441,7 +441,7 @@ static int send_pkt(struct l2cap_chan *chan, struct sk_buff *skb,
+ iv.iov_len = skb->len;
+
+ memset(&msg, 0, sizeof(msg));
+- iov_iter_kvec(&msg.msg_iter, WRITE, &iv, 1, skb->len);
++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iv, 1, skb->len);
+
+ err = l2cap_chan_send(chan, &msg, skb->len);
+ if (err > 0) {
+diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
+index 1fcc482397c3..e7adb8a98cf9 100644
+--- a/net/bluetooth/a2mp.c
++++ b/net/bluetooth/a2mp.c
+@@ -56,7 +56,7 @@ static void a2mp_send(struct amp_mgr *mgr, u8 code, u8 ident, u16 len, void *dat
+
+ memset(&msg, 0, sizeof(msg));
+
+- iov_iter_kvec(&msg.msg_iter, WRITE, &iv, 1, total_len);
++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iv, 1, total_len);
+
+ l2cap_chan_send(chan, &msg, total_len);
+
+diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
+index 11f853d0500f..70663229b3cc 100644
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -605,7 +605,7 @@ static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
+
+ memset(&msg, 0, sizeof(msg));
+
+- iov_iter_kvec(&msg.msg_iter, WRITE, iv, 2, 1 + len);
++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iv, 2, 1 + len);
+
+ l2cap_chan_send(chan, &msg, 1 + len);
+
+diff --git a/net/ceph/messenger_v1.c b/net/ceph/messenger_v1.c
+index 3ddbde87e4d6..d1787d7d33ef 100644
+--- a/net/ceph/messenger_v1.c
++++ b/net/ceph/messenger_v1.c
+@@ -30,7 +30,7 @@ static int ceph_tcp_recvmsg(struct socket *sock, void *buf, size_t len)
+ if (!buf)
+ msg.msg_flags |= MSG_TRUNC;
+
+- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, len);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, len);
+ r = sock_recvmsg(sock, &msg, msg.msg_flags);
+ if (r == -EAGAIN)
+ r = 0;
+@@ -49,7 +49,7 @@ static int ceph_tcp_recvpage(struct socket *sock, struct page *page,
+ int r;
+
+ BUG_ON(page_offset + length > PAGE_SIZE);
+- iov_iter_bvec(&msg.msg_iter, READ, &bvec, 1, length);
++ iov_iter_bvec(&msg.msg_iter, ITER_DEST, &bvec, 1, length);
+ r = sock_recvmsg(sock, &msg, msg.msg_flags);
+ if (r == -EAGAIN)
+ r = 0;
+diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c
+index cc8ff81a50b7..3009028c4fa2 100644
+--- a/net/ceph/messenger_v2.c
++++ b/net/ceph/messenger_v2.c
+@@ -168,7 +168,7 @@ static int do_try_sendpage(struct socket *sock, struct iov_iter *it)
+ bv.bv_offset, bv.bv_len,
+ CEPH_MSG_FLAGS);
+ } else {
+- iov_iter_bvec(&msg.msg_iter, WRITE, &bv, 1, bv.bv_len);
++ iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bv, 1, bv.bv_len);
+ ret = sock_sendmsg(sock, &msg);
+ }
+ if (ret <= 0) {
+@@ -225,7 +225,7 @@ static void reset_in_kvecs(struct ceph_connection *con)
+ WARN_ON(iov_iter_count(&con->v2.in_iter));
+
+ con->v2.in_kvec_cnt = 0;
+- iov_iter_kvec(&con->v2.in_iter, READ, con->v2.in_kvecs, 0, 0);
++ iov_iter_kvec(&con->v2.in_iter, ITER_DEST, con->v2.in_kvecs, 0, 0);
+ }
+
+ static void set_in_bvec(struct ceph_connection *con, const struct bio_vec *bv)
+@@ -233,7 +233,7 @@ static void set_in_bvec(struct ceph_connection *con, const struct bio_vec *bv)
+ WARN_ON(iov_iter_count(&con->v2.in_iter));
+
+ con->v2.in_bvec = *bv;
+- iov_iter_bvec(&con->v2.in_iter, READ, &con->v2.in_bvec, 1, bv->bv_len);
++ iov_iter_bvec(&con->v2.in_iter, ITER_DEST, &con->v2.in_bvec, 1, bv->bv_len);
+ }
+
+ static void set_in_skip(struct ceph_connection *con, int len)
+@@ -241,7 +241,7 @@ static void set_in_skip(struct ceph_connection *con, int len)
+ WARN_ON(iov_iter_count(&con->v2.in_iter));
+
+ dout("%s con %p len %d\n", __func__, con, len);
+- iov_iter_discard(&con->v2.in_iter, READ, len);
++ iov_iter_discard(&con->v2.in_iter, ITER_DEST, len);
+ }
+
+ static void add_out_kvec(struct ceph_connection *con, void *buf, int len)
+@@ -265,7 +265,7 @@ static void reset_out_kvecs(struct ceph_connection *con)
+
