From: Sasha Levin Date: Mon, 6 Feb 2023 13:35:48 +0000 (-0500) Subject: Fixes for 6.1 X-Git-Tag: v5.15.93~58 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8732fdbdfe475ace1e259aa6a8043acb5ed9108b;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/alsa-firewire-motu-fix-unreleased-lock-warning-in-hw.patch b/queue-6.1/alsa-firewire-motu-fix-unreleased-lock-warning-in-hw.patch new file mode 100644 index 00000000000..428861a4ac5 --- /dev/null +++ b/queue-6.1/alsa-firewire-motu-fix-unreleased-lock-warning-in-hw.patch @@ -0,0 +1,41 @@ +From bbb1e09de4ccc227f482a35eefd8df63bdb68272 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 23:15:40 +0900 +Subject: ALSA: firewire-motu: fix unreleased lock warning in hwdep device + +From: Takashi Sakamoto + +[ Upstream commit c7a806d9ce6757ff56078674916e53bd859f242d ] + +Smatch static analysis tool detects that acquired lock is not released +in hwdep device when condition branch is passed due to no event. It is +unlikely to occur, while fulfilling is preferable for better coding. + +Reported-by: Dan Carpenter +Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model") +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20230130141540.102854-1-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/motu/motu-hwdep.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/firewire/motu/motu-hwdep.c b/sound/firewire/motu/motu-hwdep.c +index a900fc0e7644..88d1f4b56e4b 100644 +--- a/sound/firewire/motu/motu-hwdep.c ++++ b/sound/firewire/motu/motu-hwdep.c +@@ -87,6 +87,10 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, + return -EFAULT; + + count = consumed; ++ } else { ++ spin_unlock_irq(&motu->lock); ++ ++ count = 0; + } + + return count; +-- +2.39.0 + diff --git a/queue-6.1/alsa-hda-via-avoid-potential-array-out-of-bound-in-a.patch b/queue-6.1/alsa-hda-via-avoid-potential-array-out-of-bound-in-a.patch new file mode 100644 index 00000000000..05ac3366a91 --- /dev/null +++ b/queue-6.1/alsa-hda-via-avoid-potential-array-out-of-bound-in-a.patch @@ -0,0 +1,41 @@ +From bac19fbbbaf61b9708ea09ee807652686dd4a2b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 00:22:59 -0800 +Subject: ALSA: hda/via: Avoid potential array out-of-bound in + add_secret_dac_path() + +From: Artemii Karasev + +[ Upstream commit b9cee506da2b7920b5ea02ccd8e78a907d0ee7aa ] + +snd_hda_get_connections() can return a negative error code. +It may lead to accessing 'conn' array at a negative index. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Artemii Karasev +Fixes: 30b4503378c9 ("ALSA: hda - Expose secret DAC-AA connection of some VIA codecs") +Link: https://lore.kernel.org/r/20230119082259.3634-1-karasev@ispras.ru +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_via.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c +index aea7fae2ca4b..2994f85bc1b9 100644 +--- a/sound/pci/hda/patch_via.c ++++ b/sound/pci/hda/patch_via.c +@@ -819,6 +819,9 @@ static int add_secret_dac_path(struct hda_codec *codec) + return 0; + nums = snd_hda_get_connections(codec, spec->gen.mixer_nid, conn, + ARRAY_SIZE(conn) - 1); ++ if (nums < 0) ++ return nums; ++ + for (i = 0; i < nums; i++) { + if (get_wcaps_type(get_wcaps(codec, conn[i])) == AC_WID_AUD_OUT) + return 0; +-- +2.39.0 + diff --git a/queue-6.1/alsa-memalloc-workaround-for-xen-pv.patch b/queue-6.1/alsa-memalloc-workaround-for-xen-pv.patch new file mode 100644 index 00000000000..bb9ade3dc30 --- /dev/null +++ b/queue-6.1/alsa-memalloc-workaround-for-xen-pv.patch @@ -0,0 +1,220 @@ +From ad1ed2c0da44c14019dddefdd7594dfd042cb1a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 16:31:04 +0100 +Subject: ALSA: memalloc: Workaround for Xen PV +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Iwai + +[ Upstream commit 53466ebdec614f915c691809b0861acecb941e30 ] + +We change recently the memalloc helper to use +dma_alloc_noncontiguous() and the fallback to get_pages(). Although +lots of issues with IOMMU (or non-IOMMU) have been addressed, but +there seems still a regression on Xen PV. Interestingly, the only +proper way to work is use dma_alloc_coherent(). The use of +dma_alloc_coherent() for SG buffer was dropped as it's problematic on +IOMMU systems. OTOH, Xen PV has a different way, and it's fine to use +the dma_alloc_coherent(). + +This patch is a workaround for Xen PV. It consists of the following +changes: +- For Xen PV, use only the fallback allocation without + dma_alloc_noncontiguous() +- In the fallback allocation, use dma_alloc_coherent(); + the DMA address from dma_alloc_coherent() is returned in get_addr + ops +- The DMA addresses are stored in an array; the first entry stores the + number of allocated pages in lower bits, which are referred at + releasing pages again + +Reported-by: Marek Marczykowski-Górecki +Tested-by: Marek Marczykowski-Górecki +Fixes: a8d302a0b770 ("ALSA: memalloc: Revive x86-specific WC page allocations again") +Fixes: 9736a325137b ("ALSA: memalloc: Don't fall back for SG-buffer with IOMMU") +Link: https://lore.kernel.org/r/87tu256lqs.wl-tiwai@suse.de +Link: https://lore.kernel.org/r/20230125153104.5527-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/memalloc.c | 87 ++++++++++++++++++++++++++++++++++--------- + 1 file changed, 69 insertions(+), 18 deletions(-) + +diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c +index 7268304009ad..11ff1ee51345 100644 +--- a/sound/core/memalloc.c ++++ b/sound/core/memalloc.c +@@ -542,16 +542,15 @@ static void *snd_dma_noncontig_alloc(struct snd_dma_buffer *dmab, size_t size) + struct sg_table *sgt; + void *p; + ++#ifdef CONFIG_SND_DMA_SGBUF ++ if (cpu_feature_enabled(X86_FEATURE_XENPV)) ++ return snd_dma_sg_fallback_alloc(dmab, size); ++#endif + sgt = dma_alloc_noncontiguous(dmab->dev.dev, size, dmab->dev.dir, + DEFAULT_GFP, 0); + #ifdef CONFIG_SND_DMA_SGBUF +- if (!sgt && !get_dma_ops(dmab->dev.dev)) { +- if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG) +- dmab->dev.type = SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK; +- else +- dmab->dev.type = SNDRV_DMA_TYPE_DEV_SG_FALLBACK; ++ if (!sgt && !get_dma_ops(dmab->dev.dev)) + return snd_dma_sg_fallback_alloc(dmab, size); +- } + #endif + if (!sgt) + return NULL; +@@ -718,19 +717,38 @@ static const struct snd_malloc_ops snd_dma_sg_wc_ops = { + + /* Fallback SG-buffer allocations for x86 */ + struct snd_dma_sg_fallback { ++ bool use_dma_alloc_coherent; + size_t count; + struct page **pages; ++ /* DMA address array; the first page contains #pages in ~PAGE_MASK */ ++ dma_addr_t *addrs; + }; + + static void __snd_dma_sg_fallback_free(struct snd_dma_buffer *dmab, + struct snd_dma_sg_fallback *sgbuf) + { +- bool wc = dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK; +- size_t i; +- +- for (i = 0; i < sgbuf->count && sgbuf->pages[i]; i++) +- do_free_pages(page_address(sgbuf->pages[i]), PAGE_SIZE, wc); ++ size_t i, size; ++ ++ if (sgbuf->pages && sgbuf->addrs) { ++ i = 0; ++ while (i < sgbuf->count) { ++ if (!sgbuf->pages[i] || !sgbuf->addrs[i]) ++ break; ++ size = sgbuf->addrs[i] & ~PAGE_MASK; ++ if (WARN_ON(!size)) ++ break; ++ if (sgbuf->use_dma_alloc_coherent) ++ dma_free_coherent(dmab->dev.dev, size << PAGE_SHIFT, ++ page_address(sgbuf->pages[i]), ++ sgbuf->addrs[i] & PAGE_MASK); ++ else ++ do_free_pages(page_address(sgbuf->pages[i]), ++ size << PAGE_SHIFT, false); ++ i += size; ++ } ++ } + kvfree(sgbuf->pages); ++ kvfree(sgbuf->addrs); + kfree(sgbuf); + } + +@@ -739,24 +757,36 @@ static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size) + struct snd_dma_sg_fallback *sgbuf; + struct page **pagep, *curp; + size_t chunk, npages; ++ dma_addr_t *addrp; + dma_addr_t addr; + void *p; +- bool wc = dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK; ++ ++ /* correct the type */ ++ if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_SG) ++ dmab->dev.type = SNDRV_DMA_TYPE_DEV_SG_FALLBACK; ++ else if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG) ++ dmab->dev.type = SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK; + + sgbuf = kzalloc(sizeof(*sgbuf), GFP_KERNEL); + if (!sgbuf) + return NULL; ++ sgbuf->use_dma_alloc_coherent = cpu_feature_enabled(X86_FEATURE_XENPV); + size = PAGE_ALIGN(size); + sgbuf->count = size >> PAGE_SHIFT; + sgbuf->pages = kvcalloc(sgbuf->count, sizeof(*sgbuf->pages), GFP_KERNEL); +- if (!sgbuf->pages) ++ sgbuf->addrs = kvcalloc(sgbuf->count, sizeof(*sgbuf->addrs), GFP_KERNEL); ++ if (!sgbuf->pages || !sgbuf->addrs) + goto error; + + pagep = sgbuf->pages; +- chunk = size; ++ addrp = sgbuf->addrs; ++ chunk = (PAGE_SIZE - 1) << PAGE_SHIFT; /* to fit in low bits in addrs */ + while (size > 0) { + chunk = min(size, chunk); +- p = do_alloc_pages(dmab->dev.dev, chunk, &addr, wc); ++ if (sgbuf->use_dma_alloc_coherent) ++ p = dma_alloc_coherent(dmab->dev.dev, chunk, &addr, DEFAULT_GFP); ++ else ++ p = do_alloc_pages(dmab->dev.dev, chunk, &addr, false); + if (!p) { + if (chunk <= PAGE_SIZE) + goto error; +@@ -768,17 +798,25 @@ static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size) + size -= chunk; + /* fill pages */ + npages = chunk >> PAGE_SHIFT; ++ *addrp = npages; /* store in lower bits */ + curp = virt_to_page(p); +- while (npages--) ++ while (npages--) { + *pagep++ = curp++; ++ *addrp++ |= addr; ++ addr += PAGE_SIZE; ++ } + } + + p = vmap(sgbuf->pages, sgbuf->count, VM_MAP, PAGE_KERNEL); + if (!p) + goto error; ++ ++ if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK) ++ set_pages_array_wc(sgbuf->pages, sgbuf->count); ++ + dmab->private_data = sgbuf; + /* store the first page address for convenience */ +- dmab->addr = snd_sgbuf_get_addr(dmab, 0); ++ dmab->addr = sgbuf->addrs[0] & PAGE_MASK; + return p; + + error: +@@ -788,10 +826,23 @@ static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size) + + static void snd_dma_sg_fallback_free(struct snd_dma_buffer *dmab) + { ++ struct snd_dma_sg_fallback *sgbuf = dmab->private_data; ++ ++ if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK) ++ set_pages_array_wb(sgbuf->pages, sgbuf->count); + vunmap(dmab->area); + __snd_dma_sg_fallback_free(dmab, dmab->private_data); + } + ++static dma_addr_t snd_dma_sg_fallback_get_addr(struct snd_dma_buffer *dmab, ++ size_t offset) ++{ ++ struct snd_dma_sg_fallback *sgbuf = dmab->private_data; ++ size_t index = offset >> PAGE_SHIFT; ++ ++ return (sgbuf->addrs[index] & PAGE_MASK) | (offset & ~PAGE_MASK); ++} ++ + static int snd_dma_sg_fallback_mmap(struct snd_dma_buffer *dmab, + struct vm_area_struct *area) + { +@@ -806,8 +857,8 @@ static const struct snd_malloc_ops snd_dma_sg_fallback_ops = { + .alloc = snd_dma_sg_fallback_alloc, + .free = snd_dma_sg_fallback_free, + .mmap = snd_dma_sg_fallback_mmap, ++ .get_addr = snd_dma_sg_fallback_get_addr, + /* reuse vmalloc helpers */ +- .get_addr = snd_dma_vmalloc_get_addr, + .get_page = snd_dma_vmalloc_get_page, + .get_chunk_size = snd_dma_vmalloc_get_chunk_size, + }; +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-freescale-imx8dxl-fix-sc_pwrkey-s-property.patch b/queue-6.1/arm64-dts-freescale-imx8dxl-fix-sc_pwrkey-s-property.patch new file mode 100644 index 00000000000..bec13fa445a --- /dev/null +++ b/queue-6.1/arm64-dts-freescale-imx8dxl-fix-sc_pwrkey-s-property.patch @@ -0,0 +1,37 @@ +From 4ea53b7cd10a006c8703f5aa37eb58c2b8b7e23d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 16:07:40 -0500 +Subject: arm64: dts: freescale: imx8dxl: fix sc_pwrkey's property name + linux,keycode + +From: Frank Li + +[ Upstream commit cfb47bf5a470bdd80e8ac2f7b2f3a34563ecd4ea ] + +linux,keycode should be "linux,keycodes" according binding-doc +Documentation/devicetree/bindings/input/fsl,scu-key.yaml + +Fixes: f537ee7f1e76 ("arm64: dts: freescale: add i.MX8DXL SoC support") +Signed-off-by: Frank Li +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8dxl.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8dxl.dtsi b/arch/arm64/boot/dts/freescale/imx8dxl.dtsi +index 5ddbda0b4def..f2c4d13b2f3c 100644 +--- a/arch/arm64/boot/dts/freescale/imx8dxl.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8dxl.dtsi +@@ -157,7 +157,7 @@ + + sc_pwrkey: keys { + compatible = "fsl,imx8qxp-sc-key", "fsl,imx-sc-key"; +- linux,keycode = ; ++ linux,keycodes = ; + wakeup-source; + }; + +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-imx8m-venice-remove-incorrect-uart-has-rts.patch b/queue-6.1/arm64-dts-imx8m-venice-remove-incorrect-uart-has-rts.patch new file mode 100644 index 00000000000..0ad3e577394 --- /dev/null +++ b/queue-6.1/arm64-dts-imx8m-venice-remove-incorrect-uart-has-rts.patch @@ -0,0 +1,176 @@ +From f62189fe2d77d2ca4ed3ff227ab08797dfdb27d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 11:04:02 -0300 +Subject: arm64: dts: imx8m-venice: Remove incorrect 'uart-has-rtscts' + +From: Fabio Estevam + +[ Upstream commit fca053893e8d5be8173c92876c6329cbee78b880 ] + +The following build warnings are seen when running: + +make dtbs_check DT_SCHEMA_FILES=fsl-imx-uart.yaml + +arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dtb: serial@30860000: cts-gpios: False schema does not allow [[33, 3, 1]] + From schema: Documentation/devicetree/bindings/serial/fsl-imx-uart.yaml +arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dtb: serial@30860000: rts-gpios: False schema does not allow [[33, 5, 1]] + From schema: Documentation/devicetree/bindings/serial/fsl-imx-uart.yaml +... + +The imx8m Venice Gateworks boards do not expose the UART RTS and CTS +as native UART pins, so 'uart-has-rtscts' should not be used. + +Using 'uart-has-rtscts' with 'rts-gpios' is an invalid combination +detected by serial.yaml. + +Fix the problem by removing the incorrect 'uart-has-rtscts' property. + +Fixes: 27c8f4ccc1b9 ("arm64: dts: imx8mm-venice-gw72xx-0x: add dt overlays for serial modes") +Fixes: d9a9a7cf32c9 ("arm64: dts: imx8m{m,n}-venice-*: add missing uart-has-rtscts property to UARTs") +Fixes: 870f645b396b ("arm64: dts: imx8mp-venice-gw74xx: add WiFi/BT module support") +Signed-off-by: Fabio Estevam +Acked-by: Tim Harvey +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs232-rts.dts | 1 - + .../boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs232-rts.dts | 1 - + arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx.dtsi | 1 - + arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts | 3 --- + arch/arm64/boot/dts/freescale/imx8mm-venice-gw7902.dts | 3 --- + arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dts | 1 - + arch/arm64/boot/dts/freescale/imx8mn-venice-gw7902.dts | 1 - + arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts | 1 - + 8 files changed, 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs232-rts.dts b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs232-rts.dts +index 3ea73a6886ff..f6ad1a4b8b66 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs232-rts.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs232-rts.dts +@@ -33,7 +33,6 @@ + pinctrl-0 = <&pinctrl_uart2>; + rts-gpios = <&gpio5 29 GPIO_ACTIVE_LOW>; + cts-gpios = <&gpio5 28 GPIO_ACTIVE_LOW>; +- uart-has-rtscts; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs232-rts.dts b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs232-rts.dts +index 2fa635e1c1a8..1f8ea20dfafc 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs232-rts.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs232-rts.dts +@@ -33,7 +33,6 @@ + pinctrl-0 = <&pinctrl_uart2>; + rts-gpios = <&gpio5 29 GPIO_ACTIVE_LOW>; + cts-gpios = <&gpio5 28 GPIO_ACTIVE_LOW>; +- uart-has-rtscts; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx.dtsi +index 244ef8d6cc68..7761d5671cb1 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx.dtsi +@@ -222,7 +222,6 @@ + pinctrl-0 = <&pinctrl_uart3>, <&pinctrl_bten>; + cts-gpios = <&gpio5 8 GPIO_ACTIVE_LOW>; + rts-gpios = <&gpio5 9 GPIO_ACTIVE_LOW>; +- uart-has-rtscts; + status = "okay"; + + bluetooth { +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts +index 72311b55f06d..5a770c8b777e 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts +@@ -721,7 +721,6 @@ + dtr-gpios = <&gpio1 14 GPIO_ACTIVE_LOW>; + dsr-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>; + dcd-gpios = <&gpio1 11 GPIO_ACTIVE_LOW>; +- uart-has-rtscts; + status = "okay"; + }; + +@@ -737,7 +736,6 @@ + pinctrl-0 = <&pinctrl_uart3>, <&pinctrl_uart3_gpio>; + cts-gpios = <&gpio4 10 GPIO_ACTIVE_LOW>; + rts-gpios = <&gpio4 9 GPIO_ACTIVE_LOW>; +- uart-has-rtscts; + status = "okay"; + }; + +@@ -746,7 +744,6 @@ + pinctrl-0 = <&pinctrl_uart4>, <&pinctrl_uart4_gpio>; + cts-gpios = <&gpio5 11 GPIO_ACTIVE_LOW>; + rts-gpios = <&gpio5 12 GPIO_ACTIVE_LOW>; +- uart-has-rtscts; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7902.dts b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7902.dts +index 31f4c735fe4f..ba0b3f507855 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7902.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7902.dts +@@ -651,7 +651,6 @@ + pinctrl-0 = <&pinctrl_uart1>, <&pinctrl_uart1_gpio>; + rts-gpios = <&gpio4 10 GPIO_ACTIVE_LOW>; + cts-gpios = <&gpio4 24 GPIO_ACTIVE_LOW>; +- uart-has-rtscts; + status = "okay"; + }; + +@@ -668,7 +667,6 @@ + pinctrl-0 = <&pinctrl_uart3>, <&pinctrl_uart3_gpio>; + rts-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>; + cts-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>; +- uart-has-rtscts; + status = "okay"; + + bluetooth { +@@ -686,7 +684,6 @@ + dtr-gpios = <&gpio4 3 GPIO_ACTIVE_LOW>; + dsr-gpios = <&gpio4 4 GPIO_ACTIVE_LOW>; + dcd-gpios = <&gpio4 6 GPIO_ACTIVE_LOW>; +- uart-has-rtscts; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dts b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dts +index 19f6d2943d26..8e861b920d09 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dts +@@ -572,7 +572,6 @@ + dtr-gpios = <&gpio1 0 GPIO_ACTIVE_LOW>; + dsr-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>; + dcd-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>; +- uart-has-rtscts; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn-venice-gw7902.dts b/arch/arm64/boot/dts/freescale/imx8mn-venice-gw7902.dts +index dd4302ac1de4..e7362d7615bd 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn-venice-gw7902.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mn-venice-gw7902.dts +@@ -631,7 +631,6 @@ + pinctrl-0 = <&pinctrl_uart3>, <&pinctrl_uart3_gpio>; + rts-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>; + cts-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>; +- uart-has-rtscts; + status = "okay"; + + bluetooth { +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +index 06b4c93c5876..d68ef4f0726f 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +@@ -611,7 +611,6 @@ + pinctrl-0 = <&pinctrl_uart3>, <&pinctrl_uart3_gpio>; + cts-gpios = <&gpio3 21 GPIO_ACTIVE_LOW>; + rts-gpios = <&gpio3 22 GPIO_ACTIVE_LOW>; +- uart-has-rtscts; + status = "okay"; + + bluetooth { +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-imx8mm-fix-pad-control-for-uart1_dte_rx.patch b/queue-6.1/arm64-dts-imx8mm-fix-pad-control-for-uart1_dte_rx.patch new file mode 100644 index 00000000000..335b0e37240 --- /dev/null +++ b/queue-6.1/arm64-dts-imx8mm-fix-pad-control-for-uart1_dte_rx.patch @@ -0,0 +1,43 @@ +From 741f0f9a5d820a5208119d6f11ee556a40efbacd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Jan 2023 22:35:03 +0100 +Subject: arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pierluigi Passaro + +[ Upstream commit 47123900f3e4a7f769631d6ec15abf44086276f6 ] + +According section +    8.2.5.313 Select Input Register (IOMUXC_UART1_RXD_SELECT_INPUT) +of  +    i.MX 8M Mini Applications Processor Reference Manual, Rev. 3, 11/2020 +the required setting for this specific pin configuration is "1" + +Signed-off-by: Pierluigi Passaro +Reviewed-by: Fabio Estevam +Fixes: c1c9d41319c3 ("dt-bindings: imx: Add pinctrl binding doc for imx8mm") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h +index 83c8f715cd90..b1f11098d248 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h ++++ b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h +@@ -602,7 +602,7 @@ + #define MX8MM_IOMUXC_UART1_RXD_GPIO5_IO22 0x234 0x49C 0x000 0x5 0x0 + #define MX8MM_IOMUXC_UART1_RXD_TPSMP_HDATA24 0x234 0x49C 0x000 0x7 0x0 + #define MX8MM_IOMUXC_UART1_TXD_UART1_DCE_TX 0x238 0x4A0 0x000 0x0 0x0 +-#define MX8MM_IOMUXC_UART1_TXD_UART1_DTE_RX 0x238 0x4A0 0x4F4 0x0 0x0 ++#define MX8MM_IOMUXC_UART1_TXD_UART1_DTE_RX 0x238 0x4A0 0x4F4 0x0 0x1 + #define MX8MM_IOMUXC_UART1_TXD_ECSPI3_MOSI 0x238 0x4A0 0x000 0x1 0x0 + #define MX8MM_IOMUXC_UART1_TXD_GPIO5_IO23 0x238 0x4A0 0x000 0x5 0x0 + #define MX8MM_IOMUXC_UART1_TXD_TPSMP_HDATA25 0x238 0x4A0 0x000 0x7 0x0 +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-imx8mm-verdin-do-not-power-down-eth-phy.patch b/queue-6.1/arm64-dts-imx8mm-verdin-do-not-power-down-eth-phy.patch new file mode 100644 index 00000000000..7d23ce30afe --- /dev/null +++ b/queue-6.1/arm64-dts-imx8mm-verdin-do-not-power-down-eth-phy.patch @@ -0,0 +1,49 @@ +From fb2253bd739d56a269035b365f9ce206f5d9824c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jan 2023 15:01:52 +0100 +Subject: arm64: dts: imx8mm-verdin: Do not power down eth-phy + +From: Philippe Schenker + +[ Upstream commit 39c95d0c357d7ef76aea958c1bece6b24f9b2e7e ] + +Currently if suspending using either freeze or memory state, the fec +driver tries to power down the phy which leads to crash of the kernel +and non-responsible kernel with the following call trace: + +[ 24.839889 ] Call trace: +[ 24.839892 ] phy_error+0x18/0x60 +[ 24.839898 ] kszphy_handle_interrupt+0x6c/0x80 +[ 24.839903 ] phy_interrupt+0x20/0x2c +[ 24.839909 ] irq_thread_fn+0x30/0xa0 +[ 24.839919 ] irq_thread+0x178/0x2c0 +[ 24.839925 ] kthread+0x154/0x160 +[ 24.839932 ] ret_from_fork+0x10/0x20 + +Since there is currently no functionality in the phy subsystem to power +down phys let's just disable the feature of powering-down the ethernet +phy. + +Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") +Signed-off-by: Philippe Schenker +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +index bcab830c6e95..59445f916d7f 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +@@ -98,6 +98,7 @@ + off-on-delay = <500000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_reg_eth>; ++ regulator-always-on; + regulator-boot-on; + regulator-max-microvolt = <3300000>; + regulator-min-microvolt = <3300000>; +-- +2.39.0 + diff --git a/queue-6.1/asoc-amd-acp-es8336-drop-reference-count-of-acpi-dev.patch b/queue-6.1/asoc-amd-acp-es8336-drop-reference-count-of-acpi-dev.patch new file mode 100644 index 00000000000..15f4c255961 --- /dev/null +++ b/queue-6.1/asoc-amd-acp-es8336-drop-reference-count-of-acpi-dev.patch @@ -0,0 +1,49 @@ +From 5419eacbb98f30506fc41ee0b2e92ef9ed33715a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 13:23:56 +0200 +Subject: ASoC: amd: acp-es8336: Drop reference count of ACPI device after use + +From: Andy Shevchenko + +[ Upstream commit d784fc8be6814b31854f7b529919ca4506ff8066 ] + +Theoretically the device might gone if its reference count drops to 0. +This might be the case when we try to find the first physical node of +the ACPI device. We need to keep reference to it until we get a result +of the above mentioned call. Refactor the code to drop the reference +count at the correct place. + +While at it, move to acpi_dev_put() as symmetrical call to the +acpi_dev_get_first_match_dev(). + +Fixes: 02527c3f2300 ("ASoC: amd: add Machine driver for Jadeite platform") +Signed-off-by: Andy Shevchenko +Acked-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/20230112112356.67643-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp-es8336.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/amd/acp-es8336.c b/sound/soc/amd/acp-es8336.c +index 2fe8df86053a..89499542c803 100644 +--- a/sound/soc/amd/acp-es8336.c ++++ b/sound/soc/amd/acp-es8336.c +@@ -198,9 +198,11 @@ static int st_es8336_late_probe(struct snd_soc_card *card) + int ret; + + adev = acpi_dev_get_first_match_dev("ESSX8336", NULL, -1); +- if (adev) +- put_device(&adev->dev); ++ if (!adev) ++ return -ENODEV; ++ + codec_dev = acpi_get_first_physical_node(adev); ++ acpi_dev_put(adev); + if (!codec_dev) + dev_err(card->dev, "can not find codec dev\n"); + +-- +2.39.0 + diff --git a/queue-6.1/asoc-intel-avs-implement-pci-shutdown.patch b/queue-6.1/asoc-intel-avs-implement-pci-shutdown.patch new file mode 100644 index 00000000000..db460fb7e83 --- /dev/null +++ b/queue-6.1/asoc-intel-avs-implement-pci-shutdown.patch @@ -0,0 +1,73 @@ +From 3586444c1dcc8cc075f7bf15903b973ec0423487 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 20:03:08 +0100 +Subject: ASoC: Intel: avs: Implement PCI shutdown +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit f89d783d68dcc6b2ce4fe3bda972ae0f84df0dca ] + +On shutdown reference to i915 driver needs to be released to not spam +logs with unnecessary warnings. While at it do some additional cleanup +to make sure DSP is powered down and interrupts from device are +disabled. + +Fixes: 1affc44ea5dd ("ASoC: Intel: avs: PCI driver implementation") +Reported-by: Kornel Dulęba +Signed-off-by: Amadeusz Sławiński +Reviewed-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20230113190310.1451693-2-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/core.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c +index 4f93639ce488..5bb3eee2f783 100644 +--- a/sound/soc/intel/avs/core.c ++++ b/sound/soc/intel/avs/core.c +@@ -476,6 +476,29 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + return ret; + } + ++static void avs_pci_shutdown(struct pci_dev *pci) ++{ ++ struct hdac_bus *bus = pci_get_drvdata(pci); ++ struct avs_dev *adev = hdac_to_avs(bus); ++ ++ cancel_work_sync(&adev->probe_work); ++ avs_ipc_block(adev->ipc); ++ ++ snd_hdac_stop_streams(bus); ++ avs_dsp_op(adev, int_control, false); ++ snd_hdac_ext_bus_ppcap_int_enable(bus, false); ++ snd_hdac_ext_bus_link_power_down_all(bus); ++ ++ snd_hdac_bus_stop_chip(bus); ++ snd_hdac_display_power(bus, HDA_CODEC_IDX_CONTROLLER, false); ++ ++ if (avs_platattr_test(adev, CLDMA)) ++ pci_free_irq(pci, 0, &code_loader); ++ pci_free_irq(pci, 0, adev); ++ pci_free_irq(pci, 0, bus); ++ pci_free_irq_vectors(pci); ++} ++ + static void avs_pci_remove(struct pci_dev *pci) + { + struct hdac_device *hdev, *save; +@@ -679,6 +702,7 @@ static struct pci_driver avs_pci_driver = { + .id_table = avs_ids, + .probe = avs_pci_probe, + .remove = avs_pci_remove, ++ .shutdown = avs_pci_shutdown, + .driver = { + .pm = &avs_dev_pm, + }, +-- +2.39.0 + diff --git a/queue-6.1/asoc-intel-bytcht_es8316-drop-reference-count-of-acp.patch b/queue-6.1/asoc-intel-bytcht_es8316-drop-reference-count-of-acp.patch new file mode 100644 index 00000000000..9ac7f59bd7e --- /dev/null +++ b/queue-6.1/asoc-intel-bytcht_es8316-drop-reference-count-of-acp.patch @@ -0,0 +1,84 @@ +From f9ff09e3ad46aa8d4b35dfbd8a079ceb7a2df3b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 13:28:48 +0200 +Subject: ASoC: Intel: bytcht_es8316: Drop reference count of ACPI device after + use + +From: Andy Shevchenko + +[ Upstream commit 6b1c0bd6fdefbf3c3d75680c2708f5423ef72e46 ] + +Theoretically the device might gone if its reference count drops to 0. +This might be the case when we try to find the first physical node of +the ACPI device. We need to keep reference to it until we get a result +of the above mentioned call. Refactor the code to drop the reference +count at the correct place. + +While at it, move to acpi_dev_put() as symmetrical call to the +acpi_dev_get_first_match_dev(). + +Fixes: 3c22a73fb873 ("ASoC: Intel: bytcht_es8316: fix HID handling") +Signed-off-by: Andy Shevchenko +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20230112112852.67714-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcht_es8316.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index a935c5fd9edb..4dd37848b30e 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -497,21 +497,28 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev) + if (adev) { + snprintf(codec_name, sizeof(codec_name), + "i2c-%s", acpi_dev_name(adev)); +- put_device(&adev->dev); + byt_cht_es8316_dais[dai_index].codecs->name = codec_name; + } else { + dev_err(dev, "Error cannot find '%s' dev\n", mach->id); + return -ENXIO; + } + ++ codec_dev = acpi_get_first_physical_node(adev); ++ acpi_dev_put(adev); ++ if (!codec_dev) ++ return -EPROBE_DEFER; ++ priv->codec_dev = get_device(codec_dev); ++ + /* override platform name, if required */ + byt_cht_es8316_card.dev = dev; + platform_name = mach->mach_params.platform; + + ret = snd_soc_fixup_dai_links_platform_name(&byt_cht_es8316_card, + platform_name); +- if (ret) ++ if (ret) { ++ put_device(codec_dev); + return ret; ++ } + + /* Check for BYTCR or other platform and setup quirks */ + dmi_id = dmi_first_match(byt_cht_es8316_quirk_table); +@@ -539,13 +546,10 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev) + + /* get the clock */ + priv->mclk = devm_clk_get(dev, "pmc_plt_clk_3"); +- if (IS_ERR(priv->mclk)) ++ if (IS_ERR(priv->mclk)) { ++ put_device(codec_dev); + return dev_err_probe(dev, PTR_ERR(priv->mclk), "clk_get pmc_plt_clk_3 failed\n"); +- +- codec_dev = acpi_get_first_physical_node(adev); +- if (!codec_dev) +- return -EPROBE_DEFER; +- priv->codec_dev = get_device(codec_dev); ++ } + + if (quirk & BYT_CHT_ES8316_JD_INVERTED) + props[cnt++] = PROPERTY_ENTRY_BOOL("everest,jack-detect-inverted"); +-- +2.39.0 + diff --git a/queue-6.1/asoc-intel-bytcr_rt5640-drop-reference-count-of-acpi.patch b/queue-6.1/asoc-intel-bytcr_rt5640-drop-reference-count-of-acpi.patch new file mode 100644 index 00000000000..ee0611b3b37 --- /dev/null +++ b/queue-6.1/asoc-intel-bytcr_rt5640-drop-reference-count-of-acpi.patch @@ -0,0 +1,68 @@ +From 846f2e32ea985246796e1d411816befd2fd90b0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 13:28:50 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Drop reference count of ACPI device after + use + +From: Andy Shevchenko + +[ Upstream commit cbf87bcf46e399e9a5288430d940efbad3551c68 ] + +Theoretically the device might gone if its reference count drops to 0. +This might be the case when we try to find the first physical node of +the ACPI device. We need to keep reference to it until we get a result +of the above mentioned call. Refactor the code to drop the reference +count at the correct place. + +While at it, move to acpi_dev_put() as symmetrical call to the +acpi_dev_get_first_match_dev(). + +Fixes: a232b96dcece ("ASoC: Intel: bytcr_rt5640: use HID translation util") +Signed-off-by: Andy Shevchenko +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20230112112852.67714-4-andriy.shevchenko@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index ddd2625bed90..4f46f52c38e4 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -1626,13 +1626,18 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + if (adev) { + snprintf(byt_rt5640_codec_name, sizeof(byt_rt5640_codec_name), + "i2c-%s", acpi_dev_name(adev)); +- put_device(&adev->dev); + byt_rt5640_dais[dai_index].codecs->name = byt_rt5640_codec_name; + } else { + dev_err(dev, "Error cannot find '%s' dev\n", mach->id); + return -ENXIO; + } + ++ codec_dev = acpi_get_first_physical_node(adev); ++ acpi_dev_put(adev); ++ if (!codec_dev) ++ return -EPROBE_DEFER; ++ priv->codec_dev = get_device(codec_dev); ++ + /* + * swap SSP0 if bytcr is detected + * (will be overridden if DMI quirk is detected) +@@ -1707,11 +1712,6 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + byt_rt5640_quirk = quirk_override; + } + +- codec_dev = acpi_get_first_physical_node(adev); +- if (!codec_dev) +- return -EPROBE_DEFER; +- priv->codec_dev = get_device(codec_dev); +- + if (byt_rt5640_quirk & BYT_RT5640_JD_HP_ELITEP_1000G2) { + acpi_dev_add_driver_gpios(ACPI_COMPANION(priv->codec_dev), + byt_rt5640_hp_elitepad_1000g2_gpios); +-- +2.39.0 + diff --git a/queue-6.1/asoc-intel-bytcr_rt5651-drop-reference-count-of-acpi.patch b/queue-6.1/asoc-intel-bytcr_rt5651-drop-reference-count-of-acpi.patch new file mode 100644 index 00000000000..cc837df486a --- /dev/null +++ b/queue-6.1/asoc-intel-bytcr_rt5651-drop-reference-count-of-acpi.patch @@ -0,0 +1,52 @@ +From 4025a0bc5017b66fa01627419567cb367df46e4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 13:28:49 +0200 +Subject: ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after + use + +From: Andy Shevchenko + +[ Upstream commit 721858823d7cdc8f2a897579b040e935989f6f02 ] + +Theoretically the device might gone if its reference count drops to 0. +This might be the case when we try to find the first physical node of +the ACPI device. We need to keep reference to it until we get a result +of the above mentioned call. Refactor the code to drop the reference +count at the correct place. + +While at it, move to acpi_dev_put() as symmetrical call to the +acpi_dev_get_first_match_dev(). + +Fixes: 02c0a3b3047f ("ASoC: Intel: bytcr_rt5651: add MCLK, quirks and cleanups") +Signed-off-by: Andy Shevchenko +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20230112112852.67714-3-andriy.shevchenko@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5651.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c +index 2beb686768f2..d74d184e1c7f 100644 +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -922,7 +922,6 @@ static int snd_byt_rt5651_mc_probe(struct platform_device *pdev) + if (adev) { + snprintf(byt_rt5651_codec_name, sizeof(byt_rt5651_codec_name), + "i2c-%s", acpi_dev_name(adev)); +- put_device(&adev->dev); + byt_rt5651_dais[dai_index].codecs->name = byt_rt5651_codec_name; + } else { + dev_err(dev, "Error cannot find '%s' dev\n", mach->id); +@@ -930,6 +929,7 @@ static int snd_byt_rt5651_mc_probe(struct platform_device *pdev) + } + + codec_dev = acpi_get_first_physical_node(adev); ++ acpi_dev_put(adev); + if (!codec_dev) + return -EPROBE_DEFER; + priv->codec_dev = get_device(codec_dev); +-- +2.39.0 + diff --git a/queue-6.1/asoc-intel-bytcr_wm5102-drop-reference-count-of-acpi.patch b/queue-6.1/asoc-intel-bytcr_wm5102-drop-reference-count-of-acpi.patch new file mode 100644 index 00000000000..cbf435e4b7f --- /dev/null +++ b/queue-6.1/asoc-intel-bytcr_wm5102-drop-reference-count-of-acpi.patch @@ -0,0 +1,47 @@ +From 2f29cc175c02a95178aea6db188d79c9b54d8644 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 13:28:51 +0200 +Subject: ASoC: Intel: bytcr_wm5102: Drop reference count of ACPI device after + use + +From: Andy Shevchenko + +[ Upstream commit c8aa49abdeda2ab587aadb083e670f6aa0236f93 ] + +Theoretically the device might gone if its reference count drops to 0. +This might be the case when we try to find the first physical node of +the ACPI device. We need to keep reference to it until we get a result +of the above mentioned call. Refactor the code to drop the reference +count at the correct place. + +While at it, move to acpi_dev_put() as symmetrical call to the +acpi_dev_get_first_match_dev(). + +Fixes: 9a87fc1e0619 ("ASoC: Intel: bytcr_wm5102: Add machine driver for BYT/WM5102") +Signed-off-by: Andy Shevchenko +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20230112112852.67714-5-andriy.shevchenko@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_wm5102.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/bytcr_wm5102.c b/sound/soc/intel/boards/bytcr_wm5102.c +index 45a6805787f5..f8da1bcd010e 100644 +--- a/sound/soc/intel/boards/bytcr_wm5102.c ++++ b/sound/soc/intel/boards/bytcr_wm5102.c +@@ -411,9 +411,9 @@ static int snd_byt_wm5102_mc_probe(struct platform_device *pdev) + return -ENOENT; + } + snprintf(codec_name, sizeof(codec_name), "spi-%s", acpi_dev_name(adev)); +- put_device(&adev->dev); + + codec_dev = bus_find_device_by_name(&spi_bus_type, NULL, codec_name); ++ acpi_dev_put(adev); + if (!codec_dev) + return -EPROBE_DEFER; + +-- +2.39.0 + diff --git a/queue-6.1/asoc-intel-sof_es8336-drop-reference-count-of-acpi-d.patch b/queue-6.1/asoc-intel-sof_es8336-drop-reference-count-of-acpi-d.patch new file mode 100644 index 00000000000..9ef4e2a635d --- /dev/null +++ b/queue-6.1/asoc-intel-sof_es8336-drop-reference-count-of-acpi-d.patch @@ -0,0 +1,69 @@ +From 8aa5b026f83d17e1433c1ce6c3c19f2a2d702d80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 13:28:52 +0200 +Subject: ASoC: Intel: sof_es8336: Drop reference count of ACPI device after + use + +From: Andy Shevchenko + +[ Upstream commit 64e57b2195725c1ae2246a8a2ce224abb60620ac ] + +Theoretically the device might gone if its reference count drops to 0. +This might be the case when we try to find the first physical node of +the ACPI device. We need to keep reference to it until we get a result +of the above mentioned call. Refactor the code to drop the reference +count at the correct place. + +While at it, move to acpi_dev_put() as symmetrical call to the +acpi_dev_get_first_match_dev(). + +Fixes: a164137ce91a ("ASoC: Intel: add machine driver for SOF+ES8336") +Signed-off-by: Andy Shevchenko +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20230112112852.67714-6-andriy.shevchenko@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_es8336.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c +index 773e5d1d87d4..894b6610b9e2 100644 +--- a/sound/soc/intel/boards/sof_es8336.c ++++ b/sound/soc/intel/boards/sof_es8336.c +@@ -681,7 +681,6 @@ static int sof_es8336_probe(struct platform_device *pdev) + if (adev) { + snprintf(codec_name, sizeof(codec_name), + "i2c-%s", acpi_dev_name(adev)); +- put_device(&adev->dev); + dai_links[0].codecs->name = codec_name; + + /* also fixup codec dai name if relevant */ +@@ -692,16 +691,19 @@ static int sof_es8336_probe(struct platform_device *pdev) + return -ENXIO; + } + +- ret = snd_soc_fixup_dai_links_platform_name(&sof_es8336_card, +- mach->mach_params.platform); +- if (ret) +- return ret; +- + codec_dev = acpi_get_first_physical_node(adev); ++ acpi_dev_put(adev); + if (!codec_dev) + return -EPROBE_DEFER; + priv->codec_dev = get_device(codec_dev); + ++ ret = snd_soc_fixup_dai_links_platform_name(&sof_es8336_card, ++ mach->mach_params.platform); ++ if (ret) { ++ put_device(codec_dev); ++ return ret; ++ } ++ + if (quirk & SOF_ES8336_JD_INVERTED) + props[cnt++] = PROPERTY_ENTRY_BOOL("everest,jack-detect-inverted"); + +-- +2.39.0 + diff --git a/queue-6.1/asoc-sof-ipc4-mtrace-prevent-underflow-in-sof_ipc4_p.patch b/queue-6.1/asoc-sof-ipc4-mtrace-prevent-underflow-in-sof_ipc4_p.patch new file mode 100644 index 00000000000..f8374f3a8a3 --- /dev/null +++ b/queue-6.1/asoc-sof-ipc4-mtrace-prevent-underflow-in-sof_ipc4_p.patch @@ -0,0 +1,54 @@ +From 796c68693cc5781f2e2e78d0ff2731915ae0e97b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 17:58:54 +0300 +Subject: ASoC: SOF: ipc4-mtrace: prevent underflow in + sof_ipc4_priority_mask_dfs_write() + +From: Dan Carpenter + +[ Upstream commit ea57680af47587397f5005d7758022441ed66d54 ] + +The "id" comes from the user. Change the type to unsigned to prevent +an array underflow. + +Fixes: f4ea22f7aa75 ("ASoC: SOF: ipc4: Add support for mtrace log extraction") +Signed-off-by: Dan Carpenter +Acked-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/Y8laruWOEwOC/dx9@kili +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4-mtrace.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/sof/ipc4-mtrace.c b/sound/soc/sof/ipc4-mtrace.c +index 70dea8ae706e..0ec6ef681012 100644 +--- a/sound/soc/sof/ipc4-mtrace.c ++++ b/sound/soc/sof/ipc4-mtrace.c +@@ -344,9 +344,10 @@ static ssize_t sof_ipc4_priority_mask_dfs_write(struct file *file, + size_t count, loff_t *ppos) + { + struct sof_mtrace_priv *priv = file->private_data; +- int id, ret; ++ unsigned int id; + char *buf; + u32 mask; ++ int ret; + + /* + * To update Nth mask entry, write: +@@ -357,9 +358,9 @@ static ssize_t sof_ipc4_priority_mask_dfs_write(struct file *file, + if (IS_ERR(buf)) + return PTR_ERR(buf); + +- ret = sscanf(buf, "%d,0x%x", &id, &mask); ++ ret = sscanf(buf, "%u,0x%x", &id, &mask); + if (ret != 2) { +- ret = sscanf(buf, "%d,%x", &id, &mask); ++ ret = sscanf(buf, "%u,%x", &id, &mask); + if (ret != 2) { + ret = -EINVAL; + goto out; +-- +2.39.0 + diff --git a/queue-6.1/ata-libata-fix-sata_down_spd_limit-when-no-link-spee.patch b/queue-6.1/ata-libata-fix-sata_down_spd_limit-when-no-link-spee.patch new file mode 100644 index 00000000000..a85227e44dd --- /dev/null +++ b/queue-6.1/ata-libata-fix-sata_down_spd_limit-when-no-link-spee.patch @@ -0,0 +1,57 @@ +From 1ff97ff6a50a22ea6c8f7eacc82f11feacc7d817 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 12:27:41 +0900 +Subject: ata: libata: Fix sata_down_spd_limit() when no link speed is reported + +From: Damien Le Moal + +[ Upstream commit 69f2c9346313ba3d3dfa4091ff99df26c67c9021 ] + +Commit 2dc0b46b5ea3 ("libata: sata_down_spd_limit should return if +driver has not recorded sstatus speed") changed the behavior of +sata_down_spd_limit() to return doing nothing if a drive does not report +a current link speed, to avoid reducing the link speed to the lowest 1.5 +Gbps speed. + +However, the change assumed that a speed was recorded before probing +(e.g. before a suspend/resume) and set in link->sata_spd. This causes +problems with adapters/drives combination failing to establish a link +speed during probe autonegotiation. One example reported of this problem +is an mvebu adapter with a 3Gbps port-multiplier box: autonegotiation +fails, leaving no recorded link speed and no reported current link +speed. Probe retries also fail as no action is taken by sata_set_spd() +after each retry. + +Fix this by returning early in sata_down_spd_limit() only if we do have +a recorded link speed, that is, if link->sata_spd is not 0. With this +fix, a failed probe not leading to a recorded link speed is retried at +the lower 1.5 Gbps speed, with the link speed potentially increased +later on the second revalidate of the device if the device reports +that it supports higher link speeds. + +Reported-by: Marius Dinu +Fixes: 2dc0b46b5ea3 ("libata: sata_down_spd_limit should return if driver has not recorded sstatus speed") +Reviewed-by: Niklas Cassel +Tested-by: Marius Dinu +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index d3ce5c383f3a..26a75f5cce95 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -3108,7 +3108,7 @@ int sata_down_spd_limit(struct ata_link *link, u32 spd_limit) + */ + if (spd > 1) + mask &= (1 << (spd - 1)) - 1; +- else ++ else if (link->sata_spd) + return -EINVAL; + + /* were we already at the bottom? */ +-- +2.39.0 + diff --git a/queue-6.1/bcache-silence-memcpy-run-time-false-positive-warnin.patch b/queue-6.1/bcache-silence-memcpy-run-time-false-positive-warnin.patch new file mode 100644 index 00000000000..9dce573ed1a --- /dev/null +++ b/queue-6.1/bcache-silence-memcpy-run-time-false-positive-warnin.patch @@ -0,0 +1,63 @@ +From 2caec17ccc2ec59bc4be9d1b298a5ff24e8a4f75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jan 2023 22:02:33 -0800 +Subject: bcache: Silence memcpy() run-time false positive warnings + +From: Kees Cook + +[ Upstream commit be0d8f48ad97f5b775b0af3310343f676dbf318a ] + +struct bkey has internal padding in a union, but it isn't always named +the same (e.g. key ## _pad, key_p, etc). This makes it extremely hard +for the compiler to reason about the available size of copies done +against such keys. Use unsafe_memcpy() for now, to silence the many +run-time false positive warnings: + + memcpy: detected field-spanning write (size 264) of single field "&i->j" at drivers/md/bcache/journal.c:152 (size 240) + memcpy: detected field-spanning write (size 24) of single field "&b->key" at drivers/md/bcache/btree.c:939 (size 16) + memcpy: detected field-spanning write (size 24) of single field "&temp.key" at drivers/md/bcache/extents.c:428 (size 16) + +Reported-by: Alexandre Pereira +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216785 +Acked-by: Coly Li +Cc: Kent Overstreet +Cc: linux-bcache@vger.kernel.org +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20230106060229.never.047-kees@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/bcache_ondisk.h | 3 ++- + drivers/md/bcache/journal.c | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/bcache/bcache_ondisk.h b/drivers/md/bcache/bcache_ondisk.h +index 97413586195b..f96034e0ba4f 100644 +--- a/drivers/md/bcache/bcache_ondisk.h ++++ b/drivers/md/bcache/bcache_ondisk.h +@@ -106,7 +106,8 @@ static inline unsigned long bkey_bytes(const struct bkey *k) + return bkey_u64s(k) * sizeof(__u64); + } + +-#define bkey_copy(_dest, _src) memcpy(_dest, _src, bkey_bytes(_src)) ++#define bkey_copy(_dest, _src) unsafe_memcpy(_dest, _src, bkey_bytes(_src), \ ++ /* bkey is always padded */) + + static inline void bkey_copy_key(struct bkey *dest, const struct bkey *src) + { +diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c +index e5da469a4235..c182c21de2e8 100644 +--- a/drivers/md/bcache/journal.c ++++ b/drivers/md/bcache/journal.c +@@ -149,7 +149,8 @@ reread: left = ca->sb.bucket_size - offset; + bytes, GFP_KERNEL); + if (!i) + return -ENOMEM; +- memcpy(&i->j, j, bytes); ++ unsafe_memcpy(&i->j, j, bytes, ++ /* "bytes" was calculated by set_bytes() above */); + /* Add to the location after 'where' points to */ + list_add(&i->list, where); + ret = 1; +-- +2.39.0 + diff --git a/queue-6.1/block-bfq-fix-uaf-for-bfqq-in-bic_set_bfqq.patch b/queue-6.1/block-bfq-fix-uaf-for-bfqq-in-bic_set_bfqq.patch new file mode 100644 index 00000000000..729f5f3553b --- /dev/null +++ b/queue-6.1/block-bfq-fix-uaf-for-bfqq-in-bic_set_bfqq.patch @@ -0,0 +1,62 @@ +From e6711f08f95034aec1e04ff3e9330e8f48782480 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 09:41:36 +0800 +Subject: block, bfq: fix uaf for bfqq in bic_set_bfqq() + +From: Yu Kuai + +[ Upstream commit b600de2d7d3a16f9007fad1bdae82a3951a26af2 ] + +After commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'"), +bic->bfqq will be accessed in bic_set_bfqq(), however, in some context +bic->bfqq will be freed, and bic_set_bfqq() is called with the freed +bic->bfqq. + +Fix the problem by always freeing bfqq after bic_set_bfqq(). + +Fixes: 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") +Reported-and-tested-by: Shinichiro Kawasaki +Signed-off-by: Yu Kuai +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230130014136.591038-1-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-cgroup.c | 2 +- + block/bfq-iosched.c | 4 +++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index dfb6d1d8bd46..60b4299bec8e 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -761,8 +761,8 @@ static void *__bfq_bic_change_cgroup(struct bfq_data *bfqd, + * request from the old cgroup. + */ + bfq_put_cooperator(sync_bfqq); +- bfq_release_process_ref(bfqd, sync_bfqq); + bic_set_bfqq(bic, NULL, true); ++ bfq_release_process_ref(bfqd, sync_bfqq); + } + } + } +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 917939b60ef8..ff9d23889415 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -5491,9 +5491,11 @@ static void bfq_check_ioprio_change(struct bfq_io_cq *bic, struct bio *bio) + + bfqq = bic_to_bfqq(bic, false); + if (bfqq) { +- bfq_release_process_ref(bfqd, bfqq); ++ struct bfq_queue *old_bfqq = bfqq; ++ + bfqq = bfq_get_queue(bfqd, bio, false, bic, true); + bic_set_bfqq(bic, bfqq, false); ++ bfq_release_process_ref(bfqd, old_bfqq); + } + + bfqq = bic_to_bfqq(bic, true); +-- +2.39.0 + diff --git a/queue-6.1/block-bfq-replace-0-1-with-false-true-in-bic-apis.patch b/queue-6.1/block-bfq-replace-0-1-with-false-true-in-bic-apis.patch new file mode 100644 index 00000000000..2c98715c444 --- /dev/null +++ b/queue-6.1/block-bfq-replace-0-1-with-false-true-in-bic-apis.patch @@ -0,0 +1,79 @@ +From ba6460877c5b3e323e12d59f16cbdde4ce248b37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Dec 2022 11:31:55 +0800 +Subject: block, bfq: replace 0/1 with false/true in bic apis + +From: Yu Kuai + +[ Upstream commit 337366e02b370d2800110fbc99940f6ddddcbdfa ] + +Just to make the code a litter cleaner, there are no functional changes. + +Signed-off-by: Yu Kuai +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20221214033155.3455754-3-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Stable-dep-of: b600de2d7d3a ("block, bfq: fix uaf for bfqq in bic_set_bfqq()") +Signed-off-by: Sasha Levin +--- + block/bfq-cgroup.c | 8 ++++---- + block/bfq-iosched.c | 4 ++-- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index 7d624a3a3f0f..dfb6d1d8bd46 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -718,15 +718,15 @@ static void *__bfq_bic_change_cgroup(struct bfq_data *bfqd, + struct bfq_io_cq *bic, + struct bfq_group *bfqg) + { +- struct bfq_queue *async_bfqq = bic_to_bfqq(bic, 0); +- struct bfq_queue *sync_bfqq = bic_to_bfqq(bic, 1); ++ struct bfq_queue *async_bfqq = bic_to_bfqq(bic, false); ++ struct bfq_queue *sync_bfqq = bic_to_bfqq(bic, true); + struct bfq_entity *entity; + + if (async_bfqq) { + entity = &async_bfqq->entity; + + if (entity->sched_data != &bfqg->sched_data) { +- bic_set_bfqq(bic, NULL, 0); ++ bic_set_bfqq(bic, NULL, false); + bfq_release_process_ref(bfqd, async_bfqq); + } + } +@@ -762,7 +762,7 @@ static void *__bfq_bic_change_cgroup(struct bfq_data *bfqd, + */ + bfq_put_cooperator(sync_bfqq); + bfq_release_process_ref(bfqd, sync_bfqq); +- bic_set_bfqq(bic, NULL, 1); ++ bic_set_bfqq(bic, NULL, true); + } + } + } +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 7b894df32e32..917939b60ef8 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -3180,7 +3180,7 @@ bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic, + /* + * Merge queues (that is, let bic redirect its requests to new_bfqq) + */ +- bic_set_bfqq(bic, new_bfqq, 1); ++ bic_set_bfqq(bic, new_bfqq, true); + bfq_mark_bfqq_coop(new_bfqq); + /* + * new_bfqq now belongs to at least two bics (it is a shared queue): +@@ -6627,7 +6627,7 @@ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq) + return bfqq; + } + +- bic_set_bfqq(bic, NULL, 1); ++ bic_set_bfqq(bic, NULL, true); + + bfq_put_cooperator(bfqq); + +-- +2.39.0 + diff --git a/queue-6.1/block-ublk-extending-queue_size-to-fix-overflow.patch b/queue-6.1/block-ublk-extending-queue_size-to-fix-overflow.patch new file mode 100644 index 00000000000..64f328548cb --- /dev/null +++ b/queue-6.1/block-ublk-extending-queue_size-to-fix-overflow.patch @@ -0,0 +1,53 @@ +From 0fce056679bf830de1c3cfedf40ed027240fe5a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 02:05:52 -0500 +Subject: block: ublk: extending queue_size to fix overflow + +From: Liu Xiaodong + +[ Upstream commit 29baef789c838bd5c02f50c88adbbc6b955aaf61 ] + +When validating drafted SPDK ublk target, in a case that +assigning large queue depth to multiqueue ublk device, +ublk target would run into a weird incorrect state. During +rounds of review and debug, An overflow bug was found +in ublk driver. + +In ublk_cmd.h, UBLK_MAX_QUEUE_DEPTH is 4096 which means +each ublk queue depth can be set as large as 4096. But +when setting qd for a ublk device, +sizeof(struct ublk_queue) + depth * sizeof(struct ublk_io) +will be larger than 65535 if qd is larger than 2728. +Then queue_size is overflowed, and ublk_get_queue() +references a wrong pointer position. The wrong content of +ublk_queue elements will lead to out-of-bounds memory +access. + +Extend queue_size in ublk_device as "unsigned int". + +Signed-off-by: Liu Xiaodong +Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20230131070552.115067-1-xiaodong.liu@intel.