From: Sasha Levin Date: Thu, 5 Aug 2021 01:38:17 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v4.4.279~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1a8947e5805743eb77ae3a4e6e797b006a845f82;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/asoc-tlv320aic31xx-fix-reversed-bclk-wclk-master-bit.patch b/queue-4.19/asoc-tlv320aic31xx-fix-reversed-bclk-wclk-master-bit.patch new file mode 100644 index 00000000000..b743799d177 --- /dev/null +++ b/queue-4.19/asoc-tlv320aic31xx-fix-reversed-bclk-wclk-master-bit.patch @@ -0,0 +1,49 @@ +From e6f37e51fa46414fdab45510650bb7c1632c67e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 21:09:41 -0400 +Subject: ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits + +From: Kyle Russell + +[ Upstream commit 9cf76a72af6ab81030dea6481b1d7bdd814fbdaf ] + +These are backwards from Table 7-71 of the TLV320AIC3100 spec [1]. + +This was broken in 12eb4d66ba2e when BCLK_MASTER and WCLK_MASTER +were converted from 0x08 and 0x04 to BIT(2) and BIT(3), respectively. + +-#define AIC31XX_BCLK_MASTER 0x08 +-#define AIC31XX_WCLK_MASTER 0x04 ++#define AIC31XX_BCLK_MASTER BIT(2) ++#define AIC31XX_WCLK_MASTER BIT(3) + +Probably just a typo since the defines were not listed in bit order. + +[1] https://www.ti.com/lit/gpn/tlv320aic3100 + +Signed-off-by: Kyle Russell +Link: https://lore.kernel.org/r/20210622010941.241386-1-bkylerussell@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320aic31xx.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tlv320aic31xx.h b/sound/soc/codecs/tlv320aic31xx.h +index 0b587585b38b..6071de5fca57 100644 +--- a/sound/soc/codecs/tlv320aic31xx.h ++++ b/sound/soc/codecs/tlv320aic31xx.h +@@ -147,8 +147,8 @@ struct aic31xx_pdata { + #define AIC31XX_WORD_LEN_24BITS 0x02 + #define AIC31XX_WORD_LEN_32BITS 0x03 + #define AIC31XX_IFACE1_MASTER_MASK GENMASK(3, 2) +-#define AIC31XX_BCLK_MASTER BIT(2) +-#define AIC31XX_WCLK_MASTER BIT(3) ++#define AIC31XX_BCLK_MASTER BIT(3) ++#define AIC31XX_WCLK_MASTER BIT(2) + + /* AIC31XX_DATA_OFFSET */ + #define AIC31XX_DATA_OFFSET_MASK GENMASK(7, 0) +-- +2.30.2 + diff --git a/queue-4.19/net-fix-zero-copy-head-len-calculation.patch b/queue-4.19/net-fix-zero-copy-head-len-calculation.patch new file mode 100644 index 00000000000..0e5ee783802 --- /dev/null +++ b/queue-4.19/net-fix-zero-copy-head-len-calculation.patch @@ -0,0 +1,79 @@ +From ef8188e688c20ac347b566428b8352abaead957e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 16:59:00 -0700 +Subject: net: Fix zero-copy head len calculation. + +From: Pravin B Shelar + +[ Upstream commit a17ad0961706244dce48ec941f7e476a38c0e727 ] + +In some cases skb head could be locked and entire header +data is pulled from skb. When skb_zerocopy() called in such cases, +following BUG is triggered. This patch fixes it by copying entire +skb in such cases. +This could be optimized incase this is performance bottleneck. + +---8<--- +kernel BUG at net/core/skbuff.c:2961! +invalid opcode: 0000 [#1] SMP PTI +CPU: 2 PID: 0 Comm: swapper/2 Tainted: G OE 5.4.0-77-generic #86-Ubuntu +Hardware name: OpenStack Foundation OpenStack Nova, BIOS 1.13.0-1ubuntu1.1 04/01/2014 +RIP: 0010:skb_zerocopy+0x37a/0x3a0 +RSP: 0018:ffffbcc70013ca38 EFLAGS: 00010246 +Call Trace: + + queue_userspace_packet+0x2af/0x5e0 [openvswitch] + ovs_dp_upcall+0x3d/0x60 [openvswitch] + ovs_dp_process_packet+0x125/0x150 [openvswitch] + ovs_vport_receive+0x77/0xd0 [openvswitch] + netdev_port_receive+0x87/0x130 [openvswitch] + netdev_frame_hook+0x4b/0x60 [openvswitch] + __netif_receive_skb_core+0x2b4/0xc90 + __netif_receive_skb_one_core+0x3f/0xa0 + __netif_receive_skb+0x18/0x60 + process_backlog+0xa9/0x160 + net_rx_action+0x142/0x390 + __do_softirq+0xe1/0x2d6 + irq_exit+0xae/0xb0 + do_IRQ+0x5a/0xf0 + common_interrupt+0xf/0xf + +Code that triggered BUG: +int +skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) +{ + int i, j = 0; + int plen = 0; /* length of skb->head fragment */ + int ret; + struct page *page; + unsigned int offset; + + BUG_ON(!from->head_frag && !hlen); + +Signed-off-by: Pravin B Shelar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/skbuff.