+ con->v2.out_kvec_cnt = 0;
+
+- iov_iter_kvec(&con->v2.out_iter, WRITE, con->v2.out_kvecs, 0, 0);
++ iov_iter_kvec(&con->v2.out_iter, ITER_SOURCE, con->v2.out_kvecs, 0, 0);
+ con->v2.out_iter_sendpage = false;
+ }
+
+@@ -277,7 +277,7 @@ static void set_out_bvec(struct ceph_connection *con, const struct bio_vec *bv,
+
+ con->v2.out_bvec = *bv;
+ con->v2.out_iter_sendpage = zerocopy;
+- iov_iter_bvec(&con->v2.out_iter, WRITE, &con->v2.out_bvec, 1,
++ iov_iter_bvec(&con->v2.out_iter, ITER_SOURCE, &con->v2.out_bvec, 1,
+ con->v2.out_bvec.bv_len);
+ }
+
+@@ -290,7 +290,7 @@ static void set_out_bvec_zero(struct ceph_connection *con)
+ con->v2.out_bvec.bv_offset = 0;
+ con->v2.out_bvec.bv_len = min(con->v2.out_zero, (int)PAGE_SIZE);
+ con->v2.out_iter_sendpage = true;
+- iov_iter_bvec(&con->v2.out_iter, WRITE, &con->v2.out_bvec, 1,
++ iov_iter_bvec(&con->v2.out_iter, ITER_SOURCE, &con->v2.out_bvec, 1,
+ con->v2.out_bvec.bv_len);
+ }
+
+diff --git a/net/compat.c b/net/compat.c
+index 385f04a6be2f..161b7bea1f62 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -95,7 +95,8 @@ int get_compat_msghdr(struct msghdr *kmsg,
+ if (err)
+ return err;
+
+- err = import_iovec(save_addr ? READ : WRITE, compat_ptr(msg.msg_iov), msg.msg_iovlen,
++ err = import_iovec(save_addr ? ITER_DEST : ITER_SOURCE,
++ compat_ptr(msg.msg_iov), msg.msg_iovlen,
+ UIO_FASTIOV, iov, &kmsg->msg_iter);
+ return err < 0 ? err : 0;
+ }
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index ec19ed722453..6667c3538f2a 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2001,7 +2001,7 @@ static int receive_fallback_to_copy(struct sock *sk,
+ if (copy_address != zc->copybuf_address)
+ return -EINVAL;
+
+- err = import_single_range(READ, (void __user *)copy_address,
++ err = import_single_range(ITER_DEST, (void __user *)copy_address,
+ inq, &iov, &msg.msg_iter);
+ if (err)
+ return err;
+@@ -2035,7 +2035,7 @@ static int tcp_copy_straggler_data(struct tcp_zerocopy_receive *zc,
+ if (copy_address != zc->copybuf_address)
+ return -EINVAL;
+
+- err = import_single_range(READ, (void __user *)copy_address,
++ err = import_single_range(ITER_DEST, (void __user *)copy_address,
+ copylen, &iov, &msg.msg_iter);
+ if (err)
+ return err;
+diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
+index a56fd0b5a430..4963fec815da 100644
+--- a/net/netfilter/ipvs/ip_vs_sync.c
++++ b/net/netfilter/ipvs/ip_vs_sync.c
+@@ -1617,7 +1617,7 @@ ip_vs_receive(struct socket *sock, char *buffer, const size_t buflen)
+ EnterFunction(7);
+
+ /* Receive a packet */
+- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, buflen);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, buflen);
+ len = sock_recvmsg(sock, &msg, MSG_DONTWAIT);
+ if (len < 0)
+ return len;
+diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
+index 1472f31480d8..dfb9797f7bc6 100644
+--- a/net/smc/smc_clc.c
++++ b/net/smc/smc_clc.c
+@@ -673,7 +673,7 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
+ */
+ krflags = MSG_PEEK | MSG_WAITALL;
+ clc_sk->sk_rcvtimeo = timeout;
+- iov_iter_kvec(&msg.msg_iter, READ, &vec, 1,
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &vec, 1,
+ sizeof(struct smc_clc_msg_hdr));
+ len = sock_recvmsg(smc->clcsock, &msg, krflags);
+ if (signal_pending(current)) {
+@@ -720,7 +720,7 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
+ } else {
+ recvlen = datlen;
+ }
+- iov_iter_kvec(&msg.msg_iter, READ, &vec, 1, recvlen);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &vec, 1, recvlen);
+ krflags = MSG_WAITALL;
+ len = sock_recvmsg(smc->clcsock, &msg, krflags);
+ if (len < recvlen || !smc_clc_msg_hdr_valid(clcm, check_trl)) {
+@@ -737,7 +737,7 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
+ /* receive remaining proposal message */
+ recvlen = datlen > SMC_CLC_RECV_BUF_LEN ?