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/ublk_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c +index e54693204630..6368b56eacf1 100644 +--- a/drivers/block/ublk_drv.c ++++ b/drivers/block/ublk_drv.c +@@ -137,7 +137,7 @@ struct ublk_device { + + char *__queues; + +- unsigned short queue_size; ++ unsigned int queue_size; + struct ublksrv_ctrl_dev_info dev_info; + + struct blk_mq_tag_set tag_set; +-- +2.39.0 + diff --git a/queue-6.1/bpf-add-missing-btf_put-to-register_btf_id_dtor_kfun.patch b/queue-6.1/bpf-add-missing-btf_put-to-register_btf_id_dtor_kfun.patch new file mode 100644 index 00000000000..50556d403e6 --- /dev/null +++ b/queue-6.1/bpf-add-missing-btf_put-to-register_btf_id_dtor_kfun.patch @@ -0,0 +1,46 @@ +From e979ec2158d753a572e5ee08b826b39d9896e306 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 13:21:48 +0100 +Subject: bpf: Add missing btf_put to register_btf_id_dtor_kfuncs + +From: Jiri Olsa + +[ Upstream commit 74bc3a5acc82f020d2e126f56c535d02d1e74e37 ] + +We take the BTF reference before we register dtors and we need +to put it back when it's done. + +We probably won't se a problem with kernel BTF, but module BTF +would stay loaded (because of the extra ref) even when its module +is removed. + +Cc: Kumar Kartikeya Dwivedi +Fixes: 5ce937d613a4 ("bpf: Populate pairs of btf_id and destructor kfunc in btf") +Acked-by: Kumar Kartikeya Dwivedi +Signed-off-by: Jiri Olsa +Link: https://lore.kernel.org/r/20230120122148.1522359-1-jolsa@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index efdbba2a0230..a7c2f0c3fc19 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -7607,9 +7607,9 @@ int register_btf_id_dtor_kfuncs(const struct btf_id_dtor_kfunc *dtors, u32 add_c + + sort(tab->dtors, tab->cnt, sizeof(tab->dtors[0]), btf_id_cmp_func, NULL); + +- return 0; + end: +- btf_free_dtor_kfunc_tab(btf); ++ if (ret) ++ btf_free_dtor_kfunc_tab(btf); + btf_put(btf); + return ret; + } +-- +2.39.0 + diff --git a/queue-6.1/bpf-fix-a-possible-task-gone-issue-with-bpf_send_sig.patch b/queue-6.1/bpf-fix-a-possible-task-gone-issue-with-bpf_send_sig.patch new file mode 100644 index 00000000000..732330681b3 --- /dev/null +++ b/queue-6.1/bpf-fix-a-possible-task-gone-issue-with-bpf_send_sig.patch @@ -0,0 +1,55 @@ +From 18e84f69d61455dd5f7501cc1bd4b6c1e2f952fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 12:48:15 -0800 +Subject: bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() + helpers + +From: Yonghong Song + +[ Upstream commit bdb7fdb0aca8b96cef9995d3a57e251c2289322f ] + +In current bpf_send_signal() and bpf_send_signal_thread() helper +implementation, irq_work is used to handle nmi context. Hao Sun +reported in [1] that the current task at the entry of the helper +might be gone during irq_work callback processing. To fix the issue, +a reference is acquired for the current task before enqueuing into +the irq_work so that the queued task is still available during +irq_work callback processing. + + [1] https://lore.kernel.org/bpf/20230109074425.12556-1-sunhao.th@gmail.com/ + +Fixes: 8b401f9ed244 ("bpf: implement bpf_send_signal() helper") +Tested-by: Hao Sun +Reported-by: Hao Sun +Signed-off-by: Yonghong Song +Link: https://lore.kernel.org/r/20230118204815.3331855-1-yhs@fb.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index eb8c117cc8b6..9d4163abadf4 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -832,6 +832,7 @@ static void do_bpf_send_signal(struct irq_work *entry) + + work = container_of(entry, struct send_signal_irq_work, irq_work); + group_send_sig_info(work->sig, SEND_SIG_PRIV, work->task, work->type); ++ put_task_struct(work->task); + } + + static int bpf_send_signal_common(u32 sig, enum pid_type type) +@@ -866,7 +867,7 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type) + * to the irq_work. The current task may change when queued + * irq works get executed. + */ +- work->task = current; ++ work->task = get_task_struct(current); + work->sig = sig; + work->type = type; + irq_work_queue(&work->irq_work); +-- +2.39.0 + diff --git a/queue-6.1/bpf-fix-off-by-one-error-in-bpf_mem_cache_idx.patch b/queue-6.1/bpf-fix-off-by-one-error-in-bpf_mem_cache_idx.patch new file mode 100644 index 00000000000..7388d963c7b --- /dev/null +++ b/queue-6.1/bpf-fix-off-by-one-error-in-bpf_mem_cache_idx.patch @@ -0,0 +1,38 @@ +From 17874deb379044d0d0e75b0e7d5ba9b8042c6be1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 16:46:30 +0800 +Subject: bpf: Fix off-by-one error in bpf_mem_cache_idx() + +From: Hou Tao + +[ Upstream commit 36024d023d139a0c8b552dc3b7f4dc7b4c139e8f ] + +According to the definition of sizes[NUM_CACHES], when the size passed +to bpf_mem_cache_size() is 256, it should return 6 instead 7. + +Fixes: 7c8199e24fa0 ("bpf: Introduce any context BPF specific memory allocator.") +Signed-off-by: Hou Tao +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20230118084630.3750680-1-houtao@huaweicloud.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/memalloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c +index 4901fa1048cd..6187c28d266f 100644 +--- a/kernel/bpf/memalloc.c ++++ b/kernel/bpf/memalloc.c +@@ -71,7 +71,7 @@ static int bpf_mem_cache_idx(size_t size) + if (size <= 192) + return size_index[(size - 1) / 8] - 1; + +- return fls(size - 1) - 1; ++ return fls(size - 1) - 2; + } + + #define NUM_CACHES 11 +-- +2.39.0 + diff --git a/queue-6.1/bpf-fix-the-kernel-crash-caused-by-bpf_setsockopt.patch b/queue-6.1/bpf-fix-the-kernel-crash-caused-by-bpf_setsockopt.patch new file mode 100644 index 00000000000..03244593f05 --- /dev/null +++ b/queue-6.1/bpf-fix-the-kernel-crash-caused-by-bpf_setsockopt.patch @@ -0,0 +1,62 @@ +From 89ca4b1cbbd9accd7550f97aa00952a3c2856424 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 16:17:32 -0800 +Subject: bpf: Fix the kernel crash caused by bpf_setsockopt(). + +From: Kui-Feng Lee + +[ Upstream commit 5416c9aea8323583e8696f0500b6142dfae80821 ] + +The kernel crash was caused by a BPF program attached to the +"lsm_cgroup/socket_sock_rcv_skb" hook, which performed a call to +`bpf_setsockopt()` in order to set the TCP_NODELAY flag as an +example. Flags like TCP_NODELAY can prompt the kernel to flush a +socket's outgoing queue, and this hook +"lsm_cgroup/socket_sock_rcv_skb" is frequently triggered by +softirqs. The issue was that in certain circumstances, when +`tcp_write_xmit()` was called to flush the queue, it would also allow +BH (bottom-half) to run. This could lead to our program attempting to +flush the same socket recursively, which caused a `skbuff` to be +unlinked twice. + +`security_sock_rcv_skb()` is triggered by `tcp_filter()`. This occurs +before the sock ownership is checked in `tcp_v4_rcv()`. Consequently, +if a bpf program runs on `security_sock_rcv_skb()` while under softirq +conditions, it may not possess the lock needed for `bpf_setsockopt()`, +thus presenting an issue. + +The patch fixes this issue by ensuring that a BPF program attached to +the "lsm_cgroup/socket_sock_rcv_skb" hook is not allowed to call +`bpf_setsockopt()`. + +The differences from v1 are + - changing commit log to explain holding the lock of the sock, + - emphasizing that TCP_NODELAY is not the only flag, and + - adding the fixes tag. + +v1: https://lore.kernel.org/bpf/20230125000244.1109228-1-kuifeng@meta.com/ + +Signed-off-by: Kui-Feng Lee +Fixes: 9113d7e48e91 ("bpf: expose bpf_{g,s}etsockopt to lsm cgroup") +Link: https://lore.kernel.org/r/20230127001732.4162630-1-kuifeng@meta.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + kernel/bpf/bpf_lsm.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c +index d6c9b3705f24..e6a76da4bca7 100644 +--- a/kernel/bpf/bpf_lsm.c ++++ b/kernel/bpf/bpf_lsm.c +@@ -51,7 +51,6 @@ BTF_SET_END(bpf_lsm_current_hooks) + */ + BTF_SET_START(bpf_lsm_locked_sockopt_hooks) + #ifdef CONFIG_SECURITY_NETWORK +-BTF_ID(func, bpf_lsm_socket_sock_rcv_skb) + BTF_ID(func, bpf_lsm_sock_graft) + BTF_ID(func, bpf_lsm_inet_csk_clone) + BTF_ID(func, bpf_lsm_inet_conn_established) +-- +2.39.0 + diff --git a/queue-6.1/bpf-fix-to-preserve-reg-parent-live-fields-when-copy.patch b/queue-6.1/bpf-fix-to-preserve-reg-parent-live-fields-when-copy.patch new file mode 100644 index 00000000000..fabcf1013fb --- /dev/null +++ b/queue-6.1/bpf-fix-to-preserve-reg-parent-live-fields-when-copy.patch @@ -0,0 +1,193 @@ +From 96208e047412682e9629fb119ae85c7b3c939591 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 16:22:13 +0200 +Subject: bpf: Fix to preserve reg parent/live fields when copying range info + +From: Eduard Zingerman + +[ Upstream commit 71f656a50176915d6813751188b5758daa8d012b ] + +Register range information is copied in several places. The intent is +to transfer range/id information from one register/stack spill to +another. Currently this is done using direct register assignment, e.g.: + +static void find_equal_scalars(..., struct bpf_reg_state *known_reg) +{ + ... + struct bpf_reg_state *reg; + ... + *reg = *known_reg; + ... +} + +However, such assignments also copy the following bpf_reg_state fields: + +struct bpf_reg_state { + ... + struct bpf_reg_state *parent; + ... + enum bpf_reg_liveness live; + ... +}; + +Copying of these fields is accidental and incorrect, as could be +demonstrated by the following example: + + 0: call ktime_get_ns() + 1: r6 = r0 + 2: call ktime_get_ns() + 3: r7 = r0 + 4: if r0 > r6 goto +1 ; r0 & r6 are unbound thus generated + ; branch states are identical + 5: *(u64 *)(r10 - 8) = 0xdeadbeef ; 64-bit write to fp[-8] + --- checkpoint --- + 6: r1 = 42 ; r1 marked as written + 7: *(u8 *)(r10 - 8) = r1 ; 8-bit write, fp[-8] parent & live + ; overwritten + 8: r2 = *(u64 *)(r10 - 8) + 9: r0 = 0 + 10: exit + +This example is unsafe because 64-bit write to fp[-8] at (5) is +conditional, thus not all bytes of fp[-8] are guaranteed to be set +when it is read at (8). However, currently the example passes +verification. + +First, the execution path 1-10 is examined by verifier. +Suppose that a new checkpoint is created by is_state_visited() at (6). +After checkpoint creation: +- r1.parent points to checkpoint.r1, +- fp[-8].parent points to checkpoint.fp[-8]. +At (6) the r1.live is set to REG_LIVE_WRITTEN. +At (7) the fp[-8].parent is set to r1.parent and fp[-8].live is set to +REG_LIVE_WRITTEN, because of the following code called in +check_stack_write_fixed_off(): + +static void save_register_state(struct bpf_func_state *state, + int spi, struct bpf_reg_state *reg, + int size) +{ + ... + state->stack[spi].spilled_ptr = *reg; // <--- parent & live copied + if (size == BPF_REG_SIZE) + state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN; + ... +} + +Note the intent to mark stack spill as written only if 8 bytes are +spilled to a slot, however this intent is spoiled by a 'live' field copy. +At (8) the checkpoint.fp[-8] should be marked as REG_LIVE_READ but +this does not happen: +- fp[-8] in a current state is already marked as REG_LIVE_WRITTEN; +- fp[-8].parent points to checkpoint.r1, parentage chain is used by + mark_reg_read() to mark checkpoint states. +At (10) the verification is finished for path 1-10 and jump 4-6 is +examined. The checkpoint.fp[-8] never gets REG_LIVE_READ mark and this +spill is pruned from the cached states by clean_live_states(). Hence +verifier state obtained via path 1-4,6 is deemed identical to one +obtained via path 1-6 and program marked as safe. + +Note: the example should be executed with BPF_F_TEST_STATE_FREQ flag +set to force creation of intermediate verifier states. + +This commit revisits the locations where bpf_reg_state instances are +copied and replaces the direct copies with a call to a function +copy_register_state(dst, src) that preserves 'parent' and 'live' +fields of the 'dst'. + +Fixes: 679c782de14b ("bpf/verifier: per-register parent pointers") +Signed-off-by: Eduard Zingerman +Link: https://lore.kernel.org/r/20230106142214.1040390-2-eddyz87@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 25 ++++++++++++++++++------- + 1 file changed, 18 insertions(+), 7 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 398a0008aff7..82f2da71eb35 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -3011,13 +3011,24 @@ static bool __is_pointer_value(bool allow_ptr_leaks, + return reg->type != SCALAR_VALUE; + } + ++/* Copy src state preserving dst->parent and dst->live fields */ ++static void copy_register_state(struct bpf_reg_state *dst, const struct bpf_reg_state *src) ++{ ++ struct bpf_reg_state *parent = dst->parent; ++ enum bpf_reg_liveness live = dst->live; ++ ++ *dst = *src; ++ dst->parent = parent; ++ dst->live = live; ++} ++ + static void save_register_state(struct bpf_func_state *state, + int spi, struct bpf_reg_state *reg, + int size) + { + int i; + +- state->stack[spi].spilled_ptr = *reg; ++ copy_register_state(&state->stack[spi].spilled_ptr, reg); + if (size == BPF_REG_SIZE) + state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN; + +@@ -3345,7 +3356,7 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, + */ + s32 subreg_def = state->regs[dst_regno].subreg_def; + +- state->regs[dst_regno] = *reg; ++ copy_register_state(&state->regs[dst_regno], reg); + state->regs[dst_regno].subreg_def = subreg_def; + } else { + for (i = 0; i < size; i++) { +@@ -3366,7 +3377,7 @@ static int check_stack_read_fixed_off(struct bpf_verifier_env *env, + + if (dst_regno >= 0) { + /* restore register state from stack */ +- state->regs[dst_regno] = *reg; ++ copy_register_state(&state->regs[dst_regno], reg); + /* mark reg as written since spilled pointer state likely + * has its liveness marks cleared by is_state_visited() + * which resets stack/reg liveness for state transitions +@@ -8085,7 +8096,7 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, + */ + if (!ptr_is_dst_reg) { + tmp = *dst_reg; +- *dst_reg = *ptr_reg; ++ copy_register_state(dst_reg, ptr_reg); + } + ret = sanitize_speculative_path(env, NULL, env->insn_idx + 1, + env->insn_idx); +@@ -9338,7 +9349,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + * to propagate min/max range. + */ + src_reg->id = ++env->id_gen; +- *dst_reg = *src_reg; ++ copy_register_state(dst_reg, src_reg); + dst_reg->live |= REG_LIVE_WRITTEN; + dst_reg->subreg_def = DEF_NOT_SUBREG; + } else { +@@ -9349,7 +9360,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) + insn->src_reg); + return -EACCES; + } else if (src_reg->type == SCALAR_VALUE) { +- *dst_reg = *src_reg; ++ copy_register_state(dst_reg, src_reg); + /* Make sure ID is cleared otherwise + * dst_reg min/max could be incorrectly + * propagated into src_reg by find_equal_scalars() +@@ -10145,7 +10156,7 @@ static void find_equal_scalars(struct bpf_verifier_state *vstate, + + bpf_for_each_reg_in_vstate(vstate, state, reg, ({ + if (reg->type == SCALAR_VALUE && reg->id == known_reg->id) +- *reg = *known_reg; ++ copy_register_state(reg, known_reg); + })); + } + +-- +2.39.0 + diff --git a/queue-6.1/bpf-sockmap-check-for-any-of-tcp_bpf_prots-when-clon.patch b/queue-6.1/bpf-sockmap-check-for-any-of-tcp_bpf_prots-when-clon.patch new file mode 100644 index 00000000000..a6d1b690cf3 --- /dev/null +++ b/queue-6.1/bpf-sockmap-check-for-any-of-tcp_bpf_prots-when-clon.patch @@ -0,0 +1,102 @@ +From 8c6f0fb40e0c04ab569520b889f1c67e19f42174 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Jan 2023 13:41:44 +0100 +Subject: bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener + +From: Jakub Sitnicki + +[ Upstream commit ddce1e091757d0259107c6c0c7262df201de2b66 ] + +A listening socket linked to a sockmap has its sk_prot overridden. It +points to one of the struct proto variants in tcp_bpf_prots. The variant +depends on the socket's family and which sockmap programs are attached. + +A child socket cloned from a TCP listener initially inherits their sk_prot. +But before cloning is finished, we restore the child's proto to the +listener's original non-tcp_bpf_prots one. This happens in +tcp_create_openreq_child -> tcp_bpf_clone. + +Today, in tcp_bpf_clone we detect if the child's proto should be restored +by checking only for the TCP_BPF_BASE proto variant. This is not +correct. The sk_prot of listening socket linked to a sockmap can point to +to any variant in tcp_bpf_prots. + +If the listeners sk_prot happens to be not the TCP_BPF_BASE variant, then +the child socket unintentionally is left if the inherited sk_prot by +tcp_bpf_clone. + +This leads to issues like infinite recursion on close [1], because the +child state is otherwise not set up for use with tcp_bpf_prot operations. + +Adjust the check in tcp_bpf_clone to detect all of tcp_bpf_prots variants. + +Note that it wouldn't be sufficient to check the socket state when +overriding the sk_prot in tcp_bpf_update_proto in order to always use the +TCP_BPF_BASE variant for listening sockets. Since commit +b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap usage") +it is possible for a socket to transition to TCP_LISTEN state while already +linked to a sockmap, e.g. connect() -> insert into map -> +connect(AF_UNSPEC) -> listen(). + +[1]: https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/ + +Fixes: e80251555f0b ("tcp_bpf: Don't let child socket inherit parent protocol ops on copy") +Reported-by: syzbot+04c21ed96d861dccc5cd@syzkaller.appspotmail.com +Signed-off-by: Jakub Sitnicki +Acked-by: John Fastabend +Link: https://lore.kernel.org/r/20230113-sockmap-fix-v2-2-1e0ee7ac2f90@cloudflare.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/util_macros.h | 12 ++++++++++++ + net/ipv4/tcp_bpf.c | 4 ++-- + 2 files changed, 14 insertions(+), 2 deletions(-) + +diff --git a/include/linux/util_macros.h b/include/linux/util_macros.h +index 72299f261b25..43db6e47503c 100644 +--- a/include/linux/util_macros.h ++++ b/include/linux/util_macros.h +@@ -38,4 +38,16 @@ + */ + #define find_closest_descending(x, a, as) __find_closest(x, a, as, >=) + ++/** ++ * is_insidevar - check if the @ptr points inside the @var memory range. ++ * @ptr: the pointer to a memory address. ++ * @var: the variable which address and size identify the memory range. ++ * ++ * Evaluates to true if the address in @ptr lies within the memory ++ * range allocated to @var. ++ */ ++#define is_insidevar(ptr, var) \ ++ ((uintptr_t)(ptr) >= (uintptr_t)(var) && \ ++ (uintptr_t)(ptr) < (uintptr_t)(var) + sizeof(var)) ++ + #endif +diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c +index 94aad3870c5f..cf26d65ca389 100644 +--- a/net/ipv4/tcp_bpf.c ++++ b/net/ipv4/tcp_bpf.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -639,10 +640,9 @@ EXPORT_SYMBOL_GPL(tcp_bpf_update_proto); + */ + void tcp_bpf_clone(const struct sock *sk, struct sock *newsk) + { +- int family = sk->sk_family == AF_INET6 ? TCP_BPF_IPV6 : TCP_BPF_IPV4; + struct proto *prot = newsk->sk_prot; + +- if (prot == &tcp_bpf_prots[family][TCP_BPF_BASE]) ++ if (is_insidevar(prot, tcp_bpf_prots)) + newsk->sk_prot = sk->sk_prot_creator; + } + #endif /* CONFIG_BPF_SYSCALL */ +-- +2.39.0 + diff --git a/queue-6.1/bus-sunxi-rsb-fix-error-handling-in-sunxi_rsb_init.patch b/queue-6.1/bus-sunxi-rsb-fix-error-handling-in-sunxi_rsb_init.patch new file mode 100644 index 00000000000..bd744f49d1d --- /dev/null +++ b/queue-6.1/bus-sunxi-rsb-fix-error-handling-in-sunxi_rsb_init.patch @@ -0,0 +1,46 @@ +From c07ae1b5e528fd28bf4ed4fbc067fc417c3f303b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 09:42:00 +0000 +Subject: bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() + +From: Yuan Can + +[ Upstream commit f71eaf2708be7831428eacae7db25d8ec6b8b4c5 ] + +The sunxi_rsb_init() returns the platform_driver_register() directly +without checking its return value, if platform_driver_register() failed, +the sunxi_rsb_bus is not unregistered. +Fix by unregister sunxi_rsb_bus when platform_driver_register() failed. + +Fixes: d787dcdb9c8f ("bus: sunxi-rsb: Add driver for Allwinner Reduced Serial Bus") +Signed-off-by: Yuan Can +Reviewed-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20221123094200.12036-1-yuancan@huawei.com +Signed-off-by: Jernej Skrabec +Signed-off-by: Sasha Levin +--- + drivers/bus/sunxi-rsb.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c +index 3aa91aed3bf7..226e87b85116 100644 +--- a/drivers/bus/sunxi-rsb.c ++++ b/drivers/bus/sunxi-rsb.c +@@ -857,7 +857,13 @@ static int __init sunxi_rsb_init(void) + return ret; + } + +- return platform_driver_register(&sunxi_rsb_driver); ++ ret = platform_driver_register(&sunxi_rsb_driver); ++ if (ret) { ++ bus_unregister(&sunxi_rsb_bus); ++ return ret; ++ } ++ ++ return 0; + } + module_init(sunxi_rsb_init); + +-- +2.39.0 + diff --git a/queue-6.1/can-j1939-fix-errant-warn_on_once-in-j1939_session_d.patch b/queue-6.1/can-j1939-fix-errant-warn_on_once-in-j1939_session_d.patch new file mode 100644 index 00000000000..8cc7c98f92c --- /dev/null +++ b/queue-6.1/can-j1939-fix-errant-warn_on_once-in-j1939_session_d.patch @@ -0,0 +1,77 @@ +From 7b9ebfd10386131725af9515150416a66185ad20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Sep 2021 17:42:00 +0800 +Subject: can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate + +From: Ziyang Xuan + +[ Upstream commit d0553680f94c49bbe0e39eb50d033ba563b4212d ] + +The conclusion "j1939_session_deactivate() should be called with a +session ref-count of at least 2" is incorrect. In some concurrent +scenarios, j1939_session_deactivate can be called with the session +ref-count less than 2. But there is not any problem because it +will check the session active state before session putting in +j1939_session_deactivate_locked(). + +Here is the concurrent scenario of the problem reported by syzbot +and my reproduction log. + + cpu0 cpu1 + j1939_xtp_rx_eoma +j1939_xtp_rx_abort_one + j1939_session_get_by_addr [kref == 2] +j1939_session_get_by_addr [kref == 3] +j1939_session_deactivate [kref == 2] +j1939_session_put [kref == 1] + j1939_session_completed + j1939_session_deactivate + WARN_ON_ONCE(kref < 2) + +===================================================== +WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70 +CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 +RIP: 0010:j1939_session_deactivate+0x5f/0x70 +Call Trace: + j1939_session_deactivate_activate_next+0x11/0x28 + j1939_xtp_rx_eoma+0x12a/0x180 + j1939_tp_recv+0x4a2/0x510 + j1939_can_recv+0x226/0x380 + can_rcv_filter+0xf8/0x220 + can_receive+0x102/0x220 + ? process_backlog+0xf0/0x2c0 + can_rcv+0x53/0xf0 + __netif_receive_skb_one_core+0x67/0x90 + ? process_backlog+0x97/0x2c0 + __netif_receive_skb+0x22/0x80 + +Fixes: 0c71437dd50d ("can: j1939: j1939_session_deactivate(): clarify lifetime of session object") +Reported-by: syzbot+9981a614060dcee6eeca@syzkaller.appspotmail.com +Signed-off-by: Ziyang Xuan +Acked-by: Oleksij Rempel +Link: https://lore.kernel.org/all/20210906094200.95868-1-william.xuanziyang@huawei.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/j1939/transport.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c +index 55f29c9f9e08..4177e9617070 100644 +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -1092,10 +1092,6 @@ static bool j1939_session_deactivate(struct j1939_session *session) + bool active; + + j1939_session_list_lock(priv); +- /* This function should be called with a session ref-count of at +- * least 2. +- */ +- WARN_ON_ONCE(kref_read(&session->kref) < 2); + active = j1939_session_deactivate_locked(session); + j1939_session_list_unlock(priv); + +-- +2.39.0 + diff --git a/queue-6.1/can-mcp251xfd-mcp251xfd_ring_set_ringparam-assign-mi.patch b/queue-6.1/can-mcp251xfd-mcp251xfd_ring_set_ringparam-assign-mi.patch new file mode 100644 index 00000000000..da146a1462d --- /dev/null +++ b/queue-6.1/can-mcp251xfd-mcp251xfd_ring_set_ringparam-assign-mi.patch @@ -0,0 +1,37 @@ +From 8a6a3d47d706b1cb3b39889554c3c7fbf506b42b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Jan 2023 09:03:42 +0100 +Subject: can: mcp251xfd: mcp251xfd_ring_set_ringparam(): assign missing + tx_obj_num_coalesce_irq + +From: Marc Kleine-Budde + +[ Upstream commit 1613fff7a32e1d9e2ac09db73feba0e71a188445 ] + +If the a new ring layout is set, the max coalesced frames for RX and +TX are re-calculated, too. Add the missing assignment of the newly +calculated TX max coalesced frames. + +Fixes: 656fc12ddaf8 ("can: mcp251xfd: add TX IRQ coalescing ethtool support") +Link: https://lore.kernel.org/all/20230130154334.1578518-1-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/mcp251xfd/mcp251xfd-ethtool.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-ethtool.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-ethtool.c +index 3585f02575df..57eeb066a945 100644 +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-ethtool.c ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-ethtool.c +@@ -48,6 +48,7 @@ mcp251xfd_ring_set_ringparam(struct net_device *ndev, + priv->rx_obj_num = layout.cur_rx; + priv->rx_obj_num_coalesce_irq = layout.rx_coalesce; + priv->tx->obj_num = layout.cur_tx; ++ priv->tx_obj_num_coalesce_irq = layout.tx_coalesce; + + return 0; + } +-- +2.39.0 + diff --git a/queue-6.1/can-raw-fix-can-fd-frame-transmissions-over-can-xl-d.patch b/queue-6.1/can-raw-fix-can-fd-frame-transmissions-over-can-xl-d.patch new file mode 100644 index 00000000000..585a5636f61 --- /dev/null +++ b/queue-6.1/can-raw-fix-can-fd-frame-transmissions-over-can-xl-d.patch @@ -0,0 +1,125 @@ +From 3af660e809b5d266319296bae2fb9aae95989741 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 11:56:13 +0100 +Subject: can: raw: fix CAN FD frame transmissions over CAN XL devices + +From: Oliver Hartkopp + +[ Upstream commit 3793301cbaa4a62d83e21f685307da7671f812ab ] + +A CAN XL device is always capable to process CAN FD frames. The former +check when sending CAN FD frames relied on the existence of a CAN FD +device and did not check for a CAN XL device that would be correct +too. + +With this patch the CAN FD feature is enabled automatically when CAN +XL is switched on - and CAN FD cannot be switch off while CAN XL is +enabled. + +This precondition also leads to a clean up and reduction of checks in +the hot path in raw_rcv() and raw_sendmsg(). Some conditions are +reordered to handle simple checks first. + +changes since v1: https://lore.kernel.org/all/20230131091012.50553-1-socketcan@hartkopp.net +- fixed typo: devive -> device +changes since v2: https://lore.kernel.org/all/20230131091824.51026-1-socketcan@hartkopp.net/ +- reorder checks in if statements to handle simple checks first + +Fixes: 626332696d75 ("can: raw: add CAN XL support") +Signed-off-by: Oliver Hartkopp +Link: https://lore.kernel.org/all/20230131105613.55228-1-socketcan@hartkopp.net +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/raw.c | 47 +++++++++++++++++++++++++++++++---------------- + 1 file changed, 31 insertions(+), 16 deletions(-) + +diff --git a/net/can/raw.c b/net/can/raw.c +index 3eb7d3e2b541..4abab2c3011a 100644 +--- a/net/can/raw.c ++++ b/net/can/raw.c +@@ -132,8 +132,8 @@ static void raw_rcv(struct sk_buff *oskb, void *data) + return; + + /* make sure to not pass oversized frames to the socket */ +- if ((can_is_canfd_skb(oskb) && !ro->fd_frames && !ro->xl_frames) || +- (can_is_canxl_skb(oskb) && !ro->xl_frames)) ++ if ((!ro->fd_frames && can_is_canfd_skb(oskb)) || ++ (!ro->xl_frames && can_is_canxl_skb(oskb))) + return; + + /* eliminate multiple filter matches for the same skb */ +@@ -670,6 +670,11 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, + if (copy_from_sockptr(&ro->fd_frames, optval, optlen)) + return -EFAULT; + ++ /* Enabling CAN XL includes CAN FD */ ++ if (ro->xl_frames && !ro->fd_frames) { ++ ro->fd_frames = ro->xl_frames; ++ return -EINVAL; ++ } + break; + + case CAN_RAW_XL_FRAMES: +@@ -679,6 +684,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, + if (copy_from_sockptr(&ro->xl_frames, optval, optlen)) + return -EFAULT; + ++ /* Enabling CAN XL includes CAN FD */ ++ if (ro->xl_frames) ++ ro->fd_frames = ro->xl_frames; + break; + + case CAN_RAW_JOIN_FILTERS: +@@ -786,6 +794,25 @@ static int raw_getsockopt(struct socket *sock, int level, int optname, + return 0; + } + ++static bool raw_bad_txframe(struct raw_sock *ro, struct sk_buff *skb, int mtu) ++{ ++ /* Classical CAN -> no checks for flags and device capabilities */ ++ if (can_is_can_skb(skb)) ++ return false; ++ ++ /* CAN FD -> needs to be enabled and a CAN FD or CAN XL device */ ++ if (ro->fd_frames && can_is_canfd_skb(skb) && ++ (mtu == CANFD_MTU || can_is_canxl_dev_mtu(mtu))) ++ return false; ++ ++ /* CAN XL -> needs to be enabled and a CAN XL device */ ++ if (ro->xl_frames && can_is_canxl_skb(skb) && ++ can_is_canxl_dev_mtu(mtu)) ++ return false; ++ ++ return true; ++} ++ + static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + { + struct sock *sk = sock->sk; +@@ -833,20 +860,8 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + goto free_skb; + + err = -EINVAL; +- if (ro->xl_frames && can_is_canxl_dev_mtu(dev->mtu)) { +- /* CAN XL, CAN FD and Classical CAN */ +- if (!can_is_canxl_skb(skb) && !can_is_canfd_skb(skb) && +- !can_is_can_skb(skb)) +- goto free_skb; +- } else if (ro->fd_frames && dev->mtu == CANFD_MTU) { +- /* CAN FD and Classical CAN */ +- if (!can_is_canfd_skb(skb) && !can_is_can_skb(skb)) +- goto free_skb; +- } else { +- /* Classical CAN */ +- if (!can_is_can_skb(skb)) +- goto free_skb; +- } ++ if (raw_bad_txframe(ro, skb, dev->mtu)) ++ goto free_skb; + + sockcm_init(&sockc, sk); + if (msg->msg_controllen) { +-- +2.39.0 + diff --git a/queue-6.1/certs-fix-build-error-when-pkcs-11-uri-contains-semi.patch b/queue-6.1/certs-fix-build-error-when-pkcs-11-uri-contains-semi.patch new file mode 100644 index 00000000000..480586fd4e6 --- /dev/null +++ b/queue-6.1/certs-fix-build-error-when-pkcs-11-uri-contains-semi.patch @@ -0,0 +1,45 @@ +From ea37ba179fe324e644b87a88733b16fb0194b444 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 09:43:22 +0100 +Subject: certs: Fix build error when PKCS#11 URI contains semicolon + +From: Jan Luebbe + +[ Upstream commit b1c3d2beed8ef3699fab106340e33a79052df116 ] + +When CONFIG_MODULE_SIG_KEY is PKCS#11 URI (pkcs11:*) and contains a +semicolon, signing_key.x509 fails to build: + + certs/extract-cert pkcs11:token=foo;object=bar;pin-value=1111 certs/signing_key.x509 + Usage: extract-cert + +Add quotes to the extract-cert argument to avoid splitting by the shell. + +This approach was suggested by Masahiro Yamada . + +Fixes: 129ab0d2d9f3 ("kbuild: do not quote string values in include/config/auto.conf") +Signed-off-by: Jan Luebbe +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + certs/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/certs/Makefile b/certs/Makefile +index 9486ed924731..799ad7b9e68a 100644 +--- a/certs/Makefile ++++ b/certs/Makefile +@@ -23,8 +23,8 @@ $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE + targets += blacklist_hash_list + + quiet_cmd_extract_certs = CERT $@ +- cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@ +-extract-cert-in = $(or $(filter-out $(obj)/extract-cert, $(real-prereqs)),"") ++ cmd_extract_certs = $(obj)/extract-cert "$(extract-cert-in)" $@ ++extract-cert-in = $(filter-out $(obj)/extract-cert, $(real-prereqs)) + + $(obj)/system_certificates.o: $(obj)/x509_certificate_list + +-- +2.39.0 + diff --git a/queue-6.1/copy_oldmem_kernel-write-is-data-source-not-destinat.patch b/queue-6.1/copy_oldmem_kernel-write-is-data-source-not-destinat.patch new file mode 100644 index 00000000000..6d76e1b4990 --- /dev/null +++ b/queue-6.1/copy_oldmem_kernel-write-is-data-source-not-destinat.patch @@ -0,0 +1,32 @@ +From 59d3842634810c81a1ef83793275ed6f2ccbbd8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 18:55:18 -0400 +Subject: copy_oldmem_kernel() - WRITE is "data source", not destination + +From: Al Viro + +[ Upstream commit 0e1e4a2238d465199e8f11eb7a779bcb224a0505 ] + +Signed-off-by: Al Viro +Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response") +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/crash_dump.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c +index e4ef67e4da0a..a19a2763e8d4 100644 +--- a/arch/s390/kernel/crash_dump.c ++++ b/arch/s390/kernel/crash_dump.c +@@ -153,7 +153,7 @@ int copy_oldmem_kernel(void *dst, unsigned long src, size_t count) + + kvec.iov_base = dst; + kvec.iov_len = count; +- iov_iter_kvec(&iter, WRITE, &kvec, 1, count); ++ iov_iter_kvec(&iter, READ, &kvec, 1, count); + if (copy_oldmem_iter(&iter, src, count) < count) + return -EFAULT; + return 0; +-- +2.39.0 + diff --git a/queue-6.1/dpaa2-eth-execute-xdp_do_flush-before-napi_complete_.patch b/queue-6.1/dpaa2-eth-execute-xdp_do_flush-before-napi_complete_.patch new file mode 100644 index 00000000000..ca8a3e558d1 --- /dev/null +++ b/queue-6.1/dpaa2-eth-execute-xdp_do_flush-before-napi_complete_.patch @@ -0,0 +1,72 @@ +From af1de54aba5563662e968942e919945255fd022e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 08:49:01 +0100 +Subject: dpaa2-eth: execute xdp_do_flush() before napi_complete_done() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Magnus Karlsson + +[ Upstream commit a3191c4d86c5d3bd35b00dfde6910b88391436a0 ] + +Make sure that xdp_do_flush() is always executed before +napi_complete_done(). This is important for two reasons. First, a +redirect to an XSKMAP assumes that a call to xdp_do_redirect() from +napi context X on CPU Y will be followed by a xdp_do_flush() from the +same napi context and CPU. This is not guaranteed if the +napi_complete_done() is executed before xdp_do_flush(), as it tells +the napi logic that it is fine to schedule napi context X on another +CPU. Details from a production system triggering this bug using the +veth driver can be found following the first link below. + +The second reason is that the XDP_REDIRECT logic in itself relies on +being inside a single NAPI instance through to the xdp_do_flush() call +for RCU protection of all in-kernel data structures. Details can be +found in the second link below. + +Fixes: d678be1dc1ec ("dpaa2-eth: add XDP_REDIRECT support") +Signed-off-by: Magnus Karlsson +Acked-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com +Link: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/ +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index 8d029addddad..6383d9805dac 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -1868,10 +1868,15 @@ static int dpaa2_eth_poll(struct napi_struct *napi, int budget) + if (rx_cleaned >= budget || + txconf_cleaned >= DPAA2_ETH_TXCONF_PER_NAPI) { + work_done = budget; ++ if (ch->xdp.res & XDP_REDIRECT) ++ xdp_do_flush(); + goto out; + } + } while (store_cleaned); + ++ if (ch->xdp.res & XDP_REDIRECT) ++ xdp_do_flush(); ++ + /* Update NET DIM with the values for this CDAN */ + dpaa2_io_update_net_dim(ch->dpio, ch->stats.frames_per_cdan, + ch->stats.bytes_per_cdan); +@@ -1902,9 +1907,7 @@ static int dpaa2_eth_poll(struct napi_struct *napi, int budget) + txc_fq->dq_bytes = 0; + } + +- if (ch->xdp.res & XDP_REDIRECT) +- xdp_do_flush_map(); +- else if (rx_cleaned && ch->xdp.res & XDP_TX) ++ if (rx_cleaned && ch->xdp.res & XDP_TX) + dpaa2_eth_xdp_tx_flush(priv, ch, &priv->fq[flowid]); + + return work_done; +-- +2.39.0 + diff --git a/queue-6.1/dpaa_eth-execute-xdp_do_flush-before-napi_complete_d.patch b/queue-6.1/dpaa_eth-execute-xdp_do_flush-before-napi_complete_d.patch new file mode 100644 index 00000000000..fd58ce11095 --- /dev/null +++ b/queue-6.1/dpaa_eth-execute-xdp_do_flush-before-napi_complete_d.patch @@ -0,0 +1,66 @@ +From 887859ffa95dbcb485c7c66c3bbfab2c2c8862b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 08:49:00 +0100 +Subject: dpaa_eth: execute xdp_do_flush() before napi_complete_done() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Magnus Karlsson + +[ Upstream commit b534013798b77f81a36f36dafd59bab9de837619 ] + +Make sure that xdp_do_flush() is always executed before +napi_complete_done(). This is important for two reasons. First, a +redirect to an XSKMAP assumes that a call to xdp_do_redirect() from +napi context X on CPU Y will be followed by a xdp_do_flush() from the +same napi context and CPU. This is not guaranteed if the +napi_complete_done() is executed before xdp_do_flush(), as it tells +the napi logic that it is fine to schedule napi context X on another +CPU. Details from a production system triggering this bug using the +veth driver can be found following the first link below. + +The second reason is that the XDP_REDIRECT logic in itself relies on +being inside a single NAPI instance through to the xdp_do_flush() call +for RCU protection of all in-kernel data structures. Details can be +found in the second link below. + +Fixes: a1e031ffb422 ("dpaa_eth: add XDP_REDIRECT support") +Signed-off-by: Magnus Karlsson +Acked-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com +Link: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/ +Acked-by: Camelia Groza +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index fc68a32ce2f7..d8fb7d4ebd51 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -2400,6 +2400,9 @@ static int dpaa_eth_poll(struct napi_struct *napi, int budget) + + cleaned = qman_p_poll_dqrr(np->p, budget); + ++ if (np->xdp_act & XDP_REDIRECT) ++ xdp_do_flush(); ++ + if (cleaned < budget) { + napi_complete_done(napi, cleaned); + qman_p_irqsource_add(np->p, QM_PIRQ_DQRI); +@@ -2407,9 +2410,6 @@ static int dpaa_eth_poll(struct napi_struct *napi, int budget) + qman_p_irqsource_add(np->p, QM_PIRQ_DQRI); + } + +- if (np->xdp_act & XDP_REDIRECT) +- xdp_do_flush(); +- + return cleaned; + } + +-- +2.39.0 + diff --git a/queue-6.1/drm-amd-display-fix-timing-not-changning-when-freesy.patch b/queue-6.1/drm-amd-display-fix-timing-not-changning-when-freesy.patch new file mode 100644 index 00000000000..06427293085 --- /dev/null +++ b/queue-6.1/drm-amd-display-fix-timing-not-changning-when-freesy.patch @@ -0,0 +1,49 @@ +From 83266dd75d75036d773245df6b6a9ade7e398ccd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 14:56:22 -0500 +Subject: drm/amd/display: Fix timing not changning when freesync video is + enabled + +From: Aurabindo Pillai + +[ Upstream commit 4b069553246f993c4221e382d0d0ae34f5ba730e ] + +[Why&How] +Switching between certain modes that are freesync video modes and those +are not freesync video modes result in timing not changing as seen by +the monitor due to incorrect timing being driven. + +The issue is fixed by ensuring that when a non freesync video mode is +set, we reset the freesync status on the crtc. + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Alan Liu +Signed-off-by: Aurabindo Pillai +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 85bd1f18259c..b425ec00817c 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -8784,6 +8784,13 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, + if (!dm_old_crtc_state->stream) + goto skip_modeset; + ++ /* Unset freesync video if it was active before */ ++ if (dm_old_crtc_state->freesync_config.state == VRR_STATE_ACTIVE_FIXED) { ++ dm_new_crtc_state->freesync_config.state = VRR_STATE_INACTIVE; ++ dm_new_crtc_state->freesync_config.fixed_refresh_in_uhz = 0; ++ } ++ ++ /* Now check if we should set freesync video mode */ + if (amdgpu_freesync_vid_mode && dm_new_crtc_state->stream && + is_timing_unchanged_for_freesync(new_crtc_state, + old_crtc_state)) { +-- +2.39.0 + diff --git a/queue-6.1/drm-i915-adlp-fix-typo-for-reference-clock.patch b/queue-6.1/drm-i915-adlp-fix-typo-for-reference-clock.patch new file mode 100644 index 00000000000..6b6b3614213 --- /dev/null +++ b/queue-6.1/drm-i915-adlp-fix-typo-for-reference-clock.patch @@ -0,0 +1,40 @@ +From 3005a6cadf61686a2e94cd957c7a49ad638056c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 15:11:31 +0530 +Subject: drm/i915/adlp: Fix typo for reference clock + +From: Chaitanya Kumar Borah + +[ Upstream commit 47a2bd9d985bfdb55900f313603619fc9234f317 ] + +Fix typo for reference clock from 24400 to 24000. + +Bspec: 55409 +Fixes: 626426ff9ce4 ("drm/i915/adl_p: Add cdclk support for ADL-P") +Reviewed-by: Matt Roper +Signed-off-by: Chaitanya Kumar Borah +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20230112094131.550252-1-chaitanya.kumar.borah@intel.com +(cherry picked from commit 2b6f7e39ccae065abfbe3b6e562ec95ccad09f1e) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_cdclk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_cdclk.c b/drivers/gpu/drm/i915/display/intel_cdclk.c +index ed05070b7307..92925f0f7239 100644 +--- a/drivers/gpu/drm/i915/display/intel_cdclk.c ++++ b/drivers/gpu/drm/i915/display/intel_cdclk.c +@@ -1323,7 +1323,7 @@ static const struct intel_cdclk_vals adlp_cdclk_table[] = { + { .refclk = 24000, .cdclk = 192000, .divider = 2, .ratio = 16 }, + { .refclk = 24000, .cdclk = 312000, .divider = 2, .ratio = 26 }, + { .refclk = 24000, .cdclk = 552000, .divider = 2, .ratio = 46 }, +- { .refclk = 24400, .cdclk = 648000, .divider = 2, .ratio = 54 }, ++ { .refclk = 24000, .cdclk = 648000, .divider = 2, .ratio = 54 }, + + { .refclk = 38400, .cdclk = 179200, .divider = 3, .ratio = 14 }, + { .refclk = 38400, .cdclk = 192000, .divider = 2, .ratio = 10 }, +-- +2.39.0 + diff --git a/queue-6.1/drm-i915-fix-request-ref-counting-during-error-captu.patch b/queue-6.1/drm-i915-fix-request-ref-counting-during-error-captu.patch new file mode 100644 index 00000000000..47eec59225d --- /dev/null +++ b/queue-6.1/drm-i915-fix-request-ref-counting-during-error-captu.patch @@ -0,0 +1,205 @@ +From e8211b93de1375cf1e656c105e381991668909c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 16:28:36 -0800 +Subject: drm/i915: Fix request ref counting during error capture & debugfs + dump + +From: John Harrison + +[ Upstream commit 86d8ddc74124c3fdfc139f246ba6da15e45e86e3 ] + +When GuC support was added to error capture, the reference counting +around the request object was broken. Fix it up. + +The context based search manages the spinlocking around the search +internally. So it needs to grab the reference count internally as +well. The execlist only request based search relies on external +locking, so it needs an external reference count but within the +spinlock not outside it. + +The only other caller of the context based search is the code for +dumping engine state to debugfs. That code wasn't previously getting +an explicit reference at all as it does everything while holding the +execlist specific spinlock. So, that needs updaing as well as that +spinlock doesn't help when using GuC submission. Rather than trying to +conditionally get/put depending on submission model, just change it to +always do the get/put. + +v2: Explicitly document adding an extra blank line in some dense code +(Andy Shevchenko). Fix multiple potential null pointer derefs in case +of no request found (some spotted by Tvrtko, but there was more!). +Also fix a leaked request in case of !started and another in +__guc_reset_context now that intel_context_find_active_request is +actually reference counting the returned request. +v3: Add a _get suffix to intel_context_find_active_request now that it +grabs a reference (Daniele). +v4: Split the intel_guc_find_hung_context change to a separate patch +and rename intel_context_find_active_request_get to +intel_context_get_active_request (Tvrtko). +v5: s/locking/reference counting/ in commit message (Tvrtko) + +Fixes: dc0dad365c5e ("drm/i915/guc: Fix for error capture after full GPU reset with GuC") +Fixes: 573ba126aef3 ("drm/i915/guc: Capture error state on context reset") +Signed-off-by: John Harrison +Reviewed-by: Daniele Ceraolo Spurio +Acked-by: Tvrtko Ursulin +Cc: Matthew Brost +Cc: Jani Nikula +Cc: Joonas Lahtinen +Cc: Rodrigo Vivi +Cc: Andrzej Hajda +Cc: Matthew Auld +Cc: Matt Roper +Cc: Umesh Nerlige Ramappa +Cc: Michael Cheng +Cc: Lucas De Marchi +Cc: Tejas Upadhyay +Cc: Andy Shevchenko +Cc: Aravind Iddamsetty +Cc: Alan Previn +Cc: Bruce Chang +Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-3-John.C.Harrison@Intel.com +(cherry picked from commit 3700e353781e27f1bc7222f51f2cc36cbeb9b4ec) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_context.c | 4 +++- + drivers/gpu/drm/i915/gt/intel_context.h | 3 +-- + drivers/gpu/drm/i915/gt/intel_engine_cs.c | 6 +++++- + drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 3 ++- + drivers/gpu/drm/i915/i915_gpu_error.c | 13 ++++++------- + 5 files changed, 17 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_context.c b/drivers/gpu/drm/i915/gt/intel_context.c +index e94365b08f1e..2aa63ec521b8 100644 +--- a/drivers/gpu/drm/i915/gt/intel_context.c ++++ b/drivers/gpu/drm/i915/gt/intel_context.c +@@ -528,7 +528,7 @@ struct i915_request *intel_context_create_request(struct intel_context *ce) + return rq; + } + +-struct i915_request *intel_context_find_active_request(struct intel_context *ce) ++struct i915_request *intel_context_get_active_request(struct intel_context *ce) + { + struct intel_context *parent = intel_context_to_parent(ce); + struct i915_request *rq, *active = NULL; +@@ -552,6 +552,8 @@ struct i915_request *intel_context_find_active_request(struct intel_context *ce) + + active = rq; + } ++ if (active) ++ active = i915_request_get_rcu(active); + spin_unlock_irqrestore(&parent->guc_state.lock, flags); + + return active; +diff --git a/drivers/gpu/drm/i915/gt/intel_context.h b/drivers/gpu/drm/i915/gt/intel_context.h +index be09fb2e883a..4ab6c8ddd6ec 100644 +--- a/drivers/gpu/drm/i915/gt/intel_context.h ++++ b/drivers/gpu/drm/i915/gt/intel_context.h +@@ -268,8 +268,7 @@ int intel_context_prepare_remote_request(struct intel_context *ce, + + struct i915_request *intel_context_create_request(struct intel_context *ce); + +-struct i915_request * +-intel_context_find_active_request(struct intel_context *ce); ++struct i915_request *intel_context_get_active_request(struct intel_context *ce); + + static inline bool intel_context_is_barrier(const struct intel_context *ce) + { +diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c +index fcbccd8d244e..4327c6d91ce9 100644 +--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c ++++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c +@@ -2201,9 +2201,11 @@ static void engine_dump_active_requests(struct intel_engine_cs *engine, struct d + if (guc) { + ce = intel_engine_get_hung_context(engine); + if (ce) +- hung_rq = intel_context_find_active_request(ce); ++ hung_rq = intel_context_get_active_request(ce); + } else { + hung_rq = intel_engine_execlist_find_hung_request(engine); ++ if (hung_rq) ++ hung_rq = i915_request_get_rcu(hung_rq); + } + + if (hung_rq) +@@ -2214,6 +2216,8 @@ static void engine_dump_active_requests(struct intel_engine_cs *engine, struct d + else + intel_engine_dump_active_requests(&engine->sched_engine->requests, + hung_rq, m); ++ if (hung_rq) ++ i915_request_put(hung_rq); + } + + void intel_engine_dump(struct intel_engine_cs *engine, +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +index 259162002c3a..0ec07dad1dcf 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +@@ -1685,7 +1685,7 @@ static void __guc_reset_context(struct intel_context *ce, intel_engine_mask_t st + goto next_context; + + guilty = false; +- rq = intel_context_find_active_request(ce); ++ rq = intel_context_get_active_request(ce); + if (!rq) { + head = ce->ring->tail; + goto out_replay; +@@ -1698,6 +1698,7 @@ static void __guc_reset_context(struct intel_context *ce, intel_engine_mask_t st + head = intel_ring_wrap(ce->ring, rq->head); + + __i915_request_reset(rq, guilty); ++ i915_request_put(rq); + out_replay: + guc_reset_state(ce, head, guilty); + next_context: +diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c +index 9ea2fe34e7d3..a8ee4cd2ff16 100644 +--- a/drivers/gpu/drm/i915/i915_gpu_error.c ++++ b/drivers/gpu/drm/i915/i915_gpu_error.c +@@ -1603,7 +1603,7 @@ capture_engine(struct intel_engine_cs *engine, + ce = intel_engine_get_hung_context(engine); + if (ce) { + intel_engine_clear_hung_context(engine); +- rq = intel_context_find_active_request(ce); ++ rq = intel_context_get_active_request(ce); + if (!rq || !i915_request_started(rq)) + goto no_request_capture; + } else { +@@ -1614,21 +1614,18 @@ capture_engine(struct intel_engine_cs *engine, + if (!intel_uc_uses_guc_submission(&engine->gt->uc)) { + spin_lock_irqsave(&engine->sched_engine->lock, flags); + rq = intel_engine_execlist_find_hung_request(engine); ++ if (rq) ++ rq = i915_request_get_rcu(rq); + spin_unlock_irqrestore(&engine->sched_engine->lock, + flags); + } + } +- if (rq) +- rq = i915_request_get_rcu(rq); +- + if (!rq) + goto no_request_capture; + + capture = intel_engine_coredump_add_request(ee, rq, ATOMIC_MAYFAIL); +- if (!capture) { +- i915_request_put(rq); ++ if (!capture) + goto no_request_capture; +- } + if (dump_flags & CORE_DUMP_FLAG_IS_GUC_CAPTURE) + intel_guc_capture_get_matching_node(engine->gt, ee, ce); + +@@ -1638,6 +1635,8 @@ capture_engine(struct intel_engine_cs *engine, + return ee; + + no_request_capture: ++ if (rq) ++ i915_request_put(rq); + kfree(ee); + return NULL; + } +-- +2.39.0 + diff --git a/queue-6.1/drm-i915-fix-up-locking-around-dumping-requests-list.patch b/queue-6.1/drm-i915-fix-up-locking-around-dumping-requests-list.patch new file mode 100644 index 00000000000..10c2db518f0 --- /dev/null +++ b/queue-6.1/drm-i915-fix-up-locking-around-dumping-requests-list.patch @@ -0,0 +1,303 @@ +From 2c53009b2ecf4788d32c5a651d928e60e0c6ddfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 16:28:37 -0800 +Subject: drm/i915: Fix up locking around dumping requests lists + +From: John Harrison + +[ Upstream commit 5bc4b43d5c6c9692ddc7b96116650cdf9406f3da ] + +The debugfs dump of requests was confused about what state requires +the execlist lock versus the GuC lock. There was also a bunch of +duplicated messy code between it and the error capture code. + +So refactor the hung request search into a re-usable function. And +reduce the span of the execlist state lock to only the execlist +specific code paths. In order to do that, also move the report of hold +count (which is an execlist only concept) from the top level dump +function to the lower level execlist specific function. Also, move the +execlist specific code into the execlist source file. + +v2: Rename some functions and move to more appropriate files (Daniele). +v3: Rename new execlist dump function (Daniele) + +Fixes: dc0dad365c5e ("drm/i915/guc: Fix for error capture after full GPU reset with GuC") +Signed-off-by: John Harrison +Reviewed-by: Daniele Ceraolo Spurio +Acked-by: Tvrtko Ursulin +Cc: Matthew Brost +Cc: Jani Nikula +Cc: Joonas Lahtinen +Cc: Rodrigo Vivi +Cc: Matt Roper +Cc: Umesh Nerlige Ramappa +Cc: Michael Cheng +Cc: Lucas De Marchi +Cc: Bruce Chang +Cc: Alan Previn +Cc: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-4-John.C.Harrison@Intel.com +(cherry picked from commit a4be3dca53172d9d2091e4b474fb795c81ed3d6c) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_engine.h | 4 +- + drivers/gpu/drm/i915/gt/intel_engine_cs.c | 74 +++++++++---------- + .../drm/i915/gt/intel_execlists_submission.c | 27 +++++++ + .../drm/i915/gt/intel_execlists_submission.h | 4 + + drivers/gpu/drm/i915/i915_gpu_error.c | 26 +------ + 5 files changed, 73 insertions(+), 62 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_engine.h b/drivers/gpu/drm/i915/gt/intel_engine.h +index cbc8b857d5f7..7a4504ea35c3 100644 +--- a/drivers/gpu/drm/i915/gt/intel_engine.h ++++ b/drivers/gpu/drm/i915/gt/intel_engine.h +@@ -248,8 +248,8 @@ void intel_engine_dump_active_requests(struct list_head *requests, + ktime_t intel_engine_get_busy_time(struct intel_engine_cs *engine, + ktime_t *now); + +-struct i915_request * +-intel_engine_execlist_find_hung_request(struct intel_engine_cs *engine); ++void intel_engine_get_hung_entity(struct intel_engine_cs *engine, ++ struct intel_context **ce, struct i915_request **rq); + + u32 intel_engine_context_size(struct intel_gt *gt, u8 class); + struct intel_context * +diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c +index 4327c6d91ce9..b458547e1fc6 100644 +--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c ++++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c +@@ -2078,17 +2078,6 @@ static void print_request_ring(struct drm_printer *m, struct i915_request *rq) + } + } + +-static unsigned long list_count(struct list_head *list) +-{ +- struct list_head *pos; +- unsigned long count = 0; +- +- list_for_each(pos, list) +- count++; +- +- return count; +-} +- + static unsigned long read_ul(void *p, size_t x) + { + return *(unsigned long *)(p + x); +@@ -2180,11 +2169,11 @@ void intel_engine_dump_active_requests(struct list_head *requests, + } + } + +-static void engine_dump_active_requests(struct intel_engine_cs *engine, struct drm_printer *m) ++static void engine_dump_active_requests(struct intel_engine_cs *engine, ++ struct drm_printer *m) + { ++ struct intel_context *hung_ce = NULL; + struct i915_request *hung_rq = NULL; +- struct intel_context *ce; +- bool guc; + + /* + * No need for an engine->irq_seqno_barrier() before the seqno reads. +@@ -2193,29 +2182,20 @@ static void engine_dump_active_requests(struct intel_engine_cs *engine, struct d + * But the intention here is just to report an instantaneous snapshot + * so that's fine. + */ +- lockdep_assert_held(&engine->sched_engine->lock); ++ intel_engine_get_hung_entity(engine, &hung_ce, &hung_rq); + + drm_printf(m, "\tRequests:\n"); + +- guc = intel_uc_uses_guc_submission(&engine->gt->uc); +- if (guc) { +- ce = intel_engine_get_hung_context(engine); +- if (ce) +- hung_rq = intel_context_get_active_request(ce); +- } else { +- hung_rq = intel_engine_execlist_find_hung_request(engine); +- if (hung_rq) +- hung_rq = i915_request_get_rcu(hung_rq); +- } +- + if (hung_rq) + engine_dump_request(hung_rq, m, "\t\thung"); ++ else if (hung_ce) ++ drm_printf(m, "\t\tGot hung ce but no hung rq!\n"); + +- if (guc) ++ if (intel_uc_uses_guc_submission(&engine->gt->uc)) + intel_guc_dump_active_requests(engine, hung_rq, m); + else +- intel_engine_dump_active_requests(&engine->sched_engine->requests, +- hung_rq, m); ++ intel_execlists_dump_active_requests(engine, hung_rq, m); ++ + if (hung_rq) + i915_request_put(hung_rq); + } +@@ -2227,7 +2207,6 @@ void intel_engine_dump(struct intel_engine_cs *engine, + struct i915_gpu_error * const error = &engine->i915->gpu_error; + struct i915_request *rq; + intel_wakeref_t wakeref; +- unsigned long flags; + ktime_t dummy; + + if (header) { +@@ -2264,13 +2243,8 @@ void intel_engine_dump(struct intel_engine_cs *engine, + i915_reset_count(error)); + print_properties(engine, m); + +- spin_lock_irqsave(&engine->sched_engine->lock, flags); + engine_dump_active_requests(engine, m); + +- drm_printf(m, "\tOn hold?: %lu\n", +- list_count(&engine->sched_engine->hold)); +- spin_unlock_irqrestore(&engine->sched_engine->lock, flags); +- + drm_printf(m, "\tMMIO base: 0x%08x\n", engine->mmio_base); + wakeref = intel_runtime_pm_get_if_in_use(engine->uncore->rpm); + if (wakeref) { +@@ -2316,8 +2290,7 @@ intel_engine_create_virtual(struct intel_engine_cs **siblings, + return siblings[0]->cops->create_virtual(siblings, count, flags); + } + +-struct i915_request * +-intel_engine_execlist_find_hung_request(struct intel_engine_cs *engine) ++static struct i915_request *engine_execlist_find_hung_request(struct intel_engine_cs *engine) + { + struct i915_request *request, *active = NULL; + +@@ -2369,6 +2342,33 @@ intel_engine_execlist_find_hung_request(struct intel_engine_cs *engine) + return active; + } + ++void intel_engine_get_hung_entity(struct intel_engine_cs *engine, ++ struct intel_context **ce, struct i915_request **rq) ++{ ++ unsigned long flags; ++ ++ *ce = intel_engine_get_hung_context(engine); ++ if (*ce) { ++ intel_engine_clear_hung_context(engine); ++ ++ *rq = intel_context_get_active_request(*ce); ++ return; ++ } ++ ++ /* ++ * Getting here with GuC enabled means it is a forced error capture ++ * with no actual hang. So, no need to attempt the execlist search. ++ */ ++ if (intel_uc_uses_guc_submission(&engine->gt->uc)) ++ return; ++ ++ spin_lock_irqsave(&engine->sched_engine->lock, flags); ++ *rq = engine_execlist_find_hung_request(engine); ++ if (*rq) ++ *rq = i915_request_get_rcu(*rq); ++ spin_unlock_irqrestore(&engine->sched_engine->lock, flags); ++} ++ + void xehp_enable_ccs_engines(struct intel_engine_cs *engine) + { + /* +diff --git a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c +index c718e6dc40b5..bfd1ffc71a48 100644 +--- a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c ++++ b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c +@@ -4144,6 +4144,33 @@ void intel_execlists_show_requests(struct intel_engine_cs *engine, + spin_unlock_irqrestore(&sched_engine->lock, flags); + } + ++static unsigned long list_count(struct list_head *list) ++{ ++ struct list_head *pos; ++ unsigned long count = 0; ++ ++ list_for_each(pos, list) ++ count++; ++ ++ return count; ++} ++ ++void intel_execlists_dump_active_requests(struct intel_engine_cs *engine, ++ struct i915_request *hung_rq, ++ struct drm_printer *m) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&engine->sched_engine->lock, flags); ++ ++ intel_engine_dump_active_requests(&engine->sched_engine->requests, hung_rq, m); ++ ++ drm_printf(m, "\tOn hold?: %lu\n", ++ list_count(&engine->sched_engine->hold)); ++ ++ spin_unlock_irqrestore(&engine->sched_engine->lock, flags); ++} ++ + #if IS_ENABLED(CONFIG_DRM_I915_SELFTEST) + #include "selftest_execlists.c" + #endif +diff --git a/drivers/gpu/drm/i915/gt/intel_execlists_submission.h b/drivers/gpu/drm/i915/gt/intel_execlists_submission.h +index a1aa92c983a5..d2c7d45ea062 100644 +--- a/drivers/gpu/drm/i915/gt/intel_execlists_submission.h ++++ b/drivers/gpu/drm/i915/gt/intel_execlists_submission.h +@@ -32,6 +32,10 @@ void intel_execlists_show_requests(struct intel_engine_cs *engine, + int indent), + unsigned int max); + ++void intel_execlists_dump_active_requests(struct intel_engine_cs *engine, ++ struct i915_request *hung_rq, ++ struct drm_printer *m); ++ + bool + intel_engine_in_execlists_submission_mode(const struct intel_engine_cs *engine); + +diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c +index a8ee4cd2ff16..847b9e6af1a1 100644 +--- a/drivers/gpu/drm/i915/i915_gpu_error.c ++++ b/drivers/gpu/drm/i915/i915_gpu_error.c +@@ -1592,35 +1592,15 @@ capture_engine(struct intel_engine_cs *engine, + { + struct intel_engine_capture_vma *capture = NULL; + struct intel_engine_coredump *ee; +- struct intel_context *ce; ++ struct intel_context *ce = NULL; + struct i915_request *rq = NULL; +- unsigned long flags; + + ee = intel_engine_coredump_alloc(engine, ALLOW_FAIL, dump_flags); + if (!ee) + return NULL; + +- ce = intel_engine_get_hung_context(engine); +- if (ce) { +- intel_engine_clear_hung_context(engine); +- rq = intel_context_get_active_request(ce); +- if (!rq || !i915_request_started(rq)) +- goto no_request_capture; +- } else { +- /* +- * Getting here with GuC enabled means it is a forced error capture +- * with no actual hang. So, no need to attempt the execlist search. +- */ +- if (!intel_uc_uses_guc_submission(&engine->gt->uc)) { +- spin_lock_irqsave(&engine->sched_engine->lock, flags); +- rq = intel_engine_execlist_find_hung_request(engine); +- if (rq) +- rq = i915_request_get_rcu(rq); +- spin_unlock_irqrestore(&engine->sched_engine->lock, +- flags); +- } +- } +- if (!rq) ++ intel_engine_get_hung_entity(engine, &ce, &rq); ++ if (!rq || !i915_request_started(rq)) + goto no_request_capture; + + capture = intel_engine_coredump_add_request(ee, rq, ATOMIC_MAYFAIL); +-- +2.39.0 + diff --git a/queue-6.1/drm-i915-guc-fix-locking-when-searching-for-a-hung-r.patch b/queue-6.1/drm-i915-guc-fix-locking-when-searching-for-a-hung-r.patch new file mode 100644 index 00000000000..8b1119abd08 --- /dev/null +++ b/queue-6.1/drm-i915-guc-fix-locking-when-searching-for-a-hung-r.patch @@ -0,0 +1,81 @@ +From bb9fdc1ba1a931c91f1b15b47f0e48e547b26855 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 16:28:35 -0800 +Subject: drm/i915/guc: Fix locking when searching for a hung request + +From: John Harrison + +[ Upstream commit 87b04e53daf806945c415e94de9f90943d434aed ] + +intel_guc_find_hung_context() was not acquiring the correct spinlock +before searching the request list. So fix that up. While at it, add +some extra whitespace padding for readability. + +Fixes: dc0dad365c5e ("drm/i915/guc: Fix for error capture after full GPU reset with GuC") +Signed-off-by: John Harrison +Reviewed-by: Daniele Ceraolo Spurio +Acked-by: Tvrtko Ursulin +Cc: Matthew Brost +Cc: Jani Nikula +Cc: Joonas Lahtinen +Cc: Rodrigo Vivi +Cc: Matt Roper +Cc: Umesh Nerlige Ramappa +Cc: Michael Cheng +Cc: Lucas De Marchi +Cc: Tejas Upadhyay +Cc: Chris Wilson +Cc: Bruce Chang +Cc: Alan Previn +Cc: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-2-John.C.Harrison@Intel.com +(cherry picked from commit d1c3717501bcf56536e8b8c1bdaf5cd5357f6bb2) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +index 1a23e901cc66..259162002c3a 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +@@ -4587,6 +4587,8 @@ void intel_guc_find_hung_context(struct intel_engine_cs *engine) + + xa_lock_irqsave(&guc->context_lookup, flags); + xa_for_each(&guc->context_lookup, index, ce) { ++ bool found; ++ + if (!kref_get_unless_zero(&ce->ref)) + continue; + +@@ -4603,10 +4605,18 @@ void intel_guc_find_hung_context(struct intel_engine_cs *engine) + goto next; + } + ++ found = false; ++ spin_lock(&ce->guc_state.lock); + list_for_each_entry(rq, &ce->guc_state.requests, sched.link) { + if (i915_test_request_state(rq) != I915_REQUEST_ACTIVE) + continue; + ++ found = true; ++ break; ++ } ++ spin_unlock(&ce->guc_state.lock); ++ ++ if (found) { + intel_engine_set_hung_context(engine, ce); + + /* Can only cope with one hang at a time... */ +@@ -4614,6 +4624,7 @@ void intel_guc_find_hung_context(struct intel_engine_cs *engine) + xa_lock(&guc->context_lookup); + goto done; + } ++ + next: + intel_context_put(ce); + xa_lock(&guc->context_lookup); +-- +2.39.0 + diff --git a/queue-6.1/drm-panel-boe-tv101wum-nl6-ensure-dsi-writes-succeed.patch b/queue-6.1/drm-panel-boe-tv101wum-nl6-ensure-dsi-writes-succeed.patch new file mode 100644 index 00000000000..acc489f4eec --- /dev/null +++ b/queue-6.1/drm-panel-boe-tv101wum-nl6-ensure-dsi-writes-succeed.patch @@ -0,0 +1,99 @@ +From 7c10e6e9fd4c6c80055a4af47a702d7c6f2529f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jan 2023 19:01:08 -0800 +Subject: drm/panel: boe-tv101wum-nl6: Ensure DSI writes succeed during disable + +From: Stephen Boyd + +[ Upstream commit a3ee9e0b57f8ecca02d1c16fad4941e09bfe2941 ] + +The unprepare sequence has started to fail after moving to panel bridge +code in the msm drm driver (commit 007ac0262b0d ("drm/msm/dsi: switch to +DRM_PANEL_BRIDGE")). You'll see messages like this in the kernel logs: + + panel-boe-tv101wum-nl6 ae94000.dsi.0: failed to set panel off: -22 + +This is because boe_panel_enter_sleep_mode() needs an operating DSI link +to set the panel into sleep mode. Performing those writes in the +unprepare phase of bridge ops is too late, because the link has already +been torn down by the DSI controller in post_disable, i.e. the PHY has +been disabled, etc. See dsi_mgr_bridge_post_disable() for more details +on the DSI . + +Split the unprepare function into a disable part and an unprepare part. +For now, just the DSI writes to enter sleep mode are put in the disable +function. This fixes the panel off routine and keeps the panel happy. + +My Wormdingler has an integrated touchscreen that stops responding to +touch if the panel is only half disabled too. This patch fixes it. And +finally, this saves power when the screen is off because without this +fix the regulators for the panel are left enabled when nothing is being +displayed on the screen. + +Fixes: 007ac0262b0d ("drm/msm/dsi: switch to DRM_PANEL_BRIDGE") +Fixes: a869b9db7adf ("drm/panel: support for boe tv101wum-nl6 wuxga dsi video mode panel") +Cc: yangcong +Cc: Douglas Anderson +Cc: Jitao Shi +Cc: Sam Ravnborg +Cc: Rob Clark +Cc: Dmitry Baryshkov +Signed-off-by: Stephen Boyd +Reviewed-by: Douglas Anderson +Signed-off-by: Douglas Anderson +Link: https://patchwork.freedesktop.org/patch/msgid/20230106030108.2542081-1-swboyd@chromium.org +(cherry picked from commit c913cd5489930abbb557ef144a333846286754c3) +Signed-off-by: Thomas Zimmermann +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +index 857a2f0420d7..c924f1124ebc 100644 +--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c ++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +@@ -1193,14 +1193,11 @@ static int boe_panel_enter_sleep_mode(struct boe_panel *boe) + return 0; + } + +-static int boe_panel_unprepare(struct drm_panel *panel) ++static int boe_panel_disable(struct drm_panel *panel) + { + struct boe_panel *boe = to_boe_panel(panel); + int ret; + +- if (!boe->prepared) +- return 0; +- + ret = boe_panel_enter_sleep_mode(boe); + if (ret < 0) { + dev_err(panel->dev, "failed to set panel off: %d\n", ret); +@@ -1209,6 +1206,16 @@ static int boe_panel_unprepare(struct drm_panel *panel) + + msleep(150); + ++ return 0; ++} ++ ++static int boe_panel_unprepare(struct drm_panel *panel) ++{ ++ struct boe_panel *boe = to_boe_panel(panel); ++ ++ if (!boe->prepared) ++ return 0; ++ + if (boe->desc->discharge_on_disable) { + regulator_disable(boe->avee); + regulator_disable(boe->avdd); +@@ -1528,6 +1535,7 @@ static enum drm_panel_orientation boe_panel_get_orientation(struct drm_panel *pa + } + + static const struct drm_panel_funcs boe_panel_funcs = { ++ .disable = boe_panel_disable, + .unprepare = boe_panel_unprepare, + .prepare = boe_panel_prepare, + .enable = boe_panel_enable, +-- +2.39.0 + diff --git a/queue-6.1/drm-ssd130x-init-display-before-the-ssd130x_display_.patch b/queue-6.1/drm-ssd130x-init-display-before-the-ssd130x_display_.patch new file mode 100644 index 00000000000..bfec647d5ab --- /dev/null +++ b/queue-6.1/drm-ssd130x-init-display-before-the-ssd130x_display_.patch @@ -0,0 +1,77 @@ +From 5646905ccd3a1f96d245bdb75615b31619bf825b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 19:42:30 +0100 +Subject: drm/ssd130x: Init display before the SSD130X_DISPLAY_ON command + +From: Javier Martinez Canillas + +[ Upstream commit 343c700480982214dc4f834f536a49a4098e556a ] + +Commit 622113b9f11f ("drm/ssd130x: Replace simple display helpers with the +atomic helpers") changed the driver to just use the atomic helpers instead +of the simple KMS abstraction layer. + +But the commit also made a subtle change on the display power sequence and +initialization order, by moving the ssd130x_power_on() call to the encoder +.atomic_enable handler and the ssd130x_init() call to CRTC .reset handler. + +Before this change, both ssd130x_power_on() and ssd130x_init() were called +in the simple display pipeline .enable handler, so the display was already +initialized by the time the SSD130X_DISPLAY_ON command was sent. + +For some reasons, it only made the ssd130x SPI driver to fail but the I2C +was still working. That is the reason why the bug was not noticed before. + +To revert to the old driver behavior, move the ssd130x_init() call to the +encoder .atomic_enable as well. Besides fixing the panel not being turned +on when using SPI, it also gets rid of the custom CRTC .reset callback. + +Fixes: 622113b9f11f ("drm/ssd130x: Replace simple display helpers with the atomic helpers") +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20230125184230.3343206-1-javierm@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/solomon/ssd130x.c | 18 +++++++----------- + 1 file changed, 7 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/solomon/ssd130x.c b/drivers/gpu/drm/solomon/ssd130x.c +index bc41a5ae810a..4bb3a247732d 100644 +--- a/drivers/gpu/drm/solomon/ssd130x.c ++++ b/drivers/gpu/drm/solomon/ssd130x.c +@@ -665,18 +665,8 @@ static const struct drm_crtc_helper_funcs ssd130x_crtc_helper_funcs = { + .atomic_check = ssd130x_crtc_helper_atomic_check, + }; + +-static void ssd130x_crtc_reset(struct drm_crtc *crtc) +-{ +- struct drm_device *drm = crtc->dev; +- struct ssd130x_device *ssd130x = drm_to_ssd130x(drm); +- +- ssd130x_init(ssd130x); +- +- drm_atomic_helper_crtc_reset(crtc); +-} +- + static const struct drm_crtc_funcs ssd130x_crtc_funcs = { +- .reset = ssd130x_crtc_reset, ++ .reset = drm_atomic_helper_crtc_reset, + .destroy = drm_crtc_cleanup, + .set_config = drm_atomic_helper_set_config, + .page_flip = drm_atomic_helper_page_flip, +@@ -695,6 +685,12 @@ static void ssd130x_encoder_helper_atomic_enable(struct drm_encoder *encoder, + if (ret) + return; + ++ ret = ssd130x_init(ssd130x); ++ if (ret) { ++ ssd130x_power_off(ssd130x); ++ return; ++ } ++ + ssd130x_write_cmd(ssd130x, 1, SSD130X_DISPLAY_ON); + + backlight_enable(ssd130x->bl_dev); +-- +2.39.0 + diff --git a/queue-6.1/drm-vc4-hdmi-make-cec-adapter-name-unique.patch b/queue-6.1/drm-vc4-hdmi-make-cec-adapter-name-unique.patch new file mode 100644 index 00000000000..a00b92738d7 --- /dev/null +++ b/queue-6.1/drm-vc4-hdmi-make-cec-adapter-name-unique.patch @@ -0,0 +1,40 @@ +From c05a3d5d4a309ec810feeae7ca02255834ca70ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 10:02:19 +0100 +Subject: drm/vc4: hdmi: make CEC adapter name unique + +From: Hans Verkuil + +[ Upstream commit 51128c3f2a7c98055ea1d27e34910dc10977f618 ] + +The bcm2711 has two HDMI outputs, each with their own CEC adapter. +The CEC adapter name has to be unique, but it is currently +hardcoded to "vc4" for both outputs. Change this to use the card_name +from the variant information in order to make the adapter name unique. + +Signed-off-by: Hans Verkuil +Fixes: 15b4511a4af6 ("drm/vc4: add HDMI CEC support") +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/dcf1db75-d9cc-62cc-fa12-baf1b2b3bf31@xs4all.nl +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index 470432c8fd70..c4b73d9dd040 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -3009,7 +3009,8 @@ static int vc4_hdmi_cec_init(struct vc4_hdmi *vc4_hdmi) + } + + vc4_hdmi->cec_adap = cec_allocate_adapter(&vc4_hdmi_cec_adap_ops, +- vc4_hdmi, "vc4", ++ vc4_hdmi, ++ vc4_hdmi->variant->card_name, + CEC_CAP_DEFAULTS | + CEC_CAP_CONNECTOR_INFO, 1); + ret = PTR_ERR_OR_ZERO(vc4_hdmi->cec_adap); +-- +2.39.0 + diff --git a/queue-6.1/efi-fix-potential-null-deref-in-efi_mem_reserve_pers.patch b/queue-6.1/efi-fix-potential-null-deref-in-efi_mem_reserve_pers.patch new file mode 100644 index 00000000000..d126cd11c7d --- /dev/null +++ b/queue-6.1/efi-fix-potential-null-deref-in-efi_mem_reserve_pers.patch @@ -0,0 +1,42 @@ +From 4b15f20631e98a2723e708d0950814d2626d52ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Feb 2023 16:22:13 +0300 +Subject: efi: fix potential NULL deref in efi_mem_reserve_persistent + +From: Anton Gusev + +[ Upstream commit 966d47e1f27c45507c5df82b2a2157e5a4fd3909 ] + +When iterating on a linked list, a result of memremap is dereferenced +without checking it for NULL. + +This patch adds a check that falls back on allocating a new page in +case memremap doesn't succeed. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 18df7577adae ("efi/memreserve: deal with memreserve entries in unmapped memory") +Signed-off-by: Anton Gusev +[ardb: return -ENOMEM instead of breaking out of the loop] +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/efi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c +index 033aac6be7da..b43e5e6ddaf6 100644 +--- a/drivers/firmware/efi/efi.c ++++ b/drivers/firmware/efi/efi.c +@@ -984,6 +984,8 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size) + /* first try to find a slot in an existing linked list entry */ + for (prsv = efi_memreserve_root->next; prsv; ) { + rsv = memremap(prsv, sizeof(*rsv), MEMREMAP_WB); ++ if (!rsv) ++ return -ENOMEM; + index = atomic_fetch_add_unless(&rsv->count, 1, rsv->size); + if (index < rsv->size) { + rsv->entry[index].base = addr; +-- +2.39.0 + diff --git a/queue-6.1/fix-direction-argument-of-iov_iter_-init-bvec.patch b/queue-6.1/fix-direction-argument-of-iov_iter_-init-bvec.patch new file mode 100644 index 00000000000..69a02fa3e29 --- /dev/null +++ b/queue-6.1/fix-direction-argument-of-iov_iter_-init-bvec.patch @@ -0,0 +1,75 @@ +From 15c8644204c5b32d048cadb27de61eb62b4428e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 19:09:39 -0400 +Subject: fix 'direction' argument of iov_iter_{init,bvec}() + +From: Al Viro + +[ Upstream commit e3bf3df824675ea9cadc3cd2c75d08ee83a6ae26 ] + +READ means "data destination", WRITE - "data source". + +Signed-off-by: Al Viro +Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response") +Signed-off-by: Sasha Levin +--- + drivers/vhost/vhost.c | 6 +++--- + drivers/vhost/vringh.c | 4 ++-- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 547f89a6940f..c234869d6727 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -833,7 +833,7 @@ static int vhost_copy_to_user(struct vhost_virtqueue *vq, void __user *to, + VHOST_ACCESS_WO); + if (ret < 0) + goto out; +- iov_iter_init(&t, WRITE, vq->iotlb_iov, ret, size); ++ iov_iter_init(&t, READ, vq->iotlb_iov, ret, size); + ret = copy_to_iter(from, size, &t); + if (ret == size) + ret = 0; +@@ -872,7 +872,7 @@ static int vhost_copy_from_user(struct vhost_virtqueue *vq, void *to, + (unsigned long long) size); + goto out; + } +- iov_iter_init(&f, READ, vq->iotlb_iov, ret, size); ++ iov_iter_init(&f, WRITE, vq->iotlb_iov, ret, size); + ret = copy_from_iter(to, size, &f); + if (ret == size) + ret = 0; +@@ -2136,7 +2136,7 @@ static int get_indirect(struct vhost_virtqueue *vq, + vq_err(vq, "Translation failure %d in indirect.\n", ret); + return ret; + } +- iov_iter_init(&from, READ, vq->indirect, ret, len); ++ iov_iter_init(&from, WRITE, vq->indirect, ret, len); + count = len / sizeof desc; + /* Buffers are chained via a 16 bit next field, so + * we can have at most 2^16 of these. */ +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index 828c29306565..139c782848c6 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -1161,7 +1161,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + else if (ret < 0) + return ret; + +- iov_iter_bvec(&iter, READ, iov, ret, translated); ++ iov_iter_bvec(&iter, WRITE, iov, ret, translated); + + ret = copy_from_iter(dst, translated, &iter); + if (ret < 0) +@@ -1194,7 +1194,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + else if (ret < 0) + return ret; + +- iov_iter_bvec(&iter, WRITE, iov, ret, translated); ++ iov_iter_bvec(&iter, READ, iov, ret, translated); + + ret = copy_to_iter(src, translated, &iter); + if (ret < 0) +-- +2.39.0 + diff --git a/queue-6.1/fix-direction-argument-of-iov_iter_kvec.patch b/queue-6.1/fix-direction-argument-of-iov_iter_kvec.patch new file mode 100644 index 00000000000..5681e1a97af --- /dev/null +++ b/queue-6.1/fix-direction-argument-of-iov_iter_kvec.patch @@ -0,0 +1,55 @@ +From 09ad65ee301cb6f20ae4832a45d4f9e29d770df0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 19:16:56 -0400 +Subject: fix "direction" argument of iov_iter_kvec() + +From: Al Viro + +[ Upstream commit fc02f33787d8dd227b54f263eba983d5b249c032 ] + +Signed-off-by: Al Viro +Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response") +Signed-off-by: Sasha Levin +--- + drivers/xen/pvcalls-back.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c +index d6f945fd4147..21b9c850a382 100644 +--- a/drivers/xen/pvcalls-back.c ++++ b/drivers/xen/pvcalls-back.c +@@ -129,13 +129,13 @@ static bool pvcalls_conn_back_read(void *opaque) + if (masked_prod < masked_cons) { + vec[0].iov_base = data->in + masked_prod; + vec[0].iov_len = wanted; +- iov_iter_kvec(&msg.msg_iter, WRITE, vec, 1, wanted); ++ iov_iter_kvec(&msg.msg_iter, READ, vec, 1, wanted); + } else { + vec[0].iov_base = data->in + masked_prod; + vec[0].iov_len = array_size - masked_prod; + vec[1].iov_base = data->in; + vec[1].iov_len = wanted - vec[0].iov_len; +- iov_iter_kvec(&msg.msg_iter, WRITE, vec, 2, wanted); ++ iov_iter_kvec(&msg.msg_iter, READ, vec, 2, wanted); + } + + atomic_set(&map->read, 0); +@@ -188,13 +188,13 @@ static bool pvcalls_conn_back_write(struct sock_mapping *map) + if (pvcalls_mask(prod, array_size) > pvcalls_mask(cons, array_size)) { + vec[0].iov_base = data->out + pvcalls_mask(cons, array_size); + vec[0].iov_len = size; +- iov_iter_kvec(&msg.msg_iter, READ, vec, 1, size); ++ iov_iter_kvec(&msg.msg_iter, WRITE, vec, 1, size); + } else { + vec[0].iov_base = data->out + pvcalls_mask(cons, array_size); + vec[0].iov_len = array_size - pvcalls_mask(cons, array_size); + vec[1].iov_base = data->out; + vec[1].iov_len = size - vec[0].iov_len; +- iov_iter_kvec(&msg.msg_iter, READ, vec, 2, size); ++ iov_iter_kvec(&msg.msg_iter, WRITE, vec, 2, size); + } + + atomic_set(&map->write, 0); +-- +2.39.0 + diff --git a/queue-6.1/fix-iov_iter_bvec-direction-argument.patch b/queue-6.1/fix-iov_iter_bvec-direction-argument.patch new file mode 100644 index 00000000000..5a701f3a05f --- /dev/null +++ b/queue-6.1/fix-iov_iter_bvec-direction-argument.patch @@ -0,0 +1,41 @@ +From 1001a259456372f0a03db49cf03349d7b215c3dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 19:04:18 -0400 +Subject: fix iov_iter_bvec() "direction" argument + +From: Al Viro + +[ Upstream commit b676668d99155e6859d99bbf2df18b3f03851902 ] + +Signed-off-by: Al Viro +Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response") +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_file.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c +index 28aa643be5d5..55935040541b 100644 +--- a/drivers/target/target_core_file.c ++++ b/drivers/target/target_core_file.c +@@ -337,7 +337,7 @@ static int fd_do_rw(struct se_cmd *cmd, struct file *fd, + len += sg->length; + } + +- iov_iter_bvec(&iter, READ, bvec, sgl_nents, len); ++ iov_iter_bvec(&iter, is_write, bvec, sgl_nents, len); + if (is_write) + ret = vfs_iter_write(fd, &iter, &pos, 0); + else +@@ -473,7 +473,7 @@ fd_execute_write_same(struct se_cmd *cmd) + len += se_dev->dev_attrib.block_size; + } + +- iov_iter_bvec(&iter, READ, bvec, nolb, len); ++ iov_iter_bvec(&iter, WRITE, bvec, nolb, len); + ret = vfs_iter_write(fd_dev->fd_file, &iter, &pos, 0); + + kfree(bvec); +-- +2.39.0 + diff --git a/queue-6.1/fscache-use-wait_on_bit-to-wait-for-the-freeing-of-r.patch b/queue-6.1/fscache-use-wait_on_bit-to-wait-for-the-freeing-of-r.patch new file mode 100644 index 00000000000..715cbf6e90b --- /dev/null +++ b/queue-6.1/fscache-use-wait_on_bit-to-wait-for-the-freeing-of-r.patch @@ -0,0 +1,100 @@ +From 97b1dc985ce1d6235a025671abbaf83173e3c1c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 19:52:10 +0800 +Subject: fscache: Use wait_on_bit() to wait for the freeing of relinquished + volume + +From: Hou Tao + +[ Upstream commit 8226e37d82f43657da34dd770e2b38f20242ada7 ] + +The freeing of relinquished volume will wake up the pending volume +acquisition by using wake_up_bit(), however it is mismatched with +wait_var_event() used in fscache_wait_on_volume_collision() and it will +never wake up the waiter in the wait-queue because these two functions +operate on different wait-queues. + +According to the implementation in fscache_wait_on_volume_collision(), +if the wake-up of pending acquisition is delayed longer than 20 seconds +(e.g., due to the delay of on-demand fd closing), the first +wait_var_event_timeout() will timeout and the following wait_var_event() +will hang forever as shown below: + + FS-Cache: Potential volume collision new=00000024 old=00000022 + ...... + INFO: task mount:1148 blocked for more than 122 seconds. + Not tainted 6.1.0-rc6+ #1 + task:mount state:D stack:0 pid:1148 ppid:1 + Call Trace: + + __schedule+0x2f6/0xb80 + schedule+0x67/0xe0 + fscache_wait_on_volume_collision.cold+0x80/0x82 + __fscache_acquire_volume+0x40d/0x4e0 + erofs_fscache_register_volume+0x51/0xe0 [erofs] + erofs_fscache_register_fs+0x19c/0x240 [erofs] + erofs_fc_fill_super+0x746/0xaf0 [erofs] + vfs_get_super+0x7d/0x100 + get_tree_nodev+0x16/0x20 + erofs_fc_get_tree+0x20/0x30 [erofs] + vfs_get_tree+0x24/0xb0 + path_mount+0x2fa/0xa90 + do_mount+0x7c/0xa0 + __x64_sys_mount+0x8b/0xe0 + do_syscall_64+0x30/0x60 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Considering that wake_up_bit() is more selective, so fix it by using +wait_on_bit() instead of wait_var_event() to wait for the freeing of +relinquished volume. In addition because waitqueue_active() is used in +wake_up_bit() and clear_bit() doesn't imply any memory barrier, use +clear_and_wake_up_bit() to add the missing memory barrier between +cursor->flags and waitqueue_active(). + +Fixes: 62ab63352350 ("fscache: Implement volume registration") +Reviewed-by: Jingbo Xu +Signed-off-by: Hou Tao +Signed-off-by: David Howells +Reviewed-by: Jeff Layton +Link: https://lore.kernel.org/r/20230113115211.2895845-2-houtao@huaweicloud.com/ # v3 +Signed-off-by: Sasha Levin +--- + fs/fscache/volume.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/fs/fscache/volume.c b/fs/fscache/volume.c +index ab8ceddf9efa..903af9d85f8b 100644 +--- a/fs/fscache/volume.c ++++ b/fs/fscache/volume.c +@@ -141,13 +141,14 @@ static bool fscache_is_acquire_pending(struct fscache_volume *volume) + static void fscache_wait_on_volume_collision(struct fscache_volume *candidate, + unsigned int collidee_debug_id) + { +- wait_var_event_timeout(&candidate->flags, +- !fscache_is_acquire_pending(candidate), 20 * HZ); ++ wait_on_bit_timeout(&candidate->flags, FSCACHE_VOLUME_ACQUIRE_PENDING, ++ TASK_UNINTERRUPTIBLE, 20 * HZ); + if (fscache_is_acquire_pending(candidate)) { + pr_notice("Potential volume collision new=%08x old=%08x", + candidate->debug_id, collidee_debug_id); + fscache_stat(&fscache_n_volumes_collision); +- wait_var_event(&candidate->flags, !fscache_is_acquire_pending(candidate)); ++ wait_on_bit(&candidate->flags, FSCACHE_VOLUME_ACQUIRE_PENDING, ++ TASK_UNINTERRUPTIBLE); + } + } + +@@ -347,8 +348,8 @@ static void fscache_wake_pending_volume(struct fscache_volume *volume, + hlist_bl_for_each_entry(cursor, p, h, hash_link) { + if (fscache_volume_same(cursor, volume)) { + fscache_see_volume(cursor, fscache_volume_see_hash_wake); +- clear_bit(FSCACHE_VOLUME_ACQUIRE_PENDING, &cursor->flags); +- wake_up_bit(&cursor->flags, FSCACHE_VOLUME_ACQUIRE_PENDING); ++ clear_and_wake_up_bit(FSCACHE_VOLUME_ACQUIRE_PENDING, ++ &cursor->flags); + return; + } + } +-- +2.39.0 + diff --git a/queue-6.1/i2c-designware-pci-add-new-pci-ids-for-amd-navi-gpu.patch b/queue-6.1/i2c-designware-pci-add-new-pci-ids-for-amd-navi-gpu.patch new file mode 100644 index 00000000000..e3ccf27f847 --- /dev/null +++ b/queue-6.1/i2c-designware-pci-add-new-pci-ids-for-amd-navi-gpu.patch @@ -0,0 +1,39 @@ +From 021af8422d999b964839507042340e7fdbd41dba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 22:39:55 +0530 +Subject: i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU + +From: Basavaraj Natikar + +[ Upstream commit 2ece0930ac5662bccce0ba4c59b84c98d2437200 ] + +Add additional supported PCI IDs for latest AMD NAVI GPU card which +has an integrated Type-C controller and designware I2C with PCI +interface. + +Signed-off-by: Basavaraj Natikar +Tested-by: Sanath S +Reviewed-by: Andy Shevchenko +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-pcidrv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c +index e499f96506c5..782fe1ef3ca1 100644 +--- a/drivers/i2c/busses/i2c-designware-pcidrv.c ++++ b/drivers/i2c/busses/i2c-designware-pcidrv.c +@@ -396,6 +396,8 @@ static const struct pci_device_id i2_designware_pci_ids[] = { + { PCI_VDEVICE(ATI, 0x73a4), navi_amd }, + { PCI_VDEVICE(ATI, 0x73e4), navi_amd }, + { PCI_VDEVICE(ATI, 0x73c4), navi_amd }, ++ { PCI_VDEVICE(ATI, 0x7444), navi_amd }, ++ { PCI_VDEVICE(ATI, 0x7464), navi_amd }, + { 0,} + }; + MODULE_DEVICE_TABLE(pci, i2_designware_pci_ids); +-- +2.39.0 + diff --git a/queue-6.1/i2c-mxs-suppress-probe-deferral-error-message.patch b/queue-6.1/i2c-mxs-suppress-probe-deferral-error-message.patch new file mode 100644 index 00000000000..c4d3ab6f37d --- /dev/null +++ b/queue-6.1/i2c-mxs-suppress-probe-deferral-error-message.patch @@ -0,0 +1,44 @@ +From d372e779c4e4b7038bd03d8a0eca94539e97ac37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Jan 2023 13:32:29 +0100 +Subject: i2c: mxs: suppress probe-deferral error message + +From: Stefan Wahren + +[ Upstream commit 78a4471fa1a76a8bef4919105de67660a89a1e9b ] + +During boot of I2SE Duckbill the kernel log contains a +confusing error: + + Failed to request dma + +This is caused by i2c-mxs tries to request a not yet available DMA +channel (-EPROBE_DEFER). So suppress this message by using +dev_err_probe(). + +Signed-off-by: Stefan Wahren +Reviewed-by: Fabio Estevam +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mxs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c +index 5af5cffc444e..d113bed79545 100644 +--- a/drivers/i2c/busses/i2c-mxs.c ++++ b/drivers/i2c/busses/i2c-mxs.c +@@ -826,8 +826,8 @@ static int mxs_i2c_probe(struct platform_device *pdev) + /* Setup the DMA */ + i2c->dmach = dma_request_chan(dev, "rx-tx"); + if (IS_ERR(i2c->dmach)) { +- dev_err(dev, "Failed to request dma\n"); +- return PTR_ERR(i2c->dmach); ++ return dev_err_probe(dev, PTR_ERR(i2c->dmach), ++ "Failed to request dma\n"); + } + + platform_set_drvdata(pdev, i2c); +-- +2.39.0 + diff --git a/queue-6.1/i2c-rk3x-fix-a-bunch-of-kernel-doc-warnings.patch b/queue-6.1/i2c-rk3x-fix-a-bunch-of-kernel-doc-warnings.patch new file mode 100644 index 00000000000..f8276856248 --- /dev/null +++ b/queue-6.1/i2c-rk3x-fix-a-bunch-of-kernel-doc-warnings.patch @@ -0,0 +1,180 @@ +From 860d859ec57099db13f61584805ccfe33fff156b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 22:38:05 -0800 +Subject: i2c: rk3x: fix a bunch of kernel-doc warnings + +From: Randy Dunlap + +[ Upstream commit 0582d984793d30442da88fe458674502bad1ad29 ] + +Fix multiple W=1 kernel-doc warnings in i2c-rk3x.c: + +drivers/i2c/busses/i2c-rk3x.c:83: warning: missing initial short description on line: + * struct i2c_spec_values: +drivers/i2c/busses/i2c-rk3x.c:139: warning: missing initial short description on line: + * struct rk3x_i2c_calced_timings: +drivers/i2c/busses/i2c-rk3x.c:162: warning: missing initial short description on line: + * struct rk3x_i2c_soc_data: +drivers/i2c/busses/i2c-rk3x.c:242: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst + * Generate a START condition, which triggers a REG_INT_START interrupt. +drivers/i2c/busses/i2c-rk3x.c:261: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst + * Generate a STOP condition, which triggers a REG_INT_STOP interrupt. +drivers/i2c/busses/i2c-rk3x.c:304: warning: expecting prototype for Setup a read according to i2c(). Prototype was for rk3x_i2c_prepare_read() instead +drivers/i2c/busses/i2c-rk3x.c:335: warning: expecting prototype for Fill the transmit buffer with data from i2c(). Prototype was for rk3x_i2c_fill_transmit_buf() instead +drivers/i2c/busses/i2c-rk3x.c:535: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst + * Get timing values of I2C specification +drivers/i2c/busses/i2c-rk3x.c:552: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst + * Calculate divider values for desired SCL frequency +drivers/i2c/busses/i2c-rk3x.c:713: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst + * Calculate timing values for desired SCL frequency +drivers/i2c/busses/i2c-rk3x.c:963: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst + * Setup I2C registers for an I2C operation specified by msgs, num. + +Signed-off-by: Randy Dunlap +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rk3x.c | 44 +++++++++++++++++------------------ + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c +index d1658ed76562..b31cf4f18f85 100644 +--- a/drivers/i2c/busses/i2c-rk3x.c ++++ b/drivers/i2c/busses/i2c-rk3x.c +@@ -80,7 +80,7 @@ enum { + #define DEFAULT_SCL_RATE (100 * 1000) /* Hz */ + + /** +- * struct i2c_spec_values: ++ * struct i2c_spec_values - I2C specification values for various modes + * @min_hold_start_ns: min hold time (repeated) START condition + * @min_low_ns: min LOW period of the SCL clock + * @min_high_ns: min HIGH period of the SCL cloc +@@ -136,7 +136,7 @@ static const struct i2c_spec_values fast_mode_plus_spec = { + }; + + /** +- * struct rk3x_i2c_calced_timings: ++ * struct rk3x_i2c_calced_timings - calculated V1 timings + * @div_low: Divider output for low + * @div_high: Divider output for high + * @tuning: Used to adjust setup/hold data time, +@@ -159,7 +159,7 @@ enum rk3x_i2c_state { + }; + + /** +- * struct rk3x_i2c_soc_data: ++ * struct rk3x_i2c_soc_data - SOC-specific data + * @grf_offset: offset inside the grf regmap for setting the i2c type + * @calc_timings: Callback function for i2c timing information calculated + */ +@@ -239,7 +239,8 @@ static inline void rk3x_i2c_clean_ipd(struct rk3x_i2c *i2c) + } + + /** +- * Generate a START condition, which triggers a REG_INT_START interrupt. ++ * rk3x_i2c_start - Generate a START condition, which triggers a REG_INT_START interrupt. ++ * @i2c: target controller data + */ + static void rk3x_i2c_start(struct rk3x_i2c *i2c) + { +@@ -258,8 +259,8 @@ static void rk3x_i2c_start(struct rk3x_i2c *i2c) + } + + /** +- * Generate a STOP condition, which triggers a REG_INT_STOP interrupt. +- * ++ * rk3x_i2c_stop - Generate a STOP condition, which triggers a REG_INT_STOP interrupt. ++ * @i2c: target controller data + * @error: Error code to return in rk3x_i2c_xfer + */ + static void rk3x_i2c_stop(struct rk3x_i2c *i2c, int error) +@@ -298,7 +299,8 @@ static void rk3x_i2c_stop(struct rk3x_i2c *i2c, int error) + } + + /** +- * Setup a read according to i2c->msg ++ * rk3x_i2c_prepare_read - Setup a read according to i2c->msg ++ * @i2c: target controller data + */ + static void rk3x_i2c_prepare_read(struct rk3x_i2c *i2c) + { +@@ -329,7 +331,8 @@ static void rk3x_i2c_prepare_read(struct rk3x_i2c *i2c) + } + + /** +- * Fill the transmit buffer with data from i2c->msg ++ * rk3x_i2c_fill_transmit_buf - Fill the transmit buffer with data from i2c->msg ++ * @i2c: target controller data + */ + static void rk3x_i2c_fill_transmit_buf(struct rk3x_i2c *i2c) + { +@@ -532,11 +535,10 @@ static irqreturn_t rk3x_i2c_irq(int irqno, void *dev_id) + } + + /** +- * Get timing values of I2C specification +- * ++ * rk3x_i2c_get_spec - Get timing values of I2C specification + * @speed: Desired SCL frequency + * +- * Returns: Matched i2c spec values. ++ * Return: Matched i2c_spec_values. + */ + static const struct i2c_spec_values *rk3x_i2c_get_spec(unsigned int speed) + { +@@ -549,13 +551,12 @@ static const struct i2c_spec_values *rk3x_i2c_get_spec(unsigned int speed) + } + + /** +- * Calculate divider values for desired SCL frequency +- * ++ * rk3x_i2c_v0_calc_timings - Calculate divider values for desired SCL frequency + * @clk_rate: I2C input clock rate + * @t: Known I2C timing information + * @t_calc: Caculated rk3x private timings that would be written into regs + * +- * Returns: 0 on success, -EINVAL if the goal SCL rate is too slow. In that case ++ * Return: %0 on success, -%EINVAL if the goal SCL rate is too slow. In that case + * a best-effort divider value is returned in divs. If the target rate is + * too high, we silently use the highest possible rate. + */ +@@ -710,13 +711,12 @@ static int rk3x_i2c_v0_calc_timings(unsigned long clk_rate, + } + + /** +- * Calculate timing values for desired SCL frequency +- * ++ * rk3x_i2c_v1_calc_timings - Calculate timing values for desired SCL frequency + * @clk_rate: I2C input clock rate + * @t: Known I2C timing information + * @t_calc: Caculated rk3x private timings that would be written into regs + * +- * Returns: 0 on success, -EINVAL if the goal SCL rate is too slow. In that case ++ * Return: %0 on success, -%EINVAL if the goal SCL rate is too slow. In that case + * a best-effort divider value is returned in divs. If the target rate is + * too high, we silently use the highest possible rate. + * The following formulas are v1's method to calculate timings. +@@ -960,14 +960,14 @@ static int rk3x_i2c_clk_notifier_cb(struct notifier_block *nb, unsigned long + } + + /** +- * Setup I2C registers for an I2C operation specified by msgs, num. +- * +- * Must be called with i2c->lock held. +- * ++ * rk3x_i2c_setup - Setup I2C registers for an I2C operation specified by msgs, num. ++ * @i2c: target controller data + * @msgs: I2C msgs to process + * @num: Number of msgs + * +- * returns: Number of I2C msgs processed or negative in case of error ++ * Must be called with i2c->lock held. ++ * ++ * Return: Number of I2C msgs processed or negative in case of error + */ + static int rk3x_i2c_setup(struct rk3x_i2c *i2c, struct i2c_msg *msgs, int num) + { +-- +2.39.0 + diff --git a/queue-6.1/ice-prevent-set_channel-from-changing-queues-while-r.patch b/queue-6.1/ice-prevent-set_channel-from-changing-queues-while-r.patch new file mode 100644 index 00000000000..0709b5ffcc5 --- /dev/null +++ b/queue-6.1/ice-prevent-set_channel-from-changing-queues-while-r.patch @@ -0,0 +1,211 @@ +From e32d7e59dd44f76de5eb806d154c1f976304db87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 09:19:43 -0800 +Subject: ice: Prevent set_channel from changing queues while RDMA active + +From: Dave Ertman + +[ Upstream commit a6a0974aae4209d039ba81226ded5246eea14961 ] + +The PF controls the set of queues that the RDMA auxiliary_driver requests +resources from. The set_channel command will alter that pool and trigger a +reconfiguration of the VSI, which breaks RDMA functionality. + +Prevent set_channel from executing when RDMA driver bound to auxiliary +device. + +Adding a locked variable to pass down the call chain to avoid double +locking the device_lock. + +Fixes: 348048e724a0 ("ice: Implement iidc operations") +Signed-off-by: Dave Ertman +Tested-by: Gurucharan G (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice.h | 2 +- + drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 23 +++++++++------- + drivers/net/ethernet/intel/ice/ice_dcb_lib.h | 4 +-- + drivers/net/ethernet/intel/ice/ice_ethtool.c | 28 +++++++++++++++++--- + drivers/net/ethernet/intel/ice/ice_main.c | 5 ++-- + 5 files changed, 43 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h +index 001500afc4a6..e04871379baa 100644 +--- a/drivers/net/ethernet/intel/ice/ice.h ++++ b/drivers/net/ethernet/intel/ice/ice.h +@@ -856,7 +856,7 @@ void ice_set_ethtool_repr_ops(struct net_device *netdev); + void ice_set_ethtool_safe_mode_ops(struct net_device *netdev); + u16 ice_get_avail_txq_count(struct ice_pf *pf); + u16 ice_get_avail_rxq_count(struct ice_pf *pf); +-int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx); ++int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked); + void ice_update_vsi_stats(struct ice_vsi *vsi); + void ice_update_pf_stats(struct ice_pf *pf); + void +diff --git a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c +index add90e75f05c..9aa0437aa598 100644 +--- a/drivers/net/ethernet/intel/ice/ice_dcb_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_dcb_lib.c +@@ -434,7 +434,7 @@ int ice_pf_dcb_cfg(struct ice_pf *pf, struct ice_dcbx_cfg *new_cfg, bool locked) + goto out; + } + +- ice_pf_dcb_recfg(pf); ++ ice_pf_dcb_recfg(pf, false); + + out: + /* enable previously downed VSIs */ +@@ -724,12 +724,13 @@ static int ice_dcb_noncontig_cfg(struct ice_pf *pf) + /** + * ice_pf_dcb_recfg - Reconfigure all VEBs and VSIs + * @pf: pointer to the PF struct ++ * @locked: is adev device lock held + * + * Assumed caller has already disabled all VSIs before + * calling this function. Reconfiguring DCB based on + * local_dcbx_cfg. + */ +-void ice_pf_dcb_recfg(struct ice_pf *pf) ++void ice_pf_dcb_recfg(struct ice_pf *pf, bool locked) + { + struct ice_dcbx_cfg *dcbcfg = &pf->hw.port_info->qos_cfg.local_dcbx_cfg; + struct iidc_event *event; +@@ -776,14 +777,16 @@ void ice_pf_dcb_recfg(struct ice_pf *pf) + if (vsi->type == ICE_VSI_PF) + ice_dcbnl_set_all(vsi); + } +- /* Notify the AUX drivers that TC change is finished */ +- event = kzalloc(sizeof(*event), GFP_KERNEL); +- if (!event) +- return; ++ if (!locked) { ++ /* Notify the AUX drivers that TC change is finished */ ++ event = kzalloc(sizeof(*event), GFP_KERNEL); ++ if (!event) ++ return; + +- set_bit(IIDC_EVENT_AFTER_TC_CHANGE, event->type); +- ice_send_event_to_aux(pf, event); +- kfree(event); ++ set_bit(IIDC_EVENT_AFTER_TC_CHANGE, event->type); ++ ice_send_event_to_aux(pf, event); ++ kfree(event); ++ } + } + + /** +@@ -1034,7 +1037,7 @@ ice_dcb_process_lldp_set_mib_change(struct ice_pf *pf, + } + + /* changes in configuration update VSI */ +- ice_pf_dcb_recfg(pf); ++ ice_pf_dcb_recfg(pf, false); + + /* enable previously downed VSIs */ + ice_dcb_ena_dis_vsi(pf, true, true); +diff --git a/drivers/net/ethernet/intel/ice/ice_dcb_lib.h b/drivers/net/ethernet/intel/ice/ice_dcb_lib.h +index 4c421c842a13..800879a88c5e 100644 +--- a/drivers/net/ethernet/intel/ice/ice_dcb_lib.h ++++ b/drivers/net/ethernet/intel/ice/ice_dcb_lib.h +@@ -23,7 +23,7 @@ u8 ice_dcb_get_tc(struct ice_vsi *vsi, int queue_index); + int + ice_pf_dcb_cfg(struct ice_pf *pf, struct ice_dcbx_cfg *new_cfg, bool locked); + int ice_dcb_bwchk(struct ice_pf *pf, struct ice_dcbx_cfg *dcbcfg); +-void ice_pf_dcb_recfg(struct ice_pf *pf); ++void ice_pf_dcb_recfg(struct ice_pf *pf, bool locked); + void ice_vsi_cfg_dcb_rings(struct ice_vsi *vsi); + int ice_init_pf_dcb(struct ice_pf *pf, bool locked); + void ice_update_dcb_stats(struct ice_pf *pf); +@@ -128,7 +128,7 @@ static inline u8 ice_get_pfc_mode(struct ice_pf *pf) + return 0; + } + +-static inline void ice_pf_dcb_recfg(struct ice_pf *pf) { } ++static inline void ice_pf_dcb_recfg(struct ice_pf *pf, bool locked) { } + static inline void ice_vsi_cfg_dcb_rings(struct ice_vsi *vsi) { } + static inline void ice_update_dcb_stats(struct ice_pf *pf) { } + static inline void +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index b7be84bbe72d..e1f6373a3a2c 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -3472,7 +3472,9 @@ static int ice_set_channels(struct net_device *dev, struct ethtool_channels *ch) + struct ice_vsi *vsi = np->vsi; + struct ice_pf *pf = vsi->back; + int new_rx = 0, new_tx = 0; ++ bool locked = false; + u32 curr_combined; ++ int ret = 0; + + /* do not support changing channels in Safe Mode */ + if (ice_is_safe_mode(pf)) { +@@ -3536,15 +3538,33 @@ static int ice_set_channels(struct net_device *dev, struct ethtool_channels *ch) + return -EINVAL; + } + +- ice_vsi_recfg_qs(vsi, new_rx, new_tx); ++ if (pf->adev) { ++ mutex_lock(&pf->adev_mutex); ++ device_lock(&pf->adev->dev); ++ locked = true; ++ if (pf->adev->dev.driver) { ++ netdev_err(dev, "Cannot change channels when RDMA is active\n"); ++ ret = -EBUSY; ++ goto adev_unlock; ++ } ++ } ++ ++ ice_vsi_recfg_qs(vsi, new_rx, new_tx, locked); + +- if (!netif_is_rxfh_configured(dev)) +- return ice_vsi_set_dflt_rss_lut(vsi, new_rx); ++ if (!netif_is_rxfh_configured(dev)) { ++ ret = ice_vsi_set_dflt_rss_lut(vsi, new_rx); ++ goto adev_unlock; ++ } + + /* Update rss_size due to change in Rx queues */ + vsi->rss_size = ice_get_valid_rss_size(&pf->hw, new_rx); + +- return 0; ++adev_unlock: ++ if (locked) { ++ device_unlock(&pf->adev->dev); ++ mutex_unlock(&pf->adev_mutex); ++ } ++ return ret; + } + + /** +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index ca2898467dcb..1ac5f0018c7e 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -4192,12 +4192,13 @@ bool ice_is_wol_supported(struct ice_hw *hw) + * @vsi: VSI being changed + * @new_rx: new number of Rx queues + * @new_tx: new number of Tx queues ++ * @locked: is adev device_lock held + * + * Only change the number of queues if new_tx, or new_rx is non-0. + * + * Returns 0 on success. + */ +-int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx) ++int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked) + { + struct ice_pf *pf = vsi->back; + int err = 0, timeout = 50; +@@ -4226,7 +4227,7 @@ int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx) + + ice_vsi_close(vsi); + ice_vsi_rebuild(vsi, false); +- ice_pf_dcb_recfg(pf); ++ ice_pf_dcb_recfg(pf, locked); + ice_vsi_open(vsi); + done: + clear_bit(ICE_CFG_BUSY, pf->state); +-- +2.39.0 + diff --git a/queue-6.1/igc-return-an-error-if-the-mac-type-is-unknown-in-ig.patch b/queue-6.1/igc-return-an-error-if-the-mac-type-is-unknown-in-ig.patch new file mode 100644 index 00000000000..f168262f1bf --- /dev/null +++ b/queue-6.1/igc-return-an-error-if-the-mac-type-is-unknown-in-ig.patch @@ -0,0 +1,76 @@ +From ec896a458986c0b410175ff72f9d239a8209fada Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 13:54:37 -0800 +Subject: igc: return an error if the mac type is unknown in + igc_ptp_systim_to_hwtstamp() + +From: Tom Rix + +[ Upstream commit a2df8463e15c10a8a882090f3d7a760fdb7b189d ] + +clang static analysis reports +drivers/net/ethernet/intel/igc/igc_ptp.c:673:3: warning: The left operand of + '+' is a garbage value [core.UndefinedBinaryOperatorResult] + ktime_add_ns(shhwtstamps.hwtstamp, adjust); + ^ ~~~~~~~~~~~~~~~~~~~~ + +igc_ptp_systim_to_hwtstamp() silently returns without setting the hwtstamp +if the mac type is unknown. This should be treated as an error. + +Fixes: 81b055205e8b ("igc: Add support for RX timestamping") +Signed-off-by: Tom Rix +Reviewed-by: Simon Horman +Acked-by: Sasha Neftin +Tested-by: Naama Meir +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20230131215437.1528994-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_ptp.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c +index c34734d432e0..4e10ced736db 100644 +--- a/drivers/net/ethernet/intel/igc/igc_ptp.c ++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c +@@ -417,10 +417,12 @@ static int igc_ptp_verify_pin(struct ptp_clock_info *ptp, unsigned int pin, + * + * We need to convert the system time value stored in the RX/TXSTMP registers + * into a hwtstamp which can be used by the upper level timestamping functions. ++ * ++ * Returns 0 on success. + **/ +-static void igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter, +- struct skb_shared_hwtstamps *hwtstamps, +- u64 systim) ++static int igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter, ++ struct skb_shared_hwtstamps *hwtstamps, ++ u64 systim) + { + switch (adapter->hw.mac.type) { + case igc_i225: +@@ -430,8 +432,9 @@ static void igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter, + systim & 0xFFFFFFFF); + break; + default: +- break; ++ return -EINVAL; + } ++ return 0; + } + + /** +@@ -652,7 +655,8 @@ static void igc_ptp_tx_hwtstamp(struct igc_adapter *adapter) + + regval = rd32(IGC_TXSTMPL); + regval |= (u64)rd32(IGC_TXSTMPH) << 32; +- igc_ptp_systim_to_hwtstamp(adapter, &shhwtstamps, regval); ++ if (igc_ptp_systim_to_hwtstamp(adapter, &shhwtstamps, regval)) ++ return; + + switch (adapter->link_speed) { + case SPEED_10: +-- +2.39.0 + diff --git a/queue-6.1/ip-ip6_gre-fix-changing-addr-gen-mode-not-generating.patch b/queue-6.1/ip-ip6_gre-fix-changing-addr-gen-mode-not-generating.patch new file mode 100644 index 00000000000..d7610db04a7 --- /dev/null +++ b/queue-6.1/ip-ip6_gre-fix-changing-addr-gen-mode-not-generating.patch @@ -0,0 +1,129 @@ +From 2a3f19ec5524fb7a90ed733505c302d081168d06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 16:46:45 +1300 +Subject: ip/ip6_gre: Fix changing addr gen mode not generating IPv6 link local + address + +From: Thomas Winter + +[ Upstream commit 23ca0c2c93406bdb1150659e720bda1cec1fad04 ] + +For our point-to-point GRE tunnels, they have IN6_ADDR_GEN_MODE_NONE +when they are created then we set IN6_ADDR_GEN_MODE_EUI64 when they +come up to generate the IPv6 link local address for the interface. +Recently we found that they were no longer generating IPv6 addresses. +This issue would also have affected SIT tunnels. + +Commit e5dd729460ca changed the code path so that GRE tunnels +generate an IPv6 address based on the tunnel source address. +It also changed the code path so GRE tunnels don't call addrconf_addr_gen +in addrconf_dev_config which is called by addrconf_sysctl_addr_gen_mode +when the IN6_ADDR_GEN_MODE is changed. + +This patch aims to fix this issue by moving the code in addrconf_notify +which calls the addr gen for GRE and SIT into a separate function +and calling it in the places that expect the IPv6 address to be +generated. + +The previous addrconf_dev_config is renamed to addrconf_eth_config +since it only expected eth type interfaces and follows the +addrconf_gre/sit_config format. + +A part of this changes means that the loopback address will be +attempted to be configured when changing addr_gen_mode for lo. +This should not be a problem because the address should exist anyway +and if does already exist then no error is produced. + +Fixes: e5dd729460ca ("ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL address") +Signed-off-by: Thomas Winter +Reviewed-by: David Ahern +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/addrconf.c | 49 +++++++++++++++++++++++++-------------------- + 1 file changed, 27 insertions(+), 22 deletions(-) + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 9c3f5202a97b..eaecaf2ffe00 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -3447,6 +3447,30 @@ static void addrconf_gre_config(struct net_device *dev) + } + #endif + ++static void addrconf_init_auto_addrs(struct net_device *dev) ++{ ++ switch (dev->type) { ++#if IS_ENABLED(CONFIG_IPV6_SIT) ++ case ARPHRD_SIT: ++ addrconf_sit_config(dev); ++ break; ++#endif ++#if IS_ENABLED(CONFIG_NET_IPGRE) || IS_ENABLED(CONFIG_IPV6_GRE) ++ case ARPHRD_IP6GRE: ++ case ARPHRD_IPGRE: ++ addrconf_gre_config(dev); ++ break; ++#endif ++ case ARPHRD_LOOPBACK: ++ init_loopback(dev); ++ break; ++ ++ default: ++ addrconf_dev_config(dev); ++ break; ++ } ++} ++ + static int fixup_permanent_addr(struct net *net, + struct inet6_dev *idev, + struct inet6_ifaddr *ifp) +@@ -3615,26 +3639,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, + run_pending = 1; + } + +- switch (dev->type) { +-#if IS_ENABLED(CONFIG_IPV6_SIT) +- case ARPHRD_SIT: +- addrconf_sit_config(dev); +- break; +-#endif +-#if IS_ENABLED(CONFIG_NET_IPGRE) || IS_ENABLED(CONFIG_IPV6_GRE) +- case ARPHRD_IP6GRE: +- case ARPHRD_IPGRE: +- addrconf_gre_config(dev); +- break; +-#endif +- case ARPHRD_LOOPBACK: +- init_loopback(dev); +- break; +- +- default: +- addrconf_dev_config(dev); +- break; +- } ++ addrconf_init_auto_addrs(dev); + + if (!IS_ERR_OR_NULL(idev)) { + if (run_pending) +@@ -6397,7 +6402,7 @@ static int addrconf_sysctl_addr_gen_mode(struct ctl_table *ctl, int write, + + if (idev->cnf.addr_gen_mode != new_val) { + idev->cnf.addr_gen_mode = new_val; +- addrconf_dev_config(idev->dev); ++ addrconf_init_auto_addrs(idev->dev); + } + } else if (&net->ipv6.devconf_all->addr_gen_mode == ctl->data) { + struct net_device *dev; +@@ -6408,7 +6413,7 @@ static int addrconf_sysctl_addr_gen_mode(struct ctl_table *ctl, int write, + if (idev && + idev->cnf.addr_gen_mode != new_val) { + idev->cnf.addr_gen_mode = new_val; +- addrconf_dev_config(idev->dev); ++ addrconf_init_auto_addrs(idev->dev); + } + } + } +-- +2.39.0 + diff --git a/queue-6.1/ip-ip6_gre-fix-non-point-to-point-tunnel-not-generat.patch b/queue-6.1/ip-ip6_gre-fix-non-point-to-point-tunnel-not-generat.patch new file mode 100644 index 00000000000..b95834d91ce --- /dev/null +++ b/queue-6.1/ip-ip6_gre-fix-non-point-to-point-tunnel-not-generat.patch @@ -0,0 +1,62 @@ +From 80c5276d45492d51962b3d36af335cf7819e05b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 16:46:46 +1300 +Subject: ip/ip6_gre: Fix non-point-to-point tunnel not generating IPv6 link + local address + +From: Thomas Winter + +[ Upstream commit 30e2291f61f93f7132c060190f8360df52644ec1 ] + +We recently found that our non-point-to-point tunnels were not +generating any IPv6 link local address and instead generating an +IPv6 compat address, breaking IPv6 communication on the tunnel. + +Previously, addrconf_gre_config always would call addrconf_addr_gen +and generate a EUI64 link local address for the tunnel. +Then commit e5dd729460ca changed the code path so that add_v4_addrs +is called but this only generates a compat IPv6 address for +non-point-to-point tunnels. + +I assume the compat address is specifically for SIT tunnels so +have kept that only for SIT - GRE tunnels now always generate link +local addresses. + +Fixes: e5dd729460ca ("ip/ip6_gre: use the same logic as SIT interfaces when computing v6LL address") +Signed-off-by: Thomas Winter +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/addrconf.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index eaecaf2ffe00..e6c7edcf6834 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -3127,17 +3127,17 @@ static void add_v4_addrs(struct inet6_dev *idev) + offset = sizeof(struct in6_addr) - 4; + memcpy(&addr.s6_addr32[3], idev->dev->dev_addr + offset, 4); + +- if (idev->dev->flags&IFF_POINTOPOINT) { ++ if (!(idev->dev->flags & IFF_POINTOPOINT) && idev->dev->type == ARPHRD_SIT) { ++ scope = IPV6_ADDR_COMPATv4; ++ plen = 96; ++ pflags |= RTF_NONEXTHOP; ++ } else { + if (idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_NONE) + return; + + addr.s6_addr32[0] = htonl(0xfe800000); + scope = IFA_LINK; + plen = 64; +- } else { +- scope = IPV6_ADDR_COMPATv4; +- plen = 96; +- pflags |= RTF_NONEXTHOP; + } + + if (addr.s6_addr32[3]) { +-- +2.39.0 + diff --git a/queue-6.1/kbuild-modinst-fix-build-error-when-config_module_si.patch b/queue-6.1/kbuild-modinst-fix-build-error-when-config_module_si.patch new file mode 100644 index 00000000000..2fbb4a16739 --- /dev/null +++ b/queue-6.1/kbuild-modinst-fix-build-error-when-config_module_si.patch @@ -0,0 +1,54 @@ +From 41e6cb052ec3b74ae9f73830d304123305f827bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 09:43:23 +0100 +Subject: kbuild: modinst: Fix build error when CONFIG_MODULE_SIG_KEY is a + PKCS#11 URI + +From: Jan Luebbe + +[ Upstream commit 22e46f6480e83bcf49b6d5e6b66c81872c97a902 ] + +When CONFIG_MODULE_SIG_KEY is PKCS#11 URI (pkcs11:*), signing of modules +fails: + + scripts/sign-file sha256 /.../linux/pkcs11:token=foo;object=bar;pin-value=1111 certs/signing_key.x509 /.../kernel/crypto/tcrypt.ko + Usage: scripts/sign-file [-dp] [] + scripts/sign-file -s [] + +First, we need to avoid adding the $(srctree)/ prefix to the URL. + +Second, since the kconfig string values no longer include quotes, we need to add +them again when passing a PKCS#11 URI to sign-file. This avoids +splitting by the shell if the URI contains semicolons. + +Fixes: 4db9c2e3d055 ("kbuild: stop using config_filename in scripts/Makefile.modsign") +Fixes: 129ab0d2d9f3 ("kbuild: do not quote string values in include/config/auto.conf") +Signed-off-by: Jan Luebbe +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/Makefile.modinst | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst +index a4c987c23750..10df89b9ef67 100644 +--- a/scripts/Makefile.modinst ++++ b/scripts/Makefile.modinst +@@ -66,9 +66,13 @@ endif + # Don't stop modules_install even if we can't sign external modules. + # + ifeq ($(CONFIG_MODULE_SIG_ALL),y) ++ifeq ($(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)),) + sig-key := $(if $(wildcard $(CONFIG_MODULE_SIG_KEY)),,$(srctree)/)$(CONFIG_MODULE_SIG_KEY) ++else ++sig-key := $(CONFIG_MODULE_SIG_KEY) ++endif + quiet_cmd_sign = SIGN $@ +- cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(sig-key) certs/signing_key.x509 $@ \ ++ cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) "$(sig-key)" certs/signing_key.x509 $@ \ + $(if $(KBUILD_EXTMOD),|| true) + else + quiet_cmd_sign := +-- +2.39.0 + diff --git a/queue-6.1/kunit-fix-kunit_test_init_section_suites.patch b/queue-6.1/kunit-fix-kunit_test_init_section_suites.patch new file mode 100644 index 00000000000..f9037b1f115 --- /dev/null +++ b/queue-6.1/kunit-fix-kunit_test_init_section_suites.patch @@ -0,0 +1,41 @@ +From 630cbbd98b333d40992cc21a1916e9437fd8a296 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 10:35:03 +0800 +Subject: kunit: fix kunit_test_init_section_suites(...) + +From: Brendan Higgins + +[ Upstream commit 254c71374a70051a043676b67ba4f7ad392b5fe6 ] + +Looks like kunit_test_init_section_suites(...) was messed up in a merge +conflict. This fixes it. + +kunit_test_init_section_suites(...) was not updated to avoid the extra +level of indirection when .kunit_test_suites was flattened. Given no-one +was actively using it, this went unnoticed for a long period of time. + +Fixes: e5857d396f35 ("kunit: flatten kunit_suite*** to kunit_suite** in .kunit_test_suites") +Signed-off-by: Brendan Higgins +Signed-off-by: David Gow +Tested-by: Martin Fernandez +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + include/kunit/test.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/include/kunit/test.h b/include/kunit/test.h +index b1ab6b32216d..ebcdbddf8344 100644 +--- a/include/kunit/test.h ++++ b/include/kunit/test.h +@@ -299,7 +299,6 @@ static inline int kunit_run_all_tests(void) + */ + #define kunit_test_init_section_suites(__suites...) \ + __kunit_test_suites(CONCATENATE(__UNIQUE_ID(array), _probe), \ +- CONCATENATE(__UNIQUE_ID(suites), _probe), \ + ##__suites) + + #define kunit_test_init_section_suite(suite) \ +-- +2.39.0 + diff --git a/queue-6.1/maple_tree-should-get-pivots-boundary-by-type.patch b/queue-6.1/maple_tree-should-get-pivots-boundary-by-type.patch new file mode 100644 index 00000000000..af8b123aaf8 --- /dev/null +++ b/queue-6.1/maple_tree-should-get-pivots-boundary-by-type.patch @@ -0,0 +1,45 @@ +From b83f75545c813dbc8eb591825a4536d24790408d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Nov 2022 23:43:08 +0000 +Subject: maple_tree: should get pivots boundary by type + +From: Wei Yang + +[ Upstream commit ab6ef70a8b0d314c2160af70b0de984664d675e0 ] + +We should get pivots boundary by type. Fixes a potential overindexing of +mt_pivots[]. + +Link: https://lkml.kernel.org/r/20221112234308.23823-1-richard.weiyang@gmail.com +Fixes: 54a611b60590 ("Maple Tree: add new data structure") +Signed-off-by: Wei Yang +Reviewed-by: Liam R. Howlett +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + lib/maple_tree.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/lib/maple_tree.c b/lib/maple_tree.c +index fe21bf276d91..5bfaae60ed8b 100644 +--- a/lib/maple_tree.c ++++ b/lib/maple_tree.c +@@ -665,12 +665,13 @@ static inline unsigned long mte_pivot(const struct maple_enode *mn, + unsigned char piv) + { + struct maple_node *node = mte_to_node(mn); ++ enum maple_type type = mte_node_type(mn); + +- if (piv >= mt_pivots[piv]) { ++ if (piv >= mt_pivots[type]) { + WARN_ON(1); + return 0; + } +- switch (mte_node_type(mn)) { ++ switch (type) { + case maple_arange_64: + return node->ma64.pivot[piv]; + case maple_range_64: +-- +2.39.0 + diff --git a/queue-6.1/media-v4l2-ctrls-api.c-move-ctrl-is_new-1-to-the-cor.patch b/queue-6.1/media-v4l2-ctrls-api.c-move-ctrl-is_new-1-to-the-cor.patch new file mode 100644 index 00000000000..ad77891c27e --- /dev/null +++ b/queue-6.1/media-v4l2-ctrls-api.c-move-ctrl-is_new-1-to-the-cor.patch @@ -0,0 +1,39 @@ +From 76aa7f1c321c8fb34caf270e6ce7e339b68c851a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Dec 2022 18:02:27 +0100 +Subject: media: v4l2-ctrls-api.c: move ctrl->is_new = 1 to the correct line + +From: Hans Verkuil + +[ Upstream commit a1550700629f30c5bd554161524f14f14600d554 ] + +The patch that fixed string control support somehow got mangled when it was +merged in mainline: the added line ended up in the wrong place. + +Fix this. + +Fixes: 73278d483378 ("media: v4l2-ctrls-api.c: add back dropped ctrl->is_new = 1") +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-ctrls-api.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/v4l2-core/v4l2-ctrls-api.c b/drivers/media/v4l2-core/v4l2-ctrls-api.c +index 3d3b6dc24ca6..002ea6588edf 100644 +--- a/drivers/media/v4l2-core/v4l2-ctrls-api.c ++++ b/drivers/media/v4l2-core/v4l2-ctrls-api.c +@@ -150,8 +150,8 @@ static int user_to_new(struct v4l2_ext_control *c, struct v4l2_ctrl *ctrl) + * then return an error. + */ + if (strlen(ctrl->p_new.p_char) == ctrl->maximum && last) +- ctrl->is_new = 1; + return -ERANGE; ++ ctrl->is_new = 1; + } + return ret; + default: +-- +2.39.0 + diff --git a/queue-6.1/memcpy_real-write-is-data-source-not-destination.patch b/queue-6.1/memcpy_real-write-is-data-source-not-destination.patch new file mode 100644 index 00000000000..cbaa7c2e2e4 --- /dev/null +++ b/queue-6.1/memcpy_real-write-is-data-source-not-destination.patch @@ -0,0 +1,32 @@ +From da917408f0816a4e3720dfdfd3f18e0cc859e20d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Oct 2022 13:29:08 -0400 +Subject: memcpy_real(): WRITE is "data source", not destination... + +From: Al Viro + +[ Upstream commit 77729412acde120712f5793e9134c2b1cbd1ee02 ] + +Signed-off-by: Al Viro +Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response") +Signed-off-by: Sasha Levin +--- + arch/s390/mm/maccess.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c +index 1571cdcb0c50..753b006c8ea5 100644 +--- a/arch/s390/mm/maccess.c ++++ b/arch/s390/mm/maccess.c +@@ -128,7 +128,7 @@ int memcpy_real(void *dest, unsigned long src, size_t count) + + kvec.iov_base = dest; + kvec.iov_len = count; +- iov_iter_kvec(&iter, WRITE, &kvec, 1, count); ++ iov_iter_kvec(&iter, READ, &kvec, 1, count); + if (memcpy_real_iter(&iter, src, count) < count) + return -EFAULT; + return 0; +-- +2.39.0 + diff --git a/queue-6.1/net-openvswitch-fix-flow-memory-leak-in-ovs_flow_cmd.patch b/queue-6.1/net-openvswitch-fix-flow-memory-leak-in-ovs_flow_cmd.patch new file mode 100644 index 00000000000..8874875c222 --- /dev/null +++ b/queue-6.1/net-openvswitch-fix-flow-memory-leak-in-ovs_flow_cmd.patch @@ -0,0 +1,110 @@ +From afcb5a4cc0ea868edfcf9fc86617d04b14b57556 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 00:02:18 +0300 +Subject: net: openvswitch: fix flow memory leak in ovs_flow_cmd_new + +From: Fedor Pchelkin + +[ Upstream commit 0c598aed445eb45b0ee7ba405f7ece99ee349c30 ] + +Syzkaller reports a memory leak of new_flow in ovs_flow_cmd_new() as it is +not freed when an allocation of a key fails. + +BUG: memory leak +unreferenced object 0xffff888116668000 (size 632): + comm "syz-executor231", pid 1090, jiffies 4294844701 (age 18.871s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000defa3494>] kmem_cache_zalloc include/linux/slab.h:654 [inline] + [<00000000defa3494>] ovs_flow_alloc+0x19/0x180 net/openvswitch/flow_table.c:77 + [<00000000c67d8873>] ovs_flow_cmd_new+0x1de/0xd40 net/openvswitch/datapath.c:957 + [<0000000010a539a8>] genl_family_rcv_msg_doit+0x22d/0x330 net/netlink/genetlink.c:739 + [<00000000dff3302d>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] + [<00000000dff3302d>] genl_rcv_msg+0x328/0x590 net/netlink/genetlink.c:800 + [<000000000286dd87>] netlink_rcv_skb+0x153/0x430 net/netlink/af_netlink.c:2515 + [<0000000061fed410>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811 + [<000000009dc0f111>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] + [<000000009dc0f111>] netlink_unicast+0x545/0x7f0 net/netlink/af_netlink.c:1339 + [<000000004a5ee816>] netlink_sendmsg+0x8e7/0xde0 net/netlink/af_netlink.c:1934 + [<00000000482b476f>] sock_sendmsg_nosec net/socket.c:651 [inline] + [<00000000482b476f>] sock_sendmsg+0x152/0x190 net/socket.c:671 + [<00000000698574ba>] ____sys_sendmsg+0x70a/0x870 net/socket.c:2356 + [<00000000d28d9e11>] ___sys_sendmsg+0xf3/0x170 net/socket.c:2410 + [<0000000083ba9120>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439 + [<00000000c00628f8>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46 + [<000000004abfdcf4>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 + +To fix this the patch rearranges the goto labels to reflect the order of +object allocations and adds appropriate goto statements on the error +paths. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: 68bb10101e6b ("openvswitch: Fix flow lookup to use unmasked key") +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Acked-by: Eelco Chaudron +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230201210218.361970-1-pchelkin@ispras.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/openvswitch/datapath.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c +index fa0f1952d763..5920fdca1287 100644 +--- a/net/openvswitch/datapath.c ++++ b/net/openvswitch/datapath.c +@@ -979,14 +979,14 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info) + key = kzalloc(sizeof(*key), GFP_KERNEL); + if (!key) { + error = -ENOMEM; +- goto err_kfree_key; ++ goto err_kfree_flow; + } + + ovs_match_init(&match, key, false, &mask); + error = ovs_nla_get_match(net, &match, a[OVS_FLOW_ATTR_KEY], + a[OVS_FLOW_ATTR_MASK], log); + if (error) +- goto err_kfree_flow; ++ goto err_kfree_key; + + ovs_flow_mask_key(&new_flow->key, key, true, &mask); + +@@ -994,14 +994,14 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info) + error = ovs_nla_get_identifier(&new_flow->id, a[OVS_FLOW_ATTR_UFID], + key, log); + if (error) +- goto err_kfree_flow; ++ goto err_kfree_key; + + /* Validate actions. */ + error = ovs_nla_copy_actions(net, a[OVS_FLOW_ATTR_ACTIONS], + &new_flow->key, &acts, log); + if (error) { + OVS_NLERR(log, "Flow actions may not be safe on all matching packets."); +- goto err_kfree_flow; ++ goto err_kfree_key; + } + + reply = ovs_flow_cmd_alloc_info(acts, &new_flow->id, info, false, +@@ -1101,10 +1101,10 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info) + kfree_skb(reply); + err_kfree_acts: + ovs_nla_free_flow_actions(acts); +-err_kfree_flow: +- ovs_flow_free(new_flow, false); + err_kfree_key: + kfree(key); ++err_kfree_flow: ++ ovs_flow_free(new_flow, false); + error: + return error; + } +-- +2.39.0 + diff --git a/queue-6.1/net-phy-dp83822-fix-null-pointer-access-on-dp83825-d.patch b/queue-6.1/net-phy-dp83822-fix-null-pointer-access-on-dp83825-d.patch new file mode 100644 index 00000000000..d41817b584c --- /dev/null +++ b/queue-6.1/net-phy-dp83822-fix-null-pointer-access-on-dp83825-d.patch @@ -0,0 +1,53 @@ +From 8798d6fbdab6e4cd78a58bb002e0b1ed6b0138ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 19:23:26 +0100 +Subject: net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices + +From: Andre Kalb + +[ Upstream commit 422ae7d9c7221e8d4c8526d0f54106307d69d2dc ] + +The probe() function is only used for the DP83822 PHY, leaving the +private data pointer uninitialized for the smaller DP83825/26 models. +While all uses of the private data structure are hidden in 82822 specific +callbacks, configuring the interrupt is shared across all models. +This causes a NULL pointer dereference on the smaller PHYs as it accesses +the private data unchecked. Verifying the pointer avoids that. + +Fixes: 5dc39fd5ef35 ("net: phy: DP83822: Add ability to advertise Fiber connection") +Signed-off-by: Andre Kalb +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/Y9FzniUhUtbaGKU7@pc6682 +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/dp83822.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c +index b60db8b6f477..267e6fd3d444 100644 +--- a/drivers/net/phy/dp83822.c ++++ b/drivers/net/phy/dp83822.c +@@ -233,7 +233,8 @@ static int dp83822_config_intr(struct phy_device *phydev) + DP83822_ENERGY_DET_INT_EN | + DP83822_LINK_QUAL_INT_EN); + +- if (!dp83822->fx_enabled) ++ /* Private data pointer is NULL on DP83825/26 */ ++ if (!dp83822 || !dp83822->fx_enabled) + misr_status |= DP83822_ANEG_COMPLETE_INT_EN | + DP83822_DUP_MODE_CHANGE_INT_EN | + DP83822_SPEED_CHANGED_INT_EN; +@@ -253,7 +254,8 @@ static int dp83822_config_intr(struct phy_device *phydev) + DP83822_PAGE_RX_INT_EN | + DP83822_EEE_ERROR_CHANGE_INT_EN); + +- if (!dp83822->fx_enabled) ++ /* Private data pointer is NULL on DP83825/26 */ ++ if (!dp83822 || !dp83822->fx_enabled) + misr_status |= DP83822_ANEG_ERR_INT_EN | + DP83822_WOL_PKT_INT_EN; + +-- +2.39.0 + diff --git a/queue-6.1/net-phy-meson-gxl-add-generic-dummy-stubs-for-mmd-re.patch b/queue-6.1/net-phy-meson-gxl-add-generic-dummy-stubs-for-mmd-re.patch new file mode 100644 index 00000000000..2bc5d6ce673 --- /dev/null +++ b/queue-6.1/net-phy-meson-gxl-add-generic-dummy-stubs-for-mmd-re.patch @@ -0,0 +1,42 @@ +From c9c2011cb3774d0330167191102c6e6b493df216 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 15:14:02 -0800 +Subject: net: phy: meson-gxl: Add generic dummy stubs for MMD register access + +From: Chris Healy + +[ Upstream commit afc2336f89dc0fc0ef25b92366814524b0fd90fb ] + +The Meson G12A Internal PHY does not support standard IEEE MMD extended +register access, therefore add generic dummy stubs to fail the read and +write MMD calls. This is necessary to prevent the core PHY code from +erroneously believing that EEE is supported by this PHY even though this +PHY does not support EEE, as MMD register access returns all FFFFs. + +Fixes: 5c3407abb338 ("net: phy: meson-gxl: add g12a support") +Reviewed-by: Heiner Kallweit +Signed-off-by: Chris Healy +Reviewed-by: Jerome Brunet +Link: https://lore.kernel.org/r/20230130231402.471493-1-cphealy@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/meson-gxl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c +index c49062ad72c6..5e41658b1e2f 100644 +--- a/drivers/net/phy/meson-gxl.c ++++ b/drivers/net/phy/meson-gxl.c +@@ -271,6 +271,8 @@ static struct phy_driver meson_gxl_phy[] = { + .handle_interrupt = meson_gxl_handle_interrupt, + .suspend = genphy_suspend, + .resume = genphy_resume, ++ .read_mmd = genphy_read_mmd_unsupported, ++ .write_mmd = genphy_write_mmd_unsupported, + }, + }; + +-- +2.39.0 + diff --git a/queue-6.1/net-tls-tls_is_tx_ready-checked-list_entry.patch b/queue-6.1/net-tls-tls_is_tx_ready-checked-list_entry.patch new file mode 100644 index 00000000000..72fa5517c96 --- /dev/null +++ b/queue-6.1/net-tls-tls_is_tx_ready-checked-list_entry.patch @@ -0,0 +1,40 @@ +From d390cdf61b502621ab5294863f35fbbf91fea46a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Jan 2023 16:29:17 +0000 +Subject: net/tls: tls_is_tx_ready() checked list_entry + +From: Pietro Borrello + +[ Upstream commit ffe2a22562444720b05bdfeb999c03e810d84cbb ] + +tls_is_tx_ready() checks that list_first_entry() does not return NULL. +This condition can never happen. For empty lists, list_first_entry() +returns the list_entry() of the head, which is a type confusion. +Use list_first_entry_or_null() which returns NULL in case of empty +lists. + +Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230128-list-entry-null-check-tls-v1-1-525bbfe6f0d0@diag.uniroma1.it +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_sw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 9ed978634125..a83d2b4275fa 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -2427,7 +2427,7 @@ static bool tls_is_tx_ready(struct tls_sw_context_tx *ctx) + { + struct tls_rec *rec; + +- rec = list_first_entry(&ctx->tx_list, struct tls_rec, list); ++ rec = list_first_entry_or_null(&ctx->tx_list, struct tls_rec, list); + if (!rec) + return false; + +-- +2.39.0 + diff --git a/queue-6.1/net-wwan-t7xx-fix-runtime-pm-initialization.patch b/queue-6.1/net-wwan-t7xx-fix-runtime-pm-initialization.patch new file mode 100644 index 00000000000..f661cbb816d --- /dev/null +++ b/queue-6.1/net-wwan-t7xx-fix-runtime-pm-initialization.patch @@ -0,0 +1,44 @@ +From 7b5c69ae142be3ea0a20c8a5dbe3c6f7c93469ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 13:25:35 +0000 +Subject: net: wwan: t7xx: Fix Runtime PM initialization +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kornel Dulęba + +[ Upstream commit e3d6d152a1cbdee25f2e3962009a2751b54e2297 ] + +For PCI devices the Runtime PM refcount is incremented twice: +1. During device enumeration with a call to pm_runtime_forbid. +2. Just before a driver probe logic is called. +Because of that in order to enable Runtime PM on a given device +we have to call both pm_runtime_allow and pm_runtime_put_noidle, +once it's ready to be runtime suspended. +The former was missing causing the pm refcount to never reach 0. + +Fixes: d10b3a695ba0 ("net: wwan: t7xx: Runtime PM") +Signed-off-by: Kornel Dulęba +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wwan/t7xx/t7xx_pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wwan/t7xx/t7xx_pci.c b/drivers/net/wwan/t7xx/t7xx_pci.c +index 871f2a27a398..226fc1703e90 100644 +--- a/drivers/net/wwan/t7xx/t7xx_pci.c ++++ b/drivers/net/wwan/t7xx/t7xx_pci.c +@@ -121,6 +121,8 @@ void t7xx_pci_pm_init_late(struct t7xx_pci_dev *t7xx_dev) + iowrite32(T7XX_L1_BIT(0), IREG_BASE(t7xx_dev) + ENABLE_ASPM_LOWPWR); + atomic_set(&t7xx_dev->md_pm_state, MTK_PM_RESUMED); + ++ pm_runtime_mark_last_busy(&t7xx_dev->pdev->dev); ++ pm_runtime_allow(&t7xx_dev->pdev->dev); + pm_runtime_put_noidle(&t7xx_dev->pdev->dev); + } + +-- +2.39.0 + diff --git a/queue-6.1/net-x25-fix-to-not-accept-on-connected-socket.patch b/queue-6.1/net-x25-fix-to-not-accept-on-connected-socket.patch new file mode 100644 index 00000000000..5a55ae0de1f --- /dev/null +++ b/queue-6.1/net-x25-fix-to-not-accept-on-connected-socket.patch @@ -0,0 +1,47 @@ +From c6213128a4c27d43d5201b77f7381a89dfb651e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Jan 2023 11:43:23 -0800 +Subject: net/x25: Fix to not accept on connected socket + +From: Hyunwoo Kim + +[ Upstream commit f2b0b5210f67c56a3bcdf92ff665fb285d6e0067 ] + +When listen() and accept() are called on an x25 socket +that connect() succeeds, accept() succeeds immediately. +This is because x25_connect() queues the skb to +sk->sk_receive_queue, and x25_accept() dequeues it. + +This creates a child socket with the sk of the parent +x25 socket, which can cause confusion. + +Fix x25_listen() to return -EINVAL if the socket has +already been successfully connect()ed to avoid this issue. + +Signed-off-by: Hyunwoo Kim +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/x25/af_x25.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index 3b55502b2965..5c7ad301d742 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -482,6 +482,12 @@ static int x25_listen(struct socket *sock, int backlog) + int rc = -EOPNOTSUPP; + + lock_sock(sk); ++ if (sock->state != SS_UNCONNECTED) { ++ rc = -EINVAL; ++ release_sock(sk); ++ return rc; ++ } ++ + if (sk->sk_state != TCP_LISTEN) { + memset(&x25_sk(sk)->dest_addr, 0, X25_ADDR_LEN); + sk->sk_max_ack_backlog = backlog; +-- +2.39.0 + diff --git a/queue-6.1/netfilter-br_netfilter-disable-sabotage_in-hook-afte.patch b/queue-6.1/netfilter-br_netfilter-disable-sabotage_in-hook-afte.patch new file mode 100644 index 00000000000..cca25cec4f4 --- /dev/null +++ b/queue-6.1/netfilter-br_netfilter-disable-sabotage_in-hook-afte.patch @@ -0,0 +1,66 @@ +From 4f1a85b827f5976a8cf402ae8e5bf19fded707d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 11:39:29 +0100 +Subject: netfilter: br_netfilter: disable sabotage_in hook after first + suppression + +From: Florian Westphal + +[ Upstream commit 2b272bb558f1d3a5aa95ed8a82253786fd1a48ba ] + +When using a xfrm interface in a bridged setup (the outgoing device is +bridged), the incoming packets in the xfrm interface are only tracked +in the outgoing direction. + +$ brctl show +bridge name interfaces +br_eth1 eth1 + +$ conntrack -L +tcp 115 SYN_SENT src=192... dst=192... [UNREPLIED] ... + +If br_netfilter is enabled, the first (encrypted) packet is received onR +eth1, conntrack hooks are called from br_netfilter emulation which +allocates nf_bridge info for this skb. + +If the packet is for local machine, skb gets passed up the ip stack. +The skb passes through ip prerouting a second time. br_netfilter +ip_sabotage_in supresses the re-invocation of the hooks. + +After this, skb gets decrypted in xfrm layer and appears in +network stack a second time (after decryption). + +Then, ip_sabotage_in is called again and suppresses netfilter +hook invocation, even though the bridge layer never called them +for the plaintext incarnation of the packet. + +Free the bridge info after the first suppression to avoid this. + +I was unable to figure out where the regression comes from, as far as i +can see br_netfilter always had this problem; i did not expect that skb +is looped again with different headers. + +Fixes: c4b0e771f906 ("netfilter: avoid using skb->nf_bridge directly") +Reported-and-tested-by: Wolfgang Nothdurft +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/bridge/br_netfilter_hooks.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c +index f20f4373ff40..9554abcfd5b4 100644 +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -871,6 +871,7 @@ static unsigned int ip_sabotage_in(void *priv, + if (nf_bridge && !nf_bridge->in_prerouting && + !netif_is_l3_master(skb->dev) && + !netif_is_l3_slave(skb->dev)) { ++ nf_bridge_info_free(skb); + state->okfn(state->net, state->sk, skb); + return NF_STOLEN; + } +-- +2.39.0 + diff --git a/queue-6.1/netrom-fix-use-after-free-caused-by-accept-on-alread.patch b/queue-6.1/netrom-fix-use-after-free-caused-by-accept-on-alread.patch new file mode 100644 index 00000000000..f0d89a49a63 --- /dev/null +++ b/queue-6.1/netrom-fix-use-after-free-caused-by-accept-on-alread.patch @@ -0,0 +1,211 @@ +From 7539e8f773b4f43599dff15ddf63874a5a641348 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 18:32:50 -0800 +Subject: netrom: Fix use-after-free caused by accept on already connected + socket + +From: Hyunwoo Kim + +[ Upstream commit 611792920925fb088ddccbe2783c7f92fdfb6b64 ] + +If you call listen() and accept() on an already connect()ed +AF_NETROM socket, accept() can successfully connect. +This is because when the peer socket sends data to sendmsg, +the skb with its own sk stored in the connected socket's +sk->sk_receive_queue is connected, and nr_accept() dequeues +the skb waiting in the sk->sk_receive_queue. + +As a result, nr_accept() allocates and returns a sock with +the sk of the parent AF_NETROM socket. + +And here use-after-free can happen through complex race conditions: +``` + cpu0 cpu1 + 1. socket_2 = socket(AF_NETROM) + . + . + listen(socket_2) + accepted_socket = accept(socket_2) + 2. socket_1 = socket(AF_NETROM) + nr_create() // sk refcount : 1 + connect(socket_1) + 3. write(accepted_socket) + nr_sendmsg() + nr_output() + nr_kick() + nr_send_iframe() + nr_transmit_buffer() + nr_route_frame() + nr_loopback_queue() + nr_loopback_timer() + nr_rx_frame() + nr_process_rx_frame(sk, skb); // sk : socket_1's sk + nr_state3_machine() + nr_queue_rx_frame() + sock_queue_rcv_skb() + sock_queue_rcv_skb_reason() + __sock_queue_rcv_skb() + __skb_queue_tail(list, skb); // list : socket_1's sk->sk_receive_queue + 4. listen(socket_1) + nr_listen() + uaf_socket = accept(socket_1) + nr_accept() + skb_dequeue(&sk->sk_receive_queue); + 5. close(accepted_socket) + nr_release() + nr_write_internal(sk, NR_DISCREQ) + nr_transmit_buffer() // NR_DISCREQ + nr_route_frame() + nr_loopback_queue() + nr_loopback_timer() + nr_rx_frame() // sk : socket_1's sk + nr_process_rx_frame() // NR_STATE_3 + nr_state3_machine() // NR_DISCREQ + nr_disconnect() + nr_sk(sk)->state = NR_STATE_0; + 6. close(socket_1) // sk refcount : 3 + nr_release() // NR_STATE_0 + sock_put(sk); // sk refcount : 0 + sk_free(sk); + close(uaf_socket) + nr_release() + sock_hold(sk); // UAF +``` + +KASAN report by syzbot: +``` +BUG: KASAN: use-after-free in nr_release+0x66/0x460 net/netrom/af_netrom.c:520 +Write of size 4 at addr ffff8880235d8080 by task syz-executor564/5128 + +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 + print_address_description mm/kasan/report.c:306 [inline] + print_report+0x15e/0x461 mm/kasan/report.c:417 + kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 + check_region_inline mm/kasan/generic.c:183 [inline] + kasan_check_range+0x141/0x190 mm/kasan/generic.c:189 + instrument_atomic_read_write include/linux/instrumented.h:102 [inline] + atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:116 [inline] + __refcount_add include/linux/refcount.h:193 [inline] + __refcount_inc include/linux/refcount.h:250 [inline] + refcount_inc include/linux/refcount.h:267 [inline] + sock_hold include/net/sock.h:775 [inline] + nr_release+0x66/0x460 net/netrom/af_netrom.c:520 + __sock_release+0xcd/0x280 net/socket.c:650 + sock_close+0x1c/0x20 net/socket.c:1365 + __fput+0x27c/0xa90 fs/file_table.c:320 + task_work_run+0x16f/0x270 kernel/task_work.c:179 + exit_task_work include/linux/task_work.h:38 [inline] + do_exit+0xaa8/0x2950 kernel/exit.c:867 + do_group_exit+0xd4/0x2a0 kernel/exit.c:1012 + get_signal+0x21c3/0x2450 kernel/signal.c:2859 + arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 + exit_to_user_mode_loop kernel/entry/common.c:168 [inline] + exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 + __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] + syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 + do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f6c19e3c9b9 +Code: Unable to access opcode bytes at 0x7f6c19e3c98f. +RSP: 002b:00007fffd4ba2ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 +RAX: 0000000000000116 RBX: 0000000000000003 RCX: 00007f6c19e3c9b9 +RDX: 0000000000000318 RSI: 00000000200bd000 RDI: 0000000000000006 +RBP: 0000000000000003 R08: 000000000000000d R09: 000000000000000d +R10: 0000000000000000 R11: 0000000000000246 R12: 000055555566a2c0 +R13: 0000000000000011 R14: 0000000000000000 R15: 0000000000000000 + + +Allocated by task 5128: + kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + ____kasan_kmalloc mm/kasan/common.c:371 [inline] + ____kasan_kmalloc mm/kasan/common.c:330 [inline] + __kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:380 + kasan_kmalloc include/linux/kasan.h:211 [inline] + __do_kmalloc_node mm/slab_common.c:968 [inline] + __kmalloc+0x5a/0xd0 mm/slab_common.c:981 + kmalloc include/linux/slab.h:584 [inline] + sk_prot_alloc+0x140/0x290 net/core/sock.c:2038 + sk_alloc+0x3a/0x7a0 net/core/sock.c:2091 + nr_create+0xb6/0x5f0 net/netrom/af_netrom.c:433 + __sock_create+0x359/0x790 net/socket.c:1515 + sock_create net/socket.c:1566 [inline] + __sys_socket_create net/socket.c:1603 [inline] + __sys_socket_create net/socket.c:1588 [inline] + __sys_socket+0x133/0x250 net/socket.c:1636 + __do_sys_socket net/socket.c:1649 [inline] + __se_sys_socket net/socket.c:1647 [inline] + __x64_sys_socket+0x73/0xb0 net/socket.c:1647 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Freed by task 5128: + kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 + kasan_set_track+0x25/0x30 mm/kasan/common.c:52 + kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:518 + ____kasan_slab_free mm/kasan/common.c:236 [inline] + ____kasan_slab_free+0x13b/0x1a0 mm/kasan/common.c:200 + kasan_slab_free include/linux/kasan.h:177 [inline] + __cache_free mm/slab.c:3394 [inline] + __do_kmem_cache_free mm/slab.c:3580 [inline] + __kmem_cache_free+0xcd/0x3b0 mm/slab.c:3587 + sk_prot_free net/core/sock.c:2074 [inline] + __sk_destruct+0x5df/0x750 net/core/sock.c:2166 + sk_destruct net/core/sock.c:2181 [inline] + __sk_free+0x175/0x460 net/core/sock.c:2192 + sk_free+0x7c/0xa0 net/core/sock.c:2203 + sock_put include/net/sock.h:1991 [inline] + nr_release+0x39e/0x460 net/netrom/af_netrom.c:554 + __sock_release+0xcd/0x280 net/socket.c:650 + sock_close+0x1c/0x20 net/socket.c:1365 + __fput+0x27c/0xa90 fs/file_table.c:320 + task_work_run+0x16f/0x270 kernel/task_work.c:179 + exit_task_work include/linux/task_work.h:38 [inline] + do_exit+0xaa8/0x2950 kernel/exit.c:867 + do_group_exit+0xd4/0x2a0 kernel/exit.c:1012 + get_signal+0x21c3/0x2450 kernel/signal.c:2859 + arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 + exit_to_user_mode_loop kernel/entry/common.c:168 [inline] + exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 + __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] + syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 + do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +``` + +To fix this issue, nr_listen() returns -EINVAL for sockets that +successfully nr_connect(). + +Reported-by: syzbot+caa188bdfc1eeafeb418@syzkaller.appspotmail.com +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Hyunwoo Kim +Reviewed-by: Kuniyuki Iwashima +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/netrom/af_netrom.