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index ea9684bcc2e8..e1daab49b0eb 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2705,8 +2705,11 @@ skb_zerocopy_headlen(const struct sk_buff *from) + + if (!from->head_frag || + skb_headlen(from) < L1_CACHE_BYTES || +- skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) ++ skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) { + hlen = skb_headlen(from); ++ if (!hlen) ++ hlen = from->len; ++ } + + if (skb_has_frag_list(from)) + hlen = from->len; +-- +2.30.2 + diff --git a/queue-4.19/qed-fix-possible-unpaired-spin_-un-lock_bh-in-_qed_m.patch b/queue-4.19/qed-fix-possible-unpaired-spin_-un-lock_bh-in-_qed_m.patch new file mode 100644 index 00000000000..423c8812f5f --- /dev/null +++ b/queue-4.19/qed-fix-possible-unpaired-spin_-un-lock_bh-in-_qed_m.patch @@ -0,0 +1,114 @@ +From 0985e4661b8670a1daa4e752d54b484459173cb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 16:08:21 +0800 +Subject: qed: fix possible unpaired spin_{un}lock_bh in + _qed_mcp_cmd_and_union() + +From: Jia He + +[ Upstream commit 6206b7981a36476f4695d661ae139f7db36a802d ] + +Liajian reported a bug_on hit on a ThunderX2 arm64 server with FastLinQ +QL41000 ethernet controller: + BUG: scheduling while atomic: kworker/0:4/531/0x00000200 + [qed_probe:488()]hw prepare failed + kernel BUG at mm/vmalloc.c:2355! + Internal error: Oops - BUG: 0 [#1] SMP + CPU: 0 PID: 531 Comm: kworker/0:4 Tainted: G W 5.4.0-77-generic #86-Ubuntu + pstate: 00400009 (nzcv daif +PAN -UAO) + Call trace: + vunmap+0x4c/0x50 + iounmap+0x48/0x58 + qed_free_pci+0x60/0x80 [qed] + qed_probe+0x35c/0x688 [qed] + __qede_probe+0x88/0x5c8 [qede] + qede_probe+0x60/0xe0 [qede] + local_pci_probe+0x48/0xa0 + work_for_cpu_fn+0x24/0x38 + process_one_work+0x1d0/0x468 + worker_thread+0x238/0x4e0 + kthread+0xf0/0x118 + ret_from_fork+0x10/0x18 + +In this case, qed_hw_prepare() returns error due to hw/fw error, but in +theory work queue should be in process context instead of interrupt. + +The root cause might be the unpaired spin_{un}lock_bh() in +_qed_mcp_cmd_and_union(), which causes botton half is disabled incorrectly. + +Reported-by: Lijian Zhang +Signed-off-by: Jia He +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_mcp.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +index 938ace333af1..0d62db3241be 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +@@ -498,14 +498,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + + spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + +- if (!qed_mcp_has_pending_cmd(p_hwfn)) ++ if (!qed_mcp_has_pending_cmd(p_hwfn)) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; ++ } + + rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt); +- if (!rc) ++ if (!rc) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; +- else if (rc != -EAGAIN) ++ } else if (rc != -EAGAIN) { + goto err; ++ } + + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + +@@ -522,6 +526,8 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + return -EAGAIN; + } + ++ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); ++ + /* Send the mailbox command */ + qed_mcp_reread_offsets(p_hwfn, p_ptt); + seq_num = ++p_hwfn->mcp_info->drv_mb_seq; +@@ -548,14 +554,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + + spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + +- if (p_cmd_elem->b_is_completed) ++ if (p_cmd_elem->b_is_completed) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; ++ } + + rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt); +- if (!rc) ++ if (!rc) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; +- else if (rc != -EAGAIN) ++ } else if (rc != -EAGAIN) { + goto err; ++ } + + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + } while (++cnt < max_retries); +@@ -576,6 +586,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + return -EAGAIN; + } + ++ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem); + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + +-- +2.30.2 + diff --git a/queue-4.19/r8152-fix-potential-pm-refcount-imbalance.patch b/queue-4.19/r8152-fix-potential-pm-refcount-imbalance.patch new file mode 100644 index 00000000000..5841a587a2d --- /dev/null +++ b/queue-4.19/r8152-fix-potential-pm-refcount-imbalance.patch @@ -0,0 +1,40 @@ +From e5a1c1a912395068725a7bd3b8b3cee0ff721527 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jul 2021 19:00:21 +0200 +Subject: r8152: Fix potential PM refcount imbalance + +From: Takashi Iwai + +[ Upstream commit 9c23aa51477a37f8b56c3c40192248db0663c196 ] + +rtl8152_close() takes the refcount via usb_autopm_get_interface() but +it doesn't release when RTL8152_UNPLUG test hits. This may lead to +the imbalance of PM refcount. This patch addresses it. + +Link: https://bugzilla.suse.com/show_bug.cgi?id=1186194 +Signed-off-by: Takashi Iwai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 726fb5561a0f..4764e4f54cef 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -3960,9 +3960,10 @@ static int rtl8152_close(struct net_device *netdev) + tp->rtl_ops.down(tp); + + mutex_unlock(&tp->control); ++ } + ++ if (!res) + usb_autopm_put_interface(tp->intf); +- } + + free_all_mem(tp); + +-- +2.30.2 + diff --git a/queue-4.19/regulator-rt5033-fix-n_voltages-settings-for-buck-an.patch b/queue-4.19/regulator-rt5033-fix-n_voltages-settings-for-buck-an.patch new file mode 100644 index 00000000000..d73024d0638 --- /dev/null +++ b/queue-4.19/regulator-rt5033-fix-n_voltages-settings-for-buck-an.patch @@ -0,0 +1,48 @@ +From 07e6c23179181456626de690b860be7ed8936777 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Jun 2021 16:04:18 +0800 +Subject: regulator: rt5033: Fix n_voltages settings for BUCK and LDO + +From: Axel Lin + +[ Upstream commit 6549c46af8551b346bcc0b9043f93848319acd5c ] + +For linear regulators, the n_voltages should be (max - min) / step + 1. + +Buck voltage from 1v to 3V, per step 100mV, and vout mask is 0x1f. +If value is from 20 to 31, the voltage will all be fixed to 3V. +And LDO also, just vout range is different from 1.2v to 3v, step is the +same. If value is from 18 to 31, the voltage will also be fixed to 3v. + +Signed-off-by: Axel Lin +Reviewed-by: ChiYuan Huang +Link: https://lore.kernel.org/r/20210627080418.1718127-1-axel.lin@ingics.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/linux/mfd/rt5033-private.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/mfd/rt5033-private.h b/include/linux/mfd/rt5033-private.h +index 1b63fc2f42d1..52d53d134f72 100644 +--- a/include/linux/mfd/rt5033-private.h ++++ b/include/linux/mfd/rt5033-private.h +@@ -203,13 +203,13 @@ enum rt5033_reg { + #define RT5033_REGULATOR_BUCK_VOLTAGE_MIN 1000000U + #define RT5033_REGULATOR_BUCK_VOLTAGE_MAX 3000000U + #define RT5033_REGULATOR_BUCK_VOLTAGE_STEP 100000U +-#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 32 ++#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 21 + + /* RT5033 regulator LDO output voltage uV */ + #define RT5033_REGULATOR_LDO_VOLTAGE_MIN 1200000U + #define RT5033_REGULATOR_LDO_VOLTAGE_MAX 3000000U + #define RT5033_REGULATOR_LDO_VOLTAGE_STEP 100000U +-#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 32 ++#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 19 + + /* RT5033 regulator SAFE LDO output voltage uV */ + #define RT5033_REGULATOR_SAFE_LDO_VOLTAGE 4900000U +-- +2.30.2 + diff --git a/queue-4.19/series b/queue-4.19/series index 5373ff710bc..61597d72246 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -1 +1,6 @@ btrfs-mark-compressed-range-uptodate-only-if-all-bio.patch +regulator-rt5033-fix-n_voltages-settings-for-buck-an.patch +asoc-tlv320aic31xx-fix-reversed-bclk-wclk-master-bit.patch +r8152-fix-potential-pm-refcount-imbalance.patch +qed-fix-possible-unpaired-spin_-un-lock_bh-in-_qed_m.patch +net-fix-zero-copy-head-len-calculation.patch