+ SMC_CLC_RECV_BUF_LEN : datlen;
+- iov_iter_kvec(&msg.msg_iter, READ, &vec, 1, recvlen);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &vec, 1, recvlen);
+ len = sock_recvmsg(smc->clcsock, &msg, krflags);
+ datlen -= len;
+ }
+diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
+index 64dedffe9d26..f4b6a71ac488 100644
+--- a/net/smc/smc_tx.c
++++ b/net/smc/smc_tx.c
+@@ -308,7 +308,7 @@ int smc_tx_sendpage(struct smc_sock *smc, struct page *page, int offset,
+
+ iov.iov_base = kaddr + offset;
+ iov.iov_len = size;
+- iov_iter_kvec(&msg.msg_iter, WRITE, &iov, 1, size);
++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iov, 1, size);
+ rc = smc_tx_sendmsg(smc, &msg, size);
+ kunmap(page);
+ return rc;
+diff --git a/net/socket.c b/net/socket.c
+index 00da9ce3dba0..73463c7c3702 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -750,7 +750,7 @@ EXPORT_SYMBOL(sock_sendmsg);
+ int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
+ struct kvec *vec, size_t num, size_t size)
+ {
+- iov_iter_kvec(&msg->msg_iter, WRITE, vec, num, size);
++ iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, vec, num, size);
+ return sock_sendmsg(sock, msg);
+ }
+ EXPORT_SYMBOL(kernel_sendmsg);
+@@ -776,7 +776,7 @@ int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ if (!sock->ops->sendmsg_locked)
+ return sock_no_sendmsg_locked(sk, msg, size);
+
+- iov_iter_kvec(&msg->msg_iter, WRITE, vec, num, size);
++ iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, vec, num, size);
+
+ return sock->ops->sendmsg_locked(sk, msg, msg_data_left(msg));
+ }
+@@ -1034,7 +1034,7 @@ int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
+ struct kvec *vec, size_t num, size_t size, int flags)
+ {
+ msg->msg_control_is_user = false;
+- iov_iter_kvec(&msg->msg_iter, READ, vec, num, size);
++ iov_iter_kvec(&msg->msg_iter, ITER_DEST, vec, num, size);
+ return sock_recvmsg(sock, msg, flags);
+ }
+ EXPORT_SYMBOL(kernel_recvmsg);
+@@ -2092,7 +2092,7 @@ int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags,
+ struct iovec iov;
+ int fput_needed;
+
+- err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter);
++ err = import_single_range(ITER_SOURCE, buff, len, &iov, &msg.msg_iter);
+ if (unlikely(err))
+ return err;
+ sock = sockfd_lookup_light(fd, &err, &fput_needed);
+@@ -2157,7 +2157,7 @@ int __sys_recvfrom(int fd, void __user *ubuf, size_t size, unsigned int flags,
+ int err, err2;
+ int fput_needed;
+
+- err = import_single_range(READ, ubuf, size, &iov, &msg.msg_iter);
++ err = import_single_range(ITER_DEST, ubuf, size, &iov, &msg.msg_iter);
+ if (unlikely(err))
+ return err;
+ sock = sockfd_lookup_light(fd, &err, &fput_needed);
+@@ -2417,7 +2417,7 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
+ if (err)
+ return err;
+
+- err = import_iovec(save_addr ? READ : WRITE,
++ err = import_iovec(save_addr ? ITER_DEST : ITER_SOURCE,
+ msg.msg_iov, msg.msg_iovlen,
+ UIO_FASTIOV, iov, &kmsg->msg_iter);
+ return err < 0 ? err : 0;
+diff --git a/net/sunrpc/socklib.c b/net/sunrpc/socklib.c
+index 71ba4cf513bc..1b2b84feeec6 100644
+--- a/net/sunrpc/socklib.c
++++ b/net/sunrpc/socklib.c
+@@ -214,14 +214,14 @@ static inline int xprt_sendmsg(struct socket *sock, struct msghdr *msg,
+ static int xprt_send_kvec(struct socket *sock, struct msghdr *msg,
+ struct kvec *vec, size_t seek)
+ {
+- iov_iter_kvec(&msg->msg_iter, WRITE, vec, 1, vec->iov_len);
++ iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, vec, 1, vec->iov_len);
+ return xprt_sendmsg(sock, msg, seek);
+ }
+
+ static int xprt_send_pagedata(struct socket *sock, struct msghdr *msg,
+ struct xdr_buf *xdr, size_t base)
+ {
+- iov_iter_bvec(&msg->msg_iter, WRITE, xdr->bvec, xdr_buf_pagecount(xdr),
++ iov_iter_bvec(&msg->msg_iter, ITER_SOURCE, xdr->bvec, xdr_buf_pagecount(xdr),
+ xdr->page_len + xdr->page_base);
+ return xprt_sendmsg(sock, msg, base + xdr->page_base);
+ }
+@@ -244,7 +244,7 @@ static int xprt_send_rm_and_kvec(struct socket *sock, struct msghdr *msg,
+ };
+ size_t len = iov[0].iov_len + iov[1].iov_len;
+
+- iov_iter_kvec(&msg->msg_iter, WRITE, iov, 2, len);
++ iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, iov, 2, len);
+ return xprt_sendmsg(sock, msg, base);
+ }
+
+diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
+index e833103f4629..815baf308236 100644
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -260,7 +260,7 @@ static ssize_t svc_tcp_read_msg(struct svc_rqst *rqstp, size_t buflen,
+ rqstp->rq_respages = &rqstp->rq_pages[i];
+ rqstp->rq_next_page = rqstp->rq_respages + 1;
+
+- iov_iter_bvec(&msg.msg_iter, READ, bvec, i, buflen);
++ iov_iter_bvec(&msg.msg_iter, ITER_DEST, bvec, i, buflen);
+ if (seek) {
+ iov_iter_advance(&msg.msg_iter, seek);
+ buflen -= seek;