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index 6f7f4392cffb..5a4cb796150f 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -400,6 +400,11 @@ static int nr_listen(struct socket *sock, int backlog) + struct sock *sk = sock->sk; + + lock_sock(sk); ++ if (sock->state != SS_UNCONNECTED) { ++ release_sock(sk); ++ return -EINVAL; ++ } ++ + if (sk->sk_state != TCP_LISTEN) { + memset(&nr_sk(sk)->user_addr, 0, AX25_ADDR_LEN); + sk->sk_max_ack_backlog = backlog; +-- +2.39.0 + diff --git a/queue-6.1/octeontx2-af-fix-devlink-unregister.patch b/queue-6.1/octeontx2-af-fix-devlink-unregister.patch new file mode 100644 index 00000000000..c5dcee650d5 --- /dev/null +++ b/queue-6.1/octeontx2-af-fix-devlink-unregister.patch @@ -0,0 +1,103 @@ +From 277e68660b5ddbe04f9820bd4ceed22a2a05b083 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 11:46:59 +0530 +Subject: octeontx2-af: Fix devlink unregister + +From: Ratheesh Kannoth + +[ Upstream commit 917d5e04d4dd2bbbf36fc6976ba442e284ccc42d ] + +Exact match feature is only available in CN10K-B. +Unregister exact match devlink entry only for +this silicon variant. + +Fixes: 87e4ea29b030 ("octeontx2-af: Debugsfs support for exact match.") +Signed-off-by: Ratheesh Kannoth +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230131061659.1025137-1-rkannoth@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../marvell/octeontx2/af/rvu_devlink.c | 35 ++++++++++++++----- + 1 file changed, 27 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +index 88dee589cb21..dc7bd2ce78f7 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +@@ -1500,6 +1500,9 @@ static const struct devlink_param rvu_af_dl_params[] = { + BIT(DEVLINK_PARAM_CMODE_RUNTIME), + rvu_af_dl_dwrr_mtu_get, rvu_af_dl_dwrr_mtu_set, + rvu_af_dl_dwrr_mtu_validate), ++}; ++ ++static const struct devlink_param rvu_af_dl_param_exact_match[] = { + DEVLINK_PARAM_DRIVER(RVU_AF_DEVLINK_PARAM_ID_NPC_EXACT_FEATURE_DISABLE, + "npc_exact_feature_disable", DEVLINK_PARAM_TYPE_STRING, + BIT(DEVLINK_PARAM_CMODE_RUNTIME), +@@ -1563,7 +1566,6 @@ int rvu_register_dl(struct rvu *rvu) + { + struct rvu_devlink *rvu_dl; + struct devlink *dl; +- size_t size; + int err; + + dl = devlink_alloc(&rvu_devlink_ops, sizeof(struct rvu_devlink), +@@ -1585,21 +1587,32 @@ int rvu_register_dl(struct rvu *rvu) + goto err_dl_health; + } + ++ err = devlink_params_register(dl, rvu_af_dl_params, ARRAY_SIZE(rvu_af_dl_params)); ++ if (err) { ++ dev_err(rvu->dev, ++ "devlink params register failed with error %d", err); ++ goto err_dl_health; ++ } ++ + /* Register exact match devlink only for CN10K-B */ +- size = ARRAY_SIZE(rvu_af_dl_params); + if (!rvu_npc_exact_has_match_table(rvu)) +- size -= 1; ++ goto done; + +- err = devlink_params_register(dl, rvu_af_dl_params, size); ++ err = devlink_params_register(dl, rvu_af_dl_param_exact_match, ++ ARRAY_SIZE(rvu_af_dl_param_exact_match)); + if (err) { + dev_err(rvu->dev, +- "devlink params register failed with error %d", err); +- goto err_dl_health; ++ "devlink exact match params register failed with error %d", err); ++ goto err_dl_exact_match; + } + ++done: + devlink_register(dl); + return 0; + ++err_dl_exact_match: ++ devlink_params_unregister(dl, rvu_af_dl_params, ARRAY_SIZE(rvu_af_dl_params)); ++ + err_dl_health: + rvu_health_reporters_destroy(rvu); + devlink_free(dl); +@@ -1612,8 +1625,14 @@ void rvu_unregister_dl(struct rvu *rvu) + struct devlink *dl = rvu_dl->dl; + + devlink_unregister(dl); +- devlink_params_unregister(dl, rvu_af_dl_params, +- ARRAY_SIZE(rvu_af_dl_params)); ++ ++ devlink_params_unregister(dl, rvu_af_dl_params, ARRAY_SIZE(rvu_af_dl_params)); ++ ++ /* Unregister exact match devlink only for CN10K-B */ ++ if (rvu_npc_exact_has_match_table(rvu)) ++ devlink_params_unregister(dl, rvu_af_dl_param_exact_match, ++ ARRAY_SIZE(rvu_af_dl_param_exact_match)); ++ + rvu_health_reporters_destroy(rvu); + devlink_free(dl); + } +-- +2.39.0 + diff --git a/queue-6.1/perf-x86-intel-add-emerald-rapids.patch b/queue-6.1/perf-x86-intel-add-emerald-rapids.patch new file mode 100644 index 00000000000..7e14fd1653d --- /dev/null +++ b/queue-6.1/perf-x86-intel-add-emerald-rapids.patch @@ -0,0 +1,36 @@ +From 69205c5c840990d5f414fa0ff917101ca9b56249 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 08:04:46 -0800 +Subject: perf/x86/intel: Add Emerald Rapids + +From: Kan Liang + +[ Upstream commit 6795e558e9cc6123c24e2100a2ebe88e58a792bc ] + +From core PMU's perspective, Emerald Rapids is the same as the Sapphire +Rapids. The only difference is the event list, which will be +supported in the perf tool later. + +Signed-off-by: Kan Liang +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230106160449.3566477-1-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 1b92bf05fd65..5a1d0ea402e4 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -6342,6 +6342,7 @@ __init int intel_pmu_init(void) + break; + + case INTEL_FAM6_SAPPHIRERAPIDS_X: ++ case INTEL_FAM6_EMERALDRAPIDS_X: + pmem = true; + x86_pmu.late_ack = true; + memcpy(hw_cache_event_ids, spr_hw_cache_event_ids, sizeof(hw_cache_event_ids)); +-- +2.39.0 + diff --git a/queue-6.1/perf-x86-intel-cstate-add-emerald-rapids.patch b/queue-6.1/perf-x86-intel-cstate-add-emerald-rapids.patch new file mode 100644 index 00000000000..aa8ab87cdc2 --- /dev/null +++ b/queue-6.1/perf-x86-intel-cstate-add-emerald-rapids.patch @@ -0,0 +1,36 @@ +From b9aace868eebbf1456ce2d4959a9d5034772948e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 08:04:47 -0800 +Subject: perf/x86/intel/cstate: Add Emerald Rapids + +From: Kan Liang + +[ Upstream commit 5a8a05f165fb18d37526062419774d9088c2a9b9 ] + +From the perspective of Intel cstate residency counters, +Emerald Rapids is the same as the Sapphire Rapids and Ice Lake. +Add Emerald Rapids model. + +Signed-off-by: Kan Liang +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230106160449.3566477-2-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/cstate.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c +index 3019fb1926e3..551741e79e03 100644 +--- a/arch/x86/events/intel/cstate.c ++++ b/arch/x86/events/intel/cstate.c +@@ -677,6 +677,7 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = { + X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_X, &icx_cstates), + X86_MATCH_INTEL_FAM6_MODEL(ICELAKE_D, &icx_cstates), + X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X, &icx_cstates), ++ X86_MATCH_INTEL_FAM6_MODEL(EMERALDRAPIDS_X, &icx_cstates), + + X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE_L, &icl_cstates), + X86_MATCH_INTEL_FAM6_MODEL(TIGERLAKE, &icl_cstates), +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-amd-pmc-disable-irq1-wakeup-for-rn-czn.patch b/queue-6.1/platform-x86-amd-pmc-disable-irq1-wakeup-for-rn-czn.patch new file mode 100644 index 00000000000..328f793003e --- /dev/null +++ b/queue-6.1/platform-x86-amd-pmc-disable-irq1-wakeup-for-rn-czn.patch @@ -0,0 +1,145 @@ +From 48dd53839297f3997f73aaf9d1a4148405ee5aab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 13:15:18 -0600 +Subject: platform/x86/amd: pmc: Disable IRQ1 wakeup for RN/CZN + +From: Mario Limonciello + +[ Upstream commit 8e60615e8932167057b363c11a7835da7f007106 ] + +By default when the system is configured for low power idle in the FADT +the keyboard is set up as a wake source. This matches the behavior that +Windows uses for Modern Standby as well. + +It has been reported that a variety of AMD based designs there are +spurious wakeups are happening where two IRQ sources are active. + +For example: +``` +PM: Triggering wakeup from IRQ 9 +PM: Triggering wakeup from IRQ 1 +``` + +In these designs IRQ 9 is the ACPI SCI and IRQ 1 is the keyboard. +One way to trigger this problem is to suspend the laptop and then unplug +the AC adapter. The SOC will be in a hardware sleep state and plugging +in the AC adapter returns control to the kernel's s2idle loop. + +Normally if just IRQ 9 was active the s2idle loop would advance any EC +transactions and no other IRQ being active would cause the s2idle loop +to put the SOC back into hardware sleep state. + +When this bug occurred IRQ 1 is also active even if no keyboard activity +occurred. This causes the s2idle loop to break and the system to wake. + +This is a platform firmware bug triggering IRQ1 without keyboard activity. +This occurs in Windows as well, but Windows will enter "SW DRIPS" and +then with no activity enters back into "HW DRIPS" (hardware sleep state). + +This issue affects Renoir, Lucienne, Cezanne, and Barcelo platforms. It +does not happen on newer systems such as Mendocino or Rembrandt. + +It's been fixed in newer platform firmware. To avoid triggering the bug +on older systems check the SMU F/W version and adjust the policy at suspend +time for s2idle wakeup from keyboard on these systems. A lot of thought +and experimentation has been given around the timing of disabling IRQ1, +and to make it work the "suspend" PM callback is restored. + +Reported-by: Kai-Heng Feng +Reported-by: Xaver Hugl +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2115 +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/1951 +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20230120191519.15926-1-mario.limonciello@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc.c | 50 ++++++++++++++++++++++++++++++++++ + 1 file changed, 50 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c +index 8d924986381b..be1b49824edb 100644 +--- a/drivers/platform/x86/amd/pmc.c ++++ b/drivers/platform/x86/amd/pmc.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -653,6 +654,33 @@ static int amd_pmc_get_os_hint(struct amd_pmc_dev *dev) + return -EINVAL; + } + ++static int amd_pmc_czn_wa_irq1(struct amd_pmc_dev *pdev) ++{ ++ struct device *d; ++ int rc; ++ ++ if (!pdev->major) { ++ rc = amd_pmc_get_smu_version(pdev); ++ if (rc) ++ return rc; ++ } ++ ++ if (pdev->major > 64 || (pdev->major == 64 && pdev->minor > 65)) ++ return 0; ++ ++ d = bus_find_device_by_name(&serio_bus, NULL, "serio0"); ++ if (!d) ++ return 0; ++ if (device_may_wakeup(d)) { ++ dev_info_once(d, "Disabling IRQ1 wakeup source to avoid platform firmware bug\n"); ++ disable_irq_wake(1); ++ device_set_wakeup_enable(d, false); ++ } ++ put_device(d); ++ ++ return 0; ++} ++ + static int amd_pmc_verify_czn_rtc(struct amd_pmc_dev *pdev, u32 *arg) + { + struct rtc_device *rtc_device; +@@ -782,6 +810,25 @@ static struct acpi_s2idle_dev_ops amd_pmc_s2idle_dev_ops = { + .check = amd_pmc_s2idle_check, + .restore = amd_pmc_s2idle_restore, + }; ++ ++static int __maybe_unused amd_pmc_suspend_handler(struct device *dev) ++{ ++ struct amd_pmc_dev *pdev = dev_get_drvdata(dev); ++ ++ if (pdev->cpu_id == AMD_CPU_ID_CZN) { ++ int rc = amd_pmc_czn_wa_irq1(pdev); ++ ++ if (rc) { ++ dev_err(pdev->dev, "failed to adjust keyboard wakeup: %d\n", rc); ++ return rc; ++ } ++ } ++ ++ return 0; ++} ++ ++static SIMPLE_DEV_PM_OPS(amd_pmc_pm, amd_pmc_suspend_handler, NULL); ++ + #endif + + static const struct pci_device_id pmc_pci_ids[] = { +@@ -980,6 +1027,9 @@ static struct platform_driver amd_pmc_driver = { + .name = "amd_pmc", + .acpi_match_table = amd_pmc_acpi_ids, + .dev_groups = pmc_groups, ++#ifdef CONFIG_SUSPEND ++ .pm = &amd_pmc_pm, ++#endif + }, + .probe = amd_pmc_probe, + .remove = amd_pmc_remove, +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-amd-pmf-add-helper-routine-to-check-ppr.patch b/queue-6.1/platform-x86-amd-pmf-add-helper-routine-to-check-ppr.patch new file mode 100644 index 00000000000..915d4c8a2f4 --- /dev/null +++ b/queue-6.1/platform-x86-amd-pmf-add-helper-routine-to-check-ppr.patch @@ -0,0 +1,87 @@ +From c5da981e17f1db54482f0a081bc2ff1b846eeda3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 15:29:33 +0530 +Subject: platform/x86/amd/pmf: Add helper routine to check pprof is balanced + +From: Shyam Sundar S K + +[ Upstream commit 16909aa8c9cc284085f1202c6403ecb9814af812 ] + +Add helper routine to check if the current platform profile +is balanced mode and remove duplicate code occurrences. + +Signed-off-by: Shyam Sundar S K +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/r/20230125095936.3292883-3-Shyam-sundar.S-k@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Stable-dep-of: f21bf62290dd ("platform/x86/amd/pmf: Fix to update SPS thermals when power supply change") +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/cnqf.c | 6 +++--- + drivers/platform/x86/amd/pmf/pmf.h | 1 + + drivers/platform/x86/amd/pmf/sps.c | 5 +++++ + 3 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/amd/pmf/cnqf.c b/drivers/platform/x86/amd/pmf/cnqf.c +index ef2ac30ff15e..f39275ec5cc9 100644 +--- a/drivers/platform/x86/amd/pmf/cnqf.c ++++ b/drivers/platform/x86/amd/pmf/cnqf.c +@@ -103,7 +103,7 @@ int amd_pmf_trans_cnqf(struct amd_pmf_dev *dev, int socket_power, ktime_t time_l + + src = amd_pmf_cnqf_get_power_source(dev); + +- if (dev->current_profile == PLATFORM_PROFILE_BALANCED) { ++ if (is_pprof_balanced(dev)) { + amd_pmf_set_cnqf(dev, src, config_store.current_mode, NULL); + } else { + /* +@@ -317,7 +317,7 @@ static ssize_t cnqf_enable_store(struct device *dev, + src = amd_pmf_cnqf_get_power_source(pdev); + pdev->cnqf_enabled = input; + +- if (pdev->cnqf_enabled && pdev->current_profile == PLATFORM_PROFILE_BALANCED) { ++ if (pdev->cnqf_enabled && is_pprof_balanced(pdev)) { + amd_pmf_set_cnqf(pdev, src, config_store.current_mode, NULL); + } else { + if (is_apmf_func_supported(pdev, APMF_FUNC_STATIC_SLIDER_GRANULAR)) +@@ -382,7 +382,7 @@ int amd_pmf_init_cnqf(struct amd_pmf_dev *dev) + dev->cnqf_enabled = amd_pmf_check_flags(dev); + + /* update the thermal for CnQF */ +- if (dev->cnqf_enabled && dev->current_profile == PLATFORM_PROFILE_BALANCED) { ++ if (dev->cnqf_enabled && is_pprof_balanced(dev)) { + src = amd_pmf_cnqf_get_power_source(dev); + amd_pmf_set_cnqf(dev, src, config_store.current_mode, NULL); + } +diff --git a/drivers/platform/x86/amd/pmf/pmf.h b/drivers/platform/x86/amd/pmf/pmf.h +index b5b77a353b96..b94e1a9030f8 100644 +--- a/drivers/platform/x86/amd/pmf/pmf.h ++++ b/drivers/platform/x86/amd/pmf/pmf.h +@@ -391,6 +391,7 @@ int amd_pmf_init_sps(struct amd_pmf_dev *dev); + void amd_pmf_deinit_sps(struct amd_pmf_dev *dev); + int apmf_get_static_slider_granular(struct amd_pmf_dev *pdev, + struct apmf_static_slider_granular_output *output); ++bool is_pprof_balanced(struct amd_pmf_dev *pmf); + + + int apmf_update_fan_idx(struct amd_pmf_dev *pdev, bool manual, u32 idx); +diff --git a/drivers/platform/x86/amd/pmf/sps.c b/drivers/platform/x86/amd/pmf/sps.c +index 5bccea137bda..bed762d47a14 100644 +--- a/drivers/platform/x86/amd/pmf/sps.c ++++ b/drivers/platform/x86/amd/pmf/sps.c +@@ -83,6 +83,11 @@ int amd_pmf_set_sps_power_limits(struct amd_pmf_dev *pmf) + return 0; + } + ++bool is_pprof_balanced(struct amd_pmf_dev *pmf) ++{ ++ return (pmf->current_profile == PLATFORM_PROFILE_BALANCED) ? true : false; ++} ++ + static int amd_pmf_profile_get(struct platform_profile_handler *pprof, + enum platform_profile_option *profile) + { +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-amd-pmf-add-helper-routine-to-update-sp.patch b/queue-6.1/platform-x86-amd-pmf-add-helper-routine-to-update-sp.patch new file mode 100644 index 00000000000..4fdf259689f --- /dev/null +++ b/queue-6.1/platform-x86-amd-pmf-add-helper-routine-to-update-sp.patch @@ -0,0 +1,129 @@ +From 42372f190ff2d6d7a54efd2c6e7578f42e65719d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 15:29:32 +0530 +Subject: platform/x86/amd/pmf: Add helper routine to update SPS thermals + +From: Shyam Sundar S K + +[ Upstream commit c5258d39fc4cbed37e20945715e7eb102f26d65b ] + +Add helper routine to update the static slider information +and remove the duplicate code occurrences after this change. + +Signed-off-by: Shyam Sundar S K +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/r/20230125095936.3292883-2-Shyam-sundar.S-k@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Stable-dep-of: 635f79bc73cf ("platform/x86/amd/pmf: Fix to update SPS default pprof thermals") +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/auto-mode.c | 7 +------ + drivers/platform/x86/amd/pmf/cnqf.c | 8 ++------ + drivers/platform/x86/amd/pmf/pmf.h | 1 + + drivers/platform/x86/amd/pmf/sps.c | 20 ++++++++++++++------ + 4 files changed, 18 insertions(+), 18 deletions(-) + +diff --git a/drivers/platform/x86/amd/pmf/auto-mode.c b/drivers/platform/x86/amd/pmf/auto-mode.c +index 85ce9ed25b85..96a8e1832c05 100644 +--- a/drivers/platform/x86/amd/pmf/auto-mode.c ++++ b/drivers/platform/x86/amd/pmf/auto-mode.c +@@ -275,13 +275,8 @@ int amd_pmf_reset_amt(struct amd_pmf_dev *dev) + */ + + if (is_apmf_func_supported(dev, APMF_FUNC_STATIC_SLIDER_GRANULAR)) { +- int mode = amd_pmf_get_pprof_modes(dev); +- +- if (mode < 0) +- return mode; +- + dev_dbg(dev->dev, "resetting AMT thermals\n"); +- amd_pmf_update_slider(dev, SLIDER_OP_SET, mode, NULL); ++ amd_pmf_set_sps_power_limits(dev); + } + return 0; + } +diff --git a/drivers/platform/x86/amd/pmf/cnqf.c b/drivers/platform/x86/amd/pmf/cnqf.c +index 668c7c0fea83..ef2ac30ff15e 100644 +--- a/drivers/platform/x86/amd/pmf/cnqf.c ++++ b/drivers/platform/x86/amd/pmf/cnqf.c +@@ -307,13 +307,9 @@ static ssize_t cnqf_enable_store(struct device *dev, + const char *buf, size_t count) + { + struct amd_pmf_dev *pdev = dev_get_drvdata(dev); +- int mode, result, src; ++ int result, src; + bool input; + +- mode = amd_pmf_get_pprof_modes(pdev); +- if (mode < 0) +- return mode; +- + result = kstrtobool(buf, &input); + if (result) + return result; +@@ -325,7 +321,7 @@ static ssize_t cnqf_enable_store(struct device *dev, + amd_pmf_set_cnqf(pdev, src, config_store.current_mode, NULL); + } else { + if (is_apmf_func_supported(pdev, APMF_FUNC_STATIC_SLIDER_GRANULAR)) +- amd_pmf_update_slider(pdev, SLIDER_OP_SET, mode, NULL); ++ amd_pmf_set_sps_power_limits(pdev); + } + + dev_dbg(pdev->dev, "Received CnQF %s\n", input ? "on" : "off"); +diff --git a/drivers/platform/x86/amd/pmf/pmf.h b/drivers/platform/x86/amd/pmf/pmf.h +index 84bbe2c6ea61..b5b77a353b96 100644 +--- a/drivers/platform/x86/amd/pmf/pmf.h ++++ b/drivers/platform/x86/amd/pmf/pmf.h +@@ -394,6 +394,7 @@ int apmf_get_static_slider_granular(struct amd_pmf_dev *pdev, + + + int apmf_update_fan_idx(struct amd_pmf_dev *pdev, bool manual, u32 idx); ++int amd_pmf_set_sps_power_limits(struct amd_pmf_dev *pmf); + + /* Auto Mode Layer */ + int apmf_get_auto_mode_def(struct amd_pmf_dev *pdev, struct apmf_auto_mode *data); +diff --git a/drivers/platform/x86/amd/pmf/sps.c b/drivers/platform/x86/amd/pmf/sps.c +index dba7e36962dc..5f842d6e6db2 100644 +--- a/drivers/platform/x86/amd/pmf/sps.c ++++ b/drivers/platform/x86/amd/pmf/sps.c +@@ -70,6 +70,19 @@ void amd_pmf_update_slider(struct amd_pmf_dev *dev, bool op, int idx, + } + } + ++int amd_pmf_set_sps_power_limits(struct amd_pmf_dev *pmf) ++{ ++ int mode; ++ ++ mode = amd_pmf_get_pprof_modes(pmf); ++ if (mode < 0) ++ return mode; ++ ++ amd_pmf_update_slider(pmf, SLIDER_OP_SET, mode, NULL); ++ ++ return 0; ++} ++ + static int amd_pmf_profile_get(struct platform_profile_handler *pprof, + enum platform_profile_option *profile) + { +@@ -105,15 +118,10 @@ static int amd_pmf_profile_set(struct platform_profile_handler *pprof, + enum platform_profile_option profile) + { + struct amd_pmf_dev *pmf = container_of(pprof, struct amd_pmf_dev, pprof); +- int mode; + + pmf->current_profile = profile; +- mode = amd_pmf_get_pprof_modes(pmf); +- if (mode < 0) +- return mode; + +- amd_pmf_update_slider(pmf, SLIDER_OP_SET, mode, NULL); +- return 0; ++ return amd_pmf_set_sps_power_limits(pmf); + } + + int amd_pmf_init_sps(struct amd_pmf_dev *dev) +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-amd-pmf-ensure-mutexes-are-initialized-.patch b/queue-6.1/platform-x86-amd-pmf-ensure-mutexes-are-initialized-.patch new file mode 100644 index 00000000000..51ecdda45cb --- /dev/null +++ b/queue-6.1/platform-x86-amd-pmf-ensure-mutexes-are-initialized-.patch @@ -0,0 +1,66 @@ +From 5d9dc7b10becfc5a8b50c42fb64c89dc1dc70e5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 14:25:54 +0100 +Subject: platform/x86/amd/pmf: Ensure mutexes are initialized before use + +From: Hans de Goede + +[ Upstream commit e0c40529ff942a985eb0f3dacf18d35ee4dbb03d ] + +As soon as the first handler or sysfs file is registered +the mutex may get used. + +Move the initialization to before any handler registration / +sysfs file creation. + +Likewise move the destruction of the mutex to after all +the de-initialization is done. + +Fixes: da5ce22df5fe ("platform/x86/amd/pmf: Add support for PMF core layer") +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230130132554.696025-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/core.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c +index c9f7bcef4ac8..da23639071d7 100644 +--- a/drivers/platform/x86/amd/pmf/core.c ++++ b/drivers/platform/x86/amd/pmf/core.c +@@ -385,6 +385,9 @@ static int amd_pmf_probe(struct platform_device *pdev) + if (!dev->regbase) + return -ENOMEM; + ++ mutex_init(&dev->lock); ++ mutex_init(&dev->update_mutex); ++ + apmf_acpi_init(dev); + platform_set_drvdata(pdev, dev); + amd_pmf_init_features(dev); +@@ -394,8 +397,6 @@ static int amd_pmf_probe(struct platform_device *pdev) + dev->pwr_src_notifier.notifier_call = amd_pmf_pwr_src_notify_call; + power_supply_reg_notifier(&dev->pwr_src_notifier); + +- mutex_init(&dev->lock); +- mutex_init(&dev->update_mutex); + dev_info(dev->dev, "registered PMF device successfully\n"); + + return 0; +@@ -406,11 +407,11 @@ static int amd_pmf_remove(struct platform_device *pdev) + struct amd_pmf_dev *dev = platform_get_drvdata(pdev); + + power_supply_unreg_notifier(&dev->pwr_src_notifier); +- mutex_destroy(&dev->lock); +- mutex_destroy(&dev->update_mutex); + amd_pmf_deinit_features(dev); + apmf_acpi_deinit(dev); + amd_pmf_dbgfs_unregister(dev); ++ mutex_destroy(&dev->lock); ++ mutex_destroy(&dev->update_mutex); + kfree(dev->buf); + return 0; + } +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-amd-pmf-fix-to-update-sps-default-pprof.patch b/queue-6.1/platform-x86-amd-pmf-fix-to-update-sps-default-pprof.patch new file mode 100644 index 00000000000..4da30689546 --- /dev/null +++ b/queue-6.1/platform-x86-amd-pmf-fix-to-update-sps-default-pprof.patch @@ -0,0 +1,43 @@ +From 5e527315ab65e25853433b84be40a4822bf9f3ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 15:29:35 +0530 +Subject: platform/x86/amd/pmf: Fix to update SPS default pprof thermals + +From: Shyam Sundar S K + +[ Upstream commit 635f79bc73cf3d40c4198a20b3a0e7016dd6f0d3 ] + +By design PMF static slider will be set to BALANCED during +init, but updating to corresponding thermal values from +the PMF config store was missed, leading to improper settings +getting propagated to PMFW. + +Fixes: 4c71ae414474 ("platform/x86/amd/pmf: Add support SPS PMF feature") +Suggested-by: Patil Rajesh Reddy +Signed-off-by: Shyam Sundar S K +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/r/20230125095936.3292883-5-Shyam-sundar.S-k@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/sps.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmf/sps.c b/drivers/platform/x86/amd/pmf/sps.c +index 5f842d6e6db2..5bccea137bda 100644 +--- a/drivers/platform/x86/amd/pmf/sps.c ++++ b/drivers/platform/x86/amd/pmf/sps.c +@@ -131,6 +131,9 @@ int amd_pmf_init_sps(struct amd_pmf_dev *dev) + dev->current_profile = PLATFORM_PROFILE_BALANCED; + amd_pmf_load_defaults_sps(dev); + ++ /* update SPS balanced power mode thermals */ ++ amd_pmf_set_sps_power_limits(dev); ++ + dev->pprof.profile_get = amd_pmf_profile_get; + dev->pprof.profile_set = amd_pmf_profile_set; + +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-amd-pmf-fix-to-update-sps-thermals-when.patch b/queue-6.1/platform-x86-amd-pmf-fix-to-update-sps-thermals-when.patch new file mode 100644 index 00000000000..f13130ec631 --- /dev/null +++ b/queue-6.1/platform-x86-amd-pmf-fix-to-update-sps-thermals-when.patch @@ -0,0 +1,96 @@ +From ad0756aa22b26c742d083eea17f6a0f6a1134024 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 15:29:36 +0530 +Subject: platform/x86/amd/pmf: Fix to update SPS thermals when power supply + change + +From: Shyam Sundar S K + +[ Upstream commit f21bf62290dd4d769594dcf0e6a688783d74f6a0 ] + +Every power mode of static power slider has its own AC and DC power +settings. + +When the power source changes from AC to DC, corresponding DC thermals +were not updated from PMF config store and this leads the system to always +run on AC power settings. + +Fix it by registering with power_supply notifier and apply DC settings +upon getting notified by the power_supply handler. + +Fixes: da5ce22df5fe ("platform/x86/amd/pmf: Add support for PMF core layer") +Suggested-by: Patil Rajesh Reddy +Signed-off-by: Shyam Sundar S K +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/r/20230125095936.3292883-6-Shyam-sundar.S-k@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/core.c | 23 +++++++++++++++++++++++ + drivers/platform/x86/amd/pmf/pmf.h | 1 + + 2 files changed, 24 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c +index a5f5a4bcff6d..c9f7bcef4ac8 100644 +--- a/drivers/platform/x86/amd/pmf/core.c ++++ b/drivers/platform/x86/amd/pmf/core.c +@@ -58,6 +58,25 @@ static bool force_load; + module_param(force_load, bool, 0444); + MODULE_PARM_DESC(force_load, "Force load this driver on supported older platforms (experimental)"); + ++static int amd_pmf_pwr_src_notify_call(struct notifier_block *nb, unsigned long event, void *data) ++{ ++ struct amd_pmf_dev *pmf = container_of(nb, struct amd_pmf_dev, pwr_src_notifier); ++ ++ if (event != PSY_EVENT_PROP_CHANGED) ++ return NOTIFY_OK; ++ ++ if (is_apmf_func_supported(pmf, APMF_FUNC_AUTO_MODE) || ++ is_apmf_func_supported(pmf, APMF_FUNC_DYN_SLIDER_DC) || ++ is_apmf_func_supported(pmf, APMF_FUNC_DYN_SLIDER_AC)) { ++ if ((pmf->amt_enabled || pmf->cnqf_enabled) && is_pprof_balanced(pmf)) ++ return NOTIFY_DONE; ++ } ++ ++ amd_pmf_set_sps_power_limits(pmf); ++ ++ return NOTIFY_OK; ++} ++ + static int current_power_limits_show(struct seq_file *seq, void *unused) + { + struct amd_pmf_dev *dev = seq->private; +@@ -372,6 +391,9 @@ static int amd_pmf_probe(struct platform_device *pdev) + apmf_install_handler(dev); + amd_pmf_dbgfs_register(dev); + ++ dev->pwr_src_notifier.notifier_call = amd_pmf_pwr_src_notify_call; ++ power_supply_reg_notifier(&dev->pwr_src_notifier); ++ + mutex_init(&dev->lock); + mutex_init(&dev->update_mutex); + dev_info(dev->dev, "registered PMF device successfully\n"); +@@ -383,6 +405,7 @@ static int amd_pmf_remove(struct platform_device *pdev) + { + struct amd_pmf_dev *dev = platform_get_drvdata(pdev); + ++ power_supply_unreg_notifier(&dev->pwr_src_notifier); + mutex_destroy(&dev->lock); + mutex_destroy(&dev->update_mutex); + amd_pmf_deinit_features(dev); +diff --git a/drivers/platform/x86/amd/pmf/pmf.h b/drivers/platform/x86/amd/pmf/pmf.h +index b94e1a9030f8..06c30cdc0573 100644 +--- a/drivers/platform/x86/amd/pmf/pmf.h ++++ b/drivers/platform/x86/amd/pmf/pmf.h +@@ -169,6 +169,7 @@ struct amd_pmf_dev { + struct mutex update_mutex; /* protects race between ACPI handler and metrics thread */ + bool cnqf_enabled; + bool cnqf_supported; ++ struct notifier_block pwr_src_notifier; + }; + + struct apmf_sps_prop_granular { +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-amd-pmf-update-to-auto-mode-limits-only.patch b/queue-6.1/platform-x86-amd-pmf-update-to-auto-mode-limits-only.patch new file mode 100644 index 00000000000..6978d91fd50 --- /dev/null +++ b/queue-6.1/platform-x86-amd-pmf-update-to-auto-mode-limits-only.patch @@ -0,0 +1,43 @@ +From 4983ffb1bebabe6343344fb4eb7ac38961e1fe2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 15:29:34 +0530 +Subject: platform/x86/amd/pmf: update to auto-mode limits only after AMT event + +From: Shyam Sundar S K + +[ Upstream commit 3dfe28c936f87373a2b6ada750be4c52c0f249f3 ] + +Auto-mode thermal limits should be updated only after receiving the AMT +event. But due to a bug in the older commit, these settings were getting +applied during the auto-mode init. + +Fix this by removing amd_pmf_set_automode() during auto-mode +initialization. + +Fixes: 3f5571d99524 ("platform/x86/amd/pmf: Add support for Auto mode feature") +Suggested-by: Patil Rajesh Reddy +Signed-off-by: Shyam Sundar S K +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/r/20230125095936.3292883-4-Shyam-sundar.S-k@amd.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/auto-mode.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/platform/x86/amd/pmf/auto-mode.c b/drivers/platform/x86/amd/pmf/auto-mode.c +index 644af42e07cf..85ce9ed25b85 100644 +--- a/drivers/platform/x86/amd/pmf/auto-mode.c ++++ b/drivers/platform/x86/amd/pmf/auto-mode.c +@@ -299,7 +299,5 @@ void amd_pmf_deinit_auto_mode(struct amd_pmf_dev *dev) + void amd_pmf_init_auto_mode(struct amd_pmf_dev *dev) + { + amd_pmf_load_defaults_auto_mode(dev); +- /* update the thermal limits for Automode */ +- amd_pmf_set_automode(dev, config_store.current_mode, NULL); + amd_pmf_init_metrics_table(dev); + } +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-dell-wmi-add-a-keymap-for-key_mute-in-t.patch b/queue-6.1/platform-x86-dell-wmi-add-a-keymap-for-key_mute-in-t.patch new file mode 100644 index 00000000000..a6215828ded --- /dev/null +++ b/queue-6.1/platform-x86-dell-wmi-add-a-keymap-for-key_mute-in-t.patch @@ -0,0 +1,41 @@ +From c08d5dadbc75cd68a171cb3853cf418a45e79a3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 20:34:36 +0800 +Subject: platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 + table + +From: Koba Ko + +[ Upstream commit 83bcf3e52e9cfc727df33f1055ef0618c91719d0 ] + +Some platforms send the speaker-mute key from EC. dell-wmi can't +recognize it. + +Add a new keymap for KEY_MUTE in type 0x0010 table. + +Signed-off-by: Koba Ko +Link: https://lore.kernel.org/r/20230117123436.200440-1-koba.ko@canonical.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/dell/dell-wmi-base.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/platform/x86/dell/dell-wmi-base.c b/drivers/platform/x86/dell/dell-wmi-base.c +index 0a259a27459f..502783a7adb1 100644 +--- a/drivers/platform/x86/dell/dell-wmi-base.c ++++ b/drivers/platform/x86/dell/dell-wmi-base.c +@@ -261,6 +261,9 @@ static const struct key_entry dell_wmi_keymap_type_0010[] = { + { KE_KEY, 0x57, { KEY_BRIGHTNESSDOWN } }, + { KE_KEY, 0x58, { KEY_BRIGHTNESSUP } }, + ++ /*Speaker Mute*/ ++ { KE_KEY, 0x109, { KEY_MUTE} }, ++ + /* Mic mute */ + { KE_KEY, 0x150, { KEY_MICMUTE } }, + +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch b/queue-6.1/platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch new file mode 100644 index 00000000000..b0b8f989392 --- /dev/null +++ b/queue-6.1/platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch @@ -0,0 +1,41 @@ +From e4e5816cb07208d5773420993fead2e676a16f21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 20:39:25 +0530 +Subject: platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kevin Kuriakose + +[ Upstream commit a410429a3b7e748a9db9f357e71e2e085a21c902 ] + +To the best of my knowledge this is the same board as the B450M DS3H-CF, +but with an added WiFi card. Name obtained using dmidecode, tested +with force_load on v6.1.6 + +Signed-off-by: Kevin Kuriakose +Acked-by: Thomas Weißschuh +Link: https://lore.kernel.org/r/20230119150925.31962-1-kevinmkuriakose@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/gigabyte-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/gigabyte-wmi.c b/drivers/platform/x86/gigabyte-wmi.c +index 5e7e6659a849..322cfaeda17b 100644 +--- a/drivers/platform/x86/gigabyte-wmi.c ++++ b/drivers/platform/x86/gigabyte-wmi.c +@@ -141,6 +141,7 @@ static u8 gigabyte_wmi_detect_sensor_usability(struct wmi_device *wdev) + + static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = { + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M DS3H-CF"), ++ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M DS3H WIFI-CF"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M S2H V2"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE AX V2"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE"), +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-hp-wmi-handle-omen-key-event.patch b/queue-6.1/platform-x86-hp-wmi-handle-omen-key-event.patch new file mode 100644 index 00000000000..f2561275948 --- /dev/null +++ b/queue-6.1/platform-x86-hp-wmi-handle-omen-key-event.patch @@ -0,0 +1,66 @@ +From cecd9bfb2610a027a7e9644d318ebb717f70c363 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Jan 2023 03:42:14 +0530 +Subject: platform/x86: hp-wmi: Handle Omen Key event + +From: Rishit Bansal + +[ Upstream commit 3ee5447b2048c8389ed899838a40b40180d50906 ] + +Add support to map the "HP Omen Key" to KEY_PROG2. Laptops in the HP +Omen Series open the HP Omen Command Center application on windows. But, +on linux it fails with the following message from the hp-wmi driver: + +[ 5143.415714] hp_wmi: Unknown event_id - 29 - 0x21a5 + +Also adds support to map Fn+Esc to KEY_FN_ESC. This currently throws the +following message on the hp-wmi driver: + +[ 6082.143785] hp_wmi: Unknown key code - 0x21a7 + +There is also a "Win-Lock" key on HP Omen Laptops which supports +Enabling and Disabling the Windows key, which trigger commands 0x21a4 +and 0x121a4 respectively, but I wasn't able to find any KEY in input.h +to map this to. + +Signed-off-by: Rishit Bansal +Link: https://lore.kernel.org/r/20230120221214.24426-1-rishitbansal0@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/hp-wmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c +index 0a99058be813..4a3851332ef2 100644 +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -90,6 +90,7 @@ enum hp_wmi_event_ids { + HPWMI_PEAKSHIFT_PERIOD = 0x0F, + HPWMI_BATTERY_CHARGE_PERIOD = 0x10, + HPWMI_SANITIZATION_MODE = 0x17, ++ HPWMI_OMEN_KEY = 0x1D, + HPWMI_SMART_EXPERIENCE_APP = 0x21, + }; + +@@ -216,6 +217,8 @@ static const struct key_entry hp_wmi_keymap[] = { + { KE_KEY, 0x213b, { KEY_INFO } }, + { KE_KEY, 0x2169, { KEY_ROTATE_DISPLAY } }, + { KE_KEY, 0x216a, { KEY_SETUP } }, ++ { KE_KEY, 0x21a5, { KEY_PROG2 } }, /* HP Omen Key */ ++ { KE_KEY, 0x21a7, { KEY_FN_ESC } }, + { KE_KEY, 0x21a9, { KEY_TOUCHPAD_OFF } }, + { KE_KEY, 0x121a9, { KEY_TOUCHPAD_ON } }, + { KE_KEY, 0x231b, { KEY_HELP } }, +@@ -810,6 +813,7 @@ static void hp_wmi_notify(u32 value, void *context) + case HPWMI_SMART_ADAPTER: + break; + case HPWMI_BEZEL_BUTTON: ++ case HPWMI_OMEN_KEY: + key_code = hp_wmi_read_int(HPWMI_HOTKEY_QUERY); + if (key_code < 0) + break; +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-thinkpad_acpi-fix-thinklight-led-bright.patch b/queue-6.1/platform-x86-thinkpad_acpi-fix-thinklight-led-bright.patch new file mode 100644 index 00000000000..a7687438187 --- /dev/null +++ b/queue-6.1/platform-x86-thinkpad_acpi-fix-thinklight-led-bright.patch @@ -0,0 +1,38 @@ +From 7343db90457126535c0f4989a94232fb05fe34a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Jan 2023 00:57:23 +0100 +Subject: platform/x86: thinkpad_acpi: Fix thinklight LED brightness returning + 255 + +From: Hans de Goede + +[ Upstream commit eebf82012dddbdcb09e4e49d3cdfafb93bc66eb2 ] + +Reading the thinklight LED brightnes while the LED is on returns +255 (LED_FULL) but we advertise a max_brightness of 1, so this should +be 1 (LED_ON). + +Fixes: db5e2a4ca0a7 ("platform/x86: thinkpad_acpi: Fix max_brightness of thinklight") +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230127235723.412864-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 7fd735c67a8e..2a48a2d880d8 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -5566,7 +5566,7 @@ static int light_sysfs_set(struct led_classdev *led_cdev, + + static enum led_brightness light_sysfs_get(struct led_classdev *led_cdev) + { +- return (light_get_status() == 1) ? LED_FULL : LED_OFF; ++ return (light_get_status() == 1) ? LED_ON : LED_OFF; + } + + static struct tpacpi_led_classdev tpacpi_led_thinklight = { +-- +2.39.0 + diff --git a/queue-6.1/qede-execute-xdp_do_flush-before-napi_complete_done.patch b/queue-6.1/qede-execute-xdp_do_flush-before-napi_complete_done.patch new file mode 100644 index 00000000000..7f57a35fba1 --- /dev/null +++ b/queue-6.1/qede-execute-xdp_do_flush-before-napi_complete_done.patch @@ -0,0 +1,66 @@ +From 173e6aedd94f202ba3a21659c2b19e6c9a095938 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 08:48:57 +0100 +Subject: qede: execute xdp_do_flush() before napi_complete_done() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Magnus Karlsson + +[ Upstream commit 2ccce20d51faa0178086163ccb6c84a099a87ab4 ] + +Make sure that xdp_do_flush() is always executed before +napi_complete_done(). This is important for two reasons. First, a +redirect to an XSKMAP assumes that a call to xdp_do_redirect() from +napi context X on CPU Y will be followed by a xdp_do_flush() from the +same napi context and CPU. This is not guaranteed if the +napi_complete_done() is executed before xdp_do_flush(), as it tells +the napi logic that it is fine to schedule napi context X on another +CPU. Details from a production system triggering this bug using the +veth driver can be found following the first link below. + +The second reason is that the XDP_REDIRECT logic in itself relies on +being inside a single NAPI instance through to the xdp_do_flush() call +for RCU protection of all in-kernel data structures. Details can be +found in the second link below. + +Fixes: d1b25b79e162b ("qede: add .ndo_xdp_xmit() and XDP_REDIRECT support") +Signed-off-by: Magnus Karlsson +Acked-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com +Link: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/ +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qede/qede_fp.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c +index 7c2af482192d..cb1746bc0e0c 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c +@@ -1438,6 +1438,10 @@ int qede_poll(struct napi_struct *napi, int budget) + rx_work_done = (likely(fp->type & QEDE_FASTPATH_RX) && + qede_has_rx_work(fp->rxq)) ? + qede_rx_int(fp, budget) : 0; ++ ++ if (fp->xdp_xmit & QEDE_XDP_REDIRECT) ++ xdp_do_flush(); ++ + /* Handle case where we are called by netpoll with a budget of 0 */ + if (rx_work_done < budget || !budget) { + if (!qede_poll_is_more_work(fp)) { +@@ -1457,9 +1461,6 @@ int qede_poll(struct napi_struct *napi, int budget) + qede_update_tx_producer(fp->xdp_tx); + } + +- if (fp->xdp_xmit & QEDE_XDP_REDIRECT) +- xdp_do_flush_map(); +- + return rx_work_done; + } + +-- +2.39.0 + diff --git a/queue-6.1/read-is-data-destination-not-source.patch b/queue-6.1/read-is-data-destination-not-source.patch new file mode 100644 index 00000000000..2618f2202cc --- /dev/null +++ b/queue-6.1/read-is-data-destination-not-source.patch @@ -0,0 +1,32 @@ +From 0782949e2c212f49834b5cdc7b9aa7a0abfef923 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 19:01:10 -0400 +Subject: READ is "data destination", not source... + +From: Al Viro + +[ Upstream commit 355d2c2798e9dc39f6714fa7ef8902c0d4c5350b ] + +Signed-off-by: Al Viro +Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index 8546b8816524..88282b288abd 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -966,7 +966,7 @@ static void rtrs_clt_init_req(struct rtrs_clt_io_req *req, + refcount_set(&req->ref, 1); + req->mp_policy = clt_path->clt->mp_policy; + +- iov_iter_kvec(&iter, READ, vec, 1, usr_len); ++ iov_iter_kvec(&iter, WRITE, vec, 1, usr_len); + len = _copy_from_iter(req->iu->buf, usr_len, &iter); + WARN_ON(len != usr_len); + +-- +2.39.0 + diff --git a/queue-6.1/revert-gfs2-stop-using-generic_writepages-in-gfs2_ai.patch b/queue-6.1/revert-gfs2-stop-using-generic_writepages-in-gfs2_ai.patch new file mode 100644 index 00000000000..dd6053a0e35 --- /dev/null +++ b/queue-6.1/revert-gfs2-stop-using-generic_writepages-in-gfs2_ai.patch @@ -0,0 +1,74 @@ +From 93d079890c729fc5eafc4f0d78cdf74e981ceded Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 20:14:42 +0100 +Subject: Revert "gfs2: stop using generic_writepages in gfs2_ail1_start_one" + +From: Andreas Gruenbacher + +[ Upstream commit 95ecbd0f162fc06ef4c4045a66f653f47b62a2d3 ] + +Commit b2b0a5e97855 switched from generic_writepages() to +filemap_fdatawrite_wbc() in gfs2_ail1_start_one() on the path to +replacing ->writepage() with ->writepages() and eventually eliminating +the former. Function gfs2_ail1_start_one() is called from +gfs2_log_flush(), our main function for flushing the filesystem log. + +Unfortunately, at least as implemented today, ->writepage() and +->writepages() are entirely different operations for journaled data +inodes: while the former creates and submits transactions covering the +data to be written, the latter flushes dirty buffers out to disk. + +With gfs2_ail1_start_one() now calling ->writepages(), we end up +creating filesystem transactions while we are in the course of a log +flush, which immediately deadlocks on the sdp->sd_log_flush_lock +semaphore. + +Work around that by going back to how things used to work before commit +b2b0a5e97855 for now; figuring out a superior solution will take time we +don't have available right now. However ... + +Since the removal of generic_writepages() is imminent, open-code it +here. We're already inside a blk_start_plug() ... blk_finish_plug() +section here, so skip that part of the original generic_writepages(). + +This reverts commit b2b0a5e978552e348f85ad9c7568b630a5ede659. + +Signed-off-by: Andreas Gruenbacher +Acked-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/gfs2/log.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c +index 723639376ae2..61323deb80bc 100644 +--- a/fs/gfs2/log.c ++++ b/fs/gfs2/log.c +@@ -80,6 +80,15 @@ void gfs2_remove_from_ail(struct gfs2_bufdata *bd) + brelse(bd->bd_bh); + } + ++static int __gfs2_writepage(struct page *page, struct writeback_control *wbc, ++ void *data) ++{ ++ struct address_space *mapping = data; ++ int ret = mapping->a_ops->writepage(page, wbc); ++ mapping_set_error(mapping, ret); ++ return ret; ++} ++ + /** + * gfs2_ail1_start_one - Start I/O on a transaction + * @sdp: The superblock +@@ -131,7 +140,7 @@ __acquires(&sdp->sd_ail_lock) + if (!mapping) + continue; + spin_unlock(&sdp->sd_ail_lock); +- ret = filemap_fdatawrite_wbc(mapping, wbc); ++ ret = write_cache_pages(mapping, wbc, __gfs2_writepage, mapping); + if (need_resched()) { + blk_finish_plug(plug); + cond_resched(); +-- +2.39.0 + diff --git a/queue-6.1/riscv-kprobe-fixup-kernel-panic-when-probing-an-ille.patch b/queue-6.1/riscv-kprobe-fixup-kernel-panic-when-probing-an-ille.patch new file mode 100644 index 00000000000..8a62984552b --- /dev/null +++ b/queue-6.1/riscv-kprobe-fixup-kernel-panic-when-probing-an-ille.patch @@ -0,0 +1,95 @@ +From ca76327b433d475958e3267feb81e0479a83b8fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 23:06:04 -0500 +Subject: riscv: kprobe: Fixup kernel panic when probing an illegal position +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Guo Ren + +[ Upstream commit 87f48c7ccc73afc78630530d9af51f458f58cab8 ] + +The kernel would panic when probed for an illegal position. eg: + +(CONFIG_RISCV_ISA_C=n) + +echo 'p:hello kernel_clone+0x16 a0=%a0' >> kprobe_events +echo 1 > events/kprobes/hello/enable +cat trace + +Kernel panic - not syncing: stack-protector: Kernel stack +is corrupted in: __do_sys_newfstatat+0xb8/0xb8 +CPU: 0 PID: 111 Comm: sh Not tainted +6.2.0-rc1-00027-g2d398fe49a4d #490 +Hardware name: riscv-virtio,qemu (DT) +Call Trace: +[] dump_backtrace+0x38/0x48 +[] show_stack+0x50/0x68 +[] dump_stack_lvl+0x60/0x84 +[] dump_stack+0x20/0x30 +[] panic+0x160/0x374 +[] generic_handle_arch_irq+0x0/0xa8 +[] sys_newstat+0x0/0x30 +[] sys_clone+0x20/0x30 +[] ret_from_syscall+0x0/0x4 +---[ end Kernel panic - not syncing: stack-protector: +Kernel stack is corrupted in: __do_sys_newfstatat+0xb8/0xb8 ]--- + +That is because the kprobe's ebreak instruction broke the kernel's +original code. The user should guarantee the correction of the probe +position, but it couldn't make the kernel panic. + +This patch adds arch_check_kprobe in arch_prepare_kprobe to prevent an +illegal position (Such as the middle of an instruction). + +Fixes: c22b0bcb1dd0 ("riscv: Add kprobes supported") +Signed-off-by: Guo Ren +Signed-off-by: Guo Ren +Reviewed-by: Björn Töpel +Link: https://lore.kernel.org/r/20230201040604.3390509-1-guoren@kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/probes/kprobes.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c +index e6e950b7cf32..388ecada500c 100644 +--- a/arch/riscv/kernel/probes/kprobes.c ++++ b/arch/riscv/kernel/probes/kprobes.c +@@ -48,6 +48,21 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs) + post_kprobe_handler(p, kcb, regs); + } + ++static bool __kprobes arch_check_kprobe(struct kprobe *p) ++{ ++ unsigned long tmp = (unsigned long)p->addr - p->offset; ++ unsigned long addr = (unsigned long)p->addr; ++ ++ while (tmp <= addr) { ++ if (tmp == addr) ++ return true; ++ ++ tmp += GET_INSN_LENGTH(*(u16 *)tmp); ++ } ++ ++ return false; ++} ++ + int __kprobes arch_prepare_kprobe(struct kprobe *p) + { + unsigned long probe_addr = (unsigned long)p->addr; +@@ -55,6 +70,9 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) + if (probe_addr & 0x1) + return -EILSEQ; + ++ if (!arch_check_kprobe(p)) ++ return -EILSEQ; ++ + /* copy instruction */ + p->opcode = *p->addr; + +-- +2.39.0 + diff --git a/queue-6.1/rtc-sunplus-fix-format-string-for-printing-resource.patch b/queue-6.1/rtc-sunplus-fix-format-string-for-printing-resource.patch new file mode 100644 index 00000000000..df2d79ed762 --- /dev/null +++ b/queue-6.1/rtc-sunplus-fix-format-string-for-printing-resource.patch @@ -0,0 +1,47 @@ +From 3672f40dfe3581efc0bfcff13c8b114e0cdc1ca6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 18:24:44 +0100 +Subject: rtc: sunplus: fix format string for printing resource + +From: Arnd Bergmann + +[ Upstream commit 08279468a294d8c996a657ecc9e51bd5c084c75d ] + +On 32-bit architectures with 64-bit resource_size_t, sp_rtc_probe() +causes a compiler warning: + +drivers/rtc/rtc-sunplus.c: In function 'sp_rtc_probe': +drivers/rtc/rtc-sunplus.c:243:33: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] + 243 | dev_dbg(&plat_dev->dev, "res = 0x%x, reg_base = 0x%lx\n", + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The best way to print a resource is the special %pR format string, +and similarly to print a pointer we can use %p and avoid the cast. + +Fixes: fad6cbe9b2b4 ("rtc: Add driver for RTC in Sunplus SP7021") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20230117172450.2938962-1-arnd@kernel.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-sunplus.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/rtc/rtc-sunplus.c b/drivers/rtc/rtc-sunplus.c +index e8e2ab1103fc..4b578e4d44f6 100644 +--- a/drivers/rtc/rtc-sunplus.c ++++ b/drivers/rtc/rtc-sunplus.c +@@ -240,8 +240,8 @@ static int sp_rtc_probe(struct platform_device *plat_dev) + if (IS_ERR(sp_rtc->reg_base)) + return dev_err_probe(&plat_dev->dev, PTR_ERR(sp_rtc->reg_base), + "%s devm_ioremap_resource fail\n", RTC_REG_NAME); +- dev_dbg(&plat_dev->dev, "res = 0x%x, reg_base = 0x%lx\n", +- sp_rtc->res->start, (unsigned long)sp_rtc->reg_base); ++ dev_dbg(&plat_dev->dev, "res = %pR, reg_base = %p\n", ++ sp_rtc->res, sp_rtc->reg_base); + + sp_rtc->irq = platform_get_irq(plat_dev, 0); + if (sp_rtc->irq < 0) +-- +2.39.0 + diff --git a/queue-6.1/scsi-iscsi_tcp-fix-uaf-during-login-when-accessing-t.patch b/queue-6.1/scsi-iscsi_tcp-fix-uaf-during-login-when-accessing-t.patch new file mode 100644 index 00000000000..c80e7ea9606 --- /dev/null +++ b/queue-6.1/scsi-iscsi_tcp-fix-uaf-during-login-when-accessing-t.patch @@ -0,0 +1,68 @@ +From d712ca765374736b33e7c5eaacd720e3a2405b03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 13:39:37 -0600 +Subject: scsi: iscsi_tcp: Fix UAF during login when accessing the shost + ipaddress + +From: Mike Christie + +[ Upstream commit f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3 ] + +If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, +userspace could be accessing the host's ipaddress attr. If we then free the +session via iscsi_session_teardown() while userspace is still accessing the +session we will hit a use after free bug. + +Set the tcp_sw_host->session after we have completed session creation and +can no longer fail. + +Link: https://lore.kernel.org/r/20230117193937.21244-3-michael.christie@oracle.com +Signed-off-by: Mike Christie +Reviewed-by: Lee Duncan +Acked-by: Ding Hui +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/iscsi_tcp.