+@@ -874,7 +874,7 @@ static ssize_t svc_tcp_read_marker(struct svc_sock *svsk,
+ want = sizeof(rpc_fraghdr) - svsk->sk_tcplen;
+ iov.iov_base = ((char *)&svsk->sk_marker) + svsk->sk_tcplen;
+ iov.iov_len = want;
+- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, want);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, want);
+ len = sock_recvmsg(svsk->sk_sock, &msg, MSG_DONTWAIT);
+ if (len < 0)
+ return len;
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 915b9902f673..b3ab6d9d752e 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -364,7 +364,7 @@ static ssize_t
+ xs_read_kvec(struct socket *sock, struct msghdr *msg, int flags,
+ struct kvec *kvec, size_t count, size_t seek)
+ {
+- iov_iter_kvec(&msg->msg_iter, READ, kvec, 1, count);
++ iov_iter_kvec(&msg->msg_iter, ITER_DEST, kvec, 1, count);
+ return xs_sock_recvmsg(sock, msg, flags, seek);
+ }
+
+@@ -373,7 +373,7 @@ xs_read_bvec(struct socket *sock, struct msghdr *msg, int flags,
+ struct bio_vec *bvec, unsigned long nr, size_t count,
+ size_t seek)
+ {
+- iov_iter_bvec(&msg->msg_iter, READ, bvec, nr, count);
++ iov_iter_bvec(&msg->msg_iter, ITER_DEST, bvec, nr, count);
+ return xs_sock_recvmsg(sock, msg, flags, seek);
+ }
+
+@@ -381,7 +381,7 @@ static ssize_t
+ xs_read_discard(struct socket *sock, struct msghdr *msg, int flags,
+ size_t count)
+ {
+- iov_iter_discard(&msg->msg_iter, READ, count);
++ iov_iter_discard(&msg->msg_iter, ITER_DEST, count);
+ return sock_recvmsg(sock, msg, flags);
+ }
+
+diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
+index e3b427a70398..69c88cc03887 100644
+--- a/net/tipc/topsrv.c
++++ b/net/tipc/topsrv.c
+@@ -396,7 +396,7 @@ static int tipc_conn_rcv_from_sock(struct tipc_conn *con)
+ iov.iov_base = &s;
+ iov.iov_len = sizeof(s);
+ msg.msg_name = NULL;
+- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, iov.iov_len);
++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, iov.iov_len);
+ ret = sock_recvmsg(con->sock, &msg, MSG_DONTWAIT);
+ if (ret == -EWOULDBLOCK)
+ return -EWOULDBLOCK;
+diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
+index a03d66046ca3..6c593788dc25 100644
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -620,7 +620,7 @@ int tls_device_sendpage(struct sock *sk, struct page *page,
+ kaddr = kmap(page);
+ iov.iov_base = kaddr + offset;
+ iov.iov_len = size;
+- iov_iter_kvec(&msg_iter, WRITE, &iov, 1, size);
++ iov_iter_kvec(&msg_iter, ITER_SOURCE, &iov, 1, size);
+ iter_offset.msg_iter = &msg_iter;
+ rc = tls_push_data(sk, iter_offset, size, flags, TLS_RECORD_TYPE_DATA,
+ NULL);
+@@ -697,7 +697,7 @@ static int tls_device_push_pending_record(struct sock *sk, int flags)
+ union tls_iter_offset iter;
+ struct iov_iter msg_iter;
+
+- iov_iter_kvec(&msg_iter, WRITE, NULL, 0, 0);
++ iov_iter_kvec(&msg_iter, ITER_SOURCE, NULL, 0, 0);
+ iter.msg_iter = &msg_iter;
+ return tls_push_data(sk, iter, 0, flags, TLS_RECORD_TYPE_DATA, NULL);
+ }
+diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c
+index 29a540dcb5a7..d6fece1ed982 100644
+--- a/net/xfrm/espintcp.c
++++ b/net/xfrm/espintcp.c
+@@ -354,7 +354,7 @@ static int espintcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ *((__be16 *)buf) = cpu_to_be16(msglen);
+ pfx_iov.iov_base = buf;
+ pfx_iov.iov_len = sizeof(buf);
+- iov_iter_kvec(&pfx_iter, WRITE, &pfx_iov, 1, pfx_iov.iov_len);
++ iov_iter_kvec(&pfx_iter, ITER_SOURCE, &pfx_iov, 1, pfx_iov.iov_len);
+
+ err = sk_msg_memcopy_from_iter(sk, &pfx_iter, &emsg->skmsg,
+ pfx_iov.iov_len);
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index 96a92a645216..d54f73c558f7 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -1251,7 +1251,7 @@ long keyctl_instantiate_key(key_serial_t id,
+ struct iov_iter from;
+ int ret;
+
+- ret = import_single_range(WRITE, (void __user *)_payload, plen,
++ ret = import_single_range(ITER_SOURCE, (void __user *)_payload, plen,
+ &iov, &from);
+ if (unlikely(ret))
+ return ret;
+@@ -1283,7 +1283,7 @@ long keyctl_instantiate_key_iov(key_serial_t id,
+ if (!_payload_iov)
+ ioc = 0;
+
+- ret = import_iovec(WRITE, _payload_iov, ioc,
++ ret = import_iovec(ITER_SOURCE, _payload_iov, ioc,
+ ARRAY_SIZE(iovstack), &iov, &from);
+ if (ret < 0)
+ return ret;
+--
+2.39.0
+
--- /dev/null
+From ffdce1a03982125ecd4366c554222e8293827192 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jan 2023 10:15:18 -0500
+Subject: vhost/net: Clear the pending messages when the backend is removed
+
+From: Eric Auger <eric.auger@redhat.com>
+
+[ Upstream commit 9526f9a2b762af16be94a72aca5d65c677d28f50 ]
+
+When the vhost iotlb is used along with a guest virtual iommu
+and the guest gets rebooted, some MISS messages may have been
+recorded just before the reboot and spuriously executed by
+the virtual iommu after the reboot.
+
+As vhost does not have any explicit reset user API,
+VHOST_NET_SET_BACKEND looks a reasonable point where to clear
+the pending messages, in case the backend is removed.
+
+Export vhost_clear_msg() and call it in vhost_net_set_backend()
+when fd == -1.
+
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Suggested-by: Jason Wang <jasowang@redhat.com>
+Fixes: 6b1e6cc7855b0 ("vhost: new device IOTLB API")
+Message-Id: <20230117151518.44725-3-eric.auger@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/net.c | 3 +++
+ drivers/vhost/vhost.c | 3 ++-
+ drivers/vhost/vhost.h | 1 +
+ 3 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index 20265393aee7..c7e44d818252 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -1511,6 +1511,9 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
+ nvq = &n->vqs[index];
+ mutex_lock(&vq->mutex);
+
++ if (fd == -1)
++ vhost_clear_msg(&n->dev);
++
+ /* Verify that ring has been setup correctly. */
+ if (!vhost_vq_access_ok(vq)) {
+ r = -EFAULT;
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 3c2359570df9..547f89a6940f 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -661,7 +661,7 @@ void vhost_dev_stop(struct vhost_dev *dev)
+ }
+ EXPORT_SYMBOL_GPL(vhost_dev_stop);
+
+-static void vhost_clear_msg(struct vhost_dev *dev)
++void vhost_clear_msg(struct vhost_dev *dev)
+ {
+ struct vhost_msg_node *node, *n;
+
+@@ -679,6 +679,7 @@ static void vhost_clear_msg(struct vhost_dev *dev)
+
+ spin_unlock(&dev->iotlb_lock);
+ }
++EXPORT_SYMBOL_GPL(vhost_clear_msg);
+
+ void vhost_dev_cleanup(struct vhost_dev *dev)
+ {
+diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
+index d9109107af08..790b296271f1 100644
+--- a/drivers/vhost/vhost.h
++++ b/drivers/vhost/vhost.h
+@@ -181,6 +181,7 @@ long vhost_dev_ioctl(struct vhost_dev *, unsigned int ioctl, void __user *argp);
+ long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp);
+ bool vhost_vq_access_ok(struct vhost_virtqueue *vq);
+ bool vhost_log_access_ok(struct vhost_dev *);
++void vhost_clear_msg(struct vhost_dev *dev);
+
+ int vhost_get_vq_desc(struct vhost_virtqueue *,
+ struct iovec iov[], unsigned int iov_count,
+--
+2.39.0
+
--- /dev/null
+From 1a6bdb0367212bf6933a977318e07cf8a9eedf33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 15:36:47 +0800
+Subject: vhost-scsi: unbreak any layout for response
+
+From: Jason Wang <jasowang@redhat.com>
+
+[ Upstream commit 6dd88fd59da84631b5fe5c8176931c38cfa3b265 ]
+
+Al Viro said:
+
+"""
+Since "vhost/scsi: fix reuse of &vq->iov[out] in response"
+we have this:
+ cmd->tvc_resp_iov = vq->iov[vc.out];
+ cmd->tvc_in_iovs = vc.in;
+combined with
+ iov_iter_init(&iov_iter, ITER_DEST, &cmd->tvc_resp_iov,
+ cmd->tvc_in_iovs, sizeof(v_rsp));
+in vhost_scsi_complete_cmd_work(). We used to have ->tvc_resp_iov
+_pointing_ to vq->iov[vc.out]; back then iov_iter_init() asked to
+set an iovec-backed iov_iter over the tail of vq->iov[], with
+length being the amount of iovecs in the tail.
+
+Now we have a copy of one element of that array. Fortunately, the members
+following it in the containing structure are two non-NULL kernel pointers,
+so copy_to_iter() will not copy anything beyond the first iovec - kernel
+pointer is not (on the majority of architectures) going to be accepted by
+access_ok() in copyout() and it won't be skipped since the "length" (in
+reality - another non-NULL kernel pointer) won't be zero.
+
+So it's not going to give a guest-to-qemu escalation, but it's definitely
+a bug. Frankly, my preference would be to verify that the very first iovec
+is long enough to hold rsp_size. Due to the above, any users that try to
+give us vq->iov[vc.out].iov_len < sizeof(struct virtio_scsi_cmd_resp)
+would currently get a failure in vhost_scsi_complete_cmd_work()
+anyway.