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c +index 9c0c8f34ef67..c3ad04ad66e0 100644 +--- a/drivers/scsi/iscsi_tcp.c ++++ b/drivers/scsi/iscsi_tcp.c +@@ -848,7 +848,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost, + enum iscsi_host_param param, char *buf) + { + struct iscsi_sw_tcp_host *tcp_sw_host = iscsi_host_priv(shost); +- struct iscsi_session *session = tcp_sw_host->session; ++ struct iscsi_session *session; + struct iscsi_conn *conn; + struct iscsi_tcp_conn *tcp_conn; + struct iscsi_sw_tcp_conn *tcp_sw_conn; +@@ -858,6 +858,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost, + + switch (param) { + case ISCSI_HOST_PARAM_IPADDRESS: ++ session = tcp_sw_host->session; + if (!session) + return -ENOTCONN; + +@@ -958,11 +959,13 @@ iscsi_sw_tcp_session_create(struct iscsi_endpoint *ep, uint16_t cmds_max, + if (!cls_session) + goto remove_host; + session = cls_session->dd_data; +- tcp_sw_host = iscsi_host_priv(shost); +- tcp_sw_host->session = session; + + if (iscsi_tcp_r2tpool_alloc(session)) + goto remove_session; ++ ++ /* We are now fully setup so expose the session to sysfs. */ ++ tcp_sw_host = iscsi_host_priv(shost); ++ tcp_sw_host->session = session; + return cls_session; + + remove_session: +-- +2.39.0 + diff --git a/queue-6.1/scsi-iscsi_tcp-fix-uaf-during-logout-when-accessing-.patch b/queue-6.1/scsi-iscsi_tcp-fix-uaf-during-logout-when-accessing-.patch new file mode 100644 index 00000000000..8f652b41c07 --- /dev/null +++ b/queue-6.1/scsi-iscsi_tcp-fix-uaf-during-logout-when-accessing-.patch @@ -0,0 +1,230 @@ +From 880f111fdf807a6b95aa569f938643e4c29b3a8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 13:39:36 -0600 +Subject: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost + ipaddress + +From: Mike Christie + +[ Upstream commit 6f1d64b13097e85abda0f91b5638000afc5f9a06 ] + +Bug report and analysis from Ding Hui. + +During iSCSI session logout, if another task accesses the shost ipaddress +attr, we can get a KASAN UAF report like this: + +[ 276.942144] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x78/0xe0 +[ 276.942535] Write of size 4 at addr ffff8881053b45b8 by task cat/4088 +[ 276.943511] CPU: 2 PID: 4088 Comm: cat Tainted: G E 6.1.0-rc8+ #3 +[ 276.943997] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 +[ 276.944470] Call Trace: +[ 276.944943] +[ 276.945397] dump_stack_lvl+0x34/0x48 +[ 276.945887] print_address_description.constprop.0+0x86/0x1e7 +[ 276.946421] print_report+0x36/0x4f +[ 276.947358] kasan_report+0xad/0x130 +[ 276.948234] kasan_check_range+0x35/0x1c0 +[ 276.948674] _raw_spin_lock_bh+0x78/0xe0 +[ 276.949989] iscsi_sw_tcp_host_get_param+0xad/0x2e0 [iscsi_tcp] +[ 276.951765] show_host_param_ISCSI_HOST_PARAM_IPADDRESS+0xe9/0x130 [scsi_transport_iscsi] +[ 276.952185] dev_attr_show+0x3f/0x80 +[ 276.953005] sysfs_kf_seq_show+0x1fb/0x3e0 +[ 276.953401] seq_read_iter+0x402/0x1020 +[ 276.954260] vfs_read+0x532/0x7b0 +[ 276.955113] ksys_read+0xed/0x1c0 +[ 276.955952] do_syscall_64+0x38/0x90 +[ 276.956347] entry_SYSCALL_64_after_hwframe+0x63/0xcd +[ 276.956769] RIP: 0033:0x7f5d3a679222 +[ 276.957161] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 32 c0 0b 00 e8 a5 fe 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 +[ 276.958009] RSP: 002b:00007ffc864d16a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 +[ 276.958431] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5d3a679222 +[ 276.958857] RDX: 0000000000020000 RSI: 00007f5d3a4fe000 RDI: 0000000000000003 +[ 276.959281] RBP: 00007f5d3a4fe000 R08: 00000000ffffffff R09: 0000000000000000 +[ 276.959682] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000020000 +[ 276.960126] R13: 0000000000000003 R14: 0000000000000000 R15: 0000557a26dada58 +[ 276.960536] +[ 276.961357] Allocated by task 2209: +[ 276.961756] kasan_save_stack+0x1e/0x40 +[ 276.962170] kasan_set_track+0x21/0x30 +[ 276.962557] __kasan_kmalloc+0x7e/0x90 +[ 276.962923] __kmalloc+0x5b/0x140 +[ 276.963308] iscsi_alloc_session+0x28/0x840 [scsi_transport_iscsi] +[ 276.963712] iscsi_session_setup+0xda/0xba0 [libiscsi] +[ 276.964078] iscsi_sw_tcp_session_create+0x1fd/0x330 [iscsi_tcp] +[ 276.964431] iscsi_if_create_session.isra.0+0x50/0x260 [scsi_transport_iscsi] +[ 276.964793] iscsi_if_recv_msg+0xc5a/0x2660 [scsi_transport_iscsi] +[ 276.965153] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] +[ 276.965546] netlink_unicast+0x4d5/0x7b0 +[ 276.965905] netlink_sendmsg+0x78d/0xc30 +[ 276.966236] sock_sendmsg+0xe5/0x120 +[ 276.966576] ____sys_sendmsg+0x5fe/0x860 +[ 276.966923] ___sys_sendmsg+0xe0/0x170 +[ 276.967300] __sys_sendmsg+0xc8/0x170 +[ 276.967666] do_syscall_64+0x38/0x90 +[ 276.968028] entry_SYSCALL_64_after_hwframe+0x63/0xcd +[ 276.968773] Freed by task 2209: +[ 276.969111] kasan_save_stack+0x1e/0x40 +[ 276.969449] kasan_set_track+0x21/0x30 +[ 276.969789] kasan_save_free_info+0x2a/0x50 +[ 276.970146] __kasan_slab_free+0x106/0x190 +[ 276.970470] __kmem_cache_free+0x133/0x270 +[ 276.970816] device_release+0x98/0x210 +[ 276.971145] kobject_cleanup+0x101/0x360 +[ 276.971462] iscsi_session_teardown+0x3fb/0x530 [libiscsi] +[ 276.971775] iscsi_sw_tcp_session_destroy+0xd8/0x130 [iscsi_tcp] +[ 276.972143] iscsi_if_recv_msg+0x1bf1/0x2660 [scsi_transport_iscsi] +[ 276.972485] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] +[ 276.972808] netlink_unicast+0x4d5/0x7b0 +[ 276.973201] netlink_sendmsg+0x78d/0xc30 +[ 276.973544] sock_sendmsg+0xe5/0x120 +[ 276.973864] ____sys_sendmsg+0x5fe/0x860 +[ 276.974248] ___sys_sendmsg+0xe0/0x170 +[ 276.974583] __sys_sendmsg+0xc8/0x170 +[ 276.974891] do_syscall_64+0x38/0x90 +[ 276.975216] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +We can easily reproduce by two tasks: +1. while :; do iscsiadm -m node --login; iscsiadm -m node --logout; done +2. while :; do cat \ +/sys/devices/platform/host*/iscsi_host/host*/ipaddress; done + + iscsid | cat +--------------------------------+--------------------------------------- +|- iscsi_sw_tcp_session_destroy | + |- iscsi_session_teardown | + |- device_release | + |- iscsi_session_release ||- dev_attr_show + |- kfree | |- show_host_param_ + | ISCSI_HOST_PARAM_IPADDRESS + | |- iscsi_sw_tcp_host_get_param + | |- r/w tcp_sw_host->session (UAF) + |- iscsi_host_remove | + |- iscsi_host_free | + +Fix the above bug by splitting the session removal into 2 parts: + + 1. removal from iSCSI class which includes sysfs and removal from host + tracking. + + 2. freeing of session. + +During iscsi_tcp host and session removal we can remove the session from +sysfs then remove the host from sysfs. At this point we know userspace is +not accessing the kernel via sysfs so we can free the session and host. + +Link: https://lore.kernel.org/r/20230117193937.21244-2-michael.christie@oracle.com +Signed-off-by: Mike Christie +Reviewed-by: Lee Duncan +Acked-by: Ding Hui +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/iscsi_tcp.c | 11 +++++++++-- + drivers/scsi/libiscsi.c | 38 +++++++++++++++++++++++++++++++------- + include/scsi/libiscsi.h | 2 ++ + 3 files changed, 42 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c +index 5fb1f364e815..9c0c8f34ef67 100644 +--- a/drivers/scsi/iscsi_tcp.c ++++ b/drivers/scsi/iscsi_tcp.c +@@ -982,10 +982,17 @@ static void iscsi_sw_tcp_session_destroy(struct iscsi_cls_session *cls_session) + if (WARN_ON_ONCE(session->leadconn)) + return; + ++ iscsi_session_remove(cls_session); ++ /* ++ * Our get_host_param needs to access the session, so remove the ++ * host from sysfs before freeing the session to make sure userspace ++ * is no longer accessing the callout. ++ */ ++ iscsi_host_remove(shost, false); ++ + iscsi_tcp_r2tpool_free(cls_session->dd_data); +- iscsi_session_teardown(cls_session); + +- iscsi_host_remove(shost, false); ++ iscsi_session_free(cls_session); + iscsi_host_free(shost); + } + +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index d95f4bcdeb2e..6e811d753cb1 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -3104,17 +3104,32 @@ iscsi_session_setup(struct iscsi_transport *iscsit, struct Scsi_Host *shost, + } + EXPORT_SYMBOL_GPL(iscsi_session_setup); + +-/** +- * iscsi_session_teardown - destroy session, host, and cls_session +- * @cls_session: iscsi session ++/* ++ * issi_session_remove - Remove session from iSCSI class. + */ +-void iscsi_session_teardown(struct iscsi_cls_session *cls_session) ++void iscsi_session_remove(struct iscsi_cls_session *cls_session) + { + struct iscsi_session *session = cls_session->dd_data; +- struct module *owner = cls_session->transport->owner; + struct Scsi_Host *shost = session->host; + + iscsi_remove_session(cls_session); ++ /* ++ * host removal only has to wait for its children to be removed from ++ * sysfs, and iscsi_tcp needs to do iscsi_host_remove before freeing ++ * the session, so drop the session count here. ++ */ ++ iscsi_host_dec_session_cnt(shost); ++} ++EXPORT_SYMBOL_GPL(iscsi_session_remove); ++ ++/** ++ * iscsi_session_free - Free iscsi session and it's resources ++ * @cls_session: iscsi session ++ */ ++void iscsi_session_free(struct iscsi_cls_session *cls_session) ++{ ++ struct iscsi_session *session = cls_session->dd_data; ++ struct module *owner = cls_session->transport->owner; + + iscsi_pool_free(&session->cmdpool); + kfree(session->password); +@@ -3132,10 +3147,19 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session) + kfree(session->discovery_parent_type); + + iscsi_free_session(cls_session); +- +- iscsi_host_dec_session_cnt(shost); + module_put(owner); + } ++EXPORT_SYMBOL_GPL(iscsi_session_free); ++ ++/** ++ * iscsi_session_teardown - destroy session and cls_session ++ * @cls_session: iscsi session ++ */ ++void iscsi_session_teardown(struct iscsi_cls_session *cls_session) ++{ ++ iscsi_session_remove(cls_session); ++ iscsi_session_free(cls_session); ++} + EXPORT_SYMBOL_GPL(iscsi_session_teardown); + + /** +diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h +index 654cc3918c94..7fb3cb787df4 100644 +--- a/include/scsi/libiscsi.h ++++ b/include/scsi/libiscsi.h +@@ -422,6 +422,8 @@ extern int iscsi_host_get_max_scsi_cmds(struct Scsi_Host *shost, + extern struct iscsi_cls_session * + iscsi_session_setup(struct iscsi_transport *, struct Scsi_Host *shost, + uint16_t, int, int, uint32_t, unsigned int); ++void iscsi_session_remove(struct iscsi_cls_session *cls_session); ++void iscsi_session_free(struct iscsi_cls_session *cls_session); + extern void iscsi_session_teardown(struct iscsi_cls_session *); + extern void iscsi_session_recovery_timedout(struct iscsi_cls_session *); + extern int iscsi_set_param(struct iscsi_cls_conn *cls_conn, +-- +2.39.0 + diff --git a/queue-6.1/scsi-revert-scsi-core-map-pq-1-pdt-other-values-to-s.patch b/queue-6.1/scsi-revert-scsi-core-map-pq-1-pdt-other-values-to-s.patch new file mode 100644 index 00000000000..c9aad15cf98 --- /dev/null +++ b/queue-6.1/scsi-revert-scsi-core-map-pq-1-pdt-other-values-to-s.patch @@ -0,0 +1,56 @@ +From d05614853f64dfe9d339e9c04602441d9de3b2e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 22:06:08 -0500 +Subject: scsi: Revert "scsi: core: map PQ=1, PDT=other values to + SCSI_SCAN_TARGET_PRESENT" + +From: Martin K. Petersen + +[ Upstream commit 15600159bcc6abbeae6b33a849bef90dca28b78f ] + +This reverts commit 948e922fc44611ee2de0c89583ca958cb5307d36. + +Not all targets that return PQ=1 and PDT=0 should be ignored. While +the SCSI spec is vague in this department, there appears to be a +critical mass of devices which rely on devices being accessible with +this combination of reported values. + +Fixes: 948e922fc446 ("scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT") +Link: https://lore.kernel.org/r/yq1lelrleqr.fsf@ca-mkp.ca.oracle.com +Acked-by: Bart Van Assche +Acked-by: Martin Wilck +Acked-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_scan.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 5d27f5196de6..d149b218715e 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -1233,8 +1233,7 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget, + * that no LUN is present, so don't add sdev in these cases. + * Two specific examples are: + * 1) NetApp targets: return PQ=1, PDT=0x1f +- * 2) IBM/2145 targets: return PQ=1, PDT=0 +- * 3) USB UFI: returns PDT=0x1f, with the PQ bits being "reserved" ++ * 2) USB UFI: returns PDT=0x1f, with the PQ bits being "reserved" + * in the UFI 1.0 spec (we cannot rely on reserved bits). + * + * References: +@@ -1248,8 +1247,8 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget, + * PDT=00h Direct-access device (floppy) + * PDT=1Fh none (no FDD connected to the requested logical unit) + */ +- if (((result[0] >> 5) == 1 || +- (starget->pdt_1f_for_no_lun && (result[0] & 0x1f) == 0x1f)) && ++ if (((result[0] >> 5) == 1 || starget->pdt_1f_for_no_lun) && ++ (result[0] & 0x1f) == 0x1f && + !scsi_is_wlun(lun)) { + SCSI_LOG_SCAN_BUS(3, sdev_printk(KERN_INFO, sdev, + "scsi scan: peripheral device type" +-- +2.39.0 + diff --git a/queue-6.1/scsi-target-core-fix-warning-on-rt-kernels.patch b/queue-6.1/scsi-target-core-fix-warning-on-rt-kernels.patch new file mode 100644 index 00000000000..1bb6b90ddc9 --- /dev/null +++ b/queue-6.1/scsi-target-core-fix-warning-on-rt-kernels.patch @@ -0,0 +1,40 @@ +From 6877d12142b25874811d740d5b0580a0433f8b8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 13:53:10 +0100 +Subject: scsi: target: core: Fix warning on RT kernels + +From: Maurizio Lombardi + +[ Upstream commit 84ed64b1a7a7fcd507598dee7708c1f225123711 ] + +Calling spin_lock_irqsave() does not disable the interrupts on realtime +kernels, remove the warning and replace assert_spin_locked() with +lockdep_assert_held(). + +Signed-off-by: Maurizio Lombardi +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20230110125310.55884-1-mlombard@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_tmr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c +index bac111456fa1..2b95b4550a63 100644 +--- a/drivers/target/target_core_tmr.c ++++ b/drivers/target/target_core_tmr.c +@@ -73,8 +73,8 @@ static bool __target_check_io_state(struct se_cmd *se_cmd, + { + struct se_session *sess = se_cmd->se_sess; + +- assert_spin_locked(&sess->sess_cmd_lock); +- WARN_ON_ONCE(!irqs_disabled()); ++ lockdep_assert_held(&sess->sess_cmd_lock); ++ + /* + * If command already reached CMD_T_COMPLETE state within + * target_complete_cmd() or CMD_T_FABRIC_STOP due to shutdown, +-- +2.39.0 + diff --git a/queue-6.1/sctp-do-not-check-hb_timer.expires-when-resetting-hb.patch b/queue-6.1/sctp-do-not-check-hb_timer.expires-when-resetting-hb.patch new file mode 100644 index 00000000000..9d7e546753c --- /dev/null +++ b/queue-6.1/sctp-do-not-check-hb_timer.expires-when-resetting-hb.patch @@ -0,0 +1,53 @@ +From 8f0edf16ddd6f7a40efc0d9a8242e68a633218e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 11:25:33 -0500 +Subject: sctp: do not check hb_timer.expires when resetting hb_timer + +From: Xin Long + +[ Upstream commit 8f35ae17ef565a605de5f409e04bcd49a55d7646 ] + +It tries to avoid the frequently hb_timer refresh in commit ba6f5e33bdbb +("sctp: avoid refreshing heartbeat timer too often"), and it only allows +mod_timer when the new expires is after hb_timer.expires. It means even +a much shorter interval for hb timer gets applied, it will have to wait +until the current hb timer to time out. + +In sctp_do_8_2_transport_strike(), when a transport enters PF state, it +expects to update the hb timer to resend a heartbeat every rto after +calling sctp_transport_reset_hb_timer(), which will not work as the +change mentioned above. + +The frequently hb_timer refresh was caused by sctp_transport_reset_timers() +called in sctp_outq_flush() and it was already removed in the commit above. +So we don't have to check hb_timer.expires when resetting hb_timer as it is +now not called very often. + +Fixes: ba6f5e33bdbb ("sctp: avoid refreshing heartbeat timer too often") +Signed-off-by: Xin Long +Acked-by: Marcelo Ricardo Leitner +Link: https://lore.kernel.org/r/d958c06985713ec84049a2d5664879802710179a.1675095933.git.lucien.xin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/transport.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/net/sctp/transport.c b/net/sctp/transport.c +index f8fd98784977..b3f1a91e9a07 100644 +--- a/net/sctp/transport.c ++++ b/net/sctp/transport.c +@@ -196,9 +196,7 @@ void sctp_transport_reset_hb_timer(struct sctp_transport *transport) + + /* When a data chunk is sent, reset the heartbeat interval. */ + expires = jiffies + sctp_transport_timeout(transport); +- if ((time_before(transport->hb_timer.expires, expires) || +- !timer_pending(&transport->hb_timer)) && +- !mod_timer(&transport->hb_timer, ++ if (!mod_timer(&transport->hb_timer, + expires + prandom_u32_max(transport->rto))) + sctp_transport_hold(transport); + } +-- +2.39.0 + diff --git a/queue-6.1/selftests-filesystems-grant-executable-permission-to.patch b/queue-6.1/selftests-filesystems-grant-executable-permission-to.patch new file mode 100644 index 00000000000..f794b736db5 --- /dev/null +++ b/queue-6.1/selftests-filesystems-grant-executable-permission-to.patch @@ -0,0 +1,37 @@ +From 69f32dbae8719c1e064d10d2da7d66e538d72ba1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 16:15:31 +0800 +Subject: selftests/filesystems: grant executable permission to + run_fat_tests.sh + +From: Pengfei Xu + +[ Upstream commit 24b5308cf5ee9f52dd22f3af78a5b0cdc9d35e72 ] + +When use tools/testing/selftests/kselftest_install.sh to make the +kselftest-list.txt under tools/testing/selftests/kselftest_install. + +Then use tools/testing/selftests/kselftest_install/run_kselftest.sh to run +all the kselftests in kselftest-list.txt, it will be blocked by case +"filesystems/fat: run_fat_tests.sh" with "Warning: file run_fat_tests.sh +is not executable", so grant executable permission to run_fat_tests.sh to +fix this issue. + +Link: https://lkml.kernel.org/r/dfdbba6df8a1ab34bb1e81cd8bd7ca3f9ed5c369.1673424747.git.pengfei.xu@intel.com +Fixes: dd7c9be330d8 ("selftests/filesystems: add a vfat RENAME_EXCHANGE test") +Signed-off-by: Pengfei Xu +Reviewed-by: Javier Martinez Canillas +Cc: Shuah Khan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/filesystems/fat/run_fat_tests.sh | 0 + 1 file changed, 0 insertions(+), 0 deletions(-) + mode change 100644 => 100755 tools/testing/selftests/filesystems/fat/run_fat_tests.sh + +diff --git a/tools/testing/selftests/filesystems/fat/run_fat_tests.sh b/tools/testing/selftests/filesystems/fat/run_fat_tests.sh +old mode 100644 +new mode 100755 +-- +2.39.0 + diff --git a/queue-6.1/selftests-net-udpgso_bench-fix-racing-bug-between-th.patch b/queue-6.1/selftests-net-udpgso_bench-fix-racing-bug-between-th.patch new file mode 100644 index 00000000000..d271ef8401a --- /dev/null +++ b/queue-6.1/selftests-net-udpgso_bench-fix-racing-bug-between-th.patch @@ -0,0 +1,80 @@ +From 65712ac83f2484850b1f5f4a1b10487c970df190 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 00:16:14 +0000 +Subject: selftests: net: udpgso_bench: Fix racing bug between the rx/tx + programs + +From: Andrei Gherzan + +[ Upstream commit dafe93b9ee21028d625dce347118b82659652eff ] + +"udpgro_bench.sh" invokes udpgso_bench_rx/udpgso_bench_tx programs +subsequently and while doing so, there is a chance that the rx one is not +ready to accept socket connections. This racing bug could fail the test +with at least one of the following: + +./udpgso_bench_tx: connect: Connection refused +./udpgso_bench_tx: sendmsg: Connection refused +./udpgso_bench_tx: write: Connection refused + +This change addresses this by making udpgro_bench.sh wait for the rx +program to be ready before firing off the tx one - up to a 10s timeout. + +Fixes: 3a687bef148d ("selftests: udp gso benchmark") +Signed-off-by: Andrei Gherzan +Cc: Paolo Abeni +Cc: Willem de Bruijn +Reviewed-by: Willem de Bruijn +Link: https://lore.kernel.org/r/20230201001612.515730-3-andrei.gherzan@canonical.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/udpgso_bench.sh | 24 +++++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/net/udpgso_bench.sh b/tools/testing/selftests/net/udpgso_bench.sh +index dc932fd65363..640bc43452fa 100755 +--- a/tools/testing/selftests/net/udpgso_bench.sh ++++ b/tools/testing/selftests/net/udpgso_bench.sh +@@ -7,6 +7,7 @@ readonly GREEN='\033[0;92m' + readonly YELLOW='\033[0;33m' + readonly RED='\033[0;31m' + readonly NC='\033[0m' # No Color ++readonly TESTPORT=8000 + + readonly KSFT_PASS=0 + readonly KSFT_FAIL=1 +@@ -56,11 +57,26 @@ trap wake_children EXIT + + run_one() { + local -r args=$@ ++ local nr_socks=0 ++ local i=0 ++ local -r timeout=10 ++ ++ ./udpgso_bench_rx -p "$TESTPORT" & ++ ./udpgso_bench_rx -p "$TESTPORT" -t & ++ ++ # Wait for the above test program to get ready to receive connections. ++ while [ "$i" -lt "$timeout" ]; do ++ nr_socks="$(ss -lnHi | grep -c "\*:${TESTPORT}")" ++ [ "$nr_socks" -eq 2 ] && break ++ i=$((i + 1)) ++ sleep 1 ++ done ++ if [ "$nr_socks" -ne 2 ]; then ++ echo "timed out while waiting for udpgso_bench_rx" ++ exit 1 ++ fi + +- ./udpgso_bench_rx & +- ./udpgso_bench_rx -t & +- +- ./udpgso_bench_tx ${args} ++ ./udpgso_bench_tx -p "$TESTPORT" ${args} + } + + run_in_netns() { +-- +2.39.0 + diff --git a/queue-6.1/selftests-net-udpgso_bench_rx-fix-used-uninitialized.patch b/queue-6.1/selftests-net-udpgso_bench_rx-fix-used-uninitialized.patch new file mode 100644 index 00000000000..21eeb41c4af --- /dev/null +++ b/queue-6.1/selftests-net-udpgso_bench_rx-fix-used-uninitialized.patch @@ -0,0 +1,51 @@ +From 061298ff4d2b806c98677e87b304a2788311a451 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 00:16:10 +0000 +Subject: selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler + warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andrei Gherzan + +[ Upstream commit c03c80e3a03ffb4f790901d60797e9810539d946 ] + +This change fixes the following compiler warning: + +/usr/include/x86_64-linux-gnu/bits/error.h:40:5: warning: ‘gso_size’ may +be used uninitialized [-Wmaybe-uninitialized] + 40 | __error_noreturn (__status, __errnum, __format, + __va_arg_pack ()); + | + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + udpgso_bench_rx.c: In function ‘main’: + udpgso_bench_rx.c:253:23: note: ‘gso_size’ was declared here + 253 | int ret, len, gso_size, budget = 256; + +Fixes: 3327a9c46352 ("selftests: add functionals test for UDP GRO") +Signed-off-by: Andrei Gherzan +Reviewed-by: Willem de Bruijn +Link: https://lore.kernel.org/r/20230201001612.515730-1-andrei.gherzan@canonical.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/udpgso_bench_rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c +index 6a193425c367..d0895bd1933f 100644 +--- a/tools/testing/selftests/net/udpgso_bench_rx.c ++++ b/tools/testing/selftests/net/udpgso_bench_rx.c +@@ -250,7 +250,7 @@ static int recv_msg(int fd, char *buf, int len, int *gso_size) + static void do_flush_udp(int fd) + { + static char rbuf[ETH_MAX_MTU]; +- int ret, len, gso_size, budget = 256; ++ int ret, len, gso_size = 0, budget = 256; + + len = cfg_read_all ? sizeof(rbuf) : 0; + while (budget--) { +-- +2.39.0 + diff --git a/queue-6.1/selftests-net-udpgso_bench_rx-tx-stop-when-wrong-cli.patch b/queue-6.1/selftests-net-udpgso_bench_rx-tx-stop-when-wrong-cli.patch new file mode 100644 index 00000000000..a028b149763 --- /dev/null +++ b/queue-6.1/selftests-net-udpgso_bench_rx-tx-stop-when-wrong-cli.patch @@ -0,0 +1,55 @@ +From 323d0f030372b74127929dc4d6c78ffe1001f347 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 00:16:12 +0000 +Subject: selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are + provided + +From: Andrei Gherzan + +[ Upstream commit db9b47ee9f5f375ab0c5daeb20321c75b4fa657d ] + +Leaving unrecognized arguments buried in the output, can easily hide a +CLI/script typo. Avoid this by exiting when wrong arguments are provided to +the udpgso_bench test programs. + +Fixes: 3a687bef148d ("selftests: udp gso benchmark") +Signed-off-by: Andrei Gherzan +Cc: Willem de Bruijn +Reviewed-by: Willem de Bruijn +Link: https://lore.kernel.org/r/20230201001612.515730-2-andrei.gherzan@canonical.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/udpgso_bench_rx.c | 2 ++ + tools/testing/selftests/net/udpgso_bench_tx.c | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c +index d0895bd1933f..4058c7451e70 100644 +--- a/tools/testing/selftests/net/udpgso_bench_rx.c ++++ b/tools/testing/selftests/net/udpgso_bench_rx.c +@@ -336,6 +336,8 @@ static void parse_opts(int argc, char **argv) + cfg_verify = true; + cfg_read_all = true; + break; ++ default: ++ exit(1); + } + } + +diff --git a/tools/testing/selftests/net/udpgso_bench_tx.c b/tools/testing/selftests/net/udpgso_bench_tx.c +index f1fdaa270291..b47b5c32039f 100644 +--- a/tools/testing/selftests/net/udpgso_bench_tx.c ++++ b/tools/testing/selftests/net/udpgso_bench_tx.c +@@ -490,6 +490,8 @@ static void parse_opts(int argc, char **argv) + case 'z': + cfg_zerocopy = true; + break; ++ default: ++ exit(1); + } + } + +-- +2.39.0 + diff --git a/queue-6.1/selftests-net-udpgso_bench_tx-cater-for-pending-data.patch b/queue-6.1/selftests-net-udpgso_bench_tx-cater-for-pending-data.patch new file mode 100644 index 00000000000..3547dffaf8e --- /dev/null +++ b/queue-6.1/selftests-net-udpgso_bench_tx-cater-for-pending-data.patch @@ -0,0 +1,135 @@ +From 66b7e00df43adf2f281de4af990779e5b61ce040 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 00:16:16 +0000 +Subject: selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy + benchmarking + +From: Andrei Gherzan + +[ Upstream commit 329c9cd769c2e306957df031efff656c40922c76 ] + +The test tool can check that the zerocopy number of completions value is +valid taking into consideration the number of datagram send calls. This can +catch the system into a state where the datagrams are still in the system +(for example in a qdisk, waiting for the network interface to return a +completion notification, etc). + +This change adds a retry logic of computing the number of completions up to +a configurable (via CLI) timeout (default: 2 seconds). + +Fixes: 79ebc3c26010 ("net/udpgso_bench_tx: options to exercise TX CMSG") +Signed-off-by: Andrei Gherzan +Cc: Willem de Bruijn +Cc: Paolo Abeni +Reviewed-by: Willem de Bruijn +Link: https://lore.kernel.org/r/20230201001612.515730-4-andrei.gherzan@canonical.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/udpgso_bench_tx.c | 34 +++++++++++++++---- + 1 file changed, 27 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/net/udpgso_bench_tx.c b/tools/testing/selftests/net/udpgso_bench_tx.c +index b47b5c32039f..477392715a9a 100644 +--- a/tools/testing/selftests/net/udpgso_bench_tx.c ++++ b/tools/testing/selftests/net/udpgso_bench_tx.c +@@ -62,6 +62,7 @@ static int cfg_payload_len = (1472 * 42); + static int cfg_port = 8000; + static int cfg_runtime_ms = -1; + static bool cfg_poll; ++static int cfg_poll_loop_timeout_ms = 2000; + static bool cfg_segment; + static bool cfg_sendmmsg; + static bool cfg_tcp; +@@ -235,16 +236,17 @@ static void flush_errqueue_recv(int fd) + } + } + +-static void flush_errqueue(int fd, const bool do_poll) ++static void flush_errqueue(int fd, const bool do_poll, ++ unsigned long poll_timeout, const bool poll_err) + { + if (do_poll) { + struct pollfd fds = {0}; + int ret; + + fds.fd = fd; +- ret = poll(&fds, 1, 500); ++ ret = poll(&fds, 1, poll_timeout); + if (ret == 0) { +- if (cfg_verbose) ++ if ((cfg_verbose) && (poll_err)) + fprintf(stderr, "poll timeout\n"); + } else if (ret < 0) { + error(1, errno, "poll"); +@@ -254,6 +256,20 @@ static void flush_errqueue(int fd, const bool do_poll) + flush_errqueue_recv(fd); + } + ++static void flush_errqueue_retry(int fd, unsigned long num_sends) ++{ ++ unsigned long tnow, tstop; ++ bool first_try = true; ++ ++ tnow = gettimeofday_ms(); ++ tstop = tnow + cfg_poll_loop_timeout_ms; ++ do { ++ flush_errqueue(fd, true, tstop - tnow, first_try); ++ first_try = false; ++ tnow = gettimeofday_ms(); ++ } while ((stat_zcopies != num_sends) && (tnow < tstop)); ++} ++ + static int send_tcp(int fd, char *data) + { + int ret, done = 0, count = 0; +@@ -413,7 +429,8 @@ static int send_udp_segment(int fd, char *data) + + static void usage(const char *filepath) + { +- error(1, 0, "Usage: %s [-46acmHPtTuvz] [-C cpu] [-D dst ip] [-l secs] [-M messagenr] [-p port] [-s sendsize] [-S gsosize]", ++ error(1, 0, "Usage: %s [-46acmHPtTuvz] [-C cpu] [-D dst ip] [-l secs] " ++ "[-L secs] [-M messagenr] [-p port] [-s sendsize] [-S gsosize]", + filepath); + } + +@@ -423,7 +440,7 @@ static void parse_opts(int argc, char **argv) + int max_len, hdrlen; + int c; + +- while ((c = getopt(argc, argv, "46acC:D:Hl:mM:p:s:PS:tTuvz")) != -1) { ++ while ((c = getopt(argc, argv, "46acC:D:Hl:L:mM:p:s:PS:tTuvz")) != -1) { + switch (c) { + case '4': + if (cfg_family != PF_UNSPEC) +@@ -452,6 +469,9 @@ static void parse_opts(int argc, char **argv) + case 'l': + cfg_runtime_ms = strtoul(optarg, NULL, 10) * 1000; + break; ++ case 'L': ++ cfg_poll_loop_timeout_ms = strtoul(optarg, NULL, 10) * 1000; ++ break; + case 'm': + cfg_sendmmsg = true; + break; +@@ -679,7 +699,7 @@ int main(int argc, char **argv) + num_sends += send_udp(fd, buf[i]); + num_msgs++; + if ((cfg_zerocopy && ((num_msgs & 0xF) == 0)) || cfg_tx_tstamp) +- flush_errqueue(fd, cfg_poll); ++ flush_errqueue(fd, cfg_poll, 500, true); + + if (cfg_msg_nr && num_msgs >= cfg_msg_nr) + break; +@@ -698,7 +718,7 @@ int main(int argc, char **argv) + } while (!interrupted && (cfg_runtime_ms == -1 || tnow < tstop)); + + if (cfg_zerocopy || cfg_tx_tstamp) +- flush_errqueue(fd, true); ++ flush_errqueue_retry(fd, num_sends); + + if (close(fd)) + error(1, errno, "close"); +-- +2.39.0 + diff --git a/queue-6.1/selftests-vm-remove-__use_gnu-in-hugetlb-madvise.c.patch b/queue-6.1/selftests-vm-remove-__use_gnu-in-hugetlb-madvise.c.patch new file mode 100644 index 00000000000..a9ce0881c74 --- /dev/null +++ b/queue-6.1/selftests-vm-remove-__use_gnu-in-hugetlb-madvise.c.patch @@ -0,0 +1,54 @@ +From 30bd9afe6d55a72cec45bf4a4aa710c601297d6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jan 2023 11:33:07 -0500 +Subject: selftests/vm: remove __USE_GNU in hugetlb-madvise.c + +From: Peter Xu + +[ Upstream commit 0ca2c535f5a07f01118a6a70bfab78576e02fcae ] + +__USE_GNU should be an internal macro only used inside glibc. Either +memfd_create() or fallocate() requires _GNU_SOURCE per man page, where +__USE_GNU will further be defined by glibc headers include/features.h: + + #ifdef _GNU_SOURCE + # define __USE_GNU 1 + #endif + +This fixes: + + >> hugetlb-madvise.c:20: warning: "__USE_GNU" redefined + 20 | #define __USE_GNU + | + In file included from /usr/include/x86_64-linux-gnu/bits/libc-header-start.h:33, + from /usr/include/stdlib.h:26, + from hugetlb-madvise.c:16: + /usr/include/features.h:407: note: this is the location of the previous definition + 407 | # define __USE_GNU 1 + | + +Link: https://lkml.kernel.org/r/Y8V9z+z6Tk7NetI3@x1n +Signed-off-by: Peter Xu +Reported-by: kernel test robot +Cc: Mike Kravetz +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vm/hugetlb-madvise.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/tools/testing/selftests/vm/hugetlb-madvise.c b/tools/testing/selftests/vm/hugetlb-madvise.c +index 3c9943131881..b3f01f1f7a60 100644 +--- a/tools/testing/selftests/vm/hugetlb-madvise.c ++++ b/tools/testing/selftests/vm/hugetlb-madvise.c +@@ -16,7 +16,6 @@ + #include + #include + #include +-#define __USE_GNU + #include + + #define USAGE "USAGE: %s \n" +-- +2.39.0 + diff --git a/queue-6.1/series b/queue-6.1/series index e8e31cc7adc..7328e1678e0 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -1 +1,110 @@ firewire-fix-memory-leak-for-payload-of-request-subaction-to-iec-61883-1-fcp-region.patch +bus-sunxi-rsb-fix-error-handling-in-sunxi_rsb_init.patch +arm64-dts-imx8m-venice-remove-incorrect-uart-has-rts.patch +arm64-dts-freescale-imx8dxl-fix-sc_pwrkey-s-property.patch +asoc-amd-acp-es8336-drop-reference-count-of-acpi-dev.patch +asoc-intel-bytcht_es8316-drop-reference-count-of-acp.patch +asoc-intel-bytcr_rt5651-drop-reference-count-of-acpi.patch +asoc-intel-bytcr_rt5640-drop-reference-count-of-acpi.patch +asoc-intel-bytcr_wm5102-drop-reference-count-of-acpi.patch +asoc-intel-sof_es8336-drop-reference-count-of-acpi-d.patch +asoc-intel-avs-implement-pci-shutdown.patch +selftests-vm-remove-__use_gnu-in-hugetlb-madvise.c.patch +bpf-fix-off-by-one-error-in-bpf_mem_cache_idx.patch +bpf-fix-a-possible-task-gone-issue-with-bpf_send_sig.patch +alsa-hda-via-avoid-potential-array-out-of-bound-in-a.patch +bpf-fix-to-preserve-reg-parent-live-fields-when-copy.patch +selftests-filesystems-grant-executable-permission-to.patch +asoc-sof-ipc4-mtrace-prevent-underflow-in-sof_ipc4_p.patch +bpf-add-missing-btf_put-to-register_btf_id_dtor_kfun.patch +media-v4l2-ctrls-api.c-move-ctrl-is_new-1-to-the-cor.patch +bpf-sockmap-check-for-any-of-tcp_bpf_prots-when-clon.patch +arm64-dts-imx8mm-fix-pad-control-for-uart1_dte_rx.patch +arm64-dts-imx8mm-verdin-do-not-power-down-eth-phy.patch +drm-vc4-hdmi-make-cec-adapter-name-unique.patch +drm-ssd130x-init-display-before-the-ssd130x_display_.patch +scsi-revert-scsi-core-map-pq-1-pdt-other-values-to-s.patch +bpf-fix-the-kernel-crash-caused-by-bpf_setsockopt.patch +alsa-memalloc-workaround-for-xen-pv.patch +vhost-net-clear-the-pending-messages-when-the-backen.patch +copy_oldmem_kernel-write-is-data-source-not-destinat.patch +write-is-data-source-not-destination.patch +read-is-data-destination-not-source.patch +zcore-write-is-data-source-not-destination.patch +memcpy_real-write-is-data-source-not-destination.patch +fix-iov_iter_bvec-direction-argument.patch +fix-direction-argument-of-iov_iter_-init-bvec.patch +fix-direction-argument-of-iov_iter_kvec.patch +use-less-confusing-names-for-iov_iter-direction-init.patch +vhost-scsi-unbreak-any-layout-for-response.patch +ice-prevent-set_channel-from-changing-queues-while-r.patch +qede-execute-xdp_do_flush-before-napi_complete_done.patch +virtio-net-execute-xdp_do_flush-before-napi_complete.patch +dpaa_eth-execute-xdp_do_flush-before-napi_complete_d.patch +dpaa2-eth-execute-xdp_do_flush-before-napi_complete_.patch +skb-do-mix-page-pool-and-page-referenced-frags-in-gr.patch +sfc-correctly-advertise-tunneled-ipv6-segmentation.patch +net-phy-dp83822-fix-null-pointer-access-on-dp83825-d.patch +net-wwan-t7xx-fix-runtime-pm-initialization.patch +block-bfq-replace-0-1-with-false-true-in-bic-apis.patch +block-bfq-fix-uaf-for-bfqq-in-bic_set_bfqq.patch +netrom-fix-use-after-free-caused-by-accept-on-alread.patch +fscache-use-wait_on_bit-to-wait-for-the-freeing-of-r.patch +platform-x86-amd-pmf-update-to-auto-mode-limits-only.patch +platform-x86-amd-pmf-add-helper-routine-to-update-sp.patch +platform-x86-amd-pmf-fix-to-update-sps-default-pprof.patch +platform-x86-amd-pmf-add-helper-routine-to-check-ppr.patch +platform-x86-amd-pmf-fix-to-update-sps-thermals-when.patch +platform-x86-amd-pmf-ensure-mutexes-are-initialized-.patch +platform-x86-thinkpad_acpi-fix-thinklight-led-bright.patch +drm-i915-guc-fix-locking-when-searching-for-a-hung-r.patch +drm-i915-fix-request-ref-counting-during-error-captu.patch +drm-i915-fix-up-locking-around-dumping-requests-list.patch +drm-i915-adlp-fix-typo-for-reference-clock.patch +net-tls-tls_is_tx_ready-checked-list_entry.patch +alsa-firewire-motu-fix-unreleased-lock-warning-in-hw.patch +netfilter-br_netfilter-disable-sabotage_in-hook-afte.patch +block-ublk-extending-queue_size-to-fix-overflow.patch +kunit-fix-kunit_test_init_section_suites.patch +squashfs-harden-sanity-check-in-squashfs_read_xattr_.patch +maple_tree-should-get-pivots-boundary-by-type.patch +sctp-do-not-check-hb_timer.expires-when-resetting-hb.patch +net-phy-meson-gxl-add-generic-dummy-stubs-for-mmd-re.patch +drm-panel-boe-tv101wum-nl6-ensure-dsi-writes-succeed.patch +ip-ip6_gre-fix-changing-addr-gen-mode-not-generating.patch +ip-ip6_gre-fix-non-point-to-point-tunnel-not-generat.patch +riscv-kprobe-fixup-kernel-panic-when-probing-an-ille.patch +igc-return-an-error-if-the-mac-type-is-unknown-in-ig.patch +octeontx2-af-fix-devlink-unregister.patch +can-j1939-fix-errant-warn_on_once-in-j1939_session_d.patch +can-raw-fix-can-fd-frame-transmissions-over-can-xl-d.patch +can-mcp251xfd-mcp251xfd_ring_set_ringparam-assign-mi.patch +ata-libata-fix-sata_down_spd_limit-when-no-link-spee.patch +selftests-net-udpgso_bench_rx-fix-used-uninitialized.patch +selftests-net-udpgso_bench_rx-tx-stop-when-wrong-cli.patch +selftests-net-udpgso_bench-fix-racing-bug-between-th.patch +selftests-net-udpgso_bench_tx-cater-for-pending-data.patch +virtio-net-keep-stop-to-follow-mirror-sequence-of-op.patch +net-openvswitch-fix-flow-memory-leak-in-ovs_flow_cmd.patch +efi-fix-potential-null-deref-in-efi_mem_reserve_pers.patch +rtc-sunplus-fix-format-string-for-printing-resource.patch +certs-fix-build-error-when-pkcs-11-uri-contains-semi.patch +kbuild-modinst-fix-build-error-when-config_module_si.patch +i2c-designware-pci-add-new-pci-ids-for-amd-navi-gpu.patch +i2c-mxs-suppress-probe-deferral-error-message.patch +scsi-target-core-fix-warning-on-rt-kernels.patch +x86-aperfmperf-erase-stale-arch_freq_scale-values-wh.patch +perf-x86-intel-add-emerald-rapids.patch +perf-x86-intel-cstate-add-emerald-rapids.patch +scsi-iscsi_tcp-fix-uaf-during-logout-when-accessing-.patch +scsi-iscsi_tcp-fix-uaf-during-login-when-accessing-t.patch +i2c-rk3x-fix-a-bunch-of-kernel-doc-warnings.patch +revert-gfs2-stop-using-generic_writepages-in-gfs2_ai.patch +x86-build-move-mindirect-branch-cs-prefix-out-of-gcc.patch +platform-x86-dell-wmi-add-a-keymap-for-key_mute-in-t.patch +platform-x86-hp-wmi-handle-omen-key-event.patch +platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch +platform-x86-amd-pmc-disable-irq1-wakeup-for-rn-czn.patch +net-x25-fix-to-not-accept-on-connected-socket.patch +drm-amd-display-fix-timing-not-changning-when-freesy.patch +bcache-silence-memcpy-run-time-false-positive-warnin.patch diff --git a/queue-6.1/sfc-correctly-advertise-tunneled-ipv6-segmentation.patch b/queue-6.1/sfc-correctly-advertise-tunneled-ipv6-segmentation.patch new file mode 100644 index 00000000000..7cb60ef0035 --- /dev/null +++ b/queue-6.1/sfc-correctly-advertise-tunneled-ipv6-segmentation.patch @@ -0,0 +1,53 @@ +From 2acb1140dd8a6d81d7b2434aac8b1d0027754604 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 15:35:13 +0100 +Subject: sfc: correctly advertise tunneled IPv6 segmentation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit ffffd2454a7a1bc9f7242b12c4cc0b05c12692b4 ] + +Recent sfc NICs are TSO capable for some tunnel protocols. However, it +was not working properly because the feature was not advertised in +hw_enc_features, but in hw_features only. + +Setting up a GENEVE tunnel and using iperf3 to send IPv4 and IPv6 traffic +to the tunnel show, with tcpdump, that the IPv4 packets still had ~64k +size but the IPv6 ones had only ~1500 bytes (they had been segmented by +software, not offloaded). With this patch segmentation is offloaded as +expected and the traffic is correctly received at the other end. + +Fixes: 24b2c3751aa3 ("sfc: advertise encapsulated offloads on EF10") +Reported-by: Tianhao Zhao +Signed-off-by: Íñigo Huguet +Acked-by: Martin Habets +Link: https://lore.kernel.org/r/20230125143513.25841-1-ihuguet@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/efx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c +index 0556542d7a6b..3a86f1213a05 100644 +--- a/drivers/net/ethernet/sfc/efx.c ++++ b/drivers/net/ethernet/sfc/efx.c +@@ -1003,8 +1003,11 @@ static int efx_pci_probe_post_io(struct efx_nic *efx) + /* Determine netdevice features */ + net_dev->features |= (efx->type->offload_features | NETIF_F_SG | + NETIF_F_TSO | NETIF_F_RXCSUM | NETIF_F_RXALL); +- if (efx->type->offload_features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM)) ++ if (efx->type->offload_features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM)) { + net_dev->features |= NETIF_F_TSO6; ++ if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) ++ net_dev->hw_enc_features |= NETIF_F_TSO6; ++ } + /* Check whether device supports TSO */ + if (!efx->type->tso_versions || !efx->type->tso_versions(efx)) + net_dev->features &= ~NETIF_F_ALL_TSO; +-- +2.39.0 + diff --git a/queue-6.1/skb-do-mix-page-pool-and-page-referenced-frags-in-gr.patch b/queue-6.1/skb-do-mix-page-pool-and-page-referenced-frags-in-gr.patch new file mode 100644 index 00000000000..0790f2f87c9 --- /dev/null +++ b/queue-6.1/skb-do-mix-page-pool-and-page-referenced-frags-in-gr.patch @@ -0,0 +1,52 @@ +From 92eb647db502bb1cc1cf45ab6172793cfe270067 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 11:06:59 -0800 +Subject: skb: Do mix page pool and page referenced frags in GRO + +From: Alexander Duyck + +[ Upstream commit 7d2c89b325874a35564db5630a459966afab04cc ] + +GSO should not merge page pool recycled frames with standard reference +counted frames. Traditionally this didn't occur, at least not often. +However as we start looking at adding support for wireless adapters there +becomes the potential to mix the two due to A-MSDU repartitioning frames in +the receive path. There are possibly other places where this may have +occurred however I suspect they must be few and far between as we have not +seen this issue until now. + +Fixes: 53e0961da1c7 ("page_pool: add frag page recycling support in page pool") +Reported-by: Felix Fietkau +Signed-off-by: Alexander Duyck +Acked-by: Ilias Apalodimas +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/167475990764.1934330.11960904198087757911.stgit@localhost.localdomain +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/gro.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/net/core/gro.c b/net/core/gro.c +index 1b4abfb9a7a1..352f966cb1da 100644 +--- a/net/core/gro.c ++++ b/net/core/gro.c +@@ -162,6 +162,15 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb) + struct sk_buff *lp; + int segs; + ++ /* Do not splice page pool based packets w/ non-page pool ++ * packets. This can result in reference count issues as page ++ * pool pages will not decrement the reference count and will ++ * instead be immediately returned to the pool or have frag ++ * count decremented. ++ */ ++ if (p->pp_recycle != skb->pp_recycle) ++ return -ETOOMANYREFS; ++ + /* pairs with WRITE_ONCE() in netif_set_gro_max_size() */ + gro_max_size = READ_ONCE(p->dev->gro_max_size); + +-- +2.39.0 + diff --git a/queue-6.1/squashfs-harden-sanity-check-in-squashfs_read_xattr_.patch b/queue-6.1/squashfs-harden-sanity-check-in-squashfs_read_xattr_.patch new file mode 100644 index 00000000000..ec7900faf66 --- /dev/null +++ b/queue-6.1/squashfs-harden-sanity-check-in-squashfs_read_xattr_.patch @@ -0,0 +1,45 @@ +From 32066f52db63f47e43b93bcb663882a7e9a5ef4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 13:52:26 +0300 +Subject: squashfs: harden sanity check in squashfs_read_xattr_id_table + +From: Fedor Pchelkin + +[ Upstream commit 72e544b1b28325fe78a4687b980871a7e4101f76 ] + +While mounting a corrupted filesystem, a signed integer '*xattr_ids' can +become less than zero. This leads to the incorrect computation of 'len' +and 'indexes' values which can cause null-ptr-deref in copy_bio_to_actor() +or out-of-bounds accesses in the next sanity checks inside +squashfs_read_xattr_id_table(). + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Link: https://lkml.kernel.org/r/20230117105226.329303-2-pchelkin@ispras.ru +Fixes: 506220d2ba21 ("squashfs: add more sanity checks in xattr id lookup") +Reported-by: +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Cc: Phillip Lougher +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/squashfs/xattr_id.