+"""
+
+However, the spec doesn't say anything about the legacy descriptor
+layout for the respone. So this patch tries to not assume the response
+to reside in a single separate descriptor which is what commit
+79c14141a487 ("vhost/scsi: Convert completion path to use") tries to
+achieve towards to ANY_LAYOUT.
+
+This is done by allocating and using dedicate resp iov in the
+command. To be safety, start with UIO_MAXIOV to be consistent with the
+limitation that we advertise to the vhost_get_vq_desc().
+
+Testing with the hacked virtio-scsi driver that use 1 descriptor for 1
+byte in the response.
+
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Benjamin Coddington <bcodding@redhat.com>
+Cc: Nicholas Bellinger <nab@linux-iscsi.org>
+Fixes: a77ec83a5789 ("vhost/scsi: fix reuse of &vq->iov[out] in response")
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Message-Id: <20230119073647.76467-1-jasowang@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/scsi.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index dca6346d75b3..d5ecb8876fc9 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -80,7 +80,7 @@ struct vhost_scsi_cmd {
+ struct scatterlist *tvc_prot_sgl;
+ struct page **tvc_upages;
+ /* Pointer to response header iovec */
+- struct iovec tvc_resp_iov;
++ struct iovec *tvc_resp_iov;
+ /* Pointer to vhost_scsi for our device */
+ struct vhost_scsi *tvc_vhost;
+ /* Pointer to vhost_virtqueue for the cmd */
+@@ -563,7 +563,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
+ memcpy(v_rsp.sense, cmd->tvc_sense_buf,
+ se_cmd->scsi_sense_length);
+
+- iov_iter_init(&iov_iter, ITER_DEST, &cmd->tvc_resp_iov,
++ iov_iter_init(&iov_iter, ITER_DEST, cmd->tvc_resp_iov,
+ cmd->tvc_in_iovs, sizeof(v_rsp));
+ ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter);
+ if (likely(ret == sizeof(v_rsp))) {
+@@ -594,6 +594,7 @@ vhost_scsi_get_cmd(struct vhost_virtqueue *vq, struct vhost_scsi_tpg *tpg,
+ struct vhost_scsi_cmd *cmd;
+ struct vhost_scsi_nexus *tv_nexus;
+ struct scatterlist *sg, *prot_sg;
++ struct iovec *tvc_resp_iov;
+ struct page **pages;
+ int tag;
+
+@@ -613,6 +614,7 @@ vhost_scsi_get_cmd(struct vhost_virtqueue *vq, struct vhost_scsi_tpg *tpg,
+ sg = cmd->tvc_sgl;
+ prot_sg = cmd->tvc_prot_sgl;
+ pages = cmd->tvc_upages;
++ tvc_resp_iov = cmd->tvc_resp_iov;
+ memset(cmd, 0, sizeof(*cmd));
+ cmd->tvc_sgl = sg;
+ cmd->tvc_prot_sgl = prot_sg;
+@@ -625,6 +627,7 @@ vhost_scsi_get_cmd(struct vhost_virtqueue *vq, struct vhost_scsi_tpg *tpg,
+ cmd->tvc_data_direction = data_direction;
+ cmd->tvc_nexus = tv_nexus;
+ cmd->inflight = vhost_scsi_get_inflight(vq);
++ cmd->tvc_resp_iov = tvc_resp_iov;
+
+ memcpy(cmd->tvc_cdb, cdb, VHOST_SCSI_MAX_CDB_SIZE);
+
+@@ -935,7 +938,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
+ struct iov_iter in_iter, prot_iter, data_iter;
+ u64 tag;
+ u32 exp_data_len, data_direction;
+- int ret, prot_bytes, c = 0;
++ int ret, prot_bytes, i, c = 0;
+ u16 lun;
+ u8 task_attr;
+ bool t10_pi = vhost_has_feature(vq, VIRTIO_SCSI_F_T10_PI);
+@@ -1092,7 +1095,8 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
+ }
+ cmd->tvc_vhost = vs;
+ cmd->tvc_vq = vq;
+- cmd->tvc_resp_iov = vq->iov[vc.out];
++ for (i = 0; i < vc.in ; i++)
++ cmd->tvc_resp_iov[i] = vq->iov[vc.out + i];
+ cmd->tvc_in_iovs = vc.in;
+
+ pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n",
+@@ -1461,6 +1465,7 @@ static void vhost_scsi_destroy_vq_cmds(struct vhost_virtqueue *vq)
+ kfree(tv_cmd->tvc_sgl);
+ kfree(tv_cmd->tvc_prot_sgl);
+ kfree(tv_cmd->tvc_upages);
++ kfree(tv_cmd->tvc_resp_iov);
+ }
+
+ sbitmap_free(&svq->scsi_tags);
+@@ -1508,6 +1513,14 @@ static int vhost_scsi_setup_vq_cmds(struct vhost_virtqueue *vq, int max_cmds)
+ goto out;
+ }
+
++ tv_cmd->tvc_resp_iov = kcalloc(UIO_MAXIOV,
++ sizeof(struct iovec),
++ GFP_KERNEL);
++ if (!tv_cmd->tvc_resp_iov) {
++ pr_err("Unable to allocate tv_cmd->tvc_resp_iov\n");
++ goto out;
++ }
++
+ tv_cmd->tvc_prot_sgl = kcalloc(VHOST_SCSI_PREALLOC_PROT_SGLS,
+ sizeof(struct scatterlist),
+ GFP_KERNEL);
+--
+2.39.0
+
--- /dev/null
+From cca121f877e2848b274c2b736d3641176f96a38f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 08:48:59 +0100
+Subject: virtio-net: execute xdp_do_flush() before napi_complete_done()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Magnus Karlsson <magnus.karlsson@intel.com>
+
+[ Upstream commit ad7e615f646c9b5b2cf655cdfb9d91a28db4f25a ]
+
+Make sure that xdp_do_flush() is always executed before
+napi_complete_done(). This is important for two reasons. First, a
+redirect to an XSKMAP assumes that a call to xdp_do_redirect() from
+napi context X on CPU Y will be followed by a xdp_do_flush() from the
+same napi context and CPU. This is not guaranteed if the
+napi_complete_done() is executed before xdp_do_flush(), as it tells
+the napi logic that it is fine to schedule napi context X on another
+CPU. Details from a production system triggering this bug using the
+veth driver can be found following the first link below.
+
+The second reason is that the XDP_REDIRECT logic in itself relies on
+being inside a single NAPI instance through to the xdp_do_flush() call
+for RCU protection of all in-kernel data structures. Details can be
+found in the second link below.
+
+Fixes: 186b3c998c50 ("virtio-net: support XDP_REDIRECT")
+Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com
+Link: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 3cd15f16090f..ec388932aacf 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1673,13 +1673,13 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
+
+ received = virtnet_receive(rq, budget, &xdp_xmit);
+
++ if (xdp_xmit & VIRTIO_XDP_REDIR)
++ xdp_do_flush();
++
+ /* Out of packets? */
+ if (received < budget)
+ virtqueue_napi_complete(napi, rq->vq, received);
+
+- if (xdp_xmit & VIRTIO_XDP_REDIR)
+- xdp_do_flush();
+-
+ if (xdp_xmit & VIRTIO_XDP_TX) {
+ sq = virtnet_xdp_get_sq(vi);
+ if (virtqueue_kick_prepare(sq->vq) && virtqueue_notify(sq->vq)) {
+--
+2.39.0
+
--- /dev/null
+From b6da8e5ba0f2c75c0573324143ab49c613f0dc3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 18:35:16 +0200
+Subject: virtio-net: Keep stop() to follow mirror sequence of open()
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 63b114042d8a9c02d9939889177c36dbdb17a588 ]
+
+Cited commit in fixes tag frees rxq xdp info while RQ NAPI is
+still enabled and packet processing may be ongoing.
+
+Follow the mirror sequence of open() in the stop() callback.
+This ensures that when rxq info is unregistered, no rx
+packet processing is ongoing.
+
+Fixes: 754b8a21a96d ("virtio_net: setup xdp_rxq_info")
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Link: https://lore.kernel.org/r/20230202163516.12559-1-parav@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index ec388932aacf..20b1b34a092a 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -2154,8 +2154,8 @@ static int virtnet_close(struct net_device *dev)
+ cancel_delayed_work_sync(&vi->refill);
+
+ for (i = 0; i < vi->max_queue_pairs; i++) {
+- xdp_rxq_info_unreg(&vi->rq[i].xdp_rxq);
+ napi_disable(&vi->rq[i].napi);
++ xdp_rxq_info_unreg(&vi->rq[i].xdp_rxq);
+ virtnet_napi_tx_disable(&vi->sq[i].napi);
+ }
+
+--
+2.39.0
+
--- /dev/null
+From ab7f76c6e16405503753ac5f7c701d52491a85fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Sep 2022 18:59:12 -0400
+Subject: WRITE is "data source", not destination...
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 974c36fb828aeae7b4f9063f94860ae6c5633efd ]
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fsi/fsi-sbefifo.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c
+index 5f93a53846aa..efd4942aa043 100644
+--- a/drivers/fsi/fsi-sbefifo.c
++++ b/drivers/fsi/fsi-sbefifo.c
+@@ -659,7 +659,7 @@ static void sbefifo_collect_async_ffdc(struct sbefifo *sbefifo)
+ }
+ ffdc_iov.iov_base = ffdc;
+ ffdc_iov.iov_len = SBEFIFO_MAX_FFDC_SIZE;
+- iov_iter_kvec(&ffdc_iter, WRITE, &ffdc_iov, 1, SBEFIFO_MAX_FFDC_SIZE);
++ iov_iter_kvec(&ffdc_iter, READ, &ffdc_iov, 1, SBEFIFO_MAX_FFDC_SIZE);
+ cmd[0] = cpu_to_be32(2);
+ cmd[1] = cpu_to_be32(SBEFIFO_CMD_GET_SBE_FFDC);
+ rc = sbefifo_do_command(sbefifo, cmd, 2, &ffdc_iter);
+@@ -756,7 +756,7 @@ int sbefifo_submit(struct device *dev, const __be32 *command, size_t cmd_len,
+ rbytes = (*resp_len) * sizeof(__be32);
+ resp_iov.iov_base = response;
+ resp_iov.iov_len = rbytes;
+- iov_iter_kvec(&resp_iter, WRITE, &resp_iov, 1, rbytes);
++ iov_iter_kvec(&resp_iter, READ, &resp_iov, 1, rbytes);
+
+ /* Perform the command */
+ rc = mutex_lock_interruptible(&sbefifo->lock);
+@@ -839,7 +839,7 @@ static ssize_t sbefifo_user_read(struct file *file, char __user *buf,
+ /* Prepare iov iterator */
+ resp_iov.iov_base = buf;
+ resp_iov.iov_len = len;
+- iov_iter_init(&resp_iter, WRITE, &resp_iov, 1, len);
++ iov_iter_init(&resp_iter, READ, &resp_iov, 1, len);
+
+ /* Perform the command */
+ rc = mutex_lock_interruptible(&sbefifo->lock);
+--
+2.39.0
+
--- /dev/null
+From f301d10133763f73069e2d213bb72acd10ca191d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 18:02:06 +0200
+Subject: x86/aperfmperf: Erase stale arch_freq_scale values when disabling
+ frequency invariance readings
+
+From: Yair Podemsky <ypodemsk@redhat.com>
+
+[ Upstream commit 5f5cc9ed992cbab6361f198966f0edba5fc52688 ]
+
+Once disable_freq_invariance_work is called the scale_freq_tick function
+will not compute or update the arch_freq_scale values.