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/squashfs/xattr_id.c b/fs/squashfs/xattr_id.c +index 087cab8c78f4..f6d78cbc3e74 100644 +--- a/fs/squashfs/xattr_id.c ++++ b/fs/squashfs/xattr_id.c +@@ -76,7 +76,7 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start, + /* Sanity check values */ + + /* there is always at least one xattr id */ +- if (*xattr_ids == 0) ++ if (*xattr_ids <= 0) + return ERR_PTR(-EINVAL); + + len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids); +-- +2.39.0 + diff --git a/queue-6.1/use-less-confusing-names-for-iov_iter-direction-init.patch b/queue-6.1/use-less-confusing-names-for-iov_iter-direction-init.patch new file mode 100644 index 00000000000..5f762cb72b6 --- /dev/null +++ b/queue-6.1/use-less-confusing-names-for-iov_iter-direction-init.patch @@ -0,0 +1,2165 @@ +From f656e023949336b0f70921c14f9a12548fe8a59a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 20:25:47 -0400 +Subject: use less confusing names for iov_iter direction initializers + +From: Al Viro + +[ Upstream commit de4eda9de2d957ef2d6a8365a01e26a435e958cb ] + +READ/WRITE proved to be actively confusing - the meanings are +"data destination, as used with read(2)" and "data source, as +used with write(2)", but people keep interpreting those as +"we read data from it" and "we write data to it", i.e. exactly +the wrong way. + +Call them ITER_DEST and ITER_SOURCE - at least that is harder +to misinterpret... + +Signed-off-by: Al Viro +Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response") +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/crash_dump.c | 2 +- + arch/s390/mm/maccess.c | 2 +- + arch/x86/kernel/cpu/microcode/intel.c | 2 +- + arch/x86/kernel/crash_dump_64.c | 2 +- + crypto/testmgr.c | 4 ++-- + drivers/acpi/pfr_update.c | 2 +- + drivers/block/drbd/drbd_main.c | 2 +- + drivers/block/drbd/drbd_receiver.c | 2 +- + drivers/block/loop.c | 12 ++++++------ + drivers/block/nbd.c | 10 +++++----- + drivers/char/random.c | 4 ++-- + drivers/fsi/fsi-sbefifo.c | 6 +++--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- + drivers/isdn/mISDN/l1oip_core.c | 2 +- + drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +++--- + drivers/net/ppp/ppp_generic.c | 2 +- + drivers/nvme/host/tcp.c | 4 ++-- + drivers/nvme/target/io-cmd-file.c | 4 ++-- + drivers/nvme/target/tcp.c | 2 +- + drivers/s390/char/zcore.c | 2 +- + drivers/scsi/sg.c | 2 +- + drivers/target/iscsi/iscsi_target_util.c | 4 ++-- + drivers/target/target_core_file.c | 2 +- + drivers/usb/usbip/usbip_common.c | 2 +- + drivers/vhost/net.c | 6 +++--- + drivers/vhost/scsi.c | 10 +++++----- + drivers/vhost/vhost.c | 6 +++--- + drivers/vhost/vringh.c | 4 ++-- + drivers/vhost/vsock.c | 4 ++-- + drivers/xen/pvcalls-back.c | 8 ++++---- + fs/9p/vfs_addr.c | 4 ++-- + fs/9p/vfs_dir.c | 2 +- + fs/9p/xattr.c | 4 ++-- + fs/afs/cmservice.c | 2 +- + fs/afs/dir.c | 2 +- + fs/afs/file.c | 4 ++-- + fs/afs/internal.h | 4 ++-- + fs/afs/rxrpc.c | 10 +++++----- + fs/afs/write.c | 4 ++-- + fs/aio.c | 4 ++-- + fs/btrfs/ioctl.c | 4 ++-- + fs/ceph/addr.c | 4 ++-- + fs/ceph/file.c | 4 ++-- + fs/cifs/connect.c | 6 +++--- + fs/cifs/file.c | 4 ++-- + fs/cifs/fscache.c | 4 ++-- + fs/cifs/smb2ops.c | 4 ++-- + fs/cifs/transport.c | 6 +++--- + fs/coredump.c | 2 +- + fs/erofs/fscache.c | 6 +++--- + fs/fscache/io.c | 2 +- + fs/fuse/ioctl.c | 4 ++-- + fs/netfs/io.c | 6 +++--- + fs/nfs/fscache.c | 4 ++-- + fs/nfsd/vfs.c | 4 ++-- + fs/ocfs2/cluster/tcp.c | 2 +- + fs/orangefs/inode.c | 8 ++++---- + fs/proc/vmcore.c | 6 +++--- + fs/read_write.c | 12 ++++++------ + fs/seq_file.c | 2 +- + fs/splice.c | 10 +++++----- + include/linux/uio.h | 3 +++ + io_uring/net.c | 14 +++++++------- + io_uring/rw.c | 10 +++++----- + kernel/trace/trace_events_user.c | 2 +- + mm/madvise.c | 2 +- + mm/page_io.c | 4 ++-- + mm/process_vm_access.c | 2 +- + net/9p/client.c | 2 +- + net/bluetooth/6lowpan.c | 2 +- + net/bluetooth/a2mp.c | 2 +- + net/bluetooth/smp.c | 2 +- + net/ceph/messenger_v1.c | 4 ++-- + net/ceph/messenger_v2.c | 14 +++++++------- + net/compat.c | 3 ++- + net/ipv4/tcp.c | 4 ++-- + net/netfilter/ipvs/ip_vs_sync.c | 2 +- + net/smc/smc_clc.c | 6 +++--- + net/smc/smc_tx.c | 2 +- + net/socket.c | 12 ++++++------ + net/sunrpc/socklib.c | 6 +++--- + net/sunrpc/svcsock.c | 4 ++-- + net/sunrpc/xprtsock.c | 6 +++--- + net/tipc/topsrv.c | 2 +- + net/tls/tls_device.c | 4 ++-- + net/xfrm/espintcp.c | 2 +- + security/keys/keyctl.c | 4 ++-- + 87 files changed, 195 insertions(+), 191 deletions(-) + +diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c +index a19a2763e8d4..c13b1455ec8c 100644 +--- a/arch/s390/kernel/crash_dump.c ++++ b/arch/s390/kernel/crash_dump.c +@@ -153,7 +153,7 @@ int copy_oldmem_kernel(void *dst, unsigned long src, size_t count) + + kvec.iov_base = dst; + kvec.iov_len = count; +- iov_iter_kvec(&iter, READ, &kvec, 1, count); ++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, count); + if (copy_oldmem_iter(&iter, src, count) < count) + return -EFAULT; + return 0; +diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c +index 753b006c8ea5..4824d1cd33d8 100644 +--- a/arch/s390/mm/maccess.c ++++ b/arch/s390/mm/maccess.c +@@ -128,7 +128,7 @@ int memcpy_real(void *dest, unsigned long src, size_t count) + + kvec.iov_base = dest; + kvec.iov_len = count; +- iov_iter_kvec(&iter, READ, &kvec, 1, count); ++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, count); + if (memcpy_real_iter(&iter, src, count) < count) + return -EFAULT; + return 0; +diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c +index 048e38ec99e7..1def66118b03 100644 +--- a/arch/x86/kernel/cpu/microcode/intel.c ++++ b/arch/x86/kernel/cpu/microcode/intel.c +@@ -902,7 +902,7 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device, + + kvec.iov_base = (void *)firmware->data; + kvec.iov_len = firmware->size; +- iov_iter_kvec(&iter, WRITE, &kvec, 1, firmware->size); ++ iov_iter_kvec(&iter, ITER_SOURCE, &kvec, 1, firmware->size); + ret = generic_load_microcode(cpu, &iter); + + release_firmware(firmware); +diff --git a/arch/x86/kernel/crash_dump_64.c b/arch/x86/kernel/crash_dump_64.c +index e75bc2f217ff..32d710f7eb84 100644 +--- a/arch/x86/kernel/crash_dump_64.c ++++ b/arch/x86/kernel/crash_dump_64.c +@@ -57,7 +57,7 @@ ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos) + struct kvec kvec = { .iov_base = buf, .iov_len = count }; + struct iov_iter iter; + +- iov_iter_kvec(&iter, READ, &kvec, 1, count); ++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, count); + + return read_from_oldmem(&iter, count, ppos, + cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT)); +diff --git a/crypto/testmgr.c b/crypto/testmgr.c +index bcd059caa1c8..814d2dc87d7e 100644 +--- a/crypto/testmgr.c ++++ b/crypto/testmgr.c +@@ -766,7 +766,7 @@ static int build_cipher_test_sglists(struct cipher_test_sglists *tsgls, + struct iov_iter input; + int err; + +- iov_iter_kvec(&input, WRITE, inputs, nr_inputs, src_total_len); ++ iov_iter_kvec(&input, ITER_SOURCE, inputs, nr_inputs, src_total_len); + err = build_test_sglist(&tsgls->src, cfg->src_divs, alignmask, + cfg->inplace_mode != OUT_OF_PLACE ? + max(dst_total_len, src_total_len) : +@@ -1180,7 +1180,7 @@ static int build_hash_sglist(struct test_sglist *tsgl, + + kv.iov_base = (void *)vec->plaintext; + kv.iov_len = vec->psize; +- iov_iter_kvec(&input, WRITE, &kv, 1, vec->psize); ++ iov_iter_kvec(&input, ITER_SOURCE, &kv, 1, vec->psize); + return build_test_sglist(tsgl, cfg->src_divs, alignmask, vec->psize, + &input, divs); + } +diff --git a/drivers/acpi/pfr_update.c b/drivers/acpi/pfr_update.c +index 9d2bdc13253a..98267f163e2b 100644 +--- a/drivers/acpi/pfr_update.c ++++ b/drivers/acpi/pfr_update.c +@@ -455,7 +455,7 @@ static ssize_t pfru_write(struct file *file, const char __user *buf, + + iov.iov_base = (void __user *)buf; + iov.iov_len = len; +- iov_iter_init(&iter, WRITE, &iov, 1, len); ++ iov_iter_init(&iter, ITER_SOURCE, &iov, 1, len); + + /* map the communication buffer */ + phy_addr = (phys_addr_t)((buf_info.addr_hi << 32) | buf_info.addr_lo); +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index 677240232684..590d1b50ab5d 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -1816,7 +1816,7 @@ int drbd_send(struct drbd_connection *connection, struct socket *sock, + + /* THINK if (signal_pending) return ... ? */ + +- iov_iter_kvec(&msg.msg_iter, WRITE, &iov, 1, size); ++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iov, 1, size); + + if (sock == connection->data.socket) { + rcu_read_lock(); +diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c +index ee69d50ba4fd..54010eac6ca9 100644 +--- a/drivers/block/drbd/drbd_receiver.c ++++ b/drivers/block/drbd/drbd_receiver.c +@@ -507,7 +507,7 @@ static int drbd_recv_short(struct socket *sock, void *buf, size_t size, int flag + struct msghdr msg = { + .msg_flags = (flags ? flags : MSG_WAITALL | MSG_NOSIGNAL) + }; +- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, size); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, size); + return sock_recvmsg(sock, &msg, msg.msg_flags); + } + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index d12d3d171ec4..df628e30bca4 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -243,7 +243,7 @@ static int lo_write_bvec(struct file *file, struct bio_vec *bvec, loff_t *ppos) + struct iov_iter i; + ssize_t bw; + +- iov_iter_bvec(&i, WRITE, bvec, 1, bvec->bv_len); ++ iov_iter_bvec(&i, ITER_SOURCE, bvec, 1, bvec->bv_len); + + file_start_write(file); + bw = vfs_iter_write(file, &i, ppos, 0); +@@ -286,7 +286,7 @@ static int lo_read_simple(struct loop_device *lo, struct request *rq, + ssize_t len; + + rq_for_each_segment(bvec, rq, iter) { +- iov_iter_bvec(&i, READ, &bvec, 1, bvec.bv_len); ++ iov_iter_bvec(&i, ITER_DEST, &bvec, 1, bvec.bv_len); + len = vfs_iter_read(lo->lo_backing_file, &i, &pos, 0); + if (len < 0) + return len; +@@ -392,7 +392,7 @@ static void lo_rw_aio_complete(struct kiocb *iocb, long ret) + } + + static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd, +- loff_t pos, bool rw) ++ loff_t pos, int rw) + { + struct iov_iter iter; + struct req_iterator rq_iter; +@@ -448,7 +448,7 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd, + cmd->iocb.ki_flags = IOCB_DIRECT; + cmd->iocb.ki_ioprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_NONE, 0); + +- if (rw == WRITE) ++ if (rw == ITER_SOURCE) + ret = call_write_iter(file, &cmd->iocb, &iter); + else + ret = call_read_iter(file, &cmd->iocb, &iter); +@@ -490,12 +490,12 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq) + return lo_fallocate(lo, rq, pos, FALLOC_FL_PUNCH_HOLE); + case REQ_OP_WRITE: + if (cmd->use_aio) +- return lo_rw_aio(lo, cmd, pos, WRITE); ++ return lo_rw_aio(lo, cmd, pos, ITER_SOURCE); + else + return lo_write_simple(lo, rq, pos); + case REQ_OP_READ: + if (cmd->use_aio) +- return lo_rw_aio(lo, cmd, pos, READ); ++ return lo_rw_aio(lo, cmd, pos, ITER_DEST); + else + return lo_read_simple(lo, rq, pos); + default: +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 5cffd96ef2d7..e379ccc63c52 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -563,7 +563,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index) + u32 nbd_cmd_flags = 0; + int sent = nsock->sent, skip = 0; + +- iov_iter_kvec(&from, WRITE, &iov, 1, sizeof(request)); ++ iov_iter_kvec(&from, ITER_SOURCE, &iov, 1, sizeof(request)); + + type = req_to_nbd_cmd_type(req); + if (type == U32_MAX) +@@ -649,7 +649,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index) + + dev_dbg(nbd_to_dev(nbd), "request %p: sending %d bytes data\n", + req, bvec.bv_len); +- iov_iter_bvec(&from, WRITE, &bvec, 1, bvec.bv_len); ++ iov_iter_bvec(&from, ITER_SOURCE, &bvec, 1, bvec.bv_len); + if (skip) { + if (skip >= iov_iter_count(&from)) { + skip -= iov_iter_count(&from); +@@ -701,7 +701,7 @@ static int nbd_read_reply(struct nbd_device *nbd, int index, + int result; + + reply->magic = 0; +- iov_iter_kvec(&to, READ, &iov, 1, sizeof(*reply)); ++ iov_iter_kvec(&to, ITER_DEST, &iov, 1, sizeof(*reply)); + result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL); + if (result < 0) { + if (!nbd_disconnected(nbd->config)) +@@ -790,7 +790,7 @@ static struct nbd_cmd *nbd_handle_reply(struct nbd_device *nbd, int index, + struct iov_iter to; + + rq_for_each_segment(bvec, req, iter) { +- iov_iter_bvec(&to, READ, &bvec, 1, bvec.bv_len); ++ iov_iter_bvec(&to, ITER_DEST, &bvec, 1, bvec.bv_len); + result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL); + if (result < 0) { + dev_err(disk_to_dev(nbd->disk), "Receive data failed (result %d)\n", +@@ -1267,7 +1267,7 @@ static void send_disconnects(struct nbd_device *nbd) + for (i = 0; i < config->num_connections; i++) { + struct nbd_sock *nsock = config->socks[i]; + +- iov_iter_kvec(&from, WRITE, &iov, 1, sizeof(request)); ++ iov_iter_kvec(&from, ITER_SOURCE, &iov, 1, sizeof(request)); + mutex_lock(&nsock->tx_lock); + ret = sock_xmit(nbd, i, 1, &from, 0, NULL); + if (ret < 0) +diff --git a/drivers/char/random.c b/drivers/char/random.c +index f5868dddbb61..5d1c8e1c99b5 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1329,7 +1329,7 @@ SYSCALL_DEFINE3(getrandom, char __user *, ubuf, size_t, len, unsigned int, flags + return ret; + } + +- ret = import_single_range(READ, ubuf, len, &iov, &iter); ++ ret = import_single_range(ITER_DEST, ubuf, len, &iov, &iter); + if (unlikely(ret)) + return ret; + return get_random_bytes_user(&iter); +@@ -1447,7 +1447,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg) + return -EINVAL; + if (get_user(len, p++)) + return -EFAULT; +- ret = import_single_range(WRITE, p, len, &iov, &iter); ++ ret = import_single_range(ITER_SOURCE, p, len, &iov, &iter); + if (unlikely(ret)) + return ret; + ret = write_pool_user(&iter); +diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c +index efd4942aa043..9912b7a6a4b9 100644 +--- a/drivers/fsi/fsi-sbefifo.c ++++ b/drivers/fsi/fsi-sbefifo.c +@@ -659,7 +659,7 @@ static void sbefifo_collect_async_ffdc(struct sbefifo *sbefifo) + } + ffdc_iov.iov_base = ffdc; + ffdc_iov.iov_len = SBEFIFO_MAX_FFDC_SIZE; +- iov_iter_kvec(&ffdc_iter, READ, &ffdc_iov, 1, SBEFIFO_MAX_FFDC_SIZE); ++ iov_iter_kvec(&ffdc_iter, ITER_DEST, &ffdc_iov, 1, SBEFIFO_MAX_FFDC_SIZE); + cmd[0] = cpu_to_be32(2); + cmd[1] = cpu_to_be32(SBEFIFO_CMD_GET_SBE_FFDC); + rc = sbefifo_do_command(sbefifo, cmd, 2, &ffdc_iter); +@@ -756,7 +756,7 @@ int sbefifo_submit(struct device *dev, const __be32 *command, size_t cmd_len, + rbytes = (*resp_len) * sizeof(__be32); + resp_iov.iov_base = response; + resp_iov.iov_len = rbytes; +- iov_iter_kvec(&resp_iter, READ, &resp_iov, 1, rbytes); ++ iov_iter_kvec(&resp_iter, ITER_DEST, &resp_iov, 1, rbytes); + + /* Perform the command */ + rc = mutex_lock_interruptible(&sbefifo->lock); +@@ -839,7 +839,7 @@ static ssize_t sbefifo_user_read(struct file *file, char __user *buf, + /* Prepare iov iterator */ + resp_iov.iov_base = buf; + resp_iov.iov_len = len; +- iov_iter_init(&resp_iter, READ, &resp_iov, 1, len); ++ iov_iter_init(&resp_iter, ITER_DEST, &resp_iov, 1, len); + + /* Perform the command */ + rc = mutex_lock_interruptible(&sbefifo->lock); +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index 88282b288abd..730f2f1e09bb 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -966,7 +966,7 @@ static void rtrs_clt_init_req(struct rtrs_clt_io_req *req, + refcount_set(&req->ref, 1); + req->mp_policy = clt_path->clt->mp_policy; + +- iov_iter_kvec(&iter, WRITE, vec, 1, usr_len); ++ iov_iter_kvec(&iter, ITER_SOURCE, vec, 1, usr_len); + len = _copy_from_iter(req->iu->buf, usr_len, &iter); + WARN_ON(len != usr_len); + +diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c +index a77195e378b7..c24771336f61 100644 +--- a/drivers/isdn/mISDN/l1oip_core.c ++++ b/drivers/isdn/mISDN/l1oip_core.c +@@ -706,7 +706,7 @@ l1oip_socket_thread(void *data) + printk(KERN_DEBUG "%s: socket created and open\n", + __func__); + while (!signal_pending(current)) { +- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, recvbuf_size); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, recvbuf_size); + recvlen = sock_recvmsg(socket, &msg, 0); + if (recvlen > 0) { + l1oip_socket_parse(hc, &sin_rx, recvbuf, recvlen); +diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c +index 844264e1b88c..73d71c4ec139 100644 +--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c ++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c +@@ -3044,7 +3044,7 @@ ssize_t vmci_qpair_enqueue(struct vmci_qp *qpair, + if (!qpair || !buf) + return VMCI_ERROR_INVALID_ARGS; + +- iov_iter_kvec(&from, WRITE, &v, 1, buf_size); ++ iov_iter_kvec(&from, ITER_SOURCE, &v, 1, buf_size); + + qp_lock(qpair); + +@@ -3088,7 +3088,7 @@ ssize_t vmci_qpair_dequeue(struct vmci_qp *qpair, + if (!qpair || !buf) + return VMCI_ERROR_INVALID_ARGS; + +- iov_iter_kvec(&to, READ, &v, 1, buf_size); ++ iov_iter_kvec(&to, ITER_DEST, &v, 1, buf_size); + + qp_lock(qpair); + +@@ -3133,7 +3133,7 @@ ssize_t vmci_qpair_peek(struct vmci_qp *qpair, + if (!qpair || !buf) + return VMCI_ERROR_INVALID_ARGS; + +- iov_iter_kvec(&to, READ, &v, 1, buf_size); ++ iov_iter_kvec(&to, ITER_DEST, &v, 1, buf_size); + + qp_lock(qpair); + +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index d4c821c8cf57..1d71f5276241 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -480,7 +480,7 @@ static ssize_t ppp_read(struct file *file, char __user *buf, + ret = -EFAULT; + iov.iov_base = buf; + iov.iov_len = count; +- iov_iter_init(&to, READ, &iov, 1, count); ++ iov_iter_init(&to, ITER_DEST, &iov, 1, count); + if (skb_copy_datagram_iter(skb, 0, &to, skb->len)) + goto outf; + ret = skb->len; +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index eacd445b5333..4c052c261517 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -301,7 +301,7 @@ static inline void nvme_tcp_advance_req(struct nvme_tcp_request *req, + if (!iov_iter_count(&req->iter) && + req->data_sent < req->data_len) { + req->curr_bio = req->curr_bio->bi_next; +- nvme_tcp_init_iter(req, WRITE); ++ nvme_tcp_init_iter(req, ITER_SOURCE); + } + } + +@@ -781,7 +781,7 @@ static int nvme_tcp_recv_data(struct nvme_tcp_queue *queue, struct sk_buff *skb, + nvme_tcp_init_recv_ctx(queue); + return -EIO; + } +- nvme_tcp_init_iter(req, READ); ++ nvme_tcp_init_iter(req, ITER_DEST); + } + + /* we can read only from what is left in this bio */ +diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c +index e55ec6fefd7f..871c4f32f443 100644 +--- a/drivers/nvme/target/io-cmd-file.c ++++ b/drivers/nvme/target/io-cmd-file.c +@@ -92,10 +92,10 @@ static ssize_t nvmet_file_submit_bvec(struct nvmet_req *req, loff_t pos, + if (req->cmd->rw.control & cpu_to_le16(NVME_RW_FUA)) + ki_flags |= IOCB_DSYNC; + call_iter = req->ns->file->f_op->write_iter; +- rw = WRITE; ++ rw = ITER_SOURCE; + } else { + call_iter = req->ns->file->f_op->read_iter; +- rw = READ; ++ rw = ITER_DEST; + } + + iov_iter_bvec(&iter, rw, req->f.bvec, nr_segs, count); +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 6c1476e086ef..cc05c094de22 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -331,7 +331,7 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd) + sg_offset = 0; + } + +- iov_iter_bvec(&cmd->recv_msg.msg_iter, READ, cmd->iov, ++ iov_iter_bvec(&cmd->recv_msg.msg_iter, ITER_DEST, cmd->iov, + nr_pages, cmd->pdu_len); + } + +diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c +index 83ddac1e5838..a41833557d55 100644 +--- a/drivers/s390/char/zcore.c ++++ b/drivers/s390/char/zcore.c +@@ -103,7 +103,7 @@ static inline int memcpy_hsa_kernel(void *dst, unsigned long src, size_t count) + + kvec.iov_base = dst; + kvec.iov_len = count; +- iov_iter_kvec(&iter, READ, &kvec, 1, count); ++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, count); + if (memcpy_hsa_iter(&iter, src, count) < count) + return -EIO; + return 0; +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index ce34a8ad53b4..12344be14232 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -1726,7 +1726,7 @@ sg_start_req(Sg_request *srp, unsigned char *cmd) + Sg_scatter_hold *rsv_schp = &sfp->reserve; + struct request_queue *q = sfp->parentdp->device->request_queue; + struct rq_map_data *md, map_data; +- int rw = hp->dxfer_direction == SG_DXFER_TO_DEV ? WRITE : READ; ++ int rw = hp->dxfer_direction == SG_DXFER_TO_DEV ? ITER_SOURCE : ITER_DEST; + struct scsi_cmnd *scmd; + + SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp, +diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c +index 8d9f21372b67..26dc8ed3045b 100644 +--- a/drivers/target/iscsi/iscsi_target_util.c ++++ b/drivers/target/iscsi/iscsi_target_util.c +@@ -1225,7 +1225,7 @@ int rx_data( + return -1; + + memset(&msg, 0, sizeof(struct msghdr)); +- iov_iter_kvec(&msg.msg_iter, READ, iov, iov_count, data); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, iov, iov_count, data); + + while (msg_data_left(&msg)) { + rx_loop = sock_recvmsg(conn->sock, &msg, MSG_WAITALL); +@@ -1261,7 +1261,7 @@ int tx_data( + + memset(&msg, 0, sizeof(struct msghdr)); + +- iov_iter_kvec(&msg.msg_iter, WRITE, iov, iov_count, data); ++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iov, iov_count, data); + + while (msg_data_left(&msg)) { + int tx_loop = sock_sendmsg(conn->sock, &msg); +diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c +index 55935040541b..7e81a53dbf3c 100644 +--- a/drivers/target/target_core_file.c ++++ b/drivers/target/target_core_file.c +@@ -473,7 +473,7 @@ fd_execute_write_same(struct se_cmd *cmd) + len += se_dev->dev_attrib.block_size; + } + +- iov_iter_bvec(&iter, WRITE, bvec, nolb, len); ++ iov_iter_bvec(&iter, ITER_SOURCE, bvec, nolb, len); + ret = vfs_iter_write(fd_dev->fd_file, &iter, &pos, 0); + + kfree(bvec); +diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c +index 053a2bca4c47..f8b326eed54d 100644 +--- a/drivers/usb/usbip/usbip_common.c ++++ b/drivers/usb/usbip/usbip_common.c +@@ -309,7 +309,7 @@ int usbip_recv(struct socket *sock, void *buf, int size) + if (!sock || !buf || !size) + return -EINVAL; + +- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, size); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, size); + + usbip_dbg_xmit("enter\n"); + +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index c7e44d818252..4c538b30fd76 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -611,7 +611,7 @@ static size_t init_iov_iter(struct vhost_virtqueue *vq, struct iov_iter *iter, + /* Skip header. TODO: support TSO. */ + size_t len = iov_length(vq->iov, out); + +- iov_iter_init(iter, WRITE, vq->iov, out, len); ++ iov_iter_init(iter, ITER_SOURCE, vq->iov, out, len); + iov_iter_advance(iter, hdr_size); + + return iov_iter_count(iter); +@@ -1184,14 +1184,14 @@ static void handle_rx(struct vhost_net *net) + msg.msg_control = vhost_net_buf_consume(&nvq->rxq); + /* On overrun, truncate and discard */ + if (unlikely(headcount > UIO_MAXIOV)) { +- iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1); ++ iov_iter_init(&msg.msg_iter, ITER_DEST, vq->iov, 1, 1); + err = sock->ops->recvmsg(sock, &msg, + 1, MSG_DONTWAIT | MSG_TRUNC); + pr_debug("Discarded rx packet: len %zd\n", sock_len); + continue; + } + /* We don't need to be notified again. */ +- iov_iter_init(&msg.msg_iter, READ, vq->iov, in, vhost_len); ++ iov_iter_init(&msg.msg_iter, ITER_DEST, vq->iov, in, vhost_len); + fixup = msg.msg_iter; + if (unlikely((vhost_hlen))) { + /* We will supply the header ourselves +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index 7ebf106d50c1..dca6346d75b3 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -563,7 +563,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) + memcpy(v_rsp.sense, cmd->tvc_sense_buf, + se_cmd->scsi_sense_length); + +- iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov, ++ iov_iter_init(&iov_iter, ITER_DEST, &cmd->tvc_resp_iov, + cmd->tvc_in_iovs, sizeof(v_rsp)); + ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter); + if (likely(ret == sizeof(v_rsp))) { +@@ -864,7 +864,7 @@ vhost_scsi_get_desc(struct vhost_scsi *vs, struct vhost_virtqueue *vq, + * point at the start of the outgoing WRITE payload, if + * DMA_TO_DEVICE is set. + */ +- iov_iter_init(&vc->out_iter, WRITE, vq->iov, vc->out, vc->out_size); ++ iov_iter_init(&vc->out_iter, ITER_SOURCE, vq->iov, vc->out, vc->out_size); + ret = 0; + + done: +@@ -1016,7 +1016,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + data_direction = DMA_FROM_DEVICE; + exp_data_len = vc.in_size - vc.rsp_size; + +- iov_iter_init(&in_iter, READ, &vq->iov[vc.out], vc.in, ++ iov_iter_init(&in_iter, ITER_DEST, &vq->iov[vc.out], vc.in, + vc.rsp_size + exp_data_len); + iov_iter_advance(&in_iter, vc.rsp_size); + data_iter = in_iter; +@@ -1146,7 +1146,7 @@ vhost_scsi_send_tmf_resp(struct vhost_scsi *vs, struct vhost_virtqueue *vq, + memset(&rsp, 0, sizeof(rsp)); + rsp.response = tmf_resp_code; + +- iov_iter_init(&iov_iter, READ, resp_iov, in_iovs, sizeof(rsp)); ++ iov_iter_init(&iov_iter, ITER_DEST, resp_iov, in_iovs, sizeof(rsp)); + + ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter); + if (likely(ret == sizeof(rsp))) +@@ -1238,7 +1238,7 @@ vhost_scsi_send_an_resp(struct vhost_scsi *vs, + memset(&rsp, 0, sizeof(rsp)); /* event_actual = 0 */ + rsp.response = VIRTIO_SCSI_S_OK; + +- iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp)); ++ iov_iter_init(&iov_iter, ITER_DEST, &vq->iov[vc->out], vc->in, sizeof(rsp)); + + ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter); + if (likely(ret == sizeof(rsp))) +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index c234869d6727..43c9770b86e5 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -833,7 +833,7 @@ static int vhost_copy_to_user(struct vhost_virtqueue *vq, void __user *to, + VHOST_ACCESS_WO); + if (ret < 0) + goto out; +- iov_iter_init(&t, READ, vq->iotlb_iov, ret, size); ++ iov_iter_init(&t, ITER_DEST, vq->iotlb_iov, ret, size); + ret = copy_to_iter(from, size, &t); + if (ret == size) + ret = 0; +@@ -872,7 +872,7 @@ static int vhost_copy_from_user(struct vhost_virtqueue *vq, void *to, + (unsigned long long) size); + goto out; + } +- iov_iter_init(&f, WRITE, vq->iotlb_iov, ret, size); ++ iov_iter_init(&f, ITER_SOURCE, vq->iotlb_iov, ret, size); + ret = copy_from_iter(to, size, &f); + if (ret == size) + ret = 0; +@@ -2136,7 +2136,7 @@ static int get_indirect(struct vhost_virtqueue *vq, + vq_err(vq, "Translation failure %d in indirect.\n", ret); + return ret; + } +- iov_iter_init(&from, WRITE, vq->indirect, ret, len); ++ iov_iter_init(&from, ITER_SOURCE, vq->indirect, ret, len); + count = len / sizeof desc; + /* Buffers are chained via a 16 bit next field, so + * we can have at most 2^16 of these. */ +diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c +index 139c782848c6..33eb941fcf15 100644 +--- a/drivers/vhost/vringh.c ++++ b/drivers/vhost/vringh.c +@@ -1161,7 +1161,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, + else if (ret < 0) + return ret; + +- iov_iter_bvec(&iter, WRITE, iov, ret, translated); ++ iov_iter_bvec(&iter, ITER_SOURCE, iov, ret, translated); + + ret = copy_from_iter(dst, translated, &iter); + if (ret < 0) +@@ -1194,7 +1194,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, + else if (ret < 0) + return ret; + +- iov_iter_bvec(&iter, READ, iov, ret, translated); ++ iov_iter_bvec(&iter, ITER_DEST, iov, ret, translated); + + ret = copy_to_iter(src, translated, &iter); + if (ret < 0) +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c +index 10a7d23731fe..a2b374372363 100644 +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -165,7 +165,7 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock, + break; + } + +- iov_iter_init(&iov_iter, READ, &vq->iov[out], in, iov_len); ++ iov_iter_init(&iov_iter, ITER_DEST, &vq->iov[out], in, iov_len); + payload_len = pkt->len - pkt->off; + + /* If the packet is greater than the space available in the +@@ -371,7 +371,7 @@ vhost_vsock_alloc_pkt(struct vhost_virtqueue *vq, + return NULL; + + len = iov_length(vq->iov, out); +- iov_iter_init(&iov_iter, WRITE, vq->iov, out, len); ++ iov_iter_init(&iov_iter, ITER_SOURCE, vq->iov, out, len); + + nbytes = copy_from_iter(&pkt->hdr, sizeof(pkt->hdr), &iov_iter); + if (nbytes != sizeof(pkt->hdr)) { +diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c +index 21b9c850a382..28b2a1fa25ab 100644 +--- a/drivers/xen/pvcalls-back.c ++++ b/drivers/xen/pvcalls-back.c +@@ -129,13 +129,13 @@ static bool pvcalls_conn_back_read(void *opaque) + if (masked_prod < masked_cons) { + vec[0].iov_base = data->in + masked_prod; + vec[0].iov_len = wanted; +- iov_iter_kvec(&msg.msg_iter, READ, vec, 1, wanted); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, vec, 1, wanted); + } else { + vec[0].iov_base = data->in + masked_prod; + vec[0].iov_len = array_size - masked_prod; + vec[1].iov_base = data->in; + vec[1].iov_len = wanted - vec[0].iov_len; +- iov_iter_kvec(&msg.msg_iter, READ, vec, 2, wanted); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, vec, 2, wanted); + } + + atomic_set(&map->read, 0); +@@ -188,13 +188,13 @@ static bool pvcalls_conn_back_write(struct sock_mapping *map) + if (pvcalls_mask(prod, array_size) > pvcalls_mask(cons, array_size)) { + vec[0].iov_base = data->out + pvcalls_mask(cons, array_size); + vec[0].iov_len = size; +- iov_iter_kvec(&msg.msg_iter, WRITE, vec, 1, size); ++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, vec, 1, size); + } else { + vec[0].iov_base = data->out + pvcalls_mask(cons, array_size); + vec[0].iov_len = array_size - pvcalls_mask(cons, array_size); + vec[1].iov_base = data->out; + vec[1].iov_len = size - vec[0].iov_len; +- iov_iter_kvec(&msg.msg_iter, WRITE, vec, 2, size); ++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, vec, 2, size); + } + + atomic_set(&map->write, 0); +diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c +index 47b9a1122f34..a19891015f19 100644 +--- a/fs/9p/vfs_addr.c ++++ b/fs/9p/vfs_addr.c +@@ -40,7 +40,7 @@ static void v9fs_issue_read(struct netfs_io_subrequest *subreq) + size_t len = subreq->len - subreq->transferred; + int total, err; + +- iov_iter_xarray(&to, READ, &rreq->mapping->i_pages, pos, len); ++ iov_iter_xarray(&to, ITER_DEST, &rreq->mapping->i_pages, pos, len); + + total = p9_client_read(fid, pos, &to, &err); + +@@ -172,7 +172,7 @@ static int v9fs_vfs_write_folio_locked(struct folio *folio) + + len = min_t(loff_t, i_size - start, len); + +- iov_iter_xarray(&from, WRITE, &folio_mapping(folio)->i_pages, start, len); ++ iov_iter_xarray(&from, ITER_SOURCE, &folio_mapping(folio)->i_pages, start, len); + + /* We should have writeback_fid always set */ + BUG_ON(!v9inode->writeback_fid); +diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c +index 000fbaae9b18..3bb95adc9619 100644 +--- a/fs/9p/vfs_dir.c ++++ b/fs/9p/vfs_dir.c +@@ -109,7 +109,7 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) + struct iov_iter to; + int n; + +- iov_iter_kvec(&to, READ, &kvec, 1, buflen); ++ iov_iter_kvec(&to, ITER_DEST, &kvec, 1, buflen); + n = p9_client_read(file->private_data, ctx->pos, &to, + &err); + if (err) +diff --git a/fs/9p/xattr.c b/fs/9p/xattr.c +index 1f9298a4bd42..2807bb63f780 100644 +--- a/fs/9p/xattr.c ++++ b/fs/9p/xattr.c +@@ -24,7 +24,7 @@ ssize_t v9fs_fid_xattr_get(struct p9_fid *fid, const char *name, + struct iov_iter to; + int err; + +- iov_iter_kvec(&to, READ, &kvec, 1, buffer_size); ++ iov_iter_kvec(&to, ITER_DEST, &kvec, 1, buffer_size); + + attr_fid = p9_client_xattrwalk(fid, name, &attr_size); + if (IS_ERR(attr_fid)) { +@@ -109,7 +109,7 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name, + struct iov_iter from; + int retval, err; + +- iov_iter_kvec(&from, WRITE, &kvec, 1, value_len); ++ iov_iter_kvec(&from, ITER_SOURCE, &kvec, 1, value_len); + + p9_debug(P9_DEBUG_VFS, "name = %s value_len = %zu flags = %d\n", + name, value_len, flags); +diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c +index 0a090d614e76..7dcd59693a0c 100644 +--- a/fs/afs/cmservice.c ++++ b/fs/afs/cmservice.c +@@ -298,7 +298,7 @@ static int afs_deliver_cb_callback(struct afs_call *call) + if (call->count2 != call->count && call->count2 != 0) + return afs_protocol_error(call, afs_eproto_cb_count); + call->iter = &call->def_iter; +- iov_iter_discard(&call->def_iter, READ, call->count2 * 3 * 4); ++ iov_iter_discard(&call->def_iter, ITER_DEST, call->count2 * 3 * 4); + call->unmarshall++; + + fallthrough; +diff --git a/fs/afs/dir.c b/fs/afs/dir.c +index 230c2d19116d..104df2964225 100644 +--- a/fs/afs/dir.c ++++ b/fs/afs/dir.c +@@ -305,7 +305,7 @@ static struct afs_read *afs_read_dir(struct afs_vnode *dvnode, struct key *key) + req->actual_len = i_size; /* May change */ + req->len = nr_pages * PAGE_SIZE; /* We can ask for more than there is */ + req->data_version = dvnode->status.data_version; /* May change */ +- iov_iter_xarray(&req->def_iter, READ, &dvnode->netfs.inode.i_mapping->i_pages, ++ iov_iter_xarray(&req->def_iter, ITER_DEST, &dvnode->netfs.inode.i_mapping->i_pages, + 0, i_size); + req->iter = &req->def_iter; + +diff --git a/fs/afs/file.c b/fs/afs/file.c +index d1cfb235c4b9..2eeab57df133 100644 +--- a/fs/afs/file.c ++++ b/fs/afs/file.c +@@ -324,7 +324,7 @@ static void afs_issue_read(struct netfs_io_subrequest *subreq) + fsreq->vnode = vnode; + fsreq->iter = &fsreq->def_iter; + +- iov_iter_xarray(&fsreq->def_iter, READ, ++ iov_iter_xarray(&fsreq->def_iter, ITER_DEST, + &fsreq->vnode->netfs.inode.i_mapping->i_pages, + fsreq->pos, fsreq->len); + +@@ -346,7 +346,7 @@ static int afs_symlink_read_folio(struct file *file, struct folio *folio) + fsreq->len = folio_size(folio); + fsreq->vnode = vnode; + fsreq->iter = &fsreq->def_iter; +- iov_iter_xarray(&fsreq->def_iter, READ, &folio->mapping->i_pages, ++ iov_iter_xarray(&fsreq->def_iter, ITER_DEST, &folio->mapping->i_pages, + fsreq->pos, fsreq->len); + + ret = afs_fetch_data(fsreq->vnode, fsreq); +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index 723d162078a3..9ba7b68375c9 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -1301,7 +1301,7 @@ static inline void afs_extract_begin(struct afs_call *call, void *buf, size_t si + call->iov_len = size; + call->kvec[0].iov_base = buf; + call->kvec[0].iov_len = size; +- iov_iter_kvec(&call->def_iter, READ, call->kvec, 1, size); ++ iov_iter_kvec(&call->def_iter, ITER_DEST, call->kvec, 1, size); + } + + static inline void afs_extract_to_tmp(struct afs_call *call) +@@ -1319,7 +1319,7 @@ static inline void afs_extract_to_tmp64(struct afs_call *call) + static inline void afs_extract_discard(struct afs_call *call, size_t size) + { + call->iov_len = size; +- iov_iter_discard(&call->def_iter, READ, size); ++ iov_iter_discard(&call->def_iter, ITER_DEST, size); + } + + static inline void afs_extract_to_buf(struct afs_call *call, size_t size) +diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c +index eccc3cd0cb70..c62939e5ea1f 100644 +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -359,7 +359,7 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) + + msg.msg_name = NULL; + msg.msg_namelen = 0; +- iov_iter_kvec(&msg.msg_iter, WRITE, iov, 1, call->request_size); ++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iov, 1, call->request_size); + msg.msg_control = NULL; + msg.msg_controllen = 0; + msg.msg_flags = MSG_WAITALL | (call->write_iter ? MSG_MORE : 0); +@@ -400,7 +400,7 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp) + RX_USER_ABORT, ret, "KSD"); + } else { + len = 0; +- iov_iter_kvec(&msg.msg_iter, READ, NULL, 0, 0); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, NULL, 0, 0); + rxrpc_kernel_recv_data(call->net->socket, rxcall, + &msg.msg_iter, &len, false, + &call->abort_code, &call->service_id); +@@ -485,7 +485,7 @@ static void afs_deliver_to_call(struct afs_call *call) + ) { + if (state == AFS_CALL_SV_AWAIT_ACK) { + len = 0; +- iov_iter_kvec(&call->def_iter, READ, NULL, 0, 0); ++ iov_iter_kvec(&call->def_iter, ITER_DEST, NULL, 0, 0); + ret = rxrpc_kernel_recv_data(call->net->socket, + call->rxcall, &call->def_iter, + &len, false, &remote_abort, +@@ -822,7 +822,7 @@ void afs_send_empty_reply(struct afs_call *call) + + msg.msg_name = NULL; + msg.msg_namelen = 0; +- iov_iter_kvec(&msg.msg_iter, WRITE, NULL, 0, 0); ++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, NULL, 0, 0); + msg.msg_control = NULL; + msg.msg_controllen = 0; + msg.msg_flags = 0; +@@ -862,7 +862,7 @@ void afs_send_simple_reply(struct afs_call *call, const void *buf, size_t len) + iov[0].iov_len = len; + msg.msg_name = NULL; + msg.msg_namelen = 0; +- iov_iter_kvec(&msg.msg_iter, WRITE, iov, 1, len); ++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iov, 1, len); + msg.msg_control = NULL; + msg.msg_controllen = 0; + msg.msg_flags = 0; +diff --git a/fs/afs/write.c b/fs/afs/write.c +index 9ebdd36eaf2f..08fd456dde67 100644 +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -609,7 +609,7 @@ static ssize_t afs_write_back_from_locked_folio(struct address_space *mapping, + */ + afs_write_to_cache(vnode, start, len, i_size, caching); + +- iov_iter_xarray(&iter, WRITE, &mapping->i_pages, start, len); ++ iov_iter_xarray(&iter, ITER_SOURCE, &mapping->i_pages, start, len); + ret = afs_store_data(vnode, &iter, start, false); + } else { + _debug("write discard %x @%llx [%llx]", len, start, i_size); +@@ -1000,7 +1000,7 @@ int afs_launder_folio(struct folio *folio) + bv[0].bv_page = &folio->page; + bv[0].bv_offset = f; + bv[0].bv_len = t - f; +- iov_iter_bvec(&iter, WRITE, bv, 1, bv[0].bv_len); ++ iov_iter_bvec(&iter, ITER_SOURCE, bv, 1, bv[0].bv_len); + + trace_afs_folio_dirty(vnode, tracepoint_string("launder"), folio); + ret = afs_store_data(vnode, &iter, folio_pos(folio) + f, true); +diff --git a/fs/aio.c b/fs/aio.c +index 5b2ff20ad322..562916d85cba 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -1552,7 +1552,7 @@ static int aio_read(struct kiocb *req, const struct iocb *iocb, + if (unlikely(!file->f_op->read_iter)) + return -EINVAL; + +- ret = aio_setup_rw(READ, iocb, &iovec, vectored, compat, &iter); ++ ret = aio_setup_rw(ITER_DEST, iocb, &iovec, vectored, compat, &iter); + if (ret < 0) + return ret; + ret = rw_verify_area(READ, file, &req->ki_pos, iov_iter_count(&iter)); +@@ -1580,7 +1580,7 @@ static int aio_write(struct kiocb *req, const struct iocb *iocb, + if (unlikely(!file->f_op->write_iter)) + return -EINVAL; + +- ret = aio_setup_rw(WRITE, iocb, &iovec, vectored, compat, &iter); ++ ret = aio_setup_rw(ITER_SOURCE, iocb, &iovec, vectored, compat, &iter); + if (ret < 0) + return ret; + ret = rw_verify_area(WRITE, file, &req->ki_pos, iov_iter_count(&iter)); +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index fd1902573cde..c05f16a35bca 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -5283,7 +5283,7 @@ static int btrfs_ioctl_encoded_read(struct file *file, void __user *argp, + goto out_acct; + } + +- ret = import_iovec(READ, args.iov, args.iovcnt, ARRAY_SIZE(iovstack), ++ ret = import_iovec(ITER_DEST, args.iov, args.iovcnt, ARRAY_SIZE(iovstack), + &iov, &iter); + if (ret < 0) + goto out_acct; +@@ -5382,7 +5382,7 @@ static int btrfs_ioctl_encoded_write(struct file *file, void __user *argp, bool + if (args.len > args.unencoded_len - args.unencoded_offset) + goto out_acct; + +- ret = import_iovec(WRITE, args.iov, args.iovcnt, ARRAY_SIZE(iovstack), ++ ret = import_iovec(ITER_SOURCE, args.iov, args.iovcnt, ARRAY_SIZE(iovstack), + &iov, &iter); + if (ret < 0) + goto out_acct; +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index dcf701b05cc1..61f47debec5a 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -288,7 +288,7 @@ static bool ceph_netfs_issue_op_inline(struct netfs_io_subrequest *subreq) + } + + len = min_t(size_t, iinfo->inline_len - subreq->start, subreq->len); +- iov_iter_xarray(&iter, READ, &rreq->mapping->i_pages, subreq->start, len); ++ iov_iter_xarray(&iter, ITER_DEST, &rreq->mapping->i_pages, subreq->start, len); + err = copy_to_iter(iinfo->inline_data + subreq->start, len, &iter); + if (err == 0) + err = -EFAULT; +@@ -327,7 +327,7 @@ static void ceph_netfs_issue_read(struct netfs_io_subrequest *subreq) + } + + dout("%s: pos=%llu orig_len=%zu len=%llu\n", __func__, subreq->start, subreq->len, len); +- iov_iter_xarray(&iter, READ, &rreq->mapping->i_pages, subreq->start, len); ++ iov_iter_xarray(&iter, ITER_DEST, &rreq->mapping->i_pages, subreq->start, len); + err = iov_iter_get_pages_alloc2(&iter, &pages, len, &page_off); + if (err < 0) { + dout("%s: iov_ter_get_pages_alloc returned %d\n", __func__, err); +diff --git a/fs/ceph/file.c b/fs/ceph/file.c +index 04fd34557de8..6f9580defb2b 100644 +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -1161,7 +1161,7 @@ static void ceph_aio_complete_req(struct ceph_osd_request *req) + aio_req->total_len = rc + zlen; + } + +- iov_iter_bvec(&i, READ, osd_data->bvec_pos.bvecs, ++ iov_iter_bvec(&i, ITER_DEST, osd_data->bvec_pos.bvecs, + osd_data->num_bvecs, len); + iov_iter_advance(&i, rc); + iov_iter_zero(zlen, &i); +@@ -1400,7 +1400,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, + int zlen = min_t(size_t, len - ret, + size - pos - ret); + +- iov_iter_bvec(&i, READ, bvecs, num_pages, len); ++ iov_iter_bvec(&i, ITER_DEST, bvecs, num_pages, len); + iov_iter_advance(&i, ret); + iov_iter_zero(zlen, &i); + ret += zlen; +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index eab36e4ea130..384c7c0e1088 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -761,7 +761,7 @@ cifs_read_from_socket(struct TCP_Server_Info *server, char *buf, + { + struct msghdr smb_msg = {}; + struct kvec iov = {.iov_base = buf, .iov_len = to_read}; +- iov_iter_kvec(&smb_msg.msg_iter, READ, &iov, 1, to_read); ++ iov_iter_kvec(&smb_msg.msg_iter, ITER_DEST, &iov, 1, to_read); + + return cifs_readv_from_socket(server, &smb_msg); + } +@@ -776,7 +776,7 @@ cifs_discard_from_socket(struct TCP_Server_Info *server, size_t to_read) + * and cifs_readv_from_socket sets msg_control and msg_controllen + * so little to initialize in struct msghdr + */ +- iov_iter_discard(&smb_msg.msg_iter, READ, to_read); ++ iov_iter_discard(&smb_msg.msg_iter, ITER_DEST, to_read); + + return cifs_readv_from_socket(server, &smb_msg); + } +@@ -788,7 +788,7 @@ cifs_read_page_from_socket(struct TCP_Server_Info *server, struct page *page, + struct msghdr smb_msg = {}; + struct bio_vec bv = { + .bv_page = page, .bv_len = to_read, .bv_offset = page_offset}; +- iov_iter_bvec(&smb_msg.msg_iter, READ, &bv, 1, to_read); ++ iov_iter_bvec(&smb_msg.msg_iter, ITER_DEST, &bv, 1, to_read); + return cifs_readv_from_socket(server, &smb_msg); + } + +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index cd9698209930..209dfc06fd6d 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -3532,7 +3532,7 @@ static ssize_t __cifs_writev( + ctx->iter = *from; + ctx->len = len; + } else { +- rc = setup_aio_ctx_iter(ctx, from, WRITE); ++ rc = setup_aio_ctx_iter(ctx, from, ITER_SOURCE); + if (rc) { + kref_put(&ctx->refcount, cifs_aio_ctx_release); + return rc; +@@ -4276,7 +4276,7 @@ static ssize_t __cifs_readv( + ctx->iter = *to; + ctx->len = len; + } else { +- rc = setup_aio_ctx_iter(ctx, to, READ); ++ rc = setup_aio_ctx_iter(ctx, to, ITER_DEST); + if (rc) { + kref_put(&ctx->refcount, cifs_aio_ctx_release); + return rc; +diff --git a/fs/cifs/fscache.c b/fs/cifs/fscache.c +index a1751b956318..f6f3a6b75601 100644 +--- a/fs/cifs/fscache.c ++++ b/fs/cifs/fscache.c +@@ -150,7 +150,7 @@ static int fscache_fallback_read_page(struct inode *inode, struct page *page) + bvec[0].bv_page = page; + bvec[0].bv_offset = 0; + bvec[0].bv_len = PAGE_SIZE; +- iov_iter_bvec(&iter, READ, bvec, ARRAY_SIZE(bvec), PAGE_SIZE); ++ iov_iter_bvec(&iter, ITER_DEST, bvec, ARRAY_SIZE(bvec), PAGE_SIZE); + + ret = fscache_begin_read_operation(&cres, cookie); + if (ret < 0) +@@ -180,7 +180,7 @@ static int fscache_fallback_write_page(struct inode *inode, struct page *page, + bvec[0].bv_page = page; + bvec[0].bv_offset = 0; + bvec[0].bv_len = PAGE_SIZE; +- iov_iter_bvec(&iter, WRITE, bvec, ARRAY_SIZE(bvec), PAGE_SIZE); ++ iov_iter_bvec(&iter, ITER_SOURCE, bvec, ARRAY_SIZE(bvec), PAGE_SIZE); + + ret = fscache_begin_write_operation(&cres, cookie); + if (ret < 0) +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 1ff5b6b0e07a..78c2d618eb51 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -4737,13 +4737,13 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, + return 0; + } + +- iov_iter_bvec(&iter, WRITE, bvec, npages, data_len); ++ iov_iter_bvec(&iter, ITER_SOURCE, bvec, npages, data_len); + } else if (buf_len >= data_offset + data_len) { + /* read response payload is in buf */ + WARN_ONCE(npages > 0, "read data can be either in buf or in pages"); + iov.iov_base = buf + data_offset; + iov.iov_len = data_len; +- iov_iter_kvec(&iter, WRITE, &iov, 1, data_len); ++ iov_iter_kvec(&iter, ITER_SOURCE, &iov, 1, data_len); + } else { + /* read response payload cannot be in both buf and pages */ + WARN_ONCE(1, "buf can not contain only a part of read data"); +diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c +index 575fa8f58342..3851d0aaa288 100644 +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -347,7 +347,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, + .iov_base = &rfc1002_marker, + .iov_len = 4 + }; +- iov_iter_kvec(&smb_msg.msg_iter, WRITE, &hiov, 1, 4); ++ iov_iter_kvec(&smb_msg.msg_iter, ITER_SOURCE, &hiov, 1, 4); + rc = smb_send_kvec(server, &smb_msg, &sent); + if (rc < 0) + goto unmask; +@@ -368,7 +368,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, + size += iov[i].iov_len; + } + +- iov_iter_kvec(&smb_msg.msg_iter, WRITE, iov, n_vec, size); ++ iov_iter_kvec(&smb_msg.msg_iter, ITER_SOURCE, iov, n_vec, size); + + rc = smb_send_kvec(server, &smb_msg, &sent); + if (rc < 0) +@@ -384,7 +384,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, + rqst_page_get_length(&rqst[j], i, &bvec.bv_len, + &bvec.bv_offset); + +- iov_iter_bvec(&smb_msg.msg_iter, WRITE, ++ iov_iter_bvec(&smb_msg.msg_iter, ITER_SOURCE, + &bvec, 1, bvec.bv_len); + rc = smb_send_kvec(server, &smb_msg, &sent); + if (rc < 0) +diff --git a/fs/coredump.c b/fs/coredump.c +index 7bad7785e8e6..095ed821c8ac 100644 +--- a/fs/coredump.c ++++ b/fs/coredump.c +@@ -853,7 +853,7 @@ static int dump_emit_page(struct coredump_params *cprm, struct page *page) + if (dump_interrupted()) + return 0; + pos = file->f_pos; +- iov_iter_bvec(&iter, WRITE, &bvec, 1, PAGE_SIZE); ++ iov_iter_bvec(&iter, ITER_SOURCE, &bvec, 1, PAGE_SIZE); + n = __kernel_write_iter(cprm->file, &iter, &pos); + if (n != PAGE_SIZE) + return 0; +diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c +index 6a792a513d6b..b04f93bc062a 100644 +--- a/fs/erofs/fscache.c ++++ b/fs/erofs/fscache.c +@@ -194,7 +194,7 @@ static int erofs_fscache_read_folios_async(struct fscache_cookie *cookie, + + atomic_inc(&rreq->nr_outstanding); + +- iov_iter_xarray(&iter, READ, &rreq->mapping->i_pages, ++ iov_iter_xarray(&iter, ITER_DEST, &rreq->mapping->i_pages, + start + done, subreq->len); + + ret = fscache_read(cres, subreq->start, &iter, +@@ -290,7 +290,7 @@ static int erofs_fscache_data_read(struct address_space *mapping, + if (IS_ERR(src)) + return PTR_ERR(src); + +- iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, PAGE_SIZE); ++ iov_iter_xarray(&iter, ITER_DEST, &mapping->i_pages, pos, PAGE_SIZE); + if (copy_to_iter(src + offset, size, &iter) != size) { + erofs_put_metabuf(&buf); + return -EFAULT; +@@ -302,7 +302,7 @@ static int erofs_fscache_data_read(struct address_space *mapping, + + if (!(map.m_flags & EROFS_MAP_MAPPED)) { + count = len; +- iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, count); ++ iov_iter_xarray(&iter, ITER_DEST, &mapping->i_pages, pos, count); + iov_iter_zero(count, &iter); + return count; + } +diff --git a/fs/fscache/io.c b/fs/fscache/io.c +index 3af3b08a9bb3..0d2b8dec8f82 100644 +--- a/fs/fscache/io.c ++++ b/fs/fscache/io.c +@@ -286,7 +286,7 @@ void __fscache_write_to_cache(struct fscache_cookie *cookie, + * taken into account. + */ + +- iov_iter_xarray(&iter, WRITE, &mapping->i_pages, start, len); ++ iov_iter_xarray(&iter, ITER_SOURCE, &mapping->i_pages, start, len); + fscache_write(cres, start, &iter, fscache_wreq_done, wreq); + return; + +diff --git a/fs/fuse/ioctl.c b/fs/fuse/ioctl.c +index 61d8afcb10a3..fcce94ace2c2 100644 +--- a/fs/fuse/ioctl.c ++++ b/fs/fuse/ioctl.c +@@ -255,7 +255,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, + ap.args.in_pages = true; + + err = -EFAULT; +- iov_iter_init(&ii, WRITE, in_iov, in_iovs, in_size); ++ iov_iter_init(&ii, ITER_SOURCE, in_iov, in_iovs, in_size); + for (i = 0; iov_iter_count(&ii) && !WARN_ON(i >= ap.num_pages); i++) { + c = copy_page_from_iter(ap.pages[i], 0, PAGE_SIZE, &ii); + if (c != PAGE_SIZE && iov_iter_count(&ii)) +@@ -324,7 +324,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, + goto out; + + err = -EFAULT; +- iov_iter_init(&ii, READ, out_iov, out_iovs, transferred); ++ iov_iter_init(&ii, ITER_DEST, out_iov, out_iovs, transferred); + for (i = 0; iov_iter_count(&ii) && !WARN_ON(i >= ap.num_pages); i++) { + c = copy_page_to_iter(ap.pages[i], 0, PAGE_SIZE, &ii); + if (c != PAGE_SIZE && iov_iter_count(&ii)) +diff --git a/fs/netfs/io.c b/fs/netfs/io.c +index e374767d1b68..7f753380e047 100644 +--- a/fs/netfs/io.c ++++ b/fs/netfs/io.c +@@ -23,7 +23,7 @@ static void netfs_clear_unread(struct netfs_io_subrequest *subreq) + { + struct iov_iter iter; + +- iov_iter_xarray(&iter, READ, &subreq->rreq->mapping->i_pages, ++ iov_iter_xarray(&iter, ITER_DEST, &subreq->rreq->mapping->i_pages, + subreq->start + subreq->transferred, + subreq->len - subreq->transferred); + iov_iter_zero(iov_iter_count(&iter), &iter); +@@ -49,7 +49,7 @@ static void netfs_read_from_cache(struct netfs_io_request *rreq, + struct iov_iter iter; + + netfs_stat(&netfs_n_rh_read); +- iov_iter_xarray(&iter, READ, &rreq->mapping->i_pages, ++ iov_iter_xarray(&iter, ITER_DEST, &rreq->mapping->i_pages, + subreq->start + subreq->transferred, + subreq->len - subreq->transferred); + +@@ -208,7 +208,7 @@ static void netfs_rreq_do_write_to_cache(struct netfs_io_request *rreq) + continue; + } + +- iov_iter_xarray(&iter, WRITE, &rreq->mapping->i_pages, ++ iov_iter_xarray(&iter, ITER_SOURCE, &rreq->mapping->i_pages, + subreq->start, subreq->len); + + atomic_inc(&rreq->nr_copy_ops); +diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c +index e861d7bae305..e731c00a9fcb 100644 +--- a/fs/nfs/fscache.c ++++ b/fs/nfs/fscache.c +@@ -252,7 +252,7 @@ static int fscache_fallback_read_page(struct inode *inode, struct page *page) + bvec[0].bv_page = page; + bvec[0].bv_offset = 0; + bvec[0].bv_len = PAGE_SIZE; +- iov_iter_bvec(&iter, READ, bvec, ARRAY_SIZE(bvec), PAGE_SIZE); ++ iov_iter_bvec(&iter, ITER_DEST, bvec, ARRAY_SIZE(bvec), PAGE_SIZE); + + ret = fscache_begin_read_operation(&cres, cookie); + if (ret < 0) +@@ -282,7 +282,7 @@ static int fscache_fallback_write_page(struct inode *inode, struct page *page, + bvec[0].bv_page = page; + bvec[0].bv_offset = 0; + bvec[0].bv_len = PAGE_SIZE; +- iov_iter_bvec(&iter, WRITE, bvec, ARRAY_SIZE(bvec), PAGE_SIZE); ++ iov_iter_bvec(&iter, ITER_SOURCE, bvec, ARRAY_SIZE(bvec), PAGE_SIZE); + + ret = fscache_begin_write_operation(&cres, cookie); + if (ret < 0) +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index 2934ab1d9862..0d49c6bb22eb 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -943,7 +943,7 @@ __be32 nfsd_readv(struct svc_rqst *rqstp, struct svc_fh *fhp, + ssize_t host_err; + + trace_nfsd_read_vector(rqstp, fhp, offset, *count); +- iov_iter_kvec(&iter, READ, vec, vlen, *count); ++ iov_iter_kvec(&iter, ITER_DEST, vec, vlen, *count); + host_err = vfs_iter_read(file, &iter, &ppos, 0); + return nfsd_finish_read(rqstp, fhp, file, offset, count, eof, host_err); + } +@@ -1033,7 +1033,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf, + if (stable && !use_wgather) + flags |= RWF_SYNC; + +- iov_iter_kvec(&iter, WRITE, vec, vlen, *cnt); ++ iov_iter_kvec(&iter, ITER_SOURCE, vec, vlen, *cnt); + since = READ_ONCE(file->f_wb_err); + if (verf) + nfsd_copy_write_verifier(verf, nn); +diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c +index f660c0dbdb63..785cabd71d67 100644 +--- a/fs/ocfs2/cluster/tcp.c ++++ b/fs/ocfs2/cluster/tcp.c +@@ -900,7 +900,7 @@ static int o2net_recv_tcp_msg(struct socket *sock, void *data, size_t len) + { + struct kvec vec = { .iov_len = len, .iov_base = data, }; + struct msghdr msg = { .msg_flags = MSG_DONTWAIT, }; +- iov_iter_kvec(&msg.msg_iter, READ, &vec, 1, len); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &vec, 1, len); + return sock_recvmsg(sock, &msg, MSG_DONTWAIT); + } + +diff --git a/fs/orangefs/inode.c b/fs/orangefs/inode.c +index 7a8c0c6e698d..b3bbb5a5787a 100644 +--- a/fs/orangefs/inode.c ++++ b/fs/orangefs/inode.c +@@ -53,7 +53,7 @@ static int orangefs_writepage_locked(struct page *page, + bv.bv_len = wlen; + bv.bv_offset = off % PAGE_SIZE; + WARN_ON(wlen == 0); +- iov_iter_bvec(&iter, WRITE, &bv, 1, wlen); ++ iov_iter_bvec(&iter, ITER_SOURCE, &bv, 1, wlen); + + ret = wait_for_direct_io(ORANGEFS_IO_WRITE, inode, &off, &iter, wlen, + len, wr, NULL, NULL); +@@ -112,7 +112,7 @@ static int orangefs_writepages_work(struct orangefs_writepages *ow, + else + ow->bv[i].bv_offset = 0; + } +- iov_iter_bvec(&iter, WRITE, ow->bv, ow->npages, ow->len); ++ iov_iter_bvec(&iter, ITER_SOURCE, ow->bv, ow->npages, ow->len); + + WARN_ON(ow->off >= len); + if (ow->off + ow->len > len) +@@ -270,7 +270,7 @@ static void orangefs_readahead(struct readahead_control *rac) + offset = readahead_pos(rac); + i_pages = &rac->mapping->i_pages; + +- iov_iter_xarray(&iter, READ, i_pages, offset, readahead_length(rac)); ++ iov_iter_xarray(&iter, ITER_DEST, i_pages, offset, readahead_length(rac)); + + /* read in the pages. */ + if ((ret = wait_for_direct_io(ORANGEFS_IO_READ, inode, +@@ -303,7 +303,7 @@ static int orangefs_read_folio(struct file *file, struct folio *folio) + bv.bv_page = &folio->page; + bv.bv_len = folio_size(folio); + bv.bv_offset = 0; +- iov_iter_bvec(&iter, READ, &bv, 1, folio_size(folio)); ++ iov_iter_bvec(&iter, ITER_DEST, &bv, 1, folio_size(folio)); + + ret = wait_for_direct_io(ORANGEFS_IO_READ, inode, &off, &iter, + folio_size(folio), inode->i_size, NULL, NULL, file); +diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c +index f2aa86c421f2..5aa527ca6dbe 100644 +--- a/fs/proc/vmcore.c ++++ b/fs/proc/vmcore.c +@@ -199,7 +199,7 @@ ssize_t __weak elfcorehdr_read(char *buf, size_t count, u64 *ppos) + struct kvec kvec = { .iov_base = buf, .iov_len = count }; + struct iov_iter iter; + +- iov_iter_kvec(&iter, READ, &kvec, 1, count); ++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, count); + + return read_from_oldmem(&iter, count, ppos, false); + } +@@ -212,7 +212,7 @@ ssize_t __weak elfcorehdr_read_notes(char *buf, size_t count, u64 *ppos) + struct kvec kvec = { .iov_base = buf, .iov_len = count }; + struct iov_iter iter; + +- iov_iter_kvec(&iter, READ, &kvec, 1, count); ++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, count); + + return read_from_oldmem(&iter, count, ppos, + cc_platform_has(CC_ATTR_MEM_ENCRYPT)); +@@ -437,7 +437,7 @@ static vm_fault_t mmap_vmcore_fault(struct vm_fault *vmf) + offset = (loff_t) index << PAGE_SHIFT; + kvec.iov_base = page_address(page); + kvec.iov_len = PAGE_SIZE; +- iov_iter_kvec(&iter, READ, &kvec, 1, PAGE_SIZE); ++ iov_iter_kvec(&iter, ITER_DEST, &kvec, 1, PAGE_SIZE); + + rc = __read_vmcore(&iter, &offset); + if (rc < 0) { +diff --git a/fs/read_write.c b/fs/read_write.c +index 24b9668d6377..7a2ff6157eda 100644 +--- a/fs/read_write.c ++++ b/fs/read_write.c +@@ -384,7 +384,7 @@ static ssize_t new_sync_read(struct file *filp, char __user *buf, size_t len, lo + + init_sync_kiocb(&kiocb, filp); + kiocb.ki_pos = (ppos ? *ppos : 0); +- iov_iter_ubuf(&iter, READ, buf, len); ++ iov_iter_ubuf(&iter, ITER_DEST, buf, len); + + ret = call_read_iter(filp, &kiocb, &iter); + BUG_ON(ret == -EIOCBQUEUED); +@@ -424,7 +424,7 @@ ssize_t __kernel_read(struct file *file, void *buf, size_t count, loff_t *pos) + + init_sync_kiocb(&kiocb, file); + kiocb.ki_pos = pos ? *pos : 0; +- iov_iter_kvec(&iter, READ, &iov, 1, iov.iov_len); ++ iov_iter_kvec(&iter, ITER_DEST, &iov, 1, iov.iov_len); + ret = file->f_op->read_iter(&kiocb, &iter); + if (ret > 0) { + if (pos) +@@ -486,7 +486,7 @@ static ssize_t new_sync_write(struct file *filp, const char __user *buf, size_t + + init_sync_kiocb(&kiocb, filp); + kiocb.ki_pos = (ppos ? *ppos : 0); +- iov_iter_ubuf(&iter, WRITE, (void __user *)buf, len); ++ iov_iter_ubuf(&iter, ITER_SOURCE, (void __user *)buf, len); + + ret = call_write_iter(filp, &kiocb, &iter); + BUG_ON(ret == -EIOCBQUEUED); +@@ -533,7 +533,7 @@ ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t + .iov_len = min_t(size_t, count, MAX_RW_COUNT), + }; + struct iov_iter iter; +- iov_iter_kvec(&iter, WRITE, &iov, 1, iov.iov_len); ++ iov_iter_kvec(&iter, ITER_SOURCE, &iov, 1, iov.iov_len); + return __kernel_write_iter(file, &iter, pos); + } + /* +@@ -911,7 +911,7 @@ static ssize_t vfs_readv(struct file *file, const struct iovec __user *vec, + struct iov_iter iter; + ssize_t ret; + +- ret = import_iovec(READ, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter); ++ ret = import_iovec(ITER_DEST, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter); + if (ret >= 0) { + ret = do_iter_read(file, &iter, pos, flags); + kfree(iov); +@@ -928,7 +928,7 @@ static ssize_t vfs_writev(struct file *file, const struct iovec __user *vec, + struct iov_iter iter; + ssize_t ret; + +- ret = import_iovec(WRITE, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter); ++ ret = import_iovec(ITER_SOURCE, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter); + if (ret >= 0) { + file_start_write(file); + ret = do_iter_write(file, &iter, pos, flags); +diff --git a/fs/seq_file.c b/fs/seq_file.c +index 9456a2032224..f5fdaf3b1572 100644 +--- a/fs/seq_file.c ++++ b/fs/seq_file.c +@@ -156,7 +156,7 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos) + ssize_t ret; + + init_sync_kiocb(&kiocb, file); +- iov_iter_init(&iter, READ, &iov, 1, size); ++ iov_iter_init(&iter, ITER_DEST, &iov, 1, size); + + kiocb.ki_pos = *ppos; + ret = seq_read_iter(&kiocb, &iter); +diff --git a/fs/splice.c b/fs/splice.c +index 0878b852b355..5969b7a1d353 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -303,7 +303,7 @@ ssize_t generic_file_splice_read(struct file *in, loff_t *ppos, + struct kiocb kiocb; + int ret; + +- iov_iter_pipe(&to, READ, pipe, len); ++ iov_iter_pipe(&to, ITER_DEST, pipe, len); + init_sync_kiocb(&kiocb, in); + kiocb.ki_pos = *ppos; + ret = call_read_iter(in, &kiocb, &to); +@@ -682,7 +682,7 @@ iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out, + n++; + } + +- iov_iter_bvec(&from, WRITE, array, n, sd.total_len - left); ++ iov_iter_bvec(&from, ITER_SOURCE, array, n, sd.total_len - left); + ret = vfs_iter_write(out, &from, &sd.pos, 0); + if (ret <= 0) + break; +@@ -1263,9 +1263,9 @@ static int vmsplice_type(struct fd f, int *type) + if (!f.file) + return -EBADF; + if (f.file->f_mode & FMODE_WRITE) { +- *type = WRITE; ++ *type = ITER_SOURCE; + } else if (f.file->f_mode & FMODE_READ) { +- *type = READ; ++ *type = ITER_DEST; + } else { + fdput(f); + return -EBADF; +@@ -1314,7 +1314,7 @@ SYSCALL_DEFINE4(vmsplice, int, fd, const struct iovec __user *, uiov, + + if (!iov_iter_count(&iter)) + error = 0; +- else if (iov_iter_rw(&iter) == WRITE) ++ else if (type == ITER_SOURCE) + error = vmsplice_to_pipe(f.file, &iter, flags); + else + error = vmsplice_to_user(f.file, &iter, flags); +diff --git a/include/linux/uio.h b/include/linux/uio.h +index 2e3134b14ffd..87fc3d0dda98 100644 +--- a/include/linux/uio.h ++++ b/include/linux/uio.h +@@ -29,6 +29,9 @@ enum iter_type { + ITER_UBUF, + }; + ++#define ITER_SOURCE 1 // == WRITE ++#define ITER_DEST 0 // == READ ++ + struct iov_iter_state { + size_t iov_offset; + size_t count; +diff --git a/io_uring/net.c b/io_uring/net.c +index 9046e269e5a5..520a73b5a448 100644 +--- a/io_uring/net.c ++++ b/io_uring/net.c +@@ -364,7 +364,7 @@ int io_send(struct io_kiocb *req, unsigned int issue_flags) + if (unlikely(!sock)) + return -ENOTSOCK; + +- ret = import_single_range(WRITE, sr->buf, sr->len, &iov, &msg.msg_iter); ++ ret = import_single_range(ITER_SOURCE, sr->buf, sr->len, &iov, &msg.msg_iter); + if (unlikely(ret)) + return ret; + +@@ -450,7 +450,7 @@ static int __io_recvmsg_copy_hdr(struct io_kiocb *req, + } + } else { + iomsg->free_iov = iomsg->fast_iov; +- ret = __import_iovec(READ, msg.msg_iov, msg.msg_iovlen, UIO_FASTIOV, ++ ret = __import_iovec(ITER_DEST, msg.msg_iov, msg.msg_iovlen, UIO_FASTIOV, + &iomsg->free_iov, &iomsg->msg.msg_iter, + false); + if (ret > 0) +@@ -503,7 +503,7 @@ static int __io_compat_recvmsg_copy_hdr(struct io_kiocb *req, + } + } else { + iomsg->free_iov = iomsg->fast_iov; +- ret = __import_iovec(READ, (struct iovec __user *)uiov, msg.msg_iovlen, ++ ret = __import_iovec(ITER_DEST, (struct iovec __user *)uiov, msg.msg_iovlen, + UIO_FASTIOV, &iomsg->free_iov, + &iomsg->msg.msg_iter, true); + if (ret < 0) +@@ -763,7 +763,7 @@ int io_recvmsg(struct io_kiocb *req, unsigned int issue_flags) + + kmsg->fast_iov[0].iov_base = buf; + kmsg->fast_iov[0].iov_len = len; +- iov_iter_init(&kmsg->msg.msg_iter, READ, kmsg->fast_iov, 1, ++ iov_iter_init(&kmsg->msg.msg_iter, ITER_DEST, kmsg->fast_iov, 1, + len); + } + +@@ -857,7 +857,7 @@ int io_recv(struct io_kiocb *req, unsigned int issue_flags) + sr->buf = buf; + } + +- ret = import_single_range(READ, sr->buf, len, &iov, &msg.msg_iter); ++ ret = import_single_range(ITER_DEST, sr->buf, len, &iov, &msg.msg_iter); + if (unlikely(ret)) + goto out_free; + +@@ -1097,13 +1097,13 @@ int io_send_zc(struct io_kiocb *req, unsigned int issue_flags) + return io_setup_async_addr(req, &__address, issue_flags); + + if (zc->flags & IORING_RECVSEND_FIXED_BUF) { +- ret = io_import_fixed(WRITE, &msg.msg_iter, req->imu, ++ ret = io_import_fixed(ITER_SOURCE, &msg.msg_iter, req->imu, + (u64)(uintptr_t)zc->buf, zc->len); + if (unlikely(ret)) + return ret; + msg.sg_from_iter = io_sg_from_iter; + } else { +- ret = import_single_range(WRITE, zc->buf, zc->len, &iov, ++ ret = import_single_range(ITER_SOURCE, zc->buf, zc->len, &iov, + &msg.msg_iter); + if (unlikely(ret)) + return ret; +diff --git a/io_uring/rw.c b/io_uring/rw.c +index 6223472095d2..0218fae12edd 100644 +--- a/io_uring/rw.c ++++ b/io_uring/rw.c +@@ -548,12 +548,12 @@ static inline int io_rw_prep_async(struct io_kiocb *req, int rw) + + int io_readv_prep_async(struct io_kiocb *req) + { +- return io_rw_prep_async(req, READ); ++ return io_rw_prep_async(req, ITER_DEST); + } + + int io_writev_prep_async(struct io_kiocb *req) + { +- return io_rw_prep_async(req, WRITE); ++ return io_rw_prep_async(req, ITER_SOURCE); + } + + /* +@@ -704,7 +704,7 @@ int io_read(struct io_kiocb *req, unsigned int issue_flags) + loff_t *ppos; + + if (!req_has_async_data(req)) { +- ret = io_import_iovec(READ, req, &iovec, s, issue_flags); ++ ret = io_import_iovec(ITER_DEST, req, &iovec, s, issue_flags); + if (unlikely(ret < 0)) + return ret; + } else { +@@ -716,7 +716,7 @@ int io_read(struct io_kiocb *req, unsigned int issue_flags) + * buffers, as we dropped the selected one before retry. + */ + if (io_do_buffer_select(req)) { +- ret = io_import_iovec(READ, req, &iovec, s, issue_flags); ++ ret = io_import_iovec(ITER_DEST, req, &iovec, s, issue_flags); + if (unlikely(ret < 0)) + return ret; + } +@@ -851,7 +851,7 @@ int io_write(struct io_kiocb *req, unsigned int issue_flags) + loff_t *ppos; + + if (!req_has_async_data(req)) { +- ret = io_import_iovec(WRITE, req, &iovec, s, issue_flags); ++ ret = io_import_iovec(ITER_SOURCE, req, &iovec, s, issue_flags); + if (unlikely(ret < 0)) + return ret; + } else { +diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c +index 9cb53182bb31..908e8a13c675 100644 +--- a/kernel/trace/trace_events_user.c ++++ b/kernel/trace/trace_events_user.c +@@ -1489,7 +1489,7 @@ static ssize_t user_events_write(struct file *file, const char __user *ubuf, + if (unlikely(*ppos != 0)) + return -EFAULT; + +- if (unlikely(import_single_range(WRITE, (char __user *)ubuf, ++ if (unlikely(import_single_range(ITER_SOURCE, (char __user *)ubuf, + count, &iov, &i))) + return -EFAULT; + +diff --git a/mm/madvise.c b/mm/madvise.c +index b913ba6efc10..d03e149ffe6e 100644 +--- a/mm/madvise.c ++++ b/mm/madvise.c +@@ -1459,7 +1459,7 @@ SYSCALL_DEFINE5(process_madvise, int, pidfd, const struct iovec __user *, vec, + goto out; + } + +- ret = import_iovec(READ, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter); ++ ret = import_iovec(ITER_DEST, vec, vlen, ARRAY_SIZE(iovstack), &iov, &iter); + if (ret < 0) + goto out; + +diff --git a/mm/page_io.c b/mm/page_io.c +index 2af34dd8fa4d..3a5f921b932e 100644 +--- a/mm/page_io.c ++++ b/mm/page_io.c +@@ -376,7 +376,7 @@ void swap_write_unplug(struct swap_iocb *sio) + struct address_space *mapping = sio->iocb.ki_filp->f_mapping; + int ret; + +- iov_iter_bvec(&from, WRITE, sio->bvec, sio->pages, sio->len); ++ iov_iter_bvec(&from, ITER_SOURCE, sio->bvec, sio->pages, sio->len); + ret = mapping->a_ops->swap_rw(&sio->iocb, &from); + if (ret != -EIOCBQUEUED) + sio_write_complete(&sio->iocb, ret); +@@ -530,7 +530,7 @@ void __swap_read_unplug(struct swap_iocb *sio) + struct address_space *mapping = sio->iocb.ki_filp->f_mapping; + int ret; + +- iov_iter_bvec(&from, READ, sio->bvec, sio->pages, sio->len); ++ iov_iter_bvec(&from, ITER_DEST, sio->bvec, sio->pages, sio->len); + ret = mapping->a_ops->swap_rw(&sio->iocb, &from); + if (ret != -EIOCBQUEUED) + sio_read_complete(&sio->iocb, ret); +diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c +index 4bcc11958089..78dfaf9e8990 100644 +--- a/mm/process_vm_access.c ++++ b/mm/process_vm_access.c +@@ -263,7 +263,7 @@ static ssize_t process_vm_rw(pid_t pid, + struct iovec *iov_r; + struct iov_iter iter; + ssize_t rc; +- int dir = vm_write ? WRITE : READ; ++ int dir = vm_write ? ITER_SOURCE : ITER_DEST; + + if (flags != 0) + return -EINVAL; +diff --git a/net/9p/client.c b/net/9p/client.c +index b5aa25f82b78..554a4b11f4fe 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -2049,7 +2049,7 @@ int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset) + struct kvec kv = {.iov_base = data, .iov_len = count}; + struct iov_iter to; + +- iov_iter_kvec(&to, READ, &kv, 1, count); ++ iov_iter_kvec(&to, ITER_DEST, &kv, 1, count); + + p9_debug(P9_DEBUG_9P, ">>> TREADDIR fid %d offset %llu count %d\n", + fid->fid, offset, count); +diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c +index c57d643afb10..4eb1b3ced0d2 100644 +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -441,7 +441,7 @@ static int send_pkt(struct l2cap_chan *chan, struct sk_buff *skb, + iv.iov_len = skb->len; + + memset(&msg, 0, sizeof(msg)); +- iov_iter_kvec(&msg.msg_iter, WRITE, &iv, 1, skb->len); ++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iv, 1, skb->len); + + err = l2cap_chan_send(chan, &msg, skb->len); + if (err > 0) { +diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c +index 1fcc482397c3..e7adb8a98cf9 100644 +--- a/net/bluetooth/a2mp.c ++++ b/net/bluetooth/a2mp.c +@@ -56,7 +56,7 @@ static void a2mp_send(struct amp_mgr *mgr, u8 code, u8 ident, u16 len, void *dat + + memset(&msg, 0, sizeof(msg)); + +- iov_iter_kvec(&msg.msg_iter, WRITE, &iv, 1, total_len); ++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iv, 1, total_len); + + l2cap_chan_send(chan, &msg, total_len); + +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index 11f853d0500f..70663229b3cc 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -605,7 +605,7 @@ static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data) + + memset(&msg, 0, sizeof(msg)); + +- iov_iter_kvec(&msg.msg_iter, WRITE, iv, 2, 1 + len); ++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iv, 2, 1 + len); + + l2cap_chan_send(chan, &msg, 1 + len); + +diff --git a/net/ceph/messenger_v1.c b/net/ceph/messenger_v1.c +index 3ddbde87e4d6..d1787d7d33ef 100644 +--- a/net/ceph/messenger_v1.c ++++ b/net/ceph/messenger_v1.c +@@ -30,7 +30,7 @@ static int ceph_tcp_recvmsg(struct socket *sock, void *buf, size_t len) + if (!buf) + msg.msg_flags |= MSG_TRUNC; + +- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, len); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, len); + r = sock_recvmsg(sock, &msg, msg.msg_flags); + if (r == -EAGAIN) + r = 0; +@@ -49,7 +49,7 @@ static int ceph_tcp_recvpage(struct socket *sock, struct page *page, + int r; + + BUG_ON(page_offset + length > PAGE_SIZE); +- iov_iter_bvec(&msg.msg_iter, READ, &bvec, 1, length); ++ iov_iter_bvec(&msg.msg_iter, ITER_DEST, &bvec, 1, length); + r = sock_recvmsg(sock, &msg, msg.msg_flags); + if (r == -EAGAIN) + r = 0; +diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c +index cc8ff81a50b7..3009028c4fa2 100644 +--- a/net/ceph/messenger_v2.c ++++ b/net/ceph/messenger_v2.c +@@ -168,7 +168,7 @@ static int do_try_sendpage(struct socket *sock, struct iov_iter *it) + bv.bv_offset, bv.bv_len, + CEPH_MSG_FLAGS); + } else { +- iov_iter_bvec(&msg.msg_iter, WRITE, &bv, 1, bv.bv_len); ++ iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bv, 1, bv.bv_len); + ret = sock_sendmsg(sock, &msg); + } + if (ret <= 0) { +@@ -225,7 +225,7 @@ static void reset_in_kvecs(struct ceph_connection *con) + WARN_ON(iov_iter_count(&con->v2.in_iter)); + + con->v2.in_kvec_cnt = 0; +- iov_iter_kvec(&con->v2.in_iter, READ, con->v2.in_kvecs, 0, 0); ++ iov_iter_kvec(&con->v2.in_iter, ITER_DEST, con->v2.in_kvecs, 0, 0); + } + + static void set_in_bvec(struct ceph_connection *con, const struct bio_vec *bv) +@@ -233,7 +233,7 @@ static void set_in_bvec(struct ceph_connection *con, const struct bio_vec *bv) + WARN_ON(iov_iter_count(&con->v2.in_iter)); + + con->v2.in_bvec = *bv; +- iov_iter_bvec(&con->v2.in_iter, READ, &con->v2.in_bvec, 1, bv->bv_len); ++ iov_iter_bvec(&con->v2.in_iter, ITER_DEST, &con->v2.in_bvec, 1, bv->bv_len); + } + + static void set_in_skip(struct ceph_connection *con, int len) +@@ -241,7 +241,7 @@ static void set_in_skip(struct ceph_connection *con, int len) + WARN_ON(iov_iter_count(&con->v2.in_iter)); + + dout("%s con %p len %d\n", __func__, con, len); +- iov_iter_discard(&con->v2.in_iter, READ, len); ++ iov_iter_discard(&con->v2.in_iter, ITER_DEST, len); + } + + static void add_out_kvec(struct ceph_connection *con, void *buf, int len) +@@ -265,7 +265,7 @@ static void reset_out_kvecs(struct ceph_connection *con) + + con->v2.out_kvec_cnt = 0; + +- iov_iter_kvec(&con->v2.out_iter, WRITE, con->v2.out_kvecs, 0, 0); ++ iov_iter_kvec(&con->v2.out_iter, ITER_SOURCE, con->v2.out_kvecs, 0, 0); + con->v2.out_iter_sendpage = false; + } + +@@ -277,7 +277,7 @@ static void set_out_bvec(struct ceph_connection *con, const struct bio_vec *bv, + + con->v2.out_bvec = *bv; + con->v2.out_iter_sendpage = zerocopy; +- iov_iter_bvec(&con->v2.out_iter, WRITE, &con->v2.out_bvec, 1, ++ iov_iter_bvec(&con->v2.out_iter, ITER_SOURCE, &con->v2.out_bvec, 1, + con->v2.out_bvec.bv_len); + } + +@@ -290,7 +290,7 @@ static void set_out_bvec_zero(struct ceph_connection *con) + con->v2.out_bvec.bv_offset = 0; + con->v2.out_bvec.bv_len = min(con->v2.out_zero, (int)PAGE_SIZE); + con->v2.out_iter_sendpage = true; +- iov_iter_bvec(&con->v2.out_iter, WRITE, &con->v2.out_bvec, 1, ++ iov_iter_bvec(&con->v2.out_iter, ITER_SOURCE, &con->v2.out_bvec, 1, + con->v2.out_bvec.bv_len); + } + +diff --git a/net/compat.c b/net/compat.c +index 385f04a6be2f..161b7bea1f62 100644 +--- a/net/compat.c ++++ b/net/compat.c +@@ -95,7 +95,8 @@ int get_compat_msghdr(struct msghdr *kmsg, + if (err) + return err; + +- err = import_iovec(save_addr ? READ : WRITE, compat_ptr(msg.msg_iov), msg.msg_iovlen, ++ err = import_iovec(save_addr ? ITER_DEST : ITER_SOURCE, ++ compat_ptr(msg.msg_iov), msg.msg_iovlen, + UIO_FASTIOV, iov, &kmsg->msg_iter); + return err < 0 ? err : 0; + } +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index ec19ed722453..6667c3538f2a 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2001,7 +2001,7 @@ static int receive_fallback_to_copy(struct sock *sk, + if (copy_address != zc->copybuf_address) + return -EINVAL; + +- err = import_single_range(READ, (void __user *)copy_address, ++ err = import_single_range(ITER_DEST, (void __user *)copy_address, + inq, &iov, &msg.msg_iter); + if (err) + return err; +@@ -2035,7 +2035,7 @@ static int tcp_copy_straggler_data(struct tcp_zerocopy_receive *zc, + if (copy_address != zc->copybuf_address) + return -EINVAL; + +- err = import_single_range(READ, (void __user *)copy_address, ++ err = import_single_range(ITER_DEST, (void __user *)copy_address, + copylen, &iov, &msg.msg_iter); + if (err) + return err; +diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c +index a56fd0b5a430..4963fec815da 100644 +--- a/net/netfilter/ipvs/ip_vs_sync.c ++++ b/net/netfilter/ipvs/ip_vs_sync.c +@@ -1617,7 +1617,7 @@ ip_vs_receive(struct socket *sock, char *buffer, const size_t buflen) + EnterFunction(7); + + /* Receive a packet */ +- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, buflen); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, buflen); + len = sock_recvmsg(sock, &msg, MSG_DONTWAIT); + if (len < 0) + return len; +diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c +index 1472f31480d8..dfb9797f7bc6 100644 +--- a/net/smc/smc_clc.c ++++ b/net/smc/smc_clc.c +@@ -673,7 +673,7 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen, + */ + krflags = MSG_PEEK | MSG_WAITALL; + clc_sk->sk_rcvtimeo = timeout; +- iov_iter_kvec(&msg.msg_iter, READ, &vec, 1, ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &vec, 1, + sizeof(struct smc_clc_msg_hdr)); + len = sock_recvmsg(smc->clcsock, &msg, krflags); + if (signal_pending(current)) { +@@ -720,7 +720,7 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen, + } else { + recvlen = datlen; + } +- iov_iter_kvec(&msg.msg_iter, READ, &vec, 1, recvlen); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &vec, 1, recvlen); + krflags = MSG_WAITALL; + len = sock_recvmsg(smc->clcsock, &msg, krflags); + if (len < recvlen || !smc_clc_msg_hdr_valid(clcm, check_trl)) { +@@ -737,7 +737,7 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen, + /* receive remaining proposal message */ + recvlen = datlen > SMC_CLC_RECV_BUF_LEN ? + SMC_CLC_RECV_BUF_LEN : datlen; +- iov_iter_kvec(&msg.msg_iter, READ, &vec, 1, recvlen); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &vec, 1, recvlen); + len = sock_recvmsg(smc->clcsock, &msg, krflags); + datlen -= len; + } +diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c +index 64dedffe9d26..f4b6a71ac488 100644 +--- a/net/smc/smc_tx.c ++++ b/net/smc/smc_tx.c +@@ -308,7 +308,7 @@ int smc_tx_sendpage(struct smc_sock *smc, struct page *page, int offset, + + iov.iov_base = kaddr + offset; + iov.iov_len = size; +- iov_iter_kvec(&msg.msg_iter, WRITE, &iov, 1, size); ++ iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iov, 1, size); + rc = smc_tx_sendmsg(smc, &msg, size); + kunmap(page); + return rc; +diff --git a/net/socket.c b/net/socket.c +index 00da9ce3dba0..73463c7c3702 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -750,7 +750,7 @@ EXPORT_SYMBOL(sock_sendmsg); + int kernel_sendmsg(struct socket *sock, struct msghdr *msg, + struct kvec *vec, size_t num, size_t size) + { +- iov_iter_kvec(&msg->msg_iter, WRITE, vec, num, size); ++ iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, vec, num, size); + return sock_sendmsg(sock, msg); + } + EXPORT_SYMBOL(kernel_sendmsg); +@@ -776,7 +776,7 @@ int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg, + if (!sock->ops->sendmsg_locked) + return sock_no_sendmsg_locked(sk, msg, size); + +- iov_iter_kvec(&msg->msg_iter, WRITE, vec, num, size); ++ iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, vec, num, size); + + return sock->ops->sendmsg_locked(sk, msg, msg_data_left(msg)); + } +@@ -1034,7 +1034,7 @@ int kernel_recvmsg(struct socket *sock, struct msghdr *msg, + struct kvec *vec, size_t num, size_t size, int flags) + { + msg->msg_control_is_user = false; +- iov_iter_kvec(&msg->msg_iter, READ, vec, num, size); ++ iov_iter_kvec(&msg->msg_iter, ITER_DEST, vec, num, size); + return sock_recvmsg(sock, msg, flags); + } + EXPORT_SYMBOL(kernel_recvmsg); +@@ -2092,7 +2092,7 @@ int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags, + struct iovec iov; + int fput_needed; + +- err = import_single_range(WRITE, buff, len, &iov, &msg.msg_iter); ++ err = import_single_range(ITER_SOURCE, buff, len, &iov, &msg.msg_iter); + if (unlikely(err)) + return err; + sock = sockfd_lookup_light(fd, &err, &fput_needed); +@@ -2157,7 +2157,7 @@ int __sys_recvfrom(int fd, void __user *ubuf, size_t size, unsigned int flags, + int err, err2; + int fput_needed; + +- err = import_single_range(READ, ubuf, size, &iov, &msg.msg_iter); ++ err = import_single_range(ITER_DEST, ubuf, size, &iov, &msg.msg_iter); + if (unlikely(err)) + return err; + sock = sockfd_lookup_light(fd, &err, &fput_needed); +@@ -2417,7 +2417,7 @@ static int copy_msghdr_from_user(struct msghdr *kmsg, + if (err) + return err; + +- err = import_iovec(save_addr ? READ : WRITE, ++ err = import_iovec(save_addr ? ITER_DEST : ITER_SOURCE, + msg.msg_iov, msg.msg_iovlen, + UIO_FASTIOV, iov, &kmsg->msg_iter); + return err < 0 ? err : 0; +diff --git a/net/sunrpc/socklib.c b/net/sunrpc/socklib.c +index 71ba4cf513bc..1b2b84feeec6 100644 +--- a/net/sunrpc/socklib.c ++++ b/net/sunrpc/socklib.c +@@ -214,14 +214,14 @@ static inline int xprt_sendmsg(struct socket *sock, struct msghdr *msg, + static int xprt_send_kvec(struct socket *sock, struct msghdr *msg, + struct kvec *vec, size_t seek) + { +- iov_iter_kvec(&msg->msg_iter, WRITE, vec, 1, vec->iov_len); ++ iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, vec, 1, vec->iov_len); + return xprt_sendmsg(sock, msg, seek); + } + + static int xprt_send_pagedata(struct socket *sock, struct msghdr *msg, + struct xdr_buf *xdr, size_t base) + { +- iov_iter_bvec(&msg->msg_iter, WRITE, xdr->bvec, xdr_buf_pagecount(xdr), ++ iov_iter_bvec(&msg->msg_iter, ITER_SOURCE, xdr->bvec, xdr_buf_pagecount(xdr), + xdr->page_len + xdr->page_base); + return xprt_sendmsg(sock, msg, base + xdr->page_base); + } +@@ -244,7 +244,7 @@ static int xprt_send_rm_and_kvec(struct socket *sock, struct msghdr *msg, + }; + size_t len = iov[0].iov_len + iov[1].iov_len; + +- iov_iter_kvec(&msg->msg_iter, WRITE, iov, 2, len); ++ iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, iov, 2, len); + return xprt_sendmsg(sock, msg, base); + } + +diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c +index e833103f4629..815baf308236 100644 +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -260,7 +260,7 @@ static ssize_t svc_tcp_read_msg(struct svc_rqst *rqstp, size_t buflen, + rqstp->rq_respages = &rqstp->rq_pages[i]; + rqstp->rq_next_page = rqstp->rq_respages + 1; + +- iov_iter_bvec(&msg.msg_iter, READ, bvec, i, buflen); ++ iov_iter_bvec(&msg.msg_iter, ITER_DEST, bvec, i, buflen); + if (seek) { + iov_iter_advance(&msg.msg_iter, seek); + buflen -= seek; +@@ -874,7 +874,7 @@ static ssize_t svc_tcp_read_marker(struct svc_sock *svsk, + want = sizeof(rpc_fraghdr) - svsk->sk_tcplen; + iov.iov_base = ((char *)&svsk->sk_marker) + svsk->sk_tcplen; + iov.iov_len = want; +- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, want); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, want); + len = sock_recvmsg(svsk->sk_sock, &msg, MSG_DONTWAIT); + if (len < 0) + return len; +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 915b9902f673..b3ab6d9d752e 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -364,7 +364,7 @@ static ssize_t + xs_read_kvec(struct socket *sock, struct msghdr *msg, int flags, + struct kvec *kvec, size_t count, size_t seek) + { +- iov_iter_kvec(&msg->msg_iter, READ, kvec, 1, count); ++ iov_iter_kvec(&msg->msg_iter, ITER_DEST, kvec, 1, count); + return xs_sock_recvmsg(sock, msg, flags, seek); + } + +@@ -373,7 +373,7 @@ xs_read_bvec(struct socket *sock, struct msghdr *msg, int flags, + struct bio_vec *bvec, unsigned long nr, size_t count, + size_t seek) + { +- iov_iter_bvec(&msg->msg_iter, READ, bvec, nr, count); ++ iov_iter_bvec(&msg->msg_iter, ITER_DEST, bvec, nr, count); + return xs_sock_recvmsg(sock, msg, flags, seek); + } + +@@ -381,7 +381,7 @@ static ssize_t + xs_read_discard(struct socket *sock, struct msghdr *msg, int flags, + size_t count) + { +- iov_iter_discard(&msg->msg_iter, READ, count); ++ iov_iter_discard(&msg->msg_iter, ITER_DEST, count); + return sock_recvmsg(sock, msg, flags); + } + +diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c +index e3b427a70398..69c88cc03887 100644 +--- a/net/tipc/topsrv.c ++++ b/net/tipc/topsrv.c +@@ -396,7 +396,7 @@ static int tipc_conn_rcv_from_sock(struct tipc_conn *con) + iov.iov_base = &s; + iov.iov_len = sizeof(s); + msg.msg_name = NULL; +- iov_iter_kvec(&msg.msg_iter, READ, &iov, 1, iov.iov_len); ++ iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, iov.iov_len); + ret = sock_recvmsg(con->sock, &msg, MSG_DONTWAIT); + if (ret == -EWOULDBLOCK) + return -EWOULDBLOCK; +diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c +index a03d66046ca3..6c593788dc25 100644 +--- a/net/tls/tls_device.c ++++ b/net/tls/tls_device.c +@@ -620,7 +620,7 @@ int tls_device_sendpage(struct sock *sk, struct page *page, + kaddr = kmap(page); + iov.iov_base = kaddr + offset; + iov.iov_len = size; +- iov_iter_kvec(&msg_iter, WRITE, &iov, 1, size); ++ iov_iter_kvec(&msg_iter, ITER_SOURCE, &iov, 1, size); + iter_offset.msg_iter = &msg_iter; + rc = tls_push_data(sk, iter_offset, size, flags, TLS_RECORD_TYPE_DATA, + NULL); +@@ -697,7 +697,7 @@ static int tls_device_push_pending_record(struct sock *sk, int flags) + union tls_iter_offset iter; + struct iov_iter msg_iter; + +- iov_iter_kvec(&msg_iter, WRITE, NULL, 0, 0); ++ iov_iter_kvec(&msg_iter, ITER_SOURCE, NULL, 0, 0); + iter.msg_iter = &msg_iter; + return tls_push_data(sk, iter, 0, flags, TLS_RECORD_TYPE_DATA, NULL); + } +diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c +index 29a540dcb5a7..d6fece1ed982 100644 +--- a/net/xfrm/espintcp.c ++++ b/net/xfrm/espintcp.c +@@ -354,7 +354,7 @@ static int espintcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + *((__be16 *)buf) = cpu_to_be16(msglen); + pfx_iov.iov_base = buf; + pfx_iov.iov_len = sizeof(buf); +- iov_iter_kvec(&pfx_iter, WRITE, &pfx_iov, 1, pfx_iov.iov_len); ++ iov_iter_kvec(&pfx_iter, ITER_SOURCE, &pfx_iov, 1, pfx_iov.iov_len); + + err = sk_msg_memcopy_from_iter(sk, &pfx_iter, &emsg->skmsg, + pfx_iov.iov_len); +diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c +index 96a92a645216..d54f73c558f7 100644 +--- a/security/keys/keyctl.c ++++ b/security/keys/keyctl.c +@@ -1251,7 +1251,7 @@ long keyctl_instantiate_key(key_serial_t id, + struct iov_iter from; + int ret; + +- ret = import_single_range(WRITE, (void __user *)_payload, plen, ++ ret = import_single_range(ITER_SOURCE, (void __user *)_payload, plen, + &iov, &from); + if (unlikely(ret)) + return ret; +@@ -1283,7 +1283,7 @@ long keyctl_instantiate_key_iov(key_serial_t id, + if (!_payload_iov) + ioc = 0; + +- ret = import_iovec(WRITE, _payload_iov, ioc, ++ ret = import_iovec(ITER_SOURCE, _payload_iov, ioc, + ARRAY_SIZE(iovstack), &iov, &from); + if (ret < 0) + return ret; +-- +2.39.0 + diff --git a/queue-6.1/vhost-net-clear-the-pending-messages-when-the-backen.patch b/queue-6.1/vhost-net-clear-the-pending-messages-when-the-backen.patch new file mode 100644 index 00000000000..7e731ca5f99 --- /dev/null +++ b/queue-6.1/vhost-net-clear-the-pending-messages-when-the-backen.patch @@ -0,0 +1,83 @@ +From ffdce1a03982125ecd4366c554222e8293827192 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 10:15:18 -0500 +Subject: vhost/net: Clear the pending messages when the backend is removed + +From: Eric Auger + +[ Upstream commit 9526f9a2b762af16be94a72aca5d65c677d28f50 ] + +When the vhost iotlb is used along with a guest virtual iommu +and the guest gets rebooted, some MISS messages may have been +recorded just before the reboot and spuriously executed by +the virtual iommu after the reboot. + +As vhost does not have any explicit reset user API, +VHOST_NET_SET_BACKEND looks a reasonable point where to clear +the pending messages, in case the backend is removed. + +Export vhost_clear_msg() and call it in vhost_net_set_backend() +when fd == -1. + +Signed-off-by: Eric Auger +Suggested-by: Jason Wang +Fixes: 6b1e6cc7855b0 ("vhost: new device IOTLB API") +Message-Id: <20230117151518.44725-3-eric.auger@redhat.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/net.c | 3 +++ + drivers/vhost/vhost.c | 3 ++- + drivers/vhost/vhost.h | 1 + + 3 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index 20265393aee7..c7e44d818252 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -1511,6 +1511,9 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd) + nvq = &n->vqs[index]; + mutex_lock(&vq->mutex); + ++ if (fd == -1) ++ vhost_clear_msg(&n->dev); ++ + /* Verify that ring has been setup correctly. */ + if (!vhost_vq_access_ok(vq)) { + r = -EFAULT; +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 3c2359570df9..547f89a6940f 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -661,7 +661,7 @@ void vhost_dev_stop(struct vhost_dev *dev) + } + EXPORT_SYMBOL_GPL(vhost_dev_stop); + +-static void vhost_clear_msg(struct vhost_dev *dev) ++void vhost_clear_msg(struct vhost_dev *dev) + { + struct vhost_msg_node *node, *n; + +@@ -679,6 +679,7 @@ static void vhost_clear_msg(struct vhost_dev *dev) + + spin_unlock(&dev->iotlb_lock); + } ++EXPORT_SYMBOL_GPL(vhost_clear_msg); + + void vhost_dev_cleanup(struct vhost_dev *dev) + { +diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h +index d9109107af08..790b296271f1 100644 +--- a/drivers/vhost/vhost.h ++++ b/drivers/vhost/vhost.h +@@ -181,6 +181,7 @@ long vhost_dev_ioctl(struct vhost_dev *, unsigned int ioctl, void __user *argp); + long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp); + bool vhost_vq_access_ok(struct vhost_virtqueue *vq); + bool vhost_log_access_ok(struct vhost_dev *); ++void vhost_clear_msg(struct vhost_dev *dev); + + int vhost_get_vq_desc(struct vhost_virtqueue *, + struct iovec iov[], unsigned int iov_count, +-- +2.39.0 + diff --git a/queue-6.1/vhost-scsi-unbreak-any-layout-for-response.patch b/queue-6.1/vhost-scsi-unbreak-any-layout-for-response.patch new file mode 100644 index 00000000000..fe679467110 --- /dev/null +++ b/queue-6.1/vhost-scsi-unbreak-any-layout-for-response.patch @@ -0,0 +1,156 @@ +From 1a6bdb0367212bf6933a977318e07cf8a9eedf33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 15:36:47 +0800 +Subject: vhost-scsi: unbreak any layout for response + +From: Jason Wang + +[ Upstream commit 6dd88fd59da84631b5fe5c8176931c38cfa3b265 ] + +Al Viro said: + +""" +Since "vhost/scsi: fix reuse of &vq->iov[out] in response" +we have this: + cmd->tvc_resp_iov = vq->iov[vc.out]; + cmd->tvc_in_iovs = vc.in; +combined with + iov_iter_init(&iov_iter, ITER_DEST, &cmd->tvc_resp_iov, + cmd->tvc_in_iovs, sizeof(v_rsp)); +in vhost_scsi_complete_cmd_work(). We used to have ->tvc_resp_iov +_pointing_ to vq->iov[vc.out]; back then iov_iter_init() asked to +set an iovec-backed iov_iter over the tail of vq->iov[], with +length being the amount of iovecs in the tail. + +Now we have a copy of one element of that array. Fortunately, the members +following it in the containing structure are two non-NULL kernel pointers, +so copy_to_iter() will not copy anything beyond the first iovec - kernel +pointer is not (on the majority of architectures) going to be accepted by +access_ok() in copyout() and it won't be skipped since the "length" (in +reality - another non-NULL kernel pointer) won't be zero. + +So it's not going to give a guest-to-qemu escalation, but it's definitely +a bug. Frankly, my preference would be to verify that the very first iovec +is long enough to hold rsp_size. Due to the above, any users that try to +give us vq->iov[vc.out].iov_len < sizeof(struct virtio_scsi_cmd_resp) +would currently get a failure in vhost_scsi_complete_cmd_work() +anyway. +""" + +However, the spec doesn't say anything about the legacy descriptor +layout for the respone. So this patch tries to not assume the response +to reside in a single separate descriptor which is what commit +79c14141a487 ("vhost/scsi: Convert completion path to use") tries to +achieve towards to ANY_LAYOUT. + +This is done by allocating and using dedicate resp iov in the +command. To be safety, start with UIO_MAXIOV to be consistent with the +limitation that we advertise to the vhost_get_vq_desc(). + +Testing with the hacked virtio-scsi driver that use 1 descriptor for 1 +byte in the response. + +Reported-by: Al Viro +Cc: Benjamin Coddington +Cc: Nicholas Bellinger +Fixes: a77ec83a5789 ("vhost/scsi: fix reuse of &vq->iov[out] in response") +Signed-off-by: Jason Wang +Message-Id: <20230119073647.76467-1-jasowang@redhat.com> +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Stefan Hajnoczi +Signed-off-by: Sasha Levin +--- + drivers/vhost/scsi.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index dca6346d75b3..d5ecb8876fc9 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -80,7 +80,7 @@ struct vhost_scsi_cmd { + struct scatterlist *tvc_prot_sgl; + struct page **tvc_upages; + /* Pointer to response header iovec */ +- struct iovec tvc_resp_iov; ++ struct iovec *tvc_resp_iov; + /* Pointer to vhost_scsi for our device */ + struct vhost_scsi *tvc_vhost; + /* Pointer to vhost_virtqueue for the cmd */ +@@ -563,7 +563,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) + memcpy(v_rsp.sense, cmd->tvc_sense_buf, + se_cmd->scsi_sense_length); + +- iov_iter_init(&iov_iter, ITER_DEST, &cmd->tvc_resp_iov, ++ iov_iter_init(&iov_iter, ITER_DEST, cmd->tvc_resp_iov, + cmd->tvc_in_iovs, sizeof(v_rsp)); + ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter); + if (likely(ret == sizeof(v_rsp))) { +@@ -594,6 +594,7 @@ vhost_scsi_get_cmd(struct vhost_virtqueue *vq, struct vhost_scsi_tpg *tpg, + struct vhost_scsi_cmd *cmd; + struct vhost_scsi_nexus *tv_nexus; + struct scatterlist *sg, *prot_sg; ++ struct iovec *tvc_resp_iov; + struct page **pages; + int tag; + +@@ -613,6 +614,7 @@ vhost_scsi_get_cmd(struct vhost_virtqueue *vq, struct vhost_scsi_tpg *tpg, + sg = cmd->tvc_sgl; + prot_sg = cmd->tvc_prot_sgl; + pages = cmd->tvc_upages; ++ tvc_resp_iov = cmd->tvc_resp_iov; + memset(cmd, 0, sizeof(*cmd)); + cmd->tvc_sgl = sg; + cmd->tvc_prot_sgl = prot_sg; +@@ -625,6 +627,7 @@ vhost_scsi_get_cmd(struct vhost_virtqueue *vq, struct vhost_scsi_tpg *tpg, + cmd->tvc_data_direction = data_direction; + cmd->tvc_nexus = tv_nexus; + cmd->inflight = vhost_scsi_get_inflight(vq); ++ cmd->tvc_resp_iov = tvc_resp_iov; + + memcpy(cmd->tvc_cdb, cdb, VHOST_SCSI_MAX_CDB_SIZE); + +@@ -935,7 +938,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + struct iov_iter in_iter, prot_iter, data_iter; + u64 tag; + u32 exp_data_len, data_direction; +- int ret, prot_bytes, c = 0; ++ int ret, prot_bytes, i, c = 0; + u16 lun; + u8 task_attr; + bool t10_pi = vhost_has_feature(vq, VIRTIO_SCSI_F_T10_PI); +@@ -1092,7 +1095,8 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + } + cmd->tvc_vhost = vs; + cmd->tvc_vq = vq; +- cmd->tvc_resp_iov = vq->iov[vc.out]; ++ for (i = 0; i < vc.in ; i++) ++ cmd->tvc_resp_iov[i] = vq->iov[vc.out + i]; + cmd->tvc_in_iovs = vc.in; + + pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n", +@@ -1461,6 +1465,7 @@ static void vhost_scsi_destroy_vq_cmds(struct vhost_virtqueue *vq) + kfree(tv_cmd->tvc_sgl); + kfree(tv_cmd->tvc_prot_sgl); + kfree(tv_cmd->tvc_upages); ++ kfree(tv_cmd->tvc_resp_iov); + } + + sbitmap_free(&svq->scsi_tags); +@@ -1508,6 +1513,14 @@ static int vhost_scsi_setup_vq_cmds(struct vhost_virtqueue *vq, int max_cmds) + goto out; + } + ++ tv_cmd->tvc_resp_iov = kcalloc(UIO_MAXIOV, ++ sizeof(struct iovec), ++ GFP_KERNEL); ++ if (!tv_cmd->tvc_resp_iov) { ++ pr_err("Unable to allocate tv_cmd->tvc_resp_iov\n"); ++ goto out; ++ } ++ + tv_cmd->tvc_prot_sgl = kcalloc(VHOST_SCSI_PREALLOC_PROT_SGLS, + sizeof(struct scatterlist), + GFP_KERNEL); +-- +2.39.0 + diff --git a/queue-6.1/virtio-net-execute-xdp_do_flush-before-napi_complete.patch b/queue-6.1/virtio-net-execute-xdp_do_flush-before-napi_complete.patch new file mode 100644 index 00000000000..a7dbeaa59e4 --- /dev/null +++ b/queue-6.1/virtio-net-execute-xdp_do_flush-before-napi_complete.patch @@ -0,0 +1,63 @@ +From cca121f877e2848b274c2b736d3641176f96a38f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 08:48:59 +0100 +Subject: virtio-net: execute xdp_do_flush() before napi_complete_done() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Magnus Karlsson + +[ Upstream commit ad7e615f646c9b5b2cf655cdfb9d91a28db4f25a ] + +Make sure that xdp_do_flush() is always executed before +napi_complete_done(). This is important for two reasons. First, a +redirect to an XSKMAP assumes that a call to xdp_do_redirect() from +napi context X on CPU Y will be followed by a xdp_do_flush() from the +same napi context and CPU. This is not guaranteed if the +napi_complete_done() is executed before xdp_do_flush(), as it tells +the napi logic that it is fine to schedule napi context X on another +CPU. Details from a production system triggering this bug using the +veth driver can be found following the first link below. + +The second reason is that the XDP_REDIRECT logic in itself relies on +being inside a single NAPI instance through to the xdp_do_flush() call +for RCU protection of all in-kernel data structures. Details can be +found in the second link below. + +Fixes: 186b3c998c50 ("virtio-net: support XDP_REDIRECT") +Signed-off-by: Magnus Karlsson +Acked-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/r/20221220185903.1105011-1-sbohrer@cloudflare.com +Link: https://lore.kernel.org/all/20210624160609.292325-1-toke@redhat.com/ +Acked-by: Michael S. Tsirkin +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 3cd15f16090f..ec388932aacf 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -1673,13 +1673,13 @@ static int virtnet_poll(struct napi_struct *napi, int budget) + + received = virtnet_receive(rq, budget, &xdp_xmit); + ++ if (xdp_xmit & VIRTIO_XDP_REDIR) ++ xdp_do_flush(); ++ + /* Out of packets? */ + if (received < budget) + virtqueue_napi_complete(napi, rq->vq, received); + +- if (xdp_xmit & VIRTIO_XDP_REDIR) +- xdp_do_flush(); +- + if (xdp_xmit & VIRTIO_XDP_TX) { + sq = virtnet_xdp_get_sq(vi); + if (virtqueue_kick_prepare(sq->vq) && virtqueue_notify(sq->vq)) { +-- +2.39.0 + diff --git a/queue-6.1/virtio-net-keep-stop-to-follow-mirror-sequence-of-op.patch b/queue-6.1/virtio-net-keep-stop-to-follow-mirror-sequence-of-op.patch new file mode 100644 index 00000000000..a6c899026fd --- /dev/null +++ b/queue-6.1/virtio-net-keep-stop-to-follow-mirror-sequence-of-op.patch @@ -0,0 +1,44 @@ +From b6da8e5ba0f2c75c0573324143ab49c613f0dc3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 18:35:16 +0200 +Subject: virtio-net: Keep stop() to follow mirror sequence of open() + +From: Parav Pandit + +[ Upstream commit 63b114042d8a9c02d9939889177c36dbdb17a588 ] + +Cited commit in fixes tag frees rxq xdp info while RQ NAPI is +still enabled and packet processing may be ongoing. + +Follow the mirror sequence of open() in the stop() callback. +This ensures that when rxq info is unregistered, no rx +packet processing is ongoing. + +Fixes: 754b8a21a96d ("virtio_net: setup xdp_rxq_info") +Acked-by: Michael S. Tsirkin +Reviewed-by: Jiri Pirko +Signed-off-by: Parav Pandit +Link: https://lore.kernel.org/r/20230202163516.12559-1-parav@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index ec388932aacf..20b1b34a092a 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -2154,8 +2154,8 @@ static int virtnet_close(struct net_device *dev) + cancel_delayed_work_sync(&vi->refill); + + for (i = 0; i < vi->max_queue_pairs; i++) { +- xdp_rxq_info_unreg(&vi->rq[i].xdp_rxq); + napi_disable(&vi->rq[i].napi); ++ xdp_rxq_info_unreg(&vi->rq[i].xdp_rxq); + virtnet_napi_tx_disable(&vi->sq[i].napi); + } + +-- +2.39.0 + diff --git a/queue-6.1/write-is-data-source-not-destination.patch b/queue-6.1/write-is-data-source-not-destination.patch new file mode 100644 index 00000000000..c08520055af --- /dev/null +++ b/queue-6.1/write-is-data-source-not-destination.patch @@ -0,0 +1,50 @@ +From ab7f76c6e16405503753ac5f7c701d52491a85fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 18:59:12 -0400 +Subject: WRITE is "data source", not destination... + +From: Al Viro + +[ Upstream commit 974c36fb828aeae7b4f9063f94860ae6c5633efd ] + +Signed-off-by: Al Viro +Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response") +Signed-off-by: Sasha Levin +--- + drivers/fsi/fsi-sbefifo.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c +index 5f93a53846aa..efd4942aa043 100644 +--- a/drivers/fsi/fsi-sbefifo.c ++++ b/drivers/fsi/fsi-sbefifo.c +@@ -659,7 +659,7 @@ static void sbefifo_collect_async_ffdc(struct sbefifo *sbefifo) + } + ffdc_iov.iov_base = ffdc; + ffdc_iov.iov_len = SBEFIFO_MAX_FFDC_SIZE; +- iov_iter_kvec(&ffdc_iter, WRITE, &ffdc_iov, 1, SBEFIFO_MAX_FFDC_SIZE); ++ iov_iter_kvec(&ffdc_iter, READ, &ffdc_iov, 1, SBEFIFO_MAX_FFDC_SIZE); + cmd[0] = cpu_to_be32(2); + cmd[1] = cpu_to_be32(SBEFIFO_CMD_GET_SBE_FFDC); + rc = sbefifo_do_command(sbefifo, cmd, 2, &ffdc_iter); +@@ -756,7 +756,7 @@ int sbefifo_submit(struct device *dev, const __be32 *command, size_t cmd_len, + rbytes = (*resp_len) * sizeof(__be32); + resp_iov.iov_base = response; + resp_iov.iov_len = rbytes; +- iov_iter_kvec(&resp_iter, WRITE, &resp_iov, 1, rbytes); ++ iov_iter_kvec(&resp_iter, READ, &resp_iov, 1, rbytes); + + /* Perform the command */ + rc = mutex_lock_interruptible(&sbefifo->lock); +@@ -839,7 +839,7 @@ static ssize_t sbefifo_user_read(struct file *file, char __user *buf, + /* Prepare iov iterator */ + resp_iov.iov_base = buf; + resp_iov.iov_len = len; +- iov_iter_init(&resp_iter, WRITE, &resp_iov, 1, len); ++ iov_iter_init(&resp_iter, READ, &resp_iov, 1, len); + + /* Perform the command */ + rc = mutex_lock_interruptible(&sbefifo->lock); +-- +2.39.0 + diff --git a/queue-6.1/x86-aperfmperf-erase-stale-arch_freq_scale-values-wh.patch b/queue-6.1/x86-aperfmperf-erase-stale-arch_freq_scale-values-wh.patch new file mode 100644 index 00000000000..ad1ae9dcfcc --- /dev/null +++ b/queue-6.1/x86-aperfmperf-erase-stale-arch_freq_scale-values-wh.patch @@ -0,0 +1,53 @@ +From f301d10133763f73069e2d213bb72acd10ca191d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 18:02:06 +0200 +Subject: x86/aperfmperf: Erase stale arch_freq_scale values when disabling + frequency invariance readings + +From: Yair Podemsky + +[ Upstream commit 5f5cc9ed992cbab6361f198966f0edba5fc52688 ] + +Once disable_freq_invariance_work is called the scale_freq_tick function +will not compute or update the arch_freq_scale values. +However the scheduler will still read these values and use them. +The result is that the scheduler might perform unfair decisions based on stale +values. + +This patch adds the step of setting the arch_freq_scale values for all +cpus to the default (max) value SCHED_CAPACITY_SCALE, Once all cpus +have the same arch_freq_scale value the scaling is meaningless. + +Signed-off-by: Yair Podemsky +Signed-off-by: Ingo Molnar +Acked-by: Peter Zijlstra +Link: https://lore.kernel.org/r/20230110160206.75912-1-ypodemsk@redhat.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/aperfmperf.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/x86/kernel/cpu/aperfmperf.c b/arch/x86/kernel/cpu/aperfmperf.c +index 1f60a2b27936..fdbb5f07448f 100644 +--- a/arch/x86/kernel/cpu/aperfmperf.c ++++ b/arch/x86/kernel/cpu/aperfmperf.c +@@ -330,7 +330,16 @@ static void __init bp_init_freq_invariance(void) + + static void disable_freq_invariance_workfn(struct work_struct *work) + { ++ int cpu; ++ + static_branch_disable(&arch_scale_freq_key); ++ ++ /* ++ * Set arch_freq_scale to a default value on all cpus ++ * This negates the effect of scaling ++ */ ++ for_each_possible_cpu(cpu) ++ per_cpu(arch_freq_scale, cpu) = SCHED_CAPACITY_SCALE; + } + + static DECLARE_WORK(disable_freq_invariance_work, +-- +2.39.0 + diff --git a/queue-6.1/x86-build-move-mindirect-branch-cs-prefix-out-of-gcc.patch b/queue-6.1/x86-build-move-mindirect-branch-cs-prefix-out-of-gcc.patch new file mode 100644 index 00000000000..f181ad39b56 --- /dev/null +++ b/queue-6.1/x86-build-move-mindirect-branch-cs-prefix-out-of-gcc.patch @@ -0,0 +1,47 @@ +From 16c08189f60712a186707f179681ef5c3c289f3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 09:58:27 -0700 +Subject: x86/build: Move '-mindirect-branch-cs-prefix' out of GCC-only block + +From: Nathan Chancellor + +[ Upstream commit 27b5de622ea3fe0ad5a31a0ebd9f7a0a276932d1 ] + +LLVM 16 will have support for this flag so move it out of the GCC-only +block to allow LLVM builds to take advantage of it. + +Signed-off-by: Nathan Chancellor +Signed-off-by: Ingo Molnar +Tested-by: Nick Desaulniers +Reviewed-by: Nick Desaulniers +Acked-by: Peter Zijlstra (Intel) +Link: https://github.com/ClangBuiltLinux/linux/issues/1665 +Link: https://github.com/llvm/llvm-project/commit/6f867f9102838ebe314c1f3661fdf95700386e5a +Link: https://lore.kernel.org/r/20230120165826.2469302-1-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/Makefile b/arch/x86/Makefile +index 415a5d138de4..3419ffa2a350 100644 +--- a/arch/x86/Makefile ++++ b/arch/x86/Makefile +@@ -14,13 +14,13 @@ endif + + ifdef CONFIG_CC_IS_GCC + RETPOLINE_CFLAGS := $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register) +-RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch-cs-prefix) + RETPOLINE_VDSO_CFLAGS := $(call cc-option,-mindirect-branch=thunk-inline -mindirect-branch-register) + endif + ifdef CONFIG_CC_IS_CLANG + RETPOLINE_CFLAGS := -mretpoline-external-thunk + RETPOLINE_VDSO_CFLAGS := -mretpoline + endif ++RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch-cs-prefix) + + ifdef CONFIG_RETHUNK + RETHUNK_CFLAGS := -mfunction-return=thunk-extern +-- +2.39.0 + diff --git a/queue-6.1/zcore-write-is-data-source-not-destination.patch b/queue-6.1/zcore-write-is-data-source-not-destination.patch new file mode 100644 index 00000000000..f67b56ed20c --- /dev/null +++ b/queue-6.1/zcore-write-is-data-source-not-destination.patch @@ -0,0 +1,32 @@ +From 85b467e742d1490e0a84a2bad5e67a0489893ea8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 19:02:47 -0400 +Subject: zcore: WRITE is "data source", not destination... + +From: Al Viro + +[ Upstream commit 4ba48e1bae5f68af24d8d71d4f28de9eb658af1d ] + +Signed-off-by: Al Viro +Stable-dep-of: 6dd88fd59da8 ("vhost-scsi: unbreak any layout for response") +Signed-off-by: Sasha Levin +--- + drivers/s390/char/zcore.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c +index 6165e6aae762..83ddac1e5838 100644 +--- a/drivers/s390/char/zcore.c ++++ b/drivers/s390/char/zcore.c +@@ -103,7 +103,7 @@ static inline int memcpy_hsa_kernel(void *dst, unsigned long src, size_t count) + + kvec.iov_base = dst; + kvec.iov_len = count; +- iov_iter_kvec(&iter, WRITE, &kvec, 1, count); ++ iov_iter_kvec(&iter, READ, &kvec, 1, count); + if (memcpy_hsa_iter(&iter, src, count) < count) + return -EIO; + return 0; +-- +2.39.0 +