+However the scheduler will still read these values and use them.
+The result is that the scheduler might perform unfair decisions based on stale
+values.
+
+This patch adds the step of setting the arch_freq_scale values for all
+cpus to the default (max) value SCHED_CAPACITY_SCALE, Once all cpus
+have the same arch_freq_scale value the scaling is meaningless.
+
+Signed-off-by: Yair Podemsky <ypodemsk@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20230110160206.75912-1-ypodemsk@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/aperfmperf.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/aperfmperf.c b/arch/x86/kernel/cpu/aperfmperf.c
+index 1f60a2b27936..fdbb5f07448f 100644
+--- a/arch/x86/kernel/cpu/aperfmperf.c
++++ b/arch/x86/kernel/cpu/aperfmperf.c
+@@ -330,7 +330,16 @@ static void __init bp_init_freq_invariance(void)
+
+ static void disable_freq_invariance_workfn(struct work_struct *work)
+ {
++ int cpu;
++
+ static_branch_disable(&arch_scale_freq_key);
++
++ /*
++ * Set arch_freq_scale to a default value on all cpus
++ * This negates the effect of scaling
++ */
++ for_each_possible_cpu(cpu)
++ per_cpu(arch_freq_scale, cpu) = SCHED_CAPACITY_SCALE;
+ }
+
+ static DECLARE_WORK(disable_freq_invariance_work,
+--
+2.39.0
+
--- /dev/null
+From 16c08189f60712a186707f179681ef5c3c289f3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 09:58:27 -0700
+Subject: x86/build: Move '-mindirect-branch-cs-prefix' out of GCC-only block
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 27b5de622ea3fe0ad5a31a0ebd9f7a0a276932d1 ]
+
+LLVM 16 will have support for this flag so move it out of the GCC-only
+block to allow LLVM builds to take advantage of it.
+
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Tested-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://github.com/ClangBuiltLinux/linux/issues/1665
+Link: https://github.com/llvm/llvm-project/commit/6f867f9102838ebe314c1f3661fdf95700386e5a
+Link: https://lore.kernel.org/r/20230120165826.2469302-1-nathan@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index 415a5d138de4..3419ffa2a350 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -14,13 +14,13 @@ endif
+
+ ifdef CONFIG_CC_IS_GCC
+ RETPOLINE_CFLAGS := $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register)
+-RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch-cs-prefix)
+ RETPOLINE_VDSO_CFLAGS := $(call cc-option,-mindirect-branch=thunk-inline -mindirect-branch-register)
+ endif
+ ifdef CONFIG_CC_IS_CLANG
+ RETPOLINE_CFLAGS := -mretpoline-external-thunk
+ RETPOLINE_VDSO_CFLAGS := -mretpoline
+ endif
++RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch-cs-prefix)
+
+ ifdef CONFIG_RETHUNK
+ RETHUNK_CFLAGS := -mfunction-return=thunk-extern
+--
+2.39.0
+
--- /dev/null
+From 85b467e742d1490e0a84a2bad5e67a0489893ea8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Sep 2022 19:02:47 -0400
+Subject: zcore: WRITE is "data source", not destination...
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 4ba48e1bae5f68af24d8d71d4f28de9eb658af1d ]
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/char/zcore.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
+index 6165e6aae762..83ddac1e5838 100644
+--- a/drivers/s390/char/zcore.c
++++ b/drivers/s390/char/zcore.c
+@@ -103,7 +103,7 @@ static inline int memcpy_hsa_kernel(void *dst, unsigned long src, size_t count)
+
+ kvec.iov_base = dst;
+ kvec.iov_len = count;
+- iov_iter_kvec(&iter, WRITE, &kvec, 1, count);
++ iov_iter_kvec(&iter, READ, &kvec, 1, count);
+ if (memcpy_hsa_iter(&iter, src, count) < count)
+ return -EIO;
+ return 0;
+--
+2.39.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
